diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000000..333d6134f2
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+.git
+.github
+.opencode
+node_modules
+**/node_modules
+tmp
+dist
+**/dist
+.env
+.env.*
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
new file mode 100644
index 0000000000..43b65d6d21
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -0,0 +1,65 @@
+name: Bug report
+description: Report a problem in OpenWork
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What's not working / wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: To Reproduce
+      description: "Minimal Steps to reproduce the issue:"
+      placeholder: |
+        1. Go to '...'
+        2. Click on '....'
+        3. Scroll down to '....'
+        4. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: A short description of what you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: A short description of what actually happened.
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots (optional)
+      description: If applicable, add screenshots or a video to help explain your problem.
+    validations:
+      required: false
+  - type: textarea
+    id: desktop_info
+    attributes:
+      label: OW version & Desktop info (optional) 
+      description: |
+        Include OS and OpenWork version if possible.
+        OpenWork version: Settings > General.
+      placeholder: |
+        - OpenWork version: [e.g. 0.1.166]
+        - OS: [e.g. macOS Tahoe 26.2]
+    validations:
+      required: false
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: Additional context (optional)
+      description: Add any other context about the problem here.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml
new file mode 100644
index 0000000000..fbbc6fce53
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature.yml
@@ -0,0 +1,68 @@
+name: Feature request
+description: Suggest an improvement or new capability
+title: "[Feature]: "
+labels:
+  - feature
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Short description of the request.
+      placeholder: Add ...
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / goal
+      description: What user outcome are you trying to achieve?
+    validations:
+      required: true
+  - type: checkboxes
+    id: users
+    attributes:
+      label: Primary user(s)
+      options:
+        - label: Bob (IT / power user)
+        - label: Susan (non-technical)
+        - label: Other team roles
+  - type: textarea
+    id: opencode_alignment
+    attributes:
+      label: OpenCode primitive alignment
+      description: Is there an existing OpenCode primitive or API that covers this? If not, why is a thin OpenWork layer still needed?
+      placeholder: session.*, permission.*, skills/plugins, mcp...
+    validations:
+      required: true
+  - type: textarea
+    id: doc_alignment
+    attributes:
+      label: Alignment with VISION/PRINCIPLES/PRODUCT
+      description: How does this align with `VISION.md`, `PRINCIPLES.md`, and `PRODUCT.md`?
+    validations:
+      required: true
+  - type: textarea
+    id: testability
+    attributes:
+      label: Testability
+      description: How can we test this? (manual steps, tooling, screenshots)
+      placeholder: pnpm dev + chrome mcp + screenshots
+    validations:
+      required: true
+  - type: dropdown
+    id: ready_to_build
+    attributes:
+      label: Ready to build it yourself?
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Links, mockups, or related issues.
+    validations:
+      required: false
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000000..fbf625b38a
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,41 @@
+## Summary
+-
+
+## Why
+-
+
+## Issue
+- Closes #
+
+## Scope
+-
+
+## Out of scope
+-
+
+## Testing
+### Ran
+- `...`
+
+### Result
+- pass/fail:
+- if fail, exact files/errors:
+
+## CI status
+- pass:
+- code-related failures:
+- external/env/auth blockers:
+
+## Manual verification
+1.
+2.
+3.
+
+## Evidence
+- video/screenshot link, or `N/A (docs-only)`
+
+## Risk
+-
+
+## Rollback
+-
diff --git a/.github/workflows/alpha-macos-aarch64.yml b/.github/workflows/alpha-macos-aarch64.yml
new file mode 100644
index 0000000000..5405eff284
--- /dev/null
+++ b/.github/workflows/alpha-macos-aarch64.yml
@@ -0,0 +1,247 @@
+name: Alpha Channel (macOS arm64)
+
+# Every merge to `dev` publishes a fresh macOS arm64 build to the OpenWork
+# alpha release channel.
+#
+# The alpha channel is macOS-only today. It lives as a rolling GitHub
+# release. Each run also updates a small manifest on the fixed
+# `alpha-macos-latest` release so the Electron updater feed stays stable while
+# historical alpha artifacts remain available.
+#
+# See:
+#   - ARCHITECTURE.md#release-channels
+#   - .github/workflows/release-macos-aarch64.yml (stable channel)
+
+on:
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: alpha-macos-aarch64-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish-alpha-macos-aarch64:
+    name: Build + Publish alpha (aarch64-apple-darwin)
+    runs-on: macos-14
+    timeout-minutes: 180
+
+    env:
+      ALPHA_RELEASE_TAG: alpha-macos-latest
+      ALPHA_RELEASE_NAME: OpenWork Alpha (macOS arm64)
+      # Apple signing + notarization are required so alpha bundles install
+      # and launch without Gatekeeper friction. Alpha builds are served
+      # from GitHub Releases like stable, just from a different tag.
+      MACOS_NOTARIZE: ${{ vars.MACOS_NOTARIZE || 'true' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: macos-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            macos-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Resolve alpha version
+        id: alpha-version
+        shell: bash
+        env:
+          GITHUB_RUN_NUMBER: ${{ github.run_number }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node <<'NODE' >> "$GITHUB_OUTPUT"
+          const fs = require("node:fs");
+          const path = "apps/desktop/package.json";
+          const raw = JSON.parse(fs.readFileSync(path, "utf8"));
+          const current = String(raw.version || "").trim();
+          const match = current.match(/^(\d+)\.(\d+)\.(\d+)(?:-.+)?$/);
+          if (!match) {
+            throw new Error(`Unsupported version in ${path}: ${current}`);
+          }
+          const [, major, minor, patch] = match;
+          // Alpha builds advertise the *next* patch version so semver
+          // comparison makes the alpha newer than the current stable
+          // (e.g. stable 0.11.207 < alpha 0.11.208-alpha.<run>). Once
+          // stable 0.11.208 ships, its semver beats the alpha prerelease
+          // tag and alpha users cleanly migrate forward.
+          const nextPatch = Number(patch) + 1;
+          const run = process.env.GITHUB_RUN_NUMBER || "0";
+          const sha = (process.env.GITHUB_SHA || "").slice(0, 7) || "local";
+          const alpha = `${major}.${minor}.${nextPatch}-alpha.${run}+${sha}`;
+          const releaseTag = `alpha-macos-v${major}.${minor}.${nextPatch}-alpha.${run}-${sha}`;
+          console.log(`alpha_version=${alpha}`);
+          console.log(`base_version=${major}.${minor}.${nextPatch}`);
+          console.log(`release_tag=${releaseTag}`);
+          NODE
+
+      - name: Write alpha Electron package version
+        shell: bash
+        env:
+          ALPHA_VERSION: ${{ steps.alpha-version.outputs.alpha_version }}
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const fs = require("node:fs");
+          for (const path of ["apps/desktop/package.json", "apps/app/package.json"]) {
+            const json = JSON.parse(fs.readFileSync(path, "utf8"));
+            json.version = process.env.ALPHA_VERSION;
+            fs.writeFileSync(path, `${JSON.stringify(json, null, 2)}\n`);
+          }
+          NODE
+
+      - name: Write notary API key
+        if: env.MACOS_NOTARIZE == 'true'
+        env:
+          APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
+        run: |
+          set -euo pipefail
+
+          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
+          printf '%s' "$APPLE_NOTARY_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
+          chmod 600 "$NOTARY_KEY_PATH"
+
+          echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
+
+      - name: Reject unsigned Electron alpha release
+        if: env.MACOS_NOTARIZE != 'true'
+        shell: bash
+        run: |
+          echo "Electron alpha artifacts must be signed and notarized. Set MACOS_NOTARIZE=true and provide Apple signing secrets." >&2
+          exit 1
+
+      - name: Build Electron alpha app
+        if: env.MACOS_NOTARIZE == 'true'
+        shell: bash
+        env:
+          TARGET: aarch64-apple-darwin
+        run: pnpm --filter @openwork/desktop build:electron
+
+      - name: Package Electron alpha (macOS, signed + notarized)
+        if: env.MACOS_NOTARIZE == 'true'
+        env:
+          CSC_LINK: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          CSC_KEY_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+          MACOS_NOTARIZE: true
+          APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
+        run: |
+          set -euo pipefail
+          pnpm --dir apps/desktop exec electron-builder \
+            --config electron-builder.yml \
+            --mac \
+            --arm64 \
+            --publish never
+
+      - name: Create immutable alpha prerelease
+        if: env.MACOS_NOTARIZE == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ALPHA_VERSION: ${{ steps.alpha-version.outputs.alpha_version }}
+          ALPHA_RUN_RELEASE_TAG: ${{ steps.alpha-version.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+          body="Rolling alpha build for OpenWork (macOS arm64) from ${GITHUB_SHA}."
+          if gh release view "$ALPHA_RUN_RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Alpha prerelease $ALPHA_RUN_RELEASE_TAG already exists; reusing it."
+            exit 0
+          fi
+          gh release create "$ALPHA_RUN_RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "OpenWork Alpha ${ALPHA_VERSION}" \
+            --notes "$body" \
+            --target "$GITHUB_SHA" \
+            --prerelease
+
+      - name: Upload Electron alpha updater assets
+        if: env.MACOS_NOTARIZE == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ALPHA_RUN_RELEASE_TAG: ${{ steps.alpha-version.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          assets=(
+            apps/desktop/dist-electron/*.dmg
+            apps/desktop/dist-electron/*.zip
+            apps/desktop/dist-electron/*.blockmap
+            apps/desktop/dist-electron/latest-mac.yml
+          )
+          if [ ${#assets[@]} -eq 0 ]; then
+            echo "No Electron alpha assets found in apps/desktop/dist-electron" >&2
+            exit 1
+          fi
+          gh release upload "$ALPHA_RUN_RELEASE_TAG" "${assets[@]}" \
+            --repo "$GITHUB_REPOSITORY" \
+            --clobber
+
+      - name: Update alpha updater pointer
+        if: env.MACOS_NOTARIZE == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ALPHA_RUN_RELEASE_TAG: ${{ steps.alpha-version.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+          POINTER_MANIFEST="$RUNNER_TEMP/latest-mac.yml"
+          export POINTER_MANIFEST
+          node <<'NODE'
+          const fs = require("node:fs");
+          const manifestPath = "apps/desktop/dist-electron/latest-mac.yml";
+          const releaseTag = process.env.ALPHA_RUN_RELEASE_TAG;
+          const baseUrl = `https://github.com/different-ai/openwork/releases/download/${releaseTag}`;
+          const rewritten = fs.readFileSync(manifestPath, "utf8")
+            .replace(/(url:\s*)(openwork-[^\n]+)/g, `$1${baseUrl}/$2`)
+            .replace(/(path:\s*)(openwork-[^\n]+)/g, `$1${baseUrl}/$2`);
+          fs.writeFileSync(process.env.POINTER_MANIFEST, rewritten);
+          NODE
+
+          if ! gh release view "$ALPHA_RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$ALPHA_RELEASE_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$ALPHA_RELEASE_NAME" \
+              --notes "Stable Electron updater pointer for the newest macOS arm64 alpha prerelease." \
+              --target "$GITHUB_SHA" \
+              --prerelease
+          fi
+
+          gh release upload "$ALPHA_RELEASE_TAG" "$POINTER_MANIFEST#latest-mac.yml" \
+            --repo "$GITHUB_REPOSITORY" \
+            --clobber
diff --git a/.github/workflows/aur-validate.yml b/.github/workflows/aur-validate.yml
new file mode 100644
index 0000000000..d61c8e1158
--- /dev/null
+++ b/.github/workflows/aur-validate.yml
@@ -0,0 +1,457 @@
+name: AUR Validate
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Git ref to validate (branch, SHA, or tag)"
+        required: false
+        type: string
+        default: dev
+      version:
+        description: "Package version override (e.g., 0.11.160)"
+        required: false
+        type: string
+      arch:
+        description: "Target architecture"
+        required: false
+        type: choice
+        options:
+          - x86_64
+        default: x86_64
+      mode:
+        description: "Validation mode"
+        required: false
+        type: choice
+        options:
+          - smoke
+          - publish-ready
+        default: smoke
+      artifact_source:
+        description: "Where to source desktop .deb"
+        required: false
+        type: choice
+        options:
+          - local-build-artifact
+          - release
+        default: local-build-artifact
+      release_tag:
+        description: "Release tag when artifact_source=release (e.g., v0.11.160)"
+        required: false
+        type: string
+      artifact_run_id:
+        description: "Workflow run ID to download artifact from when artifact_source=local-build-artifact"
+        required: false
+        type: string
+      artifact_name:
+        description: "Artifact name in artifact_run_id"
+        required: false
+        type: string
+        default: openwork-desktop-linux-amd64-deb
+      asset_url_x86_64:
+        description: "Optional explicit public URL for x86_64 .deb"
+        required: false
+        type: string
+      push_to_aur:
+        description: "Push validated PKGBUILD/.SRCINFO to AUR"
+        required: false
+        type: boolean
+        default: false
+      aur_repo:
+        description: "AUR repo name"
+        required: false
+        type: string
+        default: openwork
+
+  workflow_call:
+    inputs:
+      ref:
+        required: false
+        type: string
+        default: dev
+      version:
+        required: false
+        type: string
+      arch:
+        required: false
+        type: string
+        default: x86_64
+      mode:
+        required: false
+        type: string
+        default: smoke
+      artifact_source:
+        required: false
+        type: string
+        default: local-build-artifact
+      release_tag:
+        required: false
+        type: string
+      artifact_run_id:
+        required: false
+        type: string
+      artifact_name:
+        required: false
+        type: string
+        default: openwork-desktop-linux-amd64-deb
+      asset_url_x86_64:
+        required: false
+        type: string
+      push_to_aur:
+        required: false
+        type: boolean
+        default: false
+      aur_repo:
+        required: false
+        type: string
+        default: openwork
+    secrets:
+      AUR_SSH_PRIVATE_KEY:
+        required: false
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: aur-validate-${{ github.workflow }}-${{ inputs.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  aur-validate:
+    name: Validate AUR package (${{ inputs.arch }}, ${{ inputs.mode }})
+    runs-on: ubuntu-22.04
+    container:
+      image: archlinux:latest
+    env:
+      TARGET_ARCH: ${{ inputs.arch || 'x86_64' }}
+      MODE: ${{ inputs.mode || 'smoke' }}
+      ARTIFACT_SOURCE: ${{ inputs.artifact_source || 'local-build-artifact' }}
+      INPUT_VERSION: ${{ inputs.version }}
+      INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
+      INPUT_ASSET_URL_X86_64: ${{ inputs.asset_url_x86_64 }}
+      INPUT_ARTIFACT_RUN_ID: ${{ inputs.artifact_run_id }}
+      INPUT_ARTIFACT_NAME: ${{ inputs.artifact_name || 'openwork-desktop-linux-amd64-deb' }}
+      PUSH_TO_AUR: ${{ inputs.push_to_aur && 'true' || 'false' }}
+      AUR_REPO: ${{ inputs.aur_repo || 'openwork' }}
+    steps:
+      - name: Validate workflow inputs
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ "${TARGET_ARCH}" != "x86_64" ]; then
+            echo "Only x86_64 is currently supported." >&2
+            exit 1
+          fi
+
+          if [ "${MODE}" != "smoke" ] && [ "${MODE}" != "publish-ready" ]; then
+            echo "mode must be smoke or publish-ready" >&2
+            exit 1
+          fi
+
+          if [ "${ARTIFACT_SOURCE}" != "local-build-artifact" ] && [ "${ARTIFACT_SOURCE}" != "release" ]; then
+            echo "artifact_source must be local-build-artifact or release" >&2
+            exit 1
+          fi
+
+          if [ "${ARTIFACT_SOURCE}" = "local-build-artifact" ] && [ -z "${INPUT_ASSET_URL_X86_64:-}" ] && [ -z "${INPUT_ARTIFACT_RUN_ID:-}" ]; then
+            echo "artifact_run_id is required when artifact_source=local-build-artifact and asset_url_x86_64 is empty" >&2
+            exit 1
+          fi
+
+          if [ "${PUSH_TO_AUR}" = "true" ] && [ "${ARTIFACT_SOURCE}" = "local-build-artifact" ] && [ -z "${INPUT_ASSET_URL_X86_64:-}" ]; then
+            echo "For push_to_aur with local-build-artifact, set asset_url_x86_64 to a public URL (or use artifact_source=release)." >&2
+            exit 1
+          fi
+
+      - name: Install Arch packaging dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm --needed \
+            base-devel \
+            curl \
+            git \
+            jq \
+            namcap \
+            openssh \
+            python \
+            sudo \
+            xorg-server-xvfb
+
+      - name: Checkout target ref
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref_name }}
+          fetch-depth: 0
+
+      - name: Create non-root makepkg user
+        shell: bash
+        run: |
+          set -euo pipefail
+          useradd -m -s /bin/bash builder
+          echo "builder ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/builder
+          chmod 0440 /etc/sudoers.d/builder
+          chown -R builder:builder "$GITHUB_WORKSPACE"
+
+      - name: Download release asset (.deb)
+        if: env.ARTIFACT_SOURCE == 'release'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          release_tag="${INPUT_RELEASE_TAG:-}"
+          if [ -z "$release_tag" ] && [ -n "${INPUT_VERSION:-}" ]; then
+            release_tag="v${INPUT_VERSION}"
+          fi
+
+          if [ -z "$release_tag" ]; then
+            echo "release_tag or version is required when artifact_source=release" >&2
+            exit 1
+          fi
+
+          case "$release_tag" in
+            v*) ;;
+            *) release_tag="v${release_tag}" ;;
+          esac
+
+          asset_url="${INPUT_ASSET_URL_X86_64:-}"
+          if [ -z "$asset_url" ]; then
+            asset_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${release_tag}/openwork-desktop-linux-amd64.deb"
+          fi
+
+          mkdir -p /tmp/aur-artifacts
+          curl -fL --retry 5 --retry-all-errors --retry-delay 2 "$asset_url" -o /tmp/aur-artifacts/openwork-desktop-linux-amd64.deb
+
+          echo "RESOLVED_RELEASE_TAG=${release_tag}" >> "$GITHUB_ENV"
+          echo "RESOLVED_ASSET_URL_X86_64=${asset_url}" >> "$GITHUB_ENV"
+
+      - name: Download local workflow artifact
+        if: env.ARTIFACT_SOURCE == 'local-build-artifact' && env.INPUT_ASSET_URL_X86_64 == ''
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ inputs.artifact_name || 'openwork-desktop-linux-amd64-deb' }}
+          run-id: ${{ inputs.artifact_run_id }}
+          github-token: ${{ github.token }}
+          path: /tmp/aur-artifacts
+
+      - name: Download x86_64 asset URL override
+        if: env.ARTIFACT_SOURCE == 'local-build-artifact' && env.INPUT_ASSET_URL_X86_64 != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/aur-artifacts
+          curl -fL --retry 5 --retry-all-errors --retry-delay 2 "${INPUT_ASSET_URL_X86_64}" -o /tmp/aur-artifacts/openwork-desktop-linux-amd64.deb
+
+      - name: Resolve local artifact path
+        if: env.ARTIFACT_SOURCE == 'local-build-artifact'
+        shell: bash
+        run: |
+          set -euo pipefail
+          deb_path=$(find /tmp/aur-artifacts -maxdepth 3 -type f -name '*.deb' | head -n 1)
+          if [ -z "${deb_path:-}" ]; then
+            echo "No .deb file found in /tmp/aur-artifacts" >&2
+            exit 1
+          fi
+
+          if [ "$deb_path" != "/tmp/aur-artifacts/openwork-desktop-linux-amd64.deb" ]; then
+            cp "$deb_path" /tmp/aur-artifacts/openwork-desktop-linux-amd64.deb
+          fi
+
+      - name: Resolve version, URL, and checksum
+        id: resolve
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          deb_path="/tmp/aur-artifacts/openwork-desktop-linux-amd64.deb"
+          if [ ! -f "$deb_path" ]; then
+            echo "Expected $deb_path to exist" >&2
+            exit 1
+          fi
+
+          version="${INPUT_VERSION:-}"
+          if [ -z "$version" ] && [ -n "${RESOLVED_RELEASE_TAG:-}" ]; then
+            version="${RESOLVED_RELEASE_TAG#v}"
+          fi
+          if [ -z "$version" ]; then
+            version="$(awk -F= '$1 == "pkgver" {print $2; exit}' packaging/aur/PKGBUILD)"
+          fi
+
+          if [ -z "$version" ]; then
+            echo "Unable to determine version. Pass inputs.version." >&2
+            exit 1
+          fi
+
+          sha256="$(sha256sum "$deb_path" | awk '{print $1}')"
+
+          source_url="${RESOLVED_ASSET_URL_X86_64:-}"
+          if [ -z "$source_url" ] && [ -n "${INPUT_ASSET_URL_X86_64:-}" ]; then
+            source_url="${INPUT_ASSET_URL_X86_64}"
+          fi
+          if [ -z "$source_url" ]; then
+            source_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/v${version}/openwork-desktop-linux-amd64.deb"
+          fi
+
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "sha256=${sha256}" >> "$GITHUB_OUTPUT"
+          echo "source_url=${source_url}" >> "$GITHUB_OUTPUT"
+
+      - name: Patch PKGBUILD for x86_64 validation
+        shell: bash
+        env:
+          RESOLVED_VERSION: ${{ steps.resolve.outputs.version }}
+          RESOLVED_SHA256: ${{ steps.resolve.outputs.sha256 }}
+          RESOLVED_SOURCE_URL: ${{ steps.resolve.outputs.source_url }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import pathlib
+          import re
+          import os
+
+          path = pathlib.Path("packaging/aur/PKGBUILD")
+          text = path.read_text()
+
+          version = os.environ["RESOLVED_VERSION"]
+          sha256 = os.environ["RESOLVED_SHA256"]
+          source_url = os.environ["RESOLVED_SOURCE_URL"]
+
+          text = re.sub(r"^pkgver=.*$", f"pkgver={version}", text, flags=re.M)
+          text = re.sub(r"^pkgrel=.*$", "pkgrel=1", text, flags=re.M)
+          text = re.sub(r"^arch=.*$", "arch=('x86_64')", text, flags=re.M)
+          text = re.sub(
+              r"^source_x86_64=.*$",
+              "source_x86_64=(\"${pkgname}-${pkgver}.deb::" + source_url + "\")",
+              text,
+              flags=re.M,
+          )
+          text = re.sub(
+              r"^sha256sums_x86_64=.*$",
+              f"sha256sums_x86_64=('{sha256}')",
+              text,
+              flags=re.M,
+          )
+          text = re.sub(r"^source_aarch64=.*\n?", "", text, flags=re.M)
+          text = re.sub(r"^sha256sums_aarch64=.*\n?", "", text, flags=re.M)
+
+          path.write_text(text)
+          PY
+
+      - name: Regenerate .SRCINFO
+        shell: bash
+        run: |
+          set -euo pipefail
+          workspace_path="$GITHUB_WORKSPACE"
+          sudo -u builder bash -lc "cd '$workspace_path/packaging/aur' && makepkg --printsrcinfo > .SRCINFO"
+
+      - name: Build package with makepkg
+        shell: bash
+        run: |
+          set -euo pipefail
+          workspace_path="$GITHUB_WORKSPACE"
+          sudo -u builder bash -lc "cd '$workspace_path/packaging/aur' && makepkg -f --syncdeps --noconfirm --cleanbuild"
+
+      - name: Run namcap checks
+        if: env.MODE == 'publish-ready'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd packaging/aur
+          namcap PKGBUILD || true
+          pkg_file=$(ls -1 openwork-*.pkg.tar.* | head -n 1)
+          namcap "$pkg_file" || true
+
+      - name: Install built package
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd packaging/aur
+          pkg_file=$(ls -1 openwork-*.pkg.tar.* | head -n 1)
+          pacman -U --noconfirm "$pkg_file"
+
+      - name: Smoke launch
+        shell: bash
+        run: |
+          set -euo pipefail
+          pacman -Ql openwork > /tmp/openwork-installed-files.txt
+
+          if [ ! -s /tmp/openwork-installed-files.txt ]; then
+            echo "openwork package install listing is empty" >&2
+            exit 1
+          fi
+
+          launch_bin=""
+          for candidate in \
+            "$(command -v openwork 2>/dev/null || true)" \
+            /usr/bin/openwork \
+            /opt/openwork/openwork \
+            /opt/openwork/openwork-desktop \
+            /opt/openwork/opencode
+          do
+            if [ -n "$candidate" ] && [ -x "$candidate" ]; then
+              launch_bin="$candidate"
+              break
+            fi
+          done
+
+          if [ -n "$launch_bin" ]; then
+            xvfb-run -a bash -lc '"$1" --help >/tmp/openwork-help.txt 2>&1 || "$1" --version >/tmp/openwork-version.txt 2>&1 || true' -- "$launch_bin"
+          else
+            echo "No runnable desktop binary found; install sanity check passed." 
+          fi
+
+      - name: Publish to AUR
+        if: env.PUSH_TO_AUR == 'true'
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          RELEASE_TAG: v${{ steps.resolve.outputs.version }}
+          AUR_SKIP_UPDATE: "1"
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ -z "${AUR_SSH_PRIVATE_KEY:-}" ]; then
+            echo "AUR_SSH_PRIVATE_KEY not set; cannot push to AUR." >&2
+            exit 1
+          fi
+
+          mkdir -p "$HOME/.ssh"
+          touch "$HOME/.ssh/known_hosts"
+          ssh-keygen -R aur.archlinux.org >/dev/null 2>&1 || true
+          ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> "$HOME/.ssh/known_hosts" 2>/dev/null
+
+          tmp_dir="$(mktemp -d)"
+          trap 'rm -rf "$tmp_dir"' EXIT
+
+          key_path="$tmp_dir/aur.key"
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$key_path"
+          chmod 600 "$key_path"
+
+          aur_remote="ssh://aur@aur.archlinux.org/${AUR_REPO}.git"
+          export GIT_SSH_COMMAND="ssh -i $key_path -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
+
+          git clone "$aur_remote" "$tmp_dir/aur"
+          cp packaging/aur/PKGBUILD "$tmp_dir/aur/PKGBUILD"
+          cp packaging/aur/.SRCINFO "$tmp_dir/aur/.SRCINFO"
+
+          cd "$tmp_dir/aur"
+          if git diff --quiet -- PKGBUILD .SRCINFO; then
+            echo "AUR already up to date for ${AUR_REPO}."
+            exit 0
+          fi
+
+          git add PKGBUILD .SRCINFO
+          git -c user.name="OpenWork Release Bot" \
+              -c user.email="release-bot@users.noreply.github.com" \
+              commit -m "chore(aur): update PKGBUILD for ${RELEASE_TAG#v}"
+
+          current_branch="$(git symbolic-ref --short HEAD 2>/dev/null || true)"
+          if [ -z "$current_branch" ]; then
+            current_branch="master"
+          fi
+
+          git push origin "HEAD:${current_branch}"
diff --git a/.github/workflows/build-electron-desktop.yml b/.github/workflows/build-electron-desktop.yml
new file mode 100644
index 0000000000..9f4364baba
--- /dev/null
+++ b/.github/workflows/build-electron-desktop.yml
@@ -0,0 +1,114 @@
+name: Build Electron Desktop
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - electron-notary-test
+    paths:
+      - apps/app/**
+      - apps/desktop/**
+      - packages/ui/**
+      - constants.json
+      - pnpm-lock.yaml
+      - package.json
+      - .github/workflows/build-electron-desktop.yml
+
+jobs:
+  build-electron:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            artifact: macos
+          - os: ubuntu-latest
+            artifact: linux
+          - os: windows-latest
+            artifact: windows
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # pnpm must be installed BEFORE setup-node so setup-node can find the
+      # pnpm binary on PATH. Matches the pattern in build-desktop.yml so
+      # the two workflows share the same bootstrap story.
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Package Electron desktop (unpacked)
+        run: pnpm --filter @openwork/desktop package:electron:dir
+
+      - name: Upload Electron artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: openwork-electron-${{ matrix.artifact }}
+          path: apps/desktop/dist-electron/**
+
+  electron-macos-notarization-smoke:
+    name: Electron macOS notarization smoke
+    runs-on: macos-14
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Write notary API key
+        env:
+          APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
+        run: |
+          set -euo pipefail
+
+          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
+          printf '%s' "$APPLE_NOTARY_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
+          chmod 600 "$NOTARY_KEY_PATH"
+
+          echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
+
+      - name: Package Electron desktop (signed + notarized, no publish)
+        env:
+          CSC_LINK: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          CSC_KEY_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+          MACOS_NOTARIZE: true
+          APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
+        run: |
+          set -euo pipefail
+          pnpm --filter @openwork/desktop run build:electron
+          pnpm --dir apps/desktop exec electron-builder --config electron-builder.yml --mac dmg zip --publish never
diff --git a/.github/workflows/ci-i18n.yml b/.github/workflows/ci-i18n.yml
new file mode 100644
index 0000000000..3a4eb10a41
--- /dev/null
+++ b/.github/workflows/ci-i18n.yml
@@ -0,0 +1,28 @@
+name: i18n Audit
+
+on:
+  pull_request:
+    branches:
+      - dev
+  push:
+    branches:
+      - dev
+
+permissions:
+  contents: read
+
+jobs:
+  i18n-audit:
+    runs-on: blacksmith-4vcpu-ubuntu-2204
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Run i18n audit
+        run: node scripts/i18n-audit.mjs --ci
diff --git a/.github/workflows/ci-openwork-ui-mcp.yml b/.github/workflows/ci-openwork-ui-mcp.yml
new file mode 100644
index 0000000000..739bd8bf1b
--- /dev/null
+++ b/.github/workflows/ci-openwork-ui-mcp.yml
@@ -0,0 +1,77 @@
+name: openwork-ui-mcp
+
+on:
+  push:
+    branches: [dev]
+    paths:
+      - "packages/openwork-ui-mcp/**"
+      - ".github/workflows/ci-openwork-ui-mcp.yml"
+    tags:
+      - "openwork-ui-mcp-v*"
+  pull_request:
+    branches: [dev]
+    paths:
+      - "packages/openwork-ui-mcp/**"
+      - ".github/workflows/ci-openwork-ui-mcp.yml"
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: packages/openwork-ui-mcp
+
+jobs:
+  check:
+    name: Syntax & dry-run publish
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Syntax check
+        run: node --check index.mjs
+
+      - name: Dry-run publish
+        run: npm publish --dry-run --access public
+
+  publish:
+    name: Publish to npm
+    needs: check
+    if: startsWith(github.ref, 'refs/tags/openwork-ui-mcp-v')
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Syntax check
+        run: node --check index.mjs
+
+      - name: Publish
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
new file mode 100644
index 0000000000..e7d4ae15df
--- /dev/null
+++ b/.github/workflows/ci-tests.yml
@@ -0,0 +1,118 @@
+name: OpenWork Tests
+
+on:
+  pull_request:
+    branches:
+      - dev
+  push:
+    branches:
+      - dev
+
+permissions:
+  contents: read
+
+jobs:
+  openwork-tests:
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [blacksmith-4vcpu-ubuntu-2204, macos-14]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Install OpenCode CLI
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
+        run: |
+          set -euo pipefail
+
+          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
+          version="$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")"
+          version="$(echo "$version" | tr -d '\r\n' | sed 's/^v//')"
+
+          if [ -z "$version" ]; then
+            echo "Unable to resolve OpenCode version from constants.json." >&2
+            exit 1
+          fi
+
+          arch="$(uname -m)"
+          case "${RUNNER_OS}" in
+            Linux)
+              if [ "$arch" = "aarch64" ] || [ "$arch" = "arm64" ]; then
+                opencode_asset="opencode-linux-arm64.tar.gz"
+              else
+                opencode_asset="opencode-linux-x64-baseline.tar.gz"
+              fi
+              ;;
+            macOS)
+              if [ "$arch" = "arm64" ]; then
+                opencode_asset="opencode-darwin-arm64.zip"
+              else
+                opencode_asset="opencode-darwin-x64-baseline.zip"
+              fi
+              ;;
+            *)
+              echo "Unsupported OS: ${RUNNER_OS}" >&2
+              exit 1
+              ;;
+          esac
+
+          url="https://github.com/${repo}/releases/download/v${version}/${opencode_asset}"
+          tmp_dir="$RUNNER_TEMP/opencode"
+          extract_dir="$tmp_dir/extracted"
+          rm -rf "$tmp_dir"
+          mkdir -p "$extract_dir"
+
+          curl_headers=()
+          if [ -n "${GITHUB_TOKEN:-}" ]; then
+            curl_headers+=( -H "Authorization: Bearer ${GITHUB_TOKEN}" )
+          fi
+
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 "${curl_headers[@]}" -o "$tmp_dir/$opencode_asset" "$url"
+
+          if [[ "$opencode_asset" == *.tar.gz ]]; then
+            tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"
+          else
+            unzip -q "$tmp_dir/$opencode_asset" -d "$extract_dir"
+          fi
+
+          if [ -f "$extract_dir/opencode" ]; then
+            bin_path="$extract_dir/opencode"
+          elif [ -f "$extract_dir/opencode.exe" ]; then
+            bin_path="$extract_dir/opencode.exe"
+          else
+            echo "OpenCode binary not found in archive" >&2
+            ls -la "$extract_dir"
+            exit 1
+          fi
+
+          install_dir="$HOME/.opencode/bin"
+          mkdir -p "$install_dir"
+          cp "$bin_path" "$install_dir/opencode"
+          chmod 755 "$install_dir/opencode"
+          echo "$install_dir" >> "$GITHUB_PATH"
+
+      - name: Verify OpenCode
+        run: opencode --version
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run e2e tests
+        run: pnpm --filter @openwork/app test:e2e
diff --git a/.github/workflows/deploy-den.yml b/.github/workflows/deploy-den.yml
new file mode 100644
index 0000000000..4ed04072bd
--- /dev/null
+++ b/.github/workflows/deploy-den.yml
@@ -0,0 +1,99 @@
+name: Deploy Den
+
+on:
+  workflow_call:
+    inputs:
+      daytona_snapshot:
+        description: "Daytona snapshot name to promote into Render"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      daytona_snapshot:
+        description: "Daytona snapshot name to promote into Render"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-den-${{ inputs.daytona_snapshot }}
+  cancel-in-progress: false
+
+jobs:
+  deploy-den:
+    name: Update Render Daytona Snapshot
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RENDER_API_BASE: https://api.render.com/v1
+      RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+      RENDER_SERVICE_ID: ${{ secrets.RENDER_DEN_CONTROL_PLANE_SERVICE_ID }}
+      DAYTONA_SNAPSHOT: ${{ inputs.daytona_snapshot }}
+    steps:
+      - name: Validate required configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_SNAPSHOT:-}" ]; then
+            echo "daytona_snapshot input is required" >&2
+            exit 1
+          fi
+
+          if [ -z "${RENDER_API_KEY:-}" ]; then
+            echo "Missing required secret: RENDER_API_KEY" >&2
+            exit 1
+          fi
+
+          if [ -z "${RENDER_SERVICE_ID:-}" ]; then
+            echo "Missing required secret: RENDER_DEN_CONTROL_PLANE_SERVICE_ID" >&2
+            exit 1
+          fi
+
+      - name: Update DAYTONA_SNAPSHOT on Render
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          payload="$(python3 -c 'import json, sys; print(json.dumps({"value": sys.argv[1]}))' "$DAYTONA_SNAPSHOT")"
+          response_file="$(mktemp)"
+          status_code="$(curl -sS -o "$response_file" -w "%{http_code}" \
+            -X PUT "${RENDER_API_BASE}/services/${RENDER_SERVICE_ID}/env-vars/DAYTONA_SNAPSHOT" \
+            -H "Accept: application/json" \
+            -H "Authorization: Bearer ${RENDER_API_KEY}" \
+            -H "Content-Type: application/json" \
+            --data "$payload")"
+
+          if [ "$status_code" -lt 200 ] || [ "$status_code" -ge 300 ]; then
+            echo "Failed to update Render DAYTONA_SNAPSHOT (HTTP $status_code)" >&2
+            python3 -c 'from pathlib import Path; import sys; print(Path(sys.argv[1]).read_text(errors="replace"))' "$response_file"
+            exit 1
+          fi
+
+          echo "Render DAYTONA_SNAPSHOT set to ${DAYTONA_SNAPSHOT}"
+
+      - name: Trigger Render deploy
+        id: deploy
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          response_file="$(mktemp)"
+          status_code="$(curl -sS -o "$response_file" -w "%{http_code}" \
+            -X POST "${RENDER_API_BASE}/services/${RENDER_SERVICE_ID}/deploys" \
+            -H "Accept: application/json" \
+            -H "Authorization: Bearer ${RENDER_API_KEY}" \
+            -H "Content-Type: application/json" \
+            --data '{}')"
+
+          if [ "$status_code" -lt 200 ] || [ "$status_code" -ge 300 ]; then
+            echo "Failed to trigger Render deploy (HTTP $status_code)" >&2
+            python3 -c 'from pathlib import Path; import sys; print(Path(sys.argv[1]).read_text(errors="replace"))' "$response_file"
+            exit 1
+          fi
+
+          deploy_id="$(python3 -c 'import json, sys; from pathlib import Path; text = Path(sys.argv[1]).read_text(errors="replace").strip(); data = json.loads(text) if text else {}; print(data.get("id", "") if isinstance(data, dict) else "")' "$response_file")"
+
+          echo "deploy_id=${deploy_id}" >> "$GITHUB_OUTPUT"
+          echo "Triggered Render deploy ${deploy_id:-<unknown>} for snapshot ${DAYTONA_SNAPSHOT}"
diff --git a/.github/workflows/download-stats.yml b/.github/workflows/download-stats.yml
new file mode 100644
index 0000000000..a965d04b70
--- /dev/null
+++ b/.github/workflows/download-stats.yml
@@ -0,0 +1,43 @@
+name: Download Stats
+
+on:
+  schedule:
+    - cron: "0 12 * * *" # Run daily at 12:00 UTC
+  workflow_dispatch:
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  stats:
+    if: github.repository == 'different-ai/openwork'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Run stats script
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}
+          POSTHOG_HOST: https://us.i.posthog.com
+          POSTHOG_LEGACY_EVENT: download
+          POSTHOG_V2_EVENT: release_asset_snapshot
+          POSTHOG_DISTINCT_ID: openwork-download
+          GITHUB_REPO: different-ai/openwork
+        run: node scripts/stats.mjs
+
+      - name: Commit stats
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add STATS.md STATS_V2.md
+          git diff --staged --quiet || git commit -m "ignore: update download stats $(date -I)"
+          git push
diff --git a/.github/workflows/opencode-agents.yml b/.github/workflows/opencode-agents.yml
new file mode 100644
index 0000000000..8abafe4299
--- /dev/null
+++ b/.github/workflows/opencode-agents.yml
@@ -0,0 +1,106 @@
+name: Opencode Agents
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Run issue triage or duplicate PR check
+        required: true
+        type: choice
+        options:
+          - issue
+          - pull_request
+      number:
+        description: Issue or pull request number
+        required: true
+        type: number
+
+jobs:
+  triage-issue:
+    if: inputs.target == 'issue'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Install opencode
+        run: |
+          version="$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")"
+          curl -fsSL https://opencode.ai/install | bash -s -- --version "$version" --no-modify-path
+
+      - name: Triage issue
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ inputs.number }}
+        run: |
+          cat > /tmp/issue_prompt.txt <<'PROMPT_EOF'
+          The following issue was just opened, triage it:
+          PROMPT_EOF
+          ISSUE_TITLE="$(gh issue view "$ISSUE_NUMBER" --json title --jq .title)"
+          ISSUE_BODY="$(gh issue view "$ISSUE_NUMBER" --json body --jq .body)"
+          printf '\nTitle: %s\n\n%s\n' "$ISSUE_TITLE" "$ISSUE_BODY" >> /tmp/issue_prompt.txt
+          opencode run --agent triage "$(cat /tmp/issue_prompt.txt)"
+
+  duplicate-prs:
+    if: inputs.target == 'pull_request'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Install opencode
+        run: |
+          version="$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")"
+          curl -fsSL https://opencode.ai/install | bash -s -- --version "$version" --no-modify-path
+
+      - name: Build prompt
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.number }}
+        run: |
+          {
+            echo "Check for duplicate PRs related to this new PR:"
+            echo ""
+            echo "CURRENT_PR_NUMBER: $PR_NUMBER"
+            echo ""
+            echo "Title: $(gh pr view \"$PR_NUMBER\" --json title --jq .title)"
+            echo ""
+            echo "Description:"
+            gh pr view "$PR_NUMBER" --json body --jq .body
+          } > pr_info.txt
+
+      - name: Check for duplicate PRs
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.number }}
+        run: |
+          opencode run --agent duplicate-pr "$(cat pr_info.txt)" > /tmp/comment_output.txt
+
+          {
+            echo "_The following comment was made by an LLM, it may be inaccurate:_"
+            echo ""
+            cat /tmp/comment_output.txt
+          } > /tmp/comment_body.txt
+          gh pr comment "$PR_NUMBER" --body-file /tmp/comment_body.txt
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
new file mode 100644
index 0000000000..36de01c42e
--- /dev/null
+++ b/.github/workflows/prerelease.yml
@@ -0,0 +1,327 @@
+name: PreRelease App
+
+on:
+  push:
+    branches:
+      - dev
+      - feat/windows-sidecar
+
+permissions:
+  contents: write
+
+concurrency:
+  group: prerelease-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prepare-release:
+    name: Prepare Prerelease
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+
+    outputs:
+      release_tag: ${{ steps.prerelease-meta.outputs.release_tag }}
+      release_name: ${{ steps.prerelease-meta.outputs.release_name }}
+      release_body: ${{ steps.prerelease-meta.outputs.release_body }}
+
+    steps:
+      - name: Set prerelease metadata
+        id: prerelease-meta
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          short_sha=$(echo "$GITHUB_SHA" | cut -c1-7)
+          tag="v${short_sha}-dev"
+          name="OpenWork ${tag}"
+          body="Automated prerelease from ${GITHUB_REF_NAME} (${GITHUB_SHA})."
+
+          echo "RELEASE_TAG=$tag" >> "$GITHUB_ENV"
+          echo "RELEASE_NAME=$name" >> "$GITHUB_ENV"
+          {
+            echo "RELEASE_BODY<<__OPENWORK_RELEASE_BODY_EOF__"
+            echo "$body"
+            echo "__OPENWORK_RELEASE_BODY_EOF__"
+          } >> "$GITHUB_ENV"
+
+          echo "release_tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "release_name=$name" >> "$GITHUB_OUTPUT"
+          {
+            echo "release_body<<__OPENWORK_RELEASE_BODY_EOF__"
+            echo "$body"
+            echo "__OPENWORK_RELEASE_BODY_EOF__"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create prerelease
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          BODY_FILE="$RUNNER_TEMP/release_body.md"
+          printf '%s\n' "$RELEASE_BODY" > "$BODY_FILE"
+
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Prerelease $RELEASE_TAG already exists; skipping create."
+            exit 0
+          fi
+
+          gh release create "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$RELEASE_NAME" \
+            --notes-file "$BODY_FILE" \
+            --prerelease
+
+  publish-tauri:
+    name: Build + Publish (${{ matrix.target }})
+    needs: prepare-release
+    # Set OPENWORK_LINUX_X64_RUNNER_LABEL to route only the Linux x86_64 build to a larger runner.
+    runs-on: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
+    timeout-minutes: 360
+
+    env:
+      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
+      RELEASE_NAME: ${{ needs.prepare-release.outputs.release_name }}
+      RELEASE_BODY: ${{ needs.prepare-release.outputs.release_body }}
+      MACOS_NOTARIZE: ${{ vars.MACOS_NOTARIZE || 'false' }}
+      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos-14
+            os_type: macos
+            target: aarch64-apple-darwin
+            args: "--target aarch64-apple-darwin --bundles dmg,app"
+          - platform: macos-14
+            os_type: macos
+            target: x86_64-apple-darwin
+            args: "--target x86_64-apple-darwin --bundles dmg,app"
+          - platform: ubuntu-22.04
+            os_type: linux
+            target: x86_64-unknown-linux-gnu
+            args: "--target x86_64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: ubuntu-22.04-arm
+            os_type: linux
+            target: aarch64-unknown-linux-gnu
+            args: "--target aarch64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: windows-2022
+            os_type: windows
+            target: x86_64-pc-windows-msvc
+            args: "--target x86_64-pc-windows-msvc --bundles msi"
+
+    steps:
+      - name: Log runner selection
+        shell: bash
+        run: |
+          echo "Requested larger runner label: ${RUNNER_LABEL:-<unset>}"
+          echo "Effective runs-on: ${EFFECTIVE_RUNS_ON}"
+        env:
+          RUNNER_LABEL: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL }}
+          EFFECTIVE_RUNS_ON: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Enable git long paths (Windows)
+        if: matrix.os_type == 'windows'
+        shell: pwsh
+        run: git config --global core.longpaths true
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install OpenTUI x64 core (macOS x86_64)
+        if: matrix.os_type == 'macos' && matrix.target == 'x86_64-apple-darwin'
+        run: pnpm add -w --ignore-workspace-root-check @opentui/core-darwin-x64@0.1.77
+
+      - name: Install Linux build dependencies
+        if: matrix.os_type == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgtk-3-dev \
+            libglib2.0-dev \
+            libayatana-appindicator3-dev \
+            libsoup-3.0-dev \
+            libwebkit2gtk-4.1-dev \
+            libssl-dev \
+            rpm \
+            libdbus-1-dev \
+            librsvg2-dev
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Resolve OpenCode version
+        id: opencode-version
+        shell: bash
+        run: |
+          node <<'NODE' >> "$GITHUB_OUTPUT"
+          const fs = require('fs');
+          const parsed = JSON.parse(fs.readFileSync('./constants.json', 'utf8'));
+          const version = String(parsed.opencodeVersion || '').replace(/^v/, '').trim();
+          if (!version) {
+            throw new Error('Pinned OpenCode version is missing from constants.json');
+          }
+          console.log('version=' + version);
+          NODE
+
+      - name: Download OpenCode sidecar
+        shell: bash
+        env:
+          PINNED_OPENCODE_VERSION: ${{ steps.opencode-version.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              opencode_asset="opencode-darwin-arm64.zip"
+              ;;
+            x86_64-apple-darwin)
+              opencode_asset="opencode-darwin-x64-baseline.zip"
+              ;;
+            x86_64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-x64-baseline.tar.gz"
+              ;;
+            aarch64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-arm64.tar.gz"
+              ;;
+            x86_64-pc-windows-msvc)
+              opencode_asset="opencode-windows-x64-baseline.zip"
+              ;;
+            *)
+              echo "Unsupported target: ${{ matrix.target }}"
+              exit 1
+              ;;
+          esac
+
+          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
+          url="https://github.com/${repo}/releases/download/v${PINNED_OPENCODE_VERSION}/${opencode_asset}"
+          tmp_dir="$RUNNER_TEMP/opencode"
+          extract_dir="$tmp_dir/extracted"
+          rm -rf "$tmp_dir"
+          mkdir -p "$extract_dir"
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 -o "$tmp_dir/$opencode_asset" "$url"
+
+          if [[ "$opencode_asset" == *.tar.gz ]]; then
+            tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"
+          else
+            if command -v unzip >/dev/null 2>&1; then
+              unzip -q "$tmp_dir/$opencode_asset" -d "$extract_dir"
+            elif command -v 7z >/dev/null 2>&1; then
+              7z x "$tmp_dir/$opencode_asset" -o"$extract_dir" >/dev/null
+            else
+              echo "No unzip utility available"
+              exit 1
+            fi
+          fi
+
+          if [ -f "$extract_dir/opencode" ]; then
+            bin_path="$extract_dir/opencode"
+          elif [ -f "$extract_dir/opencode.exe" ]; then
+            bin_path="$extract_dir/opencode.exe"
+          else
+            echo "OpenCode binary not found in archive"
+            ls -la "$extract_dir"
+            exit 1
+          fi
+
+          target_name="opencode-${{ matrix.target }}"
+          if [ "${{ matrix.os_type }}" = "windows" ]; then
+            target_name="${target_name}.exe"
+          fi
+
+          mkdir -p apps/desktop/src-tauri/sidecars
+          cp "$bin_path" "apps/desktop/src-tauri/sidecars/${target_name}"
+          chmod 755 "apps/desktop/src-tauri/sidecars/${target_name}"
+
+      - name: Write notary API key
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        env:
+          APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
+        run: |
+          set -euo pipefail
+
+          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
+          printf '%s' "$APPLE_NOTARY_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
+          chmod 600 "$NOTARY_KEY_PATH"
+
+          echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
+
+      - name: Build + upload (notarized)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        uses: tauri-apps/tauri-action@v0.5.17
+        env:
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+
+          # macOS notarization (App Store Connect API key)
+          APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
+        with:
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          prerelease: true
+          releaseDraft: false
+          projectPath: apps/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3
+
+      - name: Build + upload
+        if: matrix.os_type != 'macos' || env.MACOS_NOTARIZE != 'true'
+        uses: tauri-apps/tauri-action@v0.5.17
+        env:
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+        with:
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          prerelease: true
+          releaseDraft: false
+          projectPath: apps/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3
diff --git a/.github/workflows/release-daytona-snapshot.yml b/.github/workflows/release-daytona-snapshot.yml
new file mode 100644
index 0000000000..4d8baa3ac1
--- /dev/null
+++ b/.github/workflows/release-daytona-snapshot.yml
@@ -0,0 +1,172 @@
+name: Release Daytona Snapshot
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: "Tag to build from (e.g., v0.11.200). Defaults to current ref."
+        required: false
+        type: string
+      deploy_den:
+        description: "Whether to promote the published snapshot into the Den Render service"
+        required: false
+        type: boolean
+        default: true
+      snapshot_name:
+        description: "Optional explicit Daytona snapshot name"
+        required: false
+        type: string
+      snapshot_region:
+        description: "Optional Daytona region override for snapshot push"
+        required: false
+        type: string
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build from (e.g., v0.11.200). Defaults to release tag/current ref."
+        required: false
+        type: string
+      deploy_den:
+        description: "Whether to promote the published snapshot into the Den Render service"
+        required: false
+        type: boolean
+        default: true
+      snapshot_name:
+        description: "Optional explicit Daytona snapshot name"
+        required: false
+        type: string
+      snapshot_region:
+        description: "Optional Daytona region override for snapshot push"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish-daytona-snapshot:
+    name: Build and Push Daytona Snapshot
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    outputs:
+      release_tag: ${{ steps.resolve.outputs.release_tag }}
+      snapshot_name: ${{ steps.resolve.outputs.snapshot_name }}
+      snapshot_region: ${{ steps.resolve.outputs.snapshot_region }}
+    steps:
+      - name: Resolve release tag and snapshot name
+        id: resolve
+        shell: bash
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
+          INPUT_SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
+          INPUT_SNAPSHOT_REGION: ${{ inputs.snapshot_region }}
+          SNAPSHOT_NAME_BASE: ${{ vars.DAYTONA_SNAPSHOT_NAME_BASE }}
+          DEFAULT_SNAPSHOT_REGION: ${{ vars.DAYTONA_SNAPSHOT_REGION }}
+        run: |
+          set -euo pipefail
+
+          tag="${INPUT_TAG:-}"
+          if [ -z "$tag" ]; then
+            tag="${GITHUB_REF_NAME}"
+          fi
+          if [[ "$tag" != v* ]]; then
+            tag="v${tag}"
+          fi
+          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid release tag: $tag" >&2
+            exit 1
+          fi
+
+          base_name="${SNAPSHOT_NAME_BASE:-openwork}"
+          if [ -n "${INPUT_SNAPSHOT_NAME:-}" ]; then
+            snapshot_name="${INPUT_SNAPSHOT_NAME}"
+          else
+            snapshot_name="${base_name}-${tag#v}"
+          fi
+          snapshot_region="${INPUT_SNAPSHOT_REGION:-${DEFAULT_SNAPSHOT_REGION:-}}"
+
+          echo "release_tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "snapshot_name=$snapshot_name" >> "$GITHUB_OUTPUT"
+          echo "snapshot_region=$snapshot_region" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout release source
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.resolve.outputs.release_tag }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Install Daytona CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          case "$(uname -s)" in
+            Linux) platform="linux" ;;
+            Darwin) platform="darwin" ;;
+            *)
+              echo "Unsupported OS: $(uname -s)" >&2
+              exit 1
+              ;;
+          esac
+
+          case "$(uname -m)" in
+            x86_64|amd64) arch="amd64" ;;
+            aarch64|arm64) arch="arm64" ;;
+            *)
+              echo "Unsupported architecture: $(uname -m)" >&2
+              exit 1
+              ;;
+          esac
+
+          asset_name="daytona-${platform}-${arch}"
+          install_dir="$HOME/.local/bin"
+          mkdir -p "$install_dir"
+
+          release_json="$(curl -fsSL https://api.github.com/repos/daytonaio/daytona/releases/latest)"
+          asset_url="$(python3 -c 'import json, sys; data = json.load(sys.stdin); name = sys.argv[1]; print(next(asset["browser_download_url"] for asset in data["assets"] if asset["name"] == name))' "$asset_name" <<<"$release_json")"
+
+          curl -fL "$asset_url" -o "$install_dir/daytona"
+          chmod +x "$install_dir/daytona"
+
+          echo "$install_dir" >> "$GITHUB_PATH"
+          export PATH="$install_dir:$PATH"
+
+          daytona version
+
+      - name: Build and push snapshot
+        shell: bash
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
+          DAYTONA_TARGET: ${{ vars.DAYTONA_TARGET }}
+          DAYTONA_SNAPSHOT_REGION: ${{ steps.resolve.outputs.snapshot_region }}
+          DAYTONA_SNAPSHOT_NAME: ${{ steps.resolve.outputs.snapshot_name }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_API_KEY:-}" ]; then
+            echo "Missing required secret: DAYTONA_API_KEY" >&2
+            exit 1
+          fi
+
+          export DAYTONA_CONFIG_DIR="$RUNNER_TEMP/daytona"
+          mkdir -p "$DAYTONA_CONFIG_DIR"
+          daytona login --api-key "$DAYTONA_API_KEY"
+
+          echo "Publishing Daytona snapshot: ${DAYTONA_SNAPSHOT_NAME}"
+          ./scripts/create-daytona-openwork-snapshot.sh "${DAYTONA_SNAPSHOT_NAME}"
+
+  deploy-den:
+    name: Promote Daytona Snapshot to Den Render Service
+    needs: [publish-daytona-snapshot]
+    if: ${{ inputs.deploy_den }}
+    uses: ./.github/workflows/deploy-den.yml
+    with:
+      daytona_snapshot: ${{ needs.publish-daytona-snapshot.outputs.snapshot_name }}
+    secrets: inherit
diff --git a/.github/workflows/release-macos-aarch64.yml b/.github/workflows/release-macos-aarch64.yml
new file mode 100644
index 0000000000..f2c22e31a3
--- /dev/null
+++ b/.github/workflows/release-macos-aarch64.yml
@@ -0,0 +1,1167 @@
+name: Release App
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release (e.g., v0.1.2). Leave empty to use current ref."
+        required: false
+        type: string
+      release_name:
+        description: "Release title (defaults to OpenWork <tag>)"
+        required: false
+        type: string
+      release_body:
+        description: "Release notes body in Markdown (defaults to a short placeholder)"
+        required: false
+        type: string
+      draft:
+        description: "Create the GitHub Release as a draft"
+        required: false
+        type: boolean
+        default: false
+      prerelease:
+        description: "Mark the GitHub Release as a prerelease"
+        required: false
+        type: boolean
+        default: false
+      notarize:
+        description: "Notarize macOS builds (requires Apple team configured)"
+        required: false
+        type: boolean
+        default: true
+      build_tauri:
+        description: "Build desktop (Tauri) artifacts"
+        required: false
+        type: boolean
+        default: true
+      publish_sidecars:
+        description: "Build + upload openwork-orchestrator sidecar release assets"
+        required: false
+        type: boolean
+        default: true
+      publish_npm:
+        description: "Publish openwork-orchestrator/openwork-server/opencode-router to npm if versions changed"
+        required: false
+        type: boolean
+        default: true
+      publish_daytona_snapshot:
+        description: "Build + push Daytona worker snapshot"
+        required: false
+        type: boolean
+        default: true
+      publish_electron:
+        description: "Build + publish Electron desktop artifacts (macOS/Linux/Windows) alongside Tauri"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  resolve-release:
+    name: Resolve Release Metadata
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    outputs:
+      release_tag: ${{ steps.resolve.outputs.release_tag }}
+      release_name: ${{ steps.resolve.outputs.release_name }}
+      release_body: ${{ steps.resolve.outputs.release_body }}
+      draft: ${{ steps.resolve.outputs.draft }}
+      prerelease: ${{ steps.resolve.outputs.prerelease }}
+      notarize: ${{ steps.resolve.outputs.notarize }}
+      build_tauri: ${{ steps.resolve.outputs.build_tauri }}
+      publish_sidecars: ${{ steps.resolve.outputs.publish_sidecars }}
+      publish_npm: ${{ steps.resolve.outputs.publish_npm }}
+      publish_daytona_snapshot: ${{ steps.resolve.outputs.publish_daytona_snapshot }}
+    steps:
+      - name: Resolve metadata
+        id: resolve
+        shell: bash
+        env:
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+          INPUT_RELEASE_NAME: ${{ github.event.inputs.release_name }}
+          INPUT_RELEASE_BODY: ${{ github.event.inputs.release_body }}
+          INPUT_DRAFT: ${{ github.event.inputs.draft }}
+          INPUT_PRERELEASE: ${{ github.event.inputs.prerelease }}
+          INPUT_NOTARIZE: ${{ github.event.inputs.notarize }}
+          INPUT_BUILD_TAURI: ${{ github.event.inputs.build_tauri }}
+          INPUT_PUBLISH_SIDECARS: ${{ github.event.inputs.publish_sidecars }}
+          INPUT_PUBLISH_NPM: ${{ github.event.inputs.publish_npm }}
+          INPUT_PUBLISH_DAYTONA_SNAPSHOT: ${{ github.event.inputs.publish_daytona_snapshot }}
+          DEFAULT_PUBLISH_SIDECARS: ${{ vars.RELEASE_PUBLISH_SIDECARS }}
+          DEFAULT_PUBLISH_NPM: ${{ vars.RELEASE_PUBLISH_NPM }}
+          DEFAULT_PUBLISH_DAYTONA_SNAPSHOT: ${{ vars.RELEASE_PUBLISH_DAYTONA_SNAPSHOT }}
+          DEFAULT_NOTARIZE: ${{ vars.MACOS_NOTARIZE }}
+          DEFAULT_BUILD_TAURI: ${{ vars.RELEASE_BUILD_TAURI }}
+        run: |
+          set -euo pipefail
+
+          TAG_INPUT="${INPUT_TAG:-}"
+          if [ -n "$TAG_INPUT" ]; then
+            if [[ "$TAG_INPUT" == v* ]]; then
+              TAG="$TAG_INPUT"
+            else
+              TAG="v$TAG_INPUT"
+            fi
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid release tag: $TAG (expected vX.Y.Z)" >&2
+            exit 1
+          fi
+
+          RELEASE_NAME_INPUT="${INPUT_RELEASE_NAME:-}"
+          if [ -n "$RELEASE_NAME_INPUT" ]; then
+            RELEASE_NAME="$RELEASE_NAME_INPUT"
+          else
+            RELEASE_NAME="OpenWork $TAG"
+          fi
+
+          RELEASE_BODY_INPUT="${INPUT_RELEASE_BODY:-}"
+          if [ -n "$RELEASE_BODY_INPUT" ]; then
+            RELEASE_BODY="$RELEASE_BODY_INPUT"
+          else
+            printf -v RELEASE_BODY '%s\n\nOpenWork %s desktop release.\n\n%s\n%s\n%s' \
+              "## What's new" \
+              "$TAG" \
+              "- Download the attached installer for your platform." \
+              "- Electron builds use the attached latest-mac.yml updater feed when Electron publishing is enabled." \
+              "- Tauri builds use the attached latest.json updater manifest."
+          fi
+
+          draft="${INPUT_DRAFT:-}"
+          if [ -z "$draft" ]; then
+            if [ "${GITHUB_EVENT_NAME}" = "push" ]; then
+              # Keep tag-triggered releases out of /releases/latest until assets + latest.json are ready.
+              draft="true"
+            else
+              draft="false"
+            fi
+          fi
+          prerelease="${INPUT_PRERELEASE:-false}"
+          notarize="${INPUT_NOTARIZE:-}"
+          if [ -z "$notarize" ]; then
+            notarize="${DEFAULT_NOTARIZE:-true}"
+          fi
+
+          build_tauri="${INPUT_BUILD_TAURI:-}"
+          if [ -z "$build_tauri" ]; then
+            build_tauri="${DEFAULT_BUILD_TAURI:-true}"
+          fi
+
+          publish_sidecars="${INPUT_PUBLISH_SIDECARS:-}"
+          if [ -z "$publish_sidecars" ]; then
+            publish_sidecars="${DEFAULT_PUBLISH_SIDECARS:-true}"
+          fi
+          publish_npm="${INPUT_PUBLISH_NPM:-}"
+          if [ -z "$publish_npm" ]; then
+            publish_npm="${DEFAULT_PUBLISH_NPM:-true}"
+          fi
+
+          publish_daytona_snapshot="${INPUT_PUBLISH_DAYTONA_SNAPSHOT:-}"
+          if [ -z "$publish_daytona_snapshot" ]; then
+            publish_daytona_snapshot="${DEFAULT_PUBLISH_DAYTONA_SNAPSHOT:-true}"
+          fi
+
+          TAG="${TAG//$'\n'/}"
+          TAG="${TAG//$'\r'/}"
+          RELEASE_NAME="${RELEASE_NAME//$'\n'/ }"
+          RELEASE_NAME="${RELEASE_NAME//$'\r'/ }"
+
+          echo "release_tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "release_name=$RELEASE_NAME" >> "$GITHUB_OUTPUT"
+          echo "draft=$draft" >> "$GITHUB_OUTPUT"
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
+          echo "notarize=$notarize" >> "$GITHUB_OUTPUT"
+          echo "build_tauri=$build_tauri" >> "$GITHUB_OUTPUT"
+          echo "publish_sidecars=$publish_sidecars" >> "$GITHUB_OUTPUT"
+          echo "publish_npm=$publish_npm" >> "$GITHUB_OUTPUT"
+          echo "publish_daytona_snapshot=$publish_daytona_snapshot" >> "$GITHUB_OUTPUT"
+          {
+            echo "release_body<<__OPENWORK_RELEASE_BODY_EOF__"
+            printf '%s\n' "$RELEASE_BODY"
+            echo "__OPENWORK_RELEASE_BODY_EOF__"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create release if missing
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          BODY_FILE="$RUNNER_TEMP/release_body.md"
+          printf '%s\n' "${{ steps.resolve.outputs.release_body }}" > "$BODY_FILE"
+
+          if gh release view "${{ steps.resolve.outputs.release_tag }}" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Release ${{ steps.resolve.outputs.release_tag }} already exists; skipping create."
+            exit 0
+          fi
+
+          DRAFT_FLAG=""
+          PRERELEASE_FLAG=""
+          if [ "${{ steps.resolve.outputs.draft }}" = "true" ]; then
+            DRAFT_FLAG="--draft"
+          fi
+          if [ "${{ steps.resolve.outputs.prerelease }}" = "true" ]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release create "${{ steps.resolve.outputs.release_tag }}" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "${{ steps.resolve.outputs.release_name }}" \
+            --notes-file "$BODY_FILE" \
+            $DRAFT_FLAG $PRERELEASE_FLAG
+
+  verify-release:
+    name: Verify Release Versions
+    needs: resolve-release
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Verify tag matches app versions
+        run: node scripts/release/verify-tag.mjs --tag "$RELEASE_TAG"
+
+      - name: Release review (strict)
+        run: node scripts/release/review.mjs --strict
+
+  publish-tauri:
+    name: Build + Publish (${{ matrix.target }})
+    needs: [resolve-release, verify-release]
+    if: needs.resolve-release.outputs.build_tauri == 'true'
+    # Set OPENWORK_LINUX_X64_RUNNER_LABEL to route only the Linux x86_64 build to a larger runner.
+    runs-on: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
+    timeout-minutes: 360
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+      RELEASE_NAME: ${{ needs.resolve-release.outputs.release_name }}
+      RELEASE_BODY: ${{ needs.resolve-release.outputs.release_body }}
+      RELEASE_DRAFT: ${{ needs.resolve-release.outputs.draft }}
+      RELEASE_PRERELEASE: ${{ needs.resolve-release.outputs.prerelease }}
+      MACOS_NOTARIZE: ${{ needs.resolve-release.outputs.notarize }}
+      # Ensure Tauri's beforeBuildCommand (prepare:sidecar) uses our fork.
+      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos-14
+            os_type: macos
+            target: aarch64-apple-darwin
+            args: "--target aarch64-apple-darwin --bundles dmg,app"
+          - platform: macos-14
+            os_type: macos
+            target: x86_64-apple-darwin
+            args: "--target x86_64-apple-darwin --bundles dmg,app"
+          - platform: ubuntu-22.04
+            os_type: linux
+            target: x86_64-unknown-linux-gnu
+            args: "--target x86_64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: ubuntu-22.04-arm
+            os_type: linux
+            target: aarch64-unknown-linux-gnu
+            args: "--target aarch64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: windows-2022
+            os_type: windows
+            target: x86_64-pc-windows-msvc
+            args: "--target x86_64-pc-windows-msvc --bundles msi"
+
+    steps:
+      - name: Log runner selection
+        shell: bash
+        run: |
+          echo "Requested larger runner label: ${RUNNER_LABEL:-<unset>}"
+          echo "Effective runs-on: ${EFFECTIVE_RUNS_ON}"
+        env:
+          RUNNER_LABEL: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL }}
+          EFFECTIVE_RUNS_ON: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Enable git long paths (Windows)
+        if: matrix.os_type == 'windows'
+        shell: pwsh
+        run: git config --global core.longpaths true
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Cache cargo
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/desktop/src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Install OpenTUI x64 core (macOS x86_64)
+        if: matrix.os_type == 'macos' && matrix.target == 'x86_64-apple-darwin'
+        run: pnpm add -w --ignore-workspace-root-check @opentui/core-darwin-x64@0.1.77
+
+      - name: Install Linux build dependencies
+        if: matrix.os_type == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgtk-3-dev \
+            libglib2.0-dev \
+            libayatana-appindicator3-dev \
+            libsoup-3.0-dev \
+            libwebkit2gtk-4.1-dev \
+            libssl-dev \
+            rpm \
+            libdbus-1-dev \
+            librsvg2-dev
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Resolve OpenCode version
+        id: opencode-version
+        shell: bash
+        run: |
+          node <<'NODE' >> "$GITHUB_OUTPUT"
+          const fs = require('fs');
+          const parsed = JSON.parse(fs.readFileSync('./constants.json', 'utf8'));
+          const version = String(parsed.opencodeVersion || '').replace(/^v/, '').trim();
+          if (!version) {
+            throw new Error('Pinned OpenCode version is missing from constants.json');
+          }
+          console.log('version=' + version);
+          NODE
+
+      - name: Download OpenCode sidecar
+        shell: bash
+        env:
+          PINNED_OPENCODE_VERSION: ${{ steps.opencode-version.outputs.version }}
+          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
+        run: |
+          set -euo pipefail
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              opencode_asset="opencode-darwin-arm64.zip"
+              ;;
+            x86_64-apple-darwin)
+              opencode_asset="opencode-darwin-x64-baseline.zip"
+              ;;
+            x86_64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-x64-baseline.tar.gz"
+              ;;
+            aarch64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-arm64.tar.gz"
+              ;;
+            x86_64-pc-windows-msvc)
+              opencode_asset="opencode-windows-x64-baseline.zip"
+              ;;
+            *)
+              echo "Unsupported target: ${{ matrix.target }}" >&2
+              exit 1
+              ;;
+          esac
+
+          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
+          url="https://github.com/${repo}/releases/download/v${PINNED_OPENCODE_VERSION}/${opencode_asset}"
+          tmp_dir="$RUNNER_TEMP/opencode"
+          extract_dir="$tmp_dir/extracted"
+          rm -rf "$tmp_dir"
+          mkdir -p "$extract_dir"
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 -o "$tmp_dir/$opencode_asset" "$url"
+
+          if [[ "$opencode_asset" == *.tar.gz ]]; then
+            tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"
+          else
+            if command -v unzip >/dev/null 2>&1; then
+              unzip -q "$tmp_dir/$opencode_asset" -d "$extract_dir"
+            elif command -v 7z >/dev/null 2>&1; then
+              7z x "$tmp_dir/$opencode_asset" -o"$extract_dir" >/dev/null
+            else
+              echo "No unzip utility available" >&2
+              exit 1
+            fi
+          fi
+
+          if [ -f "$extract_dir/opencode" ]; then
+            bin_path="$extract_dir/opencode"
+          elif [ -f "$extract_dir/opencode.exe" ]; then
+            bin_path="$extract_dir/opencode.exe"
+          else
+            echo "OpenCode binary not found in archive" >&2
+            ls -la "$extract_dir"
+            exit 1
+          fi
+
+          target_name="opencode-${{ matrix.target }}"
+          if [ "${{ matrix.os_type }}" = "windows" ]; then
+            target_name="${target_name}.exe"
+          fi
+
+          mkdir -p apps/desktop/src-tauri/sidecars
+          cp "$bin_path" "apps/desktop/src-tauri/sidecars/${target_name}"
+          chmod 755 "apps/desktop/src-tauri/sidecars/${target_name}"
+
+      - name: Write notary API key
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        env:
+          APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
+          APPLE_NOTARY_API_KEY_ID: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_NOTARY_API_ISSUER_ID: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_CODESIGN_CERT_P12_BASE64: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CODESIGN_CERT_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+        run: |
+          set -euo pipefail
+
+          missing=()
+          for name in \
+            APPLE_NOTARY_API_KEY_P8_BASE64 \
+            APPLE_NOTARY_API_KEY_ID \
+            APPLE_NOTARY_API_ISSUER_ID \
+            APPLE_CODESIGN_CERT_P12_BASE64 \
+            APPLE_CODESIGN_CERT_PASSWORD \
+            APPLE_SIGNING_IDENTITY; do
+            if [ -z "${!name:-}" ]; then
+              missing+=("$name")
+            fi
+          done
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing macOS notarization/signing secrets: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
+          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
+          printf '%s' "$APPLE_NOTARY_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
+          chmod 600 "$NOTARY_KEY_PATH"
+
+          echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
+
+      - name: Reject unnotarized macOS Tauri release
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE != 'true'
+        shell: bash
+        run: |
+          echo "macOS release assets must be notarized. Re-run with notarize=true or set MACOS_NOTARIZE=true." >&2
+          exit 1
+
+      - name: Build + upload (notarized)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
+        env:
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+
+          # macOS notarization (App Store Connect API key)
+          APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
+        with:
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          releaseDraft: ${{ env.RELEASE_DRAFT == 'true' }}
+          prerelease: ${{ env.RELEASE_PRERELEASE == 'true' }}
+          projectPath: apps/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3
+          uploadUpdaterJson: false
+          updaterJsonPreferNsis: true
+          releaseAssetNamePattern: openwork-desktop-[platform]-[arch][ext]
+
+      - name: Build + upload
+        if: matrix.os_type != 'macos'
+        uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
+        env:
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+        with:
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          releaseDraft: ${{ env.RELEASE_DRAFT == 'true' }}
+          prerelease: ${{ env.RELEASE_PRERELEASE == 'true' }}
+          projectPath: apps/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3
+          uploadUpdaterJson: false
+          updaterJsonPreferNsis: true
+          releaseAssetNamePattern: openwork-desktop-[platform]-[arch][ext]
+
+      - name: Verify versions.json bundled (macOS)
+        if: success() && matrix.os_type == 'macos'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          tmp_dir="$RUNNER_TEMP/openwork-bundle-verify"
+          archive_path="apps/desktop/src-tauri/target/${{ matrix.target }}/release/bundle/macos/OpenWork.app.tar.gz"
+
+          if [ ! -f "$archive_path" ]; then
+            echo "ERROR: updater archive missing from local build output: $archive_path" >&2
+            exit 1
+          fi
+
+          rm -rf "$tmp_dir"
+          mkdir -p "$tmp_dir"
+
+          tar -xzf "$archive_path" -C "$tmp_dir"
+
+          app_path="$tmp_dir/OpenWork.app"
+          manifest_path="$app_path/Contents/Resources/versions.json"
+
+          if [ ! -f "$manifest_path" ]; then
+            echo "ERROR: versions.json missing from app bundle: $manifest_path" >&2
+            echo "Hint: ensure apps/desktop/src-tauri/tauri.conf.json bundles sidecars/versions.json as a resource" >&2
+            exit 1
+          fi
+
+          echo "Found bundled versions.json at $manifest_path"
+          codesign --verify --deep --strict --verbose=2 "$app_path"
+          spctl -a -vv -t execute "$app_path"
+          xcrun stapler validate "$app_path"
+
+  publish-updater-json:
+    name: Publish consolidated latest.json
+    needs: [resolve-release, verify-release, publish-tauri]
+    if: needs.resolve-release.outputs.build_tauri == 'true'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Generate latest.json from release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          node scripts/release/generate-latest-json.mjs \
+            --tag "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --output "$RUNNER_TEMP/latest.json"
+
+      - name: Upload latest.json
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh release upload "$RELEASE_TAG" "$RUNNER_TEMP/latest.json#latest.json" \
+            --repo "$GITHUB_REPOSITORY" \
+            --clobber
+
+  publish-electron:
+    name: Build + publish Electron (${{ matrix.artifact }})
+    # Runs alongside the Tauri jobs so the same release carries both
+    # latest.json (Tauri updater) AND latest-*.yml (electron-updater).
+    # Gated on RELEASE_PUBLISH_ELECTRON=true (repo var) OR the workflow
+    # input of the same name so opt-in during rollout, opt-out if a
+    # non-migration release doesn't want Electron artifacts.
+    needs: [resolve-release, verify-release]
+    if: ${{ vars.RELEASE_PUBLISH_ELECTRON == 'true' || github.event.inputs.publish_electron == 'true' }}
+    runs-on: ${{ matrix.platform }}
+    timeout-minutes: 120
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+      MACOS_NOTARIZE: ${{ needs.resolve-release.outputs.notarize }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos-14
+            os_type: macos
+            artifact: electron-macos-arm64
+            electron_args: "--mac --arm64"
+            target_triple: aarch64-apple-darwin
+          - platform: macos-14
+            os_type: macos
+            artifact: electron-macos-x64
+            electron_args: "--mac --x64"
+            target_triple: x86_64-apple-darwin
+          - platform: ubuntu-22.04
+            os_type: linux
+            artifact: electron-linux-x64
+            electron_args: "--linux --x64"
+            target_triple: x86_64-unknown-linux-gnu
+          - platform: ubuntu-22.04-arm
+            os_type: linux
+            artifact: electron-linux-arm64
+            electron_args: "--linux --arm64"
+            target_triple: aarch64-unknown-linux-gnu
+          - platform: windows-2022
+            os_type: windows
+            artifact: electron-windows-x64
+            electron_args: "--win --x64"
+            target_triple: x86_64-pc-windows-msvc
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Enable git long paths (Windows)
+        if: matrix.os_type == 'windows'
+        shell: pwsh
+        run: git config --global core.longpaths true
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ${{ runner.os }}-electron-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-electron-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Write Electron notary API key (macOS)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        env:
+          APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
+          APPLE_NOTARY_API_KEY_ID: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_NOTARY_API_ISSUER_ID: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_CODESIGN_CERT_P12_BASE64: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CODESIGN_CERT_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+        run: |
+          set -euo pipefail
+
+          missing=()
+          for name in \
+            APPLE_NOTARY_API_KEY_P8_BASE64 \
+            APPLE_NOTARY_API_KEY_ID \
+            APPLE_NOTARY_API_ISSUER_ID \
+            APPLE_CODESIGN_CERT_P12_BASE64 \
+            APPLE_CODESIGN_CERT_PASSWORD; do
+            if [ -z "${!name:-}" ]; then
+              missing+=("$name")
+            fi
+          done
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing Electron macOS notarization/signing secrets: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
+          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
+          printf '%s' "$APPLE_NOTARY_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
+          chmod 600 "$NOTARY_KEY_PATH"
+
+          echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
+
+      - name: Reject unnotarized macOS Electron release
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE != 'true'
+        shell: bash
+        run: |
+          echo "macOS Electron release assets must be notarized. Re-run with notarize=true or set MACOS_NOTARIZE=true." >&2
+          exit 1
+
+      - name: Build Electron app
+        shell: bash
+        env:
+          # TARGET tells prepare-sidecar.mjs which architecture's sidecars
+          # to download (critical for cross-arch builds like x64 on arm64 mac).
+          TARGET: ${{ matrix.target_triple }}
+        run: pnpm --filter @openwork/desktop build:electron
+
+      - name: Package + publish Electron (macOS, signed + notarized)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        env:
+          CSC_LINK: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          CSC_KEY_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+          APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
+          APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          pnpm --dir apps/desktop exec electron-builder \
+            --config electron-builder.yml \
+            ${{ matrix.electron_args }} \
+            --publish always
+
+      - name: Package + publish Electron (Linux)
+        if: matrix.os_type == 'linux'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          pnpm --dir apps/desktop exec electron-builder \
+            --config electron-builder.yml \
+            ${{ matrix.electron_args }} \
+            --publish always
+
+      - name: Package + publish Electron (Windows)
+        if: matrix.os_type == 'windows'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          pnpm --dir apps/desktop exec electron-builder \
+            --config electron-builder.yml \
+            ${{ matrix.electron_args }} \
+            --publish always
+
+  release-orchestrator-sidecars:
+    name: Build + Upload openwork-orchestrator Sidecars
+    needs: [resolve-release, verify-release]
+    if: needs.resolve-release.outputs.publish_sidecars == 'true'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ubuntu-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ubuntu-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Resolve sidecar versions
+        id: sidecar-versions
+        shell: bash
+        run: |
+          node -e "const fs=require('fs'); const orchestrator=JSON.parse(fs.readFileSync('apps/orchestrator/package.json','utf8')); const server=JSON.parse(fs.readFileSync('apps/server/package.json','utf8')); const opencodeRouter=JSON.parse(fs.readFileSync('apps/opencode-router/package.json','utf8')); console.log('orchestrator=' + orchestrator.version); console.log('server=' + server.version); console.log('opencodeRouter=' + opencodeRouter.version);" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve SOURCE_DATE_EPOCH
+        id: source-date
+        shell: bash
+        run: |
+          epoch=$(git show -s --format=%ct "${RELEASE_TAG}")
+          echo "epoch=$epoch" >> "$GITHUB_OUTPUT"
+
+      - name: Check openwork-orchestrator release
+        id: orchestrator-release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="openwork-orchestrator-v${{ steps.sidecar-versions.outputs.orchestrator }}"
+          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build orchestrator release artifacts
+        env:
+          SOURCE_DATE_EPOCH: ${{ steps.source-date.outputs.epoch }}
+        run: |
+          pnpm --filter openwork-orchestrator build:bin:all
+          pnpm --filter openwork-orchestrator build:sidecars
+
+      - name: Release review (strict)
+        env:
+          SOURCE_DATE_EPOCH: ${{ steps.source-date.outputs.epoch }}
+        run: node scripts/release/review.mjs --strict
+
+      - name: Create openwork-orchestrator release
+        if: steps.orchestrator-release.outputs.exists != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version="${{ steps.sidecar-versions.outputs.orchestrator }}"
+          tag="openwork-orchestrator-v${version}"
+          notes="Sidecar bundle for openwork-orchestrator v${version}.\n\nopenwork-server: ${{ steps.sidecar-versions.outputs.server }}\nopencodeRouter: ${{ steps.sidecar-versions.outputs.opencodeRouter }}"
+          gh release create "$tag" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "openwork-orchestrator v${version}" \
+            --notes "$notes" \
+            --latest=false
+
+      - name: Upload orchestrator release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="openwork-orchestrator-v${{ steps.sidecar-versions.outputs.orchestrator }}"
+          gh release upload "$tag" apps/orchestrator/dist/bin/* apps/orchestrator/dist/sidecars/* --repo "$GITHUB_REPOSITORY" --clobber
+
+  publish-npm:
+    name: Publish npm packages
+    needs: [resolve-release, verify-release, release-orchestrator-sidecars]
+    if: |
+      always() &&
+      needs.resolve-release.result == 'success' &&
+      needs.verify-release.result == 'success' &&
+      (needs.release-orchestrator-sidecars.result == 'success' || needs.release-orchestrator-sidecars.result == 'skipped') &&
+      needs.resolve-release.outputs.publish_npm == 'true'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # Dispatch-based release recovery uses the workflow ref so fixes to
+          # npm release automation can run without moving an already-shipped tag.
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || env.RELEASE_TAG }}
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ubuntu-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ubuntu-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Resolve package versions
+        id: package-versions
+        shell: bash
+        run: |
+          node -e "const fs=require('fs'); const orchestrator=JSON.parse(fs.readFileSync('apps/orchestrator/package.json','utf8')); const server=JSON.parse(fs.readFileSync('apps/server/package.json','utf8')); const opencodeRouter=JSON.parse(fs.readFileSync('apps/opencode-router/package.json','utf8')); console.log('orchestrator=' + orchestrator.version); console.log('server=' + server.version); console.log('opencodeRouter=' + opencodeRouter.version);" >> "$GITHUB_OUTPUT"
+
+      - name: Check npm versions
+        id: npm-versions
+        shell: bash
+        env:
+          ORCHESTRATOR_VERSION: ${{ steps.package-versions.outputs.orchestrator }}
+          SERVER_VERSION: ${{ steps.package-versions.outputs.server }}
+          OPENCODE_ROUTER_VERSION: ${{ steps.package-versions.outputs.opencodeRouter }}
+        run: |
+          set -euo pipefail
+          # npm view exits non-zero for packages that don't exist yet (404).
+          # Treat missing packages as "not published" so release can publish them.
+          orchestrator_current="$(npm view openwork-orchestrator version 2>/dev/null || true)"
+          server_current="$(npm view openwork-server version 2>/dev/null || true)"
+          opencodeRouter_current="$(npm view opencode-router version 2>/dev/null || true)"
+
+          if [ "$orchestrator_current" = "$ORCHESTRATOR_VERSION" ]; then
+            echo "publish_orchestrator=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish_orchestrator=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [ "$server_current" = "$SERVER_VERSION" ]; then
+            echo "publish_server=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish_server=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [ "$opencodeRouter_current" = "$OPENCODE_ROUTER_VERSION" ]; then
+            echo "publish_opencodeRouter=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish_opencodeRouter=true" >> "$GITHUB_OUTPUT"
+          fi
+
+          publish_any=false
+          if [ "$orchestrator_current" != "$ORCHESTRATOR_VERSION" ] || [ "$server_current" != "$SERVER_VERSION" ] || [ "$opencodeRouter_current" != "$OPENCODE_ROUTER_VERSION" ]; then
+            publish_any=true
+          fi
+          echo "publish_any=$publish_any" >> "$GITHUB_OUTPUT"
+
+      - name: Ensure npm auth
+        id: npm-auth
+        shell: bash
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PUBLISH_ANY: ${{ steps.npm-versions.outputs.publish_any }}
+        run: |
+          set -euo pipefail
+
+          if [ "${PUBLISH_ANY}" != "true" ]; then
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "${NPM_TOKEN:-}" ]; then
+            echo "NPM_TOKEN not set; skipping npm publish."
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          npm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
+          echo "enabled=true" >> "$GITHUB_OUTPUT"
+
+      - name: Publish openwork-server
+        if: steps.npm-auth.outputs.enabled == 'true' && steps.npm-versions.outputs.publish_server == 'true'
+        run: pnpm --filter openwork-server publish --access public --no-git-checks
+
+      - name: Publish opencode-router
+        if: steps.npm-auth.outputs.enabled == 'true' && steps.npm-versions.outputs.publish_opencodeRouter == 'true'
+        run: pnpm --filter opencode-router publish --access public --no-git-checks
+
+      - name: Publish openwork-orchestrator
+        if: steps.npm-auth.outputs.enabled == 'true' && steps.npm-versions.outputs.publish_orchestrator == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ORCHESTRATOR_VERSION: ${{ steps.package-versions.outputs.orchestrator }}
+        run: |
+          set -euo pipefail
+          tag="openwork-orchestrator-v${ORCHESTRATOR_VERSION}"
+          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "openwork-orchestrator sidecar release $tag not found. Publish sidecars before openwork-orchestrator." >&2
+            exit 1
+          fi
+          pnpm --filter openwork-orchestrator build:bin:all
+          node apps/orchestrator/scripts/publish-npm.mjs
+
+  publish-daytona-snapshot:
+    name: Build + Push Daytona Snapshot
+    needs: [resolve-release, verify-release, publish-npm]
+    if: |
+      always() &&
+      needs.resolve-release.result == 'success' &&
+      needs.verify-release.result == 'success' &&
+      (needs.publish-npm.result == 'success' || needs.publish-npm.result == 'skipped') &&
+      needs.resolve-release.outputs.publish_daytona_snapshot == 'true'
+    uses: ./.github/workflows/release-daytona-snapshot.yml
+    with:
+      tag: ${{ needs.resolve-release.outputs.release_tag }}
+    secrets: inherit
+
+  aur-publish:
+    name: Publish AUR
+    needs: [resolve-release, publish-tauri, publish-release]
+    if: |
+      always() &&
+      needs.resolve-release.result == 'success' &&
+      (needs.publish-tauri.result == 'success' || needs.publish-tauri.result == 'skipped') &&
+      (needs.publish-release.result == 'success' || needs.publish-release.result == 'skipped')
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+    steps:
+      - name: Checkout dev
+        uses: actions/checkout@v6
+        with:
+          ref: dev
+          fetch-depth: 0
+
+      - name: Update AUR packaging files
+        run: scripts/aur/update-aur.sh "$RELEASE_TAG"
+
+      - name: Commit packaging update to dev
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if ! git status --porcelain -- packaging/aur/PKGBUILD packaging/aur/.SRCINFO | grep -q .; then
+            echo "AUR packaging already up to date in dev."
+            exit 0
+          fi
+
+          version="${RELEASE_TAG#v}"
+          git add packaging/aur/PKGBUILD packaging/aur/.SRCINFO
+          git -c user.name="OpenWork Release Bot" \
+              -c user.email="release-bot@users.noreply.github.com" \
+              commit -m "chore(aur): update PKGBUILD for ${version}"
+          git push origin HEAD:dev
+
+      - name: Publish to AUR
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          AUR_REPO: ${{ vars.AUR_REPO || 'openwork' }}
+          AUR_SKIP_UPDATE: "1"
+        run: |
+          set -euo pipefail
+          if [ -z "${AUR_SSH_PRIVATE_KEY:-}" ]; then
+            echo "AUR_SSH_PRIVATE_KEY not set; skipping publish to AUR."
+            exit 0
+          fi
+          scripts/aur/publish-aur.sh "$RELEASE_TAG"
+
+  publish-release:
+    name: Publish GitHub Release
+    needs:
+      - resolve-release
+      - verify-release
+      - publish-tauri
+      - publish-updater-json
+      - publish-electron
+      - release-orchestrator-sidecars
+      - publish-npm
+      - publish-daytona-snapshot
+    if: |
+      always() &&
+      needs.resolve-release.outputs.draft == 'true' &&
+      needs.resolve-release.result == 'success' &&
+      needs.verify-release.result == 'success' &&
+      (needs.publish-tauri.result == 'success' || needs.publish-tauri.result == 'skipped') &&
+      (needs.publish-updater-json.result == 'success' || needs.publish-updater-json.result == 'skipped') &&
+      (needs.publish-electron.result == 'success' || needs.publish-electron.result == 'skipped') &&
+      (needs.release-orchestrator-sidecars.result == 'success' || needs.release-orchestrator-sidecars.result == 'skipped') &&
+      (needs.publish-npm.result == 'success' || needs.publish-npm.result == 'skipped') &&
+      (needs.publish-daytona-snapshot.result == 'success' || needs.publish-daytona-snapshot.result == 'skipped')
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+      RELEASE_PRERELEASE: ${{ needs.resolve-release.outputs.prerelease }}
+    steps:
+      - name: Publish release after assets are ready
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          if [ "${RELEASE_PRERELEASE}" = "true" ]; then
+            gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false --prerelease
+          else
+            gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false --latest
+          fi
diff --git a/.github/workflows/windows-signed-artifacts.yml b/.github/workflows/windows-signed-artifacts.yml
new file mode 100644
index 0000000000..149290e5d5
--- /dev/null
+++ b/.github/workflows/windows-signed-artifacts.yml
@@ -0,0 +1,122 @@
+name: Windows Signed Artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to build
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-sign-windows:
+    name: Build and sign Windows artifacts
+    runs-on: windows-latest
+    env:
+      TAURI_TARGET: x86_64-pc-windows-msvc
+      BUN_TARGET: bun-windows-x64
+      WINDOWS_SIGNING_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
+      WINDOWS_TIMESTAMP_URL: ${{ secrets.WINDOWS_TIMESTAMP_URL || 'http://timestamp.digicert.com' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: 1.3.10
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Prepare sidecars
+        run: pnpm -C apps/desktop prepare:sidecar
+
+      - name: Import Windows signing certificate
+        shell: pwsh
+        env:
+          WINDOWS_CERT_PFX_BASE64: ${{ secrets.WINDOWS_CERT_PFX_BASE64 }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERT_PFX_BASE64)) {
+            throw "WINDOWS_CERT_PFX_BASE64 is required for Windows signing."
+          }
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_SIGNING_CERT_PASSWORD)) {
+            throw "WINDOWS_CERT_PASSWORD is required for Windows signing."
+          }
+          $bytes = [Convert]::FromBase64String($env:WINDOWS_CERT_PFX_BASE64)
+          $certPath = Join-Path $env:RUNNER_TEMP "windows-codesign.pfx"
+          [IO.File]::WriteAllBytes($certPath, $bytes)
+          "WINDOWS_CERT_PATH=$certPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Sign bundled Windows sidecars
+        shell: pwsh
+        run: |
+          $targets = @(
+            "apps/desktop/src-tauri/sidecars/opencode-$env:TAURI_TARGET.exe",
+            "apps/desktop/src-tauri/sidecars/opencode-router-$env:TAURI_TARGET.exe",
+            "apps/desktop/src-tauri/sidecars/openwork-server-v2-$env:TAURI_TARGET.exe"
+          )
+          foreach ($target in $targets) {
+            if (!(Test-Path $target)) {
+              throw "Expected Windows sidecar missing: $target"
+            }
+            signtool sign /fd SHA256 /td SHA256 /tr $env:WINDOWS_TIMESTAMP_URL /f $env:WINDOWS_CERT_PATH /p $env:WINDOWS_SIGNING_CERT_PASSWORD $target
+          }
+
+      - name: Build embedded Server V2 runtime
+        run: pnpm --filter openwork-server-v2 build:bin:embedded:windows --bundle-dir ../desktop/src-tauri/sidecars
+        working-directory: apps/server-v2
+
+      - name: Sign Server V2 executable
+        shell: pwsh
+        run: |
+          $serverPath = "apps/server-v2/dist/bin/openwork-server-v2-$env:BUN_TARGET.exe"
+          if (!(Test-Path $serverPath)) {
+            throw "Expected Server V2 executable missing: $serverPath"
+          }
+          signtool sign /fd SHA256 /td SHA256 /tr $env:WINDOWS_TIMESTAMP_URL /f $env:WINDOWS_CERT_PATH /p $env:WINDOWS_SIGNING_CERT_PASSWORD $serverPath
+          signtool verify /pa /v $serverPath
+
+      - name: Build desktop Windows bundle
+        run: pnpm --filter @openwork/desktop exec tauri build --target x86_64-pc-windows-msvc
+
+      - name: Sign desktop Windows artifacts
+        shell: pwsh
+        run: |
+          $artifacts = Get-ChildItem -Path "apps/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle" -Recurse -Include *.exe,*.msi
+          if ($artifacts.Count -eq 0) {
+            throw "No Windows desktop artifacts were produced to sign."
+          }
+          foreach ($artifact in $artifacts) {
+            signtool sign /fd SHA256 /td SHA256 /tr $env:WINDOWS_TIMESTAMP_URL /f $env:WINDOWS_CERT_PATH /p $env:WINDOWS_SIGNING_CERT_PASSWORD $artifact.FullName
+            signtool verify /pa /v $artifact.FullName
+          }
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-signed-artifacts
+          path: |
+            apps/server-v2/dist/bin/openwork-server-v2-*.exe
+            apps/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/**/*.exe
+            apps/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/**/*.msi
diff --git a/.gitignore b/.gitignore
index 1581ebe143..0e45300eac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,14 +1,49 @@
+.turbo/
 node_modules/
+apps/desktop/dist-electron/
+packages/*/node_modules/
+apps/*/node_modules/
+ee/apps/*/node_modules/
+ee/packages/*/node_modules/
 .next/
 out/
 dist/
+packages/*/dist/
+apps/*/dist/
+ee/apps/*/dist/
+ee/packages/*/dist/
+tmp/
+
+# Local git worktrees
+_worktrees/
 
 # Tauri/Rust
-src-tauri/target/
+packages/desktop/src-tauri/target/
+packages/desktop/src-tauri/sidecars/
+apps/desktop/src-tauri/target/
+apps/desktop/src-tauri/sidecars/
+apps/desktop/resources/sidecars/
 
 # Env
 .env
 .env.*
+!.env.example
+# The migration-release fragment is committed only on the tagged
+# migration-release commit and removed by 03-post-migration-cleanup.mjs.
+# Allow git to see it so `cut-migration-release` can commit it.
+!.env.migration-release
+
+# Bun build artifacts
+*.bun-build
+apps/server/cli
+apps/server-v2/openapi/openapi.json
+packages/openwork-server-sdk/generated/
+
+# pnpm store (created by Docker volume mounts)
+.pnpm-store/
+
+# Docker dev workspace (ephemeral mount point)
+packaging/docker/workspace/
 
 # OS
 .DS_Store
@@ -19,3 +54,9 @@ vendor/opencode/
 # OpenCode local deps
 .opencode/node_modules/
 .opencode/bun.lock
+
+# OpenWork workspace-local artifacts
+.opencode/openwork/
+.vercel
+.env*.local
+.claude/*
diff --git a/.infisical.json b/.infisical.json
new file mode 100644
index 0000000000..c91c16c84f
--- /dev/null
+++ b/.infisical.json
@@ -0,0 +1,5 @@
+{
+    "workspaceId": "e9f4542a-8714-46c3-a8fd-99d8cb370aeb",
+    "defaultEnvironment": "",
+    "gitBranchToEnvironmentMapping": null
+}
\ No newline at end of file
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000000..6c2b9be4c4
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+link-workspace-packages=true
+prefer-workspace-packages=true
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000000..a45fd52cc5
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/.opencode/agent/css.md b/.opencode/agent/css.md
new file mode 100644
index 0000000000..d5e68c7bf6
--- /dev/null
+++ b/.opencode/agent/css.md
@@ -0,0 +1,149 @@
+---
+description: use whenever you are styling a ui with css
+---
+
+you are very good at writing clean maintainable css using modern techniques
+
+css is structured like this
+
+```css
+[data-page="home"] {
+  [data-component="header"] {
+    [data-slot="logo"] {
+    }
+  }
+}
+```
+
+top level pages are scoped using `data-page`
+
+pages can break down into components using `data-component`
+
+components can break down into slots using `data-slot`
+
+structure things so that this hierarchy is followed IN YOUR CSS - you should rarely need to
+nest components inside other components. you should NEVER nest components inside
+slots. you should NEVER nest slots inside other slots.
+
+**IMPORTANT: This hierarchy rule applies to CSS structure, NOT JSX/DOM structure.**
+
+The hierarchy in css file does NOT have to match the hierarchy in the dom - you
+can put components or slots at the same level in CSS even if one goes inside another in the DOM.
+
+Your JSX can nest however makes semantic sense - components can be inside slots,
+slots can contain components, etc. The DOM structure should be whatever makes the most
+semantic and functional sense.
+
+It is more important to follow the pages -> components -> slots structure IN YOUR CSS,
+while keeping your JSX/DOM structure logical and semantic.
+
+use data attributes to represent different states of the component
+
+```css
+[data-component="modal"] {
+  opacity: 0;
+
+  &[data-state="open"] {
+    opacity: 1;
+  }
+}
+```
+
+this will allow jsx to control the styling
+
+avoid selectors that just target an element type like `> span` you should assign
+it a slot name. it's ok to do this sometimes where it makes sense semantically
+like targeting `li` elements in a list
+
+in terms of file structure `./src/style/` contains all universal styling rules.
+these should not contain anything specific to a page
+
+`./src/style/token` contains all the tokens used in the project
+
+`./src/style/component` is for reusable components like buttons or inputs
+
+page specific styles should go next to the page they are styling so
+`./src/routes/about.tsx` should have its styles in `./src/routes/about.css`
+
+`about.css` should be scoped using `data-page="about"`
+
+## Example of correct implementation
+
+JSX can nest however makes sense semantically:
+
+```jsx
+<div data-slot="left">
+  <div data-component="title">Section Title</div>
+  <div data-slot="content">Content here</div>
+</div>
+```
+
+CSS maintains clean hierarchy regardless of DOM nesting:
+
+```css
+[data-page="home"] {
+  [data-component="screenshots"] {
+    [data-slot="left"] {
+      /* styles */
+    }
+    [data-slot="content"] {
+      /* styles */
+    }
+  }
+
+  [data-component="title"] {
+    /* can be at same level even though nested in DOM */
+  }
+}
+```
+
+## Reusable Components
+
+If a component is reused across multiple sections of the same page, define it at the page level:
+
+```jsx
+<!-- Used in multiple places on the same page -->
+<section data-component="install">
+  <div data-component="method">
+    <h3 data-component="title">npm</h3>
+  </div>
+  <div data-component="method">
+    <h3 data-component="title">bun</h3>
+  </div>
+</section>
+
+<section data-component="screenshots">
+  <div data-slot="left">
+    <div data-component="title">Screenshot Title</div>
+  </div>
+</section>
+```
+
+```css
+[data-page="home"] {
+  /* Reusable title component defined at page level since it's used in multiple components */
+  [data-component="title"] {
+    text-transform: uppercase;
+    font-weight: 400;
+  }
+
+  [data-component="install"] {
+    /* install-specific styles */
+  }
+
+  [data-component="screenshots"] {
+    /* screenshots-specific styles */
+  }
+}
+```
+
+This is correct because the `title` component has consistent styling and behavior across the page.
+
+## Key Clarifications
+
+1. **JSX Nesting is Flexible**: Components can be nested inside slots, slots can contain components - whatever makes semantic sense
+2. **CSS Hierarchy is Strict**: Follow pages → components → slots structure in CSS
+3. **Reusable Components**: Define at the appropriate level where they're shared (page level if used across the page, component level if only used within that component)
+4. **DOM vs CSS Structure**: These don't need to match - optimize each for its purpose
+
+See ./src/routes/index.css and ./src/routes/index.tsx for a complete example.
diff --git a/.opencode/agent/docs.md b/.opencode/agent/docs.md
new file mode 100644
index 0000000000..21cfc6a16e
--- /dev/null
+++ b/.opencode/agent/docs.md
@@ -0,0 +1,34 @@
+---
+description: ALWAYS use this when writing docs
+color: "#38A3EE"
+---
+
+You are an expert technical documentation writer
+
+You are not verbose
+
+Use a relaxed and friendly tone
+
+The title of the page should be a word or a 2-3 word phrase
+
+The description should be one short line, should not start with "The", should
+avoid repeating the title of the page, should be 5-10 words long
+
+Chunks of text should not be more than 2 sentences long
+
+Each section is separated by a divider of 3 dashes
+
+The section titles are short with only the first letter of the word capitalized
+
+The section titles are in the imperative mood
+
+The section titles should not repeat the term used in the page title, for
+example, if the page title is "Models", avoid using a section title like "Add
+new models". This might be unavoidable in some cases, but try to avoid it.
+
+Check out the /packages/web/src/content/docs/docs/index.mdx as an example.
+
+For JS or TS code snippets remove trailing semicolons and any trailing commas
+that might not be needed.
+
+If you are making a commit prefix the commit message with `docs:`
diff --git a/.opencode/agent/duplicate-pr.md b/.opencode/agent/duplicate-pr.md
new file mode 100644
index 0000000000..c9c932ef79
--- /dev/null
+++ b/.opencode/agent/duplicate-pr.md
@@ -0,0 +1,26 @@
+---
+mode: primary
+hidden: true
+model: opencode/claude-haiku-4-5
+color: "#E67E22"
+tools:
+  "*": false
+  "github-pr-search": true
+---
+
+You are a duplicate PR detection agent. When a PR is opened, your job is to search for potentially duplicate or related open PRs.
+
+Use the github-pr-search tool to search for PRs that might be addressing the same issue or feature.
+
+IMPORTANT: The input will contain a line `CURRENT_PR_NUMBER: NNNN`. This is the current PR number, you should not mark that the current PR as a duplicate of itself.
+
+Search using keywords from the PR title and description. Try multiple searches with different relevant terms.
+
+If you find potential duplicates:
+
+- List them with their titles and URLs
+- Briefly explain why they might be related
+
+If no duplicates are found, say so clearly. BUT ONLY SAY "No duplicate PRs found" (don't say anything else if no dups)
+
+Keep your response concise and actionable.
diff --git a/.opencode/agent/triage.md b/.opencode/agent/triage.md
new file mode 100644
index 0000000000..5d1147a885
--- /dev/null
+++ b/.opencode/agent/triage.md
@@ -0,0 +1,78 @@
+---
+mode: primary
+hidden: true
+model: opencode/claude-haiku-4-5
+color: "#44BA81"
+tools:
+  "*": false
+  "github-triage": true
+---
+
+You are a triage agent responsible for triaging github issues.
+
+Use your github-triage tool to triage issues.
+
+## Labels
+
+### windows
+
+Use for any issue that mentions Windows (the OS). Be sure they are saying that they are on Windows.
+
+- Use if they mention WSL too
+
+#### perf
+
+Performance-related issues:
+
+- Slow performance
+- High RAM usage
+- High CPU usage
+
+**Only** add if it's likely a RAM or CPU issue. **Do not** add for LLM slowness.
+
+#### desktop
+
+Desktop app issues:
+
+- `opencode web` command
+- The desktop app itself
+
+**Only** add if it's specifically about the Desktop application or `opencode web` view. **Do not** add for terminal, TUI, or general opencode issues.
+
+#### nix
+
+**Only** add if the issue explicitly mentions nix.
+
+#### zen
+
+**Only** add if the issue mentions "zen" or "opencode zen" or "opencode black".
+
+If the issue doesn't have "zen" or "opencode black" in it then don't add zen label
+
+#### docs
+
+Add if the issue requests better documentation or docs updates.
+
+#### opentui
+
+TUI issues potentially caused by our underlying TUI library:
+
+- Keybindings not working
+- Scroll speed issues (too fast/slow/laggy)
+- Screen flickering
+- Crashes with opentui in the log
+
+**Do not** add for general TUI bugs.
+
+When assigning to people here are the following rules:
+
+adamdotdev:
+ONLY assign adam if the issue will have the "desktop" label.
+
+fwang:
+ONLY assign fwang if the issue will have the "zen" label.
+
+jayair:
+ONLY assign jayair if the issue will have the "docs" label.
+
+In all other cases use best judgment. Avoid assigning to kommander needlessly, when in doubt assign to rekram1-node.
diff --git a/.opencode/commands/browser-setup.md b/.opencode/commands/browser-setup.md
new file mode 100644
index 0000000000..240878a971
--- /dev/null
+++ b/.opencode/commands/browser-setup.md
@@ -0,0 +1,9 @@
+---
+name: browser-setup
+description: Guide user through Chrome browser automation setup
+---
+
+Help the user set up browser automation.
+
+Use the `browser-setup-devtools` skill and follow it strictly (Chrome DevTools MCP only).
+Keep the user prompt minimal and let the skill drive the setup dance.
diff --git a/.opencode/commands/hello-stranger.md b/.opencode/commands/hello-stranger.md
new file mode 100644
index 0000000000..47802aa711
--- /dev/null
+++ b/.opencode/commands/hello-stranger.md
@@ -0,0 +1,4 @@
+---
+description: Say hello stranger
+---
+hello stranger
diff --git a/.opencode/commands/release.md b/.opencode/commands/release.md
new file mode 100644
index 0000000000..9b78a6087e
--- /dev/null
+++ b/.opencode/commands/release.md
@@ -0,0 +1,22 @@
+---
+description: Run the OpenWork release flow
+---
+
+You are running the OpenWork release flow in this repo.
+
+Arguments: `$ARGUMENTS`
+- If empty, default to a patch release.
+- If set to `minor` or `major`, use that bump type.
+
+Do the following, in order, and stop on any failure:
+
+1. Sync `dev` and ensure the working tree is clean.
+2. Bump app/desktop versions using `pnpm bump:$ARGUMENTS` (or `pnpm bump:patch` if empty).
+3. If any dependencies were pinned or changed, run `pnpm install --lockfile-only`.
+4. Run `pnpm release:review` and resolve any mismatches.
+5. Tag and push: `git tag vX.Y.Z` and `git push origin vX.Y.Z`, then `git push origin dev`.
+6. Watch the Release App GitHub Actions workflow to completion.
+7. If releasing openwork-orchestrator sidecars, build deterministically with `SOURCE_DATE_EPOCH`, upload assets to `openwork-orchestrator-vX.Y.Z`, and publish `openwork-orchestrator`.
+8. If `openwork-server` or `opencode-router` versions changed, publish those packages.
+
+Report what you changed, the tag created, and the GHA status.
diff --git a/.opencode/openwork.json b/.opencode/openwork.json
new file mode 100644
index 0000000000..5cf9aba26b
--- /dev/null
+++ b/.opencode/openwork.json
@@ -0,0 +1,5 @@
+{
+  "messaging": {
+    "enabled": true
+  }
+}
diff --git a/.opencode/package-lock.json b/.opencode/package-lock.json
new file mode 100644
index 0000000000..46ddb1c8a0
--- /dev/null
+++ b/.opencode/package-lock.json
@@ -0,0 +1,376 @@
+{
+  "name": ".opencode",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@opencode-ai/plugin": "1.4.9"
+      }
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.3.tgz",
+      "integrity": "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.3.tgz",
+      "integrity": "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.3.tgz",
+      "integrity": "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.3.tgz",
+      "integrity": "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.3.tgz",
+      "integrity": "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.3.tgz",
+      "integrity": "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode-ai/plugin": {
+      "version": "1.4.9",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.4.9.tgz",
+      "integrity": "sha512-tUtPbPs5xP9wonwuz5d/2y8QTrqFR8HOtAVTXvZ6iG26NJfW0dnnw9oTusVOayEIemd5abytCESm7X9ZZOMftQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@opencode-ai/sdk": "1.4.9",
+        "effect": "4.0.0-beta.48",
+        "zod": "4.1.8"
+      },
+      "peerDependencies": {
+        "@opentui/core": ">=0.1.100",
+        "@opentui/solid": ">=0.1.100"
+      },
+      "peerDependenciesMeta": {
+        "@opentui/core": {
+          "optional": true
+        },
+        "@opentui/solid": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@opencode-ai/sdk": {
+      "version": "1.4.9",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.4.9.tgz",
+      "integrity": "sha512-S8WQLuBFu2WwvSc1wupsV4qskniBA+JN1VaZZs52BPWwiN2zQFTD5/6dMh6oiYOMDtPjKsTFZ6qLFxDvVPNggQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "7.0.6"
+      }
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/effect": {
+      "version": "4.0.0-beta.48",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.48.tgz",
+      "integrity": "sha512-MMAM/ZabuNdNmgXiin+BAanQXK7qM8mlt7nfXDoJ/Gn9V8i89JlCq+2N0AiWmqFLXjGLA0u3FjiOjSOYQk5uMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "fast-check": "^4.6.0",
+        "find-my-way-ts": "^0.1.6",
+        "ini": "^6.0.0",
+        "kubernetes-types": "^1.30.0",
+        "msgpackr": "^1.11.9",
+        "multipasta": "^0.2.7",
+        "toml": "^4.1.1",
+        "uuid": "^13.0.0",
+        "yaml": "^2.8.3"
+      }
+    },
+    "node_modules/fast-check": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.7.0.tgz",
+      "integrity": "sha512-NsZRtqvSSoCP0HbNjUD+r1JH8zqZalyp6gLY9e7OYs7NK9b6AHOs2baBFeBG7bVNsuoukh89x2Yg3rPsul8ziQ==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "pure-rand": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=12.17.0"
+      }
+    },
+    "node_modules/find-my-way-ts": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
+      "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
+      "license": "MIT"
+    },
+    "node_modules/ini": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-6.0.0.tgz",
+      "integrity": "sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/kubernetes-types": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
+      "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/msgpackr": {
+      "version": "1.11.10",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.11.10.tgz",
+      "integrity": "sha512-iCZNq+HszvF+fC3anCm4nBmWEnbeIAfpDs6IStAEKhQ2YSgkjzVG2FF9XJqwwQh5bH3N9OUTUt4QwVN6MLMLtA==",
+      "license": "MIT",
+      "optionalDependencies": {
+        "msgpackr-extract": "^3.0.2"
+      }
+    },
+    "node_modules/msgpackr-extract": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.3.tgz",
+      "integrity": "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "node-gyp-build-optional-packages": "5.2.2"
+      },
+      "bin": {
+        "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
+      },
+      "optionalDependencies": {
+        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3",
+        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3",
+        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3",
+        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3",
+        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3",
+        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3"
+      }
+    },
+    "node_modules/multipasta": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.7.tgz",
+      "integrity": "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA==",
+      "license": "MIT"
+    },
+    "node_modules/node-gyp-build-optional-packages": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
+      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "detect-libc": "^2.0.1"
+      },
+      "bin": {
+        "node-gyp-build-optional-packages": "bin.js",
+        "node-gyp-build-optional-packages-optional": "optional.js",
+        "node-gyp-build-optional-packages-test": "build-test.js"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pure-rand": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.0.tgz",
+      "integrity": "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/toml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.1.1.tgz",
+      "integrity": "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/uuid": {
+      "version": "13.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
+      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist-node/bin/uuid"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/yaml": {
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.1.8",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}
diff --git a/.opencode/skill/release/SKILL.md b/.opencode/skill/release/SKILL.md
deleted file mode 100644
index ba630cd348..0000000000
--- a/.opencode/skill/release/SKILL.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# release
-
-Create a human-friendly **unsigned macOS DMG** release for OpenWork (or similar Tauri apps), and publish it on GitHub.
-
-This skill is intentionally lightweight: it’s mostly a checklist + a couple of sanity scripts.
-
-## What this skill is for
-
-- You have a Tauri app.
-- You want to publish a **DMG** on GitHub Releases.
-- You are **not** code signing / notarizing yet (so macOS will warn users).
-
-## Prereqs
-
-- `pnpm`
-- Rust toolchain (`cargo`, `rustc`)
-- `gh` authenticated (`gh auth status`)
-- macOS tools: `codesign`, `spctl`, `hdiutil`
-
-## Release checklist (recommended)
-
-### 1) Clean working tree
-
-```bash
-git status
-```
-
-### 2) Bump version everywhere
-
-- `package.json` (`version`)
-- `src-tauri/tauri.conf.json` (`version`)
-- `src-tauri/Cargo.toml` (`version`)
-
-### 3) Validate builds
-
-```bash
-pnpm typecheck
-pnpm build:web
-cargo check --manifest-path src-tauri/Cargo.toml
-```
-
-### 4) Build DMG
-
-```bash
-pnpm tauri build --bundles dmg
-```
-
-This should produce something like:
-
-- `src-tauri/target/release/bundle/dmg/OpenWork_<version>_aarch64.dmg`
-
-### 5) Verify “unsigned” state
-
-Unsigned here means: **not Developer ID signed / not notarized**.
-
-Quick checks:
-
-```bash
-# mount the dmg read-only
-hdiutil attach -nobrowse -readonly "src-tauri/target/release/bundle/dmg/<DMG_NAME>.dmg"
-
-# verify signature details (expect ad-hoc or not notarized)
-codesign -dv --verbose=4 "/Volumes/<VOLUME>/<APP>.app"
-
-# gatekeeper assessment (expect rejected)
-spctl -a -vv "/Volumes/<VOLUME>/<APP>.app" || true
-
-# unmount
-hdiutil detach "/Volumes/<VOLUME>"
-```
-
-### 6) Tag + push
-
-```bash
-git commit -am "Prepare vX.Y.Z release"
-git tag -a vX.Y.Z -m "OpenWork vX.Y.Z"
-git push
-git push origin vX.Y.Z
-```
-
-### 7) Create / update GitHub Release
-
-```bash
-gh release create vX.Y.Z \
-  --title "OpenWork vX.Y.Z" \
-  --notes "<human summary>"
-
-gh release upload vX.Y.Z "src-tauri/target/release/bundle/dmg/<DMG_NAME>.dmg" --clobber
-```
-
-## Local helper scripts
-
-- `bun .opencode/skill/release/first-call.ts` checks prerequisites and prints the current version.
-
-## Notes
-
-- If you later add signing/notarization, this skill should be updated to include that flow.
diff --git a/.opencode/skill/release/client.ts b/.opencode/skill/release/client.ts
deleted file mode 100644
index bbc206e104..0000000000
--- a/.opencode/skill/release/client.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { spawn } from "node:child_process";
-
-export async function run(
-  command: string,
-  args: string[],
-  options?: { cwd?: string; allowFailure?: boolean },
-): Promise<{ ok: boolean; code: number; stdout: string; stderr: string }> {
-  const cwd = options?.cwd;
-
-  const child = spawn(command, args, {
-    cwd,
-    stdio: ["ignore", "pipe", "pipe"],
-    env: process.env,
-  });
-
-  let stdout = "";
-  let stderr = "";
-
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-
-  child.stdout.on("data", (d) => (stdout += d));
-  child.stderr.on("data", (d) => (stderr += d));
-
-  const code = await new Promise<number>((resolve) => {
-    child.on("close", (c) => resolve(c ?? -1));
-  });
-
-  const ok = code === 0;
-  if (!ok && !options?.allowFailure) {
-    throw new Error(
-      `Command failed (${code}): ${command} ${args.join(" ")}\n${stderr || stdout}`,
-    );
-  }
-
-  return { ok, code, stdout, stderr };
-}
diff --git a/.opencode/skill/release/first-call.ts b/.opencode/skill/release/first-call.ts
deleted file mode 100644
index 26093d4c5a..0000000000
--- a/.opencode/skill/release/first-call.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { loadEnv } from "./load-env";
-import { run } from "./client";
-
-async function main() {
-  await loadEnv();
-
-  await run("gh", ["auth", "status"], { allowFailure: false });
-
-  const pkgRaw = await readFile("package.json", "utf8");
-  const pkg = JSON.parse(pkgRaw) as { name?: string; version?: string };
-
-  console.log(
-    JSON.stringify(
-      {
-        ok: true,
-        package: pkg.name ?? null,
-        version: pkg.version ?? null,
-        next: [
-          "pnpm typecheck",
-          "pnpm tauri build --bundles dmg",
-          "gh release upload vX.Y.Z <dmg> --clobber",
-        ],
-      },
-      null,
-      2,
-    ),
-  );
-}
-
-main().catch((e) => {
-  const message = e instanceof Error ? e.message : String(e);
-  console.error(message);
-  process.exit(1);
-});
diff --git a/.opencode/skill/release/load-env.ts b/.opencode/skill/release/load-env.ts
deleted file mode 100644
index e8fec9d65a..0000000000
--- a/.opencode/skill/release/load-env.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { run } from "./client";
-
-const REQUIRED = [
-  "pnpm",
-  "cargo",
-  "gh",
-  "hdiutil",
-  "codesign",
-  "spctl",
-];
-
-export async function loadEnv() {
-  const missing: string[] = [];
-
-  for (const bin of REQUIRED) {
-    try {
-      await run("/usr/bin/env", ["bash", "-lc", `command -v ${bin}`], { allowFailure: false });
-    } catch {
-      missing.push(bin);
-    }
-  }
-
-  if (missing.length) {
-    throw new Error(`Missing required tools: ${missing.join(", ")}`);
-  }
-
-  return { ok: true as const };
-}
diff --git a/.opencode/skills/browser-setup-devtools/SKILL.md b/.opencode/skills/browser-setup-devtools/SKILL.md
new file mode 100644
index 0000000000..4daca7d74a
--- /dev/null
+++ b/.opencode/skills/browser-setup-devtools/SKILL.md
@@ -0,0 +1,37 @@
+---
+name: browser-setup-devtools
+description: Guide users through browser automation setup using Chrome DevTools MCP only. Use when the user asks to set up browser automation, Chrome DevTools MCP, browser MCP, or runs the browser-setup command.
+---
+
+# Browser automation setup (Chrome DevTools MCP)
+
+## Principles
+
+- Keep prompts minimal; do as much as possible with tools and commands.
+- Use Chrome DevTools MCP only.
+
+## Workflow
+
+1. Ask: "Do you have Chrome installed on this computer?"
+2. If no or unsure:
+   - Offer to open the download page yourself and do it if possible.
+   - Provide a clickable link: https://www.google.com/chrome/
+   - Continue after installation is confirmed.
+3. Check DevTools MCP availability:
+   - Call `chrome-devtools_list_pages`.
+   - If pages exist, select one with `chrome-devtools_select_page`.
+   - If no pages, create one with `chrome-devtools_new_page` (use https://example.com) and then select it.
+4. If DevTools MCP calls fail:
+   - Ask the user to open Chrome and keep it running.
+   - Retry `chrome-devtools_list_pages`.
+   - If it still fails, ensure `opencode.jsonc` includes `mcp["chrome-devtools"]` with command `['npx', '-y', 'chrome-devtools-mcp@latest']` and ask the user to restart OpenWork/OpenCode.
+   - Retry the DevTools MCP check.
+5. If DevTools MCP is ready:
+   - Offer a first task ("Let's try opening a webpage").
+   - If yes, use `chrome-devtools_navigate_page` or `chrome-devtools_new_page` to open the URL and confirm completion.
+
+## Response rules
+
+- Keep each user prompt to one short sentence when possible.
+- Use direct offers like "I can open Chrome now" and follow with tool actions.
+- Always present links as clickable URLs.
diff --git a/.opencode/skills/cargo-lock-manager/.gitignore b/.opencode/skills/cargo-lock-manager/.gitignore
new file mode 100644
index 0000000000..2334d82b84
--- /dev/null
+++ b/.opencode/skills/cargo-lock-manager/.gitignore
@@ -0,0 +1,2 @@
+.env
+*.log
diff --git a/.opencode/skills/cargo-lock-manager/SKILL.md b/.opencode/skills/cargo-lock-manager/SKILL.md
new file mode 100644
index 0000000000..e7522f8d2d
--- /dev/null
+++ b/.opencode/skills/cargo-lock-manager/SKILL.md
@@ -0,0 +1,67 @@
+---
+name: cargo-lock-manager
+description: |
+  Manages Cargo.lock file updates and resolves --locked flag issues in CI/CD.
+
+  Triggers when user mentions:
+  - "cargo test --locked failed"
+  - "cannot update the lock file"
+  - "Cargo.lock is out of date"
+  - "PR failed with --locked error"
+  - "fix Cargo.lock"
+---
+
+## Quick Usage (Already Configured)
+
+### Check Cargo.lock status
+```bash
+cd packages/desktop/src-tauri
+cargo check --locked 2>&1 | head -20
+```
+
+### Update Cargo.lock locally
+```bash
+cd packages/desktop/src-tauri
+cargo update --workspace
+```
+
+### Test with --locked after update
+```bash
+cd packages/desktop/src-tauri
+cargo test --locked
+```
+
+## Common Gotchas
+
+- The `--locked` flag prevents automatic updates to Cargo.lock, which is good for reproducible builds but fails when dependencies change.
+- PRs often fail because the lock file wasn't committed after dependency updates.
+- Running `cargo update` without `--workspace` may not update all workspace members.
+
+## When CI Fails with --locked
+
+### Option 1: Update lock file and commit (Recommended)
+```bash
+cd packages/desktop/src-tauri
+cargo update --workspace
+git add Cargo.lock
+git commit -m "chore: update Cargo.lock"
+git push
+```
+
+### Option 2: Use --offline flag (for air-gapped environments)
+```bash
+cargo test --manifest-path packages/desktop/src-tauri/Cargo.toml --offline
+```
+
+## First-Time Setup (If Not Configured)
+
+No setup required. This skill assumes:
+- Rust/Cargo is installed
+- You're in the openwork repository
+- The Tauri app is in `packages/desktop/src-tauri/`
+
+## Prevention Tips
+
+- Always run `cargo check` or `cargo build` after modifying `Cargo.toml` files
+- Include `Cargo.lock` changes in the same commit as dependency updates
+- Consider adding a pre-commit hook to verify lock file is up to date
diff --git a/.opencode/skills/cargo-lock-manager/scripts/check-lock.sh b/.opencode/skills/cargo-lock-manager/scripts/check-lock.sh
new file mode 100755
index 0000000000..4681a1edb1
--- /dev/null
+++ b/.opencode/skills/cargo-lock-manager/scripts/check-lock.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# Check if Cargo.lock is up to date with --locked flag
+# Exit 0 if OK, exit 1 if needs update
+
+set -e
+
+CARGO_TOML="${1:-apps/desktop/src-tauri/Cargo.toml}"
+
+echo "🔍 Checking Cargo.lock status for: $CARGO_TOML"
+
+if cargo check --manifest-path "$CARGO_TOML" --locked 2>&1; then
+    echo "✅ Cargo.lock is up to date"
+    exit 0
+else
+    echo "❌ Cargo.lock needs update"
+    echo ""
+    echo "To fix, run:"
+    echo "  cd $(dirname "$CARGO_TOML") && cargo update --workspace"
+    exit 1
+fi
diff --git a/.opencode/skills/cargo-lock-manager/scripts/update-lock.sh b/.opencode/skills/cargo-lock-manager/scripts/update-lock.sh
new file mode 100755
index 0000000000..dd2bea69ba
--- /dev/null
+++ b/.opencode/skills/cargo-lock-manager/scripts/update-lock.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+# Update Cargo.lock for the Tauri workspace
+
+set -e
+
+CARGO_TOML="${1:-apps/desktop/src-tauri/Cargo.toml}"
+WORKDIR=$(dirname "$CARGO_TOML")
+
+echo "📦 Updating Cargo.lock in: $WORKDIR"
+
+cd "$WORKDIR"
+cargo update --workspace
+
+echo ""
+echo "✅ Cargo.lock updated"
+echo "📝 Don't forget to commit the changes!"
diff --git a/.opencode/skills/get-started/SKILL.md b/.opencode/skills/get-started/SKILL.md
new file mode 100644
index 0000000000..b8a4848ff2
--- /dev/null
+++ b/.opencode/skills/get-started/SKILL.md
@@ -0,0 +1,22 @@
+---
+name: get-started
+description: Guide users through the get started setup and Chrome DevTools demo.
+---
+
+## When to use
+
+- Always load this skill when the user says "get started".
+
+## What to do
+
+- Reply with these four lines, exactly and in order:
+
+  1) hey there welcome this is openwork
+  2) we've pre-configured you with a couple tools
+  3) Get Started
+  4) write "hey go on google.com"
+
+## Then
+
+- If the user writes "go on google.com" (or "hey go on google.com"), use the chrome-devtools MCP to open the site.
+- After the navigation completes, reply: "I'm on <site>" where <site> is the final URL or page title they asked for.
diff --git a/.opencode/skill/opencode-bridge/SKILL.md b/.opencode/skills/opencode-bridge/SKILL.md
similarity index 100%
rename from .opencode/skill/opencode-bridge/SKILL.md
rename to .opencode/skills/opencode-bridge/SKILL.md
diff --git a/.opencode/skill/opencode-mirror/SKILL.md b/.opencode/skills/opencode-mirror/SKILL.md
similarity index 86%
rename from .opencode/skill/opencode-mirror/SKILL.md
rename to .opencode/skills/opencode-mirror/SKILL.md
index 9d5c579864..cf3359934e 100644
--- a/.opencode/skill/opencode-mirror/SKILL.md
+++ b/.opencode/skills/opencode-mirror/SKILL.md
@@ -19,5 +19,5 @@ git -C vendor/opencode pull --ff-only
 
 ### Clone mirror
 ```bash
-git clone https://github.com/opencode-ai/opencode vendor/opencode
+git clone https://github.com/anomalyco/opencode vendor/opencode
 ```
diff --git a/.opencode/skills/opencode-primitives/SKILL.md b/.opencode/skills/opencode-primitives/SKILL.md
new file mode 100644
index 0000000000..c35e478c4e
--- /dev/null
+++ b/.opencode/skills/opencode-primitives/SKILL.md
@@ -0,0 +1,47 @@
+---
+name: opencode-primitives
+description: Reference OpenCode docs when implementing skills, plugins, MCPs, or config-driven behavior.
+---
+
+## Purpose
+Use this skill whenever OpenWork behavior is implemented directly on top of OpenCode primitives (skills, plugins, MCP servers, opencode.json config, tools/permissions). It anchors decisions to the official OpenCode documentation and keeps terminology consistent in the UI.
+
+## Doc Sources (Always cite when relevant)
+- Skills: https://opencode.ai/docs/skills
+- Plugins: https://opencode.ai/docs/plugins/
+- MCP servers: https://opencode.ai/docs/mcp-servers/
+- Config (opencode.json, locations, precedence): https://opencode.ai/docs/config/
+
+## Key Facts To Apply
+### Skills
+- Skill files live in `.opencode/skills/<name>/SKILL.md` or global `~/.config/opencode/skills/<name>/SKILL.md`.
+- Skills are discovered by walking up to the git worktree and loading any matching `skills/*/SKILL.md` in `.opencode/` or `.claude/skills/`.
+- `SKILL.md` requires YAML frontmatter: `name` + `description`.
+- Name rules: lowercase alphanumeric with single hyphens (`^[a-z0-9]+(-[a-z0-9]+)*$`), length 1-64, must match directory name.
+- Description length: 1-1024 characters.
+- Access is governed by `opencode.json` permissions (`permission.skill` allow/deny/ask).
+
+### Plugins
+- Local plugins live in `.opencode/plugins/` (project) or `~/.config/opencode/plugins/` (global).
+- npm plugins are listed in `opencode.json` under `plugin` and installed with Bun at startup.
+- Load order: global config, project config, global plugins dir, project plugins dir.
+
+### MCP Servers
+- MCP servers are defined in `opencode.json` under `mcp` with unique names.
+- Local servers use `type: "local"` + `command` array; remote servers use `type: "remote"` + `url`.
+- Servers can be enabled/disabled via `enabled`.
+- MCP tools are managed via `tools` in config, including glob patterns.
+- OAuth is handled automatically for remote servers; can be pre-registered or disabled.
+
+### Config (opencode.json)
+- Supports JSON and JSONC.
+- Precedence order: remote `.well-known/opencode` -> global `~/.config/opencode/opencode.json` -> custom path -> project `opencode.json` -> `.opencode/` directories -> inline env overrides.
+- `.opencode` subdirectories are plural by default (`agents/`, `commands/`, `plugins/`, `skills/`, `tools/`, `themes/`), with singular names supported for compatibility.
+
+## When to Invoke
+- Adding or adjusting OpenWork flows that reference skills, plugins, MCP servers, or OpenCode config.
+- Designing onboarding guidance that mentions skill/plugin installation, config locations, or permission prompts.
+- Implementing UIs that surface OpenCode primitives (skills tab, plugin manager, MCP toggles).
+
+## Usage
+Call `skill({ name: "opencode-primitives" })` before implementing or documenting any OpenWork behavior that maps to OpenCode primitives.
diff --git a/.opencode/skill/openwork-core/SKILL.md b/.opencode/skills/openwork-core/SKILL.md
similarity index 86%
rename from .opencode/skill/openwork-core/SKILL.md
rename to .opencode/skills/openwork-core/SKILL.md
index cd92a4660e..ac668d2fde 100644
--- a/.opencode/skill/openwork-core/SKILL.md
+++ b/.opencode/skills/openwork-core/SKILL.md
@@ -6,7 +6,7 @@ description: Core context and guardrails for OpenWork native app
 ## Quick Usage (Already Configured)
 
 ### Orientation
-- Read `AGENTS.md` and `design-prd.md` before changing behavior.
+- Read `AGENTS.md`, `VISION.md`, `PRINCIPLES.md`, `PRODUCT.md`, and `ARCHITECTURE.md` before changing behavior.
 - Ensure `vendor/opencode` exists for self-reference.
 - Use the `tauri-solidjs` skill for stack-specific guidance.
 
@@ -20,6 +20,9 @@ git -C vendor/opencode pull --ff-only
 pnpm tauri dev          # Desktop development
 pnpm tauri ios dev      # iOS development
 pnpm tauri android dev  # Android development
+
+# Or run directly in the desktop package:
+pnpm -C packages/desktop tauri dev
 ```
 
 ## OpenCode Integration
@@ -58,7 +61,7 @@ opencode -p "your prompt" -f json -q
 
 ### Clone the OpenCode mirror
 ```bash
-git clone https://github.com/opencode-ai/opencode vendor/opencode
+git clone https://github.com/anomalyco/opencode vendor/opencode
 ```
 
 ### Initialize Tauri project
@@ -81,5 +84,5 @@ pnpm tauri android init
 
 ### Clone the OpenCode mirror
 ```bash
-git clone https://github.com/opencode-ai/opencode vendor/opencode
+git clone https://github.com/anomalyco/opencode vendor/opencode
 ```
diff --git a/.opencode/skills/openwork-debug/SKILL.md b/.opencode/skills/openwork-debug/SKILL.md
new file mode 100644
index 0000000000..f0615605e2
--- /dev/null
+++ b/.opencode/skills/openwork-debug/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: openwork-debug
+description: Debug OpenWork sidecars, config, and audit trail
+---
+
+## Credential check
+
+Set these before running the HTTP checks:
+
+- `OPENWORK_SERVER_URL`
+- `OPENWORK_SERVER_TOKEN`
+- `OPENWORK_WORKSPACE_ID` (optional; use `/workspaces` to discover)
+
+## Quick usage (read-only)
+
+```bash
+curl -s "$OPENWORK_SERVER_URL/health"
+curl -s "$OPENWORK_SERVER_URL/capabilities" \
+  -H "Authorization: Bearer $OPENWORK_SERVER_TOKEN"
+
+curl -s "$OPENWORK_SERVER_URL/workspaces" \
+  -H "Authorization: Bearer $OPENWORK_SERVER_TOKEN"
+```
+
+## Workspace config snapshot
+
+```bash
+curl -s "$OPENWORK_SERVER_URL/workspace/$OPENWORK_WORKSPACE_ID/config" \
+  -H "Authorization: Bearer $OPENWORK_SERVER_TOKEN"
+```
+
+## Audit log (recent)
+
+```bash
+curl -s "$OPENWORK_SERVER_URL/workspace/$OPENWORK_WORKSPACE_ID/audit?limit=25" \
+  -H "Authorization: Bearer $OPENWORK_SERVER_TOKEN"
+```
+
+## OpenCode engine checks
+
+```bash
+opencode -p "ping" -f json -q
+opencode mcp list
+opencode mcp debug <name>
+```
+
+## DB fallback (read-only)
+
+When the engine API is unavailable, you can inspect the SQLite db:
+
+```bash
+sqlite3 ~/.opencode/opencode.db "select id, title, status from sessions order by updated_at desc limit 5;"
+sqlite3 ~/.opencode/opencode.db "select role, content from messages order by created_at desc limit 10;"
+```
+
+## Notes
+
+- Audit logs are stored at `.opencode/openwork/audit.jsonl` in the workspace root.
+- OpenWork server writes only within approved workspace roots.
diff --git a/.opencode/skills/openwork-orchestrator-npm-publish/.env.example b/.opencode/skills/openwork-orchestrator-npm-publish/.env.example
new file mode 100644
index 0000000000..8c3e04f3cb
--- /dev/null
+++ b/.opencode/skills/openwork-orchestrator-npm-publish/.env.example
@@ -0,0 +1 @@
+NPM_TOKEN=
diff --git a/.opencode/skills/openwork-orchestrator-npm-publish/.gitignore b/.opencode/skills/openwork-orchestrator-npm-publish/.gitignore
new file mode 100644
index 0000000000..4c49bd78f1
--- /dev/null
+++ b/.opencode/skills/openwork-orchestrator-npm-publish/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/.opencode/skills/openwork-orchestrator-npm-publish/SKILL.md b/.opencode/skills/openwork-orchestrator-npm-publish/SKILL.md
new file mode 100644
index 0000000000..fb3e5cbedf
--- /dev/null
+++ b/.opencode/skills/openwork-orchestrator-npm-publish/SKILL.md
@@ -0,0 +1,83 @@
+---
+name: openwork-orchestrator-npm-publish
+description: |
+  Publish the openwork-orchestrator npm package with clean git hygiene.
+
+  Triggers when user mentions:
+  - "openwork-orchestrator npm publish"
+  - "publish openwork-orchestrator"
+  - "bump openwork-orchestrator"
+---
+
+## Quick usage (already configured)
+
+1. Ensure you are on the default branch and the tree is clean.
+2. Bump versions via the shared release bump (this keeps `openwork-orchestrator` aligned with the app/desktop release).
+
+```bash
+pnpm bump:patch
+# or: pnpm bump:minor
+# or: pnpm bump:major
+# or: pnpm bump:set -- X.Y.Z
+```
+
+3. Commit the bump.
+4. Preferred: publish via the "Release App" GitHub Actions workflow by tagging `vX.Y.Z`.
+
+Manual recovery path (sidecars + npm) below.
+
+```bash
+pnpm --filter openwork-orchestrator build:sidecars
+gh release create openwork-orchestrator-vX.Y.Z packages/orchestrator/dist/sidecars/* \
+  --repo different-ai/openwork \
+  --title "openwork-orchestrator vX.Y.Z sidecars" \
+  --notes "Sidecar binaries and manifest for openwork-orchestrator vX.Y.Z"
+```
+
+5. Build openwork-orchestrator binaries for all supported platforms.
+
+```bash
+pnpm --filter openwork-orchestrator build:bin:all
+```
+
+6. Publish `openwork-orchestrator` as a meta package + platform packages (optionalDependencies).
+
+```bash
+node packages/orchestrator/scripts/publish-npm.mjs
+```
+
+7. Verify the published version.
+
+```bash
+npm view openwork-orchestrator version
+```
+
+---
+
+## Scripted publish
+
+```bash
+./.opencode/skills/openwork-orchestrator-npm-publish/scripts/publish-openwork-orchestrator.sh
+```
+
+---
+
+## First-time setup (if not configured)
+
+Authenticate with npm before publishing.
+
+```bash
+npm login
+```
+
+Alternatively, export an npm token in your environment (see `.env.example`).
+
+---
+
+## Notes
+
+- `openwork-orchestrator` is published as:
+  - `openwork-orchestrator` (wrapper + optionalDependencies)
+  - `openwork-orchestrator-darwin-arm64`, `openwork-orchestrator-darwin-x64`, `openwork-orchestrator-linux-arm64`, `openwork-orchestrator-linux-x64`, `openwork-orchestrator-windows-x64` (platform binaries)
+- `openwork-orchestrator` is versioned in lockstep with OpenWork app/desktop releases.
+- openwork-orchestrator downloads sidecars from `openwork-orchestrator-vX.Y.Z` release assets by default.
diff --git a/.opencode/skills/openwork-orchestrator-npm-publish/scripts/publish-openwork-orchestrator.sh b/.opencode/skills/openwork-orchestrator-npm-publish/scripts/publish-openwork-orchestrator.sh
new file mode 100755
index 0000000000..dc6a6749e5
--- /dev/null
+++ b/.opencode/skills/openwork-orchestrator-npm-publish/scripts/publish-openwork-orchestrator.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(git rev-parse --show-toplevel)"
+cd "$root"
+
+if [ -n "$(git status --porcelain)" ]; then
+  echo "Working tree is dirty. Commit or stash before publish."
+  exit 1
+fi
+
+version=$(node -p "require('./apps/orchestrator/package.json').version")
+echo "Publishing openwork-orchestrator@$version"
+
+pnpm --filter openwork-orchestrator publish --access public
diff --git a/.opencode/skills/release/SKILL.md b/.opencode/skills/release/SKILL.md
new file mode 100644
index 0000000000..97bd034bf0
--- /dev/null
+++ b/.opencode/skills/release/SKILL.md
@@ -0,0 +1,54 @@
+---
+title: Release flow
+description: Step through versioning, tagging, and verification
+name: release
+---
+
+## Prepare
+Confirm the repo is on `main` and clean. Keep changes aligned with OpenCode primitives like `.opencode`, `opencode.json`, skills, and plugins when relevant.
+
+---
+
+## Bump
+Update versions in `packages/app/package.json`, `packages/desktop/package.json`, `packages/orchestrator/package.json` (publishes as `openwork-orchestrator`), `packages/desktop/src-tauri/tauri.conf.json`, and `packages/desktop/src-tauri/Cargo.toml`. Use one of these commands.
+
+```bash
+pnpm bump:patch
+pnpm bump:minor
+pnpm bump:major
+pnpm bump:set -- 0.1.21
+```
+
+---
+
+## Merge
+Merge the version bump into `main`. Make sure no secrets or credentials are committed.
+
+---
+
+## Tag
+Create and push the tag to trigger the Release App workflow.
+
+```bash
+git tag vX.Y.Z
+git push origin vX.Y.Z
+```
+
+---
+
+## Rerun
+If a tag needs a rerun, dispatch the workflow.
+
+```bash
+gh workflow run "Release App" --repo different-ai/openwork -f tag=vX.Y.Z
+```
+
+---
+
+## Verify
+Confirm the run and the published release.
+
+```bash
+gh run list --repo different-ai/openwork --workflow "Release App" --limit 5
+gh release view vX.Y.Z --repo different-ai/openwork
+```
diff --git a/.opencode/skills/solidjs-patterns/SKILL.md b/.opencode/skills/solidjs-patterns/SKILL.md
new file mode 100644
index 0000000000..949a953ded
--- /dev/null
+++ b/.opencode/skills/solidjs-patterns/SKILL.md
@@ -0,0 +1,93 @@
+---
+name: solidjs-patterns
+description: SolidJS reactivity + UI state patterns for OpenWork
+---
+
+## Why this skill exists
+
+OpenWork’s UI is SolidJS: it updates via **signals**, not React-style rerenders.
+Most “UI stuck” bugs are actually **state coupling** bugs (e.g. one global `busy()` disabling an unrelated action), not rerender issues.
+
+This skill captures the patterns we want to consistently use in OpenWork.
+
+## Core rules
+
+- Prefer **fine-grained signals** over shared global flags.
+- Keep async actions **scoped** (each action gets its own `pending` state).
+- Derive UI state via `createMemo()` instead of duplicating booleans.
+- Avoid mutating arrays/objects stored in signals; always create new values.
+
+## Scoped async actions (recommended)
+
+When an operation can overlap with others (permissions, installs, background refresh), don’t reuse a global `busy()`.
+
+Use a dedicated signal per action:
+
+```ts
+const [replying, setReplying] = createSignal(false);
+
+async function respond() {
+  if (replying()) return;
+  setReplying(true);
+  try {
+    await doTheThing();
+  } finally {
+    setReplying(false);
+  }
+}
+```
+
+### Why
+
+A single `busy()` boolean creates deadlocks:
+
+- Long-running task sets `busy(true)`
+- A permission prompt appears and its buttons are disabled by `busy()`
+- The task can’t continue until permission is answered
+- The user can’t answer because buttons are disabled
+
+Fix: permission UI must be disabled only by a **permission-specific** pending state.
+
+## Signal snapshots in async handlers
+
+If you read signals inside an async function and you need stable values, snapshot early:
+
+```ts
+const request = activePermission();
+if (!request) return;
+const requestID = request.id;
+
+await respondPermission(requestID, "always");
+```
+
+## Derived UI state
+
+Prefer `createMemo()` for computed disabled states:
+
+```ts
+const canSend = createMemo(() => prompt().trim().length > 0 && !busy());
+```
+
+## Lists
+
+- Use setter callbacks for derived updates:
+
+```ts
+setItems((current) => current.filter((x) => x.id !== id));
+```
+
+- Don’t mutate `current` in-place.
+
+## Practical checklist (SolidJS UI changes)
+
+- Does any button depend on a global flag that could be true during long-running work?
+- Could two async actions overlap and fight over one boolean?
+- Is any UI state duplicated (can be derived instead)?
+- Do event handlers read signals after an `await` where values might have changed?
+- If you refactor props/types, did you update all intermediate component signatures and call sites?
+
+## References
+
+- SolidJS: https://www.solidjs.com/docs/latest
+- SolidJS signals: https://www.solidjs.com/docs/latest/api#createsignal
+- SolidJS memos: https://www.solidjs.com/docs/latest/api#creatememo
diff --git a/.opencode/skill/tauri-solidjs/SKILL.md b/.opencode/skills/tauri-solidjs/SKILL.md
similarity index 78%
rename from .opencode/skill/tauri-solidjs/SKILL.md
rename to .opencode/skills/tauri-solidjs/SKILL.md
index f3c34e4372..c6a5c469f3 100644
--- a/.opencode/skill/tauri-solidjs/SKILL.md
+++ b/.opencode/skills/tauri-solidjs/SKILL.md
@@ -34,25 +34,28 @@ pnpm tauri android build
 ## Project Structure
 
 ```
-apps/openwork/
-  src-tauri/
-    src/
-      main.rs           # Rust entry point
-      lib.rs            # Tauri commands and state
-    Cargo.toml          # Rust dependencies
-    tauri.conf.json     # Tauri configuration
-    capabilities/       # Permission capabilities
-  src/
-    App.tsx             # SolidJS root component
-    index.tsx           # Entry point
-    components/         # UI components
-    stores/             # Solid stores for state
-    lib/                # Utilities and OpenCode bridge
-  index.html            # HTML template
-  package.json          # Frontend dependencies
-  vite.config.ts        # Vite configuration
+openwork/
+  packages/
+    desktop/
+      src-tauri/
+        src/
+          main.rs           # Rust entry point
+          lib.rs            # Tauri commands and state
+        Cargo.toml          # Rust dependencies
+        tauri.conf.json     # Tauri configuration
+        capabilities/       # Permission capabilities
+      src/
+        App.tsx             # SolidJS root component
+        index.tsx           # Entry point
+      components/           # UI components
+      stores/               # Solid stores for state
+      lib/                  # Utilities and OpenCode bridge
+      index.html            # HTML template
+      package.json          # Frontend dependencies
+      vite.config.ts        # Vite configuration
 ```
 
+
 ## Key Dependencies
 
 ### Frontend (package.json)
@@ -88,7 +91,7 @@ serde_json = "1"
 ## Tauri Commands (Rust -> JS)
 
 ```rust
-// src-tauri/src/lib.rs
+// packages/desktop/src-tauri/src/lib.rs
 use tauri::Manager;
 
 #[tauri::command]
diff --git a/.vercelignore b/.vercelignore
new file mode 100644
index 0000000000..8de21fa1de
--- /dev/null
+++ b/.vercelignore
@@ -0,0 +1,15 @@
+_archive
+_worktrees
+.git
+.opencode
+vendor
+**/node_modules
+**/.next
+**/dist
+**/.*.bun-build
+packages/agent-lab
+packages/desktop
+packages/headless
+packages/opencode-router
+packages/owpenbot
+packages/server
diff --git a/AGENTS.md b/AGENTS.md
index 85537a2006..9958c15e2b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,86 +1,273 @@
 # AGENTS.md
 
-OpenWork exists to bring OpenCode's agentic power to non-technical people through an accessible, transparent **native GUI**. It is an open-source competitor to Anthropic's Cowork and must stay faithful to OpenCode's principles: self-building, self-referential, standards-first, and graceful degradation.
+OpenWork helps users run agents, skills, and MCP. It is an open-source alternative to Claude Cowork/Codex as a desktop app.
+
+## What OpenWork Is
+
+OpenWork is a practical control surface for agentic work:
+
+* Run local and remote agent workflows from one place.
+* Use OpenCode capabilities directly through OpenWork.
+* Compose desktop app, server, and messaging connectors without lock-in.
+* Treat the OpenWork app as a client of the OpenWork server API surface.
+* Connect to hosted workers through a simple user flow: `Add a worker` -> `Connect remote`.
+
+## Core Philosophy
+
+* **Local-first, cloud-ready**: OpenWork runs on your machine in one click and can connect to cloud workflows when needed.
+* **Server-consumption first**: the app should consume OpenWork server surfaces (self-hosted or hosted), not invent parallel behavior.
+* **Composable**: use the desktop app, WhatsApp/Slack/Telegram connectors, or server mode based on the task.
+* **Ejectable**: OpenWork is powered by OpenCode, so anything OpenCode can do is available in OpenWork, even before a dedicated UI exists.
+* **Sharing is caring**: start solo, then share quickly; one CLI or desktop command can spin up an instantly shareable instance.
+
+## Core Runtime Model (Updated)
+
+OpenWork now has three production-grade ways to run the same product surface:
+
+1. **Desktop-hosted app/server**
+   - OpenWork app runs locally and can host server functionality on-device.
+2. **CLI-hosted server (openwork-orchestrator)**
+   - OpenWork server surfaces can be provided by the orchestrator/CLI on a trusted machine.
+3. **Hosted OpenWork Cloud server**
+   - OpenWork-hosted infrastructure provisions workers and exposes the same remote-connect semantics.
+
+User mental model:
+
+* The app is the UI and control layer.
+* The server is the execution/control API layer.
+* A worker is a remote runtime destination.
+* Connecting to a worker happens through `Add worker` -> `Connect remote` using URL + token (or deep link).
+
+Read `ARCHITECTURE.md` for runtime flow, server-vs-shell ownership, and architecture behavior. Read `INFRASTRUCTURE.md` for deployment and control-plane details.
 
 ## Why OpenWork Exists
 
-1. **OpenCode is powerful but terminal-only.** Non-technical users can't access it.
-2. **Cowork is closed-source and locked to Claude Max.** We need an open alternative.
-3. **Mobile-first matters.** People want to run tasks from their phones.
-4. **Slick UI is non-negotiable.** The experience must feel premium, not utilitarian.
+**Cowork is closed-source and locked to Claude Max.** We need an open alternative.
+**Mobile-first matters.** People want to run tasks from their phones, including via messaging surfaces like WhatsApp and Telegram through OpenCode Router.
+**Slick UI is non-negotiable.** The experience must feel premium, not utilitarian.
+
+## Agent Guidelines for development
+
+* **Purpose-first UI**: prioritize clarity, safety, and approachability for non-technical users.
+* **Parity with OpenCode**: anything the UI can do must map cleanly to OpenCode tools.
+* **Prefer OpenCode primitives**: represent concepts using OpenCode's native surfaces first (folders/projects, `.opencode`, `opencode.json`, skills, plugins) before introducing new abstractions.
+* **Web parity**: anything that mutates `.opencode/` should be expressible via the OpenWork server API; Tauri-only filesystem calls are a fallback for host mode, not a separate capability set.
+* **Self-referential**: maintain a gitignored mirror of OpenCode at `vendor/opencode` for inspection.
+* **Self-building**: prefer prompts, skills, and composable primitives over bespoke logic.
+* **Open source**: keep the repo portable; no secrets committed.
+* **Slick and fluid**: 60fps animations, micro-interactions, premium feel.
+* **Mobile-native**: touch targets, gestures, and layouts optimized for small screens.
+* **Provider-neutral control**: expose app actions through OpenWork-owned control surfaces first; provider-specific controllers should drive those surfaces rather than hardwiring provider logic into the app UI.
+
+## Task Intake (Required)
+
+Before making changes, explicitly confirm the target repository in your first task update.
+
+Required format:
+
+1. `Target repo: <path>` (for example: `_repos/openwork`)
+2. `Out of scope repos: <list>` (for example: `_repos/opencode`)
+3. `Planned output: <what will be changed/tested>`
+
+If the user request references multiple repos and the intended edit location is ambiguous, stop after discovery and ask for a single repo target before editing files.
+
+## New Feature Workflow (Required)
+
+When the user asks to create a new feature, follow this exact procedure:
+
+1. Make sure you are up to date on all submodules and repos synced to the head of remotes.
+2. Create a worktree.
+3. Implement the feature.
+4. Start the narrowest supported product stack for the flow under test.
+5. Use Chrome MCP to fully test the feature with the relevant flow-specific skill.
+6. Take screenshots and put them in the repo.
+7. Refer to these screenshots in the PR (only if relevant in the UI).
+8. Always test the flow you just implemented.
+
+If you cannot complete steps 4-8 (Docker, Chrome MCP, missing credentials, or environment limitations), you must say so explicitly and include:
+
+* which steps you could not run and why
+* what you verified instead (tests, logs, manual checks)
+* the exact commands/steps the user should run to complete the end-to-end gate
+
+## Pull Request Expectations (Fast Merge)
+
+If you open a PR, you must run tests and report what you ran (commands + result).
+
+To maximize merge speed, include evidence of the end-to-end flow:
+
+* Ideally: attach a short video/screen recording showing the flow running successfully.
+* Otherwise: screenshots are acceptable, but video is preferred.
+
+If you cannot run tests or capture the video, say so explicitly and explain why, and include the exact commands/steps for the reviewer to reproduce.
+
+## Living Systems
 
-## Core Expectations
+OpenWork aims to be a **living system**: agents, skills, commands, and config are hot-reloadable while sessions are running. This enables agents to create new skills or update their own configuration and have changes take effect immediately, without tearing down active sessions.
 
-- **Purpose-first UI**: prioritize clarity, safety, and approachability for non-technical users.
-- **Parity with OpenCode**: anything the UI can do must map cleanly to OpenCode tools.
-- **Self-referential**: maintain a gitignored mirror of OpenCode at `vendor/opencode` for inspection.
-- **Self-building**: prefer prompts, skills, and composable primitives over bespoke logic.
-- **Open source**: keep the repo portable; no secrets committed.
-- **Slick and fluid**: 60fps animations, micro-interactions, premium feel.
-- **Mobile-native**: touch targets, gestures, and layouts optimized for small screens.
+Design principles for hot reload:
+
+* **Conservative triggers**: only reload when a file that OpenCode reads at startup actually changes inside `.opencode/` or `opencode.json`. Ignore metadata files like `openwork.json`, `.DS_Store`, etc.
+* **Workspace-scoped**: reload state is keyed per workspace. Switching workspaces never leaks reload signals from one workspace to another.
+* **Session-aware**: when sessions are actively running, queue reload signals. Promote to visible reload (toast or auto-reload) only after all active sessions finish. This avoids interrupting in-flight tool calls.
+* **Auto-reload setting**: each workspace can opt into automatic reload via `.opencode/openwork.json` (`reload.auto`). When enabled, the engine reloads automatically once queued signals are ready and no sessions are active.
+* **Session continuity**: before reload, capture running session IDs, agents, and models. After reload, optionally relaunch those sessions so the user experiences seamless continuity.
+* **Per-workspace isolation**: the desktop file watcher only watches the runtime-connected workspace root and its `.opencode/` directory. This can differ briefly from the UI-selected workspace while the user browses another workspace. The server reload event store is already keyed by `workspaceId`.
 
 ## Technology Stack
 
-| Layer | Technology |
-|-------|------------|
-| Desktop/Mobile shell | Tauri 2.x |
-| Frontend | SolidJS + TailwindCSS |
-| State | Solid stores + IndexedDB |
-| IPC | Tauri commands + events |
+| Layer                | Technology                |
+| -------------------- | ------------------------- |
+| Desktop/Mobile shell | Tauri 2.x with Electron migration path |
+| Frontend             | SolidJS + TailwindCSS     |
+| State                | Solid stores + IndexedDB  |
+| IPC                  | Tauri commands + events   |
 | OpenCode integration | Spawn CLI or embed binary |
 
 ## Repository Guidance
 
-- Always read `design-prd.md` at session start for product intent and user flows.
-- Keep `design-prd.md` and `.opencode/skill/*/SKILL.md` updated when behavior changes.
-- Use `.opencode/skill/` for repeatable workflows and domain vocabulary.
+* Use `VISION.md`, `PRINCIPLES.md`, `PRODUCT.md`, `ARCHITECTURE.md`, and `INFRASTRUCTURE.md` to understand the "why" and requirements so you can guide your decisions.
+* Treat `ARCHITECTURE.md` as the authoritative system design source for runtime flow, server ownership, filesystem mutation policy, and agent/runtime boundaries. If those behaviors change, update `ARCHITECTURE.md` in the same task.
+* Use `DESIGN-LANGUAGE.md` as the default visual reference for OpenWork app and landing work.
+* For OpenWork session-surface details, also reference `packages/docs/orbita-layout-style.mdx`.
+
+## App Architecture (CUPID)
+
+For `apps/app/src/app/**`, use CUPID: small public surfaces, intention-revealing names, minimal dependencies, predictable ownership, and domain-based structure.
+
+* Organize app code by product domain and app behavior, not generic buckets like `pages`, `hooks`, `utils`, or app-wide props.
+* Prefer a thin shell, domain modules, and tiny shared primitives.
+* Colocate state, UI, helpers, and server/client adapters with the domain that owns the workflow.
+* Treat shared utilities as a last resort; promote only after multiple real consumers exist.
+* Cross-domain imports should go through a small public API, not another domain's internals.
+* Keep global shell code thin and use it for routing, top-level layout, runtime wiring, and shared reload/update surfaces only.
+* Domain map: shell, workspace, session, connections, cloud, app-settings, and kernel.
+* When changing app architecture, moving ownership, or editing hot spots like `app.tsx`, `pages/dashboard.tsx`, `pages/session.tsx`, or `pages/settings.tsx`, consult the workspace-root skill at `../../.opencode/skills/cupid-app-architecture/SKILL.md` first.
+
+## Dev Debugging
+
+* If you change `apps/server/src`, rebuild the OpenWork server binary (`pnpm --filter openwork-server build:bin`) because `openwork` (openwork-orchestrator) runs the compiled server, not the TS sources.
 
 ## Local Structure
 
 ```
-apps/openwork/
-  AGENTS.md           # This file
-  design-prd.md       # Exhaustive PRD and user flow map
-  .gitignore          # Ignores vendor/opencode, node_modules, etc.
+openwork/
+  AGENTS.md                    # This file
+  VISION.md                     # Product vision and positioning
+  PRINCIPLES.md                 # Decision framework and guardrails
+  PRODUCT.md                    # Requirements, UX, and user flows
+  ARCHITECTURE.md               # Runtime modes and OpenCode integration
+  .gitignore                    # Ignores vendor/opencode, node_modules, etc.
   .opencode/
-    skill/            # Skills for product workflows
-  vendor/
-    opencode/         # Gitignored OpenCode mirror for self-inspection
-  src-tauri/          # Rust backend (Tauri)
-  src/                # SolidJS frontend
-  package.json        # Frontend dependencies
-  Cargo.toml          # Rust dependencies
+  apps/
+    app/
+      src/
+      public/
+      pr/
+      prd/
+      package.json
+    desktop/
+      src-tauri/
+      package.json
+    server/
+      src/
+      package.json
 ```
 
 ## OpenCode SDK Usage
 
 OpenWork integrates with OpenCode via:
 
-1. **Non-interactive mode**: `opencode -p "prompt" -f json -q`
-2. **Database access**: Read `.opencode/opencode.db` for sessions and messages.
-3. **MCP bridge**: OpenWork as an MCP server for real-time permissions and streaming.
+1.  **Non-interactive mode**: `opencode -p "prompt" -f json -q`
+2.  **Database access**: Read `.opencode/opencode.db` for sessions and messages.
 
 Key primitives to expose:
-- `session.Service` — Task runs, history
-- `message.Service` — Chat bubbles, tool calls
-- `agent.Service` — Task execution, progress
-- `permission.Service` — Permission prompts
-- `tools.BaseTool` — Step-level actions
+
+* `session.Service` — Task runs, history
+* `message.Service` — Chat bubbles, tool calls
+* `agent.Service` — Task execution, progress
+* `permission.Service` — Permission prompts
+* `tools.BaseTool` — Step-level actions
 
 ## Safety + Accessibility
 
-- Default to least-privilege permissions and explicit user approvals.
-- Provide transparent status, progress, and reasoning at every step.
-- Use progressive disclosure for advanced controls.
-- WCAG 2.1 AA compliance.
-- Screen reader labels for all interactive elements.
+* Default to least-privilege permissions and explicit user approvals.
+* Provide transparent status, progress, and reasoning at every step.
+* WCAG 2.1 AA compliance.
+* Screen reader labels for all interactive elements.
 
 ## Performance Targets
 
-| Metric | Target |
-|--------|--------|
-| First contentful paint | <500ms |
-| Time to interactive | <1s |
-| Animation frame rate | 60fps |
-| Interaction latency | <100ms |
-| Bundle size (JS) | <200KB gzipped |
+| Metric                 | Target         |
+| ---------------------- | -------------- |
+| First contentful paint | <500ms         |
+| Time to interactive    | <1s            |
+| Animation frame rate   | 60fps          |
+| Interaction latency    | <100ms         |
+| Bundle size (JS)       | <200KB gzipped |
+
+## Skill: SolidJS Patterns
+
+When editing SolidJS UI (`apps/app/src/**/*.tsx`), consult:
+
+* `.opencode/skills/solidjs-patterns/SKILL.md`
+
+This captures OpenWork’s preferred reactivity + UI state patterns (avoid global `busy()` deadlocks; use scoped async state).
+
+## Skill: Trigger a Release
+
+OpenWork releases are built by GitHub Actions (`Release App`). A release is triggered by pushing a `v*` tag (e.g. `v0.1.6`).
+`Release App` can also publish openwork-orchestrator sidecars and npm packages when enabled via workflow inputs or repo vars (`RELEASE_PUBLISH_SIDECARS`, `RELEASE_PUBLISH_NPM`).
+
+### Standard release (recommended)
+
+1.  Ensure `main` is green and up to date.
+2.  Bump versions (keep these in sync):
+
+* `apps/app/package.json` (`version`)
+* `apps/desktop/package.json` (`version`)
+* `apps/orchestrator/package.json` (`version`, publishes as `openwork-orchestrator`)
+* `apps/desktop/src-tauri/tauri.conf.json` (`version`)
+* `apps/desktop/src-tauri/Cargo.toml` (`version`)
+
+You can bump all three non-interactively with:
+
+* `pnpm bump:patch`
+* `pnpm bump:minor`
+* `pnpm bump:major`
+* `pnpm bump:set -- 0.1.21`
+
+3.  Merge the version bump to `main`.
+4.  Create and push a tag:
+    * `git tag vX.Y.Z`
+    * `git push origin vX.Y.Z`
+
+This triggers the workflow automatically (`on: push.tags: v*`).
+
+### Re-run / repair an existing release
+
+If the workflow needs to be re-run for an existing tag (e.g. notarization retry), use workflow dispatch:
+
+* `gh workflow run "Release App" --repo different-ai/openwork -f tag=vX.Y.Z`
+
+### Verify
+
+* Runs: `gh run list --repo different-ai/openwork --workflow "Release App" --limit 5`
+* Release: `gh release view vX.Y.Z --repo different-ai/openwork`
+
+Confirm the DMG assets are attached and versioned correctly.
+
+## Skill: Publish openwork-orchestrator (npm)
+
+This is usually covered by `Release App` when `publish_sidecars` + `publish_npm` are enabled. Use `.opencode/skills/openwork-orchestrator-npm-publish/SKILL.md` for manual recovery or one-off publishing.
+
+1.  Ensure the default branch is up to date and clean.
+2.  Bump `apps/orchestrator/package.json` (`version`).
+3.  Commit the bump.
+4.  Build and upload sidecar assets for the same version tag:
+    * `pnpm --filter openwork-orchestrator build:sidecars`
+    * `gh release create openwork-orchestrator-vX.Y.Z apps/orchestrator/dist/sidecars/* --repo different-ai/openwork`
+5.  Publish:
+    * `pnpm --filter openwork-orchestrator publish --access public`
+6.  Verify:
+    * `npm view openwork-orchestrator version`
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
new file mode 100644
index 0000000000..ab75b712c0
--- /dev/null
+++ b/ARCHITECTURE.md
@@ -0,0 +1,551 @@
+# OpenWork Architecture
+
+## Design principle: Predictable > Clever
+
+OpenWork optimizes for **predictability** over "clever" auto-detection. Users should be able to form a correct mental model of what will happen.
+
+Guidelines:
+
+- Prefer **explicit configuration** (a single setting or env var) over heuristics.
+- Auto-detection is acceptable as a convenience, but must be:
+  - explainable (we can tell the user what we tried)
+  - overrideable (one obvious escape hatch)
+  - safe (no surprising side effects)
+- When a prerequisite is missing, surface the **exact failing check** and a concrete next step.
+
+### Example: Docker-backed sandboxes (desktop)
+
+When enabling Docker-backed sandbox mode, prefer an explicit, single-path override for the Docker client binary:
+
+- `OPENWORK_DOCKER_BIN` (absolute path to `docker`)
+
+This keeps behavior predictable across environments where GUI apps do not inherit shell PATH (common on macOS).
+
+Auto-detection can exist as a convenience, but should be tiered and explainable:
+
+1. Honor `OPENWORK_DOCKER_BIN` if set.
+2. Try the process PATH.
+3. On macOS, try the login PATH from `/usr/libexec/path_helper`.
+4. Last-resort: try well-known locations (Homebrew, Docker Desktop bundle) and validate the binary exists.
+
+The readiness check should be a clear, single command (e.g. `docker info`) and the UI should show the exact error output when it fails.
+
+## Minimal use of Tauri
+We move most of the functionality to the openwork server which interfaces mostly with FS and proxies to opencode.
+
+
+
+## Filesystem mutation policy
+
+OpenWork should route filesystem mutations through the OpenWork server whenever possible.
+
+Why:
+
+- the server is the one place that can apply the same behavior for both local and remote workspaces
+- server-routed writes keep permission checks, approvals, audit trails, and reload events consistent
+- Tauri-only filesystem mutations only work in desktop host mode and break parity with remote execution
+
+Guidelines:
+
+- Any UI feature that changes workspace files or config should call an OpenWork server endpoint first.
+- Local Tauri filesystem commands are a host-mode fallback, not the primary product surface.
+- If a feature cannot yet write through the OpenWork server, treat that as an architecture gap and close it before depending on direct local writes.
+- Reads can fall back locally when necessary, but writes should be designed around the OpenWork server path.
+
+## Agent authority map
+
+When OpenWork is edited from `openwork-enterprise`, architecture and runtime behavior should be sourced from this document.
+
+| Entry point | Role | Architecture authority |
+| --- | --- | --- |
+| `openwork-enterprise/AGENTS.md` | OpenWork Factory multi-repo orchestration | Defers OpenWork runtime flow, server-vs-shell ownership, and filesystem mutation behavior to `_repos/openwork/ARCHITECTURE.md`. |
+| `openwork-enterprise/.opencode/agents/openwork-surgeon.md` | Surgical fix agent for `_repos/openwork` | Uses `_repos/openwork/ARCHITECTURE.md` as the runtime and architecture source of truth before changing product behavior. |
+| `_repos/openwork/AGENTS.md` | Product vocabulary, audience, and repo-local development guidance | Refers to `ARCHITECTURE.md` for runtime flow, server ownership, and architectural boundaries. |
+| Skills / commands / agents that mutate workspace state | Capability layer on top of the product runtime | Should assume the OpenWork server path is canonical for workspace creation, config writes, `.opencode/` mutation, and reload signaling. |
+
+### Agent access to server-owned behavior
+
+Agents, skills, and commands should model the following as OpenWork server behavior first:
+
+- workspace creation and initialization
+- writes to `.opencode/`, `opencode.json`, and `opencode.jsonc`
+- OpenWork workspace config writes (`.opencode/openwork.json`)
+- share-bundle publish/fetch flows for supported OpenWork capability bundles such as skills
+- reload event generation after config or capability changes
+- other filesystem-backed capability changes that must work across desktop host mode and remote clients
+
+Tauri or other native shell behavior remains the fallback or shell boundary for:
+
+- file and folder picking
+- reveal/open-in-OS affordances
+- updater and window management
+- host-side process supervision and native runtime bootstrapping
+
+If an agent needs one of the server-owned behaviors above and only a Tauri path exists, treat that as an architecture gap to close rather than a parallel capability surface to preserve.
+
+## Release channels
+
+OpenWork desktop ships through two release channels:
+
+- **Stable** (default, all platforms): versioned builds produced by the `Release App` workflow. Each tag `vX.Y.Z` publishes signed, notarized Tauri bundles plus a `latest.json` updater manifest at `https://github.com/different-ai/openwork/releases/latest/download/latest.json`; when Electron publishing is enabled, the same release also carries signed, notarized Electron macOS assets plus `latest-mac.yml` at `https://github.com/different-ai/openwork/releases/latest/download/latest-mac.yml`.
+- **Alpha** (macOS arm64 only, rolling): every merge to `dev` publishes signed, notarized Tauri and Electron builds to the rolling GitHub release tagged `alpha-macos-latest`. The Tauri alpha updater manifest lives at `https://github.com/different-ai/openwork/releases/download/alpha-macos-latest/latest.json`; Electron alpha assets include `latest-mac.yml` at `https://github.com/different-ai/openwork/releases/download/alpha-macos-latest/latest-mac.yml` on the same release.
+
+Guidelines:
+
+- The Tauri alpha channel is an opt-in preference (`LocalPreferences.releaseChannel`). The normal Updates toggle is rendered only when `isTauriRuntime()` and `isMacPlatform()` both resolve true; other platforms silently fall back to stable even if the stored preference says `"alpha"`.
+- The Electron alpha channel is Debug-only during the migration window. Migrated Electron users can switch feeds from Settings → Debug → Electron alpha channel; the normal Updates page stays on the selected Electron feed and defaults to stable.
+- Alpha builds advertise the next patch version plus an `-alpha.<runNumber>+<sha>` prerelease suffix. That keeps semver ordering `stable < alpha.1 < alpha.2 < next stable` so alpha users migrate forward cleanly when the next stable ships.
+- Alpha and stable share the same Tauri updater signing keypair so an installed stable can upgrade into alpha and vice versa without re-installing manually.
+- Apple signing and notarization are required on both channels; `alpha-macos-aarch64.yml` fails closed unless `MACOS_NOTARIZE=true`, and the `Release App` Electron job reuses the same Tauri Apple signing/notary secrets.
+- The alpha workflow is the source of truth for the alpha channel's CI contract. Treat `.github/workflows/alpha-macos-aarch64.yml`, `apps/app/src/app/lib/release-channels.ts`, and this document as one coupled unit.
+
+Code references:
+
+- Workflow: `.github/workflows/alpha-macos-aarch64.yml`
+- Endpoint resolution: `apps/app/src/app/lib/release-channels.ts`
+- Electron alpha resolver: `apps/app/src/app/lib/electron-alpha.ts`
+- Preference plumbing: `apps/app/src/react-app/kernel/local-provider.tsx`, `apps/app/src/react-app/domains/settings/pages/updates-view.tsx`, `apps/app/src/react-app/domains/settings/pages/debug-view.tsx`
+- Stable workflow (reference): `.github/workflows/release-macos-aarch64.yml`
+
+## Reload-required flow
+
+OpenWork uses a single reload-required flow for changes that only take effect when OpenCode restarts.
+
+Key pieces:
+
+- `createSystemState()` owns the raw queued-reload state.
+- `reloadPending()` means a reload is currently queued for the active workspace.
+- `markReloadRequired(reason, trigger)` queues the reload and records the source that caused it.
+- `app.tsx` exposes `reloadRequired(...sources)` as a small helper for UI filtering. It is used to decide whether the shared reload popup should show for a given trigger type.
+
+Use this flow when a change mutates startup-loaded OpenCode inputs, for example:
+
+- `opencode.json`
+- `.opencode/skills/**`
+- `.opencode/agents/**`
+- `.opencode/commands/**`
+- MCP definitions or plugin lists that OpenCode only loads at startup
+
+Do not invent a separate reload banner per feature. New UI that needs restart semantics should:
+
+1. perform the config or filesystem mutation
+2. call `markReloadRequired(...)`
+3. rely on the shared reload popup to explain and execute the restart path
+
+Current examples that should use this shared flow include MCP changes, auto context compaction, default model changes, authorized folder updates, plugin changes, and other `opencode.json` writes.
+
+When the desktop shell asks the OpenWork server to manage OpenCode, the managed
+OpenCode process starts from a shell-owned local workdir under app data instead
+of the user's selected workspace. Workspace-specific file access still flows
+through the OpenWork server and `x-opencode-directory`, but startup no longer
+depends on opening a project `opencode.json` from slow cloud-synced folders such
+as iCloud Drive.
+
+## opencode primitives
+how to pick the right extension abstraction for 
+@opencode
+
+opencode has a lot of extensibility options:
+mcp / plugins / skills / bash / agents / commands
+
+- mcp
+use when you need authenticated third-party flows (oauth) and want to expose that safely to end users
+good fit when "auth + capability surface" is the product boundary
+downside: you're limited to whatever surface area the server exposes
+
+- bash / raw cli
+use only for the most advanced users or internal power workflows
+highest risk, easiest to get out of hand (context creep + permission creep + footguns)
+great for power users and prototyping, terrifying as a default for non-tech users
+
+- plugins
+use when you need real tools in code and want to scope permissions around them
+good middle ground: safer than raw cli, more flexible than mcp, reusable and testable
+basically "guardrails + capability packaging"
+
+- skills
+use when you want reliable plain-english patterns that shape behavior
+best for repeatability and making workflows legible
+pro tip: pair skills with plugins or cli (i literally embed skills inside plugins right now and expose commands like get_skills / retrieve)
+
+- agents
+use when you need to create tasks that are executed by different models than the main one and might have some extra context to find skills or interact with mcps.
+
+- commands 
+`/` commands that trigger tools
+
+These are all opencode primitives you can read the docs to find out exactly how to set them up.
+
+## Core Concepts of OpenWork
+
+- uses all these primitives
+- uses native OpenCode commands for reusable flows (markdown files in `.opencode/commands`)
+- adds a new abstraction "workspace" is a project folder and a simple .json file that includes a list of opencode primitives that map perfectly to an opencode workdir (not fully implemented)
+  - openwork can open a workpace.json and decide where to populate a folder with thse settings (not implemented today
+
+## Repository/component map
+
+- `/apps/app/`: OpenWork app UI (desktop/mobile/web client experience layer).
+- `/apps/desktop/`: Tauri desktop shell that hosts the app UI and manages native process lifecycles.
+- `/apps/server/`: OpenWork server (API/control layer consumed by the app).
+- `/apps/orchestrator/`: OpenWork orchestrator CLI/daemon. In `start`/`serve` host mode it manages OpenWork server + OpenCode; in daemon mode it manages worker/sandbox lifecycle.
+- `/apps/share/`: share-link publisher service for OpenWork bundle imports.
+- `/ee/apps/landing/`: OpenWork landing page surfaces.
+- `/ee/apps/den-web/`: Den web UI for sign-in, worker creation, and future user-management flows.
+- `/ee/apps/den-api/`: Den control plane API (formerly `/ee/apps/den-controller/`) that provisions/spins up worker runtimes.
+- `/ee/apps/den-worker-proxy/`: proxy layer that keeps Daytona API keys server-side, refreshes signed worker preview URLs, and forwards worker traffic so users do not manage provider keys directly.
+- `/ee/apps/den-worker-runtime/`: worker runtime packaging (including Docker/runtime artifacts) deployed to Daytona sandboxes.
+
+## Core Architecture
+
+OpenWork is a client experience that consumes OpenWork server surfaces.
+
+### Provider-neutral app control surface
+
+OpenWork app control mode is owned by the UI runtime. The app exposes a
+provider-neutral action registry through `window.__openworkControl` so external
+controllers can inspect the current route, discover visible/safe actions, and
+request an action by ID without depending on DOM scraping or a specific model
+provider.
+
+Guidelines:
+
+- The app owns visible, screen-local state: which actions are available, which
+  element should be spotlighted, and how actions are choreographed so users can
+  see control happen.
+- Controllers such as MCP bridges, test harnesses, or optional external drivers should
+  call the app control surface instead of reaching into app internals.
+- Provider/API secrets and privileged filesystem or server mutations remain
+  server-owned; the app control surface should route those through OpenWork
+  server APIs rather than adding provider-specific behavior to the UI.
+- Raw screenshot or coordinate-based control is a fallback for uninstrumented
+  surfaces, not the default architecture.
+
+### MCP UI Control profile
+
+OpenWork should standardize external app control through MCP where possible. The
+app-local `window.__openworkControl` registry remains the source of current UI
+affordances, but public integrations should expose those affordances as MCP
+tools that follow `docs/mcp-ui-control-profile.md`:
+
+- `ui.snapshot` for current semantic app state
+- `ui.list_actions` for currently available action metadata and input schemas
+- `ui.execute_action` for running one semantic action by ID
+
+Standalone control clients such as HandsFree should be MCP clients first: they
+can connect to any configured MCP server and call generic MCP tools. OpenWork's
+local UI bridge is an implementation detail behind the OpenWork MCP surface.
+
+OpenWork supports two product runtime modes for users:
+
+- desktop
+- web/cloud (also usable from mobile clients)
+
+OpenWork therefore has two runtime connection modes:
+
+### Mode A - Desktop
+
+- OpenWork runs on a desktop/laptop and can host OpenWork server surfaces locally.
+- The OpenCode server runs on loopback (default `127.0.0.1:4096`).
+- The OpenWork server also defaults to loopback-only access. Remote sharing is an explicit opt-in that rebinds the OpenWork server to `0.0.0.0` while keeping OpenCode on loopback.
+- OpenWork UI connects via the official SDK and listens to events.
+- OpenWork server is the local API/control layer for this mode and owns the managed OpenCode child lifecycle.
+
+### Mode B - Web/Cloud (can be mobile)
+
+- User signs in to hosted OpenWork web/app surfaces (including mobile browser/client access).
+- User launches a cloud worker from hosted control plane.
+- OpenWork returns remote connect credentials (`/w/ws_*` URL + access token).
+- User connects from OpenWork app using `Add a worker` -> `Connect remote`.
+
+This model keeps the user experience consistent across self-hosted and hosted paths while preserving OpenCode parity.
+
+### Mode A composition (Tauri shell + local services)
+
+- `/apps/app/` runs as the product UI; on desktop it is hosted inside `/apps/desktop/` (Tauri webview).
+- `/apps/desktop/` exposes native commands (`engine_*`, `orchestrator_*`, `openwork_server_*`) to start/stop local services and report status to the UI.
+- `/apps/desktop/` is also the source of truth for desktop bootstrap config that must survive updates, including Den server targeting and forced-sign-in startup behavior. The shell reads a predictable external `desktop-bootstrap.json` from the host config directory (or `OPENWORK_DESKTOP_BOOTSTRAP_PATH` when explicitly overridden). Default builds consume that file when present; custom builds seed or overwrite it when their bundled bootstrap differs from the standard default.
+- Desktop host runtime is server-managed: the shell starts OpenWork server with managed OpenCode enabled, and the UI consumes OpenWork server APIs.
+- OpenWork server (`/apps/server/`) is the API surface consumed by the UI; it proxies OpenCode routes for the active workspace.
+- Desktop-launched OpenCode credentials are always random, per-launch values generated by OpenWork. OpenCode stays on loopback and is intended to be reached through OpenWork server rather than exposed directly.
+
+```text
+/apps/app UI
+    |
+    v
+/apps/desktop (Tauri shell)
+    |
+    +--> /apps/server (OpenWork API + proxy surface)
+               |
+               +--> OpenCode
+```
+
+### Mode B composition (Web/Cloud services)
+
+- `/ee/apps/den-web/` is the hosted web control surface (sign-in, worker create, upcoming user management).
+- `/ee/apps/den-api/` (formerly `/ee/apps/den-controller/`) is the cloud control plane API (auth/session + worker CRUD + provisioning orchestration).
+- Desktop org runtime config is fetched from Den after sign-in and is treated as server-owned runtime policy. It is stored per organization in Den (`organization.desktop_app_restrictions`) as sparse negative restriction flags (for example `blockZenModel`) and managed from the cloud org settings UI, while install/bootstrap config remains shell-owned in the external bootstrap file and only contains base URL, optional API base URL, and the `forceSignin` startup flag.
+- Daytona-backed workers mount a single shared provider volume and isolate each worker's persistent data by subpaths (`workers/<workerId>/workspace` and `workers/<workerId>/data`) rather than creating dedicated provider volumes per worker.
+- `/ee/apps/den-worker-runtime/` defines the runtime packaging and boot path used inside cloud workers (including Docker/snapshot artifacts and `openwork serve` startup assumptions).
+- `/ee/apps/den-worker-proxy/` fronts Daytona worker preview URLs, refreshes signed links with provider credentials, and proxies traffic to the worker runtime.
+- The OpenWork app (desktop or mobile client) connects to worker OpenWork server surfaces via URL + token (`/w/ws_*` when available).
+
+```text
+/ee/apps/den-web
+    |
+    v
+/ee/apps/den-api (formerly /ee/apps/den-controller)
+    |
+    +--> Daytona/Render provisioning
+    |        |
+    |        v
+    |      /ee/apps/den-worker-runtime -> openwork serve + OpenCode
+    |
+    +--> /ee/apps/den-worker-proxy (signed preview + proxy)
+
+OpenWork app/mobile client
+    -> Connect remote (URL + token)
+    -> worker OpenWork server surface
+```
+
+## Messaging Bridge
+
+OpenWork no longer starts or proxies an app-owned local messaging bridge in the desktop host runtime. Messaging surfaces must be provided by an external server/worker surface rather than Tauri, Electron, or OpenWork server launching a local `opencode-router` child.
+
+Terminology clarification:
+
+- `selected workspace` is a UI concept: the workspace the user is currently viewing and where compose/config actions should target.
+- `runtime active workspace` is a backend concept: the workspace the local server/orchestrator currently reports as active.
+- `watched workspace` is the desktop-host/runtime concept for which workspace root local file watching is currently attached to.
+- These states must be treated separately. UI selection can change without implying that the backend has switched roots yet.
+- In practice, `selected workspace` and `runtime active workspace` often converge once the user sends work, but they are allowed to diverge briefly while the UI is browsing another workspace.
+
+Desktop local OpenWork server ports:
+
+- Desktop-hosted local OpenWork server instances do not assume a fixed `8787` port.
+- Each workspace gets a persistent preferred localhost port in the `48000-51000` range.
+- On restart, desktop tries to reuse that workspace's saved port first.
+- If that port is unavailable, desktop picks another free port in the same range and avoids ports already reserved by other known workspaces.
+
+```text
+Shared-root case
+
+router root: /Users/me/projects
+
+  /Users/me/projects/a   OK
+  /Users/me/projects/b   OK
+  /Users/me/projects/c   OK
+
+Unrelated-root case
+
+router root: /Users/me/projects/a
+
+  /Users/me/projects/a   OK
+  /Users/me/other/b      rejected
+  /tmp/c                 rejected
+```
+
+This is intentional for now: predictable scoping beats clever cross-root auto-routing.
+
+## Cloud Worker Connect Flow (Canonical)
+
+1. Authenticate in OpenWork Cloud control surface.
+2. Launch worker (with checkout/paywall when needed).
+3. Wait for provisioning and health.
+4. Generate/retrieve connect credentials.
+5. Connect in OpenWork app via deep link or manual URL + token.
+
+Technical note:
+
+- Default connect URL should be workspace-scoped (`/w/ws_*`) when available.
+- Technical diagnostics (host URL, worker ID, raw logs) should be progressive disclosure, not default UI.
+
+## Web Parity + Filesystem Actions
+
+The browser runtime cannot read or write arbitrary local files. Any feature that:
+
+- reads skills/commands/plugins from `.opencode/`
+- edits `SKILL.md` / command templates / `opencode.json`
+- opens folders / reveals paths
+
+must be routed through a host-side service.
+
+In OpenWork, the long-term direction is:
+
+- Use the OpenWork server (`/apps/server/`) as the single API surface for filesystem-backed operations.
+- Treat Tauri-only file operations as an implementation detail / convenience fallback, not a separate feature set.
+
+This ensures the same UI flows work on desktop, mobile, and web clients, with approvals and auditing handled centrally.
+
+## OpenCode Integration (Exact SDK + APIs)
+
+OpenWork uses the official JavaScript/TypeScript SDK:
+
+- Package: `@opencode-ai/sdk/v2` (UI should import `@opencode-ai/sdk/v2/client` to avoid Node-only server code)
+- Purpose: type-safe client generated from OpenAPI spec
+
+### Engine Lifecycle
+
+#### Start server + client (Host mode)
+
+Use `createOpencode()` to launch the OpenCode server and create a client.
+
+```ts
+import { createOpencode } from "@opencode-ai/sdk/v2";
+
+const opencode = await createOpencode({
+  hostname: "127.0.0.1",
+  port: 4096,
+  timeout: 5000,
+  config: {
+    model: "anthropic/claude-3-5-sonnet-20241022",
+  },
+});
+
+const { client } = opencode;
+// opencode.server.url is available
+```
+
+#### Connect to an existing server (Client mode)
+
+```ts
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+
+const client = createOpencodeClient({
+  baseUrl: "http://localhost:4096",
+  directory: "/path/to/project",
+});
+```
+
+### Health + Version
+
+- `client.global.health()`
+  - Used for startup checks, compatibility warnings, and diagnostics.
+
+### Event Streaming (Real-time UI)
+
+OpenWork must be real-time. It subscribes to SSE events:
+
+- `client.event.subscribe()`
+
+The UI uses these events to drive:
+
+- streaming assistant responses
+- step-level tool execution timeline
+- permission prompts
+- session lifecycle changes
+
+### Sessions (Primary Primitive)
+
+OpenWork maps a "Task Run" to an OpenCode **Session**.
+
+Core methods:
+
+- `client.session.create()`
+- `client.session.list()`
+- `client.session.get()`
+- `client.session.messages()`
+- `client.session.prompt()`
+- `client.session.abort()`
+- `client.session.summarize()`
+
+### Files + Search
+
+OpenWork's file browser and "what changed" UI are powered by:
+
+- `client.find.text()`
+- `client.find.files()`
+- `client.find.symbols()`
+- `client.file.read()`
+- `client.file.status()`
+
+### Permissions
+
+OpenWork must surface permission requests clearly and respond explicitly.
+
+- Permission response API:
+  - `client.permission.reply({ requestID, reply })` (where `reply` is `once` | `always` | `reject`)
+
+OpenWork UI should:
+
+1. Show what is being requested (scope + reason).
+2. Provide choices (allow once / allow for session / deny).
+3. Post the response to the server.
+4. Record the decision in the run's audit log.
+
+### Config + Providers
+
+OpenWork's settings pages use:
+
+- `client.config.get()`
+- `client.config.providers()`
+- `client.auth.set()` (optional flow to store keys)
+
+### Extensibility - Skills + Plugins
+
+OpenWork exposes two extension surfaces:
+
+1. **Skills**
+   - Installed into `.opencode/skills/*`.
+   - Skills can be imported from local directories or installed from curated lists.
+
+2. **Plugins (OpenCode)**
+   - Plugins are configured via `opencode.json` in the workspace.
+   - The format is the same as OpenCode CLI uses today.
+   - OpenWork should show plugin status and instructions; a native plugin manager is planned.
+
+### Engine reload (config refresh)
+
+- OpenWork server exposes `POST /workspace/:id/engine/reload`.
+- It calls OpenCode `POST /instance/dispose` with the workspace directory to force a config re-read.
+- Use after skills/plugins/MCP/config edits; reloads can interrupt active sessions.
+- Reload requests follow OpenWork server approval rules.
+
+### Skill Registry (Current + Future)
+
+- Today, OpenWork only supports **curated lists + manual sources**.
+- Future goals:
+  - in-app registry search
+  - curated list sync (e.g. Awesome Claude Skills)
+  - frictionless publishing without signup
+
+## Projects + Path
+
+- `client.project.list()` / `client.project.current()`
+- `client.path.get()`
+
+OpenWork conceptually treats "workspace" as the current project/path.
+
+## Optional TUI Control (Advanced)
+
+The SDK exposes `client.tui.*` methods. OpenWork can optionally provide a "Developer Mode" screen to:
+
+- append/submit prompt
+- open help/sessions/themes/models
+- show toast
+
+This is optional and not required for non-technical MVP.
+
+## Folder Authorization Model
+
+OpenWork enforces folder access through **two layers**:
+
+1. **OpenWork UI authorization**
+   - user explicitly selects allowed folders via native picker
+   - OpenWork remembers allowed roots per profile
+
+2. **OpenCode server permissions**
+   - OpenCode requests permissions as needed
+   - OpenWork intercepts requests via events and displays them
+
+Rules:
+
+- Default deny for anything outside allowed roots.
+- "Allow once" never expands persistent scope.
+- "Allow for session" applies only to the session ID.
+- "Always allow" (if offered) must be explicit and reversible.
+
+## Open Questions
+
+- Best packaging strategy for Host mode engine (bundled vs user-installed Node/runtime).
+- Best remote transport for mobile client (LAN only vs optional tunnel).
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000000..fb9c64f38c
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,55 @@
+# Code of Conduct
+
+## Our commitment
+
+We are committed to making participation in the OpenWork community a harassment-free
+experience for everyone, regardless of age, body size, disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience, education,
+socio-economic status, nationality, personal appearance, race, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse,
+inclusive, and healthy community.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment include:
+
+- Demonstrating empathy and kindness toward other people.
+- Being respectful of differing opinions, viewpoints, and experiences.
+- Giving and gracefully accepting constructive feedback.
+- Taking responsibility and apologizing to those affected by our mistakes.
+- Focusing on what is best for the community.
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery and sexual attention or advances.
+- Trolling, insulting or derogatory comments, and personal or political attacks.
+- Public or private harassment.
+- Publishing others' private information without explicit permission.
+- Other conduct that could reasonably be considered inappropriate in a professional
+  setting.
+
+## Enforcement responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in response
+to behavior they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, including GitHub issues,
+pull requests, discussions, and direct interactions in official OpenWork channels.
+
+## Reporting
+
+If you experience or witness unacceptable behavior, report it to
+`benjamin.shafii@gmail.com` with as much context as possible.
+
+All reports will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1.
+
+[homepage]: https://www.contributor-covenant.org/version/2/1/code_of_conduct/
diff --git a/DESIGN-LANGUAGE.md b/DESIGN-LANGUAGE.md
new file mode 100644
index 0000000000..2e06374211
--- /dev/null
+++ b/DESIGN-LANGUAGE.md
@@ -0,0 +1,871 @@
+# OpenWork Design Language
+
+This is the definitive visual system for OpenWork product and landing work.
+
+OpenWork should feel like a premium work tool: calm, useful, technical, and trustworthy. The design should read as software first, not a flashy marketing site. The goal is clarity with taste, not visual noise.
+
+---
+
+## 1. Core Design Position
+
+OpenWork design is:
+
+- quiet
+- premium
+- operational
+- flat-first
+- structured by typography, spacing, and borders
+- atmospheric only in controlled places
+
+OpenWork design is **not**:
+
+- glossy
+- glassy
+- beige
+- aggressively gradient-heavy
+- border-heavy
+- shadow-led
+- decorative for its own sake
+
+The basic rule:
+
+> Use structure before effects.
+
+If something needs emphasis, prefer this order:
+
+1. layout
+2. spacing
+3. typography
+4. opacity
+5. background tint
+6. border
+7. shadow
+
+Shadow should almost never be the first tool.
+
+---
+
+## 2. The OpenWork Mood
+
+The product should feel like:
+
+- a serious desktop tool
+- a clean command center
+- a modern open-source alternative to Claude Cowork
+- something you would trust with real workflows, team sharing, and remote workers
+
+Tone:
+
+- polished, but restrained
+- modern, but not trendy
+- friendly, but not cute
+- futuristic through discipline, not chrome
+
+---
+
+## 3. Color + Surface Rules
+
+### Base page color
+
+- Default page/background base: very light cool neutral (`#f6f9fc` or equivalent)
+- Prefer white and near-white surfaces over tinted beige panels
+- Avoid warm paper/beige backgrounds unless there is a very strong reason
+
+### Surface hierarchy
+
+Use only a few layers:
+
+1. **Page background**
+2. **Primary white surface**
+3. **Soft secondary surface**
+4. **Interactive selected state**
+
+Do not create lots of micro-layers.
+
+### Preferred surface treatments
+
+#### Flat app surface
+
+For most application UI:
+
+- white or near-white background
+- 1px subtle border
+- no visible shadow or only the smallest shadow possible
+
+#### Soft shell
+
+Use for landing sections that need grouping but should still feel calm.
+
+- `landing-shell-soft` style direction
+- near-white background
+- subtle edge definition
+- **no box shadow by default**
+
+This is no longer landing-only in spirit. For app surfaces like modals, package builders,
+and share flows, the same shell language is often the right starting point when the surface
+represents a workflow object instead of generic settings chrome.
+
+#### Elevated showcase shell
+
+Use only when a hero/demo needs one extra level of emphasis.
+
+- may use `landing-shell`
+- still soft
+- never dark or “floating card everywhere”
+- should be rare, not the default wrapper for all sections
+
+### Background imagery
+
+Allowed only when all of the following are true:
+
+- it sits behind content, not under core text blocks directly
+- it is subtle
+- it fades away or is spatially constrained
+- it does not compete with reading
+
+Pattern/background image rules:
+
+- top-of-page background patterns should be low-opacity and fade out down the page
+- section-specific image backgrounds are allowed for showcase frames
+- content cards that sit on top of image backgrounds should still be white and legible
+- use images as atmosphere, not content
+
+---
+
+## 4. Borders
+
+Borders are one of the main structure tools in OpenWork.
+
+### Border philosophy
+
+- prefer soft gray borders
+- prefer low contrast
+- prefer consistency over emphasis
+
+### What not to do
+
+- do **not** use harsh black borders for selection
+- do **not** outline selected cards with strong dark strokes
+- do **not** stack border + heavy shadow + tint all at once
+
+### Good border usage
+
+- `border-gray-200`
+- `border-gray-300` for stronger but still soft selection
+- low-alpha white borders for translucent landing shells
+- soft shell borders like `#eceef1` for app sidebars and large rounded utility panels
+
+Do not use a dark or high-contrast outline as the main styling for a small icon tile,
+badge shell, or compact decorative container. If the element is just carrying an icon,
+prefer a soft filled tile over an outlined chip.
+
+Selection should usually feel like:
+
+- soft neutral fill
+- darker text
+- optional tiny border or tiny shadow only when needed
+
+not:
+
+- dark outline
+- glow
+- hard stroke
+
+---
+
+## 5. Shadows
+
+Shadows must be restrained.
+
+### General rule
+
+- App UI: almost flat
+- Landing UI: soft and selective
+- Selection states: tiny shadow only
+
+### Approved shadow levels
+
+#### None
+
+Default for most grouped surfaces.
+
+#### Tiny control shadow
+
+Use for active pills and secondary buttons:
+
+```css
+0 0 0 1px rgba(0,0,0,0.06),
+0 1px 2px 0 rgba(0,0,0,0.04)
+```
+
+#### Light card shadow
+
+Use sparingly for a main demo shell or one hero card.
+
+#### Strong CTA shadow
+
+Reserved for the primary CTA only.
+
+### Never do
+
+- large ambient shadows across many cards on one page
+- floaty SaaS-marketing shadows everywhere
+- using shadow as the main selected-state signal
+- glassmorphism blur shadows in the app
+
+---
+
+## 6. Geometry + Radius
+
+OpenWork should have a small set of radii and use them consistently.
+
+### Radius system
+
+- **Pills / buttons / chips:** `rounded-full`
+- **Small controls / rows / compact cards:** `rounded-xl`
+- **Medium panels / embedded demos:** `rounded-2xl`
+- **Large showcase wrappers:** `rounded-3xl` or `rounded-[2.5rem]`
+- **Sidebar/app shell wrappers:** `rounded-[2rem]` to `rounded-[2.5rem]`
+
+### Rules
+
+- Don’t mix too many different radii in one section
+- If the outer shell is very rounded, inner panels should step down cleanly
+- Pills should look intentional, not bubbly
+
+---
+
+## 7. Typography
+
+Typography does most of the hierarchy work.
+
+### General tone
+
+- clean sans-serif
+- medium weight for important labels
+- gray text for explanatory copy
+- no overly stylized headings
+
+### Hierarchy
+
+#### Eyebrows
+
+- uppercase
+- tracked
+- small (`text-[11px]`)
+- muted gray
+
+#### Headlines
+
+- medium weight
+- tight tracking
+- dark ink (`#011627` or equivalent)
+- large enough to lead, not shout
+
+#### Body
+
+- `text-sm` or `text-base`
+- relaxed line height
+- `text-gray-500` or `text-gray-600`
+
+#### Active explanatory text
+
+If paired with an active state (like a selected workflow descriptor), the copy may move from muted gray to dark ink.
+
+### Avoid
+
+- giant type jumps
+- ultra-light weights
+- loud uppercase body copy
+- dense paragraphs without breathing room
+
+---
+
+## 7.5 Copy Direction
+
+OpenWork copy should feel as disciplined as the UI.
+
+### General tone
+
+- concise
+- product-led
+- operational
+- calm
+- confident without overselling
+
+### Good copy behavior
+
+- lead with the main user value, not the implementation detail
+- prefer one clear idea per sentence
+- keep interface copy shorter than marketing copy
+- make support text explain utility, not restate the headline in different words
+
+### Avoid
+
+- repetitive copy that says the same thing three ways
+- enterprise filler words like "provisioned setups" when a simpler phrase exists
+- admin-heavy or billing-heavy framing when the main value is team workflow
+- overdescribing secondary features
+
+### Preferred OpenWork Cloud framing
+
+For OpenWork Cloud, the primary story is:
+
+1. share setup across the team/org
+2. keep everything in sync
+3. background agents are secondary / alpha
+4. custom LLM providers are tertiary / coming soon
+
+Do not make the product read like:
+
+- a billing page first
+- a hosting toggle first
+- an equal split between desktop and Cloud
+
+It should read like:
+
+- team setup sharing first
+- operational consistency second
+- advanced/cloud extensions after that
+
+### Preferred terminology
+
+Use:
+
+- **OpenWork Cloud**
+- **Shared setups**
+- **Shared templates**
+- **Custom LLM providers**
+- **Background agents**
+
+Prefer:
+
+- "Manage your team’s setup, invite teammates, and keep everything in sync."
+- "Create and update shared templates your team can use right away."
+- "Standardize provider access for your team."
+
+Avoid:
+
+- "Den" in user-facing copy
+- "Provisioned setups"
+- "Configured setups"
+- "Choose how to run..." when the real goal is to explain team value
+
+### Hierarchy rules for product pages
+
+For sign-in, checkout, and dashboard copy:
+
+- headline should state the core team value
+- subcopy should explain the workflow benefit in one sentence
+- supporting bullets/cards should not compete equally with the main value
+- desktop should often appear as a fallback or secondary path, not a co-equal hero choice
+
+### Docs CTA language
+
+When linking to supporting documentation, prefer short utility labels:
+
+- **Learn how**
+- **How sharing works**
+- **Read the guide**
+
+These should feel like helpful follow-through, not a second headline.
+
+---
+
+## 8. Buttons
+
+There are only a few button families in OpenWork.
+
+### 8.1 Primary button
+
+Use for the main action only.
+
+Characteristics:
+
+- dark fill (`#011627`)
+- white text
+- fully rounded pill
+- slightly stronger shadow than the rest of the system
+- feels decisive but still clean
+
+Canonical pattern: `doc-button`
+
+Use for:
+
+- Download
+- Run task
+- other main conversion/action moments
+
+### 8.2 Secondary button
+
+Use for support actions.
+
+Characteristics:
+
+- white fill
+- no hard border
+- tiny ring + small shadow
+- black/dark text
+- fully rounded pill
+
+Canonical pattern: `secondary-button`
+
+This is also the reference style for:
+
+- active segmented controls
+- selected pills inside a track
+
+### 8.3 Tertiary / text actions
+
+Use for less important actions.
+
+Characteristics:
+
+- no heavy box treatment
+- rely on text color and hover only
+
+### Button rules
+
+- Do not invent many new button styles
+- Reuse the primary and secondary button logic whenever possible
+- If a selector pill is active, it should usually resemble the secondary button family
+
+---
+
+## 9. Selectors, Tabs, and Pills
+
+This is now one of the clearest OpenWork patterns.
+
+### Track pattern
+
+Use a soft segmented track:
+
+- light border
+- subtle gray background
+- full pill radius
+- tiny inset padding
+
+Example structure:
+
+- track: `border border-gray-200 bg-gray-50/50 rounded-full p-1`
+- active item: white pill + tiny shadow
+- inactive item: muted text only
+
+### Active state
+
+Active tab/pill should look like:
+
+- white pill
+- soft ring/shadow
+- dark text
+
+### Inactive state
+
+Inactive tab/pill should look like:
+
+- no card chrome
+- muted gray text
+- stronger text on hover
+
+### Do not
+
+- use harsh dark borders for selection
+- create heavy segmented controls with thick strokes
+- use loud fills for tabs
+
+### Flat selected row pattern
+
+For app navigation, especially dashboard sidebars:
+
+- selected state should usually be a soft gray fill (`bg-gray-100` / `bg-slate-100` family)
+- selected items should not default to white floating pills inside a white or near-white shell
+- rely on fill + text weight before adding chrome
+- hover state should usually be one step lighter than selected, not a different visual language
+
+---
+
+## 10. Lists and Row Systems
+
+OpenWork has two primary list patterns.
+
+### 10.1 Operational row list
+
+Use for sessions, workspaces, activity rows, and compact app lists.
+
+Pattern:
+
+- flat container
+- rounded-xl row
+- light hover tint
+- selected row uses a subtle fill and stronger text
+- metadata remains quiet
+
+Good signals:
+
+- `font-medium`
+- subtle background tint
+- tiny status accent if needed
+- rounded-2xl row inside a softer outer shell when the list is acting as a primary sidebar
+
+Bad signals:
+
+- white card floating above white page
+- hard selected outline
+- large shadows on list rows
+
+### 10.1a Sidebar shell pattern
+
+Use for app/dashboard sidebars when the sidebar itself should feel like a calm standalone object.
+
+Pattern:
+
+- outer shell uses a near-white neutral background, not pure white
+- shell gets a large radius (`rounded-[2rem]` range)
+- shell uses a faint border, often enough without any visible shadow
+- internal rows stay flatter than the outer shell
+- selected row uses a soft gray fill, not a stronger border treatment
+- footer actions may appear as floating white pills/cards inside the shell if they need separation
+
+This is the right pattern for:
+
+- workspace sidebars
+- Cloud dashboard sidebars
+- utility navigation that should feel product-like rather than admin-like
+
+### 10.2 Text-led preview list
+
+Use when a list controls a larger preview panel to the right.
+
+Pattern:
+
+- no boxed cards for each item
+- text blocks stacked vertically
+- inactive items use lower opacity
+- active item uses full opacity and darker copy
+
+This is the right pattern for:
+
+- feature explanation lists next to a demo panel
+- “build / import / ready” style narratives
+
+---
+
+## 11. Cards and Section Layouts
+
+### Explanatory cards
+
+Use only when the card itself is the unit of information.
+
+Should be:
+
+- simple
+- lightly bordered
+- white
+- softly rounded
+
+### When not to use cards
+
+If the user is just choosing between three conceptual options, don’t force every option into a boxed card. Use:
+
+- pill selector
+- text-only list
+- opacity-driven stacked copy
+
+### Product object cards
+
+Use when the UI is presenting a reusable worker, template, integration, or packaged setup.
+
+Pattern:
+
+- soft shell or near-white card
+- generous padding
+- title first
+- one short supporting sentence
+- compact status pill in the top-right if needed
+- actions inline underneath or within the card
+
+These should feel like curated product objects, not admin rows.
+
+### Icon tiles inside cards
+
+When a card uses an icon block:
+
+- use a soft filled tile (`bg-slate-50` / similar)
+- prefer no visible border by default
+- let size, radius, and fill define the tile
+- if a muted version is needed, use a quieter fill rather than an outline
+
+Do not:
+
+- put a dark stroke around the icon tile
+- make the icon tile look like a separate outlined button unless it actually is one
+- introduce standalone black/ink borders for decorative icon wrappers
+
+### Section composition
+
+Most sections should follow one of these layouts:
+
+1. **Headline + supporting copy + CTA**
+2. **Selector on left + live descriptor on right**
+3. **Text list on left + preview/demo on right**
+4. **Three-column summary cards**
+
+Do not mix too many interaction models in one section.
+
+---
+
+## 12. Demo and Mockup Styling
+
+Embedded product demos should feel like software, not like illustrations.
+
+### Demo shell rules
+
+- white inner content area
+- subtle chrome
+- soft border
+- restrained shadow
+- clear spacing
+
+### If the outer frame is atmospheric
+
+Then the inner mockup must become simpler.
+
+Meaning:
+
+- image/pattern on outer background is okay
+- inner card should stay clean and white
+- do not combine colorful outer frame with complex inner effects
+
+### Content in demos
+
+- use real-looking interaction states
+- keep labels readable
+- emphasize utility over visual flourish
+
+### Packaged workflow surfaces
+
+When showing a workflow like share/package/export:
+
+- prefer a soft shell over default modal chrome
+- make the core object the hero (template, worker, integration, package)
+- reduce the number of nested bordered panels
+- use one or two strong cards, then flatter supporting sections
+- present actions as intentional product actions, not generic form controls
+
+---
+
+## 13. Selection States
+
+Selection should usually be shown through one or more of:
+
+- darker text
+- stronger opacity
+- soft neutral fill
+- soft gray border
+- tiny shadow
+
+Selection should **not** usually be shown through:
+
+- black outline
+- bright accent fill
+- glow
+- thick stroke
+
+OpenWork selection should feel confident, not loud.
+
+When a selected item sits inside a soft app shell, prefer:
+
+- tinted gray fill first
+- then weight and text color
+- then at most a tiny white badge or tiny control shadow for supporting UI
+
+Avoid making the selected state look like a separate floating card unless the interface is explicitly using segmented pills.
+
+---
+
+## 13.5 Modal Surfaces
+
+Not every modal should look like a system dialog.
+
+For workflow modals (share, package, connect, publish, save to team):
+
+- use a large soft shell with a near-white background
+- keep the header airy and typographic
+- avoid harsh header separators unless they add real structure
+- prefer one scrollable content region inside the shell
+- use soft cards for major choices
+- reduce mini-panels and stacked utility boxes
+
+Good modal direction:
+
+- feels like a product surface
+- can contain object cards and actions
+- uses soft hierarchy and breathing room
+
+Bad modal direction:
+
+- dense settings sheet
+- too many small bordered sub-panels
+- generic dialog chrome with no product feel
+
+---
+
+## 14. Motion
+
+Motion should be tight and purposeful.
+
+### Allowed motion
+
+- pill transitions with spring
+- short opacity transitions
+- tiny translateY on primary CTA hover
+- soft content crossfades
+
+### Avoid
+
+- floaty delayed animations everywhere
+- scale-heavy hover effects
+- decorative motion on non-interactive surfaces
+
+### Timing
+
+- interactions should feel immediate
+- most transitions should live around `150ms–300ms`
+- spring motion should be controlled, not bouncy
+
+---
+
+## 15. OpenWork App vs Landing
+
+The app and the landing share one system, but not the same degree of atmosphere.
+
+### App
+
+- flatter
+- more structural
+- almost no decorative shadow
+- almost no background texture
+- strong emphasis on state clarity and density
+
+### Landing
+
+- may use soft shells
+- may use one atmospheric background image/pattern in a controlled region
+- may use more spacing and larger radii
+- still must obey the same button, border, and selection rules
+
+Landing should feel like the same product family, not a separate visual brand.
+
+---
+
+## 16. Anti-Patterns
+
+Do not introduce these:
+
+- beige canvases as default backgrounds
+- harsh black selected borders
+- random glassmorphism
+- multiple heavy shadow systems on one screen
+- over-rounded cards everywhere
+- boxed selectors when text or pills would be clearer
+- giant gradients behind readable text
+- decorative badges/counters with no functional meaning
+- hiding anchor labels just to show hover actions
+- outlined icon chips that read darker than the card they sit inside
+
+If something looks “designed” before it looks “useful,” it is probably wrong.
+
+---
+
+## 17. Canonical Component Patterns
+
+### Primary CTA
+
+- dark pill
+- white text
+- slight elevation
+
+### Secondary CTA / active segmented pill
+
+- white pill
+- tiny ring + tiny shadow
+- dark text
+
+### Selector track
+
+- light gray border
+- soft neutral background
+- internal padding
+- active item is white
+
+### Text-led feature list
+
+- no cards
+- stacked copy
+- inactive items at reduced opacity
+- active item at full opacity
+
+### Operational list row
+
+- rounded-xl
+- subtle hover tint
+- selected row uses fill/weight, not loud chrome
+
+### App sidebar shell
+
+- large rounded outer shell
+- faint neutral background
+- subtle border
+- flat internal rows
+- selected row uses soft gray fill
+- floating footer action can be white if it needs separation from the shell
+
+### Share/package modal
+
+- soft shell modal
+- object cards for reusable templates or integrations
+- compact status pills
+- strong dark primary CTA
+- white secondary CTA with tiny ring/shadow
+- avoid form-heavy utility styling unless the step is truly form-driven
+
+### Landing shell
+
+- reserved for hero/showcase moments
+- use sparingly
+
+### Landing soft shell
+
+- flat, near-white, subtle border
+- no shadow by default
+
+---
+
+## 18. Design Decision Tests
+
+Before shipping a UI change, ask:
+
+1. Is this relying on layout and typography first, or on effects first?
+2. Is the selected state soft and obvious, rather than harsh?
+3. Are we reusing the existing primary/secondary button language?
+4. Does this section need cards, or would pills / text / opacity be cleaner?
+5. Is the shadow doing real work, or is it just decoration?
+6. Would this still feel like OpenWork if all colors were muted?
+7. Does this feel like one coherent product across app and landing?
+
+If the answer to those is not clearly yes, simplify.
+
+---
+
+## 19. Canonical References in This Repo
+
+Use these as implementation references:
+
+- Landing button + shell primitives: `_repos/openwork/ee/apps/landing/app/globals.css`
+- Landing hero and selector patterns: `_repos/openwork/ee/apps/landing/components/landing-home.tsx`
+- Landing demo list rhythm: `_repos/openwork/ee/apps/landing/components/landing-app-demo-panel.tsx`
+- Cloud dashboard sidebar shell + selected state: `_repos/openwork/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-dashboard-shell.tsx`
+- Share/package modal direction: `_repos/openwork/apps/app/src/app/components/share-workspace-modal.tsx`
+- App workspace/session list rhythm: `_repos/openwork/apps/app/src/app/components/session/workspace-session-list.tsx`
+
+When in doubt, prefer the calmer version.
diff --git a/DESIGN-SYSTEM.md b/DESIGN-SYSTEM.md
new file mode 100644
index 0000000000..efc252707c
--- /dev/null
+++ b/DESIGN-SYSTEM.md
@@ -0,0 +1,474 @@
+# OpenWork Design System
+
+This document turns the visual direction in `DESIGN-LANGUAGE.md` into an implementation system that can unify:
+
+- `apps/app` (OpenWork app)
+- `ee/apps/den-web` (OpenWork Cloud / Den web surfaces)
+- `ee/apps/landing` (marketing + product storytelling)
+
+The goal is not to create three similar styles. The goal is one OpenWork design system with a few environment-specific expressions.
+
+---
+
+## 1. Why this exists
+
+Today the product already has the beginnings of a system, but it is split across:
+
+- app-specific CSS variables in `apps/app/src/app/index.css`
+- Tailwind theme setup in `apps/app/tailwind.config.ts`
+- Radix color tokens in `apps/app/src/styles/colors.css`
+- repeated utility-class decisions across app, Cloud, and landing
+
+That creates three problems:
+
+1. the app and Cloud can feel related but not identical
+2. visual decisions are made at the screen level instead of the system level
+3. tokens, primitives, and page composition rules are not clearly separated
+
+This file defines the missing structure.
+
+---
+
+## 2. System model
+
+OpenWork should use a three-layer design system:
+
+### Layer 1: Foundations
+
+Raw design tokens:
+
+- color
+- typography
+- spacing
+- radius
+- shadow
+- motion
+
+These are the only values components should depend on directly.
+
+### Layer 2: Semantic tokens
+
+Product-meaning tokens:
+
+- `surface.page`
+- `surface.panel`
+- `surface.sidebar`
+- `text.primary`
+- `text.secondary`
+- `border.subtle`
+- `action.primary.bg`
+- `state.hover`
+- `state.selected`
+
+These should map foundation tokens into product meaning.
+
+### Layer 3: Component primitives
+
+Reusable building blocks:
+
+- Button
+- Card
+- Input
+- Modal shell
+- Sidebar shell
+- List row
+- Status pill
+- Section header
+- Empty state
+
+Pages should mostly compose these primitives, not invent their own visual logic.
+
+---
+
+## 3. Relationship to existing docs
+
+- `DESIGN-LANGUAGE.md` = visual philosophy and qualitative rules
+- `DESIGN-SYSTEM.md` = implementation structure and migration plan
+
+If there is a conflict:
+
+1. `DESIGN-LANGUAGE.md` decides what the product should feel like
+2. `DESIGN-SYSTEM.md` decides how to encode that in tokens and primitives
+
+---
+
+## 4. Core principle: one system, three expressions
+
+OpenWork has three main UI contexts:
+
+1. **App expression** — denser, flatter, operational
+2. **Cloud expression** — still operational, slightly more editorial and roomy
+3. **Landing expression** — more atmospheric, but still clearly the same product family
+
+These should differ mostly in:
+
+- spacing density
+- shell scale
+- amount of atmosphere
+- page composition
+
+They should **not** differ in:
+
+- brand color logic
+- button language
+- border philosophy
+- type hierarchy
+- selection behavior
+
+---
+
+## 5. Canonical token architecture
+
+We should converge on a small token set that works everywhere.
+
+### 5.1 Foundation color tokens
+
+Use Radix as the raw palette source, but not as the public API for product styling.
+
+Raw palette source:
+
+- Radix gray/slate/sage for neutrals
+- Radix red/amber/green/blue for semantic states
+
+### 5.2 Semantic color tokens
+
+Canonical semantic token set:
+
+- `--ow-color-page`
+- `--ow-color-surface`
+- `--ow-color-surface-subtle`
+- `--ow-color-surface-sidebar`
+- `--ow-color-border`
+- `--ow-color-border-strong`
+- `--ow-color-text`
+- `--ow-color-text-muted`
+- `--ow-color-text-subtle`
+- `--ow-color-accent`
+- `--ow-color-accent-hover`
+- `--ow-color-hover`
+- `--ow-color-active`
+- `--ow-color-success`
+- `--ow-color-warning`
+- `--ow-color-danger`
+
+These should become the shared API across app and Cloud.
+
+### 5.3 Current mapping from app tokens
+
+Existing app tokens already point in the right direction:
+
+- `--dls-app-bg` -> `--ow-color-page`
+- `--dls-surface` -> `--ow-color-surface`
+- `--dls-sidebar` -> `--ow-color-surface-sidebar`
+- `--dls-border` -> `--ow-color-border`
+- `--dls-text-primary` -> `--ow-color-text`
+- `--dls-text-secondary` -> `--ow-color-text-muted`
+- `--dls-accent` -> `--ow-color-accent`
+- `--dls-accent-hover` -> `--ow-color-accent-hover`
+
+We should migrate by aliasing first, not by breaking everything at once.
+
+---
+
+## 6. Typography system
+
+Typography should be systemized into roles, not ad hoc text sizes.
+
+### Roles
+
+- **display** — rare marketing or hero usage
+- **headline** — page and section headers
+- **title** — card and object titles
+- **body** — default reading text
+- **meta** — labels, helper copy, secondary information
+- **micro** — pills, badges, tiny metadata
+
+### Shared rules
+
+- one main sans family across product surfaces
+- medium weight does the majority of hierarchy work
+- muted text is the default support color
+- avoid large type jumps inside the app
+
+---
+
+## 7. Spacing system
+
+OpenWork should use a consistent spacing scale instead of one-off values.
+
+Recommended base scale:
+
+- 4
+- 8
+- 12
+- 16
+- 20
+- 24
+- 32
+- 40
+- 48
+- 64
+
+### Usage guidance
+
+- micro control padding: 8–12
+- row padding: 12–16
+- card padding: 20–24
+- major section padding: 32–48
+- page rhythm: 48–64 on roomy surfaces, 24–32 in dense app surfaces
+
+---
+
+## 8. Radius system
+
+Canonical radius roles:
+
+- `--ow-radius-control` — small controls and rows
+- `--ow-radius-card` — cards and panels
+- `--ow-radius-shell` — sidebars, large grouped containers, modal shells
+- `--ow-radius-pill` — buttons, tabs, chips
+
+Suggested mapping:
+
+- control: 12px
+- card: 16px
+- shell: 24px–32px
+- pill: 9999px
+
+---
+
+## 9. Shadow system
+
+Shadow should be a named system with very few levels.
+
+- `--ow-shadow-none`
+- `--ow-shadow-control`
+- `--ow-shadow-card`
+- `--ow-shadow-shell`
+
+Default behavior:
+
+- app: mostly `none` or `control`
+- Cloud: mostly `none`, `control`, occasional `card`
+- landing: selective `card` or `shell`
+
+---
+
+## 10. Component primitive families
+
+We should explicitly define a small primitive set shared across product surfaces.
+
+### 10.1 Action primitives
+
+- Primary button
+- Secondary button
+- Ghost button
+- Destructive button
+- Segmented pill / tab item
+
+### 10.2 Structure primitives
+
+- Page shell
+- Sidebar shell
+- Card
+- Quiet card
+- Modal shell
+- Section divider
+
+### 10.3 Input primitives
+
+- Text input
+- Textarea
+- Select
+- Checkbox/radio treatment
+- Inline field group
+
+### 10.4 Navigation primitives
+
+- Sidebar row
+- List row
+- Topbar item
+- Breadcrumb / section tab
+
+### 10.5 Feedback primitives
+
+- Status pill
+- Banner
+- Empty state
+- Toast
+
+---
+
+## 11. System-first implementation rules
+
+### Rule 1: prefer semantic tokens over raw utility colors
+
+Prefer:
+
+- `bg-[var(--ow-color-surface)]`
+- `text-[var(--ow-color-text-muted)]`
+
+Over:
+
+- `bg-white`
+- `text-gray-500`
+
+Raw grays are still acceptable for temporary legacy usage, but new primitives should use semantic tokens.
+
+### Rule 2: page code should not define new visual language
+
+Page files can compose primitives and choose layouts.
+They should not invent new button styles, new shadow rules, or new selection patterns.
+
+### Rule 3: Radix stays underneath the system
+
+Radix is the palette source.
+OpenWork tokens are the product API.
+
+### Rule 4: app and Cloud should share primitives even if frameworks differ
+
+Even when implementations differ, the primitive names and behaviors should match.
+
+Example:
+
+- `Button` in app
+- `Button` in den-web
+
+Both should resolve to the same token logic and visual rules.
+
+---
+
+## 12. Migration strategy
+
+Do not redesign everything at once.
+Use this sequence.
+
+### Phase 1: lock the foundations
+
+1. create canonical semantic tokens
+2. alias current app tokens to the new token names
+3. document primitive families and approved variants
+
+### Phase 2: unify the most reused primitives
+
+Start with:
+
+1. Button
+2. Card
+3. Input
+4. Sidebar row
+5. Modal shell
+
+These give the largest visual consistency gain.
+
+### Phase 3: unify shell patterns
+
+Standardize:
+
+- page background
+- sidebar shell
+- panel/card shell
+- list row selection
+- headers and section spacing
+
+### Phase 4: refactor high-traffic screens
+
+Prioritize:
+
+- workspace/session surfaces in `apps/app`
+- Cloud dashboard shells in `ee/apps/den-web`
+- share/package/connect flows in `apps/app`
+
+### Phase 5: remove local style drift
+
+As primitives stabilize:
+
+- reduce repeated one-off class recipes
+- replace raw gray classes in repeated patterns
+- collapse duplicate card/button/input styles into primitives
+
+---
+
+## 13. Recommended initial source of truth files
+
+If we implement this system, the likely canonical files should be:
+
+- `DESIGN-LANGUAGE.md` — philosophy
+- `DESIGN-SYSTEM.md` — system rules and migration plan
+- `apps/app/src/app/index.css` — initial token host for app runtime
+- `apps/app/tailwind.config.ts` — Tailwind token exposure
+- `apps/app/src/app/components/button.tsx` — canonical action primitive start
+- `apps/app/src/app/components/card.tsx` — canonical surface primitive start
+- `apps/app/src/app/components/text-input.tsx` — canonical field primitive start
+
+Later, a shared package may make sense, but not before the token model is stable.
+
+---
+
+## 14. Recommended file plan for the next step
+
+The smallest safe implementation path is:
+
+### Step A
+
+Introduce canonical `--ow-*` aliases in `apps/app/src/app/index.css` without removing `--dls-*` yet.
+
+### Step B
+
+Refactor `Button`, `Card`, and `TextInput` to consume shared semantic tokens.
+
+### Step C
+
+Use the Den dashboard shell as the reference for:
+
+- sidebar shell
+- row selection
+- neutral panel rhythm
+
+### Step D
+
+Restyle one OpenWork app screen fully using the system to prove the direction.
+
+Recommended pilot screens:
+
+- `apps/app/src/app/pages/settings.tsx`
+- session/workspace sidebar surfaces
+- share workspace modal
+
+---
+
+## 15. What a successful system looks like
+
+We will know this is working when:
+
+1. app, Cloud, and landing feel obviously from the same product family
+2. a new screen can be built mostly from existing primitives
+3. visual changes happen by adjusting tokens or primitives, not by editing many pages
+4. selection, buttons, cards, and inputs behave consistently everywhere
+5. raw color classes become uncommon outside truly local exceptions
+
+---
+
+## 16. Anti-goals
+
+This system should not:
+
+- introduce a trendy visual reboot disconnected from the current product
+- replace the OpenWork mood described in `DESIGN-LANGUAGE.md`
+- depend on a large new dependency just to manage styling
+- force a shared package too early
+- block incremental improvements until a perfect system exists
+
+The correct approach is a strong design system built through small, boring, compounding steps.
+
+---
+
+## 17. Immediate next recommendation
+
+If continuing from this doc, the best next change is:
+
+1. add `--ow-*` semantic token aliases in `apps/app/src/app/index.css`
+2. standardize `Button`, `Card`, and `TextInput`
+3. then restyle one app shell to match the calmer Den dashboard direction
+
+That gives a real system foothold without a broad rewrite.
diff --git a/INFRASTRUCTURE.md b/INFRASTRUCTURE.md
new file mode 100644
index 0000000000..018c6b1f61
--- /dev/null
+++ b/INFRASTRUCTURE.md
@@ -0,0 +1,103 @@
+# OpenWork Infrastructure Principles
+
+OpenWork is an experience layer. `opencode` is the engine. This document defines how infrastructure is built so every component is usable on its own, composable as a sidecar, and easy to automate.
+
+## Core Principles
+
+1.  CLI-first, always
+
+* Every infrastructure component must be runnable via a single CLI command.
+* The OpenWork UI may wrap these, but never replace or lock them out.
+
+2.  Unix-like interfaces
+
+* Prefer simple, composable boundaries: JSON over stdout, flags, and env vars.
+* Favor readable logs and predictable exit codes.
+
+3.  Sidecar-composable
+
+* Any component must run as a sidecar without special casing.
+* The UI should connect to the same surface area the CLI exposes.
+
+4.  Clear boundaries
+
+* OpenCode remains the engine; OpenWork adds a thin config + UX layer.
+* When OpenCode exposes a stable API, use it instead of re-implementing.
+
+5.  Local-first, graceful degradation
+
+* Default to local execution.
+* Hosted cloud is a first-class option, not a separate product.
+* If a sidecar is missing or offline, the UI falls back to read-only or explicit user guidance.
+
+6.  Portable configuration
+
+* Use config files + env vars; avoid hidden state.
+* Keep credentials outside git and outside the repo.
+
+7.  Observability by default
+
+* Provide health endpoints and structured logs.
+* Record audit events for every config mutation.
+
+8.  Security + scoping
+
+* All filesystem access is scoped to explicit workspace roots.
+* Writes require explicit host approval when requested remotely.
+
+9.  Debuggable by agents
+    Agents like (you?) make tool calls tool calls can do a variety of things form using chrome
+    to calling curl, using the cli, using bun, making scripts.
+
+You're not afraid to run the program on your OS but to benefit from it you need to design the arch
+so these things are callable.
+
+E.g. it is very hard to call a things from the desktop app (you have not a lot of control).
+
+But what you can do is:
+
+* run the undelrying clis (since they are implented as sidecar)
+* run against real opencode value
+* use bash to test endpionts of these various servers/etc
+* if needed don't hestiate to ask for credentialse.g. to test telegram or other similar flow
+  -you should be able to test 99% of the flow on your own
+
+## Applied to Current Components
+
+### opencode Engine
+
+* Always usable via `opencode` CLI.
+* OpenWork never replaces the CLI; it only connects to the engine.
+
+### OpenWork Server
+
+* Runs standalone via `openwork-server` CLI.
+* Provides filesystem-backed config surfaces (skills, plugins, MCP, commands).
+* Sidecar lifecycle is described in `packages/app/pr/openwork-server.md`.
+* Can also be consumed as a hosted OpenWork Cloud control surface for remote worker lifecycle.
+
+### OpenWork Cloud Control Plane
+
+* Hosted deployment of OpenWork server capabilities for worker provisioning and remote connect.
+* Must preserve the same user-level contract as self-hosted paths:
+  - launch worker
+  - get connect credentials (URL + token)
+  - connect via `Add worker` -> `Connect remote`
+* Should not require a separate mental model for users moving between local and hosted modes.
+
+### OpenCode Router
+
+* Runs standalone via `opencode-router` CLI.
+* Must be able to use OpenWork server for config and approvals.
+
+## Non-goals
+
+* Replacing OpenCode primitives with custom abstractions.
+* Forcing cloud-only lock-in (self-hosted desktop/CLI paths must remain valid).
+
+## References
+
+* `VISION.md`
+* `PRINCIPLES.md`
+* `ARCHITECTURE.md`
+* `packages/app/pr/openwork-server.md`
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000000..546b09b5df
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,29 @@
+Copyright (c) 2026-present Different AI, Inc.
+
+Portions of this software are licensed as follows:
+
+* All content that resides under the /ee directory of this repository is licensed under the license defined in "ee/LICENSE" (Fair Source License).
+* All third party components incorporated into the OpenWork Software are licensed under the original license provided by the owner of the applicable component.
+* Content outside of the above mentioned directories or restrictions above is available under the "MIT" license as defined below.
+
+MIT License
+
+Copyright (c) 2026 Different AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/PRINCIPLES.md b/PRINCIPLES.md
new file mode 100644
index 0000000000..6bcb80d845
--- /dev/null
+++ b/PRINCIPLES.md
@@ -0,0 +1,31 @@
+# OpenWork Principles
+
+## Decision framework for adding new features or fixing bugs:
+
+- is it easy to test? how can we make it more easy ? (e.g. we can use the chrome mcp  and pnpm:dev to test ui take screenshots)
+- is there an existing opencode equivalent for this feature? (we should use it if we can) if not how does it map to a better user experience for bob *or* susan (see below)
+- if it's a bug what were you testing? what were you trying to achieve? what did you observe we can't move on before having a core undesrtanding
+
+## Constraints
+
+- Work with **only the folders the user authorizes**.
+- Treat **plugins + skills + commands + mcp** as the primary extensibility system. These are native to OpenCode and OpenWork must be a thin layer on top of them. They're mostly fs based.
+
+## Principles
+
+- **Parity**: UI actions map to OpenCode server APIs.
+- **Server-consumption first**: OpenWork app consumes OpenWork server surfaces (desktop-hosted, orchestrator-hosted, or cloud-hosted) instead of inventing parallel behavior.
+- **Transparency**: plans, steps, tool calls, permissions are visible.
+- **Least privilege**: only user-authorized folders + explicit approvals.
+- **Prompt is the workflow**: product logic lives in prompts, rules, and skills.
+- **Graceful degradation**: if access is missing, guide the user.
+- **Progressive disclosure by default**: non-technical users should see clear primary actions first; IDs/URLs/diagnostics stay behind explicit "manual" or "advanced" sections.
+- **Cloud + self-hosted consistency**: the same connect mental model (`Add worker` -> `Connect remote`) should work regardless of where the server runs.
+
+## Security & Privacy
+
+- Local-first by default.
+- No secrets in git.
+- Use OS keychain for credentials.
+- Clear, explicit permissions.
+- Exportable audit logs.
diff --git a/PRODUCT.md b/PRODUCT.md
new file mode 100644
index 0000000000..610040c5a0
--- /dev/null
+++ b/PRODUCT.md
@@ -0,0 +1,60 @@
+## Product
+
+OpenWork helps individual create, consume, and maintain their agentic workflows.
+
+OpenWork helps companies share their agentic workflows and provision their entire team.
+
+The chat interfaces is where people consume the workflows.
+
+Interfaces for consuming workflows:
+- Desktop app
+- Slack
+- Telegram
+
+What is a "agentic workflow":
+- LLM providers
+- Skills
+- MCP
+- Agents
+- Plugins
+- Tools
+- Background Agents
+
+Where are workflows created:
+- Desktop app (using slash commands like `/create-skills`)
+- Web App
+- [We need better places for this to happen[
+
+Where are workflows maintain:
+- In OpenWork Cloud (internal name is Den).
+
+Where are workflow hosted:
+- Local Machine
+- Remote via a OpenWork Host (CLI or desktop)
+- Remote on OpenWork Cloud (via Den sandbox workers)
+
+## Current OpenWork Cloud flow
+
+- Users can sign in with the standard web auth providers or accept an org invite through the hosted join flow.
+- Invite signup keeps the invited email fixed, verifies the user by email code, and then drops them into the org join path.
+- Cloud workers are a paid flow: users complete checkout before they can launch hosted workers.
+- After a worker is ready, the user connects from the OpenWork app with `Add a worker` -> `Connect remote`, or opens the generated deep link directly.
+
+## Team distribution
+
+- Organizations can publish shared skill hubs so members discover approved skills from one managed place instead of collecting local-only installs by hand.
+
+## Actors
+Bob IT guy makes the config.
+Susan the accountant consumes the config.
+
+Constraints:
+- We use standards were possible
+- We use opencode where possible
+- We stay platform agnostic
+
+
+How to decide if OpenWork should do something:
+- Does it help Bob share config more easily?
+- Does it help Susan consume shared workflows more easily?
+- Is this something that is coding specific?
diff --git a/README.md b/README.md
index 0c095c8b14..0bbe3325cc 100644
--- a/README.md
+++ b/README.md
@@ -1,104 +1,251 @@
-# OpenWork
+> OpenWork is the open source alternative to Claude Cowork/Codex (desktop app).
 
-OpenWork is an **extensible, open-source “Claude Work” style system for knowledge workers**.
 
-It’s a native desktop app (Tauri) that runs **OpenCode** under the hood, but presents it as a clean, guided workflow:
-- pick a workspace
-- start a run
-- watch progress + plan updates
-- approve permissions when needed
-- reuse what works (templates + skills)
+## Core Philosophy
 
-The goal: make “agentic work” feel like a product, not a terminal.
+- Local-first, cloud-ready: OpenWork runs on your machine in one click. Send a message instantly.
+- Composable: desktop app, Slack/Telegram connector, or server. Use what fits, no lock-in.
+- Ejectable: OpenWork is powered by OpenCode, so everything OpenCode can do works in OpenWork, even without a UI yet.
+- Sharing is caring: start solo on localhost, then explicitly opt into remote sharing when you need it.
+
+<p align="center">
+  <img src="./app-demo.gif" alt="OpenWork demo" width="800" />
+</p>
+
+OpenWork is designed around the idea that you can easily ship your agentic workflows for your team as a repeatable, productized process.
+
+> [!TIP]
+> **Looking for an [Enterprise Plan](https://openworklabs.com/enterprise)?** [Speak with our Sales Team today](https://calendar.app.google/86QpCENvhfEzDFLu5)
+>
+> Get enhanced capabilities including feature prioritization, SSO, SLA support, LTS versions, and more.
+
+## Alternate UIs
+- **OpenWork Orchestrator (CLI host)**: run OpenCode + OpenWork server without the desktop UI.
+  - install: `npm install -g openwork-orchestrator`
+  - run: `openwork start --workspace /path/to/workspace --approval auto`
+  - docs: [apps/orchestrator/README.md](./apps/orchestrator/README.md)
+
+## Quick start
+
+Download the desktop app from [openworklabs.com/download](https://openworklabs.com/download), grab the latest [GitHub release](https://github.com/different-ai/openwork/releases), or install from source below.
+
+- macOS and Linux downloads are available directly.
+- Windows access is currently handled through the paid support plan on [openworklabs.com/pricing#windows-support](https://openworklabs.com/pricing#windows-support).
+- Hosted OpenWork Cloud workers are launched from the web app after checkout, then connected from the desktop app via `Add a worker` -> `Connect remote`.
 
 ## Why
 
-Knowledge workers don’t want to learn a CLI, fight config sprawl, or rebuild the same workflows in every repo.
+Current CLI and GUIs for opencode are anchored around developers. That means a focus on file diffs, tool names, and hard to extend capabilities without relying on exposing some form of cli.
+
 OpenWork is designed to be:
-- **Extensible**: skills and workflows are installable modules.
+
+- **Extensible**: skill and opencode plugins are installable modules.
 - **Auditable**: show what happened, when, and why.
-- **Permissioned**: explicit user approval for risky actions.
-- **Portable**: keep logic in prompts/skills, not bespoke code.
+- **Permissioned**: access to privileged flows.
+- **Local/Remote**: OpenWork works locally as well as can connect to remote servers.
 
-## What’s Included (v0.1)
+## What’s Included
 
-- **Host mode**: start `opencode serve` locally in a chosen folder.
+- **Host mode**: runs opencode locally on your computer
 - **Client mode**: connect to an existing OpenCode server by URL.
 - **Sessions**: create/select sessions and send prompts.
 - **Live streaming**: SSE `/event` subscription for realtime updates.
 - **Execution plan**: render OpenCode todos as a timeline.
 - **Permissions**: surface permission requests and reply (allow once / always / deny).
 - **Templates**: save and re-run common workflows (stored locally).
+- **Debug exports**: copy or export the runtime debug report and developer log stream from Settings -> Debug when you need to file a bug.
 - **Skills manager**:
-  - list installed `.opencode/skill` folders
-  - install from OpenPackage (`opkg install ...`)
-  - import a local skill folder into `.opencode/skill/<skill-name>`
+  - list installed `.opencode/skills` folders
+  - import a local skill folder into `.opencode/skills/<skill-name>`
+
+## Skill Manager
+
+<img width="1292" height="932" alt="image" src="https://github.com/user-attachments/assets/b500c1c6-a218-42ce-8a11-52787f5642b6" />
+
+## Works on local computer or servers
+
+<img width="1292" height="932" alt="Screenshot 2026-01-13 at 7 05 16 PM" src="https://github.com/user-attachments/assets/9c864390-de69-48f2-82c1-93b328dd60c3" />
 
 ## Quick Start
 
 ### Requirements
 
 - Node.js + `pnpm`
-- Rust toolchain (for Tauri): `cargo`, `rustc`
+- Rust toolchain (for Tauri): install via `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`
+- Tauri CLI: `cargo install tauri-cli`
 - OpenCode CLI installed and available on PATH: `opencode`
 
+### Local Dev Prerequisites (Desktop)
+
+Before running `pnpm dev`, ensure these are installed and active in your shell:
+
+- Node + pnpm (repo uses `pnpm@10.27.0`)
+- **Bun 1.3.9+** (`bun --version`)
+- Rust toolchain (for Tauri), with Cargo from current `rustup` stable (supports `Cargo.lock` v4)
+- Xcode Command Line Tools (macOS)
+- On Linux, WebKitGTK 4.1 development packages so `pkg-config` can resolve `webkit2gtk-4.1` and `javascriptcoregtk-4.1`
+
+### One-minute sanity check
+
+Run from repo root:
+
+```bash
+git checkout dev
+git pull --ff-only origin dev
+pnpm install --frozen-lockfile
+
+which bun
+bun --version
+pnpm --filter @openwork/desktop exec tauri --version
+```
+
 ### Install
 
 ```bash
 pnpm install
 ```
 
+OpenWork now lives in `apps/app` (UI) and `apps/desktop` (desktop shell).
+
 ### Run (Desktop)
 
 ```bash
 pnpm dev
 ```
 
+`pnpm dev` now enables `OPENWORK_DEV_MODE=1` automatically, so desktop dev uses an isolated OpenCode state instead of your personal global config/auth/data.
+
 ### Run (Web UI only)
 
 ```bash
-pnpm dev:web
+pnpm dev:ui
+```
+
+All repo `dev` entrypoints now opt into the same dev-mode isolation so local testing uses the OpenWork-managed OpenCode state consistently.
+
+### Arch Users:
+
+```bash
+sudo pacman -S --needed webkit2gtk-4.1
+curl -fsSL https://opencode.ai/install | bash -s -- --version "$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")" --no-modify-path
 ```
 
 ## Architecture (high-level)
 
-- In **Host mode**, OpenWork spawns:
-  - `opencode serve --hostname 127.0.0.1 --port <free-port>`
-  - with your selected project folder as the process working directory.
+- In **Host mode**, OpenWork runs a local host stack and connects the UI to it.
+  - Default runtime: `openwork` (installed from `openwork-orchestrator`), which orchestrates `opencode`, `openwork-server`, and optionally `opencode-router`.
+  - Fallback runtime: `direct`, where the desktop app spawns `opencode serve --hostname 127.0.0.1 --port <free-port>` directly.
+
+When you select a project folder, OpenWork runs the host stack locally using that folder and connects the desktop UI.
+This lets you run agentic workflows, send prompts, and see progress entirely on your machine without a remote server.
+
 - The UI uses `@opencode-ai/sdk/v2/client` to:
   - connect to the server
   - list/create sessions
   - send prompts
-  - subscribe to SSE events
+  - subscribe to SSE events(Server-Sent Events are used to stream real-time updates from the server to the UI.)
   - read todos and permission requests
 
 ## Folder Picker
 
 The folder picker uses the Tauri dialog plugin.
 Capability permissions are defined in:
-- `src-tauri/capabilities/default.json`
 
-## OpenPackage Notes
+- `apps/desktop/src-tauri/capabilities/default.json`
 
-If `opkg` is not installed globally, OpenWork falls back to:
+## OpenCode Plugins
 
-```bash
-pnpm dlx opkg install <package>
+Plugins are the **native** way to extend OpenCode. OpenWork now manages them from the Skills tab by
+reading and writing `opencode.json`.
+
+- **Project scope**: `<workspace>/opencode.json`
+- **Global scope**: `~/.config/opencode/opencode.json` (or `$XDG_CONFIG_HOME/opencode/opencode.json`)
+
+You can still edit `opencode.json` manually; OpenWork uses the same format as the OpenCode CLI:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-wakatime"]
+}
 ```
 
 ## Useful Commands
 
 ```bash
+pnpm dev
+pnpm dev:ui
 pnpm typecheck
-pnpm build:web
+pnpm build
+pnpm build:ui
 pnpm test:e2e
 ```
 
+## Troubleshooting
+
+If you need to report a desktop or session bug, open Settings -> Debug and export both the runtime debug report and developer logs before filing an issue.
+
+### Linux / Wayland (Hyprland)
+
+If OpenWork crashes on launch with WebKitGTK errors like `Failed to create GBM buffer`, disable dmabuf or compositing before launch. Try one of the following environment flags.
+
+```bash
+WEBKIT_DISABLE_DMABUF_RENDERER=1 openwork
+```
+
+```bash
+WEBKIT_DISABLE_COMPOSITING_MODE=1 openwork
+```
+
 ## Security Notes
 
 - OpenWork hides model reasoning and sensitive tool metadata by default.
 - Host mode binds to `127.0.0.1` by default.
 
+## Contributing
+
+- Review `AGENTS.md` plus `VISION.md`, `PRINCIPLES.md`, `PRODUCT.md`, and `ARCHITECTURE.md` to understand the product goals before making changes.
+- Ensure Node.js, `pnpm`, the Rust toolchain, and `opencode` are installed before working inside the repo.
+- Run `pnpm install` once per checkout, then verify your change with `pnpm typecheck` plus `pnpm test:e2e` (or the targeted subset of scripts) before opening a PR.
+- Use `.github/pull_request_template.md` when opening PRs and include exact commands, outcomes, manual verification steps, and evidence.
+- If CI fails, classify failures in the PR body as either code-related regressions or external/environment/auth blockers.
+- Add new PRDs to `apps/app/pr/<name>.md` following the `.opencode/skills/prd-conventions/SKILL.md` conventions described in `AGENTS.md`.
+
+Community docs:
+
+- `CODE_OF_CONDUCT.md`
+- `SECURITY.md`
+- `SUPPORT.md`
+- `TRIAGE.md`
+
+First contribution checklist:
+
+- [ ] Run `pnpm install` and baseline verification commands.
+- [ ] Confirm your change has a clear issue link and scope.
+- [ ] Add/update tests for behavioral changes.
+- [ ] Include commands run and outcomes in your PR.
+- [ ] Add screenshots/video for user-facing flow changes.
+
+## Supported Languages
+
+Translated READMEs: [`translated_readmes/`](./translated_readmes/README.md), available in English, 简体中文, 繁體中文, 日本語.
+
+The App is available in the following languages:
+- English (`en`)
+- French (`fr`)
+- Spanish (`es`)
+- Catalan (`ca`)
+- Brazilian Portuguese (`pt-BR`)
+- Japanese (`ja`)
+- Simplified Chinese (`zh`)
+- Thai (`th`)
+- Vietnamese (`vi`)
+- Russian (`ru`)
+
+## For Teams & Businesses
+
+Interested in using OpenWork in your organization? We'd love to hear from you — reach out at [ben@openworklabs.com](mailto:ben@openworklabs.com) to chat about your use case.
+
 ## License
 
-TBD.
+MIT — see `LICENSE`.
diff --git a/RELEASE.md b/RELEASE.md
new file mode 100644
index 0000000000..135da4bbd5
--- /dev/null
+++ b/RELEASE.md
@@ -0,0 +1,64 @@
+# Release checklist
+
+OpenWork releases should be deterministic, easy to reproduce, and fully verifiable with CLI tooling.
+
+## Preflight
+
+- Sync the default branch (currently `dev`).
+- Run `pnpm release:review` and fix any mismatches.
+- If you are building sidecar assets, set `SOURCE_DATE_EPOCH` to the tag timestamp for deterministic manifests.
+
+## App release (desktop)
+
+1. Bump versions (app + desktop + Tauri + Cargo):
+    - `pnpm bump:patch` or `pnpm bump:minor` or `pnpm bump:major`
+2. Re-run `pnpm release:review`.
+3. Build sidecars for the desktop bundle:
+   - `pnpm --filter @different-ai/openwork prepare:sidecar`
+4. Commit the version bump.
+5. Tag and push:
+   - `git tag vX.Y.Z`
+   - `git push origin vX.Y.Z`
+
+## openwork-orchestrator (npm + sidecars)
+
+1. Bump versions (includes `packages/orchestrator/package.json`):
+   - `pnpm bump:patch` or `pnpm bump:minor` or `pnpm bump:major`
+2. Build sidecar assets and manifest:
+   - `pnpm --filter openwork-orchestrator build:sidecars`
+3. Create the GitHub release for sidecars:
+   - `gh release create openwork-orchestrator-vX.Y.Z packages/orchestrator/dist/sidecars/* --repo different-ai/openwork`
+4. Publish the package:
+   - `pnpm --filter openwork-orchestrator publish --access public`
+
+## openwork-server + opencode-router (if version changed)
+
+- `pnpm --filter openwork-server publish --access public`
+- `pnpm --filter opencode-router publish --access public`
+
+## Verification
+
+- `openwork start --workspace /path/to/workspace --check --check-events`
+- `gh run list --repo different-ai/openwork --workflow "Release App" --limit 5`
+- `gh release view vX.Y.Z --repo different-ai/openwork`
+
+Use `pnpm release:review --json` when automating these checks in scripts or agents.
+
+## AUR
+
+`Release App` publishes the Arch AUR package automatically after the Linux `.deb` asset is uploaded.
+
+For local AMD64 Arch builds without Docker, see `packaging/aur/README.md`.
+
+Required repo config:
+
+- GitHub Actions secret: `AUR_SSH_PRIVATE_KEY` (SSH key with push access to the AUR package repo)
+- Optional repo variable: `AUR_REPO` (defaults to `openwork`)
+
+## npm publishing
+
+If you want `Release App` to publish `openwork-orchestrator`, `openwork-server`, and `opencode-router` to npm, configure:
+
+- GitHub Actions secret: `NPM_TOKEN` (npm automation token)
+
+If `NPM_TOKEN` is not set, the npm publish job is skipped.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..b8593f097e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,33 @@
+# Security Policy
+
+## Supported versions
+
+OpenWork is under active development and we prioritize fixes on the latest release and
+the current `dev` branch.
+
+## Reporting a vulnerability
+
+Please do not open public GitHub issues for security vulnerabilities.
+
+Instead, report vulnerabilities privately to:
+
+- Email: `ben@openworklabs.com`
+- Subject: `[OpenWork security] <short summary>`
+
+Please include:
+
+- A clear description of the issue
+- Reproduction steps or proof of concept
+- Impact assessment
+- Suggested remediation (if known)
+
+## Response expectations
+
+- We will acknowledge receipt within 3 business days.
+- We will provide an initial triage status within 7 business days.
+- We will share remediation or mitigation guidance as soon as available.
+
+## Disclosure guidance
+
+Please keep details private until a fix or mitigation is available and maintainers
+confirm public disclosure timing.
diff --git a/STATS.md b/STATS.md
new file mode 100644
index 0000000000..0f82d3f162
--- /dev/null
+++ b/STATS.md
@@ -0,0 +1,110 @@
+# Download Stats
+
+Legacy cumulative release-asset totals. For classified v2 buckets, see `STATS_V2.md`.
+
+| Date | GitHub Downloads | Total |
+|------|------------------|-------|
+| 2026-01-24 | 15,879 (+15,879) | 15,879 (+15,879) |
+| 2026-01-24 | 17,254 (+1,375) | 17,254 (+1,375) |
+| 2026-01-24 | 17,254 (+0) | 17,254 (+0) |
+| 2026-01-26 | 19,869 (+2,615) | 19,869 (+2,615) |
+| 2026-01-27 | 23,489 (+3,620) | 23,489 (+3,620) |
+| 2026-01-28 | 25,238 (+1,749) | 25,238 (+1,749) |
+| 2026-01-29 | 26,939 (+1,701) | 26,939 (+1,701) |
+| 2026-01-30 | 28,718 (+1,779) | 28,718 (+1,779) |
+| 2026-01-31 | 30,070 (+1,352) | 30,070 (+1,352) |
+| 2026-02-01 | 31,383 (+1,313) | 31,383 (+1,313) |
+| 2026-02-02 | 33,206 (+1,823) | 33,206 (+1,823) |
+| 2026-02-03 | 35,064 (+1,858) | 35,064 (+1,858) |
+| 2026-02-04 | 38,330 (+3,266) | 38,330 (+3,266) |
+| 2026-02-05 | 41,657 (+3,327) | 41,657 (+3,327) |
+| 2026-02-06 | 44,561 (+2,904) | 44,561 (+2,904) |
+| 2026-02-07 | 47,783 (+3,222) | 47,783 (+3,222) |
+| 2026-02-08 | 51,070 (+3,287) | 51,070 (+3,287) |
+| 2026-02-09 | 54,793 (+3,723) | 54,793 (+3,723) |
+| 2026-02-10 | 58,605 (+3,812) | 58,605 (+3,812) |
+| 2026-02-11 | 62,536 (+3,931) | 62,536 (+3,931) |
+| 2026-02-12 | 66,149 (+3,613) | 66,149 (+3,613) |
+| 2026-02-13 | 69,528 (+3,379) | 69,528 (+3,379) |
+| 2026-02-14 | 72,204 (+2,676) | 72,204 (+2,676) |
+| 2026-02-15 | 74,561 (+2,357) | 74,561 (+2,357) |
+| 2026-02-16 | 77,144 (+2,583) | 77,144 (+2,583) |
+| 2026-02-17 | 79,817 (+2,673) | 79,817 (+2,673) |
+| 2026-02-18 | 83,020 (+3,203) | 83,020 (+3,203) |
+| 2026-02-19 | 86,687 (+3,667) | 86,687 (+3,667) |
+| 2026-02-20 | 90,491 (+3,804) | 90,491 (+3,804) |
+| 2026-02-21 | 94,409 (+3,918) | 94,409 (+3,918) |
+| 2026-02-22 | 99,076 (+4,667) | 99,076 (+4,667) |
+| 2026-02-23 | 103,810 (+4,734) | 103,810 (+4,734) |
+| 2026-02-24 | 108,788 (+4,978) | 108,788 (+4,978) |
+| 2026-02-25 | 113,976 (+5,188) | 113,976 (+5,188) |
+| 2026-02-26 | 119,570 (+5,594) | 119,570 (+5,594) |
+| 2026-02-27 | 125,213 (+5,643) | 125,213 (+5,643) |
+| 2026-02-28 | 130,766 (+5,553) | 130,766 (+5,553) |
+| 2026-03-01 | 133,877 (+3,111) | 133,877 (+3,111) |
+| 2026-03-02 | 139,092 (+5,215) | 139,092 (+5,215) |
+| 2026-03-03 | 144,346 (+5,254) | 144,346 (+5,254) |
+| 2026-03-04 | 148,772 (+4,426) | 148,772 (+4,426) |
+| 2026-03-05 | 152,105 (+3,333) | 152,105 (+3,333) |
+| 2026-03-06 | 155,629 (+3,524) | 155,629 (+3,524) |
+| 2026-03-07 | 157,784 (+2,155) | 157,784 (+2,155) |
+| 2026-03-07 | 158,107 (+323) | 158,107 (+323) |
+| 2026-03-08 | 159,616 (+1,509) | 159,616 (+1,509) |
+| 2026-03-09 | 162,103 (+2,487) | 162,103 (+2,487) |
+| 2026-03-10 | 165,406 (+3,303) | 165,406 (+3,303) |
+| 2026-03-11 | 168,897 (+3,491) | 168,897 (+3,491) |
+| 2026-03-12 | 172,707 (+3,810) | 172,707 (+3,810) |
+| 2026-03-13 | 176,511 (+3,804) | 176,511 (+3,804) |
+| 2026-03-14 | 177,484 (+973) | 177,484 (+973) |
+| 2026-03-15 | 178,354 (+870) | 178,354 (+870) |
+| 2026-03-16 | 179,050 (+696) | 179,050 (+696) |
+| 2026-03-17 | 180,297 (+1,247) | 180,297 (+1,247) |
+| 2026-03-18 | 181,354 (+1,057) | 181,354 (+1,057) |
+| 2026-03-19 | 182,208 (+854) | 182,208 (+854) |
+| 2026-03-20 | 183,136 (+928) | 183,136 (+928) |
+| 2026-03-21 | 184,156 (+1,020) | 184,156 (+1,020) |
+| 2026-03-22 | 184,744 (+588) | 184,744 (+588) |
+| 2026-03-23 | 185,371 (+627) | 185,371 (+627) |
+| 2026-03-24 | 186,649 (+1,278) | 186,649 (+1,278) |
+| 2026-03-25 | 187,746 (+1,097) | 187,746 (+1,097) |
+| 2026-03-26 | 193,858 (+6,112) | 193,858 (+6,112) |
+| 2026-03-27 | 200,722 (+6,864) | 200,722 (+6,864) |
+| 2026-03-28 | 206,754 (+6,032) | 206,754 (+6,032) |
+| 2026-03-29 | 211,210 (+4,456) | 211,210 (+4,456) |
+| 2026-03-30 | 217,507 (+6,297) | 217,507 (+6,297) |
+| 2026-03-31 | 225,120 (+7,613) | 225,120 (+7,613) |
+| 2026-04-01 | 232,042 (+6,922) | 232,042 (+6,922) |
+| 2026-04-02 | 251,721 (+19,679) | 251,721 (+19,679) |
+| 2026-04-03 | 300,714 (+48,993) | 300,714 (+48,993) |
+| 2026-04-04 | 345,411 (+44,697) | 345,411 (+44,697) |
+| 2026-04-05 | 388,231 (+42,820) | 388,231 (+42,820) |
+| 2026-04-06 | 428,311 (+40,080) | 428,311 (+40,080) |
+| 2026-04-07 | 471,893 (+43,582) | 471,893 (+43,582) |
+| 2026-04-08 | 517,274 (+45,381) | 517,274 (+45,381) |
+| 2026-04-09 | 560,586 (+43,312) | 560,586 (+43,312) |
+| 2026-04-10 | 602,133 (+41,547) | 602,133 (+41,547) |
+| 2026-04-11 | 638,258 (+36,125) | 638,258 (+36,125) |
+| 2026-04-12 | 671,199 (+32,941) | 671,199 (+32,941) |
+| 2026-04-13 | 705,072 (+33,873) | 705,072 (+33,873) |
+| 2026-04-14 | 725,846 (+20,774) | 725,846 (+20,774) |
+| 2026-04-15 | 731,872 (+6,026) | 731,872 (+6,026) |
+| 2026-04-16 | 738,176 (+6,304) | 738,176 (+6,304) |
+| 2026-04-17 | 743,397 (+5,221) | 743,397 (+5,221) |
+| 2026-04-18 | 747,542 (+4,145) | 747,542 (+4,145) |
+| 2026-04-19 | 751,067 (+3,525) | 751,067 (+3,525) |
+| 2026-04-20 | 755,765 (+4,698) | 755,765 (+4,698) |
+| 2026-04-21 | 762,220 (+6,455) | 762,220 (+6,455) |
+| 2026-04-22 | 767,840 (+5,620) | 767,840 (+5,620) |
+| 2026-04-23 | 773,380 (+5,540) | 773,380 (+5,540) |
+| 2026-04-24 | 778,287 (+4,907) | 778,287 (+4,907) |
+| 2026-04-25 | 782,587 (+4,300) | 782,587 (+4,300) |
+| 2026-04-26 | 786,791 (+4,204) | 786,791 (+4,204) |
+| 2026-04-27 | 791,564 (+4,773) | 791,564 (+4,773) |
+| 2026-04-28 | 795,811 (+4,247) | 795,811 (+4,247) |
+| 2026-04-29 | 799,679 (+3,868) | 799,679 (+3,868) |
+| 2026-04-30 | 805,584 (+5,905) | 805,584 (+5,905) |
+| 2026-05-01 | 809,415 (+3,831) | 809,415 (+3,831) |
+| 2026-05-02 | 813,107 (+3,692) | 813,107 (+3,692) |
+| 2026-05-03 | 816,532 (+3,425) | 816,532 (+3,425) |
+| 2026-05-04 | 820,823 (+4,291) | 820,823 (+4,291) |
+| 2026-05-05 | 824,968 (+4,145) | 824,968 (+4,145) |
diff --git a/STATS_V2.md b/STATS_V2.md
new file mode 100644
index 0000000000..a93620053b
--- /dev/null
+++ b/STATS_V2.md
@@ -0,0 +1,66 @@
+# Download Stats V2
+
+Classified GitHub release asset snapshots. `Manual installs` counts installer downloads (`.dmg`, `.msi`, `.deb`, `.rpm`). `Updater` counts updater artifacts (`latest.json`, macOS updater bundles, updater signatures). `Other` captures signatures, sidecars, and uncategorized assets.
+
+| Date | Manual Installs | Updater | Other | All Release Assets |
+|------|-----------------|---------|-------|--------------------|
+| 2026-03-07 | 54,446 (+54,446) | 89,201 (+89,201) | 14,460 (+14,460) | 158,107 (+158,107) |
+| 2026-03-08 | 54,727 (+281) | 90,315 (+1,114) | 14,574 (+114) | 159,616 (+1,509) |
+| 2026-03-09 | 55,242 (+515) | 92,073 (+1,758) | 14,788 (+214) | 162,103 (+2,487) |
+| 2026-03-10 | 56,051 (+809) | 94,325 (+2,252) | 15,030 (+242) | 165,406 (+3,303) |
+| 2026-03-11 | 56,914 (+863) | 96,683 (+2,358) | 15,300 (+270) | 168,897 (+3,491) |
+| 2026-03-12 | 57,703 (+789) | 99,150 (+2,467) | 15,854 (+554) | 172,707 (+3,810) |
+| 2026-03-13 | 58,605 (+902) | 101,229 (+2,079) | 16,677 (+823) | 176,511 (+3,804) |
+| 2026-03-14 | 58,838 (+233) | 101,875 (+646) | 16,771 (+94) | 177,484 (+973) |
+| 2026-03-15 | 59,168 (+330) | 102,281 (+406) | 16,905 (+134) | 178,354 (+870) |
+| 2026-03-16 | 59,363 (+195) | 102,655 (+374) | 17,032 (+127) | 179,050 (+696) |
+| 2026-03-17 | 59,631 (+268) | 103,431 (+776) | 17,235 (+203) | 180,297 (+1,247) |
+| 2026-03-18 | 59,845 (+214) | 104,136 (+705) | 17,373 (+138) | 181,354 (+1,057) |
+| 2026-03-19 | 60,045 (+200) | 104,667 (+531) | 17,496 (+123) | 182,208 (+854) |
+| 2026-03-20 | 60,221 (+176) | 105,278 (+611) | 17,637 (+141) | 183,136 (+928) |
+| 2026-03-21 | 60,558 (+337) | 105,839 (+561) | 17,759 (+122) | 184,156 (+1,020) |
+| 2026-03-22 | 60,687 (+129) | 106,219 (+380) | 17,838 (+79) | 184,744 (+588) |
+| 2026-03-23 | 60,848 (+161) | 106,545 (+326) | 17,978 (+140) | 185,371 (+627) |
+| 2026-03-24 | 61,247 (+399) | 107,230 (+685) | 18,172 (+194) | 186,649 (+1,278) |
+| 2026-03-25 | 61,477 (+230) | 107,957 (+727) | 18,312 (+140) | 187,746 (+1,097) |
+| 2026-03-26 | 63,032 (+1,555) | 112,084 (+4,127) | 18,742 (+430) | 193,858 (+6,112) |
+| 2026-03-27 | 64,244 (+1,212) | 117,236 (+5,152) | 19,242 (+500) | 200,722 (+6,864) |
+| 2026-03-28 | 65,441 (+1,197) | 121,574 (+4,338) | 19,739 (+497) | 206,754 (+6,032) |
+| 2026-03-29 | 66,202 (+761) | 125,041 (+3,467) | 19,967 (+228) | 211,210 (+4,456) |
+| 2026-03-30 | 67,249 (+1,047) | 129,987 (+4,946) | 20,271 (+304) | 217,507 (+6,297) |
+| 2026-03-31 | 68,732 (+1,483) | 135,648 (+5,661) | 20,740 (+469) | 225,120 (+7,613) |
+| 2026-04-01 | 69,871 (+1,139) | 140,959 (+5,311) | 21,212 (+472) | 232,042 (+6,922) |
+| 2026-04-02 | 70,782 (+911) | 159,313 (+18,354) | 21,626 (+414) | 251,721 (+19,679) |
+| 2026-04-03 | 71,365 (+583) | 207,310 (+47,997) | 22,039 (+413) | 300,714 (+48,993) |
+| 2026-04-04 | 71,953 (+588) | 251,008 (+43,698) | 22,450 (+411) | 345,411 (+44,697) |
+| 2026-04-05 | 72,498 (+545) | 292,876 (+41,868) | 22,857 (+407) | 388,231 (+42,820) |
+| 2026-04-06 | 73,191 (+693) | 331,794 (+38,918) | 23,326 (+469) | 428,311 (+40,080) |
+| 2026-04-07 | 73,774 (+583) | 374,167 (+42,373) | 23,952 (+626) | 471,893 (+43,582) |
+| 2026-04-08 | 74,644 (+870) | 417,934 (+43,767) | 24,696 (+744) | 517,274 (+45,381) |
+| 2026-04-09 | 75,240 (+596) | 460,144 (+42,210) | 25,202 (+506) | 560,586 (+43,312) |
+| 2026-04-10 | 75,755 (+515) | 500,754 (+40,610) | 25,624 (+422) | 602,133 (+41,547) |
+| 2026-04-11 | 76,295 (+540) | 535,996 (+35,242) | 25,967 (+343) | 638,258 (+36,125) |
+| 2026-04-12 | 76,990 (+695) | 567,970 (+31,974) | 26,239 (+272) | 671,199 (+32,941) |
+| 2026-04-13 | 77,567 (+577) | 600,843 (+32,873) | 26,662 (+423) | 705,072 (+33,873) |
+| 2026-04-14 | 78,520 (+953) | 620,193 (+19,350) | 27,133 (+471) | 725,846 (+20,774) |
+| 2026-04-15 | 79,422 (+902) | 624,874 (+4,681) | 27,576 (+443) | 731,872 (+6,026) |
+| 2026-04-16 | 80,356 (+934) | 629,753 (+4,879) | 28,067 (+491) | 738,176 (+6,304) |
+| 2026-04-17 | 81,107 (+751) | 633,807 (+4,054) | 28,483 (+416) | 743,397 (+5,221) |
+| 2026-04-18 | 81,864 (+757) | 636,892 (+3,085) | 28,786 (+303) | 747,542 (+4,145) |
+| 2026-04-19 | 82,486 (+622) | 639,536 (+2,644) | 29,045 (+259) | 751,067 (+3,525) |
+| 2026-04-20 | 83,222 (+736) | 643,271 (+3,735) | 29,272 (+227) | 755,765 (+4,698) |
+| 2026-04-21 | 84,271 (+1,049) | 648,249 (+4,978) | 29,700 (+428) | 762,220 (+6,455) |
+| 2026-04-22 | 85,162 (+891) | 652,627 (+4,378) | 30,051 (+351) | 767,840 (+5,620) |
+| 2026-04-23 | 86,133 (+971) | 656,777 (+4,150) | 30,470 (+419) | 773,380 (+5,540) |
+| 2026-04-24 | 86,915 (+782) | 660,538 (+3,761) | 30,834 (+364) | 778,287 (+4,907) |
+| 2026-04-25 | 87,706 (+791) | 663,737 (+3,199) | 31,144 (+310) | 782,587 (+4,300) |
+| 2026-04-26 | 88,514 (+808) | 666,704 (+2,967) | 31,573 (+429) | 786,791 (+4,204) |
+| 2026-04-27 | 89,347 (+833) | 670,293 (+3,589) | 31,924 (+351) | 791,564 (+4,773) |
+| 2026-04-28 | 90,158 (+811) | 672,622 (+2,329) | 33,031 (+1,107) | 795,811 (+4,247) |
+| 2026-04-29 | 91,297 (+1,139) | 674,416 (+1,794) | 33,966 (+935) | 799,679 (+3,868) |
+| 2026-04-30 | 92,816 (+1,519) | 677,341 (+2,925) | 35,427 (+1,461) | 805,584 (+5,905) |
+| 2026-05-01 | 93,823 (+1,007) | 678,963 (+1,622) | 36,629 (+1,202) | 809,415 (+3,831) |
+| 2026-05-02 | 94,509 (+686) | 680,471 (+1,508) | 38,127 (+1,498) | 813,107 (+3,692) |
+| 2026-05-03 | 95,237 (+728) | 681,632 (+1,161) | 39,663 (+1,536) | 816,532 (+3,425) |
+| 2026-05-04 | 96,444 (+1,207) | 683,102 (+1,470) | 41,277 (+1,614) | 820,823 (+4,291) |
+| 2026-05-05 | 97,232 (+788) | 684,504 (+1,402) | 43,232 (+1,955) | 824,968 (+4,145) |
diff --git a/SUPPORT.md b/SUPPORT.md
new file mode 100644
index 0000000000..37b51dd6ef
--- /dev/null
+++ b/SUPPORT.md
@@ -0,0 +1,23 @@
+# Support
+
+## Where to ask for help
+
+Use the right channel to get faster help:
+
+- **Questions / usage help**: open a GitHub issue and mark it as a question.
+- **Bug reports**: use the Bug issue template.
+- **Feature requests**: use the Feature issue template.
+- **Security reports**: follow `SECURITY.md` and report privately.
+
+## Before opening an issue
+
+- Search existing issues to avoid duplicates.
+- Include exact OpenWork/OpenCode versions, OS, and reproduction steps.
+- For desktop, worker, or session bugs, open Settings -> Debug and include both:
+  - the runtime debug report
+  - the developer log export
+- Add screenshots when they help explain the flow or failure state.
+
+## Maintainer triage
+
+Maintainers use the rubric in `TRIAGE.md` to label and route issues.
diff --git a/TRANSLATIONS.md b/TRANSLATIONS.md
new file mode 100644
index 0000000000..c65a0abddd
--- /dev/null
+++ b/TRANSLATIONS.md
@@ -0,0 +1,27 @@
+# Help Translate OpenWork
+
+We are actively looking for contributors to translate OpenWork to your own native language.
+
+## README translations
+
+Translated README variants live in `translated_readmes/`, so adding a new language only touches the index there plus the supported languages list in the root `README.md`.
+
+If you want to add a new README language:
+
+1. Copy `README.md` to a new file like `translated_readmes/README_<LANG>.md`.
+2. Translate the content.
+3. Add your new language link to `translated_readmes/README.md`.
+4. Add your language name to the supported languages list at the bottom of `README.md`.
+5. Open a PR.
+
+## App UI translations (i18n)
+
+You can also help translate the app UI via:
+
+- `apps/app/src/i18n/`
+
+Currently available app UI locales: English (`en`), Japanese (`ja`), Simplified Chinese (`zh`), Vietnamese (`vi`), Brazilian Portuguese (`pt-BR`), Russian (`ru`).
+
+Locale files live in `apps/app/src/i18n/locales/`.
+
+If you are unsure where to start, open an issue and mention the language you want to contribute.
diff --git a/TRIAGE.md b/TRIAGE.md
new file mode 100644
index 0000000000..ec4981f225
--- /dev/null
+++ b/TRIAGE.md
@@ -0,0 +1,35 @@
+# Issue Triage Rubric
+
+This document defines how maintainers triage issues consistently.
+
+## Core type labels
+
+- `bug`: behavior does not match expected behavior.
+- `enhancement`: improvement to existing behavior.
+- `question`: support or usage request.
+
+Apply exactly one core type label whenever possible.
+
+## Contribution-oriented labels
+
+- `good first issue`: small, well-scoped, low-risk, and has clear acceptance criteria.
+- `help wanted` or `help needed`: maintainers welcome external contributions.
+- `needs-info`: issue cannot be actioned until reporter provides missing details.
+
+## Suggested triage flow
+
+1. Confirm issue template fields are complete.
+2. Add a core type label (`bug`, `enhancement`, or `question`).
+3. Add scope/difficulty labels if helpful.
+4. Add `needs-info` when reproduction details are missing.
+5. Add `good first issue` or `help wanted/help needed` only when issue is ready to build.
+
+## Closing guidance
+
+Close as:
+
+- `duplicate`: issue already tracked elsewhere.
+- `invalid`: report is not actionable or not a product issue.
+- `wontfix`: acknowledged but not planned.
+
+When closing, include a short reason and a link to related issue/docs when available.
diff --git a/VISION.md b/VISION.md
new file mode 100644
index 0000000000..817d5524c0
--- /dev/null
+++ b/VISION.md
@@ -0,0 +1,31 @@
+# OpenWork Vision
+
+**Mission:** Make your company feel 1000× more productive.
+
+**How:** We give AI agents the tools your team already uses and let them learn from your behavior. The more you use OpenWork, the more connected your tools become, the more knowledge accumulates, and the bigger the chunks of work you can automate.
+
+**Today:** OpenWork is the simplest interface to `opencode` and OpenWork server surfaces. Double-click, pick a folder, and you get three things instantly:
+
+1. **Zero-friction setup** — your existing opencode configuration just works, no migration needed
+2. **Chat access** — WhatsApp and Telegram ready to go (one token, done)
+3. **Cloud-ready** — every app doubles as a client; connect to hosted workers from anywhere
+
+Current cloud mental model:
+
+- OpenWork app is the experience layer.
+- OpenWork server is the control/API layer.
+- OpenWork worker is the runtime destination.
+- Connect flow is intentionally simple: `Add a worker` -> `Connect remote`.
+
+OpenWork helps users ship agentic workflows to their team. It works on top of opencode (opencode.ai) an agentic coding platform that exposes apis and sdks. We care about maximally using the opencode primitives. And build the thinest possible layer - always favoring opencode apis over custom built ones.
+
+In other words:
+- OpenCode is the **engine**.
+- OpenWork is the **experience** : onboarding, safety, permissions, progress, artifacts, and a premium-feeling UI.
+
+OpenWork competes directly with Anthropic's Cowork conceptually, but stays open, local-first, and standards-based.
+
+## Non-Goals
+
+- Replacing OpenCode's CLI/TUI.
+- Creating bespoke "magic" capabilities that don't map to OpenCode APIs.
diff --git a/app-demo.gif b/app-demo.gif
new file mode 100644
index 0000000000..b4618fd1dd
Binary files /dev/null and b/app-demo.gif differ
diff --git a/apps/app/.env.migration-release b/apps/app/.env.migration-release
new file mode 100644
index 0000000000..c47d147dfa
--- /dev/null
+++ b/apps/app/.env.migration-release
@@ -0,0 +1,9 @@
+# Generated by scripts/migration/01-cut-migration-release.mjs.
+# Consumed by apps/app Vite build during the v0.12.0 release only.
+VITE_OPENWORK_MIGRATION_RELEASE=1
+VITE_OPENWORK_MIGRATION_VERSION=0.13.3
+VITE_OPENWORK_MIGRATION_MAC_ARM64_URL=https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-mac-arm64-0.13.3.zip
+VITE_OPENWORK_MIGRATION_MAC_X64_URL=https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-mac-x64-0.13.3.zip
+VITE_OPENWORK_MIGRATION_WINDOWS_X64_URL=https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-win-x64-0.13.3.exe
+VITE_OPENWORK_MIGRATION_LINUX_ARM64_URL=https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-linux-arm64-0.13.3.AppImage
+VITE_OPENWORK_MIGRATION_LINUX_X64_URL=https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-linux-x86_64-0.13.3.AppImage
\ No newline at end of file
diff --git a/apps/app/components.json b/apps/app/components.json
new file mode 100644
index 0000000000..3781d892e6
--- /dev/null
+++ b/apps/app/components.json
@@ -0,0 +1,25 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "base-luma",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "tailwind.config.ts",
+    "css": "src/app/index.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "rtl": true,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "menuColor": "inverted-translucent",
+  "menuAccent": "subtle",
+  "registries": {}
+}
diff --git a/apps/app/index.html b/apps/app/index.html
new file mode 100644
index 0000000000..7ac4f5640d
--- /dev/null
+++ b/apps/app/index.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>OpenWork</title>
+
+    <link rel="icon" type="image/svg+xml" href="/openwork-mark.svg" />
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+    <script>
+      (function () {
+        try {
+          var mode = localStorage.getItem("openwork.themePref") || "system";
+          var prefersDark = window.matchMedia("(prefers-color-scheme: dark)").matches;
+          var resolved = mode === "dark" || (mode === "system" && prefersDark) ? "dark" : "light";
+          document.documentElement.dataset.theme = resolved;
+          document.documentElement.style.colorScheme = resolved;
+        } catch (e) {
+          document.documentElement.dataset.theme = "light";
+          document.documentElement.style.colorScheme = "light";
+        }
+      })();
+    </script>
+  </head>
+  <body class="bg-dls-surface text-dls-text">
+    <div id="root"></div>
+    <script type="module" src="/src/index.react.tsx"></script>
+  </body>
+</html>
diff --git a/apps/app/package.json b/apps/app/package.json
new file mode 100644
index 0000000000..b53f2254f3
--- /dev/null
+++ b/apps/app/package.json
@@ -0,0 +1,92 @@
+{
+  "name": "@openwork/app",
+  "private": true,
+  "version": "0.13.3",
+  "type": "module",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 vite",
+    "dev:windows": "vite",
+    "prebuild": "pnpm --dir ../../packages/ui build",
+    "build": "vite build",
+    "dev:web": "OPENWORK_DEV_MODE=1 vite",
+    "prebuild:web": "pnpm --dir ../../packages/ui build",
+    "build:web": "vite build",
+    "preview": "vite preview",
+    "pretypecheck": "pnpm --dir ../../packages/ui build",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test:health": "node scripts/health.mjs",
+    "test:mention-send": "node scripts/mention-send.mjs",
+    "test:sessions": "node scripts/sessions.mjs",
+    "test:refactor": "pnpm typecheck && pnpm test:health && pnpm test:sessions",
+    "test:events": "node scripts/events.mjs",
+    "test:todos": "node scripts/todos.mjs",
+    "test:permissions": "node scripts/permissions.mjs",
+    "test:remote-diagnostics": "bun test scripts/remote-workspace-diagnostics.test.ts",
+    "test:dev-log": "bun scripts/dev-log.ts",
+    "test:session-error-recovery": "bun scripts/session-error-recovery.ts",
+    "test:session-scope": "bun scripts/session-scope.ts",
+    "test:session-switch": "node scripts/session-switch.mjs",
+    "test:fs-engine": "node scripts/fs-engine.mjs",
+    "test:local-file-path": "node scripts/local-file-path.mjs",
+    "test:browser-entry": "node scripts/browser-entry.mjs",
+    "test:e2e": "pnpm test:local-file-path && node scripts/e2e.mjs && node scripts/session-switch.mjs && node scripts/fs-engine.mjs && node scripts/browser-entry.mjs",
+    "bump:patch": "node scripts/bump-version.mjs patch",
+    "bump:minor": "node scripts/bump-version.mjs minor",
+    "bump:major": "node scripts/bump-version.mjs major",
+    "bump:set": "node scripts/bump-version.mjs --set"
+  },
+  "dependencies": {
+    "@ai-sdk/react": "^3.0.148",
+    "@base-ui/react": "^1.4.1",
+    "@codemirror/commands": "^6.8.0",
+    "@codemirror/lang-markdown": "^6.3.3",
+    "@codemirror/language": "^6.11.0",
+    "@codemirror/state": "^6.5.2",
+    "@codemirror/view": "^6.38.0",
+    "@fontsource-variable/geist": "^5.2.8",
+    "@fontsource-variable/ibm-plex-sans": "^5.2.8",
+    "@lexical/react": "^0.35.0",
+    "@opencode-ai/sdk": "^1.4.9",
+    "@openwork/types": "workspace:*",
+    "@openwork/ui": "workspace:*",
+    "@radix-ui/colors": "^3.0.0",
+    "@tanstack/react-query": "^5.90.3",
+    "@tanstack/react-virtual": "^3.13.23",
+    "@tauri-apps/api": "^2.0.0",
+    "@tauri-apps/plugin-deep-link": "^2.4.7",
+    "@tauri-apps/plugin-dialog": "~2.6.0",
+    "@tauri-apps/plugin-http": "~2.5.6",
+    "@tauri-apps/plugin-opener": "^2.5.3",
+    "@tauri-apps/plugin-process": "~2.3.1",
+    "@tauri-apps/plugin-updater": "~2.9.0",
+    "ai": "^6.0.146",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "fuzzysort": "^3.1.0",
+    "jsonc-parser": "^3.2.1",
+    "lexical": "^0.35.0",
+    "lucide-react": "^0.577.0",
+    "marked": "^17.0.1",
+    "react": "^19.1.1",
+    "react-dom": "^19.1.1",
+    "react-markdown": "^10.1.0",
+    "react-router-dom": "^7.14.1",
+    "remark-gfm": "^4.0.1",
+    "shadcn": "^4.6.0",
+    "streamdown": "^2.5.0",
+    "tailwind-merge": "^3.5.0",
+    "tw-animate-css": "^1.4.0",
+    "zustand": "^5.0.12"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.1.18",
+    "@types/node": "^25.6.0",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.0.4",
+    "tailwindcss": "^4.1.18",
+    "typescript": "^5.6.3",
+    "vite": "^6.0.1"
+  },
+  "packageManager": "pnpm@10.27.0"
+}
diff --git a/apps/app/pr/1419-remote-worker-before.png b/apps/app/pr/1419-remote-worker-before.png
new file mode 100644
index 0000000000..f78b4a27c1
Binary files /dev/null and b/apps/app/pr/1419-remote-worker-before.png differ
diff --git a/apps/app/pr/1419-remote-worker-diagnostics-error.png b/apps/app/pr/1419-remote-worker-diagnostics-error.png
new file mode 100644
index 0000000000..2b8a4488f1
Binary files /dev/null and b/apps/app/pr/1419-remote-worker-diagnostics-error.png differ
diff --git a/apps/app/pr/cloud-settings-dark-after.png b/apps/app/pr/cloud-settings-dark-after.png
new file mode 100644
index 0000000000..f7ea309b7f
Binary files /dev/null and b/apps/app/pr/cloud-settings-dark-after.png differ
diff --git a/apps/app/pr/cloud-settings-dark-before.png b/apps/app/pr/cloud-settings-dark-before.png
new file mode 100644
index 0000000000..32d75f6e31
Binary files /dev/null and b/apps/app/pr/cloud-settings-dark-before.png differ
diff --git a/apps/app/pr/environment-variables-dark.png b/apps/app/pr/environment-variables-dark.png
new file mode 100644
index 0000000000..6375907079
Binary files /dev/null and b/apps/app/pr/environment-variables-dark.png differ
diff --git a/apps/app/pr/environment-variables-demo.mp4 b/apps/app/pr/environment-variables-demo.mp4
new file mode 100644
index 0000000000..22b717d8ee
Binary files /dev/null and b/apps/app/pr/environment-variables-demo.mp4 differ
diff --git a/apps/app/pr/environment-variables.md b/apps/app/pr/environment-variables.md
new file mode 100644
index 0000000000..0a9a0518f4
--- /dev/null
+++ b/apps/app/pr/environment-variables.md
@@ -0,0 +1,189 @@
+# Environment variables UI
+
+Closes #1436.
+
+## Why
+
+Agentic workflows pull in secrets from every direction — LLM provider keys,
+ElevenLabs for TTS, Gemini / Nano Banana for images, GitHub tokens for repo
+automation, cloud project IDs, corporate proxies and CA certs. Skills and
+MCPs in a workspace assume those values exist in the process environment.
+
+Today the only way to get them there is to edit shell rc files and launch
+OpenWork from a terminal, which:
+
+- **Breaks entirely on Linux GUI launches** (`.bashrc` isn't sourced) — the
+  concrete user report in #1436.
+- **Is invisible friction for non-technical teammates** (the "Susan" persona
+  called out in `AGENTS.md`).
+- Has no masking, no audit trail, no reserved-keys guardrail.
+
+This PR adds a first-class **Settings → Environment** pane. Credentials go
+in once, and every child OpenWork spawns — OpenCode, the OpenWork server,
+opencode-router, and any MCP or plugin those three launch — inherits them
+via OS process environment.
+
+Boundaries vs. adjacent features:
+
+- Not a replacement for OpenCode's native `provider auth` flow, which owns
+  credentials for LLM providers OpenCode directly supports (stored in
+  `auth.json`). Users should keep using that for model keys where possible.
+- Not a replacement for Den's cloud `LLM Providers` push, which owns
+  org-wide distribution for signed-in users. On remote workspaces, the pane
+  shows a read-only hint and does not fetch or display local env values.
+- This fills the OSS / local-machine path for every other service skills
+  and MCPs call into — ElevenLabs, Gemini image APIs, GitHub, Notion,
+  LangSmith / OTEL exporters, proxy + CA-cert config, and so on.
+
+## Storage
+
+Deterministic path, identical across every loader:
+
+| OS | Path |
+| --- | --- |
+| Linux / macOS | `~/.config/openwork/env.json` |
+| Windows | `%APPDATA%\openwork\env.json` |
+
+Override via `OPENWORK_ENV_STORE` (mirrors `OPENWORK_TOKEN_STORE`). The file
+is written with `0o600` perms on POSIX.
+
+Shape:
+
+```json
+{
+  "schemaVersion": 1,
+  "updatedAt": 1714000000000,
+  "variables": [
+    { "key": "ANTHROPIC_API_KEY", "value": "sk-ant-...", "updatedAt": 1714000000000 }
+  ]
+}
+```
+
+## Server
+
+`EnvService` at `apps/server/src/env-file.ts` — mirrors the `TokenService`
+pattern. Four desktop-host-token routes on the OpenWork server, so remote
+owner/collaborator/viewer clients and OpenCode tools are structurally unable to
+reach them:
+
+- `GET /env` → `{ items: [{ key, value, updatedAt }] }` (values raw; the UI masks presentationally)
+- `GET /env/keys` → `{ keys: [...] }` (names only, used for agent context)
+- `PUT /env` → single entry `{ key, value }` or batch `{ entries: [...] }`
+- `DELETE /env/:key`
+
+## Shell spawn injection
+
+Same file, four loaders that agree byte-for-byte on path + reserved-keys policy:
+
+| Host | File | Integration point |
+| --- | --- | --- |
+| Tauri (Rust) | `apps/desktop/src-tauri/src/env_file.rs` | merged into 4 spawn sites alongside `bun_env_overrides()` |
+| Electron (Node) | inline in `apps/desktop/electron/runtime.mjs` | single `buildChildEnv()` helper |
+| Orchestrator (TS) | inline in `apps/orchestrator/src/cli.ts` | single `buildSpawnEnv()` helper |
+| Server injection helper | `EnvService.readForInjection()` | reserved by consumers that want to reuse the TS reader |
+
+Merge order on every host: **user env first, process env / caller env wins.**
+This matches the Linux-GUI case (no shell env → user env fills in) and never
+lets the user shadow wiring the shell has already set.
+
+Reserved-keys policy: **any key starting with `OPENWORK_` or `OPENCODE_`** is
+refused at write time and stripped at read time. Defends against a
+hand-edited `env.json` that tries to shadow auth credentials.
+
+## UI
+
+`apps/app/src/react-app/domains/settings/pages/environment-view.tsx` —
+self-contained React pane registered as a **global** settings tab (user-level
+data, not workspace-scoped). Drops into the existing settings shell with one
+line in each of `types.ts`, `settings-page.tsx`, `settings-route.tsx`.
+
+- Table with masked values (`ab••••yz`), reveal/hide toggle per row, add/edit
+  modal, delete-with-confirm.
+- Client-side key validation mirrors the server (`^[A-Za-z_][A-Za-z0-9_]*$`)
+  + reserved-prefix check.
+- Writes are saved immediately and then marked as pending. The user can click
+  **Apply changes** to restart the local agents so the new environment is
+  active without a full app relaunch.
+- Remote workspaces show a read-only hint and do not list local env values.
+
+## Reload semantics
+
+Env vars are fixed in a process's environment at spawn time, so saving the
+file alone cannot update an already-running OpenCode/server/router child. The
+pane makes that explicit: after a successful write it shows a pending state and
+an **Apply changes** action. Applying restarts the local OpenWork runtime with
+the sidecar orchestrator path, preserves the local workspace list and remote
+access setting, reconnects the client, then clears the pending state.
+
+Until pending changes are applied, the app does not inject newly saved key names
+into agent system context. That avoids the agent claiming a key is configured
+before the running processes can actually read it.
+
+The same restart boundary is used for delete: removed key names stop appearing
+after **Apply changes**.
+
+## Agent context
+
+The app never sends secret values to the model. When there are no pending
+environment changes, it calls `GET /env/keys` and sends only configured key
+names as per-message system context:
+
+```text
+OpenWork environment variables configured:
+- EXAMPLE_API_KEY
+
+Only names are shown; values are secret. Use these names when relevant.
+```
+
+This is not written into `AGENTS.md`; OpenCode combines it with its normal
+instruction sources for that prompt.
+
+## i18n
+
+All strings live under the `settings.environment.*` and
+`settings.tab_*_environment` namespaces. Full translations in `en.ts`,
+`zh.ts`, `ja.ts`. Other locales (`vi`, `pt-BR`, `th`, `fr`, `ca`, `es`) fall
+back to English via the existing `t()` runtime (`i18n/index.ts:109-113`), so
+nothing ships as raw keys.
+
+## Tests
+
+| Layer | File | What |
+| --- | --- | --- |
+| Server unit | `apps/server/src/env-file.test.ts` | 12 tests — path resolution, validation, reserved keys, perms, round-trip, tampered-file defense |
+| Server HTTP e2e | `apps/server/src/env-routes.e2e.test.ts` | 12 tests — auth 401, owner-bearer rejection, CORS PUT preflight, PUT/GET round-trip, key-name-only route, batch PUT, invalid key 400, reserved key 400, DELETE missing/found, restart persistence |
+| Tauri Rust unit | `apps/desktop/src-tauri/src/env_file.rs` | 4 tests — missing file, malformed JSON, well-formed load, reserved-key strip |
+
+Bun picks up `*.e2e.test.ts` automatically — no CI wiring change.
+
+## Verification ran in latest review
+
+```
+pnpm --filter openwork-server test                                    # 107 pass, 0 fail
+bun test ./src/env-file.test.ts ./src/env-routes.e2e.test.ts          # 24 pass, 0 fail
+pnpm --filter openwork-server typecheck                               # clean
+pnpm --filter openwork-server build:bin                               # ok
+pnpm --filter openwork-orchestrator typecheck                         # clean
+pnpm --filter @openwork/app typecheck                                 # clean
+pnpm build:ui                                                         # ok (production Vite; large chunk warning unchanged)
+node --check apps/desktop/electron/runtime.mjs                        # ok
+node --check apps/desktop/scripts/prepare-sidecar.mjs                 # ok
+node --check apps/desktop/scripts/tauri-before-dev.mjs                # ok
+PATH="$HOME/.cargo/bin:$PATH" cargo test env_file                     # 4 pass, 0 fail
+git diff --check                                                      # clean
+```
+
+## Evidence
+
+- Screenshot: `apps/app/pr/environment-variables-dark.png`
+- Demo recording: `apps/app/pr/environment-variables-demo.mp4`
+
+## Non-goals (follow-ups)
+
+- OS keychain storage (`PRINCIPLES.md` line 29). JSON + `0o600` matches the
+  existing `tokens.ts` precedent and keeps the Rust reader trivial (no
+  keychain FFI). A follow-up PR can migrate values into the keychain while
+  leaving the JSON file as a manifest of key names + timestamps.
+- Per-workspace scoping. The issue asks for user-level; workspace overrides
+  are a separate feature.
+- Cloud push for MCP keys — owned by the Den / LLM Providers team.
diff --git a/apps/app/pr/first-boot-real-shell.png b/apps/app/pr/first-boot-real-shell.png
new file mode 100644
index 0000000000..97db14c594
Binary files /dev/null and b/apps/app/pr/first-boot-real-shell.png differ
diff --git a/apps/app/pr/permission-approval-dark.png b/apps/app/pr/permission-approval-dark.png
new file mode 100644
index 0000000000..3570f98500
Binary files /dev/null and b/apps/app/pr/permission-approval-dark.png differ
diff --git a/apps/app/pr/permission-approval-light.png b/apps/app/pr/permission-approval-light.png
new file mode 100644
index 0000000000..9247c1317d
Binary files /dev/null and b/apps/app/pr/permission-approval-light.png differ
diff --git a/apps/app/pr/session-error-recovery-offline.png b/apps/app/pr/session-error-recovery-offline.png
new file mode 100644
index 0000000000..3c23d828d3
Binary files /dev/null and b/apps/app/pr/session-error-recovery-offline.png differ
diff --git a/apps/app/pr/session-scroll-loading-polish.png b/apps/app/pr/session-scroll-loading-polish.png
new file mode 100644
index 0000000000..1c23026bb6
Binary files /dev/null and b/apps/app/pr/session-scroll-loading-polish.png differ
diff --git a/apps/app/public/apple-touch-icon.png b/apps/app/public/apple-touch-icon.png
new file mode 100644
index 0000000000..7c05dcc9b9
Binary files /dev/null and b/apps/app/public/apple-touch-icon.png differ
diff --git a/apps/app/public/favicon-16x16.png b/apps/app/public/favicon-16x16.png
new file mode 100644
index 0000000000..9be1ead979
Binary files /dev/null and b/apps/app/public/favicon-16x16.png differ
diff --git a/apps/app/public/favicon-32x32.png b/apps/app/public/favicon-32x32.png
new file mode 100644
index 0000000000..8a82bb5e58
Binary files /dev/null and b/apps/app/public/favicon-32x32.png differ
diff --git a/apps/app/public/openwork-logo-square.svg b/apps/app/public/openwork-logo-square.svg
new file mode 100644
index 0000000000..05e4ca1aab
--- /dev/null
+++ b/apps/app/public/openwork-logo-square.svg
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><rect x="0" y="0" width="1024" height="1024" fill="#F6F9FC" /><g transform="translate(0 79)"><path fill="#F6F9FC" transform="scale(1.22782 1.22837)" d="M0 0L834 0L834 705L0 705L0 0Z" /><path fill="#267CE8" transform="scale(1.22782 1.22837)" d="M489.706 13.2067C513.1 12.6429 524.37 18.0338 544.172 28.9645C554.812 34.8361 565.417 40.7692 575.987 46.7636L623.161 73.1911C633.304 78.8802 648.205 86.8557 656.949 93.5265C671.572 105.278 682.878 124.059 684.772 142.967C686.008 155.312 685.416 169.689 685.393 182.229L685.338 250.826L685.372 355.084C685.386 379.657 686.782 409.077 682.106 432.796C676.384 462.128 663.833 489.701 645.471 513.279C633.909 528.118 620.199 541.15 604.793 551.945C599.457 555.614 592.954 559.009 587.227 562.165L566.349 573.782L490.325 615.505L413.405 657.834C399.048 665.782 384.576 674.467 369.744 681.506C361.213 685.555 353.186 686.736 343.986 687.847C332.319 688.503 320.643 686.73 309.696 682.642C302.173 679.825 294.507 675.213 287.459 671.242L257.212 654.164C240.589 644.968 224.014 635.685 207.487 626.316C195.999 619.8 184.133 614.106 174.269 605.49C159.003 592.157 148.609 570.188 147.986 549.859C147.55 535.622 147.847 520.109 147.85 505.672L147.819 420.403L147.85 329.093C147.849 311.72 147.537 293.949 147.964 276.627C148.835 241.274 164.137 204.197 187.556 177.955C196.521 167.737 206.83 158.783 218.202 151.337C230.128 143.488 249.672 133.624 262.396 126.64L347.136 80.1888L415.637 42.4394C426.276 36.5407 437.001 30.7695 447.666 24.9431C461.784 17.2313 473.721 14.1313 489.706 13.2067Z" /><path fill="#F6F9FC" transform="scale(1.22782 1.22837)" d="M613.495 108.907C639.009 107.532 658.622 124.065 659.007 150.133C659.296 169.703 659.07 189.298 659.027 208.873L658.981 311.995L658.979 374.656C658.999 389.22 659.565 405.923 657.663 420.157C654.856 440.488 648.093 460.071 637.755 477.8C627.209 496.602 612.965 513.072 595.883 526.22C582.911 536.108 560.086 547.955 545.057 556.264L458.95 603.539C442.262 612.72 424.832 621.959 408.333 631.293L379.778 647.24C369.407 653.004 362.467 657.913 350.887 661.072C348.507 661.531 346.107 661.876 343.694 662.106C330.104 663.339 318.471 658.454 311.429 646.575C304.438 634.784 305.278 622.415 305.272 609.35L305.276 581.135L305.279 494.036L305.275 391.715C305.274 375.882 304.891 359.441 305.383 343.65C306.281 314.832 318.799 285.614 337.486 263.791C345.51 254.416 354.806 246.209 365.103 239.409C376.044 232.304 394.739 222.713 406.481 216.271L480.987 175.344L553.336 135.593C562.924 130.31 572.634 125.059 582.183 119.72C592.951 113.7 600.889 109.871 613.495 108.907Z" /><path fill="#267CE8" transform="scale(1.22782 1.22837)" d="M552.617 209.449C565.11 207.756 577.011 214.204 580.608 226.634C581.546 229.836 582.105 233.137 582.272 236.469C582.785 245.918 582.378 259.542 582.378 269.236L582.37 332.988L582.442 374.561C582.631 402.737 583.481 422.16 569.367 447.751C562.379 460.393 552.917 471.497 541.545 480.402C532.899 487.216 520.709 493.139 510.906 498.439L474.59 518.454L440.699 537.17C433.771 541.003 422.024 548.001 414.837 550.08C402.908 553.084 391.698 547.444 387.562 535.75C384.356 526.684 385.506 515.189 385.506 505.527L385.503 457.709L385.489 384.03C385.478 371.4 384.815 351.092 386.661 339.194C388.761 325.465 393.966 312.396 401.878 300.981C413.272 284.362 424.519 277.582 441.566 267.97L473.202 250.472L517.941 225.743C528.235 220.087 541.263 211.555 552.617 209.449Z" /><path fill="#F6F9FC" transform="scale(1.22782 1.22837)" d="M554.979 341.691C555.336 341.919 555.337 342.07 555.594 342.494C556.042 350.455 555.806 362.581 555.705 370.915C555.529 385.446 556.982 404.382 553.345 418.079C549.45 432.427 541.606 445.394 530.705 455.504C519.85 465.527 497.742 475.964 484.069 483.644C460.488 496.888 436.159 509.447 412.706 522.991L411.812 522.863C411.407 520.181 411.547 514.367 411.563 511.472L411.658 492.343L411.61 419.915C419.924 415.981 426.783 412.012 434.772 407.687C446.115 401.668 457.389 395.518 468.59 389.239L554.979 341.691Z" /><path fill="#F6F9FC" transform="scale(1.22782 1.22837)" d="M552.331 234.96C554.485 235.301 556.551 237.371 556.614 239.633C557.281 263.444 556.174 287.348 557.115 311.166C552.421 313.443 547.786 316.269 543.172 318.742C500.165 341.793 457.862 366.802 414.633 389.386L411.35 391.177C411.218 382.756 411.206 373.815 411.267 365.434C411.442 351.358 409.942 338.875 415.225 325.394C423.561 304.124 440.103 297.043 458.571 286.899L494.563 266.917C509.559 258.614 524.638 250.506 539.452 241.88C543.628 239.448 547.927 236.939 552.331 234.96Z" /><path fill="#F6F9FC" transform="scale(1.22782 1.22837)" d="M488.102 39.2607C496.474 38.3596 504.941 39.2681 512.931 41.9247C521.728 44.8835 531.398 51.0393 539.748 55.6788L591.66 84.9511C586.978 87.3272 581.602 90.517 576.905 93.08L537.206 114.931L416.066 181.45L377.926 202.235C358.394 212.908 342.907 220.761 326.811 236.812C304.868 258.696 290.149 285.333 283.042 315.474C278.522 334.641 279.262 351.024 279.267 370.329L279.289 415.328L279.281 566.374L279.27 620.635C279.272 623.769 279.266 626.886 279.365 630.019C279.422 631.805 280.411 636.017 279.563 637.418L278.661 636.993C273.11 633.535 265.688 629.62 259.852 626.32L219.561 603.651C211.953 599.35 199.869 592.943 193.469 587.758C182.647 578.907 175.732 566.162 174.212 552.264C173.026 540.881 173.765 518.934 173.753 506.814L173.698 417.79L173.706 320.735C173.715 306.328 173.307 291.177 173.817 276.838C174.844 247.95 186.862 219.785 204.924 197.517C212.379 188.485 221.121 180.598 230.871 174.11C244.429 165.13 265.192 154.596 280.057 146.445L364.951 99.9187C391.081 85.7307 416.953 71.0634 443.173 57.026C459.988 48.0244 468.061 41.3697 488.102 39.2607Z" /></g></svg>
diff --git a/apps/app/public/openwork-logo.svg b/apps/app/public/openwork-logo.svg
new file mode 100644
index 0000000000..1052922e80
--- /dev/null
+++ b/apps/app/public/openwork-logo.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" ?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1024" height="866" viewBox="0 0 1024 866"><path fill="#267CE8" transform="scale(1.22782 1.22837)" d="M489.706 13.2067C513.1 12.6429 524.37 18.0338 544.172 28.9645C554.812 34.8361 565.417 40.7692 575.987 46.7636L623.161 73.1911C633.304 78.8802 648.205 86.8557 656.949 93.5265C671.572 105.278 682.878 124.059 684.772 142.967C686.008 155.312 685.416 169.689 685.393 182.229L685.338 250.826L685.372 355.084C685.386 379.657 686.782 409.077 682.106 432.796C676.384 462.128 663.833 489.701 645.471 513.279C633.909 528.118 620.199 541.15 604.793 551.945C599.457 555.614 592.954 559.009 587.227 562.165L566.349 573.782L490.325 615.505L413.405 657.834C399.048 665.782 384.576 674.467 369.744 681.506C361.213 685.555 353.186 686.736 343.986 687.847C332.319 688.503 320.643 686.73 309.696 682.642C302.173 679.825 294.507 675.213 287.459 671.242L257.212 654.164C240.589 644.968 224.014 635.685 207.487 626.316C195.999 619.8 184.133 614.106 174.269 605.49C159.003 592.157 148.609 570.188 147.986 549.859C147.55 535.622 147.847 520.109 147.85 505.672L147.819 420.403L147.85 329.093C147.849 311.72 147.537 293.949 147.964 276.627C148.835 241.274 164.137 204.197 187.556 177.955C196.521 167.737 206.83 158.783 218.202 151.337C230.128 143.488 249.672 133.624 262.396 126.64L347.136 80.1888L415.637 42.4394C426.276 36.5407 437.001 30.7695 447.666 24.9431C461.784 17.2313 473.721 14.1313 489.706 13.2067Z"/><path fill="#DFEBF8" transform="scale(1.22782 1.22837)" d="M613.495 108.907C639.009 107.532 658.622 124.065 659.007 150.133C659.296 169.703 659.07 189.298 659.027 208.873L658.981 311.995L658.979 374.656C658.999 389.22 659.565 405.923 657.663 420.157C654.856 440.488 648.093 460.071 637.755 477.8C627.209 496.602 612.965 513.072 595.883 526.22C582.911 536.108 560.086 547.955 545.057 556.264L458.95 603.539C442.262 612.72 424.832 621.959 408.333 631.293L379.778 647.24C369.407 653.004 362.467 657.913 350.887 661.072C348.507 661.531 346.107 661.876 343.694 662.106C330.104 663.339 318.471 658.454 311.429 646.575C304.438 634.784 305.278 622.415 305.272 609.35L305.276 581.135L305.279 494.036L305.275 391.715C305.274 375.882 304.891 359.441 305.383 343.65C306.281 314.832 318.799 285.614 337.486 263.791C345.51 254.416 354.806 246.209 365.103 239.409C376.044 232.304 394.739 222.713 406.481 216.271L480.987 175.344L553.336 135.593C562.924 130.31 572.634 125.059 582.183 119.72C592.951 113.7 600.889 109.871 613.495 108.907Z"/><path fill="#267CE8" transform="scale(1.22782 1.22837)" d="M552.617 209.449C565.11 207.756 577.011 214.204 580.608 226.634C581.546 229.836 582.105 233.137 582.272 236.469C582.785 245.918 582.378 259.542 582.378 269.236L582.37 332.988L582.442 374.561C582.631 402.737 583.481 422.16 569.367 447.751C562.379 460.393 552.917 471.497 541.545 480.402C532.899 487.216 520.709 493.139 510.906 498.439L474.59 518.454L440.699 537.17C433.771 541.003 422.024 548.001 414.837 550.08C402.908 553.084 391.698 547.444 387.562 535.75C384.356 526.684 385.506 515.189 385.506 505.527L385.503 457.709L385.489 384.03C385.478 371.4 384.815 351.092 386.661 339.194C388.761 325.465 393.966 312.396 401.878 300.981C413.272 284.362 424.519 277.582 441.566 267.97L473.202 250.472L517.941 225.743C528.235 220.087 541.263 211.555 552.617 209.449Z"/><path fill="#DFEBF8" transform="scale(1.22782 1.22837)" d="M554.979 341.691C555.336 341.919 555.337 342.07 555.594 342.494C556.042 350.455 555.806 362.581 555.705 370.915C555.529 385.446 556.982 404.382 553.345 418.079C549.45 432.427 541.606 445.394 530.705 455.504C519.85 465.527 497.742 475.964 484.069 483.644C460.488 496.888 436.159 509.447 412.706 522.991L411.812 522.863C411.407 520.181 411.547 514.367 411.563 511.472L411.658 492.343L411.61 419.915C419.924 415.981 426.783 412.012 434.772 407.687C446.115 401.668 457.389 395.518 468.59 389.239L554.979 341.691Z"/><path fill="#DFEBF8" transform="scale(1.22782 1.22837)" d="M552.331 234.96C554.485 235.301 556.551 237.371 556.614 239.633C557.281 263.444 556.174 287.348 557.115 311.166C552.421 313.443 547.786 316.269 543.172 318.742C500.165 341.793 457.862 366.802 414.633 389.386L411.35 391.177C411.218 382.756 411.206 373.815 411.267 365.434C411.442 351.358 409.942 338.875 415.225 325.394C423.561 304.124 440.103 297.043 458.571 286.899L494.563 266.917C509.559 258.614 524.638 250.506 539.452 241.88C543.628 239.448 547.927 236.939 552.331 234.96Z"/><path fill="#DFEBF8" transform="scale(1.22782 1.22837)" d="M488.102 39.2607C496.474 38.3596 504.941 39.2681 512.931 41.9247C521.728 44.8835 531.398 51.0393 539.748 55.6788L591.66 84.9511C586.978 87.3272 581.602 90.517 576.905 93.08L537.206 114.931L416.066 181.45L377.926 202.235C358.394 212.908 342.907 220.761 326.811 236.812C304.868 258.696 290.149 285.333 283.042 315.474C278.522 334.641 279.262 351.024 279.267 370.329L279.289 415.328L279.281 566.374L279.27 620.635C279.272 623.769 279.266 626.886 279.365 630.019C279.422 631.805 280.411 636.017 279.563 637.418L278.661 636.993C273.11 633.535 265.688 629.62 259.852 626.32L219.561 603.651C211.953 599.35 199.869 592.943 193.469 587.758C182.647 578.907 175.732 566.162 174.212 552.264C173.026 540.881 173.765 518.934 173.753 506.814L173.698 417.79L173.706 320.735C173.715 306.328 173.307 291.177 173.817 276.838C174.844 247.95 186.862 219.785 204.924 197.517C212.379 188.485 221.121 180.598 230.871 174.11C244.429 165.13 265.192 154.596 280.057 146.445L364.951 99.9187C391.081 85.7307 416.953 71.0634 443.173 57.026C459.988 48.0244 468.061 41.3697 488.102 39.2607Z"/></svg>
\ No newline at end of file
diff --git a/apps/app/public/openwork-mark.svg b/apps/app/public/openwork-mark.svg
new file mode 100644
index 0000000000..e7ebb9153d
--- /dev/null
+++ b/apps/app/public/openwork-mark.svg
@@ -0,0 +1,30 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 834 649"
+  fill="none"
+>
+  <path
+    fill="#011627"
+    d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z"
+  />
+  <path
+    fill="#011627"
+    d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z"
+  />
+</svg>
diff --git a/scripts/_util.mjs b/apps/app/scripts/_util.mjs
similarity index 84%
rename from scripts/_util.mjs
rename to apps/app/scripts/_util.mjs
index 291b0238ce..aa6bcc0926 100644
--- a/scripts/_util.mjs
+++ b/apps/app/scripts/_util.mjs
@@ -2,14 +2,24 @@ import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
 import { once } from "node:events";
 import net from "node:net";
-import { realpathSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 
 import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
 
+function resolveBasicAuthHeader() {
+  const password = process.env.OPENCODE_SERVER_PASSWORD?.trim() ?? "";
+  if (!password) return undefined;
+  const username = process.env.OPENCODE_SERVER_USERNAME?.trim() || "opencode";
+  const encoded = Buffer.from(`${username}:${password}`, "utf8").toString("base64");
+  return `Basic ${encoded}`;
+}
+
 export function makeClient({ baseUrl, directory }) {
+  const authorization = resolveBasicAuthHeader();
   return createOpencodeClient({
     baseUrl,
     directory,
+    headers: authorization ? { Authorization: authorization } : undefined,
     responseStyle: "data",
     throwOnError: true,
   });
@@ -153,3 +163,12 @@ export function parseArgs(argv) {
   }
   return args;
 }
+
+export function canWriteWorkspace(directory) {
+  try {
+    const stat = statSync(directory);
+    return stat && stat.isDirectory();
+  } catch {
+    return false;
+  }
+}
diff --git a/apps/app/scripts/browser-entry.mjs b/apps/app/scripts/browser-entry.mjs
new file mode 100644
index 0000000000..f174b7981d
--- /dev/null
+++ b/apps/app/scripts/browser-entry.mjs
@@ -0,0 +1,310 @@
+import assert from "node:assert";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+
+import { findFreePort, makeClient, parseArgs, spawnOpencodeServe, waitForHealthy } from "./_util.mjs";
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function writeSse(res, chunks) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+  });
+  for (const chunk of chunks) {
+    res.write(`data: ${JSON.stringify(chunk)}\n\n`);
+  }
+  res.write("data: [DONE]\n\n");
+  res.end();
+}
+
+function createTextStream(text) {
+  return [
+    {
+      id: "chatcmpl-1",
+      object: "chat.completion.chunk",
+      choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-1",
+      object: "chat.completion.chunk",
+      choices: [{ index: 0, delta: { content: text }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-1",
+      object: "chat.completion.chunk",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+  ];
+}
+
+function createInvalidToolStream() {
+  return [
+    {
+      id: "chatcmpl-2",
+      object: "chat.completion.chunk",
+      choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-2",
+      object: "chat.completion.chunk",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_1",
+                type: "function",
+                function: { name: "nonexistent_tool", arguments: "{}" },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    {
+      id: "chatcmpl-2",
+      object: "chat.completion.chunk",
+      choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }],
+    },
+  ];
+}
+
+function hasChromeQuickstartPrompt(haystack) {
+  return (
+    haystack.includes("chrome devtools mcp") ||
+    haystack.includes("chrome-devtools_*") ||
+    haystack.includes("control chrome")
+  );
+}
+
+const args = parseArgs(process.argv.slice(2));
+const keepTmp = args.get("keep-tmp") === "true";
+
+const results = {
+  ok: true,
+  steps: [],
+};
+
+function step(name, fn) {
+  results.steps.push({ name, status: "running" });
+  const idx = results.steps.length - 1;
+  return Promise.resolve()
+    .then(fn)
+    .then((data) => {
+      results.steps[idx] = { name, status: "ok", data };
+    })
+    .catch((e) => {
+      results.ok = false;
+      results.steps[idx] = {
+        name,
+        status: "error",
+        error: e instanceof Error ? e.message : String(e),
+      };
+      throw e;
+    });
+}
+
+let tmpdir;
+let mock;
+let opencode;
+let sawChromeQuickstartPrompt = false;
+const mockSockets = new Set();
+
+try {
+  tmpdir = await mkdtemp(path.join(os.tmpdir(), "openwork-browser-entry-"));
+
+  const templateUrl = new URL("../src/app/data/commands/browser-setup.md", import.meta.url);
+  const template = await readFile(templateUrl, "utf8");
+
+  await step("workspace.setup", async () => {
+    await mkdir(path.join(tmpdir, ".opencode", "commands"), { recursive: true });
+    await writeFile(path.join(tmpdir, ".opencode", "commands", "browser-setup.md"), template, "utf8");
+    return { tmpdir };
+  });
+
+  const mockPort = await findFreePort();
+  const baseURL = `http://127.0.0.1:${mockPort}/v1`;
+
+  await step("provider.mock.start", async () => {
+    mock = http.createServer(async (req, res) => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "127.0.0.1"}`);
+      if (req.method === "GET" && url.pathname.endsWith("/models")) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            object: "list",
+            data: [{ id: "qwen-plus", object: "model" }],
+          }),
+        );
+        return;
+      }
+
+      if (req.method === "POST" && url.pathname.endsWith("/chat/completions")) {
+        const raw = await new Promise((resolve) => {
+          let data = "";
+          req.setEncoding("utf8");
+          req.on("data", (chunk) => (data += chunk));
+          req.on("end", () => resolve(data));
+        });
+
+        let body;
+        try {
+          body = raw ? JSON.parse(raw) : {};
+        } catch {
+          body = {};
+        }
+
+        const haystack = JSON.stringify(body).toLowerCase();
+        const triesChromeMcp = hasChromeQuickstartPrompt(haystack);
+
+        if (triesChromeMcp) {
+          sawChromeQuickstartPrompt = true;
+          writeSse(
+            res,
+            createTextStream(
+              "Trying Control Chrome first. If Chrome MCP is unavailable, open the MCP tab, connect Control Chrome, and retry.",
+            ),
+          );
+        } else {
+          writeSse(res, createInvalidToolStream());
+        }
+        return;
+      }
+
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("not found");
+    });
+    mock.on("connection", (socket) => {
+      mockSockets.add(socket);
+      socket.on("close", () => {
+        mockSockets.delete(socket);
+      });
+    });
+
+    await new Promise((resolve) => mock.listen(mockPort, "127.0.0.1", resolve));
+    return { baseURL };
+  });
+
+  await step("workspace.config", async () => {
+    await writeFile(
+      path.join(tmpdir, "opencode.json"),
+      JSON.stringify(
+        {
+          $schema: "https://opencode.ai/config.json",
+          enabled_providers: ["alibaba"],
+          provider: {
+            alibaba: {
+              options: {
+                apiKey: "test-key",
+                baseURL,
+              },
+            },
+          },
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    );
+    return {};
+  });
+
+  const port = await findFreePort();
+  opencode = await spawnOpencodeServe({ directory: tmpdir, port });
+  const client = makeClient({ baseUrl: opencode.baseUrl, directory: opencode.cwd });
+
+  await step("health", async () => {
+    const health = await waitForHealthy(client);
+    return health;
+  });
+
+  let sessionId;
+
+  await step("session.create", async () => {
+    const session = await client.session.create({ title: "OpenWork browser-entry test" });
+    sessionId = session.id;
+    assert.ok(sessionId);
+    return { id: session.id };
+  });
+
+  await step("session.command (browser-setup)", async () => {
+    await client.session.command({
+      sessionID: sessionId,
+      command: "browser-setup",
+      arguments: "",
+      model: "alibaba/qwen-plus",
+    });
+    return {};
+  });
+
+  await step("assert.chrome-mcp-quickstart", async () => {
+    assert.equal(sawChromeQuickstartPrompt, true, "Expected browser quickstart prompt to reference Chrome DevTools MCP");
+    return { sawChromeQuickstartPrompt };
+  });
+
+  await step("assert.no-tool-errors", async () => {
+    const start = Date.now();
+    // Keep this internal polling window short: the test should wait up to 12 seconds for the assistant response before failing
+    while (Date.now() - start < 12_000) {
+      const msgs = await client.session.messages({ sessionID: sessionId, limit: 50 });
+      const parts = msgs.flatMap((m) => m.parts ?? []);
+      const toolErrors = parts.filter((p) => p?.type === "tool" && String(p?.state?.status ?? "").toLowerCase() === "error");
+      if (toolErrors.length > 0) {
+        const first = toolErrors[0];
+        const tool = typeof first.tool === "string" ? first.tool : "tool";
+        const title = typeof first.state?.title === "string" ? first.state.title : "";
+        const err = typeof first.state?.error === "string" ? first.state.error : "";
+        throw new Error(`Unexpected tool error (${tool}): ${title} ${err}`.trim());
+      }
+
+      const hasAssistantText = msgs.some(
+        (m) => m.info?.role === "assistant" && (m.parts ?? []).some((p) => p.type === "text" && String(p.text ?? "").trim()),
+      );
+      if (hasAssistantText) {
+        return { messages: msgs.length };
+      }
+
+      await sleep(250);
+    }
+    throw new Error("Timed out waiting for assistant response");
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  results.ok = false;
+  results.error = message;
+  results.stderr = opencode?.getStderr?.() ?? "";
+  console.error(JSON.stringify(results, null, 2));
+  process.exitCode = 1;
+} finally {
+  try {
+    if (opencode) await opencode.close();
+  } catch {
+    // ignore
+  }
+  try {
+    if (mock) {
+      for (const socket of mockSockets) {
+        socket.destroy();
+      }
+      await new Promise((resolve) => mock.close(() => resolve()));
+    }
+  } catch {
+    // ignore
+  }
+  try {
+    if (tmpdir && !keepTmp) await rm(tmpdir, { recursive: true, force: true });
+  } catch {
+    // ignore
+  }
+}
diff --git a/apps/app/scripts/bump-version.mjs b/apps/app/scripts/bump-version.mjs
new file mode 100755
index 0000000000..0eb0dcad81
--- /dev/null
+++ b/apps/app/scripts/bump-version.mjs
@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+const ROOT = process.cwd();
+const REPO_ROOT = path.resolve(ROOT, "../..");
+const args = process.argv.slice(2);
+
+const usage = () => {
+  console.log(`Usage:
+  node scripts/bump-version.mjs patch|minor|major
+  node scripts/bump-version.mjs --set x.y.z
+  node scripts/bump-version.mjs --dry-run [patch|minor|major|--set x.y.z]`);
+};
+
+const isDryRun = args.includes("--dry-run");
+// pnpm forwards args to scripts with an explicit "--" separator; strip it so
+// "pnpm bump:set -- 0.1.21" works as expected.
+const filtered = args.filter((arg) => arg !== "--dry-run" && arg !== "--");
+
+if (!filtered.length) {
+  usage();
+  process.exit(1);
+}
+
+let mode = filtered[0];
+let explicit = null;
+
+if (mode === "--set") {
+  explicit = filtered[1] ?? null;
+  if (!explicit) {
+    console.error("--set requires a version like 0.1.21");
+    process.exit(1);
+  }
+}
+
+const semverPattern = /^\d+\.\d+\.\d+$/;
+
+const readJson = async (filePath) =>
+  JSON.parse(await readFile(filePath, "utf8"));
+
+const bump = (value, bumpMode) => {
+  if (!semverPattern.test(value)) {
+    throw new Error(`Invalid version: ${value}`);
+  }
+  const [major, minor, patch] = value.split(".").map(Number);
+  if (bumpMode === "major") return `${major + 1}.0.0`;
+  if (bumpMode === "minor") return `${major}.${minor + 1}.0`;
+  if (bumpMode === "patch") return `${major}.${minor}.${patch + 1}`;
+  throw new Error(`Unknown bump mode: ${bumpMode}`);
+};
+
+const targetVersion = async () => {
+  if (explicit) return explicit;
+  const pkg = await readJson(path.join(ROOT, "package.json"));
+  return bump(pkg.version, mode);
+};
+
+const updatePackageJson = async (nextVersion) => {
+  const uiPath = path.join(ROOT, "package.json");
+  const tauriPath = path.join(REPO_ROOT, "apps", "desktop", "package.json");
+  const orchestratorPath = path.join(
+    REPO_ROOT,
+    "apps",
+    "orchestrator",
+    "package.json",
+  );
+  const serverPath = path.join(REPO_ROOT, "apps", "server", "package.json");
+  const opencodeRouterPath = path.join(
+    REPO_ROOT,
+    "apps",
+    "opencode-router",
+    "package.json",
+  );
+  const uiData = await readJson(uiPath);
+  const tauriData = await readJson(tauriPath);
+  const orchestratorData = await readJson(orchestratorPath);
+  const serverData = await readJson(serverPath);
+  const opencodeRouterData = await readJson(opencodeRouterPath);
+  uiData.version = nextVersion;
+  tauriData.version = nextVersion;
+  // Desktop pins opencodeRouterVersion for sidecar bundling; keep it aligned.
+  tauriData.opencodeRouterVersion = nextVersion;
+  orchestratorData.version = nextVersion;
+
+  // Ensure openwork-orchestrator uses the same openwork-server/opencode-router versions.
+  orchestratorData.dependencies = orchestratorData.dependencies ?? {};
+  orchestratorData.dependencies["openwork-server"] = nextVersion;
+  orchestratorData.dependencies["opencode-router"] = nextVersion;
+
+  serverData.version = nextVersion;
+  opencodeRouterData.version = nextVersion;
+  if (!isDryRun) {
+    await writeFile(uiPath, JSON.stringify(uiData, null, 2) + "\n");
+    await writeFile(tauriPath, JSON.stringify(tauriData, null, 2) + "\n");
+    await writeFile(
+      orchestratorPath,
+      JSON.stringify(orchestratorData, null, 2) + "\n",
+    );
+    await writeFile(serverPath, JSON.stringify(serverData, null, 2) + "\n");
+    await writeFile(
+      opencodeRouterPath,
+      JSON.stringify(opencodeRouterData, null, 2) + "\n",
+    );
+  }
+};
+
+const updateCargoToml = async (nextVersion) => {
+  const filePath = path.join(
+    REPO_ROOT,
+    "apps",
+    "desktop",
+    "src-tauri",
+    "Cargo.toml",
+  );
+  const raw = await readFile(filePath, "utf8");
+  const updated = raw.replace(
+    /\bversion\s*=\s*"[^"]+"/m,
+    `version = "${nextVersion}"`,
+  );
+  if (!isDryRun) {
+    await writeFile(filePath, updated);
+    // Regenerate Cargo.lock so it stays in sync with the version bump.
+    const { execFileSync } = await import("node:child_process");
+    try {
+      execFileSync("cargo", ["generate-lockfile"], {
+        cwd: path.join(REPO_ROOT, "apps", "desktop", "src-tauri"),
+        stdio: "ignore",
+      });
+    } catch {
+      // cargo may not be installed (e.g. CI without Rust); skip silently.
+    }
+  }
+};
+
+const updateTauriConfig = async (nextVersion) => {
+  const filePath = path.join(
+    REPO_ROOT,
+    "apps",
+    "desktop",
+    "src-tauri",
+    "tauri.conf.json",
+  );
+  const data = JSON.parse(await readFile(filePath, "utf8"));
+  data.version = nextVersion;
+  if (!isDryRun) {
+    await writeFile(filePath, JSON.stringify(data, null, 2) + "\n");
+  }
+};
+
+const main = async () => {
+  if (explicit && !semverPattern.test(explicit)) {
+    throw new Error(`Invalid explicit version: ${explicit}`);
+  }
+  if (explicit === null && !["patch", "minor", "major"].includes(mode)) {
+    throw new Error(`Unknown mode: ${mode}`);
+  }
+
+  const nextVersion = await targetVersion();
+  await updatePackageJson(nextVersion);
+  await updateCargoToml(nextVersion);
+  await updateTauriConfig(nextVersion);
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        version: nextVersion,
+        dryRun: isDryRun,
+        files: [
+          "apps/app/package.json",
+          "apps/desktop/package.json",
+          "apps/orchestrator/package.json",
+          "apps/server/package.json",
+          "apps/opencode-router/package.json",
+          "apps/desktop/src-tauri/Cargo.toml",
+          "apps/desktop/src-tauri/tauri.conf.json",
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+};
+
+main().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(JSON.stringify({ ok: false, error: message }));
+  process.exit(1);
+});
diff --git a/apps/app/scripts/bundle-url-policy.ts b/apps/app/scripts/bundle-url-policy.ts
new file mode 100644
index 0000000000..112eb8b216
--- /dev/null
+++ b/apps/app/scripts/bundle-url-policy.ts
@@ -0,0 +1,45 @@
+import { strict as assert } from "node:assert";
+
+import { describeBundleUrlTrust, isConfiguredBundlePublisherUrl } from "../src/app/bundles/url-policy";
+
+const trusted = describeBundleUrlTrust(
+  "https://share.openworklabs.com/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
+  "https://share.openworklabs.com",
+);
+
+assert.deepEqual(trusted, {
+  trusted: true,
+  bundleId: "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+  actualOrigin: "https://share.openworklabs.com",
+  configuredOrigin: "https://share.openworklabs.com",
+});
+
+const untrusted = describeBundleUrlTrust(
+  "https://evil.example/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
+  "https://share.openworklabs.com",
+);
+
+assert.deepEqual(untrusted, {
+  trusted: false,
+  bundleId: "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+  actualOrigin: "https://evil.example",
+  configuredOrigin: "https://share.openworklabs.com",
+});
+
+assert.equal(
+  isConfiguredBundlePublisherUrl(
+    "https://share.openworklabs.com/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
+    "https://share.openworklabs.com",
+  ),
+  true,
+);
+
+assert.equal(
+  isConfiguredBundlePublisherUrl(
+    "https://share.openworklabs.com/not-a-bundle",
+    "https://share.openworklabs.com",
+  ),
+  false,
+);
+
+console.log("bundle-url-policy ok");
diff --git a/apps/app/scripts/dev-log.ts b/apps/app/scripts/dev-log.ts
new file mode 100644
index 0000000000..5791e789b2
--- /dev/null
+++ b/apps/app/scripts/dev-log.ts
@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+
+const { clearDevLogs, formatDevLogLine, formatDevLogText, readDevLogs, recordDevLog } = await import(
+  "../src/app/lib/dev-log.ts"
+);
+
+const results = {
+  ok: true,
+  steps: [] as Array<Record<string, unknown>>,
+};
+
+async function step(name: string, fn: () => void | Promise<void>) {
+  results.steps.push({ name, status: "running" });
+  const index = results.steps.length - 1;
+
+  try {
+    await fn();
+    results.steps[index] = { name, status: "ok" };
+  } catch (error) {
+    results.ok = false;
+    results.steps[index] = {
+      name,
+      status: "error",
+      error: error instanceof Error ? error.message : String(error),
+    };
+    throw error;
+  }
+}
+
+try {
+  clearDevLogs();
+
+  await step("disabled logging does not retain entries", () => {
+    recordDevLog(false, { level: "debug", source: "workspace", label: "connect:start" });
+    assert.equal(readDevLogs(0).length, 0);
+  });
+
+  await step("enabled logging retains ordered entries", () => {
+    recordDevLog(true, { level: "debug", source: "workspace", label: "connect:start", payload: { root: "/tmp/demo" } });
+    recordDevLog(true, { level: "warn", source: "session", label: "stream:error", payload: { code: 500 } });
+    const logs = readDevLogs(0);
+    assert.equal(logs.length, 2);
+    assert.equal(logs[0]?.source, "workspace");
+    assert.equal(logs[1]?.level, "warn");
+  });
+
+  await step("formatted output stays readable and exportable", () => {
+    const line = formatDevLogLine(readDevLogs(1)[0]!);
+    assert.match(line, /WARN session:stream:error/);
+    const text = formatDevLogText(0);
+    assert.match(text, /DEBUG workspace:connect:start/);
+    assert.match(text, /WARN session:stream:error/);
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+} catch (error) {
+  results.ok = false;
+  console.error(
+    JSON.stringify(
+      {
+        ...results,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      null,
+      2,
+    ),
+  );
+  process.exitCode = 1;
+}
diff --git a/scripts/e2e.mjs b/apps/app/scripts/e2e.mjs
similarity index 100%
rename from scripts/e2e.mjs
rename to apps/app/scripts/e2e.mjs
diff --git a/scripts/events.mjs b/apps/app/scripts/events.mjs
similarity index 100%
rename from scripts/events.mjs
rename to apps/app/scripts/events.mjs
diff --git a/apps/app/scripts/fs-engine.mjs b/apps/app/scripts/fs-engine.mjs
new file mode 100644
index 0000000000..7fb044ffdf
--- /dev/null
+++ b/apps/app/scripts/fs-engine.mjs
@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import {
+  findFreePort,
+  makeClient,
+  parseArgs,
+  spawnOpencodeServe,
+  waitForHealthy,
+} from "./_util.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+const directory = args.get("dir") ?? process.cwd();
+
+const port = await findFreePort();
+const server = await spawnOpencodeServe({ directory, port });
+
+try {
+  const client = makeClient({ baseUrl: server.baseUrl, directory: server.cwd });
+  await waitForHealthy(client);
+
+  const root = ".openwork/test-engine";
+  const nestedDir = path.join(root, "nested");
+  const filePath = path.join(root, "hello.txt");
+
+  await mkdir(path.join(directory, nestedDir), { recursive: true });
+  await writeFile(path.join(directory, filePath), "openwork engine test\n", "utf8");
+
+  const entries = await client.file.list({ directory, path: root });
+  assert.ok(entries.some((entry) => entry.name === "nested" && entry.type === "directory"));
+  assert.ok(entries.some((entry) => entry.name === "hello.txt" && entry.type === "file"));
+
+  const read = await client.file.read({ directory, path: filePath });
+  assert.equal(read.type, "text");
+  assert.ok(read.content.includes("openwork engine test"));
+
+  await rm(path.join(directory, root), { recursive: true, force: true });
+
+  console.log(
+    JSON.stringify({
+      ok: true,
+      baseUrl: server.baseUrl,
+      directory: server.cwd,
+      root,
+    }),
+  );
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  console.error(JSON.stringify({ ok: false, error: message, stderr: server.getStderr() }));
+  process.exitCode = 1;
+} finally {
+  await server.close();
+}
diff --git a/scripts/health.mjs b/apps/app/scripts/health.mjs
similarity index 100%
rename from scripts/health.mjs
rename to apps/app/scripts/health.mjs
diff --git a/apps/app/scripts/local-file-path.mjs b/apps/app/scripts/local-file-path.mjs
new file mode 100644
index 0000000000..b5a0e248aa
--- /dev/null
+++ b/apps/app/scripts/local-file-path.mjs
@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { normalizeLocalFilePath } from "../src/app/lib/local-file-path.impl.js";
+
+const equals = (input, expected) => {
+  assert.equal(normalizeLocalFilePath(input), expected, `normalizeLocalFilePath(${input})`);
+};
+
+equals(" notes/todo.md ", "notes/todo.md");
+equals("file:///tmp/notes.md", "/tmp/notes.md");
+equals("file:/tmp/notes.md", "/tmp/notes.md");
+equals("file:///C:/Users/xj/note.md", "C:/Users/xj/note.md");
+equals("file://server/share/note.md", "//server/share/note.md");
+equals("file://localhost/tmp/notes.md", "/tmp/notes.md");
+equals("FILE:///tmp/notes.md", "/tmp/notes.md");
+
+assert.doesNotThrow(() => normalizeLocalFilePath("file:///tmp/100%/note.md"));
+equals("file:///tmp/100%/note.md", "/tmp/100%/note.md");
+assert.doesNotThrow(() => normalizeLocalFilePath("file://%zz"));
+equals("file://%zz", "%zz");
+
+console.log(JSON.stringify({ ok: true, checks: 11 }));
diff --git a/apps/app/scripts/mention-send.mjs b/apps/app/scripts/mention-send.mjs
new file mode 100644
index 0000000000..217cbdd0f2
--- /dev/null
+++ b/apps/app/scripts/mention-send.mjs
@@ -0,0 +1,144 @@
+import assert from "node:assert/strict";
+
+import { findFreePort, makeClient, parseArgs, spawnOpencodeServe, waitForHealthy } from "./_util.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+const directory = args.get("dir") ?? process.cwd();
+
+const port = await findFreePort();
+const server = await spawnOpencodeServe({ directory, port });
+
+const results = {
+  ok: true,
+  baseUrl: server.baseUrl,
+  directory: server.cwd,
+  steps: [],
+};
+
+function formatError(e) {
+  if (e instanceof Error) return e.message;
+  try {
+    return JSON.stringify(e);
+  } catch {
+    return String(e);
+  }
+}
+
+function step(name, fn) {
+  results.steps.push({ name, status: "running" });
+  const idx = results.steps.length - 1;
+  return Promise.resolve()
+    .then(fn)
+    .then((data) => {
+      results.steps[idx] = { name, status: "ok", data };
+    })
+    .catch((e) => {
+      results.ok = false;
+      results.steps[idx] = { name, status: "error", error: formatError(e) };
+      throw e;
+    });
+}
+
+const targetPath = args.get("path") ?? "src/app/pages/session.tsx";
+const absolutePath = (() => {
+  const trimmed = String(targetPath || "").trim();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("/")) return trimmed;
+  if (/^[a-zA-Z]:\\/.test(trimmed)) return trimmed;
+  return (server.cwd + "/" + trimmed).replace("//", "/");
+})();
+const fileUrl = absolutePath ? `file://${absolutePath}` : "";
+
+try {
+  const client = makeClient({ baseUrl: server.baseUrl, directory: server.cwd });
+  await step("health", async () => waitForHealthy(client));
+
+  let sessionId = "";
+  await step("session.create", async () => {
+    const session = await client.session.create({ title: "OpenWork mention-send" });
+    sessionId = session.id;
+    assert.ok(sessionId);
+    return { id: session.id };
+  });
+
+  async function messagesSummary(label) {
+    const msgs = await client.session.messages({ sessionID: sessionId, limit: 50 });
+    const roles = msgs.map((m) => m?.role ?? m?.info?.role ?? null);
+    const user = msgs.filter((m) => (m?.role ?? m?.info?.role ?? null) === "user");
+    const last = user[user.length - 1];
+    const lastParts = Array.isArray(last?.parts) ? last.parts : [];
+    return {
+      label,
+      total: msgs.length,
+      userCount: user.length,
+      roles: Array.from(new Set(roles)),
+      lastMessageRole: msgs.length ? (msgs[msgs.length - 1]?.role ?? msgs[msgs.length - 1]?.info?.role ?? null) : null,
+      sampleKeys: msgs.length ? Object.keys(msgs[0] ?? {}) : [],
+      sample: msgs.length
+        ? {
+            role: msgs[0]?.role ?? msgs[0]?.info?.role ?? null,
+            parts: Array.isArray(msgs[0]?.parts) ? msgs[0].parts.map((p) => p.type) : [],
+          }
+        : null,
+      lastUserParts: lastParts.map((p) => p.type),
+      lastUserText: (lastParts.find((p) => p.type === "text")?.text ?? ""),
+    };
+  }
+
+  await step("messages.initial", async () => messagesSummary("initial"));
+
+  await step("prompt.invalidFilePart", async () => {
+    // Mirrors the bug in OpenWork: sending a file mention with only {path}.
+    try {
+      await client.session.prompt({
+        sessionID: sessionId,
+        noReply: true,
+        parts: [
+          { type: "text", text: " " },
+          { type: "file", path: targetPath },
+        ],
+      });
+      throw new Error("expected prompt to fail validation, but it succeeded");
+    } catch (e) {
+      return { expectedFailure: true, error: formatError(e) };
+    }
+  });
+
+  await step("prompt.spaceTextWithValidFile", async () => {
+    assert.ok(fileUrl, "missing file url");
+    await client.session.prompt({
+      sessionID: sessionId,
+      noReply: true,
+      parts: [
+        { type: "text", text: " " },
+        { type: "file", mime: "text/plain", url: fileUrl, filename: "session.tsx" },
+      ],
+    });
+    return messagesSummary("after-space-text");
+  });
+
+  await step("prompt.fixedPayload", async () => {
+    assert.ok(fileUrl, "missing file url");
+    await client.session.prompt({
+      sessionID: sessionId,
+      noReply: true,
+      parts: [
+        { type: "text", text: `@${targetPath}` },
+        { type: "file", mime: "text/plain", url: fileUrl, filename: "session.tsx" },
+      ],
+    });
+    const summary = await messagesSummary("after-fixed");
+    assert.ok(summary.lastUserText.includes(targetPath), "expected last user text to include the mentioned path");
+    return summary;
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+} catch (e) {
+  results.ok = false;
+  results.error = formatError(e);
+  results.stderr = server.getStderr();
+  console.error(JSON.stringify(results, null, 2));
+  process.exitCode = 1;
+} finally {
+  await server.close();
+}
diff --git a/scripts/permissions.mjs b/apps/app/scripts/permissions.mjs
similarity index 100%
rename from scripts/permissions.mjs
rename to apps/app/scripts/permissions.mjs
diff --git a/apps/app/scripts/remote-workspace-diagnostics.test.ts b/apps/app/scripts/remote-workspace-diagnostics.test.ts
new file mode 100644
index 0000000000..e58b4322c7
--- /dev/null
+++ b/apps/app/scripts/remote-workspace-diagnostics.test.ts
@@ -0,0 +1,430 @@
+import { describe, expect, test } from "bun:test";
+
+import type { OpenworkServerClient } from "../src/app/lib/openwork-server";
+import type { WorkspaceInfo } from "../src/app/lib/desktop";
+import { getWorkspaceTaskLoadErrorDisplay } from "../src/app/utils";
+import {
+  diagnoseRemoteWorkspaceTaskLoadFailure,
+  getRemoteWorkspaceConnectionKey,
+  redactRemoteDiagnosticText,
+  resolveRemoteWorkspaceConnectionTarget,
+  testRemoteWorkspaceConnection,
+} from "../src/react-app/domains/workspace/remote-workspace-diagnostics";
+
+function workspace(overrides: Partial<WorkspaceInfo> = {}): WorkspaceInfo {
+  return {
+    id: "ws_local",
+    name: "Remote worker",
+    path: "",
+    preset: "remote",
+    workspaceType: "remote",
+    remoteType: "openwork",
+    openworkHostUrl: "https://worker.example.com/w/ws_remote",
+    openworkToken: "ow-token",
+    ...overrides,
+  };
+}
+
+function client(overrides: Partial<OpenworkServerClient> = {}): OpenworkServerClient {
+  return {
+    baseUrl: "https://worker.example.com/w/ws_remote",
+    token: "ow-token",
+    health: async () => ({ ok: true, version: "0.1.0", uptimeMs: 10 }),
+    status: async () => ({
+      ok: true,
+      version: "0.1.0",
+      uptimeMs: 10,
+      readOnly: false,
+      approval: { mode: "manual", timeoutMs: 30_000 },
+      corsOrigins: [],
+      workspaceCount: 1,
+      activeWorkspaceId: "ws_remote",
+      selectedWorkspaceId: "ws_remote",
+      workspace: {
+        id: "ws_remote",
+        name: "Worker project",
+        path: "/workspace",
+        preset: "starter",
+        workspaceType: "local",
+      },
+      authorizedRoots: ["/workspace"],
+      server: { host: "127.0.0.1", port: 8787 },
+      tokenSource: { client: "file", host: "file" },
+    }),
+    capabilities: async () => ({
+      skills: { read: true, write: true, source: "openwork" },
+      plugins: { read: true, write: true },
+      mcp: { read: true, write: true },
+      commands: { read: true, write: true },
+      config: { read: true, write: true },
+    }),
+    listWorkspaces: async () => ({
+      items: [
+        {
+          id: "ws_remote",
+          name: "Worker project",
+          path: "/workspace",
+          preset: "starter",
+          workspaceType: "local",
+        },
+      ],
+      activeId: "ws_remote",
+    }),
+    ...overrides,
+  } as OpenworkServerClient;
+}
+
+function serverError(status: number, code: string, message: string) {
+  return Object.assign(new Error(message), { status, code });
+}
+
+describe("resolveRemoteWorkspaceConnectionTarget", () => {
+  test("builds a workspace-scoped OpenWork target from saved worker credentials", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(
+      workspace({
+        openworkHostUrl: "https://worker.example.com",
+        openworkWorkspaceId: "ws_remote",
+      }),
+    );
+
+    expect(target.ok).toBe(true);
+    if (!target.ok) return;
+    expect(target.target.baseUrl).toBe("https://worker.example.com/w/ws_remote");
+    expect(target.target.workspaceId).toBe("ws_remote");
+    expect(target.target.token).toBe("ow-token");
+  });
+
+  test("parses workspace id from a workspace-scoped connect URL", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(workspace());
+
+    expect(target.ok).toBe(true);
+    if (!target.ok) return;
+    expect(target.target.workspaceId).toBe("ws_remote");
+    expect(target.target.baseUrl).toBe("https://worker.example.com/w/ws_remote");
+  });
+
+  test("fails fast when a remote worker has no endpoint", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(
+      workspace({
+        openworkHostUrl: "",
+        baseUrl: "",
+      }),
+    );
+
+    expect(target.ok).toBe(false);
+    if (target.ok) return;
+    expect(target.state.status).toBe("error");
+    expect(target.state.message).toContain("URL is missing");
+  });
+
+  test("fails fast when a remote worker endpoint is invalid", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(
+      workspace({
+        openworkHostUrl: "not a url",
+      }),
+    );
+
+    expect(target.ok).toBe(false);
+    if (target.ok) return;
+    expect(target.state.status).toBe("error");
+    expect(target.state.message).toContain("URL is invalid");
+  });
+
+  test("does not run OpenWork probes against non-OpenWork remote workspaces", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(
+      workspace({
+        remoteType: "opencode",
+        openworkHostUrl: "",
+        openworkToken: "",
+        baseUrl: "https://opencode.example.com",
+      }),
+    );
+
+    expect(target.ok).toBe(false);
+    if (target.ok) return;
+    expect(target.state.status).toBe("error");
+    expect(target.state.message).toContain("OpenWork remote workers");
+  });
+
+  test("does not run OpenWork probes against stale OpenWork fields on non-OpenWork remotes", () => {
+    const target = resolveRemoteWorkspaceConnectionTarget(
+      workspace({
+        remoteType: "opencode",
+        openworkHostUrl: "https://worker.example.com/w/ws_remote",
+        openworkToken: "owt_secret",
+        baseUrl: "https://opencode.example.com",
+      }),
+    );
+
+    expect(target.ok).toBe(false);
+    if (target.ok) return;
+    expect(target.state.message).toContain("OpenWork remote workers");
+  });
+});
+
+describe("testRemoteWorkspaceConnection", () => {
+  test("returns a connected state after health, token, capabilities, and workspace checks pass", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      now: () => 123,
+      createClient: () => client(),
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.state).toEqual({
+      status: "connected",
+      message: "Connected to Worker project.",
+      checkedAt: 123,
+    });
+  });
+
+  test("reports a missing token after proving the worker endpoint is reachable", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace({ openworkToken: "" }), {
+      createClient: () => client(),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("Token is missing");
+  });
+
+  test("reports unhealthy health responses as endpoint failures", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          health: async () => ({ ok: false, version: "0.1.0", uptimeMs: 10 }),
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("unhealthy response");
+  });
+
+  test("uses fallback OpenWork tokens saved on older workspace records", async () => {
+    const result = await testRemoteWorkspaceConnection(
+      workspace({
+        openworkToken: "",
+        openworkClientToken: "legacy-client-token",
+      }),
+      {
+        createClient: (target) => {
+          expect(target.token).toBe("legacy-client-token");
+          return client();
+        },
+      },
+    );
+
+    expect(result.ok).toBe(true);
+  });
+
+  test("reports rejected credentials without hiding the endpoint", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          capabilities: async () => {
+            throw serverError(401, "invalid_token", "Invalid token");
+          },
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("Token was rejected by worker.example.com");
+  });
+
+  test("reports a missing workspace separately from a dead worker", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          status: async () => {
+            throw serverError(404, "workspace_not_found", "Workspace not found");
+          },
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("Workspace ws_remote was not found");
+  });
+
+  test("uses workspace list when the saved remote target is not workspace-scoped", async () => {
+    const result = await testRemoteWorkspaceConnection(
+      workspace({
+        openworkHostUrl: "https://worker.example.com",
+        openworkWorkspaceId: "",
+        baseUrl: "",
+      }),
+      {
+        createClient: (target) => {
+          expect(target.baseUrl).toBe("https://worker.example.com");
+          expect(target.workspaceId).toBe(null);
+          return client({
+            status: async () => {
+              throw new Error("status should not be called");
+            },
+          });
+        },
+      },
+    );
+
+    expect(result.ok).toBe(true);
+    expect(result.state.message).toBe("Connected to Worker project.");
+  });
+
+  test("reports rejected credentials from the workspace list fallback", async () => {
+    const result = await testRemoteWorkspaceConnection(
+      workspace({
+        openworkHostUrl: "https://worker.example.com",
+        openworkWorkspaceId: "",
+        baseUrl: "",
+      }),
+      {
+        createClient: () =>
+          client({
+            listWorkspaces: async () => {
+              throw serverError(401, "invalid_token", "Invalid token");
+            },
+          }),
+      },
+    );
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("Token was rejected by worker.example.com");
+  });
+
+  test("reports unauthorized workspace status separately from bad credentials", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          status: async () => {
+            throw serverError(403, "forbidden", "Forbidden");
+          },
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("is not authorized");
+  });
+
+  test("reports endpoint reachability failures from the health probe", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          health: async () => {
+            throw new Error("Failed to fetch");
+          },
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.status).toBe("error");
+    expect(result.state.message).toContain("Cannot reach worker.example.com");
+  });
+
+  test("redacts token-like values from diagnostic error messages", async () => {
+    const result = await testRemoteWorkspaceConnection(workspace(), {
+      createClient: () =>
+        client({
+          health: async () => {
+            throw new Error("Failed with Bearer owt_live_secret and ?token=abc123");
+          },
+        }),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.state.message).toContain("Bearer [redacted]");
+    expect(result.state.message).toContain("?token=[redacted]");
+    expect(result.state.message).not.toContain("owt_live_secret");
+    expect(result.state.message).not.toContain("abc123");
+  });
+});
+
+describe("remote diagnostic identity", () => {
+  test("redacts common token shapes", () => {
+    const redacted = redactRemoteDiagnosticText(
+      "Authorization: Bearer abc.def and https://x.test/?access_token=secret&ok=1 and owt_live_secret",
+    );
+
+    expect(redacted).toContain("Authorization: Bearer [redacted]");
+    expect(redacted).toContain("?access_token=[redacted]&ok=1");
+    expect(redacted).toContain("owt_[redacted]");
+    expect(redacted).not.toContain("abc.def");
+    expect(redacted).not.toContain("secret");
+    expect(redacted).not.toContain("owt_live_secret");
+  });
+
+  test("changes when connection credentials change", () => {
+    const before = getRemoteWorkspaceConnectionKey(workspace({ openworkToken: "old-token" }));
+    const after = getRemoteWorkspaceConnectionKey(workspace({ openworkToken: "new-token" }));
+
+    expect(before).not.toBe(after);
+  });
+});
+
+describe("diagnoseRemoteWorkspaceTaskLoadFailure", () => {
+  test("keeps the task load error when the worker itself is reachable", async () => {
+    const state = await diagnoseRemoteWorkspaceTaskLoadFailure(
+      workspace(),
+      "Session list failed",
+      {
+        now: () => 456,
+        createClient: () => client(),
+      },
+    );
+
+    expect(state).toEqual({
+      status: "error",
+      message: "Worker is reachable, but tasks failed to load: Session list failed",
+      checkedAt: 456,
+    });
+  });
+
+  test("prefers the blocking connection diagnostic when the worker is unreachable", async () => {
+    const state = await diagnoseRemoteWorkspaceTaskLoadFailure(
+      workspace(),
+      "Session list failed",
+      {
+        createClient: () =>
+          client({
+            health: async () => {
+              throw new Error("Failed to fetch");
+            },
+          }),
+      },
+    );
+
+    expect(state.status).toBe("error");
+    expect(state.message).toContain("Cannot reach worker.example.com");
+  });
+
+  test("redacts token-like values from task load fallbacks", async () => {
+    const state = await diagnoseRemoteWorkspaceTaskLoadFailure(
+      workspace(),
+      "Session failed with bearer owt_live_secret and ?token=abc123",
+      {
+        createClient: () => client(),
+      },
+    );
+
+    expect(state.message).toContain("bearer [redacted]");
+    expect(state.message).toContain("?token=[redacted]");
+    expect(state.message).not.toContain("owt_live_secret");
+    expect(state.message).not.toContain("abc123");
+  });
+});
+
+describe("getWorkspaceTaskLoadErrorDisplay", () => {
+  test("redacts remote worker task load errors before rendering", () => {
+    const display = getWorkspaceTaskLoadErrorDisplay(
+      workspace(),
+      "failed with Authorization: Bearer owt_live_secret and ?token=abc123",
+    );
+
+    expect(display.message).toContain("Authorization: Bearer [redacted]");
+    expect(display.message).toContain("?token=[redacted]");
+    expect(display.message).not.toContain("owt_live_secret");
+    expect(display.message).not.toContain("abc123");
+  });
+});
diff --git a/apps/app/scripts/select-session-debug.mjs b/apps/app/scripts/select-session-debug.mjs
new file mode 100644
index 0000000000..f8b4bc1bcd
--- /dev/null
+++ b/apps/app/scripts/select-session-debug.mjs
@@ -0,0 +1,90 @@
+import assert from "node:assert/strict";
+
+import {
+  findFreePort,
+  makeClient,
+  parseArgs,
+  spawnOpencodeServe,
+  waitForHealthy,
+} from "./_util.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+const directory = args.get("dir") ?? process.cwd();
+const baseUrlOverride = args.get("baseUrl") ?? null;
+const count = Number.parseInt(args.get("count") ?? "2", 10);
+const sessionIdOverride = args.get("session") ?? null;
+
+const withTiming = async (label, fn) => {
+  const start = Date.now();
+  try {
+    const result = await fn();
+    const elapsed = Date.now() - start;
+    return { ok: true, label, elapsed, result };
+  } catch (error) {
+    const elapsed = Date.now() - start;
+    return { ok: false, label, elapsed, error: error instanceof Error ? error.message : String(error) };
+  }
+};
+
+let server = null;
+
+try {
+  if (!baseUrlOverride) {
+    const port = await findFreePort();
+    server = await spawnOpencodeServe({ directory, port });
+  }
+
+  const baseUrl = baseUrlOverride ?? server.baseUrl;
+  const client = makeClient({ baseUrl, directory: server?.cwd ?? directory });
+
+  await waitForHealthy(client);
+
+  console.log(
+    JSON.stringify({
+      ok: true,
+      baseUrl,
+      directory: server?.cwd ?? directory,
+      count,
+      sessionIdOverride,
+    }),
+  );
+
+  for (let i = 0; i < count; i += 1) {
+    console.log(`\n=== Iteration ${i + 1}/${count} ===`);
+
+    const health = await withTiming("global.health", async () => client.global.health());
+    console.log(JSON.stringify(health));
+
+    let sessionId = sessionIdOverride;
+    if (!sessionId) {
+      const create = await withTiming("session.create", async () =>
+        client.session.create({ title: `Debug session ${i + 1}`, directory }),
+      );
+      console.log(JSON.stringify(create));
+      assert.ok(create.ok, "session.create failed");
+      sessionId = create.result.id;
+    }
+
+    const list = await withTiming("session.list", async () => client.session.list({ limit: 50 }));
+    console.log(JSON.stringify(list));
+
+    const messages = await withTiming("session.messages", async () =>
+      client.session.messages({ sessionID: sessionId, limit: 50 }),
+    );
+    console.log(JSON.stringify(messages));
+
+    const todos = await withTiming("session.todo", async () => client.session.todo({ sessionID: sessionId }));
+    console.log(JSON.stringify(todos));
+
+    const permissions = await withTiming("permission.list", async () => client.permission.list());
+    console.log(JSON.stringify(permissions));
+  }
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  console.error(JSON.stringify({ ok: false, error: message, stderr: server?.getStderr?.() ?? null }));
+  process.exitCode = 1;
+} finally {
+  if (server) {
+    await server.close();
+  }
+}
diff --git a/apps/app/scripts/session-error-recovery.ts b/apps/app/scripts/session-error-recovery.ts
new file mode 100644
index 0000000000..85bc60907f
--- /dev/null
+++ b/apps/app/scripts/session-error-recovery.ts
@@ -0,0 +1,95 @@
+import assert from "node:assert/strict";
+
+import {
+  latestSessionErrorTurnTime,
+  shouldResetRunState,
+} from "../src/react-app/domains/session/sync/run-state";
+
+assert.equal(latestSessionErrorTurnTime([]), null);
+assert.equal(
+  latestSessionErrorTurnTime([
+    { id: "session-error:test:0", text: "older", afterMessageID: null, time: 10 },
+    { id: "session-error:test:1", text: "latest", afterMessageID: "message-1", time: 25 },
+  ]),
+  25,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: false,
+    sessionStatus: "idle",
+    runHasBegun: true,
+    runStartedAt: 100,
+    latestErrorTurnTime: null,
+  }),
+  true,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: false,
+    sessionStatus: "idle",
+    runHasBegun: false,
+    runStartedAt: 100,
+    latestErrorTurnTime: 120,
+  }),
+  true,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: false,
+    sessionStatus: "idle",
+    runHasBegun: false,
+    runStartedAt: 100,
+    latestErrorTurnTime: 80,
+  }),
+  false,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: false,
+    sessionStatus: "running",
+    runHasBegun: false,
+    runStartedAt: 100,
+    latestErrorTurnTime: 120,
+  }),
+  false,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: false,
+    sessionStatus: "idle",
+    runHasBegun: false,
+    runStartedAt: null,
+    latestErrorTurnTime: 120,
+  }),
+  false,
+);
+
+assert.equal(
+  shouldResetRunState({
+    hasError: true,
+    sessionStatus: "idle",
+    runHasBegun: false,
+    runStartedAt: 100,
+    latestErrorTurnTime: null,
+  }),
+  true,
+);
+
+console.log(
+  JSON.stringify({
+    ok: true,
+    cases: [
+      "picks latest session error turn",
+      "resets completed runs when the session returns idle",
+      "resets immediate failed sends after a synthetic session error turn",
+      "resets immediate failures that only surface a session-level error banner",
+      "ignores stale prior errors",
+      "does not reset while the session is still active",
+    ],
+  }),
+);
diff --git a/apps/app/scripts/session-render-state.test.ts b/apps/app/scripts/session-render-state.test.ts
new file mode 100644
index 0000000000..1ac2f612ba
--- /dev/null
+++ b/apps/app/scripts/session-render-state.test.ts
@@ -0,0 +1,177 @@
+import { describe, expect, it } from "bun:test";
+import type { UIMessage } from "ai";
+
+import type { OpenworkSessionSnapshot } from "../src/app/lib/openwork-server";
+import {
+  deriveRenderedSessionMessages,
+  resolveRenderedSessionSnapshot,
+} from "../src/react-app/domains/session/surface/session-render-state";
+import { mergeSnapshotIntoCachedMessages } from "../src/react-app/domains/session/sync/message-merge";
+
+function snapshotWithMessages(
+  messages: Array<{ id: string; role: "user" | "assistant"; text: string }>,
+  sessionId = "ses_test",
+): OpenworkSessionSnapshot {
+  return {
+    session: {
+      id: sessionId,
+      parentID: undefined,
+      title: "Test session",
+      time: { created: 1, updated: 2 },
+      share: undefined,
+      version: "0",
+    },
+    messages: messages.map((message, index) => ({
+      info: {
+        id: message.id,
+        role: message.role,
+        sessionID: sessionId,
+        time: { created: index + 1 },
+      },
+      parts: [
+        {
+          id: `part_${message.id}`,
+          type: "text",
+          text: message.text,
+          sessionID: sessionId,
+          messageID: message.id,
+        },
+      ],
+    })),
+    todos: [],
+    status: { type: "idle" },
+  } as unknown as OpenworkSessionSnapshot;
+}
+
+function uiMessage(id: string, role: "user" | "assistant", text: string): UIMessage {
+  return {
+    id,
+    role,
+    parts: [{ type: "text", text, state: "done" }],
+  };
+}
+
+function snapshotWithText(text: string, sessionId = "ses_test"): OpenworkSessionSnapshot {
+  return snapshotWithMessages([{ id: "msg_user", role: "user", text }], sessionId);
+}
+
+describe("mergeSnapshotIntoCachedMessages", () => {
+  it("keeps older cached messages when a busy snapshot only contains the active tail", () => {
+    const merged = mergeSnapshotIntoCachedMessages(
+      [uiMessage("msg_current_user", "user", "latest prompt")],
+      [
+        uiMessage("msg_old_user", "user", "old prompt"),
+        uiMessage("msg_old_assistant", "assistant", "old answer"),
+        uiMessage("msg_current_user", "user", "latest"),
+      ],
+    );
+
+    expect(merged.map((message) => message.id)).toEqual([
+      "msg_old_user",
+      "msg_old_assistant",
+      "msg_current_user",
+    ]);
+    expect(merged[2]?.parts[0]).toMatchObject({ text: "latest prompt" });
+  });
+});
+
+describe("deriveRenderedSessionMessages", () => {
+  it("falls back to snapshot messages when transcript cache is empty", () => {
+    const messages = deriveRenderedSessionMessages({
+      transcriptState: [],
+      snapshot: snapshotWithText("still here"),
+    });
+
+    expect(messages).toHaveLength(1);
+    expect(messages[0]?.parts[0]).toMatchObject({
+      type: "text",
+      text: "still here",
+    });
+  });
+
+  it("keeps live transcript cache when it covers the snapshot", () => {
+    const cached: UIMessage[] = [
+      {
+        id: "msg_user",
+        role: "assistant",
+        parts: [{ type: "text", text: "live text", state: "done" }],
+      },
+    ];
+
+    expect(deriveRenderedSessionMessages({
+      transcriptState: cached,
+      snapshot: snapshotWithText("snapshot text"),
+    })).toBe(cached);
+  });
+
+  it("keeps snapshot history visible when the live cache only has the active turn", () => {
+    const messages = deriveRenderedSessionMessages({
+      transcriptState: [
+        {
+          id: "msg_current_user",
+          role: "user",
+          parts: [{ type: "text", text: "latest prompt", state: "done" }],
+        },
+        {
+          id: "msg_current_assistant",
+          role: "assistant",
+          parts: [{ type: "text", text: "streaming answer", state: "streaming" }],
+        },
+      ],
+      snapshot: snapshotWithMessages([
+        { id: "msg_old_user", role: "user", text: "old prompt" },
+        { id: "msg_old_assistant", role: "assistant", text: "old answer" },
+      ]),
+      includeLiveOnlyMessages: true,
+    });
+
+    expect(messages.map((message) => message.id)).toEqual([
+      "msg_old_user",
+      "msg_old_assistant",
+      "msg_current_user",
+      "msg_current_assistant",
+    ]);
+  });
+
+  it("returns an empty list only when there is no cache or snapshot content", () => {
+    expect(deriveRenderedSessionMessages({
+      transcriptState: [],
+      snapshot: null,
+    })).toEqual([]);
+  });
+
+  it("does not use a cached snapshot from a different session", () => {
+    const snapshot = resolveRenderedSessionSnapshot({
+      sessionId: "ses_next",
+      currentSnapshot: null,
+      cachedRendered: {
+        sessionId: "ses_previous",
+        snapshot: snapshotWithText("previous session", "ses_previous"),
+      },
+    });
+
+    expect(snapshot).toBeNull();
+    expect(deriveRenderedSessionMessages({
+      transcriptState: [],
+      snapshot,
+    })).toEqual([]);
+  });
+
+  it("keeps a cached snapshot for the current session while live cache is empty", () => {
+    const cached = snapshotWithText("current session", "ses_current");
+    const snapshot = resolveRenderedSessionSnapshot({
+      sessionId: "ses_current",
+      currentSnapshot: null,
+      cachedRendered: {
+        sessionId: "ses_current",
+        snapshot: cached,
+      },
+    });
+
+    expect(snapshot).toBe(cached);
+    expect(deriveRenderedSessionMessages({
+      transcriptState: [],
+      snapshot,
+    })[0]?.parts[0]).toMatchObject({ text: "current session" });
+  });
+});
diff --git a/apps/app/scripts/session-scope.ts b/apps/app/scripts/session-scope.ts
new file mode 100644
index 0000000000..97899943c8
--- /dev/null
+++ b/apps/app/scripts/session-scope.ts
@@ -0,0 +1,254 @@
+import assert from "node:assert/strict";
+
+Object.defineProperty(globalThis, "navigator", {
+  configurable: true,
+  value: {
+    platform: "MacIntel",
+    userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)",
+  },
+});
+
+const {
+  describeDirectoryScope,
+  resolveScopedClientDirectory,
+  scopedRootsMatch,
+  shouldApplyScopedSessionLoad,
+  shouldRedirectMissingSessionAfterScopedLoad,
+  toSessionTransportDirectory,
+} = await import("../src/app/lib/session-scope.ts");
+
+const starterRoot = "/Users/test/OpenWork/starter";
+const otherRoot = "/Users/test/OpenWork/second";
+
+const results = {
+  ok: true,
+  steps: [] as Array<Record<string, unknown>>,
+};
+
+async function step(name: string, fn: () => void | Promise<void>) {
+  results.steps.push({ name, status: "running" });
+  const index = results.steps.length - 1;
+
+  try {
+    await fn();
+    results.steps[index] = { name, status: "ok" };
+  } catch (error) {
+    results.ok = false;
+    results.steps[index] = {
+      name,
+      status: "error",
+      error: error instanceof Error ? error.message : String(error),
+    };
+    throw error;
+  }
+}
+
+try {
+  await step("local connect prefers explicit target root", () => {
+    assert.equal(
+      resolveScopedClientDirectory({ workspaceType: "local", targetRoot: starterRoot }),
+      starterRoot,
+    );
+    assert.equal(
+      resolveScopedClientDirectory({
+        workspaceType: "local",
+        directory: otherRoot,
+        targetRoot: starterRoot,
+      }),
+      otherRoot,
+    );
+  });
+
+  await step("remote connect still waits for remote discovery", () => {
+    assert.equal(resolveScopedClientDirectory({ workspaceType: "remote", targetRoot: starterRoot }), "");
+  });
+
+  await step("scope matching is stable on desktop-style paths", () => {
+    assert.equal(scopedRootsMatch(`${starterRoot}/`, starterRoot.toUpperCase()), true);
+    assert.equal(scopedRootsMatch(starterRoot, otherRoot), false);
+  });
+
+  await step("stale session loads cannot overwrite another workspace sidebar", () => {
+    for (let index = 0; index < 50; index += 1) {
+      assert.equal(
+        shouldApplyScopedSessionLoad({
+          loadedScopeRoot: otherRoot,
+          workspaceRoot: starterRoot,
+        }),
+        false,
+      );
+    }
+  });
+
+  await step("same-scope session loads still update the active workspace", () => {
+    assert.equal(
+      shouldApplyScopedSessionLoad({
+        loadedScopeRoot: `${starterRoot}/`,
+        workspaceRoot: starterRoot,
+      }),
+      true,
+    );
+  });
+
+  await step("windows create and list use the same transport directory", () => {
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: {
+        platform: "Win32",
+        userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+      },
+    });
+
+    const winRoot = String.raw`C:\Users\Test\OpenWork\starter`;
+    const transport = toSessionTransportDirectory(winRoot);
+
+    assert.equal(transport, winRoot);
+    assert.equal(resolveScopedClientDirectory({ workspaceType: "local", targetRoot: winRoot }), transport);
+    assert.equal(resolveScopedClientDirectory({ workspaceType: "local", directory: winRoot }), transport);
+
+    const uncRoot = String.raw`\\?\UNC\server\share\starter`;
+    assert.equal(toSessionTransportDirectory(uncRoot), String.raw`\\server\share\starter`);
+    assert.equal(describeDirectoryScope(uncRoot).normalized, "//server/share/starter");
+
+    const verbatimDriveRoot = String.raw`\\?\C:\Users\Test\OpenWork\starter`;
+    assert.equal(toSessionTransportDirectory(verbatimDriveRoot), String.raw`C:\Users\Test\OpenWork\starter`);
+    assert.equal(describeDirectoryScope(verbatimDriveRoot).normalized, "c:/users/test/openwork/starter");
+  });
+
+  await step("round-trip invariant: every query path equals the create path (unix)", () => {
+    // Restore macOS navigator for this step.
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: {
+        platform: "MacIntel",
+        userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)",
+      },
+    });
+
+    const unixPaths = [
+      "/Users/test/OpenWork/starter",
+      "/Users/test/OpenWork/starter/",
+      "/home/user/projects/my-app",
+      "/tmp/sandbox",
+      "/private/tmp/sandbox",
+    ];
+
+    for (const raw of unixPaths) {
+      const createDir = toSessionTransportDirectory(raw);
+      const listDir = toSessionTransportDirectory(raw);
+      const resolvedDir = resolveScopedClientDirectory({ workspaceType: "local", targetRoot: raw });
+      assert.equal(createDir, listDir, `create vs list mismatch for: ${raw}`);
+      assert.equal(createDir, resolvedDir, `create vs resolved mismatch for: ${raw}`);
+    }
+  });
+
+  await step("round-trip invariant: every query path equals the create path (windows)", () => {
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: {
+        platform: "Win32",
+        userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+      },
+    });
+
+    // Use escaped strings — Bun's parser chokes on String.raw inside array literals.
+    const windowsPaths = [
+      "C:\\Users\\Test\\OpenWork\\starter",
+      "C:\\Users\\Test\\OpenWork\\starter\\",
+      "D:\\projects\\my-app",
+      "\\\\server\\share\\starter",
+      "\\\\?\\C:\\Users\\Test\\OpenWork\\starter",
+      "\\\\?\\UNC\\server\\share\\starter",
+    ];
+
+    for (const raw of windowsPaths) {
+      const createDir = toSessionTransportDirectory(raw);
+      const listDir = toSessionTransportDirectory(raw);
+      const resolvedDir = resolveScopedClientDirectory({ workspaceType: "local", targetRoot: raw });
+      assert.equal(createDir, listDir, `create vs list mismatch for: ${raw}`);
+      assert.equal(createDir, resolvedDir, `create vs resolved mismatch for: ${raw}`);
+    }
+  });
+
+  await step("idempotency: double-converting a transport directory is stable", () => {
+    // Restore macOS for Unix paths.
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: {
+        platform: "MacIntel",
+        userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)",
+      },
+    });
+
+    const samples = [
+      "/Users/test/OpenWork/starter",
+      "/home/user/projects/my-app",
+    ];
+    for (const raw of samples) {
+      const once = toSessionTransportDirectory(raw);
+      const twice = toSessionTransportDirectory(once);
+      assert.equal(once, twice, `not idempotent for unix path: ${raw}`);
+    }
+
+    // Switch to Windows.
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: {
+        platform: "Win32",
+        userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+      },
+    });
+
+    const winSamples = [
+      "C:\\Users\\Test\\OpenWork\\starter",
+      "\\\\server\\share\\starter",
+    ];
+    for (const raw of winSamples) {
+      const once = toSessionTransportDirectory(raw);
+      const twice = toSessionTransportDirectory(once);
+      assert.equal(once, twice, `not idempotent for win path: ${raw}`);
+    }
+  });
+
+  await step("route guard only redirects when the loaded scope matches", () => {
+    assert.equal(
+      shouldRedirectMissingSessionAfterScopedLoad({
+        loadedScopeRoot: otherRoot,
+        workspaceRoot: starterRoot,
+        hasMatchingSession: false,
+      }),
+      false,
+    );
+    assert.equal(
+      shouldRedirectMissingSessionAfterScopedLoad({
+        loadedScopeRoot: starterRoot,
+        workspaceRoot: starterRoot,
+        hasMatchingSession: false,
+      }),
+      true,
+    );
+    assert.equal(
+      shouldRedirectMissingSessionAfterScopedLoad({
+        loadedScopeRoot: starterRoot,
+        workspaceRoot: starterRoot,
+        hasMatchingSession: true,
+      }),
+      false,
+    );
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+} catch (error) {
+  results.ok = false;
+  console.error(
+    JSON.stringify(
+      {
+        ...results,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      null,
+      2,
+    ),
+  );
+  process.exitCode = 1;
+}
diff --git a/apps/app/scripts/session-switch.mjs b/apps/app/scripts/session-switch.mjs
new file mode 100644
index 0000000000..694f65cca6
--- /dev/null
+++ b/apps/app/scripts/session-switch.mjs
@@ -0,0 +1,151 @@
+import assert from "node:assert/strict";
+
+import {
+  findFreePort,
+  makeClient,
+  parseArgs,
+  spawnOpencodeServe,
+  waitForHealthy,
+} from "./_util.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+const directory = args.get("dir") ?? process.cwd();
+
+const port = await findFreePort();
+const server = await spawnOpencodeServe({ directory, port });
+
+const results = {
+  ok: true,
+  baseUrl: server.baseUrl,
+  directory: server.cwd,
+  steps: [],
+};
+
+function step(name, fn) {
+  results.steps.push({ name, status: "running" });
+  const idx = results.steps.length - 1;
+
+  return Promise.resolve()
+    .then(fn)
+    .then((data) => {
+      results.steps[idx] = { name, status: "ok", data };
+    })
+    .catch((e) => {
+      results.ok = false;
+      results.steps[idx] = {
+        name,
+        status: "error",
+        error: e instanceof Error ? e.message : String(e),
+      };
+      throw e;
+    });
+}
+
+function getMessageSessionId(message) {
+  if (message && typeof message.sessionID === "string") return message.sessionID;
+  if (message && message.info && typeof message.info.sessionID === "string") return message.info.sessionID;
+  return null;
+}
+
+function extractLastText(messages) {
+  const list = Array.isArray(messages) ? messages.slice() : [];
+  for (let i = list.length - 1; i >= 0; i -= 1) {
+    const msg = list[i];
+    const parts = Array.isArray(msg?.parts) ? msg.parts : [];
+    for (let p = parts.length - 1; p >= 0; p -= 1) {
+      const part = parts[p];
+      if (part && part.type === "text" && typeof part.text === "string") {
+        return part.text;
+      }
+    }
+  }
+  return null;
+}
+
+try {
+  const client = makeClient({ baseUrl: server.baseUrl, directory: server.cwd });
+  await waitForHealthy(client);
+
+  let sessionA;
+  let sessionB;
+
+  await step("session.create A", async () => {
+    sessionA = await client.session.create({ title: "OpenWork session A" });
+    assert.ok(sessionA?.id);
+    return { id: sessionA.id };
+  });
+
+  await step("session.create B", async () => {
+    sessionB = await client.session.create({ title: "OpenWork session B" });
+    assert.ok(sessionB?.id);
+    return { id: sessionB.id };
+  });
+
+  await step("session.prompt A", async () => {
+    await client.session.prompt({
+      sessionID: sessionA.id,
+      noReply: true,
+      parts: [{ type: "text", text: "Hello from session A" }],
+    });
+    return { sessionID: sessionA.id };
+  });
+
+  await step("session.prompt B", async () => {
+    await client.session.prompt({
+      sessionID: sessionB.id,
+      noReply: true,
+      parts: [{ type: "text", text: "Hello from session B" }],
+    });
+    return { sessionID: sessionB.id };
+  });
+
+  await step("session.messages A", async () => {
+    const messages = await client.session.messages({ sessionID: sessionA.id, limit: 50 });
+    assert.ok(Array.isArray(messages));
+    for (const msg of messages) {
+      const msgSessionId = getMessageSessionId(msg);
+      assert.equal(msgSessionId, sessionA.id);
+    }
+    const text = extractLastText(messages);
+    assert.ok(text && text.includes("session A"));
+    return { count: messages.length };
+  });
+
+  await step("session.messages B", async () => {
+    const messages = await client.session.messages({ sessionID: sessionB.id, limit: 50 });
+    assert.ok(Array.isArray(messages));
+    for (const msg of messages) {
+      const msgSessionId = getMessageSessionId(msg);
+      assert.equal(msgSessionId, sessionB.id);
+    }
+    const text = extractLastText(messages);
+    assert.ok(text && text.includes("session B"));
+    return { count: messages.length };
+  });
+
+  await step("session.messages switch", async () => {
+    const [messagesA, messagesB] = await Promise.all([
+      client.session.messages({ sessionID: sessionA.id, limit: 50 }),
+      client.session.messages({ sessionID: sessionB.id, limit: 50 }),
+    ]);
+
+    const textA = extractLastText(messagesA);
+    const textB = extractLastText(messagesB);
+
+    assert.ok(textA && textA.includes("session A"));
+    assert.ok(textB && textB.includes("session B"));
+
+    return { aCount: messagesA.length, bCount: messagesB.length };
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  results.ok = false;
+  results.error = message;
+  results.stderr = server.getStderr();
+  console.error(JSON.stringify(results, null, 2));
+  process.exitCode = 1;
+} finally {
+  await server.close();
+}
diff --git a/apps/app/scripts/sessions-parallel.mjs b/apps/app/scripts/sessions-parallel.mjs
new file mode 100644
index 0000000000..45dc072a2e
--- /dev/null
+++ b/apps/app/scripts/sessions-parallel.mjs
@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+
+import {
+  findFreePort,
+  makeClient,
+  parseArgs,
+  spawnOpencodeServe,
+  waitForHealthy,
+} from "./_util.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+const directory = args.get("dir") ?? process.cwd();
+const count = parseInt(args.get("count") ?? "5", 10);
+
+const port = await findFreePort();
+const server = await spawnOpencodeServe({
+  directory,
+  port,
+});
+
+try {
+  const client = makeClient({ baseUrl: server.baseUrl, directory: server.cwd });
+  await waitForHealthy(client);
+
+  console.log(`Creating ${count} sessions in parallel...`);
+
+  const results = await Promise.all(
+    Array.from({ length: count }, async (_, i) => {
+      const start = Date.now();
+      const label = `session-${i + 1}`;
+      console.log(`[${label}] starting...`);
+      
+      try {
+        const session = await client.session.create({ title: `Parallel session ${i + 1}` });
+        const elapsed = Date.now() - start;
+        console.log(`[${label}] created in ${elapsed}ms - ${session.id}`);
+        return { label, ok: true, elapsed, id: session.id };
+      } catch (err) {
+        const elapsed = Date.now() - start;
+        console.log(`[${label}] FAILED in ${elapsed}ms - ${err.message}`);
+        return { label, ok: false, elapsed, error: err.message };
+      }
+    })
+  );
+
+  const successful = results.filter((r) => r.ok);
+  const failed = results.filter((r) => !r.ok);
+  const times = successful.map((r) => r.elapsed);
+  const avg = times.length ? (times.reduce((a, b) => a + b, 0) / times.length).toFixed(0) : "N/A";
+  const max = times.length ? Math.max(...times) : "N/A";
+  const min = times.length ? Math.min(...times) : "N/A";
+
+  console.log("\n--- Summary ---");
+  console.log(`Total: ${count}, Success: ${successful.length}, Failed: ${failed.length}`);
+  console.log(`Times (ms): min=${min}, avg=${avg}, max=${max}`);
+
+  // Now test sequential creates after the parallel burst
+  console.log("\nNow creating 3 more sessions sequentially...");
+  for (let i = 0; i < 3; i++) {
+    const start = Date.now();
+    const session = await client.session.create({ title: `Sequential session ${i + 1}` });
+    const elapsed = Date.now() - start;
+    console.log(`[sequential-${i + 1}] created in ${elapsed}ms - ${session.id}`);
+  }
+
+  console.log(
+    JSON.stringify({
+      ok: true,
+      baseUrl: server.baseUrl,
+      parallelResults: results,
+      stats: { count, successful: successful.length, failed: failed.length, min, avg, max },
+    }),
+  );
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  console.error(JSON.stringify({ ok: false, error: message, stderr: server.getStderr() }));
+  process.exitCode = 1;
+} finally {
+  await server.close();
+}
diff --git a/scripts/sessions.mjs b/apps/app/scripts/sessions.mjs
similarity index 100%
rename from scripts/sessions.mjs
rename to apps/app/scripts/sessions.mjs
diff --git a/scripts/todos.mjs b/apps/app/scripts/todos.mjs
similarity index 100%
rename from scripts/todos.mjs
rename to apps/app/scripts/todos.mjs
diff --git a/apps/app/src/app/bundles/apply.ts b/apps/app/src/app/bundles/apply.ts
new file mode 100644
index 0000000000..f3530b1c40
--- /dev/null
+++ b/apps/app/src/app/bundles/apply.ts
@@ -0,0 +1,87 @@
+import type { WorkspaceDisplay } from "../types";
+import { parseOpenworkWorkspaceIdFromUrl } from "../lib/openwork-server";
+import type { WorkspaceInfo } from "../lib/desktop";
+import type { BundleImportTarget, BundleV1 } from "./types";
+
+export function buildImportPayloadFromBundle(bundle: BundleV1): {
+  payload: Record<string, unknown>;
+  importedSkillsCount: number;
+} {
+  if (bundle.type === "skill") {
+    return {
+      payload: {
+        mode: { skills: "merge" },
+        skills: [
+          {
+            name: bundle.name,
+            description: bundle.description,
+            trigger: bundle.trigger,
+            content: bundle.content,
+          },
+        ],
+      },
+      importedSkillsCount: 1,
+    };
+  }
+
+  if (bundle.type === "skills-set") {
+    return {
+      payload: {
+        mode: { skills: "merge" },
+        skills: bundle.skills.map((skill) => ({
+          name: skill.name,
+          description: skill.description,
+          trigger: skill.trigger,
+          content: skill.content,
+        })),
+      },
+      importedSkillsCount: bundle.skills.length,
+    };
+  }
+
+  throw new Error(`Unsupported bundle type: ${(bundle as { type?: string }).type || "unknown"}`);
+}
+
+export function isBundleImportWorkspace(workspace: WorkspaceDisplay | WorkspaceInfo | null): boolean {
+  if (!workspace?.id?.trim()) return false;
+  if (workspace.workspaceType === "local") {
+    return Boolean(workspace.path?.trim());
+  }
+  return Boolean(workspace.remoteType === "openwork" || workspace.openworkHostUrl?.trim() || workspace.openworkWorkspaceId?.trim());
+}
+
+export function resolveBundleImportTargetForWorkspace(
+  workspace: WorkspaceDisplay | WorkspaceInfo | null,
+): BundleImportTarget | undefined {
+  if (!workspace) return undefined;
+  if (workspace.workspaceType === "local") {
+    const localRoot = workspace.path?.trim() ?? "";
+    return localRoot ? { localRoot } : undefined;
+  }
+
+  const workspaceId =
+    workspace.openworkWorkspaceId?.trim() ||
+    parseOpenworkWorkspaceIdFromUrl(workspace.openworkHostUrl ?? "") ||
+    parseOpenworkWorkspaceIdFromUrl(workspace.baseUrl ?? "") ||
+    null;
+  const directoryHint = workspace.directory?.trim() || workspace.path?.trim() || null;
+  if (workspaceId || directoryHint) {
+    return {
+      workspaceId,
+      directoryHint,
+    };
+  }
+  return undefined;
+}
+
+export function describeWorkspaceForBundleToasts(workspace: WorkspaceDisplay | WorkspaceInfo | null): string {
+  return (
+    workspace?.displayName?.trim() ||
+    workspace?.openworkWorkspaceName?.trim() ||
+    workspace?.name?.trim() ||
+    workspace?.directory?.trim() ||
+    workspace?.path?.trim() ||
+    workspace?.baseUrl?.trim() ||
+    "the selected worker"
+  );
+}
diff --git a/apps/app/src/app/bundles/index.ts b/apps/app/src/app/bundles/index.ts
new file mode 100644
index 0000000000..002cd2ab99
--- /dev/null
+++ b/apps/app/src/app/bundles/index.ts
@@ -0,0 +1,5 @@
+export * from "./apply";
+export * from "./publish";
+export * from "./schema";
+export * from "./sources";
+export * from "./types";
diff --git a/apps/app/src/app/bundles/publish.ts b/apps/app/src/app/bundles/publish.ts
new file mode 100644
index 0000000000..a6e2ab6560
--- /dev/null
+++ b/apps/app/src/app/bundles/publish.ts
@@ -0,0 +1,42 @@
+import type {
+  OpenworkServerClient,
+  OpenworkWorkspaceExport,
+} from "../lib/openwork-server";
+import type { SkillsSetBundleV1 } from "./types";
+
+export function buildSkillsSetBundle(
+  workspaceName: string,
+  exported: OpenworkWorkspaceExport,
+): SkillsSetBundleV1 {
+  const skills = Array.isArray(exported.skills) ? exported.skills : [];
+  if (!skills.length) {
+    throw new Error("No skills found in this workspace.");
+  }
+
+  return {
+    schemaVersion: 1,
+    type: "skills-set",
+    name: `${workspaceName} skills`,
+    description: "Complete skills set from an OpenWork workspace.",
+    skills: skills.map((skill) => ({
+      name: skill.name,
+      description: skill.description,
+      trigger: skill.trigger,
+      content: skill.content,
+    })),
+  };
+}
+
+export async function publishSkillsSetBundleFromWorkspace(input: {
+  client: OpenworkServerClient;
+  workspaceId: string;
+  workspaceName: string;
+}) {
+  const exported = await input.client.exportWorkspace(input.workspaceId, {
+    sensitiveMode: "exclude",
+  });
+  const payload = buildSkillsSetBundle(input.workspaceName, exported);
+  return input.client.publishBundle(payload, "skills-set", {
+    name: payload.name,
+  });
+}
diff --git a/apps/app/src/app/bundles/schema.ts b/apps/app/src/app/bundles/schema.ts
new file mode 100644
index 0000000000..e2654fae5a
--- /dev/null
+++ b/apps/app/src/app/bundles/schema.ts
@@ -0,0 +1,95 @@
+import type {
+  BundleImportSummary,
+  BundleV1,
+  SkillBundleItem,
+} from "./types";
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function readSkillItem(value: unknown): SkillBundleItem | null {
+  const record = readRecord(value);
+  if (!record) return null;
+  const name = typeof record.name === "string" ? record.name.trim() : "";
+  const content = typeof record.content === "string" ? record.content : "";
+  if (!name || !content) return null;
+  return {
+    name,
+    description: typeof record.description === "string" ? record.description : undefined,
+    trigger: typeof record.trigger === "string" ? record.trigger : undefined,
+    content,
+  };
+}
+
+export function describeBundleImport(bundle: BundleV1): BundleImportSummary {
+  if (bundle.type === "skill") {
+    return {
+      title: "Import 1 skill",
+      description: bundle.description?.trim() || `Add \`${bundle.name}\` to an existing worker or create a new one for it.`,
+      items: [bundle.name],
+    };
+  }
+
+  if (bundle.type === "skills-set") {
+    const count = bundle.skills.length;
+    return {
+      title: `Import ${count} skill${count === 1 ? "" : "s"}`,
+      description:
+        bundle.description?.trim() ||
+        `${bundle.name || "Shared skills"} is ready to import into an existing worker or a new worker.`,
+      items: bundle.skills.map((skill) => skill.name),
+    };
+  }
+
+  throw new Error(`Unsupported bundle type: ${(bundle as { type?: string }).type || "unknown"}`);
+}
+
+export function parseBundlePayload(value: unknown): BundleV1 {
+  const record = readRecord(value);
+  if (!record) {
+    throw new Error("Invalid bundle payload.");
+  }
+
+  const schemaVersion = typeof record.schemaVersion === "number" ? record.schemaVersion : null;
+  const type = typeof record.type === "string" ? record.type.trim() : "";
+  const name = typeof record.name === "string" ? record.name.trim() : "";
+
+  if (schemaVersion !== 1) {
+    throw new Error("Unsupported bundle schema version.");
+  }
+
+  if (type === "skill") {
+    const content = typeof record.content === "string" ? record.content : "";
+    if (!name || !content) {
+      throw new Error("Invalid skill bundle payload.");
+    }
+    return {
+      schemaVersion: 1,
+      type: "skill",
+      name,
+      description: typeof record.description === "string" ? record.description : undefined,
+      trigger: typeof record.trigger === "string" ? record.trigger : undefined,
+      content,
+    };
+  }
+
+  if (type === "skills-set") {
+    const skills = Array.isArray(record.skills)
+      ? record.skills.map(readSkillItem).filter((item): item is SkillBundleItem => Boolean(item))
+      : [];
+    if (!skills.length) {
+      throw new Error("Skills set bundle has no importable skills.");
+    }
+    return {
+      schemaVersion: 1,
+      type: "skills-set",
+      name: name || "Shared skills",
+      description: typeof record.description === "string" ? record.description : undefined,
+      skills,
+    };
+  }
+
+  throw new Error(`Unsupported bundle type: ${type || "unknown"}`);
+}
diff --git a/apps/app/src/app/bundles/skill-org-publish.ts b/apps/app/src/app/bundles/skill-org-publish.ts
new file mode 100644
index 0000000000..910fe6bc86
--- /dev/null
+++ b/apps/app/src/app/bundles/skill-org-publish.ts
@@ -0,0 +1,51 @@
+import { createDenClient, readDenSettings, writeDenSettings } from "../lib/den";
+
+export async function saveInstalledSkillToOpenWorkOrg(input: {
+  skillText: string;
+  shared?: "org" | "public" | null;
+  skillHubId?: string | null;
+}): Promise<{ skillId: string; orgId: string; orgName: string }> {
+  const settings = readDenSettings();
+  const token = settings.authToken?.trim() ?? "";
+  if (!token) {
+    throw new Error("Sign in to OpenWork Cloud in Settings to share with your team.");
+  }
+
+  const cloudClient = createDenClient({ baseUrl: settings.baseUrl, apiBaseUrl: settings.apiBaseUrl, token });
+  let orgId = settings.activeOrgId?.trim() ?? "";
+  let orgSlug = settings.activeOrgSlug?.trim() ?? "";
+  let orgName = settings.activeOrgName?.trim() ?? "";
+
+  if (!orgSlug || !orgName || !orgId) {
+    const response = await cloudClient.listOrgs();
+    const match = orgId
+      ? response.orgs.find((org) => org.id === orgId)
+      : response.orgs.find((org) => org.slug === orgSlug) ?? response.orgs[0];
+    if (!match) {
+      throw new Error("Choose an organization in Settings -> Cloud before sharing with your team.");
+    }
+    orgId = match.id;
+    orgSlug = match.slug;
+    orgName = match.name;
+    writeDenSettings({
+      ...settings,
+      baseUrl: settings.baseUrl,
+      authToken: token,
+      activeOrgId: orgId,
+      activeOrgSlug: orgSlug,
+      activeOrgName: orgName,
+    });
+  }
+
+  const created = await cloudClient.createOrgSkill(orgId, {
+    skillText: input.skillText,
+    shared: input.shared === undefined ? null : input.shared,
+  });
+
+  const hubId = input.skillHubId?.trim() ?? "";
+  if (hubId) {
+    await cloudClient.addOrgSkillToHub(orgId, hubId, created.id);
+  }
+
+  return { skillId: created.id, orgId, orgName };
+}
diff --git a/apps/app/src/app/bundles/sources.ts b/apps/app/src/app/bundles/sources.ts
new file mode 100644
index 0000000000..62ceba3827
--- /dev/null
+++ b/apps/app/src/app/bundles/sources.ts
@@ -0,0 +1,156 @@
+import { desktopFetch } from "../lib/desktop";
+import type { OpenworkServerClient } from "../lib/openwork-server";
+import { isDesktopRuntime, safeStringify } from "../utils";
+import { parseBundlePayload } from "./schema";
+import type { BundleImportIntent, BundleRequest, BundleV1 } from "./types";
+import { extractBundleId, isConfiguredBundlePublisherUrl } from "./url-policy";
+
+function isSupportedDeepLinkProtocol(protocol: string): boolean {
+  const normalized = protocol.toLowerCase();
+  return normalized === "openwork:" || normalized === "openwork-dev:" || normalized === "https:" || normalized === "http:";
+}
+
+export function normalizeBundleImportIntent(value: string | null | undefined): BundleImportIntent {
+  const normalized = (value ?? "").trim().toLowerCase();
+  if (normalized === "new_worker" || normalized === "new-worker" || normalized === "newworker") {
+    return "new_worker";
+  }
+  return "import_current";
+}
+
+export function parseBundleDeepLink(rawUrl: string): BundleRequest | null {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  const protocol = url.protocol.toLowerCase();
+  if (!isSupportedDeepLinkProtocol(protocol)) {
+    return null;
+  }
+
+  const routeHost = url.hostname.toLowerCase();
+  const routePath = url.pathname.replace(/^\/+/, "").toLowerCase();
+  const routeSegments = routePath.split("/").filter(Boolean);
+  const routeTail = routeSegments[routeSegments.length - 1] ?? "";
+  const looksLikeImportRoute = routeHost === "import-bundle" || routePath === "import-bundle" || routeTail === "import-bundle";
+
+  const rawBundleUrl = url.searchParams.get("ow_bundle") ?? url.searchParams.get("bundleUrl") ?? "";
+  if (!looksLikeImportRoute && !rawBundleUrl.trim()) {
+    return null;
+  }
+
+  try {
+    if ((protocol === "https:" || protocol === "http:") && !rawBundleUrl.trim()) {
+      if (isConfiguredBundlePublisherUrl(url.toString())) {
+        return {
+          bundleUrl: url.toString(),
+          intent: normalizeBundleImportIntent(url.searchParams.get("ow_intent") ?? url.searchParams.get("intent")),
+          source: url.searchParams.get("ow_source")?.trim() ?? url.searchParams.get("source")?.trim() ?? undefined,
+          label: url.searchParams.get("ow_label")?.trim() ?? url.searchParams.get("label")?.trim() ?? undefined,
+        };
+      }
+    }
+
+    const parsedBundleUrl = new URL(rawBundleUrl.trim());
+    if (parsedBundleUrl.protocol !== "https:" && parsedBundleUrl.protocol !== "http:") {
+      return null;
+    }
+    return {
+      bundleUrl: parsedBundleUrl.toString(),
+      intent: normalizeBundleImportIntent(url.searchParams.get("ow_intent") ?? url.searchParams.get("intent")),
+      source: url.searchParams.get("ow_source")?.trim() ?? url.searchParams.get("source")?.trim() ?? undefined,
+      label: url.searchParams.get("ow_label")?.trim() ?? url.searchParams.get("label")?.trim() ?? undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function stripBundleQuery(rawUrl: string): string | null {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  let changed = false;
+  for (const key of ["ow_bundle", "bundleUrl", "ow_intent", "intent", "ow_source", "source", "ow_org", "ow_label"]) {
+    if (url.searchParams.has(key)) {
+      url.searchParams.delete(key);
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return null;
+  }
+
+  const search = url.searchParams.toString();
+  return `${url.pathname}${search ? `?${search}` : ""}${url.hash}`;
+}
+
+export async function fetchBundle(
+  bundleUrl: string,
+  serverClient?: OpenworkServerClient | null,
+  options?: { forceClientFetch?: boolean },
+): Promise<BundleV1> {
+  let targetUrl: URL;
+  try {
+    targetUrl = new URL(bundleUrl);
+  } catch {
+    throw new Error("Invalid bundle URL.");
+  }
+
+  if (targetUrl.protocol !== "https:" && targetUrl.protocol !== "http:") {
+    throw new Error("Bundle URL must use http(s).");
+  }
+
+  const bundleId = extractBundleId(targetUrl);
+  if (bundleId) {
+    targetUrl.pathname = `/b/${bundleId}/data`;
+    targetUrl.searchParams.delete("format");
+  }
+
+  if (!targetUrl.searchParams.has("format")) {
+    targetUrl.searchParams.set("format", "json");
+  }
+
+  if (serverClient && !options?.forceClientFetch) {
+    return parseBundlePayload(await serverClient.fetchBundle(targetUrl.toString()));
+  }
+
+  const controller = new AbortController();
+  const timeout = window.setTimeout(() => controller.abort(), 15_000);
+
+  try {
+    let response: Response;
+    try {
+        response = isDesktopRuntime()
+          ? await desktopFetch(targetUrl.toString(), {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: controller.signal,
+          })
+        : await fetch(targetUrl.toString(), {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: controller.signal,
+          });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      throw new Error(`Failed to load bundle from ${targetUrl.toString()}: ${message}`);
+    }
+    if (!response.ok) {
+      const details = (await response.text()).trim();
+      const suffix = details ? `: ${details}` : "";
+      throw new Error(`Failed to fetch bundle from ${targetUrl.toString()} (${response.status})${suffix}`);
+    }
+    return parseBundlePayload(await response.json());
+  } finally {
+    window.clearTimeout(timeout);
+  }
+}
diff --git a/apps/app/src/app/bundles/types.ts b/apps/app/src/app/bundles/types.ts
new file mode 100644
index 0000000000..ba25cff3f3
--- /dev/null
+++ b/apps/app/src/app/bundles/types.ts
@@ -0,0 +1,65 @@
+export type SkillBundleItem = {
+  name: string;
+  description?: string;
+  content: string;
+  trigger?: string;
+};
+
+export type SkillBundleV1 = {
+  schemaVersion: 1;
+  type: "skill";
+  name: string;
+  description?: string;
+  trigger?: string;
+  content: string;
+};
+
+export type SkillsSetBundleV1 = {
+  schemaVersion: 1;
+  type: "skills-set";
+  name: string;
+  description?: string;
+  skills: SkillBundleItem[];
+};
+
+export type BundleV1 = SkillBundleV1 | SkillsSetBundleV1;
+
+export type BundleImportIntent = "new_worker" | "import_current";
+
+export type BundleRequest = {
+  bundleUrl?: string | null;
+  intent: BundleImportIntent;
+  source?: string;
+  label?: string;
+};
+
+export type BundleImportTarget = {
+  workspaceId?: string | null;
+  localRoot?: string | null;
+  directoryHint?: string | null;
+};
+
+export type SkillDestinationRequest = {
+  request: BundleRequest;
+  bundle: SkillBundleV1;
+};
+
+export type BundleImportChoice = {
+  request: BundleRequest;
+  bundle: BundleV1;
+};
+
+export type BundleWorkerOption = {
+  id: string;
+  label: string;
+  detail: string;
+  badge: string;
+  current: boolean;
+  disabledReason?: string | null;
+};
+
+export type BundleImportSummary = {
+  title: string;
+  description: string;
+  items: string[];
+};
diff --git a/apps/app/src/app/bundles/url-policy.ts b/apps/app/src/app/bundles/url-policy.ts
new file mode 100644
index 0000000000..c40bd2bcbc
--- /dev/null
+++ b/apps/app/src/app/bundles/url-policy.ts
@@ -0,0 +1,49 @@
+import { DEFAULT_OPENWORK_PUBLISHER_BASE_URL } from "../lib/publisher";
+
+export type BundleUrlTrust = {
+  trusted: boolean;
+  bundleId: string | null;
+  actualOrigin: string | null;
+  configuredOrigin: string | null;
+};
+
+export function extractBundleId(url: URL): string | null {
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments[0] === "b" && segments[1] && (segments.length === 2 || (segments.length === 3 && segments[2] === "data"))) {
+    return segments[1];
+  }
+  return null;
+}
+
+export function resolveConfiguredBundlePublisherOrigin(baseUrl = DEFAULT_OPENWORK_PUBLISHER_BASE_URL): string | null {
+  try {
+    return new URL(baseUrl).origin;
+  } catch {
+    return null;
+  }
+}
+
+export function describeBundleUrlTrust(bundleUrl: string, baseUrl = DEFAULT_OPENWORK_PUBLISHER_BASE_URL): BundleUrlTrust {
+  const configuredOrigin = resolveConfiguredBundlePublisherOrigin(baseUrl);
+  try {
+    const url = new URL(bundleUrl);
+    const bundleId = extractBundleId(url);
+    return {
+      trusted: Boolean(configuredOrigin && url.origin === configuredOrigin && bundleId),
+      bundleId,
+      actualOrigin: url.origin,
+      configuredOrigin,
+    };
+  } catch {
+    return {
+      trusted: false,
+      bundleId: null,
+      actualOrigin: null,
+      configuredOrigin,
+    };
+  }
+}
+
+export function isConfiguredBundlePublisherUrl(bundleUrl: string, baseUrl = DEFAULT_OPENWORK_PUBLISHER_BASE_URL): boolean {
+  return describeBundleUrlTrust(bundleUrl, baseUrl).trusted;
+}
diff --git a/apps/app/src/app/cloud/desktop-app-restrictions.ts b/apps/app/src/app/cloud/desktop-app-restrictions.ts
new file mode 100644
index 0000000000..92f9bf5777
--- /dev/null
+++ b/apps/app/src/app/cloud/desktop-app-restrictions.ts
@@ -0,0 +1,79 @@
+import type { DesktopAppRestrictions } from "@openwork/types/den/desktop-app-restrictions";
+import type { DenDesktopConfig } from "../lib/den";
+import type { ModelRef } from "../types";
+
+export type DesktopAppRestrictionKey = keyof DesktopAppRestrictions;
+
+export type DesktopAppRestrictionChecker = (input: {
+  restriction: DesktopAppRestrictionKey;
+}) => boolean;
+
+export const DESKTOP_RESTRICTION_OPENCODE_PROVIDER_ID = "opencode";
+
+export function checkDesktopAppRestriction(input: {
+  config: DenDesktopConfig | null | undefined;
+  restriction: DesktopAppRestrictionKey;
+}) {
+  return input.config?.[input.restriction] === true;
+}
+
+export function isDesktopProviderBlocked(input: {
+  providerId: string;
+  checkRestriction: DesktopAppRestrictionChecker;
+}) {
+  const providerId = input.providerId.trim().toLowerCase();
+  if (!providerId) return false;
+
+  if (providerId === DESKTOP_RESTRICTION_OPENCODE_PROVIDER_ID) {
+    return input.checkRestriction({ restriction: "blockZenModel" });
+  }
+
+  return false;
+}
+
+export function isDesktopModelBlocked(input: {
+  model: ModelRef;
+  checkRestriction: DesktopAppRestrictionChecker;
+}) {
+  return isDesktopProviderBlocked({
+    providerId: input.model.providerID,
+    checkRestriction: input.checkRestriction,
+  });
+}
+
+type DesktopAppRestrictionSyncContext = {
+  checkRestriction: DesktopAppRestrictionChecker;
+  reconcileRestrictedModels?: () => void;
+  ensureProjectProviderDisabledState?: (providerId: string, disabled: boolean) => Promise<unknown>;
+  onError?: (error: Error, details: {
+    restriction: DesktopAppRestrictionKey;
+    action: string;
+    providerId?: string;
+  }) => void;
+};
+
+export async function runDesktopAppRestrictionSyncEffects(
+  input: DesktopAppRestrictionSyncContext,
+) {
+  const shouldDisableOpencodeProvider = input.checkRestriction({ restriction: "blockZenModel" });
+
+  input.reconcileRestrictedModels?.();
+
+  if (input.ensureProjectProviderDisabledState) {
+    try {
+      await input.ensureProjectProviderDisabledState(
+        DESKTOP_RESTRICTION_OPENCODE_PROVIDER_ID,
+        shouldDisableOpencodeProvider,
+      );
+    } catch (error) {
+      input.onError?.(
+        error instanceof Error ? error : new Error(String(error ?? "Desktop restriction effect failed.")),
+        {
+          restriction: "blockZenModel",
+          action: "ensureProjectProviderDisabledState",
+          providerId: DESKTOP_RESTRICTION_OPENCODE_PROVIDER_ID,
+        },
+      );
+    }
+  }
+}
diff --git a/apps/app/src/app/cloud/import-state.ts b/apps/app/src/app/cloud/import-state.ts
new file mode 100644
index 0000000000..aeccfa3ed4
--- /dev/null
+++ b/apps/app/src/app/cloud/import-state.ts
@@ -0,0 +1,208 @@
+export type CloudImportedSkillHub = {
+  hubId: string;
+  name: string;
+  skillNames: string[];
+  skillIds: string[];
+  importedAt: number | null;
+};
+
+export type CloudImportedSkill = {
+  cloudSkillId: string;
+  installedName: string;
+  title: string;
+  description: string | null;
+  shared: "org" | "public" | null;
+  updatedAt: string | null;
+  importedAt: number | null;
+};
+
+export type CloudImportedProvider = {
+  cloudProviderId: string;
+  providerId: string;
+  sourceProviderId: string;
+  name: string;
+  source: string | null;
+  updatedAt: string | null;
+  modelIds: string[];
+  importedAt: number | null;
+};
+
+export type CloudImportedPluginFile = {
+  configObjectId: string;
+  versionId: string | null;
+  objectType: string;
+  title: string;
+  path: string;
+  updatedAt: string | null;
+};
+
+export type CloudImportedPlugin = {
+  pluginId: string;
+  marketplaceId: string | null;
+  name: string;
+  description: string | null;
+  updatedAt: string | null;
+  files: CloudImportedPluginFile[];
+  importedAt: number | null;
+};
+
+export type WorkspaceCloudImports = {
+  skillHubs: Record<string, CloudImportedSkillHub>;
+  skills: Record<string, CloudImportedSkill>;
+  providers: Record<string, CloudImportedProvider>;
+  plugins: Record<string, CloudImportedPlugin>;
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  Boolean(value) && typeof value === "object" && !Array.isArray(value);
+
+const readStringArray = (value: unknown) =>
+  Array.isArray(value)
+    ? value.filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    : [];
+
+export function readWorkspaceCloudImports(value: unknown): WorkspaceCloudImports {
+  const root = isRecord(value) ? value : {};
+  const cloudImports = isRecord(root.cloudImports) ? root.cloudImports : {};
+  const rawSkillHubs = isRecord(cloudImports.skillHubs) ? cloudImports.skillHubs : {};
+  const rawSkills = isRecord(cloudImports.skills) ? cloudImports.skills : {};
+  const rawProviders = isRecord(cloudImports.providers) ? cloudImports.providers : {};
+  const rawPlugins = isRecord(cloudImports.plugins) ? cloudImports.plugins : {};
+
+  const skillHubs = Object.fromEntries(
+    Object.entries(rawSkillHubs)
+      .map(([key, entry]) => {
+        if (!isRecord(entry)) return null;
+        const hubId = typeof entry.hubId === "string" ? entry.hubId.trim() : key.trim();
+        const name = typeof entry.name === "string" ? entry.name.trim() : hubId;
+        if (!hubId || !name) return null;
+        const imported = {
+          hubId,
+          name,
+          skillNames: readStringArray(entry.skillNames),
+          skillIds: readStringArray(entry.skillIds),
+          importedAt: typeof entry.importedAt === "number" && Number.isFinite(entry.importedAt)
+            ? entry.importedAt
+            : null,
+        } satisfies CloudImportedSkillHub;
+        return [hubId, imported] as const;
+      })
+      .filter((entry): entry is readonly [string, CloudImportedSkillHub] => Boolean(entry)),
+  );
+
+  const providers = Object.fromEntries(
+    Object.entries(rawProviders)
+      .map(([key, entry]) => {
+        if (!isRecord(entry)) return null;
+        const cloudProviderId = typeof entry.cloudProviderId === "string"
+          ? entry.cloudProviderId.trim()
+          : key.trim();
+        const providerId = typeof entry.providerId === "string" ? entry.providerId.trim() : "";
+        const sourceProviderId = typeof entry.sourceProviderId === "string"
+          ? entry.sourceProviderId.trim()
+          : providerId;
+        const name = typeof entry.name === "string" ? entry.name.trim() : providerId || cloudProviderId;
+        if (!cloudProviderId || !providerId || !sourceProviderId || !name) return null;
+        const imported = {
+          cloudProviderId,
+          providerId,
+          sourceProviderId,
+          name,
+          source: typeof entry.source === "string" ? entry.source.trim() || null : null,
+          updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt.trim() || null : null,
+          modelIds: readStringArray(entry.modelIds),
+          importedAt: typeof entry.importedAt === "number" && Number.isFinite(entry.importedAt)
+            ? entry.importedAt
+            : null,
+        } satisfies CloudImportedProvider;
+        return [cloudProviderId, imported] as const;
+      })
+      .filter((entry): entry is readonly [string, CloudImportedProvider] => Boolean(entry)),
+  );
+
+  const skills = Object.fromEntries(
+    Object.entries(rawSkills)
+      .map(([key, entry]) => {
+        if (!isRecord(entry)) return null;
+        const cloudSkillId = typeof entry.cloudSkillId === "string"
+          ? entry.cloudSkillId.trim()
+          : key.trim();
+        const installedName = typeof entry.installedName === "string" ? entry.installedName.trim() : "";
+        const title = typeof entry.title === "string" ? entry.title.trim() : installedName || cloudSkillId;
+        if (!cloudSkillId || !installedName || !title) return null;
+        const imported = {
+          cloudSkillId,
+          installedName,
+          title,
+          description: typeof entry.description === "string" ? entry.description.trim() || null : null,
+          shared: entry.shared === "org" || entry.shared === "public" ? entry.shared : null,
+          updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt.trim() || null : null,
+          importedAt: typeof entry.importedAt === "number" && Number.isFinite(entry.importedAt)
+            ? entry.importedAt
+            : null,
+        } satisfies CloudImportedSkill;
+        return [cloudSkillId, imported] as const;
+      })
+      .filter((entry): entry is readonly [string, CloudImportedSkill] => Boolean(entry)),
+  );
+
+  const plugins = Object.fromEntries(
+    Object.entries(rawPlugins)
+      .map(([key, entry]) => {
+        if (!isRecord(entry)) return null;
+        const pluginId = typeof entry.pluginId === "string" ? entry.pluginId.trim() : key.trim();
+        const name = typeof entry.name === "string" ? entry.name.trim() : pluginId;
+        if (!pluginId || !name) return null;
+        const files = Array.isArray(entry.files)
+          ? entry.files
+              .map((file): CloudImportedPluginFile | null => {
+                if (!isRecord(file)) return null;
+                const configObjectId = typeof file.configObjectId === "string" ? file.configObjectId.trim() : "";
+                const objectType = typeof file.objectType === "string" ? file.objectType.trim() : "";
+                const title = typeof file.title === "string" ? file.title.trim() : configObjectId;
+                const path = typeof file.path === "string" ? file.path.trim() : "";
+                if (!configObjectId || !objectType || !title || !path) return null;
+                return {
+                  configObjectId,
+                  versionId: typeof file.versionId === "string" ? file.versionId.trim() || null : null,
+                  objectType,
+                  title,
+                  path,
+                  updatedAt: typeof file.updatedAt === "string" ? file.updatedAt.trim() || null : null,
+                };
+              })
+              .filter((file): file is CloudImportedPluginFile => file !== null)
+          : [];
+        const imported = {
+          pluginId,
+          marketplaceId: typeof entry.marketplaceId === "string" ? entry.marketplaceId.trim() || null : null,
+          name,
+          description: typeof entry.description === "string" ? entry.description.trim() || null : null,
+          updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt.trim() || null : null,
+          files,
+          importedAt: typeof entry.importedAt === "number" && Number.isFinite(entry.importedAt)
+            ? entry.importedAt
+            : null,
+        } satisfies CloudImportedPlugin;
+        return [pluginId, imported] as const;
+      })
+      .filter((entry): entry is readonly [string, CloudImportedPlugin] => Boolean(entry)),
+  );
+
+  return { skillHubs, skills, providers, plugins };
+}
+
+export function withWorkspaceCloudImports(
+  config: Record<string, unknown>,
+  cloudImports: WorkspaceCloudImports,
+) {
+  return {
+    ...config,
+    cloudImports: {
+      skillHubs: cloudImports.skillHubs,
+      skills: cloudImports.skills,
+      providers: cloudImports.providers,
+      plugins: cloudImports.plugins,
+    },
+  };
+}
diff --git a/apps/app/src/app/cloud/sync/constants.ts b/apps/app/src/app/cloud/sync/constants.ts
new file mode 100644
index 0000000000..30e73fb0fa
--- /dev/null
+++ b/apps/app/src/app/cloud/sync/constants.ts
@@ -0,0 +1 @@
+export const CLOUD_SYNC_INTERVAL_MS = 5 * 60 * 1000;
diff --git a/apps/app/src/app/constants.ts b/apps/app/src/app/constants.ts
new file mode 100644
index 0000000000..1af79fe204
--- /dev/null
+++ b/apps/app/src/app/constants.ts
@@ -0,0 +1,75 @@
+import type { ModelRef, SuggestedPlugin } from "./types";
+import { t } from "../i18n";
+
+export const MODEL_PREF_KEY = "openwork.defaultModel";
+export const SESSION_MODEL_PREF_KEY = "openwork.sessionModels";
+export const THINKING_PREF_KEY = "openwork.showThinking";
+export const VARIANT_PREF_KEY = "openwork.modelVariant";
+export const LANGUAGE_PREF_KEY = "openwork.language";
+export const HIDE_TITLEBAR_PREF_KEY = "openwork.hideTitlebar";
+
+export const DEFAULT_MODEL: ModelRef = {
+  providerID: "opencode",
+  modelID: "big-pickle",
+};
+
+export const SUGGESTED_PLUGINS: SuggestedPlugin[] = [];
+
+export type McpDirectoryInfo = {
+  id?: string;
+  name: string;
+  description: string;
+  url?: string;
+  type?: "remote" | "local";
+  command?: string[];
+  oauth: boolean;
+};
+
+export const CHROME_DEVTOOLS_MCP_ID = "chrome-devtools";
+export const CHROME_DEVTOOLS_MCP_COMMAND = ["npx", "-y", "chrome-devtools-mcp@latest"] as const;
+
+export const MCP_QUICK_CONNECT: McpDirectoryInfo[] = [
+  {
+    get name() { return t("mcp.quick_connect_notion_title"); },
+    get description() { return t("mcp.quick_connect_notion_desc"); },
+    url: "https://mcp.notion.com/mcp",
+    type: "remote",
+    oauth: true,
+  },
+  {
+    get name() { return t("mcp.quick_connect_linear_title"); },
+    get description() { return t("mcp.quick_connect_linear_desc"); },
+    url: "https://mcp.linear.app/mcp",
+    type: "remote",
+    oauth: true,
+  },
+  {
+    get name() { return t("mcp.quick_connect_sentry_title"); },
+    get description() { return t("mcp.quick_connect_sentry_desc"); },
+    url: "https://mcp.sentry.dev/mcp",
+    type: "remote",
+    oauth: true,
+  },
+  {
+    get name() { return t("mcp.quick_connect_stripe_title"); },
+    get description() { return t("mcp.quick_connect_stripe_desc"); },
+    url: "https://mcp.stripe.com",
+    type: "remote",
+    oauth: true,
+  },
+  {
+    get name() { return t("mcp.quick_connect_context7_title"); },
+    get description() { return t("mcp.quick_connect_context7_desc"); },
+    url: "https://mcp.context7.com/mcp",
+    type: "remote",
+    oauth: false,
+  },
+  {
+    id: CHROME_DEVTOOLS_MCP_ID,
+    get name() { return t("mcp.quick_connect_chrome_title"); },
+    get description() { return t("mcp.quick_connect_chrome_desc"); },
+    type: "local",
+    command: [...CHROME_DEVTOOLS_MCP_COMMAND],
+    oauth: false,
+  },
+];
diff --git a/apps/app/src/app/data/commands/browser-setup.md b/apps/app/src/app/data/commands/browser-setup.md
new file mode 100644
index 0000000000..4043a2ba84
--- /dev/null
+++ b/apps/app/src/app/data/commands/browser-setup.md
@@ -0,0 +1,14 @@
+---
+name: browser-setup
+description: Try Control Chrome first, then explain setup if Chrome MCP is unavailable
+---
+
+Try browser automation in OpenWork right away.
+
+IMPORTANT:
+- Prefer Chrome DevTools MCP / `chrome-devtools_*` tools first.
+- If those tools are available, use them in your first response to open `https://example.com` and tell the user the page title.
+- If those tools are not available, do not invent substitute tools and do not fall back to Playwright first.
+- Instead, tell the user the shortest exact steps to connect `Control Chrome` from OpenWork's MCP tab, then ask them to retry.
+
+Keep the response short and action-oriented.
diff --git a/apps/app/src/app/data/skill-creator.md b/apps/app/src/app/data/skill-creator.md
new file mode 100644
index 0000000000..dc83ab70bb
--- /dev/null
+++ b/apps/app/src/app/data/skill-creator.md
@@ -0,0 +1,78 @@
+---
+name: skill-creator
+description: Guide for creating effective skills. Use when users want to create or update a skill that extends OpenCode with specialized knowledge, workflows, or tool integrations.
+---
+
+# Skill Creator
+
+This skill is a template + checklist for creating skills in a workspace.
+
+## What is a skill?
+
+A skill is a folder under `.opencode/skills/<skill-name>/` or `.claude/skills/<skill-name>/` anchored by `SKILL.md`.
+
+## OpenWork behavior
+
+- In OpenWork, prefer creating the skill at `.opencode/skills/<skill-name>/SKILL.md`.
+- Use a file mutation tool (`write`, `edit`, or `apply_patch`) on the real skill path instead of pasting the whole skill into chat.
+- Writing the skill file lets OpenWork show the reload banner above the conversation so the user can activate the new skill immediately.
+
+## Design goals
+
+- Portable: safe to copy between machines
+- Reconstructable: can recreate any required local state
+- Self-building: can bootstrap its own config/state
+- Credential-safe: no secrets committed; graceful first-time setup
+
+## Recommended structure
+
+```
+.opencode/
+  skills/
+    my-skill/
+      SKILL.md
+      README.md
+      templates/
+      scripts/
+```
+
+## Trigger phrases (critical)
+
+The description field is how Claude decides when to use your skill.
+Include 2-3 specific phrases that should trigger it.
+
+Bad example:
+"Use when working with content"
+
+Good examples:
+"Use when user mentions 'content pipeline', 'add to content database', or 'schedule a post'"
+"Triggers on: 'rotate PDF', 'flip PDF pages', 'change PDF orientation'"
+
+Quick validation:
+- Contains at least one quoted phrase
+- Uses "when" or "triggers"
+- Longer than ~50 characters
+
+## Frontmatter template
+
+```yaml
+---
+name: my-skill
+description: |
+  [What it does in one sentence]
+
+  Triggers when user mentions:
+  - "[specific phrase 1]"
+  - "[specific phrase 2]"
+  - "[specific phrase 3]"
+---
+```
+
+## Authoring checklist
+
+1. Start with a clear purpose statement: when to use it + what it outputs.
+2. Specify inputs/outputs and any required permissions.
+3. Include “Setup” steps if the skill needs local tooling.
+4. Add examples: at least 2 realistic user prompts.
+5. Keep it safe: avoid destructive defaults; ask for confirmation.
+6. In OpenWork, finish by writing the final `SKILL.md` file to `.opencode/skills/<skill-name>/SKILL.md` so the reload banner can appear.
diff --git a/apps/app/src/app/index.css b/apps/app/src/app/index.css
new file mode 100644
index 0000000000..d0612070d5
--- /dev/null
+++ b/apps/app/src/app/index.css
@@ -0,0 +1,459 @@
+@import "tailwindcss";
+@config "../../tailwind.config.ts";
+
+@import "../styles/colors.css";
+
+@import "tw-animate-css";
+
+@import "shadcn/tailwind.css";
+
+@import "@fontsource-variable/geist";
+
+@import "@fontsource-variable/ibm-plex-sans";
+
+@custom-variant dark (&:is(.dark, .dark *, [data-theme="dark"], [data-theme="dark"] *));
+
+:root {
+  color-scheme: light;
+  --dls-surface: var(--slate-1);
+  --dls-sidebar: var(--slate-2);
+  --dls-app-bg: var(--slate-1);
+  --dls-background: var(--slate-1);
+  --dls-canvas: var(--slate-2);
+  --dls-surface-muted: var(--slate-3);
+  --dls-border: #f3f4f6;
+  --dls-accent: var(--blue-9);
+  --dls-accent-hover: var(--blue-10);
+  --dls-accent-rgb: 0 144 255;
+  --dls-secondary-rgb: 96 100 108;
+  --dls-text-primary: var(--slate-12);
+  --dls-text-secondary: var(--slate-11);
+  --dls-hover: var(--slate-3);
+  --dls-active: var(--slate-5);
+  --dls-radius: 16px;
+  --dls-radius-lg: 24px;
+  --dls-shell-shadow: 0 10px 30px rgba(15, 23, 42, 0.06);
+  --dls-card-shadow: 0 8px 24px rgba(15, 23, 42, 0.05);
+  --background: var(--slate-1);
+  --foreground: var(--slate-12);
+  --card: var(--slate-1);
+  --card-foreground: var(--slate-12);
+  --popover: var(--slate-1);
+  --popover-foreground: var(--slate-12);
+  --primary-foreground: white;
+  --secondary: var(--slate-3);
+  --secondary-foreground: var(--slate-12);
+  --muted: var(--slate-3);
+  --muted-foreground: var(--slate-11);
+  --accent: var(--slate-3);
+  --accent-foreground: var(--slate-12);
+  --destructive: var(--red-9);
+  --border: var(--slate-5);
+  --input: var(--slate-6);
+  --ring: var(--slate-8);
+  --chart-1: var(--sky-9);
+  --chart-2: var(--blue-9);
+  --chart-3: var(--indigo-9);
+  --chart-4: var(--violet-9);
+  --chart-5: var(--purple-9);
+  --radius: 0.45rem;
+  --sidebar: var(--slate-2);
+  --sidebar-foreground: var(--slate-12);
+  --sidebar-primary: var(--blue-9);
+  --sidebar-primary-foreground: white;
+  --sidebar-accent: var(--slate-3);
+  --sidebar-accent-foreground: var(--slate-12);
+  --sidebar-border: var(--slate-6);
+  --sidebar-ring: var(--slate-8);
+}
+
+[data-theme="dark"] {
+  color-scheme: dark;
+  --dls-surface: var(--slate-1);
+  --dls-sidebar: var(--slate-2);
+  --dls-app-bg: var(--slate-1);
+  --dls-background: var(--slate-1);
+  --dls-canvas: var(--slate-2);
+  --dls-surface-muted: var(--slate-3);
+  --dls-border: #262626;
+  --dls-accent: var(--blue-9);
+  --dls-accent-hover: var(--blue-10);
+  --dls-accent-rgb: 59 142 247;
+  --dls-secondary-rgb: 176 180 186;
+  --dls-text-primary: var(--slate-12);
+  --dls-text-secondary: var(--slate-11);
+  --dls-hover: var(--slate-3);
+  --dls-active: var(--slate-5);
+  --dls-shell-shadow: 0 18px 48px rgba(0, 0, 0, 0.32);
+  --dls-card-shadow: 0 14px 36px rgba(0, 0, 0, 0.24);
+}
+
+html,
+body {
+  height: 100%;
+  overflow: hidden;
+}
+
+#root {
+  height: 100%;
+  overflow: hidden;
+}
+
+html {
+  font-size: var(--openwork-font-size, 16px);
+}
+
+body {
+  margin: 0;
+  font-family:
+    "IBM Plex Sans",
+    Geist,
+    "Avenir Next",
+    Inter,
+    ui-sans-serif,
+    system-ui,
+    -apple-system,
+    BlinkMacSystemFont,
+    "Segoe UI",
+    Roboto,
+    "Helvetica Neue",
+    Arial,
+    "Noto Sans",
+    "Apple Color Emoji",
+    "Segoe UI Emoji";
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: var(--dls-text-primary);
+  background-color: var(--dls-surface);
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+.ow-soft-shell {
+  border: 1px solid var(--dls-border);
+  background: var(--dls-surface);
+  border-radius: 2rem;
+  box-shadow: var(--dls-shell-shadow);
+}
+
+.ow-soft-card {
+  border: 1px solid var(--dls-border);
+  background: var(--dls-surface);
+  border-radius: 1.5rem;
+  box-shadow: var(--dls-card-shadow);
+}
+
+.ow-soft-card-quiet {
+  border: 1px solid var(--dls-border);
+  background: var(--dls-sidebar);
+  border-radius: 1.5rem;
+}
+
+.ow-button-primary {
+  display: inline-flex;
+  min-height: 48px;
+  align-items: center;
+  justify-content: center;
+  border-radius: 9999px;
+  background: var(--dls-accent);
+  color: white;
+  box-shadow: 0 8px 20px -16px rgba(var(--dls-accent-rgb), 0.45);
+}
+
+.ow-button-primary:hover:not(:disabled) {
+  background: var(--dls-accent-hover);
+}
+
+.ow-button-secondary {
+  display: inline-flex;
+  min-height: 48px;
+  align-items: center;
+  justify-content: center;
+  border-radius: 9999px;
+  border: 1px solid var(--dls-border);
+  background: var(--dls-surface);
+  color: var(--dls-text-primary);
+  box-shadow: var(--dls-card-shadow);
+}
+
+.ow-button-secondary:hover:not(:disabled) {
+  background: var(--dls-hover);
+}
+
+.ow-button-primary,
+.ow-button-secondary {
+  padding: 0.75rem 1.25rem;
+  font-size: 13px;
+  font-weight: 500;
+  transition: background-color 150ms ease, color 150ms ease, transform 150ms ease, opacity 150ms ease;
+}
+
+.ow-button-primary:active:not(:disabled),
+.ow-button-secondary:active:not(:disabled) {
+  transform: scale(0.99);
+}
+
+.ow-button-primary:disabled,
+.ow-button-secondary:disabled {
+  opacity: 0.5;
+}
+
+.ow-status-pill {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 9999px;
+  padding: 0.25rem 0.625rem;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+}
+
+.ow-status-pill-positive {
+  border: 1px solid var(--green-a6);
+  background: var(--green-3);
+  color: var(--green-11);
+}
+
+.ow-status-pill-warning {
+  border: 1px solid var(--amber-a6);
+  background: var(--amber-3);
+  color: var(--amber-11);
+}
+
+.ow-status-pill-neutral {
+  border: 1px solid var(--slate-6);
+  background: var(--slate-2);
+  color: var(--slate-11);
+}
+
+.ow-icon-tile {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 0.85rem;
+  background: var(--slate-3);
+  color: var(--slate-12);
+}
+
+.ow-icon-tile-muted {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 0.85rem;
+  background: var(--slate-3);
+  color: var(--slate-11);
+}
+
+.ow-input {
+  appearance: none;
+  width: 100%;
+  border: 0;
+  border-radius: 0.9rem;
+  background: var(--slate-1);
+  box-shadow: inset 0 0 0 1px var(--slate-6);
+  color: var(--dls-text-primary);
+}
+
+.ow-input::placeholder {
+  color: var(--slate-11);
+}
+
+.ow-input:focus {
+  outline: none;
+  box-shadow: inset 0 0 0 1px rgba(var(--dls-accent-rgb), 0.28), 0 0 0 3px rgba(var(--dls-accent-rgb), 0.08);
+}
+
+/* Global clickable elements pointer */
+button,
+[role="button"],
+a,
+input[type="submit"],
+input[type="button"],
+input[type="checkbox"],
+input[type="radio"],
+select {
+  cursor: pointer;
+}
+
+button:disabled,
+[role="button"][aria-disabled="true"],
+input:disabled,
+select:disabled {
+  cursor: not-allowed;
+}
+
+@utility animate-spin-slow {
+  animation: spin 3s linear infinite;
+}
+
+@keyframes soft-pulse {
+  0%,
+  100% {
+    transform: scale(1);
+    opacity: 0.4;
+  }
+  50% {
+    transform: scale(1.15);
+    opacity: 1;
+  }
+}
+
+@utility animate-soft-pulse {
+  animation: soft-pulse 1.5s cubic-bezier(0.4, 0, 0.6, 1) infinite;
+}
+
+/* Highlight animation for just-saved command */
+@keyframes command-highlight {
+  0% {
+    box-shadow: 0 0 0 0 var(--indigo-a9);
+    border-color: var(--indigo-a9);
+  }
+  50% {
+    box-shadow: 0 0 0 8px var(--indigo-a1);
+    border-color: var(--indigo-a7);
+  }
+  100% {
+    box-shadow: 0 0 0 0 var(--indigo-a1);
+    border-color: var(--slate-a3);
+  }
+}
+
+.command-just-saved {
+  animation: command-highlight 2s ease-out;
+  border-color: var(--indigo-a9);
+}
+
+@keyframes progress-shimmer {
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(200%);
+  }
+}
+
+@utility animate-progress-shimmer {
+  animation: progress-shimmer 2s infinite linear;
+}
+
+/* Quiet, small dot ticker (`:: :: ::`). Each dot pulses briefly in sequence,
+   illuminating left-to-right like a subtle running light. Used for boot,
+   "awaiting first token", and any idle-but-alive hint. */
+@keyframes ow-dot-ticker {
+  0% {
+    background-color: rgba(var(--dls-secondary-rgb, 120, 120, 120), 0.22);
+    box-shadow: 0 0 0 rgba(var(--dls-accent-rgb), 0);
+  }
+  20% {
+    background-color: rgba(var(--dls-accent-rgb), 0.95);
+    box-shadow: 0 0 8px rgba(var(--dls-accent-rgb), 0.45);
+  }
+  55%,
+  100% {
+    background-color: rgba(var(--dls-secondary-rgb, 120, 120, 120), 0.22);
+    box-shadow: 0 0 0 rgba(var(--dls-accent-rgb), 0);
+  }
+}
+
+.ow-dot-ticker {
+  animation: ow-dot-ticker 1.4s cubic-bezier(0.4, 0, 0.2, 1) infinite;
+  background-color: rgba(var(--dls-secondary-rgb, 120, 120, 120), 0.22);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .ow-dot-ticker {
+    animation: none;
+    background-color: rgba(var(--dls-accent-rgb), 0.6);
+  }
+}
+
+.dark,
+[data-theme="dark"] {
+  --background: var(--slate-1);
+  --foreground: var(--slate-12);
+  --card: var(--slate-2);
+  --card-foreground: var(--slate-12);
+  --popover: var(--slate-2);
+  --popover-foreground: var(--slate-12);
+  --primary-foreground: var(--slate-12);
+  --secondary: var(--slate-3);
+  --secondary-foreground: var(--slate-12);
+  --muted: var(--slate-3);
+  --muted-foreground: var(--slate-10);
+  --accent: var(--slate-3);
+  --accent-foreground: var(--slate-12);
+  --destructive: var(--red-9);
+  --border: var(--slate-3);
+  --input: var(--slate-6);
+  --ring: var(--slate-8);
+  --chart-1: var(--sky-9);
+  --chart-2: var(--blue-9);
+  --chart-3: var(--indigo-9);
+  --chart-4: var(--violet-9);
+  --chart-5: var(--purple-9);
+  --sidebar: var(--slate-2);
+  --sidebar-foreground: var(--slate-12);
+  --sidebar-primary: var(--blue-9);
+  --sidebar-primary-foreground: var(--slate-12);
+  --sidebar-accent: var(--slate-3);
+  --sidebar-accent-foreground: var(--slate-12);
+  --sidebar-border: var(--slate-6);
+  --sidebar-ring: var(--slate-8);
+}
+
+@theme inline {
+  --font-sans: 'Geist Variable', sans-serif;
+  --font-heading: 'IBM Plex Sans Variable', sans-serif;
+  --color-sidebar-ring: var(--sidebar-ring);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar: var(--sidebar);
+  --color-chart-5: var(--chart-5);
+  --color-chart-4: var(--chart-4);
+  --color-chart-3: var(--chart-3);
+  --color-chart-2: var(--chart-2);
+  --color-chart-1: var(--chart-1);
+  --color-ring: var(--ring);
+  --color-input: var(--input);
+  --color-border: var(--border);
+  --color-destructive: var(--destructive);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-accent: var(--accent);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-muted: var(--muted);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-secondary: var(--secondary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-primary: var(--dls-accent);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-popover: var(--popover);
+  --color-card-foreground: var(--card-foreground);
+  --color-card: var(--card);
+  --color-foreground: var(--foreground);
+  --color-background: var(--background);
+  --radius-sm: calc(var(--radius) * 0.6);
+  --radius-md: calc(var(--radius) * 0.8);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) * 1.4);
+  --radius-2xl: calc(var(--radius) * 1.8);
+  --radius-3xl: calc(var(--radius) * 2.2);
+  --radius-4xl: calc(var(--radius) * 2.6);
+}
+
+@layer base {
+  * {
+    @apply border-border outline-ring/50;
+  }
+  body {
+    @apply bg-background text-foreground;
+  }
+  html {
+    @apply font-sans;
+  }
+}
diff --git a/apps/app/src/app/lib/deep-link-bridge.ts b/apps/app/src/app/lib/deep-link-bridge.ts
new file mode 100644
index 0000000000..a0b716dcf4
--- /dev/null
+++ b/apps/app/src/app/lib/deep-link-bridge.ts
@@ -0,0 +1,43 @@
+export const deepLinkBridgeEvent = "openwork:deep-link";
+export const nativeDeepLinkEvent = "openwork:deep-link-native";
+
+export type DeepLinkBridgeDetail = {
+  urls: string[];
+};
+
+declare global {
+  interface Window {
+    __OPENWORK__?: {
+      deepLinks?: string[];
+    };
+  }
+}
+
+function normalizeDeepLinks(urls: readonly string[]): string[] {
+  return urls.map((url) => url.trim()).filter(Boolean);
+}
+
+export function pushPendingDeepLinks(target: Window, urls: readonly string[]): string[] {
+  const normalized = normalizeDeepLinks(urls);
+  if (normalized.length === 0) {
+    return [];
+  }
+
+  target.__OPENWORK__ ??= {};
+  const pending = target.__OPENWORK__.deepLinks ?? [];
+  target.__OPENWORK__.deepLinks = [...pending, ...normalized];
+  target.dispatchEvent(
+    new CustomEvent<DeepLinkBridgeDetail>(deepLinkBridgeEvent, {
+      detail: { urls: normalized },
+    }),
+  );
+  return normalized;
+}
+
+export function drainPendingDeepLinks(target: Window): string[] {
+  const pending = target.__OPENWORK__?.deepLinks ?? [];
+  if (target.__OPENWORK__) {
+    target.__OPENWORK__.deepLinks = [];
+  }
+  return [...pending];
+}
diff --git a/apps/app/src/app/lib/den-session-events.ts b/apps/app/src/app/lib/den-session-events.ts
new file mode 100644
index 0000000000..131841fac0
--- /dev/null
+++ b/apps/app/src/app/lib/den-session-events.ts
@@ -0,0 +1,41 @@
+import type { DenSettings, DenUser } from "./den";
+
+export const denSessionUpdatedEvent = "openwork-den-session-updated";
+export const denSettingsChangedEvent = "openwork-den-settings-changed";
+
+export type DenSessionUpdatedDetail = {
+  status?: "success" | "error";
+  baseUrl?: string | null;
+  token?: string | null;
+  user?: DenUser | null;
+  email?: string | null;
+  message?: string | null;
+};
+
+export function dispatchDenSessionUpdated(detail: DenSessionUpdatedDetail) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.dispatchEvent(
+    new CustomEvent<DenSessionUpdatedDetail>(denSessionUpdatedEvent, {
+      detail,
+    }),
+  );
+}
+
+export type DenSettingsChangedDetail = {
+  settings: DenSettings;
+};
+
+export function dispatchDenSettingsChanged(detail: DenSettingsChangedDetail) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.dispatchEvent(
+    new CustomEvent<DenSettingsChangedDetail>(denSettingsChangedEvent, {
+      detail,
+    }),
+  );
+}
diff --git a/apps/app/src/app/lib/den.ts b/apps/app/src/app/lib/den.ts
new file mode 100644
index 0000000000..db15c87abe
--- /dev/null
+++ b/apps/app/src/app/lib/den.ts
@@ -0,0 +1,1524 @@
+import {
+  normalizeDesktopConfig,
+  type DesktopConfig as SharedDesktopConfig,
+} from "@openwork/types/den/desktop-app-restrictions";
+
+// Re-export the shared schema under the local alias so React consumers
+// (e.g. the cloud domain's desktop-config provider) can import it alongside
+// the helpers they need. Solid references it internally only; the React
+// port wants it as part of the public surface of this module.
+export type { SharedDesktopConfig };
+export { normalizeDesktopConfig };
+
+import { isDesktopDeployment } from "./openwork-deployment";
+import {
+  dispatchDenSettingsChanged,
+} from "./den-session-events";
+import {
+  desktopFetch,
+  getDesktopBootstrapConfig as getDesktopBootstrapConfigFromShell,
+  setDesktopBootstrapConfig as setDesktopBootstrapConfigInShell,
+  type DesktopBootstrapConfig as ShellDesktopBootstrapConfig,
+} from "./desktop";
+import { isDesktopRuntime } from "../utils";
+import type { DenOrgSkillCard } from "../types";
+
+const STORAGE_BASE_URL = "openwork.den.baseUrl";
+const STORAGE_API_BASE_URL = "openwork.den.apiBaseUrl";
+const STORAGE_AUTH_TOKEN = "openwork.den.authToken";
+const STORAGE_ACTIVE_ORG_ID = "openwork.den.activeOrgId";
+const STORAGE_ACTIVE_ORG_SLUG = "openwork.den.activeOrgSlug";
+const STORAGE_ACTIVE_ORG_NAME = "openwork.den.activeOrgName";
+const DEFAULT_DEN_TIMEOUT_MS = 12_000;
+
+export const DEFAULT_DEN_AUTH_NAME = "OpenWork User";
+const BUILD_DEN_BASE_URL =
+  (typeof import.meta !== "undefined" && typeof import.meta.env?.VITE_DEN_BASE_URL === "string"
+    ? import.meta.env.VITE_DEN_BASE_URL
+    : "").trim() || "https://app.openworklabs.com";
+const BUILD_DEN_API_BASE_URL =
+  (typeof import.meta !== "undefined" && typeof import.meta.env?.VITE_DEN_API_BASE_URL === "string"
+    ? import.meta.env.VITE_DEN_API_BASE_URL
+    : "").trim() || undefined;
+const BUILD_DEN_REQUIRE_SIGNIN =
+  (typeof import.meta !== "undefined" && typeof import.meta.env?.VITE_DEN_REQUIRE_SIGNIN === "string"
+    ? /^(1|true|yes|on)$/i.test(import.meta.env.VITE_DEN_REQUIRE_SIGNIN.trim())
+    : false);
+
+export const DEFAULT_DEN_BASE_URL = BUILD_DEN_BASE_URL;
+
+export type DenSettings = {
+  baseUrl: string;
+  apiBaseUrl?: string;
+  authToken?: string | null;
+  activeOrgId?: string | null;
+  activeOrgSlug?: string | null;
+  activeOrgName?: string | null;
+};
+
+type DenBaseUrls = {
+  baseUrl: string;
+  apiBaseUrl: string;
+};
+
+export type DenBootstrapConfig = DenBaseUrls & {
+  requireSignin: boolean;
+};
+
+export type DenDesktopConfig = SharedDesktopConfig;
+
+export type DenUser = {
+  id: string;
+  email: string;
+  name: string | null;
+};
+
+export type DenOrgSummary = {
+  id: string;
+  name: string;
+  slug: string;
+  role: "owner" | "admin" | "member";
+};
+
+export type DenWorkerSummary = {
+  workerId: string;
+  workerName: string;
+  status: string;
+  instanceUrl: string | null;
+  provider: string | null;
+  isMine: boolean;
+  createdAt: string | null;
+};
+
+export type DenWorkerTokens = {
+  clientToken: string | null;
+  ownerToken: string | null;
+  hostToken: string | null;
+  openworkUrl: string | null;
+  workspaceId: string | null;
+};
+
+export type DenOrgLlmProviderModel = {
+  id: string;
+  name: string;
+  config: Record<string, unknown>;
+  createdAt: string | null;
+};
+
+export type DenOrgLlmProvider = {
+  id: string;
+  source: "models_dev" | "custom";
+  providerId: string;
+  name: string;
+  providerConfig: Record<string, unknown>;
+  hasApiKey: boolean;
+  models: DenOrgLlmProviderModel[];
+  createdAt: string | null;
+  updatedAt: string | null;
+};
+
+export type DenOrgLlmProviderConnection = DenOrgLlmProvider & {
+  apiKey: string | null;
+};
+
+export type DenPluginConfigObjectType = "skill" | "agent" | "command" | "tool" | "mcp" | "hook" | "context" | "custom";
+
+export type DenPluginConfigObjectVersion = {
+  id: string;
+  rawSourceText: string | null;
+  normalizedPayloadJson: Record<string, unknown> | null;
+  sourceRevisionRef: string | null;
+  createdAt: string | null;
+};
+
+export type DenPluginConfigObject = {
+  id: string;
+  objectType: DenPluginConfigObjectType;
+  title: string;
+  description: string | null;
+  currentFileName: string | null;
+  currentFileExtension: string | null;
+  currentRelativePath: string | null;
+  status: string;
+  updatedAt: string | null;
+  latestVersion: DenPluginConfigObjectVersion | null;
+};
+
+export type DenPluginMembership = {
+  id: string;
+  pluginId: string;
+  configObjectId: string;
+  configObject?: DenPluginConfigObject;
+};
+
+export type DenOrgPlugin = {
+  id: string;
+  name: string;
+  description: string | null;
+  status: string;
+  memberCount: number;
+  updatedAt: string | null;
+  componentCounts: Record<string, number>;
+};
+
+export type DenOrgMarketplace = {
+  id: string;
+  name: string;
+  description: string | null;
+  status: string;
+  pluginCount: number;
+  updatedAt: string | null;
+};
+
+export type DenOrgMarketplaceResolved = {
+  marketplace: DenOrgMarketplace;
+  plugins: DenOrgPlugin[];
+};
+
+export type DenOrgPluginResolved = {
+  plugin: DenOrgPlugin;
+  memberships: DenPluginMembership[];
+};
+
+export type DenBillingPrice = {
+  amount: number | null;
+  currency: string | null;
+  recurringInterval: string | null;
+  recurringIntervalCount: number | null;
+};
+
+export type DenBillingSubscription = {
+  id: string;
+  status: string;
+  amount: number | null;
+  currency: string | null;
+  recurringInterval: string | null;
+  recurringIntervalCount: number | null;
+  currentPeriodStart: string | null;
+  currentPeriodEnd: string | null;
+  cancelAtPeriodEnd: boolean;
+  canceledAt: string | null;
+  endedAt: string | null;
+};
+
+export type DenBillingInvoice = {
+  id: string;
+  createdAt: string | null;
+  status: string;
+  totalAmount: number | null;
+  currency: string | null;
+  invoiceNumber: string | null;
+  invoiceUrl: string | null;
+};
+
+export type DenBillingSummary = {
+  featureGateEnabled: boolean;
+  hasActivePlan: boolean;
+  checkoutRequired: boolean;
+  checkoutUrl: string | null;
+  portalUrl: string | null;
+  price: DenBillingPrice | null;
+  subscription: DenBillingSubscription | null;
+  invoices: DenBillingInvoice[];
+  productId: string | null;
+  benefitId: string | null;
+};
+
+type DenAuthResult = {
+  user: DenUser | null;
+  token: string | null;
+};
+
+export type DenDesktopHandoffExchange = {
+  user: DenUser | null;
+  token: string | null;
+};
+
+const defaultBootstrapBaseUrls = resolveDenBaseUrls({
+  baseUrl: BUILD_DEN_BASE_URL,
+  apiBaseUrl: BUILD_DEN_API_BASE_URL,
+});
+
+let desktopBootstrapConfig: DenBootstrapConfig = {
+  ...defaultBootstrapBaseUrls,
+  requireSignin: BUILD_DEN_REQUIRE_SIGNIN,
+};
+
+export type DenAppVersionMetadata = {
+  minAppVersion: string;
+  latestAppVersion: string;
+};
+
+type RawJsonResponse<T> = {
+  ok: boolean;
+  status: number;
+  json: T | null;
+};
+
+export class DenApiError extends Error {
+  status: number;
+  code: string;
+  details?: unknown;
+
+  constructor(status: number, code: string, message: string, details?: unknown) {
+    super(message);
+    this.name = "DenApiError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function getDenAppVersionMetadata(payload: unknown): DenAppVersionMetadata | null {
+  if (!isRecord(payload)) return null;
+
+  const latestAppVersion =
+    typeof payload.latestAppVersion === "string" ? payload.latestAppVersion.trim() : "";
+  if (!latestAppVersion) return null;
+
+  return {
+    minAppVersion:
+      typeof payload.minAppVersion === "string" ? payload.minAppVersion.trim() : "",
+    latestAppVersion,
+  };
+}
+
+export function normalizeDenDesktopConfig(payload: unknown): DenDesktopConfig {
+  return normalizeDesktopConfig(payload);
+}
+
+export function normalizeDenBaseUrl(input: string | null | undefined): string | null {
+  const value = (input ?? "").trim();
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return null;
+    }
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+function isWebAppHost(hostname: string): boolean {
+  const normalized = hostname.trim().toLowerCase();
+
+  if (
+    normalized === "localhost" ||
+    normalized === "0.0.0.0" ||
+    normalized === "::1" ||
+    normalized === "[::1]" ||
+    /^127(?:\.\d{1,3}){3}$/.test(normalized)
+  ) {
+    return true;
+  }
+
+  const ipv4Match = normalized.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (ipv4Match) {
+    const [first, second, third, fourth] = ipv4Match.slice(1).map(Number);
+    const octets = [first, second, third, fourth];
+    if (octets.every((octet) => Number.isInteger(octet) && octet >= 0 && octet <= 255)) {
+      if (
+        first === 10 ||
+        first === 127 ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168) ||
+        (first === 169 && second === 254) ||
+        (first === 100 && second >= 64 && second <= 127)
+      ) {
+        return true;
+      }
+    }
+  }
+
+  return normalized === "app.openworklabs.com" || normalized === "app.openwork.software" || normalized.startsWith("app.");
+}
+
+function stripDenApiBasePath(input: string | null | undefined): string | null {
+  const normalized = normalizeDenBaseUrl(input);
+  if (!normalized) return null;
+
+  try {
+    const url = new URL(normalized);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    const suffix = "/api/den";
+    if (!pathname.toLowerCase().endsWith(suffix)) {
+      return normalized;
+    }
+
+    const nextPathname = pathname.slice(0, -suffix.length) || "/";
+    url.pathname = nextPathname;
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return normalized;
+  }
+}
+
+function ensureDenApiBasePath(input: string | null | undefined): string | null {
+  const normalized = normalizeDenBaseUrl(input);
+  if (!normalized) return null;
+
+  try {
+    const url = new URL(normalized);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (pathname.toLowerCase().endsWith("/api/den")) {
+      return normalized;
+    }
+    url.pathname = `${pathname}/api/den`.replace(/\/+/g, "/");
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return normalized;
+  }
+}
+
+function deriveDenApiBaseUrl(input: string | null | undefined): string {
+  const normalized = normalizeDenBaseUrl(input) ?? DEFAULT_DEN_BASE_URL;
+
+  try {
+    const url = new URL(normalized);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (pathname.toLowerCase().endsWith("/api/den")) {
+      return normalized;
+    }
+    if (isWebAppHost(url.hostname)) {
+      return ensureDenApiBasePath(normalized) ?? normalized;
+    }
+  } catch {
+    return normalized;
+  }
+
+  return normalized;
+}
+
+export function resolveDenBaseUrls(input: { baseUrl?: string | null; apiBaseUrl?: string | null } | string | null | undefined): DenBaseUrls {
+  const rawBaseUrl = typeof input === "string" ? input : input?.baseUrl;
+  const rawApiBaseUrl = typeof input === "string" ? null : input?.apiBaseUrl;
+  const normalizedBaseUrl = normalizeDenBaseUrl(rawBaseUrl);
+  const normalizedApiBaseUrl = normalizeDenBaseUrl(rawApiBaseUrl);
+  const seedUrl = normalizedBaseUrl ?? normalizedApiBaseUrl ?? DEFAULT_DEN_BASE_URL;
+
+  return {
+    baseUrl: stripDenApiBasePath(normalizedBaseUrl ?? seedUrl) ?? DEFAULT_DEN_BASE_URL,
+    apiBaseUrl: normalizedApiBaseUrl ?? deriveDenApiBaseUrl(seedUrl),
+  };
+}
+
+function resolveDenBootstrapConfig(
+  input: { baseUrl: string; apiBaseUrl?: string | null; requireSignin?: boolean | null },
+): DenBootstrapConfig {
+  return {
+    ...resolveDenBaseUrls(input),
+    requireSignin: input.requireSignin === true,
+  };
+}
+
+function syncBootstrapSettingsToLocalStorage(config: DenBootstrapConfig) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.setItem(STORAGE_BASE_URL, config.baseUrl);
+  window.localStorage.setItem(STORAGE_API_BASE_URL, config.apiBaseUrl);
+}
+
+function getPendingBootstrapConfig(next: DenSettings): DenBootstrapConfig | null {
+  if (next.baseUrl === undefined && next.apiBaseUrl === undefined) {
+    return null;
+  }
+
+  const previous = readDenBootstrapConfig();
+  return resolveDenBootstrapConfig({
+    baseUrl: next.baseUrl ?? previous.baseUrl,
+    apiBaseUrl: next.apiBaseUrl ?? previous.apiBaseUrl,
+    requireSignin: previous.requireSignin,
+  });
+}
+
+function applyDesktopBootstrapConfig(config: DenBootstrapConfig) {
+  desktopBootstrapConfig = config;
+  syncBootstrapSettingsToLocalStorage(config);
+}
+
+export function readDenBootstrapConfig(): DenBootstrapConfig {
+  return desktopBootstrapConfig;
+}
+
+export async function initializeDenBootstrapConfig(): Promise<DenBootstrapConfig> {
+  if (!isDesktopRuntime()) {
+    desktopBootstrapConfig = resolveDenBootstrapConfig({
+      baseUrl: BUILD_DEN_BASE_URL,
+      apiBaseUrl: BUILD_DEN_API_BASE_URL,
+      requireSignin: BUILD_DEN_REQUIRE_SIGNIN,
+    });
+    return desktopBootstrapConfig;
+  }
+
+  try {
+    const bootstrap = await getDesktopBootstrapConfigFromShell();
+    applyDesktopBootstrapConfig(resolveDenBootstrapConfig(bootstrap));
+  } catch {
+    desktopBootstrapConfig = resolveDenBootstrapConfig({
+      baseUrl: BUILD_DEN_BASE_URL,
+      apiBaseUrl: BUILD_DEN_API_BASE_URL,
+      requireSignin: BUILD_DEN_REQUIRE_SIGNIN,
+    });
+    syncBootstrapSettingsToLocalStorage(desktopBootstrapConfig);
+  }
+
+  return desktopBootstrapConfig;
+}
+
+export async function setDenBootstrapConfig(
+  next: ShellDesktopBootstrapConfig,
+): Promise<DenBootstrapConfig> {
+  const normalized = resolveDenBootstrapConfig(next);
+
+  if (isDesktopRuntime()) {
+    const persisted = await setDesktopBootstrapConfigInShell({
+      baseUrl: normalized.baseUrl,
+      apiBaseUrl: normalized.apiBaseUrl,
+      requireSignin: normalized.requireSignin,
+    });
+    applyDesktopBootstrapConfig(resolveDenBootstrapConfig(persisted));
+  } else {
+    applyDesktopBootstrapConfig(normalized);
+  }
+
+  dispatchDenSettingsChanged({
+    settings: readDenSettings(),
+  });
+
+  return readDenBootstrapConfig();
+}
+
+export function buildDenAuthUrl(baseUrl: string, mode: "sign-in" | "sign-up"): string {
+  const target = new URL(resolveDenBaseUrls(baseUrl).baseUrl);
+  target.searchParams.set("mode", mode);
+  if (isDesktopDeployment()) {
+    target.searchParams.set("desktopAuth", "1");
+    target.searchParams.set("desktopScheme", "openwork");
+  }
+  return target.toString();
+}
+
+function resolveRequestBaseUrl(baseUrls: DenBaseUrls, path: string): string {
+  return path.startsWith("/api/") ? baseUrls.baseUrl : baseUrls.apiBaseUrl;
+}
+
+export function readDenSettings(): DenSettings {
+  if (typeof window === "undefined") {
+    return {
+      ...readDenBootstrapConfig(),
+      authToken: null,
+      activeOrgId: null,
+      activeOrgSlug: null,
+      activeOrgName: null,
+    };
+  }
+
+  const baseUrls = resolveDenBaseUrls({
+    baseUrl: window.localStorage.getItem(STORAGE_BASE_URL) ?? readDenBootstrapConfig().baseUrl,
+    apiBaseUrl: window.localStorage.getItem(STORAGE_API_BASE_URL) ?? readDenBootstrapConfig().apiBaseUrl,
+  });
+
+  return {
+    ...baseUrls,
+    authToken: (window.localStorage.getItem(STORAGE_AUTH_TOKEN) ?? "").trim() || null,
+    activeOrgId: (window.localStorage.getItem(STORAGE_ACTIVE_ORG_ID) ?? "").trim() || null,
+    activeOrgSlug: (window.localStorage.getItem(STORAGE_ACTIVE_ORG_SLUG) ?? "").trim() || null,
+    activeOrgName: (window.localStorage.getItem(STORAGE_ACTIVE_ORG_NAME) ?? "").trim() || null,
+  };
+}
+
+export function writeDenSettings(next: DenSettings, options?: { persistBootstrap?: boolean }) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  const pendingBootstrap = getPendingBootstrapConfig(next);
+  const previous = readDenSettings();
+  const resolved = resolveDenBaseUrls(next);
+  const previousResolved = resolveDenBaseUrls(previous);
+  const baseUrl = resolved.baseUrl;
+  const apiBaseUrl = next.apiBaseUrl !== undefined
+    ? resolved.apiBaseUrl
+    : previousResolved.baseUrl === resolved.baseUrl
+      ? previous.apiBaseUrl ?? resolved.apiBaseUrl
+      : resolved.apiBaseUrl;
+  const authToken = next.authToken?.trim() ?? "";
+  const activeOrgId = next.activeOrgId?.trim() ?? "";
+  const activeOrgSlug = next.activeOrgSlug?.trim() ?? "";
+  const activeOrgName = next.activeOrgName?.trim() ?? "";
+
+  if (
+    previous.baseUrl === baseUrl &&
+    (previous.apiBaseUrl ?? "") === apiBaseUrl &&
+    (previous.authToken ?? "") === authToken &&
+    (previous.activeOrgId ?? "") === activeOrgId &&
+    (previous.activeOrgSlug ?? "") === activeOrgSlug &&
+    (previous.activeOrgName ?? "") === activeOrgName
+  ) {
+    return;
+  }
+
+  window.localStorage.setItem(STORAGE_BASE_URL, baseUrl);
+  window.localStorage.setItem(STORAGE_API_BASE_URL, apiBaseUrl);
+  if (authToken) {
+    window.localStorage.setItem(STORAGE_AUTH_TOKEN, authToken);
+  } else {
+    window.localStorage.removeItem(STORAGE_AUTH_TOKEN);
+  }
+
+  if (activeOrgId) {
+    window.localStorage.setItem(STORAGE_ACTIVE_ORG_ID, activeOrgId);
+  } else {
+    window.localStorage.removeItem(STORAGE_ACTIVE_ORG_ID);
+  }
+
+  if (activeOrgSlug) {
+    window.localStorage.setItem(STORAGE_ACTIVE_ORG_SLUG, activeOrgSlug);
+  } else {
+    window.localStorage.removeItem(STORAGE_ACTIVE_ORG_SLUG);
+  }
+
+  if (activeOrgName) {
+    window.localStorage.setItem(STORAGE_ACTIVE_ORG_NAME, activeOrgName);
+  } else {
+    window.localStorage.removeItem(STORAGE_ACTIVE_ORG_NAME);
+  }
+
+  if (options?.persistBootstrap !== false && pendingBootstrap) {
+    const currentBootstrap = readDenBootstrapConfig();
+    if (
+      pendingBootstrap.baseUrl !== currentBootstrap.baseUrl ||
+      pendingBootstrap.apiBaseUrl !== currentBootstrap.apiBaseUrl
+    ) {
+      void setDenBootstrapConfig({
+        baseUrl: pendingBootstrap.baseUrl,
+        apiBaseUrl: pendingBootstrap.apiBaseUrl,
+        requireSignin: currentBootstrap.requireSignin,
+      }).catch(() => undefined);
+    }
+  }
+
+  dispatchDenSettingsChanged({
+    settings: readDenSettings(),
+  });
+}
+
+export function clearDenSession(options?: { includeBaseUrls?: boolean }) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  if (options?.includeBaseUrls) {
+    window.localStorage.removeItem(STORAGE_BASE_URL);
+    window.localStorage.removeItem(STORAGE_API_BASE_URL);
+  }
+
+  window.localStorage.removeItem(STORAGE_AUTH_TOKEN);
+  window.localStorage.removeItem(STORAGE_ACTIVE_ORG_ID);
+  window.localStorage.removeItem(STORAGE_ACTIVE_ORG_SLUG);
+  window.localStorage.removeItem(STORAGE_ACTIVE_ORG_NAME);
+
+  dispatchDenSettingsChanged({
+    settings: readDenSettings(),
+  });
+}
+
+export async function ensureDenActiveOrganization(options?: { forceServerSync?: boolean }) {
+  const settings = readDenSettings();
+  const token = settings.authToken?.trim() ?? "";
+  if (!token) {
+    return null;
+  }
+
+  const client = createDenClient({
+    baseUrl: settings.baseUrl,
+    apiBaseUrl: settings.apiBaseUrl,
+    token,
+  });
+
+  const response = await client.listOrgs();
+  const targetOrg =
+    response.orgs.find((org) => org.id === response.activeOrgId) ??
+    response.orgs.find((org) => org.slug === response.activeOrgSlug) ??
+    response.orgs[0] ??
+    null;
+
+  if (!targetOrg) {
+    writeDenSettings({
+      ...settings,
+      activeOrgId: null,
+      activeOrgSlug: null,
+      activeOrgName: null,
+    }, { persistBootstrap: false });
+    return null;
+  }
+
+  if (
+    options?.forceServerSync &&
+    (!response.activeOrgId || response.activeOrgId !== targetOrg.id)
+  ) {
+    await client.setActiveOrganization({ organizationId: targetOrg.id });
+  }
+
+  writeDenSettings({
+    ...settings,
+    activeOrgId: targetOrg.id,
+    activeOrgSlug: targetOrg.slug,
+    activeOrgName: targetOrg.name,
+  }, { persistBootstrap: false });
+
+  return targetOrg;
+}
+
+function getErrorMessage(payload: unknown, fallback: string): string {
+  if (typeof payload === "string" && payload.trim()) {
+    return payload.trim();
+  }
+
+  if (!isRecord(payload)) {
+    return fallback;
+  }
+
+  if (typeof payload.message === "string" && payload.message.trim()) {
+    return payload.message.trim();
+  }
+
+  if (typeof payload.error === "string" && payload.error.trim()) {
+    return payload.error.trim();
+  }
+
+  return fallback;
+}
+
+function getUser(payload: unknown): DenUser | null {
+  if (!isRecord(payload) || !isRecord(payload.user)) {
+    return null;
+  }
+
+  const user = payload.user;
+  if (typeof user.id !== "string" || typeof user.email !== "string") {
+    return null;
+  }
+
+  return {
+    id: user.id,
+    email: user.email,
+    name: typeof user.name === "string" ? user.name : null,
+  };
+}
+
+function getToken(payload: unknown): string | null {
+  if (!isRecord(payload) || typeof payload.token !== "string") {
+    return null;
+  }
+  return payload.token.trim() || null;
+}
+
+function getOrgList(payload: unknown): DenOrgSummary[] {
+  if (!isRecord(payload) || !Array.isArray(payload.orgs)) {
+    return [];
+  }
+
+  return payload.orgs
+    .map((entry) => {
+      if (!isRecord(entry)) return null;
+      if (
+        typeof entry.id !== "string" ||
+        typeof entry.name !== "string" ||
+        typeof entry.slug !== "string" ||
+        (entry.role !== "owner" && entry.role !== "admin" && entry.role !== "member")
+      ) {
+        return null;
+      }
+
+      return {
+        id: entry.id,
+        name: entry.name,
+        slug: entry.slug,
+        role: entry.role,
+      } satisfies DenOrgSummary;
+    })
+    .filter((entry): entry is DenOrgSummary => Boolean(entry));
+}
+
+function getWorkers(payload: unknown): DenWorkerSummary[] {
+  if (!isRecord(payload) || !Array.isArray(payload.workers)) {
+    return [];
+  }
+
+  return payload.workers
+    .map((entry) => {
+      if (!isRecord(entry)) return null;
+      const instance = isRecord(entry.instance) ? entry.instance : null;
+      if (typeof entry.id !== "string" || typeof entry.name !== "string") {
+        return null;
+      }
+      return {
+        workerId: entry.id,
+        workerName: entry.name,
+        status: typeof entry.status === "string" ? entry.status : "unknown",
+        instanceUrl: instance && typeof instance.url === "string" ? instance.url : null,
+        provider: instance && typeof instance.provider === "string" ? instance.provider : null,
+        isMine: Boolean(entry.isMine),
+        createdAt: typeof entry.createdAt === "string" ? entry.createdAt : null,
+      } satisfies DenWorkerSummary;
+    })
+    .filter((entry): entry is DenWorkerSummary => Boolean(entry));
+}
+
+function getWorkerTokens(payload: unknown): DenWorkerTokens | null {
+  if (!isRecord(payload) || !isRecord(payload.tokens)) {
+    return null;
+  }
+
+  const tokens = payload.tokens;
+  const connect = isRecord(payload.connect) ? payload.connect : null;
+  return {
+    clientToken: typeof tokens.client === "string" ? tokens.client : null,
+    ownerToken: typeof tokens.owner === "string" ? tokens.owner : null,
+    hostToken: typeof tokens.host === "string" ? tokens.host : null,
+    openworkUrl: connect && typeof connect.openworkUrl === "string" ? connect.openworkUrl : null,
+    workspaceId: connect && typeof connect.workspaceId === "string" ? connect.workspaceId : null,
+  };
+}
+
+function parseDenOrgSkillRow(record: Record<string, unknown>, hubName: string | null): DenOrgSkillCard | null {
+  if (typeof record.id !== "string" || typeof record.title !== "string" || typeof record.skillText !== "string") {
+    return null;
+  }
+  const description = typeof record.description === "string" ? record.description : null;
+  const shared = record.shared === "org" || record.shared === "public" ? record.shared : null;
+  return {
+    id: record.id,
+    title: record.title,
+    description,
+    skillText: record.skillText,
+    hubName,
+    shared,
+    updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : null,
+  };
+}
+
+function getDenOrgSkillsFromPayload(payload: unknown): DenOrgSkillCard[] {
+  if (!isRecord(payload) || !Array.isArray(payload.skills)) {
+    return [];
+  }
+  return payload.skills
+    .map((entry) => (isRecord(entry) ? parseDenOrgSkillRow(entry, null) : null))
+    .filter((entry): entry is DenOrgSkillCard => entry !== null);
+}
+
+export type DenOrgSkillHub = { id: string; name: string; skills: DenOrgSkillCard[] };
+
+function parseOrgSkillHubEntry(hub: Record<string, unknown>): DenOrgSkillHub | null {
+  const hubId = hub.id;
+  const hubName = hub.name;
+  const hubSkills = hub.skills;
+  if (typeof hubId !== "string" || typeof hubName !== "string" || !Array.isArray(hubSkills)) {
+    return null;
+  }
+  const skills = hubSkills
+    .map((s) => (isRecord(s) ? parseDenOrgSkillRow(s, hubName) : null))
+    .filter((s): s is DenOrgSkillCard => s !== null);
+  return { id: hubId, name: hubName, skills };
+}
+
+function getDenOrgSkillHubsFromPayload(payload: unknown): DenOrgSkillHub[] {
+  if (!isRecord(payload) || !Array.isArray(payload.skillHubs)) {
+    return [];
+  }
+  return payload.skillHubs
+    .map((entry) => (isRecord(entry) ? parseOrgSkillHubEntry(entry) : null))
+      .filter((e): e is DenOrgSkillHub => e !== null);
+}
+
+function parseDenOrgLlmProviderModel(value: unknown): DenOrgLlmProviderModel | null {
+  if (!isRecord(value) || typeof value.id !== "string" || typeof value.name !== "string") {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    name: value.name,
+    config: isRecord(value.config) ? value.config : {},
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : null,
+  };
+}
+
+function parseDenOrgLlmProvider(value: unknown): DenOrgLlmProvider | null {
+  if (
+    !isRecord(value) ||
+    typeof value.id !== "string" ||
+    typeof value.providerId !== "string" ||
+    typeof value.name !== "string" ||
+    (value.source !== "models_dev" && value.source !== "custom")
+  ) {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    source: value.source,
+    providerId: value.providerId,
+    name: value.name,
+    providerConfig: isRecord(value.providerConfig) ? value.providerConfig : {},
+    hasApiKey: value.hasApiKey === true,
+    models: Array.isArray(value.models)
+      ? value.models.map(parseDenOrgLlmProviderModel).filter((entry): entry is DenOrgLlmProviderModel => entry !== null)
+      : [],
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : null,
+    updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : null,
+  };
+}
+
+function getDenOrgLlmProviders(payload: unknown): DenOrgLlmProvider[] {
+  if (!isRecord(payload) || !Array.isArray(payload.llmProviders)) {
+    return [];
+  }
+
+  return payload.llmProviders
+    .map(parseDenOrgLlmProvider)
+    .filter((entry): entry is DenOrgLlmProvider => entry !== null);
+}
+
+function getDenOrgLlmProviderConnection(payload: unknown): DenOrgLlmProviderConnection | null {
+  if (!isRecord(payload) || !payload.llmProvider) {
+    return null;
+  }
+
+  const provider = parseDenOrgLlmProvider(payload.llmProvider);
+  if (!provider || !isRecord(payload.llmProvider)) {
+    return null;
+  }
+
+  return {
+    ...provider,
+    apiKey: typeof payload.llmProvider.apiKey === "string" ? payload.llmProvider.apiKey : null,
+  };
+}
+
+function parsePluginConfigObjectType(value: unknown): DenPluginConfigObjectType | null {
+  return value === "skill" || value === "agent" || value === "command" || value === "tool" ||
+    value === "mcp" || value === "hook" || value === "context" || value === "custom"
+    ? value
+    : null;
+}
+
+function parsePluginConfigObjectVersion(value: unknown): DenPluginConfigObjectVersion | null {
+  if (!isRecord(value) || typeof value.id !== "string") return null;
+  return {
+    id: value.id,
+    rawSourceText: typeof value.rawSourceText === "string" ? value.rawSourceText : null,
+    normalizedPayloadJson: isRecord(value.normalizedPayloadJson) ? value.normalizedPayloadJson : null,
+    sourceRevisionRef: typeof value.sourceRevisionRef === "string" ? value.sourceRevisionRef : null,
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : null,
+  };
+}
+
+function parsePluginConfigObject(value: unknown): DenPluginConfigObject | null {
+  if (!isRecord(value) || typeof value.id !== "string" || typeof value.title !== "string") return null;
+  const objectType = parsePluginConfigObjectType(value.objectType);
+  if (!objectType) return null;
+  return {
+    id: value.id,
+    objectType,
+    title: value.title,
+    description: typeof value.description === "string" ? value.description : null,
+    currentFileName: typeof value.currentFileName === "string" ? value.currentFileName : null,
+    currentFileExtension: typeof value.currentFileExtension === "string" ? value.currentFileExtension : null,
+    currentRelativePath: typeof value.currentRelativePath === "string" ? value.currentRelativePath : null,
+    status: typeof value.status === "string" ? value.status : "active",
+    updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : null,
+    latestVersion: parsePluginConfigObjectVersion(value.latestVersion),
+  };
+}
+
+function parseOrgPlugin(value: unknown): DenOrgPlugin | null {
+  if (!isRecord(value) || typeof value.id !== "string" || typeof value.name !== "string") return null;
+  const counts = isRecord(value.componentCounts)
+    ? Object.fromEntries(
+        Object.entries(value.componentCounts).filter((entry): entry is [string, number] =>
+          typeof entry[0] === "string" && typeof entry[1] === "number" && Number.isFinite(entry[1]) && entry[1] >= 0,
+        ),
+      )
+    : {};
+  return {
+    id: value.id,
+    name: value.name,
+    description: typeof value.description === "string" ? value.description : null,
+    status: typeof value.status === "string" ? value.status : "active",
+    memberCount: typeof value.memberCount === "number" && Number.isFinite(value.memberCount) ? value.memberCount : 0,
+    updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : null,
+    componentCounts: counts,
+  };
+}
+
+function parseOrgMarketplace(value: unknown): DenOrgMarketplace | null {
+  if (!isRecord(value) || typeof value.id !== "string" || typeof value.name !== "string") return null;
+  return {
+    id: value.id,
+    name: value.name,
+    description: typeof value.description === "string" ? value.description : null,
+    status: typeof value.status === "string" ? value.status : "active",
+    pluginCount: typeof value.pluginCount === "number" && Number.isFinite(value.pluginCount) ? value.pluginCount : 0,
+    updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : null,
+  };
+}
+
+function parsePluginMembership(value: unknown): DenPluginMembership | null {
+  if (!isRecord(value) || typeof value.id !== "string" || typeof value.pluginId !== "string" || typeof value.configObjectId !== "string") {
+    return null;
+  }
+  const configObject = parsePluginConfigObject(value.configObject);
+  return {
+    id: value.id,
+    pluginId: value.pluginId,
+    configObjectId: value.configObjectId,
+    ...(configObject ? { configObject } : {}),
+  };
+}
+
+function getOrgMarketplaces(payload: unknown): DenOrgMarketplace[] {
+  if (!isRecord(payload) || !Array.isArray(payload.items)) return [];
+  return payload.items.map(parseOrgMarketplace).filter((entry): entry is DenOrgMarketplace => entry !== null);
+}
+
+function getOrgMarketplaceResolved(payload: unknown): DenOrgMarketplaceResolved | null {
+  if (!isRecord(payload) || !isRecord(payload.item)) return null;
+  const marketplace = parseOrgMarketplace(payload.item.marketplace);
+  if (!marketplace || !Array.isArray(payload.item.plugins)) return null;
+  return {
+    marketplace,
+    plugins: payload.item.plugins.map(parseOrgPlugin).filter((entry): entry is DenOrgPlugin => entry !== null),
+  };
+}
+
+function getOrgPluginResolved(plugin: DenOrgPlugin, payload: unknown): DenOrgPluginResolved {
+  const memberships = isRecord(payload) && Array.isArray(payload.items)
+    ? payload.items.map(parsePluginMembership).filter((entry): entry is DenPluginMembership => entry !== null)
+    : [];
+  return { plugin, memberships };
+}
+
+function getBillingPrice(value: unknown): DenBillingPrice | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  return {
+    amount: typeof value.amount === "number" ? value.amount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    recurringInterval: typeof value.recurringInterval === "string" ? value.recurringInterval : null,
+    recurringIntervalCount: typeof value.recurringIntervalCount === "number" ? value.recurringIntervalCount : null,
+  };
+}
+
+function getBillingSubscription(value: unknown): DenBillingSubscription | null {
+  if (!isRecord(value) || typeof value.id !== "string") {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    status: typeof value.status === "string" ? value.status : "unknown",
+    amount: typeof value.amount === "number" ? value.amount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    recurringInterval: typeof value.recurringInterval === "string" ? value.recurringInterval : null,
+    recurringIntervalCount: typeof value.recurringIntervalCount === "number" ? value.recurringIntervalCount : null,
+    currentPeriodStart: typeof value.currentPeriodStart === "string" ? value.currentPeriodStart : null,
+    currentPeriodEnd: typeof value.currentPeriodEnd === "string" ? value.currentPeriodEnd : null,
+    cancelAtPeriodEnd: value.cancelAtPeriodEnd === true,
+    canceledAt: typeof value.canceledAt === "string" ? value.canceledAt : null,
+    endedAt: typeof value.endedAt === "string" ? value.endedAt : null,
+  };
+}
+
+function getBillingInvoice(value: unknown): DenBillingInvoice | null {
+  if (!isRecord(value) || typeof value.id !== "string") {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : null,
+    status: typeof value.status === "string" ? value.status : "unknown",
+    totalAmount: typeof value.totalAmount === "number" ? value.totalAmount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    invoiceNumber: typeof value.invoiceNumber === "string" ? value.invoiceNumber : null,
+    invoiceUrl: typeof value.invoiceUrl === "string" ? value.invoiceUrl : null,
+  };
+}
+
+export type DenOrgSkillHubSummary = {
+  id: string;
+  name: string;
+  canManage: boolean;
+};
+
+function getOrgSkillHubSummaries(payload: unknown): DenOrgSkillHubSummary[] {
+  if (!isRecord(payload) || !Array.isArray(payload.skillHubs)) {
+    return [];
+  }
+
+  return payload.skillHubs
+    .map((entry) => {
+      if (!isRecord(entry)) return null;
+      if (typeof entry.id !== "string" || typeof entry.name !== "string" || typeof entry.canManage !== "boolean") {
+        return null;
+      }
+      return { id: entry.id, name: entry.name, canManage: entry.canManage };
+    })
+    .filter((entry): entry is DenOrgSkillHubSummary => Boolean(entry));
+}
+
+function getCreatedOrgSkillId(payload: unknown): string | null {
+  if (!isRecord(payload) || !isRecord(payload.skill)) return null;
+  return typeof payload.skill.id === "string" ? payload.skill.id : null;
+}
+
+function getBillingSummary(payload: unknown): DenBillingSummary | null {
+  if (!isRecord(payload) || !isRecord(payload.billing)) {
+    return null;
+  }
+
+  const billing = payload.billing;
+  if (
+    typeof billing.featureGateEnabled !== "boolean" ||
+    typeof billing.hasActivePlan !== "boolean" ||
+    typeof billing.checkoutRequired !== "boolean"
+  ) {
+    return null;
+  }
+
+  return {
+    featureGateEnabled: billing.featureGateEnabled,
+    hasActivePlan: billing.hasActivePlan,
+    checkoutRequired: billing.checkoutRequired,
+    checkoutUrl: typeof billing.checkoutUrl === "string" ? billing.checkoutUrl : null,
+    portalUrl: typeof billing.portalUrl === "string" ? billing.portalUrl : null,
+    price: getBillingPrice(billing.price),
+    subscription: getBillingSubscription(billing.subscription),
+    invoices: Array.isArray(billing.invoices)
+      ? billing.invoices.map((item) => getBillingInvoice(item)).filter((item): item is DenBillingInvoice => item !== null)
+      : [],
+    productId: typeof billing.productId === "string" ? billing.productId : null,
+    benefitId: typeof billing.benefitId === "string" ? billing.benefitId : null,
+  };
+}
+
+const resolveFetch = () => (isDesktopRuntime() ? desktopFetch : globalThis.fetch);
+
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+
+async function fetchWithTimeout(fetchImpl: FetchLike, url: string, init: RequestInit, timeoutMs: number) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return fetchImpl(url, init);
+  }
+
+  const controller = typeof AbortController !== "undefined" ? new AbortController() : null;
+  const signal = controller?.signal;
+  const initWithSignal = signal && !init.signal ? { ...init, signal } : init;
+
+  let timeoutId: ReturnType<typeof setTimeout> | null = null;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeoutId = setTimeout(() => {
+      try {
+        controller?.abort();
+      } catch {
+        // ignore
+      }
+      reject(new Error("Request timed out."));
+    }, timeoutMs);
+  });
+
+  try {
+    return await Promise.race([fetchImpl(url, initWithSignal), timeoutPromise]);
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+  }
+}
+
+async function requestJsonRaw<T>(
+  input: string | DenBaseUrls,
+  path: string,
+  options: { method?: string; token?: string | null; body?: unknown; timeoutMs?: number } = {},
+): Promise<RawJsonResponse<T>> {
+  const baseUrls = typeof input === "string" ? resolveDenBaseUrls(input) : input;
+  const url = `${resolveRequestBaseUrl(baseUrls, path)}${path}`;
+  const headers: Record<string, string> = { Accept: "application/json" };
+  const token = options.token?.trim() ?? "";
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  if (options.body !== undefined) {
+    headers["Content-Type"] = "application/json";
+  }
+
+  const response = await fetchWithTimeout(
+    resolveFetch(),
+    url,
+    {
+      method: options.method ?? "GET",
+      headers,
+      body: options.body === undefined ? undefined : JSON.stringify(options.body),
+      credentials: "include",
+    },
+    options.timeoutMs ?? DEFAULT_DEN_TIMEOUT_MS,
+  );
+
+  const text = await response.text();
+  let json: T | null = null;
+  try {
+    json = text ? (JSON.parse(text) as T) : null;
+  } catch {
+    json = null;
+  }
+  return { ok: response.ok, status: response.status, json };
+}
+
+async function requestJson<T>(
+  input: string | DenBaseUrls,
+  path: string,
+  options: { method?: string; token?: string | null; body?: unknown; timeoutMs?: number } = {},
+): Promise<T> {
+  const raw = await requestJsonRaw<T>(input, path, options);
+  if (!raw.ok) {
+    const payload = raw.json;
+    const code = isRecord(payload) && typeof payload.error === "string" ? payload.error : "request_failed";
+    const message = getErrorMessage(payload, `Request failed with ${raw.status}.`);
+    throw new DenApiError(raw.status, code, message, isRecord(payload) ? payload.details : undefined);
+  }
+  return raw.json as T;
+}
+
+async function ensureActiveOrganization(
+  baseUrls: DenBaseUrls,
+  token: string | null,
+  input: { organizationId?: string | null; organizationSlug?: string | null },
+) {
+  const organizationId = input.organizationId?.trim() ?? "";
+  const organizationSlug = input.organizationSlug?.trim() ?? "";
+  if (!token || (!organizationId && !organizationSlug)) {
+    return;
+  }
+
+  await requestJson<unknown>(baseUrls, "/api/auth/organization/set-active", {
+    method: "POST",
+    token,
+    body: {
+      organizationId: organizationId || undefined,
+      organizationSlug: organizationSlug || undefined,
+    },
+  });
+}
+
+export function createDenClient(options: { baseUrl: string; apiBaseUrl?: string | null; token?: string | null }) {
+  const baseUrls = resolveDenBaseUrls({
+    baseUrl: options.baseUrl,
+    apiBaseUrl: options.apiBaseUrl,
+  });
+  const token = options.token?.trim() ?? null;
+
+  return {
+    async setActiveOrganization(input: { organizationId?: string | null; organizationSlug?: string | null }): Promise<void> {
+      await ensureActiveOrganization(baseUrls, token, input);
+    },
+
+    async signInEmail(email: string, password: string): Promise<DenAuthResult> {
+      const payload = await requestJson<unknown>(baseUrls, "/api/auth/sign-in/email", {
+        method: "POST",
+        body: {
+          email: email.trim(),
+          password,
+        },
+      });
+      return { user: getUser(payload), token: getToken(payload) };
+    },
+
+    async signUpEmail(email: string, password: string): Promise<DenAuthResult> {
+      const payload = await requestJson<unknown>(baseUrls, "/api/auth/sign-up/email", {
+        method: "POST",
+        body: {
+          name: DEFAULT_DEN_AUTH_NAME,
+          email: email.trim(),
+          password,
+        },
+      });
+      return { user: getUser(payload), token: getToken(payload) };
+    },
+
+    async signOut() {
+      await requestJsonRaw(baseUrls, "/api/auth/sign-out", {
+        method: "POST",
+        token,
+        body: {},
+      });
+    },
+
+    async getSession(): Promise<DenUser> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/me", {
+        method: "GET",
+        token,
+      });
+      const user = getUser(payload);
+      if (!user) {
+        throw new DenApiError(500, "invalid_session_payload", "Session response did not include a user.");
+      }
+      return user;
+    },
+
+    async getAppVersionMetadata(): Promise<DenAppVersionMetadata> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/app-version", {
+        method: "GET",
+      });
+      const appVersionMetadata = getDenAppVersionMetadata(payload);
+      if (!appVersionMetadata) {
+        throw new DenApiError(500, "invalid_app_version_payload", "App version response was missing version details.");
+      }
+      return appVersionMetadata;
+    },
+
+    async getDesktopConfig(): Promise<DenDesktopConfig> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/me/desktop-config", {
+        method: "GET",
+        token,
+      });
+      return normalizeDenDesktopConfig(payload);
+    },
+
+    async exchangeDesktopHandoff(grant: string): Promise<DenDesktopHandoffExchange> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/auth/desktop-handoff/exchange", {
+        method: "POST",
+        body: { grant },
+      });
+      return { user: getUser(payload), token: getToken(payload) };
+    },
+
+    async listOrgs(): Promise<{ orgs: DenOrgSummary[]; activeOrgId: string | null; activeOrgSlug: string | null; defaultOrgId: string | null }> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/me/orgs", {
+        method: "GET",
+        token,
+      });
+
+      const activeOrgId = isRecord(payload) && typeof payload.activeOrgId === "string"
+        ? payload.activeOrgId
+        : null;
+      const activeOrgSlug = isRecord(payload) && typeof payload.activeOrgSlug === "string"
+        ? payload.activeOrgSlug
+        : null;
+
+      return {
+        orgs: getOrgList(payload),
+        activeOrgId,
+        activeOrgSlug,
+        defaultOrgId: activeOrgId,
+      };
+    },
+
+    async listWorkers(orgId: string, limit = 20): Promise<DenWorkerSummary[]> {
+      const params = new URLSearchParams();
+      params.set("limit", String(limit));
+      const payload = await requestJson<unknown>(baseUrls, `/v1/workers?${params.toString()}`, {
+        method: "GET",
+        token,
+      });
+      return getWorkers(payload);
+    },
+
+    async getWorkerTokens(workerId: string, orgId: string): Promise<DenWorkerTokens> {
+      const payload = await requestJson<unknown>(baseUrls, `/v1/workers/${encodeURIComponent(workerId)}/tokens`, {
+        method: "POST",
+        token,
+        body: {},
+      });
+      const tokens = getWorkerTokens(payload);
+      if (!tokens) {
+        throw new DenApiError(500, "invalid_worker_token_payload", "Worker token response was missing token values.");
+      }
+      return tokens;
+    },
+
+    async listOrgSkills(orgId: string): Promise<DenOrgSkillCard[]> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/skills", {
+        method: "GET",
+        token,
+      });
+      return getDenOrgSkillsFromPayload(payload);
+    },
+
+    async listOrgSkillHubs(orgId: string): Promise<DenOrgSkillHub[]> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/skill-hubs", {
+        method: "GET",
+        token,
+      });
+      return getDenOrgSkillHubsFromPayload(payload);
+    },
+
+    async listOrgSkillHubSummaries(orgId: string): Promise<DenOrgSkillHubSummary[]> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/skill-hubs", {
+        method: "GET",
+        token,
+      });
+      return getOrgSkillHubSummaries(payload);
+    },
+
+    async createOrgSkill(
+      orgId: string,
+      input: { skillText: string; shared?: "org" | "public" | null },
+    ): Promise<{ id: string }> {
+      const body = {
+        skillText: input.skillText,
+        shared: input.shared === undefined ? ("org" as const) : input.shared,
+      };
+      const payload = await requestJson<unknown>(baseUrls, "/v1/skills", {
+        method: "POST",
+        token,
+        body,
+      });
+      const id = getCreatedOrgSkillId(payload);
+      if (!id) {
+        throw new DenApiError(500, "invalid_skill_payload", "Skill response was missing id.");
+      }
+      return { id };
+    },
+
+    async addOrgSkillToHub(orgId: string, skillHubId: string, skillId: string): Promise<void> {
+      await requestJson<unknown>(
+        baseUrls,
+        `/v1/skill-hubs/${encodeURIComponent(skillHubId)}/skills`,
+        {
+          method: "POST",
+          token,
+          body: { skillId },
+        },
+      );
+    },
+
+    async listOrgLlmProviders(orgId: string): Promise<DenOrgLlmProvider[]> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/llm-providers", {
+        method: "GET",
+        token,
+      });
+      return getDenOrgLlmProviders(payload);
+    },
+
+    async getOrgLlmProviderConnection(orgId: string, llmProviderId: string): Promise<DenOrgLlmProviderConnection> {
+      const payload = await requestJson<unknown>(
+        baseUrls,
+        `/v1/llm-providers/${encodeURIComponent(llmProviderId)}/connect`,
+        {
+          method: "GET",
+          token,
+        },
+      );
+      const provider = getDenOrgLlmProviderConnection(payload);
+      if (!provider) {
+        throw new DenApiError(500, "invalid_llm_provider_payload", "LLM provider response was missing connection details.");
+      }
+      return provider;
+    },
+
+    async listOrgMarketplaces(orgId: string): Promise<DenOrgMarketplace[]> {
+      const payload = await requestJson<unknown>(
+        baseUrls,
+        `/v1/marketplaces?status=active&limit=100`,
+        { method: "GET", token },
+      );
+      return getOrgMarketplaces(payload);
+    },
+
+    async getOrgMarketplaceResolved(orgId: string, marketplaceId: string): Promise<DenOrgMarketplaceResolved> {
+      const payload = await requestJson<unknown>(
+        baseUrls,
+        `/v1/marketplaces/${encodeURIComponent(marketplaceId)}/resolved`,
+        { method: "GET", token },
+      );
+      const resolved = getOrgMarketplaceResolved(payload);
+      if (!resolved) {
+        throw new DenApiError(500, "invalid_marketplace_payload", "Marketplace response was missing plugin details.");
+      }
+      return resolved;
+    },
+
+    async getOrgPluginResolved(orgId: string, plugin: DenOrgPlugin): Promise<DenOrgPluginResolved> {
+      const payload = await requestJson<unknown>(
+        baseUrls,
+        `/v1/plugins/${encodeURIComponent(plugin.id)}/resolved`,
+        { method: "GET", token },
+      );
+      return getOrgPluginResolved(plugin, payload);
+    },
+
+    async getBillingStatus(options: { includeCheckout?: boolean; includePortal?: boolean; includeInvoices?: boolean } = {}): Promise<DenBillingSummary> {
+      const params = new URLSearchParams();
+      if (options.includeCheckout) {
+        params.set("includeCheckout", "1");
+      }
+      if (options.includePortal === false) {
+        params.set("excludePortal", "1");
+      }
+      if (options.includeInvoices === false) {
+        params.set("excludeInvoices", "1");
+      }
+
+      const path = params.size > 0 ? `/v1/workers/billing?${params.toString()}` : "/v1/workers/billing";
+      const payload = await requestJson<unknown>(baseUrls, path, {
+        method: "GET",
+        token,
+      });
+      const summary = getBillingSummary(payload);
+      if (!summary) {
+        throw new DenApiError(500, "invalid_billing_payload", "Billing response was missing details.");
+      }
+      return summary;
+    },
+
+    async updateSubscriptionCancellation(cancelAtPeriodEnd: boolean): Promise<{ subscription: DenBillingSubscription | null; billing: DenBillingSummary }> {
+      const payload = await requestJson<unknown>(baseUrls, "/v1/workers/billing/subscription", {
+        method: "POST",
+        token,
+        body: { cancelAtPeriodEnd },
+      });
+      const billing = getBillingSummary(payload);
+      if (!billing) {
+        throw new DenApiError(500, "invalid_billing_payload", "Subscription update response was missing billing details.");
+      }
+
+      return {
+        subscription: isRecord(payload) ? getBillingSubscription(payload.subscription) : null,
+        billing,
+      };
+    },
+  };
+}
+
+export async function fetchDenOrgSkillsCatalog(
+  client: ReturnType<typeof createDenClient>,
+  orgId: string,
+): Promise<DenOrgSkillCard[]> {
+  const [hubs, flatSkills] = await Promise.all([client.listOrgSkillHubs(orgId), client.listOrgSkills(orgId)]);
+  const hubNameBySkillId = new Map<string, string>();
+  for (const hub of hubs) {
+    for (const skill of hub.skills) {
+      if (!hubNameBySkillId.has(skill.id)) {
+        hubNameBySkillId.set(skill.id, hub.name);
+      }
+    }
+  }
+  const byId = new Map<string, DenOrgSkillCard>();
+  for (const skill of flatSkills) {
+    byId.set(skill.id, {
+      ...skill,
+      hubName: hubNameBySkillId.get(skill.id) ?? null,
+    });
+  }
+  return [...byId.values()].sort((a, b) => a.title.localeCompare(b.title));
+}
diff --git a/apps/app/src/app/lib/desktop-tauri.ts b/apps/app/src/app/lib/desktop-tauri.ts
new file mode 100644
index 0000000000..417ec66a1c
--- /dev/null
+++ b/apps/app/src/app/lib/desktop-tauri.ts
@@ -0,0 +1,776 @@
+import { invoke } from "@tauri-apps/api/core";
+import { fetch as tauriFetch } from "@tauri-apps/plugin-http";
+import { validateMcpServerName } from "../mcp";
+import { applyWebviewZoom } from "./font-zoom";
+import { nativeDeepLinkEvent } from "./deep-link-bridge";
+
+export const desktopFetch = tauriFetch as unknown as typeof globalThis.fetch;
+
+export async function openDesktopUrl(url: string): Promise<void> {
+  const { openUrl } = await import("@tauri-apps/plugin-opener");
+  await openUrl(url);
+}
+
+export async function openDesktopPath(target: string): Promise<void> {
+  const { openPath } = await import("@tauri-apps/plugin-opener");
+  await openPath(target);
+}
+
+export async function revealDesktopItemInDir(target: string): Promise<void> {
+  const { revealItemInDir } = await import("@tauri-apps/plugin-opener");
+  await revealItemInDir(target);
+}
+
+export async function relaunchDesktopApp(): Promise<void> {
+  const { relaunch } = await import("@tauri-apps/plugin-process");
+  await relaunch();
+}
+
+export async function getDesktopHomeDir(): Promise<string> {
+  const { homeDir } = await import("@tauri-apps/api/path");
+  return homeDir();
+}
+
+export async function joinDesktopPath(...parts: string[]): Promise<string> {
+  const { join } = await import("@tauri-apps/api/path");
+  return join(...parts);
+}
+
+export async function setDesktopZoomFactor(value: number): Promise<boolean> {
+  try {
+    const { getCurrentWebview } = await import("@tauri-apps/api/webview");
+    const webview = getCurrentWebview();
+    await applyWebviewZoom(webview, value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function subscribeDesktopDeepLinks(
+  handler: (urls: string[]) => void,
+): Promise<() => void> {
+  const [{ getCurrent, onOpenUrl }, { listen }] = await Promise.all([
+    import("@tauri-apps/plugin-deep-link"),
+    import("@tauri-apps/api/event"),
+  ]);
+
+  const startUrls = await getCurrent().catch(() => null);
+  if (Array.isArray(startUrls)) {
+    handler(startUrls);
+  }
+
+  const deepLinkUnlisten = await onOpenUrl((urls) => {
+    handler(urls);
+  }).catch(() => () => undefined);
+
+  const eventUnlisten = await listen<string[]>(nativeDeepLinkEvent, (event) => {
+    if (Array.isArray(event.payload)) {
+      handler(event.payload);
+    }
+  }).catch(() => () => undefined);
+
+  return () => {
+    void deepLinkUnlisten();
+    void eventUnlisten();
+  };
+}
+
+export type EngineInfo = {
+  running: boolean;
+  runtime: "direct";
+  baseUrl: string | null;
+  projectDir: string | null;
+  hostname: string | null;
+  port: number | null;
+  opencodeUsername: string | null;
+  opencodePassword: string | null;
+  opencodeBinPath: string | null;
+  opencodeBinSource: string | null;
+  pid: number | null;
+  lastStdout: string | null;
+  lastStderr: string | null;
+};
+
+export type OpenworkServerInfo = {
+  running: boolean;
+  remoteAccessEnabled: boolean;
+  host: string | null;
+  port: number | null;
+  baseUrl: string | null;
+  connectUrl: string | null;
+  mdnsUrl: string | null;
+  lanUrl: string | null;
+  clientToken: string | null;
+  ownerToken: string | null;
+  hostToken: string | null;
+  managedOpencodeBinPath: string | null;
+  managedOpencodeBinSource: string | null;
+  pid: number | null;
+  lastStdout: string | null;
+  lastStderr: string | null;
+};
+
+export type EngineDoctorResult = {
+  found: boolean;
+  inPath: boolean;
+  resolvedPath: string | null;
+  resolvedSource: string | null;
+  version: string | null;
+  supportsServe: boolean;
+  notes: string[];
+  serveHelpStatus: number | null;
+  serveHelpStdout: string | null;
+  serveHelpStderr: string | null;
+};
+
+export type WorkspaceInfo = {
+  id: string;
+  name: string;
+  path: string;
+  preset: string;
+  workspaceType: "local" | "remote";
+  remoteType?: "openwork" | "opencode" | null;
+  baseUrl?: string | null;
+  directory?: string | null;
+  displayName?: string | null;
+  openworkHostUrl?: string | null;
+  openworkToken?: string | null;
+  openworkClientToken?: string | null;
+  openworkHostToken?: string | null;
+  openworkWorkspaceId?: string | null;
+  openworkWorkspaceName?: string | null;
+
+  // Sandbox lifecycle metadata (desktop-managed)
+  sandboxBackend?: "docker" | "microsandbox" | null;
+  sandboxRunId?: string | null;
+  sandboxContainerName?: string | null;
+};
+
+export type WorkspaceList = {
+  // UI-selected workspace persisted by the desktop shell.
+  selectedId?: string;
+  // Runtime/watch target currently followed by the desktop host.
+  watchedId?: string | null;
+  // Legacy desktop payloads used activeId for the UI-selected workspace.
+  activeId?: string | null;
+  workspaces: WorkspaceInfo[];
+};
+
+export function resolveWorkspaceListSelectedId(
+  list: Pick<WorkspaceList, "selectedId" | "activeId"> | null | undefined,
+): string {
+  return list?.selectedId?.trim() || list?.activeId?.trim() || "";
+}
+
+export type WorkspaceExportSummary = {
+  outputPath: string;
+  included: number;
+  excluded: string[];
+};
+
+export async function engineStart(
+  projectDir: string,
+  options?: {
+    preferSidecar?: boolean;
+    runtime?: "direct";
+    workspacePaths?: string[];
+    opencodeBinPath?: string | null;
+    opencodeEnableExa?: boolean;
+    openworkRemoteAccess?: boolean;
+  },
+): Promise<EngineInfo> {
+  return invoke<EngineInfo>("engine_start", {
+    projectDir,
+    preferSidecar: options?.preferSidecar ?? true,
+    opencodeBinPath: options?.opencodeBinPath ?? null,
+    opencodeEnableExa: options?.opencodeEnableExa ?? null,
+    openworkRemoteAccess: options?.openworkRemoteAccess ?? null,
+    runtime: options?.runtime ?? null,
+    workspacePaths: options?.workspacePaths ?? null,
+  });
+}
+
+export async function workspaceBootstrap(): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_bootstrap");
+}
+
+export async function workspaceSetSelected(workspaceId: string): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_set_selected", { workspaceId });
+}
+
+export async function workspaceSetRuntimeActive(workspaceId: string | null): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_set_runtime_active", { workspaceId: workspaceId ?? "" });
+}
+
+export async function workspaceCreate(input: {
+  folderPath: string;
+  name: string;
+  preset: string;
+}): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_create", {
+    folderPath: input.folderPath,
+    name: input.name,
+    preset: input.preset,
+  });
+}
+
+export async function workspaceCreateRemote(input: {
+  baseUrl: string;
+  directory?: string | null;
+  displayName?: string | null;
+  remoteType?: "openwork" | "opencode" | null;
+  openworkHostUrl?: string | null;
+  openworkToken?: string | null;
+  openworkClientToken?: string | null;
+  openworkHostToken?: string | null;
+  openworkWorkspaceId?: string | null;
+  openworkWorkspaceName?: string | null;
+
+  // Sandbox lifecycle metadata (desktop-managed)
+  sandboxBackend?: "docker" | "microsandbox" | null;
+  sandboxRunId?: string | null;
+  sandboxContainerName?: string | null;
+}): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_create_remote", {
+    baseUrl: input.baseUrl,
+    directory: input.directory ?? null,
+    displayName: input.displayName ?? null,
+    remoteType: input.remoteType ?? null,
+    openworkHostUrl: input.openworkHostUrl ?? null,
+    openworkToken: input.openworkToken ?? null,
+    openworkClientToken: input.openworkClientToken ?? null,
+    openworkHostToken: input.openworkHostToken ?? null,
+    openworkWorkspaceId: input.openworkWorkspaceId ?? null,
+    openworkWorkspaceName: input.openworkWorkspaceName ?? null,
+    sandboxBackend: input.sandboxBackend ?? null,
+    sandboxRunId: input.sandboxRunId ?? null,
+    sandboxContainerName: input.sandboxContainerName ?? null,
+  });
+}
+
+export async function workspaceUpdateRemote(input: {
+  workspaceId: string;
+  baseUrl?: string | null;
+  directory?: string | null;
+  displayName?: string | null;
+  remoteType?: "openwork" | "opencode" | null;
+  openworkHostUrl?: string | null;
+  openworkToken?: string | null;
+  openworkClientToken?: string | null;
+  openworkHostToken?: string | null;
+  openworkWorkspaceId?: string | null;
+  openworkWorkspaceName?: string | null;
+
+  // Sandbox lifecycle metadata (desktop-managed)
+  sandboxBackend?: "docker" | "microsandbox" | null;
+  sandboxRunId?: string | null;
+  sandboxContainerName?: string | null;
+}): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_update_remote", {
+    workspaceId: input.workspaceId,
+    baseUrl: input.baseUrl ?? null,
+    directory: input.directory ?? null,
+    displayName: input.displayName ?? null,
+    remoteType: input.remoteType ?? null,
+    openworkHostUrl: input.openworkHostUrl ?? null,
+    openworkToken: input.openworkToken ?? null,
+    openworkClientToken: input.openworkClientToken ?? null,
+    openworkHostToken: input.openworkHostToken ?? null,
+    openworkWorkspaceId: input.openworkWorkspaceId ?? null,
+    openworkWorkspaceName: input.openworkWorkspaceName ?? null,
+    sandboxBackend: input.sandboxBackend ?? null,
+    sandboxRunId: input.sandboxRunId ?? null,
+    sandboxContainerName: input.sandboxContainerName ?? null,
+  });
+}
+
+export async function workspaceUpdateDisplayName(input: {
+  workspaceId: string;
+  displayName?: string | null;
+}): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_update_display_name", {
+    workspaceId: input.workspaceId,
+    displayName: input.displayName ?? null,
+  });
+}
+
+export async function workspaceForget(workspaceId: string): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_forget", { workspaceId });
+}
+
+export async function workspaceAddAuthorizedRoot(input: {
+  workspacePath: string;
+  folderPath: string;
+}): Promise<ExecResult> {
+  return invoke<ExecResult>("workspace_add_authorized_root", {
+    workspacePath: input.workspacePath,
+    folderPath: input.folderPath,
+  });
+}
+
+export async function workspaceExportConfig(input: {
+  workspaceId: string;
+  outputPath: string;
+}): Promise<WorkspaceExportSummary> {
+  return invoke<WorkspaceExportSummary>("workspace_export_config", {
+    workspaceId: input.workspaceId,
+    outputPath: input.outputPath,
+  });
+}
+
+export async function workspaceImportConfig(input: {
+  archivePath: string;
+  targetDir: string;
+  name?: string | null;
+}): Promise<WorkspaceList> {
+  return invoke<WorkspaceList>("workspace_import_config", {
+    archivePath: input.archivePath,
+    targetDir: input.targetDir,
+    name: input.name ?? null,
+  });
+}
+
+export type OpencodeCommandDraft = {
+  name: string;
+  description?: string;
+  template: string;
+  agent?: string;
+  model?: string;
+  subtask?: boolean;
+};
+
+export type WorkspaceOpenworkConfig = {
+  version: number;
+  workspace?: {
+    name?: string | null;
+    createdAt?: number | null;
+    preset?: string | null;
+  } | null;
+  authorizedRoots: string[];
+  reload?: {
+    auto?: boolean;
+    resume?: boolean;
+  } | null;
+};
+
+export async function workspaceOpenworkRead(input: {
+  workspacePath: string;
+}): Promise<WorkspaceOpenworkConfig> {
+  return invoke<WorkspaceOpenworkConfig>("workspace_openwork_read", {
+    workspacePath: input.workspacePath,
+  });
+}
+
+export async function workspaceOpenworkWrite(input: {
+  workspacePath: string;
+  config: WorkspaceOpenworkConfig;
+}): Promise<ExecResult> {
+  return invoke<ExecResult>("workspace_openwork_write", {
+    workspacePath: input.workspacePath,
+    config: input.config,
+  });
+}
+
+export async function opencodeCommandList(input: {
+  scope: "workspace" | "global";
+  projectDir: string;
+}): Promise<string[]> {
+  return invoke<string[]>("opencode_command_list", {
+    scope: input.scope,
+    projectDir: input.projectDir,
+  });
+}
+
+export async function opencodeCommandWrite(input: {
+  scope: "workspace" | "global";
+  projectDir: string;
+  command: OpencodeCommandDraft;
+}): Promise<ExecResult> {
+  return invoke<ExecResult>("opencode_command_write", {
+    scope: input.scope,
+    projectDir: input.projectDir,
+    command: input.command,
+  });
+}
+
+export async function opencodeCommandDelete(input: {
+  scope: "workspace" | "global";
+  projectDir: string;
+  name: string;
+}): Promise<ExecResult> {
+  return invoke<ExecResult>("opencode_command_delete", {
+    scope: input.scope,
+    projectDir: input.projectDir,
+    name: input.name,
+  });
+}
+
+export async function engineStop(): Promise<EngineInfo> {
+  return invoke<EngineInfo>("engine_stop");
+}
+
+export async function engineRestart(options?: {
+  opencodeEnableExa?: boolean;
+  openworkRemoteAccess?: boolean;
+}): Promise<EngineInfo> {
+  return invoke<EngineInfo>("engine_restart", {
+    opencodeEnableExa: options?.opencodeEnableExa ?? null,
+    openworkRemoteAccess: options?.openworkRemoteAccess ?? null,
+  });
+}
+
+export type AppBuildInfo = {
+  version: string;
+  gitSha?: string | null;
+  buildEpoch?: string | null;
+  openworkDevMode?: boolean;
+  os?: string | null;
+  arch?: string | null;
+};
+
+export type DesktopBootstrapConfig = {
+  baseUrl: string;
+  apiBaseUrl?: string | null;
+  requireSignin: boolean;
+};
+
+export async function appBuildInfo(): Promise<AppBuildInfo> {
+  return invoke<AppBuildInfo>("app_build_info");
+}
+
+export async function getDesktopBootstrapConfig(): Promise<DesktopBootstrapConfig> {
+  return invoke<DesktopBootstrapConfig>("get_desktop_bootstrap_config");
+}
+
+export async function setDesktopBootstrapConfig(
+  config: DesktopBootstrapConfig,
+): Promise<DesktopBootstrapConfig> {
+  return invoke<DesktopBootstrapConfig>("set_desktop_bootstrap_config", { config });
+}
+
+export async function nukeOpenworkAndOpencodeConfigAndExit(): Promise<void> {
+  return invoke<void>("nuke_openwork_and_opencode_config_and_exit");
+}
+
+export type OrchestratorDetachedHost = {
+  openworkUrl: string;
+  token: string;
+  ownerToken?: string | null;
+  hostToken: string;
+  port: number;
+  sandboxBackend?: "docker" | "microsandbox" | null;
+  sandboxRunId?: string | null;
+  sandboxContainerName?: string | null;
+};
+
+export async function orchestratorStartDetached(input: {
+  workspacePath: string;
+  sandboxBackend?: "none" | "docker" | "microsandbox" | null;
+  sandboxImageRef?: string | null;
+  runId?: string | null;
+  openworkToken?: string | null;
+  openworkHostToken?: string | null;
+}): Promise<OrchestratorDetachedHost> {
+  return invoke<OrchestratorDetachedHost>("orchestrator_start_detached", {
+    workspacePath: input.workspacePath,
+    sandboxBackend: input.sandboxBackend ?? null,
+    sandboxImageRef: input.sandboxImageRef ?? null,
+    runId: input.runId ?? null,
+    openworkToken: input.openworkToken ?? null,
+    openworkHostToken: input.openworkHostToken ?? null,
+  });
+}
+
+export type SandboxDoctorResult = {
+  installed: boolean;
+  daemonRunning: boolean;
+  permissionOk: boolean;
+  ready: boolean;
+  clientVersion?: string | null;
+  serverVersion?: string | null;
+  error?: string | null;
+  debug?: {
+    candidates: string[];
+    selectedBin?: string | null;
+    versionCommand?: {
+      status: number;
+      stdout: string;
+      stderr: string;
+    } | null;
+    infoCommand?: {
+      status: number;
+      stdout: string;
+      stderr: string;
+    } | null;
+  } | null;
+};
+
+export async function sandboxDoctor(): Promise<SandboxDoctorResult> {
+  return invoke<SandboxDoctorResult>("sandbox_doctor");
+}
+
+export async function sandboxStop(containerName: string): Promise<ExecResult> {
+  return invoke<ExecResult>("sandbox_stop", { containerName });
+}
+
+export type OpenworkDockerCleanupResult = {
+  candidates: string[];
+  removed: string[];
+  errors: string[];
+};
+
+export async function sandboxCleanupOpenworkContainers(): Promise<OpenworkDockerCleanupResult> {
+  return invoke<OpenworkDockerCleanupResult>("sandbox_cleanup_openwork_containers");
+}
+
+export type SandboxDebugProbeResult = {
+  startedAt: number;
+  finishedAt: number;
+  runId: string;
+  workspacePath: string;
+  ready: boolean;
+  doctor: SandboxDoctorResult;
+  detachedHost?: OrchestratorDetachedHost | null;
+  dockerInspect?: {
+    status: number;
+    stdout: string;
+    stderr: string;
+  } | null;
+  dockerLogs?: {
+    status: number;
+    stdout: string;
+    stderr: string;
+  } | null;
+  cleanup: {
+    containerName?: string | null;
+    containerRemoved: boolean;
+    removeResult?: {
+      status: number;
+      stdout: string;
+      stderr: string;
+    } | null;
+    workspaceRemoved: boolean;
+    errors: string[];
+  };
+  error?: string | null;
+};
+
+export async function sandboxDebugProbe(): Promise<SandboxDebugProbeResult> {
+  return invoke<SandboxDebugProbeResult>("sandbox_debug_probe");
+}
+
+export async function openworkServerInfo(): Promise<OpenworkServerInfo> {
+  return invoke<OpenworkServerInfo>("openwork_server_info");
+}
+
+export async function openworkServerRestart(options?: {
+  remoteAccessEnabled?: boolean;
+}): Promise<OpenworkServerInfo> {
+  return invoke<OpenworkServerInfo>("openwork_server_restart", {
+    remoteAccessEnabled: options?.remoteAccessEnabled ?? null,
+  });
+}
+
+export async function engineInfo(): Promise<EngineInfo> {
+  return invoke<EngineInfo>("engine_info");
+}
+
+export async function runtimeBootstrap(): Promise<unknown> {
+  return {
+    ok: true,
+    skipped: true,
+    reason: "unsupported-runtime",
+  };
+}
+
+export async function engineDoctor(options?: {
+  preferSidecar?: boolean;
+  opencodeBinPath?: string | null;
+}): Promise<EngineDoctorResult> {
+  return invoke<EngineDoctorResult>("engine_doctor", {
+    preferSidecar: options?.preferSidecar ?? true,
+    opencodeBinPath: options?.opencodeBinPath ?? null,
+  });
+}
+
+export async function pickDirectory(options?: {
+  title?: string;
+  defaultPath?: string;
+  multiple?: boolean;
+}): Promise<string | string[] | null> {
+  const { open } = await import("@tauri-apps/plugin-dialog");
+  return open({
+    title: options?.title,
+    defaultPath: options?.defaultPath,
+    directory: true,
+    canCreateDirectories: true,
+    multiple: options?.multiple,
+  });
+}
+
+export async function pickFile(options?: {
+  title?: string;
+  defaultPath?: string;
+  multiple?: boolean;
+  filters?: Array<{ name: string; extensions: string[] }>;
+}): Promise<string | string[] | null> {
+  const { open } = await import("@tauri-apps/plugin-dialog");
+  return open({
+    title: options?.title,
+    defaultPath: options?.defaultPath,
+    directory: false,
+    multiple: options?.multiple,
+    filters: options?.filters,
+  });
+}
+
+export async function saveFile(options?: {
+  title?: string;
+  defaultPath?: string;
+  filters?: Array<{ name: string; extensions: string[] }>;
+}): Promise<string | null> {
+  const { save } = await import("@tauri-apps/plugin-dialog");
+  return save({
+    title: options?.title,
+    defaultPath: options?.defaultPath,
+    filters: options?.filters,
+  });
+}
+
+export type ExecResult = {
+  ok: boolean;
+  status: number;
+  stdout: string;
+  stderr: string;
+};
+
+export async function engineInstall(): Promise<ExecResult> {
+  return invoke<ExecResult>("engine_install");
+}
+
+export async function importSkill(
+  projectDir: string,
+  sourceDir: string,
+  options?: { overwrite?: boolean },
+): Promise<ExecResult> {
+  return invoke<ExecResult>("import_skill", {
+    projectDir,
+    sourceDir,
+    overwrite: options?.overwrite ?? false,
+  });
+}
+
+export async function installSkillTemplate(
+  projectDir: string,
+  name: string,
+  content: string,
+  options?: { overwrite?: boolean },
+): Promise<ExecResult> {
+  return invoke<ExecResult>("install_skill_template", {
+    projectDir,
+    name,
+    content,
+    overwrite: options?.overwrite ?? false,
+  });
+}
+
+export type LocalSkillCard = {
+  name: string;
+  path: string;
+  description?: string;
+  trigger?: string;
+};
+
+export type LocalSkillContent = {
+  path: string;
+  content: string;
+};
+
+export async function listLocalSkills(projectDir: string): Promise<LocalSkillCard[]> {
+  return invoke<LocalSkillCard[]>("list_local_skills", { projectDir });
+}
+
+export async function readLocalSkill(projectDir: string, name: string): Promise<LocalSkillContent> {
+  return invoke<LocalSkillContent>("read_local_skill", { projectDir, name });
+}
+
+export async function writeLocalSkill(projectDir: string, name: string, content: string): Promise<ExecResult> {
+  return invoke<ExecResult>("write_local_skill", { projectDir, name, content });
+}
+
+export async function uninstallSkill(projectDir: string, name: string): Promise<ExecResult> {
+  return invoke<ExecResult>("uninstall_skill", { projectDir, name });
+}
+
+export type OpencodeConfigFile = {
+  path: string;
+  exists: boolean;
+  content: string | null;
+};
+
+export type UpdaterEnvironment = {
+  supported: boolean;
+  reason: string | null;
+  executablePath: string | null;
+  appBundlePath: string | null;
+};
+
+export async function updaterEnvironment(): Promise<UpdaterEnvironment> {
+  return invoke<UpdaterEnvironment>("updater_environment");
+}
+
+export async function readOpencodeConfig(
+  scope: "project" | "global",
+  projectDir: string,
+): Promise<OpencodeConfigFile> {
+  return invoke<OpencodeConfigFile>("read_opencode_config", { scope, projectDir });
+}
+
+export async function writeOpencodeConfig(
+  scope: "project" | "global",
+  projectDir: string,
+  content: string,
+): Promise<ExecResult> {
+  return invoke<ExecResult>("write_opencode_config", { scope, projectDir, content });
+}
+
+export async function resetOpenworkState(mode: "onboarding" | "all"): Promise<void> {
+  return invoke<void>("reset_openwork_state", { mode });
+}
+
+export type CacheResetResult = {
+  removed: string[];
+  missing: string[];
+  errors: string[];
+};
+
+export async function resetOpencodeCache(): Promise<CacheResetResult> {
+  return invoke<CacheResetResult>("reset_opencode_cache");
+}
+
+export async function opencodeMcpAuth(
+  projectDir: string,
+  serverName: string,
+): Promise<ExecResult> {
+  const safeProjectDir = projectDir.trim();
+  if (!safeProjectDir) {
+    throw new Error("project_dir is required");
+  }
+
+  const safeServerName = validateMcpServerName(serverName);
+
+  return invoke<ExecResult>("opencode_mcp_auth", {
+    projectDir: safeProjectDir,
+    serverName: safeServerName,
+  });
+}
+
+/**
+ * Set window decorations (titlebar) visibility.
+ * When `decorations` is false, the native titlebar is hidden.
+ * Useful for tiling window managers on Linux (e.g., Hyprland, i3, sway).
+ */
+export async function setWindowDecorations(decorations: boolean): Promise<void> {
+  return invoke<void>("set_window_decorations", { decorations });
+}
diff --git a/apps/app/src/app/lib/desktop.ts b/apps/app/src/app/lib/desktop.ts
new file mode 100644
index 0000000000..dd4a2b9546
--- /dev/null
+++ b/apps/app/src/app/lib/desktop.ts
@@ -0,0 +1,348 @@
+import * as tauriBridge from "./desktop-tauri";
+import { nativeDeepLinkEvent } from "./deep-link-bridge";
+
+export type * from "./desktop-tauri";
+
+export type DesktopBridge = typeof tauriBridge;
+
+declare global {
+  interface Window {
+    __OPENWORK_ELECTRON__?: {
+      bridge?: Partial<DesktopBridge>;
+      invokeDesktop?: (command: string, ...args: unknown[]) => Promise<unknown>;
+      shell?: {
+        openExternal?: (url: string) => Promise<void>;
+        relaunch?: () => Promise<void>;
+      };
+      migration?: {
+        readSnapshot?: () => Promise<unknown>;
+        ackSnapshot?: () => Promise<{ ok: boolean; moved: boolean }>;
+      };
+      updater?: {
+        getChannel?: () => Promise<{
+          channel: "stable" | "alpha";
+          feedUrl: string;
+          currentVersion: string;
+        }>;
+        setChannel?: (channel: "stable" | "alpha") => Promise<{
+          channel: "stable" | "alpha";
+          feedUrl: string;
+          currentVersion: string;
+        }>;
+        check?: () => Promise<{
+          available: boolean;
+          currentVersion?: string;
+          latestVersion?: string | null;
+          releaseDate?: string | null;
+          releaseNotes?: unknown;
+          channel?: "stable" | "alpha";
+          feedUrl?: string;
+          reason?: string;
+        }>;
+        download?: () => Promise<{ ok: boolean; reason?: string }>;
+        installAndRestart?: () => Promise<{ ok: boolean; reason?: string }>;
+      };
+      meta?: {
+        initialDeepLinks?: string[];
+        platform?: "darwin" | "linux" | "windows";
+        version?: string;
+      };
+    };
+  }
+}
+
+function missingElectronMethod(method: string): never {
+  throw new Error(`Electron desktop bridge method is not implemented yet: ${method}`);
+}
+
+function isElectronDesktopRuntime() {
+  return typeof window !== "undefined" && window.__OPENWORK_ELECTRON__ != null;
+}
+
+function isTauriDesktopRuntime() {
+  return typeof window !== "undefined" && (window as any).__TAURI_INTERNALS__ != null;
+}
+
+async function invokeElectronHelper<T>(command: string, ...args: unknown[]): Promise<T> {
+  const invokeDesktop = window.__OPENWORK_ELECTRON__?.invokeDesktop;
+  if (!invokeDesktop) {
+    throw new Error(`Electron desktop helper is unavailable: ${command}`);
+  }
+  return (await invokeDesktop(command, ...args)) as T;
+}
+
+function resolveElectronBridge(): DesktopBridge {
+  const exposed = window.__OPENWORK_ELECTRON__?.bridge ?? {};
+  const invokeDesktop = window.__OPENWORK_ELECTRON__?.invokeDesktop;
+  return new Proxy(exposed as DesktopBridge, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (value != null) {
+        return value;
+      }
+
+      if (prop === "resolveWorkspaceListSelectedId") {
+        return tauriBridge.resolveWorkspaceListSelectedId;
+      }
+
+      if (typeof prop === "string" && invokeDesktop) {
+        return (...args: unknown[]) => invokeDesktop(prop, ...args);
+      }
+
+      if (typeof prop === "string") {
+        return (..._args: unknown[]) => missingElectronMethod(prop);
+      }
+
+      return value;
+    },
+  });
+}
+
+function resolveDesktopBridge(): DesktopBridge {
+  if (
+    typeof window !== "undefined" &&
+    (window.__OPENWORK_ELECTRON__?.bridge || window.__OPENWORK_ELECTRON__?.invokeDesktop)
+  ) {
+    return resolveElectronBridge();
+  }
+  return tauriBridge;
+}
+
+export const desktopBridge: DesktopBridge = new Proxy({} as DesktopBridge, {
+  get(_target, prop, receiver) {
+    return Reflect.get(resolveDesktopBridge(), prop, receiver);
+  },
+});
+
+function isLoopbackUrl(input: RequestInfo | URL): boolean {
+  const raw = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+  try {
+    const url = new URL(raw);
+    return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+
+export const desktopFetch: typeof globalThis.fetch = (input, init) => {
+  if (isElectronDesktopRuntime()) {
+    if (isLoopbackUrl(input)) {
+      return globalThis.fetch(input, init);
+    }
+
+    return invokeElectronHelper<{
+      status: number;
+      statusText: string;
+      headers: [string, string][];
+      body: string;
+    }>("__fetch", typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url, {
+      method: init?.method,
+      headers: init?.headers ? Object.fromEntries(new Headers(init.headers).entries()) : undefined,
+      body: typeof init?.body === "string" ? init.body : undefined,
+    }).then(
+      (result) =>
+        new Response(result.body, {
+          status: result.status,
+          statusText: result.statusText,
+          headers: result.headers,
+        }),
+    );
+  }
+  return tauriBridge.desktopFetch(input, init);
+};
+
+export async function openDesktopUrl(url: string): Promise<void> {
+  if (isElectronDesktopRuntime()) {
+    const openExternal = window.__OPENWORK_ELECTRON__?.shell?.openExternal;
+    if (openExternal) {
+      await openExternal(url);
+      return;
+    }
+  }
+  if (isTauriDesktopRuntime()) {
+    await tauriBridge.openDesktopUrl(url);
+    return;
+  }
+  if (typeof window !== "undefined") {
+    window.open(url, "_blank", "noopener,noreferrer");
+  }
+}
+
+export async function openDesktopPath(target: string): Promise<void> {
+  if (isElectronDesktopRuntime()) {
+    const result = await invokeElectronHelper<string | null>("__openPath", target);
+    if (typeof result === "string" && result.trim()) {
+      throw new Error(result);
+    }
+    return;
+  }
+  await tauriBridge.openDesktopPath(target);
+}
+
+export async function revealDesktopItemInDir(target: string): Promise<void> {
+  if (isElectronDesktopRuntime()) {
+    await invokeElectronHelper<void>("__revealItemInDir", target);
+    return;
+  }
+  await tauriBridge.revealDesktopItemInDir(target);
+}
+
+export async function relaunchDesktopApp(): Promise<void> {
+  if (isElectronDesktopRuntime()) {
+    await window.__OPENWORK_ELECTRON__?.shell?.relaunch?.();
+    return;
+  }
+  await tauriBridge.relaunchDesktopApp();
+}
+
+export async function getDesktopHomeDir(): Promise<string> {
+  if (isElectronDesktopRuntime()) {
+    return invokeElectronHelper<string>("__homeDir");
+  }
+  return tauriBridge.getDesktopHomeDir();
+}
+
+export async function joinDesktopPath(...parts: string[]): Promise<string> {
+  if (isElectronDesktopRuntime()) {
+    return invokeElectronHelper<string>("__joinPath", ...parts);
+  }
+  return tauriBridge.joinDesktopPath(...parts);
+}
+
+export async function setDesktopZoomFactor(value: number): Promise<boolean> {
+  if (isElectronDesktopRuntime()) {
+    return invokeElectronHelper<boolean>("__setZoomFactor", value);
+  }
+  return tauriBridge.setDesktopZoomFactor(value);
+}
+
+export async function subscribeDesktopDeepLinks(
+  handler: (urls: string[]) => void,
+): Promise<() => void> {
+  if (isElectronDesktopRuntime()) {
+    const listener = (event: Event) => {
+      const customEvent = event as CustomEvent<string[]>;
+      if (Array.isArray(customEvent.detail)) {
+        handler(customEvent.detail);
+      }
+    };
+    window.addEventListener(nativeDeepLinkEvent, listener as EventListener);
+    const initialUrls = window.__OPENWORK_ELECTRON__?.meta?.initialDeepLinks;
+    if (Array.isArray(initialUrls) && initialUrls.length > 0) {
+      handler(initialUrls);
+    }
+    return () => {
+      window.removeEventListener(nativeDeepLinkEvent, listener as EventListener);
+    };
+  }
+
+  return tauriBridge.subscribeDesktopDeepLinks(handler);
+}
+
+const {
+  resolveWorkspaceListSelectedId,
+  engineStart,
+  workspaceBootstrap,
+  workspaceSetSelected,
+  workspaceSetRuntimeActive,
+  workspaceCreate,
+  workspaceCreateRemote,
+  workspaceUpdateRemote,
+  workspaceUpdateDisplayName,
+  workspaceForget,
+  workspaceAddAuthorizedRoot,
+  workspaceExportConfig,
+  workspaceImportConfig,
+  workspaceOpenworkRead,
+  workspaceOpenworkWrite,
+  opencodeCommandList,
+  opencodeCommandWrite,
+  opencodeCommandDelete,
+  engineStop,
+  engineRestart,
+  appBuildInfo,
+  getDesktopBootstrapConfig,
+  setDesktopBootstrapConfig,
+  nukeOpenworkAndOpencodeConfigAndExit,
+  orchestratorStartDetached,
+  sandboxDoctor,
+  sandboxStop,
+  sandboxCleanupOpenworkContainers,
+  sandboxDebugProbe,
+  openworkServerInfo,
+  openworkServerRestart,
+  runtimeBootstrap,
+  engineInfo,
+  engineDoctor,
+  pickDirectory,
+  pickFile,
+  saveFile,
+  engineInstall,
+  importSkill,
+  installSkillTemplate,
+  listLocalSkills,
+  readLocalSkill,
+  writeLocalSkill,
+  uninstallSkill,
+  updaterEnvironment,
+  readOpencodeConfig,
+  writeOpencodeConfig,
+  resetOpenworkState,
+  resetOpencodeCache,
+  opencodeMcpAuth,
+  setWindowDecorations,
+} = desktopBridge;
+
+export {
+  resolveWorkspaceListSelectedId,
+  engineStart,
+  workspaceBootstrap,
+  workspaceSetSelected,
+  workspaceSetRuntimeActive,
+  workspaceCreate,
+  workspaceCreateRemote,
+  workspaceUpdateRemote,
+  workspaceUpdateDisplayName,
+  workspaceForget,
+  workspaceAddAuthorizedRoot,
+  workspaceExportConfig,
+  workspaceImportConfig,
+  workspaceOpenworkRead,
+  workspaceOpenworkWrite,
+  opencodeCommandList,
+  opencodeCommandWrite,
+  opencodeCommandDelete,
+  engineStop,
+  engineRestart,
+  appBuildInfo,
+  getDesktopBootstrapConfig,
+  setDesktopBootstrapConfig,
+  nukeOpenworkAndOpencodeConfigAndExit,
+  orchestratorStartDetached,
+  sandboxDoctor,
+  sandboxStop,
+  sandboxCleanupOpenworkContainers,
+  sandboxDebugProbe,
+  openworkServerInfo,
+  openworkServerRestart,
+  runtimeBootstrap,
+  engineInfo,
+  engineDoctor,
+  pickDirectory,
+  pickFile,
+  saveFile,
+  engineInstall,
+  importSkill,
+  installSkillTemplate,
+  listLocalSkills,
+  readLocalSkill,
+  writeLocalSkill,
+  uninstallSkill,
+  updaterEnvironment,
+  readOpencodeConfig,
+  writeOpencodeConfig,
+  resetOpenworkState,
+  resetOpencodeCache,
+  opencodeMcpAuth,
+  setWindowDecorations,
+};
diff --git a/apps/app/src/app/lib/dev-log.ts b/apps/app/src/app/lib/dev-log.ts
new file mode 100644
index 0000000000..25594a55e2
--- /dev/null
+++ b/apps/app/src/app/lib/dev-log.ts
@@ -0,0 +1,88 @@
+export type DevLogLevel = "debug" | "warn" | "perf";
+
+export type DevLogRecord = {
+  id: number;
+  at: string;
+  ts: number;
+  level: DevLogLevel;
+  source: string;
+  label: string;
+  payload?: unknown;
+};
+
+type DevRoot = typeof globalThis & {
+  __openworkDevLogSeq?: number;
+  __openworkDevLogs?: DevLogRecord[];
+};
+
+const DEV_LOG_LIMIT = 1500;
+
+const payloadText = (value: unknown) => {
+  if (value === undefined) return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+};
+
+export const recordDevLog = (
+  enabled: boolean,
+  input: {
+    level: DevLogLevel;
+    source: string;
+    label: string;
+    payload?: unknown;
+  },
+) => {
+  if (!enabled) return;
+
+  const root = globalThis as DevRoot;
+  const id = (root.__openworkDevLogSeq ?? 0) + 1;
+  root.__openworkDevLogSeq = id;
+
+  const entry: DevLogRecord = {
+    id,
+    at: new Date().toISOString(),
+    ts: Date.now(),
+    level: input.level,
+    source: input.source,
+    label: input.label,
+    payload: input.payload,
+  };
+
+  const logs = root.__openworkDevLogs ?? [];
+  logs.push(entry);
+  if (logs.length > DEV_LOG_LIMIT) {
+    logs.splice(0, logs.length - DEV_LOG_LIMIT);
+  }
+  root.__openworkDevLogs = logs;
+};
+
+export const readDevLogs = (limit = 200) => {
+  const root = globalThis as DevRoot;
+  const logs = root.__openworkDevLogs ?? [];
+  if (limit === 0) return logs.slice();
+  if (limit < 0) return [];
+  if (logs.length <= limit) return logs.slice();
+  return logs.slice(logs.length - limit);
+};
+
+export const clearDevLogs = () => {
+  const root = globalThis as DevRoot;
+  root.__openworkDevLogs = [];
+  root.__openworkDevLogSeq = 0;
+};
+
+export const formatDevLogLine = (entry: DevLogRecord) => {
+  const prefix = `[${entry.at}] ${entry.level.toUpperCase()} ${entry.source}:${entry.label}`;
+  const text = payloadText(entry.payload);
+  return text ? `${prefix} ${text}` : prefix;
+};
+
+export const formatDevLogText = (limit = 200) => {
+  const lines = readDevLogs(limit).map(formatDevLogLine);
+  if (!lines.length) return "";
+  return `${lines.join("\n")}\n`;
+};
diff --git a/apps/app/src/app/lib/electron-alpha.ts b/apps/app/src/app/lib/electron-alpha.ts
new file mode 100644
index 0000000000..5e30fbc6e9
--- /dev/null
+++ b/apps/app/src/app/lib/electron-alpha.ts
@@ -0,0 +1,80 @@
+import { desktopFetch } from "./desktop";
+
+export type ElectronAlphaArtifact = {
+  arch: "arm64" | "x64";
+  manifestUrl: string;
+  releaseUrl: string;
+  url: string;
+  path: string;
+  version: string;
+  sha512: string;
+};
+
+const ELECTRON_ALPHA_RELEASE_BASE_URL =
+  "https://github.com/different-ai/openwork/releases/download/alpha-macos-latest";
+
+export const ELECTRON_ALPHA_RELEASE_PAGE_URL =
+  "https://github.com/different-ai/openwork/releases/tag/alpha-macos-latest";
+
+export const ELECTRON_ALPHA_LATEST_MAC_YML_URL = `${ELECTRON_ALPHA_RELEASE_BASE_URL}/latest-mac.yml`;
+
+function parseYamlScalar(raw: string, key: string): string | null {
+  const pattern = new RegExp(`^\\s*${key}:\\s*(.+?)\\s*$`, "m");
+  const match = raw.match(pattern);
+  if (!match?.[1]) return null;
+  return match[1].trim().replace(/^['"]|['"]$/g, "");
+}
+
+function parseFirstFileUrl(raw: string): string | null {
+  const match = raw.match(/^\s*-\s+url:\s*(.+?)\s*$/m);
+  if (!match?.[1]) return null;
+  return match[1].trim().replace(/^['"]|['"]$/g, "");
+}
+
+function resolveArtifactUrl(pathOrUrl: string): string {
+  if (/^https:\/\//i.test(pathOrUrl)) return pathOrUrl;
+  return new URL(pathOrUrl, `${ELECTRON_ALPHA_RELEASE_BASE_URL}/`).toString();
+}
+
+export function parseElectronLatestMacYml(
+  raw: string,
+  arch: "arm64" | "x64",
+): ElectronAlphaArtifact {
+  const version = parseYamlScalar(raw, "version");
+  const path = parseYamlScalar(raw, "path") ?? parseFirstFileUrl(raw);
+  const sha512 = parseYamlScalar(raw, "sha512");
+
+  if (!version) {
+    throw new Error("latest-mac.yml is missing version.");
+  }
+  if (!path) {
+    throw new Error("latest-mac.yml is missing artifact path/url.");
+  }
+  if (!sha512) {
+    throw new Error("latest-mac.yml is missing sha512.");
+  }
+
+  return {
+    arch,
+    manifestUrl: ELECTRON_ALPHA_LATEST_MAC_YML_URL,
+    releaseUrl: ELECTRON_ALPHA_RELEASE_PAGE_URL,
+    url: resolveArtifactUrl(path),
+    path,
+    version,
+    sha512,
+  };
+}
+
+export async function resolveElectronAlphaArtifact(
+  arch: "arm64" | "x64" = "arm64",
+): Promise<ElectronAlphaArtifact> {
+  const response = await desktopFetch(ELECTRON_ALPHA_LATEST_MAC_YML_URL, {
+    headers: { Accept: "text/yaml, text/plain, */*" },
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch latest-mac.yml (${response.status} ${response.statusText}).`,
+    );
+  }
+  return parseElectronLatestMacYml(await response.text(), arch);
+}
diff --git a/apps/app/src/app/lib/feedback.ts b/apps/app/src/app/lib/feedback.ts
new file mode 100644
index 0000000000..5eb0c16a91
--- /dev/null
+++ b/apps/app/src/app/lib/feedback.ts
@@ -0,0 +1,109 @@
+const ENV_FEEDBACK_URL = String(import.meta.env.VITE_OPENWORK_FEEDBACK_URL ?? "").trim();
+const ENV_APP_VERSION = String(import.meta.env.VITE_OPENWORK_APP_VERSION ?? "").trim();
+
+export const DEFAULT_FEEDBACK_URL =
+  ENV_FEEDBACK_URL || "https://openworklabs.com/feedback";
+
+type FeedbackUrlOptions = {
+  entrypoint: string;
+  deployment?: string | null;
+  appVersion?: string | null;
+  openworkServerVersion?: string | null;
+  opencodeVersion?: string | null;
+  orchestratorVersion?: string | null;
+};
+
+type ClientOsContext = {
+  osName?: string;
+  osVersion?: string;
+  platform?: string;
+};
+
+function parseClientOsContext(): ClientOsContext {
+  if (typeof navigator === "undefined") return {};
+
+  const platform =
+    typeof (navigator as Navigator & { userAgentData?: { platform?: string } }).userAgentData
+      ?.platform === "string"
+      ? (navigator as Navigator & { userAgentData?: { platform?: string } }).userAgentData?.platform?.trim() ?? ""
+      : typeof navigator.platform === "string"
+        ? navigator.platform.trim()
+        : "";
+  const userAgent =
+    typeof navigator.userAgent === "string" ? navigator.userAgent : "";
+
+  const macMatch = userAgent.match(/Mac OS X ([0-9_]+)/i);
+  if (macMatch) {
+    return {
+      osName: "macOS",
+      osVersion: macMatch[1]?.replace(/_/g, "."),
+      platform,
+    };
+  }
+
+  const windowsMatch = userAgent.match(/Windows NT ([0-9.]+)/i);
+  if (windowsMatch) {
+    const rawVersion = windowsMatch[1] ?? "";
+    const mappedVersion =
+      rawVersion === "10.0" ? "10/11" : rawVersion || undefined;
+    return {
+      osName: "Windows",
+      osVersion: mappedVersion,
+      platform,
+    };
+  }
+
+  const iosMatch = userAgent.match(/(?:iPhone|iPad|iPod).*OS ([0-9_]+)/i);
+  if (iosMatch) {
+    return {
+      osName: "iOS",
+      osVersion: iosMatch[1]?.replace(/_/g, "."),
+      platform,
+    };
+  }
+
+  const androidMatch = userAgent.match(/Android ([0-9.]+)/i);
+  if (androidMatch) {
+    return {
+      osName: "Android",
+      osVersion: androidMatch[1],
+      platform,
+    };
+  }
+
+  if (/Linux/i.test(userAgent) || /Linux/i.test(platform)) {
+    return {
+      osName: "Linux",
+      platform,
+    };
+  }
+
+  return platform ? { platform } : {};
+}
+
+export function buildFeedbackUrl(options: FeedbackUrlOptions): string {
+  const url = new URL(DEFAULT_FEEDBACK_URL);
+  const osContext = parseClientOsContext();
+
+  url.searchParams.set("source", "openwork-app");
+  url.searchParams.set("entrypoint", options.entrypoint);
+
+  const entries = {
+    deployment: options.deployment?.trim() ?? "",
+    appVersion: options.appVersion?.trim() || ENV_APP_VERSION,
+    openworkServerVersion: options.openworkServerVersion?.trim() ?? "",
+    opencodeVersion: options.opencodeVersion?.trim() ?? "",
+    orchestratorVersion: options.orchestratorVersion?.trim() ?? "",
+    osName: osContext.osName?.trim() ?? "",
+    osVersion: osContext.osVersion?.trim() ?? "",
+    platform: osContext.platform?.trim() ?? "",
+  };
+
+  for (const [key, value] of Object.entries(entries)) {
+    if (value) {
+      url.searchParams.set(key, value);
+    }
+  }
+
+  return url.toString();
+}
diff --git a/apps/app/src/app/lib/font-zoom.ts b/apps/app/src/app/lib/font-zoom.ts
new file mode 100644
index 0000000000..cf33f68ca2
--- /dev/null
+++ b/apps/app/src/app/lib/font-zoom.ts
@@ -0,0 +1,82 @@
+export const FONT_ZOOM_STORAGE_KEY = "openwork.desktop-font-zoom.v1";
+export const FONT_ZOOM_BASE_PX = 16;
+export const FONT_ZOOM_STEP = 0.1;
+export const FONT_ZOOM_MIN = 0.8;
+export const FONT_ZOOM_MAX = 1.6;
+
+export type FontZoomShortcutAction = "in" | "out" | "reset";
+export type FontZoomTarget = { setZoom: (scaleFactor: number) => Promise<void> };
+
+export function clampFontZoom(value: number): number {
+  return Math.min(FONT_ZOOM_MAX, Math.max(FONT_ZOOM_MIN, value));
+}
+
+export function normalizeFontZoom(value: number): number {
+  return Math.round(clampFontZoom(value) * 100) / 100;
+}
+
+export function parseFontZoomShortcut(event: {
+  key: string;
+  code: string;
+  metaKey: boolean;
+  ctrlKey: boolean;
+  altKey: boolean;
+}): FontZoomShortcutAction | null {
+  const mod = event.metaKey || event.ctrlKey;
+  if (!mod || event.altKey) return null;
+
+  if (
+    event.code === "Equal" ||
+    event.code === "NumpadAdd" ||
+    event.key === "+" ||
+    event.key === "="
+  ) {
+    return "in";
+  }
+  if (
+    event.code === "Minus" ||
+    event.code === "NumpadSubtract" ||
+    event.key === "-" ||
+    event.key === "_"
+  ) {
+    return "out";
+  }
+  if (event.code === "Digit0" || event.code === "Numpad0" || event.key === "0") {
+    return "reset";
+  }
+
+  return null;
+}
+
+export function readStoredFontZoom(storage: Pick<Storage, "getItem">): number | null {
+  try {
+    const raw = storage.getItem(FONT_ZOOM_STORAGE_KEY);
+    if (!raw) return null;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed)) return null;
+    return normalizeFontZoom(parsed);
+  } catch {
+    return null;
+  }
+}
+
+export function persistFontZoom(storage: Pick<Storage, "setItem">, value: number) {
+  try {
+    storage.setItem(FONT_ZOOM_STORAGE_KEY, String(value));
+  } catch {
+    // ignore storage failures
+  }
+}
+
+export function applyFontZoom(rootStyle: Pick<CSSStyleDeclaration, "setProperty">, value: number): number {
+  const normalized = normalizeFontZoom(value);
+  const px = FONT_ZOOM_BASE_PX * normalized;
+  rootStyle.setProperty("--openwork-font-size", `${px}px`);
+  return normalized;
+}
+
+export async function applyWebviewZoom(target: FontZoomTarget, value: number): Promise<number> {
+  const normalized = normalizeFontZoom(value);
+  await target.setZoom(normalized);
+  return normalized;
+}
diff --git a/apps/app/src/app/lib/local-file-path.impl.d.ts b/apps/app/src/app/lib/local-file-path.impl.d.ts
new file mode 100644
index 0000000000..34dc99ee87
--- /dev/null
+++ b/apps/app/src/app/lib/local-file-path.impl.d.ts
@@ -0,0 +1 @@
+export function normalizeLocalFilePath(value: unknown): string;
diff --git a/apps/app/src/app/lib/local-file-path.impl.js b/apps/app/src/app/lib/local-file-path.impl.js
new file mode 100644
index 0000000000..cbc660edbd
--- /dev/null
+++ b/apps/app/src/app/lib/local-file-path.impl.js
@@ -0,0 +1,33 @@
+const FILE_URI_PREFIX_RE = /^file:(?:\/\/)?/i;
+const WINDOWS_DRIVE_URI_PATH_RE = /^\/[A-Za-z]:\//;
+
+const safeDecodeURIComponent = (value) => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+export const normalizeLocalFilePath = (value) => {
+  const trimmed = String(value ?? "").trim();
+  if (!FILE_URI_PREFIX_RE.test(trimmed)) return trimmed;
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "file:") return trimmed;
+
+    const pathname = safeDecodeURIComponent(parsed.pathname || "");
+    if (!pathname) return trimmed;
+    if (WINDOWS_DRIVE_URI_PATH_RE.test(pathname)) return pathname.slice(1);
+    if (parsed.hostname && parsed.hostname.toLowerCase() !== "localhost") {
+      return `//${parsed.hostname}${pathname}`;
+    }
+    return pathname;
+  } catch {
+    const decoded = safeDecodeURIComponent(trimmed.replace(FILE_URI_PREFIX_RE, ""));
+    if (!decoded) return trimmed;
+    if (WINDOWS_DRIVE_URI_PATH_RE.test(decoded)) return decoded.slice(1);
+    return decoded;
+  }
+};
diff --git a/apps/app/src/app/lib/local-file-path.ts b/apps/app/src/app/lib/local-file-path.ts
new file mode 100644
index 0000000000..5546f44a3d
--- /dev/null
+++ b/apps/app/src/app/lib/local-file-path.ts
@@ -0,0 +1,4 @@
+import { normalizeLocalFilePath as normalizeLocalFilePathImpl } from "./local-file-path.impl.js";
+
+export const normalizeLocalFilePath = (value: string): string =>
+  normalizeLocalFilePathImpl(value) as string;
diff --git a/apps/app/src/app/lib/migration.ts b/apps/app/src/app/lib/migration.ts
new file mode 100644
index 0000000000..ab42ea0e5c
--- /dev/null
+++ b/apps/app/src/app/lib/migration.ts
@@ -0,0 +1,218 @@
+// One-way Tauri → Electron migration snapshot plumbing.
+//
+// The Tauri shell exports localStorage keys the user actively depends on
+// (workspace list, selected workspace, per-workspace last-session, server
+// list) into a JSON file in app_data_dir just before launching the
+// Electron installer. Electron reads that file on first launch, hydrates
+// localStorage for the keys that are still empty, then marks the file as
+// acknowledged.
+//
+// Scope decision: we migrate *workspace* keys only. Everything else
+// (theme, font zoom, sidebar widths, feature flags) is cheap to redo and
+// not worth the complexity of a cross-origin localStorage transfer.
+
+import { invoke } from "@tauri-apps/api/core";
+
+export const MIGRATION_SNAPSHOT_VERSION = 1;
+
+// Keep this list tiny and strict. Adding keys here expands blast radius
+// if a later release renames them.
+export const MIGRATION_KEY_PATTERNS: Array<RegExp> = [
+  /^openwork\.react\.activeWorkspace$/,
+  /^openwork\.react\.sessionByWorkspace$/,
+  /^openwork\.server\.list$/,
+  /^openwork\.server\.active$/,
+  /^openwork\.server\.urlOverride$/,
+  /^openwork\.server\.token$/,
+];
+
+export type MigrationSnapshot = {
+  version: typeof MIGRATION_SNAPSHOT_VERSION;
+  writtenAt: number;
+  source: "tauri";
+  keys: Record<string, string>;
+};
+
+function matchesMigrationKey(key: string) {
+  return MIGRATION_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+
+function collectMigrationKeysFromLocalStorage(): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (typeof window === "undefined") return out;
+  for (let i = 0; i < window.localStorage.length; i++) {
+    const key = window.localStorage.key(i);
+    if (!key || !matchesMigrationKey(key)) continue;
+    const value = window.localStorage.getItem(key);
+    if (value != null) out[key] = value;
+  }
+  return out;
+}
+
+/**
+ * Tauri-only. Called by the last Tauri release right before it kicks off
+ * the Electron installer. Snapshots the workspace-related localStorage
+ * keys to <app_data_dir>/migration-snapshot.v1.json via a Rust command
+ * that does the actual disk write (renderer can't write outside the
+ * sandbox on its own).
+ */
+export async function writeMigrationSnapshotFromTauri(): Promise<{
+  ok: boolean;
+  keyCount: number;
+  reason?: string;
+}> {
+  try {
+    const keys = collectMigrationKeysFromLocalStorage();
+    const snapshot: MigrationSnapshot = {
+      version: MIGRATION_SNAPSHOT_VERSION,
+      writtenAt: Date.now(),
+      source: "tauri",
+      keys,
+    };
+    await invoke("write_migration_snapshot", { snapshot });
+    return { ok: true, keyCount: Object.keys(keys).length };
+  } catch (error) {
+    return {
+      ok: false,
+      keyCount: 0,
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+type ElectronMigrationBridge = {
+  readSnapshot: () => Promise<MigrationSnapshot | null>;
+  ackSnapshot: () => Promise<{ ok: boolean; moved: boolean }>;
+};
+
+function electronMigrationBridge(): ElectronMigrationBridge | null {
+  if (typeof window === "undefined") return null;
+  const bridge = (window as unknown as {
+    __OPENWORK_ELECTRON__?: { migration?: ElectronMigrationBridge };
+  }).__OPENWORK_ELECTRON__;
+  return bridge?.migration ?? null;
+}
+
+/**
+ * Electron-only. Called once during app boot. Reads the migration
+ * snapshot (if any), hydrates localStorage for keys that aren't already
+ * set on the Electron install, and acks the file so we don't re-ingest
+ * on subsequent launches.
+ *
+ * Returns the number of keys hydrated. Returns 0 when there is no
+ * snapshot, which is the steady-state case after the first launch.
+ */
+export async function ingestMigrationSnapshotOnElectronBoot(): Promise<number> {
+  const bridge = electronMigrationBridge();
+  if (!bridge) return 0;
+
+  let snapshot: MigrationSnapshot | null = null;
+  try {
+    snapshot = await bridge.readSnapshot();
+  } catch {
+    return 0;
+  }
+  if (!snapshot || snapshot.version !== MIGRATION_SNAPSHOT_VERSION) return 0;
+
+  const entries = Object.entries(snapshot.keys ?? {});
+  let hydrated = 0;
+  if (typeof window !== "undefined") {
+    for (const [key, value] of entries) {
+      if (!matchesMigrationKey(key)) continue;
+      if (window.localStorage.getItem(key) != null) continue;
+      try {
+        window.localStorage.setItem(key, value);
+        hydrated += 1;
+      } catch {
+        // localStorage write failures are non-fatal; the user just won't
+        // see that key migrated this launch.
+      }
+    }
+  }
+
+  try {
+    await bridge.ackSnapshot();
+  } catch {
+    // A failed ack means we'll re-ingest on next launch, but the
+    // "skip if already set" guard keeps that idempotent.
+  }
+
+  return hydrated;
+}
+
+export type MigrateToElectronRequest = {
+  /**
+   * Download URL for the matching Electron artifact. On macOS a .zip.
+   * On Windows, an NSIS .exe (TODO — stubbed today). On Linux, an AppImage
+   * (TODO — stubbed today).
+   */
+  url: string;
+  /** Optional sha256 to verify before touching the filesystem. */
+  sha256?: string;
+  /** Optional electron-builder sha512 (base64) from latest-mac.yml. */
+  sha512?: string;
+  /**
+   * Override where the Electron .app ends up (macOS). Defaults to
+   * replacing the currently-running .app bundle in place.
+   */
+  targetAppPath?: string;
+};
+
+/**
+ * Tauri-only. Hand off to the new Electron build:
+ *   1. Download + verify the installer
+ *   2. Replace the running .app bundle
+ *   3. Relaunch into the Electron binary
+ *   4. Quit this Tauri process
+ *
+ * Callers should invoke `writeMigrationSnapshotFromTauri()` first so the
+ * new Electron shell can hydrate localStorage on first launch.
+ */
+export async function migrateToElectron(
+  request: MigrateToElectronRequest,
+): Promise<{ ok: boolean; reason?: string }> {
+  try {
+    await invoke("migrate_to_electron", { request });
+    return { ok: true };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+// Localstorage key that stores a "don't ask again until" epoch-ms.
+// Users who click "Later" get a 24h reprieve; after that we nudge again.
+export const MIGRATION_DEFER_KEY = "openwork.migration.deferredUntil";
+export const MIGRATION_DEFAULT_DEFER_MS = 24 * 60 * 60 * 1000;
+
+export function isMigrationDeferred(now: number = Date.now()): boolean {
+  if (typeof window === "undefined") return false;
+  try {
+    const raw = window.localStorage.getItem(MIGRATION_DEFER_KEY);
+    if (!raw) return false;
+    const until = Number.parseInt(raw, 10);
+    return Number.isFinite(until) && until > now;
+  } catch {
+    return false;
+  }
+}
+
+export function deferMigration(ms: number = MIGRATION_DEFAULT_DEFER_MS): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(MIGRATION_DEFER_KEY, String(Date.now() + ms));
+  } catch {
+    // non-fatal
+  }
+}
+
+export function clearMigrationDefer(): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.removeItem(MIGRATION_DEFER_KEY);
+  } catch {
+    // non-fatal
+  }
+}
diff --git a/apps/app/src/app/lib/model-behavior.ts b/apps/app/src/app/lib/model-behavior.ts
new file mode 100644
index 0000000000..a8cccd76eb
--- /dev/null
+++ b/apps/app/src/app/lib/model-behavior.ts
@@ -0,0 +1,217 @@
+import type { ProviderListItem } from "../types";
+import type { ModelBehaviorOption } from "../types";
+import { t } from "../../i18n";
+
+type ProviderModel = ProviderListItem["models"][string];
+
+const WELL_KNOWN_VARIANT_ORDER = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+] as const;
+
+function defaultBehaviorOption(): ModelBehaviorOption {
+  return {
+    value: null,
+    label: t("settings.provider_default_label"),
+    description: t("settings.provider_default_desc"),
+  };
+}
+
+const humanize = (value: string) => {
+  const cleaned = value.replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
+  if (!cleaned) return value;
+  return cleaned
+    .split(" ")
+    .filter(Boolean)
+    .map((word) => {
+      if (/\d/.test(word) || word.length <= 3) return word.toUpperCase();
+      const lower = word.toLowerCase();
+      return lower.charAt(0).toUpperCase() + lower.slice(1);
+    })
+    .join(" ");
+};
+
+export const normalizeModelBehaviorValue = (value: string | null) => {
+  if (!value) return null;
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) return null;
+  if (
+    normalized === "balance" ||
+    normalized === "balanced" ||
+    normalized === "default" ||
+    normalized === "provider-default"
+  ) {
+    return null;
+  }
+  return normalized;
+};
+
+const getVariantKeys = (model: ProviderModel) => {
+  const keys = Object.keys(model.variants ?? {})
+    .map((key) => normalizeModelBehaviorValue(key))
+    .filter((key): key is string => Boolean(key));
+  return Array.from(new Set(keys));
+};
+
+const sortVariantKeys = (keys: string[]) =>
+  keys.slice().sort((a, b) => {
+    const aIndex = WELL_KNOWN_VARIANT_ORDER.indexOf(a as (typeof WELL_KNOWN_VARIANT_ORDER)[number]);
+    const bIndex = WELL_KNOWN_VARIANT_ORDER.indexOf(b as (typeof WELL_KNOWN_VARIANT_ORDER)[number]);
+    if (aIndex !== -1 || bIndex !== -1) {
+      if (aIndex === -1) return 1;
+      if (bIndex === -1) return -1;
+      return aIndex - bIndex;
+    }
+    return a.localeCompare(b);
+  });
+
+const providerFamily = (providerID: string, providerName?: string | null) => {
+  const normalizedId = providerID.trim().toLowerCase();
+  if (["anthropic", "openai", "google", "opencode"].includes(normalizedId)) {
+    return normalizedId;
+  }
+
+  const normalizedName = providerName?.trim().toLowerCase() ?? "";
+  if (normalizedName.includes("anthropic")) return "anthropic";
+  if (normalizedName.includes("openai")) return "openai";
+  if (normalizedName.includes("google")) return "google";
+  if (normalizedName.includes("opencode")) return "opencode";
+  return normalizedId;
+};
+
+const getBehaviorTitle = (
+  providerID: string,
+  model: ProviderModel,
+  variantKeys: string[],
+  providerName?: string | null,
+) => {
+  const family = providerFamily(providerID, providerName);
+  if (variantKeys.length > 0) {
+    if (family === "anthropic") return t("model_behavior.title_extended_thinking");
+    if (family === "google") return t("model_behavior.title_reasoning_budget");
+    if (
+      family === "openai" ||
+      family === "opencode" ||
+      variantKeys.some((key) => ["none", "minimal", "low", "medium", "high", "xhigh"].includes(key))
+    ) {
+      return t("model_behavior.title_reasoning_effort");
+    }
+    return t("app.model_behavior_title");
+  }
+  if (model.capabilities?.reasoning) return t("model_behavior.title_builtin_reasoning");
+  return t("model_behavior.title_standard_generation");
+};
+
+const getVariantLabel = (providerID: string, key: string, providerName?: string | null) => {
+  const family = providerFamily(providerID, providerName);
+  if (key === "none") return t("model_behavior.label_fast");
+  if (key === "minimal") return t("model_behavior.label_quick");
+  if (key === "low") return t("model_behavior.label_light");
+  if (key === "medium") return t("model_behavior.label_balanced");
+  if (key === "high") return family === "anthropic" ? t("model_behavior.label_extended") : t("model_behavior.label_deep");
+  if (key === "xhigh" || key === "max") return t("model_behavior.label_maximum");
+  return humanize(key);
+};
+
+export const formatGenericBehaviorLabel = (value: string | null) => {
+  const normalized = normalizeModelBehaviorValue(value);
+  if (!normalized) return defaultBehaviorOption().label;
+  return getVariantLabel("generic", normalized);
+};
+
+const getVariantDescription = (
+  providerID: string,
+  key: string,
+  label: string,
+  providerName?: string | null,
+) => {
+  const family = providerFamily(providerID, providerName);
+  if (key === "none") return t("model_behavior.desc_none");
+  if (key === "minimal") return t("model_behavior.desc_minimal");
+  if (key === "low") return family === "google"
+    ? t("model_behavior.desc_low_google")
+    : t("model_behavior.desc_low");
+  if (key === "medium") return t("model_behavior.desc_medium");
+  if (key === "high") return family === "anthropic"
+    ? t("model_behavior.desc_high_anthropic")
+    : t("model_behavior.desc_high");
+  if (key === "xhigh" || key === "max") return family === "anthropic"
+    ? t("model_behavior.desc_max_anthropic")
+    : t("model_behavior.desc_max");
+  return t("model_behavior.desc_generic", { label: label.toLowerCase() });
+};
+
+export const getModelBehaviorOptions = (
+  providerID: string,
+  model: ProviderModel,
+  providerName?: string | null,
+): ModelBehaviorOption[] => {
+  const variantKeys = sortVariantKeys(getVariantKeys(model));
+  if (!variantKeys.length) return [];
+  return [
+    defaultBehaviorOption(),
+    ...variantKeys.map((key) => {
+      const label = getVariantLabel(providerID, key, providerName);
+      return {
+        value: key,
+        label,
+        description: getVariantDescription(providerID, key, label, providerName),
+      };
+    }),
+  ];
+};
+
+export const sanitizeModelBehaviorValue = (
+  providerID: string,
+  model: ProviderModel,
+  value: string | null,
+  providerName?: string | null,
+) => {
+  const normalized = normalizeModelBehaviorValue(value);
+  if (!normalized) return null;
+  return getModelBehaviorOptions(providerID, model, providerName).some((option) => option.value === normalized)
+    ? normalized
+    : null;
+};
+
+export const getModelBehaviorSummary = (
+  providerID: string,
+  model: ProviderModel,
+  value: string | null,
+  providerName?: string | null,
+) => {
+  const options = getModelBehaviorOptions(providerID, model, providerName);
+  const sanitized = sanitizeModelBehaviorValue(providerID, model, value, providerName);
+  const selected = options.find((option) => option.value === sanitized) ?? options[0] ?? null;
+  const title = getBehaviorTitle(providerID, model, getVariantKeys(model), providerName);
+
+  if (options.length > 0) {
+    return {
+      title,
+      label: selected?.label ?? defaultBehaviorOption().label,
+      description: selected?.description ?? defaultBehaviorOption().description,
+      options,
+    };
+  }
+
+  if (model.capabilities?.reasoning) {
+    return {
+      title,
+      label: t("model_behavior.label_builtin"),
+      description: t("model_behavior.desc_builtin"),
+      options,
+    };
+  }
+
+  return {
+    title,
+    label: t("model_behavior.label_standard"),
+    description: t("model_behavior.desc_standard"),
+    options,
+  };
+};
diff --git a/apps/app/src/app/lib/opencode-session.ts b/apps/app/src/app/lib/opencode-session.ts
new file mode 100644
index 0000000000..713638e8fe
--- /dev/null
+++ b/apps/app/src/app/lib/opencode-session.ts
@@ -0,0 +1,161 @@
+/**
+ * Typed helpers for OpenCode session operations.
+ *
+ * The OpenCode SDK (v2) exposes `session.abort`, `session.revert`,
+ * `session.unrevert`, `session.shell`, and `command.list` as typed methods.
+ * This module provides thin wrappers that avoid `as any` casts by using the
+ * SDK types directly, and adds feature-detection for newer API surface
+ * (e.g. `shellAsync`) that may not be present in older SDK versions.
+ */
+import type { Session } from "@opencode-ai/sdk/v2/client";
+import type { Client, ModelRef } from "../types";
+import { unwrap } from "./opencode";
+
+// ---------------------------------------------------------------------------
+// Session helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Abort an active session. Silently succeeds if the session is already idle.
+ */
+export async function abortSession(client: Client, sessionID: string): Promise<void> {
+  unwrap(await client.session.abort({ sessionID }));
+}
+
+/**
+ * Abort an active session, swallowing errors (useful before revert/undo).
+ */
+export async function abortSessionSafe(client: Client, sessionID: string): Promise<void> {
+  try {
+    await client.session.abort({ sessionID });
+  } catch {
+    // intentional: abort may fail if session is already idle
+  }
+}
+
+/**
+ * Revert a session to a specific message boundary.
+ */
+export async function revertSession(
+  client: Client,
+  sessionID: string,
+  messageID: string,
+): Promise<Session> {
+  return unwrap(await client.session.revert({ sessionID, messageID })) as Session;
+}
+
+/**
+ * Restore all previously reverted messages in a session.
+ */
+export async function unrevertSession(
+  client: Client,
+  sessionID: string,
+): Promise<Session> {
+  return unwrap(await client.session.unrevert({ sessionID })) as Session;
+}
+
+/**
+ * Compact/summarize a long session to reduce context size.
+ * Uses `session.summarize` when available and falls back to `/compact` command.
+ */
+export async function compactSession(
+  client: Client,
+  sessionID: string,
+  model: ModelRef,
+  options?: { directory?: string },
+): Promise<void> {
+  const session = client.session as { summarize?: (input: {
+    sessionID: string;
+    directory?: string;
+    providerID: string;
+    modelID: string;
+  }) => Promise<unknown> };
+
+  if (typeof session.summarize === "function") {
+    const result = await session.summarize({
+      sessionID,
+      directory: options?.directory,
+      providerID: model.providerID,
+      modelID: model.modelID,
+    });
+    assertNoClientError(result);
+    return;
+  }
+
+  const modelString = `${model.providerID}/${model.modelID}`;
+  const result = await client.session.command({
+    sessionID,
+    command: "compact",
+    arguments: "",
+    model: modelString,
+    directory: options?.directory,
+  });
+  assertNoClientError(result);
+}
+
+// ---------------------------------------------------------------------------
+// Shell execution
+// ---------------------------------------------------------------------------
+
+/**
+ * Execute a shell command in a session. Uses `shell` from the SDK.
+ * Falls back to `promptAsync` with a `!` prefix if `shell` is unavailable.
+ */
+export async function shellInSession(
+  client: Client,
+  sessionID: string,
+  command: string,
+  options?: { model?: { providerID: string; modelID: string }; agent?: string; variant?: string },
+): Promise<void> {
+  const result = await client.session.shell({ sessionID, command });
+  assertNoClientError(result);
+}
+
+// ---------------------------------------------------------------------------
+// Command listing
+// ---------------------------------------------------------------------------
+
+export type CommandListItem = {
+  id: string;
+  name: string;
+  description?: string;
+  source?: "command" | "mcp" | "skill";
+};
+
+/**
+ * List available slash commands for a workspace.
+ */
+export async function listCommands(
+  client: Client,
+  directory?: string,
+): Promise<CommandListItem[]> {
+  try {
+    const result = await client.command.list({ directory });
+    const list = result?.data ?? [];
+    if (!Array.isArray(list)) return [];
+    return list.map((cmd: Record<string, unknown>) => ({
+      id: `cmd:${cmd.name}`,
+      name: String(cmd.name ?? ""),
+      description: cmd.description ? String(cmd.description) : undefined,
+      source: cmd.source as CommandListItem["source"],
+    }));
+  } catch {
+    return [];
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Internal
+// ---------------------------------------------------------------------------
+
+function assertNoClientError(result: unknown): void {
+  const maybe = result as { error?: unknown } | null | undefined;
+  if (!maybe || maybe.error === undefined) return;
+  const message =
+    maybe.error instanceof Error
+      ? maybe.error.message
+      : typeof maybe.error === "string"
+        ? maybe.error
+        : JSON.stringify(maybe.error);
+  throw new Error(message || "Unknown error");
+}
diff --git a/apps/app/src/app/lib/opencode.ts b/apps/app/src/app/lib/opencode.ts
new file mode 100644
index 0000000000..48ea7a531c
--- /dev/null
+++ b/apps/app/src/app/lib/opencode.ts
@@ -0,0 +1,507 @@
+import { createOpencodeClient, type Message, type Part, type Session, type Todo } from "@opencode-ai/sdk/v2/client";
+
+import { desktopFetch } from "./desktop";
+import { createOpenworkServerClient, OpenworkServerError } from "./openwork-server";
+import { isDesktopRuntime } from "../utils";
+
+type FieldsResult<T> =
+  | ({ data: T; error?: undefined } & { request: Request; response: Response })
+  | ({ data?: undefined; error: unknown } & { request: Request; response: Response });
+
+type PromptAsyncParameters = {
+  sessionID: string;
+  directory?: string;
+  messageID?: string;
+  model?: { providerID: string; modelID: string };
+  agent?: string;
+  noReply?: boolean;
+  tools?: { [key: string]: boolean };
+  system?: string;
+  variant?: string;
+  parts?: unknown[];
+  reasoning_effort?: string;
+};
+
+type CommandParameters = {
+  sessionID: string;
+  directory?: string;
+  messageID?: string;
+  agent?: string;
+  model?: string;
+  arguments?: string;
+  command?: string;
+  variant?: string;
+  parts?: unknown[];
+  reasoning_effort?: string;
+};
+
+type SessionListParameters = {
+  directory?: string;
+  roots?: boolean;
+  start?: number;
+  search?: string;
+  limit?: number;
+};
+
+type SessionLookupParameters = {
+  sessionID: string;
+  directory?: string;
+};
+
+type SessionMessagesParameters = {
+  sessionID: string;
+  directory?: string;
+  limit?: number;
+};
+
+export type OpencodeAuth = {
+  username?: string;
+  password?: string;
+  token?: string;
+  mode?: "basic" | "openwork";
+};
+
+const DEFAULT_OPENCODE_REQUEST_TIMEOUT_MS = 10_000;
+const OAUTH_OPENCODE_REQUEST_TIMEOUT_MS = 5 * 60_000;
+const MCP_AUTH_OPENCODE_REQUEST_TIMEOUT_MS = 90_000;
+const SESSION_COMMAND_URL_RE = /\/session\/[^/?#]+\/command(?:[?#]|$)/;
+
+function getRequestUrl(input: RequestInfo | URL): string {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.toString();
+  if (typeof Request !== "undefined" && input instanceof Request) return input.url;
+  return String(input);
+}
+
+function resolveRequestTimeoutMs(input: RequestInfo | URL, fallbackMs: number): number {
+  const url = getRequestUrl(input);
+  if (SESSION_COMMAND_URL_RE.test(url)) {
+    return 0;
+  }
+  if (/\/provider\/oauth\//.test(url) || /\/mcp\/auth\/callback\b/.test(url)) {
+    return Math.max(fallbackMs, OAUTH_OPENCODE_REQUEST_TIMEOUT_MS);
+  }
+  if (/\/mcp\/.*auth\b/.test(url)) {
+    return Math.max(fallbackMs, MCP_AUTH_OPENCODE_REQUEST_TIMEOUT_MS);
+  }
+  return fallbackMs;
+}
+
+
+function buildDirectoryHeader(directory?: string) {
+  if (!directory?.trim()) return undefined;
+  const trimmed = directory.trim();
+  return /[^\x00-\x7F]/.test(trimmed) ? encodeURIComponent(trimmed) : trimmed;
+}
+
+async function postSessionRequest<T>(
+  fetchImpl: typeof globalThis.fetch,
+  baseUrl: string,
+  path: string,
+  body: Record<string, unknown>,
+  options?: { headers?: Record<string, string>; directory?: string; throwOnError?: boolean },
+): Promise<FieldsResult<T>> {
+  const headers = new Headers(options?.headers);
+  headers.set("Content-Type", "application/json");
+  const directoryHeader = buildDirectoryHeader(options?.directory);
+  if (directoryHeader) {
+    headers.set("x-opencode-directory", directoryHeader);
+  }
+
+  const response = await fetchImpl(`${baseUrl}${path}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+
+  const request = new Request(`${baseUrl}${path}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+
+  if (response.ok) {
+    const data = response.status === 204 ? ({} as T) : ((await response.json()) as T);
+    return { data, request, response };
+  }
+
+  const text = await response.text();
+  let error: unknown = text;
+  try {
+    error = text ? JSON.parse(text) : text;
+  } catch {
+    // ignore
+  }
+  if (options?.throwOnError) throw error;
+  return { error, request, response };
+}
+
+function resolveOpenworkWorkspaceMount(baseUrl: string): { baseUrl: string; workspaceId: string } | null {
+  try {
+    const url = new URL(baseUrl);
+    const match = url.pathname.replace(/\/+$/, "").match(/^(.*\/w\/([^/]+))\/opencode$/);
+    if (!match?.[1] || !match[2]) return null;
+    url.pathname = match[1];
+    url.search = "";
+    return {
+      baseUrl: url.toString().replace(/\/+$/, ""),
+      workspaceId: decodeURIComponent(match[2]),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function createSyntheticResult<T>(
+  url: string,
+  method: string,
+  input:
+    | { ok: true; data: T; status?: number }
+    | { ok: false; error: unknown; status?: number },
+): FieldsResult<T> {
+  const request = new Request(url, { method });
+  const response = new Response(input.ok ? JSON.stringify(input.data) : null, {
+    status: input.status ?? (input.ok ? 200 : 500),
+    headers: { "Content-Type": "application/json" },
+  });
+  if (input.ok) {
+    return { data: input.data, request, response };
+  }
+  return { error: input.error, request, response };
+}
+
+async function wrapOpenworkRead<T>(
+  url: string,
+  read: () => Promise<T>,
+  options?: { throwOnError?: boolean },
+): Promise<FieldsResult<T>> {
+  try {
+    return createSyntheticResult(url, "GET", { ok: true, data: await read() });
+  } catch (error) {
+    if (options?.throwOnError) throw error;
+    return createSyntheticResult(url, "GET", {
+      ok: false,
+      error,
+      status: error instanceof OpenworkServerError ? error.status : 500,
+    });
+  }
+}
+
+function shouldFallbackToLegacySessionRead(error: unknown): boolean {
+  if (!(error instanceof OpenworkServerError)) return false;
+  return error.status === 404 || error.status === 405 || error.status === 501;
+}
+
+async function wrapOpenworkReadWithFallback<T>(
+  url: string,
+  read: () => Promise<T>,
+  fallback: () => Promise<FieldsResult<T>>,
+  options?: { throwOnError?: boolean },
+): Promise<FieldsResult<T>> {
+  try {
+    return createSyntheticResult(url, "GET", { ok: true, data: await read() });
+  } catch (error) {
+    if (!shouldFallbackToLegacySessionRead(error)) {
+      if (options?.throwOnError) throw error;
+      return createSyntheticResult(url, "GET", {
+        ok: false,
+        error,
+        status: error instanceof OpenworkServerError ? error.status : 500,
+      });
+    }
+    return fallback();
+  }
+}
+
+async function fetchWithTimeout(
+  fetchImpl: typeof globalThis.fetch,
+  input: RequestInfo | URL,
+  init: RequestInit | undefined,
+  timeoutMs: number,
+) {
+  const effectiveTimeoutMs = resolveRequestTimeoutMs(input, timeoutMs);
+  if (!Number.isFinite(effectiveTimeoutMs) || effectiveTimeoutMs <= 0) {
+    return fetchImpl(input, init);
+  }
+
+  const controller = typeof AbortController !== "undefined" ? new AbortController() : null;
+  const signal = controller?.signal;
+  const initWithSignal = signal && !init?.signal ? { ...(init ?? {}), signal } : init;
+
+  let timeoutId: ReturnType<typeof setTimeout> | null = null;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeoutId = setTimeout(() => {
+      try {
+        controller?.abort();
+      } catch {
+        // ignore
+      }
+      reject(new Error("Request timed out."));
+    }, effectiveTimeoutMs);
+  });
+
+  try {
+    return await Promise.race([fetchImpl(input, initWithSignal), timeoutPromise]);
+  } catch (error) {
+    const name = (error && typeof error === "object" && "name" in error ? (error as any).name : "") as string;
+    if (name === "AbortError") {
+      throw new Error("Request timed out.");
+    }
+    throw error;
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+  }
+}
+
+const encodeBasicAuth = (auth?: OpencodeAuth) => {
+  if (!auth?.username || !auth?.password) return null;
+  const token = `${auth.username}:${auth.password}`;
+  if (typeof btoa === "function") return btoa(token);
+  const buffer = (globalThis as { Buffer?: { from: (input: string, encoding: string) => { toString: (encoding: string) => string } } })
+    .Buffer;
+  return buffer ? buffer.from(token, "utf8").toString("base64") : null;
+};
+
+const resolveAuthHeader = (auth?: OpencodeAuth) => {
+  if (auth?.mode === "openwork" && auth.token) {
+    return `Bearer ${auth.token}`;
+  }
+  const encoded = encodeBasicAuth(auth);
+  return encoded ? `Basic ${encoded}` : null;
+};
+
+/**
+ * URLs whose response body we must stream chunk-by-chunk (SSE, long-running
+ * message streams, event subscriptions). The Tauri HTTP plugin's
+ * `fetch_read_body` IPC call blocks until the entire body is delivered, so
+ * pointing it at an infinite stream freezes the webview's main thread for
+ * minutes. For these endpoints we always use the webview's native fetch —
+ * CORS is already wide open on the openwork/opencode stack, so there's no
+ * reason to route them through the plugin.
+ */
+const STREAM_URL_RE = /\/(event|stream)(\b|\/|$|\?)/;
+
+function requestIsStreaming(input: RequestInfo | URL, init?: RequestInit): boolean {
+  const url = getRequestUrl(input);
+  if (STREAM_URL_RE.test(url)) return true;
+  const accept =
+    input instanceof Request
+      ? input.headers.get("accept") ?? input.headers.get("Accept")
+      : new Headers(init?.headers).get("accept") ?? new Headers(init?.headers).get("Accept");
+  return typeof accept === "string" && accept.toLowerCase().includes("text/event-stream");
+}
+
+function nativeFetchRef(): typeof globalThis.fetch {
+  if (typeof window !== "undefined" && typeof window.fetch === "function") return window.fetch.bind(window);
+  return globalThis.fetch as typeof globalThis.fetch;
+}
+
+const createDesktopFetch = (auth?: OpencodeAuth) => {
+  const authHeader = resolveAuthHeader(auth);
+  const addAuth = (headers: Headers) => {
+    if (!authHeader || headers.has("Authorization")) return;
+    headers.set("Authorization", authHeader);
+  };
+
+  return (input: RequestInfo | URL, init?: RequestInit) => {
+    // Streams must go through the webview's native fetch to avoid the
+    // Tauri HTTP plugin's `fetch_read_body` hang on never-closing bodies.
+    const shouldStream = requestIsStreaming(input, init);
+    const underlyingFetch = shouldStream
+      ? nativeFetchRef()
+      : desktopFetch;
+    // Streams should never be timed out at the transport layer; the caller
+    // aborts via AbortSignal when the subscription unmounts.
+    const timeoutMs = shouldStream ? 0 : DEFAULT_OPENCODE_REQUEST_TIMEOUT_MS;
+
+    if (input instanceof Request) {
+      const headers = new Headers(input.headers);
+      addAuth(headers);
+      const request = new Request(input, { headers });
+      return fetchWithTimeout(underlyingFetch, request, undefined, timeoutMs);
+    }
+
+    const headers = new Headers(init?.headers);
+    addAuth(headers);
+    return fetchWithTimeout(
+      underlyingFetch,
+      input,
+      {
+        ...init,
+        headers,
+      },
+      timeoutMs,
+    );
+  };
+};
+
+export function unwrap<T>(result: FieldsResult<T>): NonNullable<T> {
+  if (result.data !== undefined) {
+    return result.data as NonNullable<T>;
+  }
+  const message =
+    result.error instanceof Error
+      ? result.error.message
+      : typeof result.error === "string"
+        ? result.error
+        : JSON.stringify(result.error);
+  throw new Error(message || "Unknown error");
+}
+
+export function createClient(baseUrl: string, directory?: string, auth?: OpencodeAuth) {
+  const headers: Record<string, string> = {};
+  if (!isDesktopRuntime()) {
+    const authHeader = resolveAuthHeader(auth);
+    if (authHeader) {
+      headers.Authorization = authHeader;
+    }
+  }
+
+  const fetchImpl = isDesktopRuntime()
+    ? createDesktopFetch(auth)
+    : (input: RequestInfo | URL, init?: RequestInit) =>
+        fetchWithTimeout(globalThis.fetch, input, init, DEFAULT_OPENCODE_REQUEST_TIMEOUT_MS);
+  const client = createOpencodeClient({
+    baseUrl,
+    directory,
+    headers: Object.keys(headers).length ? headers : undefined,
+    fetch: fetchImpl,
+  });
+
+  const session = client.session as typeof client.session;
+  const openworkMount = auth?.mode === "openwork" ? resolveOpenworkWorkspaceMount(baseUrl) : null;
+  const openworkSessionClient =
+    openworkMount && auth?.token
+      ? createOpenworkServerClient({ baseUrl: openworkMount.baseUrl, token: auth.token })
+      : null;
+  // TODO(2026-04-12): remove the old-server compatibility path here once all
+  // OpenWork servers expose the workspace-scoped session read APIs.
+  const sessionOverrides = session as any as {
+    list: (parameters?: SessionListParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<Session[]>>;
+    get: (parameters: SessionLookupParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<Session>>;
+    messages: (parameters: SessionMessagesParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<Array<{ info: Message; parts: Part[] }>>>;
+    todo: (parameters: SessionLookupParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<Todo[]>>;
+    promptAsync: (parameters: PromptAsyncParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<{}>>;
+    command: (parameters: CommandParameters, options?: { throwOnError?: boolean }) => Promise<FieldsResult<{}>>;
+  };
+
+  const listOriginal = sessionOverrides.list.bind(session);
+  sessionOverrides.list = (parameters?: SessionListParameters, options?: { throwOnError?: boolean }) => {
+    if (!openworkMount || !openworkSessionClient) {
+      return listOriginal(parameters, options);
+    }
+    const query = new URLSearchParams();
+    if (typeof parameters?.roots === "boolean") query.set("roots", String(parameters.roots));
+    if (typeof parameters?.start === "number") query.set("start", String(parameters.start));
+    if (parameters?.search?.trim()) query.set("search", parameters.search.trim());
+    if (typeof parameters?.limit === "number") query.set("limit", String(parameters.limit));
+    const url = `${openworkMount.baseUrl}/workspace/${encodeURIComponent(openworkMount.workspaceId)}/sessions${query.size ? `?${query.toString()}` : ""}`;
+    return wrapOpenworkReadWithFallback(
+      url,
+      async () => (await openworkSessionClient.listSessions(openworkMount.workspaceId, parameters)).items,
+      () => listOriginal(parameters, options),
+      options,
+    );
+  };
+
+  const getOriginal = sessionOverrides.get.bind(session);
+  sessionOverrides.get = (parameters: SessionLookupParameters, options?: { throwOnError?: boolean }) => {
+    if (!openworkMount || !openworkSessionClient) {
+      return getOriginal(parameters, options);
+    }
+    const url = `${openworkMount.baseUrl}/workspace/${encodeURIComponent(openworkMount.workspaceId)}/sessions/${encodeURIComponent(parameters.sessionID)}`;
+    return wrapOpenworkReadWithFallback(
+      url,
+      async () => (await openworkSessionClient.getSession(openworkMount.workspaceId, parameters.sessionID)).item,
+      () => getOriginal(parameters, options),
+      options,
+    );
+  };
+
+  const messagesOriginal = sessionOverrides.messages.bind(session);
+  sessionOverrides.messages = (parameters: SessionMessagesParameters, options?: { throwOnError?: boolean }) => {
+    if (!openworkMount || !openworkSessionClient) {
+      return messagesOriginal(parameters, options);
+    }
+    const query = new URLSearchParams();
+    if (typeof parameters.limit === "number") query.set("limit", String(parameters.limit));
+    const url = `${openworkMount.baseUrl}/workspace/${encodeURIComponent(openworkMount.workspaceId)}/sessions/${encodeURIComponent(parameters.sessionID)}/messages${query.size ? `?${query.toString()}` : ""}`;
+    return wrapOpenworkReadWithFallback(
+      url,
+      async () =>
+        (await openworkSessionClient.getSessionMessages(openworkMount.workspaceId, parameters.sessionID, {
+          limit: parameters.limit,
+        })).items,
+      () => messagesOriginal(parameters, options),
+      options,
+    );
+  };
+
+  const todoOriginal = sessionOverrides.todo.bind(session);
+  sessionOverrides.todo = (parameters: SessionLookupParameters, options?: { throwOnError?: boolean }) => {
+    if (!openworkMount || !openworkSessionClient) {
+      return todoOriginal(parameters, options);
+    }
+    const url = `${openworkMount.baseUrl}/workspace/${encodeURIComponent(openworkMount.workspaceId)}/sessions/${encodeURIComponent(parameters.sessionID)}/snapshot`;
+    return wrapOpenworkReadWithFallback(
+      url,
+      async () => (await openworkSessionClient.getSessionSnapshot(openworkMount.workspaceId, parameters.sessionID)).item.todos,
+      () => todoOriginal(parameters, options),
+      options,
+    );
+  };
+
+  const promptAsyncOriginal = sessionOverrides.promptAsync.bind(session);
+  sessionOverrides.promptAsync = (parameters: PromptAsyncParameters, options?: { throwOnError?: boolean }) => {
+    if (!("reasoning_effort" in parameters)) {
+      return promptAsyncOriginal(parameters, options);
+    }
+    const { sessionID, directory: requestDirectory, ...body } = parameters;
+    return postSessionRequest(fetchImpl, baseUrl, `/session/${encodeURIComponent(sessionID)}/prompt_async`, body, {
+      headers: Object.keys(headers).length ? headers : undefined,
+      directory: requestDirectory ?? directory,
+      throwOnError: options?.throwOnError,
+    });
+  };
+
+  const commandOriginal = sessionOverrides.command.bind(session);
+  sessionOverrides.command = (parameters: CommandParameters, options?: { throwOnError?: boolean }) => {
+    if (!("reasoning_effort" in parameters)) {
+      return commandOriginal(parameters, options);
+    }
+    const { sessionID, directory: requestDirectory, ...body } = parameters;
+    return postSessionRequest(fetchImpl, baseUrl, `/session/${encodeURIComponent(sessionID)}/command`, body, {
+      headers: Object.keys(headers).length ? headers : undefined,
+      directory: requestDirectory ?? directory,
+      throwOnError: options?.throwOnError,
+    });
+  };
+
+  return client;
+}
+
+export async function waitForHealthy(
+  client: ReturnType<typeof createClient>,
+  options?: { timeoutMs?: number; pollMs?: number },
+) {
+  const timeoutMs = options?.timeoutMs ?? 10_000;
+  const pollMs = options?.pollMs ?? 250;
+
+  const start = Date.now();
+  let lastError: string | null = null;
+
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const health = unwrap(await client.global.health());
+      if (health.healthy) {
+        return health;
+      }
+      lastError = "Server reported unhealthy";
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : "Unknown error";
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+
+  throw new Error(lastError ?? "Timed out waiting for server health");
+}
diff --git a/apps/app/src/app/lib/openwork-deployment.ts b/apps/app/src/app/lib/openwork-deployment.ts
new file mode 100644
index 0000000000..77dd4bc742
--- /dev/null
+++ b/apps/app/src/app/lib/openwork-deployment.ts
@@ -0,0 +1,25 @@
+export const OPENWORK_DEPLOYMENT_ENV_VAR = "VITE_OPENWORK_DEPLOYMENT";
+
+export type OpenWorkDeployment = "desktop" | "web";
+
+function normalizeDeployment(value: string | undefined): OpenWorkDeployment {
+  const normalized = value?.trim().toLowerCase();
+  return normalized === "web" ? "web" : "desktop";
+}
+
+export function getOpenWorkDeployment(): OpenWorkDeployment {
+  const envValue =
+    typeof import.meta !== "undefined" && typeof import.meta.env?.VITE_OPENWORK_DEPLOYMENT === "string"
+      ? import.meta.env.VITE_OPENWORK_DEPLOYMENT
+      : undefined;
+
+  return normalizeDeployment(envValue);
+}
+
+export function isWebDeployment(): boolean {
+  return getOpenWorkDeployment() === "web";
+}
+
+export function isDesktopDeployment(): boolean {
+  return getOpenWorkDeployment() === "desktop";
+}
diff --git a/apps/app/src/app/lib/openwork-env-runtime.ts b/apps/app/src/app/lib/openwork-env-runtime.ts
new file mode 100644
index 0000000000..9999b9629f
--- /dev/null
+++ b/apps/app/src/app/lib/openwork-env-runtime.ts
@@ -0,0 +1,88 @@
+const PENDING_CHANGES_KEY = "openwork.settings.environment.pendingChanges";
+
+type PendingChangesState = {
+  pending: boolean;
+  runtimeKey?: string;
+};
+
+function getStorage(kind: "localStorage" | "sessionStorage"): Storage | null {
+  if (typeof window === "undefined") return null;
+  try {
+    return window[kind] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function parsePendingChangesState(raw: string | null): PendingChangesState {
+  if (!raw) return { pending: false };
+  if (raw === "1") return { pending: true };
+  try {
+    const parsed = JSON.parse(raw) as { pending?: unknown; runtimeKey?: unknown };
+    return {
+      pending: parsed.pending === true,
+      runtimeKey: typeof parsed.runtimeKey === "string" && parsed.runtimeKey.trim()
+        ? parsed.runtimeKey.trim()
+        : undefined,
+    };
+  } catch {
+    return { pending: false };
+  }
+}
+
+export function buildOpenworkEnvRuntimeKey(input: {
+  baseUrl?: string | null;
+  pid?: number | null;
+  port?: number | null;
+}): string | undefined {
+  const baseUrl = (input.baseUrl?.trim() ?? "").replace(/\/+$/, "");
+  const pid = typeof input.pid === "number" && Number.isFinite(input.pid) && input.pid > 0
+    ? `pid:${input.pid}`
+    : "";
+  const port = !pid && typeof input.port === "number" && Number.isFinite(input.port) && input.port > 0
+    ? `port:${input.port}`
+    : "";
+  const runtime = pid || port;
+  if (!baseUrl && !runtime) return undefined;
+  return `${baseUrl || "openwork"}::${runtime || "runtime"}`;
+}
+
+export function readOpenworkEnvPendingChanges(runtimeKey?: string | null): boolean {
+  const localStorage = getStorage("localStorage");
+  const sessionStorage = getStorage("sessionStorage");
+  const state = parsePendingChangesState(localStorage?.getItem(PENDING_CHANGES_KEY) ?? null);
+  const legacySessionState = parsePendingChangesState(
+    sessionStorage?.getItem(PENDING_CHANGES_KEY) ?? null,
+  );
+  const pending = state.pending ? state : legacySessionState;
+  if (!pending.pending) return false;
+
+  const currentRuntimeKey = runtimeKey?.trim() || undefined;
+  if (currentRuntimeKey && pending.runtimeKey && pending.runtimeKey !== currentRuntimeKey) {
+    writeOpenworkEnvPendingChanges(false);
+    return false;
+  }
+
+  return true;
+}
+
+export function writeOpenworkEnvPendingChanges(value: boolean, runtimeKey?: string | null): void {
+  const localStorage = getStorage("localStorage");
+  const sessionStorage = getStorage("sessionStorage");
+  try {
+    if (value) {
+      const payload = {
+        pending: true,
+        changedAt: Date.now(),
+        ...(runtimeKey?.trim() ? { runtimeKey: runtimeKey.trim() } : {}),
+      };
+      localStorage?.setItem(PENDING_CHANGES_KEY, JSON.stringify(payload));
+      sessionStorage?.removeItem(PENDING_CHANGES_KEY);
+    } else {
+      localStorage?.removeItem(PENDING_CHANGES_KEY);
+      sessionStorage?.removeItem(PENDING_CHANGES_KEY);
+    }
+  } catch {
+    // ignore persistence failures
+  }
+}
diff --git a/apps/app/src/app/lib/openwork-links.ts b/apps/app/src/app/lib/openwork-links.ts
new file mode 100644
index 0000000000..b13ad8fca3
--- /dev/null
+++ b/apps/app/src/app/lib/openwork-links.ts
@@ -0,0 +1,206 @@
+import { DEFAULT_DEN_BASE_URL, normalizeDenBaseUrl } from "./den";
+import { normalizeOpenworkServerUrl } from "./openwork-server";
+import { normalizeBundleImportIntent, parseBundleDeepLink } from "../bundles/sources";
+import type { BundleRequest } from "../bundles/types";
+
+export type RemoteWorkspaceDefaults = {
+  openworkHostUrl?: string | null;
+  openworkToken?: string | null;
+  directory?: string | null;
+  displayName?: string | null;
+  autoConnect?: boolean;
+};
+
+export type DenAuthDeepLink = {
+  grant: string;
+  denBaseUrl: string;
+};
+
+function isSupportedDeepLinkProtocol(protocol: string): boolean {
+  const normalized = protocol.toLowerCase();
+  return normalized === "openwork:" || normalized === "openwork-dev:" || normalized === "https:" || normalized === "http:";
+}
+
+export function parseRemoteConnectDeepLink(rawUrl: string): RemoteWorkspaceDefaults | null {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  const protocol = url.protocol.toLowerCase();
+  if (!isSupportedDeepLinkProtocol(protocol)) {
+    return null;
+  }
+
+  const routeHost = url.hostname.toLowerCase();
+  const routePath = url.pathname.replace(/^\/+/, "").toLowerCase();
+  const routeSegments = routePath.split("/").filter(Boolean);
+  const routeTail = routeSegments[routeSegments.length - 1] ?? "";
+  if (routeHost !== "connect-remote" && routePath !== "connect-remote" && routeTail !== "connect-remote") {
+    return null;
+  }
+
+  const hostUrlRaw = url.searchParams.get("openworkHostUrl") ?? url.searchParams.get("openworkUrl") ?? "";
+  const tokenRaw = url.searchParams.get("openworkToken") ?? url.searchParams.get("accessToken") ?? "";
+  const normalizedHostUrl = normalizeOpenworkServerUrl(hostUrlRaw);
+  const token = tokenRaw.trim();
+  if (!normalizedHostUrl || !token) {
+    return null;
+  }
+
+  const workerName = url.searchParams.get("workerName")?.trim() ?? "";
+  const workerId = url.searchParams.get("workerId")?.trim() ?? "";
+  const displayName = workerName || (workerId ? `Worker ${workerId.slice(0, 8)}` : "");
+  const autoConnectRaw =
+    url.searchParams.get("autoConnect") ??
+    url.searchParams.get("bypassModal") ??
+    url.searchParams.get("bypassAddWorkerModal") ??
+    "";
+  const autoConnect = ["1", "true", "yes", "on"].includes(autoConnectRaw.trim().toLowerCase());
+
+  return {
+    openworkHostUrl: normalizedHostUrl,
+    openworkToken: token,
+    directory: null,
+    displayName: displayName || null,
+    autoConnect,
+  };
+}
+
+export function stripRemoteConnectQuery(rawUrl: string): string | null {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  let changed = false;
+  for (const key of [
+    "openworkHostUrl",
+    "openworkUrl",
+    "openworkToken",
+    "accessToken",
+    "workerId",
+    "workerName",
+    "autoConnect",
+    "bypassModal",
+    "bypassAddWorkerModal",
+    "source",
+  ]) {
+    if (url.searchParams.has(key)) {
+      url.searchParams.delete(key);
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return null;
+  }
+
+  const search = url.searchParams.toString();
+  return `${url.pathname}${search ? `?${search}` : ""}${url.hash}`;
+}
+
+export function parseDenAuthDeepLink(rawUrl: string): DenAuthDeepLink | null {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+
+  const protocol = url.protocol.toLowerCase();
+  if (!isSupportedDeepLinkProtocol(protocol)) {
+    return null;
+  }
+
+  const routeHost = url.hostname.toLowerCase();
+  const routePath = url.pathname.replace(/^\/+/, "").toLowerCase();
+  const routeSegments = routePath.split("/").filter(Boolean);
+  const routeTail = routeSegments[routeSegments.length - 1] ?? "";
+  if (routeHost !== "den-auth" && routePath !== "den-auth" && routeTail !== "den-auth") {
+    return null;
+  }
+
+  const grant = url.searchParams.get("grant")?.trim() ?? "";
+  const denBaseUrl = normalizeDenBaseUrl(url.searchParams.get("denBaseUrl")?.trim() ?? "") ?? DEFAULT_DEN_BASE_URL;
+  if (!grant) {
+    return null;
+  }
+
+  return { grant, denBaseUrl };
+}
+
+function normalizeDebugDeepLinkInput(rawValue: string): string {
+  const trimmed = rawValue.trim();
+  if (!trimmed) return "";
+
+  const directMatch = trimmed.match(/(?:openwork-dev|openwork|https?):\/\/[^\s"'<>]+/i);
+  if (directMatch) return directMatch[0];
+
+  const bareShareMatch = trimmed.match(/share\.openwork(?:labs\.com|\.software)\/b\/[^\s"'<>]+/i);
+  if (bareShareMatch) return `https://${bareShareMatch[0]}`;
+
+  return trimmed;
+}
+
+export function parseDebugDeepLinkInput(rawValue: string):
+  | { kind: "bundle"; link: BundleRequest }
+  | { kind: "remote"; link: RemoteWorkspaceDefaults }
+  | { kind: "auth"; link: DenAuthDeepLink }
+  | null {
+  const normalized = normalizeDebugDeepLinkInput(rawValue);
+  if (!normalized) return null;
+
+  const denAuthLink = parseDenAuthDeepLink(normalized);
+  if (denAuthLink) {
+    return { kind: "auth", link: denAuthLink };
+  }
+
+  const bundleLink = parseBundleDeepLink(normalized);
+  if (bundleLink) {
+    return { kind: "bundle", link: bundleLink };
+  }
+
+  const remoteConnectLink = parseRemoteConnectDeepLink(normalized);
+  if (remoteConnectLink) {
+    return { kind: "remote", link: remoteConnectLink };
+  }
+
+  const bundleMatch = normalized.match(/ow_bundle=([^&\s]+)/i);
+  if (bundleMatch?.[1]) {
+    try {
+      const bundleUrl = decodeURIComponent(bundleMatch[1]);
+      const intentMatch = normalized.match(/(?:ow_intent|intent)=([^&\s]+)/i);
+      const labelMatch = normalized.match(/ow_label=([^&\s]+)/i);
+      const sourceMatch = normalized.match(/(?:ow_source|source)=([^&\s]+)/i);
+      return {
+        kind: "bundle",
+        link: {
+          bundleUrl,
+          intent: normalizeBundleImportIntent(intentMatch?.[1] ? decodeURIComponent(intentMatch[1]) : undefined),
+          label: labelMatch?.[1] ? decodeURIComponent(labelMatch[1]) : undefined,
+          source: sourceMatch?.[1] ? decodeURIComponent(sourceMatch[1]) : undefined,
+        },
+      };
+    } catch {
+      // ignore fallback parsing errors
+    }
+  }
+
+  const shareIdMatch = normalized.match(/share\.openwork(?:labs\.com|\.software)\/b\/([^\s/?#"'<>]+)/i);
+  if (shareIdMatch?.[1]) {
+    return {
+      kind: "bundle",
+      link: {
+        bundleUrl: `https://share.openworklabs.com/b/${shareIdMatch[1]}`,
+        intent: "new_worker",
+      },
+    };
+  }
+
+  return null;
+}
diff --git a/apps/app/src/app/lib/openwork-server.ts b/apps/app/src/app/lib/openwork-server.ts
new file mode 100644
index 0000000000..35737405d0
--- /dev/null
+++ b/apps/app/src/app/lib/openwork-server.ts
@@ -0,0 +1,1265 @@
+import type { Message, Part, Session, Todo } from "@opencode-ai/sdk/v2/client";
+import { desktopFetch } from "./desktop";
+import { isDesktopRuntime } from "../utils";
+import type { ExecResult, OpencodeConfigFile, WorkspaceInfo, WorkspaceList } from "./desktop";
+
+export type OpenworkServerCapabilities = {
+  skills: { read: boolean; write: boolean; source: "openwork" | "opencode" };
+  hub?: {
+    skills?: {
+      read: boolean;
+      install: boolean;
+      repo?: { owner: string; name: string; ref: string };
+    };
+  };
+  plugins: { read: boolean; write: boolean };
+  mcp: { read: boolean; write: boolean };
+  commands: { read: boolean; write: boolean };
+  config: { read: boolean; write: boolean };
+  sandbox?: { enabled: boolean; backend: "none" | "docker" | "container" };
+  proxy?: { opencode: boolean };
+  toolProviders?: {
+    browser?: {
+      enabled: boolean;
+      placement: "in-sandbox" | "host-machine" | "client-machine" | "external";
+      mode: "none" | "headless" | "interactive";
+    };
+    files?: {
+      injection: boolean;
+      outbox: boolean;
+      inboxPath: string;
+      outboxPath: string;
+      maxBytes: number;
+    };
+  };
+};
+
+export type OpenworkServerStatus = "connected" | "disconnected" | "limited";
+
+export type OpenworkServerDiagnostics = {
+  ok: boolean;
+  version: string;
+  uptimeMs: number;
+  readOnly: boolean;
+  approval: { mode: "manual" | "auto"; timeoutMs: number };
+  corsOrigins: string[];
+  workspaceCount: number;
+  activeWorkspaceId?: string | null;
+  selectedWorkspaceId?: string | null;
+  workspace: OpenworkWorkspaceInfo | null;
+  authorizedRoots: string[];
+  server: { host: string; port: number; configPath?: string | null };
+  tokenSource: { client: string; host: string };
+};
+
+export type OpenworkRuntimeServiceName = "openwork-server" | "opencode";
+
+export type OpenworkRuntimeServiceSnapshot = {
+  name: OpenworkRuntimeServiceName;
+  enabled: boolean;
+  running: boolean;
+  targetVersion: string | null;
+  actualVersion: string | null;
+  upgradeAvailable: boolean;
+};
+
+export type OpenworkRuntimeSnapshot = {
+  ok: boolean;
+  orchestrator?: {
+    version: string;
+    startedAt: number;
+  };
+  worker?: {
+    workspace: string;
+    sandboxMode: string;
+  };
+  upgrade?: {
+    status: "idle" | "running" | "failed";
+    startedAt: number | null;
+    finishedAt: number | null;
+    error: string | null;
+    operationId: string | null;
+    services: OpenworkRuntimeServiceName[];
+  };
+  services: OpenworkRuntimeServiceSnapshot[];
+};
+
+export type OpenworkServerSettings = {
+  urlOverride?: string;
+  portOverride?: number;
+  token?: string;
+  hostToken?: string;
+  remoteAccessEnabled?: boolean;
+};
+
+export type OpenworkWorkspaceInfo = WorkspaceInfo & {
+  opencode?: {
+    baseUrl?: string;
+    directory?: string;
+    username?: string;
+    password?: string;
+  };
+};
+
+export type OpenworkWorkspaceList = {
+  items: OpenworkWorkspaceInfo[];
+  workspaces?: WorkspaceInfo[];
+  activeId?: string | null;
+};
+
+export type OpenworkSessionMessage = {
+  info: Message;
+  parts: Part[];
+};
+
+export type OpenworkSessionSnapshot = {
+  session: Session;
+  messages: OpenworkSessionMessage[];
+  todos: Todo[];
+  status:
+    | { type: "idle" }
+    | { type: "busy" }
+    | { type: "retry"; attempt: number; message: string; next: number };
+};
+
+export type OpenworkPluginItem = {
+  spec: string;
+  source: "config" | "dir.project" | "dir.global";
+  scope: "project" | "global";
+  path?: string;
+};
+
+export type OpenworkSkillItem = {
+  name: string;
+  path: string;
+  description: string;
+  scope: "project" | "global";
+  trigger?: string;
+};
+
+export type OpenworkSkillContent = {
+  item: OpenworkSkillItem;
+  content: string;
+};
+
+export type OpenworkHubSkillItem = {
+  name: string;
+  description: string;
+  trigger?: string;
+  source: {
+    owner: string;
+    repo: string;
+    ref: string;
+    path: string;
+  };
+};
+
+export type OpenworkHubRepo = {
+  owner?: string;
+  repo?: string;
+  ref?: string;
+};
+
+export type OpenworkWorkspaceFileContent = {
+  path: string;
+  content: string;
+  bytes: number;
+  updatedAt: number;
+};
+
+export type OpenworkWorkspaceFileWriteResult = {
+  ok: boolean;
+  path: string;
+  bytes: number;
+  updatedAt: number;
+  revision?: string;
+};
+
+export type OpenworkCommandItem = {
+  name: string;
+  description?: string;
+  template: string;
+  agent?: string;
+  model?: string | null;
+  subtask?: boolean;
+  scope: "workspace" | "global";
+};
+
+export type OpenworkMcpItem = {
+  name: string;
+  config: Record<string, unknown>;
+  source: "config.project" | "config.global" | "config.remote";
+  disabledByTools?: boolean;
+};
+
+export type OpenworkWorkspaceExport = {
+  workspaceId: string;
+  exportedAt: number;
+  opencode?: Record<string, unknown>;
+  openwork?: Record<string, unknown>;
+  skills?: Array<{ name: string; description?: string; trigger?: string; content: string }>;
+  commands?: Array<{ name: string; description?: string; template?: string }>;
+  files?: Array<{ path: string; content: string }>;
+};
+
+export type OpenworkWorkspaceImportChange = {
+  kind: "opencode" | "openwork" | "skill" | "command" | "file";
+  action: "create" | "update" | "replace" | "delete" | "unchanged";
+  label: string;
+  path: string;
+};
+
+export type OpenworkWorkspaceImportPreview = {
+  fingerprint: string;
+  summary: {
+    total: number;
+    create: number;
+    update: number;
+    replace: number;
+    delete: number;
+    unchanged: number;
+  };
+  changes: OpenworkWorkspaceImportChange[];
+};
+
+export type OpenworkWorkspaceExportSensitiveMode = "auto" | "include" | "exclude";
+
+export type OpenworkWorkspaceExportWarning = {
+  id: string;
+  label: string;
+  detail: string;
+};
+
+export type OpenworkBlueprintSessionsMaterializeResult = {
+  ok: boolean;
+  created: Array<{ templateId: string; sessionId: string; title: string }>;
+  existing: Array<{ templateId: string; sessionId: string }>;
+  openSessionId: string | null;
+};
+
+export type OpenworkArtifactItem = {
+  id: string;
+  name?: string;
+  path?: string;
+  size?: number;
+  createdAt?: number;
+  updatedAt?: number;
+  mime?: string;
+};
+
+export type OpenworkArtifactList = {
+  items: OpenworkArtifactItem[];
+};
+
+export type OpenworkInboxItem = {
+  id: string;
+  name?: string;
+  path?: string;
+  size?: number;
+  updatedAt?: number;
+};
+
+export type OpenworkInboxList = {
+  items: OpenworkInboxItem[];
+};
+
+export type OpenworkInboxUploadResult = {
+  ok: boolean;
+  path: string;
+  bytes: number;
+};
+
+export type OpenworkActor = {
+  type: "remote" | "host";
+  clientId?: string;
+  tokenHash?: string;
+};
+
+export type OpenworkAuditEntry = {
+  id: string;
+  workspaceId: string;
+  actor: OpenworkActor;
+  action: string;
+  target: string;
+  summary: string;
+  timestamp: number;
+};
+
+export type OpenworkReloadTrigger = {
+  type: "skill" | "plugin" | "config" | "mcp" | "agent" | "command";
+  name?: string;
+  action?: "added" | "removed" | "updated";
+  path?: string;
+};
+
+export type OpenworkReloadEvent = {
+  id: string;
+  seq: number;
+  workspaceId: string;
+  reason: "plugins" | "skills" | "mcp" | "config" | "agents" | "commands";
+  trigger?: OpenworkReloadTrigger;
+  timestamp: number;
+};
+
+// Fallback for explicit server-mode URL derivation. Desktop local workers replace this
+// with the persisted runtime-discovered port once the host reports it.
+export const DEFAULT_OPENWORK_SERVER_PORT = 8787;
+
+const STORAGE_URL_OVERRIDE = "openwork.server.urlOverride";
+const STORAGE_PORT_OVERRIDE = "openwork.server.port";
+const STORAGE_TOKEN = "openwork.server.token";
+const STORAGE_HOST_TOKEN = "openwork.server.hostToken";
+const STORAGE_REMOTE_ACCESS = "openwork.server.remoteAccessEnabled";
+
+export function normalizeOpenworkServerUrl(input: string) {
+  const trimmed = input.trim();
+  if (!trimmed) return null;
+  const withProtocol = /^https?:\/\//.test(trimmed) ? trimmed : `http://${trimmed}`;
+  return withProtocol.replace(/\/+$/, "");
+}
+
+export function isLoopbackOpenworkServerUrl(input: string) {
+  const normalized = normalizeOpenworkServerUrl(input) ?? "";
+  if (!normalized) return false;
+  try {
+    const hostname = new URL(normalized).hostname.toLowerCase();
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+
+export function parseOpenworkWorkspaceIdFromUrl(input: string) {
+  const normalized = normalizeOpenworkServerUrl(input) ?? "";
+  if (!normalized) return null;
+
+  try {
+    const url = new URL(normalized);
+    const segments = url.pathname.split("/").filter(Boolean);
+    const last = segments[segments.length - 1] ?? "";
+    const prev = segments[segments.length - 2] ?? "";
+    if (prev !== "w" || !last) return null;
+    return decodeURIComponent(last);
+  } catch {
+    const match = normalized.match(/\/w\/([^/?#]+)/);
+    if (!match?.[1]) return null;
+    try {
+      return decodeURIComponent(match[1]);
+    } catch {
+      return match[1];
+    }
+  }
+}
+
+export function buildOpenworkWorkspaceBaseUrl(hostUrl: string, workspaceId?: string | null) {
+  const normalized = normalizeOpenworkServerUrl(hostUrl) ?? "";
+  if (!normalized) return null;
+
+  try {
+    const url = new URL(normalized);
+    const segments = url.pathname.split("/").filter(Boolean);
+    const last = segments[segments.length - 1] ?? "";
+    const prev = segments[segments.length - 2] ?? "";
+    const alreadyMounted = prev === "w" && Boolean(last);
+    if (alreadyMounted) {
+      return url.toString().replace(/\/+$/, "");
+    }
+
+    const id = (workspaceId ?? "").trim();
+    if (!id) return url.toString().replace(/\/+$/, "");
+
+    const basePath = url.pathname.replace(/\/+$/, "");
+    url.pathname = `${basePath}/w/${encodeURIComponent(id)}`;
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    const id = (workspaceId ?? "").trim();
+    if (!id) return normalized;
+    return `${normalized.replace(/\/+$/, "")}/w/${encodeURIComponent(id)}`;
+  }
+}
+
+const OPENWORK_INVITE_PARAM_URL = "ow_url";
+const OPENWORK_INVITE_PARAM_TOKEN = "ow_token";
+const OPENWORK_INVITE_PARAM_STARTUP = "ow_startup";
+const OPENWORK_INVITE_PARAM_AUTO_CONNECT = "ow_auto_connect";
+
+export type OpenworkConnectInvite = {
+  url: string;
+  token?: string;
+  startup?: "server";
+  autoConnect?: boolean;
+};
+
+export function readOpenworkConnectInviteFromSearch(input: string | URLSearchParams) {
+  const search =
+    typeof input === "string"
+      ? new URLSearchParams(input.startsWith("?") ? input.slice(1) : input)
+      : input;
+
+  const rawUrl = search.get(OPENWORK_INVITE_PARAM_URL)?.trim() ?? "";
+  const url = normalizeOpenworkServerUrl(rawUrl);
+  if (!url) return null;
+
+  const token = search.get(OPENWORK_INVITE_PARAM_TOKEN)?.trim() ?? "";
+  const startupRaw = search.get(OPENWORK_INVITE_PARAM_STARTUP)?.trim() ?? "";
+  const startup = startupRaw === "server" ? "server" : undefined;
+  const autoConnect = search.get(OPENWORK_INVITE_PARAM_AUTO_CONNECT)?.trim() === "1";
+
+  return {
+    url,
+    token: token || undefined,
+    startup,
+    autoConnect: autoConnect || undefined,
+  } satisfies OpenworkConnectInvite;
+}
+
+export function stripOpenworkConnectInviteFromUrl(input: string) {
+  try {
+    const url = new URL(input);
+    url.searchParams.delete(OPENWORK_INVITE_PARAM_URL);
+    url.searchParams.delete(OPENWORK_INVITE_PARAM_TOKEN);
+    url.searchParams.delete(OPENWORK_INVITE_PARAM_STARTUP);
+    url.searchParams.delete(OPENWORK_INVITE_PARAM_AUTO_CONNECT);
+    return url.toString();
+  } catch {
+    return input;
+  }
+}
+
+export function readOpenworkServerSettings(): OpenworkServerSettings {
+  if (typeof window === "undefined") return {};
+  try {
+    const urlOverride = normalizeOpenworkServerUrl(
+      window.localStorage.getItem(STORAGE_URL_OVERRIDE) ?? "",
+    );
+    const portRaw = window.localStorage.getItem(STORAGE_PORT_OVERRIDE) ?? "";
+    const portOverride = portRaw ? Number(portRaw) : undefined;
+    const token = window.localStorage.getItem(STORAGE_TOKEN) ?? undefined;
+    const hostToken = window.localStorage.getItem(STORAGE_HOST_TOKEN) ?? undefined;
+    const remoteAccessRaw = window.localStorage.getItem(STORAGE_REMOTE_ACCESS) ?? "";
+    return {
+      urlOverride: urlOverride ?? undefined,
+      portOverride: Number.isNaN(portOverride) ? undefined : portOverride,
+      token: token?.trim() || undefined,
+      hostToken: hostToken?.trim() || undefined,
+      remoteAccessEnabled: remoteAccessRaw === "1",
+    };
+  } catch {
+    return {};
+  }
+}
+
+export function writeOpenworkServerSettings(next: OpenworkServerSettings): OpenworkServerSettings {
+  if (typeof window === "undefined") return next;
+  try {
+    const urlOverride = normalizeOpenworkServerUrl(next.urlOverride ?? "");
+    const portOverride = typeof next.portOverride === "number" ? next.portOverride : undefined;
+    const token = next.token?.trim() || undefined;
+    const hostToken = next.hostToken?.trim() || undefined;
+    const remoteAccessEnabled = next.remoteAccessEnabled === true;
+
+    if (urlOverride) {
+      window.localStorage.setItem(STORAGE_URL_OVERRIDE, urlOverride);
+    } else {
+      window.localStorage.removeItem(STORAGE_URL_OVERRIDE);
+    }
+
+    if (typeof portOverride === "number" && !Number.isNaN(portOverride)) {
+      window.localStorage.setItem(STORAGE_PORT_OVERRIDE, String(portOverride));
+    } else {
+      window.localStorage.removeItem(STORAGE_PORT_OVERRIDE);
+    }
+
+    if (token) {
+      window.localStorage.setItem(STORAGE_TOKEN, token);
+    } else {
+      window.localStorage.removeItem(STORAGE_TOKEN);
+    }
+
+    if (hostToken) {
+      window.localStorage.setItem(STORAGE_HOST_TOKEN, hostToken);
+    } else {
+      window.localStorage.removeItem(STORAGE_HOST_TOKEN);
+    }
+
+    if (remoteAccessEnabled) {
+      window.localStorage.setItem(STORAGE_REMOTE_ACCESS, "1");
+    } else {
+      window.localStorage.removeItem(STORAGE_REMOTE_ACCESS);
+    }
+
+    return readOpenworkServerSettings();
+  } catch {
+    return next;
+  }
+}
+
+export function hydrateOpenworkServerSettingsFromEnv() {
+  if (typeof window === "undefined") return;
+
+  const envUrl = typeof import.meta.env?.VITE_OPENWORK_URL === "string"
+    ? import.meta.env.VITE_OPENWORK_URL.trim()
+    : "";
+  const envPort = typeof import.meta.env?.VITE_OPENWORK_PORT === "string"
+    ? import.meta.env.VITE_OPENWORK_PORT.trim()
+    : "";
+  const envToken = typeof import.meta.env?.VITE_OPENWORK_TOKEN === "string"
+    ? import.meta.env.VITE_OPENWORK_TOKEN.trim()
+    : "";
+  const envHostToken = typeof import.meta.env?.VITE_OPENWORK_HOST_TOKEN === "string"
+    ? import.meta.env.VITE_OPENWORK_HOST_TOKEN.trim()
+    : "";
+
+  if (!envUrl && !envPort && !envToken && !envHostToken) return;
+
+  try {
+    const current = readOpenworkServerSettings();
+    const next: OpenworkServerSettings = { ...current };
+    let changed = false;
+
+    if (!current.urlOverride && envUrl) {
+      next.urlOverride = normalizeOpenworkServerUrl(envUrl) ?? undefined;
+      changed = true;
+    }
+
+    if (!current.portOverride && envPort) {
+      const parsed = Number(envPort);
+      if (Number.isFinite(parsed) && parsed > 0) {
+        next.portOverride = parsed;
+        changed = true;
+      }
+    }
+
+    if (!current.token && envToken) {
+      next.token = envToken;
+      changed = true;
+    }
+
+    if (!current.hostToken && envHostToken) {
+      next.hostToken = envHostToken;
+      changed = true;
+    }
+
+    if (changed) {
+      writeOpenworkServerSettings(next);
+    }
+  } catch {
+    // ignore
+  }
+}
+
+export function clearOpenworkServerSettings() {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.removeItem(STORAGE_URL_OVERRIDE);
+    window.localStorage.removeItem(STORAGE_PORT_OVERRIDE);
+    window.localStorage.removeItem(STORAGE_TOKEN);
+    window.localStorage.removeItem(STORAGE_HOST_TOKEN);
+    window.localStorage.removeItem(STORAGE_REMOTE_ACCESS);
+  } catch {
+    // ignore
+  }
+}
+
+export class OpenworkServerError extends Error {
+  status: number;
+  code: string;
+  details?: unknown;
+
+  constructor(status: number, code: string, message: string, details?: unknown) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+}
+
+function buildHeaders(
+  token?: string,
+  hostToken?: string,
+  extra?: Record<string, string>,
+) {
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  if (hostToken) {
+    headers["X-OpenWork-Host-Token"] = hostToken;
+  }
+  if (extra) {
+    Object.assign(headers, extra);
+  }
+  return headers;
+}
+
+function buildAuthHeaders(token?: string, hostToken?: string, extra?: Record<string, string>) {
+  const headers: Record<string, string> = {};
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  if (hostToken) {
+    headers["X-OpenWork-Host-Token"] = hostToken;
+  }
+  if (extra) {
+    Object.assign(headers, extra);
+  }
+  return headers;
+}
+
+// Use Tauri's fetch when running in the desktop app to avoid CORS issues.
+// Stream URLs (SSE) bypass the plugin because its `fetch_read_body` IPC call
+// blocks until the body closes — that freezes the webview for infinite bodies.
+const OPENWORK_STREAM_URL_RE = /\/events(\b|\?)|\/event-stream\b|\/stream\b/;
+
+function isStreamUrl(url: string): boolean {
+  return OPENWORK_STREAM_URL_RE.test(url);
+}
+
+const resolveFetch = (url?: string) => {
+  if (!isDesktopRuntime()) return globalThis.fetch;
+  if (url && isStreamUrl(url)) {
+    return typeof window !== "undefined" ? window.fetch.bind(window) : globalThis.fetch;
+  }
+  return desktopFetch;
+};
+
+const DEFAULT_OPENWORK_SERVER_TIMEOUT_MS = 10_000;
+
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+
+async function fetchWithTimeout(
+  fetchImpl: FetchLike,
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return fetchImpl(url, init);
+  }
+
+  const controller = typeof AbortController !== "undefined" ? new AbortController() : null;
+  const signal = controller?.signal;
+  const initWithSignal = signal && !init.signal ? { ...init, signal } : init;
+
+  let timeoutId: ReturnType<typeof setTimeout> | null = null;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeoutId = setTimeout(() => {
+      try {
+        controller?.abort();
+      } catch {
+        // ignore
+      }
+      reject(new Error("Request timed out."));
+    }, timeoutMs);
+  });
+
+  try {
+    return await Promise.race([fetchImpl(url, initWithSignal), timeoutPromise]);
+  } catch (error) {
+    const name = (error && typeof error === "object" && "name" in error ? (error as any).name : "") as string;
+    if (name === "AbortError") {
+      throw new Error("Request timed out.");
+    }
+    throw error;
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+  }
+}
+
+async function requestJson<T>(
+  baseUrl: string,
+  path: string,
+  options: { method?: string; token?: string; hostToken?: string; body?: unknown; timeoutMs?: number } = {},
+): Promise<T> {
+  const url = `${baseUrl}${path}`;
+  const fetchImpl = resolveFetch(url);
+  const response = await fetchWithTimeout(
+    fetchImpl,
+    url,
+    {
+      method: options.method ?? "GET",
+      headers: buildHeaders(options.token, options.hostToken),
+      body: options.body ? JSON.stringify(options.body) : undefined,
+    },
+    options.timeoutMs ?? DEFAULT_OPENWORK_SERVER_TIMEOUT_MS,
+  );
+
+  const text = await response.text();
+  const json = text ? JSON.parse(text) : null;
+
+  if (!response.ok) {
+    const code = typeof json?.code === "string" ? json.code : "request_failed";
+    const message = typeof json?.message === "string" ? json.message : response.statusText;
+    throw new OpenworkServerError(response.status, code, message, json?.details);
+  }
+
+  return json as T;
+}
+
+async function requestMultipartRaw(
+  baseUrl: string,
+  path: string,
+  options: { method?: string; token?: string; hostToken?: string; body?: FormData; timeoutMs?: number } = {},
+): Promise<{ ok: boolean; status: number; text: string }>{
+  const url = `${baseUrl}${path}`;
+  const fetchImpl = resolveFetch(url);
+  const response = await fetchWithTimeout(
+    fetchImpl,
+    url,
+    {
+      method: options.method ?? "POST",
+      headers: buildAuthHeaders(options.token, options.hostToken),
+      body: options.body,
+    },
+    options.timeoutMs ?? DEFAULT_OPENWORK_SERVER_TIMEOUT_MS,
+  );
+  const text = await response.text();
+  return { ok: response.ok, status: response.status, text };
+}
+
+async function requestBinary(
+  baseUrl: string,
+  path: string,
+  options: { method?: string; token?: string; hostToken?: string; timeoutMs?: number } = {},
+): Promise<{ data: ArrayBuffer; contentType: string | null; filename: string | null }>{
+  const url = `${baseUrl}${path}`;
+  const fetchImpl = resolveFetch(url);
+  const response = await fetchWithTimeout(
+    fetchImpl,
+    url,
+    {
+      method: options.method ?? "GET",
+      headers: buildAuthHeaders(options.token, options.hostToken),
+    },
+    options.timeoutMs ?? DEFAULT_OPENWORK_SERVER_TIMEOUT_MS,
+  );
+
+  if (!response.ok) {
+    const text = await response.text();
+    let json: any = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    const code = typeof json?.code === "string" ? json.code : "request_failed";
+    const message = typeof json?.message === "string" ? json.message : response.statusText;
+    throw new OpenworkServerError(response.status, code, message, json?.details);
+  }
+
+  const contentType = response.headers.get("content-type");
+  const disposition = response.headers.get("content-disposition") ?? "";
+  const filenameMatch = disposition.match(/filename\*=UTF-8''([^;]+)|filename="?([^";]+)"?/i);
+  const filenameRaw = filenameMatch?.[1] ?? filenameMatch?.[2] ?? null;
+  const filename = filenameRaw ? decodeURIComponent(filenameRaw) : null;
+  const data = await response.arrayBuffer();
+  return { data, contentType, filename };
+}
+
+export function createOpenworkServerClient(options: { baseUrl: string; token?: string; hostToken?: string }) {
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const token = options.token;
+  const hostToken = options.hostToken;
+
+  const timeouts = {
+    health: 3_000,
+    capabilities: 6_000,
+    listWorkspaces: 8_000,
+    activateWorkspace: 10_000,
+    deleteWorkspace: 10_000,
+    deleteSession: 12_000,
+    sessionRead: 12_000,
+    status: 6_000,
+    config: 10_000,
+    workspaceExport: 30_000,
+    workspaceImport: 30_000,
+    shareBundle: 20_000,
+    binary: 60_000,
+  };
+
+  return {
+    baseUrl,
+    token,
+    health: () =>
+      requestJson<{ ok: boolean; version: string; uptimeMs: number }>(baseUrl, "/health", { token, hostToken, timeoutMs: timeouts.health }),
+    runtimeVersions: () =>
+      requestJson<OpenworkRuntimeSnapshot>(baseUrl, "/runtime/versions", { token, hostToken, timeoutMs: timeouts.status }),
+    status: () => requestJson<OpenworkServerDiagnostics>(baseUrl, "/status", { token, hostToken, timeoutMs: timeouts.status }),
+    capabilities: () => requestJson<OpenworkServerCapabilities>(baseUrl, "/capabilities", { token, hostToken, timeoutMs: timeouts.capabilities }),
+    listWorkspaces: () => requestJson<OpenworkWorkspaceList>(baseUrl, "/workspaces", { token, hostToken, timeoutMs: timeouts.listWorkspaces }),
+    createLocalWorkspace: (payload: { folderPath: string; name: string; preset: string }) =>
+      requestJson<WorkspaceList>(baseUrl, "/workspaces/local", {
+        token,
+        hostToken,
+        method: "POST",
+        body: payload,
+        timeoutMs: timeouts.activateWorkspace,
+      }),
+    updateWorkspaceDisplayName: (workspaceId: string, displayName: string | null) =>
+      requestJson<WorkspaceList>(baseUrl, `/workspaces/${encodeURIComponent(workspaceId)}/display-name`, {
+        token,
+        hostToken,
+        method: "PATCH",
+        body: { displayName },
+        timeoutMs: timeouts.activateWorkspace,
+      }),
+    activateWorkspace: (workspaceId: string) =>
+      requestJson<{ activeId: string; workspace: OpenworkWorkspaceInfo }>(
+        baseUrl,
+        `/workspaces/${encodeURIComponent(workspaceId)}/activate`,
+        { token, hostToken, method: "POST", timeoutMs: timeouts.activateWorkspace },
+      ),
+    deleteWorkspace: (workspaceId: string) =>
+      requestJson<{ ok: boolean; deleted: boolean; persisted: boolean; activeId: string | null; items: OpenworkWorkspaceInfo[]; workspaces?: WorkspaceInfo[] }>(
+        baseUrl,
+        `/workspaces/${encodeURIComponent(workspaceId)}`,
+        { token, hostToken, method: "DELETE", timeoutMs: timeouts.deleteWorkspace },
+      ),
+    deleteSession: (workspaceId: string, sessionId: string) =>
+      requestJson<{ ok: boolean }>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}`,
+        { token, hostToken, method: "DELETE", timeoutMs: timeouts.deleteSession },
+      ),
+    listSessions: (
+      workspaceId: string,
+      options?: { roots?: boolean; start?: number; search?: string; limit?: number },
+    ) => {
+      const query = new URLSearchParams();
+      if (typeof options?.roots === "boolean") query.set("roots", String(options.roots));
+      if (typeof options?.start === "number") query.set("start", String(options.start));
+      if (options?.search?.trim()) query.set("search", options.search.trim());
+      if (typeof options?.limit === "number") query.set("limit", String(options.limit));
+      const suffix = query.size ? `?${query.toString()}` : "";
+      return requestJson<{ items: Session[] }>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/sessions${suffix}`,
+        { token, hostToken, timeoutMs: timeouts.sessionRead },
+      );
+    },
+    getSession: (workspaceId: string, sessionId: string) =>
+      requestJson<{ item: Session }>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}`,
+        { token, hostToken, timeoutMs: timeouts.sessionRead },
+      ),
+    getSessionMessages: (workspaceId: string, sessionId: string, options?: { limit?: number }) => {
+      const query = new URLSearchParams();
+      if (typeof options?.limit === "number") query.set("limit", String(options.limit));
+      const suffix = query.size ? `?${query.toString()}` : "";
+      return requestJson<{ items: OpenworkSessionMessage[] }>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}/messages${suffix}`,
+        { token, hostToken, timeoutMs: timeouts.sessionRead },
+      );
+    },
+    getSessionSnapshot: (workspaceId: string, sessionId: string, options?: { limit?: number }) => {
+      const query = new URLSearchParams();
+      if (typeof options?.limit === "number") query.set("limit", String(options.limit));
+      const suffix = query.size ? `?${query.toString()}` : "";
+      return requestJson<{ item: OpenworkSessionSnapshot }>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}/snapshot${suffix}`,
+        { token, hostToken, timeoutMs: timeouts.sessionRead },
+      );
+    },
+    exportWorkspace: (
+      workspaceId: string,
+      options?: { sensitiveMode?: OpenworkWorkspaceExportSensitiveMode },
+    ) => {
+      const query = new URLSearchParams();
+      if (options?.sensitiveMode) {
+        query.set("sensitive", options.sensitiveMode);
+      }
+      const suffix = query.size ? `?${query.toString()}` : "";
+      return requestJson<OpenworkWorkspaceExport>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/export${suffix}`, {
+        token,
+        hostToken,
+        timeoutMs: timeouts.workspaceExport,
+      });
+    },
+    importWorkspace: (workspaceId: string, payload: Record<string, unknown>) =>
+      requestJson<{ ok: boolean; preview?: OpenworkWorkspaceImportPreview }>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/import`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: payload,
+        timeoutMs: timeouts.workspaceImport,
+      }),
+    previewWorkspaceImport: (workspaceId: string, payload: Record<string, unknown>) =>
+      requestJson<OpenworkWorkspaceImportPreview>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/import/preview`,
+        {
+          token,
+          hostToken,
+          method: "POST",
+          body: payload,
+          timeoutMs: timeouts.workspaceImport,
+        },
+      ),
+    materializeBlueprintSessions: (workspaceId: string) =>
+      requestJson<OpenworkBlueprintSessionsMaterializeResult>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/blueprint/sessions/materialize`,
+        {
+          token,
+          hostToken,
+          method: "POST",
+          timeoutMs: timeouts.workspaceImport,
+        },
+      ),
+    publishBundle: (payload: unknown, bundleType: "skill" | "skills-set", options?: { name?: string; timeoutMs?: number }) =>
+      requestJson<{ url: string }>(baseUrl, "/share/bundles/publish", {
+        token,
+        hostToken,
+        method: "POST",
+        body: {
+          payload,
+          bundleType,
+          name: options?.name,
+          timeoutMs: options?.timeoutMs,
+        },
+        timeoutMs: options?.timeoutMs ?? timeouts.shareBundle,
+      }),
+    fetchBundle: (bundleUrl: string, options?: { timeoutMs?: number }) =>
+      requestJson<Record<string, unknown>>(baseUrl, "/share/bundles/fetch", {
+        token,
+        hostToken,
+        method: "POST",
+        body: {
+          bundleUrl,
+          timeoutMs: options?.timeoutMs,
+        },
+        timeoutMs: options?.timeoutMs ?? timeouts.shareBundle,
+      }),
+    getConfig: (workspaceId: string) =>
+      requestJson<{ opencode: Record<string, unknown>; openwork: Record<string, unknown>; updatedAt?: number | null }>(
+        baseUrl,
+        `/workspace/${workspaceId}/config`,
+        { token, hostToken, timeoutMs: timeouts.config },
+      ),
+    patchConfig: (workspaceId: string, payload: { opencode?: Record<string, unknown>; openwork?: Record<string, unknown> }) =>
+      requestJson<{ updatedAt?: number | null }>(baseUrl, `/workspace/${workspaceId}/config`, {
+        token,
+        hostToken,
+        method: "PATCH",
+        body: payload,
+      }),
+    readOpencodeConfigFile: (workspaceId: string, scope: "project" | "global" = "project") => {
+      const query = `?scope=${scope}`;
+      return requestJson<OpencodeConfigFile>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/opencode-config${query}`, {
+        token,
+        hostToken,
+      });
+    },
+    writeOpencodeConfigFile: (workspaceId: string, scope: "project" | "global", content: string) =>
+      requestJson<ExecResult>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/opencode-config`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: { scope, content },
+      }),
+    listReloadEvents: (workspaceId: string, options?: { since?: number }) => {
+      const query = typeof options?.since === "number" ? `?since=${options.since}` : "";
+      return requestJson<{ items: OpenworkReloadEvent[]; cursor?: number }>(
+        baseUrl,
+        `/workspace/${workspaceId}/events${query}`,
+        { token, hostToken },
+      );
+    },
+    reloadEngine: (workspaceId: string) =>
+      requestJson<{ ok: boolean; reloadedAt?: number }>(baseUrl, `/workspace/${workspaceId}/engine/reload`, {
+        token,
+        hostToken,
+        method: "POST",
+      }),
+    listPlugins: (workspaceId: string, options?: { includeGlobal?: boolean }) => {
+      const query = options?.includeGlobal ? "?includeGlobal=true" : "";
+      return requestJson<{ items: OpenworkPluginItem[]; loadOrder: string[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/plugins${query}`,
+        { token, hostToken },
+      );
+    },
+    addPlugin: (workspaceId: string, spec: string) =>
+      requestJson<{ items: OpenworkPluginItem[]; loadOrder: string[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/plugins`,
+        { token, hostToken, method: "POST", body: { spec } },
+      ),
+    removePlugin: (workspaceId: string, name: string) =>
+      requestJson<{ items: OpenworkPluginItem[]; loadOrder: string[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/plugins/${encodeURIComponent(name)}`,
+        { token, hostToken, method: "DELETE" },
+      ),
+    listSkills: (workspaceId: string, options?: { includeGlobal?: boolean }) => {
+      const query = options?.includeGlobal ? "?includeGlobal=true" : "";
+      return requestJson<{ items: OpenworkSkillItem[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/skills${query}`,
+        { token, hostToken },
+      );
+    },
+    listHubSkills: (options?: { repo?: OpenworkHubRepo }) => {
+      const params = new URLSearchParams();
+      const owner = options?.repo?.owner?.trim();
+      const repo = options?.repo?.repo?.trim();
+      const ref = options?.repo?.ref?.trim();
+      if (owner) params.set("owner", owner);
+      if (repo) params.set("repo", repo);
+      if (ref) params.set("ref", ref);
+      const query = params.size ? `?${params.toString()}` : "";
+      return requestJson<{ items: OpenworkHubSkillItem[] }>(baseUrl, `/hub/skills${query}`, {
+        token,
+        hostToken,
+      });
+    },
+    installHubSkill: (
+      workspaceId: string,
+      name: string,
+      options?: { overwrite?: boolean; repo?: { owner?: string; repo?: string; ref?: string } },
+    ) =>
+      requestJson<{ ok: boolean; name: string; path: string; action: "added" | "updated"; written: number; skipped: number }>(
+        baseUrl,
+        `/workspace/${workspaceId}/skills/hub/${encodeURIComponent(name)}`,
+        {
+          token,
+          hostToken,
+          method: "POST",
+          body: {
+            ...(options?.overwrite ? { overwrite: true } : {}),
+            ...(options?.repo ? { repo: options.repo } : {}),
+          },
+        },
+      ),
+    getSkill: (workspaceId: string, name: string, options?: { includeGlobal?: boolean }) => {
+      const query = options?.includeGlobal ? "?includeGlobal=true" : "";
+      return requestJson<OpenworkSkillContent>(
+        baseUrl,
+        `/workspace/${workspaceId}/skills/${encodeURIComponent(name)}${query}`,
+        { token, hostToken },
+      );
+    },
+    upsertSkill: (workspaceId: string, payload: { name: string; content: string; description?: string }) =>
+      requestJson<OpenworkSkillItem>(baseUrl, `/workspace/${workspaceId}/skills`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: payload,
+      }),
+    deleteSkill: (workspaceId: string, name: string) =>
+      requestJson<{ path: string }>(
+        baseUrl,
+        `/workspace/${workspaceId}/skills/${encodeURIComponent(name)}`,
+        {
+          token,
+          hostToken,
+          method: "DELETE",
+        },
+      ),
+    listMcp: (workspaceId: string) =>
+      requestJson<{ items: OpenworkMcpItem[] }>(baseUrl, `/workspace/${workspaceId}/mcp`, { token, hostToken }),
+    addMcp: (workspaceId: string, payload: { name: string; config: Record<string, unknown> }) =>
+      requestJson<{ items: OpenworkMcpItem[] }>(baseUrl, `/workspace/${workspaceId}/mcp`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: payload,
+      }),
+    removeMcp: (workspaceId: string, name: string) =>
+      requestJson<{ items: OpenworkMcpItem[] }>(baseUrl, `/workspace/${workspaceId}/mcp/${encodeURIComponent(name)}`, {
+        token,
+        hostToken,
+        method: "DELETE",
+      }),
+    setMcpEnabled: (workspaceId: string, name: string, enabled: boolean) =>
+      requestJson<{ items: OpenworkMcpItem[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/mcp/${encodeURIComponent(name)}/enabled`,
+        {
+          token,
+          hostToken,
+          method: "POST",
+          body: { enabled },
+        },
+      ),
+
+    logoutMcpAuth: (workspaceId: string, name: string) =>
+      requestJson<{ ok: true }>(baseUrl, `/workspace/${workspaceId}/mcp/${encodeURIComponent(name)}/auth`, {
+        token,
+        hostToken,
+        method: "DELETE",
+      }),
+
+    listCommands: (workspaceId: string, scope: "workspace" | "global" = "workspace") =>
+      requestJson<{ items: OpenworkCommandItem[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/commands?scope=${scope}`,
+        { token, hostToken },
+      ),
+    listAudit: (workspaceId: string, limit = 50) =>
+      requestJson<{ items: OpenworkAuditEntry[] }>(
+        baseUrl,
+        `/workspace/${workspaceId}/audit?limit=${limit}`,
+        { token, hostToken },
+      ),
+    upsertCommand: (
+      workspaceId: string,
+      payload: { name: string; description?: string; template: string; agent?: string; model?: string | null; subtask?: boolean },
+    ) =>
+      requestJson<{ items: OpenworkCommandItem[] }>(baseUrl, `/workspace/${workspaceId}/commands`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: payload,
+      }),
+    deleteCommand: (workspaceId: string, name: string) =>
+      requestJson<{ ok: boolean }>(baseUrl, `/workspace/${workspaceId}/commands/${encodeURIComponent(name)}`, {
+        token,
+        hostToken,
+        method: "DELETE",
+      }),
+    uploadInbox: async (workspaceId: string, file: File, options?: { path?: string }) => {
+      const id = workspaceId.trim();
+      if (!id) throw new Error("workspaceId is required");
+      if (!file) throw new Error("file is required");
+      const form = new FormData();
+      form.append("file", file);
+      if (options?.path?.trim()) {
+        form.append("path", options.path.trim());
+      }
+
+      const result = await requestMultipartRaw(baseUrl, `/workspace/${encodeURIComponent(id)}/inbox`, {
+        token,
+        hostToken,
+        method: "POST",
+        body: form,
+        timeoutMs: timeouts.binary,
+      });
+
+      if (!result.ok) {
+        let message = result.text.trim();
+        try {
+          const json = message ? JSON.parse(message) : null;
+          if (json && typeof json.message === "string") {
+            message = json.message;
+          }
+        } catch {
+          // ignore
+        }
+        throw new OpenworkServerError(
+          result.status,
+          "request_failed",
+          message || "Shared folder upload failed",
+        );
+      }
+
+      const body = result.text.trim();
+      if (body) {
+        try {
+          const parsed = JSON.parse(body) as Partial<OpenworkInboxUploadResult>;
+          if (typeof parsed.path === "string" && parsed.path.trim()) {
+            return {
+              ok: parsed.ok ?? true,
+              path: parsed.path.trim(),
+              bytes: typeof parsed.bytes === "number" ? parsed.bytes : file.size,
+            } satisfies OpenworkInboxUploadResult;
+          }
+        } catch {
+          // ignore invalid JSON and fall back
+        }
+      }
+
+      return {
+        ok: true,
+        path: options?.path?.trim() || file.name,
+        bytes: file.size,
+      } satisfies OpenworkInboxUploadResult;
+    },
+
+    listInbox: (workspaceId: string) =>
+      requestJson<OpenworkInboxList>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/inbox`, {
+        token,
+        hostToken,
+      }),
+
+    downloadInboxItem: (workspaceId: string, inboxId: string) =>
+      requestBinary(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/inbox/${encodeURIComponent(inboxId)}`,
+        { token, hostToken, timeoutMs: timeouts.binary },
+      ),
+
+    readWorkspaceFile: (workspaceId: string, path: string) =>
+      requestJson<OpenworkWorkspaceFileContent>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/files/content?path=${encodeURIComponent(path)}`,
+        { token, hostToken },
+      ),
+
+    writeWorkspaceFile: (
+      workspaceId: string,
+      payload: { path: string; content: string; baseUpdatedAt?: number | null; force?: boolean },
+    ) =>
+      requestJson<OpenworkWorkspaceFileWriteResult>(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/files/content`,
+        {
+          token,
+          hostToken,
+          method: "POST",
+          body: payload,
+        },
+      ),
+
+    listArtifacts: (workspaceId: string) =>
+      requestJson<OpenworkArtifactList>(baseUrl, `/workspace/${encodeURIComponent(workspaceId)}/artifacts`, {
+        token,
+        hostToken,
+      }),
+
+    downloadArtifact: (workspaceId: string, artifactId: string) =>
+      requestBinary(
+        baseUrl,
+        `/workspace/${encodeURIComponent(workspaceId)}/artifacts/${encodeURIComponent(artifactId)}`,
+        { token, hostToken, timeoutMs: timeouts.binary },
+      ),
+
+    // User-level env vars (host-auth only — desktop shell is the sole caller).
+    // See apps/server/src/env-file.ts and apps/app/pr/environment-variables.md.
+    listUserEnvKeys: () =>
+      requestJson<{ keys: string[] }>(
+        baseUrl,
+        "/env/keys",
+        { token, hostToken, timeoutMs: timeouts.config },
+      ),
+
+    listUserEnv: () =>
+      requestJson<{ items: Array<{ key: string; value: string; updatedAt: number }> }>(
+        baseUrl,
+        "/env",
+        { token, hostToken, timeoutMs: timeouts.config },
+      ),
+
+    upsertUserEnv: (entries: Array<{ key: string; value: string }>) =>
+      requestJson<{ ok: true; count: number }>(baseUrl, "/env", {
+        token,
+        hostToken,
+        method: "PUT",
+        body: { entries },
+        timeoutMs: timeouts.config,
+      }),
+
+    deleteUserEnv: (key: string) =>
+      requestJson<{ ok: true }>(baseUrl, `/env/${encodeURIComponent(key)}`, {
+        token,
+        hostToken,
+        method: "DELETE",
+        timeoutMs: timeouts.config,
+      }),
+  };
+}
+
+export type OpenworkServerClient = ReturnType<typeof createOpenworkServerClient>;
diff --git a/apps/app/src/app/lib/perf-log.ts b/apps/app/src/app/lib/perf-log.ts
new file mode 100644
index 0000000000..aa699fe353
--- /dev/null
+++ b/apps/app/src/app/lib/perf-log.ts
@@ -0,0 +1,144 @@
+import { recordDevLog } from "./dev-log";
+
+export type PerfLogRecord = {
+  id: number;
+  at: string;
+  ts: number;
+  scope: string;
+  event: string;
+  payload?: Record<string, unknown>;
+};
+
+type PerfRoot = typeof globalThis & {
+  __openworkPerfSeq?: number;
+  __openworkPerfLogs?: PerfLogRecord[];
+  __openworkPerfConsoleAt?: Record<string, number>;
+  __openworkPerfConsoleSuppressed?: Record<string, number>;
+};
+
+const PERF_LOG_LIMIT = 500;
+const HOT_EVENT_MIN_INTERVAL_MS = 750;
+const HOT_EVENT_KEYS = new Set([
+  "session.sse:flush",
+  "session.sse:arrival-gap",
+  "session.event:message.part.delta",
+  "session.event:message.part.updated",
+  "session.compaction:synthetic-continue",
+  "session.input:draft-flush",
+  "session.render:message-blocks",
+  "session.render:tool-summary",
+  "session.render:batch-commit",
+  "session.main-thread:lag",
+  "session.window:state",
+]);
+
+export const perfNow = () => {
+  if (typeof performance !== "undefined" && typeof performance.now === "function") {
+    return performance.now();
+  }
+  return Date.now();
+};
+
+const round = (value: number) => Math.round(value * 100) / 100;
+
+export const recordPerfLog = (
+  enabled: boolean,
+  scope: string,
+  event: string,
+  payload?: Record<string, unknown>,
+) => {
+  if (!enabled) return;
+
+  const root = globalThis as PerfRoot;
+  const id = (root.__openworkPerfSeq ?? 0) + 1;
+  root.__openworkPerfSeq = id;
+
+  const entry: PerfLogRecord = {
+    id,
+    at: new Date().toISOString(),
+    ts: Date.now(),
+    scope,
+    event,
+    payload,
+  };
+
+  const logs = root.__openworkPerfLogs ?? [];
+  logs.push(entry);
+  if (logs.length > PERF_LOG_LIMIT) {
+    logs.splice(0, logs.length - PERF_LOG_LIMIT);
+  }
+  root.__openworkPerfLogs = logs;
+  recordDevLog(enabled, {
+    level: "perf",
+    source: scope,
+    label: event,
+    payload,
+  });
+
+  try {
+    const key = `${scope}:${event}`;
+    const now = Date.now();
+    const lastByKey = root.__openworkPerfConsoleAt ?? (root.__openworkPerfConsoleAt = {});
+    const suppressedByKey =
+      root.__openworkPerfConsoleSuppressed ?? (root.__openworkPerfConsoleSuppressed = {});
+    if (HOT_EVENT_KEYS.has(key)) {
+      const last = lastByKey[key] ?? 0;
+      if (now - last < HOT_EVENT_MIN_INTERVAL_MS) {
+        suppressedByKey[key] = (suppressedByKey[key] ?? 0) + 1;
+        return;
+      }
+    }
+
+    lastByKey[key] = now;
+    const suppressed = suppressedByKey[key] ?? 0;
+    if (suppressed > 0) {
+      suppressedByKey[key] = 0;
+    }
+
+    if (payload === undefined) {
+      if (suppressed > 0) {
+        console.log(`[OWPERF] ${scope}:${event}`, { suppressed });
+        return;
+      }
+      console.log(`[OWPERF] ${scope}:${event}`);
+      return;
+    }
+
+    if (suppressed > 0) {
+      console.log(`[OWPERF] ${scope}:${event}`, { ...payload, suppressed });
+      return;
+    }
+
+    console.log(`[OWPERF] ${scope}:${event}`, payload);
+  } catch {
+    // ignore
+  }
+};
+
+export const readPerfLogs = (limit = 120) => {
+  const root = globalThis as PerfRoot;
+  const logs = root.__openworkPerfLogs ?? [];
+  if (limit <= 0) return [];
+  if (logs.length <= limit) return logs.slice();
+  return logs.slice(logs.length - limit);
+};
+
+export const clearPerfLogs = () => {
+  const root = globalThis as PerfRoot;
+  root.__openworkPerfLogs = [];
+  root.__openworkPerfSeq = 0;
+};
+
+export const finishPerf = (
+  enabled: boolean,
+  scope: string,
+  event: string,
+  startedAt: number,
+  payload?: Record<string, unknown>,
+) => {
+  if (!enabled) return;
+  recordPerfLog(enabled, scope, event, {
+    ...(payload ?? {}),
+    ms: round(perfNow() - startedAt),
+  });
+};
diff --git a/apps/app/src/app/lib/publisher.ts b/apps/app/src/app/lib/publisher.ts
new file mode 100644
index 0000000000..5efc2b8818
--- /dev/null
+++ b/apps/app/src/app/lib/publisher.ts
@@ -0,0 +1,80 @@
+export type OpenworkPublisherBundleType = "skill" | "skills-set";
+
+export type PublishBundleResult = {
+  url: string;
+};
+
+const ENV_OPENWORK_PUBLISHER_BASE_URL = String(import.meta.env.VITE_OPENWORK_PUBLISHER_BASE_URL ?? "").trim();
+
+export const DEFAULT_OPENWORK_PUBLISHER_BASE_URL =
+  ENV_OPENWORK_PUBLISHER_BASE_URL || "https://share.openworklabs.com";
+
+function normalizeBaseUrl(input: string): string {
+  const trimmed = String(input ?? "").trim();
+  if (!trimmed) {
+    throw new Error("Publisher baseUrl is required");
+  }
+  return trimmed.replace(/\/+$/, "");
+}
+
+async function readErrorMessage(response: Response): Promise<string> {
+  try {
+    const text = await response.text();
+    if (!text.trim()) return "";
+    try {
+      const json = JSON.parse(text) as Record<string, unknown>;
+      if (json && typeof json.message === "string" && json.message.trim()) {
+        return json.message.trim();
+      }
+    } catch {
+      // ignore
+    }
+    return text.trim();
+  } catch {
+    return "";
+  }
+}
+
+export async function publishOpenworkBundleJson(input: {
+  payload: unknown;
+  bundleType: OpenworkPublisherBundleType;
+  name?: string;
+  baseUrl?: string;
+  timeoutMs?: number;
+}): Promise<PublishBundleResult> {
+  const baseUrl = normalizeBaseUrl(input.baseUrl ?? DEFAULT_OPENWORK_PUBLISHER_BASE_URL);
+  const timeoutMs = typeof input.timeoutMs === "number" && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 15_000;
+
+  const controller = new AbortController();
+  const timer = window.setTimeout(() => controller.abort(), Math.max(1_000, timeoutMs));
+
+  try {
+    const response = await fetch(`${baseUrl}/v1/bundles`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "X-OpenWork-Bundle-Type": input.bundleType,
+        "X-OpenWork-Schema-Version": "v1",
+        ...(input.name?.trim() ? { "X-OpenWork-Name": input.name.trim() } : null),
+      },
+      body: JSON.stringify(input.payload),
+      signal: controller.signal,
+    });
+
+    if (!response.ok) {
+      const details = await readErrorMessage(response);
+      const suffix = details ? `: ${details}` : "";
+      throw new Error(`Publish failed (${response.status})${suffix}`);
+    }
+
+    const json = (await response.json()) as Record<string, unknown>;
+    const url = typeof json.url === "string" ? json.url.trim() : "";
+    if (!url) {
+      throw new Error("Publisher response missing url");
+    }
+    return { url };
+  } finally {
+    window.clearTimeout(timer);
+  }
+}
diff --git a/apps/app/src/app/lib/release-channels.ts b/apps/app/src/app/lib/release-channels.ts
new file mode 100644
index 0000000000..e423baacb1
--- /dev/null
+++ b/apps/app/src/app/lib/release-channels.ts
@@ -0,0 +1,65 @@
+/**
+ * Release-channel concept for OpenWork desktop builds.
+ *
+ * There are two channels users can opt into:
+ *
+ * - "stable": the default. The desktop app auto-updates from the rolling
+ *   "latest" GitHub release attached to whichever semver tag most recently
+ *   finished the Release App workflow. macOS, Linux, Windows.
+ *
+ * - "alpha": a macOS-only rolling channel that auto-updates on every merge
+ *   to `dev`. Alpha builds are published to a fixed GitHub release tag
+ *   (`alpha-macos-latest`) so the updater endpoint stays stable while the
+ *   underlying artifact is replaced on every dev push.
+ *
+ * Only the macOS (arm64) build is published to the alpha channel today.
+ * Linux and Windows always resolve to the stable channel.
+ */
+
+import type { ReleaseChannel } from "../types";
+
+/** Stable channel's Tauri updater manifest URL. */
+export const STABLE_UPDATER_ENDPOINT =
+  "https://github.com/different-ai/openwork/releases/latest/download/latest.json";
+
+/** Alpha channel's Tauri updater manifest URL (macOS-only, rolling). */
+export const ALPHA_UPDATER_ENDPOINT =
+  "https://github.com/different-ai/openwork/releases/download/alpha-macos-latest/latest.json";
+
+/** Rolling GitHub release tag that alpha macOS artifacts are published to. */
+export const ALPHA_MACOS_RELEASE_TAG = "alpha-macos-latest";
+
+export type PlatformKind = "darwin" | "linux" | "windows" | "web" | "unknown";
+
+/**
+ * Returns true when the given platform supports the alpha channel.
+ *
+ * Today alpha builds are produced only for macOS (arm64). The type-level
+ * conservatism here is deliberate: it's easier to widen later than to
+ * silently start advertising an alpha endpoint that serves no artifact.
+ */
+export function isAlphaChannelSupported(platform: PlatformKind): boolean {
+  return platform === "darwin";
+}
+
+/**
+ * Resolve the Tauri updater manifest URL for the requested channel.
+ *
+ * Falls back to the stable endpoint whenever alpha isn't supported on the
+ * current platform, so the caller never needs to special-case "alpha chosen
+ * on Linux" / "alpha chosen on Windows" etc.
+ */
+export function resolveUpdaterEndpoint(
+  channel: ReleaseChannel,
+  platform: PlatformKind = "darwin",
+): string {
+  if (channel === "alpha" && isAlphaChannelSupported(platform)) {
+    return ALPHA_UPDATER_ENDPOINT;
+  }
+  return STABLE_UPDATER_ENDPOINT;
+}
+
+/** Narrow an arbitrary string to a valid ReleaseChannel, defaulting to stable. */
+export function coerceReleaseChannel(value: unknown): ReleaseChannel {
+  return value === "alpha" ? "alpha" : "stable";
+}
diff --git a/apps/app/src/app/lib/session-scope.ts b/apps/app/src/app/lib/session-scope.ts
new file mode 100644
index 0000000000..a3e38ff6c7
--- /dev/null
+++ b/apps/app/src/app/lib/session-scope.ts
@@ -0,0 +1,101 @@
+import { normalizeDirectoryPath } from "../utils";
+import { normalizeDirectoryQueryPath } from "../utils";
+
+/**
+ * Branded string for directory values sent over the wire to the OpenCode server.
+ *
+ * The server compares `session.directory === query.directory` with strict
+ * equality, so every call site that creates, lists, or deletes sessions must
+ * use the same canonical format.  The brand makes it a *compile error* to pass
+ * a raw `string` where a `TransportDirectory` is expected — you must go
+ * through {@link toSessionTransportDirectory} first.
+ *
+ * On Windows this preserves native backslashes (`C:\Users\…`); on Unix it
+ * normalises to forward-slashed paths without a trailing separator.
+ */
+export type TransportDirectory = string & {
+  readonly __transportDirectory: unique symbol;
+};
+
+type WorkspaceType = "local" | "remote";
+
+export function resolveScopedClientDirectory(input: {
+  directory?: string | null;
+  targetRoot?: string | null;
+  workspaceType?: WorkspaceType | null;
+}): TransportDirectory {
+  const directory = toSessionTransportDirectory(input.directory);
+  if (directory) return directory;
+
+  if (input.workspaceType === "remote") return "" as TransportDirectory;
+
+  return toSessionTransportDirectory(input.targetRoot);
+}
+
+/**
+ * Canonical formatter for directory values sent to the OpenCode server.
+ *
+ * Returns a {@link TransportDirectory} — the only format the server accepts for
+ * exact directory matching.  All session create / list / delete calls must use
+ * this (or {@link resolveScopedClientDirectory}) instead of the local-only
+ * {@link normalizeDirectoryQueryPath}.
+ */
+export function toSessionTransportDirectory(input?: string | null): TransportDirectory {
+  const trimmed = (input ?? "").trim();
+  if (!trimmed) return "" as TransportDirectory;
+
+  if (/^\\\\\?\\UNC\\/i.test(trimmed)) {
+    return `\\${trimmed.slice(7)}` as TransportDirectory;
+  }
+
+  if (/^\\\\\?\\[a-zA-Z]:[\\/]/.test(trimmed)) {
+    return trimmed.slice(4) as TransportDirectory;
+  }
+
+  if (/^(?:[a-zA-Z]:[\\/]|\\\\)/.test(trimmed)) {
+    return trimmed as TransportDirectory;
+  }
+
+  return normalizeDirectoryQueryPath(trimmed) as TransportDirectory;
+}
+
+export function describeDirectoryScope(input?: string | null) {
+  const raw = input ?? "";
+  const trimmed = raw.trim();
+  const transport = toSessionTransportDirectory(trimmed);
+  const normalized = normalizeDirectoryPath(trimmed);
+  return {
+    raw: trimmed || null,
+    transport: (transport || null) as TransportDirectory | null,
+    normalized: normalized || null,
+  };
+}
+
+export function scopedRootsMatch(a?: string | null, b?: string | null) {
+  const left = normalizeDirectoryPath(a ?? "");
+  const right = normalizeDirectoryPath(b ?? "");
+  if (!left || !right) return false;
+  return left === right;
+}
+
+export function shouldApplyScopedSessionLoad(input: {
+  loadedScopeRoot?: string | null;
+  workspaceRoot?: string | null;
+}) {
+  const workspaceRoot = normalizeDirectoryPath(input.workspaceRoot ?? "");
+  if (!workspaceRoot) return true;
+  return scopedRootsMatch(input.loadedScopeRoot, workspaceRoot);
+}
+
+export function shouldRedirectMissingSessionAfterScopedLoad(input: {
+  loadedScopeRoot?: string | null;
+  workspaceRoot?: string | null;
+  hasMatchingSession: boolean;
+}) {
+  if (input.hasMatchingSession) return false;
+
+  const workspaceRoot = normalizeDirectoryPath(input.workspaceRoot ?? "");
+  if (!workspaceRoot) return false;
+
+  return scopedRootsMatch(input.loadedScopeRoot, workspaceRoot);
+}
diff --git a/apps/app/src/app/lib/session-title.ts b/apps/app/src/app/lib/session-title.ts
new file mode 100644
index 0000000000..aea996de92
--- /dev/null
+++ b/apps/app/src/app/lib/session-title.ts
@@ -0,0 +1,22 @@
+import { t } from "../../i18n";
+
+/** Raw English string — used for prefix matching against stored titles. */
+export const DEFAULT_SESSION_TITLE = "New session";
+
+const GENERATED_SESSION_TITLE_PREFIX = `${DEFAULT_SESSION_TITLE} - `;
+
+export function isGeneratedSessionTitle(title: string | null | undefined) {
+  const trimmed = title?.trim() ?? "";
+  if (!trimmed.startsWith(GENERATED_SESSION_TITLE_PREFIX)) return false;
+  const suffix = trimmed.slice(GENERATED_SESSION_TITLE_PREFIX.length).trim();
+  return Boolean(suffix) && Number.isFinite(Date.parse(suffix));
+}
+
+export function getDisplaySessionTitle(
+  title: string | null | undefined,
+  fallback?: string,
+) {
+  const trimmed = title?.trim() ?? "";
+  if (!trimmed || isGeneratedSessionTitle(trimmed)) return fallback ?? t("session.default_title");
+  return trimmed;
+}
diff --git a/apps/app/src/app/lib/startup-boot.ts b/apps/app/src/app/lib/startup-boot.ts
new file mode 100644
index 0000000000..87cd9c5674
--- /dev/null
+++ b/apps/app/src/app/lib/startup-boot.ts
@@ -0,0 +1,56 @@
+export type BootPhase =
+  | "nativeInit"
+  | "workspaceBootstrap"
+  | "engineProbe"
+  | "engineStartOrConnect"
+  | "sessionIndexReady"
+  | "firstSessionReady"
+  | "ready"
+  | "error";
+
+export type StartupBranch =
+  | "firstRunNoWorkspace"
+  | "remoteWorkspace"
+  | "localAttachExisting"
+  | "localHostStart"
+  | "serverPreference"
+  | "localPreference"
+  | "welcome"
+  | "unknown";
+
+export type StartupTraceEvent = {
+  at: number;
+  phase: BootPhase;
+  event: string;
+  detail?: Record<string, unknown>;
+};
+
+export function classifyStartupBranch(input: {
+  workspaceCount: number;
+  activeWorkspaceType: "local" | "remote" | null;
+  startupPreference: "local" | "server" | null;
+  engineHasBaseUrl: boolean;
+  selectedWorkspacePath: string;
+}): StartupBranch {
+  if (input.workspaceCount === 0) return "firstRunNoWorkspace";
+  if (input.activeWorkspaceType === "remote") return "remoteWorkspace";
+  if (input.startupPreference === "server") return "serverPreference";
+  if (!input.selectedWorkspacePath.trim()) {
+    if (input.startupPreference === "local") return "localPreference";
+    return "welcome";
+  }
+  return input.engineHasBaseUrl ? "localAttachExisting" : "localHostStart";
+}
+
+export function pushStartupTraceEvent(
+  current: StartupTraceEvent[],
+  event: StartupTraceEvent,
+  maxEvents = 100,
+): StartupTraceEvent[] {
+  if (!Number.isFinite(event.at) || !event.phase || !event.event) {
+    return current;
+  }
+  const base = current.length >= maxEvents ? current.slice(current.length - maxEvents + 1) : current.slice();
+  base.push(event);
+  return base;
+}
diff --git a/apps/app/src/app/lib/tauri.ts b/apps/app/src/app/lib/tauri.ts
new file mode 100644
index 0000000000..9c4641a4bc
--- /dev/null
+++ b/apps/app/src/app/lib/tauri.ts
@@ -0,0 +1 @@
+export * from "./desktop";
diff --git a/apps/app/src/app/lib/version-gate.ts b/apps/app/src/app/lib/version-gate.ts
new file mode 100644
index 0000000000..64d8b92d9c
--- /dev/null
+++ b/apps/app/src/app/lib/version-gate.ts
@@ -0,0 +1,222 @@
+// Version comparator + update gating helpers.
+//
+// Ported from dev's Solid system-state.ts (#1476 + #1512). Pure functions
+// so they're reusable from any React feature site once the updater flow
+// gets wired.
+
+import { createDenClient, readDenSettings, type DenDesktopConfig } from "./den";
+
+type ParsedVersion = {
+  release: number[];
+  prerelease: string[];
+};
+
+function parseComparableVersion(value: string): ParsedVersion | null {
+  const normalized = value.trim().replace(/^v/i, "");
+  if (!normalized) return null;
+
+  const [versionCore] = normalized.split("+", 1);
+  if (!versionCore) return null;
+
+  const [releasePart, prereleasePart = ""] = versionCore.split("-", 2);
+  const release = releasePart.split(".").map((segment) => Number(segment));
+  if (!release.length || release.some((segment) => !Number.isInteger(segment) || segment < 0)) {
+    return null;
+  }
+
+  const prerelease = prereleasePart
+    .split(".")
+    .map((segment) => segment.trim())
+    .filter(Boolean);
+
+  return { release, prerelease };
+}
+
+function comparePrereleaseIdentifiers(left: string[], right: string[]): number {
+  // semver-ish: absence of prerelease ranks higher than presence.
+  if (!left.length && !right.length) return 0;
+  if (!left.length) return 1;
+  if (!right.length) return -1;
+
+  const count = Math.max(left.length, right.length);
+  for (let index = 0; index < count; index += 1) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === undefined) return -1;
+    if (rightPart === undefined) return 1;
+
+    const leftNumeric = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
+    const rightNumeric = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
+
+    if (leftNumeric !== null && rightNumeric !== null) {
+      if (leftNumeric !== rightNumeric) return leftNumeric < rightNumeric ? -1 : 1;
+      continue;
+    }
+
+    if (leftNumeric !== null) return -1;
+    if (rightNumeric !== null) return 1;
+
+    const comparison = leftPart.localeCompare(rightPart);
+    if (comparison !== 0) return comparison < 0 ? -1 : 1;
+  }
+
+  return 0;
+}
+
+function releasePart(value: string): number[] | null {
+  return parseComparableVersion(value)?.release ?? null;
+}
+
+/**
+ * Compare two version strings. Returns -1 / 0 / 1 as usual, or null if
+ * either side fails to parse. Accepts an optional leading `v` and handles
+ * prerelease tags (e.g. `0.11.212-alpha.3`).
+ */
+export function compareVersions(left: string, right: string): number | null {
+  const parsedLeft = parseComparableVersion(left);
+  const parsedRight = parseComparableVersion(right);
+  if (!parsedLeft || !parsedRight) return null;
+
+  const count = Math.max(parsedLeft.release.length, parsedRight.release.length);
+  for (let index = 0; index < count; index += 1) {
+    const leftPart = parsedLeft.release[index] ?? 0;
+    const rightPart = parsedRight.release[index] ?? 0;
+    if (leftPart !== rightPart) return leftPart < rightPart ? -1 : 1;
+  }
+
+  return comparePrereleaseIdentifiers(parsedLeft.prerelease, parsedRight.prerelease);
+}
+
+/**
+ * Apply the org-level `allowedDesktopVersions` filter (dev #1512). When
+ * the array is unset, everything is allowed; when it's set, the candidate
+ * update version must match one of the allowed versions exactly (by
+ * semver comparison, so leading `v` prefixes and trailing build metadata
+ * are treated equivalently).
+ */
+export function isUpdateAllowedByDesktopConfig(
+  updateVersion: string,
+  desktopConfig: DenDesktopConfig | null | undefined,
+): boolean {
+  if (!Array.isArray(desktopConfig?.allowedDesktopVersions)) {
+    return true;
+  }
+
+  return desktopConfig.allowedDesktopVersions.some(
+    (allowedVersion) => compareVersions(updateVersion, allowedVersion) === 0,
+  );
+}
+
+function maxAllowedDesktopVersion(desktopConfig: DenDesktopConfig | null | undefined): string | null {
+  if (!Array.isArray(desktopConfig?.allowedDesktopVersions)) {
+    return null;
+  }
+
+  let maxVersion: string | null = null;
+  for (const version of desktopConfig.allowedDesktopVersions) {
+    if (parseComparableVersion(version) === null) continue;
+    if (maxVersion === null) {
+      maxVersion = version;
+      continue;
+    }
+    const comparison = compareVersions(version, maxVersion);
+    if (comparison !== null && comparison > 0) {
+      maxVersion = version;
+    }
+  }
+  return maxVersion;
+}
+
+function effectiveMaxDesktopVersion(
+  denLatestAppVersion: string,
+  desktopConfig: DenDesktopConfig | null | undefined,
+): string {
+  const orgMaxVersion = maxAllowedDesktopVersion(desktopConfig);
+  if (!orgMaxVersion) return denLatestAppVersion;
+  const comparison = compareVersions(orgMaxVersion, denLatestAppVersion);
+  return comparison !== null && comparison < 0 ? orgMaxVersion : denLatestAppVersion;
+}
+
+function isWithinOnePatchAhead(updateVersion: string, maxVersion: string): boolean {
+  const directComparison = compareVersions(updateVersion, maxVersion);
+  if (directComparison !== null && directComparison <= 0) {
+    return true;
+  }
+
+  const updateRelease = releasePart(updateVersion);
+  const maxRelease = releasePart(maxVersion);
+  if (!updateRelease || !maxRelease) return false;
+
+  const updateMajor = updateRelease[0] ?? 0;
+  const updateMinor = updateRelease[1] ?? 0;
+  const updatePatch = updateRelease[2] ?? 0;
+  const maxMajor = maxRelease[0] ?? 0;
+  const maxMinor = maxRelease[1] ?? 0;
+  const maxPatch = maxRelease[2] ?? 0;
+
+  return updateMajor === maxMajor && updateMinor === maxMinor && updatePatch <= maxPatch + 1;
+}
+
+async function readDenLatestAppVersion(): Promise<string | null> {
+  try {
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const client = createDenClient({
+      baseUrl: settings.baseUrl,
+      apiBaseUrl: settings.apiBaseUrl,
+      ...(token ? { token } : {}),
+    });
+    const metadata = await client.getAppVersionMetadata();
+    return metadata.latestAppVersion;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Ask Den for the currently-supported latest app version (dev #1476) and
+ * return true only when the candidate update version is the latest
+ * version or older. If Den is unreachable or returns an invalid payload,
+ * this returns `false` — the caller must treat that as "do not surface
+ * the update".
+ *
+ * No-op safe: callers can invoke this without any Den auth; the client
+ * will omit the token when none is persisted.
+ */
+export async function isUpdateSupportedByDen(updateVersion: string): Promise<boolean> {
+  const latestAppVersion = await readDenLatestAppVersion();
+  if (!latestAppVersion) return false;
+  const comparison = compareVersions(updateVersion, latestAppVersion);
+  return comparison !== null && comparison <= 0;
+}
+
+/**
+ * Alpha channel builds may run one patch ahead of the current Den/org maximum
+ * (e.g. Den allows 0.13.3, alpha 0.13.4-alpha.N is allowed). Larger jumps are
+ * still blocked so alpha cannot bypass staged rollout ceilings entirely.
+ */
+export async function isAlphaUpdateAllowed(
+  updateVersion: string,
+  desktopConfig: DenDesktopConfig | null | undefined,
+): Promise<boolean> {
+  const latestAppVersion = await readDenLatestAppVersion();
+  if (!latestAppVersion) return false;
+  const effectiveMaxVersion = effectiveMaxDesktopVersion(latestAppVersion, desktopConfig);
+  return isWithinOnePatchAhead(updateVersion, effectiveMaxVersion);
+}
+
+/**
+ * Combined gate: the update must be supported by Den (version metadata
+ * endpoint) AND allowed by the active org's `allowedDesktopVersions` if
+ * one is configured. Intended to be the single call site the React
+ * updater flow makes before surfacing an update as installable.
+ */
+export async function isUpdateAllowed(
+  updateVersion: string,
+  desktopConfig: DenDesktopConfig | null | undefined,
+): Promise<boolean> {
+  if (!isUpdateAllowedByDesktopConfig(updateVersion, desktopConfig)) {
+    return false;
+  }
+  return isUpdateSupportedByDen(updateVersion);
+}
diff --git a/apps/app/src/app/lib/workspace-blueprints.ts b/apps/app/src/app/lib/workspace-blueprints.ts
new file mode 100644
index 0000000000..671f293385
--- /dev/null
+++ b/apps/app/src/app/lib/workspace-blueprints.ts
@@ -0,0 +1,248 @@
+import type {
+  WorkspaceBlueprint,
+  WorkspaceBlueprintMaterializedSession,
+  WorkspaceBlueprintSessionMessage,
+  WorkspaceBlueprintSessionTemplate,
+  WorkspaceBlueprintStarter,
+  WorkspaceOpenworkConfig,
+} from "../types";
+import { parseTemplateFrontmatter } from "../utils";
+import { t } from "../../i18n";
+
+import browserSetupTemplate from "../data/commands/browser-setup.md?raw";
+
+const BROWSER_AUTOMATION_QUICKSTART_PROMPT = (() => {
+  const parsed = parseTemplateFrontmatter(browserSetupTemplate);
+  return (parsed?.body ?? browserSetupTemplate).trim();
+})();
+
+
+const defaultWelcomeBlueprintMessages = (): WorkspaceBlueprintSessionMessage[] => [
+  {
+    role: "assistant",
+    text: t("blueprint.welcome_message"),
+  },
+];
+
+export function defaultBlueprintSessionsForPreset(_preset: string): WorkspaceBlueprintSessionTemplate[] {
+  return [
+    {
+      id: "welcome-to-openwork",
+      title: t("blueprint.welcome_title"),
+      messages: defaultWelcomeBlueprintMessages(),
+      openOnFirstLoad: true,
+    },
+    {
+      id: "csv-playbook",
+      title: t("blueprint.csv_session_title"),
+      messages: [
+        {
+          role: "assistant",
+          text: t("blueprint.csv_session_assistant"),
+        },
+        {
+          role: "user",
+          text: t("blueprint.csv_session_user"),
+        },
+      ],
+      openOnFirstLoad: false,
+    },
+  ];
+}
+
+function normalizeSessionMessage(value: unknown): WorkspaceBlueprintSessionMessage | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  const text = typeof record.text === "string" ? record.text.trim() : "";
+  if (!text) return null;
+  const role = String(record.role ?? "assistant").trim().toLowerCase() === "user" ? "user" : "assistant";
+  return { role, text };
+}
+
+function normalizeSessionTemplate(value: unknown, index: number): WorkspaceBlueprintSessionTemplate | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  const title = typeof record.title === "string" ? record.title.trim() : "";
+  const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : `template-session-${index + 1}`;
+  const messages = Array.isArray(record.messages)
+    ? record.messages.map(normalizeSessionMessage).filter((item): item is WorkspaceBlueprintSessionMessage => Boolean(item))
+    : [];
+  if (!title && messages.length === 0) return null;
+  return {
+    id,
+    title: title || null,
+    messages,
+    openOnFirstLoad: record.openOnFirstLoad === true,
+  };
+}
+
+function normalizeMaterializedSession(value: unknown): WorkspaceBlueprintMaterializedSession | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  const sessionId = typeof record.sessionId === "string" ? record.sessionId.trim() : "";
+  const templateId = typeof record.templateId === "string" ? record.templateId.trim() : "";
+  if (!sessionId || !templateId) return null;
+  return { sessionId, templateId };
+}
+
+function normalizeBlueprint(value: unknown): WorkspaceBlueprint | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value as WorkspaceBlueprint & Record<string, unknown>;
+  const sessions = Array.isArray(candidate.sessions)
+    ? candidate.sessions
+        .map((session, index) => normalizeSessionTemplate(session, index))
+        .filter((item): item is WorkspaceBlueprintSessionTemplate => Boolean(item))
+    : null;
+  const materializedSessions = Array.isArray(candidate.materialized?.sessions?.items)
+    ? candidate.materialized?.sessions?.items
+        .map(normalizeMaterializedSession)
+        .filter((item): item is WorkspaceBlueprintMaterializedSession => Boolean(item))
+    : null;
+
+  return {
+    emptyState: candidate.emptyState ?? null,
+    sessions,
+    materialized: candidate.materialized
+      ? {
+          sessions: candidate.materialized.sessions
+            ? {
+                hydratedAt:
+                  typeof candidate.materialized.sessions.hydratedAt === "number"
+                    ? candidate.materialized.sessions.hydratedAt
+                    : null,
+                items: materializedSessions,
+              }
+            : null,
+        }
+      : null,
+  };
+}
+
+export function defaultBlueprintStartersForPreset(preset: string): WorkspaceBlueprintStarter[] {
+  switch (preset.trim().toLowerCase()) {
+    case "automation":
+      return [
+        {
+          id: "automation-command",
+          kind: "prompt",
+          title: t("blueprint.starter_command_title"),
+          description: t("blueprint.starter_command_desc"),
+          prompt: t("blueprint.starter_command_prompt"),
+        },
+        {
+          id: "automation-blueprint",
+          kind: "session",
+          title: t("blueprint.starter_blueprint_title"),
+          description: t("blueprint.starter_blueprint_desc"),
+          prompt: t("blueprint.starter_blueprint_prompt"),
+        },
+      ];
+    case "minimal":
+      return [
+        {
+          id: "minimal-explore",
+          kind: "prompt",
+          title: t("blueprint.starter_explore_title"),
+          description: t("blueprint.starter_explore_desc"),
+          prompt: t("blueprint.starter_explore_prompt"),
+        },
+      ];
+    default:
+      return [
+        {
+          id: "csv-help",
+          kind: "prompt",
+          title: t("blueprint.starter_csv_title"),
+          description: t("blueprint.starter_csv_desc"),
+          prompt: t("blueprint.starter_csv_prompt"),
+        },
+        {
+          id: "starter-connect-openai",
+          kind: "action",
+          title: t("blueprint.starter_connect_openai_title"),
+          description: t("blueprint.starter_connect_openai_desc"),
+          action: "connect-openai",
+        },
+        {
+          id: "browser-automation",
+          kind: "session",
+          title: t("blueprint.starter_chrome_title"),
+          description: t("blueprint.starter_chrome_desc"),
+          prompt: t("blueprint.starter_chrome_prompt"),
+        },
+      ];
+  }
+}
+
+export function defaultBlueprintCopyForPreset(preset: string) {
+  switch (preset.trim().toLowerCase()) {
+    case "automation":
+      return {
+        title: t("blueprint.automation_title"),
+        body: t("blueprint.automation_body"),
+      };
+    case "minimal":
+      return {
+        title: t("blueprint.minimal_title"),
+        body: t("blueprint.minimal_body"),
+      };
+    default:
+      return {
+        title: t("blueprint.empty_title"),
+        body: t("blueprint.empty_body"),
+      };
+  }
+}
+
+export function buildDefaultWorkspaceBlueprint(preset: string): WorkspaceBlueprint {
+  const copy = defaultBlueprintCopyForPreset(preset);
+  return {
+    emptyState: {
+      title: copy.title,
+      body: copy.body,
+      starters: defaultBlueprintStartersForPreset(preset),
+    },
+    sessions: defaultBlueprintSessionsForPreset(preset),
+  };
+}
+
+export function blueprintSessions(config: WorkspaceOpenworkConfig | null | undefined): WorkspaceBlueprintSessionTemplate[] {
+  return Array.isArray(config?.blueprint?.sessions)
+    ? config!.blueprint!.sessions!.filter((item): item is WorkspaceBlueprintSessionTemplate => Boolean(item))
+    : [];
+}
+
+export function blueprintMaterializedSessions(config: WorkspaceOpenworkConfig | null | undefined): WorkspaceBlueprintMaterializedSession[] {
+  return Array.isArray(config?.blueprint?.materialized?.sessions?.items)
+    ? config!.blueprint!.materialized!.sessions!.items!.filter((item): item is WorkspaceBlueprintMaterializedSession => Boolean(item))
+    : [];
+}
+
+export function normalizeWorkspaceOpenworkConfig(
+  value: unknown,
+  preset?: string | null,
+): WorkspaceOpenworkConfig {
+  const candidate =
+    value && typeof value === "object"
+      ? (value as Partial<WorkspaceOpenworkConfig>)
+      : {};
+
+  const normalizedPreset =
+    candidate.workspace?.preset?.trim() || preset?.trim() || null;
+
+  return {
+    version: typeof candidate.version === "number" ? candidate.version : 1,
+    workspace:
+      candidate.workspace || normalizedPreset
+        ? {
+            ...(candidate.workspace ?? {}),
+            preset: normalizedPreset,
+          }
+        : null,
+    authorizedRoots: Array.isArray(candidate.authorizedRoots)
+      ? candidate.authorizedRoots.filter((item): item is string => typeof item === "string")
+      : [],
+    blueprint: normalizeBlueprint(candidate.blueprint),
+    reload: candidate.reload ?? null,
+  };
+}
diff --git a/apps/app/src/app/mcp.ts b/apps/app/src/app/mcp.ts
new file mode 100644
index 0000000000..b96917d296
--- /dev/null
+++ b/apps/app/src/app/mcp.ts
@@ -0,0 +1,113 @@
+import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
+import type { McpServerConfig, McpServerEntry } from "./types";
+import { readOpencodeConfig, writeOpencodeConfig } from "./lib/desktop";
+import { CHROME_DEVTOOLS_MCP_COMMAND, CHROME_DEVTOOLS_MCP_ID } from "./constants";
+
+type McpConfigValue = Record<string, unknown> | null | undefined;
+
+export const CHROME_DEVTOOLS_AUTO_CONNECT_ARG = "--autoConnect";
+
+type McpIdentity = {
+  id?: string;
+  name: string;
+};
+
+export function normalizeMcpSlug(name: string): string {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+}
+
+export function getMcpIdentityKey(entry: McpIdentity): string {
+  return entry.id ?? normalizeMcpSlug(entry.name);
+}
+
+export function isChromeDevtoolsMcp(entry: McpIdentity | string | null | undefined): boolean {
+  if (!entry) return false;
+  const key = typeof entry === "string" ? entry : getMcpIdentityKey(entry);
+  return key === CHROME_DEVTOOLS_MCP_ID || normalizeMcpSlug(typeof entry === "string" ? entry : entry.name) === "control-chrome";
+}
+
+export function usesChromeDevtoolsAutoConnect(command?: string[]): boolean {
+  return Array.isArray(command) && command.includes(CHROME_DEVTOOLS_AUTO_CONNECT_ARG);
+}
+
+export function buildChromeDevtoolsCommand(command: string[] | undefined, useExistingProfile: boolean): string[] {
+  const base = Array.isArray(command) && command.length
+    ? command.filter((part) => part !== CHROME_DEVTOOLS_AUTO_CONNECT_ARG)
+    : [...CHROME_DEVTOOLS_MCP_COMMAND];
+  return useExistingProfile ? [...base, CHROME_DEVTOOLS_AUTO_CONNECT_ARG] : base;
+}
+
+export function validateMcpServerName(name: string): string {
+  const trimmed = name.trim();
+  if (!trimmed) {
+    throw new Error("server_name is required");
+  }
+  if (trimmed.startsWith("-")) {
+    throw new Error("server_name must not start with '-'");
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(trimmed)) {
+    throw new Error("server_name must be alphanumeric with '-' or '_'");
+  }
+  return trimmed;
+}
+
+export async function removeMcpFromConfig(
+  projectDir: string,
+  name: string,
+): Promise<void> {
+  const configFile = await readOpencodeConfig("project", projectDir);
+  const raw = configFile.exists && configFile.content?.trim()
+    ? configFile.content
+    : "{}\n";
+
+  const parseErrors: Array<{ error: number; offset: number; length: number }> = [];
+  const existingConfig = parse(raw, parseErrors, { allowTrailingComma: true }) as Record<string, unknown> | undefined;
+  if (parseErrors.length > 0) {
+    const details = parseErrors
+      .map((entry) => printParseErrorCode(entry.error))
+      .join(", ");
+    throw new Error(`Failed to parse opencode config: ${details}`);
+  }
+
+  const mcpSection = existingConfig?.["mcp"] as Record<string, unknown> | undefined;
+  if (!mcpSection || !(name in mcpSection)) return;
+
+  const formattingOptions = { insertSpaces: true, tabSize: 2, eol: "\n" };
+  const updated = applyEdits(raw, modify(raw, ["mcp", name], undefined, { formattingOptions }));
+  const writeResult = await writeOpencodeConfig(
+    "project",
+    projectDir,
+    updated.endsWith("\n") ? updated : `${updated}\n`,
+  );
+  if (!writeResult.ok) {
+    throw new Error(writeResult.stderr || writeResult.stdout || "Failed to write opencode.json");
+  }
+}
+
+export function parseMcpServersFromContent(content: string): McpServerEntry[] {
+  if (!content.trim()) return [];
+
+  try {
+    const parsed = parse(content) as Record<string, unknown> | undefined;
+    const mcp = parsed?.mcp as McpConfigValue;
+
+    if (!mcp || typeof mcp !== "object") {
+      return [];
+    }
+
+    return Object.entries(mcp).flatMap(([name, value]) => {
+      if (!value || typeof value !== "object") {
+        return [];
+      }
+
+      const config = value as McpServerConfig;
+      if (config.type !== "remote" && config.type !== "local") {
+        return [];
+      }
+
+      return [{ name, config, source: "config.project" as const }];
+    });
+  } catch {
+    return [];
+  }
+}
diff --git a/apps/app/src/app/theme.ts b/apps/app/src/app/theme.ts
new file mode 100644
index 0000000000..efd5e24f45
--- /dev/null
+++ b/apps/app/src/app/theme.ts
@@ -0,0 +1,62 @@
+export type ThemeMode = "light" | "dark" | "system";
+
+const THEME_PREF_KEY = "openwork.themePref";
+
+const mediaQuery = "(prefers-color-scheme: dark)";
+
+const getMediaQueryList = () =>
+  typeof window === "undefined" ? null : window.matchMedia(mediaQuery);
+
+const readStoredMode = (): ThemeMode => {
+  if (typeof window === "undefined") return "system";
+  try {
+    const stored = window.localStorage.getItem(THEME_PREF_KEY);
+    if (stored === "light" || stored === "dark" || stored === "system") {
+      return stored;
+    }
+  } catch {
+    // ignore
+  }
+  return "system";
+};
+
+const resolveMode = (mode: ThemeMode) => {
+  if (mode !== "system") return mode;
+  return getMediaQueryList()?.matches ? "dark" : "light";
+};
+
+const applyTheme = (mode: ThemeMode) => {
+  if (typeof document === "undefined") return;
+  const resolved = resolveMode(mode);
+  document.documentElement.dataset.theme = resolved;
+  document.documentElement.style.colorScheme = resolved;
+};
+
+export const bootstrapTheme = () => {
+  const mode = readStoredMode();
+  applyTheme(mode);
+};
+
+export const getInitialThemeMode = () => readStoredMode();
+
+export const persistThemeMode = (mode: ThemeMode) => {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(THEME_PREF_KEY, mode);
+  } catch {
+    // ignore
+  }
+};
+
+export const subscribeToSystemTheme = (onChange: (isDark: boolean) => void) => {
+  const list = getMediaQueryList();
+  if (!list) return () => undefined;
+
+  const handler = (event: MediaQueryListEvent) => onChange(event.matches);
+  list.addEventListener("change", handler);
+  return () => list.removeEventListener("change", handler);
+};
+
+export const applyThemeMode = (mode: ThemeMode) => {
+  applyTheme(mode);
+};
diff --git a/apps/app/src/app/types.ts b/apps/app/src/app/types.ts
new file mode 100644
index 0000000000..9b215e0dae
--- /dev/null
+++ b/apps/app/src/app/types.ts
@@ -0,0 +1,445 @@
+import type {
+  Message,
+  Part,
+  PermissionRequest as ApiPermissionRequest,
+  QuestionRequest,
+  ProviderListResponse,
+  Session,
+} from "@opencode-ai/sdk/v2/client";
+import type { createClient } from "./lib/opencode";
+import type { OpencodeConfigFile, WorkspaceInfo } from "./lib/desktop";
+
+export type Client = ReturnType<typeof createClient>;
+
+export type ProviderListItem = ProviderListResponse["all"][number];
+
+export type SidebarSessionItem = {
+  id: string;
+  title: string;
+  slug?: string | null;
+  parentID?: string | null;
+  time?: {
+    updated?: number | null;
+    created?: number | null;
+  };
+  directory?: string | null;
+};
+
+export type WorkspaceSessionGroup = {
+  workspace: WorkspaceInfo;
+  sessions: SidebarSessionItem[];
+  status: "idle" | "loading" | "ready" | "error";
+  error?: string | null;
+};
+
+export type PlaceholderMessageInfo = {
+  id: string;
+  sessionID: string;
+  role: "assistant" | "user";
+  time: {
+    created: number;
+    completed?: number;
+  };
+  parentID: string;
+  modelID: string;
+  providerID: string;
+  mode: string;
+  agent: string;
+  path: {
+    cwd: string;
+    root: string;
+  };
+  cost: number;
+  tokens: {
+    input: number;
+    output: number;
+    reasoning: number;
+    cache: {
+      read: number;
+      write: number;
+    };
+  };
+};
+
+export type PlaceholderAssistantMessage = PlaceholderMessageInfo & {
+  role: "assistant";
+};
+
+export type MessageInfo = Message | PlaceholderMessageInfo;
+
+export type MessageWithParts = {
+  info: MessageInfo;
+  parts: Part[];
+};
+
+export type SessionErrorTurn = {
+  id: string;
+  text: string;
+  afterMessageID: string | null;
+  time: number;
+};
+
+export const SYNTHETIC_SESSION_ERROR_MESSAGE_PREFIX = "session-error:";
+
+export type StepGroupMode = "exploration" | "standalone";
+
+export type MessageGroup =
+  | { kind: "text"; part: Part; segment: "intent" | "result" }
+  | { kind: "steps"; id: string; parts: Part[]; segment: "execution"; mode: StepGroupMode };
+
+export type PromptMode = "prompt" | "shell";
+
+export type ComposerPart =
+  | { type: "text"; text: string }
+  | { type: "agent"; name: string }
+  | { type: "file"; path: string; label?: string }
+  | { type: "paste"; id: string; label: string; text: string; lines: number };
+
+export type ComposerAttachment = {
+  id: string;
+  name: string;
+  mimeType: string;
+  size: number;
+  kind: "image" | "file";
+  file: File;
+  previewUrl?: string;
+};
+
+export type SlashCommandOption = {
+  id: string;
+  name: string;
+  description?: string;
+  source?: "command" | "mcp" | "skill";
+};
+
+export type ComposerDraft = {
+  mode: PromptMode;
+  parts: ComposerPart[];
+  attachments: ComposerAttachment[];
+  /** Editor-visible text (may include collapsed paste placeholders). */
+  text: string;
+  /**
+   * Resolved text to send to the model.
+   * When a paste is collapsed into a placeholder (e.g. "[pasted text 1]"),
+   * this includes the full pasted text instead.
+   */
+  resolvedText?: string;
+  /** When set, draft is a slash command invocation */
+  command?: { name: string; arguments: string } | undefined;
+};
+
+export type ArtifactItem = {
+  id: string;
+  name: string;
+  path?: string;
+  kind: "file" | "text";
+  size?: string;
+  messageId?: string;
+};
+
+export type OpencodeEvent = {
+  type: string;
+  properties?: unknown;
+};
+
+export type SessionCompactionState = {
+  running: boolean;
+  startedAt: number | null;
+  finishedAt: number | null;
+  mode: "auto" | "manual" | null;
+  messageID: string | null;
+};
+
+export type View = "settings" | "session" | "signin";
+
+export type StartupPreference = "local" | "server";
+
+/**
+ * Release channel the desktop app is subscribed to.
+ *
+ * - "stable": default. Auto-updates from the rolling stable GitHub release.
+ * - "alpha": macOS-only. Auto-updates from the rolling alpha release that
+ *   every merge to `dev` publishes to.
+ *
+ * See `apps/app/src/app/lib/release-channels.ts` for URL resolution.
+ */
+export type ReleaseChannel = "stable" | "alpha";
+
+export type EngineRuntime = "direct";
+
+export type OnboardingStep = "welcome" | "local" | "server" | "connecting";
+
+export type SettingsTab =
+  | "general"
+  | "den"
+  | "skills"
+  | "extensions"
+  | "environment"
+  | "advanced"
+  | "appearance"
+  | "updates"
+  | "recovery"
+  | "debug";
+
+export type WorkspacePreset = "starter" | "automation" | "minimal";
+
+export type WorkspaceConnectionStatus = "idle" | "connecting" | "connected" | "error";
+
+export type WorkspaceConnectionState = {
+  status: WorkspaceConnectionStatus;
+  message?: string | null;
+  checkedAt?: number | null;
+};
+
+export type ResetOpenworkMode = "onboarding" | "all";
+
+export type WorkspaceBlueprintStarterKind = "prompt" | "session" | "action";
+
+export type WorkspaceBlueprintStarterAction = "connect-openai";
+
+export type WorkspaceBlueprintStarter = {
+  id?: string | null;
+  kind?: WorkspaceBlueprintStarterKind | null;
+  title?: string | null;
+  description?: string | null;
+  prompt?: string | null;
+  action?: WorkspaceBlueprintStarterAction | null;
+};
+
+export type WorkspaceBlueprintSessionMessageRole = "assistant" | "user";
+
+export type WorkspaceBlueprintSessionMessage = {
+  role?: WorkspaceBlueprintSessionMessageRole | null;
+  text?: string | null;
+};
+
+export type WorkspaceBlueprintSessionTemplate = {
+  id?: string | null;
+  title?: string | null;
+  messages?: WorkspaceBlueprintSessionMessage[] | null;
+  openOnFirstLoad?: boolean | null;
+};
+
+export type WorkspaceBlueprintMaterializedSession = {
+  templateId?: string | null;
+  sessionId?: string | null;
+};
+
+export type WorkspaceBlueprintMaterializedSessions = {
+  hydratedAt?: number | null;
+  items?: WorkspaceBlueprintMaterializedSession[] | null;
+};
+
+export type WorkspaceBlueprintEmptyState = {
+  title?: string | null;
+  body?: string | null;
+  starters?: WorkspaceBlueprintStarter[] | null;
+};
+
+export type WorkspaceBlueprint = {
+  emptyState?: WorkspaceBlueprintEmptyState | null;
+  sessions?: WorkspaceBlueprintSessionTemplate[] | null;
+  materialized?: {
+    sessions?: WorkspaceBlueprintMaterializedSessions | null;
+  } | null;
+};
+
+export type WorkspaceOpenworkConfig = {
+  version: number;
+  workspace?: {
+    name?: string | null;
+    createdAt?: number | null;
+    preset?: string | null;
+  } | null;
+  authorizedRoots: string[];
+  blueprint?: WorkspaceBlueprint | null;
+  reload?: {
+    auto?: boolean;
+    resume?: boolean;
+  } | null;
+};
+
+export type SkillCard = {
+  name: string;
+  path: string;
+  description?: string;
+  trigger?: string;
+};
+
+export type HubSkillRepo = {
+  owner: string;
+  repo: string;
+  ref: string;
+};
+
+export type HubSkillCard = {
+  name: string;
+  description?: string;
+  trigger?: string;
+  source: HubSkillRepo & {
+    path: string;
+  };
+};
+
+/** OpenWork Cloud (Den) org skill surfaced in the Skills catalog (team hub + shared). */
+export type DenOrgSkillCard = {
+  id: string;
+  title: string;
+  description: string | null;
+  skillText: string;
+  hubName: string | null;
+  shared: "org" | "public" | null;
+  updatedAt: string | null;
+};
+
+export type PluginInstallStep = {
+  title: string;
+  description: string;
+  command?: string;
+  url?: string;
+  path?: string;
+  note?: string;
+};
+
+export type SuggestedPlugin = {
+  name: string;
+  packageName: string;
+  description: string;
+  tags: string[];
+  aliases?: string[];
+  installMode?: "simple" | "guided";
+  steps?: PluginInstallStep[];
+};
+
+export type PluginScope = "project" | "global";
+
+export type McpServerSource = "config.project" | "config.global" | "config.remote";
+
+export type McpServerConfig = {
+  type: "remote" | "local";
+  url?: string;
+  command?: string[];
+  enabled?: boolean;
+  headers?: Record<string, string>;
+  environment?: Record<string, string>;
+  oauth?: Record<string, string> | false;
+  timeout?: number;
+};
+
+export type McpServerEntry = {
+  name: string;
+  config: McpServerConfig;
+  source?: McpServerSource;
+};
+
+export type McpStatus =
+  | { status: "connected" }
+  | { status: "disabled" }
+  | { status: "failed"; error: string }
+  | { status: "needs_auth" }
+  | { status: "needs_client_registration"; error: string };
+
+export type McpStatusMap = Record<string, McpStatus>;
+
+export type ReloadReason = "plugins" | "skills" | "mcp" | "config" | "agents" | "commands";
+
+export type OpencodeConnectStatus = {
+  at: number;
+  baseUrl: string;
+  directory?: string | null;
+  reason?: string | null;
+  status: "connecting" | "connected" | "error";
+  error?: string | null;
+  metrics?: {
+    healthyMs?: number;
+    loadSessionsMs?: number;
+    pendingPermissionsMs?: number;
+    providersMs?: number;
+    totalMs?: number;
+  };
+};
+
+export type ReloadTrigger = {
+  type: "skill" | "plugin" | "config" | "mcp" | "agent" | "command";
+  name?: string;
+  action?: "added" | "removed" | "updated";
+  path?: string;
+};
+
+export type PendingPermission = ApiPermissionRequest & {
+  receivedAt: number;
+};
+
+export type PendingQuestion = QuestionRequest & {
+  receivedAt: number;
+};
+
+export type TodoItem = {
+  id: string;
+  content: string;
+  status: string;
+  priority: string;
+};
+
+export type ModelRef = {
+  providerID: string;
+  modelID: string;
+};
+
+export type ModelBehaviorOption = {
+  value: string | null;
+  label: string;
+  description: string;
+};
+
+export type ModelOption = {
+  providerID: string;
+  modelID: string;
+  title: string;
+  description?: string;
+  footer?: string;
+  behaviorTitle: string;
+  behaviorLabel: string;
+  behaviorDescription: string;
+  behaviorValue: string | null;
+  behaviorOptions?: ModelBehaviorOption[];
+  disabled?: boolean;
+  isFree: boolean;
+  isConnected: boolean;
+  isRecommended?: boolean;
+};
+
+export type SelectedSessionSnapshot = {
+  session: Session | null;
+  status: string;
+  modelLabel: string;
+};
+
+export type WorkspaceState = {
+  active: WorkspaceInfo | null;
+  path: string;
+  root: string;
+};
+
+export type PluginState = {
+  scope: PluginScope;
+  config: OpencodeConfigFile | null;
+  list: string[];
+};
+
+export type WorkspaceDisplay = WorkspaceInfo & {
+  name: string;
+};
+
+export type UpdateHandle = {
+  available: boolean;
+  currentVersion: string;
+  version: string;
+  date?: string;
+  body?: string;
+  rawJson: Record<string, unknown>;
+  close: () => Promise<void>;
+  download: (onEvent?: (event: any) => void) => Promise<void>;
+  install: () => Promise<void>;
+  downloadAndInstall: (onEvent?: (event: any) => void) => Promise<void>;
+};
diff --git a/apps/app/src/app/utils/index.ts b/apps/app/src/app/utils/index.ts
new file mode 100644
index 0000000000..51307f5b49
--- /dev/null
+++ b/apps/app/src/app/utils/index.ts
@@ -0,0 +1,1070 @@
+import type { Part, Session } from "@opencode-ai/sdk/v2/client";
+import { t } from "../../i18n";
+import type {
+  ArtifactItem,
+  MessageGroup,
+  MessageInfo,
+  MessageWithParts,
+  ModelRef,
+  OpencodeEvent,
+  PlaceholderAssistantMessage,
+  ProviderListItem,
+} from "../types";
+import type { WorkspaceInfo } from "../lib/desktop";
+
+export function formatModelRef(model: ModelRef) {
+  return `${model.providerID}/${model.modelID}`;
+}
+
+export function parseModelRef(raw: string | null): ModelRef | null {
+  if (!raw) return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  const [providerID, ...rest] = trimmed.split("/");
+  if (!providerID || rest.length === 0) return null;
+  return { providerID, modelID: rest.join("/") };
+}
+
+export function modelEquals(a: ModelRef, b: ModelRef) {
+  return a.providerID === b.providerID && a.modelID === b.modelID;
+}
+
+const FRIENDLY_PROVIDER_LABELS: Record<string, string> = {
+  opencode: "OpenCode",
+  openai: "OpenAI",
+  anthropic: "Anthropic",
+  google: "Google",
+  openrouter: "OpenRouter",
+};
+
+const humanizeModelLabel = (value: string) => {
+  const normalized = value.trim().toLowerCase();
+  if (normalized && FRIENDLY_PROVIDER_LABELS[normalized]) {
+    return FRIENDLY_PROVIDER_LABELS[normalized];
+  }
+
+  const cleaned = value.replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
+  if (!cleaned) return value;
+
+  return cleaned
+    .split(" ")
+    .filter(Boolean)
+    .map((word) => {
+      if (/\d/.test(word) || word.length <= 3) {
+        return word.toUpperCase();
+      }
+      const lower = word.toLowerCase();
+      return lower.charAt(0).toUpperCase() + lower.slice(1);
+    })
+    .join(" ");
+};
+
+export function formatModelLabel(model: ModelRef, providers: ProviderListItem[] = []) {
+  const provider = providers.find((p) => p.id === model.providerID);
+  const modelInfo = provider?.models?.[model.modelID];
+
+  const providerLabel = provider?.name ?? humanizeModelLabel(model.providerID);
+  const modelLabel = modelInfo?.name ?? humanizeModelLabel(model.modelID);
+
+  return `${providerLabel} · ${modelLabel}`;
+}
+
+export function isTauriRuntime() {
+  return typeof window !== "undefined" && (window as any).__TAURI_INTERNALS__ != null;
+}
+
+export function isElectronRuntime() {
+  return typeof window !== "undefined" && (window as Window).__OPENWORK_ELECTRON__ != null;
+}
+
+export function isDesktopRuntime() {
+  return isTauriRuntime() || isElectronRuntime();
+}
+
+export function isWindowsPlatform() {
+  if (typeof navigator === "undefined") return false;
+
+  const ua = typeof navigator.userAgent === "string" ? navigator.userAgent : "";
+  const platform =
+    typeof (navigator as any).userAgentData?.platform === "string"
+      ? (navigator as any).userAgentData.platform
+      : typeof navigator.platform === "string"
+        ? navigator.platform
+        : "";
+
+  return /windows/i.test(platform) || /windows/i.test(ua);
+}
+
+export function isMacPlatform() {
+  if (typeof navigator === "undefined") return false;
+
+  const ua = typeof navigator.userAgent === "string" ? navigator.userAgent : "";
+  const platform =
+    typeof (navigator as any).userAgentData?.platform === "string"
+      ? (navigator as any).userAgentData.platform
+      : typeof navigator.platform === "string"
+        ? navigator.platform
+        : "";
+
+  return /mac/i.test(platform) || /macintosh|mac os x/i.test(ua);
+}
+
+const STARTUP_PREF_KEY = "openwork.startupPref";
+const LEGACY_PREF_KEY = "openwork.modePref";
+const LEGACY_PREF_KEY_ALT = "openwork_mode_pref";
+
+export function readStartupPreference(): "local" | "server" | null {
+  if (typeof window === "undefined") return null;
+
+  try {
+    const pref =
+      window.localStorage.getItem(STARTUP_PREF_KEY) ??
+      window.localStorage.getItem(LEGACY_PREF_KEY) ??
+      window.localStorage.getItem(LEGACY_PREF_KEY_ALT);
+
+    if (pref === "local" || pref === "server") return pref;
+    if (pref === "host") return "local";
+    if (pref === "client") return "server";
+  } catch {
+    // ignore
+  }
+
+  return null;
+}
+
+export function writeStartupPreference(nextPref: "local" | "server") {
+  if (typeof window === "undefined") return;
+
+  try {
+    window.localStorage.setItem(STARTUP_PREF_KEY, nextPref);
+    window.localStorage.removeItem(LEGACY_PREF_KEY);
+    window.localStorage.removeItem(LEGACY_PREF_KEY_ALT);
+  } catch {
+    // ignore
+  }
+}
+
+export function clearStartupPreference() {
+  if (typeof window === "undefined") return;
+
+  try {
+    window.localStorage.removeItem(STARTUP_PREF_KEY);
+    window.localStorage.removeItem(LEGACY_PREF_KEY);
+    window.localStorage.removeItem(LEGACY_PREF_KEY_ALT);
+  } catch {
+    // ignore
+  }
+}
+
+export function safeStringify(value: unknown) {
+  const seen = new WeakSet<object>();
+
+  try {
+    return JSON.stringify(
+      value,
+      (key, val) => {
+        if (val && typeof val === "object") {
+          if (seen.has(val as object)) {
+            return "<circular>";
+          }
+          seen.add(val as object);
+        }
+
+        const lowerKey = key.toLowerCase();
+        if (
+          lowerKey === "reasoningencryptedcontent" ||
+          lowerKey.includes("api_key") ||
+          lowerKey.includes("apikey") ||
+          lowerKey.includes("access_token") ||
+          lowerKey.includes("refresh_token") ||
+          lowerKey.includes("token") ||
+          lowerKey.includes("authorization") ||
+          lowerKey.includes("cookie") ||
+          lowerKey.includes("secret")
+        ) {
+          return "[redacted]";
+        }
+
+        return val;
+      },
+      2,
+    );
+  } catch {
+    return "<unserializable>";
+  }
+}
+
+export function formatBytes(bytes: number) {
+  if (!Number.isFinite(bytes) || bytes <= 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB"] as const;
+  const idx = Math.min(units.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
+  const value = bytes / Math.pow(1024, idx);
+  const rounded = idx === 0 ? Math.round(value) : Math.round(value * 10) / 10;
+  return `${rounded} ${units[idx]}`;
+}
+
+/**
+ * Convert a directory path to a forward-slash normalised form for **local**
+ * comparison only (e.g. case-insensitive matching via {@link normalizeDirectoryPath}).
+ *
+ * **Do NOT use this when building a directory value that will be sent to the
+ * OpenCode server** (session.list, session.create, mcp.status, etc.).  The
+ * server compares directories with strict equality and on Windows it stores
+ * native backslash paths.  Use
+ * {@link import("../lib/session-scope").toSessionTransportDirectory toSessionTransportDirectory}
+ * instead — it returns a branded {@link import("../lib/session-scope").TransportDirectory TransportDirectory}
+ * that the compiler can enforce.
+ */
+export function normalizeDirectoryQueryPath(input?: string | null) {
+  const trimmed = (input ?? "").trim();
+  if (!trimmed) return "";
+  const withoutVerbatim = /^\\\\\?\\UNC\\/i.test(trimmed)
+    ? `\\${trimmed.slice(7)}`
+    : /^\\\\\?\\[a-zA-Z]:[\\/]/.test(trimmed)
+      ? trimmed.slice(4)
+      : trimmed;
+  const unified = withoutVerbatim.replace(/\\/g, "/");
+  const withoutTrailing = unified.replace(/\/+$/, "");
+  return withoutTrailing || "/";
+}
+
+export function normalizeDirectoryPath(input?: string | null) {
+  const normalized = normalizeDirectoryQueryPath(input);
+  if (!normalized) return "";
+  return isWindowsPlatform() || isMacPlatform() ? normalized.toLowerCase() : normalized;
+}
+
+export function normalizeEvent(raw: unknown): OpencodeEvent | null {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+
+  const record = raw as Record<string, unknown>;
+
+  if (typeof record.type === "string") {
+    return {
+      type: record.type,
+      properties: record.properties,
+    };
+  }
+
+  if (record.payload && typeof record.payload === "object") {
+    const payload = record.payload as Record<string, unknown>;
+    if (typeof payload.type === "string") {
+      return {
+        type: payload.type,
+        properties: payload.properties,
+      };
+    }
+  }
+
+  return null;
+}
+
+export function formatRelativeTime(timestampMs: number) {
+  const delta = Date.now() - timestampMs;
+
+  if (delta < 0) {
+    return t("time.just_now");
+  }
+
+  if (delta < 60_000) {
+    return t("time.seconds_ago", { count: Math.max(1, Math.round(delta / 1000)) });
+  }
+
+  if (delta < 60 * 60_000) {
+    return t("time.minutes_ago", { count: Math.max(1, Math.round(delta / 60_000)) });
+  }
+
+  if (delta < 24 * 60 * 60_000) {
+    return t("time.hours_ago", { count: Math.max(1, Math.round(delta / (60 * 60_000))) });
+  }
+
+  return new Date(timestampMs).toLocaleDateString();
+}
+
+export function addOpencodeCacheHint(message: string) {
+  const lower = message.toLowerCase();
+  const cacheSignals = [
+    ".cache/opencode",
+    "library/caches/opencode",
+    "appdata/local/opencode",
+    "fetch_jwks.js",
+    "opencode cache",
+  ];
+
+  if (cacheSignals.some((signal) => lower.includes(signal)) && lower.includes("enoent")) {
+    return `${message}\n\nOpenCode cache looks corrupted. Use Repair cache in Settings to rebuild it.`;
+  }
+
+  return message;
+}
+
+const SANDBOX_DOCKER_OFFLINE_HINTS = [
+  "cannot connect to the docker daemon",
+  "is the docker daemon running",
+  "docker daemon",
+  "docker desktop",
+  "docker engine",
+  "error during connect",
+  "docker.sock",
+  "docker_socket",
+  "open //./pipe/docker_engine",
+];
+
+const SANDBOX_NETWORK_HINTS = [
+  "failed to fetch",
+  "fetch failed",
+  "networkerror",
+  "request timed out",
+  "timeout",
+  "connection refused",
+  "econnrefused",
+  "connection reset",
+  "socket hang up",
+  "enotfound",
+  "getaddrinfo",
+  "could not connect",
+];
+
+export function isSandboxWorkspace(workspace: WorkspaceInfo) {
+  return (
+    workspace.workspaceType === "remote" &&
+    (workspace.sandboxBackend === "docker" ||
+      workspace.sandboxBackend === "microsandbox" ||
+      Boolean(workspace.sandboxRunId?.trim()) ||
+      Boolean(workspace.sandboxContainerName?.trim()))
+  );
+}
+
+export function redactTokenLikeText(value: string): string {
+  return value
+    .replace(/([?&](?:access_token|api_key|key|password|token)=)[^&\s]+/gi, "$1[redacted]")
+    .replace(/\b(authorization:\s*bearer\s+)[^\s,]+/gi, "$1[redacted]")
+    .replace(/\b(bearer\s+)[a-z0-9._~+/=-]+/gi, "$1[redacted]")
+    .replace(/\bowt_[a-z0-9_-]+\b/gi, "owt_[redacted]");
+}
+
+export function getWorkspaceTaskLoadErrorDisplay(workspace: WorkspaceInfo, error?: string | null) {
+  const raw = redactTokenLikeText(error?.trim() ?? "");
+  const fallbackTitle = raw || "Failed to load tasks";
+  if (!raw || !isSandboxWorkspace(workspace)) {
+    return {
+      tone: "error" as const,
+      label: "Error",
+      message: raw && workspace.workspaceType === "remote" ? raw : "Failed to load tasks",
+      title: fallbackTitle,
+    };
+  }
+
+  const normalized = raw.toLowerCase();
+  const hasDockerHint = SANDBOX_DOCKER_OFFLINE_HINTS.some((hint) => normalized.includes(hint));
+  const hasNetworkHint = SANDBOX_NETWORK_HINTS.some((hint) => normalized.includes(hint));
+  const host = `${workspace.baseUrl ?? ""} ${workspace.openworkHostUrl ?? ""}`.toLowerCase();
+  const localHost = host.includes("localhost") || host.includes("127.0.0.1");
+
+  if (!hasDockerHint && !(localHost && hasNetworkHint)) {
+    return {
+      tone: "error" as const,
+      label: "Error",
+      message: "Failed to load tasks",
+      title: fallbackTitle,
+    };
+  }
+
+  const message = "Sandbox is offline. Start Docker Desktop, then test connection.";
+  return {
+    tone: "offline" as const,
+    label: "Offline",
+    message,
+    title: `${message}\n\n${raw}`,
+  };
+}
+
+export function parseTemplateFrontmatter(raw: string) {
+  const trimmed = raw.trimStart();
+  if (!trimmed.startsWith("---")) return null;
+  const endIndex = trimmed.indexOf("\n---", 3);
+  if (endIndex === -1) return null;
+  const header = trimmed.slice(3, endIndex).trim();
+  const body = trimmed.slice(endIndex + 4).replace(/^\r?\n/, "");
+  const data: Record<string, string> = {};
+
+  const unescapeValue = (value: string) => {
+    if (value.startsWith("\"") && value.endsWith("\"")) {
+      const inner = value.slice(1, -1);
+      return inner.replace(/\\(\\|\"|n|r|t)/g, (_match, code) => {
+        switch (code) {
+          case "n":
+            return "\n";
+          case "r":
+            return "\r";
+          case "t":
+            return "\t";
+          case "\\":
+            return "\\";
+          case "\"":
+            return "\"";
+          default:
+            return code;
+        }
+      });
+    }
+
+    if (value.startsWith("'") && value.endsWith("'")) {
+      return value.slice(1, -1).replace(/''/g, "'");
+    }
+
+    return value;
+  };
+
+  for (const line of header.split(/\r?\n/)) {
+    const entry = line.trim();
+    if (!entry) continue;
+    const colonIndex = entry.indexOf(":");
+    if (colonIndex === -1) continue;
+    const key = entry.slice(0, colonIndex).trim();
+    let value = entry.slice(colonIndex + 1).trim();
+    if (!key) continue;
+    value = unescapeValue(value);
+    data[key] = value;
+  }
+
+  return { data, body };
+}
+
+export function upsertSession(list: Session[], next: Session) {
+  const idx = list.findIndex((s) => s.id === next.id);
+  if (idx === -1) return [...list, next];
+
+  const copy = list.slice();
+  copy[idx] = next;
+  return copy;
+}
+
+export function normalizeSessionStatus(status: unknown) {
+  if (!status || typeof status !== "object") return "idle";
+  const record = status as Record<string, unknown>;
+  if (record.type === "busy") return "running";
+  if (record.type === "retry") return "retry";
+  if (record.type === "idle") return "idle";
+  return "idle";
+}
+
+export function modelFromUserMessage(info: MessageInfo): ModelRef | null {
+  if (!info || typeof info !== "object") return null;
+  if ((info as any).role !== "user") return null;
+
+  const model = (info as any).model as unknown;
+  if (!model || typeof model !== "object") return null;
+
+  const providerID = (model as any).providerID;
+  const modelID = (model as any).modelID;
+
+  if (typeof providerID !== "string" || typeof modelID !== "string") return null;
+  return { providerID, modelID };
+}
+
+export function lastUserModelFromMessages(list: MessageWithParts[]): ModelRef | null {
+  for (let i = list.length - 1; i >= 0; i -= 1) {
+    const model = modelFromUserMessage(list[i]?.info);
+    if (model) return model;
+  }
+
+  return null;
+}
+
+export function isStepPart(part: Part) {
+  return part.type === "reasoning" || part.type === "tool";
+}
+
+export function isUserVisiblePart(part: Part) {
+  const flags = part as { synthetic?: boolean; ignored?: boolean };
+  return !flags.synthetic && !flags.ignored;
+}
+
+export function isVisibleTextPart(part: Part) {
+  return part.type === "text" && isUserVisiblePart(part);
+}
+
+const EXPLORATION_TOOL_NAMES = new Set(["read", "glob", "grep", "search", "list", "list_files"]);
+
+function isExplorationToolPart(part: Part) {
+  if (part.type !== "tool") return false;
+  const tool = typeof (part as any).tool === "string" ? String((part as any).tool).toLowerCase() : "";
+  return EXPLORATION_TOOL_NAMES.has(tool);
+}
+
+export function groupMessageParts(parts: Part[], messageId: string): MessageGroup[] {
+  const groups: MessageGroup[] = [];
+  const explorationSteps: Part[] = [];
+  let textBuffer = "";
+  let stepGroupIndex = 0;
+  let sawExecution = false;
+
+  const flushText = () => {
+    if (!textBuffer) return;
+    groups.push({
+      kind: "text",
+      part: { type: "text", text: textBuffer } as Part,
+      segment: sawExecution ? "result" : "intent",
+    });
+    textBuffer = "";
+  };
+
+  const pushSteps = (stepParts: Part[], mode: "exploration" | "standalone") => {
+    if (!stepParts.length) return;
+    groups.push({
+      kind: "steps",
+      id: `steps-${messageId}-${stepGroupIndex}`,
+      parts: stepParts,
+      segment: "execution",
+      mode,
+    });
+    stepGroupIndex += 1;
+    sawExecution = true;
+  };
+
+  const flushExplorationSteps = () => {
+    if (!explorationSteps.length) return;
+    pushSteps(explorationSteps.splice(0, explorationSteps.length), "exploration");
+  };
+
+  parts.forEach((part) => {
+    if (part.type === "text") {
+      if (!isVisibleTextPart(part)) {
+        return;
+      }
+      flushExplorationSteps();
+      textBuffer += (part as { text?: string }).text ?? "";
+      return;
+    }
+
+    if (part.type === "agent") {
+      flushExplorationSteps();
+      const name = (part as { name?: string }).name ?? "";
+      textBuffer += name ? `@${name}` : "@agent";
+      return;
+    }
+
+    if (part.type === "file") {
+      flushExplorationSteps();
+      flushText();
+      groups.push({ kind: "text", part, segment: sawExecution ? "result" : "intent" });
+      return;
+    }
+
+    if (part.type === "step-start" || part.type === "step-finish") {
+      return;
+    }
+
+    flushText();
+
+    if (isExplorationToolPart(part)) {
+      explorationSteps.push(part);
+      return;
+    }
+
+    if (part.type === "reasoning" && explorationSteps.length > 0) {
+      explorationSteps.push(part);
+      return;
+    }
+
+    flushExplorationSteps();
+    pushSteps([part], "standalone");
+  });
+
+  flushText();
+
+  flushExplorationSteps();
+
+  return groups;
+}
+
+/** Classify a tool name into a semantic category for icon selection */
+export function classifyTool(toolName: string): "read" | "edit" | "write" | "search" | "terminal" | "glob" | "task" | "skill" | "tool" {
+  const lower = toolName.toLowerCase();
+  if (lower === "skill") return "skill";
+  if (lower.includes("read") || lower.includes("cat") || lower.includes("fetch")) return "read";
+  if (lower === "apply_patch") return "write";
+  if (lower.includes("edit") || lower.includes("replace") || lower.includes("update")) return "edit";
+  if (lower.includes("write") || lower.includes("create") || lower.includes("patch")) return "write";
+  if (lower.includes("grep") || lower.includes("search") || lower.includes("find")) return "search";
+  if (lower.includes("bash") || lower.includes("shell") || lower.includes("exec") || lower.includes("command") || lower.includes("run")) return "terminal";
+  if (lower.includes("glob") || lower.includes("list") || lower.includes("ls")) return "glob";
+  if (lower.includes("task") || lower.includes("agent") || lower.includes("todo")) return "task";
+  return "tool";
+}
+
+/** Extract a clean filename from a file path */
+function extractFilename(filePath: string): string {
+  const parts = filePath.replace(/\\/g, "/").split("/");
+  return parts[parts.length - 1] || filePath;
+}
+
+function normalizeStepText(value: unknown): string {
+  if (typeof value !== "string") return "";
+  return value.replace(/\s+/g, " ").trim();
+}
+
+function cleanReasoningText(value: string): string {
+  return value
+    .replace(/\[REDACTED\]/g, "")
+    .replace(/\*\*([^*]+)\*\*/g, "$1")
+    .replace(/__([^_]+)__/g, "$1")
+    .replace(/`([^`]+)`/g, "$1")
+    .trim();
+}
+
+function truncateStepText(value: string, max = 80): string {
+  return value.length > max ? `${value.slice(0, Math.max(0, max - 3))}...` : value;
+}
+
+function isPathLike(value: string): boolean {
+  return /^(?:[A-Za-z]:[\\/]|~[\\/]|\/|\.\.?[\\/])/.test(value) || /[\\/]/.test(value);
+}
+
+function normalizePathToken(value: string): string {
+  const clean = value.trim().replace(/^[`'"([{]+|[`'"\])},.;:]+$/g, "");
+  if (!isPathLike(clean)) return clean;
+  return extractFilename(clean);
+}
+
+function formatAgentLabel(value: string): string {
+  const clean = value.trim().replace(/[_-]+/g, " ");
+  if (!clean) return "";
+  return clean
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))
+    .join(" ");
+}
+
+function getToolInput(state: any): Record<string, unknown> {
+  const input = state?.input;
+  if (input && typeof input === "object") return input as Record<string, unknown>;
+  return {};
+}
+
+function pickInputText(input: Record<string, unknown>, keys: string[]): string {
+  for (const key of keys) {
+    const value = input[key];
+    const text = normalizeStepText(value);
+    if (text) return text;
+  }
+  return "";
+}
+
+function buildToolTitle(state: any, toolName: string): string {
+  const lower = toolName.toLowerCase();
+  const input = getToolInput(state);
+  const pick = (...keys: string[]) => pickInputText(input, keys);
+  const file = (...keys: string[]) => {
+    const value = pick(...keys);
+    if (!value) return "";
+    return normalizePathToken(value);
+  };
+
+  if (lower === "read") {
+    const target = file("filePath", "path", "file");
+    return target ? `Reviewed ${target}` : "Reviewed file";
+  }
+
+  if (lower === "edit") {
+    const target = file("filePath", "path", "file");
+    return target ? `Updated ${target}` : "Updated file";
+  }
+
+  if (lower === "write") {
+    const target = file("filePath", "path", "file");
+    return target ? `Write ${target}` : "Write file";
+  }
+
+  if (lower === "apply_patch") {
+    return "Apply patch";
+  }
+
+  if (lower === "list" || lower === "list_files") {
+    const target = file("path");
+    return target ? `Reviewed ${target}` : "Reviewed files";
+  }
+
+  if (lower === "grep" || lower === "glob" || lower === "search") {
+    const pattern = pick("pattern", "query");
+    return pattern ? `Searched ${truncateStepText(pattern, 44)}` : "Searched code";
+  }
+
+  if (lower === "bash") {
+    const description = pick("description");
+    if (description) return truncateStepText(description, 56);
+    const command = pick("command", "cmd");
+    if (command) return truncateStepText(`Run ${command}`, 56);
+    return "Run command";
+  }
+
+  if (lower === "task") {
+    const agent = formatAgentLabel(pick("subagent_type"));
+    if (agent) return `${agent} task`;
+    return "Task";
+  }
+
+  if (lower === "todowrite") {
+    return "Update todo list";
+  }
+
+  if (lower === "todoread") {
+    return "Read todo list";
+  }
+
+  if (lower === "webfetch") {
+    const url = pick("url");
+    return url ? `Checked ${truncateStepText(url, 44)}` : "Checked web page";
+  }
+
+  if (lower === "skill") {
+    const name = pick("name");
+    return name ? `Load skill ${name}` : "Load skill";
+  }
+
+  const stateTitle = normalizeStepText(state?.title);
+  if (stateTitle) {
+    return truncateStepText(isPathLike(stateTitle) ? normalizePathToken(stateTitle) : stateTitle, 56);
+  }
+
+  const fallback = normalizeStepText(toolName)
+    .replace(/[_-]+/g, " ")
+    .replace(/\s+/g, " ");
+  return fallback || "Tool";
+}
+
+/** Build a concise detail line for a tool call — avoids dumping raw output */
+function buildToolDetail(state: any, toolName: string): string | undefined {
+  const lower = toolName.toLowerCase();
+  const input = getToolInput(state);
+  const pick = (...keys: string[]) => pickInputText(input, keys);
+
+  if (lower === "read") {
+    const chunks: string[] = [];
+    const offset = input.offset;
+    const limit = input.limit;
+    if (typeof offset === "number") chunks.push(`offset ${offset}`);
+    if (typeof limit === "number") chunks.push(`limit ${limit}`);
+    if (chunks.length > 0) return chunks.join(" - ");
+    return undefined;
+  }
+
+  if (lower === "bash") {
+    const command = pick("command", "cmd");
+    if (command) return truncateStepText(command, 80);
+  }
+
+  if (lower === "grep" || lower === "glob" || lower === "search") {
+    const root = pick("path");
+    if (root) return `in ${normalizePathToken(root)}`;
+  }
+
+  if (lower === "task") {
+    const description = pick("description");
+    if (description) return truncateStepText(description, 80);
+    const agent = formatAgentLabel(pick("subagent_type"));
+    if (agent) return `${agent} agent`;
+  }
+
+  if (lower === "todowrite" || lower === "todoread") {
+    return undefined;
+  }
+
+  if (lower === "webfetch") {
+    const url = pick("url");
+    if (url) return truncateStepText(url, 80);
+  }
+
+  // For file operations, show the filename
+  const filePath = state?.path ?? state?.file;
+  if (typeof filePath === "string" && filePath.trim()) {
+    const name = extractFilename(filePath.trim());
+    const status = state?.status;
+    if (status === "completed" || status === "done") {
+      return name;
+    }
+    return name;
+  }
+
+  // For edits that report updated files, show filename(s)
+  const files = state?.files;
+  if (Array.isArray(files) && files.length > 0) {
+    const names = files.filter((f: any) => typeof f === "string").map(extractFilename);
+    if (names.length === 1) return names[0];
+    if (names.length > 1) return `${names[0]} +${names.length - 1} more`;
+  }
+
+  // For bash/terminal commands, show the command
+  const command = state?.command ?? state?.cmd;
+  if (typeof command === "string" && command.trim()) {
+    const clean = command.trim();
+    return clean.length > 80 ? `${clean.slice(0, 77)}...` : clean;
+  }
+
+  // For search/grep, show the pattern
+  const pattern = state?.pattern ?? state?.query;
+  if (typeof pattern === "string" && pattern.trim()) {
+    return `"${pattern.trim().length > 60 ? pattern.trim().slice(0, 57) + "..." : pattern.trim()}"`;
+  }
+
+  // Subtitle/detail from state as fallback
+  const subtitle = state?.subtitle ?? state?.detail ?? state?.summary;
+  if (typeof subtitle === "string" && subtitle.trim()) {
+    const clean = subtitle.trim();
+    return clean.length > 80 ? `${clean.slice(0, 77)}...` : clean;
+  }
+
+  // For completed tools with output, show a very short summary
+  const outputRaw = typeof state?.output === "string" ? state.output.trim() : "";
+  if (outputRaw) {
+    if (lower === "read") return undefined;
+
+    const output = outputRaw.length > 3000 ? outputRaw.slice(0, 3000) : outputRaw;
+
+    // Extract just the first meaningful line (skip line numbers and raw file markers)
+    const lines = output.split("\n").filter((l: string) => {
+      const trimmed = l.trim();
+      return (
+        trimmed &&
+        !trimmed.startsWith("<file>") &&
+        !trimmed.startsWith("<path>") &&
+        !trimmed.startsWith("<type>") &&
+        !trimmed.startsWith("<content>") &&
+        !trimmed.startsWith("</content>") &&
+        !/^\d{5}\|/.test(trimmed) &&
+        !/^\d+:\s/.test(trimmed)
+      );
+    });
+    if (lines.length > 0) {
+      const first = lines[0].trim();
+      if (first.startsWith("Success")) {
+        // "Success. Updated the following files: M foo.ts" -> "foo.ts"
+        const match = first.match(/:\s*[MADR]\s+(.+)/);
+        if (match) return extractFilename(match[1].trim());
+        return "Done";
+      }
+      return first.length > 80 ? `${first.slice(0, 77)}...` : first;
+    }
+  }
+
+  return undefined;
+}
+
+const ARTIFACT_PATH_PATTERN =
+  /(?:^|[\s"'`([{])((?:[a-zA-Z]:[/\\]|\.{1,2}[/\\]|~[/\\]|[/\\])[\w./\\\-]*\.[a-z][a-z0-9]{0,9}|[\w.\-]+[/\\][\w./\\\-]*\.[a-z][a-z0-9]{0,9})/gi;
+const ARTIFACT_OUTPUT_SCAN_LIMIT = 4000;
+const ARTIFACT_OUTPUT_SKIP_TOOLS = new Set(["webfetch"]);
+
+// Patterns that indicate a path is a truncated system/absolute path rather than a workspace-relative path
+const TRUNCATED_SYSTEM_PATH_PATTERNS = [
+  /com\.[^/]+\.(openwork|opencode)/i, // macOS app bundle identifiers
+  /\.openwork\.dev\//i, // OpenWork dev paths
+  /Application Support\//i, // macOS Application Support
+  /AppData[/\\]/i, // Windows AppData
+  /\.local\/share\//i, // Linux XDG data
+  /workspaces\/[^/]+\/workspaces\//i, // Nested workspaces paths (clearly malformed)
+];
+
+/**
+ * Clean up an artifact path to extract the workspace-relative portion.
+ * Returns null if the path should be rejected entirely.
+ */
+function cleanArtifactPath(rawPath: string): string | null {
+  const normalized = rawPath.trim().replace(/[\\/]+/g, "/");
+  if (!normalized) return null;
+
+  // Check if this looks like a truncated system path
+  for (const pattern of TRUNCATED_SYSTEM_PATH_PATTERNS) {
+    if (pattern.test(normalized)) {
+      // Try to extract just the relative part after "workspaces/<name>/"
+      const workspacesMatch = normalized.match(/workspaces\/[^/]+\/(.+)$/i);
+      if (workspacesMatch && workspacesMatch[1]) {
+        const relative = workspacesMatch[1];
+        // Validate the extracted path doesn't still contain system patterns
+        if (!TRUNCATED_SYSTEM_PATH_PATTERNS.some((p) => p.test(relative))) {
+          return relative;
+        }
+      }
+      // Reject the path entirely if we can't extract a clean relative path
+      return null;
+    }
+  }
+
+  return normalized;
+}
+
+type DeriveArtifactsOptions = {
+  maxMessages?: number;
+};
+
+export function summarizeStep(part: Part): { title: string; detail?: string; isSkill?: boolean; skillName?: string; toolCategory?: string; status?: string } {
+  if (part.type === "tool") {
+    const record = part as any;
+    const toolName = record.tool ? String(record.tool) : "Tool";
+    const state = record.state ?? {};
+    const title = buildToolTitle(state, toolName);
+    const category = classifyTool(toolName);
+    const status = state.status ? String(state.status) : undefined;
+    const detail = buildToolDetail(state, toolName);
+    const normalizedTitle = normalizeStepText(title).toLowerCase();
+    const finalDetail = detail && normalizeStepText(detail).toLowerCase() !== normalizedTitle ? detail : undefined;
+    
+    // Detect skill trigger
+    if (category === "skill") {
+      const skillName = state.metadata?.name || title.replace(/^(Loaded skill:\s*|Load skill\s+)/i, "");
+      return { title, isSkill: true, skillName, detail: finalDetail, toolCategory: category, status };
+    }
+    
+    return { title, detail: finalDetail, toolCategory: category, status };
+  }
+
+  if (part.type === "reasoning") {
+    const record = part as any;
+    const text = typeof record.text === "string" ? cleanReasoningText(record.text) : "";
+    if (!text) return { title: "Thinking", toolCategory: "tool" };
+
+    const lines = text
+      .split(/\r?\n/)
+      .map((line: string) => line.trim())
+      .filter(Boolean);
+    const compact = lines.join(" ");
+
+    let headline = "";
+    let detail = "";
+    if (lines.length > 1) {
+      headline = lines[0];
+      detail = lines.slice(1).join("\n");
+    } else {
+      const sentenceBreak = compact.indexOf(". ");
+      if (sentenceBreak > 18 && sentenceBreak < 120) {
+        headline = compact.slice(0, sentenceBreak + 1).trim();
+        detail = compact.slice(sentenceBreak + 2).trim();
+      } else {
+        headline = compact;
+        detail = compact;
+      }
+    }
+
+    headline = headline.replace(/^thinking[:\s-]*/i, "").trim();
+    const title = truncateStepText(headline || "Thinking", 96);
+    return { title, detail: detail || undefined, toolCategory: "tool" };
+  }
+
+  if (part.type === "step-start" || part.type === "step-finish") {
+    const reason = (part as any).reason;
+    return {
+      title: part.type === "step-start" ? "Step started" : "Step finished",
+      detail: reason ? String(reason) : undefined,
+      toolCategory: "tool",
+    };
+  }
+
+  return { title: "Step", toolCategory: "tool" };
+}
+
+export function deriveArtifacts(list: MessageWithParts[], options: DeriveArtifactsOptions = {}): ArtifactItem[] {
+  const results = new Map<string, ArtifactItem>();
+  const maxMessages =
+    typeof options.maxMessages === "number" && Number.isFinite(options.maxMessages) && options.maxMessages > 0
+      ? Math.floor(options.maxMessages)
+      : null;
+  const source = maxMessages && list.length > maxMessages ? list.slice(list.length - maxMessages) : list;
+
+  source.forEach((message) => {
+    const messageId = String((message.info as any)?.id ?? "");
+
+    message.parts.forEach((part) => {
+      if (part.type !== "tool") return;
+      const record = part as any;
+      const state = record.state ?? {};
+      const matches = new Set<string>();
+
+      const explicit = [
+        state.path,
+        state.file,
+        ...(Array.isArray(state.files) ? state.files : []),
+      ];
+
+      explicit.forEach((f) => {
+        if (typeof f === "string") {
+          const trimmed = f.trim();
+          if (
+            trimmed.length > 0 &&
+            trimmed.length <= 500 &&
+            trimmed.includes(".") &&
+            !/^\.{2,}$/.test(trimmed)
+          ) {
+            matches.add(trimmed);
+          }
+        }
+      });
+
+      const toolName =
+        typeof record.tool === "string" && record.tool.trim()
+          ? record.tool.trim().toLowerCase()
+          : "";
+      const titleText = typeof state.title === "string" ? state.title : "";
+      const outputText =
+        typeof state.output === "string" && !ARTIFACT_OUTPUT_SKIP_TOOLS.has(toolName)
+          ? state.output.slice(0, ARTIFACT_OUTPUT_SCAN_LIMIT)
+          : "";
+
+      const text = [titleText, outputText]
+        .filter((v): v is string => Boolean(v))
+        .join(" ");
+
+      if (text) {
+        ARTIFACT_PATH_PATTERN.lastIndex = 0;
+        Array.from(text.matchAll(ARTIFACT_PATH_PATTERN))
+          .map((m) => m[1])
+          .filter((f) => f && f.length <= 500)
+          .forEach((f) => matches.add(f));
+      }
+
+      if (matches.size === 0) return;
+
+      matches.forEach((match) => {
+        const cleanedPath = cleanArtifactPath(match);
+        if (!cleanedPath) return;
+
+        const key = cleanedPath.toLowerCase();
+        const name = cleanedPath.split("/").pop() ?? cleanedPath;
+        const id = `artifact-${encodeURIComponent(cleanedPath)}`;
+
+        // Delete and re-add to move to end (most recent)
+        if (results.has(key)) results.delete(key);
+        results.set(key, {
+          id,
+          name,
+          path: cleanedPath,
+          kind: "file" as const,
+          size: state.size ? String(state.size) : undefined,
+          messageId: messageId || undefined,
+        });
+      });
+    });
+  });
+
+  return Array.from(results.values());
+}
+
+export function deriveWorkingFiles(items: ArtifactItem[]): string[] {
+  const results: string[] = [];
+  const seen = new Set<string>();
+
+  for (const item of items) {
+    const rawKey = item.path ?? item.name;
+    const normalizedPath = rawKey.trim().replace(/[\\/]+/g, "/");
+    const normalizedKey = normalizedPath.toLowerCase();
+    if (!normalizedPath || seen.has(normalizedKey)) continue;
+    seen.add(normalizedKey);
+    results.push(normalizedPath);
+    if (results.length >= 5) break;
+  }
+
+  return results;
+}
diff --git a/apps/app/src/app/utils/plugins.ts b/apps/app/src/app/utils/plugins.ts
new file mode 100644
index 0000000000..8026a6477d
--- /dev/null
+++ b/apps/app/src/app/utils/plugins.ts
@@ -0,0 +1,88 @@
+import { parse } from "jsonc-parser";
+
+import type { OpencodeConfigFile } from "../lib/desktop";
+
+type PluginListValue = string | string[] | null | undefined;
+
+type PluginConfig = {
+  content: string | null;
+} | null;
+
+export function normalizePluginList(value: PluginListValue) {
+  if (!value) return [] as string[];
+  if (Array.isArray(value)) {
+    return value
+      .map((entry) => (typeof entry === "string" ? entry.trim() : ""))
+      .filter((entry) => entry.length > 0);
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed ? [trimmed] : [];
+  }
+  return [] as string[];
+}
+
+export function stripPluginVersion(spec: string) {
+  const trimmed = spec.trim();
+  if (!trimmed) return "";
+
+  const looksLikeVersion = (suffix: string) =>
+    /^(latest|next|beta|alpha|canary|rc|stable|\d)/i.test(suffix);
+
+  if (trimmed.startsWith("@")) {
+    const slashIndex = trimmed.indexOf("/");
+    if (slashIndex === -1) return trimmed;
+
+    const atIndex = trimmed.indexOf("@", slashIndex + 1);
+    if (atIndex === -1) return trimmed;
+
+    const suffix = trimmed.slice(atIndex + 1);
+    return looksLikeVersion(suffix) ? trimmed.slice(0, atIndex) : trimmed;
+  }
+
+  const atIndex = trimmed.indexOf("@");
+  if (atIndex === -1) return trimmed;
+
+  const suffix = trimmed.slice(atIndex + 1);
+  return looksLikeVersion(suffix) ? trimmed.slice(0, atIndex) : trimmed;
+}
+
+export function isPluginInstalled(pluginList: string[], pluginName: string, aliases: string[] = []) {
+  const normalized = pluginList.flatMap((entry) => {
+    const raw = entry.toLowerCase();
+    const stripped = stripPluginVersion(entry).toLowerCase();
+    return stripped && stripped !== raw ? [raw, stripped] : [raw];
+  });
+
+  const list = new Set(normalized);
+  return [pluginName, ...aliases].some((entry) => list.has(entry.toLowerCase()));
+}
+
+export function loadPluginsFromConfig(
+  config: PluginConfig,
+  onList: (next: string[]) => void,
+  onError: (message: string) => void,
+) {
+  if (!config?.content) {
+    onList([]);
+    return;
+  }
+
+  try {
+    const parsed = parse(config.content) as Record<string, unknown> | undefined;
+    const next = normalizePluginList(parsed?.plugin as PluginListValue);
+    onList(next);
+  } catch (e) {
+    onList([]);
+    onError(e instanceof Error ? e.message : "Failed to parse opencode.json");
+  }
+}
+
+export function parsePluginListFromContent(content: string) {
+  try {
+    const parsed = parse(content) as Record<string, unknown> | undefined;
+    return normalizePluginList(parsed?.plugin as PluginListValue);
+  } catch {
+    return [] as string[];
+  }
+}
diff --git a/apps/app/src/app/utils/providers.ts b/apps/app/src/app/utils/providers.ts
new file mode 100644
index 0000000000..966c0822b6
--- /dev/null
+++ b/apps/app/src/app/utils/providers.ts
@@ -0,0 +1,51 @@
+import type { Provider as ConfigProvider, ProviderListResponse } from "@opencode-ai/sdk/v2/client";
+
+const PINNED_PROVIDER_ORDER = ["opencode", "openai", "anthropic"] as const;
+
+export const providerPriorityRank = (id: string) => {
+  const normalized = id.trim().toLowerCase();
+  const index = PINNED_PROVIDER_ORDER.indexOf(
+    normalized as (typeof PINNED_PROVIDER_ORDER)[number],
+  );
+  return index === -1 ? PINNED_PROVIDER_ORDER.length : index;
+};
+
+export const compareProviders = (
+  a: { id: string; name?: string },
+  b: { id: string; name?: string },
+) => {
+  const rankDiff = providerPriorityRank(a.id) - providerPriorityRank(b.id);
+  if (rankDiff !== 0) return rankDiff;
+
+  const aName = (a.name ?? a.id).trim();
+  const bName = (b.name ?? b.id).trim();
+  return aName.localeCompare(bName);
+};
+
+// Starting with @opencode-ai/sdk@1.4.x, `ConfigProvider` (from `config.providers()`)
+// and the provider items in `ProviderListResponse.all` share the same shape, so
+// this mapper is effectively an identity function. It is kept for call-site
+// stability and to normalize optional fields (`name`, `env`).
+export const mapConfigProvidersToList = (
+  providers: ConfigProvider[],
+): ProviderListResponse["all"] =>
+  providers.map((provider) => ({
+    ...provider,
+    name: provider.name ?? provider.id,
+    env: provider.env ?? [],
+  }));
+
+export const filterProviderList = (
+  value: ProviderListResponse,
+  disabledProviders: string[],
+): ProviderListResponse => {
+  const disabled = new Set(disabledProviders.map((id) => id.trim()).filter(Boolean));
+  if (!disabled.size) return value;
+  return {
+    all: value.all.filter((provider) => !disabled.has(provider.id)),
+    connected: value.connected.filter((id) => !disabled.has(id)),
+    default: Object.fromEntries(
+      Object.entries(value.default).filter(([id]) => !disabled.has(id)),
+    ),
+  };
+};
diff --git a/apps/app/src/components/ui/accordion.tsx b/apps/app/src/components/ui/accordion.tsx
new file mode 100644
index 0000000000..2faf916dc7
--- /dev/null
+++ b/apps/app/src/components/ui/accordion.tsx
@@ -0,0 +1,75 @@
+import { Accordion as AccordionPrimitive } from "@base-ui/react/accordion"
+
+import { cn } from "@/lib/utils"
+import { ChevronDownIcon, ChevronUpIcon } from "lucide-react"
+
+function Accordion({ className, ...props }: AccordionPrimitive.Root.Props) {
+  return (
+    <AccordionPrimitive.Root
+      data-slot="accordion"
+      className={cn(
+        "flex w-full flex-col relative rounded-xl border border-border bg-clip-padding shadow-xs/5 before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--radius-xl)-1px)] before:shadow-[0_1px_--theme(--color-black/4%)] dark:before:shadow-[0_-1px_--theme(--color-white/6%)] bg-muted/10",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function AccordionItem({ className, ...props }: AccordionPrimitive.Item.Props) {
+  return (
+    <AccordionPrimitive.Item
+      data-slot="accordion-item"
+      className={cn("not-last:border-b", className)}
+      {...props}
+    />
+  )
+}
+
+function AccordionTrigger({
+  className,
+  children,
+  ...props
+}: AccordionPrimitive.Trigger.Props) {
+  return (
+    <AccordionPrimitive.Header className="flex">
+      <AccordionPrimitive.Trigger
+        data-slot="accordion-trigger"
+        className={cn(
+          "group/accordion-trigger relative flex flex-1 items-start justify-between gap-6 border border-transparent px-4 py-2 text-start text-sm font-medium transition-all outline-none hover:underline aria-disabled:pointer-events-none aria-disabled:opacity-50 **:data-[slot=accordion-trigger-icon]:ms-auto **:data-[slot=accordion-trigger-icon]:size-4 **:data-[slot=accordion-trigger-icon]:text-muted-foreground",
+          className
+        )}
+        {...props}
+      >
+        {children}
+        <ChevronDownIcon data-slot="accordion-trigger-icon" className="pointer-events-none shrink-0 group-aria-expanded/accordion-trigger:hidden" />
+        <ChevronUpIcon data-slot="accordion-trigger-icon" className="pointer-events-none hidden shrink-0 group-aria-expanded/accordion-trigger:inline" />
+      </AccordionPrimitive.Trigger>
+    </AccordionPrimitive.Header>
+  )
+}
+
+function AccordionContent({
+  className,
+  children,
+  ...props
+}: AccordionPrimitive.Panel.Props) {
+  return (
+    <AccordionPrimitive.Panel
+      data-slot="accordion-content"
+      className="overflow-hidden text-sm data-open:animate-accordion-down data-closed:animate-accordion-up"
+      {...props}
+    >
+      <div
+        className={cn(
+          "h-(--accordion-panel-height) pt-0 px-4 pb-4 data-ending-style:h-0 data-starting-style:h-0 [&_a]:underline [&_a]:underline-offset-3 [&_a]:hover:text-foreground [&_p:not(:last-child)]:mb-4",
+          className
+        )}
+      >
+        {children}
+      </div>
+    </AccordionPrimitive.Panel>
+  )
+}
+
+export { Accordion, AccordionItem, AccordionTrigger, AccordionContent }
diff --git a/apps/app/src/components/ui/button.tsx b/apps/app/src/components/ui/button.tsx
new file mode 100644
index 0000000000..a14483c129
--- /dev/null
+++ b/apps/app/src/components/ui/button.tsx
@@ -0,0 +1,56 @@
+import { Button as ButtonPrimitive } from "@base-ui/react/button"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const buttonVariants = cva(
+  "group/button inline-flex shrink-0 items-center justify-center rounded-4xl border border-transparent bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/30 active:not-aria-[haspopup]:translate-y-px disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 relative",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/80 bg-clip-padding shadow-xs/5 before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--radius-xl)-1px)] before:shadow-[0_1px_--theme(--color-black/4%)] dark:before:shadow-[0_-1px_--theme(--color-white/6%)]",
+        outline:
+          "border-border bg-muted/20 hover:bg-muted hover:border-foreground/20 hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground dark:bg-muted/20 dark:hover:bg-input/30 dark:hover:border-input/80 bg-clip-padding shadow-xs/5 before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--radius-xl)-1px)] before:shadow-[0_1px_--theme(--color-black/4%)] dark:before:shadow-[0_-1px_--theme(--color-white/6%)]",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80 aria-expanded:bg-secondary aria-expanded:text-secondary-foreground",
+        ghost:
+          "hover:bg-muted hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground dark:hover:bg-muted/50",
+        destructive:
+          "border-border text-destructive hover:bg-destructive/10 hover:border-destructive/40 focus-visible:border-destructive/40 focus-visible:ring-destructive/20 dark:border-border dark:hover:bg-destructive/10 dark:border-destructive/40 dark:focus-visible:ring-destructive/40 bg-clip-padding shadow-xs/5 before:pointer-events-none before:absolute before:inset-0 before:rounded-[calc(var(--radius-xl)-1px)] before:shadow-[0_1px_--theme(--color-black/4%)] dark:before:shadow-[0_-1px_--theme(--color-white/6%)]",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default:
+          "h-9 gap-1.5 px-3 has-data-[icon=inline-end]:pe-2.5 has-data-[icon=inline-start]:ps-2.5 rounded-xl",
+        xs: "h-6 gap-1 px-2.5 text-xs has-data-[icon=inline-end]:pe-2 has-data-[icon=inline-start]:ps-2 [&_svg:not([class*='size-'])]:size-3",
+        sm: "h-8 gap-1 px-3 has-data-[icon=inline-end]:pe-2 has-data-[icon=inline-start]:ps-2 rounded-xl",
+        lg: "h-10 gap-1.5 px-4 has-data-[icon=inline-end]:pe-3 has-data-[icon=inline-start]:ps-3 rounded-xl",
+        icon: "size-9",
+        "icon-xs": "size-6 [&_svg:not([class*='size-'])]:size-3",
+        "icon-sm": "size-8",
+        "icon-lg": "size-10",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+function Button({
+  className,
+  variant = "default",
+  size = "default",
+  ...props
+}: ButtonPrimitive.Props & VariantProps<typeof buttonVariants>) {
+  return (
+    <ButtonPrimitive
+      data-slot="button"
+      className={cn(buttonVariants({ variant, size, className }))}
+      {...props}
+    />
+  )
+}
+
+export { Button, buttonVariants }
diff --git a/apps/app/src/components/ui/collapsible.tsx b/apps/app/src/components/ui/collapsible.tsx
new file mode 100644
index 0000000000..4b242f71d4
--- /dev/null
+++ b/apps/app/src/components/ui/collapsible.tsx
@@ -0,0 +1,19 @@
+import { Collapsible as CollapsiblePrimitive } from "@base-ui/react/collapsible"
+
+function Collapsible({ ...props }: CollapsiblePrimitive.Root.Props) {
+  return <CollapsiblePrimitive.Root data-slot="collapsible" {...props} />
+}
+
+function CollapsibleTrigger({ ...props }: CollapsiblePrimitive.Trigger.Props) {
+  return (
+    <CollapsiblePrimitive.Trigger data-slot="collapsible-trigger" {...props} />
+  )
+}
+
+function CollapsibleContent({ ...props }: CollapsiblePrimitive.Panel.Props) {
+  return (
+    <CollapsiblePrimitive.Panel data-slot="collapsible-content" {...props} />
+  )
+}
+
+export { Collapsible, CollapsibleTrigger, CollapsibleContent }
diff --git a/apps/app/src/components/ui/dialog.tsx b/apps/app/src/components/ui/dialog.tsx
new file mode 100644
index 0000000000..c470012e61
--- /dev/null
+++ b/apps/app/src/components/ui/dialog.tsx
@@ -0,0 +1,158 @@
+import * as React from "react";
+import { Dialog as DialogPrimitive } from "@base-ui/react/dialog"
+
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+import { XIcon } from "lucide-react"
+
+function Dialog({ ...props }: DialogPrimitive.Root.Props) {
+  return <DialogPrimitive.Root data-slot="dialog" {...props} />
+}
+
+function DialogTrigger({ ...props }: DialogPrimitive.Trigger.Props) {
+  return <DialogPrimitive.Trigger data-slot="dialog-trigger" {...props} />
+}
+
+function DialogPortal({ ...props }: DialogPrimitive.Portal.Props) {
+  return <DialogPrimitive.Portal data-slot="dialog-portal" {...props} />
+}
+
+function DialogClose({ ...props }: DialogPrimitive.Close.Props) {
+  return <DialogPrimitive.Close data-slot="dialog-close" {...props} />
+}
+
+function DialogOverlay({
+  className,
+  ...props
+}: DialogPrimitive.Backdrop.Props) {
+  return (
+    <DialogPrimitive.Backdrop
+      data-slot="dialog-overlay"
+      className={cn(
+        "fixed inset-0 isolate z-50 bg-black/30 duration-100 supports-backdrop-filter:backdrop-blur-sm data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function DialogContent({
+  className,
+  children,
+  showCloseButton = true,
+  ...props
+}: DialogPrimitive.Popup.Props & {
+  showCloseButton?: boolean
+}) {
+  return (
+    <DialogPortal>
+      <DialogOverlay />
+      <DialogPrimitive.Popup
+        data-slot="dialog-content"
+        className={cn(
+          "fixed top-1/2 start-1/2 z-50 grid w-full max-w-[calc(100%-2rem)] -translate-x-1/2 rtl:translate-x-1/2 -translate-y-1/2 gap-6 rounded-4xl bg-popover p-6 text-sm text-popover-foreground shadow-xl ring-1 ring-foreground/5 duration-100 outline-none sm:max-w-md dark:ring-foreground/10 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className
+        )}
+        {...props}
+      >
+        {children}
+        {showCloseButton && (
+          <DialogPrimitive.Close
+            data-slot="dialog-close"
+            render={
+              <Button
+                variant="ghost"
+                className="absolute top-4 end-4 bg-secondary"
+                size="icon-sm"
+              />
+            }
+          >
+            <XIcon
+            />
+            <span className="sr-only">Close</span>
+          </DialogPrimitive.Close>
+        )}
+      </DialogPrimitive.Popup>
+    </DialogPortal>
+  )
+}
+
+function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="dialog-header"
+      className={cn("flex flex-col gap-1.5", className)}
+      {...props}
+    />
+  )
+}
+
+function DialogFooter({
+  className,
+  showCloseButton = false,
+  children,
+  ...props
+}: React.ComponentProps<"div"> & {
+  showCloseButton?: boolean
+}) {
+  return (
+    <div
+      data-slot="dialog-footer"
+      className={cn(
+        "flex flex-col-reverse gap-2 sm:flex-row sm:justify-end",
+        className
+      )}
+      {...props}
+    >
+      {children}
+      {showCloseButton && (
+        <DialogPrimitive.Close render={<Button variant="outline" />}>
+          Close
+        </DialogPrimitive.Close>
+      )}
+    </div>
+  )
+}
+
+function DialogTitle({ className, ...props }: DialogPrimitive.Title.Props) {
+  return (
+    <DialogPrimitive.Title
+      data-slot="dialog-title"
+      className={cn(
+        "font-heading text-base leading-none font-medium",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function DialogDescription({
+  className,
+  ...props
+}: DialogPrimitive.Description.Props) {
+  return (
+    <DialogPrimitive.Description
+      data-slot="dialog-description"
+      className={cn(
+        "text-sm text-muted-foreground *:[a]:underline *:[a]:underline-offset-3 *:[a]:hover:text-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogOverlay,
+  DialogPortal,
+  DialogTitle,
+  DialogTrigger,
+}
diff --git a/apps/app/src/components/ui/field.tsx b/apps/app/src/components/ui/field.tsx
new file mode 100644
index 0000000000..b2ff343451
--- /dev/null
+++ b/apps/app/src/components/ui/field.tsx
@@ -0,0 +1,236 @@
+import * as React from "react";
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+import { Label } from "@/components/ui/label"
+import { Separator } from "@/components/ui/separator"
+
+function FieldSet({ className, ...props }: React.ComponentProps<"fieldset">) {
+  return (
+    <fieldset
+      data-slot="field-set"
+      className={cn(
+        "flex flex-col gap-6 has-[>[data-slot=checkbox-group]]:gap-3 has-[>[data-slot=radio-group]]:gap-3",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldLegend({
+  className,
+  variant = "legend",
+  ...props
+}: React.ComponentProps<"legend"> & { variant?: "legend" | "label" }) {
+  return (
+    <legend
+      data-slot="field-legend"
+      data-variant={variant}
+      className={cn(
+        "mb-3 font-medium data-[variant=label]:text-sm data-[variant=legend]:text-base",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-group"
+      className={cn(
+        "group/field-group @container/field-group flex w-full flex-col gap-7 data-[slot=checkbox-group]:gap-3 *:data-[slot=field-group]:gap-4",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+const fieldVariants = cva(
+  "group/field flex w-full gap-3 data-[invalid=true]:text-destructive",
+  {
+    variants: {
+      orientation: {
+        vertical: "flex-col *:w-full [&>.sr-only]:w-auto",
+        horizontal:
+          "flex-row items-center has-[>[data-slot=field-content]]:items-start *:data-[slot=field-label]:flex-auto has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
+        responsive:
+          "flex-col *:w-full @md/field-group:flex-row @md/field-group:items-center @md/field-group:*:w-auto @md/field-group:has-[>[data-slot=field-content]]:items-start @md/field-group:*:data-[slot=field-label]:flex-auto [&>.sr-only]:w-auto @md/field-group:has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
+      },
+    },
+    defaultVariants: {
+      orientation: "vertical",
+    },
+  }
+)
+
+function Field({
+  className,
+  orientation = "vertical",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof fieldVariants>) {
+  return (
+    <div
+      role="group"
+      data-slot="field"
+      data-orientation={orientation}
+      className={cn(fieldVariants({ orientation }), className)}
+      {...props}
+    />
+  )
+}
+
+function FieldContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-content"
+      className={cn(
+        "group/field-content flex flex-1 flex-col gap-1 leading-snug",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldLabel({
+  className,
+  ...props
+}: React.ComponentProps<typeof Label>) {
+  return (
+    <Label
+      data-slot="field-label"
+      className={cn(
+        "group/field-label peer/field-label flex w-fit gap-2 leading-snug group-data-[disabled=true]/field:opacity-50 has-data-checked:bg-input/30 has-[>[data-slot=field]]:rounded-2xl has-[>[data-slot=field]]:border *:data-[slot=field]:p-4",
+        "has-[>[data-slot=field]]:w-full has-[>[data-slot=field]]:flex-col",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-label"
+      className={cn(
+        "flex w-fit items-center gap-2 text-sm font-medium group-data-[disabled=true]/field:opacity-50",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldDescription({ className, ...props }: React.ComponentProps<"p">) {
+  return (
+    <p
+      data-slot="field-description"
+      className={cn(
+        "text-start text-sm leading-normal font-normal text-muted-foreground group-has-data-horizontal/field:text-balance [[data-variant=legend]+&]:-mt-1.5",
+        "last:mt-0 nth-last-2:-mt-1",
+        "[&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-primary",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function FieldSeparator({
+  children,
+  className,
+  ...props
+}: React.ComponentProps<"div"> & {
+  children?: React.ReactNode
+}) {
+  return (
+    <div
+      data-slot="field-separator"
+      data-content={!!children}
+      className={cn(
+        "relative -my-2 h-5 text-sm group-data-[variant=outline]/field-group:-mb-2",
+        className
+      )}
+      {...props}
+    >
+      <Separator className="absolute inset-0 top-1/2" />
+      {children && (
+        <span
+          className="relative mx-auto block w-fit bg-background px-2 text-muted-foreground"
+          data-slot="field-separator-content"
+        >
+          {children}
+        </span>
+      )}
+    </div>
+  )
+}
+
+function FieldError({
+  className,
+  children,
+  errors,
+  ...props
+}: React.ComponentProps<"div"> & {
+  errors?: Array<{ message?: string } | undefined>
+}) {
+  const content = React.useMemo(() => {
+    if (children) {
+      return children
+    }
+
+    if (!errors?.length) {
+      return null
+    }
+
+    const uniqueErrors = [
+      ...new Map(errors.map((error) => [error?.message, error])).values(),
+    ]
+
+    if (uniqueErrors?.length == 1) {
+      return uniqueErrors[0]?.message
+    }
+
+    return (
+      <ul className="ms-4 flex list-disc flex-col gap-1">
+        {uniqueErrors.map(
+          (error, index) =>
+            error?.message && <li key={index}>{error.message}</li>
+        )}
+      </ul>
+    )
+  }, [children, errors])
+
+  if (!content) {
+    return null
+  }
+
+  return (
+    <div
+      role="alert"
+      data-slot="field-error"
+      className={cn("text-sm font-normal text-destructive", className)}
+      {...props}
+    >
+      {content}
+    </div>
+  )
+}
+
+export {
+  Field,
+  FieldLabel,
+  FieldDescription,
+  FieldError,
+  FieldGroup,
+  FieldLegend,
+  FieldSeparator,
+  FieldSet,
+  FieldContent,
+  FieldTitle,
+}
diff --git a/apps/app/src/components/ui/input-group.tsx b/apps/app/src/components/ui/input-group.tsx
new file mode 100644
index 0000000000..eb309f6063
--- /dev/null
+++ b/apps/app/src/components/ui/input-group.tsx
@@ -0,0 +1,153 @@
+import * as React from "react";
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Textarea } from "@/components/ui/textarea"
+
+function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="input-group"
+      role="group"
+      className={cn(
+        "group/input-group relative flex h-9 w-full min-w-0 items-center rounded-xl border border-border bg-muted/20 dark:bg-transparent hover:bg-input/40 dark:hover:bg-input/20 transition-[color,box-shadow,background-color] outline-none in-data-[slot=combobox-content]:focus-within:border-inherit in-data-[slot=combobox-content]:focus-within:ring-0 has-data-[align=block-end]:rounded-3xl has-data-[align=block-start]:rounded-xl has-[[data-slot=input-group-control]:focus-visible]:border-ring has-[[data-slot=input-group-control]:focus-visible]:ring-3 has-[[data-slot=input-group-control]:focus-visible]:ring-ring/30 has-[[data-slot][aria-invalid=true]]:border-destructive has-[[data-slot][aria-invalid=true]]:ring-3 has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[textarea]:rounded-xl has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>textarea]:h-auto dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40 has-[>[data-align=block-end]]:[&>input]:pt-3 has-[>[data-align=block-start]]:[&>input]:pb-3 has-[>[data-align=inline-end]]:[&>input]:pe-1.5 has-[>[data-align=inline-start]]:[&>input]:ps-1.5",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+const inputGroupAddonVariants = cva(
+  "flex h-auto cursor-text items-center justify-center gap-2 py-2 text-sm font-medium text-muted-foreground select-none group-data-[disabled=true]/input-group:opacity-50 **:data-[slot=kbd]:rounded-3xl **:data-[slot=kbd]:bg-muted-foreground/10 **:data-[slot=kbd]:px-1.5 [&>svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      align: {
+        "inline-start": "order-first ps-3 has-[>button]:-ms-1 has-[>kbd]:-ms-1",
+        "inline-end": "order-last pe-3 has-[>button]:-me-1 has-[>kbd]:-me-1",
+        "block-start":
+          "order-first w-full justify-start px-3 pt-3 group-has-[>input]/input-group:pt-3.5 [.border-b]:pb-3.5",
+        "block-end":
+          "order-last w-full justify-start px-3 pb-3 group-has-[>input]/input-group:pb-3.5 [.border-t]:pt-3.5",
+      },
+    },
+    defaultVariants: {
+      align: "inline-start",
+    },
+  }
+)
+
+function InputGroupAddon({
+  className,
+  align = "inline-start",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof inputGroupAddonVariants>) {
+  return (
+    <div
+      role="group"
+      data-slot="input-group-addon"
+      data-align={align}
+      className={cn(inputGroupAddonVariants({ align }), className)}
+      onClick={(e) => {
+        if ((e.target as HTMLElement).closest("button")) {
+          return
+        }
+        e.currentTarget.parentElement?.querySelector("input")?.focus()
+      }}
+      {...props}
+    />
+  )
+}
+
+const inputGroupButtonVariants = cva(
+  "flex items-center gap-2 rounded-4xl text-sm shadow-none",
+  {
+    variants: {
+      size: {
+        xs: "h-6 gap-1 rounded-xl px-1.5 [&>svg:not([class*='size-'])]:size-3.5",
+        sm: "",
+        "icon-xs": "size-6 rounded-xl p-0 has-[>svg]:p-0",
+        "icon-sm": "size-8 p-0 has-[>svg]:p-0",
+      },
+    },
+    defaultVariants: {
+      size: "xs",
+    },
+  }
+)
+
+function InputGroupButton({
+  className,
+  type = "button",
+  variant = "ghost",
+  size = "xs",
+  ...props
+}: Omit<React.ComponentProps<typeof Button>, "size" | "type"> &
+  VariantProps<typeof inputGroupButtonVariants> & {
+    type?: "button" | "submit" | "reset"
+  }) {
+  return (
+    <Button
+      type={type}
+      data-size={size}
+      variant={variant}
+      className={cn(inputGroupButtonVariants({ size }), className)}
+      {...props}
+    />
+  )
+}
+
+function InputGroupText({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      className={cn(
+        "flex items-center gap-2 text-sm text-muted-foreground [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function InputGroupInput({
+  className,
+  ...props
+}: React.ComponentProps<"input">) {
+  return (
+    <Input
+      data-slot="input-group-control"
+      className={cn(
+        "flex-1 rounded-none border-0 bg-transparent shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function InputGroupTextarea({
+  className,
+  ...props
+}: React.ComponentProps<"textarea">) {
+  return (
+    <Textarea
+      data-slot="input-group-control"
+      className={cn(
+        "flex-1 resize-none rounded-none border-0 bg-transparent py-2.5 shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupButton,
+  InputGroupText,
+  InputGroupInput,
+  InputGroupTextarea,
+}
diff --git a/apps/app/src/components/ui/input.tsx b/apps/app/src/components/ui/input.tsx
new file mode 100644
index 0000000000..5477e9dec4
--- /dev/null
+++ b/apps/app/src/components/ui/input.tsx
@@ -0,0 +1,20 @@
+import * as React from "react";
+import { Input as InputPrimitive } from "@base-ui/react/input"
+
+import { cn } from "@/lib/utils"
+
+function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+  return (
+    <InputPrimitive
+      type={type}
+      data-slot="input"
+      className={cn(
+        "h-9 w-full min-w-0 rounded-lg border border-transparent bg-input/50 px-3 py-1 text-base transition-[color,box-shadow,background-color] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/30 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 md:text-sm dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Input }
diff --git a/apps/app/src/components/ui/label.tsx b/apps/app/src/components/ui/label.tsx
new file mode 100644
index 0000000000..e1380df936
--- /dev/null
+++ b/apps/app/src/components/ui/label.tsx
@@ -0,0 +1,18 @@
+import * as React from "react";
+
+import { cn } from "@/lib/utils"
+
+function Label({ className, ...props }: React.ComponentProps<"label">) {
+  return (
+    <label
+      data-slot="label"
+      className={cn(
+        "flex items-center gap-2 text-sm leading-none font-medium select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Label }
diff --git a/apps/app/src/components/ui/popover.tsx b/apps/app/src/components/ui/popover.tsx
new file mode 100644
index 0000000000..822ad391ff
--- /dev/null
+++ b/apps/app/src/components/ui/popover.tsx
@@ -0,0 +1,88 @@
+import * as React from "react";
+import { Popover as PopoverPrimitive } from "@base-ui/react/popover"
+
+import { cn } from "@/lib/utils"
+
+function Popover({ ...props }: PopoverPrimitive.Root.Props) {
+  return <PopoverPrimitive.Root data-slot="popover" {...props} />
+}
+
+function PopoverTrigger({ ...props }: PopoverPrimitive.Trigger.Props) {
+  return <PopoverPrimitive.Trigger data-slot="popover-trigger" {...props} />
+}
+
+function PopoverContent({
+  className,
+  align = "center",
+  alignOffset = 0,
+  side = "bottom",
+  sideOffset = 4,
+  ...props
+}: PopoverPrimitive.Popup.Props &
+  Pick<
+    PopoverPrimitive.Positioner.Props,
+    "align" | "alignOffset" | "side" | "sideOffset"
+  >) {
+  return (
+    <PopoverPrimitive.Portal>
+      <PopoverPrimitive.Positioner
+        align={align}
+        alignOffset={alignOffset}
+        side={side}
+        sideOffset={sideOffset}
+        className="isolate z-50"
+      >
+        <PopoverPrimitive.Popup
+          data-slot="popover-content"
+          className={cn(
+            "z-50 flex w-72 origin-(--transform-origin) flex-col gap-4 rounded-3xl bg-popover p-4 text-sm text-popover-foreground shadow-lg ring-1 ring-foreground/5 outline-hidden duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=inline-end]:slide-in-from-start-2 data-[side=inline-start]:slide-in-from-end-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 dark:ring-foreground/10 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+            className
+          )}
+          {...props}
+        />
+      </PopoverPrimitive.Positioner>
+    </PopoverPrimitive.Portal>
+  )
+}
+
+function PopoverHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="popover-header"
+      className={cn("flex flex-col gap-1 text-sm", className)}
+      {...props}
+    />
+  )
+}
+
+function PopoverTitle({ className, ...props }: PopoverPrimitive.Title.Props) {
+  return (
+    <PopoverPrimitive.Title
+      data-slot="popover-title"
+      className={cn("text-base font-medium", className)}
+      {...props}
+    />
+  )
+}
+
+function PopoverDescription({
+  className,
+  ...props
+}: PopoverPrimitive.Description.Props) {
+  return (
+    <PopoverPrimitive.Description
+      data-slot="popover-description"
+      className={cn("text-muted-foreground", className)}
+      {...props}
+    />
+  )
+}
+
+export {
+  Popover,
+  PopoverContent,
+  PopoverDescription,
+  PopoverHeader,
+  PopoverTitle,
+  PopoverTrigger,
+}
diff --git a/apps/app/src/components/ui/select.tsx b/apps/app/src/components/ui/select.tsx
new file mode 100644
index 0000000000..4e812e1491
--- /dev/null
+++ b/apps/app/src/components/ui/select.tsx
@@ -0,0 +1,205 @@
+import * as React from "react";
+import { Select as SelectPrimitive } from "@base-ui/react/select"
+
+import { cn } from "@/lib/utils"
+import { ChevronDownIcon, CheckIcon, ChevronUpIcon } from "lucide-react"
+
+const Select = SelectPrimitive.Root
+
+function SelectGroup({ className, ...props }: SelectPrimitive.Group.Props) {
+  return (
+    <SelectPrimitive.Group
+      data-slot="select-group"
+      className={cn("scroll-my-1.5 p-1.5", className)}
+      {...props}
+    />
+  )
+}
+
+function SelectValue({ className, ...props }: SelectPrimitive.Value.Props) {
+  return (
+    <SelectPrimitive.Value
+      data-slot="select-value"
+      className={cn("flex flex-1 text-start", className)}
+      {...props}
+    />
+  )
+}
+
+function SelectTrigger({
+  className,
+  size = "default",
+  children,
+  ...props
+}: SelectPrimitive.Trigger.Props & {
+  size?: "sm" | "default"
+}) {
+  return (
+    <SelectPrimitive.Trigger
+      data-slot="select-trigger"
+      data-size={size}
+      className={cn(
+        "flex w-fit items-center justify-between gap-1.5 rounded-3xl border border-border bg-input/50 px-3 py-2 text-sm whitespace-nowrap transition-[color,box-shadow,background-color] outline-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/30 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-placeholder:text-muted-foreground data-[size=default]:h-9 data-[size=sm]:h-8 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-1.5 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    >
+      {children}
+      <SelectPrimitive.Icon
+        render={
+          <ChevronDownIcon className="pointer-events-none size-4 text-muted-foreground" />
+        }
+      />
+    </SelectPrimitive.Trigger>
+  )
+}
+
+function SelectContent({
+  className,
+  children,
+  side = "bottom",
+  sideOffset = 4,
+  align = "center",
+  alignOffset = 0,
+  alignItemWithTrigger = false,
+  ...props
+}: SelectPrimitive.Popup.Props &
+  Pick<
+    SelectPrimitive.Positioner.Props,
+    "align" | "alignOffset" | "side" | "sideOffset" | "alignItemWithTrigger"
+  >) {
+  return (
+    <SelectPrimitive.Portal>
+      <SelectPrimitive.Positioner
+        side={side}
+        sideOffset={sideOffset}
+        align={align}
+        alignOffset={alignOffset}
+        alignItemWithTrigger={alignItemWithTrigger}
+        className="isolate z-50"
+      >
+        <SelectPrimitive.Popup
+          data-slot="select-content"
+          data-align-trigger={alignItemWithTrigger}
+          className={cn(
+                                            "dark isolate z-50 max-h-(--available-height) w-(--anchor-width) min-w-36 origin-(--transform-origin) overflow-x-hidden overflow-y-auto rounded-3xl text-popover-foreground shadow-lg ring-1 ring-foreground/5 duration-100 data-[align-trigger=true]:animate-none data-[side=bottom]:slide-in-from-top-2 data-[side=inline-end]:slide-in-from-start-2 data-[side=inline-start]:slide-in-from-end-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 dark:ring-foreground/10 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95 animate-none! relative bg-popover/70 before:pointer-events-none before:absolute before:inset-0 before:-z-1 before:rounded-[inherit] before:backdrop-blur-2xl before:backdrop-saturate-150 **:data-[slot$=-item]:focus:bg-foreground/10 **:data-[slot$=-item]:data-highlighted:bg-foreground/10 **:data-[slot$=-separator]:bg-foreground/5 **:data-[slot$=-trigger]:focus:bg-foreground/10 **:data-[slot$=-trigger]:aria-expanded:bg-foreground/10! **:data-[variant=destructive]:focus:bg-foreground/10! **:data-[variant=destructive]:text-accent-foreground! **:data-[variant=destructive]:**:text-accent-foreground!",
+                                            className
+                                          )}
+          {...props}
+        >
+          <SelectScrollUpButton />
+          <SelectPrimitive.List>{children}</SelectPrimitive.List>
+          <SelectScrollDownButton />
+        </SelectPrimitive.Popup>
+      </SelectPrimitive.Positioner>
+    </SelectPrimitive.Portal>
+  )
+}
+
+function SelectLabel({
+  className,
+  ...props
+}: SelectPrimitive.GroupLabel.Props) {
+  return (
+    <SelectPrimitive.GroupLabel
+      data-slot="select-label"
+      className={cn("px-3 py-2.5 text-xs text-muted-foreground", className)}
+      {...props}
+    />
+  )
+}
+
+function SelectItem({
+  className,
+  children,
+  ...props
+}: SelectPrimitive.Item.Props) {
+  return (
+    <SelectPrimitive.Item
+      data-slot="select-item"
+      className={cn(
+        "relative flex w-full cursor-default items-center gap-2.5 rounded-2xl py-2 pe-8 ps-3 text-sm font-medium outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
+        className
+      )}
+      {...props}
+    >
+      <SelectPrimitive.ItemText className="flex flex-1 shrink-0 gap-2 whitespace-nowrap">
+        {children}
+      </SelectPrimitive.ItemText>
+      <SelectPrimitive.ItemIndicator
+        render={
+          <span className="pointer-events-none absolute end-2 flex size-4 items-center justify-center" />
+        }
+      >
+        <CheckIcon className="pointer-events-none" />
+      </SelectPrimitive.ItemIndicator>
+    </SelectPrimitive.Item>
+  )
+}
+
+function SelectSeparator({
+  className,
+  ...props
+}: SelectPrimitive.Separator.Props) {
+  return (
+    <SelectPrimitive.Separator
+      data-slot="select-separator"
+      className={cn(
+        "pointer-events-none -mx-1.5 my-1.5 h-px bg-border",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SelectScrollUpButton({
+  className,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.ScrollUpArrow>) {
+  return (
+    <SelectPrimitive.ScrollUpArrow
+      data-slot="select-scroll-up-button"
+      className={cn(
+        "top-0 z-10 flex w-full cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    >
+      <ChevronUpIcon
+      />
+    </SelectPrimitive.ScrollUpArrow>
+  )
+}
+
+function SelectScrollDownButton({
+  className,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.ScrollDownArrow>) {
+  return (
+    <SelectPrimitive.ScrollDownArrow
+      data-slot="select-scroll-down-button"
+      className={cn(
+        "bottom-0 z-10 flex w-full cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    >
+      <ChevronDownIcon
+      />
+    </SelectPrimitive.ScrollDownArrow>
+  )
+}
+
+export {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectLabel,
+  SelectScrollDownButton,
+  SelectScrollUpButton,
+  SelectSeparator,
+  SelectTrigger,
+  SelectValue,
+}
diff --git a/apps/app/src/components/ui/separator.tsx b/apps/app/src/components/ui/separator.tsx
new file mode 100644
index 0000000000..4f65961bb7
--- /dev/null
+++ b/apps/app/src/components/ui/separator.tsx
@@ -0,0 +1,23 @@
+import { Separator as SeparatorPrimitive } from "@base-ui/react/separator"
+
+import { cn } from "@/lib/utils"
+
+function Separator({
+  className,
+  orientation = "horizontal",
+  ...props
+}: SeparatorPrimitive.Props) {
+  return (
+    <SeparatorPrimitive
+      data-slot="separator"
+      orientation={orientation}
+      className={cn(
+        "shrink-0 bg-border data-horizontal:h-px data-horizontal:w-full data-vertical:w-px data-vertical:self-stretch",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Separator }
diff --git a/apps/app/src/components/ui/sheet.tsx b/apps/app/src/components/ui/sheet.tsx
new file mode 100644
index 0000000000..4b789f1a56
--- /dev/null
+++ b/apps/app/src/components/ui/sheet.tsx
@@ -0,0 +1,136 @@
+import * as React from "react";
+import { Dialog as SheetPrimitive } from "@base-ui/react/dialog"
+
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+import { XIcon } from "lucide-react"
+
+function Sheet({ ...props }: SheetPrimitive.Root.Props) {
+  return <SheetPrimitive.Root data-slot="sheet" {...props} />
+}
+
+function SheetTrigger({ ...props }: SheetPrimitive.Trigger.Props) {
+  return <SheetPrimitive.Trigger data-slot="sheet-trigger" {...props} />
+}
+
+function SheetClose({ ...props }: SheetPrimitive.Close.Props) {
+  return <SheetPrimitive.Close data-slot="sheet-close" {...props} />
+}
+
+function SheetPortal({ ...props }: SheetPrimitive.Portal.Props) {
+  return <SheetPrimitive.Portal data-slot="sheet-portal" {...props} />
+}
+
+function SheetOverlay({ className, ...props }: SheetPrimitive.Backdrop.Props) {
+  return (
+    <SheetPrimitive.Backdrop
+      data-slot="sheet-overlay"
+      className={cn(
+        "fixed inset-0 z-50 bg-black/30 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-sm",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SheetContent({
+  className,
+  children,
+  side = "right",
+  showCloseButton = true,
+  ...props
+}: SheetPrimitive.Popup.Props & {
+  side?: "top" | "right" | "bottom" | "left"
+  showCloseButton?: boolean
+}) {
+  return (
+    <SheetPortal>
+      <SheetOverlay />
+      <SheetPrimitive.Popup
+        data-slot="sheet-content"
+        data-side={side}
+        className={cn(
+          "fixed z-50 flex flex-col bg-popover bg-clip-padding text-sm text-popover-foreground shadow-xl transition duration-200 ease-in-out data-ending-style:opacity-0 data-starting-style:opacity-0 data-[side=bottom]:inset-x-0 data-[side=bottom]:bottom-0 data-[side=bottom]:h-auto data-[side=bottom]:border-t data-[side=bottom]:data-ending-style:translate-y-[2.5rem] data-[side=bottom]:data-starting-style:translate-y-[2.5rem] data-[side=left]:inset-y-0 data-[side=left]:left-0 data-[side=left]:h-full data-[side=left]:w-3/4 data-[side=left]:border-e data-[side=left]:data-ending-style:translate-x-[-2.5rem] rtl:data-[side=left]:data-ending-style:-translate-x-[-2.5rem] data-[side=left]:data-starting-style:translate-x-[-2.5rem] rtl:data-[side=left]:data-starting-style:-translate-x-[-2.5rem] data-[side=right]:inset-y-0 data-[side=right]:right-0 data-[side=right]:h-full data-[side=right]:w-3/4 data-[side=right]:border-s data-[side=right]:data-ending-style:translate-x-[2.5rem] rtl:data-[side=right]:data-ending-style:-translate-x-[2.5rem] data-[side=right]:data-starting-style:translate-x-[2.5rem] rtl:data-[side=right]:data-starting-style:-translate-x-[2.5rem] data-[side=top]:inset-x-0 data-[side=top]:top-0 data-[side=top]:h-auto data-[side=top]:border-b data-[side=top]:data-ending-style:translate-y-[-2.5rem] data-[side=top]:data-starting-style:translate-y-[-2.5rem] data-[side=left]:sm:max-w-sm data-[side=right]:sm:max-w-sm",
+          className
+        )}
+        {...props}
+      >
+        {children}
+        {showCloseButton && (
+          <SheetPrimitive.Close
+            data-slot="sheet-close"
+            render={
+              <Button
+                variant="ghost"
+                className="absolute top-4 end-4 bg-secondary"
+                size="icon-sm"
+              />
+            }
+          >
+            <XIcon
+            />
+            <span className="sr-only">Close</span>
+          </SheetPrimitive.Close>
+        )}
+      </SheetPrimitive.Popup>
+    </SheetPortal>
+  )
+}
+
+function SheetHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sheet-header"
+      className={cn("flex flex-col gap-1.5 p-6", className)}
+      {...props}
+    />
+  )
+}
+
+function SheetFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sheet-footer"
+      className={cn("mt-auto flex flex-col gap-2 p-6", className)}
+      {...props}
+    />
+  )
+}
+
+function SheetTitle({ className, ...props }: SheetPrimitive.Title.Props) {
+  return (
+    <SheetPrimitive.Title
+      data-slot="sheet-title"
+      className={cn(
+        "font-heading text-base font-medium text-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SheetDescription({
+  className,
+  ...props
+}: SheetPrimitive.Description.Props) {
+  return (
+    <SheetPrimitive.Description
+      data-slot="sheet-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  )
+}
+
+export {
+  Sheet,
+  SheetTrigger,
+  SheetClose,
+  SheetContent,
+  SheetHeader,
+  SheetFooter,
+  SheetTitle,
+  SheetDescription,
+}
diff --git a/apps/app/src/components/ui/sidebar.tsx b/apps/app/src/components/ui/sidebar.tsx
new file mode 100644
index 0000000000..baf7e46a90
--- /dev/null
+++ b/apps/app/src/components/ui/sidebar.tsx
@@ -0,0 +1,715 @@
+"use client"
+
+import * as React from "react";
+import { mergeProps } from "@base-ui/react/merge-props"
+import { useRender } from "@base-ui/react/use-render"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { useIsMobile } from "@/hooks/use-mobile"
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Separator } from "@/components/ui/separator"
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle,
+} from "@/components/ui/sheet"
+import { Skeleton } from "@/components/ui/skeleton"
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip"
+import { PanelLeftIcon } from "lucide-react"
+
+const SIDEBAR_COOKIE_NAME = "sidebar_state"
+const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7
+const SIDEBAR_WIDTH = "16rem"
+const SIDEBAR_WIDTH_MOBILE = "18rem"
+const SIDEBAR_WIDTH_ICON = "3rem"
+const SIDEBAR_KEYBOARD_SHORTCUT = "b"
+
+type SidebarContextProps = {
+  state: "expanded" | "collapsed"
+  open: boolean
+  setOpen: (open: boolean) => void
+  openMobile: boolean
+  setOpenMobile: (open: boolean) => void
+  isMobile: boolean
+  toggleSidebar: () => void
+}
+
+const SidebarContext = React.createContext<SidebarContextProps | null>(null)
+
+function useSidebar() {
+  const context = React.useContext(SidebarContext)
+  if (!context) {
+    throw new Error("useSidebar must be used within a SidebarProvider.")
+  }
+
+  return context
+}
+
+function SidebarProvider({
+  defaultOpen = true,
+  open: openProp,
+  onOpenChange: setOpenProp,
+  className,
+  style,
+  children,
+  ...props
+}: React.ComponentProps<"div"> & {
+  defaultOpen?: boolean
+  open?: boolean
+  onOpenChange?: (open: boolean) => void
+}) {
+  const isMobile = useIsMobile()
+  const [openMobile, setOpenMobile] = React.useState(false)
+
+  // This is the internal state of the sidebar.
+  // We use openProp and setOpenProp for control from outside the component.
+  const [_open, _setOpen] = React.useState(defaultOpen)
+  const open = openProp ?? _open
+  const setOpen = React.useCallback(
+    (value: boolean | ((value: boolean) => boolean)) => {
+      const openState = typeof value === "function" ? value(open) : value
+      if (setOpenProp) {
+        setOpenProp(openState)
+      } else {
+        _setOpen(openState)
+      }
+
+      // This sets the cookie to keep the sidebar state.
+      document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`
+    },
+    [setOpenProp, open]
+  )
+
+  // Helper to toggle the sidebar.
+  const toggleSidebar = React.useCallback(() => {
+    return isMobile ? setOpenMobile((open) => !open) : setOpen((open) => !open)
+  }, [isMobile, setOpen, setOpenMobile])
+
+  // Adds a keyboard shortcut to toggle the sidebar.
+  React.useEffect(() => {
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (
+        event.key === SIDEBAR_KEYBOARD_SHORTCUT &&
+        (event.metaKey || event.ctrlKey)
+      ) {
+        event.preventDefault()
+        toggleSidebar()
+      }
+    }
+
+    window.addEventListener("keydown", handleKeyDown)
+    return () => window.removeEventListener("keydown", handleKeyDown)
+  }, [toggleSidebar])
+
+  // We add a state so that we can do data-state="expanded" or "collapsed".
+  // This makes it easier to style the sidebar with Tailwind classes.
+  const state = open ? "expanded" : "collapsed"
+
+  const contextValue = React.useMemo<SidebarContextProps>(
+    () => ({
+      state,
+      open,
+      setOpen,
+      isMobile,
+      openMobile,
+      setOpenMobile,
+      toggleSidebar,
+    }),
+    [state, open, setOpen, isMobile, openMobile, setOpenMobile, toggleSidebar]
+  )
+
+  return (
+    <SidebarContext.Provider value={contextValue}>
+      <div
+        data-slot="sidebar-wrapper"
+        style={
+          {
+            "--sidebar-width": SIDEBAR_WIDTH,
+            "--sidebar-width-icon": SIDEBAR_WIDTH_ICON,
+            ...style,
+          } as React.CSSProperties
+        }
+        className={cn(
+          "group/sidebar-wrapper flex min-h-svh w-full has-data-[variant=inset]:bg-sidebar",
+          className
+        )}
+        {...props}
+      >
+        {children}
+      </div>
+    </SidebarContext.Provider>
+  )
+}
+
+function Sidebar({
+  side = "left",
+  variant = "sidebar",
+  collapsible = "offcanvas",
+  className,
+  children,
+  dir,
+  ...props
+}: React.ComponentProps<"div"> & {
+  side?: "left" | "right"
+  variant?: "sidebar" | "floating" | "inset"
+  collapsible?: "offcanvas" | "icon" | "none"
+}) {
+  const { isMobile, state, openMobile, setOpenMobile } = useSidebar()
+
+  if (isMobile && collapsible !== "none") {
+    return (
+      <Sheet open={openMobile} onOpenChange={setOpenMobile} {...props}>
+        <SheetContent
+          dir={dir}
+          data-sidebar="sidebar"
+          data-slot="sidebar"
+          data-mobile="true"
+          className="w-(--sidebar-width) bg-sidebar p-0 text-sidebar-foreground [&>button]:hidden"
+          style={
+            {
+              "--sidebar-width": SIDEBAR_WIDTH_MOBILE,
+            } as React.CSSProperties
+          }
+          side={side}
+        >
+          <SheetHeader className="sr-only">
+            <SheetTitle>Sidebar</SheetTitle>
+            <SheetDescription>Displays the mobile sidebar.</SheetDescription>
+          </SheetHeader>
+          <div className="flex h-full w-full flex-col">{children}</div>
+        </SheetContent>
+      </Sheet>
+    )
+  }
+
+  return (
+    <div
+      className={cn(
+        "group peer text-sidebar-foreground",
+        collapsible === "none" ? "block" : "hidden md:block"
+      )}
+      data-state={state}
+      data-collapsible={state === "collapsed" ? collapsible : ""}
+      data-variant={variant}
+      data-side={side}
+      data-slot="sidebar"
+    >
+      {/* This is what handles the sidebar gap on desktop */}
+      <div
+        data-slot="sidebar-gap"
+        className={cn(
+          "relative w-(--sidebar-width) bg-transparent transition-[width] duration-200 ease-linear",
+          "group-data-[collapsible=offcanvas]:w-0",
+          "group-data-[side=right]:rotate-180",
+          variant === "floating" || variant === "inset"
+            ? "group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4)))]"
+            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon)"
+        )}
+      />
+      <div
+        data-slot="sidebar-container"
+        data-side={side}
+        className={cn(
+          "fixed inset-y-0 z-10 h-svh w-(--sidebar-width) transition-[left,right,width] duration-200 ease-linear data-[side=left]:left-0 data-[side=left]:group-data-[collapsible=offcanvas]:left-[calc(var(--sidebar-width)*-1)] data-[side=right]:right-0 data-[side=right]:group-data-[collapsible=offcanvas]:right-[calc(var(--sidebar-width)*-1)] md:flex",
+          collapsible === "none" && "flex",
+          // Adjust the padding for floating and inset variants.
+          variant === "floating" || variant === "inset"
+            ? "p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4))+2px)]"
+            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon) group-data-[side=left]:border-e group-data-[side=right]:border-s",
+          className
+        )}
+        {...props}
+      >
+        <div
+          data-sidebar="sidebar"
+          data-slot="sidebar-inner"
+          className="flex size-full flex-col bg-sidebar group-data-[variant=floating]:rounded-2xl group-data-[variant=floating]:shadow-sm group-data-[variant=floating]:ring-1 group-data-[variant=floating]:ring-sidebar-border"
+        >
+          {children}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function SidebarTrigger({
+  className,
+  onClick,
+  ...props
+}: React.ComponentProps<typeof Button>) {
+  const { toggleSidebar } = useSidebar()
+
+  return (
+    <Button
+      data-sidebar="trigger"
+      data-slot="sidebar-trigger"
+      variant="ghost"
+      size="icon-sm"
+      className={cn(className)}
+      onClick={(event) => {
+        onClick?.(event)
+        toggleSidebar()
+      }}
+      {...props}
+    >
+      <PanelLeftIcon className="rtl:rotate-180 size-3.5" />
+      <span className="sr-only">Toggle Sidebar</span>
+    </Button>
+  )
+}
+
+function SidebarRail({ className, ...props }: React.ComponentProps<"button">) {
+  const { toggleSidebar } = useSidebar()
+
+  return (
+    <button
+      data-sidebar="rail"
+      data-slot="sidebar-rail"
+      aria-label="Toggle Sidebar"
+      tabIndex={-1}
+      onClick={toggleSidebar}
+      title="Toggle Sidebar"
+      className={cn(
+        "absolute inset-y-0 z-20 hidden w-4 transition-all ease-linear group-data-[side=left]:-right-4 group-data-[side=right]:left-0 after:absolute after:inset-y-0 after:start-1/2 after:w-[2px] hover:after:bg-sidebar-border sm:flex ltr:-translate-x-1/2 rtl:-translate-x-1/2",
+        "in-data-[side=left]:cursor-w-resize rtl:in-data-[side=left]:cursor-e-resize in-data-[side=right]:cursor-e-resize rtl:in-data-[side=right]:cursor-w-resize",
+        "[[data-side=left][data-state=collapsed]_&]:cursor-e-resize rtl:[[data-side=left][data-state=collapsed]_&]:cursor-w-resize [[data-side=right][data-state=collapsed]_&]:cursor-w-resize rtl:[[data-side=right][data-state=collapsed]_&]:cursor-e-resize",
+        "group-data-[collapsible=offcanvas]:translate-x-0 rtl:group-data-[collapsible=offcanvas]:-translate-x-0 group-data-[collapsible=offcanvas]:after:start-full hover:group-data-[collapsible=offcanvas]:bg-sidebar",
+        "[[data-side=left][data-collapsible=offcanvas]_&]:-end-2",
+        "[[data-side=right][data-collapsible=offcanvas]_&]:-start-2",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarInset({ className, ...props }: React.ComponentProps<"main">) {
+  return (
+    <main
+      data-slot="sidebar-inset"
+      className={cn(
+        "relative flex w-full flex-1 flex-col bg-background md:peer-data-[variant=inset]:m-2 md:peer-data-[variant=inset]:ms-0 md:peer-data-[variant=inset]:rounded-2xl md:peer-data-[variant=inset]:shadow-sm md:peer-data-[variant=inset]:peer-data-[state=collapsed]:ms-2",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarInput({
+  className,
+  ...props
+}: React.ComponentProps<typeof Input>) {
+  return (
+    <Input
+      data-slot="sidebar-input"
+      data-sidebar="input"
+      className={cn("h-8 w-full bg-input/50 shadow-none", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-header"
+      data-sidebar="header"
+      className={cn(
+        "flex flex-col gap-2 p-2 [--radius:var(--radius-xl)]",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-footer"
+      data-sidebar="footer"
+      className={cn("flex flex-col gap-2 p-2", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof Separator>) {
+  return (
+    <Separator
+      data-slot="sidebar-separator"
+      data-sidebar="separator"
+      className={cn("mx-2 w-auto bg-sidebar-border", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-content"
+      data-sidebar="content"
+      className={cn(
+        "no-scrollbar flex min-h-0 flex-1 flex-col gap-2 overflow-auto [--radius:var(--radius-xl)] group-data-[collapsible=icon]:overflow-hidden",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-group"
+      data-sidebar="group"
+      className={cn("relative flex w-full min-w-0 flex-col p-2", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarGroupLabel({
+  className,
+  render,
+  ...props
+}: useRender.ComponentProps<"div"> & React.ComponentProps<"div">) {
+  return useRender({
+    defaultTagName: "div",
+    props: mergeProps<"div">(
+      {
+        className: cn(
+          "flex h-8 shrink-0 items-center rounded-xl px-3 text-xs font-medium text-sidebar-foreground/70 ring-sidebar-ring outline-hidden transition-[margin,opacity] duration-200 ease-linear group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0 focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
+          className
+        ),
+      },
+      props
+    ),
+    render,
+    state: {
+      slot: "sidebar-group-label",
+      sidebar: "group-label",
+    },
+  })
+}
+
+function SidebarGroupAction({
+  className,
+  render,
+  ...props
+}: useRender.ComponentProps<"button"> & React.ComponentProps<"button">) {
+  return useRender({
+    defaultTagName: "button",
+    props: mergeProps<"button">(
+      {
+        className: cn(
+          "absolute top-3.5 end-3 flex aspect-square w-5 items-center justify-center rounded-xl p-0 text-sidebar-foreground ring-sidebar-ring outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 md:after:hidden [&>svg]:size-4 [&>svg]:shrink-0",
+          className
+        ),
+      },
+      props
+    ),
+    render,
+    state: {
+      slot: "sidebar-group-action",
+      sidebar: "group-action",
+    },
+  })
+}
+
+function SidebarGroupContent({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-group-content"
+      data-sidebar="group-content"
+      className={cn("w-full text-sm", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarMenu({ className, ...props }: React.ComponentProps<"ul">) {
+  return (
+    <ul
+      data-slot="sidebar-menu"
+      data-sidebar="menu"
+      className={cn("flex w-full min-w-0 flex-col gap-0.5", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarMenuItem({ className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="sidebar-menu-item"
+      data-sidebar="menu-item"
+      className={cn("group/menu-item relative", className)}
+      {...props}
+    />
+  )
+}
+
+const sidebarMenuButtonVariants = cva(
+  "peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-xl px-3 py-2 text-start text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pe-8 group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:font-medium data-active:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
+  {
+    variants: {
+      variant: {
+        default: "hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
+        outline:
+          "bg-background shadow-[0_0_0_1px_hsl(var(--sidebar-border))] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground hover:shadow-[0_0_0_1px_hsl(var(--sidebar-accent))]",
+      },
+      size: {
+        default: "h-9 text-sm",
+        sm: "h-8 text-xs",
+        lg: "h-14 px-3 text-sm group-data-[collapsible=icon]:p-0!",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+function SidebarMenuButton({
+  render,
+  isActive = false,
+  variant = "default",
+  size = "default",
+  tooltip,
+  className,
+  ...props
+}: useRender.ComponentProps<"button"> &
+  React.ComponentProps<"button"> & {
+    isActive?: boolean
+    tooltip?: string | React.ComponentProps<typeof TooltipContent>
+  } & VariantProps<typeof sidebarMenuButtonVariants>) {
+  const { isMobile, state } = useSidebar()
+  const comp = useRender({
+    defaultTagName: "button",
+    props: mergeProps<"button">(
+      {
+        className: cn(sidebarMenuButtonVariants({ variant, size }), className),
+      },
+      props
+    ),
+    render: !tooltip ? render : <TooltipTrigger render={render} />,
+    state: {
+      slot: "sidebar-menu-button",
+      sidebar: "menu-button",
+      size,
+      active: isActive,
+    },
+  })
+
+  if (!tooltip) {
+    return comp
+  }
+
+  if (typeof tooltip === "string") {
+    tooltip = {
+      children: tooltip,
+    }
+  }
+
+  return (
+    <Tooltip>
+      {comp}
+      <TooltipContent
+        side="right"
+        align="center"
+        hidden={state !== "collapsed" || isMobile}
+        {...tooltip}
+      />
+    </Tooltip>
+  )
+}
+
+function SidebarMenuAction({
+  className,
+  render,
+  showOnHover = false,
+  ...props
+}: useRender.ComponentProps<"button"> &
+  React.ComponentProps<"button"> & {
+    showOnHover?: boolean
+  }) {
+  return useRender({
+    defaultTagName: "button",
+    props: mergeProps<"button">(
+      {
+        className: cn(
+          "absolute top-1.5 end-1 flex aspect-square w-5 items-center justify-center rounded-xl p-0 text-sidebar-foreground ring-sidebar-ring outline-hidden transition-transform group-data-[collapsible=icon]:hidden peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[size=default]/menu-button:top-2 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 after:absolute after:-inset-2 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 md:after:hidden [&>svg]:size-4 [&>svg]:shrink-0",
+          showOnHover &&
+            "group-focus-within/menu-item:opacity-100 group-hover/menu-item:opacity-100 peer-data-active/menu-button:text-sidebar-accent-foreground aria-expanded:opacity-100 md:opacity-0",
+          className
+        ),
+      },
+      props
+    ),
+    render,
+    state: {
+      slot: "sidebar-menu-action",
+      sidebar: "menu-action",
+    },
+  })
+}
+
+function SidebarMenuBadge({
+  className,
+  ...props
+}: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-menu-badge"
+      data-sidebar="menu-badge"
+      className={cn(
+        "pointer-events-none absolute end-1 flex h-5 min-w-5 items-center justify-center rounded-xl px-1 text-xs font-medium text-sidebar-foreground tabular-nums select-none group-data-[collapsible=icon]:hidden peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[size=default]/menu-button:top-1.5 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 peer-data-active/menu-button:text-sidebar-accent-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarMenuSkeleton({
+  className,
+  showIcon = false,
+  ...props
+}: React.ComponentProps<"div"> & {
+  showIcon?: boolean
+}) {
+  // Random width between 50 to 90%.
+  const [width] = React.useState(() => {
+    return `${Math.floor(Math.random() * 40) + 50}%`
+  })
+
+  return (
+    <div
+      data-slot="sidebar-menu-skeleton"
+      data-sidebar="menu-skeleton"
+      className={cn("flex h-8 items-center gap-2 rounded-xl px-2", className)}
+      {...props}
+    >
+      {showIcon && (
+        <Skeleton
+          className="size-4 rounded-xl"
+          data-sidebar="menu-skeleton-icon"
+        />
+      )}
+      <Skeleton
+        className="h-4 max-w-(--skeleton-width) flex-1"
+        data-sidebar="menu-skeleton-text"
+        style={
+          {
+            "--skeleton-width": width,
+          } as React.CSSProperties
+        }
+      />
+    </div>
+  )
+}
+
+function SidebarMenuSub({ className, ...props }: React.ComponentProps<"ul">) {
+  return (
+    <ul
+      data-slot="sidebar-menu-sub"
+      data-sidebar="menu-sub"
+      className={cn(
+        "mx-3.5 flex min-w-0 translate-x-px rtl:-translate-x-px flex-col gap-1 border-s border-sidebar-border px-2.5 py-0.5 group-data-[collapsible=icon]:hidden",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function SidebarMenuSubItem({
+  className,
+  ...props
+}: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="sidebar-menu-sub-item"
+      data-sidebar="menu-sub-item"
+      className={cn("group/menu-sub-item relative", className)}
+      {...props}
+    />
+  )
+}
+
+function SidebarMenuSubButton({
+  render,
+  size = "md",
+  isActive = false,
+  className,
+  ...props
+}: useRender.ComponentProps<"a"> &
+  React.ComponentProps<"a"> & {
+    size?: "sm" | "md"
+    isActive?: boolean
+  }) {
+  return useRender({
+    defaultTagName: "a",
+    props: mergeProps<"a">(
+      {
+        className: cn(
+          "flex h-7 min-w-0 -translate-x-px rtl:translate-x-px items-center gap-2 overflow-hidden rounded-xl px-3 text-sidebar-foreground ring-sidebar-ring outline-hidden group-data-[collapsible=icon]:hidden hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[size=md]:text-sm data-[size=sm]:text-xs data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0 [&>svg]:text-sidebar-accent-foreground",
+          className
+        ),
+      },
+      props
+    ),
+    render,
+    state: {
+      slot: "sidebar-menu-sub-button",
+      sidebar: "menu-sub-button",
+      size,
+      active: isActive,
+    },
+  })
+}
+
+export {
+  Sidebar,
+  SidebarContent,
+  SidebarFooter,
+  SidebarGroup,
+  SidebarGroupAction,
+  SidebarGroupContent,
+  SidebarGroupLabel,
+  SidebarHeader,
+  SidebarInput,
+  SidebarInset,
+  SidebarMenu,
+  SidebarMenuAction,
+  SidebarMenuBadge,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarMenuSkeleton,
+  SidebarMenuSub,
+  SidebarMenuSubButton,
+  SidebarMenuSubItem,
+  SidebarProvider,
+  SidebarRail,
+  SidebarSeparator,
+  SidebarTrigger,
+  useSidebar,
+}
diff --git a/apps/app/src/components/ui/skeleton.tsx b/apps/app/src/components/ui/skeleton.tsx
new file mode 100644
index 0000000000..d598583909
--- /dev/null
+++ b/apps/app/src/components/ui/skeleton.tsx
@@ -0,0 +1,13 @@
+import { cn } from "@/lib/utils"
+
+function Skeleton({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="skeleton"
+      className={cn("animate-pulse rounded-2xl bg-muted", className)}
+      {...props}
+    />
+  )
+}
+
+export { Skeleton }
diff --git a/apps/app/src/components/ui/tabs.tsx b/apps/app/src/components/ui/tabs.tsx
new file mode 100644
index 0000000000..c64fa15c8f
--- /dev/null
+++ b/apps/app/src/components/ui/tabs.tsx
@@ -0,0 +1,80 @@
+import { Tabs as TabsPrimitive } from "@base-ui/react/tabs"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+function Tabs({
+  className,
+  orientation = "horizontal",
+  ...props
+}: TabsPrimitive.Root.Props) {
+  return (
+    <TabsPrimitive.Root
+      data-slot="tabs"
+      data-orientation={orientation}
+      className={cn(
+        "group/tabs flex gap-2 data-horizontal:flex-col",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+const tabsListVariants = cva(
+  "group/tabs-list inline-flex w-fit items-center justify-center rounded-lg p-1 text-muted-foreground group-data-horizontal/tabs:h-9 group-data-vertical/tabs:h-fit group-data-vertical/tabs:flex-col group-data-vertical/tabs:rounded-2xl data-[variant=line]:rounded-none",
+  {
+    variants: {
+      variant: {
+        default: "p-0",
+        line: "gap-1 bg-transparent",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+function TabsList({
+  className,
+  variant = "default",
+  ...props
+}: TabsPrimitive.List.Props & VariantProps<typeof tabsListVariants>) {
+  return (
+    <TabsPrimitive.List
+      data-slot="tabs-list"
+      data-variant={variant}
+      className={cn(tabsListVariants({ variant }), className)}
+      {...props}
+    />
+  )
+}
+
+function TabsTrigger({ className, ...props }: TabsPrimitive.Tab.Props) {
+  return (
+    <TabsPrimitive.Tab
+      data-slot="tabs-trigger"
+      className={cn(
+        "relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-2 rounded-lg border border-transparent! px-3 py-1 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-vertical/tabs:w-full group-data-vertical/tabs:justify-start group-data-vertical/tabs:rounded-2xl group-data-vertical/tabs:px-3 group-data-vertical/tabs:py-1.5 hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:opacity-50 has-data-[icon=inline-end]:pe-2 has-data-[icon=inline-start]:ps-2 aria-disabled:pointer-events-none aria-disabled:opacity-50 dark:text-muted-foreground dark:hover:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        "group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
+        "data-active:bg-background data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 dark:data-active:text-foreground",
+        "after:absolute after:bg-foreground after:opacity-0 after:transition-opacity group-data-horizontal/tabs:after:inset-x-0 group-data-horizontal/tabs:after:bottom-[-5px] group-data-horizontal/tabs:after:h-0.5 group-data-vertical/tabs:after:inset-y-0 group-data-vertical/tabs:after:-end-1 group-data-vertical/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function TabsContent({ className, ...props }: TabsPrimitive.Panel.Props) {
+  return (
+    <TabsPrimitive.Panel
+      data-slot="tabs-content"
+      className={cn("flex-1 text-sm outline-none", className)}
+      {...props}
+    />
+  )
+}
+
+export { Tabs, TabsList, TabsTrigger, TabsContent, tabsListVariants }
diff --git a/apps/app/src/components/ui/textarea.tsx b/apps/app/src/components/ui/textarea.tsx
new file mode 100644
index 0000000000..b10f21bf40
--- /dev/null
+++ b/apps/app/src/components/ui/textarea.tsx
@@ -0,0 +1,18 @@
+import * as React from "react";
+
+import { cn } from "@/lib/utils"
+
+function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
+  return (
+    <textarea
+      data-slot="textarea"
+      className={cn(
+        "flex field-sizing-content min-h-16 w-full resize-none rounded-2xl border border-transparent bg-input/50 px-3 py-3 text-base transition-[color,box-shadow,background-color] outline-none placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/30 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 md:text-sm dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Textarea }
diff --git a/apps/app/src/components/ui/tooltip.tsx b/apps/app/src/components/ui/tooltip.tsx
new file mode 100644
index 0000000000..007e2b2058
--- /dev/null
+++ b/apps/app/src/components/ui/tooltip.tsx
@@ -0,0 +1,66 @@
+"use client"
+
+import { Tooltip as TooltipPrimitive } from "@base-ui/react/tooltip"
+
+import { cn } from "@/lib/utils"
+
+function TooltipProvider({
+  delay = 0,
+  ...props
+}: TooltipPrimitive.Provider.Props) {
+  return (
+    <TooltipPrimitive.Provider
+      data-slot="tooltip-provider"
+      delay={delay}
+      {...props}
+    />
+  )
+}
+
+function Tooltip({ ...props }: TooltipPrimitive.Root.Props) {
+  return <TooltipPrimitive.Root data-slot="tooltip" {...props} />
+}
+
+function TooltipTrigger({ ...props }: TooltipPrimitive.Trigger.Props) {
+  return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />
+}
+
+function TooltipContent({
+  className,
+  side = "top",
+  sideOffset = 4,
+  align = "center",
+  alignOffset = 0,
+  children,
+  ...props
+}: TooltipPrimitive.Popup.Props &
+  Pick<
+    TooltipPrimitive.Positioner.Props,
+    "align" | "alignOffset" | "side" | "sideOffset"
+  >) {
+  return (
+    <TooltipPrimitive.Portal>
+      <TooltipPrimitive.Positioner
+        align={align}
+        alignOffset={alignOffset}
+        side={side}
+        sideOffset={sideOffset}
+        className="isolate z-50"
+      >
+        <TooltipPrimitive.Popup
+          data-slot="tooltip-content"
+          className={cn(
+            "z-50 inline-flex w-fit max-w-xs origin-(--transform-origin) items-center gap-1.5 rounded-xl bg-foreground px-3 py-1.5 text-xs text-background has-data-[slot=kbd]:pe-1.5 data-[side=bottom]:slide-in-from-top-2 data-[side=inline-end]:slide-in-from-start-2 data-[side=inline-start]:slide-in-from-end-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 **:data-[slot=kbd]:relative **:data-[slot=kbd]:isolate **:data-[slot=kbd]:z-50 **:data-[slot=kbd]:rounded-lg data-[state=delayed-open]:animate-in data-[state=delayed-open]:fade-in-0 data-[state=delayed-open]:zoom-in-95 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+            className
+          )}
+          {...props}
+        >
+          {children}
+          <TooltipPrimitive.Arrow className="z-50 size-2.5 translate-y-[calc(-50%-2px)] rotate-45 rounded-[2px] bg-foreground fill-foreground data-[side=bottom]:top-1 data-[side=inline-end]:top-1/2! data-[side=inline-end]:-start-1 data-[side=inline-end]:translate-x-[1.5px] rtl:data-[side=inline-end]:-translate-x-[1.5px] data-[side=inline-end]:-translate-y-1/2 data-[side=inline-start]:top-1/2! data-[side=inline-start]:-end-1 data-[side=inline-start]:translate-x-[-1.5px] rtl:data-[side=inline-start]:-translate-x-[-1.5px] data-[side=inline-start]:-translate-y-1/2 data-[side=left]:top-1/2! data-[side=left]:-right-1 data-[side=left]:translate-x-[-1.5px] rtl:data-[side=left]:-translate-x-[-1.5px] data-[side=left]:-translate-y-1/2 data-[side=right]:top-1/2! data-[side=right]:-left-1 data-[side=right]:translate-x-[1.5px] rtl:data-[side=right]:-translate-x-[1.5px] data-[side=right]:-translate-y-1/2 data-[side=top]:-bottom-2.5" />
+        </TooltipPrimitive.Popup>
+      </TooltipPrimitive.Positioner>
+    </TooltipPrimitive.Portal>
+  )
+}
+
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }
diff --git a/apps/app/src/hooks/use-mobile.ts b/apps/app/src/hooks/use-mobile.ts
new file mode 100644
index 0000000000..4acadd43b9
--- /dev/null
+++ b/apps/app/src/hooks/use-mobile.ts
@@ -0,0 +1,19 @@
+import * as React from "react";
+
+const MOBILE_BREAKPOINT = 768
+
+export function useIsMobile() {
+  const [isMobile, setIsMobile] = React.useState<boolean | undefined>(undefined)
+
+  React.useEffect(() => {
+    const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`)
+    const onChange = () => {
+      setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+    }
+    mql.addEventListener("change", onChange)
+    setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+    return () => mql.removeEventListener("change", onChange)
+  }, [])
+
+  return !!isMobile
+}
diff --git a/apps/app/src/i18n/index.ts b/apps/app/src/i18n/index.ts
new file mode 100644
index 0000000000..040d0c2b80
--- /dev/null
+++ b/apps/app/src/i18n/index.ts
@@ -0,0 +1,204 @@
+import en from "./locales/en";
+import ja from "./locales/ja";
+import zh from "./locales/zh";
+import vi from "./locales/vi";
+import ptBR from "./locales/pt-BR";
+import th from "./locales/th";
+import fr from "./locales/fr";
+import ca from "./locales/ca";
+import es from "./locales/es";
+import ru from "./locales/ru";
+import { LANGUAGE_PREF_KEY } from "../app/constants";
+
+/**
+ * Supported languages
+ */
+export type Language = "en" | "ja" | "zh" | "vi" | "pt-BR" | "th" | "fr" | "ca" | "es" | "ru";
+export type Locale = Language;
+
+/**
+ * All supported languages - single source of truth
+ */
+export const LANGUAGES: Language[] = ["en", "ja", "zh", "vi", "pt-BR", "th", "fr", "ca", "es", "ru"];
+
+/**
+ * Language options for UI - single source of truth
+ */
+export const LANGUAGE_OPTIONS = [
+  { value: "en" as Language, label: "English", nativeName: "English" },
+  { value: "ja" as Language, label: "Japanese", nativeName: "日本語" },
+  { value: "zh" as Language, label: "Chinese (Simplified)", nativeName: "简体中文" },
+  { value: "vi" as Language, label: "Vietnamese", nativeName: "Tiếng Việt" },
+  { value: "pt-BR" as Language, label: "Portuguese (BR)", nativeName: "Português (BR)" },
+  { value: "th" as Language, label: "Thai", nativeName: "ไทย" },
+  { value: "fr" as Language, label: "French", nativeName: "Français" },
+  { value: "ca" as Language, label: "Catalan", nativeName: "Català" },
+  { value: "es" as Language, label: "Spanish", nativeName: "Español" },
+  { value: "ru" as Language, label: "Russian", nativeName: "Русский" },
+] as const;
+
+const PLURAL_SUFFIX_EMPTY_LANGUAGES = new Set<Language>(["ja", "zh", "th"]);
+
+/**
+ * Current translation strings use an English-style plural suffix placeholder.
+ * Some locales render the noun without a visible plural marker, so we keep
+ * that suffix empty for them.
+ */
+export const pluralSuffix = (locale: Language, count: number): string => {
+  if (PLURAL_SUFFIX_EMPTY_LANGUAGES.has(locale)) {
+    return "";
+  }
+
+  return count === 1 ? "" : "s";
+};
+
+/**
+ * Translation maps
+ */
+const TRANSLATIONS: Record<Language, Record<string, string>> = {
+  en,
+  ja,
+  zh,
+  vi,
+  "pt-BR": ptBR,
+  th,
+  fr,
+  ca,
+  es,
+  ru,
+};
+
+/**
+ * Type guard to validate if a value is a Language
+ * Replaces long chains like: value === "en" || value === "zh"
+ */
+export const isLanguage = (value: unknown): value is Language => {
+  return typeof value === "string" && LANGUAGES.includes(value as Language);
+};
+
+let localeValue: Language = "en";
+
+/**
+ * Get current locale
+ */
+export const currentLocale = (): Language => locale();
+function locale(): Language {
+  return localeValue;
+}
+
+/**
+ * Set locale and persist to localStorage
+ */
+export const setLocale = (newLocale: Language) => {
+  if (!isLanguage(newLocale)) {
+    console.warn(`Invalid locale: ${newLocale}, falling back to "en"`);
+    newLocale = "en";
+  }
+
+  localeValue = newLocale;
+
+  if (typeof document !== "undefined") {
+    document.documentElement.setAttribute("lang", newLocale);
+  }
+
+  // Persist to localStorage
+  if (typeof window !== "undefined") {
+    try {
+      window.localStorage.setItem(LANGUAGE_PREF_KEY, newLocale);
+    } catch (e) {
+      console.warn("Failed to persist language preference:", e);
+    }
+  }
+};
+
+/**
+ * Resolve a translation entry with the locale → English → null fallback chain.
+ */
+const lookupEntry = (loc: Language, candidateKey: string): string | null => {
+  if (TRANSLATIONS[loc]?.[candidateKey]) return TRANSLATIONS[loc][candidateKey];
+  if (loc !== "en" && TRANSLATIONS.en?.[candidateKey]) return TRANSLATIONS.en[candidateKey];
+  return null;
+};
+
+const pluralRulesCache = new Map<Language, Intl.PluralRules>();
+const pluralRule = (loc: Language, count: number): Intl.LDMLPluralRule => {
+  let rules = pluralRulesCache.get(loc);
+  if (!rules) {
+    rules = new Intl.PluralRules(loc);
+    pluralRulesCache.set(loc, rules);
+  }
+  return rules.select(count);
+};
+
+/**
+ * Pick the right key variant for a count. Tries `${key}_zero` (only when count === 0),
+ * then `${key}_${rule}` (e.g. `_one` / `_other`), then `${key}_other`, then the bare
+ * key. Asian locales (no grammatical plural) define only the bare key and hit the
+ * final step. Each candidate runs through the locale → English fallback so an
+ * untranslated key still resolves to the English `_one` / `_other` variant.
+ */
+const resolvePluralKey = (loc: Language, key: string, count: number): string => {
+  const candidates: string[] = [];
+  if (count === 0) candidates.push(`${key}_zero`);
+  candidates.push(`${key}_${pluralRule(loc, count)}`, `${key}_other`, key);
+
+  for (const candidate of candidates) {
+    if (lookupEntry(loc, candidate) !== null) return candidate;
+  }
+  return key;
+};
+
+/**
+ * Translation function with fallback behavior.
+ * - Locale fallback: target language → English → key itself.
+ * - Plural fallback: when params include a numeric `count`, the lookup picks
+ *   `${key}_one` / `${key}_other` (or `${key}_zero` when count === 0) per
+ *   `Intl.PluralRules`, and falls back to the bare key when no variants exist.
+ */
+export const t = (key: string, params?: Record<string, string | number> & { lng?: Language }): string => {
+  const loc = params?.lng ?? locale();
+
+  const lookupKey =
+    typeof params?.count === "number" ? resolvePluralKey(loc, key, params.count) : key;
+
+  const result = lookupEntry(loc, lookupKey);
+  if (result === null) return key;
+
+  if (!params) return result;
+
+  let out = result;
+  for (const [k, v] of Object.entries(params)) {
+    if (k === "lng") continue;
+    out = out.replace(`{${k}}`, String(v));
+  }
+  return out;
+};
+
+/**
+ * Initialize locale from localStorage
+ * Call this during app initialization
+ */
+export const initLocale = (): Language => {
+  if (typeof window === "undefined") {
+    return "en";
+  }
+
+  try {
+    const stored = window.localStorage.getItem(LANGUAGE_PREF_KEY);
+    if (isLanguage(stored)) {
+      localeValue = stored;
+      if (typeof document !== "undefined") {
+        document.documentElement.setAttribute("lang", stored);
+      }
+      return stored;
+    }
+  } catch (e) {
+    console.warn("Failed to read language preference:", e);
+  }
+
+  if (typeof document !== "undefined") {
+    document.documentElement.setAttribute("lang", "en");
+  }
+
+  return "en";
+};
diff --git a/apps/app/src/i18n/locales/ca.ts b/apps/app/src/i18n/locales/ca.ts
new file mode 100644
index 0000000000..a1330552c5
--- /dev/null
+++ b/apps/app/src/i18n/locales/ca.ts
@@ -0,0 +1,1417 @@
+/**
+ * Catalan translations (Català)
+ * Professional terms (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) are NOT translated
+ */
+
+export default {
+  "app.compact_command_desc": "Resumeix aquesta sessió per reduir la mida del context.",
+  "app.error_audit_load": "No s'ha pogut carregar el registre d'auditoria.",
+  "app.error_auth_failed": "L'autenticació ha fallat",
+  "app.error_command_not_resolved": "No s'ha pogut resoldre la comanda.",
+  "app.error_compact_empty": "Encara no hi ha res per compactar.",
+  "app.error_compact_no_session": "Selecciona una sessió amb missatges abans d'executar /compact.",
+  "app.error_compact_no_session_id": "Selecciona una sessió abans de compactar.",
+  "app.error_connect_first": "Connecta't a aquest worker abans d'aplicar canvis de runtime.",
+  "app.error_not_connected": "No connectat a un servidor",
+  "app.error_rate_limit": "Has superat el límit de peticions",
+  "app.error_remote_access": "No s'ha pogut actualitzar l'accés remot.",
+  "app.error_request_failed": "La sol·licitud ha fallat",
+  "app.error_restart_local_worker": "No s'ha pogut reiniciar el worker local amb la configuració de compartició actualitzada.",
+  "app.error_session_name_required": "El nom de la sessió és obligatori",
+  "app.local_disabled_reason": "Crea workspaces locals des de l'app d'escriptori. Els workspaces remots i compartits aquí continuen funcionant.",
+  "app.model_behavior_title": "Comportament del model",
+  "app.plugins_hint_readonly": "El servidor OpenWork és de només lectura per als Plugins.",
+  "app.reload_later": "Més tard",
+  "app.reload_now": "Recarrega ara",
+  "app.reload_stop_tasks": "Recarrega i atura les tasques",
+  "app.skills_hint_readonly": "El servidor OpenWork és de només lectura per a Skills. Afegeix un token d'host a Avançat per habilitar-ne la instal·lació.",
+  "app.unknown_error": "Error desconegut",
+  "blueprint.automation_body": "Comença amb un flux de treball reutilitzable o escriu la teva pròpia tasca aquí sota.",
+  "blueprint.automation_title": "Què vols automatitzar?",
+  "blueprint.csv_session_assistant": "Et puc ajudar a generar, netejar, combinar i resumir fitxers CSV. Quin tipus de feina amb CSV vols automatitzar?",
+  "blueprint.csv_session_title": "Idees de flux de treball CSV",
+  "blueprint.csv_session_user": "Vull combinar les exportacions de diverses eines en un sol CSV.",
+  "blueprint.empty_body": "Tria un punt de partida o escriu directament aquí sota.",
+  "blueprint.empty_title": "Què vols fer?",
+  "blueprint.minimal_body": "Fes una pregunta sobre aquest workspace o fes servir un missatge d'inici.",
+  "blueprint.minimal_title": "Comença amb una tasca",
+  "blueprint.starter_blueprint_desc": "Dissenya un flux de treball reutilitzable amb Skills, Commands i passos de traspàs.",
+  "blueprint.starter_blueprint_prompt": "Ajuda'm a dissenyar un blueprint d'automatització reutilitzable per a aquest workspace. Pregunta què s'hauria d'estandarditzar i després proposa el flux de treball.",
+  "blueprint.starter_blueprint_title": "Planifica un blueprint d'automatització",
+  "blueprint.starter_chrome_desc": "Comença ara mateix una conversa d'automatització del navegador.",
+  "blueprint.starter_chrome_prompt": "Ajuda'm a connectar-me a Chrome i automatitzar una tasca repetitiva.",
+  "blueprint.starter_chrome_title": "Automatitza Chrome",
+  "blueprint.starter_command_desc": "Converteix un flux de treball repetit en una /command per a aquest workspace.",
+  "blueprint.starter_command_prompt": "Ajuda'm a crear una /command reutilitzable per a aquest workspace. Pregunta quin flux de treball vull automatitzar i després redacta la Command.",
+  "blueprint.starter_command_title": "Crea una /command reutilitzable",
+  "blueprint.starter_connect_openai_desc": "Afegeix el teu proveïdor d'OpenAI perquè els models ChatGPT estiguin preparats en sessions noves.",
+  "blueprint.starter_connect_openai_title": "Connecta ChatGPT",
+  "blueprint.starter_csv_desc": "Neteja o genera dades de fulls de càlcul.",
+  "blueprint.starter_csv_prompt": "Ajuda'm a crear o editar fitxers CSV en aquest ordinador.",
+  "blueprint.starter_csv_title": "Treballa en un CSV",
+  "blueprint.starter_explore_desc": "Resumeix els fitxers i proposa la millor primera tasca per començar.",
+  "blueprint.starter_explore_prompt": "Resumeix aquest workspace, assenyala els fitxers més importants i proposa la millor primera tasca.",
+  "blueprint.starter_explore_title": "Explora aquest workspace",
+  "blueprint.welcome_message": "Hola, benvingut a OpenWork!\n\nLa gent ens fa servir per escriure fitxers .csv al seu ordinador, connectar-se a Chrome i automatitzar tasques repetitives, i sincronitzar contactes amb Notion.\n\nPerò l'únic límit és la teva imaginació.\n\nQuè vols fer?",
+  "blueprint.welcome_title": "Benvingut a OpenWork",
+  "common.add": "Afegeix",
+  "common.cancel": "Cancel·la",
+  "common.close": "Tancar",
+  "common.default_parens": "(per defecte)",
+  "common.edit": "Edita",
+  "common.hide": "Amaga",
+  "common.navigate": "navegar",
+  "common.next": "Següent",
+  "common.off": "Apagat",
+  "common.on": "Encès",
+  "common.path": "Ruta",
+  "common.question": "Pregunta",
+  "common.refresh": "Actualitza",
+  "common.remove": "Eliminar",
+  "common.reset": "Restableix",
+  "common.save": "Desa",
+  "common.select": "seleccionar",
+  "common.show": "Mostra",
+  "common.something_went_wrong": "Hi ha hagut un problema",
+  "common.submit": "Envia",
+  "common.unknown": "Desconegut",
+  "composer.agent_label": "Agent",
+  "composer.attach_files": "Adjuntar fitxers",
+  "composer.attachments_unavailable": "Els fitxers adjunts no estan disponibles.",
+  "composer.behavior_label": "Comportament",
+  "composer.configure": "Configura",
+  "composer.default_agent": "Agent per defecte",
+  "composer.file_exceeds_limit": "{name} supera el límit de 8 MB.",
+  "composer.file_kind": "Fitxer",
+  "composer.image_kind": "Imatge",
+  "composer.inserted_links_unsupported": "S'han inserit enllaços per a fitxers no compatibles.",
+  "composer.loading_commands": "S'estan carregant les Commands...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "No s'ha trobat cap Command.",
+  "composer.placeholder": "Descriu la teva tasca...",
+  "composer.remote_worker_paste_warning": "Aquest és un worker remot. Sandboxes també són remots. Per compartir fitxers amb ell, pengeu-los a la carpeta compartida de la barra lateral.",
+  "composer.run_task": "Executar la tasca",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Atura",
+  "composer.tools_label": "Commands, Skills i MCPs",
+  "composer.unsupported_attachment_type": "Tipus de fitxer adjunt no compatible.",
+  "composer.upload_to_shared_folder": "Penja a la carpeta compartida",
+  "composer.uploaded_multiple_files": "S'han penjat fitxers {count} a la carpeta compartida i s'han inserit enllaços.",
+  "composer.uploaded_single_file": "S'ha penjat {name} a la carpeta compartida i s'ha inserit un enllaç.",
+  "config.collaborator_token_disabled_hint": "Es desa amb antelació per compartir remotament, però ara mateix l'accés remot està desactivat.",
+  "config.collaborator_token_label": "Token de col·laborador",
+  "config.collaborator_token_remote_hint": "Accés remot de rutina per a telèfons o ordinadors portàtils connectats a aquest servidor.",
+  "config.connection_failed": "La connexió ha fallat.",
+  "config.connection_failed_check": "La connexió ha fallat. Comprova l'URL de l'host i el token.",
+  "config.connection_status_updated": "Estat de connexió actualitzat.",
+  "config.connection_successful": "Connexió correcta.",
+  "config.copied": "Copiat",
+  "config.copy": "Copia",
+  "config.desktop_only_hint": "Algunes funcions de configuració (compartir el servidor local i el pont de missatgeria) requereixen l'app d'escriptori.",
+  "config.diagnostics_desc": "Copia l'estat del runtime, ja depurat, per diagnosticar problemes.",
+  "config.diagnostics_title": "Paquet de diagnòstic",
+  "config.engine_reload_desc": "Reinicia el servidor OpenCode per a aquest workspace.",
+  "config.engine_reload_title": "Recàrrega del motor",
+  "config.host_admin_token_hint": "Token intern només per a l'host per a la CLI d'aprovacions i les API d'administració. No el facis servir en el flux de connexió remota de l'app.",
+  "config.host_admin_token_label": "Token d'administrador de l'host",
+  "config.host_local_only": "Només local",
+  "config.host_offline": "Fora de línia",
+  "config.host_remote_enabled": "Accés remot habilitat",
+  "config.local_ip_hint": "Fes servir la teva IP local a la mateixa Wi-Fi per tenir la connexió més ràpida.",
+  "config.mdns_hint": "Els noms .local són més fàcils de recordar, però pot ser que no es resolguin en totes les xarxes.",
+  "config.messaging_identities_desc": "Gestiona les identitats i l'encaminament Telegram/Slack a la pestanya Identitats.",
+  "config.messaging_identities_title": "Identitats de missatgeria",
+  "config.not_set": "No configurat",
+  "config.owner_token_disabled_hint": "Només rellevant després d'habilitar l'accés remot per a aquest worker.",
+  "config.owner_token_label": "Token del propietari",
+  "config.owner_token_remote_hint": "Fes servir-ho quan un client remot necessiti respondre sol·licituds de permís o fer accions només per al propietari.",
+  "config.reload_active_tasks_warning": "La recàrrega aturarà les tasques actives.",
+  "config.reload_availability_hint": "La recàrrega només està disponible per a workers locals o per a servidors OpenWork connectats.",
+  "config.reload_connect_hint": "Connecta't a aquest worker per tornar a carregar.",
+  "config.reload_engine": "Torna a carregar el motor",
+  "config.reload_now_desc": "Aplica actualitzacions de configuració i torna a connectar la sessió.",
+  "config.reload_now_title": "Torna a carregar ara",
+  "config.reloading": "S'està tornant a carregar...",
+  "config.remote_access_off_hint": "L'accés remot està desactivat. Fes servir Comparteix el workspace per activar-lo abans de connectar-te des d'una altra màquina.",
+  "config.resolved_worker_url": "URL de worker resolt:",
+  "config.server_needed_hint": "Cal una connexió al servidor OpenWork per sincronitzar Skills, Plugins i Commands.",
+  "config.server_section_desc": "Connecta't a un servidor OpenWork. Fes servir l'URL i un token de col·laborador o de propietari que et faciliti l'administrador del servidor.",
+  "config.server_section_title": "Servidor OpenWork",
+  "config.server_sharing_desc": "Comparteix aquests detalls amb un dispositiu de confiança. Mantingueu el servidor a la mateixa xarxa per a la configuració més ràpida.",
+  "config.server_sharing_menu_hint": "Per als enllaços de compartició per workspace, fes servir Compartir... al menú del workspace.",
+  "config.server_sharing_title": "Compartició del servidor OpenWork",
+  "config.server_url_hint": "Fes servir l'URL que t'hagi compartit el teu servidor OpenWork. Els workers locals de l'app d'escriptori reutilitzen un port alt persistent dins del rang 48000-51000.",
+  "config.server_url_input_label": "URL del servidor OpenWork",
+  "config.server_url_label": "URL del servidor OpenWork",
+  "config.starting_server": "S'està iniciant el servidor...",
+  "config.status_connected": "Connectat",
+  "config.status_limited": "Limitat",
+  "config.status_not_connected": "No connectat",
+  "config.test_connection": "Prova de connexió",
+  "config.testing": "Prova...",
+  "config.testing_connection": "S'està provant la connexió...",
+  "config.token_hint": "Opcional. Enganxa un token de col·laborador per a l'accés habitual o un token de propietari si aquest client ha de respondre a sol·licituds de permisos.",
+  "config.token_label": "Token de col·laborador o propietari",
+  "config.token_placeholder": "Enganxa el token",
+  "config.unavailable": "No disponible",
+  "config.worker_id": "ID del worker:",
+  "config.workspace_config_desc": "Aquests paràmetres afecten el workspace seleccionat. Les accions només de runtime s'apliquen a qualsevol workspace connectat actualment.",
+  "config.workspace_config_title": "Configuració del workspace",
+  "config.workspace_id_prefix": "Workspace:",
+  "context_panel.add_button": "Afegeix",
+  "context_panel.add_folder_hint": "Afegeix una carpeta per permetre que aquest workspace llegeixi i editi fitxers fora del seu directori arrel.",
+  "context_panel.adding_button": "S'està afegint...",
+  "context_panel.always_available": "Sempre disponible",
+  "context_panel.authorized_folders": "Carpetes autoritzades",
+  "context_panel.authorized_folders_desc": "Concedeix accés a aquest workspace per llegir i editar fitxers en directoris fora de la seva arrel.",
+  "context_panel.authorized_folders_no_access": "Connecta't a un workspace d'un servidor OpenWork amb permisos d'escriptura per editar les carpetes autoritzades.",
+  "context_panel.browse_button": "Navega",
+  "context_panel.config_access_unavailable": "L'accés a la configuració del servidor OpenWork no està disponible per a aquest workspace.",
+  "context_panel.config_read_only": "El servidor OpenWork està connectat en mode de només lectura per a la configuració d'aquest workspace.",
+  "context_panel.folder_already_authorized": "La carpeta ja està autoritzada.",
+  "context_panel.folders_updated": "Carpetes autoritzades actualitzades.",
+  "context_panel.input_placeholder": "Escriu la ruta de la carpeta que vols autoritzar...",
+  "context_panel.no_external_folders": "No hi ha carpetes externes autoritzades",
+  "context_panel.no_mcp": "No s'han carregat servidors MCP.",
+  "context_panel.no_server_workspace": "No s'ha seleccionat cap workspace del servidor actiu.",
+  "context_panel.no_skills": "No s'ha carregat cap Skill.",
+  "context_panel.preserving_entries": "Es conserven {count} entrades de permisos que no corresponen a carpetes.",
+  "context_panel.preserving_entry": "Es conserva 1 entrada de permisos que no correspon a cap carpeta.",
+  "context_panel.remove_folder": "Elimina {name}",
+  "context_panel.saving_folders": "S'estan desant les carpetes autoritzades...",
+  "context_panel.server_disconnected": "El servidor OpenWork està desconnectat.",
+  "context_panel.workspace_root_available": "L'arrel del workspace ja està disponible.",
+  "context_panel.workspace_root_badge": "Arrel del workspace",
+  "context_panel.writable_workspace_required": "Cal un workspace d'un servidor OpenWork amb permisos d'escriptura per actualitzar les carpetes autoritzades.",
+  "dashboard.change": "Canviar",
+  "dashboard.choose_folder": "Tria una carpeta",
+  "dashboard.choose_folder_continue": "Tria una carpeta per continuar.",
+  "dashboard.chooser_local_desc": "Crea un workspace en aquest dispositiu i, si vols, parteix d'una plantilla d'equip.",
+  "dashboard.chooser_remote_desc": "Connecta't a un worker OpenWork autoallotjat amb una URL i un token d'accés.",
+  "dashboard.chooser_shared_desc": "Explora els workers del núvol compartits amb la teva organització i connecta't en un sol pas.",
+  "dashboard.close_settings": "Tanca la configuració",
+  "dashboard.cloud_worker": "Worker Cloud",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Connecta un worker remot",
+  "dashboard.connected": "Connectat",
+  "dashboard.connecting": "S'està connectant...",
+  "dashboard.create_local_workspace_subtitle": "Crea un workspace en aquest dispositiu i, si vols, parteix d'una plantilla d'equip.",
+  "dashboard.create_local_workspace_title": "Workspace local",
+  "dashboard.create_remote_custom_subtitle": "Connecta't a un worker OpenWork autoallotjat.",
+  "dashboard.create_remote_custom_title": "Connecta un worker remot personalitzat",
+  "dashboard.create_remote_workspace_confirm": "Afegeix un workspace",
+  "dashboard.create_remote_workspace_subtitle": "Desa un servidor OpenWork com a workspace.",
+  "dashboard.create_remote_workspace_title": "Afegeix un workspace remot",
+  "dashboard.create_sandbox_confirm": "Crea com a sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "Explora els workers del núvol compartits amb la teva organització i connecta't en un sol pas.",
+  "dashboard.create_shared_subtitle_signed_out": "Inicia la sessió a OpenWork Cloud per accedir als workers compartits amb la teva organització.",
+  "dashboard.create_shared_title": "Workspaces compartits",
+  "dashboard.create_workspace_confirm": "Crea un workspace",
+  "dashboard.create_workspace_subtitle": "Inicialitza un workspace nou basat en una carpeta.",
+  "dashboard.create_workspace_title": "Crea un workspace",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Desa la connexió",
+  "dashboard.edit_remote_workspace_subtitle": "Actualitza les dades del servidor OpenWork per a aquest workspace.",
+  "dashboard.edit_remote_workspace_title": "Edita la connexió remota",
+  "dashboard.error_choose_org": "Tria una organització abans d'obrir un workspace.",
+  "dashboard.error_connect_worker": "No s'ha pogut connectar a {name}.",
+  "dashboard.error_load_orgs": "No s'han pogut carregar les organitzacions.",
+  "dashboard.error_load_shared_workspaces": "No s'han pogut carregar els workspaces compartits.",
+  "dashboard.error_workspace_not_ready": "El workspace encara no està preparat per connectar-se. Torna-ho a provar d'aquí a un moment.",
+  "dashboard.import_config": "Importa la configuració",
+  "dashboard.importing": "S'està important…",
+  "dashboard.modal_back": "Enrere",
+  "dashboard.modal_close": "Tanca el modal d'afegir workspace",
+  "dashboard.remote": "Remot",
+  "dashboard.remote_base_url_required": "Afegeix l’URL del servidor per continuar.",
+  "dashboard.remote_server_details_hint": "Connecta't a un worker OpenWork autoallotjat.",
+  "dashboard.remote_server_details_title": "Detalls del servidor remot",
+  "dashboard.sandbox_checking_docker": "S'està comprovant el Docker...",
+  "dashboard.sandbox_get_ready_title": "Els sandboxes necessiten Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Atenció",
+  "dashboard.worker_status_ready": "A punt",
+  "dashboard.worker_status_starting": "Començant",
+  "dashboard.worker_status_stopped": "Parat",
+  "dashboard.worker_status_unknown": "Desconegut",
+  "den.active_org_hint": "Els workers del núvol i les plantilles d'equip depenen de l'organització seleccionada.",
+  "den.active_org_title": "Organització activa",
+  "den.auto_reconnect_hint": "Acaba l'autenticació al navegador i OpenWork es reconnectarà aquí automàticament.",
+  "den.checking_session": "Comprovant la sessió",
+  "den.choose_org_for_providers": "Tria una organització per veure els proveïdors de núvol.",
+  "den.choose_org_for_skills": "Tria una organització per veure les Skills del núvol.",
+  "den.choose_org_for_skill_hubs": "Tria una organització per veure els centres d'Skills al núvol.",
+  "den.cloud_account_hint": "Gestiona el teu compte connectat i l'organització.",
+  "den.cloud_account_title": "Compte Cloud",
+  "den.cloud_control_plane_open": "Obre al navegador",
+  "den.cloud_control_plane_reset": "Restableix",
+  "den.cloud_control_plane_save": "Desa l'URL",
+  "den.cloud_control_plane_url_hint": "Només el mode desenvolupador. Fes servir-ho per orientar un pla de control Cloud local o autoallotjat. En canviar-lo, es tanca la sessió perquè l'aplicació es pugui rehidratar contra el nou pla de control.",
+  "den.cloud_control_plane_url_label": "URL del pla de control Cloud",
+  "den.cloud_provider_detail": "{count} models · proveïdor {source}",
+  "den.cloud_provider_removed_detail": "Aquest proveïdor importat ja no està al núvol. Desinstal·la la configuració local de {providerId}.",
+  "den.cloud_provider_sync_detail": "El proveïdor de Cloud ha canviat. Sincronitza la configuració dels {count} models {source} a opencode.jsonc.",
+  "den.cloud_skill_detail": "Instal·la aquesta Skill al núvol a .opencode/skills.",
+  "den.cloud_skill_imported_detail": "Instal·lat localment com a {name}.",
+  "den.cloud_skill_removed_detail": "Aquesta Skill del núvol es va eliminar aigües amunt. Desinstal·la la còpia local de {name}.",
+  "den.cloud_skill_sync_detail": "Hi ha disponible una versió al núvol més recent per a {name}. Actualitza la còpia local per mantenir-se sincronitzada.",
+  "den.cloud_skills_hint": "Explora les Skills del núvol a què tens accés, instal·la-les localment i actualitza-les quan canviï la versió remota.",
+  "den.cloud_skills_title": "Skills",
+  "den.cloud_providers_hint": "Importa proveïdors de LLM gestionats a opencode.jsonc i fes servir la credencial de l'organització en aquest workspace.",
+  "den.cloud_providers_title": "Proveïdors del núvol",
+  "den.cloud_section_desc": "Inicia la sessió, tria una organització i obre workers del núvol o plantilles d'equip.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Inicia la sessió a OpenWork Cloud per mantenir les tasques actives encara que l'ordinador entri en repòs.",
+  "den.cloud_workers_hint": "Obre workers directament a OpenWork mitjançant el mateix flux de connexió remota que l'aplicació ja utilitza en altres llocs.",
+  "den.cloud_workers_title": "Workers del núvol",
+  "den.create_account": "Crea un compte",
+  "den.credentials_ready_badge": "Credencial a punt",
+  "den.error_base_url": "Introdueix un URL del pla de control http:// o https:// Cloud vàlid.",
+  "den.error_choose_org": "Tria una organització abans d'obrir un worker.",
+  "den.error_load_orgs": "No s'han pogut carregar les organitzacions.",
+  "den.error_load_skills": "No s'han pogut carregar les Skills al núvol.",
+  "den.error_load_workers": "No s'han pogut carregar els workers.",
+  "den.error_no_session": "No s'ha trobat cap sessió Cloud activa.",
+  "den.error_no_token": "S'ha completat l'inici de sessió a l'escriptori, però OpenWork Cloud no ha retornat cap token de sessió.",
+  "den.error_open_worker": "No s'ha pogut obrir {name} a OpenWork.",
+  "den.error_open_worker_fallback": "No s'ha pogut obrir {name}.",
+  "den.error_paste_valid_code": "Enganxa un enllaç d'inici de sessió OpenWork vàlid o un codi d'inici de sessió únic.",
+  "den.error_signin_failed": "No s'ha pogut completar l'inici de sessió a OpenWork Cloud.",
+  "den.error_worker_not_ready": "El worker encara no està preparat per obrir. Torna-ho a provar quan finalitzi l'aprovisionament.",
+  "den.finish_signin": "Acaba l'inici de sessió",
+  "den.finishing": "S'està acabant...",
+  "den.hide_signin_code": "Amaga el codi d'inici de sessió",
+  "den.import_all": "Importa-ho tot",
+  "den.import_skill": "Instal·lar",
+  "den.import_skill_failed": "No s'ha pogut instal·lar {name}.",
+  "den.import_provider": "Importar",
+  "den.import_provider_failed": "No s'ha pogut importar {name}.",
+  "den.imported_badge": "Importat",
+  "den.imported_provider": "{name} importat.",
+  "den.importing": "S'està important...",
+  "den.needs_attention": "Necessita atenció",
+  "den.no_cloud_providers": "Encara no hi ha cap proveïdor de núvol disponible per a aquesta organització.",
+  "den.no_cloud_skills": "Encara no hi ha Skills al núvol disponibles per a aquesta organització.",
+  "den.no_cloud_workers": "Encara no hi ha cap worker del núvol visible per a aquesta organització. Crea'n un a Cloud i després actualitza aquesta pestanya.",
+  "den.no_org_selected": "No s'ha seleccionat cap organització",
+  "den.no_skill_hubs": "Encara no hi ha cap centre d'Skills al núvol disponible per a aquesta organització.",
+  "den.open": "Obre",
+  "den.opening": "S'està obrint...",
+  "den.org_member_suffix": "(Membre)",
+  "den.org_owner_suffix": "(Propietari)",
+  "den.org_switched": "S'ha canviat a {name}.",
+  "den.out_of_sync_badge": "No sincronitzat",
+  "den.private_badge": "Privat",
+  "den.paste_signin_code": "Enganxa el codi d'inici de sessió",
+  "den.refresh": "Actualitza",
+  "den.reload_workspace": "Torna a carregar el workspace per aplicar els canvis de configuració.",
+  "den.remove_provider_failed": "No s'ha pogut eliminar {name}.",
+  "den.remove_skill_failed": "No s'ha pogut desinstal·lar {name}.",
+  "den.removed_from_cloud_badge": "Eliminat del núvol",
+  "den.removed_provider": "S'ha eliminat {name}.",
+  "den.removing": "S'està eliminant...",
+  "den.sign_out": "Tanca la sessió",
+  "den.signed_out": "Tancat la sessió",
+  "den.signin_button": "Inicia la sessió",
+  "den.signin_code_note": "Accepta un enllaç openwork://den-auth o el codi temporal en brut.",
+  "den.signin_link_hint": "Si el navegador no torna a OpenWork automàticament, enganxa aquí l'enllaç d'inici de sessió o el codi temporal d'OpenWork Cloud.",
+  "den.signin_link_label": "Enllaç d'inici de sessió o codi únic",
+  "den.signin_link_placeholder": "openwork://den-auth?... o codi enganxat",
+  "den.signin_title": "Inicia la sessió a OpenWork Cloud",
+  "den.signing_in": "S'està acabant l'inici de sessió de OpenWork Cloud...",
+  "den.signing_out": "Tancant la sessió...",
+  "den.skill_hub_detail": "Importa les Skills compartides de {count} a .opencode/skills.",
+  "den.skill_hub_imported_detail": "S'han importat les Skills {count} a aquest workspace.",
+  "den.skill_hub_removed_detail": "Aquest concentrador s'ha eliminat del núvol. Desinstal·la les Skills importades {importedCount} d'aquest workspace.",
+  "den.skill_hub_skills_badge": "Skills {count}",
+  "den.skill_hub_sync_detail": "Cloud ara té Skills {liveCount}; aquest workspace ha importat {importedCount}. Sincronitza per actualitzar el conjunt instal·lat.",
+  "den.skill_hubs_hint": "Importa totes les Skills d'un concentrador de núvol compartit a aquest workspace en un sol pas.",
+  "den.skill_hubs_title": "Centres d'Skills",
+  "den.status_base_url_updated": "S'ha actualitzat l'URL del pla de control Cloud. Torna a iniciar la sessió per continuar.",
+  "den.status_browser_signin": "Acabeu d'iniciar la sessió al vostre navegador per connectar OpenWork.",
+  "den.status_browser_signup": "Acabeu la creació del compte al vostre navegador per connectar OpenWork.",
+  "den.status_cloud_signed_in_as": "OpenWork Cloud connectat com a {email}.",
+  "den.status_cloud_signin_done": "OpenWork Cloud connectat.",
+  "den.status_loaded_orgs_one": "S'ha carregat {count} org.",
+  "den.status_loaded_orgs_other": "S'ha carregat {count} orgs.",
+  "den.status_loaded_skills_one": "S'han carregat {count} Skill del núvol per a {name}.",
+  "den.status_loaded_skills_other": "S'han carregat {count} Skills del núvol per a {name}.",
+  "den.status_loaded_workers_one": "S'ha carregat {count} worker per a {name}.",
+  "den.status_loaded_workers_other": "S'ha carregat {count} workers per a {name}.",
+  "den.status_no_skills": "No s'han trobat Skills al núvol per a {name}.",
+  "den.status_no_workers": "No s'ha trobat cap worker per a {name}.",
+  "den.status_opened_worker": "S'ha obert {name} a OpenWork.",
+  "den.status_signed_in_as": "S'ha iniciat la sessió com a {email}.",
+  "den.status_signed_out": "Heu tancat la sessió i heu esborrat la vostra sessió OpenWork Cloud en aquest dispositiu.",
+  "den.sync": "Sincronitza",
+  "den.sync_provider_failed": "No s'ha pogut sincronitzar {name}.",
+  "den.sync_skill_failed": "No s'ha pogut actualitzar {name}.",
+  "den.synced_provider": "{name} sincronitzat.",
+  "den.syncing": "S'està sincronitzant...",
+  "den.installed_name_badge": "Local: {name}",
+  "den.uninstall": "Desinstal·la",
+  "den.worker_mine_badge": "El meu",
+  "den.worker_not_ready_title": "Aquest worker encara no està preparat per obrir-se.",
+  "den.worker_provider_label": "{provider} worker",
+  "den.worker_secondary_cloud": "Worker Cloud",
+  "extensions.app_count_one": "Aplicació {count} connectada",
+  "extensions.app_count_other": "Aplicacions {count} connectades",
+  "extensions.apps_mcp_header": "Aplicacions (MCP)",
+  "extensions.filter_all": "Tots",
+  "extensions.filter_apps": "Aplicacions",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count_one": "{count} plugin",
+  "extensions.plugin_count_other": "{count} plugins",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Les apps (MCP) i els Plugins d'OpenCode són al mateix lloc.",
+  "extensions.title": "Extensions",
+  "identities.agent_behavior_desc": "Un fitxer per workspace. Afegeix una primera línia opcional @agent <id> per enviar-ho a un agent OpenCode concret.",
+  "identities.agent_behavior_title": "Comportament de l'agent de missatgeria",
+  "identities.agent_created": "S'ha creat un fitxer d'agent de missatgeria predeterminat.",
+  "identities.agent_file_changed": "El fitxer ha canviat de forma remota. Torna a carregar i desa de nou.",
+  "identities.agent_loading": "S'està carregant el fitxer de l'agent...",
+  "identities.agent_none": "cap",
+  "identities.agent_not_found": "Encara no s'ha trobat el fitxer d'agent en aquest workspace.",
+  "identities.agent_saved": "Comportament de missatgeria desat.",
+  "identities.agent_scope_status": "Àmbit actiu: workspace · estat: {status} · agent seleccionat: {agent}",
+  "identities.agent_status_loaded": "carregat",
+  "identities.agent_status_missing": "no trobat",
+  "identities.agent_worker_scope_unavailable": "L'àmbit del worker no està disponible.",
+  "identities.all_channels": "Tots els canals",
+  "identities.app_token_label": "Token d'aplicació",
+  "identities.auto_bind_label": "Enllaça automàticament entre iguals al directori en enviament directe",
+  "identities.available_channels": "Canals disponibles",
+  "identities.bot_token_label": "Token de bot",
+  "identities.bot_token_placeholder": "Enganxa el token de bot Telegram de @BotFather",
+  "identities.botfather_step1_open": "1. Obre @BotFather a Telegram",
+  "identities.botfather_step1_run": "i executa /newbot",
+  "identities.botfather_step3_choose": "3. Tria un nom i un nom d'usuari per al teu bot",
+  "identities.botfather_step3_or_private": "per a la safata d'entrada oberta o",
+  "identities.botfather_step3_private": "Privat",
+  "identities.botfather_step3_public": "Públic",
+  "identities.botfather_step3_to_require": "per exigir",
+  "identities.channel_label": "Canal",
+  "identities.channels_connected": "connectat",
+  "identities.channels_label": "Canals",
+  "identities.configured_suffix": "configurat",
+  "identities.connect_server_desc": "Les identitats estan disponibles quan esteu connectat a un host OpenWork.",
+  "identities.connect_server_title": "Connecta't a un servidor OpenWork",
+  "identities.connect_slack": "Connecta Slack",
+  "identities.connected_badge": "Connectat",
+  "identities.connecting": "S'està connectant...",
+  "identities.copy_bot_token_hint": "Copia el token del bot i enganxa'l aquí sota.",
+  "identities.copy_code": "Copia el codi",
+  "identities.create_default_file": "Crea un fitxer predeterminat",
+  "identities.create_private_bot": "Crea un bot privat",
+  "identities.create_public_bot": "Crea un bot públic",
+  "identities.days_ago": "Fa {days}d",
+  "identities.default_routing": "Encaminament per defecte",
+  "identities.directory_label": "Directori (opcional)",
+  "identities.disable_messaging": "Desactiva la missatgeria",
+  "identities.disable_messaging_message": "Això desactivarà la missatgeria per a aquest workspace. La configuració de Telegram i Slack quedarà oculta fins que la tornis a activar, i hauràs de reiniciar el worker per aturar completament el sidecar de missatgeria.",
+  "identities.disable_messaging_title": "Vols desactivar la missatgeria per a aquest worker?",
+  "identities.disabled_label": "Desactivat",
+  "identities.disabling": "S'està desactivant...",
+  "identities.disconnect": "Desconnecta",
+  "identities.dispatched_messages": "Missatges {sent}/{attempted} enviats.",
+  "identities.enable_messaging": "Activa la missatgeria",
+  "identities.enable_messaging_risk": "La missatgeria pot exposar aquest worker a ordres remotes. Si un bot és públic o queda compromès, pot accedir a fitxers, credencials i claus API disponibles per a aquest worker.",
+  "identities.enable_messaging_title": "Vols activar la missatgeria per a aquest worker?",
+  "identities.enabled_label": "Habilitat",
+  "identities.enabling": "S'està habilitant...",
+  "identities.health_offline": "Fora de línia",
+  "identities.health_running": "En execució",
+  "identities.health_unavailable": "No disponible",
+  "identities.health_unknown": "Desconegut",
+  "identities.hours_ago": "fa {hours}h",
+  "identities.identities_label": "Identitats",
+  "identities.just_now": "Just ara",
+  "identities.last_activity": "Última activitat",
+  "identities.later": "Més tard",
+  "identities.message_label": "Missatge",
+  "identities.message_routing_desc": "Controla a quina carpeta de workspace va cada conversa. Per defecte, els missatges s'envien a la carpeta predeterminada del worker, tret que hi configuris regles.",
+  "identities.message_routing_title": "Encaminament de missatges",
+  "identities.messages_today": "Missatges avui",
+  "identities.messaging_disabled_hint": "Activa la missatgeria només si entens el risc i tens previst protegir-ne l'accés (per exemple, amb aparellament privat de Telegram).",
+  "identities.messaging_disabled_restart": "Missatgeria desactivada. Reinicia aquest worker per aturar la missatgeria sidecar.",
+  "identities.messaging_disabled_risk": "Els bots de missatgeria poden executar accions contra el teu worker local. Si s'exposen públicament, poden donar accés als fitxers, credencials i claus API disponibles per a aquest worker.",
+  "identities.messaging_disabled_title": "La missatgeria està desactivada per defecte",
+  "identities.messaging_enabled_restart": "Missatgeria activada. Reinicia aquest worker per aplicar-lo abans de configurar els canals.",
+  "identities.messaging_sidecar_not_running": "La missatgeria està activada en aquest workspace, però la missatgeria sidecar encara no s'està executant. Reinicia aquest worker i, a continuació, torna a la configuració de missatgeria per connectar Telegram o Slack.",
+  "identities.minutes_ago": "fa {minutes}m",
+  "identities.not_set": "No configurat",
+  "identities.open_bot_link": "Obre @{username} a Telegram",
+  "identities.pairing_code_copied": "S'ha copiat el codi d'aparellament.",
+  "identities.pairing_code_copy_failed": "No s'ha pogut copiar el codi d'aparellament. Copia'l manualment.",
+  "identities.pairing_code_instruction_prefix": "Enviar",
+  "identities.peer_id_label": "ID del peer (opcional)",
+  "identities.peer_id_placeholder_slack": "p. ex. slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "p. ex. telegram:123456789",
+  "identities.private_label": "Privat",
+  "identities.private_pairing_code": "Codi d'aparellament privat",
+  "identities.public_bot_confirm": "Sí, entenc el risc",
+  "identities.public_bot_warning_message": "El teu bot serà accessible públicament i qualsevol persona que hi tingui accés podrà tenir control total del teu worker local, inclosos els fitxers i les claus API que hi hagis posat. Si crees un bot privat, pots limitar qui hi accedeix exigint un token d'aparellament. Segur que vols fer públic aquest bot?",
+  "identities.public_bot_warning_title": "Voleu fer públic aquest bot?",
+  "identities.public_label": "Públic",
+  "identities.quick_setup": "Configuració ràpida",
+  "identities.reconnect_failed": "No s'ha pogut reconnectar. Comprova l'URL i el token d'OpenWork i torna-ho a provar.",
+  "identities.reconnected": "Reconnectat.",
+  "identities.reconnected_refreshing": "Reconnectat. S'està actualitzant l'estat del worker...",
+  "identities.reload": "Torna a carregar",
+  "identities.repair_reconnect": "Repara i torna a connectar",
+  "identities.restart_failed": "Ha fallat el reinici. Reinicia el worker des de Configuració i torna-ho a provar.",
+  "identities.restart_to_disable_messaging": "La missatgeria s'ha desactivat per a aquest workspace. Reinicia el worker ara per aturar la missatgeria sidecar.",
+  "identities.restart_to_enable_messaging": "S'ha activat la missatgeria per a aquest workspace. Reinicia el worker ara per arrencar el sidecar de missatgeria i desbloquejar la configuració de Telegram i Slack.",
+  "identities.restart_worker": "Reinicia el worker",
+  "identities.restart_worker_title": "Vols reiniciar el worker ara?",
+  "identities.restarting": "S'està reiniciant...",
+  "identities.routing_override_prefix": "Tots els missatges dirigits a",
+  "identities.routing_override_suffix": "(anul·lació activa)",
+  "identities.running_label": "En execució",
+  "identities.save_behavior": "Desa el comportament",
+  "identities.saving": "S'està desant...",
+  "identities.send_test_button": "Envia un missatge de prova",
+  "identities.send_test_desc": "Valida la configuració de sortida. Fes servir un peer ID per a l'enviament directe, o deixa'l buit perquè s'enviï segons els enllaços d'un directori.",
+  "identities.send_test_title": "Envia un missatge de prova",
+  "identities.sending": "S'està enviant...",
+  "identities.slack_desc": "El teu worker apareix com a bot als canals de Slack. Els membres de l'equip li poden escriure directament o mencionar-lo en fils.",
+  "identities.slack_intro": "Connecta el teu workspace de Slack perquè els membres de l'equip puguin interactuar amb aquest worker des de canals i missatges directes.",
+  "identities.slack_unavailable": "Les identitats Slack no estan disponibles.",
+  "identities.status_active": "Actiu",
+  "identities.status_label": "Estat",
+  "identities.status_stopped": "Parat",
+  "identities.stopped_label": "Parat",
+  "identities.subtitle": "Permet que la gent arribi al teu worker a través d'apps de missatgeria. Connecta un canal i el worker llegirà i respondrà automàticament els missatges.",
+  "identities.tab_general": "General",
+  "identities.telegram_bot_access_desc": "Bot públic: el primer xat de Telegram queda enllaçat automàticament. Bot privat: cal un codi d'aparellament abans que cap missatge pugui executar eines.",
+  "identities.telegram_delete_failed": "No s'ha pogut suprimir.",
+  "identities.telegram_deleted": "S'ha suprimit.",
+  "identities.telegram_deleted_pending": "S'ha suprimit (pendent d'aplicar).",
+  "identities.telegram_desc": "Connecta un bot de Telegram en mode públic (bústia oberta) o en mode privat (cal codi d'aparellament).",
+  "identities.telegram_private_saved_pair": "Bot privat desat. Aparella't amb /pair {code}",
+  "identities.telegram_save_failed": "No s'ha pogut desar.",
+  "identities.telegram_saved": "Desat.",
+  "identities.telegram_saved_pending": "Desat (pendent d'aplicar).",
+  "identities.telegram_saved_username": "Desat (@{username})",
+  "identities.telegram_unavailable": "Les identitats Telegram no estan disponibles.",
+  "identities.title": "Canals de missatgeria",
+  "identities.unsaved_changes": "Canvis no desats",
+  "identities.worker_offline": "worker fora de línia",
+  "identities.worker_online": "worker en línia",
+  "identities.worker_restarted": "worker reiniciat.",
+  "identities.worker_restarted_refreshing": "worker reiniciat. S'està actualitzant l'estat dels missatges...",
+  "identities.worker_scope_unavailable": "L'àmbit del worker no està disponible.",
+  "identities.worker_scope_unavailable_detail": "L'àmbit del worker no està disponible. Torna't a connectar amb una URL de worker o canvia a un worker conegut.",
+  "identities.worker_unavailable": "worker no disponible",
+  "identities.workspace_id_required": "Cal l'ID del workspace per gestionar les identitats. Torna a connectar-te amb una URL de workspace o selecciona'n un d'assignat en aquest host.",
+  "identities.workspace_scope_prefix": "Àmbit del workspace:",
+  "mcp.add_modal_subtitle": "Connecta un servidor MCP personalitzat mitjançant una URL o una comanda local.",
+  "mcp.add_modal_title": "Afegeix una aplicació personalitzada",
+  "mcp.add_server_button": "Afegeix una aplicació",
+  "mcp.advanced": "Avançat",
+  "mcp.advanced_settings": "Configuració avançada",
+  "mcp.advanced_settings_hint": "Edita els fitxers de configuració i gestiona les connexions manualment.",
+  "mcp.app_connected": "aplicació connectada",
+  "mcp.apps_connected": "aplicacions connectades",
+  "mcp.apps_subtitle": "Connecta les teves eines preferides perquè OpenWork les pugui fer servir per tu.",
+  "mcp.apps_title": "Aplicacions",
+  "mcp.auth.already_connected": "Ja està connectat",
+  "mcp.auth.already_connected_description": "{server} ja està autenticat i llest per utilitzar.",
+  "mcp.auth.applying_changes_body": "Estem reiniciant el worker perquè el nou MCP estigui llest per autenticar-se.",
+  "mcp.auth.applying_changes_title": "Aplicant canvis abans d'iniciar la sessió",
+  "mcp.auth.authorization_link": "Enllaç d'autorització",
+  "mcp.auth.authorization_still_required": "Encara cal autorització. Torna-ho a provar per reiniciar el flux.",
+  "mcp.auth.callback_invalid": "Enganxa l'URL de devolució de trucada o el paràmetre de codi per finalitzar OAuth.",
+  "mcp.auth.callback_label": "URL de retorn o codi",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Cancel·la",
+  "mcp.auth.client_registration_required": "Cal registrar el client abans que OAuth pugui continuar.",
+  "mcp.auth.complete_connection": "Connexió completa",
+  "mcp.auth.configured_previously": "És possible que el MCP s'hagi configurat globalment o en una sessió anterior. Podeu tancar aquest modal i començar a utilitzar les eines MCP immediatament.",
+  "mcp.auth.connect_server": "Connecta {server}",
+  "mcp.auth.copied": "Copiat",
+  "mcp.auth.copy_link": "Copia l'enllaç",
+  "mcp.auth.done": "Fet",
+  "mcp.auth.failed_to_start_oauth": "No s'ha pogut iniciar el flux OAuth",
+  "mcp.auth.follow_browser_steps": "Segueix els passos d'autorització al navegador.",
+  "mcp.auth.force_stop": "Força l'aturada",
+  "mcp.auth.force_stopping": "Aturant...",
+  "mcp.auth.im_done": "Ja està",
+  "mcp.auth.invalid_refresh_token": "El token d'actualització OAuth no és vàlid o ha caducat. Torna a autoritzar per continuar.",
+  "mcp.auth.manual_finish_hint": "Enganxa l'URL de retorn (localhost:19876) o només el codi per acabar la connexió.",
+  "mcp.auth.manual_finish_title": "Servidor remot?",
+  "mcp.auth.oauth_completed_reload": "OAuth completat. Torna a carregar el motor per activar el MCP.",
+  "mcp.auth.oauth_failed": "L'autenticació OAuth ha fallat.",
+  "mcp.auth.oauth_not_supported_hint": "Això pot voler dir:\n• El servidor MCP no anuncia capacitats OAuth\n• Cal recarregar el motor per descobrir les capacitats del servidor\n• Prova: opencode mcp auth {server} des de la CLI",
+  "mcp.auth.open_browser_signin": "Obrirem el vostre navegador per finalitzar l'inici de sessió.",
+  "mcp.auth.port_forward_hint": "Consell: reenvia el port de callback si cal: ssh -L 19876:127.0.0.1:19876 usuari@host",
+  "mcp.auth.reauth_action": "Torna a autoritzar OAuth",
+  "mcp.auth.reauth_cli_hint": "Executa: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "La reautorització ha fallat.",
+  "mcp.auth.reauth_remote_hint": "Torna a autoritzar des de la màquina que executa aquest worker.",
+  "mcp.auth.reauth_running": "S'està reautoritzant...",
+  "mcp.auth.reload_blocked": "La recàrrega queda aturada mentre s'està executant una sessió. Atura l'execució per acabar la configuració.",
+  "mcp.auth.reload_engine_retry": "Aplica els canvis i torna-ho a provar",
+  "mcp.auth.reload_failed": "No s'ha pogut tornar a carregar el worker abans d'iniciar la sessió.",
+  "mcp.auth.reload_notice": "Perquè això tingui efecte, OpenWork ha de refrescar el servei del worker. Això pot interrompre una sessió en curs.",
+  "mcp.auth.reload_remote_confirm": "Perquè això tingui efecte, OpenWork ha d'actualitzar el servei worker. Això pot aturar la sessió de carrera. Continuar?",
+  "mcp.auth.reopen_browser_link": "Fes clic aquí per tornar a obrir el navegador",
+  "mcp.auth.request_timed_out": "La sol·licitud s'ha esgotat.",
+  "mcp.auth.retry": "Torna-ho a provar",
+  "mcp.auth.retry_now": "Torna-ho a provar ara",
+  "mcp.auth.server_disabled": "Aquest servidor MCP està desactivat. Activa'l i torna-ho a provar.",
+  "mcp.auth.step1_description": "Llançarem automàticament el flux d'inici de sessió de {server}.",
+  "mcp.auth.step1_title": "Obrint el teu navegador",
+  "mcp.auth.step2_description": "Inicia la sessió i aprova l'accés quan se't demani.",
+  "mcp.auth.step2_title": "Autoritzeu OpenWork",
+  "mcp.auth.step3_description": "Acabarem la connexió tan bon punt s'hagi completat l'autorització.",
+  "mcp.auth.step3_title": "Torna aquí quan hagis acabat",
+  "mcp.auth.try_reload_engine": "{message}. Prova primer de recarregar el motor.",
+  "mcp.auth.waiting_authorization": "S'està esperant que es completi l'autorització al vostre navegador...",
+  "mcp.auth.waiting_for_conversation_body": "Us redirigirem per autenticar-vos tan aviat com sigui possible.",
+  "mcp.auth.waiting_for_conversation_title": "Esperant que finalitzi la conversa",
+  "mcp.auth.waiting_for_session": "S'està esperant que {session} acabi de treballar",
+  "mcp.available_apps": "Aplicacions disponibles",
+  "mcp.cap_signin": "Inici de sessió al compte",
+  "mcp.cap_tools": "Eines d'IA",
+  "mcp.config_file": "Fitxer de configuració",
+  "mcp.config_load_failed": "No s'ha pogut carregar el fitxer de configuració",
+  "mcp.config_not_loaded": "Encara no s'ha carregat",
+  "mcp.connect": "Connecta't",
+  "mcp.connect_failed": "No s'ha pogut connectar. Torna-ho a provar.",
+  "mcp.connect_server_first": "Connecta't primer al servidor.",
+  "mcp.connected": "Connectat",
+  "mcp.connected_badge": "Connectat",
+  "mcp.connection_failed": "Problema de connexió: torna-ho a provar",
+  "mcp.connection_type": "Connexió",
+  "mcp.control_chrome_browser_hint": "A Chrome 144 o superior, fes això primer:",
+  "mcp.control_chrome_browser_step_one": "Obre chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Activa la depuració remota.",
+  "mcp.control_chrome_browser_step_three": "Permet connexions de depuració entrants quan Chrome ho demani.",
+  "mcp.control_chrome_browser_title": "1. Activa l'accés a Chrome",
+  "mcp.control_chrome_connect": "Afegeix Control Chrome",
+  "mcp.control_chrome_docs": "Guia oficial MCP",
+  "mcp.control_chrome_edit": "Edita la configuració",
+  "mcp.control_chrome_profile_hint": "Control Chrome normalment obre un perfil Chrome independent. Activeu-ho si voleu que OpenWork reutilitzi la finestra Chrome que ja teniu oberta.",
+  "mcp.control_chrome_profile_title": "2. Tria quin Chrome vols fer servir",
+  "mcp.control_chrome_save": "Desa la configuració",
+  "mcp.control_chrome_setup_subtitle": "Activa l'accés a Chrome i tria si OpenWork ha de fer servir un perfil net propi o enganxar-se al Chrome que ja tens obert.",
+  "mcp.control_chrome_setup_title": "Configura Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Quan això està activat, OpenWork afegeix --autoConnect de manera que el MCP s'adjunta a una instància Chrome que ja heu iniciat.",
+  "mcp.control_chrome_toggle_label": "Utilitza el meu perfil Chrome existent",
+  "mcp.control_chrome_toggle_off": "OpenWork llançarà un perfil Chrome independent només per a l'automatització.",
+  "mcp.control_chrome_toggle_on": "OpenWork reutilitzarà les vostres pestanyes, galetes i inicis de sessió actuals.",
+  "mcp.custom_app_cta_hint": "Connecta el teu servidor MCP, una eina interna o una app allotjada.",
+  "mcp.desktop_required": "Les aplicacions requereixen el app d'escriptori.",
+  "mcp.docs_link": "Més informació",
+  "mcp.file_not_found": "El fitxer de configuració encara no s'ha creat",
+  "mcp.friendly_status_issue": "Problema",
+  "mcp.friendly_status_needs_signin": "Cal iniciar sessió",
+  "mcp.friendly_status_offline": "Fora de línia",
+  "mcp.friendly_status_paused": "En pausa",
+  "mcp.friendly_status_ready": "A punt",
+  "mcp.last_synced": "Sincronitzat",
+  "mcp.login_action": "Inicia la sessió",
+  "mcp.login_hint": "Connecta el teu compte per acabar de configurar aquesta app.",
+  "mcp.login_unavailable": "Aquesta app no admet l'inici de sessió des d'OpenWork.",
+  "mcp.logout_action": "Tanca la sessió",
+  "mcp.logout_failed": "No s'ha pogut tancar la sessió.",
+  "mcp.logout_hint": "Elimina les credencials OAuth emmagatzemades. Haureu de tornar a iniciar la sessió.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Això eliminarà les credencials OAuth emmagatzemades per a {server}. Haureu de tornar a iniciar la sessió per utilitzar aquesta aplicació.",
+  "mcp.logout_modal_title": "Tanca la sessió d'aquesta aplicació?",
+  "mcp.logout_success": "S'ha tancat la sessió de {server}.",
+  "mcp.logout_working": "Tancant la sessió...",
+  "mcp.name_required": "Introdueix un nom de servidor.",
+  "mcp.no_apps_hint": "Connecta'n una a dalt per començar.",
+  "mcp.no_apps_yet": "Encara no hi ha cap aplicació connectada",
+  "mcp.oauth": "Inicia la sessió",
+  "mcp.oauth_optional_hint": "Utilitza OAuth al navegador per connectar el vostre compte.",
+  "mcp.oauth_optional_label": "Aquesta aplicació requereix iniciar sessió",
+  "mcp.one_click_connect": "Connecta amb un sol clic",
+  "mcp.open_file": "Obre el fitxer",
+  "mcp.opening_label": "S'està obrint...",
+  "mcp.pick_workspace_error": "Tria primer una carpeta de workspace.",
+  "mcp.pick_workspace_first": "Tria primer una carpeta de workspace.",
+  "mcp.quick_connect_chrome_desc": "Controla pestanyes de Chrome amb automatització del navegador.",
+  "mcp.quick_connect_chrome_title": "Control Chrome",
+  "mcp.quick_connect_context7_desc": "Cerca documentació del producte amb més context.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Planifica sprints i lliura tickets més de pressa.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Pàgines, bases de dades i documents del projecte sincronitzats.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Segueix les releases i resol errors de producció.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Consulta pagaments, factures i subscripcions.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Atura la tasca en execució per activar-la.",
+  "mcp.remote_workspace_url_hint": "Els workers remots es connecten més ràpidament amb servidors MCP basats en URL.",
+  "mcp.remove_app": "Eliminar",
+  "mcp.remove_failed": "No s'ha pogut eliminar l'aplicació.",
+  "mcp.remove_modal_message": "Esteu segur que voleu eliminar {server}? Sempre el podeu tornar a afegir més tard.",
+  "mcp.remove_modal_title": "Elimina l'aplicació",
+  "mcp.reveal_config_failed": "No s'ha pogut obrir el fitxer de configuració",
+  "mcp.reveal_in_finder": "Mostra a Finder",
+  "mcp.scope_global": "Tots els workspaces",
+  "mcp.scope_project": "Aquest workspace",
+  "mcp.server_command": "Command",
+  "mcp.server_command_hint": "La comanda de shell per arrencar el servidor.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Nom de l'aplicació",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Tipus",
+  "mcp.server_url": "URL del servidor",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Inicia la sessió",
+  "mcp.tap_to_connect": "Toca per connectar",
+  "mcp.technical_details": "Detalls tècnics",
+  "mcp.type_cloud": "Cloud (inicieu la sessió amb el vostre compte)",
+  "mcp.type_local": "Local (s'executa en aquest dispositiu)",
+  "mcp.type_local_cmd": "Local (comanda)",
+  "mcp.type_remote": "Remot (URL)",
+  "mcp.url_or_command_required": "Introdueix una URL per als servidors remots o una comanda per als servidors locals.",
+  "mcp.your_apps": "Les teves aplicacions",
+  "model_behavior.desc_builtin": "Aquest model decideix el seu propi camí de raonament i no exposa perfils aquí.",
+  "model_behavior.desc_generic": "Fes servir el perfil {label}.",
+  "model_behavior.desc_high": "Dedica més temps a raonar abans de respondre.",
+  "model_behavior.desc_high_anthropic": "Fes servir el pressupost estàndard de pensament estès.",
+  "model_behavior.desc_low": "Feu servir una passada de raonament més lleugera abans de respondre.",
+  "model_behavior.desc_low_google": "Fes servir un pressupost de raonament més lleuger per a respostes més ràpides.",
+  "model_behavior.desc_max": "Fes servir el perfil de raonament més profund del proveïdor.",
+  "model_behavior.desc_max_anthropic": "Fes servir el pressupost de pensament ampli més gran disponible.",
+  "model_behavior.desc_medium": "Equilibra velocitat i profunditat de raonament.",
+  "model_behavior.desc_minimal": "Feu servir una quantitat molt petita de raonament.",
+  "model_behavior.desc_none": "Afavoreix la velocitat amb el camí de raonament més lleuger.",
+  "model_behavior.desc_standard": "Aquest model no exposa controls de raonament addicionals.",
+  "model_behavior.label_balanced": "Equilibrat",
+  "model_behavior.label_builtin": "Integrat",
+  "model_behavior.label_deep": "Profund",
+  "model_behavior.label_extended": "Estesa",
+  "model_behavior.label_fast": "Ràpid",
+  "model_behavior.label_light": "Llum",
+  "model_behavior.label_maximum": "Màxim",
+  "model_behavior.label_quick": "Ràpid",
+  "model_behavior.label_standard": "Estàndard",
+  "model_behavior.title_builtin_reasoning": "Raonament incorporat",
+  "model_behavior.title_extended_thinking": "Pensament estès",
+  "model_behavior.title_reasoning_budget": "Raonament pressupostari",
+  "model_behavior.title_reasoning_effort": "Esforç de raonament",
+  "model_behavior.title_standard_generation": "Generació estàndard",
+  "model_picker.chat_model_desc": "Tria el model per a aquest xat. Si un model admet perfils de raonament, configureu-los a la seva targeta.",
+  "model_picker.chat_model_title": "Model de xat",
+  "model_picker.connect_provider_hint": "Connecta aquest proveïdor per veure i desar models",
+  "model_picker.default_model_desc": "Tria el model predeterminat per a xats nous i, a continuació, ajusteu els perfils de raonament a la seva targeta abans de prémer Fet.",
+  "model_picker.default_model_title": "Model per defecte",
+  "model_picker.model_count_one": "{count} model",
+  "model_picker.model_count_other": "{count} models",
+  "model_picker.more_providers": "Més proveïdors",
+  "model_picker.no_results": "No hi ha cap model que coincideixi amb la teva cerca.",
+  "model_picker.other_connected_models": "Altres models connectats",
+  "model_picker.recommended": "Recomanat",
+  "onboarding.authorize_folder": "Carpeta d'autorització",
+  "plugins.add": "Afegeix",
+  "plugins.add_hint": "Afegeix noms de paquets npm, p. ex. opencode-wakatime",
+  "plugins.add_label": "Afegeix un Plugin",
+  "plugins.added": "Afegit",
+  "plugins.config": "Config",
+  "plugins.config_label": "Config",
+  "plugins.desc": "Gestiona `opencode.json` per al vostre projecte o OpenCode plugins global.",
+  "plugins.empty": "Encara no s'ha configurat cap Plugin.",
+  "plugins.enabled": "Habilitat",
+  "plugins.hide_setup": "Amaga la configuració",
+  "plugins.not_loaded": "Encara no s'ha carregat",
+  "plugins.not_loaded_yet": "Encara no s'ha carregat",
+  "plugins.remove": "Eliminar",
+  "plugins.scope_global": "Global",
+  "plugins.scope_project": "Projecte",
+  "plugins.setup": "Configuració",
+  "plugins.suggested": "Connectors suggerits",
+  "plugins.suggested_heading": "Connectors suggerits",
+  "plugins.title": "OpenCode plugins",
+  "providers.api_key_label": "Tecla API",
+  "providers.api_key_required": "La clau API és necessària",
+  "providers.auth_failed": "L'autenticació ha fallat",
+  "providers.connect_failed": "No s'ha pogut connectar el proveïdor",
+  "providers.disabled_in_config_suffix": "i el va desactivar a la configuració de OpenCode.",
+  "providers.disconnect_failed": "No s'ha pogut desconnectar el proveïdor",
+  "providers.disconnected_prefix": "Desconnectat",
+  "providers.load_failed": "No s'han pogut carregar els proveïdors",
+  "providers.no_oauth_prefix": "No hi ha cap flux OAuth disponible",
+  "providers.no_providers_available": "No hi ha proveïdors disponibles",
+  "providers.not_connected": "No connectat a un servidor",
+  "providers.not_oauth_flow_prefix": "El mètode d'autenticació seleccionat no és un flux OAuth per",
+  "providers.oauth_failed": "No s'ha pogut completar OAuth",
+  "providers.oauth_method_required": "És necessari el mètode OAuth",
+  "providers.provider_error": "Error del proveïdor ({provider})",
+  "providers.provider_id_required": "Es requereix l'identificador del proveïdor",
+  "providers.rate_limit_exceeded": "S'ha superat el límit de tarifa",
+  "providers.removal_unsupported": "Aquest client no admet l'eliminació de l'autenticació del proveïdor.",
+  "providers.request_failed": "La sol·licitud ha fallat",
+  "providers.save_api_key_failed": "No s'ha pogut desar la clau API",
+  "providers.still_connected_suffix": ", però el worker encara informa que està connectat. Esborra qualsevol clau API o credencial OAuth que quedi i reinicia el worker per desconnectar-lo completament.",
+  "providers.unknown_provider": "Proveïdor desconegut",
+  "providers.use_api_key_suffix": "Fes servir una clau API.",
+  "question_modal.custom_answer_label": "O escriviu una resposta personalitzada",
+  "question_modal.custom_answer_placeholder": "Escriu la teva resposta aquí...",
+  "question_modal.question_counter": "Pregunta {current} de {total}",
+  "session.allow_for_session": "Permet la sessió",
+  "session.allow_once": "Permet una vegada",
+  "session.cmd_current_workspace": "Workspace actual",
+  "session.cmd_new_session_detail": "Inicia una tasca nova al workspace actual",
+  "session.cmd_new_session_meta": "Crear",
+  "session.cmd_new_session_title": "Crea una sessió nova",
+  "session.cmd_sessions_detail": "{count} disponible a tots els workspaces",
+  "session.cmd_sessions_meta": "Saltar",
+  "session.cmd_sessions_title": "Sessions de cerca",
+  "session.cmd_switch": "Canvia",
+  "session.create_or_connect_workspace": "Crea o connecteu un workspace",
+  "session.default_agent": "Agent per defecte",
+  "session.default_title": "Nova sessió",
+  "session.delete": "Suprimeix",
+  "session.delete_named_session_message": "Això suprimirà permanentment \"{title}\" i els seus missatges.",
+  "session.delete_session_generic": "Això suprimirà permanentment la sessió seleccionada i els seus missatges.",
+  "session.delete_session_title": "Vols suprimir la sessió?",
+  "session.deleting": "S'està suprimint...",
+  "session.deny": "Negar",
+  "session.details": "Detalls",
+  "session.details_label": "Detalls",
+  "session.doom_loop_label": "Doom Loop",
+  "session.doom_loop_message": "OpenCode ha detectat trucades d'eina repetides amb entrada idèntica i pregunta si hauria de continuar després d'errors repetits.",
+  "session.doom_loop_note": "Rebutja per aturar el bucle o permet si vols que l'agent ho continuï intentant.",
+  "session.doom_loop_repeated_call_label": "Trucada repetida",
+  "session.doom_loop_repeated_tool_call": "Crida repetida a l'eina",
+  "session.doom_loop_title": "S'ha detectat Doom Loop",
+  "session.doom_loop_tool_label": "Eina",
+  "session.export_already_running": "L'exportació ja s'està executant.",
+  "session.export_desktop_only": "L'exportació està disponible a l'app d'escriptori.",
+  "session.export_desktop_only_local": "L'exportació està disponible per a workers locals a l'app d'escriptori.",
+  "session.export_local_only": "L'exportació només és compatible amb workers locals.",
+  "session.loading_detail": "Recollint els missatges més recents per a aquesta tasca.",
+  "session.model": "Model",
+  "session.new_task": "Nova tasca",
+  "session.open": "Obert",
+  "session.palette_hint_navigate": "Tecles de fletxa per navegar",
+  "session.palette_hint_run": "Entra per executar · Esc per tancar",
+  "session.palette_placeholder_actions": "Accions de cerca",
+  "session.palette_placeholder_sessions": "Cerca per títol de sessió o workspace",
+  "session.palette_title_actions": "Accions ràpides",
+  "session.palette_title_sessions": "Sessions de cerca",
+  "session.permission_detail_command": "Ordre",
+  "session.permission_detail_cwd": "Directori de treball",
+  "session.permission_detail_description": "Descripció",
+  "session.permission_detail_diff": "Diferència",
+  "session.permission_detail_file": "Fitxer",
+  "session.permission_detail_files": "Fitxers",
+  "session.permission_detail_agent": "Agent",
+  "session.permission_detail_parent_directory": "Directori pare",
+  "session.permission_detail_path": "Camí",
+  "session.permission_detail_query": "Consulta",
+  "session.permission_detail_target": "Objectiu",
+  "session.permission_detail_tool": "Eina",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Edició de fitxer",
+  "session.permission_kind_external_directory": "Directori extern",
+  "session.permission_kind_question": "Pregunta",
+  "session.permission_kind_read": "Lectura de fitxer",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Subtasca",
+  "session.permission_kind_todowrite": "Escriptura de tasques",
+  "session.permission_label": "Permís",
+  "session.permission_message": "OpenCode està sol·licitant permís per continuar.",
+  "session.permission_message_bash": "Revisa l'abast de l'ordre abans de permetre que OpenCode continuï.",
+  "session.permission_message_edit": "Revisa el fitxer i la diferència abans de permetre que OpenCode faci canvis.",
+  "session.permission_message_external_directory": "Revisa la carpeta abans de permetre l'accés fora del workspace.",
+  "session.permission_message_read": "Revisa l'abast de fitxers sol·licitat abans de permetre l'accés.",
+  "session.permission_message_task": "Revisa la subtasca sol·licitada abans de permetre que comenci.",
+  "session.permission_metadata_unavailable": "No s'han pogut mostrar les metadades.",
+  "session.permission_review_label": "Revisió",
+  "session.permission_scope_empty": "No s'ha proporcionat cap àmbit específic.",
+  "session.permission_decision_hint": "Permet una vegada per a aquesta sol·licitud, o per a la sessió quan confiïs en aquest àmbit.",
+  "session.permission_title_bash": "Executar una ordre de shell?",
+  "session.permission_title_edit": "Modificar fitxers?",
+  "session.permission_title_external_directory": "Accedir a una carpeta externa?",
+  "session.permission_title_generic": "Aprovar {permission}?",
+  "session.permission_title_read": "Llegir fitxers?",
+  "session.permission_title_task": "Iniciar una subtasca?",
+  "session.redo_aria_label": "Refeix l'últim missatge revertit",
+  "session.redo_label": "Refer",
+  "session.redo_title": "Refeix l'últim missatge revertit",
+  "session.rename_description": "Actualitza el nom d'aquesta sessió.",
+  "session.rename_label": "Nom de la sessió",
+  "session.rename_placeholder": "Introdueix un nom nou",
+  "session.rename_title": "Canvia el nom de la sessió",
+  "session.resize_workspace_column": "Canvia la mida de la columna del workspace",
+  "session.revert_label": "Revertir",
+  "session.scope_label": "Àmbit",
+  "session.share_collaborator_hint": "Accés remot de rutina quan no necessiteu accions només del propietari.",
+  "session.share_collaborator_host_hint": "Accés remot habitual a aquest host sense accions només del propietari.",
+  "session.share_collaborator_label": "Token de col·laborador",
+  "session.share_connected_with_hint": "Aquest workspace està connectat actualment amb aquesta contrasenya.",
+  "session.share_desktop_app_required": "Cal l'app d'escriptori",
+  "session.share_local_host_not_ready": "El host local d'OpenWork encara no està a punt.",
+  "session.share_missing_host_url": "Falta l'URL del host d'OpenWork.",
+  "session.share_missing_token": "Falta el token d'OpenWork.",
+  "session.share_note_direct_runtime": "El runtime del motor està configurat en Direct. Canviar de worker local pot reiniciar el host i desconnectar els clients. El token pot canviar després del reinici.",
+  "session.share_opencode_base_url": "URL base OpenCode",
+  "session.share_openwork_workers_only": "Els enllaços de servei de compartició estan disponibles per a OpenWork workers.",
+  "session.share_owner_permission_hint": "Fes servir-lo quan el client remot hagi de respondre a les sol·licituds de permís.",
+  "session.share_password": "Contrasenya",
+  "session.share_select_workspace": "Selecciona primer un workspace.",
+  "session.share_set_token_hint": "Defineix el token a la configuració del workspace",
+  "session.share_starting_server": "S'està iniciant el servidor...",
+  "session.share_worker_url": "URL del worker",
+  "session.share_worker_url_phones_hint": "Fes servir-lo en telèfons o ordinadors portàtils connectats a aquest worker.",
+  "session.share_worker_url_resolving_hint": "S'està resolent l'URL del worker; mentrestant es mostra l'URL del host com a alternativa.",
+  "session.todo_progress": "{completed} de les tasques {total} completades",
+  "session.undo_label": "Revertir",
+  "session.undo_title": "Desfer l'últim missatge",
+  "session.workspace_fallback": "Workspace",
+  "settings.api_keys_info": "Les claus API es desen localment a OpenCode. Els proveïdors basats en variables d'entorn s'han de canviar a l'entorn del worker i després recarregar.",
+  "settings.appearance_hint": "Segueix el sistema o força el mode clar/fosc.",
+  "settings.appearance_title": "Aparença",
+  "settings.audit_log_title": "Registre d'auditoria",
+  "settings.auto_compact": "Compactació automàtica del context",
+  "settings.auto_compact_desc": "Controla OpenCode compaction.auto per a aquest workspace. Torna a carregar el motor després de canviar-lo.",
+  "settings.auto_update_desc": "Descarrega les actualitzacions automàticament (et demana",
+  "settings.auto_update_title": "Actualització automàtica",
+  "settings.background_checks_desc": "OpenWork sempre comprova si hi ha actualitzacions en arrencar. També ho comprova un cop",
+  "settings.background_checks_title": "Comprovacions en segon pla",
+  "settings.cache_repair_requires_desktop": "La reparació de la memòria cache requereix l'app d'escriptori",
+  "settings.cap_browser_tools": "Eines del navegador: {value}",
+  "settings.cap_commands": "Commands: {value}",
+  "settings.cap_config": "Configuració: {value}",
+  "settings.cap_file_tools": "Eines de fitxer: {value}",
+  "settings.cap_inbox_off": "safata d'entrada desactivada",
+  "settings.cap_inbox_on": "safata d'entrada activada",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "bústia de sortida desactivada",
+  "settings.cap_outbox_on": "bústia de sortida activada",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "llegir",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "escriure",
+  "settings.capabilities_title": "Capacitats del servidor OpenWork",
+  "settings.capabilities_unavailable": "Capacitats no disponibles. Connecta't amb un token de client.",
+  "settings.change": "Canviar",
+  "settings.choose": "Tria",
+  "settings.clear": "Esborra",
+  "settings.configure": "Configura",
+  "settings.connect_provider": "Connecta un proveïdor",
+  "settings.connection": "Connexió",
+  "settings.connection_failed": "La connexió ha fallat",
+  "settings.connection_title": "Connexió",
+  "settings.copied_debug_report": "S'ha copiat l'informe JSON del runtime.",
+  "settings.copy_json": "Copia JSON",
+  "settings.custom_binary_hint": "Fes servir-ho per apuntar OpenWork a una compilació OpenCode local",
+  "settings.custom_binary_label": "Binari personalitzat OpenCode",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_desktop_app": "Aplicació d'escriptori: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "Servidor OpenWork: {version}",
+  "settings.deeplink_hint": "Accepta openwork://, openwork-dev:// o una URL compatible en brut de https://share.openworklabs.com/b/...",
+  "settings.delete_containers": "S'estan retirant els contenidors...",
+  "settings.delete_local_config": "S'està eliminant l'estat local...",
+  "settings.dev_mode_badge": "Mode de desenvolupament",
+  "settings.developer": "Desenvolupador",
+  "settings.developer_mode_desc": "Activa les eines de depuració, els diagnòstics i la pestanya Desenvolupador.",
+  "settings.developer_mode_title": "Mode de desenvolupador",
+  "settings.developer_panel_disabled": "Panell de desenvolupador desactivat.",
+  "settings.developer_panel_enabled": "Panell de desenvolupador activat.",
+  "settings.diag_approval": "Aprovació: {mode} ({ms}ms)",
+  "settings.diag_config_path": "Ruta de configuració: {path}",
+  "settings.diag_default": "per defecte",
+  "settings.diag_host_token_source": "Origen del token de host: {source}",
+  "settings.diag_opencode_binary": "OpenCode binari: {binary}",
+  "settings.diag_read_only": "Només de lectura: {value}",
+  "settings.diag_runtime_workspace": "Workspace del runtime: {id}",
+  "settings.diag_selected_workspace": "Workspace seleccionat: {id}",
+  "settings.diag_started": "Inici: {time}",
+  "settings.diag_token_source": "Font del token: {source}",
+  "settings.diag_workspaces": "Workspaces: {count}",
+  "settings.diagnostics_unavailable": "Diagnòstic no disponible.",
+  "settings.disable_developer_mode": "Desactiva el mode de desenvolupador",
+  "settings.disabled": "Desactivat",
+  "settings.disconnect": "Desconnecta",
+  "settings.disconnect_server": "Desconnecta el servidor",
+  "settings.disconnecting": "S'està desconnectant...",
+  "settings.docker_containers_desc": "Forçar els contenidors Docker llançats per OpenWork",
+  "settings.docker_containers_title": "Contenidors Docker d'OpenWork",
+  "settings.docker_requires_desktop": "La neteja de Docker requereix l'app d'escriptori",
+  "settings.done": "Fet",
+  "settings.enable_developer_mode": "Activa el mode de desenvolupador",
+  "settings.enable_exa": "Activa la cerca web Exa",
+  "settings.enable_exa_desc": "S'aplica quan OpenWork Orchestrator arrenca OpenCode. Per defecte està desactivat",
+  "settings.engine_bundled": "En paquet (recomanat)",
+  "settings.engine_bundled_hint": "El motor en paquet és l'opció més fiable. Fes servir System",
+  "settings.engine_custom_binary": "Binari personalitzat",
+  "settings.engine_desc": "Tria com s'executa OpenCode localment.",
+  "settings.engine_source": "Font del motor",
+  "settings.engine_source_debug": "Font del motor",
+  "settings.engine_system_path": "Instal·lació del sistema (PATH)",
+  "settings.engine_title": "Motor",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "Reinicia OpenCode o l'orquestrador després de canviar aquesta configuració.",
+  "settings.export": "Exporta",
+  "settings.exported_debug_report": "S'ha exportat l'informe JSON del runtime.",
+  "settings.feedback_badge": "Llegim tots els missatges",
+  "settings.feedback_desc": "Digueu-nos què us sembla bé i què us sembla dur. Els comentaris van directament a l'equip i ens ajuden a prioritzar el que s'enviarà a continuació.",
+  "settings.feedback_title": "Ajuda a donar forma a OpenWork",
+  "settings.group_global": "Global",
+  "settings.group_workspace": "Workspace",
+  "settings.hide_titlebar": "Amaga la barra de títol",
+  "settings.hide_titlebar_desc": "Amaga la barra de títol de la finestra. Útil en gestors de finestres en mosaic",
+  "settings.join_discord": "Uneix-te a Discord",
+  "settings.language": "Llengua",
+  "settings.language.description": "Tria l'idioma que prefereixes",
+  "settings.last_error": "Últim error",
+  "settings.last_stderr": "Últim stderr",
+  "settings.last_stdout": "Últim stdout",
+  "settings.loading_providers": "S'estan carregant els proveïdors...",
+  "settings.managed_by_env": "Gestionat per l'entorn",
+  "settings.model": "Model",
+  "settings.model_behavior": "Comportament del model",
+  "settings.model_behavior_desc": "Obre el selector de models predeterminat per triar perfils de raonament quan estiguin disponibles.",
+  "settings.model_section_desc": "Tria el model de xat predeterminat i revisa com raona.",
+  "settings.model_title": "Model",
+  "settings.no_active_workspace": "No hi ha workspace local actiu.",
+  "settings.no_audit_entries": "Encara no hi ha entrades d'auditoria.",
+  "settings.no_custom_path_set": "No s'ha definit cap camí personalitzat",
+  "settings.nuke_hint": "Fes servir això només si vols reiniciar completament l'app d'escriptori i l'estat del runtime d'OpenCode.",
+  "settings.off": "Apagat",
+  "settings.on": "Encès",
+  "settings.open_deeplink_action": "S'està obrint...",
+  "settings.open_deeplink_button": "Amaga",
+  "settings.open_deeplink_desc": "Enganxa un deep link d'OpenWork o una URL compartida per obrir-lo.",
+  "settings.open_deeplink_title": "Obre deep link",
+  "settings.opencode_cache": "memòria cache d'OpenCode",
+  "settings.opencode_cache_description": "Repara les dades de la memòria cache utilitzades per engegar el motor. Segur de córrer.",
+  "settings.opencode_engine_desc": "Entorn d'execució local per a agents, eines i proveïdors de models.",
+  "settings.opencode_engine_label": "Motor OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Sidecar del runtime local.",
+  "settings.opencode_sdk_desc": "Diagnòstic de connexió de la UI.",
+  "settings.opencode_sdk_title": "Motor OpenCode",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Obre deep link",
+  "settings.openwork_config_sidecar_desc": "Sidecar de configuració i aprovacions.",
+  "settings.openwork_diagnostics_title": "Diagnòstic del servidor OpenWork",
+  "settings.openwork_server_desc": "Pla de control de sessió per a la sincronització de l'app, els workers i l'accés remot",
+  "settings.openwork_server_label": "Servidor OpenWork",
+  "settings.pending_permissions": "Permisos pendents",
+  "settings.production_mode_badge": "Producció",
+  "settings.provider_default_desc": "Fes servir el comportament de raonament predeterminat integrat del model.",
+  "settings.provider_default_label": "Per defecte del proveïdor",
+  "settings.provider_source_config": "Config",
+  "settings.provider_source_custom": "Personalitzat",
+  "settings.provider_source_env": "Medi ambient",
+  "settings.providers_desc": "Connecta serveis per als models i les eines.",
+  "settings.providers_title": "Proveïdors",
+  "settings.quit_hint": "OpenWork es tanca just després de la neteja perquè la pròxima obertura arrenqui des d'un estat local net per a aquest mode.",
+  "settings.recent_events": "Esdeveniments recents",
+  "settings.reconnect_failed": "No s'ha pogut reconnectar. Comprova l'URL i el token del servidor i torna-ho a provar.",
+  "settings.reconnect_server": "S'està tornant a connectar...",
+  "settings.reconnect_server_failed": "No s'ha pogut reconnectar al servidor OpenWork.",
+  "settings.reconnected": "Tornes a estar connectat al servidor OpenWork.",
+  "settings.reconnecting": "S'està tornant a connectar...",
+  "settings.removing_containers": "S'estan retirant els contenidors...",
+  "settings.removing_local_state": "S'està eliminant l'estat local...",
+  "settings.repair_cache": "Repara la memòria cache",
+  "settings.repairing_cache": "Reparació de la memòria cache",
+  "settings.report_issue": "Informa d'un problema",
+  "settings.reset": "Restableix",
+  "settings.reset_app_data": "Restableix les dades de l'aplicació",
+  "settings.reset_app_data_description": "Més agressiu. Esborra la memòria cache OpenWork + les dades de l'aplicació.",
+  "settings.reset_app_data_title": "Restableix les dades de l'aplicació",
+  "settings.reset_app_data_warning": "Esborra la memòria cache OpenWork i les dades de l'aplicació en aquest dispositiu.",
+  "settings.reset_button": "Restableix",
+  "settings.reset_cancel": "Cancel·la",
+  "settings.reset_config_defaults": "S'està reiniciant...",
+  "settings.reset_confirm_button": "Restablir i reiniciar",
+  "settings.reset_confirmation_hint": "Escriu {resetWord} per confirmar-ho. OpenWork es reiniciarà.",
+  "settings.reset_confirmation_label": "Confirmació",
+  "settings.reset_confirmation_placeholder": "Escriu RESET",
+  "settings.reset_onboarding": "Restableix la incorporació",
+  "settings.reset_onboarding_description": "Esborra les preferències de OpenWork i reinicia l'aplicació.",
+  "settings.reset_onboarding_title": "Restableix la incorporació",
+  "settings.reset_onboarding_warning": "Esborra les preferències locals de OpenWork i els marcadors d'incorporació del workspace.",
+  "settings.reset_openwork_desc_dev": "Amb el mode de desenvolupament actiu, només esborra l'estat de desenvolupament OpenCode aïllat dins de openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "Amb el mode de desenvolupament actiu, només esborra l'estat de desenvolupament OpenCode aïllat dins de openwork-dev-data.",
+  "settings.reset_openwork_title": "Restableix l'estat OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "Cal escriure RESET i reiniciarà l'aplicació.",
+  "settings.reset_startup": "Restableix el mode d'inici predeterminat",
+  "settings.reset_startup_pref": "Restableix la preferència d'inici",
+  "settings.reset_stop_active_runs": "Atura les execucions actives abans de restablir.",
+  "settings.resetting": "S'està reiniciant...",
+  "settings.restart_blocked_message": "OpenWork s'ha de reiniciar per acabar aquesta actualització. Per evitar interrompre la feina que tens en marxa, la instal·lació queda en pausa fins que acabin les execucions actives o les aturis.",
+  "settings.restart_failed": "El reinici ha fallat. Revisa els registres i torna-ho a provar.",
+  "settings.restart_opencode": "S'està reiniciant...",
+  "settings.restart_openwork_server": "S'està reiniciant...",
+  "settings.restart_server_failed": "No s'ha pogut reiniciar el servidor local.",
+  "settings.restarted": "S'ha reiniciat el servidor local.",
+  "settings.restarting": "S'està reiniciant...",
+  "settings.reveal_config": "Mostra la configuració",
+  "settings.reveal_config_requires_desktop": "Mostrar la configuració requereix l'app d'escriptori",
+  "settings.run_sandbox_probe": "Sonda en execució...",
+  "settings.running_probe": "Sonda en execució...",
+  "settings.runtime_debug_desc": "Instantània de diagnòstic llegible amb exportació amb un sol clic.",
+  "settings.runtime_debug_title": "Informe de depuració del runtime",
+  "settings.runtime_desc": "Estat del motor local i del servidor OpenWork.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Error",
+  "settings.sandbox_export_hint": "Fes servir Exporta a l'informe de depuració del runtime de més amunt per",
+  "settings.sandbox_probe_desc": "Executa una comprovació temporal d'arrencada d'un sandbox de Docker i",
+  "settings.sandbox_probe_success": "La prova de Sandbox ha anat bé. Exporta l'informe de depuració per al suport.",
+  "settings.sandbox_probe_title": "Sonda Sandbox",
+  "settings.sandbox_ready": "A punt",
+  "settings.sandbox_requires_desktop": "La prova de Sandbox requereix l'app d'escriptori",
+  "settings.sandbox_result": "Resultat: {status}",
+  "settings.sandbox_run_id": "ID d'execució: {id}",
+  "settings.sandbox_stop_runs_hint": "Atura les execucions actives abans de llançar la sonda",
+  "settings.search_models": "Cerca models...",
+  "settings.send_feedback": "Envia comentaris",
+  "settings.show_model_reasoning": "Mostra el raonament del model",
+  "settings.show_model_reasoning_desc": "Desplega les traces de raonament a la UI quan el model les exposi.",
+  "settings.showing_models": "Mostrant {count} de {total}",
+  "settings.startup": "Inici",
+  "settings.startup_remote_warning": "Ara mateix la preferència d'inici és remota. La configuració del motor",
+  "settings.startup_reset_hint": "Això esborra la teva preferència desada i mostra la pantalla de connexió",
+  "settings.startup_title": "Posada en marxa",
+  "settings.stop_local_server": "Atura el servidor local",
+  "settings.stop_runs_before_cleanup": "Atura les execucions actives abans de fer neteja",
+  "settings.stop_runs_before_reset_config": "Atura les execucions actives abans de restablir la configuració",
+  "settings.stop_runs_to_reset": "Atura les execucions actives per restablir",
+  "settings.switch": "Canvia",
+  "settings.tab_advanced": "Avançat",
+  "settings.tab_appearance": "Aparença",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Depuració",
+  "settings.tab_description_advanced": "Inspecciona l'estat del runtime, l'estat de la connexió i els controls orientats a desenvolupador.",
+  "settings.tab_description_appearance": "Ajusta l'aspecte d'OpenWork al desktop, al tema del sistema i al marc de l'app.",
+  "settings.tab_description_debug": "Revisa els diagnòstics, els registres i les utilitats avançades de depuració del runtime.",
+  "settings.tab_description_den": "Gestiona la connexió a OpenWork Cloud, els workers allotjats i l'accés al workspace.",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "Gestiona apps MCP i Plugins d'OpenCode per a aquest workspace.",
+  "settings.tab_description_general": "Connecta proveïdors, tria el model predeterminat, autoritza carpetes i controla el workspace OpenWork seleccionat juntament amb la seva connexió de runtime.",
+  "settings.tab_description_recovery": "Repara l'estat de migració, restableix els valors predeterminats del workspace i recupera la configuració local.",
+  "settings.tab_description_skills": "Explora, edita i instal·la Skills sense sortir de la configuració.",
+  "settings.tab_description_updates": "Mantén l'app actualitzada amb comprovacions silencioses en segon pla i controls d'instal·lació.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Extensions",
+  "settings.tab_general": "Configuració",
+  "settings.tab_recovery": "Recuperació",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Actualitzacions",
+  "settings.theme_dark": "Fosc",
+  "settings.theme_light": "Clar",
+  "settings.theme_system": "Sistema",
+  "settings.theme_system_hint": "El mode Sistema segueix automàticament la preferència del sistema operatiu.",
+  "settings.update": "Actualització",
+  "settings.update_available": "Actualització disponible: v",
+  "settings.update_available_version": "Actualització disponible: v{version}",
+  "settings.update_check_button": "Comprova",
+  "settings.update_check_failed": "La comprovació d'actualització ha fallat",
+  "settings.update_checking": "S'està comprovant...",
+  "settings.update_download_button": "Descarregar",
+  "settings.update_downloading": "S'està baixant...",
+  "settings.update_install_button": "Instal·la i reinicia",
+  "settings.update_last_checked": "Darrera comprovació {time}",
+  "settings.update_published": "Publicat {date}",
+  "settings.update_ready": "A punt per instal·lar: v",
+  "settings.update_ready_version": "A punt per instal·lar: v{version}",
+  "settings.update_uptodate": "Al dia",
+  "settings.updates": "Actualitzacions",
+  "settings.updates_desc": "Mantén OpenWork al dia.",
+  "settings.updates_desktop_only": "Les actualitzacions només estan disponibles a l'app d'escriptori.",
+  "settings.updates_not_supported": "Les actualitzacions no són compatibles amb aquest entorn.",
+  "settings.updates_title": "Actualitzacions",
+  "settings.window_appearance_desc": "Personalitza l'aspecte de la finestra.",
+  "settings.worker_id_label": "worker {id}",
+  "settings.worker_unresolved": "worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Configuració del workspace",
+  "settings.workspace_debug_events_label": "Esdeveniments de depuració del workspace",
+  "share.back_hint": "Torna a les opcions per compartir",
+  "share.chooser_subtitle": "Tria com vols compartir aquest workspace.",
+  "share.close_hint": "Tancar",
+  "share.option_access_desc": "Mostra les dades de connexió en directe necessàries per accedir a aquest workspace en execució des d'una altra màquina.",
+  "share.option_access_title": "Accedeix al workspace remotament",
+  "share_skill_destination.add_to_workspace": "Afegeix-la al workspace",
+  "share_skill_destination.adding": "Afegint-la",
+  "share_skill_destination.connect_remote_hint": "Connecta primer un workspace remot",
+  "share_skill_destination.create_worker_hint": "Crea primer un workspace",
+  "share_skill_destination.more_options": "Més opcions",
+  "share.subtitle_access": "Mostra les dades de connexió en directe necessàries per accedir a aquest workspace des d'una altra màquina.",
+  "share.title": "Comparteix el workspace",
+  "share.view_access": "Accedeix al workspace remotament",
+  "share.workspace_fallback": "Workspace",
+  "share_skill_destination.connect_remote": "Connecta un workspace remot",
+  "share_skill_destination.create_worker": "Crea un nou workspace",
+  "share_skill_destination.current_badge": "Actual",
+  "share_skill_destination.existing_workers": "Workspaces existents",
+  "share_skill_destination.fallback_skill_name": "Skill compartida",
+  "share_skill_destination.local_badge": "Local",
+  "share_skill_destination.no_workers": "Encara no hi ha cap workspace a punt. Crea'n un o connecta un workspace remot per instal·lar-hi aquesta Skill.",
+  "share_skill_destination.remote_badge": "Remot",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Seleccionat",
+  "share_skill_destination.selected_hint": "Seleccionat. Revisa la destinació aquí sota i confirma.",
+  "share_skill_destination.skill_label": "Skill compartida",
+  "share_skill_destination.subtitle": "Tria un workspace existent o crea'n un de nou abans d'importar aquesta Skill compartida.",
+  "share_skill_destination.title": "On vols posar aquesta Skill?",
+  "share_skill_destination.trigger_label": "Activador",
+  "sidebar.collapse": "Replega",
+  "sidebar.expand": "Expandir",
+  "skills.add_custom_repo": "Afegeix un dipòsit GitHub personalitzat",
+  "skills.add_git_repo": "Afegeix git repo",
+  "skills.add_openwork_hub": "Afegeix OpenWork Hub",
+  "skills.available_from_hub": "Disponible a Hub",
+  "skills.catalog_search_placeholder": "Cerca Skills instal·lades, d'equip i de concentrador",
+  "skills.cloud_choose_org_detail": "Fes servir el tauler Cloud per triar la vostra organització activa i, a continuació, actualitza aquesta llista.",
+  "skills.cloud_choose_org_hint": "Tria una organització a Configuració → Cloud per carregar les Skills de l'equip.",
+  "skills.cloud_footer_label": "Equip",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "S'ha instal·lat {name} en aquest worker.",
+  "skills.cloud_installed_as": "S'ha instal·lat com a {name}",
+  "skills.cloud_installing": "S'està instal·lant {title}...",
+  "skills.cloud_installing_short": "Instal·lació",
+  "skills.cloud_no_search_matches": "Cap Skill no coincideix amb aquesta cerca.",
+  "skills.cloud_org_empty": "Encara no hi ha Skills organitzatives disponibles.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "No s'han pogut carregar les Skills d'organització.",
+  "skills.cloud_refresh": "Actualitzar les Skills de l'equip",
+  "skills.cloud_section_subtitle": "Skills que se t'han compartit a través d'OpenWork Cloud, inclosos els hubs d'Skills de l'equip als quals tens accés.",
+  "skills.cloud_section_title": "De la vostra organització",
+  "skills.cloud_shared_org": "Org",
+  "skills.cloud_shared_private": "Privat",
+  "skills.cloud_shared_public": "Públic",
+  "skills.cloud_sign_in": "Inicia la sessió a Cloud",
+  "skills.cloud_sign_in_hint": "Inicia la sessió a OpenWork Cloud per explorar les Skills de l'equip i de l'organització.",
+  "skills.cloud_status_installed": "Instal·lat",
+  "skills.cloud_status_update": "Actualització disponible",
+  "skills.cloud_update_skill": "Actualització",
+  "skills.cloud_updated": "S'ha actualitzat {name} en aquest worker.",
+  "skills.cloud_updating": "S'està actualitzant {title}…",
+  "skills.cloud_removed": "S'ha eliminat l'Skill del núvol local {name}.",
+  "skills.copy_link_failed": "No s'ha pogut copiar l'enllaç",
+  "skills.create_in_chat": "Crea Skills al xat",
+  "skills.desktop_required": "La gestió d'Skills requereix el app d'escriptori.",
+  "skills.enter_plugin_name": "Introdueix el nom d'un paquet de Plugin.",
+  "skills.failed_load_active": "No s'han pogut carregar els Plugins actius.",
+  "skills.failed_load_opencode": "No s'ha pogut carregar opencode.json",
+  "skills.failed_parse_opencode": "No s'ha pogut analitzar opencode.json",
+  "skills.failed_to_load": "No s'han pogut carregar les Skills",
+  "skills.failed_update_opencode": "No s'ha pogut actualitzar opencode.json",
+  "skills.filter_all": "Tots",
+  "skills.filter_cloud": "Equip",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Instal·lat",
+  "skills.from_repo": "Des de {owner}/{repo}",
+  "skills.github_repo_hint": "Introdueix un repo GitHub en format owner/repo.",
+  "skills.host_mode_only": "Només workspace local",
+  "skills.host_only_error": "La gestió d'Skills requereix un workspace local o servidor OpenWork connectat.",
+  "skills.hub_desc": "Explora les Skills compartides dels concentradors recolzats per GitHub i afegeix-les a aquest worker.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Importar",
+  "skills.import_failed": "La importació ha fallat ({status})",
+  "skills.import_local": "Importa les Skills locals",
+  "skills.import_local_skill": "Importa les Skills locals",
+  "skills.imported": "Importat.",
+  "skills.install": "Instal·lar",
+  "skills.install_failed": "La instal·lació de l'Skill ha fallat.",
+  "skills.install_name_title": "Instal·la {name}",
+  "skills.installed": "Skills instal·lades",
+  "skills.installed_desc": "Les Skills instal·lades en directe en aquest worker i es poden editar o compartir.",
+  "skills.installed_status": "Instal·lat",
+  "skills.installing": "Afegeix Skill",
+  "skills.installing_prefix": "S'està instal·lant {name}...",
+  "skills.installing_skill_creator": "S'està instal·lant el creador d'Skills...",
+  "skills.link_copied": "S'ha copiat l'enllaç",
+  "skills.loading": "S'està carregant…",
+  "skills.no_description": "Encara no hi ha descripció.",
+  "skills.no_hub_repo_label": "No s'ha seleccionat cap dipòsit de concentrador",
+  "skills.no_hub_repo_selected": "No hi ha Skills de concentració disponibles.",
+  "skills.no_hub_skills": "No s'ha seleccionat cap dipòsit de concentrador. Afegeix un repo GitHub per navegar per Skills.",
+  "skills.no_opencode_found": "Encara no s'ha trobat cap opencode.json. Afegeix un Plugin per crear-ne un.",
+  "skills.no_opencode_workspace": "Encara no hi ha opencode.json en aquest workspace.",
+  "skills.no_skills": "No s'ha detectat cap Skill a `.opencode/skills`, `.claude/skills` o `~/.agents/skills`.",
+  "skills.no_skills_found": "Encara no s'han trobat Skills.",
+  "skills.owner_label": "Propietari",
+  "skills.owner_repo_required": "El propietari i el dipòsit són necessaris.",
+  "skills.pick_project_first": "Tria primer una carpeta de projecte.",
+  "skills.pick_project_for_active": "Tria una carpeta de projecte per carregar Plugins actius.",
+  "skills.pick_project_for_plugins": "Tria una carpeta de projecte per gestionar els Plugins del projecte.",
+  "skills.pick_workspace_first": "Tria primer una carpeta de workspace.",
+  "skills.plugin_already_listed": "El Plugin ja apareix a opencode.json.",
+  "skills.plugin_management_host_only": "La gestió de Plugins requereix el app d'escriptori.",
+  "skills.plugins_host_only": "Plugins només estan disponibles a app d'escriptori.",
+  "skills.ref_label": "Ref (branch/tag/commit)",
+  "skills.refresh": "Actualitza",
+  "skills.refresh_hub": "Actualitzar el centre",
+  "skills.remove_saved_repo": "Elimina el repositori desat",
+  "skills.repo_label": "Repo",
+  "skills.reveal_failed": "No s'ha pogut obrir la carpeta d'Skills.",
+  "skills.reveal_folder": "Obre la carpeta d'Skills",
+  "skills.save_and_load": "Guarda i carrega",
+  "skills.select_skill_folder": "Selecciona la carpeta d'Skills",
+  "skills.share_back": "Enrere",
+  "skills.share_chooser_subtitle": "Desa a la vostra organització OpenWork Cloud o publiqueu un enllaç d'instal·lació públic.",
+  "skills.share_close": "Tancar",
+  "skills.share_copy_link": "Còpia",
+  "skills.share_done": "Fet",
+  "skills.share_option_public_desc": "Crea un enllaç que qualsevol pugui utilitzar per instal·lar aquesta Skill.",
+  "skills.share_option_public_title": "Enllaç públic",
+  "skills.share_option_team_desc": "Afegeix aquesta Skill a la vostra organització OpenWork Cloud activa.",
+  "skills.share_option_team_title": "Comparteix amb l'equip",
+  "skills.share_public_create": "Crea un enllaç",
+  "skills.share_public_creating": "S'està publicant…",
+  "skills.share_public_intro": "Publicar un enllaç públic. Qualsevol persona amb l'URL pot instal·lar aquesta Skill.",
+  "skills.share_public_regenerate": "Regenera l'enllaç",
+  "skills.share_publisher_label": "Editor",
+  "skills.share_subtitle_public": "Qualsevol persona amb l'enllaç pot instal·lar aquesta Skill.",
+  "skills.share_subtitle_team": "Emmagatzemat a la vostra organització per als companys d'equip.",
+  "skills.share_team_choose_org": "Tria una organització a Configuració → Cloud abans de compartir-la amb el vostre equip.",
+  "skills.share_team_permissions_intro": "Carrega aquesta Skill a la vostra organització OpenWork Cloud activa i decidiu qui la pot veure.",
+  "skills.share_team_permissions_label": "Permisos per compartir",
+  "skills.share_team_permission_org": "Només organització: no al centre",
+  "skills.share_team_permission_private": "Privat només per a mi",
+  "skills.share_team_hubs_loading": "S'estan carregant els concentradors…",
+  "skills.share_team_org_fallback": "Organització activa de Cloud",
+  "skills.share_team_upload_and_save": "Carrega i desa",
+  "skills.share_team_uploading": "S'està carregant…",
+  "skills.share_team_sign_in": "Inicia la sessió per compartir amb l'equip",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud s'obre al vostre navegador. Torna aquí després d'iniciar la sessió.",
+  "skills.share_team_uploaded_success": "Penjat a {org}. Les Skills Cloud s'actualitzaran per al vostre compte.",
+  "skills.share_title": "Comparteix Skill",
+  "skills.shown_count": "Es mostra {count}",
+  "skills.skill_creator_already_installed": "El creador d'Skills ja està instal·lat.",
+  "skills.skill_creator_installed": "Skill creator instal·lat.",
+  "skills.skill_load_failed": "No s'ha pogut carregar l'Skill.",
+  "skills.source_label": "Font",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Activador: {trigger}",
+  "skills.uninstall": "Desinstal·la",
+  "skills.uninstall_failed": "No s'ha pogut desinstal·lar l'Skill.",
+  "skills.uninstall_title": "Vols desinstal·lar l'Skill?",
+  "skills.uninstall_warning": "Això suprimirà permanentment l'Skill `{name}` del vostre workspace.",
+  "skills.uninstalled": "S'ha eliminat l'Skill.",
+  "skills.unknown_error": "Error desconegut",
+  "skills.worker_profile_desc": "Skills són les Skills bàsiques d'aquest worker. Descobreix-los des de Hub, gestiona el que està instal·lat i crea-ne de nous directament al xat.",
+  "status.back": "Torna a la pantalla anterior",
+  "status.connected": "Connectat",
+  "status.connecting": "Connectant",
+  "status.creating_task": "Creació de nova tasca",
+  "status.developer_mode": "Mode de desenvolupador",
+  "status.disconnected": "Desconnectat",
+  "status.disconnected_hint": "Obre la configuració per tornar a connectar-te",
+  "status.disconnected_label": "Desconnectat",
+  "status.docs": "Docs",
+  "status.feedback": "Feedback",
+  "status.limited_hint": "Torna a connectar-vos per restaurar les funcions completes de OpenWork",
+  "status.limited_mcp_hint": "{count} MCP connectat · Torna a connectar per obtenir funcions completes",
+  "status.limited_mode": "Mode limitat",
+  "status.loading_session": "Sessió de càrrega",
+  "status.mcp_connected": "{count} MCP connectat",
+  "status.open_docs": "Obre la documentació",
+  "status.openwork_ready": "OpenWork llest",
+  "status.providers_connected_one": "{count} proveïdor connectat",
+  "status.providers_connected_other": "{count} proveïdors connectat",
+  "status.ready_for_tasks": "Preparat per a noves tasques",
+  "status.running": "Córrer",
+  "status.send_feedback": "Envieu comentaris",
+  "status.settings": "Configuració",
+  "system.reload_body_agents": "OpenCode carrega agents a l'inici. Torna a carregar el motor per posar agents actualitzats disponibles.",
+  "system.reload_body_commands": "OpenCode carrega ordres a l'inici. Torna a carregar el motor per fer que les ordres actualitzades estiguin disponibles.",
+  "system.reload_body_config": "OpenCode llegeix opencode.json a l'inici. Torna a carregar el motor per aplicar els canvis de configuració.",
+  "system.reload_body_default": "OpenWork ha detectat canvis que requereixen tornar a carregar la instància OpenCode.",
+  "system.reload_body_mcp": "OpenCode carrega els servidors MCP a l'inici. Torna a carregar el motor per activar la nova connexió.",
+  "system.reload_body_mixed": "OpenWork ha detectat canvis en la configuració de OpenCode. Torna a carregar el motor per aplicar-los.",
+  "system.reload_body_plugins": "OpenCode carrega Plugins npm a l'inici. Torna a carregar el motor per aplicar els canvis opencode.json.",
+  "system.reload_body_skills": "OpenCode pot emmagatzemar a la memòria cache el descobriment d'Skills/state. Torna a carregar el motor per posar a disposició les Skills instal·lades recentment.",
+  "system.reload_failed": "No s'ha pogut tornar a carregar el motor.",
+  "system.reload_required": "Cal tornar a carregar",
+  "system.reload_unavailable": "La recàrrega no està disponible per a aquest worker.",
+  "system.stop_active_runs_before_reset": "Atura les execucions actives abans de restablir.",
+  "time.hours_ago": "fa {count}h",
+  "time.just_now": "just ara",
+  "time.minutes_ago": "fa {count}m",
+  "time.seconds_ago": "fa {count}s",
+  "workspace.loading_tasks": "S'estan carregant tasques...",
+  "workspace.local_badge": "Local",
+  "workspace.new_task_inline": "+ Tasca nova",
+  "workspace.no_tasks": "Encara no hi ha tasques.",
+  "workspace.remote_badge": "Remot",
+  "workspace.rename_description": "Actualitza el nom que es mostra a la barra lateral.",
+  "workspace.rename_label": "Nom del workspace",
+  "workspace.rename_placeholder": "Disseny del workspace en equip",
+  "workspace.rename_title": "Edita el nom del workspace",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Seleccionat",
+  "workspace_list.add_workspace": "Afegeix un workspace",
+  "workspace_list.connecting": "S'està connectant...",
+  "workspace_list.delete_session": "Suprimeix la sessió",
+  "workspace_list.edit_connection": "Edita la connexió",
+  "workspace_list.edit_name": "Edita el nom",
+  "workspace_list.hide_child_sessions": "Amaga les sessions infantils",
+  "workspace_list.recover": "Recupera",
+  "workspace_list.remote_worker_unavailable": "Worker remot no disponible",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork no pot carregar tasques d'aquest worker fins que es corregeixi la connexió.",
+  "workspace_list.remove_workspace": "Elimina el workspace",
+  "workspace_list.rename_session": "Canvia el nom de la sessió",
+  "workspace_list.reveal_explorer": "Mostra a l'Explorer",
+  "workspace_list.reveal_finder": "Mostra al Finder",
+  "workspace_list.session_actions": "Accions de sessió",
+  "workspace_list.share": "Comparteix...",
+  "workspace_list.show_child_sessions": "Mostra les sessions infantils",
+  "workspace_list.show_more": "Mostra'n {count} més",
+  "workspace_list.show_more_fallback": "Mostra'n més",
+  "workspace_list.test_connection": "Prova de connexió",
+  "workspace_list.unavailable": "No disponible",
+  "workspace_list.workspace_fallback": "Workspace",
+  "workspace_list.workspace_options": "Opcions de workspace",
+} as const;
diff --git a/apps/app/src/i18n/locales/en.ts b/apps/app/src/i18n/locales/en.ts
new file mode 100644
index 0000000000..6d2c2d035b
--- /dev/null
+++ b/apps/app/src/i18n/locales/en.ts
@@ -0,0 +1,1506 @@
+/**
+ * English translations
+ * Professional terms (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) are NOT translated
+ */
+
+export default {
+  "app.compact_command_desc": "Summarize this session to reduce context size.",
+  "app.error_audit_load": "Failed to load audit log.",
+  "app.error_auth_failed": "Authentication failed",
+  "app.error_command_not_resolved": "Command was not resolved.",
+  "app.error_compact_empty": "Nothing to compact yet.",
+  "app.error_compact_no_session": "Select a session with messages before running /compact.",
+  "app.error_compact_no_session_id": "Select a session before compacting.",
+  "app.error_connect_first": "Connect to this worker before applying runtime changes.",
+  "app.error_not_connected": "Not connected to a server",
+  "app.error_rate_limit": "Rate limit exceeded",
+  "app.error_remote_access": "Failed to update remote access.",
+  "app.error_request_failed": "Request failed",
+  "app.error_restart_local_worker": "Failed to restart the local worker with the updated sharing setting.",
+  "app.error_session_name_required": "Session name is required",
+  "app.local_disabled_reason": "Create local workspaces in the desktop app. Remote and shared workspaces still work here.",
+  "app.model_behavior_title": "Model behavior",
+  "app.plugins_hint_readonly": "OpenWork server is read-only for plugins.",
+  "app.reload_later": "Later",
+  "app.reload_now": "Reload now",
+  "app.reload_stop_tasks": "Reload & Stop Tasks",
+  "app.skills_hint_readonly": "OpenWork server is read-only for skills. Add a host token in Advanced to enable installs.",
+  "action.remove": "Remove",
+  "app.unknown_error": "Unknown error",
+  "blueprint.automation_body": "Start from a reusable workflow or type your own task below.",
+  "blueprint.automation_title": "What do you want to automate?",
+  "blueprint.csv_session_assistant": "I can help you generate, clean, merge, and summarize CSV files. What kind of CSV work do you want to automate?",
+  "blueprint.csv_session_title": "CSV workflow ideas",
+  "blueprint.csv_session_user": "I want to combine exports from multiple tools into one clean CSV.",
+  "blueprint.empty_body": "Pick a starting point or just type below.",
+  "blueprint.empty_title": "What do you want to do?",
+  "blueprint.minimal_body": "Ask a question about this workspace or use a starter prompt.",
+  "blueprint.minimal_title": "Start with a task",
+  "blueprint.starter_blueprint_desc": "Design a repeatable workflow with skills, commands, and handoff steps.",
+  "blueprint.starter_blueprint_prompt": "Help me design a reusable automation blueprint for this workspace. Ask what should be standardized, then propose the workflow.",
+  "blueprint.starter_blueprint_title": "Plan an automation blueprint",
+  "blueprint.starter_chrome_desc": "Start a browser automation conversation right away.",
+  "blueprint.starter_chrome_prompt": "Help me connect to Chrome and automate a repetitive task.",
+  "blueprint.starter_chrome_title": "Automate Chrome",
+  "blueprint.starter_command_desc": "Turn a repeated workflow into a slash command for this workspace.",
+  "blueprint.starter_command_prompt": "Help me create a reusable /command for this workspace. Ask what workflow I want to automate, then draft the command.",
+  "blueprint.starter_command_title": "Create a reusable command",
+  "blueprint.starter_connect_openai_desc": "Add your OpenAI provider so ChatGPT models are ready in new sessions.",
+  "blueprint.starter_connect_openai_title": "Connect ChatGPT",
+  "blueprint.starter_csv_desc": "Clean up or generate spreadsheet data.",
+  "blueprint.starter_csv_prompt": "Help me create or edit CSV files on this computer.",
+  "blueprint.starter_csv_title": "Work on a CSV",
+  "blueprint.starter_explore_desc": "Summarize the files and suggest the best first task to tackle.",
+  "blueprint.starter_explore_prompt": "Summarize this workspace, point out the most important files, and suggest the best first task.",
+  "blueprint.starter_explore_title": "Explore this workspace",
+  "blueprint.welcome_message": "Hi welcome to OpenWork!\n\nPeople use us to write .csv files on their computer, connect to Chrome and automate repetitive tasks, and sync contacts to Notion.\n\nBut the only limit is your imagination.\n\nWhat would you want to do?",
+  "blueprint.welcome_title": "Welcome to OpenWork",
+  "common.add": "Add",
+  "common.cancel": "Cancel",
+  "common.back": "Back",
+  "common.close": "Close",
+  "common.default_parens": "(default)",
+  "common.edit": "Edit",
+  "common.hide": "Hide",
+  "common.navigate": "navigate",
+  "common.next": "Next",
+  "common.off": "Off",
+  "common.on": "On",
+  "common.path": "Path",
+  "common.question": "Question",
+  "common.refresh": "Refresh",
+  "common.remove": "Remove",
+  "common.reset": "Reset",
+  "common.save": "Save",
+  "common.select": "select",
+  "common.show": "Show",
+  "common.something_went_wrong": "Something went wrong",
+  "common.submit": "Submit",
+  "common.unknown": "Unknown",
+  "composer.agent_label": "Agent",
+  "composer.attach_files": "Attach files",
+  "composer.attachments_unavailable": "Attachments are unavailable.",
+  "composer.behavior_label": "Behavior",
+  "composer.configure": "Configure",
+  "composer.default_agent": "Default agent",
+  "composer.file_exceeds_limit": "{name} exceeds the 8MB limit.",
+  "composer.file_kind": "File",
+  "composer.image_kind": "Image",
+  "composer.inserted_links_unsupported": "Inserted links for unsupported files.",
+  "composer.loading_commands": "Loading commands...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "No commands found.",
+  "composer.placeholder": "Describe your task...",
+  "composer.remote_worker_paste_warning": "This is a remote worker. Sandboxes are remote too. To share files with it, upload them to the Shared folder in the sidebar.",
+  "composer.run_task": "Run task",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Stop",
+  "composer.tools_label": "Commands, skills, and MCPs",
+  "composer.unsupported_attachment_type": "Unsupported attachment type.",
+  "composer.upload_to_shared_folder": "Upload to shared folder",
+  "composer.uploaded_multiple_files": "Uploaded {count} files to the shared folder and inserted links.",
+  "composer.uploaded_single_file": "Uploaded {name} to the shared folder and inserted a link.",
+  "config.collaborator_token_disabled_hint": "Stored in advance for remote sharing, but remote access is currently disabled.",
+  "config.collaborator_token_label": "Collaborator token",
+  "config.collaborator_token_remote_hint": "Routine remote access for phones or laptops connecting to this server.",
+  "config.connection_failed": "Connection failed.",
+  "config.connection_failed_check": "Connection failed. Check the host URL and token.",
+  "config.connection_status_updated": "Connection status updated.",
+  "config.connection_successful": "Connection successful.",
+  "config.copied": "Copied",
+  "config.copy": "Copy",
+  "config.desktop_only_hint": "Some config features (local server sharing + messaging bridge) require the desktop app.",
+  "config.diagnostics_desc": "Copy sanitized runtime state for debugging.",
+  "config.diagnostics_title": "Diagnostics bundle",
+  "config.engine_reload_desc": "Restart the OpenCode server for this workspace.",
+  "config.engine_reload_title": "Engine reload",
+  "config.host_admin_token_hint": "Internal host-only token for approvals CLI and admin APIs. Do not use this in the remote app connect flow.",
+  "config.host_admin_token_label": "Host admin token",
+  "config.host_local_only": "Local only",
+  "config.host_offline": "Offline",
+  "config.host_remote_enabled": "Remote enabled",
+  "config.local_ip_hint": "Use your local IP on the same Wi-Fi for the fastest connection.",
+  "config.mdns_hint": ".local names are easier to remember but may not resolve on all networks.",
+  "config.messaging_identities_desc": "Manage Telegram/Slack identities and routing in the Identities tab.",
+  "config.messaging_identities_title": "Messaging identities",
+  "config.not_set": "Not set",
+  "config.owner_token_disabled_hint": "Only relevant after you enable remote access for this worker.",
+  "config.owner_token_label": "Owner token",
+  "config.owner_token_remote_hint": "Use this when a remote client needs to answer permission prompts or take owner-only actions.",
+  "config.reload_active_tasks_warning": "Reloading will stop active tasks.",
+  "config.reload_availability_hint": "Reloading is only available for local workers or connected OpenWork servers.",
+  "config.reload_connect_hint": "Connect to this worker to reload.",
+  "config.reload_engine": "Reload engine",
+  "config.reload_now_desc": "Applies config updates and reconnects your session.",
+  "config.reload_now_title": "Reload now",
+  "config.reloading": "Reloading...",
+  "config.remote_access_off_hint": "Remote access is off. Use Share workspace to enable it before connecting from another machine.",
+  "config.resolved_worker_url": "Resolved worker URL:",
+  "config.server_needed_hint": "OpenWork server connection needed to sync skills, plugins, and commands.",
+  "config.server_section_desc": "Connect to an OpenWork server. Use the URL plus a collaborator or owner token from your server admin.",
+  "config.server_section_title": "OpenWork server",
+  "config.server_sharing_desc": "Share these details with a trusted device. Keep the server on the same network for the fastest setup.",
+  "config.server_sharing_menu_hint": "For per-workspace sharing links, use Share... in the workspace menu.",
+  "config.server_sharing_title": "OpenWork server sharing",
+  "config.server_url_hint": "Use the URL shared by your OpenWork server. Local desktop workers reuse a persistent high port in the 48000-51000 range.",
+  "config.server_url_input_label": "OpenWork server URL",
+  "config.server_url_label": "OpenWork Server URL",
+  "config.starting_server": "Starting server…",
+  "config.status_connected": "Connected",
+  "config.status_limited": "Limited",
+  "config.status_not_connected": "Not connected",
+  "config.test_connection": "Test connection",
+  "config.testing": "Testing...",
+  "config.testing_connection": "Testing connection...",
+  "config.token_hint": "Optional. Paste a collaborator token for routine access or an owner token when this client must answer permission prompts.",
+  "config.token_label": "Collaborator or owner token",
+  "config.token_placeholder": "Paste your token",
+  "config.unavailable": "Unavailable",
+  "config.worker_id": "Worker ID:",
+  "config.workspace_config_desc": "These settings affect the selected workspace. Runtime-only actions apply to whichever workspace is currently connected.",
+  "config.workspace_config_title": "Workspace config",
+  "config.workspace_id_prefix": "Workspace:",
+  "context_panel.add_button": "Add",
+  "context_panel.add_folder_hint": "Add a folder to let this workspace read and edit files outside its root directory.",
+  "context_panel.adding_button": "Adding...",
+  "context_panel.always_available": "Always available",
+  "context_panel.authorized_folders": "Authorized folders",
+  "context_panel.authorized_folders_desc": "Grant this workspace access to read and edit files in directories outside of its root.",
+  "context_panel.authorized_folders_no_access": "Connect to a writable OpenWork server workspace to edit authorized folders.",
+  "context_panel.browse_button": "Browse",
+  "context_panel.config_access_unavailable": "OpenWork server config access is unavailable for this workspace.",
+  "context_panel.config_read_only": "OpenWork server is connected read-only for workspace config.",
+  "context_panel.folder_already_authorized": "Folder is already authorized.",
+  "context_panel.folders_updated": "Authorized folders updated.",
+  "context_panel.input_placeholder": "Type a folder path to authorize...",
+  "context_panel.no_external_folders": "No external folders authorized",
+  "context_panel.no_mcp": "No MCP servers loaded.",
+  "context_panel.no_server_workspace": "No active server workspace is selected.",
+  "context_panel.no_skills": "No skills loaded.",
+  "context_panel.preserving_entries": "Preserving {count} non-folder permission entries.",
+  "context_panel.preserving_entry": "Preserving 1 non-folder permission entry.",
+  "context_panel.remove_folder": "Remove {name}",
+  "context_panel.saving_folders": "Saving authorized folders...",
+  "context_panel.server_disconnected": "OpenWork server is disconnected.",
+  "context_panel.workspace_root_available": "Workspace root is already available.",
+  "context_panel.workspace_root_badge": "Workspace root",
+  "context_panel.writable_workspace_required": "A writable OpenWork server workspace is required to update authorized folders.",
+  "dashboard.change": "Change",
+  "dashboard.choose_folder": "Choose a folder",
+  "dashboard.choose_folder_continue": "Choose a folder to continue.",
+  "dashboard.chooser_local_desc": "Create a workspace on this device.",
+  "dashboard.chooser_remote_desc": "Attach to a self-hosted OpenWork worker using a URL and access token.",
+  "dashboard.chooser_shared_desc": "Browse cloud workers shared with your organization and connect in one step.",
+  "dashboard.close_settings": "Close settings",
+  "dashboard.cloud_worker": "Cloud worker",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Connect remote",
+  "dashboard.connected": "Connected",
+  "dashboard.connecting": "Connecting...",
+  "dashboard.create_local_workspace_subtitle": "Create a workspace on this device.",
+  "dashboard.create_local_workspace_title": "Local workspace",
+  "dashboard.create_remote_custom_subtitle": "Attach to a self-hosted OpenWork worker.",
+  "dashboard.create_remote_custom_title": "Connect custom remote",
+  "dashboard.create_remote_workspace_confirm": "Add Workspace",
+  "dashboard.create_remote_workspace_subtitle": "Save an OpenWork server as a workspace.",
+  "dashboard.create_remote_workspace_title": "Add Remote Workspace",
+  "dashboard.create_sandbox_confirm": "Create as sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "Browse cloud workers shared with your organization and connect in one step.",
+  "dashboard.create_shared_subtitle_signed_out": "Sign in to OpenWork Cloud to access workers shared with your organization.",
+  "dashboard.create_shared_title": "Shared workspaces",
+  "dashboard.create_workspace_confirm": "Create Workspace",
+  "dashboard.create_workspace_subtitle": "Initialize a new folder-based workspace.",
+  "dashboard.create_workspace_title": "Create Workspace",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Save connection",
+  "dashboard.edit_remote_workspace_subtitle": "Update the OpenWork server details for this workspace.",
+  "dashboard.edit_remote_workspace_title": "Edit Remote Connection",
+  "dashboard.error_choose_org": "Choose an organization before opening a workspace.",
+  "dashboard.error_connect_worker": "Failed to connect to {name}.",
+  "dashboard.error_load_orgs": "Failed to load organizations.",
+  "dashboard.error_load_shared_workspaces": "Failed to load shared workspaces.",
+  "dashboard.error_workspace_not_ready": "Workspace is not ready to connect yet. Try again in a moment.",
+  "dashboard.import_config": "Import config",
+  "dashboard.importing": "Importing…",
+  "dashboard.modal_back": "Back",
+  "dashboard.modal_close": "Close add workspace modal",
+  "dashboard.remote": "Remote",
+  "dashboard.remote_base_url_required": "Add a server URL to continue.",
+  "dashboard.remote_server_details_hint": "Attach to a self-hosted OpenWork worker.",
+  "dashboard.remote_server_details_title": "Remote server details",
+  "dashboard.sandbox_checking_docker": "Checking Docker...",
+  "dashboard.sandbox_get_ready_title": "Sandboxes need Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Attention",
+  "dashboard.worker_status_ready": "Ready",
+  "dashboard.worker_status_starting": "Starting",
+  "dashboard.worker_status_stopped": "Stopped",
+  "dashboard.worker_status_unknown": "Unknown",
+  "den.active_org_hint": "Choose an organization to access shared Cloud workers, providers, and skills.",
+  "den.active_org_title": "Active organization",
+  "den.auto_reconnect_hint": "Finish auth in your browser and OpenWork will reconnect here automatically.",
+  "den.checking_session": "Checking session",
+  "den.choose_org_for_providers": "Choose an org to view cloud providers.",
+  "den.choose_org_for_skills": "Choose an org to view cloud skills.",
+  "den.choose_org_for_skill_hubs": "Choose an org to view cloud skill hubs.",
+  "den.cloud_account_hint": "Manage your connected account and organization.",
+  "den.cloud_account_title": "Cloud account",
+  "den.cloud_control_plane_open": "Open in browser",
+  "den.cloud_control_plane_reset": "Reset",
+  "den.cloud_control_plane_save": "Save URL",
+  "den.cloud_control_plane_url_hint": "Developer mode only. Use this to target a local or self-hosted Cloud control plane. Changing it signs you out so the app can re-hydrate against the new control plane.",
+  "den.cloud_control_plane_url_label": "Cloud control plane URL",
+  "den.cloud_provider_detail": "{count} models · {source} provider",
+  "den.cloud_provider_removed_detail": "This imported provider is no longer in cloud. Uninstall the local {providerId} config.",
+  "den.cloud_provider_sync_detail": "Cloud provider changed. Sync the {count} model {source} config into opencode.jsonc.",
+  "den.cloud_skill_detail": "Install this cloud skill into .opencode/skills.",
+  "den.cloud_skill_imported_detail": "Installed locally as {name}.",
+  "den.cloud_skill_removed_detail": "This cloud skill was removed upstream. Uninstall the local {name} copy.",
+  "den.cloud_skill_sync_detail": "A newer cloud version is available for {name}. Update the local copy to stay in sync.",
+  "den.cloud_skills_hint": "Browse cloud skills you can access, install, and sync changes.",
+  "den.cloud_skills_title": "Skills",
+  "den.cloud_providers_hint": "Import managed LLM providers into opencode.jsonc and use the org credential in this workspace.",
+  "den.cloud_providers_title": "Cloud providers",
+  "den.cloud_section_desc": "Sign in, pick an organization, and open Cloud workers.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Sign in to OpenWork Cloud to keep your tasks alive even when your computer sleeps.",
+  "den.cloud_signed_in_desc": "You are signed in and ready to use OpenWork Cloud.",
+  "den.cloud_workers_hint": "Open workers directly into OpenWork using the same remote-connect flow the app already uses elsewhere.",
+  "den.cloud_workers_title": "Cloud workers",
+  "den.create_account": "Create account",
+  "den.credentials_ready_badge": "Credential ready",
+  "den.error_base_url": "Enter a valid http:// or https:// Cloud control plane URL.",
+  "den.error_choose_org": "Choose an org before opening a worker.",
+  "den.error_load_orgs": "Failed to load orgs.",
+  "den.error_load_skills": "Failed to load cloud skills.",
+  "den.error_load_workers": "Failed to load workers.",
+  "den.error_no_session": "No active Cloud session found.",
+  "den.error_no_token": "Desktop sign-in completed, but OpenWork Cloud did not return a session token.",
+  "den.error_open_worker": "Failed to open {name} in OpenWork.",
+  "den.error_open_worker_fallback": "Failed to open {name}.",
+  "den.error_paste_valid_code": "Paste a valid OpenWork sign-in link or one-time sign-in code.",
+  "den.error_signin_failed": "Failed to complete OpenWork Cloud sign-in.",
+  "den.error_worker_not_ready": "Worker is not ready to open yet. Try again after provisioning finishes.",
+  "den.finish_signin": "Finish sign-in",
+  "den.finishing": "Finishing...",
+  "den.hide_signin_code": "Hide sign-in code",
+  "den.import_all": "Import all",
+  "den.import_skill": "Install",
+  "den.import_skill_failed": "Failed to install {name}.",
+  "den.import_provider": "Import",
+  "den.import_provider_failed": "Failed to import {name}.",
+  "den.imported_badge": "Imported",
+  "den.imported_provider": "Imported {name}.",
+  "den.importing": "Importing...",
+  "den.needs_attention": "Needs attention",
+  "den.no_cloud_providers": "No cloud providers are available for this org yet.",
+  "den.no_cloud_skills": "No cloud skills are available for this org yet.",
+  "den.no_cloud_workers": "No cloud workers are visible for this org yet. Create one in Cloud, then refresh this tab.",
+  "den.no_org_selected": "No org selected",
+  "den.no_skill_hubs": "No cloud skill hubs are available for this org yet.",
+  "den.open": "Open",
+  "den.opening": "Opening...",
+  "den.org_member_suffix": "(Member)",
+  "den.org_owner_suffix": "(Owner)",
+  "den.org_switched": "Switched to {name}.",
+  "den.out_of_sync_badge": "Out of sync",
+  "den.private_badge": "Private",
+  "den.paste_signin_code": "Paste sign-in code",
+  "den.refresh": "Refresh",
+  "den.reload_workspace": "Reload workspace to apply config changes.",
+  "den.remove_provider_failed": "Failed to remove {name}.",
+  "den.remove_skill_failed": "Failed to uninstall {name}.",
+  "den.removed_from_cloud_badge": "Removed from cloud",
+  "den.removed_provider": "Removed {name}.",
+  "den.removing": "Removing...",
+  "den.sign_out": "Sign out",
+  "den.signed_out": "Signed out",
+  "den.signin_button": "Sign in",
+  "den.signin_code_note": "Accepts an openwork://den-auth link or the raw one-time grant.",
+  "den.signin_link_hint": "If your browser doesn't bounce back into OpenWork automatically, paste the sign-in link or one-time code from OpenWork Cloud here.",
+  "den.signin_link_label": "Sign-in link or one-time code",
+  "den.signin_link_placeholder": "openwork://den-auth?... or pasted code",
+  "den.signin_title": "Sign in to OpenWork Cloud",
+  "den.signing_in": "Finishing OpenWork Cloud sign-in...",
+  "den.signing_out": "Signing out...",
+  "den.skill_hub_detail": "Import {count} shared skills into .opencode/skills.",
+  "den.skill_hub_imported_detail": "Imported {count} skills into this workspace.",
+  "den.skill_hub_removed_detail": "This hub was removed from cloud. Uninstall the {importedCount} imported skills from this workspace.",
+  "den.skill_hub_skills_badge": "{count} skills",
+  "den.skill_hub_sync_detail": "Cloud now has {liveCount} skills; this workspace imported {importedCount}. Sync to update the installed set.",
+  "den.skill_hubs_hint": "Import every skill from a shared cloud hub into this workspace in one step.",
+  "den.skill_hubs_title": "Skill hubs",
+  "den.status_base_url_updated": "Updated the Cloud control plane URL. Sign in again to continue.",
+  "den.status_browser_signin": "Finish signing in in your browser to connect OpenWork.",
+  "den.status_browser_signup": "Finish account creation in your browser to connect OpenWork.",
+  "den.status_cloud_signed_in_as": "Connected OpenWork Cloud as {email}.",
+  "den.status_cloud_signin_done": "Connected OpenWork Cloud.",
+  "den.status_loaded_orgs_one": "Connected {count} organization.",
+  "den.status_loaded_orgs_other": "Connected {count} organizations.",
+  "den.status_loaded_skills_one": "Loaded {count} cloud skill for {name}.",
+  "den.status_loaded_skills_other": "Loaded {count} cloud skills for {name}.",
+  "den.status_loaded_workers_one": "Loaded {count} worker for {name}.",
+  "den.status_loaded_workers_other": "Loaded {count} workers for {name}.",
+  "den.status_no_skills": "No cloud skills found for {name}.",
+  "den.status_no_workers": "No workers found for {name}.",
+  "den.status_opened_worker": "Opened {name} in OpenWork.",
+  "den.status_signed_in_as": "Signed in as {email}.",
+  "den.status_signed_out": "Signed out and cleared your OpenWork Cloud session on this device.",
+  "den.sync": "Sync",
+  "den.sync_provider_failed": "Failed to sync {name}.",
+  "den.sync_skill_failed": "Failed to update {name}.",
+  "den.synced_provider": "Synced {name}.",
+  "den.syncing": "Syncing...",
+  "den.installed_name_badge": "Local: {name}",
+  "den.uninstall": "Uninstall",
+  "den.worker_mine_badge": "Mine",
+  "den.worker_not_ready_title": "This worker is not ready to open yet.",
+  "den.worker_provider_label": "{provider} worker",
+  "den.worker_secondary_cloud": "Cloud worker",
+  "extensions.app_count_one": "{count} app connected",
+  "extensions.app_count_other": "{count} apps connected",
+  "extensions.apps_mcp_header": "Apps (MCP)",
+  "extensions.filter_all": "All",
+  "extensions.filter_apps": "Apps",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count_one": "{count} plugin",
+  "extensions.plugin_count_other": "{count} plugins",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Apps (MCP) and OpenCode plugins live in one place.",
+  "extensions.title": "Extensions",
+  "identities.agent_behavior_desc": "One file per workspace. Add optional first line @agent <id> to route via a specific OpenCode agent.",
+  "identities.agent_behavior_title": "Messaging agent behavior",
+  "identities.agent_created": "Created default messaging agent file.",
+  "identities.agent_file_changed": "File changed remotely. Reload and save again.",
+  "identities.agent_loading": "Loading agent file…",
+  "identities.agent_none": "none",
+  "identities.agent_not_found": "Agent file not found in this workspace yet.",
+  "identities.agent_placeholder": "Describe how the messaging agent should respond in this workspace.",
+  "identities.agent_saved": "Saved messaging behavior.",
+  "identities.agent_scope_status": "Active scope: workspace · status: {status} · selected agent: {agent}",
+  "identities.agent_status_loaded": "loaded",
+  "identities.agent_status_missing": "missing",
+  "identities.agent_worker_scope_unavailable": "Worker scope unavailable.",
+  "identities.all_channels": "All channels",
+  "identities.app_token_label": "App token",
+  "identities.auto_bind_label": "Auto-bind peer to directory on direct send",
+  "identities.available_channels": "Available channels",
+  "identities.bot_token_label": "Bot token",
+  "identities.bot_token_placeholder": "Paste Telegram bot token from @BotFather",
+  "identities.botfather_step1_open": "1. Open @BotFather in Telegram",
+  "identities.botfather_step1_run": "and run /newbot",
+  "identities.botfather_step3_choose": "3. Choose a name and username for your bot",
+  "identities.botfather_step3_or_private": "for open inbox or",
+  "identities.botfather_step3_private": "Private",
+  "identities.botfather_step3_public": "Public",
+  "identities.botfather_step3_to_require": "to require",
+  "identities.channel_label": "Channel",
+  "identities.channels_connected": "connected",
+  "identities.channels_label": "Channels",
+  "identities.configured_suffix": "configured",
+  "identities.connect_server_desc": "Identities are available when you are connected to an OpenWork host.",
+  "identities.connect_server_title": "Connect to an OpenWork server",
+  "identities.connect_slack": "Connect Slack",
+  "identities.connected_badge": "Connected",
+  "identities.connecting": "Connecting...",
+  "identities.copy_bot_token_hint": "Copy the bot token and paste it below.",
+  "identities.copy_code": "Copy code",
+  "identities.create_default_file": "Create default file",
+  "identities.create_private_bot": "Create private bot",
+  "identities.create_public_bot": "Create public bot",
+  "identities.days_ago": "{days}d ago",
+  "identities.default_routing": "Default routing",
+  "identities.directory_label": "Directory (optional)",
+  "identities.disable_messaging": "Disable messaging",
+  "identities.disable_messaging_message": "This will turn off messaging for this workspace. Telegram and Slack setup will be hidden until messaging is enabled again, and you will need to restart the worker to fully stop the messaging sidecar.",
+  "identities.disable_messaging_title": "Disable messaging for this worker?",
+  "identities.disabled_label": "Disabled",
+  "identities.disabling": "Disabling...",
+  "identities.disconnect": "Disconnect",
+  "identities.dispatched_messages": "Dispatched {sent}/{attempted} messages.",
+  "identities.enable_messaging": "Enable messaging",
+  "identities.enable_messaging_risk": "Messaging can expose this worker to remote commands. If a bot is public or compromised, it can access files, credentials, and API keys available to this worker.",
+  "identities.enable_messaging_title": "Enable messaging for this worker?",
+  "identities.enabled_label": "Enabled",
+  "identities.enabling": "Enabling...",
+  "identities.health_offline": "Offline",
+  "identities.health_running": "Running",
+  "identities.health_unavailable": "Unavailable",
+  "identities.health_unavailable_status": "Unavailable ({status})",
+  "identities.health_unknown": "Unknown",
+  "identities.hours_ago": "{hours}h ago",
+  "identities.identities_label": "Identities",
+  "identities.just_now": "Just now",
+  "identities.last_activity": "Last activity",
+  "identities.later": "Later",
+  "identities.message_label": "Message",
+  "identities.message_routing_desc": "Control which conversations go to which workspace folder. Messages are routed to the worker's default folder unless you set up rules here.",
+  "identities.message_routing_title": "Message routing",
+  "identities.messages_today": "Messages today",
+  "identities.messaging_disabled_hint": "Enable messaging only if you understand the risk and plan to secure access (for example, private Telegram pairing).",
+  "identities.messaging_disabled_restart": "Messaging disabled. Restart this worker to stop the messaging sidecar.",
+  "identities.messaging_disabled_risk": "Messaging bots can execute actions against your local worker. If exposed publicly, they may allow access to files, credentials, and API keys available to this worker.",
+  "identities.messaging_disabled_title": "Messaging is disabled by default",
+  "identities.messaging_enabled_restart": "Messaging enabled. Restart this worker to apply before configuring channels.",
+  "identities.messaging_sidecar_not_running": "Messaging is enabled in this workspace, but the messaging sidecar is not running yet. Restart this worker, then return to Messaging settings to connect Telegram or Slack.",
+  "identities.minutes_ago": "{minutes}m ago",
+  "identities.not_set": "Not set",
+  "identities.open_bot_link": "Open @{username} in Telegram",
+  "identities.pairing_code_copied": "Pairing code copied.",
+  "identities.pairing_code_copy_failed": "Could not copy pairing code. Copy it manually.",
+  "identities.pairing_code_instruction_prefix": "Send",
+  "identities.peer_id_label": "Peer ID (optional)",
+  "identities.peer_id_placeholder_slack": "e.g. slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "e.g. telegram:123456789",
+  "identities.private_label": "Private",
+  "identities.private_pairing_code": "Private pairing code",
+  "identities.public_bot_confirm": "Yes I understand the risk",
+  "identities.public_bot_warning_message": "Your bot will be accessible to the public and anyone who gets access to your bot will be able to have full access to your local worker including any files or API keys that you've given it. If you create a private bot, you can limit who can access it by requiring a pairing token. Are you sure you want to make your bot public?",
+  "identities.public_bot_warning_title": "Make this bot public?",
+  "identities.public_label": "Public",
+  "identities.quick_setup": "Quick setup",
+  "identities.reconnect_failed": "Reconnect failed. Check OpenWork URL/token and try again.",
+  "identities.reconnected": "Reconnected.",
+  "identities.reconnected_refreshing": "Reconnected. Refreshing worker state...",
+  "identities.reload": "Reload",
+  "identities.repair_reconnect": "Repair & reconnect",
+  "identities.restart_failed": "Restart failed. Please restart the worker from Settings and try again.",
+  "identities.restart_to_disable_messaging": "Messaging was disabled for this workspace. Restart the worker now to stop the messaging sidecar.",
+  "identities.restart_to_enable_messaging": "Messaging was enabled for this workspace. Restart the worker now to start the messaging sidecar and unlock Telegram and Slack setup.",
+  "identities.restart_worker": "Restart worker",
+  "identities.restart_worker_title": "Restart worker now?",
+  "identities.restarting": "Restarting...",
+  "identities.routing_override_prefix": "All messages routed to",
+  "identities.routing_override_suffix": "(override active)",
+  "identities.running_label": "Running",
+  "identities.save_behavior": "Save behavior",
+  "identities.saving": "Saving...",
+  "identities.send_test_button": "Send test message",
+  "identities.send_test_desc": "Validate outbound wiring. Use a peer ID for direct send, or leave peer ID empty to fan out by bindings in a directory.",
+  "identities.send_test_title": "Send test message",
+  "identities.sending": "Sending...",
+  "identities.slack_desc": "Your worker appears as a bot in Slack channels. Team members can message it directly or mention it in threads.",
+  "identities.slack_intro": "Connect your Slack workspace to let team members interact with this worker in channels and DMs.",
+  "identities.slack_unavailable": "Slack identities unavailable.",
+  "identities.status_active": "Active",
+  "identities.status_label": "Status",
+  "identities.status_stopped": "Stopped",
+  "identities.stopped_label": "Stopped",
+  "identities.subtitle": "Let people reach your worker through messaging apps. Connect a channel and your worker will automatically read and respond to messages.",
+  "identities.tab_general": "General",
+  "identities.telegram_bot_access_desc": "Public bot: first Telegram chat auto-links. Private bot: requires a pairing code before any messages run tools.",
+  "identities.telegram_delete_failed": "Failed to delete.",
+  "identities.telegram_deleted": "Deleted.",
+  "identities.telegram_deleted_pending": "Deleted (pending apply).",
+  "identities.telegram_desc": "Connect a Telegram bot in public mode (open inbox) or private mode (pairing code required).",
+  "identities.telegram_private_saved_pair": "Private bot saved. Pair via /pair {code}",
+  "identities.telegram_save_failed": "Failed to save.",
+  "identities.telegram_saved": "Saved.",
+  "identities.telegram_saved_pending": "Saved (pending apply).",
+  "identities.telegram_saved_username": "Saved (@{username})",
+  "identities.telegram_unavailable": "Telegram identities unavailable.",
+  "identities.title": "Messaging channels",
+  "identities.unsaved_changes": "Unsaved changes",
+  "identities.worker_offline": "Worker offline",
+  "identities.worker_online": "Worker online",
+  "identities.worker_restarted": "Worker restarted.",
+  "identities.worker_restarted_refreshing": "Worker restarted. Refreshing messaging status...",
+  "identities.worker_scope_unavailable": "Worker scope unavailable.",
+  "identities.worker_scope_unavailable_detail": "Worker scope unavailable. Reconnect using a worker URL or switch to a known worker.",
+  "identities.worker_unavailable": "Worker unavailable",
+  "identities.workspace_id_required": "Workspace ID is required to manage identities. Reconnect with a workspace URL or select a workspace mapped on this host.",
+  "identities.workspace_scope_prefix": "Workspace scope:",
+  "mcp.disable_app": "Disable",
+  "mcp.enable_app": "Enable",
+  "mcp.reloading_status": "Reloading MCP servers…",
+  "mcp.toggle_failed": "Failed to update MCP enabled state.",
+  "mcp.toggle_requires_server": "Connect to an OpenWork server to enable or disable MCPs.",
+  "mcp.add_modal_subtitle": "Connect a custom MCP server by URL or local command.",
+  "mcp.add_modal_title": "Add Custom App",
+  "mcp.add_server_button": "Add App",
+  "mcp.advanced": "Advanced",
+  "mcp.advanced_settings": "Advanced settings",
+  "mcp.advanced_settings_hint": "Edit config files and manage connections manually.",
+  "mcp.app_connected": "app connected",
+  "mcp.apps_connected": "apps connected",
+  "mcp.apps_subtitle": "Connect your favorite tools so OpenWork can use them on your behalf.",
+  "mcp.apps_title": "Apps",
+  "mcp.auth.already_connected": "Already Connected",
+  "mcp.auth.already_connected_description": "{server} is already authenticated and ready to use.",
+  "mcp.auth.applying_changes_body": "We are restarting the worker so the new MCP is ready to authenticate.",
+  "mcp.auth.applying_changes_title": "Applying changes before sign-in",
+  "mcp.auth.authorization_link": "Authorization link",
+  "mcp.auth.authorization_still_required": "Authorization is still required. Try again to restart the flow.",
+  "mcp.auth.callback_invalid": "Paste the callback URL or the code parameter to finish OAuth.",
+  "mcp.auth.callback_label": "Callback URL or code",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Cancel",
+  "mcp.auth.client_registration_required": "Client registration is required before OAuth can continue.",
+  "mcp.auth.complete_connection": "Complete connection",
+  "mcp.auth.configured_previously": "The MCP may have been configured globally or in a previous session. You can close this modal and start using the MCP tools right away.",
+  "mcp.auth.connect_server": "Connect {server}",
+  "mcp.auth.copied": "Copied",
+  "mcp.auth.copy_link": "Copy link",
+  "mcp.auth.done": "Done",
+  "mcp.auth.failed_to_start_oauth": "Failed to start OAuth flow",
+  "mcp.auth.follow_browser_steps": "Follow the authorization steps in the browser.",
+  "mcp.auth.force_stop": "Force stop",
+  "mcp.auth.force_stopping": "Stopping...",
+  "mcp.auth.im_done": "I'm done",
+  "mcp.auth.invalid_refresh_token": "The OAuth refresh token is invalid or expired. Reauthorize to continue.",
+  "mcp.auth.manual_finish_hint": "Paste the callback URL (localhost:19876) or just the code to finish connecting.",
+  "mcp.auth.manual_finish_title": "Remote server?",
+  "mcp.auth.oauth_completed_reload": "OAuth completed. Reload the engine to activate the MCP.",
+  "mcp.auth.oauth_failed": "OAuth authentication failed.",
+  "mcp.auth.oauth_not_supported_hint": "This could mean:\n• The MCP server doesn't advertise OAuth capabilities\n• The engine needs to reload to discover server capabilities\n• Try: opencode mcp auth {server} from the CLI",
+  "mcp.auth.open_browser_signin": "We'll open your browser to finish sign-in.",
+  "mcp.auth.port_forward_hint": "Tip: forward the callback port if needed: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "Reauthorize OAuth",
+  "mcp.auth.reauth_cli_hint": "Run: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "Reauthorization failed.",
+  "mcp.auth.reauth_remote_hint": "Reauthorize from the machine running this worker.",
+  "mcp.auth.reauth_running": "Reauthorizing...",
+  "mcp.auth.reload_blocked": "Reload is paused while a session is running. Stop the run to finish setup.",
+  "mcp.auth.reload_engine_retry": "Apply changes and retry",
+  "mcp.auth.reload_failed": "Failed to reload the worker before sign-in.",
+  "mcp.auth.reload_notice": "For this to take effect, OpenWork needs to refresh the worker service. This can interrupt a running session.",
+  "mcp.auth.reload_remote_confirm": "For this to take effect, OpenWork needs to refresh the worker service. This might stop your running session. Continue?",
+  "mcp.auth.reopen_browser_link": "Click here to re-open the browser",
+  "mcp.auth.request_timed_out": "Request timed out.",
+  "mcp.auth.retry": "Retry",
+  "mcp.auth.retry_now": "Retry Now",
+  "mcp.auth.server_disabled": "This MCP server is disabled. Enable it and try again.",
+  "mcp.auth.step1_description": "We'll launch {server}'s sign-in flow automatically.",
+  "mcp.auth.step1_title": "Opening your browser",
+  "mcp.auth.step2_description": "Sign in and approve access when prompted.",
+  "mcp.auth.step2_title": "Authorize OpenWork",
+  "mcp.auth.step3_description": "We'll finish connecting as soon as authorization completes.",
+  "mcp.auth.step3_title": "Return here when you're done",
+  "mcp.auth.try_reload_engine": "{message}. Try reloading the engine first.",
+  "mcp.auth.waiting_authorization": "Waiting for authorization to complete in your browser...",
+  "mcp.auth.waiting_for_conversation_body": "We will redirect you to authenticate as soon as possible.",
+  "mcp.auth.waiting_for_conversation_title": "Waiting for conversation to complete",
+  "mcp.auth.waiting_for_session": "Waiting for {session} to finish working",
+  "mcp.available_apps": "Available apps",
+  "mcp.cap_signin": "Account sign-in",
+  "mcp.cap_tools": "AI tools",
+  "mcp.config_file": "Config file",
+  "mcp.config_load_failed": "Couldn't load the config file",
+  "mcp.config_not_loaded": "Not loaded yet",
+  "mcp.connect": "Connect",
+  "mcp.connect_failed": "Couldn't connect. Try again.",
+  "mcp.connect_server_first": "Connect to the server first.",
+  "mcp.connected": "Connected",
+  "mcp.connected_badge": "Connected",
+  "mcp.connection_failed": "Connection issue — try again",
+  "mcp.connection_type": "Connection",
+  "mcp.control_chrome_browser_hint": "In Chrome 144 or newer, do this first:",
+  "mcp.control_chrome_browser_step_one": "Open chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Enable remote debugging.",
+  "mcp.control_chrome_browser_step_three": "Allow incoming debugging connections when Chrome asks.",
+  "mcp.control_chrome_browser_title": "1. Turn on Chrome access",
+  "mcp.control_chrome_connect": "Add Control Chrome",
+  "mcp.control_chrome_docs": "Official MCP guide",
+  "mcp.control_chrome_edit": "Edit settings",
+  "mcp.control_chrome_profile_hint": "Control Chrome normally opens a separate Chrome profile. Turn this on if you want OpenWork to reuse the Chrome window you already have open.",
+  "mcp.control_chrome_profile_title": "2. Choose which Chrome to use",
+  "mcp.control_chrome_save": "Save settings",
+  "mcp.control_chrome_setup_subtitle": "Turn on Chrome access, then choose whether OpenWork should use its own clean profile or attach to the Chrome you already use.",
+  "mcp.control_chrome_setup_title": "Set up Control Chrome",
+  "mcp.control_chrome_toggle_hint": "When this is on, OpenWork adds --autoConnect so the MCP attaches to a Chrome instance you already started.",
+  "mcp.control_chrome_toggle_label": "Use my existing Chrome profile",
+  "mcp.control_chrome_toggle_off": "OpenWork will launch a separate Chrome profile just for automation.",
+  "mcp.control_chrome_toggle_on": "OpenWork will reuse your current tabs, cookies, and sign-ins.",
+  "mcp.custom_app_cta_hint": "Connect your own MCP server, internal tool, or hosted app.",
+  "mcp.desktop_required": "Apps require the desktop app.",
+  "mcp.docs_link": "Learn more",
+  "mcp.file_not_found": "Config file not created yet",
+  "mcp.friendly_status_issue": "Issue",
+  "mcp.friendly_status_needs_signin": "Sign in needed",
+  "mcp.friendly_status_offline": "Offline",
+  "mcp.friendly_status_paused": "Paused",
+  "mcp.friendly_status_ready": "Ready",
+  "mcp.last_synced": "Synced",
+  "mcp.login_action": "Sign in",
+  "mcp.login_hint": "Connect your account to finish setting up this app.",
+  "mcp.login_unavailable": "This app does not support sign-in from OpenWork.",
+  "mcp.logout_action": "Log out",
+  "mcp.logout_failed": "Failed to log out.",
+  "mcp.logout_hint": "Removes stored OAuth credentials. You'll need to sign in again.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "This will remove stored OAuth credentials for {server}. You'll need to sign in again to use this app.",
+  "mcp.logout_modal_title": "Log out of this app?",
+  "mcp.logout_success": "Logged out of {server}.",
+  "mcp.logout_working": "Logging out...",
+  "mcp.name_required": "Enter a server name.",
+  "mcp.no_apps_hint": "Connect one above to get started.",
+  "mcp.no_apps_yet": "No apps connected yet",
+  "mcp.oauth": "Sign in",
+  "mcp.oauth_optional_hint": "Uses OAuth in the browser to connect your account.",
+  "mcp.oauth_optional_label": "This app requires sign-in",
+  "mcp.one_click_connect": "One-click connect",
+  "mcp.open_file": "Open file",
+  "mcp.opening_label": "Opening...",
+  "mcp.pick_workspace_error": "Choose a workspace folder first.",
+  "mcp.pick_workspace_first": "Choose a workspace folder first.",
+  "mcp.quick_connect_chrome_desc": "Drive Chrome tabs with browser automation.",
+  "mcp.quick_connect_chrome_title": "Control Chrome",
+  "mcp.quick_connect_context7_desc": "Search product docs with richer context.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Plan sprints and ship tickets faster.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Pages, databases, and project docs in sync.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Track releases and resolve production errors.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Inspect payments, invoices, and subscriptions.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Stop the running task to activate.",
+  "mcp.remote_workspace_url_hint": "Remote workers connect fastest with URL-based MCP servers.",
+  "mcp.remove_app": "Remove",
+  "mcp.remove_failed": "Couldn't remove the app.",
+  "mcp.remove_modal_message": "Are you sure you want to remove {server}? You can always add it back later.",
+  "mcp.remove_modal_title": "Remove app",
+  "mcp.reveal_config_failed": "Couldn't open the config file",
+  "mcp.reveal_in_finder": "Show in Finder",
+  "mcp.scope_global": "All workspaces",
+  "mcp.scope_project": "This workspace",
+  "mcp.server_command": "Command",
+  "mcp.server_command_hint": "The shell command to start the server.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "App name",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Type",
+  "mcp.server_url": "Server URL",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Sign-in",
+  "mcp.tap_to_connect": "Tap to connect",
+  "mcp.technical_details": "Technical details",
+  "mcp.type_cloud": "Cloud (sign in with your account)",
+  "mcp.type_local": "Local (runs on this device)",
+  "mcp.type_local_cmd": "Local (command)",
+  "mcp.type_remote": "Remote (URL)",
+  "mcp.url_or_command_required": "Enter a URL for remote or a command for local servers.",
+  "mcp.your_apps": "Your apps",
+  "model_behavior.desc_builtin": "This model decides its own reasoning path and does not expose profiles here.",
+  "model_behavior.desc_generic": "Use the {label} profile.",
+  "model_behavior.desc_high": "Spend more time reasoning before answering.",
+  "model_behavior.desc_high_anthropic": "Use the standard extended-thinking budget.",
+  "model_behavior.desc_low": "Use a lighter reasoning pass before answering.",
+  "model_behavior.desc_low_google": "Use a lighter reasoning budget for quicker responses.",
+  "model_behavior.desc_max": "Use the provider's deepest reasoning profile.",
+  "model_behavior.desc_max_anthropic": "Use the largest extended-thinking budget available.",
+  "model_behavior.desc_medium": "Balance speed and reasoning depth.",
+  "model_behavior.desc_minimal": "Use a very small amount of reasoning.",
+  "model_behavior.desc_none": "Favor speed with the lightest reasoning path.",
+  "model_behavior.desc_standard": "This model does not expose extra reasoning controls.",
+  "model_behavior.label_balanced": "Balanced",
+  "model_behavior.label_builtin": "Built in",
+  "model_behavior.label_deep": "Deep",
+  "model_behavior.label_extended": "Extended",
+  "model_behavior.label_fast": "Fast",
+  "model_behavior.label_light": "Light",
+  "model_behavior.label_maximum": "Maximum",
+  "model_behavior.label_quick": "Quick",
+  "model_behavior.label_standard": "Standard",
+  "model_behavior.title_builtin_reasoning": "Built-in reasoning",
+  "model_behavior.title_extended_thinking": "Extended thinking",
+  "model_behavior.title_reasoning_budget": "Reasoning budget",
+  "model_behavior.title_reasoning_effort": "Reasoning effort",
+  "model_behavior.title_standard_generation": "Standard generation",
+  "model_picker.chat_model_desc": "Choose the model for this chat. If a model supports reasoning profiles, configure them on its card.",
+  "model_picker.chat_model_title": "Chat model",
+  "model_picker.connect_provider_hint": "Connect this provider to browse and save models",
+  "model_picker.default_model_desc": "Choose the default model for new chats, then fine-tune reasoning profiles on its card before pressing Done.",
+  "model_picker.default_model_title": "Default model",
+  "model_picker.model_count_one": "{count} model",
+  "model_picker.model_count_other": "{count} models",
+  "model_picker.more_providers": "More providers",
+  "model_picker.no_results": "No models match your search.",
+  "model_picker.other_connected_models": "Other connected models",
+  "model_picker.recommended": "Recommended",
+  "onboarding.authorize_folder": "Authorize folder",
+  "welcome.title": "Welcome to OpenWork",
+  "welcome.subtitle": "Your computer, but it works for you.",
+  "welcome.get_started": "Get started",
+  "welcome.capability_spreadsheets": "Edit spreadsheets",
+  "welcome.capability_spreadsheets_desc": "Create, clean, and transform CSV and Excel files.",
+  "welcome.capability_browser": "Control your browser",
+  "welcome.capability_browser_desc": "Automate Chrome for repetitive web tasks.",
+  "welcome.capability_files": "Organize files",
+  "welcome.capability_files_desc": "Read, write, and manage files and folders.",
+  "welcome.capability_automate": "Automate tasks",
+  "welcome.capability_automate_desc": "Build reusable workflows with skills and commands.",
+  "welcome.capability_content": "Generate content",
+  "welcome.capability_content_desc": "Draft documents, emails, and reports.",
+  "welcome.capability_apis": "Connect to APIs",
+  "welcome.capability_apis_desc": "Plug into external services and tools via MCP.",
+  "welcome.folder_title": "Pick a folder",
+  "welcome.folder_explanation": "This folder becomes your workspace. OpenWork will be able to:",
+  "welcome.folder_read": "Read files you put in there",
+  "welcome.folder_write": "Create and edit files for you",
+  "welcome.folder_anything": "Work with spreadsheets, docs, images \u2014 anything in the folder",
+  "welcome.folder_drop_hint": "Drop files in anytime and OpenWork can pick them up.",
+  "plugins.add": "Add",
+  "plugins.add_hint": "Add npm package names, e.g. opencode-wakatime",
+  "plugins.add_label": "Add plugin",
+  "plugins.added": "Added",
+  "plugins.config": "Config",
+  "plugins.config_label": "Config",
+  "plugins.desc": "Manage `opencode.json` for your project or global OpenCode plugins.",
+  "plugins.empty": "No plugins configured yet.",
+  "plugins.enabled": "Enabled",
+  "plugins.hide_setup": "Hide setup",
+  "plugins.not_loaded": "Not loaded yet",
+  "plugins.not_loaded_yet": "Not loaded yet",
+  "plugins.remove": "Remove",
+  "plugins.scope_global": "Global",
+  "plugins.scope_project": "Project",
+  "plugins.setup": "Setup",
+  "plugins.suggested": "Suggested plugins",
+  "plugins.suggested_heading": "Suggested plugins",
+  "plugins.title": "OpenCode plugins",
+  "providers.api_key_label": "API key",
+  "providers.api_key_required": "API key is required",
+  "providers.auth_failed": "Authentication failed",
+  "providers.connect_failed": "Failed to connect provider",
+  "providers.disabled_in_config_suffix": "and disabled it in OpenCode config.",
+  "providers.disconnect_failed": "Failed to disconnect provider",
+  "providers.disconnected_prefix": "Disconnected",
+  "providers.load_failed": "Failed to load providers",
+  "providers.no_oauth_prefix": "No OAuth flow available for",
+  "providers.no_providers_available": "No providers available",
+  "providers.not_connected": "Not connected to a server",
+  "providers.not_oauth_flow_prefix": "Selected auth method is not an OAuth flow for",
+  "providers.oauth_failed": "Failed to complete OAuth",
+  "providers.oauth_method_required": "OAuth method is required",
+  "providers.provider_error": "Provider error ({provider})",
+  "providers.provider_id_required": "Provider ID is required",
+  "providers.rate_limit_exceeded": "Rate limit exceeded",
+  "providers.removal_unsupported": "Provider auth removal is not supported by this client.",
+  "providers.request_failed": "Request failed",
+  "providers.save_api_key_failed": "Failed to save API key",
+  "providers.still_connected_suffix": ", but the worker still reports it as connected. Clear any remaining API key or OAuth credentials and restart the worker to fully disconnect.",
+  "providers.unknown_provider": "Unknown provider",
+  "providers.use_api_key_suffix": "Use an API key instead.",
+  "question_modal.custom_answer_label": "Or type a custom answer",
+  "question_modal.custom_answer_placeholder": "Type your answer here...",
+  "question_modal.question_counter": "Question {current} of {total}",
+  "session.allow_for_session": "Allow for session",
+  "session.allow_once": "Allow once",
+  "session.cmd_current_workspace": "Current workspace",
+  "session.cmd_new_session_detail": "Start a fresh task in the current workspace",
+  "session.cmd_new_session_meta": "Create",
+  "session.cmd_new_session_title": "Create new session",
+  "session.cmd_sessions_detail": "{count} available across workspaces",
+  "session.cmd_sessions_meta": "Jump",
+  "session.cmd_sessions_title": "Search sessions",
+  "session.cmd_settings_meta": "Open",
+  "session.cmd_switch": "Switch",
+  "session.palette_no_matches": "No matches.",
+  "session.create_or_connect_workspace": "Create or connect a workspace",
+  "session.default_agent": "Default agent",
+  "session.default_model": "Pick a model",
+  "session.default_title": "New session",
+  "session.delete": "Delete",
+  "session.delete_named_session_message": "This will permanently delete \"{title}\" and its messages.",
+  "session.delete_session_generic": "This will permanently delete the selected session and its messages.",
+  "session.delete_session_title": "Delete session?",
+  "session.deleting": "Deleting...",
+  "session.deny": "Deny",
+  "session.details": "Details",
+  "session.details_label": "Details",
+  "session.doom_loop_label": "Doom Loop",
+  "session.doom_loop_message": "OpenCode detected repeated tool calls with identical input and is asking whether it should continue after repeated failures.",
+  "session.doom_loop_note": "Reject to stop the loop, or allow if you want the agent to keep trying.",
+  "session.doom_loop_repeated_call_label": "Repeated call",
+  "session.doom_loop_repeated_tool_call": "Repeated tool call",
+  "session.doom_loop_title": "Doom Loop Detected",
+  "session.doom_loop_tool_label": "Tool",
+  "session.export_already_running": "Export is already running.",
+  "session.export_desktop_only": "Export is available in the desktop app.",
+  "session.export_desktop_only_local": "Export is available for local workers in the desktop app.",
+  "session.export_local_only": "Export is only supported for local workers.",
+  "session.loading_detail": "Pulling in the latest messages for this task.",
+  "session.model": "Model",
+  "session.new_task": "New task",
+  "session.open": "Open",
+  "session.palette_hint_navigate": "Arrow keys to navigate",
+  "session.palette_hint_run": "Enter to run · Esc to close",
+  "session.palette_placeholder_actions": "Search actions",
+  "session.palette_placeholder_sessions": "Find by session title or workspace",
+  "session.palette_title_actions": "Quick actions",
+  "session.palette_title_sessions": "Search sessions",
+  "session.permission_label": "Permission",
+  "session.permission_detail_command": "Command",
+  "session.permission_detail_cwd": "Working directory",
+  "session.permission_detail_description": "Description",
+  "session.permission_detail_diff": "Diff",
+  "session.permission_detail_files": "Files",
+  "session.permission_detail_file": "File",
+  "session.permission_detail_agent": "Agent",
+  "session.permission_detail_parent_directory": "Parent directory",
+  "session.permission_detail_path": "Path",
+  "session.permission_detail_query": "Query",
+  "session.permission_detail_target": "Target",
+  "session.permission_detail_tool": "Tool",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "File edit",
+  "session.permission_kind_external_directory": "External directory",
+  "session.permission_kind_question": "Question",
+  "session.permission_kind_read": "File read",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Subtask",
+  "session.permission_kind_todowrite": "Todo write",
+  "session.permission_message": "OpenCode is requesting permission to continue.",
+  "session.permission_message_bash": "Review the command scope before allowing OpenCode to continue.",
+  "session.permission_message_edit": "Review the file and diff before allowing OpenCode to make changes.",
+  "session.permission_message_external_directory": "Review the folder before allowing access outside the workspace.",
+  "session.permission_message_read": "Review the requested file scope before allowing access.",
+  "session.permission_message_task": "Review the requested subtask before allowing it to start.",
+  "session.permission_metadata_unavailable": "Metadata could not be displayed.",
+  "session.permission_review_label": "Review",
+  "session.permission_scope_empty": "No specific scope provided.",
+  "session.permission_title_bash": "Run a shell command?",
+  "session.permission_title_edit": "Modify files?",
+  "session.permission_title_external_directory": "Access an external folder?",
+  "session.permission_title_generic": "Approve {permission}?",
+  "session.permission_title_read": "Read files?",
+  "session.permission_title_task": "Start a subtask?",
+  "session.permission_decision_hint": "Allow once for this request, or allow for session when you trust this scope.",
+  "session.redo_aria_label": "Redo last reverted message",
+  "session.redo_label": "Redo",
+  "session.redo_title": "Redo last reverted message",
+  "session.rename_description": "Update the name for this session.",
+  "session.rename_label": "Session name",
+  "session.rename_placeholder": "Enter a new name",
+  "session.rename_title": "Rename session",
+  "session.resize_workspace_column": "Resize workspace column",
+  "session.revert_label": "Revert",
+  "session.scope_label": "Scope",
+  "session.select_or_create_session": "Select or create a session to get started.",
+  "session.share_collaborator_hint": "Routine remote access when you do not need owner-only actions.",
+  "session.share_collaborator_host_hint": "Routine remote access to this host without owner-only actions.",
+  "session.share_collaborator_label": "Collaborator token",
+  "session.share_connected_with_hint": "This workspace is currently connected with this password.",
+  "session.share_desktop_app_required": "Desktop app required",
+  "session.share_local_host_not_ready": "Local OpenWork host is not ready yet.",
+  "session.share_missing_host_url": "Missing OpenWork host URL.",
+  "session.share_missing_token": "Missing OpenWork token.",
+  "session.share_note_direct_runtime": "Remote access shares the currently running local worker. If you switch local folders later, reopen this panel to confirm the URL and password.",
+  "session.share_opencode_base_url": "OpenCode base URL",
+  "session.share_openwork_workers_only": "Share service links are available for OpenWork workers.",
+  "session.share_owner_permission_hint": "Use when the remote client must answer permission prompts.",
+  "session.share_password": "Password",
+  "session.share_select_workspace": "Select a workspace first.",
+  "session.share_set_token_hint": "Set token in workspace settings",
+  "session.share_starting_server": "Starting server...",
+  "session.share_worker_url": "Worker URL",
+  "session.share_worker_url_phones_hint": "Use on phones or laptops connecting to this worker.",
+  "session.share_worker_url_resolving_hint": "Worker URL is resolving; host URL shown as fallback.",
+  "session.support_docs": "Open documentation",
+  "session.support_feedback": "Open feedback",
+  "session.todo_label": "Tasks",
+  "session.todo_progress": "{completed} out of {total} tasks completed",
+  "session.todo_progress_label": "Progress",
+  "session.undo_label": "Revert",
+  "session.undo_title": "Undo last message",
+  "session.untitled": "Untitled",
+  "session.workspace_fallback": "Workspace",
+  "settings.audit_actor_host": "host",
+  "settings.audit_actor_remote": "remote",
+  "settings.api_keys_info": "API keys are stored locally by OpenCode. Environment-backed providers must be changed in the worker environment and then reloaded.",
+  "settings.appearance_hint": "Match the system or force light/dark mode.",
+  "settings.appearance_title": "Appearance",
+  "settings.audit_log_title": "Audit log",
+  "settings.auto_compact": "Auto context compaction",
+  "settings.auto_compact_desc": "Controls OpenCode compaction.auto for this workspace. Reload the engine after changing it.",
+  "settings.auto_update_desc": "Download updates automatically (prompts to",
+  "settings.auto_update_title": "Auto-update",
+  "settings.background_checks_desc": "OpenWork always checks on launch. Also checks once",
+  "settings.background_checks_title": "Background checks",
+  "settings.cache_repair_requires_desktop": "Cache repair requires the desktop app",
+  "settings.cap_browser_tools": "Browser tools: {value}",
+  "settings.cap_commands": "Commands: {value}",
+  "settings.cap_config": "Config: {value}",
+  "settings.cap_file_tools": "File tools: {value}",
+  "settings.cap_inbox_off": "inbox off",
+  "settings.cap_inbox_on": "inbox on",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "outbox off",
+  "settings.cap_outbox_on": "outbox on",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "read",
+  "settings.cap_read_only": "read only",
+  "settings.cap_read_write": "read/write",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "write",
+  "settings.cap_write_only": "write only",
+  "settings.capabilities_title": "OpenWork server capabilities",
+  "settings.capabilities_unavailable": "Capabilities unavailable. Connect with a client token.",
+  "settings.change": "Change",
+  "settings.choose": "Choose",
+  "settings.clear": "Clear",
+  "settings.config_updated": "Configuration updated. Reload the engine if the change affects OpenCode.",
+  "settings.configure": "Configure",
+  "settings.connect_provider": "Connect provider",
+  "settings.connection": "Connection",
+  "settings.connection_failed": "Connection failed",
+  "settings.connection_title": "Connection",
+  "settings.copied_debug_report": "Copied runtime report JSON.",
+  "settings.copy_json": "Copy JSON",
+  "settings.custom_binary_hint": "Use this to point OpenWork at a local OpenCode build",
+  "settings.custom_binary_label": "Custom OpenCode binary",
+  "settings.debug_base_url": "Base URL: {url}",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_connect_url": "Connect URL: {url}",
+  "settings.debug_desktop_app": "Desktop app: {version}",
+  "settings.debug_hostname": "Hostname: {hostname}",
+  "settings.debug_lan_url": "LAN URL: {url}",
+  "settings.debug_mdns_url": "mDNS URL: {url}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "OpenWork server: {version}",
+  "settings.debug_pid": "PID: {pid}",
+  "settings.debug_port": "Port: {port}",
+  "settings.debug_project_dir": "Project dir: {path}",
+  "settings.debug_remote_access": "Remote access: {value}",
+  "settings.debug_runtime": "Runtime: {runtime}",
+  "settings.error": "Error",
+  "settings.idle": "Idle",
+  "settings.loading": "Loading",
+  "settings.deeplink_hint": "Accepts openwork://, openwork-dev://, or a raw supported https://share.openworklabs.com/b/... URL.",
+  "settings.default_label": "Default",
+  "settings.delete_containers": "Removing containers...",
+  "settings.delete_local_config": "Removing local state...",
+  "settings.dev_mode_badge": "Dev mode",
+  "settings.developer": "Developer",
+  "settings.developer_mode_desc": "Enables debug tools, diagnostics, and the Developer tab.",
+  "settings.developer_mode_title": "Developer mode",
+  "settings.developer_panel_disabled": "Developer panel enabled.",
+  "settings.developer_panel_enabled": "Developer panel enabled.",
+  "settings.diag_approval": "Approval: {mode} ({ms}ms)",
+  "settings.diag_config_path": "Config path: {path}",
+  "settings.diag_default": "default",
+  "settings.diag_host_token_source": "Host token source: {source}",
+  "settings.diag_opencode_binary": "OpenCode binary: {binary}",
+  "settings.diag_read_only": "Read-only: {value}",
+  "settings.diag_runtime_workspace": "Runtime workspace: {id}",
+  "settings.diag_selected_workspace": "Selected workspace: {id}",
+  "settings.diag_started": "Started: {time}",
+  "settings.diag_token_source": "Token source: {source}",
+  "settings.diag_workspaces": "Workspaces: {count}",
+  "settings.diagnostics_unavailable": "Diagnostics unavailable.",
+  "settings.disable_developer_mode": "Disable Developer Mode",
+  "settings.disabled": "Disabled",
+  "settings.disconnect": "Disconnect",
+  "settings.disconnect_server": "Disconnect server",
+  "settings.disconnecting": "Disconnecting...",
+  "settings.docker_containers_desc": "Force-remove Docker containers launched by OpenWork",
+  "settings.docker_containers_title": "OpenWork Docker containers",
+  "settings.docker_requires_desktop": "Docker cleanup requires the desktop app",
+  "settings.done": "Done",
+  "settings.enable_developer_mode": "Enable Developer Mode",
+  "settings.enable_exa": "Enable Exa web search",
+  "settings.enable_exa_desc": "Applies the next time OpenCode is started by OpenWork. Off by default.",
+  "settings.engine_bundled": "Bundled (recommended)",
+  "settings.engine_bundled_hint": "Bundled engine is the most reliable option. Use System",
+  "settings.engine_custom_binary": "Custom binary",
+  "settings.engine_desc": "Choose how OpenCode runs locally.",
+  "settings.engine_source": "Engine source",
+  "settings.engine_source_debug": "Engine source",
+  "settings.engine_system_path": "System install (PATH)",
+  "settings.engine_title": "Engine",
+  "settings.exa_restart_hint": "Restart OpenCode after changing this setting.",
+  "settings.export": "Export",
+  "settings.exported_debug_report": "Exported runtime report JSON.",
+  "settings.feedback_badge": "We read every message",
+  "settings.feedback_desc": "Tell us what feels great and what feels rough. Feedback goes straight to the team and helps us prioritize what ships next.",
+  "settings.feedback_title": "Help shape OpenWork",
+  "settings.group_global": "Global",
+  "settings.group_workspace": "Workspace",
+  "settings.hide_titlebar": "Hide titlebar",
+  "settings.hide_titlebar_desc": "Hide the window titlebar. Useful for tiling window",
+  "settings.join_discord": "Join Discord",
+  "settings.language": "Language",
+  "settings.language.description": "Choose your preferred language",
+  "settings.last_error": "Last error",
+  "settings.last_stderr": "Last stderr",
+  "settings.last_stdout": "Last stdout",
+  "settings.loading_providers": "Loading providers...",
+  "settings.managed_by_env": "Managed by env",
+  "settings.model": "Model",
+  "settings.model_behavior": "Model behavior",
+  "settings.model_behavior_desc": "Open the default model picker to choose reasoning profiles when they are available.",
+  "settings.model_section_desc": "Pick the default chat model and review how it reasons.",
+  "settings.model_title": "Model",
+  "settings.no_active_workspace": "No active local workspace.",
+  "settings.no_providers_connected": "No providers connected yet.",
+  "settings.no_audit_entries": "No audit entries yet.",
+  "settings.no_custom_path_set": "No custom path set",
+  "settings.nuke_hint": "Use this only when you want to fully reset the desktop app and its OpenCode runtime state.",
+  "settings.off": "Off",
+  "settings.on": "On",
+  "settings.open_deeplink_action": "Opening...",
+  "settings.open_deeplink_button": "Hide",
+  "settings.open_deeplink_desc": "Paste an OpenWork deeplink or share URL to open it.",
+  "settings.open_deeplink_failed": "Failed to open deeplink",
+  "settings.open_deeplink_title": "Open Deeplink",
+  "settings.opencode_cache": "OpenCode cache",
+  "settings.opencode_cache_description": "Repairs cached data used to start the engine. Safe to run.",
+  "settings.opencode_engine_desc": "Local runtime for agents, tools, and model providers.",
+  "settings.opencode_engine_label": "OpenCode engine",
+  "settings.opencode_engine_sidecar": "OpenCode engine",
+  "settings.opencode_engine_sidecar_desc": "Local OpenCode process managed by OpenWork.",
+  "settings.opencode_sdk_desc": "Browser → engine connection.",
+  "settings.opencode_sdk_title": "OpenCode SDK link",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Open deeplink",
+  "settings.openwork_config_sidecar_desc": "Local OpenWork server (Bun) that hosts approvals, audit, and OpenCode lifecycle.",
+  "settings.openwork_diagnostics_title": "OpenWork server diagnostics",
+  "settings.openwork_server_desc": "Session control plane for app sync, workers, and remote",
+  "settings.openwork_server_label": "OpenWork server",
+  "settings.pending_permissions": "Pending permissions",
+  "settings.production_mode_badge": "Production",
+  "settings.provider_default_desc": "Use the model's built-in default reasoning behavior.",
+  "settings.provider_default_label": "Provider default",
+  "settings.provider_source_config": "Config",
+  "settings.provider_source_custom": "Custom",
+  "settings.provider_source_env": "Environment",
+  "settings.providers_desc": "Connect services for models and tools.",
+  "settings.providers_title": "Providers",
+  "settings.quit_hint": "OpenWork quits immediately after cleanup so the next launch starts from a blank local state for this mode.",
+  "settings.recent_events": "Recent events",
+  "settings.reconnect_failed": "Reconnect failed. Check server URL/token and try again.",
+  "settings.reconnect_server": "Reconnecting...",
+  "settings.reconnect_server_failed": "Failed to reconnect OpenWork server.",
+  "settings.reconnected": "Reconnected to OpenWork server.",
+  "settings.reconnecting": "Reconnecting...",
+  "settings.removing_containers": "Removing containers...",
+  "settings.removing_local_state": "Removing local state...",
+  "settings.repair_cache": "Repair cache",
+  "settings.repairing_cache": "Repairing cache",
+  "settings.report_issue": "Report an issue",
+  "settings.reset": "Reset",
+  "settings.reset_app_data": "Reset app data",
+  "settings.reset_app_data_description": "More aggressive. Clears OpenWork cache + app data.",
+  "settings.reset_app_data_title": "Reset app data",
+  "settings.reset_app_data_warning": "Clears OpenWork cache and app data on this device.",
+  "settings.reset_button": "Reset",
+  "settings.reset_cancel": "Cancel",
+  "settings.reset_config_defaults": "Resetting...",
+  "settings.reset_confirm_button": "Reset & Restart",
+  "settings.reset_confirmation_hint": "Type {resetWord} to confirm. OpenWork will restart.",
+  "settings.reset_confirmation_label": "Confirmation",
+  "settings.reset_confirmation_placeholder": "Type RESET",
+  "settings.reset_onboarding": "Reset onboarding",
+  "settings.reset_onboarding_description": "Clears OpenWork preferences and restarts the app.",
+  "settings.reset_onboarding_title": "Reset onboarding",
+  "settings.reset_onboarding_warning": "Clears OpenWork local preferences and workspace onboarding markers.",
+  "settings.reset_openwork_desc_dev": "With dev mode active, it only clears the isolated OpenCode dev state inside openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "With dev mode active, it only clears the isolated OpenCode dev state inside openwork-dev-data.",
+  "settings.reset_openwork_title": "Reset OpenWork + OpenCode state",
+  "settings.reset_requires_confirm": "Requires typing RESET and will restart the app.",
+  "settings.reset_startup": "Reset default startup mode",
+  "settings.reset_startup_pref": "Reset startup preference",
+  "settings.reset_stop_active_runs": "Stop active runs before resetting.",
+  "settings.resetting": "Resetting...",
+  "settings.restart_blocked_message": "OpenWork needs to restart to finish this update. To avoid interrupting your current work, install is paused until your active runs finish or you stop them.",
+  "settings.restart_failed": "Restart failed. Check logs and try again.",
+  "settings.restart_opencode": "Restart OpenCode",
+  "settings.restart_openwork_server": "Restart OpenWork server",
+  "settings.restart_server_failed": "Failed to restart local server.",
+  "settings.restarted": "Restarted local server.",
+  "settings.restarting": "Restarting…",
+  "settings.restart_succeeded_template": "Restarted {service}.",
+  "settings.restart_failed_template": "Failed to restart {service}.",
+  "settings.copy_logs": "Copy logs",
+  "settings.copied_service_logs": "Copied {service} logs.",
+  "settings.no_logs_captured": "No logs captured yet.",
+  "settings.exported_developer_log": "Exported developer log.",
+  "settings.developer_log_title": "Developer log stream",
+  "settings.developer_log_desc": "App, workspace, session, and perf events captured while Developer Mode is on.",
+  "settings.developer_log_count": "Showing the latest {count} retained records.",
+  "settings.developer_log_empty": "No developer logs captured yet.",
+  "settings.services_section_title": "Services",
+  "settings.services_section_desc": "Local services that power this OpenWork session. Each service has its own restart and logs.",
+  "settings.activity_section_title": "Activity",
+  "settings.activity_section_desc": "Audit trail and recent runtime events.",
+  "settings.tools_section_title": "Tools",
+  "settings.tools_section_desc": "Probes and binary pickers for diagnosing local execution.",
+  "settings.recovery_section_title": "Reset & recovery",
+  "settings.recovery_section_desc": "Roll back state without quitting OpenWork.",
+  "settings.danger_section_title": "Danger zone",
+  "settings.danger_section_desc": "Irreversible actions. Use only when you understand the consequences.",
+  "settings.clear_button": "Clear",
+  "settings.copy_log_button": "Copy log",
+  "settings.export_log_button": "Export .log",
+  "settings.reveal_config": "Reveal config",
+  "settings.reveal_config_requires_desktop": "Reveal config requires the desktop app",
+  "settings.run_sandbox_probe": "Running probe...",
+  "settings.running_probe": "Running probe...",
+  "settings.runtime_debug_desc": "Readable diagnostics snapshot with one-click export.",
+  "settings.runtime_debug_title": "Runtime debug report",
+  "settings.runtime_desc": "Status for your local engine and OpenWork server.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Error",
+  "settings.sandbox_export_hint": "Use Export in Runtime debug report above to",
+  "settings.sandbox_probe_desc": "Runs a temporary Docker sandbox startup check and",
+  "settings.sandbox_probe_success": "Sandbox probe succeeded. Export the debug report for support.",
+  "settings.sandbox_probe_title": "Sandbox probe",
+  "settings.sandbox_ready": "Ready",
+  "settings.sandbox_requires_desktop": "Sandbox probe requires desktop app",
+  "settings.sandbox_result": "Result: {status}",
+  "settings.sandbox_run_id": "Run ID: {id}",
+  "settings.sandbox_stop_runs_hint": "Stop active runs before probing",
+  "settings.search_models": "Search models…",
+  "settings.send_feedback": "Send feedback",
+  "settings.show_model_reasoning": "Show model reasoning",
+  "settings.show_model_reasoning_desc": "Expand reasoning traces in the UI when a model exposes them.",
+  "settings.showing_models": "Showing {count} of {total}",
+  "settings.startup": "Startup",
+  "settings.startup_remote_warning": "Startup preference is currently remote. Engine settings",
+  "settings.startup_reset_hint": "This clears your saved preference and shows the connection",
+  "settings.startup_title": "Startup",
+  "settings.stop_local_server": "Stop local server",
+  "settings.stop_runs_before_cleanup": "Stop active runs before cleanup",
+  "settings.stop_runs_before_reset_config": "Stop active runs before resetting config",
+  "settings.stop_runs_to_reset": "Stop active runs to reset",
+  "settings.switch": "Switch",
+  "settings.tab_advanced": "Advanced",
+  "settings.tab_appearance": "Appearance",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Debug",
+  "settings.tab_description_advanced": "Inspect runtime health, connection state, and developer-facing controls.",
+  "settings.tab_description_appearance": "Adjust how OpenWork looks across desktop, system theme, and app chrome.",
+  "settings.tab_description_debug": "Review runtime diagnostics, logs, and low-level debugging utilities.",
+  "settings.tab_description_den": "Manage your OpenWork Cloud connection, hosted workers, and workspace access.",
+  "settings.tab_description_extensions": "Manage MCP apps and OpenCode plugins for this workspace.",
+  "settings.tab_description_general": "Connect providers, choose the default model, authorize folders, and control the selected OpenWork workspace plus its runtime connection.",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_recovery": "Repair migration state, reset workspace defaults, and recover local settings.",
+  "settings.tab_description_skills": "Browse, edit, and install skills without leaving settings.",
+  "settings.tab_description_updates": "Keep the app current with quiet background checks and install controls.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Extensions",
+  "settings.tab_general": "Settings",
+  "settings.tab_recovery": "Recovery",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Updates",
+  "settings.theme_dark": "Dark",
+  "settings.theme_light": "Light",
+  "settings.theme_system": "System",
+  "settings.theme_system_hint": "System mode follows your OS preference automatically.",
+  "settings.update": "Update",
+  "settings.update_available": "Update available: v",
+  "settings.update_available_version": "Update available: v{version}",
+  "settings.update_check_button": "Check",
+  "settings.update_check_failed": "Update check failed",
+  "settings.update_checking": "Checking...",
+  "settings.update_download_button": "Download",
+  "settings.update_downloading": "Downloading...",
+  "settings.update_install_button": "Install & Restart",
+  "settings.update_last_checked": "Last checked {time}",
+  "settings.update_published": "Published {date}",
+  "settings.update_ready": "Ready to install: v",
+  "settings.update_ready_version": "Ready to install: v{version}",
+  "settings.update_uptodate": "Up to date",
+  "settings.updates": "Updates",
+  "settings.updates_desc": "Keep OpenWork up to date.",
+  "settings.updates_desktop_only": "Updates are only available in the desktop app.",
+  "settings.updates_not_supported": "Updates are not supported in this environment.",
+  "settings.updates_title": "Updates",
+  "settings.window_appearance_desc": "Customize window appearance.",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Workspace config",
+  "settings.workspace_debug_events_label": "Workspace debug events",
+  "share.back_hint": "Back to share options",
+  "share.chooser_subtitle": "Choose how you want to share this workspace.",
+  "share.close_hint": "Close",
+  "share.option_access_desc": "Reveal the live connection details needed to reach this running workspace from another machine.",
+  "share.option_access_title": "Access workspace remotely",
+  "share.subtitle_access": "Reveal the live connection details needed to reach this workspace from another machine.",
+  "share.title": "Share workspace",
+  "share.view_access": "Access workspace remotely",
+  "share.workspace_fallback": "Workspace",
+  "share_skill_destination.add_to_workspace": "Add skill to workspace",
+  "share_skill_destination.adding": "Adding skill...",
+  "share_skill_destination.connect_remote": "Connect remote workspace",
+  "share_skill_destination.connect_remote_hint": "Attach an OpenWork host, then choose it from the list to import this skill.",
+  "share_skill_destination.create_worker": "Create new workspace",
+  "share_skill_destination.create_worker_hint": "Open the workspace setup flow, then add this skill after the new workspace is ready.",
+  "share_skill_destination.current_badge": "Current",
+  "share_skill_destination.existing_workers": "Existing workspaces",
+  "share_skill_destination.fallback_skill_name": "Shared skill",
+  "share_skill_destination.local_badge": "Local",
+  "share_skill_destination.more_options": "More options",
+  "share_skill_destination.no_workers": "No workspaces are ready yet. Create one or connect a remote workspace to install this skill.",
+  "share_skill_destination.remote_badge": "Remote",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Selected",
+  "share_skill_destination.selected_hint": "Selected. Review the destination below, then confirm.",
+  "share_skill_destination.skill_label": "Shared skill",
+  "share_skill_destination.subtitle": "Choose an existing workspace or create a new one before importing this shared skill.",
+  "share_skill_destination.title": "Where should this skill go?",
+  "share_skill_destination.trigger_label": "Trigger",
+  "sidebar.collapse": "Collapse",
+  "sidebar.expand": "Expand",
+  "skills.add_custom_repo": "Add custom GitHub repo",
+  "skills.add_git_repo": "Add git repo",
+  "skills.add_openwork_hub": "Add OpenWork Hub",
+  "skills.available_from_hub": "Available from Hub",
+  "skills.catalog_search_placeholder": "Search installed, team, and hub skills",
+  "skills.cloud_choose_org_detail": "Use the Cloud panel to pick your active org, then refresh this list.",
+  "skills.cloud_choose_org_hint": "Choose an organization in Settings → Cloud to load team skills.",
+  "skills.cloud_footer_label": "Team",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "Installed {name} on this worker.",
+  "skills.cloud_installed_as": "Installed as {name}",
+  "skills.cloud_installing": "Installing {title}…",
+  "skills.cloud_installing_short": "Installing",
+  "skills.cloud_no_search_matches": "No skills match that search.",
+  "skills.cloud_org_empty": "No organization skills are available yet.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "Failed to load organization skills.",
+  "skills.cloud_refresh": "Refresh team skills",
+  "skills.cloud_section_subtitle": "Skills shared with you through OpenWork Cloud — including team skill hubs you can access.",
+  "skills.cloud_section_title": "From your organization",
+  "skills.cloud_shared_org": "Org",
+  "skills.cloud_shared_private": "Private",
+  "skills.cloud_shared_public": "Public",
+  "skills.cloud_sign_in": "Sign in to Cloud",
+  "skills.cloud_sign_in_hint": "Sign in to OpenWork Cloud to browse team and org skills.",
+  "skills.cloud_status_installed": "Installed",
+  "skills.cloud_status_update": "Update available",
+  "skills.cloud_update_skill": "Update",
+  "skills.cloud_updated": "Updated {name} on this worker.",
+  "skills.cloud_updating": "Updating {title}…",
+  "skills.cloud_removed": "Removed local cloud skill {name}.",
+  "skills.copy_link_failed": "Failed to copy link",
+  "skills.create_in_chat": "Create skill in chat",
+  "skills.desktop_required": "Skill management requires the desktop app.",
+  "skills.enter_plugin_name": "Enter a plugin package name.",
+  "skills.failed_load_active": "Failed to load active plugins.",
+  "skills.failed_load_opencode": "Failed to load opencode.json",
+  "skills.failed_parse_opencode": "Failed to parse opencode.json",
+  "skills.failed_to_load": "Failed to load skills",
+  "skills.failed_update_opencode": "Failed to update opencode.json",
+  "skills.filter_all": "All",
+  "skills.filter_cloud": "Team",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Installed",
+  "skills.from_repo": "From {owner}/{repo}",
+  "skills.github_repo_hint": "Enter a GitHub repo in owner/repo format.",
+  "skills.host_mode_only": "Local workspace only",
+  "skills.host_only_error": "Skill management requires a local workspace or connected OpenWork server.",
+  "skills.hub_desc": "Browse shared skills from GitHub-backed hubs and add them to this worker.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Import",
+  "skills.import_failed": "Import failed ({status})",
+  "skills.import_local": "Import local skill",
+  "skills.import_local_skill": "Import local skill",
+  "skills.imported": "Imported.",
+  "skills.install": "Install",
+  "skills.install_failed": "Skill install failed.",
+  "skills.install_name_title": "Install {name}",
+  "skills.installed": "Installed skills",
+  "skills.installed_desc": "Installed skills live on this worker and can be edited or shared.",
+  "skills.installed_status": "Installed",
+  "skills.installing": "Add skill",
+  "skills.installing_prefix": "Installing {name}…",
+  "skills.installing_skill_creator": "Installing skill creator...",
+  "skills.link_copied": "Link copied",
+  "skills.loading": "Loading…",
+  "skills.no_description": "No description yet.",
+  "skills.no_hub_repo_label": "No hub repo selected",
+  "skills.no_hub_repo_selected": "No hub skills available.",
+  "skills.no_hub_skills": "No hub repo selected. Add a GitHub repo to browse skills.",
+  "skills.no_opencode_found": "No opencode.json found yet. Add a plugin to create one.",
+  "skills.no_opencode_workspace": "No opencode.json in this workspace yet.",
+  "skills.no_skills": "No skills detected in `.opencode/skills`, `.claude/skills`, or `~/.agents/skills`.",
+  "skills.no_skills_found": "No skills found yet.",
+  "skills.owner_label": "Owner",
+  "skills.owner_repo_required": "Owner and repo are required.",
+  "skills.pick_project_first": "Pick a project folder first.",
+  "skills.pick_project_for_active": "Pick a project folder to load active plugins.",
+  "skills.pick_project_for_plugins": "Pick a project folder to manage project plugins.",
+  "skills.pick_workspace_first": "Pick a workspace folder first.",
+  "skills.plugin_already_listed": "Plugin already listed in opencode.json.",
+  "skills.plugin_management_host_only": "Plugin management requires the desktop app.",
+  "skills.plugins_host_only": "Plugins are only available in the desktop app.",
+  "skills.ref_label": "Ref (branch/tag/commit)",
+  "skills.refresh": "Refresh",
+  "skills.refresh_hub": "Refresh hub",
+  "skills.remove_saved_repo": "Remove saved repo",
+  "skills.repo_label": "Repo",
+  "skills.reveal_failed": "Failed to open skills folder.",
+  "skills.reveal_folder": "Open skills folder",
+  "skills.save_and_load": "Save and load",
+  "skills.select_skill_folder": "Select skill folder",
+  "skills.share_back": "Back",
+  "skills.share_chooser_subtitle": "Save to your OpenWork Cloud organization or publish a public install link.",
+  "skills.share_close": "Close",
+  "skills.share_copy_link": "Copy",
+  "skills.share_done": "Done",
+  "skills.share_option_public_desc": "Create a link anyone can use to install this skill.",
+  "skills.share_option_public_title": "Public link",
+  "skills.share_option_team_desc": "Add this skill to your active OpenWork Cloud organization.",
+  "skills.share_option_team_title": "Share with team",
+  "skills.share_public_create": "Create link",
+  "skills.share_public_creating": "Publishing…",
+  "skills.share_public_intro": "Publish a public link. Anyone with the URL can install this skill.",
+  "skills.share_public_regenerate": "Regenerate link",
+  "skills.share_publisher_label": "Publisher",
+  "skills.share_subtitle_public": "Anyone with the link can install this skill.",
+  "skills.share_subtitle_team": "Stored in your organization for teammates.",
+  "skills.share_team_choose_org": "Choose an organization in Settings → Cloud before sharing with your team.",
+  "skills.share_team_permissions_intro": "Upload this skill to your active OpenWork Cloud organization and decide who can see it.",
+  "skills.share_team_permissions_label": "Sharing Permissions",
+  "skills.share_team_permission_org": "Organization Only - Not in hub",
+  "skills.share_team_permission_private": "Private for me only",
+  "skills.share_team_hubs_loading": "Loading hubs…",
+  "skills.share_team_org_fallback": "Active Cloud org",
+  "skills.share_team_upload_and_save": "Upload and save",
+  "skills.share_team_uploading": "Uploading…",
+  "skills.share_team_sign_in": "Sign in to share with team",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud opens in your browser. Return here after signing in.",
+  "skills.share_team_uploaded_success": "Uploaded to {org}. Cloud skills will refresh for your account.",
+  "skills.share_title": "Share skill",
+  "skills.shown_count": "{count} shown",
+  "skills.skill_creator_already_installed": "Skill creator is already installed.",
+  "skills.skill_creator_installed": "Skill creator installed.",
+  "skills.skill_load_failed": "Failed to load skill.",
+  "skills.source_label": "Source",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Trigger: {trigger}",
+  "skills.uninstall": "Uninstall",
+  "skills.uninstall_failed": "Failed to uninstall skill.",
+  "skills.uninstall_title": "Uninstall skill?",
+  "skills.uninstall_warning": "This will permanently delete the `{name}` skill from your workspace.",
+  "skills.uninstalled": "Skill removed.",
+  "skills.unknown_error": "Unknown error",
+  "skills.worker_profile_desc": "Skills are the core abilities of this worker. Discover them from Hub, manage what is installed, and create new ones directly in chat.",
+  "status.back": "Back to previous screen",
+  "status.connected": "Connected",
+  "status.connecting": "Connecting",
+  "status.creating_task": "Creating new task",
+  "status.developer_mode": "Developer mode",
+  "status.disconnected": "Disconnected",
+  "status.disconnected_hint": "Open settings to reconnect",
+  "status.disconnected_label": "Disconnected",
+  "status.docs": "Docs",
+  "status.feedback": "Feedback",
+  "status.limited_hint": "Reconnect to restore full OpenWork features",
+  "status.limited_mcp_hint": "{count} MCP connected · reconnect for full features",
+  "status.limited_mode": "Limited Mode",
+  "status.loading_session": "Loading session",
+  "status.mcp_connected": "{count} MCP connected",
+  "status.open_docs": "Open documentation",
+  "status.openwork_ready": "OpenWork Ready",
+  "status.providers_connected_one": "{count} provider connected",
+  "status.providers_connected_other": "{count} providers connected",
+  "status.ready_for_tasks": "Ready for new tasks",
+  "status.running": "Running",
+  "status.send_feedback": "Send feedback",
+  "status.settings": "Settings",
+  "system.reload_body_agents": "OpenCode loads agents at startup. Reload the engine to make updated agents available.",
+  "system.reload_body_commands": "OpenCode loads commands at startup. Reload the engine to make updated commands available.",
+  "system.reload_body_config": "OpenCode reads opencode.json at startup. Reload the engine to apply configuration changes.",
+  "system.reload_body_default": "OpenWork detected changes that require reloading the OpenCode instance.",
+  "system.reload_body_mcp": "OpenCode loads MCP servers at startup. Reload the engine to activate the new connection.",
+  "system.reload_body_mixed": "OpenWork detected OpenCode configuration changes. Reload the engine to apply them.",
+  "system.reload_body_plugins": "OpenCode loads npm plugins at startup. Reload the engine to apply opencode.json changes.",
+  "system.reload_body_skills": "OpenCode can cache skill discovery/state. Reload the engine to make newly installed skills available.",
+  "system.reload_failed": "Failed to reload the engine.",
+  "system.reload_required": "Reload required",
+  "system.reload_unavailable": "Reload is unavailable for this worker.",
+  "system.stop_active_runs_before_reset": "Stop active runs before resetting.",
+  "time.hours_ago": "{count}h ago",
+  "time.just_now": "just now",
+  "time.minutes_ago": "{count}m ago",
+  "time.seconds_ago": "{count}s ago",
+  "workspace.create_workspace": "Create workspace",
+  "workspace.empty_state_body": "Create or connect a workspace to get started.",
+  "workspace.loading_tasks": "Loading tasks...",
+  "workspace.local_badge": "Local",
+  "workspace.new_task_inline": "+ New task",
+  "workspace.no_tasks": "No tasks yet.",
+  "workspace.remote_badge": "Remote",
+  "workspace.rename_description": "Update the name shown in the sidebar.",
+  "workspace.rename_label": "Workspace name",
+  "workspace.rename_placeholder": "Design team workspace",
+  "workspace.rename_title": "Edit workspace name",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Selected",
+  "workspace_list.add_workspace": "Add workspace",
+  "workspace_list.connecting": "Connecting...",
+  "workspace_list.delete_session": "Delete session",
+  "workspace_list.edit_connection": "Edit connection",
+  "workspace_list.edit_name": "Edit name",
+  "workspace_list.hide_child_sessions": "Hide child sessions",
+  "workspace_list.recover": "Recover",
+  "workspace_list.remove_confirm": "Remove this workspace from the sidebar? Sessions and files on disk are preserved.",
+  "workspace_list.remove_workspace": "Remove workspace",
+  "workspace_list.rename_session": "Rename session",
+  "workspace_list.remote_worker_unavailable": "Remote worker unavailable",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork can't load tasks from this worker until the connection is fixed.",
+  "workspace_list.reveal_explorer": "Reveal in Explorer",
+  "workspace_list.reveal_finder": "Reveal in Finder",
+  "workspace_list.session_actions": "Session actions",
+  "workspace_list.share": "Share...",
+  "workspace_list.show_child_sessions": "Show child sessions",
+  "workspace_list.show_more": "Show {count} more",
+  "workspace_list.show_more_fallback": "Show more",
+  "workspace_list.test_connection": "Test connection",
+  "workspace_list.unavailable": "Unavailable",
+  "workspace_list.workspace_fallback": "Workspace",
+  "workspace_list.workspace_options": "Workspace options",
+} as const;
diff --git a/apps/app/src/i18n/locales/es.ts b/apps/app/src/i18n/locales/es.ts
new file mode 100644
index 0000000000..c115d68a88
--- /dev/null
+++ b/apps/app/src/i18n/locales/es.ts
@@ -0,0 +1,1417 @@
+/**
+ * Spanish translations (Español)
+ * Professional terms (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) are NOT translated
+ */
+
+export default {
+  "app.compact_command_desc": "Resume esta sesión para reducir el contexto.",
+  "app.error_audit_load": "No se pudo cargar el audit log.",
+  "app.error_auth_failed": "Error de autenticación",
+  "app.error_command_not_resolved": "No se pudo resolver el Commando.",
+  "app.error_compact_empty": "Nada que compactar todavía.",
+  "app.error_compact_no_session": "Selecciona una sesión con mensajes antes de ejecutar /compactar.",
+  "app.error_compact_no_session_id": "Selecciona una sesión antes de compactar.",
+  "app.error_connect_first": "Conecta a este worker antes de realizar cambios del runtime.",
+  "app.error_not_connected": "No conectado a un servidor",
+  "app.error_rate_limit": "Has superado el límite de peticiones",
+  "app.error_remote_access": "No se pudo actualizar el acceso remoto.",
+  "app.error_request_failed": "Solicitud fallida",
+  "app.error_restart_local_worker": "No se pudo reiniciar el worker local con la configuración de uso compartido actualizada.",
+  "app.error_session_name_required": "El nombre de la sesión es obligatorio.",
+  "app.local_disabled_reason": "Crea workspaces locales en la app de escritorio. Los workspaces remotos y compartidos siguen funcionando aquí.",
+  "app.model_behavior_title": "Comportamiento del modelo",
+  "app.plugins_hint_readonly": "El servidor de OpenWork es de solo lectura para Plugins.",
+  "app.reload_later": "Más tarde",
+  "app.reload_now": "Recargar ahora",
+  "app.reload_stop_tasks": "Recargar y detener tareas",
+  "app.skills_hint_readonly": "El servidor de OpenWork es de solo lectura para Skills. Añade un token de host en Avanzado para poder instalarlas.",
+  "app.unknown_error": "Error desconocido",
+  "blueprint.automation_body": "Empieza con un flujo de trabajo reutilizable o escribe tu propia tarea abajo.",
+  "blueprint.automation_title": "¿Qué quieres automatizar?",
+  "blueprint.csv_session_assistant": "Puedo ayudarte a generar, limpiar, fusionar y resumir archivos CSV. ¿Qué tipo de trabajo con CSV quieres automatizar?",
+  "blueprint.csv_session_title": "Ideas de flujo de trabajo CSV",
+  "blueprint.csv_session_user": "Quiero combinar exportaciones de múltiples herramientas en un CSV limpio.",
+  "blueprint.empty_body": "Elige un punto de partida o simplemente escribe abajo.",
+  "blueprint.empty_title": "¿Qué quieres hacer?",
+  "blueprint.minimal_body": "Haz una pregunta sobre este espacio de trabajo o usa un prompt inicial.",
+  "blueprint.minimal_title": "Empezar con una tarea",
+  "blueprint.starter_blueprint_desc": "Diseña un flujo de trabajo repetible con Skills, Commands y pasos de handoff.",
+  "blueprint.starter_blueprint_prompt": "Ayúdame a diseñar un blueprint de automatización reutilizable para este espacio de trabajo. Pregunta qué conviene estandarizar y luego propón el flujo de trabajo.",
+  "blueprint.starter_blueprint_title": "Planificar un blueprint de automatización",
+  "blueprint.starter_chrome_desc": "Inicia una conversación sobre automatización del navegador de inmediato.",
+  "blueprint.starter_chrome_prompt": "Ayúdame a conectarme a Chrome y automatizar una tarea repetitiva.",
+  "blueprint.starter_chrome_title": "Automatizar Chrome",
+  "blueprint.starter_command_desc": "Convierte un flujo de trabajo repetido en un /command para este espacio de trabajo.",
+  "blueprint.starter_command_prompt": "Ayúdame a crear un /command reutilizable para este espacio de trabajo. Pregunta qué flujo de trabajo quiero automatizar y luego redacta el Command.",
+  "blueprint.starter_command_title": "Crear un /command reutilizable",
+  "blueprint.starter_connect_openai_desc": "Añade tu proveedor de OpenAI para que los modelos ChatGPT estén listos en las sesiones nuevas.",
+  "blueprint.starter_connect_openai_title": "Conectar ChatGPT",
+  "blueprint.starter_csv_desc": "Limpiar o generar datos de hojas de cálculo.",
+  "blueprint.starter_csv_prompt": "Ayúdame a crear o editar archivos CSV en este ordenador.",
+  "blueprint.starter_csv_title": "Trabajar en un CSV",
+  "blueprint.starter_explore_desc": "Resume los archivos y sugiere la mejor tarea para empezar.",
+  "blueprint.starter_explore_prompt": "Resume este espacio de trabajo, señala los archivos más importantes y sugiere la mejor tarea para empezar.",
+  "blueprint.starter_explore_title": "Explorar este espacio de trabajo",
+  "blueprint.welcome_message": "Hola, te damos la bienvenida a OpenWork.\n\nLa gente usa OpenWork para crear archivos .csv en su ordenador, conectarse a Chrome, automatizar tareas repetitivas y sincronizar contactos con Notion.\n\nPero puedes ir mucho más allá.\n\n¿Qué te apetece hacer?",
+  "blueprint.welcome_title": "Bienvenido a OpenWork",
+  "common.add": "Añadir",
+  "common.cancel": "Cancelar",
+  "common.close": "Cerrar",
+  "common.default_parens": "(predeterminado)",
+  "common.edit": "Editar",
+  "common.hide": "Ocultar",
+  "common.navigate": "navegar",
+  "common.next": "Siguiente",
+  "common.off": "Desactivado",
+  "common.on": "Activado",
+  "common.path": "Ruta",
+  "common.question": "Pregunta",
+  "common.refresh": "Actualizar",
+  "common.remove": "Eliminar",
+  "common.reset": "Restablecer",
+  "common.save": "Guardar",
+  "common.select": "seleccionar",
+  "common.show": "Mostrar",
+  "common.something_went_wrong": "Algo salió mal",
+  "common.submit": "Enviar",
+  "common.unknown": "Desconocido",
+  "composer.agent_label": "Agente",
+  "composer.attach_files": "Adjuntar archivos",
+  "composer.attachments_unavailable": "Los archivos adjuntos no están disponibles.",
+  "composer.behavior_label": "Comportamiento",
+  "composer.configure": "Configurar",
+  "composer.default_agent": "Agente predeterminado",
+  "composer.file_exceeds_limit": "{name} supera el límite de 8 MB.",
+  "composer.file_kind": "Archivo",
+  "composer.image_kind": "Imagen",
+  "composer.inserted_links_unsupported": "Enlaces insertados para archivos no compatibles.",
+  "composer.loading_commands": "Cargando Commands...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "No se encontraron Commands.",
+  "composer.placeholder": "Describe tu tarea...",
+  "composer.remote_worker_paste_warning": "Este es un worker remoto. Los sandboxes también son remotos. Para compartir archivos con él, súbelos a la carpeta compartida de la barra lateral.",
+  "composer.run_task": "Ejecutar tarea",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Detener",
+  "composer.tools_label": "Commands, Skills y MCPs",
+  "composer.unsupported_attachment_type": "Tipo de archivo adjunto no admitido.",
+  "composer.upload_to_shared_folder": "Subir a la carpeta compartida",
+  "composer.uploaded_multiple_files": "Se subieron {count} archivos a la carpeta compartida y se añadieron enlaces.",
+  "composer.uploaded_single_file": "Se subió {name} a la carpeta compartida y se agregó un enlace.",
+  "config.collaborator_token_disabled_hint": "Almacenado de antemano para compartirlo de forma remota, pero el acceso remoto está actualmente deshabilitado.",
+  "config.collaborator_token_label": "Token de colaborador",
+  "config.collaborator_token_remote_hint": "Acceso remoto habitual para móviles o portátiles que se conectan a este servidor.",
+  "config.connection_failed": "La conexión falló.",
+  "config.connection_failed_check": "La conexión ha fallado. Comprueba la URL del host y el token.",
+  "config.connection_status_updated": "Estado de conexión actualizado.",
+  "config.connection_successful": "Conexión exitosa.",
+  "config.copied": "Copiado",
+  "config.copy": "Copiar",
+  "config.desktop_only_hint": "Algunas funciones de configuración (uso compartido del servidor local + puente de mensajería) requieren la app de escritorio.",
+  "config.diagnostics_desc": "Copia el estado del runtime, ya depurado, para diagnosticar problemas.",
+  "config.diagnostics_title": "Paquete de diagnóstico",
+  "config.engine_reload_desc": "Reinicia el servidor de OpenCode de este espacio de trabajo.",
+  "config.engine_reload_title": "Recarga del motor",
+  "config.host_admin_token_hint": "Token interno solo para el host para la CLI de aprobaciones y las APIs de administración. No lo uses en el flujo de conexión remota de la app.",
+  "config.host_admin_token_label": "Token de administrador del host",
+  "config.host_local_only": "Solo local",
+  "config.host_offline": "Desconectado",
+  "config.host_remote_enabled": "Remoto habilitado",
+  "config.local_ip_hint": "Usa tu IP local en la misma red Wi-Fi para obtener la conexión más rápida.",
+  "config.mdns_hint": "Los nombres.local son más fáciles de recordar, pero es posible que no se resuelvan en todas las redes.",
+  "config.messaging_identities_desc": "Gestiona las identidades de Telegram/Slack y el enrutamiento en la pestaña Identidades.",
+  "config.messaging_identities_title": "Identidades de mensajería",
+  "config.not_set": "No establecido",
+  "config.owner_token_disabled_hint": "Solo es relevante después de habilitar el acceso remoto para este worker.",
+  "config.owner_token_label": "Token de propietario",
+  "config.owner_token_remote_hint": "Úsalo cuando un cliente remoto tenga que responder solicitudes de permiso o realizar acciones exclusivas del propietario.",
+  "config.reload_active_tasks_warning": "La recarga detendrá las tareas activas.",
+  "config.reload_availability_hint": "La recarga solo está disponible para workers locales o para servidores de OpenWork conectados.",
+  "config.reload_connect_hint": "Conecta a este worker para recargar.",
+  "config.reload_engine": "Recargar motor",
+  "config.reload_now_desc": "Aplica los cambios de configuración y vuelve a conectar tu sesión.",
+  "config.reload_now_title": "Recargar ahora",
+  "config.reloading": "Recargando...",
+  "config.remote_access_off_hint": "El acceso remoto está desactivado. Usa Compartir espacio de trabajo para habilitarlo antes de conectarte desde otra máquina.",
+  "config.resolved_worker_url": "URL del worker resuelta:",
+  "config.server_needed_hint": "Se necesita una conexión al servidor de OpenWork para sincronizar Skills, Plugins y Commands.",
+  "config.server_section_desc": "Conéctate a un servidor de OpenWork. Usa la URL y un token de colaborador o de propietario proporcionado por el administrador del servidor.",
+  "config.server_section_title": "Servidor de OpenWork",
+  "config.server_sharing_desc": "Comparte estos datos con un dispositivo de confianza. Mantén el servidor en la misma red para que la configuración sea más rápida.",
+  "config.server_sharing_menu_hint": "Para enlaces de uso compartido por espacio de trabajo, usa Compartir... en el menú del espacio de trabajo.",
+  "config.server_sharing_title": "Uso compartido del servidor de OpenWork",
+  "config.server_url_hint": "Usa la URL que te compartió tu servidor de OpenWork. Los workers locales de escritorio reutilizan un puerto alto persistente dentro del rango 48000-51000.",
+  "config.server_url_input_label": "URL del servidor de OpenWork",
+  "config.server_url_label": "URL del servidor de OpenWork",
+  "config.starting_server": "Iniciando servidor…",
+  "config.status_connected": "Conectado",
+  "config.status_limited": "Limitado",
+  "config.status_not_connected": "No conectado",
+  "config.test_connection": "Probar conexión",
+  "config.testing": "Probando...",
+  "config.testing_connection": "Probando conexión...",
+  "config.token_hint": "Opcional. Pega un token de colaborador para el acceso habitual o un token de propietario cuando este cliente tenga que responder solicitudes de permiso.",
+  "config.token_label": "Token de colaborador o de propietario",
+  "config.token_placeholder": "Pega tu token",
+  "config.unavailable": "Indisponible",
+  "config.worker_id": "ID del worker:",
+  "config.workspace_config_desc": "Estos ajustes afectan al espacio de trabajo seleccionado. Las acciones exclusivas del runtime se aplican al espacio de trabajo que esté conectado en ese momento.",
+  "config.workspace_config_title": "Configuración del espacio de trabajo",
+  "config.workspace_id_prefix": "Espacio de trabajo:",
+  "context_panel.add_button": "Añadir",
+  "context_panel.add_folder_hint": "Añade una carpeta para que este espacio de trabajo pueda leer y editar archivos fuera de su directorio raíz.",
+  "context_panel.adding_button": "Añadiendo...",
+  "context_panel.always_available": "Siempre disponible",
+  "context_panel.authorized_folders": "Carpetas autorizadas",
+  "context_panel.authorized_folders_desc": "Permite que este espacio de trabajo lea y edite archivos en directorios fuera de su carpeta raíz.",
+  "context_panel.authorized_folders_no_access": "Conéctate a un espacio de trabajo editable del servidor de OpenWork para modificar las carpetas autorizadas.",
+  "context_panel.browse_button": "Navegar",
+  "context_panel.config_access_unavailable": "El acceso a la configuración del servidor de OpenWork no está disponible para este espacio de trabajo.",
+  "context_panel.config_read_only": "El servidor de OpenWork está conectado en modo de solo lectura para la configuración del espacio de trabajo.",
+  "context_panel.folder_already_authorized": "La carpeta ya está autorizada.",
+  "context_panel.folders_updated": "Carpetas autorizadas actualizadas.",
+  "context_panel.input_placeholder": "Escribe una ruta de carpeta para autorizar...",
+  "context_panel.no_external_folders": "No se autorizan carpetas externas",
+  "context_panel.no_mcp": "No hay servidores MCP cargados.",
+  "context_panel.no_server_workspace": "No hay ningún espacio de trabajo del servidor activo seleccionado.",
+  "context_panel.no_skills": "No hay Skills cargadas.",
+  "context_panel.preserving_entries": "Se conservarán {count} entradas de permisos que no son carpetas.",
+  "context_panel.preserving_entry": "Se conservará 1 entrada de permisos que no corresponde a una carpeta.",
+  "context_panel.remove_folder": "Quitar {name}",
+  "context_panel.saving_folders": "Guardando carpetas autorizadas...",
+  "context_panel.server_disconnected": "El servidor de OpenWork está desconectado.",
+  "context_panel.workspace_root_available": "La raíz del espacio de trabajo ya está disponible.",
+  "context_panel.workspace_root_badge": "Raíz del espacio de trabajo",
+  "context_panel.writable_workspace_required": "Se necesita un espacio de trabajo editable del servidor de OpenWork para actualizar las carpetas autorizadas.",
+  "dashboard.change": "Cambiar",
+  "dashboard.choose_folder": "Elige una carpeta",
+  "dashboard.choose_folder_continue": "Elige una carpeta para continuar.",
+  "dashboard.chooser_local_desc": "Crea un espacio de trabajo en este dispositivo y, si quieres, empieza desde una plantilla del equipo.",
+  "dashboard.chooser_remote_desc": "Conéctate a un worker de OpenWork autohospedado con una URL y un token de acceso.",
+  "dashboard.chooser_shared_desc": "Explora los workers de Cloud compartidos con tu organización y conéctate en un solo paso.",
+  "dashboard.close_settings": "Cerrar ajustes",
+  "dashboard.cloud_worker": "Worker de Cloud",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Conectar en remoto",
+  "dashboard.connected": "Conectado",
+  "dashboard.connecting": "Conectando...",
+  "dashboard.create_local_workspace_subtitle": "Crea un espacio de trabajo en este dispositivo y, si quieres, empieza desde una plantilla del equipo.",
+  "dashboard.create_local_workspace_title": "Espacio de trabajo local",
+  "dashboard.create_remote_custom_subtitle": "Conéctate a un worker de OpenWork autohospedado.",
+  "dashboard.create_remote_custom_title": "Conectar remoto personalizado",
+  "dashboard.create_remote_workspace_confirm": "Añadir espacio de trabajo",
+  "dashboard.create_remote_workspace_subtitle": "Guarda un servidor de OpenWork como espacio de trabajo.",
+  "dashboard.create_remote_workspace_title": "Añadir espacio de trabajo remoto",
+  "dashboard.create_sandbox_confirm": "Crear como zona de pruebas",
+  "dashboard.create_shared_subtitle_signed_in": "Explora los workers de Cloud compartidos con tu organización y conéctate en un solo paso.",
+  "dashboard.create_shared_subtitle_signed_out": "Inicia sesión en OpenWork Cloud para acceder a los workers compartidos con tu organización.",
+  "dashboard.create_shared_title": "Espacios de trabajo compartidos",
+  "dashboard.create_workspace_confirm": "Crear espacio de trabajo",
+  "dashboard.create_workspace_subtitle": "Inicializa un nuevo espacio de trabajo basado en una carpeta.",
+  "dashboard.create_workspace_title": "Crear espacio de trabajo",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Guardar conexión",
+  "dashboard.edit_remote_workspace_subtitle": "Actualiza los datos del servidor de OpenWork para este espacio de trabajo.",
+  "dashboard.edit_remote_workspace_title": "Editar conexión remota",
+  "dashboard.error_choose_org": "Elige una organización antes de abrir un espacio de trabajo.",
+  "dashboard.error_connect_worker": "No se pudo conectar a {name}.",
+  "dashboard.error_load_orgs": "No se pudieron cargar las organizaciones.",
+  "dashboard.error_load_shared_workspaces": "No se pudieron cargar los espacios de trabajo compartidos.",
+  "dashboard.error_workspace_not_ready": "Este espacio de trabajo aún no está listo para conectarse. Inténtalo de nuevo en un momento.",
+  "dashboard.import_config": "Importar configuración",
+  "dashboard.importing": "Importando…",
+  "dashboard.modal_back": "Atrás",
+  "dashboard.modal_close": "Cerrar modal de añadir espacio de trabajo",
+  "dashboard.remote": "Remoto",
+  "dashboard.remote_base_url_required": "Añade una URL del servidor para continuar.",
+  "dashboard.remote_server_details_hint": "Conéctate a un worker de OpenWork autohospedado.",
+  "dashboard.remote_server_details_title": "Detalles del servidor remoto",
+  "dashboard.sandbox_checking_docker": "Comprobando Docker...",
+  "dashboard.sandbox_get_ready_title": "Los sandboxes necesitan Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Atención",
+  "dashboard.worker_status_ready": "Listo",
+  "dashboard.worker_status_starting": "Iniciando",
+  "dashboard.worker_status_stopped": "Detenido",
+  "dashboard.worker_status_unknown": "Desconocido",
+  "den.active_org_hint": "Los workers de Cloud y las plantillas de equipo dependen de la organización seleccionada.",
+  "den.active_org_title": "Organización activa",
+  "den.auto_reconnect_hint": "Termina la autenticación en tu navegador y OpenWork volverá a conectarse aquí automáticamente.",
+  "den.checking_session": "Comprobando la sesión",
+  "den.choose_org_for_providers": "Elige una organización para ver los proveedores de Cloud.",
+  "den.choose_org_for_skills": "Elige una organización para ver las Skills en Cloud.",
+  "den.choose_org_for_skill_hubs": "Elige una organización para ver los centros de Skills en Cloud.",
+  "den.cloud_account_hint": "Gestiona tu cuenta conectada y tu organización.",
+  "den.cloud_account_title": "Cuenta de Cloud",
+  "den.cloud_control_plane_open": "Abrir en el navegador",
+  "den.cloud_control_plane_reset": "Reiniciar",
+  "den.cloud_control_plane_save": "Guardar URL",
+  "den.cloud_control_plane_url_hint": "Solo en modo desarrollador. Úsalo para apuntar a un plano de control de Cloud local o autohospedado. Al cambiarlo, se cierra la sesión para que la app pueda volver a hidratarse con el nuevo plano de control.",
+  "den.cloud_control_plane_url_label": "URL del plano de control de Cloud",
+  "den.cloud_provider_detail": "Modelos {count} · Proveedor {source}",
+  "den.cloud_provider_removed_detail": "Este proveedor importado ya no está en Cloud. Desinstala la configuración local de {providerId}.",
+  "den.cloud_provider_sync_detail": "El proveedor de Cloud cambió. Sincroniza la configuración del modelo {count} {source} con `opencode.jsonc`.",
+  "den.cloud_skill_detail": "Instala esta Skill de Cloud en `.opencode/skills`.",
+  "den.cloud_skill_imported_detail": "Instalado localmente como {name}.",
+  "den.cloud_skill_removed_detail": "Esta Skill de Cloud se eliminó del origen. Desinstala la copia local de {name}.",
+  "den.cloud_skill_sync_detail": "Hay una versión más nueva en Cloud disponible para {name}. Actualiza la copia local para permanecer sincronizada.",
+  "den.cloud_skills_hint": "Explora las Skills de Cloud a las que tienes acceso, instálalas localmente y actualízalas cuando cambie la versión remota.",
+  "den.cloud_skills_title": "Skills",
+  "den.cloud_providers_hint": "Importa proveedores LLM gestionados a `opencode.jsonc` y usa la credencial de la organización en este espacio de trabajo.",
+  "den.cloud_providers_title": "Proveedores de Cloud",
+  "den.cloud_section_desc": "Inicia sesión, elige una organización y abre workers de Cloud o plantillas de equipo.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Inicia sesión en OpenWork Cloud para mantener activas tus tareas incluso cuando tu equipo esté inactivo.",
+  "den.cloud_workers_hint": "Abre workers directamente en OpenWork con el mismo flujo de conexión remota que ya usa la app en otros lugares.",
+  "den.cloud_workers_title": "Workers de Cloud",
+  "den.create_account": "Crear una cuenta",
+  "den.credentials_ready_badge": "Credencial lista",
+  "den.error_base_url": "Introduce una URL válida del plano de control de Cloud con `http://` o `https://`.",
+  "den.error_choose_org": "Elige una organización antes de abrir un worker.",
+  "den.error_load_orgs": "No se pudieron cargar las organizaciones.",
+  "den.error_load_skills": "No se pudieron cargar las Skills en Cloud.",
+  "den.error_load_workers": "No se pudieron cargar los workers.",
+  "den.error_no_session": "No se encontró ninguna sesión activa de Cloud.",
+  "den.error_no_token": "El inicio de sesión de escritorio se completó, pero OpenWork Cloud no devolvió un token de sesión.",
+  "den.error_open_worker": "No se pudo abrir {name} en OpenWork.",
+  "den.error_open_worker_fallback": "No se pudo abrir {name}.",
+  "den.error_paste_valid_code": "Pega un enlace de inicio de sesión OpenWork válido o un código de inicio de sesión único.",
+  "den.error_signin_failed": "No se pudo completar el inicio de sesión en OpenWork Cloud.",
+  "den.error_worker_not_ready": "El worker todavía no está listo para abrirse. Inténtalo de nuevo cuando termine el aprovisionamiento.",
+  "den.finish_signin": "Finalizar el inicio de sesión",
+  "den.finishing": "Finalizando...",
+  "den.hide_signin_code": "Ocultar código de inicio de sesión",
+  "den.import_all": "Importar todo",
+  "den.import_skill": "Instalar",
+  "den.import_skill_failed": "No se pudo instalar {name}.",
+  "den.import_provider": "Importar",
+  "den.import_provider_failed": "No se pudo importar {name}.",
+  "den.imported_badge": "Importado",
+  "den.imported_provider": "Importado {name}.",
+  "den.importing": "Importando...",
+  "den.needs_attention": "Necesita atención",
+  "den.no_cloud_providers": "Aún no hay proveedores de Cloud disponibles para esta organización.",
+  "den.no_cloud_skills": "Aún no hay Skills en Cloud disponibles para esta organización.",
+  "den.no_cloud_workers": "Todavía no hay workers de Cloud visibles para esta organización. Crea uno en Cloud y luego actualiza esta pestaña.",
+  "den.no_org_selected": "Ninguna organización seleccionada",
+  "den.no_skill_hubs": "Aún no hay centros de Skills en Cloud disponibles para esta organización.",
+  "den.open": "Abierto",
+  "den.opening": "Abriendo...",
+  "den.org_member_suffix": "(Miembro)",
+  "den.org_owner_suffix": "(Propietario)",
+  "den.org_switched": "Cambiado a {name}.",
+  "den.out_of_sync_badge": "Fuera de sincronización",
+  "den.private_badge": "Privado",
+  "den.paste_signin_code": "Pegar código de inicio de sesión",
+  "den.refresh": "Actualizar",
+  "den.reload_workspace": "Vuelve a cargar el espacio de trabajo para aplicar los cambios de configuración.",
+  "den.remove_provider_failed": "No se pudo eliminar {name}.",
+  "den.remove_skill_failed": "No se pudo desinstalar {name}.",
+  "den.removed_from_cloud_badge": "Eliminado de Cloud",
+  "den.removed_provider": "Se eliminó {name}.",
+  "den.removing": "Eliminando...",
+  "den.sign_out": "Cerrar sesión",
+  "den.signed_out": "Sesión cerrada",
+  "den.signin_button": "Iniciar sesión",
+  "den.signin_code_note": "Acepta un enlace openwork://den-auth o la concesión única sin procesar.",
+  "den.signin_link_hint": "Si tu navegador no vuelve automáticamente a OpenWork, pega aquí el enlace o el código de inicio de sesión de OpenWork Cloud.",
+  "den.signin_link_label": "Enlace de inicio de sesión o código de un solo uso",
+  "den.signin_link_placeholder": "openwork://den-auth?... o código pegado",
+  "den.signin_title": "Iniciar sesión en OpenWork Cloud",
+  "den.signing_in": "Finalizando el inicio de sesión en OpenWork Cloud...",
+  "den.signing_out": "Cerrando sesión...",
+  "den.skill_hub_detail": "Importa {count} Skills compartidas a `.opencode/skills`.",
+  "den.skill_hub_imported_detail": "{count} Skills importadas a este espacio de trabajo.",
+  "den.skill_hub_removed_detail": "Este hub se eliminó de Cloud. Desinstala las {importedCount} Skills importadas en este espacio de trabajo.",
+  "den.skill_hub_skills_badge": "{count} Skills",
+  "den.skill_hub_sync_detail": "Cloud ahora tiene {liveCount} Skills; este espacio de trabajo importó {importedCount}. Sincroniza para actualizar el conjunto instalado.",
+  "den.skill_hubs_hint": "Importa todas las Skills desde un hub de Cloud compartido a este espacio de trabajo en un solo paso.",
+  "den.skill_hubs_title": "Hubs de Skills",
+  "den.status_base_url_updated": "Se actualizó la URL del plano de control de Cloud. Vuelve a iniciar sesión para continuar.",
+  "den.status_browser_signin": "Termina de iniciar sesión en tu navegador para conectar OpenWork.",
+  "den.status_browser_signup": "Termina de crear tu cuenta en el navegador para conectar OpenWork.",
+  "den.status_cloud_signed_in_as": "Conectado a OpenWork Cloud como {email}.",
+  "den.status_cloud_signin_done": "OpenWork Cloud conectado.",
+  "den.status_loaded_orgs_one": "Se cargaron {count} organización.",
+  "den.status_loaded_orgs_other": "Se cargaron {count} organizacións.",
+  "den.status_loaded_skills_one": "Se cargaron {count} Skill de Cloud para {name}.",
+  "den.status_loaded_skills_other": "Se cargaron {count} Skills de Cloud para {name}.",
+  "den.status_loaded_workers_one": "Se cargaron {count} worker para {name}.",
+  "den.status_loaded_workers_other": "Se cargaron {count} workers para {name}.",
+  "den.status_no_skills": "No se encontraron Skills en Cloud para {name}.",
+  "den.status_no_workers": "No se encontraron workers para {name}.",
+  "den.status_opened_worker": "Se abrió {name} en OpenWork.",
+  "den.status_signed_in_as": "Has iniciado sesión como {email}.",
+  "den.status_signed_out": "Se cerró la sesión y se borró tu sesión de OpenWork Cloud en este dispositivo.",
+  "den.sync": "Sincronizar",
+  "den.sync_provider_failed": "No se pudo sincronizar {name}.",
+  "den.sync_skill_failed": "No se pudo actualizar {name}.",
+  "den.synced_provider": "Sincronizado {name}.",
+  "den.syncing": "Sincronizando...",
+  "den.installed_name_badge": "Local: {name}",
+  "den.uninstall": "Desinstalar",
+  "den.worker_mine_badge": "Mío",
+  "den.worker_not_ready_title": "Este worker aún no está listo para abrir.",
+  "den.worker_provider_label": "Worker de {provider}",
+  "den.worker_secondary_cloud": "Worker de Cloud",
+  "extensions.app_count_one": "Aplicación {count} conectada",
+  "extensions.app_count_other": "Aplicaciones {count} conectadas",
+  "extensions.apps_mcp_header": "Aplicaciones (MCP)",
+  "extensions.filter_all": "Todo",
+  "extensions.filter_apps": "Aplicaciones",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count_one": "Plugin {count}",
+  "extensions.plugin_count_other": "Plugins {count}",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Las aplicaciones (MCP) y los Plugins OpenCode se encuentran en un solo lugar.",
+  "extensions.title": "Extensiones",
+  "identities.agent_behavior_desc": "Un archivo por espacio de trabajo. Añade una primera línea opcional `@agent <id>` para enviarlo por un agente concreto de OpenCode.",
+  "identities.agent_behavior_title": "Comportamiento del agente de mensajería",
+  "identities.agent_created": "Archivo de agente de mensajería predeterminado creado.",
+  "identities.agent_file_changed": "Archivo cambiado de forma remota. Vuelve a cargar y guardar nuevamente.",
+  "identities.agent_loading": "Cargando archivo de agente…",
+  "identities.agent_none": "ninguno",
+  "identities.agent_not_found": "El archivo del agente aún no se ha encontrado en este espacio de trabajo.",
+  "identities.agent_saved": "Comportamiento de mensajería guardado.",
+  "identities.agent_scope_status": "Alcance activo: espacio de trabajo · estado: {status} · agente seleccionado: {agent}",
+  "identities.agent_status_loaded": "cargado",
+  "identities.agent_status_missing": "desaparecido",
+  "identities.agent_worker_scope_unavailable": "Alcance del worker no disponible.",
+  "identities.all_channels": "Todos los canales",
+  "identities.app_token_label": "Token de la app",
+  "identities.auto_bind_label": "Vinculación automática entre pares y directorio en envío directo",
+  "identities.available_channels": "Canales disponibles",
+  "identities.bot_token_label": "Token del bot",
+  "identities.bot_token_placeholder": "Pega el token de Telegram de @BotFather",
+  "identities.botfather_step1_open": "1. Abre @BotFather en Telegram",
+  "identities.botfather_step1_run": "y ejecuta /newbot",
+  "identities.botfather_step3_choose": "3. Elige un nombre y nombre de usuario para tu bot.",
+  "identities.botfather_step3_or_private": "para abrir bandeja de entrada o",
+  "identities.botfather_step3_private": "Privado",
+  "identities.botfather_step3_public": "Público",
+  "identities.botfather_step3_to_require": "requerir",
+  "identities.channel_label": "Canal",
+  "identities.channels_connected": "conectado",
+  "identities.channels_label": "Canales",
+  "identities.configured_suffix": "configurado",
+  "identities.connect_server_desc": "Las identidades están disponibles cuando estás conectado a un host de OpenWork.",
+  "identities.connect_server_title": "Conéctate a un servidor de OpenWork",
+  "identities.connect_slack": "Conectar Slack",
+  "identities.connected_badge": "Conectado",
+  "identities.connecting": "Conectando...",
+  "identities.copy_bot_token_hint": "Copia el token del bot y pégalo abajo.",
+  "identities.copy_code": "Copiar código",
+  "identities.create_default_file": "Crear archivo predeterminado",
+  "identities.create_private_bot": "Crear bot privado",
+  "identities.create_public_bot": "Crear bot público",
+  "identities.days_ago": "Hace {days}d",
+  "identities.default_routing": "Enrutamiento predeterminado",
+  "identities.directory_label": "Directorio (opcional)",
+  "identities.disable_messaging": "Desactivar mensajes",
+  "identities.disable_messaging_message": "Esto desactivará los mensajes para este espacio de trabajo. La configuración de Telegram y Slack estará oculta hasta que se habilite la mensajería nuevamente y deberá reiniciar el worker para detener completamente el sidecar de mensajería.",
+  "identities.disable_messaging_title": "¿Desactivar mensajes para este worker?",
+  "identities.disabled_label": "Desactivado",
+  "identities.disabling": "Desactivando...",
+  "identities.disconnect": "Desconectar",
+  "identities.dispatched_messages": "Se enviaron {sent}/{attempted} mensajes.",
+  "identities.enable_messaging": "Habilitar mensajería",
+  "identities.enable_messaging_risk": "La mensajería puede exponer este worker a Commands remotos. Si un bot es público o está comprometido, puede acceder a archivos, credenciales y claves API disponibles para este worker.",
+  "identities.enable_messaging_title": "¿Habilitar mensajería para este worker?",
+  "identities.enabled_label": "Activado",
+  "identities.enabling": "Habilitando...",
+  "identities.health_offline": "Desconectado",
+  "identities.health_running": "En ejecución",
+  "identities.health_unavailable": "Indisponible",
+  "identities.health_unknown": "Desconocido",
+  "identities.hours_ago": "Hace {hours}h",
+  "identities.identities_label": "Identidades",
+  "identities.just_now": "En este momento",
+  "identities.last_activity": "Última actividad",
+  "identities.later": "Más tarde",
+  "identities.message_label": "Mensaje",
+  "identities.message_routing_desc": "Controla qué conversaciones van a qué carpeta del espacio de trabajo. Los mensajes se envían a la carpeta predeterminada del worker salvo que definas reglas aquí.",
+  "identities.message_routing_title": "Enrutamiento de mensajes",
+  "identities.messages_today": "Mensajes de hoy",
+  "identities.messaging_disabled_hint": "Activa la mensajería solo si entiendes el riesgo y piensas proteger el acceso (por ejemplo, con emparejamiento privado en Telegram).",
+  "identities.messaging_disabled_restart": "Mensajería deshabilitada. Reinicia este worker para detener el sidecar de mensajería.",
+  "identities.messaging_disabled_risk": "Los bots de mensajería pueden ejecutar acciones contra tu worker local. Si se exponen públicamente, pueden permitir el acceso a archivos, credenciales y claves API disponibles para este worker.",
+  "identities.messaging_disabled_title": "La mensajería está deshabilitada de forma predeterminada",
+  "identities.messaging_enabled_restart": "Mensajería habilitada. Reinicia este worker para aplicar antes de configurar canales.",
+  "identities.messaging_sidecar_not_running": "La mensajería está habilitada en este espacio de trabajo, pero el sidecar de mensajería todavía no está en ejecución. Reinicia este worker y luego vuelve a Ajustes de mensajería para conectar Telegram o Slack.",
+  "identities.minutes_ago": "Hace {minutes}m",
+  "identities.not_set": "No establecido",
+  "identities.open_bot_link": "Abrir @{username} en Telegram",
+  "identities.pairing_code_copied": "Código de emparejamiento copiado.",
+  "identities.pairing_code_copy_failed": "No se pudo copiar el código de emparejamiento. Cópialo manualmente.",
+  "identities.pairing_code_instruction_prefix": "Enviar",
+  "identities.peer_id_label": "ID de compañero (opcional)",
+  "identities.peer_id_placeholder_slack": "p. ej. slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "p. ej. telegram:123456789",
+  "identities.private_label": "Privado",
+  "identities.private_pairing_code": "Código de emparejamiento privado",
+  "identities.public_bot_confirm": "Sí, entiendo el riesgo.",
+  "identities.public_bot_warning_message": "Tu bot será público y cualquiera que consiga acceso a él podrá tener control total sobre tu worker local, incluidos los archivos o claves API a los que tenga acceso. Si creas un bot privado, puedes limitar el acceso exigiendo un token de emparejamiento. ¿Seguro que quieres hacerlo público?",
+  "identities.public_bot_warning_title": "¿Hacer público este bot?",
+  "identities.public_label": "Público",
+  "identities.quick_setup": "Configuración rápida",
+  "identities.reconnect_failed": "No se ha podido reconectar. Comprueba la URL y el token de OpenWork y vuelve a intentarlo.",
+  "identities.reconnected": "Reconectado.",
+  "identities.reconnected_refreshing": "Reconectado. Actualizando el estado del worker...",
+  "identities.reload": "Recargar",
+  "identities.repair_reconnect": "Reparar y reconectar",
+  "identities.restart_failed": "El reinicio falló. Reinicia el worker desde Ajustes y vuelve a intentarlo.",
+  "identities.restart_to_disable_messaging": "La mensajería fue deshabilitada para este espacio de trabajo. Reinicia el worker ahora para detener el sidecar de mensajería.",
+  "identities.restart_to_enable_messaging": "La mensajería fue habilitada para este espacio de trabajo. Reinicia el worker ahora para iniciar el sidecar de mensajería y desbloquear la configuración de Telegram y Slack.",
+  "identities.restart_worker": "Reiniciar worker",
+  "identities.restart_worker_title": "¿Reiniciar worker ahora?",
+  "identities.restarting": "Reiniciando...",
+  "identities.routing_override_prefix": "Todos los mensajes se envían a",
+  "identities.routing_override_suffix": "(anulación activa)",
+  "identities.running_label": "En ejecución",
+  "identities.save_behavior": "Guardar comportamiento",
+  "identities.saving": "Guardando...",
+  "identities.send_test_button": "Enviar mensaje de prueba",
+  "identities.send_test_desc": "Valida la configuración de salida. Usa un ID de par para el envío directo o deja el campo vacío para repartir los mensajes según las vinculaciones de un directorio.",
+  "identities.send_test_title": "Enviar mensaje de prueba",
+  "identities.sending": "Envío...",
+  "identities.slack_desc": "Tu worker aparece como un bot en los canales Slack. Los miembros del equipo pueden enviarle mensajes directamente o mencionarlo en hilos.",
+  "identities.slack_intro": "Conecta tu espacio de trabajo de Slack para que tu equipo pueda interactuar con este worker en canales y mensajes directos.",
+  "identities.slack_unavailable": "Las identidades de Slack no están disponibles.",
+  "identities.status_active": "Activo",
+  "identities.status_label": "Estado",
+  "identities.status_stopped": "Interrumpido",
+  "identities.stopped_label": "Interrumpido",
+  "identities.subtitle": "Permite que otras personas lleguen a tu worker a través de apps de mensajería. Conecta un canal y tu worker leerá y responderá automáticamente a los mensajes.",
+  "identities.tab_general": "General",
+  "identities.telegram_bot_access_desc": "Bot público: primeros enlaces automáticos del chat Telegram. Bot privado: requiere un código de emparejamiento antes de que cualquier mensaje ejecute herramientas.",
+  "identities.telegram_delete_failed": "No se pudo eliminar.",
+  "identities.telegram_deleted": "Eliminado.",
+  "identities.telegram_deleted_pending": "Eliminado (pendiente de aplicar).",
+  "identities.telegram_desc": "Conecta un bot de Telegram en modo público (abrir bandeja de entrada) o en modo privado (requiere código de emparejamiento).",
+  "identities.telegram_private_saved_pair": "Bot privado guardado. Emparejar a través de /pair {code}",
+  "identities.telegram_save_failed": "No se pudo guardar.",
+  "identities.telegram_saved": "Guardado.",
+  "identities.telegram_saved_pending": "Guardado (pendiente de aplicar).",
+  "identities.telegram_saved_username": "Guardado (@{username})",
+  "identities.telegram_unavailable": "Las identidades de Telegram no están disponibles.",
+  "identities.title": "Canales de mensajería",
+  "identities.unsaved_changes": "Cambios no guardados",
+  "identities.worker_offline": "Worker desconectado",
+  "identities.worker_online": "Worker en línea",
+  "identities.worker_restarted": "El worker se reinició.",
+  "identities.worker_restarted_refreshing": "El worker se reinició. Actualizando el estado de la mensajería...",
+  "identities.worker_scope_unavailable": "Alcance del worker no disponible.",
+  "identities.worker_scope_unavailable_detail": "El alcance del worker no está disponible. Vuelve a conectarte con una URL de worker o cambia a un worker conocido.",
+  "identities.worker_unavailable": "Worker no disponible",
+  "identities.workspace_id_required": "Se necesita el ID del espacio de trabajo para gestionar identidades. Vuelve a conectarte con una URL de espacio de trabajo o selecciona uno asignado en este host.",
+  "identities.workspace_scope_prefix": "Alcance del espacio de trabajo:",
+  "mcp.add_modal_subtitle": "Conecta un servidor MCP personalizado mediante URL o un Command local.",
+  "mcp.add_modal_title": "Añadir aplicación personalizada",
+  "mcp.add_server_button": "Añadir aplicación",
+  "mcp.advanced": "Avanzado",
+  "mcp.advanced_settings": "Ajustes avanzados",
+  "mcp.advanced_settings_hint": "Edita archivos de configuración y gestiona conexiones manualmente.",
+  "mcp.app_connected": "aplicación conectada",
+  "mcp.apps_connected": "aplicaciones conectadas",
+  "mcp.apps_subtitle": "Conecta tus herramientas favoritas para que OpenWork pueda usarlas por ti.",
+  "mcp.apps_title": "Aplicaciones",
+  "mcp.auth.already_connected": "Ya conectado",
+  "mcp.auth.already_connected_description": "{server} ya está autenticado y listo para usar.",
+  "mcp.auth.applying_changes_body": "Estamos reiniciando el worker para que el nuevo MCP esté listo para autenticarse.",
+  "mcp.auth.applying_changes_title": "Aplicar cambios antes de iniciar sesión",
+  "mcp.auth.authorization_link": "Enlace de autorización",
+  "mcp.auth.authorization_still_required": "La autorización sigue siendo necesaria. Inténtalo otra vez para reiniciar el flujo.",
+  "mcp.auth.callback_invalid": "Pega la URL de callback o el parámetro `code` para completar OAuth.",
+  "mcp.auth.callback_label": "URL de callback o código",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Cancelar",
+  "mcp.auth.client_registration_required": "Es necesario registrarse como cliente antes de que OAuth pueda continuar.",
+  "mcp.auth.complete_connection": "Conexión completa",
+  "mcp.auth.configured_previously": "Es posible que el MCP se haya configurado globalmente o en una sesión anterior. Puedes cerrar este modal y empezar a usar las herramientas MCP de inmediato.",
+  "mcp.auth.connect_server": "Conectar {server}",
+  "mcp.auth.copied": "Copiado",
+  "mcp.auth.copy_link": "Copiar enlace",
+  "mcp.auth.done": "Hecho",
+  "mcp.auth.failed_to_start_oauth": "No se pudo iniciar el flujo OAuth",
+  "mcp.auth.follow_browser_steps": "Sigue los pasos de autorización en el navegador.",
+  "mcp.auth.force_stop": "Forzar parada",
+  "mcp.auth.force_stopping": "Parada...",
+  "mcp.auth.im_done": "He terminado",
+  "mcp.auth.invalid_refresh_token": "El token de refresco de OAuth no es válido o ha caducado. Vuelve a autorizar para continuar.",
+  "mcp.auth.manual_finish_hint": "Pega la URL de callback (`localhost:19876`) o simplemente el código para terminar la conexión.",
+  "mcp.auth.manual_finish_title": "¿Servidor remoto?",
+  "mcp.auth.oauth_completed_reload": "OAuth completado. Vuelve a cargar el motor para activar el MCP.",
+  "mcp.auth.oauth_failed": "Error de autenticación OAuth.",
+  "mcp.auth.oauth_not_supported_hint": "Esto podría significar:\n• El servidor MCP no anuncia capacidades de OAuth\n• El motor necesita recargarse para descubrir las capacidades del servidor\n• Prueba: `opencode mcp auth {server}` desde la CLI",
+  "mcp.auth.open_browser_signin": "Abriremos tu navegador para completar el inicio de sesión.",
+  "mcp.auth.port_forward_hint": "Consejo: reenvía el puerto de callback si hace falta: `ssh -L 19876:127.0.0.1:19876 usuario@host`",
+  "mcp.auth.reauth_action": "Reautorizar OAuth",
+  "mcp.auth.reauth_cli_hint": "Ejecuta: `opencode mcp auth {server}`",
+  "mcp.auth.reauth_failed": "La reautorización falló.",
+  "mcp.auth.reauth_remote_hint": "Vuelve a autorizar desde la máquina que ejecuta este worker.",
+  "mcp.auth.reauth_running": "Reautorizando...",
+  "mcp.auth.reload_blocked": "La recarga se pausa mientras se ejecuta una sesión. Detenga la ejecución para finalizar la configuración.",
+  "mcp.auth.reload_engine_retry": "Aplicar cambios y volver a intentarlo",
+  "mcp.auth.reload_failed": "No se pudo recargar el worker antes de iniciar sesión.",
+  "mcp.auth.reload_notice": "Para que esto tenga efecto, OpenWork necesita actualizar el servicio del worker. Esto puede interrumpir una sesión en curso.",
+  "mcp.auth.reload_remote_confirm": "Para que esto tenga efecto, OpenWork necesita actualizar el servicio del worker. Esto puede parar tu sesión en curso. ¿Quieres seguir?",
+  "mcp.auth.reopen_browser_link": "Haz clic aquí para volver a abrir el navegador",
+  "mcp.auth.request_timed_out": "Se agotó el tiempo de espera de la solicitud.",
+  "mcp.auth.retry": "Reintentar",
+  "mcp.auth.retry_now": "Reintentar ahora",
+  "mcp.auth.server_disabled": "Este servidor MCP está desactivado. Actívalo y vuelve a intentarlo.",
+  "mcp.auth.step1_description": "Iniciaremos automáticamente el flujo de inicio de sesión de {server}.",
+  "mcp.auth.step1_title": "Abriendo tu navegador",
+  "mcp.auth.step2_description": "Inicia sesión y aprueba el acceso cuando se te pida.",
+  "mcp.auth.step2_title": "Autorizar OpenWork",
+  "mcp.auth.step3_description": "Terminaremos de conectarnos tan pronto como se complete la autorización.",
+  "mcp.auth.step3_title": "Vuelve aquí cuando hayas terminado.",
+  "mcp.auth.try_reload_engine": "{message}. Prueba primero a recargar el motor.",
+  "mcp.auth.waiting_authorization": "Esperando a que se complete la autorización en tu navegador...",
+  "mcp.auth.waiting_for_conversation_body": "Lo redirigiremos para que se autentique lo antes posible.",
+  "mcp.auth.waiting_for_conversation_title": "Esperando a que se complete la conversación",
+  "mcp.auth.waiting_for_session": "Esperando a que {session} termine de funcionar",
+  "mcp.available_apps": "Aplicaciones disponibles",
+  "mcp.cap_signin": "Iniciar sesión en la cuenta",
+  "mcp.cap_tools": "Herramientas de IA",
+  "mcp.config_file": "Archivo de configuración",
+  "mcp.config_load_failed": "No se pudo cargar el archivo de configuración",
+  "mcp.config_not_loaded": "Aún no cargado",
+  "mcp.connect": "Conectar",
+  "mcp.connect_failed": "No se pudo conectar. Inténtalo de nuevo.",
+  "mcp.connect_server_first": "Conecta primero al servidor.",
+  "mcp.connected": "Conectado",
+  "mcp.connected_badge": "Conectado",
+  "mcp.connection_failed": "Problema de conexión: inténtalo de nuevo",
+  "mcp.connection_type": "Conexión",
+  "mcp.control_chrome_browser_hint": "En Chrome 144 o posterior, haz esto primero:",
+  "mcp.control_chrome_browser_step_one": "Abre `chrome://inspect/#remote-debugging`.",
+  "mcp.control_chrome_browser_step_two": "Activa la depuración remota.",
+  "mcp.control_chrome_browser_step_three": "Permite las conexiones de depuración entrantes cuando Chrome te lo pida.",
+  "mcp.control_chrome_browser_title": "1. Activa el acceso a Chrome",
+  "mcp.control_chrome_connect": "Añadir Control Chrome",
+  "mcp.control_chrome_docs": "Guía oficial MCP",
+  "mcp.control_chrome_edit": "Editar configuración",
+  "mcp.control_chrome_profile_hint": "Control Chrome suele abrir un perfil de Chrome aparte. Activa esta opción si quieres que OpenWork reutilice la ventana de Chrome que ya tienes abierta.",
+  "mcp.control_chrome_profile_title": "2. Elige qué Chrome usar",
+  "mcp.control_chrome_save": "Guardar configuración",
+  "mcp.control_chrome_setup_subtitle": "Activa el acceso a Chrome y luego elige si OpenWork debe usar un perfil limpio propio o conectarse al Chrome que ya usas.",
+  "mcp.control_chrome_setup_title": "Configurar Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Cuando esto está activado, OpenWork añade --autoConnect para que MCP se conecte a una instancia de Chrome que ya has abierto.",
+  "mcp.control_chrome_toggle_label": "Usar mi perfil Chrome existente",
+  "mcp.control_chrome_toggle_off": "OpenWork abrirá un perfil de Chrome aparte solo para la automatización.",
+  "mcp.control_chrome_toggle_on": "OpenWork reutilizará tus pestañas, cookies e inicios de sesión actuales.",
+  "mcp.custom_app_cta_hint": "Conecta tu propio servidor MCP, herramienta interna o app alojada.",
+  "mcp.desktop_required": "Las apps requieren la app de escritorio.",
+  "mcp.docs_link": "Más información",
+  "mcp.file_not_found": "Archivo de configuración aún no creado",
+  "mcp.friendly_status_issue": "Problema",
+  "mcp.friendly_status_needs_signin": "Hace falta iniciar sesión",
+  "mcp.friendly_status_offline": "Desconectado",
+  "mcp.friendly_status_paused": "En pausa",
+  "mcp.friendly_status_ready": "Listo",
+  "mcp.last_synced": "Sincronizado",
+  "mcp.login_action": "Iniciar sesión",
+  "mcp.login_hint": "Conecta tu cuenta para terminar de configurar esta app.",
+  "mcp.login_unavailable": "Esta aplicación no admite el inicio de sesión desde OpenWork.",
+  "mcp.logout_action": "Finalizar la sesión",
+  "mcp.logout_failed": "No se pudo cerrar sesión.",
+  "mcp.logout_hint": "Elimina las credenciales OAuth almacenadas. Tendrás que iniciar sesión nuevamente.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Esto eliminará las credenciales OAuth almacenadas para {server}. Deberá iniciar sesión nuevamente para usar esta aplicación.",
+  "mcp.logout_modal_title": "¿Cerrar sesión en esta aplicación?",
+  "mcp.logout_success": "Se cerró la sesión de {server}.",
+  "mcp.logout_working": "Cerrar sesión...",
+  "mcp.name_required": "Escribe un nombre de servidor.",
+  "mcp.no_apps_hint": "Conecta una de las opciones de arriba para empezar.",
+  "mcp.no_apps_yet": "Aún no hay aplicaciones conectadas",
+  "mcp.oauth": "Iniciar sesión",
+  "mcp.oauth_optional_hint": "Usa OAuth en el navegador para conectar tu cuenta.",
+  "mcp.oauth_optional_label": "Esta aplicación requiere iniciar sesión",
+  "mcp.one_click_connect": "Conexión con un clic",
+  "mcp.open_file": "Abrir archivo",
+  "mcp.opening_label": "Abriendo...",
+  "mcp.pick_workspace_error": "Elige primero una carpeta del espacio de trabajo.",
+  "mcp.pick_workspace_first": "Elige primero una carpeta del espacio de trabajo.",
+  "mcp.quick_connect_chrome_desc": "Controla pestañas de Chrome con automatización del navegador.",
+  "mcp.quick_connect_chrome_title": "Control Chrome",
+  "mcp.quick_connect_context7_desc": "Busca documentación del producto con más contexto.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Planifica sprints y lanza tickets más rápido.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Páginas, bases de datos y documentos de proyectos sincronizados.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Sigue lanzamientos y resuelve errores de producción.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Inspeccionar pagos, facturas y suscripciones.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Detenga la tarea en ejecución para activarla.",
+  "mcp.remote_workspace_url_hint": "Los workers remotos se conectan más rápido con servidores MCP basados en URL.",
+  "mcp.remove_app": "Eliminar",
+  "mcp.remove_failed": "No se pudo eliminar la aplicación.",
+  "mcp.remove_modal_message": "¿Seguro que quieres eliminar {server}? Siempre podrás volver a añadirlo más tarde.",
+  "mcp.remove_modal_title": "Quitar aplicación",
+  "mcp.reveal_config_failed": "No se pudo abrir el archivo de configuración",
+  "mcp.reveal_in_finder": "Mostrar en Finder",
+  "mcp.scope_global": "Todos los espacios de trabajo",
+  "mcp.scope_project": "Este espacio de trabajo",
+  "mcp.server_command": "Command",
+  "mcp.server_command_hint": "El Command de shell para iniciar el servidor.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Nombre de la aplicación",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Tipo",
+  "mcp.server_url": "URL del servidor",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Iniciar sesión",
+  "mcp.tap_to_connect": "Toca para conectarte",
+  "mcp.technical_details": "Detalles técnicos",
+  "mcp.type_cloud": "Cloud (inicia sesión con tu cuenta)",
+  "mcp.type_local": "Local (se ejecuta en este dispositivo)",
+  "mcp.type_local_cmd": "Local (Command)",
+  "mcp.type_remote": "Remoto (URL)",
+  "mcp.url_or_command_required": "Introduce una URL para servidores remotos o un Command para servidores locales.",
+  "mcp.your_apps": "Tus aplicaciones",
+  "model_behavior.desc_builtin": "Este modelo decide su propio camino de razonamiento y no expone perfiles aquí.",
+  "model_behavior.desc_generic": "Usa el perfil {label}.",
+  "model_behavior.desc_high": "Dedica más tiempo a razonar antes de responder.",
+  "model_behavior.desc_high_anthropic": "Usa el presupuesto estándar de pensamiento extendido.",
+  "model_behavior.desc_low": "Usa un razonamiento más ligero antes de responder.",
+  "model_behavior.desc_low_google": "Usa un presupuesto de razonamiento más ligero para obtener respuestas más rápidas.",
+  "model_behavior.desc_max": "Usa el perfil de razonamiento más profundo del proveedor.",
+  "model_behavior.desc_max_anthropic": "Usa el mayor presupuesto disponible para pensamiento extendido.",
+  "model_behavior.desc_medium": "Equilibra la velocidad y la profundidad del razonamiento.",
+  "model_behavior.desc_minimal": "Usa una cantidad muy pequeña de razonamiento.",
+  "model_behavior.desc_none": "Favorece la velocidad con el camino de razonamiento más ligero.",
+  "model_behavior.desc_standard": "Este modelo no expone controles de razonamiento adicionales.",
+  "model_behavior.label_balanced": "Equilibrado",
+  "model_behavior.label_builtin": "Construido en",
+  "model_behavior.label_deep": "Profundo",
+  "model_behavior.label_extended": "Extendido",
+  "model_behavior.label_fast": "Rápido",
+  "model_behavior.label_light": "Claro",
+  "model_behavior.label_maximum": "Máximo",
+  "model_behavior.label_quick": "Rápido",
+  "model_behavior.label_standard": "Estándar",
+  "model_behavior.title_builtin_reasoning": "Razonamiento incorporado",
+  "model_behavior.title_extended_thinking": "pensamiento extendido",
+  "model_behavior.title_reasoning_budget": "presupuesto de razonamiento",
+  "model_behavior.title_reasoning_effort": "esfuerzo de razonamiento",
+  "model_behavior.title_standard_generation": "Generación estándar",
+  "model_picker.chat_model_desc": "Elige el modelo para este chat. Si un modelo admite perfiles de razonamiento, configúrelos en su tarjeta.",
+  "model_picker.chat_model_title": "modelo de chat",
+  "model_picker.connect_provider_hint": "Conecta este proveedor para buscar y guardar modelos",
+  "model_picker.default_model_desc": "Elige el modelo predeterminado para nuevos chats, luego ajuste los perfiles de razonamiento en su tarjeta antes de presionar Listo.",
+  "model_picker.default_model_title": "Modelo predeterminado",
+  "model_picker.model_count_one": "{count} modelo",
+  "model_picker.model_count_other": "{count} modelos",
+  "model_picker.more_providers": "Más proveedores",
+  "model_picker.no_results": "Ningún modelo coincide con tu búsqueda.",
+  "model_picker.other_connected_models": "Otros modelos conectados",
+  "model_picker.recommended": "Recomendado",
+  "onboarding.authorize_folder": "Autorizar carpeta",
+  "plugins.add": "Añadir",
+  "plugins.add_hint": "Añade nombres de paquetes npm, por ejemplo, opencode-wakatime",
+  "plugins.add_label": "Añadir Plugin",
+  "plugins.added": "Añadido",
+  "plugins.config": "Configuración",
+  "plugins.config_label": "Configuración",
+  "plugins.desc": "Gestiona `opencode.json` para tu proyecto o los Plugins globales de OpenCode.",
+  "plugins.empty": "Aún no hay Plugins configurados.",
+  "plugins.enabled": "Activado",
+  "plugins.hide_setup": "Ocultar configuración",
+  "plugins.not_loaded": "Aún no cargado",
+  "plugins.not_loaded_yet": "Aún no cargado",
+  "plugins.remove": "Eliminar",
+  "plugins.scope_global": "Global",
+  "plugins.scope_project": "Proyecto",
+  "plugins.setup": "Configuración",
+  "plugins.suggested": "Plugins sugeridos",
+  "plugins.suggested_heading": "Plugins sugeridos",
+  "plugins.title": "Plugins OpenCode",
+  "providers.api_key_label": "Clave API",
+  "providers.api_key_required": "Hace falta una clave API",
+  "providers.auth_failed": "Error de autenticación",
+  "providers.connect_failed": "No se pudo conectar el proveedor",
+  "providers.disabled_in_config_suffix": "y lo deshabilité en la configuración de OpenCode.",
+  "providers.disconnect_failed": "No se pudo desconectar el proveedor",
+  "providers.disconnected_prefix": "Desconectado",
+  "providers.load_failed": "No se pudieron cargar los proveedores",
+  "providers.no_oauth_prefix": "No hay flujo OAuth disponible para",
+  "providers.no_providers_available": "No hay proveedores disponibles",
+  "providers.not_connected": "No conectado a un servidor",
+  "providers.not_oauth_flow_prefix": "El método de autenticación seleccionado no es un flujo OAuth para",
+  "providers.oauth_failed": "No se pudo completar OAuth",
+  "providers.oauth_method_required": "Hace falta el método OAuth",
+  "providers.provider_error": "Error de proveedor ({provider})",
+  "providers.provider_id_required": "Hace falta el ID del proveedor",
+  "providers.rate_limit_exceeded": "Has superado el límite de peticiones",
+  "providers.removal_unsupported": "Este cliente no admite la eliminación de la autenticación del proveedor.",
+  "providers.request_failed": "Solicitud fallida",
+  "providers.save_api_key_failed": "No se pudo guardar la clave API",
+  "providers.still_connected_suffix": ", pero el worker todavía lo informa como conectado. Borre cualquier clave API restante o credenciales de OAuth y reinicie el worker para desconectarlo por completo.",
+  "providers.unknown_provider": "Proveedor desconocido",
+  "providers.use_api_key_suffix": "Usa una clave API en su lugar.",
+  "question_modal.custom_answer_label": "O escribe una respuesta personalizada",
+  "question_modal.custom_answer_placeholder": "Escribe tu respuesta aquí...",
+  "question_modal.question_counter": "Pregunta {current} de {total}",
+  "session.allow_for_session": "Permitir durante la sesión",
+  "session.allow_once": "Permitir una vez",
+  "session.cmd_current_workspace": "Espacio de trabajo actual",
+  "session.cmd_new_session_detail": "Iniciar una nueva tarea en el espacio de trabajo actual",
+  "session.cmd_new_session_meta": "Crear",
+  "session.cmd_new_session_title": "Crear nueva sesión",
+  "session.cmd_sessions_detail": "{count} disponibles en distintos espacios de trabajo",
+  "session.cmd_sessions_meta": "Saltar",
+  "session.cmd_sessions_title": "Buscar sesiones",
+  "session.cmd_switch": "Cambiar",
+  "session.create_or_connect_workspace": "Crear o conectar un espacio de trabajo",
+  "session.default_agent": "Agente predeterminado",
+  "session.default_title": "Nueva sesión",
+  "session.delete": "Eliminar",
+  "session.delete_named_session_message": "Esto eliminará permanentemente \"{title}\" y sus mensajes.",
+  "session.delete_session_generic": "Esto eliminará permanentemente la sesión seleccionada y sus mensajes.",
+  "session.delete_session_title": "¿Eliminar sesión?",
+  "session.deleting": "Eliminando...",
+  "session.deny": "Denegar",
+  "session.details": "Detalles",
+  "session.details_label": "Detalles",
+  "session.doom_loop_label": "Bucle fatal",
+  "session.doom_loop_message": "OpenCode detectó llamadas repetidas a herramientas con entradas idénticas y pregunta si debe continuar después de repetidas fallas.",
+  "session.doom_loop_note": "Rechazar para detener el ciclo o permitir si desea que el agente siga intentándolo.",
+  "session.doom_loop_repeated_call_label": "llamada repetida",
+  "session.doom_loop_repeated_tool_call": "Llamada de herramienta repetida",
+  "session.doom_loop_title": "Bucle fatal detectado",
+  "session.doom_loop_tool_label": "Herramienta",
+  "session.export_already_running": "La exportación ya está en marcha.",
+  "session.export_desktop_only": "La exportación está disponible en la app de escritorio.",
+  "session.export_desktop_only_local": "La exportación está disponible para workers locales en la app de escritorio.",
+  "session.export_local_only": "La exportación solo es compatible con workers locales.",
+  "session.loading_detail": "Obteniendo los mensajes más recientes para esta tarea.",
+  "session.model": "Modelo",
+  "session.new_task": "Nueva tarea",
+  "session.open": "Abrir",
+  "session.palette_hint_navigate": "Teclas de flecha para navegar",
+  "session.palette_hint_run": "Enter para ejecutar · Esc para cerrar",
+  "session.palette_placeholder_actions": "Acciones de búsqueda",
+  "session.palette_placeholder_sessions": "Buscar por título de sesión o espacio de trabajo",
+  "session.palette_title_actions": "Acciones rápidas",
+  "session.palette_title_sessions": "Buscar sesiones",
+  "session.permission_detail_command": "Comando",
+  "session.permission_detail_cwd": "Directorio de trabajo",
+  "session.permission_detail_description": "Descripción",
+  "session.permission_detail_diff": "Diferencia",
+  "session.permission_detail_file": "Archivo",
+  "session.permission_detail_files": "Archivos",
+  "session.permission_detail_agent": "Agente",
+  "session.permission_detail_parent_directory": "Directorio padre",
+  "session.permission_detail_path": "Ruta",
+  "session.permission_detail_query": "Consulta",
+  "session.permission_detail_target": "Objetivo",
+  "session.permission_detail_tool": "Herramienta",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Edición de archivo",
+  "session.permission_kind_external_directory": "Directorio externo",
+  "session.permission_kind_question": "Pregunta",
+  "session.permission_kind_read": "Lectura de archivo",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Subtarea",
+  "session.permission_kind_todowrite": "Escritura de tareas",
+  "session.permission_label": "Permiso",
+  "session.permission_message": "OpenCode solicita permiso para continuar.",
+  "session.permission_message_bash": "Revisa el alcance del comando antes de permitir que OpenCode continúe.",
+  "session.permission_message_edit": "Revisa el archivo y la diferencia antes de permitir que OpenCode haga cambios.",
+  "session.permission_message_external_directory": "Revisa la carpeta antes de permitir acceso fuera del workspace.",
+  "session.permission_message_read": "Revisa el alcance de archivos solicitado antes de permitir el acceso.",
+  "session.permission_message_task": "Revisa la subtarea solicitada antes de permitir que empiece.",
+  "session.permission_metadata_unavailable": "No se pudieron mostrar los metadatos.",
+  "session.permission_review_label": "Revisión",
+  "session.permission_scope_empty": "No se proporcionó un alcance específico.",
+  "session.permission_decision_hint": "Permite una vez para esta solicitud, o durante la sesión cuando confíes en este alcance.",
+  "session.permission_title_bash": "¿Ejecutar un comando de shell?",
+  "session.permission_title_edit": "¿Modificar archivos?",
+  "session.permission_title_external_directory": "¿Acceder a una carpeta externa?",
+  "session.permission_title_generic": "¿Aprobar {permission}?",
+  "session.permission_title_read": "¿Leer archivos?",
+  "session.permission_title_task": "¿Iniciar una subtarea?",
+  "session.redo_aria_label": "Rehacer el último mensaje revertido",
+  "session.redo_label": "Rehacer",
+  "session.redo_title": "Rehacer el último mensaje revertido",
+  "session.rename_description": "Actualiza el nombre de esta sesión.",
+  "session.rename_label": "Nombre de la sesión",
+  "session.rename_placeholder": "Escribe un nombre nuevo",
+  "session.rename_title": "Cambiar nombre de sesión",
+  "session.resize_workspace_column": "Cambiar el tamaño de la columna espacio de trabajo",
+  "session.revert_label": "Revertir",
+  "session.scope_label": "Alcance",
+  "session.share_collaborator_hint": "Acceso remoto habitual cuando no necesitas acciones exclusivas del propietario.",
+  "session.share_collaborator_host_hint": "Acceso remoto habitual a este host sin acciones exclusivas del propietario.",
+  "session.share_collaborator_label": "Token de colaborador",
+  "session.share_connected_with_hint": "Este espacio de trabajo está actualmente conectado con esta contraseña.",
+  "session.share_desktop_app_required": "Hace falta la app de escritorio",
+  "session.share_local_host_not_ready": "El host local de OpenWork todavía no está listo.",
+  "session.share_missing_host_url": "Falta la URL del host de OpenWork.",
+  "session.share_missing_token": "Falta el token de OpenWork.",
+  "session.share_note_direct_runtime": "El runtime del motor está configurado en Direct. Cambiar de worker local puede reiniciar el host y desconectar a los clientes. El token puede cambiar después del reinicio.",
+  "session.share_opencode_base_url": "URL base de OpenCode",
+  "session.share_openwork_workers_only": "Los enlaces del servicio para compartir solo están disponibles para workers de OpenWork.",
+  "session.share_owner_permission_hint": "Úsalo cuando el cliente remoto tenga que responder solicitudes de permiso.",
+  "session.share_password": "Contraseña",
+  "session.share_select_workspace": "Selecciona primero un espacio de trabajo.",
+  "session.share_set_token_hint": "Configura el token en los ajustes del espacio de trabajo",
+  "session.share_starting_server": "Iniciando servidor...",
+  "session.share_worker_url": "URL del worker",
+  "session.share_worker_url_phones_hint": "Úsalo en móviles o portátiles que se conecten a este worker.",
+  "session.share_worker_url_resolving_hint": "La URL del worker se está resolviendo; mientras tanto se muestra la URL del host como alternativa.",
+  "session.todo_progress": "{completed} de {total} tareas completadas",
+  "session.undo_label": "Revertir",
+  "session.undo_title": "Deshacer el último mensaje",
+  "session.workspace_fallback": "workspace",
+  "settings.api_keys_info": "OpenCode almacena las claves API localmente. Los proveedores definidos por el entorno deben cambiarse en el entorno del worker y después recargarse.",
+  "settings.appearance_hint": "Sigue la configuración del sistema o fuerza el modo claro u oscuro.",
+  "settings.appearance_title": "Apariencia",
+  "settings.audit_log_title": "Registro de auditoría",
+  "settings.auto_compact": "Compactación automática de contexto",
+  "settings.auto_compact_desc": "Controla `compaction.auto` de OpenCode para este espacio de trabajo. Recarga el motor después de cambiarlo.",
+  "settings.auto_update_desc": "Descarga las actualizaciones automáticamente (solicita",
+  "settings.auto_update_title": "Actualización automática",
+  "settings.background_checks_desc": "OpenWork siempre comprueba el lanzamiento. También comprueba una vez",
+  "settings.background_checks_title": "Comprobaciones en segundo plano",
+  "settings.cache_repair_requires_desktop": "La reparación de caché requiere la app de escritorio",
+  "settings.cap_browser_tools": "Herramientas del navegador: {value}",
+  "settings.cap_commands": "Commands: {value}",
+  "settings.cap_config": "Configuración: {value}",
+  "settings.cap_file_tools": "Herramientas de archivo: {value}",
+  "settings.cap_inbox_off": "bandeja de entrada desactivada",
+  "settings.cap_inbox_on": "bandeja de entrada activada",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "bandeja de salida desactivada",
+  "settings.cap_outbox_on": "bandeja de salida activada",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "leer",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "escribir",
+  "settings.capabilities_title": "Capacidades del servidor de OpenWork",
+  "settings.capabilities_unavailable": "Capacidades no disponibles. Conéctate con un token de cliente.",
+  "settings.change": "Cambiar",
+  "settings.choose": "Elegir",
+  "settings.clear": "Borrar",
+  "settings.configure": "Configurar",
+  "settings.connect_provider": "Conectar proveedor",
+  "settings.connection": "Conexión",
+  "settings.connection_failed": "La conexión falló",
+  "settings.connection_title": "Conexión",
+  "settings.copied_debug_report": "Informe JSON del runtime copiado.",
+  "settings.copy_json": "Copia JSON",
+  "settings.custom_binary_hint": "Úsalo para apuntar OpenWork a una compilación local de OpenCode.",
+  "settings.custom_binary_label": "Binario OpenCode personalizado",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_desktop_app": "App de escritorio: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "Servidor de OpenWork: {version}",
+  "settings.deeplink_hint": "Admite `openwork://`, `openwork-dev://` o una URL compatible `https://share.openworklabs.com/b/...`.",
+  "settings.delete_containers": "Quitando contenedores...",
+  "settings.delete_local_config": "Eliminando estado local...",
+  "settings.dev_mode_badge": "Modo de desarrollo",
+  "settings.developer": "Desarrollador",
+  "settings.developer_mode_desc": "Habilita herramientas de depuración, diagnósticos y la pestaña Desarrollador.",
+  "settings.developer_mode_title": "Modo desarrollador",
+  "settings.developer_panel_disabled": "Panel de desarrollador deshabilitado.",
+  "settings.developer_panel_enabled": "Panel de desarrollador habilitado.",
+  "settings.diag_approval": "Aprobación: {mode} ({ms}ms)",
+  "settings.diag_config_path": "Ruta de configuración: {path}",
+  "settings.diag_default": "predeterminado",
+  "settings.diag_host_token_source": "Fuente del token de host: {source}",
+  "settings.diag_opencode_binary": "Binario de OpenCode: {binary}",
+  "settings.diag_read_only": "Solo lectura: {value}",
+  "settings.diag_runtime_workspace": "Espacio de trabajo del runtime: {id}",
+  "settings.diag_selected_workspace": "Espacio de trabajo seleccionado: {id}",
+  "settings.diag_started": "Iniciado: {time}",
+  "settings.diag_token_source": "Fuente del token: {source}",
+  "settings.diag_workspaces": "Espacios de trabajo: {count}",
+  "settings.diagnostics_unavailable": "Diagnóstico no disponible.",
+  "settings.disable_developer_mode": "Deshabilitar el modo de desarrollador",
+  "settings.disabled": "Desactivado",
+  "settings.disconnect": "Desconectar",
+  "settings.disconnect_server": "Desconectar servidor",
+  "settings.disconnecting": "Desconectando...",
+  "settings.docker_containers_desc": "Eliminación forzada de contenedores de Docker iniciados por OpenWork.",
+  "settings.docker_containers_title": "Contenedores OpenWork Docker",
+  "settings.docker_requires_desktop": "La limpieza de Docker requiere la app de escritorio",
+  "settings.done": "Hecho",
+  "settings.enable_developer_mode": "Habilitar el modo de desarrollador",
+  "settings.enable_exa": "Habilitar la búsqueda web Exa",
+  "settings.enable_exa_desc": "Se aplica cuando OpenWork Orchestrator inicia OpenCode. Está desactivado por defecto.",
+  "settings.engine_bundled": "Incluido (recomendado)",
+  "settings.engine_bundled_hint": "El motor integrado es la opción más confiable. Usa Sistema solo si lo necesitas.",
+  "settings.engine_custom_binary": "Binario personalizado",
+  "settings.engine_desc": "Elige cómo se ejecuta OpenCode localmente.",
+  "settings.engine_source": "Fuente del motor",
+  "settings.engine_source_debug": "Fuente del motor",
+  "settings.engine_system_path": "Instalación del sistema (PATH)",
+  "settings.engine_title": "Motor",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "Reinicia OpenCode o el orquestador después de cambiar esta configuración.",
+  "settings.export": "Exportar",
+  "settings.exported_debug_report": "Informe JSON del runtime exportado.",
+  "settings.feedback_badge": "Leemos cada mensaje",
+  "settings.feedback_desc": "Cuéntanos qué se siente genial y qué se siente difícil. Tus comentarios van directamente al equipo y nos ayudan a priorizar lo próximo que lancemos.",
+  "settings.feedback_title": "Ayuda a dar forma a OpenWork",
+  "settings.group_global": "Global",
+  "settings.group_workspace": "Espacio de trabajo",
+  "settings.hide_titlebar": "Ocultar barra de título",
+  "settings.hide_titlebar_desc": "Oculta la barra de título de la ventana. Útil para mosaico de ventanas",
+  "settings.join_discord": "Únete a Discord",
+  "settings.language": "Idioma",
+  "settings.language.description": "Elige tu idioma preferido",
+  "settings.last_error": "Último error",
+  "settings.last_stderr": "Último stderr",
+  "settings.last_stdout": "Última salida estándar",
+  "settings.loading_providers": "Cargando proveedores...",
+  "settings.managed_by_env": "Gestionado por variables de entorno",
+  "settings.model": "Modelo",
+  "settings.model_behavior": "Comportamiento del modelo",
+  "settings.model_behavior_desc": "Abre el selector del modelo predeterminado para elegir perfiles de razonamiento cuando estén disponibles.",
+  "settings.model_section_desc": "Elige el modelo de chat predeterminado y revisa cómo razona.",
+  "settings.model_title": "Modelo",
+  "settings.no_active_workspace": "No hay espacio de trabajo local activo.",
+  "settings.no_audit_entries": "Aún no hay entradas de auditoría.",
+  "settings.no_custom_path_set": "No se ha establecido ninguna ruta personalizada",
+  "settings.nuke_hint": "Úsalo solo si quieres restablecer del todo la app de escritorio y el estado del runtime de OpenCode.",
+  "settings.off": "Desactivado",
+  "settings.on": "Activado",
+  "settings.open_deeplink_action": "Abriendo...",
+  "settings.open_deeplink_button": "Abrir",
+  "settings.open_deeplink_desc": "Pega un deep link de OpenWork o una URL compartida para abrirla.",
+  "settings.open_deeplink_title": "Abrir deep link",
+  "settings.opencode_cache": "Caché de OpenCode",
+  "settings.opencode_cache_description": "Repara los datos en caché que se usan para iniciar el motor. Es seguro ejecutarlo.",
+  "settings.opencode_engine_desc": "Entorno de ejecución local para agentes, herramientas y proveedores de modelos.",
+  "settings.opencode_engine_label": "Motor de OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Sidecar del runtime local.",
+  "settings.opencode_sdk_desc": "Diagnósticos de conexión de la interfaz.",
+  "settings.opencode_sdk_title": "Motor de OpenCode",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Abrir deep link",
+  "settings.openwork_config_sidecar_desc": "Sidecar de configuración y aprobaciones.",
+  "settings.openwork_diagnostics_title": "Diagnóstico del servidor de OpenWork",
+  "settings.openwork_server_desc": "Plano de control de sesiones para la sincronización de la app, los workers y el acceso remoto",
+  "settings.openwork_server_label": "Servidor de OpenWork",
+  "settings.pending_permissions": "Permisos pendientes",
+  "settings.production_mode_badge": "Producción",
+  "settings.provider_default_desc": "Usa el comportamiento de razonamiento predeterminado integrado del modelo.",
+  "settings.provider_default_label": "Proveedor predeterminado",
+  "settings.provider_source_config": "Configuración",
+  "settings.provider_source_custom": "Personalizado",
+  "settings.provider_source_env": "Entorno",
+  "settings.providers_desc": "Servicios de conexión para modelos y herramientas.",
+  "settings.providers_title": "Proveedores",
+  "settings.quit_hint": "OpenWork se cierra inmediatamente después de la limpieza, por lo que el siguiente inicio comienza desde un estado local en blanco para este modo.",
+  "settings.recent_events": "Eventos recientes",
+  "settings.reconnect_failed": "No se ha podido volver a conectar. Comprueba la URL y el token del servidor, y vuelve a intentarlo.",
+  "settings.reconnect_server": "Reconectando...",
+  "settings.reconnect_server_failed": "No se pudo volver a conectar al servidor de OpenWork.",
+  "settings.reconnected": "Reconectado al servidor de OpenWork.",
+  "settings.reconnecting": "Reconectando...",
+  "settings.removing_containers": "Quitando contenedores...",
+  "settings.removing_local_state": "Eliminando estado local...",
+  "settings.repair_cache": "Reparar caché",
+  "settings.repairing_cache": "Reparando caché",
+  "settings.report_issue": "Informar un problema",
+  "settings.reset": "Reiniciar",
+  "settings.reset_app_data": "Restablecer datos de la aplicación",
+  "settings.reset_app_data_description": "Más agresivo. Borra el caché del OpenWork y los datos de la aplicación.",
+  "settings.reset_app_data_title": "Restablecer datos de la aplicación",
+  "settings.reset_app_data_warning": "Borra el caché del OpenWork y los datos de la aplicación en este dispositivo.",
+  "settings.reset_button": "Reiniciar",
+  "settings.reset_cancel": "Cancelar",
+  "settings.reset_config_defaults": "Restableciendo...",
+  "settings.reset_confirm_button": "Restablecer y reiniciar",
+  "settings.reset_confirmation_hint": "Escriba {resetWord} para confirmar. OpenWork se reiniciará.",
+  "settings.reset_confirmation_label": "Confirmación",
+  "settings.reset_confirmation_placeholder": "Tipo RESET",
+  "settings.reset_onboarding": "Restablecer incorporación",
+  "settings.reset_onboarding_description": "Borra las preferencias de OpenWork y reinicia la aplicación.",
+  "settings.reset_onboarding_title": "Restablecer incorporación",
+  "settings.reset_onboarding_warning": "Borra las preferencias locales de OpenWork y los marcadores de incorporación de espacio de trabajo.",
+  "settings.reset_openwork_desc_dev": "Con el modo de desarrollo activo, solo borra el estado de desarrollo aislado de OpenCode dentro de openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "Con el modo de desarrollo activo, solo borra el estado de desarrollo aislado de OpenCode dentro de openwork-dev-data.",
+  "settings.reset_openwork_title": "Restablecer el estado de OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "Requiere escribir RESET y reiniciará la aplicación.",
+  "settings.reset_startup": "Restablecer el modo de inicio predeterminado",
+  "settings.reset_startup_pref": "Restablecer preferencia de inicio",
+  "settings.reset_stop_active_runs": "Detenga las ejecuciones activas antes de reiniciar.",
+  "settings.resetting": "Restableciendo...",
+  "settings.restart_blocked_message": "OpenWork necesita reiniciarse para finalizar esta actualización. Para evitar interrumpir su trabajo actual, la instalación se pausa hasta que finalicen las ejecuciones activas o usted las detenga.",
+  "settings.restart_failed": "El reinicio falló. Verifique los registros e inténtelo nuevamente.",
+  "settings.restart_opencode": "Reiniciando...",
+  "settings.restart_openwork_server": "Reiniciando...",
+  "settings.restart_server_failed": "No se pudo reiniciar el servidor local.",
+  "settings.restarted": "Servidor local reiniciado.",
+  "settings.restarting": "Reiniciando...",
+  "settings.reveal_config": "Mostrar configuración",
+  "settings.reveal_config_requires_desktop": "La configuración de revelación requiere la app de escritorio",
+  "settings.run_sandbox_probe": "Ejecutar prueba del sandbox",
+  "settings.running_probe": "Ejecutando prueba...",
+  "settings.runtime_debug_desc": "Instantánea de diagnóstico legible con exportación con un solo clic.",
+  "settings.runtime_debug_title": "Informe de depuración del runtime",
+  "settings.runtime_desc": "Estado de tu motor local y del servidor de OpenWork.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Error",
+  "settings.sandbox_export_hint": "Usa Exportar en el informe de depuración del runtime para compartirlo con soporte.",
+  "settings.sandbox_probe_desc": "Ejecuta una comprobación temporal del arranque del sandbox de Docker y registra el resultado en el informe de depuración.",
+  "settings.sandbox_probe_success": "La prueba del sandbox se completó correctamente. Exporta el informe de depuración si necesitas ayuda.",
+  "settings.sandbox_probe_title": "Prueba del sandbox",
+  "settings.sandbox_ready": "Listo",
+  "settings.sandbox_requires_desktop": "La sonda Sandbox requiere una app de escritorio",
+  "settings.sandbox_result": "Resultado: {status}",
+  "settings.sandbox_run_id": "ID de ejecución: {id}",
+  "settings.sandbox_stop_runs_hint": "Detenga las ejecuciones activas antes de sondear",
+  "settings.search_models": "Buscar modelos…",
+  "settings.send_feedback": "Enviar comentarios",
+  "settings.show_model_reasoning": "Mostrar razonamiento del modelo",
+  "settings.show_model_reasoning_desc": "Amplíe las trazas de razonamiento en la interfaz de usuario cuando un modelo las exponga.",
+  "settings.showing_models": "Mostrando {count} de {total}",
+  "settings.startup": "Inicio",
+  "settings.startup_remote_warning": "La preferencia de inicio está configurada actualmente en remoto. Ajusta la configuración del motor si hace falta.",
+  "settings.startup_reset_hint": "Esto borra la preferencia guardada y vuelve a mostrar la pantalla de conexión.",
+  "settings.startup_title": "Puesta en marcha",
+  "settings.stop_local_server": "Detener el servidor local",
+  "settings.stop_runs_before_cleanup": "Detener ejecuciones activas antes de la limpieza",
+  "settings.stop_runs_before_reset_config": "Detenga las ejecuciones activas antes de restablecer la configuración",
+  "settings.stop_runs_to_reset": "Detener ejecuciones activas para restablecer",
+  "settings.switch": "Cambiar",
+  "settings.tab_advanced": "Avanzado",
+  "settings.tab_appearance": "Apariencia",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Depurar",
+  "settings.tab_description_advanced": "Inspecciona el estado del runtime, el estado de la conexión y los controles orientados a desarrolladores.",
+  "settings.tab_description_appearance": "Ajusta la apariencia de OpenWork en el escritorio, el tema del sistema y la app de Chrome.",
+  "settings.tab_description_debug": "Revisa diagnósticos, registros y utilidades avanzadas de depuración del runtime.",
+  "settings.tab_description_den": "Gestiona tu conexión con OpenWork Cloud y tu acceso alojado a workers y espacios de trabajo.",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "Gestiona aplicaciones MCP y Plugins de OpenCode para este espacio de trabajo.",
+  "settings.tab_description_general": "Conecta proveedores, elige el modelo predeterminado, autoriza carpetas y controla el espacio de trabajo seleccionado junto con su conexión de runtime.",
+  "settings.tab_description_recovery": "Repara el estado de migración, restablece los valores predeterminados del espacio de trabajo y recupera la configuración local.",
+  "settings.tab_description_skills": "Explora, edita e instala Skills sin salir de la configuración.",
+  "settings.tab_description_updates": "Mantén la app actualizada con comprobaciones silenciosas en segundo plano y controles de instalación.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Extensiones",
+  "settings.tab_general": "General",
+  "settings.tab_recovery": "Recuperación",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Actualizaciones",
+  "settings.theme_dark": "Oscuro",
+  "settings.theme_light": "Claro",
+  "settings.theme_system": "Sistema",
+  "settings.theme_system_hint": "El modo Sistema sigue automáticamente las preferencias de tu sistema operativo.",
+  "settings.update": "Actualizar",
+  "settings.update_available": "Actualización disponible: v",
+  "settings.update_available_version": "Actualización disponible: v{version}",
+  "settings.update_check_button": "Buscar",
+  "settings.update_check_failed": "Error en la comprobación de actualización",
+  "settings.update_checking": "Buscando...",
+  "settings.update_download_button": "Descargar",
+  "settings.update_downloading": "Descargando...",
+  "settings.update_install_button": "Instalar y reiniciar",
+  "settings.update_last_checked": "Última comprobación {time}",
+  "settings.update_published": "Publicado {date}",
+  "settings.update_ready": "Listo para instalar: v",
+  "settings.update_ready_version": "Listo para instalar: v{version}",
+  "settings.update_uptodate": "Al día",
+  "settings.updates": "Actualizaciones",
+  "settings.updates_desc": "Mantén OpenWork actualizado.",
+  "settings.updates_desktop_only": "Las actualizaciones solo están disponibles en la app de escritorio.",
+  "settings.updates_not_supported": "Las actualizaciones no son compatibles en este entorno.",
+  "settings.updates_title": "Actualizaciones",
+  "settings.window_appearance_desc": "Personaliza la apariencia de la ventana.",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {entorno de ejecuciónWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Configuración del espacio de trabajo",
+  "settings.workspace_debug_events_label": "Eventos de depuración del espacio de trabajo",
+  "share.back_hint": "Volver a compartir opciones",
+  "share.chooser_subtitle": "Elige cómo quieres compartir este espacio de trabajo.",
+  "share.close_hint": "Cerrar",
+  "share.option_access_desc": "Muestra los datos de conexión en vivo necesarios para acceder a este espacio de trabajo en ejecución desde otra máquina.",
+  "share.option_access_title": "Acceder al espacio de trabajo en remoto",
+  "share.subtitle_access": "Muestra los datos de conexión en vivo necesarios para acceder a este espacio de trabajo desde otra máquina.",
+  "share.title": "Compartir espacio de trabajo",
+  "share.view_access": "Acceder al espacio de trabajo en remoto",
+  "share.workspace_fallback": "workspace",
+  "share_skill_destination.add_to_workspace": "Añadir al espacio de trabajo",
+  "share_skill_destination.adding": "Añadiendo...",
+  "share_skill_destination.connect_remote": "Conectar espacio de trabajo remoto",
+  "share_skill_destination.connect_remote_hint": "Conecta un espacio de trabajo remoto para usarlo como destino.",
+  "share_skill_destination.create_worker": "Crear nuevo espacio de trabajo",
+  "share_skill_destination.create_worker_hint": "Crea un espacio de trabajo nuevo y luego añade esta Skill.",
+  "share_skill_destination.current_badge": "Actual",
+  "share_skill_destination.existing_workers": "Espacios de trabajo existentes",
+  "share_skill_destination.fallback_skill_name": "Skill compartida",
+  "share_skill_destination.local_badge": "Local",
+  "share_skill_destination.more_options": "Más opciones",
+  "share_skill_destination.no_workers": "Todavía no hay espacios de trabajo listos. Crea uno o conecta un espacio de trabajo remoto para instalar esta Skill.",
+  "share_skill_destination.remote_badge": "Remoto",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Seleccionado",
+  "share_skill_destination.selected_hint": "Seleccionado. Revisa el destino de abajo y luego confirma.",
+  "share_skill_destination.skill_label": "Skill compartida",
+  "share_skill_destination.subtitle": "Elige un espacio de trabajo existente o crea uno nuevo antes de importar esta Skill compartida.",
+  "share_skill_destination.title": "¿A dónde debería ir esta Skill?",
+  "share_skill_destination.trigger_label": "Activador",
+  "sidebar.collapse": "Colapsar",
+  "sidebar.expand": "Expandir",
+  "skills.add_custom_repo": "Añadir repositorio GitHub personalizado",
+  "skills.add_git_repo": "Añadir repositorio Git",
+  "skills.add_openwork_hub": "Añadir OpenWork Hub",
+  "skills.available_from_hub": "Disponible desde Hub",
+  "skills.catalog_search_placeholder": "Buscar Skills instaladas, del equipo y de hubs",
+  "skills.cloud_choose_org_detail": "Usa el panel de Cloud para elegir tu organización activa y luego actualiza esta lista.",
+  "skills.cloud_choose_org_hint": "Elige una organización en Configuración → Cloud para cargar Skills de equipo.",
+  "skills.cloud_footer_label": "Equipo",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "Se instaló {name} en este worker.",
+  "skills.cloud_installed_as": "Instalado como {name}",
+  "skills.cloud_installing": "Instalando {title}…",
+  "skills.cloud_installing_short": "Instalando",
+  "skills.cloud_no_search_matches": "Ninguna Skill coincide con esa búsqueda.",
+  "skills.cloud_org_empty": "Aún no hay Skills de organización disponibles.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "No se pudieron cargar las Skills de organización.",
+  "skills.cloud_refresh": "Actualizar las Skills del equipo",
+  "skills.cloud_section_subtitle": "Skills compartidas contigo a través de OpenWork Cloud, incluidos hubs de Skills del equipo a los que tienes acceso.",
+  "skills.cloud_section_title": "De tu organización",
+  "skills.cloud_shared_org": "organización",
+  "skills.cloud_shared_private": "Privado",
+  "skills.cloud_shared_public": "Público",
+  "skills.cloud_sign_in": "Iniciar sesión en Cloud",
+  "skills.cloud_sign_in_hint": "Inicia sesión en OpenWork Cloud para explorar las Skills de equipo y organización.",
+  "skills.cloud_status_installed": "Instalado",
+  "skills.cloud_status_update": "Actualización disponible",
+  "skills.cloud_update_skill": "Actualizar",
+  "skills.cloud_updated": "{name} actualizado en este worker.",
+  "skills.cloud_updating": "Actualizando {title}…",
+  "skills.cloud_removed": "Se eliminó la Skill de Cloud local {name}.",
+  "skills.copy_link_failed": "No se pudo copiar el enlace",
+  "skills.create_in_chat": "Crear Skill en el chat",
+  "skills.desktop_required": "La gestión de Skills requiere la app de escritorio.",
+  "skills.enter_plugin_name": "Introduce un nombre de paquete de Plugin.",
+  "skills.failed_load_active": "No se pudieron cargar los Plugins activos.",
+  "skills.failed_load_opencode": "No se pudo cargar opencode.json",
+  "skills.failed_parse_opencode": "No se pudo analizar opencode.json",
+  "skills.failed_to_load": "No se pudieron cargar las Skills",
+  "skills.failed_update_opencode": "No se pudo actualizar opencode.json",
+  "skills.filter_all": "Todo",
+  "skills.filter_cloud": "Equipo",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Instalado",
+  "skills.from_repo": "Desde {owner}/{repo}",
+  "skills.github_repo_hint": "Introduce un repositorio de GitHub con el formato `owner/repo`.",
+  "skills.host_mode_only": "Solo espacio de trabajo local",
+  "skills.host_only_error": "La gestión del Skill requiere un espacio de trabajo local o un servidor de OpenWork conectado.",
+  "skills.hub_desc": "Explora Skills compartidas desde hubs respaldados por GitHub y agrégalas a este worker.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Importar",
+  "skills.import_failed": "Error de importación ({status})",
+  "skills.import_local": "Importar Skill local",
+  "skills.import_local_skill": "Importar Skill local",
+  "skills.imported": "Importado.",
+  "skills.install": "Instalar",
+  "skills.install_failed": "La instalación de Skill falló.",
+  "skills.install_name_title": "Instalar {name}",
+  "skills.installed": "Skills instaladas",
+  "skills.installed_desc": "Las Skills instaladas están disponibles en este worker y se pueden editar o compartir.",
+  "skills.installed_status": "Instalado",
+  "skills.installing": "Añadir Skill",
+  "skills.installing_prefix": "Instalando {name}…",
+  "skills.installing_skill_creator": "Instalando creador de Skills...",
+  "skills.link_copied": "Enlace copiado",
+  "skills.loading": "Cargando…",
+  "skills.no_description": "Aún no hay descripción.",
+  "skills.no_hub_repo_label": "No se seleccionó ningún repositorio central",
+  "skills.no_hub_repo_selected": "No hay Skills de hub disponibles.",
+  "skills.no_hub_skills": "No has seleccionado ningún repositorio central. Añade un repositorio GitHub para explorar Skills.",
+  "skills.no_opencode_found": "Todavía no se ha encontrado opencode.json. Añade un Plugin para crear uno.",
+  "skills.no_opencode_workspace": "Aún no hay opencode.json en este espacio de trabajo.",
+  "skills.no_skills": "No se detectaron Skills en `.opencode/skills`, `.claude/skills` o `~/.agents/skills`.",
+  "skills.no_skills_found": "Aún no se han encontrado Skills.",
+  "skills.owner_label": "Dueño",
+  "skills.owner_repo_required": "Hacen falta propietario y repositorio.",
+  "skills.pick_project_first": "Elige primero una carpeta de proyecto.",
+  "skills.pick_project_for_active": "Elige una carpeta de proyecto para cargar Plugins activos.",
+  "skills.pick_project_for_plugins": "Elige una carpeta de proyecto para administrar los Plugins del proyecto.",
+  "skills.pick_workspace_first": "Elige primero una carpeta del espacio de trabajo.",
+  "skills.plugin_already_listed": "Plugin ya figura en opencode.json.",
+  "skills.plugin_management_host_only": "La administración de Plugin requiere la app de escritorio.",
+  "skills.plugins_host_only": "Plugins solo están disponibles en la app de escritorio.",
+  "skills.ref_label": "Ref (sucursal/tag/commit)",
+  "skills.refresh": "Actualizar",
+  "skills.refresh_hub": "Actualizar centro",
+  "skills.remove_saved_repo": "Eliminar repositorio guardado",
+  "skills.repo_label": "Repositorio",
+  "skills.reveal_failed": "No se pudo abrir la carpeta de Skills.",
+  "skills.reveal_folder": "Abrir carpeta de Skills",
+  "skills.save_and_load": "Guardar y cargar",
+  "skills.select_skill_folder": "Seleccionar carpeta de Skills",
+  "skills.share_back": "Atrás",
+  "skills.share_chooser_subtitle": "Guárdala en tu organización de OpenWork Cloud o publica un enlace público de instalación.",
+  "skills.share_close": "Cerrar",
+  "skills.share_copy_link": "Copiar",
+  "skills.share_done": "Hecho",
+  "skills.share_option_public_desc": "Crea un enlace que cualquiera pueda usar para instalar esta Skill.",
+  "skills.share_option_public_title": "Enlace público",
+  "skills.share_option_team_desc": "Añade esta Skill a tu organización activa de OpenWork Cloud.",
+  "skills.share_option_team_title": "Compartir con el equipo",
+  "skills.share_public_create": "Crear enlace",
+  "skills.share_public_creating": "Publicación…",
+  "skills.share_public_intro": "Publica un enlace público. Cualquiera que tenga la URL podrá instalar esta Skill.",
+  "skills.share_public_regenerate": "Regenerar enlace",
+  "skills.share_publisher_label": "Editor",
+  "skills.share_subtitle_public": "Cualquiera que tenga el enlace puede instalar esta Skill.",
+  "skills.share_subtitle_team": "Se guarda en tu organización para que tu equipo pueda instalarla.",
+  "skills.share_team_choose_org": "Elige una organización en Configuración → Cloud antes de compartirla con tu equipo.",
+  "skills.share_team_permissions_intro": "Sube esta Skill a tu organización OpenWork Cloud activa y decide quién puede verla.",
+  "skills.share_team_permissions_label": "Compartir permisos",
+  "skills.share_team_permission_org": "Solo organización: no en el centro",
+  "skills.share_team_permission_private": "Privado solo para mi",
+  "skills.share_team_hubs_loading": "Cargando centros…",
+  "skills.share_team_org_fallback": "Organización activa Cloud",
+  "skills.share_team_upload_and_save": "Subir y guardar",
+  "skills.share_team_uploading": "Subiendo…",
+  "skills.share_team_sign_in": "Inicia sesión para compartir con el equipo",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud se abre en tu navegador. Vuelve aquí después de iniciar sesión.",
+  "skills.share_team_uploaded_success": "Subido a {org}. Las Skills de Cloud se actualizarán para tu cuenta.",
+  "skills.share_title": "Compartir Skill",
+  "skills.shown_count": "Se muestra {count}",
+  "skills.skill_creator_already_installed": "La Skill para crear Skills ya está instalada.",
+  "skills.skill_creator_installed": "Se instaló la Skill para crear Skills.",
+  "skills.skill_load_failed": "No se pudo cargar la Skill.",
+  "skills.source_label": "Fuente",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Activador: {trigger}",
+  "skills.uninstall": "Desinstalar",
+  "skills.uninstall_failed": "No se pudo desinstalar la Skill.",
+  "skills.uninstall_title": "¿Desinstalar Skill?",
+  "skills.uninstall_warning": "Esto eliminará permanentemente la Skill `{name}` de tu espacio de trabajo.",
+  "skills.uninstalled": "Skill desinstalada.",
+  "skills.unknown_error": "Error desconocido",
+  "skills.worker_profile_desc": "Las Skills son las capacidades principales de este worker. Descúbrelas desde un Hub, gestiona las instaladas y crea nuevas directamente en el chat.",
+  "status.back": "Volver a la pantalla anterior",
+  "status.connected": "Conectado",
+  "status.connecting": "Conectando",
+  "status.creating_task": "Creando nueva tarea",
+  "status.developer_mode": "Modo desarrollador",
+  "status.disconnected": "Desconectado",
+  "status.disconnected_hint": "Abre la configuración para volver a conectarte.",
+  "status.disconnected_label": "Desconectado",
+  "status.docs": "Docs",
+  "status.feedback": "Comentario",
+  "status.limited_hint": "Vuelve a conectarte para recuperar todas las funciones de OpenWork.",
+  "status.limited_mcp_hint": "{count} MCP conectado · vuelve a conectarte para tenerlo todo",
+  "status.limited_mode": "Modo limitado",
+  "status.loading_session": "Cargando sesión",
+  "status.mcp_connected": "{count} MCP conectado",
+  "status.open_docs": "Abrir documentación",
+  "status.openwork_ready": "OpenWork listo",
+  "status.providers_connected_one": "{count} proveedor conectado",
+  "status.providers_connected_other": "{count} proveedors conectado",
+  "status.ready_for_tasks": "Listo para nuevas tareas",
+  "status.running": "En ejecución",
+  "status.send_feedback": "Enviar comentarios",
+  "status.settings": "Ajustes",
+  "system.reload_body_agents": "OpenCode carga agentes al inicio. Vuelve a cargar el motor para que los agentes actualizados estén disponibles.",
+  "system.reload_body_commands": "OpenCode carga Commands al inicio. Vuelve a cargar el motor para que los Commands actualizados estén disponibles.",
+  "system.reload_body_config": "OpenCode lee opencode.json al inicio. Vuelve a cargar el motor para aplicar los cambios de configuración.",
+  "system.reload_body_default": "OpenWork detectó cambios que requieren recargar la instancia OpenCode.",
+  "system.reload_body_mcp": "OpenCode carga los servidores MCP al inicio. Vuelve a cargar el motor para activar la nueva conexión.",
+  "system.reload_body_mixed": "OpenWork detectó cambios de configuración de OpenCode. Vuelve a cargar el motor para aplicarlos.",
+  "system.reload_body_plugins": "OpenCode carga Plugins npm al inicio. Vuelve a cargar el motor para aplicar los cambios opencode.json.",
+  "system.reload_body_skills": "OpenCode puede almacenar en caché el descubrimiento y estado de Skills. Vuelve a cargar el motor para que las Skills recién instaladas estén disponibles.",
+  "system.reload_failed": "No se pudo recargar el motor.",
+  "system.reload_required": "Hace falta recargar",
+  "system.reload_unavailable": "La recarga no está disponible para este worker.",
+  "system.stop_active_runs_before_reset": "Detenga las ejecuciones activas antes de reiniciar.",
+  "time.hours_ago": "Hace {count}h",
+  "time.just_now": "En este momento",
+  "time.minutes_ago": "Hace {count}m",
+  "time.seconds_ago": "Hace {count}s",
+  "workspace.loading_tasks": "Cargando tareas...",
+  "workspace.local_badge": "Local",
+  "workspace.new_task_inline": "+ Nueva tarea",
+  "workspace.no_tasks": "Aún no hay tareas.",
+  "workspace.remote_badge": "Remoto",
+  "workspace.rename_description": "Actualiza el nombre que se muestra en la barra lateral.",
+  "workspace.rename_label": "Nombre del espacio de trabajo",
+  "workspace.rename_placeholder": "Equipo de diseño espacio de trabajo",
+  "workspace.rename_title": "Editar nombre espacio de trabajo",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Seleccionado",
+  "workspace_list.add_workspace": "Añadir espacio de trabajo",
+  "workspace_list.connecting": "Conectando...",
+  "workspace_list.delete_session": "Eliminar sesión",
+  "workspace_list.edit_connection": "Editar conexión",
+  "workspace_list.edit_name": "Editar nombre",
+  "workspace_list.hide_child_sessions": "Ocultar sesiones secundarias",
+  "workspace_list.recover": "Recuperar",
+  "workspace_list.remote_worker_unavailable": "Worker remoto no disponible",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork no puede cargar tareas de este worker hasta que se arregle la conexión.",
+  "workspace_list.remove_workspace": "Quitar espacio de trabajo",
+  "workspace_list.rename_session": "Cambiar nombre de la sesión",
+  "workspace_list.reveal_explorer": "Revelar en Explorar",
+  "workspace_list.reveal_finder": "Revelar en Finder",
+  "workspace_list.session_actions": "Acciones de sesión",
+  "workspace_list.share": "Compartir...",
+  "workspace_list.show_child_sessions": "Mostrar sesiones secundarias",
+  "workspace_list.show_more": "Mostrar {count} más",
+  "workspace_list.show_more_fallback": "Mostrar más",
+  "workspace_list.test_connection": "Probar conexión",
+  "workspace_list.unavailable": "No disponible",
+  "workspace_list.workspace_fallback": "workspace",
+  "workspace_list.workspace_options": "Opciones de espacio de trabajo",
+} as const;
diff --git a/apps/app/src/i18n/locales/fr.ts b/apps/app/src/i18n/locales/fr.ts
new file mode 100644
index 0000000000..eb510c255a
--- /dev/null
+++ b/apps/app/src/i18n/locales/fr.ts
@@ -0,0 +1,1417 @@
+/**
+ * French translations (Français)
+ * Professional terms (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) are NOT translated
+ */
+
+export default {
+  "app.compact_command_desc": "Résumez cette session pour réduire la taille du contexte.",
+  "app.error_audit_load": "Échec du chargement du journal d'audit.",
+  "app.error_auth_failed": "Échec de l'authentification",
+  "app.error_command_not_resolved": "La commande n'a pas été résolue.",
+  "app.error_compact_empty": "Rien à compacter pour le moment.",
+  "app.error_compact_no_session": "Sélectionnez une session avec des messages avant d'exécuter /compact.",
+  "app.error_compact_no_session_id": "Sélectionnez une session avant de compacter.",
+  "app.error_connect_first": "Connectez-vous d'abord à ce worker avant d'appliquer des changements d'exécution.",
+  "app.error_not_connected": "Non connecté à un serveur",
+  "app.error_rate_limit": "Limite de débit dépassée",
+  "app.error_remote_access": "Échec de la mise à jour de l'accès distant.",
+  "app.error_request_failed": "Échec de la requête",
+  "app.error_restart_local_worker": "Échec du redémarrage du worker local avec le paramètre de partage mis à jour.",
+  "app.error_session_name_required": "Le nom de la session est requis",
+  "app.local_disabled_reason": "Créez des espaces de travail locaux dans l'application desktop. Les espaces de travail distants et partagés fonctionnent toujours ici.",
+  "app.model_behavior_title": "Comportement du modèle",
+  "app.plugins_hint_readonly": "Le serveur OpenWork est en lecture seule pour les Plugins.",
+  "app.reload_later": "Plus tard",
+  "app.reload_now": "Recharger maintenant",
+  "app.reload_stop_tasks": "Recharger et arrêter les tâches",
+  "app.skills_hint_readonly": "Le serveur OpenWork est en lecture seule pour les Skills. Ajoutez un jeton hôte dans Avancé pour activer les installations.",
+  "app.unknown_error": "Erreur inconnue",
+  "blueprint.automation_body": "Commencez à partir d'un workflow réutilisable ou saisissez votre propre tâche ci-dessous.",
+  "blueprint.automation_title": "Que voulez-vous automatiser ?",
+  "blueprint.csv_session_assistant": "Je peux vous aider à générer, nettoyer, fusionner et résumer des fichiers CSV. Quel type de travail CSV voulez-vous automatiser ?",
+  "blueprint.csv_session_title": "Idées de workflow CSV",
+  "blueprint.csv_session_user": "Je veux combiner des exports de plusieurs outils en un seul CSV propre.",
+  "blueprint.empty_body": "Choisissez un point de départ ou saisissez simplement ci-dessous.",
+  "blueprint.empty_title": "Que voulez-vous faire ?",
+  "blueprint.minimal_body": "Posez une question sur cet espace de travail ou utilisez un prompt de départ.",
+  "blueprint.minimal_title": "Commencer par une tâche",
+  "blueprint.starter_blueprint_desc": "Concevez un workflow répétable avec des Skills, des Commands et des étapes de transfert.",
+  "blueprint.starter_blueprint_prompt": "Aidez-moi à concevoir un blueprint d'automatisation réutilisable pour cet espace de travail. Demandez ce qui doit être standardisé, puis proposez le workflow.",
+  "blueprint.starter_blueprint_title": "Planifier un blueprint d'automatisation",
+  "blueprint.starter_chrome_desc": "Démarrez immédiatement une conversation d'automatisation du navigateur.",
+  "blueprint.starter_chrome_prompt": "Aidez-moi à me connecter à Chrome et à automatiser une tâche répétitive.",
+  "blueprint.starter_chrome_title": "Automatiser Chrome",
+  "blueprint.starter_command_desc": "Transformez un workflow répété en commande slash pour cet espace de travail.",
+  "blueprint.starter_command_prompt": "Aidez-moi à créer une /command réutilisable pour cet espace de travail. Demandez quel workflow je veux automatiser, puis rédigez la commande.",
+  "blueprint.starter_command_title": "Créer une commande réutilisable",
+  "blueprint.starter_connect_openai_desc": "Ajoutez votre fournisseur OpenAI pour que les modèles ChatGPT soient prêts dans les nouvelles sessions.",
+  "blueprint.starter_connect_openai_title": "Connecter ChatGPT",
+  "blueprint.starter_csv_desc": "Nettoyez ou générez des données de feuille de calcul.",
+  "blueprint.starter_csv_prompt": "Aidez-moi à créer ou modifier des fichiers CSV sur cet ordinateur.",
+  "blueprint.starter_csv_title": "Travailler sur un CSV",
+  "blueprint.starter_explore_desc": "Résumez les fichiers et suggérez la meilleure première tâche à traiter.",
+  "blueprint.starter_explore_prompt": "Résumez cet espace de travail, indiquez les fichiers les plus importants et suggérez la meilleure première tâche.",
+  "blueprint.starter_explore_title": "Explorer cet espace de travail",
+  "blueprint.welcome_message": "Bonjour, bienvenue sur OpenWork !\n\nLes gens nous utilisent pour écrire des fichiers .csv sur leur ordinateur, se connecter à Chrome et automatiser des tâches répétitives, et synchroniser des contacts avec Notion.\n\nMais la seule limite est votre imagination.\n\nQue voudriez-vous faire ?",
+  "blueprint.welcome_title": "Bienvenue sur OpenWork",
+  "common.add": "Ajouter",
+  "common.cancel": "Annuler",
+  "common.close": "Fermer",
+  "common.default_parens": "(par défaut)",
+  "common.edit": "Modifier",
+  "common.hide": "Masquer",
+  "common.navigate": "naviguer",
+  "common.next": "Suivant",
+  "common.off": "Désactivé",
+  "common.on": "Activé",
+  "common.path": "Chemin",
+  "common.question": "Question",
+  "common.refresh": "Actualiser",
+  "common.remove": "Supprimer",
+  "common.reset": "Réinitialiser",
+  "common.save": "Enregistrer",
+  "common.select": "sélectionner",
+  "common.show": "Afficher",
+  "common.something_went_wrong": "Un problème est survenu",
+  "common.submit": "Envoyer",
+  "common.unknown": "Inconnu",
+  "composer.agent_label": "Agent",
+  "composer.attach_files": "Joindre des fichiers",
+  "composer.attachments_unavailable": "Les pièces jointes ne sont pas disponibles.",
+  "composer.behavior_label": "Comportement",
+  "composer.configure": "Configurer",
+  "composer.default_agent": "Agent par défaut",
+  "composer.file_exceeds_limit": "{name} dépasse la limite de 8 Mo.",
+  "composer.file_kind": "Fichier",
+  "composer.image_kind": "Image",
+  "composer.inserted_links_unsupported": "Liens insérés pour des fichiers non pris en charge.",
+  "composer.loading_commands": "Chargement des Commands...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "Aucune commande trouvée.",
+  "composer.placeholder": "Décrivez votre tâche...",
+  "composer.remote_worker_paste_warning": "Ceci est un worker distant. Les sandboxes sont aussi distantes. Pour partager des fichiers avec lui, téléversez-les dans le dossier Shared dans la barre latérale.",
+  "composer.run_task": "Exécuter la tâche",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Arrêter",
+  "composer.tools_label": "Commands, Skills et MCPs",
+  "composer.unsupported_attachment_type": "Type de pièce jointe non pris en charge.",
+  "composer.upload_to_shared_folder": "Téléverser vers le dossier partagé",
+  "composer.uploaded_multiple_files": "{count} fichiers téléversés vers le dossier partagé et liens insérés.",
+  "composer.uploaded_single_file": "{name} a été téléversé vers le dossier partagé et un lien a été inséré.",
+  "config.collaborator_token_disabled_hint": "Stocké à l'avance pour le partage distant, mais l'accès distant est actuellement désactivé.",
+  "config.collaborator_token_label": "Jeton collaborateur",
+  "config.collaborator_token_remote_hint": "Accès distant courant pour les téléphones ou ordinateurs portables se connectant à ce serveur.",
+  "config.connection_failed": "Échec de la connexion.",
+  "config.connection_failed_check": "Échec de la connexion. Vérifiez l'URL de l'hôte et le jeton.",
+  "config.connection_status_updated": "État de connexion mis à jour.",
+  "config.connection_successful": "Connexion réussie.",
+  "config.copied": "Copié",
+  "config.copy": "Copier",
+  "config.desktop_only_hint": "Certaines fonctions de configuration (partage du serveur local + bridge de messagerie) nécessitent l'application desktop.",
+  "config.diagnostics_desc": "Copiez un état d'exécution nettoyé pour le débogage.",
+  "config.diagnostics_title": "Bundle de diagnostic",
+  "config.engine_reload_desc": "Redémarrez le serveur OpenCode pour cet espace de travail.",
+  "config.engine_reload_title": "Rechargement du moteur",
+  "config.host_admin_token_hint": "Jeton interne réservé à l'hôte pour la CLI des approbations et les API d'administration. Ne l'utilisez pas dans le flux de connexion d'application distante.",
+  "config.host_admin_token_label": "Jeton admin hôte",
+  "config.host_local_only": "Local uniquement",
+  "config.host_offline": "Hors ligne",
+  "config.host_remote_enabled": "Distant activé",
+  "config.local_ip_hint": "Utilisez votre IP locale sur le même Wi‑Fi pour la connexion la plus rapide.",
+  "config.mdns_hint": "Les noms .local sont plus faciles à retenir, mais peuvent ne pas être résolus sur tous les réseaux.",
+  "config.messaging_identities_desc": "Gérez les identités Telegram/Slack et le routage dans l'onglet Identities.",
+  "config.messaging_identities_title": "Identités de messagerie",
+  "config.not_set": "Non défini",
+  "config.owner_token_disabled_hint": "Pertinent seulement après avoir activé l'accès distant pour ce worker.",
+  "config.owner_token_label": "Jeton propriétaire",
+  "config.owner_token_remote_hint": "Utilisez-le lorsqu'un client distant doit répondre aux demandes d'autorisation ou effectuer des actions réservées au propriétaire.",
+  "config.reload_active_tasks_warning": "Le rechargement arrêtera les tâches actives.",
+  "config.reload_availability_hint": "Le rechargement n'est disponible que pour les workers locaux ou les serveurs OpenWork connectés.",
+  "config.reload_connect_hint": "Connectez-vous à ce worker pour recharger.",
+  "config.reload_engine": "Recharger le moteur",
+  "config.reload_now_desc": "Applique les mises à jour de configuration et reconnecte votre session.",
+  "config.reload_now_title": "Recharger maintenant",
+  "config.reloading": "Rechargement...",
+  "config.remote_access_off_hint": "L'accès distant est désactivé. Utilisez Partager l'espace de travail pour l'activer avant de vous connecter depuis une autre machine.",
+  "config.resolved_worker_url": "URL du worker résolue :",
+  "config.server_needed_hint": "Connexion au serveur OpenWork nécessaire pour synchroniser Skills, Plugins et Commands.",
+  "config.server_section_desc": "Connectez-vous à un serveur OpenWork. Utilisez l'URL plus un jeton collaborateur ou propriétaire fourni par l'administrateur de votre serveur.",
+  "config.server_section_title": "Serveur OpenWork",
+  "config.server_sharing_desc": "Partagez ces détails avec un appareil de confiance. Gardez le serveur sur le même réseau pour une configuration plus rapide.",
+  "config.server_sharing_menu_hint": "Pour des liens de partage par espace de travail, utilisez Partager... dans le menu de l'espace de travail.",
+  "config.server_sharing_title": "Partage du serveur OpenWork",
+  "config.server_url_hint": "Utilisez l'URL partagée par votre serveur OpenWork. Les workers desktop locaux réutilisent un port élevé persistant dans la plage 48000-51000.",
+  "config.server_url_input_label": "URL du serveur OpenWork",
+  "config.server_url_label": "URL du serveur OpenWork",
+  "config.starting_server": "Démarrage du serveur…",
+  "config.status_connected": "Connecté",
+  "config.status_limited": "Limité",
+  "config.status_not_connected": "Non connecté",
+  "config.test_connection": "Tester la connexion",
+  "config.testing": "Test...",
+  "config.testing_connection": "Test de la connexion...",
+  "config.token_hint": "Optionnel. Collez un jeton collaborateur pour un accès courant ou un jeton propriétaire si ce client doit répondre aux demandes d'autorisation.",
+  "config.token_label": "Jeton collaborateur ou propriétaire",
+  "config.token_placeholder": "Collez votre jeton",
+  "config.unavailable": "Indisponible",
+  "config.worker_id": "ID du worker :",
+  "config.workspace_config_desc": "Ces paramètres affectent l'espace de travail sélectionné. Les actions limitées à l'exécution s'appliquent à l'espace de travail actuellement connecté.",
+  "config.workspace_config_title": "Configuration de l'espace de travail",
+  "config.workspace_id_prefix": "Espace de travail :",
+  "context_panel.add_button": "Ajouter",
+  "context_panel.add_folder_hint": "Ajoutez un dossier pour permettre à cet espace de travail de lire et modifier des fichiers en dehors de son répertoire racine.",
+  "context_panel.adding_button": "Ajout...",
+  "context_panel.always_available": "Toujours disponible",
+  "context_panel.authorized_folders": "Dossiers autorisés",
+  "context_panel.authorized_folders_desc": "Accordez à cet espace de travail l'accès en lecture et écriture à des répertoires situés hors de sa racine.",
+  "context_panel.authorized_folders_no_access": "Connectez-vous à un espace de travail de serveur OpenWork accessible en écriture pour modifier les dossiers autorisés.",
+  "context_panel.browse_button": "Parcourir",
+  "context_panel.config_access_unavailable": "L'accès à la configuration du serveur OpenWork est indisponible pour cet espace de travail.",
+  "context_panel.config_read_only": "Le serveur OpenWork est connecté en lecture seule pour la configuration de l'espace de travail.",
+  "context_panel.folder_already_authorized": "Le dossier est déjà autorisé.",
+  "context_panel.folders_updated": "Dossiers autorisés mis à jour.",
+  "context_panel.input_placeholder": "Saisissez un chemin de dossier à autoriser...",
+  "context_panel.no_external_folders": "Aucun dossier externe autorisé",
+  "context_panel.no_mcp": "Aucun serveur MCP chargé.",
+  "context_panel.no_server_workspace": "Aucun espace de travail serveur actif sélectionné.",
+  "context_panel.no_skills": "Aucun Skill chargé.",
+  "context_panel.preserving_entries": "Conservation de {count} entrées d'autorisation non liées à des dossiers.",
+  "context_panel.preserving_entry": "Conservation d'une entrée d'autorisation non liée à un dossier.",
+  "context_panel.remove_folder": "Supprimer {name}",
+  "context_panel.saving_folders": "Enregistrement des dossiers autorisés...",
+  "context_panel.server_disconnected": "Le serveur OpenWork est déconnecté.",
+  "context_panel.workspace_root_available": "La racine de l'espace de travail est déjà disponible.",
+  "context_panel.workspace_root_badge": "Racine de l'espace de travail",
+  "context_panel.writable_workspace_required": "Un espace de travail de serveur OpenWork accessible en écriture est requis pour mettre à jour les dossiers autorisés.",
+  "dashboard.change": "Modifier",
+  "dashboard.choose_folder": "Choisir un dossier",
+  "dashboard.choose_folder_continue": "Choisissez un dossier pour continuer.",
+  "dashboard.chooser_local_desc": "Créez un espace de travail sur cet appareil et démarrez éventuellement à partir d'un modèle d'équipe.",
+  "dashboard.chooser_remote_desc": "Attachez-vous à un worker OpenWork auto-hébergé en utilisant une URL et un jeton d'accès.",
+  "dashboard.chooser_shared_desc": "Parcourez les workers cloud partagés avec votre organisation et connectez-vous en une étape.",
+  "dashboard.close_settings": "Fermer les paramètres",
+  "dashboard.cloud_worker": "Worker cloud",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Connecter un accès distant",
+  "dashboard.connected": "Connecté",
+  "dashboard.connecting": "Connexion...",
+  "dashboard.create_local_workspace_subtitle": "Créez un espace de travail sur cet appareil et démarrez éventuellement à partir d'un modèle d'équipe.",
+  "dashboard.create_local_workspace_title": "Espace de travail local",
+  "dashboard.create_remote_custom_subtitle": "Attachez-vous à un worker OpenWork auto-hébergé.",
+  "dashboard.create_remote_custom_title": "Connecter un accès distant personnalisé",
+  "dashboard.create_remote_workspace_confirm": "Ajouter l'espace de travail",
+  "dashboard.create_remote_workspace_subtitle": "Enregistrez un serveur OpenWork comme espace de travail.",
+  "dashboard.create_remote_workspace_title": "Ajouter un espace de travail distant",
+  "dashboard.create_sandbox_confirm": "Créer comme sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "Parcourez les workers cloud partagés avec votre organisation et connectez-vous en une étape.",
+  "dashboard.create_shared_subtitle_signed_out": "Connectez-vous à OpenWork Cloud pour accéder aux workers partagés avec votre organisation.",
+  "dashboard.create_shared_title": "Espaces de travail partagés",
+  "dashboard.create_workspace_confirm": "Créer l'espace de travail",
+  "dashboard.create_workspace_subtitle": "Initialiser un nouvel espace de travail basé sur un dossier.",
+  "dashboard.create_workspace_title": "Créer un espace de travail",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Enregistrer la connexion",
+  "dashboard.edit_remote_workspace_subtitle": "Mettez à jour les détails du serveur OpenWork pour cet espace de travail.",
+  "dashboard.edit_remote_workspace_title": "Modifier la connexion distante",
+  "dashboard.error_choose_org": "Choisissez une organisation avant d'ouvrir un espace de travail.",
+  "dashboard.error_connect_worker": "Échec de la connexion à {name}.",
+  "dashboard.error_load_orgs": "Échec du chargement des organisations.",
+  "dashboard.error_load_shared_workspaces": "Échec du chargement des espaces de travail partagés.",
+  "dashboard.error_workspace_not_ready": "L'espace de travail n'est pas encore prêt à être connecté. Réessayez dans un instant.",
+  "dashboard.import_config": "Importer la configuration",
+  "dashboard.importing": "Importation…",
+  "dashboard.modal_back": "Retour",
+  "dashboard.modal_close": "Fermer la fenêtre Ajouter un espace de travail",
+  "dashboard.remote": "Distant",
+  "dashboard.remote_base_url_required": "Ajoutez une URL de serveur pour continuer.",
+  "dashboard.remote_server_details_hint": "Attachez-vous à un worker OpenWork auto-hébergé.",
+  "dashboard.remote_server_details_title": "Détails du serveur distant",
+  "dashboard.sandbox_checking_docker": "Vérification de Docker...",
+  "dashboard.sandbox_get_ready_title": "Les sandboxes nécessitent Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Attention",
+  "dashboard.worker_status_ready": "Prêt",
+  "dashboard.worker_status_starting": "Démarrage",
+  "dashboard.worker_status_stopped": "Arrêté",
+  "dashboard.worker_status_unknown": "Inconnu",
+  "den.active_org_hint": "Les workers cloud et les modèles d'équipe sont limités à l'organisation sélectionnée.",
+  "den.active_org_title": "Organisation active",
+  "den.auto_reconnect_hint": "Terminez l'authentification dans votre navigateur et OpenWork se reconnectera automatiquement ici.",
+  "den.checking_session": "Vérification de la session",
+  "den.choose_org_for_providers": "Choisissez une organisation pour voir les fournisseurs cloud.",
+  "den.choose_org_for_skills": "Choisissez une organisation pour voir les Skills cloud.",
+  "den.choose_org_for_skill_hubs": "Choisissez une organisation pour voir les hubs de Skills cloud.",
+  "den.cloud_account_hint": "Gérez votre compte connecté et votre organisation.",
+  "den.cloud_account_title": "Compte cloud",
+  "den.cloud_control_plane_open": "Ouvrir dans le navigateur",
+  "den.cloud_control_plane_reset": "Réinitialiser",
+  "den.cloud_control_plane_save": "Enregistrer l'URL",
+  "den.cloud_control_plane_url_hint": "Mode développeur uniquement. Utilisez ceci pour cibler un plan de contrôle Cloud local ou auto-hébergé. Le modifier vous déconnecte afin que l'application puisse se réhydrater avec le nouveau plan de contrôle.",
+  "den.cloud_control_plane_url_label": "URL du plan de contrôle Cloud",
+  "den.cloud_provider_detail": "{count} modèles · fournisseur {source}",
+  "den.cloud_provider_removed_detail": "Ce fournisseur importé n'est plus dans le cloud. Désinstallez la configuration locale {providerId}.",
+  "den.cloud_provider_sync_detail": "Le fournisseur cloud a changé. Synchronisez la configuration {source} du modèle {count} dans opencode.jsonc.",
+  "den.cloud_skill_detail": "Installez ce Skill cloud dans .opencode/skills.",
+  "den.cloud_skill_imported_detail": "Installé localement sous {name}.",
+  "den.cloud_skill_removed_detail": "Ce Skill cloud a été supprimé en amont. Désinstallez la copie locale {name}.",
+  "den.cloud_skill_sync_detail": "Une version cloud plus récente est disponible pour {name}. Mettez à jour la copie locale pour rester synchronisé.",
+  "den.cloud_skills_hint": "Parcourez les Skills cloud individuels auxquels vous avez accès, installez-les localement et mettez-les à jour lorsque la version distante change.",
+  "den.cloud_skills_title": "Skills",
+  "den.cloud_providers_hint": "Importez des fournisseurs LLM gérés dans opencode.jsonc et utilisez l'identifiant de l'organisation dans cet espace de travail.",
+  "den.cloud_providers_title": "Fournisseurs cloud",
+  "den.cloud_section_desc": "Connectez-vous, choisissez une organisation et ouvrez des workers Cloud ou des modèles d'équipe.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Connectez-vous à OpenWork Cloud pour garder vos tâches actives même lorsque votre ordinateur est en veille.",
+  "den.cloud_workers_hint": "Ouvrez directement les workers dans OpenWork en utilisant le même flux de connexion distante que l'application utilise ailleurs.",
+  "den.cloud_workers_title": "Workers cloud",
+  "den.create_account": "Créer un compte",
+  "den.credentials_ready_badge": "Identifiant prêt",
+  "den.error_base_url": "Entrez une URL de plan de contrôle Cloud valide en http:// ou https://.",
+  "den.error_choose_org": "Choisissez une organisation avant d'ouvrir un worker.",
+  "den.error_load_orgs": "Échec du chargement des organisations.",
+  "den.error_load_skills": "Échec du chargement des Skills cloud.",
+  "den.error_load_workers": "Échec du chargement des workers.",
+  "den.error_no_session": "Aucune session Cloud active trouvée.",
+  "den.error_no_token": "La connexion desktop a été terminée, mais OpenWork Cloud n'a pas renvoyé de jeton de session.",
+  "den.error_open_worker": "Échec de l'ouverture de {name} dans OpenWork.",
+  "den.error_open_worker_fallback": "Échec de l'ouverture de {name}.",
+  "den.error_paste_valid_code": "Collez un lien de connexion OpenWork valide ou un code de connexion à usage unique.",
+  "den.error_signin_failed": "Impossible de terminer la connexion à OpenWork Cloud.",
+  "den.error_worker_not_ready": "Le worker n'est pas encore prêt à être ouvert. Réessayez une fois le provisionnement terminé.",
+  "den.finish_signin": "Terminer la connexion",
+  "den.finishing": "Finalisation...",
+  "den.hide_signin_code": "Masquer le code de connexion",
+  "den.import_all": "Tout importer",
+  "den.import_skill": "Installer",
+  "den.import_skill_failed": "Échec de l'installation de {name}.",
+  "den.import_provider": "Importer",
+  "den.import_provider_failed": "Échec de l'import de {name}.",
+  "den.imported_badge": "Importé",
+  "den.imported_provider": "{name} importé.",
+  "den.importing": "Importation...",
+  "den.needs_attention": "Nécessite une attention",
+  "den.no_cloud_providers": "Aucun fournisseur cloud n'est encore disponible pour cette organisation.",
+  "den.no_cloud_skills": "Aucun Skill cloud n'est encore disponible pour cette organisation.",
+  "den.no_cloud_workers": "Aucun worker cloud n'est encore visible pour cette organisation. Créez-en un dans Cloud, puis actualisez cet onglet.",
+  "den.no_org_selected": "Aucune organisation sélectionnée",
+  "den.no_skill_hubs": "Aucun hub de Skills cloud n'est encore disponible pour cette organisation.",
+  "den.open": "Ouvrir",
+  "den.opening": "Ouverture...",
+  "den.org_member_suffix": "(Membre)",
+  "den.org_owner_suffix": "(Propriétaire)",
+  "den.org_switched": "Basculé vers {name}.",
+  "den.out_of_sync_badge": "Désynchronisé",
+  "den.private_badge": "Privé",
+  "den.paste_signin_code": "Coller le code de connexion",
+  "den.refresh": "Actualiser",
+  "den.reload_workspace": "Rechargez l'espace de travail pour appliquer les changements de configuration.",
+  "den.remove_provider_failed": "Échec de la suppression de {name}.",
+  "den.remove_skill_failed": "Échec de la désinstallation de {name}.",
+  "den.removed_from_cloud_badge": "Supprimé du cloud",
+  "den.removed_provider": "{name} supprimé.",
+  "den.removing": "Suppression...",
+  "den.sign_out": "Se déconnecter",
+  "den.signed_out": "Déconnecté",
+  "den.signin_button": "Se connecter",
+  "den.signin_code_note": "Accepte un lien openwork://den-auth ou l'autorisation brute à usage unique.",
+  "den.signin_link_hint": "Si votre navigateur ne revient pas automatiquement dans OpenWork, collez ici le lien de connexion ou le code à usage unique depuis OpenWork Cloud.",
+  "den.signin_link_label": "Lien de connexion ou code à usage unique",
+  "den.signin_link_placeholder": "openwork://den-auth?... ou code collé",
+  "den.signin_title": "Se connecter à OpenWork Cloud",
+  "den.signing_in": "Finalisation de la connexion OpenWork Cloud...",
+  "den.signing_out": "Déconnexion...",
+  "den.skill_hub_detail": "Importez {count} Skills partagés dans .opencode/skills.",
+  "den.skill_hub_imported_detail": "{count} Skills importés dans cet espace de travail.",
+  "den.skill_hub_removed_detail": "Ce hub a été supprimé du cloud. Désinstallez les {importedCount} Skills importés de cet espace de travail.",
+  "den.skill_hub_skills_badge": "{count} Skills",
+  "den.skill_hub_sync_detail": "Le cloud contient désormais {liveCount} Skills ; cet espace de travail en a importé {importedCount}. Synchronisez pour mettre à jour l'ensemble installé.",
+  "den.skill_hubs_hint": "Importez chaque Skill d'un hub cloud partagé dans cet espace de travail en une seule étape.",
+  "den.skill_hubs_title": "Hubs de Skills",
+  "den.status_base_url_updated": "URL du plan de contrôle Cloud mise à jour. Reconnectez-vous pour continuer.",
+  "den.status_browser_signin": "Terminez la connexion dans votre navigateur pour connecter OpenWork.",
+  "den.status_browser_signup": "Terminez la création du compte dans votre navigateur pour connecter OpenWork.",
+  "den.status_cloud_signed_in_as": "OpenWork Cloud connecté en tant que {email}.",
+  "den.status_cloud_signin_done": "OpenWork Cloud connecté.",
+  "den.status_loaded_orgs_one": "{count} organisation chargée.",
+  "den.status_loaded_orgs_other": "{count} organisations chargée.",
+  "den.status_loaded_skills_one": "{count} Skill cloud chargé pour {name}.",
+  "den.status_loaded_skills_other": "{count} Skills cloud chargé pour {name}.",
+  "den.status_loaded_workers_one": "{count} worker chargé pour {name}.",
+  "den.status_loaded_workers_other": "{count} workers chargé pour {name}.",
+  "den.status_no_skills": "Aucun Skill cloud trouvé pour {name}.",
+  "den.status_no_workers": "Aucun worker trouvé pour {name}.",
+  "den.status_opened_worker": "{name} ouvert dans OpenWork.",
+  "den.status_signed_in_as": "Connecté en tant que {email}.",
+  "den.status_signed_out": "Déconnecté et session OpenWork Cloud effacée sur cet appareil.",
+  "den.sync": "Synchroniser",
+  "den.sync_provider_failed": "Échec de la synchronisation de {name}.",
+  "den.sync_skill_failed": "Échec de la mise à jour de {name}.",
+  "den.synced_provider": "{name} synchronisé.",
+  "den.syncing": "Synchronisation...",
+  "den.installed_name_badge": "Local : {name}",
+  "den.uninstall": "Désinstaller",
+  "den.worker_mine_badge": "À moi",
+  "den.worker_not_ready_title": "Ce worker n'est pas encore prêt à être ouvert.",
+  "den.worker_provider_label": "worker {provider}",
+  "den.worker_secondary_cloud": "Worker cloud",
+  "extensions.app_count_one": "{count} application connectée",
+  "extensions.app_count_other": "{count} applications connectées",
+  "extensions.apps_mcp_header": "Applications (MCP)",
+  "extensions.filter_all": "Tout",
+  "extensions.filter_apps": "Applications",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count_one": "{count} plugin",
+  "extensions.plugin_count_other": "{count} plugins",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Les applications (MCP) et les Plugins OpenCode se trouvent au même endroit.",
+  "extensions.title": "Extensions",
+  "identities.agent_behavior_desc": "Un fichier par espace de travail. Ajoutez une première ligne optionnelle @agent <id> pour router via un agent OpenCode spécifique.",
+  "identities.agent_behavior_title": "Comportement de l'agent de messagerie",
+  "identities.agent_created": "Fichier d'agent de messagerie par défaut créé.",
+  "identities.agent_file_changed": "Le fichier a changé à distance. Rechargez puis enregistrez à nouveau.",
+  "identities.agent_loading": "Chargement du fichier de l'agent…",
+  "identities.agent_none": "aucun",
+  "identities.agent_not_found": "Fichier d'agent introuvable dans cet espace de travail pour le moment.",
+  "identities.agent_saved": "Comportement de messagerie enregistré.",
+  "identities.agent_scope_status": "Portée active : espace de travail · état : {status} · agent sélectionné : {agent}",
+  "identities.agent_status_loaded": "chargé",
+  "identities.agent_status_missing": "manquant",
+  "identities.agent_worker_scope_unavailable": "Portée du worker indisponible.",
+  "identities.all_channels": "Tous les canaux",
+  "identities.app_token_label": "Jeton d'application",
+  "identities.auto_bind_label": "Associer automatiquement le pair au répertoire lors d'un envoi direct",
+  "identities.available_channels": "Canaux disponibles",
+  "identities.bot_token_label": "Jeton du bot",
+  "identities.bot_token_placeholder": "Collez le jeton du bot Telegram de @BotFather",
+  "identities.botfather_step1_open": "1. Ouvrez @BotFather dans Telegram",
+  "identities.botfather_step1_run": "et exécutez /newbot",
+  "identities.botfather_step3_choose": "3. Choisissez un nom et un nom d'utilisateur pour votre bot",
+  "identities.botfather_step3_or_private": "pour une boîte de réception ouverte ou",
+  "identities.botfather_step3_private": "Privé",
+  "identities.botfather_step3_public": "Public",
+  "identities.botfather_step3_to_require": "pour exiger",
+  "identities.channel_label": "Canal",
+  "identities.channels_connected": "connecté",
+  "identities.channels_label": "Canaux",
+  "identities.configured_suffix": "configuré",
+  "identities.connect_server_desc": "Les identités sont disponibles lorsque vous êtes connecté à un hôte OpenWork.",
+  "identities.connect_server_title": "Se connecter à un serveur OpenWork",
+  "identities.connect_slack": "Connecter Slack",
+  "identities.connected_badge": "Connecté",
+  "identities.connecting": "Connexion...",
+  "identities.copy_bot_token_hint": "Copiez le jeton du bot et collez-le ci-dessous.",
+  "identities.copy_code": "Copier le code",
+  "identities.create_default_file": "Créer le fichier par défaut",
+  "identities.create_private_bot": "Créer un bot privé",
+  "identities.create_public_bot": "Créer un bot public",
+  "identities.days_ago": "il y a {days} j",
+  "identities.default_routing": "Routage par défaut",
+  "identities.directory_label": "Répertoire (optionnel)",
+  "identities.disable_messaging": "Désactiver la messagerie",
+  "identities.disable_messaging_message": "Cela désactivera la messagerie pour cet espace de travail. La configuration Telegram et Slack sera masquée jusqu'à ce que la messagerie soit réactivée, et vous devrez redémarrer le worker pour arrêter complètement le sidecar de messagerie.",
+  "identities.disable_messaging_title": "Désactiver la messagerie pour ce worker ?",
+  "identities.disabled_label": "Désactivé",
+  "identities.disabling": "Désactivation...",
+  "identities.disconnect": "Déconnecter",
+  "identities.dispatched_messages": "{sent}/{attempted} messages envoyés.",
+  "identities.enable_messaging": "Activer la messagerie",
+  "identities.enable_messaging_risk": "La messagerie peut exposer ce worker à des commandes distantes. Si un bot est public ou compromis, il peut accéder aux fichiers, identifiants et clés API disponibles pour ce worker.",
+  "identities.enable_messaging_title": "Activer la messagerie pour ce worker ?",
+  "identities.enabled_label": "Activé",
+  "identities.enabling": "Activation...",
+  "identities.health_offline": "Hors ligne",
+  "identities.health_running": "En cours d'exécution",
+  "identities.health_unavailable": "Indisponible",
+  "identities.health_unknown": "Inconnu",
+  "identities.hours_ago": "il y a {hours} h",
+  "identities.identities_label": "Identités",
+  "identities.just_now": "À l'instant",
+  "identities.last_activity": "Dernière activité",
+  "identities.later": "Plus tard",
+  "identities.message_label": "Message",
+  "identities.message_routing_desc": "Contrôlez quelles conversations vont dans quel dossier d'espace de travail. Les messages sont routés vers le dossier par défaut du worker, sauf si vous configurez des règles ici.",
+  "identities.message_routing_title": "Routage des messages",
+  "identities.messages_today": "Messages aujourd'hui",
+  "identities.messaging_disabled_hint": "N'activez la messagerie que si vous comprenez le risque et prévoyez de sécuriser l'accès (par exemple, appairage Telegram privé).",
+  "identities.messaging_disabled_restart": "Messagerie désactivée. Redémarrez ce worker pour arrêter le sidecar de messagerie.",
+  "identities.messaging_disabled_risk": "Les bots de messagerie peuvent exécuter des actions sur votre worker local. S'ils sont exposés publiquement, ils peuvent permettre l'accès aux fichiers, identifiants et clés API disponibles pour ce worker.",
+  "identities.messaging_disabled_title": "La messagerie est désactivée par défaut",
+  "identities.messaging_enabled_restart": "Messagerie activée. Redémarrez ce worker pour appliquer avant de configurer les canaux.",
+  "identities.messaging_sidecar_not_running": "La messagerie est activée dans cet espace de travail, mais le sidecar de messagerie n'est pas encore en cours d'exécution. Redémarrez ce worker, puis revenez dans les paramètres Messagerie pour connecter Telegram ou Slack.",
+  "identities.minutes_ago": "il y a {minutes} min",
+  "identities.not_set": "Non défini",
+  "identities.open_bot_link": "Ouvrir @{username} dans Telegram",
+  "identities.pairing_code_copied": "Code d'appairage copié.",
+  "identities.pairing_code_copy_failed": "Impossible de copier le code d'appairage. Copiez-le manuellement.",
+  "identities.pairing_code_instruction_prefix": "Envoyer",
+  "identities.peer_id_label": "ID du pair (optionnel)",
+  "identities.peer_id_placeholder_slack": "ex. slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "ex. telegram:123456789",
+  "identities.private_label": "Privé",
+  "identities.private_pairing_code": "Code d'appairage privé",
+  "identities.public_bot_confirm": "Oui, je comprends le risque",
+  "identities.public_bot_warning_message": "Votre bot sera accessible au public et toute personne qui y a accès pourra avoir un accès complet à votre worker local, y compris aux fichiers ou clés API que vous lui avez fournis. Si vous créez un bot privé, vous pouvez limiter l'accès en exigeant un jeton d'appairage. Êtes-vous sûr de vouloir rendre votre bot public ?",
+  "identities.public_bot_warning_title": "Rendre ce bot public ?",
+  "identities.public_label": "Public",
+  "identities.quick_setup": "Configuration rapide",
+  "identities.reconnect_failed": "Échec de la reconnexion. Vérifiez l'URL/le jeton OpenWork et réessayez.",
+  "identities.reconnected": "Reconnecté.",
+  "identities.reconnected_refreshing": "Reconnecté. Actualisation de l'état du worker...",
+  "identities.reload": "Recharger",
+  "identities.repair_reconnect": "Réparer et reconnecter",
+  "identities.restart_failed": "Échec du redémarrage. Veuillez redémarrer le worker depuis les Paramètres et réessayer.",
+  "identities.restart_to_disable_messaging": "La messagerie a été désactivée pour cet espace de travail. Redémarrez maintenant le worker pour arrêter le sidecar de messagerie.",
+  "identities.restart_to_enable_messaging": "La messagerie a été activée pour cet espace de travail. Redémarrez maintenant le worker pour lancer le sidecar de messagerie et débloquer la configuration de Telegram et Slack.",
+  "identities.restart_worker": "Redémarrer le worker",
+  "identities.restart_worker_title": "Redémarrer le worker maintenant ?",
+  "identities.restarting": "Redémarrage...",
+  "identities.routing_override_prefix": "Tous les messages sont routés vers",
+  "identities.routing_override_suffix": "(forçage actif)",
+  "identities.running_label": "En cours d'exécution",
+  "identities.save_behavior": "Enregistrer le comportement",
+  "identities.saving": "Enregistrement...",
+  "identities.send_test_button": "Envoyer un message de test",
+  "identities.send_test_desc": "Validez le câblage sortant. Utilisez un ID de pair pour un envoi direct, ou laissez l'ID vide pour distribuer selon les associations dans un répertoire.",
+  "identities.send_test_title": "Envoyer un message de test",
+  "identities.sending": "Envoi...",
+  "identities.slack_desc": "Votre worker apparaît comme un bot dans les canaux Slack. Les membres de l'équipe peuvent lui envoyer des messages directement ou le mentionner dans des fils.",
+  "identities.slack_intro": "Connectez votre espace de travail Slack pour permettre aux membres de l'équipe d'interagir avec ce worker dans les canaux et les messages directs.",
+  "identities.slack_unavailable": "Identités Slack indisponibles.",
+  "identities.status_active": "Actif",
+  "identities.status_label": "État",
+  "identities.status_stopped": "Arrêté",
+  "identities.stopped_label": "Arrêté",
+  "identities.subtitle": "Permettez aux personnes de joindre votre worker via des applications de messagerie. Connectez un canal et votre worker lira et répondra automatiquement aux messages.",
+  "identities.tab_general": "Général",
+  "identities.telegram_bot_access_desc": "Bot public : le premier chat Telegram se lie automatiquement. Bot privé : exige un code d'appairage avant que des messages n'exécutent des outils.",
+  "identities.telegram_delete_failed": "Échec de la suppression.",
+  "identities.telegram_deleted": "Supprimé.",
+  "identities.telegram_deleted_pending": "Supprimé (application en attente).",
+  "identities.telegram_desc": "Connectez un bot Telegram en mode public (boîte de réception ouverte) ou privé (code d'appairage requis).",
+  "identities.telegram_private_saved_pair": "Bot privé enregistré. Associez via /pair {code}",
+  "identities.telegram_save_failed": "Échec de l'enregistrement.",
+  "identities.telegram_saved": "Enregistré.",
+  "identities.telegram_saved_pending": "Enregistré (application en attente).",
+  "identities.telegram_saved_username": "Enregistré (@{username})",
+  "identities.telegram_unavailable": "Identités Telegram indisponibles.",
+  "identities.title": "Canaux de messagerie",
+  "identities.unsaved_changes": "Modifications non enregistrées",
+  "identities.worker_offline": "Worker hors ligne",
+  "identities.worker_online": "Worker en ligne",
+  "identities.worker_restarted": "Worker redémarré.",
+  "identities.worker_restarted_refreshing": "Worker redémarré. Actualisation de l'état de la messagerie...",
+  "identities.worker_scope_unavailable": "Portée du worker indisponible.",
+  "identities.worker_scope_unavailable_detail": "Portée du worker indisponible. Reconnectez-vous avec une URL de worker ou basculez vers un worker connu.",
+  "identities.worker_unavailable": "Worker indisponible",
+  "identities.workspace_id_required": "L'ID de l'espace de travail est requis pour gérer les identités. Reconnectez-vous avec une URL d'espace de travail ou sélectionnez un espace de travail mappé sur cet hôte.",
+  "identities.workspace_scope_prefix": "Portée de l'espace de travail :",
+  "mcp.add_modal_subtitle": "Connectez un serveur MCP personnalisé par URL ou commande locale.",
+  "mcp.add_modal_title": "Ajouter une application personnalisée",
+  "mcp.add_server_button": "Ajouter une application",
+  "mcp.advanced": "Avancé",
+  "mcp.advanced_settings": "Paramètres avancés",
+  "mcp.advanced_settings_hint": "Modifiez les fichiers de configuration et gérez les connexions manuellement.",
+  "mcp.app_connected": "application connectée",
+  "mcp.apps_connected": "applications connectées",
+  "mcp.apps_subtitle": "Connectez vos outils préférés pour qu'OpenWork puisse les utiliser en votre nom.",
+  "mcp.apps_title": "Applications",
+  "mcp.auth.already_connected": "Déjà connecté",
+  "mcp.auth.already_connected_description": "{server} est déjà authentifié et prêt à être utilisé.",
+  "mcp.auth.applying_changes_body": "Nous redémarrons le worker pour que le nouveau MCP soit prêt à s'authentifier.",
+  "mcp.auth.applying_changes_title": "Application des changements avant connexion",
+  "mcp.auth.authorization_link": "Lien d'autorisation",
+  "mcp.auth.authorization_still_required": "L'autorisation est toujours requise. Réessayez pour redémarrer le flux.",
+  "mcp.auth.callback_invalid": "Collez l'URL de rappel ou le paramètre code pour terminer OAuth.",
+  "mcp.auth.callback_label": "URL de rappel ou code",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Annuler",
+  "mcp.auth.client_registration_required": "L'enregistrement du client est requis avant que OAuth puisse continuer.",
+  "mcp.auth.complete_connection": "Terminer la connexion",
+  "mcp.auth.configured_previously": "Le MCP a peut-être été configuré globalement ou dans une session précédente. Vous pouvez fermer cette fenêtre et commencer à utiliser les outils MCP tout de suite.",
+  "mcp.auth.connect_server": "Connecter {server}",
+  "mcp.auth.copied": "Copié",
+  "mcp.auth.copy_link": "Copier le lien",
+  "mcp.auth.done": "Terminé",
+  "mcp.auth.failed_to_start_oauth": "Échec du démarrage du flux OAuth",
+  "mcp.auth.follow_browser_steps": "Suivez les étapes d'autorisation dans le navigateur.",
+  "mcp.auth.force_stop": "Forcer l'arrêt",
+  "mcp.auth.force_stopping": "Arrêt...",
+  "mcp.auth.im_done": "J'ai terminé",
+  "mcp.auth.invalid_refresh_token": "Le jeton de rafraîchissement OAuth est invalide ou expiré. Réautorisez pour continuer.",
+  "mcp.auth.manual_finish_hint": "Collez l'URL de rappel (localhost:19876) ou simplement le code pour terminer la connexion.",
+  "mcp.auth.manual_finish_title": "Serveur distant ?",
+  "mcp.auth.oauth_completed_reload": "OAuth terminé. Rechargez le moteur pour activer le MCP.",
+  "mcp.auth.oauth_failed": "Échec de l'authentification OAuth.",
+  "mcp.auth.oauth_not_supported_hint": "Cela peut vouloir dire :\n• Le serveur MCP n'annonce pas de capacités OAuth\n• Le moteur doit être rechargé pour découvrir les capacités du serveur\n• Essayez : opencode mcp auth {server} depuis la CLI",
+  "mcp.auth.open_browser_signin": "Nous ouvrirons votre navigateur pour terminer la connexion.",
+  "mcp.auth.port_forward_hint": "Astuce : transférez le port de rappel si nécessaire : ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "Réautoriser OAuth",
+  "mcp.auth.reauth_cli_hint": "Exécutez : opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "Échec de la réautorisation.",
+  "mcp.auth.reauth_remote_hint": "Réautorisez depuis la machine qui exécute ce worker.",
+  "mcp.auth.reauth_running": "Réautorisation...",
+  "mcp.auth.reload_blocked": "Le rechargement est en pause pendant qu'une session est en cours. Arrêtez l'exécution pour terminer la configuration.",
+  "mcp.auth.reload_engine_retry": "Appliquer les changements et réessayer",
+  "mcp.auth.reload_failed": "Échec du rechargement du worker avant la connexion.",
+  "mcp.auth.reload_notice": "Pour que cela prenne effet, OpenWork doit actualiser le service du worker. Cela peut interrompre une session en cours.",
+  "mcp.auth.reload_remote_confirm": "Pour que cela prenne effet, OpenWork doit actualiser le service du worker. Cela pourrait arrêter votre session en cours. Continuer ?",
+  "mcp.auth.reopen_browser_link": "Cliquez ici pour rouvrir le navigateur",
+  "mcp.auth.request_timed_out": "La requête a expiré.",
+  "mcp.auth.retry": "Réessayer",
+  "mcp.auth.retry_now": "Réessayer maintenant",
+  "mcp.auth.server_disabled": "Ce serveur MCP est désactivé. Activez-le et réessayez.",
+  "mcp.auth.step1_description": "Nous lancerons automatiquement le flux de connexion de {server}.",
+  "mcp.auth.step1_title": "Ouverture de votre navigateur",
+  "mcp.auth.step2_description": "Connectez-vous et approuvez l'accès lorsqu'on vous le demande.",
+  "mcp.auth.step2_title": "Autoriser OpenWork",
+  "mcp.auth.step3_description": "Nous terminerons la connexion dès que l'autorisation sera terminée.",
+  "mcp.auth.step3_title": "Revenez ici quand vous avez terminé",
+  "mcp.auth.try_reload_engine": "{message}. Essayez d'abord de recharger le moteur.",
+  "mcp.auth.waiting_authorization": "En attente de la fin de l'autorisation dans votre navigateur...",
+  "mcp.auth.waiting_for_conversation_body": "Nous vous redirigerons vers l'authentification dès que possible.",
+  "mcp.auth.waiting_for_conversation_title": "En attente de la fin de la conversation",
+  "mcp.auth.waiting_for_session": "En attente que {session} termine son travail",
+  "mcp.available_apps": "Applications disponibles",
+  "mcp.cap_signin": "Connexion au compte",
+  "mcp.cap_tools": "Outils IA",
+  "mcp.config_file": "Fichier de configuration",
+  "mcp.config_load_failed": "Impossible de charger le fichier de configuration",
+  "mcp.config_not_loaded": "Pas encore chargé",
+  "mcp.connect": "Connecter",
+  "mcp.connect_failed": "Impossible de se connecter. Réessayez.",
+  "mcp.connect_server_first": "Connectez-vous d'abord au serveur.",
+  "mcp.connected": "Connecté",
+  "mcp.connected_badge": "Connecté",
+  "mcp.connection_failed": "Problème de connexion — réessayez",
+  "mcp.connection_type": "Connexion",
+  "mcp.control_chrome_browser_hint": "Dans Chrome 144 ou version ultérieure, faites d'abord ceci :",
+  "mcp.control_chrome_browser_step_one": "Ouvrez chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Activez le débogage à distance.",
+  "mcp.control_chrome_browser_step_three": "Autorisez les connexions de débogage entrantes lorsque Chrome le demande.",
+  "mcp.control_chrome_browser_title": "1. Activer l'accès à Chrome",
+  "mcp.control_chrome_connect": "Ajouter Control Chrome",
+  "mcp.control_chrome_docs": "Guide MCP officiel",
+  "mcp.control_chrome_edit": "Modifier les paramètres",
+  "mcp.control_chrome_profile_hint": "Control Chrome ouvre normalement un profil Chrome séparé. Activez ceci si vous voulez qu'OpenWork réutilise la fenêtre Chrome déjà ouverte.",
+  "mcp.control_chrome_profile_title": "2. Choisir quel Chrome utiliser",
+  "mcp.control_chrome_save": "Enregistrer les paramètres",
+  "mcp.control_chrome_setup_subtitle": "Activez l'accès à Chrome, puis choisissez si OpenWork doit utiliser son propre profil propre ou se rattacher au Chrome que vous utilisez déjà.",
+  "mcp.control_chrome_setup_title": "Configurer Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Lorsque cette option est activée, OpenWork ajoute --autoConnect pour que le MCP se rattache à une instance Chrome que vous avez déjà démarrée.",
+  "mcp.control_chrome_toggle_label": "Utiliser mon profil Chrome existant",
+  "mcp.control_chrome_toggle_off": "OpenWork lancera un profil Chrome séparé uniquement pour l'automatisation.",
+  "mcp.control_chrome_toggle_on": "OpenWork réutilisera vos onglets, cookies et connexions actuels.",
+  "mcp.custom_app_cta_hint": "Connectez votre propre serveur MCP, outil interne ou application hébergée.",
+  "mcp.desktop_required": "Les applications nécessitent l'application desktop.",
+  "mcp.docs_link": "En savoir plus",
+  "mcp.file_not_found": "Fichier de configuration pas encore créé",
+  "mcp.friendly_status_issue": "Problème",
+  "mcp.friendly_status_needs_signin": "Connexion requise",
+  "mcp.friendly_status_offline": "Hors ligne",
+  "mcp.friendly_status_paused": "En pause",
+  "mcp.friendly_status_ready": "Prêt",
+  "mcp.last_synced": "Synchronisé",
+  "mcp.login_action": "Se connecter",
+  "mcp.login_hint": "Connectez votre compte pour terminer la configuration de cette application.",
+  "mcp.login_unavailable": "Cette application ne prend pas en charge la connexion depuis OpenWork.",
+  "mcp.logout_action": "Se déconnecter",
+  "mcp.logout_failed": "Échec de la déconnexion.",
+  "mcp.logout_hint": "Supprime les identifiants OAuth stockés. Vous devrez vous reconnecter.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Cela supprimera les identifiants OAuth stockés pour {server}. Vous devrez vous reconnecter pour utiliser cette application.",
+  "mcp.logout_modal_title": "Se déconnecter de cette application ?",
+  "mcp.logout_success": "Déconnecté de {server}.",
+  "mcp.logout_working": "Déconnexion...",
+  "mcp.name_required": "Entrez un nom de serveur.",
+  "mcp.no_apps_hint": "Connectez-en une ci-dessus pour commencer.",
+  "mcp.no_apps_yet": "Aucune application connectée pour le moment",
+  "mcp.oauth": "Se connecter",
+  "mcp.oauth_optional_hint": "Utilise OAuth dans le navigateur pour connecter votre compte.",
+  "mcp.oauth_optional_label": "Cette application nécessite une connexion",
+  "mcp.one_click_connect": "Connexion en un clic",
+  "mcp.open_file": "Ouvrir le fichier",
+  "mcp.opening_label": "Ouverture...",
+  "mcp.pick_workspace_error": "Choisissez d'abord un dossier d'espace de travail.",
+  "mcp.pick_workspace_first": "Choisissez d'abord un dossier d'espace de travail.",
+  "mcp.quick_connect_chrome_desc": "Pilotez les onglets Chrome avec l'automatisation du navigateur.",
+  "mcp.quick_connect_chrome_title": "Control Chrome",
+  "mcp.quick_connect_context7_desc": "Recherchez dans la documentation produit avec un contexte plus riche.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Planifiez les sprints et livrez les tickets plus vite.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Pages, bases de données et docs projet synchronisés.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Suivez les releases et résolvez les erreurs de production.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Inspectez paiements, factures et abonnements.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Arrêtez la tâche en cours pour activer.",
+  "mcp.remote_workspace_url_hint": "Les workers distants se connectent plus rapidement avec des serveurs MCP basés sur une URL.",
+  "mcp.remove_app": "Supprimer",
+  "mcp.remove_failed": "Impossible de supprimer l'application.",
+  "mcp.remove_modal_message": "Êtes-vous sûr de vouloir supprimer {server} ? Vous pourrez toujours l'ajouter de nouveau plus tard.",
+  "mcp.remove_modal_title": "Supprimer l'application",
+  "mcp.reveal_config_failed": "Impossible d'ouvrir le fichier de configuration",
+  "mcp.reveal_in_finder": "Afficher dans le Finder",
+  "mcp.scope_global": "Tous les espaces de travail",
+  "mcp.scope_project": "Cet espace de travail",
+  "mcp.server_command": "Commande",
+  "mcp.server_command_hint": "La commande shell pour démarrer le serveur.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Nom de l'application",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Type",
+  "mcp.server_url": "URL du serveur",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Connexion",
+  "mcp.tap_to_connect": "Appuyez pour connecter",
+  "mcp.technical_details": "Détails techniques",
+  "mcp.type_cloud": "Cloud (connectez-vous avec votre compte)",
+  "mcp.type_local": "Local (s'exécute sur cet appareil)",
+  "mcp.type_local_cmd": "Local (commande)",
+  "mcp.type_remote": "Distant (URL)",
+  "mcp.url_or_command_required": "Entrez une URL pour un serveur distant ou une commande pour un serveur local.",
+  "mcp.your_apps": "Vos applications",
+  "model_behavior.desc_builtin": "Ce modèle décide lui-même de son chemin de raisonnement et n'expose pas ici de profils.",
+  "model_behavior.desc_generic": "Utiliser le profil {label}.",
+  "model_behavior.desc_high": "Passe plus de temps à raisonner avant de répondre.",
+  "model_behavior.desc_high_anthropic": "Utiliser le budget de réflexion étendue standard.",
+  "model_behavior.desc_low": "Utiliser un raisonnement plus léger avant de répondre.",
+  "model_behavior.desc_low_google": "Utiliser un budget de raisonnement plus léger pour des réponses plus rapides.",
+  "model_behavior.desc_max": "Utiliser le profil de raisonnement le plus profond du fournisseur.",
+  "model_behavior.desc_max_anthropic": "Utiliser le plus grand budget de réflexion étendue disponible.",
+  "model_behavior.desc_medium": "Équilibrer vitesse et profondeur de raisonnement.",
+  "model_behavior.desc_minimal": "Utiliser une très petite quantité de raisonnement.",
+  "model_behavior.desc_none": "Favoriser la vitesse avec le chemin de raisonnement le plus léger.",
+  "model_behavior.desc_standard": "Ce modèle n'expose pas de contrôles supplémentaires de raisonnement.",
+  "model_behavior.label_balanced": "Équilibré",
+  "model_behavior.label_builtin": "Intégré",
+  "model_behavior.label_deep": "Profond",
+  "model_behavior.label_extended": "Étendu",
+  "model_behavior.label_fast": "Rapide",
+  "model_behavior.label_light": "Léger",
+  "model_behavior.label_maximum": "Maximum",
+  "model_behavior.label_quick": "Express",
+  "model_behavior.label_standard": "Standard",
+  "model_behavior.title_builtin_reasoning": "Raisonnement intégré",
+  "model_behavior.title_extended_thinking": "Réflexion étendue",
+  "model_behavior.title_reasoning_budget": "Budget de raisonnement",
+  "model_behavior.title_reasoning_effort": "Effort de raisonnement",
+  "model_behavior.title_standard_generation": "Génération standard",
+  "model_picker.chat_model_desc": "Choisissez le modèle pour ce chat. Si un modèle prend en charge des profils de raisonnement, configurez-les sur sa carte.",
+  "model_picker.chat_model_title": "Modèle de chat",
+  "model_picker.connect_provider_hint": "Connectez ce fournisseur pour parcourir et enregistrer des modèles",
+  "model_picker.default_model_desc": "Choisissez le modèle par défaut pour les nouveaux chats, puis ajustez les profils de raisonnement sur sa carte avant d'appuyer sur Terminé.",
+  "model_picker.default_model_title": "Modèle par défaut",
+  "model_picker.model_count_one": "{count} modèle",
+  "model_picker.model_count_other": "{count} modèles",
+  "model_picker.more_providers": "Plus de fournisseurs",
+  "model_picker.no_results": "Aucun modèle ne correspond à votre recherche.",
+  "model_picker.other_connected_models": "Autres modèles connectés",
+  "model_picker.recommended": "Recommandé",
+  "onboarding.authorize_folder": "Autoriser le dossier",
+  "plugins.add": "Ajouter",
+  "plugins.add_hint": "Ajoutez des noms de packages npm, par ex. opencode-wakatime",
+  "plugins.add_label": "Ajouter un plugin",
+  "plugins.added": "Ajouté",
+  "plugins.config": "Config",
+  "plugins.config_label": "Config",
+  "plugins.desc": "Gérez `opencode.json` pour votre projet ou les Plugins OpenCode globaux.",
+  "plugins.empty": "Aucun Plugin configuré pour le moment.",
+  "plugins.enabled": "Activé",
+  "plugins.hide_setup": "Masquer la configuration",
+  "plugins.not_loaded": "Pas encore chargé",
+  "plugins.not_loaded_yet": "Pas encore chargé",
+  "plugins.remove": "Supprimer",
+  "plugins.scope_global": "Global",
+  "plugins.scope_project": "Projet",
+  "plugins.setup": "Configuration",
+  "plugins.suggested": "Plugins suggérés",
+  "plugins.suggested_heading": "Plugins suggérés",
+  "plugins.title": "Plugins OpenCode",
+  "providers.api_key_label": "Clé API",
+  "providers.api_key_required": "La clé API est requise",
+  "providers.auth_failed": "Échec de l'authentification",
+  "providers.connect_failed": "Échec de la connexion au fournisseur",
+  "providers.disabled_in_config_suffix": "et l'a désactivé dans la configuration OpenCode.",
+  "providers.disconnect_failed": "Échec de la déconnexion du fournisseur",
+  "providers.disconnected_prefix": "Déconnecté",
+  "providers.load_failed": "Échec du chargement des fournisseurs",
+  "providers.no_oauth_prefix": "Aucun flux OAuth disponible pour",
+  "providers.no_providers_available": "Aucun fournisseur disponible",
+  "providers.not_connected": "Non connecté à un serveur",
+  "providers.not_oauth_flow_prefix": "La méthode d'authentification sélectionnée n'est pas un flux OAuth pour",
+  "providers.oauth_failed": "Impossible de terminer OAuth",
+  "providers.oauth_method_required": "La méthode OAuth est requise",
+  "providers.provider_error": "Erreur du fournisseur ({provider})",
+  "providers.provider_id_required": "L'ID du fournisseur est requis",
+  "providers.rate_limit_exceeded": "Limite de débit dépassée",
+  "providers.removal_unsupported": "La suppression de l'authentification du fournisseur n'est pas prise en charge par ce client.",
+  "providers.request_failed": "Échec de la requête",
+  "providers.save_api_key_failed": "Échec de l'enregistrement de la clé API",
+  "providers.still_connected_suffix": ", mais le worker le signale toujours comme connecté. Effacez toute clé API ou identifiant OAuth restant et redémarrez le worker pour le déconnecter complètement.",
+  "providers.unknown_provider": "Fournisseur inconnu",
+  "providers.use_api_key_suffix": "Utilisez plutôt une clé API.",
+  "question_modal.custom_answer_label": "Ou saisissez une réponse personnalisée",
+  "question_modal.custom_answer_placeholder": "Tapez votre réponse ici...",
+  "question_modal.question_counter": "Question {current} sur {total}",
+  "session.allow_for_session": "Autoriser pour la session",
+  "session.allow_once": "Autoriser une fois",
+  "session.cmd_current_workspace": "Espace de travail actuel",
+  "session.cmd_new_session_detail": "Démarrer une nouvelle tâche dans l'espace de travail actuel",
+  "session.cmd_new_session_meta": "Créer",
+  "session.cmd_new_session_title": "Créer une nouvelle session",
+  "session.cmd_sessions_detail": "{count} disponibles dans tous les espaces de travail",
+  "session.cmd_sessions_meta": "Aller",
+  "session.cmd_sessions_title": "Rechercher des Sessions",
+  "session.cmd_switch": "Basculer",
+  "session.create_or_connect_workspace": "Créer ou connecter un espace de travail",
+  "session.default_agent": "Agent par défaut",
+  "session.default_title": "Nouvelle session",
+  "session.delete": "Supprimer",
+  "session.delete_named_session_message": "Cela supprimera définitivement \"{title}\" et ses messages.",
+  "session.delete_session_generic": "Cela supprimera définitivement la session sélectionnée et ses messages.",
+  "session.delete_session_title": "Supprimer la session ?",
+  "session.deleting": "Suppression...",
+  "session.deny": "Refuser",
+  "session.details": "Détails",
+  "session.details_label": "Détails",
+  "session.doom_loop_label": "Boucle infinie",
+  "session.doom_loop_message": "OpenCode a détecté des appels d'outils répétés avec une entrée identique et demande s'il doit continuer après des échecs répétés.",
+  "session.doom_loop_note": "Refusez pour arrêter la boucle, ou autorisez si vous voulez que l'agent continue d'essayer.",
+  "session.doom_loop_repeated_call_label": "Appel répété",
+  "session.doom_loop_repeated_tool_call": "Appel d'outil répété",
+  "session.doom_loop_title": "Boucle infinie détectée",
+  "session.doom_loop_tool_label": "Outil",
+  "session.export_already_running": "L'export est déjà en cours.",
+  "session.export_desktop_only": "L'export est disponible dans l'application desktop.",
+  "session.export_desktop_only_local": "L'export est disponible pour les workers locaux dans l'application desktop.",
+  "session.export_local_only": "L'export n'est pris en charge que pour les workers locaux.",
+  "session.loading_detail": "Récupération des derniers messages pour cette tâche.",
+  "session.model": "Modèle",
+  "session.new_task": "Nouvelle tâche",
+  "session.open": "Ouvrir",
+  "session.palette_hint_navigate": "Touches fléchées pour naviguer",
+  "session.palette_hint_run": "Entrée pour exécuter · Échap pour fermer",
+  "session.palette_placeholder_actions": "Rechercher des actions",
+  "session.palette_placeholder_sessions": "Trouver par titre de session ou espace de travail",
+  "session.palette_title_actions": "Actions rapides",
+  "session.palette_title_sessions": "Rechercher des Sessions",
+  "session.permission_detail_command": "Commande",
+  "session.permission_detail_cwd": "Répertoire de travail",
+  "session.permission_detail_description": "Description",
+  "session.permission_detail_diff": "Diff",
+  "session.permission_detail_file": "Fichier",
+  "session.permission_detail_files": "Fichiers",
+  "session.permission_detail_agent": "Agent",
+  "session.permission_detail_parent_directory": "Répertoire parent",
+  "session.permission_detail_path": "Chemin",
+  "session.permission_detail_query": "Requête",
+  "session.permission_detail_target": "Cible",
+  "session.permission_detail_tool": "Outil",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Modification de fichier",
+  "session.permission_kind_external_directory": "Répertoire externe",
+  "session.permission_kind_question": "Question",
+  "session.permission_kind_read": "Lecture de fichier",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Sous-tâche",
+  "session.permission_kind_todowrite": "Écriture de tâches",
+  "session.permission_label": "Autorisation",
+  "session.permission_message": "OpenCode demande une autorisation pour continuer.",
+  "session.permission_message_bash": "Vérifiez la portée de la commande avant d'autoriser OpenCode à continuer.",
+  "session.permission_message_edit": "Vérifiez le fichier et le diff avant d'autoriser OpenCode à modifier des fichiers.",
+  "session.permission_message_external_directory": "Vérifiez le dossier avant d'autoriser l'accès en dehors du workspace.",
+  "session.permission_message_read": "Vérifiez la portée des fichiers demandés avant d'autoriser l'accès.",
+  "session.permission_message_task": "Vérifiez la sous-tâche demandée avant d'autoriser son démarrage.",
+  "session.permission_metadata_unavailable": "Impossible d'afficher les métadonnées.",
+  "session.permission_review_label": "Revue",
+  "session.permission_scope_empty": "Aucune portée spécifique fournie.",
+  "session.permission_decision_hint": "Autorisez une fois pour cette demande, ou pour la session lorsque vous faites confiance à cette portée.",
+  "session.permission_title_bash": "Exécuter une commande shell ?",
+  "session.permission_title_edit": "Modifier des fichiers ?",
+  "session.permission_title_external_directory": "Accéder à un dossier externe ?",
+  "session.permission_title_generic": "Approuver {permission} ?",
+  "session.permission_title_read": "Lire des fichiers ?",
+  "session.permission_title_task": "Démarrer une sous-tâche ?",
+  "session.redo_aria_label": "Rétablir le dernier message annulé",
+  "session.redo_label": "Rétablir",
+  "session.redo_title": "Rétablir le dernier message annulé",
+  "session.rename_description": "Mettez à jour le nom de cette session.",
+  "session.rename_label": "Nom de la session",
+  "session.rename_placeholder": "Entrez un nouveau nom",
+  "session.rename_title": "Renommer la session",
+  "session.resize_workspace_column": "Redimensionner la colonne de l'espace de travail",
+  "session.revert_label": "Annuler",
+  "session.scope_label": "Portée",
+  "session.share_collaborator_hint": "Accès distant courant lorsque vous n'avez pas besoin d'actions réservées au propriétaire.",
+  "session.share_collaborator_host_hint": "Accès distant courant à cet hôte sans actions réservées au propriétaire.",
+  "session.share_collaborator_label": "Jeton collaborateur",
+  "session.share_connected_with_hint": "Cet espace de travail est actuellement connecté avec ce mot de passe.",
+  "session.share_desktop_app_required": "Application desktop requise",
+  "session.share_local_host_not_ready": "L'hôte OpenWork local n'est pas encore prêt.",
+  "session.share_missing_host_url": "URL d'hôte OpenWork manquante.",
+  "session.share_missing_token": "Jeton OpenWork manquant.",
+  "session.share_note_direct_runtime": "Le runtime du moteur est réglé sur Direct. Le changement de workers locaux peut redémarrer l'hôte et déconnecter les clients. Le jeton peut changer après un redémarrage.",
+  "session.share_opencode_base_url": "URL de base OpenCode",
+  "session.share_openwork_workers_only": "Les liens de service de partage ne sont disponibles que pour les workers OpenWork.",
+  "session.share_owner_permission_hint": "À utiliser lorsque le client distant doit répondre aux demandes d'autorisation.",
+  "session.share_password": "Mot de passe",
+  "session.share_select_workspace": "Sélectionnez d'abord un espace de travail.",
+  "session.share_set_token_hint": "Définir le jeton dans les paramètres de l'espace de travail",
+  "session.share_starting_server": "Démarrage du serveur...",
+  "session.share_worker_url": "URL du worker",
+  "session.share_worker_url_phones_hint": "À utiliser sur les téléphones ou ordinateurs portables se connectant à ce worker.",
+  "session.share_worker_url_resolving_hint": "L'URL du worker est en cours de résolution ; l'URL de l'hôte est affichée en secours.",
+  "session.todo_progress": "{completed} tâches terminées sur {total}",
+  "session.undo_label": "Annuler",
+  "session.undo_title": "Annuler le dernier message",
+  "session.workspace_fallback": "Espace de travail",
+  "settings.api_keys_info": "Les clés API sont stockées localement par OpenCode. Les fournisseurs basés sur l'environnement doivent être modifiés dans l'environnement du worker puis rechargés.",
+  "settings.appearance_hint": "Correspondre au système ou forcer le mode clair/sombre.",
+  "settings.appearance_title": "Apparence",
+  "settings.audit_log_title": "Journal d'audit",
+  "settings.auto_compact": "Compaction automatique du contexte",
+  "settings.auto_compact_desc": "Contrôle compaction.auto d'OpenCode pour cet espace de travail. Rechargez le moteur après modification.",
+  "settings.auto_update_desc": "Télécharger les mises à jour automatiquement (invite à",
+  "settings.auto_update_title": "Mise à jour automatique",
+  "settings.background_checks_desc": "OpenWork vérifie toujours au lancement. Vérifie aussi une fois",
+  "settings.background_checks_title": "Vérifications en arrière-plan",
+  "settings.cache_repair_requires_desktop": "La réparation du cache nécessite l'application desktop",
+  "settings.cap_browser_tools": "Outils navigateur : {value}",
+  "settings.cap_commands": "Commands : {value}",
+  "settings.cap_config": "Config : {value}",
+  "settings.cap_file_tools": "Outils fichiers : {value}",
+  "settings.cap_inbox_off": "boîte de réception désactivée",
+  "settings.cap_inbox_on": "boîte de réception activée",
+  "settings.cap_mcp": "MCP : {value}",
+  "settings.cap_outbox_off": "boîte d'envoi désactivée",
+  "settings.cap_outbox_on": "boîte d'envoi activée",
+  "settings.cap_plugins": "Plugins : {value}",
+  "settings.cap_read": "lecture",
+  "settings.cap_sandbox": "Sandbox : {value}",
+  "settings.cap_skills": "Skills : {value}",
+  "settings.cap_write": "écriture",
+  "settings.capabilities_title": "Capacités du serveur OpenWork",
+  "settings.capabilities_unavailable": "Capacités indisponibles. Connectez-vous avec un jeton client.",
+  "settings.change": "Modifier",
+  "settings.choose": "Choisir",
+  "settings.clear": "Effacer",
+  "settings.configure": "Configurer",
+  "settings.connect_provider": "Connecter un fournisseur",
+  "settings.connection": "Connexion",
+  "settings.connection_failed": "Échec de la connexion",
+  "settings.connection_title": "Connexion",
+  "settings.copied_debug_report": "Rapport d'exécution JSON copié.",
+  "settings.copy_json": "Copier le JSON",
+  "settings.custom_binary_hint": "Utilisez ceci pour pointer OpenWork vers une build locale d'OpenCode",
+  "settings.custom_binary_label": "Binaire OpenCode personnalisé",
+  "settings.debug_commit": "Commit : {sha}",
+  "settings.debug_desktop_app": "Application desktop : {version}",
+  "settings.debug_opencode_version": "OpenCode : {version}",
+  "settings.debug_openwork_server_version": "Serveur OpenWork : {version}",
+  "settings.deeplink_hint": "Accepte openwork://, openwork-dev:// ou une URL brute prise en charge https://share.openworklabs.com/b/... .",
+  "settings.delete_containers": "Suppression des conteneurs...",
+  "settings.delete_local_config": "Suppression de l'état local...",
+  "settings.dev_mode_badge": "Mode dev",
+  "settings.developer": "Développeur",
+  "settings.developer_mode_desc": "Active les outils de débogage, diagnostics et l'onglet Développeur.",
+  "settings.developer_mode_title": "Mode développeur",
+  "settings.developer_panel_disabled": "Panneau développeur activé.",
+  "settings.developer_panel_enabled": "Panneau développeur activé.",
+  "settings.diag_approval": "Approbation : {mode} ({ms}ms)",
+  "settings.diag_config_path": "Chemin de configuration : {path}",
+  "settings.diag_default": "par défaut",
+  "settings.diag_host_token_source": "Source du jeton hôte : {source}",
+  "settings.diag_opencode_binary": "Binaire OpenCode : {binary}",
+  "settings.diag_read_only": "Lecture seule : {value}",
+  "settings.diag_runtime_workspace": "Espace de travail runtime : {id}",
+  "settings.diag_selected_workspace": "Espace de travail sélectionné : {id}",
+  "settings.diag_started": "Démarré : {time}",
+  "settings.diag_token_source": "Source du jeton : {source}",
+  "settings.diag_workspaces": "Espaces de travail : {count}",
+  "settings.diagnostics_unavailable": "Diagnostics indisponibles.",
+  "settings.disable_developer_mode": "Désactiver le mode développeur",
+  "settings.disabled": "Désactivé",
+  "settings.disconnect": "Déconnecter",
+  "settings.disconnect_server": "Déconnecter le serveur",
+  "settings.disconnecting": "Déconnexion...",
+  "settings.docker_containers_desc": "Supprimer de force les conteneurs Docker lancés par OpenWork",
+  "settings.docker_containers_title": "Conteneurs Docker OpenWork",
+  "settings.docker_requires_desktop": "Le nettoyage Docker nécessite l'application desktop",
+  "settings.done": "Terminé",
+  "settings.enable_developer_mode": "Activer le mode développeur",
+  "settings.enable_exa": "Activer la recherche web Exa",
+  "settings.enable_exa_desc": "S'applique lorsque OpenWork Orchestrator lance OpenCode. Désactivé par",
+  "settings.engine_bundled": "Intégré (recommandé)",
+  "settings.engine_bundled_hint": "Le moteur intégré est l'option la plus fiable. Utilisez Système",
+  "settings.engine_custom_binary": "Binaire personnalisé",
+  "settings.engine_desc": "Choisissez comment OpenCode s'exécute localement.",
+  "settings.engine_source": "Source du moteur",
+  "settings.engine_source_debug": "Source du moteur",
+  "settings.engine_system_path": "Installation système (PATH)",
+  "settings.engine_title": "Moteur",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "Redémarrez OpenCode ou l'orchestrateur après avoir modifié ce paramètre.",
+  "settings.export": "Exporter",
+  "settings.exported_debug_report": "Rapport d'exécution JSON exporté.",
+  "settings.feedback_badge": "Nous lisons chaque message",
+  "settings.feedback_desc": "Dites-nous ce qui vous plaît et ce qui vous semble difficile. Les retours vont directement à l'équipe et nous aident à prioriser ce qui sera livré ensuite.",
+  "settings.feedback_title": "Aidez à façonner OpenWork",
+  "settings.group_global": "Global",
+  "settings.group_workspace": "Espace de travail",
+  "settings.hide_titlebar": "Masquer la barre de titre",
+  "settings.hide_titlebar_desc": "Masquer la barre de titre de la fenêtre. Utile pour les gestionnaires de fenêtres en mosaïque",
+  "settings.join_discord": "Rejoindre Discord",
+  "settings.language": "Langue",
+  "settings.language.description": "Choisissez votre langue préférée",
+  "settings.last_error": "Dernière erreur",
+  "settings.last_stderr": "Dernier stderr",
+  "settings.last_stdout": "Dernier stdout",
+  "settings.loading_providers": "Chargement des fournisseurs...",
+  "settings.managed_by_env": "Géré par l'environnement",
+  "settings.model": "Modèle",
+  "settings.model_behavior": "Comportement du modèle",
+  "settings.model_behavior_desc": "Ouvrez le sélecteur du modèle par défaut pour choisir des profils de raisonnement lorsqu'ils sont disponibles.",
+  "settings.model_section_desc": "Choisissez le modèle de chat par défaut et examinez sa manière de raisonner.",
+  "settings.model_title": "Modèle",
+  "settings.no_active_workspace": "Aucun espace de travail local actif.",
+  "settings.no_audit_entries": "Aucune entrée d'audit pour le moment.",
+  "settings.no_custom_path_set": "Aucun chemin personnalisé défini",
+  "settings.nuke_hint": "Utilisez ceci uniquement si vous voulez réinitialiser complètement l'application desktop et son état d'exécution OpenCode.",
+  "settings.off": "Désactivé",
+  "settings.on": "Activé",
+  "settings.open_deeplink_action": "Ouverture...",
+  "settings.open_deeplink_button": "Masquer",
+  "settings.open_deeplink_desc": "Collez un lien profond OpenWork ou une URL de partage pour l'ouvrir.",
+  "settings.open_deeplink_title": "Ouvrir un lien profond",
+  "settings.opencode_cache": "Cache OpenCode",
+  "settings.opencode_cache_description": "Répare les données mises en cache utilisées pour démarrer le moteur. Sûr à exécuter.",
+  "settings.opencode_engine_desc": "Runtime local pour les agents, outils et fournisseurs de modèles.",
+  "settings.opencode_engine_label": "Moteur OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Sidecar d'exécution locale.",
+  "settings.opencode_sdk_desc": "Diagnostics de connexion de l'UI.",
+  "settings.opencode_sdk_title": "Moteur OpenCode",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Ouvrir le lien profond",
+  "settings.openwork_config_sidecar_desc": "Sidecar de configuration et d'approbations.",
+  "settings.openwork_diagnostics_title": "Diagnostics du serveur OpenWork",
+  "settings.openwork_server_desc": "Plan de contrôle des sessions pour la synchronisation de l'application, les workers et l'accès distant",
+  "settings.openwork_server_label": "Serveur OpenWork",
+  "settings.pending_permissions": "Autorisations en attente",
+  "settings.production_mode_badge": "Production",
+  "settings.provider_default_desc": "Utiliser le comportement de raisonnement par défaut intégré du modèle.",
+  "settings.provider_default_label": "Valeur par défaut du fournisseur",
+  "settings.provider_source_config": "Config",
+  "settings.provider_source_custom": "Personnalisé",
+  "settings.provider_source_env": "Environnement",
+  "settings.providers_desc": "Connectez des services pour les modèles et les outils.",
+  "settings.providers_title": "Fournisseurs",
+  "settings.quit_hint": "OpenWork se ferme immédiatement après le nettoyage afin que le prochain lancement démarre avec un état local vierge pour ce mode.",
+  "settings.recent_events": "Événements récents",
+  "settings.reconnect_failed": "Échec de la reconnexion. Vérifiez l'URL/le jeton du serveur et réessayez.",
+  "settings.reconnect_server": "Reconnexion...",
+  "settings.reconnect_server_failed": "Échec de la reconnexion au serveur OpenWork.",
+  "settings.reconnected": "Reconnecté au serveur OpenWork.",
+  "settings.reconnecting": "Reconnexion...",
+  "settings.removing_containers": "Suppression des conteneurs...",
+  "settings.removing_local_state": "Suppression de l'état local...",
+  "settings.repair_cache": "Réparer le cache",
+  "settings.repairing_cache": "Réparation du cache",
+  "settings.report_issue": "Signaler un problème",
+  "settings.reset": "Réinitialiser",
+  "settings.reset_app_data": "Réinitialiser les données de l'application",
+  "settings.reset_app_data_description": "Plus agressif. Efface le cache OpenWork et les données de l'application.",
+  "settings.reset_app_data_title": "Réinitialiser les données de l'application",
+  "settings.reset_app_data_warning": "Efface le cache OpenWork et les données de l'application sur cet appareil.",
+  "settings.reset_button": "Réinitialiser",
+  "settings.reset_cancel": "Annuler",
+  "settings.reset_config_defaults": "Réinitialisation...",
+  "settings.reset_confirm_button": "Réinitialiser et redémarrer",
+  "settings.reset_confirmation_hint": "Tapez {resetWord} pour confirmer. OpenWork redémarrera.",
+  "settings.reset_confirmation_label": "Confirmation",
+  "settings.reset_confirmation_placeholder": "Tapez RESET",
+  "settings.reset_onboarding": "Réinitialiser l'onboarding",
+  "settings.reset_onboarding_description": "Efface les préférences OpenWork et redémarre l'application.",
+  "settings.reset_onboarding_title": "Réinitialiser l'onboarding",
+  "settings.reset_onboarding_warning": "Efface les préférences locales OpenWork et les marqueurs d'onboarding des espaces de travail.",
+  "settings.reset_openwork_desc_dev": "Avec le mode dev actif, cela n'efface que l'état de développement isolé d'OpenCode dans openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "Avec le mode dev actif, cela n'efface que l'état de développement isolé d'OpenCode dans openwork-dev-data.",
+  "settings.reset_openwork_title": "Réinitialiser l'état d'OpenWork et d'OpenCode",
+  "settings.reset_requires_confirm": "Nécessite de taper RESET et redémarrera l'application.",
+  "settings.reset_startup": "Réinitialiser le mode de démarrage par défaut",
+  "settings.reset_startup_pref": "Réinitialiser la préférence de démarrage",
+  "settings.reset_stop_active_runs": "Arrêtez les exécutions actives avant de réinitialiser.",
+  "settings.resetting": "Réinitialisation...",
+  "settings.restart_blocked_message": "OpenWork doit redémarrer pour terminer cette mise à jour. Pour éviter d'interrompre votre travail en cours, l'installation est mise en pause jusqu'à la fin de vos exécutions actives ou jusqu'à ce que vous les arrêtiez.",
+  "settings.restart_failed": "Échec du redémarrage. Vérifiez les journaux et réessayez.",
+  "settings.restart_opencode": "Redémarrage...",
+  "settings.restart_openwork_server": "Redémarrage...",
+  "settings.restart_server_failed": "Échec du redémarrage du serveur local.",
+  "settings.restarted": "Serveur local redémarré.",
+  "settings.restarting": "Redémarrage...",
+  "settings.reveal_config": "Révéler la configuration",
+  "settings.reveal_config_requires_desktop": "Révéler la configuration nécessite l'application desktop",
+  "settings.run_sandbox_probe": "Exécution de la sonde...",
+  "settings.running_probe": "Exécution de la sonde...",
+  "settings.runtime_debug_desc": "Instantané de diagnostic lisible avec export en un clic.",
+  "settings.runtime_debug_title": "Rapport de débogage runtime",
+  "settings.runtime_desc": "État de votre moteur local et du serveur OpenWork.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Erreur",
+  "settings.sandbox_export_hint": "Utilisez Exporter dans le rapport de débogage runtime ci-dessus pour",
+  "settings.sandbox_probe_desc": "Exécute une vérification temporaire de démarrage de sandbox Docker et",
+  "settings.sandbox_probe_success": "Sonde de sandbox réussie. Exportez le rapport de débogage pour le support.",
+  "settings.sandbox_probe_title": "Sonde de sandbox",
+  "settings.sandbox_ready": "Prêt",
+  "settings.sandbox_requires_desktop": "La sonde de sandbox nécessite l'application desktop",
+  "settings.sandbox_result": "Résultat : {status}",
+  "settings.sandbox_run_id": "ID d'exécution : {id}",
+  "settings.sandbox_stop_runs_hint": "Arrêtez les exécutions actives avant de sonder",
+  "settings.search_models": "Rechercher des modèles…",
+  "settings.send_feedback": "Envoyer un retour",
+  "settings.show_model_reasoning": "Afficher le raisonnement du modèle",
+  "settings.show_model_reasoning_desc": "Développe les traces de raisonnement dans l'UI lorsqu'un modèle les expose.",
+  "settings.showing_models": "Affichage de {count} sur {total}",
+  "settings.startup": "Démarrage",
+  "settings.startup_remote_warning": "La préférence de démarrage est actuellement distante. Paramètres du moteur",
+  "settings.startup_reset_hint": "Cela efface votre préférence enregistrée et affiche la connexion",
+  "settings.startup_title": "Démarrage",
+  "settings.stop_local_server": "Arrêter le serveur local",
+  "settings.stop_runs_before_cleanup": "Arrêtez les exécutions actives avant le nettoyage",
+  "settings.stop_runs_before_reset_config": "Arrêtez les exécutions actives avant de réinitialiser la configuration",
+  "settings.stop_runs_to_reset": "Arrêtez les exécutions actives pour réinitialiser",
+  "settings.switch": "Basculer",
+  "settings.tab_advanced": "Avancé",
+  "settings.tab_appearance": "Apparence",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Débogage",
+  "settings.tab_description_advanced": "Inspectez la santé du runtime, l'état de connexion et les contrôles destinés aux développeurs.",
+  "settings.tab_description_appearance": "Ajustez l'apparence d'OpenWork sur desktop, thème système et chrome de l'application.",
+  "settings.tab_description_debug": "Consultez les diagnostics du runtime, les journaux et les utilitaires de débogage bas niveau.",
+  "settings.tab_description_den": "Gérez votre connexion OpenWork Cloud, les workers hébergés et l'accès à l'espace de travail.",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "Gérez les applications MCP et les Plugins OpenCode pour cet espace de travail.",
+  "settings.tab_description_general": "Connectez des fournisseurs, choisissez le modèle par défaut, autorisez des dossiers et contrôlez l'espace de travail OpenWork sélectionné ainsi que sa connexion runtime.",
+  "settings.tab_description_recovery": "Réparez l'état des migrations, réinitialisez les valeurs par défaut de l'espace de travail et récupérez les paramètres locaux.",
+  "settings.tab_description_skills": "Parcourez, modifiez et installez des Skills sans quitter les paramètres.",
+  "settings.tab_description_updates": "Gardez l'application à jour avec des vérifications discrètes en arrière-plan et des contrôles d'installation.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Extensions",
+  "settings.tab_general": "Paramètres",
+  "settings.tab_recovery": "Récupération",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Mises à jour",
+  "settings.theme_dark": "Sombre",
+  "settings.theme_light": "Clair",
+  "settings.theme_system": "Système",
+  "settings.theme_system_hint": "Le mode système suit automatiquement la préférence de votre OS.",
+  "settings.update": "Mettre à jour",
+  "settings.update_available": "Mise à jour disponible : v",
+  "settings.update_available_version": "Mise à jour disponible : v{version}",
+  "settings.update_check_button": "Vérifier",
+  "settings.update_check_failed": "Échec de la vérification des mises à jour",
+  "settings.update_checking": "Vérification...",
+  "settings.update_download_button": "Télécharger",
+  "settings.update_downloading": "Téléchargement...",
+  "settings.update_install_button": "Installer et redémarrer",
+  "settings.update_last_checked": "Dernière vérification {time}",
+  "settings.update_published": "Publié le {date}",
+  "settings.update_ready": "Prêt à installer : v",
+  "settings.update_ready_version": "Prêt à installer : v{version}",
+  "settings.update_uptodate": "À jour",
+  "settings.updates": "Mises à jour",
+  "settings.updates_desc": "Gardez OpenWork à jour.",
+  "settings.updates_desktop_only": "Les mises à jour ne sont disponibles que dans l'application desktop.",
+  "settings.updates_not_supported": "Les mises à jour ne sont pas prises en charge dans cet environnement.",
+  "settings.updates_title": "Mises à jour",
+  "settings.window_appearance_desc": "Personnalisez l'apparence de la fenêtre.",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Configuration de l'espace de travail",
+  "settings.workspace_debug_events_label": "Événements de débogage de l'espace de travail",
+  "share.back_hint": "Retour aux options de partage",
+  "share.chooser_subtitle": "Choisissez comment vous voulez partager cet espace de travail.",
+  "share.close_hint": "Fermer",
+  "share.option_access_desc": "Révélez les détails de connexion en direct nécessaires pour atteindre cet espace de travail en cours d'exécution depuis une autre machine.",
+  "share.option_access_title": "Accéder à l'espace de travail à distance",
+  "share.subtitle_access": "Révélez les détails de connexion en direct nécessaires pour atteindre cet espace de travail depuis une autre machine.",
+  "share.title": "Partager l'espace de travail",
+  "share.view_access": "Accéder à l'espace de travail à distance",
+  "share.workspace_fallback": "Espace de travail",
+  "share_skill_destination.add_to_workspace": "Ajouter le Skill à l'espace de travail",
+  "share_skill_destination.adding": "Ajout du Skill...",
+  "share_skill_destination.connect_remote": "Connecter un espace de travail distant",
+  "share_skill_destination.connect_remote_hint": "Attachez un hôte OpenWork, puis choisissez-le dans la liste pour importer ce Skill.",
+  "share_skill_destination.create_worker": "Créer un nouvel espace de travail",
+  "share_skill_destination.create_worker_hint": "Ouvrez le flux de configuration de l'espace de travail, puis ajoutez ce Skill une fois que le nouvel espace de travail est prêt.",
+  "share_skill_destination.current_badge": "Actuel",
+  "share_skill_destination.existing_workers": "Espaces de travail existants",
+  "share_skill_destination.fallback_skill_name": "Skill partagé",
+  "share_skill_destination.local_badge": "Local",
+  "share_skill_destination.more_options": "Plus d'options",
+  "share_skill_destination.no_workers": "Aucun espace de travail n'est encore prêt. Créez-en un ou connectez un espace de travail distant pour installer ce Skill.",
+  "share_skill_destination.remote_badge": "Distant",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Sélectionné",
+  "share_skill_destination.selected_hint": "Sélectionné. Vérifiez la destination ci-dessous, puis confirmez.",
+  "share_skill_destination.skill_label": "Skill partagé",
+  "share_skill_destination.subtitle": "Choisissez un espace de travail existant ou créez-en un nouveau avant d'importer ce Skill partagé.",
+  "share_skill_destination.title": "Où ce Skill doit-il aller ?",
+  "share_skill_destination.trigger_label": "Déclencheur",
+  "sidebar.collapse": "Réduire",
+  "sidebar.expand": "Développer",
+  "skills.add_custom_repo": "Ajouter un dépôt GitHub personnalisé",
+  "skills.add_git_repo": "Ajouter un dépôt git",
+  "skills.add_openwork_hub": "Ajouter un Hub OpenWork",
+  "skills.available_from_hub": "Disponible depuis le Hub",
+  "skills.catalog_search_placeholder": "Rechercher parmi les Skills installés, d'équipe et du hub",
+  "skills.cloud_choose_org_detail": "Utilisez le panneau Cloud pour choisir votre organisation active, puis actualisez cette liste.",
+  "skills.cloud_choose_org_hint": "Choisissez une organisation dans Paramètres → Cloud pour charger les Skills d'équipe.",
+  "skills.cloud_footer_label": "Équipe",
+  "skills.cloud_hub_label": "Hub : {name}",
+  "skills.cloud_installed": "{name} installé sur ce worker.",
+  "skills.cloud_installed_as": "Installé sous {name}",
+  "skills.cloud_installing": "Installation de {title}…",
+  "skills.cloud_installing_short": "Installation",
+  "skills.cloud_no_search_matches": "Aucun Skill ne correspond à cette recherche.",
+  "skills.cloud_org_empty": "Aucun Skill d'organisation n'est encore disponible.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "Échec du chargement des Skills de l'organisation.",
+  "skills.cloud_refresh": "Actualiser les Skills d'équipe",
+  "skills.cloud_section_subtitle": "Skills partagés avec vous via OpenWork Cloud — y compris les hubs de Skills d'équipe auxquels vous avez accès.",
+  "skills.cloud_section_title": "Depuis votre organisation",
+  "skills.cloud_shared_org": "Organisation",
+  "skills.cloud_shared_private": "Privé",
+  "skills.cloud_shared_public": "Public",
+  "skills.cloud_sign_in": "Se connecter à Cloud",
+  "skills.cloud_sign_in_hint": "Connectez-vous à OpenWork Cloud pour parcourir les Skills d'équipe et d'organisation.",
+  "skills.cloud_status_installed": "Installé",
+  "skills.cloud_status_update": "Mise à jour disponible",
+  "skills.cloud_update_skill": "Mettre à jour",
+  "skills.cloud_updated": "{name} mis à jour sur ce worker.",
+  "skills.cloud_updating": "Mise à jour de {title}…",
+  "skills.cloud_removed": "Skill cloud local {name} supprimé.",
+  "skills.copy_link_failed": "Échec de la copie du lien",
+  "skills.create_in_chat": "Créer un Skill dans le chat",
+  "skills.desktop_required": "La gestion des Skills nécessite l'application desktop.",
+  "skills.enter_plugin_name": "Entrez un nom de package plugin.",
+  "skills.failed_load_active": "Échec du chargement des Plugins actifs.",
+  "skills.failed_load_opencode": "Échec du chargement de opencode.json",
+  "skills.failed_parse_opencode": "Échec de l'analyse de opencode.json",
+  "skills.failed_to_load": "Échec du chargement des Skills",
+  "skills.failed_update_opencode": "Échec de la mise à jour de opencode.json",
+  "skills.filter_all": "Tout",
+  "skills.filter_cloud": "Équipe",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Installé",
+  "skills.from_repo": "Depuis {owner}/{repo}",
+  "skills.github_repo_hint": "Entrez un dépôt GitHub au format owner/repo.",
+  "skills.host_mode_only": "Espace de travail local uniquement",
+  "skills.host_only_error": "La gestion des Skills nécessite un espace de travail local ou un serveur OpenWork connecté.",
+  "skills.hub_desc": "Parcourez les Skills partagés depuis des hubs adossés à GitHub et ajoutez-les à ce worker.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Importer",
+  "skills.import_failed": "Échec de l'import ({status})",
+  "skills.import_local": "Importer un Skill local",
+  "skills.import_local_skill": "Importer un Skill local",
+  "skills.imported": "Importé.",
+  "skills.install": "Installer",
+  "skills.install_failed": "Échec de l'installation du Skill.",
+  "skills.install_name_title": "Installer {name}",
+  "skills.installed": "Skills installés",
+  "skills.installed_desc": "Les Skills installés vivent sur ce worker et peuvent être modifiés ou partagés.",
+  "skills.installed_status": "Installé",
+  "skills.installing": "Ajouter un Skill",
+  "skills.installing_prefix": "Installation de {name}…",
+  "skills.installing_skill_creator": "Installation du créateur de Skills...",
+  "skills.link_copied": "Lien copié",
+  "skills.loading": "Chargement…",
+  "skills.no_description": "Aucune description pour le moment.",
+  "skills.no_hub_repo_label": "Aucun dépôt de hub sélectionné",
+  "skills.no_hub_repo_selected": "Aucun Skill de hub disponible.",
+  "skills.no_hub_skills": "Aucun dépôt de hub sélectionné. Ajoutez un dépôt GitHub pour parcourir les Skills.",
+  "skills.no_opencode_found": "Aucun opencode.json trouvé pour le moment. Ajoutez un plugin pour en créer un.",
+  "skills.no_opencode_workspace": "Aucun opencode.json dans cet espace de travail pour le moment.",
+  "skills.no_skills": "Aucun Skill détecté dans `.opencode/skills`, `.claude/skills` ou `~/.agents/skills`.",
+  "skills.no_skills_found": "Aucun Skill trouvé pour le moment.",
+  "skills.owner_label": "Propriétaire",
+  "skills.owner_repo_required": "Le propriétaire et le dépôt sont requis.",
+  "skills.pick_project_first": "Choisissez d'abord un dossier de projet.",
+  "skills.pick_project_for_active": "Choisissez un dossier de projet pour charger les Plugins actifs.",
+  "skills.pick_project_for_plugins": "Choisissez un dossier de projet pour gérer les Plugins du projet.",
+  "skills.pick_workspace_first": "Choisissez d'abord un dossier d'espace de travail.",
+  "skills.plugin_already_listed": "Le plugin est déjà listé dans opencode.json.",
+  "skills.plugin_management_host_only": "La gestion des Plugins nécessite l'application desktop.",
+  "skills.plugins_host_only": "Les Plugins ne sont disponibles que dans l'application desktop.",
+  "skills.ref_label": "Ref (branche/tag/commit)",
+  "skills.refresh": "Actualiser",
+  "skills.refresh_hub": "Actualiser le hub",
+  "skills.remove_saved_repo": "Supprimer le dépôt enregistré",
+  "skills.repo_label": "Dépôt",
+  "skills.reveal_failed": "Échec de l'ouverture du dossier des Skills.",
+  "skills.reveal_folder": "Ouvrir le dossier des Skills",
+  "skills.save_and_load": "Enregistrer et charger",
+  "skills.select_skill_folder": "Sélectionner le dossier du Skill",
+  "skills.share_back": "Retour",
+  "skills.share_chooser_subtitle": "Enregistrez dans votre organisation OpenWork Cloud ou publiez un lien d'installation public.",
+  "skills.share_close": "Fermer",
+  "skills.share_copy_link": "Copier",
+  "skills.share_done": "Terminé",
+  "skills.share_option_public_desc": "Créez un lien que tout le monde peut utiliser pour installer ce Skill.",
+  "skills.share_option_public_title": "Lien public",
+  "skills.share_option_team_desc": "Ajoutez ce Skill à votre organisation OpenWork Cloud active.",
+  "skills.share_option_team_title": "Partager avec l'équipe",
+  "skills.share_public_create": "Créer le lien",
+  "skills.share_public_creating": "Publication…",
+  "skills.share_public_intro": "Publiez un lien public. Toute personne disposant de l'URL peut installer ce Skill.",
+  "skills.share_public_regenerate": "Régénérer le lien",
+  "skills.share_publisher_label": "Éditeur",
+  "skills.share_subtitle_public": "Toute personne ayant le lien peut installer ce Skill.",
+  "skills.share_subtitle_team": "Stocké dans votre organisation pour les coéquipiers.",
+  "skills.share_team_choose_org": "Choisissez une organisation dans Paramètres → Cloud avant de partager avec votre équipe.",
+  "skills.share_team_permissions_intro": "Téléversez ce Skill dans votre organisation OpenWork Cloud active et décidez qui peut le voir.",
+  "skills.share_team_permissions_label": "Autorisations de partage",
+  "skills.share_team_permission_org": "Organisation uniquement - pas dans le hub",
+  "skills.share_team_permission_private": "Privé pour moi uniquement",
+  "skills.share_team_hubs_loading": "Chargement des hubs…",
+  "skills.share_team_org_fallback": "Organisation Cloud active",
+  "skills.share_team_upload_and_save": "Téléverser et enregistrer",
+  "skills.share_team_uploading": "Téléversement…",
+  "skills.share_team_sign_in": "Connectez-vous pour partager avec l'équipe",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud s'ouvre dans votre navigateur. Revenez ici après vous être connecté.",
+  "skills.share_team_uploaded_success": "Téléversé dans {org}. Les Skills cloud seront actualisés pour votre compte.",
+  "skills.share_title": "Partager le Skill",
+  "skills.shown_count": "{count} affichés",
+  "skills.skill_creator_already_installed": "Le créateur de Skills est déjà installé.",
+  "skills.skill_creator_installed": "Créateur de Skills installé.",
+  "skills.skill_load_failed": "Échec du chargement du Skill.",
+  "skills.source_label": "Source",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Déclencheur : {trigger}",
+  "skills.uninstall": "Désinstaller",
+  "skills.uninstall_failed": "Échec de la désinstallation du Skill.",
+  "skills.uninstall_title": "Désinstaller le Skill ?",
+  "skills.uninstall_warning": "Cela supprimera définitivement le Skill `{name}` de votre espace de travail.",
+  "skills.uninstalled": "Skill supprimé.",
+  "skills.unknown_error": "Erreur inconnue",
+  "skills.worker_profile_desc": "Les Skills sont les capacités centrales de ce worker. Découvrez-les via le Hub, gérez ce qui est installé et créez-en de nouveaux directement dans le chat.",
+  "status.back": "Retour à l'écran précédent",
+  "status.connected": "Connecté",
+  "status.connecting": "Connexion",
+  "status.creating_task": "Création d'une nouvelle tâche",
+  "status.developer_mode": "Mode développeur",
+  "status.disconnected": "Déconnecté",
+  "status.disconnected_hint": "Ouvrez les paramètres pour vous reconnecter",
+  "status.disconnected_label": "Déconnecté",
+  "status.docs": "Docs",
+  "status.feedback": "Retour",
+  "status.limited_hint": "Reconnectez-vous pour restaurer toutes les fonctionnalités OpenWork",
+  "status.limited_mcp_hint": "{count} MCP connecté · reconnectez-vous pour toutes les fonctionnalités",
+  "status.limited_mode": "Mode limité",
+  "status.loading_session": "Chargement de la session",
+  "status.mcp_connected": "{count} MCP connecté",
+  "status.open_docs": "Ouvrir la documentation",
+  "status.openwork_ready": "OpenWork prêt",
+  "status.providers_connected_one": "{count} fournisseur connecté",
+  "status.providers_connected_other": "{count} fournisseurs connecté",
+  "status.ready_for_tasks": "Prêt pour de nouvelles tâches",
+  "status.running": "En cours d'exécution",
+  "status.send_feedback": "Envoyer un retour",
+  "status.settings": "Paramètres",
+  "system.reload_body_agents": "OpenCode charge les agents au démarrage. Rechargez le moteur pour rendre les agents mis à jour disponibles.",
+  "system.reload_body_commands": "OpenCode charge les Commands au démarrage. Rechargez le moteur pour rendre les Commands mis à jour disponibles.",
+  "system.reload_body_config": "OpenCode lit opencode.json au démarrage. Rechargez le moteur pour appliquer les changements de configuration.",
+  "system.reload_body_default": "OpenWork a détecté des changements qui nécessitent le rechargement de l'instance OpenCode.",
+  "system.reload_body_mcp": "OpenCode charge les serveurs MCP au démarrage. Rechargez le moteur pour activer la nouvelle connexion.",
+  "system.reload_body_mixed": "OpenWork a détecté des changements de configuration OpenCode. Rechargez le moteur pour les appliquer.",
+  "system.reload_body_plugins": "OpenCode charge les plugins npm au démarrage. Rechargez le moteur pour appliquer les changements de opencode.json.",
+  "system.reload_body_skills": "OpenCode peut mettre en cache la découverte/l'état des Skills. Rechargez le moteur pour rendre les Skills nouvellement installés disponibles.",
+  "system.reload_failed": "Échec du rechargement du moteur.",
+  "system.reload_required": "Rechargement requis",
+  "system.reload_unavailable": "Le rechargement n'est pas disponible pour ce worker.",
+  "system.stop_active_runs_before_reset": "Arrêtez les exécutions actives avant de réinitialiser.",
+  "time.hours_ago": "il y a {count} h",
+  "time.just_now": "à l'instant",
+  "time.minutes_ago": "il y a {count} min",
+  "time.seconds_ago": "il y a {count} s",
+  "workspace.loading_tasks": "Chargement des tâches...",
+  "workspace.local_badge": "Local",
+  "workspace.new_task_inline": "+ Nouvelle tâche",
+  "workspace.no_tasks": "Aucune tâche pour le moment.",
+  "workspace.remote_badge": "Distant",
+  "workspace.rename_description": "Mettez à jour le nom affiché dans la barre latérale.",
+  "workspace.rename_label": "Nom de l'espace de travail",
+  "workspace.rename_placeholder": "Espace de travail de l'équipe design",
+  "workspace.rename_title": "Modifier le nom de l'espace de travail",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Sélectionné",
+  "workspace_list.add_workspace": "Ajouter un espace de travail",
+  "workspace_list.connecting": "Connexion...",
+  "workspace_list.delete_session": "Supprimer la session",
+  "workspace_list.edit_connection": "Modifier la connexion",
+  "workspace_list.edit_name": "Modifier le nom",
+  "workspace_list.hide_child_sessions": "Masquer les sessions enfants",
+  "workspace_list.recover": "Récupérer",
+  "workspace_list.remote_worker_unavailable": "Worker distant indisponible",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork ne peut pas charger les tâches de ce worker tant que la connexion n'est pas corrigée.",
+  "workspace_list.remove_workspace": "Supprimer l'espace de travail",
+  "workspace_list.rename_session": "Renommer la session",
+  "workspace_list.reveal_explorer": "Révéler dans l'Explorateur",
+  "workspace_list.reveal_finder": "Révéler dans le Finder",
+  "workspace_list.session_actions": "Actions de session",
+  "workspace_list.share": "Partager...",
+  "workspace_list.show_child_sessions": "Afficher les sessions enfants",
+  "workspace_list.show_more": "Afficher {count} de plus",
+  "workspace_list.show_more_fallback": "Afficher plus",
+  "workspace_list.test_connection": "Tester la connexion",
+  "workspace_list.unavailable": "Indisponible",
+  "workspace_list.workspace_fallback": "Espace de travail",
+  "workspace_list.workspace_options": "Options de l'espace de travail",
+} as const;
diff --git a/apps/app/src/i18n/locales/index.ts b/apps/app/src/i18n/locales/index.ts
new file mode 100644
index 0000000000..667f05de72
--- /dev/null
+++ b/apps/app/src/i18n/locales/index.ts
@@ -0,0 +1,12 @@
+/**
+ * Re-export all translation files for convenience
+ */
+export { default as en } from "./en";
+export { default as ja } from "./ja";
+export { default as zh } from "./zh";
+export { default as vi } from "./vi";
+export { default as ptBR } from "./pt-BR";
+export { default as fr } from "./fr";
+export { default as ca } from "./ca";
+export { default as es } from "./es";
+export { default as ru } from "./ru";
diff --git a/apps/app/src/i18n/locales/ja.ts b/apps/app/src/i18n/locales/ja.ts
new file mode 100644
index 0000000000..bb5156e20c
--- /dev/null
+++ b/apps/app/src/i18n/locales/ja.ts
@@ -0,0 +1,1377 @@
+/**
+ * Japanese translations (日本語)
+ */
+
+export default {
+  "app.compact_command_desc": "このセッションを要約してコンテキストサイズを削減します。",
+  "app.error_audit_load": "監査ログの読み込みに失敗しました。",
+  "app.error_auth_failed": "認証に失敗しました",
+  "app.error_command_not_resolved": "コマンドを解決できませんでした。",
+  "app.error_compact_empty": "まだ圧縮するものがありません。",
+  "app.error_compact_no_session": "/compactを実行する前にメッセージのあるセッションを選択してください。",
+  "app.error_compact_no_session_id": "圧縮する前にセッションを選択してください。",
+  "app.error_connect_first": "ランタイム変更を適用する前にこのワークスペースに接続してください。",
+  "app.error_not_connected": "サーバーに接続されていません",
+  "app.error_rate_limit": "レート制限を超えました",
+  "app.error_remote_access": "リモートアクセスの更新に失敗しました。",
+  "app.error_request_failed": "リクエストに失敗しました",
+  "app.error_restart_local_worker": "共有設定の更新後にローカルワーカーの再起動に失敗しました。",
+  "app.error_session_name_required": "セッション名は必須です",
+  "app.local_disabled_reason": "ローカルワークスペースはデスクトップアプリで作成できます。リモートおよび共有ワークスペースはここでも利用可能です。",
+  "app.model_behavior_title": "モデル動作",
+  "app.plugins_hint_readonly": "OpenWorkサーバーのプラグインは読み取り専用です。",
+  "app.reload_later": "後で",
+  "app.reload_now": "今すぐリロード",
+  "app.reload_stop_tasks": "リロードしてタスクを停止",
+  "app.skills_hint_readonly": "OpenWorkサーバーのスキルは読み取り専用です。インストールを有効にするには詳細設定でホストトークンを追加してください。",
+  "app.unknown_error": "不明なエラー",
+  "blueprint.automation_body": "再利用可能なワークフローから始めるか、下にタスクを入力してください。",
+  "blueprint.automation_title": "何を自動化しますか？",
+  "blueprint.csv_session_assistant": "CSVファイルの生成、クリーンアップ、マージ、集計のお手伝いができます。どんなCSV作業を自動化しますか？",
+  "blueprint.csv_session_title": "CSVワークフローのアイデア",
+  "blueprint.csv_session_user": "複数のツールからのエクスポートを1つのきれいなCSVにまとめたいです。",
+  "blueprint.empty_body": "テンプレートを選ぶか、下に入力してください。",
+  "blueprint.empty_title": "何をしましょうか？",
+  "blueprint.minimal_body": "このワークスペースについて質問するか、スタータープロンプトを使ってください。",
+  "blueprint.minimal_title": "タスクから始める",
+  "blueprint.starter_blueprint_desc": "スキル、コマンド、ハンドオフステップを含む再利用可能なワークフローを設計します。",
+  "blueprint.starter_blueprint_prompt": "このワークスペースの再利用可能なオートメーション設計図の作成を手伝ってください。何を標準化すべきか聞いてから、ワークフローを提案してください。",
+  "blueprint.starter_blueprint_title": "オートメーション設計図を作成",
+  "blueprint.starter_chrome_desc": "ブラウザ自動化のセッションをすぐに開始します。",
+  "blueprint.starter_chrome_prompt": "Chromeに接続して、繰り返しのタスクを自動化するのを手伝ってください。",
+  "blueprint.starter_chrome_title": "Chromeを自動化",
+  "blueprint.starter_command_desc": "繰り返しのワークフローをこのワークスペースのスラッシュコマンドに変換します。",
+  "blueprint.starter_command_prompt": "このワークスペースで再利用可能な/コマンドの作成を手伝ってください。自動化したいワークフローを聞いてから、コマンドを作成してください。",
+  "blueprint.starter_command_title": "再利用可能なコマンドを作成",
+  "blueprint.starter_connect_openai_desc": "OpenAIプロバイダーを追加して、新しいセッションでChatGPTモデルをすぐに使えるようにします。",
+  "blueprint.starter_connect_openai_title": "ChatGPTに接続",
+  "blueprint.starter_csv_desc": "スプレッドシートデータのクリーンアップや生成。",
+  "blueprint.starter_csv_prompt": "このコンピュータでCSVファイルの作成や編集を手伝ってください。",
+  "blueprint.starter_csv_title": "CSVを操作",
+  "blueprint.starter_explore_desc": "ファイルを要約し、最初に取り組むべきタスクを提案します。",
+  "blueprint.starter_explore_prompt": "このワークスペースを要約し、最も重要なファイルを指摘し、最初に取り組むべきタスクを提案してください。",
+  "blueprint.starter_explore_title": "このワークスペースを探索",
+  "blueprint.welcome_message": "OpenWorkへようこそ！\n\nCSVファイルの作成、Chromeの自動化、Notionへの連絡先同期など、さまざまな作業に使われています。\n\n可能性は無限大です。\n\n何をしましょうか？",
+  "blueprint.welcome_title": "OpenWorkへようこそ",
+  "common.add": "追加",
+  "common.cancel": "キャンセル",
+  "common.close": "閉じる",
+  "common.default_parens": "（デフォルト）",
+  "common.edit": "編集",
+  "common.hide": "隠す",
+  "common.navigate": "移動",
+  "common.next": "次へ",
+  "common.off": "オフ",
+  "common.on": "オン",
+  "common.path": "パス",
+  "common.question": "質問",
+  "common.refresh": "更新",
+  "common.remove": "削除",
+  "common.reset": "リセット",
+  "common.save": "保存",
+  "common.select": "選択",
+  "common.show": "表示",
+  "common.something_went_wrong": "エラーが発生しました",
+  "common.submit": "送信",
+  "common.unknown": "不明",
+  "composer.agent_label": "エージェント",
+  "composer.attach_files": "ファイルを添付",
+  "composer.attachments_unavailable": "添付ファイルは利用できません。",
+  "composer.behavior_label": "動作",
+  "composer.configure": "設定",
+  "composer.default_agent": "デフォルトエージェント",
+  "composer.file_exceeds_limit": "{name}は8MBの制限を超えています。",
+  "composer.file_kind": "ファイル",
+  "composer.image_kind": "画像",
+  "composer.inserted_links_unsupported": "未対応ファイルのリンクを挿入しました。",
+  "composer.loading_commands": "コマンドを読み込み中…",
+  "composer.mcps_label": "MCP",
+  "composer.no_commands": "コマンドが見つかりません。",
+  "composer.placeholder": "タスクを入力してください…",
+  "composer.remote_worker_paste_warning": "これはリモートワーカーです。サンドボックスもリモートです。ファイルを共有するには、サイドバーの共有フォルダにアップロードしてください。",
+  "composer.run_task": "タスクを実行",
+  "composer.skill_source": "スキル",
+  "composer.stop": "停止",
+  "composer.tools_label": "コマンド、スキル、MCP",
+  "composer.unsupported_attachment_type": "未対応の添付ファイル形式です。",
+  "composer.upload_to_shared_folder": "共有フォルダにアップロード",
+  "composer.uploaded_multiple_files": "{count}件のファイルを共有フォルダにアップロードし、リンクを挿入しました。",
+  "composer.uploaded_single_file": "{name}を共有フォルダにアップロードし、リンクを挿入しました。",
+  "config.collaborator_token_disabled_hint": "リモート共有用に事前保存されていますが、リモートアクセスは現在無効です。",
+  "config.collaborator_token_label": "コラボレータートークン",
+  "config.collaborator_token_remote_hint": "スマートフォンやノートPCからこのサーバーに接続する通常のリモートアクセス用。",
+  "config.connection_failed": "接続に失敗しました。",
+  "config.connection_failed_check": "接続に失敗しました。ホストURLとトークンを確認してください。",
+  "config.connection_status_updated": "接続ステータスを更新しました。",
+  "config.connection_successful": "接続に成功しました。",
+  "config.copied": "コピー済み",
+  "config.copy": "コピー",
+  "config.desktop_only_hint": "一部の設定機能（ローカルサーバー共有やメッセージングブリッジ）にはデスクトップアプリが必要です。",
+  "config.diagnostics_desc": "サニタイズされたランタイム状態をデバッグ用にコピーします。",
+  "config.diagnostics_title": "診断バンドル",
+  "config.engine_reload_desc": "このワークスペースのOpenCodeサーバーを再起動します。",
+  "config.engine_reload_title": "エンジンリロード",
+  "config.host_admin_token_hint": "承認CLIおよび管理APIのためのホスト専用内部トークンです。リモートアプリ接続フローには使用しないでください。",
+  "config.host_admin_token_label": "ホスト管理トークン",
+  "config.host_local_only": "ローカルのみ",
+  "config.host_offline": "オフライン",
+  "config.host_remote_enabled": "リモート有効",
+  "config.local_ip_hint": "同じWi-Fiでは、ローカルIPを使うと最も高速に接続できます。",
+  "config.mdns_hint": ".localの名前は覚えやすいですが、一部のネットワークでは解決できない場合があります。",
+  "config.messaging_identities_desc": "Telegram/Slackのアイデンティティとルーティングはアイデンティティタブで管理できます。",
+  "config.messaging_identities_title": "メッセージングアイデンティティ",
+  "config.not_set": "未設定",
+  "config.owner_token_disabled_hint": "このワーカーのリモートアクセスを有効にした後にのみ関連します。",
+  "config.owner_token_label": "オーナートークン",
+  "config.owner_token_remote_hint": "リモートクライアントが許可プロンプトへの応答やオーナー専用操作が必要な場合に使用します。",
+  "config.reload_active_tasks_warning": "リロードするとアクティブなタスクが停止します。",
+  "config.reload_availability_hint": "リロードはローカルワーカーまたは接続済みOpenWorkサーバーでのみ利用可能です。",
+  "config.reload_connect_hint": "リロードするにはこのワーカーに接続してください。",
+  "config.reload_engine": "エンジンをリロード",
+  "config.reload_now_desc": "設定の更新を適用し、セッションを再接続します。",
+  "config.reload_now_title": "今すぐリロード",
+  "config.reloading": "リロード中…",
+  "config.remote_access_off_hint": "リモートアクセスはオフです。別のマシンから接続する場合は、先にワークスペースの共有を有効にしてください。",
+  "config.resolved_worker_url": "解決済みワーカーURL:",
+  "config.server_needed_hint": "スキル、プラグイン、コマンドを同期するにはOpenWorkサーバー接続が必要です。",
+  "config.server_section_desc": "OpenWorkサーバーに接続します。サーバー管理者から共有されたURLとコラボレーターまたはオーナートークンを使用してください。",
+  "config.server_section_title": "OpenWorkサーバー",
+  "config.server_sharing_desc": "信頼できるデバイスとこれらの詳細を共有してください。最速のセットアップには同じネットワーク上のサーバーを使用してください。",
+  "config.server_sharing_menu_hint": "ワークスペースごとの共有リンクは、ワークスペースメニューの「共有…」から利用できます。",
+  "config.server_sharing_title": "OpenWorkサーバー共有",
+  "config.server_url_hint": "OpenWorkサーバーから共有されたURLを使用してください。ローカルデスクトップワーカーは48000〜51000の範囲の永続ハイポートを再利用します。",
+  "config.server_url_input_label": "OpenWorkサーバーURL",
+  "config.server_url_label": "OpenWorkサーバーURL",
+  "config.starting_server": "サーバーを起動中…",
+  "config.status_connected": "接続済み",
+  "config.status_limited": "制限あり",
+  "config.status_not_connected": "未接続",
+  "config.test_connection": "接続をテスト",
+  "config.testing": "テスト中…",
+  "config.testing_connection": "接続をテスト中…",
+  "config.token_hint": "任意。通常アクセス用のコラボレータートークン、または許可プロンプトへの応答が必要な場合はオーナートークンを貼り付けてください。",
+  "config.token_label": "コラボレーターまたはオーナートークン",
+  "config.token_placeholder": "トークンを貼り付け",
+  "config.unavailable": "利用不可",
+  "config.worker_id": "ワーカーID:",
+  "config.workspace_config_desc": "これらの設定は選択されたワークスペースに適用されます。ランタイム操作は現在接続中のワークスペースに適用されます。",
+  "config.workspace_config_title": "ワークスペース設定",
+  "config.workspace_id_prefix": "ワークスペース:",
+  "context_panel.add_button": "追加",
+  "context_panel.add_folder_hint": "フォルダを追加して、このワークスペースがルートディレクトリ外のファイルを読み書きできるようにします。",
+  "context_panel.adding_button": "追加中…",
+  "context_panel.always_available": "常に利用可能",
+  "context_panel.authorized_folders": "許可されたフォルダ",
+  "context_panel.authorized_folders_desc": "このワークスペースにルートディレクトリ外のファイルへの読み書きアクセスを許可します。",
+  "context_panel.authorized_folders_no_access": "許可されたフォルダを編集するには、書き込み可能なOpenWorkサーバーワークスペースに接続してください。",
+  "context_panel.browse_button": "参照",
+  "context_panel.config_access_unavailable": "このワークスペースではOpenWorkサーバー設定へのアクセスが利用できません。",
+  "context_panel.config_read_only": "OpenWorkサーバーのワークスペース設定は読み取り専用です。",
+  "context_panel.folder_already_authorized": "このフォルダはすでに許可されています。",
+  "context_panel.folders_updated": "許可されたフォルダを更新しました。",
+  "context_panel.input_placeholder": "許可するフォルダパスを入力…",
+  "context_panel.no_external_folders": "外部フォルダが許可されていません",
+  "context_panel.no_mcp": "MCPサーバーが読み込まれていません。",
+  "context_panel.no_server_workspace": "アクティブなサーバーワークスペースが選択されていません。",
+  "context_panel.no_skills": "スキルが読み込まれていません。",
+  "context_panel.preserving_entries": "フォルダ以外の権限エントリ（{count}件）を維持しています。",
+  "context_panel.preserving_entry": "フォルダ以外の権限エントリ（1件）を維持しています。",
+  "context_panel.remove_folder": "{name}を削除",
+  "context_panel.saving_folders": "許可されたフォルダを保存中…",
+  "context_panel.server_disconnected": "OpenWorkサーバーが接続されていません。",
+  "context_panel.workspace_root_available": "ワークスペースルートはすでに利用可能です。",
+  "context_panel.workspace_root_badge": "ワークスペースルート",
+  "context_panel.writable_workspace_required": "許可されたフォルダを更新するには、書き込み可能なOpenWorkサーバーワークスペースが必要です。",
+  "dashboard.change": "変更",
+  "dashboard.choose_folder": "フォルダを選択してください",
+  "dashboard.choose_folder_continue": "続行するにはフォルダを選択してください。",
+  "dashboard.chooser_local_desc": "このデバイスにワークスペースを作成し、チームテンプレートから開始することもできます。",
+  "dashboard.chooser_remote_desc": "URLとアクセストークンを使ってセルフホストのOpenWorkワーカーに接続します。",
+  "dashboard.chooser_shared_desc": "組織で共有されたクラウドワーカーを参照し、ワンステップで接続します。",
+  "dashboard.close_settings": "設定を閉じる",
+  "dashboard.cloud_worker": "クラウドワーカー",
+  "dashboard.commands": "コマンド",
+  "dashboard.connect_remote_button": "リモート接続",
+  "dashboard.connected": "接続済み",
+  "dashboard.connecting": "接続中…",
+  "dashboard.create_local_workspace_subtitle": "このデバイスにワークスペースを作成し、チームテンプレートから開始することもできます。",
+  "dashboard.create_local_workspace_title": "ローカルワークスペース",
+  "dashboard.create_remote_custom_subtitle": "セルフホストのOpenWorkワーカーに接続します。",
+  "dashboard.create_remote_custom_title": "カスタムリモートに接続",
+  "dashboard.create_remote_workspace_confirm": "ワークスペースを追加",
+  "dashboard.create_remote_workspace_subtitle": "OpenWorkサーバーをワークスペースとして保存します。",
+  "dashboard.create_remote_workspace_title": "リモートワークスペースを追加",
+  "dashboard.create_sandbox_confirm": "サンドボックスとして作成",
+  "dashboard.create_shared_subtitle_signed_in": "組織で共有されたクラウドワーカーを参照し、ワンステップで接続します。",
+  "dashboard.create_shared_subtitle_signed_out": "組織で共有されたワークスペースにアクセスするにはOpenWork Cloudにサインインしてください。",
+  "dashboard.create_shared_title": "共有ワークスペース",
+  "dashboard.create_workspace_confirm": "ワークスペースを作成",
+  "dashboard.create_workspace_subtitle": "新しいフォルダベースのワークスペースを作成します。",
+  "dashboard.create_workspace_title": "ワークスペースを作成",
+  "dashboard.desktop_badge": "デスクトップ",
+  "dashboard.edit_remote_workspace_confirm": "接続を保存",
+  "dashboard.edit_remote_workspace_subtitle": "このワークスペースのOpenWorkサーバー詳細を更新します。",
+  "dashboard.edit_remote_workspace_title": "リモート接続を編集",
+  "dashboard.error_choose_org": "ワークスペースを開く前に組織を選択してください。",
+  "dashboard.error_connect_worker": "{name}への接続に失敗しました。",
+  "dashboard.error_load_orgs": "組織の読み込みに失敗しました。",
+  "dashboard.error_load_shared_workspaces": "共有ワークスペースの読み込みに失敗しました。",
+  "dashboard.error_workspace_not_ready": "ワークスペースはまだ接続できる状態ではありません。しばらくしてから再試行してください。",
+  "dashboard.import_config": "設定をインポート",
+  "dashboard.importing": "インポート中…",
+  "dashboard.modal_back": "戻る",
+  "dashboard.modal_close": "ワークスペース追加ダイアログを閉じる",
+  "dashboard.remote": "リモート",
+  "dashboard.remote_base_url_required": "続行するにはサーバーURLを追加してください。",
+  "dashboard.remote_server_details_hint": "セルフホストのOpenWorkワーカーに接続します。",
+  "dashboard.remote_server_details_title": "リモートサーバー詳細",
+  "dashboard.sandbox_checking_docker": "Dockerを確認中…",
+  "dashboard.sandbox_get_ready_title": "サンドボックスにはDockerが必要です",
+  "dashboard.skills": "スキル",
+  "dashboard.worker_status_attention": "要確認",
+  "dashboard.worker_status_ready": "準備完了",
+  "dashboard.worker_status_starting": "起動中",
+  "dashboard.worker_status_stopped": "停止済み",
+  "dashboard.worker_status_unknown": "不明",
+  "den.active_org_hint": "クラウドワーカーとチームテンプレートは選択した組織にスコープされます。",
+  "den.active_org_title": "アクティブな組織",
+  "den.auto_reconnect_hint": "ブラウザで認証を完了すると、OpenWorkが自動的にここに再接続します。",
+  "den.checking_session": "セッションを確認中",
+  "den.choose_org_for_providers": "クラウドプロバイダーを表示するには組織を選択してください。",
+  "den.choose_org_for_skill_hubs": "クラウドスキルハブを表示するには組織を選択してください。",
+  "den.cloud_account_hint": "接続済みアカウントと組織を管理します。",
+  "den.cloud_account_title": "Cloudアカウント",
+  "den.cloud_control_plane_open": "ブラウザで開く",
+  "den.cloud_control_plane_reset": "リセット",
+  "den.cloud_control_plane_save": "URLを保存",
+  "den.cloud_control_plane_url_hint": "デベロッパーモード専用。ローカルまたはセルフホストのCloudコントロールプレーンを対象にする場合に使用します。変更するとサインアウトされ、新しいコントロールプレーンに対して再接続します。",
+  "den.cloud_control_plane_url_label": "Cloudコントロールプレーン URL",
+  "den.cloud_provider_detail": "{count}モデル · {source}プロバイダー",
+  "den.cloud_provider_removed_detail": "このインポート済みプロバイダーはクラウドにありません。ローカルの{providerId}設定をアンインストールしてください。",
+  "den.cloud_provider_sync_detail": "クラウドプロバイダーが変更されました。{count}モデルの{source}設定をopencode.jsoncに同期してください。",
+  "den.cloud_providers_hint": "管理対象LLMプロバイダーをopencode.jsoncにインポートし、このワークスペースで組織の認証情報を使用します。",
+  "den.cloud_providers_title": "クラウドプロバイダー",
+  "den.cloud_section_desc": "サインインして組織を選択し、Cloudワーカーやチームテンプレートを開きます。",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "コンピュータがスリープしてもタスクを維持するには、OpenWork Cloudにサインインしてください。",
+  "den.cloud_workers_hint": "アプリの既存のリモート接続フローを使って、ワーカーを直接OpenWorkで開きます。",
+  "den.cloud_workers_title": "クラウドワーカー",
+  "den.create_account": "アカウントを作成",
+  "den.credentials_ready_badge": "認証情報準備完了",
+  "den.error_base_url": "有効なhttp://またはhttps://のCloudコントロールプレーンURLを入力してください。",
+  "den.error_choose_org": "ワーカーを開く前に組織を選択してください。",
+  "den.error_load_orgs": "組織の読み込みに失敗しました。",
+  "den.error_load_workers": "ワーカーの読み込みに失敗しました。",
+  "den.error_no_session": "アクティブなCloudセッションが見つかりません。",
+  "den.error_no_token": "デスクトップサインインは完了しましたが、OpenWork Cloudがセッショントークンを返しませんでした。",
+  "den.error_open_worker": "OpenWorkで{name}を開けませんでした。",
+  "den.error_open_worker_fallback": "{name}を開けませんでした。",
+  "den.error_paste_valid_code": "有効なOpenWorkサインインリンクまたはワンタイムサインインコードを貼り付けてください。",
+  "den.error_signin_failed": "OpenWork Cloudサインインを完了できませんでした。",
+  "den.error_worker_not_ready": "ワーカーはまだ開ける状態ではありません。プロビジョニング完了後に再試行してください。",
+  "den.finish_signin": "サインインを完了",
+  "den.finishing": "完了中…",
+  "den.hide_signin_code": "サインインコードを隠す",
+  "den.import_all": "すべてインポート",
+  "den.import_provider": "インポート",
+  "den.import_provider_failed": "{name}のインポートに失敗しました。",
+  "den.imported_badge": "インポート済み",
+  "den.imported_provider": "{name}をインポートしました。",
+  "den.importing": "インポート中…",
+  "den.needs_attention": "要確認",
+  "den.no_cloud_providers": "この組織にはまだクラウドプロバイダーがありません。",
+  "den.no_cloud_workers": "この組織にはまだクラウドワーカーがありません。Cloudで作成してから、このタブを更新してください。",
+  "den.no_org_selected": "組織が選択されていません",
+  "den.no_skill_hubs": "この組織にはまだクラウドスキルハブがありません。",
+  "den.open": "開く",
+  "den.opening": "開いています…",
+  "den.org_member_suffix": "（メンバー）",
+  "den.org_owner_suffix": "（オーナー）",
+  "den.org_switched": "{name}に切り替えました。",
+  "den.out_of_sync_badge": "同期が必要",
+  "den.paste_signin_code": "サインインコードを貼り付け",
+  "den.refresh": "更新",
+  "den.reload_workspace": "設定変更を適用するにはワークスペースをリロードしてください。",
+  "den.remove_provider_failed": "{name}の削除に失敗しました。",
+  "den.removed_from_cloud_badge": "クラウドから削除済み",
+  "den.removed_provider": "{name}を削除しました。",
+  "den.removing": "削除中…",
+  "den.sign_out": "サインアウト",
+  "den.signed_out": "サインアウト済み",
+  "den.signin_button": "サインイン",
+  "den.signin_code_note": "openwork://den-authリンクまたは生のワンタイムコードを受け付けます。",
+  "den.signin_link_hint": "ブラウザが自動的にOpenWorkに戻らない場合は、OpenWork Cloudのサインインリンクまたはワンタイムコードをここに貼り付けてください。",
+  "den.signin_link_label": "サインインリンクまたはワンタイムコード",
+  "den.signin_link_placeholder": "openwork://den-auth?... またはコードを貼り付け",
+  "den.signin_title": "OpenWork Cloudにサインイン",
+  "den.signing_in": "OpenWork Cloudサインインを完了中…",
+  "den.signing_out": "サインアウト中…",
+  "den.skill_hub_detail": "{count}件の共有スキルを.opencode/skillsにインポートします。",
+  "den.skill_hub_imported_detail": "このワークスペースに{count}件のスキルをインポートしました。",
+  "den.skill_hub_removed_detail": "このハブはクラウドから削除されました。このワークスペースの{importedCount}件のインポート済みスキルをアンインストールしてください。",
+  "den.skill_hub_skills_badge": "{count}件のスキル",
+  "den.skill_hub_sync_detail": "クラウドに{liveCount}件のスキルがあり、このワークスペースは{importedCount}件をインポート済みです。同期してインストール済みセットを更新してください。",
+  "den.skill_hubs_hint": "共有クラウドハブからすべてのスキルをこのワークスペースに一括インポートします。",
+  "den.skill_hubs_title": "スキルハブ",
+  "den.status_base_url_updated": "Cloudコントロールプレーン URLを更新しました。続行するには再度サインインしてください。",
+  "den.status_browser_signin": "ブラウザでサインインを完了してOpenWorkに接続してください。",
+  "den.status_browser_signup": "ブラウザでアカウント作成を完了してOpenWorkに接続してください。",
+  "den.status_cloud_signed_in_as": "OpenWork Cloudに{email}として接続しました。",
+  "den.status_cloud_signin_done": "OpenWork Cloudに接続しました。",
+  "den.status_loaded_orgs": "{count}件の組織を読み込みました。",
+  "den.status_loaded_workers": "{name}の{count}件のワーカーを読み込みました。",
+  "den.status_no_workers": "{name}にワーカーが見つかりません。",
+  "den.status_opened_worker": "OpenWorkで{name}を開きました。",
+  "den.status_signed_in_as": "{email}としてサインインしました。",
+  "den.status_signed_out": "サインアウトし、このデバイスのOpenWork Cloudセッションを削除しました。",
+  "den.sync": "同期",
+  "den.sync_provider_failed": "{name}の同期に失敗しました。",
+  "den.synced_provider": "{name}を同期しました。",
+  "den.syncing": "同期中…",
+  "den.uninstall": "アンインストール",
+  "den.worker_mine_badge": "自分",
+  "den.worker_not_ready_title": "このワーカーはまだ開ける状態ではありません。",
+  "den.worker_provider_label": "{provider}ワーカー",
+  "den.worker_secondary_cloud": "クラウドワーカー",
+  "extensions.app_count": "{count}件のアプリ接続済み",
+  "extensions.apps_mcp_header": "アプリ（MCP）",
+  "extensions.filter_all": "すべて",
+  "extensions.filter_apps": "アプリ",
+  "extensions.filter_plugins": "プラグイン",
+  "extensions.plugin_count": "{count}件のプラグイン",
+  "extensions.plugins_opencode_header": "プラグイン（OpenCode）",
+  "extensions.subtitle": "アプリ（MCP）とOpenCodeプラグインをまとめて管理できます。",
+  "extensions.title": "拡張機能",
+  "identities.agent_behavior_desc": "ワークスペースごとに1ファイルです。先頭行に@agent <id>を追加すると特定のOpenCodeエージェント経由でルーティングされます。",
+  "identities.agent_behavior_title": "メッセージングエージェントの動作",
+  "identities.agent_created": "デフォルトのメッセージングエージェントファイルを作成しました。",
+  "identities.agent_file_changed": "ファイルがリモートで変更されました。リロードして再度保存してください。",
+  "identities.agent_loading": "エージェントファイルを読み込み中…",
+  "identities.agent_none": "なし",
+  "identities.agent_not_found": "このワークスペースにエージェントファイルがまだありません。",
+  "identities.agent_saved": "メッセージング動作を保存しました。",
+  "identities.agent_scope_status": "アクティブスコープ: ワークスペース · ステータス: {status} · 選択エージェント: {agent}",
+  "identities.agent_status_loaded": "読み込み済み",
+  "identities.agent_status_missing": "未設定",
+  "identities.agent_worker_scope_unavailable": "ワーカースコープが利用できません。",
+  "identities.all_channels": "すべてのチャンネル",
+  "identities.app_token_label": "アプリトークン",
+  "identities.auto_bind_label": "ダイレクト送信時にピアをディレクトリに自動バインド",
+  "identities.available_channels": "利用可能なチャンネル",
+  "identities.bot_token_label": "ボットトークン",
+  "identities.bot_token_placeholder": "@BotFatherからTelegramボットトークンを貼り付け",
+  "identities.botfather_step1_open": "1. Telegramで@BotFatherを開く",
+  "identities.botfather_step1_run": "/newbotを実行",
+  "identities.botfather_step3_choose": "3. ボットの名前とユーザー名を選択",
+  "identities.botfather_step3_or_private": "でオープン受信箱にするか",
+  "identities.botfather_step3_private": "プライベート",
+  "identities.botfather_step3_public": "パブリック",
+  "identities.botfather_step3_to_require": "にしてペアリングコードを要求",
+  "identities.channel_label": "チャンネル",
+  "identities.channels_connected": "接続済み",
+  "identities.channels_label": "チャンネル",
+  "identities.configured_suffix": "設定済み",
+  "identities.connect_server_desc": "OpenWorkホストに接続されている場合、アイデンティティが利用可能になります。",
+  "identities.connect_server_title": "OpenWorkサーバーに接続",
+  "identities.connect_slack": "Slackに接続",
+  "identities.connected_badge": "接続済み",
+  "identities.connecting": "接続中…",
+  "identities.copy_bot_token_hint": "ボットトークンをコピーして下に貼り付けてください。",
+  "identities.copy_code": "コードをコピー",
+  "identities.create_default_file": "デフォルトファイルを作成",
+  "identities.create_private_bot": "プライベートボットを作成",
+  "identities.create_public_bot": "パブリックボットを作成",
+  "identities.days_ago": "{days}日前",
+  "identities.default_routing": "デフォルトルーティング",
+  "identities.directory_label": "ディレクトリ（任意）",
+  "identities.disable_messaging": "メッセージングを無効化",
+  "identities.disable_messaging_message": "このワークスペースのメッセージングをオフにします。メッセージングを再度有効にするまでTelegramとSlackの設定は非表示になり、メッセージングサイドカーを完全に停止するにはワーカーの再起動が必要です。",
+  "identities.disable_messaging_title": "このワーカーのメッセージングを無効にしますか？",
+  "identities.disabled_label": "無効",
+  "identities.disabling": "無効化中…",
+  "identities.disconnect": "切断",
+  "identities.dispatched_messages": "{sent}/{attempted}件のメッセージを送信しました。",
+  "identities.enable_messaging": "メッセージングを有効化",
+  "identities.enable_messaging_risk": "メッセージングを有効にすると、このワーカーがリモートコマンドにさらされる可能性があります。ボットがパブリックまたは侵害された場合、このワーカーがアクセスできるファイル、認証情報、APIキーにアクセスされる恐れがあります。",
+  "identities.enable_messaging_title": "このワーカーのメッセージングを有効にしますか？",
+  "identities.enabled_label": "有効",
+  "identities.enabling": "有効化中…",
+  "identities.health_offline": "オフライン",
+  "identities.health_running": "実行中",
+  "identities.health_unavailable": "利用不可",
+  "identities.health_unknown": "不明",
+  "identities.hours_ago": "{hours}時間前",
+  "identities.identities_label": "アイデンティティ",
+  "identities.just_now": "たった今",
+  "identities.last_activity": "最終アクティビティ",
+  "identities.later": "後で",
+  "identities.message_label": "メッセージ",
+  "identities.message_routing_desc": "どの会話をどのワークスペースフォルダに送るかを制御します。ここでルールを設定しない限り、メッセージはワーカーのデフォルトフォルダにルーティングされます。",
+  "identities.message_routing_title": "メッセージルーティング",
+  "identities.messages_today": "今日のメッセージ",
+  "identities.messaging_disabled_hint": "リスクを理解し、アクセスを保護する予定がある場合のみメッセージングを有効にしてください（例: Telegramプライベートペアリング）。",
+  "identities.messaging_disabled_restart": "メッセージングが無効です。メッセージングサイドカーを停止するにはこのワーカーを再起動してください。",
+  "identities.messaging_disabled_risk": "メッセージングボットはローカルワーカーに対してアクションを実行できます。パブリックに公開された場合、このワーカーがアクセスできるファイル、認証情報、APIキーへのアクセスが可能になる恐れがあります。",
+  "identities.messaging_disabled_title": "メッセージングはデフォルトで無効です",
+  "identities.messaging_enabled_restart": "メッセージングが有効です。メッセージングサイドカーを起動してTelegramとSlackのセットアップを行うには、このワーカーを再起動してください。",
+  "identities.messaging_sidecar_not_running": "このワークスペースでメッセージングは有効ですが、メッセージングサイドカーがまだ実行されていません。このワーカーを再起動してから、メッセージング設定に戻ってTelegramまたはSlackに接続してください。",
+  "identities.minutes_ago": "{minutes}分前",
+  "identities.not_set": "未設定",
+  "identities.open_bot_link": "Telegramで@{username}を開く",
+  "identities.pairing_code_copied": "ペアリングコードをコピーしました。",
+  "identities.pairing_code_copy_failed": "ペアリングコードをコピーできませんでした。手動でコピーしてください。",
+  "identities.pairing_code_instruction_prefix": "送信",
+  "identities.peer_id_label": "ピアID（任意）",
+  "identities.peer_id_placeholder_slack": "例: slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "例: telegram:123456789",
+  "identities.private_label": "プライベート",
+  "identities.private_pairing_code": "プライベートペアリングコード",
+  "identities.public_bot_confirm": "リスクを理解しました",
+  "identities.public_bot_warning_message": "ボットがパブリックになり、アクセスした人がローカルワーカーに完全アクセスできるようになります。ファイルやAPIキーも含まれます。プライベートボットを作成するとペアリングトークンでアクセスを制限できます。本当にパブリックにしますか？",
+  "identities.public_bot_warning_title": "このボットをパブリックにしますか？",
+  "identities.public_label": "パブリック",
+  "identities.quick_setup": "クイックセットアップ",
+  "identities.reconnect_failed": "再接続に失敗しました。OpenWork URL/トークンを確認して再試行してください。",
+  "identities.reconnected": "再接続しました。",
+  "identities.reconnected_refreshing": "再接続しました。ワーカーの状態を更新中…",
+  "identities.reload": "リロード",
+  "identities.repair_reconnect": "修復して再接続",
+  "identities.restart_failed": "再起動に失敗しました。設定からワーカーを再起動して再試行してください。",
+  "identities.restart_to_disable_messaging": "このワークスペースのメッセージングが無効になりました。メッセージングサイドカーを停止するにはワーカーを今すぐ再起動してください。",
+  "identities.restart_to_enable_messaging": "このワークスペースのメッセージングが有効になりました。メッセージングサイドカーを起動してTelegramとSlackのセットアップを行うには、ワーカーを今すぐ再起動してください。",
+  "identities.restart_worker": "ワーカーを再起動",
+  "identities.restart_worker_title": "ワーカーを今すぐ再起動しますか？",
+  "identities.restarting": "再起動中…",
+  "identities.routing_override_prefix": "すべてのメッセージの転送先:",
+  "identities.routing_override_suffix": "（オーバーライド有効）",
+  "identities.running_label": "実行中",
+  "identities.save_behavior": "動作を保存",
+  "identities.saving": "保存中…",
+  "identities.send_test_button": "テストメッセージを送信",
+  "identities.send_test_desc": "送信経路を検証します。ダイレクト送信にはピアIDを使用するか、ディレクトリ内のバインディングでファンアウトするにはピアIDを空にしてください。",
+  "identities.send_test_title": "テストメッセージを送信",
+  "identities.sending": "送信中…",
+  "identities.slack_desc": "ワーカーがSlackチャンネルでボットとして表示されます。チームメンバーがダイレクトメッセージやスレッドで操作できます。",
+  "identities.slack_intro": "Slackワークスペースに接続して、チームメンバーがチャンネルやDMでこのワーカーとやり取りできるようにします。",
+  "identities.slack_unavailable": "Slackアイデンティティが利用できません。",
+  "identities.status_active": "アクティブ",
+  "identities.status_label": "ステータス",
+  "identities.status_stopped": "停止",
+  "identities.stopped_label": "停止",
+  "identities.subtitle": "メッセージングアプリを通じてワーカーにアクセスできるようにします。チャンネルを接続すると、ワーカーが自動的にメッセージを読み取り応答します。",
+  "identities.tab_general": "一般",
+  "identities.telegram_bot_access_desc": "パブリックボット: 最初のTelegramチャットが自動リンクされます。プライベートボット: ツールの実行前にペアリングコードが必要です。",
+  "identities.telegram_delete_failed": "削除に失敗しました。",
+  "identities.telegram_deleted": "削除しました。",
+  "identities.telegram_deleted_pending": "削除済み（適用待ち）。",
+  "identities.telegram_desc": "Telegramボットをパブリックモード（オープン受信箱）またはプライベートモード（ペアリングコード必須）で接続します。",
+  "identities.telegram_private_saved_pair": "プライベートボットを保存しました。/pair {code}でペアリングしてください",
+  "identities.telegram_save_failed": "保存に失敗しました。",
+  "identities.telegram_saved": "保存しました。",
+  "identities.telegram_saved_pending": "保存済み（適用待ち）。",
+  "identities.telegram_saved_username": "保存しました（@{username}）",
+  "identities.telegram_unavailable": "Telegramアイデンティティが利用できません。",
+  "identities.title": "メッセージングチャンネル",
+  "identities.unsaved_changes": "未保存の変更",
+  "identities.worker_offline": "ワーカーオフライン",
+  "identities.worker_online": "ワーカーオンライン",
+  "identities.worker_restarted": "ワーカーを再起動しました。",
+  "identities.worker_restarted_refreshing": "ワーカーを再起動しました。メッセージングステータスを更新中…",
+  "identities.worker_scope_unavailable": "ワーカースコープが利用できません。",
+  "identities.worker_scope_unavailable_detail": "ワーカースコープが利用できません。ワーカーURLで再接続するか、既知のワーカーに切り替えてください。",
+  "identities.worker_unavailable": "ワーカーが利用できません",
+  "identities.workspace_id_required": "アイデンティティを管理するにはワークスペースIDが必要です。ワークスペースURLで再接続するか、このホストにマッピングされたワークスペースを選択してください。",
+  "identities.workspace_scope_prefix": "ワークスペーススコープ:",
+  "mcp.add_modal_subtitle": "URLまたはローカルコマンドでカスタムMCPサーバーを接続します。",
+  "mcp.add_modal_title": "カスタムアプリを追加",
+  "mcp.add_server_button": "アプリを追加",
+  "mcp.advanced": "詳細",
+  "mcp.advanced_settings": "詳細設定",
+  "mcp.advanced_settings_hint": "設定ファイルを編集し、接続を手動で管理します。",
+  "mcp.app_connected": "アプリ接続済み",
+  "mcp.apps_connected": "アプリ接続済み",
+  "mcp.apps_subtitle": "ツールを接続して、OpenWorkが代わりに操作できるようにしましょう。",
+  "mcp.apps_title": "アプリ",
+  "mcp.auth.already_connected": "既に接続済み",
+  "mcp.auth.already_connected_description": "{server} は既に認証済みで、使用する準備ができています。",
+  "mcp.auth.applying_changes_body": "新しいMCPが認証できるようにワーカーを再起動しています。",
+  "mcp.auth.applying_changes_title": "サインイン前に変更を適用中",
+  "mcp.auth.authorization_link": "認証リンク",
+  "mcp.auth.authorization_still_required": "承認がまだ必要です。フローを再開するには再試行してください。",
+  "mcp.auth.callback_invalid": "OAuthを完了するにはコールバックURLまたはcodeパラメータを貼り付けてください。",
+  "mcp.auth.callback_label": "コールバックURLまたはコード",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "キャンセル",
+  "mcp.auth.client_registration_required": "OAuthを続行する前にクライアント登録が必要です。",
+  "mcp.auth.complete_connection": "接続を完了",
+  "mcp.auth.configured_previously": "MCPはグローバルまたは前のセッションで設定されている可能性があります。この画面を閉じて、すぐにMCPツールの使用を開始できます。",
+  "mcp.auth.connect_server": "{server} に接続",
+  "mcp.auth.copied": "コピー済み",
+  "mcp.auth.copy_link": "リンクをコピー",
+  "mcp.auth.done": "完了",
+  "mcp.auth.failed_to_start_oauth": "OAuthフローの開始に失敗しました",
+  "mcp.auth.follow_browser_steps": "ブラウザで承認手順に従ってください。",
+  "mcp.auth.force_stop": "強制停止",
+  "mcp.auth.force_stopping": "停止中…",
+  "mcp.auth.im_done": "完了しました",
+  "mcp.auth.invalid_refresh_token": "OAuthリフレッシュトークンが無効または期限切れです。続行するには再承認してください。",
+  "mcp.auth.manual_finish_hint": "コールバックURL（localhost:19876）またはコードだけを貼り付けて接続を完了してください。",
+  "mcp.auth.manual_finish_title": "リモートサーバーですか？",
+  "mcp.auth.oauth_completed_reload": "OAuthが完了しました。MCPを有効化するにはエンジンをリロードしてください。",
+  "mcp.auth.oauth_failed": "OAuth認証に失敗しました。",
+  "mcp.auth.oauth_not_supported_hint": "考えられる原因:\n• MCPサーバーがOAuth機能を公開していません\n• エンジンをリロードしてサーバー機能を検出する必要があります\n• 試してみてください: opencode mcp auth {server}（CLIから）",
+  "mcp.auth.open_browser_signin": "ブラウザを開いてサインインを完了します。",
+  "mcp.auth.port_forward_hint": "ヒント: 必要に応じてコールバックポートを転送してください: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "OAuthを再承認",
+  "mcp.auth.reauth_cli_hint": "実行: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "再承認に失敗しました。",
+  "mcp.auth.reauth_remote_hint": "このワーカーを実行しているマシンから再承認してください。",
+  "mcp.auth.reauth_running": "再承認中…",
+  "mcp.auth.reload_blocked": "セッション実行中はリロードが一時停止されます。セットアップを完了するには実行を停止してください。",
+  "mcp.auth.reload_engine_retry": "変更を適用して再試行",
+  "mcp.auth.reload_failed": "サインイン前にワーカーのリロードに失敗しました。",
+  "mcp.auth.reload_notice": "この変更を反映するには、OpenWorkがワーカーサービスを更新する必要があります。実行中のセッションが中断される可能性があります。",
+  "mcp.auth.reload_remote_confirm": "この変更を反映するには、OpenWorkがワーカーサービスを更新する必要があります。実行中のセッションが停止する可能性があります。続行しますか？",
+  "mcp.auth.reopen_browser_link": "ここをクリックしてブラウザを再度開く",
+  "mcp.auth.request_timed_out": "リクエストがタイムアウトしました。",
+  "mcp.auth.retry": "再試行",
+  "mcp.auth.retry_now": "今すぐ再試行",
+  "mcp.auth.server_disabled": "このMCPサーバーは無効です。有効にしてから再試行してください。",
+  "mcp.auth.step1_description": "{server} のサインインフローを自動的に起動します。",
+  "mcp.auth.step1_title": "ブラウザを開いています",
+  "mcp.auth.step2_description": "サインインしてプロンプトが表示されたらアクセスを承認してください。",
+  "mcp.auth.step2_title": "OpenWorkを承認",
+  "mcp.auth.step3_description": "承認が完了次第、接続を完了します。",
+  "mcp.auth.step3_title": "完了したらここに戻ってください",
+  "mcp.auth.try_reload_engine": "{message}。まずエンジンのリロードを試してください。",
+  "mcp.auth.waiting_authorization": "ブラウザでの承認完了を待っています…",
+  "mcp.auth.waiting_for_conversation_body": "できるだけ早く認証画面にリダイレクトします。",
+  "mcp.auth.waiting_for_conversation_title": "会話の完了を待っています",
+  "mcp.auth.waiting_for_session": "{session} の作業完了を待っています",
+  "mcp.available_apps": "利用可能なアプリ",
+  "mcp.cap_signin": "アカウントサインイン",
+  "mcp.cap_tools": "AIツール",
+  "mcp.config_file": "設定ファイル",
+  "mcp.config_load_failed": "設定ファイルを読み込めませんでした",
+  "mcp.config_not_loaded": "まだ読み込まれていません",
+  "mcp.connect": "接続",
+  "mcp.connect_failed": "接続できませんでした。再試行してください。",
+  "mcp.connect_server_first": "先にサーバーに接続してください。",
+  "mcp.connected": "接続済み",
+  "mcp.connected_badge": "接続済み",
+  "mcp.connection_failed": "接続の問題 — 再試行してください",
+  "mcp.connection_type": "接続",
+  "mcp.control_chrome_browser_hint": "Chrome 144以降では、まず次の手順を実行してください:",
+  "mcp.control_chrome_browser_step_one": "chrome://inspect/#remote-debuggingを開く。",
+  "mcp.control_chrome_browser_step_two": "リモートデバッグを有効にする。",
+  "mcp.control_chrome_browser_step_three": "Chromeが求めたらデバッグ接続を許可する。",
+  "mcp.control_chrome_browser_title": "1. Chromeアクセスを有効にする",
+  "mcp.control_chrome_connect": "Control Chromeを追加",
+  "mcp.control_chrome_docs": "公式MCPガイド",
+  "mcp.control_chrome_edit": "設定を編集",
+  "mcp.control_chrome_profile_hint": "Control Chromeは通常、別のChromeプロファイルを開きます。すでに開いているChromeウィンドウをOpenWorkで再利用したい場合はこれをオンにしてください。",
+  "mcp.control_chrome_profile_title": "2. 使用するChromeを選択",
+  "mcp.control_chrome_save": "設定を保存",
+  "mcp.control_chrome_setup_subtitle": "Chromeアクセスを有効にし、OpenWorkが独自のクリーンプロファイルを使うか、すでに使用しているChromeに接続するかを選択します。",
+  "mcp.control_chrome_setup_title": "Control Chromeのセットアップ",
+  "mcp.control_chrome_toggle_hint": "オンにすると、OpenWorkが--autoConnectを追加し、すでに起動しているChromeインスタンスにMCPが接続します。",
+  "mcp.control_chrome_toggle_label": "既存のChromeプロファイルを使用",
+  "mcp.control_chrome_toggle_off": "OpenWorkは自動化専用の別のChromeプロファイルを起動します。",
+  "mcp.control_chrome_toggle_on": "OpenWorkは現在のタブ、Cookie、サインイン情報を再利用します。",
+  "mcp.custom_app_cta_hint": "独自のMCPサーバー、社内ツール、またはホスト型アプリを接続します。",
+  "mcp.desktop_required": "アプリにはデスクトップアプリが必要です。",
+  "mcp.docs_link": "詳細を見る",
+  "mcp.file_not_found": "設定ファイルがまだ作成されていません",
+  "mcp.friendly_status_issue": "問題",
+  "mcp.friendly_status_needs_signin": "サインインが必要",
+  "mcp.friendly_status_offline": "オフライン",
+  "mcp.friendly_status_paused": "一時停止中",
+  "mcp.friendly_status_ready": "準備完了",
+  "mcp.last_synced": "同期済み",
+  "mcp.login_action": "サインイン",
+  "mcp.login_hint": "アカウントを接続してこのアプリのセットアップを完了してください。",
+  "mcp.login_unavailable": "このアプリはOpenWorkからのサインインに対応していません。",
+  "mcp.logout_action": "ログアウト",
+  "mcp.logout_failed": "ログアウトに失敗しました。",
+  "mcp.logout_hint": "保存されたOAuth認証情報を削除します。再度サインインが必要になります。",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "{server} の保存されたOAuth認証情報が削除されます。このアプリを使用するには再度サインインが必要です。",
+  "mcp.logout_modal_title": "このアプリからログアウトしますか？",
+  "mcp.logout_success": "{server} からログアウトしました。",
+  "mcp.logout_working": "ログアウト中…",
+  "mcp.name_required": "サーバー名を入力してください。",
+  "mcp.no_apps_hint": "上のアプリを接続して始めましょう。",
+  "mcp.no_apps_yet": "まだアプリが接続されていません",
+  "mcp.oauth": "サインイン",
+  "mcp.oauth_optional_hint": "ブラウザでOAuthを使ってアカウントに接続します。",
+  "mcp.oauth_optional_label": "このアプリはサインインが必要です",
+  "mcp.one_click_connect": "ワンクリック接続",
+  "mcp.open_file": "ファイルを開く",
+  "mcp.opening_label": "開いています…",
+  "mcp.pick_workspace_error": "最初にワークスペースフォルダを選択してください。",
+  "mcp.pick_workspace_first": "最初にワークスペースフォルダを選択してください。",
+  "mcp.quick_connect_chrome_desc": "ブラウザ自動化でChromeタブを操作。",
+  "mcp.quick_connect_chrome_title": "Chromeを操作",
+  "mcp.quick_connect_context7_desc": "より豊富なコンテキストで製品ドキュメントを検索。",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "スプリントを計画し、チケットをより速く処理。",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "ページ、データベース、プロジェクトドキュメントを同期。",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "リリースを追跡し、本番エラーを解決。",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "支払い、請求書、サブスクリプションを確認。",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "実行中のタスクを停止して有効化してください。",
+  "mcp.remote_workspace_url_hint": "リモートワーカーはURLベースのMCPサーバーとの接続が最も速いです。",
+  "mcp.remove_app": "削除",
+  "mcp.remove_failed": "アプリを削除できませんでした。",
+  "mcp.remove_modal_message": "{server} を削除してもよろしいですか？後で再度追加できます。",
+  "mcp.remove_modal_title": "アプリを削除",
+  "mcp.reveal_config_failed": "設定ファイルを開けませんでした",
+  "mcp.reveal_in_finder": "Finderで表示",
+  "mcp.scope_global": "すべてのワークスペース",
+  "mcp.scope_project": "このワークスペース",
+  "mcp.server_command": "コマンド",
+  "mcp.server_command_hint": "サーバーを起動するシェルコマンド。",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "アプリ名",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "タイプ",
+  "mcp.server_url": "サーバーURL",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "サインイン",
+  "mcp.tap_to_connect": "タップして接続",
+  "mcp.technical_details": "技術的な詳細",
+  "mcp.type_cloud": "クラウド（アカウントでサインイン）",
+  "mcp.type_local": "ローカル（このデバイスで実行）",
+  "mcp.type_local_cmd": "ローカル（コマンド）",
+  "mcp.type_remote": "リモート（URL）",
+  "mcp.url_or_command_required": "リモートの場合はURL、ローカルの場合はコマンドを入力してください。",
+  "mcp.your_apps": "接続済みアプリ",
+  "model_behavior.desc_builtin": "このモデルは独自の推論パスを決定し、ここではプロファイルを公開しません。",
+  "model_behavior.desc_generic": "{label}プロファイルを使用します。",
+  "model_behavior.desc_high": "回答前により多くの時間をかけて推論します。",
+  "model_behavior.desc_high_anthropic": "標準の拡張シンキングバジェットを使用します。",
+  "model_behavior.desc_low": "回答前に軽めの推論パスを実行します。",
+  "model_behavior.desc_low_google": "より軽い推論バジェットで素早く応答します。",
+  "model_behavior.desc_max": "プロバイダーの最も深い推論プロファイルを使用します。",
+  "model_behavior.desc_max_anthropic": "利用可能な最大の拡張シンキングバジェットを使用します。",
+  "model_behavior.desc_medium": "速度と推論の深さをバランスします。",
+  "model_behavior.desc_minimal": "ごく少量の推論を使用します。",
+  "model_behavior.desc_none": "最軽量の推論パスで速度を優先します。",
+  "model_behavior.desc_standard": "このモデルは追加の推論コントロールを公開していません。",
+  "model_behavior.label_balanced": "バランス",
+  "model_behavior.label_builtin": "ビルトイン",
+  "model_behavior.label_deep": "ディープ",
+  "model_behavior.label_extended": "拡張",
+  "model_behavior.label_fast": "高速",
+  "model_behavior.label_light": "ライト",
+  "model_behavior.label_maximum": "最大",
+  "model_behavior.label_quick": "クイック",
+  "model_behavior.label_standard": "スタンダード",
+  "model_behavior.title_builtin_reasoning": "組み込み推論",
+  "model_behavior.title_extended_thinking": "拡張シンキング",
+  "model_behavior.title_reasoning_budget": "推論バジェット",
+  "model_behavior.title_reasoning_effort": "推論エフォート",
+  "model_behavior.title_standard_generation": "標準生成",
+  "model_picker.chat_model_desc": "このチャットのモデルを選択します。モデルが推論プロファイルをサポートしている場合は、カードで設定します。",
+  "model_picker.chat_model_title": "チャットモデル",
+  "model_picker.connect_provider_hint": "このプロバイダーに接続してモデルを閲覧・保存",
+  "model_picker.default_model_desc": "新しいチャットのデフォルトモデルを選択し、その後、カードで推論プロファイルを微調整してから「完了」を押します。",
+  "model_picker.default_model_title": "デフォルトモデル",
+  "model_picker.model_count": "{count}件のモデル",
+  "model_picker.more_providers": "さらにプロバイダー",
+  "model_picker.no_results": "検索に一致するモデルがありません。",
+  "model_picker.other_connected_models": "その他の接続済みモデル",
+  "model_picker.recommended": "おすすめ",
+  "onboarding.authorize_folder": "フォルダを承認",
+  "plugins.add": "追加",
+  "plugins.add_hint": "npmパッケージ名を追加してください（例: opencode-wakatime）",
+  "plugins.add_label": "プラグインを追加",
+  "plugins.added": "追加済み",
+  "plugins.config": "設定",
+  "plugins.config_label": "設定",
+  "plugins.desc": "プロジェクトまたはグローバルのOpenCodeプラグインの`opencode.json`を管理します。",
+  "plugins.empty": "まだプラグインが設定されていません。",
+  "plugins.enabled": "有効",
+  "plugins.hide_setup": "セットアップを隠す",
+  "plugins.not_loaded": "まだ読み込まれていません",
+  "plugins.not_loaded_yet": "まだ読み込まれていません",
+  "plugins.remove": "削除",
+  "plugins.scope_global": "グローバル",
+  "plugins.scope_project": "プロジェクト",
+  "plugins.setup": "セットアップ",
+  "plugins.suggested": "おすすめのプラグイン",
+  "plugins.suggested_heading": "おすすめプラグイン",
+  "plugins.title": "OpenCodeプラグイン",
+  "providers.api_key_label": "APIキー",
+  "providers.api_key_required": "APIキーが必要です",
+  "providers.auth_failed": "認証に失敗しました",
+  "providers.connect_failed": "プロバイダーの接続に失敗しました",
+  "providers.disabled_in_config_suffix": "、OpenCode設定で無効にしました。",
+  "providers.disconnect_failed": "プロバイダーの切断に失敗しました",
+  "providers.disconnected_prefix": "切断済み",
+  "providers.load_failed": "プロバイダーの読み込みに失敗しました",
+  "providers.no_oauth_prefix": "OAuthフローがありません:",
+  "providers.no_providers_available": "利用可能なプロバイダーがありません",
+  "providers.not_connected": "サーバーに接続されていません",
+  "providers.not_oauth_flow_prefix": "選択された認証方法はOAuthフローではありません:",
+  "providers.oauth_failed": "OAuthの完了に失敗しました",
+  "providers.oauth_method_required": "OAuthメソッドが必要です",
+  "providers.provider_error": "プロバイダーエラー（{provider}）",
+  "providers.provider_id_required": "プロバイダーIDが必要です",
+  "providers.rate_limit_exceeded": "レートリミットを超過しました",
+  "providers.removal_unsupported": "プロバイダー認証の削除はこのクライアントではサポートされていません。",
+  "providers.request_failed": "リクエストに失敗しました",
+  "providers.save_api_key_failed": "APIキーの保存に失敗しました",
+  "providers.still_connected_suffix": "、ワーカーはまだ接続済みと報告しています。残存するAPIキーまたはOAuth認証情報をクリアし、ワーカーを再起動して完全に切断してください。",
+  "providers.unknown_provider": "不明なプロバイダー",
+  "providers.use_api_key_suffix": "代わりにAPIキーを使用してください。",
+  "question_modal.custom_answer_label": "またはカスタム回答を入力",
+  "question_modal.custom_answer_placeholder": "ここに回答を入力…",
+  "question_modal.question_counter": "質問{current}/{total}",
+  "session.allow_for_session": "セッション中許可",
+  "session.allow_once": "一度だけ許可",
+  "session.cmd_current_workspace": "現在のワークスペース",
+  "session.cmd_new_session_detail": "現在のワークスペースで新しいタスクを開始",
+  "session.cmd_new_session_meta": "作成",
+  "session.cmd_new_session_title": "新規セッションを作成",
+  "session.cmd_sessions_detail": "ワークスペース全体で{count}件利用可能",
+  "session.cmd_sessions_meta": "移動",
+  "session.cmd_sessions_title": "セッションを検索",
+  "session.cmd_switch": "切り替え",
+  "session.create_or_connect_workspace": "ワークスペースを作成または接続",
+  "session.default_agent": "デフォルトエージェント",
+  "session.default_title": "新規セッション",
+  "session.delete": "削除",
+  "session.delete_named_session_message": "「{title}」とそのメッセージを完全に削除します。",
+  "session.delete_session_generic": "選択したセッションとそのメッセージを完全に削除します。",
+  "session.delete_session_title": "セッションを削除しますか？",
+  "session.deleting": "削除中…",
+  "session.deny": "拒否",
+  "session.details": "詳細",
+  "session.details_label": "詳細",
+  "session.doom_loop_label": "ドゥームループ",
+  "session.doom_loop_message": "OpenCodeが同一入力でのツール呼び出しの繰り返しを検出しました。繰り返し失敗した後、続行するか確認しています。",
+  "session.doom_loop_note": "ループを停止するには拒否、エージェントに再試行させるには許可を選択してください。",
+  "session.doom_loop_repeated_call_label": "繰り返しの呼び出し",
+  "session.doom_loop_repeated_tool_call": "繰り返しのツール呼び出し",
+  "session.doom_loop_title": "ドゥームループを検出",
+  "session.doom_loop_tool_label": "ツール",
+  "session.export_already_running": "エクスポートは既に実行中です。",
+  "session.export_desktop_only": "エクスポートはデスクトップアプリで利用可能です。",
+  "session.export_desktop_only_local": "エクスポートはデスクトップアプリのローカルワーカーで利用可能です。",
+  "session.export_local_only": "エクスポートはローカルワーカーでのみサポートされています。",
+  "session.loading_detail": "このタスクの最新メッセージを取得しています。",
+  "session.model": "モデル",
+  "session.new_task": "新しいタスク",
+  "session.open": "開く",
+  "session.palette_hint_navigate": "矢印キーで移動",
+  "session.palette_hint_run": "Enterで実行 · Escで閉じる",
+  "session.palette_placeholder_actions": "アクションを検索",
+  "session.palette_placeholder_sessions": "セッション名またはワークスペースで検索",
+  "session.palette_title_actions": "クイックアクション",
+  "session.palette_title_sessions": "セッションを検索",
+  "session.permission_label": "権限",
+  "session.permission_detail_command": "コマンド",
+  "session.permission_detail_cwd": "作業ディレクトリ",
+  "session.permission_detail_description": "説明",
+  "session.permission_detail_diff": "差分",
+  "session.permission_detail_file": "ファイル",
+  "session.permission_detail_files": "ファイル",
+  "session.permission_detail_agent": "エージェント",
+  "session.permission_detail_parent_directory": "親ディレクトリ",
+  "session.permission_detail_path": "パス",
+  "session.permission_detail_query": "クエリ",
+  "session.permission_detail_target": "対象",
+  "session.permission_detail_tool": "ツール",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "ファイル編集",
+  "session.permission_kind_external_directory": "外部ディレクトリ",
+  "session.permission_kind_question": "質問",
+  "session.permission_kind_read": "ファイル読み取り",
+  "session.permission_kind_skill": "スキル",
+  "session.permission_kind_task": "サブタスク",
+  "session.permission_kind_todowrite": "Todo書き込み",
+  "session.permission_message": "OpenCodeが続行するために許可を求めています。",
+  "session.permission_message_bash": "OpenCodeの続行を許可する前に、コマンドのスコープを確認してください。",
+  "session.permission_message_edit": "OpenCodeに変更を許可する前に、ファイルと差分を確認してください。",
+  "session.permission_message_external_directory": "ワークスペース外へのアクセスを許可する前に、フォルダを確認してください。",
+  "session.permission_message_read": "アクセスを許可する前に、要求されたファイルスコープを確認してください。",
+  "session.permission_message_task": "開始を許可する前に、要求されたサブタスクを確認してください。",
+  "session.permission_metadata_unavailable": "メタデータを表示できませんでした。",
+  "session.permission_review_label": "確認",
+  "session.permission_scope_empty": "具体的なスコープはありません。",
+  "session.permission_title_bash": "シェルコマンドを実行しますか？",
+  "session.permission_title_edit": "ファイルを変更しますか？",
+  "session.permission_title_external_directory": "外部フォルダにアクセスしますか？",
+  "session.permission_title_generic": "{permission}を承認しますか？",
+  "session.permission_title_read": "ファイルを読み取りますか？",
+  "session.permission_title_task": "サブタスクを開始しますか？",
+  "session.permission_decision_hint": "このリクエストだけなら一度だけ許可し、このスコープを信頼できる場合はセッション中許可してください。",
+  "session.redo_aria_label": "最後に取り消したメッセージをやり直す",
+  "session.redo_label": "やり直し",
+  "session.redo_title": "最後に取り消したメッセージをやり直す",
+  "session.rename_description": "このセッションの名前を更新します。",
+  "session.rename_label": "セッション名",
+  "session.rename_placeholder": "新しい名前を入力",
+  "session.rename_title": "セッション名を変更",
+  "session.resize_workspace_column": "ワークスペース列のサイズを変更",
+  "session.revert_label": "元に戻す",
+  "session.scope_label": "スコープ",
+  "session.share_collaborator_hint": "オーナー専用アクションが不要な通常のリモートアクセス。",
+  "session.share_collaborator_host_hint": "オーナー専用アクションなしのこのホストへの通常のリモートアクセス。",
+  "session.share_collaborator_label": "コラボレータートークン",
+  "session.share_connected_with_hint": "このワークスペースは現在このパスワードで接続されています。",
+  "session.share_desktop_app_required": "デスクトップアプリが必要です",
+  "session.share_local_host_not_ready": "ローカルOpenWorkホストがまだ準備できていません。",
+  "session.share_missing_host_url": "OpenWorkホストのURLがありません。",
+  "session.share_missing_token": "OpenWorkトークンがありません。",
+  "session.share_note_direct_runtime": "エンジンランタイムがダイレクトに設定されています。ローカルワーカーの切り替えでホストが再起動しクライアントが切断される場合があります。再起動後にトークンが変更される可能性があります。",
+  "session.share_opencode_base_url": "OpenCodeベースURL",
+  "session.share_openwork_workers_only": "共有サービスリンクはOpenWorkワーカーで利用可能です。",
+  "session.share_owner_permission_hint": "リモートクライアントが許可プロンプトに応答する必要がある場合に使用します。",
+  "session.share_password": "パスワード",
+  "session.share_select_workspace": "最初にワークスペースを選択してください。",
+  "session.share_set_token_hint": "ワークスペース設定でトークンを設定",
+  "session.share_starting_server": "サーバーを起動中…",
+  "session.share_worker_url": "ワーカーURL",
+  "session.share_worker_url_phones_hint": "このワーカーに接続するスマートフォンやノートPCで使用します。",
+  "session.share_worker_url_resolving_hint": "ワーカーURLを解決中。フォールバックとしてホストURLを表示しています。",
+  "session.todo_progress": "{total}件中{completed}件のタスクが完了",
+  "session.undo_label": "元に戻す",
+  "session.undo_title": "最後のメッセージを元に戻す",
+  "session.workspace_fallback": "ワークスペース",
+  "settings.api_keys_info": "APIキーはOpenCodeによってローカルに保存されます。環境に基づくプロバイダーはワーカー環境で変更してからリロードしてください。",
+  "settings.appearance_hint": "システムに合わせるか、ライト/ダークモードを強制します。",
+  "settings.appearance_title": "外観",
+  "settings.audit_log_title": "監査ログ",
+  "settings.auto_compact": "自動コンテキスト圧縮",
+  "settings.auto_compact_desc": "このワークスペースのOpenCode compaction.autoを制御します。変更後にエンジンをリロードしてください。",
+  "settings.auto_update_desc": "アップデートを自動的にダウンロードします（インストール前に確認）。",
+  "settings.auto_update_title": "自動アップデート",
+  "settings.background_checks_desc": "OpenWorkは起動時に常にチェックします。また1日1回バックグラウンドでチェックします。",
+  "settings.background_checks_title": "バックグラウンドチェック",
+  "settings.cache_repair_requires_desktop": "キャッシュの修復にはデスクトップアプリが必要です",
+  "settings.cap_browser_tools": "ブラウザツール: {value}",
+  "settings.cap_commands": "コマンド: {value}",
+  "settings.cap_config": "設定: {value}",
+  "settings.cap_file_tools": "ファイルツール: {value}",
+  "settings.cap_inbox_off": "インボックスオフ",
+  "settings.cap_inbox_on": "インボックスオン",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "アウトボックスオフ",
+  "settings.cap_outbox_on": "アウトボックスオン",
+  "settings.cap_plugins": "プラグイン: {value}",
+  "settings.cap_read": "読み取り",
+  "settings.cap_sandbox": "サンドボックス: {value}",
+  "settings.cap_skills": "スキル: {value}",
+  "settings.cap_write": "書き込み",
+  "settings.capabilities_title": "OpenWorkサーバー機能",
+  "settings.capabilities_unavailable": "機能が利用できません。クライアントトークンで接続してください。",
+  "settings.change": "変更",
+  "settings.choose": "選択",
+  "settings.clear": "クリア",
+  "settings.configure": "設定",
+  "settings.connect_provider": "プロバイダーを接続",
+  "settings.connection": "接続",
+  "settings.connection_failed": "接続に失敗しました",
+  "settings.connection_title": "接続",
+  "settings.copied_debug_report": "ランタイムレポートJSONをコピーしました。",
+  "settings.copy_json": "JSONをコピー",
+  "settings.custom_binary_hint": "ローカルのOpenCodeビルドを指定するために使用します",
+  "settings.custom_binary_label": "カスタムOpenCodeバイナリ",
+  "settings.debug_commit": "コミット: {sha}",
+  "settings.debug_desktop_app": "デスクトップアプリ: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "OpenWorkサーバー: {version}",
+  "settings.deeplink_hint": "openwork://、openwork-dev://、またはhttps://share.openworklabs.com/b/...のURLを受け付けます。",
+  "settings.delete_containers": "コンテナを削除中…",
+  "settings.delete_local_config": "ローカル状態を削除中…",
+  "settings.dev_mode_badge": "デベロッパーモード",
+  "settings.developer": "デベロッパー",
+  "settings.developer_mode_desc": "デバッグツール、ダイアグノスティクス、デベロッパータブを有効にします。",
+  "settings.developer_mode_title": "デベロッパーモード",
+  "settings.developer_panel_disabled": "デベロッパーパネルが無効になりました。",
+  "settings.developer_panel_enabled": "デベロッパーパネルが有効になりました。",
+  "settings.diag_approval": "承認: {mode}（{ms}ms）",
+  "settings.diag_config_path": "設定パス: {path}",
+  "settings.diag_default": "デフォルト",
+  "settings.diag_host_token_source": "ホストトークンソース: {source}",
+  "settings.diag_opencode_binary": "OpenCodeバイナリ: {binary}",
+  "settings.diag_read_only": "読み取り専用: {value}",
+  "settings.diag_runtime_workspace": "ランタイムワークスペース: {id}",
+  "settings.diag_selected_workspace": "選択されたワークスペース: {id}",
+  "settings.diag_started": "開始: {time}",
+  "settings.diag_token_source": "トークンソース: {source}",
+  "settings.diag_workspaces": "ワークスペース: {count}",
+  "settings.diagnostics_unavailable": "診断が利用できません。",
+  "settings.disable_developer_mode": "デベロッパーモードを無効化",
+  "settings.disabled": "無効",
+  "settings.disconnect": "切断",
+  "settings.disconnect_server": "サーバーを切断",
+  "settings.disconnecting": "切断中…",
+  "settings.docker_containers_desc": "OpenWorkによって起動されたDockerコンテナを強制削除します。",
+  "settings.docker_containers_title": "OpenWork Dockerコンテナ",
+  "settings.docker_requires_desktop": "Dockerクリーンアップにはデスクトップアプリが必要です。",
+  "settings.done": "完了",
+  "settings.enable_developer_mode": "デベロッパーモードを有効化",
+  "settings.enable_exa": "Exa ウェブ検索を有効化",
+  "settings.enable_exa_desc": "OpenWork OrchestratorがOpenCodeを起動する際に適用されます。",
+  "settings.engine_bundled": "バンドル版（推奨）",
+  "settings.engine_bundled_hint": "バンドルエンジンが最も安定した選択肢です。システム",
+  "settings.engine_custom_binary": "カスタムバイナリ",
+  "settings.engine_desc": "OpenCodeのローカル実行方法を選択します。",
+  "settings.engine_source": "エンジンソース",
+  "settings.engine_source_debug": "エンジンソース",
+  "settings.engine_system_path": "システムインストール（PATH）",
+  "settings.engine_title": "エンジン",
+  "settings.environment.add_button": "変数を追加",
+  "settings.environment.add_title": "環境変数を追加",
+  "settings.environment.cancel": "キャンセル",
+  "settings.environment.click_to_edit": "クリックして編集",
+  "settings.environment.confirm_delete": "{key} を削除しますか？変更を適用すると、エージェントから見えなくなります。",
+  "settings.environment.close_editor": "エディターを閉じる",
+  "settings.environment.delete": "削除",
+  "settings.environment.delete_title": "環境変数を削除",
+  "settings.environment.delete_variable": "{key} を削除",
+  "settings.environment.deleting": "削除中…",
+  "settings.environment.description": "ローカルのエージェント、skills、MCP servers が使う API キーやトークンを保存します。シークレットはこのデバイスに保持され、変更を適用すると利用可能になります。",
+  "settings.environment.edit_title": "環境変数を編集",
+  "settings.environment.empty_body": "ANTHROPIC_API_KEY、GOOGLE_API_KEY、ELEVENLABS_API_KEY、GITHUB_TOKEN など、エージェントや MCP servers が必要とするサービスキーを追加します。",
+  "settings.environment.empty_title": "環境変数はまだありません",
+  "settings.environment.empty_value": "（空）",
+  "settings.environment.footer_hint": "OPENWORK_ / OPENCODE_ キーはアプリとランタイムの内部配線用です。OpenCode のランタイム設定はシェルで指定してください。",
+  "settings.environment.override_hint": "OpenWork 起動前に設定済みの環境変数は、ここで保存した値より優先されます。",
+  "settings.environment.hide": "隠す",
+  "settings.environment.hide_value": "{key} の値を隠す",
+  "settings.environment.key_hint": "英字・数字・アンダースコアのみ。数字で始められません。",
+  "settings.environment.key_label": "名前",
+  "settings.environment.loading": "読み込み中…",
+  "settings.environment.remote_workspace_hint": "このワークスペースはリモートです。ここではローカル環境変数を表示・編集しません。クラウドの LLM Providers を使うか、worker ホストを直接設定してください。",
+  "settings.environment.apply_button": "変更を適用",
+  "settings.environment.apply_blocked_active_tasks": "環境変数の変更を適用する前に、実行中のタスクを停止してください。",
+  "settings.environment.apply_confirm_body": "OpenWork はローカルエージェントを再起動し、最新の環境変数を使えるようにします。実行中のローカルタスクは停止する場合があります。",
+  "settings.environment.apply_no_local_workspace": "OpenWork はローカルワークスペースに接続されていません。",
+  "settings.environment.apply_pending_body": "変更を適用してローカルエージェントを再起動すると、最新の値が利用可能になります。",
+  "settings.environment.apply_pending_body_manual": "ローカルエージェントを再起動すると、最新の値が利用可能になります。",
+  "settings.environment.apply_pending_title": "変更は保存済みですが、まだ有効ではありません",
+  "settings.environment.apply_refresh_failed": "変更は有効になりましたが、OpenWork の状態を更新できませんでした。表示が古い場合はアプリを開き直してください。",
+  "settings.environment.apply_success": "環境変数の変更が有効になりました。",
+  "settings.environment.apply_title": "環境変数の変更を適用しますか？",
+  "settings.environment.apply_unavailable": "変更の適用はデスクトップアプリでのみ利用できます。",
+  "settings.environment.applying": "適用中…",
+  "settings.environment.restart_required": "保存しました。変更を適用すると有効になります。",
+  "settings.environment.reveal": "表示",
+  "settings.environment.reveal_value": "{key} の値を表示",
+  "settings.environment.save": "保存",
+  "settings.environment.saving": "保存中…",
+  "settings.environment.title": "環境変数",
+  "settings.environment.validation_duplicate": "同じ名前の変数がすでに存在します。",
+  "settings.environment.validation_empty": "名前は必須です。",
+  "settings.environment.validation_reserved": "OPENWORK_ / OPENCODE_ の名前は OpenWork/OpenCode が管理します。",
+  "settings.environment.validation_shape": "英字・数字・アンダースコアを使用してください。数字で始められません。",
+  "settings.environment.value_label": "値",
+  "settings.exa_restart_hint": "この設定を変更した後、OpenCodeまたはオーケストレーターを再起動してください。",
+  "settings.export": "エクスポート",
+  "settings.exported_debug_report": "ランタイムレポートJSONをエクスポートしました。",
+  "settings.feedback_badge": "すべてのメッセージを読んでいます",
+  "settings.feedback_desc": "良い点や改善点を教えてください。フィードバックはチームに直接届き、次に何をリリースするかの優先順位付けに役立ちます。",
+  "settings.feedback_title": "OpenWorkを改善する",
+  "settings.group_global": "グローバル",
+  "settings.group_workspace": "ワークスペース",
+  "settings.hide_titlebar": "タイトルバーを非表示",
+  "settings.hide_titlebar_desc": "ウィンドウのタイトルバーを非表示にします。タイル型ウィンドウマネージャーに便利です。",
+  "settings.join_discord": "Discordに参加",
+  "settings.language": "言語",
+  "settings.language.description": "使用する言語を選択してください",
+  "settings.last_error": "最後のエラー",
+  "settings.last_stderr": "最後のstderr",
+  "settings.last_stdout": "最後のstdout",
+  "settings.loading_providers": "プロバイダーを読み込み中…",
+  "settings.managed_by_env": "環境変数で管理",
+  "settings.model": "モデル",
+  "settings.model_behavior": "モデル動作",
+  "settings.model_behavior_desc": "デフォルトモデルピッカーを開いて、利用可能な場合に推論プロファイルを選択します。",
+  "settings.model_section_desc": "デフォルトのチャットモデルを選択し、推論方法を確認します。",
+  "settings.model_title": "モデル",
+  "settings.no_active_workspace": "アクティブなローカルワークスペースがありません。",
+  "settings.no_audit_entries": "まだ監査エントリがありません。",
+  "settings.no_custom_path_set": "カスタムパスが設定されていません",
+  "settings.nuke_hint": "デスクトップアプリとそのOpenCodeランタイム状態を完全にリセットする場合にのみ使用してください。",
+  "settings.off": "オフ",
+  "settings.on": "オン",
+  "settings.open_deeplink_action": "開いています…",
+  "settings.open_deeplink_button": "開く",
+  "settings.open_deeplink_desc": "OpenWorkのディープリンクまたは共有URLを貼り付けて開きます。",
+  "settings.open_deeplink_title": "ディープリンクを開く",
+  "settings.opencode_cache": "OpenCodeキャッシュ",
+  "settings.opencode_cache_description": "エンジンの起動に使用されるキャッシュデータを修復します。安全に実行できます。",
+  "settings.opencode_engine_desc": "エージェント、ツール、モデルプロバイダーのローカルランタイム。",
+  "settings.opencode_engine_label": "OpenCodeエンジン",
+  "settings.opencode_engine_sidecar_desc": "ローカル実行サイドカー。",
+  "settings.opencode_sdk_desc": "UI接続診断。",
+  "settings.opencode_sdk_title": "OpenCodeエンジン",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "開いています…",
+  "settings.openwork_config_sidecar_desc": "設定と承認のサイドカー。",
+  "settings.openwork_diagnostics_title": "OpenWorkサーバー診断",
+  "settings.openwork_server_desc": "アプリ同期、ワーカー、リモート接続のセッションコントロールプレーン。",
+  "settings.openwork_server_label": "OpenWorkサーバー",
+  "settings.pending_permissions": "保留中の権限",
+  "settings.production_mode_badge": "プロダクション",
+  "settings.provider_default_desc": "モデルの組み込みデフォルト推論動作を使用します。",
+  "settings.provider_default_label": "プロバイダーのデフォルト",
+  "settings.provider_source_config": "設定",
+  "settings.provider_source_custom": "カスタム",
+  "settings.provider_source_env": "環境変数",
+  "settings.providers_desc": "モデルとツール用のサービスを接続します。",
+  "settings.providers_title": "プロバイダー",
+  "settings.quit_hint": "OpenWorkはクリーンアップ後すぐに終了し、次回起動時にこのモードのクリーンなローカル状態から開始します。",
+  "settings.recent_events": "最近のイベント",
+  "settings.reconnect_failed": "再接続に失敗しました。サーバーURL/トークンを確認して再試行してください。",
+  "settings.reconnect_server": "再接続中…",
+  "settings.reconnect_server_failed": "OpenWorkサーバーへの再接続に失敗しました。",
+  "settings.reconnected": "OpenWorkサーバーに再接続しました。",
+  "settings.reconnecting": "再接続中…",
+  "settings.removing_containers": "コンテナを削除中…",
+  "settings.removing_local_state": "ローカル状態を削除中…",
+  "settings.repair_cache": "キャッシュを修復",
+  "settings.repairing_cache": "キャッシュ修復中",
+  "settings.report_issue": "問題を報告",
+  "settings.reset": "リセット",
+  "settings.reset_app_data": "アプリデータをリセット",
+  "settings.reset_app_data_description": "より強力なリセット。OpenWorkのキャッシュとアプリデータをクリアします。",
+  "settings.reset_app_data_title": "アプリデータをリセット",
+  "settings.reset_app_data_warning": "このデバイスのOpenWorkキャッシュとアプリデータをクリアします。",
+  "settings.reset_button": "リセット",
+  "settings.reset_cancel": "キャンセル",
+  "settings.reset_config_defaults": "リセット中…",
+  "settings.reset_confirm_button": "リセットして再起動",
+  "settings.reset_confirmation_hint": "確認のため {resetWord} と入力してください。OpenWorkが再起動されます。",
+  "settings.reset_confirmation_label": "確認",
+  "settings.reset_confirmation_placeholder": "RESETと入力",
+  "settings.reset_onboarding": "オンボーディングをリセット",
+  "settings.reset_onboarding_description": "OpenWorkの設定をクリアしてアプリを再起動します。",
+  "settings.reset_onboarding_title": "オンボーディングをリセット",
+  "settings.reset_onboarding_warning": "OpenWorkのローカル設定とワークスペースのオンボーディングマーカーをクリアします。",
+  "settings.reset_openwork_desc_dev": "開発モードが有効な場合、openwork-dev-data内のOpenCode開発状態のみをクリアします。",
+  "settings.reset_openwork_desc_prod": "開発モードが有効な場合、openwork-dev-data内のOpenCode開発状態のみをクリアします。",
+  "settings.reset_openwork_title": "OpenWork + OpenCodeの状態をリセット",
+  "settings.reset_requires_confirm": "RESETの入力が必要で、アプリが再起動します。",
+  "settings.reset_startup": "デフォルト起動モードをリセット",
+  "settings.reset_startup_pref": "起動設定をリセット",
+  "settings.reset_stop_active_runs": "リセットする前にアクティブな実行を停止してください。",
+  "settings.resetting": "リセット中…",
+  "settings.restart_blocked_message": "このアップデートを完了するにはOpenWorkの再起動が必要です。作業を中断しないため、アクティブな実行が終了するか停止するまでインストールは一時停止しています。",
+  "settings.restart_failed": "再起動に失敗しました。ログを確認してもう一度試してください。",
+  "settings.restart_opencode": "再起動中…",
+  "settings.restart_openwork_server": "OpenWorkサーバーを再起動中…",
+  "settings.restart_server_failed": "ローカルサーバーの再起動に失敗しました。",
+  "settings.restarted": "ローカルサーバーを再起動しました。",
+  "settings.restarting": "再起動中…",
+  "settings.reveal_config": "設定ファイルを開く",
+  "settings.reveal_config_requires_desktop": "設定の表示にはデスクトップアプリが必要です",
+  "settings.run_sandbox_probe": "プローブを実行中…",
+  "settings.running_probe": "プローブを実行中…",
+  "settings.runtime_debug_desc": "ワンクリックエクスポート付きの読みやすい診断スナップショット。",
+  "settings.runtime_debug_title": "ランタイムデバッグレポート",
+  "settings.runtime_desc": "ローカルエンジンとOpenWorkサーバーのステータス。",
+  "settings.runtime_title": "ランタイム",
+  "settings.sandbox_error": "エラー",
+  "settings.sandbox_export_hint": "上のランタイムデバッグレポートのエクスポートを使用して",
+  "settings.sandbox_probe_desc": "一時的なDockerサンドボックスの起動チェックを実行し、",
+  "settings.sandbox_probe_success": "サンドボックスプローブに成功しました。サポート用にデバッグレポートをエクスポートしてください。",
+  "settings.sandbox_probe_title": "サンドボックスプローブ",
+  "settings.sandbox_ready": "準備完了",
+  "settings.sandbox_requires_desktop": "サンドボックスプローブにはデスクトップアプリが必要です",
+  "settings.sandbox_result": "結果: {status}",
+  "settings.sandbox_run_id": "実行ID: {id}",
+  "settings.sandbox_stop_runs_hint": "プローブの前にアクティブな実行を停止してください",
+  "settings.search_models": "モデルを検索…",
+  "settings.send_feedback": "フィードバックを送信",
+  "settings.show_model_reasoning": "モデルの推論を表示",
+  "settings.show_model_reasoning_desc": "モデルが推論トレースを提供する場合、UIで展開表示します。",
+  "settings.showing_models": "{total}件中{count}件を表示",
+  "settings.startup": "起動",
+  "settings.startup_remote_warning": "起動設定は現在リモートです。エンジン設定は",
+  "settings.startup_reset_hint": "保存された設定をクリアし、接続画面を表示します。",
+  "settings.startup_title": "起動",
+  "settings.stop_local_server": "ローカルサーバーを停止",
+  "settings.stop_runs_before_cleanup": "クリーンアップの前にアクティブな実行を停止してください",
+  "settings.stop_runs_before_reset_config": "設定リセットの前にアクティブな実行を停止してください",
+  "settings.stop_runs_to_reset": "リセットするにはアクティブな実行を停止してください",
+  "settings.switch": "切り替え",
+  "settings.tab_advanced": "詳細",
+  "settings.tab_appearance": "外観",
+  "settings.tab_cloud": "クラウド",
+  "settings.tab_debug": "デバッグ",
+  "settings.tab_description_advanced": "初期設定をやり直すためにOpenWorkのローカル状態をリセットします。",
+  "settings.tab_description_appearance": "テーマとユーザーインターフェースの外観をカスタマイズします。",
+  "settings.tab_description_debug": "ランタイムダイアログ、ログ、低レベルデバッグユーティリティを確認します。",
+  "settings.tab_description_den": "OpenWork Cloud接続、ホストワーカー、ワークスペースアクセスを管理します。",
+  "settings.tab_description_extensions": "このワークスペースのMCPアプリとOpenCodeプラグインを管理します。",
+  "settings.tab_description_general": "プロバイダーを接続し、デフォルトモデルを選択し、フォルダへのアクセスを許可し、OpenWorkワークスペースとそのランタイム接続を管理します。",
+  "settings.tab_description_environment": "ローカルのエージェント、skills、MCP servers が使う API キーやトークンを保存します。シークレットはこのデバイスに保持されます。",
+  "settings.tab_description_recovery": "マイグレーション状態を修復し、ワークスペースのデフォルトをリセットし、ローカル設定を復元します。",
+  "settings.tab_description_skills": "カスタムスキルをこのワークスペースに作成、保存、実行します。",
+  "settings.tab_description_updates": "OpenWorkを最新の状態に保ちます。",
+  "settings.tab_environment": "環境変数",
+  "settings.tab_extensions": "拡張機能",
+  "settings.tab_general": "設定",
+  "settings.tab_recovery": "リカバリー",
+  "settings.tab_skills": "スキル",
+  "settings.tab_updates": "アップデート",
+  "settings.theme_dark": "ダーク",
+  "settings.theme_light": "ライト",
+  "settings.theme_system": "システム",
+  "settings.theme_system_hint": "システムモードはOSの設定に自動的に従います。",
+  "settings.update": "アップデート",
+  "settings.update_available": "アップデート利用可能: v",
+  "settings.update_available_version": "アップデート利用可能: v{version}",
+  "settings.update_check_button": "確認",
+  "settings.update_check_failed": "アップデートの確認に失敗しました",
+  "settings.update_checking": "確認中…",
+  "settings.update_download_button": "ダウンロード",
+  "settings.update_downloading": "ダウンロード中…",
+  "settings.update_install_button": "インストールして再起動",
+  "settings.update_last_checked": "最終確認 {time}",
+  "settings.update_published": "公開日 {date}",
+  "settings.update_ready": "インストール準備完了: v",
+  "settings.update_ready_version": "インストール準備完了: v{version}",
+  "settings.update_uptodate": "最新です",
+  "settings.updates": "アップデート",
+  "settings.updates_desc": "OpenWorkを最新の状態に保ちます。",
+  "settings.updates_desktop_only": "アップデートはデスクトップアプリでのみ利用可能です。",
+  "settings.updates_not_supported": "この環境ではアップデートはサポートされていません。",
+  "settings.updates_title": "アップデート",
+  "settings.window_appearance_desc": "ウィンドウの外観をカスタマイズします。",
+  "settings.worker_id_label": "ワーカー{id}",
+  "settings.worker_unresolved": "ワーカー{runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "ワークスペース設定",
+  "settings.workspace_debug_events_label": "ワークスペースデバッグイベント",
+  "share.back_hint": "共有オプションに戻る",
+  "share.chooser_subtitle": "このワークスペースの共有方法を選択してください。",
+  "share.close_hint": "閉じる",
+  "share.option_access_desc": "別のマシンからこの実行中のワークスペースに到達するために必要なライブ接続詳細を表示します。",
+  "share.option_access_title": "ワークスペースにリモートアクセス",
+  "share.subtitle_access": "別のマシンからこのワークスペースに到達するために必要なライブ接続詳細を表示します。",
+  "share.title": "ワークスペースを共有",
+  "share.view_access": "ワークスペースにリモートアクセス",
+  "share.workspace_fallback": "ワークスペース",
+  "share_skill_destination.add_to_workspace": "ワークスペースに追加",
+  "share_skill_destination.adding": "追加中…",
+  "share_skill_destination.connect_remote": "リモートワークスペースに接続",
+  "share_skill_destination.connect_remote_hint": "リモートワークスペースに接続してからリストで選択してください。",
+  "share_skill_destination.create_worker": "新しいワークスペースを作成",
+  "share_skill_destination.create_worker_hint": "新しいワークスペースを作成してこのスキルを追加します。",
+  "share_skill_destination.current_badge": "現在",
+  "share_skill_destination.existing_workers": "既存のワークスペース",
+  "share_skill_destination.fallback_skill_name": "共有スキル",
+  "share_skill_destination.local_badge": "ローカル",
+  "share_skill_destination.more_options": "その他のオプション",
+  "share_skill_destination.no_workers": "まだ準備できたワークスペースがありません。このスキルをインストールするには、ワークスペースを作成するかリモートワークスペースに接続してください。",
+  "share_skill_destination.remote_badge": "リモート",
+  "share_skill_destination.sandbox_badge": "サンドボックス",
+  "share_skill_destination.selected_badge": "選択済み",
+  "share_skill_destination.selected_hint": "選択済み。下の送信先を確認してから確定してください。",
+  "share_skill_destination.skill_label": "共有スキル",
+  "share_skill_destination.subtitle": "共有されたスキルをインポートする前に、既存のワークスペースを選択するか新しいワークスペースを作成してください。",
+  "share_skill_destination.title": "このスキルをどこに追加しますか？",
+  "share_skill_destination.trigger_label": "トリガー",
+  "sidebar.collapse": "折りたたむ",
+  "sidebar.expand": "展開",
+  "skills.add_custom_repo": "カスタムGitHubリポを追加",
+  "skills.add_git_repo": "Gitリポを追加",
+  "skills.add_openwork_hub": "OpenWork Hubを追加",
+  "skills.available_from_hub": "ハブから利用可能",
+  "skills.catalog_search_placeholder": "インストール済み、チーム、ハブのスキルを検索",
+  "skills.cloud_choose_org_detail": "Cloudパネルでアクティブな組織を選択してから、このリストを更新してください。",
+  "skills.cloud_choose_org_hint": "チームスキルを読み込むには設定→Cloudで組織を選択してください。",
+  "skills.cloud_footer_label": "チーム",
+  "skills.cloud_hub_label": "ハブ: {name}",
+  "skills.cloud_installed": "このワーカーに{name}をインストールしました。",
+  "skills.cloud_installing": "{title}をインストール中…",
+  "skills.cloud_installing_short": "インストール中",
+  "skills.cloud_no_search_matches": "検索に一致するスキルがありません。",
+  "skills.cloud_org_empty": "組織のスキルはまだ利用できません。",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "組織スキルの読み込みに失敗しました。",
+  "skills.cloud_refresh": "チームスキルを更新",
+  "skills.cloud_section_subtitle": "OpenWork Cloudで共有されたスキル（アクセス可能なチームスキルハブを含む）。",
+  "skills.cloud_section_title": "組織から",
+  "skills.cloud_shared_org": "組織",
+  "skills.cloud_shared_public": "公開",
+  "skills.cloud_sign_in": "Cloudにサインイン",
+  "skills.cloud_sign_in_hint": "チームおよび組織のスキルを参照するにはOpenWork Cloudにサインインしてください。",
+  "skills.copy_link_failed": "リンクのコピーに失敗しました",
+  "skills.create_in_chat": "チャットでスキルを作成",
+  "skills.desktop_required": "スキル管理にはデスクトップアプリが必要です。",
+  "skills.enter_plugin_name": "プラグインパッケージ名を入力してください。",
+  "skills.failed_load_active": "アクティブなプラグインの読み込みに失敗しました。",
+  "skills.failed_load_opencode": "opencode.jsonの読み込みに失敗しました",
+  "skills.failed_parse_opencode": "opencode.jsonの解析に失敗しました",
+  "skills.failed_to_load": "スキルの読み込みに失敗しました",
+  "skills.failed_update_opencode": "opencode.jsonの更新に失敗しました",
+  "skills.filter_all": "すべて",
+  "skills.filter_cloud": "チーム",
+  "skills.filter_hub": "ハブ",
+  "skills.filter_installed": "インストール済み",
+  "skills.from_repo": "{owner}/{repo}から",
+  "skills.github_repo_hint": "owner/repo形式でGitHubリポジトリを入力してください。",
+  "skills.host_mode_only": "ローカルワークスペースのみ",
+  "skills.host_only_error": "スキル管理にはローカルワークスペースまたは接続されたOpenWorkサーバーが必要です。",
+  "skills.hub_desc": "GitHubベースのハブから共有スキルを閲覧し、このワーカーに追加します。",
+  "skills.hub_label": "ハブ",
+  "skills.import": "インポート",
+  "skills.import_failed": "インポートに失敗しました（{status}）",
+  "skills.import_local": "ローカルスキルをインポート",
+  "skills.import_local_skill": "ローカルスキルをインポート",
+  "skills.imported": "インポート完了。",
+  "skills.install": "インストール",
+  "skills.install_failed": "スキルのインストールに失敗しました。",
+  "skills.install_name_title": "{name}をインストール",
+  "skills.installed": "インストール済みスキル",
+  "skills.installed_desc": "インストール済みスキルはこのワーカーで実行でき、編集または共有できます。",
+  "skills.installed_status": "インストール済み",
+  "skills.installing": "スキルを追加",
+  "skills.installing_prefix": "{name}をインストール中…",
+  "skills.installing_skill_creator": "スキルクリエイターをインストール中…",
+  "skills.link_copied": "リンクをコピーしました",
+  "skills.loading": "読み込み中…",
+  "skills.no_description": "説明はまだありません。",
+  "skills.no_hub_repo_label": "ハブリポが選択されていません",
+  "skills.no_hub_repo_selected": "ハブスキルが利用できません。",
+  "skills.no_hub_skills": "ハブリポが選択されていません。スキルを閲覧するにはGitHubリポを追加してください。",
+  "skills.no_opencode_found": "opencode.jsonがまだ見つかりません。プラグインを追加して作成してください。",
+  "skills.no_opencode_workspace": "このワークスペースにはまだopencode.jsonがありません。",
+  "skills.no_skills": "`.opencode/skills`、`.claude/skills`、`~/.agents/skills`にスキルが検出されませんでした。",
+  "skills.no_skills_found": "まだスキルが見つかりません。",
+  "skills.owner_label": "オーナー",
+  "skills.owner_repo_required": "オーナーとリポは必須です。",
+  "skills.pick_project_first": "最初にプロジェクトフォルダを選択してください。",
+  "skills.pick_project_for_active": "アクティブなプラグインを読み込むにはプロジェクトフォルダを選択してください。",
+  "skills.pick_project_for_plugins": "プロジェクトのプラグインを管理するにはプロジェクトフォルダを選択してください。",
+  "skills.pick_workspace_first": "最初にワークスペースフォルダを選択してください。",
+  "skills.plugin_already_listed": "プラグインは既にopencode.jsonに登録されています。",
+  "skills.plugin_management_host_only": "プラグイン管理にはデスクトップアプリが必要です。",
+  "skills.plugins_host_only": "プラグインはデスクトップアプリでのみ利用可能です。",
+  "skills.ref_label": "Ref（ブランチ/タグ/コミット）",
+  "skills.refresh": "更新",
+  "skills.refresh_hub": "ハブを更新",
+  "skills.remove_saved_repo": "保存済みリポを削除",
+  "skills.repo_label": "リポ",
+  "skills.reveal_failed": "スキルフォルダを開けませんでした。",
+  "skills.reveal_folder": "スキルフォルダを開く",
+  "skills.save_and_load": "保存して読み込み",
+  "skills.select_skill_folder": "スキルフォルダを選択",
+  "skills.share_back": "戻る",
+  "skills.share_chooser_subtitle": "OpenWork Cloudの組織に保存するか、公開インストールリンクを発行します。",
+  "skills.share_close": "閉じる",
+  "skills.share_copy_link": "コピー",
+  "skills.share_done": "完了",
+  "skills.share_option_public_desc": "誰でもこのスキルをインストールできるリンクを作成します。",
+  "skills.share_option_public_title": "公開リンク",
+  "skills.share_option_team_desc": "アクティブなOpenWork Cloud組織にこのスキルを追加します。",
+  "skills.share_option_team_title": "チームと共有",
+  "skills.share_public_create": "リンクを作成",
+  "skills.share_public_creating": "公開中…",
+  "skills.share_public_intro": "公開リンクを発行します。URLを知っている人は誰でもインストールできます。",
+  "skills.share_public_regenerate": "リンクを再発行",
+  "skills.share_publisher_label": "パブリッシャー",
+  "skills.share_subtitle_public": "リンクを知っている人は誰でもこのスキルをインストールできます。",
+  "skills.share_subtitle_team": "チーム向けに組織に保存されます。",
+  "skills.share_team_choose_org": "チーム共有の前に設定のCloudで組織を選んでください。",
+  "skills.share_team_hubs_loading": "ハブを読み込み中…",
+  "skills.share_team_org_fallback": "アクティブなCloud組織",
+  "skills.share_team_sign_in": "チーム共有のためにサインイン",
+  "skills.share_team_sign_in_hint": "ブラウザでOpenWork Cloudが開きます。サインイン後にここに戻ってください。",
+  "skills.share_title": "スキルを共有",
+  "skills.shown_count": "{count}件表示",
+  "skills.skill_creator_already_installed": "スキルクリエイターは既にインストール済みです。",
+  "skills.skill_creator_installed": "スキルクリエイターをインストールしました。",
+  "skills.skill_load_failed": "スキルの読み込みに失敗しました。",
+  "skills.source_label": "ソース",
+  "skills.title": "スキル",
+  "skills.trigger_label": "トリガー: {trigger}",
+  "skills.uninstall": "アンインストール",
+  "skills.uninstall_failed": "スキルのアンインストールに失敗しました。",
+  "skills.uninstall_title": "スキルをアンインストールしますか？",
+  "skills.uninstall_warning": "ワークスペースから`{name}`スキルを完全に削除します。",
+  "skills.uninstalled": "スキルを削除しました。",
+  "skills.unknown_error": "不明なエラー",
+  "skills.worker_profile_desc": "スキルはこのワーカーの主要な機能です。ハブから探し、インストール済みのものを管理し、チャットから直接作成できます。",
+  "status.back": "前の画面に戻る",
+  "status.connected": "接続済み",
+  "status.connecting": "接続中",
+  "status.creating_task": "新しいタスクを作成中",
+  "status.developer_mode": "デベロッパーモード",
+  "status.disconnected": "切断済み",
+  "status.disconnected_hint": "設定を開いて再接続してください",
+  "status.disconnected_label": "切断済み",
+  "status.docs": "ドキュメント",
+  "status.feedback": "フィードバック",
+  "status.limited_hint": "再接続してOpenWorkの全機能を復元",
+  "status.limited_mcp_hint": "{count}件のMCP接続済み · 全機能には再接続が必要",
+  "status.limited_mode": "制限モード",
+  "status.loading_session": "セッションを読み込み中",
+  "status.mcp_connected": "{count}件のMCP接続済み",
+  "status.open_docs": "ドキュメントを開く",
+  "status.openwork_ready": "OpenWork準備完了",
+  "status.providers_connected": "{count}件のプロバイダーが接続済み",
+  "status.ready_for_tasks": "新しいタスクの準備完了",
+  "status.running": "実行中",
+  "status.send_feedback": "フィードバックを送信",
+  "status.settings": "設定",
+  "system.reload_body_agents": "OpenCodeは起動時にエージェントを読み込みます。更新されたエージェントを利用可能にするにはエンジンをリロードしてください。",
+  "system.reload_body_commands": "OpenCodeは起動時にコマンドを読み込みます。更新されたコマンドを利用可能にするにはエンジンをリロードしてください。",
+  "system.reload_body_config": "OpenCodeは起動時にopencode.jsonを読み込みます。設定変更を適用するにはエンジンをリロードしてください。",
+  "system.reload_body_default": "OpenWorkがOpenCodeインスタンスのリロードが必要な変更を検出しました。",
+  "system.reload_body_mcp": "OpenCodeは起動時にMCPサーバーを読み込みます。新しい接続を有効にするにはエンジンをリロードしてください。",
+  "system.reload_body_mixed": "OpenWorkがOpenCode設定の変更を検出しました。エンジンをリロードして適用してください。",
+  "system.reload_body_plugins": "OpenCodeは起動時にnpmプラグインを読み込みます。opencode.jsonの変更を適用するにはエンジンをリロードしてください。",
+  "system.reload_body_skills": "OpenCodeはスキルの検出/状態をキャッシュできます。新しくインストールしたスキルを利用可能にするにはエンジンをリロードしてください。",
+  "system.reload_failed": "エンジンのリロードに失敗しました。",
+  "system.reload_required": "リロードが必要",
+  "system.reload_unavailable": "このワーカーではリロードできません。",
+  "system.stop_active_runs_before_reset": "リセットする前にアクティブな実行を停止してください。",
+  "time.hours_ago": "{count}時間前",
+  "time.just_now": "たった今",
+  "time.minutes_ago": "{count}分前",
+  "time.seconds_ago": "{count}秒前",
+  "workspace.loading_tasks": "タスクを読み込み中…",
+  "workspace.local_badge": "ローカル",
+  "workspace.new_task_inline": "＋ 新しいタスク",
+  "workspace.no_tasks": "まだタスクがありません。",
+  "workspace.remote_badge": "リモート",
+  "workspace.rename_description": "サイドバーに表示される名前を更新します。",
+  "workspace.rename_label": "ワークスペース名",
+  "workspace.rename_placeholder": "デザインチームワークスペース",
+  "workspace.rename_title": "ワークスペース名を編集",
+  "workspace.sandbox_badge": "サンドボックス",
+  "workspace.selected": "選択済み",
+  "workspace_list.add_workspace": "ワークスペースを追加",
+  "workspace_list.connecting": "接続中…",
+  "workspace_list.delete_session": "セッションを削除",
+  "workspace_list.edit_connection": "接続を編集",
+  "workspace_list.edit_name": "名前を編集",
+  "workspace_list.hide_child_sessions": "子セッションを隠す",
+  "workspace_list.recover": "復元",
+  "workspace_list.remote_worker_unavailable": "リモートワーカーを利用できません",
+  "workspace_list.remote_worker_unavailable_hint": "接続が修正されるまで、このワーカーからタスクを読み込めません。",
+  "workspace_list.remove_workspace": "ワークスペースを削除",
+  "workspace_list.rename_session": "セッション名を変更",
+  "workspace_list.reveal_explorer": "エクスプローラーで表示",
+  "workspace_list.reveal_finder": "Finderで表示",
+  "workspace_list.session_actions": "セッションアクション",
+  "workspace_list.share": "共有…",
+  "workspace_list.show_child_sessions": "子セッションを表示",
+  "workspace_list.show_more": "さらに{count}件表示",
+  "workspace_list.show_more_fallback": "もっと見る",
+  "workspace_list.test_connection": "接続テスト",
+  "workspace_list.unavailable": "利用不可",
+  "workspace_list.workspace_fallback": "ワークスペース",
+  "workspace_list.workspace_options": "ワークスペースオプション",
+} as const;
diff --git a/apps/app/src/i18n/locales/pt-BR.ts b/apps/app/src/i18n/locales/pt-BR.ts
new file mode 100644
index 0000000000..03c4c8108b
--- /dev/null
+++ b/apps/app/src/i18n/locales/pt-BR.ts
@@ -0,0 +1,1384 @@
+/**
+ * Traduções para português do Brasil
+ * Termos profissionais (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) NÃO são traduzidos
+ */
+
+export default {
+  "app.compact_command_desc": "Resumir esta sessão para reduzir o tamanho do contexto.",
+  "app.error_audit_load": "Falha ao carregar o log de auditoria.",
+  "app.error_auth_failed": "Falha na autenticação",
+  "app.error_command_not_resolved": "Comando não foi resolvido.",
+  "app.error_compact_empty": "Nada para compactar ainda.",
+  "app.error_compact_no_session": "Selecione uma sessão com mensagens antes de executar /compact.",
+  "app.error_compact_no_session_id": "Selecione uma sessão antes de compactar.",
+  "app.error_connect_first": "Conecte a este worker antes de aplicar alterações de runtime.",
+  "app.error_not_connected": "Não conectado a um servidor",
+  "app.error_rate_limit": "Limite de requisições excedido",
+  "app.error_remote_access": "Falha ao atualizar o acesso remoto.",
+  "app.error_request_failed": "Falha na requisição",
+  "app.error_restart_local_worker": "Falha ao reiniciar o worker local com a configuração de compartilhamento atualizada.",
+  "app.error_session_name_required": "O nome da sessão é obrigatório",
+  "app.local_disabled_reason": "Crie workspaces locais no app desktop. Workspaces remotos e compartilhados ainda funcionam aqui.",
+  "app.model_behavior_title": "Comportamento do modelo",
+  "app.plugins_hint_readonly": "O servidor OpenWork está em modo somente leitura para plugins.",
+  "app.reload_later": "Depois",
+  "app.reload_now": "Recarregar agora",
+  "app.reload_stop_tasks": "Recarregar e Parar Tarefas",
+  "app.skills_hint_readonly": "O servidor OpenWork está em modo somente leitura para skills. Adicione um token de host em Avançado para habilitar instalações.",
+  "app.unknown_error": "Erro desconhecido",
+  "blueprint.automation_body": "Comece com um workflow reutilizável ou digite sua tarefa abaixo.",
+  "blueprint.automation_title": "O que você quer automatizar?",
+  "blueprint.csv_session_assistant": "Posso ajudar a gerar, limpar, mesclar e resumir arquivos CSV. Que tipo de trabalho com CSV você quer automatizar?",
+  "blueprint.csv_session_title": "Ideias de workflow com CSV",
+  "blueprint.csv_session_user": "Quero combinar exportações de várias ferramentas em um CSV limpo.",
+  "blueprint.empty_body": "Escolha um ponto de partida ou digite abaixo.",
+  "blueprint.empty_title": "O que você quer fazer?",
+  "blueprint.minimal_body": "Faça uma pergunta sobre este workspace ou use um prompt inicial.",
+  "blueprint.minimal_title": "Comece com uma tarefa",
+  "blueprint.starter_blueprint_desc": "Projete um workflow reproduzível com skills, comandos e etapas de handoff.",
+  "blueprint.starter_blueprint_prompt": "Me ajude a projetar um blueprint de automação reutilizável para este workspace. Pergunte o que deve ser padronizado e depois proponha o workflow.",
+  "blueprint.starter_blueprint_title": "Planejar um blueprint de automação",
+  "blueprint.starter_chrome_desc": "Comece uma conversa de automação de navegador agora mesmo.",
+  "blueprint.starter_chrome_prompt": "Me ajude a conectar ao Chrome e automatizar uma tarefa repetitiva.",
+  "blueprint.starter_chrome_title": "Automatizar Chrome",
+  "blueprint.starter_command_desc": "Transforme um workflow repetido em um comando slash para este workspace.",
+  "blueprint.starter_command_prompt": "Me ajude a criar um /comando reutilizável para este workspace. Pergunte qual workflow eu quero automatizar e depois elabore o comando.",
+  "blueprint.starter_command_title": "Criar um comando reutilizável",
+  "blueprint.starter_connect_openai_desc": "Adicione seu provedor OpenAI para que os modelos ChatGPT estejam prontos em novas sessões.",
+  "blueprint.starter_connect_openai_title": "Conectar ChatGPT",
+  "blueprint.starter_csv_desc": "Limpe ou gere dados de planilha.",
+  "blueprint.starter_csv_prompt": "Me ajude a criar ou editar arquivos CSV neste computador.",
+  "blueprint.starter_csv_title": "Trabalhar com CSV",
+  "blueprint.starter_explore_desc": "Resuma os arquivos e sugira a melhor primeira tarefa a realizar.",
+  "blueprint.starter_explore_prompt": "Resuma este workspace, aponte os arquivos mais importantes e sugira a melhor primeira tarefa.",
+  "blueprint.starter_explore_title": "Explorar este workspace",
+  "blueprint.welcome_message": "Olá, boas-vindas ao OpenWork!\n\nAs pessoas usam o OpenWork para escrever arquivos .csv no computador, conectar ao Chrome e automatizar tarefas repetitivas, e sincronizar contatos com o Notion.\n\nMas o único limite é a sua imaginação.\n\nO que você gostaria de fazer?",
+  "blueprint.welcome_title": "Boas-vindas ao OpenWork",
+  "common.add": "Adicionar",
+  "common.cancel": "Cancelar",
+  "common.close": "Fechar",
+  "common.default_parens": "(padrão)",
+  "common.edit": "Editar",
+  "common.hide": "Ocultar",
+  "common.navigate": "navegar",
+  "common.next": "Próximo",
+  "common.off": "Desativado",
+  "common.on": "Ativado",
+  "common.path": "Caminho",
+  "common.question": "Pergunta",
+  "common.refresh": "Atualizar",
+  "common.remove": "Remover",
+  "common.reset": "Redefinir",
+  "common.save": "Salvar",
+  "common.select": "selecionar",
+  "common.show": "Mostrar",
+  "common.something_went_wrong": "Algo deu errado",
+  "common.submit": "Enviar",
+  "common.unknown": "Desconhecido",
+  "composer.agent_label": "Agente",
+  "composer.attach_files": "Anexar arquivos",
+  "composer.attachments_unavailable": "Anexos não estão disponíveis.",
+  "composer.behavior_label": "Comportamento",
+  "composer.configure": "Configurar",
+  "composer.default_agent": "Agente padrão",
+  "composer.file_exceeds_limit": "{name} excede o limite de 8MB.",
+  "composer.file_kind": "Arquivo",
+  "composer.image_kind": "Imagem",
+  "composer.inserted_links_unsupported": "Links inseridos para arquivos não suportados.",
+  "composer.loading_commands": "Carregando comandos...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "Nenhum comando encontrado.",
+  "composer.placeholder": "Descreva sua tarefa...",
+  "composer.remote_worker_paste_warning": "Este é um worker remoto. Sandboxes também são remotos. Para compartilhar arquivos, envie-os para a Pasta Compartilhada na barra lateral.",
+  "composer.run_task": "Executar tarefa",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Parar",
+  "composer.tools_label": "Comandos, skills e MCPs",
+  "composer.unsupported_attachment_type": "Tipo de anexo não suportado.",
+  "composer.upload_to_shared_folder": "Enviar para pasta compartilhada",
+  "composer.uploaded_multiple_files": "{count} arquivos enviados para a pasta compartilhada com links inseridos.",
+  "composer.uploaded_single_file": "{name} enviado para a pasta compartilhada com link inserido.",
+  "config.collaborator_token_disabled_hint": "Armazenado antecipadamente para compartilhamento remoto, mas o acesso remoto está desativado.",
+  "config.collaborator_token_label": "Token de colaborador",
+  "config.collaborator_token_remote_hint": "Acesso remoto rotineiro para celulares ou laptops conectando a este servidor.",
+  "config.connection_failed": "Falha na conexão.",
+  "config.connection_failed_check": "Falha na conexão. Verifique a URL e o token do host.",
+  "config.connection_status_updated": "Status da conexão atualizado.",
+  "config.connection_successful": "Conexão bem-sucedida.",
+  "config.copied": "Copiado",
+  "config.copy": "Copiar",
+  "config.desktop_only_hint": "Alguns recursos de config (compartilhamento de servidor local + bridge de mensagens) requerem o app desktop.",
+  "config.diagnostics_desc": "Copiar estado de runtime sanitizado para depuração.",
+  "config.diagnostics_title": "Pacote de diagnósticos",
+  "config.engine_reload_desc": "Reiniciar o servidor OpenCode para este workspace.",
+  "config.engine_reload_title": "Recarregar engine",
+  "config.host_admin_token_hint": "Token interno apenas para o host, usado para CLI de aprovações e APIs admin. Não use no fluxo de conexão do app remoto.",
+  "config.host_admin_token_label": "Token admin do host",
+  "config.host_local_only": "Apenas local",
+  "config.host_offline": "Offline",
+  "config.host_remote_enabled": "Remoto ativado",
+  "config.local_ip_hint": "Use seu IP local na mesma rede Wi-Fi para a conexão mais rápida.",
+  "config.mdns_hint": "Nomes .local são mais fáceis de lembrar, mas podem não resolver em todas as redes.",
+  "config.messaging_identities_desc": "Gerencie identidades do Telegram/Slack e roteamento na aba Identidades.",
+  "config.messaging_identities_title": "Identidades de mensagens",
+  "config.not_set": "Não definido",
+  "config.owner_token_disabled_hint": "Relevante apenas após ativar o acesso remoto para este worker.",
+  "config.owner_token_label": "Token do proprietário",
+  "config.owner_token_remote_hint": "Use quando o cliente remoto precisar responder a prompts de permissão ou executar ações exclusivas do proprietário.",
+  "config.reload_active_tasks_warning": "O recarregamento parará as tarefas ativas.",
+  "config.reload_availability_hint": "O recarregamento está disponível apenas para workers locais ou servidores OpenWork conectados.",
+  "config.reload_connect_hint": "Conecte a este worker para recarregar.",
+  "config.reload_engine": "Recarregar engine",
+  "config.reload_now_desc": "Aplica atualizações de config e reconecta sua sessão.",
+  "config.reload_now_title": "Recarregar agora",
+  "config.reloading": "Recarregando...",
+  "config.remote_access_off_hint": "O acesso remoto está desativado. Use Compartilhar workspace para ativá-lo antes de conectar de outra máquina.",
+  "config.resolved_worker_url": "URL do worker resolvida:",
+  "config.server_needed_hint": "Conexão com o servidor OpenWork necessária para sincronizar skills, plugins e comandos.",
+  "config.server_section_desc": "Conecte a um servidor OpenWork. Use a URL mais um token de colaborador ou proprietário do administrador do servidor.",
+  "config.server_section_title": "Servidor OpenWork",
+  "config.server_sharing_desc": "Compartilhe esses dados com um dispositivo de confiança. Mantenha o servidor na mesma rede para a configuração mais rápida.",
+  "config.server_sharing_menu_hint": "Para links de compartilhamento por workspace, use Compartilhar... no menu do workspace.",
+  "config.server_sharing_title": "Compartilhamento do servidor OpenWork",
+  "config.server_url_hint": "Use a URL compartilhada pelo seu servidor OpenWork. Workers locais do desktop reutilizam uma porta alta persistente na faixa 48000-51000.",
+  "config.server_url_input_label": "URL do servidor OpenWork",
+  "config.server_url_label": "URL do Servidor OpenWork",
+  "config.starting_server": "Iniciando servidor…",
+  "config.status_connected": "Conectado",
+  "config.status_limited": "Limitado",
+  "config.status_not_connected": "Não conectado",
+  "config.test_connection": "Testar conexão",
+  "config.testing": "Testando...",
+  "config.testing_connection": "Testando conexão...",
+  "config.token_hint": "Opcional. Cole um token de colaborador para acesso rotineiro ou um token de proprietário quando este cliente precisar responder a prompts de permissão.",
+  "config.token_label": "Token de colaborador ou proprietário",
+  "config.token_placeholder": "Cole seu token",
+  "config.unavailable": "Indisponível",
+  "config.worker_id": "ID do Worker:",
+  "config.workspace_config_desc": "Essas configurações afetam o workspace selecionado. Ações somente de runtime se aplicam ao workspace conectado no momento.",
+  "config.workspace_config_title": "Config do workspace",
+  "config.workspace_id_prefix": "Workspace:",
+  "context_panel.add_button": "Adicionar",
+  "context_panel.add_folder_hint": "Adicione uma pasta para permitir que este workspace leia e edite arquivos fora do diretório raiz.",
+  "context_panel.adding_button": "Adicionando...",
+  "context_panel.always_available": "Sempre disponível",
+  "context_panel.authorized_folders": "Pastas autorizadas",
+  "context_panel.authorized_folders_desc": "Conceda a este workspace acesso para ler e editar arquivos em diretórios fora da raiz.",
+  "context_panel.authorized_folders_no_access": "Conecte a um workspace OpenWork com permissão de escrita para editar as pastas autorizadas.",
+  "context_panel.browse_button": "Navegar",
+  "context_panel.config_access_unavailable": "O acesso à configuração do servidor OpenWork não está disponível para este workspace.",
+  "context_panel.config_read_only": "O servidor OpenWork está conectado em modo somente leitura para configuração do workspace.",
+  "context_panel.folder_already_authorized": "Pasta já autorizada.",
+  "context_panel.folders_updated": "Pastas autorizadas atualizadas.",
+  "context_panel.input_placeholder": "Digite o caminho de uma pasta para autorizar...",
+  "context_panel.no_external_folders": "Nenhuma pasta externa autorizada",
+  "context_panel.no_mcp": "Nenhum servidor MCP carregado.",
+  "context_panel.no_server_workspace": "Nenhum workspace de servidor ativo selecionado.",
+  "context_panel.no_skills": "Nenhuma skill carregada.",
+  "context_panel.preserving_entries": "Preservando {count} entradas de permissão não relacionadas a pastas.",
+  "context_panel.preserving_entry": "Preservando 1 entrada de permissão não relacionada a pasta.",
+  "context_panel.remove_folder": "Remover {name}",
+  "context_panel.saving_folders": "Salvando pastas autorizadas...",
+  "context_panel.server_disconnected": "Servidor OpenWork desconectado.",
+  "context_panel.workspace_root_available": "A raiz do workspace já está disponível.",
+  "context_panel.workspace_root_badge": "Raiz do workspace",
+  "context_panel.writable_workspace_required": "É necessário um workspace OpenWork com permissão de escrita para atualizar as pastas autorizadas.",
+  "dashboard.change": "Alterar",
+  "dashboard.choose_folder": "Escolher uma pasta",
+  "dashboard.choose_folder_continue": "Escolha uma pasta para continuar.",
+  "dashboard.chooser_local_desc": "Crie um workspace neste dispositivo e, opcionalmente, comece a partir de um template de equipe.",
+  "dashboard.chooser_remote_desc": "Conecte a um worker OpenWork auto-hospedado usando uma URL e token de acesso.",
+  "dashboard.chooser_shared_desc": "Navegue por workers na nuvem compartilhados com sua organização e conecte em um passo.",
+  "dashboard.close_settings": "Fechar configurações",
+  "dashboard.cloud_worker": "Worker na nuvem",
+  "dashboard.commands": "Comandos",
+  "dashboard.connect_remote_button": "Conectar remoto",
+  "dashboard.connected": "Conectado",
+  "dashboard.connecting": "Conectando...",
+  "dashboard.create_local_workspace_subtitle": "Crie um workspace neste dispositivo e, opcionalmente, comece a partir de um template de equipe.",
+  "dashboard.create_local_workspace_title": "Workspace local",
+  "dashboard.create_remote_custom_subtitle": "Conecte a um worker OpenWork auto-hospedado.",
+  "dashboard.create_remote_custom_title": "Conectar remoto personalizado",
+  "dashboard.create_remote_workspace_confirm": "Adicionar Workspace",
+  "dashboard.create_remote_workspace_subtitle": "Salvar um servidor OpenWork como workspace.",
+  "dashboard.create_remote_workspace_title": "Adicionar Workspace Remoto",
+  "dashboard.create_sandbox_confirm": "Criar como sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "Navegue por workers na nuvem compartilhados com sua organização e conecte em um passo.",
+  "dashboard.create_shared_subtitle_signed_out": "Entre no OpenWork Cloud para acessar workers compartilhados com sua organização.",
+  "dashboard.create_shared_title": "Workspaces compartilhados",
+  "dashboard.create_workspace_confirm": "Criar Workspace",
+  "dashboard.create_workspace_subtitle": "Inicializar um novo workspace baseado em pasta.",
+  "dashboard.create_workspace_title": "Criar Workspace",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Salvar conexão",
+  "dashboard.edit_remote_workspace_subtitle": "Atualizar os dados do servidor OpenWork para este workspace.",
+  "dashboard.edit_remote_workspace_title": "Editar Conexão Remota",
+  "dashboard.error_choose_org": "Escolha uma organização antes de abrir um workspace.",
+  "dashboard.error_connect_worker": "Falha ao conectar a {name}.",
+  "dashboard.error_load_orgs": "Falha ao carregar organizações.",
+  "dashboard.error_load_shared_workspaces": "Falha ao carregar workspaces compartilhados.",
+  "dashboard.error_workspace_not_ready": "O workspace ainda não está pronto para conectar. Tente novamente em instantes.",
+  "dashboard.import_config": "Importar config",
+  "dashboard.importing": "Importando…",
+  "dashboard.modal_back": "Voltar",
+  "dashboard.modal_close": "Fechar modal de adicionar workspace",
+  "dashboard.remote": "Remoto",
+  "dashboard.remote_base_url_required": "Adicione uma URL de servidor para continuar.",
+  "dashboard.remote_server_details_hint": "Conecte a um worker OpenWork auto-hospedado.",
+  "dashboard.remote_server_details_title": "Detalhes do servidor remoto",
+  "dashboard.sandbox_checking_docker": "Verificando Docker...",
+  "dashboard.sandbox_get_ready_title": "Sandboxes precisam do Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Atenção",
+  "dashboard.worker_status_ready": "Pronto",
+  "dashboard.worker_status_starting": "Iniciando",
+  "dashboard.worker_status_stopped": "Parado",
+  "dashboard.worker_status_unknown": "Desconhecido",
+  "den.active_org_hint": "Workers na nuvem e templates de equipe estão vinculados à organização selecionada.",
+  "den.active_org_title": "Organização ativa",
+  "den.auto_reconnect_hint": "Conclua a autenticação no navegador e o OpenWork reconectará aqui automaticamente.",
+  "den.checking_session": "Verificando sessão",
+  "den.choose_org_for_providers": "Escolha uma organização para ver provedores cloud.",
+  "den.choose_org_for_skill_hubs": "Escolha uma organização para ver hubs de skills cloud.",
+  "den.cloud_account_hint": "Gerencie sua conta conectada e organização.",
+  "den.cloud_account_title": "Conta Cloud",
+  "den.cloud_control_plane_open": "Abrir no navegador",
+  "den.cloud_control_plane_reset": "Redefinir",
+  "den.cloud_control_plane_save": "Salvar URL",
+  "den.cloud_control_plane_url_hint": "Apenas modo desenvolvedor. Use para apontar para um plano de controle Cloud local ou auto-hospedado. Alterá-lo desconecta você para que o app possa se re-hidratar no novo plano de controle.",
+  "den.cloud_control_plane_url_label": "URL do plano de controle Cloud",
+  "den.cloud_provider_detail": "{count} modelos · provedor {source}",
+  "den.cloud_provider_removed_detail": "Este provedor importado não está mais no cloud. Desinstale a configuração local {providerId}.",
+  "den.cloud_provider_sync_detail": "O provedor cloud mudou. Sincronize a configuração {source} com {count} modelos para o opencode.jsonc.",
+  "den.cloud_providers_hint": "Importe provedores LLM gerenciados para o opencode.jsonc e use a credencial da organização neste workspace.",
+  "den.cloud_providers_title": "Provedores cloud",
+  "den.cloud_section_desc": "Entre, escolha uma organização e abra workers Cloud ou templates de equipe.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Entre no OpenWork Cloud para manter suas tarefas ativas mesmo quando seu computador entrar em suspensão.",
+  "den.cloud_workers_hint": "Abra workers diretamente no OpenWork usando o mesmo fluxo de conexão remota que o app já usa.",
+  "den.cloud_workers_title": "Workers na nuvem",
+  "den.create_account": "Criar conta",
+  "den.credentials_ready_badge": "Credencial pronta",
+  "den.error_base_url": "Digite uma URL de plano de controle Cloud válida com http:// ou https://.",
+  "den.error_choose_org": "Escolha uma organização antes de abrir um worker.",
+  "den.error_load_orgs": "Falha ao carregar organizações.",
+  "den.error_load_workers": "Falha ao carregar workers.",
+  "den.error_no_session": "Nenhuma sessão Cloud ativa encontrada.",
+  "den.error_no_token": "Login no desktop concluído, mas o OpenWork Cloud não retornou um token de sessão.",
+  "den.error_open_worker": "Falha ao abrir {name} no OpenWork.",
+  "den.error_open_worker_fallback": "Falha ao abrir {name}.",
+  "den.error_paste_valid_code": "Cole um link de login do OpenWork válido ou um código de uso único.",
+  "den.error_signin_failed": "Falha ao concluir o login no OpenWork Cloud.",
+  "den.error_worker_not_ready": "O worker ainda não está pronto. Tente novamente após o provisionamento ser concluído.",
+  "den.finish_signin": "Concluir login",
+  "den.finishing": "Concluindo...",
+  "den.hide_signin_code": "Ocultar código de login",
+  "den.import_all": "Importar tudo",
+  "den.import_provider": "Importar",
+  "den.import_provider_failed": "Falha ao importar {name}.",
+  "den.imported_badge": "Importado",
+  "den.imported_provider": "{name} importado.",
+  "den.importing": "Importando…",
+  "den.needs_attention": "Requer atenção",
+  "den.no_cloud_providers": "Nenhum provedor cloud disponível para esta organização.",
+  "den.no_cloud_workers": "Nenhum worker na nuvem visível para esta organização ainda. Crie um no Cloud e atualize esta aba.",
+  "den.no_org_selected": "Nenhuma organização selecionada",
+  "den.no_skill_hubs": "Nenhum hub de skills cloud disponível para esta organização.",
+  "den.open": "Abrir",
+  "den.opening": "Abrindo...",
+  "den.org_member_suffix": "(Membro)",
+  "den.org_owner_suffix": "(Proprietário)",
+  "den.org_switched": "Alterado para {name}.",
+  "den.out_of_sync_badge": "Desatualizado",
+  "den.paste_signin_code": "Colar código de login",
+  "den.refresh": "Atualizar",
+  "den.reload_workspace": "Recarregue o workspace para aplicar as alterações.",
+  "den.remove_provider_failed": "Falha ao remover {name}.",
+  "den.removed_from_cloud_badge": "Removido do cloud",
+  "den.removed_provider": "{name} removido.",
+  "den.removing": "Removendo…",
+  "den.sign_out": "Sair",
+  "den.signed_out": "Desconectado",
+  "den.signin_button": "Entrar",
+  "den.signin_code_note": "Aceita um link openwork://den-auth ou o código de uso único.",
+  "den.signin_link_hint": "Se o navegador não redirecionar de volta para o OpenWork automaticamente, cole o link de login ou código de uso único do OpenWork Cloud aqui.",
+  "den.signin_link_label": "Link de login ou código de uso único",
+  "den.signin_link_placeholder": "openwork://den-auth?... ou código colado",
+  "den.signin_title": "Entrar no OpenWork Cloud",
+  "den.signing_in": "Concluindo login no OpenWork Cloud...",
+  "den.signing_out": "Saindo...",
+  "den.skill_hub_detail": "Importar {count} skills compartilhadas para .opencode/skills.",
+  "den.skill_hub_imported_detail": "Importadas {count} skills para este workspace.",
+  "den.skill_hub_removed_detail": "Este hub foi removido do cloud. Desinstale as {importedCount} skills importadas deste workspace.",
+  "den.skill_hub_skills_badge": "{count} skills",
+  "den.skill_hub_sync_detail": "O cloud agora tem {liveCount} skills; este workspace importou {importedCount}. Sincronize para atualizar.",
+  "den.skill_hubs_hint": "Importe todas as skills de um hub cloud compartilhado para este workspace de uma vez.",
+  "den.skill_hubs_title": "Hubs de skills",
+  "den.status_base_url_updated": "URL do plano de controle Cloud atualizada. Entre novamente para continuar.",
+  "den.status_browser_signin": "Conclua o login no navegador para conectar o OpenWork.",
+  "den.status_browser_signup": "Conclua a criação da conta no navegador para conectar o OpenWork.",
+  "den.status_cloud_signed_in_as": "OpenWork Cloud conectado como {email}.",
+  "den.status_cloud_signin_done": "OpenWork Cloud conectado.",
+  "den.status_loaded_orgs_one": "{count} org carregada.",
+  "den.status_loaded_orgs_other": "{count} orgs carregadas.",
+  "den.status_loaded_workers_one": "{count} worker carregado para {name}.",
+  "den.status_loaded_workers_other": "{count} workers carregados para {name}.",
+  "den.status_no_workers": "Nenhum worker encontrado para {name}.",
+  "den.status_opened_worker": "{name} aberto no OpenWork.",
+  "den.status_signed_in_as": "Conectado como {email}.",
+  "den.status_signed_out": "Saiu do OpenWork Cloud e a sessão foi limpa neste dispositivo.",
+  "den.sync": "Sincronizar",
+  "den.sync_provider_failed": "Falha ao sincronizar {name}.",
+  "den.synced_provider": "{name} sincronizado.",
+  "den.syncing": "Sincronizando…",
+  "den.uninstall": "Desinstalar",
+  "den.worker_mine_badge": "Meu",
+  "den.worker_not_ready_title": "Este worker ainda não está pronto para abrir.",
+  "den.worker_provider_label": "Worker {provider}",
+  "den.worker_secondary_cloud": "Worker na nuvem",
+  "extensions.app_count_one": "{count} app conectado",
+  "extensions.app_count_other": "{count} apps conectados",
+  "extensions.apps_mcp_header": "Apps (MCP)",
+  "extensions.filter_all": "Todos",
+  "extensions.filter_apps": "Apps",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count_one": "{count} plugin",
+  "extensions.plugin_count_other": "{count} plugins",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Apps (MCP) e plugins OpenCode ficam em um só lugar.",
+  "extensions.title": "Extensões",
+  "identities.agent_behavior_desc": "Um arquivo por workspace. Adicione uma primeira linha opcional @agent <id> para rotear via um agente OpenCode específico.",
+  "identities.agent_behavior_title": "Comportamento do agente de mensagens",
+  "identities.agent_created": "Arquivo padrão do agente de mensagens criado.",
+  "identities.agent_file_changed": "Arquivo alterado remotamente. Recarregue e salve novamente.",
+  "identities.agent_loading": "Carregando arquivo do agente…",
+  "identities.agent_none": "nenhum",
+  "identities.agent_not_found": "Arquivo do agente não encontrado neste workspace ainda.",
+  "identities.agent_saved": "Comportamento de mensagens salvo.",
+  "identities.agent_scope_status": "Escopo ativo: workspace · status: {status} · agente selecionado: {agent}",
+  "identities.agent_status_loaded": "carregado",
+  "identities.agent_status_missing": "ausente",
+  "identities.agent_worker_scope_unavailable": "Escopo do worker indisponível.",
+  "identities.all_channels": "Todos os canais",
+  "identities.app_token_label": "Token do app",
+  "identities.auto_bind_label": "Vincular peer ao diretório automaticamente ao enviar diretamente",
+  "identities.available_channels": "Canais disponíveis",
+  "identities.bot_token_label": "Token do bot",
+  "identities.bot_token_placeholder": "Cole o token do bot Telegram do @BotFather",
+  "identities.botfather_step1_open": "1. Abra o @BotFather no Telegram",
+  "identities.botfather_step1_run": "e execute /newbot",
+  "identities.botfather_step3_choose": "3. Escolha um nome e username para seu bot",
+  "identities.botfather_step3_or_private": "para caixa aberta ou",
+  "identities.botfather_step3_private": "Privado",
+  "identities.botfather_step3_public": "Público",
+  "identities.botfather_step3_to_require": "para exigir",
+  "identities.channel_label": "Canal",
+  "identities.channels_connected": "conectados",
+  "identities.channels_label": "Canais",
+  "identities.configured_suffix": "configurado",
+  "identities.connect_server_desc": "As identidades ficam disponíveis quando você está conectado a um servidor OpenWork.",
+  "identities.connect_server_title": "Conectar a um servidor OpenWork",
+  "identities.connect_slack": "Conectar Slack",
+  "identities.connected_badge": "Conectado",
+  "identities.connecting": "Conectando...",
+  "identities.copy_bot_token_hint": "Copie o token do bot e cole abaixo.",
+  "identities.copy_code": "Copiar código",
+  "identities.create_default_file": "Criar arquivo padrão",
+  "identities.create_private_bot": "Criar bot privado",
+  "identities.create_public_bot": "Criar bot público",
+  "identities.days_ago": "{days}d atrás",
+  "identities.default_routing": "Roteamento padrão",
+  "identities.directory_label": "Diretório (opcional)",
+  "identities.disable_messaging": "Desativar mensagens",
+  "identities.disable_messaging_message": "Isso desativará as mensagens para este workspace. A configuração do Telegram e Slack ficará oculta até que as mensagens sejam reativadas, e você precisará reiniciar o worker para parar completamente o sidecar de mensagens.",
+  "identities.disable_messaging_title": "Desativar mensagens para este worker?",
+  "identities.disabled_label": "Desativado",
+  "identities.disabling": "Desativando...",
+  "identities.disconnect": "Desconectar",
+  "identities.dispatched_messages": "{sent}/{attempted} mensagens despachadas.",
+  "identities.enable_messaging": "Ativar mensagens",
+  "identities.enable_messaging_risk": "Mensagens podem expor este worker a comandos remotos. Se o bot for público ou comprometido, pode acessar arquivos, credenciais e chaves de API disponíveis neste worker.",
+  "identities.enable_messaging_title": "Ativar mensagens para este worker?",
+  "identities.enabled_label": "Ativado",
+  "identities.enabling": "Ativando...",
+  "identities.health_offline": "Offline",
+  "identities.health_running": "Em execução",
+  "identities.health_unavailable": "Indisponível",
+  "identities.health_unknown": "Desconhecido",
+  "identities.hours_ago": "{hours}h atrás",
+  "identities.identities_label": "Identidades",
+  "identities.just_now": "Agora mesmo",
+  "identities.last_activity": "Última atividade",
+  "identities.later": "Depois",
+  "identities.message_label": "Mensagem",
+  "identities.message_routing_desc": "Controle quais conversas vão para qual pasta do workspace. Mensagens são roteadas para a pasta padrão do worker, a menos que você configure regras aqui.",
+  "identities.message_routing_title": "Roteamento de mensagens",
+  "identities.messages_today": "Mensagens hoje",
+  "identities.messaging_disabled_hint": "Ative as mensagens apenas se entender o risco e planejar proteger o acesso (por exemplo, emparelhamento privado do Telegram).",
+  "identities.messaging_disabled_restart": "Mensagens desativadas. Reinicie este worker para parar o sidecar de mensagens.",
+  "identities.messaging_disabled_risk": "Bots de mensagens podem executar ações contra seu worker local. Se expostos publicamente, podem permitir acesso a arquivos, credenciais e chaves de API disponíveis neste worker.",
+  "identities.messaging_disabled_title": "Mensagens desativadas por padrão",
+  "identities.messaging_enabled_restart": "Mensagens ativadas. Reinicie este worker para iniciar o sidecar de mensagens e desbloquear a configuração do Telegram e Slack.",
+  "identities.messaging_sidecar_not_running": "Mensagens estão ativadas neste workspace, mas o sidecar de mensagens ainda não está em execução. Reinicie este worker e volte às configurações de Mensagens para conectar o Telegram ou Slack.",
+  "identities.minutes_ago": "{minutes}m atrás",
+  "identities.not_set": "Não definido",
+  "identities.open_bot_link": "Abrir @{username} no Telegram",
+  "identities.pairing_code_copied": "Código de emparelhamento copiado.",
+  "identities.pairing_code_copy_failed": "Não foi possível copiar o código de emparelhamento. Copie manualmente.",
+  "identities.pairing_code_instruction_prefix": "Envie",
+  "identities.peer_id_label": "ID do peer (opcional)",
+  "identities.peer_id_placeholder_slack": "ex: slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "ex: telegram:123456789",
+  "identities.private_label": "Privado",
+  "identities.private_pairing_code": "Código de emparelhamento privado",
+  "identities.public_bot_confirm": "Sim, entendo o risco",
+  "identities.public_bot_warning_message": "Seu bot será acessível ao público e qualquer pessoa que obter acesso ao bot terá acesso total ao seu worker local, incluindo arquivos e chaves de API que você concedeu. Se criar um bot privado, você pode limitar quem pode acessá-lo exigindo um token de emparelhamento. Tem certeza de que deseja tornar seu bot público?",
+  "identities.public_bot_warning_title": "Tornar este bot público?",
+  "identities.public_label": "Público",
+  "identities.quick_setup": "Configuração rápida",
+  "identities.reconnect_failed": "Falha ao reconectar. Verifique a URL/token do OpenWork e tente novamente.",
+  "identities.reconnected": "Reconectado.",
+  "identities.reconnected_refreshing": "Reconectado. Atualizando estado do worker...",
+  "identities.reload": "Recarregar",
+  "identities.repair_reconnect": "Reparar e reconectar",
+  "identities.restart_failed": "Falha ao reiniciar. Reinicie o worker nas Configurações e tente novamente.",
+  "identities.restart_to_disable_messaging": "Mensagens foram desativadas para este workspace. Reinicie o worker agora para parar o sidecar de mensagens.",
+  "identities.restart_to_enable_messaging": "Mensagens foram ativadas para este workspace. Reinicie o worker agora para iniciar o sidecar de mensagens e desbloquear a configuração do Telegram e Slack.",
+  "identities.restart_worker": "Reiniciar worker",
+  "identities.restart_worker_title": "Reiniciar worker agora?",
+  "identities.restarting": "Reiniciando...",
+  "identities.routing_override_prefix": "Todas as mensagens roteadas para",
+  "identities.routing_override_suffix": "(substituição ativa)",
+  "identities.running_label": "Em execução",
+  "identities.save_behavior": "Salvar comportamento",
+  "identities.saving": "Salvando...",
+  "identities.send_test_button": "Enviar mensagem de teste",
+  "identities.send_test_desc": "Validar a conexão de saída. Use um ID de peer para envio direto ou deixe o ID de peer vazio para distribuir por bindings em um diretório.",
+  "identities.send_test_title": "Enviar mensagem de teste",
+  "identities.sending": "Enviando...",
+  "identities.slack_desc": "Seu worker aparece como um bot nos canais do Slack. Membros da equipe podem enviar mensagens diretamente ou mencioná-lo em threads.",
+  "identities.slack_intro": "Conecte seu workspace do Slack para que membros da equipe interajam com este worker em canais e DMs.",
+  "identities.slack_unavailable": "Identidades do Slack indisponíveis.",
+  "identities.status_active": "Ativo",
+  "identities.status_label": "Status",
+  "identities.status_stopped": "Parado",
+  "identities.stopped_label": "Parado",
+  "identities.subtitle": "Permita que pessoas alcancem seu worker por apps de mensagens. Conecte um canal e seu worker lerá e responderá mensagens automaticamente.",
+  "identities.tab_general": "Geral",
+  "identities.telegram_bot_access_desc": "Bot público: o primeiro chat do Telegram vincula automaticamente. Bot privado: requer código de emparelhamento antes de qualquer mensagem executar ferramentas.",
+  "identities.telegram_delete_failed": "Falha ao excluir.",
+  "identities.telegram_deleted": "Excluído.",
+  "identities.telegram_deleted_pending": "Excluído (pendente aplicação).",
+  "identities.telegram_desc": "Conecte um bot Telegram em modo público (caixa aberta) ou modo privado (código de emparelhamento obrigatório).",
+  "identities.telegram_private_saved_pair": "Bot privado salvo. Emparelhe via /pair {code}",
+  "identities.telegram_save_failed": "Falha ao salvar.",
+  "identities.telegram_saved": "Salvo.",
+  "identities.telegram_saved_pending": "Salvo (pendente aplicação).",
+  "identities.telegram_saved_username": "Salvo (@{username})",
+  "identities.telegram_unavailable": "Identidades do Telegram indisponíveis.",
+  "identities.title": "Canais de mensagens",
+  "identities.unsaved_changes": "Alterações não salvas",
+  "identities.worker_offline": "Worker offline",
+  "identities.worker_online": "Worker online",
+  "identities.worker_restarted": "Worker reiniciado.",
+  "identities.worker_restarted_refreshing": "Worker reiniciado. Atualizando status de mensagens...",
+  "identities.worker_scope_unavailable": "Escopo do worker indisponível.",
+  "identities.worker_scope_unavailable_detail": "Escopo do worker indisponível. Reconecte usando uma URL de worker ou mude para um worker conhecido.",
+  "identities.worker_unavailable": "Worker indisponível",
+  "identities.workspace_id_required": "O ID do workspace é obrigatório para gerenciar identidades. Reconecte com uma URL de workspace ou selecione um workspace mapeado neste host.",
+  "identities.workspace_scope_prefix": "Escopo do workspace:",
+  "mcp.add_modal_subtitle": "Conecte um servidor MCP personalizado por URL ou comando local.",
+  "mcp.add_modal_title": "Adicionar App Personalizado",
+  "mcp.add_server_button": "Adicionar app",
+  "mcp.advanced": "Avançado",
+  "mcp.advanced_settings": "Configurações avançadas",
+  "mcp.advanced_settings_hint": "Edite arquivos de configuração e gerencie conexões manualmente.",
+  "mcp.app_connected": "app conectado",
+  "mcp.apps_connected": "apps conectados",
+  "mcp.apps_subtitle": "Conecte suas ferramentas favoritas para que o OpenWork as use em seu nome.",
+  "mcp.apps_title": "Apps",
+  "mcp.auth.already_connected": "Já Conectado",
+  "mcp.auth.already_connected_description": "{server} já está autenticado e pronto para uso.",
+  "mcp.auth.applying_changes_body": "Estamos reiniciando o worker para que o novo MCP esteja pronto para autenticar.",
+  "mcp.auth.applying_changes_title": "Aplicando alterações antes do login",
+  "mcp.auth.authorization_link": "Link de autorização",
+  "mcp.auth.authorization_still_required": "A autorização ainda é necessária. Tente novamente para reiniciar o fluxo.",
+  "mcp.auth.callback_invalid": "Cole a URL de callback ou o parâmetro de código para concluir o OAuth.",
+  "mcp.auth.callback_label": "URL de callback ou código",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Cancelar",
+  "mcp.auth.client_registration_required": "O registro do cliente é necessário antes de continuar com o OAuth.",
+  "mcp.auth.complete_connection": "Concluir conexão",
+  "mcp.auth.configured_previously": "O MCP pode ter sido configurado globalmente ou em uma sessão anterior. Você pode fechar este modal e começar a usar as ferramentas MCP imediatamente.",
+  "mcp.auth.connect_server": "Conectar {server}",
+  "mcp.auth.copied": "Copiado",
+  "mcp.auth.copy_link": "Copiar link",
+  "mcp.auth.done": "Concluído",
+  "mcp.auth.failed_to_start_oauth": "Falha ao iniciar fluxo OAuth",
+  "mcp.auth.follow_browser_steps": "Siga os passos de autorização no navegador.",
+  "mcp.auth.force_stop": "Forçar parada",
+  "mcp.auth.force_stopping": "Parando...",
+  "mcp.auth.im_done": "Terminei",
+  "mcp.auth.invalid_refresh_token": "O token de atualização OAuth é inválido ou expirou. Reautorize para continuar.",
+  "mcp.auth.manual_finish_hint": "Cole a URL de callback (localhost:19876) ou apenas o código para concluir a conexão.",
+  "mcp.auth.manual_finish_title": "Servidor remoto?",
+  "mcp.auth.oauth_completed_reload": "OAuth concluído. Recarregue o engine para ativar o MCP.",
+  "mcp.auth.oauth_failed": "Falha na autenticação OAuth.",
+  "mcp.auth.oauth_not_supported_hint": "Isso pode significar:\n• O servidor MCP não anuncia capacidades OAuth\n• O engine precisa recarregar para descobrir as capacidades do servidor\n• Tente: opencode mcp auth {server} pela CLI",
+  "mcp.auth.open_browser_signin": "Abriremos seu navegador para concluir o login.",
+  "mcp.auth.port_forward_hint": "Dica: encaminhe a porta de callback se necessário: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "Reautorizar OAuth",
+  "mcp.auth.reauth_cli_hint": "Execute: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "Falha na reautorização.",
+  "mcp.auth.reauth_remote_hint": "Reautorize a partir da máquina que executa este worker.",
+  "mcp.auth.reauth_running": "Reautorizando...",
+  "mcp.auth.reload_blocked": "O recarregamento está pausado enquanto uma sessão está em execução. Pare a execução para concluir a configuração.",
+  "mcp.auth.reload_engine_retry": "Aplicar alterações e tentar novamente",
+  "mcp.auth.reload_failed": "Falha ao recarregar o worker antes do login.",
+  "mcp.auth.reload_notice": "Para isso ter efeito, o OpenWork precisa reiniciar o serviço worker. Isso pode interromper uma sessão em andamento.",
+  "mcp.auth.reload_remote_confirm": "Para isso ter efeito, o OpenWork precisa reiniciar o serviço worker. Isso pode parar sua sessão em andamento. Continuar?",
+  "mcp.auth.reopen_browser_link": "Clique aqui para reabrir o navegador",
+  "mcp.auth.request_timed_out": "Tempo da solicitação expirou.",
+  "mcp.auth.retry": "Tentar novamente",
+  "mcp.auth.retry_now": "Tentar Agora",
+  "mcp.auth.server_disabled": "Este servidor MCP está desativado. Ative-o e tente novamente.",
+  "mcp.auth.step1_description": "Iniciaremos o fluxo de login do {server} automaticamente.",
+  "mcp.auth.step1_title": "Abrindo seu navegador",
+  "mcp.auth.step2_description": "Entre e aprove o acesso quando solicitado.",
+  "mcp.auth.step2_title": "Autorizar o OpenWork",
+  "mcp.auth.step3_description": "Concluiremos a conexão assim que a autorização for completada.",
+  "mcp.auth.step3_title": "Volte aqui quando terminar",
+  "mcp.auth.try_reload_engine": "{message}. Tente recarregar o engine primeiro.",
+  "mcp.auth.waiting_authorization": "Aguardando a autorização ser concluída no seu navegador...",
+  "mcp.auth.waiting_for_conversation_body": "Vamos redirecioná-lo para autenticar assim que possível.",
+  "mcp.auth.waiting_for_conversation_title": "Aguardando conversa ser concluída",
+  "mcp.auth.waiting_for_session": "Aguardando {session} terminar",
+  "mcp.available_apps": "Apps disponíveis",
+  "mcp.cap_signin": "Login na conta",
+  "mcp.cap_tools": "Ferramentas de IA",
+  "mcp.config_file": "Arquivo de configuração",
+  "mcp.config_load_failed": "Não foi possível carregar o arquivo de configuração",
+  "mcp.config_not_loaded": "Ainda não carregado",
+  "mcp.connect": "Conectar",
+  "mcp.connect_failed": "Não foi possível conectar. Tente novamente.",
+  "mcp.connect_server_first": "Conecte ao servidor primeiro.",
+  "mcp.connected": "Conectado",
+  "mcp.connected_badge": "Conectado",
+  "mcp.connection_failed": "Problema de conexão, tente novamente",
+  "mcp.connection_type": "Conexão",
+  "mcp.control_chrome_browser_hint": "No Chrome 144 ou mais recente, faça isso primeiro:",
+  "mcp.control_chrome_browser_step_one": "Abra chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Ative a depuração remota.",
+  "mcp.control_chrome_browser_step_three": "Permita conexões de depuração quando o Chrome solicitar.",
+  "mcp.control_chrome_browser_title": "1. Ativar acesso ao Chrome",
+  "mcp.control_chrome_connect": "Adicionar Control Chrome",
+  "mcp.control_chrome_docs": "Guia oficial do MCP",
+  "mcp.control_chrome_edit": "Editar configurações",
+  "mcp.control_chrome_profile_hint": "O Control Chrome normalmente abre um perfil separado do Chrome. Ative isso se quiser que o OpenWork reutilize a janela do Chrome que você já tem aberta.",
+  "mcp.control_chrome_profile_title": "2. Escolher qual Chrome usar",
+  "mcp.control_chrome_save": "Salvar configurações",
+  "mcp.control_chrome_setup_subtitle": "Ative o acesso ao Chrome e escolha se o OpenWork deve usar seu próprio perfil limpo ou se conectar ao Chrome que você já usa.",
+  "mcp.control_chrome_setup_title": "Configurar Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Quando ativado, o OpenWork adiciona --autoConnect para que o MCP se conecte a uma instância do Chrome que você já iniciou.",
+  "mcp.control_chrome_toggle_label": "Usar meu perfil existente do Chrome",
+  "mcp.control_chrome_toggle_off": "O OpenWork abrirá um perfil separado do Chrome apenas para automação.",
+  "mcp.control_chrome_toggle_on": "O OpenWork reutilizará suas abas, cookies e logins atuais.",
+  "mcp.custom_app_cta_hint": "Conecte seu próprio servidor MCP, ferramenta interna ou app hospedado.",
+  "mcp.desktop_required": "Apps requerem o app desktop.",
+  "mcp.docs_link": "Saiba mais",
+  "mcp.file_not_found": "Arquivo de configuração ainda não criado",
+  "mcp.friendly_status_issue": "Problema",
+  "mcp.friendly_status_needs_signin": "Login necessário",
+  "mcp.friendly_status_offline": "Offline",
+  "mcp.friendly_status_paused": "Pausado",
+  "mcp.friendly_status_ready": "Pronto",
+  "mcp.last_synced": "Sincronizado",
+  "mcp.login_action": "Entrar",
+  "mcp.login_hint": "Conecte sua conta para terminar de configurar este app.",
+  "mcp.login_unavailable": "Este app não suporta login pelo OpenWork.",
+  "mcp.logout_action": "Sair",
+  "mcp.logout_failed": "Falha ao sair.",
+  "mcp.logout_hint": "Remove as credenciais OAuth armazenadas. Você precisará entrar novamente.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Isso removerá as credenciais OAuth armazenadas para {server}. Você precisará entrar novamente para usar este app.",
+  "mcp.logout_modal_title": "Sair deste app?",
+  "mcp.logout_success": "Saiu de {server}.",
+  "mcp.logout_working": "Saindo...",
+  "mcp.name_required": "Digite um nome para o servidor.",
+  "mcp.no_apps_hint": "Conecte um acima para começar.",
+  "mcp.no_apps_yet": "Nenhum app conectado ainda",
+  "mcp.oauth": "Entrar",
+  "mcp.oauth_optional_hint": "Usa OAuth no navegador para conectar sua conta.",
+  "mcp.oauth_optional_label": "Este app exige login",
+  "mcp.one_click_connect": "Conectar com um clique",
+  "mcp.open_file": "Abrir arquivo",
+  "mcp.opening_label": "Abrindo...",
+  "mcp.pick_workspace_error": "Escolha primeiro uma pasta de workspace.",
+  "mcp.pick_workspace_first": "Escolha primeiro uma pasta de workspace.",
+  "mcp.quick_connect_chrome_desc": "Controle abas do Chrome com automação de navegador.",
+  "mcp.quick_connect_chrome_title": "Controlar Chrome",
+  "mcp.quick_connect_context7_desc": "Pesquise docs de produto com contexto mais rico.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Planeje sprints e resolva tickets mais rápido.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Páginas, bancos de dados e docs de projeto sincronizados.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Acompanhe releases e resolva erros de produção.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Inspecione pagamentos, faturas e assinaturas.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Pare a tarefa em execução para ativar.",
+  "mcp.remote_workspace_url_hint": "Workers remotos se conectam mais rápido com servidores MCP baseados em URL.",
+  "mcp.remove_app": "Remover",
+  "mcp.remove_failed": "Não foi possível remover o app.",
+  "mcp.remove_modal_message": "Tem certeza que deseja remover {server}? Você pode adicioná-lo de volta a qualquer momento.",
+  "mcp.remove_modal_title": "Remover app",
+  "mcp.reveal_config_failed": "Não foi possível abrir o arquivo de configuração",
+  "mcp.reveal_in_finder": "Mostrar no Finder",
+  "mcp.scope_global": "Todos os workspaces",
+  "mcp.scope_project": "Este workspace",
+  "mcp.server_command": "Comando",
+  "mcp.server_command_hint": "O comando shell para iniciar o servidor.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Nome do app",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Tipo",
+  "mcp.server_url": "URL do servidor",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Login",
+  "mcp.tap_to_connect": "Toque para conectar",
+  "mcp.technical_details": "Detalhes técnicos",
+  "mcp.type_cloud": "Nuvem (entrar com sua conta)",
+  "mcp.type_local": "Local (roda neste dispositivo)",
+  "mcp.type_local_cmd": "Local (comando)",
+  "mcp.type_remote": "Remoto (URL)",
+  "mcp.url_or_command_required": "Digite uma URL para servidores remotos ou um comando para servidores locais.",
+  "mcp.your_apps": "Seus apps",
+  "model_behavior.desc_builtin": "Este modelo decide seu próprio caminho de raciocínio e não expõe perfis aqui.",
+  "model_behavior.desc_generic": "Usar o perfil {label}.",
+  "model_behavior.desc_high": "Dedicar mais tempo ao raciocínio antes de responder.",
+  "model_behavior.desc_high_anthropic": "Usar o orçamento padrão de extended thinking.",
+  "model_behavior.desc_low": "Usar um passo de raciocínio mais leve antes de responder.",
+  "model_behavior.desc_low_google": "Usar um orçamento de raciocínio mais leve para respostas rápidas.",
+  "model_behavior.desc_max": "Usar o perfil de raciocínio mais profundo do provedor.",
+  "model_behavior.desc_max_anthropic": "Usar o maior orçamento de extended thinking disponível.",
+  "model_behavior.desc_medium": "Equilibrar velocidade e profundidade de raciocínio.",
+  "model_behavior.desc_minimal": "Usar uma quantidade mínima de raciocínio.",
+  "model_behavior.desc_none": "Priorizar velocidade com o caminho de raciocínio mais leve.",
+  "model_behavior.desc_standard": "Este modelo não expõe controles de raciocínio extras.",
+  "model_behavior.label_balanced": "Equilibrado",
+  "model_behavior.label_builtin": "Integrado",
+  "model_behavior.label_deep": "Profundo",
+  "model_behavior.label_extended": "Estendido",
+  "model_behavior.label_fast": "Rápido",
+  "model_behavior.label_light": "Leve",
+  "model_behavior.label_maximum": "Máximo",
+  "model_behavior.label_quick": "Ágil",
+  "model_behavior.label_standard": "Padrão",
+  "model_behavior.title_builtin_reasoning": "Raciocínio integrado",
+  "model_behavior.title_extended_thinking": "Extended thinking",
+  "model_behavior.title_reasoning_budget": "Reasoning budget",
+  "model_behavior.title_reasoning_effort": "Reasoning effort",
+  "model_behavior.title_standard_generation": "Geração padrão",
+  "model_picker.chat_model_desc": "Escolha o modelo para este chat. Se o modelo suportar perfis de raciocínio, configure-os no cartão.",
+  "model_picker.chat_model_title": "Modelo do chat",
+  "model_picker.connect_provider_hint": "Conecte este provedor para explorar e salvar modelos",
+  "model_picker.default_model_desc": "Escolha o modelo padrão para novos chats e ajuste os perfis de raciocínio no cartão antes de clicar em Concluído.",
+  "model_picker.default_model_title": "Modelo padrão",
+  "model_picker.model_count_one": "{count} modelo",
+  "model_picker.model_count_other": "{count} modelos",
+  "model_picker.more_providers": "Mais provedores",
+  "model_picker.no_results": "Nenhum modelo corresponde à sua busca.",
+  "model_picker.other_connected_models": "Outros modelos conectados",
+  "model_picker.recommended": "Recomendado",
+  "onboarding.authorize_folder": "Autorizar pasta",
+  "plugins.add": "Adicionar",
+  "plugins.add_hint": "Adicione nomes de pacotes npm, ex: opencode-wakatime",
+  "plugins.add_label": "Adicionar plugin",
+  "plugins.added": "Adicionado",
+  "plugins.config": "Config",
+  "plugins.config_label": "Config",
+  "plugins.desc": "Gerenciar `opencode.json` para plugins do projeto ou globais do OpenCode.",
+  "plugins.empty": "Nenhum plugin configurado ainda.",
+  "plugins.enabled": "Ativado",
+  "plugins.hide_setup": "Ocultar configuração",
+  "plugins.not_loaded": "Ainda não carregado",
+  "plugins.not_loaded_yet": "Ainda não carregado",
+  "plugins.remove": "Remover",
+  "plugins.scope_global": "Global",
+  "plugins.scope_project": "Projeto",
+  "plugins.setup": "Configurar",
+  "plugins.suggested": "Plugins sugeridos",
+  "plugins.suggested_heading": "Plugins sugeridos",
+  "plugins.title": "Plugins OpenCode",
+  "providers.api_key_label": "Chave de API",
+  "providers.api_key_required": "A chave de API é obrigatória",
+  "providers.auth_failed": "Falha na autenticação",
+  "providers.connect_failed": "Falha ao conectar provedor",
+  "providers.disabled_in_config_suffix": "e desativado na configuração do OpenCode.",
+  "providers.disconnect_failed": "Falha ao desconectar provedor",
+  "providers.disconnected_prefix": "Desconectado",
+  "providers.load_failed": "Falha ao carregar provedores",
+  "providers.no_oauth_prefix": "Nenhum fluxo OAuth disponível para",
+  "providers.no_providers_available": "Nenhum provedor disponível",
+  "providers.not_connected": "Não conectado a um servidor",
+  "providers.not_oauth_flow_prefix": "O método de autenticação selecionado não é um fluxo OAuth para",
+  "providers.oauth_failed": "Falha ao concluir OAuth",
+  "providers.oauth_method_required": "O método OAuth é obrigatório",
+  "providers.provider_error": "Erro do provedor ({provider})",
+  "providers.provider_id_required": "O ID do provedor é obrigatório",
+  "providers.rate_limit_exceeded": "Limite de requisições excedido",
+  "providers.removal_unsupported": "A remoção da autenticação do provedor não é suportada por este cliente.",
+  "providers.request_failed": "Falha na requisição",
+  "providers.save_api_key_failed": "Falha ao salvar chave de API",
+  "providers.still_connected_suffix": ", mas o worker ainda reporta como conectado. Limpe qualquer chave de API ou credenciais OAuth restantes e reinicie o worker para desconectar completamente.",
+  "providers.unknown_provider": "Provedor desconhecido",
+  "providers.use_api_key_suffix": "Use uma chave de API em vez disso.",
+  "question_modal.custom_answer_label": "Ou digite uma resposta personalizada",
+  "question_modal.custom_answer_placeholder": "Digite sua resposta aqui...",
+  "question_modal.question_counter": "Pergunta {current} de {total}",
+  "session.allow_for_session": "Permitir para esta sessão",
+  "session.allow_once": "Permitir uma vez",
+  "session.cmd_current_workspace": "Workspace atual",
+  "session.cmd_new_session_detail": "Iniciar uma nova tarefa no workspace atual",
+  "session.cmd_new_session_meta": "Criar",
+  "session.cmd_new_session_title": "Criar nova sessão",
+  "session.cmd_sessions_detail": "{count} disponíveis nos workspaces",
+  "session.cmd_sessions_meta": "Ir",
+  "session.cmd_sessions_title": "Buscar sessões",
+  "session.cmd_switch": "Alternar",
+  "session.create_or_connect_workspace": "Criar ou conectar um workspace",
+  "session.default_agent": "Agente padrão",
+  "session.default_title": "Nova sessão",
+  "session.delete": "Excluir",
+  "session.delete_named_session_message": "Isso excluirá permanentemente \"{title}\" e suas mensagens.",
+  "session.delete_session_generic": "Isso excluirá permanentemente a sessão selecionada e suas mensagens.",
+  "session.delete_session_title": "Excluir sessão?",
+  "session.deleting": "Excluindo...",
+  "session.deny": "Negar",
+  "session.details": "Detalhes",
+  "session.details_label": "Detalhes",
+  "session.doom_loop_label": "Loop Infinito",
+  "session.doom_loop_message": "O OpenCode detectou chamadas de ferramenta repetidas com a mesma entrada e está perguntando se deve continuar após falhas repetidas.",
+  "session.doom_loop_note": "Rejeite para parar o loop ou permita se quiser que o agente continue tentando.",
+  "session.doom_loop_repeated_call_label": "Chamada repetida",
+  "session.doom_loop_repeated_tool_call": "Chamada de ferramenta repetida",
+  "session.doom_loop_title": "Loop Infinito Detectado",
+  "session.doom_loop_tool_label": "Ferramenta",
+  "session.export_already_running": "Exportação já em andamento.",
+  "session.export_desktop_only": "Exportação disponível apenas no app desktop.",
+  "session.export_desktop_only_local": "Exportação disponível para workers locais no app desktop.",
+  "session.export_local_only": "Exportação disponível apenas para workers locais.",
+  "session.loading_detail": "Buscando as últimas mensagens desta tarefa.",
+  "session.model": "Modelo",
+  "session.new_task": "Nova tarefa",
+  "session.open": "Abrir",
+  "session.palette_hint_navigate": "Setas para navegar",
+  "session.palette_hint_run": "Enter para executar · Esc para fechar",
+  "session.palette_placeholder_actions": "Buscar ações",
+  "session.palette_placeholder_sessions": "Buscar por título de sessão ou workspace",
+  "session.palette_title_actions": "Ações rápidas",
+  "session.palette_title_sessions": "Buscar sessões",
+  "session.permission_detail_command": "Comando",
+  "session.permission_detail_cwd": "Diretório de trabalho",
+  "session.permission_detail_description": "Descrição",
+  "session.permission_detail_diff": "Diff",
+  "session.permission_detail_file": "Arquivo",
+  "session.permission_detail_files": "Arquivos",
+  "session.permission_detail_agent": "Agente",
+  "session.permission_detail_parent_directory": "Diretório pai",
+  "session.permission_detail_path": "Caminho",
+  "session.permission_detail_query": "Consulta",
+  "session.permission_detail_target": "Destino",
+  "session.permission_detail_tool": "Ferramenta",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Edição de arquivo",
+  "session.permission_kind_external_directory": "Diretório externo",
+  "session.permission_kind_question": "Pergunta",
+  "session.permission_kind_read": "Leitura de arquivo",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Subtarefa",
+  "session.permission_kind_todowrite": "Escrita de tarefas",
+  "session.permission_label": "Permissão",
+  "session.permission_message": "O OpenCode está solicitando permissão para continuar.",
+  "session.permission_message_bash": "Revise o escopo do comando antes de permitir que o OpenCode continue.",
+  "session.permission_message_edit": "Revise o arquivo e o diff antes de permitir que o OpenCode faça alterações.",
+  "session.permission_message_external_directory": "Revise a pasta antes de permitir acesso fora do workspace.",
+  "session.permission_message_read": "Revise o escopo de arquivos solicitado antes de permitir o acesso.",
+  "session.permission_message_task": "Revise a subtarefa solicitada antes de permitir que ela comece.",
+  "session.permission_metadata_unavailable": "Não foi possível exibir os metadados.",
+  "session.permission_review_label": "Revisão",
+  "session.permission_scope_empty": "Nenhum escopo específico foi fornecido.",
+  "session.permission_decision_hint": "Permita uma vez para esta solicitação, ou pela sessão quando confiar neste escopo.",
+  "session.permission_title_bash": "Executar um comando de shell?",
+  "session.permission_title_edit": "Modificar arquivos?",
+  "session.permission_title_external_directory": "Acessar uma pasta externa?",
+  "session.permission_title_generic": "Aprovar {permission}?",
+  "session.permission_title_read": "Ler arquivos?",
+  "session.permission_title_task": "Iniciar uma subtarefa?",
+  "session.redo_aria_label": "Refazer última mensagem revertida",
+  "session.redo_label": "Refazer",
+  "session.redo_title": "Refazer última mensagem revertida",
+  "session.rename_description": "Atualizar o nome desta sessão.",
+  "session.rename_label": "Nome da sessão",
+  "session.rename_placeholder": "Digite um novo nome",
+  "session.rename_title": "Renomear sessão",
+  "session.resize_workspace_column": "Redimensionar coluna do workspace",
+  "session.revert_label": "Reverter",
+  "session.scope_label": "Escopo",
+  "session.share_collaborator_hint": "Acesso remoto rotineiro quando você não precisa de ações exclusivas do proprietário.",
+  "session.share_collaborator_host_hint": "Acesso remoto rotineiro a este host sem ações exclusivas do proprietário.",
+  "session.share_collaborator_label": "Token de colaborador",
+  "session.share_connected_with_hint": "Este workspace está conectado com esta senha.",
+  "session.share_desktop_app_required": "Requer o app desktop",
+  "session.share_local_host_not_ready": "O host local do OpenWork ainda não está pronto.",
+  "session.share_missing_host_url": "URL do host OpenWork ausente.",
+  "session.share_missing_token": "Token do OpenWork ausente.",
+  "session.share_note_direct_runtime": "O runtime do engine está em modo Direto. Alternar workers locais pode reiniciar o host e desconectar clientes. O token pode mudar após a reinicialização.",
+  "session.share_opencode_base_url": "URL base do OpenCode",
+  "session.share_openwork_workers_only": "Links de compartilhamento estão disponíveis para workers OpenWork.",
+  "session.share_owner_permission_hint": "Use quando o cliente remoto precisar responder a prompts de permissão.",
+  "session.share_password": "Senha",
+  "session.share_select_workspace": "Selecione um workspace primeiro.",
+  "session.share_set_token_hint": "Definir token nas configurações do workspace",
+  "session.share_starting_server": "Iniciando servidor...",
+  "session.share_worker_url": "URL do worker",
+  "session.share_worker_url_phones_hint": "Use em celulares ou laptops conectando a este worker.",
+  "session.share_worker_url_resolving_hint": "URL do worker está sendo resolvida; URL do host exibida como alternativa.",
+  "session.todo_progress": "{completed} de {total} tarefas concluídas",
+  "session.undo_label": "Reverter",
+  "session.undo_title": "Desfazer última mensagem",
+  "session.workspace_fallback": "Workspace",
+  "settings.api_keys_info": "As chaves de API são armazenadas localmente pelo OpenCode. Provedores baseados em variáveis de ambiente devem ser alterados no ambiente do worker e recarregados.",
+  "settings.appearance_hint": "Seguir o sistema ou forçar modo claro/escuro.",
+  "settings.appearance_title": "Aparência",
+  "settings.audit_log_title": "Log de auditoria",
+  "settings.auto_compact": "Compactação automática de contexto",
+  "settings.auto_compact_desc": "Controla a compactação automática do OpenCode para este workspace. Recarregue o engine após alterar.",
+  "settings.auto_update_desc": "Baixar atualizações automaticamente (solicita para",
+  "settings.auto_update_title": "Atualização automática",
+  "settings.background_checks_desc": "O OpenWork sempre verifica ao iniciar. Também verifica uma vez",
+  "settings.background_checks_title": "Verificações em segundo plano",
+  "settings.cache_repair_requires_desktop": "O reparo de cache requer o app desktop",
+  "settings.cap_browser_tools": "Ferramentas do navegador: {value}",
+  "settings.cap_commands": "Comandos: {value}",
+  "settings.cap_config": "Config: {value}",
+  "settings.cap_file_tools": "Ferramentas de arquivo: {value}",
+  "settings.cap_inbox_off": "inbox desativado",
+  "settings.cap_inbox_on": "inbox ativado",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "outbox desativado",
+  "settings.cap_outbox_on": "outbox ativado",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "leitura",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "escrita",
+  "settings.capabilities_title": "Capacidades do servidor OpenWork",
+  "settings.capabilities_unavailable": "Capacidades indisponíveis. Conecte com um token de cliente.",
+  "settings.change": "Alterar",
+  "settings.choose": "Escolher",
+  "settings.clear": "Limpar",
+  "settings.configure": "Configurar",
+  "settings.connect_provider": "Conectar provedor",
+  "settings.connection": "Conexão",
+  "settings.connection_failed": "Falha na conexão",
+  "settings.connection_title": "Conexão",
+  "settings.copied_debug_report": "JSON do relatório de runtime copiado.",
+  "settings.copy_json": "Copiar JSON",
+  "settings.custom_binary_hint": "Use para apontar o OpenWork para um build local do OpenCode",
+  "settings.custom_binary_label": "Binário personalizado do OpenCode",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_desktop_app": "App desktop: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "Servidor OpenWork: {version}",
+  "settings.deeplink_hint": "Aceita openwork://, openwork-dev:// ou uma URL https://share.openworklabs.com/b/... raw suportada.",
+  "settings.delete_containers": "Removendo containers...",
+  "settings.delete_local_config": "Removendo estado local...",
+  "settings.dev_mode_badge": "Modo dev",
+  "settings.developer": "Desenvolvedor",
+  "settings.developer_mode_desc": "Ativa ferramentas de depuração, diagnósticos e a aba Desenvolvedor.",
+  "settings.developer_mode_title": "Modo desenvolvedor",
+  "settings.developer_panel_disabled": "Painel de desenvolvedor desativado.",
+  "settings.developer_panel_enabled": "Painel de desenvolvedor ativado.",
+  "settings.diag_approval": "Aprovação: {mode} ({ms}ms)",
+  "settings.diag_config_path": "Caminho da config: {path}",
+  "settings.diag_default": "padrão",
+  "settings.diag_host_token_source": "Origem do token do host: {source}",
+  "settings.diag_opencode_binary": "Binário OpenCode: {binary}",
+  "settings.diag_read_only": "Somente leitura: {value}",
+  "settings.diag_runtime_workspace": "Workspace de runtime: {id}",
+  "settings.diag_selected_workspace": "Workspace selecionado: {id}",
+  "settings.diag_started": "Iniciado: {time}",
+  "settings.diag_token_source": "Origem do token: {source}",
+  "settings.diag_workspaces": "Workspaces: {count}",
+  "settings.diagnostics_unavailable": "Diagnósticos indisponíveis.",
+  "settings.disable_developer_mode": "Desativar Modo Desenvolvedor",
+  "settings.disabled": "Desativado",
+  "settings.disconnect": "Desconectar",
+  "settings.disconnect_server": "Desconectar servidor",
+  "settings.disconnecting": "Desconectando...",
+  "settings.docker_containers_desc": "Forçar remoção de containers Docker iniciados pelo OpenWork",
+  "settings.docker_containers_title": "Containers Docker do OpenWork",
+  "settings.docker_requires_desktop": "A limpeza do Docker requer o app desktop",
+  "settings.done": "Concluído",
+  "settings.enable_developer_mode": "Ativar Modo Desenvolvedor",
+  "settings.enable_exa": "Ativar busca web Exa",
+  "settings.enable_exa_desc": "Aplica-se quando o OpenWork Orchestrator inicia o OpenCode.",
+  "settings.engine_bundled": "Integrado (recomendado)",
+  "settings.engine_bundled_hint": "O engine integrado é a opção mais confiável. Use Sistema",
+  "settings.engine_custom_binary": "Binário personalizado",
+  "settings.engine_desc": "Escolha como o OpenCode roda localmente.",
+  "settings.engine_source": "Fonte do engine",
+  "settings.engine_source_debug": "Fonte do engine",
+  "settings.engine_system_path": "Instalação do sistema (PATH)",
+  "settings.engine_title": "Engine",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "Reinicie o OpenCode ou o orchestrator após alterar esta configuração.",
+  "settings.export": "Exportar",
+  "settings.exported_debug_report": "JSON do relatório de runtime exportado.",
+  "settings.feedback_badge": "Lemos cada mensagem",
+  "settings.feedback_desc": "Conte-nos o que está ótimo e o que está difícil. O feedback vai direto para a equipe e nos ajuda a priorizar o que lançamos a seguir.",
+  "settings.feedback_title": "Ajude a moldar o OpenWork",
+  "settings.group_global": "Global",
+  "settings.group_workspace": "Workspace",
+  "settings.hide_titlebar": "Ocultar barra de título",
+  "settings.hide_titlebar_desc": "Oculta a barra de título da janela. Útil para gerenciadores de janelas tipo tiling",
+  "settings.join_discord": "Entrar no Discord",
+  "settings.language": "Idioma",
+  "settings.language.description": "Escolha seu idioma preferido",
+  "settings.last_error": "Último erro",
+  "settings.last_stderr": "Último stderr",
+  "settings.last_stdout": "Último stdout",
+  "settings.loading_providers": "Carregando provedores...",
+  "settings.managed_by_env": "Gerenciado por variável de ambiente",
+  "settings.model": "Modelo",
+  "settings.model_behavior": "Comportamento do modelo",
+  "settings.model_behavior_desc": "Abra o seletor de modelo padrão para escolher perfis de raciocínio quando disponíveis.",
+  "settings.model_section_desc": "Escolha o modelo de chat padrão e veja como ele raciocina.",
+  "settings.model_title": "Modelo",
+  "settings.no_active_workspace": "Nenhum workspace local ativo.",
+  "settings.no_audit_entries": "Nenhuma entrada de auditoria ainda.",
+  "settings.no_custom_path_set": "Nenhum caminho personalizado definido",
+  "settings.nuke_hint": "Use apenas quando quiser resetar completamente o app desktop e o estado do runtime OpenCode.",
+  "settings.off": "Desativado",
+  "settings.on": "Ativado",
+  "settings.open_deeplink_action": "Abrindo...",
+  "settings.open_deeplink_button": "Ocultar",
+  "settings.open_deeplink_desc": "Cole um deeplink ou URL compartilhada do OpenWork para abrir.",
+  "settings.open_deeplink_title": "Abrir Deeplink",
+  "settings.opencode_cache": "Cache do OpenCode",
+  "settings.opencode_cache_description": "Repara dados em cache usados para iniciar o engine. Seguro de executar.",
+  "settings.opencode_engine_desc": "Runtime local para agentes, ferramentas e provedores de modelos.",
+  "settings.opencode_engine_label": "Engine OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Sidecar de execução local.",
+  "settings.opencode_sdk_desc": "Diagnósticos de conexão da interface.",
+  "settings.opencode_sdk_title": "Engine OpenCode",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Abrir deeplink",
+  "settings.openwork_config_sidecar_desc": "Sidecar de configuração e aprovações.",
+  "settings.openwork_diagnostics_title": "Diagnósticos do servidor OpenWork",
+  "settings.openwork_server_desc": "Plano de controle de sessão para sincronização do app, workers e acesso remoto.",
+  "settings.openwork_server_label": "Servidor OpenWork",
+  "settings.pending_permissions": "Permissões pendentes",
+  "settings.production_mode_badge": "Produção",
+  "settings.provider_default_desc": "Use o comportamento de raciocínio padrão integrado do modelo.",
+  "settings.provider_default_label": "Padrão do provedor",
+  "settings.provider_source_config": "Config",
+  "settings.provider_source_custom": "Personalizado",
+  "settings.provider_source_env": "Ambiente",
+  "settings.providers_desc": "Conecte serviços para modelos e ferramentas.",
+  "settings.providers_title": "Provedores",
+  "settings.quit_hint": "O OpenWork fecha imediatamente após a limpeza para que a próxima inicialização comece de um estado local limpo para este modo.",
+  "settings.recent_events": "Eventos recentes",
+  "settings.reconnect_failed": "Falha ao reconectar. Verifique a URL/token do servidor e tente novamente.",
+  "settings.reconnect_server": "Reconectando...",
+  "settings.reconnect_server_failed": "Falha ao reconectar o servidor OpenWork.",
+  "settings.reconnected": "Reconectado ao servidor OpenWork.",
+  "settings.reconnecting": "Reconectando...",
+  "settings.removing_containers": "Removendo containers...",
+  "settings.removing_local_state": "Removendo estado local...",
+  "settings.repair_cache": "Reparar cache",
+  "settings.repairing_cache": "Reparando cache",
+  "settings.report_issue": "Reportar um problema",
+  "settings.reset": "Redefinir",
+  "settings.reset_app_data": "Redefinir dados do app",
+  "settings.reset_app_data_description": "Mais agressivo. Apaga cache + dados do OpenWork.",
+  "settings.reset_app_data_title": "Redefinir dados do app",
+  "settings.reset_app_data_warning": "Apaga cache e dados do OpenWork neste dispositivo.",
+  "settings.reset_button": "Redefinir",
+  "settings.reset_cancel": "Cancelar",
+  "settings.reset_config_defaults": "Redefinindo...",
+  "settings.reset_confirm_button": "Redefinir e Reiniciar",
+  "settings.reset_confirmation_hint": "Digite {resetWord} para confirmar. O OpenWork será reiniciado.",
+  "settings.reset_confirmation_label": "Confirmação",
+  "settings.reset_confirmation_placeholder": "Digite RESET",
+  "settings.reset_onboarding": "Redefinir onboarding",
+  "settings.reset_onboarding_description": "Apaga as preferências do OpenWork e reinicia o app.",
+  "settings.reset_onboarding_title": "Redefinir onboarding",
+  "settings.reset_onboarding_warning": "Apaga preferências locais e marcadores de onboarding do workspace no OpenWork.",
+  "settings.reset_openwork_desc_dev": "Com o modo dev ativo, limpa apenas o estado isolado do OpenCode dev dentro de openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "Com o modo dev ativo, limpa apenas o estado isolado do OpenCode dev dentro de openwork-dev-data.",
+  "settings.reset_openwork_title": "Redefinir estado do OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "Requer digitar RESET e reiniciará o app.",
+  "settings.reset_startup": "Redefinir modo de inicialização padrão",
+  "settings.reset_startup_pref": "Redefinir preferência de inicialização",
+  "settings.reset_stop_active_runs": "Pare as execuções ativas antes de redefinir.",
+  "settings.resetting": "Redefinindo...",
+  "settings.restart_blocked_message": "O OpenWork precisa reiniciar para concluir esta atualização. Para não interromper seu trabalho atual, a instalação está pausada até que suas execuções ativas terminem ou sejam paradas.",
+  "settings.restart_failed": "Falha ao reiniciar. Verifique os logs e tente novamente.",
+  "settings.restart_opencode": "Reiniciando...",
+  "settings.restart_openwork_server": "Reiniciando...",
+  "settings.restart_server_failed": "Falha ao reiniciar o servidor local.",
+  "settings.restarted": "Servidor local reiniciado.",
+  "settings.restarting": "Reiniciando...",
+  "settings.reveal_config": "Revelar configuração",
+  "settings.reveal_config_requires_desktop": "Revelar configuração requer o app desktop",
+  "settings.run_sandbox_probe": "Executando sonda...",
+  "settings.running_probe": "Executando sonda...",
+  "settings.runtime_debug_desc": "Snapshot de diagnósticos legível com exportação em um clique.",
+  "settings.runtime_debug_title": "Relatório de depuração do runtime",
+  "settings.runtime_desc": "Status do seu engine local e servidor OpenWork.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Erro",
+  "settings.sandbox_export_hint": "Use Exportar no relatório de depuração do runtime acima para",
+  "settings.sandbox_probe_desc": "Executa uma verificação temporária de inicialização do sandbox Docker e",
+  "settings.sandbox_probe_success": "Sonda do sandbox bem-sucedida. Exporte o relatório de depuração para suporte.",
+  "settings.sandbox_probe_title": "Sonda do sandbox",
+  "settings.sandbox_ready": "Pronto",
+  "settings.sandbox_requires_desktop": "Sonda do sandbox requer o app desktop",
+  "settings.sandbox_result": "Resultado: {status}",
+  "settings.sandbox_run_id": "ID da execução: {id}",
+  "settings.sandbox_stop_runs_hint": "Pare as execuções ativas antes de sondar",
+  "settings.search_models": "Buscar modelos…",
+  "settings.send_feedback": "Enviar feedback",
+  "settings.show_model_reasoning": "Mostrar raciocínio do modelo",
+  "settings.show_model_reasoning_desc": "Expandir os traços de raciocínio na interface quando o modelo os expõe.",
+  "settings.showing_models": "Exibindo {count} de {total}",
+  "settings.startup": "Inicialização",
+  "settings.startup_remote_warning": "A preferência de inicialização é atualmente remota. Configurações do engine",
+  "settings.startup_reset_hint": "Apaga sua preferência salva e exibe a seleção de conexão",
+  "settings.startup_title": "Inicialização",
+  "settings.stop_local_server": "Parar servidor local",
+  "settings.stop_runs_before_cleanup": "Pare as execuções ativas antes da limpeza",
+  "settings.stop_runs_before_reset_config": "Pare as execuções ativas antes de redefinir a configuração",
+  "settings.stop_runs_to_reset": "Pare as execuções ativas para redefinir",
+  "settings.switch": "Alternar",
+  "settings.tab_advanced": "Avançado",
+  "settings.tab_appearance": "Aparência",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Depuração",
+  "settings.tab_description_advanced": "Inspecione a saúde do runtime, estado da conexão e controles para desenvolvedores.",
+  "settings.tab_description_appearance": "Ajuste a aparência do OpenWork no desktop, tema do sistema e decoração do app.",
+  "settings.tab_description_debug": "Revise diagnósticos do runtime, logs e utilitários de depuração de baixo nível.",
+  "settings.tab_description_den": "Gerencie sua conexão OpenWork Cloud, workers hospedados e acesso a workspaces.",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "Gerencie apps MCP e plugins OpenCode para este workspace.",
+  "settings.tab_description_general": "Conecte provedores, escolha o modelo padrão, autorize pastas e controle o workspace OpenWork selecionado e sua conexão de runtime.",
+  "settings.tab_description_recovery": "Repare estado de migração, redefina padrões do workspace e recupere configurações locais.",
+  "settings.tab_description_skills": "Navegue, edite e instale skills sem sair das configurações.",
+  "settings.tab_description_updates": "Mantenha o app atualizado com verificações silenciosas em segundo plano e controles de instalação.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Extensões",
+  "settings.tab_general": "Configurações",
+  "settings.tab_recovery": "Recuperação",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Atualizações",
+  "settings.theme_dark": "Escuro",
+  "settings.theme_light": "Claro",
+  "settings.theme_system": "Sistema",
+  "settings.theme_system_hint": "O modo sistema segue automaticamente a preferência do seu SO.",
+  "settings.update": "Atualizar",
+  "settings.update_available": "Atualização disponível: v",
+  "settings.update_available_version": "Atualização disponível: v{version}",
+  "settings.update_check_button": "Verificar",
+  "settings.update_check_failed": "Falha na verificação de atualização",
+  "settings.update_checking": "Verificando...",
+  "settings.update_download_button": "Baixar",
+  "settings.update_downloading": "Baixando...",
+  "settings.update_install_button": "Instalar e Reiniciar",
+  "settings.update_last_checked": "Última verificação {time}",
+  "settings.update_published": "Publicado em {date}",
+  "settings.update_ready": "Pronto para instalar: v",
+  "settings.update_ready_version": "Pronto para instalar: v{version}",
+  "settings.update_uptodate": "Atualizado",
+  "settings.updates": "Atualizações",
+  "settings.updates_desc": "Manter o OpenWork atualizado.",
+  "settings.updates_desktop_only": "Atualizações estão disponíveis apenas no app desktop.",
+  "settings.updates_not_supported": "Atualizações não são suportadas neste ambiente.",
+  "settings.updates_title": "Atualizações",
+  "settings.window_appearance_desc": "Personalizar aparência da janela.",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Config do workspace",
+  "settings.workspace_debug_events_label": "Eventos de depuração do workspace",
+  "share.back_hint": "Voltar às opções de compartilhamento",
+  "share.chooser_subtitle": "Escolha como deseja compartilhar este workspace.",
+  "share.close_hint": "Fechar",
+  "share.option_access_desc": "Revele os detalhes de conexão ativos necessários para acessar este workspace em execução de outra máquina.",
+  "share.option_access_title": "Acessar workspace remotamente",
+  "share.subtitle_access": "Revele os detalhes de conexão necessários para acessar este workspace de outra máquina.",
+  "share.title": "Compartilhar workspace",
+  "share.view_access": "Acessar workspace remotamente",
+  "share.workspace_fallback": "Workspace",
+  "share_skill_destination.add_to_workspace": "Adicionar ao workspace",
+  "share_skill_destination.adding": "Adicionando...",
+  "share_skill_destination.connect_remote": "Conectar workspace remoto",
+  "share_skill_destination.connect_remote_hint": "Vincule um host OpenWork e selecione-o na lista para importar esta skill.",
+  "share_skill_destination.create_worker": "Criar novo workspace",
+  "share_skill_destination.create_worker_hint": "Abra o fluxo de configuração do workspace e adicione esta skill após o novo workspace estar pronto.",
+  "share_skill_destination.current_badge": "Atual",
+  "share_skill_destination.existing_workers": "Workspaces existentes",
+  "share_skill_destination.fallback_skill_name": "Skill compartilhada",
+  "share_skill_destination.local_badge": "Local",
+  "share_skill_destination.more_options": "Mais opções",
+  "share_skill_destination.no_workers": "Nenhum workspace está pronto ainda. Crie um ou conecte um workspace remoto para instalar esta skill.",
+  "share_skill_destination.remote_badge": "Remoto",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Selecionado",
+  "share_skill_destination.selected_hint": "Selecionado. Revise o destino abaixo e confirme.",
+  "share_skill_destination.skill_label": "Skill compartilhada",
+  "share_skill_destination.subtitle": "Escolha um workspace existente ou crie um novo antes de importar esta skill compartilhada.",
+  "share_skill_destination.title": "Para onde esta skill deve ir?",
+  "share_skill_destination.trigger_label": "Gatilho",
+  "sidebar.collapse": "Recolher",
+  "sidebar.expand": "Expandir",
+  "skills.add_custom_repo": "Adicionar repo GitHub personalizado",
+  "skills.add_git_repo": "Adicionar repo git",
+  "skills.add_openwork_hub": "Adicionar OpenWork Hub",
+  "skills.available_from_hub": "Disponível no Hub",
+  "skills.catalog_search_placeholder": "Buscar skills instaladas, de equipe e de hub",
+  "skills.cloud_choose_org_detail": "Use o painel Cloud para escolher sua organização ativa e atualize esta lista.",
+  "skills.cloud_choose_org_hint": "Escolha uma organização em Configurações → Cloud para carregar skills da equipe.",
+  "skills.cloud_footer_label": "Equipe",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "{name} instalado neste worker.",
+  "skills.cloud_installing": "Instalando {title}…",
+  "skills.cloud_installing_short": "Instalando",
+  "skills.cloud_no_search_matches": "Nenhuma skill corresponde a essa busca.",
+  "skills.cloud_org_empty": "Nenhuma skill da organização disponível ainda.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "Falha ao carregar skills da organização.",
+  "skills.cloud_refresh": "Atualizar skills da equipe",
+  "skills.cloud_section_subtitle": "Skills compartilhadas com você pelo OpenWork Cloud — incluindo hubs de skills da equipe que você pode acessar.",
+  "skills.cloud_section_title": "Da sua organização",
+  "skills.cloud_shared_org": "Org",
+  "skills.cloud_shared_public": "Público",
+  "skills.cloud_sign_in": "Entrar no Cloud",
+  "skills.cloud_sign_in_hint": "Entre no OpenWork Cloud para navegar por skills de equipe e organização.",
+  "skills.copy_link_failed": "Falha ao copiar link",
+  "skills.create_in_chat": "Criar skill no chat",
+  "skills.desktop_required": "O gerenciamento de skills requer o app desktop.",
+  "skills.enter_plugin_name": "Digite o nome do pacote do plugin.",
+  "skills.failed_load_active": "Falha ao carregar plugins ativos.",
+  "skills.failed_load_opencode": "Falha ao carregar opencode.json",
+  "skills.failed_parse_opencode": "Falha ao processar opencode.json",
+  "skills.failed_to_load": "Falha ao carregar skills",
+  "skills.failed_update_opencode": "Falha ao atualizar opencode.json",
+  "skills.filter_all": "Todas",
+  "skills.filter_cloud": "Equipe",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Instaladas",
+  "skills.from_repo": "De {owner}/{repo}",
+  "skills.github_repo_hint": "Insira um repo GitHub no formato owner/repo.",
+  "skills.host_mode_only": "Apenas workspace local",
+  "skills.host_only_error": "O gerenciamento de skills requer um workspace local ou servidor OpenWork conectado.",
+  "skills.hub_desc": "Navegue por skills compartilhadas de hubs no GitHub e adicione-as a este worker.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Importar",
+  "skills.import_failed": "Falha na importação ({status})",
+  "skills.import_local": "Importar skill local",
+  "skills.import_local_skill": "Importar skill local",
+  "skills.imported": "Importado.",
+  "skills.install": "Instalar",
+  "skills.install_failed": "Falha na instalação da skill.",
+  "skills.install_name_title": "Instalar {name}",
+  "skills.installed": "Skills instaladas",
+  "skills.installed_desc": "Skills instaladas vivem neste worker e podem ser editadas ou compartilhadas.",
+  "skills.installed_status": "Instalado",
+  "skills.installing": "Adicionar skill",
+  "skills.installing_prefix": "Instalando {name}…",
+  "skills.installing_skill_creator": "Instalando criador de skills...",
+  "skills.link_copied": "Link copiado",
+  "skills.loading": "Carregando…",
+  "skills.no_description": "Sem descrição ainda.",
+  "skills.no_hub_repo_label": "Nenhum repo de hub selecionado",
+  "skills.no_hub_repo_selected": "Nenhuma skill de hub disponível.",
+  "skills.no_hub_skills": "Nenhum repo de hub selecionado. Adicione um repo GitHub para navegar por skills.",
+  "skills.no_opencode_found": "Nenhum opencode.json encontrado ainda. Adicione um plugin para criar um.",
+  "skills.no_opencode_workspace": "Nenhum opencode.json neste workspace ainda.",
+  "skills.no_skills": "Nenhuma skill detectada em `.opencode/skills`, `.claude/skills` ou `~/.agents/skills`.",
+  "skills.no_skills_found": "Nenhuma skill encontrada ainda.",
+  "skills.owner_label": "Proprietário",
+  "skills.owner_repo_required": "Proprietário e repo são obrigatórios.",
+  "skills.pick_project_first": "Escolha primeiro uma pasta de projeto.",
+  "skills.pick_project_for_active": "Escolha uma pasta de projeto para carregar os plugins ativos.",
+  "skills.pick_project_for_plugins": "Escolha uma pasta de projeto para gerenciar os plugins do projeto.",
+  "skills.pick_workspace_first": "Escolha primeiro uma pasta de workspace.",
+  "skills.plugin_already_listed": "Plugin já listado no opencode.json.",
+  "skills.plugin_management_host_only": "O gerenciamento de plugins requer o app desktop.",
+  "skills.plugins_host_only": "Plugins estão disponíveis apenas no app desktop.",
+  "skills.ref_label": "Ref (branch/tag/commit)",
+  "skills.refresh": "Atualizar",
+  "skills.refresh_hub": "Atualizar hub",
+  "skills.remove_saved_repo": "Remover repo salvo",
+  "skills.repo_label": "Repo",
+  "skills.reveal_failed": "Falha ao abrir a pasta de skills.",
+  "skills.reveal_folder": "Abrir pasta de skills",
+  "skills.save_and_load": "Salvar e carregar",
+  "skills.select_skill_folder": "Selecionar pasta da skill",
+  "skills.share_back": "Voltar",
+  "skills.share_chooser_subtitle": "Salve na sua organização OpenWork Cloud ou publique um link de instalação público.",
+  "skills.share_close": "Fechar",
+  "skills.share_copy_link": "Copiar",
+  "skills.share_done": "Concluído",
+  "skills.share_option_public_desc": "Crie um link para qualquer pessoa instalar esta skill.",
+  "skills.share_option_public_title": "Link público",
+  "skills.share_option_team_desc": "Adicione esta skill à organização ativa do OpenWork Cloud.",
+  "skills.share_option_team_title": "Compartilhar com a equipe",
+  "skills.share_public_create": "Criar link",
+  "skills.share_public_creating": "Publicando…",
+  "skills.share_public_intro": "Publique um link público. Qualquer pessoa com a URL pode instalar esta skill.",
+  "skills.share_public_regenerate": "Regenerar link",
+  "skills.share_publisher_label": "Publicador",
+  "skills.share_subtitle_public": "Qualquer pessoa com o link pode instalar esta skill.",
+  "skills.share_subtitle_team": "Salva na sua organização para a equipe.",
+  "skills.share_team_choose_org": "Escolha uma organização em Configurações → Cloud antes de compartilhar.",
+  "skills.share_team_hubs_loading": "Carregando hubs…",
+  "skills.share_team_org_fallback": "Organização Cloud ativa",
+  "skills.share_team_sign_in": "Entrar para compartilhar com a equipe",
+  "skills.share_team_sign_in_hint": "O OpenWork Cloud abre no navegador. Volte aqui após entrar.",
+  "skills.share_title": "Compartilhar skill",
+  "skills.shown_count": "{count} exibidas",
+  "skills.skill_creator_already_installed": "O criador de skills já está instalado.",
+  "skills.skill_creator_installed": "Criador de skills instalado.",
+  "skills.skill_load_failed": "Falha ao carregar skill.",
+  "skills.source_label": "Fonte",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Gatilho: {trigger}",
+  "skills.uninstall": "Desinstalar",
+  "skills.uninstall_failed": "Falha ao desinstalar a skill.",
+  "skills.uninstall_title": "Desinstalar skill?",
+  "skills.uninstall_warning": "Isso excluirá permanentemente a skill `{name}` do seu workspace.",
+  "skills.uninstalled": "Skill removida.",
+  "skills.unknown_error": "Erro desconhecido",
+  "skills.worker_profile_desc": "Skills são as habilidades principais deste worker. Descubra-as no Hub, gerencie as instaladas e crie novas diretamente no chat.",
+  "status.back": "Voltar à tela anterior",
+  "status.connected": "Conectado",
+  "status.connecting": "Conectando",
+  "status.creating_task": "Criando nova tarefa",
+  "status.developer_mode": "Modo desenvolvedor",
+  "status.disconnected": "Desconectado",
+  "status.disconnected_hint": "Abra as configurações para reconectar",
+  "status.disconnected_label": "Desconectado",
+  "status.docs": "Docs",
+  "status.feedback": "Feedback",
+  "status.limited_hint": "Reconecte para restaurar todos os recursos do OpenWork",
+  "status.limited_mcp_hint": "{count} MCP conectados · reconecte para recursos completos",
+  "status.limited_mode": "Modo Limitado",
+  "status.loading_session": "Carregando sessão",
+  "status.mcp_connected": "{count} MCP conectados",
+  "status.open_docs": "Abrir documentação",
+  "status.openwork_ready": "OpenWork Pronto",
+  "status.providers_connected_one": "{count} provider conectado",
+  "status.providers_connected_other": "{count} providers conectados",
+  "status.ready_for_tasks": "Pronto para novas tarefas",
+  "status.running": "Em execução",
+  "status.send_feedback": "Enviar feedback",
+  "status.settings": "Configurações",
+  "system.reload_body_agents": "O OpenCode carrega agents na inicialização. Recarregue o engine para disponibilizar agents atualizados.",
+  "system.reload_body_commands": "O OpenCode carrega comandos na inicialização. Recarregue o engine para disponibilizar comandos atualizados.",
+  "system.reload_body_config": "O OpenCode lê opencode.json na inicialização. Recarregue o engine para aplicar mudanças de configuração.",
+  "system.reload_body_default": "O OpenWork detectou mudanças que exigem recarregar a instância do OpenCode.",
+  "system.reload_body_mcp": "O OpenCode carrega servidores MCP na inicialização. Recarregue o engine para ativar a nova conexão.",
+  "system.reload_body_mixed": "O OpenWork detectou mudanças na configuração do OpenCode. Recarregue o engine para aplicá-las.",
+  "system.reload_body_plugins": "O OpenCode carrega plugins npm na inicialização. Recarregue o engine para aplicar mudanças no opencode.json.",
+  "system.reload_body_skills": "O OpenCode pode cachear a descoberta de skills. Recarregue o engine para disponibilizar skills recém-instaladas.",
+  "system.reload_failed": "Falha ao recarregar o engine.",
+  "system.reload_required": "Recarregamento necessário",
+  "system.reload_unavailable": "Recarregamento não disponível para este worker.",
+  "system.stop_active_runs_before_reset": "Pare as execuções ativas antes de redefinir.",
+  "time.hours_ago": "{count}h atrás",
+  "time.just_now": "agora mesmo",
+  "time.minutes_ago": "{count}min atrás",
+  "time.seconds_ago": "{count}s atrás",
+  "workspace.loading_tasks": "Carregando tarefas...",
+  "workspace.local_badge": "Local",
+  "workspace.new_task_inline": "+ Nova tarefa",
+  "workspace.no_tasks": "Nenhuma tarefa ainda.",
+  "workspace.remote_badge": "Remoto",
+  "workspace.rename_description": "Atualizar o nome exibido na barra lateral.",
+  "workspace.rename_label": "Nome do workspace",
+  "workspace.rename_placeholder": "Workspace da equipe de design",
+  "workspace.rename_title": "Editar nome do workspace",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Selecionado",
+  "workspace_list.add_workspace": "Adicionar workspace",
+  "workspace_list.connecting": "Conectando...",
+  "workspace_list.delete_session": "Excluir sessão",
+  "workspace_list.edit_connection": "Editar conexão",
+  "workspace_list.edit_name": "Editar nome",
+  "workspace_list.hide_child_sessions": "Ocultar sessões filhas",
+  "workspace_list.recover": "Recuperar",
+  "workspace_list.remote_worker_unavailable": "Worker remoto indisponível",
+  "workspace_list.remote_worker_unavailable_hint": "O OpenWork não consegue carregar tarefas deste worker até que a conexão seja corrigida.",
+  "workspace_list.remove_workspace": "Remover workspace",
+  "workspace_list.rename_session": "Renomear sessão",
+  "workspace_list.reveal_explorer": "Mostrar no Explorador",
+  "workspace_list.reveal_finder": "Mostrar no Finder",
+  "workspace_list.session_actions": "Ações da sessão",
+  "workspace_list.share": "Compartilhar...",
+  "workspace_list.show_child_sessions": "Mostrar sessões filhas",
+  "workspace_list.show_more": "Mostrar mais {count}",
+  "workspace_list.show_more_fallback": "Mostrar mais",
+  "workspace_list.test_connection": "Testar conexão",
+  "workspace_list.unavailable": "Indisponível",
+  "workspace_list.workspace_fallback": "Workspace",
+  "workspace_list.workspace_options": "Opções do workspace",
+} as const;
diff --git a/apps/app/src/i18n/locales/ru.ts b/apps/app/src/i18n/locales/ru.ts
new file mode 100644
index 0000000000..a21b87e369
--- /dev/null
+++ b/apps/app/src/i18n/locales/ru.ts
@@ -0,0 +1,1514 @@
+/**
+ * Russian translations
+ * Product terms like OpenWork, OpenCode, OpenPackage, Skills, Plugins, Commands, Sessions, and MCP stay as project terminology where needed.
+ */
+
+export default {
+  "app.compact_command_desc": "Сведите этот сеанс в компактный вид, чтобы уменьшить размер контекста.",
+  "app.error_audit_load": "Не удалось загрузить журнал аудита.",
+  "app.error_auth_failed": "Ошибка аутентификации",
+  "app.error_command_not_resolved": "Команда не была разрешена.",
+  "app.error_compact_empty": "Пока нечего сжимать.",
+  "app.error_compact_no_session": "Выберите сеанс с сообщениями, прежде чем запускать /compact.",
+  "app.error_compact_no_session_id": "Выберите сеанс перед сжатием.",
+  "app.error_connect_first": "Подключитесь к этому воркеру перед применением изменений среды выполнения.",
+  "app.error_not_connected": "Нет подключения к серверу",
+  "app.error_rate_limit": "Превышен лимит запросов",
+  "app.error_remote_access": "Не удалось обновить удаленный доступ.",
+  "app.error_request_failed": "Запрос не выполнен",
+  "app.error_restart_local_worker": "Не удалось перезапустить локального воркера с обновленной настройкой общего доступа.",
+  "app.error_session_name_required": "Требуется имя сеанса",
+  "app.local_disabled_reason": "Создавайте локальные рабочие пространства в настольном приложении. Удаленные и общие рабочие пространства здесь по-прежнему работают.",
+  "app.model_behavior_title": "Поведение модели",
+  "app.plugins_hint_readonly": "Сервер OpenWork доступен только для чтения для Plugins.",
+  "app.reload_later": "Позже",
+  "app.reload_now": "Перезагрузить сейчас",
+  "app.reload_stop_tasks": "Перезагрузить и остановить задачи",
+  "app.skills_hint_readonly": "Сервер OpenWork доступен только для чтения для навыков. Добавьте host-токен в Advanced, чтобы включить установку.",
+  "app.unknown_error": "Неизвестная ошибка",
+  "blueprint.automation_body": "Начните с повторно используемого рабочего процесса или введите свою задачу ниже.",
+  "blueprint.automation_title": "Что вы хотите автоматизировать?",
+  "blueprint.csv_session_assistant": "Я могу помочь вам создавать, очищать, объединять и сводить CSV-файлы. Какой вид работы с CSV вы хотите автоматизировать?",
+  "blueprint.csv_session_title": "Идеи рабочих процессов с CSV",
+  "blueprint.csv_session_user": "Я хочу объединить экспорты из нескольких инструментов в один чистый CSV.",
+  "blueprint.empty_body": "Выберите точку старта или просто введите текст ниже.",
+  "blueprint.empty_title": "Что вы хотите сделать?",
+  "blueprint.minimal_body": "Задайте вопрос об этом рабочем пространстве или используйте стартовый prompt.",
+  "blueprint.minimal_title": "Начните с задачи",
+  "blueprint.starter_blueprint_desc": "Спроектируйте повторяемый рабочий процесс с Skills, Commands и шагами передачи.",
+  "blueprint.starter_blueprint_prompt": "Помогите мне спроектировать reusable automation blueprint для этого рабочего пространства. Спросите, что нужно стандартизировать, а затем предложите рабочий процесс.",
+  "blueprint.starter_blueprint_title": "Спланировать automation blueprint",
+  "blueprint.starter_chrome_desc": "Сразу начните диалог для автоматизации браузера.",
+  "blueprint.starter_chrome_prompt": "Помогите мне подключиться к Chrome и автоматизировать повторяющуюся задачу.",
+  "blueprint.starter_chrome_title": "Автоматизировать Chrome",
+  "blueprint.starter_command_desc": "Превратите повторяющийся рабочий процесс в slash-command для этого рабочего пространства.",
+  "blueprint.starter_command_prompt": "Помогите мне создать reusable /command для этого рабочего пространства. Спросите, какой рабочий процесс я хочу автоматизировать, а затем подготовьте команду.",
+  "blueprint.starter_command_title": "Создать reusable command",
+  "blueprint.starter_connect_openai_desc": "Добавьте вашего OpenAI провайдера, чтобы модели ChatGPT были готовы в новых сеансах.",
+  "blueprint.starter_connect_openai_title": "Подключить ChatGPT",
+  "blueprint.starter_csv_desc": "Очистить или сгенерировать табличные данные.",
+  "blueprint.starter_csv_prompt": "Помогите мне создать или отредактировать CSV-файлы на этом компьютере.",
+  "blueprint.starter_csv_title": "Работа с CSV",
+  "blueprint.starter_explore_desc": "Сведите содержимое файлов и предложите лучшую первую задачу.",
+  "blueprint.starter_explore_prompt": "Сведите это рабочее пространство, укажите самые важные файлы и предложите лучшую первую задачу.",
+  "blueprint.starter_explore_title": "Изучить это рабочее пространство",
+  "blueprint.welcome_message": "Привет, добро пожаловать в OpenWork!\n\nЛюди используют нас, чтобы писать CSV-файлы на своем компьютере, подключаться к Chrome и автоматизировать повторяющиеся задачи, а также синхронизировать контакты с Notion.\n\nНо единственное ограничение — это ваше воображение.\n\nЧто бы вы хотели сделать?",
+  "blueprint.welcome_title": "Добро пожаловать в OpenWork",
+  "common.add": "Добавить",
+  "common.cancel": "Отмена",
+  "common.back": "Назад",
+  "common.close": "Закрыть",
+  "common.default_parens": "(по умолчанию)",
+  "common.edit": "Изменить",
+  "common.hide": "Скрыть",
+  "common.navigate": "перейти",
+  "common.next": "Далее",
+  "common.off": "Выкл.",
+  "common.on": "Вкл.",
+  "common.path": "Путь",
+  "common.question": "Вопрос",
+  "common.refresh": "Обновить",
+  "common.remove": "Удалить",
+  "common.reset": "Сбросить",
+  "common.save": "Сохранить",
+  "common.select": "выберите",
+  "common.show": "Показать",
+  "common.something_went_wrong": "Что-то пошло не так",
+  "common.submit": "Отправить",
+  "common.unknown": "Неизвестно",
+  "composer.agent_label": "Агент",
+  "composer.attach_files": "Прикрепить файлы",
+  "composer.attachments_unavailable": "Вложения недоступны.",
+  "composer.behavior_label": "Поведение",
+  "composer.configure": "Настроить",
+  "composer.default_agent": "Агент по умолчанию",
+  "composer.file_exceeds_limit": "{name} превышает лимит 8 МБ.",
+  "composer.file_kind": "Файл",
+  "composer.image_kind": "Изображение",
+  "composer.inserted_links_unsupported": "Вставлены ссылки для неподдерживаемых файлов.",
+  "composer.loading_commands": "Загрузка команд...",
+  "composer.mcps_label": "MCPs",
+  "composer.no_commands": "Команды не найдены.",
+  "composer.placeholder": "Опишите вашу задачу...",
+  "composer.remote_worker_paste_warning": "Это удаленный воркер. Песочницы тоже находятся удаленно. Чтобы поделиться с ним файлами, загрузите их в папку Shared на боковой панели.",
+  "composer.run_task": "Запустить задачу",
+  "composer.skill_source": "Навык",
+  "composer.stop": "Остановить",
+  "composer.tools_label": "Команды, навыки и MCPs",
+  "composer.unsupported_attachment_type": "Неподдерживаемый тип вложения.",
+  "composer.upload_to_shared_folder": "Загрузить в общую папку",
+  "composer.uploaded_multiple_files": "Загружено {count} файлов в общую папку и вставлены ссылки.",
+  "composer.uploaded_single_file": "Загружен {name} в общую папку и вставлена ссылка.",
+  "config.collaborator_token_disabled_hint": "Сохранен заранее для удаленного доступа, но удаленный доступ сейчас отключен.",
+  "config.collaborator_token_label": "Токен соавтора",
+  "config.collaborator_token_remote_hint": "Обычный удаленный доступ для телефонов или ноутбуков, подключающихся к этому серверу.",
+  "config.connection_failed": "Подключение не удалось.",
+  "config.connection_failed_check": "Подключение не удалось. Проверьте URL хоста и токен.",
+  "config.connection_status_updated": "Статус подключения обновлен.",
+  "config.connection_successful": "Подключение успешно.",
+  "config.copied": "Скопировано",
+  "config.copy": "Копировать",
+  "config.desktop_only_hint": "Некоторые функции конфигурации (общий доступ к локальному серверу + messaging bridge) требуют настольного приложения.",
+  "config.diagnostics_desc": "Скопировать очищенное состояние среды выполнения для отладки.",
+  "config.diagnostics_title": "Пакет диагностики",
+  "config.engine_reload_desc": "Перезапустить сервер OpenCode для этого рабочего пространства.",
+  "config.engine_reload_title": "Перезагрузка движка",
+  "config.host_admin_token_hint": "Внутренний токен хоста только для approvals CLI и admin API. Не используйте его в потоке подключения удаленного приложения.",
+  "config.host_admin_token_label": "Admin-токен хоста",
+  "config.host_local_only": "Только локально",
+  "config.host_offline": "Не в сети",
+  "config.host_remote_enabled": "Удаленный доступ включен",
+  "config.local_ip_hint": "Используйте локальный IP в той же Wi‑Fi сети для самого быстрого подключения.",
+  "config.mdns_hint": "Имена .local проще запомнить, но они могут не разрешаться во всех сетях.",
+  "config.messaging_identities_desc": "Управляйте идентификаторами Telegram/Slack и маршрутизацией во вкладке Identities.",
+  "config.messaging_identities_title": "Идентификаторы для messaging",
+  "config.not_set": "Не задано",
+  "config.owner_token_disabled_hint": "Имеет смысл только после включения удаленного доступа для этого воркера.",
+  "config.owner_token_label": "Токен владельца",
+  "config.owner_token_remote_hint": "Используйте это, когда удаленному клиенту нужно отвечать на запросы разрешений или выполнять действия только владельца.",
+  "config.reload_active_tasks_warning": "Перезагрузка остановит активные задачи.",
+  "config.reload_availability_hint": "Перезагрузка доступна только для локальных воркеров или подключенных серверов OpenWork.",
+  "config.reload_connect_hint": "Подключитесь к этому воркеру, чтобы перезагрузить его.",
+  "config.reload_engine": "Перезагрузить движок",
+  "config.reload_now_desc": "Применяет обновления конфигурации и переподключает сеанс.",
+  "config.reload_now_title": "Перезагрузить сейчас",
+  "config.reloading": "Перезагрузка...",
+  "config.remote_access_off_hint": "Удаленный доступ выключен. Используйте Share workspace, чтобы включить его перед подключением с другого компьютера.",
+  "config.resolved_worker_url": "Распознанный URL воркера:",
+  "config.server_needed_hint": "Для синхронизации навыков, Plugins и команд требуется подключение к серверу OpenWork.",
+  "config.server_section_desc": "Подключитесь к серверу OpenWork. Используйте URL и токен соавтора или владельца от администратора сервера.",
+  "config.server_section_title": "Сервер OpenWork",
+  "config.server_sharing_desc": "Поделитесь этими данными с доверенным устройством. Для самого быстрого подключения держите сервер в той же сети.",
+  "config.server_sharing_menu_hint": "Для ссылок общего доступа на отдельные рабочие пространства используйте Share... в меню рабочего пространства.",
+  "config.server_sharing_title": "Общий доступ к серверу OpenWork",
+  "config.server_url_hint": "Используйте URL, предоставленный вашим сервером OpenWork. Локальные настольные воркеры повторно используют постоянный высокий порт в диапазоне 48000-51000.",
+  "config.server_url_input_label": "URL сервера OpenWork",
+  "config.server_url_label": "URL сервера OpenWork",
+  "config.starting_server": "Запуск сервера…",
+  "config.status_connected": "Подключено",
+  "config.status_limited": "Ограничено",
+  "config.status_not_connected": "Не подключено",
+  "config.test_connection": "Проверить подключение",
+  "config.testing": "Проверка...",
+  "config.testing_connection": "Проверка подключения...",
+  "config.token_hint": "Необязательно. Вставьте токен соавтора для обычного доступа или токен владельца, если этот клиент должен отвечать на запросы разрешений.",
+  "config.token_label": "Токен соавтора или владельца",
+  "config.token_placeholder": "Вставьте ваш токен",
+  "config.unavailable": "Недоступно",
+  "config.worker_id": "Worker ID:",
+  "config.workspace_config_desc": "Эти настройки влияют на выбранное рабочее пространство. Действия только во время работы применяются к тому рабочему пространству, к которому сейчас подключены.",
+  "config.workspace_config_title": "Конфигурация рабочего пространства",
+  "config.workspace_id_prefix": "Рабочее пространство:",
+  "context_panel.add_button": "Добавить",
+  "context_panel.add_folder_hint": "Добавьте папку, чтобы позволить этому рабочему пространству читать и редактировать файлы вне корневого каталога.",
+  "context_panel.adding_button": "Добавление...",
+  "context_panel.always_available": "Всегда доступно",
+  "context_panel.authorized_folders": "Авторизованные папки",
+  "context_panel.authorized_folders_desc": "Предоставьте этому рабочему пространству доступ на чтение и редактирование файлов в каталогах вне его корня.",
+  "context_panel.authorized_folders_no_access": "Подключитесь к доступному на запись рабочему пространству сервера OpenWork, чтобы редактировать авторизованные папки.",
+  "context_panel.browse_button": "Обзор",
+  "context_panel.config_access_unavailable": "Доступ к конфигурации сервера OpenWork недоступен для этого рабочего пространства.",
+  "context_panel.config_read_only": "Сервер OpenWork подключен только для чтения конфигурации рабочего пространства.",
+  "context_panel.folder_already_authorized": "Папка уже авторизована.",
+  "context_panel.folders_updated": "Авторизованные папки обновлены.",
+  "context_panel.input_placeholder": "Введите путь к папке, чтобы авторизовать...",
+  "context_panel.no_external_folders": "Нет авторизованных внешних папок",
+  "context_panel.no_mcp": "Нет загруженных MCP-серверов.",
+  "context_panel.no_server_workspace": "Не выбрано активное серверное рабочее пространство.",
+  "context_panel.no_skills": "Нет загруженных Skills.",
+  "context_panel.preserving_entries": "Сохраняем {count} записи разрешений, не относящиеся к папкам.",
+  "context_panel.preserving_entry": "Сохраняется 1 запись разрешения, не относящаяся к папке.",
+  "context_panel.remove_folder": "Удалить {name}",
+  "context_panel.saving_folders": "Сохранение авторизованных папок...",
+  "context_panel.server_disconnected": "Сервер OpenWork отключен.",
+  "context_panel.workspace_root_available": "Корневой каталог рабочего пространства уже доступен.",
+  "context_panel.workspace_root_badge": "Корень workspace",
+  "context_panel.writable_workspace_required": "Для обновления авторизованных папок требуется доступное на запись рабочее пространство сервера OpenWork.",
+  "dashboard.change": "Изменить",
+  "dashboard.choose_folder": "Выберите папку",
+  "dashboard.choose_folder_continue": "Выберите папку, чтобы продолжить.",
+  "dashboard.chooser_local_desc": "Создайте рабочее пространство на этом устройстве.",
+  "dashboard.chooser_remote_desc": "Подключитесь к self-hosted OpenWork воркеру по URL и токену доступа.",
+  "dashboard.chooser_shared_desc": "Просматривайте облачные воркеры, которыми поделилась ваша организация, и подключайтесь в один шаг.",
+  "dashboard.close_settings": "Закрыть настройки",
+  "dashboard.cloud_worker": "Облачный воркер",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Подключиться удаленно",
+  "dashboard.connected": "Подключено",
+  "dashboard.connecting": "Подключение...",
+  "dashboard.create_local_workspace_subtitle": "Создайте рабочее пространство на этом устройстве.",
+  "dashboard.create_local_workspace_title": "Локальное рабочее пространство",
+  "dashboard.create_remote_custom_subtitle": "Подключитесь к self-hosted OpenWork воркеру.",
+  "dashboard.create_remote_custom_title": "Подключить свой удаленный сервер",
+  "dashboard.create_remote_workspace_confirm": "Добавить рабочее пространство",
+  "dashboard.create_remote_workspace_subtitle": "Сохраните сервер OpenWork как рабочее пространство.",
+  "dashboard.create_remote_workspace_title": "Добавить удаленное рабочее пространство",
+  "dashboard.create_sandbox_confirm": "Создать как песочницу",
+  "dashboard.create_shared_subtitle_signed_in": "Просматривайте облачные воркеры, которыми поделилась ваша организация, и подключайтесь в один шаг.",
+  "dashboard.create_shared_subtitle_signed_out": "Войдите в OpenWork Cloud, чтобы получить доступ к воркерам, которыми поделилась ваша организация.",
+  "dashboard.create_shared_title": "Общие рабочие пространства",
+  "dashboard.create_workspace_confirm": "Создать рабочее пространство",
+  "dashboard.create_workspace_subtitle": "Инициализируйте новое папочное рабочее пространство.",
+  "dashboard.create_workspace_title": "Создать рабочее пространство",
+  "dashboard.desktop_badge": "Настольное",
+  "dashboard.edit_remote_workspace_confirm": "Сохранить подключение",
+  "dashboard.edit_remote_workspace_subtitle": "Обновите данные сервера OpenWork для этого рабочего пространства.",
+  "dashboard.edit_remote_workspace_title": "Изменить удаленное подключение",
+  "dashboard.error_choose_org": "Выберите организацию перед открытием рабочего пространства.",
+  "dashboard.error_connect_worker": "Не удалось подключиться к {name}.",
+  "dashboard.error_load_orgs": "Не удалось загрузить организации.",
+  "dashboard.error_load_shared_workspaces": "Не удалось загрузить общие рабочие пространства.",
+  "dashboard.error_workspace_not_ready": "Рабочее пространство пока не готово к подключению. Повторите попытку через минуту.",
+  "dashboard.import_config": "Импортировать конфигурацию",
+  "dashboard.importing": "Импорт...",
+  "dashboard.modal_back": "Назад",
+  "dashboard.modal_close": "Закрыть модальное окно добавления рабочего пространства",
+  "dashboard.remote": "Удаленное",
+  "dashboard.remote_base_url_required": "Добавьте URL сервера, чтобы продолжить.",
+  "dashboard.remote_server_details_hint": "Подключитесь к self-hosted OpenWork воркеру.",
+  "dashboard.remote_server_details_title": "Подробности удаленного сервера",
+  "dashboard.sandbox_checking_docker": "Проверка Docker...",
+  "dashboard.sandbox_get_ready_title": "Для песочниц нужен Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Требует внимания",
+  "dashboard.worker_status_ready": "Готов",
+  "dashboard.worker_status_starting": "Запуск",
+  "dashboard.worker_status_stopped": "Остановлен",
+  "dashboard.worker_status_unknown": "Неизвестно",
+  "identities.agent_behavior_desc": "Один файл на рабочее пространство. Добавьте необязательную первую строку @agent <id>, чтобы маршрутизировать через конкретного OpenCode-агента.",
+  "identities.agent_behavior_title": "Поведение агента для messaging",
+  "identities.agent_created": "Создан файл агента мессенджинга по умолчанию.",
+  "identities.agent_file_changed": "Файл изменен удаленно. Перезагрузите и сохраните еще раз.",
+  "identities.agent_loading": "Загрузка файла агента…",
+  "identities.agent_none": "none",
+  "identities.agent_not_found": "Файл агента пока не найден в этом рабочем пространстве.",
+  "identities.agent_saved": "Поведение мессенджинга сохранено.",
+  "identities.agent_scope_status": "Активная область: workspace · статус: {status} · выбранный агент: {agent}",
+  "identities.agent_status_loaded": "загружен",
+  "identities.agent_status_missing": "отсутствует",
+  "identities.agent_worker_scope_unavailable": "Область воркера недоступна.",
+  "identities.all_channels": "Все каналы",
+  "identities.app_token_label": "Токен приложения",
+  "identities.auto_bind_label": "Автоматически привязывать peer к каталогу при прямой отправке",
+  "identities.available_channels": "Доступные каналы",
+  "identities.bot_token_label": "Токен бота",
+  "identities.bot_token_placeholder": "Вставьте токен Telegram-бота из @BotFather",
+  "identities.botfather_step1_open": "1. Откройте @BotFather в Telegram",
+  "identities.botfather_step1_run": "и выполните /newbot",
+  "identities.botfather_step3_choose": "3. Выберите имя и username для вашего бота",
+  "identities.botfather_step3_or_private": "для открытого inbox или",
+  "identities.botfather_step3_private": "Приватный",
+  "identities.botfather_step3_public": "Публичный",
+  "identities.botfather_step3_to_require": "чтобы потребовать",
+  "identities.channel_label": "Канал",
+  "identities.channels_connected": "подключено",
+  "identities.channels_label": "Каналы",
+  "identities.configured_suffix": "настроено",
+  "identities.connect_server_desc": "Идентификаторы доступны, когда вы подключены к хосту OpenWork.",
+  "identities.connect_server_title": "Подключиться к серверу OpenWork",
+  "identities.connect_slack": "Подключить Slack",
+  "identities.connected_badge": "Подключено",
+  "identities.connecting": "Подключение...",
+  "identities.copy_bot_token_hint": "Скопируйте токен бота и вставьте его ниже.",
+  "identities.copy_code": "Скопировать код",
+  "identities.create_default_file": "Создать файл по умолчанию",
+  "identities.create_private_bot": "Создать приватного бота",
+  "identities.create_public_bot": "Создать публичного бота",
+  "identities.days_ago": "{days} дн. назад",
+  "identities.default_routing": "Маршрутизация по умолчанию",
+  "identities.directory_label": "Каталог (необязательно)",
+  "identities.disable_messaging": "Отключить messaging",
+  "identities.disable_messaging_message": "Это отключит messaging для этого рабочего пространства. Настройка Telegram и Slack будет скрыта, пока messaging снова не будет включен, и вам нужно будет перезапустить воркер, чтобы полностью остановить messaging sidecar.",
+  "identities.disable_messaging_title": "Отключить messaging для этого воркера?",
+  "identities.disabled_label": "Отключено",
+  "identities.disabling": "Отключение...",
+  "identities.disconnect": "Отключить",
+  "identities.dispatched_messages": "Отправлено {sent}/{attempted} сообщений.",
+  "identities.enable_messaging": "Включить messaging",
+  "identities.enable_messaging_risk": "Messaging может открыть этому воркеру доступ к удаленным командам. Если бот публичный или скомпрометирован, он может получить доступ к файлам, учетным данным и API-ключам, доступным этому воркеру.",
+  "identities.enable_messaging_title": "Включить messaging для этого воркера?",
+  "identities.enabled_label": "Включено",
+  "identities.enabling": "Включение...",
+  "identities.health_offline": "Не в сети",
+  "identities.health_running": "Работает",
+  "identities.health_unavailable": "Недоступно",
+  "identities.health_unknown": "Неизвестно",
+  "identities.hours_ago": "{hours} ч назад",
+  "identities.identities_label": "Идентификаторы",
+  "identities.just_now": "Только что",
+  "identities.last_activity": "Последняя активность",
+  "identities.later": "Позже",
+  "identities.message_label": "Сообщение",
+  "identities.message_routing_desc": "Управляйте тем, какие разговоры идут в какую папку рабочего пространства. Сообщения маршрутизируются в папку по умолчанию воркера, если вы не настроили правила здесь.",
+  "identities.message_routing_title": "Маршрутизация сообщений",
+  "identities.messages_today": "Сообщений сегодня",
+  "identities.messaging_disabled_hint": "Включайте messaging только если понимаете риск и планируете защитить доступ (например, приватную пару Telegram).",
+  "identities.messaging_disabled_restart": "Messaging отключен. Перезапустите этого воркера, чтобы остановить messaging sidecar.",
+  "identities.messaging_disabled_risk": "Messaging-боты могут выполнять действия от имени вашего локального воркера. Если они открыты публично, они могут дать доступ к файлам, учетным данным и API-ключам, доступным этому воркеру.",
+  "identities.messaging_disabled_title": "Messaging отключен по умолчанию",
+  "identities.messaging_enabled_restart": "Messaging включен. Перезапустите этого воркера, чтобы применить изменения перед настройкой каналов.",
+  "identities.messaging_sidecar_not_running": "Messaging включен в этом рабочем пространстве, но messaging sidecar еще не запущен. Перезапустите этого воркера, затем вернитесь в настройки Messaging, чтобы подключить Telegram или Slack.",
+  "identities.minutes_ago": "{minutes} мин назад",
+  "identities.not_set": "Не задано",
+  "identities.open_bot_link": "Открыть @{username} в Telegram",
+  "identities.pairing_code_copied": "Код сопряжения скопирован.",
+  "identities.pairing_code_copy_failed": "Не удалось скопировать код сопряжения. Скопируйте его вручную.",
+  "identities.pairing_code_instruction_prefix": "Отправьте",
+  "identities.peer_id_label": "Peer ID (необязательно)",
+  "identities.peer_id_placeholder_slack": "например, slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "например, telegram:123456789",
+  "identities.private_label": "Приватный",
+  "identities.private_pairing_code": "Приватный код сопряжения",
+  "identities.public_bot_confirm": "Да, я понимаю риск",
+  "identities.public_bot_warning_message": "Ваш бот будет доступен публично, и любой, кто получит к нему доступ, сможет получить полный доступ к вашему локальному воркеру, включая любые файлы или API-ключи, которые вы ему дали. Если вы создадите приватного бота, вы сможете ограничить, кто может получить к нему доступ, требуя токен сопряжения. Вы уверены, что хотите сделать вашего бота публичным?",
+  "identities.public_bot_warning_title": "Сделать этого бота публичным?",
+  "identities.public_label": "Публичный",
+  "identities.quick_setup": "Быстрая настройка",
+  "identities.reconnect_failed": "Переподключение не удалось. Проверьте URL/токен OpenWork и попробуйте еще раз.",
+  "identities.reconnected": "Переподключено.",
+  "identities.reconnected_refreshing": "Переподключено. Обновление состояния воркера...",
+  "identities.reload": "Перезагрузить",
+  "identities.repair_reconnect": "Восстановить и переподключить",
+  "identities.restart_failed": "Не удалось перезапустить. Перезапустите воркера из Settings и попробуйте снова.",
+  "identities.restart_to_disable_messaging": "Messaging был отключен для этого рабочего пространства. Перезапустите воркера сейчас, чтобы остановить messaging sidecar.",
+  "identities.restart_to_enable_messaging": "Messaging был включен для этого рабочего пространства. Перезапустите воркера сейчас, чтобы запустить messaging sidecar и открыть настройку Telegram и Slack.",
+  "identities.restart_worker": "Перезапустить воркер",
+  "identities.restart_worker_title": "Перезапустить воркер сейчас?",
+  "identities.restarting": "Перезапуск...",
+  "identities.routing_override_prefix": "Все сообщения направляются в",
+  "identities.routing_override_suffix": "(переопределение активно)",
+  "identities.running_label": "Работает",
+  "identities.save_behavior": "Сохранить поведение",
+  "identities.saving": "Сохранение...",
+  "identities.send_test_button": "Отправить тестовое сообщение",
+  "identities.send_test_desc": "Проверьте исходящую проводку. Используйте peer ID для прямой отправки или оставьте peer ID пустым, чтобы распределить по привязкам в каталоге.",
+  "identities.send_test_title": "Отправить тестовое сообщение",
+  "identities.sending": "Отправка...",
+  "identities.slack_desc": "Ваш воркер отображается как бот в каналах Slack. Участники команды могут писать ему напрямую или упоминать его в тредах.",
+  "identities.slack_intro": "Подключите ваше рабочее пространство Slack, чтобы участники команды могли взаимодействовать с этим воркером в каналах и личных сообщениях.",
+  "identities.slack_unavailable": "Идентификаторы Slack недоступны.",
+  "identities.status_active": "Активно",
+  "identities.status_label": "Статус",
+  "identities.status_stopped": "Остановлено",
+  "identities.stopped_label": "Остановлено",
+  "identities.subtitle": "Позвольте людям обращаться к вашему воркеру через мессенджеры. Подключите канал, и ваш воркер будет автоматически читать сообщения и отвечать на них.",
+  "identities.tab_general": "Общее",
+  "identities.telegram_bot_access_desc": "Публичный бот: первый чат Telegram автоматически связывается. Приватный бот: перед любыми сообщениями требуется код сопряжения.",
+  "identities.telegram_delete_failed": "Не удалось удалить.",
+  "identities.telegram_deleted": "Удалено.",
+  "identities.telegram_deleted_pending": "Удалено (ожидает применения).",
+  "identities.telegram_desc": "Подключите Telegram-бота в публичном режиме (открытый inbox) или приватном режиме (требуется код сопряжения).",
+  "identities.telegram_private_saved_pair": "Приватный бот сохранен. Сопряжение через /pair {code}",
+  "identities.telegram_save_failed": "Не удалось сохранить.",
+  "identities.telegram_saved": "Сохранено.",
+  "identities.telegram_saved_pending": "Сохранено (ожидает применения).",
+  "identities.telegram_saved_username": "Сохранено (@{username})",
+  "identities.telegram_unavailable": "Идентификаторы Telegram недоступны.",
+  "identities.title": "Каналы мессенджинга",
+  "identities.unsaved_changes": "Несохраненные изменения",
+  "identities.worker_offline": "Воркер не в сети",
+  "identities.worker_online": "Воркер в сети",
+  "identities.worker_restarted": "Воркер перезапущен.",
+  "identities.worker_restarted_refreshing": "Воркер перезапущен. Обновление состояния мессенджинга...",
+  "identities.worker_scope_unavailable": "Область воркера недоступна.",
+  "identities.worker_scope_unavailable_detail": "Область воркера недоступна. Переподключитесь по URL воркера или переключитесь на известный воркер.",
+  "identities.worker_unavailable": "Воркер недоступен",
+  "identities.workspace_id_required": "Для управления идентификаторами требуется Workspace ID. Переподключитесь с URL workspace или выберите workspace, сопоставленный на этом хосте.",
+  "identities.workspace_scope_prefix": "Область workspace:",
+  "mcp.disable_app": "Отключить",
+  "mcp.enable_app": "Включить",
+  "mcp.reloading_status": "Перезагрузка MCP-серверов…",
+  "mcp.toggle_failed": "Не удалось обновить состояние включения MCP.",
+  "mcp.toggle_requires_server": "Подключитесь к серверу OpenWork, чтобы включать или отключать MCPs.",
+  "mcp.add_modal_subtitle": "Подключите собственный MCP-сервер по URL или локальной команде.",
+  "mcp.add_modal_title": "Добавить custom app",
+  "mcp.add_server_button": "Добавить app",
+  "mcp.advanced": "Дополнительно",
+  "mcp.advanced_settings": "Дополнительные настройки",
+  "mcp.advanced_settings_hint": "Редактируйте файлы конфигурации и управляйте подключениями вручную.",
+  "mcp.app_connected": "app подключено",
+  "mcp.apps_connected": "apps подключены",
+  "mcp.apps_subtitle": "Подключите ваши любимые инструменты, чтобы OpenWork мог использовать их от вашего имени.",
+  "mcp.apps_title": "Приложения",
+  "mcp.auth.already_connected": "Уже подключено",
+  "mcp.auth.already_connected_description": "{server} уже авторизован и готов к использованию.",
+  "mcp.auth.applying_changes_body": "Мы перезапускаем воркер, чтобы новый MCP был готов к авторизации.",
+  "mcp.auth.applying_changes_title": "Применение изменений перед входом",
+  "mcp.auth.authorization_link": "Ссылка авторизации",
+  "mcp.auth.authorization_still_required": "Авторизация все еще требуется. Попробуйте еще раз, чтобы перезапустить поток.",
+  "mcp.auth.callback_invalid": "Вставьте callback URL или параметр code, чтобы завершить OAuth.",
+  "mcp.auth.callback_label": "Callback URL или code",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Отмена",
+  "mcp.auth.client_registration_required": "Перед продолжением OAuth требуется регистрация клиента.",
+  "mcp.auth.complete_connection": "Завершить подключение",
+  "mcp.auth.configured_previously": "MCP мог быть настроен глобально или в предыдущем сеансе. Вы можете закрыть это окно и сразу начать использовать инструменты MCP.",
+  "mcp.auth.connect_server": "Подключить {server}",
+  "mcp.auth.copied": "Скопировано",
+  "mcp.auth.copy_link": "Копировать ссылку",
+  "mcp.auth.done": "Готово",
+  "mcp.auth.failed_to_start_oauth": "Не удалось запустить поток OAuth",
+  "mcp.auth.follow_browser_steps": "Следуйте шагам авторизации в браузере.",
+  "mcp.auth.force_stop": "Принудительно остановить",
+  "mcp.auth.force_stopping": "Остановка...",
+  "mcp.auth.im_done": "Я закончил",
+  "mcp.auth.invalid_refresh_token": "OAuth refresh token недействителен или истек. Повторно авторизуйтесь, чтобы продолжить.",
+  "mcp.auth.manual_finish_hint": "Вставьте callback URL (localhost:19876) или просто код, чтобы завершить подключение.",
+  "mcp.auth.manual_finish_title": "Удаленный сервер?",
+  "mcp.auth.oauth_completed_reload": "OAuth завершен. Перезагрузите движок, чтобы активировать MCP.",
+  "mcp.auth.oauth_failed": "Авторизация OAuth не удалась.",
+  "mcp.auth.oauth_not_supported_hint": "Это может означать:\n• MCP-сервер не объявляет возможности OAuth\n• Движок нужно перезагрузить, чтобы обнаружить возможности сервера\n• Попробуйте: opencode mcp auth {server} из CLI",
+  "mcp.auth.open_browser_signin": "Мы откроем ваш браузер, чтобы завершить вход.",
+  "mcp.auth.port_forward_hint": "Подсказка: при необходимости пробросьте callback-порт: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "Повторно авторизовать OAuth",
+  "mcp.auth.reauth_cli_hint": "Запустите: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "Повторная авторизация не удалась.",
+  "mcp.auth.reauth_remote_hint": "Повторно авторизуйтесь на машине, где запущен этот воркер.",
+  "mcp.auth.reauth_running": "Повторная авторизация...",
+  "mcp.auth.reload_blocked": "Перезагрузка приостановлена, пока идет сеанс. Остановите запуск, чтобы завершить настройку.",
+  "mcp.auth.reload_engine_retry": "Применить изменения и повторить",
+  "mcp.auth.reload_failed": "Не удалось перезагрузить воркер перед входом.",
+  "mcp.auth.reload_notice": "Чтобы это вступило в силу, OpenWork должен обновить сервис воркера. Это может прервать текущий сеанс.",
+  "mcp.auth.reload_remote_confirm": "Чтобы это вступило в силу, OpenWork должен обновить сервис воркера. Это может остановить текущий сеанс. Продолжить?",
+  "mcp.auth.reopen_browser_link": "Нажмите здесь, чтобы снова открыть браузер",
+  "mcp.auth.request_timed_out": "Время ожидания запроса истекло.",
+  "mcp.auth.retry": "Повторить",
+  "mcp.auth.retry_now": "Повторить сейчас",
+  "mcp.auth.server_disabled": "Этот MCP-сервер отключен. Включите его и попробуйте снова.",
+  "mcp.auth.step1_description": "Мы автоматически запустим поток входа для {server}.",
+  "mcp.auth.step1_title": "Открываем ваш браузер",
+  "mcp.auth.step2_description": "Войдите и подтвердите доступ, когда будет предложено.",
+  "mcp.auth.step2_title": "Авторизовать OpenWork",
+  "mcp.auth.step3_description": "Мы завершим подключение сразу после завершения авторизации.",
+  "mcp.auth.step3_title": "Вернитесь сюда, когда закончите",
+  "mcp.auth.try_reload_engine": "{message}. Сначала попробуйте перезагрузить движок.",
+  "mcp.auth.waiting_authorization": "Ожидание завершения авторизации в браузере...",
+  "mcp.auth.waiting_for_conversation_body": "Мы перенаправим вас на авторизацию как можно скорее.",
+  "mcp.auth.waiting_for_conversation_title": "Ожидание завершения разговора",
+  "mcp.auth.waiting_for_session": "Ожидание завершения работы {session}",
+  "mcp.available_apps": "Доступные приложения",
+  "mcp.cap_signin": "Вход в аккаунт",
+  "mcp.cap_tools": "AI tools",
+  "mcp.config_file": "Файл конфигурации",
+  "mcp.config_load_failed": "Не удалось загрузить файл конфигурации",
+  "mcp.config_not_loaded": "Еще не загружено",
+  "mcp.connect": "Подключить",
+  "mcp.connect_failed": "Не удалось подключиться. Попробуйте еще раз.",
+  "mcp.connect_server_first": "Сначала подключитесь к серверу.",
+  "mcp.connected": "Подключено",
+  "mcp.connected_badge": "Подключено",
+  "mcp.connection_failed": "Проблема с подключением — попробуйте еще раз",
+  "mcp.connection_type": "Подключение",
+  "mcp.control_chrome_browser_hint": "В Chrome 144 или новее сделайте сначала следующее:",
+  "mcp.control_chrome_browser_step_one": "Откройте chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Включите remote debugging.",
+  "mcp.control_chrome_browser_step_three": "Разрешите входящие подключения для отладки, когда Chrome попросит.",
+  "mcp.control_chrome_browser_title": "1. Включите доступ к Chrome",
+  "mcp.control_chrome_connect": "Добавить Control Chrome",
+  "mcp.control_chrome_docs": "Официальное руководство MCP",
+  "mcp.control_chrome_edit": "Изменить настройки",
+  "mcp.control_chrome_profile_hint": "Control Chrome обычно открывает отдельный профиль Chrome. Включите это, если хотите, чтобы OpenWork использовал уже открытое вами окно Chrome.",
+  "mcp.control_chrome_profile_title": "2. Выберите, какой Chrome использовать",
+  "mcp.control_chrome_save": "Сохранить настройки",
+  "mcp.control_chrome_setup_subtitle": "Включите доступ к Chrome, затем выберите, должен ли OpenWork использовать свой чистый профиль или подключаться к уже используемому Chrome.",
+  "mcp.control_chrome_setup_title": "Настроить Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Когда это включено, OpenWork добавляет --autoConnect, чтобы MCP подключался к экземпляру Chrome, который вы уже запустили.",
+  "mcp.control_chrome_toggle_label": "Использовать мой существующий профиль Chrome",
+  "mcp.control_chrome_toggle_off": "OpenWork запустит отдельный профиль Chrome только для автоматизации.",
+  "mcp.control_chrome_toggle_on": "OpenWork будет использовать ваши текущие вкладки, cookies и входы.",
+  "mcp.custom_app_cta_hint": "Подключите свой MCP-сервер, внутренний инструмент или hosted app.",
+  "mcp.desktop_required": "Для приложений требуется настольное приложение.",
+  "mcp.docs_link": "Узнать больше",
+  "mcp.file_not_found": "Файл конфигурации еще не создан",
+  "mcp.friendly_status_issue": "Проблема",
+  "mcp.friendly_status_needs_signin": "Требуется вход",
+  "mcp.friendly_status_offline": "Не в сети",
+  "mcp.friendly_status_paused": "Приостановлено",
+  "mcp.friendly_status_ready": "Готово",
+  "mcp.last_synced": "Синхронизировано",
+  "mcp.login_action": "Войти",
+  "mcp.login_hint": "Подключите ваш аккаунт, чтобы завершить настройку этого приложения.",
+  "mcp.login_unavailable": "Это приложение не поддерживает вход из OpenWork.",
+  "mcp.logout_action": "Выйти",
+  "mcp.logout_failed": "Не удалось выйти.",
+  "mcp.logout_hint": "Удаляет сохраненные OAuth-учетные данные. Вам нужно будет войти снова.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Это удалит сохраненные OAuth-учетные данные для {server}. Вам нужно будет войти снова, чтобы использовать это приложение.",
+  "mcp.logout_modal_title": "Выйти из этого приложения?",
+  "mcp.logout_success": "Выполнен выход из {server}.",
+  "mcp.logout_working": "Выход...",
+  "mcp.name_required": "Введите имя сервера.",
+  "mcp.no_apps_hint": "Подключите одно из приложений выше, чтобы начать.",
+  "mcp.no_apps_yet": "Пока нет подключенных приложений",
+  "mcp.oauth": "Войти",
+  "mcp.oauth_optional_hint": "Использует OAuth в браузере для подключения вашего аккаунта.",
+  "mcp.oauth_optional_label": "Это приложение требует входа",
+  "mcp.one_click_connect": "Подключение в один клик",
+  "mcp.open_file": "Открыть файл",
+  "mcp.opening_label": "Открытие...",
+  "mcp.pick_workspace_error": "Сначала выберите папку рабочего пространства.",
+  "mcp.pick_workspace_first": "Сначала выберите папку рабочего пространства.",
+  "mcp.quick_connect_chrome_desc": "Управляйте вкладками Chrome с помощью браузерной автоматизации.",
+  "mcp.quick_connect_chrome_title": "Control Chrome",
+  "mcp.quick_connect_context7_desc": "Ищите документацию продукта с более богатым контекстом.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Планируйте спринты и быстрее закрывайте задачи.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Страницы, базы данных и проектная документация в синхронизации.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Отслеживайте релизы и устраняйте production-ошибки.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Проверяйте платежи, счета и подписки.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Остановите выполняющуюся задачу, чтобы активировать.",
+  "mcp.remote_workspace_url_hint": "Удаленные воркеры подключаются быстрее всего к MCP-серверам на основе URL.",
+  "mcp.remove_app": "Удалить",
+  "mcp.remove_failed": "Не удалось удалить приложение.",
+  "mcp.remove_modal_message": "Вы уверены, что хотите удалить {server}? Вы всегда сможете добавить его снова позже.",
+  "mcp.remove_modal_title": "Удалить приложение",
+  "mcp.reveal_config_failed": "Не удалось открыть файл конфигурации",
+  "mcp.reveal_in_finder": "Показать в Finder",
+  "mcp.scope_global": "Все рабочие пространства",
+  "mcp.scope_project": "Это рабочее пространство",
+  "mcp.server_command": "Команда",
+  "mcp.server_command_hint": "Команда shell для запуска сервера.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Имя приложения",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Тип",
+  "mcp.server_url": "URL сервера",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Вход",
+  "mcp.tap_to_connect": "Нажмите, чтобы подключиться",
+  "mcp.technical_details": "Технические детали",
+  "mcp.type_cloud": "Cloud (войти через аккаунт)",
+  "mcp.type_local": "Локально (работает на этом устройстве)",
+  "mcp.type_local_cmd": "Локально (команда)",
+  "mcp.type_remote": "Удаленно (URL)",
+  "mcp.url_or_command_required": "Введите URL для удаленного сервера или команду для локального сервера.",
+  "mcp.your_apps": "Ваши приложения",
+  "model_behavior.desc_builtin": "Эта модель сама выбирает путь рассуждения и не показывает профили здесь.",
+  "model_behavior.desc_generic": "Используйте профиль {label}.",
+  "model_behavior.desc_high": "Потратьте больше времени на рассуждение перед ответом.",
+  "model_behavior.desc_high_anthropic": "Используйте стандартный бюджет extended-thinking.",
+  "model_behavior.desc_low": "Используйте более легкий проход рассуждений перед ответом.",
+  "model_behavior.desc_low_google": "Используйте более легкий бюджет рассуждений для более быстрых ответов.",
+  "model_behavior.desc_max": "Используйте самый глубокий профиль рассуждений провайдера.",
+  "model_behavior.desc_max_anthropic": "Используйте самый большой доступный бюджет extended-thinking.",
+  "model_behavior.desc_medium": "Сбалансируйте скорость и глубину рассуждений.",
+  "model_behavior.desc_minimal": "Используйте очень небольшой объем рассуждений.",
+  "model_behavior.desc_none": "Отдайте приоритет скорости и самому легкому пути рассуждений.",
+  "model_behavior.desc_standard": "Эта модель не показывает дополнительных настроек рассуждений.",
+  "model_behavior.label_balanced": "Сбалансированный",
+  "model_behavior.label_builtin": "Встроенный",
+  "model_behavior.label_deep": "Глубокий",
+  "model_behavior.label_extended": "Расширенный",
+  "model_behavior.label_fast": "Быстрый",
+  "model_behavior.label_light": "Легкий",
+  "model_behavior.label_maximum": "Максимальный",
+  "model_behavior.label_quick": "Быстрый",
+  "model_behavior.label_standard": "Стандартный",
+  "model_behavior.title_builtin_reasoning": "Встроенное рассуждение",
+  "model_behavior.title_extended_thinking": "Расширенное thinking",
+  "model_behavior.title_reasoning_budget": "Бюджет рассуждений",
+  "model_behavior.title_reasoning_effort": "Усилие рассуждений",
+  "model_behavior.title_standard_generation": "Стандартная генерация",
+  "model_picker.chat_model_desc": "Выберите модель для этого чата. Если модель поддерживает профили рассуждений, настройте их на ее карточке.",
+  "model_picker.chat_model_title": "Модель чата",
+  "model_picker.connect_provider_hint": "Подключите этого провайдера, чтобы просматривать и сохранять модели",
+  "model_picker.default_model_desc": "Выберите модель по умолчанию для новых чатов, затем донастройте профили рассуждений на ее карточке перед нажатием Done.",
+  "model_picker.default_model_title": "Модель по умолчанию",
+  "model_picker.model_count_one": "{count} модель",
+  "model_picker.model_count_few": "{count} модели",
+  "model_picker.model_count_many": "{count} моделей",
+  "model_picker.model_count_other": "{count} моделей",
+  "model_picker.more_providers": "Еще провайдеры",
+  "model_picker.no_results": "По вашему поиску нет моделей.",
+  "model_picker.other_connected_models": "Другие подключенные модели",
+  "model_picker.recommended": "Рекомендуется",
+  "onboarding.authorize_folder": "Авторизовать папку",
+  "plugins.add": "Добавить",
+  "plugins.add_hint": "Введите названия npm-пакетов, например opencode-wakatime",
+  "plugins.add_label": "Добавить plugin",
+  "plugins.added": "Добавлено",
+  "plugins.config": "Конфиг",
+  "plugins.config_label": "Конфиг",
+  "plugins.desc": "Управляйте `opencode.json` для плагинов OpenCode вашего проекта или глобальных плагинов OpenCode.",
+  "plugins.empty": "Пока не настроено ни одного плагина.",
+  "plugins.enabled": "Включено",
+  "plugins.hide_setup": "Скрыть настройку",
+  "plugins.not_loaded": "Еще не загружено",
+  "plugins.not_loaded_yet": "Еще не загружено",
+  "plugins.remove": "Удалить",
+  "plugins.scope_global": "Глобально",
+  "plugins.scope_project": "Проект",
+  "plugins.setup": "Настройка",
+  "plugins.suggested": "Предложенные Plugins",
+  "plugins.suggested_heading": "Предложенные Plugins",
+  "plugins.title": "Плагины OpenCode",
+  "providers.api_key_label": "API key",
+  "providers.api_key_required": "Требуется API key",
+  "providers.auth_failed": "Ошибка аутентификации",
+  "providers.connect_failed": "Не удалось подключить провайдера",
+  "providers.disabled_in_config_suffix": "и отключил его в конфигурации OpenCode.",
+  "providers.disconnect_failed": "Не удалось отключить провайдера",
+  "providers.disconnected_prefix": "Отключено",
+  "providers.load_failed": "Не удалось загрузить провайдеров",
+  "providers.no_oauth_prefix": "Для не найден OAuth-поток",
+  "providers.no_providers_available": "Провайдеры недоступны",
+  "providers.not_connected": "Нет подключения к серверу",
+  "providers.not_oauth_flow_prefix": "Выбранный метод авторизации не является OAuth-потоком для",
+  "providers.oauth_failed": "Не удалось завершить OAuth",
+  "providers.oauth_method_required": "Требуется метод OAuth",
+  "providers.provider_error": "Ошибка провайдера ({provider})",
+  "providers.provider_id_required": "Требуется ID провайдера",
+  "providers.rate_limit_exceeded": "Превышен лимит запросов",
+  "providers.removal_unsupported": "Этот клиент не поддерживает удаление OAuth-авторизации провайдера.",
+  "providers.request_failed": "Запрос не выполнен",
+  "providers.save_api_key_failed": "Не удалось сохранить API key",
+  "providers.still_connected_suffix": ", но воркер по-прежнему сообщает, что подключен. Очистите оставшийся API key или OAuth-учетные данные и перезапустите воркер, чтобы полностью отключиться.",
+  "providers.unknown_provider": "Неизвестный провайдер",
+  "providers.use_api_key_suffix": "Используйте вместо этого API key.",
+  "question_modal.custom_answer_label": "Или введите свой ответ",
+  "question_modal.custom_answer_placeholder": "Введите ваш ответ здесь...",
+  "question_modal.question_counter": "Вопрос {current} из {total}",
+  "session.allow_for_session": "Разрешить для сеанса",
+  "session.allow_once": "Разрешить один раз",
+  "session.cmd_current_workspace": "Текущее рабочее пространство",
+  "session.cmd_new_session_detail": "Начать новую задачу в текущем рабочем пространстве",
+  "session.cmd_new_session_meta": "Создать",
+  "session.cmd_new_session_title": "Создать новый сеанс",
+  "session.cmd_sessions_detail": "{count} доступно во всех рабочих пространствах",
+  "session.cmd_sessions_meta": "Перейти",
+  "session.cmd_sessions_title": "Поиск сеансов",
+  "session.cmd_settings_meta": "Открыть",
+  "session.cmd_switch": "Переключить",
+  "session.palette_no_matches": "Совпадений нет.",
+  "session.create_or_connect_workspace": "Создайте или подключите рабочее пространство",
+  "session.default_agent": "Агент по умолчанию",
+  "session.default_model": "Выберите модель",
+  "session.default_title": "Новый сеанс",
+  "session.delete": "Удалить",
+  "session.delete_named_session_message": "Это навсегда удалит \"{title}\" и его сообщения.",
+  "session.delete_session_generic": "Это навсегда удалит выбранный сеанс и его сообщения.",
+  "session.delete_session_title": "Удалить сеанс?",
+  "session.deleting": "Удаление...",
+  "session.deny": "Запретить",
+  "session.details": "Подробности",
+  "session.details_label": "Подробности",
+  "session.doom_loop_label": "Doom Loop",
+  "session.doom_loop_message": "OpenCode обнаружил повторяющиеся вызовы инструментов с одинаковым входом и спрашивает, продолжать ли после повторяющихся сбоев.",
+  "session.doom_loop_note": "Отклоните, чтобы остановить цикл, или разрешите, если хотите, чтобы агент продолжал попытки.",
+  "session.doom_loop_repeated_call_label": "Повторный вызов",
+  "session.doom_loop_repeated_tool_call": "Повторный вызов инструмента",
+  "session.doom_loop_title": "Обнаружен Doom Loop",
+  "session.doom_loop_tool_label": "Инструмент",
+  "session.export_already_running": "Экспорт уже выполняется.",
+  "session.export_desktop_only": "Экспорт доступен в настольном приложении.",
+  "session.export_desktop_only_local": "Экспорт доступен для локальных воркеров в настольном приложении.",
+  "session.export_local_only": "Экспорт поддерживается только для локальных воркеров.",
+  "session.loading_detail": "Подтягиваем последние сообщения для этой задачи.",
+  "session.model": "Модель",
+  "session.new_task": "Новая задача",
+  "session.open": "Открыть",
+  "session.palette_hint_navigate": "Стрелки для навигации",
+  "session.palette_hint_run": "Enter для запуска · Esc для закрытия",
+  "session.palette_placeholder_actions": "Поиск действий",
+  "session.palette_placeholder_sessions": "Найти по названию сеанса или рабочему пространству",
+  "session.palette_title_actions": "Быстрые действия",
+  "session.palette_title_sessions": "Поиск сеансов",
+  "session.permission_label": "Разрешение",
+  "session.permission_detail_command": "Команда",
+  "session.permission_detail_cwd": "Рабочий каталог",
+  "session.permission_detail_description": "Описание",
+  "session.permission_detail_diff": "Diff",
+  "session.permission_detail_files": "Файлы",
+  "session.permission_detail_file": "Файл",
+  "session.permission_detail_agent": "Агент",
+  "session.permission_detail_parent_directory": "Родительский каталог",
+  "session.permission_detail_path": "Путь",
+  "session.permission_detail_query": "Запрос",
+  "session.permission_detail_target": "Цель",
+  "session.permission_detail_tool": "Инструмент",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Редактирование файла",
+  "session.permission_kind_external_directory": "Внешний каталог",
+  "session.permission_kind_question": "Вопрос",
+  "session.permission_kind_read": "Чтение файла",
+  "session.permission_kind_skill": "Навык",
+  "session.permission_kind_task": "Подзадача",
+  "session.permission_kind_todowrite": "Запись todo",
+  "session.permission_message": "OpenCode запрашивает разрешение на продолжение.",
+  "session.permission_message_bash": "Проверьте область команды перед тем, как разрешить OpenCode продолжить.",
+  "session.permission_message_edit": "Проверьте файл и diff перед тем, как разрешить OpenCode вносить изменения.",
+  "session.permission_message_external_directory": "Проверьте папку перед тем, как разрешить доступ вне workspace.",
+  "session.permission_message_read": "Проверьте запрашиваемую область файла перед тем, как разрешить доступ.",
+  "session.permission_message_task": "Проверьте запрашиваемую подзадачу перед тем, как разрешить ее запуск.",
+  "session.permission_metadata_unavailable": "Метаданные не удалось отобразить.",
+  "session.permission_review_label": "Проверка",
+  "session.permission_scope_empty": "Явная область не указана.",
+  "session.permission_title_bash": "Выполнить shell-команду?",
+  "session.permission_title_edit": "Изменить файлы?",
+  "session.permission_title_external_directory": "Получить доступ к внешней папке?",
+  "session.permission_title_generic": "Одобрить {permission}?",
+  "session.permission_title_read": "Прочитать файлы?",
+  "session.permission_title_task": "Запустить подзадачу?",
+  "session.permission_decision_hint": "Разрешите один раз для этого запроса или разрешите для сеанса, если доверяете этой области.",
+  "session.redo_aria_label": "Повторить последнее отмененное сообщение",
+  "session.redo_label": "Повторить",
+  "session.redo_title": "Повторить последнее отмененное сообщение",
+  "session.rename_description": "Обновите имя для этого сеанса.",
+  "session.rename_label": "Имя сеанса",
+  "session.rename_placeholder": "Введите новое имя",
+  "session.rename_title": "Переименовать сеанс",
+  "session.resize_workspace_column": "Изменить ширину колонки workspace",
+  "session.revert_label": "Отменить",
+  "session.scope_label": "Область",
+  "session.select_or_create_session": "Выберите или создайте сеанс, чтобы начать.",
+  "session.share_collaborator_hint": "Обычный удаленный доступ, когда вам не нужны действия только владельца.",
+  "session.share_collaborator_host_hint": "Обычный удаленный доступ к этому хосту без действий только владельца.",
+  "session.share_collaborator_label": "Токен соавтора",
+  "session.share_connected_with_hint": "Это рабочее пространство сейчас подключено с этим паролем.",
+  "session.share_desktop_app_required": "Требуется настольное приложение",
+  "session.share_local_host_not_ready": "Локальный хост OpenWork пока не готов.",
+  "session.share_missing_host_url": "Отсутствует URL хоста OpenWork.",
+  "session.share_missing_token": "Отсутствует токен OpenWork.",
+  "session.share_note_direct_runtime": "Удаленный доступ делит текущего локального воркера, который сейчас работает. Если вы позже переключите локальные папки, снова откройте эту панель, чтобы проверить URL и пароль.",
+  "session.share_opencode_base_url": "Базовый URL OpenCode",
+  "session.share_openwork_workers_only": "Ссылки сервиса общего доступа доступны только для воркеров OpenWork.",
+  "session.share_owner_permission_hint": "Используйте, когда удаленному клиенту нужно отвечать на запросы разрешений.",
+  "session.share_password": "Пароль",
+  "session.share_select_workspace": "Сначала выберите workspace.",
+  "session.share_set_token_hint": "Установите токен в настройках workspace",
+  "session.share_starting_server": "Запуск сервера...",
+  "session.share_worker_url": "URL воркера",
+  "session.share_worker_url_phones_hint": "Используйте на телефонах или ноутбуках, подключающихся к этому воркеру.",
+  "session.share_worker_url_resolving_hint": "URL воркера определяется; URL хоста показан как запасной вариант.",
+  "session.support_docs": "Открыть документацию",
+  "session.support_feedback": "Открыть отзывы",
+  "session.todo_label": "Задачи",
+  "session.todo_progress": "{completed} из {total} задач выполнено",
+  "session.todo_progress_label": "Прогресс",
+  "session.undo_label": "Отменить",
+  "session.undo_title": "Отменить последнее сообщение",
+  "session.untitled": "Без названия",
+  "session.workspace_fallback": "Рабочее пространство",
+  "share.back_hint": "Назад к параметрам общего доступа",
+  "share.chooser_subtitle": "Выберите, как вы хотите поделиться этим рабочим пространством.",
+  "share.close_hint": "Закрыть",
+  "share.option_access_desc": "Покажите live connection details, необходимые для доступа к этому запущенному workspace с другого компьютера.",
+  "share.option_access_title": "Удаленный доступ к workspace",
+  "share.subtitle_access": "Покажите live connection details, необходимые для доступа к этому workspace с другого компьютера.",
+  "share.title": "Поделиться workspace",
+  "share.view_access": "Доступ к workspace удаленно",
+  "share.workspace_fallback": "Рабочее пространство",
+  "share_skill_destination.add_to_workspace": "Добавить навык в workspace",
+  "share_skill_destination.adding": "Добавление навыка...",
+  "share_skill_destination.connect_remote": "Подключить удаленное workspace",
+  "share_skill_destination.connect_remote_hint": "Подключите хост OpenWork, затем выберите его из списка, чтобы импортировать этот навык.",
+  "share_skill_destination.create_worker": "Создать новое workspace",
+  "share_skill_destination.create_worker_hint": "Откройте поток настройки workspace, а затем добавьте этот навык после того, как новое workspace будет готово.",
+  "share_skill_destination.current_badge": "Текущее",
+  "share_skill_destination.existing_workers": "Существующие рабочие пространства",
+  "share_skill_destination.fallback_skill_name": "Общий навык",
+  "share_skill_destination.local_badge": "Локально",
+  "share_skill_destination.more_options": "Еще варианты",
+  "share_skill_destination.no_workers": "Пока нет готовых рабочих пространств. Создайте одно или подключите удаленное workspace, чтобы установить этот навык.",
+  "share_skill_destination.remote_badge": "Удаленно",
+  "share_skill_destination.sandbox_badge": "Песочница",
+  "share_skill_destination.selected_badge": "Выбрано",
+  "share_skill_destination.selected_hint": "Выбрано. Проверьте назначение ниже, затем подтвердите.",
+  "share_skill_destination.skill_label": "Общий навык",
+  "share_skill_destination.subtitle": "Выберите существующее workspace или создайте новое перед импортом этого общего навыка.",
+  "share_skill_destination.title": "Куда должен попасть этот навык?",
+  "share_skill_destination.trigger_label": "Триггер",
+  "sidebar.collapse": "Свернуть",
+  "sidebar.expand": "Развернуть",
+  "skills.add_custom_repo": "Добавить пользовательский GitHub-репозиторий",
+  "skills.add_git_repo": "Добавить git-репозиторий",
+  "skills.add_openwork_hub": "Добавить OpenWork Hub",
+  "skills.available_from_hub": "Доступно из Hub",
+  "skills.catalog_search_placeholder": "Поиск установленных, командных и hub-навыков",
+  "skills.cloud_choose_org_detail": "Используйте панель Cloud, чтобы выбрать активную организацию, затем обновите этот список.",
+  "skills.cloud_choose_org_hint": "Выберите организацию в Settings → Cloud, чтобы загрузить навыки команды.",
+  "skills.cloud_footer_label": "Команда",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "Установлен {name} на этом воркере.",
+  "skills.cloud_installed_as": "Установлен как {name}",
+  "skills.cloud_installing": "Установка {title}…",
+  "skills.cloud_installing_short": "Установка",
+  "skills.cloud_no_search_matches": "По вашему поиску навыки не найдены.",
+  "skills.cloud_org_empty": "Пока нет доступных навыков организации.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "Не удалось загрузить навыки организации.",
+  "skills.cloud_refresh": "Обновить навыки команды",
+  "skills.cloud_section_subtitle": "Навыки, которыми с вами поделились через OpenWork Cloud — включая хабы навыков команды, к которым у вас есть доступ.",
+  "skills.cloud_section_title": "Из вашей организации",
+  "skills.cloud_shared_org": "Организация",
+  "skills.cloud_shared_private": "Приватный",
+  "skills.cloud_shared_public": "Публичный",
+  "skills.cloud_sign_in": "Войти в Cloud",
+  "skills.cloud_sign_in_hint": "Войдите в OpenWork Cloud, чтобы просматривать навыки команды и организации.",
+  "skills.cloud_status_installed": "Установлено",
+  "skills.cloud_status_update": "Доступно обновление",
+  "skills.cloud_update_skill": "Обновить",
+  "skills.cloud_updated": "Обновлен {name} на этом воркере.",
+  "skills.cloud_updating": "Обновление {title}…",
+  "skills.cloud_removed": "Удален локальный cloud-навык {name}.",
+  "skills.copy_link_failed": "Не удалось скопировать ссылку",
+  "skills.create_in_chat": "Создать навык в чате",
+  "skills.desktop_required": "Для управления навыками требуется настольное приложение.",
+  "skills.enter_plugin_name": "Введите название пакета плагина.",
+  "skills.failed_load_active": "Не удалось загрузить активные плагины.",
+  "skills.failed_load_opencode": "Не удалось загрузить opencode.json",
+  "skills.failed_parse_opencode": "Не удалось разобрать opencode.json",
+  "skills.failed_to_load": "Не удалось загрузить навыки",
+  "skills.failed_update_opencode": "Не удалось обновить opencode.json",
+  "skills.filter_all": "Все",
+  "skills.filter_cloud": "Команда",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Установленные",
+  "skills.from_repo": "Из {owner}/{repo}",
+  "skills.github_repo_hint": "Введите GitHub-репозиторий в формате owner/repo.",
+  "skills.host_mode_only": "Только локальное рабочее пространство",
+  "skills.host_only_error": "Для управления навыками требуется локальное рабочее пространство или подключенный сервер OpenWork.",
+  "skills.hub_desc": "Просматривайте общие навыки из GitHub-backed хабов и добавляйте их в этого воркера.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Импортировать",
+  "skills.import_failed": "Импорт не удался ({status})",
+  "skills.import_local": "Импортировать локальный навык",
+  "skills.import_local_skill": "Импортировать локальный навык",
+  "skills.imported": "Импортировано.",
+  "skills.install": "Установить",
+  "skills.install_failed": "Не удалось установить навык.",
+  "skills.install_name_title": "Установить {name}",
+  "skills.installed": "Установленные навыки",
+  "skills.installed_desc": "Установленные навыки живут на этом воркере и могут быть отредактированы или переданы.",
+  "skills.installed_status": "Установлено",
+  "skills.installing": "Добавить навык",
+  "skills.installing_prefix": "Установка {name}…",
+  "skills.installing_skill_creator": "Установка Skill Creator...",
+  "skills.link_copied": "Ссылка скопирована",
+  "skills.loading": "Загрузка…",
+  "skills.no_description": "Описание пока отсутствует.",
+  "skills.no_hub_repo_label": "Hub-репозиторий не выбран",
+  "skills.no_hub_repo_selected": "Hub-навыки недоступны.",
+  "skills.no_hub_skills": "Hub-репозиторий не выбран. Добавьте GitHub-репозиторий, чтобы просматривать навыки.",
+  "skills.no_opencode_found": "opencode.json пока не найден. Добавьте плагин, чтобы создать его.",
+  "skills.no_opencode_workspace": "В этом рабочем пространстве пока нет opencode.json.",
+  "skills.no_skills": "Навыки не обнаружены в `.opencode/skills`, `.claude/skills` или `~/.agents/skills`.",
+  "skills.no_skills_found": "Пока навыки не найдены.",
+  "skills.owner_label": "Владелец",
+  "skills.owner_repo_required": "Требуются владелец и репозиторий.",
+  "skills.pick_project_first": "Сначала выберите папку проекта.",
+  "skills.pick_project_for_active": "Выберите папку проекта, чтобы загрузить активные плагины.",
+  "skills.pick_project_for_plugins": "Выберите папку проекта для управления плагинами проекта.",
+  "skills.pick_workspace_first": "Сначала выберите папку рабочего пространства.",
+  "skills.plugin_already_listed": "Плагин уже указан в opencode.json.",
+  "skills.plugin_management_host_only": "Управление плагинами требует настольного приложения.",
+  "skills.plugins_host_only": "Плагины доступны только в настольном приложении.",
+  "skills.ref_label": "Ref (ветка/тег/коммит)",
+  "skills.refresh": "Обновить",
+  "skills.refresh_hub": "Обновить Hub",
+  "skills.remove_saved_repo": "Удалить сохраненный репозиторий",
+  "skills.repo_label": "Репозиторий",
+  "skills.reveal_failed": "Не удалось открыть папку навыков.",
+  "skills.reveal_folder": "Открыть папку навыков",
+  "skills.save_and_load": "Сохранить и загрузить",
+  "skills.select_skill_folder": "Выберите папку навыка",
+  "skills.share_back": "Назад",
+  "skills.share_chooser_subtitle": "Сохраните в вашу организацию OpenWork Cloud или опубликуйте публичную ссылку установки.",
+  "skills.share_close": "Закрыть",
+  "skills.share_copy_link": "Копировать",
+  "skills.share_done": "Готово",
+  "skills.share_option_public_desc": "Создайте ссылку, по которой любой сможет установить этот навык.",
+  "skills.share_option_public_title": "Публичная ссылка",
+  "skills.share_option_team_desc": "Добавьте этот навык в активную организацию OpenWork Cloud.",
+  "skills.share_option_team_title": "Поделиться с командой",
+  "skills.share_public_create": "Создать ссылку",
+  "skills.share_public_creating": "Публикация…",
+  "skills.share_public_intro": "Опубликуйте публичную ссылку. Любой, у кого есть URL, сможет установить этот навык.",
+  "skills.share_public_regenerate": "Сгенерировать ссылку заново",
+  "skills.share_publisher_label": "Издатель",
+  "skills.share_subtitle_public": "Любой, у кого есть ссылка, сможет установить этот навык.",
+  "skills.share_subtitle_team": "Сохраняется в вашей организации для коллег.",
+  "skills.share_team_choose_org": "Выберите организацию в Settings → Cloud перед тем, как делиться с командой.",
+  "skills.share_team_permissions_intro": "Загрузите этот навык в активную организацию OpenWork Cloud и решите, кто сможет его видеть.",
+  "skills.share_team_permissions_label": "Права общего доступа",
+  "skills.share_team_permission_org": "Только организация - не в Hub",
+  "skills.share_team_permission_private": "Только для меня",
+  "skills.share_team_hubs_loading": "Загрузка Hub...",
+  "skills.share_team_org_fallback": "Активная Cloud org",
+  "skills.share_team_upload_and_save": "Загрузить и сохранить",
+  "skills.share_team_uploading": "Загрузка…",
+  "skills.share_team_sign_in": "Войти, чтобы делиться с командой",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud откроется в вашем браузере. Вернитесь сюда после входа.",
+  "skills.share_team_uploaded_success": "Загружено в {org}. Cloud-навыки обновятся для вашего аккаунта.",
+  "skills.share_title": "Поделиться навыком",
+  "skills.shown_count": "Показано {count}",
+  "skills.skill_creator_already_installed": "Skill Creator уже установлен.",
+  "skills.skill_creator_installed": "Skill Creator установлен.",
+  "skills.skill_load_failed": "Не удалось загрузить навык.",
+  "skills.source_label": "Источник",
+  "skills.title": "Навыки",
+  "skills.trigger_label": "Триггер: {trigger}",
+  "skills.uninstall": "Удалить",
+  "skills.uninstall_failed": "Не удалось удалить навык.",
+  "skills.uninstall_title": "Удалить навык?",
+  "skills.uninstall_warning": "Это навсегда удалит навык `{name}` из вашего рабочего пространства.",
+  "skills.uninstalled": "Навык удален.",
+  "skills.unknown_error": "Неизвестная ошибка",
+  "skills.worker_profile_desc": "Навыки — это основные возможности этого воркера. Находите их в Hub, управляйте установленными и создавайте новые прямо в чате.",
+  "status.back": "Назад к предыдущему экрану",
+  "status.connected": "Подключено",
+  "status.connecting": "Подключение",
+  "status.creating_task": "Создание новой задачи",
+  "status.developer_mode": "Режим разработчика",
+  "status.disconnected": "Отключено",
+  "status.disconnected_hint": "Откройте настройки, чтобы переподключиться",
+  "status.disconnected_label": "Отключено",
+  "status.docs": "Документация",
+  "status.feedback": "Обратная связь",
+  "status.limited_hint": "Переподключитесь, чтобы восстановить все возможности OpenWork",
+  "status.limited_mcp_hint": "{count} MCP подключено · переподключитесь для полных возможностей",
+  "status.limited_mode": "Ограниченный режим",
+  "status.loading_session": "Загрузка сеанса",
+  "status.mcp_connected": "{count} MCP подключено",
+  "status.open_docs": "Открыть документацию",
+  "status.openwork_ready": "OpenWork готов",
+  "status.providers_connected_one": "Подключён {count} провайдер",
+  "status.providers_connected_few": "Подключено {count} провайдера",
+  "status.providers_connected_many": "Подключено {count} провайдеров",
+  "status.providers_connected_other": "Подключено {count} провайдеров",
+  "status.ready_for_tasks": "Готов к новым задачам",
+  "status.running": "Выполняется",
+  "status.send_feedback": "Отправить отзыв",
+  "status.settings": "Настройки",
+  "system.reload_body_agents": "OpenCode загружает агентов при запуске. Перезагрузите движок, чтобы обновленные агенты стали доступны.",
+  "system.reload_body_commands": "OpenCode загружает команды при запуске. Перезагрузите движок, чтобы обновленные команды стали доступны.",
+  "system.reload_body_config": "OpenCode читает opencode.json при запуске. Перезагрузите движок, чтобы применить изменения конфигурации.",
+  "system.reload_body_default": "OpenWork обнаружил изменения, требующие перезагрузки экземпляра OpenCode.",
+  "system.reload_body_mcp": "OpenCode загружает MCP-серверы при запуске. Перезагрузите движок, чтобы активировать новое подключение.",
+  "system.reload_body_mixed": "OpenWork обнаружил изменения конфигурации OpenCode. Перезагрузите движок, чтобы применить их.",
+  "system.reload_body_plugins": "OpenCode загружает npm-плагины при запуске. Перезагрузите движок, чтобы применить изменения opencode.json.",
+  "system.reload_body_skills": "OpenCode может кэшировать обнаружение и состояние навыков. Перезагрузите движок, чтобы новые навыки стали доступны.",
+  "system.reload_failed": "Не удалось перезагрузить движок.",
+  "system.reload_required": "Требуется перезагрузка",
+  "system.reload_unavailable": "Перезагрузка недоступна для этого воркера.",
+  "system.stop_active_runs_before_reset": "Остановите активные запуски перед сбросом.",
+  "time.hours_ago": "{count} ч назад",
+  "time.just_now": "только что",
+  "time.minutes_ago": "{count} мин назад",
+  "time.seconds_ago": "{count} с назад",
+  "welcome.title": "Добро пожаловать в OpenWork",
+  "welcome.subtitle": "Ваш компьютер, но он работает для вас.",
+  "welcome.get_started": "Начать",
+  "welcome.capability_spreadsheets": "Редактировать таблицы",
+  "welcome.capability_spreadsheets_desc": "Создавайте, очищайте и преобразуйте CSV- и Excel-файлы.",
+  "welcome.capability_browser": "Управлять браузером",
+  "welcome.capability_browser_desc": "Автоматизируйте Chrome для повторяющихся веб-задач.",
+  "welcome.capability_files": "Организовывать файлы",
+  "welcome.capability_files_desc": "Читать, записывать и управлять файлами и папками.",
+  "welcome.capability_automate": "Автоматизировать задачи",
+  "welcome.capability_automate_desc": "Создавайте повторно используемые рабочие процессы с навыками и командами.",
+  "welcome.capability_content": "Генерировать контент",
+  "welcome.capability_content_desc": "Создавайте черновики документов, писем и отчетов.",
+  "welcome.capability_apis": "Подключаться к API",
+  "welcome.capability_apis_desc": "Подключайтесь к внешним сервисам и инструментам через MCP.",
+  "welcome.folder_title": "Выберите папку",
+  "welcome.folder_explanation": "Эта папка станет вашим workspace. OpenWork сможет:",
+  "welcome.folder_read": "Читать файлы, которые вы туда поместите",
+  "welcome.folder_write": "Создавать и редактировать файлы для вас",
+  "welcome.folder_anything": "Работать с таблицами, документами, изображениями — с чем угодно в папке",
+  "welcome.folder_drop_hint": "Перетаскивайте файлы в любое время, и OpenWork сможет их подхватить.",
+  "workspace.create_workspace": "Создать рабочее пространство",
+  "workspace.empty_state_body": "Создайте или подключите рабочее пространство, чтобы начать.",
+  "workspace.loading_tasks": "Загрузка задач...",
+  "workspace.local_badge": "Локально",
+  "workspace.new_task_inline": "+ Новая задача",
+  "workspace.no_tasks": "Пока нет задач.",
+  "workspace.remote_badge": "Удаленно",
+  "workspace.rename_description": "Обновите имя, отображаемое в sidebar.",
+  "workspace.rename_label": "Имя рабочего пространства",
+  "workspace.rename_placeholder": "Рабочее пространство команды дизайна",
+  "workspace.rename_title": "Изменить имя рабочего пространства",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Выбрано",
+  "workspace_list.add_workspace": "Добавить рабочее пространство",
+  "workspace_list.connecting": "Подключение...",
+  "workspace_list.delete_session": "Удалить сеанс",
+  "workspace_list.edit_connection": "Изменить подключение",
+  "workspace_list.edit_name": "Изменить имя",
+  "workspace_list.hide_child_sessions": "Скрыть дочерние сеансы",
+  "workspace_list.recover": "Восстановить",
+  "workspace_list.remove_confirm": "Удалить это рабочее пространство из sidebar? Сеансы и файлы на диске останутся сохранены.",
+  "workspace_list.remove_workspace": "Удалить рабочее пространство",
+  "workspace_list.rename_session": "Переименовать сеанс",
+  "workspace_list.reveal_explorer": "Показать в Explorer",
+  "workspace_list.reveal_finder": "Показать в Finder",
+  "workspace_list.session_actions": "Действия сеанса",
+  "workspace_list.share": "Поделиться...",
+  "workspace_list.show_child_sessions": "Показать дочерние сеансы",
+  "workspace_list.show_more": "Показать еще {count}",
+  "workspace_list.show_more_fallback": "Показать еще",
+  "workspace_list.test_connection": "Проверить подключение",
+  "workspace_list.workspace_fallback": "Рабочее пространство",
+  "workspace_list.workspace_options": "Параметры рабочего пространства",
+  "settings.audit_actor_host": "хост",
+  "settings.audit_actor_remote": "удаленный",
+  "settings.api_keys_info": "API-ключи OpenCode хранит локально. Провайдеров, завязанных на environment variables, нужно менять в окружении воркера, а затем перезагружать.",
+  "settings.appearance_hint": "Сопоставьте с системой или принудительно включите светлую/темную тему.",
+  "settings.appearance_title": "Внешний вид",
+  "settings.audit_log_title": "Журнал аудита",
+  "settings.auto_compact": "Автосжатие контекста",
+  "settings.auto_compact_desc": "Управляет OpenCode compaction.auto для этого рабочего пространства. После изменения перезагрузите движок.",
+  "settings.auto_update_desc": "Загружать обновления автоматически (перед установкой будет запрашиваться подтверждение).",
+  "settings.auto_update_title": "Автообновление",
+  "settings.background_checks_desc": "OpenWork всегда проверяет наличие обновлений при запуске. Также раз в день выполняет фоновую проверку.",
+  "settings.background_checks_title": "Фоновые проверки",
+  "settings.cache_repair_requires_desktop": "Восстановление кэша требует настольного приложения",
+  "settings.cap_browser_tools": "Инструменты браузера: {value}",
+  "settings.cap_commands": "Команды: {value}",
+  "settings.cap_config": "Конфиг: {value}",
+  "settings.cap_file_tools": "Инструменты файлов: {value}",
+  "settings.cap_inbox_off": "входящие выкл.",
+  "settings.cap_inbox_on": "входящие вкл.",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "исходящие выкл.",
+  "settings.cap_outbox_on": "исходящие вкл.",
+  "settings.cap_plugins": "Плагины: {value}",
+  "settings.cap_read": "чтение",
+  "settings.cap_read_only": "только чтение",
+  "settings.cap_read_write": "чтение/запись",
+  "settings.cap_sandbox": "Песочница: {value}",
+  "settings.cap_skills": "Навыки: {value}",
+  "settings.cap_write": "запись",
+  "settings.cap_write_only": "только запись",
+  "settings.capabilities_title": "Возможности сервера OpenWork",
+  "settings.capabilities_unavailable": "Возможности недоступны. Подключитесь с токеном клиента.",
+  "settings.change": "Изменить",
+  "settings.choose": "Выбрать",
+  "settings.clear": "Очистить",
+  "settings.config_updated": "Конфигурация обновлена. Перезагрузите движок, если изменение влияет на OpenCode.",
+  "settings.configure": "Настроить",
+  "settings.connect_provider": "Подключить провайдера",
+  "settings.connection": "Подключение",
+  "settings.connection_failed": "Подключение не удалось",
+  "settings.connection_title": "Подключение",
+  "settings.copied_debug_report": "JSON runtime-отчета скопирован.",
+  "settings.copy_json": "Скопировать JSON",
+  "settings.custom_binary_hint": "Используйте это, чтобы указать OpenWork на локальную сборку OpenCode",
+  "settings.custom_binary_label": "Пользовательский бинарный файл OpenCode",
+  "settings.debug_base_url": "Базовый URL: {url}",
+  "settings.debug_commit": "Коммит: {sha}",
+  "settings.debug_connect_url": "URL подключения: {url}",
+  "settings.debug_desktop_app": "Настольное приложение: {version}",
+  "settings.debug_hostname": "Имя хоста: {hostname}",
+  "settings.debug_lan_url": "LAN URL: {url}",
+  "settings.debug_mdns_url": "mDNS URL: {url}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "Сервер OpenWork: {version}",
+  "settings.debug_pid": "PID: {pid}",
+  "settings.debug_port": "Порт: {port}",
+  "settings.debug_project_dir": "Каталог проекта: {path}",
+  "settings.debug_remote_access": "Удаленный доступ: {value}",
+  "settings.debug_runtime": "Среда выполнения: {runtime}",
+  "settings.error": "Ошибка",
+  "settings.idle": "В ожидании",
+  "settings.loading": "Загрузка",
+  "settings.deeplink_hint": "Принимает openwork://, openwork-dev:// или поддерживаемый raw URL https://share.openworklabs.com/b/...",
+  "settings.default_label": "По умолчанию",
+  "settings.delete_containers": "Удаление контейнеров...",
+  "settings.delete_local_config": "Удаление локального состояния...",
+  "settings.dev_mode_badge": "Режим dev",
+  "settings.developer": "Разработчик",
+  "settings.developer_mode_desc": "Включает инструменты отладки, диагностику и вкладку Developer.",
+  "settings.developer_mode_title": "Режим разработчика",
+  "settings.developer_panel_disabled": "Панель разработчика включена.",
+  "settings.developer_panel_enabled": "Панель разработчика включена.",
+  "settings.diag_approval": "Разрешение: {mode} ({ms}мс)",
+  "settings.diag_config_path": "Путь к конфигу: {path}",
+  "settings.diag_default": "по умолчанию",
+  "settings.diag_host_token_source": "Источник host-токена: {source}",
+  "settings.diag_opencode_binary": "Бинарный файл OpenCode: {binary}",
+  "settings.diag_read_only": "Только чтение: {value}",
+  "settings.diag_runtime_workspace": "Runtime workspace: {id}",
+  "settings.diag_selected_workspace": "Выбранное workspace: {id}",
+  "settings.diag_started": "Запущено: {time}",
+  "settings.diag_token_source": "Источник токена: {source}",
+  "settings.diag_workspaces": "Рабочие пространства: {count}",
+  "settings.diagnostics_unavailable": "Диагностика недоступна.",
+  "settings.disable_developer_mode": "Отключить режим разработчика",
+  "settings.disabled": "Отключено",
+  "settings.disconnect": "Отключить",
+  "settings.disconnect_server": "Отключить сервер",
+  "settings.disconnecting": "Отключение...",
+  "settings.docker_containers_desc": "Принудительно удалить Docker-контейнеры, запущенные OpenWork",
+  "settings.docker_containers_title": "Docker-контейнеры OpenWork",
+  "settings.docker_requires_desktop": "Для очистки Docker требуется настольное приложение",
+  "settings.done": "Готово",
+  "settings.enable_developer_mode": "Включить режим разработчика",
+  "settings.enable_exa": "Включить веб-поиск Exa",
+  "settings.enable_exa_desc": "Вступит в силу при следующем запуске OpenCode через OpenWork. По умолчанию выключено.",
+  "settings.engine_bundled": "Встроенный (рекомендуется)",
+  "settings.engine_bundled_hint": "Встроенный движок — самый надежный вариант. Используйте System",
+  "settings.engine_custom_binary": "Пользовательский binary",
+  "settings.engine_desc": "Выберите, как локально запускается OpenCode.",
+  "settings.engine_source": "Источник движка",
+  "settings.engine_source_debug": "Источник движка",
+  "settings.engine_system_path": "Системная установка (PATH)",
+  "settings.engine_title": "Движок",
+  "settings.exa_restart_hint": "Перезапустите OpenCode после изменения этой настройки.",
+  "settings.export": "Экспорт",
+  "settings.exported_debug_report": "JSON runtime-отчета экспортирован.",
+  "settings.feedback_badge": "Мы читаем каждое сообщение",
+  "settings.feedback_desc": "Расскажите, что вам нравится, а что вызывает трудности. Отзыв сразу попадает команде и помогает понять, что выпускать дальше.",
+  "settings.feedback_title": "Помогите сформировать OpenWork",
+  "settings.group_global": "Глобально",
+  "settings.group_workspace": "Рабочее пространство",
+  "settings.hide_titlebar": "Скрыть title bar",
+  "settings.hide_titlebar_desc": "Скрыть заголовок окна. Полезно для оконной раскладки",
+  "settings.join_discord": "Присоединиться к Discord",
+  "settings.language": "Язык",
+  "settings.language.description": "Выберите предпочитаемый язык",
+  "settings.last_error": "Последняя ошибка",
+  "settings.last_stderr": "Последний stderr",
+  "settings.last_stdout": "Последний stdout",
+  "settings.loading_providers": "Загрузка провайдеров...",
+  "settings.managed_by_env": "Управляется из env",
+  "settings.model": "Модель",
+  "settings.model_behavior": "Поведение модели",
+  "settings.model_behavior_desc": "Откройте выбор модели по умолчанию, чтобы выбрать профили рассуждений, когда они доступны.",
+  "settings.model_section_desc": "Выберите модель чата по умолчанию и посмотрите, как она рассуждает.",
+  "settings.model_title": "Модель",
+  "settings.no_active_workspace": "Нет активного локального workspace.",
+  "settings.no_providers_connected": "Пока нет подключенных провайдеров.",
+  "settings.no_audit_entries": "Пока нет записей аудита.",
+  "settings.no_custom_path_set": "Пользовательский путь не задан",
+  "settings.nuke_hint": "Используйте это только тогда, когда хотите полностью сбросить настольное приложение и состояние runtime OpenCode.",
+  "settings.off": "Выкл.",
+  "settings.on": "Вкл.",
+  "settings.open_deeplink_action": "Открытие...",
+  "settings.open_deeplink_button": "Скрыть",
+  "settings.open_deeplink_desc": "Вставьте OpenWork deeplink или share URL, чтобы открыть его.",
+  "settings.open_deeplink_failed": "Не удалось открыть deeplink",
+  "settings.open_deeplink_title": "Открыть deeplink",
+  "settings.opencode_cache": "Кэш OpenCode",
+  "settings.opencode_cache_description": "Исправляет кэшированные данные, используемые для запуска движка. Безопасно для запуска.",
+  "settings.opencode_engine_desc": "Локальная среда выполнения для агентов, инструментов и провайдеров моделей.",
+  "settings.opencode_engine_label": "Движок OpenCode",
+  "settings.opencode_engine_sidecar": "Движок OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Локальный процесс OpenCode, управляемый OpenWork.",
+  "settings.opencode_sdk_desc": "Связь browser → engine.",
+  "settings.opencode_sdk_title": "Ссылка OpenCode SDK",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Открытие deeplink",
+  "settings.openwork_config_sidecar_desc": "Локальный сервер OpenWork (Bun), который обслуживает approvals, audit и lifecycle OpenCode.",
+  "settings.openwork_diagnostics_title": "Диагностика сервера OpenWork",
+  "settings.openwork_server_desc": "Панель управления сеансом для синхронизации приложения, воркеров и удаленного доступа",
+  "settings.openwork_server_label": "Сервер OpenWork",
+  "settings.pending_permissions": "Ожидающие разрешения",
+  "settings.production_mode_badge": "Production",
+  "settings.provider_default_desc": "Используйте встроенное поведение модели по умолчанию для рассуждений.",
+  "settings.provider_default_label": "Провайдер по умолчанию",
+  "settings.provider_source_config": "Конфиг",
+  "settings.provider_source_custom": "Пользовательский",
+  "settings.provider_source_env": "Окружение",
+  "settings.providers_desc": "Подключайте сервисы для моделей и инструментов.",
+  "settings.providers_title": "Провайдеры",
+  "settings.quit_hint": "OpenWork сразу завершает работу после очистки, чтобы следующий запуск в этом режиме начинался с пустого локального состояния.",
+  "settings.recent_events": "Недавние события",
+  "settings.reconnect_failed": "Переподключение не удалось. Проверьте URL сервера/токен и попробуйте еще раз.",
+  "settings.reconnect_server": "Переподключение...",
+  "settings.reconnect_server_failed": "Не удалось переподключить сервер OpenWork.",
+  "settings.reconnected": "Переподключено к серверу OpenWork.",
+  "settings.reconnecting": "Переподключение...",
+  "settings.removing_containers": "Удаление контейнеров...",
+  "settings.removing_local_state": "Удаление локального состояния...",
+  "settings.repair_cache": "Восстановить кэш",
+  "settings.repairing_cache": "Восстановление кэша",
+  "settings.report_issue": "Сообщить о проблеме",
+  "settings.reset": "Сбросить",
+  "settings.reset_app_data": "Сбросить данные приложения",
+  "settings.reset_app_data_description": "Более агрессивно. Очищает кэш OpenWork + данные приложения.",
+  "settings.reset_app_data_title": "Сбросить данные приложения",
+  "settings.reset_app_data_warning": "Очищает кэш OpenWork и данные приложения на этом устройстве.",
+  "settings.reset_button": "Сбросить",
+  "settings.reset_cancel": "Отмена",
+  "settings.reset_config_defaults": "Сброс...",
+  "settings.reset_confirm_button": "Сбросить и перезапустить",
+  "settings.reset_confirmation_hint": "Введите {resetWord}, чтобы подтвердить. OpenWork будет перезапущен.",
+  "settings.reset_confirmation_label": "Подтверждение",
+  "settings.reset_confirmation_placeholder": "Введите RESET",
+  "settings.reset_onboarding": "Сбросить onboarding",
+  "settings.reset_onboarding_description": "Очищает настройки OpenWork и перезапускает приложение.",
+  "settings.reset_onboarding_title": "Сбросить onboarding",
+  "settings.reset_onboarding_warning": "Очищает локальные настройки OpenWork и маркеры onboarding workspace.",
+  "settings.reset_openwork_desc_dev": "При активном режиме dev это очищает только изолированное dev-состояние OpenCode внутри openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "При активном режиме dev это очищает только изолированное dev-состояние OpenCode внутри openwork-dev-data.",
+  "settings.reset_openwork_title": "Сбросить состояние OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "Требует ввода RESET и перезапустит приложение.",
+  "settings.reset_startup": "Сбросить режим запуска по умолчанию",
+  "settings.reset_startup_pref": "Сбросить предпочтение запуска",
+  "settings.reset_stop_active_runs": "Остановите активные запуски перед сбросом.",
+  "settings.resetting": "Сброс...",
+  "settings.restart_blocked_message": "OpenWork нужно перезапустить, чтобы завершить это обновление. Чтобы не прерывать текущую работу, установка приостановлена, пока не завершатся активные запуски или вы не остановите их.",
+  "settings.restart_failed": "Перезапуск не удался. Проверьте журналы и попробуйте снова.",
+  "settings.restart_opencode": "Перезапустить OpenCode",
+  "settings.restart_openwork_server": "Перезапустить сервер OpenWork",
+  "settings.restart_server_failed": "Не удалось перезапустить локальный сервер.",
+  "settings.restarted": "Локальный сервер перезапущен.",
+  "settings.restarting": "Перезапуск…",
+  "settings.restart_succeeded_template": "Перезапущен {service}.",
+  "settings.restart_failed_template": "Не удалось перезапустить {service}.",
+  "settings.copy_logs": "Скопировать журналы",
+  "settings.copied_service_logs": "Журналы {service} скопированы.",
+  "settings.no_logs_captured": "Журналы пока не собраны.",
+  "settings.exported_developer_log": "Developer log экспортирован.",
+  "settings.developer_log_title": "Поток developer log",
+  "settings.developer_log_desc": "События приложения, workspace, сеансов и производительности, собираемые, пока включен режим разработчика.",
+  "settings.developer_log_count": "Показаны последние {count} сохраненных записей.",
+  "settings.developer_log_empty": "Developer logs пока не собраны.",
+  "settings.services_section_title": "Сервисы",
+  "settings.services_section_desc": "Локальные сервисы, которые обеспечивают работу этого сеанса OpenWork. У каждого сервиса есть собственный перезапуск и журналы.",
+  "settings.activity_section_title": "Активность",
+  "settings.activity_section_desc": "Журнал аудита и недавние события среды выполнения.",
+  "settings.tools_section_title": "Инструменты",
+  "settings.tools_section_desc": "Проверки и выбор бинарных файлов для диагностики локального выполнения.",
+  "settings.recovery_section_title": "Сброс и восстановление",
+  "settings.recovery_section_desc": "Откатите состояние без выхода из OpenWork.",
+  "settings.danger_section_title": "Опасная зона",
+  "settings.danger_section_desc": "Необратимые действия. Используйте только если понимаете последствия.",
+  "settings.clear_button": "Очистить",
+  "settings.copy_log_button": "Скопировать журнал",
+  "settings.export_log_button": "Экспортировать .log",
+  "settings.reveal_config": "Показать конфиг",
+  "settings.reveal_config_requires_desktop": "Для показа конфигурации требуется настольное приложение",
+  "settings.run_sandbox_probe": "Запуск проверки...",
+  "settings.running_probe": "Запуск проверки...",
+  "settings.runtime_debug_desc": "Читаемый диагностический снимок с экспортом в один клик.",
+  "settings.runtime_debug_title": "Отчет отладки среды выполнения",
+  "settings.runtime_desc": "Статус вашего локального движка и сервера OpenWork.",
+  "settings.runtime_title": "Среда выполнения",
+  "settings.sandbox_error": "Ошибка",
+  "settings.sandbox_export_hint": "Используйте Export в отчете отладки Runtime выше, чтобы экспортировать диагностику.",
+  "settings.sandbox_probe_desc": "Запускает временную проверку старта Docker-песочницы и собирает результаты.",
+  "settings.sandbox_probe_success": "Проверка песочницы успешно пройдена. Экспортируйте отчет для поддержки.",
+  "settings.sandbox_probe_title": "Проверка песочницы",
+  "settings.sandbox_ready": "Готово",
+  "settings.sandbox_requires_desktop": "Для проверки песочницы требуется настольное приложение",
+  "settings.sandbox_result": "Результат: {status}",
+  "settings.sandbox_run_id": "ID запуска: {id}",
+  "settings.sandbox_stop_runs_hint": "Остановите активные запуски перед проверкой",
+  "settings.search_models": "Поиск моделей…",
+  "settings.send_feedback": "Отправить отзыв",
+  "settings.show_model_reasoning": "Показывать рассуждения модели",
+  "settings.show_model_reasoning_desc": "Разворачивайте traces рассуждений в UI, когда модель их показывает.",
+  "settings.showing_models": "Показано {count} из {total}",
+  "settings.startup": "Запуск",
+  "settings.startup_remote_warning": "Предпочтение запуска сейчас удаленное. Настройки движка",
+  "settings.startup_reset_hint": "Это очистит сохраненное предпочтение и покажет экран подключения",
+  "settings.startup_title": "Запуск",
+  "settings.stop_local_server": "Остановить локальный сервер",
+  "settings.stop_runs_before_cleanup": "Остановите активные запуски перед очисткой",
+  "settings.stop_runs_before_reset_config": "Остановите активные запуски перед сбросом конфигурации",
+  "settings.stop_runs_to_reset": "Остановите активные запуски для сброса",
+  "settings.switch": "Переключить",
+  "settings.tab_advanced": "Дополнительно",
+  "settings.tab_appearance": "Внешний вид",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Отладка",
+  "settings.tab_description_advanced": "Проверяйте состояние среды выполнения, состояние подключения и инструменты для разработчика.",
+  "settings.tab_description_appearance": "Настройте внешний вид OpenWork на уровне desktop, system theme и chrome приложения.",
+  "settings.tab_description_debug": "Просматривайте диагностику среды выполнения, журналы и низкоуровневые инструменты отладки.",
+  "settings.tab_description_den": "Управляйте подключением OpenWork Cloud, hosted workers и доступом к workspace.",
+  "settings.tab_description_extensions": "Управляйте MCP apps и OpenCode plugins для этого workspace.",
+  "settings.tab_description_general": "Подключайте провайдеров, выбирайте модель по умолчанию, авторизуйте папки и управляйте выбранным workspace OpenWork вместе с его подключением к среде выполнения.",
+  "settings.environment.add_button": "Добавить переменную",
+  "settings.environment.add_title": "Добавить переменную окружения",
+  "settings.environment.cancel": "Отмена",
+  "settings.environment.click_to_edit": "Нажмите, чтобы редактировать",
+  "settings.environment.confirm_delete": "Удалить {key}? После применения изменений агенты перестанут видеть этот ключ.",
+  "settings.environment.close_editor": "Закрыть редактор",
+  "settings.environment.delete": "Удалить",
+  "settings.environment.delete_title": "Удалить переменную окружения",
+  "settings.environment.delete_variable": "Удалить {key}",
+  "settings.environment.deleting": "Удаление…",
+  "settings.environment.description": "Сохраняйте API-ключи и токены для локальных агентов, навыков и MCP-серверов. Секреты остаются на этом устройстве; изменения станут доступны после применения.",
+  "settings.environment.edit_title": "Изменить переменную окружения",
+  "settings.environment.empty_body": "Добавьте такие ключи, как ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY или GITHUB_TOKEN, для сервисов, которые нужны вашим агентам и MCP-серверам.",
+  "settings.environment.empty_title": "Пока нет переменных окружения",
+  "settings.environment.empty_value": "(пусто)",
+  "settings.environment.footer_hint": "Ключи OPENWORK_ и OPENCODE_ зарезервированы для связки приложения и runtime. Настраивайте параметры runtime OpenCode из shell.",
+  "settings.environment.override_hint": "Переменные окружения, заданные до запуска OpenWork, имеют приоритет над значениями, сохраненными здесь.",
+  "settings.environment.hide": "Скрыть",
+  "settings.environment.hide_value": "Скрыть значение для {key}",
+  "settings.environment.key_hint": "Буквы, цифры и подчеркивания. Не может начинаться с цифры.",
+  "settings.environment.key_label": "Ключ",
+  "settings.environment.loading": "Загрузка…",
+  "settings.environment.remote_workspace_hint": "Это workspace удаленное. Локальные переменные окружения здесь скрыты; используйте cloud LLM Providers или настройте host воркера напрямую.",
+  "settings.environment.apply_button": "Применить изменения",
+  "settings.environment.apply_blocked_active_tasks": "Остановите выполняющиеся задачи перед применением изменений окружения.",
+  "settings.environment.apply_confirm_body": "OpenWork перезапустит локальных агентов, чтобы они использовали актуальное окружение. Выполняющиеся локальные задачи могут остановиться.",
+  "settings.environment.apply_no_local_workspace": "OpenWork не подключен к локальному workspace.",
+  "settings.environment.apply_pending_body": "Примените изменения, чтобы перезапустить локальных агентов и сделать актуальные значения доступными.",
+  "settings.environment.apply_pending_body_manual": "Перезапустите локальных агентов, чтобы сделать актуальные значения доступными.",
+  "settings.environment.apply_pending_title": "Изменения сохранены, но пока не активны",
+  "settings.environment.apply_refresh_failed": "Изменения активны, но статус OpenWork не обновился. Если выглядит устаревшим, перезапустите приложение.",
+  "settings.environment.apply_success": "Изменения окружения активны.",
+  "settings.environment.apply_title": "Применить изменения окружения?",
+  "settings.environment.apply_unavailable": "Применение изменений доступно только в настольном приложении.",
+  "settings.environment.applying": "Применение…",
+  "settings.environment.restart_required": "Сохранено. Примените изменения, чтобы обновление стало доступно.",
+  "settings.environment.reveal": "Показать",
+  "settings.environment.reveal_value": "Показать значение для {key}",
+  "settings.environment.save": "Сохранить",
+  "settings.environment.saving": "Сохранение…",
+  "settings.environment.title": "Переменные окружения",
+  "settings.environment.validation_duplicate": "Переменная с таким именем уже существует.",
+  "settings.environment.validation_empty": "Требуется имя.",
+  "settings.environment.validation_reserved": "Имена OPENWORK_ и OPENCODE_ управляются OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Используйте буквы, цифры и подчеркивания; не начинайте с цифры.",
+  "settings.environment.value_label": "Значение",
+  "settings.tab_description_environment": "Сохраняйте API-ключи и токены для локальных агентов, навыков и MCP-серверов. Секреты остаются на этом устройстве.",
+  "settings.tab_description_recovery": "Исправляйте состояние миграции, сбрасывайте значения workspace по умолчанию и восстанавливайте локальные настройки.",
+  "settings.tab_description_skills": "Просматривайте, редактируйте и устанавливайте навыки, не выходя из settings.",
+  "settings.tab_description_updates": "Поддерживайте приложение актуальным с тихими фоновыми проверками и управлением установкой.",
+  "settings.tab_environment": "Окружение",
+  "settings.tab_extensions": "Расширения",
+  "settings.tab_general": "Настройки",
+  "settings.tab_recovery": "Восстановление",
+  "settings.tab_skills": "Навыки",
+  "settings.tab_updates": "Обновления",
+  "settings.theme_dark": "Темная",
+  "settings.theme_light": "Светлая",
+  "settings.theme_system": "Системная",
+  "settings.theme_system_hint": "Системный режим автоматически следует предпочтениям вашей ОС.",
+  "settings.update": "Обновить",
+  "settings.update_available": "Доступно обновление: v",
+  "settings.update_available_version": "Доступно обновление: v{version}",
+  "settings.update_check_button": "Проверить",
+  "settings.update_check_failed": "Проверка обновления не удалась",
+  "settings.update_checking": "Проверка...",
+  "settings.update_download_button": "Скачать",
+  "settings.update_downloading": "Скачивание...",
+  "settings.update_install_button": "Установить и перезапустить",
+  "settings.update_last_checked": "Последняя проверка {time}",
+  "settings.update_published": "Опубликовано {date}",
+  "settings.update_ready": "Готово к установке: v",
+  "settings.update_ready_version": "Готово к установке: v{version}",
+  "settings.update_uptodate": "Актуально",
+  "settings.updates": "Обновления",
+  "settings.updates_desc": "Поддерживайте OpenWork в актуальном состоянии.",
+  "settings.updates_desktop_only": "Обновления доступны только в настольном приложении.",
+  "settings.updates_not_supported": "Обновления не поддерживаются в этой среде.",
+  "settings.updates_title": "Обновления",
+  "settings.window_appearance_desc": "Настройте внешний вид окна.",
+  "settings.worker_id_label": "Воркер {id}",
+  "settings.worker_unresolved": "Воркер {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Конфигурация workspace",
+  "settings.workspace_debug_events_label": "События отладки workspace",
+  "action.remove": "Удалить",
+  "den.active_org_hint": "Cloud-воркеры привязаны к выбранной организации.",
+  "den.active_org_title": "Активная организация",
+  "den.auto_reconnect_hint": "Завершите авторизацию в браузере, и OpenWork переподключится сюда автоматически.",
+  "den.checking_session": "Проверка сеанса",
+  "den.choose_org_for_providers": "Выберите организацию, чтобы просматривать cloud-провайдеров.",
+  "den.choose_org_for_skills": "Выберите организацию, чтобы просматривать cloud-навыки.",
+  "den.choose_org_for_skill_hubs": "Выберите организацию, чтобы просматривать cloud skill hubs.",
+  "den.cloud_account_hint": "Управляйте подключенным аккаунтом и организацией.",
+  "den.cloud_account_title": "Cloud-аккаунт",
+  "den.cloud_control_plane_open": "Открыть в браузере",
+  "den.cloud_control_plane_reset": "Сбросить",
+  "den.cloud_control_plane_save": "Сохранить URL",
+  "den.cloud_control_plane_url_hint": "Только для режима разработчика. Используйте это, чтобы указать локальный или self-hosted Cloud control plane. При изменении вы выйдете из системы, чтобы приложение могло заново инициализироваться через новый control plane.",
+  "den.cloud_control_plane_url_label": "URL Cloud control plane",
+  "den.cloud_provider_detail": "{count} моделей · провайдер {source}",
+  "den.cloud_provider_removed_detail": "Этот импортированный провайдер больше не доступен в Cloud. Удалите локальную конфигурацию {providerId}.",
+  "den.cloud_provider_sync_detail": "Провайдер Cloud изменился. Синхронизируйте конфиг {count} модели {source} в opencode.jsonc.",
+  "den.cloud_skill_detail": "Установите этот cloud-навык в .opencode/skills.",
+  "den.cloud_skill_imported_detail": "Локально установлен как {name}.",
+  "den.cloud_skill_removed_detail": "Этот cloud-навык был удален upstream. Удалите локальную копию {name}.",
+  "den.cloud_skill_sync_detail": "Доступна более новая cloud-версия для {name}. Обновите локальную копию, чтобы оставаться в sync.",
+  "den.cloud_skills_hint": "Просматривайте отдельные cloud-навыки, к которым у вас есть доступ, устанавливайте их локально и обновляйте, когда удаленная версия меняется.",
+  "den.cloud_skills_title": "Skills",
+  "den.cloud_providers_hint": "Импортируйте управляемых LLM-провайдеров в opencode.jsonc и используйте учетные данные организации в этом workspace.",
+  "den.cloud_providers_title": "Cloud providers",
+  "den.cloud_section_desc": "Войдите, выберите организацию и откройте Cloud-воркеры.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Войдите в OpenWork Cloud, чтобы ваши задачи продолжали работать даже когда компьютер уходит в sleep.",
+  "den.cloud_workers_hint": "Открывайте воркеры напрямую в OpenWork, используя тот же поток remote-connect, который приложение уже использует в других местах.",
+  "den.cloud_workers_title": "Cloud workers",
+  "den.create_account": "Создать аккаунт",
+  "den.credentials_ready_badge": "Учетные данные готовы",
+  "den.error_base_url": "Введите допустимый Cloud control plane URL с http:// или https://.",
+  "den.error_choose_org": "Выберите организацию перед открытием воркера.",
+  "den.error_load_orgs": "Не удалось загрузить организации.",
+  "den.error_load_skills": "Не удалось загрузить cloud-навыки.",
+  "den.error_load_workers": "Не удалось загрузить воркеры.",
+  "den.error_no_session": "Активная Cloud-сессия не найдена.",
+  "den.error_no_token": "Вход в настольном приложении завершен, но OpenWork Cloud не вернул токен сеанса.",
+  "den.error_open_worker": "Не удалось открыть {name} в OpenWork.",
+  "den.error_open_worker_fallback": "Не удалось открыть {name}.",
+  "den.error_paste_valid_code": "Вставьте корректную ссылку входа OpenWork или одноразовый код входа.",
+  "den.error_signin_failed": "Не удалось завершить вход в OpenWork Cloud.",
+  "den.error_worker_not_ready": "Воркер пока не готов к открытию. Попробуйте еще раз после завершения provisioning.",
+  "den.finish_signin": "Завершить вход",
+  "den.finishing": "Завершение...",
+  "den.hide_signin_code": "Скрыть код входа",
+  "den.import_all": "Импортировать все",
+  "den.import_skill": "Установить",
+  "den.import_skill_failed": "Не удалось установить {name}.",
+  "den.import_provider": "Импортировать",
+  "den.import_provider_failed": "Не удалось импортировать {name}.",
+  "den.imported_badge": "Импортировано",
+  "den.imported_provider": "Импортирован {name}.",
+  "den.importing": "Импорт...",
+  "den.needs_attention": "Требует внимания",
+  "den.no_cloud_providers": "Для этой организации пока нет доступных cloud-провайдеров.",
+  "den.no_cloud_skills": "Для этой организации пока нет доступных cloud-навыков.",
+  "den.no_cloud_workers": "Для этой организации пока не видно cloud-воркеров. Создайте один в Cloud, затем обновите эту вкладку.",
+  "den.no_org_selected": "Организация не выбрана",
+  "den.no_skill_hubs": "Для этой организации пока нет доступных cloud skill hubs.",
+  "den.open": "Открыть",
+  "den.opening": "Открытие...",
+  "den.org_member_suffix": "(Участник)",
+  "den.org_owner_suffix": "(Владелец)",
+  "den.org_switched": "Переключено на {name}.",
+  "den.out_of_sync_badge": "Не синхронизировано",
+  "den.private_badge": "Приватный",
+  "den.paste_signin_code": "Вставить код входа",
+  "den.refresh": "Обновить",
+  "den.reload_workspace": "Перезагрузите workspace, чтобы применить изменения конфига.",
+  "den.remove_provider_failed": "Не удалось удалить {name}.",
+  "den.remove_skill_failed": "Не удалось удалить {name}.",
+  "den.removed_from_cloud_badge": "Удалено из Cloud",
+  "den.removed_provider": "Удален {name}.",
+  "den.removing": "Удаление...",
+  "den.sign_out": "Выйти",
+  "den.signed_out": "Вы вышли",
+  "den.signin_button": "Войти",
+  "den.signin_code_note": "Принимает ссылку openwork://den-auth или raw одноразовый grant.",
+  "den.signin_link_hint": "Если браузер не возвращает вас в OpenWork автоматически, вставьте сюда ссылку входа или одноразовый код из OpenWork Cloud.",
+  "den.signin_link_label": "Ссылка входа или одноразовый код",
+  "den.signin_link_placeholder": "openwork://den-auth?... или вставленный код",
+  "den.signin_title": "Войти в OpenWork Cloud",
+  "den.signing_in": "Завершение входа в OpenWork Cloud...",
+  "den.signing_out": "Выполняется выход...",
+  "den.skill_hub_detail": "Импортируйте {count} общих навыков в .opencode/skills.",
+  "den.skill_hub_imported_detail": "Импортировано {count} навыков в это workspace.",
+  "den.skill_hub_removed_detail": "Этот hub был удален из Cloud. Удалите из этого workspace {importedCount} импортированных навыков.",
+  "den.skill_hub_skills_badge": "{count} навыков",
+  "den.skill_hub_sync_detail": "В Cloud теперь {liveCount} навыков; в этом workspace импортировано {importedCount}. Синхронизируйте, чтобы обновить установленный набор.",
+  "den.skill_hubs_hint": "Импортируйте все навыки из общего cloud hub в это workspace за один шаг.",
+  "den.skill_hubs_title": "Skill hubs",
+  "den.status_base_url_updated": "URL Cloud control plane обновлен. Войдите снова, чтобы продолжить.",
+  "den.status_browser_signin": "Завершите вход в браузере, чтобы подключить OpenWork.",
+  "den.status_browser_signup": "Завершите создание аккаунта в браузере, чтобы подключить OpenWork.",
+  "den.status_cloud_signed_in_as": "Подключено к OpenWork Cloud как {email}.",
+  "den.status_cloud_signin_done": "Подключено к OpenWork Cloud.",
+  "den.status_loaded_orgs_one": "Загружена {count} организация.",
+  "den.status_loaded_orgs_few": "Загружено {count} организации.",
+  "den.status_loaded_orgs_many": "Загружено {count} организаций.",
+  "den.status_loaded_orgs_other": "Загружено {count} организаций.",
+  "den.status_loaded_skills_one": "Загружен {count} облачный навык для {name}.",
+  "den.status_loaded_skills_few": "Загружено {count} облачных навыка для {name}.",
+  "den.status_loaded_skills_many": "Загружено {count} облачных навыков для {name}.",
+  "den.status_loaded_skills_other": "Загружено {count} облачных навыков для {name}.",
+  "den.status_loaded_workers_one": "Загружен {count} воркер для {name}.",
+  "den.status_loaded_workers_few": "Загружено {count} воркера для {name}.",
+  "den.status_loaded_workers_many": "Загружено {count} воркеров для {name}.",
+  "den.status_loaded_workers_other": "Загружено {count} воркеров для {name}.",
+  "den.status_no_skills": "Для {name} cloud-навыки не найдены.",
+  "den.status_no_workers": "Для {name} воркеры не найдены.",
+  "den.status_opened_worker": "Открыт {name} в OpenWork.",
+  "den.status_signed_in_as": "Вошли как {email}.",
+  "den.status_signed_out": "Вы вышли и очистили сеанс OpenWork Cloud на этом устройстве.",
+  "den.sync": "Синхронизировать",
+  "den.sync_provider_failed": "Не удалось синхронизировать {name}.",
+  "den.sync_skill_failed": "Не удалось обновить {name}.",
+  "den.synced_provider": "Синхронизирован {name}.",
+  "den.syncing": "Синхронизация...",
+  "den.installed_name_badge": "Локально: {name}",
+  "den.uninstall": "Удалить",
+  "den.worker_mine_badge": "Мой",
+  "den.worker_not_ready_title": "Этот воркер пока не готов к открытию.",
+  "den.worker_provider_label": "{provider} воркер",
+  "den.worker_secondary_cloud": "Cloud-воркер",
+  "extensions.app_count_one": "{count} приложение подключено",
+  "extensions.app_count_few": "{count} приложения подключено",
+  "extensions.app_count_many": "{count} приложений подключено",
+  "extensions.app_count_other": "{count} приложений подключено",
+  "extensions.apps_mcp_header": "Приложения (MCP)",
+  "extensions.filter_all": "Все",
+  "extensions.filter_apps": "Приложения",
+  "extensions.filter_plugins": "Плагины",
+  "extensions.plugin_count_one": "{count} плагин",
+  "extensions.plugin_count_few": "{count} плагина",
+  "extensions.plugin_count_many": "{count} плагинов",
+  "extensions.plugin_count_other": "{count} плагинов",
+  "extensions.plugins_opencode_header": "Плагины (OpenCode)",
+  "extensions.subtitle": "Приложения (MCP) и плагины OpenCode собраны в одном месте.",
+  "extensions.title": "Расширения",
+} as const;
diff --git a/apps/app/src/i18n/locales/th.ts b/apps/app/src/i18n/locales/th.ts
new file mode 100644
index 0000000000..4e692404b3
--- /dev/null
+++ b/apps/app/src/i18n/locales/th.ts
@@ -0,0 +1,1378 @@
+/**
+ * Thai translations
+ * Professional terms (Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork) are NOT translated
+ */
+
+export default {
+  "app.compact_command_desc": "สรุปเซสชันนี้เพื่อลดขนาดบริบท",
+  "app.error_audit_load": "โหลดบันทึกการตรวจสอบไม่สำเร็จ",
+  "app.error_auth_failed": "การยืนยันตัวตนล้มเหลว",
+  "app.error_command_not_resolved": "ไม่สามารถ resolve คำสั่ง",
+  "app.error_compact_empty": "ยังไม่มีสิ่งที่จะบีบอัด",
+  "app.error_compact_no_session": "เลือกเซสชันที่มีข้อความก่อนรัน /compact",
+  "app.error_compact_no_session_id": "เลือกเซสชันก่อนบีบอัด",
+  "app.error_connect_first": "เชื่อมต่อ worker นี้ก่อนใช้การเปลี่ยนแปลง runtime",
+  "app.error_not_connected": "ไม่ได้เชื่อมต่อกับเซิร์ฟเวอร์",
+  "app.error_rate_limit": "เกินขีดจำกัดอัตราการใช้งาน",
+  "app.error_remote_access": "อัปเดตการเข้าถึงระยะไกลไม่สำเร็จ",
+  "app.error_request_failed": "คำขอล้มเหลว",
+  "app.error_restart_local_worker": "รีสตาร์ท local worker ด้วยการตั้งค่าการแชร์ที่อัปเดตไม่สำเร็จ",
+  "app.error_session_name_required": "ต้องใส่ชื่อเซสชัน",
+  "app.local_disabled_reason": "สร้างพื้นที่ทำงานภายในเครื่องในแอปเดสก์ท็อป พื้นที่ทำงานระยะไกลและที่แชร์ยังใช้งานได้ที่นี่",
+  "app.model_behavior_title": "พฤติกรรมโมเดล",
+  "app.plugins_hint_readonly": "OpenWork server เป็นแบบอ่านอย่างเดียวสำหรับ plugins",
+  "app.reload_later": "ภายหลัง",
+  "app.reload_now": "รีโหลดตอนนี้",
+  "app.reload_stop_tasks": "รีโหลดและหยุดงาน",
+  "app.skills_hint_readonly": "OpenWork server เป็นแบบอ่านอย่างเดียวสำหรับ skills เพิ่ม host token ใน Advanced เพื่อเปิดการติดตั้ง",
+  "app.unknown_error": "ข้อผิดพลาดที่ไม่ทราบสาเหตุ",
+  "blueprint.automation_body": "เริ่มจาก workflow ที่ใช้ซ้ำได้ หรือพิมพ์งานของคุณด้านล่าง",
+  "blueprint.automation_title": "ต้องการให้ทำอะไรอัตโนมัติ?",
+  "blueprint.csv_session_assistant": "ฉันช่วยสร้าง ทำความสะอาด รวม และสรุปไฟล์ CSV ได้ ต้องการทำงาน CSV แบบไหน?",
+  "blueprint.csv_session_title": "ไอเดียการทำงาน CSV",
+  "blueprint.csv_session_user": "ฉันต้องการรวมข้อมูลส่งออกจากหลายเครื่องมือเป็น CSV เดียวที่สะอาด",
+  "blueprint.empty_body": "เลือกจุดเริ่มต้น หรือพิมพ์ด้านล่าง",
+  "blueprint.empty_title": "ต้องการทำอะไร?",
+  "blueprint.minimal_body": "ถามเกี่ยวกับพื้นที่ทำงานนี้ หรือใช้พรอมต์เริ่มต้น",
+  "blueprint.minimal_title": "เริ่มต้นด้วยงาน",
+  "blueprint.starter_blueprint_desc": "ออกแบบ workflow ที่ใช้ซ้ำได้ด้วย skills, คำสั่ง และขั้นตอนการส่งต่อ",
+  "blueprint.starter_blueprint_prompt": "ช่วยออกแบบ automation blueprint ที่ใช้ซ้ำได้สำหรับพื้นที่ทำงานนี้ ถามว่าควรทำให้เป็นมาตรฐานอย่างไร แล้วเสนอ workflow",
+  "blueprint.starter_blueprint_title": "วางแผน automation blueprint",
+  "blueprint.starter_chrome_desc": "เริ่มต้น browser automation ได้ทันที",
+  "blueprint.starter_chrome_prompt": "ช่วยเชื่อมต่อ Chrome และทำให้งานซ้ำๆ เป็นอัตโนมัติ",
+  "blueprint.starter_chrome_title": "ทำ Chrome อัตโนมัติ",
+  "blueprint.starter_command_desc": "เปลี่ยน workflow ที่ทำซ้ำๆ เป็น slash command สำหรับพื้นที่ทำงานนี้",
+  "blueprint.starter_command_prompt": "ช่วยสร้าง /command ที่ใช้ซ้ำได้สำหรับพื้นที่ทำงานนี้ ถามว่าต้องการทำ workflow อะไรอัตโนมัติ แล้วร่างคำสั่ง",
+  "blueprint.starter_command_title": "สร้างคำสั่งที่ใช้ซ้ำได้",
+  "blueprint.starter_connect_openai_desc": "เพิ่ม provider OpenAI เพื่อให้โมเดล ChatGPT พร้อมใช้งานในเซสชันใหม่",
+  "blueprint.starter_connect_openai_title": "เชื่อมต่อ ChatGPT",
+  "blueprint.starter_csv_desc": "ทำความสะอาดหรือสร้างข้อมูลสเปรดชีต",
+  "blueprint.starter_csv_prompt": "ช่วยสร้างหรือแก้ไขไฟล์ CSV บนคอมพิวเตอร์เครื่องนี้",
+  "blueprint.starter_csv_title": "ทำงานกับ CSV",
+  "blueprint.starter_explore_desc": "สรุปไฟล์ในพื้นที่ทำงานและแนะนำงานแรกที่ควรทำ",
+  "blueprint.starter_explore_prompt": "สรุปพื้นที่ทำงานนี้ ชี้ไฟล์สำคัญที่สุด แล้วแนะนำงานแรกที่ดีที่สุด",
+  "blueprint.starter_explore_title": "สำรวจพื้นที่ทำงานนี้",
+  "blueprint.welcome_message": "สวัสดี ยินดีต้อนรับสู่ OpenWork!\n\nผู้คนใช้ OpenWork เขียนไฟล์ .csv บนคอมพิวเตอร์ เชื่อมต่อ Chrome เพื่อทำงานซ้ำๆ อัตโนมัติ และซิงค์ผู้ติดต่อกับ Notion\n\nขีดจำกัดอยู่ที่จินตนาการของคุณ\n\nต้องการทำอะไร?",
+  "blueprint.welcome_title": "ยินดีต้อนรับสู่ OpenWork",
+  "common.add": "เพิ่ม",
+  "common.cancel": "ยกเลิก",
+  "common.close": "ปิด",
+  "common.default_parens": "(ค่าเริ่มต้น)",
+  "common.edit": "แก้ไข",
+  "common.hide": "ซ่อน",
+  "common.navigate": "นำทาง",
+  "common.next": "ถัดไป",
+  "common.off": "ปิด",
+  "common.on": "เปิด",
+  "common.path": "เส้นทาง",
+  "common.question": "คำถาม",
+  "common.refresh": "รีเฟรช",
+  "common.remove": "ลบ",
+  "common.reset": "รีเซ็ต",
+  "common.save": "บันทึก",
+  "common.select": "เลือก",
+  "common.show": "แสดง",
+  "common.something_went_wrong": "เกิดข้อผิดพลาด",
+  "common.submit": "ส่ง",
+  "common.unknown": "ไม่ทราบ",
+  "composer.agent_label": "Agent",
+  "composer.attach_files": "แนบไฟล์",
+  "composer.attachments_unavailable": "ไฟล์แนบไม่พร้อมใช้งาน",
+  "composer.behavior_label": "พฤติกรรม",
+  "composer.configure": "ตั้งค่า",
+  "composer.default_agent": "Agent เริ่มต้น",
+  "composer.file_exceeds_limit": "{name} เกินขีดจำกัด 8MB",
+  "composer.file_kind": "ไฟล์",
+  "composer.image_kind": "รูปภาพ",
+  "composer.inserted_links_unsupported": "แทรกลิงก์สำหรับไฟล์ที่ไม่รองรับ",
+  "composer.loading_commands": "กำลังโหลดคำสั่ง...",
+  "composer.mcps_label": "MCP",
+  "composer.no_commands": "ไม่พบคำสั่ง",
+  "composer.placeholder": "อธิบายงานของคุณ...",
+  "composer.remote_worker_paste_warning": "นี่คือ remote worker Sandbox ก็เป็น remote เช่นกัน หากต้องการแชร์ไฟล์ ให้อัปโหลดไปยังโฟลเดอร์ที่แชร์ในแถบด้านข้าง",
+  "composer.run_task": "รันงาน",
+  "composer.skill_source": "Skill",
+  "composer.stop": "หยุด",
+  "composer.tools_label": "คำสั่ง, Skills และ MCP",
+  "composer.unsupported_attachment_type": "ประเภทไฟล์แนบไม่รองรับ",
+  "composer.upload_to_shared_folder": "อัปโหลดไปยังโฟลเดอร์ที่แชร์",
+  "composer.uploaded_multiple_files": "อัปโหลด {count} ไฟล์ไปยังโฟลเดอร์ที่แชร์และแทรกลิงก์แล้ว",
+  "composer.uploaded_single_file": "อัปโหลด {name} ไปยังโฟลเดอร์ที่แชร์และแทรกลิงก์แล้ว",
+  "config.collaborator_token_disabled_hint": "เก็บไว้ล่วงหน้าสำหรับการแชร์ระยะไกล แต่การเข้าถึงระยะไกลปิดอยู่",
+  "config.collaborator_token_label": "โทเค็นผู้ร่วมงาน",
+  "config.collaborator_token_remote_hint": "การเข้าถึงระยะไกลปกติสำหรับโทรศัพท์หรือแล็ปท็อปที่เชื่อมต่อกับเซิร์ฟเวอร์นี้",
+  "config.connection_failed": "เชื่อมต่อล้มเหลว",
+  "config.connection_failed_check": "เชื่อมต่อล้มเหลว ตรวจสอบ host URL และ token",
+  "config.connection_status_updated": "อัปเดตสถานะการเชื่อมต่อแล้ว",
+  "config.connection_successful": "เชื่อมต่อสำเร็จ",
+  "config.copied": "คัดลอกแล้ว",
+  "config.copy": "คัดลอก",
+  "config.desktop_only_hint": "ฟีเจอร์ config บางอย่าง (แชร์ local server + messaging bridge) ต้องใช้แอปเดสก์ท็อป",
+  "config.diagnostics_desc": "คัดลอกสถานะรันไทม์ที่ปลอดภัยสำหรับดีบัก",
+  "config.diagnostics_title": "ชุดข้อมูลวินิจฉัย",
+  "config.engine_reload_desc": "รีสตาร์ท OpenCode server สำหรับพื้นที่ทำงานนี้",
+  "config.engine_reload_title": "รีโหลด engine",
+  "config.host_admin_token_hint": "Token ภายใน host สำหรับ approvals CLI และ admin API อย่าใช้ในขั้นตอนเชื่อมต่อแอป remote",
+  "config.host_admin_token_label": "Token ผู้ดูแล host",
+  "config.host_local_only": "ภายในเครื่องเท่านั้น",
+  "config.host_offline": "ออฟไลน์",
+  "config.host_remote_enabled": "เปิดใช้งานระยะไกล",
+  "config.local_ip_hint": "ใช้ IP ภายในเครื่องบน Wi-Fi เดียวกันเพื่อการเชื่อมต่อที่เร็วที่สุด",
+  "config.mdns_hint": "ชื่อ .local จดจำง่ายกว่าแต่อาจ resolve ไม่ได้ในทุกเครือข่าย",
+  "config.messaging_identities_desc": "จัดการ Telegram/Slack identities และ routing ในแท็บ Identities",
+  "config.messaging_identities_title": "Messaging identities",
+  "config.not_set": "ไม่ได้ตั้งค่า",
+  "config.owner_token_disabled_hint": "ใช้ได้หลังจากเปิดการเข้าถึงระยะไกลสำหรับ worker นี้",
+  "config.owner_token_label": "โทเค็นเจ้าของ",
+  "config.owner_token_remote_hint": "ใช้เมื่อ remote client ต้องตอบคำขออนุญาตหรือดำเนินการที่ต้องใช้สิทธิ์เจ้าของ",
+  "config.reload_active_tasks_warning": "การรีโหลดจะหยุดงานที่กำลังทำงาน",
+  "config.reload_availability_hint": "การรีโหลดใช้ได้เฉพาะ local workers หรือ OpenWork server ที่เชื่อมต่อ",
+  "config.reload_connect_hint": "เชื่อมต่อ worker นี้เพื่อรีโหลด",
+  "config.reload_engine": "รีโหลด engine",
+  "config.reload_now_desc": "ใช้การอัปเดต config และเชื่อมต่อเซสชันใหม่",
+  "config.reload_now_title": "รีโหลดตอนนี้",
+  "config.reloading": "กำลังรีโหลด...",
+  "config.remote_access_off_hint": "การเข้าถึงระยะไกลปิดอยู่ ใช้ แชร์พื้นที่ทำงาน เพื่อเปิดก่อนเชื่อมต่อจากเครื่องอื่น",
+  "config.resolved_worker_url": "URL ของ worker ที่ resolve:",
+  "config.server_needed_hint": "ต้องเชื่อมต่อ OpenWork server เพื่อซิงค์ skills, plugins และ commands",
+  "config.server_section_desc": "เชื่อมต่อ OpenWork server ใช้ URL พร้อม collaborator หรือ owner token จากผู้ดูแลเซิร์ฟเวอร์",
+  "config.server_section_title": "OpenWork server",
+  "config.server_sharing_desc": "แชร์รายละเอียดเหล่านี้กับอุปกรณ์ที่เชื่อถือได้ ใช้เซิร์ฟเวอร์บนเครือข่ายเดียวกันเพื่อการตั้งค่าที่เร็วที่สุด",
+  "config.server_sharing_menu_hint": "สำหรับลิงก์แชร์เฉพาะพื้นที่ทำงาน ใช้ แชร์... ในเมนูพื้นที่ทำงาน",
+  "config.server_sharing_title": "แชร์ OpenWork server",
+  "config.server_url_hint": "ใช้ URL ที่แชร์โดย OpenWork server ของคุณ Desktop workers ใช้ port ถาวรในช่วง 48000-51000",
+  "config.server_url_input_label": "URL ของ OpenWork server",
+  "config.server_url_label": "URL ของ OpenWork Server",
+  "config.starting_server": "กำลังเริ่มเซิร์ฟเวอร์…",
+  "config.status_connected": "เชื่อมต่อแล้ว",
+  "config.status_limited": "จำกัด",
+  "config.status_not_connected": "ยังไม่ได้เชื่อมต่อ",
+  "config.test_connection": "ทดสอบการเชื่อมต่อ",
+  "config.testing": "กำลังทดสอบ...",
+  "config.testing_connection": "กำลังทดสอบการเชื่อมต่อ...",
+  "config.token_hint": "ไม่บังคับ วางโทเค็นผู้ร่วมงานสำหรับการเข้าถึงปกติ หรือโทเค็นเจ้าของเมื่อ client ต้องตอบคำขออนุญาต",
+  "config.token_label": "โทเค็นผู้ร่วมงานหรือเจ้าของ",
+  "config.token_placeholder": "วางโทเค็นของคุณ",
+  "config.unavailable": "ไม่พร้อมใช้งาน",
+  "config.worker_id": "Worker ID:",
+  "config.workspace_config_desc": "การตั้งค่าเหล่านี้มีผลต่อพื้นที่ทำงานที่เลือก การดำเนินการรันไทม์ใช้กับพื้นที่ทำงานที่เชื่อมต่ออยู่",
+  "config.workspace_config_title": "การตั้งค่าพื้นที่ทำงาน",
+  "config.workspace_id_prefix": "พื้นที่ทำงาน:",
+  "context_panel.add_button": "เพิ่ม",
+  "context_panel.add_folder_hint": "เพิ่มโฟลเดอร์เพื่อให้พื้นที่ทำงานนี้อ่านและแก้ไขไฟล์นอกไดเรกทอรีรูท",
+  "context_panel.adding_button": "กำลังเพิ่ม...",
+  "context_panel.always_available": "พร้อมใช้งานเสมอ",
+  "context_panel.authorized_folders": "โฟลเดอร์ที่อนุญาต",
+  "context_panel.authorized_folders_desc": "ให้พื้นที่ทำงานนี้เข้าถึงอ่านและแก้ไขไฟล์ในไดเรกทอรีนอกรูท",
+  "context_panel.authorized_folders_no_access": "เชื่อมต่อพื้นที่ทำงาน OpenWork server ที่เขียนได้เพื่อแก้ไขโฟลเดอร์ที่อนุญาต",
+  "context_panel.browse_button": "เรียกดู",
+  "context_panel.config_access_unavailable": "การเข้าถึง config ของ OpenWork server ไม่พร้อมใช้งานสำหรับพื้นที่ทำงานนี้",
+  "context_panel.config_read_only": "OpenWork server เชื่อมต่อแบบอ่านอย่างเดียวสำหรับ config พื้นที่ทำงาน",
+  "context_panel.folder_already_authorized": "โฟลเดอร์ได้รับอนุญาตแล้ว",
+  "context_panel.folders_updated": "อัปเดตโฟลเดอร์ที่อนุญาตแล้ว",
+  "context_panel.input_placeholder": "พิมพ์เส้นทางโฟลเดอร์เพื่ออนุญาต...",
+  "context_panel.no_external_folders": "ยังไม่มีโฟลเดอร์ภายนอกที่อนุญาต",
+  "context_panel.no_mcp": "ไม่ได้โหลด MCP servers",
+  "context_panel.no_server_workspace": "ยังไม่ได้เลือกพื้นที่ทำงาน server ที่ใช้งาน",
+  "context_panel.no_skills": "ไม่ได้โหลด Skills",
+  "context_panel.preserving_entries": "คงไว้ {count} รายการสิทธิ์ที่ไม่ใช่โฟลเดอร์",
+  "context_panel.preserving_entry": "คงไว้ 1 รายการสิทธิ์ที่ไม่ใช่โฟลเดอร์",
+  "context_panel.remove_folder": "ลบ {name}",
+  "context_panel.saving_folders": "กำลังบันทึกโฟลเดอร์ที่อนุญาต...",
+  "context_panel.server_disconnected": "OpenWork server ตัดการเชื่อมต่อแล้ว",
+  "context_panel.workspace_root_available": "รูทพื้นที่ทำงานพร้อมใช้งานแล้ว",
+  "context_panel.workspace_root_badge": "รูทพื้นที่ทำงาน",
+  "context_panel.writable_workspace_required": "ต้องมีพื้นที่ทำงาน OpenWork server ที่เขียนได้เพื่ออัปเดตโฟลเดอร์ที่อนุญาต",
+  "dashboard.change": "เปลี่ยน",
+  "dashboard.choose_folder": "เลือกโฟลเดอร์",
+  "dashboard.choose_folder_continue": "เลือกโฟลเดอร์เพื่อดำเนินการต่อ",
+  "dashboard.chooser_local_desc": "สร้างพื้นที่ทำงานบนอุปกรณ์นี้และเลือกเริ่มจากเทมเพลตทีม",
+  "dashboard.chooser_remote_desc": "แนบกับ OpenWork worker ที่โฮสต์เองด้วย URL และ access token",
+  "dashboard.chooser_shared_desc": "เรียกดู cloud workers ที่แชร์กับองค์กรของคุณและเชื่อมต่อในขั้นตอนเดียว",
+  "dashboard.close_settings": "ปิดการตั้งค่า",
+  "dashboard.cloud_worker": "Cloud worker",
+  "dashboard.commands": "คำสั่ง",
+  "dashboard.connect_remote_button": "เชื่อมต่อระยะไกล",
+  "dashboard.connected": "เชื่อมต่อแล้ว",
+  "dashboard.connecting": "กำลังเชื่อมต่อ...",
+  "dashboard.create_local_workspace_subtitle": "สร้างพื้นที่ทำงานบนอุปกรณ์นี้และเลือกเริ่มจากเทมเพลตทีม",
+  "dashboard.create_local_workspace_title": "พื้นที่ทำงานภายในเครื่อง",
+  "dashboard.create_remote_custom_subtitle": "แนบกับ OpenWork worker ที่โฮสต์เอง",
+  "dashboard.create_remote_custom_title": "เชื่อมต่อ remote กำหนดเอง",
+  "dashboard.create_remote_workspace_confirm": "เพิ่มพื้นที่ทำงาน",
+  "dashboard.create_remote_workspace_subtitle": "บันทึก OpenWork server เป็นพื้นที่ทำงาน",
+  "dashboard.create_remote_workspace_title": "เพิ่มพื้นที่ทำงานระยะไกล",
+  "dashboard.create_sandbox_confirm": "สร้างเป็น sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "เรียกดู cloud workers ที่แชร์กับองค์กรของคุณและเชื่อมต่อในขั้นตอนเดียว",
+  "dashboard.create_shared_subtitle_signed_out": "เข้าสู่ระบบ OpenWork Cloud เพื่อเข้าถึง workers ที่แชร์กับองค์กรของคุณ",
+  "dashboard.create_shared_title": "พื้นที่ทำงานที่แชร์",
+  "dashboard.create_workspace_confirm": "สร้างพื้นที่ทำงาน",
+  "dashboard.create_workspace_subtitle": "เริ่มต้นพื้นที่ทำงานใหม่ตามโฟลเดอร์",
+  "dashboard.create_workspace_title": "สร้างพื้นที่ทำงาน",
+  "dashboard.desktop_badge": "เดสก์ท็อป",
+  "dashboard.edit_remote_workspace_confirm": "บันทึกการเชื่อมต่อ",
+  "dashboard.edit_remote_workspace_subtitle": "อัปเดตรายละเอียด OpenWork server สำหรับพื้นที่ทำงานนี้",
+  "dashboard.edit_remote_workspace_title": "แก้ไขการเชื่อมต่อระยะไกล",
+  "dashboard.error_choose_org": "เลือกองค์กรก่อนเปิดพื้นที่ทำงาน",
+  "dashboard.error_connect_worker": "เชื่อมต่อ {name} ไม่สำเร็จ",
+  "dashboard.error_load_orgs": "โหลดองค์กรไม่สำเร็จ",
+  "dashboard.error_load_shared_workspaces": "โหลดพื้นที่ทำงานที่แชร์ไม่สำเร็จ",
+  "dashboard.error_workspace_not_ready": "พื้นที่ทำงานยังไม่พร้อมเชื่อมต่อ ลองอีกครั้งในอีกสักครู่",
+  "dashboard.import_config": "นำเข้า config",
+  "dashboard.importing": "กำลังนำเข้า…",
+  "dashboard.modal_back": "กลับ",
+  "dashboard.modal_close": "ปิดหน้าต่างเพิ่มพื้นที่ทำงาน",
+  "dashboard.remote": "ระยะไกล",
+  "dashboard.remote_base_url_required": "เพิ่ม URL ของเซิร์ฟเวอร์เพื่อดำเนินการต่อ",
+  "dashboard.remote_server_details_hint": "แนบกับ OpenWork worker ที่โฮสต์เอง",
+  "dashboard.remote_server_details_title": "รายละเอียดเซิร์ฟเวอร์ระยะไกล",
+  "dashboard.sandbox_checking_docker": "กำลังตรวจสอบ Docker...",
+  "dashboard.sandbox_get_ready_title": "Sandbox ต้องใช้ Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "ต้องตรวจสอบ",
+  "dashboard.worker_status_ready": "พร้อม",
+  "dashboard.worker_status_starting": "กำลังเริ่ม",
+  "dashboard.worker_status_stopped": "หยุดแล้ว",
+  "dashboard.worker_status_unknown": "ไม่ทราบ",
+  "den.active_org_hint": "Cloud workers และเทมเพลตทีมจะอยู่ภายใต้องค์กรที่เลือก",
+  "den.active_org_title": "องค์กรที่ใช้งาน",
+  "den.auto_reconnect_hint": "เข้าสู่ระบบในเบราว์เซอร์ให้เสร็จ แล้ว OpenWork จะเชื่อมต่อใหม่โดยอัตโนมัติ",
+  "den.checking_session": "กำลังตรวจสอบเซสชัน",
+  "den.choose_org_for_providers": "เลือกองค์กรเพื่อดู provider บน Cloud",
+  "den.choose_org_for_skill_hubs": "เลือกองค์กรเพื่อดู Skill Hub บน Cloud",
+  "den.cloud_account_hint": "จัดการบัญชีและองค์กรที่เชื่อมต่อ",
+  "den.cloud_account_title": "บัญชี Cloud",
+  "den.cloud_control_plane_open": "เปิดในเบราว์เซอร์",
+  "den.cloud_control_plane_reset": "รีเซ็ต",
+  "den.cloud_control_plane_save": "บันทึก URL",
+  "den.cloud_control_plane_url_hint": "โหมดนักพัฒนาเท่านั้น ใช้เพื่อเชื่อมต่อ Cloud control plane ภายในเครื่องหรือที่โฮสต์เอง การเปลี่ยนจะออกจากระบบเพื่อให้แอปโหลดข้อมูลจาก control plane ใหม่",
+  "den.cloud_control_plane_url_label": "URL ของ Cloud control plane",
+  "den.cloud_provider_detail": "{count} โมเดล · {source} provider",
+  "den.cloud_provider_removed_detail": "Provider ที่นำเข้านี้ไม่อยู่บน Cloud แล้ว ถอนการติดตั้งการกำหนดค่า {providerId} ในเครื่อง",
+  "den.cloud_provider_sync_detail": "Provider บน Cloud เปลี่ยนแปลงแล้ว ซิงค์การกำหนดค่า {source} กับ {count} โมเดลเข้า opencode.jsonc",
+  "den.cloud_providers_hint": "นำเข้า LLM provider ที่จัดการแล้วเข้า opencode.jsonc และใช้ข้อมูลรับรองขององค์กรในพื้นที่ทำงานนี้",
+  "den.cloud_providers_title": "Provider บน Cloud",
+  "den.cloud_section_desc": "เข้าสู่ระบบ เลือกองค์กร และเปิด Cloud workers หรือเทมเพลตทีม",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "เข้าสู่ระบบ OpenWork Cloud เพื่อให้งานยังทำงานแม้คอมพิวเตอร์เข้าสู่โหมดสลีป",
+  "den.cloud_workers_hint": "เปิด workers ตรงใน OpenWork ด้วยขั้นตอนเชื่อมต่อระยะไกลเดียวกับที่แอปใช้ที่อื่น",
+  "den.cloud_workers_title": "Cloud workers",
+  "den.create_account": "สร้างบัญชี",
+  "den.credentials_ready_badge": "ข้อมูลรับรองพร้อม",
+  "den.error_base_url": "ใส่ URL ของ Cloud control plane ที่ถูกต้อง (http:// หรือ https://)",
+  "den.error_choose_org": "เลือกองค์กรก่อนเปิด worker",
+  "den.error_load_orgs": "โหลดองค์กรไม่สำเร็จ",
+  "den.error_load_workers": "โหลด workers ไม่สำเร็จ",
+  "den.error_no_session": "ไม่พบเซสชัน Cloud ที่ใช้งาน",
+  "den.error_no_token": "การเข้าสู่ระบบเดสก์ท็อปเสร็จสิ้น แต่ OpenWork Cloud ไม่ส่งคืนโทเค็นเซสชัน",
+  "den.error_open_worker": "เปิด {name} ใน OpenWork ไม่สำเร็จ",
+  "den.error_open_worker_fallback": "เปิด {name} ไม่สำเร็จ",
+  "den.error_paste_valid_code": "วางลิงก์เข้าสู่ระบบ OpenWork หรือรหัสครั้งเดียวที่ถูกต้อง",
+  "den.error_signin_failed": "เข้าสู่ระบบ OpenWork Cloud ไม่สำเร็จ",
+  "den.error_worker_not_ready": "Worker ยังไม่พร้อมเปิด ลองอีกครั้งหลังการจัดเตรียมเสร็จ",
+  "den.finish_signin": "เข้าสู่ระบบให้เสร็จ",
+  "den.finishing": "กำลังเสร็จสิ้น...",
+  "den.hide_signin_code": "ซ่อนรหัสเข้าสู่ระบบ",
+  "den.import_all": "นำเข้าทั้งหมด",
+  "den.import_provider": "นำเข้า",
+  "den.import_provider_failed": "ไม่สามารถนำเข้า {name} ได้",
+  "den.imported_badge": "นำเข้าแล้ว",
+  "den.imported_provider": "นำเข้า {name} แล้ว",
+  "den.importing": "กำลังนำเข้า…",
+  "den.needs_attention": "ต้องให้ความสนใจ",
+  "den.no_cloud_providers": "ยังไม่มี provider บน Cloud สำหรับองค์กรนี้",
+  "den.no_cloud_workers": "ยังไม่มี cloud workers สำหรับองค์กรนี้ สร้างใน Cloud แล้วรีเฟรชแท็บนี้",
+  "den.no_org_selected": "ยังไม่ได้เลือกองค์กร",
+  "den.no_skill_hubs": "ยังไม่มี Skill Hub บน Cloud สำหรับองค์กรนี้",
+  "den.open": "เปิด",
+  "den.opening": "กำลังเปิด...",
+  "den.org_member_suffix": "(สมาชิก)",
+  "den.org_owner_suffix": "(เจ้าของ)",
+  "den.org_switched": "สลับไปยัง {name} แล้ว",
+  "den.out_of_sync_badge": "ไม่ตรงกัน",
+  "den.paste_signin_code": "วางรหัสเข้าสู่ระบบ",
+  "den.refresh": "รีเฟรช",
+  "den.reload_workspace": "โหลดพื้นที่ทำงานใหม่เพื่อใช้การเปลี่ยนแปลงการตั้งค่า",
+  "den.remove_provider_failed": "ไม่สามารถลบ {name} ได้",
+  "den.removed_from_cloud_badge": "ลบจาก Cloud แล้ว",
+  "den.removed_provider": "ลบ {name} แล้ว",
+  "den.removing": "กำลังลบ…",
+  "den.sign_out": "ออกจากระบบ",
+  "den.signed_out": "ออกจากระบบแล้ว",
+  "den.signin_button": "เข้าสู่ระบบ",
+  "den.signin_code_note": "รับลิงก์ openwork://den-auth หรือรหัสครั้งเดียว",
+  "den.signin_link_hint": "หากเบราว์เซอร์ไม่กลับมาที่ OpenWork โดยอัตโนมัติ ให้วางลิงก์เข้าสู่ระบบหรือรหัสครั้งเดียวจาก OpenWork Cloud ที่นี่",
+  "den.signin_link_label": "ลิงก์เข้าสู่ระบบหรือรหัสครั้งเดียว",
+  "den.signin_link_placeholder": "openwork://den-auth?... หรือรหัสที่วาง",
+  "den.signin_title": "เข้าสู่ระบบ OpenWork Cloud",
+  "den.signing_in": "กำลังดำเนินการเข้าสู่ระบบ OpenWork Cloud ให้เสร็จสิ้น...",
+  "den.signing_out": "กำลังออกจากระบบ...",
+  "den.skill_hub_detail": "นำเข้า {count} skill ที่แชร์เข้า .opencode/skills",
+  "den.skill_hub_imported_detail": "นำเข้า {count} skill เข้าพื้นที่ทำงานนี้แล้ว",
+  "den.skill_hub_removed_detail": "Hub นี้ถูกลบจาก Cloud แล้ว ถอนการติดตั้ง {importedCount} skill ที่นำเข้าจากพื้นที่ทำงานนี้",
+  "den.skill_hub_skills_badge": "{count} skills",
+  "den.skill_hub_sync_detail": "Cloud มี {liveCount} skill; พื้นที่ทำงานนี้นำเข้า {importedCount} รายการ ซิงค์เพื่ออัปเดต",
+  "den.skill_hubs_hint": "นำเข้า skill ทั้งหมดจาก Cloud Hub ที่แชร์เข้าพื้นที่ทำงานนี้ในขั้นตอนเดียว",
+  "den.skill_hubs_title": "Skill Hub",
+  "den.status_base_url_updated": "อัปเดต URL ของ Cloud control plane แล้ว เข้าสู่ระบบอีกครั้งเพื่อดำเนินการต่อ",
+  "den.status_browser_signin": "เข้าสู่ระบบในเบราว์เซอร์ให้เสร็จเพื่อเชื่อมต่อ OpenWork",
+  "den.status_browser_signup": "สร้างบัญชีในเบราว์เซอร์ให้เสร็จเพื่อเชื่อมต่อ OpenWork",
+  "den.status_cloud_signed_in_as": "เชื่อมต่อ OpenWork Cloud เป็น {email}",
+  "den.status_cloud_signin_done": "เชื่อมต่อ OpenWork Cloud แล้ว",
+  "den.status_loaded_orgs": "โหลด {count} องค์กรแล้ว",
+  "den.status_loaded_workers": "โหลด {count} workers สำหรับ {name} แล้ว",
+  "den.status_no_workers": "ไม่พบ workers สำหรับ {name}",
+  "den.status_opened_worker": "เปิด {name} ใน OpenWork แล้ว",
+  "den.status_signed_in_as": "เข้าสู่ระบบเป็น {email}",
+  "den.status_signed_out": "ออกจากระบบและล้างเซสชัน OpenWork Cloud บนอุปกรณ์นี้แล้ว",
+  "den.sync": "ซิงค์",
+  "den.sync_provider_failed": "ไม่สามารถซิงค์ {name} ได้",
+  "den.synced_provider": "ซิงค์ {name} แล้ว",
+  "den.syncing": "กำลังซิงค์…",
+  "den.uninstall": "ถอนการติดตั้ง",
+  "den.worker_mine_badge": "ของฉัน",
+  "den.worker_not_ready_title": "Worker นี้ยังไม่พร้อมเปิด",
+  "den.worker_provider_label": "{provider} worker",
+  "den.worker_secondary_cloud": "Cloud worker",
+  "extensions.app_count": "{count} แอปเชื่อมต่อแล้ว",
+  "extensions.apps_mcp_header": "แอป (MCP)",
+  "extensions.filter_all": "ทั้งหมด",
+  "extensions.filter_apps": "แอป",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count": "{count} ปลั๊กอิน",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "แอป (MCP) และ OpenCode plugins อยู่ในที่เดียว",
+  "extensions.title": "ส่วนขยาย",
+  "identities.agent_behavior_desc": "ไฟล์เดียวต่อพื้นที่ทำงาน เพิ่มบรรทัดแรก @agent <id> เพื่อ route ผ่าน OpenCode agent ที่ระบุ",
+  "identities.agent_behavior_title": "พฤติกรรม messaging agent",
+  "identities.agent_created": "สร้างไฟล์ messaging agent เริ่มต้นแล้ว",
+  "identities.agent_file_changed": "ไฟล์ถูกเปลี่ยนจากระยะไกล รีโหลดและบันทึกใหม่",
+  "identities.agent_loading": "กำลังโหลดไฟล์ agent…",
+  "identities.agent_none": "ไม่มี",
+  "identities.agent_not_found": "ยังไม่พบไฟล์ agent ในพื้นที่ทำงานนี้",
+  "identities.agent_saved": "บันทึกพฤติกรรม messaging แล้ว",
+  "identities.agent_scope_status": "ขอบเขต: พื้นที่ทำงาน · สถานะ: {status} · agent ที่เลือก: {agent}",
+  "identities.agent_status_loaded": "โหลดแล้ว",
+  "identities.agent_status_missing": "ไม่พบ",
+  "identities.agent_worker_scope_unavailable": "ขอบเขต worker ไม่พร้อมใช้งาน",
+  "identities.all_channels": "ทุกช่องทาง",
+  "identities.app_token_label": "App token",
+  "identities.auto_bind_label": "ผูก peer กับไดเรกทอรีอัตโนมัติเมื่อส่งตรง",
+  "identities.available_channels": "ช่องทางที่ใช้ได้",
+  "identities.bot_token_label": "Bot token",
+  "identities.bot_token_placeholder": "วาง Telegram bot token จาก @BotFather",
+  "identities.botfather_step1_open": "1. เปิด @BotFather ใน Telegram",
+  "identities.botfather_step1_run": "แล้วรัน /newbot",
+  "identities.botfather_step3_choose": "3. เลือกชื่อและ username สำหรับบอท",
+  "identities.botfather_step3_or_private": "สำหรับ inbox เปิด หรือ",
+  "identities.botfather_step3_private": "ส่วนตัว",
+  "identities.botfather_step3_public": "สาธารณะ",
+  "identities.botfather_step3_to_require": "เพื่อกำหนด",
+  "identities.channel_label": "ช่องทาง",
+  "identities.channels_connected": "เชื่อมต่อแล้ว",
+  "identities.channels_label": "ช่องทาง",
+  "identities.configured_suffix": "ตั้งค่าแล้ว",
+  "identities.connect_server_desc": "Identities ใช้งานได้เมื่อเชื่อมต่อกับ OpenWork host",
+  "identities.connect_server_title": "เชื่อมต่อ OpenWork server",
+  "identities.connect_slack": "เชื่อมต่อ Slack",
+  "identities.connected_badge": "เชื่อมต่อแล้ว",
+  "identities.connecting": "กำลังเชื่อมต่อ...",
+  "identities.copy_bot_token_hint": "คัดลอก bot token แล้ววางด้านล่าง",
+  "identities.copy_code": "คัดลอกรหัส",
+  "identities.create_default_file": "สร้างไฟล์เริ่มต้น",
+  "identities.create_private_bot": "สร้างบอทส่วนตัว",
+  "identities.create_public_bot": "สร้างบอทสาธารณะ",
+  "identities.days_ago": "{days} วันที่แล้ว",
+  "identities.default_routing": "การ route เริ่มต้น",
+  "identities.directory_label": "ไดเรกทอรี (ไม่บังคับ)",
+  "identities.disable_messaging": "ปิด messaging",
+  "identities.disable_messaging_message": "การดำเนินการนี้จะปิด messaging สำหรับพื้นที่ทำงานนี้ การตั้งค่า Telegram และ Slack จะถูกซ่อนจนกว่าจะเปิด messaging อีกครั้ง และคุณจะต้องรีสตาร์ท worker เพื่อหยุด messaging sidecar อย่างสมบูรณ์",
+  "identities.disable_messaging_title": "ปิด messaging สำหรับ worker นี้?",
+  "identities.disabled_label": "ปิดใช้งาน",
+  "identities.disabling": "กำลังปิดใช้งาน...",
+  "identities.disconnect": "ตัดการเชื่อมต่อ",
+  "identities.dispatched_messages": "ส่ง {sent}/{attempted} ข้อความแล้ว",
+  "identities.enable_messaging": "เปิด messaging",
+  "identities.enable_messaging_risk": "Messaging อาจเปิดเผย worker นี้ต่อคำสั่งระยะไกล หากบอทเป็นสาธารณะหรือถูกบุกรุก อาจเข้าถึงไฟล์ ข้อมูลรับรอง และ API key ที่ worker นี้ใช้ได้",
+  "identities.enable_messaging_title": "เปิด messaging สำหรับ worker นี้?",
+  "identities.enabled_label": "เปิดใช้งาน",
+  "identities.enabling": "กำลังเปิดใช้งาน...",
+  "identities.health_offline": "ออฟไลน์",
+  "identities.health_running": "กำลังทำงาน",
+  "identities.health_unavailable": "ไม่พร้อมใช้งาน",
+  "identities.health_unknown": "ไม่ทราบ",
+  "identities.hours_ago": "{hours} ชม. ที่แล้ว",
+  "identities.identities_label": "Identities",
+  "identities.just_now": "เมื่อสักครู่",
+  "identities.last_activity": "กิจกรรมล่าสุด",
+  "identities.later": "ภายหลัง",
+  "identities.message_label": "ข้อความ",
+  "identities.message_routing_desc": "ควบคุมว่าบทสนทนาไหนจะส่งไปโฟลเดอร์ไหน ข้อความจะถูก route ไปยังโฟลเดอร์เริ่มต้นของ worker เว้นแต่คุณจะตั้งกฎที่นี่",
+  "identities.message_routing_title": "การ route ข้อความ",
+  "identities.messages_today": "ข้อความวันนี้",
+  "identities.messaging_disabled_hint": "เปิด messaging เฉพาะเมื่อคุณเข้าใจความเสี่ยงและวางแผนรักษาความปลอดภัย (เช่น Telegram pairing แบบส่วนตัว)",
+  "identities.messaging_disabled_restart": "ปิด messaging แล้ว รีสตาร์ท worker เพื่อหยุด messaging sidecar",
+  "identities.messaging_disabled_risk": "บอท messaging สามารถดำเนินการต่อ local worker ของคุณได้ หากเปิดเผยต่อสาธารณะ อาจอนุญาตให้เข้าถึงไฟล์ ข้อมูลรับรอง และ API key ที่ worker นี้ใช้ได้",
+  "identities.messaging_disabled_title": "Messaging ปิดอยู่เป็นค่าเริ่มต้น",
+  "identities.messaging_enabled_restart": "เปิด messaging แล้ว รีสตาร์ท worker เพื่อเริ่ม messaging sidecar และปลดล็อกการตั้งค่า Telegram และ Slack",
+  "identities.messaging_sidecar_not_running": "Messaging เปิดอยู่ในพื้นที่ทำงานนี้ แต่ messaging sidecar ยังไม่ทำงาน รีสตาร์ท worker แล้วกลับมาที่การตั้งค่า Messaging เพื่อเชื่อมต่อ Telegram หรือ Slack",
+  "identities.minutes_ago": "{minutes} นาทีที่แล้ว",
+  "identities.not_set": "ไม่ได้ตั้งค่า",
+  "identities.open_bot_link": "เปิด @{username} ใน Telegram",
+  "identities.pairing_code_copied": "คัดลอกรหัสจับคู่แล้ว",
+  "identities.pairing_code_copy_failed": "คัดลอกรหัสจับคู่ไม่ได้ คัดลอกด้วยตนเอง",
+  "identities.pairing_code_instruction_prefix": "ส่ง",
+  "identities.peer_id_label": "Peer ID (ไม่บังคับ)",
+  "identities.peer_id_placeholder_slack": "เช่น slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "เช่น telegram:123456789",
+  "identities.private_label": "ส่วนตัว",
+  "identities.private_pairing_code": "รหัสจับคู่ส่วนตัว",
+  "identities.public_bot_confirm": "ใช่ ฉันเข้าใจความเสี่ยง",
+  "identities.public_bot_warning_message": "บอทของคุณจะเข้าถึงได้สาธารณะ ทุกคนที่เข้าถึงบอทจะสามารถเข้าถึง local worker ของคุณได้เต็มที่ รวมถึงไฟล์และ API key ที่คุณให้ไว้ หากสร้างบอทส่วนตัว คุณสามารถจำกัดผู้เข้าถึงด้วยการกำหนดให้ใช้ pairing token คุณแน่ใจหรือไม่ว่าต้องการทำบอทสาธารณะ?",
+  "identities.public_bot_warning_title": "ทำบอทนี้เป็นสาธารณะ?",
+  "identities.public_label": "สาธารณะ",
+  "identities.quick_setup": "ตั้งค่าด่วน",
+  "identities.reconnect_failed": "เชื่อมต่อใหม่ไม่สำเร็จ ตรวจสอบ URL/token ของ OpenWork แล้วลองอีกครั้ง",
+  "identities.reconnected": "เชื่อมต่อใหม่แล้ว",
+  "identities.reconnected_refreshing": "เชื่อมต่อใหม่แล้ว กำลังรีเฟรชสถานะ worker...",
+  "identities.reload": "รีโหลด",
+  "identities.repair_reconnect": "ซ่อมแซมและเชื่อมต่อใหม่",
+  "identities.restart_failed": "รีสตาร์ทล้มเหลว กรุณารีสตาร์ท worker จาก Settings แล้วลองอีกครั้ง",
+  "identities.restart_to_disable_messaging": "ปิด messaging สำหรับพื้นที่ทำงานนี้แล้ว รีสตาร์ท worker ตอนนี้เพื่อหยุด messaging sidecar",
+  "identities.restart_to_enable_messaging": "เปิด messaging สำหรับพื้นที่ทำงานนี้แล้ว รีสตาร์ท worker ตอนนี้เพื่อเริ่ม messaging sidecar และปลดล็อกการตั้งค่า Telegram และ Slack",
+  "identities.restart_worker": "รีสตาร์ท worker",
+  "identities.restart_worker_title": "รีสตาร์ท worker ตอนนี้?",
+  "identities.restarting": "กำลังรีสตาร์ท...",
+  "identities.routing_override_prefix": "ข้อความทั้งหมด route ไปที่",
+  "identities.routing_override_suffix": "(override ทำงานอยู่)",
+  "identities.running_label": "กำลังทำงาน",
+  "identities.save_behavior": "บันทึกพฤติกรรม",
+  "identities.saving": "กำลังบันทึก...",
+  "identities.send_test_button": "ส่งข้อความทดสอบ",
+  "identities.send_test_desc": "ตรวจสอบการเชื่อมต่อขาออก ใช้ peer ID สำหรับส่งตรง หรือเว้น peer ID ว่างเพื่อกระจายตาม bindings ในไดเรกทอรี",
+  "identities.send_test_title": "ส่งข้อความทดสอบ",
+  "identities.sending": "กำลังส่ง...",
+  "identities.slack_desc": "Worker ของคุณจะปรากฏเป็นบอทใน Slack channels สมาชิกทีมสามารถส่งข้อความโดยตรงหรือ mention ในเธรด",
+  "identities.slack_intro": "เชื่อมต่อ Slack workspace เพื่อให้สมาชิกทีมโต้ตอบกับ worker นี้ใน channels และ DM",
+  "identities.slack_unavailable": "Slack identities ไม่พร้อมใช้งาน",
+  "identities.status_active": "ใช้งานอยู่",
+  "identities.status_label": "สถานะ",
+  "identities.status_stopped": "หยุดแล้ว",
+  "identities.stopped_label": "หยุดแล้ว",
+  "identities.subtitle": "ให้ผู้คนเข้าถึง worker ของคุณผ่านแอปข้อความ เชื่อมต่อช่องทางแล้ว worker จะอ่านและตอบข้อความโดยอัตโนมัติ",
+  "identities.tab_general": "ทั่วไป",
+  "identities.telegram_bot_access_desc": "บอทสาธารณะ: แชท Telegram แรกจะเชื่อมต่ออัตโนมัติ บอทส่วนตัว: ต้องใช้รหัสจับคู่ก่อนข้อความจะรันเครื่องมือ",
+  "identities.telegram_delete_failed": "ลบไม่สำเร็จ",
+  "identities.telegram_deleted": "ลบแล้ว",
+  "identities.telegram_deleted_pending": "ลบแล้ว (รอใช้งาน)",
+  "identities.telegram_desc": "เชื่อมต่อ Telegram bot ในโหมดสาธารณะ (inbox เปิด) หรือโหมดส่วนตัว (ต้องใช้รหัสจับคู่)",
+  "identities.telegram_private_saved_pair": "บันทึกบอทส่วนตัวแล้ว จับคู่ด้วย /pair {code}",
+  "identities.telegram_save_failed": "บันทึกไม่สำเร็จ",
+  "identities.telegram_saved": "บันทึกแล้ว",
+  "identities.telegram_saved_pending": "บันทึกแล้ว (รอใช้งาน)",
+  "identities.telegram_saved_username": "บันทึกแล้ว (@{username})",
+  "identities.telegram_unavailable": "Telegram identities ไม่พร้อมใช้งาน",
+  "identities.title": "ช่องทาง messaging",
+  "identities.unsaved_changes": "มีการเปลี่ยนแปลงที่ยังไม่ได้บันทึก",
+  "identities.worker_offline": "Worker ออฟไลน์",
+  "identities.worker_online": "Worker ออนไลน์",
+  "identities.worker_restarted": "รีสตาร์ท worker แล้ว",
+  "identities.worker_restarted_refreshing": "รีสตาร์ท worker แล้ว กำลังรีเฟรชสถานะ messaging...",
+  "identities.worker_scope_unavailable": "ขอบเขต worker ไม่พร้อมใช้งาน",
+  "identities.worker_scope_unavailable_detail": "ขอบเขต worker ไม่พร้อมใช้งาน เชื่อมต่อใหม่ด้วย worker URL หรือสลับไปยัง worker ที่รู้จัก",
+  "identities.worker_unavailable": "Worker ไม่พร้อมใช้งาน",
+  "identities.workspace_id_required": "ต้องใช้ Workspace ID เพื่อจัดการ identities เชื่อมต่อใหม่ด้วย workspace URL หรือเลือกพื้นที่ทำงานที่ map ไว้บน host นี้",
+  "identities.workspace_scope_prefix": "ขอบเขตพื้นที่ทำงาน:",
+  "mcp.add_modal_subtitle": "เชื่อมต่อ MCP server กำหนดเองด้วย URL หรือคำสั่งภายในเครื่อง",
+  "mcp.add_modal_title": "เพิ่มแอปกำหนดเอง",
+  "mcp.add_server_button": "เพิ่มแอป",
+  "mcp.advanced": "ขั้นสูง",
+  "mcp.advanced_settings": "การตั้งค่าขั้นสูง",
+  "mcp.advanced_settings_hint": "แก้ไขไฟล์ config และจัดการการเชื่อมต่อด้วยตนเอง",
+  "mcp.app_connected": "แอปที่เชื่อมต่อ",
+  "mcp.apps_connected": "แอปที่เชื่อมต่อ",
+  "mcp.apps_subtitle": "เชื่อมต่อเครื่องมือที่คุณชื่นชอบเพื่อให้ OpenWork ใช้งานแทนคุณ",
+  "mcp.apps_title": "แอป",
+  "mcp.auth.already_connected": "เชื่อมต่อแล้ว",
+  "mcp.auth.already_connected_description": "{server} ได้ยืนยันตัวตนแล้วและพร้อมใช้งาน",
+  "mcp.auth.applying_changes_body": "เรากำลังรีสตาร์ท worker เพื่อให้ MCP ใหม่พร้อมยืนยันตัวตน",
+  "mcp.auth.applying_changes_title": "กำลังใช้การเปลี่ยนแปลงก่อนเข้าสู่ระบบ",
+  "mcp.auth.authorization_link": "ลิงก์อนุมัติ",
+  "mcp.auth.authorization_still_required": "ยังต้องการอนุมัติ ลองอีกครั้งเพื่อเริ่มขั้นตอนใหม่",
+  "mcp.auth.callback_invalid": "วาง callback URL หรือพารามิเตอร์ code เพื่อเสร็จสิ้น OAuth",
+  "mcp.auth.callback_label": "Callback URL หรือรหัส",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "ยกเลิก",
+  "mcp.auth.client_registration_required": "ต้องลงทะเบียน client ก่อนดำเนินการ OAuth",
+  "mcp.auth.complete_connection": "เชื่อมต่อให้เสร็จ",
+  "mcp.auth.configured_previously": "MCP อาจถูกตั้งค่าไว้แบบทั่วไปหรือในเซสชันก่อนหน้า คุณสามารถปิดหน้าต่างนี้และเริ่มใช้เครื่องมือ MCP ได้ทันที",
+  "mcp.auth.connect_server": "เชื่อมต่อ {server}",
+  "mcp.auth.copied": "คัดลอกแล้ว",
+  "mcp.auth.copy_link": "คัดลอกลิงก์",
+  "mcp.auth.done": "เสร็จสิ้น",
+  "mcp.auth.failed_to_start_oauth": "เริ่มขั้นตอน OAuth ไม่สำเร็จ",
+  "mcp.auth.follow_browser_steps": "ทำตามขั้นตอนการอนุมัติในเบราว์เซอร์",
+  "mcp.auth.force_stop": "บังคับหยุด",
+  "mcp.auth.force_stopping": "กำลังหยุด...",
+  "mcp.auth.im_done": "ดำเนินการเสร็จแล้ว",
+  "mcp.auth.invalid_refresh_token": "Refresh token ของ OAuth ไม่ถูกต้องหรือหมดอายุ ยืนยันตัวตนอีกครั้งเพื่อดำเนินการต่อ",
+  "mcp.auth.manual_finish_hint": "วาง callback URL (localhost:19876) หรือรหัสเพื่อเชื่อมต่อให้เสร็จ",
+  "mcp.auth.manual_finish_title": "เซิร์ฟเวอร์ระยะไกล?",
+  "mcp.auth.oauth_completed_reload": "OAuth เสร็จสิ้น รีโหลด engine เพื่อเปิดใช้งาน MCP",
+  "mcp.auth.oauth_failed": "การยืนยันตัวตน OAuth ล้มเหลว",
+  "mcp.auth.oauth_not_supported_hint": "อาจหมายความว่า:\n• MCP server ไม่ได้ประกาศความสามารถ OAuth\n• Engine ต้องรีโหลดเพื่อตรวจสอบความสามารถของเซิร์ฟเวอร์\n• ลอง: opencode mcp auth {server} จาก CLI",
+  "mcp.auth.open_browser_signin": "เราจะเปิดเบราว์เซอร์เพื่อเข้าสู่ระบบ",
+  "mcp.auth.port_forward_hint": "เคล็ดลับ: forward callback port ถ้าจำเป็น: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "ยืนยันตัวตน OAuth อีกครั้ง",
+  "mcp.auth.reauth_cli_hint": "รัน: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "ยืนยันตัวตนอีกครั้งไม่สำเร็จ",
+  "mcp.auth.reauth_remote_hint": "ยืนยันตัวตนอีกครั้งจากเครื่องที่รัน worker นี้",
+  "mcp.auth.reauth_running": "กำลังยืนยันตัวตนอีกครั้ง...",
+  "mcp.auth.reload_blocked": "การรีโหลดหยุดชั่วคราวขณะเซสชันกำลังทำงาน หยุดการทำงานเพื่อตั้งค่าให้เสร็จ",
+  "mcp.auth.reload_engine_retry": "ใช้การเปลี่ยนแปลงและลองอีกครั้ง",
+  "mcp.auth.reload_failed": "รีโหลด worker ก่อนเข้าสู่ระบบไม่สำเร็จ",
+  "mcp.auth.reload_notice": "เพื่อให้มีผล OpenWork ต้องรีเฟรชบริการ worker ซึ่งอาจหยุดเซสชันที่กำลังทำงาน",
+  "mcp.auth.reload_remote_confirm": "เพื่อให้มีผล OpenWork ต้องรีเฟรชบริการ worker ซึ่งอาจหยุดเซสชันที่กำลังทำงาน ดำเนินการต่อ?",
+  "mcp.auth.reopen_browser_link": "คลิกที่นี่เพื่อเปิดเบราว์เซอร์อีกครั้ง",
+  "mcp.auth.request_timed_out": "คำขอหมดเวลา",
+  "mcp.auth.retry": "ลองอีกครั้ง",
+  "mcp.auth.retry_now": "ลองอีกครั้งทันที",
+  "mcp.auth.server_disabled": "MCP server นี้ถูกปิดใช้งาน เปิดใช้งานแล้วลองอีกครั้ง",
+  "mcp.auth.step1_description": "เราจะเปิดขั้นตอนเข้าสู่ระบบของ {server} โดยอัตโนมัติ",
+  "mcp.auth.step1_title": "กำลังเปิดเบราว์เซอร์",
+  "mcp.auth.step2_description": "เข้าสู่ระบบและอนุมัติการเข้าถึงเมื่อมีการแจ้ง",
+  "mcp.auth.step2_title": "อนุมัติ OpenWork",
+  "mcp.auth.step3_description": "เราจะเชื่อมต่อให้เสร็จทันทีที่การอนุมัติเสร็จสิ้น",
+  "mcp.auth.step3_title": "กลับมาที่นี่เมื่อเสร็จแล้ว",
+  "mcp.auth.try_reload_engine": "{message} ลองรีโหลด engine ก่อน",
+  "mcp.auth.waiting_authorization": "กำลังรอการอนุมัติในเบราว์เซอร์ของคุณ...",
+  "mcp.auth.waiting_for_conversation_body": "เราจะนำคุณไปยืนยันตัวตนโดยเร็วที่สุด",
+  "mcp.auth.waiting_for_conversation_title": "กำลังรอให้บทสนทนาเสร็จสิ้น",
+  "mcp.auth.waiting_for_session": "กำลังรอให้ {session} ทำงานเสร็จ",
+  "mcp.available_apps": "แอปที่ใช้ได้",
+  "mcp.cap_signin": "เข้าสู่ระบบบัญชี",
+  "mcp.cap_tools": "เครื่องมือ AI",
+  "mcp.config_file": "ไฟล์ config",
+  "mcp.config_load_failed": "ไม่สามารถโหลดไฟล์ config",
+  "mcp.config_not_loaded": "ยังไม่ได้โหลด",
+  "mcp.connect": "เชื่อมต่อ",
+  "mcp.connect_failed": "เชื่อมต่อไม่สำเร็จ ลองอีกครั้ง",
+  "mcp.connect_server_first": "เชื่อมต่อเซิร์ฟเวอร์ก่อน",
+  "mcp.connected": "เชื่อมต่อแล้ว",
+  "mcp.connected_badge": "เชื่อมต่อแล้ว",
+  "mcp.connection_failed": "มีปัญหาการเชื่อมต่อ — ลองอีกครั้ง",
+  "mcp.connection_type": "การเชื่อมต่อ",
+  "mcp.control_chrome_browser_hint": "ใน Chrome 144 หรือใหม่กว่า ทำสิ่งนี้ก่อน:",
+  "mcp.control_chrome_browser_step_one": "เปิด chrome://inspect/#remote-debugging",
+  "mcp.control_chrome_browser_step_two": "เปิดใช้งาน remote debugging",
+  "mcp.control_chrome_browser_step_three": "อนุญาตการเชื่อมต่อ debugging ขาเข้าเมื่อ Chrome ถาม",
+  "mcp.control_chrome_browser_title": "1. เปิดการเข้าถึง Chrome",
+  "mcp.control_chrome_connect": "เพิ่ม Control Chrome",
+  "mcp.control_chrome_docs": "คู่มือ MCP อย่างเป็นทางการ",
+  "mcp.control_chrome_edit": "แก้ไขการตั้งค่า",
+  "mcp.control_chrome_profile_hint": "Control Chrome ปกติจะเปิดโปรไฟล์ Chrome แยก เปิดตัวเลือกนี้หากต้องการให้ OpenWork ใช้หน้าต่าง Chrome ที่เปิดอยู่",
+  "mcp.control_chrome_profile_title": "2. เลือก Chrome ที่จะใช้",
+  "mcp.control_chrome_save": "บันทึกการตั้งค่า",
+  "mcp.control_chrome_setup_subtitle": "เปิดการเข้าถึง Chrome แล้วเลือกว่า OpenWork ควรใช้โปรไฟล์ใหม่หรือแนบกับ Chrome ที่คุณใช้อยู่",
+  "mcp.control_chrome_setup_title": "ตั้งค่า Control Chrome",
+  "mcp.control_chrome_toggle_hint": "เมื่อเปิดใช้งาน OpenWork จะเพิ่ม --autoConnect เพื่อให้ MCP แนบกับ Chrome ที่คุณเริ่มไว้แล้ว",
+  "mcp.control_chrome_toggle_label": "ใช้โปรไฟล์ Chrome ที่มีอยู่",
+  "mcp.control_chrome_toggle_off": "OpenWork จะเปิดโปรไฟล์ Chrome แยกสำหรับ automation",
+  "mcp.control_chrome_toggle_on": "OpenWork จะใช้แท็บ, คุกกี้ และข้อมูลเข้าสู่ระบบปัจจุบันของคุณ",
+  "mcp.custom_app_cta_hint": "เชื่อมต่อ MCP server, เครื่องมือภายใน หรือแอปที่โฮสต์ของคุณเอง",
+  "mcp.desktop_required": "แอปต้องใช้แอปเดสก์ท็อป",
+  "mcp.docs_link": "เรียนรู้เพิ่มเติม",
+  "mcp.file_not_found": "ยังไม่ได้สร้างไฟล์ config",
+  "mcp.friendly_status_issue": "มีปัญหา",
+  "mcp.friendly_status_needs_signin": "ต้องเข้าสู่ระบบ",
+  "mcp.friendly_status_offline": "ออฟไลน์",
+  "mcp.friendly_status_paused": "หยุดชั่วคราว",
+  "mcp.friendly_status_ready": "พร้อม",
+  "mcp.last_synced": "ซิงค์แล้ว",
+  "mcp.login_action": "เข้าสู่ระบบ",
+  "mcp.login_hint": "เชื่อมต่อบัญชีของคุณเพื่อตั้งค่าแอปนี้ให้เสร็จ",
+  "mcp.login_unavailable": "แอปนี้ไม่รองรับการเข้าสู่ระบบจาก OpenWork",
+  "mcp.logout_action": "ออกจากระบบ",
+  "mcp.logout_failed": "ออกจากระบบไม่สำเร็จ",
+  "mcp.logout_hint": "ลบข้อมูล OAuth ที่เก็บไว้ คุณจะต้องเข้าสู่ระบบอีกครั้ง",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "การดำเนินการนี้จะลบข้อมูล OAuth ที่เก็บไว้สำหรับ {server} คุณจะต้องเข้าสู่ระบบอีกครั้งเพื่อใช้แอปนี้",
+  "mcp.logout_modal_title": "ออกจากระบบแอปนี้?",
+  "mcp.logout_success": "ออกจากระบบ {server} แล้ว",
+  "mcp.logout_working": "กำลังออกจากระบบ...",
+  "mcp.name_required": "ใส่ชื่อเซิร์ฟเวอร์",
+  "mcp.no_apps_hint": "เชื่อมต่อแอปด้านบนเพื่อเริ่มต้น",
+  "mcp.no_apps_yet": "ยังไม่มีแอปที่เชื่อมต่อ",
+  "mcp.oauth": "เข้าสู่ระบบ",
+  "mcp.oauth_optional_hint": "ใช้ OAuth ในเบราว์เซอร์เพื่อเชื่อมต่อบัญชีของคุณ",
+  "mcp.oauth_optional_label": "แอปนี้ต้องเข้าสู่ระบบ",
+  "mcp.one_click_connect": "เชื่อมต่อด้วยคลิกเดียว",
+  "mcp.open_file": "เปิดไฟล์",
+  "mcp.opening_label": "กำลังเปิด...",
+  "mcp.pick_workspace_error": "เลือกโฟลเดอร์พื้นที่ทำงานก่อน",
+  "mcp.pick_workspace_first": "เลือกโฟลเดอร์พื้นที่ทำงานก่อน",
+  "mcp.quick_connect_chrome_desc": "ควบคุมแท็บ Chrome ด้วย browser automation",
+  "mcp.quick_connect_chrome_title": "ควบคุม Chrome",
+  "mcp.quick_connect_context7_desc": "ค้นหาเอกสารผลิตภัณฑ์ด้วยบริบทที่สมบูรณ์ยิ่งขึ้น",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "วางแผน sprint และจัดการ ticket ได้เร็วขึ้น",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "ซิงค์หน้า ฐานข้อมูล และเอกสารโปรเจกต์",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "ติดตามรีลีสและแก้ไขข้อผิดพลาดใน production",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "ตรวจสอบการชำระเงิน ใบแจ้งหนี้ และการสมัครสมาชิก",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "หยุดงานที่กำลังทำงานเพื่อเปิดใช้งาน",
+  "mcp.remote_workspace_url_hint": "Remote workers เชื่อมต่อได้เร็วที่สุดกับ MCP server แบบ URL",
+  "mcp.remove_app": "ลบ",
+  "mcp.remove_failed": "ลบแอปไม่สำเร็จ",
+  "mcp.remove_modal_message": "คุณแน่ใจหรือไม่ว่าต้องการลบ {server}? คุณสามารถเพิ่มกลับได้ในภายหลัง",
+  "mcp.remove_modal_title": "ลบแอป",
+  "mcp.reveal_config_failed": "ไม่สามารถเปิดไฟล์ config",
+  "mcp.reveal_in_finder": "เปิดในตัวจัดการไฟล์",
+  "mcp.scope_global": "ทุกพื้นที่ทำงาน",
+  "mcp.scope_project": "พื้นที่ทำงานนี้",
+  "mcp.server_command": "คำสั่ง",
+  "mcp.server_command_hint": "คำสั่ง shell สำหรับเริ่มเซิร์ฟเวอร์",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "ชื่อแอป",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "ประเภท",
+  "mcp.server_url": "URL ของเซิร์ฟเวอร์",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "การเข้าสู่ระบบ",
+  "mcp.tap_to_connect": "แตะเพื่อเชื่อมต่อ",
+  "mcp.technical_details": "รายละเอียดทางเทคนิค",
+  "mcp.type_cloud": "Cloud (เข้าสู่ระบบด้วยบัญชีของคุณ)",
+  "mcp.type_local": "ภายในเครื่อง (ทำงานบนอุปกรณ์นี้)",
+  "mcp.type_local_cmd": "ภายในเครื่อง (คำสั่ง)",
+  "mcp.type_remote": "ระยะไกล (URL)",
+  "mcp.url_or_command_required": "ใส่ URL สำหรับระยะไกล หรือคำสั่งสำหรับเซิร์ฟเวอร์ภายในเครื่อง",
+  "mcp.your_apps": "แอปของคุณ",
+  "model_behavior.desc_builtin": "โมเดลนี้กำหนดเส้นทางการใช้เหตุผลเองและไม่แสดงโปรไฟล์ที่นี่",
+  "model_behavior.desc_generic": "ใช้โปรไฟล์ {label}",
+  "model_behavior.desc_high": "ใช้เวลามากขึ้นในการใช้เหตุผลก่อนตอบ",
+  "model_behavior.desc_high_anthropic": "ใช้งบประมาณ extended thinking มาตรฐาน",
+  "model_behavior.desc_low": "ใช้การใช้เหตุผลเบาก่อนตอบ",
+  "model_behavior.desc_low_google": "ใช้งบประมาณการใช้เหตุผลเบาขึ้นเพื่อตอบสนองเร็วขึ้น",
+  "model_behavior.desc_max": "ใช้โปรไฟล์การใช้เหตุผลที่ลึกที่สุดของ provider",
+  "model_behavior.desc_max_anthropic": "ใช้งบประมาณ extended thinking สูงสุดที่มี",
+  "model_behavior.desc_medium": "สมดุลระหว่างความเร็วและความลึกของการใช้เหตุผล",
+  "model_behavior.desc_minimal": "ใช้การใช้เหตุผลเพียงเล็กน้อย",
+  "model_behavior.desc_none": "ให้ความสำคัญกับความเร็วด้วยเส้นทางการใช้เหตุผลเบาที่สุด",
+  "model_behavior.desc_standard": "โมเดลนี้ไม่มีการควบคุมการใช้เหตุผลเพิ่มเติม",
+  "model_behavior.label_balanced": "สมดุล",
+  "model_behavior.label_builtin": "ในตัว",
+  "model_behavior.label_deep": "ลึก",
+  "model_behavior.label_extended": "ขยาย",
+  "model_behavior.label_fast": "เร็ว",
+  "model_behavior.label_light": "เบา",
+  "model_behavior.label_maximum": "สูงสุด",
+  "model_behavior.label_quick": "รวดเร็ว",
+  "model_behavior.label_standard": "มาตรฐาน",
+  "model_behavior.title_builtin_reasoning": "การใช้เหตุผลในตัว",
+  "model_behavior.title_extended_thinking": "Extended thinking",
+  "model_behavior.title_reasoning_budget": "งบประมาณการใช้เหตุผล",
+  "model_behavior.title_reasoning_effort": "ระดับการใช้เหตุผล",
+  "model_behavior.title_standard_generation": "การสร้างแบบมาตรฐาน",
+  "model_picker.chat_model_desc": "เลือกโมเดลสำหรับแชทนี้ หากโมเดลรองรับ reasoning profiles ให้ตั้งค่าบนการ์ดของโมเดล",
+  "model_picker.chat_model_title": "โมเดลแชท",
+  "model_picker.connect_provider_hint": "เชื่อมต่อผู้ให้บริการนี้เพื่อเรียกดูและบันทึกโมเดล",
+  "model_picker.default_model_desc": "เลือกโมเดลเริ่มต้นสำหรับแชทใหม่ แล้วปรับ reasoning profiles บนการ์ดก่อนกด เสร็จสิ้น",
+  "model_picker.default_model_title": "โมเดลเริ่มต้น",
+  "model_picker.model_count": "{count} โมเดล",
+  "model_picker.more_providers": "ผู้ให้บริการเพิ่มเติม",
+  "model_picker.no_results": "ไม่พบโมเดลที่ตรงกับการค้นหา",
+  "model_picker.other_connected_models": "โมเดลที่เชื่อมต่ออื่นๆ",
+  "model_picker.recommended": "แนะนำ",
+  "onboarding.authorize_folder": "อนุญาตโฟลเดอร์",
+  "plugins.add": "เพิ่ม",
+  "plugins.add_hint": "เพิ่มชื่อแพ็กเกจ npm เช่น opencode-wakatime",
+  "plugins.add_label": "เพิ่ม plugin",
+  "plugins.added": "เพิ่มแล้ว",
+  "plugins.config": "การตั้งค่า",
+  "plugins.config_label": "การตั้งค่า",
+  "plugins.desc": "จัดการ `opencode.json` สำหรับโปรเจกต์หรือ OpenCode plugins ทั่วไป",
+  "plugins.empty": "ยังไม่มี plugins ที่ตั้งค่า",
+  "plugins.enabled": "เปิดใช้งาน",
+  "plugins.hide_setup": "ซ่อนการตั้งค่า",
+  "plugins.not_loaded": "ยังไม่ได้โหลด",
+  "plugins.not_loaded_yet": "ยังไม่ได้โหลด",
+  "plugins.remove": "ลบ",
+  "plugins.scope_global": "ทั่วไป",
+  "plugins.scope_project": "โปรเจกต์",
+  "plugins.setup": "ตั้งค่า",
+  "plugins.suggested": "Plugins ที่แนะนำ",
+  "plugins.suggested_heading": "Plugins ที่แนะนำ",
+  "plugins.title": "OpenCode plugins",
+  "providers.api_key_label": "API key",
+  "providers.api_key_required": "ต้องใส่ API key",
+  "providers.auth_failed": "การยืนยันตัวตนล้มเหลว",
+  "providers.connect_failed": "เชื่อมต่อผู้ให้บริการไม่สำเร็จ",
+  "providers.disabled_in_config_suffix": "และปิดใช้งานใน OpenCode config แล้ว",
+  "providers.disconnect_failed": "ตัดการเชื่อมต่อผู้ให้บริการไม่สำเร็จ",
+  "providers.disconnected_prefix": "ตัดการเชื่อมต่อแล้ว",
+  "providers.load_failed": "โหลดผู้ให้บริการไม่สำเร็จ",
+  "providers.no_oauth_prefix": "ไม่มีขั้นตอน OAuth สำหรับ",
+  "providers.no_providers_available": "ไม่มีผู้ให้บริการที่ใช้ได้",
+  "providers.not_connected": "ไม่ได้เชื่อมต่อกับเซิร์ฟเวอร์",
+  "providers.not_oauth_flow_prefix": "วิธีการยืนยันตัวตนที่เลือกไม่ใช่ OAuth flow สำหรับ",
+  "providers.oauth_failed": "ดำเนินการ OAuth ไม่สำเร็จ",
+  "providers.oauth_method_required": "ต้องใช้วิธี OAuth",
+  "providers.provider_error": "ข้อผิดพลาดของผู้ให้บริการ ({provider})",
+  "providers.provider_id_required": "ต้องใส่ Provider ID",
+  "providers.rate_limit_exceeded": "เกินขีดจำกัดอัตราการใช้งาน",
+  "providers.removal_unsupported": "Client นี้ไม่รองรับการลบการยืนยันตัวตนของผู้ให้บริการ",
+  "providers.request_failed": "คำขอล้มเหลว",
+  "providers.save_api_key_failed": "บันทึก API key ไม่สำเร็จ",
+  "providers.still_connected_suffix": " แต่ worker ยังรายงานว่าเชื่อมต่ออยู่ ล้าง API key หรือข้อมูล OAuth ที่เหลือแล้วรีสตาร์ท worker เพื่อตัดการเชื่อมต่อทั้งหมด",
+  "providers.unknown_provider": "ผู้ให้บริการที่ไม่รู้จัก",
+  "providers.use_api_key_suffix": "ใช้ API key แทน",
+  "question_modal.custom_answer_label": "หรือพิมพ์คำตอบเอง",
+  "question_modal.custom_answer_placeholder": "พิมพ์คำตอบที่นี่...",
+  "question_modal.question_counter": "คำถามที่ {current} จาก {total}",
+  "session.allow_for_session": "อนุญาตตลอดเซสชัน",
+  "session.allow_once": "อนุญาตครั้งเดียว",
+  "session.cmd_current_workspace": "พื้นที่ทำงานปัจจุบัน",
+  "session.cmd_new_session_detail": "เริ่มงานใหม่ในพื้นที่ทำงานปัจจุบัน",
+  "session.cmd_new_session_meta": "สร้าง",
+  "session.cmd_new_session_title": "สร้างเซสชันใหม่",
+  "session.cmd_sessions_detail": "{count} เซสชันที่ใช้ได้ข้ามพื้นที่ทำงาน",
+  "session.cmd_sessions_meta": "ข้าม",
+  "session.cmd_sessions_title": "ค้นหาเซสชัน",
+  "session.cmd_switch": "สลับ",
+  "session.create_or_connect_workspace": "สร้างหรือเชื่อมต่อพื้นที่ทำงาน",
+  "session.default_agent": "Agent เริ่มต้น",
+  "session.default_title": "เซสชันใหม่",
+  "session.delete": "ลบ",
+  "session.delete_named_session_message": "การดำเนินการนี้จะลบ \"{title}\" และข้อความทั้งหมดอย่างถาวร",
+  "session.delete_session_generic": "การดำเนินการนี้จะลบเซสชันที่เลือกและข้อความทั้งหมดอย่างถาวร",
+  "session.delete_session_title": "ลบเซสชัน?",
+  "session.deleting": "กำลังลบ...",
+  "session.deny": "ปฏิเสธ",
+  "session.details": "รายละเอียด",
+  "session.details_label": "รายละเอียด",
+  "session.doom_loop_label": "Doom Loop",
+  "session.doom_loop_message": "OpenCode ตรวจพบการเรียกเครื่องมือซ้ำด้วยข้อมูลเดิมและถามว่าควรดำเนินการต่อหลังจากล้มเหลวซ้ำ",
+  "session.doom_loop_note": "ปฏิเสธเพื่อหยุดลูป หรืออนุญาตหากต้องการให้ agent ลองต่อ",
+  "session.doom_loop_repeated_call_label": "การเรียกซ้ำ",
+  "session.doom_loop_repeated_tool_call": "การเรียกเครื่องมือซ้ำ",
+  "session.doom_loop_title": "ตรวจพบ Doom Loop",
+  "session.doom_loop_tool_label": "เครื่องมือ",
+  "session.export_already_running": "การส่งออกกำลังทำงานอยู่",
+  "session.export_desktop_only": "การส่งออกใช้งานได้เฉพาะในแอปเดสก์ท็อป",
+  "session.export_desktop_only_local": "การส่งออกใช้งานได้สำหรับ local workers ในแอปเดสก์ท็อป",
+  "session.export_local_only": "การส่งออกรองรับเฉพาะ local workers",
+  "session.loading_detail": "กำลังดึงข้อความล่าสุดสำหรับงานนี้",
+  "session.model": "โมเดล",
+  "session.new_task": "งานใหม่",
+  "session.open": "เปิด",
+  "session.palette_hint_navigate": "ใช้ปุ่มลูกศรเพื่อนำทาง",
+  "session.palette_hint_run": "Enter เพื่อรัน · Esc เพื่อปิด",
+  "session.palette_placeholder_actions": "ค้นหาการดำเนินการ",
+  "session.palette_placeholder_sessions": "ค้นหาตามชื่อเซสชันหรือพื้นที่ทำงาน",
+  "session.palette_title_actions": "การดำเนินการด่วน",
+  "session.palette_title_sessions": "ค้นหาเซสชัน",
+  "session.permission_detail_command": "คำสั่ง",
+  "session.permission_detail_cwd": "ไดเรกทอรีทำงาน",
+  "session.permission_detail_description": "คำอธิบาย",
+  "session.permission_detail_diff": "ส่วนต่าง",
+  "session.permission_detail_file": "ไฟล์",
+  "session.permission_detail_files": "ไฟล์",
+  "session.permission_detail_agent": "เอเจนต์",
+  "session.permission_detail_parent_directory": "ไดเรกทอรีหลัก",
+  "session.permission_detail_path": "พาธ",
+  "session.permission_detail_query": "คำค้นหา",
+  "session.permission_detail_target": "เป้าหมาย",
+  "session.permission_detail_tool": "เครื่องมือ",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "แก้ไขไฟล์",
+  "session.permission_kind_external_directory": "ไดเรกทอรีภายนอก",
+  "session.permission_kind_question": "คำถาม",
+  "session.permission_kind_read": "อ่านไฟล์",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "งานย่อย",
+  "session.permission_kind_todowrite": "เขียนรายการงาน",
+  "session.permission_label": "การอนุญาต",
+  "session.permission_message": "OpenCode กำลังขออนุญาตเพื่อดำเนินการต่อ",
+  "session.permission_message_bash": "ตรวจสอบขอบเขตคำสั่งก่อนอนุญาตให้ OpenCode ทำต่อ",
+  "session.permission_message_edit": "ตรวจสอบไฟล์และส่วนต่างก่อนอนุญาตให้ OpenCode แก้ไข",
+  "session.permission_message_external_directory": "ตรวจสอบโฟลเดอร์ก่อนอนุญาตให้เข้าถึงนอก workspace",
+  "session.permission_message_read": "ตรวจสอบขอบเขตไฟล์ที่ร้องขอก่อนอนุญาตให้เข้าถึง",
+  "session.permission_message_task": "ตรวจสอบงานย่อยที่ร้องขอก่อนอนุญาตให้เริ่ม",
+  "session.permission_metadata_unavailable": "ไม่สามารถแสดงเมตาดาต้าได้",
+  "session.permission_review_label": "ตรวจสอบ",
+  "session.permission_scope_empty": "ไม่มีขอบเขตเฉพาะ",
+  "session.permission_decision_hint": "อนุญาตครั้งเดียวสำหรับคำขอนี้ หรืออนุญาตตลอดเซสชันเมื่อคุณเชื่อถือขอบเขตนี้",
+  "session.permission_title_bash": "เรียกใช้คำสั่ง shell?",
+  "session.permission_title_edit": "แก้ไขไฟล์?",
+  "session.permission_title_external_directory": "เข้าถึงโฟลเดอร์ภายนอก?",
+  "session.permission_title_generic": "อนุมัติ {permission}?",
+  "session.permission_title_read": "อ่านไฟล์?",
+  "session.permission_title_task": "เริ่มงานย่อย?",
+  "session.redo_aria_label": "ทำซ้ำข้อความที่ย้อนกลับ",
+  "session.redo_label": "ทำซ้ำ",
+  "session.redo_title": "ทำซ้ำข้อความที่ย้อนกลับ",
+  "session.rename_description": "อัปเดตชื่อสำหรับเซสชันนี้",
+  "session.rename_label": "ชื่อเซสชัน",
+  "session.rename_placeholder": "ใส่ชื่อใหม่",
+  "session.rename_title": "เปลี่ยนชื่อเซสชัน",
+  "session.resize_workspace_column": "ปรับขนาดคอลัมน์พื้นที่ทำงาน",
+  "session.revert_label": "ย้อนกลับ",
+  "session.scope_label": "ขอบเขต",
+  "session.share_collaborator_hint": "การเข้าถึงระยะไกลปกติเมื่อไม่ต้องการสิทธิ์ของเจ้าของ",
+  "session.share_collaborator_host_hint": "การเข้าถึงระยะไกลปกติสำหรับ host นี้โดยไม่ต้องใช้สิทธิ์ของเจ้าของ",
+  "session.share_collaborator_label": "โทเค็นผู้ร่วมงาน",
+  "session.share_connected_with_hint": "พื้นที่ทำงานนี้เชื่อมต่ออยู่ด้วยรหัสผ่านนี้",
+  "session.share_desktop_app_required": "ต้องใช้แอปเดสก์ท็อป",
+  "session.share_local_host_not_ready": "OpenWork host ภายในเครื่องยังไม่พร้อม",
+  "session.share_missing_host_url": "ไม่พบ URL ของ OpenWork host",
+  "session.share_missing_token": "ไม่พบโทเค็น OpenWork",
+  "session.share_note_direct_runtime": "Engine runtime ถูกตั้งเป็น Direct การสลับ local workers อาจรีสตาร์ท host และตัดการเชื่อมต่อ clients โทเค็นอาจเปลี่ยนหลังรีสตาร์ท",
+  "session.share_opencode_base_url": "URL ฐาน OpenCode",
+  "session.share_openwork_workers_only": "ลิงก์บริการแชร์ใช้ได้สำหรับ OpenWork workers",
+  "session.share_owner_permission_hint": "ใช้เมื่อ remote client ต้องตอบคำขออนุญาต",
+  "session.share_password": "รหัสผ่าน",
+  "session.share_select_workspace": "เลือกพื้นที่ทำงานก่อน",
+  "session.share_set_token_hint": "ตั้งโทเค็นในการตั้งค่าพื้นที่ทำงาน",
+  "session.share_starting_server": "กำลังเริ่มเซิร์ฟเวอร์...",
+  "session.share_worker_url": "URL ของ Worker",
+  "session.share_worker_url_phones_hint": "ใช้บนโทรศัพท์หรือแล็ปท็อปที่เชื่อมต่อกับ worker นี้",
+  "session.share_worker_url_resolving_hint": "URL ของ Worker กำลัง resolve; แสดง host URL เป็นตัวสำรอง",
+  "session.todo_progress": "{completed} จาก {total} งานเสร็จแล้ว",
+  "session.undo_label": "ย้อนกลับ",
+  "session.undo_title": "เลิกทำข้อความล่าสุด",
+  "session.workspace_fallback": "พื้นที่ทำงาน",
+  "settings.api_keys_info": "API key ถูกเก็บไว้ในเครื่องโดย OpenCode ผู้ให้บริการที่ใช้ environment ต้องเปลี่ยนในสภาพแวดล้อม worker แล้วรีโหลด",
+  "settings.appearance_hint": "ตามระบบหรือบังคับโหมดสว่าง/มืด",
+  "settings.appearance_title": "ธีม",
+  "settings.audit_log_title": "บันทึกการตรวจสอบ",
+  "settings.auto_compact": "บีบอัดบริบทอัตโนมัติ",
+  "settings.auto_compact_desc": "ควบคุม compaction.auto ของ OpenCode สำหรับพื้นที่ทำงานนี้ รีโหลด engine หลังเปลี่ยน",
+  "settings.auto_update_desc": "ดาวน์โหลดอัปเดตอัตโนมัติ (จะถามก่อนติดตั้ง)",
+  "settings.auto_update_title": "อัปเดตอัตโนมัติ",
+  "settings.background_checks_desc": "OpenWork ตรวจสอบเสมอตอนเปิดแอป ตรวจสอบเพิ่มอีกวันละครั้ง",
+  "settings.background_checks_title": "ตรวจสอบในพื้นหลัง",
+  "settings.cache_repair_requires_desktop": "การซ่อมแซมแคชต้องใช้แอปเดสก์ท็อป",
+  "settings.cap_browser_tools": "เครื่องมือเบราว์เซอร์: {value}",
+  "settings.cap_commands": "คำสั่ง: {value}",
+  "settings.cap_config": "Config: {value}",
+  "settings.cap_file_tools": "เครื่องมือไฟล์: {value}",
+  "settings.cap_inbox_off": "inbox ปิด",
+  "settings.cap_inbox_on": "inbox เปิด",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "outbox ปิด",
+  "settings.cap_outbox_on": "outbox เปิด",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "อ่าน",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "เขียน",
+  "settings.capabilities_title": "ความสามารถของ OpenWork server",
+  "settings.capabilities_unavailable": "ความสามารถไม่พร้อมใช้งาน เชื่อมต่อด้วย client token",
+  "settings.change": "เปลี่ยน",
+  "settings.choose": "เลือก",
+  "settings.clear": "ล้าง",
+  "settings.configure": "ตั้งค่า",
+  "settings.connect_provider": "เชื่อมต่อผู้ให้บริการ",
+  "settings.connection": "การเชื่อมต่อ",
+  "settings.connection_failed": "เชื่อมต่อล้มเหลว",
+  "settings.connection_title": "การเชื่อมต่อ",
+  "settings.copied_debug_report": "คัดลอก JSON รายงานรันไทม์แล้ว",
+  "settings.copy_json": "คัดลอก JSON",
+  "settings.custom_binary_hint": "ใช้เพื่อชี้ OpenWork ไปที่ OpenCode build ภายในเครื่อง",
+  "settings.custom_binary_label": "OpenCode binary กำหนดเอง",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_desktop_app": "แอปเดสก์ท็อป: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "OpenWork server: {version}",
+  "settings.deeplink_hint": "รับ openwork://, openwork-dev:// หรือ URL https://share.openworklabs.com/b/... ที่รองรับ",
+  "settings.delete_containers": "กำลังลบ containers...",
+  "settings.delete_local_config": "กำลังลบสถานะภายในเครื่อง...",
+  "settings.dev_mode_badge": "โหมดนักพัฒนา",
+  "settings.developer": "นักพัฒนา",
+  "settings.developer_mode_desc": "เปิดเครื่องมือดีบัก การวินิจฉัย และแท็บนักพัฒนา",
+  "settings.developer_mode_title": "โหมดนักพัฒนา",
+  "settings.developer_panel_disabled": "ปิดแผงนักพัฒนาแล้ว",
+  "settings.developer_panel_enabled": "เปิดแผงนักพัฒนาแล้ว",
+  "settings.diag_approval": "การอนุมัติ: {mode} ({ms}ms)",
+  "settings.diag_config_path": "เส้นทาง config: {path}",
+  "settings.diag_default": "ค่าเริ่มต้น",
+  "settings.diag_host_token_source": "แหล่ง host token: {source}",
+  "settings.diag_opencode_binary": "OpenCode binary: {binary}",
+  "settings.diag_read_only": "อ่านอย่างเดียว: {value}",
+  "settings.diag_runtime_workspace": "Runtime workspace: {id}",
+  "settings.diag_selected_workspace": "พื้นที่ทำงานที่เลือก: {id}",
+  "settings.diag_started": "เริ่ม: {time}",
+  "settings.diag_token_source": "แหล่ง token: {source}",
+  "settings.diag_workspaces": "พื้นที่ทำงาน: {count}",
+  "settings.diagnostics_unavailable": "ข้อมูลวินิจฉัยไม่พร้อมใช้งาน",
+  "settings.disable_developer_mode": "ปิดโหมดนักพัฒนา",
+  "settings.disabled": "ปิดใช้งาน",
+  "settings.disconnect": "ตัดการเชื่อมต่อ",
+  "settings.disconnect_server": "ตัดการเชื่อมต่อเซิร์ฟเวอร์",
+  "settings.disconnecting": "กำลังตัดการเชื่อมต่อ...",
+  "settings.docker_containers_desc": "บังคับลบ Docker containers ที่ OpenWork เปิดใช้",
+  "settings.docker_containers_title": "Docker containers ของ OpenWork",
+  "settings.docker_requires_desktop": "การล้าง Docker ต้องใช้แอปเดสก์ท็อป",
+  "settings.done": "เสร็จสิ้น",
+  "settings.enable_developer_mode": "เปิดโหมดนักพัฒนา",
+  "settings.enable_exa": "เปิด Exa web search",
+  "settings.enable_exa_desc": "ใช้งานเมื่อ OpenWork Orchestrator เปิด OpenCode",
+  "settings.engine_bundled": "แบบรวม (แนะนำ)",
+  "settings.engine_bundled_hint": "Engine แบบรวมเป็นตัวเลือกที่เสถียรที่สุด ใช้ System",
+  "settings.engine_custom_binary": "Binary กำหนดเอง",
+  "settings.engine_desc": "เลือกวิธีรัน OpenCode ภายในเครื่อง",
+  "settings.engine_source": "แหล่งที่มาของ engine",
+  "settings.engine_source_debug": "แหล่ง engine",
+  "settings.engine_system_path": "ติดตั้งในระบบ (PATH)",
+  "settings.engine_title": "Engine",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "รีสตาร์ท OpenCode หรือ orchestrator หลังเปลี่ยนการตั้งค่านี้",
+  "settings.export": "ส่งออก",
+  "settings.exported_debug_report": "ส่งออก JSON รายงานรันไทม์แล้ว",
+  "settings.feedback_badge": "เราอ่านทุกข้อความ",
+  "settings.feedback_desc": "บอกสิ่งที่ชอบและสิ่งที่ยังไม่ดีพอ ความคิดเห็นส่งตรงถึงทีมและช่วยให้เรารู้ว่าจะพัฒนาอะไรต่อไป",
+  "settings.feedback_title": "ช่วยพัฒนา OpenWork",
+  "settings.group_global": "ทั่วไป",
+  "settings.group_workspace": "พื้นที่ทำงาน",
+  "settings.hide_titlebar": "ซ่อนแถบชื่อหน้าต่าง",
+  "settings.hide_titlebar_desc": "ซ่อนแถบชื่อหน้าต่าง เหมาะสำหรับ tiling window",
+  "settings.join_discord": "เข้าร่วม Discord",
+  "settings.language": "ภาษา",
+  "settings.language.description": "เลือกภาษาที่คุณต้องการ",
+  "settings.last_error": "ข้อผิดพลาดล่าสุด",
+  "settings.last_stderr": "Stderr ล่าสุด",
+  "settings.last_stdout": "Stdout ล่าสุด",
+  "settings.loading_providers": "กำลังโหลดผู้ให้บริการ...",
+  "settings.managed_by_env": "จัดการโดยตัวแปรสภาพแวดล้อม",
+  "settings.model": "โมเดล",
+  "settings.model_behavior": "พฤติกรรมโมเดล",
+  "settings.model_behavior_desc": "เปิดตัวเลือกโมเดลเริ่มต้นเพื่อเลือก reasoning profiles เมื่อมีให้ใช้",
+  "settings.model_section_desc": "เลือกโมเดลแชทเริ่มต้นและตรวจสอบวิธีการใช้เหตุผล",
+  "settings.model_title": "โมเดล",
+  "settings.no_active_workspace": "ไม่มีพื้นที่ทำงานภายในเครื่องที่ใช้งาน",
+  "settings.no_audit_entries": "ยังไม่มีรายการตรวจสอบ",
+  "settings.no_custom_path_set": "ยังไม่ได้ตั้งเส้นทางกำหนดเอง",
+  "settings.nuke_hint": "ใช้เฉพาะเมื่อต้องการรีเซ็ตแอปเดสก์ท็อปและสถานะ OpenCode runtime ทั้งหมด",
+  "settings.off": "ปิด",
+  "settings.on": "เปิด",
+  "settings.open_deeplink_action": "กำลังเปิด...",
+  "settings.open_deeplink_button": "ซ่อน",
+  "settings.open_deeplink_desc": "วาง deeplink หรือ URL แชร์ของ OpenWork เพื่อเปิด",
+  "settings.open_deeplink_title": "เปิด Deeplink",
+  "settings.opencode_cache": "แคช OpenCode",
+  "settings.opencode_cache_description": "ซ่อมแซมข้อมูลแคชที่ใช้เริ่ม engine ทำได้อย่างปลอดภัย",
+  "settings.opencode_engine_desc": "รันไทม์ภายในเครื่องสำหรับ agents, tools และผู้ให้บริการโมเดล",
+  "settings.opencode_engine_label": "OpenCode engine",
+  "settings.opencode_engine_sidecar_desc": "Sidecar สำหรับรันภายในเครื่อง",
+  "settings.opencode_sdk_desc": "ข้อมูลวินิจฉัยการเชื่อมต่อ UI",
+  "settings.opencode_sdk_title": "OpenCode engine",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "เปิด deeplink",
+  "settings.openwork_config_sidecar_desc": "Sidecar สำหรับ config และ approvals",
+  "settings.openwork_diagnostics_title": "ข้อมูลวินิจฉัย OpenWork server",
+  "settings.openwork_server_desc": "แผงควบคุมเซสชันสำหรับซิงค์แอป, workers และระยะไกล",
+  "settings.openwork_server_label": "OpenWork server",
+  "settings.pending_permissions": "สิทธิ์ที่รอดำเนินการ",
+  "settings.production_mode_badge": "โหมด Production",
+  "settings.provider_default_desc": "ใช้พฤติกรรม reasoning ค่าเริ่มต้นของโมเดล",
+  "settings.provider_default_label": "ค่าเริ่มต้นของผู้ให้บริการ",
+  "settings.provider_source_config": "Config",
+  "settings.provider_source_custom": "กำหนดเอง",
+  "settings.provider_source_env": "Environment",
+  "settings.providers_desc": "เชื่อมต่อบริการสำหรับโมเดลและเครื่องมือ",
+  "settings.providers_title": "ผู้ให้บริการ",
+  "settings.quit_hint": "OpenWork จะปิดทันทีหลังล้างข้อมูลเพื่อให้การเปิดครั้งถัดไปเริ่มจากสถานะว่างสำหรับโหมดนี้",
+  "settings.recent_events": "เหตุการณ์ล่าสุด",
+  "settings.reconnect_failed": "เชื่อมต่อใหม่ไม่สำเร็จ ตรวจสอบ URL/token ของเซิร์ฟเวอร์แล้วลองอีกครั้ง",
+  "settings.reconnect_server": "กำลังเชื่อมต่อใหม่...",
+  "settings.reconnect_server_failed": "เชื่อมต่อ OpenWork server ใหม่ไม่สำเร็จ",
+  "settings.reconnected": "เชื่อมต่อ OpenWork server ใหม่แล้ว",
+  "settings.reconnecting": "กำลังเชื่อมต่อใหม่...",
+  "settings.removing_containers": "กำลังลบ containers...",
+  "settings.removing_local_state": "กำลังลบสถานะภายในเครื่อง...",
+  "settings.repair_cache": "ซ่อมแซมแคช",
+  "settings.repairing_cache": "กำลังซ่อมแซมแคช",
+  "settings.report_issue": "รายงานปัญหา",
+  "settings.reset": "รีเซ็ต",
+  "settings.reset_app_data": "รีเซ็ตข้อมูลแอป",
+  "settings.reset_app_data_description": "รุนแรงกว่า ล้างแคชและข้อมูลแอปของ OpenWork",
+  "settings.reset_app_data_title": "รีเซ็ตข้อมูลแอป",
+  "settings.reset_app_data_warning": "ล้างแคชและข้อมูลแอป OpenWork บนอุปกรณ์นี้",
+  "settings.reset_button": "รีเซ็ต",
+  "settings.reset_cancel": "ยกเลิก",
+  "settings.reset_config_defaults": "กำลังรีเซ็ต...",
+  "settings.reset_confirm_button": "รีเซ็ตและรีสตาร์ท",
+  "settings.reset_confirmation_hint": "พิมพ์ {resetWord} เพื่อยืนยัน OpenWork จะรีสตาร์ท",
+  "settings.reset_confirmation_label": "การยืนยัน",
+  "settings.reset_confirmation_placeholder": "พิมพ์ RESET",
+  "settings.reset_onboarding": "รีเซ็ต onboarding",
+  "settings.reset_onboarding_description": "ล้างค่าตั้งค่า OpenWork และรีสตาร์ทแอป",
+  "settings.reset_onboarding_title": "รีเซ็ต onboarding",
+  "settings.reset_onboarding_warning": "ล้างค่าตั้งค่า OpenWork และตัวบ่งชี้ onboarding ของพื้นที่ทำงาน",
+  "settings.reset_openwork_desc_dev": "เมื่อเปิดโหมดนักพัฒนา จะล้างเฉพาะ OpenCode dev state ภายใน openwork-dev-data",
+  "settings.reset_openwork_desc_prod": "เมื่อเปิดโหมดนักพัฒนา จะล้างเฉพาะ OpenCode dev state ภายใน openwork-dev-data",
+  "settings.reset_openwork_title": "รีเซ็ตสถานะ OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "ต้องพิมพ์ RESET และจะรีสตาร์ทแอป",
+  "settings.reset_startup": "รีเซ็ตโหมดเริ่มต้น",
+  "settings.reset_startup_pref": "รีเซ็ตค่าเริ่มต้นการเปิดใช้งาน",
+  "settings.reset_stop_active_runs": "หยุดงานที่กำลังทำงานก่อนรีเซ็ต",
+  "settings.resetting": "กำลังรีเซ็ต...",
+  "settings.restart_blocked_message": "OpenWork ต้องรีสตาร์ทเพื่อเสร็จสิ้นการอัปเดตนี้ เพื่อไม่ให้รบกวนงานปัจจุบัน การติดตั้งจะหยุดชั่วคราวจนกว่างานที่กำลังทำงานจะเสร็จหรือคุณหยุดงาน",
+  "settings.restart_failed": "รีสตาร์ทล้มเหลว ตรวจสอบ logs และลองอีกครั้ง",
+  "settings.restart_opencode": "กำลังรีสตาร์ท...",
+  "settings.restart_openwork_server": "กำลังรีสตาร์ท...",
+  "settings.restart_server_failed": "รีสตาร์ท local server ไม่สำเร็จ",
+  "settings.restarted": "รีสตาร์ท local server แล้ว",
+  "settings.restarting": "กำลังรีสตาร์ท...",
+  "settings.reveal_config": "เปิดไฟล์ config",
+  "settings.reveal_config_requires_desktop": "การเปิดไฟล์ config ต้องใช้แอปเดสก์ท็อป",
+  "settings.run_sandbox_probe": "กำลังรัน probe...",
+  "settings.running_probe": "กำลังรัน probe...",
+  "settings.runtime_debug_desc": "สแนปช็อตข้อมูลวินิจฉัยที่อ่านได้พร้อมส่งออกด้วยคลิกเดียว",
+  "settings.runtime_debug_title": "รายงานดีบักรันไทม์",
+  "settings.runtime_desc": "สถานะ engine ภายในเครื่องและ OpenWork server",
+  "settings.runtime_title": "รันไทม์",
+  "settings.sandbox_error": "ข้อผิดพลาด",
+  "settings.sandbox_export_hint": "ใช้ส่งออกในรายงานดีบักรันไทม์ด้านบนเพื่อ",
+  "settings.sandbox_probe_desc": "รันการตรวจสอบ Docker sandbox แบบชั่วคราวและ",
+  "settings.sandbox_probe_success": "Sandbox probe สำเร็จ ส่งออกรายงานดีบักสำหรับ support",
+  "settings.sandbox_probe_title": "Sandbox probe",
+  "settings.sandbox_ready": "พร้อม",
+  "settings.sandbox_requires_desktop": "Sandbox probe ต้องใช้แอปเดสก์ท็อป",
+  "settings.sandbox_result": "ผลลัพธ์: {status}",
+  "settings.sandbox_run_id": "Run ID: {id}",
+  "settings.sandbox_stop_runs_hint": "หยุดงานที่กำลังทำงานก่อน probe",
+  "settings.search_models": "ค้นหาโมเดล…",
+  "settings.send_feedback": "ส่งความคิดเห็น",
+  "settings.show_model_reasoning": "แสดงการใช้เหตุผลของโมเดล",
+  "settings.show_model_reasoning_desc": "ขยาย reasoning traces ใน UI เมื่อโมเดลรองรับ",
+  "settings.showing_models": "แสดง {count} จาก {total}",
+  "settings.startup": "การเริ่มต้น",
+  "settings.startup_remote_warning": "ค่าเริ่มต้นการเปิดใช้งานเป็นระยะไกล การตั้งค่า engine",
+  "settings.startup_reset_hint": "ล้างค่าที่บันทึกไว้และแสดงหน้าจอเชื่อมต่อ",
+  "settings.startup_title": "การเริ่มต้น",
+  "settings.stop_local_server": "หยุด local server",
+  "settings.stop_runs_before_cleanup": "หยุดงานที่กำลังทำงานก่อนล้างข้อมูล",
+  "settings.stop_runs_before_reset_config": "หยุดงานที่กำลังทำงานก่อนรีเซ็ต config",
+  "settings.stop_runs_to_reset": "หยุดงานที่กำลังทำงานเพื่อรีเซ็ต",
+  "settings.switch": "สลับ",
+  "settings.tab_advanced": "ขั้นสูง",
+  "settings.tab_appearance": "ธีม",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "ดีบัก",
+  "settings.tab_description_advanced": "ตรวจสอบสถานะรันไทม์ การเชื่อมต่อ และตัวควบคุมสำหรับนักพัฒนา",
+  "settings.tab_description_appearance": "ปรับรูปลักษณ์ OpenWork ทั้งเดสก์ท็อป ธีมระบบ และ app chrome",
+  "settings.tab_description_debug": "ตรวจสอบข้อมูลวินิจฉัยรันไทม์ logs และเครื่องมือดีบักระดับต่ำ",
+  "settings.tab_description_den": "จัดการการเชื่อมต่อ OpenWork Cloud, workers ที่โฮสต์ และการเข้าถึงพื้นที่ทำงาน",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "จัดการแอป MCP และ OpenCode plugins สำหรับพื้นที่ทำงานนี้",
+  "settings.tab_description_general": "เชื่อมต่อผู้ให้บริการ เลือกโมเดลเริ่มต้น อนุญาตโฟลเดอร์ และควบคุมพื้นที่ทำงาน OpenWork ที่เลือกพร้อมการเชื่อมต่อรันไทม์",
+  "settings.tab_description_recovery": "ซ่อมแซมสถานะ migration รีเซ็ตค่าเริ่มต้นพื้นที่ทำงาน และกู้คืนการตั้งค่าภายในเครื่อง",
+  "settings.tab_description_skills": "เรียกดู แก้ไข และติดตั้ง skills โดยไม่ต้องออกจากการตั้งค่า",
+  "settings.tab_description_updates": "อัปเดตแอปให้เป็นปัจจุบันด้วยการตรวจสอบในพื้นหลังและตัวควบคุมการติดตั้ง",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "ส่วนขยาย",
+  "settings.tab_general": "การตั้งค่า",
+  "settings.tab_recovery": "การกู้คืน",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "การอัปเดต",
+  "settings.theme_dark": "มืด",
+  "settings.theme_light": "สว่าง",
+  "settings.theme_system": "ตามระบบ",
+  "settings.theme_system_hint": "โหมดตามระบบจะตามค่าตั้งค่า OS ของคุณโดยอัตโนมัติ",
+  "settings.update": "อัปเดต",
+  "settings.update_available": "มีอัปเดต: v",
+  "settings.update_available_version": "มีอัปเดต: v{version}",
+  "settings.update_check_button": "ตรวจสอบ",
+  "settings.update_check_failed": "ตรวจสอบอัปเดตไม่สำเร็จ",
+  "settings.update_checking": "กำลังตรวจสอบ...",
+  "settings.update_download_button": "ดาวน์โหลด",
+  "settings.update_downloading": "กำลังดาวน์โหลด...",
+  "settings.update_install_button": "ติดตั้งและรีสตาร์ท",
+  "settings.update_last_checked": "ตรวจสอบล่าสุด {time}",
+  "settings.update_published": "เผยแพร่ {date}",
+  "settings.update_ready": "พร้อมติดตั้ง: v",
+  "settings.update_ready_version": "พร้อมติดตั้ง: v{version}",
+  "settings.update_uptodate": "เป็นเวอร์ชันล่าสุดแล้ว",
+  "settings.updates": "การอัปเดต",
+  "settings.updates_desc": "อัปเดต OpenWork ให้เป็นเวอร์ชันล่าสุด",
+  "settings.updates_desktop_only": "การอัปเดตใช้งานได้เฉพาะในแอปเดสก์ท็อป",
+  "settings.updates_not_supported": "ไม่รองรับการอัปเดตในสภาพแวดล้อมนี้",
+  "settings.updates_title": "การอัปเดต",
+  "settings.window_appearance_desc": "ปรับแต่งรูปลักษณ์หน้าต่าง",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "การตั้งค่าพื้นที่ทำงาน",
+  "settings.workspace_debug_events_label": "เหตุการณ์ดีบักพื้นที่ทำงาน",
+  "share.back_hint": "กลับไปตัวเลือกการแชร์",
+  "share.chooser_subtitle": "เลือกวิธีแชร์พื้นที่ทำงานนี้",
+  "share.close_hint": "ปิด",
+  "share.option_access_desc": "แสดงรายละเอียดการเชื่อมต่อสำหรับเข้าถึงพื้นที่ทำงานนี้จากเครื่องอื่น",
+  "share.option_access_title": "เข้าถึงพื้นที่ทำงานระยะไกล",
+  "share.subtitle_access": "แสดงรายละเอียดการเชื่อมต่อสำหรับเข้าถึงพื้นที่ทำงานนี้จากเครื่องอื่น",
+  "share.title": "แชร์พื้นที่ทำงาน",
+  "share.view_access": "เข้าถึงพื้นที่ทำงานระยะไกล",
+  "share.workspace_fallback": "พื้นที่ทำงาน",
+  "share_skill_destination.add_to_workspace": "เพิ่มไปยังพื้นที่ทำงาน",
+  "share_skill_destination.adding": "กำลังเพิ่ม...",
+  "share_skill_destination.connect_remote": "เชื่อมต่อพื้นที่ทำงานระยะไกล",
+  "share_skill_destination.connect_remote_hint": "เชื่อมต่อ OpenWork host แล้วเลือกจากรายการเพื่อนำเข้า skill นี้",
+  "share_skill_destination.create_worker": "สร้างพื้นที่ทำงานใหม่",
+  "share_skill_destination.create_worker_hint": "เปิดขั้นตอนสร้างพื้นที่ทำงาน แล้วเพิ่ม skill หลังจากพื้นที่ทำงานใหม่พร้อม",
+  "share_skill_destination.current_badge": "ปัจจุบัน",
+  "share_skill_destination.existing_workers": "พื้นที่ทำงานที่มีอยู่",
+  "share_skill_destination.fallback_skill_name": "Skill ที่แชร์",
+  "share_skill_destination.local_badge": "ภายในเครื่อง",
+  "share_skill_destination.more_options": "ตัวเลือกเพิ่มเติม",
+  "share_skill_destination.no_workers": "ยังไม่มีพื้นที่ทำงานพร้อมใช้งาน สร้างใหม่หรือเชื่อมต่อพื้นที่ทำงานระยะไกลเพื่อติดตั้ง skill นี้",
+  "share_skill_destination.remote_badge": "ระยะไกล",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "เลือกแล้ว",
+  "share_skill_destination.selected_hint": "เลือกแล้ว ตรวจสอบปลายทางด้านล่าง แล้วยืนยัน",
+  "share_skill_destination.skill_label": "Skill ที่แชร์",
+  "share_skill_destination.subtitle": "เลือกพื้นที่ทำงานที่มีอยู่หรือสร้างใหม่ก่อนนำเข้า skill ที่แชร์",
+  "share_skill_destination.title": "Skill นี้ควรไปที่ไหน?",
+  "share_skill_destination.trigger_label": "ทริกเกอร์",
+  "sidebar.collapse": "ยุบ",
+  "sidebar.expand": "ขยาย",
+  "skills.add_custom_repo": "เพิ่ม GitHub repo กำหนดเอง",
+  "skills.add_git_repo": "เพิ่ม git repo",
+  "skills.add_openwork_hub": "เพิ่ม OpenWork Hub",
+  "skills.available_from_hub": "พร้อมใช้งานจาก Hub",
+  "skills.catalog_search_placeholder": "ค้นหา skills ที่ติดตั้ง, ทีม และ hub",
+  "skills.cloud_choose_org_detail": "ใช้แผง Cloud เพื่อเลือกองค์กรที่ใช้งาน แล้วรีเฟรชรายการนี้",
+  "skills.cloud_choose_org_hint": "เลือกองค์กรใน Settings → Cloud เพื่อโหลด skills ของทีม",
+  "skills.cloud_footer_label": "ทีม",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "ติดตั้ง {name} บน worker นี้แล้ว",
+  "skills.cloud_installing": "กำลังติดตั้ง {title}…",
+  "skills.cloud_installing_short": "กำลังติดตั้ง",
+  "skills.cloud_no_search_matches": "ไม่พบ skills ที่ตรงกับการค้นหา",
+  "skills.cloud_org_empty": "ยังไม่มี skills ขององค์กร",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "โหลด skills ขององค์กรไม่สำเร็จ",
+  "skills.cloud_refresh": "รีเฟรช skills ของทีม",
+  "skills.cloud_section_subtitle": "Skills ที่แชร์กับคุณผ่าน OpenWork Cloud — รวมถึง skill hub ของทีมที่คุณเข้าถึงได้",
+  "skills.cloud_section_title": "จากองค์กรของคุณ",
+  "skills.cloud_shared_org": "องค์กร",
+  "skills.cloud_shared_public": "สาธารณะ",
+  "skills.cloud_sign_in": "เข้าสู่ระบบ Cloud",
+  "skills.cloud_sign_in_hint": "เข้าสู่ระบบ OpenWork Cloud เพื่อเรียกดู skills ของทีมและองค์กร",
+  "skills.copy_link_failed": "คัดลอกลิงก์ไม่สำเร็จ",
+  "skills.create_in_chat": "สร้าง skill ในแชท",
+  "skills.desktop_required": "การจัดการ Skills ต้องใช้แอปเดสก์ท็อป",
+  "skills.enter_plugin_name": "ใส่ชื่อแพ็กเกจ plugin",
+  "skills.failed_load_active": "โหลด plugins ที่ใช้งานไม่สำเร็จ",
+  "skills.failed_load_opencode": "โหลด opencode.json ไม่สำเร็จ",
+  "skills.failed_parse_opencode": "แปลง opencode.json ไม่สำเร็จ",
+  "skills.failed_to_load": "โหลด skills ไม่สำเร็จ",
+  "skills.failed_update_opencode": "อัปเดต opencode.json ไม่สำเร็จ",
+  "skills.filter_all": "ทั้งหมด",
+  "skills.filter_cloud": "ทีม",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "ติดตั้งแล้ว",
+  "skills.from_repo": "จาก {owner}/{repo}",
+  "skills.github_repo_hint": "ป้อน repo GitHub ในรูปแบบ owner/repo",
+  "skills.host_mode_only": "เฉพาะพื้นที่ทำงานภายในเครื่อง",
+  "skills.host_only_error": "การจัดการ Skills ต้องใช้พื้นที่ทำงานภายในเครื่องหรือ OpenWork server ที่เชื่อมต่อ",
+  "skills.hub_desc": "เรียกดู skills ที่แชร์จาก GitHub-backed hubs และเพิ่มลงใน worker นี้",
+  "skills.hub_label": "Hub",
+  "skills.import": "นำเข้า",
+  "skills.import_failed": "นำเข้าไม่สำเร็จ ({status})",
+  "skills.import_local": "นำเข้า skill ภายในเครื่อง",
+  "skills.import_local_skill": "นำเข้า skill ภายในเครื่อง",
+  "skills.imported": "นำเข้าแล้ว",
+  "skills.install": "ติดตั้ง",
+  "skills.install_failed": "ติดตั้ง skill ไม่สำเร็จ",
+  "skills.install_name_title": "ติดตั้ง {name}",
+  "skills.installed": "Skills ที่ติดตั้ง",
+  "skills.installed_desc": "Skills ที่ติดตั้งอยู่บน worker นี้ สามารถแก้ไขหรือแชร์ได้",
+  "skills.installed_status": "ติดตั้งแล้ว",
+  "skills.installing": "เพิ่ม skill",
+  "skills.installing_prefix": "กำลังติดตั้ง {name}…",
+  "skills.installing_skill_creator": "กำลังติดตั้ง skill creator...",
+  "skills.link_copied": "คัดลอกลิงก์แล้ว",
+  "skills.loading": "กำลังโหลด…",
+  "skills.no_description": "ยังไม่มีคำอธิบาย",
+  "skills.no_hub_repo_label": "ยังไม่ได้เลือก hub repo",
+  "skills.no_hub_repo_selected": "ไม่มี hub skills ที่ใช้ได้",
+  "skills.no_hub_skills": "ยังไม่ได้เลือก hub repo เพิ่ม GitHub repo เพื่อเรียกดู skills",
+  "skills.no_opencode_found": "ยังไม่พบ opencode.json เพิ่ม plugin เพื่อสร้าง",
+  "skills.no_opencode_workspace": "ยังไม่มี opencode.json ในพื้นที่ทำงานนี้",
+  "skills.no_skills": "ไม่พบ skills ใน `.opencode/skills`, `.claude/skills` หรือ `~/.agents/skills`",
+  "skills.no_skills_found": "ยังไม่พบ skills",
+  "skills.owner_label": "เจ้าของ",
+  "skills.owner_repo_required": "ต้องใส่เจ้าของและ repo",
+  "skills.pick_project_first": "เลือกโฟลเดอร์โปรเจกต์ก่อน",
+  "skills.pick_project_for_active": "เลือกโฟลเดอร์โปรเจกต์เพื่อโหลด plugins ที่ใช้งาน",
+  "skills.pick_project_for_plugins": "เลือกโฟลเดอร์โปรเจกต์เพื่อจัดการ plugins ของโปรเจกต์",
+  "skills.pick_workspace_first": "เลือกโฟลเดอร์พื้นที่ทำงานก่อน",
+  "skills.plugin_already_listed": "Plugin มีอยู่ใน opencode.json แล้ว",
+  "skills.plugin_management_host_only": "การจัดการ plugins ต้องใช้แอปเดสก์ท็อป",
+  "skills.plugins_host_only": "Plugins ใช้งานได้เฉพาะในแอปเดสก์ท็อป",
+  "skills.ref_label": "Ref (branch/tag/commit)",
+  "skills.refresh": "รีเฟรช",
+  "skills.refresh_hub": "รีเฟรช hub",
+  "skills.remove_saved_repo": "ลบ repo ที่บันทึก",
+  "skills.repo_label": "Repo",
+  "skills.reveal_failed": "เปิดโฟลเดอร์ skills ไม่สำเร็จ",
+  "skills.reveal_folder": "เปิดโฟลเดอร์ skills",
+  "skills.save_and_load": "บันทึกและโหลด",
+  "skills.select_skill_folder": "เลือกโฟลเดอร์ skill",
+  "skills.share_back": "กลับ",
+  "skills.share_chooser_subtitle": "บันทึกไปยังองค์กร OpenWork Cloud หรือเผยแพร่ลิงก์ติดตั้งสาธารณะ",
+  "skills.share_close": "ปิด",
+  "skills.share_copy_link": "คัดลอก",
+  "skills.share_done": "เสร็จสิ้น",
+  "skills.share_option_public_desc": "สร้างลิงก์ที่ทุกคนสามารถใช้ติดตั้ง skill นี้ได้",
+  "skills.share_option_public_title": "ลิงก์สาธารณะ",
+  "skills.share_option_team_desc": "เพิ่ม skill นี้ไปยังองค์กร OpenWork Cloud ที่ใช้งาน",
+  "skills.share_option_team_title": "แชร์กับทีม",
+  "skills.share_public_create": "สร้างลิงก์",
+  "skills.share_public_creating": "กำลังเผยแพร่…",
+  "skills.share_public_intro": "เผยแพร่ลิงก์สาธารณะ ทุกคนที่มี URL สามารถติดตั้ง skill นี้ได้",
+  "skills.share_public_regenerate": "สร้างลิงก์ใหม่",
+  "skills.share_publisher_label": "ผู้เผยแพร่",
+  "skills.share_subtitle_public": "ทุกคนที่มีลิงก์สามารถติดตั้ง skill นี้ได้",
+  "skills.share_subtitle_team": "จัดเก็บในองค์กรสำหรับเพื่อนร่วมทีม",
+  "skills.share_team_choose_org": "เลือกองค์กรใน Settings → Cloud ก่อนแชร์กับทีม",
+  "skills.share_team_hubs_loading": "กำลังโหลด hubs…",
+  "skills.share_team_org_fallback": "องค์กร Cloud ที่ใช้งาน",
+  "skills.share_team_sign_in": "เข้าสู่ระบบเพื่อแชร์กับทีม",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud จะเปิดในเบราว์เซอร์ กลับมาที่นี่หลังเข้าสู่ระบบ",
+  "skills.share_title": "แชร์ skill",
+  "skills.shown_count": "แสดง {count} รายการ",
+  "skills.skill_creator_already_installed": "ติดตั้ง skill creator แล้ว",
+  "skills.skill_creator_installed": "ติดตั้ง skill creator แล้ว",
+  "skills.skill_load_failed": "โหลด skill ไม่สำเร็จ",
+  "skills.source_label": "แหล่ง",
+  "skills.title": "Skills",
+  "skills.trigger_label": "ทริกเกอร์: {trigger}",
+  "skills.uninstall": "ถอนการติดตั้ง",
+  "skills.uninstall_failed": "ถอนการติดตั้ง skill ไม่สำเร็จ",
+  "skills.uninstall_title": "ถอนการติดตั้ง skill?",
+  "skills.uninstall_warning": "การดำเนินการนี้จะลบ skill `{name}` ออกจากพื้นที่ทำงานอย่างถาวร",
+  "skills.uninstalled": "ลบ skill แล้ว",
+  "skills.unknown_error": "ข้อผิดพลาดที่ไม่ทราบสาเหตุ",
+  "skills.worker_profile_desc": "Skills คือความสามารถหลักของ worker นี้ ค้นพบจาก Hub จัดการที่ติดตั้ง และสร้างใหม่ในแชทได้โดยตรง",
+  "status.back": "กลับไปหน้าจอก่อนหน้า",
+  "status.connected": "เชื่อมต่อแล้ว",
+  "status.connecting": "กำลังเชื่อมต่อ",
+  "status.creating_task": "กำลังสร้างงานใหม่",
+  "status.developer_mode": "โหมดนักพัฒนา",
+  "status.disconnected": "ตัดการเชื่อมต่อ",
+  "status.disconnected_hint": "เปิดการตั้งค่าเพื่อเชื่อมต่อใหม่",
+  "status.disconnected_label": "ตัดการเชื่อมต่อ",
+  "status.docs": "เอกสาร",
+  "status.feedback": "ข้อเสนอแนะ",
+  "status.limited_hint": "เชื่อมต่อใหม่เพื่อคืนค่าฟีเจอร์ OpenWork ทั้งหมด",
+  "status.limited_mcp_hint": "เชื่อมต่อ {count} MCP · เชื่อมต่อใหม่เพื่อฟีเจอร์ทั้งหมด",
+  "status.limited_mode": "โหมดจำกัด",
+  "status.loading_session": "กำลังโหลดเซสชัน",
+  "status.mcp_connected": "เชื่อมต่อ {count} MCP",
+  "status.open_docs": "เปิดเอกสาร",
+  "status.openwork_ready": "OpenWork พร้อม",
+  "status.providers_connected": "เชื่อมต่อ {count} ผู้ให้บริการ",
+  "status.ready_for_tasks": "พร้อมรับงานใหม่",
+  "status.running": "กำลังทำงาน",
+  "status.send_feedback": "ส่งข้อเสนอแนะ",
+  "status.settings": "การตั้งค่า",
+  "system.reload_body_agents": "OpenCode โหลด agent ตอนเริ่มต้น โหลด engine ใหม่เพื่อให้ agent ที่อัปเดตพร้อมใช้งาน",
+  "system.reload_body_commands": "OpenCode โหลดคำสั่งตอนเริ่มต้น โหลด engine ใหม่เพื่อให้คำสั่งที่อัปเดตพร้อมใช้งาน",
+  "system.reload_body_config": "OpenCode อ่าน opencode.json ตอนเริ่มต้น โหลด engine ใหม่เพื่อใช้การเปลี่ยนแปลงการตั้งค่า",
+  "system.reload_body_default": "OpenWork ตรวจพบการเปลี่ยนแปลงที่ต้องโหลด OpenCode ใหม่",
+  "system.reload_body_mcp": "OpenCode โหลด MCP server ตอนเริ่มต้น โหลด engine ใหม่เพื่อเปิดใช้งานการเชื่อมต่อใหม่",
+  "system.reload_body_mixed": "OpenWork ตรวจพบการเปลี่ยนแปลงการตั้งค่า OpenCode โหลด engine ใหม่เพื่อใช้งาน",
+  "system.reload_body_plugins": "OpenCode โหลดปลั๊กอิน npm ตอนเริ่มต้น โหลด engine ใหม่เพื่อใช้การเปลี่ยนแปลง opencode.json",
+  "system.reload_body_skills": "OpenCode อาจแคชการค้นหา skill โหลด engine ใหม่เพื่อให้ skill ที่ติดตั้งใหม่พร้อมใช้งาน",
+  "system.reload_failed": "ไม่สามารถโหลด engine ใหม่ได้",
+  "system.reload_required": "ต้องโหลดใหม่",
+  "system.reload_unavailable": "ไม่สามารถโหลดใหม่สำหรับ worker นี้",
+  "system.stop_active_runs_before_reset": "หยุดการทำงานที่กำลังดำเนินอยู่ก่อนรีเซ็ต",
+  "time.hours_ago": "{count} ชั่วโมงที่แล้ว",
+  "time.just_now": "เมื่อสักครู่",
+  "time.minutes_ago": "{count} นาทีที่แล้ว",
+  "time.seconds_ago": "{count} วินาทีที่แล้ว",
+  "workspace.loading_tasks": "กำลังโหลดงาน...",
+  "workspace.local_badge": "ภายในเครื่อง",
+  "workspace.new_task_inline": "+ งานใหม่",
+  "workspace.no_tasks": "ยังไม่มีงาน",
+  "workspace.remote_badge": "ระยะไกล",
+  "workspace.rename_description": "อัปเดตชื่อที่แสดงในแถบด้านข้าง",
+  "workspace.rename_label": "ชื่อพื้นที่ทำงาน",
+  "workspace.rename_placeholder": "พื้นที่ทำงานทีมออกแบบ",
+  "workspace.rename_title": "แก้ไขชื่อพื้นที่ทำงาน",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "เลือกแล้ว",
+  "workspace_list.add_workspace": "เพิ่มพื้นที่ทำงาน",
+  "workspace_list.connecting": "กำลังเชื่อมต่อ...",
+  "workspace_list.delete_session": "ลบเซสชัน",
+  "workspace_list.edit_connection": "แก้ไขการเชื่อมต่อ",
+  "workspace_list.edit_name": "แก้ไขชื่อ",
+  "workspace_list.hide_child_sessions": "ซ่อนเซสชันย่อย",
+  "workspace_list.recover": "กู้คืน",
+  "workspace_list.remote_worker_unavailable": "รีโมตเวิร์กเกอร์ไม่พร้อมใช้งาน",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork โหลดงานจากเวิร์กเกอร์นี้ไม่ได้จนกว่าจะแก้ไขการเชื่อมต่อ",
+  "workspace_list.remove_workspace": "ลบพื้นที่ทำงาน",
+  "workspace_list.rename_session": "เปลี่ยนชื่อเซสชัน",
+  "workspace_list.reveal_explorer": "เปิดใน Explorer",
+  "workspace_list.reveal_finder": "เปิดใน Finder",
+  "workspace_list.session_actions": "การดำเนินการเซสชัน",
+  "workspace_list.share": "แชร์...",
+  "workspace_list.show_child_sessions": "แสดงเซสชันย่อย",
+  "workspace_list.show_more": "แสดงเพิ่ม {count} รายการ",
+  "workspace_list.show_more_fallback": "แสดงเพิ่มเติม",
+  "workspace_list.test_connection": "ทดสอบการเชื่อมต่อ",
+  "workspace_list.unavailable": "ไม่พร้อมใช้งาน",
+  "workspace_list.workspace_fallback": "พื้นที่ทำงาน",
+  "workspace_list.workspace_options": "ตัวเลือกพื้นที่ทำงาน",
+} as const;
diff --git a/apps/app/src/i18n/locales/vi.ts b/apps/app/src/i18n/locales/vi.ts
new file mode 100644
index 0000000000..b017f28c7e
--- /dev/null
+++ b/apps/app/src/i18n/locales/vi.ts
@@ -0,0 +1,1378 @@
+/**
+ * Tiếng Việt translations
+ * Thuật ngữ chuyên môn KHÔNG dịch: Skills, Plugins, Commands, Sessions, OpenCode, OpenPackage, OpenWork, MCPs, OAuth, MCP
+ */
+
+export default {
+  "app.compact_command_desc": "Tóm tắt phiên này để giảm kích thước ngữ cảnh.",
+  "app.error_audit_load": "Tải nhật ký kiểm toán thất bại.",
+  "app.error_auth_failed": "Xác thực thất bại",
+  "app.error_command_not_resolved": "Command chưa được xử lý.",
+  "app.error_compact_empty": "Chưa có gì để thu gọn.",
+  "app.error_compact_no_session": "Chọn phiên có tin nhắn trước khi chạy /compact.",
+  "app.error_compact_no_session_id": "Chọn phiên trước khi thu gọn.",
+  "app.error_connect_first": "Kết nối worker này trước khi áp dụng thay đổi runtime.",
+  "app.error_not_connected": "Chưa kết nối máy chủ",
+  "app.error_rate_limit": "Vượt quá giới hạn tốc độ",
+  "app.error_remote_access": "Cập nhật truy cập từ xa thất bại.",
+  "app.error_request_failed": "Yêu cầu thất bại",
+  "app.error_restart_local_worker": "Khởi động lại worker nội bộ với cài đặt chia sẻ mới thất bại.",
+  "app.error_session_name_required": "Tên phiên là bắt buộc",
+  "app.local_disabled_reason": "Tạo workspace nội bộ trong ứng dụng desktop. Workspace từ xa và chia sẻ vẫn hoạt động ở đây.",
+  "app.model_behavior_title": "Hành vi model",
+  "app.plugins_hint_readonly": "Máy chủ OpenWork chỉ đọc cho plugins.",
+  "app.reload_later": "Để sau",
+  "app.reload_now": "Tải lại ngay",
+  "app.reload_stop_tasks": "Tải lại & Dừng task",
+  "app.skills_hint_readonly": "Máy chủ OpenWork chỉ đọc cho skills. Thêm token chủ sở hữu trong Nâng cao để bật cài đặt.",
+  "app.unknown_error": "Lỗi không xác định",
+  "blueprint.automation_body": "Bắt đầu từ luồng tái sử dụng hoặc nhập task bên dưới.",
+  "blueprint.automation_title": "Bạn muốn tự động hóa gì?",
+  "blueprint.csv_session_assistant": "Tôi có thể giúp bạn tạo, dọn dẹp, ghép nối và tóm tắt tệp CSV. Bạn muốn tự động hóa loại công việc CSV nào?",
+  "blueprint.csv_session_title": "Ý tưởng làm việc với CSV",
+  "blueprint.csv_session_user": "Tôi muốn ghép dữ liệu xuất từ nhiều công cụ thành một tệp CSV gọn gàng.",
+  "blueprint.empty_body": "Chọn điểm bắt đầu hoặc nhập bên dưới.",
+  "blueprint.empty_title": "Bạn muốn làm gì?",
+  "blueprint.minimal_body": "Đặt câu hỏi về workspace này hoặc dùng prompt khởi đầu.",
+  "blueprint.minimal_title": "Bắt đầu với một task",
+  "blueprint.starter_blueprint_desc": "Thiết kế luồng công việc tái sử dụng gồm skills, commands và bước chuyển giao.",
+  "blueprint.starter_blueprint_prompt": "Giúp tôi thiết kế một automation blueprint tái sử dụng cho workspace này. Hỏi tôi cần chuẩn hóa gì, rồi đề xuất luồng công việc.",
+  "blueprint.starter_blueprint_title": "Lập kế hoạch automation blueprint",
+  "blueprint.starter_chrome_desc": "Bắt đầu cuộc trò chuyện tự động hóa trình duyệt ngay.",
+  "blueprint.starter_chrome_prompt": "Giúp tôi kết nối Chrome và tự động hóa một tác vụ lặp lại.",
+  "blueprint.starter_chrome_title": "Tự động hóa Chrome",
+  "blueprint.starter_command_desc": "Biến luồng công việc lặp lại thành slash command cho workspace này.",
+  "blueprint.starter_command_prompt": "Giúp tôi tạo một /command tái sử dụng cho workspace này. Hỏi tôi muốn tự động hóa luồng nào, rồi soạn command.",
+  "blueprint.starter_command_title": "Tạo command tái sử dụng",
+  "blueprint.starter_connect_openai_desc": "Thêm provider OpenAI để các model ChatGPT sẵn sàng trong phiên mới.",
+  "blueprint.starter_connect_openai_title": "Kết nối ChatGPT",
+  "blueprint.starter_csv_desc": "Dọn dẹp hoặc tạo dữ liệu bảng tính.",
+  "blueprint.starter_csv_prompt": "Giúp tôi tạo hoặc chỉnh sửa tệp CSV trên máy tính này.",
+  "blueprint.starter_csv_title": "Làm việc với CSV",
+  "blueprint.starter_explore_desc": "Tóm tắt các tệp và gợi ý task đầu tiên nên làm.",
+  "blueprint.starter_explore_prompt": "Tóm tắt workspace này, chỉ ra các tệp quan trọng nhất và gợi ý task đầu tiên nên làm.",
+  "blueprint.starter_explore_title": "Khám phá workspace này",
+  "blueprint.welcome_message": "Xin chào, chào mừng bạn đến với OpenWork!\n\nMọi người dùng chúng tôi để tạo tệp .csv trên máy tính, kết nối Chrome và tự động hóa tác vụ lặp lại, cùng đồng bộ liên hệ với Notion.\n\nNhưng giới hạn duy nhất là trí tưởng tượng của bạn.\n\nBạn muốn làm gì?",
+  "blueprint.welcome_title": "Chào mừng đến với OpenWork",
+  "common.add": "Thêm",
+  "common.cancel": "Hủy",
+  "common.close": "Đóng",
+  "common.default_parens": "(mặc định)",
+  "common.edit": "Sửa",
+  "common.hide": "Ẩn",
+  "common.navigate": "điều hướng",
+  "common.next": "Tiếp",
+  "common.off": "Tắt",
+  "common.on": "Bật",
+  "common.path": "Đường dẫn",
+  "common.question": "Câu hỏi",
+  "common.refresh": "Làm mới",
+  "common.remove": "Xóa",
+  "common.reset": "Đặt lại",
+  "common.save": "Lưu",
+  "common.select": "chọn",
+  "common.show": "Hiện",
+  "common.something_went_wrong": "Đã xảy ra lỗi",
+  "common.submit": "Gửi",
+  "common.unknown": "Không rõ",
+  "composer.agent_label": "Agent",
+  "composer.attach_files": "Đính kèm tệp",
+  "composer.attachments_unavailable": "Đính kèm không khả dụng.",
+  "composer.behavior_label": "Hành vi",
+  "composer.configure": "Cấu hình",
+  "composer.default_agent": "Agent mặc định",
+  "composer.file_exceeds_limit": "{name} vượt quá giới hạn 8MB.",
+  "composer.file_kind": "Tệp",
+  "composer.image_kind": "Hình ảnh",
+  "composer.inserted_links_unsupported": "Đã chèn liên kết cho các tệp không được hỗ trợ.",
+  "composer.loading_commands": "Đang tải commands...",
+  "composer.mcps_label": "MCP",
+  "composer.no_commands": "Không tìm thấy command.",
+  "composer.placeholder": "Mô tả task của bạn...",
+  "composer.remote_worker_paste_warning": "Đây là worker từ xa. Sandbox cũng ở xa. Để chia sẻ tệp, tải lên Thư mục chia sẻ trong thanh bên.",
+  "composer.run_task": "Chạy task",
+  "composer.skill_source": "Skill",
+  "composer.stop": "Dừng",
+  "composer.tools_label": "Commands, skills và MCP",
+  "composer.unsupported_attachment_type": "Loại tệp đính kèm không được hỗ trợ.",
+  "composer.upload_to_shared_folder": "Tải lên thư mục chia sẻ",
+  "composer.uploaded_multiple_files": "Đã tải {count} tệp lên thư mục chia sẻ và chèn liên kết.",
+  "composer.uploaded_single_file": "Đã tải {name} lên thư mục chia sẻ và chèn liên kết.",
+  "config.collaborator_token_disabled_hint": "Đã lưu sẵn cho chia sẻ từ xa, nhưng truy cập từ xa hiện đang tắt.",
+  "config.collaborator_token_label": "Token cộng tác",
+  "config.collaborator_token_remote_hint": "Truy cập từ xa thông thường cho điện thoại hoặc laptop kết nối máy chủ này.",
+  "config.connection_failed": "Kết nối thất bại.",
+  "config.connection_failed_check": "Kết nối thất bại. Kiểm tra URL máy chủ và token.",
+  "config.connection_status_updated": "Đã cập nhật trạng thái kết nối.",
+  "config.connection_successful": "Kết nối thành công.",
+  "config.copied": "Đã sao chép",
+  "config.copy": "Sao chép",
+  "config.desktop_only_hint": "Một số tính năng cấu hình (chia sẻ máy chủ nội bộ + cầu nối nhắn tin) yêu cầu ứng dụng desktop.",
+  "config.diagnostics_desc": "Sao chép trạng thái runtime đã được lọc để gỡ lỗi.",
+  "config.diagnostics_title": "Gói chẩn đoán",
+  "config.engine_reload_desc": "Khởi động lại máy chủ OpenCode cho workspace này.",
+  "config.engine_reload_title": "Tải lại engine",
+  "config.host_admin_token_hint": "Token nội bộ chỉ dành cho máy chủ, dùng cho CLI phê duyệt và API quản trị. Không sử dụng trong luồng kết nối ứng dụng từ xa.",
+  "config.host_admin_token_label": "Token quản trị máy chủ",
+  "config.host_local_only": "Chỉ nội bộ",
+  "config.host_offline": "Ngoại tuyến",
+  "config.host_remote_enabled": "Đã bật truy cập từ xa",
+  "config.local_ip_hint": "Dùng IP nội bộ trên cùng mạng Wi-Fi để kết nối nhanh nhất.",
+  "config.mdns_hint": "Tên .local dễ nhớ hơn nhưng có thể không hoạt động trên mọi mạng.",
+  "config.messaging_identities_desc": "Quản lý danh tính Telegram/Slack và định tuyến trong tab Danh tính.",
+  "config.messaging_identities_title": "Danh tính nhắn tin",
+  "config.not_set": "Chưa đặt",
+  "config.owner_token_disabled_hint": "Chỉ cần thiết sau khi bạn bật truy cập từ xa cho worker này.",
+  "config.owner_token_label": "Token chủ sở hữu",
+  "config.owner_token_remote_hint": "Dùng khi client từ xa cần trả lời yêu cầu quyền hoặc thực hiện thao tác chủ sở hữu.",
+  "config.reload_active_tasks_warning": "Tải lại sẽ dừng các task đang chạy.",
+  "config.reload_availability_hint": "Tải lại chỉ khả dụng cho worker nội bộ hoặc máy chủ OpenWork đã kết nối.",
+  "config.reload_connect_hint": "Kết nối worker này để tải lại.",
+  "config.reload_engine": "Tải lại engine",
+  "config.reload_now_desc": "Áp dụng cập nhật cấu hình và kết nối lại phiên của bạn.",
+  "config.reload_now_title": "Tải lại ngay",
+  "config.reloading": "Đang tải lại...",
+  "config.remote_access_off_hint": "Truy cập từ xa đang tắt. Dùng Chia sẻ workspace để bật trước khi kết nối từ máy khác.",
+  "config.resolved_worker_url": "URL worker đã xác định:",
+  "config.server_needed_hint": "Cần kết nối máy chủ OpenWork để đồng bộ skills, plugins và commands.",
+  "config.server_section_desc": "Kết nối máy chủ OpenWork. Dùng URL cùng token cộng tác hoặc chủ sở hữu từ quản trị viên.",
+  "config.server_section_title": "Máy chủ OpenWork",
+  "config.server_sharing_desc": "Chia sẻ thông tin này với thiết bị tin cậy. Giữ máy chủ trên cùng mạng để thiết lập nhanh nhất.",
+  "config.server_sharing_menu_hint": "Để chia sẻ theo workspace, dùng Chia sẻ... trong menu workspace.",
+  "config.server_sharing_title": "Chia sẻ máy chủ OpenWork",
+  "config.server_url_hint": "Dùng URL được cung cấp bởi máy chủ OpenWork. Worker desktop nội bộ dùng cổng cố định trong khoảng 48000-51000.",
+  "config.server_url_input_label": "URL máy chủ OpenWork",
+  "config.server_url_label": "URL máy chủ OpenWork",
+  "config.starting_server": "Đang khởi động máy chủ…",
+  "config.status_connected": "Đã kết nối",
+  "config.status_limited": "Giới hạn",
+  "config.status_not_connected": "Chưa kết nối",
+  "config.test_connection": "Kiểm tra kết nối",
+  "config.testing": "Đang kiểm tra...",
+  "config.testing_connection": "Đang kiểm tra kết nối...",
+  "config.token_hint": "Tùy chọn. Dùng token cộng tác cho truy cập thông thường hoặc token chủ sở hữu khi client này phải trả lời yêu cầu quyền.",
+  "config.token_label": "Token cộng tác hoặc chủ sở hữu",
+  "config.token_placeholder": "Dán token của bạn",
+  "config.unavailable": "Không khả dụng",
+  "config.worker_id": "ID Worker:",
+  "config.workspace_config_desc": "Các cài đặt này ảnh hưởng đến workspace đã chọn. Thao tác runtime áp dụng cho workspace đang kết nối.",
+  "config.workspace_config_title": "Cấu hình workspace",
+  "config.workspace_id_prefix": "Workspace:",
+  "context_panel.add_button": "Thêm",
+  "context_panel.add_folder_hint": "Thêm thư mục để workspace có thể đọc và chỉnh sửa tệp ngoài thư mục gốc.",
+  "context_panel.adding_button": "Đang thêm...",
+  "context_panel.always_available": "Luôn khả dụng",
+  "context_panel.authorized_folders": "Thư mục được phép",
+  "context_panel.authorized_folders_desc": "Cấp quyền cho workspace này đọc và chỉnh sửa tệp trong thư mục bên ngoài thư mục gốc.",
+  "context_panel.authorized_folders_no_access": "Kết nối workspace máy chủ OpenWork có quyền ghi để chỉnh sửa thư mục được phép.",
+  "context_panel.browse_button": "Duyệt",
+  "context_panel.config_access_unavailable": "Quyền truy cập cấu hình máy chủ OpenWork không khả dụng cho workspace này.",
+  "context_panel.config_read_only": "Máy chủ OpenWork kết nối chỉ đọc cho cấu hình workspace.",
+  "context_panel.folder_already_authorized": "Thư mục đã được cấp quyền.",
+  "context_panel.folders_updated": "Đã cập nhật thư mục được phép.",
+  "context_panel.input_placeholder": "Nhập đường dẫn thư mục để cấp quyền...",
+  "context_panel.no_external_folders": "Chưa cấp quyền thư mục bên ngoài",
+  "context_panel.no_mcp": "Chưa tải MCP server nào.",
+  "context_panel.no_server_workspace": "Chưa chọn workspace máy chủ đang hoạt động.",
+  "context_panel.no_skills": "Chưa tải skill nào.",
+  "context_panel.preserving_entries": "Giữ nguyên {count} mục quyền không phải thư mục.",
+  "context_panel.preserving_entry": "Giữ nguyên 1 mục quyền không phải thư mục.",
+  "context_panel.remove_folder": "Xóa {name}",
+  "context_panel.saving_folders": "Đang lưu thư mục được phép...",
+  "context_panel.server_disconnected": "Máy chủ OpenWork đã ngắt kết nối.",
+  "context_panel.workspace_root_available": "Thư mục gốc workspace đã khả dụng.",
+  "context_panel.workspace_root_badge": "Thư mục gốc workspace",
+  "context_panel.writable_workspace_required": "Cần workspace máy chủ OpenWork có quyền ghi để cập nhật thư mục được phép.",
+  "dashboard.change": "Thay đổi",
+  "dashboard.choose_folder": "Chọn thư mục",
+  "dashboard.choose_folder_continue": "Chọn thư mục để tiếp tục.",
+  "dashboard.chooser_local_desc": "Tạo workspace trên thiết bị này và tùy chọn bắt đầu từ mẫu nhóm.",
+  "dashboard.chooser_remote_desc": "Kết nối worker OpenWork tự lưu trữ bằng URL và token truy cập.",
+  "dashboard.chooser_shared_desc": "Duyệt worker Cloud được chia sẻ với tổ chức và kết nối chỉ một bước.",
+  "dashboard.close_settings": "Đóng cài đặt",
+  "dashboard.cloud_worker": "Worker Cloud",
+  "dashboard.commands": "Commands",
+  "dashboard.connect_remote_button": "Kết nối từ xa",
+  "dashboard.connected": "Đã kết nối",
+  "dashboard.connecting": "Đang kết nối...",
+  "dashboard.create_local_workspace_subtitle": "Tạo workspace trên thiết bị này và tùy chọn bắt đầu từ mẫu nhóm.",
+  "dashboard.create_local_workspace_title": "Workspace nội bộ",
+  "dashboard.create_remote_custom_subtitle": "Kết nối worker OpenWork tự lưu trữ.",
+  "dashboard.create_remote_custom_title": "Kết nối từ xa tùy chỉnh",
+  "dashboard.create_remote_workspace_confirm": "Thêm Workspace",
+  "dashboard.create_remote_workspace_subtitle": "Lưu máy chủ OpenWork làm workspace.",
+  "dashboard.create_remote_workspace_title": "Thêm Workspace từ xa",
+  "dashboard.create_sandbox_confirm": "Tạo dạng sandbox",
+  "dashboard.create_shared_subtitle_signed_in": "Duyệt worker Cloud được chia sẻ với tổ chức và kết nối chỉ một bước.",
+  "dashboard.create_shared_subtitle_signed_out": "Đăng nhập OpenWork Cloud để truy cập worker được chia sẻ với tổ chức của bạn.",
+  "dashboard.create_shared_title": "Workspace chia sẻ",
+  "dashboard.create_workspace_confirm": "Tạo Workspace",
+  "dashboard.create_workspace_subtitle": "Khởi tạo workspace mới dựa trên thư mục.",
+  "dashboard.create_workspace_title": "Tạo Workspace",
+  "dashboard.desktop_badge": "Desktop",
+  "dashboard.edit_remote_workspace_confirm": "Lưu kết nối",
+  "dashboard.edit_remote_workspace_subtitle": "Cập nhật thông tin máy chủ OpenWork cho workspace này.",
+  "dashboard.edit_remote_workspace_title": "Chỉnh sửa kết nối từ xa",
+  "dashboard.error_choose_org": "Chọn tổ chức trước khi mở workspace.",
+  "dashboard.error_connect_worker": "Kết nối {name} thất bại.",
+  "dashboard.error_load_orgs": "Tải tổ chức thất bại.",
+  "dashboard.error_load_shared_workspaces": "Tải workspace chia sẻ thất bại.",
+  "dashboard.error_workspace_not_ready": "Workspace chưa sẵn sàng kết nối. Thử lại sau giây lát.",
+  "dashboard.import_config": "Nhập cấu hình",
+  "dashboard.importing": "Đang nhập…",
+  "dashboard.modal_back": "Quay lại",
+  "dashboard.modal_close": "Đóng hộp thoại thêm workspace",
+  "dashboard.remote": "Từ xa",
+  "dashboard.remote_base_url_required": "Vui lòng nhập URL máy chủ để tiếp tục.",
+  "dashboard.remote_server_details_hint": "Kết nối worker OpenWork tự lưu trữ.",
+  "dashboard.remote_server_details_title": "Chi tiết máy chủ từ xa",
+  "dashboard.sandbox_checking_docker": "Đang kiểm tra Docker...",
+  "dashboard.sandbox_get_ready_title": "Sandbox cần Docker",
+  "dashboard.skills": "Skills",
+  "dashboard.worker_status_attention": "Cần chú ý",
+  "dashboard.worker_status_ready": "Sẵn sàng",
+  "dashboard.worker_status_starting": "Đang khởi động",
+  "dashboard.worker_status_stopped": "Đã dừng",
+  "dashboard.worker_status_unknown": "Không rõ",
+  "den.active_org_hint": "Worker Cloud và mẫu nhóm thuộc phạm vi tổ chức đã chọn.",
+  "den.active_org_title": "Tổ chức đang hoạt động",
+  "den.auto_reconnect_hint": "Hoàn tất xác thực trong trình duyệt và OpenWork sẽ tự động kết nối lại ở đây.",
+  "den.checking_session": "Đang kiểm tra phiên",
+  "den.choose_org_for_providers": "Chọn tổ chức để xem provider Cloud.",
+  "den.choose_org_for_skill_hubs": "Chọn tổ chức để xem skill hub Cloud.",
+  "den.cloud_account_hint": "Quản lý tài khoản và tổ chức đã kết nối.",
+  "den.cloud_account_title": "Tài khoản Cloud",
+  "den.cloud_control_plane_open": "Mở trong trình duyệt",
+  "den.cloud_control_plane_reset": "Đặt lại",
+  "den.cloud_control_plane_save": "Lưu URL",
+  "den.cloud_control_plane_url_hint": "Chỉ chế độ nhà phát triển. Dùng để trỏ đến Cloud control plane nội bộ hoặc tự lưu trữ. Thay đổi sẽ đăng xuất để ứng dụng kết nối lại với control plane mới.",
+  "den.cloud_control_plane_url_label": "URL Cloud control plane",
+  "den.cloud_provider_detail": "{count} model · provider {source}",
+  "den.cloud_provider_removed_detail": "Provider đã nhập không còn trên Cloud. Gỡ cài đặt cấu hình {providerId} cục bộ.",
+  "den.cloud_provider_sync_detail": "Provider Cloud đã thay đổi. Đồng bộ cấu hình {source} với {count} model vào opencode.jsonc.",
+  "den.cloud_providers_hint": "Nhập provider LLM được quản lý vào opencode.jsonc và sử dụng thông tin xác thực của tổ chức trong workspace này.",
+  "den.cloud_providers_title": "Provider Cloud",
+  "den.cloud_section_desc": "Đăng nhập, chọn tổ chức và mở worker Cloud hoặc mẫu nhóm.",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "Đăng nhập OpenWork Cloud để giữ task hoạt động khi máy ngủ.",
+  "den.cloud_workers_hint": "Mở worker trực tiếp vào OpenWork bằng luồng kết nối từ xa có sẵn.",
+  "den.cloud_workers_title": "Worker Cloud",
+  "den.create_account": "Tạo tài khoản",
+  "den.credentials_ready_badge": "Thông tin xác thực sẵn sàng",
+  "den.error_base_url": "Nhập URL Cloud control plane hợp lệ dạng http:// hoặc https://.",
+  "den.error_choose_org": "Chọn tổ chức trước khi mở worker.",
+  "den.error_load_orgs": "Tải tổ chức thất bại.",
+  "den.error_load_workers": "Tải worker thất bại.",
+  "den.error_no_session": "Không tìm thấy phiên Cloud đang hoạt động.",
+  "den.error_no_token": "Đăng nhập desktop hoàn tất, nhưng OpenWork Cloud không trả về token phiên.",
+  "den.error_open_worker": "Mở {name} trong OpenWork thất bại.",
+  "den.error_open_worker_fallback": "Mở {name} thất bại.",
+  "den.error_paste_valid_code": "Dán liên kết đăng nhập OpenWork hợp lệ hoặc mã đăng nhập một lần.",
+  "den.error_signin_failed": "Đăng nhập OpenWork Cloud thất bại.",
+  "den.error_worker_not_ready": "Worker chưa sẵn sàng. Thử lại sau khi cung cấp xong.",
+  "den.finish_signin": "Hoàn tất đăng nhập",
+  "den.finishing": "Đang hoàn tất...",
+  "den.hide_signin_code": "Ẩn mã đăng nhập",
+  "den.import_all": "Nhập tất cả",
+  "den.import_provider": "Nhập",
+  "den.import_provider_failed": "Không thể nhập {name}.",
+  "den.imported_badge": "Đã nhập",
+  "den.imported_provider": "Đã nhập {name}.",
+  "den.importing": "Đang nhập…",
+  "den.needs_attention": "Cần chú ý",
+  "den.no_cloud_providers": "Chưa có provider Cloud nào cho tổ chức này.",
+  "den.no_cloud_workers": "Chưa có worker Cloud cho tổ chức này. Tạo worker trong Cloud, rồi làm mới tab này.",
+  "den.no_org_selected": "Chưa chọn tổ chức",
+  "den.no_skill_hubs": "Chưa có skill hub Cloud nào cho tổ chức này.",
+  "den.open": "Mở",
+  "den.opening": "Đang mở...",
+  "den.org_member_suffix": "(Thành viên)",
+  "den.org_owner_suffix": "(Chủ sở hữu)",
+  "den.org_switched": "Đã chuyển sang {name}.",
+  "den.out_of_sync_badge": "Chưa đồng bộ",
+  "den.paste_signin_code": "Dán mã đăng nhập",
+  "den.refresh": "Làm mới",
+  "den.reload_workspace": "Tải lại workspace để áp dụng thay đổi cấu hình.",
+  "den.remove_provider_failed": "Không thể xóa {name}.",
+  "den.removed_from_cloud_badge": "Đã xóa khỏi Cloud",
+  "den.removed_provider": "Đã xóa {name}.",
+  "den.removing": "Đang xóa…",
+  "den.sign_out": "Đăng xuất",
+  "den.signed_out": "Đã đăng xuất",
+  "den.signin_button": "Đăng nhập",
+  "den.signin_code_note": "Chấp nhận liên kết openwork://den-auth hoặc mã một lần.",
+  "den.signin_link_hint": "Nếu trình duyệt không tự quay lại OpenWork, dán liên kết đăng nhập hoặc mã một lần từ OpenWork Cloud vào đây.",
+  "den.signin_link_label": "Liên kết đăng nhập hoặc mã một lần",
+  "den.signin_link_placeholder": "openwork://den-auth?... hoặc mã đã dán",
+  "den.signin_title": "Đăng nhập OpenWork Cloud",
+  "den.signing_in": "Đang hoàn tất đăng nhập OpenWork Cloud...",
+  "den.signing_out": "Đang đăng xuất...",
+  "den.skill_hub_detail": "Nhập {count} skill được chia sẻ vào .opencode/skills.",
+  "den.skill_hub_imported_detail": "Đã nhập {count} skill vào workspace này.",
+  "den.skill_hub_removed_detail": "Hub này đã bị xóa khỏi Cloud. Gỡ cài đặt {importedCount} skill đã nhập khỏi workspace này.",
+  "den.skill_hub_skills_badge": "{count} skills",
+  "den.skill_hub_sync_detail": "Cloud hiện có {liveCount} skill; workspace này đã nhập {importedCount}. Đồng bộ để cập nhật.",
+  "den.skill_hubs_hint": "Nhập tất cả skill từ hub Cloud được chia sẻ vào workspace này chỉ với một bước.",
+  "den.skill_hubs_title": "Skill hub",
+  "den.status_base_url_updated": "Đã cập nhật URL Cloud control plane. Đăng nhập lại để tiếp tục.",
+  "den.status_browser_signin": "Hoàn tất đăng nhập trong trình duyệt để kết nối OpenWork.",
+  "den.status_browser_signup": "Hoàn tất tạo tài khoản trong trình duyệt để kết nối OpenWork.",
+  "den.status_cloud_signed_in_as": "Đã kết nối OpenWork Cloud với {email}.",
+  "den.status_cloud_signin_done": "Đã kết nối OpenWork Cloud.",
+  "den.status_loaded_orgs": "Đã tải {count} tổ chức.",
+  "den.status_loaded_workers": "Đã tải {count} worker cho {name}.",
+  "den.status_no_workers": "Không tìm thấy worker cho {name}.",
+  "den.status_opened_worker": "Đã mở {name} trong OpenWork.",
+  "den.status_signed_in_as": "Đã đăng nhập với {email}.",
+  "den.status_signed_out": "Đã đăng xuất và xóa phiên OpenWork Cloud trên thiết bị này.",
+  "den.sync": "Đồng bộ",
+  "den.sync_provider_failed": "Không thể đồng bộ {name}.",
+  "den.synced_provider": "Đã đồng bộ {name}.",
+  "den.syncing": "Đang đồng bộ…",
+  "den.uninstall": "Gỡ cài đặt",
+  "den.worker_mine_badge": "Của tôi",
+  "den.worker_not_ready_title": "Worker này chưa sẵn sàng.",
+  "den.worker_provider_label": "Worker {provider}",
+  "den.worker_secondary_cloud": "Worker Cloud",
+  "extensions.app_count": "{count} ứng dụng đã kết nối",
+  "extensions.apps_mcp_header": "Ứng dụng (MCP)",
+  "extensions.filter_all": "Tất cả",
+  "extensions.filter_apps": "Ứng dụng",
+  "extensions.filter_plugins": "Plugins",
+  "extensions.plugin_count": "{count} plugins",
+  "extensions.plugins_opencode_header": "Plugins (OpenCode)",
+  "extensions.subtitle": "Ứng dụng (MCP) và OpenCode plugins gộp chung một nơi.",
+  "extensions.title": "Tiện ích mở rộng",
+  "identities.agent_behavior_desc": "Một tệp mỗi workspace. Thêm dòng đầu tùy chọn @agent <id> để định tuyến qua agent OpenCode cụ thể.",
+  "identities.agent_behavior_title": "Hành vi agent nhắn tin",
+  "identities.agent_created": "Đã tạo tệp agent nhắn tin mặc định.",
+  "identities.agent_file_changed": "Tệp đã thay đổi từ xa. Tải lại và lưu lần nữa.",
+  "identities.agent_loading": "Đang tải tệp agent…",
+  "identities.agent_none": "không có",
+  "identities.agent_not_found": "Chưa tìm thấy tệp agent trong workspace này.",
+  "identities.agent_saved": "Đã lưu hành vi nhắn tin.",
+  "identities.agent_scope_status": "Phạm vi hoạt động: workspace · trạng thái: {status} · agent đã chọn: {agent}",
+  "identities.agent_status_loaded": "đã tải",
+  "identities.agent_status_missing": "thiếu",
+  "identities.agent_worker_scope_unavailable": "Phạm vi worker không khả dụng.",
+  "identities.all_channels": "Tất cả kênh",
+  "identities.app_token_label": "Token ứng dụng",
+  "identities.auto_bind_label": "Tự động liên kết peer với thư mục khi gửi trực tiếp",
+  "identities.available_channels": "Kênh khả dụng",
+  "identities.bot_token_label": "Token bot",
+  "identities.bot_token_placeholder": "Dán token bot Telegram từ @BotFather",
+  "identities.botfather_step1_open": "1. Mở @BotFather trong Telegram",
+  "identities.botfather_step1_run": "và chạy /newbot",
+  "identities.botfather_step3_choose": "3. Chọn tên và username cho bot",
+  "identities.botfather_step3_or_private": "cho hộp thư mở hoặc",
+  "identities.botfather_step3_private": "Riêng tư",
+  "identities.botfather_step3_public": "Công khai",
+  "identities.botfather_step3_to_require": "để yêu cầu",
+  "identities.channel_label": "Kênh",
+  "identities.channels_connected": "đã kết nối",
+  "identities.channels_label": "Kênh",
+  "identities.configured_suffix": "đã cấu hình",
+  "identities.connect_server_desc": "Danh tính khả dụng khi bạn đã kết nối máy chủ OpenWork.",
+  "identities.connect_server_title": "Kết nối máy chủ OpenWork",
+  "identities.connect_slack": "Kết nối Slack",
+  "identities.connected_badge": "Đã kết nối",
+  "identities.connecting": "Đang kết nối...",
+  "identities.copy_bot_token_hint": "Sao chép token bot và dán vào bên dưới.",
+  "identities.copy_code": "Sao chép mã",
+  "identities.create_default_file": "Tạo tệp mặc định",
+  "identities.create_private_bot": "Tạo bot riêng tư",
+  "identities.create_public_bot": "Tạo bot công khai",
+  "identities.days_ago": "{days} ngày trước",
+  "identities.default_routing": "Định tuyến mặc định",
+  "identities.directory_label": "Thư mục (tùy chọn)",
+  "identities.disable_messaging": "Tắt nhắn tin",
+  "identities.disable_messaging_message": "Thao tác này sẽ tắt nhắn tin cho workspace này. Thiết lập Telegram và Slack sẽ bị ẩn cho đến khi bật lại, và bạn cần khởi động lại worker để dừng hoàn toàn sidecar nhắn tin.",
+  "identities.disable_messaging_title": "Tắt nhắn tin cho worker này?",
+  "identities.disabled_label": "Đã tắt",
+  "identities.disabling": "Đang tắt...",
+  "identities.disconnect": "Ngắt kết nối",
+  "identities.dispatched_messages": "Đã gửi {sent}/{attempted} tin nhắn.",
+  "identities.enable_messaging": "Bật nhắn tin",
+  "identities.enable_messaging_risk": "Nhắn tin có thể phơi bày worker này cho lệnh từ xa. Nếu bot công khai hoặc bị xâm phạm, nó có thể truy cập tệp, thông tin đăng nhập và API key của worker.",
+  "identities.enable_messaging_title": "Bật nhắn tin cho worker này?",
+  "identities.enabled_label": "Đã bật",
+  "identities.enabling": "Đang bật...",
+  "identities.health_offline": "Ngoại tuyến",
+  "identities.health_running": "Đang chạy",
+  "identities.health_unavailable": "Không khả dụng",
+  "identities.health_unknown": "Không rõ",
+  "identities.hours_ago": "{hours} giờ trước",
+  "identities.identities_label": "Danh tính",
+  "identities.just_now": "Vừa xong",
+  "identities.last_activity": "Hoạt động cuối",
+  "identities.later": "Để sau",
+  "identities.message_label": "Tin nhắn",
+  "identities.message_routing_desc": "Kiểm soát cuộc hội thoại nào đến thư mục workspace nào. Tin nhắn được định tuyến đến thư mục mặc định của worker trừ khi bạn thiết lập quy tắc ở đây.",
+  "identities.message_routing_title": "Định tuyến tin nhắn",
+  "identities.messages_today": "Tin nhắn hôm nay",
+  "identities.messaging_disabled_hint": "Chỉ bật nhắn tin nếu bạn hiểu rủi ro và dự định bảo mật truy cập (ví dụ: ghép nối Telegram riêng tư).",
+  "identities.messaging_disabled_restart": "Nhắn tin đã tắt. Khởi động lại worker để dừng sidecar nhắn tin.",
+  "identities.messaging_disabled_risk": "Bot nhắn tin có thể thực hiện hành động trên worker nội bộ. Nếu bị phơi bày công khai, chúng có thể truy cập tệp, thông tin đăng nhập và API key của worker.",
+  "identities.messaging_disabled_title": "Nhắn tin tắt theo mặc định",
+  "identities.messaging_enabled_restart": "Nhắn tin đã bật. Khởi động lại worker để áp dụng trước khi cấu hình kênh.",
+  "identities.messaging_sidecar_not_running": "Nhắn tin đã bật trong workspace này, nhưng sidecar nhắn tin chưa chạy. Khởi động lại worker, rồi quay lại cài đặt Nhắn tin để kết nối Telegram hoặc Slack.",
+  "identities.minutes_ago": "{minutes} phút trước",
+  "identities.not_set": "Chưa đặt",
+  "identities.open_bot_link": "Mở @{username} trong Telegram",
+  "identities.pairing_code_copied": "Đã sao chép mã ghép nối.",
+  "identities.pairing_code_copy_failed": "Không thể sao chép mã ghép nối. Vui lòng sao chép thủ công.",
+  "identities.pairing_code_instruction_prefix": "Gửi",
+  "identities.peer_id_label": "Peer ID (tùy chọn)",
+  "identities.peer_id_placeholder_slack": "ví dụ: slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "ví dụ: telegram:123456789",
+  "identities.private_label": "Riêng tư",
+  "identities.private_pairing_code": "Mã ghép nối riêng tư",
+  "identities.public_bot_confirm": "Tôi hiểu rủi ro",
+  "identities.public_bot_warning_message": "Bot của bạn sẽ được truy cập công khai và bất kỳ ai có quyền truy cập bot đều có thể toàn quyền truy cập worker nội bộ bao gồm tệp và API key. Nếu tạo bot riêng tư, bạn có thể giới hạn quyền truy cập bằng mã ghép nối. Bạn có chắc muốn đặt bot công khai không?",
+  "identities.public_bot_warning_title": "Đặt bot này công khai?",
+  "identities.public_label": "Công khai",
+  "identities.quick_setup": "Thiết lập nhanh",
+  "identities.reconnect_failed": "Kết nối lại thất bại. Kiểm tra URL/token OpenWork và thử lại.",
+  "identities.reconnected": "Đã kết nối lại.",
+  "identities.reconnected_refreshing": "Đã kết nối lại. Đang làm mới trạng thái worker...",
+  "identities.reload": "Tải lại",
+  "identities.repair_reconnect": "Sửa lỗi & kết nối lại",
+  "identities.restart_failed": "Khởi động lại thất bại. Vui lòng khởi động lại worker từ Cài đặt và thử lại.",
+  "identities.restart_to_disable_messaging": "Nhắn tin đã tắt cho workspace này. Khởi động lại worker ngay để dừng sidecar nhắn tin.",
+  "identities.restart_to_enable_messaging": "Nhắn tin đã bật cho workspace này. Khởi động lại worker ngay để khởi chạy sidecar nhắn tin và mở khóa thiết lập Telegram và Slack.",
+  "identities.restart_worker": "Khởi động lại worker",
+  "identities.restart_worker_title": "Khởi động lại worker ngay?",
+  "identities.restarting": "Đang khởi động lại...",
+  "identities.routing_override_prefix": "Tất cả tin nhắn định tuyến đến",
+  "identities.routing_override_suffix": "(đang ghi đè)",
+  "identities.running_label": "Đang chạy",
+  "identities.save_behavior": "Lưu hành vi",
+  "identities.saving": "Đang lưu...",
+  "identities.send_test_button": "Gửi tin nhắn thử",
+  "identities.send_test_desc": "Kiểm tra đường truyền đi. Dùng peer ID để gửi trực tiếp, hoặc để trống peer ID để phân phối theo liên kết trong thư mục.",
+  "identities.send_test_title": "Gửi tin nhắn thử",
+  "identities.sending": "Đang gửi...",
+  "identities.slack_desc": "Worker của bạn xuất hiện như bot trong các kênh Slack. Thành viên nhóm có thể nhắn trực tiếp hoặc đề cập trong luồng.",
+  "identities.slack_intro": "Kết nối workspace Slack để thành viên nhóm tương tác với worker này trong kênh và tin nhắn trực tiếp.",
+  "identities.slack_unavailable": "Danh tính Slack không khả dụng.",
+  "identities.status_active": "Đang hoạt động",
+  "identities.status_label": "Trạng thái",
+  "identities.status_stopped": "Đã dừng",
+  "identities.stopped_label": "Đã dừng",
+  "identities.subtitle": "Để mọi người liên lạc worker qua ứng dụng nhắn tin. Kết nối kênh và worker sẽ tự động đọc và phản hồi tin nhắn.",
+  "identities.tab_general": "Chung",
+  "identities.telegram_bot_access_desc": "Bot công khai: chat Telegram đầu tiên tự động liên kết. Bot riêng tư: yêu cầu mã ghép nối trước khi tin nhắn chạy công cụ.",
+  "identities.telegram_delete_failed": "Xóa thất bại.",
+  "identities.telegram_deleted": "Đã xóa.",
+  "identities.telegram_deleted_pending": "Đã xóa (chờ áp dụng).",
+  "identities.telegram_desc": "Kết nối bot Telegram ở chế độ công khai (hộp thư mở) hoặc riêng tư (cần mã ghép nối).",
+  "identities.telegram_private_saved_pair": "Đã lưu bot riêng tư. Ghép nối qua /pair {code}",
+  "identities.telegram_save_failed": "Lưu thất bại.",
+  "identities.telegram_saved": "Đã lưu.",
+  "identities.telegram_saved_pending": "Đã lưu (chờ áp dụng).",
+  "identities.telegram_saved_username": "Đã lưu (@{username})",
+  "identities.telegram_unavailable": "Danh tính Telegram không khả dụng.",
+  "identities.title": "Kênh nhắn tin",
+  "identities.unsaved_changes": "Thay đổi chưa lưu",
+  "identities.worker_offline": "Worker ngoại tuyến",
+  "identities.worker_online": "Worker trực tuyến",
+  "identities.worker_restarted": "Đã khởi động lại worker.",
+  "identities.worker_restarted_refreshing": "Đã khởi động lại worker. Đang làm mới trạng thái nhắn tin...",
+  "identities.worker_scope_unavailable": "Phạm vi worker không khả dụng.",
+  "identities.worker_scope_unavailable_detail": "Phạm vi worker không khả dụng. Kết nối lại bằng URL worker hoặc chuyển sang worker đã biết.",
+  "identities.worker_unavailable": "Worker không khả dụng",
+  "identities.workspace_id_required": "Cần ID workspace để quản lý danh tính. Kết nối lại bằng URL workspace hoặc chọn workspace đã ánh xạ trên máy chủ này.",
+  "identities.workspace_scope_prefix": "Phạm vi workspace:",
+  "mcp.add_modal_subtitle": "Kết nối MCP server tùy chỉnh bằng URL hoặc lệnh nội bộ.",
+  "mcp.add_modal_title": "Thêm ứng dụng tùy chỉnh",
+  "mcp.add_server_button": "Thêm ứng dụng",
+  "mcp.advanced": "Nâng cao",
+  "mcp.advanced_settings": "Cài đặt nâng cao",
+  "mcp.advanced_settings_hint": "Chỉnh sửa tệp cấu hình và quản lý kết nối thủ công.",
+  "mcp.app_connected": "ứng dụng đã kết nối",
+  "mcp.apps_connected": "ứng dụng đã kết nối",
+  "mcp.apps_subtitle": "Kết nối các công cụ yêu thích để OpenWork có thể sử dụng thay bạn.",
+  "mcp.apps_title": "Ứng dụng",
+  "mcp.auth.already_connected": "Đã kết nối",
+  "mcp.auth.already_connected_description": "{server} đã được xác thực và sẵn sàng sử dụng.",
+  "mcp.auth.applying_changes_body": "Chúng tôi đang khởi động lại worker để MCP mới sẵn sàng xác thực.",
+  "mcp.auth.applying_changes_title": "Đang áp dụng thay đổi trước khi đăng nhập",
+  "mcp.auth.authorization_link": "Liên kết cấp quyền",
+  "mcp.auth.authorization_still_required": "Vẫn cần xác thực. Thử lại để khởi động lại luồng.",
+  "mcp.auth.callback_invalid": "Dán URL callback hoặc tham số code để hoàn tất OAuth.",
+  "mcp.auth.callback_label": "URL callback hoặc mã code",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "Hủy",
+  "mcp.auth.client_registration_required": "Cần đăng ký client trước khi tiếp tục OAuth.",
+  "mcp.auth.complete_connection": "Hoàn tất kết nối",
+  "mcp.auth.configured_previously": "MCP có thể đã được cấu hình toàn cục hoặc trong phiên trước. Bạn có thể đóng hộp thoại này và bắt đầu sử dụng ngay.",
+  "mcp.auth.connect_server": "Kết nối {server}",
+  "mcp.auth.copied": "Đã sao chép",
+  "mcp.auth.copy_link": "Sao chép liên kết",
+  "mcp.auth.done": "Xong",
+  "mcp.auth.failed_to_start_oauth": "Không thể khởi động luồng OAuth",
+  "mcp.auth.follow_browser_steps": "Làm theo các bước xác thực trong trình duyệt.",
+  "mcp.auth.force_stop": "Buộc dừng",
+  "mcp.auth.force_stopping": "Đang dừng...",
+  "mcp.auth.im_done": "Tôi đã xong",
+  "mcp.auth.invalid_refresh_token": "Refresh token OAuth không hợp lệ hoặc đã hết hạn. Vui lòng xác thực lại.",
+  "mcp.auth.manual_finish_hint": "Dán URL callback (localhost:19876) hoặc chỉ mã code để hoàn tất kết nối.",
+  "mcp.auth.manual_finish_title": "Server từ xa?",
+  "mcp.auth.oauth_completed_reload": "OAuth hoàn tất. Tải lại engine để kích hoạt MCP.",
+  "mcp.auth.oauth_failed": "Xác thực OAuth thất bại.",
+  "mcp.auth.oauth_not_supported_hint": "Điều này có thể do:\n• MCP server không hỗ trợ OAuth\n• Engine cần tải lại để phát hiện tính năng server\n• Thử: opencode mcp auth {server} từ CLI",
+  "mcp.auth.open_browser_signin": "Chúng tôi sẽ mở trình duyệt để hoàn tất đăng nhập.",
+  "mcp.auth.port_forward_hint": "Mẹo: chuyển tiếp cổng callback nếu cần: ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "Xác thực lại OAuth",
+  "mcp.auth.reauth_cli_hint": "Chạy: opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "Xác thực lại thất bại.",
+  "mcp.auth.reauth_remote_hint": "Xác thực lại từ máy đang chạy worker này.",
+  "mcp.auth.reauth_running": "Đang xác thực lại...",
+  "mcp.auth.reload_blocked": "Đang tạm dừng tải lại vì có phiên đang chạy. Dừng phiên để hoàn tất thiết lập.",
+  "mcp.auth.reload_engine_retry": "Áp dụng thay đổi và thử lại",
+  "mcp.auth.reload_failed": "Tải lại worker trước khi đăng nhập thất bại.",
+  "mcp.auth.reload_notice": "Để thay đổi có hiệu lực, OpenWork cần làm mới dịch vụ worker. Điều này có thể gián đoạn phiên đang chạy.",
+  "mcp.auth.reload_remote_confirm": "Để thay đổi có hiệu lực, OpenWork cần làm mới dịch vụ worker. Điều này có thể dừng phiên đang chạy. Tiếp tục?",
+  "mcp.auth.reopen_browser_link": "Nhấn vào đây để mở lại trình duyệt",
+  "mcp.auth.request_timed_out": "Yêu cầu hết thời gian.",
+  "mcp.auth.retry": "Thử lại",
+  "mcp.auth.retry_now": "Thử lại ngay",
+  "mcp.auth.server_disabled": "MCP server này đã bị tắt. Bật lại và thử lần nữa.",
+  "mcp.auth.step1_description": "Chúng tôi sẽ tự động mở trang đăng nhập của {server}.",
+  "mcp.auth.step1_title": "Đang mở trình duyệt",
+  "mcp.auth.step2_description": "Đăng nhập và chấp thuận quyền truy cập khi được yêu cầu.",
+  "mcp.auth.step2_title": "Cấp quyền cho OpenWork",
+  "mcp.auth.step3_description": "Chúng tôi sẽ hoàn tất kết nối ngay khi xác thực xong.",
+  "mcp.auth.step3_title": "Quay lại đây khi hoàn tất",
+  "mcp.auth.try_reload_engine": "{message}. Thử tải lại engine trước.",
+  "mcp.auth.waiting_authorization": "Đang đợi bạn hoàn tất xác thực trong trình duyệt...",
+  "mcp.auth.waiting_for_conversation_body": "Chúng tôi sẽ chuyển hướng bạn để xác thực ngay khi có thể.",
+  "mcp.auth.waiting_for_conversation_title": "Đang đợi cuộc hội thoại hoàn tất",
+  "mcp.auth.waiting_for_session": "Đang đợi {session} hoàn tất",
+  "mcp.available_apps": "Ứng dụng khả dụng",
+  "mcp.cap_signin": "Đăng nhập tài khoản",
+  "mcp.cap_tools": "Công cụ AI",
+  "mcp.config_file": "Tệp cấu hình",
+  "mcp.config_load_failed": "Không thể tải tệp cấu hình",
+  "mcp.config_not_loaded": "Chưa tải",
+  "mcp.connect": "Kết nối",
+  "mcp.connect_failed": "Không thể kết nối. Vui lòng thử lại.",
+  "mcp.connect_server_first": "Vui lòng kết nối máy chủ trước.",
+  "mcp.connected": "Đã kết nối",
+  "mcp.connected_badge": "Đã kết nối",
+  "mcp.connection_failed": "Lỗi kết nối — thử lại",
+  "mcp.connection_type": "Kết nối",
+  "mcp.control_chrome_browser_hint": "Trong Chrome 144 trở lên, làm điều này trước:",
+  "mcp.control_chrome_browser_step_one": "Mở chrome://inspect/#remote-debugging.",
+  "mcp.control_chrome_browser_step_two": "Bật gỡ lỗi từ xa.",
+  "mcp.control_chrome_browser_step_three": "Cho phép kết nối gỡ lỗi khi Chrome yêu cầu.",
+  "mcp.control_chrome_browser_title": "1. Bật quyền truy cập Chrome",
+  "mcp.control_chrome_connect": "Thêm Control Chrome",
+  "mcp.control_chrome_docs": "Hướng dẫn MCP chính thức",
+  "mcp.control_chrome_edit": "Chỉnh sửa cài đặt",
+  "mcp.control_chrome_profile_hint": "Control Chrome thường mở profile Chrome riêng. Bật tùy chọn này nếu bạn muốn OpenWork dùng lại cửa sổ Chrome đang mở.",
+  "mcp.control_chrome_profile_title": "2. Chọn Chrome nào để dùng",
+  "mcp.control_chrome_save": "Lưu cài đặt",
+  "mcp.control_chrome_setup_subtitle": "Bật quyền truy cập Chrome, rồi chọn OpenWork nên dùng profile sạch hay gắn vào Chrome đang dùng.",
+  "mcp.control_chrome_setup_title": "Thiết lập Control Chrome",
+  "mcp.control_chrome_toggle_hint": "Khi bật, OpenWork thêm --autoConnect để MCP gắn vào phiên Chrome đã khởi động.",
+  "mcp.control_chrome_toggle_label": "Dùng profile Chrome hiện tại",
+  "mcp.control_chrome_toggle_off": "OpenWork sẽ mở profile Chrome riêng cho tự động hóa.",
+  "mcp.control_chrome_toggle_on": "OpenWork sẽ dùng lại tab, cookie và đăng nhập hiện tại của bạn.",
+  "mcp.custom_app_cta_hint": "Kết nối MCP server, công cụ nội bộ hoặc ứng dụng được lưu trữ của riêng bạn.",
+  "mcp.desktop_required": "Ứng dụng yêu cầu app desktop.",
+  "mcp.docs_link": "Tìm hiểu thêm",
+  "mcp.file_not_found": "Chưa tạo tệp cấu hình",
+  "mcp.friendly_status_issue": "Sự cố",
+  "mcp.friendly_status_needs_signin": "Cần đăng nhập",
+  "mcp.friendly_status_offline": "Ngoại tuyến",
+  "mcp.friendly_status_paused": "Tạm dừng",
+  "mcp.friendly_status_ready": "Sẵn sàng",
+  "mcp.last_synced": "Đã đồng bộ",
+  "mcp.login_action": "Đăng nhập",
+  "mcp.login_hint": "Kết nối tài khoản để hoàn tất thiết lập ứng dụng.",
+  "mcp.login_unavailable": "Ứng dụng này không hỗ trợ đăng nhập từ OpenWork.",
+  "mcp.logout_action": "Đăng xuất",
+  "mcp.logout_failed": "Đăng xuất thất bại.",
+  "mcp.logout_hint": "Xóa thông tin đăng nhập OAuth đã lưu. Bạn sẽ cần đăng nhập lại.",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "Thao tác này sẽ xóa thông tin OAuth đã lưu của {server}. Bạn sẽ cần đăng nhập lại để sử dụng.",
+  "mcp.logout_modal_title": "Đăng xuất khỏi ứng dụng?",
+  "mcp.logout_success": "Đã đăng xuất khỏi {server}.",
+  "mcp.logout_working": "Đang đăng xuất...",
+  "mcp.name_required": "Vui lòng nhập tên server.",
+  "mcp.no_apps_hint": "Kết nối một ứng dụng ở trên để bắt đầu.",
+  "mcp.no_apps_yet": "Chưa kết nối ứng dụng nào",
+  "mcp.oauth": "Đăng nhập",
+  "mcp.oauth_optional_hint": "Dùng OAuth trong trình duyệt để kết nối tài khoản của bạn.",
+  "mcp.oauth_optional_label": "Ứng dụng này yêu cầu đăng nhập",
+  "mcp.one_click_connect": "Kết nối một chạm",
+  "mcp.open_file": "Mở tệp",
+  "mcp.opening_label": "Đang mở...",
+  "mcp.pick_workspace_error": "Vui lòng chọn thư mục workspace trước.",
+  "mcp.pick_workspace_first": "Vui lòng chọn thư mục workspace trước.",
+  "mcp.quick_connect_chrome_desc": "Điều khiển tab Chrome với browser automation.",
+  "mcp.quick_connect_chrome_title": "Điều khiển Chrome",
+  "mcp.quick_connect_context7_desc": "Tìm kiếm tài liệu sản phẩm với ngữ cảnh phong phú hơn.",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "Lập kế hoạch sprint và xử lý ticket nhanh hơn.",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "Đồng bộ trang, cơ sở dữ liệu và tài liệu dự án.",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "Theo dõi bản phát hành và xử lý lỗi production.",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "Kiểm tra thanh toán, hóa đơn và đăng ký.",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "Dừng task đang chạy để kích hoạt.",
+  "mcp.remote_workspace_url_hint": "Workspace từ xa kết nối nhanh nhất với MCP server dạng URL.",
+  "mcp.remove_app": "Xóa",
+  "mcp.remove_failed": "Không thể xóa ứng dụng.",
+  "mcp.remove_modal_message": "Bạn có chắc muốn xóa {server}? Bạn luôn có thể thêm lại sau.",
+  "mcp.remove_modal_title": "Xóa ứng dụng",
+  "mcp.reveal_config_failed": "Không thể mở tệp cấu hình",
+  "mcp.reveal_in_finder": "Hiện trong Finder",
+  "mcp.scope_global": "Tất cả workspaces",
+  "mcp.scope_project": "Workspace này",
+  "mcp.server_command": "Lệnh",
+  "mcp.server_command_hint": "Lệnh shell để khởi động server.",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "Tên ứng dụng",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "Loại",
+  "mcp.server_url": "URL máy chủ",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "Đăng nhập",
+  "mcp.tap_to_connect": "Nhấn để kết nối",
+  "mcp.technical_details": "Chi tiết kỹ thuật",
+  "mcp.type_cloud": "Cloud (đăng nhập bằng tài khoản)",
+  "mcp.type_local": "Nội bộ (chạy trên thiết bị này)",
+  "mcp.type_local_cmd": "Nội bộ (lệnh)",
+  "mcp.type_remote": "Từ xa (URL)",
+  "mcp.url_or_command_required": "Nhập URL cho server từ xa hoặc lệnh cho server nội bộ.",
+  "mcp.your_apps": "Ứng dụng của bạn",
+  "model_behavior.desc_builtin": "Model này tự quyết định đường suy luận và không hiển thị cấu hình tại đây.",
+  "model_behavior.desc_generic": "Sử dụng cấu hình {label}.",
+  "model_behavior.desc_high": "Dành nhiều thời gian hơn để suy luận trước khi trả lời.",
+  "model_behavior.desc_high_anthropic": "Sử dụng ngân sách extended thinking tiêu chuẩn.",
+  "model_behavior.desc_low": "Thực hiện suy luận nhẹ trước khi trả lời.",
+  "model_behavior.desc_low_google": "Dùng ngân sách suy luận nhẹ hơn để phản hồi nhanh.",
+  "model_behavior.desc_max": "Sử dụng cấu hình suy luận sâu nhất của provider.",
+  "model_behavior.desc_max_anthropic": "Sử dụng ngân sách extended thinking lớn nhất.",
+  "model_behavior.desc_medium": "Cân bằng tốc độ và độ sâu suy luận.",
+  "model_behavior.desc_minimal": "Sử dụng lượng suy luận rất nhỏ.",
+  "model_behavior.desc_none": "Ưu tiên tốc độ với đường suy luận nhẹ nhất.",
+  "model_behavior.desc_standard": "Model này không cung cấp điều khiển suy luận bổ sung.",
+  "model_behavior.label_balanced": "Cân bằng",
+  "model_behavior.label_builtin": "Tích hợp",
+  "model_behavior.label_deep": "Sâu",
+  "model_behavior.label_extended": "Mở rộng",
+  "model_behavior.label_fast": "Nhanh",
+  "model_behavior.label_light": "Nhẹ",
+  "model_behavior.label_maximum": "Tối đa",
+  "model_behavior.label_quick": "Nhanh gọn",
+  "model_behavior.label_standard": "Tiêu chuẩn",
+  "model_behavior.title_builtin_reasoning": "Suy luận tích hợp",
+  "model_behavior.title_extended_thinking": "Extended thinking",
+  "model_behavior.title_reasoning_budget": "Reasoning budget",
+  "model_behavior.title_reasoning_effort": "Reasoning effort",
+  "model_behavior.title_standard_generation": "Tạo văn bản tiêu chuẩn",
+  "model_picker.chat_model_desc": "Chọn model cho cuộc trò chuyện này. Nếu model hỗ trợ hồ sơ suy luận, cấu hình trên thẻ của nó.",
+  "model_picker.chat_model_title": "Model cuộc trò chuyện",
+  "model_picker.connect_provider_hint": "Kết nối provider này để duyệt và lưu model",
+  "model_picker.default_model_desc": "Chọn model mặc định cho cuộc trò chuyện mới, rồi tinh chỉnh hồ sơ suy luận trên thẻ trước khi nhấn Xong.",
+  "model_picker.default_model_title": "Model mặc định",
+  "model_picker.model_count": "{count} model",
+  "model_picker.more_providers": "Thêm provider",
+  "model_picker.no_results": "Không có model phù hợp với tìm kiếm.",
+  "model_picker.other_connected_models": "Model đã kết nối khác",
+  "model_picker.recommended": "Đề xuất",
+  "onboarding.authorize_folder": "Cấp quyền thư mục",
+  "plugins.add": "Thêm",
+  "plugins.add_hint": "Thêm tên gói npm, ví dụ: opencode-wakatime",
+  "plugins.add_label": "Thêm plugin",
+  "plugins.added": "Đã thêm",
+  "plugins.config": "Cấu hình",
+  "plugins.config_label": "Cấu hình",
+  "plugins.desc": "Quản lý `opencode.json` cho dự án hoặc plugins OpenCode toàn cục.",
+  "plugins.empty": "Chưa cấu hình plugin nào.",
+  "plugins.enabled": "Đã bật",
+  "plugins.hide_setup": "Ẩn thiết lập",
+  "plugins.not_loaded": "Chưa tải",
+  "plugins.not_loaded_yet": "Chưa tải",
+  "plugins.remove": "Xóa",
+  "plugins.scope_global": "Toàn cục",
+  "plugins.scope_project": "Dự án",
+  "plugins.setup": "Thiết lập",
+  "plugins.suggested": "Plugins gợi ý",
+  "plugins.suggested_heading": "Plugins gợi ý",
+  "plugins.title": "OpenCode Plugins",
+  "providers.api_key_label": "API key",
+  "providers.api_key_required": "API key là bắt buộc",
+  "providers.auth_failed": "Xác thực thất bại",
+  "providers.connect_failed": "Kết nối provider thất bại",
+  "providers.disabled_in_config_suffix": "và đã tắt trong cấu hình OpenCode.",
+  "providers.disconnect_failed": "Ngắt kết nối provider thất bại",
+  "providers.disconnected_prefix": "Đã ngắt kết nối",
+  "providers.load_failed": "Tải providers thất bại",
+  "providers.no_oauth_prefix": "Không có luồng OAuth cho",
+  "providers.no_providers_available": "Không có provider khả dụng",
+  "providers.not_connected": "Chưa kết nối máy chủ",
+  "providers.not_oauth_flow_prefix": "Phương thức xác thực đã chọn không phải luồng OAuth cho",
+  "providers.oauth_failed": "Hoàn tất OAuth thất bại",
+  "providers.oauth_method_required": "Phương thức OAuth là bắt buộc",
+  "providers.provider_error": "Lỗi provider ({provider})",
+  "providers.provider_id_required": "ID provider là bắt buộc",
+  "providers.rate_limit_exceeded": "Vượt quá giới hạn tốc độ",
+  "providers.removal_unsupported": "Client này không hỗ trợ xóa xác thực provider.",
+  "providers.request_failed": "Yêu cầu thất bại",
+  "providers.save_api_key_failed": "Lưu API key thất bại",
+  "providers.still_connected_suffix": ", nhưng worker vẫn báo đã kết nối. Xóa API key hoặc thông tin OAuth còn lại và khởi động lại worker để ngắt hoàn toàn.",
+  "providers.unknown_provider": "Provider không xác định",
+  "providers.use_api_key_suffix": "Dùng API key thay thế.",
+  "question_modal.custom_answer_label": "Hoặc nhập câu trả lời tùy chỉnh",
+  "question_modal.custom_answer_placeholder": "Nhập câu trả lời của bạn...",
+  "question_modal.question_counter": "Câu hỏi {current} / {total}",
+  "session.allow_for_session": "Cho phép trong phiên này",
+  "session.allow_once": "Cho phép một lần",
+  "session.cmd_current_workspace": "Workspace hiện tại",
+  "session.cmd_new_session_detail": "Bắt đầu task mới trong workspace hiện tại",
+  "session.cmd_new_session_meta": "Tạo",
+  "session.cmd_new_session_title": "Tạo phiên mới",
+  "session.cmd_sessions_detail": "{count} khả dụng trên các workspace",
+  "session.cmd_sessions_meta": "Chuyển",
+  "session.cmd_sessions_title": "Tìm kiếm phiên",
+  "session.cmd_switch": "Chuyển",
+  "session.create_or_connect_workspace": "Tạo hoặc kết nối workspace",
+  "session.default_agent": "Agent mặc định",
+  "session.default_title": "Phiên mới",
+  "session.delete": "Xóa",
+  "session.delete_named_session_message": "Thao tác này sẽ xóa vĩnh viễn \"{title}\" và các tin nhắn.",
+  "session.delete_session_generic": "Thao tác này sẽ xóa vĩnh viễn phiên đã chọn và các tin nhắn.",
+  "session.delete_session_title": "Xóa phiên?",
+  "session.deleting": "Đang xóa...",
+  "session.deny": "Từ chối",
+  "session.details": "Chi tiết",
+  "session.details_label": "Chi tiết",
+  "session.doom_loop_label": "Vòng lặp lỗi",
+  "session.doom_loop_message": "OpenCode phát hiện lệnh gọi công cụ lặp lại với cùng đầu vào và hỏi xem có nên tiếp tục sau các lần thất bại lặp lại.",
+  "session.doom_loop_note": "Từ chối để dừng vòng lặp, hoặc cho phép nếu bạn muốn agent tiếp tục thử.",
+  "session.doom_loop_repeated_call_label": "Lệnh gọi lặp lại",
+  "session.doom_loop_repeated_tool_call": "Lệnh gọi công cụ lặp lại",
+  "session.doom_loop_title": "Phát hiện vòng lặp lỗi",
+  "session.doom_loop_tool_label": "Công cụ",
+  "session.export_already_running": "Đang xuất rồi.",
+  "session.export_desktop_only": "Xuất khả dụng trong ứng dụng desktop.",
+  "session.export_desktop_only_local": "Xuất khả dụng cho worker nội bộ trong ứng dụng desktop.",
+  "session.export_local_only": "Xuất chỉ hỗ trợ cho worker nội bộ.",
+  "session.loading_detail": "Đang tải tin nhắn mới nhất cho task này.",
+  "session.model": "Model",
+  "session.new_task": "Tạo task mới",
+  "session.open": "Mở",
+  "session.palette_hint_navigate": "Phím mũi tên để di chuyển",
+  "session.palette_hint_run": "Enter để chạy · Esc để đóng",
+  "session.palette_placeholder_actions": "Tìm thao tác",
+  "session.palette_placeholder_sessions": "Tìm theo tiêu đề phiên hoặc workspace",
+  "session.palette_title_actions": "Thao tác nhanh",
+  "session.palette_title_sessions": "Tìm kiếm phiên",
+  "session.permission_detail_command": "Lệnh",
+  "session.permission_detail_cwd": "Thư mục làm việc",
+  "session.permission_detail_description": "Mô tả",
+  "session.permission_detail_diff": "Diff",
+  "session.permission_detail_file": "Tệp",
+  "session.permission_detail_files": "Tệp",
+  "session.permission_detail_agent": "Agent",
+  "session.permission_detail_parent_directory": "Thư mục cha",
+  "session.permission_detail_path": "Đường dẫn",
+  "session.permission_detail_query": "Truy vấn",
+  "session.permission_detail_target": "Đích",
+  "session.permission_detail_tool": "Công cụ",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "Sửa tệp",
+  "session.permission_kind_external_directory": "Thư mục bên ngoài",
+  "session.permission_kind_question": "Câu hỏi",
+  "session.permission_kind_read": "Đọc tệp",
+  "session.permission_kind_skill": "Skill",
+  "session.permission_kind_task": "Tác vụ con",
+  "session.permission_kind_todowrite": "Ghi danh sách việc cần làm",
+  "session.permission_label": "Quyền",
+  "session.permission_message": "OpenCode đang yêu cầu quyền để tiếp tục.",
+  "session.permission_message_bash": "Xem phạm vi lệnh trước khi cho phép OpenCode tiếp tục.",
+  "session.permission_message_edit": "Xem tệp và diff trước khi cho phép OpenCode thay đổi.",
+  "session.permission_message_external_directory": "Xem thư mục trước khi cho phép truy cập ngoài workspace.",
+  "session.permission_message_read": "Xem phạm vi tệp được yêu cầu trước khi cho phép truy cập.",
+  "session.permission_message_task": "Xem tác vụ con được yêu cầu trước khi cho phép bắt đầu.",
+  "session.permission_metadata_unavailable": "Không thể hiển thị siêu dữ liệu.",
+  "session.permission_review_label": "Xem lại",
+  "session.permission_scope_empty": "Không có phạm vi cụ thể.",
+  "session.permission_decision_hint": "Cho phép một lần cho yêu cầu này, hoặc cho phép trong phiên khi bạn tin tưởng phạm vi này.",
+  "session.permission_title_bash": "Chạy lệnh shell?",
+  "session.permission_title_edit": "Sửa tệp?",
+  "session.permission_title_external_directory": "Truy cập thư mục bên ngoài?",
+  "session.permission_title_generic": "Phê duyệt {permission}?",
+  "session.permission_title_read": "Đọc tệp?",
+  "session.permission_title_task": "Bắt đầu tác vụ con?",
+  "session.redo_aria_label": "Làm lại tin nhắn đã hoàn tác",
+  "session.redo_label": "Làm lại",
+  "session.redo_title": "Làm lại tin nhắn đã hoàn tác",
+  "session.rename_description": "Cập nhật tên cho phiên này.",
+  "session.rename_label": "Tên phiên",
+  "session.rename_placeholder": "Nhập tên mới",
+  "session.rename_title": "Đổi tên phiên",
+  "session.resize_workspace_column": "Thay đổi kích thước cột workspace",
+  "session.revert_label": "Hoàn tác",
+  "session.scope_label": "Phạm vi",
+  "session.share_collaborator_hint": "Truy cập từ xa thông thường khi không cần thao tác chủ sở hữu.",
+  "session.share_collaborator_host_hint": "Truy cập từ xa thông thường tới máy chủ này mà không cần thao tác chủ sở hữu.",
+  "session.share_collaborator_label": "Token cộng tác",
+  "session.share_connected_with_hint": "Workspace này đang kết nối với mật khẩu này.",
+  "session.share_desktop_app_required": "Yêu cầu ứng dụng desktop",
+  "session.share_local_host_not_ready": "Máy chủ OpenWork nội bộ chưa sẵn sàng.",
+  "session.share_missing_host_url": "Thiếu URL máy chủ OpenWork.",
+  "session.share_missing_token": "Thiếu token OpenWork.",
+  "session.share_note_direct_runtime": "Engine runtime đang ở chế độ Trực tiếp. Chuyển worker nội bộ có thể khởi động lại máy chủ và ngắt kết nối client. Token có thể thay đổi sau khi khởi động lại.",
+  "session.share_opencode_base_url": "URL cơ sở OpenCode",
+  "session.share_openwork_workers_only": "Liên kết chia sẻ dịch vụ khả dụng cho worker OpenWork.",
+  "session.share_owner_permission_hint": "Dùng khi client từ xa cần trả lời yêu cầu quyền.",
+  "session.share_password": "Mật khẩu",
+  "session.share_select_workspace": "Chọn workspace trước.",
+  "session.share_set_token_hint": "Đặt token trong cài đặt workspace",
+  "session.share_starting_server": "Đang khởi động máy chủ...",
+  "session.share_worker_url": "URL Worker",
+  "session.share_worker_url_phones_hint": "Dùng trên điện thoại hoặc laptop kết nối worker này.",
+  "session.share_worker_url_resolving_hint": "URL Worker đang xử lý; URL máy chủ hiển thị tạm.",
+  "session.todo_progress": "{completed} / {total} task hoàn thành",
+  "session.undo_label": "Hoàn tác",
+  "session.undo_title": "Hoàn tác tin nhắn cuối",
+  "session.workspace_fallback": "Workspace",
+  "settings.api_keys_info": "API key được lưu cục bộ bởi OpenCode. Provider dựa trên biến môi trường phải thay đổi trong môi trường worker rồi tải lại.",
+  "settings.appearance_hint": "Theo hệ thống hoặc buộc chế độ sáng/tối.",
+  "settings.appearance_title": "Giao diện",
+  "settings.audit_log_title": "Nhật ký kiểm toán",
+  "settings.auto_compact": "Thu gọn ngữ cảnh tự động",
+  "settings.auto_compact_desc": "Kiểm soát thu gọn ngữ cảnh tự động của OpenCode cho workspace này. Tải lại engine sau khi thay đổi.",
+  "settings.auto_update_desc": "Tự động tải bản cập nhật (hỏi trước khi",
+  "settings.auto_update_title": "Tự động cập nhật",
+  "settings.background_checks_desc": "OpenWork luôn kiểm tra khi khởi động. Cũng kiểm tra một lần",
+  "settings.background_checks_title": "Kiểm tra nền",
+  "settings.cache_repair_requires_desktop": "Sửa bộ nhớ đệm yêu cầu ứng dụng desktop",
+  "settings.cap_browser_tools": "Công cụ trình duyệt: {value}",
+  "settings.cap_commands": "Commands: {value}",
+  "settings.cap_config": "Cấu hình: {value}",
+  "settings.cap_file_tools": "Công cụ tệp: {value}",
+  "settings.cap_inbox_off": "hộp đến tắt",
+  "settings.cap_inbox_on": "hộp đến bật",
+  "settings.cap_mcp": "MCP: {value}",
+  "settings.cap_outbox_off": "hộp đi tắt",
+  "settings.cap_outbox_on": "hộp đi bật",
+  "settings.cap_plugins": "Plugins: {value}",
+  "settings.cap_read": "đọc",
+  "settings.cap_sandbox": "Sandbox: {value}",
+  "settings.cap_skills": "Skills: {value}",
+  "settings.cap_write": "ghi",
+  "settings.capabilities_title": "Khả năng máy chủ OpenWork",
+  "settings.capabilities_unavailable": "Khả năng không khả dụng. Kết nối bằng token client.",
+  "settings.change": "Thay đổi",
+  "settings.choose": "Chọn",
+  "settings.clear": "Xóa",
+  "settings.configure": "Cấu hình",
+  "settings.connect_provider": "Kết nối provider",
+  "settings.connection": "Kết nối",
+  "settings.connection_failed": "Kết nối thất bại",
+  "settings.connection_title": "Kết nối",
+  "settings.copied_debug_report": "Đã sao chép báo cáo runtime JSON.",
+  "settings.copy_json": "Sao chép JSON",
+  "settings.custom_binary_hint": "Dùng để trỏ OpenWork đến bản build OpenCode nội bộ",
+  "settings.custom_binary_label": "File nhị phân OpenCode tùy chỉnh",
+  "settings.debug_commit": "Commit: {sha}",
+  "settings.debug_desktop_app": "Ứng dụng desktop: {version}",
+  "settings.debug_opencode_version": "OpenCode: {version}",
+  "settings.debug_openwork_server_version": "Máy chủ OpenWork: {version}",
+  "settings.deeplink_hint": "Chấp nhận openwork://, openwork-dev://, hoặc URL https://share.openworklabs.com/b/... hỗ trợ.",
+  "settings.delete_containers": "Đang xóa container...",
+  "settings.delete_local_config": "Đang xóa trạng thái cục bộ...",
+  "settings.dev_mode_badge": "Chế độ phát triển",
+  "settings.developer": "Nhà phát triển",
+  "settings.developer_mode_desc": "Bật công cụ gỡ lỗi, chẩn đoán và tab Nhà phát triển.",
+  "settings.developer_mode_title": "Chế độ nhà phát triển",
+  "settings.developer_panel_disabled": "Đã tắt bảng nhà phát triển.",
+  "settings.developer_panel_enabled": "Đã bật bảng nhà phát triển.",
+  "settings.diag_approval": "Phê duyệt: {mode} ({ms}ms)",
+  "settings.diag_config_path": "Đường dẫn cấu hình: {path}",
+  "settings.diag_default": "mặc định",
+  "settings.diag_host_token_source": "Nguồn token máy chủ: {source}",
+  "settings.diag_opencode_binary": "File nhị phân OpenCode: {binary}",
+  "settings.diag_read_only": "Chỉ đọc: {value}",
+  "settings.diag_runtime_workspace": "Workspace runtime: {id}",
+  "settings.diag_selected_workspace": "Workspace đã chọn: {id}",
+  "settings.diag_started": "Bắt đầu: {time}",
+  "settings.diag_token_source": "Nguồn token: {source}",
+  "settings.diag_workspaces": "Workspaces: {count}",
+  "settings.diagnostics_unavailable": "Chẩn đoán không khả dụng.",
+  "settings.disable_developer_mode": "Tắt chế độ Nhà phát triển",
+  "settings.disabled": "Đã tắt",
+  "settings.disconnect": "Ngắt kết nối",
+  "settings.disconnect_server": "Ngắt kết nối máy chủ",
+  "settings.disconnecting": "Đang ngắt kết nối...",
+  "settings.docker_containers_desc": "Buộc xóa container Docker do OpenWork tạo",
+  "settings.docker_containers_title": "Container Docker của OpenWork",
+  "settings.docker_requires_desktop": "Dọn dẹp Docker yêu cầu ứng dụng desktop",
+  "settings.done": "Xong",
+  "settings.enable_developer_mode": "Bật chế độ Nhà phát triển",
+  "settings.enable_exa": "Bật tìm kiếm web Exa",
+  "settings.enable_exa_desc": "Áp dụng khi OpenWork Orchestrator khởi chạy OpenCode.",
+  "settings.engine_bundled": "Đi kèm (khuyến nghị)",
+  "settings.engine_bundled_hint": "Engine đi kèm là tùy chọn đáng tin nhất. Dùng Hệ thống",
+  "settings.engine_custom_binary": "File nhị phân tùy chỉnh",
+  "settings.engine_desc": "Chọn cách OpenCode chạy nội bộ.",
+  "settings.engine_source": "Nguồn engine",
+  "settings.engine_source_debug": "Nguồn engine",
+  "settings.engine_system_path": "Cài đặt hệ thống (PATH)",
+  "settings.engine_title": "Engine",
+  "settings.environment.add_button": "Add variable",
+  "settings.environment.add_title": "Add environment variable",
+  "settings.environment.apply_button": "Apply changes",
+  "settings.environment.apply_blocked_active_tasks": "Stop running tasks before applying environment changes.",
+  "settings.environment.apply_confirm_body": "OpenWork will restart local agents so they can use the latest environment. Running local tasks may stop.",
+  "settings.environment.apply_no_local_workspace": "OpenWork is not connected to a local workspace.",
+  "settings.environment.apply_pending_body": "Apply changes to restart local agents and make the latest values available.",
+  "settings.environment.apply_pending_body_manual": "Restart local agents to make the latest values available.",
+  "settings.environment.apply_pending_title": "Changes are saved, not active yet",
+  "settings.environment.apply_refresh_failed": "Changes are active, but OpenWork status did not refresh. Reopen the app if it looks stale.",
+  "settings.environment.apply_success": "Environment changes are active.",
+  "settings.environment.apply_title": "Apply environment changes?",
+  "settings.environment.apply_unavailable": "Apply changes is only available in the desktop app.",
+  "settings.environment.applying": "Applying…",
+  "settings.environment.cancel": "Cancel",
+  "settings.environment.click_to_edit": "Click to edit",
+  "settings.environment.close_editor": "Close editor",
+  "settings.environment.confirm_delete": "Delete {key}? Agents stop seeing this key after you apply changes.",
+  "settings.environment.delete": "Delete",
+  "settings.environment.delete_title": "Delete environment variable",
+  "settings.environment.delete_variable": "Delete {key}",
+  "settings.environment.deleting": "Deleting…",
+  "settings.environment.description": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device; changes become available after you apply them.",
+  "settings.environment.edit_title": "Edit environment variable",
+  "settings.environment.empty_body": "Add keys like ANTHROPIC_API_KEY, GOOGLE_API_KEY, ELEVENLABS_API_KEY, or GITHUB_TOKEN for services your agents and MCP servers need.",
+  "settings.environment.empty_title": "No environment variables yet",
+  "settings.environment.empty_value": "(empty)",
+  "settings.environment.footer_hint": "OPENWORK_ and OPENCODE_ keys are reserved for app/runtime wiring. Configure OpenCode runtime settings from your shell.",
+  "settings.environment.hide": "Hide",
+  "settings.environment.hide_value": "Hide value for {key}",
+  "settings.environment.key_hint": "Letters, digits, and underscores. Cannot start with a digit.",
+  "settings.environment.key_label": "Key",
+  "settings.environment.loading": "Loading…",
+  "settings.environment.override_hint": "Environment variables set before OpenWork starts take precedence over values saved here.",
+  "settings.environment.remote_workspace_hint": "This workspace is remote. Local environment variables are hidden here; use cloud LLM Providers or configure the worker host directly.",
+  "settings.environment.restart_required": "Saved. Apply changes to make the update available.",
+  "settings.environment.reveal": "Reveal",
+  "settings.environment.reveal_value": "Reveal value for {key}",
+  "settings.environment.save": "Save",
+  "settings.environment.saving": "Saving…",
+  "settings.environment.title": "Environment variables",
+  "settings.environment.validation_duplicate": "A variable with this name already exists.",
+  "settings.environment.validation_empty": "Name is required.",
+  "settings.environment.validation_reserved": "OPENWORK_ and OPENCODE_ names are managed by OpenWork/OpenCode.",
+  "settings.environment.validation_shape": "Use letters, digits, and underscores; do not start with a digit.",
+  "settings.environment.value_label": "Value",
+  "settings.exa_restart_hint": "Khởi động lại OpenCode hoặc orchestrator sau khi thay đổi cài đặt này.",
+  "settings.export": "Xuất",
+  "settings.exported_debug_report": "Đã xuất báo cáo runtime JSON.",
+  "settings.feedback_badge": "Chúng tôi đọc từng tin nhắn",
+  "settings.feedback_desc": "Cho chúng tôi biết điều gì tuyệt vời và điều gì chưa ổn. Phản hồi sẽ được gửi thẳng đến nhóm và giúp chúng tôi ưu tiên những gì phát triển tiếp theo.",
+  "settings.feedback_title": "Góp phần định hình OpenWork",
+  "settings.group_global": "Toàn cục",
+  "settings.group_workspace": "Workspace",
+  "settings.hide_titlebar": "Ẩn thanh tiêu đề",
+  "settings.hide_titlebar_desc": "Ẩn thanh tiêu đề cửa sổ. Hữu ích cho trình quản lý cửa sổ xếp gạch",
+  "settings.join_discord": "Tham gia Discord",
+  "settings.language": "Ngôn ngữ",
+  "settings.language.description": "Chọn ngôn ngữ ưa thích",
+  "settings.last_error": "Lỗi cuối",
+  "settings.last_stderr": "Stderr cuối",
+  "settings.last_stdout": "Stdout cuối",
+  "settings.loading_providers": "Đang tải provider...",
+  "settings.managed_by_env": "Quản lý bởi biến môi trường",
+  "settings.model": "Model",
+  "settings.model_behavior": "Hành vi model",
+  "settings.model_behavior_desc": "Mở bộ chọn model mặc định để chọn hồ sơ suy luận khi có sẵn.",
+  "settings.model_section_desc": "Chọn model trò chuyện mặc định và xem xét cách nó suy luận.",
+  "settings.model_title": "Model",
+  "settings.no_active_workspace": "Không có workspace nội bộ đang hoạt động.",
+  "settings.no_audit_entries": "Chưa có mục kiểm toán.",
+  "settings.no_custom_path_set": "Chưa đặt đường dẫn tùy chỉnh",
+  "settings.nuke_hint": "Chỉ dùng khi bạn muốn đặt lại hoàn toàn ứng dụng desktop và trạng thái runtime OpenCode.",
+  "settings.off": "Tắt",
+  "settings.on": "Bật",
+  "settings.open_deeplink_action": "Đang mở...",
+  "settings.open_deeplink_button": "Ẩn",
+  "settings.open_deeplink_desc": "Dán deeplink hoặc URL chia sẻ OpenWork để mở.",
+  "settings.open_deeplink_title": "Mở Deeplink",
+  "settings.opencode_cache": "Bộ nhớ đệm OpenCode",
+  "settings.opencode_cache_description": "Sửa dữ liệu đệm dùng để khởi động engine. An toàn để chạy.",
+  "settings.opencode_engine_desc": "Runtime nội bộ cho agents, tools và provider mô hình.",
+  "settings.opencode_engine_label": "Engine OpenCode",
+  "settings.opencode_engine_sidecar_desc": "Sidecar thực thi nội bộ.",
+  "settings.opencode_sdk_desc": "Chẩn đoán kết nối giao diện.",
+  "settings.opencode_sdk_title": "Engine OpenCode",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "Mở deeplink",
+  "settings.openwork_config_sidecar_desc": "Sidecar cấu hình và phê duyệt.",
+  "settings.openwork_diagnostics_title": "Chẩn đoán máy chủ OpenWork",
+  "settings.openwork_server_desc": "Trung tâm điều phối phiên cho đồng bộ ứng dụng, workers và kết nối từ xa.",
+  "settings.openwork_server_label": "Máy chủ OpenWork",
+  "settings.pending_permissions": "Quyền đang chờ",
+  "settings.production_mode_badge": "Production",
+  "settings.provider_default_desc": "Sử dụng hành vi suy luận mặc định tích hợp sẵn của model.",
+  "settings.provider_default_label": "Mặc định của provider",
+  "settings.provider_source_config": "Cấu hình",
+  "settings.provider_source_custom": "Tùy chỉnh",
+  "settings.provider_source_env": "Biến môi trường",
+  "settings.providers_desc": "Kết nối dịch vụ cho models và công cụ.",
+  "settings.providers_title": "Providers",
+  "settings.quit_hint": "OpenWork thoát ngay sau khi dọn dẹp để lần khởi động tiếp theo bắt đầu từ trạng thái cục bộ trống cho chế độ này.",
+  "settings.recent_events": "Sự kiện gần đây",
+  "settings.reconnect_failed": "Kết nối lại thất bại. Kiểm tra URL/token máy chủ và thử lại.",
+  "settings.reconnect_server": "Đang kết nối lại...",
+  "settings.reconnect_server_failed": "Kết nối lại máy chủ OpenWork thất bại.",
+  "settings.reconnected": "Đã kết nối lại máy chủ OpenWork.",
+  "settings.reconnecting": "Đang kết nối lại...",
+  "settings.removing_containers": "Đang xóa container...",
+  "settings.removing_local_state": "Đang xóa trạng thái cục bộ...",
+  "settings.repair_cache": "Sửa bộ nhớ đệm",
+  "settings.repairing_cache": "Đang sửa bộ nhớ đệm",
+  "settings.report_issue": "Báo cáo sự cố",
+  "settings.reset": "Đặt lại",
+  "settings.reset_app_data": "Đặt lại dữ liệu ứng dụng",
+  "settings.reset_app_data_description": "Triệt để hơn. Xóa bộ nhớ đệm + dữ liệu ứng dụng OpenWork.",
+  "settings.reset_app_data_title": "Đặt lại dữ liệu ứng dụng",
+  "settings.reset_app_data_warning": "Xóa bộ nhớ đệm và dữ liệu ứng dụng OpenWork trên thiết bị này.",
+  "settings.reset_button": "Đặt lại",
+  "settings.reset_cancel": "Hủy",
+  "settings.reset_config_defaults": "Đang đặt lại...",
+  "settings.reset_confirm_button": "Đặt lại & Khởi động lại",
+  "settings.reset_confirmation_hint": "Nhập {resetWord} để xác nhận. OpenWork sẽ khởi động lại.",
+  "settings.reset_confirmation_label": "Xác nhận",
+  "settings.reset_confirmation_placeholder": "Nhập RESET",
+  "settings.reset_onboarding": "Đặt lại thiết lập ban đầu",
+  "settings.reset_onboarding_description": "Xóa tùy chọn OpenWork và khởi động lại ứng dụng.",
+  "settings.reset_onboarding_title": "Đặt lại thiết lập ban đầu",
+  "settings.reset_onboarding_warning": "Xóa tùy chọn cục bộ và đánh dấu thiết lập ban đầu của OpenWork.",
+  "settings.reset_openwork_desc_dev": "Với chế độ dev, chỉ xóa trạng thái OpenCode dev riêng biệt trong openwork-dev-data.",
+  "settings.reset_openwork_desc_prod": "Với chế độ dev, chỉ xóa trạng thái OpenCode dev riêng biệt trong openwork-dev-data.",
+  "settings.reset_openwork_title": "Đặt lại trạng thái OpenWork + OpenCode",
+  "settings.reset_requires_confirm": "Yêu cầu nhập RESET và sẽ khởi động lại ứng dụng.",
+  "settings.reset_startup": "Đặt lại chế độ khởi động mặc định",
+  "settings.reset_startup_pref": "Đặt lại tùy chọn khởi động",
+  "settings.reset_stop_active_runs": "Dừng các task đang chạy trước khi đặt lại.",
+  "settings.resetting": "Đang đặt lại...",
+  "settings.restart_blocked_message": "OpenWork cần khởi động lại để hoàn tất cập nhật. Để tránh gián đoạn công việc hiện tại, cài đặt bị tạm dừng cho đến khi task đang chạy hoàn tất hoặc bạn dừng chúng.",
+  "settings.restart_failed": "Khởi động lại thất bại. Kiểm tra nhật ký và thử lại.",
+  "settings.restart_opencode": "Đang khởi động lại...",
+  "settings.restart_openwork_server": "Đang khởi động lại...",
+  "settings.restart_server_failed": "Khởi động lại máy chủ nội bộ thất bại.",
+  "settings.restarted": "Đã khởi động lại máy chủ nội bộ.",
+  "settings.restarting": "Đang khởi động lại...",
+  "settings.reveal_config": "Hiện cấu hình",
+  "settings.reveal_config_requires_desktop": "Hiện cấu hình yêu cầu ứng dụng desktop",
+  "settings.run_sandbox_probe": "Đang chạy kiểm tra...",
+  "settings.running_probe": "Đang chạy kiểm tra...",
+  "settings.runtime_debug_desc": "Bản chụp chẩn đoán dễ đọc với xuất một cú nhấp.",
+  "settings.runtime_debug_title": "Báo cáo gỡ lỗi runtime",
+  "settings.runtime_desc": "Trạng thái engine nội bộ và máy chủ OpenWork.",
+  "settings.runtime_title": "Runtime",
+  "settings.sandbox_error": "Lỗi",
+  "settings.sandbox_export_hint": "Dùng Xuất trong Báo cáo gỡ lỗi runtime ở trên để",
+  "settings.sandbox_probe_desc": "Chạy kiểm tra khởi động sandbox Docker tạm thời và",
+  "settings.sandbox_probe_success": "Kiểm tra sandbox thành công. Xuất báo cáo gỡ lỗi để hỗ trợ.",
+  "settings.sandbox_probe_title": "Kiểm tra sandbox",
+  "settings.sandbox_ready": "Sẵn sàng",
+  "settings.sandbox_requires_desktop": "Kiểm tra sandbox yêu cầu ứng dụng desktop",
+  "settings.sandbox_result": "Kết quả: {status}",
+  "settings.sandbox_run_id": "ID chạy: {id}",
+  "settings.sandbox_stop_runs_hint": "Dừng task đang chạy trước khi kiểm tra",
+  "settings.search_models": "Tìm model…",
+  "settings.send_feedback": "Gửi phản hồi",
+  "settings.show_model_reasoning": "Hiển thị suy luận model",
+  "settings.show_model_reasoning_desc": "Mở rộng dấu vết suy luận trong giao diện khi model cung cấp.",
+  "settings.showing_models": "Hiển thị {count} / {total}",
+  "settings.startup": "Khởi động",
+  "settings.startup_remote_warning": "Tùy chọn khởi động hiện là từ xa. Cài đặt engine",
+  "settings.startup_reset_hint": "Xóa tùy chọn đã lưu và hiện lựa chọn kết nối",
+  "settings.startup_title": "Khởi động",
+  "settings.stop_local_server": "Dừng máy chủ nội bộ",
+  "settings.stop_runs_before_cleanup": "Dừng task đang chạy trước khi dọn dẹp",
+  "settings.stop_runs_before_reset_config": "Dừng task đang chạy trước khi đặt lại cấu hình",
+  "settings.stop_runs_to_reset": "Dừng task đang chạy để đặt lại",
+  "settings.switch": "Chuyển",
+  "settings.tab_advanced": "Nâng cao",
+  "settings.tab_appearance": "Giao diện",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "Gỡ lỗi",
+  "settings.tab_description_advanced": "Kiểm tra trạng thái runtime, kết nối và điều khiển dành cho nhà phát triển.",
+  "settings.tab_description_appearance": "Điều chỉnh giao diện OpenWork trên desktop, giao diện hệ thống và chrome ứng dụng.",
+  "settings.tab_description_debug": "Xem chẩn đoán runtime, nhật ký và tiện ích gỡ lỗi cấp thấp.",
+  "settings.tab_description_den": "Quản lý kết nối OpenWork Cloud, worker được lưu trữ và quyền truy cập workspace.",
+  "settings.tab_description_environment": "Save API keys and tokens for local agents, skills, and MCP servers. Secrets stay on this device.",
+  "settings.tab_description_extensions": "Quản lý ứng dụng MCP và plugins OpenCode cho workspace này.",
+  "settings.tab_description_general": "Kết nối provider, chọn model mặc định, cấp quyền thư mục và kiểm soát workspace OpenWork cùng kết nối runtime.",
+  "settings.tab_description_recovery": "Sửa trạng thái di chuyển, đặt lại mặc định workspace và khôi phục cài đặt cục bộ.",
+  "settings.tab_description_skills": "Duyệt, chỉnh sửa và cài đặt skills mà không cần rời cài đặt.",
+  "settings.tab_description_updates": "Giữ ứng dụng luôn cập nhật với kiểm tra nền im lặng và điều khiển cài đặt.",
+  "settings.tab_environment": "Environment",
+  "settings.tab_extensions": "Tiện ích mở rộng",
+  "settings.tab_general": "Cài đặt",
+  "settings.tab_recovery": "Khôi phục",
+  "settings.tab_skills": "Skills",
+  "settings.tab_updates": "Cập nhật",
+  "settings.theme_dark": "Tối",
+  "settings.theme_light": "Sáng",
+  "settings.theme_system": "Hệ thống",
+  "settings.theme_system_hint": "Chế độ hệ thống tự động theo tùy chọn hệ điều hành.",
+  "settings.update": "Cập nhật",
+  "settings.update_available": "Có bản cập nhật: v",
+  "settings.update_available_version": "Có bản cập nhật: v{version}",
+  "settings.update_check_button": "Kiểm tra",
+  "settings.update_check_failed": "Kiểm tra cập nhật thất bại",
+  "settings.update_checking": "Đang kiểm tra...",
+  "settings.update_download_button": "Tải xuống",
+  "settings.update_downloading": "Đang tải xuống...",
+  "settings.update_install_button": "Cài đặt & Khởi động lại",
+  "settings.update_last_checked": "Kiểm tra lần cuối {time}",
+  "settings.update_published": "Phát hành {date}",
+  "settings.update_ready": "Sẵn sàng cài đặt: v",
+  "settings.update_ready_version": "Sẵn sàng cài đặt: v{version}",
+  "settings.update_uptodate": "Đã cập nhật mới nhất",
+  "settings.updates": "Cập nhật",
+  "settings.updates_desc": "Giữ OpenWork luôn cập nhật.",
+  "settings.updates_desktop_only": "Cập nhật chỉ khả dụng trong ứng dụng desktop.",
+  "settings.updates_not_supported": "Cập nhật không được hỗ trợ trong môi trường này.",
+  "settings.updates_title": "Cập nhật",
+  "settings.window_appearance_desc": "Tùy chỉnh giao diện cửa sổ.",
+  "settings.worker_id_label": "Worker {id}",
+  "settings.worker_unresolved": "Worker {runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "Cấu hình workspace",
+  "settings.workspace_debug_events_label": "Sự kiện gỡ lỗi workspace",
+  "share.back_hint": "Quay lại tùy chọn chia sẻ",
+  "share.chooser_subtitle": "Chọn cách bạn muốn chia sẻ workspace này.",
+  "share.close_hint": "Đóng",
+  "share.option_access_desc": "Hiện chi tiết kết nối trực tiếp để truy cập workspace này từ máy khác.",
+  "share.option_access_title": "Truy cập workspace từ xa",
+  "share.subtitle_access": "Hiện chi tiết kết nối trực tiếp để truy cập workspace này từ máy khác.",
+  "share.title": "Chia sẻ workspace",
+  "share.view_access": "Truy cập workspace từ xa",
+  "share.workspace_fallback": "Workspace",
+  "share_skill_destination.add_to_workspace": "Thêm vào workspace",
+  "share_skill_destination.adding": "Đang thêm...",
+  "share_skill_destination.connect_remote": "Kết nối workspace từ xa",
+  "share_skill_destination.connect_remote_hint": "Kết nối workspace từ xa để nhập skill này.",
+  "share_skill_destination.create_worker": "Tạo workspace mới",
+  "share_skill_destination.create_worker_hint": "Tạo workspace mới để cài skill này.",
+  "share_skill_destination.current_badge": "Hiện tại",
+  "share_skill_destination.existing_workers": "Workspace hiện có",
+  "share_skill_destination.fallback_skill_name": "Skill chia sẻ",
+  "share_skill_destination.local_badge": "Nội bộ",
+  "share_skill_destination.more_options": "Thêm tùy chọn",
+  "share_skill_destination.no_workers": "Chưa có workspace sẵn sàng. Tạo workspace hoặc kết nối workspace từ xa để cài skill này.",
+  "share_skill_destination.remote_badge": "Từ xa",
+  "share_skill_destination.sandbox_badge": "Sandbox",
+  "share_skill_destination.selected_badge": "Đã chọn",
+  "share_skill_destination.selected_hint": "Đã chọn. Xem lại đích bên dưới, rồi xác nhận.",
+  "share_skill_destination.skill_label": "Skill chia sẻ",
+  "share_skill_destination.subtitle": "Chọn workspace hiện có hoặc tạo mới trước khi nhập skill chia sẻ này.",
+  "share_skill_destination.title": "Skill này nên đặt ở đâu?",
+  "share_skill_destination.trigger_label": "Kích hoạt",
+  "sidebar.collapse": "Thu gọn",
+  "sidebar.expand": "Mở rộng",
+  "skills.add_custom_repo": "Thêm repo GitHub tùy chỉnh",
+  "skills.add_git_repo": "Thêm repo git",
+  "skills.add_openwork_hub": "Thêm OpenWork Hub",
+  "skills.available_from_hub": "Có sẵn từ Hub",
+  "skills.catalog_search_placeholder": "Tìm skills đã cài, nhóm và hub",
+  "skills.cloud_choose_org_detail": "Dùng bảng Cloud để chọn tổ chức, rồi làm mới danh sách này.",
+  "skills.cloud_choose_org_hint": "Chọn tổ chức trong Cài đặt → Cloud để tải skills nhóm.",
+  "skills.cloud_footer_label": "Nhóm",
+  "skills.cloud_hub_label": "Hub: {name}",
+  "skills.cloud_installed": "Đã cài {name} lên worker này.",
+  "skills.cloud_installing": "Đang cài {title}…",
+  "skills.cloud_installing_short": "Đang cài",
+  "skills.cloud_no_search_matches": "Không có skill phù hợp.",
+  "skills.cloud_org_empty": "Chưa có skills tổ chức.",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "Tải skills tổ chức thất bại.",
+  "skills.cloud_refresh": "Làm mới skills nhóm",
+  "skills.cloud_section_subtitle": "Skills được chia sẻ với bạn qua OpenWork Cloud — bao gồm skill hub nhóm mà bạn có quyền truy cập.",
+  "skills.cloud_section_title": "Từ tổ chức của bạn",
+  "skills.cloud_shared_org": "Tổ chức",
+  "skills.cloud_shared_public": "Công khai",
+  "skills.cloud_sign_in": "Đăng nhập Cloud",
+  "skills.cloud_sign_in_hint": "Đăng nhập OpenWork Cloud để duyệt skills nhóm và tổ chức.",
+  "skills.copy_link_failed": "Sao chép liên kết thất bại",
+  "skills.create_in_chat": "Tạo skill trong chat",
+  "skills.desktop_required": "Quản lý skills yêu cầu ứng dụng desktop.",
+  "skills.enter_plugin_name": "Nhập tên gói plugin.",
+  "skills.failed_load_active": "Tải plugins đang hoạt động thất bại.",
+  "skills.failed_load_opencode": "Tải opencode.json thất bại",
+  "skills.failed_parse_opencode": "Phân tích opencode.json thất bại",
+  "skills.failed_to_load": "Tải skills thất bại",
+  "skills.failed_update_opencode": "Cập nhật opencode.json thất bại",
+  "skills.filter_all": "Tất cả",
+  "skills.filter_cloud": "Nhóm",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "Đã cài",
+  "skills.from_repo": "Từ {owner}/{repo}",
+  "skills.github_repo_hint": "Nhập repo GitHub theo định dạng owner/repo.",
+  "skills.host_mode_only": "Chỉ workspace nội bộ",
+  "skills.host_only_error": "Quản lý skills yêu cầu workspace nội bộ hoặc máy chủ OpenWork đã kết nối.",
+  "skills.hub_desc": "Duyệt skills chia sẻ từ hub dựa trên GitHub và thêm vào worker này.",
+  "skills.hub_label": "Hub",
+  "skills.import": "Nhập",
+  "skills.import_failed": "Nhập thất bại ({status})",
+  "skills.import_local": "Nhập skill từ máy",
+  "skills.import_local_skill": "Nhập skill từ máy",
+  "skills.imported": "Đã nhập.",
+  "skills.install": "Cài đặt",
+  "skills.install_failed": "Cài đặt skill thất bại.",
+  "skills.install_name_title": "Cài đặt {name}",
+  "skills.installed": "Skills đã cài",
+  "skills.installed_desc": "Skills đã cài nằm trên worker này và có thể chỉnh sửa hoặc chia sẻ.",
+  "skills.installed_status": "Đã cài",
+  "skills.installing": "Thêm skill",
+  "skills.installing_prefix": "Đang cài {name}…",
+  "skills.installing_skill_creator": "Đang cài skill creator...",
+  "skills.link_copied": "Đã sao chép liên kết",
+  "skills.loading": "Đang tải…",
+  "skills.no_description": "Chưa có mô tả.",
+  "skills.no_hub_repo_label": "Chưa chọn repo hub",
+  "skills.no_hub_repo_selected": "Không có skills hub khả dụng.",
+  "skills.no_hub_skills": "Chưa chọn repo hub. Thêm repo GitHub để duyệt skills.",
+  "skills.no_opencode_found": "Chưa tìm thấy opencode.json. Thêm plugin để tạo một file.",
+  "skills.no_opencode_workspace": "Chưa có opencode.json trong workspace này.",
+  "skills.no_skills": "Không phát hiện skills trong `.opencode/skills`, `.claude/skills`, hoặc `~/.agents/skills`.",
+  "skills.no_skills_found": "Chưa tìm thấy skills nào.",
+  "skills.owner_label": "Chủ sở hữu",
+  "skills.owner_repo_required": "Chủ sở hữu và repo là bắt buộc.",
+  "skills.pick_project_first": "Vui lòng chọn thư mục dự án trước.",
+  "skills.pick_project_for_active": "Chọn thư mục dự án để tải plugins đang hoạt động.",
+  "skills.pick_project_for_plugins": "Chọn thư mục dự án để quản lý plugins.",
+  "skills.pick_workspace_first": "Vui lòng chọn thư mục workspace trước.",
+  "skills.plugin_already_listed": "Plugin đã có trong opencode.json.",
+  "skills.plugin_management_host_only": "Quản lý plugins yêu cầu ứng dụng desktop.",
+  "skills.plugins_host_only": "Plugins chỉ khả dụng trong ứng dụng desktop.",
+  "skills.ref_label": "Ref (branch/tag/commit)",
+  "skills.refresh": "Làm mới",
+  "skills.refresh_hub": "Làm mới hub",
+  "skills.remove_saved_repo": "Xóa repo đã lưu",
+  "skills.repo_label": "Repo",
+  "skills.reveal_failed": "Không thể mở thư mục skills.",
+  "skills.reveal_folder": "Mở thư mục skills",
+  "skills.save_and_load": "Lưu và tải",
+  "skills.select_skill_folder": "Chọn thư mục skill",
+  "skills.share_back": "Quay lại",
+  "skills.share_chooser_subtitle": "Lưu vào tổ chức OpenWork Cloud hoặc tạo liên kết cài đặt công khai.",
+  "skills.share_close": "Đóng",
+  "skills.share_copy_link": "Sao chép",
+  "skills.share_done": "Xong",
+  "skills.share_option_public_desc": "Tạo liên kết để mọi người cài skill này.",
+  "skills.share_option_public_title": "Liên kết công khai",
+  "skills.share_option_team_desc": "Thêm skill này vào tổ chức OpenWork Cloud đang chọn.",
+  "skills.share_option_team_title": "Chia sẻ với nhóm",
+  "skills.share_public_create": "Tạo liên kết",
+  "skills.share_public_creating": "Đang xuất bản…",
+  "skills.share_public_intro": "Tạo liên kết công khai. Ai có URL đều có thể cài skill.",
+  "skills.share_public_regenerate": "Tạo lại liên kết",
+  "skills.share_publisher_label": "Nhà phát hành",
+  "skills.share_subtitle_public": "Ai có liên kết cũng có thể cài skill này.",
+  "skills.share_subtitle_team": "Lưu trong tổ chức để đồng đội dùng.",
+  "skills.share_team_choose_org": "Chọn tổ chức trong Cài đặt → Cloud trước khi chia sẻ.",
+  "skills.share_team_hubs_loading": "Đang tải hub…",
+  "skills.share_team_org_fallback": "Tổ chức Cloud hiện tại",
+  "skills.share_team_sign_in": "Đăng nhập để chia sẻ với nhóm",
+  "skills.share_team_sign_in_hint": "OpenWork Cloud mở trong trình duyệt. Đăng nhập rồi quay lại đây.",
+  "skills.share_title": "Chia sẻ skill",
+  "skills.shown_count": "{count} hiển thị",
+  "skills.skill_creator_already_installed": "Skill creator đã được cài rồi.",
+  "skills.skill_creator_installed": "Đã cài skill creator.",
+  "skills.skill_load_failed": "Tải skill thất bại.",
+  "skills.source_label": "Nguồn",
+  "skills.title": "Skills",
+  "skills.trigger_label": "Kích hoạt: {trigger}",
+  "skills.uninstall": "Gỡ cài đặt",
+  "skills.uninstall_failed": "Gỡ skill thất bại.",
+  "skills.uninstall_title": "Gỡ skill này?",
+  "skills.uninstall_warning": "Thao tác này sẽ xóa vĩnh viễn skill `{name}` khỏi workspace của bạn.",
+  "skills.uninstalled": "Đã gỡ skill.",
+  "skills.unknown_error": "Lỗi không xác định",
+  "skills.worker_profile_desc": "Skills là khả năng cốt lõi của worker này. Khám phá từ Hub, quản lý những gì đã cài và tạo mới trực tiếp trong chat.",
+  "status.back": "Quay lại màn hình trước",
+  "status.connected": "Đã kết nối",
+  "status.connecting": "Đang kết nối",
+  "status.creating_task": "Đang tạo task mới",
+  "status.developer_mode": "Chế độ nhà phát triển",
+  "status.disconnected": "Đã ngắt kết nối",
+  "status.disconnected_hint": "Mở cài đặt để kết nối lại",
+  "status.disconnected_label": "Đã ngắt kết nối",
+  "status.docs": "Tài liệu",
+  "status.feedback": "Phản hồi",
+  "status.limited_hint": "Kết nối lại để khôi phục đầy đủ tính năng OpenWork",
+  "status.limited_mcp_hint": "{count} MCP đã kết nối · kết nối lại để có đầy đủ tính năng",
+  "status.limited_mode": "Chế độ giới hạn",
+  "status.loading_session": "Đang tải phiên",
+  "status.mcp_connected": "{count} MCP đã kết nối",
+  "status.open_docs": "Mở tài liệu",
+  "status.openwork_ready": "OpenWork sẵn sàng",
+  "status.providers_connected": "{count} provider đã kết nối",
+  "status.ready_for_tasks": "Sẵn sàng cho task mới",
+  "status.running": "Đang chạy",
+  "status.send_feedback": "Gửi phản hồi",
+  "status.settings": "Cài đặt",
+  "system.reload_body_agents": "OpenCode tải agent khi khởi động. Tải lại engine để agent cập nhật có sẵn.",
+  "system.reload_body_commands": "OpenCode tải command khi khởi động. Tải lại engine để command cập nhật có sẵn.",
+  "system.reload_body_config": "OpenCode đọc opencode.json khi khởi động. Tải lại engine để áp dụng thay đổi cấu hình.",
+  "system.reload_body_default": "OpenWork phát hiện thay đổi cần tải lại OpenCode.",
+  "system.reload_body_mcp": "OpenCode tải MCP server khi khởi động. Tải lại engine để kích hoạt kết nối mới.",
+  "system.reload_body_mixed": "OpenWork phát hiện thay đổi cấu hình OpenCode. Tải lại engine để áp dụng.",
+  "system.reload_body_plugins": "OpenCode tải plugin npm khi khởi động. Tải lại engine để áp dụng thay đổi opencode.json.",
+  "system.reload_body_skills": "OpenCode có thể cache trạng thái skill. Tải lại engine để skill mới có sẵn.",
+  "system.reload_failed": "Không thể tải lại engine.",
+  "system.reload_required": "Cần tải lại",
+  "system.reload_unavailable": "Không thể tải lại cho worker này.",
+  "system.stop_active_runs_before_reset": "Dừng các lượt chạy đang hoạt động trước khi đặt lại.",
+  "time.hours_ago": "{count} giờ trước",
+  "time.just_now": "vừa xong",
+  "time.minutes_ago": "{count} phút trước",
+  "time.seconds_ago": "{count} giây trước",
+  "workspace.loading_tasks": "Đang tải task...",
+  "workspace.local_badge": "Nội bộ",
+  "workspace.new_task_inline": "+ Task mới",
+  "workspace.no_tasks": "Chưa có task.",
+  "workspace.remote_badge": "Từ xa",
+  "workspace.rename_description": "Cập nhật tên hiển thị trên thanh bên.",
+  "workspace.rename_label": "Tên workspace",
+  "workspace.rename_placeholder": "Workspace nhóm thiết kế",
+  "workspace.rename_title": "Đổi tên workspace",
+  "workspace.sandbox_badge": "Sandbox",
+  "workspace.selected": "Đã chọn",
+  "workspace_list.add_workspace": "Thêm workspace",
+  "workspace_list.connecting": "Đang kết nối...",
+  "workspace_list.delete_session": "Xóa phiên",
+  "workspace_list.edit_connection": "Chỉnh sửa kết nối",
+  "workspace_list.edit_name": "Chỉnh sửa tên",
+  "workspace_list.hide_child_sessions": "Ẩn phiên con",
+  "workspace_list.recover": "Khôi phục",
+  "workspace_list.remote_worker_unavailable": "Worker từ xa không khả dụng",
+  "workspace_list.remote_worker_unavailable_hint": "OpenWork không thể tải tác vụ từ worker này cho đến khi kết nối được sửa.",
+  "workspace_list.remove_workspace": "Xóa workspace",
+  "workspace_list.rename_session": "Đổi tên phiên",
+  "workspace_list.reveal_explorer": "Hiện trong Explorer",
+  "workspace_list.reveal_finder": "Hiện trong Finder",
+  "workspace_list.session_actions": "Thao tác phiên",
+  "workspace_list.share": "Chia sẻ...",
+  "workspace_list.show_child_sessions": "Hiện phiên con",
+  "workspace_list.show_more": "Hiện thêm {count}",
+  "workspace_list.show_more_fallback": "Hiện thêm",
+  "workspace_list.test_connection": "Kiểm tra kết nối",
+  "workspace_list.unavailable": "Không khả dụng",
+  "workspace_list.workspace_fallback": "Workspace",
+  "workspace_list.workspace_options": "Tùy chọn workspace",
+} as const;
diff --git a/apps/app/src/i18n/locales/zh.ts b/apps/app/src/i18n/locales/zh.ts
new file mode 100644
index 0000000000..df15ce31b2
--- /dev/null
+++ b/apps/app/src/i18n/locales/zh.ts
@@ -0,0 +1,1381 @@
+/**
+ * 中文（简体）翻译
+ * 产品名称保留英文：OpenCode、OpenPackage、OpenWork
+ * Skills：标题用"Skills（技能）"，正文用"skills"
+ * MCP：协议名称保留英文，不翻译为"应用"
+ * 翻译的术语：命令(Commands)、插件(Plugins)、会话(Sessions)、应用(Apps)
+ */
+
+export default {
+  "app.compact_command_desc": "压缩此会话以减少上下文大小。",
+  "app.error_audit_load": "加载审计日志失败。",
+  "app.error_auth_failed": "认证失败",
+  "app.error_command_not_resolved": "命令未解析。",
+  "app.error_compact_empty": "暂无可压缩的内容。",
+  "app.error_compact_no_session": "请先选择一个有消息的会话再运行/compact。",
+  "app.error_compact_no_session_id": "请先选择一个会话再压缩。",
+  "app.error_connect_first": "请先连接到此工作区再应用运行时更改。",
+  "app.error_not_connected": "未连接到服务器",
+  "app.error_rate_limit": "请求频率超限",
+  "app.error_remote_access": "更新远程访问失败。",
+  "app.error_request_failed": "请求失败",
+  "app.error_restart_local_worker": "使用更新的共享设置重启本地工作区失败。",
+  "app.error_session_name_required": "会话名称为必填项",
+  "app.local_disabled_reason": "本地工作区需在桌面应用中创建。远程和共享工作区仍可正常使用。",
+  "app.model_behavior_title": "模型行为",
+  "app.plugins_hint_readonly": "OpenWork服务器对插件为只读模式。",
+  "app.reload_later": "稍后",
+  "app.reload_now": "立即重新加载",
+  "app.reload_stop_tasks": "重新加载并停止任务",
+  "app.skills_hint_readonly": "OpenWork服务器对skills为只读模式。请在高级设置中添加主机令牌以启用安装。",
+  "app.unknown_error": "未知错误",
+  "blueprint.automation_body": "从可复用的工作流开始，或在下方输入你的任务。",
+  "blueprint.automation_title": "你想自动化什么？",
+  "blueprint.csv_session_assistant": "我可以帮你生成、清洗、合并和汇总CSV文件。你想自动化哪种CSV工作？",
+  "blueprint.csv_session_title": "CSV工作流创意",
+  "blueprint.csv_session_user": "我想把多个工具的导出合并成一个整洁的CSV。",
+  "blueprint.empty_body": "选择一个起点，或直接在下方输入。",
+  "blueprint.empty_title": "你想做什么？",
+  "blueprint.minimal_body": "询问关于此工作区的问题，或使用启动提示词。",
+  "blueprint.minimal_title": "从一个任务开始",
+  "blueprint.starter_blueprint_desc": "设计一个包含skills、命令和交接步骤的可复用工作流。",
+  "blueprint.starter_blueprint_prompt": "帮我为此工作区设计一个可复用的自动化蓝图。先问我想标准化什么，然后提出工作流方案。",
+  "blueprint.starter_blueprint_title": "规划自动化蓝图",
+  "blueprint.starter_chrome_desc": "立即开始浏览器自动化对话。",
+  "blueprint.starter_chrome_prompt": "帮我连接Chrome并自动化一个重复性任务。",
+  "blueprint.starter_chrome_title": "Chrome自动化",
+  "blueprint.starter_command_desc": "将重复的工作流转化为此工作区的斜杠命令。",
+  "blueprint.starter_command_prompt": "帮我为此工作区创建一个可复用的/command。先问我想自动化什么工作流，然后起草命令。",
+  "blueprint.starter_command_title": "创建可复用命令",
+  "blueprint.starter_connect_openai_desc": "添加OpenAI提供商，让ChatGPT模型在新会话中即可使用。",
+  "blueprint.starter_connect_openai_title": "连接ChatGPT",
+  "blueprint.starter_csv_desc": "清洗或生成电子表格数据。",
+  "blueprint.starter_csv_prompt": "帮我在这台电脑上创建或编辑CSV文件。",
+  "blueprint.starter_csv_title": "处理CSV",
+  "blueprint.starter_explore_desc": "汇总文件并建议最适合先处理的任务。",
+  "blueprint.starter_explore_prompt": "汇总此工作区，指出最重要的文件，并建议最适合先处理的任务。",
+  "blueprint.starter_explore_title": "探索此工作区",
+  "blueprint.welcome_message": "你好，欢迎使用OpenWork！\n\n大家用OpenWork在电脑上编写CSV文件、连接Chrome自动化重复任务，以及将联系人同步到Notion。\n\n但唯一的限制是你的想象力。\n\n你想做什么？",
+  "blueprint.welcome_title": "欢迎使用OpenWork",
+  "common.add": "添加",
+  "common.cancel": "取消",
+  "common.close": "关闭",
+  "common.default_parens": "（默认）",
+  "common.edit": "编辑",
+  "common.hide": "隐藏",
+  "common.navigate": "导航",
+  "common.next": "下一步",
+  "common.off": "关闭",
+  "common.on": "开启",
+  "common.path": "路径",
+  "common.question": "问题",
+  "common.refresh": "刷新",
+  "common.remove": "移除",
+  "common.reset": "重置",
+  "common.save": "保存",
+  "common.select": "选择",
+  "common.show": "显示",
+  "common.something_went_wrong": "出了点问题",
+  "common.submit": "提交",
+  "common.unknown": "未知",
+  "composer.agent_label": "智能体",
+  "composer.attach_files": "附加文件",
+  "composer.attachments_unavailable": "附件功能不可用。",
+  "composer.behavior_label": "行为",
+  "composer.configure": "配置",
+  "composer.default_agent": "默认智能体",
+  "composer.file_exceeds_limit": "{name}超过8MB限制。",
+  "composer.file_kind": "文件",
+  "composer.image_kind": "图片",
+  "composer.inserted_links_unsupported": "已为不支持的文件插入链接。",
+  "composer.loading_commands": "正在加载命令…",
+  "composer.mcps_label": "MCP",
+  "composer.no_commands": "未找到命令。",
+  "composer.placeholder": "描述你的任务…",
+  "composer.remote_worker_paste_warning": "这是远程工作区。沙箱也是远程的。要共享文件，请上传到侧边栏的共享文件夹。",
+  "composer.run_task": "运行任务",
+  "composer.skill_source": "Skill",
+  "composer.stop": "停止",
+  "composer.tools_label": "命令、技能和MCP",
+  "composer.unsupported_attachment_type": "不支持的附件类型。",
+  "composer.upload_to_shared_folder": "上传到共享文件夹",
+  "composer.uploaded_multiple_files": "已上传{count}个文件到共享文件夹并插入链接。",
+  "composer.uploaded_single_file": "已上传{name}到共享文件夹并插入链接。",
+  "config.collaborator_token_disabled_hint": "已预存用于远程共享，但远程访问当前已禁用。",
+  "config.collaborator_token_label": "协作者令牌",
+  "config.collaborator_token_remote_hint": "手机或笔记本连接此服务器时的日常远程访问。",
+  "config.connection_failed": "连接失败。",
+  "config.connection_failed_check": "连接失败。请检查主机URL和令牌。",
+  "config.connection_status_updated": "连接状态已更新。",
+  "config.connection_successful": "连接成功。",
+  "config.copied": "已复制",
+  "config.copy": "复制",
+  "config.desktop_only_hint": "部分配置功能（本地服务器共享 + 消息桥接）需要桌面应用。",
+  "config.diagnostics_desc": "复制脱敏的运行时状态用于调试。",
+  "config.diagnostics_title": "诊断包",
+  "config.engine_reload_desc": "重启此工作区的OpenCode服务器。",
+  "config.engine_reload_title": "引擎重新加载",
+  "config.host_admin_token_hint": "仅限主机内部使用的令牌，用于审批CLI和管理API。请勿在远程应用连接流程中使用。",
+  "config.host_admin_token_label": "主机管理员令牌",
+  "config.host_local_only": "仅限本地",
+  "config.host_offline": "离线",
+  "config.host_remote_enabled": "已启用远程",
+  "config.local_ip_hint": "在同一Wi-Fi下使用本地IP可获得最快连接。",
+  "config.mdns_hint": ".local名称更易记忆，但可能无法在所有网络上解析。",
+  "config.messaging_identities_desc": "在身份标签页中管理Telegram/Slack身份和路由。",
+  "config.messaging_identities_title": "消息身份",
+  "config.not_set": "未设置",
+  "config.owner_token_disabled_hint": "仅在启用此工作区的远程访问后才有效。",
+  "config.owner_token_label": "所有者令牌",
+  "config.owner_token_remote_hint": "远程客户端需要回答权限提示或执行所有者操作时使用。",
+  "config.reload_active_tasks_warning": "重新加载将停止活动任务。",
+  "config.reload_availability_hint": "仅本地工作区或已连接的OpenWork服务器支持重新加载。",
+  "config.reload_connect_hint": "连接此工作区后才能重新加载。",
+  "config.reload_engine": "重新加载引擎",
+  "config.reload_now_desc": "应用配置更新并重新连接会话。",
+  "config.reload_now_title": "立即重新加载",
+  "config.reloading": "正在重新加载…",
+  "config.remote_access_off_hint": "远程访问已关闭。请先通过分享工作区启用远程访问，然后再从其他设备连接。",
+  "config.resolved_worker_url": "解析后的工作区URL：",
+  "config.server_needed_hint": "需要连接OpenWork服务器以同步skills、插件和命令。",
+  "config.server_section_desc": "连接OpenWork服务器。使用URL加服务器管理员提供的协作者或所有者令牌。",
+  "config.server_section_title": "OpenWork服务器",
+  "config.server_sharing_desc": "将这些详情分享给受信任的设备。保持服务器在同一网络以获得最快设置。",
+  "config.server_sharing_menu_hint": "如需每个工作区的分享链接，请使用工作区菜单中的分享…",
+  "config.server_sharing_title": "OpenWork服务器共享",
+  "config.server_url_hint": "使用OpenWork服务器提供的URL。本地桌面工作区使用48000-51000范围内的持久高端口。",
+  "config.server_url_input_label": "OpenWork服务器URL",
+  "config.server_url_label": "OpenWork服务器URL",
+  "config.starting_server": "正在启动服务器…",
+  "config.status_connected": "已连接",
+  "config.status_limited": "受限",
+  "config.status_not_connected": "未连接",
+  "config.test_connection": "测试连接",
+  "config.testing": "正在测试…",
+  "config.testing_connection": "正在测试连接…",
+  "config.token_hint": "可选。粘贴协作者令牌用于日常访问，或在此客户端需要回答权限提示时粘贴所有者令牌。",
+  "config.token_label": "协作者或所有者令牌",
+  "config.token_placeholder": "粘贴你的令牌",
+  "config.unavailable": "不可用",
+  "config.worker_id": "工作区ID：",
+  "config.workspace_config_desc": "这些设置影响所选工作区。仅运行时操作适用于当前连接的工作区。",
+  "config.workspace_config_title": "工作区配置",
+  "config.workspace_id_prefix": "工作区：",
+  "context_panel.add_button": "添加",
+  "context_panel.add_folder_hint": "添加文件夹以允许此工作区读写其根目录以外的文件。",
+  "context_panel.adding_button": "添加中…",
+  "context_panel.always_available": "始终可用",
+  "context_panel.authorized_folders": "已授权文件夹",
+  "context_panel.authorized_folders_desc": "授予此工作区访问权限，以读取和编辑根目录之外的文件夹。",
+  "context_panel.authorized_folders_no_access": "连接可写的OpenWork服务器工作区以编辑已授权文件夹。",
+  "context_panel.browse_button": "浏览",
+  "context_panel.config_access_unavailable": "此工作区无法访问OpenWork服务器配置。",
+  "context_panel.config_read_only": "OpenWork服务器对工作区配置为只读连接。",
+  "context_panel.folder_already_authorized": "文件夹已授权。",
+  "context_panel.folders_updated": "已授权文件夹已更新。",
+  "context_panel.input_placeholder": "输入要授权的文件夹路径…",
+  "context_panel.no_external_folders": "暂无已授权的外部文件夹",
+  "context_panel.no_mcp": "未加载MCP服务器。",
+  "context_panel.no_server_workspace": "未选择活动的服务器工作区。",
+  "context_panel.no_skills": "未加载skills。",
+  "context_panel.preserving_entries": "保留{count}条非文件夹权限条目。",
+  "context_panel.preserving_entry": "保留1条非文件夹权限条目。",
+  "context_panel.remove_folder": "移除{name}",
+  "context_panel.saving_folders": "正在保存已授权文件夹…",
+  "context_panel.server_disconnected": "OpenWork服务器已断开连接。",
+  "context_panel.workspace_root_available": "工作区根目录已可用。",
+  "context_panel.workspace_root_badge": "工作区根目录",
+  "context_panel.writable_workspace_required": "需要可写的OpenWork服务器工作区才能更新已授权文件夹。",
+  "dashboard.change": "更改",
+  "dashboard.choose_folder": "选择文件夹",
+  "dashboard.choose_folder_continue": "选择文件夹以继续。",
+  "dashboard.chooser_local_desc": "在此设备上创建工作区，可选择从团队模板开始。",
+  "dashboard.chooser_remote_desc": "使用URL和访问令牌连接自托管的OpenWork工作区。",
+  "dashboard.chooser_shared_desc": "浏览组织共享的云端工作区，一步连接。",
+  "dashboard.close_settings": "关闭设置",
+  "dashboard.cloud_worker": "云端工作区",
+  "dashboard.commands": "命令",
+  "dashboard.connect_remote_button": "连接远程",
+  "dashboard.connected": "已连接",
+  "dashboard.connecting": "正在连接…",
+  "dashboard.create_local_workspace_subtitle": "在此设备上创建工作区，可选择从团队模板开始。",
+  "dashboard.create_local_workspace_title": "本地工作区",
+  "dashboard.create_remote_custom_subtitle": "连接自托管的OpenWork工作区。",
+  "dashboard.create_remote_custom_title": "连接自定义远程",
+  "dashboard.create_remote_workspace_confirm": "添加工作区",
+  "dashboard.create_remote_workspace_subtitle": "保存OpenWork服务器为工作区。",
+  "dashboard.create_remote_workspace_title": "添加远程工作区",
+  "dashboard.create_sandbox_confirm": "创建为沙箱",
+  "dashboard.create_shared_subtitle_signed_in": "浏览组织共享的云端工作区，一步连接。",
+  "dashboard.create_shared_subtitle_signed_out": "登录OpenWork Cloud以访问组织共享的工作区。",
+  "dashboard.create_shared_title": "共享工作区",
+  "dashboard.create_workspace_confirm": "创建工作区",
+  "dashboard.create_workspace_subtitle": "初始化新的基于文件夹的工作区。",
+  "dashboard.create_workspace_title": "创建工作区",
+  "dashboard.desktop_badge": "桌面版",
+  "dashboard.edit_remote_workspace_confirm": "保存连接",
+  "dashboard.edit_remote_workspace_subtitle": "更新此工作区的OpenWork服务器信息。",
+  "dashboard.edit_remote_workspace_title": "编辑远程连接",
+  "dashboard.error_choose_org": "请先选择组织再打开工作区。",
+  "dashboard.error_connect_worker": "连接{name}失败。",
+  "dashboard.error_load_orgs": "加载组织失败。",
+  "dashboard.error_load_shared_workspaces": "加载共享工作区失败。",
+  "dashboard.error_workspace_not_ready": "工作区尚未就绪。请稍后重试。",
+  "dashboard.import_config": "导入配置",
+  "dashboard.importing": "正在导入…",
+  "dashboard.modal_back": "返回",
+  "dashboard.modal_close": "关闭添加工作区弹窗",
+  "dashboard.remote": "远程",
+  "dashboard.remote_base_url_required": "请先填写服务器地址。",
+  "dashboard.remote_server_details_hint": "连接自托管的OpenWork工作区。",
+  "dashboard.remote_server_details_title": "远程服务器详情",
+  "dashboard.sandbox_checking_docker": "正在检查Docker...",
+  "dashboard.sandbox_get_ready_title": "沙箱需要Docker",
+  "dashboard.skills": "Skills（技能）",
+  "dashboard.worker_status_attention": "需要关注",
+  "dashboard.worker_status_ready": "就绪",
+  "dashboard.worker_status_starting": "启动中",
+  "dashboard.worker_status_stopped": "已停止",
+  "dashboard.worker_status_unknown": "未知",
+  "den.active_org_hint": "云端工作区和团队模板限于所选组织。",
+  "den.active_org_title": "当前组织",
+  "den.auto_reconnect_hint": "在浏览器中完成认证后，OpenWork将自动重新连接。",
+  "den.checking_session": "正在检查会话",
+  "den.choose_org_for_providers": "选择一个组织以查看云端提供商。",
+  "den.choose_org_for_skill_hubs": "选择一个组织以查看云端Skill Hub。",
+  "den.cloud_account_hint": "管理已连接的账户和组织。",
+  "den.cloud_account_title": "Cloud账户",
+  "den.cloud_control_plane_open": "在浏览器中打开",
+  "den.cloud_control_plane_reset": "重置",
+  "den.cloud_control_plane_save": "保存URL",
+  "den.cloud_control_plane_url_hint": "仅限开发者模式。用于连接本地或自托管的Cloud控制平面。更改后将退出登录以重新连接新的控制平面。",
+  "den.cloud_control_plane_url_label": "Cloud控制平面URL",
+  "den.cloud_provider_detail": "{count}个模型 · {source}提供商",
+  "den.cloud_provider_removed_detail": "此导入的提供商不再存在于云端。请卸载本地的{providerId}配置。",
+  "den.cloud_provider_sync_detail": "云端提供商已变更。将{count}个模型的{source}配置同步到opencode.jsonc。",
+  "den.cloud_providers_hint": "将托管LLM提供商导入opencode.jsonc，并在此工作区中使用组织凭据。",
+  "den.cloud_providers_title": "云端提供商",
+  "den.cloud_section_desc": "登录、选择组织，打开Cloud工作区或团队模板。",
+  "den.cloud_section_title": "OpenWork Cloud",
+  "den.cloud_sleep_hint": "登录OpenWork Cloud，即使电脑进入睡眠状态也能保持任务运行。",
+  "den.cloud_workers_hint": "使用应用内的远程连接流程直接在OpenWork中打开工作区。",
+  "den.cloud_workers_title": "云端工作区",
+  "den.create_account": "创建账户",
+  "den.credentials_ready_badge": "凭据就绪",
+  "den.error_base_url": "请输入有效的http:// 或https:// Cloud控制平面URL。",
+  "den.error_choose_org": "请先选择组织再打开工作区。",
+  "den.error_load_orgs": "加载组织失败。",
+  "den.error_load_workers": "加载工作区失败。",
+  "den.error_no_session": "未找到有效的Cloud会话。",
+  "den.error_no_token": "桌面登录已完成，但OpenWork Cloud未返回会话令牌。",
+  "den.error_open_worker": "在OpenWork中打开{name}失败。",
+  "den.error_open_worker_fallback": "打开{name}失败。",
+  "den.error_paste_valid_code": "请粘贴有效的OpenWork登录链接或一次性登录码。",
+  "den.error_signin_failed": "完成OpenWork Cloud登录失败。",
+  "den.error_worker_not_ready": "工作区尚未就绪。请在部署完成后重试。",
+  "den.finish_signin": "完成登录",
+  "den.finishing": "正在完成…",
+  "den.hide_signin_code": "隐藏登录码",
+  "den.import_all": "全部导入",
+  "den.import_provider": "导入",
+  "den.import_provider_failed": "导入{name}失败。",
+  "den.imported_badge": "已导入",
+  "den.imported_provider": "已导入{name}。",
+  "den.importing": "导入中…",
+  "den.needs_attention": "需要关注",
+  "den.no_cloud_providers": "此组织暂无可用的云端提供商。",
+  "den.no_cloud_workers": "此组织暂无可见的云端工作区。请在Cloud中创建后刷新此标签页。",
+  "den.no_org_selected": "未选择组织",
+  "den.no_skill_hubs": "此组织暂无可用的云端Skill Hub。",
+  "den.open": "打开",
+  "den.opening": "正在打开…",
+  "den.org_member_suffix": "（成员）",
+  "den.org_owner_suffix": "（所有者）",
+  "den.org_switched": "已切换到{name}。",
+  "den.out_of_sync_badge": "不同步",
+  "den.paste_signin_code": "粘贴登录码",
+  "den.refresh": "刷新",
+  "den.reload_workspace": "重新加载工作区以应用配置变更。",
+  "den.remove_provider_failed": "移除{name}失败。",
+  "den.removed_from_cloud_badge": "已从云端移除",
+  "den.removed_provider": "已移除{name}。",
+  "den.removing": "移除中…",
+  "den.sign_out": "退出登录",
+  "den.signed_out": "已退出",
+  "den.signin_button": "登录",
+  "den.signin_code_note": "支持openwork://den-auth链接或一次性授权码。",
+  "den.signin_link_hint": "如果浏览器未自动跳回OpenWork，请在此粘贴OpenWork Cloud的登录链接或一次性登录码。",
+  "den.signin_link_label": "登录链接或一次性登录码",
+  "den.signin_link_placeholder": "openwork://den-auth?...或粘贴登录码",
+  "den.signin_title": "登录OpenWork Cloud",
+  "den.signing_in": "正在完成OpenWork Cloud登录…",
+  "den.signing_out": "正在退出…",
+  "den.skill_hub_detail": "将{count}个共享Skill导入到.opencode/skills。",
+  "den.skill_hub_imported_detail": "已将{count}个Skill导入此工作区。",
+  "den.skill_hub_removed_detail": "此Hub已从云端移除。请卸载此工作区中已导入的{importedCount}个Skill。",
+  "den.skill_hub_skills_badge": "{count}个Skill",
+  "den.skill_hub_sync_detail": "云端现有{liveCount}个Skill；此工作区已导入{importedCount}个。同步以更新已安装集。",
+  "den.skill_hubs_hint": "一键将共享云端Hub中的所有Skill导入到此工作区。",
+  "den.skill_hubs_title": "Skill Hub",
+  "den.status_base_url_updated": "已更新Cloud控制平面URL。请重新登录以继续。",
+  "den.status_browser_signin": "请在浏览器中完成登录以连接OpenWork。",
+  "den.status_browser_signup": "请在浏览器中完成账户创建以连接OpenWork。",
+  "den.status_cloud_signed_in_as": "已作为{email}连接OpenWork Cloud。",
+  "den.status_cloud_signin_done": "已连接OpenWork Cloud。",
+  "den.status_loaded_orgs": "已加载{count}个组织。",
+  "den.status_loaded_workers": "已加载{name}的{count}个工作区。",
+  "den.status_no_workers": "未找到{name}的工作区。",
+  "den.status_opened_worker": "已在OpenWork中打开{name}。",
+  "den.status_signed_in_as": "已登录为{email}。",
+  "den.status_signed_out": "已退出登录并清除此设备上的OpenWork Cloud会话。",
+  "den.sync": "同步",
+  "den.sync_provider_failed": "同步{name}失败。",
+  "den.synced_provider": "已同步{name}。",
+  "den.syncing": "同步中…",
+  "den.uninstall": "卸载",
+  "den.worker_mine_badge": "我的",
+  "den.worker_not_ready_title": "此工作区尚未准备就绪。",
+  "den.worker_provider_label": "{provider}工作区",
+  "den.worker_secondary_cloud": "云端工作区",
+  "extensions.app_count": "{count}个应用已连接",
+  "extensions.apps_mcp_header": "应用（MCP）",
+  "extensions.filter_all": "全部",
+  "extensions.filter_apps": "应用",
+  "extensions.filter_plugins": "插件",
+  "extensions.plugin_count": "{count}个插件",
+  "extensions.plugins_opencode_header": "插件（OpenCode）",
+  "extensions.subtitle": "应用（MCP）和OpenCode插件集中管理。",
+  "extensions.title": "扩展",
+  "identities.agent_behavior_desc": "每个工作区一个文件。可在首行添加@agent <id>以通过特定OpenCode智能体路由。",
+  "identities.agent_behavior_title": "消息智能体行为",
+  "identities.agent_created": "已创建默认消息智能体文件。",
+  "identities.agent_file_changed": "文件已被远程修改。请重新加载后再保存。",
+  "identities.agent_loading": "正在加载智能体文件…",
+  "identities.agent_none": "无",
+  "identities.agent_not_found": "此工作区中尚未找到智能体文件。",
+  "identities.agent_saved": "已保存消息行为。",
+  "identities.agent_scope_status": "活动范围：工作区 · 状态：{status} · 已选智能体：{agent}",
+  "identities.agent_status_loaded": "已加载",
+  "identities.agent_status_missing": "缺失",
+  "identities.agent_worker_scope_unavailable": "工作区范围不可用。",
+  "identities.all_channels": "所有频道",
+  "identities.app_token_label": "应用令牌",
+  "identities.auto_bind_label": "直接发送时自动绑定对等方到目录",
+  "identities.available_channels": "可用频道",
+  "identities.bot_token_label": "机器人令牌",
+  "identities.bot_token_placeholder": "粘贴来自@BotFather的Telegram机器人令牌",
+  "identities.botfather_step1_open": "1. 在Telegram中打开@BotFather",
+  "identities.botfather_step1_run": "并运行/newbot",
+  "identities.botfather_step3_choose": "3. 为你的机器人选择名称和用户名",
+  "identities.botfather_step3_or_private": "用于开放收件箱，或",
+  "identities.botfather_step3_private": "私有",
+  "identities.botfather_step3_public": "公开",
+  "identities.botfather_step3_to_require": "以要求",
+  "identities.channel_label": "频道",
+  "identities.channels_connected": "已连接",
+  "identities.channels_label": "频道",
+  "identities.configured_suffix": "已配置",
+  "identities.connect_server_desc": "身份功能在连接OpenWork服务器后可用。",
+  "identities.connect_server_title": "连接OpenWork服务器",
+  "identities.connect_slack": "连接Slack",
+  "identities.connected_badge": "已连接",
+  "identities.connecting": "正在连接…",
+  "identities.copy_bot_token_hint": "复制机器人令牌并粘贴到下方。",
+  "identities.copy_code": "复制代码",
+  "identities.create_default_file": "创建默认文件",
+  "identities.create_private_bot": "创建私有机器人",
+  "identities.create_public_bot": "创建公开机器人",
+  "identities.days_ago": "{days}天前",
+  "identities.default_routing": "默认路由",
+  "identities.directory_label": "目录（可选）",
+  "identities.disable_messaging": "禁用消息",
+  "identities.disable_messaging_message": "这将关闭此工作区的消息功能。Telegram和Slack设置将隐藏，直到重新启用消息功能。你需要重启工作区以完全停止消息sidecar。",
+  "identities.disable_messaging_title": "禁用此工作区的消息功能？",
+  "identities.disabled_label": "已禁用",
+  "identities.disabling": "正在禁用…",
+  "identities.disconnect": "断开连接",
+  "identities.dispatched_messages": "已分发{sent}/{attempted}条消息。",
+  "identities.enable_messaging": "启用消息",
+  "identities.enable_messaging_risk": "消息功能可能将此工作区暴露给远程命令。如果机器人是公开的或被入侵，它可以访问此工作区可用的文件、凭据和API密钥。",
+  "identities.enable_messaging_title": "启用此工作区的消息功能？",
+  "identities.enabled_label": "已启用",
+  "identities.enabling": "正在启用…",
+  "identities.health_offline": "离线",
+  "identities.health_running": "运行中",
+  "identities.health_unavailable": "不可用",
+  "identities.health_unknown": "未知",
+  "identities.hours_ago": "{hours}小时前",
+  "identities.identities_label": "身份",
+  "identities.just_now": "刚刚",
+  "identities.last_activity": "最近活动",
+  "identities.later": "稍后",
+  "identities.message_label": "消息",
+  "identities.message_routing_desc": "控制哪些对话路由到哪个工作区文件夹。除非你在此设置规则，否则消息将路由到工作区的默认文件夹。",
+  "identities.message_routing_title": "消息路由",
+  "identities.messages_today": "今日消息",
+  "identities.messaging_disabled_hint": "仅在你了解风险并计划保护访问安全（例如使用Telegram私有配对）时才启用消息功能。",
+  "identities.messaging_disabled_restart": "消息已禁用。请重启此工作区以停止消息sidecar。",
+  "identities.messaging_disabled_risk": "消息机器人可以对你的本地工作区执行操作。如果公开暴露，它们可能允许访问此工作区可用的文件、凭据和API密钥。",
+  "identities.messaging_disabled_title": "消息功能默认禁用",
+  "identities.messaging_enabled_restart": "消息已启用。请立即重启此工作区以启动消息sidecar，并解锁Telegram和Slack设置。",
+  "identities.messaging_sidecar_not_running": "此工作区已启用消息功能，但消息sidecar尚未运行。请重启此工作区，然后返回消息设置连接Telegram或Slack。",
+  "identities.minutes_ago": "{minutes}分钟前",
+  "identities.not_set": "未设置",
+  "identities.open_bot_link": "在Telegram中打开@{username}",
+  "identities.pairing_code_copied": "配对码已复制。",
+  "identities.pairing_code_copy_failed": "无法复制配对码。请手动复制。",
+  "identities.pairing_code_instruction_prefix": "发送",
+  "identities.peer_id_label": "对等方ID（可选）",
+  "identities.peer_id_placeholder_slack": "例如 slack:U12345678",
+  "identities.peer_id_placeholder_telegram": "例如 telegram:123456789",
+  "identities.private_label": "私有",
+  "identities.private_pairing_code": "私有配对码",
+  "identities.public_bot_confirm": "是的，我了解风险",
+  "identities.public_bot_warning_message": "你的机器人将对公众开放，任何获得你机器人访问权限的人都可以完全访问你的本地工作区，包括你提供的所有文件和API密钥。如果创建私有机器人，你可以通过要求配对令牌来限制谁可以访问。确定要将机器人设为公开吗？",
+  "identities.public_bot_warning_title": "将此机器人设为公开？",
+  "identities.public_label": "公开",
+  "identities.quick_setup": "快速设置",
+  "identities.reconnect_failed": "重新连接失败。请检查OpenWork URL/令牌后重试。",
+  "identities.reconnected": "已重新连接。",
+  "identities.reconnected_refreshing": "已重新连接。正在刷新工作区状态…",
+  "identities.reload": "重新加载",
+  "identities.repair_reconnect": "修复并重新连接",
+  "identities.restart_failed": "重启失败。请在设置中重启工作区后重试。",
+  "identities.restart_to_disable_messaging": "此工作区的消息功能已禁用。请立即重启工作区以停止消息sidecar。",
+  "identities.restart_to_enable_messaging": "此工作区的消息功能已启用。请立即重启工作区以启动消息sidecar，并解锁Telegram和Slack设置。",
+  "identities.restart_worker": "重启工作区",
+  "identities.restart_worker_title": "立即重启工作区？",
+  "identities.restarting": "正在重启…",
+  "identities.routing_override_prefix": "所有消息路由到",
+  "identities.routing_override_suffix": "（覆盖已激活）",
+  "identities.running_label": "运行中",
+  "identities.save_behavior": "保存行为",
+  "identities.saving": "正在保存…",
+  "identities.send_test_button": "发送测试消息",
+  "identities.send_test_desc": "验证出站链路。使用对等方ID进行直接发送，或留空对等方ID以按目录中的绑定进行扇出。",
+  "identities.send_test_title": "发送测试消息",
+  "identities.sending": "正在发送…",
+  "identities.slack_desc": "你的工作区在Slack频道中显示为机器人。团队成员可以直接发消息或在对话中@提及它。",
+  "identities.slack_intro": "连接Slack工作区，让团队成员可以在频道和私信中与此工作区交互。",
+  "identities.slack_unavailable": "Slack身份不可用。",
+  "identities.status_active": "活动",
+  "identities.status_label": "状态",
+  "identities.status_stopped": "已停止",
+  "identities.stopped_label": "已停止",
+  "identities.subtitle": "让人们通过消息应用联系你的工作区。连接频道后，你的工作区将自动读取和回复消息。",
+  "identities.tab_general": "通用",
+  "identities.telegram_bot_access_desc": "公开机器人：首次Telegram聊天自动关联。私有机器人：需要配对码后才能运行工具。",
+  "identities.telegram_delete_failed": "删除失败。",
+  "identities.telegram_deleted": "已删除。",
+  "identities.telegram_deleted_pending": "已删除（等待应用）。",
+  "identities.telegram_desc": "连接Telegram机器人，可选公开模式（开放收件箱）或私有模式（需要配对码）。",
+  "identities.telegram_private_saved_pair": "私有机器人已保存。通过/pair {code}配对",
+  "identities.telegram_save_failed": "保存失败。",
+  "identities.telegram_saved": "已保存。",
+  "identities.telegram_saved_pending": "已保存（等待应用）。",
+  "identities.telegram_saved_username": "已保存（@{username}）",
+  "identities.telegram_unavailable": "Telegram身份不可用。",
+  "identities.title": "消息频道",
+  "identities.unsaved_changes": "未保存的更改",
+  "identities.worker_offline": "工作区离线",
+  "identities.worker_online": "工作区在线",
+  "identities.worker_restarted": "工作区已重启。",
+  "identities.worker_restarted_refreshing": "工作区已重启。正在刷新消息状态…",
+  "identities.worker_scope_unavailable": "工作区范围不可用。",
+  "identities.worker_scope_unavailable_detail": "工作区范围不可用。请使用工作区URL重新连接或切换到已知的工作区。",
+  "identities.worker_unavailable": "工作区不可用",
+  "identities.workspace_id_required": "管理身份需要工作区ID。请使用工作区URL重新连接或选择此主机上映射的工作区。",
+  "identities.workspace_scope_prefix": "工作区范围：",
+  "mcp.add_modal_subtitle": "通过URL或本地命令连接自定义MCP服务器。",
+  "mcp.add_modal_title": "添加自定义应用",
+  "mcp.add_server_button": "添加应用",
+  "mcp.advanced": "高级",
+  "mcp.advanced_settings": "高级设置",
+  "mcp.advanced_settings_hint": "编辑配置文件和手动管理连接。",
+  "mcp.app_connected": "个应用已连接",
+  "mcp.apps_connected": "个应用已连接",
+  "mcp.apps_subtitle": "连接常用工具，让OpenWork代你使用。",
+  "mcp.apps_title": "应用",
+  "mcp.auth.already_connected": "已连接",
+  "mcp.auth.already_connected_description": "{server}已通过身份验证，可以正常使用。",
+  "mcp.auth.applying_changes_body": "我们正在重启worker，以便新MCP可以开始认证。",
+  "mcp.auth.applying_changes_title": "正在登录前应用更改",
+  "mcp.auth.authorization_link": "授权链接",
+  "mcp.auth.authorization_still_required": "仍需要授权。请重试以重新启动流程。",
+  "mcp.auth.callback_invalid": "请粘贴回调URL或code参数以完成OAuth。",
+  "mcp.auth.callback_label": "回调URL或授权码",
+  "mcp.auth.callback_placeholder": "http://127.0.0.1:19876/mcp/oauth/callback?code=...",
+  "mcp.auth.cancel": "取消",
+  "mcp.auth.client_registration_required": "在继续OAuth之前需要先注册客户端。",
+  "mcp.auth.complete_connection": "完成连接",
+  "mcp.auth.configured_previously": "该MCP可能在全局或之前的会话中已配置。你可以关闭此弹窗，立即开始使用MCP工具。",
+  "mcp.auth.connect_server": "连接{server}",
+  "mcp.auth.copied": "已复制",
+  "mcp.auth.copy_link": "复制链接",
+  "mcp.auth.done": "完成",
+  "mcp.auth.failed_to_start_oauth": "启动OAuth流程失败",
+  "mcp.auth.follow_browser_steps": "请在浏览器中完成授权步骤。",
+  "mcp.auth.force_stop": "强制停止",
+  "mcp.auth.force_stopping": "正在停止...",
+  "mcp.auth.im_done": "我已完成",
+  "mcp.auth.invalid_refresh_token": "OAuth刷新令牌无效或已过期。请重新授权。",
+  "mcp.auth.manual_finish_hint": "粘贴回调URL（localhost:19876）或授权码以完成连接。",
+  "mcp.auth.manual_finish_title": "远程服务器？",
+  "mcp.auth.oauth_completed_reload": "OAuth已完成。重新加载引擎以激活MCP。",
+  "mcp.auth.oauth_failed": "OAuth身份验证失败。",
+  "mcp.auth.oauth_not_supported_hint": "这可能意味着：\n• MCP服务器未声明OAuth功能\n• 引擎需要重新加载以发现服务器功能\n• 尝试：从CLI运行opencode mcp auth {server}",
+  "mcp.auth.open_browser_signin": "我们将打开你的浏览器完成登录。",
+  "mcp.auth.port_forward_hint": "提示：如需转发回调端口：ssh -L 19876:127.0.0.1:19876 user@host",
+  "mcp.auth.reauth_action": "重新授权OAuth",
+  "mcp.auth.reauth_cli_hint": "运行：opencode mcp auth {server}",
+  "mcp.auth.reauth_failed": "重新授权失败。",
+  "mcp.auth.reauth_remote_hint": "请在运行该工作区的设备上重新授权。",
+  "mcp.auth.reauth_running": "正在重新授权...",
+  "mcp.auth.reload_blocked": "会话运行中，暂时无法刷新。请先停止运行后再完成设置。",
+  "mcp.auth.reload_engine_retry": "应用更改并重试",
+  "mcp.auth.reload_failed": "登录前重启worker失败。",
+  "mcp.auth.reload_notice": "要使更改生效，OpenWork需要刷新worker服务。这可能会中断正在运行的会话。",
+  "mcp.auth.reload_remote_confirm": "要使更改生效，OpenWork需要刷新worker服务。这可能会停止你正在运行的会话。是否继续？",
+  "mcp.auth.reopen_browser_link": "点击这里重新打开浏览器",
+  "mcp.auth.request_timed_out": "请求超时。",
+  "mcp.auth.retry": "重试",
+  "mcp.auth.retry_now": "立即重试",
+  "mcp.auth.server_disabled": "此MCP服务器已禁用。请启用它后重试。",
+  "mcp.auth.step1_description": "我们将自动启动{server}的登录流程。",
+  "mcp.auth.step1_title": "正在打开你的浏览器",
+  "mcp.auth.step2_description": "登录并在提示时批准访问权限。",
+  "mcp.auth.step2_title": "授权OpenWork",
+  "mcp.auth.step3_description": "授权完成后我们将立即完成连接。",
+  "mcp.auth.step3_title": "完成后返回此处",
+  "mcp.auth.try_reload_engine": "{message}。请尝试先重新加载引擎。",
+  "mcp.auth.waiting_authorization": "正在等待你在浏览器中完成授权...",
+  "mcp.auth.waiting_for_conversation_body": "一旦可以开始认证，我们会立即为你跳转。",
+  "mcp.auth.waiting_for_conversation_title": "正在等待对话完成",
+  "mcp.auth.waiting_for_session": "正在等待{session}完成工作",
+  "mcp.available_apps": "可用应用",
+  "mcp.cap_signin": "账户登录",
+  "mcp.cap_tools": "AI工具",
+  "mcp.config_file": "配置文件",
+  "mcp.config_load_failed": "无法加载配置文件",
+  "mcp.config_not_loaded": "尚未加载",
+  "mcp.connect": "连接",
+  "mcp.connect_failed": "连接失败，请重试。",
+  "mcp.connect_server_first": "请先连接服务器。",
+  "mcp.connected": "已连接",
+  "mcp.connected_badge": "已连接",
+  "mcp.connection_failed": "连接异常 — 请重试",
+  "mcp.connection_type": "连接方式",
+  "mcp.control_chrome_browser_hint": "在Chrome 144或更高版本中，请先执行以下步骤：",
+  "mcp.control_chrome_browser_step_one": "打开chrome://inspect/#remote-debugging。",
+  "mcp.control_chrome_browser_step_two": "启用远程调试。",
+  "mcp.control_chrome_browser_step_three": "在Chrome提示时允许传入调试连接。",
+  "mcp.control_chrome_browser_title": "1. 开启Chrome访问",
+  "mcp.control_chrome_connect": "添加Control Chrome",
+  "mcp.control_chrome_docs": "官方MCP指南",
+  "mcp.control_chrome_edit": "编辑设置",
+  "mcp.control_chrome_profile_hint": "Control Chrome通常会打开独立的Chrome配置文件。如果你想让OpenWork复用已打开的Chrome窗口，请开启此选项。",
+  "mcp.control_chrome_profile_title": "2. 选择使用哪个Chrome",
+  "mcp.control_chrome_save": "保存设置",
+  "mcp.control_chrome_setup_subtitle": "先开启Chrome访问，然后选择OpenWork是使用独立配置文件还是复用已打开的Chrome。",
+  "mcp.control_chrome_setup_title": "设置Control Chrome",
+  "mcp.control_chrome_toggle_hint": "开启后，OpenWork将添加--autoConnect以连接到你已启动的Chrome实例。",
+  "mcp.control_chrome_toggle_label": "使用我现有的Chrome配置文件",
+  "mcp.control_chrome_toggle_off": "OpenWork将启动独立的Chrome配置文件用于自动化。",
+  "mcp.control_chrome_toggle_on": "OpenWork将复用你当前的标签页、Cookie和登录状态。",
+  "mcp.custom_app_cta_hint": "连接你的MCP服务器、内部工具或托管应用。",
+  "mcp.desktop_required": "应用需要桌面应用。",
+  "mcp.docs_link": "了解更多",
+  "mcp.file_not_found": "配置文件尚未创建",
+  "mcp.friendly_status_issue": "异常",
+  "mcp.friendly_status_needs_signin": "需要登录",
+  "mcp.friendly_status_offline": "离线",
+  "mcp.friendly_status_paused": "已暂停",
+  "mcp.friendly_status_ready": "就绪",
+  "mcp.last_synced": "已同步",
+  "mcp.login_action": "登录",
+  "mcp.login_hint": "连接你的账户以完成此应用的设置。",
+  "mcp.login_unavailable": "此应用不支持从OpenWork发起登录。",
+  "mcp.logout_action": "退出登录",
+  "mcp.logout_failed": "退出登录失败。",
+  "mcp.logout_hint": "将删除已保存的OAuth凭据。之后需要重新登录。",
+  "mcp.logout_label": "OAuth",
+  "mcp.logout_modal_message": "这将删除{server}的OAuth凭据。之后需要重新登录才能使用该应用。",
+  "mcp.logout_modal_title": "退出登录？",
+  "mcp.logout_success": "{server}已退出登录。",
+  "mcp.logout_working": "正在退出...",
+  "mcp.name_required": "请输入服务器名称。",
+  "mcp.no_apps_hint": "连接上方的应用开始使用。",
+  "mcp.no_apps_yet": "暂无已连接的应用",
+  "mcp.oauth": "登录",
+  "mcp.oauth_optional_hint": "在浏览器中通过OAuth连接你的账户。",
+  "mcp.oauth_optional_label": "此应用需要登录",
+  "mcp.one_click_connect": "一键连接",
+  "mcp.open_file": "打开文件",
+  "mcp.opening_label": "正在打开",
+  "mcp.pick_workspace_error": "请先选择工作区文件夹。",
+  "mcp.pick_workspace_first": "请先选择工作区文件夹。",
+  "mcp.quick_connect_chrome_desc": "通过浏览器自动化操控Chrome标签页。",
+  "mcp.quick_connect_chrome_title": "控制Chrome",
+  "mcp.quick_connect_context7_desc": "以更丰富的上下文搜索产品文档。",
+  "mcp.quick_connect_context7_title": "Context7",
+  "mcp.quick_connect_linear_desc": "规划冲刺，更快交付工单。",
+  "mcp.quick_connect_linear_title": "Linear",
+  "mcp.quick_connect_notion_desc": "同步页面、数据库和项目文档。",
+  "mcp.quick_connect_notion_title": "Notion",
+  "mcp.quick_connect_sentry_desc": "追踪发布并解决生产错误。",
+  "mcp.quick_connect_sentry_title": "Sentry",
+  "mcp.quick_connect_stripe_desc": "查看支付、发票和订阅。",
+  "mcp.quick_connect_stripe_title": "Stripe",
+  "mcp.reload_banner_blocked_hint": "停止正在运行的任务以激活。",
+  "mcp.remote_workspace_url_hint": "远程工作区建议优先使用URL类型的MCP服务器。",
+  "mcp.remove_app": "移除",
+  "mcp.remove_failed": "无法移除应用。",
+  "mcp.remove_modal_message": "确定要移除{server}吗？你可以随时重新添加。",
+  "mcp.remove_modal_title": "移除应用",
+  "mcp.reveal_config_failed": "无法打开配置文件",
+  "mcp.reveal_in_finder": "在文件管理器中显示",
+  "mcp.scope_global": "所有工作区",
+  "mcp.scope_project": "此工作区",
+  "mcp.server_command": "命令",
+  "mcp.server_command_hint": "启动服务器的shell命令。",
+  "mcp.server_command_placeholder": "npx -y @modelcontextprotocol/server-sequential-thinking",
+  "mcp.server_name": "应用名称",
+  "mcp.server_name_placeholder": "github-copilot",
+  "mcp.server_type": "类型",
+  "mcp.server_url": "服务器URL",
+  "mcp.server_url_placeholder": "https://api.githubcopilot.com/mcp/",
+  "mcp.sign_in_section_label": "登录",
+  "mcp.tap_to_connect": "点击连接",
+  "mcp.technical_details": "技术详情",
+  "mcp.type_cloud": "Cloud（使用账户登录）",
+  "mcp.type_local": "本地（在此设备运行）",
+  "mcp.type_local_cmd": "本地（命令）",
+  "mcp.type_remote": "远程（URL）",
+  "mcp.url_or_command_required": "远程服务器需要URL，本地服务器需要命令。",
+  "mcp.your_apps": "你的应用",
+  "model_behavior.desc_builtin": "此模型自行决定推理路径，不在此处提供配置。",
+  "model_behavior.desc_generic": "使用{label}配置。",
+  "model_behavior.desc_high": "回答前花更多时间推理。",
+  "model_behavior.desc_high_anthropic": "使用标准扩展思考预算。",
+  "model_behavior.desc_low": "回答前使用较轻的推理过程。",
+  "model_behavior.desc_low_google": "使用较轻的推理预算以更快响应。",
+  "model_behavior.desc_max": "使用提供商最深层的推理配置。",
+  "model_behavior.desc_max_anthropic": "使用最大的扩展思考预算。",
+  "model_behavior.desc_medium": "平衡速度和推理深度。",
+  "model_behavior.desc_minimal": "使用极少量的推理。",
+  "model_behavior.desc_none": "以最轻量的推理路径优先保证速度。",
+  "model_behavior.desc_standard": "此模型不提供额外的推理控制。",
+  "model_behavior.label_balanced": "均衡",
+  "model_behavior.label_builtin": "内置",
+  "model_behavior.label_deep": "深度",
+  "model_behavior.label_extended": "扩展",
+  "model_behavior.label_fast": "快速",
+  "model_behavior.label_light": "轻量",
+  "model_behavior.label_maximum": "最大",
+  "model_behavior.label_quick": "迅速",
+  "model_behavior.label_standard": "标准",
+  "model_behavior.title_builtin_reasoning": "内置推理",
+  "model_behavior.title_extended_thinking": "扩展思考",
+  "model_behavior.title_reasoning_budget": "推理预算",
+  "model_behavior.title_reasoning_effort": "推理力度",
+  "model_behavior.title_standard_generation": "标准生成",
+  "model_picker.chat_model_desc": "选择此对话的模型。如果模型支持推理配置，可在其卡片上进行设置。",
+  "model_picker.chat_model_title": "对话模型",
+  "model_picker.connect_provider_hint": "连接此提供商以浏览和保存模型",
+  "model_picker.default_model_desc": "选择新对话的默认模型，然后在其卡片上微调推理配置后点击完成。",
+  "model_picker.default_model_title": "默认模型",
+  "model_picker.model_count": "{count}个模型",
+  "model_picker.more_providers": "更多提供商",
+  "model_picker.no_results": "没有匹配的模型。",
+  "model_picker.other_connected_models": "其他已连接的模型",
+  "model_picker.recommended": "推荐",
+  "onboarding.authorize_folder": "授权文件夹",
+  "plugins.add": "添加",
+  "plugins.add_hint": "添加npm包名称，例如opencode-wakatime",
+  "plugins.add_label": "添加插件",
+  "plugins.added": "已添加",
+  "plugins.config": "配置",
+  "plugins.config_label": "配置",
+  "plugins.desc": "管理项目或全局OpenCode插件的`opencode.json`。",
+  "plugins.empty": "尚未配置插件。",
+  "plugins.enabled": "已启用",
+  "plugins.hide_setup": "隐藏设置",
+  "plugins.not_loaded": "尚未加载",
+  "plugins.not_loaded_yet": "尚未加载",
+  "plugins.remove": "移除",
+  "plugins.scope_global": "全局",
+  "plugins.scope_project": "项目",
+  "plugins.setup": "设置",
+  "plugins.suggested": "建议的插件",
+  "plugins.suggested_heading": "建议的插件",
+  "plugins.title": "OpenCode插件",
+  "providers.api_key_label": "API密钥",
+  "providers.api_key_required": "API密钥为必填项",
+  "providers.auth_failed": "认证失败",
+  "providers.connect_failed": "连接提供商失败",
+  "providers.disabled_in_config_suffix": "并已在OpenCode配置中禁用。",
+  "providers.disconnect_failed": "断开提供商失败",
+  "providers.disconnected_prefix": "已断开",
+  "providers.load_failed": "加载提供商失败",
+  "providers.no_oauth_prefix": "没有可用的OAuth流程：",
+  "providers.no_providers_available": "没有可用的提供商",
+  "providers.not_connected": "未连接到服务器",
+  "providers.not_oauth_flow_prefix": "所选认证方式不是OAuth流程：",
+  "providers.oauth_failed": "完成OAuth失败",
+  "providers.oauth_method_required": "OAuth方式为必填项",
+  "providers.provider_error": "提供商错误（{provider}）",
+  "providers.provider_id_required": "提供商ID为必填项",
+  "providers.rate_limit_exceeded": "请求频率超限",
+  "providers.removal_unsupported": "此客户端不支持移除提供商认证。",
+  "providers.request_failed": "请求失败",
+  "providers.save_api_key_failed": "保存API密钥失败",
+  "providers.still_connected_suffix": "，但工作区仍报告为已连接。请清除残留的API密钥或OAuth凭据，然后重启工作区以完全断开。",
+  "providers.unknown_provider": "未知提供商",
+  "providers.use_api_key_suffix": "请改用API密钥。",
+  "question_modal.custom_answer_label": "或输入自定义回答",
+  "question_modal.custom_answer_placeholder": "在此输入你的回答…",
+  "question_modal.question_counter": "问题{current} / {total}",
+  "session.allow_for_session": "在会话期间允许",
+  "session.allow_once": "允许一次",
+  "session.cmd_current_workspace": "当前工作区",
+  "session.cmd_new_session_detail": "在当前工作区开始新任务",
+  "session.cmd_new_session_meta": "创建",
+  "session.cmd_new_session_title": "新建会话",
+  "session.cmd_sessions_detail": "{count}个可用，跨工作区",
+  "session.cmd_sessions_meta": "跳转",
+  "session.cmd_sessions_title": "搜索会话",
+  "session.cmd_switch": "切换",
+  "session.create_or_connect_workspace": "创建或连接工作区",
+  "session.default_agent": "默认智能体",
+  "session.default_title": "新建会话",
+  "session.delete": "删除",
+  "session.delete_named_session_message": "这将永久删除「{title}」及其消息。",
+  "session.delete_session_generic": "这将永久删除所选会话及其消息。",
+  "session.delete_session_title": "删除会话？",
+  "session.deleting": "正在删除…",
+  "session.deny": "拒绝",
+  "session.details": "详情",
+  "session.details_label": "详情",
+  "session.doom_loop_label": "死循环",
+  "session.doom_loop_message": "OpenCode检测到使用相同输入的重复工具调用，正在询问是否在多次失败后继续。",
+  "session.doom_loop_note": "拒绝以停止循环，或允许以让智能体继续尝试。",
+  "session.doom_loop_repeated_call_label": "重复调用",
+  "session.doom_loop_repeated_tool_call": "重复的工具调用",
+  "session.doom_loop_title": "检测到死循环",
+  "session.doom_loop_tool_label": "工具",
+  "session.export_already_running": "导出正在进行中。",
+  "session.export_desktop_only": "导出功能在桌面应用中可用。",
+  "session.export_desktop_only_local": "导出功能在桌面应用中适用于本地工作区。",
+  "session.export_local_only": "导出仅支持本地工作区。",
+  "session.loading_detail": "正在拉取此任务的最新消息。",
+  "session.model": "模型",
+  "session.new_task": "新建任务",
+  "session.open": "打开",
+  "session.palette_hint_navigate": "方向键导航",
+  "session.palette_hint_run": "回车执行 · Esc关闭",
+  "session.palette_placeholder_actions": "搜索操作",
+  "session.palette_placeholder_sessions": "按会话标题或工作区搜索",
+  "session.palette_title_actions": "快捷操作",
+  "session.palette_title_sessions": "搜索会话",
+  "session.permission_label": "权限",
+  "session.permission_detail_command": "命令",
+  "session.permission_detail_cwd": "工作目录",
+  "session.permission_detail_description": "说明",
+  "session.permission_detail_diff": "差异",
+  "session.permission_detail_file": "文件",
+  "session.permission_detail_files": "文件",
+  "session.permission_detail_agent": "Agent",
+  "session.permission_detail_parent_directory": "父目录",
+  "session.permission_detail_path": "路径",
+  "session.permission_detail_query": "查询",
+  "session.permission_detail_target": "目标",
+  "session.permission_detail_tool": "工具",
+  "session.permission_detail_url": "URL",
+  "session.permission_kind_edit": "文件编辑",
+  "session.permission_kind_external_directory": "外部目录",
+  "session.permission_kind_question": "问题",
+  "session.permission_kind_read": "文件读取",
+  "session.permission_kind_skill": "技能",
+  "session.permission_kind_task": "子任务",
+  "session.permission_kind_todowrite": "Todo写入",
+  "session.permission_message": "OpenCode正在请求权限以继续。",
+  "session.permission_message_bash": "允许OpenCode继续前，请先检查命令影响范围。",
+  "session.permission_message_edit": "允许OpenCode修改前，请先检查文件和差异。",
+  "session.permission_message_external_directory": "允许访问工作区外部前，请先检查目标文件夹。",
+  "session.permission_message_read": "允许访问前，请先检查请求的文件范围。",
+  "session.permission_message_task": "允许启动前，请先检查请求的子任务。",
+  "session.permission_metadata_unavailable": "无法显示元数据。",
+  "session.permission_review_label": "检查",
+  "session.permission_scope_empty": "未提供具体范围。",
+  "session.permission_title_bash": "运行 shell 命令？",
+  "session.permission_title_edit": "修改文件？",
+  "session.permission_title_external_directory": "访问外部文件夹？",
+  "session.permission_title_generic": "批准 {permission}？",
+  "session.permission_title_read": "读取文件？",
+  "session.permission_title_task": "启动子任务？",
+  "session.permission_decision_hint": "仅信任本次请求时选择允许一次；信任这个范围时可在会话期间允许。",
+  "session.redo_aria_label": "重做上一条撤销的消息",
+  "session.redo_label": "重做",
+  "session.redo_title": "重做上一条撤销的消息",
+  "session.rename_description": "更新此会话名称。",
+  "session.rename_label": "会话名称",
+  "session.rename_placeholder": "输入新的名称",
+  "session.rename_title": "重命名会话",
+  "session.resize_workspace_column": "调整工作区列宽",
+  "session.revert_label": "撤销",
+  "session.scope_label": "范围",
+  "session.share_collaborator_hint": "日常远程访问，不需要所有者权限时使用。",
+  "session.share_collaborator_host_hint": "日常远程访问此主机，无需所有者权限。",
+  "session.share_collaborator_label": "协作者令牌",
+  "session.share_connected_with_hint": "此工作区当前使用此密码连接。",
+  "session.share_desktop_app_required": "需要桌面应用",
+  "session.share_local_host_not_ready": "本地OpenWork主机尚未就绪。",
+  "session.share_missing_host_url": "缺少OpenWork主机URL。",
+  "session.share_missing_token": "缺少OpenWork令牌。",
+  "session.share_note_direct_runtime": "引擎运行时设置为直连模式。切换本地工作区可能会重启主机并断开客户端连接。令牌可能在重启后变更。",
+  "session.share_opencode_base_url": "OpenCode基础URL",
+  "session.share_openwork_workers_only": "分享服务链接仅适用于OpenWork工作区。",
+  "session.share_owner_permission_hint": "远程客户端需要回答权限提示时使用。",
+  "session.share_password": "密码",
+  "session.share_select_workspace": "请先选择工作区。",
+  "session.share_set_token_hint": "在工作区设置中设置令牌",
+  "session.share_starting_server": "正在启动服务器…",
+  "session.share_worker_url": "工作区URL",
+  "session.share_worker_url_phones_hint": "在手机或笔记本上连接此工作区时使用。",
+  "session.share_worker_url_resolving_hint": "工作区URL正在解析，当前显示主机URL。",
+  "session.todo_progress": "已完成{completed} / {total}个任务",
+  "session.undo_label": "撤销",
+  "session.undo_title": "撤销上一条消息",
+  "session.workspace_fallback": "工作区",
+  "settings.api_keys_info": "API密钥由OpenCode存储在本地。环境变量提供商需在工作区环境中修改后重新加载。",
+  "settings.appearance_hint": "匹配系统或强制浅色/深色模式。",
+  "settings.appearance_title": "外观",
+  "settings.audit_log_title": "审计日志",
+  "settings.auto_compact": "自动上下文压缩",
+  "settings.auto_compact_desc": "控制此工作区的OpenCode compaction.auto。更改后请重载引擎。",
+  "settings.auto_update_desc": "自动下载更新（安装前会提示）",
+  "settings.auto_update_title": "自动更新",
+  "settings.background_checks_desc": "OpenWork启动时始终检查。同时每天检查一次。",
+  "settings.background_checks_title": "后台检查",
+  "settings.cache_repair_requires_desktop": "缓存修复需要桌面应用",
+  "settings.cap_browser_tools": "浏览器工具：{value}",
+  "settings.cap_commands": "命令：{value}",
+  "settings.cap_config": "配置：{value}",
+  "settings.cap_file_tools": "文件工具：{value}",
+  "settings.cap_inbox_off": "收件箱关闭",
+  "settings.cap_inbox_on": "收件箱开启",
+  "settings.cap_mcp": "MCP：{value}",
+  "settings.cap_outbox_off": "发件箱关闭",
+  "settings.cap_outbox_on": "发件箱开启",
+  "settings.cap_plugins": "插件：{value}",
+  "settings.cap_read": "读取",
+  "settings.cap_sandbox": "沙箱：{value}",
+  "settings.cap_skills": "Skills：{value}",
+  "settings.cap_write": "写入",
+  "settings.capabilities_title": "OpenWork服务器功能",
+  "settings.capabilities_unavailable": "功能不可用。请使用客户端令牌连接。",
+  "settings.change": "更改",
+  "settings.choose": "选择",
+  "settings.clear": "清除",
+  "settings.configure": "配置",
+  "settings.connect_provider": "连接提供商",
+  "settings.connection": "连接",
+  "settings.connection_failed": "连接失败",
+  "settings.connection_title": "连接",
+  "settings.copied_debug_report": "已复制运行时报告JSON。",
+  "settings.copy_json": "复制JSON",
+  "settings.custom_binary_hint": "用于将OpenWork指向本地的OpenCode构建",
+  "settings.custom_binary_label": "自定义OpenCode二进制文件",
+  "settings.debug_commit": "提交：{sha}",
+  "settings.debug_desktop_app": "桌面应用：{version}",
+  "settings.debug_opencode_version": "OpenCode：{version}",
+  "settings.debug_openwork_server_version": "OpenWork服务器：{version}",
+  "settings.deeplink_hint": "接受openwork://、openwork-dev://或原始支持的https://share.openworklabs.com/b/... URL。",
+  "settings.delete_containers": "正在移除容器…",
+  "settings.delete_local_config": "正在移除本地状态…",
+  "settings.dev_mode_badge": "开发模式",
+  "settings.developer": "开发者",
+  "settings.developer_mode_desc": "启用调试工具、诊断信息和开发者标签页。",
+  "settings.developer_mode_title": "开发者模式",
+  "settings.developer_panel_disabled": "开发者面板已禁用。",
+  "settings.developer_panel_enabled": "开发者面板已启用。",
+  "settings.diag_approval": "审批：{mode}（{ms}ms）",
+  "settings.diag_config_path": "配置路径：{path}",
+  "settings.diag_default": "默认",
+  "settings.diag_host_token_source": "主机令牌来源：{source}",
+  "settings.diag_opencode_binary": "OpenCode二进制文件：{binary}",
+  "settings.diag_read_only": "只读：{value}",
+  "settings.diag_runtime_workspace": "运行时工作区：{id}",
+  "settings.diag_selected_workspace": "已选工作区：{id}",
+  "settings.diag_started": "已启动：{time}",
+  "settings.diag_token_source": "令牌来源：{source}",
+  "settings.diag_workspaces": "工作区：{count}",
+  "settings.diagnostics_unavailable": "诊断不可用。",
+  "settings.disable_developer_mode": "禁用开发者模式",
+  "settings.disabled": "已禁用",
+  "settings.disconnect": "断开连接",
+  "settings.disconnect_server": "断开服务器",
+  "settings.disconnecting": "正在断开…",
+  "settings.docker_containers_desc": "强制移除OpenWork启动的Docker容器",
+  "settings.docker_containers_title": "OpenWork Docker容器",
+  "settings.docker_requires_desktop": "Docker清理需要桌面应用",
+  "settings.done": "完成",
+  "settings.enable_developer_mode": "启用开发者模式",
+  "settings.enable_exa": "启用Exa网页搜索",
+  "settings.enable_exa_desc": "在OpenWork编排器启动OpenCode时生效。",
+  "settings.engine_bundled": "内置（推荐）",
+  "settings.engine_bundled_hint": "内置引擎是最可靠的选项。使用系统",
+  "settings.engine_custom_binary": "自定义二进制文件",
+  "settings.engine_desc": "选择OpenCode在本地运行的方式。",
+  "settings.engine_source": "引擎来源",
+  "settings.engine_source_debug": "引擎来源",
+  "settings.engine_system_path": "系统安装（PATH）",
+  "settings.engine_title": "引擎",
+  "settings.environment.add_button": "新增变量",
+  "settings.environment.add_title": "新增环境变量",
+  "settings.environment.cancel": "取消",
+  "settings.environment.click_to_edit": "点击编辑",
+  "settings.environment.confirm_delete": "确定要删除 {key} 吗？应用更改后，agent 将不再看到这个变量。",
+  "settings.environment.close_editor": "关闭编辑器",
+  "settings.environment.delete": "删除",
+  "settings.environment.delete_title": "删除环境变量",
+  "settings.environment.delete_variable": "删除 {key}",
+  "settings.environment.deleting": "删除中……",
+  "settings.environment.description": "保存本机 agents、skills 和 MCP servers 使用的 API keys 与 tokens。Secret 只保留在这台设备上；应用更改后即可使用。",
+  "settings.environment.edit_title": "编辑环境变量",
+  "settings.environment.empty_body": "添加 ANTHROPIC_API_KEY、GOOGLE_API_KEY、ELEVENLABS_API_KEY、GITHUB_TOKEN 等服务凭证，供 agents 和 MCP servers 使用。",
+  "settings.environment.empty_title": "还没有环境变量",
+  "settings.environment.empty_value": "（空）",
+  "settings.environment.footer_hint": "OPENWORK_ 和 OPENCODE_ 键名保留给应用/运行时使用。OpenCode 运行时设置请通过 shell 配置。",
+  "settings.environment.override_hint": "OpenWork 启动前已经存在的环境变量，会优先于这里保存的值。",
+  "settings.environment.hide": "隐藏",
+  "settings.environment.hide_value": "隐藏 {key} 的值",
+  "settings.environment.key_hint": "仅允许字母、数字和下划线；不能以数字开头。",
+  "settings.environment.key_label": "名称",
+  "settings.environment.loading": "加载中……",
+  "settings.environment.remote_workspace_hint": "当前工作区是远程工作区。这里不会显示或编辑本机环境变量；请使用云端 LLM Providers，或直接配置 worker 所在主机。",
+  "settings.environment.apply_button": "应用更改",
+  "settings.environment.apply_blocked_active_tasks": "应用环境更改前，请先停止正在运行的任务。",
+  "settings.environment.apply_confirm_body": "OpenWork 会重启本机 agents，让它们使用最新环境变量。正在运行的本机任务可能会停止。",
+  "settings.environment.apply_no_local_workspace": "OpenWork 尚未连接到本机工作区。",
+  "settings.environment.apply_pending_body": "应用更改会重启本机 agents，并让最新值可用。",
+  "settings.environment.apply_pending_body_manual": "重启本机 agents 后，最新值才会可用。",
+  "settings.environment.apply_pending_title": "更改已保存，但尚未生效",
+  "settings.environment.apply_refresh_failed": "更改已生效，但 OpenWork 状态没有刷新。如果界面看起来过期，请重新打开应用。",
+  "settings.environment.apply_success": "环境变量更改已生效。",
+  "settings.environment.apply_title": "应用环境变量更改？",
+  "settings.environment.apply_unavailable": "只有桌面应用可以直接应用更改。",
+  "settings.environment.applying": "应用中……",
+  "settings.environment.restart_required": "已保存。应用更改后即可生效。",
+  "settings.environment.reveal": "查看",
+  "settings.environment.reveal_value": "查看 {key} 的值",
+  "settings.environment.save": "保存",
+  "settings.environment.saving": "保存中……",
+  "settings.environment.title": "环境变量",
+  "settings.environment.validation_duplicate": "已经存在同名变量。",
+  "settings.environment.validation_empty": "必须填写名称。",
+  "settings.environment.validation_reserved": "OPENWORK_ 和 OPENCODE_ 名称由 OpenWork/OpenCode 管理。",
+  "settings.environment.validation_shape": "请使用字母、数字和下划线，且不能以数字开头。",
+  "settings.environment.value_label": "值",
+  "settings.exa_restart_hint": "更改此设置后，请重启OpenCode或编排器。",
+  "settings.export": "导出",
+  "settings.exported_debug_report": "已导出运行时报告JSON。",
+  "settings.feedback_badge": "我们阅读每条反馈",
+  "settings.feedback_desc": "告诉我们哪里体验流畅、哪里需要改进。反馈直达团队，帮助我们确定下一步优先级。",
+  "settings.feedback_title": "帮助塑造OpenWork",
+  "settings.group_global": "全局",
+  "settings.group_workspace": "工作区",
+  "settings.hide_titlebar": "隐藏标题栏",
+  "settings.hide_titlebar_desc": "隐藏窗口标题栏。适用于平铺式窗口管理器。",
+  "settings.join_discord": "加入Discord",
+  "settings.language": "语言",
+  "settings.language.description": "选择你的首选语言",
+  "settings.last_error": "最后错误",
+  "settings.last_stderr": "最后stderr",
+  "settings.last_stdout": "最后stdout",
+  "settings.loading_providers": "正在加载提供商…",
+  "settings.managed_by_env": "由环境变量管理",
+  "settings.model": "模型",
+  "settings.model_behavior": "模型行为",
+  "settings.model_behavior_desc": "打开默认模型选择器，选择可用的推理配置。",
+  "settings.model_section_desc": "选择默认对话模型并查看其推理方式。",
+  "settings.model_title": "模型",
+  "settings.no_active_workspace": "没有活动的本地工作区。",
+  "settings.no_audit_entries": "暂无审计记录。",
+  "settings.no_custom_path_set": "未设置自定义路径",
+  "settings.nuke_hint": "仅在需要完全重置桌面应用及其OpenCode运行时状态时使用。",
+  "settings.off": "关闭",
+  "settings.on": "开启",
+  "settings.open_deeplink_action": "正在打开…",
+  "settings.open_deeplink_button": "隐藏",
+  "settings.open_deeplink_desc": "粘贴OpenWork深度链接或共享URL以打开。",
+  "settings.open_deeplink_title": "打开深层链接",
+  "settings.opencode_cache": "OpenCode缓存",
+  "settings.opencode_cache_description": "修复用于启动引擎的缓存数据。可放心执行。",
+  "settings.opencode_engine_desc": "用于智能体、工具和模型提供商的本地运行时。",
+  "settings.opencode_engine_label": "OpenCode引擎",
+  "settings.opencode_engine_sidecar_desc": "本地执行sidecar。",
+  "settings.opencode_sdk_desc": "UI连接诊断。",
+  "settings.opencode_sdk_title": "OpenCode引擎",
+  "settings.opencode_section_label": "OpenCode",
+  "settings.opening": "打开深层链接",
+  "settings.openwork_config_sidecar_desc": "配置和审批sidecar。",
+  "settings.openwork_diagnostics_title": "OpenWork服务器诊断",
+  "settings.openwork_server_desc": "用于应用同步、工作者和远程连接的会话控制平面。",
+  "settings.openwork_server_label": "OpenWork服务器",
+  "settings.pending_permissions": "待处理的权限",
+  "settings.production_mode_badge": "生产模式",
+  "settings.provider_default_desc": "使用模型内置的默认推理行为。",
+  "settings.provider_default_label": "提供商默认",
+  "settings.provider_source_config": "配置",
+  "settings.provider_source_custom": "自定义",
+  "settings.provider_source_env": "环境变量",
+  "settings.providers_desc": "连接用于模型和工具的服务。",
+  "settings.providers_title": "提供商",
+  "settings.quit_hint": "OpenWork在清理后立即退出，以便下次启动时从此模式的全新本地状态开始。",
+  "settings.recent_events": "最近的事件",
+  "settings.reconnect_failed": "重新连接失败。请检查服务器URL/令牌后重试。",
+  "settings.reconnect_server": "正在重新连接…",
+  "settings.reconnect_server_failed": "重新连接OpenWork服务器失败。",
+  "settings.reconnected": "已重新连接OpenWork服务器。",
+  "settings.reconnecting": "正在重新连接…",
+  "settings.removing_containers": "正在移除容器…",
+  "settings.removing_local_state": "正在移除本地状态…",
+  "settings.repair_cache": "修复缓存",
+  "settings.repairing_cache": "正在修复缓存",
+  "settings.report_issue": "报告问题",
+  "settings.reset": "重置",
+  "settings.reset_app_data": "重置应用数据",
+  "settings.reset_app_data_description": "更彻底的方式。清除OpenWork缓存和应用数据。",
+  "settings.reset_app_data_title": "重置应用数据",
+  "settings.reset_app_data_warning": "清除此设备上的OpenWork缓存和应用数据。",
+  "settings.reset_button": "重置",
+  "settings.reset_cancel": "取消",
+  "settings.reset_config_defaults": "正在重置…",
+  "settings.reset_confirm_button": "重置并重启",
+  "settings.reset_confirmation_hint": "输入 {resetWord} 以确认。OpenWork将重启。",
+  "settings.reset_confirmation_label": "确认",
+  "settings.reset_confirmation_placeholder": "输入RESET",
+  "settings.reset_onboarding": "重置入门",
+  "settings.reset_onboarding_description": "清除OpenWork偏好设置并重启应用。",
+  "settings.reset_onboarding_title": "重置入门",
+  "settings.reset_onboarding_warning": "清除OpenWork本地偏好设置和工作区入门标记。",
+  "settings.reset_openwork_desc_dev": "在开发模式下，仅清除openwork-dev-data中的隔离OpenCode开发状态。",
+  "settings.reset_openwork_desc_prod": "在开发模式下，仅清除openwork-dev-data中的隔离OpenCode开发状态。",
+  "settings.reset_openwork_title": "重置OpenWork + OpenCode状态",
+  "settings.reset_requires_confirm": "需要输入RESET，应用将重启。",
+  "settings.reset_startup": "重置默认启动模式",
+  "settings.reset_startup_pref": "重置启动偏好",
+  "settings.reset_stop_active_runs": "重置前停止活动运行。",
+  "settings.resetting": "正在重置…",
+  "settings.restart_blocked_message": "OpenWork需要重启以完成此更新。为避免中断当前工作，安装已暂停，直到你的活动运行完成或你手动停止它们。",
+  "settings.restart_failed": "重启失败。请检查日志后重试。",
+  "settings.restart_opencode": "正在重启…",
+  "settings.restart_openwork_server": "正在重启…",
+  "settings.restart_server_failed": "重启本地服务器失败。",
+  "settings.restarted": "本地服务器已重启。",
+  "settings.restarting": "正在重启…",
+  "settings.reveal_config": "显示配置",
+  "settings.reveal_config_requires_desktop": "显示配置需要桌面应用",
+  "settings.run_sandbox_probe": "正在运行探测…",
+  "settings.running_probe": "正在运行探测…",
+  "settings.runtime_debug_desc": "可读的诊断快照，支持一键导出。",
+  "settings.runtime_debug_title": "运行时调试报告",
+  "settings.runtime_desc": "本地引擎和OpenWork服务器的状态。",
+  "settings.runtime_title": "运行时",
+  "settings.sandbox_error": "错误",
+  "settings.sandbox_export_hint": "使用上方运行时调试报告中的导出功能",
+  "settings.sandbox_probe_desc": "运行临时Docker沙箱启动检查并",
+  "settings.sandbox_probe_success": "沙箱探测成功。导出调试报告以获取支持。",
+  "settings.sandbox_probe_title": "沙箱探测",
+  "settings.sandbox_ready": "就绪",
+  "settings.sandbox_requires_desktop": "沙箱探测需要桌面应用",
+  "settings.sandbox_result": "结果：{status}",
+  "settings.sandbox_run_id": "运行ID：{id}",
+  "settings.sandbox_stop_runs_hint": "探测前请停止活动运行",
+  "settings.search_models": "搜索模型…",
+  "settings.send_feedback": "发送反馈",
+  "settings.show_model_reasoning": "显示模型推理",
+  "settings.show_model_reasoning_desc": "当模型提供推理过程时，在界面中展开推理轨迹。",
+  "settings.showing_models": "显示{count} / {total}",
+  "settings.startup": "启动",
+  "settings.startup_remote_warning": "启动偏好当前为远程。引擎设置",
+  "settings.startup_reset_hint": "这将清除你保存的偏好并显示连接",
+  "settings.startup_title": "启动",
+  "settings.stop_local_server": "停止本地服务器",
+  "settings.stop_runs_before_cleanup": "清理前请停止活动运行",
+  "settings.stop_runs_before_reset_config": "重置配置前请停止活动运行",
+  "settings.stop_runs_to_reset": "停止活动运行以重置",
+  "settings.switch": "切换",
+  "settings.tab_advanced": "高级",
+  "settings.tab_appearance": "外观",
+  "settings.tab_cloud": "Cloud",
+  "settings.tab_debug": "调试",
+  "settings.tab_description_advanced": "检查运行时健康状态、连接状态和面向开发者的控制项。",
+  "settings.tab_description_appearance": "调整OpenWork在桌面、系统主题和应用外观方面的显示效果。",
+  "settings.tab_description_debug": "查看运行时诊断信息、日志和底层调试工具。",
+  "settings.tab_description_den": "管理OpenWork Cloud连接、托管工作区和工作区访问。",
+  "settings.tab_description_extensions": "管理此工作区的MCP应用和OpenCode插件。",
+  "settings.tab_description_general": "连接提供商、选择默认模型、授权文件夹，以及控制所选OpenWork工作区和运行时连接。",
+  "settings.tab_description_environment": "保存本机 agents、skills 和 MCP servers 使用的 API keys 与 tokens。Secret 只保留在这台设备上。",
+  "settings.tab_description_recovery": "修复迁移状态、重置工作区默认值和恢复本地设置。",
+  "settings.tab_description_skills": "在设置中浏览、编辑和安装skills。",
+  "settings.tab_description_updates": "通过静默后台检查和安装控制保持应用为最新版本。",
+  "settings.tab_environment": "环境变量",
+  "settings.tab_extensions": "扩展",
+  "settings.tab_general": "设置",
+  "settings.tab_recovery": "恢复",
+  "settings.tab_skills": "Skills（技能）",
+  "settings.tab_updates": "更新",
+  "settings.theme_dark": "深色",
+  "settings.theme_light": "浅色",
+  "settings.theme_system": "系统",
+  "settings.theme_system_hint": "系统模式自动跟随你的操作系统偏好。",
+  "settings.update": "更新",
+  "settings.update_available": "可用更新：v",
+  "settings.update_available_version": "可用更新：v{version}",
+  "settings.update_check_button": "检查",
+  "settings.update_check_failed": "更新检查失败",
+  "settings.update_checking": "检查中...",
+  "settings.update_download_button": "下载",
+  "settings.update_downloading": "下载中...",
+  "settings.update_install_button": "安装并重启",
+  "settings.update_last_checked": "上次检查{time}",
+  "settings.update_published": "发布时间{date}",
+  "settings.update_ready": "准备安装：v",
+  "settings.update_ready_version": "准备安装：v{version}",
+  "settings.update_uptodate": "已是最新",
+  "settings.updates": "更新",
+  "settings.updates_desc": "保持OpenWork为最新版本。",
+  "settings.updates_desktop_only": "更新仅在桌面应用中可用。",
+  "settings.updates_not_supported": "此环境不支持更新。",
+  "settings.updates_title": "更新",
+  "settings.window_appearance_desc": "自定义窗口外观。",
+  "settings.worker_id_label": "工作区{id}",
+  "settings.worker_unresolved": "工作区{runtimeWorkspaceId}",
+  "settings.workspace_config_desc": ".opencode/openwork.json",
+  "settings.workspace_config_title": "工作区配置",
+  "settings.workspace_debug_events_label": "工作区调试事件",
+  "share.back_hint": "返回分享选项",
+  "share.chooser_subtitle": "选择分享此工作区的方式。",
+  "share.close_hint": "关闭",
+  "share.option_access_desc": "显示从其他设备访问此运行中工作区所需的实时连接详情。",
+  "share.option_access_title": "远程访问工作区",
+  "share.subtitle_access": "显示从其他设备访问此工作区所需的实时连接详情。",
+  "share.title": "分享工作区",
+  "share.view_access": "远程访问工作区",
+  "share.workspace_fallback": "工作区",
+  "share_skill_destination.add_to_workspace": "添加到工作区",
+  "share_skill_destination.adding": "正在添加…",
+  "share_skill_destination.connect_remote": "连接远程工作区",
+  "share_skill_destination.connect_remote_hint": "连接远程工作区以导入skill",
+  "share_skill_destination.create_worker": "新建工作区",
+  "share_skill_destination.create_worker_hint": "创建新工作区以导入skill",
+  "share_skill_destination.current_badge": "当前",
+  "share_skill_destination.existing_workers": "现有工作区",
+  "share_skill_destination.fallback_skill_name": "共享skill",
+  "share_skill_destination.local_badge": "本地",
+  "share_skill_destination.more_options": "更多选项",
+  "share_skill_destination.no_workers": "暂无就绪的工作区。请创建或连接远程工作区以安装此skill。",
+  "share_skill_destination.remote_badge": "远程",
+  "share_skill_destination.sandbox_badge": "沙箱",
+  "share_skill_destination.selected_badge": "已选择",
+  "share_skill_destination.selected_hint": "已选择。请确认下方的目标后提交。",
+  "share_skill_destination.skill_label": "共享skill",
+  "share_skill_destination.subtitle": "选择现有工作区或新建一个，然后导入此共享skill。",
+  "share_skill_destination.title": "这个skill放在哪里？",
+  "share_skill_destination.trigger_label": "触发器",
+  "sidebar.collapse": "收起",
+  "sidebar.expand": "展开",
+  "skills.add_custom_repo": "添加自定义GitHub仓库",
+  "skills.add_git_repo": "添加Git仓库",
+  "skills.add_openwork_hub": "添加OpenWork Hub",
+  "skills.available_from_hub": "从Hub获取",
+  "skills.catalog_search_placeholder": "搜索已安装、团队和中心skills",
+  "skills.cloud_choose_org_detail": "在Cloud面板中选择活动组织，然后刷新此列表。",
+  "skills.cloud_choose_org_hint": "在设置 → Cloud中选择组织以加载团队skills。",
+  "skills.cloud_footer_label": "团队",
+  "skills.cloud_hub_label": "Hub：{name}",
+  "skills.cloud_installed": "已在此工作区安装{name}。",
+  "skills.cloud_installing": "正在安装{title}…",
+  "skills.cloud_installing_short": "安装中",
+  "skills.cloud_no_search_matches": "没有匹配的skills。",
+  "skills.cloud_org_empty": "暂无可用的组织skills。",
+  "skills.cloud_org_fallback": "OpenWork Cloud",
+  "skills.cloud_org_load_failed": "加载组织skills失败。",
+  "skills.cloud_refresh": "刷新团队skills",
+  "skills.cloud_section_subtitle": "通过OpenWork Cloud与你共享的skills — 包括你可访问的团队skill中心。",
+  "skills.cloud_section_title": "来自你的组织",
+  "skills.cloud_shared_org": "组织",
+  "skills.cloud_shared_public": "公开",
+  "skills.cloud_sign_in": "登录Cloud",
+  "skills.cloud_sign_in_hint": "登录OpenWork Cloud以浏览团队和组织skills。",
+  "skills.copy_link_failed": "复制链接失败",
+  "skills.create_in_chat": "在聊天中创建skill",
+  "skills.desktop_required": "Skills管理需要桌面应用。",
+  "skills.enter_plugin_name": "输入插件包名称。",
+  "skills.failed_load_active": "加载活动插件失败。",
+  "skills.failed_load_opencode": "加载opencode.json失败",
+  "skills.failed_parse_opencode": "解析opencode.json失败",
+  "skills.failed_to_load": "加载skills失败",
+  "skills.failed_update_opencode": "更新opencode.json失败",
+  "skills.filter_all": "全部",
+  "skills.filter_cloud": "团队",
+  "skills.filter_hub": "Hub",
+  "skills.filter_installed": "已安装",
+  "skills.from_repo": "来自{owner}/{repo}",
+  "skills.github_repo_hint": "输入owner/repo格式的GitHub仓库。",
+  "skills.host_mode_only": "仅本地工作区",
+  "skills.host_only_error": "Skills管理需要本地工作区或已连接的OpenWork服务器。",
+  "skills.hub_desc": "浏览来自GitHub支持的Hub的共享skills，并将其添加到此工作区。",
+  "skills.hub_label": "Hub",
+  "skills.import": "导入",
+  "skills.import_failed": "导入失败（{status}）",
+  "skills.import_local": "导入本地skill",
+  "skills.import_local_skill": "导入本地skill",
+  "skills.imported": "已导入。",
+  "skills.install": "安装",
+  "skills.install_failed": "Skills安装失败。",
+  "skills.install_name_title": "安装{name}",
+  "skills.installed": "已安装的skills",
+  "skills.installed_desc": "已安装的skills存储在此工作区中，可以编辑或分享。",
+  "skills.installed_status": "已安装",
+  "skills.installing": "添加skill",
+  "skills.installing_prefix": "正在安装{name}…",
+  "skills.installing_skill_creator": "正在安装skill creator...",
+  "skills.link_copied": "链接已复制",
+  "skills.loading": "正在加载…",
+  "skills.no_description": "暂无描述。",
+  "skills.no_hub_repo_label": "未选择Hub仓库",
+  "skills.no_hub_repo_selected": "暂无可用的Hub skills。",
+  "skills.no_hub_skills": "未选择Hub仓库。添加GitHub仓库以浏览skills。",
+  "skills.no_opencode_found": "尚未找到opencode.json。添加插件以创建一个。",
+  "skills.no_opencode_workspace": "此工作区中还没有opencode.json。",
+  "skills.no_skills": "在`.opencode/skills`、`.claude/skills`或`~/.agents/skills`中未检测到skills。",
+  "skills.no_skills_found": "还没有找到skills。",
+  "skills.owner_label": "所有者",
+  "skills.owner_repo_required": "所有者和仓库为必填项。",
+  "skills.pick_project_first": "先选择一个项目文件夹。",
+  "skills.pick_project_for_active": "选择项目文件夹以加载活动插件。",
+  "skills.pick_project_for_plugins": "选择项目文件夹以管理项目插件。",
+  "skills.pick_workspace_first": "先选择一个工作区文件夹。",
+  "skills.plugin_already_listed": "插件已在opencode.json中列出。",
+  "skills.plugin_management_host_only": "插件管理需要桌面应用。",
+  "skills.plugins_host_only": "插件仅在桌面应用中可用。",
+  "skills.ref_label": "引用（分支/标签/提交）",
+  "skills.refresh": "刷新",
+  "skills.refresh_hub": "刷新Hub",
+  "skills.remove_saved_repo": "移除已保存的仓库",
+  "skills.repo_label": "仓库",
+  "skills.reveal_failed": "打开skills文件夹失败。",
+  "skills.reveal_folder": "打开skills文件夹",
+  "skills.save_and_load": "保存并加载",
+  "skills.select_skill_folder": "选择skill文件夹",
+  "skills.share_back": "返回",
+  "skills.share_chooser_subtitle": "保存到OpenWork Cloud组织，或发布公开安装链接。",
+  "skills.share_close": "关闭",
+  "skills.share_copy_link": "复制",
+  "skills.share_done": "完成",
+  "skills.share_option_public_desc": "创建任何人都可以使用的安装链接。",
+  "skills.share_option_public_title": "公开链接",
+  "skills.share_option_team_desc": "将此skill添加到当前OpenWork Cloud组织。",
+  "skills.share_option_team_title": "与团队分享",
+  "skills.share_public_create": "创建链接",
+  "skills.share_public_creating": "发布中…",
+  "skills.share_public_intro": "发布公开链接。拥有URL的任何人都可以安装此skill。",
+  "skills.share_public_regenerate": "重新生成链接",
+  "skills.share_publisher_label": "发布方",
+  "skills.share_subtitle_public": "拥有链接的任何人都可以安装此skill。",
+  "skills.share_subtitle_team": "保存在组织中供队友使用。",
+  "skills.share_team_choose_org": "请先在设置 → Cloud中选择组织。",
+  "skills.share_team_hubs_loading": "正在加载中心…",
+  "skills.share_team_org_fallback": "当前Cloud组织",
+  "skills.share_team_sign_in": "登录后与团队分享",
+  "skills.share_team_sign_in_hint": "浏览器将打开OpenWork Cloud。登录后返回此处。",
+  "skills.share_title": "分享skill",
+  "skills.shown_count": "显示{count}个",
+  "skills.skill_creator_already_installed": "Skill creator已经安装过了。",
+  "skills.skill_creator_installed": "Skill creator已安装。",
+  "skills.skill_load_failed": "加载skill失败。",
+  "skills.source_label": "来源",
+  "skills.title": "Skills（技能）",
+  "skills.trigger_label": "触发器：{trigger}",
+  "skills.uninstall": "卸载",
+  "skills.uninstall_failed": "卸载skill失败。",
+  "skills.uninstall_title": "卸载skill？",
+  "skills.uninstall_warning": "这将永久从工作区删除`{name}` skill。",
+  "skills.uninstalled": "Skill已删除。",
+  "skills.unknown_error": "未知错误",
+  "skills.worker_profile_desc": "Skills是此工作区的核心能力。从Hub发现、管理已安装的skills，并在聊天中直接创建新的skills。",
+  "status.back": "返回上一页",
+  "status.connected": "已连接",
+  "status.connecting": "正在连接",
+  "status.creating_task": "正在创建新任务",
+  "status.developer_mode": "开发者模式",
+  "status.disconnected": "已断开",
+  "status.disconnected_hint": "打开设置以重新连接",
+  "status.disconnected_label": "已断开",
+  "status.docs": "文档",
+  "status.feedback": "反馈",
+  "status.limited_hint": "重新连接以恢复完整OpenWork功能",
+  "status.limited_mcp_hint": "{count}个MCP已连接 · 重新连接以恢复完整功能",
+  "status.limited_mode": "受限模式",
+  "status.loading_session": "正在加载会话",
+  "status.mcp_connected": "{count}个MCP已连接",
+  "status.open_docs": "打开文档",
+  "status.openwork_ready": "OpenWork就绪",
+  "status.providers_connected": "{count}个提供商已连接",
+  "status.ready_for_tasks": "可接受新任务",
+  "status.running": "运行中",
+  "status.send_feedback": "发送反馈",
+  "status.settings": "设置",
+  "system.reload_body_agents": "OpenCode在启动时加载Agent。重新加载引擎以使更新的Agent可用。",
+  "system.reload_body_commands": "OpenCode在启动时加载命令。重新加载引擎以使更新的命令可用。",
+  "system.reload_body_config": "OpenCode在启动时读取opencode.json。重新加载引擎以应用配置变更。",
+  "system.reload_body_default": "OpenWork检测到需要重新加载OpenCode实例的变更。",
+  "system.reload_body_mcp": "OpenCode在启动时加载MCP服务器。重新加载引擎以激活新连接。",
+  "system.reload_body_mixed": "OpenWork检测到OpenCode配置变更。重新加载引擎以应用。",
+  "system.reload_body_plugins": "OpenCode在启动时加载npm插件。重新加载引擎以应用opencode.json变更。",
+  "system.reload_body_skills": "OpenCode会缓存技能发现/状态。重新加载引擎以使新安装的技能可用。",
+  "system.reload_failed": "重新加载引擎失败。",
+  "system.reload_required": "需要重新加载",
+  "system.reload_unavailable": "此工作区不支持重新加载。",
+  "system.stop_active_runs_before_reset": "请先停止活跃的运行再重置。",
+  "time.hours_ago": "{count}小时前",
+  "time.just_now": "刚刚",
+  "time.minutes_ago": "{count}分钟前",
+  "time.seconds_ago": "{count}秒前",
+  "workspace.loading_tasks": "正在加载任务…",
+  "workspace.local_badge": "本地",
+  "workspace.new_task_inline": "+ 新建任务",
+  "workspace.no_tasks": "暂无任务。",
+  "workspace.remote_badge": "远程",
+  "workspace.rename_description": "更新侧边栏中显示的名称。",
+  "workspace.rename_label": "工作区名称",
+  "workspace.rename_placeholder": "设计团队工作区",
+  "workspace.rename_title": "编辑工作区名称",
+  "workspace.sandbox_badge": "沙箱",
+  "workspace.selected": "已选择",
+  "workspace_list.add_workspace": "添加工作区",
+  "workspace_list.connecting": "正在连接…",
+  "workspace_list.delete_session": "删除会话",
+  "workspace_list.edit_connection": "编辑连接",
+  "workspace_list.edit_name": "编辑名称",
+  "workspace_list.hide_child_sessions": "隐藏子会话",
+  "workspace_list.recover": "恢复",
+  "workspace_list.remove_workspace": "移除工作区",
+  "workspace_list.rename_session": "重命名会话",
+  "workspace_list.remote_worker_unavailable": "远程工作区不可用",
+  "workspace_list.remote_worker_unavailable_hint": "连接修复前，OpenWork 无法从这个远程工作区加载任务。",
+  "workspace_list.reveal_explorer": "在资源管理器中显示",
+  "workspace_list.reveal_finder": "在Finder中显示",
+  "workspace_list.session_actions": "会话操作",
+  "workspace_list.share": "分享…",
+  "workspace_list.show_child_sessions": "显示子会话",
+  "workspace_list.show_more": "显示更多{count}个",
+  "workspace_list.show_more_fallback": "显示更多",
+  "workspace_list.test_connection": "测试连接",
+  "workspace_list.unavailable": "不可用",
+  "workspace_list.workspace_fallback": "工作区",
+  "workspace_list.workspace_options": "工作区选项",
+} as const;
diff --git a/apps/app/src/index.react.tsx b/apps/app/src/index.react.tsx
new file mode 100644
index 0000000000..4ea7da98fb
--- /dev/null
+++ b/apps/app/src/index.react.tsx
@@ -0,0 +1,54 @@
+/** @jsxImportSource react */
+import * as React from "react";
+import ReactDOM from "react-dom/client";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { BrowserRouter, HashRouter } from "react-router-dom";
+
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { initializeDenBootstrapConfig } from "./app/lib/den";
+import { getOpenWorkDeployment } from "./app/lib/openwork-deployment";
+import { bootstrapTheme } from "./app/theme";
+import { isDesktopRuntime } from "./app/utils";
+import { initLocale } from "./i18n";
+import { getReactQueryClient } from "./react-app/infra/query-client";
+import {
+  createDefaultPlatform,
+  PlatformProvider,
+} from "./react-app/kernel/platform";
+import { AppProviders } from "./react-app/shell/providers";
+import { AppRoot } from "./react-app/shell/app-root";
+import { startDeepLinkBridge } from "./react-app/shell/startup-deep-links";
+import "./app/index.css";
+
+bootstrapTheme();
+initLocale();
+startDeepLinkBridge();
+await initializeDenBootstrapConfig();
+
+const root = document.getElementById("root");
+
+if (!root) {
+  throw new Error("Root element not found");
+}
+
+root.dataset.openworkDeployment = getOpenWorkDeployment();
+
+const platform = createDefaultPlatform();
+const queryClient = getReactQueryClient();
+const Router = isDesktopRuntime() ? HashRouter : BrowserRouter;
+
+ReactDOM.createRoot(root).render(
+  <React.StrictMode>
+    <QueryClientProvider client={queryClient}>
+      <TooltipProvider>
+        <PlatformProvider value={platform}>
+          <AppProviders>
+            <Router>
+              <AppRoot />
+            </Router>
+          </AppProviders>
+        </PlatformProvider>
+      </TooltipProvider>
+    </QueryClientProvider>
+  </React.StrictMode>,
+);
diff --git a/apps/app/src/lib/utils.ts b/apps/app/src/lib/utils.ts
new file mode 100644
index 0000000000..a5ef193506
--- /dev/null
+++ b/apps/app/src/lib/utils.ts
@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
diff --git a/apps/app/src/react-app/ARCHITECTURE.md b/apps/app/src/react-app/ARCHITECTURE.md
new file mode 100644
index 0000000000..15fd2e3ac2
--- /dev/null
+++ b/apps/app/src/react-app/ARCHITECTURE.md
@@ -0,0 +1,123 @@
+# React App Architecture (`src/react-app/`)
+
+This document captures the domain-based layout for the React runtime being migrated into
+`apps/app`. The Solid runtime still ships by default; the React tree is being built up domain by
+domain so it can take over in a single hard cut.
+
+## Top-level layout
+
+```text
+src/react-app/
+├── shell/                     App bootstrap, providers composition, startup effects
+├── kernel/                    App-wide state + provider contracts (replaces app/context/*)
+├── infra/                     React-only runtime infra
+├── design-system/             Reusable presentational primitives + small modal primitives
+└── domains/                   Feature-scoped code, one folder per product domain
+    ├── session/
+    │   ├── chat/              Route chrome (status bar, question/permission surfaces)
+    │   ├── surface/           Transcript, composer, markdown, tool-call, debug panel
+    │   ├── sync/              Session state plumbing (store, runtime, chat adapter)
+    │   └── modals/            Model picker, question, rename-session
+    ├── workspace/             Create + share + rename workspace flows
+    ├── settings/
+    │   ├── state/             Settings-scoped hooks/providers
+    │   ├── pages/             Plugins, extensions, config, ... (tab bodies)
+    │   └── modals/            Reset modal, ...
+    ├── connections/
+    │   └── modals/            Add-MCP, Chrome-setup, ...
+    ├── bundles/               Import / start / skill-destination flows + agnostic re-exports
+    └── shell-feedback/        Status toasts, reload banner, top-right notifications
+```
+
+## Why domains
+
+The Solid tree grew pseudo-flat (`app/components/*`, `app/context/*`, `app/pages/*`).
+The React tree uses explicit domain ownership so every feature has one obvious home.
+
+- `session/` owns everything the session route renders, including the state layer under `sync/`.
+- `workspace/` owns every workspace-modal flow, so create/share/rename live together.
+- `settings/` owns settings state, the full settings shell once it lands, and each tab body as a
+  stateless page under `pages/`.
+- `connections/` owns MCP and provider auth UI.
+- `bundles/` owns import/start/destination modals plus re-exports of the framework-agnostic
+  helpers.
+- `shell-feedback/` owns toasts and notifications that the shell shows on top of everything.
+
+Cross-domain imports go through module boundaries, not a shared blob.
+
+## Data flow
+
+```text
+┌────────────────────────────────────────────────────────────┐
+│                     src/index.react.tsx                    │  React entry
+└────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌────────────────────────────────────────────────────────────┐
+│  react-app/shell/providers.tsx (AppProviders composition)  │
+│   ServerProvider                                           │
+│   └─ GlobalSDKProvider                                     │
+│      └─ GlobalSyncProvider                                 │
+│         └─ LocalProvider                                   │
+│            └─ (QueryClientProvider + PlatformProvider      │
+│               wrap AppProviders in index.react.tsx)        │
+└────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌────────────────────────────────────────────────────────────┐
+│               react-app/shell/app-root.tsx                 │  Route root (placeholder today)
+└────────────────────────────────────────────────────────────┘
+                              │
+           ┌──────────────────┼──────────────────┐
+           ▼                  ▼                  ▼
+   domains/session     domains/workspace   domains/settings
+           │                  │                  │
+           ▼                  ▼                  ▼
+  surface/, sync/,    create-/share-/     pages/ (plugins,
+   chat/, modals/     rename-*.tsx        config, ...),
+                                           modals/, state/
+```
+
+## State ownership
+
+- `react-app/kernel/store.ts`: Zustand store, the React replacement for the Solid context bag.
+  Domain selectors in `kernel/selectors.ts`.
+- `react-app/kernel/{server,global-sdk,global-sync,local}-provider.tsx`: the Solid provider stack
+  re-expressed in React context. Same composition order as `app/entry.tsx`.
+- `react-app/kernel/platform.tsx`: `PlatformProvider` + `createDefaultPlatform()` helper
+  (Tauri-vs-web).
+- `react-app/kernel/system-state.ts`: `useSystemState()` for reload + reset modal state.
+- `react-app/kernel/model-config.ts`: framework-agnostic model parse/serialize helpers plus
+  `useDefaultModel()` (the heavier workspace overrides and auto-compact logic still live in
+  Solid and will be ported with the settings shell).
+- `react-app/infra/query-client.ts`: TanStack Query singleton.
+- Feature-specific state that is tightly coupled to one domain lives inside that domain
+  (`domains/session/sync/`, `domains/settings/state/`).
+
+## Framework-agnostic boundary
+
+Anything that is already Solid-free stays under `src/app/` and is re-exported from the React
+tree when a domain-scoped import path is clearer. Examples:
+
+- `app/lib/*` (opencode, tauri, den, openwork-server, ...) — consumed directly by React.
+- `app/types.ts`, `app/constants.ts`, `app/theme.ts`, `app/utils/*` — shared across both runtimes.
+- `app/session/composer-tools.ts` — shared session helpers.
+- `app/bundles/{types,schema,url-policy,sources,apply,publish,skill-org-publish,index}` — bundle
+  logic consumed by both runtimes; React side re-exports from `domains/bundles/*`.
+
+## Porting pattern
+
+1. **Move, don't rewrite, for framework-free files.** Re-export from the React domain folder so
+   Solid can keep importing through the old path during the transition.
+2. **Invert contexts to props** when porting pages that depended on Solid context. The React
+   version takes the data/actions it needs as props; the parent wires it up. This lets domain
+   pages land before their provider layer is fully ported.
+3. **Each port is its own commit.** The Solid runtime stays green the entire time; the React
+   entry (`src/index.react.tsx`) builds and typechecks after every commit.
+
+## Active shims
+
+During the transition, files under `src/react/**` are thin re-exports pointing at the new
+`react-app/**` locations. They exist so the Solid runtime (which imports from the old paths via
+`ReactIsland`) keeps compiling. All `src/react/**` files are deleted in the final Phase 8 cutover
+along with the Solid tree under `src/app/**`.
diff --git a/apps/app/src/react-app/design-system/button.tsx b/apps/app/src/react-app/design-system/button.tsx
new file mode 100644
index 0000000000..53db2777c1
--- /dev/null
+++ b/apps/app/src/react-app/design-system/button.tsx
@@ -0,0 +1,37 @@
+/** @jsxImportSource react */
+import { forwardRef, type ButtonHTMLAttributes } from "react";
+
+export type ButtonProps = ButtonHTMLAttributes<HTMLButtonElement> & {
+  variant?: "primary" | "secondary" | "ghost" | "outline" | "danger";
+};
+
+const base =
+  "inline-flex items-center justify-center gap-2 rounded-lg px-4 py-2 text-sm font-medium transition-colors duration-150 active:scale-[0.98] focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.2)] disabled:opacity-50 disabled:cursor-not-allowed";
+
+const variants: Record<NonNullable<ButtonProps["variant"]>, string> = {
+  primary:
+    "bg-dls-accent text-white hover:bg-[var(--dls-accent-hover)] border border-transparent shadow-[0_1px_2px_rgba(17,24,39,0.12)]",
+  secondary:
+    "bg-gray-12 text-gray-1 hover:bg-gray-11 border border-transparent font-semibold",
+  ghost:
+    "bg-transparent text-dls-secondary hover:text-dls-text hover:bg-dls-hover",
+  outline:
+    "border border-dls-border text-dls-text hover:bg-dls-hover bg-transparent",
+  danger: "bg-red-3 text-red-11 hover:bg-red-4 border border-red-6",
+};
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(
+  function Button({ variant, className, type, disabled, ...rest }, ref) {
+    const effectiveVariant = variant ?? "primary";
+    return (
+      <button
+        ref={ref}
+        type={type ?? "button"}
+        disabled={disabled}
+        aria-disabled={disabled}
+        className={`${base} ${variants[effectiveVariant]} ${className ?? ""}`.trim()}
+        {...rest}
+      />
+    );
+  },
+);
diff --git a/apps/app/src/react-app/design-system/flyout-item.tsx b/apps/app/src/react-app/design-system/flyout-item.tsx
new file mode 100644
index 0000000000..aafa4379be
--- /dev/null
+++ b/apps/app/src/react-app/design-system/flyout-item.tsx
@@ -0,0 +1,48 @@
+/** @jsxImportSource react */
+import { useEffect, useState } from "react";
+import { Check, FileText, Folder } from "lucide-react";
+
+export type FlyoutItemProps = {
+  item: {
+    id: string;
+    rect: { top: number; left: number; width: number; height: number };
+    targetRect: { top: number; left: number; width: number; height: number };
+    label: string;
+    icon: "file" | "check" | "folder";
+  };
+};
+
+export function FlyoutItem(props: FlyoutItemProps) {
+  const [active, setActive] = useState(false);
+
+  useEffect(() => {
+    const frame1 = requestAnimationFrame(() => {
+      const frame2 = requestAnimationFrame(() => setActive(true));
+      return () => cancelAnimationFrame(frame2);
+    });
+    return () => cancelAnimationFrame(frame1);
+  }, []);
+
+  return (
+    <div
+      className="fixed z-[100] pointer-events-none transition-all duration-1000 ease-[cubic-bezier(0.16,1,0.3,1)] flex items-center gap-2 px-3 py-2 rounded-xl bg-gray-12 text-gray-1 shadow-xl border border-gray-11/20"
+      style={{
+        top: `${props.item.rect.top}px`,
+        left: `${props.item.rect.left}px`,
+        transform: active
+          ? `translate(${props.item.targetRect.left - props.item.rect.left}px, ${
+              props.item.targetRect.top - props.item.rect.top
+            }px) scale(0.3)`
+          : "translate(0, 0) scale(1)",
+        opacity: active ? 0 : 1,
+      }}
+    >
+      {props.item.icon === "check" ? <Check size={14} /> : null}
+      {props.item.icon === "file" ? <FileText size={14} /> : null}
+      {props.item.icon === "folder" ? <Folder size={14} /> : null}
+      <span className="text-xs font-medium truncate max-w-[120px]">
+        {props.item.label}
+      </span>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/design-system/modals/confirm-modal.tsx b/apps/app/src/react-app/design-system/modals/confirm-modal.tsx
new file mode 100644
index 0000000000..f642ad9f98
--- /dev/null
+++ b/apps/app/src/react-app/design-system/modals/confirm-modal.tsx
@@ -0,0 +1,78 @@
+/** @jsxImportSource react */
+import type { ReactNode } from "react";
+import { AlertTriangle } from "lucide-react";
+
+export type ConfirmModalProps = {
+  open: boolean;
+  title: string;
+  message: string | ReactNode;
+  confirmLabel: string;
+  cancelLabel: string;
+  variant?: "danger" | "warning";
+  confirmButtonVariant?: "primary" | "secondary" | "ghost" | "outline" | "danger";
+  cancelButtonVariant?: "primary" | "secondary" | "ghost" | "outline" | "danger";
+  onConfirm: () => void;
+  onCancel: () => void;
+};
+
+const buttonBaseClass =
+  "inline-flex items-center justify-center rounded-full px-4 py-2 text-[13px] font-medium transition-colors focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.18)] disabled:cursor-not-allowed disabled:opacity-60";
+
+const buttonClasses = {
+  primary: `${buttonBaseClass} bg-[var(--dls-accent)] text-white hover:bg-[var(--dls-accent-hover)]`,
+  secondary: `${buttonBaseClass} bg-gray-12 text-gray-1 hover:bg-gray-11`,
+  ghost: `${buttonBaseClass} bg-transparent text-dls-secondary hover:bg-[var(--dls-hover)] hover:text-dls-text`,
+  outline: `${buttonBaseClass} border border-dls-border bg-dls-surface text-dls-text hover:bg-[var(--dls-hover)]`,
+  danger: `${buttonBaseClass} bg-red-9 text-white hover:bg-red-10`,
+} satisfies Record<NonNullable<ConfirmModalProps["confirmButtonVariant"]>, string>;
+
+export function ConfirmModal(props: ConfirmModalProps) {
+  if (!props.open) return null;
+  const variant = props.variant ?? "warning";
+  const confirmVariant = props.confirmButtonVariant ?? (variant === "danger" ? "danger" : "primary");
+  const cancelVariant = props.cancelButtonVariant ?? "outline";
+
+  const iconTileClass =
+    variant === "danger"
+      ? "bg-red-3/50 text-red-11"
+      : "bg-amber-3/50 text-amber-11";
+
+  return (
+    <div className="fixed inset-0 z-[60] bg-gray-1/70 backdrop-blur-sm flex items-center justify-center p-4">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-md rounded-2xl shadow-2xl overflow-hidden">
+        <div className="p-6">
+          <div className="flex items-start gap-4">
+            <div
+              className={`shrink-0 w-10 h-10 rounded-full flex items-center justify-center ${iconTileClass}`}
+            >
+              <AlertTriangle size={20} />
+            </div>
+            <div className="min-w-0">
+              <h3 className="text-base font-semibold text-gray-12">
+                {props.title}
+              </h3>
+              <p className="mt-2 text-sm text-gray-11">{props.message}</p>
+            </div>
+          </div>
+
+          <div className="mt-6 flex justify-end gap-2">
+            <button
+              type="button"
+              className={buttonClasses[cancelVariant]}
+              onClick={props.onCancel}
+            >
+              {props.cancelLabel}
+            </button>
+            <button
+              type="button"
+              className={buttonClasses[confirmVariant]}
+              onClick={props.onConfirm}
+            >
+              {props.confirmLabel}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/design-system/provider-icon.tsx b/apps/app/src/react-app/design-system/provider-icon.tsx
new file mode 100644
index 0000000000..ce3f2dca66
--- /dev/null
+++ b/apps/app/src/react-app/design-system/provider-icon.tsx
@@ -0,0 +1,91 @@
+/** @jsxImportSource react */
+
+export type ProviderIconProps = {
+  providerId?: string | null;
+  /**
+   * Optional provider display name. When the id is an opaque cloud id
+   * (e.g. a uuid), the name is what tells us whether it's an Anthropic /
+   * OpenAI / OpenCode provider. Ported from dev 022b68a8 ("key cloud
+   * providers by cloud id") so the icon still resolves by family.
+   */
+  providerName?: string | null;
+  className?: string;
+  size?: number;
+};
+
+export function ProviderIcon(props: ProviderIconProps) {
+  const size = props.size ?? 16;
+  const normalizedId = props.providerId?.trim().toLowerCase() ?? "";
+  const normalizedName = props.providerName?.trim().toLowerCase() ?? "";
+  const hasProviderFamily = (family: string) =>
+    normalizedId === family || normalizedName.includes(family);
+
+  const isAnthropic = hasProviderFamily("anthropic");
+  const isOpenAI = hasProviderFamily("openai");
+  const isOpenCode = hasProviderFamily("opencode");
+
+  const fallbackLetters = (() => {
+    if (normalizedId === "openrouter") return "OR";
+    if (normalizedId === "deepseek") return "DS";
+    if (normalizedId === "google") return "GO";
+    if (normalizedId.length >= 2) return normalizedId.substring(0, 2).toUpperCase();
+    return "AI";
+  })();
+
+  return (
+    <div
+      className={`flex shrink-0 items-center justify-center rounded-md ${
+        props.className ?? ""
+      }`}
+      style={{ width: `${size}px`, height: `${size}px` }}
+    >
+      {isOpenAI ? (
+        <svg
+          role="img"
+          viewBox="0 0 24 24"
+          xmlns="http://www.w3.org/2000/svg"
+          fill="currentColor"
+          width={size}
+          height={size}
+        >
+          <path d="M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 0 1-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 0 0 .7806 0l5.8428-3.3685v2.3324a.0804.0804 0 0 1-.0332.0615L9.74 19.9502a4.4992 4.4992 0 0 1-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 0 1 2.3655-1.9728V11.6a.7664.7664 0 0 0 .3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 0 1-.071 0l-4.8303-2.7865A4.504 4.504 0 0 1 2.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 0 1 .071 0l4.8303 2.7913a4.4944 4.4944 0 0 1-.6765 8.1042v-5.6772a.79.79 0 0 0-.407-.667zm2.0107-3.0231l-.142-.0852-4.7735-2.7818a.7759.7759 0 0 0-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 0 1 .0284-.0615l4.8303-2.7866a4.4992 4.4992 0 0 1 6.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 0 1-.038-.0567V6.0742a4.4992 4.4992 0 0 1 7.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 0 0-.3927.6813zm1.0976-2.3654l2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997Z" />
+        </svg>
+      ) : isAnthropic ? (
+        <svg
+          role="img"
+          viewBox="0 0 24 24"
+          xmlns="http://www.w3.org/2000/svg"
+          fill="currentColor"
+          width={size}
+          height={size}
+        >
+          <path d="M17.304 3.541h-3.672l6.696 16.918H24Zm-10.608 0L0 20.459h3.744l1.369-3.553h7.005l1.369 3.553h3.744L10.536 3.541Zm-.371 10.223 2.291-5.946 2.291 5.946Z" />
+        </svg>
+      ) : isOpenCode ? (
+        <svg
+          role="img"
+          viewBox="0 0 24 24"
+          xmlns="http://www.w3.org/2000/svg"
+          fill="none"
+          stroke="currentColor"
+          strokeWidth={2}
+          strokeLinecap="round"
+          strokeLinejoin="round"
+          width={size}
+          height={size}
+        >
+          <path d="M12 2L2 7l10 5 10-5-10-5Z" />
+          <path d="M2 17l10 5 10-5" />
+          <path d="M2 12l10 5 10-5" />
+        </svg>
+      ) : (
+        <div
+          className="flex h-full w-full items-center justify-center rounded bg-gray-3 text-[10px] font-bold tracking-tight text-gray-11"
+          style={{ fontSize: `${Math.max(8, size * 0.45)}px` }}
+        >
+          {fallbackLetters}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/design-system/restriction-notice-modal.tsx b/apps/app/src/react-app/design-system/restriction-notice-modal.tsx
new file mode 100644
index 0000000000..66a441cd8e
--- /dev/null
+++ b/apps/app/src/react-app/design-system/restriction-notice-modal.tsx
@@ -0,0 +1,60 @@
+/** @jsxImportSource react */
+import { X } from "lucide-react";
+
+import { t } from "../../i18n";
+import { Button } from "./button";
+
+export type RestrictionNoticeModalProps = {
+  open: boolean;
+  title: string;
+  message: string;
+  onClose: () => void;
+};
+
+/**
+ * React port of the Solid `RestrictionNoticeModal`
+ * (`apps/app/src/app/components/restriction-notice-modal.tsx` on dev — added
+ * as part of #1505 "enforce desktop restriction policies").
+ *
+ * Purposefully framework-free except for the design-system Button: this is
+ * a thin, declarative surface driven by the cloud domain when an org gates
+ * a feature (blockZenModel, disallowNonCloudModels, blockMultipleWorkspaces).
+ */
+export function RestrictionNoticeModal(props: RestrictionNoticeModalProps) {
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-[60] flex items-center justify-center bg-black/40 p-4 backdrop-blur-sm">
+      <div className="flex w-full max-w-[480px] flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+        <div className="flex items-start justify-between gap-4 border-b border-dls-border px-6 py-5">
+          <div className="min-w-0">
+            <h2 className="text-[20px] font-semibold tracking-[-0.3px] text-dls-text">
+              {props.title}
+            </h2>
+          </div>
+          <button
+            type="button"
+            className="inline-flex h-9 w-9 items-center justify-center rounded-full text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text"
+            aria-label={t("common.close")}
+            onClick={props.onClose}
+          >
+            <X size={18} />
+          </button>
+        </div>
+
+        <div className="px-6 py-6">
+          <p className="text-[14px] leading-6 text-dls-secondary">
+            {props.message}
+          </p>
+          <div className="mt-6 flex justify-end">
+            <Button variant="primary" onClick={props.onClose}>
+              {t("common.close")}
+            </Button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default RestrictionNoticeModal;
diff --git a/apps/app/src/react-app/design-system/select-menu.tsx b/apps/app/src/react-app/design-system/select-menu.tsx
new file mode 100644
index 0000000000..896897dff3
--- /dev/null
+++ b/apps/app/src/react-app/design-system/select-menu.tsx
@@ -0,0 +1,123 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Check, ChevronDown } from "lucide-react";
+
+export type SelectMenuOption = {
+  value: string;
+  label: string;
+};
+
+type SelectMenuProps = {
+  options: SelectMenuOption[];
+  value: string;
+  onChange: (value: string) => void;
+  disabled?: boolean;
+  placeholder?: string;
+  id?: string;
+  ariaLabelledBy?: string;
+  ariaLabel?: string;
+};
+
+const triggerClass =
+  "flex w-full items-center justify-between gap-2 rounded-xl border border-dls-border bg-dls-surface px-3.5 py-2.5 text-left text-[14px] text-dls-text shadow-none transition-[border-color,box-shadow] hover:border-dls-border focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.14)] disabled:cursor-not-allowed disabled:opacity-60";
+
+const panelClass =
+  "absolute left-0 right-0 top-[calc(100%+6px)] z-[100] max-h-56 overflow-auto rounded-xl border border-dls-border bg-dls-surface py-1 shadow-[var(--dls-shell-shadow)]";
+
+const optionRowClass =
+  "flex w-full items-center gap-2 px-3 py-2.5 text-left text-[13px] text-dls-text transition-colors hover:bg-dls-hover";
+
+export function SelectMenu(props: SelectMenuProps) {
+  const [open, setOpen] = useState(false);
+  const rootRef = useRef<HTMLDivElement | null>(null);
+
+  const displayLabel = useMemo(() => {
+    const match = props.options.find((o) => o.value === props.value);
+    if (match) return match.label;
+    return props.placeholder?.trim() || "";
+  }, [props.options, props.placeholder, props.value]);
+
+  const close = useCallback(() => setOpen(false), []);
+
+  useEffect(() => {
+    if (!open) return;
+    const onPointerDown = (event: PointerEvent) => {
+      const target = event.target as Node | null;
+      if (rootRef.current && target && !rootRef.current.contains(target)) {
+        close();
+      }
+    };
+    window.addEventListener("pointerdown", onPointerDown, true);
+    return () =>
+      window.removeEventListener("pointerdown", onPointerDown, true);
+  }, [close, open]);
+
+  useEffect(() => {
+    if (!open) return;
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        close();
+      }
+    };
+    window.addEventListener("keydown", onKeyDown);
+    return () => window.removeEventListener("keydown", onKeyDown);
+  }, [close, open]);
+
+  return (
+    <div ref={rootRef} className="relative w-full">
+      <button
+        type="button"
+        id={props.id}
+        className={triggerClass}
+        disabled={props.disabled}
+        aria-expanded={open}
+        aria-haspopup="listbox"
+        aria-labelledby={props.ariaLabelledBy}
+        aria-label={props.ariaLabel}
+        onClick={() => {
+          if (props.disabled) return;
+          setOpen((o) => !o);
+        }}
+      >
+        <span className="min-w-0 flex-1 truncate">{displayLabel}</span>
+        <ChevronDown
+          size={18}
+          className={`shrink-0 text-dls-secondary transition-transform duration-200 ${
+            open ? "rotate-180" : ""
+          }`}
+          aria-hidden
+        />
+      </button>
+
+      {open && !props.disabled ? (
+        <div className={panelClass} role="listbox">
+          {props.options.map((opt) => (
+            <button
+              key={opt.value}
+              type="button"
+              role="option"
+              aria-selected={opt.value === props.value}
+              className={`${optionRowClass} ${
+                opt.value === props.value ? "bg-dls-hover/80" : ""
+              }`}
+              onClick={() => {
+                props.onChange(opt.value);
+                close();
+              }}
+            >
+              <span className="min-w-0 flex-1 truncate">{opt.label}</span>
+              {opt.value === props.value ? (
+                <Check
+                  size={16}
+                  className="shrink-0 text-[var(--dls-accent)]"
+                  aria-hidden
+                />
+              ) : null}
+            </button>
+          ))}
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/design-system/text-input.tsx b/apps/app/src/react-app/design-system/text-input.tsx
new file mode 100644
index 0000000000..595f9f24b0
--- /dev/null
+++ b/apps/app/src/react-app/design-system/text-input.tsx
@@ -0,0 +1,31 @@
+/** @jsxImportSource react */
+import { forwardRef, type InputHTMLAttributes } from "react";
+
+export type TextInputProps = InputHTMLAttributes<HTMLInputElement> & {
+  label?: string;
+  hint?: string;
+};
+
+export const TextInput = forwardRef<HTMLInputElement, TextInputProps>(
+  function TextInput({ label, hint, className, ...rest }, ref) {
+    return (
+      <label className="block">
+        {label ? (
+          <div className="mb-1 text-xs font-medium text-dls-secondary">
+            {label}
+          </div>
+        ) : null}
+        <input
+          ref={ref}
+          className={`w-full rounded-lg bg-dls-surface px-3 py-2 text-sm text-dls-text placeholder:text-dls-secondary border border-dls-border shadow-sm focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.2)] ${
+            className ?? ""
+          }`.trim()}
+          {...rest}
+        />
+        {hint ? (
+          <div className="mt-1 text-xs text-dls-secondary">{hint}</div>
+        ) : null}
+      </label>
+    );
+  },
+);
diff --git a/apps/app/src/react-app/design-system/web-unavailable-surface.tsx b/apps/app/src/react-app/design-system/web-unavailable-surface.tsx
new file mode 100644
index 0000000000..dce81dfeb0
--- /dev/null
+++ b/apps/app/src/react-app/design-system/web-unavailable-surface.tsx
@@ -0,0 +1,63 @@
+/** @jsxImportSource react */
+import type { ReactNode } from "react";
+import { ArrowUpRight } from "lucide-react";
+
+export type WebUnavailableSurfaceProps = {
+  unavailable: boolean;
+  children: ReactNode;
+  compact?: boolean;
+  className?: string;
+  contentClassName?: string;
+};
+
+const MESSAGE =
+  "This feature is currently unavailable in OpenWork Web, check OpenWork Desktop for full functionality.";
+
+export function WebUnavailableSurface(props: WebUnavailableSurfaceProps) {
+  const innerProps = props.unavailable
+    ? {
+        inert: true,
+        "aria-disabled": true as const,
+        className: "opacity-55",
+      }
+    : {
+        className: "",
+      };
+
+  return (
+    <div className={props.className}>
+      {props.unavailable ? (
+        <div
+          className={
+            props.compact
+              ? "mb-3 rounded-xl border border-amber-7/30 bg-amber-2/45 px-3 py-2 text-[11px] text-amber-12"
+              : "mb-4 rounded-2xl border border-amber-7/30 bg-amber-2/45 px-4 py-3 text-[13px] text-amber-12"
+          }
+        >
+          <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+            <span>{MESSAGE}</span>
+            <a
+              href="https://openworklabs.com"
+              target="_blank"
+              rel="noreferrer"
+              className="inline-flex items-center gap-1 underline underline-offset-2 hover:no-underline"
+            >
+              <span>Download OpenWork Desktop</span>
+              <ArrowUpRight size={props.compact ? 12 : 14} />
+            </a>
+          </div>
+        </div>
+      ) : null}
+
+      <div className={`relative ${props.contentClassName ?? ""}`}>
+        <div {...innerProps}>{props.children}</div>
+        {props.unavailable ? (
+          <div
+            className="absolute inset-0 z-10 cursor-not-allowed"
+            aria-hidden="true"
+          />
+        ) : null}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/bundles/apply.ts b/apps/app/src/react-app/domains/bundles/apply.ts
new file mode 100644
index 0000000000..de1662d499
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/apply.ts
@@ -0,0 +1 @@
+export * from "../../../app/bundles/apply";
diff --git a/apps/app/src/react-app/domains/bundles/import-modal.tsx b/apps/app/src/react-app/domains/bundles/import-modal.tsx
new file mode 100644
index 0000000000..f37bf10b76
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/import-modal.tsx
@@ -0,0 +1,222 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useState } from "react";
+import {
+  Boxes,
+  ChevronDown,
+  ChevronRight,
+  Plus,
+  Sparkles,
+  X,
+} from "lucide-react";
+
+import type { BundleWorkerOption } from "./types";
+
+export type BundleImportModalProps = {
+  open: boolean;
+  title: string;
+  description: string;
+  items: string[];
+  workers: BundleWorkerOption[];
+  busy?: boolean;
+  error?: string | null;
+  onClose: () => void;
+  onCreateNewWorker: () => void;
+  onSelectWorker: (workspaceId: string) => void;
+};
+
+export function BundleImportModal(props: BundleImportModalProps) {
+  const [showWorkers, setShowWorkers] = useState(false);
+
+  useEffect(() => {
+    if (!props.open) return;
+    setShowWorkers(false);
+  }, [props.open]);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key !== "Escape") return;
+      event.preventDefault();
+      props.onClose();
+    };
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+  }, [props]);
+
+  const visibleItems = useMemo(
+    () => props.items.filter(Boolean).slice(0, 4),
+    [props.items],
+  );
+  const hiddenItemCount = useMemo(
+    () =>
+      Math.max(
+        0,
+        props.items.filter(Boolean).length - visibleItems.length,
+      ),
+    [props.items, visibleItems.length],
+  );
+
+  if (!props.open) return null;
+  const busy = Boolean(props.busy);
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-gray-1/70 p-4 backdrop-blur-sm">
+      <div className="w-full max-w-xl overflow-hidden rounded-2xl border border-gray-6 bg-gray-2 shadow-2xl">
+        <div className="border-b border-gray-6 bg-gray-1 px-6 py-5">
+          <div className="flex items-start justify-between gap-4">
+            <div className="flex items-start gap-3">
+              <div className="flex h-11 w-11 items-center justify-center rounded-2xl bg-indigo-9/15 text-indigo-11">
+                <Boxes size={20} />
+              </div>
+              <div>
+                <h3 className="text-lg font-semibold text-gray-12">
+                  {props.title}
+                </h3>
+                <p className="mt-1 text-sm leading-relaxed text-gray-10">
+                  {props.description}
+                </p>
+              </div>
+            </div>
+            <button
+              type="button"
+              onClick={props.onClose}
+              disabled={busy}
+              className="rounded-full p-1 text-gray-10 transition hover:bg-gray-4 hover:text-gray-12 disabled:cursor-not-allowed disabled:opacity-50"
+              aria-label="Close"
+            >
+              <X size={18} />
+            </button>
+          </div>
+
+          {visibleItems.length > 0 ? (
+            <div className="mt-4 flex flex-wrap gap-2">
+              {visibleItems.map((item) => (
+                <span
+                  key={item}
+                  className="rounded-full border border-gray-6 bg-gray-3 px-3 py-1 text-xs font-medium text-gray-11"
+                >
+                  {item}
+                </span>
+              ))}
+              {hiddenItemCount > 0 ? (
+                <span className="rounded-full border border-gray-6 bg-gray-3 px-3 py-1 text-xs font-medium text-gray-11">
+                  +{hiddenItemCount} more
+                </span>
+              ) : null}
+            </div>
+          ) : null}
+        </div>
+
+        <div className="space-y-4 p-6">
+          {props.error?.trim() ? (
+            <div className="rounded-xl border border-red-6 bg-red-2 px-4 py-3 text-sm text-red-11">
+              {props.error}
+            </div>
+          ) : null}
+
+          <button
+            type="button"
+            onClick={props.onCreateNewWorker}
+            disabled={busy}
+            className="flex w-full items-center justify-between rounded-2xl border border-indigo-7/30 bg-indigo-9/10 px-4 py-4 text-left transition hover:border-indigo-7/50 hover:bg-indigo-9/15 disabled:cursor-not-allowed disabled:opacity-60"
+          >
+            <div className="flex items-start gap-3">
+              <div className="mt-0.5 flex h-10 w-10 items-center justify-center rounded-xl bg-indigo-9/20 text-indigo-11">
+                <Plus size={18} />
+              </div>
+              <div>
+                <div className="text-sm font-semibold text-gray-12">
+                  Create new worker
+                </div>
+                <div className="mt-1 text-sm text-gray-10">
+                  Open the existing new worker flow, then import this bundle into
+                  it.
+                </div>
+              </div>
+            </div>
+            <Sparkles size={18} className="text-indigo-11" />
+          </button>
+
+          <div className="rounded-2xl border border-gray-6 bg-gray-1/70">
+            <button
+              type="button"
+              onClick={() => setShowWorkers((value) => !value)}
+              disabled={busy}
+              className="flex w-full items-center justify-between gap-3 px-4 py-4 text-left transition hover:bg-gray-3/60 disabled:cursor-not-allowed disabled:opacity-60"
+              aria-expanded={showWorkers}
+            >
+              <div>
+                <div className="text-sm font-semibold text-gray-12">
+                  Add to existing worker
+                </div>
+                <div className="mt-1 text-sm text-gray-10">
+                  Pick an existing worker and import this bundle there.
+                </div>
+              </div>
+              {showWorkers ? (
+                <ChevronDown size={18} className="text-gray-10" />
+              ) : (
+                <ChevronRight size={18} className="text-gray-10" />
+              )}
+            </button>
+
+            {showWorkers ? (
+              <div className="space-y-3 border-t border-gray-6 px-4 py-4">
+                {props.workers.length === 0 ? (
+                  <div className="rounded-xl border border-dashed border-gray-6 px-4 py-5 text-sm text-gray-10">
+                    No configured workers are available yet. Create a new worker
+                    to import this bundle.
+                  </div>
+                ) : (
+                  props.workers.map((worker) => {
+                    const disabledReason = worker.disabledReason?.trim() ?? "";
+                    const disabled = Boolean(disabledReason) || busy;
+                    return (
+                      <button
+                        key={worker.id}
+                        type="button"
+                        onClick={() => props.onSelectWorker(worker.id)}
+                        disabled={disabled}
+                        className="w-full rounded-xl border border-gray-6 bg-gray-2 px-4 py-3 text-left transition hover:border-gray-7 hover:bg-gray-3 disabled:cursor-not-allowed disabled:opacity-60"
+                      >
+                        <div className="flex items-start justify-between gap-3">
+                          <div className="min-w-0 flex-1">
+                            <div className="flex flex-wrap items-center gap-2">
+                              <span className="text-sm font-semibold text-gray-12">
+                                {worker.label}
+                              </span>
+                              <span className="rounded-full border border-gray-6 bg-gray-3 px-2 py-0.5 text-[11px] font-medium uppercase tracking-wide text-gray-10">
+                                {worker.badge}
+                              </span>
+                              {worker.current ? (
+                                <span className="rounded-full border border-emerald-7/40 bg-emerald-9/10 px-2 py-0.5 text-[11px] font-medium uppercase tracking-wide text-emerald-11">
+                                  Current
+                                </span>
+                              ) : null}
+                            </div>
+                            <div className="mt-1 truncate text-sm text-gray-10">
+                              {worker.detail}
+                            </div>
+                            {disabledReason ? (
+                              <div className="mt-2 text-xs text-amber-11">
+                                {disabledReason}
+                              </div>
+                            ) : null}
+                          </div>
+                          <ChevronRight
+                            size={18}
+                            className="mt-0.5 shrink-0 text-gray-10"
+                          />
+                        </div>
+                      </button>
+                    );
+                  })
+                )}
+              </div>
+            ) : null}
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/bundles/index.ts b/apps/app/src/react-app/domains/bundles/index.ts
new file mode 100644
index 0000000000..bd9a2e5295
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/index.ts
@@ -0,0 +1,3 @@
+// Re-export the aggregate entry point from the framework-agnostic bundle
+// module so the React tree pulls bundle helpers through a domain-scoped path.
+export * from "../../../app/bundles/index";
diff --git a/apps/app/src/react-app/domains/bundles/publish.ts b/apps/app/src/react-app/domains/bundles/publish.ts
new file mode 100644
index 0000000000..ca4b64f790
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/publish.ts
@@ -0,0 +1 @@
+export * from "../../../app/bundles/publish";
diff --git a/apps/app/src/react-app/domains/bundles/schema.ts b/apps/app/src/react-app/domains/bundles/schema.ts
new file mode 100644
index 0000000000..4b306eeb69
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/schema.ts
@@ -0,0 +1,2 @@
+// Framework-agnostic bundle schema validators re-exported for React imports.
+export * from "../../../app/bundles/schema";
diff --git a/apps/app/src/react-app/domains/bundles/skill-destination-modal.tsx b/apps/app/src/react-app/domains/bundles/skill-destination-modal.tsx
new file mode 100644
index 0000000000..9a721314e1
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/skill-destination-modal.tsx
@@ -0,0 +1,387 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useState } from "react";
+import {
+  CheckCircle2,
+  Folder,
+  FolderPlus,
+  Globe,
+  Loader2,
+  Sparkles,
+  X,
+} from "lucide-react";
+
+import type { WorkspaceInfo } from "../../../app/lib/desktop";
+import { t } from "../../../i18n";
+import { isSandboxWorkspace } from "../../../app/utils";
+import { Button } from "../../design-system/button";
+
+type SkillSummary = {
+  name: string;
+  description?: string | null;
+  trigger?: string | null;
+};
+
+export type SkillDestinationModalProps = {
+  open: boolean;
+  skill: SkillSummary | null;
+  workspaces: WorkspaceInfo[];
+  selectedWorkspaceId?: string | null;
+  busyWorkspaceId?: string | null;
+  onClose: () => void;
+  onSubmitWorkspace: (workspaceId: string) => void | Promise<void>;
+  onCreateWorker?: () => void;
+  onConnectRemote?: () => void;
+};
+
+const displayName = (workspace: WorkspaceInfo, fallback: string): string =>
+  workspace.displayName?.trim() ||
+  workspace.openworkWorkspaceName?.trim() ||
+  workspace.name?.trim() ||
+  workspace.directory?.trim() ||
+  workspace.path?.trim() ||
+  workspace.baseUrl?.trim() ||
+  fallback;
+
+export function SkillDestinationModal(props: SkillDestinationModalProps) {
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = useState<
+    string | null
+  >(null);
+
+  const footerBusy = Boolean(props.busyWorkspaceId?.trim());
+  const selectedWorkspace = useMemo(
+    () =>
+      props.workspaces.find(
+        (workspace) => workspace.id === selectedWorkspaceId,
+      ) ?? null,
+    [props.workspaces, selectedWorkspaceId],
+  );
+
+  useEffect(() => {
+    if (!props.open) return;
+    const activeMatch =
+      props.workspaces.find(
+        (workspace) => workspace.id === props.selectedWorkspaceId,
+      ) ??
+      props.workspaces[0] ??
+      null;
+    setSelectedWorkspaceId(activeMatch?.id ?? null);
+  }, [props.open, props.selectedWorkspaceId, props.workspaces]);
+
+  const subtitle = (workspace: WorkspaceInfo): string => {
+    if (workspace.workspaceType === "local") {
+      return (
+        workspace.path?.trim() ||
+        t("share_skill_destination.local_badge")
+      );
+    }
+    return (
+      workspace.directory?.trim() ||
+      workspace.openworkHostUrl?.trim() ||
+      workspace.baseUrl?.trim() ||
+      workspace.path?.trim() ||
+      t("share_skill_destination.remote_badge")
+    );
+  };
+
+  const workspaceBadge = (workspace: WorkspaceInfo): string => {
+    if (isSandboxWorkspace(workspace)) {
+      return t("share_skill_destination.sandbox_badge");
+    }
+    if (workspace.workspaceType === "remote") {
+      return t("share_skill_destination.remote_badge");
+    }
+    return t("share_skill_destination.local_badge");
+  };
+
+  const workspaceCircleClass = (
+    workspace: WorkspaceInfo,
+    selected: boolean,
+  ): string => {
+    if (selected) {
+      return "bg-indigo-7/15 text-indigo-11 border border-indigo-7/30";
+    }
+    if (isSandboxWorkspace(workspace)) {
+      return "bg-indigo-7/10 text-indigo-11 border border-indigo-7/20";
+    }
+    if (workspace.workspaceType === "remote") {
+      return "bg-sky-7/10 text-sky-11 border border-sky-7/20";
+    }
+    return "bg-amber-7/10 text-amber-11 border border-amber-7/20";
+  };
+
+  const submitSelectedWorkspace = () => {
+    const workspaceId = selectedWorkspaceId?.trim();
+    if (!workspaceId || footerBusy) return;
+    void props.onSubmitWorkspace(workspaceId);
+  };
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-gray-12/40 p-4 backdrop-blur-sm animate-in fade-in duration-200">
+      <div className="flex max-h-[90vh] w-full max-w-2xl flex-col overflow-hidden rounded-2xl border border-gray-6 bg-gray-1 shadow-2xl">
+        <div className="border-b border-gray-6 bg-gray-1 px-6 py-5">
+          <div className="flex items-start justify-between gap-4">
+            <div className="min-w-0 space-y-3">
+              <div className="inline-flex items-center gap-2 rounded-full border border-gray-6 bg-gray-2 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-gray-10">
+                <Sparkles size={12} />
+                {t("share_skill_destination.skill_label")}
+              </div>
+              <div className="rounded-xl border border-gray-6 bg-gray-2/40 px-4 py-4">
+                <div className="flex items-start gap-3">
+                  <div className="mt-0.5 flex h-10 w-10 shrink-0 items-center justify-center rounded-full border border-indigo-7/20 bg-indigo-7/10 text-indigo-11">
+                    <Sparkles size={17} />
+                  </div>
+                  <div className="min-w-0 flex-1">
+                    <div className="text-[11px] font-semibold uppercase tracking-[0.18em] text-gray-9">
+                      {t("share_skill_destination.skill_label")}
+                    </div>
+                    <h3 className="mt-1 text-lg font-semibold text-gray-12 break-words">
+                      {props.skill?.name ??
+                        t("share_skill_destination.fallback_skill_name")}
+                    </h3>
+                    {props.skill?.description?.trim() ? (
+                      <p className="mt-1 text-sm leading-relaxed text-gray-10 break-words">
+                        {props.skill.description.trim()}
+                      </p>
+                    ) : null}
+                    {props.skill?.trigger?.trim() ? (
+                      <div className="mt-3 inline-flex items-center gap-2 rounded-full border border-gray-6 bg-gray-1 px-3 py-1 text-[11px] text-gray-10">
+                        <span className="font-semibold text-gray-12">
+                          {t("share_skill_destination.trigger_label")}
+                        </span>
+                        <span className="font-mono">
+                          {props.skill.trigger.trim()}
+                        </span>
+                      </div>
+                    ) : null}
+                  </div>
+                </div>
+              </div>
+              <div>
+                <h4 className="text-sm font-medium text-gray-12">
+                  {t("share_skill_destination.title")}
+                </h4>
+                <p className="mt-1 text-sm leading-relaxed text-gray-10">
+                  {t("share_skill_destination.subtitle")}
+                </p>
+              </div>
+            </div>
+
+            <button
+              onClick={props.onClose}
+              disabled={footerBusy}
+              className={`rounded-full p-2 text-gray-9 transition hover:bg-gray-2 hover:text-gray-12 ${
+                footerBusy ? "cursor-not-allowed opacity-50" : ""
+              }`.trim()}
+              aria-label={t("common.close")}
+            >
+              <X size={18} />
+            </button>
+          </div>
+        </div>
+
+        <div className="flex-1 space-y-5 overflow-y-auto px-6 py-5">
+          <div className="space-y-3">
+            <div className="flex items-center justify-between gap-3">
+              <div className="text-sm font-medium text-gray-12">
+                {t("share_skill_destination.existing_workers")}
+              </div>
+              {props.workspaces.length > 0 ? (
+                <span className="text-[11px] uppercase tracking-[0.18em] text-gray-9">
+                  {props.workspaces.length}
+                </span>
+              ) : null}
+            </div>
+
+            {props.workspaces.length === 0 ? (
+              <div className="rounded-xl border border-dashed border-gray-6 bg-gray-2/20 px-4 py-5 text-sm leading-relaxed text-gray-10">
+                {t("share_skill_destination.no_workers")}
+              </div>
+            ) : (
+              <div className="space-y-2">
+                {props.workspaces.map((workspace) => {
+                  const isActive = workspace.id === props.selectedWorkspaceId;
+                  const isSelected = workspace.id === selectedWorkspaceId;
+                  const isBusy = workspace.id === props.busyWorkspaceId;
+
+                  return (
+                    <button
+                      key={workspace.id}
+                      type="button"
+                      onClick={() => setSelectedWorkspaceId(workspace.id)}
+                      disabled={footerBusy}
+                      aria-pressed={isSelected}
+                      className={`w-full rounded-xl border text-left transition-colors ${
+                        isSelected
+                          ? "border-indigo-7/40 bg-indigo-2/20"
+                          : "border-gray-6/40 bg-transparent hover:border-gray-7/50 hover:bg-gray-2"
+                      } ${footerBusy ? "cursor-wait opacity-70" : ""}`.trim()}
+                    >
+                      <div className="flex items-start gap-3 px-4 py-3">
+                        <div
+                          className={`mt-0.5 flex h-10 w-10 shrink-0 items-center justify-center rounded-full ${workspaceCircleClass(
+                            workspace,
+                            isSelected,
+                          )}`.trim()}
+                        >
+                          {workspace.workspaceType === "remote" ? (
+                            <Globe size={16} />
+                          ) : (
+                            <Folder size={16} />
+                          )}
+                        </div>
+
+                        <div className="min-w-0 flex-1">
+                          <div className="flex flex-wrap items-center gap-2">
+                            <div className="text-sm font-semibold text-gray-12 break-words">
+                              {displayName(workspace, "Worker")}
+                            </div>
+                            {isActive ? (
+                              <span className="rounded-full bg-gray-3 px-2 py-0.5 text-[10px] uppercase tracking-[0.18em] text-gray-11">
+                                {t("share_skill_destination.current_badge")}
+                              </span>
+                            ) : null}
+                            <span className="rounded-full bg-gray-3 px-2 py-0.5 text-[10px] uppercase tracking-[0.18em] text-gray-11">
+                              {workspaceBadge(workspace)}
+                            </span>
+                            {isSelected ? (
+                              <span className="rounded-full bg-indigo-3/60 px-2 py-0.5 text-[10px] uppercase tracking-[0.18em] text-indigo-11">
+                                {t("share_skill_destination.selected_badge")}
+                              </span>
+                            ) : null}
+                          </div>
+
+                          <div className="mt-1 text-[11px] font-mono break-all text-gray-8/80">
+                            {subtitle(workspace)}
+                          </div>
+                          {isSelected ? (
+                            <div className="mt-2 text-xs font-medium text-gray-11">
+                              {t("share_skill_destination.selected_hint")}
+                            </div>
+                          ) : null}
+                        </div>
+
+                        <div className="shrink-0 pt-0.5 text-gray-9">
+                          {isBusy ? (
+                            <Loader2 size={16} className="animate-spin" />
+                          ) : (
+                            <CheckCircle2
+                              size={16}
+                              className={
+                                isSelected ? "text-indigo-11" : "text-gray-7"
+                              }
+                            />
+                          )}
+                        </div>
+                      </div>
+                    </button>
+                  );
+                })}
+              </div>
+            )}
+          </div>
+
+          {props.onCreateWorker || props.onConnectRemote ? (
+            <div className="space-y-3 border-t border-gray-6 pt-5">
+              <div className="text-sm font-medium text-gray-12">
+                {t("share_skill_destination.more_options")}
+              </div>
+              <div className="grid gap-3 md:grid-cols-2">
+                {props.onCreateWorker ? (
+                  <button
+                    type="button"
+                    onClick={() => props.onCreateWorker?.()}
+                    disabled={footerBusy}
+                    className={`rounded-xl border border-indigo-7/30 bg-indigo-7/10 px-4 py-4 text-left transition hover:border-indigo-7/50 hover:bg-indigo-7/15 ${
+                      footerBusy ? "cursor-not-allowed opacity-60" : ""
+                    }`.trim()}
+                  >
+                    <div className="flex items-start gap-3">
+                      <div className="mt-0.5 flex h-10 w-10 items-center justify-center rounded-full border border-indigo-7/30 bg-indigo-7/15 text-indigo-11">
+                        <FolderPlus size={17} />
+                      </div>
+                      <div>
+                        <div className="text-sm font-semibold text-gray-12">
+                          {t("share_skill_destination.create_worker")}
+                        </div>
+                        <div className="mt-1 text-sm text-gray-10">
+                          {t("share_skill_destination.create_worker_hint")}
+                        </div>
+                      </div>
+                    </div>
+                  </button>
+                ) : null}
+
+                {props.onConnectRemote ? (
+                  <button
+                    type="button"
+                    onClick={() => props.onConnectRemote?.()}
+                    disabled={footerBusy}
+                    className={`rounded-xl border border-sky-7/30 bg-sky-7/10 px-4 py-4 text-left transition hover:border-sky-7/50 hover:bg-sky-7/15 ${
+                      footerBusy ? "cursor-not-allowed opacity-60" : ""
+                    }`.trim()}
+                  >
+                    <div className="flex items-start gap-3">
+                      <div className="mt-0.5 flex h-10 w-10 items-center justify-center rounded-full border border-sky-7/30 bg-sky-7/15 text-sky-11">
+                        <Globe size={17} />
+                      </div>
+                      <div>
+                        <div className="text-sm font-semibold text-gray-12">
+                          {t("share_skill_destination.connect_remote")}
+                        </div>
+                        <div className="mt-1 text-sm text-gray-10">
+                          {t("share_skill_destination.connect_remote_hint")}
+                        </div>
+                      </div>
+                    </div>
+                  </button>
+                ) : null}
+              </div>
+            </div>
+          ) : null}
+        </div>
+
+        <div className="border-t border-gray-6 bg-gray-1 px-6 py-4">
+          <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+            {selectedWorkspace ? (
+              <div className="min-w-0 text-sm text-gray-10">
+                <span className="font-medium text-gray-12">
+                  {displayName(selectedWorkspace, "Worker")}
+                </span>
+                <span className="mx-2 text-gray-8">·</span>
+                <span className="truncate align-middle">
+                  {subtitle(selectedWorkspace)}
+                </span>
+              </div>
+            ) : null}
+
+            <div className="flex items-center justify-end gap-3">
+              <Button
+                variant="ghost"
+                onClick={props.onClose}
+                disabled={footerBusy}
+              >
+                {t("common.cancel")}
+              </Button>
+              <Button
+                variant="primary"
+                onClick={submitSelectedWorkspace}
+                disabled={!selectedWorkspace || footerBusy}
+              >
+                {footerBusy ? (
+                  <span className="inline-flex items-center gap-2">
+                    <Loader2 size={16} className="animate-spin" />
+                    {t("share_skill_destination.adding")}
+                  </span>
+                ) : (
+                  t("share_skill_destination.add_to_workspace")
+                )}
+              </Button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/bundles/skill-org-publish.ts b/apps/app/src/react-app/domains/bundles/skill-org-publish.ts
new file mode 100644
index 0000000000..1ddb4b6c8d
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/skill-org-publish.ts
@@ -0,0 +1 @@
+export * from "../../../app/bundles/skill-org-publish";
diff --git a/apps/app/src/react-app/domains/bundles/sources.ts b/apps/app/src/react-app/domains/bundles/sources.ts
new file mode 100644
index 0000000000..a366aa625a
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/sources.ts
@@ -0,0 +1 @@
+export * from "../../../app/bundles/sources";
diff --git a/apps/app/src/react-app/domains/bundles/start-modal.tsx b/apps/app/src/react-app/domains/bundles/start-modal.tsx
new file mode 100644
index 0000000000..4515a188cc
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/start-modal.tsx
@@ -0,0 +1,186 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useRef, useState } from "react";
+import { FolderPlus, Loader2, Rocket, X } from "lucide-react";
+
+import { Button } from "../../design-system/button";
+
+export type BundleStartModalProps = {
+  open: boolean;
+  templateName: string;
+  description?: string | null;
+  items?: string[];
+  busy?: boolean;
+  onClose: () => void;
+  onPickFolder: () => Promise<string | null>;
+  onConfirm: (folder: string | null) => void | Promise<void>;
+};
+
+export function BundleStartModal(props: BundleStartModalProps) {
+  const pickFolderRef = useRef<HTMLButtonElement | null>(null);
+  const [selectedFolder, setSelectedFolder] = useState<string | null>(null);
+  const [pickingFolder, setPickingFolder] = useState(false);
+
+  useEffect(() => {
+    if (!props.open) return;
+    setSelectedFolder(null);
+    const frame = requestAnimationFrame(() => pickFolderRef.current?.focus());
+    return () => cancelAnimationFrame(frame);
+  }, [props.open]);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key !== "Escape") return;
+      event.preventDefault();
+      if (props.busy) return;
+      props.onClose();
+    };
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+  }, [props, props.busy, props.open]);
+
+  const visibleItems = useMemo(
+    () => (props.items ?? []).filter(Boolean).slice(0, 4),
+    [props.items],
+  );
+  const hiddenItemCount = useMemo(
+    () =>
+      Math.max(
+        0,
+        (props.items ?? []).filter(Boolean).length - visibleItems.length,
+      ),
+    [props.items, visibleItems.length],
+  );
+  const canSubmit = useMemo(
+    () => Boolean(selectedFolder?.trim()) && !props.busy && !pickingFolder,
+    [pickingFolder, props.busy, selectedFolder],
+  );
+
+  const handlePickFolder = async () => {
+    if (pickingFolder || props.busy) return;
+    setPickingFolder(true);
+    try {
+      const next = await props.onPickFolder();
+      if (next) setSelectedFolder(next);
+    } finally {
+      setPickingFolder(false);
+    }
+  };
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-gray-1/70 p-4 backdrop-blur-sm">
+      <div className="w-full max-w-xl overflow-hidden rounded-[28px] border border-dls-border bg-dls-surface shadow-2xl animate-in fade-in zoom-in-95 duration-200">
+        <div className="border-b border-dls-border px-6 py-5 bg-dls-surface">
+          <div className="flex items-start justify-between gap-4">
+            <div className="flex min-w-0 items-start gap-3">
+              <div className="flex h-11 w-11 shrink-0 items-center justify-center rounded-2xl bg-dls-accent/10 text-dls-accent">
+                <Rocket size={20} />
+              </div>
+              <div className="min-w-0">
+                <h3 className="truncate text-[18px] font-semibold text-dls-text">
+                  Start with {props.templateName}
+                </h3>
+                <p className="mt-1 text-sm leading-relaxed text-dls-secondary">
+                  {props.description?.trim() ||
+                    "Pick a folder and OpenWork will create a workspace from this template."}
+                </p>
+              </div>
+            </div>
+            <button
+              type="button"
+              onClick={props.onClose}
+              disabled={Boolean(props.busy)}
+              className="rounded-full p-1 text-dls-secondary transition hover:bg-dls-hover hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-50"
+              aria-label="Close"
+            >
+              <X size={18} />
+            </button>
+          </div>
+
+          {visibleItems.length > 0 ? (
+            <div className="mt-4 flex flex-wrap gap-2">
+              {visibleItems.map((item) => (
+                <span
+                  key={item}
+                  className="rounded-full border border-dls-border bg-dls-hover px-3 py-1 text-xs font-medium text-dls-text"
+                >
+                  {item}
+                </span>
+              ))}
+              {hiddenItemCount > 0 ? (
+                <span className="rounded-full border border-dls-border bg-dls-hover px-3 py-1 text-xs font-medium text-dls-text">
+                  +{hiddenItemCount} more
+                </span>
+              ) : null}
+            </div>
+          ) : null}
+        </div>
+
+        <div className="space-y-4 px-6 py-6">
+          <div className="rounded-2xl border border-dls-border bg-dls-sidebar px-5 py-4">
+            <div className="text-[15px] font-semibold text-dls-text">
+              Workspace folder
+            </div>
+            <p className="mt-1 text-sm text-dls-secondary">
+              Choose where this template should live. OpenWork will create the
+              workspace and bring in the template automatically.
+            </p>
+            <div className="mt-4 rounded-xl border border-dls-border bg-dls-surface px-4 py-3 text-sm text-dls-text">
+              {selectedFolder?.trim() ? (
+                <span className="font-mono text-xs break-all">
+                  {selectedFolder}
+                </span>
+              ) : (
+                <span className="text-dls-secondary">
+                  No folder selected yet.
+                </span>
+              )}
+            </div>
+            <div className="mt-4">
+              <button
+                type="button"
+                ref={pickFolderRef}
+                onClick={handlePickFolder}
+                disabled={pickingFolder || Boolean(props.busy)}
+                className="inline-flex items-center gap-2 rounded-full border border-dls-border bg-dls-surface px-4 py-2 text-xs font-medium text-dls-text transition-colors hover:bg-dls-hover disabled:cursor-wait disabled:opacity-70"
+              >
+                {pickingFolder ? (
+                  <Loader2 size={14} className="animate-spin" />
+                ) : (
+                  <FolderPlus size={14} />
+                )}
+                {selectedFolder?.trim() ? "Change folder" : "Select folder"}
+              </button>
+            </div>
+          </div>
+
+          <div className="flex items-center justify-end gap-3 border-t border-dls-border pt-4">
+            <Button
+              variant="ghost"
+              onClick={props.onClose}
+              disabled={Boolean(props.busy)}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="primary"
+              onClick={() => void props.onConfirm(selectedFolder)}
+              disabled={!canSubmit}
+            >
+              {props.busy ? (
+                <span className="inline-flex items-center gap-2">
+                  <Loader2 size={16} className="animate-spin" />
+                  Starting template...
+                </span>
+              ) : (
+                "Create workspace"
+              )}
+            </Button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/bundles/types.ts b/apps/app/src/react-app/domains/bundles/types.ts
new file mode 100644
index 0000000000..6e2b621f3d
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/types.ts
@@ -0,0 +1,3 @@
+// Framework-agnostic bundle types live in src/app/bundles/types.ts.
+// Re-exported here so React-side bundle code uses a domain-scoped path.
+export * from "../../../app/bundles/types";
diff --git a/apps/app/src/react-app/domains/bundles/url-policy.ts b/apps/app/src/react-app/domains/bundles/url-policy.ts
new file mode 100644
index 0000000000..4226824ce6
--- /dev/null
+++ b/apps/app/src/react-app/domains/bundles/url-policy.ts
@@ -0,0 +1 @@
+export * from "../../../app/bundles/url-policy";
diff --git a/apps/app/src/react-app/domains/cloud/den-auth-provider.tsx b/apps/app/src/react-app/domains/cloud/den-auth-provider.tsx
new file mode 100644
index 0000000000..ec8ab98c0a
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/den-auth-provider.tsx
@@ -0,0 +1,204 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+import {
+  clearDenSession,
+  createDenClient,
+  DenApiError,
+  ensureDenActiveOrganization,
+  readDenSettings,
+  writeDenSettings,
+  type DenUser,
+} from "../../../app/lib/den";
+import {
+  denSessionUpdatedEvent,
+  dispatchDenSessionUpdated,
+} from "../../../app/lib/den-session-events";
+import {
+  deepLinkBridgeEvent,
+  drainPendingDeepLinks,
+  type DeepLinkBridgeDetail,
+} from "../../../app/lib/deep-link-bridge";
+import { parseDenAuthDeepLink } from "../../../app/lib/openwork-links";
+
+export type DenAuthStatus = "checking" | "signed_in" | "signed_out";
+
+export type DenAuthStore = {
+  status: DenAuthStatus;
+  user: DenUser | null;
+  error: string | null;
+  isSignedIn: boolean;
+  refresh: () => Promise<void>;
+};
+
+const DenAuthContext = createContext<DenAuthStore | undefined>(undefined);
+
+type DenAuthProviderProps = {
+  children: ReactNode;
+};
+
+/**
+ * React port of the Solid `DenAuthProvider` (`apps/app/src/app/cloud/den-auth-provider.tsx`
+ * on dev). Drives the Den auth status signal the forced-signin gate and
+ * desktop-config reader rely on, and syncs Better-Auth's active organization
+ * on every refresh so subsequent requests resolve against the right org.
+ */
+export function DenAuthProvider({ children }: DenAuthProviderProps) {
+  const [status, setStatus] = useState<DenAuthStatus>("checking");
+  const [user, setUser] = useState<DenUser | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  // Monotonic token so stale async refreshes can't clobber a newer result.
+  const refreshTokenRef = useRef(0);
+  const handledGrantsRef = useRef<Set<string>>(new Set());
+
+  const refresh = useCallback(async () => {
+    const currentRun = ++refreshTokenRef.current;
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+
+    if (!token) {
+      setUser(null);
+      setError(null);
+      setStatus("signed_out");
+      return;
+    }
+
+    setStatus("checking");
+
+    try {
+      const nextUser = await createDenClient({
+        baseUrl: settings.baseUrl,
+        apiBaseUrl: settings.apiBaseUrl,
+        token,
+      }).getSession();
+
+      if (currentRun !== refreshTokenRef.current) return;
+
+      await ensureDenActiveOrganization({
+        forceServerSync:
+          !settings.activeOrgId?.trim() || !settings.activeOrgSlug?.trim(),
+      }).catch(() => null);
+
+      if (currentRun !== refreshTokenRef.current) return;
+
+      setUser(nextUser);
+      setError(null);
+      setStatus("signed_in");
+    } catch (nextError) {
+      if (currentRun !== refreshTokenRef.current) return;
+
+      if (nextError instanceof DenApiError && nextError.status === 401) {
+        clearDenSession();
+      }
+
+      setUser(null);
+      setError(
+        nextError instanceof Error
+          ? nextError.message
+          : "Failed to restore OpenWork Cloud session.",
+      );
+      setStatus("signed_out");
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+
+    if (typeof window === "undefined") return;
+
+    const handleSessionUpdated = () => {
+      void refresh();
+    };
+
+    window.addEventListener(denSessionUpdatedEvent, handleSessionUpdated);
+    return () => {
+      window.removeEventListener(denSessionUpdatedEvent, handleSessionUpdated);
+    };
+  }, [refresh]);
+
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+
+    const handleUrls = (urls: readonly string[]) => {
+      for (const rawUrl of urls) {
+        const parsed = parseDenAuthDeepLink(rawUrl);
+        if (!parsed || handledGrantsRef.current.has(parsed.grant)) continue;
+        handledGrantsRef.current.add(parsed.grant);
+
+        void createDenClient({ baseUrl: parsed.denBaseUrl })
+          .exchangeDesktopHandoff(parsed.grant)
+          .then((result) => {
+            if (!result.token) {
+              throw new Error("Failed to sign in to OpenWork Cloud.");
+            }
+
+            writeDenSettings({
+              baseUrl: parsed.denBaseUrl,
+              authToken: result.token,
+              activeOrgId: null,
+              activeOrgSlug: null,
+              activeOrgName: null,
+            });
+
+            dispatchDenSessionUpdated({
+              status: "success",
+              baseUrl: parsed.denBaseUrl,
+              token: result.token,
+              user: result.user,
+              email: result.user?.email ?? null,
+            });
+          })
+          .catch((error) => {
+            handledGrantsRef.current.delete(parsed.grant);
+            dispatchDenSessionUpdated({
+              status: "error",
+              message:
+                error instanceof Error
+                  ? error.message
+                  : "Failed to sign in to OpenWork Cloud.",
+            });
+          });
+      }
+    };
+
+    handleUrls(drainPendingDeepLinks(window));
+    const handleDeepLink = (event: Event) => {
+      handleUrls(((event as CustomEvent<DeepLinkBridgeDetail>).detail?.urls ?? []) as string[]);
+    };
+
+    window.addEventListener(deepLinkBridgeEvent, handleDeepLink);
+    return () => window.removeEventListener(deepLinkBridgeEvent, handleDeepLink);
+  }, []);
+
+  const value = useMemo<DenAuthStore>(
+    () => ({
+      status,
+      user,
+      error,
+      isSignedIn: status === "signed_in",
+      refresh,
+    }),
+    [error, refresh, status, user],
+  );
+
+  return (
+    <DenAuthContext.Provider value={value}>{children}</DenAuthContext.Provider>
+  );
+}
+
+export function useDenAuth(): DenAuthStore {
+  const context = useContext(DenAuthContext);
+  if (!context) {
+    throw new Error("useDenAuth must be used within a DenAuthProvider");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/domains/cloud/den-signin-surface.tsx b/apps/app/src/react-app/domains/cloud/den-signin-surface.tsx
new file mode 100644
index 0000000000..f65267259b
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/den-signin-surface.tsx
@@ -0,0 +1,203 @@
+/** @jsxImportSource react */
+import { ArrowUpRight, Cloud } from "lucide-react";
+
+import { t } from "../../../i18n";
+import { DEFAULT_DEN_BASE_URL } from "../../../app/lib/den";
+import { Button } from "../../design-system/button";
+import { TextInput } from "../../design-system/text-input";
+
+export type DenSignInSurfaceVariant = "panel" | "fullscreen";
+
+export type DenSignInSurfaceProps = {
+  variant?: DenSignInSurfaceVariant;
+  developerMode: boolean;
+  baseUrl: string;
+  baseUrlDraft: string;
+  baseUrlError: string | null;
+  statusMessage: string | null;
+  authError: string | null;
+  authBusy: boolean;
+  baseUrlBusy: boolean;
+  sessionBusy: boolean;
+  manualAuthOpen: boolean;
+  manualAuthInput: string;
+  onBaseUrlDraftInput: (value: string) => void;
+  onResetBaseUrl: () => void;
+  onApplyBaseUrl: () => void;
+  onOpenControlPlane: () => void;
+  onOpenBrowserAuth: (mode: "sign-in" | "sign-up") => void;
+  onToggleManualAuth: () => void;
+  onManualAuthInput: (value: string) => void;
+  onSubmitManualAuth: () => void;
+};
+
+const settingsPanelClass = "ow-soft-card rounded-[28px] p-5 md:p-6";
+const settingsPanelSoftClass = "ow-soft-card-quiet rounded-2xl p-4";
+const headerBadgeClass =
+  "inline-flex min-h-8 items-center gap-2 rounded-xl border border-dls-border bg-dls-hover px-3 text-[13px] font-medium text-dls-text shadow-sm";
+const softNoticeClass =
+  "rounded-xl border border-dls-border bg-dls-hover px-3 py-2 text-xs text-dls-secondary";
+const errorBannerClass =
+  "rounded-xl border border-red-7/30 bg-red-1/40 px-3 py-2 text-xs text-red-11";
+
+/**
+ * React port of the Solid `DenSignInSurface`
+ * (`apps/app/src/app/cloud/den-signin-surface.tsx` on dev).
+ *
+ * Stateless presentation: all state + actions are driven by the parent
+ * (ForcedSigninPage for the full-screen gate, or the Den settings panel
+ * for the embedded "panel" variant). Matches the Solid contract 1:1 so
+ * feature parity is obvious.
+ */
+export function DenSignInSurface(props: DenSignInSurfaceProps) {
+  const variant: DenSignInSurfaceVariant = props.variant ?? "panel";
+
+  const content = (
+    <div className={`${settingsPanelClass} space-y-4`}>
+      <div className="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
+        <div className="space-y-2">
+          <div className={headerBadgeClass}>
+            <Cloud size={13} className="text-dls-secondary" />
+            {t("den.cloud_section_title")}
+          </div>
+          <div>
+            <div className="text-sm font-medium text-dls-text">
+              {t("den.signin_title")}
+            </div>
+          </div>
+        </div>
+      </div>
+
+      {props.developerMode ? (
+        <div className="grid gap-3 lg:grid-cols-[minmax(0,1fr)_auto] lg:items-end">
+          <TextInput
+            label={t("den.cloud_control_plane_url_label")}
+            value={props.baseUrlDraft}
+            onChange={(event) =>
+              props.onBaseUrlDraftInput(event.currentTarget.value)
+            }
+            placeholder={DEFAULT_DEN_BASE_URL}
+            hint={t("den.cloud_control_plane_url_hint")}
+            disabled={props.authBusy || props.baseUrlBusy || props.sessionBusy}
+          />
+          <div className="flex flex-wrap items-center gap-2">
+            <Button
+              variant="outline"
+              className="h-9 px-3 text-xs"
+              onClick={props.onResetBaseUrl}
+              disabled={props.authBusy || props.baseUrlBusy || props.sessionBusy}
+            >
+              {t("den.cloud_control_plane_reset")}
+            </Button>
+            <Button
+              variant="secondary"
+              className="h-9 px-3 text-xs"
+              onClick={props.onApplyBaseUrl}
+              disabled={props.authBusy || props.baseUrlBusy || props.sessionBusy}
+            >
+              {t("den.cloud_control_plane_save")}
+            </Button>
+            <Button
+              variant="outline"
+              className="h-9 px-3 text-xs"
+              onClick={props.onOpenControlPlane}
+            >
+              {t("den.cloud_control_plane_open")}
+              <ArrowUpRight size={13} />
+            </Button>
+          </div>
+        </div>
+      ) : null}
+
+      {props.baseUrlError ? (
+        <div className={errorBannerClass}>{props.baseUrlError}</div>
+      ) : null}
+
+      {props.statusMessage && !props.authError ? (
+        <div className={softNoticeClass}>{props.statusMessage}</div>
+      ) : null}
+
+      <div className="space-y-2">
+        <div className="max-w-[54ch] text-sm text-dls-secondary">
+          {t("den.auto_reconnect_hint")}
+        </div>
+      </div>
+
+      <div className="flex flex-wrap items-center gap-2">
+        <Button
+          variant="secondary"
+          onClick={() => props.onOpenBrowserAuth("sign-in")}
+        >
+          {t("den.signin_button")}
+          <ArrowUpRight size={13} />
+        </Button>
+        <Button
+          variant="outline"
+          className="h-9 px-3 text-xs"
+          onClick={() => props.onOpenBrowserAuth("sign-up")}
+        >
+          {t("den.create_account")}
+          <ArrowUpRight size={13} />
+        </Button>
+        <Button
+          variant="outline"
+          className="h-9 px-3 text-xs"
+          onClick={props.onToggleManualAuth}
+          disabled={props.authBusy || props.sessionBusy}
+        >
+          {props.manualAuthOpen
+            ? t("den.hide_signin_code")
+            : t("den.paste_signin_code")}
+        </Button>
+      </div>
+
+      {props.manualAuthOpen ? (
+        <div className={`${settingsPanelSoftClass} space-y-3`}>
+          <TextInput
+            label={t("den.signin_link_label")}
+            value={props.manualAuthInput}
+            onChange={(event) =>
+              props.onManualAuthInput(event.currentTarget.value)
+            }
+            placeholder={t("den.signin_link_placeholder")}
+            disabled={props.authBusy || props.sessionBusy}
+            hint={t("den.signin_link_hint")}
+          />
+          <div className="flex flex-wrap items-center gap-2">
+            <Button
+              variant="secondary"
+              className="h-9 px-3 text-xs"
+              onClick={props.onSubmitManualAuth}
+              disabled={
+                props.authBusy ||
+                props.sessionBusy ||
+                !props.manualAuthInput.trim()
+              }
+            >
+              {props.authBusy ? t("den.finishing") : t("den.finish_signin")}
+            </Button>
+            <div className="text-[11px] text-dls-secondary">
+              {t("den.signin_code_note")}
+            </div>
+          </div>
+        </div>
+      ) : null}
+
+      {props.authError ? (
+        <div className={errorBannerClass}>{props.authError}</div>
+      ) : null}
+    </div>
+  );
+
+  if (variant === "fullscreen") {
+    return (
+      <div className="min-h-screen bg-[radial-gradient(circle_at_top,rgba(59,130,246,0.12),transparent_42%),linear-gradient(180deg,rgba(248,250,252,1),rgba(241,245,249,0.92))] px-6 py-10 text-dls-text">
+        <div className="mx-auto flex min-h-[calc(100vh-5rem)] max-w-3xl items-center justify-center">
+          <div className="w-full space-y-4">{content}</div>
+        </div>
+      </div>
+    );
+  }
+
+  return content;
+}
diff --git a/apps/app/src/react-app/domains/cloud/desktop-config-provider.tsx b/apps/app/src/react-app/domains/cloud/desktop-config-provider.tsx
new file mode 100644
index 0000000000..cd9959bcc8
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/desktop-config-provider.tsx
@@ -0,0 +1,248 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+import {
+  checkDesktopAppRestriction,
+  type DesktopAppRestrictionChecker,
+} from "../../../app/cloud/desktop-app-restrictions";
+import {
+  createDenClient,
+  DenApiError,
+  ensureDenActiveOrganization,
+  normalizeDenDesktopConfig,
+  readDenSettings,
+  type DenDesktopConfig,
+} from "../../../app/lib/den";
+import {
+  denSessionUpdatedEvent,
+  denSettingsChangedEvent,
+} from "../../../app/lib/den-session-events";
+import { useDenAuth } from "./den-auth-provider";
+
+export type DesktopConfigStore = {
+  config: DenDesktopConfig;
+  loading: boolean;
+  refresh: () => Promise<void>;
+  /**
+   * Stable checker function that matches the `DesktopAppRestrictionChecker`
+   * shape Solid passes to its stores. Useful when wiring restriction gates
+   * from non-hook code paths.
+   */
+  checkRestriction: DesktopAppRestrictionChecker;
+};
+
+const DesktopConfigContext = createContext<DesktopConfigStore | undefined>(
+  undefined,
+);
+
+const DEFAULT_DESKTOP_CONFIG: DenDesktopConfig = {};
+const DESKTOP_CONFIG_REFRESH_MS = 60 * 60 * 1000;
+const DESKTOP_CONFIG_CACHE_PREFIX = "openwork.den.desktopConfig:";
+
+function getDesktopConfigCacheKey(): string {
+  const settings = readDenSettings();
+  const baseUrl = settings.baseUrl.trim();
+  const activeOrgId = settings.activeOrgId?.trim() ?? "";
+  if (!baseUrl) return "";
+  return `${DESKTOP_CONFIG_CACHE_PREFIX}${baseUrl}::${activeOrgId}`;
+}
+
+function readCachedDesktopConfig(key: string): DenDesktopConfig | null {
+  if (typeof window === "undefined" || !key) return null;
+
+  try {
+    const raw = window.localStorage.getItem(key);
+    if (!raw) return null;
+    return normalizeDenDesktopConfig(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+
+function writeCachedDesktopConfig(key: string, config: DenDesktopConfig) {
+  if (typeof window === "undefined" || !key) return;
+  try {
+    window.localStorage.setItem(
+      key,
+      JSON.stringify(normalizeDenDesktopConfig(config)),
+    );
+  } catch {
+    // Quota / private-browsing failures are non-fatal — we just miss the cache next boot.
+  }
+}
+
+type DesktopConfigProviderProps = {
+  children: ReactNode;
+};
+
+/**
+ * React port of the Solid `DesktopConfigProvider`
+ * (`apps/app/src/app/cloud/desktop-config-provider.tsx` on dev).
+ *
+ * Fetches the org-scoped "desktop app restrictions" config (new
+ * `packages/types/den/desktop-app-restrictions.ts` shape) and caches it in
+ * localStorage so gates like `blockZenModel` can apply immediately on the
+ * next boot without waiting for the HTTP round-trip. Re-fetches on Den
+ * session / settings events and on a one-hour interval.
+ */
+export function DesktopConfigProvider({ children }: DesktopConfigProviderProps) {
+  const denAuth = useDenAuth();
+  const [config, setConfig] = useState<DenDesktopConfig>(DEFAULT_DESKTOP_CONFIG);
+  const [loading, setLoading] = useState(false);
+  // Bumped whenever the browser tells us the Den session or settings changed.
+  const [settingsVersion, setSettingsVersion] = useState(0);
+  // Monotonic run id — same guard-against-stale-resolution pattern as DenAuthProvider.
+  const refreshRunRef = useRef(0);
+  const isSignedIn = denAuth.isSignedIn;
+
+  const refresh = useCallback(async () => {
+    const currentRun = ++refreshRunRef.current;
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const cacheKey = getDesktopConfigCacheKey();
+
+    if (!isSignedIn || !token || !settings.activeOrgId?.trim()) {
+      setConfig(DEFAULT_DESKTOP_CONFIG);
+      setLoading(false);
+      return;
+    }
+
+    const cached = readCachedDesktopConfig(cacheKey);
+    if (!cached) setLoading(true);
+
+    try {
+      const nextConfig = await createDenClient({
+        baseUrl: settings.baseUrl,
+        apiBaseUrl: settings.apiBaseUrl,
+        token,
+      }).getDesktopConfig();
+
+      if (currentRun !== refreshRunRef.current) return;
+
+      writeCachedDesktopConfig(cacheKey, nextConfig);
+      setConfig(nextConfig);
+    } catch (error) {
+      if (currentRun !== refreshRunRef.current) return;
+
+      // If the server says the active org doesn't exist, re-sync Better Auth
+      // so the next refresh hits a valid org. Same recovery path as Solid.
+      if (
+        error instanceof DenApiError &&
+        error.status === 404 &&
+        error.code === "organization_not_found"
+      ) {
+        await ensureDenActiveOrganization({ forceServerSync: true }).catch(
+          () => null,
+        );
+      }
+
+      setConfig(cached ?? DEFAULT_DESKTOP_CONFIG);
+    } finally {
+      if (currentRun === refreshRunRef.current) {
+        setLoading(false);
+      }
+    }
+  }, [isSignedIn]);
+
+  // Re-run whenever auth flips or Den settings change. Read the cache
+  // synchronously so gated UI never flickers through "unrestricted" just
+  // because we haven't finished the HTTP call yet.
+  useEffect(() => {
+    // settingsVersion is read to tie this effect to settings-change events.
+    void settingsVersion;
+
+    if (!isSignedIn) {
+      setConfig(DEFAULT_DESKTOP_CONFIG);
+      setLoading(false);
+      return;
+    }
+
+    const cacheKey = getDesktopConfigCacheKey();
+    const cached = readCachedDesktopConfig(cacheKey);
+    setConfig(cached ?? DEFAULT_DESKTOP_CONFIG);
+    setLoading(!cached);
+    void refresh();
+  }, [isSignedIn, refresh, settingsVersion]);
+
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+
+    const handleSettingsChanged = () => {
+      setSettingsVersion((value) => value + 1);
+    };
+
+    window.addEventListener(denSessionUpdatedEvent, handleSettingsChanged);
+    window.addEventListener(denSettingsChangedEvent, handleSettingsChanged);
+
+    const interval = window.setInterval(() => {
+      if (!isSignedIn) return;
+      void refresh();
+    }, DESKTOP_CONFIG_REFRESH_MS);
+
+    return () => {
+      window.removeEventListener(denSessionUpdatedEvent, handleSettingsChanged);
+      window.removeEventListener(denSettingsChangedEvent, handleSettingsChanged);
+      window.clearInterval(interval);
+    };
+  }, [isSignedIn, refresh]);
+
+  const value = useMemo<DesktopConfigStore>(() => {
+    // Bind the checker to the latest `config` so callers see the most
+    // recent org restrictions without having to recompute every render.
+    const checkRestriction: DesktopAppRestrictionChecker = ({ restriction }) =>
+      checkDesktopAppRestriction({ config, restriction });
+    return { config, loading, refresh, checkRestriction };
+  }, [config, loading, refresh]);
+
+  return (
+    <DesktopConfigContext.Provider value={value}>
+      {children}
+    </DesktopConfigContext.Provider>
+  );
+}
+
+export function useDesktopConfig(): DesktopConfigStore {
+  const context = useContext(DesktopConfigContext);
+  if (!context) {
+    throw new Error("useDesktopConfig must be used within a DesktopConfigProvider");
+  }
+  return context;
+}
+
+/**
+ * Convenience hook that returns the raw `DesktopAppRestrictions` flags
+ * (e.g. `{ blockZenModel: true }`). Callers usually just want the flags,
+ * not the loading state — feature gates should read through this.
+ */
+export function useOrgRestrictions(): DenDesktopConfig {
+  return useDesktopConfig().config;
+}
+
+/**
+ * Hook variant that returns the stable `checkRestriction` function so
+ * feature sites that already receive a "checker" (e.g. helpers ported
+ * from Solid stores) can call it directly without reshaping.
+ */
+export function useCheckDesktopRestriction(): DesktopAppRestrictionChecker {
+  return useDesktopConfig().checkRestriction;
+}
+
+/**
+ * Single-restriction hook — returns true/false for a specific key.
+ * Use this at feature sites that only care about one flag
+ * (e.g. `useDesktopRestriction("blockMultipleWorkspaces")`).
+ */
+export function useDesktopRestriction(
+  restriction: Parameters<DesktopAppRestrictionChecker>[0]["restriction"],
+): boolean {
+  return useDesktopConfig().checkRestriction({ restriction });
+}
diff --git a/apps/app/src/react-app/domains/cloud/forced-signin-page.tsx b/apps/app/src/react-app/domains/cloud/forced-signin-page.tsx
new file mode 100644
index 0000000000..9e673b55d0
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/forced-signin-page.tsx
@@ -0,0 +1,291 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useState } from "react";
+
+import { t } from "../../../i18n";
+import {
+  buildDenAuthUrl,
+  clearDenSession,
+  createDenClient,
+  DEFAULT_DEN_BASE_URL,
+  normalizeDenBaseUrl,
+  readDenBootstrapConfig,
+  readDenSettings,
+  resolveDenBaseUrls,
+  setDenBootstrapConfig,
+  writeDenSettings,
+} from "../../../app/lib/den";
+import {
+  denSessionUpdatedEvent,
+  dispatchDenSessionUpdated,
+  type DenSessionUpdatedDetail,
+} from "../../../app/lib/den-session-events";
+import { usePlatform } from "../../kernel/platform";
+import { useBootState } from "../../shell/boot-state";
+import { useDenAuth } from "./den-auth-provider";
+import { useDesktopConfig } from "./desktop-config-provider";
+import { DenSignInSurface } from "./den-signin-surface";
+
+export type ForcedSigninPageProps = {
+  developerMode: boolean;
+};
+
+/**
+ * Parse a pasted manual-auth input. Accepts either a raw handoff grant
+ * string (>= 12 chars) or an `openwork://den-auth?grant=…` deep link.
+ * Matches the Solid ForcedSigninPage exactly so flows stay fungible.
+ */
+function parseManualAuthInput(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+
+  try {
+    const url = new URL(trimmed);
+    const protocol = url.protocol.toLowerCase();
+    const routeHost = url.hostname.toLowerCase();
+    const routePath = url.pathname.replace(/^\/+/, "").toLowerCase();
+    const routeSegments = routePath.split("/").filter(Boolean);
+    const routeTail = routeSegments[routeSegments.length - 1] ?? "";
+    if (
+      (protocol === "openwork:" || protocol === "openwork-dev:") &&
+      (routeHost === "den-auth" ||
+        routePath === "den-auth" ||
+        routeTail === "den-auth")
+    ) {
+      const grant = url.searchParams.get("grant")?.trim() ?? "";
+      const nextBaseUrl =
+        normalizeDenBaseUrl(url.searchParams.get("denBaseUrl")?.trim() ?? "") ??
+        undefined;
+      return grant ? { grant, baseUrl: nextBaseUrl } : null;
+    }
+  } catch {
+    // Treat non-URL input as a raw handoff grant.
+  }
+
+  return trimmed.length >= 12 ? { grant: trimmed } : null;
+}
+
+/**
+ * React port of the Solid `ForcedSigninPage`
+ * (`apps/app/src/app/cloud/forced-signin-page.tsx` on dev).
+ *
+ * Full-screen sign-in gate rendered when the desktop bootstrap config has
+ * `requireSignin: true` and the user is not yet signed in. Owns the local
+ * draft state (base URL, manual auth input) and pipes it into the
+ * shared `DenSignInSurface` presentation layer.
+ */
+export function ForcedSigninPage({ developerMode }: ForcedSigninPageProps) {
+  const platform = usePlatform();
+  const denAuth = useDenAuth();
+  const desktopConfig = useDesktopConfig();
+  const { markRouteReady } = useBootState();
+
+  const initial = readDenSettings();
+  const initialBaseUrl = initial.baseUrl || DEFAULT_DEN_BASE_URL;
+
+  const [baseUrl, setBaseUrl] = useState(initialBaseUrl);
+  const [baseUrlDraft, setBaseUrlDraft] = useState(initialBaseUrl);
+  const [baseUrlError, setBaseUrlError] = useState<string | null>(null);
+  const [authBusy, setAuthBusy] = useState(false);
+  const [baseUrlBusy, setBaseUrlBusy] = useState(false);
+  const [manualAuthOpen, setManualAuthOpen] = useState(false);
+  const [manualAuthInput, setManualAuthInput] = useState("");
+  const [authError, setAuthError] = useState<string | null>(null);
+  const [statusMessage, setStatusMessage] = useState<string | null>(null);
+
+  const openControlPlane = useCallback(() => {
+    platform.openLink(resolveDenBaseUrls(baseUrl).baseUrl);
+  }, [baseUrl, platform]);
+
+  const openBrowserAuth = useCallback(
+    (mode: "sign-in" | "sign-up") => {
+      platform.openLink(buildDenAuthUrl(baseUrl, mode));
+      setStatusMessage(
+        mode === "sign-up"
+          ? t("den.status_browser_signup")
+          : t("den.status_browser_signin"),
+      );
+      setAuthError(null);
+    },
+    [baseUrl, platform],
+  );
+
+  const submitManualAuth = useCallback(async () => {
+    const parsed = parseManualAuthInput(manualAuthInput);
+    if (!parsed || authBusy) {
+      if (!parsed) {
+        setAuthError(t("den.error_paste_valid_code"));
+      }
+      return;
+    }
+
+    const nextBaseUrl = parsed.baseUrl ?? baseUrl;
+
+    setAuthBusy(true);
+    setAuthError(null);
+    setStatusMessage(t("den.signing_in"));
+
+    try {
+      const result = await createDenClient({
+        baseUrl: nextBaseUrl,
+      }).exchangeDesktopHandoff(parsed.grant);
+      if (!result.token) {
+        throw new Error(t("den.error_no_token"));
+      }
+
+      if (developerMode) {
+        setBaseUrl(nextBaseUrl);
+        setBaseUrlDraft(nextBaseUrl);
+      }
+
+      writeDenSettings({
+        baseUrl: nextBaseUrl,
+        authToken: result.token,
+        activeOrgId: null,
+        activeOrgSlug: null,
+        activeOrgName: null,
+      });
+
+      setManualAuthInput("");
+      setManualAuthOpen(false);
+      dispatchDenSessionUpdated({
+        status: "success",
+        baseUrl: nextBaseUrl,
+        token: result.token,
+        user: result.user,
+        email: result.user?.email ?? null,
+      });
+    } catch (error) {
+      dispatchDenSessionUpdated({
+        status: "error",
+        message:
+          error instanceof Error
+            ? error.message
+            : t("den.error_signin_failed"),
+      });
+    } finally {
+      setAuthBusy(false);
+    }
+  }, [authBusy, baseUrl, developerMode, manualAuthInput]);
+
+  const applyBaseUrl = useCallback(async () => {
+    const normalized = normalizeDenBaseUrl(baseUrlDraft);
+    if (!normalized) {
+      setBaseUrlError(t("den.error_base_url"));
+      return;
+    }
+
+    const resolved = resolveDenBaseUrls(normalized);
+    setBaseUrlBusy(true);
+
+    try {
+      await setDenBootstrapConfig({
+        baseUrl: resolved.baseUrl,
+        apiBaseUrl: resolved.apiBaseUrl,
+        requireSignin: readDenBootstrapConfig().requireSignin,
+      });
+      setBaseUrlError(null);
+      setBaseUrl(resolved.baseUrl);
+      setBaseUrlDraft(resolved.baseUrl);
+      clearDenSession({ includeBaseUrls: !developerMode });
+      writeDenSettings(
+        {
+          baseUrl: resolved.baseUrl,
+          apiBaseUrl: resolved.apiBaseUrl,
+          authToken: null,
+          activeOrgId: null,
+          activeOrgSlug: null,
+          activeOrgName: null,
+        },
+        { persistBootstrap: false },
+      );
+      setAuthError(null);
+      setStatusMessage(t("den.status_base_url_updated"));
+      void desktopConfig.refresh();
+      void denAuth.refresh();
+    } catch (error) {
+      setBaseUrlError(
+        error instanceof Error
+          ? error.message
+          : t("den.error_base_url"),
+      );
+    } finally {
+      setBaseUrlBusy(false);
+    }
+  }, [baseUrlDraft, denAuth, desktopConfig, developerMode]);
+
+  // Listen for Den session events broadcast from the Tauri deep-link handler,
+  // a successful browser auth, or an org switch, and reflect the result in
+  // the sign-in surface's status/error banners.
+  useEffect(() => {
+    markRouteReady();
+  }, [markRouteReady]);
+
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+
+    const handler = (event: Event) => {
+      const customEvent = event as CustomEvent<DenSessionUpdatedDetail>;
+      const nextSettings = readDenSettings();
+      const nextBaseUrl =
+        customEvent.detail?.baseUrl?.trim() ||
+        nextSettings.baseUrl ||
+        DEFAULT_DEN_BASE_URL;
+      setBaseUrl(nextBaseUrl);
+      setBaseUrlDraft(nextBaseUrl);
+
+      if (customEvent.detail?.status === "success") {
+        setAuthError(null);
+        const email = customEvent.detail.email?.trim();
+        setStatusMessage(
+          email
+            ? t("den.status_cloud_signed_in_as", { email })
+            : t("den.status_cloud_signin_done"),
+        );
+      } else if (customEvent.detail?.status === "error") {
+        setAuthError(
+          customEvent.detail.message?.trim() || t("den.error_signin_failed"),
+        );
+      }
+    };
+
+    window.addEventListener(denSessionUpdatedEvent, handler as EventListener);
+    return () => {
+      window.removeEventListener(
+        denSessionUpdatedEvent,
+        handler as EventListener,
+      );
+    };
+  }, []);
+
+  return (
+    <DenSignInSurface
+      variant="fullscreen"
+      developerMode={developerMode}
+      baseUrl={baseUrl}
+      baseUrlDraft={baseUrlDraft}
+      baseUrlError={baseUrlError}
+      statusMessage={statusMessage}
+      authError={authError ?? denAuth.error}
+      authBusy={authBusy}
+      baseUrlBusy={baseUrlBusy}
+      sessionBusy={denAuth.status === "checking"}
+      manualAuthOpen={manualAuthOpen}
+      manualAuthInput={manualAuthInput}
+      onBaseUrlDraftInput={setBaseUrlDraft}
+      onResetBaseUrl={() => setBaseUrlDraft(baseUrl)}
+      onApplyBaseUrl={() => {
+        void applyBaseUrl();
+      }}
+      onOpenControlPlane={openControlPlane}
+      onOpenBrowserAuth={openBrowserAuth}
+      onToggleManualAuth={() => {
+        setManualAuthOpen((value) => !value);
+        setAuthError(null);
+      }}
+      onManualAuthInput={setManualAuthInput}
+      onSubmitManualAuth={() => {
+        void submitManualAuth();
+      }}
+    />
+  );
+}
diff --git a/apps/app/src/react-app/domains/cloud/restriction-notice-provider.tsx b/apps/app/src/react-app/domains/cloud/restriction-notice-provider.tsx
new file mode 100644
index 0000000000..1e85fa848e
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/restriction-notice-provider.tsx
@@ -0,0 +1,89 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react";
+
+import { RestrictionNoticeModal } from "../../design-system/restriction-notice-modal";
+
+export type RestrictionNoticePayload = {
+  title: string;
+  message: string;
+};
+
+export type RestrictionNoticeController = {
+  /**
+   * Show a restriction notice modal. Replaces any currently-shown notice.
+   */
+  show: (payload: RestrictionNoticePayload) => void;
+  /**
+   * Dismiss whichever notice is currently visible. Safe to call when none is shown.
+   */
+  dismiss: () => void;
+};
+
+const RestrictionNoticeContext = createContext<RestrictionNoticeController | undefined>(
+  undefined,
+);
+
+type RestrictionNoticeProviderProps = {
+  children: ReactNode;
+};
+
+/**
+ * App-wide restriction notice surface ported from Solid. Owns one active
+ * `RestrictionNoticeModal` and exposes `{ show, dismiss }` to callers via
+ * `useRestrictionNotice()`. Call sites:
+ *
+ *   const notice = useRestrictionNotice();
+ *   if (checkDesktopRestriction({ restriction: "blockMultipleWorkspaces" })) {
+ *     notice.show({ title: "...", message: "..." });
+ *     return;
+ *   }
+ *
+ * The modal lives inside the provider so consumers don't need to render it;
+ * this matches Solid's app.tsx wiring where `RestrictionNoticeModal` is a
+ * single child of the root shell.
+ */
+export function RestrictionNoticeProvider({ children }: RestrictionNoticeProviderProps) {
+  const [notice, setNotice] = useState<RestrictionNoticePayload | null>(null);
+
+  const show = useCallback((payload: RestrictionNoticePayload) => {
+    setNotice(payload);
+  }, []);
+
+  const dismiss = useCallback(() => {
+    setNotice(null);
+  }, []);
+
+  const value = useMemo<RestrictionNoticeController>(
+    () => ({ show, dismiss }),
+    [dismiss, show],
+  );
+
+  return (
+    <RestrictionNoticeContext.Provider value={value}>
+      {children}
+      <RestrictionNoticeModal
+        open={notice !== null}
+        title={notice?.title ?? "Restriction"}
+        message={notice?.message ?? ""}
+        onClose={dismiss}
+      />
+    </RestrictionNoticeContext.Provider>
+  );
+}
+
+export function useRestrictionNotice(): RestrictionNoticeController {
+  const context = useContext(RestrictionNoticeContext);
+  if (!context) {
+    throw new Error(
+      "useRestrictionNotice must be used within a RestrictionNoticeProvider",
+    );
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/domains/cloud/use-cloud-provider-auto-sync.ts b/apps/app/src/react-app/domains/cloud/use-cloud-provider-auto-sync.ts
new file mode 100644
index 0000000000..4e7a948ff9
--- /dev/null
+++ b/apps/app/src/react-app/domains/cloud/use-cloud-provider-auto-sync.ts
@@ -0,0 +1,63 @@
+/** @jsxImportSource react */
+import { useEffect, useRef } from "react";
+
+import { CLOUD_SYNC_INTERVAL_MS } from "../../../app/cloud/sync/constants";
+import { useDenAuth } from "./den-auth-provider";
+
+type CloudProviderSyncReason = "sign_in" | "app_launch" | "interval" | "settings_cloud_opened";
+type SyncFn = (reason: CloudProviderSyncReason) => Promise<unknown>;
+
+/**
+ * Periodic cloud-provider reconciliation, ported from dev #1509 "auto-sync
+ * cloud providers". Runs the provided sync function every
+ * `CLOUD_SYNC_INTERVAL_MS` while the Den session is signed-in; suspends while
+ * signed-out and lets the provider-auth store own user-visible errors.
+ *
+ * Mount once (e.g. from the settings route) — the hook is idempotent
+ * within a single mount, and avoids overlapping ticks using an in-flight
+ * ref guard.
+ */
+export function useCloudProviderAutoSync(sync: SyncFn) {
+  const denAuth = useDenAuth();
+  const syncRef = useRef(sync);
+  const inFlightRef = useRef(false);
+
+  // Keep the ref current so we always call the latest closure (store
+  // identity can change between mounts and we don't want to restart the
+  // timer just because the parent re-rendered).
+  useEffect(() => {
+    syncRef.current = sync;
+  }, [sync]);
+
+  useEffect(() => {
+    if (!denAuth.isSignedIn) return;
+
+    let cancelled = false;
+
+    const tick = async () => {
+      if (inFlightRef.current || cancelled) return;
+      inFlightRef.current = true;
+      try {
+        await syncRef.current("interval");
+      } catch {
+        // Network errors, org misconfig, etc. are non-fatal — we'll try
+        // again on the next interval. The refresh function owns surfacing
+        // any user-visible error state.
+      } finally {
+        inFlightRef.current = false;
+      }
+    };
+
+    // Immediate pass so users see server state quickly after sign-in.
+    void tick();
+
+    const interval = window.setInterval(() => {
+      void tick();
+    }, CLOUD_SYNC_INTERVAL_MS);
+
+    return () => {
+      cancelled = true;
+      window.clearInterval(interval);
+    };
+  }, [denAuth.isSignedIn]);
+}
diff --git a/apps/app/src/react-app/domains/connections/mcp-auth-modal.tsx b/apps/app/src/react-app/domains/connections/mcp-auth-modal.tsx
new file mode 100644
index 0000000000..61f56ba1c7
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/mcp-auth-modal.tsx
@@ -0,0 +1,880 @@
+/** @jsxImportSource react */
+import { useEffect, useRef, useState } from "react";
+import { CheckCircle2, Loader2, RefreshCcw, X } from "lucide-react";
+
+import type { McpDirectoryInfo } from "../../../app/constants";
+import { openDesktopUrl, opencodeMcpAuth } from "../../../app/lib/desktop";
+import { unwrap } from "../../../app/lib/opencode";
+import { validateMcpServerName } from "../../../app/mcp";
+import type { Client } from "../../../app/types";
+import { isDesktopRuntime, normalizeDirectoryPath } from "../../../app/utils";
+import { t } from "../../../i18n";
+import { Button } from "../../design-system/button";
+import { TextInput } from "../../design-system/text-input";
+
+const MCP_AUTH_POLL_INTERVAL_MS = 2_000;
+const MCP_AUTH_TIMEOUT_MS = 90_000;
+const MCP_AUTH_DISCOVERY_TIMEOUT_MS = 15_000;
+
+type McpStatusEntry = {
+  status?: string;
+  error?: string;
+};
+
+export type McpAuthModalProps = {
+  open: boolean;
+  onClose: () => void;
+  onComplete: () => void | Promise<void>;
+  onReloadEngine?: () => void | Promise<void>;
+  reloadRequired?: boolean;
+  reloadBlocked?: boolean;
+  activeSessions?: Array<{ id: string; title: string }>;
+  isRemoteWorkspace?: boolean;
+  client: Client | null;
+  entry: McpDirectoryInfo | null;
+  projectDir: string;
+  onForceStopSession?: (sessionID: string) => void | Promise<void>;
+};
+
+export function McpAuthModal(props: McpAuthModalProps) {
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [needsReload, setNeedsReload] = useState(false);
+  const [alreadyConnected, setAlreadyConnected] = useState(false);
+  const [authInProgress, setAuthInProgress] = useState(false);
+  const [statusChecking, setStatusChecking] = useState(false);
+  const [reloadNotice, setReloadNotice] = useState<string | null>(null);
+  const [authorizationUrl, setAuthorizationUrl] = useState<string | null>(null);
+  const [callbackInput, setCallbackInput] = useState("");
+  const [manualAuthBusy, setManualAuthBusy] = useState(false);
+  const [cliAuthBusy, setCliAuthBusy] = useState(false);
+  const [cliAuthResult, setCliAuthResult] = useState<string | null>(null);
+  const [authUrlCopied, setAuthUrlCopied] = useState(false);
+  const [resolvedDir, setResolvedDir] = useState("");
+  const [awaitingReload, setAwaitingReload] = useState(false);
+  const [reloadStarting, setReloadStarting] = useState(false);
+  const [reloadSatisfied, setReloadSatisfied] = useState(false);
+  const [forceStopBusySessionID, setForceStopBusySessionID] = useState<string | null>(null);
+
+  const statusPollRef = useRef<number | null>(null);
+  const authCopyTimeoutRef = useRef<number | null>(null);
+  const previousOpenRef = useRef(false);
+  const previousEntryNameRef = useRef<string | null>(null);
+
+  const stopStatusPolling = () => {
+    if (statusPollRef.current !== null) {
+      window.clearInterval(statusPollRef.current);
+      statusPollRef.current = null;
+    }
+  };
+
+  useEffect(() => {
+    const normalized = normalizeDirectoryPath(props.projectDir ?? "");
+    const collapsed = normalized.replace(/^\/private\/tmp(?=\/|$)/, "/tmp");
+    setResolvedDir(collapsed);
+  }, [props.projectDir]);
+
+  useEffect(() => {
+    return () => {
+      stopStatusPolling();
+      if (authCopyTimeoutRef.current !== null) {
+        window.clearTimeout(authCopyTimeoutRef.current);
+        authCopyTimeoutRef.current = null;
+      }
+    };
+  }, []);
+
+  const openAuthorizationUrl = async (url: string) => {
+    if (isDesktopRuntime()) {
+      await openDesktopUrl(url);
+      return;
+    }
+
+    if (typeof window !== "undefined") {
+      window.open(url, "_blank", "noopener,noreferrer");
+    }
+  };
+
+  const handleCopyAuthorizationUrl = async () => {
+    if (!authorizationUrl) return;
+
+    try {
+      await navigator.clipboard.writeText(authorizationUrl);
+      setAuthUrlCopied(true);
+      if (authCopyTimeoutRef.current !== null) {
+        window.clearTimeout(authCopyTimeoutRef.current);
+      }
+      authCopyTimeoutRef.current = window.setTimeout(() => {
+        setAuthUrlCopied(false);
+        authCopyTimeoutRef.current = null;
+      }, 2_000);
+    } catch {
+      // ignore clipboard failures
+    }
+  };
+
+  const fetchMcpStatus = async (slug: string) => {
+    if (!props.entry || !props.client) return null;
+
+    try {
+      const directory = resolvedDir.trim();
+      if (!directory) return null;
+      const result = await props.client.mcp.status({ directory });
+      const status = result.data?.[slug] as McpStatusEntry | undefined;
+      return status ?? null;
+    } catch {
+      return null;
+    }
+  };
+
+  const resolveDirectory = async () => {
+    const current = resolvedDir.trim();
+    if (current) return current;
+    if (!props.client) return "";
+
+    try {
+      const info = unwrap(await props.client.path.get());
+      const normalized = normalizeDirectoryPath(info.directory ?? "");
+      const collapsed = normalized.replace(/^\/private\/tmp(?=\/|$)/, "/tmp");
+      if (collapsed) {
+        setResolvedDir(collapsed);
+      }
+      return collapsed;
+    } catch {
+      return "";
+    }
+  };
+
+  const resolveSlug = (name: string) =>
+    validateMcpServerName(name).toLowerCase().replace(/[^a-z0-9]+/g, "-");
+
+  const waitForMcpAvailability = async (slug: string) => {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < MCP_AUTH_DISCOVERY_TIMEOUT_MS) {
+      const status = await fetchMcpStatus(slug);
+      if (status) return status;
+      await new Promise((resolve) => window.setTimeout(resolve, 500));
+    }
+    return null;
+  };
+
+  const startStatusPolling = (slug: string) => {
+    if (typeof window === "undefined") return;
+
+    stopStatusPolling();
+    const startedAt = Date.now();
+    statusPollRef.current = window.setInterval(async () => {
+      if (Date.now() - startedAt >= MCP_AUTH_TIMEOUT_MS) {
+        stopStatusPolling();
+        setError(t("mcp.auth.request_timed_out"));
+        return;
+      }
+
+      const status = await fetchMcpStatus(slug);
+      if (status?.status === "connected") {
+        setAlreadyConnected(true);
+        setError(null);
+        stopStatusPolling();
+      }
+    }, MCP_AUTH_POLL_INTERVAL_MS);
+  };
+
+  const startAuth = async (forceRetry = false, allowAutoReload = true) => {
+    if (!props.entry || !props.client) return;
+
+    let slug = "";
+    try {
+      slug = resolveSlug(props.entry.name);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.failed_to_start_oauth");
+      setError(message);
+      setLoading(false);
+      setAuthInProgress(false);
+      return;
+    }
+
+    if (!forceRetry && authInProgress) {
+      return;
+    }
+
+    setError(null);
+    setNeedsReload(false);
+    setAlreadyConnected(false);
+    stopStatusPolling();
+    setAuthorizationUrl(null);
+    setCallbackInput("");
+    setReloadNotice(null);
+    setLoading(true);
+    setAuthInProgress(true);
+
+    try {
+      const directory = await resolveDirectory();
+      if (!directory) {
+        setError(t("mcp.pick_workspace_first"));
+        return;
+      }
+
+      const statusEntry = await fetchMcpStatus(slug);
+      if (props.reloadRequired && !reloadSatisfied && !statusEntry) {
+        setNeedsReload(true);
+        setReloadNotice(
+          props.reloadBlocked
+            ? t("mcp.auth.reload_blocked")
+            : t("mcp.auth.reload_notice"),
+        );
+        return;
+      }
+
+      if (statusEntry?.status === "connected") {
+        setAlreadyConnected(true);
+        return;
+      }
+
+      if (!props.isRemoteWorkspace) {
+        const result = await props.client.mcp.auth.authenticate({
+          name: slug,
+          directory,
+        });
+        const status = unwrap(result) as McpStatusEntry;
+
+        if (status.status === "connected") {
+          setAlreadyConnected(true);
+          await props.onComplete();
+          return;
+        }
+
+        if (status.status === "needs_client_registration") {
+          setError(status.error ?? t("mcp.auth.client_registration_required"));
+        } else if (status.status === "disabled") {
+          setError(t("mcp.auth.server_disabled"));
+        } else if (status.status === "failed") {
+          setError(status.error ?? t("mcp.auth.oauth_failed"));
+        } else {
+          setError(t("mcp.auth.authorization_still_required"));
+        }
+        return;
+      }
+
+      const authResult = await props.client.mcp.auth.start({
+        name: slug,
+        directory,
+      });
+      const auth = unwrap(authResult) as { authorizationUrl?: string };
+
+      if (!auth.authorizationUrl) {
+        setAlreadyConnected(true);
+        return;
+      }
+
+      setAuthorizationUrl(auth.authorizationUrl);
+      await openAuthorizationUrl(auth.authorizationUrl);
+      startStatusPolling(slug);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.failed_to_start_oauth");
+
+      if (message.toLowerCase().includes("does not support oauth")) {
+        const serverSlug = props.entry.name.toLowerCase().replace(/[^a-z0-9]+/g, "-") || "server";
+        const canAutoReload =
+          allowAutoReload && !props.isRemoteWorkspace && !props.reloadBlocked && Boolean(props.onReloadEngine);
+
+        if (canAutoReload && props.onReloadEngine) {
+          await props.onReloadEngine();
+          await startAuth(true, false);
+          return;
+        }
+
+        if (props.reloadRequired && !reloadSatisfied) {
+          setReloadNotice(
+            props.reloadBlocked
+              ? t("mcp.auth.reload_blocked")
+              : t("mcp.auth.reload_notice"),
+          );
+        } else {
+          setError(
+            `${message}\n\n${t("mcp.auth.oauth_not_supported_hint", { server: serverSlug })}`,
+          );
+        }
+        setNeedsReload(true);
+      } else if (message.toLowerCase().includes("not found") || message.toLowerCase().includes("unknown")) {
+        setNeedsReload(true);
+        setError(t("mcp.auth.try_reload_engine", { message }));
+      } else {
+        setError(message);
+      }
+    } finally {
+      setLoading(false);
+      setAuthInProgress(false);
+    }
+  };
+
+  const isInvalidRefreshToken = () => {
+    if (!error) return false;
+    const normalized = error.toLowerCase();
+    return (
+      normalized.includes("invalidgranterror") ||
+      normalized.includes("invalid refresh token") ||
+      normalized.includes("invalid_refresh_token")
+    );
+  };
+
+  const handleCliReauth = async () => {
+    if (!props.entry || cliAuthBusy || props.isRemoteWorkspace || !isDesktopRuntime()) return;
+
+    setCliAuthBusy(true);
+    setCliAuthResult(null);
+
+    try {
+      const result = await opencodeMcpAuth(props.projectDir, props.entry.name);
+      if (result.ok) {
+        setError(null);
+        setNeedsReload(true);
+        setReloadNotice(t("mcp.auth.oauth_completed_reload"));
+      } else {
+        setCliAuthResult(result.stderr || result.stdout || t("mcp.auth.reauth_failed"));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.reauth_failed");
+      setCliAuthResult(message);
+    } finally {
+      setCliAuthBusy(false);
+    }
+  };
+
+  useEffect(() => {
+    if (!props.open || !props.entry || !props.client) {
+      previousOpenRef.current = props.open;
+      previousEntryNameRef.current = props.entry?.name ?? null;
+      return;
+    }
+
+    const previousEntryName = previousEntryNameRef.current;
+    const isInitialOpen = !previousOpenRef.current;
+    const entryChanged = previousEntryName !== props.entry.name;
+
+    if (isInitialOpen || entryChanged) {
+      setReloadSatisfied(false);
+    }
+
+    previousOpenRef.current = props.open;
+    previousEntryNameRef.current = props.entry.name;
+
+    if (props.reloadRequired && !reloadSatisfied) {
+      setAwaitingReload(true);
+      return;
+    }
+
+    void startAuth(false);
+  }, [props.open, props.entry, props.client, props.reloadRequired]);
+
+  useEffect(() => {
+    if (!props.open || !awaitingReload || props.reloadBlocked || !props.onReloadEngine || !props.entry || reloadStarting) {
+      return;
+    }
+
+    let cancelled = false;
+
+    void (async () => {
+      setReloadStarting(true);
+      setError(null);
+      setNeedsReload(false);
+      setReloadNotice(null);
+
+      try {
+        await props.onReloadEngine?.();
+        if (cancelled) return;
+
+        const slug = resolveSlug(props.entry!.name);
+        const status = await waitForMcpAvailability(slug);
+        if (cancelled) return;
+
+        if (!status) {
+          setAwaitingReload(false);
+          setNeedsReload(true);
+          setReloadNotice(
+            props.reloadBlocked
+              ? t("mcp.auth.reload_blocked")
+              : t("mcp.auth.reload_notice"),
+          );
+          return;
+        }
+
+        setReloadSatisfied(true);
+        setAwaitingReload(false);
+        await startAuth(false, false);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : t("mcp.auth.reload_failed");
+        if (cancelled) return;
+        setAwaitingReload(false);
+        setNeedsReload(true);
+        setError(message);
+      } finally {
+        if (!cancelled) {
+          setReloadStarting(false);
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [props.open, awaitingReload, props.reloadBlocked, props.onReloadEngine, props.entry, reloadStarting]);
+
+  const handleRetry = () => {
+    void startAuth(true);
+  };
+
+  const handleReloadAndRetry = async () => {
+    if (!props.onReloadEngine) return;
+    if (props.isRemoteWorkspace && typeof window !== "undefined") {
+      const proceed = window.confirm(t("mcp.auth.reload_remote_confirm"));
+      if (!proceed) return;
+    }
+    await props.onReloadEngine();
+    await startAuth(true);
+  };
+
+  const handleForceStopSession = async (sessionID: string) => {
+    if (!props.onForceStopSession || forceStopBusySessionID) return;
+    setForceStopBusySessionID(sessionID);
+    try {
+      await props.onForceStopSession(sessionID);
+    } finally {
+      setForceStopBusySessionID(null);
+    }
+  };
+
+  const handleClose = () => {
+    setError(null);
+    setLoading(false);
+    setAlreadyConnected(false);
+    setNeedsReload(false);
+    setAuthInProgress(false);
+    setStatusChecking(false);
+    setAuthorizationUrl(null);
+    setCallbackInput("");
+    setManualAuthBusy(false);
+    setReloadNotice(null);
+    setCliAuthBusy(false);
+    setCliAuthResult(null);
+    setAwaitingReload(false);
+    setReloadStarting(false);
+    setReloadSatisfied(false);
+    setForceStopBusySessionID(null);
+    stopStatusPolling();
+    props.onClose();
+  };
+
+  const parseAuthCode = (value: string) => {
+    const trimmed = value.trim();
+    if (!trimmed) return null;
+
+    const match = trimmed.match(/[?&]code=([^&]+)/);
+    if (match) {
+      try {
+        return decodeURIComponent(match[1]);
+      } catch {
+        return match[1];
+      }
+    }
+
+    if (/^https?:\/\//i.test(trimmed) || trimmed.includes("localhost") || trimmed.includes("127.0.0.1")) {
+      return null;
+    }
+
+    return trimmed;
+  };
+
+  const handleManualComplete = async () => {
+    if (!props.entry || !props.client) return;
+
+    let slug = "";
+    try {
+      slug = resolveSlug(props.entry.name);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.failed_to_start_oauth");
+      setError(message);
+      return;
+    }
+
+    const code = parseAuthCode(callbackInput);
+    if (!code) {
+      setError(t("mcp.auth.callback_invalid"));
+      return;
+    }
+
+    setManualAuthBusy(true);
+    setError(null);
+    stopStatusPolling();
+
+    try {
+      const directory = await resolveDirectory();
+      if (!directory) {
+        setError(t("mcp.pick_workspace_first"));
+        return;
+      }
+
+      const result = await props.client.mcp.auth.callback({
+        name: slug,
+        directory,
+        code,
+      });
+      const status = unwrap(result) as McpStatusEntry;
+      if (status.status === "connected") {
+        setAlreadyConnected(true);
+        setManualAuthBusy(false);
+        await props.onComplete();
+        return;
+      }
+
+      if (status.status === "needs_client_registration") {
+        setError(status.error ?? t("mcp.auth.client_registration_required"));
+      } else if (status.status === "disabled") {
+        setError(t("mcp.auth.server_disabled"));
+      } else if (status.status === "failed") {
+        setError(status.error ?? t("mcp.auth.oauth_failed"));
+      } else {
+        setError(t("mcp.auth.authorization_still_required"));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.oauth_failed");
+      setError(message);
+    } finally {
+      setManualAuthBusy(false);
+    }
+  };
+
+  const handleComplete = async () => {
+    if (!props.entry || !props.client) return;
+
+    setError(null);
+    setStatusChecking(true);
+
+    let slug = "";
+    try {
+      slug = resolveSlug(props.entry.name);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("mcp.auth.failed_to_start_oauth");
+      setError(message);
+      setStatusChecking(false);
+      return;
+    }
+
+    const statusEntry = await fetchMcpStatus(slug);
+    if (statusEntry?.status === "connected") {
+      setAlreadyConnected(true);
+      setStatusChecking(false);
+      await props.onComplete();
+      return;
+    }
+
+    if (statusEntry?.status === "needs_client_registration") {
+      setError(statusEntry.error ?? t("mcp.auth.client_registration_required"));
+    } else if (statusEntry?.status === "disabled") {
+      setError(t("mcp.auth.server_disabled"));
+    } else if (statusEntry?.status === "failed") {
+      setError(statusEntry.error ?? t("mcp.auth.oauth_failed"));
+    } else {
+      setError(t("mcp.auth.authorization_still_required"));
+    }
+
+    setStatusChecking(false);
+  };
+
+  if (!props.open) return null;
+
+  const isBusy = loading || statusChecking || manualAuthBusy;
+  const isPreparingReload = awaitingReload || reloadStarting;
+  const serverName = props.entry?.name ?? "MCP Server";
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+      <div className="absolute inset-0 bg-gray-1/60 backdrop-blur-sm" onClick={handleClose} />
+
+      <div
+        className="relative w-full max-w-lg overflow-hidden rounded-2xl border border-gray-6 bg-gray-2 shadow-2xl"
+        onClick={(event) => event.stopPropagation()}
+      >
+        <div className="flex items-center justify-between border-b border-gray-6 px-6 py-4">
+          <div>
+            <h2 className="text-lg font-semibold text-gray-12">
+              {t("mcp.auth.connect_server", { server: serverName })}
+            </h2>
+            <p className="text-sm text-gray-11">{t("mcp.auth.open_browser_signin")}</p>
+          </div>
+          <button
+            type="button"
+            className="rounded-lg p-2 text-gray-11 transition-colors hover:bg-gray-4 hover:text-gray-12"
+            onClick={handleClose}
+          >
+            <X size={20} />
+          </button>
+        </div>
+
+        <div className="space-y-5 px-6 py-5">
+          {isBusy ? (
+            <div className="space-y-4 rounded-xl border border-gray-6/60 bg-gray-1/40 px-5 py-6 text-center">
+              <div className="flex items-center justify-center">
+                <Loader2 size={32} className="animate-spin text-gray-11" />
+              </div>
+              <div className="space-y-2">
+                <p className="text-sm font-medium text-gray-12">{t("mcp.auth.waiting_authorization")}</p>
+                <p className="text-xs text-gray-10">{t("mcp.auth.follow_browser_steps")}</p>
+                <button
+                  type="button"
+                  className="text-xs text-gray-10 underline underline-offset-2 transition-colors hover:text-gray-11"
+                  onClick={handleRetry}
+                >
+                  {t("mcp.auth.reopen_browser_link")}
+                </button>
+              </div>
+            </div>
+          ) : null}
+
+          {!isBusy && isPreparingReload ? (
+            <div className="space-y-4 rounded-xl border border-amber-6/60 bg-amber-2/40 px-5 py-6 text-center">
+              <div className="flex items-center justify-center">
+                <Loader2 size={32} className="animate-spin text-amber-11" />
+              </div>
+              <div className="space-y-2">
+                <p className="text-sm font-medium text-gray-12">
+                  {props.reloadBlocked
+                    ? t("mcp.auth.waiting_for_conversation_title")
+                    : t("mcp.auth.applying_changes_title")}
+                </p>
+                <p className="text-xs text-gray-10">
+                  {props.reloadBlocked
+                    ? t("mcp.auth.waiting_for_conversation_body")
+                    : t("mcp.auth.applying_changes_body")}
+                </p>
+              </div>
+              {props.reloadBlocked && (props.activeSessions?.length ?? 0) > 0 ? (
+                <div className="space-y-2 text-left">
+                  {(props.activeSessions ?? []).map((session) => (
+                    <div
+                      key={session.id}
+                      className="flex items-center justify-between gap-3 rounded-lg border border-amber-6/50 bg-amber-1/40 px-3 py-2"
+                    >
+                      <span className="text-xs text-gray-11">
+                        {t("mcp.auth.waiting_for_session", { session: session.title })}
+                      </span>
+                      <button
+                        type="button"
+                        className="text-xs text-amber-11 underline underline-offset-2 transition-colors hover:text-amber-12 disabled:no-underline disabled:opacity-60"
+                        onClick={() => void handleForceStopSession(session.id)}
+                        disabled={forceStopBusySessionID === session.id}
+                      >
+                        {forceStopBusySessionID === session.id
+                          ? t("mcp.auth.force_stopping")
+                          : t("mcp.auth.force_stop")}
+                      </button>
+                    </div>
+                  ))}
+                </div>
+              ) : null}
+            </div>
+          ) : null}
+
+          {!isBusy && alreadyConnected ? (
+            <div className="space-y-4 rounded-xl border border-green-7/20 bg-green-7/10 p-5">
+              <div className="flex items-center gap-3">
+                <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-green-7/20">
+                  <CheckCircle2 size={24} className="text-green-11" />
+                </div>
+                <div>
+                  <p className="text-sm font-medium text-gray-12">{t("mcp.auth.already_connected")}</p>
+                  <p className="text-xs text-gray-11">
+                    {t("mcp.auth.already_connected_description", { server: serverName })}
+                  </p>
+                </div>
+              </div>
+              <p className="text-xs text-gray-10">{t("mcp.auth.configured_previously")}</p>
+            </div>
+          ) : null}
+
+          {reloadNotice ? (
+            <div className="space-y-3 rounded-xl border border-gray-6/70 bg-gray-1/50 p-4">
+              <p className="text-sm text-gray-11">{reloadNotice}</p>
+
+              <div className="flex flex-wrap gap-2 pt-1">
+                {props.onReloadEngine ? (
+                  <Button
+                    variant="secondary"
+                    onClick={() => void handleReloadAndRetry()}
+                    disabled={props.reloadBlocked}
+                    title={props.reloadBlocked ? t("mcp.reload_banner_blocked_hint") : undefined}
+                  >
+                    <RefreshCcw size={14} />
+                    {t("mcp.auth.reload_engine_retry")}
+                  </Button>
+                ) : null}
+                <Button variant="ghost" onClick={handleRetry}>
+                  {t("mcp.auth.retry_now")}
+                </Button>
+              </div>
+            </div>
+          ) : null}
+
+          {error ? (
+            <div className="space-y-3 rounded-xl border border-red-7/20 bg-red-7/10 p-4">
+              <p className="whitespace-pre-wrap text-sm text-red-11">{error}</p>
+
+              {needsReload ? (
+                <div className="flex flex-wrap gap-2 pt-2">
+                  {props.onReloadEngine ? (
+                    <Button
+                      variant="secondary"
+                      onClick={() => void handleReloadAndRetry()}
+                      disabled={props.reloadBlocked}
+                      title={props.reloadBlocked ? t("mcp.reload_banner_blocked_hint") : undefined}
+                    >
+                      <RefreshCcw size={14} />
+                      {t("mcp.auth.reload_engine_retry")}
+                    </Button>
+                  ) : null}
+                  <Button variant="ghost" onClick={handleRetry}>
+                    {t("mcp.auth.retry_now")}
+                  </Button>
+                </div>
+              ) : (
+                <div className="pt-2">
+                  <Button variant="ghost" onClick={handleRetry}>
+                    {t("mcp.auth.retry")}
+                  </Button>
+                </div>
+              )}
+
+              {isInvalidRefreshToken() ? (
+                <div className="space-y-2 pt-2">
+                  <p className="text-xs text-red-11">{t("mcp.auth.invalid_refresh_token")}</p>
+                  {!props.isRemoteWorkspace ? (
+                    isDesktopRuntime() ? (
+                      <Button variant="secondary" onClick={() => void handleCliReauth()} disabled={cliAuthBusy}>
+                        {cliAuthBusy ? <Loader2 size={14} className="animate-spin" /> : null}
+                        {cliAuthBusy
+                          ? t("mcp.auth.reauth_running")
+                          : t("mcp.auth.reauth_action")}
+                      </Button>
+                    ) : (
+                      <div className="text-[11px] text-red-10">
+                        {t("mcp.auth.reauth_cli_hint", { server: serverName })}
+                      </div>
+                    )
+                  ) : (
+                    <div className="text-[11px] text-red-10">{t("mcp.auth.reauth_remote_hint")}</div>
+                  )}
+                  {cliAuthResult ? <div className="text-[11px] text-red-10">{cliAuthResult}</div> : null}
+                </div>
+              ) : null}
+            </div>
+          ) : null}
+
+          {!isBusy && authorizationUrl && props.isRemoteWorkspace && !alreadyConnected ? (
+            <div className="space-y-3 rounded-xl border border-gray-6/60 bg-gray-1/40 p-4">
+              <div className="text-xs font-medium text-gray-12">{t("mcp.auth.manual_finish_title")}</div>
+              <div className="text-xs text-gray-10">{t("mcp.auth.manual_finish_hint")}</div>
+              <div className="flex items-center gap-3 rounded-xl border border-gray-6/70 bg-gray-2/40 px-3 py-2">
+                <div className="min-w-0 flex-1">
+                  <div className="text-[10px] uppercase tracking-wide text-gray-8">
+                    {t("mcp.auth.authorization_link")}
+                  </div>
+                  <div className="truncate font-mono text-[11px] text-gray-11">{authorizationUrl}</div>
+                </div>
+                <Button variant="ghost" className="text-xs" onClick={() => void handleCopyAuthorizationUrl()}>
+                  {authUrlCopied ? t("mcp.auth.copied") : t("mcp.auth.copy_link")}
+                </Button>
+              </div>
+              <TextInput
+                label={t("mcp.auth.callback_label")}
+                placeholder={t("mcp.auth.callback_placeholder")}
+                value={callbackInput}
+                onChange={(event) => setCallbackInput(event.currentTarget.value)}
+              />
+              <div className="text-[11px] text-gray-9">{t("mcp.auth.port_forward_hint")}</div>
+              <div className="flex justify-end">
+                <Button
+                  variant="secondary"
+                  onClick={() => void handleManualComplete()}
+                  disabled={manualAuthBusy || !callbackInput.trim()}
+                >
+                  {manualAuthBusy ? <Loader2 size={14} className="animate-spin" /> : null}
+                  {t("mcp.auth.complete_connection")}
+                </Button>
+              </div>
+            </div>
+          ) : null}
+
+          {!isBusy && !isPreparingReload && !error && !reloadNotice && !alreadyConnected ? (
+            <>
+              <div className="space-y-4">
+                <div className="flex items-start gap-3">
+                  <div className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-gray-4 text-xs font-medium text-gray-11">
+                    1
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-gray-12">{t("mcp.auth.step1_title")}</p>
+                    <p className="mt-1 text-xs text-gray-10">
+                      {t("mcp.auth.step1_description", { server: serverName })}
+                    </p>
+                  </div>
+                </div>
+
+                <div className="flex items-start gap-3">
+                  <div className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-gray-4 text-xs font-medium text-gray-11">
+                    2
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-gray-12">{t("mcp.auth.step2_title")}</p>
+                    <p className="mt-1 text-xs text-gray-10">{t("mcp.auth.step2_description")}</p>
+                  </div>
+                </div>
+
+                <div className="flex items-start gap-3">
+                  <div className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-gray-4 text-xs font-medium text-gray-11">
+                    3
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-gray-12">{t("mcp.auth.step3_title")}</p>
+                    <p className="mt-1 text-xs text-gray-10">{t("mcp.auth.step3_description")}</p>
+                  </div>
+                </div>
+              </div>
+
+              <div className="rounded-xl border border-gray-6/60 bg-gray-1/40 p-4 text-sm text-gray-11">
+                <div className="space-y-3">
+                  <p>{t("mcp.auth.waiting_authorization")}</p>
+                  <p className="text-xs text-gray-10">{t("mcp.auth.follow_browser_steps")}</p>
+                  <button
+                    type="button"
+                    className="text-left text-xs text-gray-10 underline underline-offset-2 transition-colors hover:text-gray-11"
+                    onClick={handleRetry}
+                  >
+                    {t("mcp.auth.reopen_browser_link")}
+                  </button>
+                </div>
+              </div>
+            </>
+          ) : null}
+        </div>
+
+        <div className="flex items-center justify-end gap-3 border-t border-gray-6 bg-gray-2/50 px-6 py-4">
+          {alreadyConnected ? (
+            <Button variant="primary" onClick={() => void handleComplete()}>
+              <CheckCircle2 size={16} />
+              {t("mcp.auth.done")}
+            </Button>
+          ) : (
+            <>
+              <Button variant="ghost" onClick={handleClose}>
+                {t("mcp.auth.cancel")}
+              </Button>
+              <Button variant="secondary" onClick={() => void handleComplete()}>
+                <CheckCircle2 size={16} />
+                {t("mcp.auth.im_done")}
+              </Button>
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/connections/modals.tsx b/apps/app/src/react-app/domains/connections/modals.tsx
new file mode 100644
index 0000000000..1367cb257d
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/modals.tsx
@@ -0,0 +1,43 @@
+/** @jsxImportSource react */
+import type { Client } from "../../../app/types";
+import type { McpDirectoryInfo } from "../../../app/constants";
+
+import { McpAuthModal } from "./mcp-auth-modal";
+
+export type ConnectionsModalsState = {
+  mcpAuthModalOpen: boolean;
+  mcpAuthEntry: McpDirectoryInfo | null;
+  mcpAuthNeedsReload: boolean;
+};
+
+export type ConnectionsModalsProps = {
+  client: Client | null;
+  projectDir: string;
+  reloadBlocked: boolean;
+  activeSessions: Array<{ id: string; title: string }>;
+  isRemoteWorkspace: boolean;
+  onForceStopSession: (sessionID: string) => void | Promise<void>;
+  onReloadEngine: () => void | Promise<void>;
+  modalState: ConnectionsModalsState;
+  onCloseMcpAuthModal: () => void;
+  onCompleteMcpAuthModal: () => void | Promise<void>;
+};
+
+export default function ConnectionsModals(props: ConnectionsModalsProps) {
+  return (
+    <McpAuthModal
+      open={props.modalState.mcpAuthModalOpen}
+      client={props.client}
+      entry={props.modalState.mcpAuthEntry}
+      projectDir={props.projectDir}
+      reloadRequired={props.modalState.mcpAuthNeedsReload}
+      reloadBlocked={props.reloadBlocked}
+      activeSessions={props.activeSessions}
+      isRemoteWorkspace={props.isRemoteWorkspace}
+      onForceStopSession={props.onForceStopSession}
+      onClose={props.onCloseMcpAuthModal}
+      onComplete={props.onCompleteMcpAuthModal}
+      onReloadEngine={props.onReloadEngine}
+    />
+  );
+}
diff --git a/apps/app/src/react-app/domains/connections/modals/add-mcp-modal.tsx b/apps/app/src/react-app/domains/connections/modals/add-mcp-modal.tsx
new file mode 100644
index 0000000000..d6c7d8adbe
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/modals/add-mcp-modal.tsx
@@ -0,0 +1,254 @@
+/** @jsxImportSource react */
+import { useState } from "react";
+import { Loader2, Plus, X } from "lucide-react";
+
+import { Button } from "../../../design-system/button";
+import { TextInput } from "../../../design-system/text-input";
+import type { McpDirectoryInfo } from "../../../../app/constants";
+import { t } from "../../../../i18n";
+
+export type AddMcpModalProps = {
+  open: boolean;
+  onClose: () => void;
+  onAdd: (entry: McpDirectoryInfo) => void;
+  busy: boolean;
+  isRemoteWorkspace: boolean;
+};
+
+export function AddMcpModal(props: AddMcpModalProps) {
+  const [name, setName] = useState("");
+  const [serverType, setServerType] = useState<"remote" | "local">("remote");
+  const [url, setUrl] = useState("");
+  const [command, setCommand] = useState("");
+  const [oauthRequired, setOauthRequired] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [submitting, setSubmitting] = useState(false);
+
+  const reset = () => {
+    setName("");
+    setServerType("remote");
+    setUrl("");
+    setCommand("");
+    setOauthRequired(false);
+    setError(null);
+  };
+
+  const handleClose = () => {
+    if (submitting) return;
+    reset();
+    props.onClose();
+  };
+
+  const handleSubmit = async () => {
+    if (submitting) return;
+    setError(null);
+
+    const trimmedName = name.trim();
+    if (!trimmedName) {
+      setError(t("mcp.name_required"));
+      return;
+    }
+
+    setSubmitting(true);
+
+    if (serverType === "remote") {
+      const trimmedUrl = url.trim();
+      if (!trimmedUrl) {
+        setError(t("mcp.url_or_command_required"));
+        setSubmitting(false);
+        return;
+      }
+
+      try {
+        await Promise.resolve(
+          props.onAdd({
+            name: trimmedName,
+            description: "",
+            type: "remote",
+            url: trimmedUrl,
+            oauth: oauthRequired,
+          }),
+        );
+      } finally {
+        setSubmitting(false);
+      }
+    } else {
+      const trimmedCommand = command.trim();
+      if (!trimmedCommand) {
+        setError(t("mcp.url_or_command_required"));
+        setSubmitting(false);
+        return;
+      }
+
+      try {
+        await Promise.resolve(
+          props.onAdd({
+            name: trimmedName,
+            description: "",
+            type: "local",
+            command: trimmedCommand.split(/\s+/),
+            oauth: false,
+          }),
+        );
+      } finally {
+        setSubmitting(false);
+      }
+    }
+
+    handleClose();
+  };
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+      <div
+        className="absolute inset-0 bg-gray-1/60 backdrop-blur-sm"
+        onClick={handleClose}
+      />
+      <div
+        className="relative w-full max-w-lg bg-gray-2 border border-gray-6 rounded-2xl shadow-2xl overflow-hidden"
+        onClick={(event) => event.stopPropagation()}
+      >
+        <div className="flex items-center justify-between px-6 py-4 border-b border-gray-6">
+          <div>
+            <h2 className="text-lg font-semibold text-gray-12">
+              {t("mcp.add_modal_title")}
+            </h2>
+            <p className="text-sm text-gray-11">
+              {t("mcp.add_modal_subtitle")}
+            </p>
+          </div>
+          <button
+            type="button"
+            className="p-2 text-gray-11 hover:text-gray-12 hover:bg-gray-4 rounded-lg transition-colors"
+            onClick={handleClose}
+          >
+            <X size={20} />
+          </button>
+        </div>
+
+        <div className="px-6 py-5 space-y-4">
+          <TextInput
+            label={t("mcp.server_name")}
+            placeholder={t("mcp.server_name_placeholder")}
+            value={name}
+            onChange={(event) => setName(event.currentTarget.value)}
+            autoFocus
+          />
+
+          <div>
+            <div className="mb-1 text-xs font-medium text-dls-secondary">
+              {t("mcp.server_type")}
+            </div>
+            <div className="flex items-center gap-1.5">
+              <button
+                type="button"
+                className={`px-3 py-1.5 rounded-lg text-xs font-medium transition-colors ${
+                  serverType === "remote"
+                    ? "bg-dls-active text-dls-text"
+                    : "text-dls-secondary hover:text-dls-text hover:bg-dls-hover"
+                }`}
+                onClick={() => setServerType("remote")}
+              >
+                {t("mcp.type_remote")}
+              </button>
+              <button
+                type="button"
+                disabled={props.isRemoteWorkspace}
+                className={`px-3 py-1.5 rounded-lg text-xs font-medium transition-colors ${
+                  serverType === "local"
+                    ? "bg-dls-active text-dls-text"
+                    : "text-dls-secondary hover:text-dls-text hover:bg-dls-hover"
+                } ${props.isRemoteWorkspace ? "opacity-50 cursor-not-allowed" : ""}`}
+                onClick={() => {
+                  if (props.isRemoteWorkspace) return;
+                  setServerType("local");
+                }}
+              >
+                {t("mcp.type_local_cmd")}
+              </button>
+            </div>
+            {props.isRemoteWorkspace ? (
+              <div className="mt-2 text-[11px] text-dls-secondary">
+                {t("mcp.remote_workspace_url_hint")}
+              </div>
+            ) : null}
+          </div>
+
+          {serverType === "remote" ? (
+            <div className="space-y-3">
+              <TextInput
+                label={t("mcp.server_url")}
+                placeholder={t("mcp.server_url_placeholder")}
+                value={url}
+                onChange={(event) => setUrl(event.currentTarget.value)}
+              />
+              <div className="rounded-xl border border-dls-border bg-dls-hover/40 px-3 py-3">
+                <div className="mb-2 text-xs font-medium text-dls-text">
+                  {t("mcp.sign_in_section_label")}
+                </div>
+                <label className="flex items-start gap-2 text-xs text-dls-secondary">
+                  <input
+                    type="checkbox"
+                    className="mt-0.5 h-4 w-4 rounded border border-dls-border"
+                    checked={oauthRequired}
+                    onChange={(event) =>
+                      setOauthRequired(event.currentTarget.checked)
+                    }
+                  />
+                  <span>
+                    <span className="block text-dls-text">
+                      {t("mcp.oauth_optional_label")}
+                    </span>
+                    <span className="mt-0.5 block text-dls-secondary">
+                      {t("mcp.oauth_optional_hint")}
+                    </span>
+                  </span>
+                </label>
+              </div>
+            </div>
+          ) : null}
+
+          {serverType === "local" ? (
+            <TextInput
+              label={t("mcp.server_command")}
+              placeholder={t("mcp.server_command_placeholder")}
+              hint={t("mcp.server_command_hint")}
+              value={command}
+              onChange={(event) => setCommand(event.currentTarget.value)}
+            />
+          ) : null}
+
+          {error ? (
+            <div className="rounded-lg bg-red-2 border border-red-6 px-3 py-2 text-xs text-red-11">
+              {error}
+            </div>
+          ) : null}
+        </div>
+
+        <div className="flex items-center justify-end gap-3 px-6 py-4 border-t border-gray-6 bg-gray-2/50">
+          <Button
+            variant="ghost"
+            onClick={handleClose}
+            disabled={submitting}
+          >
+            {t("mcp.auth.cancel")}
+          </Button>
+          <Button
+            variant="secondary"
+            onClick={() => void handleSubmit()}
+            disabled={props.busy || submitting}
+          >
+            {props.busy || submitting ? (
+              <Loader2 size={16} className="animate-spin" />
+            ) : (
+              <Plus size={16} />
+            )}
+            {t("mcp.add_server_button")}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/connections/modals/control-chrome-setup-modal.tsx b/apps/app/src/react-app/domains/connections/modals/control-chrome-setup-modal.tsx
new file mode 100644
index 0000000000..4b2201442d
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/modals/control-chrome-setup-modal.tsx
@@ -0,0 +1,181 @@
+/** @jsxImportSource react */
+import { useEffect, useState } from "react";
+import {
+  Check,
+  ExternalLink,
+  Loader2,
+  MonitorSmartphone,
+  Settings2,
+  X,
+} from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+export type ControlChromeSetupModalProps = {
+  open: boolean;
+  busy: boolean;
+  mode: "connect" | "edit";
+  initialUseExistingProfile: boolean;
+  onClose: () => void;
+  onSave: (useExistingProfile: boolean) => void;
+};
+
+export function ControlChromeSetupModal(props: ControlChromeSetupModalProps) {
+  const [useExistingProfile, setUseExistingProfile] = useState(
+    props.initialUseExistingProfile,
+  );
+
+  useEffect(() => {
+    if (!props.open) return;
+    setUseExistingProfile(props.initialUseExistingProfile);
+  }, [props.initialUseExistingProfile, props.open]);
+
+  if (!props.open) return null;
+
+  const ctaLabel =
+    props.mode === "edit"
+      ? t("mcp.control_chrome_save")
+      : t("mcp.control_chrome_connect");
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+      <div
+        className="absolute inset-0 bg-gray-1/70 backdrop-blur-sm"
+        onClick={props.onClose}
+      />
+
+      <div className="relative w-full max-w-2xl overflow-hidden rounded-2xl border border-gray-6/70 bg-gray-2 shadow-2xl">
+        <div className="border-b border-gray-6 px-6 py-5 sm:px-7">
+          <div className="flex items-start justify-between gap-4">
+            <div className="space-y-2">
+              <div className="inline-flex items-center gap-2 rounded-full border border-gray-6 bg-gray-3 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-gray-11">
+                <MonitorSmartphone size={12} />
+                Chrome DevTools MCP
+              </div>
+              <div>
+                <h2 className="text-xl font-semibold text-gray-12 sm:text-2xl">
+                  {t("mcp.control_chrome_setup_title")}
+                </h2>
+                <p className="mt-1 max-w-xl text-sm leading-6 text-gray-11">
+                  {t("mcp.control_chrome_setup_subtitle")}
+                </p>
+              </div>
+            </div>
+            <button
+              type="button"
+              className="rounded-xl p-2 text-gray-11 transition-colors hover:bg-gray-4 hover:text-gray-12"
+              onClick={props.onClose}
+              aria-label={t("common.cancel")}
+            >
+              <X size={20} />
+            </button>
+          </div>
+        </div>
+
+        <div className="space-y-5 px-6 py-6 sm:px-7">
+          <div className="rounded-2xl border border-gray-6 bg-gray-1/40 p-5">
+            <div className="flex items-start gap-3">
+              <div className="mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-blue-3 text-blue-11">
+                <Check size={18} />
+              </div>
+              <div className="min-w-0 flex-1">
+                <h3 className="text-sm font-semibold text-gray-12">
+                  {t("mcp.control_chrome_browser_title")}
+                </h3>
+                <p className="mt-1 text-sm text-gray-11">
+                  {t("mcp.control_chrome_browser_hint")}
+                </p>
+                <ol className="mt-3 space-y-2 text-sm leading-6 text-gray-12">
+                  <li>1. {t("mcp.control_chrome_browser_step_one")}</li>
+                  <li>2. {t("mcp.control_chrome_browser_step_two")}</li>
+                  <li>3. {t("mcp.control_chrome_browser_step_three")}</li>
+                </ol>
+                <a
+                  href="https://github.com/ChromeDevTools/chrome-devtools-mcp"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="mt-3 inline-flex items-center gap-1 text-xs font-medium text-blue-11 transition-colors hover:text-blue-12"
+                >
+                  {t("mcp.control_chrome_docs")}
+                  <ExternalLink size={12} />
+                </a>
+              </div>
+            </div>
+          </div>
+
+          <div className="rounded-2xl border border-gray-6 bg-gray-1/40 p-5">
+            <div className="flex items-start gap-3">
+              <div className="mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-gray-3 text-gray-11">
+                <Settings2 size={18} />
+              </div>
+              <div className="min-w-0 flex-1">
+                <h3 className="text-sm font-semibold text-gray-12">
+                  {t("mcp.control_chrome_profile_title")}
+                </h3>
+                <p className="mt-1 text-sm leading-6 text-gray-11">
+                  {t("mcp.control_chrome_profile_hint")}
+                </p>
+
+                <button
+                  type="button"
+                  role="switch"
+                  aria-checked={useExistingProfile}
+                  onClick={() => setUseExistingProfile((current) => !current)}
+                  className="mt-4 flex w-full items-center justify-between gap-4 rounded-2xl border border-gray-6 bg-gray-2 px-4 py-4 text-left transition-colors hover:bg-gray-3"
+                >
+                  <div className="space-y-1">
+                    <div className="text-sm font-semibold text-gray-12">
+                      {t("mcp.control_chrome_toggle_label")}
+                    </div>
+                    <div className="text-xs leading-5 text-gray-11">
+                      {t("mcp.control_chrome_toggle_hint")}
+                    </div>
+                  </div>
+
+                  <div
+                    className={`relative h-7 w-12 shrink-0 rounded-full transition-colors ${
+                      useExistingProfile ? "bg-blue-9" : "bg-gray-6"
+                    }`}
+                  >
+                    <div
+                      className={`absolute top-1 h-5 w-5 rounded-full bg-white shadow-sm transition-transform ${
+                        useExistingProfile ? "translate-x-6" : "translate-x-1"
+                      }`}
+                    />
+                  </div>
+                </button>
+
+                <div className="mt-3 rounded-2xl border border-dashed border-gray-6 bg-gray-2/70 px-4 py-3 text-xs leading-5 text-gray-11">
+                  {useExistingProfile
+                    ? t("mcp.control_chrome_toggle_on")
+                    : t("mcp.control_chrome_toggle_off")}
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+
+        <div className="flex flex-col-reverse gap-3 border-t border-gray-6 bg-gray-2/80 px-6 py-4 sm:flex-row sm:items-center sm:justify-end sm:px-7">
+          <Button variant="ghost" onClick={props.onClose}>
+            {t("mcp.auth.cancel")}
+          </Button>
+          <Button
+            variant="secondary"
+            onClick={() => props.onSave(useExistingProfile)}
+            disabled={props.busy}
+          >
+            {props.busy ? (
+              <>
+                <Loader2 size={16} className="animate-spin" />
+                {ctaLabel}
+              </>
+            ) : (
+              ctaLabel
+            )}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/connections/openwork-server-provider.tsx b/apps/app/src/react-app/domains/connections/openwork-server-provider.tsx
new file mode 100644
index 0000000000..5e2ab90cab
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/openwork-server-provider.tsx
@@ -0,0 +1,33 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useContext,
+  useSyncExternalStore,
+  type ReactNode,
+} from "react";
+
+import type { OpenworkServerStore } from "./openwork-server-store";
+
+const OpenworkServerContext = createContext<OpenworkServerStore | null>(null);
+
+export function OpenworkServerProvider(props: {
+  store: OpenworkServerStore;
+  children: ReactNode;
+}) {
+  return (
+    <OpenworkServerContext.Provider value={props.store}>
+      {props.children}
+    </OpenworkServerContext.Provider>
+  );
+}
+
+export function useOpenworkServer() {
+  const store = useContext(OpenworkServerContext);
+  if (!store) {
+    throw new Error("useOpenworkServer must be used within an OpenworkServerProvider");
+  }
+
+  useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+
+  return store;
+}
diff --git a/apps/app/src/react-app/domains/connections/openwork-server-store.ts b/apps/app/src/react-app/domains/connections/openwork-server-store.ts
new file mode 100644
index 0000000000..9f9a01ee2e
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/openwork-server-store.ts
@@ -0,0 +1,786 @@
+import { useSyncExternalStore } from "react";
+
+import { t } from "../../../i18n";
+import type { StartupPreference, WorkspaceDisplay } from "../../../app/types";
+import { isDesktopRuntime } from "../../../app/utils";
+import {
+  openworkServerInfo,
+  openworkServerRestart,
+  type OpenworkServerInfo,
+} from "../../../app/lib/desktop";
+import {
+  clearOpenworkServerSettings,
+  createOpenworkServerClient,
+  isLoopbackOpenworkServerUrl,
+  normalizeOpenworkServerUrl,
+  readOpenworkServerSettings,
+  writeOpenworkServerSettings,
+  type OpenworkAuditEntry,
+  type OpenworkServerCapabilities,
+  type OpenworkServerClient,
+  type OpenworkServerDiagnostics,
+  type OpenworkServerError,
+  type OpenworkServerSettings,
+  type OpenworkServerStatus,
+} from "../../../app/lib/openwork-server";
+
+type SetStateAction<T> = T | ((current: T) => T);
+
+type RemoteWorkspaceInput = {
+  openworkHostUrl: string;
+  openworkToken?: string | null;
+  directory?: string | null;
+  displayName?: string | null;
+};
+
+export type OpenworkServerStoreSnapshot = {
+  openworkServerSettings: OpenworkServerSettings;
+  shareRemoteAccessBusy: boolean;
+  shareRemoteAccessError: string | null;
+  openworkServerUrl: string;
+  openworkServerBaseUrl: string;
+  openworkServerAuth: { token?: string; hostToken?: string };
+  openworkServerClient: OpenworkServerClient | null;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerCapabilities: OpenworkServerCapabilities | null;
+  openworkServerReady: boolean;
+  openworkServerWorkspaceReady: boolean;
+  resolvedOpenworkCapabilities: OpenworkServerCapabilities | null;
+  openworkServerCanWriteSkills: boolean;
+  openworkServerCanWritePlugins: boolean;
+  openworkServerHostInfo: OpenworkServerInfo | null;
+  openworkServerDiagnostics: OpenworkServerDiagnostics | null;
+  openworkReconnectBusy: boolean;
+  openworkAuditEntries: OpenworkAuditEntry[];
+  openworkAuditStatus: "idle" | "loading" | "error";
+  openworkAuditError: string | null;
+  devtoolsWorkspaceId: string | null;
+};
+
+export type OpenworkServerStore = ReturnType<typeof createOpenworkServerStore>;
+
+type CreateOpenworkServerStoreOptions = {
+  startupPreference: () => StartupPreference | null;
+  documentVisible: () => boolean;
+  developerMode: () => boolean;
+  runtimeWorkspaceId: () => string | null;
+  activeClient: () => unknown | null;
+  selectedWorkspaceDisplay: () => WorkspaceDisplay;
+  restartLocalServer: () => Promise<boolean>;
+  createRemoteWorkspaceFlow: (input: RemoteWorkspaceInput) => Promise<boolean>;
+};
+
+type MutableState = {
+  openworkServerSettings: OpenworkServerSettings;
+  shareRemoteAccessBusy: boolean;
+  shareRemoteAccessError: string | null;
+  openworkServerUrl: string;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerCapabilities: OpenworkServerCapabilities | null;
+  openworkServerCheckedAt: number | null;
+  openworkServerHostInfo: OpenworkServerInfo | null;
+  openworkServerHostInfoReady: boolean;
+  openworkServerDiagnostics: OpenworkServerDiagnostics | null;
+  openworkReconnectBusy: boolean;
+  openworkAuditEntries: OpenworkAuditEntry[];
+  openworkAuditStatus: "idle" | "loading" | "error";
+  openworkAuditError: string | null;
+  devtoolsWorkspaceId: string | null;
+};
+
+const applyStateAction = <T,>(current: T, next: SetStateAction<T>) =>
+  typeof next === "function" ? (next as (value: T) => T)(current) : next;
+
+export function createOpenworkServerStore(options: CreateOpenworkServerStoreOptions) {
+  const bootStartedAt = Date.now();
+  const listeners = new Set<() => void>();
+  const intervals = new Map<string, number>();
+
+  let clientCacheKey = "";
+  let clientCacheValue: OpenworkServerClient | null = null;
+  let started = false;
+  let disposed = false;
+  let healthTimeoutId: number | null = null;
+  let healthBusy = false;
+  let healthDelayMs = 10_000;
+  let snapshot: OpenworkServerStoreSnapshot;
+
+  let state: MutableState = {
+    openworkServerSettings: readOpenworkServerSettings(),
+    shareRemoteAccessBusy: false,
+    shareRemoteAccessError: null,
+    openworkServerUrl: "",
+    openworkServerStatus: "disconnected",
+    openworkServerCapabilities: null,
+    openworkServerCheckedAt: null,
+    openworkServerHostInfo: null,
+    openworkServerHostInfoReady: !isDesktopRuntime(),
+    openworkServerDiagnostics: null,
+    openworkReconnectBusy: false,
+    openworkAuditEntries: [],
+    openworkAuditStatus: "idle",
+    openworkAuditError: null,
+    devtoolsWorkspaceId: null,
+  };
+
+  const emitChange = () => {
+    for (const listener of listeners) listener();
+  };
+
+  const getBaseUrl = () => {
+    const pref = options.startupPreference();
+    const hostInfo = state.openworkServerHostInfo;
+    const settingsUrl = normalizeOpenworkServerUrl(state.openworkServerSettings.urlOverride ?? "") ?? "";
+
+    if (pref === "local") return hostInfo?.baseUrl ?? "";
+    if (pref === "server" && settingsUrl && isLoopbackOpenworkServerUrl(settingsUrl) && hostInfo?.baseUrl) {
+      return hostInfo.baseUrl;
+    }
+    if (pref === "server") return settingsUrl;
+    return hostInfo?.baseUrl ?? settingsUrl;
+  };
+
+  const getAuth = () => {
+    const pref = options.startupPreference();
+    const hostInfo = state.openworkServerHostInfo;
+    const settingsUrl = normalizeOpenworkServerUrl(state.openworkServerSettings.urlOverride ?? "") ?? "";
+    const settingsToken = state.openworkServerSettings.token?.trim() ?? "";
+    const settingsHostToken = state.openworkServerSettings.hostToken?.trim() ?? "";
+    const clientToken = hostInfo?.clientToken?.trim() ?? "";
+    const hostToken = hostInfo?.hostToken?.trim() ?? "";
+
+    if (pref === "local") {
+      return { token: clientToken || undefined, hostToken: hostToken || undefined };
+    }
+    if (pref === "server" && settingsUrl && isLoopbackOpenworkServerUrl(settingsUrl) && hostInfo?.baseUrl) {
+      return {
+        token: clientToken || settingsToken || undefined,
+        hostToken: hostToken || settingsHostToken || undefined,
+      };
+    }
+    if (pref === "server") {
+      return {
+        token: settingsToken || undefined,
+        hostToken: settingsUrl && isLoopbackOpenworkServerUrl(settingsUrl) ? settingsHostToken || undefined : undefined,
+      };
+    }
+    if (hostInfo?.baseUrl) {
+      return { token: clientToken || undefined, hostToken: hostToken || undefined };
+    }
+    return {
+      token: settingsToken || undefined,
+      hostToken: settingsUrl && isLoopbackOpenworkServerUrl(settingsUrl) ? settingsHostToken || undefined : undefined,
+    };
+  };
+
+  const getClient = () => {
+    const baseUrl = getBaseUrl().trim();
+    if (!baseUrl) {
+      clientCacheKey = "";
+      clientCacheValue = null;
+      return null;
+    }
+
+    const auth = getAuth();
+    const key = `${baseUrl}::${auth.token ?? ""}::${auth.hostToken ?? ""}`;
+    if (key !== clientCacheKey) {
+      clientCacheKey = key;
+      clientCacheValue = createOpenworkServerClient({
+        baseUrl,
+        token: auth.token,
+        hostToken: auth.hostToken,
+      });
+    }
+    return clientCacheValue;
+  };
+
+  const refreshSnapshot = () => {
+    const openworkServerBaseUrl = getBaseUrl().trim();
+    const openworkServerAuth = getAuth();
+    const openworkServerClient = getClient();
+    const openworkServerReady = state.openworkServerStatus === "connected";
+    const openworkServerWorkspaceReady = Boolean(options.runtimeWorkspaceId());
+    const resolvedOpenworkCapabilities = state.openworkServerCapabilities;
+
+    const pref = options.startupPreference();
+    const info = state.openworkServerHostInfo;
+    const hostUrl = info?.connectUrl ?? info?.lanUrl ?? info?.mdnsUrl ?? info?.baseUrl ?? "";
+    const settingsUrl = normalizeOpenworkServerUrl(state.openworkServerSettings.urlOverride ?? "") ?? "";
+
+    let openworkServerUrl = hostUrl || settingsUrl;
+    if (pref === "local") openworkServerUrl = hostUrl;
+    if (pref === "server") openworkServerUrl = settingsUrl;
+    state.openworkServerUrl = openworkServerUrl;
+
+    snapshot = {
+      openworkServerSettings: state.openworkServerSettings,
+      shareRemoteAccessBusy: state.shareRemoteAccessBusy,
+      shareRemoteAccessError: state.shareRemoteAccessError,
+      openworkServerUrl,
+      openworkServerBaseUrl,
+      openworkServerAuth,
+      openworkServerClient,
+      openworkServerStatus: state.openworkServerStatus,
+      openworkServerCapabilities: state.openworkServerCapabilities,
+      openworkServerReady,
+      openworkServerWorkspaceReady,
+      resolvedOpenworkCapabilities,
+      openworkServerCanWriteSkills:
+        openworkServerReady &&
+        (resolvedOpenworkCapabilities?.skills?.write ?? false),
+      openworkServerCanWritePlugins:
+        openworkServerReady &&
+        (resolvedOpenworkCapabilities?.plugins?.write ?? false),
+      openworkServerHostInfo: state.openworkServerHostInfo,
+      openworkServerDiagnostics: state.openworkServerDiagnostics,
+      openworkReconnectBusy: state.openworkReconnectBusy,
+      openworkAuditEntries: state.openworkAuditEntries,
+      openworkAuditStatus: state.openworkAuditStatus,
+      openworkAuditError: state.openworkAuditError,
+      devtoolsWorkspaceId: state.devtoolsWorkspaceId,
+    };
+  };
+
+  const mutateState = (updater: (current: MutableState) => MutableState) => {
+    state = updater(state);
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const setStateField = <K extends keyof MutableState>(key: K, value: MutableState[K]) => {
+    if (Object.is(state[key], value)) return;
+    mutateState((current) => ({ ...current, [key]: value }));
+  };
+
+  const setOpenworkServerSettings = (next: SetStateAction<OpenworkServerSettings>) => {
+    const resolved = applyStateAction(state.openworkServerSettings, next);
+    mutateState((current) => ({ ...current, openworkServerSettings: resolved }));
+    queueHealthCheck(0);
+  };
+
+  const updateOpenworkServerSettings = (next: OpenworkServerSettings) => {
+    const stored = writeOpenworkServerSettings(next);
+    mutateState((current) => ({ ...current, openworkServerSettings: stored }));
+    queueHealthCheck(0);
+  };
+
+  const resetOpenworkServerSettings = () => {
+    clearOpenworkServerSettings();
+    mutateState((current) => ({ ...current, openworkServerSettings: {} }));
+    queueHealthCheck(0);
+  };
+
+  const shouldWaitForLocalHostInfo = () =>
+    isDesktopRuntime() &&
+    options.startupPreference() !== "server" &&
+    !state.openworkServerHostInfoReady;
+
+  const shouldRetryStartupCheck = (status: OpenworkServerStatus) =>
+    status !== "connected" &&
+    isDesktopRuntime() &&
+    options.startupPreference() !== "server" &&
+    Date.now() - bootStartedAt < 5_000;
+
+  const checkOpenworkServer = async (url: string, token?: string, hostToken?: string) => {
+    const client = createOpenworkServerClient({ baseUrl: url, token, hostToken });
+    try {
+      await client.health();
+    } catch (error) {
+      const resolved = error as OpenworkServerError | Error;
+      if ("status" in resolved && (resolved.status === 401 || resolved.status === 403)) {
+        return { status: "limited" as OpenworkServerStatus, capabilities: null };
+      }
+      return { status: "disconnected" as OpenworkServerStatus, capabilities: null };
+    }
+
+    if (!token) {
+      return { status: "limited" as OpenworkServerStatus, capabilities: null };
+    }
+
+    try {
+      const capabilities = await client.capabilities();
+      return { status: "connected" as OpenworkServerStatus, capabilities };
+    } catch (error) {
+      const resolved = error as OpenworkServerError | Error;
+      if ("status" in resolved && (resolved.status === 401 || resolved.status === 403)) {
+        return { status: "limited" as OpenworkServerStatus, capabilities: null };
+      }
+      return { status: "disconnected" as OpenworkServerStatus, capabilities: null };
+    }
+  };
+
+  const clearHealthTimeout = () => {
+    if (healthTimeoutId !== null) {
+      window.clearTimeout(healthTimeoutId);
+      healthTimeoutId = null;
+    }
+  };
+
+  const queueHealthCheck = (delayMs: number) => {
+    if (disposed || typeof window === "undefined") return;
+    clearHealthTimeout();
+    healthTimeoutId = window.setTimeout(() => {
+      healthTimeoutId = null;
+      void runHealthCheck();
+    }, Math.max(0, delayMs));
+  };
+
+  const runHealthCheck = async () => {
+    if (disposed || typeof window === "undefined") return;
+    if (!options.documentVisible()) return;
+    if (shouldWaitForLocalHostInfo()) return;
+    if (healthBusy) return;
+
+    const url = getBaseUrl().trim();
+    const auth = getAuth();
+    if (!url) {
+      mutateState((current) => ({
+        ...current,
+        openworkServerStatus: "disconnected",
+        openworkServerCapabilities: null,
+        openworkServerCheckedAt: Date.now(),
+      }));
+      return;
+    }
+
+    healthBusy = true;
+    try {
+      let result = await checkOpenworkServer(url, auth.token, auth.hostToken);
+
+      if (shouldRetryStartupCheck(result.status)) {
+        await new Promise<void>((resolve) => window.setTimeout(resolve, 250));
+        if (disposed) return;
+
+        try {
+          const info = await openworkServerInfo();
+          if (disposed) return;
+
+          mutateState((current) => ({
+            ...current,
+            openworkServerHostInfo: info,
+            openworkServerHostInfoReady: true,
+          }));
+
+          const retryUrl = info.baseUrl?.trim() ?? "";
+          const retryToken = info.clientToken?.trim() || undefined;
+          const retryHostToken = info.hostToken?.trim() || undefined;
+          if (retryUrl) {
+            result = await checkOpenworkServer(retryUrl, retryToken, retryHostToken);
+          }
+        } catch {
+          // Preserve the original check result when the retry probe fails.
+        }
+      }
+
+      if (disposed) return;
+      healthDelayMs =
+        result.status === "connected" || result.status === "limited"
+          ? 10_000
+          : Math.min(healthDelayMs * 2, 60_000);
+
+      mutateState((current) => ({
+        ...current,
+        openworkServerStatus: result.status,
+        openworkServerCapabilities: result.capabilities,
+        openworkServerCheckedAt: Date.now(),
+      }));
+    } catch {
+      healthDelayMs = Math.min(healthDelayMs * 2, 60_000);
+      mutateState((current) => ({
+        ...current,
+        openworkServerCheckedAt: Date.now(),
+      }));
+    } finally {
+      healthBusy = false;
+      if (!disposed) queueHealthCheck(healthDelayMs);
+    }
+  };
+
+  const syncFromOptions = () => {
+    refreshSnapshot();
+    emitChange();
+
+    if (!isDesktopRuntime()) return;
+    const port = state.openworkServerHostInfo?.port;
+    if (!port) return;
+    if (state.openworkServerSettings.portOverride === port) return;
+
+    updateOpenworkServerSettings({
+      ...state.openworkServerSettings,
+      portOverride: port,
+    });
+  };
+
+  const startInterval = (key: string, fn: () => void, ms: number) => {
+    if (typeof window === "undefined") return;
+    if (intervals.has(key)) return;
+    intervals.set(key, window.setInterval(fn, ms));
+  };
+
+  const stopInterval = (key: string) => {
+    const id = intervals.get(key);
+    if (id === undefined) return;
+    window.clearInterval(id);
+    intervals.delete(key);
+  };
+
+  const start = () => {
+    if (typeof window === "undefined") return;
+    if (started) return;
+    // Allow restart after a prior dispose() (React 18 StrictMode double-mounts
+    // each effect in dev: mount → dispose → re-mount). If we early-return when
+    // `disposed` is true, the real mount never arms polling and the UI stays
+    // on stale/empty state forever.
+    disposed = false;
+    started = true;
+
+    syncFromOptions();
+    queueHealthCheck(0);
+
+    const refreshHostInfo = () => {
+      if (!isDesktopRuntime()) return;
+      if (!options.documentVisible()) return;
+      void (async () => {
+        try {
+          const info = await openworkServerInfo();
+          if (disposed) return;
+          mutateState((current) => ({
+            ...current,
+            openworkServerHostInfo: info,
+            openworkServerHostInfoReady: true,
+          }));
+        } catch {
+          if (disposed) return;
+          mutateState((current) => ({
+            ...current,
+            openworkServerHostInfo: null,
+            openworkServerHostInfoReady: true,
+          }));
+        }
+      })();
+    };
+    refreshHostInfo();
+    startInterval("hostInfo", refreshHostInfo, 10_000);
+
+    const refreshDiagnostics = () => {
+      if (!options.documentVisible()) return;
+      if (!options.developerMode()) {
+        setStateField("openworkServerDiagnostics", null);
+        return;
+      }
+
+      const client = getClient();
+      if (!client || state.openworkServerStatus === "disconnected") {
+        setStateField("openworkServerDiagnostics", null);
+        return;
+      }
+
+      void (async () => {
+        try {
+          const status = await client.status();
+          if (!disposed) setStateField("openworkServerDiagnostics", status);
+        } catch {
+          if (!disposed) setStateField("openworkServerDiagnostics", null);
+        }
+      })();
+    };
+    refreshDiagnostics();
+    startInterval("diagnostics", refreshDiagnostics, 10_000);
+
+    const refreshDevtoolsWorkspace = () => {
+      if (!options.documentVisible()) return;
+      if (!options.developerMode()) {
+        setStateField("devtoolsWorkspaceId", null);
+        return;
+      }
+
+      const client = getClient();
+      if (!client) {
+        setStateField("devtoolsWorkspaceId", null);
+        return;
+      }
+
+      void (async () => {
+        try {
+          const response = await client.listWorkspaces();
+          if (disposed) return;
+          const items = Array.isArray(response.items) ? response.items : [];
+          const activeMatch = response.activeId
+            ? items.find((item) => item.id === response.activeId)
+            : null;
+          setStateField("devtoolsWorkspaceId", activeMatch?.id ?? items[0]?.id ?? null);
+        } catch {
+          if (!disposed) setStateField("devtoolsWorkspaceId", null);
+        }
+      })();
+    };
+    refreshDevtoolsWorkspace();
+    startInterval("devtoolsWorkspace", refreshDevtoolsWorkspace, 20_000);
+
+    const refreshAudit = () => {
+      if (!options.documentVisible()) return;
+      if (!options.developerMode()) {
+        mutateState((current) => ({
+          ...current,
+          openworkAuditEntries: [],
+          openworkAuditStatus: "idle",
+          openworkAuditError: null,
+        }));
+        return;
+      }
+
+      const client = getClient();
+      const workspaceId = state.devtoolsWorkspaceId;
+      if (!client || !workspaceId) {
+        mutateState((current) => ({
+          ...current,
+          openworkAuditEntries: [],
+          openworkAuditStatus: "idle",
+          openworkAuditError: null,
+        }));
+        return;
+      }
+
+      mutateState((current) => ({
+        ...current,
+        openworkAuditStatus: "loading",
+        openworkAuditError: null,
+      }));
+
+      void (async () => {
+        try {
+          const result = await client.listAudit(workspaceId, 50);
+          if (disposed) return;
+          mutateState((current) => ({
+            ...current,
+            openworkAuditEntries: Array.isArray(result.items) ? result.items : [],
+            openworkAuditStatus: "idle",
+          }));
+        } catch (error) {
+          if (disposed) return;
+          mutateState((current) => ({
+            ...current,
+            openworkAuditEntries: [],
+            openworkAuditStatus: "error",
+            openworkAuditError:
+              error instanceof Error
+                ? error.message
+                : t("app.error_audit_load"),
+          }));
+        }
+      })();
+    };
+    refreshAudit();
+    startInterval("audit", refreshAudit, 15_000);
+  };
+
+  const dispose = () => {
+    disposed = true;
+    started = false;
+    clearHealthTimeout();
+    for (const key of [...intervals.keys()]) stopInterval(key);
+  };
+
+  const testOpenworkServerConnection = async (next: OpenworkServerSettings) => {
+    const derived = normalizeOpenworkServerUrl(next.urlOverride ?? "");
+    if (!derived) {
+      mutateState((current) => ({
+        ...current,
+        openworkServerStatus: "disconnected",
+        openworkServerCapabilities: null,
+        openworkServerCheckedAt: Date.now(),
+      }));
+      return false;
+    }
+
+    const result = await checkOpenworkServer(derived, next.token);
+    mutateState((current) => ({
+      ...current,
+      openworkServerStatus: result.status,
+      openworkServerCapabilities: result.capabilities,
+      openworkServerCheckedAt: Date.now(),
+    }));
+
+    const ok = result.status === "connected" || result.status === "limited";
+    if (ok && !isDesktopRuntime()) {
+      const active = options.selectedWorkspaceDisplay();
+      const shouldAttach =
+        !options.activeClient() ||
+        active.workspaceType !== "remote" ||
+        active.remoteType !== "openwork";
+      if (shouldAttach) {
+        await options
+          .createRemoteWorkspaceFlow({
+            openworkHostUrl: derived,
+            openworkToken: next.token ?? null,
+          })
+          .catch(() => undefined);
+      }
+    }
+    return ok;
+  };
+
+  const reconnectOpenworkServer = async () => {
+    if (state.openworkReconnectBusy) return false;
+    setStateField("openworkReconnectBusy", true);
+
+    try {
+      let hostInfo = state.openworkServerHostInfo;
+      if (isDesktopRuntime()) {
+        try {
+          hostInfo = await openworkServerInfo();
+          mutateState((current) => ({ ...current, openworkServerHostInfo: hostInfo }));
+        } catch {
+          hostInfo = null;
+          setStateField("openworkServerHostInfo", null);
+        }
+      }
+
+      if (hostInfo?.clientToken?.trim() && options.startupPreference() !== "server") {
+        const liveToken = hostInfo.clientToken.trim();
+        const settings = state.openworkServerSettings;
+        if ((settings.token?.trim() ?? "") !== liveToken) {
+          updateOpenworkServerSettings({ ...settings, token: liveToken });
+        }
+      }
+
+      const url = getBaseUrl().trim();
+      const auth = getAuth();
+      if (!url) {
+        mutateState((current) => ({
+          ...current,
+          openworkServerStatus: "disconnected",
+          openworkServerCapabilities: null,
+          openworkServerCheckedAt: Date.now(),
+        }));
+        return false;
+      }
+
+      const result = await checkOpenworkServer(url, auth.token, auth.hostToken);
+      mutateState((current) => ({
+        ...current,
+        openworkServerStatus: result.status,
+        openworkServerCapabilities: result.capabilities,
+        openworkServerCheckedAt: Date.now(),
+      }));
+      return result.status === "connected" || result.status === "limited";
+    } finally {
+      setStateField("openworkReconnectBusy", false);
+    }
+  };
+
+  async function ensureLocalOpenworkServerClient(): Promise<OpenworkServerClient | null> {
+    let hostInfo = state.openworkServerHostInfo;
+    if (hostInfo?.baseUrl?.trim() && hostInfo.clientToken?.trim()) {
+      const existing = createOpenworkServerClient({
+        baseUrl: hostInfo.baseUrl.trim(),
+        token: hostInfo.clientToken.trim(),
+        hostToken: hostInfo.hostToken?.trim() || undefined,
+      });
+      try {
+        await existing.health();
+        if (options.startupPreference() !== "server") {
+          await reconnectOpenworkServer();
+        }
+        return existing;
+      } catch {
+        // Fall through to a local restart.
+      }
+    }
+
+    if (!isDesktopRuntime()) return null;
+
+    try {
+      hostInfo = await openworkServerRestart({
+        remoteAccessEnabled: state.openworkServerSettings.remoteAccessEnabled === true,
+      });
+      mutateState((current) => ({ ...current, openworkServerHostInfo: hostInfo }));
+    } catch {
+      return null;
+    }
+
+    const baseUrl = hostInfo?.baseUrl?.trim() ?? "";
+    const token = hostInfo?.clientToken?.trim() ?? "";
+    const hostToken = hostInfo?.hostToken?.trim() ?? "";
+    if (!baseUrl || !token) return null;
+
+    if (options.startupPreference() !== "server") {
+      await reconnectOpenworkServer();
+    }
+
+    return createOpenworkServerClient({
+      baseUrl,
+      token,
+      hostToken: hostToken || undefined,
+    });
+  }
+
+  const saveShareRemoteAccess = async (enabled: boolean) => {
+    if (state.shareRemoteAccessBusy) return;
+    const previous = state.openworkServerSettings;
+    const next: OpenworkServerSettings = {
+      ...previous,
+      remoteAccessEnabled: enabled,
+    };
+
+    mutateState((current) => ({
+      ...current,
+      shareRemoteAccessBusy: true,
+      shareRemoteAccessError: null,
+    }));
+    updateOpenworkServerSettings(next);
+
+    try {
+      if (isDesktopRuntime() && options.selectedWorkspaceDisplay().workspaceType === "local") {
+        const restarted = await options.restartLocalServer();
+        if (!restarted) {
+          throw new Error(t("app.error_restart_local_worker"));
+        }
+        await reconnectOpenworkServer();
+      }
+    } catch (error) {
+      updateOpenworkServerSettings(previous);
+      mutateState((current) => ({
+        ...current,
+        shareRemoteAccessError:
+          error instanceof Error
+            ? error.message
+            : t("app.error_remote_access"),
+      }));
+      return;
+    } finally {
+      setStateField("shareRemoteAccessBusy", false);
+    }
+  };
+
+  refreshSnapshot();
+
+  const subscribe = (listener: () => void) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+
+  const getSnapshot = () => snapshot;
+
+  return {
+    subscribe,
+    getSnapshot,
+    start,
+    dispose,
+    syncFromOptions,
+    setOpenworkServerSettings,
+    updateOpenworkServerSettings,
+    resetOpenworkServerSettings,
+    saveShareRemoteAccess,
+    checkOpenworkServer,
+    testOpenworkServerConnection,
+    reconnectOpenworkServer,
+    ensureLocalOpenworkServerClient,
+  };
+}
+
+export function useOpenworkServerStoreSnapshot(store: OpenworkServerStore) {
+  return useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+}
diff --git a/apps/app/src/react-app/domains/connections/provider-auth/index.ts b/apps/app/src/react-app/domains/connections/provider-auth/index.ts
new file mode 100644
index 0000000000..34e2274534
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/provider-auth/index.ts
@@ -0,0 +1,44 @@
+import {
+  createContext,
+  createElement,
+  useContext,
+  useSyncExternalStore,
+  type ReactNode,
+} from "react";
+
+import type { ProviderAuthStore } from "./store";
+
+export { createProviderAuthStore, useProviderAuthStoreSnapshot } from "./store";
+export type {
+  ProviderAuthMethod,
+  ProviderAuthProvider,
+  ProviderAuthStoreSnapshot,
+  ProviderOAuthStartResult,
+  ProviderAuthStore,
+} from "./store";
+export { default as ProviderAuthModal } from "./provider-auth-modal";
+
+const ProviderAuthContext = createContext<ProviderAuthStore | null>(null);
+
+type ProviderAuthStoreProviderProps = {
+  store: ProviderAuthStore;
+  children: ReactNode;
+};
+
+export function ProviderAuthStoreProvider({
+  store,
+  children,
+}: ProviderAuthStoreProviderProps) {
+  return createElement(ProviderAuthContext.Provider, { value: store }, children);
+}
+
+export function useProviderAuth() {
+  const store = useContext(ProviderAuthContext);
+  if (!store) {
+    throw new Error("useProviderAuth must be used within a ProviderAuthStoreProvider");
+  }
+
+  useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+
+  return store;
+}
diff --git a/apps/app/src/react-app/domains/connections/provider-auth/provider-auth-modal.tsx b/apps/app/src/react-app/domains/connections/provider-auth/provider-auth-modal.tsx
new file mode 100644
index 0000000000..16d137ef38
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/provider-auth/provider-auth-modal.tsx
@@ -0,0 +1,1010 @@
+/** @jsxImportSource react */
+import {
+  CheckCircle2,
+  ChevronRight,
+  Loader2,
+  Search,
+  X,
+} from "lucide-react";
+import {
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type KeyboardEvent,
+} from "react";
+
+import { openDesktopUrl } from "../../../../app/lib/desktop";
+import { isDesktopRuntime } from "../../../../app/utils";
+import { compareProviders } from "../../../../app/utils/providers";
+import { Button } from "../../../design-system/button";
+import { ProviderIcon } from "../../../design-system/provider-icon";
+import { TextInput } from "../../../design-system/text-input";
+import type {
+  ProviderAuthMethod,
+  ProviderAuthProvider,
+  ProviderOAuthStartResult,
+} from "./store";
+
+type ProviderAuthEntry = {
+  id: string;
+  name: string;
+  methods: ProviderAuthMethod[];
+  connected: boolean;
+  env: string[];
+};
+
+type ProviderOAuthSession = ProviderOAuthStartResult & {
+  providerId: string;
+  methodLabel: string;
+};
+
+const PROVIDER_LABELS: Record<string, string> = {
+  opencode: "OpenCode",
+  openai: "OpenAI",
+  anthropic: "Anthropic",
+  google: "Google",
+  openrouter: "OpenRouter",
+};
+
+export type ProviderAuthModalProps = {
+  open: boolean;
+  loading: boolean;
+  submitting: boolean;
+  error: string | null;
+  preferredProviderId?: string | null;
+  workerType?: "local" | "remote";
+  providers: ProviderAuthProvider[];
+  connectedProviderIds: string[];
+  authMethods: Record<string, ProviderAuthMethod[]>;
+  onSelect: (providerId: string, methodIndex?: number) => Promise<ProviderOAuthStartResult>;
+  onSubmitApiKey: (providerId: string, apiKey: string) => Promise<string | void>;
+  onConnectCloudProvider: (cloudProviderId: string) => Promise<string | void>;
+  onSubmitOAuth: (
+    providerId: string,
+    methodIndex: number,
+    code?: string,
+  ) => Promise<{ connected: boolean; pending?: boolean; message?: string }>;
+  onRefreshProviders?: () => Promise<unknown>;
+  onClose: () => void;
+};
+
+export default function ProviderAuthModal(props: ProviderAuthModalProps) {
+  const workerType = props.workerType === "remote" ? "remote" : "local";
+  const isRemoteWorker = workerType === "remote";
+
+  const [view, setView] = useState<
+    "list" | "method" | "api" | "cloud" | "oauth-code" | "oauth-auto"
+  >("list");
+  const [selectedProviderId, setSelectedProviderId] = useState<string | null>(null);
+  const [selectedCloudMethod, setSelectedCloudMethod] = useState<ProviderAuthMethod | null>(null);
+  const [apiKeyInput, setApiKeyInput] = useState("");
+  const [oauthCodeInput, setOauthCodeInput] = useState("");
+  const [oauthSession, setOauthSession] = useState<ProviderOAuthSession | null>(null);
+  const [searchQuery, setSearchQuery] = useState("");
+  const [activeEntryIndex, setActiveEntryIndex] = useState(0);
+  const [localError, setLocalError] = useState<string | null>(null);
+  const [pollingBusy, setPollingBusy] = useState(false);
+  const [oauthAutoBusy, setOauthAutoBusy] = useState(false);
+  const [oauthCodeCopied, setOauthCodeCopied] = useState(false);
+  const [oauthBrowserOpened, setOauthBrowserOpened] = useState(false);
+  const [autoOpenedPreferredProviderId, setAutoOpenedPreferredProviderId] = useState<string | null>(null);
+
+  const searchInputRef = useRef<HTMLInputElement | null>(null);
+  const providerPollRef = useRef<number | null>(null);
+  const oauthAutoPollRef = useRef<number | null>(null);
+  const oauthCodeCopiedResetRef = useRef<number | null>(null);
+
+  const formatProviderName = (id: string, fallback?: string) => {
+    const named = fallback?.trim();
+    if (named) return named;
+
+    const normalized = id.trim();
+    const mapped = PROVIDER_LABELS[normalized.toLowerCase()];
+    if (mapped) return mapped;
+
+    const cleaned = normalized.replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
+    if (!cleaned) return id;
+
+    return cleaned
+      .split(" ")
+      .filter(Boolean)
+      .map((word) => {
+        if (/\d/.test(word) || word.length <= 3) {
+          return word.toUpperCase();
+        }
+        const lower = word.toLowerCase();
+        return lower.charAt(0).toUpperCase() + lower.slice(1);
+      })
+      .join(" ");
+  };
+
+  const isOpenAiHeadlessMethod = (method: ProviderAuthMethod) => {
+    const label = method.label.toLowerCase();
+    return method.type === "oauth" && (label.includes("headless") || label.includes("device"));
+  };
+
+  const isOpenAiProvider = (id: string, fallbackName?: string) => {
+    const normalizedId = id.trim().toLowerCase();
+    const normalizedName = fallbackName?.trim().toLowerCase() ?? "";
+    return normalizedId === "openai" || normalizedName === "openai";
+  };
+
+  const isAnthropicProvider = (id: string, fallbackName?: string) => {
+    const normalizedId = id.trim().toLowerCase();
+    const normalizedName = fallbackName?.trim().toLowerCase() ?? "";
+    return normalizedId === "anthropic" || normalizedName === "anthropic";
+  };
+
+  const isClaudeProMaxMethod = (method: ProviderAuthMethod) => {
+    const label = method.label.toLowerCase();
+    return method.type === "oauth" && (label.includes("pro/max") || label.includes("create an api key"));
+  };
+
+  const entries = useMemo<ProviderAuthEntry[]>(() => {
+    const methods = props.authMethods ?? {};
+    const connected = new Set(props.connectedProviderIds ?? []);
+    const providers = props.providers ?? [];
+
+    return Object.keys(methods)
+      .map((id): ProviderAuthEntry => {
+        const provider = providers.find((item) => item.id === id);
+        const entryMethods = (methods[id] ?? []).filter((method) => {
+          if (isAnthropicProvider(id, provider?.name) && isClaudeProMaxMethod(method)) {
+            return false;
+          }
+          if (!isOpenAiProvider(id, provider?.name)) return true;
+          if (method.type !== "oauth") return true;
+          if (isRemoteWorker) return isOpenAiHeadlessMethod(method);
+          return !isOpenAiHeadlessMethod(method);
+        });
+        return {
+          id,
+          name: formatProviderName(id, provider?.name),
+          methods: entryMethods,
+          connected: connected.has(id),
+          env: Array.isArray(provider?.env) ? provider.env : [],
+        };
+      })
+      .filter((entry) => entry.methods.length > 0)
+      .sort(compareProviders);
+  }, [isRemoteWorker, props.authMethods, props.connectedProviderIds, props.providers]);
+
+  const selectedEntry = useMemo(
+    () => entries.find((entry) => entry.id === selectedProviderId) ?? null,
+    [entries, selectedProviderId],
+  );
+
+  const resolvedView = selectedEntry ? view : "list";
+  const errorMessage = localError ?? props.error;
+
+  const filteredEntries = useMemo(() => {
+    const query = searchQuery.trim().toLowerCase();
+    if (!query) return entries;
+    return entries.filter((entry) => {
+      const methodText = entry.methods.map((method) => method.label || (method.type === "oauth" ? "OAuth" : "API key")).join(" ");
+      return `${entry.name} ${entry.id} ${methodText}`.toLowerCase().includes(query);
+    });
+  }, [entries, searchQuery]);
+
+  const oauthInstructions = oauthSession?.authorization.instructions?.trim() ?? "";
+  const isOpenAiHeadlessSession = Boolean(
+    oauthSession && oauthSession.providerId === "openai" && oauthSession.methodLabel.toLowerCase().includes("headless"),
+  );
+  const shouldStartOauthAutoPolling =
+    props.open &&
+    resolvedView === "oauth-auto" &&
+    oauthSession &&
+    (!isOpenAiHeadlessSession || oauthBrowserOpened);
+
+  const oauthDisplayCode = useMemo(() => {
+    if (!oauthInstructions) return "";
+    const matched = oauthInstructions.match(/[A-Z0-9]{4}-[A-Z0-9]{4,5}/)?.[0];
+    if (matched) return matched;
+    if (oauthInstructions.includes(":")) {
+      return oauthInstructions.split(":").slice(1).join(":").trim();
+    }
+    return oauthInstructions;
+  }, [oauthInstructions]);
+
+  const methodLabel = (method: ProviderAuthMethod) =>
+    method.label || (method.type === "oauth" ? "OAuth" : "API key");
+
+  const actionDisabled = props.loading || props.submitting;
+
+  const resetState = () => {
+    if (oauthCodeCopiedResetRef.current !== null && typeof window !== "undefined") {
+      window.clearTimeout(oauthCodeCopiedResetRef.current);
+      oauthCodeCopiedResetRef.current = null;
+    }
+    setView("list");
+    setSelectedProviderId(null);
+    setSelectedCloudMethod(null);
+    setApiKeyInput("");
+    setOauthCodeInput("");
+    setOauthSession(null);
+    setSearchQuery("");
+    setActiveEntryIndex(0);
+    setLocalError(null);
+    setOauthCodeCopied(false);
+    setOauthBrowserOpened(false);
+  };
+
+  const stopProviderPolling = () => {
+    if (providerPollRef.current !== null) {
+      window.clearInterval(providerPollRef.current);
+      providerPollRef.current = null;
+    }
+  };
+
+  const stopOauthAutoPolling = () => {
+    if (oauthAutoPollRef.current !== null) {
+      window.clearInterval(oauthAutoPollRef.current);
+      oauthAutoPollRef.current = null;
+    }
+  };
+
+  const handleClose = () => {
+    void props.onRefreshProviders?.();
+    stopOauthAutoPolling();
+    stopProviderPolling();
+    resetState();
+    props.onClose();
+  };
+
+  useEffect(() => {
+    if (!props.open) {
+      setAutoOpenedPreferredProviderId(null);
+      resetState();
+    }
+  }, [props.open]);
+
+  useEffect(() => {
+    if (!props.open || resolvedView !== "list") return;
+    const total = filteredEntries.length;
+    if (total <= 0) {
+      setActiveEntryIndex(0);
+      return;
+    }
+    setActiveEntryIndex((current) => Math.max(0, Math.min(current, total - 1)));
+  }, [filteredEntries.length, props.open, resolvedView]);
+
+  useEffect(() => {
+    if (!props.open || resolvedView !== "list") return;
+    queueMicrotask(() => searchInputRef.current?.focus());
+  }, [props.open, resolvedView]);
+
+  useEffect(() => {
+    if (!props.open || props.loading || resolvedView !== "list") return;
+
+    const preferredId = props.preferredProviderId?.trim().toLowerCase() ?? "";
+    if (!preferredId || autoOpenedPreferredProviderId === preferredId) return;
+
+    const entry = entries.find((item) => item.id.trim().toLowerCase() === preferredId);
+    if (!entry) return;
+
+    setAutoOpenedPreferredProviderId(preferredId);
+    queueMicrotask(() => {
+      handleEntrySelect(entry);
+    });
+  }, [
+    autoOpenedPreferredProviderId,
+    entries,
+    props.loading,
+    props.open,
+    props.preferredProviderId,
+    resolvedView,
+  ]);
+
+  useEffect(() => {
+    return () => {
+      stopOauthAutoPolling();
+      stopProviderPolling();
+      if (oauthCodeCopiedResetRef.current !== null) {
+        window.clearTimeout(oauthCodeCopiedResetRef.current);
+        oauthCodeCopiedResetRef.current = null;
+      }
+    };
+  }, []);
+
+  const isOauthView = resolvedView === "oauth-code" || resolvedView === "oauth-auto";
+  const activeProviderId = oauthSession?.providerId ?? selectedProviderId;
+  const isActiveProviderConnected =
+    !!activeProviderId && (props.connectedProviderIds ?? []).includes(activeProviderId);
+
+  const pollProviders = async () => {
+    const id = activeProviderId;
+    if (!id || pollingBusy) return;
+    setPollingBusy(true);
+    try {
+      await props.onRefreshProviders?.();
+    } finally {
+      setPollingBusy(false);
+    }
+    if ((props.connectedProviderIds ?? []).includes(id)) {
+      handleClose();
+    }
+  };
+
+  const startProviderPolling = () => {
+    if (typeof window === "undefined") return;
+    if (providerPollRef.current !== null) return;
+    void pollProviders();
+    providerPollRef.current = window.setInterval(() => {
+      void pollProviders();
+    }, 2000);
+  };
+
+  useEffect(() => {
+    if (!props.open || !isOauthView) {
+      stopProviderPolling();
+      return;
+    }
+    if (isActiveProviderConnected) {
+      handleClose();
+      return;
+    }
+    startProviderPolling();
+  }, [isActiveProviderConnected, isOauthView, props.open]);
+
+  const openOauthUrl = async (url: string) => {
+    if (!url) return;
+    if (isDesktopRuntime()) {
+      await openDesktopUrl(url);
+      setOauthBrowserOpened(true);
+      return;
+    }
+    window.open(url, "_blank", "noopener,noreferrer");
+    setOauthBrowserOpened(true);
+  };
+
+  const copyOauthDisplayCode = async () => {
+    const code = oauthDisplayCode.trim();
+    if (!code) return;
+    if (typeof navigator === "undefined" || !navigator.clipboard?.writeText) {
+      setLocalError("Clipboard is unavailable in this environment.");
+      return;
+    }
+    await navigator.clipboard.writeText(code);
+    setOauthCodeCopied(true);
+    if (typeof window === "undefined") return;
+    if (oauthCodeCopiedResetRef.current !== null) {
+      window.clearTimeout(oauthCodeCopiedResetRef.current);
+    }
+    oauthCodeCopiedResetRef.current = window.setTimeout(() => {
+      setOauthCodeCopied(false);
+      oauthCodeCopiedResetRef.current = null;
+    }, 2000);
+  };
+
+  const submitOauth = async (providerId: string, methodIndex: number, code?: string) => {
+    const trimmedCode = code?.trim();
+    setLocalError(null);
+    try {
+      return await props.onSubmitOAuth(providerId, methodIndex, trimmedCode || undefined);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to complete OAuth";
+      setLocalError(message);
+      throw error instanceof Error ? error : new Error(message);
+    }
+  };
+
+  const attemptOauthAutoCompletion = async () => {
+    const session = oauthSession;
+    if (!session || oauthAutoBusy) return;
+    setOauthAutoBusy(true);
+    try {
+      const result = await submitOauth(session.providerId, session.methodIndex);
+      if (result?.connected) {
+        stopOauthAutoPolling();
+      }
+    } finally {
+      setOauthAutoBusy(false);
+    }
+  };
+
+  const startOauthAutoPolling = () => {
+    if (typeof window === "undefined") return;
+    if (oauthAutoPollRef.current !== null) return;
+    void attemptOauthAutoCompletion();
+    oauthAutoPollRef.current = window.setInterval(() => {
+      void attemptOauthAutoCompletion();
+    }, 2000);
+  };
+
+  useEffect(() => {
+    if (!shouldStartOauthAutoPolling) {
+      stopOauthAutoPolling();
+      return;
+    }
+    startOauthAutoPolling();
+  }, [shouldStartOauthAutoPolling]);
+
+  const startOauth = async (entry: ProviderAuthEntry, methodIndex?: number) => {
+    if (actionDisabled) return;
+    if (!Number.isInteger(methodIndex) || methodIndex === undefined) {
+      setLocalError(`No OAuth flow available for ${entry.name}.`);
+      return;
+    }
+    setLocalError(null);
+    setOauthCodeInput("");
+    setOauthSession(null);
+    setOauthCodeCopied(false);
+    setOauthBrowserOpened(false);
+    try {
+      const started = await props.onSelect(entry.id, methodIndex);
+      const selectedMethod = entry.methods.find((method) => method.methodIndex === methodIndex);
+      if (!selectedMethod) {
+        throw new Error(`Selected auth method is unavailable for ${entry.name}.`);
+      }
+      const nextSession: ProviderOAuthSession = {
+        providerId: entry.id,
+        methodIndex: started.methodIndex,
+        methodLabel: selectedMethod.label,
+        authorization: started.authorization,
+      };
+      setOauthSession(nextSession);
+
+      if (started.authorization.method === "code") {
+        await openOauthUrl(started.authorization.url);
+        setView("oauth-code");
+        return;
+      }
+
+      if (!isOpenAiHeadlessMethod(selectedMethod)) {
+        await openOauthUrl(started.authorization.url);
+      }
+
+      setView("oauth-auto");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to start OAuth";
+      setLocalError(message);
+    }
+  };
+
+  const handleMethodSelect = async (method: ProviderAuthMethod) => {
+    if (!selectedEntry || actionDisabled) return;
+    setLocalError(null);
+    setSelectedCloudMethod(null);
+
+    if (method.type === "oauth") {
+      await startOauth(selectedEntry, method.methodIndex);
+      return;
+    }
+
+    if (method.type === "cloud") {
+      setSelectedCloudMethod(method);
+      setView("cloud");
+      return;
+    }
+
+    setView("api");
+  };
+
+  const handleEntrySelect = (entry: ProviderAuthEntry) => {
+    if (actionDisabled) return;
+    setLocalError(null);
+    setSelectedProviderId(entry.id);
+
+    if (entry.methods.length === 1) {
+      void handleMethodSelect(entry.methods[0]);
+      return;
+    }
+
+    if (entry.methods.length > 1) {
+      setView("method");
+      return;
+    }
+
+    setLocalError(`No authentication methods available for ${entry.name}.`);
+  };
+
+  const handleApiSubmit = async () => {
+    if (!selectedEntry || actionDisabled) return;
+
+    const trimmed = apiKeyInput.trim();
+    if (!trimmed) {
+      setLocalError("API key is required.");
+      return;
+    }
+
+    setLocalError(null);
+    try {
+      await props.onSubmitApiKey(selectedEntry.id, trimmed);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to save API key";
+      setLocalError(message);
+    }
+  };
+
+  const handleCloudSubmit = async () => {
+    if (!selectedCloudMethod?.cloudProviderId || actionDisabled) return;
+
+    setLocalError(null);
+    try {
+      await props.onConnectCloudProvider(selectedCloudMethod.cloudProviderId);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to connect organization provider";
+      setLocalError(message);
+    }
+  };
+
+  const handleOauthCodeSubmit = async () => {
+    if (!selectedEntry || !oauthSession || actionDisabled) return;
+
+    const trimmed = oauthCodeInput.trim();
+    if (!trimmed) {
+      setLocalError("Authorization code is required.");
+      return;
+    }
+
+    await submitOauth(selectedEntry.id, oauthSession.methodIndex, trimmed);
+  };
+
+  const handleBack = () => {
+    if (resolvedView === "oauth-code" || resolvedView === "oauth-auto") {
+      if ((selectedEntry?.methods.length ?? 0) > 1) {
+        setView("method");
+      } else {
+        setView("list");
+      }
+      setOauthSession(null);
+      setOauthCodeInput("");
+      setOauthCodeCopied(false);
+      setOauthBrowserOpened(false);
+      setLocalError(null);
+      return;
+    }
+
+    if (resolvedView === "api" && (selectedEntry?.methods.length ?? 0) > 1) {
+      setView("method");
+      setSelectedCloudMethod(null);
+      setApiKeyInput("");
+      setLocalError(null);
+      return;
+    }
+    if (resolvedView === "cloud" && (selectedEntry?.methods.length ?? 0) > 1) {
+      setView("method");
+      setSelectedCloudMethod(null);
+      setLocalError(null);
+      return;
+    }
+    resetState();
+  };
+
+  const submittingLabel = () => {
+    if (!props.submitting) return null;
+    if (resolvedView === "api") return "Saving API key...";
+    if (resolvedView === "cloud") return "Connecting organization provider...";
+    if (resolvedView === "oauth-code") return "Verifying authorization code...";
+    if (resolvedView === "oauth-auto") return "Waiting for OAuth confirmation...";
+    return "Opening authentication...";
+  };
+
+  const stepEntryIndex = (delta: number) => {
+    const total = filteredEntries.length;
+    if (total <= 0) {
+      setActiveEntryIndex(0);
+      return;
+    }
+    setActiveEntryIndex((current) => {
+      const normalized = ((current % total) + total) % total;
+      return (normalized + delta + total) % total;
+    });
+  };
+
+  const handleListKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    if (resolvedView !== "list") return;
+    if (event.key === "ArrowDown") {
+      event.preventDefault();
+      stepEntryIndex(1);
+      return;
+    }
+    if (event.key === "ArrowUp") {
+      event.preventDefault();
+      stepEntryIndex(-1);
+      return;
+    }
+    if (event.key === "Enter") {
+      const nativeEvent = event.nativeEvent as globalThis.KeyboardEvent & { keyCode?: number };
+      if (nativeEvent.isComposing || nativeEvent.keyCode === 229) {
+        return;
+      }
+      const entry = filteredEntries[activeEntryIndex];
+      if (!entry) return;
+      event.preventDefault();
+      handleEntrySelect(entry);
+      return;
+    }
+    if (event.key === "Escape") {
+      event.preventDefault();
+      handleClose();
+    }
+  };
+
+  const methodDescription = (entry: ProviderAuthEntry, method: ProviderAuthMethod) => {
+    const label = methodLabel(method).toLowerCase();
+    if (isOpenAiProvider(entry.id, entry.name) && (label.includes("headless") || label.includes("device"))) {
+      return isRemoteWorker
+        ? "Use OpenAI's device flow for remote workers, where the browser callback may not resolve on your local machine."
+        : "Use OpenAI's device flow when the local browser callback is unreliable.";
+    }
+    if (method.type === "oauth") {
+      return "Continue in the browser and let OpenWork finish the connection automatically.";
+    }
+    if (method.type === "cloud") {
+      return method.description ?? "Use the provider and credential managed by your organization.";
+    }
+    return "Paste a secret key that OpenWork stores locally on this device.";
+  };
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-start justify-center p-4 overflow-y-auto">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-lg rounded-2xl shadow-2xl overflow-hidden max-h-[calc(100vh-2rem)] flex flex-col">
+        <div className="px-6 pt-6 pb-4 border-b border-gray-6/50 flex items-start justify-between gap-4">
+          <div>
+            <h3 className="text-lg font-semibold text-gray-12">Connect providers</h3>
+            <p className="text-sm text-gray-11 mt-1">
+              Sign in to services or use providers managed by your organization.
+            </p>
+          </div>
+          <Button variant="ghost" className="!p-2 rounded-full" onClick={handleClose} aria-label="Close">
+            <X size={16} />
+          </Button>
+        </div>
+
+        <div className="px-6 py-4 flex flex-col gap-4 min-h-0">
+          <div className="min-h-[36px]">
+            {errorMessage ? (
+              <div className="rounded-xl border border-red-7/30 bg-red-1/40 px-3 py-2 text-xs text-red-11">
+                {errorMessage}
+              </div>
+            ) : props.loading ? (
+              <div className="rounded-xl border border-gray-6 bg-gray-1/60 px-4 py-3 text-sm text-gray-10 animate-pulse">
+                Loading providers...
+              </div>
+            ) : null}
+          </div>
+
+          {!props.loading ? (
+            <div className="flex-1 space-y-2 overflow-y-auto pr-1 -mr-1">
+              {resolvedView === "list" ? (
+                <div className="space-y-3" onKeyDown={handleListKeyDown}>
+                  <div className="relative flex items-center mb-1">
+                    <Search size={16} className="absolute left-3 text-gray-9" />
+                    <input
+                      ref={searchInputRef}
+                      type="text"
+                      placeholder="Filter providers by name or ID"
+                      value={searchQuery}
+                      onChange={(event) => {
+                        setSearchQuery(event.currentTarget.value);
+                        setActiveEntryIndex(0);
+                      }}
+                      autoComplete="off"
+                      autoCapitalize="off"
+                      spellCheck={false}
+                      disabled={actionDisabled}
+                      className="w-full rounded-xl bg-gray-2 px-9 py-2.5 text-[13px] text-gray-12 placeholder:text-gray-9 border border-gray-6/60 focus:border-gray-8 focus:bg-gray-1 focus:outline-none transition-colors shadow-sm"
+                    />
+                  </div>
+
+                  {filteredEntries.length ? (
+                    filteredEntries.map((entry, index) => (
+                      <button
+                        key={entry.id}
+                        type="button"
+                        className={`w-full group flex items-start gap-3.5 rounded-xl px-3.5 py-3 text-left transition-all duration-200 disabled:opacity-60 disabled:cursor-not-allowed ${
+                          index === activeEntryIndex ? "bg-gray-3/60" : "hover:bg-gray-3/30"
+                        }`}
+                        disabled={actionDisabled}
+                        onMouseEnter={() => setActiveEntryIndex(index)}
+                        onClick={() => handleEntrySelect(entry)}
+                      >
+                        <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full border border-gray-5/60 bg-gray-2 shadow-sm overflow-hidden">
+                          <ProviderIcon providerId={entry.id} size={18} className="text-gray-12" />
+                        </div>
+
+                        <div className="flex-1 min-w-0">
+                          <div className="flex items-center justify-between gap-3">
+                            <div className="min-w-0 flex items-center gap-2">
+                              <div className="text-[14px] font-medium text-gray-12 truncate tracking-tight">
+                                {entry.name}
+                              </div>
+                            </div>
+                            <div className="flex items-center justify-end shrink-0">
+                              {entry.connected ? (
+                                <div className="flex items-center gap-1 text-[11px] font-medium text-green-11 bg-green-4/20 border border-green-5/30 px-1.5 py-0.5 rounded-md">
+                                  <CheckCircle2 size={12} strokeWidth={2.5} />
+                                  Connected
+                                </div>
+                              ) : (
+                                <div className="text-[12px] font-medium text-gray-9 group-hover:text-gray-12 transition-colors flex items-center gap-0.5 opacity-80 group-hover:opacity-100">
+                                  Connect
+                                  <ChevronRight size={14} className="opacity-0 -ml-2 group-hover:opacity-100 group-hover:ml-0 transition-all duration-200" />
+                                </div>
+                              )}
+                            </div>
+                          </div>
+                          <div className="text-[11px] text-gray-9 font-mono truncate mt-0.5 opacity-60 group-hover:opacity-80 transition-opacity">
+                            {entry.id}
+                          </div>
+
+                          <div className="mt-2 flex flex-wrap gap-1.5">
+                            {entry.methods.map((method) => (
+                              <span
+                                key={`${entry.id}-${method.type}-${method.methodIndex ?? method.cloudProviderId ?? method.label}`}
+                                className={`text-[10px] font-medium px-2 py-0.5 rounded-md border ${
+                                  method.type === "oauth"
+                                    ? "bg-indigo-3/30 text-indigo-11 border-indigo-5/30"
+                                    : method.type === "cloud"
+                                      ? "bg-emerald-3/30 text-emerald-11 border-emerald-5/30"
+                                      : "bg-gray-3/40 text-gray-11 border-gray-6/40"
+                                }`}
+                              >
+                                {methodLabel(method)}
+                              </span>
+                            ))}
+                          </div>
+                        </div>
+                      </button>
+                    ))
+                  ) : (
+                    <div className="text-sm text-gray-10 pt-2">
+                      {entries.length ? "No providers match your search." : "No providers available."}
+                    </div>
+                  )}
+
+                  <div className="text-[11px] text-gray-9">Arrow keys to navigate, Enter to select.</div>
+                </div>
+              ) : null}
+
+              {resolvedView === "method" && selectedEntry ? (
+                <div className="rounded-xl border border-gray-6/40 bg-gray-2/50 shadow-sm p-5 space-y-4">
+                  <div className="flex items-center justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12">{selectedEntry.name}</div>
+                      <div className="text-xs text-gray-10 mt-1">Choose how you'd like to connect.</div>
+                    </div>
+                    <Button variant="ghost" onClick={handleBack} disabled={actionDisabled}>
+                      Back
+                    </Button>
+                  </div>
+                  <div className="grid gap-2">
+                    {selectedEntry.methods.map((method) => (
+                      <button
+                        key={`${selectedEntry.id}-${method.type}-${method.methodIndex ?? method.cloudProviderId ?? method.label}`}
+                        type="button"
+                        className={`w-full rounded-xl border px-4 py-3.5 text-left transition-all duration-200 disabled:opacity-60 disabled:cursor-not-allowed ${
+                          method.type === "oauth"
+                            ? "border-indigo-5/40 bg-indigo-3/20 hover:bg-indigo-4/30 shadow-sm"
+                            : "border-gray-5/50 bg-gray-2 hover:bg-gray-3/50 shadow-sm"
+                        }`}
+                        onClick={() => void handleMethodSelect(method)}
+                        disabled={actionDisabled}
+                      >
+                        <div className="text-sm font-medium text-gray-12">{methodLabel(method)}</div>
+                        <div className="mt-1 text-xs text-gray-10">{methodDescription(selectedEntry, method)}</div>
+                      </button>
+                    ))}
+                  </div>
+                </div>
+              ) : null}
+
+              {resolvedView === "api" && selectedEntry ? (
+                <div className="rounded-xl border border-gray-6/40 bg-gray-2/50 shadow-sm p-5 space-y-4">
+                  <div className="flex items-center justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12">{selectedEntry.name}</div>
+                      <div className="text-xs text-gray-10 mt-1">Paste your API key to connect.</div>
+                    </div>
+                    <Button variant="ghost" onClick={handleBack} disabled={actionDisabled}>
+                      Back
+                    </Button>
+                  </div>
+                  <TextInput
+                    label="API key"
+                    type="password"
+                    placeholder="sk-..."
+                    value={apiKeyInput}
+                    onChange={(event) => {
+                      setApiKeyInput(event.currentTarget.value);
+                      if (localError) setLocalError(null);
+                    }}
+                    autoComplete="off"
+                    autoCapitalize="off"
+                    spellCheck={false}
+                    disabled={actionDisabled}
+                  />
+                  {selectedEntry.env.length > 0 ? (
+                    <div className="text-[11px] text-gray-9">
+                      Env vars: <span className="font-mono">{selectedEntry.env.join(", ")}</span>
+                    </div>
+                  ) : null}
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="text-[11px] text-gray-9">Keys are stored locally by OpenCode.</div>
+                    <Button
+                      variant="secondary"
+                      onClick={handleApiSubmit}
+                      disabled={actionDisabled || !apiKeyInput.trim()}
+                    >
+                      {props.submitting ? "Saving..." : "Save key"}
+                    </Button>
+                  </div>
+                </div>
+              ) : null}
+
+              {resolvedView === "cloud" && selectedEntry && selectedCloudMethod ? (
+                <div className="rounded-xl border border-gray-6/40 bg-gray-2/50 shadow-sm p-5 space-y-4">
+                  <div className="flex items-center justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12">{selectedEntry.name}</div>
+                      <div className="text-xs text-gray-10 mt-1">Connect with the provider managed by your organization.</div>
+                    </div>
+                    <Button variant="ghost" onClick={handleBack} disabled={actionDisabled}>
+                      Back
+                    </Button>
+                  </div>
+                  <div className="text-xs text-gray-9">
+                    {selectedCloudMethod.description ?? "Use the provider and credential managed by your organization."}
+                  </div>
+                  {(selectedCloudMethod.modelCount ?? 0) > 0 ? (
+                    <div className="rounded-lg border border-gray-6/60 bg-gray-1/60 px-3 py-2 text-[11px] text-gray-9">
+                      {(selectedCloudMethod.modelCount ?? 0)} curated model{(selectedCloudMethod.modelCount ?? 0) === 1 ? "" : "s"} will be added to this workspace.
+                    </div>
+                  ) : null}
+                  {(selectedCloudMethod.env?.length ?? 0) > 0 ? (
+                    <div className="text-[11px] text-gray-9">
+                      Env vars: <span className="font-mono">{selectedCloudMethod.env?.join(", ")}</span>
+                    </div>
+                  ) : null}
+                  <div className="flex items-center justify-between gap-3">
+                    <div className="text-[11px] text-gray-9">
+                      OpenWork will install the provider config and use the credential stored for your org.
+                    </div>
+                    <Button variant="secondary" onClick={handleCloudSubmit} disabled={actionDisabled}>
+                      {props.submitting ? "Connecting..." : "Connect provider"}
+                    </Button>
+                  </div>
+                </div>
+              ) : null}
+
+              {resolvedView === "oauth-code" && selectedEntry && oauthSession ? (
+                <div className="rounded-xl border border-gray-6/40 bg-gray-2/50 shadow-sm p-5 space-y-4">
+                  <div className="flex items-center justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12">{selectedEntry.name}</div>
+                      <div className="text-xs text-gray-10 mt-1">Finish OAuth by pasting the authorization code.</div>
+                    </div>
+                    <Button variant="ghost" onClick={handleBack} disabled={actionDisabled}>
+                      Back
+                    </Button>
+                  </div>
+                  <div className="text-xs text-gray-9">
+                    Complete sign-in in your browser, then paste the code here.
+                  </div>
+                  {oauthInstructions ? (
+                    <div className="rounded-lg border border-gray-6/60 bg-gray-1/60 px-3 py-2 text-[11px] text-gray-9 font-mono break-all">
+                      {oauthInstructions}
+                    </div>
+                  ) : null}
+                  <TextInput
+                    label="Authorization code"
+                    type="text"
+                    placeholder="Paste code"
+                    value={oauthCodeInput}
+                    onChange={(event) => {
+                      setOauthCodeInput(event.currentTarget.value);
+                      if (localError) setLocalError(null);
+                    }}
+                    onKeyDown={(event) => {
+                      if (event.key !== "Enter") return;
+                      event.preventDefault();
+                      void handleOauthCodeSubmit();
+                    }}
+                    autoComplete="off"
+                    autoCapitalize="off"
+                    spellCheck={false}
+                    disabled={actionDisabled}
+                  />
+                  <div className="flex items-center justify-between gap-3">
+                    <Button
+                      variant="outline"
+                      onClick={() => {
+                        void openOauthUrl(oauthSession.authorization.url ?? "");
+                      }}
+                    >
+                      Open browser again
+                    </Button>
+                    <Button
+                      variant="secondary"
+                      onClick={() => void handleOauthCodeSubmit()}
+                      disabled={actionDisabled || !oauthCodeInput.trim()}
+                    >
+                      {props.submitting ? "Verifying..." : "Complete connection"}
+                    </Button>
+                  </div>
+                </div>
+              ) : null}
+
+              {resolvedView === "oauth-auto" && selectedEntry && oauthSession ? (
+                <div className="rounded-xl border border-gray-6/40 bg-gray-2/50 shadow-sm p-5 space-y-4">
+                  <div className="flex items-center justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12">{selectedEntry.name}</div>
+                      <div className="text-xs text-gray-10 mt-1">Waiting for browser confirmation.</div>
+                    </div>
+                    <Button variant="ghost" onClick={handleBack} disabled={actionDisabled}>
+                      Back
+                    </Button>
+                  </div>
+                  {isOpenAiHeadlessSession ? (
+                    <div className="space-y-2 text-xs text-gray-9">
+                      <div>You'll need to sign in to your OpenAI account and provide the code below.</div>
+                      <div>The first time you do this you'll need to enable Device auth in your account settings.</div>
+                      <div>ChatGPT &gt; Account Settings &gt; Security &gt; Enable device code authorization</div>
+                      <div>When you're ready, copy the code below, and click &quot;Open Browser&quot;.</div>
+                    </div>
+                  ) : (
+                    <div className="text-xs text-gray-9">
+                      Sign in in the browser tab we just opened. We will complete the connection automatically.
+                    </div>
+                  )}
+                  {oauthDisplayCode ? (
+                    <div className="rounded-xl border border-gray-6/70 bg-gray-2/40 px-3 py-3 flex items-center gap-3">
+                      <div className="flex-1 min-w-0">
+                        <div className="text-[10px] uppercase tracking-wide text-gray-8">Confirmation code</div>
+                        <div className="text-sm text-gray-12 font-mono break-all">{oauthDisplayCode}</div>
+                      </div>
+                      <Button variant="ghost" className="text-xs shrink-0" onClick={() => void copyOauthDisplayCode()}>
+                        {oauthCodeCopied ? "Copied" : "Copy"}
+                      </Button>
+                    </div>
+                  ) : null}
+                  {isOpenAiHeadlessSession && !oauthBrowserOpened ? (
+                    <div className="flex items-center gap-2 text-xs text-gray-9">
+                      <span>Authorization checks will start after you click Open Browser.</span>
+                    </div>
+                  ) : (
+                    <div className="flex items-center gap-2 text-xs text-gray-9">
+                      <Loader2 size={14} className={props.submitting || pollingBusy || oauthAutoBusy ? "animate-spin" : ""} />
+                      <span>Checking connection status automatically...</span>
+                    </div>
+                  )}
+                  <div className="flex items-center justify-between gap-3">
+                    <Button
+                      variant="outline"
+                      onClick={() => {
+                        void openOauthUrl(oauthSession.authorization.url ?? "");
+                      }}
+                    >
+                      {isOpenAiHeadlessSession
+                        ? oauthBrowserOpened
+                          ? "Reopen Browser"
+                          : "Open Browser"
+                        : "Open browser again"}
+                    </Button>
+                    <div className="text-[11px] text-gray-9 text-right">
+                      This window will close once the provider is connected.
+                    </div>
+                  </div>
+                </div>
+              ) : null}
+            </div>
+          ) : null}
+        </div>
+
+        <div className="px-6 pt-4 pb-6 border-t border-gray-6/50 flex flex-col gap-3">
+          <div className="min-h-[16px] text-xs text-gray-10">
+            {props.submitting ? submittingLabel() : null}
+          </div>
+          <Button variant="ghost" onClick={handleClose} disabled={actionDisabled}>
+            Close
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/connections/provider-auth/store.ts b/apps/app/src/react-app/domains/connections/provider-auth/store.ts
new file mode 100644
index 0000000000..5492f0af4f
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/provider-auth/store.ts
@@ -0,0 +1,1639 @@
+import { useSyncExternalStore } from "react";
+
+import { applyEdits, modify, parse } from "jsonc-parser";
+import type {
+  ProviderAuthAuthorization,
+  ProviderConfig,
+  ProviderListResponse,
+} from "@opencode-ai/sdk/v2/client";
+
+import { t } from "../../../../i18n";
+import {
+  createDenClient,
+  readDenSettings,
+  type DenOrgLlmProvider,
+  type DenOrgLlmProviderConnection,
+} from "../../../../app/lib/den";
+import { unwrap, waitForHealthy } from "../../../../app/lib/opencode";
+import {
+  readOpencodeConfig,
+  writeOpencodeConfig,
+  workspaceOpenworkRead,
+  workspaceOpenworkWrite,
+} from "../../../../app/lib/desktop";
+import type {
+  Client,
+  ProviderListItem,
+  WorkspaceDisplay,
+} from "../../../../app/types";
+import { isDesktopRuntime, safeStringify } from "../../../../app/utils";
+import {
+  compareProviders,
+  filterProviderList,
+  mapConfigProvidersToList,
+} from "../../../../app/utils/providers";
+import type { OpenworkServerStore } from "../openwork-server-store";
+import {
+  denSessionUpdatedEvent,
+  type DenSessionUpdatedDetail,
+} from "../../../../app/lib/den-session-events";
+import {
+  readWorkspaceCloudImports,
+  withWorkspaceCloudImports,
+  type CloudImportedProvider,
+} from "../../../../app/cloud/import-state";
+
+type ProviderReturnFocusTarget = "none" | "composer";
+type CloudProviderSyncReason = "sign_in" | "app_launch" | "interval" | "settings_cloud_opened";
+
+export type ProviderAuthMethod = {
+  type: "oauth" | "api" | "cloud";
+  label: string;
+  methodIndex?: number;
+  cloudProviderId?: string;
+  description?: string;
+  env?: string[];
+  modelCount?: number;
+};
+
+export type ProviderAuthProvider = {
+  id: string;
+  name: string;
+  env: string[];
+};
+
+export type ProviderOAuthStartResult = {
+  methodIndex: number;
+  authorization: ProviderAuthAuthorization;
+};
+
+export type ProviderAuthStoreSnapshot = {
+  providerAuthModalOpen: boolean;
+  providerAuthBusy: boolean;
+  providerAuthError: string | null;
+  providerAuthMethods: Record<string, ProviderAuthMethod[]>;
+  providerAuthPreferredProviderId: string | null;
+  providerAuthWorkerType: "local" | "remote";
+  providerAuthProviders: ProviderAuthProvider[];
+  cloudOrgProviders: DenOrgLlmProvider[];
+  importedCloudProviders: Record<string, CloudImportedProvider>;
+};
+
+type CreateProviderAuthStoreOptions = {
+  client: () => Client | null;
+  providers: () => ProviderListItem[];
+  providerDefaults: () => Record<string, string>;
+  providerConnectedIds: () => string[];
+  disabledProviders: () => string[];
+  selectedWorkspaceDisplay: () => WorkspaceDisplay;
+  selectedWorkspaceRoot: () => string;
+  runtimeWorkspaceId: () => string | null;
+  openworkServer: OpenworkServerStore;
+  setProviders: (value: ProviderListItem[]) => void;
+  setProviderDefaults: (value: Record<string, string>) => void;
+  setProviderConnectedIds: (value: string[]) => void;
+  setDisabledProviders: (value: string[]) => void;
+  markOpencodeConfigReloadRequired: () => void;
+  focusPromptSoon?: () => void;
+};
+
+type MutableState = {
+  providerAuthModalOpen: boolean;
+  providerAuthBusy: boolean;
+  providerAuthError: string | null;
+  providerAuthMethods: Record<string, ProviderAuthMethod[]>;
+  providerAuthPreferredProviderId: string | null;
+  providerAuthReturnFocusTarget: ProviderReturnFocusTarget;
+  cloudOrgProviders: DenOrgLlmProvider[];
+  importedCloudProviders: Record<string, CloudImportedProvider>;
+};
+
+export type ProviderAuthStore = ReturnType<typeof createProviderAuthStore>;
+
+export function createProviderAuthStore(options: CreateProviderAuthStoreOptions) {
+  const listeners = new Set<() => void>();
+
+  let snapshot: ProviderAuthStoreSnapshot;
+  let disposed = false;
+  let started = false;
+  let denSessionCleanup: (() => void) | null = null;
+  let lastWorkspaceKey = "";
+
+  let state: MutableState = {
+    providerAuthModalOpen: false,
+    providerAuthBusy: false,
+    providerAuthError: null,
+    providerAuthMethods: {},
+    providerAuthPreferredProviderId: null,
+    providerAuthReturnFocusTarget: "none",
+    cloudOrgProviders: [],
+    importedCloudProviders: {},
+  };
+
+  let cloudOrgProvidersLoadKey = "";
+  let cloudOrgProvidersInFlightKey = "";
+  let cloudOrgProvidersInFlight: Promise<DenOrgLlmProvider[]> | null = null;
+  let cloudProviderSyncInFlight: Promise<void> | null = null;
+  let cloudProviderSyncQueuedReason: CloudProviderSyncReason | null = null;
+  let cloudProviderSyncContextKey = "";
+
+  const emitChange = () => {
+    for (const listener of listeners) listener();
+  };
+
+  const getStringList = (value: unknown) =>
+    Array.isArray(value)
+      ? value.filter(
+          (entry): entry is string =>
+            typeof entry === "string" && entry.trim().length > 0,
+        )
+      : [];
+
+  const getCloudProviderEnv = (config: Record<string, unknown>) =>
+    getStringList(config.env);
+  const sortStrings = (values: string[]) => [...values].sort();
+  const sameStringList = (a: string[], b: string[]) =>
+    a.length === b.length && a.every((value, index) => value === b[index]);
+
+  const getCloudManagedProviderId = (
+    provider: Pick<DenOrgLlmProvider, "id" | "providerId">,
+  ) => provider.id.trim();
+
+  const getProviderAuthWorkerType = (): "local" | "remote" =>
+    options.selectedWorkspaceDisplay().workspaceType === "remote" ? "remote" : "local";
+
+  const getProviderAuthProviders = (): ProviderAuthProvider[] => {
+    const merged = new Map<string, ProviderAuthProvider>();
+
+    for (const provider of options.providers()) {
+      const id = provider.id?.trim();
+      if (!id) continue;
+      merged.set(id, {
+        id,
+        name: provider.name?.trim() || id,
+        env: Array.isArray(provider.env) ? provider.env : [],
+      });
+    }
+
+    for (const provider of state.cloudOrgProviders) {
+      const id = provider.providerId.trim();
+      if (!id || merged.has(id)) continue;
+      merged.set(id, {
+        id,
+        name: provider.name.trim() || id,
+        env: getCloudProviderEnv(provider.providerConfig),
+      });
+    }
+
+    return [...merged.values()].sort(compareProviders);
+  };
+
+  const refreshSnapshot = () => {
+    snapshot = {
+      providerAuthModalOpen: state.providerAuthModalOpen,
+      providerAuthBusy: state.providerAuthBusy,
+      providerAuthError: state.providerAuthError,
+      providerAuthMethods: state.providerAuthMethods,
+      providerAuthPreferredProviderId: state.providerAuthPreferredProviderId,
+      providerAuthWorkerType: getProviderAuthWorkerType(),
+      providerAuthProviders: getProviderAuthProviders(),
+      cloudOrgProviders: state.cloudOrgProviders,
+      importedCloudProviders: state.importedCloudProviders,
+    };
+  };
+
+  const mutateState = (updater: (current: MutableState) => MutableState) => {
+    state = updater(state);
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const setStateField = <K extends keyof MutableState>(
+    key: K,
+    value: MutableState[K],
+  ) => {
+    if (Object.is(state[key], value)) return;
+    mutateState((current) => ({ ...current, [key]: value }));
+  };
+
+  const buildCloudProviderMethod = (
+    provider: DenOrgLlmProvider,
+  ): ProviderAuthMethod => ({
+    type: "cloud",
+    label:
+      provider.name.trim().toLowerCase() ===
+      provider.providerId.trim().toLowerCase()
+        ? "Use organization provider"
+        : `Use ${provider.name}`,
+    cloudProviderId: provider.id,
+    description:
+      provider.models.length > 0
+        ? `${provider.models.length} curated model${
+            provider.models.length === 1 ? "" : "s"
+          } managed by your organization.`
+        : "Use the provider and credential managed by your organization.",
+    env: getCloudProviderEnv(provider.providerConfig),
+    modelCount: provider.models.length,
+  });
+
+  const buildCloudProviderConfig = (
+    provider: DenOrgLlmProviderConnection,
+  ): ProviderConfig => {
+    const models = Object.fromEntries(
+      provider.models.map((model) => {
+        const next: NonNullable<ProviderConfig["models"]>[string] = {
+          id: model.id,
+          name: model.name,
+        };
+        const raw = model.config;
+        for (const key of [
+          "family",
+          "release_date",
+          "attachment",
+          "reasoning",
+          "temperature",
+          "tool_call",
+          "interleaved",
+          "cost",
+          "limit",
+          "modalities",
+          "status",
+          "options",
+          "headers",
+          "provider",
+          "variants",
+        ] as const) {
+          const value = raw[key];
+          if (value !== undefined) {
+            (next as Record<string, unknown>)[key] = value;
+          }
+        }
+        return [model.id, next];
+      }),
+    );
+
+    const next: ProviderConfig = {
+      id: provider.providerId,
+      name: provider.name,
+      env: getCloudProviderEnv(provider.providerConfig),
+      models,
+    };
+
+    if (
+      typeof provider.providerConfig.npm === "string" &&
+      provider.providerConfig.npm.trim()
+    ) {
+      next.npm = provider.providerConfig.npm;
+    }
+    if (
+      typeof provider.providerConfig.api === "string" &&
+      provider.providerConfig.api.trim()
+    ) {
+      next.api = provider.providerConfig.api;
+    }
+    if (
+      provider.providerConfig.options &&
+      typeof provider.providerConfig.options === "object"
+    ) {
+      next.options = provider.providerConfig.options as Record<string, unknown>;
+    }
+    if (Array.isArray(provider.providerConfig.whitelist)) {
+      next.whitelist = getStringList(provider.providerConfig.whitelist);
+    }
+    if (Array.isArray(provider.providerConfig.blacklist)) {
+      next.blacklist = getStringList(provider.providerConfig.blacklist);
+    }
+
+    return next;
+  };
+
+  const readWorkspaceOpenworkConfigRecord = async (): Promise<
+    Record<string, unknown>
+  > => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace =
+      options.selectedWorkspaceDisplay().workspaceType === "local";
+    const openworkSnapshot = options.openworkServer.getSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const openworkCapabilities = openworkSnapshot.openworkServerCapabilities;
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkCapabilities?.config?.read;
+
+    if (canUseOpenworkServer) {
+      const config = await openworkClient.getConfig(openworkWorkspaceId);
+      return config.openwork ?? {};
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      return (await workspaceOpenworkRead({
+        workspacePath: root,
+      })) as unknown as Record<string, unknown>;
+    }
+
+    return {};
+  };
+
+  const writeWorkspaceOpenworkConfigRecord = async (
+    config: Record<string, unknown>,
+  ) => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace =
+      options.selectedWorkspaceDisplay().workspaceType === "local";
+    const openworkSnapshot = options.openworkServer.getSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const openworkCapabilities = openworkSnapshot.openworkServerCapabilities;
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkCapabilities?.config?.write;
+
+    if (canUseOpenworkServer) {
+      await openworkClient.patchConfig(openworkWorkspaceId, { openwork: config });
+      return true;
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      const result = await workspaceOpenworkWrite({
+        workspacePath: root,
+        config: config as never,
+      });
+      if (!result.ok) {
+        throw new Error(
+          result.stderr || result.stdout || "Failed to write .opencode/openwork.json",
+        );
+      }
+      return true;
+    }
+
+    return false;
+  };
+
+  const refreshImportedCloudProviders = async () => {
+    try {
+      const config = await readWorkspaceOpenworkConfigRecord();
+      const cloudImports = readWorkspaceCloudImports(config);
+      setStateField("importedCloudProviders", cloudImports.providers);
+      return cloudImports.providers;
+    } catch {
+      setStateField("importedCloudProviders", {});
+      return {};
+    }
+  };
+
+  const persistImportedCloudProviders = async (
+    nextProviders: Record<string, CloudImportedProvider>,
+  ) => {
+    const config = await readWorkspaceOpenworkConfigRecord();
+    const cloudImports = readWorkspaceCloudImports(config);
+    const nextConfig = withWorkspaceCloudImports(config, {
+      ...cloudImports,
+      providers: nextProviders,
+    });
+    const persisted = await writeWorkspaceOpenworkConfigRecord(nextConfig);
+    if (!persisted) {
+      throw new Error(
+        "OpenWork server unavailable. Connect to manage imported cloud providers.",
+      );
+    }
+    setStateField("importedCloudProviders", nextProviders);
+  };
+
+  const readProjectConfigFile = async () => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace =
+      options.selectedWorkspaceDisplay().workspaceType === "local";
+    const openworkSnapshot = options.openworkServer.getSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const openworkCapabilities = openworkSnapshot.openworkServerCapabilities;
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkCapabilities?.config?.read &&
+      typeof openworkClient.readOpencodeConfigFile === "function";
+
+    if (canUseOpenworkServer) {
+      return await openworkClient.readOpencodeConfigFile(openworkWorkspaceId, "project");
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      return await readOpencodeConfig("project", root);
+    }
+
+    return null;
+  };
+
+  const writeProjectConfigFile = async (content: string) => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace =
+      options.selectedWorkspaceDisplay().workspaceType === "local";
+    const openworkSnapshot = options.openworkServer.getSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const openworkCapabilities = openworkSnapshot.openworkServerCapabilities;
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkCapabilities?.config?.write &&
+      typeof openworkClient.writeOpencodeConfigFile === "function";
+
+    if (canUseOpenworkServer) {
+      const result = await openworkClient.writeOpencodeConfigFile(
+        openworkWorkspaceId,
+        "project",
+        content,
+      );
+      if (!result.ok) {
+        throw new Error(result.stderr || result.stdout || "Failed to write opencode.jsonc");
+      }
+      return true;
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      const result = await writeOpencodeConfig("project", root, content);
+      if (!result.ok) {
+        throw new Error(result.stderr || result.stdout || "Failed to write opencode.jsonc");
+      }
+      return true;
+    }
+
+    return false;
+  };
+
+  const updateProjectConfigFile = async (
+    updater: (raw: string) => string,
+    fallbackUpdate?: (config: Record<string, unknown>) => Record<string, unknown>,
+  ) => {
+    const configFile = await readProjectConfigFile();
+    if (configFile) {
+      const raw = configFile.content?.trim()
+        ? configFile.content
+        : '{\n  "$schema": "https://opencode.ai/config.json"\n}\n';
+      await writeProjectConfigFile(updater(raw));
+      return true;
+    }
+
+    if (!fallbackUpdate) {
+      return false;
+    }
+
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+    const config = unwrap(await c.config.get());
+    const next = fallbackUpdate(config);
+    await c.config.update({ config: next });
+    return true;
+  };
+
+  const escapeRegExp = (value: string) =>
+    value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+  const cloudProviderComment = (provider: Pick<DenOrgLlmProvider, "id" | "name">) =>
+    `// OpenWork Cloud import: ${provider.name
+      .replace(/\s+/g, " ")
+      .trim()} (${provider.id}). Manage this entry from Cloud settings.`;
+
+  const removeCloudProviderComment = (raw: string, providerId: string) =>
+    raw.replace(
+      new RegExp(
+        `(^[ \t]*)// OpenWork Cloud import:.*\\n\\1(?="${escapeRegExp(providerId)}":)`,
+        "m",
+      ),
+      "$1",
+    );
+
+  const addCloudProviderComment = (
+    raw: string,
+    provider: Pick<DenOrgLlmProvider, "id" | "name">,
+    localProviderId: string,
+  ) => {
+    const withoutExisting = removeCloudProviderComment(raw, localProviderId);
+    const propertyPattern = new RegExp(
+      `^([ \t]*)"${escapeRegExp(localProviderId)}":`,
+      "m",
+    );
+    return withoutExisting.replace(
+      propertyPattern,
+      `$1${cloudProviderComment(provider)}\n$1"${localProviderId}":`,
+    );
+  };
+
+  const getProviderModelIds = (provider: Pick<DenOrgLlmProvider, "models">) =>
+    provider.models.map((model) => model.id.trim()).filter(Boolean).sort();
+
+  const formatConfigWithCloudProvider = (
+    raw: string,
+    provider: DenOrgLlmProviderConnection,
+    localProviderId: string,
+    previousProviderId?: string | null,
+  ) => {
+    const nextProviderConfig = buildCloudProviderConfig(
+      provider,
+    ) as unknown as Record<string, unknown>;
+    let updated = raw.trim()
+      ? raw
+      : '{\n  "$schema": "https://opencode.ai/config.json"\n}\n';
+
+    if (previousProviderId && previousProviderId !== localProviderId) {
+      updated = removeCloudProviderComment(updated, previousProviderId);
+      const previousEdits = modify(updated, ["provider", previousProviderId], {
+        formattingOptions: { insertSpaces: true, tabSize: 2 },
+      });
+      updated = applyEdits(updated, previousEdits);
+    }
+
+    const providerEdits = modify(updated, ["provider", localProviderId], nextProviderConfig, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 },
+    });
+    updated = applyEdits(updated, providerEdits);
+    updated = addCloudProviderComment(updated, provider, localProviderId);
+
+    const disabledToRemove = new Set([localProviderId, previousProviderId ?? ""]);
+    const currentDisabled = options.disabledProviders();
+    if (currentDisabled.some((id) => disabledToRemove.has(id))) {
+      const nextDisabled = currentDisabled.filter((id) => !disabledToRemove.has(id));
+      const disabledEdits = modify(updated, ["disabled_providers"], nextDisabled, {
+        formattingOptions: { insertSpaces: true, tabSize: 2 },
+      });
+      updated = applyEdits(updated, disabledEdits);
+    }
+
+    return updated.endsWith("\n") ? updated : `${updated}\n`;
+  };
+
+  const formatConfigWithoutCloudProvider = (raw: string, providerId: string) => {
+    let updated = raw.trim()
+      ? raw
+      : '{\n  "$schema": "https://opencode.ai/config.json"\n}\n';
+    updated = removeCloudProviderComment(updated, providerId);
+    const providerEdits = modify(updated, ["provider", providerId], {
+      formattingOptions: { insertSpaces: true, tabSize: 2 },
+    });
+    updated = applyEdits(updated, providerEdits);
+
+    const nextDisabled = options.disabledProviders().filter((id) => id !== providerId);
+    const disabledEdits = modify(updated, ["disabled_providers"], nextDisabled, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 },
+    });
+    updated = applyEdits(updated, disabledEdits);
+    return updated.endsWith("\n") ? updated : `${updated}\n`;
+  };
+
+  const assertCloudProviderImportSafe = async (
+    provider: DenOrgLlmProviderConnection,
+  ) => {
+    const localProviderId = getCloudManagedProviderId(provider);
+    const existingImported = state.importedCloudProviders[provider.id] ?? null;
+    if (
+      existingImported &&
+      existingImported.providerId !== localProviderId &&
+      Object.values(state.importedCloudProviders).some(
+        (entry) => entry.providerId === localProviderId && entry.cloudProviderId !== provider.id,
+      )
+    ) {
+      throw new Error(
+        `${localProviderId} is already imported from another cloud provider. Remove it before importing this one.`,
+      );
+    }
+
+    if (!existingImported && options.providerConnectedIds().includes(localProviderId)) {
+      throw new Error(
+        `${localProviderId} is already connected in this workspace. Disconnect it before importing the cloud-managed version.`,
+      );
+    }
+
+    const configFile = await readProjectConfigFile();
+    if (!configFile?.content?.trim() || existingImported) {
+      return;
+    }
+
+    const parsed = parse(configFile.content);
+    const providerSection =
+      parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? (parsed as Record<string, unknown>).provider
+        : null;
+    if (
+      providerSection &&
+      typeof providerSection === "object" &&
+      !Array.isArray(providerSection) &&
+      localProviderId in (providerSection as Record<string, unknown>)
+    ) {
+      throw new Error(
+        `${localProviderId} already has a provider block in opencode.jsonc. Remove it before importing the cloud-managed version.`,
+      );
+    }
+  };
+
+  const getCloudOrgProvidersKey = () => {
+    const settings = readDenSettings();
+    return [
+      settings.baseUrl,
+      settings.apiBaseUrl ?? "",
+      settings.activeOrgId?.trim() ?? "",
+      settings.authToken?.trim() ?? "",
+    ].join("::");
+  };
+
+  const refreshCloudOrgProviders = async (optionsArg?: { force?: boolean }) => {
+    const settings = readDenSettings();
+    const loadKey = getCloudOrgProvidersKey();
+    const token = settings.authToken?.trim() ?? "";
+    const orgId = settings.activeOrgId?.trim() ?? "";
+
+    if (!optionsArg?.force && cloudOrgProvidersLoadKey === loadKey) {
+      return state.cloudOrgProviders;
+    }
+
+    if (cloudOrgProvidersInFlight && cloudOrgProvidersInFlightKey === loadKey) {
+      return cloudOrgProvidersInFlight;
+    }
+
+    if (!token || !orgId) {
+      setStateField("cloudOrgProviders", []);
+      cloudOrgProvidersLoadKey = loadKey;
+      return [];
+    }
+
+    const client = createDenClient({
+      baseUrl: settings.baseUrl,
+      apiBaseUrl: settings.apiBaseUrl,
+      token,
+    });
+    const request = client
+      .listOrgLlmProviders(orgId)
+      .then((providers) => {
+        setStateField("cloudOrgProviders", providers);
+        cloudOrgProvidersLoadKey = loadKey;
+        return providers;
+      })
+      .catch((error) => {
+        setStateField("cloudOrgProviders", []);
+        cloudOrgProvidersLoadKey = "";
+        throw error;
+      })
+      .finally(() => {
+        if (cloudOrgProvidersInFlightKey === loadKey) {
+          cloudOrgProvidersInFlight = null;
+          cloudOrgProvidersInFlightKey = "";
+        }
+      });
+
+    cloudOrgProvidersInFlight = request;
+    cloudOrgProvidersInFlightKey = loadKey;
+    return request;
+  };
+
+  const applyProviderListState = (value: ProviderListResponse) => {
+    options.setProviders(value.all ?? []);
+    options.setProviderDefaults(value.default ?? {});
+    options.setProviderConnectedIds(value.connected ?? []);
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const removeProviderFromState = (providerId: string) => {
+    const resolved = providerId.trim();
+    if (!resolved) return;
+    options.setProviders(options.providers().filter((provider) => provider.id !== resolved));
+    options.setProviderConnectedIds(
+      options.providerConnectedIds().filter((id) => id !== resolved),
+    );
+    options.setProviderDefaults(
+      Object.fromEntries(
+        Object.entries(options.providerDefaults()).filter(([id]) => id !== resolved),
+      ),
+    );
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const assertNoClientError = (result: unknown) => {
+    const maybe = result as { error?: unknown } | null | undefined;
+    if (!maybe || maybe.error === undefined) return;
+    throw new Error(describeProviderError(maybe.error, t("providers.request_failed")));
+  };
+
+  const removeProviderAuthCredentials = async (providerId: string) => {
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+
+    const authClient = c.auth as unknown as {
+      remove?: (options: { providerID: string }) => Promise<unknown>;
+      set?: (options: { providerID: string; auth: unknown }) => Promise<unknown>;
+    };
+    if (typeof authClient.remove === "function") {
+      const result = await authClient.remove({ providerID: providerId });
+      assertNoClientError(result);
+      return;
+    }
+
+    const rawClient = (c as unknown as {
+      client?: { delete?: (options: { url: string }) => Promise<unknown> };
+    }).client;
+    if (rawClient?.delete) {
+      await rawClient.delete({ url: `/auth/${encodeURIComponent(providerId)}` });
+      return;
+    }
+
+    if (typeof authClient.set === "function") {
+      const result = await authClient.set({ providerID: providerId, auth: null });
+      assertNoClientError(result);
+      return;
+    }
+
+    throw new Error(t("providers.removal_unsupported"));
+  };
+
+  const describeProviderError = (error: unknown, fallback: string) => {
+    const readString = (value: unknown, max = 700) => {
+      if (typeof value !== "string") return null;
+      const trimmed = value.trim();
+      if (!trimmed) return null;
+      if (trimmed.length <= max) return trimmed;
+      return `${trimmed.slice(0, Math.max(0, max - 3))}...`;
+    };
+
+    const records: Record<string, unknown>[] = [];
+    const root = error && typeof error === "object" ? (error as Record<string, unknown>) : null;
+    if (root) {
+      records.push(root);
+      if (root.data && typeof root.data === "object") {
+        records.push(root.data as Record<string, unknown>);
+      }
+      if (root.cause && typeof root.cause === "object") {
+        const cause = root.cause as Record<string, unknown>;
+        records.push(cause);
+        if (cause.data && typeof cause.data === "object") {
+          records.push(cause.data as Record<string, unknown>);
+        }
+      }
+    }
+
+    const firstString = (keys: string[]) => {
+      for (const record of records) {
+        for (const key of keys) {
+          const value = readString(record[key]);
+          if (value) return value;
+        }
+      }
+      return null;
+    };
+
+    const firstNumber = (keys: string[]) => {
+      for (const record of records) {
+        for (const key of keys) {
+          const value = record[key];
+          if (typeof value === "number" && Number.isFinite(value)) return value;
+        }
+      }
+      return null;
+    };
+
+    const status = firstNumber(["statusCode", "status"]);
+    const provider = firstString(["providerID", "providerId", "provider"]);
+    const code = firstString(["code", "errorCode"]);
+    const response = firstString(["responseBody", "body", "response"]);
+    const raw =
+      (error instanceof Error ? readString(error.message) : null) ||
+      firstString(["message", "detail", "reason", "error"]) ||
+      (typeof error === "string" ? readString(error) : null);
+
+    const generic = raw && /^unknown\s+error$/i.test(raw);
+    const heading = (() => {
+      if (status === 401 || status === 403) return t("providers.auth_failed");
+      if (status === 429) return t("providers.rate_limit_exceeded");
+      if (provider) return t("providers.provider_error", { provider });
+      return fallback;
+    })();
+
+    const lines = [heading];
+    if (raw && !generic && raw !== heading) lines.push(raw);
+    if (status && !heading.includes(String(status))) lines.push(`Status: ${status}`);
+    if (provider && !heading.includes(provider)) lines.push(`Provider: ${provider}`);
+    if (code) lines.push(`Code: ${code}`);
+    if (response) lines.push(`Response: ${response}`);
+    if (lines.length > 1) return lines.join("\n");
+
+    if (raw && !generic) return raw;
+    if (error && typeof error === "object") {
+      const serialized = safeStringify(error);
+      if (serialized && serialized !== "{}") return serialized;
+    }
+    return fallback;
+  };
+
+  const buildProviderAuthMethods = (
+    methods: Record<string, ProviderAuthMethod[]>,
+    availableProviders: ProviderAuthProvider[],
+    workerType: "local" | "remote",
+    cloudProviders: DenOrgLlmProvider[],
+  ) => {
+    const merged = Object.fromEntries(
+      Object.entries(methods ?? {}).map(([id, providerMethods]) => [
+        id,
+        (providerMethods ?? []).map((method, methodIndex) => ({
+          ...method,
+          methodIndex,
+        })),
+      ]),
+    ) as Record<string, ProviderAuthMethod[]>;
+
+    for (const provider of availableProviders ?? []) {
+      const id = provider.id?.trim();
+      if (!id || id === "opencode") continue;
+      if (!Array.isArray(provider.env) || provider.env.length === 0) continue;
+      const existing = merged[id] ?? [];
+      if (existing.some((method) => method.type === "api")) continue;
+      merged[id] = [...existing, { type: "api", label: t("providers.api_key_label") }];
+    }
+
+    for (const [id, providerMethods] of Object.entries(merged)) {
+      const provider = availableProviders.find((item) => item.id === id);
+      const normalizedId = id.trim().toLowerCase();
+      const normalizedName = provider?.name?.trim().toLowerCase() ?? "";
+      const isOpenAiProvider = normalizedId === "openai" || normalizedName === "openai";
+      if (!isOpenAiProvider) continue;
+      merged[id] = providerMethods.filter((method) => {
+        if (method.type !== "oauth") return true;
+        const label = method.label.toLowerCase();
+        const isHeadless = label.includes("headless") || label.includes("device");
+        return workerType === "remote" ? isHeadless : !isHeadless;
+      });
+    }
+
+    for (const provider of cloudProviders) {
+      const id = provider.providerId.trim();
+      if (!id) continue;
+      const existing = merged[id] ?? [];
+      if (
+        existing.some(
+          (method) =>
+            method.type === "cloud" && method.cloudProviderId === provider.id,
+        )
+      ) {
+        continue;
+      }
+      merged[id] = [...existing, buildCloudProviderMethod(provider)];
+    }
+
+    return merged;
+  };
+
+  const loadProviderAuthMethods = async (workerType: "local" | "remote") => {
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+    const methods = unwrap(await c.provider.auth());
+    const cloudProviders = await refreshCloudOrgProviders().catch(
+      () => [] as DenOrgLlmProvider[],
+    );
+    return buildProviderAuthMethods(
+      methods as Record<string, ProviderAuthMethod[]>,
+      getProviderAuthProviders(),
+      workerType,
+      cloudProviders,
+    );
+  };
+
+  async function startProviderAuth(
+    providerId?: string,
+    methodIndex?: number,
+  ): Promise<ProviderOAuthStartResult> {
+    setStateField("providerAuthError", null);
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+    try {
+      const cachedMethods = state.providerAuthMethods;
+      const authMethods = Object.keys(cachedMethods).length
+        ? cachedMethods
+        : await loadProviderAuthMethods(getProviderAuthWorkerType());
+      const providerIds = Object.keys(authMethods).sort();
+      if (!providerIds.length) {
+        throw new Error(t("providers.no_providers_available"));
+      }
+
+      const resolved = providerId?.trim() ?? "";
+      if (!resolved) {
+        throw new Error(t("providers.provider_id_required"));
+      }
+
+      const methods = authMethods[resolved];
+      if (!methods || !methods.length) {
+        throw new Error(`${t("providers.unknown_provider")}: ${resolved}`);
+      }
+
+      const oauthIndex =
+        methodIndex !== undefined
+          ? methodIndex
+          : methods.find((method) => method.type === "oauth")?.methodIndex ?? -1;
+      if (oauthIndex === -1) {
+        throw new Error(
+          `${t("providers.no_oauth_prefix")} ${resolved}. ${t("providers.use_api_key_suffix")}`,
+        );
+      }
+
+      const selectedMethod = methods.find((method) => method.methodIndex === oauthIndex);
+      if (!selectedMethod || selectedMethod.type !== "oauth") {
+        throw new Error(`${t("providers.not_oauth_flow_prefix")} ${resolved}.`);
+      }
+
+      const auth = unwrap(
+        await c.provider.oauth.authorize({ providerID: resolved, method: oauthIndex }),
+      );
+      return { methodIndex: oauthIndex, authorization: auth };
+    } catch (error) {
+      const message = describeProviderError(error, t("providers.connect_failed"));
+      setStateField("providerAuthError", message);
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function refreshProviders(optionsArg?: { dispose?: boolean }) {
+    const c = options.client();
+    if (!c) return null;
+
+    if (optionsArg?.dispose) {
+      try {
+        unwrap(await c.instance.dispose());
+      } catch {
+        // ignore dispose failures and try reading current state anyway
+      }
+
+      try {
+        await waitForHealthy(options.client() ?? c, { timeoutMs: 8000, pollMs: 250 });
+      } catch {
+        // ignore health wait failures and still attempt provider reads
+      }
+    }
+
+    const activeClient = options.client() ?? c;
+    let disabledProviders = options.disabledProviders() ?? [];
+    try {
+      const config = unwrap(await activeClient.config.get());
+      disabledProviders = Array.isArray(config.disabled_providers)
+        ? config.disabled_providers
+        : [];
+      options.setDisabledProviders(disabledProviders);
+      refreshSnapshot();
+      emitChange();
+    } catch {
+      // ignore config read failures and continue with current store state
+    }
+
+    try {
+      const updated = filterProviderList(
+        unwrap(await activeClient.provider.list()),
+        disabledProviders,
+      );
+      applyProviderListState(updated);
+      return updated;
+    } catch {
+      try {
+        const fallback = unwrap(await activeClient.config.providers());
+        const mapped = mapConfigProvidersToList(fallback.providers);
+        const next = filterProviderList(
+          {
+            all: mapped,
+            connected: options
+              .providerConnectedIds()
+              .filter((id) => mapped.some((provider) => provider.id === id)),
+            default: fallback.default,
+          },
+          disabledProviders,
+        );
+        applyProviderListState(next);
+        return next;
+      } catch {
+        return null;
+      }
+    }
+  }
+
+  async function completeProviderAuthOAuth(
+    providerId: string,
+    methodIndex: number,
+    code?: string,
+  ) {
+    setStateField("providerAuthError", null);
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+
+    const resolved = providerId?.trim();
+    if (!resolved) {
+      throw new Error(t("providers.provider_id_required"));
+    }
+
+    if (!Number.isInteger(methodIndex) || methodIndex < 0) {
+      throw new Error(t("providers.oauth_method_required"));
+    }
+
+    const waitForProviderConnection = async (timeoutMs = 15000, pollMs = 2000) => {
+      const startedAt = Date.now();
+      while (Date.now() - startedAt < timeoutMs) {
+        try {
+          const updated = await refreshProviders({ dispose: true });
+          if (Array.isArray(updated?.connected) && updated.connected.includes(resolved)) {
+            return true;
+          }
+        } catch {
+          // ignore and retry
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+      }
+      return false;
+    };
+
+    const isPendingOauthError = (error: unknown) => {
+      const text = error instanceof Error ? error.message : String(error ?? "");
+      return /request timed out/i.test(text) || /ProviderAuthOauthMissing/i.test(text);
+    };
+
+    try {
+      const trimmedCode = code?.trim();
+      const result = await c.provider.oauth.callback({
+        providerID: resolved,
+        method: methodIndex,
+        code: trimmedCode || undefined,
+      });
+      assertNoClientError(result);
+      const updated = await refreshProviders({ dispose: true });
+      const connectedNow = Array.isArray(updated?.connected) && updated.connected.includes(resolved);
+      if (connectedNow) {
+        return { connected: true, message: `${t("status.connected")} ${resolved}` };
+      }
+      const connected = await waitForProviderConnection();
+      if (connected) {
+        return { connected: true, message: `${t("status.connected")} ${resolved}` };
+      }
+      return { connected: false, pending: true };
+    } catch (error) {
+      if (isPendingOauthError(error)) {
+        const updated = await refreshProviders({ dispose: true });
+        if (Array.isArray(updated?.connected) && updated.connected.includes(resolved)) {
+          return { connected: true, message: `${t("status.connected")} ${resolved}` };
+        }
+        const connected = await waitForProviderConnection();
+        if (connected) {
+          return { connected: true, message: `${t("status.connected")} ${resolved}` };
+        }
+        return { connected: false, pending: true };
+      }
+      const message = describeProviderError(error, t("providers.oauth_failed"));
+      setStateField("providerAuthError", message);
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function submitProviderApiKey(providerId: string, apiKey: string) {
+    setStateField("providerAuthError", null);
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+
+    const trimmed = apiKey.trim();
+    if (!trimmed) {
+      throw new Error(t("providers.api_key_required"));
+    }
+
+    try {
+      await c.auth.set({ providerID: providerId, auth: { type: "api", key: trimmed } });
+      await refreshProviders({ dispose: true });
+      return `${t("status.connected")} ${providerId}`;
+    } catch (error) {
+      const message = describeProviderError(error, t("providers.save_api_key_failed"));
+      setStateField("providerAuthError", message);
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function connectCloudProviderInternal(
+    cloudProviderId: string,
+    optionsArg?: { silent?: boolean },
+  ) {
+    if (!optionsArg?.silent) {
+      setStateField("providerAuthError", null);
+    }
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const orgId = settings.activeOrgId?.trim() ?? "";
+    if (!token || !orgId) {
+      throw new Error("Sign in to OpenWork Cloud and choose an organization first.");
+    }
+
+    try {
+      const den = createDenClient({
+        baseUrl: settings.baseUrl,
+        apiBaseUrl: settings.apiBaseUrl,
+        token,
+      });
+      const provider = await den.getOrgLlmProviderConnection(orgId, cloudProviderId);
+      const existingImported = state.importedCloudProviders[cloudProviderId] ?? null;
+      const localProviderId = getCloudManagedProviderId(provider);
+      const apiKey = provider.apiKey?.trim() ?? "";
+      const env = getCloudProviderEnv(provider.providerConfig);
+      if (!apiKey && env.length > 0) {
+        throw new Error(`${provider.name} does not have a stored organization credential yet.`);
+      }
+
+      await assertCloudProviderImportSafe(provider);
+
+      if (apiKey) {
+        await c.auth.set({
+          providerID: localProviderId,
+          auth: { type: "api", key: apiKey },
+        });
+      }
+      if (existingImported?.providerId && existingImported.providerId !== localProviderId) {
+        try {
+          await removeProviderAuthCredentials(existingImported.providerId);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error ?? "");
+          if (!/not found|unknown auth|404/i.test(message.toLowerCase())) {
+            throw error;
+          }
+        }
+      }
+      const updatedConfig = await updateProjectConfigFile((raw) =>
+        formatConfigWithCloudProvider(raw, provider, localProviderId, existingImported?.providerId ?? null),
+      );
+      if (!updatedConfig) {
+        throw new Error("Could not update opencode.jsonc for this workspace.");
+      }
+
+      const nextImportedProviders = {
+        ...state.importedCloudProviders,
+        [provider.id]: {
+          cloudProviderId: provider.id,
+          providerId: localProviderId,
+          // Track the provider id as shipped by the server at import time
+          // so we can detect local/remote drift later (see dev #1510 "key
+          // cloud providers by cloud id"). On first import both match.
+          sourceProviderId: provider.providerId,
+          name: provider.name,
+          source: provider.source,
+          updatedAt: provider.updatedAt ?? null,
+          modelIds: getProviderModelIds(provider),
+          importedAt: Date.now(),
+        },
+      };
+      await persistImportedCloudProviders(nextImportedProviders);
+
+      const nextDisabledProviders = options
+        .disabledProviders()
+        .filter((id) => id !== localProviderId && id !== existingImported?.providerId);
+      options.setDisabledProviders(nextDisabledProviders);
+      options.markOpencodeConfigReloadRequired();
+      refreshSnapshot();
+      emitChange();
+      return `${t("status.connected")} ${provider.name}`;
+    } catch (error) {
+      const message = describeProviderError(error, "Failed to connect organization provider.");
+      if (!optionsArg?.silent) {
+        setStateField("providerAuthError", message);
+      }
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function connectCloudProvider(cloudProviderId: string) {
+    return await connectCloudProviderInternal(cloudProviderId);
+  }
+
+  async function removeCloudProviderInternal(
+    cloudProviderId: string,
+    optionsArg?: { silent?: boolean },
+  ) {
+    if (!optionsArg?.silent) {
+      setStateField("providerAuthError", null);
+    }
+    const imported = state.importedCloudProviders[cloudProviderId];
+    if (!imported) {
+      throw new Error("This cloud provider has not been imported into the workspace.");
+    }
+
+    try {
+      try {
+        await removeProviderAuthCredentials(imported.providerId);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error ?? "");
+        if (!/not found|unknown auth|404/i.test(message.toLowerCase())) {
+          throw error;
+        }
+      }
+      const updatedConfig = await updateProjectConfigFile((raw) =>
+        formatConfigWithoutCloudProvider(raw, imported.providerId),
+      );
+      if (!updatedConfig) {
+        throw new Error("Could not update opencode.jsonc for this workspace.");
+      }
+
+      const nextImportedProviders = { ...state.importedCloudProviders };
+      delete nextImportedProviders[cloudProviderId];
+      await persistImportedCloudProviders(nextImportedProviders);
+
+      options.setDisabledProviders(
+        options.disabledProviders().filter((id) => id !== imported.providerId),
+      );
+      options.markOpencodeConfigReloadRequired();
+      refreshSnapshot();
+      emitChange();
+      return `${t("providers.disconnected_prefix")} ${imported.name}`;
+    } catch (error) {
+      const message = describeProviderError(error, t("providers.disconnect_failed"));
+      if (!optionsArg?.silent) {
+        setStateField("providerAuthError", message);
+      }
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function removeCloudProvider(cloudProviderId: string) {
+    return await removeCloudProviderInternal(cloudProviderId);
+  }
+
+  const logCloudProviderSyncError = (reason: CloudProviderSyncReason, error: unknown) => {
+    const message = describeProviderError(error, "Cloud provider sync failed.");
+    console.warn(`[cloud-provider-sync:${reason}] ${message}`);
+    return message;
+  };
+
+  const getCloudProviderSyncContextKey = () => {
+    const settings = readDenSettings();
+    return [
+      settings.baseUrl,
+      settings.apiBaseUrl ?? "",
+      settings.activeOrgId?.trim() ?? "",
+      settings.authToken?.trim() ?? "",
+      options.selectedWorkspaceDisplay().workspaceType,
+      options.selectedWorkspaceRoot().trim(),
+      options.runtimeWorkspaceId() ?? "",
+      options.client() ? "connected" : "disconnected",
+    ].join("::");
+  };
+
+  const hasCloudProviderSyncPrerequisites = () => {
+    const settings = readDenSettings();
+    const workspaceTarget =
+      options.selectedWorkspaceRoot().trim() || options.runtimeWorkspaceId() || "";
+    return Boolean(
+      options.client() &&
+        settings.authToken?.trim() &&
+        settings.activeOrgId?.trim() &&
+        workspaceTarget,
+    );
+  };
+
+  const isCloudProviderOutOfSync = (
+    provider: DenOrgLlmProvider,
+    importedProvider: CloudImportedProvider,
+  ) =>
+    importedProvider.providerId !== getCloudManagedProviderId(provider) ||
+    importedProvider.sourceProviderId !== provider.providerId ||
+    (importedProvider.source ?? null) !== provider.source ||
+    (importedProvider.updatedAt ?? null) !== (provider.updatedAt ?? null) ||
+    !sameStringList(importedProvider.modelIds, sortStrings(provider.models.map((model) => model.id)));
+
+  async function performCloudProviderSync(reason: CloudProviderSyncReason) {
+    if (!hasCloudProviderSyncPrerequisites()) {
+      return;
+    }
+
+    const importedProviders = await refreshImportedCloudProviders();
+    const liveProviders = await refreshCloudOrgProviders({ force: true });
+    const liveProviderMap = new Map(liveProviders.map((provider) => [provider.id, provider]));
+    const failures: string[] = [];
+    const processedLiveProviderIds = new Set<string>();
+    let configChanged = false;
+
+    for (const importedProvider of Object.values(importedProviders)) {
+      const liveProvider = liveProviderMap.get(importedProvider.cloudProviderId);
+      if (!liveProvider) {
+        try {
+          await removeCloudProviderInternal(importedProvider.cloudProviderId, { silent: true });
+          configChanged = true;
+        } catch (error) {
+          failures.push(logCloudProviderSyncError(reason, error));
+        }
+        continue;
+      }
+
+      processedLiveProviderIds.add(liveProvider.id);
+
+      if (!isCloudProviderOutOfSync(liveProvider, importedProvider)) {
+        continue;
+      }
+
+      try {
+        await removeCloudProviderInternal(importedProvider.cloudProviderId, { silent: true });
+        await connectCloudProviderInternal(liveProvider.id, { silent: true });
+        configChanged = true;
+      } catch (error) {
+        failures.push(logCloudProviderSyncError(reason, error));
+      }
+    }
+
+    const nextImportedProviders = state.importedCloudProviders;
+    for (const liveProvider of liveProviders) {
+      if (processedLiveProviderIds.has(liveProvider.id)) {
+        continue;
+      }
+      if (nextImportedProviders[liveProvider.id]) {
+        continue;
+      }
+
+      try {
+        await connectCloudProviderInternal(liveProvider.id, { silent: true });
+        configChanged = true;
+      } catch (error) {
+        failures.push(logCloudProviderSyncError(reason, error));
+      }
+    }
+
+    if (configChanged) {
+      await refreshProviders({ dispose: true }).catch(() => null);
+    }
+
+    if (failures.length > 0) {
+      throw new Error(failures.join("\n"));
+    }
+  }
+
+  async function runCloudProviderSync(reason: CloudProviderSyncReason) {
+    if (cloudProviderSyncInFlight) {
+      cloudProviderSyncQueuedReason = reason;
+      return cloudProviderSyncInFlight;
+    }
+
+    const request = performCloudProviderSync(reason)
+      .catch((error) => {
+        const message = logCloudProviderSyncError(reason, error);
+        if (reason === "settings_cloud_opened") {
+          setStateField("providerAuthError", message);
+        }
+      })
+      .finally(() => {
+        cloudProviderSyncInFlight = null;
+        const queuedReason = cloudProviderSyncQueuedReason;
+        cloudProviderSyncQueuedReason = null;
+        if (queuedReason) {
+          void runCloudProviderSync(queuedReason);
+        }
+      });
+
+    cloudProviderSyncInFlight = request;
+    return request;
+  }
+
+  async function disconnectProvider(providerId: string) {
+    setStateField("providerAuthError", null);
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("providers.not_connected"));
+    }
+
+    const resolved = providerId.trim();
+    if (!resolved) {
+      throw new Error(t("providers.provider_id_required"));
+    }
+
+    const trackedImport = Object.values(state.importedCloudProviders).find(
+      (entry) => entry.providerId === resolved,
+    );
+    if (trackedImport) {
+      return await removeCloudProvider(trackedImport.cloudProviderId);
+    }
+
+    const provider = options.providers().find((entry) => entry.id === resolved) as
+      | (ProviderListItem & { source?: string })
+      | undefined;
+    const canDisableProvider = provider?.source === "config" || provider?.source === "custom";
+
+    const disableProvider = async () => {
+      const config = unwrap(await c.config.get());
+      const disabledProviders = Array.isArray(config.disabled_providers)
+        ? config.disabled_providers
+        : [];
+      if (disabledProviders.includes(resolved)) {
+        return false;
+      }
+
+      const next = [...disabledProviders, resolved];
+      options.setDisabledProviders(next);
+      try {
+        const result = await c.config.update({
+          config: { ...config, disabled_providers: next },
+        });
+        assertNoClientError(result);
+        options.markOpencodeConfigReloadRequired();
+      } catch (error) {
+        options.setDisabledProviders(disabledProviders);
+        throw error;
+      }
+      refreshSnapshot();
+      emitChange();
+      return true;
+    };
+
+    try {
+      await removeProviderAuthCredentials(resolved);
+      let updated = await refreshProviders({ dispose: true });
+      if (canDisableProvider && Array.isArray(updated?.connected) && updated.connected.includes(resolved)) {
+        const disabled = await disableProvider();
+        if (disabled && updated) {
+          updated = filterProviderList(updated, options.disabledProviders() ?? []);
+          applyProviderListState(updated);
+        }
+        if (!Array.isArray(updated?.connected) || !updated.connected.includes(resolved)) {
+          return disabled
+            ? `${t("providers.disconnected_prefix")} ${resolved} ${t("providers.disabled_in_config_suffix")}`
+            : `${t("providers.disconnected_prefix")} ${resolved}.`;
+        }
+      }
+
+      if (Array.isArray(updated?.connected) && updated.connected.includes(resolved)) {
+        return `Removed stored credentials for ${resolved}${t("providers.still_connected_suffix")}`;
+      }
+      removeProviderFromState(resolved);
+      return `${t("providers.disconnected_prefix")} ${resolved}`;
+    } catch (error) {
+      const message = describeProviderError(error, t("providers.disconnect_failed"));
+      setStateField("providerAuthError", message);
+      throw error instanceof Error ? error : new Error(message);
+    }
+  }
+
+  async function openProviderAuthModal(optionsArg?: {
+    returnFocusTarget?: ProviderReturnFocusTarget;
+    preferredProviderId?: string;
+  }) {
+    mutateState((current) => ({
+      ...current,
+      providerAuthReturnFocusTarget: optionsArg?.returnFocusTarget ?? "none",
+      providerAuthPreferredProviderId: optionsArg?.preferredProviderId?.trim() || null,
+      providerAuthBusy: true,
+      providerAuthError: null,
+    }));
+
+    try {
+      const methods = await loadProviderAuthMethods(getProviderAuthWorkerType());
+      mutateState((current) => ({
+        ...current,
+        providerAuthMethods: methods,
+        providerAuthModalOpen: true,
+      }));
+    } catch (error) {
+      const message = describeProviderError(error, t("providers.load_failed"));
+      mutateState((current) => ({
+        ...current,
+        providerAuthPreferredProviderId: null,
+        providerAuthReturnFocusTarget: "none",
+        providerAuthError: message,
+      }));
+      throw error;
+    } finally {
+      setStateField("providerAuthBusy", false);
+    }
+  }
+
+  function closeProviderAuthModal(optionsArg?: { restorePromptFocus?: boolean }) {
+    const shouldFocusPrompt =
+      optionsArg?.restorePromptFocus ?? state.providerAuthReturnFocusTarget === "composer";
+    mutateState((current) => ({
+      ...current,
+      providerAuthModalOpen: false,
+      providerAuthError: null,
+      providerAuthPreferredProviderId: null,
+      providerAuthReturnFocusTarget: "none",
+    }));
+    if (shouldFocusPrompt) {
+      options.focusPromptSoon?.();
+    }
+  }
+
+  const subscribe = (listener: () => void) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+
+  const currentWorkspaceKey = () =>
+    `${options.selectedWorkspaceRoot().trim()}::${options.runtimeWorkspaceId() ?? ""}`;
+
+  const syncFromOptions = () => {
+    const workspaceKey = currentWorkspaceKey();
+    const workspaceChanged = workspaceKey !== lastWorkspaceKey;
+    lastWorkspaceKey = workspaceKey;
+    refreshSnapshot();
+    emitChange();
+    if (workspaceChanged) {
+      void refreshImportedCloudProviders();
+    }
+    if (!hasCloudProviderSyncPrerequisites()) {
+      cloudProviderSyncContextKey = "";
+      return;
+    }
+
+    const nextSyncContextKey = getCloudProviderSyncContextKey();
+    if (nextSyncContextKey === cloudProviderSyncContextKey) {
+      return;
+    }
+
+    cloudProviderSyncContextKey = nextSyncContextKey;
+    void runCloudProviderSync("app_launch");
+  };
+
+  const start = () => {
+    if (started) return;
+    // StrictMode double-mount re-arms after dispose.
+    disposed = false;
+    started = true;
+    lastWorkspaceKey = currentWorkspaceKey();
+    if (typeof window !== "undefined") {
+      const handleDenSessionUpdate = (event: Event) => {
+        cloudOrgProvidersLoadKey = "";
+        cloudOrgProvidersInFlightKey = "";
+        cloudOrgProvidersInFlight = null;
+        mutateState((current) => ({
+          ...current,
+          cloudOrgProviders: [],
+          providerAuthMethods: {},
+        }));
+        const detail = (event as CustomEvent<DenSessionUpdatedDetail>).detail;
+        if (detail?.status === "success") {
+          void runCloudProviderSync("sign_in");
+        }
+      };
+      window.addEventListener(
+        denSessionUpdatedEvent,
+        handleDenSessionUpdate as EventListener,
+      );
+      denSessionCleanup = () => {
+        window.removeEventListener(
+          denSessionUpdatedEvent,
+          handleDenSessionUpdate as EventListener,
+        );
+      };
+    }
+    void refreshImportedCloudProviders();
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    started = false;
+    denSessionCleanup?.();
+    denSessionCleanup = null;
+    listeners.clear();
+  };
+
+  refreshSnapshot();
+
+  return {
+    subscribe,
+    getSnapshot: () => snapshot,
+    start,
+    dispose,
+    syncFromOptions,
+    refreshCloudOrgProviders,
+    runCloudProviderSync,
+    startProviderAuth,
+    refreshProviders,
+    completeProviderAuthOAuth,
+    submitProviderApiKey,
+    connectCloudProvider,
+    removeCloudProvider,
+    disconnectProvider,
+    openProviderAuthModal,
+    closeProviderAuthModal,
+  };
+}
+
+export function useProviderAuthStoreSnapshot(store: ProviderAuthStore) {
+  return useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+}
diff --git a/apps/app/src/react-app/domains/connections/provider.tsx b/apps/app/src/react-app/domains/connections/provider.tsx
new file mode 100644
index 0000000000..6473da2272
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/provider.tsx
@@ -0,0 +1,33 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useContext,
+  useSyncExternalStore,
+  type ReactNode,
+} from "react";
+
+import type { ConnectionsStore } from "./store";
+
+const ConnectionsContext = createContext<ConnectionsStore | null>(null);
+
+export function ConnectionsProvider(props: {
+  store: ConnectionsStore;
+  children: ReactNode;
+}) {
+  return (
+    <ConnectionsContext.Provider value={props.store}>
+      {props.children}
+    </ConnectionsContext.Provider>
+  );
+}
+
+export function useConnections() {
+  const store = useContext(ConnectionsContext);
+  if (!store) {
+    throw new Error("useConnections must be used within a ConnectionsProvider");
+  }
+
+  useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+
+  return store;
+}
diff --git a/apps/app/src/react-app/domains/connections/store.ts b/apps/app/src/react-app/domains/connections/store.ts
new file mode 100644
index 0000000000..a82d6f367f
--- /dev/null
+++ b/apps/app/src/react-app/domains/connections/store.ts
@@ -0,0 +1,934 @@
+import { useSyncExternalStore } from "react";
+
+import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
+
+import { t } from "../../../i18n";
+import {
+  CHROME_DEVTOOLS_MCP_ID,
+  MCP_QUICK_CONNECT,
+  type McpDirectoryInfo,
+} from "../../../app/constants";
+import { createClient, unwrap } from "../../../app/lib/opencode";
+import { finishPerf, perfNow, recordPerfLog } from "../../../app/lib/perf-log";
+import {
+  getDesktopHomeDir,
+  readOpencodeConfig,
+  writeOpencodeConfig,
+  type OpencodeConfigFile,
+} from "../../../app/lib/desktop";
+import { toSessionTransportDirectory } from "../../../app/lib/session-scope";
+import {
+  parseMcpServersFromContent,
+  removeMcpFromConfig,
+  usesChromeDevtoolsAutoConnect,
+  validateMcpServerName,
+} from "../../../app/mcp";
+import { buildOpenworkWorkspaceBaseUrl } from "../../../app/lib/openwork-server";
+import type {
+  Client,
+  McpServerEntry,
+  McpStatusMap,
+  ReloadReason,
+  ReloadTrigger,
+} from "../../../app/types";
+import { isDesktopRuntime, normalizeDirectoryPath, safeStringify } from "../../../app/utils";
+
+import type { OpenworkServerStore } from "./openwork-server-store";
+
+type SetStateAction<T> = T | ((current: T) => T);
+
+export type ConnectionsStoreSnapshot = {
+  mcpServers: McpServerEntry[];
+  mcpStatus: string | null;
+  mcpLastUpdatedAt: number | null;
+  mcpStatuses: McpStatusMap;
+  mcpConnectingName: string | null;
+  selectedMcp: string | null;
+  mcpAuthModalOpen: boolean;
+  mcpAuthEntry: McpDirectoryInfo | null;
+  mcpAuthNeedsReload: boolean;
+};
+
+type MutableState = ConnectionsStoreSnapshot;
+
+export type ConnectionsStore = ReturnType<typeof createConnectionsStore>;
+
+export function createConnectionsStore(options: {
+  client: () => Client | null;
+  setClient: (value: Client | null) => void;
+  projectDir: () => string;
+  selectedWorkspaceId: () => string;
+  selectedWorkspaceRoot: () => string;
+  workspaceType: () => "local" | "remote";
+  openworkServer: OpenworkServerStore;
+  runtimeWorkspaceId: () => string | null;
+  ensureRuntimeWorkspaceId?: () => Promise<string | null | undefined>;
+  setProjectDir?: (value: string) => void;
+  developerMode: () => boolean;
+  markReloadRequired?: (reason: ReloadReason, trigger?: ReloadTrigger) => void;
+}) {
+  const listeners = new Set<() => void>();
+
+  let started = false;
+  let disposed = false;
+  let lastWorkspaceContextKey = "";
+  let lastProjectDir = "";
+  let snapshot: ConnectionsStoreSnapshot;
+
+  let state: MutableState = {
+    mcpServers: [],
+    mcpStatus: null,
+    mcpLastUpdatedAt: null,
+    mcpStatuses: {},
+    mcpConnectingName: null,
+    selectedMcp: null,
+    mcpAuthModalOpen: false,
+    mcpAuthEntry: null,
+    mcpAuthNeedsReload: false,
+  };
+
+  const emitChange = () => {
+    for (const listener of listeners) listener();
+  };
+
+  const refreshSnapshot = () => {
+    snapshot = {
+      mcpServers: state.mcpServers,
+      mcpStatus: state.mcpStatus,
+      mcpLastUpdatedAt: state.mcpLastUpdatedAt,
+      mcpStatuses: state.mcpStatuses,
+      mcpConnectingName: state.mcpConnectingName,
+      selectedMcp: state.selectedMcp,
+      mcpAuthModalOpen: state.mcpAuthModalOpen,
+      mcpAuthEntry: state.mcpAuthEntry,
+      mcpAuthNeedsReload: state.mcpAuthNeedsReload,
+    };
+  };
+
+  const mutateState = (updater: (current: MutableState) => MutableState) => {
+    state = updater(state);
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const setStateField = <K extends keyof MutableState>(key: K, value: MutableState[K]) => {
+    if (Object.is(state[key], value)) return;
+    mutateState((current) => ({ ...current, [key]: value }));
+  };
+
+  const applyStateAction = <T,>(current: T, next: SetStateAction<T>) =>
+    typeof next === "function" ? (next as (value: T) => T)(current) : next;
+
+  const getWorkspaceContextKey = () => {
+    const workspaceId = options.selectedWorkspaceId().trim();
+    const root = normalizeDirectoryPath(options.selectedWorkspaceRoot().trim());
+    const runtimeWorkspaceId = (options.runtimeWorkspaceId() ?? "").trim();
+    const workspaceType = options.workspaceType();
+    return `${workspaceType}:${workspaceId}:${root}:${runtimeWorkspaceId}`;
+  };
+
+  const getOpenworkSnapshot = () => options.openworkServer.getSnapshot();
+
+  const filterConfiguredStatuses = (status: McpStatusMap, entries: McpServerEntry[]) => {
+    const configured = new Set(entries.map((entry) => entry.name));
+    return Object.fromEntries(
+      Object.entries(status).filter(([name]) => configured.has(name)),
+    ) as McpStatusMap;
+  };
+
+  const readMcpConfigFile = async (scope: "project" | "global"): Promise<OpencodeConfigFile | null> => {
+    const projectDir = options.projectDir().trim();
+    const openworkSnapshot = getOpenworkSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.config?.read;
+
+    if (canUseOpenworkServer && openworkClient && openworkWorkspaceId) {
+      return openworkClient.readOpencodeConfigFile(openworkWorkspaceId, scope);
+    }
+
+    if (!isDesktopRuntime()) {
+      return null;
+    }
+
+    return readOpencodeConfig(scope, projectDir);
+  };
+
+  const ensureActiveClient = async () => {
+    let activeClient = options.client();
+    if (activeClient) {
+      return activeClient;
+    }
+
+    const openworkSnapshot = getOpenworkSnapshot();
+    const openworkBaseUrl = openworkSnapshot.openworkServerBaseUrl.trim();
+    const token = openworkSnapshot.openworkServerAuth.token?.trim();
+    if (!openworkBaseUrl || !token) {
+      return null;
+    }
+
+    const mountedBaseUrl =
+      buildOpenworkWorkspaceBaseUrl(openworkBaseUrl, options.runtimeWorkspaceId()) ?? openworkBaseUrl;
+    activeClient = createClient(`${mountedBaseUrl.replace(/\/+$/, "")}/opencode`, undefined, {
+      token,
+      mode: "openwork",
+    });
+    options.setClient(activeClient);
+    return activeClient;
+  };
+
+  const resolveWritableOpenworkTarget = async () => {
+    const openworkSnapshot = getOpenworkSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    let openworkWorkspaceId = options.runtimeWorkspaceId();
+    const openworkCapabilities = openworkSnapshot.openworkServerCapabilities;
+    if (!openworkWorkspaceId && openworkClient && openworkSnapshot.openworkServerStatus === "connected") {
+      openworkWorkspaceId = (await options.ensureRuntimeWorkspaceId?.()) ?? null;
+    }
+
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkCapabilities?.mcp?.write;
+
+    return {
+      openworkClient,
+      openworkWorkspaceId,
+      canUseOpenworkServer: Boolean(canUseOpenworkServer),
+    };
+  };
+
+  const resolveProjectDir = async (activeClient: Client | null, currentProjectDir: string) => {
+    let resolvedProjectDir = currentProjectDir;
+    if (!resolvedProjectDir && activeClient) {
+      try {
+        const pathInfo = unwrap(await activeClient.path.get());
+        const discoveredRaw = toSessionTransportDirectory(pathInfo.directory ?? "");
+        const discovered = discoveredRaw.replace(/^\/private\/tmp(?=\/|$)/, "/tmp");
+        if (discovered) {
+          resolvedProjectDir = discovered;
+          options.setProjectDir?.(discovered);
+        }
+      } catch {
+        // ignore
+      }
+    }
+
+    return resolvedProjectDir;
+  };
+
+  const listMcpFromOpenworkServer = async (projectDir: string) => {
+    const openworkSnapshot = getOpenworkSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId =
+      options.runtimeWorkspaceId()?.trim() ||
+      options.selectedWorkspaceId().trim() ||
+      ((await options.ensureRuntimeWorkspaceId?.()) ?? "")?.trim();
+    const canTryOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      Boolean(openworkClient) &&
+      Boolean(openworkWorkspaceId) &&
+      openworkSnapshot.openworkServerCapabilities?.mcp?.read !== false;
+
+    recordPerfLog(options.developerMode(), "mcp.refresh", "server-path-check", {
+      workspaceType: options.workspaceType(),
+      projectDir: projectDir || null,
+      openworkStatus: openworkSnapshot.openworkServerStatus,
+      hasOpenworkClient: Boolean(openworkClient),
+      openworkWorkspaceId: openworkWorkspaceId || null,
+      canReadMcp: openworkSnapshot.openworkServerCapabilities?.mcp?.read ?? null,
+      canTryOpenworkServer,
+    });
+
+    if (!canTryOpenworkServer || !openworkClient || !openworkWorkspaceId) return null;
+
+    const response = await openworkClient.listMcp(openworkWorkspaceId);
+    const next = response.items.map((entry) => ({
+      name: entry.name,
+      config: entry.config as McpServerEntry["config"],
+      source: entry.source,
+    }));
+
+    let nextStatuses: McpStatusMap = {};
+    const activeClient = options.client();
+    if (activeClient && projectDir) {
+      try {
+        const status = unwrap(await activeClient.mcp.status({ directory: projectDir }));
+        nextStatuses = filterConfiguredStatuses(status as McpStatusMap, next);
+      } catch {
+        nextStatuses = {};
+      }
+    }
+
+    recordPerfLog(options.developerMode(), "mcp.refresh", "server-path-result", {
+      count: next.length,
+      names: next.map((entry) => entry.name),
+      sources: next.map((entry) => entry.source ?? "unknown"),
+    });
+
+    return { next, nextStatuses };
+  };
+
+  async function refreshMcpServers() {
+    if (disposed) return;
+
+    const projectDir = options.projectDir().trim();
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+
+    try {
+      setStateField("mcpStatus", null);
+      const serverResult = await listMcpFromOpenworkServer(projectDir);
+      if (serverResult) {
+        mutateState((current) => ({
+          ...current,
+          mcpServers: serverResult.next,
+          mcpLastUpdatedAt: Date.now(),
+          mcpStatuses: serverResult.nextStatuses,
+          mcpStatus: serverResult.next.length ? null : "No MCP servers configured yet.",
+        }));
+        return;
+      }
+    } catch (error) {
+      recordPerfLog(options.developerMode(), "mcp.refresh", "server-path-error", {
+        message: error instanceof Error ? error.message : String(error),
+      });
+      if (isRemoteWorkspace) {
+        mutateState((current) => ({
+          ...current,
+          mcpServers: [],
+          mcpStatuses: {},
+          mcpStatus: error instanceof Error ? error.message : "Failed to load MCP servers",
+        }));
+        return;
+      }
+    }
+
+    if (isRemoteWorkspace) {
+      mutateState((current) => ({
+        ...current,
+        mcpStatus: "OpenWork server unavailable. MCP config is read-only.",
+        mcpServers: [],
+        mcpStatuses: {},
+      }));
+      return;
+    }
+
+    if (!isDesktopRuntime()) {
+      mutateState((current) => ({
+        ...current,
+        mcpStatus: "MCP configuration is only available for local workspaces.",
+        mcpServers: [],
+        mcpStatuses: {},
+      }));
+      return;
+    }
+
+    if (!projectDir) {
+      mutateState((current) => ({
+        ...current,
+        mcpStatus: "Pick a workspace folder to load MCP servers.",
+        mcpServers: [],
+        mcpStatuses: {},
+      }));
+      return;
+    }
+
+    try {
+      setStateField("mcpStatus", null);
+      recordPerfLog(options.developerMode(), "mcp.refresh", "desktop-project-fallback", {
+        projectDir,
+      });
+      const [globalConfig, projectConfig] = await Promise.all([
+        readOpencodeConfig("global", projectDir),
+        readOpencodeConfig("project", projectDir),
+      ]);
+      const globalServers = globalConfig.exists && globalConfig.content
+        ? parseMcpServersFromContent(globalConfig.content).map((entry) => ({
+          ...entry,
+          source: "config.global" as const,
+        }))
+        : [];
+      const projectServers = projectConfig.exists && projectConfig.content
+        ? parseMcpServersFromContent(projectConfig.content)
+        : [];
+      const projectNames = new Set(projectServers.map((entry) => entry.name));
+      const next = [
+        ...globalServers.filter((entry) => !projectNames.has(entry.name)),
+        ...projectServers,
+      ];
+
+      recordPerfLog(options.developerMode(), "mcp.refresh", "desktop-project-fallback-result", {
+        globalConfigPath: globalConfig.path,
+        projectConfigPath: projectConfig.path,
+        count: next.length,
+        names: next.map((entry) => entry.name),
+        sources: next.map((entry) => entry.source ?? "unknown"),
+      });
+
+      if (!globalConfig.exists && !projectConfig.exists) {
+        mutateState((current) => ({
+          ...current,
+          mcpServers: [],
+          mcpStatuses: {},
+          mcpStatus: "No opencode.json found yet. Create one by connecting an MCP.",
+        }));
+        return;
+      }
+
+      let nextStatuses = state.mcpStatuses;
+      const activeClient = options.client();
+      if (activeClient) {
+        try {
+          const status = unwrap(await activeClient.mcp.status({ directory: projectDir }));
+          nextStatuses = filterConfiguredStatuses(status as McpStatusMap, next);
+        } catch {
+          nextStatuses = {};
+        }
+      }
+
+      mutateState((current) => ({
+        ...current,
+        mcpServers: next,
+        mcpLastUpdatedAt: Date.now(),
+        mcpStatuses: nextStatuses,
+        mcpStatus: next.length ? null : "No MCP servers configured yet.",
+      }));
+    } catch (error) {
+      mutateState((current) => ({
+        ...current,
+        mcpServers: [],
+        mcpStatuses: {},
+        mcpStatus: error instanceof Error ? error.message : "Failed to load MCP servers",
+      }));
+    }
+  }
+
+  async function connectMcp(entry: McpDirectoryInfo) {
+    const startedAt = perfNow();
+    const openworkSnapshot = getOpenworkSnapshot();
+    const isRemoteWorkspace =
+      options.workspaceType() === "remote" ||
+      (!isDesktopRuntime() && openworkSnapshot.openworkServerStatus === "connected");
+    const projectDir = options.projectDir().trim();
+    const entryType = entry.type ?? "remote";
+
+    recordPerfLog(options.developerMode(), "mcp.connect", "start", {
+      name: entry.name,
+      type: entryType,
+      workspaceType: isRemoteWorkspace ? "remote" : "local",
+      projectDir: projectDir || null,
+    });
+
+    const { openworkClient, openworkWorkspaceId, canUseOpenworkServer } =
+      await resolveWritableOpenworkTarget();
+
+    if (isRemoteWorkspace && !canUseOpenworkServer) {
+      setStateField("mcpStatus", "OpenWork server unavailable. MCP config is read-only.");
+      finishPerf(options.developerMode(), "mcp.connect", "blocked", startedAt, {
+        reason: "openwork-server-unavailable",
+      });
+      return;
+    }
+
+    if (!canUseOpenworkServer && !isDesktopRuntime()) {
+      setStateField("mcpStatus", t("mcp.desktop_required"));
+      finishPerf(options.developerMode(), "mcp.connect", "blocked", startedAt, {
+        reason: "desktop-required",
+      });
+      return;
+    }
+
+    if (!isRemoteWorkspace && !projectDir) {
+      setStateField("mcpStatus", t("mcp.pick_workspace_first"));
+      finishPerf(options.developerMode(), "mcp.connect", "blocked", startedAt, {
+        reason: "missing-workspace",
+      });
+      return;
+    }
+
+    const activeClient = await ensureActiveClient();
+    if (!activeClient) {
+      setStateField("mcpStatus", t("mcp.connect_server_first"));
+      finishPerf(options.developerMode(), "mcp.connect", "blocked", startedAt, {
+        reason: "no-active-client",
+      });
+      return;
+    }
+
+    const resolvedProjectDir = await resolveProjectDir(activeClient, projectDir);
+    if (!resolvedProjectDir) {
+      setStateField("mcpStatus", t("mcp.pick_workspace_first"));
+      finishPerf(options.developerMode(), "mcp.connect", "blocked", startedAt, {
+        reason: "missing-workspace-after-discovery",
+      });
+      return;
+    }
+
+    const slug = entry.id ?? entry.name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    const action = snapshot.mcpServers.some((server) => server.name === slug) ? "updated" : "added";
+
+    try {
+      mutateState((current) => ({ ...current, mcpStatus: null, mcpConnectingName: entry.name }));
+
+      let mcpEnvironment: Record<string, string> | undefined;
+
+      const mcpEntryConfig: Record<string, unknown> = {
+        type: entryType,
+        enabled: true,
+      };
+
+      if (entryType === "remote") {
+        if (!entry.url) {
+          throw new Error("Missing MCP URL.");
+        }
+        mcpEntryConfig["url"] = entry.url;
+        if (entry.oauth) {
+          mcpEntryConfig["oauth"] = {};
+        }
+      }
+
+      if (entryType === "local") {
+        if (!entry.command?.length) {
+          throw new Error("Missing MCP command.");
+        }
+        mcpEntryConfig["command"] = entry.command;
+
+        if (
+          slug === CHROME_DEVTOOLS_MCP_ID &&
+          usesChromeDevtoolsAutoConnect(entry.command) &&
+          isDesktopRuntime()
+        ) {
+          try {
+            const hostHome = (await getDesktopHomeDir()).replace(/[\\/]+$/, "");
+            if (hostHome) {
+              mcpEnvironment = { HOME: hostHome };
+              mcpEntryConfig["environment"] = mcpEnvironment;
+            }
+          } catch {
+            // ignore and let the MCP use the default worker environment
+          }
+        }
+      }
+
+      if (canUseOpenworkServer && openworkClient && openworkWorkspaceId) {
+        await openworkClient.addMcp(openworkWorkspaceId, {
+          name: slug,
+          config: mcpEntryConfig,
+        });
+      } else {
+        const configFile = await readOpencodeConfig("project", resolvedProjectDir);
+
+        const raw = configFile.exists && configFile.content?.trim()
+          ? configFile.content
+          : '{\n  "$schema": "https://opencode.ai/config.json"\n}\n';
+
+        const parseErrors: Array<{ error: number; offset: number; length: number }> = [];
+        parse(raw, parseErrors, { allowTrailingComma: true });
+        if (parseErrors.length > 0) {
+          const details = parseErrors
+            .map((entry) => printParseErrorCode(entry.error))
+            .join(", ");
+          throw new Error(`Failed to parse opencode config: ${details}`);
+        }
+
+        let updated = raw;
+        const formattingOptions = { insertSpaces: true, tabSize: 2, eol: "\n" };
+        updated = applyEdits(
+          updated,
+          modify(updated, ["$schema"], "https://opencode.ai/config.json", { formattingOptions }),
+        );
+        updated = applyEdits(
+          updated,
+          modify(updated, ["mcp", slug], mcpEntryConfig, { formattingOptions }),
+        );
+
+        const writeResult = await writeOpencodeConfig(
+          "project",
+          resolvedProjectDir,
+          updated.endsWith("\n") ? updated : `${updated}\n`,
+        );
+        if (!writeResult.ok) {
+          throw new Error(writeResult.stderr || writeResult.stdout || "Failed to write opencode.json");
+        }
+      }
+
+      if (canUseOpenworkServer && openworkClient && openworkWorkspaceId) {
+        // The OpenWork server is the source of truth for workspace-scoped MCP
+        // config in the React port. Avoid also calling the OpenCode SDK's MCP
+        // hot-add endpoint here: when the SDK client is rooted at the aggregate
+        // `/opencode` route it can resolve to an internal `local_*` workspace
+        // id that the OpenWork server does not expose, producing a confusing
+        // `workspace_not_found` after the config write already succeeded.
+        setStateField("mcpStatuses", filterConfiguredStatuses(snapshot.mcpStatuses, snapshot.mcpServers));
+      } else {
+        const mcpAddConfig =
+          entryType === "remote"
+            ? {
+                type: "remote" as const,
+                url: entry.url!,
+                enabled: true,
+                ...(entry.oauth ? { oauth: {} } : {}),
+              }
+            : {
+                type: "local" as const,
+                command: entry.command!,
+                enabled: true,
+                ...(mcpEnvironment ? { environment: mcpEnvironment } : {}),
+              };
+
+        const status = unwrap(
+          await activeClient.mcp.add({
+            directory: resolvedProjectDir,
+            name: slug,
+            config: mcpAddConfig,
+          }),
+        );
+
+        setStateField("mcpStatuses", status as McpStatusMap);
+      }
+      options.markReloadRequired?.("mcp", { type: "mcp", name: slug, action });
+      await refreshMcpServers();
+
+      if (entry.oauth) {
+        mutateState((current) => ({
+          ...current,
+          mcpAuthEntry: entry,
+          mcpAuthNeedsReload: true,
+          mcpAuthModalOpen: true,
+        }));
+      } else {
+        setStateField("mcpStatus", t("mcp.connected"));
+      }
+
+      await refreshMcpServers();
+      finishPerf(options.developerMode(), "mcp.connect", "done", startedAt, {
+        name: entry.name,
+        type: entryType,
+        slug,
+      });
+    } catch (error) {
+      setStateField(
+        "mcpStatus",
+        error instanceof Error ? error.message : t("mcp.connect_failed"),
+      );
+      finishPerf(options.developerMode(), "mcp.connect", "error", startedAt, {
+        name: entry.name,
+        type: entryType,
+        error: error instanceof Error ? error.message : safeStringify(error),
+      });
+    } finally {
+      setStateField("mcpConnectingName", null);
+    }
+  }
+
+  function authorizeMcp(entry: McpServerEntry) {
+    if (entry.config.type !== "remote" || entry.config.oauth === false) {
+      setStateField("mcpStatus", t("mcp.login_unavailable"));
+      return;
+    }
+
+    const matchingQuickConnect = MCP_QUICK_CONNECT.find((candidate) => {
+      const candidateSlug = candidate.name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+      return candidateSlug === entry.name || candidate.name === entry.name;
+    });
+
+    mutateState((current) => ({
+      ...current,
+      mcpAuthEntry:
+        matchingQuickConnect ?? {
+          name: entry.name,
+          description: "",
+          type: "remote",
+          url: entry.config.url,
+          oauth: true,
+        },
+      mcpAuthNeedsReload: false,
+      mcpAuthModalOpen: true,
+    }));
+  }
+
+  async function logoutMcpAuth(name: string) {
+    const openworkSnapshot = getOpenworkSnapshot();
+    const isRemoteWorkspace =
+      options.workspaceType() === "remote" ||
+      (!isDesktopRuntime() && openworkSnapshot.openworkServerStatus === "connected");
+    const projectDir = options.projectDir().trim();
+
+    const { openworkClient, openworkWorkspaceId, canUseOpenworkServer } =
+      await resolveWritableOpenworkTarget();
+
+    if (isRemoteWorkspace && !canUseOpenworkServer) {
+      setStateField("mcpStatus", "OpenWork server unavailable. MCP auth is read-only.");
+      return;
+    }
+
+    if (!canUseOpenworkServer && !isDesktopRuntime()) {
+      setStateField("mcpStatus", t("mcp.desktop_required"));
+      return;
+    }
+
+    const activeClient = await ensureActiveClient();
+    if (!activeClient) {
+      setStateField("mcpStatus", t("mcp.connect_server_first"));
+      return;
+    }
+
+    const resolvedProjectDir = await resolveProjectDir(activeClient, projectDir);
+    if (!resolvedProjectDir) {
+      setStateField("mcpStatus", t("mcp.pick_workspace_first"));
+      return;
+    }
+
+    const safeName = validateMcpServerName(name);
+    setStateField("mcpStatus", null);
+
+    try {
+      if (canUseOpenworkServer && openworkClient && openworkWorkspaceId) {
+        await openworkClient.logoutMcpAuth(openworkWorkspaceId, safeName);
+      } else {
+        try {
+          await activeClient.mcp.disconnect({ directory: resolvedProjectDir, name: safeName });
+        } catch {
+          // ignore
+        }
+        await activeClient.mcp.auth.remove({ directory: resolvedProjectDir, name: safeName });
+      }
+
+      try {
+        const status = unwrap(await activeClient.mcp.status({ directory: resolvedProjectDir }));
+        setStateField("mcpStatuses", status as McpStatusMap);
+      } catch {
+        // ignore
+      }
+
+      await refreshMcpServers();
+      setStateField("mcpStatus", t("mcp.logout_success").replace("{server}", safeName));
+    } catch (error) {
+      setStateField(
+        "mcpStatus",
+        error instanceof Error ? error.message : t("mcp.logout_failed"),
+      );
+    }
+  }
+
+  async function removeMcp(name: string) {
+    try {
+      setStateField("mcpStatus", null);
+
+      const openworkSnapshot = getOpenworkSnapshot();
+      const openworkClient = openworkSnapshot.openworkServerClient;
+      const openworkWorkspaceId = options.runtimeWorkspaceId();
+      const canUseOpenworkServer =
+        openworkSnapshot.openworkServerStatus === "connected" &&
+        openworkClient &&
+        openworkWorkspaceId &&
+        openworkSnapshot.openworkServerCapabilities?.mcp?.write;
+
+      if (canUseOpenworkServer && openworkClient && openworkWorkspaceId) {
+        await openworkClient.removeMcp(openworkWorkspaceId, name);
+      } else {
+        const projectDir = options.projectDir().trim();
+        if (!projectDir) {
+          setStateField("mcpStatus", t("mcp.pick_workspace_first"));
+          return;
+        }
+        await removeMcpFromConfig(projectDir, name);
+      }
+
+      options.markReloadRequired?.("mcp", { type: "mcp", name, action: "removed" });
+      await refreshMcpServers();
+      if (snapshot.selectedMcp === name) {
+        setStateField("selectedMcp", null);
+      }
+      setStateField("mcpStatus", null);
+    } catch (error) {
+      setStateField(
+        "mcpStatus",
+        error instanceof Error ? error.message : t("mcp.remove_failed"),
+      );
+    }
+  }
+
+  function notifyMcpReloading() {
+    setStateField("mcpStatus", t("mcp.reloading_status"));
+  }
+
+  // OpenCode reconnects MCP servers asynchronously after /instance/dispose,
+  // so an immediate mcp.status query returns stale "disconnected". Poll on
+  // a backoff until every enabled MCP reaches a terminal status, with the
+  // banner up the whole time so users see continuous feedback.
+  async function pollMcpServersAfterReload(): Promise<void> {
+    if (disposed) return;
+    notifyMcpReloading();
+    await refreshMcpServers();
+
+    const settled = (statuses: McpStatusMap, servers: McpServerEntry[]) => {
+      const expected = servers.filter((s) => s.config.enabled !== false);
+      if (expected.length === 0) return true;
+      return expected.every((server) => {
+        const status = statuses[server.name]?.status;
+        return status === "connected" || status === "needs_auth" || status === "failed";
+      });
+    };
+
+    const delays = [400, 800, 1500, 2500, 4000];
+    for (const delay of delays) {
+      if (disposed) return;
+      if (settled(snapshot.mcpStatuses, snapshot.mcpServers)) break;
+      await new Promise((resolve) => setTimeout(resolve, delay));
+      await refreshMcpServers();
+    }
+
+    if (disposed) return;
+    // Only clear the reloading banner if it's still ours. refreshMcpServers
+    // may have already replaced it with a real message (e.g. "No MCP servers").
+    if (snapshot.mcpStatus === t("mcp.reloading_status")) {
+      setStateField("mcpStatus", null);
+    }
+  }
+
+  // Server-only path. Local fallback would rewrite opencode.jsonc whole and
+  // clobber inline comments — settings-route.tsx already gates the prop so
+  // this never gets called when the server is unavailable. Reload UX comes
+  // from the existing reload-required popup; no extra banner here.
+  async function setMcpEnabled(name: string, enabled: boolean) {
+    try {
+      const openworkSnapshot = getOpenworkSnapshot();
+      const openworkClient = openworkSnapshot.openworkServerClient;
+      const openworkWorkspaceId = options.runtimeWorkspaceId();
+      const canUseOpenworkServer =
+        openworkSnapshot.openworkServerStatus === "connected" &&
+        openworkClient &&
+        openworkWorkspaceId &&
+        openworkSnapshot.openworkServerCapabilities?.mcp?.write;
+
+      if (!canUseOpenworkServer || !openworkClient || !openworkWorkspaceId) {
+        setStateField("mcpStatus", t("mcp.toggle_requires_server"));
+        return;
+      }
+
+      await openworkClient.setMcpEnabled(openworkWorkspaceId, name, enabled);
+      options.markReloadRequired?.("mcp", { type: "mcp", name, action: "updated" });
+      await refreshMcpServers();
+    } catch (error) {
+      setStateField(
+        "mcpStatus",
+        error instanceof Error ? error.message : t("mcp.toggle_failed"),
+      );
+    }
+  }
+
+  function closeMcpAuthModal() {
+    mutateState((current) => ({
+      ...current,
+      mcpAuthModalOpen: false,
+      mcpAuthEntry: null,
+      mcpAuthNeedsReload: false,
+    }));
+  }
+
+  async function completeMcpAuthModal() {
+    closeMcpAuthModal();
+    await refreshMcpServers();
+  }
+
+  const syncFromOptions = () => {
+    const workspaceContextKey = getWorkspaceContextKey();
+    const projectDir = options.projectDir().trim();
+    const changed =
+      workspaceContextKey !== lastWorkspaceContextKey || projectDir !== lastProjectDir;
+
+    lastWorkspaceContextKey = workspaceContextKey;
+    lastProjectDir = projectDir;
+
+    if (!started || disposed || !isDesktopRuntime() || !changed) {
+      return;
+    }
+
+    void refreshMcpServers();
+  };
+
+  const start = () => {
+    if (started) return;
+    // StrictMode double-mount re-arms after dispose.
+    disposed = false;
+    started = true;
+    syncFromOptions();
+  };
+
+  const dispose = () => {
+    disposed = true;
+    started = false;
+  };
+
+  refreshSnapshot();
+
+  const subscribe = (listener: () => void) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+
+  const getSnapshot = () => snapshot;
+
+  return {
+    subscribe,
+    getSnapshot,
+    start,
+    dispose,
+    syncFromOptions,
+    get mcpServers() {
+      return snapshot.mcpServers;
+    },
+    get mcpStatus() {
+      return snapshot.mcpStatus;
+    },
+    get mcpLastUpdatedAt() {
+      return snapshot.mcpLastUpdatedAt;
+    },
+    get mcpStatuses() {
+      return snapshot.mcpStatuses;
+    },
+    get mcpConnectingName() {
+      return snapshot.mcpConnectingName;
+    },
+    get selectedMcp() {
+      return snapshot.selectedMcp;
+    },
+    setSelectedMcp(value: SetStateAction<string | null>) {
+      const resolved = applyStateAction(state.selectedMcp, value);
+      setStateField("selectedMcp", resolved);
+    },
+    quickConnect: MCP_QUICK_CONNECT,
+    readMcpConfigFile,
+    refreshMcpServers,
+    connectMcp,
+    authorizeMcp,
+    logoutMcpAuth,
+    removeMcp,
+    setMcpEnabled,
+    notifyMcpReloading,
+    pollMcpServersAfterReload,
+    get mcpAuthModalOpen() {
+      return snapshot.mcpAuthModalOpen;
+    },
+    get mcpAuthEntry() {
+      return snapshot.mcpAuthEntry;
+    },
+    get mcpAuthNeedsReload() {
+      return snapshot.mcpAuthNeedsReload;
+    },
+    closeMcpAuthModal,
+    completeMcpAuthModal,
+  };
+}
+
+export function useConnectionsStoreSnapshot(store: ConnectionsStore) {
+  return useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+}
diff --git a/apps/app/src/react-app/domains/onboarding/welcome-page.tsx b/apps/app/src/react-app/domains/onboarding/welcome-page.tsx
new file mode 100644
index 0000000000..f84818012e
--- /dev/null
+++ b/apps/app/src/react-app/domains/onboarding/welcome-page.tsx
@@ -0,0 +1,93 @@
+/** @jsxImportSource react */
+import { FileSpreadsheet, Globe, FolderOpen, Bot, FileText, Plug } from "lucide-react";
+import { t } from "../../../i18n";
+
+type CapabilityCardProps = {
+  icon: React.ReactNode;
+  title: string;
+  description: string;
+};
+
+function CapabilityCard({ icon, title, description }: CapabilityCardProps) {
+  return (
+    <div className="flex flex-col items-center gap-2 rounded-2xl border border-dls-border bg-dls-surface p-5 text-center transition-colors">
+      <div className="flex h-10 w-10 items-center justify-center rounded-xl border border-dls-border bg-dls-hover text-dls-secondary">
+        {icon}
+      </div>
+      <div className="text-[14px] font-medium text-dls-text">{title}</div>
+      <div className="text-[12px] leading-relaxed text-dls-secondary">
+        {description}
+      </div>
+    </div>
+  );
+}
+
+type WelcomePageProps = {
+  onGetStarted: () => void;
+};
+
+export function WelcomePage({ onGetStarted }: WelcomePageProps) {
+  return (
+    <div className="flex min-h-screen w-full items-center justify-center bg-dls-background p-6">
+      <div className="mx-auto w-full max-w-[640px] space-y-10">
+        {/* Header */}
+        <div className="space-y-3 text-center">
+          <div className="mx-auto flex h-16 w-16 items-center justify-center rounded-3xl border border-dls-border bg-dls-surface shadow-sm">
+            <Bot size={28} className="text-dls-accent" />
+          </div>
+          <h1 className="text-[28px] font-semibold tracking-[-0.5px] text-dls-text">
+            {t("welcome.title")}
+          </h1>
+          <p className="text-[16px] text-dls-secondary">
+            {t("welcome.subtitle")}
+          </p>
+        </div>
+
+        {/* Capability grid */}
+        <div className="grid grid-cols-2 gap-3 sm:grid-cols-3">
+          <CapabilityCard
+            icon={<FileSpreadsheet size={20} />}
+            title={t("welcome.capability_spreadsheets")}
+            description={t("welcome.capability_spreadsheets_desc")}
+          />
+          <CapabilityCard
+            icon={<Globe size={20} />}
+            title={t("welcome.capability_browser")}
+            description={t("welcome.capability_browser_desc")}
+          />
+          <CapabilityCard
+            icon={<FolderOpen size={20} />}
+            title={t("welcome.capability_files")}
+            description={t("welcome.capability_files_desc")}
+          />
+          <CapabilityCard
+            icon={<Bot size={20} />}
+            title={t("welcome.capability_automate")}
+            description={t("welcome.capability_automate_desc")}
+          />
+          <CapabilityCard
+            icon={<FileText size={20} />}
+            title={t("welcome.capability_content")}
+            description={t("welcome.capability_content_desc")}
+          />
+          <CapabilityCard
+            icon={<Plug size={20} />}
+            title={t("welcome.capability_apis")}
+            description={t("welcome.capability_apis_desc")}
+          />
+        </div>
+
+        {/* CTA */}
+        <div className="flex justify-center">
+          <button
+            type="button"
+            onClick={onGetStarted}
+            className="inline-flex items-center justify-center gap-2 rounded-full bg-dls-accent px-8 py-3 text-[15px] font-medium text-white transition-colors hover:bg-[var(--dls-accent-hover)] focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.18)]"
+          >
+            {t("welcome.get_started")}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/chat/permission-approval-modal.tsx b/apps/app/src/react-app/domains/session/chat/permission-approval-modal.tsx
new file mode 100644
index 0000000000..ec0020f29a
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/chat/permission-approval-modal.tsx
@@ -0,0 +1,364 @@
+/** @jsxImportSource react */
+import { Check, ChevronRight, Clock3, HardDrive, RefreshCcw, ShieldCheck, XCircle } from "lucide-react";
+import { useEffect, useMemo, useRef, type KeyboardEvent } from "react";
+
+import { t } from "../../../../i18n";
+import type { PendingPermission } from "../../../../app/types";
+import { Button } from "../../../design-system/button";
+
+type PermissionPresentation = {
+  title: string;
+  message: string;
+  permissionLabel: string;
+  scopeLabel: string;
+  scopeValue: string;
+  isDoomLoop: boolean;
+  note: string | null;
+};
+
+type PermissionDetail = {
+  label: string;
+  value: string;
+  multiline?: boolean;
+};
+
+type PermissionApprovalModalProps = {
+  permission: PendingPermission;
+  busy?: boolean;
+  respondPermission?: (requestID: string, reply: "once" | "always" | "reject") => void;
+  safeStringify?: (value: unknown) => string;
+};
+
+const metadataDetailKeys: Array<{ key: string; labelKey: string; multiline?: boolean }> = [
+  { key: "command", labelKey: "session.permission_detail_command", multiline: true },
+  { key: "description", labelKey: "session.permission_detail_description" },
+  { key: "cwd", labelKey: "session.permission_detail_cwd" },
+  { key: "filepath", labelKey: "session.permission_detail_file" },
+  { key: "filePath", labelKey: "session.permission_detail_file" },
+  { key: "path", labelKey: "session.permission_detail_path" },
+  { key: "target", labelKey: "session.permission_detail_target" },
+  { key: "parentDir", labelKey: "session.permission_detail_parent_directory" },
+  { key: "url", labelKey: "session.permission_detail_url" },
+  { key: "query", labelKey: "session.permission_detail_query", multiline: true },
+  { key: "subagent_type", labelKey: "session.permission_detail_agent" },
+  { key: "tool", labelKey: "session.permission_detail_tool" },
+  { key: "files", labelKey: "session.permission_detail_files", multiline: true },
+  { key: "diff", labelKey: "session.permission_detail_diff", multiline: true },
+];
+
+function readablePermissionLabel(permission: string): string {
+  if (permission === "bash") return "Bash";
+  if (permission === "edit") return t("session.permission_kind_edit");
+  if (permission === "read") return t("session.permission_kind_read");
+  if (permission === "external_directory") return t("session.permission_kind_external_directory");
+  if (permission === "task") return t("session.permission_kind_task");
+  if (permission === "todowrite") return t("session.permission_kind_todowrite");
+  if (permission === "question") return t("session.permission_kind_question");
+  if (permission === "skill") return t("session.permission_kind_skill");
+  return permission;
+}
+
+function permissionCopy(permission: string): Pick<PermissionPresentation, "title" | "message"> {
+  if (permission === "bash") {
+    return {
+      title: t("session.permission_title_bash"),
+      message: t("session.permission_message_bash"),
+    };
+  }
+  if (permission === "edit") {
+    return {
+      title: t("session.permission_title_edit"),
+      message: t("session.permission_message_edit"),
+    };
+  }
+  if (permission === "read") {
+    return {
+      title: t("session.permission_title_read"),
+      message: t("session.permission_message_read"),
+    };
+  }
+  if (permission === "external_directory") {
+    return {
+      title: t("session.permission_title_external_directory"),
+      message: t("session.permission_message_external_directory"),
+    };
+  }
+  if (permission === "task") {
+    return {
+      title: t("session.permission_title_task"),
+      message: t("session.permission_message_task"),
+    };
+  }
+  return {
+    title: t("session.permission_title_generic", undefined, { permission: readablePermissionLabel(permission) }),
+    message: t("session.permission_message"),
+  };
+}
+
+function fileChangeLine(value: unknown): string | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const path =
+    (typeof record.relativePath === "string" && record.relativePath.trim()) ||
+    (typeof record.filePath === "string" && record.filePath.trim()) ||
+    (typeof record.path === "string" && record.path.trim()) ||
+    null;
+  if (!path) return null;
+  const type = typeof record.type === "string" && record.type.trim() ? record.type.trim() : "change";
+  return `${type}: ${path}`;
+}
+
+function metadataValue(key: string, value: unknown): string | null {
+  if (typeof value === "string") return value.trim() || null;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (key === "files" && Array.isArray(value)) {
+    const lines = value.map(fileChangeLine).filter(Boolean);
+    return lines.length ? lines.join("\n") : null;
+  }
+  return null;
+}
+
+export function permissionDetailRows(metadata: Record<string, unknown>): PermissionDetail[] {
+  const seen = new Set<string>();
+  const rows: PermissionDetail[] = [];
+  for (const item of metadataDetailKeys) {
+    if (seen.has(item.labelKey)) continue;
+    const value = metadataValue(item.key, metadata[item.key]);
+    if (!value) continue;
+    seen.add(item.labelKey);
+    rows.push({
+      label: t(item.labelKey),
+      value,
+      multiline: item.multiline,
+    });
+  }
+  return rows;
+}
+
+function stringifyMetadata(metadata: Record<string, unknown>, safeStringify?: (value: unknown) => string) {
+  try {
+    return safeStringify ? safeStringify(metadata) : JSON.stringify(metadata, null, 2);
+  } catch {
+    return t("session.permission_metadata_unavailable");
+  }
+}
+
+function isFocusableElement(element: HTMLElement) {
+  if (element.hasAttribute("disabled")) return false;
+  if (element.getAttribute("aria-hidden") === "true") return false;
+  const style = window.getComputedStyle(element);
+  return style.display !== "none" && style.visibility !== "hidden";
+}
+
+function describePermissionRequest(permission: PendingPermission): PermissionPresentation {
+  const patterns = permission.patterns.filter((pattern) => pattern.trim().length > 0);
+  if (permission.permission === "doom_loop") {
+    const tool =
+      permission.metadata && typeof permission.metadata === "object" && typeof permission.metadata.tool === "string"
+        ? permission.metadata.tool
+        : null;
+
+    return {
+      title: t("session.doom_loop_title"),
+      message: t("session.doom_loop_message"),
+      permissionLabel: t("session.doom_loop_label"),
+      scopeLabel: tool ? t("session.doom_loop_tool_label") : t("session.doom_loop_repeated_call_label"),
+      scopeValue: tool ?? (patterns.length ? patterns.join(", ") : t("session.doom_loop_repeated_tool_call")),
+      isDoomLoop: true,
+      note: t("session.doom_loop_note"),
+    };
+  }
+
+  const copy = permissionCopy(permission.permission);
+  return {
+    title: copy.title,
+    message: copy.message,
+    permissionLabel: readablePermissionLabel(permission.permission),
+    scopeLabel: t("session.scope_label"),
+    scopeValue: patterns.join(", ") || t("session.permission_scope_empty"),
+    isDoomLoop: false,
+    note: null,
+  };
+}
+
+export function PermissionApprovalModal(props: PermissionApprovalModalProps) {
+  const dialogRef = useRef<HTMLElement | null>(null);
+  const previousActiveElementRef = useRef<HTMLElement | null>(null);
+  const presentation = useMemo(() => describePermissionRequest(props.permission), [props.permission]);
+  const metadata =
+    props.permission.metadata && typeof props.permission.metadata === "object"
+      ? props.permission.metadata
+      : {};
+  const hasMetadata = Object.keys(metadata).length > 0;
+  const detailRows = permissionDetailRows(metadata);
+  const Icon = presentation.isDoomLoop ? RefreshCcw : ShieldCheck;
+  const iconClass = presentation.isDoomLoop
+    ? "bg-amber-3/30 text-amber-11"
+    : "bg-[rgba(var(--dls-accent-rgb),0.1)] text-dls-accent";
+
+  useEffect(() => {
+    previousActiveElementRef.current =
+      document.activeElement instanceof HTMLElement ? document.activeElement : null;
+    dialogRef.current?.focus({ preventScroll: true });
+    return () => {
+      previousActiveElementRef.current?.focus({ preventScroll: true });
+    };
+  }, [props.permission.id]);
+
+  const handleKeyDown = (event: KeyboardEvent<HTMLElement>) => {
+    if (event.key === "Escape") {
+      event.preventDefault();
+      props.respondPermission?.(props.permission.id, "reject");
+      return;
+    }
+    if (event.key !== "Tab") return;
+    const dialog = dialogRef.current;
+    if (!dialog) return;
+    const focusable = Array.from(
+      dialog.querySelectorAll<HTMLElement>(
+        'button, [href], input, select, textarea, summary, [tabindex]:not([tabindex="-1"])',
+      ),
+    ).filter(isFocusableElement);
+    if (focusable.length === 0) {
+      event.preventDefault();
+      return;
+    }
+    const first = focusable[0]!;
+    const last = focusable[focusable.length - 1]!;
+    const active = document.activeElement;
+    if (event.shiftKey && active === first) {
+      event.preventDefault();
+      last.focus();
+      return;
+    }
+    if (!event.shiftKey && active === last) {
+      event.preventDefault();
+      first.focus();
+    }
+  };
+
+  return (
+    <div className="absolute inset-0 z-50 flex items-center justify-center bg-black/35 p-4 backdrop-blur-[6px]">
+      <section
+        ref={dialogRef}
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="permission-approval-title"
+        tabIndex={-1}
+        onKeyDown={handleKeyDown}
+        className="w-full max-w-[560px] overflow-hidden rounded-[28px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)] animate-in fade-in zoom-in-95 duration-200"
+      >
+        <div className="border-b border-dls-border px-6 py-5">
+          <div className="flex items-start gap-4">
+            <div className={`flex h-12 w-12 shrink-0 items-center justify-center rounded-2xl ${iconClass}`}>
+              <Icon size={23} strokeWidth={1.9} />
+            </div>
+            <div className="min-w-0 flex-1">
+              <h3 id="permission-approval-title" className="text-[20px] font-semibold tracking-[-0.3px] text-dls-text">
+                {presentation.title}
+              </h3>
+              <p className="mt-1.5 text-[14px] leading-6 text-dls-secondary">
+                {presentation.message}
+              </p>
+            </div>
+          </div>
+        </div>
+
+        <div className="space-y-3 px-6 py-5">
+          <div className="rounded-[20px] border border-dls-border bg-dls-hover/45 p-4">
+            <div className="text-[11px] font-semibold uppercase tracking-[0.16em] text-dls-secondary">
+              {t("session.permission_label")}
+            </div>
+            <div className="mt-2 font-mono text-[14px] leading-6 text-dls-text">
+              {presentation.permissionLabel}
+            </div>
+            {presentation.note ? (
+              <p className="mt-2 text-[13px] leading-5 text-dls-secondary">
+                {presentation.note}
+              </p>
+            ) : null}
+          </div>
+
+          <div className="rounded-[20px] border border-dls-border bg-dls-surface p-4">
+            <div className="flex items-center gap-2 text-[11px] font-semibold uppercase tracking-[0.16em] text-dls-secondary">
+              <HardDrive size={13} />
+              {presentation.scopeLabel}
+            </div>
+            <div className="mt-3 rounded-2xl border border-dls-border bg-dls-hover/55 px-3.5 py-3 font-mono text-[13px] leading-6 text-dls-text">
+              <span className="block break-all">{presentation.scopeValue}</span>
+            </div>
+          </div>
+
+          {detailRows.length > 0 ? (
+            <div className="rounded-[20px] border border-dls-border bg-dls-surface p-4">
+              <div className="text-[11px] font-semibold uppercase tracking-[0.16em] text-dls-secondary">
+                {t("session.permission_review_label")}
+              </div>
+              <div className="mt-3 space-y-3">
+                {detailRows.map((row) => (
+                  <div key={row.label}>
+                    <div className="text-[12px] font-medium text-dls-secondary">{row.label}</div>
+                    <div
+                      className={`mt-1 rounded-xl border border-dls-border bg-dls-hover/55 px-3 py-2 font-mono text-[12px] leading-5 text-dls-text ${
+                        row.multiline ? "max-h-44 overflow-auto whitespace-pre-wrap" : "break-all"
+                      }`}
+                    >
+                      {row.value}
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          ) : null}
+
+          {hasMetadata ? (
+            <details className="group rounded-[18px] border border-dls-border bg-dls-surface px-4 py-3">
+              <summary className="flex cursor-pointer list-none items-center justify-between gap-3 text-[13px] font-medium text-dls-text">
+                <span>{t("session.details_label")}</span>
+                <ChevronRight size={15} className="text-dls-secondary transition-transform group-open:rotate-90" />
+              </summary>
+              <pre className="mt-3 max-h-44 overflow-auto whitespace-pre-wrap break-words rounded-xl border border-dls-border bg-dls-hover/45 px-3 py-2.5 text-[12px] leading-5 text-dls-secondary">
+                {stringifyMetadata(metadata, props.safeStringify)}
+              </pre>
+            </details>
+          ) : null}
+        </div>
+
+        <div className="border-t border-dls-border bg-dls-hover/30 px-6 py-5">
+          <p className="mb-4 text-[12px] leading-5 text-dls-secondary">
+            {t("session.permission_decision_hint")}
+          </p>
+          <div className="grid grid-cols-1 gap-2.5 sm:grid-cols-[1fr_auto_auto]">
+            <Button
+              variant="outline"
+              className="justify-center rounded-full border-red-6/35 bg-red-2/20 text-red-11 hover:bg-red-3/30 sm:justify-self-start"
+              onClick={() => props.respondPermission?.(props.permission.id, "reject")}
+              disabled={props.busy || !props.respondPermission}
+            >
+              <XCircle size={16} />
+              {t("session.deny")}
+            </Button>
+            <Button
+              variant="primary"
+              className="rounded-full"
+              onClick={() => props.respondPermission?.(props.permission.id, "once")}
+              disabled={props.busy || !props.respondPermission}
+            >
+              <Clock3 size={16} />
+              {t("session.allow_once")}
+            </Button>
+            <Button
+              variant="outline"
+              className="rounded-full bg-dls-surface"
+              onClick={() => props.respondPermission?.(props.permission.id, "always")}
+              disabled={props.busy || !props.respondPermission}
+            >
+              <Check size={16} />
+              {t("session.allow_for_session")}
+            </Button>
+          </div>
+        </div>
+      </section>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/chat/session-page.tsx b/apps/app/src/react-app/domains/session/chat/session-page.tsx
new file mode 100644
index 0000000000..c9336b0b34
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/chat/session-page.tsx
@@ -0,0 +1,590 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useState } from "react";
+import { Check, Loader2, Minimize2, Redo2, Undo2, Zap } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { buildOpenworkWorkspaceBaseUrl, type OpenworkServerClient, type OpenworkServerStatus } from "../../../../app/lib/openwork-server";
+import { getDisplaySessionTitle } from "../../../../app/lib/session-title";
+import type { BootPhase } from "../../../../app/lib/startup-boot";
+import type { WorkspaceInfo } from "../../../../app/lib/desktop";
+import type {
+  PendingPermission,
+  PendingQuestion,
+  ProviderListItem,
+  TodoItem,
+  WorkspaceConnectionState,
+  WorkspaceSessionGroup,
+} from "../../../../app/types";
+import type { ShareWorkspaceModalProps } from "../../workspace/types";
+import { Button } from "../../../design-system/button";
+import { ConfirmModal } from "../../../design-system/modals/confirm-modal";
+import ProviderAuthModal, { type ProviderAuthModalProps } from "../../connections/provider-auth/provider-auth-modal";
+import { PermissionApprovalModal } from "./permission-approval-modal";
+import { QuestionModal } from "../modals/question-modal";
+import { RenameSessionModal } from "../modals/rename-session-modal";
+import { WorkspaceSessionList } from "../sidebar/workspace-session-list";
+import { SessionSurface, type SessionSurfaceProps } from "../surface/session-surface";
+import { ShareWorkspaceModal } from "../../workspace/share-workspace-modal";
+import { StatusBar, type StatusBarProps } from "./status-bar";
+import {
+  DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+  useWorkspaceShellLayout,
+} from "../../../shell/workspace-shell-layout";
+import { OwDotTicker } from "../../../shell/dot-ticker";
+import { useReactRenderWatchdog } from "../../../shell/react-render-watchdog";
+
+type StatusBarOverrides = Pick<
+  StatusBarProps,
+  | "statusLabel"
+  | "statusDetail"
+  | "statusDotClass"
+  | "statusPingClass"
+  | "statusPulse"
+  | "showSettingsButton"
+  | "settingsOpen"
+>;
+
+export type SessionPageHistoryControls = {
+  canUndo: boolean;
+  canRedo: boolean;
+  busyAction: "undo" | "redo" | null;
+  onUndo: () => void | Promise<void>;
+  onRedo: () => void | Promise<void>;
+};
+
+export type SessionPageSidebarProps = {
+  workspaceSessionGroups: WorkspaceSessionGroup[];
+  selectedWorkspaceId: string;
+  selectedSessionId: string | null;
+  developerMode: boolean;
+  sessionStatusById: Record<string, string>;
+  connectingWorkspaceId: string | null;
+  workspaceConnectionStateById: Record<string, WorkspaceConnectionState>;
+  newTaskDisabled: boolean;
+  sidebarHydratedFromCache: boolean;
+  startupPhase: BootPhase;
+  onSelectWorkspace: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onOpenSession: (workspaceId: string, sessionId: string) => void;
+  onPrefetchSession?: (workspaceId: string, sessionId: string) => void;
+  onCreateTaskInWorkspace: (workspaceId: string) => void;
+  onOpenRenameWorkspace: (workspaceId: string) => void;
+  onShareWorkspace: (workspaceId: string) => void;
+  onRevealWorkspace: (workspaceId: string) => void;
+  onRecoverWorkspace: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onTestWorkspaceConnection: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onEditWorkspaceConnection: (workspaceId: string) => void;
+  onForgetWorkspace: (workspaceId: string) => void;
+  onOpenCreateWorkspace: () => void;
+};
+
+export type SessionPageSurfaceProps = Omit<
+  SessionSurfaceProps,
+  "client" | "workspaceId" | "sessionId" | "opencodeBaseUrl" | "openworkToken"
+>;
+
+export type SessionPageProps = {
+  selectedSessionId: string | null;
+  selectedWorkspaceId: string;
+  selectedWorkspaceDisplay: {
+    id?: string;
+    name?: string;
+    displayName?: string;
+    workspaceType?: WorkspaceInfo["workspaceType"];
+  };
+  selectedWorkspaceRoot: string;
+  runtimeWorkspaceId: string | null;
+  workspaces: WorkspaceInfo[];
+  clientConnected: boolean;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerClient: OpenworkServerClient | null;
+  openworkServerToken?: string | null;
+  developerMode: boolean;
+  headerStatus: string;
+  busyHint: string | null;
+  startupPhase: BootPhase;
+  providerConnectedIds: string[];
+  providers?: ProviderListItem[];
+  mcpConnectedCount: number;
+  onSendFeedback: () => void;
+  onOpenSettings: () => void;
+  sidebar: SessionPageSidebarProps;
+  surface?: SessionPageSurfaceProps | null;
+  history?: SessionPageHistoryControls | null;
+  todos: TodoItem[];
+  sessionLoadingById: (sessionId: string | null) => boolean;
+  shareWorkspaceModal?: ShareWorkspaceModalProps | null;
+  providerAuthModal?: ProviderAuthModalProps | null;
+  activePermission?: PendingPermission | null;
+  permissionReplyBusy?: boolean;
+  respondPermission?: (requestID: string, reply: "once" | "always" | "reject") => void;
+  safeStringify?: (value: unknown) => string;
+  activeQuestion?: PendingQuestion | null;
+  questionReplyBusy?: boolean;
+  respondQuestion?: (requestID: string, answers: string[][]) => void;
+  statusBar?: Partial<StatusBarOverrides>;
+  onRenameSession?: (sessionId: string, title: string) => Promise<void> | void;
+  onDeleteSession?: (sessionId: string) => Promise<void> | void;
+};
+
+function getSidebarInitialLoading(props: SessionPageSidebarProps) {
+  if (props.workspaceSessionGroups.some((group) => group.sessions.length > 0)) {
+    return false;
+  }
+  if (props.sidebarHydratedFromCache) return false;
+  if (
+    props.startupPhase !== "sessionIndexReady" &&
+    props.startupPhase !== "firstSessionReady" &&
+    props.startupPhase !== "ready"
+  ) {
+    return true;
+  }
+  return props.workspaceSessionGroups.some(
+    (group) => group.status === "loading" || group.status === "idle",
+  );
+}
+
+function sessionTitleForId(groups: WorkspaceSessionGroup[], id: string | null | undefined) {
+  if (!id) return "";
+  for (const group of groups) {
+    const match = group.sessions.find((session) => session.id === id);
+    if (match) return getDisplaySessionTitle(match.title);
+  }
+  return "";
+}
+
+export function SessionPage(props: SessionPageProps) {
+  const { leftSidebarWidth, startLeftSidebarResize } = useWorkspaceShellLayout({
+    defaultLeftWidth: DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+    expandedRightWidth: 280,
+  });
+  useReactRenderWatchdog("SessionPage", {
+    selectedSessionId: props.selectedSessionId,
+    selectedWorkspaceId: props.selectedWorkspaceId,
+    clientConnected: props.clientConnected,
+    startupPhase: props.startupPhase,
+    hasSurface: Boolean(props.surface),
+    workspaceCount: props.workspaces.length,
+  });
+
+  const [renameOpen, setRenameOpen] = useState(false);
+  const [renameTitle, setRenameTitle] = useState("");
+  const [renameBusy, setRenameBusy] = useState(false);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+  const [deleteBusy, setDeleteBusy] = useState(false);
+  const [todoExpanded, setTodoExpanded] = useState(true);
+  const [showDelayedSessionLoadingState, setShowDelayedSessionLoadingState] = useState(false);
+
+  const selectedSessionTitle = useMemo(
+    () => sessionTitleForId(props.sidebar.workspaceSessionGroups, props.selectedSessionId),
+    [props.selectedSessionId, props.sidebar.workspaceSessionGroups],
+  );
+  const workspaceName =
+    props.selectedWorkspaceDisplay.displayName?.trim() ||
+    props.selectedWorkspaceDisplay.name?.trim() ||
+    t("session.workspace_fallback");
+  const providerCount = props.providerConnectedIds.length;
+  const messageCountVisible = props.selectedSessionId ? 1 : 0;
+  const showWorkspaceSetupEmptyState = props.workspaces.length === 0 && !props.selectedSessionId;
+  const showStartupSkeleton =
+    !props.selectedSessionId &&
+    !props.clientConnected &&
+    props.startupPhase !== "sessionIndexReady" &&
+    props.startupPhase !== "firstSessionReady" &&
+    props.startupPhase !== "ready";
+  const showSessionLoadingState =
+    Boolean(props.selectedSessionId) && props.sessionLoadingById(props.selectedSessionId) && !showWorkspaceSetupEmptyState;
+  const todos = useMemo(() => props.todos.filter((todo) => todo.content.trim()), [props.todos]);
+  const completedTodos = useMemo(
+    () => todos.filter((todo) => todo.status === "completed").length,
+    [todos],
+  );
+  const sidebarInitialLoading = useMemo(() => getSidebarInitialLoading(props.sidebar), [props.sidebar]);
+
+  const reactSessionBaseUrl = useMemo(() => {
+    const workspaceId = props.runtimeWorkspaceId?.trim() ?? "";
+    const baseUrl = props.openworkServerClient?.baseUrl?.trim() ?? "";
+    if (!workspaceId || !baseUrl) return "";
+    const mounted = buildOpenworkWorkspaceBaseUrl(baseUrl, workspaceId) ?? baseUrl;
+    return `${mounted.replace(/\/+$/, "")}/opencode`;
+  }, [props.openworkServerClient?.baseUrl, props.runtimeWorkspaceId]);
+
+  const reactSessionToken = props.openworkServerClient?.token?.trim() || props.openworkServerToken?.trim() || "";
+  const canRenderReactSurface = Boolean(
+    props.selectedSessionId &&
+      props.runtimeWorkspaceId &&
+      props.openworkServerClient &&
+      reactSessionBaseUrl &&
+      reactSessionToken &&
+      props.surface,
+  );
+
+  useEffect(() => {
+    if (!showSessionLoadingState) {
+      setShowDelayedSessionLoadingState(false);
+      return;
+    }
+    const id = window.setTimeout(() => {
+      setShowDelayedSessionLoadingState(true);
+    }, 1000);
+    return () => window.clearTimeout(id);
+  }, [showSessionLoadingState]);
+
+  useEffect(() => {
+    setRenameOpen(false);
+    setDeleteOpen(false);
+    setRenameBusy(false);
+    setDeleteBusy(false);
+  }, [props.selectedSessionId]);
+
+  const openRenameModal = () => {
+    if (!props.selectedSessionId || !props.onRenameSession) return;
+    setRenameTitle(selectedSessionTitle);
+    setRenameOpen(true);
+  };
+
+  const submitRename = async () => {
+    const sessionId = props.selectedSessionId;
+    const nextTitle = renameTitle.trim();
+    if (!sessionId || !props.onRenameSession || !nextTitle || nextTitle === selectedSessionTitle.trim()) return;
+    setRenameBusy(true);
+    try {
+      await props.onRenameSession(sessionId, nextTitle);
+      setRenameOpen(false);
+    } finally {
+      setRenameBusy(false);
+    }
+  };
+
+  const confirmDelete = async () => {
+    const sessionId = props.selectedSessionId;
+    if (!sessionId || !props.onDeleteSession) return;
+    setDeleteBusy(true);
+    try {
+      await props.onDeleteSession(sessionId);
+      setDeleteOpen(false);
+    } finally {
+      setDeleteBusy(false);
+    }
+  };
+
+  const todoLabel =
+    completedTodos > 0
+      ? t("session.todo_progress_label", undefined, { completed: completedTodos, total: todos.length })
+      : t("session.todo_label", undefined, { count: todos.length });
+
+  return (
+    <div className="flex h-full min-h-0 flex-col bg-[radial-gradient(circle_at_top,rgba(74,111,255,0.12),transparent_42%),var(--app-bg,#0b1020)] text-dls-text">
+      <div className="flex min-h-0 flex-1 gap-4 p-3 md:p-4">
+        <aside
+          className="relative hidden min-h-0 shrink-0 overflow-hidden rounded-[24px] border border-dls-border bg-dls-sidebar shadow-[var(--dls-shell-shadow)] lg:flex lg:flex-col"
+          style={{ width: leftSidebarWidth }}
+        >
+          <div className="flex min-h-0 flex-1">
+            <WorkspaceSessionList
+              workspaceSessionGroups={props.sidebar.workspaceSessionGroups}
+              selectedWorkspaceId={props.sidebar.selectedWorkspaceId}
+              developerMode={props.sidebar.developerMode}
+              selectedSessionId={props.sidebar.selectedSessionId}
+              showInitialLoading={sidebarInitialLoading}
+              showSessionActions={Boolean(props.onRenameSession || props.onDeleteSession)}
+              sessionStatusById={props.sidebar.sessionStatusById}
+              connectingWorkspaceId={props.sidebar.connectingWorkspaceId}
+              workspaceConnectionStateById={props.sidebar.workspaceConnectionStateById}
+              newTaskDisabled={props.sidebar.newTaskDisabled}
+              onSelectWorkspace={props.sidebar.onSelectWorkspace}
+              onOpenSession={props.sidebar.onOpenSession}
+              onPrefetchSession={props.sidebar.onPrefetchSession}
+              onCreateTaskInWorkspace={props.sidebar.onCreateTaskInWorkspace}
+              onOpenRenameSession={props.onRenameSession ? openRenameModal : undefined}
+              onOpenDeleteSession={props.onDeleteSession ? () => setDeleteOpen(true) : undefined}
+              onOpenRenameWorkspace={props.sidebar.onOpenRenameWorkspace}
+              onShareWorkspace={props.sidebar.onShareWorkspace}
+              onRevealWorkspace={props.sidebar.onRevealWorkspace}
+              onRecoverWorkspace={props.sidebar.onRecoverWorkspace}
+              onTestWorkspaceConnection={props.sidebar.onTestWorkspaceConnection}
+              onEditWorkspaceConnection={props.sidebar.onEditWorkspaceConnection}
+              onForgetWorkspace={props.sidebar.onForgetWorkspace}
+              onOpenCreateWorkspace={props.sidebar.onOpenCreateWorkspace}
+            />
+          </div>
+          <div
+            className="absolute right-0 top-3 hidden h-[calc(100%-24px)] w-2 translate-x-1/2 cursor-col-resize rounded-full bg-transparent transition-colors hover:bg-gray-6/40 lg:block"
+            onPointerDown={startLeftSidebarResize}
+            title={t("session.resize_workspace_column")}
+            aria-label={t("session.resize_workspace_column")}
+          />
+        </aside>
+
+        <main className="flex min-w-0 flex-1 flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+          <header className="z-10 flex h-12 shrink-0 items-center justify-between border-b border-dls-border bg-dls-surface px-4 md:px-6">
+            <div className="flex min-w-0 items-center gap-3">
+              <h1 className="truncate text-[15px] font-semibold text-dls-text">
+                {showWorkspaceSetupEmptyState
+                  ? t("session.create_or_connect_workspace")
+                  : selectedSessionTitle || t("session.default_title")}
+              </h1>
+              <span className="hidden truncate text-[13px] text-dls-secondary lg:inline">
+                {workspaceName}
+              </span>
+              {props.developerMode ? (
+                <span className="hidden text-[12px] text-dls-secondary lg:inline">
+                  {props.headerStatus}
+                </span>
+              ) : null}
+              {props.busyHint ? (
+                <span className="hidden text-[12px] text-dls-secondary lg:inline">
+                  {props.busyHint}
+                </span>
+              ) : null}
+            </div>
+
+            <div className="flex items-center gap-1.5 text-gray-10">
+              {props.history ? (
+                <>
+                  <button
+                    type="button"
+                    className="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                    onClick={() => void props.history?.onUndo()}
+                    disabled={!props.history.canUndo || props.history.busyAction !== null}
+                    title={t("session.undo_title")}
+                    aria-label={t("session.undo_label")}
+                  >
+                    {props.history.busyAction === "undo" ? (
+                      <Loader2 size={16} className="animate-spin" />
+                    ) : (
+                      <Undo2 size={16} />
+                    )}
+                    <span className="hidden lg:inline">{t("session.revert_label")}</span>
+                  </button>
+                  <button
+                    type="button"
+                    className="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                    onClick={() => void props.history?.onRedo()}
+                    disabled={!props.history.canRedo || props.history.busyAction !== null}
+                    title={t("session.redo_title")}
+                    aria-label={t("session.redo_aria_label")}
+                  >
+                    {props.history.busyAction === "redo" ? (
+                      <Loader2 size={16} className="animate-spin" />
+                    ) : (
+                      <Redo2 size={16} />
+                    )}
+                    <span className="hidden lg:inline">{t("session.redo_label")}</span>
+                  </button>
+                </>
+              ) : null}
+            </div>
+          </header>
+
+          <div className="flex min-h-0 flex-1 overflow-hidden">
+            <div className="relative min-w-0 flex-1 overflow-hidden bg-dls-surface">
+              {showStartupSkeleton ? (
+                <div className="px-6 py-14" role="status" aria-live="polite">
+                  <div className="mx-auto max-w-2xl space-y-6">
+                    <div className="space-y-2">
+                      <div className="h-4 w-32 animate-pulse rounded-full bg-dls-hover/80" />
+                      <div className="h-3 w-64 animate-pulse rounded-full bg-dls-hover/60" />
+                    </div>
+                    <div className="space-y-3">
+                      {[0, 1, 2].map((idx) => (
+                        <div key={idx} className="rounded-2xl border border-dls-border bg-dls-hover/40 p-4">
+                          <div
+                            className="mb-3 h-3 animate-pulse rounded-full bg-dls-hover/80"
+                            style={{ width: idx === 0 ? "42%" : idx === 1 ? "56%" : "36%" }}
+                          />
+                          <div className="space-y-2">
+                            <div className="h-2.5 animate-pulse rounded-full bg-dls-hover/70" />
+                            <div
+                              className="h-2.5 animate-pulse rounded-full bg-dls-hover/60"
+                              style={{ width: idx === 2 ? "74%" : "88%" }}
+                            />
+                          </div>
+                        </div>
+                      ))}
+                    </div>
+                  </div>
+                </div>
+              ) : null}
+
+              {showDelayedSessionLoadingState ? (
+                <div className="px-6 py-16">
+                  <div
+                    className="mx-auto flex max-w-[320px] flex-col items-center gap-3 text-center"
+                    role="status"
+                    aria-live="polite"
+                  >
+                    <OwDotTicker size="md" />
+                    <div className="text-[12px] leading-5 text-dls-secondary">
+                      {t("session.loading_detail")}
+                    </div>
+                  </div>
+                </div>
+              ) : null}
+
+              {!showDelayedSessionLoadingState && canRenderReactSurface ? (
+                <SessionSurface
+                  client={props.openworkServerClient!}
+                  workspaceId={props.runtimeWorkspaceId!}
+                  sessionId={props.selectedSessionId!}
+                  opencodeBaseUrl={reactSessionBaseUrl}
+                  openworkToken={reactSessionToken}
+                  {...props.surface!}
+                />
+              ) : null}
+
+              {!showDelayedSessionLoadingState && !canRenderReactSurface && !showStartupSkeleton ? (
+                <div className={`mx-auto max-w-[800px] px-6 ${showWorkspaceSetupEmptyState ? "pt-20" : "pt-10"}`}>
+                  {showWorkspaceSetupEmptyState ? (
+                    <div className="space-y-6 px-6 text-center">
+                      <div className="mx-auto flex h-16 w-16 items-center justify-center rounded-3xl border border-dls-border bg-dls-hover">
+                        <Zap className="text-dls-secondary" />
+                      </div>
+                      <div className="space-y-2">
+                        <h3 className="text-xl font-medium">{t("session.create_or_connect_workspace")}</h3>
+                        <p className="mx-auto max-w-sm text-sm text-dls-secondary">
+                          {t("workspace.empty_state_body")}
+                        </p>
+                      </div>
+                      <div className="flex justify-center">
+                        <Button onClick={props.sidebar.onOpenCreateWorkspace}>{t("workspace.create_workspace")}</Button>
+                      </div>
+                    </div>
+                  ) : (
+                    <div className="px-6 py-16 text-center text-sm text-dls-secondary">
+                      {props.selectedSessionId
+                        ? t("session.loading_detail")
+                        : t("session.select_or_create_session")}
+                    </div>
+                  )}
+                </div>
+              ) : null}
+            </div>
+          </div>
+
+          {todos.length > 0 ? (
+            <div className="mx-auto w-full max-w-[800px] px-4">
+              <div className="rounded-t-[20px] border border-b-0 border-dls-border bg-dls-surface shadow-[var(--dls-card-shadow)]">
+                <button
+                  type="button"
+                  className="flex w-full items-center justify-between rounded-t-[20px] px-4 py-3 text-xs text-gray-9 transition-colors hover:bg-gray-2/50"
+                  onClick={() => setTodoExpanded((current) => !current)}
+                >
+                  <div className="flex items-center gap-2">
+                    <span className="text-gray-11 font-medium">{todoLabel}</span>
+                  </div>
+                  <Minimize2 size={12} className={`text-gray-8 transition-transform ${todoExpanded ? "" : "rotate-180"}`} />
+                </button>
+                {todoExpanded ? (
+                  <div className="max-h-60 space-y-2.5 overflow-auto border-t border-dls-border px-4 pb-3">
+                    {todos.map((todo, index) => {
+                      const done = todo.status === "completed";
+                      const cancelled = todo.status === "cancelled";
+                      const active = todo.status === "in_progress";
+                      return (
+                        <div key={`${todo.content}-${index}`} className="flex items-start gap-2.5 pt-2.5 first:pt-2.5">
+                          <div className="flex items-center gap-1.5 pt-0.5">
+                            <div
+                              className={`flex h-4.5 w-4.5 items-center justify-center rounded-full border ${
+                                done
+                                  ? "border-green-6 bg-green-2 text-green-11"
+                                  : active
+                                    ? "border-amber-6 bg-amber-2 text-amber-11"
+                                    : cancelled
+                                      ? "border-gray-6 bg-gray-2 text-gray-8"
+                                      : "border-gray-6 bg-gray-1 text-gray-8"
+                              }`}
+                            >
+                              {done ? <Check size={10} /> : active ? <span className="h-1.5 w-1.5 rounded-full bg-amber-9" /> : null}
+                            </div>
+                          </div>
+                          <div className={`flex-1 text-sm leading-relaxed ${cancelled ? "text-gray-9 line-through" : "text-gray-12"}`}>
+                            <span className="mr-1.5 text-gray-9">{index + 1}.</span>
+                            {todo.content}
+                          </div>
+                        </div>
+                      );
+                    })}
+                  </div>
+                ) : null}
+              </div>
+            </div>
+          ) : null}
+
+          <StatusBar
+            clientConnected={props.clientConnected}
+            openworkServerStatus={props.openworkServerStatus}
+            developerMode={props.developerMode}
+            settingsOpen={props.statusBar?.settingsOpen ?? false}
+            onSendFeedback={props.onSendFeedback}
+            onOpenSettings={props.onOpenSettings}
+            providerConnectedIds={props.providerConnectedIds}
+            mcpConnectedCount={props.mcpConnectedCount}
+            statusLabel={props.statusBar?.statusLabel}
+            statusDetail={props.statusBar?.statusDetail}
+            statusDotClass={props.statusBar?.statusDotClass}
+            statusPingClass={props.statusBar?.statusPingClass}
+            statusPulse={props.statusBar?.statusPulse}
+            showSettingsButton={props.statusBar?.showSettingsButton}
+          />
+        </main>
+      </div>
+
+      {props.providerAuthModal ? <ProviderAuthModal {...props.providerAuthModal} /> : null}
+
+      {props.onRenameSession ? (
+        <RenameSessionModal
+          open={renameOpen}
+          title={renameTitle}
+          busy={renameBusy}
+          canSave={renameTitle.trim().length > 0 && renameTitle.trim() !== selectedSessionTitle.trim()}
+          onClose={() => {
+            if (!renameBusy) setRenameOpen(false);
+          }}
+          onSave={() => void submitRename()}
+          onTitleChange={setRenameTitle}
+        />
+      ) : null}
+
+      {props.onDeleteSession ? (
+        <ConfirmModal
+          open={deleteOpen}
+          title={t("session.delete_session_title")}
+          message={
+            selectedSessionTitle.trim()
+              ? t("session.delete_named_session_message", undefined, { title: selectedSessionTitle.trim() })
+              : t("session.delete_session_generic")
+          }
+          confirmLabel={deleteBusy ? t("session.deleting") : t("session.delete")}
+          cancelLabel={t("common.cancel")}
+          variant="danger"
+          onConfirm={() => void confirmDelete()}
+          onCancel={() => {
+            if (!deleteBusy) setDeleteOpen(false);
+          }}
+        />
+      ) : null}
+
+      {props.shareWorkspaceModal ? <ShareWorkspaceModal {...props.shareWorkspaceModal} /> : null}
+
+      {props.activePermission ? (
+        <PermissionApprovalModal
+          permission={props.activePermission}
+          busy={props.permissionReplyBusy}
+          respondPermission={props.respondPermission}
+          safeStringify={props.safeStringify}
+        />
+      ) : null}
+
+      <QuestionModal
+        open={Boolean(props.activeQuestion)}
+        questions={props.activeQuestion?.questions ?? []}
+        busy={props.questionReplyBusy ?? false}
+        onReply={(answers) => {
+          if (props.activeQuestion) {
+            props.respondQuestion?.(props.activeQuestion.id, answers);
+          }
+        }}
+      />
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/chat/status-bar.tsx b/apps/app/src/react-app/domains/session/chat/status-bar.tsx
new file mode 100644
index 0000000000..f4521e36a9
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/chat/status-bar.tsx
@@ -0,0 +1,223 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useRef, useState } from "react";
+import { BookOpen, MessageCircle, Settings } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { usePlatform } from "../../../kernel/platform";
+import { useControlAction, type OpenworkControlAction } from "../../../shell/control/control-provider";
+import type { OpenworkServerStatus } from "../../../../app/lib/openwork-server";
+
+const DOCS_URL = "https://openworklabs.com/docs";
+const STATUS_BAR_BOOT_STARTED_AT = Date.now();
+const STATUS_BAR_INITIALIZING_MS = 15_000;
+
+export type StatusBarProps = {
+  clientConnected: boolean;
+  openworkServerStatus: OpenworkServerStatus;
+  developerMode: boolean;
+  settingsOpen: boolean;
+  onSendFeedback: () => void;
+  onOpenSettings: () => void;
+  providerConnectedIds: string[];
+  mcpConnectedCount: number;
+  statusLabel?: string;
+  statusDetail?: string;
+  statusDotClass?: string;
+  statusPingClass?: string;
+  statusPulse?: boolean;
+  showSettingsButton?: boolean;
+  initializing?: boolean;
+};
+
+type StatusCopy = {
+  label: string;
+  detail: string;
+  dotClass: string;
+  pingClass: string;
+  pulse: boolean;
+};
+
+function deriveStatusCopy(props: StatusBarProps): StatusCopy {
+  if (props.statusLabel) {
+    return {
+      label: props.statusLabel,
+      detail: props.statusDetail ?? "",
+      dotClass: props.statusDotClass ?? "bg-green-9",
+      pingClass: props.statusPingClass ?? "bg-green-9/45 animate-ping",
+      pulse: props.statusPulse ?? true,
+    };
+  }
+
+  const mcp = props.mcpConnectedCount;
+
+  if (!props.clientConnected && props.openworkServerStatus === "disconnected" && props.initializing) {
+    return {
+      label: "Preparing workspace",
+      detail: t("session.loading_detail"),
+      dotClass: "bg-amber-9",
+      pingClass: "bg-amber-9/35 animate-ping",
+      pulse: true,
+    };
+  }
+
+  if (props.clientConnected) {
+    const detailBits: string[] = [];
+    if (mcp > 0) {
+      detailBits.push(t("status.mcp_connected", undefined, { count: mcp }));
+    }
+    if (!detailBits.length) {
+      detailBits.push(t("status.ready_for_tasks"));
+    }
+    if (props.developerMode) {
+      detailBits.push(t("status.developer_mode"));
+    }
+    return {
+      label: t("status.openwork_ready"),
+      detail: detailBits.join(" · "),
+      dotClass: "bg-green-9",
+      pingClass: "bg-green-9/45 animate-ping",
+      pulse: true,
+    };
+  }
+
+  if (props.openworkServerStatus === "limited") {
+    return {
+      label: t("status.limited_mode"),
+      detail:
+        mcp > 0
+          ? t("status.limited_mcp_hint", undefined, { count: mcp })
+          : t("status.limited_hint"),
+      dotClass: "bg-amber-9",
+      pingClass: "bg-amber-9/35",
+      pulse: false,
+    };
+  }
+
+  return {
+    label: t("status.disconnected_label"),
+    detail: t("status.disconnected_hint"),
+    dotClass: "bg-red-9",
+    pingClass: "bg-red-9/35",
+    pulse: false,
+  };
+}
+
+export function StatusBar(props: StatusBarProps) {
+  const platform = usePlatform();
+  const docsButtonRef = useRef<HTMLButtonElement>(null);
+  const feedbackButtonRef = useRef<HTMLButtonElement>(null);
+  const settingsButtonRef = useRef<HTMLButtonElement>(null);
+  const [initializing, setInitializing] = useState(
+    () => Date.now() - STATUS_BAR_BOOT_STARTED_AT < STATUS_BAR_INITIALIZING_MS,
+  );
+
+  useEffect(() => {
+    if (!initializing) return;
+    const remaining = Math.max(
+      0,
+      STATUS_BAR_INITIALIZING_MS - (Date.now() - STATUS_BAR_BOOT_STARTED_AT),
+    );
+    const timeout = window.setTimeout(() => setInitializing(false), remaining);
+    return () => window.clearTimeout(timeout);
+  }, [initializing]);
+
+  const statusCopy = deriveStatusCopy({ ...props, initializing });
+  const docsControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "status.docs.open",
+    label: "Open OpenWork docs",
+    description: "Open the documentation from the status bar.",
+    sideEffect: "external",
+    targetRef: docsButtonRef,
+    execute: () => platform.openLink(DOCS_URL),
+  }), [platform]);
+  useControlAction(docsControlAction);
+
+  const feedbackControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "status.feedback.open",
+    label: "Send feedback",
+    description: "Open the OpenWork feedback surface from the status bar.",
+    sideEffect: "external",
+    targetRef: feedbackButtonRef,
+    execute: props.onSendFeedback,
+  }), [props.onSendFeedback]);
+  useControlAction(feedbackControlAction);
+
+  const settingsControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "status.settings.open",
+    label: props.settingsOpen ? "Go back from settings" : "Open settings from the status bar",
+    description: "Use the visible settings button in the status bar.",
+    sideEffect: "navigation",
+    disabled: props.showSettingsButton === false,
+    targetRef: settingsButtonRef,
+    execute: props.onOpenSettings,
+  }), [props.onOpenSettings, props.settingsOpen, props.showSettingsButton]);
+  useControlAction(settingsControlAction);
+
+  return (
+    <div className="border-t border-dls-border bg-dls-surface">
+      <div className="flex h-12 items-center justify-between gap-3 px-4 md:px-6 text-[12px] text-dls-secondary">
+        <div className="flex min-w-0 items-center gap-2.5">
+          <span className="relative flex h-2.5 w-2.5 shrink-0 items-center justify-center">
+            {statusCopy.pulse ? (
+              <span
+                className={`absolute inline-flex h-full w-full rounded-full ${statusCopy.pingClass}`}
+              />
+            ) : null}
+            <span
+              className={`relative inline-flex h-2.5 w-2.5 rounded-full ${statusCopy.dotClass}`}
+            />
+          </span>
+          <span className="shrink-0 font-medium text-dls-text">
+            {statusCopy.label}
+          </span>
+          <span className="truncate text-dls-secondary">
+            {statusCopy.detail}
+          </span>
+        </div>
+
+        <div className="flex items-center gap-1.5">
+          <button
+            ref={docsButtonRef}
+            type="button"
+            className="inline-flex h-8 items-center gap-1.5 rounded-md px-2 text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text"
+            onClick={() => platform.openLink(DOCS_URL)}
+            title={t("status.open_docs")}
+            aria-label={t("status.open_docs")}
+          >
+            <BookOpen className="h-4 w-4" />
+            <span className="text-[11px] font-medium">{t("status.docs")}</span>
+          </button>
+          <button
+            ref={feedbackButtonRef}
+            type="button"
+            className="inline-flex h-8 items-center gap-1.5 rounded-md px-2 text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text"
+            onClick={props.onSendFeedback}
+            title={t("status.send_feedback")}
+            aria-label={t("status.send_feedback")}
+          >
+            <MessageCircle className="h-4 w-4" />
+            <span className="text-[11px] font-medium">
+              {t("status.feedback")}
+            </span>
+          </button>
+          {props.showSettingsButton !== false ? (
+            <button
+              ref={settingsButtonRef}
+              type="button"
+              className="flex h-8 w-8 shrink-0 items-center justify-center rounded-md text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text"
+              onClick={props.onOpenSettings}
+              title={
+                props.settingsOpen ? t("status.back") : t("status.settings")
+              }
+              aria-label={
+                props.settingsOpen ? t("status.back") : t("status.settings")
+              }
+            >
+              <Settings className="h-4 w-4" />
+            </button>
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/control/session-control-actions.ts b/apps/app/src/react-app/domains/session/control/session-control-actions.ts
new file mode 100644
index 0000000000..df30825a8d
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/control/session-control-actions.ts
@@ -0,0 +1,205 @@
+/** @jsxImportSource react */
+import { useMemo } from "react";
+
+import type { createClient } from "../../../../app/lib/opencode";
+import type { OpenworkServerClient, OpenworkWorkspaceInfo } from "../../../../app/lib/openwork-server";
+import { getDisplaySessionTitle } from "../../../../app/lib/session-title";
+import { useControlAction, type OpenworkControlAction } from "../../../shell/control/control-provider";
+
+type SessionLike = {
+  id?: string;
+  title?: string;
+  time?: {
+    updated?: number;
+    created?: number;
+  };
+};
+
+type SessionControlWorkspace = OpenworkWorkspaceInfo & {
+  displayNameResolved?: string;
+};
+
+type UseSessionControlActionsInput = {
+  workspaces: SessionControlWorkspace[];
+  sessionsByWorkspaceId: Record<string, SessionLike[]>;
+  selectedWorkspaceId: string;
+  selectedWorkspaceRoot: string;
+  selectedSessionId: string | null;
+  canCreateTask: boolean;
+  openworkClient: OpenworkServerClient | null;
+  opencodeClient: ReturnType<typeof createClient> | null;
+  navigateToSession: (sessionId: string) => void;
+  navigateToSessionRoot: () => void;
+  createTaskInWorkspace: (workspaceId: string) => Promise<unknown> | unknown;
+  openModelPicker: () => void;
+  refreshRouteState: () => Promise<unknown> | unknown;
+};
+
+function workspaceLabel(workspace: SessionControlWorkspace) {
+  return workspace.displayName?.trim() || workspace.name?.trim() || workspace.path?.trim() || "workspace";
+}
+
+function findSessionWorkspace(
+  workspaces: SessionControlWorkspace[],
+  sessionsByWorkspaceId: Record<string, SessionLike[]>,
+  sessionId: string,
+) {
+  return workspaces.find((workspace) => (
+    sessionsByWorkspaceId[workspace.id] ?? []
+  ).some((session) => session.id === sessionId));
+}
+
+function objectArgs(args: unknown) {
+  return args && typeof args === "object" ? args as Record<string, unknown> : {};
+}
+
+function stringArg(args: unknown, name: string) {
+  const value = objectArgs(args)[name];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function booleanArg(args: unknown, name: string) {
+  return objectArgs(args)[name] === true;
+}
+
+export function useSessionControlActions(input: UseSessionControlActionsInput) {
+  const {
+    canCreateTask,
+    createTaskInWorkspace,
+    navigateToSession,
+    navigateToSessionRoot,
+    openModelPicker,
+    openworkClient,
+    opencodeClient,
+    refreshRouteState,
+    selectedSessionId,
+    selectedWorkspaceId,
+    selectedWorkspaceRoot,
+    sessionsByWorkspaceId,
+    workspaces,
+  } = input;
+
+  const createTaskControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.create_task",
+    label: "Create a new task",
+    description: "Create a new session in the selected workspace.",
+    sideEffect: "mutation",
+    disabled: !canCreateTask || !selectedWorkspaceId,
+    execute: async () => {
+      if (!selectedWorkspaceId) return false;
+      await createTaskInWorkspace(selectedWorkspaceId);
+      return true;
+    },
+  }), [canCreateTask, createTaskInWorkspace, selectedWorkspaceId]);
+  useControlAction(createTaskControlAction);
+
+  const listSessionsControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.list_sessions",
+    label: "List available sessions",
+    description: "Return the list of sessions across workspaces so the user can ask to open one by name.",
+    sideEffect: "none",
+    execute: () => {
+      const out: { sessionId: string; title: string; workspace: string; updatedAt: number }[] = [];
+      for (const workspace of workspaces) {
+        const list = sessionsByWorkspaceId[workspace.id] ?? [];
+        for (const session of list) {
+          const sessionId = session.id?.trim() ?? "";
+          if (!sessionId) continue;
+          const title = getDisplaySessionTitle(session.title ?? "");
+          const updatedAt = session.time?.updated ?? session.time?.created ?? 0;
+          out.push({ sessionId, title, workspace: workspaceLabel(workspace), updatedAt });
+        }
+      }
+      out.sort((a, b) => b.updatedAt - a.updatedAt);
+      return out.slice(0, 30);
+    },
+  }), [sessionsByWorkspaceId, workspaces]);
+  useControlAction(listSessionsControlAction);
+
+  const openSessionControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.open",
+    label: "Open a session by ID",
+    description: "Navigate to a specific session. Use list_sessions first to get the session ID.",
+    sideEffect: "navigation",
+    requiresArgs: true,
+    args: [{ name: "sessionId", type: "string", required: true, description: "Session ID from session.list_sessions." }],
+    execute: (args) => {
+      const sessionId = stringArg(args, "sessionId");
+      if (!sessionId) return { ok: false, error: "sessionId is required" };
+      navigateToSession(sessionId);
+      return { ok: true, navigatedTo: sessionId };
+    },
+  }), [navigateToSession]);
+  useControlAction(openSessionControlAction);
+
+  const renameSessionControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.rename",
+    label: "Rename a session",
+    description: "Rename a session by ID. Use list_sessions first to match the title the user said.",
+    sideEffect: "mutation",
+    requiresArgs: true,
+    args: [
+      { name: "sessionId", type: "string", required: true, description: "Session ID from session.list_sessions." },
+      { name: "title", type: "string", required: true, description: "New session title." },
+    ],
+    disabled: !opencodeClient,
+    execute: async (args) => {
+      const sessionId = stringArg(args, "sessionId");
+      const title = stringArg(args, "title");
+      if (!sessionId) return { ok: false, error: "sessionId is required" };
+      if (!title) return { ok: false, error: "title is required" };
+      if (!opencodeClient) return { ok: false, error: "OpenCode client is not connected" };
+
+      const targetWorkspace = findSessionWorkspace(workspaces, sessionsByWorkspaceId, sessionId);
+      await opencodeClient.session.update({
+        sessionID: sessionId,
+        title,
+        directory: targetWorkspace?.path || selectedWorkspaceRoot || undefined,
+      });
+      await refreshRouteState();
+      return { ok: true, sessionId, title };
+    },
+  }), [opencodeClient, refreshRouteState, selectedWorkspaceRoot, sessionsByWorkspaceId, workspaces]);
+  useControlAction(renameSessionControlAction);
+
+  const deleteSessionControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.delete",
+    label: "Delete a session",
+    description: "Delete a session by ID. Destructive: only run after explicit user confirmation.",
+    sideEffect: "mutation",
+    requiresArgs: true,
+    requiresConfirmation: true,
+    args: [
+      { name: "sessionId", type: "string", required: true, description: "Session ID from session.list_sessions." },
+      { name: "confirmed", type: "boolean", required: true, description: "Must be true after explicit user confirmation." },
+    ],
+    disabled: !openworkClient,
+    execute: async (args) => {
+      const sessionId = stringArg(args, "sessionId");
+      const confirmed = booleanArg(args, "confirmed");
+      if (!sessionId) return { ok: false, error: "sessionId is required" };
+      if (!confirmed) return { ok: false, error: "Deletion requires confirmed: true after explicit user confirmation" };
+      if (!openworkClient) return { ok: false, error: "OpenWork server is not connected" };
+
+      const targetWorkspace = findSessionWorkspace(workspaces, sessionsByWorkspaceId, sessionId);
+      if (!targetWorkspace) return { ok: false, error: "Session was not found in the current session list" };
+      await openworkClient.deleteSession(targetWorkspace.id, sessionId);
+      if (selectedSessionId === sessionId) {
+        navigateToSessionRoot();
+      }
+      await refreshRouteState();
+      return { ok: true, sessionId, deleted: true };
+    },
+  }), [navigateToSessionRoot, openworkClient, refreshRouteState, selectedSessionId, sessionsByWorkspaceId, workspaces]);
+  useControlAction(deleteSessionControlAction);
+
+  const modelPickerControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.model_picker.open",
+    label: "Open the model picker",
+    description: "Open the current session model picker.",
+    sideEffect: "none",
+    disabled: !selectedWorkspaceId,
+    execute: openModelPicker,
+  }), [openModelPicker, selectedWorkspaceId]);
+  useControlAction(modelPickerControlAction);
+}
diff --git a/apps/app/src/react-app/domains/session/modals/model-picker-modal.tsx b/apps/app/src/react-app/domains/session/modals/model-picker-modal.tsx
new file mode 100644
index 0000000000..9ca1123265
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/modals/model-picker-modal.tsx
@@ -0,0 +1,579 @@
+/** @jsxImportSource react */
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type KeyboardEvent as ReactKeyboardEvent,
+} from "react";
+import { CheckCircle2, Circle, Search, X } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { modelEquals } from "../../../../app/utils";
+import type { ModelOption, ModelRef } from "../../../../app/types";
+
+// Minimal inline provider icon placeholder. The full ProviderIcon gets ported
+// from src/app/components/provider-icon.tsx in a later step of the plan.
+function ProviderIcon({
+  providerId,
+  size = 16,
+  className,
+}: {
+  providerId: string;
+  size?: number;
+  className?: string;
+}) {
+  const initial = providerId.trim().charAt(0).toUpperCase() || "?";
+  return (
+    <span
+      aria-hidden
+      className={className}
+      style={{
+        display: "inline-flex",
+        alignItems: "center",
+        justifyContent: "center",
+        width: size,
+        height: size,
+        fontSize: Math.round(size * 0.65),
+        fontWeight: 600,
+      }}
+    >
+      {initial}
+    </span>
+  );
+}
+
+export type ModelPickerModalProps = {
+  open: boolean;
+  options: ModelOption[];
+  filteredOptions: ModelOption[];
+  query: string;
+  setQuery: (value: string) => void;
+  target: "default" | "session";
+  current: ModelRef;
+  onSelect: (model: ModelRef) => void;
+  onBehaviorChange: (model: ModelRef, value: string | null) => void;
+  onOpenSettings: () => void;
+  onClose: (options?: { restorePromptFocus?: boolean }) => void;
+};
+
+type RenderedItem =
+  | { kind: "model"; opt: ModelOption }
+  | {
+      kind: "provider";
+      providerID: string;
+      title: string;
+      matchCount: number;
+    };
+
+export function ModelPickerModal(props: ModelPickerModalProps) {
+  const searchInputRef = useRef<HTMLInputElement | null>(null);
+  const optionRefs = useRef<HTMLDivElement[]>([]);
+  const [activeIndex, setActiveIndex] = useState(0);
+
+  const otherProviderLinks = useMemo(() => {
+    const seen = new Set<string>();
+    const items: { providerID: string; title: string; matchCount: number }[] =
+      [];
+    const counts = new Map<string, number>();
+
+    for (const opt of props.filteredOptions) {
+      if (opt.isConnected) continue;
+      counts.set(opt.providerID, (counts.get(opt.providerID) ?? 0) + 1);
+      if (seen.has(opt.providerID)) continue;
+      seen.add(opt.providerID);
+      items.push({
+        providerID: opt.providerID,
+        title: opt.description ?? opt.providerID,
+        matchCount: 1,
+      });
+    }
+
+    return items.map((item) => ({
+      ...item,
+      matchCount: counts.get(item.providerID) ?? 1,
+    }));
+  }, [props.filteredOptions]);
+
+  const renderedItems = useMemo<RenderedItem[]>(() => {
+    const models = props.filteredOptions.filter((opt) => opt.isConnected);
+    const recommended = models.filter((opt) => opt.isRecommended);
+    const others = models.filter((opt) => !opt.isRecommended);
+    return [
+      ...recommended.map((opt) => ({ kind: "model" as const, opt })),
+      ...others.map((opt) => ({ kind: "model" as const, opt })),
+      ...otherProviderLinks.map((item) => ({
+        kind: "provider" as const,
+        ...item,
+      })),
+    ];
+  }, [otherProviderLinks, props.filteredOptions]);
+
+  const activeModelIndex = useMemo(
+    () =>
+      renderedItems.findIndex(
+        (item) =>
+          item.kind === "model" &&
+          modelEquals(props.current, {
+            providerID: item.opt.providerID,
+            modelID: item.opt.modelID,
+          }),
+      ),
+    [props.current, renderedItems],
+  );
+
+  const recommendedOptions = useMemo(
+    () =>
+      renderedItems.flatMap((item, index) =>
+        item.kind === "model" && item.opt.isRecommended
+          ? [{ opt: item.opt, index }]
+          : [],
+      ),
+    [renderedItems],
+  );
+
+  const otherEnabledOptions = useMemo(
+    () =>
+      renderedItems.flatMap((item, index) =>
+        item.kind === "model" && !item.opt.isRecommended
+          ? [{ opt: item.opt, index }]
+          : [],
+      ),
+    [renderedItems],
+  );
+
+  const otherOptions = useMemo(
+    () =>
+      renderedItems.flatMap((item, index) =>
+        item.kind === "provider"
+          ? [
+              {
+                providerID: item.providerID,
+                title: item.title,
+                matchCount: item.matchCount,
+                index,
+              },
+            ]
+          : [],
+      ),
+    [renderedItems],
+  );
+
+  const clampIndex = useCallback(
+    (next: number) => {
+      const last = renderedItems.length - 1;
+      if (last < 0) return 0;
+      return Math.max(0, Math.min(next, last));
+    },
+    [renderedItems.length],
+  );
+
+  const scrollActiveIntoView = useCallback((idx: number) => {
+    const el = optionRefs.current[idx];
+    if (!el) return;
+    el.scrollIntoView({ block: "nearest" });
+  }, []);
+
+  const selectRenderedItem = useCallback(
+    (item: RenderedItem | undefined) => {
+      if (!item) return;
+      if (item.kind === "provider") {
+        props.onClose({ restorePromptFocus: false });
+        props.onOpenSettings();
+        return;
+      }
+      props.onSelect({
+        providerID: item.opt.providerID,
+        modelID: item.opt.modelID,
+      });
+    },
+    [props],
+  );
+
+  // Focus the search input whenever the modal opens.
+  useEffect(() => {
+    if (!props.open) return;
+    const frame = requestAnimationFrame(() => {
+      searchInputRef.current?.focus();
+      if (searchInputRef.current?.value) {
+        searchInputRef.current.select();
+      }
+    });
+    return () => cancelAnimationFrame(frame);
+  }, [props.open]);
+
+  // Keep the active option in sync with the current model on open / list change.
+  useEffect(() => {
+    if (!props.open) return;
+    const next = activeModelIndex >= 0 ? activeModelIndex : 0;
+    const clamped = clampIndex(next);
+    setActiveIndex(clamped);
+    const frame = requestAnimationFrame(() => scrollActiveIntoView(clamped));
+    return () => cancelAnimationFrame(frame);
+  }, [activeModelIndex, clampIndex, props.open, scrollActiveIntoView]);
+
+  // Window-level key handling.
+  useEffect(() => {
+    if (!props.open) return;
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        event.stopPropagation();
+        props.onClose();
+        return;
+      }
+      if (event.key === "ArrowDown") {
+        event.preventDefault();
+        event.stopPropagation();
+        setActiveIndex((current) => {
+          const next = clampIndex(current + 1);
+          requestAnimationFrame(() => scrollActiveIntoView(next));
+          return next;
+        });
+        return;
+      }
+      if (event.key === "ArrowUp") {
+        event.preventDefault();
+        event.stopPropagation();
+        setActiveIndex((current) => {
+          const next = clampIndex(current - 1);
+          requestAnimationFrame(() => scrollActiveIntoView(next));
+          return next;
+        });
+        return;
+      }
+      if (event.key === "Enter") {
+        if (event.isComposing || event.keyCode === 229) return;
+        const item = renderedItems[activeIndex];
+        if (!item) return;
+        event.preventDefault();
+        event.stopPropagation();
+        selectRenderedItem(item);
+      }
+    };
+
+    window.addEventListener("keydown", onKeyDown, true);
+    return () => window.removeEventListener("keydown", onKeyDown, true);
+  }, [activeIndex, clampIndex, renderedItems, scrollActiveIntoView, selectRenderedItem]);
+
+  if (!props.open) return null;
+
+  const registerOptionRef = (index: number) => (el: HTMLDivElement | null) => {
+    if (!el) return;
+    optionRefs.current[index] = el;
+  };
+
+  const renderOption = (opt: ModelOption, index: number) => {
+    const active = modelEquals(props.current, {
+      providerID: opt.providerID,
+      modelID: opt.modelID,
+    });
+    const isKeyboardActive = index === activeIndex;
+
+    return (
+      <div
+        key={`${opt.providerID}/${opt.modelID}`}
+        role="button"
+        tabIndex={0}
+        ref={registerOptionRef(index)}
+        className={[
+          "group w-full text-left rounded-xl px-3 py-2.5 transition-colors cursor-pointer",
+          active
+            ? "bg-gray-3 text-gray-12"
+            : isKeyboardActive
+              ? "bg-gray-2 text-gray-12"
+              : "text-gray-10 hover:bg-gray-1/70 hover:text-gray-11",
+        ].join(" ")}
+        onMouseEnter={() => setActiveIndex(index)}
+        onClick={() =>
+          props.onSelect({
+            providerID: opt.providerID,
+            modelID: opt.modelID,
+          })
+        }
+        onKeyDown={(event: ReactKeyboardEvent<HTMLDivElement>) => {
+          if (event.key !== "Enter" && event.key !== " ") return;
+          if (event.nativeEvent.isComposing) return;
+          event.preventDefault();
+          props.onSelect({
+            providerID: opt.providerID,
+            modelID: opt.modelID,
+          });
+        }}
+      >
+        <div className="flex items-start gap-3">
+          <ProviderIcon
+            providerId={opt.providerID}
+            size={16}
+            className={[
+              "mt-[1px] shrink-0 transition-colors",
+              active
+                ? "text-gray-12"
+                : "text-gray-10 group-hover:text-gray-11",
+            ].join(" ")}
+          />
+          <div className="flex-1 min-w-0">
+            <div
+              className={[
+                "text-[13px] flex items-center justify-between gap-2",
+                active ? "font-medium text-gray-12" : "text-current",
+              ].join(" ")}
+            >
+              <span className="truncate">{opt.title}</span>
+            </div>
+            <div
+              className={[
+                "mt-0.5 flex items-center gap-3 text-[11px]",
+                active
+                  ? "text-gray-10"
+                  : "text-gray-9 group-hover:text-gray-10",
+              ].join(" ")}
+            >
+              <span className="truncate">
+                {opt.description ?? opt.providerID}
+              </span>
+              <span className="ml-auto opacity-70 font-mono">
+                {opt.providerID}/{opt.modelID}
+              </span>
+            </div>
+            {opt.footer ? (
+              <div
+                className={[
+                  "text-[11px] mt-1",
+                  active
+                    ? "text-gray-10"
+                    : "text-gray-8 group-hover:text-gray-9",
+                ].join(" ")}
+              >
+                {opt.footer}
+              </div>
+            ) : null}
+            {active && (opt.behaviorOptions?.length ?? 0) > 0 ? (
+              <div
+                className="mt-3 flex items-center gap-2"
+                onKeyDown={(event) => event.stopPropagation()}
+              >
+                <span className="text-[11px] font-medium text-gray-10 mr-1">
+                  {opt.behaviorTitle}:
+                </span>
+                <div
+                  className="flex flex-wrap items-center gap-3"
+                  onClick={(event) => event.stopPropagation()}
+                >
+                  {(opt.behaviorOptions ?? []).map((option) => (
+                    <button
+                      key={option.value ?? "default"}
+                      type="button"
+                      className={[
+                        "text-[11px] transition-colors",
+                        opt.behaviorValue === option.value
+                          ? "text-gray-12 font-semibold"
+                          : "text-gray-10 hover:text-gray-12",
+                      ].join(" ")}
+                      onClick={(event) => {
+                        event.preventDefault();
+                        event.stopPropagation();
+                        props.onBehaviorChange(
+                          {
+                            providerID: opt.providerID,
+                            modelID: opt.modelID,
+                          },
+                          option.value,
+                        );
+                      }}
+                    >
+                      {option.label}
+                    </button>
+                  ))}
+                </div>
+              </div>
+            ) : null}
+          </div>
+        </div>
+      </div>
+    );
+  };
+
+  const renderProviderLink = (provider: {
+    providerID: string;
+    title: string;
+    matchCount: number;
+    index: number;
+  }) => {
+    const isKeyboardActive = provider.index === activeIndex;
+    return (
+      <div
+        key={provider.providerID}
+        role="button"
+        tabIndex={0}
+        ref={registerOptionRef(provider.index)}
+        className={[
+          "group w-full text-left rounded-xl px-3 py-2.5 transition-colors cursor-pointer",
+          isKeyboardActive
+            ? "bg-gray-2 text-gray-12"
+            : "text-gray-10 hover:bg-gray-1/70 hover:text-gray-11",
+        ].join(" ")}
+        onMouseEnter={() => setActiveIndex(provider.index)}
+        onClick={() => {
+          props.onClose({ restorePromptFocus: false });
+          props.onOpenSettings();
+        }}
+        onKeyDown={(event: ReactKeyboardEvent<HTMLDivElement>) => {
+          if (event.key !== "Enter" && event.key !== " ") return;
+          if (event.nativeEvent.isComposing) return;
+          event.preventDefault();
+          props.onClose({ restorePromptFocus: false });
+          props.onOpenSettings();
+        }}
+      >
+        <div className="flex items-start gap-3">
+          <ProviderIcon
+            providerId={provider.providerID}
+            size={16}
+            className={[
+              "mt-[1px] shrink-0 transition-colors",
+              isKeyboardActive
+                ? "text-gray-12"
+                : "text-gray-10 group-hover:text-gray-11",
+            ].join(" ")}
+          />
+          <div className="flex-1 min-w-0">
+            <div className="text-[13px] flex items-center justify-between gap-2 text-current">
+              <span className="truncate">{provider.title}</span>
+            </div>
+            <div
+              className={[
+                "mt-0.5 flex items-center gap-3 text-[11px]",
+                isKeyboardActive
+                  ? "text-gray-10"
+                  : "text-gray-9 group-hover:text-gray-10",
+              ].join(" ")}
+            >
+              <span className="truncate">
+                {t("model_picker.connect_provider_hint")}
+              </span>
+              <span className="ml-auto opacity-70">
+                {t("model_picker.model_count", { count: provider.matchCount })}
+              </span>
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  };
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-start justify-center p-4 overflow-y-auto">
+      <div className="bg-dls-surface border border-dls-border w-full max-w-lg rounded-[24px] shadow-[var(--dls-shell-shadow)] overflow-hidden max-h-[calc(100vh-2rem)] flex flex-col">
+        <div className="p-6 flex flex-col min-h-0">
+          <div className="flex items-start justify-between gap-4">
+            <div>
+              <h3 className="text-lg font-semibold text-gray-12">
+                {t(
+                  props.target === "default"
+                    ? "model_picker.default_model_title"
+                    : "model_picker.chat_model_title",
+                )}
+              </h3>
+              <p className="text-sm text-gray-11 mt-1">
+                {t(
+                  props.target === "default"
+                    ? "model_picker.default_model_desc"
+                    : "model_picker.chat_model_desc",
+                )}
+              </p>
+            </div>
+            <button
+              type="button"
+              className="inline-flex h-8 w-8 items-center justify-center rounded-full text-gray-10 transition-colors hover:bg-[var(--dls-hover)]"
+              onClick={() => props.onClose()}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          <div className="mt-5">
+            <div className="relative">
+              <Search
+                size={16}
+                className="absolute left-3 top-1/2 -translate-y-1/2 text-dls-secondary"
+              />
+              <input
+                ref={searchInputRef}
+                type="text"
+                value={props.query}
+                onChange={(event) => props.setQuery(event.currentTarget.value)}
+                placeholder={t("settings.search_models")}
+                className="w-full bg-dls-surface border border-dls-border rounded-xl py-2.5 pl-9 pr-3 text-sm text-dls-text placeholder:text-dls-secondary focus:outline-none focus:ring-1 focus:ring-[rgba(var(--dls-accent-rgb),0.2)] focus:border-dls-accent"
+              />
+            </div>
+            {props.query.trim() ? (
+              <div className="mt-2 text-xs text-dls-secondary">
+                {t("settings.showing_models", {
+                  count: props.filteredOptions.length,
+                  total: props.options.length,
+                })}
+              </div>
+            ) : null}
+          </div>
+
+          <div className="mt-4 space-y-4 overflow-y-auto pr-1 -mr-1 min-h-0">
+            {recommendedOptions.length > 0 ? (
+              <section className="space-y-2">
+                <div className="px-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-gray-9">
+                  {t("model_picker.recommended")}
+                </div>
+                {recommendedOptions.map(({ opt, index }) =>
+                  renderOption(opt, index),
+                )}
+              </section>
+            ) : null}
+
+            {otherEnabledOptions.length > 0 ? (
+              <section className="space-y-2">
+                <div className="px-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-gray-9">
+                  {t("model_picker.other_connected_models")}
+                </div>
+                {otherEnabledOptions.map(({ opt, index }) =>
+                  renderOption(opt, index),
+                )}
+              </section>
+            ) : null}
+
+            {otherOptions.length > 0 ? (
+              <section className="space-y-2">
+                <div className="px-1 text-[11px] font-semibold uppercase tracking-[0.12em] text-gray-9">
+                  {t("model_picker.more_providers")}
+                </div>
+                {otherOptions.map(renderProviderLink)}
+              </section>
+            ) : null}
+
+            {renderedItems.length === 0 ? (
+              <div className="rounded-2xl border border-gray-6/70 bg-gray-1/40 px-4 py-6 text-sm text-gray-10">
+                {t("model_picker.no_results")}
+              </div>
+            ) : null}
+          </div>
+
+          <div className="mt-5 flex justify-end shrink-0">
+            <button
+              type="button"
+              className="inline-flex items-center justify-center rounded-full border border-dls-border px-4 py-2 text-[13px] font-medium text-dls-text transition-colors hover:bg-[var(--dls-hover)]"
+              onClick={() => props.onClose()}
+            >
+              {t("settings.done")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// Small helper so downstream callers can keep the check/circle icons
+// colocated with the picker (future use for selected-state ornaments).
+export function ModelPickerSelectedIcon({ active }: { active: boolean }) {
+  return active ? <CheckCircle2 size={14} /> : <Circle size={14} />;
+}
diff --git a/apps/app/src/react-app/domains/session/modals/question-modal.tsx b/apps/app/src/react-app/domains/session/modals/question-modal.tsx
new file mode 100644
index 0000000000..c6a06bf752
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/modals/question-modal.tsx
@@ -0,0 +1,235 @@
+/** @jsxImportSource react */
+import { useEffect, useState } from "react";
+import type { QuestionInfo } from "@opencode-ai/sdk/v2/client";
+import { Check, ChevronRight, HelpCircle } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+export type QuestionModalProps = {
+  open: boolean;
+  questions: QuestionInfo[];
+  busy: boolean;
+  onReply: (answers: string[][]) => void;
+};
+
+export function QuestionModal(props: QuestionModalProps) {
+  const [currentIndex, setCurrentIndex] = useState(0);
+  const [answers, setAnswers] = useState<string[][]>([]);
+  const [currentSelection, setCurrentSelection] = useState<string[]>([]);
+  const [customInput, setCustomInput] = useState("");
+  const [focusedOptionIndex, setFocusedOptionIndex] = useState(0);
+
+  useEffect(() => {
+    if (!props.open) return;
+    setCurrentIndex(0);
+    setAnswers(new Array(props.questions.length).fill([]));
+    setCurrentSelection([]);
+    setCustomInput("");
+    setFocusedOptionIndex(0);
+  }, [props.open, props.questions.length]);
+
+  const currentQuestion = props.questions[currentIndex];
+  const isLastQuestion = currentIndex === props.questions.length - 1;
+  const canProceed = (() => {
+    if (!currentQuestion) return false;
+    if (currentQuestion.custom && customInput.trim().length > 0) return true;
+    return currentSelection.length > 0;
+  })();
+
+  const handleNext = () => {
+    if (!canProceed || !currentQuestion) return;
+    const nextAnswer = [...currentSelection];
+    if (currentQuestion.custom && customInput.trim()) {
+      nextAnswer.push(customInput.trim());
+    }
+    const newAnswers = [...answers];
+    newAnswers[currentIndex] = nextAnswer;
+    setAnswers(newAnswers);
+    if (isLastQuestion) {
+      props.onReply(newAnswers);
+    } else {
+      setCurrentIndex((i) => i + 1);
+      setCurrentSelection([]);
+      setCustomInput("");
+      setFocusedOptionIndex(0);
+    }
+  };
+
+  const toggleOption = (option: string) => {
+    if (!currentQuestion) return;
+    if (currentQuestion.multiple) {
+      setCurrentSelection((prev) =>
+        prev.includes(option) ? prev.filter((o) => o !== option) : [...prev, option],
+      );
+      return;
+    }
+    setCurrentSelection([option]);
+    if (!currentQuestion.custom) {
+      setTimeout(() => {
+        setAnswers((prevAnswers) => {
+          const newAnswers = [...prevAnswers];
+          newAnswers[currentIndex] = [option];
+          if (isLastQuestion) {
+            props.onReply(newAnswers);
+          } else {
+            setCurrentIndex((i) => i + 1);
+            setCurrentSelection([]);
+            setCustomInput("");
+            setFocusedOptionIndex(0);
+          }
+          return newAnswers;
+        });
+      }, 150);
+    }
+  };
+
+  useEffect(() => {
+    if (!props.open) return;
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (!currentQuestion) return;
+      const optionsCount = currentQuestion.options.length;
+
+      if (event.key === "ArrowDown") {
+        event.preventDefault();
+        setFocusedOptionIndex((prev) => (prev + 1) % optionsCount);
+      } else if (event.key === "ArrowUp") {
+        event.preventDefault();
+        setFocusedOptionIndex(
+          (prev) => (prev - 1 + optionsCount) % optionsCount,
+        );
+      } else if (event.key === "Enter") {
+        if (event.isComposing || event.keyCode === 229) return;
+        event.preventDefault();
+        if (
+          currentQuestion.custom &&
+          document.activeElement?.tagName === "INPUT"
+        ) {
+          handleNext();
+          return;
+        }
+        const option = currentQuestion.options[focusedOptionIndex]?.description;
+        if (option) toggleOption(option);
+      }
+    };
+
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [props.open, currentQuestion, focusedOptionIndex]);
+
+  if (!props.open || !currentQuestion) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-center justify-center p-4">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-lg rounded-2xl shadow-2xl overflow-hidden flex flex-col max-h-[85vh]">
+        <div className="p-6 border-b border-gray-6/40 bg-gray-2/50">
+          <div className="flex items-center gap-3 mb-2">
+            <div className="w-8 h-8 rounded-full bg-blue-9/20 flex items-center justify-center text-blue-9">
+              <HelpCircle size={18} />
+            </div>
+            <div>
+              <h3 className="text-lg font-semibold text-gray-12">
+                {currentQuestion.header || t("common.question")}
+              </h3>
+              <div className="text-xs text-gray-11 font-medium">
+                {t("question_modal.question_counter", undefined, {
+                  current: currentIndex + 1,
+                  total: props.questions.length,
+                })}
+              </div>
+            </div>
+          </div>
+          <p className="text-sm text-gray-11 mt-2 leading-relaxed">
+            {currentQuestion.question}
+          </p>
+        </div>
+
+        <div className="p-6 overflow-y-auto min-h-0 flex-1">
+          <div className="space-y-2">
+            {currentQuestion.options.map((opt, idx) => {
+              const isSelected = currentSelection.includes(opt.description);
+              const isFocused = focusedOptionIndex === idx;
+              return (
+                <button
+                  key={opt.description}
+                  type="button"
+                  className={`w-full text-left px-4 py-3 rounded-xl border text-sm transition-all duration-200 flex items-center justify-between group
+                        ${
+                          isSelected
+                            ? "bg-blue-9/10 border-blue-9/30 text-gray-12 shadow-sm"
+                            : "bg-gray-1 border-gray-6 hover:border-gray-8 text-gray-11 hover:text-gray-12 hover:bg-gray-3"
+                        }
+                        ${isFocused ? "ring-2 ring-blue-9/20 border-blue-9/40 bg-gray-3" : ""}
+                      `}
+                  onClick={() => {
+                    setFocusedOptionIndex(idx);
+                    toggleOption(opt.description);
+                  }}
+                >
+                  <span className="font-medium">{opt.description}</span>
+                  {isSelected ? (
+                    <div className="w-5 h-5 rounded-full bg-blue-9 flex items-center justify-center shadow-sm">
+                      <Check size={12} className="text-white" strokeWidth={3} />
+                    </div>
+                  ) : null}
+                </button>
+              );
+            })}
+          </div>
+
+          {currentQuestion.custom ? (
+            <div className="mt-4 pt-4 border-t border-dls-border">
+              <label className="block text-xs font-semibold text-dls-secondary mb-2 uppercase tracking-wide">
+                {t("question_modal.custom_answer_label")}
+              </label>
+              <input
+                type="text"
+                value={customInput}
+                onChange={(event) => setCustomInput(event.currentTarget.value)}
+                className="w-full px-4 py-3 rounded-xl bg-dls-surface border border-dls-border focus:border-dls-accent focus:ring-4 focus:ring-[rgba(var(--dls-accent-rgb),0.2)] focus:outline-none text-sm text-dls-text placeholder:text-dls-secondary transition-shadow"
+                placeholder={t("question_modal.custom_answer_placeholder")}
+                onKeyDown={(event) => {
+                  if (event.key === "Enter") {
+                    if (event.nativeEvent.isComposing || event.keyCode === 229)
+                      return;
+                    event.stopPropagation();
+                    handleNext();
+                  }
+                }}
+              />
+            </div>
+          ) : null}
+        </div>
+
+        <div className="p-6 border-t border-dls-border bg-dls-hover flex justify-between items-center">
+          <div className="text-xs text-dls-secondary flex items-center gap-2">
+            <span className="px-1.5 py-0.5 rounded border border-dls-border bg-dls-active font-mono">
+              ↑↓
+            </span>
+            <span>{t("common.navigate")}</span>
+            <span className="px-1.5 py-0.5 rounded border border-gray-6 bg-gray-3 font-mono ml-2">
+              ↵
+            </span>
+            <span>{t("common.select")}</span>
+          </div>
+
+          <div className="flex gap-2">
+            {currentQuestion.multiple || currentQuestion.custom ? (
+              <Button
+                onClick={handleNext}
+                disabled={!canProceed || props.busy}
+                className="!px-6"
+              >
+                {isLastQuestion ? t("common.submit") : t("common.next")}
+                {!isLastQuestion ? (
+                  <ChevronRight size={16} className="ml-1 -mr-1 opacity-60" />
+                ) : null}
+              </Button>
+            ) : null}
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/modals/rename-session-modal.tsx b/apps/app/src/react-app/domains/session/modals/rename-session-modal.tsx
new file mode 100644
index 0000000000..05787702b1
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/modals/rename-session-modal.tsx
@@ -0,0 +1,105 @@
+/** @jsxImportSource react */
+import { useEffect, useRef } from "react";
+import { X } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import {
+  inputClass,
+  pillGhostClass,
+  pillPrimaryClass,
+  pillSecondaryClass,
+} from "../../workspace/modal-styles";
+
+export type RenameSessionModalProps = {
+  open: boolean;
+  title: string;
+  busy: boolean;
+  canSave: boolean;
+  onClose: () => void;
+  onSave: () => void;
+  onTitleChange: (value: string) => void;
+};
+
+export function RenameSessionModal(props: RenameSessionModalProps) {
+  const inputRef = useRef<HTMLInputElement | null>(null);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const frame = requestAnimationFrame(() => {
+      inputRef.current?.focus();
+      inputRef.current?.select();
+    });
+    return () => cancelAnimationFrame(frame);
+  }, [props.open]);
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-center justify-center p-4">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-lg rounded-2xl shadow-2xl overflow-hidden">
+        <div className="p-6">
+          <div className="flex items-start justify-between gap-4">
+            <div>
+              <h3 className="text-lg font-semibold text-gray-12">
+                {t("session.rename_title")}
+              </h3>
+              <p className="text-sm text-gray-11 mt-1">
+                {t("session.rename_description")}
+              </p>
+            </div>
+            <button
+              type="button"
+              className={`${pillGhostClass} !p-2 rounded-full`}
+              onClick={props.onClose}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          <div className="mt-6">
+            <label className="mb-1.5 block text-[13px] font-medium text-dls-text">
+              {t("session.rename_label")}
+            </label>
+            <input
+              ref={inputRef}
+              type="text"
+              value={props.title}
+              onChange={(event) => props.onTitleChange(event.currentTarget.value)}
+              onKeyDown={(event) => {
+                if (
+                  event.key !== "Enter" ||
+                  event.nativeEvent.isComposing ||
+                  event.keyCode === 229
+                )
+                  return;
+                event.preventDefault();
+                if (props.canSave) props.onSave();
+              }}
+              placeholder={t("session.rename_placeholder")}
+              className={`${inputClass} bg-gray-3`}
+            />
+          </div>
+
+          <div className="mt-6 flex justify-end gap-2">
+            <button
+              type="button"
+              className={pillSecondaryClass}
+              onClick={props.onClose}
+              disabled={props.busy}
+            >
+              {t("common.cancel")}
+            </button>
+            <button
+              type="button"
+              className={pillPrimaryClass}
+              onClick={props.onSave}
+              disabled={!props.canSave}
+            >
+              {t("common.save")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/sidebar/workspace-session-list.tsx b/apps/app/src/react-app/domains/session/sidebar/workspace-session-list.tsx
new file mode 100644
index 0000000000..b229c5ae88
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sidebar/workspace-session-list.tsx
@@ -0,0 +1,893 @@
+/** @jsxImportSource react */
+import { useEffect, useRef, useState } from "react";
+import {
+  AlertCircle,
+  ChevronDown,
+  ChevronRight,
+  Loader2,
+  MoreHorizontal,
+  Plus,
+  RefreshCw,
+  RotateCcw,
+  Settings2,
+} from "lucide-react";
+
+import { getDisplaySessionTitle } from "../../../../app/lib/session-title";
+import type { WorkspaceInfo } from "../../../../app/lib/desktop";
+import type {
+  WorkspaceConnectionState,
+  WorkspaceSessionGroup,
+} from "../../../../app/types";
+import {
+  getWorkspaceTaskLoadErrorDisplay,
+  isSandboxWorkspace,
+  isWindowsPlatform,
+} from "../../../../app/utils";
+import { t } from "../../../../i18n";
+
+type Props = {
+  workspaceSessionGroups: WorkspaceSessionGroup[];
+  showInitialLoading?: boolean;
+  selectedWorkspaceId: string;
+  developerMode: boolean;
+  selectedSessionId: string | null;
+  showSessionActions?: boolean;
+  sessionStatusById?: Record<string, string>;
+  connectingWorkspaceId: string | null;
+  workspaceConnectionStateById: Record<string, WorkspaceConnectionState>;
+  newTaskDisabled: boolean;
+  onSelectWorkspace: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onOpenSession: (workspaceId: string, sessionId: string) => void;
+  onPrefetchSession?: (workspaceId: string, sessionId: string) => void;
+  onCreateTaskInWorkspace: (workspaceId: string) => void;
+  onOpenRenameSession?: () => void;
+  onOpenDeleteSession?: () => void;
+  onOpenRenameWorkspace: (workspaceId: string) => void;
+  onShareWorkspace: (workspaceId: string) => void;
+  onRevealWorkspace: (workspaceId: string) => void;
+  onRecoverWorkspace: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onTestWorkspaceConnection: (workspaceId: string) => Promise<boolean> | boolean | void;
+  onEditWorkspaceConnection: (workspaceId: string) => void;
+  onForgetWorkspace: (workspaceId: string) => void;
+  onOpenCreateWorkspace: () => void;
+};
+
+const MAX_SESSIONS_PREVIEW = 6;
+
+type SessionListItem = WorkspaceSessionGroup["sessions"][number];
+type FlattenedSessionRow = { session: SessionListItem; depth: number };
+type SessionTreeState = {
+  childrenByParent: Map<string, SessionListItem[]>;
+  ancestorIdsBySessionId: Map<string, string[]>;
+  descendantCountBySessionId: Map<string, number>;
+  activeIds: Set<string>;
+};
+
+const normalizeSessionParentID = (session: SessionListItem) => {
+  const parentID = session.parentID?.trim();
+  return parentID || "";
+};
+
+const getRootSessions = (sessions: WorkspaceSessionGroup["sessions"]) => {
+  const byID = new Set(sessions.map((session) => session.id));
+  return sessions.filter((session) => {
+    const parentID = normalizeSessionParentID(session);
+    return !parentID || !byID.has(parentID);
+  });
+};
+
+const buildSessionTreeState = (
+  sessions: WorkspaceSessionGroup["sessions"],
+  sessionStatusById: Record<string, string> | undefined,
+): SessionTreeState => {
+  const childrenByParent = new Map<string, SessionListItem[]>();
+  const ancestorIdsBySessionId = new Map<string, string[]>();
+  const descendantCountBySessionId = new Map<string, number>();
+  const activeIds = new Set<string>();
+  const sessionIds = new Set(sessions.map((session) => session.id));
+
+  sessions.forEach((session) => {
+    const parentID = normalizeSessionParentID(session);
+    if (!parentID || !sessionIds.has(parentID)) return;
+    const siblings = childrenByParent.get(parentID) ?? [];
+    siblings.push(session);
+    childrenByParent.set(parentID, siblings);
+  });
+
+  const walk = (session: SessionListItem, ancestors: string[]) => {
+    ancestorIdsBySessionId.set(session.id, ancestors);
+    const children = childrenByParent.get(session.id) ?? [];
+    let descendantCount = 0;
+    let subtreeActive = (sessionStatusById?.[session.id] ?? "idle") !== "idle";
+
+    children.forEach((child) => {
+      const childState = walk(child, [...ancestors, session.id]);
+      descendantCount += 1 + childState.descendantCount;
+      subtreeActive = subtreeActive || childState.subtreeActive;
+    });
+
+    descendantCountBySessionId.set(session.id, descendantCount);
+    if (subtreeActive) activeIds.add(session.id);
+    return { descendantCount, subtreeActive };
+  };
+
+  getRootSessions(sessions).forEach((session) => {
+    walk(session, []);
+  });
+
+  return {
+    childrenByParent,
+    ancestorIdsBySessionId,
+    descendantCountBySessionId,
+    activeIds,
+  };
+};
+
+const flattenSessionRows = (
+  sessions: WorkspaceSessionGroup["sessions"],
+  rootLimit: number,
+  tree: SessionTreeState,
+  expandedSessionIds: Set<string>,
+  forcedExpandedSessionIds: Set<string>,
+) => {
+  const roots = getRootSessions(sessions).slice(0, rootLimit);
+  const rows: FlattenedSessionRow[] = [];
+  const visited = new Set<string>();
+
+  const walk = (session: SessionListItem, depth: number) => {
+    if (visited.has(session.id)) return;
+    visited.add(session.id);
+    rows.push({ session, depth });
+    const children = tree.childrenByParent.get(session.id) ?? [];
+    if (!children.length) return;
+    const expanded = expandedSessionIds.has(session.id) || forcedExpandedSessionIds.has(session.id);
+    if (!expanded) return;
+    children.forEach((child) => walk(child, depth + 1));
+  };
+
+  roots.forEach((root) => walk(root, 0));
+  return rows;
+};
+
+const workspaceLabel = (workspace: WorkspaceInfo) =>
+  workspace.displayName?.trim() ||
+  workspace.openworkWorkspaceName?.trim() ||
+  workspace.name?.trim() ||
+  workspace.path?.trim() ||
+  t("workspace_list.workspace_fallback");
+
+const workspaceKindLabel = (workspace: WorkspaceInfo) =>
+  workspace.workspaceType === "remote"
+    ? isSandboxWorkspace(workspace)
+      ? t("workspace.sandbox_badge")
+      : t("workspace.remote_badge")
+    : t("workspace.local_badge");
+
+const WORKSPACE_SWATCHES = ["#2563eb", "#5a67d8", "#f97316", "#10b981"];
+
+const workspaceSwatchColor = (seed: string) => {
+  const value = seed.trim() || "workspace";
+  let hash = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    hash = (hash << 5) - hash + value.charCodeAt(index);
+    hash |= 0;
+  }
+  return WORKSPACE_SWATCHES[Math.abs(hash) % WORKSPACE_SWATCHES.length];
+};
+
+function RemoteConnectionIssueCard(props: {
+  message: string;
+  tone: "error" | "offline";
+  canRecover: boolean;
+  busy: boolean;
+  onRecover: () => void;
+  onTest: () => void;
+  onEdit: () => void;
+}) {
+  const isOffline = props.tone === "offline";
+  const shellClass = isOffline
+    ? "border-amber-7/35 bg-amber-2/45"
+    : "border-red-7/35 bg-red-1/40";
+  const iconClass = isOffline
+    ? "bg-amber-3/60 text-amber-11"
+    : "bg-red-3/60 text-red-11";
+  const detailClass = isOffline
+    ? "border-amber-7/25 bg-amber-1/40 text-amber-11"
+    : "border-red-7/25 bg-red-1/40 text-red-11";
+
+  return (
+    <div className={`w-full rounded-[15px] border px-3 py-3 text-left ${shellClass}`}>
+      <div className="flex items-start gap-2.5">
+        <div className={`mt-0.5 flex h-6 w-6 shrink-0 items-center justify-center rounded-full ${iconClass}`}>
+          <AlertCircle size={14} />
+        </div>
+        <div className="min-w-0 flex-1">
+          <div className="text-[12px] font-medium text-dls-text">
+            {t("workspace_list.remote_worker_unavailable")}
+          </div>
+          <div className="mt-1 text-[11px] leading-5 text-gray-10">
+            {t("workspace_list.remote_worker_unavailable_hint")}
+          </div>
+          <div
+            className={`mt-2 rounded-lg border px-2 py-1.5 text-[11px] leading-4 ${detailClass}`}
+            title={props.message}
+          >
+            {props.message}
+          </div>
+          <div className="mt-2 flex flex-wrap gap-1.5">
+            {props.canRecover ? (
+              <button
+                type="button"
+                className="inline-flex items-center gap-1.5 rounded-lg border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-gray-11 transition-colors hover:bg-gray-2 disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={props.onRecover}
+                disabled={props.busy}
+              >
+                <RotateCcw size={12} />
+                {t("workspace_list.recover")}
+              </button>
+            ) : null}
+            <button
+              type="button"
+              className="inline-flex items-center gap-1.5 rounded-lg border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-gray-11 transition-colors hover:bg-gray-2 disabled:cursor-not-allowed disabled:opacity-60"
+              onClick={props.onTest}
+              disabled={props.busy}
+            >
+              <RefreshCw size={12} />
+              {t("workspace_list.test_connection")}
+            </button>
+            <button
+              type="button"
+              className="inline-flex items-center gap-1.5 rounded-lg border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-gray-11 transition-colors hover:bg-gray-2 disabled:cursor-not-allowed disabled:opacity-60"
+              onClick={props.onEdit}
+              disabled={props.busy}
+            >
+              <Settings2 size={12} />
+              {t("common.edit")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function WorkspaceSessionList(props: Props) {
+  const [expandedWorkspaceIds, setExpandedWorkspaceIds] = useState<Set<string>>(
+    () => new Set(),
+  );
+  const [previewCountByWorkspaceId, setPreviewCountByWorkspaceId] = useState<Record<string, number>>({});
+  const [workspaceMenuId, setWorkspaceMenuId] = useState<string | null>(null);
+  const [sessionMenuOpen, setSessionMenuOpen] = useState(false);
+  const [expandedSessionIds, setExpandedSessionIds] = useState<Set<string>>(
+    () => new Set(),
+  );
+  const workspaceMenuRef = useRef<HTMLDivElement | null>(null);
+  const sessionMenuRef = useRef<HTMLDivElement | null>(null);
+
+  const revealLabel = isWindowsPlatform()
+    ? t("workspace_list.reveal_explorer")
+    : t("workspace_list.reveal_finder");
+
+  const expandWorkspace = (workspaceId: string) => {
+    const id = workspaceId.trim();
+    if (!id) return;
+    setExpandedWorkspaceIds((previous) => {
+      if (previous.has(id)) return previous;
+      const next = new Set(previous);
+      next.add(id);
+      return next;
+    });
+  };
+
+  const toggleWorkspaceExpanded = (workspaceId: string) => {
+    const id = workspaceId.trim();
+    if (!id) return;
+    setExpandedWorkspaceIds((previous) => {
+      const next = new Set(previous);
+      if (next.has(id)) {
+        next.delete(id);
+      } else {
+        next.add(id);
+      }
+      return next;
+    });
+  };
+
+  useEffect(() => {
+    const id = props.selectedWorkspaceId.trim();
+    if (!id) return;
+    // Keep the selected workspace visible without collapsing other workspaces.
+    // Collapsing the previous workspace on every cross-workspace session click
+    // makes the sidebar feel jumpy and hides the context the user just left.
+    expandWorkspace(id);
+  }, [props.selectedWorkspaceId]);
+
+  const previewCount = (workspaceId: string) =>
+    previewCountByWorkspaceId[workspaceId] ?? MAX_SESSIONS_PREVIEW;
+
+  const showMoreSessions = (workspaceId: string, totalRoots: number) => {
+    expandWorkspace(workspaceId);
+    setPreviewCountByWorkspaceId((current) => {
+      const next = { ...current };
+      const existing = next[workspaceId] ?? MAX_SESSIONS_PREVIEW;
+      next[workspaceId] = Math.min(existing + MAX_SESSIONS_PREVIEW, totalRoots);
+      return next;
+    });
+  };
+
+  const showMoreLabel = (workspaceId: string, totalRoots: number) => {
+    const remaining = Math.max(0, totalRoots - previewCount(workspaceId));
+    const nextCount = Math.min(MAX_SESSIONS_PREVIEW, remaining);
+    return nextCount > 0
+      ? t("workspace_list.show_more", undefined, { count: nextCount })
+      : t("workspace_list.show_more_fallback");
+  };
+
+  const toggleSessionExpanded = (sessionId: string) => {
+    const id = sessionId.trim();
+    if (!id) return;
+    setExpandedSessionIds((previous) => {
+      const next = new Set(previous);
+      if (next.has(id)) {
+        next.delete(id);
+      } else {
+        next.add(id);
+      }
+      return next;
+    });
+  };
+
+  useEffect(() => {
+    if (!workspaceMenuId) return;
+    const closeMenu = (event: PointerEvent) => {
+      const target = event.target as Node | null;
+      if (target && workspaceMenuRef.current?.contains(target)) return;
+      setWorkspaceMenuId(null);
+    };
+    window.addEventListener("pointerdown", closeMenu);
+    return () => {
+      window.removeEventListener("pointerdown", closeMenu);
+    };
+  }, [workspaceMenuId]);
+
+  useEffect(() => {
+    setSessionMenuOpen(false);
+  }, [props.selectedSessionId]);
+
+  useEffect(() => {
+    const workspaceId = props.selectedWorkspaceId.trim();
+    if (!workspaceId) return;
+
+    const group = props.workspaceSessionGroups.find(
+      (entry) => entry.workspace.id === workspaceId,
+    );
+    if (!group?.sessions.length) return;
+
+    const selectedId = props.selectedSessionId?.trim() ?? "";
+    const selectedIndex = selectedId
+      ? group.sessions.findIndex((session) => session.id === selectedId)
+      : -1;
+    const start = selectedIndex >= 0 ? Math.max(0, selectedIndex - 2) : 0;
+    const end = selectedIndex >= 0
+      ? Math.min(group.sessions.length, selectedIndex + 3)
+      : Math.min(group.sessions.length, 4);
+
+    group.sessions.slice(start, end).forEach((session) => {
+      props.onPrefetchSession?.(workspaceId, session.id);
+    });
+  }, [
+    props.onPrefetchSession,
+    props.selectedSessionId,
+    props.selectedWorkspaceId,
+    props.workspaceSessionGroups,
+  ]);
+
+  useEffect(() => {
+    if (!sessionMenuOpen) return;
+    const closeMenu = (event: PointerEvent) => {
+      const target = event.target as Node | null;
+      if (target && sessionMenuRef.current?.contains(target)) return;
+      setSessionMenuOpen(false);
+    };
+    window.addEventListener("pointerdown", closeMenu);
+    return () => {
+      window.removeEventListener("pointerdown", closeMenu);
+    };
+  }, [sessionMenuOpen]);
+
+  const renderSessionRow = (
+    workspaceId: string,
+    row: FlattenedSessionRow,
+    tree: SessionTreeState,
+    forcedExpandedSessionIds: Set<string>,
+  ) => {
+    const session = row.session;
+    const isSelected = props.selectedSessionId === session.id;
+    const displayTitle = getDisplaySessionTitle(session.title);
+    const hasChildren = (tree.descendantCountBySessionId.get(session.id) ?? 0) > 0;
+    const isExpanded = expandedSessionIds.has(session.id) || forcedExpandedSessionIds.has(session.id);
+    const isSessionActive = tree.activeIds.has(session.id);
+    const canManageSession = Boolean(
+      props.showSessionActions &&
+      isSelected &&
+      (props.onOpenRenameSession || props.onOpenDeleteSession),
+    );
+
+    const openSession = () => {
+      setSessionMenuOpen(false);
+      props.onOpenSession(workspaceId, session.id);
+    };
+
+    const prefetchSession = () => {
+      if (workspaceId !== props.selectedWorkspaceId) return;
+      props.onPrefetchSession?.(workspaceId, session.id);
+    };
+
+    return (
+      <div key={session.id} className="relative">
+        <div
+          role="button"
+          tabIndex={0}
+          className={`group flex min-h-9 w-full items-center justify-between rounded-xl px-3 py-1.5 text-left text-[13px] transition-colors ${
+            isSelected
+              ? "bg-gray-3 text-gray-12"
+              : "text-gray-10 hover:bg-gray-1/70 hover:text-gray-11"
+          }`}
+          style={{ marginLeft: `${Math.min(row.depth, 4) * 16}px` }}
+          onPointerEnter={prefetchSession}
+          onFocus={prefetchSession}
+          onClick={openSession}
+          onKeyDown={(event) => {
+            if (event.key !== "Enter" && event.key !== " ") return;
+            if (event.nativeEvent.isComposing || event.keyCode === 229) return;
+            event.preventDefault();
+            openSession();
+          }}
+        >
+          <div className="mr-2.5 flex min-w-0 flex-1 items-center gap-2">
+            {hasChildren ? (
+              <button
+                type="button"
+                className="-ml-1 flex h-6 w-6 shrink-0 items-center justify-center rounded-md text-gray-9 transition-colors hover:bg-gray-3/80 hover:text-gray-11"
+                aria-label={isExpanded ? t("workspace_list.hide_child_sessions") : t("workspace_list.show_child_sessions")}
+                onClick={(event) => {
+                  event.preventDefault();
+                  event.stopPropagation();
+                  toggleSessionExpanded(session.id);
+                }}
+              >
+                {isExpanded ? <ChevronDown size={13} /> : <ChevronRight size={13} />}
+              </button>
+            ) : row.depth > 0 ? (
+              <span className="h-[1px] w-3 shrink-0 rounded-full bg-dls-border" />
+            ) : null}
+
+            {isSessionActive ? <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-amber-9" /> : null}
+            <span
+              className={`block min-w-0 truncate ${
+                isSelected ? "font-medium text-gray-12" : "font-normal text-current"
+              }`}
+              title={displayTitle}
+            >
+              {displayTitle}
+            </span>
+          </div>
+
+          <div className="ml-auto flex shrink-0 items-center gap-1">
+            {canManageSession ? (
+              <button
+                type="button"
+                className="flex h-7 w-7 items-center justify-center rounded-md text-gray-9 transition-colors hover:bg-gray-3/80 hover:text-gray-11"
+                aria-label={t("workspace_list.session_actions")}
+                onClick={(event) => {
+                  event.preventDefault();
+                  event.stopPropagation();
+                  setSessionMenuOpen((current) => !current);
+                }}
+              >
+                <MoreHorizontal size={14} />
+              </button>
+            ) : null}
+          </div>
+        </div>
+
+        {canManageSession && sessionMenuOpen ? (
+          <div
+            ref={sessionMenuRef}
+            className="absolute right-0 top-[calc(100%+6px)] z-20 w-48 rounded-[18px] border border-dls-border bg-dls-surface p-1.5 shadow-[var(--dls-shell-shadow)]"
+            onClick={(event) => event.stopPropagation()}
+          >
+            {props.onOpenRenameSession ? (
+              <button
+                type="button"
+                className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                onClick={() => {
+                  setSessionMenuOpen(false);
+                  props.onOpenRenameSession?.();
+                }}
+              >
+                {t("workspace_list.rename_session")}
+              </button>
+            ) : null}
+
+            {props.onOpenDeleteSession ? (
+              <button
+                type="button"
+                className="w-full rounded-xl px-3 py-2 text-left text-sm text-red-11 transition-colors hover:bg-red-1/40"
+                onClick={() => {
+                  setSessionMenuOpen(false);
+                  props.onOpenDeleteSession?.();
+                }}
+              >
+                {t("workspace_list.delete_session")}
+              </button>
+            ) : null}
+          </div>
+        ) : null}
+      </div>
+    );
+  };
+
+  return (
+    <div className="flex h-full min-h-0 min-w-0 flex-1 flex-col">
+      <div className="min-h-0 min-w-0 flex-1 overflow-x-hidden overflow-y-auto pr-1">
+        <div className="space-y-2 pb-3">
+          {props.workspaceSessionGroups.map((group) => {
+            const tree = buildSessionTreeState(group.sessions, props.sessionStatusById);
+            const forcedExpandedSessionIds = new Set(
+              props.selectedSessionId
+                ? tree.ancestorIdsBySessionId.get(props.selectedSessionId) ?? []
+                : [],
+            );
+            const workspace = group.workspace;
+            const isConnecting = props.connectingWorkspaceId === workspace.id;
+            const connectionState = props.workspaceConnectionStateById[workspace.id] ?? {
+              status: "idle" as const,
+              message: null,
+            };
+            const isConnectionActionBusy =
+              isConnecting || connectionState.status === "connecting";
+            const canRecover =
+              workspace.workspaceType === "remote" && connectionState.status === "error";
+            const isMenuOpen = workspaceMenuId === workspace.id;
+            const taskLoadError = getWorkspaceTaskLoadErrorDisplay(workspace, group.error);
+            const connectionIssueMessage =
+              connectionState.status === "error"
+                ? connectionState.message?.trim() || taskLoadError.message
+                : taskLoadError.message;
+            const showRemoteConnectionIssue =
+              workspace.workspaceType === "remote" &&
+              Boolean(connectionIssueMessage) &&
+              (connectionState.status === "error" || group.status === "error");
+            const statusLabel = (() => {
+              const connectionMessage = connectionState.message?.trim() ?? "";
+              if (showRemoteConnectionIssue) return t("workspace_list.unavailable");
+              if (connectionState.status === "error") return connectionMessage || taskLoadError.message;
+              if (connectionState.status === "connected") return connectionMessage || t("status.connected");
+              if (group.status === "error") return taskLoadError.label;
+              if (isConnectionActionBusy) return t("workspace_list.connecting");
+              if (!props.developerMode) return "";
+              if (props.selectedWorkspaceId === workspace.id) return t("workspace.selected");
+              return workspaceKindLabel(workspace);
+            })();
+            const statusTone = connectionState.status === "connected"
+              ? "text-green-11"
+              : connectionState.status === "error" || group.status === "error"
+              ? taskLoadError.tone === "offline"
+                ? "text-amber-11"
+                : "text-red-11"
+              : "text-gray-9";
+            const rootSessions = getRootSessions(group.sessions);
+            const sessionRows = flattenSessionRows(
+              group.sessions,
+              previewCount(workspace.id),
+              tree,
+              expandedSessionIds,
+              forcedExpandedSessionIds,
+            );
+
+            return (
+              <div key={workspace.id} className="space-y-2">
+                <div className="relative group">
+                  <div
+                    role="button"
+                    tabIndex={0}
+                    className={`w-full flex items-center justify-between rounded-xl px-3.5 py-2.5 text-left text-[13px] transition-colors ${
+                      props.selectedWorkspaceId === workspace.id
+                        ? "bg-gray-2/70 text-gray-12"
+                        : "text-gray-10 hover:bg-gray-1/70 hover:text-gray-12"
+                    } ${isConnecting ? "opacity-75" : ""}`}
+                    onClick={() => {
+                      expandWorkspace(workspace.id);
+                      void Promise.resolve(props.onSelectWorkspace(workspace.id));
+                    }}
+                    onKeyDown={(event) => {
+                      if (event.key !== "Enter" && event.key !== " ") return;
+                      if (event.nativeEvent.isComposing || event.keyCode === 229) return;
+                      event.preventDefault();
+                      expandWorkspace(workspace.id);
+                      void Promise.resolve(props.onSelectWorkspace(workspace.id));
+                    }}
+                  >
+                    <div className="flex min-w-0 items-center gap-3.5">
+                      <div
+                        className="flex h-5.5 w-5.5 shrink-0 items-center justify-center rounded-full"
+                        style={{
+                          backgroundColor: workspaceSwatchColor(workspace.id || workspaceLabel(workspace)),
+                        }}
+                      />
+                      <div className="min-w-0 flex-1">
+                        <div className="min-w-0 truncate text-[14px] font-normal text-dls-text">
+                          {workspaceLabel(workspace)}
+                        </div>
+                        {statusLabel ? (
+                          <div className={`mt-0.5 truncate text-[11px] ${statusTone}`} title={statusLabel}>
+                            {statusLabel}
+                          </div>
+                        ) : null}
+                      </div>
+                    </div>
+
+                    <div className="ml-4 flex shrink-0 items-center gap-1.5">
+                      {group.status === "loading" || isConnecting ? (
+                        <Loader2 size={14} className="animate-spin text-gray-9" />
+                      ) : null}
+
+                      <div
+                        className={`items-center gap-0.5 ${
+                          props.selectedWorkspaceId === workspace.id
+                            ? "flex"
+                            : "hidden group-hover:flex group-focus-within:flex"
+                        }`}
+                      >
+                        <button
+                          type="button"
+                          className="rounded-md p-1 text-gray-9 hover:bg-gray-3/80 hover:text-gray-11"
+                          onClick={(event) => {
+                            event.stopPropagation();
+                            props.onCreateTaskInWorkspace(workspace.id);
+                          }}
+                          disabled={props.newTaskDisabled}
+                          aria-label={t("session.new_task")}
+                        >
+                          <Plus size={14} />
+                        </button>
+
+                        <button
+                          type="button"
+                          className="rounded-md p-1 text-gray-9 hover:bg-gray-3/80 hover:text-gray-11"
+                          onClick={(event) => {
+                            event.stopPropagation();
+                            setWorkspaceMenuId((current) => (current === workspace.id ? null : workspace.id));
+                          }}
+                          aria-label={t("workspace_list.workspace_options")}
+                        >
+                          <MoreHorizontal size={14} />
+                        </button>
+                      </div>
+
+                      <button
+                        type="button"
+                        className="rounded-md p-1 text-gray-9 hover:bg-gray-3/80 hover:text-gray-11"
+                        aria-label={
+                          expandedWorkspaceIds.has(workspace.id)
+                            ? t("sidebar.collapse")
+                            : t("sidebar.expand")
+                        }
+                        onClick={(event) => {
+                          event.stopPropagation();
+                          toggleWorkspaceExpanded(workspace.id);
+                        }}
+                      >
+                        {expandedWorkspaceIds.has(workspace.id) ? (
+                          <ChevronDown size={14} />
+                        ) : (
+                          <ChevronRight size={14} />
+                        )}
+                      </button>
+                    </div>
+                  </div>
+
+                  {isMenuOpen ? (
+                    <div
+                      ref={workspaceMenuRef}
+                      className="absolute right-0 top-[calc(100%+6px)] z-20 w-48 rounded-[18px] border border-dls-border bg-dls-surface p-1.5 shadow-[var(--dls-shell-shadow)]"
+                      onClick={(event) => event.stopPropagation()}
+                    >
+                      <button
+                        type="button"
+                        className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                        onClick={() => {
+                          props.onOpenRenameWorkspace(workspace.id);
+                          setWorkspaceMenuId(null);
+                        }}
+                      >
+                        {t("workspace_list.edit_name")}
+                      </button>
+                      <button
+                        type="button"
+                        className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                        onClick={() => {
+                          props.onShareWorkspace(workspace.id);
+                          setWorkspaceMenuId(null);
+                        }}
+                      >
+                        {t("workspace_list.share")}
+                      </button>
+                      {workspace.workspaceType === "local" ? (
+                        <button
+                          type="button"
+                          className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                          onClick={() => {
+                            props.onRevealWorkspace(workspace.id);
+                            setWorkspaceMenuId(null);
+                          }}
+                        >
+                          {revealLabel}
+                        </button>
+                      ) : null}
+                      {workspace.workspaceType === "remote" ? (
+                        <>
+                          {canRecover ? (
+                            <button
+                              type="button"
+                              className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                              onClick={() => {
+                                void Promise.resolve(props.onRecoverWorkspace(workspace.id));
+                                setWorkspaceMenuId(null);
+                              }}
+                              disabled={isConnectionActionBusy}
+                            >
+                              {t("workspace_list.recover")}
+                            </button>
+                          ) : null}
+                          <button
+                            type="button"
+                            className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                            onClick={() => {
+                              void Promise.resolve(props.onTestWorkspaceConnection(workspace.id));
+                              setWorkspaceMenuId(null);
+                            }}
+                            disabled={isConnectionActionBusy}
+                          >
+                            {t("workspace_list.test_connection")}
+                          </button>
+                          <button
+                            type="button"
+                            className="w-full rounded-xl px-3 py-2 text-left text-sm text-gray-11 transition-colors hover:bg-gray-2"
+                            onClick={() => {
+                              props.onEditWorkspaceConnection(workspace.id);
+                              setWorkspaceMenuId(null);
+                            }}
+                            disabled={isConnectionActionBusy}
+                          >
+                            {t("workspace_list.edit_connection")}
+                          </button>
+                        </>
+                      ) : null}
+                      <button
+                        type="button"
+                        className="w-full rounded-xl px-3 py-2 text-left text-sm text-red-11 transition-colors hover:bg-red-1/40"
+                        onClick={() => {
+                          props.onForgetWorkspace(workspace.id);
+                          setWorkspaceMenuId(null);
+                        }}
+                      >
+                        {t("workspace_list.remove_workspace")}
+                      </button>
+                    </div>
+                  ) : null}
+                </div>
+
+                {expandedWorkspaceIds.has(workspace.id) ? (
+                  <div className="mt-3 px-1 pb-1">
+                    <div className="relative flex flex-col gap-1 pl-2.5 before:absolute before:bottom-2 before:left-0 before:top-2 before:w-[2px] before:bg-gray-3 before:content-['']">
+                      {showRemoteConnectionIssue ? (
+                        <RemoteConnectionIssueCard
+                          message={connectionIssueMessage}
+                          tone={taskLoadError.tone}
+                          canRecover={canRecover}
+                          busy={isConnectionActionBusy}
+                          onRecover={() => {
+                            void Promise.resolve(props.onRecoverWorkspace(workspace.id));
+                          }}
+                          onTest={() => {
+                            void Promise.resolve(props.onTestWorkspaceConnection(workspace.id));
+                          }}
+                          onEdit={() => {
+                            props.onEditWorkspaceConnection(workspace.id);
+                          }}
+                        />
+                      ) : null}
+                      {props.showInitialLoading ? (
+                        <div className="space-y-2">
+                          {[0, 1, 2].map((idx) => (
+                            <div
+                              key={`${workspace.id}:skeleton:${idx}`}
+                              className="w-full rounded-[15px] border border-dls-border/70 bg-dls-hover/30 px-3 py-2.5"
+                            >
+                              <div
+                                className="h-2.5 rounded-full bg-dls-hover/80 animate-pulse"
+                                style={{ width: idx === 0 ? "62%" : idx === 1 ? "78%" : "54%" }}
+                              />
+                            </div>
+                          ))}
+                        </div>
+                      ) : group.status === "loading" && group.sessions.length === 0 ? (
+                        <div className="w-full rounded-[15px] px-3 py-2.5 text-left text-[11px] text-gray-10">
+                          {t("workspace.loading_tasks")}
+                        </div>
+                      ) : group.sessions.length > 0 ? (
+                        <>
+                          {sessionRows.map((row) => renderSessionRow(workspace.id, row, tree, forcedExpandedSessionIds))}
+
+                          {group.sessions.length === 0 && group.status === "ready" ? (
+                            <button
+                              type="button"
+                              className="group/empty w-full rounded-[15px] border border-transparent px-3 py-2.5 text-left text-[11px] text-gray-10 transition-colors hover:bg-gray-2/60 hover:text-gray-11"
+                              onClick={() => props.onCreateTaskInWorkspace(workspace.id)}
+                              disabled={props.newTaskDisabled}
+                            >
+                              <span className="group-hover/empty:hidden">{t("workspace.no_tasks")}</span>
+                              <span className="hidden group-hover/empty:inline font-medium">
+                                {t("workspace.new_task_inline")}
+                              </span>
+                            </button>
+                          ) : null}
+
+                          {rootSessions.length > previewCount(workspace.id) ? (
+                            <button
+                              type="button"
+                              className="w-full rounded-[15px] border border-transparent px-3 py-2.5 text-left text-[11px] text-gray-10 transition-colors hover:bg-gray-2/60 hover:text-gray-11"
+                              onClick={() => showMoreSessions(workspace.id, rootSessions.length)}
+                            >
+                              {showMoreLabel(workspace.id, rootSessions.length)}
+                            </button>
+                          ) : null}
+                        </>
+                      ) : showRemoteConnectionIssue ? null : group.status === "error" ? (
+                        <div
+                          className={`w-full rounded-[15px] border px-3 py-2.5 text-left text-[11px] ${
+                            taskLoadError.tone === "offline"
+                              ? "border-amber-7/35 bg-amber-2/50 text-amber-11"
+                              : "border-red-7/35 bg-red-1/40 text-red-11"
+                          }`}
+                          title={taskLoadError.title}
+                        >
+                          {taskLoadError.message}
+                        </div>
+                      ) : (
+                        <button
+                          type="button"
+                          className="group/empty w-full rounded-[15px] border border-transparent px-3 py-2.5 text-left text-[11px] text-gray-10 transition-colors hover:bg-gray-2/60 hover:text-gray-11"
+                          onClick={() => props.onCreateTaskInWorkspace(workspace.id)}
+                          disabled={props.newTaskDisabled}
+                        >
+                          <span className="group-hover/empty:hidden">{t("workspace.no_tasks")}</span>
+                          <span className="hidden group-hover/empty:inline font-medium">
+                            {t("workspace.new_task_inline")}
+                          </span>
+                        </button>
+                      )}
+                    </div>
+                  </div>
+                ) : null}
+              </div>
+            );
+          })}
+        </div>
+      </div>
+
+      <div className="relative mt-auto border-t border-dls-border/80 bg-dls-sidebar px-3 pt-3 pb-4">
+        <button
+          type="button"
+          className="w-full flex items-center justify-center gap-2 rounded-[18px] border border-dls-border bg-dls-surface px-3.5 py-2.5 text-[12px] font-medium text-gray-11 shadow-[var(--dls-card-shadow)] transition-colors hover:bg-gray-2"
+          onClick={props.onOpenCreateWorkspace}
+        >
+          <Plus size={14} />
+          {t("workspace_list.add_workspace")}
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/composer/composer.tsx b/apps/app/src/react-app/domains/session/surface/composer/composer.tsx
new file mode 100644
index 0000000000..76c81339ae
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/composer/composer.tsx
@@ -0,0 +1,1506 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import type { Agent } from "@opencode-ai/sdk/v2/client";
+import { ArrowUp, Check, ChevronDown, ChevronRight, FileText, Paperclip, Plug, Settings, Square, Terminal, X, Zap } from "lucide-react";
+import fuzzysort from "fuzzysort";
+import type { CloudImportedPlugin, CloudImportedPluginFile } from "../../../../../app/cloud/import-state";
+import type { ComposerAttachment, McpServerEntry, McpStatusMap, SkillCard, SlashCommandOption } from "../../../../../app/types";
+import { t } from "../../../../../i18n";
+import { LexicalPromptEditor } from "./editor";
+import {
+  ReactComposerNotice,
+  type ReactComposerNotice as ReactComposerNoticeData,
+} from "./notice";
+
+type MentionItem = {
+  id: string;
+  kind: "agent" | "file";
+  value: string;
+  label: string;
+};
+
+type PastedTextChip = {
+  id: string;
+  label: string;
+  text: string;
+  lines: number;
+};
+
+type ToolMenuSettingsSection = "commands" | "skills" | "mcps" | "plugins";
+type ToolMenuSection = "commands" | "skills" | "mcps" | `plugin:${string}`;
+
+type ComposerProps = {
+  draft: string;
+  mentions: Record<string, "agent" | "file">;
+  onDraftChange: (value: string) => void;
+  onSend: () => void | Promise<void>;
+  onStop: () => void | Promise<void>;
+  busy: boolean;
+  disabled: boolean;
+  statusLabel: string;
+  modelLabel: string;
+  onModelClick: () => void;
+  attachments: ComposerAttachment[];
+  onAttachFiles: (files: File[]) => void;
+  onRemoveAttachment: (id: string) => void;
+  attachmentsEnabled: boolean;
+  attachmentsDisabledReason: string | null;
+  modelVariantLabel: string;
+  modelVariant: string | null;
+  modelBehaviorOptions?: { value: string | null; label: string }[];
+  onModelVariantChange: (value: string | null) => void;
+  agentLabel: string;
+  selectedAgent: string | null;
+  listAgents: () => Promise<Agent[]>;
+  onSelectAgent: (agent: string | null) => void;
+  listCommands: () => Promise<SlashCommandOption[]>;
+  listSkills?: () => Promise<SkillCard[]>;
+  skills?: SkillCard[];
+  listMcp?: () => Promise<{ servers: McpServerEntry[]; statuses: McpStatusMap; status: string | null }>;
+  mcpServers?: McpServerEntry[];
+  mcpStatus?: string | null;
+  mcpStatuses?: McpStatusMap;
+  listImportedPlugins?: () => Promise<CloudImportedPlugin[]>;
+  importedPlugins?: CloudImportedPlugin[];
+  onOpenSettingsSection?: (section: ToolMenuSettingsSection) => void;
+  recentFiles: string[];
+  searchFiles: (query: string) => Promise<string[]>;
+  onInsertMention: (kind: "agent" | "file", value: string) => void;
+  notice: ReactComposerNoticeData | null;
+  onNotice: (notice: ReactComposerNoticeData) => void;
+  onPasteText: (text: string) => void;
+  onUnsupportedFileLinks: (links: string[]) => void;
+  pastedText: PastedTextChip[];
+  onRevealPastedText: (id: string) => void;
+  onRemovePastedText: (id: string) => void;
+  isRemoteWorkspace: boolean;
+  isSandboxWorkspace: boolean;
+  onUploadInboxFiles?: ((files: File[]) => void | Promise<unknown>) | null;
+  draftScopeKey?: string;
+  compactTopSpacing?: boolean;
+};
+
+const FLUSH_PROMPT_EVENT = "openwork:flushPromptDraft";
+const FOCUS_PROMPT_EVENT = "openwork:focusPrompt";
+const MAX_ATTACHMENT_BYTES = 8 * 1024 * 1024;
+const IMAGE_COMPRESS_MAX_PX = 2048;
+const IMAGE_COMPRESS_QUALITY = 0.82;
+const IMAGE_COMPRESS_TARGET_BYTES = 1_500_000;
+const ACCEPTED_IMAGE_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+const ACCEPTED_FILE_TYPES = [...ACCEPTED_IMAGE_TYPES, "application/pdf"];
+const FILE_URL_RE = /^file:\/\//i;
+const HTTP_URL_RE = /^https?:\/\//i;
+
+/**
+ * Extract external file/URL drops from a clipboard. Only used when the user
+ * drag-drops a file reference from another app (Finder / browser), which sets
+ * the text/uri-list MIME type explicitly. Plain text pastes — even ones that
+ * contain absolute paths like "/Users/..." — are NEVER treated as links here
+ * because that intercepted real text pastes and made composer paste feel
+ * broken. Plain text goes straight into the editor via Lexical's default.
+ */
+function parseClipboardUriList(clipboard: DataTransfer) {
+  const raw = clipboard.getData("text/uri-list") ?? "";
+  if (!raw.trim()) return [];
+  const links: string[] = [];
+  const seen = new Set<string>();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (!FILE_URL_RE.test(trimmed) && !HTTP_URL_RE.test(trimmed)) continue;
+    const normalized = encodeURI(trimmed);
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    links.push(normalized);
+  }
+  return links;
+}
+
+function formatBytes(size: number) {
+  if (size < 1024) return `${size} B`;
+  if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
+  return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+function isImageAttachment(attachment: ComposerAttachment) {
+  return attachment.kind === "image" || attachment.mimeType.startsWith("image/");
+}
+
+const isSupportedAttachmentType = (mime: string) => ACCEPTED_FILE_TYPES.includes(mime);
+
+async function compressImageFile(file: File): Promise<File> {
+  if (file.type === "image/gif" || file.size <= IMAGE_COMPRESS_TARGET_BYTES) {
+    return file;
+  }
+
+  const bitmap = await createImageBitmap(file);
+  const { width, height } = bitmap;
+  const maxDim = Math.max(width, height);
+  const scale = maxDim > IMAGE_COMPRESS_MAX_PX ? IMAGE_COMPRESS_MAX_PX / maxDim : 1;
+  const targetW = Math.round(width * scale);
+  const targetH = Math.round(height * scale);
+
+  let blob: Blob | null = null;
+
+  if (typeof OffscreenCanvas !== "undefined") {
+    const offscreen = new OffscreenCanvas(targetW, targetH);
+    const ctx = offscreen.getContext("2d");
+    if (ctx) {
+      ctx.drawImage(bitmap, 0, 0, targetW, targetH);
+      blob = await offscreen.convertToBlob({
+        type: "image/jpeg",
+        quality: IMAGE_COMPRESS_QUALITY,
+      });
+    }
+  }
+
+  if (!blob) {
+    const canvas = document.createElement("canvas");
+    canvas.width = targetW;
+    canvas.height = targetH;
+    const ctx = canvas.getContext("2d");
+    if (ctx) {
+      ctx.drawImage(bitmap, 0, 0, targetW, targetH);
+      blob = await new Promise<Blob | null>((resolve) =>
+        canvas.toBlob(resolve, "image/jpeg", IMAGE_COMPRESS_QUALITY),
+      );
+    }
+  }
+
+  bitmap.close();
+
+  if (!blob || blob.size >= file.size) {
+    return file;
+  }
+
+  const stem = file.name.replace(/\.[^.]+$/, "") || "image";
+  return new File([blob], `${stem}.jpg`, { type: "image/jpeg" });
+}
+
+function formatMcpStatusLabel(status: McpServerStatus | undefined) {
+  switch (status) {
+    case "connected":
+      return t("mcp.friendly_status_ready");
+    case "needs_auth":
+    case "needs_client_registration":
+      return t("mcp.friendly_status_needs_signin");
+    case "disabled":
+      return t("mcp.friendly_status_paused");
+    case "disconnected":
+      return t("mcp.friendly_status_offline");
+    case "failed":
+    default:
+      return t("mcp.friendly_status_issue");
+  }
+}
+
+type McpServerStatus = "connected" | "needs_auth" | "needs_client_registration" | "failed" | "disabled" | "disconnected";
+
+function toReactMcpStatus(name: string, entry: McpServerEntry, statuses: McpStatusMap): McpServerStatus {
+  const configured = statuses[name];
+  if (configured?.status === "connected") return "connected";
+  if (configured?.status === "needs_auth") return "needs_auth";
+  if (configured?.status === "needs_client_registration") return "needs_client_registration";
+  if (configured?.status === "failed") return "failed";
+  if (configured?.status === "disabled" || entry.config.enabled === false || entry.config.enabled === undefined && entry.config.type === "local" && entry.config.command?.length === 0) {
+    return entry.config.enabled === false ? "disabled" : configured?.status === "disabled" ? "disabled" : "disconnected";
+  }
+  return "disconnected";
+}
+
+function mcpStatusBadgeClass(status: McpServerStatus) {
+  switch (status) {
+    case "connected":
+      return "bg-green-3 text-green-11";
+    case "needs_auth":
+    case "needs_client_registration":
+      return "bg-amber-3 text-amber-11";
+    case "disabled":
+    case "disconnected":
+      return "bg-gray-3 text-gray-11";
+    default:
+      return "bg-red-3 text-red-11";
+  }
+}
+
+function formatPluginObjectType(type: string) {
+  const normalized = type.trim().toLowerCase();
+  if (!normalized) return "File";
+  if (normalized === "mcp") return "MCP";
+  return `${normalized.charAt(0).toUpperCase()}${normalized.slice(1)}`;
+}
+
+function pluginSlashCommandName(file: CloudImportedPluginFile) {
+  const path = file.path.trim();
+  if (file.objectType === "command") {
+    const command = path.match(/^\.opencode\/(?:command|commands)\/(.+)\.md$/i)?.[1];
+    return command?.trim() || null;
+  }
+  if (file.objectType === "skill") {
+    const skill = path.match(/^\.opencode\/(?:skill|skills)\/(?:[^/]+\/)?([^/]+)\/SKILL\.md$/i)?.[1];
+    return skill?.trim() || null;
+  }
+  return null;
+}
+
+export function ReactSessionComposer(props: ComposerProps) {
+  let fileInput: HTMLInputElement | undefined;
+  const [agents, setAgents] = useState<Agent[]>([]);
+  const [agentMenuOpen, setAgentMenuOpen] = useState(false);
+  const [variantMenuOpen, setVariantMenuOpen] = useState(false);
+  const [commands, setCommands] = useState<SlashCommandOption[]>([]);
+  const [commandsLoading, setCommandsLoading] = useState(false);
+  const [skillsLoading, setSkillsLoading] = useState(false);
+  const [skills, setSkills] = useState<SkillCard[]>(props.skills ?? []);
+  const [mcpLoading, setMcpLoading] = useState(false);
+  const [mcpServers, setMcpServers] = useState<McpServerEntry[]>(props.mcpServers ?? []);
+  const [mcpStatus, setMcpStatus] = useState<string | null>(props.mcpStatus ?? null);
+  const [mcpStatuses, setMcpStatuses] = useState<McpStatusMap>(props.mcpStatuses ?? {});
+  const [importedPlugins, setImportedPlugins] = useState<CloudImportedPlugin[]>(props.importedPlugins ?? []);
+  const [pluginsLoading, setPluginsLoading] = useState(false);
+  const [slashOpen, setSlashOpen] = useState(false);
+  const [toolMenuOpen, setToolMenuOpen] = useState(false);
+  const [toolMenuSection, setToolMenuSection] = useState<ToolMenuSection>("commands");
+  const [mentionItems, setMentionItems] = useState<MentionItem[]>([]);
+  const [mentionOpen, setMentionOpen] = useState(false);
+  const [menuIndex, setMenuIndex] = useState(0);
+  const menuItemRefs = useRef<Array<HTMLButtonElement | null>>([]);
+  const commandsCacheRef = useRef<SlashCommandOption[] | null>(null);
+  const commandsRequestRef = useRef<Promise<SlashCommandOption[]> | null>(null);
+  const commandsLoadVersionRef = useRef(0);
+  const listCommandsRef = useRef(props.listCommands);
+  const listSkillsRef = useRef(props.listSkills);
+  const listMcpRef = useRef(props.listMcp);
+  const listImportedPluginsRef = useRef(props.listImportedPlugins);
+  const toolMenuLoadRef = useRef({
+    openId: 0,
+    commands: false,
+    skills: false,
+    mcps: false,
+    plugins: false,
+  });
+  const [commandsLoaded, setCommandsLoaded] = useState(false);
+  const [skillsLoaded, setSkillsLoaded] = useState(Boolean(props.skills));
+  const [mcpLoaded, setMcpLoaded] = useState(Boolean(props.mcpServers));
+  const [pluginsLoaded, setPluginsLoaded] = useState(Boolean(props.importedPlugins));
+  const [agentMenuIndex, setAgentMenuIndex] = useState(0);
+  const agentItemRefs = useRef<Array<HTMLButtonElement | null>>([]);
+  const [dropzoneActive, setDropzoneActive] = useState(false);
+  const toolMenuRef = useRef<HTMLDivElement | null>(null);
+  const variantMenuRef = useRef<HTMLDivElement | null>(null);
+  const agentMenuRef = useRef<HTMLDivElement | null>(null);
+  // IME composition guard: while an IME composition is active, we must not
+  // treat Enter as a submit. Three signals keep this reliable across WebKit,
+  // Chrome, and Safari: event.isComposing, event.keyCode === 229, and the
+  // compositionstart/compositionend events below.
+  const imeComposingRef = useRef(false);
+  const rootRef = useRef<HTMLDivElement | null>(null);
+  const draftRef = useRef(props.draft);
+  useEffect(() => {
+    draftRef.current = props.draft;
+  }, [props.draft]);
+
+  const slashMatch = props.draft.match(/^\/(\S*)$/);
+  const slashOpenNext = Boolean(slashMatch);
+  const slashQuery = slashMatch?.[1] ?? "";
+  const mentionMatch = props.draft.match(/@([^\s@]*)$/);
+  const mentionOpenNext = Boolean(mentionMatch);
+  const mentionQuery = mentionMatch?.[1] ?? "";
+
+  useEffect(() => {
+    setSlashOpen(slashOpenNext);
+    setMenuIndex(0);
+  }, [slashOpenNext, slashQuery]);
+
+  useEffect(() => {
+    setMentionOpen(mentionOpenNext);
+    setMenuIndex(0);
+  }, [mentionOpenNext, mentionQuery]);
+
+  useEffect(() => {
+    if (!agentMenuOpen) return;
+    void props.listAgents().then(setAgents).catch(() => setAgents([]));
+  }, [agentMenuOpen, props.listAgents]);
+
+  useEffect(() => {
+    setSkills(props.skills ?? []);
+  }, [props.skills]);
+
+  useEffect(() => {
+    setMcpServers(props.mcpServers ?? []);
+    setMcpStatus(props.mcpStatus ?? null);
+    setMcpStatuses(props.mcpStatuses ?? {});
+  }, [props.mcpServers, props.mcpStatus, props.mcpStatuses]);
+
+  useEffect(() => {
+    setImportedPlugins(props.importedPlugins ?? []);
+  }, [props.importedPlugins]);
+
+  useEffect(() => {
+    listCommandsRef.current = props.listCommands;
+  }, [props.listCommands]);
+
+  useEffect(() => {
+    listSkillsRef.current = props.listSkills;
+  }, [props.listSkills]);
+
+  useEffect(() => {
+    listMcpRef.current = props.listMcp;
+  }, [props.listMcp]);
+
+  useEffect(() => {
+    listImportedPluginsRef.current = props.listImportedPlugins;
+  }, [props.listImportedPlugins]);
+
+  useEffect(() => {
+    setAgentMenuIndex(0);
+  }, [agentMenuOpen]);
+
+  useEffect(() => {
+    const target = agentItemRefs.current[agentMenuIndex];
+    target?.scrollIntoView({ block: "nearest" });
+  }, [agentMenuIndex, agentMenuOpen]);
+
+  useEffect(() => {
+    commandsLoadVersionRef.current += 1;
+    commandsCacheRef.current = null;
+    commandsRequestRef.current = null;
+  }, [props.listCommands]);
+
+  const loadCommands = useCallback(() => {
+    if (commandsCacheRef.current !== null) {
+      return Promise.resolve(commandsCacheRef.current);
+    }
+    if (commandsRequestRef.current) {
+      return commandsRequestRef.current;
+    }
+    const version = commandsLoadVersionRef.current;
+    const request = listCommandsRef.current().then((next) => {
+      if (commandsLoadVersionRef.current === version) {
+        commandsCacheRef.current = next;
+      }
+      return next;
+    }).finally(() => {
+      if (commandsLoadVersionRef.current === version) {
+        commandsRequestRef.current = null;
+      }
+    });
+    commandsRequestRef.current = request;
+    return request;
+  }, []);
+
+  useEffect(() => {
+    if (!toolMenuOpen) return;
+    toolMenuLoadRef.current = {
+      openId: toolMenuLoadRef.current.openId + 1,
+      commands: false,
+      skills: false,
+      mcps: false,
+      plugins: false,
+    };
+    setCommandsLoaded(false);
+    setSkillsLoaded(Boolean(props.skills));
+    setMcpLoaded(Boolean(props.mcpServers));
+    setPluginsLoaded(Boolean(props.importedPlugins));
+  }, [toolMenuOpen]);
+
+  useEffect(() => {
+    if (!slashOpen && !toolMenuOpen) return;
+    const openId = toolMenuLoadRef.current.openId;
+    if (toolMenuOpen && toolMenuLoadRef.current.commands) return;
+    if (toolMenuOpen) toolMenuLoadRef.current.commands = true;
+    let cancelled = false;
+    const cached = commandsCacheRef.current;
+    if (cached !== null) {
+      setCommands(cached);
+      setCommandsLoading(false);
+      if (toolMenuOpen && toolMenuLoadRef.current.openId === openId) setCommandsLoaded(true);
+      return () => {
+        cancelled = true;
+      };
+    }
+    setCommandsLoading(true);
+    void loadCommands()
+      .then((next) => {
+        if (!cancelled) {
+          setCommands(next);
+          if (toolMenuOpen && toolMenuLoadRef.current.openId === openId) setCommandsLoaded(true);
+        }
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setCommands([]);
+          if (toolMenuOpen && toolMenuLoadRef.current.openId === openId) setCommandsLoaded(true);
+        }
+      })
+      .finally(() => {
+        if (!cancelled) setCommandsLoading(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [slashOpen, toolMenuOpen, loadCommands]);
+
+  useEffect(() => {
+    if (!mentionOpen) return;
+    let cancelled = false;
+    void Promise.all([props.listAgents(), props.searchFiles(mentionQuery)]).then(([agentList, files]) => {
+      if (cancelled) return;
+      const recent = props.recentFiles.slice(0, 8);
+      const next: MentionItem[] = [
+        ...agentList.map((agent) => ({ id: `agent:${agent.name}`, kind: "agent" as const, value: agent.name, label: agent.name })),
+        ...recent.map((file) => ({ id: `file:${file}`, kind: "file" as const, value: file, label: file })),
+        ...files.filter((file) => !recent.includes(file)).map((file) => ({ id: `file:${file}`, kind: "file" as const, value: file, label: file })),
+      ];
+      setMentionItems(next);
+    }).catch(() => {
+      if (!cancelled) setMentionItems([]);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [mentionOpen, mentionQuery, props.listAgents, props.recentFiles, props.searchFiles]);
+
+  useEffect(() => {
+    if (!toolMenuOpen) return;
+    const handlePointerDown = (event: MouseEvent) => {
+      const target = event.target;
+      if (!(target instanceof Node)) return;
+      if (toolMenuRef.current?.contains(target)) return;
+      setToolMenuOpen(false);
+    };
+    window.addEventListener("mousedown", handlePointerDown);
+    return () => {
+      window.removeEventListener("mousedown", handlePointerDown);
+    };
+  }, [toolMenuOpen]);
+
+  useEffect(() => {
+    if (!variantMenuOpen) return;
+    const handlePointerDown = (event: MouseEvent) => {
+      const target = event.target;
+      if (!(target instanceof Node)) return;
+      if (variantMenuRef.current?.contains(target)) return;
+      setVariantMenuOpen(false);
+    };
+    window.addEventListener("mousedown", handlePointerDown);
+    return () => {
+      window.removeEventListener("mousedown", handlePointerDown);
+    };
+  }, [variantMenuOpen]);
+
+  useEffect(() => {
+    if (!agentMenuOpen) return;
+    const handlePointerDown = (event: MouseEvent) => {
+      const target = event.target;
+      if (!(target instanceof Node)) return;
+      if (agentMenuRef.current?.contains(target)) return;
+      setAgentMenuOpen(false);
+    };
+    window.addEventListener("mousedown", handlePointerDown);
+    return () => {
+      window.removeEventListener("mousedown", handlePointerDown);
+    };
+  }, [agentMenuOpen]);
+
+  useEffect(() => {
+    if (!toolMenuOpen) return;
+    const openId = toolMenuLoadRef.current.openId;
+    const listImportedPlugins = listImportedPluginsRef.current;
+    if (listImportedPlugins && !toolMenuLoadRef.current.plugins) {
+      let cancelled = false;
+      toolMenuLoadRef.current.plugins = true;
+      setPluginsLoading(true);
+      void listImportedPlugins()
+        .then((next) => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) {
+            setImportedPlugins(next);
+            setPluginsLoaded(true);
+          }
+        })
+        .catch(() => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) {
+            setImportedPlugins([]);
+            setPluginsLoaded(true);
+          }
+        })
+        .finally(() => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) setPluginsLoading(false);
+        });
+      return () => {
+        cancelled = true;
+      };
+    }
+    return undefined;
+  }, [toolMenuOpen]);
+
+  useEffect(() => {
+    if (!toolMenuOpen) return;
+    const openId = toolMenuLoadRef.current.openId;
+    const listSkills = listSkillsRef.current;
+    const listMcp = listMcpRef.current;
+    if (toolMenuSection === "skills" && listSkills && !toolMenuLoadRef.current.skills) {
+      let cancelled = false;
+      toolMenuLoadRef.current.skills = true;
+      setSkillsLoading(true);
+      void listSkills()
+        .then((next) => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) {
+            setSkills(next);
+            setSkillsLoaded(true);
+          }
+        })
+        .catch(() => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) {
+            setSkills([]);
+            setSkillsLoaded(true);
+          }
+        })
+        .finally(() => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) setSkillsLoading(false);
+        });
+      return () => {
+        cancelled = true;
+      };
+    }
+    if (toolMenuSection === "mcps" && listMcp && !toolMenuLoadRef.current.mcps) {
+      let cancelled = false;
+      toolMenuLoadRef.current.mcps = true;
+      setMcpLoading(true);
+      void listMcp()
+        .then((next) => {
+          if (cancelled || toolMenuLoadRef.current.openId !== openId) return;
+          setMcpServers(next.servers);
+          setMcpStatuses(next.statuses);
+          setMcpStatus(next.status);
+          setMcpLoaded(true);
+        })
+        .catch(() => {
+          if (cancelled || toolMenuLoadRef.current.openId !== openId) return;
+          setMcpServers([]);
+          setMcpStatuses({});
+          setMcpLoaded(true);
+        })
+        .finally(() => {
+          if (!cancelled && toolMenuLoadRef.current.openId === openId) setMcpLoading(false);
+        });
+      return () => {
+        cancelled = true;
+      };
+    }
+    return undefined;
+  }, [toolMenuOpen, toolMenuSection]);
+
+  const slashFiltered = useMemo(() => {
+    if (!slashOpen) return [];
+    if (!slashQuery) return commands.slice(0, 8);
+    return fuzzysort.go(slashQuery, commands, { keys: ["name", "description"], limit: 8 }).map((entry) => entry.obj);
+  }, [commands, slashOpen, slashQuery]);
+  const mentionFiltered = useMemo(() => {
+    if (!mentionOpen) return [];
+    if (!mentionQuery) return mentionItems.slice(0, 8);
+    return fuzzysort.go(mentionQuery, mentionItems, { keys: ["label"], limit: 8 }).map((entry) => entry.obj);
+  }, [mentionItems, mentionOpen, mentionQuery]);
+  const pastedTextTokens = useMemo(
+    () => props.pastedText.map((item) => ({ label: item.label, lines: item.lines })),
+    [props.pastedText],
+  );
+
+  const activeMenu = slashOpen ? "slash" : mentionOpen ? "mention" : null;
+  const activeItems = activeMenu === "slash" ? slashFiltered : activeMenu === "mention" ? mentionFiltered : [];
+  const toolCommandItems = commands.filter((command) => !command.source || command.source === "command");
+  const toolSkillItems = commands.filter((command) => command.source === "skill");
+  const toolMcpItems = commands.filter((command) => command.source === "mcp");
+  void toolMcpItems;
+  const pluginSections = importedPlugins
+    .filter((plugin) => plugin.files.length > 0)
+    .map((plugin) => ({ section: `plugin:${plugin.pluginId}` as const, plugin }));
+  const activePlugin = toolMenuSection.startsWith("plugin:")
+    ? pluginSections.find((entry) => entry.section === toolMenuSection)?.plugin ?? null
+    : null;
+  const canSend = props.draft.trim().length > 0 || props.attachments.length > 0;
+
+  useEffect(() => {
+    if (!toolMenuSection.startsWith("plugin:")) return;
+    if (activePlugin) return;
+    setToolMenuSection("commands");
+  }, [activePlugin, toolMenuSection]);
+
+  useEffect(() => {
+    if (!activeItems.length) {
+      setMenuIndex(0);
+      return;
+    }
+    setMenuIndex((current) => Math.max(0, Math.min(current, activeItems.length - 1)));
+  }, [activeItems.length]);
+
+  useEffect(() => {
+    menuItemRefs.current.length = activeItems.length;
+    const target = menuItemRefs.current[menuIndex];
+    target?.scrollIntoView({ block: "nearest" });
+  }, [menuIndex, activeItems.length]);
+
+  const applyCommandSelection = (command: SlashCommandOption) => {
+    props.onDraftChange(`/${command.name} `);
+    setSlashOpen(false);
+    setToolMenuOpen(false);
+  };
+
+  const applyPluginFileSelection = (file: CloudImportedPluginFile) => {
+    const commandName = pluginSlashCommandName(file);
+    if (commandName) {
+      applyCommandSelection({
+        id: `plugin:${file.configObjectId}`,
+        name: commandName,
+        source: file.objectType === "skill" ? "skill" : "command",
+      });
+      return;
+    }
+    props.onInsertMention("file", file.path);
+    setToolMenuOpen(false);
+  };
+
+  const openToolMenuSettings = () => {
+    const section: ToolMenuSettingsSection = toolMenuSection === "commands" || toolMenuSection === "skills" || toolMenuSection === "mcps"
+      ? toolMenuSection
+      : "plugins";
+    props.onOpenSettingsSection?.(section);
+  };
+
+  const acceptActiveItem = () => {
+    if (!activeItems.length) return false;
+    if (activeMenu === "slash") {
+      const command = slashFiltered[menuIndex];
+      if (!command) return false;
+      applyCommandSelection(command);
+      return true;
+    }
+    if (activeMenu === "mention") {
+      const item = mentionFiltered[menuIndex];
+      if (!item) return false;
+      props.onInsertMention(item.kind, item.value);
+      setMentionOpen(false);
+      return true;
+    }
+    return false;
+  };
+
+  // Listen for cross-app focus + draft flush events. The Solid shell uses
+  // these from deep-link handlers, the command palette, and the browser
+  // pagehide/beforeunload cycle so no in-flight draft is lost.
+  useEffect(() => {
+    const handleFocus = () => {
+      const root = rootRef.current;
+      if (!root) return;
+      const editable = root.querySelector<HTMLElement>("[contenteditable='true']");
+      editable?.focus();
+    };
+    const handleFlush = () => {
+      // onDraftChange always runs synchronously on every keystroke, so this
+      // listener is effectively a hook for the shell to signal "we're about
+      // to unmount, commit any debounced state". Re-fire with the current
+      // draft so downstream stores can checkpoint it.
+      props.onDraftChange(draftRef.current);
+    };
+    window.addEventListener(FOCUS_PROMPT_EVENT, handleFocus);
+    window.addEventListener(FLUSH_PROMPT_EVENT, handleFlush);
+    window.addEventListener("beforeunload", handleFlush);
+    window.addEventListener("pagehide", handleFlush);
+    return () => {
+      window.removeEventListener(FOCUS_PROMPT_EVENT, handleFocus);
+      window.removeEventListener(FLUSH_PROMPT_EVENT, handleFlush);
+      window.removeEventListener("beforeunload", handleFlush);
+      window.removeEventListener("pagehide", handleFlush);
+    };
+  }, [props.onDraftChange]);
+
+  const handleKeyDownCapture: React.KeyboardEventHandler<HTMLDivElement> = (event) => {
+    // IME composition guard — block Enter while IME is mid-character.
+    const imeActive =
+      imeComposingRef.current ||
+      (event.nativeEvent as KeyboardEvent).isComposing === true ||
+      event.keyCode === 229;
+    if (event.key === "Enter" && imeActive) {
+      return;
+    }
+    if (agentMenuOpen) {
+      const total = agents.length + 1;
+      if (event.key === "ArrowDown") {
+        event.preventDefault();
+        setAgentMenuIndex((current) => (current + 1) % total);
+        return;
+      }
+      if (event.key === "ArrowUp") {
+        event.preventDefault();
+        setAgentMenuIndex((current) => (current - 1 + total) % total);
+        return;
+      }
+      if (event.key === "Enter" || event.key === "Tab") {
+        event.preventDefault();
+        const selected = agentMenuIndex === 0 ? null : agents[agentMenuIndex - 1]?.name ?? null;
+        props.onSelectAgent(selected);
+        setAgentMenuOpen(false);
+        return;
+      }
+      if (event.key === "Escape") {
+        event.preventDefault();
+        setAgentMenuOpen(false);
+        setVariantMenuOpen(false);
+        return;
+      }
+    }
+
+    if (toolMenuOpen && event.key === "Escape") {
+      event.preventDefault();
+      setToolMenuOpen(false);
+      return;
+    }
+
+    if (!activeMenu || !activeItems.length) return;
+    if (event.key === "ArrowDown") {
+      event.preventDefault();
+      setMenuIndex((current) => (current + 1) % activeItems.length);
+      return;
+    }
+    if (event.key === "ArrowUp") {
+      event.preventDefault();
+      setMenuIndex((current) => (current - 1 + activeItems.length) % activeItems.length);
+      return;
+    }
+    if (event.key === "Enter" || event.key === "Tab") {
+      event.preventDefault();
+      event.stopPropagation();
+      void acceptActiveItem();
+      return;
+    }
+    if (event.key === "Escape") {
+      event.preventDefault();
+      setSlashOpen(false);
+      setMentionOpen(false);
+    }
+  };
+
+  const addAttachments = async (inputFiles: File[]) => {
+    if (!inputFiles.length) return;
+    if (!props.attachmentsEnabled) {
+      props.onNotice({
+        title: props.attachmentsDisabledReason ?? t("composer.attachments_unavailable"),
+        tone: "warning",
+      });
+      return;
+    }
+
+    const accepted: File[] = [];
+    const unsupported: string[] = [];
+    const oversize: string[] = [];
+
+    for (const original of inputFiles) {
+      if (!isSupportedAttachmentType(original.type)) {
+        unsupported.push(original.name || t("composer.file_kind"));
+        continue;
+      }
+      const processed = original.type.startsWith("image/") ? await compressImageFile(original) : original;
+      if (processed.size > MAX_ATTACHMENT_BYTES) {
+        oversize.push(processed.name || original.name);
+        continue;
+      }
+      accepted.push(processed);
+    }
+
+    if (accepted.length) {
+      props.onAttachFiles(accepted);
+      props.onNotice({
+        title:
+          accepted.length === 1
+            ? t("composer.uploaded_single_file", { name: accepted[0]?.name ?? t("composer.file_kind") })
+            : t("composer.uploaded_multiple_files", { count: accepted.length }),
+        tone: "success",
+      });
+    }
+
+    if (oversize.length) {
+      props.onNotice({
+        title:
+          oversize.length === 1
+            ? t("composer.file_exceeds_limit", { name: oversize[0] })
+            : `${oversize.length} files exceed the 8MB limit.`,
+        tone: "warning",
+      });
+    }
+
+    if (unsupported.length) {
+      props.onNotice({
+        title:
+          unsupported.length === 1
+            ? `${unsupported[0]} · ${t("composer.unsupported_attachment_type")}`
+            : `${unsupported.length} ${t("composer.unsupported_attachment_type").toLowerCase()}`,
+        tone: "warning",
+      });
+    }
+  };
+
+  const activeMcpItems = mcpServers.map((entry) => ({
+    entry,
+    status: toReactMcpStatus(entry.name, entry, mcpStatuses),
+  }));
+
+  const panelRoundedClass =
+    mentionOpen || slashOpen
+      ? "rounded-t-[18px] border-t-transparent"
+      : "shadow-[var(--dls-shell-shadow)]";
+
+  const renderSlashMenu = () => {
+    if (!slashOpen) return null;
+    return (
+      <div className="absolute bottom-full left-[-1px] right-[-1px] z-30">
+        <div className="overflow-hidden rounded-t-[20px] border border-dls-border border-b-0 bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+          <div
+            className="max-h-64 overflow-y-auto p-2"
+            onMouseDown={(event) => event.preventDefault()}
+          >
+            {slashFiltered.length > 0 ? (
+              <div className="grid gap-1">
+                {slashFiltered.map((command, index) => (
+                  <button
+                    key={command.id}
+                    ref={(element) => {
+                      menuItemRefs.current[index] = element;
+                    }}
+                    type="button"
+                    className={`flex w-full items-start gap-3 rounded-[16px] px-3 py-2.5 text-left transition-colors hover:bg-gray-2/70 ${activeMenu === "slash" && slashFiltered[menuIndex]?.id === command.id ? "bg-gray-3 text-gray-12" : "text-gray-11"}`}
+                    onMouseEnter={() => setMenuIndex(index)}
+                    onMouseDown={(event) => {
+                      event.preventDefault();
+                      event.stopPropagation();
+                      applyCommandSelection(command);
+                    }}
+                    onClick={(event) => {
+                      if (event.detail === 0) applyCommandSelection(command);
+                    }}
+                  >
+                    <Terminal size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                    <div className="min-w-0 flex-1">
+                      <div className="flex items-center justify-between gap-3">
+                        <div className="truncate text-xs font-semibold">/{command.name}</div>
+                        {command.source && command.source !== "command" ? (
+                          <span className={`shrink-0 rounded-full px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide ${command.source === "skill" ? "bg-violet-3/40 text-violet-11" : "bg-cyan-3/40 text-cyan-11"}`}>
+                            {command.source === "skill" ? t("composer.skill_source") : t("composer.mcps_label")}
+                          </span>
+                        ) : null}
+                      </div>
+                      {command.description ? <div className="truncate text-xs text-gray-10">{command.description}</div> : null}
+                    </div>
+                  </button>
+                ))}
+              </div>
+            ) : (
+              <div className="px-3 py-2 text-xs text-gray-10">
+                {!commandsLoaded && commandsLoading ? t("composer.loading_commands") : t("composer.no_commands")}
+              </div>
+            )}
+          </div>
+        </div>
+      </div>
+    );
+  };
+
+  const renderMentionMenu = () => {
+    if (!mentionOpen || mentionFiltered.length === 0) return null;
+    return (
+      <div className="absolute bottom-full left-[-1px] right-[-1px] z-30">
+        <div className="overflow-hidden rounded-t-[20px] border border-dls-border border-b-0 bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+          <div
+            className="max-h-64 overflow-y-auto p-2"
+            onMouseDown={(event) => event.preventDefault()}
+          >
+            <div className="grid gap-1">
+              {mentionFiltered.map((item, index) => (
+                <button
+                  key={item.id}
+                  ref={(element) => {
+                    menuItemRefs.current[index] = element;
+                  }}
+                  type="button"
+                  className={`flex w-full items-start gap-3 rounded-[16px] px-3 py-2.5 text-left transition-colors hover:bg-gray-2/70 ${activeMenu === "mention" && mentionFiltered[menuIndex]?.id === item.id ? "bg-gray-3 text-gray-12" : "text-gray-11"}`}
+                  onMouseEnter={() => setMenuIndex(index)}
+                  onClick={() => {
+                    props.onInsertMention(item.kind, item.value);
+                    setMentionOpen(false);
+                  }}
+                >
+                  {item.kind === "agent" ? (
+                    <Zap size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                  ) : (
+                    <FileText size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                  )}
+                  <div className="min-w-0">
+                    <div className="truncate text-xs font-semibold">@{item.label}</div>
+                    <div className="truncate text-xs text-gray-10">
+                      {item.kind === "agent"
+                        ? t("composer.agent_label")
+                        : t("composer.file_kind")}
+                    </div>
+                  </div>
+                </button>
+              ))}
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  };
+
+  return (
+    <div
+      ref={rootRef}
+      className={`sticky bottom-0 ${toolMenuOpen ? "z-50" : "z-20"} bg-gradient-to-t from-dls-surface via-dls-surface/95 to-transparent px-4 md:px-8 pb-5 ${props.compactTopSpacing ? "pt-0" : "pt-3"}`}
+      style={{ contain: "layout style" }}
+      onKeyDownCapture={handleKeyDownCapture}
+      onCompositionStart={() => {
+        imeComposingRef.current = true;
+      }}
+      onCompositionEnd={() => {
+        imeComposingRef.current = false;
+      }}
+    >
+      <div className="max-w-[800px] mx-auto">
+        {/* Main composer panel */}
+        <div
+          className={`relative overflow-visible rounded-[24px] border border-dls-border bg-dls-surface transition-all ${panelRoundedClass}`}
+        >
+          <ReactComposerNotice notice={props.notice} />
+
+          {renderMentionMenu()}
+          {renderSlashMenu()}
+
+          {props.attachments.length > 0 ? (
+            <div className="mx-5 mt-5 flex flex-wrap gap-2 md:mx-6">
+              {props.attachments.map((attachment) => (
+                <div key={attachment.id} className="flex items-center gap-2 rounded-2xl border border-gray-6 bg-gray-2 px-3 py-2 text-xs text-gray-10">
+                  {isImageAttachment(attachment) && attachment.previewUrl ? (
+                    <div className="h-10 w-10 overflow-hidden rounded-xl border border-gray-6 bg-gray-1">
+                      <img src={attachment.previewUrl} alt={attachment.name} decoding="async" className="h-full w-full object-cover" />
+                    </div>
+                  ) : (
+                    <FileText size={14} className="text-gray-9" />
+                  )}
+                  <div className="max-w-[160px] min-w-0">
+                    <div className="truncate text-[12px] font-medium text-gray-11">{attachment.name}</div>
+                    <div className="flex items-center gap-1.5 text-[11px] text-gray-10">
+                      <span>{isImageAttachment(attachment) ? t("composer.image_kind") : t("composer.file_kind")}</span>
+                      <span>·</span>
+                      <span>{formatBytes(attachment.size)}</span>
+                    </div>
+                  </div>
+                  <button
+                    type="button"
+                    className="ml-1 inline-flex h-5 w-5 items-center justify-center rounded-full text-gray-10 transition-colors hover:bg-gray-3 hover:text-gray-12"
+                    onClick={() => props.onRemoveAttachment(attachment.id)}
+                    title={t("action.remove")}
+                  >
+                    <X size={12} />
+                  </button>
+                </div>
+              ))}
+            </div>
+          ) : null}
+
+          {/*
+            The pasted-text chip used to render twice — once inline inside
+            the Lexical editor (via ComposerPastedTextNode) and again as a
+            separate rail here above the composer. Keep only the inline
+            chip; its pill already shows label + line count, and the user
+            removes it with backspace like any other inline token.
+          */}
+
+          {dropzoneActive ? (
+            <div className="pointer-events-none absolute inset-3 z-20 flex items-center justify-center rounded-[20px] border-2 border-dashed border-dls-accent bg-[color:color-mix(in_oklab,var(--dls-accent)_10%,transparent)]">
+              <div className="rounded-2xl border border-dls-border bg-dls-surface/95 px-5 py-4 text-center backdrop-blur-sm">
+                <div className="text-sm font-medium text-dls-text">{t("composer.attach_files")}</div>
+                <div className="mt-1 text-xs text-dls-secondary">Images and PDFs are supported.</div>
+              </div>
+            </div>
+          ) : null}
+
+          <div className="px-4 pt-3 pb-2">
+            {/* Editor */}
+            <LexicalPromptEditor
+              value={props.draft}
+              mentions={props.mentions}
+              pastedText={pastedTextTokens}
+              disabled={props.disabled}
+              placeholder={t("composer.placeholder")}
+              onChange={props.onDraftChange}
+              onSubmit={props.onSend}
+              onPasteText={props.onPasteText}
+              onPaste={(event) => {
+                // Paste policy:
+                // 1. Actual files on the clipboard -> attach them.
+                // 2. Explicit text/uri-list (drag from Finder / browser) -> insert links.
+                // 3. Plain text -> DO NOTHING. Let Lexical's PlainTextPlugin
+                //    handle the paste natively so newlines render correctly
+                //    and no content is silently dropped. Previous behavior
+                //    hijacked pastes that merely contained absolute paths
+                //    like "/Users/..." or pastes longer than 10 lines, which
+                //    was the root cause of "paste into composer is broken".
+                const files = Array.from(event.clipboardData?.files ?? []);
+                if (files.length) {
+                  event.preventDefault();
+                  void addAttachments(files);
+                  return;
+                }
+
+                const uriList = event.clipboardData
+                  ? parseClipboardUriList(event.clipboardData)
+                  : [];
+                if (uriList.length) {
+                  event.preventDefault();
+                  props.onUnsupportedFileLinks(uriList);
+                  props.onNotice({
+                    title: t("composer.inserted_links_unsupported"),
+                    tone: "info",
+                  });
+                  return;
+                }
+
+                const text = event.clipboardData?.getData("text/plain") ?? "";
+
+                // Collapse long pastes into an inline chip. The threshold
+                // is 3+ lines or 200+ characters — short pastes still go
+                // straight into the editor as plain text.
+                const PASTE_CHIP_LINE_THRESHOLD = 3;
+                const PASTE_CHIP_CHAR_THRESHOLD = 200;
+                const lineCount = text.split(/\r?\n/).length;
+                if (text.trim() && (lineCount >= PASTE_CHIP_LINE_THRESHOLD || text.length >= PASTE_CHIP_CHAR_THRESHOLD)) {
+                  event.preventDefault();
+                  props.onPasteText(text);
+                  return;
+                }
+
+                if (
+                  text.trim() &&
+                  (props.isRemoteWorkspace || props.isSandboxWorkspace) &&
+                  /file:\/\/|(^|\s)\/(Users|home|var|etc|opt|tmp|private|Volumes|Applications)\//.test(text)
+                ) {
+                  const attachedFiles = props.attachments.map((attachment) => attachment.file);
+                  props.onNotice({
+                    title: t("composer.remote_worker_paste_warning"),
+                    tone: "warning",
+                    actionLabel:
+                      props.onUploadInboxFiles && attachedFiles.length > 0
+                        ? t("composer.upload_to_shared_folder")
+                        : undefined,
+                    onAction:
+                      props.onUploadInboxFiles && attachedFiles.length > 0
+                        ? () => void props.onUploadInboxFiles?.(attachedFiles)
+                        : undefined,
+                  });
+                  // Intentionally no preventDefault — the notice is advisory,
+                  // the paste still goes through the editor.
+                }
+              }}
+              onDragOver={(event) => {
+                if (event.dataTransfer?.files?.length) {
+                  event.preventDefault();
+                  if (!dropzoneActive) setDropzoneActive(true);
+                }
+              }}
+              onDragLeave={(event) => {
+                const nextTarget = event.relatedTarget;
+                if (nextTarget instanceof Node && event.currentTarget.contains(nextTarget)) return;
+                setDropzoneActive(false);
+              }}
+              onDrop={(event) => {
+                const files = Array.from(event.dataTransfer?.files ?? []);
+                setDropzoneActive(false);
+                if (!files.length) return;
+                event.preventDefault();
+                void addAttachments(files);
+              }}
+            />
+
+            {/* Action row — attach/inbox/tools on the left, send on the right */}
+            <div className="mt-2 flex items-end justify-between gap-2">
+              <div className="flex items-center gap-1.5">
+                <input
+                  ref={(element) => {
+                    fileInput = element ?? undefined;
+                  }}
+                  type="file"
+                  multiple
+                  className="hidden"
+                  onChange={(event) => {
+                    const files = Array.from(event.currentTarget.files ?? []);
+                    if (files.length) void addAttachments(files);
+                    event.currentTarget.value = "";
+                  }}
+                />
+                <button
+                  type="button"
+                  className={`inline-flex h-9 max-h-9 w-9 items-center justify-center rounded-md text-gray-10 transition-colors hover:bg-gray-3 ${
+                    !props.attachmentsEnabled ? "cursor-not-allowed opacity-60" : ""
+                  }`}
+                  onClick={() => {
+                    if (!props.attachmentsEnabled) return;
+                    fileInput?.click();
+                  }}
+                  disabled={!props.attachmentsEnabled}
+                  title={props.attachmentsDisabledReason ?? t("composer.attach_files")}
+                >
+                  <Paperclip size={16} />
+                </button>
+                <div ref={toolMenuRef} className="relative">
+                  <button
+                    type="button"
+                    className={`inline-flex h-9 max-h-9 w-9 items-center justify-center rounded-md transition-colors ${toolMenuOpen ? "bg-gray-3 text-gray-12" : "text-gray-10 hover:bg-gray-3"}`}
+                    onClick={() => {
+                      setMentionOpen(false);
+                      setMentionItems([]);
+                      setSlashOpen(false);
+                      setToolMenuOpen((value) => !value);
+                    }}
+                    aria-expanded={toolMenuOpen}
+                    aria-haspopup="dialog"
+                    title={t("composer.tools_label")}
+                  >
+                    <Plug size={16} />
+                  </button>
+                  {toolMenuOpen ? (
+                    <div className="absolute bottom-full left-0 z-40 mb-3 w-[min(calc(100vw-2.5rem),34rem)] overflow-hidden rounded-[22px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+                      <div className="grid grid-cols-[152px_minmax(0,1fr)] sm:grid-cols-[176px_minmax(0,1fr)]">
+                        <div className="border-r border-dls-border bg-gray-2/30 p-2">
+                          {([
+                            ["commands", t("dashboard.commands")],
+                            ["skills", t("dashboard.skills")],
+                            ["mcps", t("composer.mcps_label")],
+                          ] as const).map(([section, label]) => (
+                            <button
+                              key={section}
+                              type="button"
+                              className={`mb-1 flex w-full items-center justify-between rounded-[16px] px-3 py-2.5 text-left text-sm transition-colors ${toolMenuSection === section ? "bg-gray-3 text-gray-12" : "text-gray-11 hover:bg-gray-2"}`}
+                              onClick={() => setToolMenuSection(section)}
+                            >
+                              <span className="truncate">{label}</span>
+                              <ChevronRight size={14} className="shrink-0 text-gray-9" />
+                            </button>
+                          ))}
+                          {pluginSections.length > 0 ? <div className="my-2 border-t border-dls-border" /> : null}
+                          {pluginSections.map(({ section, plugin }) => (
+                            <button
+                              key={plugin.pluginId}
+                              type="button"
+                              className={`mb-1 flex w-full items-center justify-between rounded-[16px] px-3 py-2.5 text-left text-sm transition-colors ${toolMenuSection === section ? "bg-gray-3 text-gray-12" : "text-gray-11 hover:bg-gray-2"}`}
+                              onClick={() => setToolMenuSection(section)}
+                            >
+                              <span className="truncate">{plugin.name}</span>
+                              <ChevronRight size={14} className="shrink-0 text-gray-9" />
+                            </button>
+                          ))}
+                        </div>
+                        <div className="max-h-72 overflow-y-auto p-2">
+                          <div className="mb-2 flex justify-end border-b border-dls-border px-1 pb-2">
+                            <button
+                              type="button"
+                              className="inline-flex items-center gap-1.5 rounded-full border border-dls-border px-3 py-1.5 text-[12px] font-medium text-gray-11 transition-colors hover:bg-gray-2"
+                              onClick={() => {
+                                setToolMenuOpen(false);
+                                openToolMenuSettings();
+                              }}
+                            >
+                              <Settings size={12} />
+                              {t("composer.configure")}
+                            </button>
+                          </div>
+                          {toolMenuSection === "commands" ? (
+                            toolCommandItems.length > 0 ? (
+                              <div className="grid gap-1">
+                                {toolCommandItems.map((command) => (
+                                  <button
+                                    key={command.id}
+                                    type="button"
+                                    className="flex w-full items-start gap-3 rounded-[16px] px-3 py-2.5 text-left text-gray-11 transition-colors hover:bg-gray-2/70"
+                                    onClick={() => applyCommandSelection(command)}
+                                  >
+                                    <Terminal size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                                    <div className="min-w-0">
+                                      <div className="truncate text-xs font-semibold text-gray-11">/{command.name}</div>
+                                      {command.description ? <div className="truncate text-xs text-gray-10">{command.description}</div> : null}
+                                    </div>
+                                  </button>
+                                ))}
+                              </div>
+                            ) : (
+                              <div className="px-3 py-2 text-xs text-gray-10">
+                                {!commandsLoaded && commandsLoading ? t("composer.loading_commands") : t("composer.no_commands")}
+                              </div>
+                            )
+                          ) : null}
+                          {toolMenuSection === "skills" ? (
+                            (skills.length > 0 || toolSkillItems.length > 0) ? (
+                              <div className="grid gap-1">
+                                {[...toolSkillItems, ...skills.filter((skill) => !toolSkillItems.some((command) => command.name === skill.name)).map((skill) => ({ id: `skill:${skill.name}`, name: skill.name, description: skill.description, source: "skill" as const }))].map((command) => (
+                                  <button
+                                    key={command.id}
+                                    type="button"
+                                    className="flex w-full items-start gap-3 rounded-[16px] px-3 py-2.5 text-left text-gray-11 transition-colors hover:bg-gray-2/70"
+                                    onClick={() => applyCommandSelection(command)}
+                                  >
+                                    <Zap size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                                    <div className="min-w-0">
+                                      <div className="truncate text-xs font-semibold text-gray-11">/{command.name}</div>
+                                      {command.description ? <div className="truncate text-xs text-gray-10">{command.description}</div> : null}
+                                    </div>
+                                  </button>
+                                ))}
+                              </div>
+                            ) : (
+                              <div className="px-3 py-2 text-xs text-gray-10">
+                                {(!skillsLoaded && skillsLoading) || (!commandsLoaded && commandsLoading) ? t("composer.loading_commands") : t("context_panel.no_skills")}
+                              </div>
+                            )
+                          ) : null}
+                          {toolMenuSection === "mcps" ? (
+                            activeMcpItems.length > 0 ? (
+                              <div className="grid gap-1">
+                                {activeMcpItems.map(({ entry, status }) => (
+                                  <div key={entry.name} className="flex items-start gap-3 rounded-[16px] px-3 py-2.5 text-gray-11">
+                                    <Plug size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                                    <div className="min-w-0 flex-1">
+                                      <div className="flex items-center justify-between gap-3">
+                                        <div className="truncate text-xs font-semibold text-gray-11">{entry.name}</div>
+                                        <span className={`shrink-0 rounded-full px-2 py-0.5 text-[10px] font-medium ${mcpStatusBadgeClass(status)}`}>
+                                          {formatMcpStatusLabel(status)}
+                                        </span>
+                                      </div>
+                                      <div className="truncate text-xs text-gray-10">{entry.config.type === "remote" ? entry.config.url ?? entry.config.command?.join(" ") ?? "Remote MCP" : entry.config.command?.join(" ") ?? "Local MCP"}</div>
+                                    </div>
+                                  </div>
+                                ))}
+                              </div>
+                            ) : (
+                              <div className="px-3 py-2 text-xs text-gray-10">
+                                {!mcpLoaded && mcpLoading ? t("composer.loading_commands") : (mcpStatus ?? t("context_panel.no_mcp"))}
+                              </div>
+                            )
+                          ) : null}
+                          {activePlugin ? (
+                            activePlugin.files.length > 0 ? (
+                              <div className="grid gap-1">
+                                {activePlugin.files.map((file) => (
+                                  <button
+                                    key={`${file.configObjectId}:${file.path}`}
+                                    type="button"
+                                    className="flex w-full items-start gap-3 rounded-[16px] px-3 py-2.5 text-left text-gray-11 transition-colors hover:bg-gray-2/70"
+                                    onClick={() => applyPluginFileSelection(file)}
+                                  >
+                                    <FileText size={14} className="mt-0.5 shrink-0 text-gray-9" />
+                                    <div className="min-w-0 flex-1">
+                                      <div className="flex items-center justify-between gap-3">
+                                        <div className="truncate text-xs font-semibold text-gray-11">{file.title}</div>
+                                        <span className="shrink-0 rounded-full bg-gray-3 px-2 py-0.5 text-[10px] font-medium text-gray-11">
+                                          {formatPluginObjectType(file.objectType)}
+                                        </span>
+                                      </div>
+                                    </div>
+                                  </button>
+                                ))}
+                              </div>
+                            ) : (
+                              <div className="px-3 py-2 text-xs text-gray-10">No plugin files imported yet.</div>
+                            )
+                          ) : toolMenuSection.startsWith("plugin:") ? (
+                            <div className="px-3 py-2 text-xs text-gray-10">
+                              {!pluginsLoaded && pluginsLoading ? t("composer.loading_commands") : "Plugin files are unavailable."}
+                            </div>
+                          ) : null}
+                        </div>
+                      </div>
+                    </div>
+                  ) : null}
+                </div>
+              </div>
+
+              {/*
+                Single action button that toggles between Stop and Run task.
+                When busy with no draft: Stop (cancels current run).
+                When busy with a draft: Run task (queues a follow-up).
+                When idle: Run task.
+              */}
+              <div className="ml-auto flex shrink-0 items-end gap-1.5">
+                {props.busy && !canSend ? (
+                  <button
+                    type="button"
+                    onClick={props.onStop}
+                    className="inline-flex h-9 max-h-9 items-center gap-2 rounded-full bg-gray-12 px-4 text-[13px] font-medium text-gray-1 transition-colors hover:bg-gray-11"
+                    title={t("composer.stop")}
+                  >
+                    <Square size={12} fill="currentColor" />
+                    <span>{t("composer.stop")}</span>
+                  </button>
+                ) : (
+                  <button
+                    type="button"
+                    onClick={canSend ? props.onSend : props.busy ? props.onStop : undefined}
+                    disabled={props.disabled || (!canSend && !props.busy)}
+                    className={`inline-flex h-9 max-h-9 items-center gap-2 rounded-full px-4 text-[13px] font-medium transition-colors ${
+                      !canSend || props.disabled
+                        ? "bg-gray-4 text-gray-10"
+                        : "bg-[var(--dls-accent)] text-white hover:bg-[var(--dls-accent-hover)]"
+                    }`}
+                    title={t("composer.run_task")}
+                  >
+                    <ArrowUp size={15} />
+                    <span>{t("composer.run_task")}</span>
+                  </button>
+                )}
+              </div>
+            </div>
+          </div>
+        </div>
+
+        {/* Below-panel control strip: agent + model + behavior variant */}
+        <div className="mt-1 flex items-center justify-between px-1">
+          <div className="flex flex-wrap items-center gap-1.5 text-gray-10 sm:gap-2.5">
+            <div ref={agentMenuRef} className="relative">
+              <button
+                type="button"
+                className="flex items-center gap-1 rounded-md px-1.5 py-1 text-[12px] font-medium text-gray-10 transition-colors hover:bg-gray-3 hover:text-gray-12"
+                onClick={() => setAgentMenuOpen((value) => !value)}
+                disabled={props.busy}
+                aria-expanded={agentMenuOpen}
+                title={t("composer.agent_label")}
+              >
+                <span className="max-w-[140px] truncate">{props.agentLabel}</span>
+                <ChevronDown size={13} />
+              </button>
+              {agentMenuOpen ? (
+                <div className="absolute left-0 bottom-full z-40 mb-2 w-64 overflow-hidden rounded-[18px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+                  <div className="border-b border-dls-border px-3 pb-1 pt-2 text-[10px] font-semibold uppercase tracking-[0.2em] text-gray-10">
+                    {t("composer.agent_label")}
+                  </div>
+                  <div
+                    className="space-y-1 p-2 max-h-64 overflow-y-auto"
+                    onMouseDown={(event) => event.preventDefault()}
+                  >
+                    <button
+                      ref={(element) => {
+                        agentItemRefs.current[0] = element;
+                      }}
+                      type="button"
+                      className={`flex w-full items-center justify-between rounded-lg px-3 py-2 text-left text-xs transition-colors ${!props.selectedAgent ? "bg-gray-2 text-gray-12" : "text-gray-11 hover:bg-gray-2/70"}`}
+                      onMouseEnter={() => setAgentMenuIndex(0)}
+                      onMouseDown={(event) => {
+                        event.preventDefault();
+                        props.onSelectAgent(null);
+                        setAgentMenuOpen(false);
+                      }}
+                    >
+                      <span>{t("composer.default_agent")}</span>
+                      {!props.selectedAgent ? <Check size={14} className="text-gray-10" /> : null}
+                    </button>
+                    {agents.map((agent, index) => {
+                      const active = props.selectedAgent === agent.name;
+                      return (
+                        <button
+                          key={agent.name}
+                          ref={(element) => {
+                            agentItemRefs.current[index + 1] = element;
+                          }}
+                          type="button"
+                          className={`flex w-full items-center justify-between rounded-lg px-3 py-2 text-left text-xs transition-colors ${active ? "bg-gray-2 text-gray-12" : "text-gray-11 hover:bg-gray-2/70"}`}
+                          onMouseEnter={() => setAgentMenuIndex(index + 1)}
+                          onMouseDown={(event) => {
+                            event.preventDefault();
+                            props.onSelectAgent(agent.name);
+                            setAgentMenuOpen(false);
+                          }}
+                        >
+                          <span className="truncate">{agent.name.charAt(0).toUpperCase() + agent.name.slice(1)}</span>
+                          {active ? <Check size={14} className="text-gray-10" /> : null}
+                        </button>
+                      );
+                    })}
+                  </div>
+                </div>
+              ) : null}
+            </div>
+
+            <button
+              type="button"
+              className="flex min-w-0 items-center gap-1 rounded-md px-1.5 py-1 text-[12px] font-medium text-gray-10 transition-colors hover:bg-gray-3 hover:text-gray-12"
+              onClick={props.onModelClick}
+              disabled={props.busy}
+            >
+              <span className="truncate leading-tight">{props.modelLabel}</span>
+              <ChevronDown size={13} className="shrink-0 ml-0.5" />
+            </button>
+
+            {props.modelBehaviorOptions?.length ? (
+              <div ref={variantMenuRef} className="relative">
+                <button
+                  type="button"
+                  className="flex items-center gap-1 rounded-md px-1.5 py-1 text-[12px] font-medium text-gray-10 transition-colors hover:bg-gray-3 hover:text-gray-12"
+                  onClick={(event) => {
+                    event.preventDefault();
+                    event.stopPropagation();
+                    setVariantMenuOpen((value) => !value);
+                  }}
+                  disabled={props.busy}
+                  aria-expanded={variantMenuOpen}
+                >
+                  <span className="truncate leading-tight">
+                    {/* Pill label is the summary resolved by session-route:
+                        if modelVariant is null it already carries the
+                        provider-default preset's label (e.g. "Balanced"). */}
+                    {props.modelVariantLabel ||
+                      (props.modelBehaviorOptions.find((option) => option.value === props.modelVariant)?.label ?? "") ||
+                      t("settings.default_label")}
+                  </span>
+                  <ChevronDown size={13} className="shrink-0 ml-0.5" />
+                </button>
+                {variantMenuOpen ? (
+                  <div className="absolute left-0 bottom-full z-40 mb-2 w-48 overflow-hidden rounded-[18px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+                    <div className="border-b border-dls-border px-3 pb-1 pt-2 text-[10px] font-semibold uppercase tracking-[0.2em] text-gray-10">
+                      {t("composer.behavior_label")}
+                    </div>
+                    <div className="space-y-1 p-2">
+                      {props.modelBehaviorOptions.map((option) => {
+                        // Highlight the row whose label matches the pill. When
+                        // modelVariant is null but the provider-default is
+                        // e.g. "medium", the "medium" row should render as
+                        // selected — user sees the actual active mode.
+                        const isActive =
+                          props.modelVariant === option.value ||
+                          (props.modelVariant == null && option.label === props.modelVariantLabel);
+                        return (
+                          <button
+                            key={option.value ?? "default"}
+                            type="button"
+                            className={`flex w-full items-center justify-between rounded-lg px-3 py-2 text-left text-xs transition-colors ${
+                              isActive ? "bg-gray-2 text-gray-12" : "text-gray-11 hover:bg-gray-2/70"
+                            }`}
+                            onClick={(event) => {
+                              event.preventDefault();
+                              event.stopPropagation();
+                              props.onModelVariantChange(option.value);
+                              setVariantMenuOpen(false);
+                            }}
+                          >
+                            <span>{option.label}</span>
+                            {isActive ? <Check size={14} className="text-gray-10" /> : null}
+                          </button>
+                        );
+                      })}
+                    </div>
+                  </div>
+                ) : null}
+              </div>
+            ) : null}
+          </div>
+
+          {/* Status label removed — redundant with the footer bar */}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/composer/editor.tsx b/apps/app/src/react-app/domains/session/surface/composer/editor.tsx
new file mode 100644
index 0000000000..2ed8060918
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/composer/editor.tsx
@@ -0,0 +1,692 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef } from "react";
+import { LexicalComposer } from "@lexical/react/LexicalComposer.js";
+import { PlainTextPlugin } from "@lexical/react/LexicalPlainTextPlugin.js";
+import { ContentEditable } from "@lexical/react/LexicalContentEditable.js";
+import { LexicalErrorBoundary } from "@lexical/react/LexicalErrorBoundary.js";
+import { OnChangePlugin } from "@lexical/react/LexicalOnChangePlugin.js";
+import { HistoryPlugin } from "@lexical/react/LexicalHistoryPlugin.js";
+import { useLexicalComposerContext } from "@lexical/react/LexicalComposerContext.js";
+import {
+  $applyNodeReplacement,
+  $createRangeSelection,
+  $createParagraphNode,
+  $createTextNode,
+  $getRoot,
+  $getSelection,
+  $setSelection,
+  $isElementNode,
+  $isRangeSelection,
+  $isTextNode,
+  COMMAND_PRIORITY_CRITICAL,
+  COMMAND_PRIORITY_HIGH,
+  KEY_ARROW_LEFT_COMMAND,
+  KEY_ARROW_RIGHT_COMMAND,
+  KEY_BACKSPACE_COMMAND,
+  KEY_ENTER_COMMAND,
+  PASTE_COMMAND,
+  type SerializedTextNode,
+  type Spread,
+  TextNode,
+  type EditorConfig,
+  type NodeKey,
+} from "lexical";
+import type { InitialConfigType } from "@lexical/react/LexicalComposer.js";
+
+type EditorProps = {
+  value: string;
+  mentions: Record<string, "agent" | "file">;
+  pastedText?: Array<{ label: string; lines: number }>;
+  disabled: boolean;
+  placeholder: string;
+  onChange: (value: string) => void;
+  onSubmit: () => void | Promise<void>;
+  onPaste?: React.ClipboardEventHandler<HTMLDivElement>;
+  onPasteText?: (text: string) => void;
+  onDrop?: React.DragEventHandler<HTMLDivElement>;
+  onDragOver?: React.DragEventHandler<HTMLDivElement>;
+  onDragLeave?: React.DragEventHandler<HTMLDivElement>;
+};
+
+type SerializedComposerMentionNode = Spread<
+  {
+    mentionValue: string;
+    mentionKind: "agent" | "file";
+    type: "composer-mention";
+    version: 1;
+  },
+  SerializedTextNode
+>;
+
+type SerializedComposerSlashCommandNode = Spread<
+  {
+    commandName: string;
+    type: "composer-slash-command";
+    version: 1;
+  },
+  SerializedTextNode
+>;
+
+class ComposerMentionNode extends TextNode {
+  __value: string;
+  __kind: "agent" | "file";
+
+  static override getType() {
+    return "composer-mention";
+  }
+
+  static override clone(node: ComposerMentionNode) {
+    return new ComposerMentionNode(node.__value, node.__kind, node.__key);
+  }
+
+  static override importJSON(serializedNode: SerializedComposerMentionNode) {
+    return $createComposerMentionNode(serializedNode.mentionValue, serializedNode.mentionKind);
+  }
+
+  constructor(value = "", kind: "agent" | "file" = "file", key?: NodeKey) {
+    super(`@${value}`, key);
+    this.__value = value;
+    this.__kind = kind;
+  }
+
+  override exportJSON(): SerializedComposerMentionNode {
+    return {
+      ...super.exportJSON(),
+      mentionValue: this.__value,
+      mentionKind: this.__kind,
+      type: "composer-mention",
+      version: 1,
+    };
+  }
+
+  override createDOM(_config: EditorConfig) {
+    const dom = document.createElement("span");
+    const isFile = this.__kind === "file";
+    dom.className = isFile
+      ? "inline-flex items-center rounded-full border border-gray-6 bg-gray-3 px-2.5 py-1 text-xs font-medium text-gray-11"
+      : "inline-flex items-center rounded-full border border-sky-6/35 bg-sky-3/20 px-2.5 py-1 text-xs font-medium text-sky-11";
+    dom.textContent = `@${isFile ? this.__value.split(/[\\/]/).pop() || this.__value : this.__value}`;
+    dom.contentEditable = "false";
+    dom.setAttribute("spellcheck", "false");
+    dom.title = `@${this.__value}`;
+    return dom;
+  }
+
+  override updateDOM(prevNode: ComposerMentionNode, dom: HTMLElement) {
+    if (prevNode.__value !== this.__value || prevNode.__kind !== this.__kind) {
+      const isFile = this.__kind === "file";
+      dom.className = isFile
+        ? "inline-flex items-center rounded-full border border-gray-6 bg-gray-3 px-2.5 py-1 text-xs font-medium text-gray-11"
+        : "inline-flex items-center rounded-full border border-sky-6/35 bg-sky-3/20 px-2.5 py-1 text-xs font-medium text-sky-11";
+      dom.textContent = `@${isFile ? this.__value.split(/[\\/]/).pop() || this.__value : this.__value}`;
+      dom.title = `@${this.__value}`;
+    }
+    return false;
+  }
+
+  override canInsertTextBefore(): false {
+    return false;
+  }
+
+  override canInsertTextAfter(): false {
+    return false;
+  }
+
+  override isTextEntity(): true {
+    return true;
+  }
+
+  override isToken(): true {
+    return true;
+  }
+}
+
+function $createComposerMentionNode(value: string, kind: "agent" | "file") {
+  return $applyNodeReplacement(new ComposerMentionNode(value, kind));
+}
+
+class ComposerSlashCommandNode extends TextNode {
+  __commandName: string;
+
+  static override getType() {
+    return "composer-slash-command";
+  }
+
+  static override clone(node: ComposerSlashCommandNode) {
+    return new ComposerSlashCommandNode(node.__commandName, node.__key);
+  }
+
+  static override importJSON(serializedNode: SerializedComposerSlashCommandNode) {
+    return $createComposerSlashCommandNode(serializedNode.commandName);
+  }
+
+  constructor(commandName = "", key?: NodeKey) {
+    super(`/${commandName}`, key);
+    this.__commandName = commandName;
+  }
+
+  override exportJSON(): SerializedComposerSlashCommandNode {
+    return {
+      ...super.exportJSON(),
+      commandName: this.__commandName,
+      type: "composer-slash-command",
+      version: 1,
+    };
+  }
+
+  override createDOM(_config: EditorConfig) {
+    const dom = document.createElement("span");
+    dom.className = "inline-flex items-center rounded-full border border-violet-6/35 bg-violet-3/20 px-2.5 py-1 text-xs font-medium text-violet-11";
+    dom.textContent = `/${this.__commandName}`;
+    dom.contentEditable = "false";
+    dom.setAttribute("spellcheck", "false");
+    dom.title = `/${this.__commandName}`;
+    return dom;
+  }
+
+  override updateDOM(prevNode: ComposerSlashCommandNode, dom: HTMLElement) {
+    if (prevNode.__commandName !== this.__commandName) {
+      dom.textContent = `/${this.__commandName}`;
+      dom.title = `/${this.__commandName}`;
+    }
+    return false;
+  }
+
+  override canInsertTextBefore(): false {
+    return false;
+  }
+
+  override canInsertTextAfter(): false {
+    return false;
+  }
+
+  override isTextEntity(): true {
+    return true;
+  }
+
+  override isToken(): true {
+    return true;
+  }
+}
+
+function $createComposerSlashCommandNode(commandName: string) {
+  return $applyNodeReplacement(new ComposerSlashCommandNode(commandName));
+}
+
+type SerializedComposerPastedTextNode = Spread<
+  {
+    pastedLabel: string;
+    pastedLines: number;
+    type: "composer-pasted-text";
+    version: 1;
+  },
+  SerializedTextNode
+>;
+
+class ComposerPastedTextNode extends TextNode {
+  __pastedLabel: string;
+  __pastedLines: number;
+
+  static override getType() {
+    return "composer-pasted-text";
+  }
+
+  static override clone(node: ComposerPastedTextNode) {
+    return new ComposerPastedTextNode(node.__pastedLabel, node.__pastedLines, node.__key);
+  }
+
+  static override importJSON(serializedNode: SerializedComposerPastedTextNode) {
+    return $createComposerPastedTextNode(serializedNode.pastedLabel, serializedNode.pastedLines);
+  }
+
+  constructor(label = "", lines = 0, key?: NodeKey) {
+    super(`[pasted text ${label}]`, key);
+    this.__pastedLabel = label;
+    this.__pastedLines = lines;
+  }
+
+  override exportJSON(): SerializedComposerPastedTextNode {
+    return {
+      ...super.exportJSON(),
+      pastedLabel: this.__pastedLabel,
+      pastedLines: this.__pastedLines,
+      type: "composer-pasted-text",
+      version: 1,
+    };
+  }
+
+  override createDOM(_config: EditorConfig) {
+    const dom = document.createElement("span");
+    dom.className = "inline-flex items-center gap-1 rounded-full border border-amber-6/35 bg-amber-3/15 px-2.5 py-1 text-xs font-medium text-amber-11";
+    dom.textContent = `Pasted · ${this.__pastedLines} line${this.__pastedLines === 1 ? "" : "s"}`;
+    dom.contentEditable = "false";
+    dom.setAttribute("spellcheck", "false");
+    dom.title = `Pasted text · ${this.__pastedLabel}`;
+    return dom;
+  }
+
+  override updateDOM(prevNode: ComposerPastedTextNode, dom: HTMLElement) {
+    if (prevNode.__pastedLabel !== this.__pastedLabel || prevNode.__pastedLines !== this.__pastedLines) {
+      dom.textContent = `Pasted · ${this.__pastedLines} line${this.__pastedLines === 1 ? "" : "s"}`;
+      dom.title = `Pasted text · ${this.__pastedLabel}`;
+    }
+    return false;
+  }
+
+  override canInsertTextBefore(): false {
+    return false;
+  }
+
+  override canInsertTextAfter(): false {
+    return false;
+  }
+
+  override isTextEntity(): true {
+    return true;
+  }
+
+  override isToken(): true {
+    return true;
+  }
+}
+
+function $createComposerPastedTextNode(label: string, lines: number) {
+  return $applyNodeReplacement(new ComposerPastedTextNode(label, lines));
+}
+
+type ComposerInlineTokenNode = ComposerMentionNode | ComposerSlashCommandNode | ComposerPastedTextNode;
+
+function setSelectionAfterNode(node: ComposerInlineTokenNode) {
+  const parent = node.getParent();
+  if (!parent || !$isElementNode(parent)) return;
+  const selection = $createRangeSelection();
+  const offset = node.getIndexWithinParent() + 1;
+  selection.anchor.set(parent.getKey(), offset, "element");
+  selection.focus.set(parent.getKey(), offset, "element");
+  $setSelection(selection);
+}
+
+function setSelectionBeforeNode(node: ComposerInlineTokenNode) {
+  const parent = node.getParent();
+  if (!parent || !$isElementNode(parent)) return;
+  const selection = $createRangeSelection();
+  const offset = node.getIndexWithinParent();
+  selection.anchor.set(parent.getKey(), offset, "element");
+  selection.focus.set(parent.getKey(), offset, "element");
+  $setSelection(selection);
+}
+
+function appendSegmentWithNewlines(
+  paragraph: ReturnType<typeof $createParagraphNode>,
+  segment: string,
+) {
+  // Preserve newlines in plain text segments. A single paragraph cannot
+  // render "\n" as a line break in contenteditable, so we split on "\n"
+  // and start a new paragraph per line. Return the paragraph the caller
+  // should keep appending to (i.e. the last one we produced).
+  if (!segment.includes("\n")) {
+    paragraph.append($createTextNode(segment));
+    return paragraph;
+  }
+  const lines = segment.split("\n");
+  let current = paragraph;
+  lines.forEach((line, index) => {
+    if (index > 0) {
+      const next = $createParagraphNode();
+      current.insertAfter(next);
+      current = next;
+    }
+    if (line.length > 0) {
+      current.append($createTextNode(line));
+    }
+  });
+  return current;
+}
+
+function setPrompt(value: string, mentions: Record<string, "agent" | "file">, pastedText?: Array<{ label: string; lines: number }>) {
+  const root = $getRoot();
+  root.clear();
+  let paragraph = $createParagraphNode();
+  root.append(paragraph);
+
+  const slashMatch = value.match(/^\/(\S+)\s(.*)$/s);
+  if (slashMatch?.[1]) {
+    paragraph.append($createComposerSlashCommandNode(slashMatch[1]));
+    paragraph.append($createTextNode(" "));
+    value = slashMatch[2] ?? "";
+  }
+
+  const segments = value.split(/(\[pasted text [^\]]+\]|@[^\s@]+)/);
+  for (const segment of segments) {
+    if (!segment) continue;
+    const pasteMatch = segment.match(/^\[pasted text (.+)\]$/);
+    if (pasteMatch?.[1]) {
+      const target = pastedText?.find((item) => item.label === pasteMatch[1]);
+      if (target) {
+        paragraph.append($createComposerPastedTextNode(target.label, target.lines));
+        continue;
+      }
+    }
+    if (segment.startsWith("@")) {
+      const token = segment.slice(1);
+      const kind = mentions[token];
+      if (kind) {
+        paragraph.append($createComposerMentionNode(token, kind));
+        continue;
+      }
+    }
+    paragraph = appendSegmentWithNewlines(paragraph, segment);
+  }
+}
+
+// Serialize the current editor state to the external draft string. Lexical's
+// root.getTextContent() joins element children with "\n\n" (its "text content
+// mode" for the root node), which causes single newlines typed/pasted by the
+// user to round-trip as double newlines and quickly corrupts the draft. We
+// walk root children ourselves and join with a single "\n" so every newline
+// the user sees onscreen is preserved exactly in the stored draft.
+function serializePromptFromRoot(): string {
+  const root = $getRoot();
+  return root
+    .getChildren()
+    .map((child) => child.getTextContent())
+    .join("\n");
+}
+
+function SyncPlugin(props: { value: string; mentions: Record<string, "agent" | "file">; pastedText?: Array<{ label: string; lines: number }>; disabled: boolean }) {
+  const [editor] = useLexicalComposerContext();
+  const valueRef = useRef(props.value);
+
+  useEffect(() => {
+    editor.setEditable(!props.disabled);
+  }, [editor, props.disabled]);
+
+  useEffect(() => {
+    // When the external value is cleared (e.g. after sending a message),
+    // always force-rebuild the editor to remove any stale chip nodes.
+    // The valueRef check can false-positive when both refs converge to ""
+    // through different paths (SyncPlugin vs OnChange).
+    //
+    // NOTE: serializePromptFromRoot() calls $getRoot() which requires an
+    // active editor state. Outside of editor.update()/editor.read() we
+    // must wrap it in editor.getEditorState().read().
+    const currentText = editor.getEditorState().read(() => serializePromptFromRoot());
+    const forceRebuild = !props.value.trim() && currentText.trim() !== "";
+    if (!forceRebuild && valueRef.current === props.value) return;
+    valueRef.current = props.value;
+    editor.update(() => {
+      if (!forceRebuild && serializePromptFromRoot() === props.value) return;
+      setPrompt(props.value, props.mentions, props.pastedText);
+      $getRoot().selectEnd();
+    });
+  }, [editor, props.mentions, props.pastedText, props.value]);
+
+  return null;
+}
+
+function SubmitPlugin(props: { onSubmit: () => void | Promise<void>; disabled: boolean }) {
+  const [editor] = useLexicalComposerContext();
+  const onSubmitRef = useRef(props.onSubmit);
+
+  useEffect(() => {
+    onSubmitRef.current = props.onSubmit;
+  }, [props.onSubmit]);
+
+  useEffect(() => {
+    return editor.registerCommand(
+      KEY_ENTER_COMMAND,
+      (event: KeyboardEvent | null) => {
+        if (props.disabled) return false;
+        // IME composition guard: three signals keep this reliable across
+        // Chrome, Safari, and WebKit. While IME is mid-character, Enter
+        // must always fall through to the editor so the composition can
+        // commit.
+        if (event?.isComposing === true || event?.keyCode === 229) return false;
+        // Shift+Enter inserts a newline — let the editor handle it.
+        if (event?.shiftKey) return false;
+        const selection = $getSelection();
+        if (!$isRangeSelection(selection)) return false;
+        // Plain Enter submits. Cmd/Ctrl+Enter also submits for muscle
+        // memory compatibility.
+        event?.preventDefault();
+        void onSubmitRef.current();
+        return true;
+      },
+      COMMAND_PRIORITY_HIGH,
+    );
+  }, [editor, props.disabled]);
+
+  return null;
+}
+
+const PASTE_CHIP_LINE_THRESHOLD = 3;
+const PASTE_CHIP_CHAR_THRESHOLD = 200;
+
+function PasteChipPlugin(props: { onPasteText?: (text: string) => void }) {
+  const [editor] = useLexicalComposerContext();
+  const onPasteTextRef = useRef(props.onPasteText);
+
+  useEffect(() => {
+    onPasteTextRef.current = props.onPasteText;
+  }, [props.onPasteText]);
+
+  useEffect(() => {
+    return editor.registerCommand(
+      PASTE_COMMAND,
+      (event: ClipboardEvent) => {
+        if (!onPasteTextRef.current) return false;
+        // Only handle plain-text pastes; files are handled in the React onPaste.
+        const files = event.clipboardData?.files;
+        if (files && files.length > 0) return false;
+        const text = event.clipboardData?.getData("text/plain") ?? "";
+        if (!text.trim()) return false;
+        const lineCount = text.split(/\r?\n/).length;
+        if (lineCount < PASTE_CHIP_LINE_THRESHOLD && text.length < PASTE_CHIP_CHAR_THRESHOLD) {
+          return false;
+        }
+        // Collapse into a paste chip.
+        event.preventDefault();
+        onPasteTextRef.current(text);
+        return true;
+      },
+      COMMAND_PRIORITY_CRITICAL,
+    );
+  }, [editor]);
+
+  return null;
+}
+
+function MentionChipNavigationPlugin() {
+  const [editor] = useLexicalComposerContext();
+
+  useEffect(() => {
+    const unregisterBackspace = editor.registerCommand(
+      KEY_BACKSPACE_COMMAND,
+      () => {
+        const selection = $getSelection();
+        if (!$isRangeSelection(selection) || !selection.isCollapsed()) return false;
+        const anchorNode = selection.anchor.getNode();
+
+        // --- Slash command chip: atomic delete ---
+        // When cursor is in the text node right after a slash chip,
+        // remove the chip (and any trailing whitespace text) in one action.
+        if ($isTextNode(anchorNode)) {
+          const previous = anchorNode.getPreviousSibling();
+          if (previous instanceof ComposerSlashCommandNode) {
+            // At offset 0: cursor is right after the chip -> remove chip
+            // At offset > 0 but text is only whitespace: also remove chip
+            const textBefore = anchorNode.getTextContent().slice(0, selection.anchor.offset);
+            if (selection.anchor.offset === 0 || textBefore.trim() === "") {
+              previous.remove();
+              // Also remove the whitespace-only prefix
+              if (selection.anchor.offset > 0) {
+                const remaining = anchorNode.getTextContent().slice(selection.anchor.offset);
+                if (remaining) {
+                  anchorNode.setTextContent(remaining);
+                  const sel = $createRangeSelection();
+                  sel.anchor.set(anchorNode.getKey(), 0, "text");
+                  sel.focus.set(anchorNode.getKey(), 0, "text");
+                  $setSelection(sel);
+                } else {
+                  anchorNode.remove();
+                }
+              }
+              return true;
+            }
+          }
+        }
+
+        // --- Mention / pasted-text chips: atomic delete (same as before) ---
+        if ($isTextNode(anchorNode) && selection.anchor.offset === 0) {
+          const previous = anchorNode.getPreviousSibling();
+          if (previous instanceof ComposerMentionNode || previous instanceof ComposerPastedTextNode) {
+            previous.remove();
+            return true;
+          }
+        }
+
+        if ($isElementNode(anchorNode)) {
+          const previous = anchorNode.getChildAtIndex(selection.anchor.offset - 1);
+          if (previous instanceof ComposerSlashCommandNode || previous instanceof ComposerMentionNode || previous instanceof ComposerPastedTextNode) {
+            previous.remove();
+            return true;
+          }
+        }
+
+        return false;
+      },
+      COMMAND_PRIORITY_HIGH,
+    );
+
+    const unregisterLeft = editor.registerCommand(
+      KEY_ARROW_LEFT_COMMAND,
+      () => {
+        const selection = $getSelection();
+        if (!$isRangeSelection(selection) || !selection.isCollapsed()) return false;
+        const anchorNode = selection.anchor.getNode();
+
+        if ($isTextNode(anchorNode) && selection.anchor.offset === 0) {
+          const previous = anchorNode.getPreviousSibling();
+          if (previous instanceof ComposerMentionNode || previous instanceof ComposerSlashCommandNode || previous instanceof ComposerPastedTextNode) {
+            setSelectionBeforeNode(previous);
+            return true;
+          }
+        }
+
+        return false;
+      },
+      COMMAND_PRIORITY_HIGH,
+    );
+
+    const unregisterRight = editor.registerCommand(
+      KEY_ARROW_RIGHT_COMMAND,
+      () => {
+        const selection = $getSelection();
+        if (!$isRangeSelection(selection) || !selection.isCollapsed()) return false;
+        const anchorNode = selection.anchor.getNode();
+
+        if (anchorNode instanceof ComposerMentionNode || anchorNode instanceof ComposerSlashCommandNode || anchorNode instanceof ComposerPastedTextNode) {
+          setSelectionAfterNode(anchorNode);
+          return true;
+        }
+
+        if ($isElementNode(anchorNode)) {
+          const current = anchorNode.getChildAtIndex(selection.anchor.offset);
+          if (current instanceof ComposerMentionNode || current instanceof ComposerSlashCommandNode || current instanceof ComposerPastedTextNode) {
+            setSelectionAfterNode(current);
+            return true;
+          }
+        }
+
+        return false;
+      },
+      COMMAND_PRIORITY_HIGH,
+    );
+
+    return () => {
+      unregisterBackspace();
+      unregisterLeft();
+      unregisterRight();
+    };
+  }, [editor]);
+
+  return null;
+}
+
+export function LexicalPromptEditor(props: EditorProps) {
+  const valueRef = useRef(props.value);
+  const onChangeRef = useRef(props.onChange);
+
+  useEffect(() => {
+    valueRef.current = props.value;
+  }, [props.value]);
+
+  useEffect(() => {
+    onChangeRef.current = props.onChange;
+  }, [props.onChange]);
+
+  const initialConfig = useMemo(
+    () => ({
+      namespace: "openwork-react-session-composer",
+      onError(error: Error) {
+        throw error;
+      },
+        editable: !props.disabled,
+        nodes: [ComposerMentionNode, ComposerSlashCommandNode, ComposerPastedTextNode],
+        editorState: () => {
+          setPrompt(props.value, props.mentions, props.pastedText);
+        },
+      }),
+    [],
+  );
+
+  const handleChange = useCallback(
+    (state: Parameters<NonNullable<React.ComponentProps<typeof OnChangePlugin>["onChange"]>>[0]) => {
+      state.read(() => {
+        const next = serializePromptFromRoot();
+        if (next === valueRef.current) return;
+        valueRef.current = next;
+        onChangeRef.current(next);
+      });
+    },
+    [],
+  );
+
+  return (
+    <LexicalComposer initialConfig={initialConfig}>
+      {/*
+        Tight start, bounded growth:
+        - min-h holds the editor to a single-line look until the user starts typing.
+        - max-h caps the composer — long pastes / multi-paragraph drafts scroll
+          inside the editor instead of pushing the transcript out of view.
+      */}
+      <div className="relative">
+        <PlainTextPlugin
+          contentEditable={
+            <ContentEditable
+              className="min-h-[60px] max-h-[280px] w-full resize-none overflow-y-auto bg-transparent text-[15px] leading-6 text-dls-text outline-none placeholder:text-dls-secondary [&_p]:min-h-[1.5rem] [&_p]:m-0"
+              aria-placeholder={props.placeholder}
+              placeholder={<span />}
+              onPaste={props.onPaste}
+              onDrop={props.onDrop}
+              onDragOver={props.onDragOver}
+              onDragLeave={props.onDragLeave}
+            />
+          }
+          placeholder={
+            <div className="pointer-events-none absolute left-0 top-0 text-[15px] leading-6 text-dls-secondary/70">
+              {props.placeholder}
+            </div>
+          }
+          ErrorBoundary={LexicalErrorBoundary}
+        />
+        <OnChangePlugin onChange={handleChange} />
+        <HistoryPlugin />
+        <SyncPlugin value={props.value} mentions={props.mentions} pastedText={props.pastedText} disabled={props.disabled} />
+        <SubmitPlugin onSubmit={props.onSubmit} disabled={props.disabled} />
+        <PasteChipPlugin onPasteText={props.onPasteText} />
+        <MentionChipNavigationPlugin />
+      </div>
+    </LexicalComposer>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/composer/notice.tsx b/apps/app/src/react-app/domains/session/surface/composer/notice.tsx
new file mode 100644
index 0000000000..77f93452a8
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/composer/notice.tsx
@@ -0,0 +1,48 @@
+/** @jsxImportSource react */
+
+export type ReactComposerNotice = {
+  title: string;
+  description?: string | null;
+  tone?: "info" | "success" | "warning" | "error";
+  actionLabel?: string;
+  onAction?: () => void;
+};
+
+export function ReactComposerNotice(props: { notice: ReactComposerNotice | null }) {
+  const tone = props.notice?.tone ?? "info";
+  if (!props.notice) return null;
+
+  const toneClass =
+    tone === "success"
+      ? "border-emerald-6/40 bg-emerald-4/80 text-emerald-11"
+      : tone === "warning"
+        ? "border-amber-6/40 bg-amber-4/80 text-amber-11"
+        : tone === "error"
+          ? "border-red-6/40 bg-red-4/80 text-red-11"
+          : "border-sky-6/40 bg-sky-4/80 text-sky-11";
+
+  return (
+    <div className="absolute bottom-full right-0 z-30 mb-3 w-[min(26rem,calc(100vw-2rem))] max-w-full overflow-hidden rounded-[1.2rem] border border-dls-border bg-dls-surface px-4 py-3 shadow-[var(--dls-shell-shadow)] backdrop-blur-xl">
+      <div className="flex items-start gap-3">
+        <div className={`mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-2xl border text-[12px] font-semibold ${toneClass}`}>
+          {tone === "success" ? "✓" : tone === "warning" ? "!" : tone === "error" ? "×" : "i"}
+        </div>
+        <div className="min-w-0 flex-1">
+          <div className="text-[13px] font-medium leading-relaxed text-dls-text">{props.notice.title}</div>
+          {props.notice.description?.trim() ? (
+            <p className="mt-1 text-[12px] leading-relaxed text-dls-secondary">{props.notice.description}</p>
+          ) : null}
+          {props.notice.actionLabel && props.notice.onAction ? (
+            <button
+              type="button"
+              className="mt-3 inline-flex items-center justify-center rounded-full border border-dls-border bg-dls-surface px-3 py-1.5 text-[12px] font-medium text-dls-text transition-colors hover:bg-dls-hover"
+              onClick={() => props.notice?.onAction?.()}
+            >
+              {props.notice.actionLabel}
+            </button>
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/debug-panel.tsx b/apps/app/src/react-app/domains/session/surface/debug-panel.tsx
new file mode 100644
index 0000000000..ba39cbb31f
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/debug-panel.tsx
@@ -0,0 +1,23 @@
+/** @jsxImportSource react */
+import type { OpenworkSessionSnapshot } from "../../../../app/lib/openwork-server";
+import type { SessionRenderModel } from "../sync/transition-controller";
+
+export function SessionDebugPanel(props: {
+  model: SessionRenderModel;
+  snapshot: OpenworkSessionSnapshot | null;
+}) {
+  return (
+    <div className="fixed bottom-20 right-4 z-30 w-[280px] rounded-2xl border border-dls-border bg-dls-surface/95 p-3 text-xs text-dls-secondary shadow-[var(--dls-card-shadow)] backdrop-blur-md">
+      <div className="mb-2 text-[11px] uppercase tracking-[0.18em] text-dls-text">React Session Debug</div>
+      <div className="space-y-1.5">
+        <div>intendedSessionId: <span className="text-dls-text">{props.model.intendedSessionId || "-"}</span></div>
+        <div>renderedSessionId: <span className="text-dls-text">{props.model.renderedSessionId || "-"}</span></div>
+        <div>transitionState: <span className="text-dls-text">{props.model.transitionState}</span></div>
+        <div>renderSource: <span className="text-dls-text">{props.model.renderSource}</span></div>
+        <div>status: <span className="text-dls-text">{props.snapshot?.status.type ?? "-"}</span></div>
+        <div>messages: <span className="text-dls-text">{props.snapshot?.messages.length ?? 0}</span></div>
+        <div>todos: <span className="text-dls-text">{props.snapshot?.todos.length ?? 0}</span></div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/markdown.tsx b/apps/app/src/react-app/domains/session/surface/markdown.tsx
new file mode 100644
index 0000000000..0119d0a1bd
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/markdown.tsx
@@ -0,0 +1,141 @@
+/** @jsxImportSource react */
+import { memo, useEffect, useRef, useState } from "react";
+import ReactMarkdown from "react-markdown";
+import type { Components } from "react-markdown";
+import remarkGfm from "remark-gfm";
+import { Streamdown } from "streamdown";
+
+import { applyTextHighlights } from "./text-highlights";
+
+function MarkdownCodeBlock(props: { className?: string; children: React.ReactNode }) {
+  const text = Array.isArray(props.children) ? props.children.join("") : String(props.children ?? "");
+  const [copied, setCopied] = useState(false);
+
+  return (
+    <div className="my-4 overflow-hidden rounded-[18px] border border-dls-border/70 bg-gray-1/80">
+      <div className="flex items-center justify-end border-b border-dls-border/70 px-3 py-2">
+        <button
+          type="button"
+          className="rounded-full border border-dls-border bg-dls-surface px-3 py-1 text-[11px] font-medium text-dls-text transition-colors hover:bg-dls-hover"
+          onClick={async () => {
+            await navigator.clipboard.writeText(text);
+            setCopied(true);
+            window.setTimeout(() => setCopied(false), 1200);
+          }}
+        >
+          {copied ? "Copied" : "Copy"}
+        </button>
+      </div>
+      <pre className="overflow-x-auto px-4 py-3 text-[12px] leading-6 text-gray-12">
+        <code className={props.className}>{props.children}</code>
+      </pre>
+    </div>
+  );
+}
+
+const markdownComponents: Components = {
+  a({ href, children }) {
+    return (
+      <a
+        href={href}
+        target="_blank"
+        rel="noreferrer noopener"
+        className="underline underline-offset-2 text-dls-accent hover:text-[var(--dls-accent-hover)]"
+      >
+        {children}
+      </a>
+    );
+  },
+  pre({ children }) {
+    return (
+      <pre className="my-4 overflow-x-auto rounded-[18px] border border-dls-border/70 bg-gray-1/80 px-4 py-3 text-[12px] leading-6 text-gray-12">
+        {children}
+      </pre>
+    );
+  },
+  code({ className, children }) {
+    const isBlock = Boolean(className?.includes("language-"));
+    if (isBlock) {
+      return <MarkdownCodeBlock className={className}>{children}</MarkdownCodeBlock>;
+    }
+    return (
+      <code className="rounded-md bg-gray-2/70 px-1.5 py-0.5 font-mono text-[0.92em] text-gray-12">
+        {children}
+      </code>
+    );
+  },
+  blockquote({ children }) {
+    return <blockquote className="my-4 border-l-4 border-dls-border pl-4 italic text-gray-11">{children}</blockquote>;
+  },
+  table({ children }) {
+    return <table className="my-4 w-full border-collapse">{children}</table>;
+  },
+  th({ children }) {
+    return <th className="border border-dls-border bg-dls-hover p-2 text-left">{children}</th>;
+  },
+  td({ children }) {
+    return <td className="border border-dls-border p-2 align-top">{children}</td>;
+  },
+  hr() {
+    return <hr className="my-6 border-none h-px bg-gray-4" />;
+  },
+};
+
+const markdownClassName = `markdown-content max-w-none text-gray-12
+  [&_strong]:font-semibold
+  [&_em]:italic
+  [&_h1]:my-5 [&_h1]:text-xl [&_h1]:font-semibold
+  [&_h2]:my-4 [&_h2]:text-lg [&_h2]:font-semibold
+  [&_h3]:my-3 [&_h3]:text-base [&_h3]:font-semibold
+  [&_p]:my-3 [&_p]:leading-relaxed
+  [&_ul]:my-3 [&_ul]:list-disc [&_ul]:pl-6
+  [&_ol]:my-3 [&_ol]:list-decimal [&_ol]:pl-6
+  [&_li]:my-1
+`.trim();
+
+function MarkdownBlockInner(props: {
+  text: string;
+  streaming?: boolean;
+  highlightQuery?: string;
+}) {
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const root = rootRef.current;
+    if (!root) return;
+
+    queueMicrotask(() => {
+      if (!rootRef.current || rootRef.current !== root) return;
+      applyTextHighlights(root, props.highlightQuery ?? "");
+    });
+  }, [props.highlightQuery, props.streaming, props.text]);
+
+  if (!props.text.trim()) return null;
+
+  if (props.streaming) {
+    return (
+      <div ref={rootRef} className={markdownClassName}>
+        <Streamdown remarkPlugins={[remarkGfm]} components={markdownComponents} skipHtml>
+          {props.text}
+        </Streamdown>
+      </div>
+    );
+  }
+
+  return (
+    <div ref={rootRef} className={markdownClassName}>
+      <ReactMarkdown remarkPlugins={[remarkGfm]} components={markdownComponents} skipHtml>
+        {props.text}
+      </ReactMarkdown>
+    </div>
+  );
+}
+
+/**
+ * Memoize so a message block that has already been rendered — the usual
+ * case for every assistant bubble above the currently-streaming one —
+ * doesn't re-parse its markdown on every token. Only re-renders when its
+ * own text / streaming / highlightQuery props change.
+ */
+export const MarkdownBlock = memo(MarkdownBlockInner);
+MarkdownBlock.displayName = "MarkdownBlock";
diff --git a/apps/app/src/react-app/domains/session/surface/message-list.tsx b/apps/app/src/react-app/domains/session/surface/message-list.tsx
new file mode 100644
index 0000000000..49c518c4cd
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/message-list.tsx
@@ -0,0 +1,1167 @@
+/** @jsxImportSource react */
+import { memo, useEffect, useMemo, useRef, useState, type CSSProperties, type ReactNode } from "react";
+import { isToolUIPart, type DynamicToolUIPart, type UIMessage } from "ai";
+import type { Part } from "@opencode-ai/sdk/v2/client";
+import { useVirtualizer } from "@tanstack/react-virtual";
+import { Check, ChevronDown, CircleAlert, Copy, File as FileIcon } from "lucide-react";
+
+import { openDesktopPath, revealDesktopItemInDir } from "../../../../app/lib/desktop";
+import {
+  SYNTHETIC_SESSION_ERROR_MESSAGE_PREFIX,
+  type MessageGroup,
+  type StepGroupMode,
+} from "../../../../app/types";
+import { groupMessageParts, isDesktopRuntime, summarizeStep } from "../../../../app/utils";
+import { MarkdownBlock } from "./markdown";
+import { applyTextHighlights } from "./text-highlights";
+
+type TranscriptPart = Part;
+
+type TranscriptMessage = {
+  id: string;
+  role: UIMessage["role"];
+  source: UIMessage;
+  parts: TranscriptPart[];
+};
+
+type StepTimelineGroup = {
+  id: string;
+  parts: TranscriptPart[];
+  mode: StepGroupMode;
+};
+
+type StepClusterBlock = {
+  kind: "steps-cluster";
+  id: string;
+  stepGroups: StepTimelineGroup[];
+  messageIds: string[];
+  isUser: boolean;
+};
+
+type MessageBlock = {
+  kind: "message";
+  message: UIMessage;
+  renderableParts: TranscriptPart[];
+  attachments: Array<{
+    url: string;
+    filename: string;
+    mime: string;
+  }>;
+  groups: MessageGroup[];
+  isUser: boolean;
+  messageId: string;
+};
+
+type MessageBlockItem = MessageBlock | StepClusterBlock;
+
+/**
+ * Stable-key used to match a block across renders. For message blocks the
+ * messageId is stable. For step clusters we reuse the cluster id (which is
+ * derived from its first step group) as the identity anchor.
+ */
+function blockIdentityKey(block: MessageBlockItem): string {
+  if (block.kind === "steps-cluster") return `cluster:${block.id}`;
+  return `msg:${block.messageId}`;
+}
+
+/**
+ * Returns true when a newly-computed block is content-equivalent to the
+ * previous block we rendered under the same identity key. We compare the
+ * underlying UIMessage reference (`message.source`) for message blocks and
+ * the messageIds array + stepGroups identity for step clusters. If equal,
+ * the caller reuses the previous block reference so React.memo'd children
+ * downstream can skip work.
+ *
+ * This is the structural-sharing trick from T3Tools' MessagesTimeline: on
+ * every streaming token, `props.messages` is a fresh array, but only the
+ * *currently-streaming* message has a new `source` reference — everything
+ * else is still pointer-equal to last tick. Rebuilding blocks from the new
+ * array gives fresh block objects for every message, so downstream memo
+ * checks all fail by default. Reusing the previous block reference when
+ * its content hasn't actually changed gives every non-streaming row a free
+ * bailout during a streaming burst.
+ */
+function blocksAreEquivalent(
+  previous: MessageBlockItem | undefined,
+  next: MessageBlockItem,
+): boolean {
+  if (!previous) return false;
+  if (previous.kind !== next.kind) return false;
+  if (previous.isUser !== next.isUser) return false;
+
+  if (previous.kind === "steps-cluster" && next.kind === "steps-cluster") {
+    if (previous.id !== next.id) return false;
+    if (previous.messageIds.length !== next.messageIds.length) return false;
+    for (let i = 0; i < previous.messageIds.length; i += 1) {
+      if (previous.messageIds[i] !== next.messageIds[i]) return false;
+    }
+    if (previous.stepGroups.length !== next.stepGroups.length) return false;
+    for (let i = 0; i < previous.stepGroups.length; i += 1) {
+      const prevGroup = previous.stepGroups[i];
+      const nextGroup = next.stepGroups[i];
+      if (!prevGroup || !nextGroup) return false;
+      if (prevGroup.id !== nextGroup.id) return false;
+      if (prevGroup.mode !== nextGroup.mode) return false;
+      if (prevGroup.parts.length !== nextGroup.parts.length) return false;
+      for (let p = 0; p < prevGroup.parts.length; p += 1) {
+        if (prevGroup.parts[p] !== nextGroup.parts[p]) return false;
+      }
+    }
+    return true;
+  }
+
+  if (previous.kind === "message" && next.kind === "message") {
+    if (previous.messageId !== next.messageId) return false;
+    // The single most important check. The session sync layer keeps
+    // UIMessage references stable for every non-streaming message across
+    // rerenders; only the actively-streaming message gets a fresh
+    // `source` reference per token. If the source is pointer-equal, the
+    // block hasn't changed and we can reuse the previous object.
+    if (previous.message !== next.message) return false;
+    if (previous.attachments.length !== next.attachments.length) return false;
+    if (previous.renderableParts.length !== next.renderableParts.length) return false;
+    if (previous.groups.length !== next.groups.length) return false;
+    return true;
+  }
+
+  return false;
+}
+
+type SessionTranscriptProps = {
+  messages: UIMessage[];
+  isStreaming: boolean;
+  developerMode: boolean;
+  showThinking?: boolean;
+  expandedStepIds?: Set<string>;
+  onExpandedStepIdsChange?: (updater: (current: Set<string>) => Set<string>) => void;
+  searchMatchMessageIds?: ReadonlySet<string>;
+  activeSearchMessageId?: string | null;
+  searchHighlightQuery?: string;
+  scrollElement?: () => HTMLElement | null | undefined;
+  setScrollToMessageById?: (
+    handler: ((messageId: string, behavior?: ScrollBehavior) => boolean) | null,
+  ) => void;
+  footer?: ReactNode;
+  variant?: "default" | "nested";
+};
+
+// 500 was too high for real-world OpenWork sessions: a handful of giant
+// messages (emails, legal docs, pasted transcripts) can still produce a
+// massive DOM even when the block count is low. Lowering the threshold means
+// we switch to react-virtual much earlier and keep the main thread lighter
+// during workspace/session switches.
+// Virtualize aggressively. A session with 20+ message blocks already pays
+// more to render eagerly than to run the virtualizer, so there's no reason
+// to defer. The only reason the threshold exists at all is to avoid the
+// virtualizer's baseline overhead for tiny sessions.
+const VIRTUALIZATION_THRESHOLD = 20;
+const VIRTUAL_OVERSCAN = 4;
+
+function partIdFromUiPart(part: UIMessage["parts"][number], fallbackId: string) {
+  const metadata = (part as { providerMetadata?: { opencode?: { partId?: unknown } } })
+    .providerMetadata?.opencode;
+  if (typeof metadata?.partId === "string" && metadata.partId.trim()) {
+    return metadata.partId;
+  }
+  return fallbackId;
+}
+
+function toDynamicToolPart(part: UIMessage["parts"][number]) {
+  if (part.type === "dynamic-tool") {
+    return part;
+  }
+  if (!isToolUIPart(part)) return null;
+  return {
+    ...part,
+    toolName: part.type.replace(/^tool-/, ""),
+    type: "dynamic-tool",
+  } as DynamicToolUIPart;
+}
+
+function toLegacyPart(
+  part: UIMessage["parts"][number],
+  fallbackId: string,
+): TranscriptPart | null {
+  const id = partIdFromUiPart(part, fallbackId);
+
+  if (part.type === "text") {
+    return { id, type: "text", text: part.text } as TranscriptPart;
+  }
+
+  if (part.type === "reasoning") {
+    return { id, type: "reasoning", text: part.text } as TranscriptPart;
+  }
+
+  if (part.type === "file") {
+    return {
+      id,
+      type: "file",
+      url: part.url,
+      filename: part.filename,
+      mime: part.mediaType,
+    } as TranscriptPart;
+  }
+
+  if (part.type === "step-start") {
+    return { id, type: "step-start" } as TranscriptPart;
+  }
+
+  const toolPart = toDynamicToolPart(part);
+  if (toolPart) {
+    const state: Record<string, unknown> = {
+      input: toolPart.input,
+    };
+
+    if (toolPart.state === "output-available") {
+      state.output = toolPart.output;
+    }
+
+    if (toolPart.state === "output-error") {
+      state.error = toolPart.errorText;
+    }
+
+    return {
+      id: toolPart.toolCallId || id,
+      type: "tool",
+      tool: toolPart.toolName,
+      state,
+    } as TranscriptPart;
+  }
+
+  return null;
+}
+
+function isAttachmentPart(part: TranscriptPart) {
+  if (part.type !== "file") return false;
+  const url = (part as { url?: string }).url;
+  return typeof url === "string" && !url.startsWith("file://");
+}
+
+function attachmentsForParts(parts: TranscriptPart[]) {
+  return parts
+    .filter(isAttachmentPart)
+    .map((part) => {
+      const record = part as {
+        url?: string;
+        filename?: string;
+        mime?: string;
+      };
+      return {
+        url: record.url ?? "",
+        filename: record.filename ?? "attachment",
+        mime: record.mime ?? "application/octet-stream",
+      };
+    })
+    .filter((attachment) => Boolean(attachment.url));
+}
+
+function partToText(part: TranscriptPart) {
+  if (part.type === "text") {
+    return String((part as { text?: string }).text ?? "");
+  }
+  if (part.type === "reasoning") {
+    return String((part as { text?: string }).text ?? "");
+  }
+  if (part.type === "agent") {
+    const name = (part as { name?: string }).name ?? "";
+    return name ? `@${name}` : "@agent";
+  }
+  if (part.type === "file") {
+    const record = part as {
+      label?: string;
+      path?: string;
+      filename?: string;
+      url?: string;
+    };
+    const label = record.label ?? record.path ?? record.filename ?? record.url ?? "";
+    return label ? `@${label}` : "@file";
+  }
+  if (part.type === "tool") {
+    return summarizeStep(part).title;
+  }
+  return "";
+}
+
+function messageToText(message: UIMessage) {
+  return message.parts
+    .flatMap((part) => {
+      if (part.type === "text") return [part.text];
+      if (part.type === "reasoning") return [part.text];
+      if (part.type === "file") return [part.filename ?? part.url];
+      const toolPart = toDynamicToolPart(part);
+      if (toolPart) {
+        if (toolPart.state === "output-error") {
+          return [`[tool:${toolPart.toolName}] ${toolPart.errorText}`];
+        }
+        if (toolPart.state === "output-available") {
+          return [`[tool:${toolPart.toolName}] ${JSON.stringify(toolPart.output)}`];
+        }
+        return [`[tool:${toolPart.toolName}] ${JSON.stringify(toolPart.input)}`];
+      }
+      return [];
+    })
+    .join("\n\n")
+    .trim();
+}
+
+function isImageAttachment(mime: string) {
+  return mime.startsWith("image/");
+}
+
+function humanMediaType(raw: string) {
+  if (!raw || raw === "application/octet-stream") return null;
+  const short = raw.replace(/^application\//, "").replace(/^text\//, "");
+  return short.toUpperCase();
+}
+
+function cleanReasoningPreview(value: string) {
+  return value
+    .replace(/\[REDACTED\]/g, "")
+    .replace(/\*\*([^*]+)\*\*/g, "$1")
+    .replace(/__([^_]+)__/g, "$1")
+    .replace(/`([^`]+)`/g, "$1")
+    .replace(/\s+\n/g, "\n")
+    .trim();
+}
+
+function formatStructuredValue(value: unknown) {
+  if (value === undefined || value === null) return "";
+  if (typeof value === "string") return value.trim();
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+function hasStructuredValue(value: unknown) {
+  if (value === undefined || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") {
+    return Object.keys(value as Record<string, unknown>).length > 0;
+  }
+  return true;
+}
+
+async function openFileWithOS(path: string) {
+  try {
+    await openDesktopPath(path);
+  } catch {
+    // silently fail on web
+  }
+}
+
+async function revealFileInFinder(path: string) {
+  try {
+    await revealDesktopItemInDir(path);
+  } catch {
+    // silently fail on web
+  }
+}
+
+function CopyButton(props: { getText: () => string }) {
+  const [copied, setCopied] = useState(false);
+
+  return (
+    <button
+      type="button"
+      className="inline-flex items-center justify-center rounded-lg border border-dls-border bg-dls-surface p-1.5 text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text"
+      title="Copy message"
+      onClick={async () => {
+        await navigator.clipboard.writeText(props.getText());
+        setCopied(true);
+        window.setTimeout(() => setCopied(false), 1200);
+      }}
+    >
+      {copied ? <Check size={14} /> : <Copy size={14} />}
+    </button>
+  );
+}
+
+/** Expandable chip for collapsed pasted text in sent messages. */
+function PastedTextChip(props: { label: string; text: string }) {
+  const [expanded, setExpanded] = useState(false);
+  const lineCount = props.text.split(/\r?\n/).length;
+
+  return (
+    <span className="inline">
+      <button
+        type="button"
+        className="inline-flex items-center gap-1 rounded-full border border-amber-6/35 bg-amber-3/15 px-2.5 py-0.5 text-xs font-medium text-amber-11 transition-colors hover:bg-amber-3/30"
+        onClick={() => setExpanded((v) => !v)}
+        title={expanded ? "Collapse pasted text" : "Expand pasted text"}
+      >
+        <ChevronDown
+          size={12}
+          className={`shrink-0 transition-transform ${expanded ? "rotate-180" : ""}`}
+        />
+        <span>Pasted · {lineCount} line{lineCount === 1 ? "" : "s"}</span>
+      </button>
+      {expanded ? (
+        <div className="mt-1.5 mb-1.5 rounded-xl border border-amber-6/20 bg-amber-3/10 px-4 py-3 text-xs leading-5 text-dls-text">
+          <pre className="whitespace-pre-wrap break-words font-mono">{props.text}</pre>
+        </div>
+      ) : null}
+    </span>
+  );
+}
+
+const PASTE_TOKEN_RE = /(\[pasted text [^\]]+\])/;
+
+function HighlightedPlainText(props: {
+  text: string;
+  className: string;
+  highlightQuery?: string;
+  /** Map of paste label -> full text for expandable chips */
+  pastedTextMap?: Map<string, string>;
+}) {
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const root = rootRef.current;
+    if (!root) return;
+
+    queueMicrotask(() => {
+      if (!rootRef.current || rootRef.current !== root) return;
+      applyTextHighlights(root, props.highlightQuery ?? "");
+    });
+  }, [props.highlightQuery, props.text]);
+
+  // If no paste tokens present, render as plain text (fast path).
+  if (!props.pastedTextMap?.size || !PASTE_TOKEN_RE.test(props.text)) {
+    return (
+      <div ref={rootRef} className={props.className}>
+        {props.text}
+      </div>
+    );
+  }
+
+  // Split on paste tokens and render chips inline.
+  const segments = props.text.split(PASTE_TOKEN_RE);
+  return (
+    <div ref={rootRef} className={props.className}>
+      {segments.map((segment, index) => {
+        const match = segment.match(/^\[pasted text (.+)\]$/);
+        if (match?.[1]) {
+          const pastedBody = props.pastedTextMap?.get(match[1]);
+          if (pastedBody) {
+            return <PastedTextChip key={index} label={match[1]} text={pastedBody} />;
+          }
+        }
+        return <span key={index}>{segment}</span>;
+      })}
+    </div>
+  );
+}
+
+function FileCard(props: {
+  part: { filename?: string; url: string; mediaType: string };
+  tone: "assistant" | "user";
+}) {
+  const [menuOpen, setMenuOpen] = useState(false);
+  const isDataUrl = props.part.url?.startsWith("data:");
+  const title = props.part.filename || (isDataUrl ? "Attached file" : props.part.url) || "File";
+  const ext = props.part.filename?.split(".").pop()?.toLowerCase();
+  const badge = humanMediaType(props.part.mediaType) ?? (ext ? ext.toUpperCase() : null);
+  const isImage = isImageAttachment(props.part.mediaType ?? "");
+  const isDesktop = isDesktopRuntime();
+  const hasPath = !isDataUrl && props.part.url && !props.part.url.startsWith("http");
+
+  return (
+    <div
+      className={`group relative flex items-center gap-3 rounded-2xl border px-4 py-3 transition-colors ${
+        props.tone === "user"
+          ? "border-gray-6/60 bg-gray-2/40 hover:bg-gray-2/60"
+          : "border-gray-6/40 bg-gray-1/40 hover:bg-gray-2/30"
+      }`}
+    >
+      {isImage && props.part.url ? (
+        <div className="h-11 w-11 shrink-0 overflow-hidden rounded-xl border border-dls-border/60 bg-dls-surface">
+          <img src={props.part.url} alt={title} loading="lazy" decoding="async" className="h-full w-full object-cover" />
+        </div>
+      ) : (
+        <div
+          className={`flex h-11 w-11 shrink-0 items-center justify-center rounded-xl ${
+            props.tone === "user" ? "bg-gray-3/60 text-gray-11" : "bg-gray-2/60 text-gray-10"
+          }`}
+        >
+          <FileIcon size={20} />
+        </div>
+      )}
+      <div className="min-w-0 flex-1">
+        <div className="truncate text-[13px] font-medium leading-snug text-gray-12">{title}</div>
+        {badge ? (
+          <div className="mt-1 inline-flex rounded-md bg-gray-3/50 px-1.5 py-0.5 text-[10px] font-medium uppercase tracking-wide text-gray-10">
+            {badge}
+          </div>
+        ) : null}
+      </div>
+
+      {isDesktop && hasPath ? (
+        <div className="relative">
+          <button
+            type="button"
+            className="flex h-8 w-8 items-center justify-center rounded-xl text-gray-9 opacity-0 transition-all hover:bg-gray-3/60 hover:text-gray-12 group-hover:opacity-100"
+            onClick={() => setMenuOpen((value) => !value)}
+            title="File actions"
+          >
+            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round"><circle cx="12" cy="12" r="1"/><circle cx="12" cy="5" r="1"/><circle cx="12" cy="19" r="1"/></svg>
+          </button>
+          {menuOpen ? (
+            <>
+              <div className="fixed inset-0 z-30" onClick={() => setMenuOpen(false)} />
+              <div className="absolute right-0 top-full z-40 mt-1 w-48 rounded-2xl border border-dls-border bg-dls-surface p-1.5 shadow-lg">
+                <button
+                  type="button"
+                  className="flex w-full items-center gap-2.5 rounded-xl px-3 py-2 text-left text-[13px] text-gray-12 transition-colors hover:bg-gray-3/60"
+                  onClick={() => {
+                    void openFileWithOS(props.part.url);
+                    setMenuOpen(false);
+                  }}
+                >
+                  Open with default app
+                </button>
+                <button
+                  type="button"
+                  className="flex w-full items-center gap-2.5 rounded-xl px-3 py-2 text-left text-[13px] text-gray-12 transition-colors hover:bg-gray-3/60"
+                  onClick={() => {
+                    void revealFileInFinder(props.part.url);
+                    setMenuOpen(false);
+                  }}
+                >
+                  Reveal in Finder
+                </button>
+                <button
+                  type="button"
+                  className="flex w-full items-center gap-2.5 rounded-xl px-3 py-2 text-left text-[13px] text-gray-12 transition-colors hover:bg-gray-3/60"
+                  onClick={() => {
+                    void navigator.clipboard.writeText(props.part.url);
+                    setMenuOpen(false);
+                  }}
+                >
+                  Copy path
+                </button>
+              </div>
+            </>
+          ) : null}
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function StepRow(props: {
+  id: string;
+  part: TranscriptPart;
+  expanded: boolean;
+  onToggle: () => void;
+}) {
+  const summary = useMemo(() => summarizeStep(props.part), [props.part]);
+  const toolState = useMemo(() => {
+    if (props.part.type !== "tool") return {} as Record<string, unknown>;
+    return (((props.part as { state?: unknown }).state ?? {}) as Record<string, unknown>);
+  }, [props.part]);
+  const toolInput = toolState.input && typeof toolState.input === "object"
+    ? (toolState.input as Record<string, unknown>)
+    : undefined;
+  const toolOutput = toolState.output;
+  const toolError = typeof toolState.error === "string" ? toolState.error : null;
+  const expandable =
+    props.part.type === "tool" &&
+    (hasStructuredValue(toolInput) || hasStructuredValue(toolOutput) || Boolean(toolError));
+  const headline = summary.title?.trim() || "Step updates progress";
+
+  if (props.part.type === "reasoning") {
+    const raw = typeof (props.part as { text?: unknown }).text === "string"
+      ? (props.part as { text: string }).text
+      : "";
+    return (
+      <div className="text-[14px] leading-[1.7] text-gray-9 whitespace-pre-wrap">
+        <div className="max-w-[720px]">{cleanReasoningPreview(raw) || headline}</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="text-[14px] text-gray-9">
+      <button
+        type="button"
+        className="w-full text-left transition-colors hover:text-dls-text disabled:cursor-default"
+        aria-expanded={expandable ? props.expanded : undefined}
+        disabled={!expandable}
+        onClick={() => {
+          if (!expandable) return;
+          props.onToggle();
+        }}
+      >
+        <span className="inline-flex max-w-[720px] items-start gap-1.5 leading-relaxed align-top">
+          <span className="min-w-0 break-words">{headline}</span>
+          {expandable ? (
+            <ChevronDown
+              size={14}
+              className={`mt-[2px] shrink-0 text-gray-8 transition-transform ${
+                props.expanded ? "" : "-rotate-90"
+              }`}
+            />
+          ) : null}
+        </span>
+      </button>
+      {props.expanded ? (
+        <div className="mt-3 ml-[22px] space-y-3">
+          {hasStructuredValue(toolInput) ? (
+            <div>
+              <div className="mb-1 text-[11px] font-medium uppercase tracking-[0.12em] text-gray-8">Request</div>
+              <pre className="overflow-x-auto rounded-[16px] border border-dls-border/70 bg-dls-surface px-4 py-3 text-[12px] leading-6 text-gray-10">
+                {formatStructuredValue(toolInput)}
+              </pre>
+            </div>
+          ) : null}
+          {hasStructuredValue(toolOutput) ? (
+            <div>
+              <div className="mb-1 text-[11px] font-medium uppercase tracking-[0.12em] text-gray-8">Result</div>
+              <pre className="overflow-x-auto rounded-[16px] border border-dls-border/70 bg-dls-surface px-4 py-3 text-[12px] leading-6 text-gray-10">
+                {formatStructuredValue(toolOutput)}
+              </pre>
+            </div>
+          ) : null}
+          {toolError ? (
+            <div>
+              <div className="mb-1 text-[11px] font-medium uppercase tracking-[0.12em] text-red-10">Error</div>
+              <pre className="overflow-x-auto rounded-[16px] border border-red-6/40 bg-red-3/20 px-4 py-3 text-[12px] leading-6 text-red-11">
+                {toolError}
+              </pre>
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function StepsContainer(props: {
+  stepGroups: StepTimelineGroup[];
+  isUser: boolean;
+  isInline?: boolean;
+  isNestedVariant: boolean;
+  isStreaming: boolean;
+  expandedStepIds: Set<string>;
+  onExpandedStepIdsChange: (updater: (current: Set<string>) => Set<string>) => void;
+}) {
+  const toggleSteps = (id: string) => {
+    props.onExpandedStepIdsChange((current) => {
+      const next = new Set(current);
+      if (next.has(id)) {
+        next.delete(id);
+      } else {
+        next.add(id);
+      }
+      return next;
+    });
+  };
+
+  const useInnerTimelineScroll = !props.isStreaming;
+
+  return (
+    <div className={props.isInline ? (props.isUser ? "mt-3" : "mt-4") : ""}>
+      <div
+        data-scrollable={useInnerTimelineScroll && !props.isNestedVariant ? "true" : undefined}
+        className={
+          !props.isNestedVariant && useInnerTimelineScroll
+            ? "max-h-[420px] overflow-y-auto pr-3"
+            : ""
+        }
+      >
+        <div className="flex flex-col gap-4">
+          {props.stepGroups.map((group) => (
+            <div key={group.id} className="flex flex-col gap-4">
+              {group.parts.map((part, index) => {
+                const rowId = `${group.id}:${index}`;
+                return (
+                  <StepRow
+                    key={rowId}
+                    id={rowId}
+                    part={part}
+                    expanded={props.expandedStepIds.has(rowId)}
+                    onToggle={() => toggleSteps(rowId)}
+                  />
+                );
+              })}
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function SessionTranscriptInner(props: SessionTranscriptProps) {
+  const showThinking = props.showThinking ?? props.developerMode;
+  const isNestedVariant = props.variant === "nested";
+  const [internalExpandedStepIds, setInternalExpandedStepIds] = useState<Set<string>>(
+    () => new Set(),
+  );
+  const expandedStepIds = props.expandedStepIds ?? internalExpandedStepIds;
+  const onExpandedStepIdsChange =
+    props.onExpandedStepIdsChange ??
+    ((updater: (current: Set<string>) => Set<string>) => {
+      setInternalExpandedStepIds((current) => updater(current));
+    });
+
+  const transcriptMessages = useMemo<TranscriptMessage[]>(() => {
+    return props.messages.map((message) => ({
+      id: message.id,
+      role: message.role,
+      source: message,
+      parts: message.parts
+        .map((part, index) => toLegacyPart(part, `${message.id}:${index}`))
+        .filter((part): part is TranscriptPart => Boolean(part)),
+    }));
+  }, [props.messages]);
+
+  // Cache of the previous messageBlocks array, indexed by identity key.
+  // Used by useStableBlocks below so structurally-equivalent blocks keep
+  // their previous object reference across renders.
+  const previousBlocksRef = useRef<Map<string, MessageBlockItem>>(new Map());
+
+  const rawMessageBlocks = useMemo<MessageBlockItem[]>(() => {
+    const blocks: MessageBlockItem[] = [];
+
+    transcriptMessages.forEach((message) => {
+      const renderableParts = message.parts.filter((part) => {
+        if (part.type === "reasoning") {
+          return showThinking;
+        }
+
+        if (part.type === "step-start" || part.type === "step-finish") {
+          return false;
+        }
+
+        return (
+          part.type === "text" ||
+          part.type === "tool" ||
+          part.type === "agent" ||
+          part.type === "file" ||
+          props.developerMode
+        );
+      });
+
+      if (!renderableParts.length) return;
+
+      const isUser = message.role === "user";
+      const attachments = attachmentsForParts(renderableParts);
+      const nonAttachmentParts = renderableParts.filter((part) => !isAttachmentPart(part));
+      const groups = groupMessageParts(nonAttachmentParts, message.id);
+      const isStepsOnly = groups.length > 0 && groups.every((group) => group.kind === "steps");
+      const stepGroups = isStepsOnly
+        ? (groups as Array<{
+            kind: "steps";
+            id: string;
+            parts: TranscriptPart[];
+            segment: "execution";
+            mode: StepGroupMode;
+          }>).map((group) => ({
+            id: group.id,
+            parts: group.parts,
+            mode: group.mode,
+          }))
+        : [];
+
+      if (isStepsOnly && stepGroups.length > 0) {
+        blocks.push({
+          kind: "steps-cluster",
+          id: stepGroups[0].id,
+          stepGroups,
+          messageIds: [message.id],
+          isUser,
+        });
+        return;
+      }
+
+      blocks.push({
+        kind: "message",
+        message: message.source,
+        renderableParts,
+        attachments,
+        groups,
+        isUser,
+        messageId: message.id,
+      });
+    });
+
+    return blocks;
+  }, [props.developerMode, showThinking, transcriptMessages]);
+
+  // Structural sharing: reuse the previous block object reference for any
+  // block whose content is equivalent. During streaming, only the active
+  // assistant message's block is actually new — every other block in the
+  // transcript keeps its previous reference, which means every
+  // React.memo'd descendant (MarkdownBlock, SessionTranscript itself, and
+  // any future per-row components) gets a pointer-equal prop and can bail
+  // out of rendering entirely.
+  const messageBlocks = useMemo<MessageBlockItem[]>(() => {
+    const prev = previousBlocksRef.current;
+    const next = new Map<string, MessageBlockItem>();
+    const stable: MessageBlockItem[] = rawMessageBlocks.map((block) => {
+      const key = blockIdentityKey(block);
+      const prevBlock = prev.get(key);
+      const reused = blocksAreEquivalent(prevBlock, block) ? (prevBlock as MessageBlockItem) : block;
+      next.set(key, reused);
+      return reused;
+    });
+    previousBlocksRef.current = next;
+    return stable;
+  }, [rawMessageBlocks]);
+
+  const latestAssistantMessageId = useMemo(() => {
+    for (let index = props.messages.length - 1; index >= 0; index -= 1) {
+      const message = props.messages[index];
+      if (message?.role === "assistant") {
+        return message.id;
+      }
+    }
+    return "";
+  }, [props.messages]);
+
+  const blockIndexByMessageId = useMemo(() => {
+    const next = new Map<string, number>();
+    messageBlocks.forEach((block, index) => {
+      if (block.kind === "steps-cluster") {
+        block.messageIds.forEach((id) => {
+          if (id) next.set(id, index);
+        });
+        return;
+      }
+
+      if (block.messageId) {
+        next.set(block.messageId, index);
+      }
+    });
+    return next;
+  }, [messageBlocks]);
+
+  // Decide to virtualize based only on block count. Do NOT gate on whether
+  // the scrollElement ref has already attached — that's false on the first
+  // render of a session, which used to make us render every message
+  // eagerly (freezing the UI on large sessions) for one tick before
+  // switching to virtualization.
+  const shouldVirtualize = messageBlocks.length >= VIRTUALIZATION_THRESHOLD;
+
+  const virtualizer = useVirtualizer({
+    count: messageBlocks.length,
+    getScrollElement: () => props.scrollElement?.() ?? null,
+    // Give react-virtual a shape-aware estimate so the initial scroll
+    // height is closer to reality. Small steps-cluster rows are much
+    // shorter than full assistant message blocks; a good estimate means
+    // fewer measurement-driven scroll corrections as rows come into view.
+    estimateSize: (index) => {
+      const block = messageBlocks[index];
+      if (!block) return 180;
+      if (block.kind === "steps-cluster") return 80;
+      return block.isUser ? 96 : 320;
+    },
+    overscan: VIRTUAL_OVERSCAN,
+    getItemKey: (index) => {
+      const block = messageBlocks[index];
+      if (!block) return `block-${index}`;
+      if (block.kind === "steps-cluster") {
+        return `steps-${block.messageIds.join(",")}`;
+      }
+      return `message-${block.messageId}`;
+    },
+  });
+
+  const virtualRows = shouldVirtualize ? virtualizer.getVirtualItems() : [];
+
+  useEffect(() => {
+    const register = props.setScrollToMessageById;
+    if (!register) return;
+
+    register((messageId, behavior = "smooth") => {
+      const index = blockIndexByMessageId.get(messageId);
+      if (index === undefined) return false;
+
+      if (shouldVirtualize) {
+        virtualizer.scrollToIndex(index, { align: "center" });
+        return true;
+      }
+
+      const container = props.scrollElement?.();
+      if (!container) return false;
+      const escapedId = messageId.replace(/"/g, '\\"');
+      const target = container.querySelector(`[data-message-id="${escapedId}"]`) as HTMLElement | null;
+      if (!target) return false;
+      target.scrollIntoView({ behavior, block: "center" });
+      return true;
+    });
+
+    return () => {
+      register(null);
+    };
+  }, [blockIndexByMessageId, props.scrollElement, props.setScrollToMessageById, shouldVirtualize, virtualizer]);
+
+  // NOTE: we intentionally do NOT call virtualizer.measure() on every
+  // messageBlocks change. react-virtual already invalidates and
+  // re-measures rows whose refs remount or whose content changes. Calling
+  // measure() explicitly on each streaming token forces a synchronous
+  // getBoundingClientRect() pass over every measured row, which made
+  // streaming into large sessions feel like the UI was frozen.
+
+  // Apply content-visibility earlier too. Even when the transcript is below
+  // the virtualization threshold, hiding distant blocks from layout/paint
+  // work reduces the chance that one large session makes the UI feel frozen.
+  const shouldUseContentVisibility = !shouldVirtualize && messageBlocks.length > 24;
+
+  const blockPerfStyle = (index: number): CSSProperties | undefined => {
+    if (!shouldUseContentVisibility) return undefined;
+    const total = messageBlocks.length;
+      if (index >= total - 12) return undefined;
+      return {
+        contentVisibility: "auto",
+        containIntrinsicSize: "180px",
+      };
+    };
+
+  const renderBlock = (block: MessageBlockItem, blockIndex: number) => {
+    const blockMessageIds = block.kind === "steps-cluster" ? block.messageIds : [block.messageId];
+    const hasSearchMatch = blockMessageIds.some((id) => props.searchMatchMessageIds?.has(id));
+    const hasActiveSearchMatch = blockMessageIds.some((id) => id === props.activeSearchMessageId);
+    const searchOutlineClass = hasActiveSearchMatch
+      ? "outline outline-2 outline-amber-8/70 outline-offset-2 rounded-2xl"
+      : hasSearchMatch
+        ? "outline outline-1 outline-amber-7/50 outline-offset-1 rounded-2xl"
+        : "";
+
+    if (block.kind === "steps-cluster") {
+      return (
+        <div
+          key={`steps-${block.id}`}
+          className={`flex group ${block.isUser ? "justify-end" : "justify-start"}`.trim()}
+          data-message-role={block.isUser ? "user" : "assistant"}
+          data-message-id={block.messageIds[0] ?? ""}
+          style={{ contain: "layout style paint", ...blockPerfStyle(blockIndex) }}
+        >
+          <div
+            className={`${
+              block.isUser
+                ? isNestedVariant
+                  ? "relative max-w-[92%] rounded-[20px] border border-dls-border bg-dls-sidebar px-4 py-3 text-[14px] leading-relaxed text-dls-text"
+                  : "relative max-w-[85%] rounded-[24px] border border-dls-border bg-dls-sidebar px-6 py-4 text-[15px] leading-relaxed text-dls-text"
+                : isNestedVariant
+                  ? "w-full relative text-[14px] leading-[1.65] text-dls-text group"
+                  : "w-full relative max-w-[760px] text-[15px] leading-[1.7] text-dls-text group"
+            } ${searchOutlineClass}`}
+          >
+            <StepsContainer
+              stepGroups={block.stepGroups}
+              isUser={block.isUser}
+              isNestedVariant={isNestedVariant}
+              isStreaming={props.isStreaming}
+              expandedStepIds={expandedStepIds}
+              onExpandedStepIdsChange={onExpandedStepIdsChange}
+            />
+          </div>
+        </div>
+      );
+    }
+
+    const groupSpacing = block.isUser ? "mb-3" : "mb-4";
+    const isSyntheticSessionError =
+      !block.isUser && block.messageId.startsWith(SYNTHETIC_SESSION_ERROR_MESSAGE_PREFIX);
+
+    if (isSyntheticSessionError) {
+      const messageText = block.renderableParts
+        .map((part) => partToText(part))
+        .join(" ")
+        .replace(/\s*\n+\s*/g, " ")
+        .replace(/\s{2,}/g, " ")
+        .trim();
+
+      return (
+        <div
+          key={`error-${block.messageId}`}
+          className="flex group justify-start"
+          data-message-role="assistant"
+          data-message-id={block.messageId}
+          style={{ contain: "layout style paint", ...blockPerfStyle(blockIndex) }}
+        >
+          <div className={`w-full relative ${isNestedVariant ? "" : "max-w-[650px]"} ${searchOutlineClass}`}>
+            <div
+              className="inline-flex max-w-full items-start gap-2 rounded-[18px] border border-red-7/20 bg-red-1/35 px-3 py-2 text-[13px] leading-5 text-red-12 shadow-sm"
+              role="alert"
+            >
+              <CircleAlert size={14} className="mt-0.5 shrink-0" />
+              <div className="min-w-0 break-words">{messageText}</div>
+            </div>
+          </div>
+        </div>
+      );
+    }
+
+    return (
+      <div
+        key={`message-${block.messageId}`}
+        className={`flex group ${block.isUser ? "justify-end" : "justify-start"}`.trim()}
+        data-message-role={block.isUser ? "user" : "assistant"}
+        data-message-id={block.messageId}
+        style={{ contain: "layout style paint", ...blockPerfStyle(blockIndex) }}
+      >
+        <div
+          className={`${
+            block.isUser
+              ? isNestedVariant
+                ? "relative max-w-[92%] rounded-[20px] border border-dls-border bg-dls-sidebar px-4 py-3 text-[14px] leading-relaxed text-dls-text"
+                : "relative max-w-[85%] rounded-[24px] border border-dls-border bg-dls-sidebar px-6 py-4 text-[15px] leading-relaxed text-dls-text"
+              : isNestedVariant
+                ? "w-full relative text-[14px] leading-[1.65] text-dls-text antialiased group"
+                : "w-full relative max-w-[760px] text-[15px] leading-[1.72] text-dls-text antialiased group"
+          } ${searchOutlineClass}`}
+        >
+          {block.attachments.length > 0 ? (
+            <div className={block.isUser ? "mb-3 flex flex-wrap gap-2" : "mb-4 flex flex-wrap gap-2"}>
+              {block.attachments.map((attachment) => (
+                <FileCard
+                  key={`${block.messageId}:${attachment.url}`}
+                  part={{
+                    filename: attachment.filename,
+                    url: attachment.url,
+                    mediaType: attachment.mime,
+                  }}
+                  tone={block.isUser ? "user" : "assistant"}
+                />
+              ))}
+            </div>
+          ) : null}
+
+          {block.groups.map((group, index) => {
+            const highlightQuery = hasSearchMatch ? props.searchHighlightQuery : undefined;
+            const isStreamingLatestAssistant =
+              !block.isUser && props.isStreaming && block.messageId === latestAssistantMessageId;
+
+            return (
+              <div key={`${block.messageId}:${group.kind}:${index}`} className={index === block.groups.length - 1 ? "" : groupSpacing}>
+                {group.kind === "text" ? (() => {
+                  if (group.part.type === "file") {
+                    const filePart = group.part as {
+                      filename?: string;
+                      url?: string;
+                      mime?: string;
+                    };
+                    return (
+                      <FileCard
+                        part={{
+                          filename: filePart.filename,
+                          url: filePart.url ?? "",
+                          mediaType: filePart.mime ?? "application/octet-stream",
+                        }}
+                        tone={block.isUser ? "user" : "assistant"}
+                      />
+                    );
+                  }
+
+                  const text = partToText(group.part);
+                  if (block.isUser) {
+                    return (
+                      <HighlightedPlainText
+                        text={text}
+                        className="whitespace-pre-wrap break-words text-gray-12"
+                        highlightQuery={highlightQuery}
+                      />
+                    );
+                  }
+
+                  return (
+                    <MarkdownBlock
+                      text={text}
+                      streaming={isStreamingLatestAssistant}
+                      highlightQuery={highlightQuery}
+                    />
+                  );
+                })() : null}
+
+                {group.kind === "steps" ? (
+                  <StepsContainer
+                    stepGroups={[{
+                      id: group.id,
+                      parts: group.parts,
+                      mode: group.mode,
+                    }]}
+                    isUser={block.isUser}
+                    isInline={true}
+                    isNestedVariant={isNestedVariant}
+                    isStreaming={props.isStreaming}
+                    expandedStepIds={expandedStepIds}
+                    onExpandedStepIdsChange={onExpandedStepIdsChange}
+                  />
+                ) : null}
+              </div>
+            );
+          })}
+
+          {!isNestedVariant ? (
+            <div className="absolute bottom-2 right-2 flex justify-end opacity-100 pointer-events-auto md:opacity-0 md:pointer-events-none md:group-hover:opacity-100 md:group-hover:pointer-events-auto md:group-focus-within:opacity-100 md:group-focus-within:pointer-events-auto transition-opacity select-none">
+              <CopyButton getText={() => messageToText(block.message)} />
+            </div>
+          ) : null}
+        </div>
+      </div>
+    );
+  };
+
+  return (
+    <div className={isNestedVariant ? "pb-0" : "pb-10"} style={{ contain: "layout paint style" }}>
+      {shouldVirtualize ? (
+        // Always render the virtualized container once we've decided to
+        // virtualize — even if virtualRows is empty on the very first tick
+        // (e.g. scrollElement ref hasn't attached yet). A fallback to
+        // rendering every message would re-introduce the eager-render
+        // freeze on huge sessions.
+        <div
+          className="relative"
+          style={{
+            height: `${Math.max(virtualizer.getTotalSize(), 1)}px`,
+            width: "100%",
+          }}
+        >
+          {virtualRows.map((virtualRow) => {
+            const block = messageBlocks[virtualRow.index];
+            if (!block) return null;
+            return (
+              <div
+                key={virtualRow.key}
+                data-index={virtualRow.index}
+                ref={(element) => {
+                  if (element) {
+                    virtualizer.measureElement(element);
+                  }
+                }}
+                className="absolute left-0 top-0 w-full pb-4"
+                style={{
+                  transform: `translateY(${virtualRow.start}px)`,
+                }}
+              >
+                {renderBlock(block, virtualRow.index)}
+              </div>
+            );
+          })}
+        </div>
+      ) : (
+        <div className={isNestedVariant ? "space-y-3" : "space-y-4"}>
+          {messageBlocks.map((block, index) => renderBlock(block, index))}
+        </div>
+      )}
+
+      {!isNestedVariant && props.footer ? props.footer : null}
+    </div>
+  );
+}
+
+/**
+ * Memoize at the transcript boundary so SessionSurface state churn (e.g.
+ * sending=true flipping while the assistant streams) doesn't force a full
+ * transcript re-render on every parent commit. Re-renders now happen only
+ * when the transcript's own props actually change (messages array
+ * identity, isStreaming, developerMode, etc.).
+ */
+export const SessionTranscript = memo(SessionTranscriptInner);
+SessionTranscript.displayName = "SessionTranscript";
diff --git a/apps/app/src/react-app/domains/session/surface/scroll-controller.ts b/apps/app/src/react-app/domains/session/surface/scroll-controller.ts
new file mode 100644
index 0000000000..03e2c245e4
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/scroll-controller.ts
@@ -0,0 +1,288 @@
+import { useCallback, useEffect, useRef, useState, type RefObject, type UIEventHandler } from "react";
+
+const FOLLOW_LATEST_BOTTOM_GAP_PX = 96;
+// Widened from 250ms so a single wheel or trackpad flick isn't missed between
+// two rapid programmatic scroll-to-bottom frames during streaming.
+const SCROLL_GESTURE_WINDOW_MS = 600;
+// Threshold (px) that counts as a meaningful "scroll upward" gesture. Anything
+// smaller is treated as anchoring jitter and ignored so we don't trip out of
+// follow-latest for pixel-level content growth.
+const MANUAL_BROWSE_UPWARD_THRESHOLD_PX = 16;
+
+type SessionScrollMode = "follow-latest" | "manual-browse";
+
+type SessionScrollControllerOptions = {
+  selectedSessionId: string | null;
+  renderedMessages: unknown;
+  containerRef: RefObject<HTMLDivElement | null>;
+  contentRef: RefObject<HTMLDivElement | null>;
+};
+
+export function useSessionScrollController(
+  options: SessionScrollControllerOptions,
+) {
+  const [mode, setMode] = useState<SessionScrollMode>("follow-latest");
+  const [topClippedMessageId, setTopClippedMessageId] = useState<string | null>(null);
+
+  const lastKnownScrollTopRef = useRef(0);
+  const programmaticScrollRef = useRef(false);
+  const programmaticScrollResetRafARef = useRef<number | undefined>(undefined);
+  const programmaticScrollResetRafBRef = useRef<number | undefined>(undefined);
+  const observedContentHeightRef = useRef(0);
+  const lastGestureAtRef = useRef(0);
+  const previousSessionIdRef = useRef<string | null>(null);
+
+  const isAtBottom = mode === "follow-latest";
+
+  const hasScrollGesture = useCallback(
+    () => Date.now() - lastGestureAtRef.current < SCROLL_GESTURE_WINDOW_MS,
+    [],
+  );
+
+  const updateOverflowAnchor = useCallback(() => {
+    const container = options.containerRef.current;
+    if (!container) return;
+    container.style.overflowAnchor = isAtBottom ? "none" : "auto";
+  }, [isAtBottom, options.containerRef]);
+
+  const markScrollGesture = useCallback(
+    (target?: EventTarget | null) => {
+      const container = options.containerRef.current;
+      if (!container) return;
+
+      const el = target instanceof Element ? target : undefined;
+      const nested = el?.closest("[data-scrollable]");
+      if (nested && nested !== container) return;
+
+      lastGestureAtRef.current = Date.now();
+    },
+    [options.containerRef],
+  );
+
+  const clearProgrammaticScrollReset = useCallback(() => {
+    if (programmaticScrollResetRafARef.current !== undefined) {
+      window.cancelAnimationFrame(programmaticScrollResetRafARef.current);
+      programmaticScrollResetRafARef.current = undefined;
+    }
+    if (programmaticScrollResetRafBRef.current !== undefined) {
+      window.cancelAnimationFrame(programmaticScrollResetRafBRef.current);
+      programmaticScrollResetRafBRef.current = undefined;
+    }
+  }, []);
+
+  const releaseProgrammaticScrollSoon = useCallback(() => {
+    clearProgrammaticScrollReset();
+    programmaticScrollResetRafARef.current = window.requestAnimationFrame(() => {
+      programmaticScrollResetRafARef.current = undefined;
+      programmaticScrollResetRafBRef.current = window.requestAnimationFrame(() => {
+        programmaticScrollResetRafBRef.current = undefined;
+        programmaticScrollRef.current = false;
+      });
+    });
+  }, [clearProgrammaticScrollReset]);
+
+  const refreshTopClippedMessage = useCallback(() => {
+    const container = options.containerRef.current;
+    if (!container) {
+      setTopClippedMessageId(null);
+      return;
+    }
+
+    const containerRect = container.getBoundingClientRect();
+    const messageEls = container.querySelectorAll("[data-message-id]");
+    const latestMessageEl = messageEls[messageEls.length - 1] as HTMLElement | undefined;
+    const latestMessageId = latestMessageEl?.getAttribute("data-message-id")?.trim() ?? "";
+    let nextId: string | null = null;
+
+    for (const node of messageEls) {
+      const el = node as HTMLElement;
+      const rect = el.getBoundingClientRect();
+      if (rect.bottom <= containerRect.top + 1) continue;
+      if (rect.top >= containerRect.bottom - 1) break;
+
+      if (rect.top < containerRect.top - 1) {
+        const id = el.getAttribute("data-message-id")?.trim() ?? "";
+        if (id) {
+          const isLatestMessage = id === latestMessageId;
+          const fillsViewportTail = rect.bottom >= containerRect.bottom - 1;
+          if (isLatestMessage || fillsViewportTail) {
+            nextId = id;
+          }
+        }
+      }
+      break;
+    }
+
+    setTopClippedMessageId(nextId);
+  }, [options.containerRef]);
+
+  const scrollToBottom = useCallback(
+    (behavior: ScrollBehavior = "auto") => {
+      const container = options.containerRef.current;
+      if (!container) return;
+
+      setMode("follow-latest");
+      setTopClippedMessageId(null);
+      programmaticScrollRef.current = true;
+
+      if (behavior === "smooth") {
+        container.scrollTo({ top: container.scrollHeight, behavior: "smooth" });
+        releaseProgrammaticScrollSoon();
+        return;
+      }
+
+      container.scrollTop = container.scrollHeight;
+      window.requestAnimationFrame(() => {
+        const next = options.containerRef.current;
+        if (!next) {
+          programmaticScrollRef.current = false;
+          return;
+        }
+        next.scrollTop = next.scrollHeight;
+        releaseProgrammaticScrollSoon();
+      });
+    },
+    [options.containerRef, releaseProgrammaticScrollSoon],
+  );
+
+  const handleScroll = useCallback<UIEventHandler<HTMLDivElement>>(
+    (event) => {
+      const container = event.currentTarget;
+      const currentTop = container.scrollTop;
+      const previousTop = lastKnownScrollTopRef.current;
+      const delta = currentTop - previousTop;
+      const scrolledUp = delta <= -MANUAL_BROWSE_UPWARD_THRESHOLD_PX;
+      const userGestured = hasScrollGesture();
+
+      // If the user scrolls up meaningfully while a programmatic scroll is
+      // in flight, abandon the programmatic state and switch to manual browse
+      // immediately. Without this the ResizeObserver's auto-scroll during
+      // streaming keeps re-anchoring us to the bottom and the user can never
+      // actually get away from the tail of the transcript.
+      if (programmaticScrollRef.current && (userGestured || scrolledUp)) {
+        programmaticScrollRef.current = false;
+        clearProgrammaticScrollReset();
+        setMode("manual-browse");
+        lastKnownScrollTopRef.current = currentTop;
+        refreshTopClippedMessage();
+        return;
+      }
+
+      if (programmaticScrollRef.current) {
+        lastKnownScrollTopRef.current = currentTop;
+        refreshTopClippedMessage();
+        return;
+      }
+
+      // Even without a fresh gesture, a strong upward delta means the user
+      // dragged a scrollbar or triggered a keyboard paging shortcut. Treat it
+      // as a manual browse request.
+      if (!userGestured && !scrolledUp) {
+        lastKnownScrollTopRef.current = currentTop;
+        refreshTopClippedMessage();
+        return;
+      }
+
+      const bottomGap = container.scrollHeight - (currentTop + container.clientHeight);
+      if (bottomGap <= FOLLOW_LATEST_BOTTOM_GAP_PX) {
+        setMode("follow-latest");
+      } else if (scrolledUp) {
+        setMode("manual-browse");
+      }
+      lastKnownScrollTopRef.current = currentTop;
+      refreshTopClippedMessage();
+    },
+    [clearProgrammaticScrollReset, hasScrollGesture, refreshTopClippedMessage],
+  );
+
+  const jumpToLatest = useCallback(
+    (behavior: ScrollBehavior = "smooth") => {
+      scrollToBottom(behavior);
+    },
+    [scrollToBottom],
+  );
+
+  const jumpToStartOfMessage = useCallback(
+    (behavior: ScrollBehavior = "smooth") => {
+      const messageId = topClippedMessageId;
+      const container = options.containerRef.current;
+      if (!messageId || !container) return;
+
+      const escapedId = messageId.replace(/"/g, '\\"');
+      const target = container.querySelector(
+        `[data-message-id="${escapedId}"]`,
+      ) as HTMLElement | null;
+      if (!target) return;
+
+      setMode("manual-browse");
+      target.scrollIntoView({ behavior, block: "start" });
+    },
+    [options.containerRef, topClippedMessageId],
+  );
+
+  useEffect(() => {
+    updateOverflowAnchor();
+  }, [updateOverflowAnchor]);
+
+  useEffect(() => {
+    const content = options.contentRef.current;
+    if (!content) return;
+
+    observedContentHeightRef.current = content.offsetHeight;
+    const observer = new ResizeObserver(() => {
+      const nextContent = options.contentRef.current;
+      if (!nextContent) return;
+
+      const nextHeight = nextContent.offsetHeight;
+      const grew = nextHeight > observedContentHeightRef.current + 1;
+      observedContentHeightRef.current = nextHeight;
+
+      // Only re-anchor to the bottom when we're already in follow-latest mode
+      // AND the user isn't actively scrolling. If they've touched the wheel,
+      // touchpad, or scrollbar in the last SCROLL_GESTURE_WINDOW_MS, treat
+      // that as intent to break out of autoscroll and leave their position
+      // alone until the next handleScroll tick reclassifies the mode.
+      if (grew && isAtBottom && !hasScrollGesture()) {
+        scrollToBottom("auto");
+        return;
+      }
+
+      refreshTopClippedMessage();
+    });
+
+    observer.observe(content);
+    return () => observer.disconnect();
+  }, [hasScrollGesture, isAtBottom, options.contentRef, refreshTopClippedMessage, scrollToBottom]);
+
+  useEffect(() => {
+    if (options.selectedSessionId === previousSessionIdRef.current) return;
+    previousSessionIdRef.current = options.selectedSessionId;
+    if (!options.selectedSessionId) return;
+
+    setMode("follow-latest");
+    setTopClippedMessageId(null);
+    observedContentHeightRef.current = 0;
+    queueMicrotask(() => scrollToBottom("auto"));
+  }, [options.selectedSessionId, scrollToBottom]);
+
+  useEffect(() => {
+    void options.renderedMessages;
+    queueMicrotask(refreshTopClippedMessage);
+  }, [options.renderedMessages, refreshTopClippedMessage]);
+
+  useEffect(() => {
+    return () => {
+      clearProgrammaticScrollReset();
+    };
+  }, [clearProgrammaticScrollReset]);
+
+  return {
+    isAtBottom,
+    topClippedMessageId,
+    handleScroll,
+    markScrollGesture,
+    scrollToBottom,
+    jumpToLatest,
+    jumpToStartOfMessage,
+  };
+}
diff --git a/apps/app/src/react-app/domains/session/surface/session-render-state.ts b/apps/app/src/react-app/domains/session/surface/session-render-state.ts
new file mode 100644
index 0000000000..d6a9a29f70
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/session-render-state.ts
@@ -0,0 +1,46 @@
+import type { UIMessage } from "ai";
+
+import type { OpenworkSessionSnapshot } from "../../../../app/lib/openwork-server";
+import { mergeSnapshotAndLiveMessages, messageListContainsAll } from "../sync/message-merge";
+import { snapshotToUIMessages } from "../sync/usechat-adapter";
+
+export function resolveRenderedSessionSnapshot(input: {
+  sessionId: string;
+  currentSnapshot: OpenworkSessionSnapshot | null | undefined;
+  cachedRendered: { sessionId: string; snapshot: OpenworkSessionSnapshot } | null | undefined;
+}) {
+  if (input.currentSnapshot?.session.id === input.sessionId) {
+    return input.currentSnapshot;
+  }
+  if (
+    input.cachedRendered?.sessionId === input.sessionId &&
+    input.cachedRendered.snapshot.session.id === input.sessionId
+  ) {
+    return input.cachedRendered.snapshot;
+  }
+  return null;
+}
+
+export function deriveRenderedSessionMessages(input: {
+  transcriptState: UIMessage[] | null | undefined;
+  snapshot: OpenworkSessionSnapshot | null | undefined;
+  includeLiveOnlyMessages?: boolean;
+}) {
+  const liveMessages = input.transcriptState ?? [];
+  const snapshotMessages = input.snapshot && input.snapshot.messages.length > 0
+    ? snapshotToUIMessages(input.snapshot)
+    : [];
+
+  if (liveMessages.length > 0 && snapshotMessages.length === 0) return liveMessages;
+  if (liveMessages.length === 0 && snapshotMessages.length > 0) return snapshotMessages;
+  if (liveMessages.length > 0 && snapshotMessages.length > 0) {
+    if (messageListContainsAll(liveMessages, snapshotMessages)) return liveMessages;
+    return mergeSnapshotAndLiveMessages(snapshotMessages, liveMessages, {
+      appendLiveOnlyMessages: input.includeLiveOnlyMessages,
+    });
+  }
+  if (input.snapshot && input.snapshot.messages.length > 0) {
+    return snapshotMessages;
+  }
+  return input.transcriptState ?? [];
+}
diff --git a/apps/app/src/react-app/domains/session/surface/session-surface.tsx b/apps/app/src/react-app/domains/session/surface/session-surface.tsx
new file mode 100644
index 0000000000..202e6d1d58
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/session-surface.tsx
@@ -0,0 +1,996 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import type { UIMessage } from "ai";
+import { useQuery } from "@tanstack/react-query";
+import type { SessionStatus } from "@opencode-ai/sdk/v2/client";
+
+import { createClient, unwrap } from "../../../../app/lib/opencode";
+import { abortSessionSafe } from "../../../../app/lib/opencode-session";
+import { readWorkspaceCloudImports, type CloudImportedPlugin } from "../../../../app/cloud/import-state";
+import type {
+  OpenworkServerClient,
+  OpenworkSessionSnapshot,
+} from "../../../../app/lib/openwork-server";
+import type {
+  ComposerAttachment,
+  ComposerDraft,
+  ComposerPart,
+  McpServerEntry,
+  McpStatusMap,
+  SkillCard,
+} from "../../../../app/types";
+import {
+  publishInspectorSlice,
+  recordInspectorEvent,
+} from "../../../shell/app-inspector";
+import { useControlAction, type OpenworkControlAction } from "../../../shell/control/control-provider";
+import { getReactQueryClient } from "../../../infra/query-client";
+import { ReactSessionComposer } from "./composer/composer";
+import { DevProfiler } from "../../../shell/dev-profiler";
+import { OwDotTicker } from "../../../shell/dot-ticker";
+import { useReactRenderWatchdog } from "../../../shell/react-render-watchdog";
+import type { ReactComposerNotice } from "./composer/notice";
+import { SessionDebugPanel } from "./debug-panel";
+import { deriveRenderedSessionMessages, resolveRenderedSessionSnapshot } from "./session-render-state";
+import { SessionTranscript } from "./message-list";
+import { deriveSessionRenderModel } from "../sync/transition-controller";
+import { useSessionScrollController } from "./scroll-controller";
+import {
+  seedSessionState,
+  statusKey as reactStatusKey,
+  transcriptKey as reactTranscriptKey,
+} from "../sync/session-sync";
+
+const EMPTY_TRANSCRIPT: UIMessage[] = [];
+const IDLE_STATUS: SessionStatus = { type: "idle" };
+const DEFAULT_COMPOSER_CONTROL_TEXT = "Help me outline the next OpenWork task.";
+
+type SessionError = {
+  message: string;
+  kind?: "model-not-found" | "generic";
+  /** For model-not-found: the model that failed. */
+  failedModel?: { providerID: string; modelID: string };
+  /** For model-not-found: suggested replacements from the backend. */
+  suggestions?: Array<{ providerID: string; modelID: string }>;
+};
+
+export type SessionSurfaceProps = {
+  client: OpenworkServerClient;
+  workspaceId: string;
+  workspaceRoot: string;
+  sessionId: string;
+  opencodeBaseUrl: string;
+  openworkToken: string;
+  developerMode: boolean;
+  modelLabel: string;
+  onModelClick: () => void;
+  onSendDraft: (draft: ComposerDraft) => void;
+  onDraftChange: (draft: ComposerDraft) => void;
+  attachmentsEnabled: boolean;
+  attachmentsDisabledReason: string | null;
+  modelVariantLabel: string;
+  modelVariant: string | null;
+  modelBehaviorOptions?: { value: string | null; label: string }[];
+  onModelVariantChange: (value: string | null) => void;
+  agentLabel: string;
+  selectedAgent: string | null;
+  listAgents: () => Promise<import("@opencode-ai/sdk/v2/client").Agent[]>;
+  onSelectAgent: (agent: string | null) => void;
+  listCommands: () => Promise<import("../../../../app/types").SlashCommandOption[]>;
+  recentFiles: string[];
+  searchFiles: (query: string) => Promise<string[]>;
+  isRemoteWorkspace: boolean;
+  isSandboxWorkspace: boolean;
+  onChangeModel?: (model: { providerID: string; modelID: string }) => void;
+  onUploadInboxFiles?: ((files: File[], options?: { notify?: boolean }) => void | Promise<unknown>) | null;
+  onOpenSettingsSection?: ((section: "commands" | "skills" | "mcps" | "plugins") => void) | undefined;
+};
+
+function messageToReadableText(message: UIMessage) {
+  const header = message.role === "user" ? "You" : message.role === "assistant" ? "OpenWork" : message.role;
+  const body = message.parts
+    .flatMap((part) => {
+      if (part.type === "text") return [part.text];
+      if (part.type === "reasoning") return [part.text];
+      if (part.type === "dynamic-tool") {
+        if (part.state === "output-error") return [`[tool:${part.toolName}] ${part.errorText}`];
+        if (part.state === "output-available") return [`[tool:${part.toolName}] ${JSON.stringify(part.output)}`];
+        return [`[tool:${part.toolName}] ${JSON.stringify(part.input)}`];
+      }
+      return [];
+    })
+    .join("\n\n");
+  return `${header}\n${body}`.trim();
+}
+
+function transcriptToText(messages: UIMessage[]) {
+  return messages
+    .map(messageToReadableText)
+    .filter(Boolean)
+    .join("\n\n---\n\n");
+}
+
+function statusLabel(snapshot: OpenworkSessionSnapshot | undefined, busy: boolean) {
+  if (busy) return "Running...";
+  if (snapshot?.status.type === "busy") return "Running...";
+  if (snapshot?.status.type === "retry") return `Retrying: ${snapshot.status.message}`;
+  return "Ready";
+}
+
+function controlTextArgument(args: unknown) {
+  if (typeof args === "string") return args;
+  if (args && typeof args === "object" && "text" in args) {
+    const text = (args as { text?: unknown }).text;
+    if (typeof text === "string") return text;
+  }
+  return DEFAULT_COMPOSER_CONTROL_TEXT;
+}
+
+const waitForControl = (ms: number) => new Promise((resolve) => window.setTimeout(resolve, ms));
+
+function useSharedQueryState<T>(queryKey: readonly unknown[], fallback: T) {
+  const queryClient = getReactQueryClient();
+  // useSyncExternalStore requires getSnapshot to return the same reference
+  // while the external store has not changed. Callers must pass stable
+  // fallbacks for empty cache states.
+  return useSyncExternalStore(
+    (callback) => queryClient.getQueryCache().subscribe(callback),
+    () => (queryClient.getQueryData<T>(queryKey) ?? fallback),
+    () => fallback,
+  );
+}
+
+function messageHasVisibleAssistantOutput(message: UIMessage) {
+  if (message.role !== "assistant") return false;
+  return message.parts.some((part) => {
+    if ("text" in part && typeof part.text === "string") return part.text.trim().length > 0;
+    return part.type === "dynamic-tool" || part.type === "file";
+  });
+}
+
+function AssistantWaitingCard() {
+  return (
+    <div className="flex justify-start py-2" role="status" aria-live="polite">
+      <div className="inline-flex items-center gap-3 rounded-full px-3 py-1.5 text-[12px] text-dls-secondary">
+        <OwDotTicker size="sm" />
+        <span>Thinking</span>
+      </div>
+    </div>
+  );
+}
+
+function parseSessionError(thrown: unknown): SessionError {
+  const raw = thrown instanceof Error ? thrown.message : String(thrown);
+  // Try to detect ProviderModelNotFoundError from the SDK error shape.
+  // The error message may be a JSON string from our serializer in session-route.
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed?.name === "ProviderModelNotFoundError" && parsed?.data) {
+      const { providerID, modelID, suggestions } = parsed.data;
+      return {
+        message: `Model ${providerID}/${modelID} is not available.`,
+        kind: "model-not-found",
+        failedModel: { providerID, modelID },
+        suggestions: Array.isArray(suggestions) ? suggestions : [],
+      };
+    }
+  } catch {
+    // Not JSON — fall through to plain message
+  }
+  // Check if the raw string mentions model-not-found patterns
+  if (/ProviderModelNotFoundError/i.test(raw) || /model.*not found/i.test(raw)) {
+    return { message: raw, kind: "model-not-found" };
+  }
+  return { message: raw || "Failed to send prompt." };
+}
+
+function SessionErrorCard({ error, onDismiss, onChangeModel, onOpenModelPicker }: {
+  error: SessionError;
+  onDismiss: () => void;
+  onChangeModel?: (model: { providerID: string; modelID: string }) => void;
+  onOpenModelPicker?: () => void;
+}) {
+  return (
+    <div className="mx-auto max-w-[720px] px-3 py-3 sm:px-5">
+      <div className="rounded-2xl border border-red-6/30 bg-red-3/15 px-5 py-4">
+        <div className="flex items-start justify-between gap-3">
+          <div className="min-w-0 flex-1">
+            <div className="text-sm font-medium text-red-11">{error.message}</div>
+            {error.kind === "model-not-found" ? (
+              <div className="mt-2 flex flex-wrap gap-2">
+                {error.suggestions && error.suggestions.length > 0 ? (
+                  error.suggestions.map((s) => (
+                    <button
+                      key={`${s.providerID}/${s.modelID}`}
+                      type="button"
+                      className="rounded-full border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-text transition-colors hover:bg-dls-hover"
+                      onClick={() => {
+                        onChangeModel?.(s);
+                        onDismiss();
+                      }}
+                    >
+                      Use {s.providerID}/{s.modelID}
+                    </button>
+                  ))
+                ) : null}
+                <button
+                  type="button"
+                  className="rounded-full border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => {
+                    onOpenModelPicker?.();
+                    onDismiss();
+                  }}
+                >
+                  Change model
+                </button>
+              </div>
+            ) : null}
+          </div>
+          <button
+            type="button"
+            className="shrink-0 rounded-full p-1 text-red-10 transition-colors hover:bg-red-3 hover:text-red-11"
+            onClick={onDismiss}
+            aria-label="Dismiss error"
+          >
+            <svg width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M3.5 3.5l7 7M10.5 3.5l-7 7" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" /></svg>
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function revokeAttachmentPreview(attachment: { previewUrl?: string | undefined }) {
+  if (!attachment.previewUrl) return;
+  URL.revokeObjectURL(attachment.previewUrl);
+}
+
+export function SessionSurface(props: SessionSurfaceProps) {
+  const [draft, setDraft] = useState("");
+  const [attachments, setAttachments] = useState<ComposerAttachment[]>([]);
+  const [mentions, setMentions] = useState<Record<string, "agent" | "file">>({});
+  const [pasteParts, setPasteParts] = useState<Array<{ id: string; label: string; text: string; lines: number }>>([]);
+  const [notice, setNotice] = useState<ReactComposerNotice | null>(null);
+  const [error, setError] = useState<SessionError | null>(null);
+  const [sending, setSending] = useState(false);
+  const [showDelayedLoading, setShowDelayedLoading] = useState(false);
+  const [awaitingAssistantBaseline, setAwaitingAssistantBaseline] = useState<number | null>(null);
+  const [rendered, setRendered] = useState<{ sessionId: string; snapshot: OpenworkSessionSnapshot } | null>(null);
+  const [toolSkills, setToolSkills] = useState<SkillCard[]>([]);
+  const [toolMcpServers, setToolMcpServers] = useState<McpServerEntry[]>([]);
+  const [toolMcpStatus, setToolMcpStatus] = useState<string | null>(null);
+  const [toolMcpStatuses, setToolMcpStatuses] = useState<McpStatusMap>({});
+  const [toolImportedPlugins, setToolImportedPlugins] = useState<CloudImportedPlugin[]>([]);
+  const composerShellRef = useRef<HTMLDivElement>(null);
+  const hydratedKeyRef = useRef<string | null>(null);
+  const attachmentsRef = useRef<ComposerAttachment[]>([]);
+  attachmentsRef.current = attachments;
+  const opencodeClient = useMemo(
+    () => createClient(props.opencodeBaseUrl, undefined, { token: props.openworkToken, mode: "openwork" }),
+    [props.opencodeBaseUrl, props.openworkToken],
+  );
+
+  const snapshotQueryKey = useMemo(
+    () => ["react-session-snapshot", props.workspaceId, props.sessionId],
+    [props.workspaceId, props.sessionId],
+  );
+  const transcriptQueryKey = useMemo(
+    () => reactTranscriptKey(props.workspaceId, props.sessionId),
+    [props.workspaceId, props.sessionId],
+  );
+  const statusQueryKey = useMemo(
+    () => reactStatusKey(props.workspaceId, props.sessionId),
+    [props.workspaceId, props.sessionId],
+  );
+  const snapshotQuery = useQuery<OpenworkSessionSnapshot>({
+    queryKey: snapshotQueryKey,
+    queryFn: async () => (await props.client.getSessionSnapshot(props.workspaceId, props.sessionId, { limit: 140 })).item,
+    staleTime: 500,
+  });
+
+  const currentSnapshot = snapshotQuery.data?.session.id === props.sessionId ? snapshotQuery.data : null;
+  const transcriptState = useSharedQueryState<UIMessage[]>(transcriptQueryKey, EMPTY_TRANSCRIPT);
+  const statusState = useSharedQueryState(statusQueryKey, currentSnapshot?.status ?? IDLE_STATUS);
+
+  useEffect(() => {
+    if (!currentSnapshot) return;
+    setRendered({ sessionId: props.sessionId, snapshot: currentSnapshot });
+  }, [props.sessionId, currentSnapshot]);
+
+  useEffect(() => {
+    hydratedKeyRef.current = null;
+    setError(null);
+    setSending(false);
+    setShowDelayedLoading(false);
+    setAwaitingAssistantBaseline(null);
+    // Clear draft + attachments + mentions on session change so typed text
+    // doesn't bleed across sessions (and across workspaces). The sessionId
+    // effectively changes when the workspace changes too because the route
+    // navigates to the remembered session id for that workspace.
+    setDraft("");
+    setAttachments((current) => {
+      current.forEach(revokeAttachmentPreview);
+      return [];
+    });
+    setMentions({});
+    setPasteParts([]);
+    setNotice(null);
+  }, [props.sessionId]);
+
+  useEffect(() => {
+    return () => {
+      attachmentsRef.current.forEach(revokeAttachmentPreview);
+    };
+  }, []);
+
+  useEffect(() => {
+    if (!notice) return;
+    const id = window.setTimeout(() => setNotice(null), 2400);
+    return () => window.clearTimeout(id);
+  }, [notice]);
+
+  // Publish a composer inspector slice so external drivers can read draft
+  // state, attachments, mentions, and sending status from the running app.
+  useEffect(() => {
+    const dispose = publishInspectorSlice("composer", () => ({
+      workspaceId: props.workspaceId,
+      sessionId: props.sessionId,
+      draft,
+      draftLength: draft.length,
+      attachments: attachments.map((attachment) => ({
+        id: attachment.id,
+        name: attachment.name,
+        mimeType: attachment.mimeType,
+        size: attachment.size,
+        kind: attachment.kind,
+      })),
+      mentions,
+      pasteParts: pasteParts.map((part) => ({
+        id: part.id,
+        label: part.label,
+        lines: part.lines,
+      })),
+      sending,
+      error,
+      hasNotice: Boolean(notice),
+    }));
+    return dispose;
+  }, [
+    attachments,
+    draft,
+    error,
+    mentions,
+    notice,
+    pasteParts,
+    props.sessionId,
+    props.workspaceId,
+    sending,
+  ]);
+
+  useEffect(() => {
+    recordInspectorEvent("session.mounted", {
+      workspaceId: props.workspaceId,
+      sessionId: props.sessionId,
+    });
+  }, [props.sessionId, props.workspaceId]);
+
+  useEffect(() => {
+    if (!currentSnapshot) return;
+    seedSessionState(props.workspaceId, currentSnapshot);
+  }, [currentSnapshot, props.workspaceId]);
+
+  useEffect(() => {
+    if (!currentSnapshot) return;
+    const key = `${props.sessionId}:${currentSnapshot.session.time?.updated ?? currentSnapshot.session.time?.created ?? 0}:${currentSnapshot.messages.length}`;
+    if (hydratedKeyRef.current === key) return;
+    hydratedKeyRef.current = key;
+    seedSessionState(props.workspaceId, currentSnapshot);
+  }, [props.sessionId, currentSnapshot, props.workspaceId]);
+
+  const snapshot = resolveRenderedSessionSnapshot({
+    sessionId: props.sessionId,
+    currentSnapshot,
+    cachedRendered: rendered,
+  });
+  const liveStatus = statusState ?? snapshot?.status ?? IDLE_STATUS;
+  const chatStreaming = sending || liveStatus.type === "busy" || liveStatus.type === "retry";
+  const renderedMessages = useMemo(
+    () => deriveRenderedSessionMessages({ transcriptState, snapshot, includeLiveOnlyMessages: chatStreaming }),
+    [chatStreaming, snapshot, transcriptState],
+  );
+  const pendingSessionLoad = !snapshot && snapshotQuery.isLoading && renderedMessages.length === 0;
+  const assistantOutputAfterAwaitStart = useMemo(() => {
+    if (awaitingAssistantBaseline === null) return false;
+    return renderedMessages
+      .slice(awaitingAssistantBaseline)
+      .some(messageHasVisibleAssistantOutput);
+  }, [awaitingAssistantBaseline, renderedMessages]);
+  const showAssistantWaitState = awaitingAssistantBaseline !== null && !assistantOutputAfterAwaitStart;
+  useReactRenderWatchdog("SessionSurface", {
+    sessionId: props.sessionId,
+    workspaceId: props.workspaceId,
+    messageCount: renderedMessages.length,
+    liveStatus: liveStatus.type,
+    sending,
+    pendingSessionLoad,
+    showAssistantWaitState,
+    hasSnapshot: Boolean(snapshot),
+  });
+
+  useEffect(() => {
+    if (!pendingSessionLoad) {
+      setShowDelayedLoading(false);
+      return;
+    }
+    const id = window.setTimeout(() => setShowDelayedLoading(true), 2000);
+    return () => window.clearTimeout(id);
+  }, [pendingSessionLoad]);
+
+  useEffect(() => {
+    if (awaitingAssistantBaseline === null) return;
+    if (assistantOutputAfterAwaitStart) {
+      setAwaitingAssistantBaseline(null);
+      return;
+    }
+    if (sending || liveStatus.type !== "idle" || renderedMessages.length <= awaitingAssistantBaseline) return;
+    const id = window.setTimeout(() => setAwaitingAssistantBaseline(null), 1200);
+    return () => window.clearTimeout(id);
+  }, [assistantOutputAfterAwaitStart, awaitingAssistantBaseline, liveStatus.type, renderedMessages.length, sending]);
+
+  const model = deriveSessionRenderModel({
+    intendedSessionId: props.sessionId,
+    renderedSessionId: renderedMessages.length > 0 || snapshot ? props.sessionId : null,
+    hasSnapshot: Boolean(snapshot) || renderedMessages.length > 0,
+    isFetching: snapshotQuery.isFetching,
+    isError: snapshotQuery.isError || Boolean(error),
+  });
+
+  const buildDraft = useCallback((text: string, nextAttachments: ComposerAttachment[]): ComposerDraft => {
+    const trimmed = text.trim();
+    const slashMatch = trimmed.match(/^\/([^\s]+)\s*(.*)$/);
+    const parts: ComposerPart[] = text.split(/(\[pasted text [^\]]+\]|@[^\s@]+)/).flatMap((segment) => {
+      if (!segment) return [] as ComposerDraft["parts"];
+      const pasteMatch = segment.match(/^\[pasted text (.+)\]$/);
+      if (pasteMatch) {
+        const target = pasteParts.find((item) => item.label === pasteMatch[1]);
+        if (target) {
+          return [{ type: "paste", id: target.id, label: target.label, text: target.text, lines: target.lines }];
+        }
+      }
+      if (segment.startsWith("@")) {
+        const value = segment.slice(1);
+        const kind = mentions[value];
+        if (kind === "agent") return [{ type: "agent", name: value } satisfies ComposerDraft["parts"][number]];
+        if (kind === "file") return [{ type: "file", path: value, label: value } satisfies ComposerDraft["parts"][number]];
+      }
+      return [{ type: "text", text: segment } satisfies ComposerDraft["parts"][number]];
+    });
+    // Expand paste placeholders in resolvedText so the model receives
+    // the actual pasted content instead of "[pasted text <label>]".
+    let resolved = text;
+    for (const part of pasteParts) {
+      resolved = resolved.replace(`[pasted text ${part.label}]`, part.text);
+    }
+    return {
+      mode: "prompt",
+      parts,
+      attachments: nextAttachments,
+      text,
+      resolvedText: resolved,
+      command: slashMatch ? { name: slashMatch[1] ?? "", arguments: slashMatch[2] ?? "" } : undefined,
+    };
+  }, [mentions, pasteParts]);
+
+  const handleCopyTranscript = async () => {
+    try {
+      await navigator.clipboard.writeText(transcriptToText(renderedMessages));
+    } catch (nextError) {
+      setError({ message: nextError instanceof Error ? nextError.message : "Failed to copy transcript." });
+    }
+  };
+
+  const handleSend = useCallback(async () => {
+    const text = draft.trim();
+    if (!text && attachments.length === 0) return;
+    // Intentionally allow sending while the assistant is still streaming.
+    // OpenCode accepts follow-up user turns mid-run and queues them; if the
+    // backend can't accept the follow-up it'll surface an error via the
+    // catch below. This restores the "append a prompt while it's still
+    // talking" behavior that the Solid composer had.
+    setError(null);
+    setSending(true);
+    setAwaitingAssistantBaseline(renderedMessages.length);
+    try {
+      const nextDraft = buildDraft(text, attachments);
+      await props.onSendDraft(nextDraft);
+      setDraft("");
+      attachments.forEach(revokeAttachmentPreview);
+      setAttachments([]);
+      props.onDraftChange(buildDraft("", []));
+      setSending(false);
+    } catch (nextError) {
+      const parsed = parseSessionError(nextError);
+      setError(parsed);
+      setDraft("");
+      setAwaitingAssistantBaseline(null);
+      setSending(false);
+    }
+  }, [attachments, buildDraft, draft, props.onDraftChange, props.onSendDraft, renderedMessages.length]);
+
+  const handleAbort = useCallback(async () => {
+    if (!chatStreaming) return;
+    setError(null);
+    try {
+      await abortSessionSafe(opencodeClient, props.sessionId);
+      await snapshotQuery.refetch();
+    } catch (nextError) {
+      setError({ message: nextError instanceof Error ? nextError.message : "Failed to stop run." });
+    }
+  }, [chatStreaming, opencodeClient, props.sessionId, snapshotQuery.refetch]);
+
+  useEffect(() => {
+    if (liveStatus.type === "idle") {
+      setSending(false);
+    }
+  }, [liveStatus.type]);
+
+  useEffect(() => {
+    props.onDraftChange(buildDraft(draft, attachments));
+  }, [attachments, buildDraft, draft, props.onDraftChange]);
+
+  const handleAttachFiles = (files: File[]) => {
+    if (!props.attachmentsEnabled) {
+      setNotice({ title: props.attachmentsDisabledReason ?? "Attachments are unavailable.", tone: "warning" });
+      return;
+    }
+    const oversized = files.filter((file) => file.size > 25 * 1024 * 1024);
+    const accepted = files.filter((file) => file.size <= 25 * 1024 * 1024);
+    if (oversized.length) {
+      setNotice({
+        title: oversized.length === 1 ? `${oversized[0]?.name ?? "File"} is too large` : `${oversized.length} files are too large`,
+        description: "Files over 25 MB were skipped.",
+        tone: "warning",
+      });
+    }
+    if (!accepted.length) return;
+    const next = accepted.map((file) => ({
+      id: `${file.name}-${file.lastModified}-${Math.random().toString(36).slice(2)}`,
+      name: file.name,
+      mimeType: file.type || "application/octet-stream",
+      size: file.size,
+      kind: file.type.startsWith("image/") ? "image" as const : "file" as const,
+      file,
+      previewUrl: file.type.startsWith("image/") ? URL.createObjectURL(file) : undefined,
+    }));
+    setAttachments((current) => [...current, ...next]);
+    setNotice({
+      title: next.length === 1 ? `Attached ${next[0]?.name ?? "file"}` : `Attached ${next.length} files`,
+      tone: "success",
+    });
+  };
+
+  const handleRemoveAttachment = (id: string) => {
+    setAttachments((current) => {
+      const target = current.find((item) => item.id === id);
+      if (target?.previewUrl) {
+        URL.revokeObjectURL(target.previewUrl);
+      }
+      return current.filter((item) => item.id !== id);
+    });
+  };
+
+  const handleInsertMention = (kind: "agent" | "file", value: string) => {
+    setDraft((current) => current.replace(/@([^\s@]*)$/, `@${value} `));
+    setMentions((current) => ({ ...current, [value]: kind }));
+  };
+
+  const handlePasteText = (text: string) => {
+    const id = `paste-${Math.random().toString(36).slice(2)}`;
+    const label = `${id.slice(-4)} · ${text.split(/\r?\n/).length} lines`;
+    setPasteParts((current) => [...current, { id, label, text, lines: text.split(/\r?\n/).length }]);
+    setDraft((current) => `${current}[pasted text ${label}]`);
+  };
+
+  const handleRevealPastedText = (id: string) => {
+    const part = pasteParts.find((item) => item.id === id);
+    if (!part) return;
+    setNotice({
+      title: `Pasted text · ${part.label}`,
+      description: part.text.slice(0, 800),
+      tone: "info",
+    });
+  };
+
+  const handleRemovePastedText = (id: string) => {
+    setPasteParts((current) => {
+      const target = current.find((item) => item.id === id);
+      if (!target) return current;
+      setDraft((draftValue) => draftValue.replace(`[pasted text ${target.label}]`, ""));
+      return current.filter((item) => item.id !== id);
+    });
+  };
+
+  const handleUnsupportedFileLinks = (links: string[]) => {
+    if (!links.length) return;
+    setDraft((current) => `${current}${current && !current.endsWith("\n") ? "\n" : ""}${links.join("\n")}`);
+  };
+
+  const typeComposerText = useCallback(async (text: string) => {
+    window.dispatchEvent(new Event("openwork:focusPrompt"));
+    setDraft(text);
+    await waitForControl(40);
+  }, []);
+
+  const composerSetTextControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "composer.set_text",
+    label: "Type into the composer",
+    description: "Replace the current session draft and type the supplied text visibly.",
+    sideEffect: "none",
+    requiresArgs: true,
+    args: [{ name: "text", type: "string", required: true, description: "Prompt text to place in the composer." }],
+    previewArgs: { text: DEFAULT_COMPOSER_CONTROL_TEXT },
+    targetRef: composerShellRef,
+    execute: async (args, helpers) => {
+      const text = controlTextArgument(args);
+      helpers.setNarration(`Typing ${text.length.toLocaleString()} characters into the composer…`);
+      await typeComposerText(text);
+      props.onDraftChange(buildDraft(text, attachments));
+      return { draftLength: text.length };
+    },
+  }), [attachments, buildDraft, props.onDraftChange, typeComposerText]);
+  useControlAction(composerSetTextControlAction);
+
+  const composerSendControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "composer.send",
+    label: "Send the composer prompt",
+    description: "Send the currently visible composer draft to the active session.",
+    sideEffect: "mutation",
+    disabled: (!draft.trim() && attachments.length === 0) || model.transitionState !== "idle",
+    targetRef: composerShellRef,
+    execute: async () => {
+      await handleSend();
+      return true;
+    },
+  }), [attachments.length, draft, handleSend, model.transitionState]);
+  useControlAction(composerSendControlAction);
+
+  const composerStopControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "composer.stop",
+    label: "Stop the current run",
+    description: "Stop the current streaming session run.",
+    sideEffect: "mutation",
+    disabled: !chatStreaming,
+    targetRef: composerShellRef,
+    execute: async () => {
+      await handleAbort();
+      return true;
+    },
+  }), [chatStreaming, handleAbort]);
+  useControlAction(composerStopControlAction);
+
+  const listSkills = async (): Promise<SkillCard[]> => {
+    const response = await props.client.listSkills(props.workspaceId, { includeGlobal: true });
+    const next = (response.items ?? []).map((skill) => ({
+      name: skill.name,
+      path: skill.path,
+      description: skill.description,
+      trigger: skill.trigger,
+    } satisfies SkillCard));
+    setToolSkills(next);
+    return next;
+  };
+
+  const listMcp = async (): Promise<{ servers: McpServerEntry[]; statuses: McpStatusMap; status: string | null }> => {
+    const response = await props.client.listMcp(props.workspaceId);
+    const servers = (response.items ?? []).map((entry) => ({
+      name: entry.name,
+      config: entry.config as McpServerEntry["config"],
+    } satisfies McpServerEntry));
+
+    let statuses: McpStatusMap = {};
+    try {
+      if (props.workspaceRoot.trim()) {
+        statuses = unwrap(await opencodeClient.mcp.status({ directory: props.workspaceRoot.trim() })) as McpStatusMap;
+      }
+    } catch {
+      statuses = {};
+    }
+
+    const status = servers.length ? null : "No MCP servers loaded.";
+    setToolMcpServers(servers);
+    setToolMcpStatuses(statuses);
+    setToolMcpStatus(status);
+    return { servers, statuses, status };
+  };
+
+  const listImportedPlugins = async (): Promise<CloudImportedPlugin[]> => {
+    const response = await props.client.getConfig(props.workspaceId);
+    const plugins = Object.values(readWorkspaceCloudImports(response.openwork).plugins)
+      .sort((left, right) => left.name.localeCompare(right.name));
+    setToolImportedPlugins(plugins);
+    return plugins;
+  };
+
+  const handleUploadInboxFiles = async (files: File[], options?: { notify?: boolean }) => {
+    const input = files.filter(Boolean);
+    if (!input.length) return;
+    try {
+      const results = await Promise.all(input.map((file) => props.client.uploadInbox(props.workspaceId, file)));
+      if (options?.notify !== false) {
+        const summary = results.map((item) => item.path.split("/").filter(Boolean).slice(-1)[0] ?? item.path).join(", ");
+        setNotice({
+          title: input.length === 1 ? "Uploaded to the shared folder." : `Uploaded ${input.length} files to the shared folder.`,
+          description: summary || undefined,
+          tone: "success",
+        });
+      }
+      return results;
+    } catch (nextError) {
+      setNotice({
+        title: nextError instanceof Error ? nextError.message : "Shared folder upload failed",
+        tone: "warning",
+      });
+      throw nextError;
+    }
+  };
+
+  const scrollRef = useRef<HTMLDivElement>(null);
+  const contentRef = useRef<HTMLDivElement>(null);
+  const sessionScroll = useSessionScrollController({
+    selectedSessionId: props.sessionId,
+    renderedMessages,
+    containerRef: scrollRef,
+    contentRef,
+  });
+
+  const sessionScrollTopControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.scroll_top",
+    label: "Go to the top of the session",
+    description: "Scroll the visible session transcript to the first messages.",
+    sideEffect: "none",
+    execute: () => {
+      const container = scrollRef.current;
+      if (!container) return { ok: false, error: "Session transcript is not mounted" };
+      container.scrollTo({ top: 0, behavior: "smooth" });
+      return { ok: true, position: "top" };
+    },
+  }), []);
+  useControlAction(sessionScrollTopControlAction);
+
+  const sessionScrollBottomControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.scroll_bottom",
+    label: "Go to the bottom of the session",
+    description: "Scroll the visible session transcript to the newest messages and composer area.",
+    sideEffect: "none",
+    execute: () => {
+      sessionScroll.jumpToLatest("smooth");
+      return { ok: true, position: "bottom" };
+    },
+  }), [sessionScroll.jumpToLatest]);
+  useControlAction(sessionScrollBottomControlAction);
+
+  const sessionLatestMessageControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.latest_message",
+    label: "Read the latest session message",
+    description: "Return the latest visible message in the current session transcript.",
+    sideEffect: "none",
+    execute: () => {
+      const message = renderedMessages[renderedMessages.length - 1];
+      if (!message) return { ok: false, error: "No messages are visible in this session" };
+      return {
+        ok: true,
+        sessionId: props.sessionId,
+        index: renderedMessages.length - 1,
+        role: message.role,
+        text: messageToReadableText(message),
+      };
+    },
+  }), [props.sessionId, renderedMessages]);
+  useControlAction(sessionLatestMessageControlAction);
+
+  const sessionReadTranscriptControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "session.read_transcript",
+    label: "Read the current session transcript",
+    description: "Return the last messages from the current session transcript as readable text, including the session ID, title, and message count.",
+    sideEffect: "none",
+    args: [{ name: "count", type: "number", required: false, description: "Number of recent messages to return, from 1 to 30. Defaults to 10." }],
+    execute: (args) => {
+      const count = typeof args === "object" && args !== null && "count" in args && typeof (args as { count?: unknown }).count === "number"
+        ? Math.min(Math.max(1, (args as { count: number }).count), 30)
+        : 10;
+      const total = renderedMessages.length;
+      const slice = renderedMessages.slice(-count);
+      if (!slice.length) return { ok: false, error: "No messages in this session" };
+      return {
+        ok: true,
+        sessionId: props.sessionId,
+        messageCount: total,
+        returned: slice.length,
+        messages: slice.map((message, index) => ({
+          index: total - slice.length + index,
+          role: message.role,
+          text: messageToReadableText(message),
+        })),
+      };
+    },
+  }), [props.sessionId, renderedMessages]);
+  useControlAction(sessionReadTranscriptControlAction);
+
+  return (
+    <DevProfiler id="SessionSurface">
+    <div className="flex h-full min-h-0 flex-col">
+      {model.transitionState === "switching" && showDelayedLoading ? (
+        <div className="flex justify-center px-6 pt-4">
+          <div className="rounded-full border border-dls-border bg-dls-hover/80 px-3 py-1 text-xs text-dls-secondary">
+            {model.renderSource === "cache" ? "Switching session from cache..." : "Switching session..."}
+          </div>
+        </div>
+      ) : null}
+
+      <div className="relative min-h-0 flex-1">
+        <div
+          ref={scrollRef}
+          onWheel={(event) => {
+            sessionScroll.markScrollGesture(event.target);
+          }}
+          onTouchStart={(event) => {
+            sessionScroll.markScrollGesture(event.target);
+          }}
+          onTouchMove={(event) => {
+            sessionScroll.markScrollGesture(event.target);
+          }}
+          onPointerDown={(event) => {
+            if (event.target !== event.currentTarget) return;
+            sessionScroll.markScrollGesture(event.currentTarget);
+          }}
+          onScroll={sessionScroll.handleScroll}
+          className="absolute inset-0 overflow-x-hidden overflow-y-auto overscroll-y-contain px-3 py-4 sm:px-5"
+        >
+          {/* Chat column: tighter than the composer (800px) so messages
+               keep a comfortable reading width and don't feel "too big". */}
+          <div ref={contentRef} className="mx-auto w-full max-w-[720px]">
+            {showDelayedLoading && pendingSessionLoad ? (
+              <div className="px-6 py-16">
+                <div className="mx-auto max-w-sm rounded-3xl border border-dls-border bg-dls-hover/60 px-8 py-10 text-center">
+                  <div className="text-sm text-dls-secondary">Opening session…</div>
+                </div>
+              </div>
+            ) : (snapshotQuery.isError || error) && !snapshot && renderedMessages.length === 0 ? (
+              <div className="px-6 py-8">
+                {error ? (
+                  <SessionErrorCard
+                    error={error}
+                    onDismiss={() => setError(null)}
+                    onChangeModel={props.onChangeModel}
+                    onOpenModelPicker={props.onModelClick}
+                  />
+                ) : (
+                  <div className="mx-auto max-w-xl rounded-3xl border border-red-6/40 bg-red-3/20 px-6 py-5 text-sm text-red-11">
+                    {snapshotQuery.error instanceof Error ? snapshotQuery.error.message : "Failed to load session."}
+                  </div>
+                )}
+              </div>
+            ) : renderedMessages.length === 0 && showAssistantWaitState ? (
+              <div className="px-6 py-12">
+                <AssistantWaitingCard />
+              </div>
+            ) : renderedMessages.length === 0 && snapshot && snapshot.messages.length === 0 ? (
+              error ? (
+                <SessionErrorCard
+                  error={error}
+                  onDismiss={() => setError(null)}
+                  onChangeModel={props.onChangeModel}
+                  onOpenModelPicker={props.onModelClick}
+                />
+              ) : null
+            ) : (
+              <DevProfiler id="SessionTranscript">
+                <>
+                  <SessionTranscript
+                    messages={renderedMessages}
+                    isStreaming={chatStreaming}
+                    developerMode={props.developerMode}
+                    scrollElement={() => scrollRef.current}
+                  />
+                  {error ? (
+                    <SessionErrorCard
+                      error={error}
+                      onDismiss={() => setError(null)}
+                      onChangeModel={props.onChangeModel}
+                      onOpenModelPicker={props.onModelClick}
+                    />
+                  ) : null}
+                  {showAssistantWaitState ? <AssistantWaitingCard /> : null}
+                </>
+              </DevProfiler>
+            )}
+          </div>
+        </div>
+        {!sessionScroll.isAtBottom || sessionScroll.topClippedMessageId ? (
+          <div className="pointer-events-none absolute bottom-2 left-1/2 z-30 flex -translate-x-1/2 justify-center">
+            <div className="pointer-events-auto flex items-center gap-2 rounded-full border border-dls-border bg-dls-surface/95 p-1 shadow-[var(--dls-card-shadow)] backdrop-blur-md">
+              {sessionScroll.topClippedMessageId ? (
+                <button
+                  type="button"
+                  className="rounded-full px-3 py-1.5 text-xs text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => {
+                    sessionScroll.jumpToStartOfMessage("smooth");
+                  }}
+                >
+                  Jump to start
+                </button>
+              ) : null}
+              {!sessionScroll.isAtBottom ? (
+                <button
+                  type="button"
+                  className="rounded-full px-3 py-1.5 text-xs text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => {
+                    sessionScroll.jumpToLatest("smooth");
+                  }}
+                >
+                  Jump to latest
+                </button>
+              ) : null}
+            </div>
+          </div>
+        ) : null}
+      </div>
+
+      <div ref={composerShellRef} className="shrink-0 border-t border-dls-border/70 px-0 pb-3 pt-3">
+        <DevProfiler id="SessionComposer">
+        <ReactSessionComposer
+          draft={draft}
+          mentions={mentions}
+          onDraftChange={setDraft}
+        onSend={handleSend}
+        onStop={handleAbort}
+        busy={chatStreaming}
+        disabled={model.transitionState !== "idle"}
+        statusLabel={statusLabel(snapshot ?? undefined, chatStreaming)}
+        modelLabel={props.modelLabel}
+        onModelClick={props.onModelClick}
+        attachments={attachments}
+        onAttachFiles={handleAttachFiles}
+        onRemoveAttachment={handleRemoveAttachment}
+        attachmentsEnabled={props.attachmentsEnabled}
+        attachmentsDisabledReason={props.attachmentsDisabledReason}
+        modelVariantLabel={props.modelVariantLabel}
+        modelVariant={props.modelVariant}
+        modelBehaviorOptions={props.modelBehaviorOptions}
+        onModelVariantChange={props.onModelVariantChange}
+        agentLabel={props.agentLabel}
+        selectedAgent={props.selectedAgent}
+        listAgents={props.listAgents}
+        onSelectAgent={props.onSelectAgent}
+        listCommands={props.listCommands}
+        listSkills={listSkills}
+        skills={toolSkills}
+        listMcp={listMcp}
+        mcpServers={toolMcpServers}
+        mcpStatus={toolMcpStatus}
+        mcpStatuses={toolMcpStatuses}
+        listImportedPlugins={listImportedPlugins}
+        importedPlugins={toolImportedPlugins}
+        onOpenSettingsSection={props.onOpenSettingsSection}
+        recentFiles={props.recentFiles}
+        searchFiles={props.searchFiles}
+        onInsertMention={handleInsertMention}
+        notice={notice}
+        onNotice={setNotice}
+        onPasteText={handlePasteText}
+        onUnsupportedFileLinks={handleUnsupportedFileLinks}
+        pastedText={pasteParts}
+        onRevealPastedText={handleRevealPastedText}
+        onRemovePastedText={handleRemovePastedText}
+        isRemoteWorkspace={props.isRemoteWorkspace}
+          isSandboxWorkspace={props.isSandboxWorkspace}
+          onUploadInboxFiles={props.onUploadInboxFiles ?? handleUploadInboxFiles}
+        />
+        </DevProfiler>
+      </div>
+      {/* Error display moved inline into the session conversation area */}
+      {props.developerMode ? <SessionDebugPanel model={model} snapshot={snapshot} /> : null}
+    </div>
+    </DevProfiler>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/surface/text-highlights.ts b/apps/app/src/react-app/domains/session/surface/text-highlights.ts
new file mode 100644
index 0000000000..170f45f033
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/text-highlights.ts
@@ -0,0 +1,75 @@
+const SEARCH_HIGHLIGHT_MARK_ATTR = "data-search-highlight";
+
+export function clearTextHighlights(root: HTMLElement) {
+  const marks = root.querySelectorAll(`mark[${SEARCH_HIGHLIGHT_MARK_ATTR}="true"]`);
+  marks.forEach((mark) => {
+    const parent = mark.parentNode;
+    if (!parent) return;
+    parent.replaceChild(document.createTextNode(mark.textContent ?? ""), mark);
+  });
+  root.normalize();
+}
+
+export function applyTextHighlights(root: HTMLElement, query: string) {
+  const needle = query.trim().toLowerCase();
+  // Fast path: if search is inactive, avoid walking large message DOM trees.
+  // We only need to clear existing marks if a previous search actually added
+  // some.
+  if (!needle) {
+    if (root.querySelector(`mark[${SEARCH_HIGHLIGHT_MARK_ATTR}="true"]`)) {
+      clearTextHighlights(root);
+    }
+    return;
+  }
+
+  clearTextHighlights(root);
+
+  const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT, {
+    acceptNode(node) {
+      const value = node.nodeValue ?? "";
+      if (!value.trim()) return NodeFilter.FILTER_REJECT;
+      const parent = node.parentElement;
+      if (!parent) return NodeFilter.FILTER_REJECT;
+      if (parent.closest("pre, code")) return NodeFilter.FILTER_REJECT;
+      if (parent.tagName === "SCRIPT" || parent.tagName === "STYLE") return NodeFilter.FILTER_REJECT;
+      return value.toLowerCase().includes(needle)
+        ? NodeFilter.FILTER_ACCEPT
+        : NodeFilter.FILTER_REJECT;
+    },
+  });
+
+  const nodes: Text[] = [];
+  let current = walker.nextNode();
+  while (current) {
+    nodes.push(current as Text);
+    current = walker.nextNode();
+  }
+
+  nodes.forEach((node) => {
+    const text = node.nodeValue ?? "";
+    const lower = text.toLowerCase();
+    let searchIndex = 0;
+    const fragment = document.createDocumentFragment();
+
+    while (searchIndex < text.length) {
+      const matchIndex = lower.indexOf(needle, searchIndex);
+      if (matchIndex === -1) {
+        fragment.appendChild(document.createTextNode(text.slice(searchIndex)));
+        break;
+      }
+
+      if (matchIndex > searchIndex) {
+        fragment.appendChild(document.createTextNode(text.slice(searchIndex, matchIndex)));
+      }
+
+      const mark = document.createElement("mark");
+      mark.setAttribute(SEARCH_HIGHLIGHT_MARK_ATTR, "true");
+      mark.className = "rounded px-0.5 bg-amber-4/70 text-current";
+      mark.textContent = text.slice(matchIndex, matchIndex + needle.length);
+      fragment.appendChild(mark);
+      searchIndex = matchIndex + needle.length;
+    }
+
+    node.parentNode?.replaceChild(fragment, node);
+  });
+}
diff --git a/apps/app/src/react-app/domains/session/surface/tool-call.tsx b/apps/app/src/react-app/domains/session/surface/tool-call.tsx
new file mode 100644
index 0000000000..bdbb2573d1
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/surface/tool-call.tsx
@@ -0,0 +1,197 @@
+/** @jsxImportSource react */
+import { useMemo, useState } from "react";
+import type { DynamicToolUIPart } from "ai";
+
+import { safeStringify, summarizeStep } from "../../../../app/utils";
+
+function normalizeToolText(value: unknown) {
+  if (typeof value !== "string") return "";
+  return value.replace(/(?:\r?\n\s*)+$/, "");
+}
+
+function hasStructuredValue(value: unknown) {
+  if (value === undefined || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") return Object.keys(value as Record<string, unknown>).length > 0;
+  return true;
+}
+
+function formatStructuredValue(value: unknown) {
+  if (value === undefined || value === null) return "";
+  if (typeof value === "string") return value.trim();
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+function diffLineClass(line: string) {
+  if (line.startsWith("+")) return "text-green-11 bg-green-1/40";
+  if (line.startsWith("-")) return "text-red-11 bg-red-1/40";
+  if (line.startsWith("@@")) return "text-blue-11 bg-blue-1/30";
+  return "text-gray-12";
+}
+
+function extractDiff(output: unknown) {
+  if (typeof output !== "string") return null;
+  if (output.includes("@@") || output.includes("+++ ") || output.includes("--- ")) {
+    return output;
+  }
+  return null;
+}
+
+async function copyText(text: string) {
+  await navigator.clipboard.writeText(text);
+}
+
+export function ToolCallView(props: { part: DynamicToolUIPart; developerMode: boolean }) {
+  const [expanded, setExpanded] = useState(false);
+  const summary = useMemo(
+    () =>
+      summarizeStep({
+        id: props.part.toolCallId,
+        type: "tool",
+        sessionID: "",
+        messageID: "",
+        tool: props.part.toolName,
+        state: {
+          input: props.part.input,
+          output: props.part.state === "output-available" ? props.part.output : undefined,
+          error: props.part.state === "output-error" ? props.part.errorText : undefined,
+          status:
+            props.part.state === "output-available"
+              ? "completed"
+              : props.part.state === "output-error"
+                ? "error"
+                : "running",
+        },
+      } as any),
+    [props.part],
+  );
+
+  const title = summary.title?.trim() || props.part.toolName || "Tool";
+  const subtitle = summary.detail?.trim() || "";
+  const status =
+    props.part.state === "output-available"
+      ? "completed"
+      : props.part.state === "output-error"
+        ? "error"
+        : "running";
+  const input = props.part.input;
+  const output = props.part.state === "output-available" ? props.part.output : undefined;
+  const error = props.part.state === "output-error" ? props.part.errorText : "";
+  const diff = extractDiff(output);
+  const diffLines = diff ? normalizeToolText(diff).split("\n") : [];
+  const expandable = hasStructuredValue(input) || hasStructuredValue(output) || Boolean(diff) || Boolean(error);
+
+  return (
+    <div className="grid gap-3 text-[14px] text-gray-9">
+      <button
+        type="button"
+        className="w-full text-left transition-colors hover:text-dls-text disabled:cursor-default"
+        aria-expanded={expandable ? expanded : undefined}
+        disabled={!expandable}
+        onClick={() => {
+          if (!expandable) return;
+          setExpanded((value) => !value);
+        }}
+      >
+        <div className="flex items-start justify-between gap-3">
+          <div className="space-y-1">
+            <div className="text-xs font-medium text-gray-12">{title}</div>
+            <div className="text-[11px] text-gray-11">{props.part.toolName}</div>
+            {subtitle ? <div className="text-xs text-gray-11">{subtitle}</div> : null}
+          </div>
+          <div
+            className={`rounded-full px-2 py-0.5 text-[11px] font-medium ${
+              status === "completed"
+                ? "bg-green-3/15 text-green-12"
+                : status === "running"
+                  ? "bg-blue-3/15 text-blue-12"
+                  : status === "error"
+                    ? "bg-red-3/15 text-red-12"
+                    : "bg-gray-2/10 text-gray-12"
+            }`}
+          >
+            {status}
+          </div>
+        </div>
+      </button>
+
+      {expanded ? (
+        <div className="space-y-3 pl-[22px]">
+          {Boolean(diff) ? (
+            <div className="rounded-lg border bg-gray-2/30 p-2">
+              <div className="mb-2 flex items-center justify-between gap-2">
+                <div className="text-[11px] font-medium text-gray-11">Diff</div>
+                <button
+                  type="button"
+                  className="rounded-full border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => void copyText(diff ?? "")}
+                >
+                  Copy
+                </button>
+              </div>
+              <div className="mt-2 grid gap-1 overflow-hidden rounded-md">
+                {diffLines.map((line, index) => (
+                  <div
+                    key={`${props.part.toolCallId}-diff-${index}`}
+                    className={`whitespace-pre-wrap break-words px-2 py-0.5 font-mono text-[11px] leading-relaxed ${diffLineClass(line)}`}
+                  >
+                    {line || " "}
+                  </div>
+                ))}
+              </div>
+            </div>
+          ) : null}
+
+          {hasStructuredValue(input) ? (
+            <div>
+              <div className="mb-1 flex items-center justify-between gap-2">
+                <div className="text-[11px] font-medium uppercase tracking-[0.12em] text-gray-8">Tool request</div>
+                <button
+                  type="button"
+                  className="rounded-full border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => void copyText(formatStructuredValue(input))}
+                >
+                  Copy
+                </button>
+              </div>
+              <pre className="overflow-x-auto rounded-[16px] border border-dls-border/70 bg-dls-surface px-4 py-3 text-[12px] leading-6 text-gray-10">
+                {formatStructuredValue(input)}
+              </pre>
+            </div>
+          ) : null}
+
+          {hasStructuredValue(output) && normalizeToolText(output) !== normalizeToolText(diff) ? (
+            <div>
+              <div className="mb-1 flex items-center justify-between gap-2">
+                <div className="text-[11px] font-medium uppercase tracking-[0.12em] text-gray-8">Tool result</div>
+                <button
+                  type="button"
+                  className="rounded-full border border-dls-border bg-dls-surface px-2 py-1 text-[11px] font-medium text-dls-text transition-colors hover:bg-dls-hover"
+                  onClick={() => void copyText(formatStructuredValue(output))}
+                >
+                  Copy
+                </button>
+              </div>
+              <pre className="overflow-x-auto rounded-[16px] border border-dls-border/70 bg-dls-surface px-4 py-3 text-[12px] leading-6 text-gray-10">
+                {formatStructuredValue(output)}
+              </pre>
+            </div>
+          ) : null}
+
+          {error ? <div className="rounded-lg bg-red-1/40 p-2 text-xs text-red-12">{error}</div> : null}
+
+          {props.developerMode && !expandable ? (
+            <pre className="overflow-x-auto rounded-[16px] border border-dls-border/70 bg-dls-surface px-4 py-3 text-[12px] leading-6 text-gray-10">
+              {safeStringify({ input, output, error, state: props.part.state })}
+            </pre>
+          ) : null}
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/sync/actions-provider.tsx b/apps/app/src/react-app/domains/session/sync/actions-provider.tsx
new file mode 100644
index 0000000000..594ac4f08f
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/actions-provider.tsx
@@ -0,0 +1,33 @@
+/** @jsxImportSource react */
+import { createContext, useContext, useSyncExternalStore, type ReactNode } from "react";
+
+import type { SessionActionsStore } from "./actions-store";
+
+const SessionActionsContext = createContext<SessionActionsStore | null>(null);
+
+type SessionActionsProviderProps = {
+  store: SessionActionsStore;
+  children: ReactNode;
+};
+
+export function SessionActionsProvider({
+  store,
+  children,
+}: SessionActionsProviderProps) {
+  return (
+    <SessionActionsContext.Provider value={store}>
+      {children}
+    </SessionActionsContext.Provider>
+  );
+}
+
+export function useSessionActions(): SessionActionsStore {
+  const context = useContext(SessionActionsContext);
+  if (!context) {
+    throw new Error("useSessionActions must be used within a SessionActionsProvider");
+  }
+
+  useSyncExternalStore(context.subscribe, context.getSnapshot, context.getSnapshot);
+
+  return context;
+}
diff --git a/apps/app/src/react-app/domains/session/sync/actions-store.ts b/apps/app/src/react-app/domains/session/sync/actions-store.ts
new file mode 100644
index 0000000000..bb6afc713d
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/actions-store.ts
@@ -0,0 +1,902 @@
+import type {
+  Agent,
+  AgentPartInput,
+  FilePartInput,
+  Session,
+  SubtaskPartInput,
+  TextPartInput,
+} from "@opencode-ai/sdk/v2/client";
+
+import { t } from "../../../../i18n";
+import { unwrap } from "../../../../app/lib/opencode";
+import {
+  abortSession as abortSessionTyped,
+  abortSessionSafe,
+  compactSession as compactSessionTyped,
+  listCommands as listCommandsTyped,
+  revertSession,
+  shellInSession,
+  unrevertSession,
+} from "../../../../app/lib/opencode-session";
+import { finishPerf, perfNow, recordPerfLog } from "../../../../app/lib/perf-log";
+import { toSessionTransportDirectory } from "../../../../app/lib/session-scope";
+import type {
+  Client,
+  ComposerAttachment,
+  ComposerDraft,
+  ComposerPart,
+  MessageWithParts,
+  ModelRef,
+} from "../../../../app/types";
+import { addOpencodeCacheHint, safeStringify } from "../../../../app/utils";
+import { clearSessionDraft, saveSessionDraft } from "./draft-store";
+
+type SessionModelConfig = {
+  applyPendingSessionChoice: (sessionId: string) => void;
+  setSessionModelById: (
+    updater: (current: Record<string, ModelRef>) => Record<string, ModelRef>,
+  ) => void;
+  clearSessionModelOverride: (sessionId: string) => void;
+};
+
+export type SessionActionsStore = ReturnType<typeof createSessionActionsStore>;
+
+type SessionActionsSnapshot = {
+  lastPromptSent: string;
+  sessionAgentById: Record<string, string>;
+};
+
+const FLUSH_PROMPT_EVENT = "openwork:flushPromptDraft";
+
+const fileToDataUrl = (file: File) =>
+  new Promise<string>((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onerror = () => reject(new Error(`Failed to read attachment: ${file.name}`));
+    reader.onload = () => {
+      const result = typeof reader.result === "string" ? reader.result : "";
+      resolve(result);
+    };
+    reader.readAsDataURL(file);
+  });
+
+export function createSessionActionsStore(options: {
+  client: () => Client | null;
+  baseUrl: () => string;
+  developerMode: () => boolean;
+  prompt: () => string;
+  setPrompt: (value: string) => void;
+  selectedSessionId: () => string | null;
+  selectedSession: () => Session | null;
+  sessions: () => Session[];
+  messages: () => MessageWithParts[];
+  setSessions: (value: Session[]) => void;
+  sessionStatusById: () => Record<string, string>;
+  setSessionStatusById: (value: Record<string, string>) => void;
+  setBusy: (value: boolean) => void;
+  setBusyLabel: (value: string | null) => void;
+  setBusyStartedAt: (value: number | null) => void;
+  setCreatingSession: (value: boolean) => void;
+  setError: (value: string | null) => void;
+  selectWorkspace: (workspaceId: string) => Promise<boolean> | boolean | void;
+  workspaceRootForId: (workspaceId: string) => string;
+  selectedWorkspaceId: () => string;
+  selectedWorkspaceRoot: () => string;
+  runtimeWorkspaceRoot: () => string;
+  ensureWorkspaceRuntime: (workspaceId: string) => Promise<boolean>;
+  selectSession: (id: string, options?: { skipHealthCheck?: boolean; source?: string }) => Promise<void>;
+  refreshSidebarWorkspaceSessions: (workspaceId: string) => Promise<void>;
+  abortRefreshes: () => void;
+  modelConfig: SessionModelConfig;
+  selectedSessionModel: () => ModelRef;
+  modelVariant: () => string | null;
+  sanitizeModelVariantForRef: (ref: ModelRef, value: string | null) => string | null;
+  resolveCodexReasoningEffort: (modelId: string, variant: string | null) => string | undefined;
+  messageIdFromInfo: (message: MessageWithParts) => string;
+  restorePromptFromUserMessage: (message: MessageWithParts) => void;
+  upsertLocalSession: (session: Session | null | undefined) => void;
+  readSessionByWorkspace: () => Record<string, string>;
+  writeSessionByWorkspace: (map: Record<string, string>) => void;
+  setSelectedSessionId: (value: string | null) => void;
+  locationPath: () => string;
+  navigate: (path: string, options?: { replace?: boolean }) => void;
+  renameSession: (sessionId: string, title: string) => Promise<void>;
+  appendSessionErrorTurn: (sessionId: string, message: string) => void;
+}) {
+  let snapshot: SessionActionsSnapshot = {
+    lastPromptSent: "",
+    sessionAgentById: {},
+  };
+
+  const listeners = new Set<() => void>();
+
+  const emitChange = () => {
+    for (const listener of listeners) {
+      listener();
+    }
+  };
+
+  const subscribe = (listener: () => void) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+
+  const getSnapshot = () => snapshot;
+
+  const setLastPromptSent = (value: string) => {
+    snapshot = {
+      ...snapshot,
+      lastPromptSent: value,
+    };
+    emitChange();
+  };
+
+  const setSessionAgentById = (
+    updater: (current: Record<string, string>) => Record<string, string>,
+  ) => {
+    snapshot = {
+      ...snapshot,
+      sessionAgentById: updater(snapshot.sessionAgentById),
+    };
+    emitChange();
+  };
+
+  type PartInput = TextPartInput | FilePartInput | AgentPartInput | SubtaskPartInput;
+
+  const attachmentToFilePart = async (attachment: ComposerAttachment): Promise<FilePartInput> => ({
+    type: "file",
+    url: await fileToDataUrl(attachment.file),
+    filename: attachment.name,
+    mime: attachment.mimeType,
+  });
+
+  const buildPromptParts = async (draft: ComposerDraft): Promise<PartInput[]> => {
+    const parts: PartInput[] = [];
+    const text = draft.resolvedText ?? draft.text;
+    parts.push({ type: "text", text } as TextPartInput);
+
+    const root = options.runtimeWorkspaceRoot().trim() || options.selectedWorkspaceRoot().trim();
+    const toAbsolutePath = (path: string) => {
+      const trimmed = path.trim();
+      if (!trimmed) return "";
+      if (trimmed.startsWith("/")) return trimmed;
+      if (/^[a-zA-Z]:\\/.test(trimmed)) return trimmed;
+      if (!root) return "";
+      return (root + "/" + trimmed).replace("//", "/");
+    };
+    const filenameFromPath = (path: string) => {
+      const normalized = path.replace(/\\/g, "/");
+      const segments = normalized.split("/").filter(Boolean);
+      return segments[segments.length - 1] ?? "file";
+    };
+
+    for (const part of draft.parts) {
+      if (part.type === "agent") {
+        parts.push({ type: "agent", name: part.name } as AgentPartInput);
+        continue;
+      }
+      if (part.type === "file") {
+        const absolute = toAbsolutePath(part.path);
+        if (!absolute) continue;
+        parts.push({
+          type: "file",
+          mime: "text/plain",
+          url: `file://${absolute}`,
+          filename: filenameFromPath(part.path),
+        } as FilePartInput);
+      }
+    }
+
+    parts.push(...(await Promise.all(draft.attachments.map(attachmentToFilePart))));
+    return parts;
+  };
+
+  const buildCommandFileParts = async (draft: ComposerDraft): Promise<FilePartInput[]> => {
+    const parts: FilePartInput[] = [];
+    const root = options.runtimeWorkspaceRoot().trim() || options.selectedWorkspaceRoot().trim();
+
+    const toAbsolutePath = (path: string) => {
+      const trimmed = path.trim();
+      if (!trimmed) return "";
+      if (trimmed.startsWith("/")) return trimmed;
+      if (/^[a-zA-Z]:\\/.test(trimmed)) return trimmed;
+      if (!root) return "";
+      return (root + "/" + trimmed).replace("//", "/");
+    };
+
+    const filenameFromPath = (path: string) => {
+      const normalized = path.replace(/\\/g, "/");
+      const segments = normalized.split("/").filter(Boolean);
+      return segments[segments.length - 1] ?? "file";
+    };
+
+    for (const part of draft.parts) {
+      if (part.type !== "file") continue;
+      const absolute = toAbsolutePath(part.path);
+      if (!absolute) continue;
+      parts.push({
+        type: "file",
+        mime: "text/plain",
+        url: `file://${absolute}`,
+        filename: filenameFromPath(part.path),
+      } as FilePartInput);
+    }
+
+    parts.push(...(await Promise.all(draft.attachments.map(attachmentToFilePart))));
+    return parts;
+  };
+
+  const describeProviderError = (error: unknown, fallback: string) => {
+    const readString = (value: unknown, max = 700) => {
+      if (typeof value !== "string") return null;
+      const trimmed = value.trim();
+      if (!trimmed) return null;
+      if (trimmed.length <= max) return trimmed;
+      return `${trimmed.slice(0, Math.max(0, max - 3))}...`;
+    };
+
+    const records: Record<string, unknown>[] = [];
+    const root = error && typeof error === "object" ? (error as Record<string, unknown>) : null;
+    if (root) {
+      records.push(root);
+      if (root.data && typeof root.data === "object") records.push(root.data as Record<string, unknown>);
+      if (root.cause && typeof root.cause === "object") {
+        const cause = root.cause as Record<string, unknown>;
+        records.push(cause);
+        if (cause.data && typeof cause.data === "object") records.push(cause.data as Record<string, unknown>);
+      }
+    }
+
+    const firstString = (keys: string[]) => {
+      for (const record of records) {
+        for (const key of keys) {
+          const value = readString(record[key]);
+          if (value) return value;
+        }
+      }
+      return null;
+    };
+
+    const firstNumber = (keys: string[]) => {
+      for (const record of records) {
+        for (const key of keys) {
+          const value = record[key];
+          if (typeof value === "number" && Number.isFinite(value)) return value;
+        }
+      }
+      return null;
+    };
+
+    const status = firstNumber(["statusCode", "status"]);
+    const provider = firstString(["providerID", "providerId", "provider"]);
+    const code = firstString(["code", "errorCode"]);
+    const response = firstString(["responseBody", "body", "response"]);
+    const raw =
+      (error instanceof Error ? readString(error.message) : null) ||
+      firstString(["message", "detail", "reason", "error"]) ||
+      (typeof error === "string" ? readString(error) : null);
+
+    const generic = raw && /^unknown\s+error$/i.test(raw);
+    const heading = (() => {
+      if (status === 401 || status === 403) return t("app.error_auth_failed");
+      if (status === 429) return t("app.error_rate_limit");
+      if (provider) return `Provider error (${provider})`;
+      return fallback;
+    })();
+
+    const lines = [heading];
+    if (raw && !generic && raw !== heading) lines.push(raw);
+    if (status && !heading.includes(String(status))) lines.push(`Status: ${status}`);
+    if (provider && !heading.includes(provider)) lines.push(`Provider: ${provider}`);
+    if (code) lines.push(`Code: ${code}`);
+    if (response) lines.push(`Response: ${response}`);
+    if (lines.length > 1) return lines.join("\n");
+
+    if (raw && !generic) return raw;
+    if (error && typeof error === "object") {
+      const serialized = safeStringify(error);
+      if (serialized && serialized !== "{}") return serialized;
+    }
+    return fallback;
+  };
+
+  const assertNoClientError = (result: unknown) => {
+    const maybe = result as { error?: unknown } | null | undefined;
+    if (!maybe || maybe.error === undefined) return;
+    throw new Error(describeProviderError(maybe.error, t("app.error_request_failed")));
+  };
+
+  const lastPromptSent = () => snapshot.lastPromptSent;
+
+  const selectedSessionAgent = () => {
+    const id = options.selectedSessionId();
+    if (!id) return null;
+    return snapshot.sessionAgentById[id] ?? null;
+  };
+
+  const sessionRevertMessageId = () => options.selectedSession()?.revert?.messageID ?? null;
+
+  async function createReadySession(workspaceId: string, initialPrompt?: string) {
+    const id = workspaceId.trim();
+    if (!id) return undefined;
+    const c = options.client();
+    if (!c) {
+      return undefined;
+    }
+
+    const workspaceRoot = options.workspaceRootForId(id).trim() || options.selectedWorkspaceRoot().trim();
+
+    const perfEnabled = options.developerMode();
+    const startedAt = perfNow();
+    const runId = (() => {
+      const key = "__openwork_create_session_run__";
+      const w = window as typeof window & { [key]?: number };
+      w[key] = (w[key] ?? 0) + 1;
+      return w[key];
+    })();
+
+    const mark = (event: string, payload?: Record<string, unknown>) => {
+      const elapsed = Math.round((perfNow() - startedAt) * 100) / 100;
+      recordPerfLog(perfEnabled, "session.create", event, {
+        runId,
+        elapsedMs: elapsed,
+        ...(payload ?? {}),
+      });
+    };
+
+    mark("start", {
+      baseUrl: options.baseUrl(),
+      workspace: workspaceRoot || null,
+      workspaceId: id,
+    });
+
+    options.abortRefreshes();
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    options.setBusy(true);
+    options.setBusyLabel("status.creating_task");
+    options.setBusyStartedAt(Date.now());
+    options.setCreatingSession(true);
+    options.setError(null);
+
+    const withTimeout = async <T,>(promise: Promise<T>, ms: number, label: string) => {
+      let timeoutId: ReturnType<typeof setTimeout> | null = null;
+      const timeoutPromise = new Promise<never>((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error(`Timed out waiting for ${label}`)), ms);
+      });
+      try {
+        return await Promise.race([promise, timeoutPromise]);
+      } finally {
+        if (timeoutId) {
+          clearTimeout(timeoutId);
+        }
+      }
+    };
+
+    try {
+      mark("health:start");
+      try {
+        await withTimeout(c.global.health(), 3_000, "health");
+        mark("health:ok");
+      } catch (healthErr) {
+        mark("health:error", {
+          error: healthErr instanceof Error ? healthErr.message : safeStringify(healthErr),
+        });
+        throw new Error("Connection lost");
+      }
+
+      let rawResult: Awaited<ReturnType<typeof c.session.create>>;
+      try {
+        const directory = toSessionTransportDirectory(workspaceRoot) || undefined;
+        mark("session:create:start");
+        rawResult = await c.session.create({ directory });
+        mark("session:create:ok");
+      } catch (createErr) {
+        mark("session:create:error", {
+          error: createErr instanceof Error ? createErr.message : safeStringify(createErr),
+        });
+        throw createErr;
+      }
+
+      const session = unwrap(rawResult);
+      if (initialPrompt) {
+        saveSessionDraft(id, session.id, {
+          text: initialPrompt,
+          mode: "prompt",
+        });
+      } else {
+        clearSessionDraft(id, session.id);
+      }
+
+      options.setBusyLabel("status.loading_session");
+      mark("session:select:start", { sessionID: session.id });
+      await options.selectSession(session.id, { skipHealthCheck: true, source: "create-ready-session" });
+      mark("session:select:ok", { sessionID: session.id });
+
+      options.modelConfig.applyPendingSessionChoice(session.id);
+
+      const currentStoreSessions = options.sessions();
+      if (!currentStoreSessions.some((s) => s.id === session.id)) {
+        options.setSessions([session, ...currentStoreSessions]);
+      }
+
+      await options.refreshSidebarWorkspaceSessions(id).catch(() => undefined);
+
+      options.navigate(`/session/${session.id}`);
+
+      finishPerf(perfEnabled, "session.create", "done", startedAt, {
+        runId,
+        sessionID: session.id,
+        workspaceId: id,
+      });
+      return session.id;
+    } catch (e) {
+      finishPerf(perfEnabled, "session.create", "error", startedAt, {
+        runId,
+        error: e instanceof Error ? e.message : safeStringify(e),
+        workspaceId: id,
+      });
+      const message = e instanceof Error ? e.message : t("app.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return undefined;
+    } finally {
+      options.setCreatingSession(false);
+      options.setBusy(false);
+      options.setBusyLabel(null);
+      options.setBusyStartedAt(null);
+    }
+  }
+
+  async function createSessionInWorkspace(workspaceId: string, initialPrompt?: string) {
+    const id = workspaceId.trim();
+    if (!id) return undefined;
+    if (options.selectedWorkspaceId().trim() !== id) {
+      const selected = await Promise.resolve(options.selectWorkspace(id));
+      if (!selected) return undefined;
+    }
+    const ready = await options.ensureWorkspaceRuntime(id);
+    if (!ready) {
+      return undefined;
+    }
+    return await createReadySession(id, initialPrompt);
+  }
+
+  async function createSessionAndOpen(initialPrompt?: string) {
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent(FLUSH_PROMPT_EVENT));
+    }
+    const workspaceId = options.selectedWorkspaceId().trim();
+    if (!workspaceId) {
+      return undefined;
+    }
+    return await createSessionInWorkspace(workspaceId, initialPrompt);
+  }
+
+  async function sendPrompt(draft?: ComposerDraft) {
+    const hasExplicitDraft = Boolean(draft);
+    const fallbackText = options.prompt().trim();
+    const resolvedDraft: ComposerDraft = draft ?? {
+      mode: "prompt",
+      parts: fallbackText ? [{ type: "text", text: fallbackText } as ComposerPart] : [],
+      attachments: [] as ComposerAttachment[],
+      text: fallbackText,
+    };
+    const content = (resolvedDraft.resolvedText ?? resolvedDraft.text).trim();
+    if (!content && !resolvedDraft.attachments.length) return;
+
+    const workspaceId = options.selectedWorkspaceId().trim();
+    if (!workspaceId) return;
+
+    const ready = await options.ensureWorkspaceRuntime(workspaceId);
+    if (!ready) return;
+
+    const c = options.client();
+    if (!c) return;
+
+    const compactShortcut = /^\/compact(?:\s+.*)?$/i.test(content);
+    const compactCommand = resolvedDraft.command?.name === "compact" || compactShortcut;
+    const commandName = compactCommand ? "compact" : (resolvedDraft.command?.name ?? null);
+    if (compactCommand && !options.selectedSessionId()) {
+      options.setError(t("app.error_compact_no_session"));
+      return;
+    }
+
+    let sessionID = options.selectedSessionId();
+    if (!sessionID) {
+      await createSessionInWorkspace(workspaceId);
+      sessionID = options.selectedSessionId();
+    }
+    if (!sessionID) return;
+
+    options.setBusy(true);
+    options.setBusyLabel("status.running");
+    options.setBusyStartedAt(Date.now());
+    options.setError(null);
+
+    const perfEnabled = options.developerMode();
+    const startedAt = perfNow();
+    const visible = options.messages();
+    const visibleParts = visible.reduce((total, message) => total + message.parts.length, 0);
+    recordPerfLog(perfEnabled, "session.prompt", "start", {
+      sessionID,
+      mode: resolvedDraft.mode,
+      command: commandName,
+      charCount: content.length,
+      attachmentCount: resolvedDraft.attachments.length,
+      messageCount: visible.length,
+      partCount: visibleParts,
+    });
+
+    try {
+      if (!compactCommand) {
+        setLastPromptSent(content);
+      }
+      clearSessionDraft(options.selectedWorkspaceId().trim(), sessionID);
+      if (!hasExplicitDraft) {
+        options.setPrompt("");
+      }
+
+      const model = options.selectedSessionModel();
+      const agent = selectedSessionAgent();
+      const parts = await buildPromptParts(resolvedDraft);
+      const selectedVariant = options.sanitizeModelVariantForRef(model, options.modelVariant()) ?? undefined;
+      const reasoningEffort = options.resolveCodexReasoningEffort(model.modelID, selectedVariant ?? null);
+      const requestVariant = reasoningEffort ? undefined : selectedVariant;
+      const promptOverrides = reasoningEffort ? ({ reasoning_effort: reasoningEffort } as const) : undefined;
+
+      if (resolvedDraft.mode === "shell") {
+        await shellInSession(c, sessionID, content);
+      } else if (resolvedDraft.command || compactCommand) {
+        if (compactCommand) {
+          await compactCurrentSession(sessionID);
+          finishPerf(perfEnabled, "session.prompt", "done", startedAt, {
+            sessionID,
+            mode: resolvedDraft.mode,
+            command: commandName,
+          });
+          return;
+        }
+
+        const command = resolvedDraft.command;
+        if (!command) {
+          throw new Error(t("app.error_command_not_resolved"));
+        }
+
+        const modelString = `${model.providerID}/${model.modelID}`;
+        const files = await buildCommandFileParts(resolvedDraft);
+
+        unwrap(
+          await c.session.command({
+            sessionID,
+            command: command.name,
+            arguments: command.arguments,
+            agent: agent ?? undefined,
+            model: modelString,
+            variant: requestVariant,
+            ...(promptOverrides ?? {}),
+            parts: files.length ? files : undefined,
+          }),
+        );
+      } else {
+        const result = await c.session.promptAsync({
+          sessionID,
+          model,
+          agent: agent ?? undefined,
+          variant: requestVariant,
+          ...(promptOverrides ?? {}),
+          parts,
+        });
+        assertNoClientError(result);
+
+        options.modelConfig.setSessionModelById((current) => ({
+          ...current,
+          [sessionID]: model,
+        }));
+
+        options.modelConfig.clearSessionModelOverride(sessionID);
+      }
+
+      finishPerf(perfEnabled, "session.prompt", "done", startedAt, {
+        sessionID,
+        mode: resolvedDraft.mode,
+        command: commandName,
+      });
+    } catch (e) {
+      finishPerf(perfEnabled, "session.prompt", "error", startedAt, {
+        sessionID,
+        mode: resolvedDraft.mode,
+        command: commandName,
+        error: e instanceof Error ? e.message : safeStringify(e),
+      });
+      const message = e instanceof Error ? e.message : safeStringify(e);
+      options.appendSessionErrorTurn(sessionID, addOpencodeCacheHint(message));
+    } finally {
+      options.setBusy(false);
+      options.setBusyLabel(null);
+      options.setBusyStartedAt(null);
+    }
+  }
+
+  async function abortSession(sessionID?: string) {
+    const c = options.client();
+    if (!c) return;
+    const id = (sessionID ?? options.selectedSessionId() ?? "").trim();
+    if (!id) return;
+    await abortSessionTyped(c, id);
+  }
+
+  function retryLastPrompt() {
+    const text = lastPromptSent().trim();
+    if (!text) return;
+    void sendPrompt({
+      mode: "prompt",
+      text,
+      parts: [{ type: "text", text }],
+      attachments: [],
+    });
+  }
+
+  async function compactCurrentSession(sessionIdOverride?: string) {
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("app.error_not_connected"));
+    }
+
+    const sessionID = (sessionIdOverride ?? options.selectedSessionId() ?? "").trim();
+    if (!sessionID) {
+      throw new Error(t("app.error_compact_no_session_id"));
+    }
+
+    const visible = options.messages();
+    if (!visible.length) {
+      throw new Error(t("app.error_compact_empty"));
+    }
+
+    const model = options.selectedSessionModel();
+    const startedAt = perfNow();
+    const modelLabel = `${model.providerID}/${model.modelID}`;
+    recordPerfLog(options.developerMode(), "session.compact", "start", {
+      sessionID,
+      messageCount: visible.length,
+      model: modelLabel,
+      variant: options.sanitizeModelVariantForRef(model, options.modelVariant()) ?? null,
+    });
+
+    try {
+      await compactSessionTyped(c, sessionID, model, {
+        directory: options.runtimeWorkspaceRoot().trim() || options.selectedWorkspaceRoot().trim() || undefined,
+      });
+      finishPerf(options.developerMode(), "session.compact", "done", startedAt, {
+        sessionID,
+        messageCount: visible.length,
+        model: modelLabel,
+      });
+    } catch (error) {
+      finishPerf(options.developerMode(), "session.compact", "error", startedAt, {
+        sessionID,
+        messageCount: visible.length,
+        model: modelLabel,
+        error: error instanceof Error ? error.message : safeStringify(error),
+      });
+      throw error;
+    }
+  }
+
+  async function undoLastUserMessage() {
+    const c = options.client();
+    const sessionID = (options.selectedSessionId() ?? "").trim();
+    if (!c || !sessionID) return;
+
+    await abortSessionSafe(c, sessionID);
+
+    const users = options.messages().filter((message) => {
+      const role = (message.info as { role?: string }).role;
+      return role === "user";
+    });
+    const target = users[users.length - 1];
+    if (!target) return;
+
+    const messageID = options.messageIdFromInfo(target);
+    if (!messageID) return;
+
+    const nextSession = await revertSession(c, sessionID, messageID);
+    options.upsertLocalSession(nextSession);
+
+    if (users.length > 1) {
+      options.restorePromptFromUserMessage(users[users.length - 2]);
+      return;
+    }
+
+    options.setPrompt("");
+  }
+
+  async function redoLastUserMessage() {
+    const c = options.client();
+    const sessionID = (options.selectedSessionId() ?? "").trim();
+    if (!c || !sessionID) return;
+
+    await abortSessionSafe(c, sessionID);
+
+    const revertMessageID = options.selectedSession()?.revert?.messageID ?? null;
+    if (!revertMessageID) return;
+
+    const users = options.messages().filter((message) => {
+      const role = (message.info as { role?: string }).role;
+      return role === "user";
+    });
+
+    const next = users.find((message) => {
+      const id = options.messageIdFromInfo(message);
+      return Boolean(id) && id > revertMessageID;
+    });
+
+    if (!next) {
+      const session = await unrevertSession(c, sessionID);
+      options.upsertLocalSession(session);
+      options.setPrompt("");
+      return;
+    }
+
+    const messageID = options.messageIdFromInfo(next);
+    if (!messageID) return;
+
+    const nextSession = await revertSession(c, sessionID, messageID);
+    options.upsertLocalSession(nextSession);
+
+    let prior: MessageWithParts | null = null;
+    for (let idx = users.length - 1; idx >= 0; idx -= 1) {
+      const candidate = users[idx];
+      const id = options.messageIdFromInfo(candidate);
+      if (id && id < messageID) {
+        prior = candidate;
+        break;
+      }
+    }
+
+    if (prior) {
+      options.restorePromptFromUserMessage(prior);
+      return;
+    }
+
+    options.setPrompt("");
+  }
+
+  async function renameSessionTitle(sessionID: string, title: string) {
+    const trimmed = title.trim();
+    if (!trimmed) {
+      throw new Error(t("app.error_session_name_required"));
+    }
+
+    await options.renameSession(sessionID, trimmed);
+    await options.refreshSidebarWorkspaceSessions(options.selectedWorkspaceId()).catch(() => undefined);
+  }
+
+  async function deleteSessionById(sessionID: string) {
+    const trimmed = sessionID.trim();
+    if (!trimmed) return;
+    const c = options.client();
+    if (!c) {
+      throw new Error(t("app.error_not_connected"));
+    }
+
+    const root = options.selectedWorkspaceRoot().trim();
+    const directory = toSessionTransportDirectory(root);
+    const params = directory ? { sessionID: trimmed, directory } : { sessionID: trimmed };
+    unwrap(await c.session.delete(params));
+    clearSessionDraft(options.selectedWorkspaceId().trim(), trimmed);
+
+    options.setSessions(options.sessions().filter((s) => s.id !== trimmed));
+    const activeWsId = options.selectedWorkspaceId();
+    await options.refreshSidebarWorkspaceSessions(activeWsId).catch(() => undefined);
+
+    try {
+      const path = options.locationPath().toLowerCase();
+      if (path === `/session/${trimmed.toLowerCase()}`) {
+        options.navigate("/session", { replace: true });
+      }
+    } catch {
+      // ignore
+    }
+
+    if (options.selectedSessionId() === trimmed) {
+      options.setSelectedSessionId(null);
+      const activeWorkspace = options.selectedWorkspaceId().trim();
+      if (activeWorkspace) {
+        const map = options.readSessionByWorkspace();
+        if (map[activeWorkspace] === trimmed) {
+          const next = { ...map };
+          delete next[activeWorkspace];
+          options.writeSessionByWorkspace(next);
+        }
+      }
+    }
+
+    const nextStatus = { ...options.sessionStatusById() };
+    if (nextStatus[trimmed]) {
+      delete nextStatus[trimmed];
+      options.setSessionStatusById(nextStatus);
+    }
+  }
+
+  async function listAgents(): Promise<Agent[]> {
+    const c = options.client();
+    if (!c) return [];
+    const list = unwrap(await c.app.agents());
+    return list.filter((agent) => !agent.hidden && agent.mode !== "subagent");
+  }
+
+  const BUILTIN_COMPACT_COMMAND = {
+    id: "builtin:compact",
+    name: "compact",
+    description: t("app.compact_command_desc"),
+    source: "command" as const,
+  };
+
+  async function listCommands(): Promise<{ id: string; name: string; description?: string; source?: "command" | "mcp" | "skill" }[]> {
+    const c = options.client();
+    if (!c) return [];
+    const directory = options.runtimeWorkspaceRoot().trim() || options.selectedWorkspaceRoot().trim() || undefined;
+    const list = await listCommandsTyped(c, directory);
+    if (list.some((entry) => entry.name === "compact")) {
+      return list;
+    }
+    return [BUILTIN_COMPACT_COMMAND, ...list];
+  }
+
+  function setSessionAgent(sessionID: string, agent: string | null) {
+    const trimmed = agent?.trim() ?? "";
+    setSessionAgentById((current) => {
+      const next = { ...current };
+      if (!trimmed) {
+        delete next[sessionID];
+        return next;
+      }
+      next[sessionID] = trimmed;
+      return next;
+    });
+  }
+
+  const searchWorkspaceFiles = async (query: string) => {
+    const trimmed = query.trim();
+    if (!trimmed) return [];
+    const activeClient = options.client();
+    if (!activeClient) return [];
+    try {
+      const directory = options.runtimeWorkspaceRoot().trim() || options.selectedWorkspaceRoot().trim();
+      const result = unwrap(
+        await activeClient.find.files({
+          query: trimmed,
+          dirs: "true",
+          limit: 50,
+          directory: directory || undefined,
+        }),
+      );
+      return result;
+    } catch {
+      return [];
+    }
+  };
+
+  return {
+    subscribe,
+    getSnapshot,
+    lastPromptSent,
+    selectedSessionAgent,
+    sessionRevertMessageId,
+    createSessionInWorkspace,
+    createSessionAndOpen,
+    sendPrompt,
+    abortSession,
+    retryLastPrompt,
+    compactCurrentSession,
+    undoLastUserMessage,
+    redoLastUserMessage,
+    renameSessionTitle,
+    deleteSessionById,
+    listAgents,
+    listCommands,
+    setSessionAgent,
+    searchWorkspaceFiles,
+  };
+}
diff --git a/apps/app/src/react-app/domains/session/sync/draft-store.ts b/apps/app/src/react-app/domains/session/sync/draft-store.ts
new file mode 100644
index 0000000000..4ba02583fb
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/draft-store.ts
@@ -0,0 +1,168 @@
+/** @jsxImportSource react */
+import { useCallback, useMemo, useSyncExternalStore } from "react";
+
+import type { PromptMode } from "../../../../app/types";
+
+export type SessionDraftSnapshot = {
+  text: string;
+  mode: PromptMode;
+};
+
+const STORAGE_KEY = "openwork.session-drafts.v1";
+const MAX_DRAFT_COUNT = 100;
+
+let draftCache: Map<string, SessionDraftSnapshot> | null = null;
+
+const listeners = new Set<() => void>();
+
+export const sessionDraftScopeKey = (
+  workspaceId: string,
+  sessionId: string | null | undefined,
+) => {
+  const workspace = workspaceId.trim();
+  const session = (sessionId ?? "").trim();
+  if (!workspace || !session) return "";
+  return `${workspace}:${session}`;
+};
+
+const isPromptMode = (value: unknown): value is PromptMode =>
+  value === "prompt" || value === "shell";
+
+const emitDraftStoreChange = () => {
+  for (const listener of listeners) {
+    listener();
+  }
+};
+
+const subscribeDraftStore = (callback: () => void) => {
+  listeners.add(callback);
+  return () => {
+    listeners.delete(callback);
+  };
+};
+
+const loadDraftCache = () => {
+  if (draftCache) return draftCache;
+  draftCache = new Map<string, SessionDraftSnapshot>();
+  if (typeof window === "undefined") return draftCache;
+  try {
+    const raw = window.localStorage.getItem(STORAGE_KEY);
+    if (!raw) return draftCache;
+    const parsed = JSON.parse(raw) as Record<string, { text?: unknown; mode?: unknown }>;
+    if (!parsed || typeof parsed !== "object") return draftCache;
+    for (const [key, value] of Object.entries(parsed)) {
+      if (!key || !value || typeof value !== "object") continue;
+      const text = typeof value.text === "string" ? value.text : "";
+      const mode = isPromptMode(value.mode) ? value.mode : "prompt";
+      if (!text && mode === "prompt") continue;
+      draftCache.set(key, { text, mode });
+    }
+  } catch {
+    return draftCache;
+  }
+  return draftCache;
+};
+
+const persistDraftCache = () => {
+  if (typeof window === "undefined") return;
+  const cache = loadDraftCache();
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(Object.fromEntries(cache)));
+  } catch {
+    // ignore storage write failures
+  }
+};
+
+export const getSessionDraft = (
+  workspaceId: string,
+  sessionId: string | null | undefined,
+) => {
+  const key = sessionDraftScopeKey(workspaceId, sessionId);
+  if (!key) return null;
+  return loadDraftCache().get(key) ?? null;
+};
+
+export const saveSessionDraft = (
+  workspaceId: string,
+  sessionId: string | null | undefined,
+  snapshot: SessionDraftSnapshot,
+) => {
+  const key = sessionDraftScopeKey(workspaceId, sessionId);
+  if (!key) return;
+
+  const normalized: SessionDraftSnapshot = {
+    text: snapshot.text,
+    mode: snapshot.mode,
+  };
+
+  if (!normalized.text && normalized.mode === "prompt") {
+    clearSessionDraft(workspaceId, sessionId);
+    return;
+  }
+
+  const cache = loadDraftCache();
+  cache.delete(key);
+  cache.set(key, normalized);
+  while (cache.size > MAX_DRAFT_COUNT) {
+    const oldest = cache.keys().next();
+    if (oldest.done) break;
+    cache.delete(oldest.value);
+  }
+  persistDraftCache();
+  emitDraftStoreChange();
+};
+
+export const clearSessionDraft = (
+  workspaceId: string,
+  sessionId: string | null | undefined,
+) => {
+  const key = sessionDraftScopeKey(workspaceId, sessionId);
+  if (!key) return;
+  const cache = loadDraftCache();
+  if (!cache.delete(key)) return;
+  persistDraftCache();
+  emitDraftStoreChange();
+};
+
+export function useSessionDraftSnapshot(
+  workspaceId: string,
+  sessionId: string | null | undefined,
+) {
+  const scopeKey = useMemo(
+    () => sessionDraftScopeKey(workspaceId, sessionId),
+    [workspaceId, sessionId],
+  );
+
+  return useSyncExternalStore(
+    subscribeDraftStore,
+    () => (scopeKey ? loadDraftCache().get(scopeKey) ?? null : null),
+    () => null,
+  );
+}
+
+export function useSessionDraftState(
+  workspaceId: string,
+  sessionId: string | null | undefined,
+) {
+  const snapshot = useSessionDraftSnapshot(workspaceId, sessionId);
+  const scopeKey = useMemo(
+    () => sessionDraftScopeKey(workspaceId, sessionId),
+    [workspaceId, sessionId],
+  );
+
+  const save = useCallback(
+    (nextSnapshot: SessionDraftSnapshot) => {
+      saveSessionDraft(workspaceId, sessionId, nextSnapshot);
+    },
+    [workspaceId, sessionId],
+  );
+
+  const clear = useCallback(() => {
+    clearSessionDraft(workspaceId, sessionId);
+  }, [workspaceId, sessionId]);
+
+  return useMemo(
+    () => ({ scopeKey, snapshot, save, clear }),
+    [clear, save, scopeKey, snapshot],
+  );
+}
diff --git a/apps/app/src/react-app/domains/session/sync/env-context.ts b/apps/app/src/react-app/domains/session/sync/env-context.ts
new file mode 100644
index 0000000000..469bdd3cd2
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/env-context.ts
@@ -0,0 +1,69 @@
+import type { OpenworkServerClient } from "../../../../app/lib/openwork-server";
+import { readOpenworkEnvPendingChanges } from "../../../../app/lib/openwork-env-runtime";
+
+const DEFAULT_CACHE_KEY = "__openwork_env_default__";
+const MAX_CONTEXT_CACHE_ENTRIES = 100;
+
+const envSystemContextCache = new Map<string, string | undefined>();
+
+export function clearOpenworkEnvSystemContextCache(): void {
+  envSystemContextCache.clear();
+}
+
+function normalizeEnvKeys(keys: string[]): string[] {
+  return Array.from(
+    new Set(
+      keys
+        .map((key) => key.trim())
+        .filter((key) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)),
+    ),
+  ).sort((a, b) => a.localeCompare(b));
+}
+
+export async function buildOpenworkEnvSystemContext(
+  client: OpenworkServerClient | null,
+  options: {
+    cacheKey?: string;
+    runtimeKey?: string | null;
+    readPendingChanges?: () => boolean;
+  } = {},
+): Promise<string | undefined> {
+  if (!client) return undefined;
+  const readPendingChanges = options.readPendingChanges ??
+    (() => readOpenworkEnvPendingChanges(options.runtimeKey));
+  if (readPendingChanges()) return undefined;
+
+  const cacheKey = `${client.baseUrl}:${options.cacheKey ?? DEFAULT_CACHE_KEY}`;
+  if (envSystemContextCache.has(cacheKey)) {
+    return envSystemContextCache.get(cacheKey);
+  }
+
+  try {
+    const response = await client.listUserEnvKeys();
+    const keys = normalizeEnvKeys(response.keys ?? []);
+    if (keys.length === 0) {
+      rememberEnvSystemContext(cacheKey, undefined);
+      return undefined;
+    }
+
+    const keyList = keys.map((key) => `- ${key}`).join("\n");
+
+    const context = [
+      "OpenWork environment variables configured:",
+      keyList,
+      "Only names are shown; values are secret. Use these names when relevant.",
+    ].join("\n");
+    rememberEnvSystemContext(cacheKey, context);
+    return context;
+  } catch {
+    return undefined;
+  }
+}
+
+function rememberEnvSystemContext(cacheKey: string, context: string | undefined): void {
+  if (envSystemContextCache.size >= MAX_CONTEXT_CACHE_ENTRIES && !envSystemContextCache.has(cacheKey)) {
+    const firstKey = envSystemContextCache.keys().next().value;
+    if (firstKey) envSystemContextCache.delete(firstKey);
+  }
+  envSystemContextCache.set(cacheKey, context);
+}
diff --git a/apps/app/src/react-app/domains/session/sync/message-merge.ts b/apps/app/src/react-app/domains/session/sync/message-merge.ts
new file mode 100644
index 0000000000..6d41b2f919
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/message-merge.ts
@@ -0,0 +1,89 @@
+import type { UIMessage } from "ai";
+
+function mergeMessageParts(snapshotMessage: UIMessage, cachedMessage: UIMessage) {
+  const parts = snapshotMessage.parts.map((part, index) => {
+    const cachedPart = cachedMessage.parts[index];
+    if (!cachedPart) return part;
+
+    if (
+      (part.type === "text" || part.type === "reasoning") &&
+      cachedPart.type === part.type &&
+      cachedPart.text.length > part.text.length
+    ) {
+      return { ...part, text: cachedPart.text };
+    }
+
+    return part;
+  });
+
+  if (cachedMessage.parts.length > snapshotMessage.parts.length) {
+    parts.push(...cachedMessage.parts.slice(snapshotMessage.parts.length));
+  }
+
+  return parts;
+}
+
+function mergeSnapshotMessageWithCached(snapshotMessage: UIMessage, cachedMessage: UIMessage): UIMessage {
+  return {
+    ...snapshotMessage,
+    parts: mergeMessageParts(snapshotMessage, cachedMessage),
+  };
+}
+
+export function messageListContainsAll(container: UIMessage[], required: UIMessage[]) {
+  if (required.length === 0) return true;
+  const ids = new Set(container.map((message) => message.id));
+  return required.every((message) => ids.has(message.id));
+}
+
+export function mergeSnapshotAndLiveMessages(
+  snapshotMessages: UIMessage[],
+  liveMessages: UIMessage[],
+  options: { appendLiveOnlyMessages?: boolean } = {},
+) {
+  if (snapshotMessages.length === 0) return liveMessages;
+  if (liveMessages.length === 0) return snapshotMessages;
+
+  const liveById = new Map(liveMessages.map((message) => [message.id, message]));
+  const snapshotIds = new Set(snapshotMessages.map((message) => message.id));
+  const merged = snapshotMessages.map((snapshotMessage) => {
+    const liveMessage = liveById.get(snapshotMessage.id);
+    return liveMessage ? mergeSnapshotMessageWithCached(snapshotMessage, liveMessage) : snapshotMessage;
+  });
+
+  if (options.appendLiveOnlyMessages) {
+    for (const liveMessage of liveMessages) {
+      if (!snapshotIds.has(liveMessage.id)) merged.push(liveMessage);
+    }
+  }
+
+  return merged;
+}
+
+export function mergeSnapshotIntoCachedMessages(snapshotMessages: UIMessage[], cachedMessages: UIMessage[]) {
+  if (snapshotMessages.length === 0) return cachedMessages;
+  if (cachedMessages.length === 0) return snapshotMessages;
+
+  const snapshotById = new Map(snapshotMessages.map((message) => [message.id, message]));
+  const cachedById = new Map(cachedMessages.map((message) => [message.id, message]));
+  const useCachedOrder = cachedMessages.length > snapshotMessages.length;
+  const primary = useCachedOrder ? cachedMessages : snapshotMessages;
+  const secondary = useCachedOrder ? snapshotMessages : cachedMessages;
+  const seen = new Set<string>();
+  const merged = primary.map((message) => {
+    seen.add(message.id);
+    const snapshotMessage = snapshotById.get(message.id);
+    const cachedMessage = cachedById.get(message.id);
+    return snapshotMessage && cachedMessage
+      ? mergeSnapshotMessageWithCached(snapshotMessage, cachedMessage)
+      : message;
+  });
+
+  for (const message of secondary) {
+    if (seen.has(message.id)) continue;
+    seen.add(message.id);
+    merged.push(message);
+  }
+
+  return merged;
+}
diff --git a/apps/app/src/react-app/domains/session/sync/run-state.ts b/apps/app/src/react-app/domains/session/sync/run-state.ts
new file mode 100644
index 0000000000..d4171ad746
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/run-state.ts
@@ -0,0 +1,21 @@
+import type { SessionErrorTurn } from "../../../../app/types";
+
+export function latestSessionErrorTurnTime(turns: SessionErrorTurn[]) {
+  const last = turns[turns.length - 1];
+  return typeof last?.time === "number" ? last.time : null;
+}
+
+export function shouldResetRunState(input: {
+  hasError: boolean;
+  sessionStatus: string;
+  runHasBegun: boolean;
+  runStartedAt: number | null;
+  latestErrorTurnTime: number | null;
+}) {
+  if (input.runStartedAt === null) return false;
+  if (input.sessionStatus !== "idle") return false;
+  if (input.hasError) return true;
+  if (input.runHasBegun) return true;
+  if (input.latestErrorTurnTime === null) return false;
+  return input.latestErrorTurnTime >= input.runStartedAt;
+}
diff --git a/apps/app/src/react-app/domains/session/sync/runtime-sync.tsx b/apps/app/src/react-app/domains/session/sync/runtime-sync.tsx
new file mode 100644
index 0000000000..fcd215e8a8
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/runtime-sync.tsx
@@ -0,0 +1,34 @@
+/** @jsxImportSource react */
+import { useEffect } from "react";
+
+import { ensureWorkspaceSessionSync, trackWorkspaceSessionSync } from "./session-sync";
+
+type ReactSessionRuntimeProps = {
+  workspaceId: string;
+  sessionId: string | null;
+  opencodeBaseUrl: string;
+  openworkToken: string;
+};
+
+export function ReactSessionRuntime(props: ReactSessionRuntimeProps) {
+  useEffect(() => {
+    return ensureWorkspaceSessionSync({
+      workspaceId: props.workspaceId,
+      baseUrl: props.opencodeBaseUrl,
+      openworkToken: props.openworkToken,
+    });
+  }, [props.workspaceId, props.opencodeBaseUrl, props.openworkToken]);
+
+  useEffect(() => {
+    return trackWorkspaceSessionSync(
+      {
+        workspaceId: props.workspaceId,
+        baseUrl: props.opencodeBaseUrl,
+        openworkToken: props.openworkToken,
+      },
+      props.sessionId,
+    );
+  }, [props.workspaceId, props.sessionId, props.opencodeBaseUrl, props.openworkToken]);
+
+  return null;
+}
diff --git a/apps/app/src/react-app/domains/session/sync/session-sync.ts b/apps/app/src/react-app/domains/session/sync/session-sync.ts
new file mode 100644
index 0000000000..f095ef0b13
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/session-sync.ts
@@ -0,0 +1,621 @@
+import type { UIMessage } from "ai";
+import type { Part, PermissionRequest, SessionStatus, Todo } from "@opencode-ai/sdk/v2/client";
+
+import { getReactQueryClient } from "../../../infra/query-client";
+import { createClient } from "../../../../app/lib/opencode";
+import { normalizeEvent } from "../../../../app/utils";
+import type { OpencodeEvent, PendingPermission } from "../../../../app/types";
+import { snapshotToUIMessages } from "./usechat-adapter";
+import type { OpenworkSessionSnapshot } from "../../../../app/lib/openwork-server";
+import { mergeSnapshotIntoCachedMessages } from "./message-merge";
+
+type SyncOptions = {
+  workspaceId: string;
+  baseUrl: string;
+  openworkToken: string;
+};
+
+type PendingDelta = {
+  sessionId: string;
+  messageId: string;
+  partId: string;
+  reasoning: boolean;
+  delta: string;
+};
+
+type SyncEntry = {
+  refs: number;
+  dispose: () => void;
+  trackedSessionRefs: Map<string, number>;
+  pendingDeltas: Map<string, { messageId: string; reasoning: boolean; text: string }>;
+  // Coalesce rapid-fire delta events from the SSE stream into one cache
+  // commit per animation frame. Without this, a long response produces a
+  // setQueryData per token; each triggers a full transcript re-render
+  // (~27ms on large sessions) which starves the main thread and looks to
+  // the user like the app "freezes after 2 words."
+  deltaFlushBuffer: PendingDelta[];
+  deltaFlushScheduled: boolean;
+};
+
+const idleStatus: SessionStatus = { type: "idle" };
+const syncs = new Map<string, SyncEntry>();
+
+export const transcriptKey = (workspaceId: string, sessionId: string) =>
+  ["react-session-transcript", workspaceId, sessionId] as const;
+export const statusKey = (workspaceId: string, sessionId: string) =>
+  ["react-session-status", workspaceId, sessionId] as const;
+export const todoKey = (workspaceId: string, sessionId: string) =>
+  ["react-session-todos", workspaceId, sessionId] as const;
+export const permissionKey = (workspaceId: string, sessionId: string) =>
+  ["react-session-permissions", workspaceId, sessionId] as const;
+
+function syncKey(input: SyncOptions) {
+  return `${input.workspaceId}:${input.baseUrl}:${input.openworkToken}`;
+}
+
+function getErrorStatus(error: unknown) {
+  if (!error || typeof error !== "object") return null;
+  const record = error as {
+    status?: unknown;
+    response?: { status?: unknown };
+    cause?: { status?: unknown };
+  };
+  const status = record.status ?? record.response?.status ?? record.cause?.status;
+  return typeof status === "number" ? status : null;
+}
+
+function shouldRetrySyncSubscribe(error: unknown) {
+  const status = getErrorStatus(error);
+  return status !== 401 && status !== 403 && status !== 404;
+}
+
+function isTrackedSession(entry: SyncEntry, sessionId: string) {
+  return (entry.trackedSessionRefs.get(sessionId) ?? 0) > 0;
+}
+
+function withReceivedAt(permission: PermissionRequest, receivedAt: number): PendingPermission {
+  return { ...permission, receivedAt };
+}
+
+function sortPermissions(a: PendingPermission, b: PendingPermission) {
+  return a.receivedAt - b.receivedAt || a.id.localeCompare(b.id);
+}
+
+export function seedPermissionState(
+  workspaceId: string,
+  sessionId: string,
+  permissions: PermissionRequest[],
+  options: { snapshotStartedAt?: number } = {},
+) {
+  const queryClient = getReactQueryClient();
+  const now = Date.now();
+  queryClient.setQueryData<PendingPermission[]>(permissionKey(workspaceId, sessionId), (current = []) => {
+    const receivedAtById = new Map(current.map((permission) => [permission.id, permission.receivedAt]));
+    const seeded = permissions
+      .filter((permission) => permission.sessionID === sessionId)
+      .map((permission) => withReceivedAt(permission, receivedAtById.get(permission.id) ?? now));
+    const seededIds = new Set(seeded.map((permission) => permission.id));
+    const snapshotStartedAt = options.snapshotStartedAt;
+    const liveAfterSnapshot =
+      typeof snapshotStartedAt === "number"
+        ? current.filter(
+            (permission) =>
+              permission.sessionID === sessionId &&
+              permission.receivedAt > snapshotStartedAt &&
+              !seededIds.has(permission.id),
+          )
+        : [];
+    return [...seeded, ...liveAfterSnapshot].sort(sortPermissions);
+  });
+}
+
+function toUIPart(part: Part): UIMessage["parts"][number] | null {
+  if (part.type === "text") {
+    return {
+      type: "text",
+      text: typeof (part as { text?: unknown }).text === "string" ? (part as { text: string }).text : "",
+      state: "done",
+      providerMetadata: { opencode: { partId: part.id } },
+    };
+  }
+  if (part.type === "reasoning") {
+    return {
+      type: "reasoning",
+      text: typeof (part as { text?: unknown }).text === "string" ? (part as { text: string }).text : "",
+      state: "done",
+      providerMetadata: { opencode: { partId: part.id } },
+    };
+  }
+  if (part.type === "file") {
+    const file = part as Part & { url?: string; filename?: string; mime?: string };
+    if (!file.url) return null;
+    return {
+      type: "file",
+      url: file.url,
+      filename: file.filename,
+      mediaType: file.mime ?? "application/octet-stream",
+      providerMetadata: { opencode: { partId: part.id } },
+    };
+  }
+  if (part.type === "tool") {
+    const record = part as Part & { tool?: string; state?: Record<string, unknown> };
+    const state = record.state ?? {};
+    const toolName = typeof record.tool === "string" ? record.tool : "tool";
+    if (typeof state.error === "string" && state.error.trim()) {
+      return {
+        type: "dynamic-tool",
+        toolName,
+        toolCallId: part.id,
+        state: "output-error",
+        input: state.input,
+        errorText: state.error,
+      };
+    }
+    if (state.output !== undefined) {
+      return {
+        type: "dynamic-tool",
+        toolName,
+        toolCallId: part.id,
+        state: "output-available",
+        input: state.input,
+        output: state.output,
+      };
+    }
+    return {
+      type: "dynamic-tool",
+      toolName,
+      toolCallId: part.id,
+      state: "input-available",
+      input: state.input,
+    };
+  }
+  if (part.type === "step-start") return { type: "step-start" };
+  return null;
+}
+
+function getPartMetadataId(part: UIMessage["parts"][number]) {
+  if (part.type !== "text" && part.type !== "reasoning" && part.type !== "file") return null;
+  const metadata = part.providerMetadata?.opencode;
+  if (!metadata || typeof metadata !== "object") return null;
+  return "partId" in metadata ? (metadata as { partId?: string }).partId ?? null : null;
+}
+
+function upsertMessage(messages: UIMessage[], next: UIMessage) {
+  const index = messages.findIndex((message) => message.id === next.id);
+  if (index === -1) return [...messages, next];
+  return messages.map((message, messageIndex) =>
+    messageIndex === index
+      ? {
+          ...message,
+          ...next,
+          parts: next.parts.length > 0 ? next.parts : message.parts,
+        }
+      : message,
+  );
+}
+
+/**
+ * When a message.part.updated or message.part.delta event arrives for a
+ * messageID we haven't seen a message.updated for yet, we have to stub the
+ * message so the part has somewhere to live. The stub's role used to be
+ * hard-coded to "assistant", which meant that if part events beat the
+ * message.updated event for a *user* turn (a common race during
+ * promptAsync), that user message flashed as an assistant-styled block
+ * until the real role arrived a tick later.
+ *
+ * Infer the stub role from the conversation instead. Chat sessions
+ * alternate, so the new message is almost always the opposite role of the
+ * most recent known message. If the transcript is empty the first message
+ * is always the user's.
+ */
+function inferStubRole(messages: UIMessage[]): UIMessage["role"] {
+  const lastMessage = messages[messages.length - 1];
+  if (!lastMessage) return "user";
+  if (lastMessage.role === "user") return "assistant";
+  if (lastMessage.role === "assistant") return "user";
+  return "assistant";
+}
+
+function upsertPart(messages: UIMessage[], messageId: string, partId: string, next: UIMessage["parts"][number]) {
+  return messages.map((message) => {
+    if (message.id !== messageId) return message;
+    const index = message.parts.findIndex((part) =>
+      ("toolCallId" in part && part.toolCallId === partId) || getPartMetadataId(part) === partId,
+    );
+    if (index === -1) {
+      return { ...message, parts: [...message.parts, next] };
+    }
+    const parts = message.parts.slice();
+    parts[index] = next;
+    return { ...message, parts };
+  });
+}
+
+function appendDelta(messages: UIMessage[], messageId: string, partId: string, delta: string, reasoning: boolean) {
+  // Fast path: locate the target message by index, only clone that message
+  // and its parts array. The previous implementation ran messages.map AND
+  // message.parts.map on every delta event, which is O(N * P) per token.
+  // For an old session with hundreds of prior messages/parts that allocated
+  // thousands of objects per token and crushed the main thread after a
+  // handful of tokens.
+  const messageIndex = messages.findIndex((message) => message.id === messageId);
+  if (messageIndex === -1) return messages;
+
+  const target = messages[messageIndex]!;
+  const lastPart = target.parts[target.parts.length - 1];
+
+  let partIndex = -1;
+  for (let i = 0; i < target.parts.length; i++) {
+    const part = target.parts[i]!;
+    const id = getPartMetadataId(part);
+    if (reasoning && part.type === "reasoning") {
+      if (id === partId || (!id && part === lastPart)) {
+        partIndex = i;
+        break;
+      }
+    } else if (!reasoning && part.type === "text") {
+      if (id === partId || (!id && part === lastPart)) {
+        partIndex = i;
+        break;
+      }
+    }
+  }
+
+  let nextParts: UIMessage["parts"];
+  if (partIndex === -1) {
+    // No existing matching part — append a fresh one so the delta is not lost.
+    const newPart: UIMessage["parts"][number] = reasoning
+      ? {
+          type: "reasoning",
+          text: delta,
+          state: "streaming" as const,
+          providerMetadata: { opencode: { partId } },
+        }
+      : {
+          type: "text",
+          text: delta,
+          state: "streaming" as const,
+          providerMetadata: { opencode: { partId } },
+        };
+    nextParts = target.parts.slice();
+    nextParts.push(newPart);
+  } else {
+    const existing = target.parts[partIndex]!;
+    nextParts = target.parts.slice();
+    if (existing.type === "text") {
+      nextParts[partIndex] = {
+        ...existing,
+        text: `${existing.text}${delta}`,
+        state: "streaming",
+      };
+    } else if (existing.type === "reasoning") {
+      nextParts[partIndex] = {
+        ...existing,
+        text: `${existing.text}${delta}`,
+        state: "streaming",
+      };
+    }
+  }
+
+  const nextMessages = messages.slice();
+  nextMessages[messageIndex] = { ...target, parts: nextParts };
+  return nextMessages;
+}
+
+function applyEvent(entry: SyncEntry, workspaceId: string, event: OpencodeEvent) {
+  const queryClient = getReactQueryClient();
+
+  if (event.type === "session.status") {
+    const props = (event.properties ?? {}) as { sessionID?: string; status?: SessionStatus };
+    if (!props.sessionID || !props.status) return;
+    if (!isTrackedSession(entry, props.sessionID)) return;
+    queryClient.setQueryData(statusKey(workspaceId, props.sessionID), props.status);
+    return;
+  }
+
+  if (event.type === "todo.updated") {
+    const props = (event.properties ?? {}) as { sessionID?: string; todos?: Todo[] };
+    if (!props.sessionID || !props.todos) return;
+    if (!isTrackedSession(entry, props.sessionID)) return;
+    queryClient.setQueryData(todoKey(workspaceId, props.sessionID), props.todos);
+    return;
+  }
+
+  if (event.type === "permission.asked") {
+    const permission = event.properties as PermissionRequest;
+    if (!permission?.id || !permission.sessionID) return;
+    if (!isTrackedSession(entry, permission.sessionID)) return;
+    const receivedAt = Date.now();
+    queryClient.setQueryData<PendingPermission[]>(permissionKey(workspaceId, permission.sessionID), (current = []) => {
+      const existing = current.find((item) => item.id === permission.id);
+      const next = withReceivedAt(permission, existing?.receivedAt ?? receivedAt);
+      if (existing) {
+        return current.map((item) => (item.id === permission.id ? next : item)).sort(sortPermissions);
+      }
+      return [...current, next].sort(sortPermissions);
+    });
+    return;
+  }
+
+  if (event.type === "permission.replied") {
+    const props = (event.properties ?? {}) as { sessionID?: string; requestID?: string };
+    if (!props.sessionID || !props.requestID) return;
+    if (!isTrackedSession(entry, props.sessionID)) return;
+    queryClient.setQueryData<PendingPermission[]>(permissionKey(workspaceId, props.sessionID), (current = []) =>
+      current.filter((permission) => permission.id !== props.requestID),
+    );
+    return;
+  }
+
+  if (event.type === "message.updated") {
+    const props = (event.properties ?? {}) as { info?: { id?: string; role?: UIMessage["role"] | string; sessionID?: string } };
+    const info = props.info;
+    if (!info?.id || !info.sessionID || (info.role !== "user" && info.role !== "assistant" && info.role !== "system")) {
+      return;
+    }
+    if (!isTrackedSession(entry, info.sessionID)) return;
+    const next = { id: info.id, role: info.role, parts: [] } satisfies UIMessage;
+    queryClient.setQueryData<UIMessage[]>(transcriptKey(workspaceId, info.sessionID), (current = []) =>
+      upsertMessage(current, next),
+    );
+    return;
+  }
+
+  if (event.type === "message.part.updated") {
+    const props = (event.properties ?? {}) as { part?: Part };
+    const part = props.part;
+    if (!part?.sessionID || !part.messageID) return;
+    if (!isTrackedSession(entry, part.sessionID)) return;
+    const mapped = toUIPart(part);
+    if (!mapped) return;
+    const pending = entry.pendingDeltas.get(part.id);
+    const seededPart =
+      pending && ((mapped.type === "text" && !pending.reasoning) || (mapped.type === "reasoning" && pending.reasoning))
+        ? { ...mapped, text: `${mapped.text}${pending.text}`, state: "streaming" as const }
+        : mapped;
+    queryClient.setQueryData<UIMessage[]>(transcriptKey(workspaceId, part.sessionID), (current = []) => {
+      // If we already have this message, keep its role; otherwise infer
+      // from the alternation pattern. Only the newly-stubbed case needs
+      // the inference — upsertMessage preserves existing role when the
+      // stub's role matches what we'd write anyway, and any subsequent
+      // message.updated will overwrite both.
+      const existing = current.find((m) => m.id === part.messageID);
+      const role = existing?.role ?? inferStubRole(current);
+      const withMessage = upsertMessage(current, { id: part.messageID, role, parts: [] });
+      return upsertPart(withMessage, part.messageID, part.id, seededPart);
+    });
+    if (pending) entry.pendingDeltas.delete(part.id);
+    return;
+  }
+
+  if (event.type === "message.part.delta") {
+    const props = (event.properties ?? {}) as {
+      sessionID?: string;
+      messageID?: string;
+      partID?: string;
+      field?: string;
+      delta?: string;
+    };
+    if (!props.sessionID || !props.messageID || !props.partID || !props.delta) return;
+    if (!isTrackedSession(entry, props.sessionID)) return;
+    // Buffer this delta and let the frame flusher apply all queued deltas
+    // for this entry in a single setQueryData call per affected session.
+    entry.deltaFlushBuffer.push({
+      sessionId: props.sessionID!,
+      messageId: props.messageID!,
+      partId: props.partID!,
+      reasoning: props.field === "reasoning",
+      delta: props.delta!,
+    });
+    scheduleDeltaFlush(entry, workspaceId);
+    return;
+  }
+
+  if (event.type === "session.idle") {
+    const props = (event.properties ?? {}) as { sessionID?: string };
+    if (!props.sessionID) return;
+    if (!isTrackedSession(entry, props.sessionID)) return;
+    queryClient.setQueryData(statusKey(workspaceId, props.sessionID), idleStatus);
+  }
+}
+
+function scheduleDeltaFlush(entry: SyncEntry, workspaceId: string) {
+  if (entry.deltaFlushScheduled) return;
+  entry.deltaFlushScheduled = true;
+  const run = () => {
+    entry.deltaFlushScheduled = false;
+    if (entry.deltaFlushBuffer.length === 0) return;
+    flushDeltas(entry, workspaceId);
+  };
+  if (typeof window !== "undefined" && typeof window.requestAnimationFrame === "function") {
+    window.requestAnimationFrame(run);
+  } else {
+    queueMicrotask(run);
+  }
+}
+
+function flushDeltas(entry: SyncEntry, workspaceId: string) {
+  const queryClient = getReactQueryClient();
+  const pending = entry.deltaFlushBuffer;
+  entry.deltaFlushBuffer = [];
+
+  // Group by session id so each transcript cache is touched at most once
+  // per flush.
+  const bySession = new Map<string, PendingDelta[]>();
+  for (const item of pending) {
+    const bucket = bySession.get(item.sessionId);
+    if (bucket) bucket.push(item);
+    else bySession.set(item.sessionId, [item]);
+  }
+
+  for (const [sessionId, items] of bySession) {
+    queryClient.setQueryData<UIMessage[]>(
+      transcriptKey(workspaceId, sessionId),
+      (current = []) => {
+        let next = current;
+        // Track which message shells we've ensured exist this flush so we
+        // don't call upsertMessage for the same message on every delta.
+        const ensuredMessageIds = new Set<string>();
+        for (const item of items) {
+          if (!ensuredMessageIds.has(item.messageId)) {
+            // Preserve the existing role if the message is already in
+            // state; otherwise infer it from the alternation pattern
+            // so the brief "stub before message.updated" window doesn't
+            // mislabel the message's bubble style.
+            const existing = next.find((m) => m.id === item.messageId);
+            const role = existing?.role ?? inferStubRole(next);
+            next = upsertMessage(next, { id: item.messageId, role, parts: [] });
+            ensuredMessageIds.add(item.messageId);
+          }
+          next = appendDelta(next, item.messageId, item.partId, item.delta, item.reasoning);
+          // If the delta landed on a synthetic "no matching part" case, keep
+          // the text so a later message.part.updated event can stitch it.
+          const message = next.find((m) => m.id === item.messageId);
+          const matched = message?.parts.some((part) =>
+            (part.type === "dynamic-tool" && part.toolCallId === item.partId) ||
+              getPartMetadataId(part) === item.partId,
+          );
+          if (!matched) {
+            const existing = entry.pendingDeltas.get(item.partId) ?? {
+              messageId: item.messageId,
+              reasoning: item.reasoning,
+              text: "",
+            };
+            existing.text += item.delta;
+            entry.pendingDeltas.set(item.partId, existing);
+          }
+        }
+        return next;
+      },
+    );
+  }
+}
+
+function startSync(input: SyncOptions) {
+  const client = createClient(input.baseUrl, undefined, { token: input.openworkToken, mode: "openwork" });
+  const controller = new AbortController();
+  const entry = syncs.get(syncKey(input));
+  let disposed = false;
+  let retryTimer: ReturnType<typeof setTimeout> | null = null;
+  let retryDelayMs = 1_000;
+
+  const scheduleRetry = () => {
+    if (disposed || controller.signal.aborted || retryTimer) return;
+    retryTimer = setTimeout(() => {
+      retryTimer = null;
+      void connect();
+    }, retryDelayMs);
+    retryDelayMs = Math.min(retryDelayMs * 2, 10_000);
+  };
+
+  const connect = async () => {
+    try {
+      const sub = await client.event.subscribe(undefined, { signal: controller.signal });
+      retryDelayMs = 1_000;
+      for await (const raw of sub.stream) {
+        if (controller.signal.aborted) return;
+        const event = normalizeEvent(raw);
+        if (!event) continue;
+        if (!entry) continue;
+        applyEvent(entry, input.workspaceId, event);
+      }
+      if (!controller.signal.aborted) scheduleRetry();
+    } catch (error) {
+      if (!controller.signal.aborted && shouldRetrySyncSubscribe(error)) scheduleRetry();
+    }
+  };
+
+  void connect();
+
+  return () => {
+    disposed = true;
+    if (retryTimer) clearTimeout(retryTimer);
+    controller.abort();
+  };
+}
+
+export function ensureWorkspaceSessionSync(input: SyncOptions) {
+  const key = syncKey(input);
+  const existing = syncs.get(key);
+  if (existing) {
+    existing.refs += 1;
+    return () => releaseWorkspaceSessionSync(input);
+  }
+
+  syncs.set(key, {
+    refs: 1,
+    dispose: () => {},
+    trackedSessionRefs: new Map(),
+    pendingDeltas: new Map(),
+    deltaFlushBuffer: [],
+    deltaFlushScheduled: false,
+  });
+
+  const created = syncs.get(key)!;
+  created.dispose = startSync(input);
+
+  return () => releaseWorkspaceSessionSync(input);
+}
+
+function releaseWorkspaceSessionSync(input: SyncOptions) {
+  const key = syncKey(input);
+  const existing = syncs.get(key);
+  if (!existing) return;
+  existing.refs -= 1;
+  if (existing.refs > 0) return;
+  // Immediate disposal is important here: a single OpenCode runtime is shared
+  // across local workspaces, and keeping old workspace subscriptions alive for
+  // 10s means rapid workspace switches accumulate multiple parallel event
+  // streams. Under larger transcripts that duplicates cache writes and can make
+  // the UI feel frozen after a handful of switches.
+  existing.dispose();
+  syncs.delete(key);
+}
+
+export function seedSessionState(workspaceId: string, snapshot: OpenworkSessionSnapshot) {
+  const queryClient = getReactQueryClient();
+  const key = transcriptKey(workspaceId, snapshot.session.id);
+  const incoming = snapshotToUIMessages(snapshot);
+  const existing = queryClient.getQueryData<UIMessage[]>(key);
+
+  if (existing && existing.length > 0 && (snapshot.status.type === "busy" || snapshot.status.type === "retry")) {
+    // During active streaming the server snapshot may have empty/stale text
+    // for in-progress parts while the cache already accumulated text via
+    // deltas.  Merge so we never overwrite longer cached text with shorter
+    // server text.
+    const merged = mergeSnapshotIntoCachedMessages(incoming, existing);
+    queryClient.setQueryData(key, merged);
+  } else {
+    queryClient.setQueryData(key, incoming);
+  }
+
+  queryClient.setQueryData(statusKey(workspaceId, snapshot.session.id), snapshot.status);
+  queryClient.setQueryData(todoKey(workspaceId, snapshot.session.id), snapshot.todos);
+}
+
+export function trackWorkspaceSessionSync(input: SyncOptions, sessionId: string | null | undefined) {
+  const normalizedSessionId = sessionId?.trim() ?? "";
+  if (!normalizedSessionId) return () => {};
+
+  const entry = syncs.get(syncKey(input));
+  if (!entry) return () => {};
+
+  entry.trackedSessionRefs.set(
+    normalizedSessionId,
+    (entry.trackedSessionRefs.get(normalizedSessionId) ?? 0) + 1,
+  );
+
+  return () => {
+    const current = entry.trackedSessionRefs.get(normalizedSessionId) ?? 0;
+    if (current <= 1) {
+      entry.trackedSessionRefs.delete(normalizedSessionId);
+      entry.deltaFlushBuffer = entry.deltaFlushBuffer.filter(
+        (item) => item.sessionId !== normalizedSessionId,
+      );
+      const queryClient = getReactQueryClient();
+      queryClient.removeQueries({ queryKey: permissionKey(input.workspaceId, normalizedSessionId), exact: true });
+      return;
+    }
+    entry.trackedSessionRefs.set(normalizedSessionId, current - 1);
+  };
+}
diff --git a/apps/app/src/react-app/domains/session/sync/transition-controller.ts b/apps/app/src/react-app/domains/session/sync/transition-controller.ts
new file mode 100644
index 0000000000..fecc872f87
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/transition-controller.ts
@@ -0,0 +1,61 @@
+export type TransitionState = "idle" | "switching" | "recovering" | "failed";
+
+export type RenderSource = "cache" | "live" | "empty" | "error" | "recovering";
+
+export type SessionRenderModel = {
+  intendedSessionId: string;
+  renderedSessionId: string | null;
+  transitionState: TransitionState;
+  renderSource: RenderSource;
+};
+
+export function deriveSessionRenderModel(input: {
+  intendedSessionId: string;
+  renderedSessionId: string | null;
+  hasSnapshot: boolean;
+  isFetching: boolean;
+  isError: boolean;
+}): SessionRenderModel {
+  if (input.isError && input.renderedSessionId && input.renderedSessionId !== input.intendedSessionId) {
+    return {
+      intendedSessionId: input.intendedSessionId,
+      renderedSessionId: input.renderedSessionId,
+      transitionState: "recovering",
+      renderSource: "recovering",
+    };
+  }
+
+  if (input.isError) {
+    return {
+      intendedSessionId: input.intendedSessionId,
+      renderedSessionId: input.renderedSessionId,
+      transitionState: "failed",
+      renderSource: "error",
+    };
+  }
+
+  if (input.renderedSessionId && input.renderedSessionId !== input.intendedSessionId) {
+    return {
+      intendedSessionId: input.intendedSessionId,
+      renderedSessionId: input.renderedSessionId,
+      transitionState: "switching",
+      renderSource: "cache",
+    };
+  }
+
+  if (!input.hasSnapshot) {
+    return {
+      intendedSessionId: input.intendedSessionId,
+      renderedSessionId: input.renderedSessionId,
+      transitionState: input.isFetching ? "switching" : "idle",
+      renderSource: "empty",
+    };
+  }
+
+  return {
+    intendedSessionId: input.intendedSessionId,
+    renderedSessionId: input.renderedSessionId,
+    transitionState: input.isFetching ? "switching" : "idle",
+    renderSource: "live",
+  };
+}
diff --git a/apps/app/src/react-app/domains/session/sync/usechat-adapter.ts b/apps/app/src/react-app/domains/session/sync/usechat-adapter.ts
new file mode 100644
index 0000000000..5f7a75662c
--- /dev/null
+++ b/apps/app/src/react-app/domains/session/sync/usechat-adapter.ts
@@ -0,0 +1,444 @@
+/** @jsxImportSource react */
+import type { UIMessage, UIMessageChunk, ChatTransport, DynamicToolUIPart } from "ai";
+import type { Part } from "@opencode-ai/sdk/v2/client";
+
+import { abortSessionSafe } from "../../../../app/lib/opencode-session";
+import type { OpenworkSessionMessage, OpenworkSessionSnapshot } from "../../../../app/lib/openwork-server";
+import { normalizeEvent, safeStringify } from "../../../../app/utils";
+import type { OpencodeEvent } from "../../../../app/types";
+import { createClient } from "../../../../app/lib/opencode";
+
+type TransportOptions = {
+  baseUrl: string;
+  openworkToken: string;
+  sessionId: string;
+};
+
+type ToolStreamState = {
+  inputSent: boolean;
+  outputSent: boolean;
+  errorSent: boolean;
+  stepStarted: boolean;
+  stepFinished: boolean;
+};
+
+type InternalPartState = {
+  textStarted: Set<string>;
+  reasoningStarted: Set<string>;
+  partKinds: Map<string, Part["type"]>;
+  partSessions: Map<string, string>;
+  tools: Map<string, ToolStreamState>;
+  assistantMessageId: string | null;
+  streamFinished: boolean;
+};
+
+function getTextPartValue(part: Part) {
+  if (part.type === "text") {
+    return typeof (part as { text?: unknown }).text === "string" ? (part as { text: string }).text : "";
+  }
+  if (part.type === "reasoning") {
+    return typeof (part as { text?: unknown }).text === "string" ? (part as { text: string }).text : "";
+  }
+  return "";
+}
+
+function mapToolPart(part: Part): DynamicToolUIPart {
+  const record = part as Part & { tool?: string; state?: Record<string, unknown> };
+  const state = (record.state ?? {}) as Record<string, unknown>;
+  const toolName = typeof record.tool === "string" ? record.tool : "tool";
+  const input = state.input;
+  const output = state.output;
+  const errorText = typeof state.error === "string" ? state.error : undefined;
+
+  if (errorText) {
+    return {
+      type: "dynamic-tool",
+      toolName,
+      toolCallId: part.id,
+      state: "output-error",
+      input,
+      errorText,
+    };
+  }
+
+  if (output !== undefined) {
+    return {
+      type: "dynamic-tool",
+      toolName,
+      toolCallId: part.id,
+      state: "output-available",
+      input,
+      output,
+    };
+  }
+
+  return {
+    type: "dynamic-tool",
+    toolName,
+    toolCallId: part.id,
+    state: "input-available",
+    input,
+  };
+}
+
+export function snapshotToUIMessages(snapshot: OpenworkSessionSnapshot): UIMessage[] {
+  return snapshot.messages.map((message) => ({
+    id: message.info.id,
+    role: message.info.role,
+    parts: message.parts.flatMap<UIMessage["parts"][number]>((part) => {
+      if (part.type === "text") {
+        return [{
+          type: "text",
+          text: getTextPartValue(part),
+          state: "done" as const,
+          providerMetadata: { opencode: { partId: part.id } },
+        }];
+      }
+      if (part.type === "reasoning") {
+        return [{
+          type: "reasoning",
+          text: getTextPartValue(part),
+          state: "done" as const,
+          providerMetadata: { opencode: { partId: part.id } },
+        }];
+      }
+      if (part.type === "file") {
+        const record = part as Part & { url?: string; filename?: string; mime?: string };
+        return record.url
+          ? [{
+              type: "file",
+              url: record.url,
+              filename: record.filename,
+              mediaType: record.mime ?? "application/octet-stream",
+              providerMetadata: { opencode: { partId: part.id } },
+            }]
+          : [];
+      }
+      if (part.type === "tool") {
+        return [{ ...mapToolPart(part), providerMetadata: { opencode: { partId: part.id } } }];
+      }
+      if (part.type === "step-start") {
+        return [{ type: "step-start", providerMetadata: { opencode: { partId: part.id } } }];
+      }
+      return [];
+    }),
+  }));
+}
+
+function extractLastUserText(messages: UIMessage[]) {
+  const lastUser = [...messages].reverse().find((message) => message.role === "user");
+  if (!lastUser) return "";
+  return lastUser.parts
+    .flatMap((part) => {
+      if (part.type === "text") return [part.text];
+      return [];
+    })
+    .join("")
+    .trim();
+}
+
+function createPartState(): InternalPartState {
+  return {
+    textStarted: new Set<string>(),
+    reasoningStarted: new Set<string>(),
+    partKinds: new Map<string, Part["type"]>(),
+    partSessions: new Map<string, string>(),
+    tools: new Map<string, ToolStreamState>(),
+    assistantMessageId: null,
+    streamFinished: false,
+  };
+}
+
+function ensureAssistantStart(
+  controller: ReadableStreamDefaultController<UIMessageChunk>,
+  state: InternalPartState,
+  messageId: string,
+) {
+  if (state.assistantMessageId) return;
+  state.assistantMessageId = messageId;
+  controller.enqueue({ type: "start", messageId });
+}
+
+function finalizeOpenParts(
+  controller: ReadableStreamDefaultController<UIMessageChunk>,
+  state: InternalPartState,
+) {
+  for (const id of state.textStarted) {
+    controller.enqueue({ type: "text-end", id });
+  }
+  for (const id of state.reasoningStarted) {
+    controller.enqueue({ type: "reasoning-end", id });
+  }
+  state.textStarted.clear();
+  state.reasoningStarted.clear();
+}
+
+function handleToolPart(
+  controller: ReadableStreamDefaultController<UIMessageChunk>,
+  state: InternalPartState,
+  part: Part,
+) {
+  const record = part as Part & { tool?: string; state?: Record<string, unknown> };
+  const toolName = typeof record.tool === "string" ? record.tool : "tool";
+  const toolState = state.tools.get(part.id) ?? {
+    inputSent: false,
+    outputSent: false,
+    errorSent: false,
+    stepStarted: false,
+    stepFinished: false,
+  };
+  const current = (record.state ?? {}) as Record<string, unknown>;
+
+  if (!toolState.stepStarted) {
+    controller.enqueue({ type: "start-step" });
+    toolState.stepStarted = true;
+  }
+
+  if (!toolState.inputSent) {
+    controller.enqueue({
+      type: "tool-input-available",
+      toolCallId: part.id,
+      toolName,
+      input: current.input,
+    });
+    toolState.inputSent = true;
+  }
+
+  if (!toolState.errorSent && typeof current.error === "string" && current.error.trim()) {
+    controller.enqueue({
+      type: "tool-output-error",
+      toolCallId: part.id,
+      errorText: current.error,
+    });
+    toolState.errorSent = true;
+    if (!toolState.stepFinished) {
+      controller.enqueue({ type: "finish-step" });
+      toolState.stepFinished = true;
+    }
+  } else if (!toolState.outputSent && current.output !== undefined) {
+    controller.enqueue({
+      type: "tool-output-available",
+      toolCallId: part.id,
+      output: current.output,
+    });
+    toolState.outputSent = true;
+    if (!toolState.stepFinished) {
+      controller.enqueue({ type: "finish-step" });
+      toolState.stepFinished = true;
+    }
+  }
+
+  state.tools.set(part.id, toolState);
+}
+
+function handleEventChunk(
+  controller: ReadableStreamDefaultController<UIMessageChunk>,
+  state: InternalPartState,
+  event: OpencodeEvent,
+  sessionId: string,
+) {
+  if (state.streamFinished) return;
+
+  if (event.type === "session.error") {
+    const record = (event.properties ?? {}) as Record<string, unknown>;
+    if (record.sessionID !== sessionId) return;
+    const errorObj = record.error;
+    const errorText =
+      typeof errorObj === "object" && errorObj && "message" in (errorObj as Record<string, unknown>)
+        ? String((errorObj as Record<string, unknown>).message ?? "")
+        : typeof record.error === "string"
+          ? record.error
+          : "Session failed";
+    finalizeOpenParts(controller, state);
+    controller.enqueue({ type: "error", errorText: errorText || "Session failed" });
+    controller.enqueue({ type: "finish", finishReason: "error" });
+    state.streamFinished = true;
+    controller.close();
+    return;
+  }
+
+  if (event.type === "session.idle") {
+    const record = (event.properties ?? {}) as Record<string, unknown>;
+    if (record.sessionID !== sessionId) return;
+    finalizeOpenParts(controller, state);
+    controller.enqueue({ type: "finish", finishReason: "stop" });
+    state.streamFinished = true;
+    controller.close();
+    return;
+  }
+
+  if (event.type === "message.updated") {
+    const record = (event.properties ?? {}) as Record<string, unknown>;
+    const info = record.info as { id?: string; role?: string; sessionID?: string } | undefined;
+    if (!info || info.sessionID !== sessionId || info.role !== "assistant" || typeof info.id !== "string") {
+      return;
+    }
+    ensureAssistantStart(controller, state, info.id);
+    return;
+  }
+
+  if (event.type === "message.part.updated") {
+    const record = (event.properties ?? {}) as Record<string, unknown>;
+    const part = record.part as Part | undefined;
+    const delta = typeof record.delta === "string" ? record.delta : "";
+    if (!part || part.sessionID !== sessionId) return;
+
+    ensureAssistantStart(controller, state, part.messageID);
+    state.partKinds.set(part.id, part.type);
+    state.partSessions.set(part.id, part.sessionID);
+
+    if (part.type === "text") {
+      if (!state.textStarted.has(part.id)) {
+        state.textStarted.add(part.id);
+        controller.enqueue({ type: "text-start", id: part.id });
+        const initial = delta || getTextPartValue(part);
+        if (initial) controller.enqueue({ type: "text-delta", id: part.id, delta: initial });
+      }
+      return;
+    }
+
+    if (part.type === "reasoning") {
+      if (!state.reasoningStarted.has(part.id)) {
+        state.reasoningStarted.add(part.id);
+        controller.enqueue({ type: "reasoning-start", id: part.id });
+        const initial = delta || getTextPartValue(part);
+        if (initial) controller.enqueue({ type: "reasoning-delta", id: part.id, delta: initial });
+      }
+      return;
+    }
+
+    if (part.type === "tool") {
+      handleToolPart(controller, state, part);
+      return;
+    }
+
+    if (part.type === "file") {
+      const file = part as Part & { url?: string; mime?: string };
+      if (file.url && file.mime) {
+        controller.enqueue({ type: "file", url: file.url, mediaType: file.mime });
+      }
+    }
+    return;
+  }
+
+  if (event.type === "message.part.delta") {
+    const record = (event.properties ?? {}) as Record<string, unknown>;
+    const messageID = typeof record.messageID === "string" ? record.messageID : null;
+    const partID = typeof record.partID === "string" ? record.partID : null;
+    const recordSessionID = typeof record.sessionID === "string" ? record.sessionID : null;
+    const field = typeof record.field === "string" ? record.field : null;
+    const delta = typeof record.delta === "string" ? record.delta : "";
+    if (!messageID || !partID || !field || !delta) return;
+
+    const ownerSessionID = recordSessionID ?? state.partSessions.get(partID) ?? null;
+    if (ownerSessionID !== sessionId) return;
+
+    ensureAssistantStart(controller, state, messageID);
+
+    const kind = state.partKinds.get(partID);
+    if (field === "text" && kind === "reasoning") {
+      if (!state.reasoningStarted.has(partID)) {
+        state.reasoningStarted.add(partID);
+        controller.enqueue({ type: "reasoning-start", id: partID });
+      }
+      controller.enqueue({ type: "reasoning-delta", id: partID, delta });
+      return;
+    }
+
+    if (field === "text") {
+      if (!state.textStarted.has(partID)) {
+        state.textStarted.add(partID);
+        controller.enqueue({ type: "text-start", id: partID });
+      }
+      controller.enqueue({ type: "text-delta", id: partID, delta });
+      return;
+    }
+
+  }
+}
+
+export function createOpenworkChatTransport(options: TransportOptions): ChatTransport<UIMessage> {
+  return {
+    async sendMessages({ messages, abortSignal }) {
+      const client = createClient(options.baseUrl, {
+        token: options.openworkToken,
+        mode: "openwork",
+      });
+
+      return new ReadableStream<UIMessageChunk>({
+        async start(controller) {
+          const state = createPartState();
+          const lastUserText = extractLastUserText(messages);
+
+          if (!lastUserText) {
+            controller.enqueue({ type: "error", errorText: "No user message to send." });
+            controller.close();
+            return;
+          }
+
+          let closed = false;
+          const close = () => {
+            if (closed) return;
+            closed = true;
+            controller.close();
+          };
+
+          abortSignal?.addEventListener("abort", () => {
+            void abortSessionSafe(client, options.sessionId).finally(() => {
+              if (!state.streamFinished) {
+                controller.enqueue({ type: "abort", reason: "user cancelled" });
+              }
+              close();
+            });
+          });
+
+          try {
+            const sub = await client.event.subscribe(undefined, { signal: abortSignal });
+
+            const consume = (async () => {
+              for await (const raw of sub.stream) {
+                if (closed) return;
+                const event = normalizeEvent(raw);
+                if (!event) continue;
+                handleEventChunk(controller, state, event, options.sessionId);
+                if (state.streamFinished) return;
+              }
+            })();
+
+            const result = await client.session.promptAsync({
+              sessionID: options.sessionId,
+              parts: [{ type: "text", text: lastUserText }],
+            });
+            if (result.error) {
+              throw new Error(
+                result.error instanceof Error ? result.error.message : safeStringify(result.error),
+              );
+            }
+
+            await consume;
+            if (!state.streamFinished && !closed) {
+              finalizeOpenParts(controller, state);
+              controller.enqueue({ type: "finish", finishReason: "stop" });
+              close();
+            }
+          } catch (error) {
+            if (closed) return;
+            finalizeOpenParts(controller, state);
+            controller.enqueue({
+              type: "error",
+              errorText: error instanceof Error ? error.message : "Failed to stream response.",
+            });
+            close();
+          }
+        },
+        async cancel() {
+          await abortSessionSafe(client, options.sessionId);
+        },
+      });
+    },
+
+    async reconnectToStream() {
+      return null;
+    },
+  };
+}
diff --git a/apps/app/src/react-app/domains/settings/cloud/cloud-account-section.tsx b/apps/app/src/react-app/domains/settings/cloud/cloud-account-section.tsx
new file mode 100644
index 0000000000..cb6feba729
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/cloud/cloud-account-section.tsx
@@ -0,0 +1,129 @@
+/** @jsxImportSource react */
+import { LogOut } from "lucide-react";
+
+import type { DenOrgSummary, DenUser } from "../../../../app/lib/den";
+import { Button } from "@/components/ui/button";
+import {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import {
+  RefreshButton,
+  SettingsNotice,
+  SettingsSectionHeaderDescription,
+} from "../settings-section";
+import { t } from "@/i18n";
+
+export interface CloudAccountSectionProps {
+  activeOrgId: string;
+  authBusy: boolean;
+  orgs: DenOrgSummary[];
+  orgsBusy: boolean;
+  orgsError: string | null;
+  sessionBusy: boolean;
+  user: DenUser | null;
+  onActiveOrgChange: (orgId: string) => void;
+  onRefreshOrgs: () => void | Promise<void>;
+  onSignOut: () => void | Promise<void>;
+}
+
+export function CloudAccountSection({
+  activeOrgId,
+  authBusy,
+  orgs,
+  orgsBusy,
+  orgsError,
+  sessionBusy,
+  user,
+  onActiveOrgChange,
+  onRefreshOrgs,
+  onSignOut,
+}: CloudAccountSectionProps) {
+  const activeOrgOptions = orgs.map((org) => ({
+    value: org.id,
+    label: `${org.name} ${org.role === "owner" ? t("den.org_owner_suffix") : t("den.org_member_suffix")}`,
+  }));
+  const handleActiveOrgChange = (orgId: string | null) => {
+    if (orgId === null) {
+      return;
+    }
+
+    onActiveOrgChange(orgId);
+  };
+
+  return (
+    <section className="flex flex-col gap-y-8">
+      <div>
+        <div className="text-sm font-medium text-dls-text">{t("den.cloud_account_title")}</div>
+        <SettingsSectionHeaderDescription>{t("den.cloud_account_hint")}</SettingsSectionHeaderDescription>
+      </div>
+
+      <div className="flex flex-col gap-8">
+        <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+          <div className="min-w-0 flex flex-col gap-y-1">
+            <div className="truncate text-sm font-medium text-dls-text">
+              {user?.name ? user.name : user?.email}
+            </div>
+            <div className="truncate text-xs text-muted-foreground">{user?.email}</div>
+          </div>
+          <Button
+            variant="outline"
+            size="sm"
+            className="shrink-0"
+            onClick={() => void onSignOut()}
+            disabled={[authBusy, sessionBusy].some(Boolean)}
+          >
+            <LogOut className="size-4" />
+            {authBusy ? t("den.signing_out") : t("den.sign_out")}
+          </Button>
+        </div>
+
+        <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+          <div className="min-w-0 flex flex-col gap-y-1">
+            <div className="text-sm font-medium text-dls-text">{t("den.active_org_title")}</div>
+            <div className=" text-xs text-muted-foreground">{t("den.active_org_hint")}</div>
+          </div>
+          <div className="flex shrink-0 items-center gap-2">
+            <div className="w-[260px] max-w-full">
+              <Select
+                value={activeOrgId}
+                items={activeOrgOptions}
+                onValueChange={handleActiveOrgChange}
+                disabled={[orgsBusy, orgs.length === 0].some(Boolean)}
+              >
+                <SelectTrigger
+                  className="w-full"
+                  aria-label={t("den.active_org_title")}
+                >
+                  <SelectValue placeholder={t("den.no_org_selected")} />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectGroup>
+                    {activeOrgOptions.map((org) => (
+                      <SelectItem key={org.value} value={org.value}>
+                        {org.label}
+                      </SelectItem>
+                    ))}
+                  </SelectGroup>
+                </SelectContent>
+              </Select>
+            </div>
+            <RefreshButton
+              busy={orgsBusy}
+              disabled={orgsBusy}
+              onRefresh={onRefreshOrgs}
+            >
+              {t("den.refresh")}
+            </RefreshButton>
+          </div>
+        </div>
+      </div>
+
+      {orgsError ? <SettingsNotice tone="error">{orgsError}</SettingsNotice> : null}
+    </section>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/cloud/dev-mode.tsx b/apps/app/src/react-app/domains/settings/cloud/dev-mode.tsx
new file mode 100644
index 0000000000..2471803fab
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/cloud/dev-mode.tsx
@@ -0,0 +1,56 @@
+/** @jsxImportSource react */
+import { ArrowUpRight } from "lucide-react";
+
+import { DEFAULT_DEN_BASE_URL } from "../../../../app/lib/den";
+import { Button } from "../../../design-system/button";
+import { TextInput } from "../../../design-system/text-input";
+import { t } from "@/i18n";
+
+type CloudDevModeProps = {
+  authBusy: boolean;
+  baseUrlDraft: string;
+  onApplyBaseUrl: () => void;
+  onBaseUrlDraftChange: (value: string) => void;
+  onOpenControlPlane: () => void;
+  onResetBaseUrl: () => void;
+  sessionBusy: boolean;
+};
+
+export function CloudDevMode(props: CloudDevModeProps) {
+  const controlsDisabled = [props.authBusy, props.sessionBusy].some(Boolean);
+
+  return (
+    <div className="grid gap-3 lg:grid-cols-[minmax(0,1fr)_auto] lg:items-end">
+      <TextInput
+        label={t("den.cloud_control_plane_url_label")}
+        value={props.baseUrlDraft}
+        onChange={(event) => props.onBaseUrlDraftChange(event.currentTarget.value)}
+        placeholder={DEFAULT_DEN_BASE_URL}
+        hint={t("den.cloud_control_plane_url_hint")}
+        disabled={controlsDisabled}
+      />
+      <div className="flex flex-wrap items-center gap-2">
+        <Button
+          variant="outline"
+          className="h-9 px-3 text-xs"
+          onClick={props.onResetBaseUrl}
+          disabled={controlsDisabled}
+        >
+          {t("den.cloud_control_plane_reset")}
+        </Button>
+        <Button
+          variant="secondary"
+          className="h-9 px-3 text-xs"
+          onClick={props.onApplyBaseUrl}
+          disabled={controlsDisabled}
+        >
+          {t("den.cloud_control_plane_save")}
+        </Button>
+        <Button variant="outline" className="h-9 px-3 text-xs" onClick={props.onOpenControlPlane}>
+          {t("den.cloud_control_plane_open")}
+          <ArrowUpRight size={13} />
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/cloud/sections.tsx b/apps/app/src/react-app/domains/settings/cloud/sections.tsx
new file mode 100644
index 0000000000..049fa66b0f
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/cloud/sections.tsx
@@ -0,0 +1,1114 @@
+/** @jsxImportSource react */
+import type { CloudImportedPlugin, CloudImportedProvider, CloudImportedSkill, CloudImportedSkillHub } from "../../../../app/cloud/import-state";
+import type {
+  DenOrgMarketplaceResolved,
+  DenOrgLlmProvider,
+  DenOrgPlugin,
+  DenOrgSkillHub,
+} from "../../../../app/lib/den";
+import type { DenOrgSkillCard } from "../../../../app/types";
+import { Field, FieldDescription, FieldLabel } from "@/components/ui/field";
+import { cva } from "class-variance-authority";
+import fuzzysort from "fuzzysort";
+import * as React from "react";
+import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "@/components/ui/accordion";
+import { Button } from "@/components/ui/button";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import {
+  RefreshButton,
+  SettingsSection,
+  SettingsNotice,
+  SettingsPill,
+  SettingsSectionHeader,
+  SettingsSectionHeaderActions,
+  SettingsSectionHeaderContent,
+  SettingsSectionHeaderDescription,
+  SettingsSectionHeaderTitle,
+} from "../settings-section";
+import {
+  SettingsList,
+  SettingsListItemActions,
+  SettingsListEmptyState,
+  SettingsListItem,
+  SettingsListItemContent,
+  SettingsListItemDescription,
+  SettingsListTitle,
+  SettingsListItemTitle,
+  SettingsListSearchInput,
+} from "../settings-list";
+import { t } from "@/i18n";
+
+type ResourceActionKind = "import" | "remove" | "sync";
+
+export type CloudSkillHubRow = {
+  key: string;
+  hubId: string;
+  name: string;
+  hub: DenOrgSkillHub | null;
+  imported: CloudImportedSkillHub | null;
+  status: "available" | "imported" | "out_of_sync" | "removed_from_cloud";
+  liveSkillCount: number;
+  importedSkillCount: number;
+};
+
+export type CloudProviderRow = {
+  key: string;
+  cloudProviderId: string;
+  provider: DenOrgLlmProvider | null;
+  imported: CloudImportedProvider | null;
+  status: "available" | "imported" | "out_of_sync" | "removed_from_cloud";
+  name: string;
+};
+
+export type CloudSkillRow = {
+  key: string;
+  cloudSkillId: string;
+  skill: DenOrgSkillCard | null;
+  imported: CloudImportedSkill | null;
+  status: "available" | "installed" | "out_of_sync" | "removed_from_cloud";
+  title: string;
+  installedName: string | null;
+};
+
+export type CloudPluginRow = {
+  marketplaceId: string;
+  plugin: DenOrgPlugin;
+  imported: CloudImportedPlugin | null;
+  status: "available" | "imported" | "out_of_sync";
+};
+
+export type CloudWorker = {
+  workerId: string;
+  workerName: string;
+  status: string;
+  instanceUrl: string | null;
+  provider: string | null;
+  isMine: boolean;
+  createdAt: string | null;
+};
+
+const statusBadgeVariants = cva("", {
+  variants: {
+    tone: {
+      ready: "border-green-7/30 bg-green-3/20 text-green-11",
+      warning: "border-amber-7/30 bg-amber-3/20 text-amber-11",
+      error: "border-red-7/30 bg-red-3/20 text-red-11",
+      neutral: "border-gray-6/60 bg-gray-3/20 text-gray-11",
+    },
+  },
+});
+
+const skillSearchKeys = ["title"];
+const pluginSearchKeys = ["plugin.name"];
+const workerSearchKeys = ["workerName"];
+const nameSearchKeys = ["name"];
+
+function resourceStatusTone(status: string) {
+  switch (status) {
+    case "installed":
+    case "imported":
+      return "ready" as const;
+    case "out_of_sync":
+      return "warning" as const;
+    case "removed_from_cloud":
+      return "error" as const;
+    default:
+      return "neutral" as const;
+  }
+}
+
+function workerStatusValue(status: string) {
+  return status.trim().toLowerCase() || "unknown";
+}
+
+function workerStatusMeta(status: string) {
+  const normalized = workerStatusValue(status);
+
+  switch (normalized) {
+    case "healthy":
+      return { label: t("dashboard.worker_status_ready"), tone: "ready" as const, canOpen: true };
+    case "provisioning":
+      return { label: t("dashboard.worker_status_starting"), tone: "warning" as const, canOpen: false };
+    case "failed":
+      return { label: t("dashboard.worker_status_attention"), tone: "error" as const, canOpen: false };
+    case "stopped":
+      return { label: t("dashboard.worker_status_stopped"), tone: "neutral" as const, canOpen: false };
+    default:
+      return {
+        label: normalized
+          ? `${normalized.slice(0, 1).toUpperCase()}${normalized.slice(1)}`
+          : t("dashboard.worker_status_unknown"),
+        tone: "neutral" as const,
+        canOpen: normalized === "ready",
+      };
+  }
+}
+
+interface UseSearchProps<T> {
+  items: T[];
+  keys: string[];
+  query: string;
+}
+
+function useSearch<T>({ items, keys, query }: UseSearchProps<T>) {
+  return React.useMemo(() => {
+    if (!query.trim()) {
+      return items;
+    }
+
+    return fuzzysort.go(query, items, { keys }).map((result) => result.obj);
+  }, [items, keys, query]);
+}
+
+interface CloudSkillListItemProps {
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  row: CloudSkillRow;
+  onImportSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+  onRemoveSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+  onSyncSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+}
+
+function CloudSkillListItem({
+  actionId,
+  actionKind,
+  row,
+  onImportSkill,
+  onRemoveSkill,
+  onSyncSkill,
+}: CloudSkillListItemProps) {
+  const actionBusy = actionId === row.cloudSkillId;
+  const actionLabel = !actionBusy
+    ? null
+    : actionKind === "import"
+      ? t("den.importing")
+      : actionKind === "sync"
+        ? t("den.syncing")
+        : t("den.removing");
+
+  return (
+    <SettingsListItem>
+      <SettingsListItemContent>
+        <SettingsListTitle>
+          <SettingsListItemTitle>{row.title}</SettingsListItemTitle>
+          {row.skill?.hubName ? <SettingsPill>{t("skills.cloud_hub_label", { name: row.skill.hubName })}</SettingsPill> : null}
+          {row.skill?.shared === "public" ? <SettingsPill>{t("skills.cloud_shared_public")}</SettingsPill> : null}
+          {row.skill?.shared === null && !row.skill?.hubName ? <SettingsPill>{t("den.private_badge")}</SettingsPill> : null}
+          {row.installedName ? <SettingsPill>{t("den.installed_name_badge", { name: row.installedName })}</SettingsPill> : null}
+          {row.status !== "available" ? (
+            <SettingsPill className={statusBadgeVariants({ tone: resourceStatusTone(row.status) })}>
+              {row.status === "installed"
+                ? t("den.imported_badge")
+                : row.status === "out_of_sync"
+                  ? t("den.out_of_sync_badge")
+                  : t("den.removed_from_cloud_badge")}
+            </SettingsPill>
+          ) : null}
+        </SettingsListTitle>
+        <SettingsListItemDescription>
+          {row.status === "available"
+            ? t("den.cloud_skill_detail", { title: row.title })
+            : row.status === "installed"
+              ? t("den.cloud_skill_imported_detail", { name: row.installedName ?? row.title })
+              : row.status === "out_of_sync"
+                ? t("den.cloud_skill_sync_detail", { name: row.installedName ?? row.title })
+                : t("den.cloud_skill_removed_detail", { name: row.installedName ?? row.title })}
+        </SettingsListItemDescription>
+      </SettingsListItemContent>
+      <SettingsListItemActions>
+        {row.status === "out_of_sync" && row.skill ? (
+          <Button
+            variant="secondary"
+            size="sm"
+            onClick={() => void onSyncSkill(row.cloudSkillId, row.title)}
+            disabled={actionId !== null}
+          >
+            {actionBusy && actionKind === "sync" ? t("den.syncing") : t("den.sync")}
+          </Button>
+        ) : null}
+        {row.status === "available" && row.skill ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void onImportSkill(row.cloudSkillId, row.title)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : t("den.import_skill")}
+          </Button>
+        ) : null}
+        {row.status !== "available" ? (
+          <Button
+            variant="destructive"
+            size="sm"
+            onClick={() => void onRemoveSkill(row.cloudSkillId, row.title)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : t("den.uninstall")}
+          </Button>
+        ) : null}
+      </SettingsListItemActions>
+    </SettingsListItem>
+  );
+}
+
+interface MarketplacePluginListItemProps {
+  actionId: string | null;
+  row: CloudPluginRow;
+  onImportPlugin: (marketplaceId: string | null, plugin: DenOrgPlugin) => void | Promise<void>;
+}
+
+function MarketplacePluginListItem({
+  actionId,
+  row,
+  onImportPlugin,
+}: MarketplacePluginListItemProps) {
+  const actionBusy = actionId === row.plugin.id;
+  const counts = Object.entries(row.plugin.componentCounts)
+    .filter(([, count]) => count > 0)
+    .map(([type, count]) => `${count} ${type}${count === 1 ? "" : "s"}`);
+
+  return (
+    <SettingsListItem>
+      <SettingsListItemContent>
+        <SettingsListTitle>
+          <SettingsListItemTitle>{row.plugin.name}</SettingsListItemTitle>
+          {row.status !== "available" ? (
+            <SettingsPill className={statusBadgeVariants({ tone: resourceStatusTone(row.status) })}>
+              {row.status === "imported" ? t("den.imported_badge") : t("den.out_of_sync_badge")}
+            </SettingsPill>
+          ) : null}
+          {counts.map((label) => (
+            <SettingsPill key={label}>{label}</SettingsPill>
+          ))}
+        </SettingsListTitle>
+        <SettingsListItemDescription>
+          {row.plugin.description || "No description provided."}
+        </SettingsListItemDescription>
+        {row.imported?.files.length ? (
+          <div className="mt-1 truncate text-xs text-muted-foreground">
+            Installed files: {row.imported.files.map((file) => file.path).join(", ")}
+          </div>
+        ) : null}
+      </SettingsListItemContent>
+      <Button
+        variant="outline"
+        size="sm"
+        onClick={() => void onImportPlugin(row.marketplaceId, row.plugin)}
+        disabled={actionId !== null}
+      >
+        {actionBusy ? t("den.importing") : row.status === "available" ? t("den.import_provider") : t("den.sync")}
+      </Button>
+    </SettingsListItem>
+  );
+}
+
+interface CloudWorkerListItemProps {
+  openingWorkerId: string | null;
+  worker: CloudWorker;
+  onOpenWorker: (workerId: string, workerName: string) => void | Promise<void>;
+}
+
+function CloudWorkerListItem({ openingWorkerId, worker, onOpenWorker }: CloudWorkerListItemProps) {
+  const status = workerStatusMeta(worker.status);
+
+  return (
+    <SettingsListItem>
+      <SettingsListItemContent>
+        <SettingsListTitle>
+          <SettingsListItemTitle>{worker.workerName}</SettingsListItemTitle>
+          <SettingsPill className={statusBadgeVariants({ tone: status.tone })}>
+            {status.label}
+          </SettingsPill>
+        </SettingsListTitle>
+        <SettingsListItemDescription>
+          {[
+            worker.isMine ? t("den.worker_mine_badge") : null,
+            worker.provider ? t("den.worker_provider_label", { provider: worker.provider }) : t("den.worker_secondary_cloud"),
+            worker.instanceUrl,
+          ].filter(Boolean).join(" · ")}
+        </SettingsListItemDescription>
+      </SettingsListItemContent>
+      <Button
+        variant="outline"
+        size="sm"
+        onClick={() => void onOpenWorker(worker.workerId, worker.workerName)}
+        disabled={[openingWorkerId !== null, !status.canOpen].some(Boolean)}
+        title={!status.canOpen ? t("den.worker_not_ready_title") : undefined}
+      >
+        {openingWorkerId === worker.workerId ? t("den.opening") : t("den.open")}
+      </Button>
+    </SettingsListItem>
+  );
+}
+
+interface SkillHubListItemProps {
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  row: CloudSkillHubRow;
+  onImport: (hubId: string) => void | Promise<void>;
+  onRemove: (hubId: string) => void | Promise<void>;
+  onSync: (hubId: string) => void | Promise<void>;
+}
+
+function SkillHubListItem({ actionId, actionKind, row, onImport, onRemove, onSync }: SkillHubListItemProps) {
+  const actionBusy = actionId === row.hubId;
+  const actionLabel = !actionBusy
+    ? null
+    : actionKind === "import"
+      ? t("den.importing")
+      : actionKind === "sync"
+        ? t("den.syncing")
+        : t("den.removing");
+
+  return (
+    <SettingsListItem>
+      <SettingsListItemContent>
+        <SettingsListTitle>
+          <SettingsListItemTitle>{row.name}</SettingsListItemTitle>
+          <SettingsPill>
+            {t("den.skill_hub_skills_badge", {
+              count: row.hub?.skills.length ?? row.importedSkillCount,
+            })}
+          </SettingsPill>
+          {row.status !== "available" ? (
+            <SettingsPill className={statusBadgeVariants({ tone: resourceStatusTone(row.status) })}>
+              {row.status === "imported"
+                ? t("den.imported_badge")
+                : row.status === "out_of_sync"
+                  ? t("den.out_of_sync_badge")
+                  : t("den.removed_from_cloud_badge")}
+            </SettingsPill>
+          ) : null}
+        </SettingsListTitle>
+        <SettingsListItemDescription>
+          {row.status === "available"
+            ? t("den.skill_hub_detail", { count: row.liveSkillCount })
+            : row.status === "imported"
+              ? t("den.skill_hub_imported_detail", { count: row.importedSkillCount })
+              : row.status === "out_of_sync"
+                ? t("den.skill_hub_sync_detail", {
+                    liveCount: row.liveSkillCount,
+                    importedCount: row.importedSkillCount,
+                  })
+                : t("den.skill_hub_removed_detail", { importedCount: row.importedSkillCount })}
+        </SettingsListItemDescription>
+      </SettingsListItemContent>
+      <SettingsListItemActions>
+        {row.status === "out_of_sync" && row.hub ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void onSync(row.hubId)}
+            disabled={actionId !== null}
+          >
+            {actionBusy && actionKind === "sync" ? t("den.syncing") : t("den.sync")}
+          </Button>
+        ) : null}
+        {row.status === "available" && row.hub ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void onImport(row.hubId)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : t("den.import_all")}
+          </Button>
+        ) : null}
+        {row.status !== "available" ? (
+          <Button
+            variant="destructive"
+            size="sm"
+            onClick={() => void onRemove(row.hubId)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : row.status === "removed_from_cloud" ? t("den.uninstall") : t("common.remove")}
+          </Button>
+        ) : null}
+      </SettingsListItemActions>
+    </SettingsListItem>
+  );
+}
+
+interface CloudProviderListItemProps {
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  row: CloudProviderRow;
+  onImport: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+  onRemove: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+  onSync: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+}
+
+function CloudProviderListItem({ actionId, actionKind, row, onImport, onRemove, onSync }: CloudProviderListItemProps) {
+  const actionBusy = actionId === row.cloudProviderId;
+  const actionLabel = !actionBusy
+    ? null
+    : actionKind === "import"
+      ? t("den.importing")
+      : actionKind === "sync"
+        ? t("den.syncing")
+        : t("den.removing");
+
+  return (
+    <SettingsListItem>
+      <SettingsListItemContent>
+        <SettingsListTitle>
+          <SettingsListItemTitle>{row.name}</SettingsListItemTitle>
+          {row.status !== "available" ? (
+            <SettingsPill className={statusBadgeVariants({ tone: resourceStatusTone(row.status) })}>
+              {row.status === "imported"
+                ? t("den.imported_badge")
+                : row.status === "out_of_sync"
+                  ? t("den.out_of_sync_badge")
+                  : t("den.removed_from_cloud_badge")}
+            </SettingsPill>
+          ) : null}
+        </SettingsListTitle>
+        <SettingsListItemDescription>
+          {[
+            row.provider?.providerId ?? row.imported?.providerId,
+            row.provider?.hasApiKey ? t("den.credentials_ready_badge") : null,
+            row.status === "removed_from_cloud"
+              ? t("den.cloud_provider_removed_detail", {
+                  providerId: row.imported?.providerId ?? row.name,
+                })
+              : row.status === "out_of_sync"
+                ? t("den.cloud_provider_sync_detail", {
+                    count: row.provider?.models.length ?? 0,
+                    source: row.provider?.source === "custom" ? "custom" : "managed",
+                  })
+                : t("den.cloud_provider_detail", {
+                    count: row.provider?.models.length ?? 0,
+                    source: row.provider?.source === "custom" ? "custom" : "managed",
+                  }),
+          ].filter(Boolean).join(" · ")}
+        </SettingsListItemDescription>
+      </SettingsListItemContent>
+      <SettingsListItemActions>
+        {row.status === "out_of_sync" && row.provider ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void onSync(row.cloudProviderId, row.name)}
+            disabled={actionId !== null}
+          >
+            {actionBusy && actionKind === "sync" ? t("den.syncing") : t("den.sync")}
+          </Button>
+        ) : null}
+        {row.status === "available" && row.provider ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void onImport(row.cloudProviderId, row.name)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : t("den.import_provider")}
+          </Button>
+        ) : null}
+        {row.status !== "available" ? (
+          <Button
+            variant="destructive"
+            size="sm"
+            onClick={() => void onRemove(row.cloudProviderId, row.name)}
+            disabled={actionId !== null}
+          >
+            {actionBusy ? actionLabel : row.status === "removed_from_cloud" ? t("den.uninstall") : t("common.remove")}
+          </Button>
+        ) : null}
+      </SettingsListItemActions>
+    </SettingsListItem>
+  );
+}
+
+export interface CloudSkillsSectionProps {
+  actionError: string | null;
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  activeOrgName: string;
+  busy: boolean;
+  hasActiveOrg: boolean;
+  rows: CloudSkillRow[];
+  statusError: string | null;
+  onImportSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+  onRefresh: () => void | Promise<void>;
+  onRemoveSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+  onSyncSkill: (cloudSkillId: string, title: string) => void | Promise<void>;
+}
+
+export function CloudSkillsSection({
+  actionError,
+  actionId,
+  actionKind,
+  busy,
+  hasActiveOrg,
+  rows,
+  statusError,
+  onImportSkill,
+  onRefresh,
+  onRemoveSkill,
+  onSyncSkill,
+}: CloudSkillsSectionProps) {
+  const [searchQuery, setSearchQuery] = React.useState("");
+  const visibleRows = useSearch({ items: rows, keys: skillSearchKeys, query: searchQuery });
+  const skillGroups = [
+    { value: "available", label: "Available", rows: visibleRows.filter((row) => row.status === "available") },
+    { value: "out_of_sync", label: t("den.out_of_sync_badge"), rows: visibleRows.filter((row) => row.status === "out_of_sync") },
+    { value: "installed", label: t("skills.cloud_status_installed"), rows: visibleRows.filter((row) => row.status === "installed") },
+    { value: "removed_from_cloud", label: t("den.removed_from_cloud_badge"), rows: visibleRows.filter((row) => row.status === "removed_from_cloud") },
+  ].filter((group) => group.rows.length > 0);
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>
+            {t("den.cloud_skills_title")}
+          </SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription>{t("den.cloud_skills_hint")}</SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+        <SettingsSectionHeaderActions>
+          <RefreshButton
+            busy={busy}
+            disabled={[busy, !hasActiveOrg].some(Boolean)}
+            onRefresh={onRefresh}
+          >
+            {t("den.refresh")}
+          </RefreshButton>
+        </SettingsSectionHeaderActions>
+      </SettingsSectionHeader>
+
+      {actionError ?? statusError ? (
+        <SettingsNotice tone="error">{actionError ?? statusError}</SettingsNotice>
+      ) : null}
+
+      {!busy && rows.length === 0 ? (
+        <SettingsListEmptyState>
+          {hasActiveOrg ? t("den.no_cloud_skills") : t("den.choose_org_for_skills")}
+        </SettingsListEmptyState>
+      ) : null}
+
+      {rows.length > 0 ? (
+        <>
+          <Field>
+            <FieldLabel className="sr-only" htmlFor="cloud-skill-search">
+              Search
+            </FieldLabel>
+            <SettingsListSearchInput
+              id="cloud-skill-search"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+            />
+            <FieldDescription className="sr-only">Search for a skill.</FieldDescription>
+          </Field>
+
+          {visibleRows.length > 0 ? (
+            <Accordion multiple defaultValue={["available", "out_of_sync"]}>
+              {skillGroups.map((group) => (
+                <AccordionItem key={group.value} value={group.value}>
+                  <AccordionTrigger className="items-center hover:no-underline group gap-x-3">
+                    <span className="group-hover:underline">{group.label}</span>
+                    <SettingsPill>{group.rows.length}</SettingsPill>
+                  </AccordionTrigger>
+                  <AccordionContent className="px-1.5 pb-1.5">
+                    <SettingsList>
+                      {group.rows.map((row) => (
+                        <CloudSkillListItem
+                          key={row.key}
+                          actionId={actionId}
+                          actionKind={actionKind}
+                          row={row}
+                          onImportSkill={onImportSkill}
+                          onRemoveSkill={onRemoveSkill}
+                          onSyncSkill={onSyncSkill}
+                        />
+                      ))}
+                    </SettingsList>
+                  </AccordionContent>
+                </AccordionItem>
+              ))}
+            </Accordion>
+          ) : (
+            <SettingsListEmptyState>No skills match your search.</SettingsListEmptyState>
+          )}
+        </>
+      ) : null}
+    </SettingsSection>
+  );
+}
+
+export interface MarketplacePluginsSectionProps {
+  actionError: string | null;
+  actionId: string | null;
+  activeMarketplaceId: string | null;
+  activeOrgName: string;
+  busy: boolean;
+  hasActiveOrg: boolean;
+  marketplaces: DenOrgMarketplaceResolved[];
+  rowsByMarketplace: Record<string, CloudPluginRow[]>;
+  statusError: string | null;
+  onImportPlugin: (marketplaceId: string | null, plugin: DenOrgPlugin) => void | Promise<void>;
+  onRefresh: () => void | Promise<void>;
+  onSelectMarketplace: (marketplaceId: string) => void;
+}
+
+export function MarketplacePluginsSection({
+  actionError,
+  actionId,
+  activeMarketplaceId,
+  busy,
+  hasActiveOrg,
+  marketplaces,
+  rowsByMarketplace,
+  statusError,
+  onImportPlugin,
+  onRefresh,
+  onSelectMarketplace,
+}: MarketplacePluginsSectionProps) {
+  const [searchQuery, setSearchQuery] = React.useState("");
+  const selectedMarketplace =
+    marketplaces.find((entry) => entry.marketplace.id === activeMarketplaceId) ?? marketplaces[0] ?? null;
+  const selectedRows = selectedMarketplace ? rowsByMarketplace[selectedMarketplace.marketplace.id] ?? [] : [];
+  const visibleRows = useSearch({ items: selectedRows, keys: pluginSearchKeys, query: searchQuery });
+  const pluginGroups = [
+    { value: "available", label: "Available", rows: visibleRows.filter((row) => row.status === "available") },
+    { value: "out_of_sync", label: t("den.out_of_sync_badge"), rows: visibleRows.filter((row) => row.status === "out_of_sync") },
+    { value: "imported", label: t("den.imported_badge"), rows: visibleRows.filter((row) => row.status === "imported") },
+  ].filter((group) => group.rows.length > 0);
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>
+            Marketplaces & Plugins
+          </SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription>
+            Browse organization marketplaces and import plugin files into this workspace.
+          </SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+        <SettingsSectionHeaderActions>
+          <RefreshButton
+            busy={busy}
+            disabled={[busy, !hasActiveOrg].some(Boolean)}
+            onRefresh={onRefresh}
+          >
+            {t("den.refresh")}
+          </RefreshButton>
+        </SettingsSectionHeaderActions>
+      </SettingsSectionHeader>
+
+      {actionError ?? statusError ? (
+        <SettingsNotice tone="error">{actionError ?? statusError}</SettingsNotice>
+      ) : null}
+
+      {!busy && marketplaces.length === 0 ? (
+        <SettingsListEmptyState>
+          {hasActiveOrg ? "No marketplaces are available yet." : "Choose an organization to view marketplaces."}
+        </SettingsListEmptyState>
+      ) : null}
+
+      {marketplaces.length > 0 ? (
+        <Tabs
+          value={selectedMarketplace?.marketplace.id}
+          onValueChange={onSelectMarketplace}
+          className="gap-y-3"
+        >
+          <TabsList className="max-w-full justify-start overflow-x-auto">
+            {marketplaces.map((entry) => (
+              <TabsTrigger
+                key={entry.marketplace.id}
+                value={entry.marketplace.id}
+                className="flex-none"
+              >
+                {entry.marketplace.name}
+              </TabsTrigger>
+            ))}
+          </TabsList>
+
+          <Field>
+            <FieldLabel className="sr-only" htmlFor="marketplace-plugin-search">
+              Search
+            </FieldLabel>
+            <SettingsListSearchInput
+              id="marketplace-plugin-search"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+            />
+            <FieldDescription className="sr-only">Search for a plugin.</FieldDescription>
+          </Field>
+
+          <TabsContent value={selectedMarketplace?.marketplace.id}>
+            {visibleRows.length > 0 ? (
+              <Accordion multiple defaultValue={["available", "out_of_sync"]}>
+                {pluginGroups.map((group) => (
+                  <AccordionItem key={group.value} value={group.value}>
+                    <AccordionTrigger className="items-center hover:no-underline group gap-x-3">
+                      <span className="group-hover:underline">{group.label}</span>
+                      <SettingsPill>{group.rows.length}</SettingsPill>
+                    </AccordionTrigger>
+                    <AccordionContent className="px-1.5 pb-1.5">
+                      <SettingsList>
+                        {group.rows.map((row) => (
+                          <MarketplacePluginListItem
+                            key={row.plugin.id}
+                            actionId={actionId}
+                            row={row}
+                            onImportPlugin={onImportPlugin}
+                          />
+                        ))}
+                      </SettingsList>
+                    </AccordionContent>
+                  </AccordionItem>
+                ))}
+              </Accordion>
+            ) : null}
+
+            {selectedRows.length > 0 && visibleRows.length === 0 ? (
+              <SettingsListEmptyState>No plugins match your search.</SettingsListEmptyState>
+            ) : null}
+
+            {selectedMarketplace && selectedRows.length === 0 ? (
+              <SettingsListEmptyState>This marketplace does not have plugins yet.</SettingsListEmptyState>
+            ) : null}
+          </TabsContent>
+        </Tabs>
+      ) : null}
+    </SettingsSection>
+  );
+}
+
+export interface CloudWorkersSectionProps {
+  activeOrgName: string;
+  openingWorkerId: string | null;
+  refreshDisabled: boolean;
+  workers: CloudWorker[];
+  workersBusy: boolean;
+  workersError: string | null;
+  onOpenWorker: (workerId: string, workerName: string) => void | Promise<void>;
+  onRefreshWorkers: () => void | Promise<void>;
+}
+
+export function CloudWorkersSection({
+  openingWorkerId,
+  refreshDisabled,
+  workers,
+  workersBusy,
+  workersError,
+  onOpenWorker,
+  onRefreshWorkers,
+}: CloudWorkersSectionProps) {
+  const [searchQuery, setSearchQuery] = React.useState("");
+  const visibleWorkers = useSearch({ items: workers, keys: workerSearchKeys, query: searchQuery });
+  const workerGroups: { value: string; label: string; rows: CloudWorker[] }[] = [];
+
+  for (const worker of visibleWorkers) {
+    const value = workerStatusValue(worker.status);
+    const group = workerGroups.find((entry) => entry.value === value);
+
+    if (group) {
+      group.rows.push(worker);
+    } else {
+      workerGroups.push({ value, label: workerStatusMeta(worker.status).label, rows: [worker] });
+    }
+  }
+
+  const workerDefaultGroups = workerGroups.filter((group) => group.value !== "stopped").map((group) => group.value);
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>
+            {t("den.cloud_workers_title")}
+          </SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription>{t("den.cloud_workers_hint")}</SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+        <SettingsSectionHeaderActions>
+          <RefreshButton
+            busy={workersBusy}
+            disabled={refreshDisabled}
+            onRefresh={onRefreshWorkers}
+          >
+            {t("den.refresh")}
+          </RefreshButton>
+        </SettingsSectionHeaderActions>
+      </SettingsSectionHeader>
+
+      {workersError ? <SettingsNotice tone="error">{workersError}</SettingsNotice> : null}
+
+      {!workersBusy && workers.length === 0 ? (
+        <SettingsListEmptyState>{t("den.no_cloud_workers")}</SettingsListEmptyState>
+      ) : null}
+
+      {workers.length > 0 ? (
+        <>
+          <Field>
+            <FieldLabel className="sr-only" htmlFor="cloud-worker-search">
+              Search
+            </FieldLabel>
+            <SettingsListSearchInput
+              id="cloud-worker-search"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+            />
+            <FieldDescription className="sr-only">Search for a worker.</FieldDescription>
+          </Field>
+
+          {visibleWorkers.length > 0 ? (
+            <Accordion multiple defaultValue={workerDefaultGroups}>
+              {workerGroups.map((group) => (
+                <AccordionItem key={group.value} value={group.value}>
+                  <AccordionTrigger className="items-center hover:no-underline group gap-x-3">
+                    <span className="group-hover:underline">{group.label}</span>
+                    <SettingsPill>{group.rows.length}</SettingsPill>
+                  </AccordionTrigger>
+                  <AccordionContent className="px-1.5 pb-1.5">
+                    <SettingsList>
+                      {group.rows.map((worker) => (
+                        <CloudWorkerListItem
+                          key={worker.workerId}
+                          openingWorkerId={openingWorkerId}
+                          worker={worker}
+                          onOpenWorker={onOpenWorker}
+                        />
+                      ))}
+                    </SettingsList>
+                  </AccordionContent>
+                </AccordionItem>
+              ))}
+            </Accordion>
+          ) : (
+            <SettingsListEmptyState>No workers match your search.</SettingsListEmptyState>
+          )}
+        </>
+      ) : null}
+    </SettingsSection>
+  );
+}
+
+export interface SkillHubsSectionProps {
+  actionError: string | null;
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  activeOrgName: string;
+  busy: boolean;
+  hasActiveOrg: boolean;
+  rows: CloudSkillHubRow[];
+  statusError: string | null;
+  onImport: (hubId: string) => void | Promise<void>;
+  onRefresh: () => void | Promise<void>;
+  onRemove: (hubId: string) => void | Promise<void>;
+  onSync: (hubId: string) => void | Promise<void>;
+}
+
+export function SkillHubsSection({
+  actionError,
+  actionId,
+  actionKind,
+  busy,
+  hasActiveOrg,
+  rows,
+  statusError,
+  onImport,
+  onRefresh,
+  onRemove,
+  onSync,
+}: SkillHubsSectionProps) {
+  const [searchQuery, setSearchQuery] = React.useState("");
+  const visibleRows = useSearch({ items: rows, keys: nameSearchKeys, query: searchQuery });
+  const skillHubGroups = [
+    { value: "available", label: "Available", rows: visibleRows.filter((row) => row.status === "available") },
+    { value: "out_of_sync", label: t("den.out_of_sync_badge"), rows: visibleRows.filter((row) => row.status === "out_of_sync") },
+    { value: "imported", label: t("den.imported_badge"), rows: visibleRows.filter((row) => row.status === "imported") },
+    { value: "removed_from_cloud", label: t("den.removed_from_cloud_badge"), rows: visibleRows.filter((row) => row.status === "removed_from_cloud") },
+  ].filter((group) => group.rows.length > 0);
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>
+            {t("den.skill_hubs_title")}
+          </SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription>{t("den.skill_hubs_hint")}</SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+        <SettingsSectionHeaderActions>
+          <RefreshButton
+            busy={busy}
+            disabled={[busy, !hasActiveOrg].some(Boolean)}
+            onRefresh={onRefresh}
+          >
+            {t("den.refresh")}
+          </RefreshButton>
+        </SettingsSectionHeaderActions>
+      </SettingsSectionHeader>
+
+      {actionError ?? statusError ? (
+        <SettingsNotice tone="error">{actionError ?? statusError}</SettingsNotice>
+      ) : null}
+
+      {!busy && rows.length === 0 ? (
+        <SettingsListEmptyState>
+          {hasActiveOrg ? t("den.no_skill_hubs") : t("den.choose_org_for_skill_hubs")}
+        </SettingsListEmptyState>
+      ) : null}
+
+      {rows.length > 0 ? (
+        <>
+          <Field>
+            <FieldLabel className="sr-only" htmlFor="skill-hub-search">
+              Search
+            </FieldLabel>
+            <SettingsListSearchInput
+              id="skill-hub-search"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+            />
+            <FieldDescription className="sr-only">Search for a skill hub.</FieldDescription>
+          </Field>
+
+          {visibleRows.length > 0 ? (
+            <Accordion multiple defaultValue={["available", "out_of_sync"]}>
+              {skillHubGroups.map((group) => (
+                <AccordionItem key={group.value} value={group.value}>
+                  <AccordionTrigger className="items-center hover:no-underline group gap-x-3">
+                    <span className="group-hover:underline">{group.label}</span>
+                    <SettingsPill>{group.rows.length}</SettingsPill>
+                  </AccordionTrigger>
+                  <AccordionContent className="px-1.5 pb-1.5">
+                    <SettingsList>
+                      {group.rows.map((row) => (
+                        <SkillHubListItem
+                          key={row.key}
+                          actionId={actionId}
+                          actionKind={actionKind}
+                          row={row}
+                          onImport={onImport}
+                          onRemove={onRemove}
+                          onSync={onSync}
+                        />
+                      ))}
+                    </SettingsList>
+                  </AccordionContent>
+                </AccordionItem>
+              ))}
+            </Accordion>
+          ) : (
+            <SettingsListEmptyState>No skill hubs match your search.</SettingsListEmptyState>
+          )}
+        </>
+      ) : null}
+    </SettingsSection>
+  );
+}
+
+export interface CloudProvidersSectionProps {
+  actionError: string | null;
+  actionId: string | null;
+  actionKind: ResourceActionKind | null;
+  activeOrgName: string;
+  busy: boolean;
+  hasActiveOrg: boolean;
+  rows: CloudProviderRow[];
+  onImport: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+  onRefresh: () => void | Promise<void>;
+  onRemove: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+  onSync: (cloudProviderId: string, providerName: string) => void | Promise<void>;
+}
+
+export function CloudProvidersSection({
+  actionError,
+  actionId,
+  actionKind,
+  busy,
+  hasActiveOrg,
+  rows,
+  onImport,
+  onRefresh,
+  onRemove,
+  onSync,
+}: CloudProvidersSectionProps) {
+  const [searchQuery, setSearchQuery] = React.useState("");
+  const visibleRows = useSearch({ items: rows, keys: nameSearchKeys, query: searchQuery });
+  const providerGroups = [
+    { value: "available", label: "Available", rows: visibleRows.filter((row) => row.status === "available") },
+    { value: "out_of_sync", label: t("den.out_of_sync_badge"), rows: visibleRows.filter((row) => row.status === "out_of_sync") },
+    { value: "imported", label: t("den.imported_badge"), rows: visibleRows.filter((row) => row.status === "imported") },
+    { value: "removed_from_cloud", label: t("den.removed_from_cloud_badge"), rows: visibleRows.filter((row) => row.status === "removed_from_cloud") },
+  ].filter((group) => group.rows.length > 0);
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>
+            {t("den.cloud_providers_title")}
+          </SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription>{t("den.cloud_providers_hint")}</SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+        <SettingsSectionHeaderActions>
+          <RefreshButton
+            busy={busy}
+            disabled={[busy, !hasActiveOrg].some(Boolean)}
+            onRefresh={onRefresh}
+          >
+            {t("den.refresh")}
+          </RefreshButton>
+        </SettingsSectionHeaderActions>
+      </SettingsSectionHeader>
+
+      {actionError ? <SettingsNotice tone="error">{actionError}</SettingsNotice> : null}
+
+      {!busy && rows.length === 0 ? (
+        <SettingsListEmptyState>
+          {hasActiveOrg ? t("den.no_cloud_providers") : t("den.choose_org_for_providers")}
+        </SettingsListEmptyState>
+      ) : null}
+
+      {rows.length > 0 ? (
+        <>
+          <Field>
+            <FieldLabel className="sr-only" htmlFor="cloud-provider-search">
+              Search
+            </FieldLabel>
+            <SettingsListSearchInput
+              id="cloud-provider-search"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+            />
+            <FieldDescription className="sr-only">Search for a provider.</FieldDescription>
+          </Field>
+
+          {visibleRows.length > 0 ? (
+            <Accordion multiple defaultValue={["available", "imported", "out_of_sync"]}>
+              {providerGroups.map((group) => (
+                <AccordionItem key={group.value} value={group.value}>
+                  <AccordionTrigger className="items-center hover:no-underline group gap-x-3">
+                    <span className="group-hover:underline">{group.label}</span>
+                    <SettingsPill>{group.rows.length}</SettingsPill>
+                  </AccordionTrigger>
+                  <AccordionContent className="px-1.5 pb-1.5">
+                    <SettingsList>
+                      {group.rows.map((row) => (
+                        <CloudProviderListItem
+                          key={row.key}
+                          actionId={actionId}
+                          actionKind={actionKind}
+                          row={row}
+                          onImport={onImport}
+                          onRemove={onRemove}
+                          onSync={onSync}
+                        />
+                      ))}
+                    </SettingsList>
+                  </AccordionContent>
+                </AccordionItem>
+              ))}
+            </Accordion>
+          ) : (
+            <SettingsListEmptyState>No providers match your search.</SettingsListEmptyState>
+          )}
+        </>
+      ) : null}
+    </SettingsSection>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/modals/reset-modal.tsx b/apps/app/src/react-app/domains/settings/modals/reset-modal.tsx
new file mode 100644
index 0000000000..1b939105c2
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/modals/reset-modal.tsx
@@ -0,0 +1,125 @@
+/** @jsxImportSource react */
+import type { ReactNode } from "react";
+import { X } from "lucide-react";
+
+import { t } from "../../../../i18n";
+
+const RESET_CONFIRM_PLACEHOLDER = "{resetWord}";
+const RESET_CONFIRM_WORD = "RESET";
+
+const buttonBaseClass =
+  "inline-flex items-center justify-center rounded-full px-4 py-2 text-[13px] font-medium transition-colors focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.18)] disabled:cursor-not-allowed disabled:opacity-60";
+const outlineButtonClass = `${buttonBaseClass} border border-dls-border bg-dls-surface text-dls-text hover:bg-[var(--dls-hover)]`;
+const dangerButtonClass = `${buttonBaseClass} bg-red-9 text-white hover:bg-red-10`;
+const ghostIconButtonClass =
+  "inline-flex h-8 w-8 items-center justify-center rounded-full text-gray-10 transition-colors hover:bg-[var(--dls-hover)] disabled:cursor-not-allowed disabled:opacity-60";
+
+export type ResetModalProps = {
+  open: boolean;
+  mode: "onboarding" | "all";
+  text: string;
+  busy: boolean;
+  canReset: boolean;
+  hasActiveRuns: boolean;
+  onClose: () => void;
+  onConfirm: () => void;
+  onTextChange: (value: string) => void;
+};
+
+export function ResetModal(props: ResetModalProps) {
+  const resetConfirmationHint = (): ReactNode => {
+    const template = t("settings.reset_confirmation_hint");
+    const parts = template.split(RESET_CONFIRM_PLACEHOLDER);
+    if (parts.length === 1) return template;
+    const nodes: ReactNode[] = [];
+    parts.forEach((part, index) => {
+      nodes.push(<span key={`part-${index}`}>{part}</span>);
+      if (index < parts.length - 1) {
+        nodes.push(
+          <span key={`word-${index}`} className="font-mono">
+            {RESET_CONFIRM_WORD}
+          </span>,
+        );
+      }
+    });
+    return nodes;
+  };
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-center justify-center p-4">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-xl rounded-2xl shadow-2xl overflow-hidden">
+        <div className="p-6">
+          <div className="flex items-start justify-between gap-4">
+            <div>
+              <h3 className="text-lg font-semibold text-gray-12">
+                {props.mode === "onboarding"
+                  ? t("settings.reset_onboarding_title")
+                  : t("settings.reset_app_data_title")}
+              </h3>
+              <p className="text-sm text-gray-11 mt-1">
+                {resetConfirmationHint()}
+              </p>
+            </div>
+            <button
+              type="button"
+              className={ghostIconButtonClass}
+              onClick={props.onClose}
+              disabled={props.busy}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          <div className="mt-6 space-y-4">
+            <div className="rounded-xl bg-gray-1/20 border border-gray-6 p-3 text-xs text-gray-11">
+              {props.mode === "onboarding"
+                ? t("settings.reset_onboarding_warning")
+                : t("settings.reset_app_data_warning")}
+            </div>
+
+            {props.hasActiveRuns ? (
+              <div className="text-xs text-red-11">
+                {t("settings.reset_stop_active_runs")}
+              </div>
+            ) : null}
+
+            <label className="block">
+              <span className="mb-1.5 block text-[13px] font-medium text-dls-text">
+                {t("settings.reset_confirmation_label")}
+              </span>
+              <input
+                type="text"
+                placeholder={t("settings.reset_confirmation_placeholder")}
+                value={props.text}
+                onChange={(event) => props.onTextChange(event.currentTarget.value)}
+                disabled={props.busy}
+                className="w-full rounded-xl border border-dls-border bg-dls-surface px-4 py-3 text-[14px] text-dls-text placeholder:text-dls-secondary focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.12)] disabled:cursor-not-allowed disabled:opacity-60"
+              />
+            </label>
+          </div>
+
+          <div className="mt-6 flex justify-end gap-2">
+            <button
+              type="button"
+              className={outlineButtonClass}
+              onClick={props.onClose}
+              disabled={props.busy}
+            >
+              {t("settings.reset_cancel")}
+            </button>
+            <button
+              type="button"
+              className={dangerButtonClass}
+              onClick={props.onConfirm}
+              disabled={!props.canReset}
+            >
+              {t("settings.reset_confirm_button")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/advanced-view.tsx b/apps/app/src/react-app/domains/settings/pages/advanced-view.tsx
new file mode 100644
index 0000000000..e3c951c896
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/advanced-view.tsx
@@ -0,0 +1,432 @@
+/** @jsxImportSource react */
+import { useState, type ReactNode } from "react";
+import { CircleAlert, Cpu, RefreshCcw, Server, Zap } from "lucide-react";
+
+import type { OpencodeConnectStatus } from "../../../../app/types";
+import type { OpenworkServerStatus } from "../../../../app/lib/openwork-server";
+import type { EngineInfo } from "../../../../app/lib/desktop";
+import { isDesktopRuntime } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+import { ConfigView, type ConfigViewProps } from "./config-view";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+const settingsPanelSoftClass = "rounded-2xl border border-gray-6/60 bg-gray-1/40 p-4";
+
+type RuntimeStatusCardProps = {
+  icon: ReactNode;
+  title: string;
+  description: string;
+  statusLabel: string;
+  statusStyle: string;
+  statusDot: string;
+  detailLines?: string[];
+};
+
+export type AdvancedViewProps = {
+  busy: boolean;
+  baseUrl: string;
+  headerStatus: string;
+  clientConnected: boolean;
+  opencodeConnectStatus: OpencodeConnectStatus | null;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerUrl: string;
+  openworkReconnectBusy: boolean;
+  reconnectOpenworkServer: () => Promise<boolean>;
+  engineInfo: EngineInfo | null;
+  restartLocalServer: () => Promise<boolean>;
+  stopHost: () => void;
+  developerMode: boolean;
+  toggleDeveloperMode: () => void;
+  opencodeDevModeEnabled: boolean;
+  openDebugDeepLink: (rawUrl: string) => Promise<{ ok: boolean; message: string }>;
+  opencodeEnableExa: boolean;
+  toggleOpencodeEnableExa: () => void;
+  microsandboxCreateSandboxEnabled: boolean;
+  toggleMicrosandboxCreateSandbox: () => void;
+  configView: ConfigViewProps;
+};
+
+function RuntimeStatusCard(props: RuntimeStatusCardProps) {
+  return (
+    <div className={`${settingsPanelSoftClass} space-y-3`}>
+      <div className="flex items-start gap-3">
+        <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-gray-6/60 bg-gray-1/70 text-gray-12">
+          {props.icon}
+        </div>
+        <div>
+          <div className="text-sm font-medium text-gray-12">{props.title}</div>
+          <div className="text-xs text-gray-9">{props.description}</div>
+        </div>
+      </div>
+      <div
+        className={`inline-flex items-center gap-2 rounded-full border px-2.5 py-1 text-[11px] font-medium ${props.statusStyle}`}
+      >
+        <span className={`h-2 w-2 rounded-full ${props.statusDot}`} />
+        {props.statusLabel}
+      </div>
+      {props.detailLines?.length ? (
+        <div className="space-y-1 border-t border-gray-6/50 pt-2 text-[11px] text-gray-9">
+          {props.detailLines.map((line) => (
+            <div key={line} className="truncate" title={line}>
+              {line}
+            </div>
+          ))}
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function formatOpencodeBinary(info: EngineInfo | null) {
+  const binary = info?.opencodeBinPath?.trim();
+  if (!binary) return "—";
+  const source = info?.opencodeBinSource?.trim();
+  return source ? `${binary} (${source})` : binary;
+}
+
+export function AdvancedView(props: AdvancedViewProps) {
+  const [openworkReconnectStatus, setOpenworkReconnectStatus] = useState<string | null>(null);
+  const [openworkReconnectError, setOpenworkReconnectError] = useState<string | null>(null);
+  const [openworkRestartBusy, setOpenworkRestartBusy] = useState(false);
+  const [openworkRestartStatus, setOpenworkRestartStatus] = useState<string | null>(null);
+  const [openworkRestartError, setOpenworkRestartError] = useState<string | null>(null);
+  const [debugDeepLinkOpen, setDebugDeepLinkOpen] = useState(false);
+  const [debugDeepLinkInput, setDebugDeepLinkInput] = useState("");
+  const [debugDeepLinkBusy, setDebugDeepLinkBusy] = useState(false);
+  const [debugDeepLinkStatus, setDebugDeepLinkStatus] = useState<string | null>(null);
+
+  const clientStatusLabel = (() => {
+    const status = props.opencodeConnectStatus?.status;
+    if (status === "connecting") return t("status.connecting");
+    if (status === "error") return t("settings.connection_failed");
+    return props.clientConnected ? t("status.connected") : t("config.status_not_connected");
+  })();
+
+  const clientStatusStyle = (() => {
+    const status = props.opencodeConnectStatus?.status;
+    if (status === "connecting") return "bg-amber-7/10 text-amber-11 border-amber-7/20";
+    if (status === "error") return "bg-red-7/10 text-red-11 border-red-7/20";
+    return props.clientConnected
+      ? "bg-green-7/10 text-green-11 border-green-7/20"
+      : "bg-gray-4/60 text-gray-11 border-gray-7/50";
+  })();
+
+  const clientStatusDot = (() => {
+    const status = props.opencodeConnectStatus?.status;
+    if (status === "connecting") return "bg-amber-9";
+    if (status === "error") return "bg-red-9";
+    return props.clientConnected ? "bg-green-9" : "bg-gray-6";
+  })();
+
+  const openworkStatusLabel = (() => {
+    switch (props.openworkServerStatus) {
+      case "connected":
+        return t("config.status_connected");
+      case "limited":
+        return t("config.status_limited");
+      default:
+        return t("config.status_not_connected");
+    }
+  })();
+
+  const openworkStatusStyle = (() => {
+    switch (props.openworkServerStatus) {
+      case "connected":
+        return "bg-green-7/10 text-green-11 border-green-7/20";
+      case "limited":
+        return "bg-amber-7/10 text-amber-11 border-amber-7/20";
+      default:
+        return "bg-gray-4/60 text-gray-11 border-gray-7/50";
+    }
+  })();
+
+  const openworkStatusDot = (() => {
+    switch (props.openworkServerStatus) {
+      case "connected":
+        return "bg-green-9";
+      case "limited":
+        return "bg-amber-9";
+      default:
+        return "bg-gray-6";
+    }
+  })();
+
+  const isLocalEngineRunning = Boolean(props.engineInfo?.running);
+
+  const handleReconnectOpenworkServer = async () => {
+    if (props.busy || props.openworkReconnectBusy || !props.openworkServerUrl.trim()) return;
+    setOpenworkReconnectStatus(null);
+    setOpenworkReconnectError(null);
+    try {
+      const ok = await props.reconnectOpenworkServer();
+      if (!ok) {
+        setOpenworkReconnectError(t("settings.reconnect_failed"));
+        return;
+      }
+      setOpenworkReconnectStatus(t("settings.reconnected"));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      setOpenworkReconnectError(message || t("settings.reconnect_server_failed"));
+    }
+  };
+
+  const handleRestartLocalServer = async () => {
+    if (props.busy || openworkRestartBusy) return;
+    setOpenworkRestartStatus(null);
+    setOpenworkRestartError(null);
+    setOpenworkRestartBusy(true);
+    try {
+      const ok = await props.restartLocalServer();
+      if (!ok) {
+        setOpenworkRestartError(t("settings.restart_failed"));
+        return;
+      }
+      setOpenworkRestartStatus(t("settings.restarted"));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      setOpenworkRestartError(message || t("settings.restart_server_failed"));
+    } finally {
+      setOpenworkRestartBusy(false);
+    }
+  };
+
+  const submitDebugDeepLink = async () => {
+    const rawUrl = debugDeepLinkInput.trim();
+    if (!rawUrl || props.busy || debugDeepLinkBusy) return;
+    setDebugDeepLinkBusy(true);
+    setDebugDeepLinkStatus(null);
+    try {
+      const result = await props.openDebugDeepLink(rawUrl);
+      setDebugDeepLinkStatus(result.message);
+      if (result.ok) {
+        setDebugDeepLinkInput("");
+      }
+    } catch (error) {
+      setDebugDeepLinkStatus(
+        error instanceof Error ? error.message : t("settings.open_deeplink_failed"),
+      );
+    } finally {
+      setDebugDeepLinkBusy(false);
+    }
+  };
+
+  return (
+    <div className="space-y-6">
+      <div className={`${settingsPanelClass} space-y-4`}>
+        <div>
+          <div className="text-sm font-medium text-gray-12">{t("settings.runtime_title")}</div>
+          <div className="text-xs text-gray-9">{t("settings.runtime_desc")}</div>
+        </div>
+
+        <div className="grid gap-3 sm:grid-cols-2">
+          <RuntimeStatusCard
+            icon={<Cpu size={18} />}
+            title={t("settings.opencode_engine_label")}
+            description={t("settings.opencode_engine_desc")}
+            statusLabel={clientStatusLabel}
+            statusStyle={clientStatusStyle}
+            statusDot={clientStatusDot}
+            detailLines={[
+              t("settings.diag_opencode_binary", undefined, {
+                binary: formatOpencodeBinary(props.engineInfo),
+              }),
+            ]}
+          />
+          <RuntimeStatusCard
+            icon={<Server size={18} />}
+            title={t("settings.openwork_server_label")}
+            description={t("settings.openwork_server_desc")}
+            statusLabel={openworkStatusLabel}
+            statusStyle={openworkStatusStyle}
+            statusDot={openworkStatusDot}
+          />
+        </div>
+      </div>
+
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div>
+          <div className="text-sm font-medium text-gray-12">{t("settings.opencode_section_label")}</div>
+          <div className="text-xs text-gray-9">{t("settings.opencode_engine_desc")}</div>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-gray-12">{t("settings.enable_exa")}</div>
+            <div className="text-xs text-gray-7">{t("settings.enable_exa_desc")}</div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.toggleOpencodeEnableExa}
+            disabled={props.busy}
+          >
+            {props.opencodeEnableExa ? t("settings.on") : t("settings.off")}
+          </Button>
+        </div>
+
+        <div className="text-[11px] text-gray-7">{t("settings.exa_restart_hint")}</div>
+      </div>
+
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div>
+          <div className="text-sm font-medium text-gray-12">Feature flags</div>
+          <div className="text-xs text-gray-9">
+            Experimental controls for sandbox and workspace behaviors.
+          </div>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-gray-12">Create Sandbox uses microsandbox image</div>
+            <div className="text-xs text-gray-7">
+              When enabled, Create Sandbox launches the detached worker with the microsandbox image
+              flow instead of the default Docker image flow.
+            </div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.toggleMicrosandboxCreateSandbox}
+            disabled={props.busy || !isDesktopRuntime()}
+          >
+            {props.microsandboxCreateSandboxEnabled ? "On" : "Off"}
+          </Button>
+        </div>
+      </div>
+
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div className="text-sm font-medium text-gray-12">{t("settings.developer_mode_title")}</div>
+        <div className="text-xs text-gray-9">{t("settings.developer_mode_desc")}</div>
+        <div className="flex flex-wrap items-center gap-3 pt-1">
+          <button
+            type="button"
+            className={`inline-flex items-center gap-1.5 rounded-md border px-3 py-1.5 text-xs font-medium shadow-sm transition-colors duration-150 focus:outline-none focus-visible:ring-2 disabled:cursor-not-allowed disabled:opacity-60 ${
+              props.developerMode
+                ? "border-blue-7/35 bg-blue-3/20 text-blue-11 hover:bg-blue-3/35 hover:text-blue-11 focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)]"
+                : "border-dls-border bg-dls-surface text-dls-secondary hover:bg-dls-hover hover:text-dls-text focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)]"
+            }`}
+            onClick={props.toggleDeveloperMode}
+          >
+            <Zap size={14} className={props.developerMode ? "text-blue-10" : "text-dls-secondary"} />
+            {props.developerMode
+              ? t("settings.disable_developer_mode")
+              : t("settings.enable_developer_mode")}
+          </button>
+          <div className="text-xs text-gray-10">
+            {props.developerMode
+              ? t("settings.developer_panel_enabled")
+              : t("settings.developer_panel_disabled")}
+          </div>
+        </div>
+
+        {isDesktopRuntime() && props.opencodeDevModeEnabled && props.developerMode ? (
+          <div className={`${settingsPanelSoftClass} space-y-3`}>
+            <div className="flex items-start justify-between gap-3">
+              <div>
+                <div className="text-sm font-medium text-gray-12">{t("settings.open_deeplink_title")}</div>
+                <div className="text-xs text-gray-9">{t("settings.open_deeplink_desc")}</div>
+              </div>
+              <button
+                type="button"
+                className="inline-flex items-center gap-1.5 rounded-md border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-secondary shadow-sm transition-colors duration-150 hover:bg-dls-hover hover:text-dls-text focus:outline-none focus-visible:ring-2 focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)] disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={() => {
+                  setDebugDeepLinkOpen((value) => !value);
+                  setDebugDeepLinkStatus(null);
+                }}
+                disabled={props.busy || debugDeepLinkBusy}
+              >
+                {debugDeepLinkOpen ? t("common.hide") : t("settings.open_deeplink_button")}
+              </button>
+            </div>
+
+            {debugDeepLinkOpen ? (
+              <div className="space-y-3">
+                <textarea
+                  value={debugDeepLinkInput}
+                  onChange={(event) => setDebugDeepLinkInput(event.currentTarget.value)}
+                  rows={3}
+                  placeholder="openwork://..."
+                  className="w-full rounded-xl border border-gray-6 bg-gray-1 px-3 py-2 text-xs font-mono text-gray-12 outline-none transition focus:border-blue-8"
+                />
+                <div className="flex flex-wrap items-center gap-2">
+                  <Button
+                    variant="secondary"
+                    className="h-8 px-3 py-0 text-xs"
+                    onClick={() => void submitDebugDeepLink()}
+                    disabled={props.busy || debugDeepLinkBusy || !debugDeepLinkInput.trim()}
+                  >
+                    {debugDeepLinkBusy ? t("settings.opening") : t("settings.open_deeplink_action")}
+                  </Button>
+                  <div className="text-[11px] text-gray-8">{t("settings.deeplink_hint")}</div>
+                </div>
+              </div>
+            ) : null}
+
+            {debugDeepLinkStatus ? <div className="text-xs text-gray-10">{debugDeepLinkStatus}</div> : null}
+          </div>
+        ) : null}
+      </div>
+
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div className="text-sm font-medium text-gray-12">{t("settings.connection_title")}</div>
+        <div className="text-xs text-gray-9">{props.headerStatus}</div>
+        <div className="break-all font-mono text-xs text-gray-8">{props.baseUrl}</div>
+        <div className="flex flex-wrap gap-2 pt-2">
+          <button
+            type="button"
+            className="inline-flex items-center gap-1.5 rounded-md border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-secondary shadow-sm transition-colors duration-150 hover:bg-dls-hover hover:text-dls-text focus:outline-none focus-visible:ring-2 focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)] disabled:cursor-not-allowed disabled:opacity-60"
+            onClick={() => void handleReconnectOpenworkServer()}
+            disabled={props.busy || props.openworkReconnectBusy || !props.openworkServerUrl.trim()}
+          >
+            <RefreshCcw size={14} className={`text-dls-secondary ${props.openworkReconnectBusy ? "animate-spin" : ""}`} />
+            {props.openworkReconnectBusy ? t("settings.reconnecting") : t("settings.reconnect_server")}
+          </button>
+
+          {isLocalEngineRunning ? (
+            <button
+              type="button"
+              className="inline-flex items-center gap-1.5 rounded-md border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-secondary shadow-sm transition-colors duration-150 hover:bg-dls-hover hover:text-dls-text focus:outline-none focus-visible:ring-2 focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)] disabled:cursor-not-allowed disabled:opacity-60"
+              onClick={() => void handleRestartLocalServer()}
+              disabled={props.busy || openworkRestartBusy}
+            >
+              <RefreshCcw size={14} className={`text-dls-secondary ${openworkRestartBusy ? "animate-spin" : ""}`} />
+              {openworkRestartBusy ? t("settings.restarting") : t("settings.restart_openwork_server")}
+            </button>
+          ) : null}
+
+          {isLocalEngineRunning ? (
+            <button
+              type="button"
+              className="inline-flex items-center gap-1.5 rounded-md border border-red-7/35 bg-red-3/25 px-3 py-1.5 text-xs font-medium text-red-11 transition-colors duration-150 hover:border-red-7/50 hover:bg-red-3/45 focus:outline-none focus-visible:ring-2 focus-visible:ring-red-7/35 disabled:cursor-not-allowed disabled:opacity-60"
+              onClick={props.stopHost}
+              disabled={props.busy}
+            >
+              <CircleAlert size={14} />
+              {t("settings.stop_local_server")}
+            </button>
+          ) : null}
+
+          {!isLocalEngineRunning && props.openworkServerStatus === "connected" ? (
+            <button
+              type="button"
+              className="inline-flex items-center gap-1.5 rounded-md border border-dls-border bg-dls-surface px-3 py-1.5 text-xs font-medium text-dls-secondary shadow-sm transition-colors duration-150 hover:bg-dls-hover hover:text-dls-text focus:outline-none focus-visible:ring-2 focus-visible:ring-[rgba(var(--dls-accent-rgb),0.25)] disabled:cursor-not-allowed disabled:opacity-60"
+              onClick={props.stopHost}
+              disabled={props.busy}
+            >
+              {t("settings.disconnect_server")}
+            </button>
+          ) : null}
+        </div>
+
+        {openworkReconnectStatus ? <div className="text-xs text-gray-10">{openworkReconnectStatus}</div> : null}
+        {openworkReconnectError ? <div className="text-xs text-red-11">{openworkReconnectError}</div> : null}
+        {openworkRestartStatus ? <div className="text-xs text-gray-10">{openworkRestartStatus}</div> : null}
+        {openworkRestartError ? <div className="text-xs text-red-11">{openworkRestartError}</div> : null}
+      </div>
+
+      {props.developerMode ? <ConfigView {...props.configView} /> : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/appearance-view.tsx b/apps/app/src/react-app/domains/settings/pages/appearance-view.tsx
new file mode 100644
index 0000000000..0578e9ecb0
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/appearance-view.tsx
@@ -0,0 +1,100 @@
+/** @jsxImportSource react */
+import { LANGUAGE_OPTIONS, t, type Language } from "../../../../i18n";
+import { isDesktopRuntime } from "../../../../app/utils";
+import { Button } from "../../../design-system/button";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+
+export type AppearanceViewProps = {
+  busy: boolean;
+  themeMode: "light" | "dark" | "system";
+  setThemeMode: (value: "light" | "dark" | "system") => void;
+  language: Language;
+  setLanguage: (value: Language) => void;
+  hideTitlebar: boolean;
+  toggleHideTitlebar: () => void;
+};
+
+export function AppearanceView(props: AppearanceViewProps) {
+  return (
+    <div className="space-y-6">
+      <div className={`${settingsPanelClass} space-y-4`}>
+        <div>
+          <div className="text-sm font-medium text-gray-12">{t("settings.appearance_title")}</div>
+          <div className="text-xs text-gray-9">{t("settings.appearance_hint")}</div>
+        </div>
+
+        <div className="flex flex-wrap gap-2">
+          <Button
+            variant={props.themeMode === "system" ? "secondary" : "outline"}
+            className="h-8 px-3 py-0 text-xs"
+            onClick={() => props.setThemeMode("system")}
+            disabled={props.busy}
+          >
+            {t("settings.theme_system")}
+          </Button>
+          <Button
+            variant={props.themeMode === "light" ? "secondary" : "outline"}
+            className="h-8 px-3 py-0 text-xs"
+            onClick={() => props.setThemeMode("light")}
+            disabled={props.busy}
+          >
+            {t("settings.theme_light")}
+          </Button>
+          <Button
+            variant={props.themeMode === "dark" ? "secondary" : "outline"}
+            className="h-8 px-3 py-0 text-xs"
+            onClick={() => props.setThemeMode("dark")}
+            disabled={props.busy}
+          >
+            {t("settings.theme_dark")}
+          </Button>
+        </div>
+
+        <div className="space-y-2">
+          <div className="text-xs font-medium text-gray-11">{t("settings.language")}</div>
+          <div className="text-xs text-gray-9">{t("settings.language.description")}</div>
+          <div className="flex flex-wrap gap-2">
+            {LANGUAGE_OPTIONS.map((option) => (
+              <Button
+                key={option.value}
+                variant={props.language === option.value ? "secondary" : "outline"}
+                className="h-8 px-3 py-0 text-xs"
+                onClick={() => props.setLanguage(option.value)}
+                disabled={props.busy}
+              >
+                {option.nativeName}
+              </Button>
+            ))}
+          </div>
+        </div>
+
+        <div className="text-xs text-gray-8">{t("settings.theme_system_hint")}</div>
+      </div>
+
+      {isDesktopRuntime() ? (
+        <div className="space-y-3 rounded-2xl border border-gray-6/50 bg-gray-2/30 p-5">
+          <div>
+            <div className="text-sm font-medium text-gray-12">{t("settings.appearance_title")}</div>
+            <div className="text-xs text-gray-10">{t("settings.window_appearance_desc")}</div>
+          </div>
+
+          <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+            <div className="min-w-0">
+              <div className="text-sm text-gray-12">{t("settings.hide_titlebar")}</div>
+              <div className="text-xs text-gray-7">{t("settings.hide_titlebar_desc")}</div>
+            </div>
+            <Button
+              variant="outline"
+              className="h-8 shrink-0 px-3 py-0 text-xs"
+              onClick={props.toggleHideTitlebar}
+              disabled={props.busy}
+            >
+              {props.hideTitlebar ? t("settings.on") : t("settings.off")}
+            </Button>
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/config-view.tsx b/apps/app/src/react-app/domains/settings/pages/config-view.tsx
new file mode 100644
index 0000000000..8d713832f4
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/config-view.tsx
@@ -0,0 +1,618 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useRef, useState } from "react";
+import { RefreshCcw } from "lucide-react";
+
+import { readDevLogs } from "../../../../app/lib/dev-log";
+import { readPerfLogs } from "../../../../app/lib/perf-log";
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  parseOpenworkWorkspaceIdFromUrl,
+  type OpenworkServerSettings,
+  type OpenworkServerStatus,
+} from "../../../../app/lib/openwork-server";
+import type { OpenworkServerInfo } from "../../../../app/lib/desktop";
+import { isDesktopRuntime } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import { TextInput } from "../../../design-system/text-input";
+
+export type ConfigViewProps = {
+  busy: boolean;
+  clientConnected: boolean;
+  anyActiveRuns: boolean;
+
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerUrl: string;
+  openworkServerSettings: OpenworkServerSettings;
+  openworkServerHostInfo: OpenworkServerInfo | null;
+  runtimeWorkspaceId: string | null;
+
+  updateOpenworkServerSettings: (next: OpenworkServerSettings) => void;
+  resetOpenworkServerSettings: () => void;
+  testOpenworkServerConnection: (
+    next: OpenworkServerSettings,
+  ) => Promise<boolean>;
+
+  canReloadWorkspace: boolean;
+  reloadWorkspaceEngine: () => Promise<void>;
+  reloadBusy: boolean;
+  reloadError: string | null;
+
+  developerMode: boolean;
+};
+
+type OpenworkTestState = "idle" | "testing" | "success" | "error";
+
+export function ConfigView(props: ConfigViewProps) {
+  const [openworkUrl, setOpenworkUrl] = useState("");
+  const [openworkToken, setOpenworkToken] = useState("");
+  const [openworkTokenVisible, setOpenworkTokenVisible] = useState(false);
+  const [openworkTestState, setOpenworkTestState] =
+    useState<OpenworkTestState>("idle");
+  const [openworkTestMessage, setOpenworkTestMessage] = useState<string | null>(
+    null,
+  );
+  const [clientTokenVisible, setClientTokenVisible] = useState(false);
+  const [ownerTokenVisible, setOwnerTokenVisible] = useState(false);
+  const [hostTokenVisible, setHostTokenVisible] = useState(false);
+  const [copyingField, setCopyingField] = useState<string | null>(null);
+  const copyTimeoutRef = useRef<number | undefined>(undefined);
+
+  useEffect(() => {
+    setOpenworkUrl(props.openworkServerSettings.urlOverride ?? "");
+    setOpenworkToken(props.openworkServerSettings.token ?? "");
+  }, [props.openworkServerSettings]);
+
+  useEffect(() => {
+    setOpenworkTestState("idle");
+    setOpenworkTestMessage(null);
+  }, [openworkUrl, openworkToken]);
+
+  useEffect(() => {
+    return () => {
+      if (copyTimeoutRef.current !== undefined) {
+        window.clearTimeout(copyTimeoutRef.current);
+      }
+    };
+  }, []);
+
+  const openworkStatusLabel = (() => {
+    switch (props.openworkServerStatus) {
+      case "connected":
+        return t("config.status_connected");
+      case "limited":
+        return t("config.status_limited");
+      default:
+        return t("config.status_not_connected");
+    }
+  })();
+
+  const openworkStatusStyle = (() => {
+    switch (props.openworkServerStatus) {
+      case "connected":
+        return "bg-green-7/10 text-green-11 border-green-7/20";
+      case "limited":
+        return "bg-amber-7/10 text-amber-11 border-amber-7/20";
+      default:
+        return "bg-gray-4/60 text-gray-11 border-gray-7/50";
+    }
+  })();
+
+  const reloadAvailabilityReason = (() => {
+    if (!props.clientConnected) return t("config.reload_connect_hint");
+    if (!props.canReloadWorkspace) return t("config.reload_availability_hint");
+    return null;
+  })();
+
+  const reloadButtonLabel = props.reloadBusy
+    ? t("config.reloading")
+    : t("config.reload_engine");
+  const reloadButtonTone: "danger" | "secondary" = props.anyActiveRuns
+    ? "danger"
+    : "secondary";
+  const reloadButtonDisabled =
+    props.reloadBusy || Boolean(reloadAvailabilityReason);
+
+  const buildOpenworkSettings = (): OpenworkServerSettings => ({
+    ...props.openworkServerSettings,
+    urlOverride: openworkUrl.trim() || undefined,
+    token: openworkToken.trim() || undefined,
+  });
+
+  const hasOpenworkChanges = (() => {
+    const currentUrl = props.openworkServerSettings.urlOverride ?? "";
+    const currentToken = props.openworkServerSettings.token ?? "";
+    return (
+      openworkUrl.trim() !== currentUrl || openworkToken.trim() !== currentToken
+    );
+  })();
+
+  const resolvedWorkspaceId = (() => {
+    const explicitId = props.runtimeWorkspaceId?.trim() ?? "";
+    if (explicitId) return explicitId;
+    return parseOpenworkWorkspaceIdFromUrl(openworkUrl) ?? "";
+  })();
+
+  const resolvedWorkspaceUrl = (() => {
+    const baseUrl = openworkUrl.trim();
+    if (!baseUrl) return "";
+    return buildOpenworkWorkspaceBaseUrl(baseUrl, resolvedWorkspaceId) ?? baseUrl;
+  })();
+
+  const hostInfo = props.openworkServerHostInfo;
+  const hostRemoteAccessEnabled = hostInfo?.remoteAccessEnabled === true;
+  const hostStatusLabel = !hostInfo?.running
+    ? t("config.host_offline")
+    : hostRemoteAccessEnabled
+      ? t("config.host_remote_enabled")
+      : t("config.host_local_only");
+  const hostStatusStyle = !hostInfo?.running
+    ? "bg-gray-4/60 text-gray-11 border-gray-7/50"
+    : "bg-green-7/10 text-green-11 border-green-7/20";
+  const hostConnectUrl =
+    hostInfo?.connectUrl ??
+    hostInfo?.mdnsUrl ??
+    hostInfo?.lanUrl ??
+    hostInfo?.baseUrl ??
+    "";
+  const hostConnectUrlUsesMdns = hostConnectUrl.includes(".local");
+
+  const diagnosticsBundleJson = useMemo(() => {
+    const urlOverride = props.openworkServerSettings.urlOverride?.trim() ?? "";
+    const token = props.openworkServerSettings.token?.trim() ?? "";
+    const developerLogs = props.developerMode ? readDevLogs(80) : [];
+    const perfLogs = props.developerMode ? readPerfLogs(80) : [];
+    const bundle = {
+      capturedAt: new Date().toISOString(),
+      runtime: {
+        tauri: isDesktopRuntime(),
+        developerMode: props.developerMode,
+      },
+      workspace: {
+        runtimeWorkspaceId: props.runtimeWorkspaceId ?? null,
+        clientConnected: props.clientConnected,
+        anyActiveRuns: props.anyActiveRuns,
+      },
+      openworkServer: {
+        status: props.openworkServerStatus,
+        url: props.openworkServerUrl,
+        settings: {
+          urlOverride: urlOverride || null,
+          tokenPresent: Boolean(token),
+        },
+        host: hostInfo
+          ? {
+              running: Boolean(hostInfo.running),
+              remoteAccessEnabled: hostInfo.remoteAccessEnabled,
+              baseUrl: hostInfo.baseUrl ?? null,
+              connectUrl: hostInfo.connectUrl ?? null,
+              mdnsUrl: hostInfo.mdnsUrl ?? null,
+              lanUrl: hostInfo.lanUrl ?? null,
+            }
+          : null,
+      },
+      reload: {
+        canReloadWorkspace: props.canReloadWorkspace,
+      },
+      sharing: {
+        hostConnectUrl: hostConnectUrl || null,
+        hostConnectUrlUsesMdns,
+      },
+      performance: {
+        retainedEntries: perfLogs.length,
+        recent: perfLogs,
+      },
+      developerLogs: {
+        retainedEntries: developerLogs.length,
+        recent: developerLogs,
+      },
+    };
+    return JSON.stringify(bundle, null, 2);
+  }, [
+    hostConnectUrl,
+    hostConnectUrlUsesMdns,
+    hostInfo,
+    props.anyActiveRuns,
+    props.canReloadWorkspace,
+    props.clientConnected,
+    props.developerMode,
+    props.openworkServerSettings.token,
+    props.openworkServerSettings.urlOverride,
+    props.openworkServerStatus,
+    props.openworkServerUrl,
+    props.runtimeWorkspaceId,
+  ]);
+
+  const handleCopy = async (value: string, field: string) => {
+    if (!value) return;
+    try {
+      await navigator.clipboard.writeText(value);
+      setCopyingField(field);
+      if (copyTimeoutRef.current !== undefined) {
+        window.clearTimeout(copyTimeoutRef.current);
+      }
+      copyTimeoutRef.current = window.setTimeout(() => {
+        setCopyingField(null);
+        copyTimeoutRef.current = undefined;
+      }, 2000);
+    } catch {
+      // ignore
+    }
+  };
+
+  const handleTestConnection = async () => {
+    if (openworkTestState === "testing") return;
+    const next = buildOpenworkSettings();
+    props.updateOpenworkServerSettings(next);
+    setOpenworkTestState("testing");
+    setOpenworkTestMessage(null);
+    try {
+      const ok = await props.testOpenworkServerConnection(next);
+      setOpenworkTestState(ok ? "success" : "error");
+      setOpenworkTestMessage(
+        ok ? t("config.connection_successful") : t("config.connection_failed"),
+      );
+    } catch (error) {
+      const message =
+        error instanceof Error
+          ? error.message
+          : t("config.connection_failed_check");
+      setOpenworkTestState("error");
+      setOpenworkTestMessage(message);
+    }
+  };
+
+  const renderTokenRow = (
+    label: string,
+    tokenValue: string | null | undefined,
+    hint: string,
+    visible: boolean,
+    toggle: () => void,
+    copyKey: string,
+  ) => (
+    <div className="flex items-center justify-between bg-gray-1 p-3 rounded-xl border border-gray-6 gap-3">
+      <div className="min-w-0">
+        <div className="text-xs font-medium text-gray-11">{label}</div>
+        <div className="text-xs text-gray-7 font-mono truncate">
+          {visible ? tokenValue || "—" : tokenValue ? "••••••••••••" : "—"}
+        </div>
+        <div className="text-[11px] text-gray-8 mt-1">{hint}</div>
+      </div>
+      <div className="flex items-center gap-2 shrink-0">
+        <Button
+          variant="outline"
+          className="text-xs h-8 py-0 px-3"
+          onClick={toggle}
+          disabled={!tokenValue}
+        >
+          {visible ? t("common.hide") : t("common.show")}
+        </Button>
+        <Button
+          variant="outline"
+          className="text-xs h-8 py-0 px-3"
+          onClick={() => handleCopy(tokenValue ?? "", copyKey)}
+          disabled={!tokenValue}
+        >
+          {copyingField === copyKey ? t("config.copied") : t("config.copy")}
+        </Button>
+      </div>
+    </div>
+  );
+
+  return (
+    <section className="space-y-6">
+      <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-2">
+        <div className="text-sm font-medium text-gray-12">
+          {t("config.workspace_config_title")}
+        </div>
+        <div className="text-xs text-gray-10">
+          {t("config.workspace_config_desc")}
+        </div>
+        {props.runtimeWorkspaceId ? (
+          <div className="text-[11px] text-gray-7 font-mono truncate">
+            {t("config.workspace_id_prefix")}
+            {props.runtimeWorkspaceId}
+          </div>
+        ) : null}
+      </div>
+
+      <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-4">
+        <div>
+          <div className="text-sm font-medium text-gray-12">
+            {t("config.engine_reload_title")}
+          </div>
+          <div className="text-xs text-gray-10">
+            {t("config.engine_reload_desc")}
+          </div>
+        </div>
+
+        <div className="flex items-center justify-between bg-gray-1 p-3 rounded-xl border border-gray-6 gap-3">
+          <div className="min-w-0 space-y-1">
+            <div className="text-sm text-gray-12">
+              {t("config.reload_now_title")}
+            </div>
+            <div className="text-xs text-gray-7">
+              {t("config.reload_now_desc")}
+            </div>
+            {props.anyActiveRuns ? (
+              <div className="text-[11px] text-amber-11">
+                {t("config.reload_active_tasks_warning")}
+              </div>
+            ) : null}
+            {props.reloadError ? (
+              <div className="text-[11px] text-red-11">{props.reloadError}</div>
+            ) : null}
+            {reloadAvailabilityReason ? (
+              <div className="text-[11px] text-gray-9">
+                {reloadAvailabilityReason}
+              </div>
+            ) : null}
+          </div>
+          <Button
+            variant={reloadButtonTone}
+            className="text-xs h-8 py-0 px-3 shrink-0"
+            onClick={props.reloadWorkspaceEngine}
+            disabled={reloadButtonDisabled}
+          >
+            <RefreshCcw
+              size={14}
+              className={props.reloadBusy ? "animate-spin" : ""}
+            />
+            {reloadButtonLabel}
+          </Button>
+        </div>
+      </div>
+
+      {props.developerMode ? (
+        <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-3">
+          <div className="flex flex-col gap-2 md:flex-row md:items-center md:justify-between">
+            <div>
+              <div className="text-sm font-medium text-gray-12">
+                {t("config.diagnostics_title")}
+              </div>
+              <div className="text-xs text-gray-10">
+                {t("config.diagnostics_desc")}
+              </div>
+            </div>
+            <Button
+              variant="secondary"
+              className="text-xs h-8 py-0 px-3 shrink-0"
+              onClick={() =>
+                void handleCopy(diagnosticsBundleJson, "debug-bundle")
+              }
+              disabled={props.busy}
+            >
+              {copyingField === "debug-bundle"
+                ? t("config.copied")
+                : t("config.copy")}
+            </Button>
+          </div>
+          <pre className="text-xs text-gray-12 whitespace-pre-wrap break-words max-h-64 overflow-auto bg-gray-1/20 border border-gray-6 rounded-xl p-3">
+            {diagnosticsBundleJson}
+          </pre>
+        </div>
+      ) : null}
+
+      {hostInfo ? (
+        <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-4">
+          <div className="flex flex-col gap-2 md:flex-row md:items-center md:justify-between">
+            <div>
+              <div className="text-sm font-medium text-gray-12">
+                {t("config.server_sharing_title")}
+              </div>
+              <div className="text-xs text-gray-10">
+                {t("config.server_sharing_desc")}
+              </div>
+            </div>
+            <div
+              className={`text-xs px-2 py-1 rounded-full border ${hostStatusStyle}`}
+            >
+              {hostStatusLabel}
+            </div>
+          </div>
+
+          <div className="grid gap-3">
+            <div className="flex items-center justify-between bg-gray-1 p-3 rounded-xl border border-gray-6 gap-3">
+              <div className="min-w-0">
+                <div className="text-xs font-medium text-gray-11">
+                  {t("config.server_url_label")}
+                </div>
+                <div className="text-xs text-gray-7 font-mono truncate">
+                  {hostConnectUrl || t("config.starting_server")}
+                </div>
+                {hostConnectUrl ? (
+                  <div className="text-[11px] text-gray-8 mt-1">
+                    {!hostRemoteAccessEnabled
+                      ? t("config.remote_access_off_hint")
+                      : hostConnectUrlUsesMdns
+                        ? t("config.mdns_hint")
+                        : t("config.local_ip_hint")}
+                  </div>
+                ) : null}
+              </div>
+              <Button
+                variant="outline"
+                className="text-xs h-8 py-0 px-3 shrink-0"
+                onClick={() => handleCopy(hostConnectUrl, "host-url")}
+                disabled={!hostConnectUrl}
+              >
+                {copyingField === "host-url"
+                  ? t("config.copied")
+                  : t("config.copy")}
+              </Button>
+            </div>
+
+            {renderTokenRow(
+              t("config.collaborator_token_label"),
+              hostInfo?.clientToken,
+              hostRemoteAccessEnabled
+                ? t("config.collaborator_token_remote_hint")
+                : t("config.collaborator_token_disabled_hint"),
+              clientTokenVisible,
+              () => setClientTokenVisible((prev) => !prev),
+              "client-token",
+            )}
+
+            {renderTokenRow(
+              t("config.owner_token_label"),
+              hostInfo?.ownerToken,
+              hostRemoteAccessEnabled
+                ? t("config.owner_token_remote_hint")
+                : t("config.owner_token_disabled_hint"),
+              ownerTokenVisible,
+              () => setOwnerTokenVisible((prev) => !prev),
+              "owner-token",
+            )}
+
+            {renderTokenRow(
+              t("config.host_admin_token_label"),
+              hostInfo?.hostToken,
+              t("config.host_admin_token_hint"),
+              hostTokenVisible,
+              () => setHostTokenVisible((prev) => !prev),
+              "host-token",
+            )}
+          </div>
+
+          <div className="text-xs text-gray-9">
+            {t("config.server_sharing_menu_hint")}
+          </div>
+        </div>
+      ) : null}
+
+      <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-4">
+        <div className="flex flex-col gap-2 md:flex-row md:items-center md:justify-between">
+          <div>
+            <div className="text-sm font-medium text-gray-12">
+              {t("config.server_section_title")}
+            </div>
+            <div className="text-xs text-gray-10">
+              {t("config.server_section_desc")}
+            </div>
+          </div>
+          <div
+            className={`text-xs px-2 py-1 rounded-full border ${openworkStatusStyle}`}
+          >
+            {openworkStatusLabel}
+          </div>
+        </div>
+
+        <div className="grid gap-3">
+          <TextInput
+            label={t("config.server_url_input_label")}
+            value={openworkUrl}
+            onChange={(event) => setOpenworkUrl(event.currentTarget.value)}
+            placeholder="http://127.0.0.1:<port>"
+            hint={t("config.server_url_hint")}
+            disabled={props.busy}
+          />
+
+          <label className="block">
+            <div className="mb-1 text-xs font-medium text-gray-11">
+              {t("config.token_label")}
+            </div>
+            <div className="flex items-center gap-2">
+              <input
+                type={openworkTokenVisible ? "text" : "password"}
+                value={openworkToken}
+                onChange={(event) => setOpenworkToken(event.currentTarget.value)}
+                placeholder={t("config.token_placeholder")}
+                disabled={props.busy}
+                className="w-full rounded-xl bg-gray-2/60 px-3 py-2 text-sm text-gray-12 placeholder:text-gray-10 shadow-[0_0_0_1px_rgba(255,255,255,0.08)] focus:outline-none focus:ring-2 focus:ring-gray-6/20"
+              />
+              <Button
+                variant="outline"
+                className="text-xs h-9 px-3 shrink-0"
+                onClick={() => setOpenworkTokenVisible((prev) => !prev)}
+                disabled={props.busy}
+              >
+                {openworkTokenVisible ? t("common.hide") : t("common.show")}
+              </Button>
+            </div>
+            <div className="mt-1 text-xs text-gray-10">
+              {t("config.token_hint")}
+            </div>
+          </label>
+        </div>
+
+        <div className="space-y-1">
+          <div className="text-[11px] text-gray-7 font-mono truncate">
+            {t("config.resolved_worker_url")}
+            {resolvedWorkspaceUrl || t("config.not_set")}
+          </div>
+          <div className="text-[11px] text-gray-8 font-mono truncate">
+            {t("config.worker_id")}
+            {resolvedWorkspaceId || t("config.unavailable")}
+          </div>
+        </div>
+
+        <div className="flex flex-wrap gap-2">
+          <Button
+            variant="secondary"
+            onClick={() => void handleTestConnection()}
+            disabled={props.busy || openworkTestState === "testing"}
+          >
+            {openworkTestState === "testing"
+              ? t("config.testing")
+              : t("config.test_connection")}
+          </Button>
+          <Button
+            variant="outline"
+            onClick={() =>
+              props.updateOpenworkServerSettings(buildOpenworkSettings())
+            }
+            disabled={props.busy || !hasOpenworkChanges}
+          >
+            {t("common.save")}
+          </Button>
+          <Button
+            variant="ghost"
+            onClick={props.resetOpenworkServerSettings}
+            disabled={props.busy}
+          >
+            {t("common.reset")}
+          </Button>
+        </div>
+
+        {openworkTestState !== "idle" ? (
+          <div
+            className={`text-xs ${
+              openworkTestState === "success"
+                ? "text-green-11"
+                : openworkTestState === "error"
+                  ? "text-red-11"
+                  : "text-gray-9"
+            }`}
+            role="status"
+            aria-live="polite"
+          >
+            {openworkTestState === "testing"
+              ? t("config.testing_connection")
+              : (openworkTestMessage ?? t("config.connection_status_updated"))}
+          </div>
+        ) : null}
+
+        {openworkStatusLabel !== t("config.status_connected") ? (
+          <div className="text-xs text-gray-9">
+            {t("config.server_needed_hint")}
+          </div>
+        ) : null}
+      </div>
+
+      <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-2">
+        <div className="text-sm font-medium text-gray-12">
+          {t("config.messaging_identities_title")}
+        </div>
+        <div className="text-xs text-gray-10">
+          {t("config.messaging_identities_desc")}
+        </div>
+      </div>
+
+      {!isDesktopRuntime() ? (
+        <div className="text-xs text-gray-9">
+          {t("config.desktop_only_hint")}
+        </div>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/debug-view.tsx b/apps/app/src/react-app/domains/settings/pages/debug-view.tsx
new file mode 100644
index 0000000000..27db7fc924
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/debug-view.tsx
@@ -0,0 +1,1086 @@
+/** @jsxImportSource react */
+import {
+  CircleAlert,
+  Copy,
+  Download,
+  ExternalLink,
+  HardDrive,
+  RefreshCcw,
+  Smartphone,
+} from "lucide-react";
+
+import type {
+  OpenworkAuditEntry,
+  OpenworkServerCapabilities,
+  OpenworkServerDiagnostics,
+} from "../../../../app/lib/openwork-server";
+import type { SandboxDebugProbeResult } from "../../../../app/lib/desktop";
+import type {
+  OpencodeConnectStatus,
+  ReleaseChannel,
+  StartupPreference,
+} from "../../../../app/types";
+import { formatRelativeTime, isDesktopRuntime } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+const sectionHeaderClass = "flex flex-col gap-1 pb-2";
+const sectionTitleClass = "text-[15px] font-semibold tracking-[-0.2px] text-dls-text";
+const sectionDescClass = "text-[12px] text-dls-secondary";
+const cardClass =
+  "rounded-2xl border border-dls-border bg-dls-surface/95 p-5 space-y-4";
+const subCardClass = "rounded-xl border border-dls-border bg-dls-sidebar/40 p-4 space-y-3";
+const monoPreClass =
+  "max-h-64 overflow-auto whitespace-pre-wrap break-words rounded-lg border border-dls-border bg-dls-sidebar/40 p-3 text-[11px] font-mono text-dls-text";
+const miniPreClass =
+  "max-h-28 overflow-auto whitespace-pre-wrap break-words rounded-lg border border-dls-border bg-dls-sidebar/30 p-2 text-[11px] font-mono text-dls-text";
+const compactDangerActionClass =
+  "inline-flex h-9 items-center gap-2 rounded-xl border border-red-7/40 bg-red-9 px-4 text-xs font-medium text-white transition-colors hover:bg-red-10 disabled:cursor-not-allowed disabled:opacity-60";
+
+type RuntimeSummary = {
+  appVersionLabel: string;
+  appCommitLabel: string;
+  opencodeVersionLabel: string;
+  openworkServerVersionLabel: string;
+};
+
+type StatusPill = {
+  label: string;
+  className: string;
+};
+
+type RuntimeServiceCard = StatusPill & {
+  lines: string[];
+  stdout?: string | null;
+  stderr?: string | null;
+  error?: string | null;
+};
+
+type OpenCodeConnectDebugCard = StatusPill & {
+  lines: string[];
+  metricsLines: string[];
+  error?: string | null;
+};
+
+type ServiceStatus = { tone: "success" | "error"; message: string } | null;
+
+export type DebugViewProps = {
+  developerMode: boolean;
+  busy: boolean;
+  anyActiveRuns: boolean;
+  startupPreference: StartupPreference | null;
+  startupLabel: string;
+  startupStatus: string | null;
+  runtimeSummary: RuntimeSummary;
+  runtimeDebugReportJson: string;
+  runtimeDebugStatus: string | null;
+  onCopyRuntimeDebugReport: () => void | Promise<void>;
+  onExportRuntimeDebugReport: () => void | Promise<void>;
+  developerLogRecordCount: number;
+  developerLogText: string;
+  developerLogStatus: string | null;
+  onClearDeveloperLog: () => void | Promise<void>;
+  onCopyDeveloperLog: () => void | Promise<void>;
+  onExportDeveloperLog: () => void | Promise<void>;
+  electronMigrationAvailable: boolean;
+  electronMigrationUrl: string;
+  electronMigrationSha256: string;
+  electronMigrationSha512: string;
+  electronMigrationArtifactLabel: string | null;
+  electronMigrationBusy: boolean;
+  electronMigrationStatus: string | null;
+  electronPreviewReleaseUrl: string;
+  onSetElectronMigrationUrl: (value: string) => void;
+  onSetElectronMigrationSha256: (value: string) => void;
+  onSetElectronMigrationSha512: (value: string) => void;
+  onOpenElectronPreviewRelease: () => void | Promise<void>;
+  onResolveElectronAlphaArtifact: () => void | Promise<void>;
+  onRevealElectronMigrationBackup: () => void | Promise<void>;
+  onPrepareElectronMigrationSnapshot: () => void | Promise<void>;
+  onInstallElectronPreviewFromTauri: () => void | Promise<void>;
+  electronAlphaUpdaterAvailable: boolean;
+  electronAlphaUpdaterBusy: boolean;
+  electronAlphaUpdaterStatus: string | null;
+  electronAlphaUpdaterChannel: ReleaseChannel;
+  onSetElectronAlphaUpdaterChannel: (channel: ReleaseChannel) => void | Promise<void>;
+  onCheckElectronAlphaUpdates: () => void | Promise<void>;
+  sandboxProbeBusy: boolean;
+  sandboxProbeResult: SandboxDebugProbeResult | null;
+  sandboxProbeStatus: string | null;
+  onRunSandboxDebugProbe: () => void | Promise<void>;
+  onStopHost: () => void | Promise<void>;
+  onResetStartupPreference: () => void | Promise<void>;
+  engineSource: "path" | "sidecar" | "custom";
+  onSetEngineSource: (value: "path" | "sidecar" | "custom") => void;
+  engineCustomBinPath: string;
+  engineCustomBinPathLabel: string;
+  onPickEngineBinary: () => void | Promise<void>;
+  onClearEngineCustomBinPath: () => void;
+  onOpenResetModal: (mode: "onboarding" | "all") => void;
+  resetModalBusy: boolean;
+  resetStatus: string | null;
+  opencodeRestarting: boolean;
+  openworkServerRestarting: boolean;
+  opencodeServiceStatus: ServiceStatus;
+  openworkServiceStatus: ServiceStatus;
+  opencodeLogStatus: string | null;
+  openworkLogStatus: string | null;
+  onCopyOpencodeLogs: () => void | Promise<void>;
+  onExportOpencodeLogs: () => void | Promise<void>;
+  onCopyOpenworkLogs: () => void | Promise<void>;
+  onExportOpenworkLogs: () => void | Promise<void>;
+  serviceRestartError: string | null;
+  onRestartOpencode: () => void | Promise<void>;
+  onRestartOpenworkServer: () => void | Promise<void>;
+  engineCard: RuntimeServiceCard;
+  opencodeConnectCard: OpenCodeConnectDebugCard;
+  openworkCard: RuntimeServiceCard;
+  openworkServerDiagnostics: OpenworkServerDiagnostics | null;
+  runtimeWorkspaceId: string | null;
+  openworkServerCapabilities: OpenworkServerCapabilities | null;
+  pendingPermissions: unknown;
+  events: unknown;
+  workspaceDebugEvents: unknown;
+  workspaceDebugEventsStatus: string | null;
+  safeStringify: (value: unknown) => string;
+  onClearWorkspaceDebugEvents: () => void | Promise<void>;
+  openworkAuditEntries: OpenworkAuditEntry[];
+  openworkAuditStatus: StatusPill;
+  openworkAuditError: string | null;
+  opencodeConnectStatus: OpencodeConnectStatus | null;
+  opencodeDevModeEnabled: boolean;
+  nukeConfigBusy: boolean;
+  nukeConfigStatus: string | null;
+  onNukeOpenworkAndOpencodeConfig: () => void | Promise<void>;
+};
+
+function formatActor(entry: OpenworkAuditEntry) {
+  if (entry.actor.type === "host") return t("settings.audit_actor_host");
+  if (entry.actor.clientId) return entry.actor.clientId;
+  if (entry.actor.tokenHash) return entry.actor.tokenHash;
+  return t("settings.audit_actor_remote");
+}
+
+function formatCapability(value: { read: boolean; write: boolean }) {
+  if (value.read && value.write) return t("settings.cap_read_write");
+  if (value.read) return t("settings.cap_read_only");
+  if (value.write) return t("settings.cap_write_only");
+  return t("settings.disabled");
+}
+
+function formatUptime(ms: number) {
+  const totalSeconds = Math.max(0, Math.floor(ms / 1000));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor((totalSeconds % 3600) / 60);
+  const seconds = totalSeconds % 60;
+
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  if (minutes > 0) return `${minutes}m ${seconds}s`;
+  return `${seconds}s`;
+}
+
+function renderLines(lines: string[]) {
+  return lines.map((line, index) => (
+    <div key={`${line}-${index}`} className="truncate text-[11px] font-mono text-dls-secondary">
+      {line}
+    </div>
+  ));
+}
+
+function StatusBanner(props: { tone: "success" | "error" | "info"; message: string }) {
+  const cls =
+    props.tone === "success"
+      ? "border-green-6 bg-green-3/40 text-green-11"
+      : props.tone === "error"
+        ? "border-red-6 bg-red-3/40 text-red-11"
+        : "border-dls-border bg-dls-sidebar/40 text-dls-secondary";
+  return (
+    <div className={`rounded-lg border px-3 py-2 text-[11px] ${cls}`}>{props.message}</div>
+  );
+}
+
+type ServiceCardProps = {
+  title: string;
+  description: string;
+  pill: StatusPill;
+  lines: string[];
+  stdout?: string | null;
+  stderr?: string | null;
+  error?: string | null;
+  restarting: boolean;
+  restartLabel: string;
+  onRestart: () => void | Promise<void>;
+  serviceStatus: ServiceStatus;
+  logStatus: string | null;
+  onCopyLogs: () => void | Promise<void>;
+  onExportLogs: () => void | Promise<void>;
+  isDesktop: boolean;
+};
+
+function ServiceCard(props: ServiceCardProps) {
+  const restartDisabled = props.restarting || !props.isDesktop;
+  return (
+    <div className={subCardClass}>
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0">
+          <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">{props.title}</div>
+          <div className="text-[12px] text-dls-secondary">{props.description}</div>
+        </div>
+        <div className={`rounded-full border px-2 py-1 text-[11px] font-medium ${props.pill.className}`}>
+          {props.pill.label}
+        </div>
+      </div>
+
+      <div className="space-y-1">{renderLines(props.lines)}</div>
+
+      <div className="flex flex-wrap items-center gap-2">
+        <Button
+          variant="secondary"
+          onClick={() => void props.onRestart()}
+          disabled={restartDisabled}
+          className="h-9 px-3 py-0 text-xs"
+          title={!props.isDesktop ? t("settings.sandbox_requires_desktop") : ""}
+        >
+          <RefreshCcw className={`mr-1.5 h-3.5 w-3.5 ${props.restarting ? "animate-spin" : ""}`} />
+          {props.restarting ? t("settings.restarting") : props.restartLabel}
+        </Button>
+        <Button
+          variant="outline"
+          onClick={() => void props.onCopyLogs()}
+          className="h-9 px-3 py-0 text-xs"
+        >
+          <Copy size={13} className="mr-1.5" />
+          {t("settings.copy_logs")}
+        </Button>
+        <Button
+          variant="outline"
+          onClick={() => void props.onExportLogs()}
+          className="h-9 px-3 py-0 text-xs"
+        >
+          <Download size={13} className="mr-1.5" />
+          {t("settings.export_log_button")}
+        </Button>
+      </div>
+
+      {props.serviceStatus ? (
+        <StatusBanner tone={props.serviceStatus.tone} message={props.serviceStatus.message} />
+      ) : null}
+      {props.logStatus ? <StatusBanner tone="info" message={props.logStatus} /> : null}
+
+      <details className="group">
+        <summary className="cursor-pointer select-none text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+          {t("settings.last_stdout")} / {t("settings.last_stderr")}
+        </summary>
+        <div className="mt-2 grid gap-2">
+          <div>
+            <div className="mb-1 text-[10px] font-medium uppercase tracking-wider text-dls-secondary">
+              {t("settings.last_stdout")}
+            </div>
+            <pre className={miniPreClass}>{props.stdout || t("settings.no_logs_captured")}</pre>
+          </div>
+          <div>
+            <div className="mb-1 text-[10px] font-medium uppercase tracking-wider text-dls-secondary">
+              {t("settings.last_stderr")}
+            </div>
+            <pre className={miniPreClass}>{props.stderr || t("settings.no_logs_captured")}</pre>
+          </div>
+          {props.error ? (
+            <div>
+              <div className="mb-1 text-[10px] font-medium uppercase tracking-wider text-dls-secondary">
+                {t("settings.last_error")}
+              </div>
+              <pre className={miniPreClass}>{props.error}</pre>
+            </div>
+          ) : null}
+        </div>
+      </details>
+    </div>
+  );
+}
+
+export function DebugView(props: DebugViewProps) {
+  if (!props.developerMode) return null;
+
+  const isDesktop = isDesktopRuntime();
+  const isLocalPreference = props.startupPreference !== "server";
+  const sandboxProbeDisabled = !isDesktop || props.sandboxProbeBusy || props.anyActiveRuns;
+  const sandboxProbeTitle = !isDesktop
+    ? t("settings.sandbox_requires_desktop")
+    : props.anyActiveRuns
+      ? t("settings.sandbox_stop_runs_hint")
+      : "";
+
+  return (
+    <section className="space-y-6">
+      {/* Section: Runtime overview */}
+      <div className={cardClass}>
+        <div className="flex items-start justify-between gap-3">
+          <div>
+            <div className={sectionTitleClass}>{t("settings.runtime_debug_title")}</div>
+            <div className={sectionDescClass}>{t("settings.runtime_debug_desc")}</div>
+          </div>
+          <div className="flex shrink-0 items-center gap-2">
+            <Button
+              variant="outline"
+              className="h-8 px-3 py-0 text-xs"
+              onClick={() => void props.onCopyRuntimeDebugReport()}
+            >
+              <Copy size={13} className="mr-1.5" />
+              {t("settings.copy_json")}
+            </Button>
+            <Button
+              variant="secondary"
+              className="h-8 px-3 py-0 text-xs"
+              onClick={() => void props.onExportRuntimeDebugReport()}
+            >
+              <Download size={13} className="mr-1.5" />
+              {t("settings.export")}
+            </Button>
+          </div>
+        </div>
+        <div className="grid gap-2 text-[12px] text-dls-secondary md:grid-cols-2">
+          <div>{t("settings.debug_desktop_app", undefined, { version: props.runtimeSummary.appVersionLabel })}</div>
+          <div>{t("settings.debug_commit", undefined, { commit: props.runtimeSummary.appCommitLabel })}</div>
+          <div>
+            {t("settings.debug_opencode_version", undefined, { version: props.runtimeSummary.opencodeVersionLabel })}
+          </div>
+          <div>
+            {t("settings.debug_openwork_server_version", undefined, {
+              version: props.runtimeSummary.openworkServerVersionLabel,
+            })}
+          </div>
+        </div>
+        {props.runtimeDebugStatus ? <StatusBanner tone="info" message={props.runtimeDebugStatus} /> : null}
+        <details className="group">
+          <summary className="cursor-pointer select-none text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+            JSON
+          </summary>
+          <pre className={`${monoPreClass} mt-2`}>{props.runtimeDebugReportJson}</pre>
+        </details>
+      </div>
+
+      {/* Section: Services */}
+      <div className={cardClass}>
+        <div className={sectionHeaderClass}>
+          <div className={sectionTitleClass}>{t("settings.services_section_title")}</div>
+          <div className={sectionDescClass}>{t("settings.services_section_desc")}</div>
+        </div>
+
+        <div className="grid gap-3 lg:grid-cols-2">
+          <ServiceCard
+            title={t("settings.openwork_server_label")}
+            description={t("settings.openwork_config_sidecar_desc")}
+            pill={props.openworkCard}
+            lines={props.openworkCard.lines}
+            stdout={props.openworkCard.stdout ?? null}
+            stderr={props.openworkCard.stderr ?? null}
+            error={props.openworkCard.error ?? null}
+            restarting={props.openworkServerRestarting}
+            restartLabel={t("settings.restart_openwork_server")}
+            onRestart={props.onRestartOpenworkServer}
+            serviceStatus={props.openworkServiceStatus}
+            logStatus={props.openworkLogStatus}
+            onCopyLogs={props.onCopyOpenworkLogs}
+            onExportLogs={props.onExportOpenworkLogs}
+            isDesktop={isDesktop}
+          />
+
+          <ServiceCard
+            title={t("settings.opencode_engine_sidecar")}
+            description={t("settings.opencode_engine_sidecar_desc")}
+            pill={props.engineCard}
+            lines={props.engineCard.lines}
+            stdout={props.engineCard.stdout ?? null}
+            stderr={props.engineCard.stderr ?? null}
+            error={props.engineCard.error ?? null}
+            restarting={props.opencodeRestarting}
+            restartLabel={t("settings.restart_opencode")}
+            onRestart={props.onRestartOpencode}
+            serviceStatus={props.opencodeServiceStatus}
+            logStatus={props.opencodeLogStatus}
+            onCopyLogs={props.onCopyOpencodeLogs}
+            onExportLogs={props.onExportOpencodeLogs}
+            isDesktop={isDesktop}
+          />
+        </div>
+
+        <div className={subCardClass}>
+          <div className="flex items-start justify-between gap-3">
+            <div className="min-w-0">
+              <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+                {t("settings.opencode_sdk_title")}
+              </div>
+              <div className="text-[12px] text-dls-secondary">{t("settings.opencode_sdk_desc")}</div>
+            </div>
+            <div className={`rounded-full border px-2 py-1 text-[11px] font-medium ${props.opencodeConnectCard.className}`}>
+              {props.opencodeConnectCard.label}
+            </div>
+          </div>
+          <div className="space-y-1">{renderLines(props.opencodeConnectCard.lines)}</div>
+          {props.opencodeConnectCard.metricsLines.length > 0 ? (
+            <div className="space-y-1 border-t border-dls-border/60 pt-1">
+              {renderLines(props.opencodeConnectCard.metricsLines)}
+            </div>
+          ) : null}
+          {props.opencodeConnectCard.error ? (
+            <div>
+              <div className="mb-1 text-[10px] font-medium uppercase tracking-wider text-dls-secondary">
+                {t("settings.last_error")}
+              </div>
+              <pre className={miniPreClass}>{props.opencodeConnectCard.error}</pre>
+            </div>
+          ) : null}
+        </div>
+
+        {props.serviceRestartError ? (
+          <StatusBanner tone="error" message={props.serviceRestartError} />
+        ) : null}
+      </div>
+
+      {/* Section: Diagnostics */}
+      <div className={cardClass}>
+        <div className={sectionHeaderClass}>
+          <div className={sectionTitleClass}>{t("settings.openwork_diagnostics_title")}</div>
+          <div className={sectionDescClass}>
+            <span className="font-mono text-[11px] text-dls-secondary">
+              {props.openworkServerDiagnostics?.version ?? "—"}
+            </span>
+          </div>
+        </div>
+
+        {props.openworkServerDiagnostics ? (
+          <div className="grid gap-2 text-[12px] text-dls-secondary md:grid-cols-2">
+            <div>{t("settings.diag_started", undefined, { time: formatUptime(props.openworkServerDiagnostics.uptimeMs) })}</div>
+            <div>
+              {t("settings.diag_read_only", undefined, {
+                value: props.openworkServerDiagnostics.readOnly ? "true" : "false",
+              })}
+            </div>
+            <div>
+              {t("settings.diag_approval", undefined, {
+                mode: props.openworkServerDiagnostics.approval.mode,
+                ms: String(props.openworkServerDiagnostics.approval.timeoutMs),
+              })}
+            </div>
+            <div>{t("settings.diag_workspaces", undefined, { count: String(props.openworkServerDiagnostics.workspaceCount) })}</div>
+            <div>
+              {t("settings.diag_selected_workspace", undefined, {
+                id: props.openworkServerDiagnostics.selectedWorkspaceId ?? "—",
+              })}
+            </div>
+            <div>
+              {t("settings.diag_runtime_workspace", undefined, {
+                id: props.openworkServerDiagnostics.activeWorkspaceId ?? "—",
+              })}
+            </div>
+            <div>
+              {t("settings.diag_config_path", undefined, {
+                path: props.openworkServerDiagnostics.server.configPath ?? t("settings.diag_default"),
+              })}
+            </div>
+            <div>
+              {t("settings.diag_token_source", undefined, {
+                source: props.openworkServerDiagnostics.tokenSource.client,
+              })}
+            </div>
+            <div>
+              {t("settings.diag_host_token_source", undefined, {
+                source: props.openworkServerDiagnostics.tokenSource.host,
+              })}
+            </div>
+          </div>
+        ) : (
+          <div className="text-[12px] text-dls-secondary">{t("settings.diagnostics_unavailable")}</div>
+        )}
+
+        <div className={subCardClass}>
+          <div className="flex items-center justify-between gap-3">
+            <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+              {t("settings.capabilities_title")}
+            </div>
+            <div className="truncate font-mono text-[11px] text-dls-secondary">
+              {props.runtimeWorkspaceId
+                ? t("settings.worker_id_label", undefined, { id: props.runtimeWorkspaceId })
+                : t("settings.worker_unresolved")}
+            </div>
+          </div>
+          {props.openworkServerCapabilities ? (
+            <div className="grid gap-2 text-[12px] text-dls-secondary md:grid-cols-2">
+              <div>{t("settings.cap_skills", undefined, { value: formatCapability(props.openworkServerCapabilities.skills) })}</div>
+              <div>{t("settings.cap_plugins", undefined, { value: formatCapability(props.openworkServerCapabilities.plugins) })}</div>
+              <div>{t("settings.cap_mcp", undefined, { value: formatCapability(props.openworkServerCapabilities.mcp) })}</div>
+              <div>{t("settings.cap_commands", undefined, { value: formatCapability(props.openworkServerCapabilities.commands) })}</div>
+              <div>{t("settings.cap_config", undefined, { value: formatCapability(props.openworkServerCapabilities.config) })}</div>
+              <div>
+                {t("settings.cap_browser_tools", undefined, {
+                  value: (() => {
+                    const browser = props.openworkServerCapabilities.toolProviders?.browser;
+                    if (!browser?.enabled) return t("settings.disabled");
+                    return `${browser.mode} · ${browser.placement}`;
+                  })(),
+                })}
+              </div>
+              <div>
+                {t("settings.cap_file_tools", undefined, {
+                  value: (() => {
+                    const files = props.openworkServerCapabilities.toolProviders?.files;
+                    if (!files) return t("config.unavailable");
+                    return [
+                      files.injection ? t("settings.cap_inbox_on") : t("settings.cap_inbox_off"),
+                      files.outbox ? t("settings.cap_outbox_on") : t("settings.cap_outbox_off"),
+                    ].join(" · ");
+                  })(),
+                })}
+              </div>
+              <div>
+                {t("settings.cap_sandbox", undefined, {
+                  value: props.openworkServerCapabilities.sandbox
+                    ? `${props.openworkServerCapabilities.sandbox.backend} (${props.openworkServerCapabilities.sandbox.enabled ? t("settings.on") : t("settings.off")})`
+                    : t("config.unavailable"),
+                })}
+              </div>
+            </div>
+          ) : (
+            <div className="text-[12px] text-dls-secondary">{t("settings.capabilities_unavailable")}</div>
+          )}
+        </div>
+      </div>
+
+      {/* Section: Activity */}
+      <div className={cardClass}>
+        <div className={sectionHeaderClass}>
+          <div className={sectionTitleClass}>{t("settings.activity_section_title")}</div>
+          <div className={sectionDescClass}>{t("settings.activity_section_desc")}</div>
+        </div>
+
+        <div className={subCardClass}>
+          <div className="flex items-center justify-between gap-3">
+            <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+              {t("settings.audit_log_title")}
+            </div>
+            <div className={`rounded-full border px-2 py-1 text-[11px] font-medium ${props.openworkAuditStatus.className}`}>
+              {props.openworkAuditStatus.label}
+            </div>
+          </div>
+          {props.openworkAuditError ? <StatusBanner tone="error" message={props.openworkAuditError} /> : null}
+          {props.openworkAuditEntries.length > 0 ? (
+            <div className="divide-y divide-dls-border/60">
+              {props.openworkAuditEntries.map((entry) => (
+                <div key={entry.id} className="flex items-start justify-between gap-4 py-2">
+                  <div className="min-w-0">
+                    <div className="truncate text-sm text-dls-text">{entry.summary}</div>
+                    <div className="truncate text-[11px] text-dls-secondary">
+                      {entry.action} · {entry.target} · {formatActor(entry)}
+                    </div>
+                  </div>
+                  <div className="whitespace-nowrap text-[11px] text-dls-secondary">
+                    {entry.timestamp ? formatRelativeTime(entry.timestamp) : "—"}
+                  </div>
+                </div>
+              ))}
+            </div>
+          ) : (
+            <div className="text-[12px] text-dls-secondary">{t("settings.no_audit_entries")}</div>
+          )}
+        </div>
+
+        <div className="grid gap-3 md:grid-cols-2">
+          <div className={subCardClass}>
+            <div className="text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+              {t("settings.pending_permissions")}
+            </div>
+            <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words text-[11px] font-mono text-dls-text">
+              {props.safeStringify(props.pendingPermissions)}
+            </pre>
+          </div>
+          <div className={subCardClass}>
+            <div className="text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+              {t("settings.recent_events")}
+            </div>
+            <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words text-[11px] font-mono text-dls-text">
+              {props.safeStringify(props.events)}
+            </pre>
+          </div>
+        </div>
+
+        <div className={subCardClass}>
+          <div className="flex items-center justify-between gap-3">
+            <div className="text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+              {t("settings.workspace_debug_events_label")}
+            </div>
+            <Button
+              variant="outline"
+              className="h-7 shrink-0 px-2 py-0 text-xs"
+              onClick={() => void props.onClearWorkspaceDebugEvents()}
+              disabled={props.busy}
+            >
+              {t("settings.clear_button")}
+            </Button>
+          </div>
+          <pre className="max-h-48 overflow-auto whitespace-pre-wrap break-words text-[11px] font-mono text-dls-text">
+            {props.safeStringify(props.workspaceDebugEvents)}
+          </pre>
+          {props.workspaceDebugEventsStatus ? (
+            <StatusBanner tone="info" message={props.workspaceDebugEventsStatus} />
+          ) : null}
+        </div>
+      </div>
+
+      {/* Section: Developer log stream */}
+      <div className={cardClass}>
+        <div className="flex items-start justify-between gap-3">
+          <div>
+            <div className={sectionTitleClass}>{t("settings.developer_log_title")}</div>
+            <div className={sectionDescClass}>{t("settings.developer_log_desc")}</div>
+          </div>
+          <div className="flex shrink-0 items-center gap-2">
+            <Button variant="outline" className="h-8 px-3 py-0 text-xs" onClick={() => void props.onClearDeveloperLog()}>
+              {t("settings.clear_button")}
+            </Button>
+            <Button variant="outline" className="h-8 px-3 py-0 text-xs" onClick={() => void props.onCopyDeveloperLog()}>
+              <Copy size={13} className="mr-1.5" />
+              {t("settings.copy_log_button")}
+            </Button>
+            <Button variant="secondary" className="h-8 px-3 py-0 text-xs" onClick={() => void props.onExportDeveloperLog()}>
+              <Download size={13} className="mr-1.5" />
+              {t("settings.export_log_button")}
+            </Button>
+          </div>
+        </div>
+        <div className="text-[11px] text-dls-secondary">
+          {t("settings.developer_log_count", undefined, { count: String(props.developerLogRecordCount) })}
+        </div>
+        <pre className={monoPreClass}>{props.developerLogText || t("settings.developer_log_empty")}</pre>
+        {props.developerLogStatus ? <StatusBanner tone="info" message={props.developerLogStatus} /> : null}
+      </div>
+
+      {/* Section: Tools */}
+      <div className={cardClass}>
+        <div className={sectionHeaderClass}>
+          <div className={sectionTitleClass}>{t("settings.tools_section_title")}</div>
+          <div className={sectionDescClass}>{t("settings.tools_section_desc")}</div>
+        </div>
+
+        <div className={subCardClass}>
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+                {t("settings.sandbox_probe_title")}
+              </div>
+              <div className="text-[12px] text-dls-secondary">{t("settings.sandbox_probe_desc")}</div>
+            </div>
+            <Button
+              variant="secondary"
+              className="h-8 px-3 py-0 text-xs"
+              onClick={() => void props.onRunSandboxDebugProbe()}
+              disabled={sandboxProbeDisabled}
+              title={sandboxProbeTitle}
+            >
+              {props.sandboxProbeBusy ? t("settings.running_probe") : t("settings.run_sandbox_probe")}
+            </Button>
+          </div>
+          {props.sandboxProbeResult ? (
+            <div className="space-y-1 text-[12px] text-dls-secondary">
+              <div>{t("settings.sandbox_run_id", undefined, { id: props.sandboxProbeResult.runId ?? "—" })}</div>
+              <div>
+                {t("settings.sandbox_result", undefined, {
+                  status: props.sandboxProbeResult.ready ? t("settings.sandbox_ready") : t("settings.sandbox_error"),
+                })}
+              </div>
+              {props.sandboxProbeResult.error ? (
+                <div className="text-red-11">{props.sandboxProbeResult.error}</div>
+              ) : null}
+            </div>
+          ) : null}
+          {props.sandboxProbeStatus ? <StatusBanner tone="info" message={props.sandboxProbeStatus} /> : null}
+          <div className="text-[11px] text-dls-secondary">{t("settings.sandbox_export_hint")}</div>
+        </div>
+
+        {isDesktop && (isLocalPreference || props.developerMode) ? (
+          <div className={subCardClass}>
+            <div>
+              <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">{t("settings.engine_title")}</div>
+              <div className="text-[12px] text-dls-secondary">{t("settings.engine_desc")}</div>
+            </div>
+
+            {!isLocalPreference ? (
+              <StatusBanner tone="info" message={t("settings.startup_remote_warning")} />
+            ) : null}
+
+            <div className="space-y-3">
+              <div className="text-[12px] text-dls-secondary">{t("settings.engine_source_debug")}</div>
+              <div className={props.developerMode ? "grid grid-cols-3 gap-2" : "grid grid-cols-2 gap-2"}>
+                <Button
+                  variant={props.engineSource === "sidecar" ? "secondary" : "outline"}
+                  onClick={() => props.onSetEngineSource("sidecar")}
+                  disabled={props.busy}
+                >
+                  {t("settings.engine_bundled")}
+                </Button>
+                <Button
+                  variant={props.engineSource === "path" ? "secondary" : "outline"}
+                  onClick={() => props.onSetEngineSource("path")}
+                  disabled={props.busy}
+                >
+                  {t("settings.engine_system_path")}
+                </Button>
+                {props.developerMode ? (
+                  <Button
+                    variant={props.engineSource === "custom" ? "secondary" : "outline"}
+                    onClick={() => props.onSetEngineSource("custom")}
+                    disabled={props.busy}
+                  >
+                    {t("settings.engine_custom_binary")}
+                  </Button>
+                ) : null}
+              </div>
+              <div className="text-[11px] text-dls-secondary">{t("settings.engine_bundled_hint")}</div>
+            </div>
+
+            {props.developerMode && props.engineSource === "custom" ? (
+              <div className="space-y-2">
+                <div className="text-[12px] text-dls-secondary">{t("settings.custom_binary_label")}</div>
+                <div className="flex items-center gap-2">
+                  <div
+                    className="min-w-0 flex-1 truncate rounded-xl border border-dls-border bg-dls-surface p-3 font-mono text-[11px] text-dls-secondary"
+                    title={props.engineCustomBinPathLabel}
+                  >
+                    {props.engineCustomBinPathLabel}
+                  </div>
+                  <Button
+                    variant="outline"
+                    className="h-10 shrink-0 px-3 text-xs"
+                    onClick={() => void props.onPickEngineBinary()}
+                    disabled={props.busy}
+                  >
+                    {t("settings.choose")}
+                  </Button>
+                  <Button
+                    variant="outline"
+                    className="h-10 shrink-0 px-3 text-xs"
+                    onClick={props.onClearEngineCustomBinPath}
+                    disabled={props.busy || !props.engineCustomBinPath.trim()}
+                    title={!props.engineCustomBinPath.trim() ? t("settings.no_custom_path_set") : t("settings.clear")}
+                  >
+                    {t("settings.clear")}
+                  </Button>
+                </div>
+                <div className="text-[11px] text-dls-secondary">{t("settings.custom_binary_hint")}</div>
+              </div>
+            ) : null}
+          </div>
+        ) : null}
+
+        <div className={subCardClass}>
+          <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+            {t("settings.startup_title")}
+          </div>
+
+          <div className="flex items-center justify-between rounded-xl border border-dls-border bg-dls-surface p-3">
+            <div className="flex items-center gap-3">
+              <div
+                className={`rounded-lg p-2 ${
+                  isLocalPreference ? "bg-indigo-7/10 text-indigo-11" : "bg-green-7/10 text-green-11"
+                }`}
+              >
+                {isLocalPreference ? <HardDrive size={18} /> : <Smartphone size={18} />}
+              </div>
+              <span className="text-sm font-medium text-dls-text">{props.startupLabel}</span>
+            </div>
+            <Button
+              variant="outline"
+              className="h-8 px-3 py-0 text-xs"
+              onClick={() => void props.onStopHost()}
+              disabled={props.busy}
+            >
+              {t("settings.switch")}
+            </Button>
+          </div>
+
+          <Button
+            variant="secondary"
+            className="group w-full justify-between"
+            onClick={() => void props.onResetStartupPreference()}
+          >
+            <span>{t("settings.reset_startup_pref")}</span>
+            <RefreshCcw size={14} className="opacity-80 transition-transform group-hover:rotate-180" />
+          </Button>
+
+          <p className="text-[11px] text-dls-secondary">{t("settings.startup_reset_hint")}</p>
+          {props.startupStatus ? <StatusBanner tone="info" message={props.startupStatus} /> : null}
+        </div>
+      </div>
+
+      {/* Section: Reset & recovery */}
+      <div className={cardClass}>
+        <div className={sectionHeaderClass}>
+          <div className={sectionTitleClass}>{t("settings.recovery_section_title")}</div>
+          <div className={sectionDescClass}>{t("settings.recovery_section_desc")}</div>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-dls-border bg-dls-surface p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-dls-text">{t("settings.reset_onboarding_title")}</div>
+            <div className="text-[12px] text-dls-secondary">{t("settings.reset_onboarding_description")}</div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={() => props.onOpenResetModal("onboarding")}
+            disabled={props.busy || props.resetModalBusy || props.anyActiveRuns}
+            title={props.anyActiveRuns ? t("settings.stop_runs_to_reset") : ""}
+          >
+            {t("settings.reset_button")}
+          </Button>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-dls-border bg-dls-surface p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-dls-text">{t("settings.reset_app_data_title")}</div>
+            <div className="text-[12px] text-dls-secondary">{t("settings.reset_app_data_description")}</div>
+          </div>
+          <Button
+            variant="danger"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={() => props.onOpenResetModal("all")}
+            disabled={props.busy || props.resetModalBusy || props.anyActiveRuns}
+            title={props.anyActiveRuns ? t("settings.stop_runs_to_reset") : ""}
+          >
+            {t("settings.reset_button")}
+          </Button>
+        </div>
+
+        <div className="text-[11px] text-dls-secondary">{t("settings.reset_requires_confirm")}</div>
+        {props.resetStatus ? <StatusBanner tone="info" message={props.resetStatus} /> : null}
+      </div>
+
+      {/* Section: Electron alpha migration (debug only) */}
+      {props.electronMigrationAvailable ? (
+        <div className={cardClass}>
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <div className={sectionTitleClass}>Electron alpha migration</div>
+              <div className={sectionDescClass}>
+                Debug-only Tauri controls. Preparing migration data is non-destructive; installing requires a URL and two
+                confirmations.
+              </div>
+            </div>
+            <Button
+              variant="outline"
+              className="h-8 shrink-0 px-3 py-0 text-xs"
+              onClick={() => void props.onOpenElectronPreviewRelease()}
+            >
+              <ExternalLink size={13} className="mr-1.5" />
+              Alpha release
+            </Button>
+          </div>
+
+          <div className="rounded-xl border border-green-7/25 bg-green-3/10 px-3 py-2 text-[12px] leading-relaxed text-green-11">
+            Safe default: use <strong>Prepare migration data</strong> first. It writes the Electron snapshot only and does
+            not replace, quit, or delete the Tauri app. The install handoff keeps rollback backup at{" "}
+            <code className="font-mono">OpenWork.app.migrate-bak</code>.
+          </div>
+
+          <div className="flex flex-wrap items-center gap-2">
+            <Button
+              variant="secondary"
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onResolveElectronAlphaArtifact()}
+              disabled={props.electronMigrationBusy}
+            >
+              {props.electronMigrationBusy ? "Resolving…" : "Resolve latest Electron alpha"}
+            </Button>
+            {props.electronMigrationArtifactLabel ? (
+              <div className="min-w-0 flex-1 truncate text-[11px] text-dls-secondary">
+                {props.electronMigrationArtifactLabel}
+              </div>
+            ) : (
+              <div className="text-[11px] text-dls-secondary">Uses latest-mac.yml from the rolling alpha release.</div>
+            )}
+          </div>
+
+          <details className="rounded-xl border border-dls-border bg-dls-sidebar/30 p-3">
+            <summary className="cursor-pointer select-none text-[11px] font-medium uppercase tracking-wider text-dls-secondary">
+              Advanced manual artifact override
+            </summary>
+            <div className="mt-3 grid gap-3 md:grid-cols-[minmax(0,1fr)_220px]">
+              <label className="space-y-1 text-[12px] text-dls-secondary">
+                <span>Electron artifact URL</span>
+                <input
+                  type="url"
+                  value={props.electronMigrationUrl}
+                  onChange={(event) => props.onSetElectronMigrationUrl(event.currentTarget.value)}
+                  placeholder="Paste a trusted Electron .zip/.exe/AppImage URL"
+                  className="h-10 w-full rounded-xl border border-dls-border bg-dls-surface px-3 font-mono text-[11px] text-dls-text outline-none transition-colors placeholder:text-dls-secondary focus:border-dls-accent"
+                />
+              </label>
+              <label className="space-y-1 text-[12px] text-dls-secondary">
+                <span>sha512 from latest-mac.yml</span>
+                <input
+                  type="text"
+                  value={props.electronMigrationSha512}
+                  onChange={(event) => props.onSetElectronMigrationSha512(event.currentTarget.value)}
+                  placeholder="recommended"
+                  className="h-10 w-full rounded-xl border border-dls-border bg-dls-surface px-3 font-mono text-[11px] text-dls-text outline-none transition-colors placeholder:text-dls-secondary focus:border-dls-accent"
+                />
+              </label>
+              <label className="space-y-1 text-[12px] text-dls-secondary md:col-span-2">
+                <span>sha256 override (legacy optional)</span>
+                <input
+                  type="text"
+                  value={props.electronMigrationSha256}
+                  onChange={(event) => props.onSetElectronMigrationSha256(event.currentTarget.value)}
+                  placeholder="Only needed when the artifact provider gives sha256 instead of latest-mac.yml sha512"
+                  className="h-10 w-full rounded-xl border border-dls-border bg-dls-surface px-3 font-mono text-[11px] text-dls-text outline-none transition-colors placeholder:text-dls-secondary focus:border-dls-accent"
+                />
+              </label>
+            </div>
+          </details>
+
+          <div className="flex flex-wrap items-center gap-2">
+            <Button
+              variant="secondary"
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onPrepareElectronMigrationSnapshot()}
+              disabled={props.electronMigrationBusy}
+            >
+              {props.electronMigrationBusy ? "Preparing…" : "Prepare migration data"}
+            </Button>
+            <Button
+              variant="outline"
+              className="h-9 border-amber-7/50 px-3 py-0 text-xs text-amber-11 hover:bg-amber-3/40"
+              onClick={() => void props.onInstallElectronPreviewFromTauri()}
+              disabled={props.electronMigrationBusy || !props.electronMigrationUrl.trim()}
+              title="Requires a trusted artifact URL. macOS keeps OpenWork.app.migrate-bak for rollback."
+            >
+              Start install handoff…
+            </Button>
+            <Button
+              variant="outline"
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onRevealElectronMigrationBackup()}
+              disabled={props.electronMigrationBusy}
+            >
+              Open backup in Finder
+            </Button>
+            <div className="text-[11px] text-dls-secondary">
+              Release page: <span className="font-mono">{props.electronPreviewReleaseUrl}</span>
+            </div>
+          </div>
+
+          {props.electronMigrationStatus ? (
+            <StatusBanner tone="info" message={props.electronMigrationStatus} />
+          ) : null}
+        </div>
+      ) : null}
+
+      {/* Section: Electron alpha updater (debug only) */}
+      {props.electronAlphaUpdaterAvailable ? (
+        <div className={cardClass}>
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <div className={sectionTitleClass}>Electron alpha channel</div>
+              <div className={sectionDescClass}>
+                Debug-only controls for migrated Electron users. Stable updates remain the default in Settings → Updates.
+              </div>
+            </div>
+            <div className="rounded-full border border-dls-border bg-dls-sidebar/50 px-2.5 py-1 text-[11px] font-medium text-dls-secondary">
+              {props.electronAlphaUpdaterChannel === "alpha" ? "Alpha" : "Stable"}
+            </div>
+          </div>
+
+          <div className="flex flex-wrap items-center gap-2">
+            <Button
+              variant={props.electronAlphaUpdaterChannel === "alpha" ? "secondary" : "outline"}
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onSetElectronAlphaUpdaterChannel("alpha")}
+              disabled={props.electronAlphaUpdaterBusy}
+            >
+              Use alpha feed
+            </Button>
+            <Button
+              variant={props.electronAlphaUpdaterChannel === "stable" ? "secondary" : "outline"}
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onSetElectronAlphaUpdaterChannel("stable")}
+              disabled={props.electronAlphaUpdaterBusy}
+            >
+              Return to stable
+            </Button>
+            <Button
+              variant="outline"
+              className="h-9 px-3 py-0 text-xs"
+              onClick={() => void props.onCheckElectronAlphaUpdates()}
+              disabled={props.electronAlphaUpdaterBusy}
+            >
+              {props.electronAlphaUpdaterBusy ? "Checking…" : "Check selected feed"}
+            </Button>
+          </div>
+
+          <div className="text-[11px] text-dls-secondary">
+            Alpha feed: <span className="font-mono">alpha-macos-latest/latest-mac.yml</span>. Stable feed:{" "}
+            <span className="font-mono">releases/latest/download/latest-mac.yml</span>.
+          </div>
+
+          {props.electronAlphaUpdaterStatus ? (
+            <StatusBanner tone="info" message={props.electronAlphaUpdaterStatus} />
+          ) : null}
+        </div>
+      ) : null}
+
+      {/* Section: Danger zone */}
+      {isDesktop ? (
+        <div className="space-y-3 rounded-2xl border border-red-7/30 bg-red-3/10 p-5">
+          <div className={sectionHeaderClass}>
+            <div className="text-[15px] font-semibold tracking-[-0.2px] text-red-11">
+              {t("settings.danger_section_title")}
+            </div>
+            <div className={sectionDescClass}>{t("settings.danger_section_desc")}</div>
+          </div>
+
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <div className="text-sm font-semibold tracking-[-0.1px] text-dls-text">
+                {t("settings.reset_openwork_title")}
+              </div>
+              <div className="text-[12px] text-dls-secondary">
+                {props.opencodeDevModeEnabled
+                  ? t("settings.reset_openwork_desc_dev")
+                  : t("settings.reset_openwork_desc_prod")}
+              </div>
+            </div>
+            <div
+              className={`shrink-0 rounded-full border px-2.5 py-1 text-[11px] font-medium ${
+                props.opencodeDevModeEnabled
+                  ? "border-blue-7/35 bg-blue-3/25 text-blue-11"
+                  : "border-dls-border bg-dls-sidebar/50 text-dls-secondary"
+              }`}
+            >
+              {props.opencodeDevModeEnabled
+                ? t("settings.dev_mode_badge")
+                : t("settings.production_mode_badge")}
+            </div>
+          </div>
+
+          <div className="text-[11px] text-dls-secondary">{t("settings.quit_hint")}</div>
+
+          <div className="flex flex-wrap items-center gap-3">
+            <button
+              type="button"
+              className={compactDangerActionClass}
+              onClick={() => void props.onNukeOpenworkAndOpencodeConfig()}
+              disabled={props.busy || props.nukeConfigBusy}
+            >
+              <CircleAlert size={14} />
+              {props.nukeConfigBusy
+                ? t("settings.removing_local_state")
+                : t("settings.delete_local_config")}
+            </button>
+            <div className="text-[12px] text-dls-secondary">{t("settings.nuke_hint")}</div>
+          </div>
+
+          {props.nukeConfigStatus ? <StatusBanner tone="error" message={props.nukeConfigStatus} /> : null}
+        </div>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/den-view.tsx b/apps/app/src/react-app/domains/settings/pages/den-view.tsx
new file mode 100644
index 0000000000..c0f216c395
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/den-view.tsx
@@ -0,0 +1,11 @@
+/** @jsxImportSource react */
+import {
+  DenSettingsPanel,
+  type DenSettingsPanelProps,
+} from "../panels/den-settings-panel";
+
+export type DenViewProps = DenSettingsPanelProps;
+
+export function DenView(props: DenViewProps) {
+  return <DenSettingsPanel {...props} />;
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/environment-view.tsx b/apps/app/src/react-app/domains/settings/pages/environment-view.tsx
new file mode 100644
index 0000000000..c8998e2b3c
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/environment-view.tsx
@@ -0,0 +1,509 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useId, useMemo, useRef, useState } from "react";
+import { Eye, EyeOff, Plus, RefreshCw, Trash2, X } from "lucide-react";
+
+import type { OpenworkServerClient } from "../../../../app/lib/openwork-server";
+import {
+  readOpenworkEnvPendingChanges,
+  writeOpenworkEnvPendingChanges,
+} from "../../../../app/lib/openwork-env-runtime";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import { ConfirmModal } from "../../../design-system/modals/confirm-modal";
+import { TextInput } from "../../../design-system/text-input";
+import { clearOpenworkEnvSystemContextCache } from "../../session/sync/env-context";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+const rowIconButtonClass =
+  "inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-lg border border-gray-7/80 bg-gray-2 text-gray-11 shadow-sm transition-colors hover:border-gray-8 hover:bg-gray-4 hover:text-gray-12 focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.25)] disabled:cursor-not-allowed disabled:opacity-50";
+const rowDangerIconButtonClass =
+  "inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-lg border border-red-7/75 bg-red-3/40 text-red-10 shadow-sm transition-colors hover:border-red-8 hover:bg-red-4/80 hover:text-red-11 focus:outline-none focus:ring-2 focus:ring-red-7/30 disabled:cursor-not-allowed disabled:opacity-50";
+
+const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RESERVED_PREFIXES = ["OPENWORK_", "OPENCODE_"] as const;
+
+type EnvItem = { key: string; value: string; updatedAt: number };
+type ApplyEnvironmentChangesResult = { statusMessage?: string } | void;
+
+export type EnvironmentViewProps = {
+  client: OpenworkServerClient | null;
+  isRemoteWorkspace: boolean;
+  onStatusMessage: (message: string) => void;
+  onApplyChanges?: () => Promise<ApplyEnvironmentChangesResult>;
+  applyBlocked?: boolean;
+  applyBlockedReason?: string | null;
+  runtimeKey?: string | null;
+};
+
+function maskValue(value: string): string {
+  if (!value) return "";
+  if (value.length <= 6) return "••••••";
+  return `${value.slice(0, 2)}••••${value.slice(-2)}`;
+}
+
+function formatUpdatedAt(ms: number): string {
+  try {
+    return new Date(ms).toLocaleString();
+  } catch {
+    return "";
+  }
+}
+
+function validateKey(key: string): string | null {
+  const trimmed = key.trim();
+  if (!trimmed) return t("settings.environment.validation_empty");
+  if (!KEY_PATTERN.test(trimmed)) return t("settings.environment.validation_shape");
+  if (RESERVED_PREFIXES.some((prefix) => trimmed.startsWith(prefix))) {
+    return t("settings.environment.validation_reserved");
+  }
+  return null;
+}
+
+export function EnvironmentView(props: EnvironmentViewProps) {
+  const { client, isRemoteWorkspace, onStatusMessage } = props;
+  const canEdit = !isRemoteWorkspace && client !== null;
+  const editorTitleId = useId();
+
+  const [items, setItems] = useState<EnvItem[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [revealed, setRevealed] = useState<Record<string, boolean>>({});
+  const [editor, setEditor] = useState<{ mode: "add" | "edit"; key: string; value: string } | null>(null);
+  const [editorError, setEditorError] = useState<string | null>(null);
+  const [saving, setSaving] = useState(false);
+  const [deleteCandidate, setDeleteCandidate] = useState<EnvItem | null>(null);
+  const [deletingKey, setDeletingKey] = useState<string | null>(null);
+  const [pendingChanges, setPendingChanges] = useState(() =>
+    readOpenworkEnvPendingChanges(props.runtimeKey),
+  );
+  const [applyConfirmOpen, setApplyConfirmOpen] = useState(false);
+  const [applyBusy, setApplyBusy] = useState(false);
+  const [applyError, setApplyError] = useState<string | null>(null);
+  const refreshRequestId = useRef(0);
+  const applyBlockedReason = props.applyBlocked
+    ? props.applyBlockedReason ?? t("settings.environment.apply_blocked_active_tasks")
+    : null;
+
+  const refresh = useCallback(async () => {
+    const requestId = ++refreshRequestId.current;
+    if (!client || isRemoteWorkspace) {
+      setItems([]);
+      setRevealed({});
+      setError(null);
+      setLoading(false);
+      return;
+    }
+    setLoading(true);
+    setError(null);
+    try {
+      const response = await client.listUserEnv();
+      if (requestId !== refreshRequestId.current) return;
+      setItems(response.items);
+    } catch (err) {
+      if (requestId !== refreshRequestId.current) return;
+      setError(err instanceof Error ? err.message : t("app.unknown_error"));
+    } finally {
+      if (requestId === refreshRequestId.current) setLoading(false);
+    }
+  }, [client, isRemoteWorkspace]);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  useEffect(() => {
+    setPendingChanges(readOpenworkEnvPendingChanges(props.runtimeKey));
+  }, [props.runtimeKey]);
+
+  useEffect(() => {
+    if (canEdit) return;
+    setEditor(null);
+    setEditorError(null);
+    setDeleteCandidate(null);
+    setDeletingKey(null);
+    setApplyConfirmOpen(false);
+    setApplyError(null);
+  }, [canEdit]);
+
+  const existingKeys = useMemo(() => new Set(items.map((item) => item.key)), [items]);
+
+  const openAdd = () => {
+    if (!canEdit) return;
+    setEditorError(null);
+    setEditor({ mode: "add", key: "", value: "" });
+  };
+
+  const openEdit = (item: EnvItem) => {
+    if (!canEdit) return;
+    setEditorError(null);
+    setEditor({ mode: "edit", key: item.key, value: item.value });
+  };
+
+  const closeEditor = () => {
+    if (saving) return;
+    setEditor(null);
+    setEditorError(null);
+  };
+
+  const markChangesPending = () => {
+    clearOpenworkEnvSystemContextCache();
+    setPendingChanges(true);
+    writeOpenworkEnvPendingChanges(true, props.runtimeKey);
+    setApplyError(null);
+    onStatusMessage(t("settings.environment.restart_required"));
+  };
+
+  useEffect(() => {
+    if (!editor) return;
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key === "Escape") closeEditor();
+    };
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+  }, [editor, saving]);
+
+  const submitEditor = async () => {
+    if (!editor || !client) return;
+    const keyError = validateKey(editor.key);
+    if (keyError) {
+      setEditorError(keyError);
+      return;
+    }
+    if (editor.mode === "add" && existingKeys.has(editor.key.trim())) {
+      setEditorError(t("settings.environment.validation_duplicate"));
+      return;
+    }
+    setSaving(true);
+    setEditorError(null);
+    try {
+      await client.upsertUserEnv([{ key: editor.key.trim(), value: editor.value }]);
+      markChangesPending();
+      closeEditor();
+      await refresh();
+    } catch (err) {
+      setEditorError(err instanceof Error ? err.message : t("app.unknown_error"));
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const confirmDelete = async () => {
+    if (!client || !deleteCandidate || deletingKey) return;
+    const key = deleteCandidate.key;
+    setDeletingKey(key);
+    try {
+      await client.deleteUserEnv(key);
+      markChangesPending();
+      setDeleteCandidate(null);
+      await refresh();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("app.unknown_error"));
+    } finally {
+      setDeletingKey(null);
+    }
+  };
+
+  const applyChanges = async () => {
+    if (!props.onApplyChanges || applyBusy) return;
+    if (props.applyBlocked) {
+      const message = applyBlockedReason ?? t("settings.environment.apply_blocked_active_tasks");
+      setApplyError(message);
+      onStatusMessage(message);
+      return;
+    }
+    setApplyBusy(true);
+    setApplyError(null);
+    try {
+      const result = await props.onApplyChanges();
+      clearOpenworkEnvSystemContextCache();
+      setPendingChanges(false);
+      writeOpenworkEnvPendingChanges(false);
+      setApplyConfirmOpen(false);
+      onStatusMessage(result?.statusMessage ?? t("settings.environment.apply_success"));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("app.unknown_error");
+      setApplyError(message);
+      onStatusMessage(message);
+    } finally {
+      setApplyBusy(false);
+    }
+  };
+
+  return (
+    <div className="space-y-6">
+      <div className={`${settingsPanelClass} space-y-4`}>
+        <div className="flex items-start justify-between gap-4">
+          <div className="min-w-0">
+            <div className="text-sm font-medium text-gray-12">
+              {t("settings.environment.title")}
+            </div>
+            <p className="mt-1 max-w-[52ch] text-xs text-gray-10">
+              {t("settings.environment.description")}
+            </p>
+          </div>
+          {canEdit ? (
+            <Button
+              variant="primary"
+              className="h-8 shrink-0 px-3 py-0 text-xs"
+              onClick={openAdd}
+            >
+              <Plus size={13} className="mr-1.5" />
+              {t("settings.environment.add_button")}
+            </Button>
+          ) : null}
+        </div>
+
+        {isRemoteWorkspace ? (
+          <div className="rounded-lg border border-dls-border/60 bg-dls-surface-muted/40 px-3 py-2 text-xs text-gray-10">
+            {t("settings.environment.remote_workspace_hint")}
+          </div>
+        ) : null}
+
+        {error ? (
+          <div className="rounded-lg border border-red-7 bg-red-3/40 px-3 py-2 text-xs text-red-11">
+            {error}
+          </div>
+        ) : null}
+
+        {pendingChanges && !isRemoteWorkspace ? (
+          <div className="rounded-xl border border-amber-7/50 bg-amber-3/30 px-3 py-3">
+            <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+              <div className="flex min-w-0 items-start gap-2.5">
+                <div className="mt-0.5 flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-amber-4/70 text-amber-11">
+                  <RefreshCw size={14} />
+                </div>
+                <div className="min-w-0">
+                  <div className="text-xs font-medium text-gray-12">
+                    {t("settings.environment.apply_pending_title")}
+                  </div>
+                  <p className="mt-0.5 max-w-[54ch] text-xs text-gray-10">
+                    {props.onApplyChanges
+                      ? t("settings.environment.apply_pending_body")
+                      : t("settings.environment.apply_pending_body_manual")}
+                  </p>
+                  {applyBlockedReason ? (
+                    <div className="mt-2 rounded-lg border border-amber-7/50 bg-amber-3/30 px-3 py-2 text-xs text-amber-11">
+                      {applyBlockedReason}
+                    </div>
+                  ) : applyError ? (
+                    <div className="mt-2 rounded-lg border border-red-7 bg-red-3/40 px-3 py-2 text-xs text-red-11">
+                      {applyError}
+                    </div>
+                  ) : null}
+                </div>
+              </div>
+              {props.onApplyChanges ? (
+                <Button
+                  variant="primary"
+                  className="h-8 shrink-0 px-3 py-0 text-xs"
+                  onClick={() => {
+                    if (props.applyBlocked) {
+                      const message = applyBlockedReason ?? t("settings.environment.apply_blocked_active_tasks");
+                      setApplyError(message);
+                      onStatusMessage(message);
+                      return;
+                    }
+                    setApplyConfirmOpen(true);
+                  }}
+                  disabled={applyBusy || props.applyBlocked}
+                  title={applyBlockedReason ?? undefined}
+                >
+                  <RefreshCw size={13} className={applyBusy ? "animate-spin" : ""} />
+                  {applyBusy ? t("settings.environment.applying") : t("settings.environment.apply_button")}
+                </Button>
+              ) : null}
+            </div>
+          </div>
+        ) : null}
+
+        {isRemoteWorkspace ? null : loading && items.length === 0 ? (
+          <div className="py-6 text-center text-xs text-gray-10">
+            {t("settings.environment.loading")}
+          </div>
+        ) : items.length === 0 ? (
+          <div className="rounded-2xl border border-dashed border-dls-border/60 px-4 py-8 text-center">
+            <div className="text-sm text-gray-12">
+              {t("settings.environment.empty_title")}
+            </div>
+            <p className="mx-auto mt-1 max-w-[42ch] text-xs text-gray-10">
+              {t("settings.environment.empty_body")}
+            </p>
+          </div>
+        ) : (
+          <div className="divide-y divide-dls-border/60 overflow-hidden rounded-2xl border border-dls-border/60">
+            {items.map((item) => {
+              const isRevealed = Boolean(revealed[item.key]);
+              const displayValue = isRevealed ? item.value : maskValue(item.value);
+              return (
+                <div
+                  key={item.key}
+                  className="flex items-center gap-3 px-4 py-3 text-sm"
+                >
+                  <div className="min-w-0 flex-1">
+                    <button
+                      type="button"
+                      onClick={() => canEdit && openEdit(item)}
+                      disabled={!canEdit}
+                      className="font-mono text-[13px] text-gray-12 hover:underline disabled:cursor-default disabled:no-underline"
+                      title={canEdit ? t("settings.environment.click_to_edit") : ""}
+                    >
+                      {item.key}
+                    </button>
+                    <div className="mt-0.5 flex items-center gap-2 text-[11px] text-gray-8">
+                      <span className="font-mono">{displayValue || t("settings.environment.empty_value")}</span>
+                      <span>·</span>
+                      <span>{formatUpdatedAt(item.updatedAt)}</span>
+                    </div>
+                  </div>
+                  <div className="flex shrink-0 items-center gap-1">
+                    <button
+                      type="button"
+                      className={rowIconButtonClass}
+                      onClick={() =>
+                        setRevealed((current) => ({ ...current, [item.key]: !current[item.key] }))
+                      }
+                      title={isRevealed ? t("settings.environment.hide") : t("settings.environment.reveal")}
+                      aria-pressed={isRevealed}
+                      aria-label={(isRevealed
+                        ? t("settings.environment.hide_value")
+                        : t("settings.environment.reveal_value")
+                      ).replace("{key}", item.key)}
+                    >
+                      {isRevealed ? <EyeOff className="h-4 w-4" strokeWidth={2.1} /> : <Eye className="h-4 w-4" strokeWidth={2.1} />}
+                    </button>
+                    {canEdit ? (
+                      <button
+                        type="button"
+                        className={rowDangerIconButtonClass}
+                        onClick={() => setDeleteCandidate(item)}
+                        disabled={deletingKey === item.key}
+                        title={t("settings.environment.delete")}
+                        aria-label={t("settings.environment.delete_variable").replace("{key}", item.key)}
+                      >
+                        <Trash2 className="h-4 w-4" strokeWidth={2.1} />
+                      </button>
+                    ) : null}
+                  </div>
+                </div>
+              );
+            })}
+          </div>
+        )}
+
+        {!isRemoteWorkspace ? (
+          <div className="space-y-1 text-[11px] text-gray-8">
+            <div>{t("settings.environment.footer_hint")}</div>
+            <div>{t("settings.environment.override_hint")}</div>
+          </div>
+        ) : null}
+      </div>
+
+      {editor ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+          <div className="absolute inset-0 bg-gray-1/60 backdrop-blur-sm" onClick={closeEditor} />
+          <div
+            className="relative w-full max-w-md rounded-2xl border border-gray-6 bg-gray-2 p-5 shadow-2xl"
+            onClick={(event) => event.stopPropagation()}
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby={editorTitleId}
+          >
+            <div className="flex items-center justify-between">
+              <div id={editorTitleId} className="text-sm font-medium text-gray-12">
+                {editor.mode === "add"
+                  ? t("settings.environment.add_title")
+                  : t("settings.environment.edit_title")}
+              </div>
+              <Button
+                variant="ghost"
+                className="h-7 w-7 p-0"
+                onClick={closeEditor}
+                aria-label={t("settings.environment.close_editor")}
+                title={t("settings.environment.close_editor")}
+              >
+                <X size={14} />
+              </Button>
+            </div>
+
+            <div className="mt-4 space-y-3">
+              <TextInput
+                label={t("settings.environment.key_label")}
+                hint={t("settings.environment.key_hint")}
+                value={editor.key}
+                onChange={(event) =>
+                  setEditor((current) => (current ? { ...current, key: event.target.value } : current))
+                }
+                disabled={editor.mode === "edit" || saving}
+                autoFocus={editor.mode === "add"}
+                placeholder="ANTHROPIC_API_KEY"
+              />
+              <label className="block">
+                <div className="mb-1 text-xs font-medium text-dls-secondary">
+                  {t("settings.environment.value_label")}
+                </div>
+                <textarea
+                  value={editor.value}
+                  onChange={(event) =>
+                    setEditor((current) => (current ? { ...current, value: event.target.value } : current))
+                  }
+                  disabled={saving}
+                  rows={3}
+                  spellCheck={false}
+                  autoComplete="off"
+                  className="w-full rounded-lg border border-dls-border bg-dls-surface px-3 py-2 font-mono text-[13px] text-dls-text shadow-sm focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.2)]"
+                />
+              </label>
+              {editorError ? (
+                <div className="rounded-lg border border-red-7 bg-red-3/40 px-3 py-2 text-xs text-red-11">
+                  {editorError}
+                </div>
+              ) : null}
+            </div>
+
+            <div className="mt-5 flex justify-end gap-2">
+              <Button variant="outline" className="h-8 px-3 text-xs" onClick={closeEditor} disabled={saving}>
+                {t("settings.environment.cancel")}
+              </Button>
+              <Button
+                variant="primary"
+                className="h-8 px-3 text-xs"
+                onClick={() => void submitEditor()}
+                disabled={saving}
+              >
+                {saving ? t("settings.environment.saving") : t("settings.environment.save")}
+              </Button>
+            </div>
+          </div>
+        </div>
+      ) : null}
+
+      <ConfirmModal
+        open={deleteCandidate !== null}
+        title={t("settings.environment.delete_title")}
+        message={deleteCandidate ? t("settings.environment.confirm_delete").replace("{key}", deleteCandidate.key) : ""}
+        confirmLabel={deletingKey ? t("settings.environment.deleting") : t("settings.environment.delete")}
+        cancelLabel={t("settings.environment.cancel")}
+        variant="danger"
+        confirmButtonVariant="danger"
+        onConfirm={() => void confirmDelete()}
+        onCancel={() => {
+          if (!deletingKey) setDeleteCandidate(null);
+        }}
+      />
+
+      <ConfirmModal
+        open={applyConfirmOpen}
+        title={t("settings.environment.apply_title")}
+        message={t("settings.environment.apply_confirm_body")}
+        confirmLabel={applyBusy ? t("settings.environment.applying") : t("settings.environment.apply_button")}
+        cancelLabel={t("settings.environment.cancel")}
+        variant="warning"
+        confirmButtonVariant="primary"
+        onConfirm={() => void applyChanges()}
+        onCancel={() => {
+          if (!applyBusy) setApplyConfirmOpen(false);
+        }}
+      />
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/extensions-view.tsx b/apps/app/src/react-app/domains/settings/pages/extensions-view.tsx
new file mode 100644
index 0000000000..9106becb87
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/extensions-view.tsx
@@ -0,0 +1,181 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useState, type ReactNode } from "react";
+import { Box, Cpu } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+import { PluginsView, type PluginsExtensionsStore } from "./plugins-view";
+
+export type ExtensionsSection = "all" | "mcp" | "plugins";
+
+type SuggestedPlugin = {
+  name: string;
+  packageName: string;
+  description: string;
+  tags: string[];
+  aliases?: string[];
+  installMode?: "simple" | "guided";
+  steps?: Array<{
+    title: string;
+    description: string;
+    command?: string;
+    url?: string;
+    path?: string;
+    note?: string;
+  }>;
+};
+
+// The Solid ExtensionsView pulled the MCP-connected count from
+// useConnections(). In React we let the parent pass that plus an
+// already-rendered MCP view so we can ship this page before the full
+// connections provider is ported.
+export type ExtensionsViewProps = {
+  busy: boolean;
+  selectedWorkspaceRoot: string;
+  isRemoteWorkspace: boolean;
+  canEditPlugins: boolean;
+  canUseGlobalScope: boolean;
+  accessHint?: string | null;
+  suggestedPlugins: SuggestedPlugin[];
+  extensions: PluginsExtensionsStore;
+  mcpConnectedAppsCount: number;
+  mcpView: ReactNode;
+  onRefresh: () => void;
+  initialSection?: ExtensionsSection;
+  setSectionRoute?: (tab: "mcp" | "plugins") => void;
+  showHeader?: boolean;
+};
+
+export function ExtensionsView(props: ExtensionsViewProps) {
+  const [section, setSection] = useState<ExtensionsSection>(
+    props.initialSection ?? "all",
+  );
+
+  useEffect(() => {
+    if (!props.initialSection || props.initialSection === section) return;
+    setSection(props.initialSection);
+    // Intentional: only react to incoming prop changes.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [props.initialSection]);
+
+  const pluginCount = useMemo(
+    () => props.extensions.pluginList().length,
+    [props.extensions],
+  );
+
+  const selectSection = (nextSection: ExtensionsSection) => {
+    setSection(nextSection);
+    if (nextSection === "mcp" || nextSection === "plugins") {
+      props.setSectionRoute?.(nextSection);
+    }
+  };
+
+  const pillClass = (active: boolean) =>
+    `px-3 py-1 rounded-full text-xs font-medium border transition-colors flex items-center gap-2 ${
+      active
+        ? "bg-gray-12/10 text-gray-12 border-gray-6/20"
+        : "text-gray-10 border-gray-6 hover:text-gray-12"
+    }`;
+
+  return (
+    <section className="space-y-6 animate-in fade-in duration-300">
+      <div className="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
+        <div className="space-y-1">
+          {props.showHeader !== false ? (
+            <>
+              <h2 className="text-3xl font-bold text-dls-text">
+                {t("extensions.title")}
+              </h2>
+              <p className="text-sm text-dls-secondary mt-1.5">
+                {t("extensions.subtitle")}
+              </p>
+            </>
+          ) : null}
+          <div
+            className={`${props.showHeader === false ? "" : "mt-3"} flex flex-wrap items-center gap-2`}
+          >
+            {props.mcpConnectedAppsCount > 0 ? (
+              <div className="inline-flex items-center gap-2 rounded-full bg-green-3 px-3 py-1">
+                <div className="w-2 h-2 rounded-full bg-green-9" />
+                <span className="text-xs font-medium text-green-11">
+                  {t("extensions.app_count", { count: props.mcpConnectedAppsCount })}
+                </span>
+              </div>
+            ) : null}
+            {pluginCount > 0 ? (
+              <div className="inline-flex items-center gap-2 rounded-full bg-gray-3 px-3 py-1">
+                <Cpu size={14} className="text-gray-11" />
+                <span className="text-xs font-medium text-gray-11">
+                  {t("extensions.plugin_count", { count: pluginCount })}
+                </span>
+              </div>
+            ) : null}
+          </div>
+        </div>
+
+        <div className="flex flex-wrap items-center gap-2">
+          <div className="flex items-center gap-2">
+            <button
+              type="button"
+              className={pillClass(section === "all")}
+              aria-pressed={section === "all"}
+              onClick={() => selectSection("all")}
+            >
+              {t("extensions.filter_all")}
+            </button>
+            <button
+              type="button"
+              className={pillClass(section === "mcp")}
+              aria-pressed={section === "mcp"}
+              onClick={() => selectSection("mcp")}
+            >
+              <Box size={14} />
+              {t("extensions.filter_apps")}
+            </button>
+            <button
+              type="button"
+              className={pillClass(section === "plugins")}
+              aria-pressed={section === "plugins"}
+              onClick={() => selectSection("plugins")}
+            >
+              <Cpu size={14} />
+              {t("extensions.filter_plugins")}
+            </button>
+          </div>
+          <Button variant="ghost" onClick={props.onRefresh}>
+            {t("common.refresh")}
+          </Button>
+        </div>
+      </div>
+
+      {section === "all" || section === "mcp" ? (
+        <div className="space-y-4">
+          <div className="flex items-center gap-2 text-sm font-medium text-gray-12">
+            <Box size={16} className="text-gray-11" />
+            <span>{t("extensions.apps_mcp_header")}</span>
+          </div>
+          {props.mcpView}
+        </div>
+      ) : null}
+
+      {section === "all" || section === "plugins" ? (
+        <div className="space-y-4">
+          <div className="flex items-center gap-2 text-sm font-medium text-gray-12">
+            <Cpu size={16} className="text-gray-11" />
+            <span>{t("extensions.plugins_opencode_header")}</span>
+          </div>
+          <PluginsView
+            extensions={props.extensions}
+            busy={props.busy}
+            selectedWorkspaceRoot={props.selectedWorkspaceRoot}
+            canEditPlugins={props.canEditPlugins}
+            canUseGlobalScope={props.canUseGlobalScope}
+            accessHint={props.accessHint}
+            suggestedPlugins={props.suggestedPlugins}
+          />
+        </div>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/general-view.tsx b/apps/app/src/react-app/domains/settings/pages/general-view.tsx
new file mode 100644
index 0000000000..77b385842c
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/general-view.tsx
@@ -0,0 +1,270 @@
+/** @jsxImportSource react */
+import { ArrowUpRight, LifeBuoy, MessageCircle, PlugZap } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import { ProviderIcon } from "../../../design-system/provider-icon";
+import {
+  AuthorizedFoldersPanel,
+  type AuthorizedFoldersPanelProps,
+} from "../panels/authorized-folders-panel";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+const settingsPanelSoftClass = "rounded-2xl border border-gray-6/60 bg-gray-1/40 p-4";
+
+type ConnectedProvider = {
+  id: string;
+  name: string;
+  source?: "env" | "api" | "config" | "custom";
+};
+
+export type GeneralSettingsViewProps = {
+  authorizedFoldersPanel: AuthorizedFoldersPanelProps;
+  busy: boolean;
+  providerAuthBusy: boolean;
+  providerStatusLabel: string;
+  providerStatusStyle: string;
+  providerSummary: string;
+  connectedProviders: ConnectedProvider[];
+  disconnectingProviderId: string | null;
+  providerConnectError: string | null;
+  providerDisconnectStatus: string | null;
+  providerDisconnectError: string | null;
+  onOpenProviderAuth: () => void | Promise<void>;
+  onDisconnectProvider: (providerId: string) => void | Promise<void>;
+  canDisconnectProvider: (source?: ConnectedProvider["source"]) => boolean;
+  defaultModelLabel: string;
+  defaultModelRef: string;
+  onChangeDefaultModel: () => void;
+  showThinking: boolean;
+  onToggleShowThinking: () => void;
+  defaultModelVariantLabel: string;
+  onConfigureModelBehavior: () => void;
+  autoCompactContext: boolean;
+  autoCompactContextBusy: boolean;
+  onToggleAutoCompactContext: () => void;
+  onSendFeedback: () => void;
+  onJoinDiscord: () => void;
+  onReportIssue: () => void;
+};
+
+function providerSourceLabel(source?: ConnectedProvider["source"]) {
+  if (source === "env") return t("settings.provider_source_env");
+  if (source === "api") return t("providers.api_key_label");
+  if (source === "config") return t("settings.provider_source_config");
+  if (source === "custom") return t("settings.provider_source_custom");
+  return null;
+}
+
+export function GeneralSettingsView(props: GeneralSettingsViewProps) {
+  return (
+    <div className="space-y-6">
+      <AuthorizedFoldersPanel {...props.authorizedFoldersPanel} />
+
+      <div className={`${settingsPanelClass} space-y-4`}>
+        <div className="flex items-start justify-between gap-4">
+          <div>
+            <div className="flex items-center gap-2">
+              <PlugZap size={16} className="text-gray-11" />
+              <div className="text-sm font-medium text-gray-12">
+                {t("settings.providers_title")}
+              </div>
+            </div>
+            <div className="mt-1 text-xs text-gray-9">{t("settings.providers_desc")}</div>
+          </div>
+          <div className={`rounded-full border px-2 py-1 text-xs ${props.providerStatusStyle}`}>
+            {props.providerStatusLabel}
+          </div>
+        </div>
+
+        <div className="flex flex-wrap items-center gap-3">
+          <Button
+            variant="secondary"
+            onClick={() => void props.onOpenProviderAuth()}
+            disabled={props.busy || props.providerAuthBusy}
+          >
+            {props.providerAuthBusy
+              ? t("settings.loading_providers")
+              : t("settings.connect_provider")}
+          </Button>
+          <div className="text-xs text-gray-10">{props.providerSummary}</div>
+        </div>
+
+        {props.connectedProviders.length > 0 ? (
+          <div className="space-y-2">
+            {props.connectedProviders.map((provider) => (
+              <div
+                key={provider.id}
+                className={`${settingsPanelSoftClass} flex flex-wrap items-center justify-between gap-3 px-3 py-2`}
+              >
+                <div className="min-w-0 flex items-center gap-3">
+                  <ProviderIcon providerId={provider.id} size={18} className="text-gray-12" />
+                  <div className="min-w-0">
+                    <div className="truncate text-sm font-medium text-gray-12">{provider.name}</div>
+                    <div className="truncate font-mono text-[11px] text-gray-8">{provider.id}</div>
+                    {providerSourceLabel(provider.source) ? (
+                      <div className="mt-1 truncate text-[11px] text-gray-9">
+                        {providerSourceLabel(provider.source)}
+                      </div>
+                    ) : null}
+                  </div>
+                </div>
+                <Button
+                  variant="outline"
+                  className="h-8 px-3 py-0 text-xs"
+                  onClick={() => void props.onDisconnectProvider(provider.id)}
+                  disabled={
+                    props.busy ||
+                    props.providerAuthBusy ||
+                    props.disconnectingProviderId !== null ||
+                    !props.canDisconnectProvider(provider.source)
+                  }
+                >
+                  {props.disconnectingProviderId === provider.id
+                    ? t("settings.disconnecting")
+                    : props.canDisconnectProvider(provider.source)
+                      ? t("settings.disconnect")
+                      : t("settings.managed_by_env")}
+                </Button>
+              </div>
+            ))}
+          </div>
+        ) : null}
+
+        {props.providerConnectError ? (
+          <div className="rounded-xl border border-red-7/30 bg-red-1/40 px-3 py-2 text-xs text-red-11">
+            {props.providerConnectError}
+          </div>
+        ) : null}
+        {props.providerDisconnectStatus ? (
+          <div className={`${settingsPanelSoftClass} px-3 py-2 text-xs text-gray-10`}>
+            {props.providerDisconnectStatus}
+          </div>
+        ) : null}
+        {props.providerDisconnectError ? (
+          <div className="rounded-xl border border-red-7/30 bg-red-1/40 px-3 py-2 text-xs text-red-11">
+            {props.providerDisconnectError}
+          </div>
+        ) : null}
+
+        <div className="text-[11px] text-gray-9">{t("settings.api_keys_info")}</div>
+      </div>
+
+      <div className={`${settingsPanelClass} space-y-4`}>
+        <div>
+          <div className="text-sm font-medium text-gray-12">{t("settings.model_title")}</div>
+          <div className="text-xs text-gray-10">{t("settings.model_section_desc")}</div>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="truncate text-sm text-gray-12">{props.defaultModelLabel}</div>
+            <div className="truncate font-mono text-xs text-gray-7">{props.defaultModelRef}</div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.onChangeDefaultModel}
+            disabled={props.busy}
+          >
+            {t("settings.change")}
+          </Button>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-gray-12">{t("settings.show_model_reasoning")}</div>
+            <div className="text-xs text-gray-7">{t("settings.show_model_reasoning_desc")}</div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.onToggleShowThinking}
+            disabled={props.busy}
+          >
+            {props.showThinking ? t("settings.on") : t("settings.off")}
+          </Button>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-gray-12">{t("settings.model_behavior")}</div>
+            <div className="truncate text-xs text-gray-7">{t("settings.model_behavior_desc")}</div>
+            <div className="mt-1 truncate text-xs font-medium text-gray-8">
+              {props.defaultModelVariantLabel}
+            </div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.onConfigureModelBehavior}
+            disabled={props.busy}
+          >
+            {t("settings.configure")}
+          </Button>
+        </div>
+
+        <div className="flex items-center justify-between gap-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+          <div className="min-w-0">
+            <div className="text-sm text-gray-12">{t("settings.auto_compact")}</div>
+            <div className="text-xs text-gray-7">{t("settings.auto_compact_desc")}</div>
+          </div>
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 px-3 py-0 text-xs"
+            onClick={props.onToggleAutoCompactContext}
+            disabled={props.busy || props.autoCompactContextBusy}
+          >
+            {props.autoCompactContext ? t("settings.on") : t("settings.off")}
+          </Button>
+        </div>
+      </div>
+
+      <div className="relative overflow-hidden rounded-2xl border border-blue-7/30 bg-gradient-to-br from-blue-3/35 via-gray-1/75 to-cyan-3/30 p-5">
+        <div className="pointer-events-none absolute -right-10 -top-10 h-32 w-32 rounded-full bg-blue-6/20 blur-2xl" />
+        <div className="pointer-events-none absolute -bottom-12 left-6 h-24 w-24 rounded-full bg-cyan-6/20 blur-2xl" />
+
+        <div className="relative space-y-4">
+          <div className="space-y-2">
+            <div className="inline-flex items-center gap-1.5 rounded-full border border-blue-7/35 bg-blue-4/25 px-2.5 py-1 text-[11px] font-medium text-blue-11">
+              <LifeBuoy size={12} />
+              {t("settings.feedback_badge")}
+            </div>
+            <div className="text-sm font-semibold text-gray-12">{t("settings.feedback_title")}</div>
+            <div className="max-w-[58ch] text-xs text-gray-10">{t("settings.feedback_desc")}</div>
+          </div>
+
+          <div className="flex flex-wrap items-center gap-2">
+            <button
+              type="button"
+              className="inline-flex h-9 items-center justify-center gap-2 rounded-xl border border-transparent bg-blue-9 px-4 text-xs font-semibold text-blue-1 transition-colors duration-150 active:scale-[0.98] hover:bg-blue-10 focus:outline-none focus:ring-2 focus:ring-blue-7/30"
+              onClick={props.onSendFeedback}
+            >
+              <MessageCircle size={14} />
+              {t("settings.send_feedback")}
+              <ArrowUpRight size={13} />
+            </button>
+
+            <button
+              type="button"
+              className="inline-flex h-9 items-center gap-1.5 rounded-xl border border-blue-7/35 bg-gray-1/70 px-3 text-xs font-medium text-gray-11 transition-colors hover:border-blue-7/50 hover:text-gray-12 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-7/30"
+              onClick={props.onJoinDiscord}
+            >
+              {t("settings.join_discord")}
+              <ArrowUpRight size={13} />
+            </button>
+
+            <button
+              type="button"
+              className="inline-flex h-9 items-center gap-1.5 rounded-xl border border-gray-7/60 bg-gray-1/70 px-3 text-xs font-medium text-gray-10 transition-colors hover:border-gray-7/80 hover:text-gray-12 focus:outline-none focus-visible:ring-2 focus-visible:ring-gray-7/40"
+              onClick={props.onReportIssue}
+            >
+              {t("settings.report_issue")}
+              <ArrowUpRight size={13} />
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/mcp-view.tsx b/apps/app/src/react-app/domains/settings/pages/mcp-view.tsx
new file mode 100644
index 0000000000..33f492d54c
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/mcp-view.tsx
@@ -0,0 +1,828 @@
+/** @jsxImportSource react */
+import { useEffect, useRef, useState } from "react";
+import {
+  BookOpen,
+  CheckCircle2,
+  ChevronDown,
+  CircleAlert,
+  Code2,
+  CreditCard,
+  ExternalLink,
+  FolderOpen,
+  Globe,
+  Loader2,
+  MonitorSmartphone,
+  Plug2,
+  Plus,
+  Power,
+  Settings,
+  Settings2,
+  Unplug,
+  Zap,
+} from "lucide-react";
+
+import { type McpDirectoryInfo } from "../../../../app/constants";
+import {
+  openDesktopPath,
+  readOpencodeConfig,
+  revealDesktopItemInDir,
+  type OpencodeConfigFile,
+} from "../../../../app/lib/desktop";
+import {
+  buildChromeDevtoolsCommand,
+  getMcpIdentityKey,
+  isChromeDevtoolsMcp,
+  normalizeMcpSlug,
+  usesChromeDevtoolsAutoConnect,
+} from "../../../../app/mcp";
+import type { McpServerEntry, McpStatusMap } from "../../../../app/types";
+import { formatRelativeTime, isDesktopRuntime, isWindowsPlatform } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import { ConfirmModal } from "../../../design-system/modals/confirm-modal";
+import { AddMcpModal } from "../../connections/modals/add-mcp-modal";
+import { ControlChromeSetupModal } from "../../connections/modals/control-chrome-setup-modal";
+
+export type ReactMcpStatus =
+  | "connected"
+  | "needs_auth"
+  | "needs_client_registration"
+  | "failed"
+  | "disabled"
+  | "disconnected";
+
+export type McpViewProps = {
+  busy: boolean;
+  selectedWorkspaceRoot: string;
+  isRemoteWorkspace: boolean;
+  readConfigFile?: (scope: "project" | "global") => Promise<OpencodeConfigFile | null>;
+  showHeader?: boolean;
+  mcpServers: McpServerEntry[];
+  mcpStatus: string | null;
+  mcpLastUpdatedAt: number | null;
+  mcpStatuses: McpStatusMap;
+  mcpConnectingName: string | null;
+  selectedMcp: string | null;
+  setSelectedMcp: (name: string | null) => void;
+  quickConnect: McpDirectoryInfo[];
+  connectMcp: (entry: McpDirectoryInfo) => void;
+  authorizeMcp: (entry: McpServerEntry) => void;
+  logoutMcpAuth: (name: string) => Promise<void> | void;
+  removeMcp: (name: string) => void;
+  setMcpEnabled?: (name: string, enabled: boolean) => Promise<void> | void;
+};
+
+const statusDot = (status: ReactMcpStatus) => {
+  switch (status) {
+    case "connected":
+      return "bg-green-9";
+    case "needs_auth":
+    case "needs_client_registration":
+      return "bg-amber-9";
+    case "disabled":
+      return "bg-gray-8";
+    case "disconnected":
+      return "bg-gray-7";
+    default:
+      return "bg-red-9";
+  }
+};
+
+const friendlyStatus = (status: ReactMcpStatus) => {
+  switch (status) {
+    case "connected":
+      return t("mcp.friendly_status_ready");
+    case "needs_auth":
+    case "needs_client_registration":
+      return t("mcp.friendly_status_needs_signin");
+    case "disabled":
+      return t("mcp.friendly_status_paused");
+    case "disconnected":
+      return t("mcp.friendly_status_offline");
+    default:
+      return t("mcp.friendly_status_issue");
+  }
+};
+
+const statusBadgeStyle = (status: ReactMcpStatus) => {
+  switch (status) {
+    case "connected":
+      return "bg-green-3 text-green-11";
+    case "needs_auth":
+    case "needs_client_registration":
+      return "bg-amber-3 text-amber-11";
+    case "disabled":
+    case "disconnected":
+      return "bg-gray-3 text-gray-11";
+    default:
+      return "bg-red-3 text-red-11";
+  }
+};
+
+const serviceIcon = (name: string) => {
+  const lower = name.toLowerCase();
+  if (lower.includes("notion")) return BookOpen;
+  if (lower.includes("linear")) return Zap;
+  if (lower.includes("sentry")) return CircleAlert;
+  if (lower.includes("stripe")) return CreditCard;
+  if (lower.includes("context")) return Globe;
+  if (lower.includes("chrome") || lower.includes("devtools")) {
+    return MonitorSmartphone;
+  }
+  return Plug2;
+};
+
+const serviceColor = (name: string) => {
+  const lower = name.toLowerCase();
+  if (lower.includes("notion")) return "text-gray-12";
+  if (lower.includes("linear")) return "text-blue-11";
+  if (lower.includes("sentry")) return "text-purple-11";
+  if (lower.includes("stripe")) return "text-blue-11";
+  if (lower.includes("context")) return "text-green-11";
+  if (lower.includes("chrome") || lower.includes("devtools")) {
+    return "text-amber-11";
+  }
+  return "text-dls-secondary";
+};
+
+const serviceIconBg = (name: string) => {
+  const lower = name.toLowerCase();
+  if (lower.includes("notion")) return "bg-gray-3 border-gray-6";
+  if (lower.includes("linear")) return "bg-blue-3 border-blue-6";
+  if (lower.includes("sentry")) return "bg-purple-3 border-purple-6";
+  if (lower.includes("stripe")) return "bg-blue-3 border-blue-6";
+  if (lower.includes("context")) return "bg-green-3 border-green-6";
+  if (lower.includes("chrome") || lower.includes("devtools")) {
+    return "bg-amber-3 border-amber-6";
+  }
+  return "bg-dls-hover border-dls-border";
+};
+
+export function McpView(props: McpViewProps) {
+  const showHeader = props.showHeader !== false;
+
+  const [logoutOpen, setLogoutOpen] = useState(false);
+  const [logoutTarget, setLogoutTarget] = useState<string | null>(null);
+  const [logoutBusy, setLogoutBusy] = useState(false);
+  const [removeOpen, setRemoveOpen] = useState(false);
+  const [removeTarget, setRemoveTarget] = useState<string | null>(null);
+  const [configScope, setConfigScope] = useState<"project" | "global">("project");
+  const [projectConfig, setProjectConfig] = useState<OpencodeConfigFile | null>(null);
+  const [globalConfig, setGlobalConfig] = useState<OpencodeConfigFile | null>(null);
+  const [configError, setConfigError] = useState<string | null>(null);
+  const [revealBusy, setRevealBusy] = useState(false);
+  const [showAdvanced, setShowAdvanced] = useState(false);
+  const [addMcpModalOpen, setAddMcpModalOpen] = useState(false);
+  const [togglingMcp, setTogglingMcp] = useState<string | null>(null);
+  const [controlChromeModalOpen, setControlChromeModalOpen] = useState(false);
+  const [controlChromeModalMode, setControlChromeModalMode] = useState<"connect" | "edit">("connect");
+  const [controlChromeExistingProfile, setControlChromeExistingProfile] = useState(false);
+  const configRequestId = useRef(0);
+
+  const quickConnectList = props.quickConnect;
+
+  useEffect(() => {
+    const root = props.selectedWorkspaceRoot.trim();
+    const nextId = configRequestId.current + 1;
+    configRequestId.current = nextId;
+    const readConfig = props.readConfigFile;
+
+    if (!readConfig && !isDesktopRuntime()) {
+      setProjectConfig(null);
+      setGlobalConfig(null);
+      setConfigError(null);
+      return;
+    }
+
+    void (async () => {
+      try {
+        setConfigError(null);
+        const [project, global] = await Promise.all([
+          root
+            ? readConfig
+              ? readConfig("project")
+              : readOpencodeConfig("project", root)
+            : Promise.resolve(null),
+          readConfig ? readConfig("global") : readOpencodeConfig("global", root),
+        ]);
+        if (nextId !== configRequestId.current) return;
+        setProjectConfig(project);
+        setGlobalConfig(global);
+      } catch (error) {
+        if (nextId !== configRequestId.current) return;
+        setProjectConfig(null);
+        setGlobalConfig(null);
+        setConfigError(
+          error instanceof Error ? error.message : t("mcp.config_load_failed"),
+        );
+      }
+    })();
+  }, [props.readConfigFile, props.selectedWorkspaceRoot]);
+
+  const activeConfig = configScope === "project" ? projectConfig : globalConfig;
+
+  const revealLabel = isWindowsPlatform()
+    ? t("mcp.open_file")
+    : t("mcp.reveal_in_finder");
+
+  const canRevealConfig =
+    isDesktopRuntime() &&
+    !revealBusy &&
+    !(configScope === "project" && !props.selectedWorkspaceRoot.trim()) &&
+    Boolean(activeConfig?.exists);
+
+  const resolveQuickConnectMatch = (name: string) =>
+    quickConnectList.find((candidate) => {
+      const candidateKey = getMcpIdentityKey(candidate);
+      return (
+        candidateKey === name ||
+        candidate.name === name ||
+        normalizeMcpSlug(candidate.name) === name
+      );
+    });
+
+  const displayName = (name: string) => resolveQuickConnectMatch(name)?.name ?? name;
+
+  const quickConnectStatus = (entry: McpDirectoryInfo) =>
+    props.mcpStatuses[getMcpIdentityKey(entry)];
+
+  const isQuickConnectConfigured = (entry: McpDirectoryInfo) =>
+    props.mcpServers.some((server) => server.name === getMcpIdentityKey(entry));
+
+  const openControlChromeModal = (
+    mode: "connect" | "edit",
+    existingEntry?: McpServerEntry | null,
+  ) => {
+    setControlChromeModalMode(mode);
+    setControlChromeExistingProfile(
+      usesChromeDevtoolsAutoConnect(existingEntry?.config.command),
+    );
+    setControlChromeModalOpen(true);
+  };
+
+  const saveControlChromeSettings = (useExistingProfile: boolean) => {
+    const controlChrome = quickConnectList.find((entry) => isChromeDevtoolsMcp(entry));
+    if (!controlChrome) return;
+    const existingEntry = props.mcpServers.find((entry) => isChromeDevtoolsMcp(entry.name));
+
+    props.connectMcp({
+      ...controlChrome,
+      command: buildChromeDevtoolsCommand(
+        existingEntry?.config.command ?? controlChrome.command,
+        useExistingProfile,
+      ),
+    });
+    setControlChromeModalOpen(false);
+  };
+
+  const supportsOauth = (entry: McpServerEntry) =>
+    entry.config.type === "remote" && entry.config.oauth !== false;
+
+  const resolveStatus = (entry: McpServerEntry): ReactMcpStatus => {
+    if (entry.config.enabled === false) return "disabled";
+    const resolved = props.mcpStatuses[entry.name];
+    return resolved?.status ?? "disconnected";
+  };
+
+  const connectedCount = props.mcpServers.filter(
+    (entry) => resolveStatus(entry) === "connected",
+  ).length;
+
+  const requestLogout = (name: string) => {
+    if (!name.trim()) return;
+    setLogoutTarget(name);
+    setLogoutOpen(true);
+  };
+
+  const confirmLogout = async () => {
+    const name = logoutTarget;
+    if (!name || logoutBusy) return;
+    setLogoutBusy(true);
+    try {
+      await props.logoutMcpAuth(name);
+    } finally {
+      setLogoutBusy(false);
+      setLogoutOpen(false);
+      setLogoutTarget(null);
+    }
+  };
+
+  const revealConfig = async () => {
+    if (!isDesktopRuntime() || revealBusy) return;
+    const root = props.selectedWorkspaceRoot.trim();
+
+    if (configScope === "project" && !root) {
+      setConfigError(t("mcp.pick_workspace_error"));
+      return;
+    }
+
+    setRevealBusy(true);
+    setConfigError(null);
+    try {
+      const resolved = props.readConfigFile
+        ? await props.readConfigFile(configScope)
+        : await readOpencodeConfig(configScope, root);
+      if (!resolved) {
+        throw new Error(t("mcp.config_load_failed"));
+      }
+      if (isWindowsPlatform()) {
+        await openDesktopPath(resolved.path);
+      } else {
+        await revealDesktopItemInDir(resolved.path);
+      }
+    } catch (error) {
+      setConfigError(
+        error instanceof Error ? error.message : t("mcp.reveal_config_failed"),
+      );
+    } finally {
+      setRevealBusy(false);
+    }
+  };
+
+  return (
+    <section className="space-y-8 animate-in fade-in duration-300">
+      {showHeader ? (
+        <div>
+          <h2 className="text-3xl font-bold text-dls-text">{t("mcp.apps_title")}</h2>
+          <p className="mt-1.5 text-sm text-dls-secondary">{t("mcp.apps_subtitle")}</p>
+          {connectedCount > 0 ? (
+            <div className="mt-3 inline-flex items-center gap-2 rounded-full bg-green-3 px-3 py-1">
+              <div className="h-2 w-2 rounded-full bg-green-9" />
+              <span className="text-xs font-medium text-green-11">
+                {connectedCount} {connectedCount === 1 ? t("mcp.app_connected") : t("mcp.apps_connected")}
+              </span>
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+
+      {props.mcpStatus ? (
+        <div className="whitespace-pre-wrap break-words rounded-xl border border-dls-border bg-dls-hover px-4 py-3 text-xs text-dls-secondary">
+          {props.mcpStatus}
+        </div>
+      ) : null}
+
+      <div className="rounded-2xl border border-blue-6/30 bg-[linear-gradient(180deg,rgba(59,130,246,0.08),rgba(59,130,246,0.03))] px-5 py-5 sm:px-6">
+        <div className="flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">
+          <div className="space-y-1">
+            <div className="text-base font-semibold text-dls-text">{t("mcp.add_modal_title")}</div>
+            <div className="text-sm text-dls-secondary">{t("mcp.custom_app_cta_hint")}</div>
+          </div>
+          <Button variant="secondary" onClick={() => setAddMcpModalOpen(true)}>
+            <Plus size={14} />
+            {t("mcp.add_modal_title")}
+          </Button>
+        </div>
+      </div>
+
+      <div className="space-y-4">
+        <div className="flex items-center justify-between">
+          <h3 className="text-[11px] font-bold uppercase tracking-widest text-dls-secondary">
+            {t("mcp.available_apps")}
+          </h3>
+          <span className="text-[11px] text-dls-secondary">{t("mcp.one_click_connect")}</span>
+        </div>
+
+        <div className="grid grid-cols-1 gap-3 sm:grid-cols-2 xl:grid-cols-3">
+          {quickConnectList.map((entry) => {
+            const configured = isQuickConnectConfigured(entry);
+            const connecting = props.mcpConnectingName === entry.name;
+            const Icon = serviceIcon(entry.name);
+            const controlChrome = isChromeDevtoolsMcp(entry);
+            const quickStatus = !configured ? quickConnectStatus(entry) : undefined;
+
+            return (
+              <div key={getMcpIdentityKey(entry)} className="relative">
+                {controlChrome && configured ? (
+                  <button
+                    type="button"
+                    className="absolute right-3 top-3 z-10 inline-flex h-8 w-8 items-center justify-center rounded-lg border border-green-6 bg-white/90 text-green-11 transition-colors hover:bg-white"
+                    aria-label={t("mcp.control_chrome_edit")}
+                    onClick={(event) => {
+                      event.stopPropagation();
+                      const existingEntry = props.mcpServers.find(
+                        (server) => server.name === getMcpIdentityKey(entry),
+                      );
+                      openControlChromeModal("edit", existingEntry);
+                    }}
+                  >
+                    <Settings size={14} />
+                  </button>
+                ) : null}
+
+                <button
+                  type="button"
+                  disabled={configured || props.busy || connecting}
+                  onClick={() => {
+                    if (configured) return;
+                    if (controlChrome) {
+                      openControlChromeModal("connect");
+                      return;
+                    }
+                    props.connectMcp(entry);
+                  }}
+                  className={`group w-full rounded-xl border p-4 text-left transition-all ${
+                    configured
+                      ? "border-green-6 bg-green-2"
+                      : "border-dls-border bg-dls-surface hover:bg-dls-hover hover:shadow-[0_4px_16px_rgba(17,24,39,0.06)]"
+                  }`}
+                >
+                  <div className="flex items-start gap-3">
+                    <div
+                      className={`flex h-10 w-10 shrink-0 items-center justify-center rounded-lg border ${
+                        configured ? "border-green-6 bg-green-3" : serviceIconBg(entry.name)
+                      }`}
+                    >
+                      {connecting ? (
+                        <Loader2 size={18} className="animate-spin text-dls-secondary" />
+                      ) : configured ? (
+                        <CheckCircle2 size={18} className="text-green-11" />
+                      ) : (
+                        <Icon size={18} className={serviceColor(entry.name)} />
+                      )}
+                    </div>
+
+                    <div className="min-w-0 flex-1">
+                      <div className="flex items-center gap-2 pr-10">
+                        <h4 className="text-sm font-semibold text-dls-text">{entry.name}</h4>
+                        {configured ? (
+                          <span className="rounded-md bg-green-3 px-1.5 py-0.5 text-[10px] font-medium text-green-11">
+                            {t("mcp.connected_badge")}
+                          </span>
+                        ) : null}
+                        {!configured && quickStatus ? (
+                          <span
+                            className={`rounded-md px-1.5 py-0.5 text-[10px] font-medium ${statusBadgeStyle(
+                              quickStatus.status,
+                            )}`}
+                          >
+                            {friendlyStatus(quickStatus.status)}
+                          </span>
+                        ) : null}
+                      </div>
+                      <p className="mt-0.5 line-clamp-2 text-xs text-dls-secondary">
+                        {entry.description}
+                      </p>
+                      {!configured && !connecting ? (
+                        <div className="mt-2 text-[11px] font-medium text-blue-11 transition-colors group-hover:text-blue-12">
+                          {t("mcp.tap_to_connect")}
+                        </div>
+                      ) : null}
+                    </div>
+                  </div>
+                </button>
+              </div>
+            );
+          })}
+        </div>
+      </div>
+
+      <div className="space-y-4">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <h3 className="text-[11px] font-bold uppercase tracking-widest text-dls-secondary">
+            {t("mcp.your_apps")}
+          </h3>
+          {props.mcpLastUpdatedAt ? (
+            <span className="tabular-nums text-[11px] text-dls-secondary">
+              {t("mcp.last_synced")} {formatRelativeTime(props.mcpLastUpdatedAt ?? Date.now())}
+            </span>
+          ) : null}
+        </div>
+
+        {props.mcpServers.length ? (
+          <div className="space-y-2">
+            {props.mcpServers.map((entry) => {
+              const status = resolveStatus(entry);
+              const Icon = serviceIcon(entry.name);
+              const isSelected = props.selectedMcp === entry.name;
+              const resolvedStatus = props.mcpStatuses[entry.name];
+              const errorInfo =
+                resolvedStatus && resolvedStatus.status === "failed"
+                  ? "error" in resolvedStatus
+                    ? resolvedStatus.error
+                    : t("mcp.connection_failed")
+                  : null;
+
+              return (
+                <div
+                  key={entry.name}
+                  className={`rounded-xl border transition-all ${
+                    isSelected
+                      ? "border-blue-7 bg-blue-2 shadow-sm"
+                      : "border-dls-border bg-dls-surface hover:bg-dls-hover"
+                  }`}
+                >
+                  <button
+                    type="button"
+                    className="w-full px-4 py-3.5 text-left"
+                    onClick={() => props.setSelectedMcp(isSelected ? null : entry.name)}
+                  >
+                    <div className="flex items-center gap-3">
+                      <div
+                        className={`flex h-8 w-8 shrink-0 items-center justify-center rounded-lg border ${
+                          status === "connected"
+                            ? "border-green-6 bg-green-3"
+                            : serviceIconBg(entry.name)
+                        }`}
+                      >
+                        <Icon
+                          size={15}
+                          className={
+                            status === "connected" ? "text-green-11" : serviceColor(entry.name)
+                          }
+                        />
+                      </div>
+                      <div className="min-w-0 flex-1">
+                        <div className="truncate text-sm font-medium text-dls-text">
+                          {displayName(entry.name)}
+                        </div>
+                      </div>
+                      <div className="flex shrink-0 items-center gap-2">
+                        <div className={`h-2 w-2 rounded-full ${statusDot(status)}`} />
+                        <span className="text-[11px] text-dls-secondary">
+                          {friendlyStatus(status)}
+                        </span>
+                      </div>
+                      <div className={`transition-transform ${isSelected ? "rotate-180" : ""}`}>
+                        <ChevronDown size={14} className="text-dls-secondary/40" />
+                      </div>
+                    </div>
+                  </button>
+
+                  {isSelected ? (
+                    <div className="animate-in fade-in slide-in-from-top-1 space-y-3 border-t border-blue-6/20 px-4 py-3 duration-200">
+                      <div className="flex items-center gap-4 text-xs">
+                        <span className="text-dls-secondary">{t("mcp.connection_type")}</span>
+                        <span className="text-dls-text">
+                          {entry.config.type === "remote" ? t("mcp.type_cloud") : t("mcp.type_local")}
+                        </span>
+                      </div>
+
+                      <div className="flex items-center gap-2">
+                        <span className="rounded-md border border-dls-border bg-dls-surface px-2 py-0.5 text-[10px] font-medium text-dls-text">
+                          {t("mcp.cap_tools")}
+                        </span>
+                        {entry.config.type === "remote" ? (
+                          <span className="rounded-md border border-dls-border bg-dls-surface px-2 py-0.5 text-[10px] font-medium text-dls-text">
+                            {t("mcp.cap_signin")}
+                          </span>
+                        ) : null}
+                      </div>
+
+                      {errorInfo ? (
+                        <div className="rounded-lg border border-red-6 bg-red-2 px-3 py-2 text-xs text-red-11">
+                          {errorInfo}
+                        </div>
+                      ) : null}
+
+                      <details className="group">
+                        <summary className="flex cursor-pointer list-none items-center gap-1.5 text-[11px] text-dls-secondary transition-colors hover:text-dls-text">
+                          <Code2 size={11} />
+                          {t("mcp.technical_details")}
+                          <ChevronDown size={10} className="transition-transform group-open:rotate-180" />
+                        </summary>
+                        <div className="mt-1.5 break-all rounded-lg bg-dls-hover px-3 py-2 font-mono text-[11px] text-dls-secondary">
+                          {entry.config.type === "remote"
+                            ? entry.config.url
+                            : entry.config.command?.join(" ")}
+                        </div>
+                      </details>
+
+                      {supportsOauth(entry) && status !== "connected" ? (
+                        <>
+                          <div className="flex items-center justify-between gap-3 pt-1">
+                            <div className="text-xs text-dls-secondary">{t("mcp.logout_label")}</div>
+                            <Button
+                              variant="secondary"
+                              className="px-3 py-1.5 text-xs"
+                              disabled={props.busy}
+                              onClick={() => props.authorizeMcp(entry)}
+                            >
+                              {t("mcp.login_action")}
+                            </Button>
+                          </div>
+                          <div className="text-[11px] text-dls-secondary/70">{t("mcp.login_hint")}</div>
+                        </>
+                      ) : null}
+
+                      {supportsOauth(entry) && status === "connected" ? (
+                        <>
+                          <div className="flex items-center justify-between gap-3 pt-1">
+                            <div className="text-xs text-dls-secondary">{t("mcp.logout_label")}</div>
+                            <Button
+                              variant="danger"
+                              className="px-3 py-1.5 text-xs"
+                              disabled={props.busy || logoutBusy}
+                              onClick={() => requestLogout(entry.name)}
+                            >
+                              {logoutBusy && logoutTarget === entry.name
+                                ? t("mcp.logout_working")
+                                : t("mcp.logout_action")}
+                            </Button>
+                          </div>
+                          <div className="text-[11px] text-dls-secondary/70">{t("mcp.logout_hint")}</div>
+                        </>
+                      ) : null}
+
+                      <div className="flex justify-end gap-2 pt-1">
+                        {isChromeDevtoolsMcp(entry.name) ? (
+                          <Button
+                            variant="outline"
+                            className="!px-3 !py-1.5 !text-xs"
+                            onClick={() => openControlChromeModal("edit", entry)}
+                          >
+                            <Settings size={13} />
+                            {t("mcp.control_chrome_edit")}
+                          </Button>
+                        ) : null}
+                        {props.setMcpEnabled && entry.source !== "config.global" ? (
+                          <Button
+                            variant="outline"
+                            className="!px-3 !py-1.5 !text-xs"
+                            disabled={props.busy || togglingMcp === entry.name}
+                            onClick={(event) => {
+                              event.stopPropagation();
+                              if (togglingMcp) return;
+                              const next = entry.config.enabled !== false ? false : true;
+                              setTogglingMcp(entry.name);
+                              void Promise.resolve(props.setMcpEnabled?.(entry.name, next)).finally(
+                                () => setTogglingMcp(null),
+                              );
+                            }}
+                          >
+                            <Power size={13} />
+                            {entry.config.enabled === false
+                              ? t("mcp.enable_app")
+                              : t("mcp.disable_app")}
+                          </Button>
+                        ) : null}
+                        <Button
+                          variant="danger"
+                          className="!px-3 !py-1.5 !text-xs"
+                          onClick={(event) => {
+                            event.stopPropagation();
+                            setRemoveTarget(entry.name);
+                            setRemoveOpen(true);
+                          }}
+                        >
+                          {t("mcp.remove_app")}
+                        </Button>
+                      </div>
+                    </div>
+                  ) : null}
+                </div>
+              );
+            })}
+          </div>
+        ) : (
+          <div className="rounded-xl border border-dashed border-dls-border px-5 py-10 text-center">
+            <Unplug size={24} className="mx-auto mb-3 text-dls-secondary/30" />
+            <div className="text-sm font-medium text-dls-secondary">{t("mcp.no_apps_yet")}</div>
+            <div className="mt-1 text-xs text-dls-secondary/60">{t("mcp.no_apps_hint")}</div>
+          </div>
+        )}
+      </div>
+
+      <ConfirmModal
+        open={logoutOpen}
+        title={t("mcp.logout_modal_title")}
+        message={t("mcp.logout_modal_message").replace("{server}", displayName(logoutTarget ?? ""))}
+        confirmLabel={logoutBusy ? t("mcp.logout_working") : t("mcp.logout_action")}
+        cancelLabel={t("common.cancel")}
+        variant="danger"
+        onCancel={() => {
+          if (logoutBusy) return;
+          setLogoutOpen(false);
+          setLogoutTarget(null);
+        }}
+        onConfirm={() => {
+          void confirmLogout();
+        }}
+      />
+
+      <ConfirmModal
+        open={removeOpen}
+        title={t("mcp.remove_modal_title")}
+        message={t("mcp.remove_modal_message").replace("{server}", displayName(removeTarget ?? ""))}
+        confirmLabel={t("mcp.remove_app")}
+        cancelLabel={t("common.cancel")}
+        variant="danger"
+        onCancel={() => {
+          setRemoveOpen(false);
+          setRemoveTarget(null);
+        }}
+        onConfirm={() => {
+          if (removeTarget) props.removeMcp(removeTarget);
+          setRemoveOpen(false);
+          setRemoveTarget(null);
+        }}
+      />
+
+      <div className="overflow-hidden rounded-xl border border-dls-border bg-dls-surface">
+        <button
+          type="button"
+          className="flex w-full items-center justify-between px-5 py-4 transition-colors hover:bg-dls-hover"
+          onClick={() => setShowAdvanced((current) => !current)}
+        >
+          <div className="flex items-center gap-3">
+            <Settings2 size={16} className="text-dls-secondary" />
+            <div className="text-left">
+              <div className="text-sm font-medium text-dls-text">{t("mcp.advanced_settings")}</div>
+              <div className="text-xs text-dls-secondary">{t("mcp.advanced_settings_hint")}</div>
+            </div>
+          </div>
+          <div className={`transition-transform ${showAdvanced ? "rotate-180" : ""}`}>
+            <ChevronDown size={16} className="text-dls-secondary" />
+          </div>
+        </button>
+
+        {showAdvanced ? (
+          <div className="animate-in fade-in slide-in-from-top-1 space-y-4 border-t border-dls-border px-5 py-4 duration-200">
+            <div className="flex items-center gap-1.5">
+              <button
+                type="button"
+                className={`rounded-lg px-3 py-1.5 text-xs font-medium transition-colors ${
+                  configScope === "project"
+                    ? "bg-dls-active text-dls-text"
+                    : "text-dls-secondary hover:bg-dls-hover hover:text-dls-text"
+                }`}
+                onClick={() => setConfigScope("project")}
+              >
+                {t("mcp.scope_project")}
+              </button>
+              <button
+                type="button"
+                className={`rounded-lg px-3 py-1.5 text-xs font-medium transition-colors ${
+                  configScope === "global"
+                    ? "bg-dls-active text-dls-text"
+                    : "text-dls-secondary hover:bg-dls-hover hover:text-dls-text"
+                }`}
+                onClick={() => setConfigScope("global")}
+              >
+                {t("mcp.scope_global")}
+              </button>
+            </div>
+
+            <div className="flex flex-col gap-1 text-xs">
+              <div className="text-dls-secondary">{t("mcp.config_file")}</div>
+              <div className="truncate font-mono text-[11px] text-dls-secondary/80">
+                {activeConfig?.path ?? t("mcp.config_not_loaded")}
+              </div>
+            </div>
+
+            <div className="flex items-center justify-between gap-3">
+              <div className="flex items-center gap-2">
+                <Button variant="secondary" onClick={() => void revealConfig()} disabled={!canRevealConfig}>
+                  {revealBusy ? (
+                    <>
+                      <Loader2 size={14} className="animate-spin" />
+                      {t("mcp.opening_label")}
+                    </>
+                  ) : (
+                    <>
+                      <FolderOpen size={14} />
+                      {revealLabel}
+                    </>
+                  )}
+                </Button>
+                <a
+                  href="https://opencode.ai/docs/mcp-servers/"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="inline-flex items-center gap-1 text-xs text-dls-secondary transition-colors hover:text-dls-text"
+                >
+                  {t("mcp.docs_link")}
+                  <ExternalLink size={11} />
+                </a>
+              </div>
+              {activeConfig && activeConfig.exists === false ? (
+                <div className="text-[11px] text-dls-secondary">{t("mcp.file_not_found")}</div>
+              ) : null}
+            </div>
+
+            {configError ? <div className="text-xs text-red-11">{configError}</div> : null}
+          </div>
+        ) : null}
+      </div>
+
+      <AddMcpModal
+        open={addMcpModalOpen}
+        onClose={() => setAddMcpModalOpen(false)}
+        onAdd={(entry) => props.connectMcp(entry)}
+        busy={props.busy}
+        isRemoteWorkspace={props.isRemoteWorkspace}
+      />
+
+      <ControlChromeSetupModal
+        open={controlChromeModalOpen}
+        busy={props.busy || props.mcpConnectingName === "Control Chrome"}
+        mode={controlChromeModalMode}
+        initialUseExistingProfile={controlChromeExistingProfile}
+        onClose={() => setControlChromeModalOpen(false)}
+        onSave={saveControlChromeSettings}
+      />
+    </section>
+  );
+}
+
+export default McpView;
diff --git a/apps/app/src/react-app/domains/settings/pages/messaging-view.tsx b/apps/app/src/react-app/domains/settings/pages/messaging-view.tsx
new file mode 100644
index 0000000000..77eacbb29c
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/messaging-view.tsx
@@ -0,0 +1,1069 @@
+/** @jsxImportSource react */
+import { ArrowRight, ChevronRight, Copy, Link, RefreshCcw, Shield } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import type {
+  OpenworkOpenCodeRouterHealthSnapshot,
+  OpenworkOpenCodeRouterIdentityItem,
+  OpenworkOpenCodeRouterSendResult,
+  OpenworkServerStatus,
+} from "../../../../app/lib/openwork-server";
+import { Button } from "../../../design-system/button";
+import { ConfirmModal } from "../../../design-system/modals/confirm-modal";
+import { TextInput } from "../../../design-system/text-input";
+
+const agentFilePath = ".opencode/agents/opencode-router.md";
+
+export type MessagingViewTab = "general" | "advanced";
+export type MessagingChannel = "telegram" | "slack";
+export type MessagingViewExpandedChannel = MessagingChannel | null;
+
+export type MessagingViewProps = {
+  busy: boolean;
+  showHeader?: boolean;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerUrl: string;
+  scopedOpenworkBaseUrl?: string;
+  workspaceId: string | null;
+  selectedWorkspaceRoot: string;
+  refreshing: boolean;
+  openworkReconnectBusy: boolean;
+  reconnectStatus: string | null;
+  reconnectError: string | null;
+  health: OpenworkOpenCodeRouterHealthSnapshot | null;
+  healthError: string | null;
+  messagingEnabled: boolean;
+  messagingSaving: boolean;
+  messagingStatus: string | null;
+  messagingError: string | null;
+  messagingRestartRequired: boolean;
+  messagingRestartBusy: boolean;
+  activeTab: MessagingViewTab;
+  expandedChannel: MessagingViewExpandedChannel;
+  telegram: {
+    identities: OpenworkOpenCodeRouterIdentityItem[];
+    identitiesError: string | null;
+    token: string;
+    enabled: boolean;
+    saving: boolean;
+    status: string | null;
+    error: string | null;
+    botUsername: string | null;
+    pairingCode: string | null;
+  };
+  slack: {
+    identities: OpenworkOpenCodeRouterIdentityItem[];
+    identitiesError: string | null;
+    botToken: string;
+    appToken: string;
+    enabled: boolean;
+    saving: boolean;
+    status: string | null;
+    error: string | null;
+  };
+  agent: {
+    loading: boolean;
+    saving: boolean;
+    exists: boolean;
+    content: string;
+    draft: string;
+    status: string | null;
+    error: string | null;
+  };
+  sendTest: {
+    channel: MessagingChannel;
+    directory: string;
+    peerId: string;
+    autoBind: boolean;
+    text: string;
+    busy: boolean;
+    status: string | null;
+    error: string | null;
+    result: OpenworkOpenCodeRouterSendResult | null;
+  };
+  modals: {
+    messagingRiskOpen: boolean;
+    messagingRestartPromptOpen: boolean;
+    messagingRestartAction: "enable" | "disable";
+    messagingDisableConfirmOpen: boolean;
+    publicTelegramWarningOpen: boolean;
+  };
+  onRepairAndReconnect: () => void | Promise<void>;
+  onRefresh: () => void | Promise<void>;
+  onSelectTab: (tab: MessagingViewTab) => void;
+  onToggleExpandedChannel: (channel: MessagingChannel) => void;
+  onOpenMessagingRisk: () => void;
+  onCancelMessagingRisk: () => void;
+  onConfirmEnableMessaging: () => void | Promise<void>;
+  onOpenDisableMessagingConfirm: () => void;
+  onCancelDisableMessagingConfirm: () => void;
+  onConfirmDisableMessaging: () => void | Promise<void>;
+  onCancelRestartPrompt: () => void;
+  onConfirmRestartMessagingWorker: () => void | Promise<void>;
+  onTelegramTokenChange: (value: string) => void;
+  onTelegramEnabledChange: (value: boolean) => void;
+  onOpenPublicTelegramWarning: () => void;
+  onCancelPublicTelegramWarning: () => void;
+  onConfirmPublicTelegram: () => void | Promise<void>;
+  onConnectPrivateTelegram: () => void | Promise<void>;
+  onDeleteTelegram: (id: string) => void | Promise<void>;
+  onCopyTelegramPairingCode: () => void | Promise<void>;
+  onHideTelegramPairingCode: () => void;
+  onSlackBotTokenChange: (value: string) => void;
+  onSlackAppTokenChange: (value: string) => void;
+  onSlackEnabledChange: (value: boolean) => void;
+  onConnectSlack: () => void | Promise<void>;
+  onDeleteSlack: (id: string) => void | Promise<void>;
+  onLoadAgentFile: () => void | Promise<void>;
+  onCreateDefaultAgentFile: () => void | Promise<void>;
+  onChangeAgentDraft: (value: string) => void;
+  onSaveAgentFile: () => void | Promise<void>;
+  onChangeSendChannel: (channel: MessagingChannel) => void;
+  onChangeSendPeerId: (value: string) => void;
+  onChangeSendDirectory: (value: string) => void;
+  onChangeSendAutoBind: (value: boolean) => void;
+  onChangeSendText: (value: string) => void;
+  onSendTestMessage: () => void | Promise<void>;
+};
+
+function TelegramIcon({ size = 20 }: { size?: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" fill="none" aria-hidden="true">
+      <circle cx="12" cy="12" r="10" fill="#229ED9" />
+      <path d="M7 12.5l2.5 2L16 8.5" stroke="white" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" />
+      <path d="M9.5 14.5l-.5 3 2-1.5" stroke="white" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" />
+    </svg>
+  );
+}
+
+function SlackIcon({ size = 20 }: { size?: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" fill="none" aria-hidden="true">
+      <path d="M14.5 2a2 2 0 012 2v4.5h-2a2 2 0 010-4h0V2z" fill="#E01E5A" />
+      <path d="M2 9.5a2 2 0 012-2h4.5v2a2 2 0 01-4 0V9.5z" fill="#36C5F0" />
+      <path d="M9.5 22a2 2 0 01-2-2v-4.5h2a2 2 0 010 4v2.5z" fill="#2EB67D" />
+      <path d="M22 14.5a2 2 0 01-2 2h-4.5v-2a2 2 0 014 0h2.5z" fill="#ECB22E" />
+      <path d="M8.5 9.5h2v2h-2z" fill="#36C5F0" />
+      <path d="M13.5 9.5h2v2h-2z" fill="#ECB22E" />
+      <path d="M8.5 14.5h2v-2h-2z" fill="#2EB67D" />
+      <path d="M13.5 14.5h2v-2h-2z" fill="#E01E5A" />
+    </svg>
+  );
+}
+
+function StatusPill(props: { label: string; value: string; ok: boolean }) {
+  return (
+    <div className="flex-1 rounded-lg border border-gray-4 bg-gray-1 px-3.5 py-2.5">
+      <div className="mb-0.5 text-[11px] text-gray-9">{props.label}</div>
+      <div className={`text-[13px] font-semibold ${props.ok ? "text-gray-12" : "text-gray-8"}`}>
+        {props.value}
+      </div>
+    </div>
+  );
+}
+
+function formatLastActivityLabel(timestamp?: number | null) {
+  if (!timestamp) return "-";
+  const elapsedMs = Math.max(0, Date.now() - timestamp);
+  if (elapsedMs < 60_000) return t("identities.just_now");
+  const minutes = Math.floor(elapsedMs / 60_000);
+  if (minutes < 60) return t("identities.minutes_ago", undefined, { minutes });
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return t("identities.hours_ago", undefined, { hours });
+  const days = Math.floor(hours / 24);
+  return t("identities.days_ago", undefined, { days });
+}
+
+export function MessagingView(props: MessagingViewProps) {
+  const serverReady = props.openworkServerStatus === "connected";
+  const scopedWorkspaceReady = Boolean(props.workspaceId?.trim());
+  const workspaceScopeLabel =
+    props.scopedOpenworkBaseUrl?.trim() || props.openworkServerUrl.trim() || t("identities.not_set");
+  const defaultRoutingDirectory = props.selectedWorkspaceRoot.trim() || t("identities.not_set");
+  const telegramBotLink = props.telegram.botUsername?.trim()
+    ? `https://t.me/${props.telegram.botUsername.trim().replace(/^@+/, "")}`
+    : null;
+  const agentDirty = props.agent.draft !== props.agent.content;
+  const hasTelegramConnected = props.telegram.identities.some((item) => item.enabled);
+  const hasSlackConnected = props.slack.identities.some((item) => item.enabled);
+  const connectedChannelCount = Number(hasTelegramConnected) + Number(hasSlackConnected);
+  const messagesToday = props.health?.activity
+    ? (props.health.activity.inboundToday ?? 0) + (props.health.activity.outboundToday ?? 0)
+    : null;
+  const lastActivityAt = props.health?.activity?.lastMessageAt ?? null;
+  const lastActivityLabel = formatLastActivityLabel(lastActivityAt);
+  const isWorkerOnline = props.health?.ok === true;
+  const statusLabel = props.healthError
+    ? t("identities.health_unavailable")
+    : props.health
+      ? props.health.ok
+        ? t("identities.health_running")
+        : t("identities.health_offline")
+      : t("identities.health_unknown");
+
+  return (
+    <div className="w-full space-y-6">
+      <div>
+        <div className="mb-1.5 flex items-center justify-between">
+          {props.showHeader !== false ? (
+            <h1 className="text-lg font-bold tracking-tight text-gray-12">{t("identities.title")}</h1>
+          ) : (
+            <div />
+          )}
+          <div className="flex items-center gap-2">
+            <Button
+              variant="outline"
+              className="h-8 px-3 text-xs"
+              onClick={() => void props.onRepairAndReconnect()}
+              disabled={props.busy || props.openworkReconnectBusy}
+            >
+              <RefreshCcw size={14} className={props.openworkReconnectBusy ? "animate-spin" : ""} />
+              <span className="ml-1.5">{t("identities.repair_reconnect")}</span>
+            </Button>
+            <Button
+              variant="outline"
+              className="h-8 px-3 text-xs"
+              onClick={() => void props.onRefresh()}
+              disabled={!serverReady || props.refreshing}
+            >
+              <RefreshCcw size={14} className={props.refreshing ? "animate-spin" : ""} />
+              <span className="ml-1.5">{t("common.refresh")}</span>
+            </Button>
+          </div>
+        </div>
+
+        {props.showHeader !== false ? (
+          <p className="text-sm leading-relaxed text-gray-9">{t("identities.subtitle")}</p>
+        ) : null}
+
+        <div className="mt-1.5 break-all font-mono text-[11px] text-gray-8">
+          {t("identities.workspace_scope_prefix")} {workspaceScopeLabel}
+        </div>
+        {props.reconnectStatus ? <div className="mt-1 text-[11px] text-gray-9">{props.reconnectStatus}</div> : null}
+        {props.reconnectError ? <div className="mt-1 text-[11px] text-red-12">{props.reconnectError}</div> : null}
+        {props.messagingStatus ? <div className="mt-1 text-[11px] text-gray-9">{props.messagingStatus}</div> : null}
+        {props.messagingError ? <div className="mt-1 text-[11px] text-red-12">{props.messagingError}</div> : null}
+      </div>
+
+      {!serverReady ? (
+        <div className="rounded-xl border border-gray-4 bg-gray-1 p-5">
+          <div className="text-sm font-semibold text-gray-12">{t("identities.connect_server_title")}</div>
+          <div className="mt-1 text-xs text-gray-10">{t("identities.connect_server_desc")}</div>
+        </div>
+      ) : null}
+
+      {serverReady ? (
+        <>
+          {!scopedWorkspaceReady ? (
+            <div className="rounded-xl border border-amber-7/20 bg-amber-1/30 px-3 py-2 text-xs text-amber-12">
+              {t("identities.workspace_id_required")}
+            </div>
+          ) : null}
+
+          {props.messagingEnabled ? (
+            <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
+              <div className="flex flex-1 items-center gap-2 rounded-xl border border-gray-4 bg-gray-1 p-1">
+                <button
+                  type="button"
+                  className={`flex-1 rounded-lg px-3 py-2 text-xs font-semibold transition-colors ${
+                    props.activeTab === "general" ? "bg-gray-12 text-gray-1" : "text-gray-10 hover:bg-gray-2"
+                  }`}
+                  onClick={() => props.onSelectTab("general")}
+                >
+                  {t("identities.tab_general")}
+                </button>
+                <button
+                  type="button"
+                  className={`flex-1 rounded-lg px-3 py-2 text-xs font-semibold transition-colors ${
+                    props.activeTab === "advanced" ? "bg-gray-12 text-gray-1" : "text-gray-10 hover:bg-gray-2"
+                  }`}
+                  onClick={() => props.onSelectTab("advanced")}
+                >
+                  {t("settings.tab_advanced")}
+                </button>
+              </div>
+              <Button
+                variant="outline"
+                className="h-8 px-3 text-xs"
+                disabled={props.messagingSaving}
+                onClick={props.onOpenDisableMessagingConfirm}
+              >
+                {t("identities.disable_messaging")}
+              </Button>
+            </div>
+          ) : null}
+
+          {!props.messagingEnabled ? (
+            <div className="space-y-3 rounded-xl border border-gray-4 bg-gray-1 px-4 py-4">
+              <div className="text-sm font-semibold text-gray-12">{t("identities.messaging_disabled_title")}</div>
+              <p className="text-xs leading-relaxed text-gray-10">{t("identities.messaging_disabled_risk")}</p>
+              <p className="text-xs leading-relaxed text-gray-10">{t("identities.messaging_disabled_hint")}</p>
+              <div className="flex flex-wrap items-center gap-2">
+                <Button
+                  variant="primary"
+                  className="h-8 px-3 text-xs"
+                  disabled={props.messagingSaving || !scopedWorkspaceReady}
+                  onClick={props.onOpenMessagingRisk}
+                >
+                  {props.messagingSaving ? t("identities.enabling") : t("identities.enable_messaging")}
+                </Button>
+              </div>
+            </div>
+          ) : null}
+
+          {props.activeTab === "general" && props.messagingEnabled ? (
+            <>
+              {props.messagingRestartRequired ? (
+                <div className="rounded-xl border border-gray-4 bg-gray-1 px-4 py-3 text-xs leading-relaxed text-gray-10">
+                  {t("identities.messaging_sidecar_not_running")}
+                  <div className="mt-3">
+                    <Button
+                      variant="primary"
+                      className="h-8 px-3 text-xs"
+                      disabled={props.messagingRestartBusy}
+                      onClick={() => void props.onConfirmRestartMessagingWorker()}
+                    >
+                      {props.messagingRestartBusy ? t("identities.restarting") : t("identities.restart_worker")}
+                    </Button>
+                  </div>
+                </div>
+              ) : null}
+
+              <div className="space-y-3.5 rounded-xl border border-gray-4 bg-gray-1 p-4">
+                <div className="flex items-center justify-between">
+                  <div className="flex items-center gap-2.5">
+                    {isWorkerOnline ? (
+                      <div className="h-2.5 w-2.5 rounded-full bg-emerald-9 animate-pulse" />
+                    ) : (
+                      <div className="h-2.5 w-2.5 rounded-full bg-gray-8" />
+                    )}
+                    <span className="text-[15px] font-semibold text-gray-12">
+                      {isWorkerOnline
+                        ? t("identities.worker_online")
+                        : props.healthError
+                          ? t("identities.worker_unavailable")
+                          : t("identities.worker_offline")}
+                    </span>
+                  </div>
+                  <span
+                    className={`rounded-full border px-2.5 py-0.5 text-[11px] font-semibold ${
+                      isWorkerOnline
+                        ? "border-emerald-7/25 bg-emerald-1/40 text-emerald-11"
+                        : props.healthError
+                          ? "border-red-7/20 bg-red-1/40 text-red-12"
+                          : "border-amber-7/25 bg-amber-1/40 text-amber-12"
+                    }`}
+                  >
+                    {statusLabel}
+                  </span>
+                </div>
+
+                {props.healthError ? (
+                  <div className="rounded-lg border border-red-7/20 bg-red-1/30 px-3 py-2 text-xs text-red-12">
+                    {props.healthError}
+                  </div>
+                ) : null}
+
+                <div className="flex gap-3">
+                  <StatusPill
+                    label={t("identities.channels_label")}
+                    value={`${connectedChannelCount} ${t("identities.channels_connected")}`}
+                    ok={connectedChannelCount > 0}
+                  />
+                  <StatusPill
+                    label={t("identities.messages_today")}
+                    value={messagesToday == null ? "-" : String(messagesToday)}
+                    ok={(messagesToday ?? 0) > 0}
+                  />
+                  <StatusPill
+                    label={t("identities.last_activity")}
+                    value={lastActivityLabel}
+                    ok={Boolean(lastActivityAt)}
+                  />
+                </div>
+              </div>
+
+              <div>
+                <div className="mb-3 text-[11px] font-semibold uppercase tracking-wider text-gray-9">
+                  {t("identities.available_channels")}
+                </div>
+
+                <div className="flex flex-col gap-2.5">
+                  <div
+                    className={`overflow-hidden rounded-xl border transition-colors ${
+                      hasTelegramConnected ? "border-emerald-7/30 bg-emerald-1/20" : "border-gray-4 bg-gray-1"
+                    }`}
+                  >
+                    <button
+                      type="button"
+                      className="flex w-full items-center gap-3.5 px-4 py-3.5 text-left transition-colors hover:bg-gray-2/50"
+                      onClick={() => props.onToggleExpandedChannel("telegram")}
+                    >
+                      <TelegramIcon size={28} />
+                      <div className="min-w-0 flex-1">
+                        <div className="flex items-center gap-2">
+                          <span className="text-[15px] font-semibold text-gray-12">Telegram</span>
+                          {hasTelegramConnected ? (
+                            <span className="rounded-full bg-emerald-1/40 px-2 py-0.5 text-[10px] font-semibold text-emerald-11">
+                              {t("identities.connected_badge")}
+                            </span>
+                          ) : null}
+                        </div>
+                        <div className="mt-0.5 text-[13px] leading-snug text-gray-9">{t("identities.telegram_desc")}</div>
+                      </div>
+                      <ChevronRight
+                        size={16}
+                        className={`shrink-0 text-gray-8 transition-transform ${
+                          props.expandedChannel === "telegram" ? "rotate-90" : ""
+                        }`}
+                      />
+                    </button>
+
+                    {props.expandedChannel === "telegram" ? (
+                      <div className="space-y-3 border-t border-gray-4 px-4 py-4 animate-[fadeUp_0.2s_ease-out]">
+                        {props.telegram.identitiesError ? (
+                          <div className="rounded-lg border border-amber-7/20 bg-amber-1/30 px-3 py-2 text-xs text-amber-12">
+                            {props.telegram.identitiesError}
+                          </div>
+                        ) : null}
+
+                        {props.telegram.identities.length > 0 ? (
+                          <>
+                            <div className="space-y-2">
+                              {props.telegram.identities.map((item) => (
+                                <div
+                                  key={item.id}
+                                  className="flex items-center justify-between gap-3 rounded-lg border border-gray-4 bg-gray-1 px-3 py-2.5"
+                                >
+                                  <div className="min-w-0">
+                                    <div className="flex items-center gap-2">
+                                      <div
+                                        className={`h-1.5 w-1.5 shrink-0 rounded-full ${item.running ? "bg-emerald-9" : "bg-gray-8"}`}
+                                      />
+                                      <span className="truncate text-[13px] font-semibold text-gray-12">
+                                        <span className="font-mono text-[12px]">{item.id}</span>
+                                      </span>
+                                    </div>
+                                    <div className="mt-0.5 pl-3.5 text-[11px] text-gray-9">
+                                      {item.enabled ? t("identities.enabled_label") : t("identities.disabled_label")} · {item.running ? t("identities.running_label") : t("identities.stopped_label")} · {item.access === "private" ? t("identities.private_label") : t("identities.public_label")}
+                                    </div>
+                                  </div>
+                                  <Button
+                                    variant="outline"
+                                    className="h-7 shrink-0 px-2.5 text-[11px]"
+                                    disabled={props.telegram.saving || item.id === "env" || !scopedWorkspaceReady}
+                                    onClick={() => void props.onDeleteTelegram(item.id)}
+                                  >
+                                    {t("identities.disconnect")}
+                                  </Button>
+                                </div>
+                              ))}
+                            </div>
+
+                            <div className="flex gap-2.5">
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.status_label")}</div>
+                                <div className="flex items-center gap-1.5">
+                                  <div
+                                    className={`h-1.5 w-1.5 rounded-full ${
+                                      props.telegram.identities.some((item) => item.running) ? "bg-emerald-9" : "bg-gray-8"
+                                    }`}
+                                  />
+                                  <span
+                                    className={`text-[13px] font-semibold ${
+                                      props.telegram.identities.some((item) => item.running)
+                                        ? "text-emerald-11"
+                                        : "text-gray-10"
+                                    }`}
+                                  >
+                                    {props.telegram.identities.some((item) => item.running)
+                                      ? t("identities.status_active")
+                                      : t("identities.status_stopped")}
+                                  </span>
+                                </div>
+                              </div>
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.identities_label")}</div>
+                                <div className="text-[13px] font-semibold text-gray-12">
+                                  {props.telegram.identities.length} {t("identities.configured_suffix")}
+                                </div>
+                              </div>
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.channel_label")}</div>
+                                <div className="text-[13px] font-semibold text-gray-12">
+                                  {props.health?.channels.telegram ? t("common.on") : t("common.off")}
+                                </div>
+                              </div>
+                            </div>
+
+                            {props.telegram.status ? <div className="text-[11px] text-gray-9">{props.telegram.status}</div> : null}
+                            {props.telegram.error ? <div className="text-[11px] text-red-12">{props.telegram.error}</div> : null}
+                          </>
+                        ) : null}
+
+                        <div className="space-y-2.5">
+                          {props.telegram.identities.length === 0 ? (
+                            <div className="space-y-2.5 rounded-xl border border-gray-4 bg-gray-2/60 px-3.5 py-3">
+                              <div className="text-[12px] font-semibold text-gray-12">{t("identities.quick_setup")}</div>
+                              <ol className="space-y-2 text-[12px] leading-relaxed text-gray-10">
+                                <li className="flex items-start gap-2">
+                                  <span className="mt-0.5 flex h-4 w-4 items-center justify-center rounded-full bg-gray-4 text-[10px] font-semibold text-gray-11">1</span>
+                                  <span>
+                                    {t("identities.botfather_step1_open")}{" "}
+                                    <a href="https://t.me/BotFather" target="_blank" rel="noreferrer" className="font-medium text-gray-12 underline">
+                                      @BotFather
+                                    </a>{" "}
+                                    {t("identities.botfather_step1_run")}{" "}
+                                    <code className="rounded bg-gray-3 px-1 py-0.5 font-mono text-[11px]">/newbot</code>.
+                                  </span>
+                                </li>
+                                <li className="flex items-start gap-2">
+                                  <span className="mt-0.5 flex h-4 w-4 items-center justify-center rounded-full bg-gray-4 text-[10px] font-semibold text-gray-11">2</span>
+                                  <span>{t("identities.copy_bot_token_hint")}</span>
+                                </li>
+                                <li className="flex items-start gap-2">
+                                  <span className="mt-0.5 flex h-4 w-4 items-center justify-center rounded-full bg-gray-4 text-[10px] font-semibold text-gray-11">3</span>
+                                  <span>
+                                    {t("identities.botfather_step3_choose")} <span className="font-medium text-gray-12">{t("identities.botfather_step3_public")}</span>{" "}
+                                    {t("identities.botfather_step3_or_private")} <span className="font-medium text-gray-12">{t("identities.botfather_step3_private")}</span>{" "}
+                                    {t("identities.botfather_step3_to_require")} <code className="rounded bg-gray-3 px-1 py-0.5 font-mono text-[11px]">/pair &lt;code&gt;</code>.
+                                  </span>
+                                </li>
+                              </ol>
+                            </div>
+                          ) : null}
+
+                          <TextInput
+                            label={t("identities.bot_token_label")}
+                            placeholder={t("identities.bot_token_placeholder")}
+                            type="password"
+                            value={props.telegram.token}
+                            onChange={(event) => props.onTelegramTokenChange(event.currentTarget.value)}
+                            className="rounded-lg border-gray-4 bg-gray-1 px-3 py-2.5 text-sm text-gray-12 placeholder:text-gray-8"
+                          />
+
+                          <label className="flex items-center gap-2 text-xs text-gray-11">
+                            <input
+                              type="checkbox"
+                              checked={props.telegram.enabled}
+                              onChange={(event) => props.onTelegramEnabledChange(event.currentTarget.checked)}
+                            />
+                            {t("identities.enabled_label")}
+                          </label>
+
+                          <div className="rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2 text-[11px] leading-relaxed text-gray-10">
+                            {t("identities.telegram_bot_access_desc")}
+                          </div>
+
+                          <div className="grid grid-cols-1 gap-2 sm:grid-cols-2">
+                            <button
+                              type="button"
+                              onClick={props.onOpenPublicTelegramWarning}
+                              disabled={props.telegram.saving || !scopedWorkspaceReady || !props.telegram.token.trim()}
+                              className={`flex items-center justify-center gap-2 rounded-lg border px-4 py-2.5 text-sm font-semibold transition-colors ${
+                                props.telegram.saving || !scopedWorkspaceReady || !props.telegram.token.trim()
+                                  ? "cursor-not-allowed border-gray-5 bg-gray-3 text-gray-8"
+                                  : "cursor-pointer border-gray-6 bg-gray-12 text-gray-1 hover:bg-gray-11"
+                              }`}
+                            >
+                              {props.telegram.saving ? (
+                                <div className="h-3.5 w-3.5 animate-spin rounded-full border-2 border-white/30 border-t-white" />
+                              ) : (
+                                <Link size={15} />
+                              )}
+                              {props.telegram.saving ? t("identities.connecting") : t("identities.create_public_bot")}
+                            </button>
+
+                            <button
+                              type="button"
+                              onClick={() => void props.onConnectPrivateTelegram()}
+                              disabled={props.telegram.saving || !scopedWorkspaceReady || !props.telegram.token.trim()}
+                              className={`flex items-center justify-center gap-2 rounded-lg border-none px-4 py-2.5 text-sm font-semibold text-white transition-opacity ${
+                                props.telegram.saving || !scopedWorkspaceReady || !props.telegram.token.trim()
+                                  ? "cursor-not-allowed opacity-50"
+                                  : "cursor-pointer opacity-100 hover:opacity-90"
+                              }`}
+                              style={{ background: "#229ED9" }}
+                            >
+                              {props.telegram.saving ? (
+                                <div className="h-3.5 w-3.5 animate-spin rounded-full border-2 border-white/30 border-t-white" />
+                              ) : (
+                                <Shield size={15} />
+                              )}
+                              {props.telegram.saving ? t("identities.connecting") : t("identities.create_private_bot")}
+                            </button>
+                          </div>
+
+                          {props.telegram.pairingCode ? (
+                            <div className="space-y-2 rounded-xl border border-sky-7/25 bg-sky-1/40 px-3.5 py-3">
+                              <div className="text-[12px] font-semibold text-sky-11">{t("identities.private_pairing_code")}</div>
+                              <div className="rounded-md border border-sky-7/20 bg-sky-2/80 px-3 py-2 font-mono text-[13px] tracking-[0.08em] text-sky-12">
+                                {props.telegram.pairingCode}
+                              </div>
+                              <div className="text-[11px] leading-relaxed text-sky-11/90">
+                                {t("identities.pairing_code_instruction_prefix")}{" "}
+                                <code className="rounded bg-sky-3/60 px-1 py-0.5 font-mono text-[10px]">
+                                  /pair {props.telegram.pairingCode}
+                                </code>
+                                .
+                              </div>
+                              <div className="flex items-center gap-2">
+                                <Button variant="outline" className="h-7 px-2.5 text-[11px]" onClick={() => void props.onCopyTelegramPairingCode()}>
+                                  <Copy size={12} />
+                                  <span className="ml-1">{t("identities.copy_code")}</span>
+                                </Button>
+                                <Button variant="outline" className="h-7 px-2.5 text-[11px]" onClick={props.onHideTelegramPairingCode}>
+                                  {t("common.hide")}
+                                </Button>
+                              </div>
+                            </div>
+                          ) : null}
+
+                          {telegramBotLink ? (
+                            <a
+                              href={telegramBotLink}
+                              target="_blank"
+                              rel="noreferrer"
+                              className="inline-flex items-center gap-2 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2 text-[12px] font-medium text-gray-11 hover:bg-gray-2"
+                            >
+                              <Link size={14} />
+                              {t("identities.open_bot_link", undefined, { username: props.telegram.botUsername ?? "" })}
+                            </a>
+                          ) : null}
+
+                          {props.telegram.identities.length === 0 && props.telegram.status ? (
+                            <div className="text-[11px] text-gray-9">{props.telegram.status}</div>
+                          ) : null}
+                          {props.telegram.identities.length === 0 && props.telegram.error ? (
+                            <div className="text-[11px] text-red-12">{props.telegram.error}</div>
+                          ) : null}
+                        </div>
+                      </div>
+                    ) : null}
+                  </div>
+
+                  <div
+                    className={`overflow-hidden rounded-xl border transition-colors ${
+                      hasSlackConnected ? "border-emerald-7/30 bg-emerald-1/20" : "border-gray-4 bg-gray-1"
+                    }`}
+                  >
+                    <button
+                      type="button"
+                      className="flex w-full items-center gap-3.5 px-4 py-3.5 text-left transition-colors hover:bg-gray-2/50"
+                      onClick={() => props.onToggleExpandedChannel("slack")}
+                    >
+                      <SlackIcon size={28} />
+                      <div className="min-w-0 flex-1">
+                        <div className="flex items-center gap-2">
+                          <span className="text-[15px] font-semibold text-gray-12">Slack</span>
+                          {hasSlackConnected ? (
+                            <span className="rounded-full bg-emerald-1/40 px-2 py-0.5 text-[10px] font-semibold text-emerald-11">
+                              {t("identities.connected_badge")}
+                            </span>
+                          ) : null}
+                        </div>
+                        <div className="mt-0.5 text-[13px] leading-snug text-gray-9">{t("identities.slack_desc")}</div>
+                      </div>
+                      <ChevronRight
+                        size={16}
+                        className={`shrink-0 text-gray-8 transition-transform ${
+                          props.expandedChannel === "slack" ? "rotate-90" : ""
+                        }`}
+                      />
+                    </button>
+
+                    {props.expandedChannel === "slack" ? (
+                      <div className="space-y-3 border-t border-gray-4 px-4 py-4 animate-[fadeUp_0.2s_ease-out]">
+                        {props.slack.identitiesError ? (
+                          <div className="rounded-lg border border-amber-7/20 bg-amber-1/30 px-3 py-2 text-xs text-amber-12">
+                            {props.slack.identitiesError}
+                          </div>
+                        ) : null}
+
+                        {props.slack.identities.length > 0 ? (
+                          <>
+                            <div className="space-y-2">
+                              {props.slack.identities.map((item) => (
+                                <div
+                                  key={item.id}
+                                  className="flex items-center justify-between gap-3 rounded-lg border border-gray-4 bg-gray-1 px-3 py-2.5"
+                                >
+                                  <div className="min-w-0">
+                                    <div className="flex items-center gap-2">
+                                      <div
+                                        className={`h-1.5 w-1.5 shrink-0 rounded-full ${item.running ? "bg-emerald-9" : "bg-gray-8"}`}
+                                      />
+                                      <span className="truncate text-[13px] font-semibold text-gray-12">
+                                        <span className="font-mono text-[12px]">{item.id}</span>
+                                      </span>
+                                    </div>
+                                    <div className="mt-0.5 pl-3.5 text-[11px] text-gray-9">
+                                      {item.enabled ? t("identities.enabled_label") : t("identities.disabled_label")} · {item.running ? t("identities.running_label") : t("identities.stopped_label")}
+                                    </div>
+                                  </div>
+                                  <Button
+                                    variant="outline"
+                                    className="h-7 shrink-0 px-2.5 text-[11px]"
+                                    disabled={props.slack.saving || item.id === "env" || !scopedWorkspaceReady}
+                                    onClick={() => void props.onDeleteSlack(item.id)}
+                                  >
+                                    {t("identities.disconnect")}
+                                  </Button>
+                                </div>
+                              ))}
+                            </div>
+
+                            <div className="flex gap-2.5">
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.status_label")}</div>
+                                <div className="flex items-center gap-1.5">
+                                  <div
+                                    className={`h-1.5 w-1.5 rounded-full ${
+                                      props.slack.identities.some((item) => item.running) ? "bg-emerald-9" : "bg-gray-8"
+                                    }`}
+                                  />
+                                  <span
+                                    className={`text-[13px] font-semibold ${
+                                      props.slack.identities.some((item) => item.running)
+                                        ? "text-emerald-11"
+                                        : "text-gray-10"
+                                    }`}
+                                  >
+                                    {props.slack.identities.some((item) => item.running)
+                                      ? t("identities.status_active")
+                                      : t("identities.status_stopped")}
+                                  </span>
+                                </div>
+                              </div>
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.identities_label")}</div>
+                                <div className="text-[13px] font-semibold text-gray-12">
+                                  {props.slack.identities.length} {t("identities.configured_suffix")}
+                                </div>
+                              </div>
+                              <div className="flex-1 rounded-lg border border-gray-4 bg-gray-2/50 px-3 py-2.5">
+                                <div className="mb-0.5 text-[11px] text-gray-9">{t("identities.channel_label")}</div>
+                                <div className="text-[13px] font-semibold text-gray-12">
+                                  {props.health?.channels.slack ? t("common.on") : t("common.off")}
+                                </div>
+                              </div>
+                            </div>
+
+                            {props.slack.status ? <div className="text-[11px] text-gray-9">{props.slack.status}</div> : null}
+                            {props.slack.error ? <div className="text-[11px] text-red-12">{props.slack.error}</div> : null}
+                          </>
+                        ) : null}
+
+                        <div className="space-y-2.5">
+                          {props.slack.identities.length === 0 ? (
+                            <p className="text-[13px] leading-relaxed text-gray-10">{t("identities.slack_intro")}</p>
+                          ) : null}
+
+                          <div className="space-y-2">
+                            <TextInput
+                              label={t("identities.bot_token_label")}
+                              placeholder="xoxb-..."
+                              type="password"
+                              value={props.slack.botToken}
+                              onChange={(event) => props.onSlackBotTokenChange(event.currentTarget.value)}
+                              className="rounded-lg border-gray-4 bg-gray-1 px-3 py-2.5 text-sm text-gray-12 placeholder:text-gray-8"
+                            />
+                            <TextInput
+                              label={t("identities.app_token_label")}
+                              placeholder="xapp-..."
+                              type="password"
+                              value={props.slack.appToken}
+                              onChange={(event) => props.onSlackAppTokenChange(event.currentTarget.value)}
+                              className="rounded-lg border-gray-4 bg-gray-1 px-3 py-2.5 text-sm text-gray-12 placeholder:text-gray-8"
+                            />
+                          </div>
+
+                          <label className="flex items-center gap-2 text-xs text-gray-11">
+                            <input
+                              type="checkbox"
+                              checked={props.slack.enabled}
+                              onChange={(event) => props.onSlackEnabledChange(event.currentTarget.checked)}
+                            />
+                            {t("identities.enabled_label")}
+                          </label>
+
+                          <button
+                            type="button"
+                            onClick={() => void props.onConnectSlack()}
+                            disabled={props.slack.saving || !scopedWorkspaceReady || !props.slack.botToken.trim() || !props.slack.appToken.trim()}
+                            className={`flex items-center gap-2 rounded-lg border-none px-4 py-2.5 text-sm font-semibold text-white transition-opacity ${
+                              props.slack.saving || !scopedWorkspaceReady || !props.slack.botToken.trim() || !props.slack.appToken.trim()
+                                ? "cursor-not-allowed opacity-50"
+                                : "cursor-pointer opacity-100 hover:opacity-90"
+                            }`}
+                            style={{ background: "#4A154B" }}
+                          >
+                            {props.slack.saving ? (
+                              <div className="h-3.5 w-3.5 animate-spin rounded-full border-2 border-white/30 border-t-white" />
+                            ) : (
+                              <Link size={15} />
+                            )}
+                            {props.slack.saving ? t("identities.connecting") : t("identities.connect_slack")}
+                          </button>
+
+                          {props.slack.identities.length === 0 && props.slack.status ? (
+                            <div className="text-[11px] text-gray-9">{props.slack.status}</div>
+                          ) : null}
+                          {props.slack.identities.length === 0 && props.slack.error ? (
+                            <div className="text-[11px] text-red-12">{props.slack.error}</div>
+                          ) : null}
+                        </div>
+                      </div>
+                    ) : null}
+                  </div>
+                </div>
+              </div>
+            </>
+          ) : null}
+
+          {props.activeTab === "advanced" && props.messagingEnabled ? (
+            <>
+              <div>
+                <div className="mb-2 text-[11px] font-semibold uppercase tracking-wider text-gray-9">
+                  {t("identities.message_routing_title")}
+                </div>
+                <p className="mb-3 text-[13px] leading-relaxed text-gray-9">{t("identities.message_routing_desc")}</p>
+
+                <div className="space-y-3 rounded-xl border border-gray-4 bg-gray-2/50 px-4 py-3.5">
+                  <div className="flex items-center gap-2">
+                    <Shield size={16} className="text-gray-9" />
+                    <span className="text-[13px] font-medium text-gray-11">{t("identities.default_routing")}</span>
+                  </div>
+                  <div className="flex items-center gap-2 pl-6">
+                    <span className="rounded-md bg-gray-4 px-2.5 py-1 text-[12px] font-medium text-gray-11">
+                      {t("identities.all_channels")}
+                    </span>
+                    <ArrowRight size={14} className="text-gray-8" />
+                    <span className="rounded-md bg-dls-accent/10 px-2.5 py-1 text-[12px] font-medium text-dls-accent">
+                      {defaultRoutingDirectory}
+                    </span>
+                  </div>
+                </div>
+
+                <div className="mt-2.5 text-xs text-gray-10">
+                  {t("identities.routing_override_prefix")}{" "}
+                  <code className="rounded bg-gray-3 px-1 py-0.5 font-mono text-[11px]">/dir &lt;path&gt;</code>{" "}
+                  {t("identities.routing_override_suffix")}
+                </div>
+              </div>
+
+              <div className="space-y-3 rounded-xl border border-gray-4 bg-gray-1 p-4">
+                <div className="flex items-center justify-between gap-2">
+                  <div>
+                    <div className="text-[13px] font-semibold text-gray-12">{t("identities.agent_behavior_title")}</div>
+                    <div className="mt-0.5 text-[12px] text-gray-9">{t("identities.agent_behavior_desc")}</div>
+                  </div>
+                  <span className="rounded-md border border-gray-4 bg-gray-2/50 px-2 py-1 text-[11px] font-mono text-gray-10">
+                    {agentFilePath}
+                  </span>
+                </div>
+
+                {props.health?.agent ? (
+                  <div className="rounded-lg border border-gray-4 bg-gray-2/40 px-3 py-2 text-[11px] text-gray-10">
+                    {t("identities.agent_scope_status", undefined, {
+                      status: props.health.agent.loaded ? t("identities.agent_status_loaded") : t("identities.agent_status_missing"),
+                      agent: props.health.agent.selected || t("identities.agent_none"),
+                    })}
+                  </div>
+                ) : null}
+
+                {props.agent.loading ? <div className="text-[11px] text-gray-9">{t("identities.agent_loading")}</div> : null}
+
+                {!props.agent.exists && !props.agent.loading ? (
+                  <div className="rounded-lg border border-amber-7/20 bg-amber-1/30 px-3 py-2 text-xs text-amber-12">
+                    {t("identities.agent_not_found")}
+                  </div>
+                ) : null}
+
+                <textarea
+                  className="min-h-[220px] w-full rounded-lg border border-gray-4 bg-gray-1 px-3 py-2.5 font-mono text-[13px] text-gray-12 placeholder:text-gray-8"
+                  placeholder={t("identities.agent_placeholder")}
+                  value={props.agent.draft}
+                  onChange={(event) => props.onChangeAgentDraft(event.currentTarget.value)}
+                />
+
+                <div className="flex flex-wrap items-center gap-2">
+                  <Button
+                    variant="outline"
+                    className="h-8 px-3 text-xs"
+                    onClick={() => void props.onLoadAgentFile()}
+                    disabled={props.agent.loading || !scopedWorkspaceReady}
+                  >
+                    {t("identities.reload")}
+                  </Button>
+                  {!props.agent.exists ? (
+                    <Button
+                      variant="outline"
+                      className="h-8 px-3 text-xs"
+                      onClick={() => void props.onCreateDefaultAgentFile()}
+                      disabled={props.agent.saving || !scopedWorkspaceReady}
+                    >
+                      {t("identities.create_default_file")}
+                    </Button>
+                  ) : null}
+                  <Button
+                    variant="secondary"
+                    className="h-8 px-3 text-xs"
+                    onClick={() => void props.onSaveAgentFile()}
+                    disabled={props.agent.saving || !scopedWorkspaceReady || !agentDirty}
+                  >
+                    {props.agent.saving ? t("identities.saving") : t("identities.save_behavior")}
+                  </Button>
+                  {agentDirty && !props.agent.saving ? (
+                    <span className="text-[11px] text-gray-9">{t("identities.unsaved_changes")}</span>
+                  ) : null}
+                </div>
+
+                {props.agent.status ? <div className="text-[11px] text-gray-9">{props.agent.status}</div> : null}
+                {props.agent.error ? <div className="text-[11px] text-red-12">{props.agent.error}</div> : null}
+              </div>
+
+              <div className="space-y-3 rounded-xl border border-gray-4 bg-gray-1 p-4">
+                <div>
+                  <div className="text-[13px] font-semibold text-gray-12">{t("identities.send_test_title")}</div>
+                  <div className="mt-0.5 text-[12px] text-gray-9">{t("identities.send_test_desc")}</div>
+                </div>
+
+                <div className="grid gap-2 sm:grid-cols-2">
+                  <div>
+                    <label className="mb-1 block text-[12px] text-gray-9">{t("identities.channel_label")}</label>
+                    <select
+                      className="w-full rounded-lg border border-gray-4 bg-gray-1 px-3 py-2 text-sm text-gray-12"
+                      value={props.sendTest.channel}
+                      onChange={(event) => props.onChangeSendChannel(event.currentTarget.value === "slack" ? "slack" : "telegram")}
+                    >
+                      <option value="telegram">Telegram</option>
+                      <option value="slack">Slack</option>
+                    </select>
+                  </div>
+                  <TextInput
+                    label={t("identities.peer_id_label")}
+                    placeholder={
+                      props.sendTest.channel === "telegram"
+                        ? t("identities.peer_id_placeholder_telegram")
+                        : t("identities.peer_id_placeholder_slack")
+                    }
+                    value={props.sendTest.peerId}
+                    onChange={(event) => props.onChangeSendPeerId(event.currentTarget.value)}
+                    className="rounded-lg border-gray-4 bg-gray-1 px-3 py-2 text-sm text-gray-12 placeholder:text-gray-8"
+                  />
+                </div>
+
+                <div className="grid gap-2 sm:grid-cols-2">
+                  <TextInput
+                    label={t("identities.directory_label")}
+                    placeholder={defaultRoutingDirectory}
+                    value={props.sendTest.directory}
+                    onChange={(event) => props.onChangeSendDirectory(event.currentTarget.value)}
+                    className="rounded-lg border-gray-4 bg-gray-1 px-3 py-2 text-sm text-gray-12 placeholder:text-gray-8"
+                  />
+                  <div className="flex items-end pb-1">
+                    <label className="flex items-center gap-2 text-xs text-gray-11">
+                      <input
+                        type="checkbox"
+                        checked={props.sendTest.autoBind}
+                        onChange={(event) => props.onChangeSendAutoBind(event.currentTarget.checked)}
+                      />
+                      {t("identities.auto_bind_label")}
+                    </label>
+                  </div>
+                </div>
+
+                <div>
+                  <label className="mb-1 block text-[12px] text-gray-9">{t("identities.message_label")}</label>
+                  <textarea
+                    className="min-h-[90px] w-full rounded-lg border border-gray-4 bg-gray-1 px-3 py-2 text-sm text-gray-12 placeholder:text-gray-8"
+                    placeholder={t("identities.send_test_button")}
+                    value={props.sendTest.text}
+                    onChange={(event) => props.onChangeSendText(event.currentTarget.value)}
+                  />
+                </div>
+
+                <div className="flex items-center gap-2">
+                  <Button
+                    variant="secondary"
+                    className="h-8 px-3 text-xs"
+                    onClick={() => void props.onSendTestMessage()}
+                    disabled={props.sendTest.busy || !scopedWorkspaceReady || !props.sendTest.text.trim()}
+                  >
+                    {props.sendTest.busy ? t("identities.sending") : t("identities.send_test_button")}
+                  </Button>
+                  {props.sendTest.status ? <span className="text-[11px] text-gray-9">{props.sendTest.status}</span> : null}
+                </div>
+
+                {props.sendTest.error ? <div className="text-[11px] text-red-12">{props.sendTest.error}</div> : null}
+                {props.sendTest.result ? (
+                  <div className="space-y-1 rounded-lg border border-gray-4 bg-gray-2/40 px-3 py-2 font-mono text-[11px] text-gray-10">
+                    <div>
+                      sent={props.sendTest.result.sent} attempted={props.sendTest.result.attempted}
+                      {props.sendTest.result.failures?.length ? ` failures=${props.sendTest.result.failures.length}` : ""}
+                      {props.sendTest.result.reason?.trim() ? ` reason=${props.sendTest.result.reason}` : ""}
+                    </div>
+                    {props.sendTest.result.failures?.map((failure) => (
+                      <div key={`${failure.identityId}:${failure.peerId}:${failure.error}`} className="text-red-11">
+                        {failure.identityId}/{failure.peerId}: {failure.error}
+                      </div>
+                    ))}
+                  </div>
+                ) : null}
+              </div>
+            </>
+          ) : null}
+
+          <ConfirmModal
+            open={props.modals.messagingRiskOpen}
+            title={t("identities.enable_messaging_title")}
+            message={t("identities.enable_messaging_risk")}
+            confirmLabel={props.messagingSaving ? t("identities.enabling") : t("identities.enable_messaging")}
+            cancelLabel={t("common.cancel")}
+            variant="danger"
+            onCancel={props.onCancelMessagingRisk}
+            onConfirm={() => void props.onConfirmEnableMessaging()}
+          />
+
+          <ConfirmModal
+            open={props.modals.messagingRestartPromptOpen}
+            title={t("identities.restart_worker_title")}
+            message={
+              props.modals.messagingRestartAction === "enable"
+                ? t("identities.restart_to_enable_messaging")
+                : t("identities.restart_to_disable_messaging")
+            }
+            confirmLabel={props.messagingRestartBusy ? t("identities.restarting") : t("identities.restart_worker")}
+            cancelLabel={t("identities.later")}
+            onCancel={props.onCancelRestartPrompt}
+            onConfirm={() => void props.onConfirmRestartMessagingWorker()}
+          />
+
+          <ConfirmModal
+            open={props.modals.messagingDisableConfirmOpen}
+            title={t("identities.disable_messaging_title")}
+            message={t("identities.disable_messaging_message")}
+            confirmLabel={props.messagingSaving ? t("identities.disabling") : t("identities.disable_messaging")}
+            cancelLabel={t("common.cancel")}
+            onCancel={props.onCancelDisableMessagingConfirm}
+            onConfirm={() => void props.onConfirmDisableMessaging()}
+          />
+
+          <ConfirmModal
+            open={props.modals.publicTelegramWarningOpen}
+            title={t("identities.public_bot_warning_title")}
+            message={t("identities.public_bot_warning_message")}
+            confirmLabel={t("identities.public_bot_confirm")}
+            cancelLabel={t("common.cancel")}
+            variant="danger"
+            confirmButtonVariant="danger"
+            cancelButtonVariant="primary"
+            onCancel={props.onCancelPublicTelegramWarning}
+            onConfirm={() => void props.onConfirmPublicTelegram()}
+          />
+        </>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/plugins-view.tsx b/apps/app/src/react-app/domains/settings/pages/plugins-view.tsx
new file mode 100644
index 0000000000..17b877144e
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/plugins-view.tsx
@@ -0,0 +1,327 @@
+/** @jsxImportSource react */
+import { Cpu } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import { TextInput } from "../../../design-system/text-input";
+
+// Explicit, prop-driven shape of the extensions store. The Solid
+// PluginsView pulled this from useExtensions(); in React we pass it
+// in so the page stays stateless and the extensions provider can be
+// ported separately.
+export type PluginsExtensionsStore = {
+  pluginScope: "project" | "global";
+  setPluginScope: (value: "project" | "global") => void;
+  refreshPlugins: (scope?: "project" | "global") => void | Promise<void>;
+  pluginConfigPath: () => string | null;
+  pluginConfig: () => { path?: string | null } | null;
+  pluginList: () => Array<{
+    name: string;
+    source: "config" | "dir.project" | "dir.global";
+    removable: boolean;
+  }>;
+  pluginInput: () => string;
+  setPluginInput: (value: string) => void;
+  pluginStatus: () => string | null;
+  addPlugin: (packageName?: string) => void | Promise<void>;
+  removePlugin: (packageName: string) => void | Promise<void>;
+  isPluginInstalledByName: (packageName: string, aliases?: string[]) => boolean;
+  activePluginGuide: () => string | null;
+  setActivePluginGuide: (packageName: string | null) => void;
+};
+
+type SuggestedPlugin = {
+  name: string;
+  packageName: string;
+  description: string;
+  tags: string[];
+  aliases?: string[];
+  installMode?: "simple" | "guided";
+  steps?: Array<{
+    title: string;
+    description: string;
+    command?: string;
+    url?: string;
+    path?: string;
+    note?: string;
+  }>;
+};
+
+export type PluginsViewProps = {
+  extensions: PluginsExtensionsStore;
+  busy: boolean;
+  selectedWorkspaceRoot: string;
+  canEditPlugins: boolean;
+  canUseGlobalScope: boolean;
+  accessHint?: string | null;
+  suggestedPlugins: SuggestedPlugin[];
+};
+
+export function PluginsView(props: PluginsViewProps) {
+  const { extensions } = props;
+  const scope = extensions.pluginScope;
+  return (
+    <section className="space-y-6">
+      <div className="bg-gray-2/30 border border-gray-6/50 rounded-2xl p-5 space-y-4">
+        <div className="flex items-start justify-between gap-4">
+          <div className="space-y-1">
+            <div className="text-sm font-medium text-gray-12">
+              {t("plugins.title")}
+            </div>
+            <div className="text-xs text-gray-10">{t("plugins.desc")}</div>
+          </div>
+          <div className="flex items-center gap-2">
+            <button
+              type="button"
+              className={`px-3 py-1 rounded-full text-xs font-medium border transition-colors ${
+                scope === "project"
+                  ? "bg-gray-12/10 text-gray-12 border-gray-6/20"
+                  : "text-gray-10 border-gray-6 hover:text-gray-12"
+              }`}
+              onClick={() => {
+                extensions.setPluginScope("project");
+                void extensions.refreshPlugins("project");
+              }}
+            >
+              {t("plugins.scope_project")}
+            </button>
+            <button
+              type="button"
+              disabled={!props.canUseGlobalScope}
+              className={`px-3 py-1 rounded-full text-xs font-medium border transition-colors ${
+                scope === "global"
+                  ? "bg-gray-12/10 text-gray-12 border-gray-6/20"
+                  : "text-gray-10 border-gray-6 hover:text-gray-12"
+              } ${
+                !props.canUseGlobalScope
+                  ? "opacity-40 cursor-not-allowed hover:text-gray-10"
+                  : ""
+              }`}
+              onClick={() => {
+                if (!props.canUseGlobalScope) return;
+                extensions.setPluginScope("global");
+                void extensions.refreshPlugins("global");
+              }}
+            >
+              {t("plugins.scope_global")}
+            </button>
+            <Button
+              variant="ghost"
+              onClick={() => void extensions.refreshPlugins()}
+            >
+              {t("common.refresh")}
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-1 text-xs text-gray-10">
+          <div>{t("plugins.config_label")}</div>
+          <div className="text-gray-7 font-mono truncate">
+            {extensions.pluginConfigPath() ??
+              extensions.pluginConfig()?.path ??
+              t("plugins.not_loaded_yet")}
+          </div>
+          {props.accessHint ? (
+            <div className="text-gray-9">{props.accessHint}</div>
+          ) : null}
+        </div>
+
+        <div className="space-y-3">
+          <div className="text-xs font-medium text-gray-11 uppercase tracking-wider">
+            {t("plugins.suggested_heading")}
+          </div>
+          <div className="grid gap-3">
+            {props.suggestedPlugins.map((plugin) => {
+              const isGuided = plugin.installMode === "guided";
+              const isInstalled = extensions.isPluginInstalledByName(
+                plugin.packageName,
+                plugin.aliases ?? [],
+              );
+              const isGuideOpen =
+                extensions.activePluginGuide() === plugin.packageName;
+
+              return (
+                <div
+                  key={plugin.packageName}
+                  className="rounded-2xl border border-gray-6/60 bg-gray-1/40 p-4 space-y-3"
+                >
+                  <div className="flex items-start justify-between gap-4">
+                    <div>
+                      <div className="text-sm font-medium text-gray-12 font-mono">
+                        {plugin.name}
+                      </div>
+                      <div className="text-xs text-gray-10 mt-1">
+                        {plugin.description}
+                      </div>
+                      {plugin.packageName !== plugin.name ? (
+                        <div className="text-xs text-gray-7 font-mono mt-1">
+                          {plugin.packageName}
+                        </div>
+                      ) : null}
+                    </div>
+                    <div className="flex items-center gap-2">
+                      {isGuided ? (
+                        <Button
+                          variant="ghost"
+                          onClick={() =>
+                            extensions.setActivePluginGuide(
+                              isGuideOpen ? null : plugin.packageName,
+                            )
+                          }
+                        >
+                          {isGuideOpen
+                            ? t("plugins.hide_setup")
+                            : t("plugins.setup")}
+                        </Button>
+                      ) : null}
+                      <Button
+                        variant={isInstalled ? "outline" : "secondary"}
+                        onClick={() => extensions.addPlugin(plugin.packageName)}
+                        disabled={
+                          props.busy ||
+                          isInstalled ||
+                          !props.canEditPlugins ||
+                          (scope === "project" &&
+                            !props.selectedWorkspaceRoot.trim())
+                        }
+                      >
+                        {isInstalled ? t("plugins.added") : t("plugins.add")}
+                      </Button>
+                    </div>
+                  </div>
+                  <div className="flex flex-wrap gap-2">
+                    {plugin.tags.map((tag) => (
+                      <span
+                        key={tag}
+                        className="text-[10px] uppercase tracking-wide bg-gray-4/70 text-gray-11 px-2 py-0.5 rounded-full"
+                      >
+                        {tag}
+                      </span>
+                    ))}
+                  </div>
+                  {isGuided && isGuideOpen ? (
+                    <div className="rounded-xl border border-gray-6/70 bg-gray-1/60 p-4 space-y-3">
+                      {(plugin.steps ?? []).map((step, idx) => (
+                        <div key={`${plugin.packageName}-step-${idx}`} className="space-y-1">
+                          <div className="text-xs font-medium text-gray-11">
+                            {idx + 1}. {step.title}
+                          </div>
+                          <div className="text-xs text-gray-10">
+                            {step.description}
+                          </div>
+                          {step.command ? (
+                            <div className="text-xs font-mono text-gray-12 bg-gray-2/60 border border-gray-6/70 rounded-lg px-3 py-2">
+                              {step.command}
+                            </div>
+                          ) : null}
+                          {step.note ? (
+                            <div className="text-xs text-gray-10">
+                              {step.note}
+                            </div>
+                          ) : null}
+                          {step.url ? (
+                            <div className="text-xs text-gray-10">
+                              Open:{" "}
+                              <span className="font-mono text-gray-11">
+                                {step.url}
+                              </span>
+                            </div>
+                          ) : null}
+                          {step.path ? (
+                            <div className="text-xs text-gray-10">
+                              Path:{" "}
+                              <span className="font-mono text-gray-11">
+                                {step.path}
+                              </span>
+                            </div>
+                          ) : null}
+                        </div>
+                      ))}
+                    </div>
+                  ) : null}
+                </div>
+              );
+            })}
+          </div>
+        </div>
+
+        {extensions.pluginList().length === 0 ? (
+          <div className="rounded-xl border border-gray-6/60 bg-gray-1/40 p-4 text-sm text-gray-10">
+            {t("plugins.empty")}
+          </div>
+        ) : (
+          <div className="grid gap-2">
+            {extensions.pluginList().map((plugin) => (
+              <div
+                key={plugin.name}
+                className="flex items-center justify-between rounded-xl border border-gray-6/60 bg-gray-1/40 px-4 py-2.5"
+              >
+                <div>
+                  <div className="text-sm text-gray-12 font-mono flex items-center gap-2">
+                    <Cpu size={14} className="text-gray-10" />
+                    {plugin.name}
+                  </div>
+                  {!plugin.removable ? (
+                    <div className="mt-1 text-xs text-gray-10">
+                      {plugin.source === "dir.global"
+                        ? "Discovered from a global plugin folder."
+                        : "Discovered from the workspace plugin folder."}
+                    </div>
+                  ) : null}
+                </div>
+                <div className="flex items-center gap-2">
+                  <div className="text-[10px] uppercase tracking-wide text-gray-10">
+                    {plugin.removable ? t("plugins.enabled") : t("settings.cap_read_only")}
+                  </div>
+                  {plugin.removable ? (
+                    <Button
+                      variant="ghost"
+                      className="h-7 px-2 text-[11px] text-red-11 hover:text-red-12"
+                      onClick={() => extensions.removePlugin(plugin.name)}
+                      disabled={props.busy || !props.canEditPlugins}
+                    >
+                      {t("plugins.remove")}
+                    </Button>
+                  ) : null}
+                </div>
+              </div>
+            ))}
+          </div>
+        )}
+
+        <div className="flex flex-col gap-3">
+          <div className="flex flex-col md:flex-row gap-3">
+            <div className="flex-1">
+              <TextInput
+                label={t("plugins.add_label")}
+                placeholder="opencode-wakatime"
+                value={extensions.pluginInput()}
+                onChange={(event) =>
+                  extensions.setPluginInput(event.currentTarget.value)
+                }
+                hint={t("plugins.add_hint")}
+              />
+            </div>
+            <Button
+              variant="secondary"
+              onClick={() => extensions.addPlugin()}
+              disabled={
+                props.busy ||
+                !extensions.pluginInput().trim() ||
+                !props.canEditPlugins
+              }
+              className="md:mt-6"
+            >
+              {t("plugins.add")}
+            </Button>
+          </div>
+          {extensions.pluginStatus() ? (
+            <div className="text-xs text-gray-10">
+              {extensions.pluginStatus()}
+            </div>
+          ) : null}
+        </div>
+      </div>
+    </section>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/recovery-view.tsx b/apps/app/src/react-app/domains/settings/pages/recovery-view.tsx
new file mode 100644
index 0000000000..f11a3a46e5
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/recovery-view.tsx
@@ -0,0 +1,108 @@
+/** @jsxImportSource react */
+import { FolderOpen } from "lucide-react";
+
+import { isDesktopRuntime } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+
+export type RecoveryViewProps = {
+  anyActiveRuns: boolean;
+  workspaceConfigPath: string;
+  revealConfigBusy: boolean;
+  onRevealWorkspaceConfig: () => void | Promise<void>;
+  resetConfigBusy: boolean;
+  onResetAppConfigDefaults: () => void | Promise<void>;
+  configActionStatus: string | null;
+  cacheRepairBusy: boolean;
+  cacheRepairResult: string | null;
+  onRepairOpencodeCache: () => void | Promise<void>;
+  dockerCleanupBusy: boolean;
+  dockerCleanupResult: string | null;
+  onCleanupOpenworkDockerContainers: () => void | Promise<void>;
+};
+
+export function RecoveryView(props: RecoveryViewProps) {
+  return (
+    <div className="space-y-6">
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div className="text-sm font-medium text-gray-12">{t("settings.workspace_config_title")}</div>
+        <div className="text-xs text-gray-10">{t("settings.workspace_config_desc")}</div>
+        <div className="break-all font-mono text-[11px] text-gray-7">
+          {props.workspaceConfigPath || t("settings.no_active_workspace")}
+        </div>
+        <div className="flex flex-wrap items-center gap-2">
+          <Button
+            variant="outline"
+            className="h-8 px-3 py-0 text-xs"
+            onClick={() => void props.onRevealWorkspaceConfig()}
+            disabled={!isDesktopRuntime() || props.revealConfigBusy || !props.workspaceConfigPath}
+            title={!isDesktopRuntime() ? t("settings.reveal_config_requires_desktop") : ""}
+          >
+            <FolderOpen size={13} className="mr-1.5" />
+            {props.revealConfigBusy ? t("settings.opening") : t("settings.reveal_config")}
+          </Button>
+          <Button
+            variant="danger"
+            className="h-8 px-3 py-0 text-xs"
+            onClick={() => void props.onResetAppConfigDefaults()}
+            disabled={props.resetConfigBusy || props.anyActiveRuns}
+            title={props.anyActiveRuns ? t("settings.stop_runs_before_reset_config") : ""}
+          >
+            {props.resetConfigBusy ? t("settings.resetting") : t("settings.reset_config_defaults")}
+          </Button>
+        </div>
+        {props.configActionStatus ? (
+          <div className="text-xs text-gray-10">{props.configActionStatus}</div>
+        ) : null}
+      </div>
+
+      <div className="flex flex-col gap-4 rounded-2xl border border-gray-6/50 bg-gray-2/30 p-4 md:flex-row md:items-center md:justify-between">
+        <div className="min-w-0">
+          <div className="text-sm text-gray-12">{t("settings.opencode_cache")}</div>
+          <div className="text-xs text-gray-7">{t("settings.opencode_cache_description")}</div>
+          {props.cacheRepairResult ? (
+            <div className="mt-2 text-xs text-gray-11">{props.cacheRepairResult}</div>
+          ) : null}
+        </div>
+        <Button
+          variant="secondary"
+          className="h-8 shrink-0 px-3 py-0 text-xs"
+          onClick={() => void props.onRepairOpencodeCache()}
+          disabled={props.cacheRepairBusy || !isDesktopRuntime()}
+          title={isDesktopRuntime() ? "" : t("settings.cache_repair_requires_desktop")}
+        >
+          {props.cacheRepairBusy ? t("settings.repairing_cache") : t("settings.repair_cache")}
+        </Button>
+      </div>
+
+      <div className="flex flex-col gap-4 rounded-2xl border border-gray-6/50 bg-gray-2/30 p-4 md:flex-row md:items-center md:justify-between">
+        <div className="min-w-0">
+          <div className="text-sm text-gray-12">{t("settings.docker_containers_title")}</div>
+          <div className="text-xs text-gray-7">{t("settings.docker_containers_desc")}</div>
+          {props.dockerCleanupResult ? (
+            <div className="mt-2 text-xs text-gray-11">{props.dockerCleanupResult}</div>
+          ) : null}
+        </div>
+        <Button
+          variant="danger"
+          className="h-8 shrink-0 px-3 py-0 text-xs"
+          onClick={() => void props.onCleanupOpenworkDockerContainers()}
+          disabled={props.dockerCleanupBusy || props.anyActiveRuns || !isDesktopRuntime()}
+          title={
+            !isDesktopRuntime()
+              ? t("settings.docker_requires_desktop")
+              : props.anyActiveRuns
+                ? t("settings.stop_runs_before_cleanup")
+                : ""
+          }
+        >
+          {props.dockerCleanupBusy
+            ? t("settings.removing_containers")
+            : t("settings.delete_containers")}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/pages/skills-view.tsx b/apps/app/src/react-app/domains/settings/pages/skills-view.tsx
new file mode 100644
index 0000000000..830cf4bc6f
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/skills-view.tsx
@@ -0,0 +1,1433 @@
+/** @jsxImportSource react */
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+  type KeyboardEvent as ReactKeyboardEvent,
+} from "react";
+import {
+  ArrowLeft,
+  Cloud,
+  Copy,
+  Edit2,
+  FolderOpen,
+  Loader2,
+  Package,
+  Plus,
+  RefreshCw,
+  Rocket,
+  Search,
+  Share2,
+  Sparkles,
+  Trash2,
+  Upload,
+  Users,
+  X,
+} from "lucide-react";
+
+import { t } from "../../../../i18n";
+import type { SkillBundleV1 } from "../../../../app/bundles/types";
+import { saveInstalledSkillToOpenWorkOrg } from "../../../../app/bundles/skill-org-publish";
+import {
+  buildDenAuthUrl,
+  createDenClient,
+  DEFAULT_DEN_BASE_URL,
+  readDenSettings,
+  type DenOrgSkillHubSummary,
+} from "../../../../app/lib/den";
+import {
+  DEFAULT_OPENWORK_PUBLISHER_BASE_URL,
+  publishOpenworkBundleJson,
+} from "../../../../app/lib/publisher";
+import type {
+  DenOrgSkillCard,
+  HubSkillCard,
+  HubSkillRepo,
+  SkillCard,
+} from "../../../../app/types";
+import {
+  inputClass,
+  modalHeaderButtonClass,
+  modalHeaderClass,
+  modalNoticeErrorClass,
+  modalNoticeSuccessClass,
+  modalOverlayClass,
+  modalShellClass,
+  modalSubtitleClass,
+  modalTitleClass,
+  pillGhostClass,
+  pillPrimaryClass,
+  pillSecondaryClass,
+  surfaceCardClass,
+  tagClass,
+} from "../../workspace/modal-styles";
+import { Button } from "../../../design-system/button";
+import { ConfirmModal } from "../../../design-system/modals/confirm-modal";
+import {
+  SelectMenu,
+  type SelectMenuOption,
+} from "../../../design-system/select-menu";
+import { WorkspaceOptionCard } from "../../../domains/workspace/option-card";
+
+type InstallResult = { ok: boolean; message: string };
+type SkillsFilter = "all" | "installed" | "cloud" | "hub";
+type ShareSkillSubView = "chooser" | "public" | "team";
+type CloudSkillInstallState = "available" | "installed" | "update" | "missing_local";
+type ToastTone = "info" | "success" | "warning" | "error";
+
+const pageTitleClass = "text-[28px] font-semibold tracking-[-0.5px] text-dls-text";
+const sectionTitleClass = "text-[15px] font-medium tracking-[-0.2px] text-dls-text";
+const panelCardClass =
+  "rounded-[20px] border border-dls-border bg-dls-surface p-5 transition-all hover:border-dls-border hover:shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)]";
+
+const OPENWORK_DEFAULT_SKILL_NAMES = new Set([
+  "workspace-guide",
+  "get-started",
+  "skill-creator",
+  "command-creator",
+  "agent-creator",
+  "plugin-creator",
+]);
+
+export type ImportedCloudSkillRecord = {
+  installedName: string;
+  updatedAt?: string | null;
+};
+
+export type SkillsExtensionsStore = {
+  skills: () => SkillCard[];
+  skillsStatus: () => string | null;
+  hubSkills: () => HubSkillCard[];
+  hubSkillsStatus: () => string | null;
+  cloudOrgSkills: () => DenOrgSkillCard[];
+  cloudOrgSkillsStatus: () => string | null;
+  importedCloudSkills: () => Record<string, ImportedCloudSkillRecord>;
+  hubRepo: () => HubSkillRepo | null;
+  hubRepos: () => HubSkillRepo[];
+  ensureHubSkillsFresh: () => void | Promise<void>;
+  ensureCloudOrgSkillsFresh: () => void | Promise<void>;
+  refreshSkills: (options?: { force?: boolean }) => void | Promise<void>;
+  refreshHubSkills: (options?: { force?: boolean }) => void | Promise<void>;
+  refreshCloudOrgSkills: (options?: { force?: boolean }) => void | Promise<void>;
+  setHubRepo: (repo: HubSkillRepo) => void | Promise<void>;
+  addHubRepo: (repo: HubSkillRepo) => void | Promise<void>;
+  removeHubRepo: (repo: HubSkillRepo) => void | Promise<void>;
+  installSkillCreator: () => Promise<InstallResult>;
+  installCloudOrgSkill: (skill: DenOrgSkillCard) => Promise<InstallResult>;
+  installHubSkill: (name: string) => Promise<InstallResult>;
+  importLocalSkill: () => void | Promise<void>;
+  revealSkillsFolder: () => void | Promise<void>;
+  readSkill: (name: string) => Promise<{ content: string } | null>;
+  saveSkill: (input: {
+    name: string;
+    content: string;
+    description?: string;
+  }) => void | Promise<void>;
+  uninstallSkill: (name: string) => void | Promise<void>;
+};
+
+export type SkillsViewProps = {
+  workspaceName: string;
+  busy: boolean;
+  showHeader?: boolean;
+  canInstallSkillCreator: boolean;
+  canUseDesktopTools: boolean;
+  accessHint?: string | null;
+  extensions: SkillsExtensionsStore;
+  onOpenLink: (url: string) => void;
+  onToast?: (input: { title: string; tone?: ToastTone }) => void;
+  createSessionAndOpen: (initialPrompt?: string) => Promise<string | undefined> | string | void;
+};
+
+export function SkillsView(props: SkillsViewProps) {
+  const { extensions } = props;
+  const [uninstallTarget, setUninstallTarget] = useState<SkillCard | null>(null);
+  const [searchQuery, setSearchQuery] = useState("");
+  const [activeFilter, setActiveFilter] = useState<SkillsFilter>("all");
+  const [customRepoOpen, setCustomRepoOpen] = useState(false);
+  const [customRepoOwner, setCustomRepoOwner] = useState("");
+  const [customRepoName, setCustomRepoName] = useState("");
+  const [customRepoRef, setCustomRepoRef] = useState("main");
+  const [customRepoError, setCustomRepoError] = useState<string | null>(null);
+
+  const [shareTarget, setShareTarget] = useState<SkillCard | null>(null);
+  const [shareSubView, setShareSubView] = useState<ShareSkillSubView>("chooser");
+  const [shareBusy, setShareBusy] = useState(false);
+  const [shareUrl, setShareUrl] = useState<string | null>(null);
+  const [shareError, setShareError] = useState<string | null>(null);
+  const [cloudSessionNonce, setCloudSessionNonce] = useState(0);
+  const [shareTeamBusy, setShareTeamBusy] = useState(false);
+  const [shareTeamError, setShareTeamError] = useState<string | null>(null);
+  const [shareTeamSuccess, setShareTeamSuccess] = useState<string | null>(null);
+  const [sharePermissionChoice, setSharePermissionChoice] = useState("org");
+  const [shareHubsLoading, setShareHubsLoading] = useState(false);
+  const [shareHubsError, setShareHubsError] = useState<string | null>(null);
+  const [shareManageableHubs, setShareManageableHubs] = useState<DenOrgSkillHubSummary[]>([]);
+
+  const [selectedSkill, setSelectedSkill] = useState<SkillCard | null>(null);
+  const [selectedContent, setSelectedContent] = useState("");
+  const [selectedLoading, setSelectedLoading] = useState(false);
+  const [selectedDirty, setSelectedDirty] = useState(false);
+  const [selectedError, setSelectedError] = useState<string | null>(null);
+
+  const [installingSkillCreator, setInstallingSkillCreator] = useState(false);
+  const [installingHubSkill, setInstallingHubSkill] = useState<string | null>(null);
+  const [installingCloudSkillId, setInstallingCloudSkillId] = useState<string | null>(null);
+  const [denUiTick, setDenUiTick] = useState(0);
+
+  const showToast = useCallback(
+    (title: string, tone: ToastTone = "info") => {
+      props.onToast?.({ title, tone });
+    },
+    [props],
+  );
+
+  const maskError = useCallback(
+    (value: unknown) =>
+      value instanceof Error ? value.message : t("common.something_went_wrong"),
+    [],
+  );
+
+  useEffect(() => {
+    void extensions.ensureHubSkillsFresh();
+    void extensions.ensureCloudOrgSkillsFresh();
+    const onDenSession = () => {
+      setDenUiTick((value) => value + 1);
+      setCloudSessionNonce((value) => value + 1);
+      void extensions.refreshCloudOrgSkills({ force: true });
+    };
+    window.addEventListener("openwork-den-session-updated", onDenSession);
+    return () => window.removeEventListener("openwork-den-session-updated", onDenSession);
+  }, [extensions]);
+
+  useEffect(() => {
+    if (!shareTarget) return;
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.key !== "Escape") return;
+      event.preventDefault();
+      if (shareSubView !== "chooser") {
+        setShareSubView("chooser");
+        setShareError(null);
+        setShareTeamError(null);
+        setShareTeamSuccess(null);
+        setSharePermissionChoice("org");
+        setShareHubsError(null);
+        return;
+      }
+      setShareTarget(null);
+    };
+    window.addEventListener("keydown", onKeyDown);
+    return () => window.removeEventListener("keydown", onKeyDown);
+  }, [shareSubView, shareTarget]);
+
+  const shareCloudSignedIn = useMemo(() => {
+    cloudSessionNonce;
+    return Boolean(readDenSettings().authToken?.trim());
+  }, [cloudSessionNonce]);
+
+  const shareTeamOrgLabel = useMemo(() => {
+    cloudSessionNonce;
+    const name = readDenSettings().activeOrgName?.trim();
+    return name || t("skills.share_team_org_fallback");
+  }, [cloudSessionNonce]);
+
+  const shareTeamDisabledReason = useMemo(() => {
+    if (!shareCloudSignedIn) return null;
+    const settings = readDenSettings();
+    if (!settings.activeOrgId?.trim() && !settings.activeOrgSlug?.trim()) {
+      return t("skills.share_team_choose_org");
+    }
+    return null;
+  }, [shareCloudSignedIn]);
+
+  useEffect(() => {
+    if (!shareTarget || shareSubView !== "team" || !shareCloudSignedIn) return;
+
+    let cancelled = false;
+    void (async () => {
+      setShareHubsLoading(true);
+      setShareHubsError(null);
+      try {
+        const settings = readDenSettings();
+        const token = settings.authToken?.trim() ?? "";
+        if (!token) return;
+
+        let orgId = settings.activeOrgId?.trim() ?? "";
+        const client = createDenClient({ baseUrl: settings.baseUrl, token });
+        if (!orgId) {
+          const result = await client.listOrgs();
+          orgId = result.orgs[0]?.id ?? "";
+        }
+        if (!orgId) {
+          throw new Error(t("skills.share_team_choose_org"));
+        }
+        const hubs = await client.listOrgSkillHubSummaries(orgId);
+        if (cancelled) return;
+        setShareManageableHubs(hubs.filter((hub) => hub.canManage));
+      } catch (error) {
+        if (cancelled) return;
+        setShareHubsError(maskError(error));
+        setShareManageableHubs([]);
+      } finally {
+        if (!cancelled) setShareHubsLoading(false);
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [maskError, shareCloudSignedIn, shareSubView, shareTarget]);
+
+  const skills = extensions.skills();
+  const hubSkills = extensions.hubSkills();
+  const cloudOrgSkills = extensions.cloudOrgSkills();
+  const importedCloudSkills = extensions.importedCloudSkills();
+  const hubRepo = extensions.hubRepo();
+  const hubRepos = extensions.hubRepos();
+  const skillsStatus = extensions.skillsStatus();
+  const hubSkillsStatus = extensions.hubSkillsStatus();
+  const cloudOrgSkillsStatus = extensions.cloudOrgSkillsStatus();
+
+  const skillCreatorInstalled = useMemo(
+    () => skills.some((skill) => skill.name === "skill-creator"),
+    [skills],
+  );
+
+  const filteredSkills = useMemo(() => {
+    const query = searchQuery.trim().toLowerCase();
+    if (!query) return skills;
+    return skills.filter((skill) => {
+      const description = skill.description ?? "";
+      return skill.name.toLowerCase().includes(query) || description.toLowerCase().includes(query);
+    });
+  }, [searchQuery, skills]);
+
+  const installedNames = useMemo(() => new Set(skills.map((skill) => skill.name)), [skills]);
+
+  const filteredHubSkills = useMemo(() => {
+    const query = searchQuery.trim().toLowerCase();
+    const items = hubSkills.filter((skill) => !installedNames.has(skill.name));
+    if (!query) return items;
+    return items.filter((skill) => {
+      const description = skill.description ?? "";
+      const trigger = skill.trigger ?? "";
+      return (
+        skill.name.toLowerCase().includes(query) ||
+        description.toLowerCase().includes(query) ||
+        trigger.toLowerCase().includes(query)
+      );
+    });
+  }, [hubSkills, installedNames, searchQuery]);
+
+  const filteredCloudOrgSkills = useMemo(() => {
+    const query = searchQuery.trim().toLowerCase();
+    if (!query) return cloudOrgSkills;
+    return cloudOrgSkills.filter((skill) => {
+      const description = skill.description ?? "";
+      const hub = skill.hubName ?? "";
+      return (
+        skill.title.toLowerCase().includes(query) ||
+        description.toLowerCase().includes(query) ||
+        hub.toLowerCase().includes(query)
+      );
+    });
+  }, [cloudOrgSkills, searchQuery]);
+
+  const cloudSkillInstallState = useCallback(
+    (skill: DenOrgSkillCard): CloudSkillInstallState => {
+      const imported = importedCloudSkills[skill.id];
+      if (!imported) return "available";
+      if (!installedNames.has(imported.installedName)) return "missing_local";
+
+      const remoteUpdatedAt = skill.updatedAt ? Date.parse(skill.updatedAt) : Number.NaN;
+      const importedUpdatedAt = imported.updatedAt ? Date.parse(imported.updatedAt) : Number.NaN;
+      if (
+        Number.isFinite(remoteUpdatedAt) &&
+        (!Number.isFinite(importedUpdatedAt) || remoteUpdatedAt > importedUpdatedAt)
+      ) {
+        return "update";
+      }
+      return "installed";
+    },
+    [importedCloudSkills, installedNames],
+  );
+
+  const cloudOrgLabel = useMemo(() => {
+    denUiTick;
+    const name = readDenSettings().activeOrgName?.trim();
+    return name || t("skills.cloud_org_fallback");
+  }, [denUiTick]);
+
+  const cloudSessionReady = useMemo(() => {
+    denUiTick;
+    const settings = readDenSettings();
+    return Boolean(settings.authToken?.trim() && settings.activeOrgId?.trim());
+  }, [denUiTick]);
+
+  const cloudNeedsSignIn = useMemo(() => {
+    denUiTick;
+    return !readDenSettings().authToken?.trim();
+  }, [denUiTick]);
+
+  const sharePermissionOptions = useMemo<SelectMenuOption[]>(
+    () => [
+      { value: "private", label: t("skills.share_team_permission_private") },
+      { value: "org", label: t("skills.share_team_permission_org") },
+      ...shareManageableHubs.map((hub) => ({ value: hub.id, label: hub.name })),
+    ],
+    [shareManageableHubs],
+  );
+
+  const shareModalSubtitle = useMemo(() => {
+    switch (shareSubView) {
+      case "public":
+        return t("skills.share_subtitle_public");
+      case "team":
+        return t("skills.share_subtitle_team");
+      default:
+        return t("skills.share_chooser_subtitle");
+    }
+  }, [shareSubView]);
+
+  const activeHubRepoLabel = useMemo(
+    () => (hubRepo ? `${hubRepo.owner}/${hubRepo.repo}@${hubRepo.ref}` : t("skills.no_hub_repo_label")),
+    [hubRepo],
+  );
+
+  const hasDefaultHubRepo = useMemo(
+    () => hubRepos.some((repo) => `${repo.owner}/${repo.repo}@${repo.ref}` === "different-ai/openwork-hub@main"),
+    [hubRepos],
+  );
+
+  const showInstalledSection = activeFilter === "all" || activeFilter === "installed";
+  const showCloudSection = activeFilter === "all" || activeFilter === "cloud";
+  const showHubSection = activeFilter === "all" || activeFilter === "hub";
+  const canCreateInChat = !props.busy && (props.canInstallSkillCreator || props.canUseDesktopTools);
+
+  const resolveSharePermission = () => {
+    const choice = sharePermissionChoice.trim();
+    if (!choice || choice === "org") return { shared: "org" as const, hubId: null as string | null };
+    if (choice === "private") return { shared: null, hubId: null as string | null };
+    return { shared: null, hubId: choice };
+  };
+
+  const closeShareLink = useCallback(() => {
+    setShareTarget(null);
+    setShareSubView("chooser");
+    setShareBusy(false);
+    setShareUrl(null);
+    setShareError(null);
+    setShareTeamBusy(false);
+    setShareTeamError(null);
+    setShareTeamSuccess(null);
+    setSharePermissionChoice("org");
+    setShareHubsError(null);
+    setShareManageableHubs([]);
+  }, []);
+
+  const goBackShareSubView = useCallback(() => {
+    setShareSubView("chooser");
+    setShareError(null);
+    setShareTeamError(null);
+    setShareTeamSuccess(null);
+    setSharePermissionChoice("org");
+    setShareHubsError(null);
+  }, []);
+
+  const runDesktopAction = useCallback(
+    (action: () => void | Promise<void>) => {
+      if (props.busy) return;
+      if (!props.canUseDesktopTools) {
+        showToast(t("skills.desktop_required"), "warning");
+        return;
+      }
+      void Promise.resolve(action());
+    },
+    [props.busy, props.canUseDesktopTools, showToast],
+  );
+
+  const refreshCatalogs = useCallback(() => {
+    if (props.busy) return;
+    void extensions.refreshSkills({ force: true });
+    void extensions.refreshHubSkills({ force: true });
+    void extensions.refreshCloudOrgSkills({ force: true });
+  }, [extensions, props.busy]);
+
+  const installSkillCreator = useCallback(async () => {
+    if (props.busy || installingSkillCreator) return;
+    if (!props.canInstallSkillCreator) {
+      showToast(props.accessHint ?? t("skills.host_only_error"), "warning");
+      return;
+    }
+    setInstallingSkillCreator(true);
+    showToast(t("skills.installing_skill_creator"));
+    try {
+      const result = await extensions.installSkillCreator();
+      showToast(result.message, "success");
+    } catch (error) {
+      showToast(maskError(error), "error");
+    } finally {
+      setInstallingSkillCreator(false);
+    }
+  }, [extensions, installingSkillCreator, maskError, props.accessHint, props.busy, props.canInstallSkillCreator, showToast]);
+
+  const installFromCloud = useCallback(
+    async (skill: DenOrgSkillCard) => {
+      if (props.busy || installingCloudSkillId) return;
+      const state = cloudSkillInstallState(skill);
+      if (state === "installed") return;
+      setInstallingCloudSkillId(skill.id);
+      showToast(
+        t(state === "update" ? "skills.cloud_updating" : "skills.cloud_installing", undefined, { title: skill.title }),
+      );
+      try {
+        const result = await extensions.installCloudOrgSkill(skill);
+        showToast(result.message, result.ok ? "success" : "error");
+      } catch (error) {
+        showToast(maskError(error), "error");
+      } finally {
+        setInstallingCloudSkillId(null);
+      }
+    },
+    [cloudSkillInstallState, extensions, installingCloudSkillId, maskError, props.busy, showToast],
+  );
+
+  const installFromHub = useCallback(
+    async (skill: HubSkillCard) => {
+      if (props.busy || installingHubSkill) return;
+      setInstallingHubSkill(skill.name);
+      showToast(`${t("skills.installing_prefix")} ${skill.name}...`);
+      try {
+        const result = await extensions.installHubSkill(skill.name);
+        showToast(result.message, "success");
+      } catch (error) {
+        showToast(maskError(error), "error");
+      } finally {
+        setInstallingHubSkill(null);
+      }
+    },
+    [extensions, installingHubSkill, maskError, props.busy, showToast],
+  );
+
+  const handleNewSkill = useCallback(async () => {
+    if (props.busy) return;
+    if (props.canInstallSkillCreator && !skillCreatorInstalled) {
+      await installSkillCreator();
+    }
+    await Promise.resolve(props.createSessionAndOpen("/skill-creator"));
+  }, [installSkillCreator, props, skillCreatorInstalled]);
+
+  const openCloudSignIn = useCallback(() => {
+    const base = readDenSettings().baseUrl?.trim() || DEFAULT_DEN_BASE_URL;
+    props.onOpenLink(buildDenAuthUrl(base, "sign-in"));
+  }, [props]);
+
+  const openShareLink = useCallback(
+    (skill: SkillCard) => {
+      if (props.busy) return;
+      setShareTarget(skill);
+      setShareSubView("chooser");
+      setShareBusy(false);
+      setShareUrl(null);
+      setShareError(null);
+      setShareTeamBusy(false);
+      setShareTeamError(null);
+      setShareTeamSuccess(null);
+      setSharePermissionChoice("org");
+      setShareHubsError(null);
+      setShareManageableHubs([]);
+      setCloudSessionNonce((value) => value + 1);
+    },
+    [props.busy],
+  );
+
+  const startShareSkillSignIn = useCallback(() => {
+    const settings = readDenSettings();
+    props.onOpenLink(buildDenAuthUrl(settings.baseUrl, "sign-in"));
+  }, [props]);
+
+  const publishSkillToTeam = useCallback(async () => {
+    if (!shareTarget || props.busy || shareTeamBusy || shareTeamDisabledReason) return;
+    setShareTeamBusy(true);
+    setShareTeamError(null);
+    setShareTeamSuccess(null);
+    try {
+      const skill = await extensions.readSkill(shareTarget.name);
+      if (!skill) throw new Error("Failed to load skill");
+      const sharing = resolveSharePermission();
+      const { orgName, orgId } = await saveInstalledSkillToOpenWorkOrg({
+        skillText: skill.content,
+        shared: sharing.shared,
+        skillHubId: sharing.hubId,
+      });
+      setShareTeamSuccess(t("skills.share_team_uploaded_success", undefined, { org: orgName }));
+      window.dispatchEvent(
+        new CustomEvent<{ orgId: string }>("openwork-den-org-skills-changed", {
+          detail: { orgId },
+        }),
+      );
+      void extensions.refreshCloudOrgSkills({ force: true });
+    } catch (error) {
+      setShareTeamError(maskError(error));
+    } finally {
+      setShareTeamBusy(false);
+    }
+  }, [extensions, maskError, props.busy, shareTarget, shareTeamBusy, shareTeamDisabledReason]);
+
+  const publishShareLink = useCallback(async () => {
+    if (!shareTarget || props.busy || shareBusy) return;
+    setShareBusy(true);
+    setShareUrl(null);
+    setShareError(null);
+    try {
+      const skill = await extensions.readSkill(shareTarget.name);
+      if (!skill) throw new Error(t("skills.skill_load_failed"));
+      const payload: SkillBundleV1 = {
+        schemaVersion: 1,
+        type: "skill",
+        name: shareTarget.name,
+        content: skill.content,
+        description: shareTarget.description ?? undefined,
+        trigger: shareTarget.trigger ?? undefined,
+      };
+      const result = await publishOpenworkBundleJson({
+        payload,
+        bundleType: "skill",
+        name: shareTarget.name,
+      });
+      setShareUrl(result.url);
+      try {
+        await navigator.clipboard.writeText(result.url);
+        showToast(t("skills.link_copied"), "success");
+      } catch {
+        // ignore clipboard failures
+      }
+    } catch (error) {
+      setShareError(maskError(error));
+    } finally {
+      setShareBusy(false);
+    }
+  }, [extensions, maskError, props.busy, shareBusy, shareTarget, showToast]);
+
+  const copyShareLink = useCallback(async () => {
+    const url = shareUrl?.trim();
+    if (!url) return;
+    try {
+      await navigator.clipboard.writeText(url);
+      showToast(t("skills.link_copied"), "success");
+    } catch {
+      setShareError(t("skills.copy_link_failed"));
+    }
+  }, [shareUrl, showToast]);
+
+  const openSkill = useCallback(
+    async (skill: SkillCard) => {
+      if (props.busy) return;
+      setSelectedSkill(skill);
+      setSelectedContent("");
+      setSelectedDirty(false);
+      setSelectedError(null);
+      setSelectedLoading(true);
+      try {
+        const result = await extensions.readSkill(skill.name);
+        if (!result) {
+          setSelectedError(t("skills.skill_load_failed"));
+          return;
+        }
+        setSelectedContent(result.content);
+      } catch (error) {
+        setSelectedError(maskError(error));
+      } finally {
+        setSelectedLoading(false);
+      }
+    },
+    [extensions, maskError, props.busy],
+  );
+
+  const saveSelectedSkill = useCallback(async () => {
+    if (!selectedSkill || !selectedDirty) return;
+    setSelectedError(null);
+    try {
+      await Promise.resolve(
+        extensions.saveSkill({
+          name: selectedSkill.name,
+          content: selectedContent,
+          description: selectedSkill.description,
+        }),
+      );
+      setSelectedDirty(false);
+    } catch (error) {
+      setSelectedError(maskError(error));
+    }
+  }, [extensions, maskError, selectedContent, selectedDirty, selectedSkill]);
+
+  const selectHubRepo = useCallback(
+    (repo: HubSkillRepo) => {
+      void Promise.resolve(extensions.setHubRepo(repo)).then(() => {
+        void extensions.refreshHubSkills({ force: true });
+      });
+    },
+    [extensions],
+  );
+
+  const openCustomRepoModal = useCallback(() => {
+    if (props.busy) return;
+    setCustomRepoOpen(true);
+    setCustomRepoOwner(hubRepo?.owner ?? "");
+    setCustomRepoName(hubRepo?.repo ?? "");
+    setCustomRepoRef(hubRepo?.ref || "main");
+    setCustomRepoError(null);
+  }, [hubRepo, props.busy]);
+
+  const closeCustomRepoModal = useCallback(() => {
+    setCustomRepoOpen(false);
+    setCustomRepoError(null);
+  }, []);
+
+  const saveCustomRepo = useCallback(() => {
+    const owner = customRepoOwner.trim();
+    const repo = customRepoName.trim();
+    const ref = customRepoRef.trim() || "main";
+    if (!owner || !repo) {
+      setCustomRepoError(t("skills.owner_repo_required"));
+      return;
+    }
+    void Promise.resolve(extensions.addHubRepo({ owner, repo, ref })).then(() => {
+      void extensions.refreshHubSkills({ force: true });
+    });
+    closeCustomRepoModal();
+  }, [closeCustomRepoModal, customRepoName, customRepoOwner, customRepoRef, extensions]);
+
+  const isOpenworkInjectedSkill = (skill: SkillCard) => {
+    const normalizedName = skill.name.trim().toLowerCase();
+    const normalizedPath = skill.path.replace(/\\/g, "/").toLowerCase();
+    return normalizedPath.includes("/.opencode/skills/") &&
+      (OPENWORK_DEFAULT_SKILL_NAMES.has(normalizedName) || normalizedName.endsWith("-creator"));
+  };
+
+  const handleSkillCardKeyDown = (
+    event: ReactKeyboardEvent<HTMLDivElement>,
+    skill: SkillCard,
+  ) => {
+    if (event.key !== "Enter" && event.key !== " ") return;
+    event.preventDefault();
+    void openSkill(skill);
+  };
+
+  return (
+    <section className="space-y-8">
+      <div className="space-y-6">
+        <div className="flex flex-col gap-4 lg:flex-row lg:items-start lg:justify-between">
+          <div className="min-w-0">
+            {props.showHeader !== false ? <h2 className={pageTitleClass}>{t("skills.title")}</h2> : null}
+            <p className="mt-2 max-w-2xl text-[14px] leading-relaxed text-dls-secondary">
+              {t("skills.worker_profile_desc")}
+            </p>
+          </div>
+
+          <div className="flex flex-wrap gap-3 lg:justify-end">
+            <button
+              type="button"
+              onClick={() => runDesktopAction(extensions.importLocalSkill)}
+              disabled={props.busy || !props.canUseDesktopTools}
+              className={pillSecondaryClass}
+            >
+              <Upload size={14} />
+              {t("skills.import_local_skill")}
+            </button>
+            <button
+              type="button"
+              onClick={() => runDesktopAction(extensions.revealSkillsFolder)}
+              disabled={props.busy || !props.canUseDesktopTools}
+              className={pillSecondaryClass}
+            >
+              <FolderOpen size={14} />
+              {t("skills.reveal_folder")}
+            </button>
+            <button type="button" onClick={() => void handleNewSkill()} disabled={!canCreateInChat} className={pillPrimaryClass}>
+              <Sparkles size={14} />
+              {t("skills.create_in_chat")}
+            </button>
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-3 rounded-[20px] border border-dls-border bg-dls-surface p-4 md:flex-row md:items-center md:justify-between">
+          <div className="relative min-w-0 flex-1">
+            <Search size={16} className="pointer-events-none absolute left-4 top-1/2 -translate-y-1/2 text-dls-secondary" />
+            <input
+              type="text"
+              value={searchQuery}
+              onChange={(event) => setSearchQuery(event.currentTarget.value)}
+              placeholder={t("skills.catalog_search_placeholder")}
+              className="w-full rounded-xl border border-dls-border bg-dls-surface py-3 pl-11 pr-4 text-[14px] text-dls-text focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.12)]"
+            />
+          </div>
+
+          <div className="flex flex-wrap items-center gap-2">
+            {(["all", "installed", "cloud", "hub"] as SkillsFilter[]).map((filter) => (
+              <button
+                key={filter}
+                type="button"
+                onClick={() => setActiveFilter(filter)}
+                className={activeFilter === filter ? pillPrimaryClass : pillGhostClass}
+              >
+                {filter === "all"
+                  ? t("skills.filter_all")
+                  : filter === "installed"
+                    ? t("skills.filter_installed")
+                    : filter === "cloud"
+                      ? t("skills.filter_cloud")
+                      : t("skills.filter_hub")}
+              </button>
+            ))}
+            <button type="button" onClick={refreshCatalogs} disabled={props.busy} className={pillSecondaryClass}>
+              <RefreshCw size={14} />
+              {t("common.refresh")}
+            </button>
+          </div>
+        </div>
+      </div>
+
+      {props.accessHint ? (
+        <div className="rounded-[20px] border border-dls-border bg-dls-hover px-5 py-4 text-[13px] text-dls-secondary">
+          {props.accessHint}
+        </div>
+      ) : null}
+      {!props.accessHint && !props.canInstallSkillCreator && !props.canUseDesktopTools ? (
+        <div className="rounded-[20px] border border-dls-border bg-dls-hover px-5 py-4 text-[13px] text-dls-secondary">
+          {t("skills.host_mode_only")}
+        </div>
+      ) : null}
+
+      {skillsStatus ? (
+        <div className="whitespace-pre-wrap break-words rounded-[20px] border border-dls-border bg-dls-hover px-5 py-4 text-[13px] text-dls-secondary">
+          {skillsStatus}
+        </div>
+      ) : null}
+
+      {showInstalledSection ? (
+        <div className="space-y-4">
+          <div className="flex items-end justify-between gap-3">
+            <div>
+              <h3 className={sectionTitleClass}>{t("skills.installed")}</h3>
+              <p className="mt-1 text-[13px] text-dls-secondary">{t("skills.installed_desc")}</p>
+            </div>
+            <div className="text-[12px] text-dls-secondary">{t("skills.shown_count", undefined, { count: filteredSkills.length })}</div>
+          </div>
+
+          {filteredSkills.length === 0 ? (
+            <div className="rounded-[20px] border border-dashed border-dls-border bg-dls-surface px-5 py-8 text-[14px] text-dls-secondary">
+              {t("skills.no_skills")}
+            </div>
+          ) : (
+            <div className="rounded-[24px] bg-dls-hover p-4">
+              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                {filteredSkills.map((skill) => (
+                  <div
+                    key={skill.path}
+                    role="button"
+                    tabIndex={0}
+                    className={`${panelCardClass} flex cursor-pointer flex-col gap-4 text-left`}
+                    onClick={() => void openSkill(skill)}
+                    onKeyDown={(event) => handleSkillCardKeyDown(event, skill)}
+                  >
+                    <div className="flex min-w-0 gap-4">
+                      <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-dls-border bg-dls-hover">
+                        <Package size={20} className="text-dls-secondary" />
+                      </div>
+                      <div className="min-w-0 flex-1">
+                        <div className="flex flex-wrap items-center gap-2">
+                          <h4 className="truncate text-[14px] font-semibold text-dls-text">{skill.name}</h4>
+                          {isOpenworkInjectedSkill(skill) ? <span className={tagClass}>OpenWork</span> : null}
+                        </div>
+                        <p className="mt-2 line-clamp-2 text-[13px] leading-relaxed text-dls-secondary">
+                          {skill.description || t("skills.no_description")}
+                        </p>
+                      </div>
+                    </div>
+
+                    <div className="flex flex-wrap items-center justify-between gap-3 border-t border-dls-border pt-4">
+                      <span className={tagClass}>{t("skills.installed_status")}</span>
+                      <div className="flex flex-wrap gap-2">
+                        <button
+                          type="button"
+                          className={pillGhostClass}
+                          onClick={(event) => {
+                            event.preventDefault();
+                            event.stopPropagation();
+                            openShareLink(skill);
+                          }}
+                          disabled={props.busy}
+                          title={t("skills.share_title")}
+                        >
+                          <Share2 size={14} />
+                          {t("skills.share_title")}
+                        </button>
+                        <button
+                          type="button"
+                          className={pillSecondaryClass}
+                          onClick={(event) => {
+                            event.preventDefault();
+                            event.stopPropagation();
+                            void openSkill(skill);
+                          }}
+                          disabled={props.busy}
+                          title={t("common.edit")}
+                        >
+                          <Edit2 size={14} />
+                          {t("common.edit")}
+                        </button>
+                        <button
+                          type="button"
+                          className={pillGhostClass}
+                          onClick={(event) => {
+                            event.preventDefault();
+                            event.stopPropagation();
+                            if (props.busy || !props.canUseDesktopTools) {
+                              if (!props.canUseDesktopTools) showToast(t("skills.desktop_required"), "warning");
+                              return;
+                            }
+                            setUninstallTarget(skill);
+                          }}
+                          disabled={props.busy || !props.canUseDesktopTools}
+                          title={t("skills.uninstall")}
+                        >
+                          <Trash2 size={14} />
+                          {t("common.remove")}
+                        </button>
+                      </div>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+        </div>
+      ) : null}
+
+      {showCloudSection ? (
+        <div className="space-y-4">
+          <div className="flex flex-col gap-3 lg:flex-row lg:items-end lg:justify-between">
+            <div>
+              <p className="mb-0.5 text-[12px] text-dls-secondary">{cloudOrgLabel}</p>
+              <h3 className={sectionTitleClass}>{t("skills.cloud_section_title")}</h3>
+              <p className="mt-1 max-w-2xl text-[13px] leading-relaxed text-dls-secondary">
+                {t("skills.cloud_section_subtitle")}
+              </p>
+            </div>
+            <div className="flex flex-wrap items-center gap-2">
+              <button
+                type="button"
+                onClick={() => void extensions.refreshCloudOrgSkills({ force: true })}
+                disabled={props.busy}
+                className={pillSecondaryClass}
+              >
+                <RefreshCw size={14} />
+                {t("skills.cloud_refresh")}
+              </button>
+            </div>
+          </div>
+
+          {!cloudSessionReady ? (
+            <div className="rounded-[20px] border border-dashed border-dls-border bg-dls-surface px-5 py-6 text-[14px] text-dls-secondary">
+              {cloudNeedsSignIn ? (
+                <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                  <p>{t("skills.cloud_sign_in_hint")}</p>
+                  <button type="button" className={pillPrimaryClass} onClick={openCloudSignIn}>
+                    {t("skills.cloud_sign_in")}
+                  </button>
+                </div>
+              ) : (
+                <div className="space-y-3">
+                  <p>{t("skills.cloud_choose_org_hint")}</p>
+                  <p className="text-[13px]">{t("skills.cloud_choose_org_detail")}</p>
+                </div>
+              )}
+            </div>
+          ) : (
+            <>
+              {cloudOrgSkillsStatus ? (
+                <div className="whitespace-pre-wrap break-words rounded-[20px] border border-dls-border bg-dls-hover px-5 py-4 text-[13px] text-dls-secondary">
+                  {cloudOrgSkillsStatus}
+                </div>
+              ) : null}
+
+              {filteredCloudOrgSkills.length === 0 ? (
+                <div className="rounded-[20px] border border-dashed border-dls-border bg-dls-surface px-5 py-8 text-[14px] text-dls-secondary">
+                  {cloudOrgSkills.length === 0 ? t("skills.cloud_org_empty") : t("skills.cloud_no_search_matches")}
+                </div>
+              ) : (
+                <div className="rounded-[24px] bg-dls-hover p-4">
+                  <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                    {filteredCloudOrgSkills.map((skill) => {
+                      const state = cloudSkillInstallState(skill);
+                      const installedName = importedCloudSkills[skill.id]?.installedName ?? null;
+                      return (
+                        <div key={skill.id} className={`${panelCardClass} flex flex-col gap-4 text-left`}>
+                          <div className="flex min-w-0 gap-4">
+                            <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-dls-border bg-dls-hover">
+                              <Cloud size={20} className="text-dls-secondary" />
+                            </div>
+                            <div className="min-w-0 flex-1">
+                              <h4 className="truncate text-[14px] font-semibold text-dls-text">{skill.title}</h4>
+                              {skill.description ? (
+                                <p className="mt-2 line-clamp-2 text-[13px] leading-relaxed text-dls-secondary">{skill.description}</p>
+                              ) : null}
+                              <div className="mt-3 flex flex-wrap items-center gap-2 text-[11px] text-dls-secondary">
+                                {skill.hubName ? <span className={tagClass}>{t("skills.cloud_hub_label", undefined, { name: skill.hubName })}</span> : null}
+                                {skill.shared === "org" ? <span className={tagClass}>{t("skills.cloud_shared_org")}</span> : null}
+                                {skill.shared === "public" ? <span className={tagClass}>{t("skills.cloud_shared_public")}</span> : null}
+                                {skill.shared === null && !skill.hubName ? <span className={tagClass}>{t("skills.cloud_shared_private")}</span> : null}
+                                {installedName ? <span className={tagClass}>{t("skills.cloud_installed_as", undefined, { name: installedName })}</span> : null}
+                                {state === "installed" ? <span className={tagClass}>{t("skills.cloud_status_installed")}</span> : null}
+                                {state === "update" ? <span className={tagClass}>{t("skills.cloud_status_update")}</span> : null}
+                              </div>
+                            </div>
+                          </div>
+
+                          <div className="flex items-center justify-between gap-3 border-t border-dls-border pt-4">
+                            <span className={tagClass}>{t("skills.cloud_footer_label")}</span>
+                            <button
+                              type="button"
+                              className={installingCloudSkillId === skill.id || state === "installed" ? pillSecondaryClass : pillPrimaryClass}
+                              onClick={(event) => {
+                                event.preventDefault();
+                                event.stopPropagation();
+                                void installFromCloud(skill);
+                              }}
+                              disabled={props.busy || installingCloudSkillId === skill.id || state === "installed"}
+                            >
+                              {installingCloudSkillId === skill.id ? <Loader2 size={14} className="animate-spin" /> : <Plus size={14} />}
+                              {installingCloudSkillId === skill.id
+                                ? t("skills.cloud_installing_short")
+                                : state === "update"
+                                  ? t("skills.cloud_update_skill")
+                                  : state === "installed"
+                                    ? t("skills.cloud_status_installed")
+                                    : t("skills.install")}
+                            </button>
+                          </div>
+                        </div>
+                      );
+                    })}
+                  </div>
+                </div>
+              )}
+            </>
+          )}
+        </div>
+      ) : null}
+
+      {showHubSection ? (
+        <div className="space-y-4">
+          <div className="flex flex-col gap-3 lg:flex-row lg:items-end lg:justify-between">
+            <div>
+              <h3 className={sectionTitleClass}>{t("skills.available_from_hub")}</h3>
+              <p className="mt-1 text-[13px] text-dls-secondary">{t("skills.hub_desc")}</p>
+            </div>
+            <div className="flex flex-wrap items-center gap-2">
+              <button
+                type="button"
+                onClick={() => {
+                  void Promise.resolve(extensions.addHubRepo({ owner: "different-ai", repo: "openwork-hub", ref: "main" })).then(() => {
+                    void extensions.refreshHubSkills({ force: true });
+                  });
+                }}
+                className={pillGhostClass}
+                disabled={props.busy || hasDefaultHubRepo}
+              >
+                <Plus size={14} />
+                {t("skills.add_openwork_hub")}
+              </button>
+              <button type="button" onClick={openCustomRepoModal} disabled={props.busy} className={pillSecondaryClass}>
+                <Plus size={14} />
+                {t("skills.add_git_repo")}
+              </button>
+              <button
+                type="button"
+                onClick={() => void extensions.refreshHubSkills({ force: true })}
+                disabled={props.busy}
+                className={pillSecondaryClass}
+              >
+                <RefreshCw size={14} />
+                {t("skills.refresh_hub")}
+              </button>
+            </div>
+          </div>
+
+          <div className="space-y-3 rounded-[20px] border border-dls-border bg-dls-surface p-4">
+            <div className="text-[12px] text-dls-secondary">
+              {t("skills.source_label")}: <span className="font-mono text-dls-text">{activeHubRepoLabel}</span>
+            </div>
+            <div className="flex flex-wrap items-center gap-2">
+              {hubRepos.map((repo) => {
+                const key = `${repo.owner}/${repo.repo}@${repo.ref}`;
+                const active = hubRepo ? key === `${hubRepo.owner}/${hubRepo.repo}@${hubRepo.ref}` : false;
+                return (
+                  <div key={key} className="inline-flex items-center overflow-hidden rounded-full border border-dls-border bg-dls-surface">
+                    <button
+                      type="button"
+                      onClick={() => selectHubRepo(repo)}
+                      className={`px-3 py-1.5 text-[12px] font-medium transition-colors ${
+                        active ? "bg-dls-accent text-white" : "text-dls-secondary hover:bg-dls-hover hover:text-dls-text"
+                      }`}
+                      disabled={props.busy}
+                    >
+                      {key}
+                    </button>
+                    <button
+                      type="button"
+                      className="px-2 py-1.5 text-[12px] text-dls-secondary transition-colors hover:bg-dls-hover hover:text-red-11"
+                      onClick={() => {
+                        void Promise.resolve(extensions.removeHubRepo(repo)).then(() => {
+                          void extensions.refreshHubSkills({ force: true });
+                        });
+                      }}
+                      disabled={props.busy}
+                      title={t("skills.remove_saved_repo")}
+                    >
+                      ×
+                    </button>
+                  </div>
+                );
+              })}
+            </div>
+          </div>
+
+          {hubSkillsStatus ? (
+            <div className="whitespace-pre-wrap break-words rounded-[20px] border border-dls-border bg-dls-hover px-5 py-4 text-[13px] text-dls-secondary">
+              {hubSkillsStatus}
+            </div>
+          ) : null}
+
+          {filteredHubSkills.length === 0 ? (
+            <div className="rounded-[20px] border border-dashed border-dls-border bg-dls-surface px-5 py-8 text-[14px] text-dls-secondary">
+              {hubRepo ? t("skills.no_hub_skills") : t("skills.no_hub_repo_selected")}
+            </div>
+          ) : (
+            <div className="rounded-[24px] bg-dls-hover p-4">
+              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                {filteredHubSkills.map((skill) => (
+                  <div key={`${skill.source.owner}/${skill.source.repo}/${skill.name}`} className={`${panelCardClass} flex flex-col gap-4 text-left`}>
+                    <div className="flex min-w-0 gap-4">
+                      <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-dls-border bg-dls-hover">
+                        <Package size={20} className="text-dls-secondary" />
+                      </div>
+                      <div className="min-w-0 flex-1">
+                        <h4 className="truncate text-[14px] font-semibold text-dls-text">{skill.name}</h4>
+                        <p className="mt-2 line-clamp-2 text-[13px] leading-relaxed text-dls-secondary">
+                          {skill.description || t("skills.from_repo", undefined, { owner: skill.source.owner, repo: skill.source.repo })}
+                        </p>
+                        <div className="mt-3 flex flex-wrap items-center gap-2 text-[11px] text-dls-secondary">
+                          <span className={`${tagClass} font-mono`}>{skill.source.owner}/{skill.source.repo}</span>
+                          {skill.trigger ? (
+                            <span className={tagClass} title={t("skills.trigger_label", undefined, { trigger: skill.trigger })}>
+                              {t("skills.trigger_label", undefined, { trigger: skill.trigger })}
+                            </span>
+                          ) : null}
+                        </div>
+                      </div>
+                    </div>
+
+                    <div className="flex items-center justify-between gap-3 border-t border-dls-border pt-4">
+                      <span className={tagClass}>{t("skills.hub_label")}</span>
+                      <button
+                        type="button"
+                        className={installingHubSkill === skill.name ? pillSecondaryClass : pillPrimaryClass}
+                        onClick={(event) => {
+                          event.preventDefault();
+                          event.stopPropagation();
+                          void installFromHub(skill);
+                        }}
+                        disabled={props.busy || installingHubSkill === skill.name}
+                        title={t("skills.install_name_title", undefined, { name: skill.name })}
+                      >
+                        {installingHubSkill === skill.name ? <Loader2 size={14} className="animate-spin" /> : <Plus size={14} />}
+                        {installingHubSkill === skill.name ? t("skills.installing") : t("common.add")}
+                      </button>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          )}
+        </div>
+      ) : null}
+
+      {selectedSkill ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4 backdrop-blur-sm">
+          <div className="w-full max-w-4xl overflow-hidden rounded-2xl border border-dls-border bg-dls-surface shadow-2xl">
+            <div className="flex items-center justify-between gap-3 border-b border-dls-border px-5 py-4">
+              <div className="min-w-0">
+                <div className="truncate text-sm font-semibold text-dls-text">{selectedSkill.name}</div>
+              </div>
+              <div className="flex items-center gap-2">
+                <button
+                  type="button"
+                  className={`rounded-lg px-3 py-1.5 text-xs font-medium transition-colors ${
+                    selectedDirty && !props.busy ? "bg-dls-text text-dls-surface hover:opacity-90" : "bg-dls-active text-dls-secondary"
+                  }`}
+                  disabled={!selectedDirty || props.busy}
+                  onClick={() => void saveSelectedSkill()}
+                >
+                  {t("common.save")}
+                </button>
+                <button
+                  type="button"
+                  className="rounded-lg bg-dls-hover px-3 py-1.5 text-xs font-medium text-dls-text transition-colors hover:bg-dls-active"
+                  onClick={() => {
+                    setSelectedSkill(null);
+                    setSelectedContent("");
+                    setSelectedDirty(false);
+                    setSelectedError(null);
+                    setSelectedLoading(false);
+                  }}
+                >
+                  {t("common.close")}
+                </button>
+              </div>
+            </div>
+
+            <div className="p-5">
+              {selectedError ? <div className="mb-3 rounded-xl border border-red-7/20 bg-red-1/40 px-4 py-3 text-xs text-red-12">{selectedError}</div> : null}
+              {selectedLoading ? (
+                <div className="text-xs text-dls-secondary">{t("skills.loading")}</div>
+              ) : (
+                <textarea
+                  value={selectedContent}
+                  onChange={(event) => {
+                    setSelectedContent(event.currentTarget.value);
+                    setSelectedDirty(true);
+                  }}
+                  className="min-h-[420px] w-full rounded-xl border border-dls-border bg-dls-hover px-4 py-3 text-xs font-mono text-dls-text focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.25)]"
+                  spellCheck={false}
+                />
+              )}
+            </div>
+          </div>
+        </div>
+      ) : null}
+
+      <ConfirmModal
+        open={Boolean(uninstallTarget)}
+        title={t("skills.uninstall_title")}
+        message={t("skills.uninstall_warning").replace("{name}", uninstallTarget?.name ?? "")}
+        confirmLabel={t("skills.uninstall")}
+        cancelLabel={t("common.cancel")}
+        confirmButtonVariant="danger"
+        onCancel={() => setUninstallTarget(null)}
+        onConfirm={() => {
+          const target = uninstallTarget;
+          setUninstallTarget(null);
+          if (!target) return;
+          void extensions.uninstallSkill(target.name);
+        }}
+      />
+
+      {shareTarget ? (
+        <div className={`${modalOverlayClass} items-start pt-[10vh]`}>
+          <div className={`${modalShellClass} max-h-[78vh] max-w-md`} role="dialog" aria-modal="true">
+            <div className={modalHeaderClass}>
+              <div className="flex min-w-0 items-start gap-3">
+                {shareSubView !== "chooser" ? (
+                  <button type="button" onClick={goBackShareSubView} className={modalHeaderButtonClass} aria-label={t("skills.share_back")}>
+                    <ArrowLeft size={16} />
+                  </button>
+                ) : null}
+                <div className="min-w-0">
+                  <div className="flex flex-wrap items-center gap-2">
+                    <h2 className={modalTitleClass}>{t("skills.share_title")}</h2>
+                    {shareSubView === "chooser" ? <span className={tagClass}>{shareTarget.name}</span> : null}
+                  </div>
+                  <p className={modalSubtitleClass}>{shareModalSubtitle}</p>
+                </div>
+              </div>
+              <button type="button" onClick={closeShareLink} className={modalHeaderButtonClass} aria-label={t("skills.share_close")} title={t("skills.share_close")}>
+                <X size={16} />
+              </button>
+            </div>
+
+            <div className="flex-1 overflow-y-auto px-6 pb-7 pt-2">
+              {shareSubView === "chooser" ? (
+                <div className="animate-in space-y-4 fade-in slide-in-from-bottom-3 duration-300">
+                  <WorkspaceOptionCard
+                    title={t("skills.share_option_team_title")}
+                    description={t("skills.share_option_team_desc")}
+                    icon={Users}
+                    onClick={() => setShareSubView("team")}
+                  />
+                  <WorkspaceOptionCard
+                    title={t("skills.share_option_public_title")}
+                    description={t("skills.share_option_public_desc")}
+                    icon={Rocket}
+                    onClick={() => setShareSubView("public")}
+                  />
+                </div>
+              ) : null}
+
+              {shareSubView === "public" ? (
+                <div className="animate-in space-y-5 pt-2 fade-in slide-in-from-right-4 duration-300">
+                  <p className="text-[14px] leading-relaxed text-dls-secondary">{t("skills.share_public_intro")}</p>
+                  <div className={surfaceCardClass}>
+                    <div className="mb-3 break-all font-mono text-[12px] text-dls-secondary">
+                      {t("skills.share_publisher_label")}: {DEFAULT_OPENWORK_PUBLISHER_BASE_URL}
+                    </div>
+                    {shareError ? <div className={`mb-3 ${modalNoticeErrorClass}`}>{shareError}</div> : null}
+                    {!shareUrl ? (
+                      <button type="button" onClick={() => void publishShareLink()} disabled={shareBusy || props.busy} className={`${pillPrimaryClass} w-full`}>
+                        {shareBusy ? t("skills.share_public_creating") : t("skills.share_public_create")}
+                      </button>
+                    ) : (
+                      <>
+                        <div className="flex items-center gap-2">
+                          <input type="text" readOnly value={shareUrl} className={`${inputClass} flex-1 font-mono text-[12px]`} />
+                          <button type="button" onClick={() => void copyShareLink()} className={pillSecondaryClass}>
+                            <Copy size={14} className="mr-1 inline" />
+                            {t("skills.share_copy_link")}
+                          </button>
+                        </div>
+                        <button type="button" onClick={() => void publishShareLink()} disabled={shareBusy} className={`${pillSecondaryClass} mt-3 w-full`}>
+                          {shareBusy ? t("skills.share_public_creating") : t("skills.share_public_regenerate")}
+                        </button>
+                      </>
+                    )}
+                  </div>
+                  <div className="flex justify-end">
+                    <button type="button" onClick={closeShareLink} className={pillSecondaryClass}>
+                      {t("skills.share_done")}
+                    </button>
+                  </div>
+                </div>
+              ) : null}
+
+              {shareSubView === "team" ? (
+                <div className="animate-in space-y-5 pt-2 fade-in slide-in-from-right-4 duration-300">
+                  <p className="text-[14px] leading-relaxed text-dls-secondary">{t("skills.share_team_permissions_intro")}</p>
+                  <div className={surfaceCardClass}>
+                    <div className="flex flex-wrap items-center gap-2">
+                      <span className={tagClass}>{shareTeamOrgLabel}</span>
+                    </div>
+                    {shareTeamError?.trim() ? <div className={`mt-4 ${modalNoticeErrorClass}`}>{shareTeamError}</div> : null}
+                    {shareTeamSuccess?.trim() ? <div className={`mt-4 ${modalNoticeSuccessClass}`}>{shareTeamSuccess}</div> : null}
+                    {shareHubsError?.trim() ? <div className={`mt-4 ${modalNoticeErrorClass}`}>{shareHubsError}</div> : null}
+                    {shareCloudSignedIn && shareTeamDisabledReason?.trim() ? (
+                      <div className="mt-4 text-[12px] text-dls-secondary">{shareTeamDisabledReason}</div>
+                    ) : null}
+                    {shareCloudSignedIn ? (
+                      <div className="mt-4">
+                        <span id="skills-share-hub-label" className="mb-1.5 block text-[13px] font-medium text-dls-text">
+                          {t("skills.share_team_permissions_label")}
+                        </span>
+                        <SelectMenu
+                          ariaLabelledBy="skills-share-hub-label"
+                          options={sharePermissionOptions}
+                          value={sharePermissionChoice}
+                          onChange={setSharePermissionChoice}
+                          disabled={shareTeamBusy || Boolean(shareTeamSuccess?.trim())}
+                        />
+                      </div>
+                    ) : null}
+                    {shareCloudSignedIn && shareHubsLoading ? (
+                      <div className="mt-3 flex items-center gap-2 text-[12px] text-dls-secondary">
+                        <Loader2 size={14} className="animate-spin" />
+                        {t("skills.share_team_hubs_loading")}
+                      </div>
+                    ) : null}
+                    <button
+                      type="button"
+                      onClick={() => {
+                        if (!shareCloudSignedIn) {
+                          startShareSkillSignIn();
+                          return;
+                        }
+                        void publishSkillToTeam();
+                      }}
+                      disabled={shareCloudSignedIn ? Boolean(shareTeamDisabledReason) || shareTeamBusy || Boolean(shareTeamSuccess?.trim()) : false}
+                      className={`${pillPrimaryClass} mt-4 w-full`}
+                    >
+                      {!shareCloudSignedIn
+                        ? t("skills.share_team_sign_in")
+                        : shareTeamBusy
+                          ? t("skills.share_team_uploading")
+                          : t("skills.share_team_upload_and_save")}
+                    </button>
+                    {!shareCloudSignedIn ? <p className="mt-3 text-[12px] text-dls-secondary">{t("skills.share_team_sign_in_hint")}</p> : null}
+                  </div>
+                  <div className="flex justify-end">
+                    <button type="button" onClick={closeShareLink} className={pillSecondaryClass}>
+                      {t("skills.share_done")}
+                    </button>
+                  </div>
+                </div>
+              ) : null}
+            </div>
+          </div>
+        </div>
+      ) : null}
+
+      {customRepoOpen ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/20 p-4 backdrop-blur-sm">
+          <div className="w-full max-w-lg overflow-hidden rounded-2xl border border-dls-border bg-dls-surface shadow-2xl">
+            <div className="space-y-4 p-6">
+              <div>
+                <h3 className="text-lg font-semibold text-dls-text">{t("skills.add_custom_repo")}</h3>
+                <p className="mt-1 text-sm text-dls-secondary">{t("skills.github_repo_hint")}</p>
+              </div>
+
+              <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+                <label className="space-y-1">
+                  <div className="text-xs font-semibold uppercase tracking-widest text-dls-secondary">{t("skills.owner_label")}</div>
+                  <input
+                    type="text"
+                    value={customRepoOwner}
+                    onChange={(event) => setCustomRepoOwner(event.currentTarget.value)}
+                    placeholder="different-ai"
+                    className="w-full rounded-lg border border-dls-border bg-dls-hover px-3 py-2 text-xs font-mono text-dls-text focus:outline-none"
+                    spellCheck={false}
+                  />
+                </label>
+                <label className="space-y-1">
+                  <div className="text-xs font-semibold uppercase tracking-widest text-dls-secondary">{t("skills.repo_label")}</div>
+                  <input
+                    type="text"
+                    value={customRepoName}
+                    onChange={(event) => setCustomRepoName(event.currentTarget.value)}
+                    placeholder="openwork-hub"
+                    className="w-full rounded-lg border border-dls-border bg-dls-hover px-3 py-2 text-xs font-mono text-dls-text focus:outline-none"
+                    spellCheck={false}
+                  />
+                </label>
+              </div>
+
+              <label className="space-y-1">
+                <div className="text-xs font-semibold uppercase tracking-widest text-dls-secondary">{t("skills.ref_label")}</div>
+                <input
+                  type="text"
+                  value={customRepoRef}
+                  onChange={(event) => setCustomRepoRef(event.currentTarget.value)}
+                  placeholder="main"
+                  className="w-full rounded-lg border border-dls-border bg-dls-hover px-3 py-2 text-xs font-mono text-dls-text focus:outline-none"
+                  spellCheck={false}
+                />
+              </label>
+
+              {customRepoError ? <div className="rounded-xl border border-red-7/20 bg-red-1/40 px-4 py-3 text-xs text-red-12">{customRepoError}</div> : null}
+
+              <div className="flex justify-end gap-2">
+                <Button variant="outline" onClick={closeCustomRepoModal} disabled={props.busy}>
+                  {t("common.cancel")}
+                </Button>
+                <Button variant="secondary" onClick={saveCustomRepo} disabled={props.busy}>
+                  {t("skills.save_and_load")}
+                </Button>
+              </div>
+            </div>
+          </div>
+        </div>
+      ) : null}
+    </section>
+  );
+}
+
+export default SkillsView;
diff --git a/apps/app/src/react-app/domains/settings/pages/updates-view.tsx b/apps/app/src/react-app/domains/settings/pages/updates-view.tsx
new file mode 100644
index 0000000000..49c7bafbe6
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/pages/updates-view.tsx
@@ -0,0 +1,252 @@
+/** @jsxImportSource react */
+import { formatBytes, formatRelativeTime, isTauriRuntime } from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import type { ReleaseChannel } from "../../../../app/types";
+import { Button } from "../../../design-system/button";
+import type { SettingsUpdateStatus } from "../state/electron-updater-state";
+
+const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+
+export type UpdatesViewProps = {
+  busy: boolean;
+  webDeployment: boolean;
+  appVersion: string | null;
+  updateEnv: { supported?: boolean; reason?: string | null } | null;
+  updateAutoCheck: boolean;
+  toggleUpdateAutoCheck: () => void;
+  updateAutoDownload: boolean;
+  toggleUpdateAutoDownload: () => void;
+  updateStatus: SettingsUpdateStatus;
+  anyActiveRuns: boolean;
+  checkForUpdates: () => void | Promise<void>;
+  downloadUpdate: () => void | Promise<void>;
+  installUpdateAndRestart: () => void | Promise<void>;
+  /** Currently selected release channel. Optional; callers may omit. */
+  releaseChannel?: ReleaseChannel;
+  /**
+   * Change the release channel. When not provided, the channel row is
+   * rendered read-only — useful for contexts where the pref can't be
+   * mutated (e.g. web preview).
+   */
+  onReleaseChannelChange?: (next: ReleaseChannel) => void;
+  /**
+   * Whether the alpha channel is available on this platform. Alpha is
+   * macOS-only today; other platforms should receive `false` so the
+   * toggle is hidden.
+   */
+  alphaChannelSupported?: boolean;
+};
+
+export function UpdatesView(props: UpdatesViewProps) {
+  const updateState = props.updateStatus?.state ?? "idle";
+  const updateVersion = props.updateStatus?.version ?? null;
+  const updateDate = props.updateStatus?.date ?? null;
+  const updateLastCheckedAt = props.updateStatus?.lastCheckedAt ?? null;
+  const updateDownloadedBytes = props.updateStatus?.downloadedBytes ?? null;
+  const updateTotalBytes = props.updateStatus?.totalBytes ?? null;
+  const updateErrorMessage = props.updateStatus?.message ?? null;
+  const updateNotes = props.updateStatus?.notes ?? null;
+
+  const updateRestartBlockedMessage =
+    updateState === "ready" && props.anyActiveRuns
+      ? t("settings.restart_blocked_message")
+      : null;
+
+  return (
+    <div className="space-y-6">
+      <div className={`${settingsPanelClass} space-y-3`}>
+        <div className="flex items-start justify-between gap-4">
+          <div>
+            <div className="text-sm font-medium text-gray-12">{t("settings.updates_title")}</div>
+            <div className="text-xs text-gray-10">{t("settings.updates_desc")}</div>
+          </div>
+          <div className="font-mono text-xs text-gray-7">{props.appVersion ? `v${props.appVersion}` : ""}</div>
+        </div>
+
+        {props.webDeployment ? (
+          <div className="rounded-xl border border-gray-6 bg-gray-1/20 p-3 text-sm text-gray-11">
+            {t("settings.updates_desktop_only")}
+          </div>
+        ) : props.updateEnv && props.updateEnv.supported === false ? (
+          <div className="rounded-xl border border-gray-6 bg-gray-1/20 p-3 text-sm text-gray-11">
+            {props.updateEnv.reason ?? t("settings.updates_not_supported")}
+          </div>
+        ) : (
+          <>
+            {props.alphaChannelSupported && props.releaseChannel ? (
+              <div className="flex items-center justify-between rounded-xl border border-gray-6 bg-gray-1 p-3">
+                <div className="space-y-0.5">
+                  <div className="text-sm text-gray-12">Release channel</div>
+                  <div className="text-xs text-gray-7">
+                    Stable is the default. Alpha auto-updates from every merge to{" "}
+                    <code className="rounded bg-gray-2 px-1 py-0.5 text-[11px]">dev</code>{" "}
+                    (macOS only).
+                  </div>
+                </div>
+                <div className="flex items-center gap-1 rounded-full border border-gray-6/60 bg-gray-1/70 p-0.5 text-xs">
+                  {(["stable", "alpha"] as const).map((value) => {
+                    const active = props.releaseChannel === value;
+                    return (
+                      <button
+                        key={value}
+                        type="button"
+                        className={`rounded-full px-3 py-1 font-medium transition-colors ${
+                          active
+                            ? "bg-gray-12/12 text-gray-12 shadow-[inset_0_1px_0_rgba(255,255,255,0.5)]"
+                            : "text-gray-10 hover:bg-gray-2/70 hover:text-gray-12"
+                        } ${!props.onReleaseChannelChange ? "cursor-default opacity-70" : ""}`}
+                        onClick={() => props.onReleaseChannelChange?.(value)}
+                        disabled={!props.onReleaseChannelChange}
+                      >
+                        {value === "stable" ? "Stable" : "Alpha"}
+                      </button>
+                    );
+                  })}
+                </div>
+              </div>
+            ) : null}
+            <div className="flex items-center justify-between rounded-xl border border-gray-6 bg-gray-1 p-3">
+              <div className="space-y-0.5">
+                <div className="text-sm text-gray-12">{t("settings.background_checks_title")}</div>
+                <div className="text-xs text-gray-7">{t("settings.background_checks_desc")}</div>
+              </div>
+              <button
+                type="button"
+                className={`min-w-[70px] rounded-full border px-4 py-1.5 text-xs font-medium shadow-[inset_0_1px_0_rgba(255,255,255,0.5)] transition-colors ${
+                  props.updateAutoCheck
+                    ? "border-gray-6/30 bg-gray-12/12 text-gray-12"
+                    : "border-gray-6/60 bg-gray-1/70 text-gray-10 hover:bg-gray-2/70 hover:text-gray-12"
+                }`}
+                onClick={props.toggleUpdateAutoCheck}
+              >
+                {props.updateAutoCheck ? t("settings.on") : t("settings.off")}
+              </button>
+            </div>
+
+            <div className="flex items-center justify-between rounded-xl border border-gray-6 bg-gray-1 p-3">
+              <div className="space-y-0.5">
+                <div className="text-sm text-gray-12">{t("settings.auto_update_title")}</div>
+                <div className="text-xs text-gray-7">{t("settings.auto_update_desc")}</div>
+              </div>
+              <button
+                type="button"
+                className={`min-w-[70px] rounded-full border px-4 py-1.5 text-xs font-medium shadow-[inset_0_1px_0_rgba(255,255,255,0.5)] transition-colors ${
+                  props.updateAutoDownload
+                    ? "border-gray-6/30 bg-gray-12/12 text-gray-12"
+                    : "border-gray-6/60 bg-gray-1/70 text-gray-10 hover:bg-gray-2/70 hover:text-gray-12"
+                }`}
+                onClick={props.toggleUpdateAutoDownload}
+              >
+                {props.updateAutoDownload ? t("settings.on") : t("settings.off")}
+              </button>
+            </div>
+
+            <div className="space-y-3 rounded-xl border border-gray-6 bg-gray-1 p-3">
+              <div className="flex items-center justify-between gap-3">
+                <div className="space-y-0.5">
+                  <div className="text-sm text-gray-12">
+                    {updateState === "checking"
+                      ? t("settings.update_checking")
+                      : updateState === "available"
+                        ? t("settings.update_available_version", undefined, { version: updateVersion ?? "" })
+                        : updateState === "downloading"
+                          ? t("settings.update_downloading")
+                          : updateState === "ready"
+                            ? t("settings.update_ready_version", undefined, { version: updateVersion ?? "" })
+                            : updateState === "error"
+                              ? t("settings.update_check_failed")
+                              : t("settings.update_uptodate")}
+                  </div>
+
+                  {updateState === "idle" && updateLastCheckedAt ? (
+                    <div className="text-xs text-gray-7">
+                      {t("settings.update_last_checked", undefined, {
+                        time: formatRelativeTime(updateLastCheckedAt),
+                      })}
+                    </div>
+                  ) : null}
+
+                  {updateState === "available" && updateDate ? (
+                    <div className="text-xs text-gray-7">
+                      {t("settings.update_published", undefined, { date: updateDate })}
+                    </div>
+                  ) : null}
+
+                  {updateState === "downloading" ? (
+                    <div className="space-y-1.5">
+                      <div className="text-xs text-gray-7">
+                        {formatBytes(updateDownloadedBytes ?? 0)}
+                        {updateTotalBytes != null ? ` / ${formatBytes(updateTotalBytes)}` : ""}
+                        {updateTotalBytes != null && updateTotalBytes > 0
+                          ? ` (${Math.round(((updateDownloadedBytes ?? 0) / updateTotalBytes) * 100)}%)`
+                          : ""}
+                      </div>
+                      {updateTotalBytes != null && updateTotalBytes > 0 ? (
+                        <div className="h-1.5 w-full overflow-hidden rounded-full bg-gray-4">
+                          <div
+                            className="h-full rounded-full bg-dls-accent transition-[width] duration-300 ease-out"
+                            style={{ width: `${Math.min(100, Math.round(((updateDownloadedBytes ?? 0) / updateTotalBytes) * 100))}%` }}
+                          />
+                        </div>
+                      ) : null}
+                    </div>
+                  ) : null}
+
+                  {updateState === "error" && updateErrorMessage ? (
+                    <div className="text-xs text-red-11">{updateErrorMessage}</div>
+                  ) : null}
+                </div>
+
+                <div className="flex items-center gap-2">
+                  <Button
+                    variant="outline"
+                    className="h-9 rounded-full border-gray-6/60 bg-gray-1/70 px-4 py-0 text-xs hover:bg-gray-2/70"
+                    onClick={props.checkForUpdates}
+                    disabled={props.busy || updateState === "checking" || updateState === "downloading"}
+                  >
+                    {t("settings.update_check_button")}
+                  </Button>
+
+                  {updateState === "available" ? (
+                    <Button
+                      variant="secondary"
+                      className="h-9 rounded-full px-4 py-0 text-xs"
+                      onClick={props.downloadUpdate}
+                      disabled={props.busy}
+                    >
+                      {t("settings.update_download_button")}
+                    </Button>
+                  ) : null}
+
+                  {updateState === "ready" ? (
+                    <Button
+                      variant="secondary"
+                      className="h-9 rounded-full px-4 py-0 text-xs"
+                      onClick={props.installUpdateAndRestart}
+                      disabled={props.busy || props.anyActiveRuns}
+                      title={updateRestartBlockedMessage ?? ""}
+                    >
+                      {t("settings.update_install_button")}
+                    </Button>
+                  ) : null}
+                </div>
+              </div>
+
+              {updateRestartBlockedMessage ? (
+                <div className="rounded-xl border border-amber-7/25 bg-amber-3/10 px-3 py-2 text-xs leading-relaxed text-amber-11">
+                  {updateRestartBlockedMessage}
+                </div>
+              ) : null}
+            </div>
+
+            {updateState === "available" && updateNotes ? (
+              <div className="max-h-40 overflow-auto whitespace-pre-wrap rounded-xl border border-gray-6 bg-gray-1/20 p-3 text-xs text-gray-11">
+                {updateNotes}
+              </div>
+            ) : null}
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/panels/authorized-folders-panel.tsx b/apps/app/src/react-app/domains/settings/panels/authorized-folders-panel.tsx
new file mode 100644
index 0000000000..b360b46036
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/panels/authorized-folders-panel.tsx
@@ -0,0 +1,441 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { Folder, FolderLock, FolderSearch, X } from "lucide-react";
+
+import { t } from "../../../../i18n";
+import { Button } from "../../../design-system/button";
+import type {
+  OpenworkServerCapabilities,
+  OpenworkServerClient,
+  OpenworkServerStatus,
+} from "../../../../app/lib/openwork-server";
+import { pickDirectory } from "../../../../app/lib/desktop";
+import {
+  isDesktopRuntime,
+  normalizeDirectoryQueryPath,
+  safeStringify,
+} from "../../../../app/utils";
+
+export type AuthorizedFoldersPanelProps = {
+  openworkServerClient: OpenworkServerClient | null;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerCapabilities: OpenworkServerCapabilities | null;
+  runtimeWorkspaceId: string | null;
+  selectedWorkspaceRoot: string;
+  activeWorkspaceType: "local" | "remote";
+  onConfigUpdated: () => void;
+};
+
+const panelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+const softPanelClass = "rounded-2xl border border-gray-6/60 bg-gray-1/40 p-4";
+
+const ensureRecord = (value: unknown): Record<string, unknown> => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value as Record<string, unknown>;
+};
+
+const normalizeAuthorizedFolderPath = (input: string | null | undefined) => {
+  const trimmed = (input ?? "").trim();
+  if (!trimmed) return "";
+  const withoutWildcard = trimmed.replace(/[\\/]\*+$/, "");
+  return normalizeDirectoryQueryPath(withoutWildcard);
+};
+
+const authorizedFolderToExternalDirectoryKey = (folder: string) => {
+  const normalized = normalizeAuthorizedFolderPath(folder);
+  if (!normalized) return "";
+  return normalized === "/" ? "/*" : `${normalized}/*`;
+};
+
+const externalDirectoryKeyToAuthorizedFolder = (key: string, value: unknown) => {
+  if (value !== "allow") return null;
+  const trimmed = key.trim();
+  if (!trimmed) return null;
+  if (trimmed === "/*") return "/";
+  if (!trimmed.endsWith("/*")) return null;
+  return normalizeAuthorizedFolderPath(trimmed.slice(0, -2));
+};
+
+const readAuthorizedFoldersFromConfig = (opencodeConfig: Record<string, unknown>) => {
+  const permission = ensureRecord(opencodeConfig.permission);
+  const externalDirectory = ensureRecord(permission.external_directory);
+  const folders: string[] = [];
+  const hiddenEntries: Record<string, unknown> = {};
+  const seen = new Set<string>();
+
+  for (const [key, value] of Object.entries(externalDirectory)) {
+    const folder = externalDirectoryKeyToAuthorizedFolder(key, value);
+    if (!folder) {
+      hiddenEntries[key] = value;
+      continue;
+    }
+    if (seen.has(folder)) continue;
+    seen.add(folder);
+    folders.push(folder);
+  }
+
+  return { folders, hiddenEntries };
+};
+
+const buildAuthorizedFoldersStatus = (preservedCount: number, action?: string) => {
+  const preservedLabel =
+    preservedCount > 0
+      ? preservedCount === 1
+        ? t("context_panel.preserving_entry")
+        : t("context_panel.preserving_entries", undefined, { count: preservedCount })
+      : null;
+  if (action && preservedLabel) return `${action} ${preservedLabel}`;
+  return action ?? preservedLabel;
+};
+
+const mergeAuthorizedFoldersIntoExternalDirectory = (
+  folders: string[],
+  hiddenEntries: Record<string, unknown>,
+): Record<string, unknown> | undefined => {
+  const next: Record<string, unknown> = { ...hiddenEntries };
+  for (const folder of folders) {
+    const key = authorizedFolderToExternalDirectoryKey(folder);
+    if (!key) continue;
+    next[key] = "allow";
+  }
+  return Object.keys(next).length ? next : undefined;
+};
+
+export function AuthorizedFoldersPanel(props: AuthorizedFoldersPanelProps) {
+  const [authorizedFolders, setAuthorizedFolders] = useState<string[]>([]);
+  const [authorizedFolderDraft, setAuthorizedFolderDraft] = useState("");
+  const [authorizedFoldersLoading, setAuthorizedFoldersLoading] = useState(false);
+  const [authorizedFoldersSaving, setAuthorizedFoldersSaving] = useState(false);
+  const [authorizedFoldersStatus, setAuthorizedFoldersStatus] = useState<string | null>(null);
+  const [authorizedFoldersError, setAuthorizedFoldersError] = useState<string | null>(null);
+
+  const openworkServerReady = props.openworkServerStatus === "connected";
+  const openworkServerWorkspaceReady = Boolean(props.runtimeWorkspaceId);
+  const canReadConfig =
+    openworkServerReady &&
+    openworkServerWorkspaceReady &&
+    (props.openworkServerCapabilities?.config?.read ?? false);
+  const canWriteConfig =
+    openworkServerReady &&
+    openworkServerWorkspaceReady &&
+    (props.openworkServerCapabilities?.config?.write ?? false);
+
+  const authorizedFoldersHint = useMemo(() => {
+    if (!openworkServerReady) return t("context_panel.server_disconnected");
+    if (!openworkServerWorkspaceReady) return t("context_panel.no_server_workspace");
+    if (!canReadConfig) return t("context_panel.config_access_unavailable");
+    if (!canWriteConfig) return t("context_panel.config_read_only");
+    return null;
+  }, [canReadConfig, canWriteConfig, openworkServerReady, openworkServerWorkspaceReady]);
+
+  const canPickAuthorizedFolder =
+    isDesktopRuntime() && canWriteConfig && props.activeWorkspaceType === "local";
+  const workspaceRootFolder = props.selectedWorkspaceRoot.trim();
+  const visibleAuthorizedFolders = useMemo(() => {
+    const root = workspaceRootFolder;
+    return root ? [root, ...authorizedFolders] : authorizedFolders;
+  }, [authorizedFolders, workspaceRootFolder]);
+
+  useEffect(() => {
+    const openworkClient = props.openworkServerClient;
+    const openworkWorkspaceId = props.runtimeWorkspaceId;
+
+    if (!openworkClient || !openworkWorkspaceId || !canReadConfig) {
+      setAuthorizedFolders([]);
+      setAuthorizedFolderDraft("");
+      setAuthorizedFoldersLoading(false);
+      setAuthorizedFoldersSaving(false);
+      setAuthorizedFoldersStatus(null);
+      setAuthorizedFoldersError(null);
+      return;
+    }
+
+    let cancelled = false;
+    setAuthorizedFolderDraft("");
+    setAuthorizedFoldersLoading(true);
+    setAuthorizedFoldersError(null);
+    setAuthorizedFoldersStatus(null);
+
+    void (async () => {
+      try {
+        const config = await openworkClient.getConfig(openworkWorkspaceId);
+        if (cancelled) return;
+        const next = readAuthorizedFoldersFromConfig(ensureRecord(config.opencode));
+        setAuthorizedFolders(next.folders);
+        setAuthorizedFoldersStatus(
+          buildAuthorizedFoldersStatus(Object.keys(next.hiddenEntries).length),
+        );
+      } catch (error) {
+        if (cancelled) return;
+        const message = error instanceof Error ? error.message : safeStringify(error);
+        setAuthorizedFolders([]);
+        setAuthorizedFoldersError(message);
+      } finally {
+        if (!cancelled) setAuthorizedFoldersLoading(false);
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [canReadConfig, props.openworkServerClient, props.runtimeWorkspaceId]);
+
+  const persistAuthorizedFolders = useCallback(async (nextFolders: string[]) => {
+    const openworkClient = props.openworkServerClient;
+    const openworkWorkspaceId = props.runtimeWorkspaceId;
+    if (!openworkClient || !openworkWorkspaceId || !canWriteConfig) {
+      setAuthorizedFoldersError(t("context_panel.writable_workspace_required"));
+      return false;
+    }
+
+    setAuthorizedFoldersSaving(true);
+    setAuthorizedFoldersError(null);
+    setAuthorizedFoldersStatus(t("context_panel.saving_folders"));
+
+    try {
+      const currentConfig = await openworkClient.getConfig(openworkWorkspaceId);
+      const currentAuthorizedFolders = readAuthorizedFoldersFromConfig(
+        ensureRecord(currentConfig.opencode),
+      );
+      const nextExternalDirectory = mergeAuthorizedFoldersIntoExternalDirectory(
+        nextFolders,
+        currentAuthorizedFolders.hiddenEntries,
+      );
+
+      await openworkClient.patchConfig(openworkWorkspaceId, {
+        opencode: {
+          permission: {
+            external_directory: nextExternalDirectory,
+          },
+        },
+      });
+      setAuthorizedFolders(nextFolders);
+      setAuthorizedFoldersStatus(
+        buildAuthorizedFoldersStatus(
+          Object.keys(currentAuthorizedFolders.hiddenEntries).length,
+          t("context_panel.folders_updated"),
+        ),
+      );
+      props.onConfigUpdated();
+      return true;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      setAuthorizedFoldersError(message);
+      setAuthorizedFoldersStatus(null);
+      return false;
+    } finally {
+      setAuthorizedFoldersSaving(false);
+    }
+  }, [canWriteConfig, props]);
+
+  const addAuthorizedFolder = useCallback(async () => {
+    const normalized = normalizeAuthorizedFolderPath(authorizedFolderDraft);
+    const workspaceRoot = normalizeAuthorizedFolderPath(workspaceRootFolder);
+    if (!normalized) return;
+    if (workspaceRoot && normalized === workspaceRoot) {
+      setAuthorizedFolderDraft("");
+      setAuthorizedFoldersStatus(t("context_panel.workspace_root_available"));
+      setAuthorizedFoldersError(null);
+      return;
+    }
+    if (authorizedFolders.includes(normalized)) {
+      setAuthorizedFolderDraft("");
+      setAuthorizedFoldersStatus(t("context_panel.folder_already_authorized"));
+      setAuthorizedFoldersError(null);
+      return;
+    }
+
+    const ok = await persistAuthorizedFolders([...authorizedFolders, normalized]);
+    if (ok) {
+      setAuthorizedFolderDraft("");
+    }
+  }, [authorizedFolderDraft, authorizedFolders, persistAuthorizedFolders, workspaceRootFolder]);
+
+  const removeAuthorizedFolder = useCallback(async (folder: string) => {
+    const nextFolders = authorizedFolders.filter((entry) => entry !== folder);
+    await persistAuthorizedFolders(nextFolders);
+  }, [authorizedFolders, persistAuthorizedFolders]);
+
+  const pickAuthorizedFolder = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    try {
+      const selection = await pickDirectory({
+        title: t("onboarding.authorize_folder"),
+      });
+      const folder =
+        typeof selection === "string"
+          ? selection
+          : Array.isArray(selection)
+            ? selection[0]
+            : null;
+      const normalized = normalizeAuthorizedFolderPath(folder);
+      const workspaceRoot = normalizeAuthorizedFolderPath(workspaceRootFolder);
+      if (!normalized) return;
+      setAuthorizedFolderDraft(normalized);
+      if (workspaceRoot && normalized === workspaceRoot) {
+        setAuthorizedFolderDraft("");
+        setAuthorizedFoldersStatus(t("context_panel.workspace_root_available"));
+        setAuthorizedFoldersError(null);
+        return;
+      }
+      if (authorizedFolders.includes(normalized)) {
+        setAuthorizedFoldersStatus(t("context_panel.folder_already_authorized"));
+        setAuthorizedFoldersError(null);
+        return;
+      }
+      const ok = await persistAuthorizedFolders([...authorizedFolders, normalized]);
+      if (ok) {
+        setAuthorizedFolderDraft("");
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      setAuthorizedFoldersError(message);
+    }
+  }, [authorizedFolders, persistAuthorizedFolders, workspaceRootFolder]);
+
+  return (
+    <div className={`${panelClass} space-y-4`}>
+      <div className="space-y-1">
+        <div className="flex items-center gap-2 text-sm font-semibold text-gray-12">
+          <FolderLock size={16} className="text-gray-10" />
+          {t("context_panel.authorized_folders")}
+        </div>
+        <div className="max-w-[65ch] text-xs leading-relaxed text-gray-9">
+          {t("context_panel.authorized_folders_desc")}
+        </div>
+      </div>
+
+      {!canReadConfig ? (
+        <div className={`${softPanelClass} px-3 py-3 text-xs text-gray-10`}>
+          {authorizedFoldersHint ?? t("context_panel.authorized_folders_no_access")}
+        </div>
+      ) : (
+        <div className="flex flex-col overflow-hidden rounded-xl border border-gray-5/60 bg-gray-1/50 shadow-sm">
+          {authorizedFoldersHint ? (
+            <div className="border-b border-gray-5/40 bg-gray-2/60 px-3 py-2 text-[11px] text-gray-10">
+              {authorizedFoldersHint}
+            </div>
+          ) : null}
+
+          {visibleAuthorizedFolders.length > 0 ? (
+            <div className="flex max-h-[300px] flex-col divide-y divide-gray-5/40 overflow-y-auto">
+              {visibleAuthorizedFolders.map((folder) => {
+                const isWorkspaceRoot = folder === workspaceRootFolder;
+                const folderName = folder.split(/[\/\\]/).filter(Boolean).pop() || folder;
+                return (
+                  <div
+                    key={folder}
+                    className={`flex items-center justify-between px-3 py-2.5 transition-colors ${
+                      isWorkspaceRoot ? "bg-blue-2/20" : "hover:bg-gray-2/50"
+                    }`}
+                  >
+                    <div className="flex overflow-hidden items-center gap-3">
+                      <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-blue-3/30 text-blue-11">
+                        <Folder size={15} />
+                      </div>
+                      <div className="flex min-w-0 flex-col">
+                        <div className="flex items-center gap-2">
+                          <span className="truncate text-sm font-medium text-gray-12">{folderName}</span>
+                          {isWorkspaceRoot ? (
+                            <span className="rounded-full border border-blue-7/30 bg-blue-3/25 px-2 py-0.5 text-[10px] font-medium text-blue-11">
+                              {t("context_panel.workspace_root_badge")}
+                            </span>
+                          ) : null}
+                        </div>
+                        <span className="truncate font-mono text-[10px] text-gray-8">{folder}</span>
+                      </div>
+                    </div>
+                    {!isWorkspaceRoot ? (
+                      <Button
+                        variant="ghost"
+                        className="h-6 w-6 shrink-0 !rounded-full !p-0 border-0 bg-transparent text-red-10 shadow-none hover:bg-red-3/15 hover:text-red-11 focus:ring-red-7/25"
+                        onClick={() => void removeAuthorizedFolder(folder)}
+                        disabled={authorizedFoldersLoading || authorizedFoldersSaving || !canWriteConfig}
+                        aria-label={t("context_panel.remove_folder", undefined, { name: folderName })}
+                      >
+                        <X size={16} className="text-current" />
+                      </Button>
+                    ) : (
+                      <span className="shrink-0 text-[10px] font-medium text-gray-8">
+                        {t("context_panel.always_available")}
+                      </span>
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+          ) : (
+            <div className="flex flex-col items-center justify-center p-6 text-center">
+              <div className="mb-3 flex h-10 w-10 items-center justify-center rounded-full bg-blue-3/30 text-blue-11">
+                <Folder size={20} />
+              </div>
+              <div className="text-sm font-medium text-gray-11">{t("context_panel.no_external_folders")}</div>
+              <div className="mt-1 max-w-[40ch] text-[11px] text-gray-9">
+                {t("context_panel.add_folder_hint")}
+              </div>
+            </div>
+          )}
+
+          {authorizedFoldersStatus ? (
+            <div className="border-t border-gray-5/40 bg-blue-2/30 px-3 py-2 text-[11px] text-blue-11">
+              {authorizedFoldersStatus}
+            </div>
+          ) : null}
+          {authorizedFoldersError ? (
+            <div className="border-t border-gray-5/40 bg-red-2/30 px-3 py-2 text-[11px] text-red-11">
+              {authorizedFoldersError}
+            </div>
+          ) : null}
+
+          <form
+            className="flex items-center gap-2 border-t border-gray-5/60 bg-gray-2/60 p-2"
+            onSubmit={(event) => {
+              event.preventDefault();
+              void addAuthorizedFolder();
+            }}
+          >
+            <div className="relative flex-1">
+              <input
+                className="w-full rounded-lg border border-gray-5/60 bg-gray-1 px-3 py-1.5 text-xs text-gray-12 placeholder:text-gray-8 focus:outline-none focus:ring-2 focus:ring-blue-7/30 disabled:opacity-50"
+                value={authorizedFolderDraft}
+                onChange={(event) => setAuthorizedFolderDraft(event.currentTarget.value)}
+                onPaste={(event) => {
+                  event.preventDefault();
+                }}
+                placeholder={t("context_panel.input_placeholder")}
+                disabled={authorizedFoldersLoading || authorizedFoldersSaving || !canWriteConfig}
+              />
+            </div>
+
+            {canPickAuthorizedFolder ? (
+              <Button
+                type="button"
+                variant="outline"
+                className="h-8 px-3 text-xs bg-gray-1 hover:bg-gray-2"
+                onClick={() => void pickAuthorizedFolder()}
+                disabled={authorizedFoldersLoading || authorizedFoldersSaving || !canWriteConfig}
+              >
+                <FolderSearch size={13} className="mr-1.5" />
+                {t("context_panel.browse_button")}
+              </Button>
+            ) : null}
+
+            <Button
+              type="submit"
+              variant="outline"
+              className="h-8 border border-gray-5/60 bg-gray-3 px-3 text-xs text-gray-12 hover:bg-gray-4"
+              disabled={
+                authorizedFoldersLoading ||
+                authorizedFoldersSaving ||
+                !canWriteConfig ||
+                !authorizedFolderDraft.trim()
+              }
+            >
+              {authorizedFoldersSaving ? t("context_panel.adding_button") : t("context_panel.add_button")}
+            </Button>
+          </form>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/panels/den-settings-panel.tsx b/apps/app/src/react-app/domains/settings/panels/den-settings-panel.tsx
new file mode 100644
index 0000000000..0868dfcfe6
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/panels/den-settings-panel.tsx
@@ -0,0 +1,1478 @@
+/** @jsxImportSource react */
+import * as React from "react";
+import { ArrowUpRight } from "lucide-react";
+
+import {
+  buildDenAuthUrl,
+  clearDenSession,
+  DEFAULT_DEN_BASE_URL,
+  DenApiError,
+  type DenOrgMarketplaceResolved,
+  type DenOrgLlmProvider,
+  type DenOrgPlugin,
+  type DenOrgSkillHub,
+  type DenUser,
+  createDenClient,
+  ensureDenActiveOrganization,
+  normalizeDenBaseUrl,
+  readDenSettings,
+  resolveDenBaseUrls,
+  writeDenSettings,
+} from "../../../../app/lib/den";
+import {
+  denSessionUpdatedEvent,
+  dispatchDenSessionUpdated,
+  type DenSessionUpdatedDetail,
+} from "../../../../app/lib/den-session-events";
+import type { CloudImportedPlugin, CloudImportedProvider, CloudImportedSkill, CloudImportedSkillHub } from "../../../../app/cloud/import-state";
+import type { DenOrgSkillCard, SkillCard } from "../../../../app/types";
+import { Separator } from "@/components/ui/separator";
+import { Button } from "@/components/ui/button";
+import {
+  Collapsible,
+  CollapsibleContent,
+  CollapsibleTrigger,
+} from "@/components/ui/collapsible";
+import { Field, FieldDescription, FieldLabel } from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import {
+  CloudProvidersSection,
+  CloudSkillsSection,
+  CloudWorkersSection,
+  MarketplacePluginsSection,
+  SkillHubsSection,
+  type CloudPluginRow,
+  type CloudProviderRow,
+  type CloudSkillHubRow,
+  type CloudSkillRow,
+} from "../cloud/sections";
+import { CloudAccountSection } from "../cloud/cloud-account-section";
+import { CloudDevMode } from "../cloud/dev-mode";
+import {
+  SettingsSection,
+  SettingsInset,
+  SettingsNotice,
+  SettingsSectionHeader,
+  SettingsSectionHeaderActions,
+  SettingsSectionHeaderContent,
+  SettingsSectionHeaderDescription,
+  SettingsSectionHeaderTitle,
+  SettingsStack,
+  SettingsStatusBadge,
+} from "../settings-section";
+import { useStatusToasts } from "../../shell-feedback/status-toasts";
+import { t } from "@/i18n";
+
+type AsyncResult = { ok: boolean; message: string };
+
+export type DenSettingsExtensionsStore = {
+  skills: () => SkillCard[];
+  cloudOrgSkills: () => DenOrgSkillCard[];
+  cloudOrgSkillsStatus: () => string | null;
+  importedCloudSkills: () => Record<string, CloudImportedSkill>;
+  refreshCloudOrgSkills: (options?: { force?: boolean }) => Promise<unknown>;
+  installCloudOrgSkill: (skill: DenOrgSkillCard) => Promise<AsyncResult>;
+  removeCloudOrgSkill: (cloudSkillId: string) => Promise<AsyncResult>;
+  syncCloudOrgSkill: (skill: DenOrgSkillCard) => Promise<AsyncResult>;
+  cloudOrgSkillHubs: () => DenOrgSkillHub[];
+  cloudOrgSkillHubsStatus: () => string | null;
+  importedCloudSkillHubs: () => Record<string, CloudImportedSkillHub>;
+  refreshCloudOrgSkillHubs: (options?: { force?: boolean }) => Promise<unknown>;
+  importCloudOrgSkillHub: (hub: DenOrgSkillHub) => Promise<AsyncResult>;
+  removeCloudOrgSkillHub: (hubId: string) => Promise<AsyncResult>;
+  syncCloudOrgSkillHub: (hub: DenOrgSkillHub) => Promise<AsyncResult>;
+  cloudOrgMarketplaces: () => DenOrgMarketplaceResolved[];
+  cloudOrgMarketplacesStatus: () => string | null;
+  importedCloudPlugins: () => Record<string, CloudImportedPlugin>;
+  refreshCloudOrgMarketplaces: (options?: { force?: boolean }) => Promise<unknown>;
+  importCloudOrgPlugin: (marketplaceId: string | null, plugin: DenOrgPlugin) => Promise<AsyncResult>;
+};
+
+export type DenSettingsPanelProps = {
+  developerMode: boolean;
+  extensions: DenSettingsExtensionsStore;
+  openLink: (url: string) => void;
+  connectRemoteWorkspace: (input: {
+    openworkHostUrl?: string | null;
+    openworkToken?: string | null;
+    directory?: string | null;
+    displayName?: string | null;
+  }) => Promise<boolean>;
+  cloudOrgProviders: DenOrgLlmProvider[];
+  importedCloudProviders: Record<string, CloudImportedProvider>;
+  refreshCloudOrgProviders: (options?: { force?: boolean }) => Promise<DenOrgLlmProvider[]>;
+  connectCloudProvider: (cloudProviderId: string) => Promise<string | void>;
+  removeCloudProvider: (cloudProviderId: string) => Promise<string | void>;
+};
+
+const sortStrings = (values: string[]) => [...values].sort();
+
+const sameStringList = (a: string[], b: string[]) =>
+  a.length === b.length && a.every((value, index) => value === b[index]);
+
+function parseManualAuthInput(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+
+  try {
+    const url = new URL(trimmed);
+    const protocol = url.protocol.toLowerCase();
+    const routeHost = url.hostname.toLowerCase();
+    const routePath = url.pathname.replace(/^\/+/, "").toLowerCase();
+    const routeSegments = routePath.split("/").filter(Boolean);
+    const routeTail = routeSegments[routeSegments.length - 1] ?? "";
+    if (
+      (protocol === "openwork:" || protocol === "openwork-dev:") &&
+      (routeHost === "den-auth" || routePath === "den-auth" || routeTail === "den-auth")
+    ) {
+      const grant = url.searchParams.get("grant")?.trim() ?? "";
+      const nextBaseUrl =
+        normalizeDenBaseUrl(url.searchParams.get("denBaseUrl")?.trim() ?? "") ?? undefined;
+      return grant ? { grant, baseUrl: nextBaseUrl } : null;
+    }
+  } catch {
+    // Treat non-URL input as a raw handoff grant.
+  }
+
+  return trimmed.length >= 12 ? { grant: trimmed } : null;
+}
+
+interface DenSignedOutPanelProps {
+  authBusy: boolean;
+  authError: string | null;
+  onClearAuthError: () => void;
+  onOpenBrowserAuth: (mode: "sign-in" | "sign-up") => void;
+  onSubmitManualAuth: (input: string) => Promise<boolean>;
+  sessionBusy: boolean;
+}
+
+function DenSignedOutPanel({
+  authBusy,
+  authError,
+  onClearAuthError,
+  onOpenBrowserAuth,
+  onSubmitManualAuth,
+  sessionBusy,
+}: DenSignedOutPanelProps) {
+  const [manualAuthOpen, setManualAuthOpen] = React.useState(false);
+  const [manualAuthInput, setManualAuthInput] = React.useState("");
+  const controlsDisabled = [authBusy, sessionBusy].some(Boolean);
+
+  const submitManualAuth = async () => {
+    const ok = await onSubmitManualAuth(manualAuthInput);
+    if (!ok) return;
+    setManualAuthInput("");
+    setManualAuthOpen(false);
+  };
+
+  return (
+    <SettingsSection>
+      <SettingsSectionHeader>
+        <SettingsSectionHeaderContent>
+          <SettingsSectionHeaderTitle>{t("den.signin_title")}</SettingsSectionHeaderTitle>
+          <SettingsSectionHeaderDescription className="max-w-[54ch]">
+            {t("den.cloud_sleep_hint")}
+          </SettingsSectionHeaderDescription>
+        </SettingsSectionHeaderContent>
+      </SettingsSectionHeader>
+
+      <div className="flex flex-col gap-6">
+        <div className="flex flex-wrap items-center gap-2">
+          <Button onClick={() => onOpenBrowserAuth("sign-in")}>
+            {t("den.signin_button")}
+            <ArrowUpRight size={13} />
+          </Button>
+          <Button variant="outline" onClick={() => onOpenBrowserAuth("sign-up")}>
+            {t("den.create_account")}
+            <ArrowUpRight size={13} />
+          </Button>
+        </div>
+
+        <Collapsible
+          open={manualAuthOpen}
+          onOpenChange={(open) => {
+            setManualAuthOpen(open);
+            onClearAuthError();
+          }}
+          disabled={controlsDisabled}
+          className="flex flex-col gap-3"
+        >
+          <CollapsibleTrigger
+            render={<Button variant="ghost" size="sm" className="w-fit self-start" disabled={controlsDisabled} />}
+          >
+            {manualAuthOpen ? t("den.hide_signin_code") : t("den.paste_signin_code")}
+          </CollapsibleTrigger>
+          <CollapsibleContent>
+            <SettingsInset className="flex flex-col gap-y-3">
+              <Field data-disabled={controlsDisabled}>
+                <FieldLabel htmlFor="den-signin-link">{t("den.signin_link_label")}</FieldLabel>
+                <Input
+                  id="den-signin-link"
+                  value={manualAuthInput}
+                  onChange={(event) => setManualAuthInput(event.currentTarget.value)}
+                  placeholder={t("den.signin_link_placeholder")}
+                  disabled={controlsDisabled}
+                />
+                <FieldDescription className="text-xs">{t("den.signin_link_hint")}</FieldDescription>
+              </Field>
+              <div className="flex flex-wrap items-center gap-2">
+                <Button
+                  onClick={() => void submitManualAuth()}
+                  disabled={[controlsDisabled, !manualAuthInput.trim()].some(Boolean)}
+                >
+                  {authBusy ? t("den.finishing") : t("den.finish_signin")}
+                </Button>
+              </div>
+            </SettingsInset>
+          </CollapsibleContent>
+        </Collapsible>
+      </div>
+
+      {authError ? <SettingsNotice tone="error">{authError}</SettingsNotice> : null}
+
+      <SettingsInset className="text-sm text-gray-10">
+        {t("den.auto_reconnect_hint")}
+      </SettingsInset>
+    </SettingsSection>
+  );
+}
+
+export function DenSettingsPanel(props: DenSettingsPanelProps) {
+  const { showToast } = useStatusToasts();
+
+  const initial = React.useMemo(() => readDenSettings(), []);
+  const initialBaseUrl = initial.baseUrl || DEFAULT_DEN_BASE_URL;
+
+  // Connection settings
+  const [baseUrl, setBaseUrl] = React.useState(initialBaseUrl);
+  const [baseUrlDraft, setBaseUrlDraft] = React.useState(initialBaseUrl);
+  const [baseUrlError, setBaseUrlError] = React.useState<string | null>(null);
+  const [authToken, setAuthToken] = React.useState(initial.authToken?.trim() || "");
+  const client = React.useMemo(
+    () => createDenClient({ baseUrl, token: authToken }),
+    [authToken, baseUrl],
+  );
+
+  // Auth session
+  const [authBusy, setAuthBusy] = React.useState(false);
+  const [sessionBusy, setSessionBusy] = React.useState(false);
+  const [user, setUser] = React.useState<DenUser | null>(null);
+  const [statusMessage, setStatusMessage] = React.useState<string | null>(null);
+  const [authError, setAuthError] = React.useState<string | null>(null);
+
+  // Organizations
+  const [activeOrgId, setActiveOrgId] = React.useState(initial.activeOrgId?.trim() || "");
+  const [orgsBusy, setOrgsBusy] = React.useState(false);
+  const [orgs, setOrgs] = React.useState<
+    Array<{ id: string; name: string; slug: string; role: "owner" | "admin" | "member" }>
+  >([]);
+  const [orgsError, setOrgsError] = React.useState<string | null>(null);
+  const activeOrg = React.useMemo(
+    () => orgs.find((org) => org.id === activeOrgId) ?? null,
+    [activeOrgId, orgs],
+  );
+  const activeOrgName = activeOrg?.name || t("den.no_org_selected");
+
+  // Workers
+  const [workersBusy, setWorkersBusy] = React.useState(false);
+  const [openingWorkerId, setOpeningWorkerId] = React.useState<string | null>(null);
+  const [workers, setWorkers] = React.useState<
+    Array<{
+      workerId: string;
+      workerName: string;
+      status: string;
+      instanceUrl: string | null;
+      provider: string | null;
+      isMine: boolean;
+      createdAt: string | null;
+    }>
+  >([]);
+  const [workersError, setWorkersError] = React.useState<string | null>(null);
+
+  // Skill hubs
+  const [skillHubsBusy, setSkillHubsBusy] = React.useState(false);
+  const [skillHubActionId, setSkillHubActionId] = React.useState<string | null>(null);
+  const [skillHubActionKind, setSkillHubActionKind] = React.useState<"import" | "remove" | "sync" | null>(null);
+  const [skillHubActionError, setSkillHubActionError] = React.useState<string | null>(null);
+
+  // Skills
+  const [skillsBusy, setSkillsBusy] = React.useState(false);
+  const [skillActionId, setSkillActionId] = React.useState<string | null>(null);
+  const [skillActionKind, setSkillActionKind] = React.useState<"import" | "remove" | "sync" | null>(null);
+  const [skillActionError, setSkillActionError] = React.useState<string | null>(null);
+
+  // Marketplaces and plugins
+  const [marketplacesBusy, setMarketplacesBusy] = React.useState(false);
+  const [activeMarketplaceId, setActiveMarketplaceId] = React.useState<string | null>(null);
+  const [pluginActionId, setPluginActionId] = React.useState<string | null>(null);
+  const [pluginActionError, setPluginActionError] = React.useState<string | null>(null);
+
+  // Providers
+  const [providersBusy, setProvidersBusy] = React.useState(false);
+  const [providerActionId, setProviderActionId] = React.useState<string | null>(null);
+  const [providerActionKind, setProviderActionKind] = React.useState<"import" | "remove" | "sync" | null>(null);
+  const [providerActionError, setProviderActionError] = React.useState<string | null>(null);
+
+  const isSignedIn = Boolean(user && authToken.trim());
+
+  const syncCurrentDenSettings = React.useCallback(() => {
+    const resolved = resolveDenBaseUrls(baseUrl);
+    writeDenSettings({
+      baseUrl: resolved.baseUrl,
+      apiBaseUrl: resolved.apiBaseUrl,
+      authToken: authToken || null,
+      activeOrgId: activeOrgId || null,
+      activeOrgSlug: activeOrg?.slug ?? null,
+      activeOrgName: activeOrg?.name ?? null,
+    });
+  }, [activeOrg, activeOrgId, authToken, baseUrl]);
+
+  // Derived extension rows
+  const installedSkillNames = React.useMemo(
+    () => new Set(props.extensions.skills().map((skill) => skill.name)),
+    [props.extensions],
+  );
+
+  const skillHubImports = props.extensions.importedCloudSkillHubs();
+  const liveSkillHubs = props.extensions.cloudOrgSkillHubs();
+  const liveSkills = props.extensions.cloudOrgSkills();
+  const importedSkills = props.extensions.importedCloudSkills();
+  const liveMarketplaces = props.extensions.cloudOrgMarketplaces();
+  const importedPlugins = props.extensions.importedCloudPlugins();
+
+  const skillHubRows = React.useMemo<CloudSkillHubRow[]>(() => {
+    const rows: CloudSkillHubRow[] = liveSkillHubs.map((hub) => {
+      const imported = skillHubImports[hub.id] ?? null;
+      const currentSkillIds = sortStrings(hub.skills.map((skill) => skill.id));
+      const importedSkillIds = sortStrings(imported?.skillIds ?? []);
+      const status = !imported
+        ? "available"
+        : sameStringList(currentSkillIds, importedSkillIds)
+          ? "imported"
+          : "out_of_sync";
+      return {
+        key: `live:${hub.id}`,
+        hubId: hub.id,
+        name: hub.name,
+        hub,
+        imported,
+        status,
+        liveSkillCount: hub.skills.length,
+        importedSkillCount: imported?.skillNames.length ?? 0,
+      };
+    });
+
+    for (const imported of Object.values(skillHubImports)) {
+      if (liveSkillHubs.some((hub) => hub.id === imported.hubId)) continue;
+      rows.push({
+        key: `imported:${imported.hubId}`,
+        hubId: imported.hubId,
+        name: imported.name,
+        hub: null,
+        imported,
+        status: "removed_from_cloud",
+        liveSkillCount: 0,
+        importedSkillCount: imported.skillNames.length,
+      });
+    }
+
+    return rows;
+  }, [liveSkillHubs, skillHubImports]);
+
+  const skillRows = React.useMemo<CloudSkillRow[]>(() => {
+    const rows: CloudSkillRow[] = liveSkills.map((skill) => {
+      const imported = importedSkills[skill.id] ?? null;
+      const remoteUpdatedAt = skill.updatedAt ? Date.parse(skill.updatedAt) : Number.NaN;
+      const importedUpdatedAt = imported?.updatedAt ? Date.parse(imported.updatedAt) : Number.NaN;
+      const installedName = imported?.installedName?.trim() || null;
+      const installedLocally = installedName ? installedSkillNames.has(installedName) : false;
+      const status = !imported
+        ? "available"
+        : !installedLocally
+          ? "out_of_sync"
+          : Number.isFinite(remoteUpdatedAt) &&
+              (!Number.isFinite(importedUpdatedAt) || remoteUpdatedAt > importedUpdatedAt)
+            ? "out_of_sync"
+            : "installed";
+
+      return {
+        key: `live:${skill.id}`,
+        cloudSkillId: skill.id,
+        skill,
+        imported,
+        status,
+        title: skill.title,
+        installedName,
+      };
+    });
+
+    for (const imported of Object.values(importedSkills)) {
+      if (liveSkills.some((skill) => skill.id === imported.cloudSkillId)) continue;
+      rows.push({
+        key: `imported:${imported.cloudSkillId}`,
+        cloudSkillId: imported.cloudSkillId,
+        skill: null,
+        imported,
+        status: "removed_from_cloud",
+        title: imported.title,
+        installedName: imported.installedName,
+      });
+    }
+
+    return rows.sort((a, b) => a.title.localeCompare(b.title));
+  }, [importedSkills, installedSkillNames, liveSkills]);
+
+  const providerRows = React.useMemo<CloudProviderRow[]>(() => {
+    const rows: CloudProviderRow[] = props.cloudOrgProviders.map((provider) => {
+      const imported = props.importedCloudProviders[provider.id] ?? null;
+      const status = !imported
+        ? "available"
+        : imported.providerId !== provider.providerId ||
+            (imported.source ?? null) !== provider.source ||
+            (imported.updatedAt ?? null) !== (provider.updatedAt ?? null) ||
+            !sameStringList(imported.modelIds, sortStrings(provider.models.map((model) => model.id)))
+          ? "out_of_sync"
+          : "imported";
+      return {
+        key: `live:${provider.id}`,
+        cloudProviderId: provider.id,
+        provider,
+        imported,
+        status,
+        name: provider.name,
+      };
+    });
+
+    for (const imported of Object.values(props.importedCloudProviders)) {
+      if (props.cloudOrgProviders.some((provider) => provider.id === imported.cloudProviderId)) continue;
+      rows.push({
+        key: `imported:${imported.cloudProviderId}`,
+        cloudProviderId: imported.cloudProviderId,
+        provider: null,
+        imported,
+        status: "removed_from_cloud",
+        name: imported.name,
+      });
+    }
+
+    return rows;
+  }, [props.cloudOrgProviders, props.importedCloudProviders]);
+
+  const marketplacePluginRows = React.useMemo<Record<string, CloudPluginRow[]>>(() => {
+    const next: Record<string, CloudPluginRow[]> = {};
+    for (const marketplace of liveMarketplaces) {
+      next[marketplace.marketplace.id] = marketplace.plugins.map((plugin) => {
+        const imported = importedPlugins[plugin.id] ?? null;
+        const status = !imported
+          ? "available"
+          : imported.updatedAt !== plugin.updatedAt || imported.files.length !== plugin.memberCount
+            ? "out_of_sync"
+            : "imported";
+        return { marketplaceId: marketplace.marketplace.id, plugin, imported, status };
+      });
+    }
+    return next;
+  }, [importedPlugins, liveMarketplaces]);
+
+  // Summary status
+  const summaryTone = React.useMemo(() => {
+    if (
+      authError ||
+      workersError ||
+      orgsError ||
+      skillActionError ||
+      pluginActionError ||
+      providerActionError ||
+      skillHubActionError
+    ) {
+      return "error" as const;
+    }
+    if (
+      sessionBusy ||
+      orgsBusy ||
+      workersBusy ||
+      skillsBusy ||
+      marketplacesBusy ||
+      providersBusy ||
+      skillHubsBusy
+    ) {
+      return "warning" as const;
+    }
+    if (isSignedIn) return "ready" as const;
+    return "neutral" as const;
+  }, [
+    authError,
+    isSignedIn,
+    orgsBusy,
+    orgsError,
+    marketplacesBusy,
+    providerActionError,
+    providersBusy,
+    pluginActionError,
+    sessionBusy,
+    skillActionError,
+    skillHubActionError,
+    skillHubsBusy,
+    skillsBusy,
+    workersBusy,
+    workersError,
+  ]);
+
+  const summaryLabel = React.useMemo(() => {
+    if (authError) return t("den.needs_attention");
+    if (sessionBusy) return t("den.checking_session");
+    if (isSignedIn) return t("dashboard.connected");
+    return t("den.signed_out");
+  }, [authError, isSignedIn, sessionBusy]);
+
+  // Shared reset helpers
+  const clearSessionState = React.useCallback(() => {
+    setUser(null);
+    setOrgs([]);
+    setWorkers([]);
+    setActiveOrgId("");
+    setActiveMarketplaceId(null);
+    setOrgsError(null);
+    setWorkersError(null);
+    setSkillHubActionError(null);
+    setPluginActionError(null);
+    setProviderActionError(null);
+    setSkillHubActionKind(null);
+    setProviderActionKind(null);
+  }, []);
+
+  const clearSignedInState = React.useCallback(
+    (message?: string | null) => {
+      clearDenSession({ includeBaseUrls: !props.developerMode });
+      if (!props.developerMode) {
+        setBaseUrl(DEFAULT_DEN_BASE_URL);
+        setBaseUrlDraft(DEFAULT_DEN_BASE_URL);
+      }
+      setAuthToken("");
+      setOpeningWorkerId(null);
+      setSkillHubActionId(null);
+      setPluginActionId(null);
+      setProviderActionId(null);
+      setSkillHubActionKind(null);
+      setProviderActionKind(null);
+      clearSessionState();
+      setBaseUrlError(null);
+      setAuthError(null);
+      setStatusMessage(message ?? null);
+    },
+    [clearSessionState, props.developerMode],
+  );
+
+  // Settings persistence
+  React.useEffect(() => {
+    syncCurrentDenSettings();
+  }, [syncCurrentDenSettings]);
+
+  // Connection settings actions
+  const openControlPlane = React.useCallback(() => {
+    props.openLink(resolveDenBaseUrls(baseUrl).baseUrl);
+  }, [baseUrl, props]);
+
+  const openBrowserAuth = React.useCallback(
+    (mode: "sign-in" | "sign-up") => {
+      props.openLink(buildDenAuthUrl(baseUrl, mode));
+      setStatusMessage(
+        mode === "sign-up"
+          ? t("den.status_browser_signup")
+          : t("den.status_browser_signin"),
+      );
+      setAuthError(null);
+    },
+    [baseUrl, props],
+  );
+
+  const applyBaseUrl = React.useCallback(() => {
+    const normalized = normalizeDenBaseUrl(baseUrlDraft);
+    if (!normalized) {
+      setBaseUrlError(t("den.error_base_url"));
+      return;
+    }
+
+    const resolved = resolveDenBaseUrls(normalized);
+    setBaseUrlError(null);
+    if (resolved.baseUrl === baseUrl) {
+      setBaseUrlDraft(resolved.baseUrl);
+      return;
+    }
+
+    setBaseUrl(resolved.baseUrl);
+    setBaseUrlDraft(resolved.baseUrl);
+    clearSignedInState(t("den.status_base_url_updated"));
+  }, [baseUrl, baseUrlDraft, clearSignedInState]);
+
+  // Auth session query candidate: user, sessionBusy, authError
+  React.useEffect(() => {
+    const token = authToken.trim();
+    if (!token) {
+      setSessionBusy(false);
+      clearSessionState();
+      setAuthError(null);
+      return;
+    }
+
+    let cancelled = false;
+    setSessionBusy(true);
+    setAuthError(null);
+
+    void createDenClient({ baseUrl, token })
+      .getSession()
+      .then((nextUser) => {
+        if (cancelled) return;
+        setUser(nextUser);
+        setStatusMessage(t("den.status_signed_in_as", { email: nextUser.email }));
+      })
+      .catch((error) => {
+        if (cancelled) return;
+        if (error instanceof DenApiError && error.status === 401) {
+          clearSignedInState();
+        } else {
+          clearSessionState();
+        }
+        setAuthError(error instanceof Error ? error.message : t("den.error_no_session"));
+      })
+      .finally(() => {
+        if (!cancelled) setSessionBusy(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [authToken, baseUrl, clearSessionState, clearSignedInState]);
+
+  // Organizations query candidate: orgs, orgsBusy, orgsError
+  const refreshOrgs = React.useCallback(
+    async (quiet = false) => {
+      if (!authToken.trim()) {
+        setOrgs([]);
+        setActiveOrgId("");
+        return;
+      }
+
+      setOrgsBusy(true);
+      if (!quiet) setOrgsError(null);
+
+      try {
+        const response = await client.listOrgs();
+        setOrgs(response.orgs);
+        const current = activeOrgId.trim();
+        const fallback = response.defaultOrgId ?? response.orgs[0]?.id ?? "";
+        const next = response.orgs.some((org) => org.id === current) ? current : fallback;
+        const nextOrg = response.orgs.find((org) => org.id === next) ?? null;
+        setActiveOrgId(next);
+        writeDenSettings({
+          baseUrl,
+          authToken: authToken || null,
+          activeOrgId: next || null,
+          activeOrgSlug: nextOrg?.slug ?? null,
+          activeOrgName: nextOrg?.name ?? null,
+        });
+        // Keep Better-Auth's active org in sync so subsequent /v1/org/* requests
+        // resolve against `next` instead of whatever the session picked last.
+        // Mirrors the Solid flow (ac41d58b "feat(den): use Better Auth active
+        // org context").
+        if (next) {
+          await ensureDenActiveOrganization({ forceServerSync: true }).catch(
+            () => null,
+          );
+        }
+        if (!quiet && response.orgs.length > 0) {
+          showToast({
+            title: t("den.status_loaded_orgs", {
+              count: response.orgs.length,
+            }),
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        setOrgsError(error instanceof Error ? error.message : t("den.error_load_orgs"));
+      } finally {
+        setOrgsBusy(false);
+      }
+    },
+    [activeOrgId, authToken, baseUrl, client, showToast],
+  );
+
+  React.useEffect(() => {
+    if (!user) return;
+    void refreshOrgs(true);
+  }, [refreshOrgs, user]);
+
+  // Workers query candidate: workers, workersBusy, workersError
+  const refreshWorkers = React.useCallback(
+    async (quiet = false) => {
+      const orgId = activeOrgId.trim();
+      if (!authToken.trim() || !orgId) {
+        setWorkers([]);
+        return;
+      }
+
+      setWorkersBusy(true);
+      if (!quiet) setWorkersError(null);
+
+      try {
+        const nextWorkers = await client.listWorkers(orgId, 20);
+        setWorkers(nextWorkers);
+        if (!quiet) {
+          showToast({
+            title: nextWorkers.length > 0
+              ? t("den.status_loaded_workers", {
+                  count: nextWorkers.length,
+                  name: activeOrg?.name ?? t("den.active_org_title"),
+                })
+              : t("den.status_no_workers", {
+                  name: activeOrg?.name ?? t("den.active_org_title"),
+                }),
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        setWorkersError(error instanceof Error ? error.message : t("den.error_load_workers"));
+      } finally {
+        setWorkersBusy(false);
+      }
+    },
+    [activeOrg, activeOrgId, authToken, client, showToast],
+  );
+
+  React.useEffect(() => {
+    if (!user || !activeOrgId.trim()) return;
+    void refreshWorkers(true);
+  }, [activeOrgId, refreshWorkers, user]);
+
+  // Skill hubs query candidate: skillHubsBusy, skillHubActionError
+  const refreshSkillHubs = React.useCallback(
+    async (quiet = false) => {
+      const orgId = activeOrgId.trim();
+      if (!authToken.trim() || !orgId) return;
+
+      setSkillHubsBusy(true);
+      if (!quiet) setSkillHubActionError(null);
+
+      try {
+        syncCurrentDenSettings();
+        await props.extensions.refreshCloudOrgSkillHubs({ force: true });
+        if (!quiet) {
+          const count = props.extensions.cloudOrgSkillHubs().length;
+          showToast({
+            title: count > 0
+              ? `Loaded ${count} cloud skill hub${count === 1 ? "" : "s"} for ${activeOrg?.name ?? t("den.active_org_title")}.`
+              : `No cloud skill hubs are available for ${activeOrg?.name ?? t("den.active_org_title")}.`,
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        if (!quiet) {
+          setSkillHubActionError(
+            error instanceof Error ? error.message : "Failed to load cloud skill hubs.",
+          );
+        }
+      } finally {
+        setSkillHubsBusy(false);
+      }
+    },
+    [activeOrg, activeOrgId, authToken, props.extensions, syncCurrentDenSettings],
+  );
+
+  React.useEffect(() => {
+    if (!user || !activeOrgId.trim()) return;
+    void refreshSkillHubs(true);
+  }, [activeOrgId, refreshSkillHubs, user]);
+
+  // Skills query candidate: skillsBusy, skillActionError
+  const refreshSkills = React.useCallback(
+    async (quiet = false) => {
+      const orgId = activeOrgId.trim();
+      if (!authToken.trim() || !orgId) return;
+
+      setSkillsBusy(true);
+      if (!quiet) setSkillActionError(null);
+
+      try {
+        syncCurrentDenSettings();
+        await props.extensions.refreshCloudOrgSkills({ force: true });
+        if (!quiet) {
+          const count = props.extensions.cloudOrgSkills().length;
+          showToast({
+            title: count > 0
+              ? t("den.status_loaded_skills", {
+                  count,
+                  name: activeOrg?.name ?? t("den.active_org_title"),
+                })
+              : t("den.status_no_skills", {
+                  name: activeOrg?.name ?? t("den.active_org_title"),
+                }),
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        if (!quiet) {
+          setSkillActionError(error instanceof Error ? error.message : t("den.error_load_skills"));
+        }
+      } finally {
+        setSkillsBusy(false);
+      }
+    },
+    [activeOrg, activeOrgId, authToken, props.extensions, syncCurrentDenSettings],
+  );
+
+  React.useEffect(() => {
+    if (!user || !activeOrgId.trim()) return;
+    void refreshSkills(true);
+  }, [activeOrgId, refreshSkills, user]);
+
+  // Marketplaces query candidate: marketplacesBusy, pluginActionError
+  const refreshMarketplaces = React.useCallback(
+    async (quiet = false) => {
+      const orgId = activeOrgId.trim();
+      if (!authToken.trim() || !orgId) return;
+
+      setMarketplacesBusy(true);
+      if (!quiet) setPluginActionError(null);
+
+      try {
+        await props.extensions.refreshCloudOrgMarketplaces({ force: true });
+        if (!quiet) {
+          const count = props.extensions.cloudOrgMarketplaces().length;
+          showToast({
+            title: count > 0
+              ? `Loaded ${count} marketplace${count === 1 ? "" : "s"} for ${activeOrg?.name ?? t("den.active_org_title")}.`
+              : `No marketplaces are available for ${activeOrg?.name ?? t("den.active_org_title")}.`,
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        if (!quiet) {
+          setPluginActionError(error instanceof Error ? error.message : "Failed to load marketplaces.");
+        }
+      } finally {
+        setMarketplacesBusy(false);
+      }
+    },
+    [activeOrg, activeOrgId, authToken, props.extensions, showToast],
+  );
+
+  React.useEffect(() => {
+    if (!user || !activeOrgId.trim()) return;
+    void refreshMarketplaces(true);
+  }, [activeOrgId, refreshMarketplaces, user]);
+
+  // Providers query candidate: providersBusy, providerActionError
+  const refreshProviders = React.useCallback(
+    async (quiet = false) => {
+      const orgId = activeOrgId.trim();
+      if (!authToken.trim() || !orgId) return;
+
+      setProvidersBusy(true);
+      setProviderActionError(null);
+
+      try {
+        syncCurrentDenSettings();
+        const items = await props.refreshCloudOrgProviders({ force: !quiet });
+        if (!quiet) {
+          showToast({
+            title: items.length > 0
+              ? `Loaded ${items.length} cloud provider${items.length === 1 ? "" : "s"} for ${activeOrg?.name ?? t("den.active_org_title")}.`
+              : `No cloud providers are available for ${activeOrg?.name ?? t("den.active_org_title")}.`,
+            tone: "info",
+          });
+        }
+      } catch (error) {
+        if (!quiet) {
+          setProviderActionError(
+            error instanceof Error ? error.message : "Failed to load cloud providers.",
+          );
+        }
+      } finally {
+        setProvidersBusy(false);
+      }
+    },
+    [activeOrg, activeOrgId, authToken, props, syncCurrentDenSettings],
+  );
+
+  React.useEffect(() => {
+    if (!user || !activeOrgId.trim()) return;
+    void refreshProviders(true);
+  }, [activeOrgId, refreshProviders, user]);
+
+  // External auth handoff events
+  React.useEffect(() => {
+    const handler = (event: Event) => {
+      const customEvent = event as CustomEvent<DenSessionUpdatedDetail>;
+      const nextSettings = readDenSettings();
+      const nextBaseUrl =
+        customEvent.detail?.baseUrl?.trim() || nextSettings.baseUrl || DEFAULT_DEN_BASE_URL;
+      const nextToken =
+        customEvent.detail?.token?.trim() || nextSettings.authToken?.trim() || "";
+      setBaseUrl(nextBaseUrl);
+      setBaseUrlDraft(nextBaseUrl);
+      setAuthToken(nextToken);
+      setActiveOrgId(nextSettings.activeOrgId?.trim() || "");
+      if (customEvent.detail?.status === "success") {
+        clearSessionState();
+        if (customEvent.detail.user) {
+          setUser(customEvent.detail.user);
+        }
+        setAuthError(null);
+        setSessionBusy(false);
+        setStatusMessage(
+          customEvent.detail.email?.trim()
+            ? t("den.status_cloud_signed_in_as", { email: customEvent.detail.email.trim() })
+            : t("den.status_cloud_signin_done"),
+        );
+      } else if (customEvent.detail?.status === "error") {
+        setAuthError(customEvent.detail.message?.trim() || t("den.error_signin_failed"));
+      }
+    };
+
+    window.addEventListener(denSessionUpdatedEvent, handler as EventListener);
+    return () => window.removeEventListener(denSessionUpdatedEvent, handler as EventListener);
+  }, [clearSessionState]);
+
+  // Auth mutations: manual sign-in and sign-out
+  const submitManualAuth = React.useCallback(async (input: string) => {
+    const parsed = parseManualAuthInput(input);
+    if (!parsed || authBusy) {
+      if (!parsed) setAuthError(t("den.error_paste_valid_code"));
+      return false;
+    }
+
+    const nextBaseUrl = parsed.baseUrl ?? baseUrl;
+    setAuthBusy(true);
+    setAuthError(null);
+    setStatusMessage(t("den.signing_in"));
+
+    try {
+      const result = await createDenClient({ baseUrl: nextBaseUrl }).exchangeDesktopHandoff(parsed.grant);
+      if (!result.token) {
+        throw new Error(t("den.error_no_token"));
+      }
+
+      if (props.developerMode) {
+        setBaseUrl(nextBaseUrl);
+        setBaseUrlDraft(nextBaseUrl);
+      }
+
+      writeDenSettings({
+        baseUrl: nextBaseUrl,
+        authToken: result.token,
+        activeOrgId: null,
+        activeOrgSlug: null,
+        activeOrgName: null,
+      });
+
+      dispatchDenSessionUpdated({
+        status: "success",
+        baseUrl: nextBaseUrl,
+        token: result.token,
+        user: result.user,
+        email: result.user?.email ?? null,
+      });
+      return true;
+    } catch (error) {
+      dispatchDenSessionUpdated({
+        status: "error",
+        message: error instanceof Error ? error.message : t("den.error_signin_failed"),
+      });
+      return false;
+    } finally {
+      setAuthBusy(false);
+    }
+  }, [authBusy, baseUrl, props.developerMode]);
+
+  const signOut = React.useCallback(async () => {
+    if (authBusy) return;
+
+    setAuthBusy(true);
+    try {
+      if (authToken.trim()) {
+        await client.signOut();
+      }
+    } catch {
+      // Ignore remote sign-out failures.
+    } finally {
+      setAuthBusy(false);
+    }
+
+    clearSignedInState(t("den.status_signed_out"));
+  }, [authBusy, authToken, clearSignedInState, client]);
+
+  // Organization mutation: active org switch
+  const handleActiveOrgChange = React.useCallback(
+    (nextId: string) => {
+      const nextOrg = orgs.find((org) => org.id === nextId) ?? null;
+      setActiveOrgId(nextId);
+      writeDenSettings({
+        baseUrl,
+        authToken: authToken ? authToken : null,
+        activeOrgId: nextId ? nextId : null,
+        activeOrgSlug: nextOrg?.slug ?? null,
+        activeOrgName: nextOrg?.name ?? null,
+      });
+      // Sync Better-Auth's active org so the next request resolves against `nextId`.
+      if (nextId) {
+        void ensureDenActiveOrganization({
+          forceServerSync: true,
+        }).catch(() => null);
+      }
+      showToast({
+        title: t("den.org_switched", { name: nextOrg?.name ?? t("den.active_org_title") }),
+        tone: "success",
+      });
+    },
+    [authToken, baseUrl, orgs, showToast],
+  );
+
+  // Worker mutation: open remote workspace
+  const handleOpenWorker = React.useCallback(
+    async (workerId: string, workerName: string) => {
+      const orgId = activeOrgId.trim();
+      if (!orgId) {
+        setWorkersError(t("den.error_choose_org"));
+        return;
+      }
+
+      setOpeningWorkerId(workerId);
+      setWorkersError(null);
+
+      try {
+        const tokens = await client.getWorkerTokens(workerId, orgId);
+        const openworkUrl = tokens.openworkUrl?.trim() ?? "";
+        const accessToken = tokens.ownerToken?.trim() || tokens.clientToken?.trim() || "";
+        if (!openworkUrl || !accessToken) {
+          throw new Error(t("den.error_worker_not_ready"));
+        }
+
+        const ok = await props.connectRemoteWorkspace({
+          openworkHostUrl: openworkUrl,
+          openworkToken: accessToken,
+          directory: null,
+          displayName: workerName,
+        });
+        if (!ok) {
+          throw new Error(t("den.error_open_worker", { name: workerName }));
+        }
+
+        showToast({
+          title: t("den.status_opened_worker", { name: workerName }),
+          tone: "success",
+        });
+      } catch (error) {
+        setWorkersError(
+          error instanceof Error
+            ? error.message
+            : t("den.error_open_worker_fallback", { name: workerName }),
+        );
+      } finally {
+        setOpeningWorkerId(null);
+      }
+    },
+    [activeOrgId, client, props, showToast],
+  );
+
+  // Skill hub mutations
+  const handleImportSkillHub = React.useCallback(
+    async (hubId: string) => {
+      const hub = props.extensions.cloudOrgSkillHubs().find((entry) => entry.id === hubId);
+      if (!hub || skillHubActionId) return;
+
+      setSkillHubActionId(hub.id);
+      setSkillHubActionKind("import");
+      setSkillHubActionError(null);
+
+      try {
+        const result = await props.extensions.importCloudOrgSkillHub(hub);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillHubActionError(error instanceof Error ? error.message : `Failed to import ${hub.name}.`);
+      } finally {
+        setSkillHubActionId(null);
+        setSkillHubActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillHubActionId],
+  );
+
+  const handleRemoveSkillHub = React.useCallback(
+    async (hubId: string) => {
+      const imported = props.extensions.importedCloudSkillHubs()[hubId];
+      if (!imported || skillHubActionId) return;
+
+      setSkillHubActionId(hubId);
+      setSkillHubActionKind("remove");
+      setSkillHubActionError(null);
+
+      try {
+        const result = await props.extensions.removeCloudOrgSkillHub(hubId);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillHubActionError(error instanceof Error ? error.message : `Failed to remove ${imported.name}.`);
+      } finally {
+        setSkillHubActionId(null);
+        setSkillHubActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillHubActionId],
+  );
+
+  const handleSyncSkillHub = React.useCallback(
+    async (hubId: string) => {
+      const hub = props.extensions.cloudOrgSkillHubs().find((entry) => entry.id === hubId);
+      if (!hub || skillHubActionId) return;
+
+      setSkillHubActionId(hub.id);
+      setSkillHubActionKind("sync");
+      setSkillHubActionError(null);
+
+      try {
+        const result = await props.extensions.syncCloudOrgSkillHub(hub);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillHubActionError(error instanceof Error ? error.message : `Failed to sync ${hub.name}.`);
+      } finally {
+        setSkillHubActionId(null);
+        setSkillHubActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillHubActionId],
+  );
+
+  // Skill mutations
+  const handleImportSkill = React.useCallback(
+    async (cloudSkillId: string, title: string) => {
+      const skill = props.extensions.cloudOrgSkills().find((entry) => entry.id === cloudSkillId);
+      if (!skill || skillActionId) return;
+
+      setSkillActionId(cloudSkillId);
+      setSkillActionKind("import");
+      setSkillActionError(null);
+
+      try {
+        const result = await props.extensions.installCloudOrgSkill(skill);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillActionError(
+          error instanceof Error ? error.message : t("den.import_skill_failed", { name: title }),
+        );
+      } finally {
+        setSkillActionId(null);
+        setSkillActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillActionId],
+  );
+
+  const handleRemoveSkill = React.useCallback(
+    async (cloudSkillId: string, title: string) => {
+      if (skillActionId) return;
+
+      setSkillActionId(cloudSkillId);
+      setSkillActionKind("remove");
+      setSkillActionError(null);
+
+      try {
+        const result = await props.extensions.removeCloudOrgSkill(cloudSkillId);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillActionError(
+          error instanceof Error ? error.message : t("den.remove_skill_failed", { name: title }),
+        );
+      } finally {
+        setSkillActionId(null);
+        setSkillActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillActionId],
+  );
+
+  const handleSyncSkill = React.useCallback(
+    async (cloudSkillId: string, title: string) => {
+      const skill = props.extensions.cloudOrgSkills().find((entry) => entry.id === cloudSkillId);
+      if (!skill || skillActionId) return;
+
+      setSkillActionId(cloudSkillId);
+      setSkillActionKind("sync");
+      setSkillActionError(null);
+
+      try {
+        const result = await props.extensions.syncCloudOrgSkill(skill);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setSkillActionError(
+          error instanceof Error ? error.message : t("den.sync_skill_failed", { name: title }),
+        );
+      } finally {
+        setSkillActionId(null);
+        setSkillActionKind(null);
+      }
+    },
+    [props.extensions, showToast, skillActionId],
+  );
+
+  // Marketplace plugin mutations
+  const handleImportPlugin = React.useCallback(
+    async (marketplaceId: string | null, plugin: DenOrgPlugin) => {
+      if (pluginActionId) return;
+
+      setPluginActionId(plugin.id);
+      setPluginActionError(null);
+
+      try {
+        const result = await props.extensions.importCloudOrgPlugin(marketplaceId, plugin);
+        if (!result.ok) throw new Error(result.message);
+        showToast({ title: `${result.message} ${t("den.reload_workspace")}`, tone: "success" });
+      } catch (error) {
+        setPluginActionError(error instanceof Error ? error.message : `Failed to import ${plugin.name}.`);
+      } finally {
+        setPluginActionId(null);
+      }
+    },
+    [pluginActionId, props.extensions, showToast],
+  );
+
+  // Provider mutations
+  const handleImportProvider = React.useCallback(
+    async (cloudProviderId: string, providerName: string) => {
+      if (providerActionId) return;
+
+      setProviderActionId(cloudProviderId);
+      setProviderActionKind("import");
+      setProviderActionError(null);
+
+      try {
+        const message = await props.connectCloudProvider(cloudProviderId);
+        showToast({
+          title: `${message || t("den.imported_provider", { name: providerName })} ${t("den.reload_workspace")}`,
+          tone: "success",
+        });
+      } catch (error) {
+        setProviderActionError(
+          error instanceof Error ? error.message : t("den.import_provider_failed", { name: providerName }),
+        );
+      } finally {
+        setProviderActionId(null);
+        setProviderActionKind(null);
+      }
+    },
+    [props, providerActionId, showToast],
+  );
+
+  const handleRemoveProvider = React.useCallback(
+    async (cloudProviderId: string, providerName: string) => {
+      if (providerActionId) return;
+
+      setProviderActionId(cloudProviderId);
+      setProviderActionKind("remove");
+      setProviderActionError(null);
+
+      try {
+        const message = await props.removeCloudProvider(cloudProviderId);
+        showToast({
+          title: `${message || t("den.removed_provider", { name: providerName })} ${t("den.reload_workspace")}`,
+          tone: "success",
+        });
+      } catch (error) {
+        setProviderActionError(
+          error instanceof Error ? error.message : t("den.remove_provider_failed", { name: providerName }),
+        );
+      } finally {
+        setProviderActionId(null);
+        setProviderActionKind(null);
+      }
+    },
+    [props, providerActionId, showToast],
+  );
+
+  const handleSyncProvider = React.useCallback(
+    async (cloudProviderId: string, providerName: string) => {
+      if (providerActionId) return;
+
+      setProviderActionId(cloudProviderId);
+      setProviderActionKind("sync");
+      setProviderActionError(null);
+
+      try {
+        await props.connectCloudProvider(cloudProviderId);
+        showToast({
+          title: `${t("den.synced_provider", { name: providerName })} ${t("den.reload_workspace")}`,
+          tone: "success",
+        });
+      } catch (error) {
+        setProviderActionError(
+          error instanceof Error ? error.message : t("den.sync_provider_failed", { name: providerName }),
+        );
+      } finally {
+        setProviderActionId(null);
+        setProviderActionKind(null);
+      }
+    },
+    [props, providerActionId, showToast],
+  );
+
+  return (
+    <SettingsStack>
+      <Separator />
+
+      <SettingsSection>
+        <SettingsSectionHeader>
+          <SettingsSectionHeaderContent>
+            <SettingsSectionHeaderTitle>{t("den.cloud_section_title")}
+
+            <SettingsStatusBadge tone={summaryTone} label={summaryLabel} />
+
+            </SettingsSectionHeaderTitle>
+            <SettingsSectionHeaderDescription className="">
+              {t(isSignedIn ? "den.cloud_signed_in_desc" : "den.cloud_section_desc")}
+            </SettingsSectionHeaderDescription>
+            {!isSignedIn ? (
+              <SettingsSectionHeaderDescription className="text-xs">
+                {t("den.cloud_sleep_hint")}
+              </SettingsSectionHeaderDescription>
+            ) : null}
+          </SettingsSectionHeaderContent>
+        </SettingsSectionHeader>
+
+        {props.developerMode ? (
+          <CloudDevMode
+            authBusy={authBusy}
+            baseUrlDraft={baseUrlDraft}
+            onApplyBaseUrl={applyBaseUrl}
+            onBaseUrlDraftChange={setBaseUrlDraft}
+            onOpenControlPlane={openControlPlane}
+            onResetBaseUrl={() => setBaseUrlDraft(baseUrl)}
+            sessionBusy={sessionBusy}
+          />
+        ) : null}
+
+        {baseUrlError ? <SettingsNotice tone="error">{baseUrlError}</SettingsNotice> : null}
+
+        {statusMessage && !authError && !workersError && !orgsError && !pluginActionError ? (
+          <SettingsNotice>{statusMessage}</SettingsNotice>
+        ) : null}
+
+        {isSignedIn ? (
+          <>
+            <CloudAccountSection
+              activeOrgId={activeOrgId}
+              authBusy={authBusy}
+              orgs={orgs}
+              orgsBusy={orgsBusy}
+              orgsError={orgsError}
+              sessionBusy={sessionBusy}
+              user={user}
+              onActiveOrgChange={handleActiveOrgChange}
+              onRefreshOrgs={refreshOrgs}
+              onSignOut={signOut}
+            />
+          </>
+        ) : null}
+      </SettingsSection>
+
+      <Separator />
+
+
+      {!isSignedIn ? (
+        <DenSignedOutPanel
+          authBusy={authBusy}
+          authError={authError}
+          onClearAuthError={() => setAuthError(null)}
+          onOpenBrowserAuth={openBrowserAuth}
+          onSubmitManualAuth={submitManualAuth}
+          sessionBusy={sessionBusy}
+        />
+      ) : (
+        <div className="flex flex-col gap-y-8">
+          <CloudSkillsSection
+            actionError={skillActionError}
+            actionId={skillActionId}
+            actionKind={skillActionKind}
+            activeOrgName={activeOrgName}
+            busy={skillsBusy}
+            hasActiveOrg={Boolean(activeOrgId.trim())}
+            rows={skillRows}
+            statusError={props.extensions.cloudOrgSkillsStatus()}
+            onImportSkill={handleImportSkill}
+            onRefresh={refreshSkills}
+            onRemoveSkill={handleRemoveSkill}
+            onSyncSkill={handleSyncSkill}
+          />
+
+          <Separator />
+
+          <MarketplacePluginsSection
+            actionError={pluginActionError}
+            actionId={pluginActionId}
+            activeMarketplaceId={activeMarketplaceId}
+            activeOrgName={activeOrgName}
+            busy={marketplacesBusy}
+            hasActiveOrg={Boolean(activeOrgId.trim())}
+            marketplaces={liveMarketplaces}
+            rowsByMarketplace={marketplacePluginRows}
+            statusError={props.extensions.cloudOrgMarketplacesStatus()}
+            onImportPlugin={handleImportPlugin}
+            onRefresh={refreshMarketplaces}
+            onSelectMarketplace={setActiveMarketplaceId}
+          />
+
+          <Separator />
+
+          <CloudWorkersSection
+            activeOrgName={activeOrgName}
+            openingWorkerId={openingWorkerId}
+            refreshDisabled={[workersBusy, !activeOrgId.trim()].some(Boolean)}
+            workers={workers}
+            workersBusy={workersBusy}
+            workersError={workersError}
+            onOpenWorker={handleOpenWorker}
+            onRefreshWorkers={refreshWorkers}
+          />
+
+          <Separator />
+
+          <SkillHubsSection
+            actionError={skillHubActionError}
+            actionId={skillHubActionId}
+            actionKind={skillHubActionKind}
+            activeOrgName={activeOrgName}
+            busy={skillHubsBusy}
+            hasActiveOrg={Boolean(activeOrgId.trim())}
+            rows={skillHubRows}
+            statusError={props.extensions.cloudOrgSkillHubsStatus()}
+            onImport={handleImportSkillHub}
+            onRefresh={refreshSkillHubs}
+            onRemove={handleRemoveSkillHub}
+            onSync={handleSyncSkillHub}
+          />
+
+          <Separator />
+
+          <CloudProvidersSection
+            actionError={providerActionError}
+            actionId={providerActionId}
+            actionKind={providerActionKind}
+            activeOrgName={activeOrgName}
+            busy={providersBusy}
+            hasActiveOrg={Boolean(activeOrgId.trim())}
+            rows={providerRows}
+            onImport={handleImportProvider}
+            onRefresh={refreshProviders}
+            onRemove={handleRemoveProvider}
+            onSync={handleSyncProvider}
+          />
+        </div>
+      )}
+    </SettingsStack>
+  );
+}
+
+export default DenSettingsPanel;
diff --git a/apps/app/src/react-app/domains/settings/settings-list.tsx b/apps/app/src/react-app/domains/settings/settings-list.tsx
new file mode 100644
index 0000000000..ee93ae24b9
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/settings-list.tsx
@@ -0,0 +1,114 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+import { SettingsInset } from "./settings-section";
+import { SearchIcon } from "lucide-react"
+
+import {
+  Field,
+  FieldDescription,
+  FieldLabel,
+} from "@/components/ui/field"
+import {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
+} from "@/components/ui/input-group"
+
+export interface SettingsListProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsList({ children, className }: SettingsListProps) {
+  return <div className={cn("flex flex-col gap-y-2", className)}>{children}</div>;
+}
+
+interface SettingsListEmptyStateProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsListEmptyState({ children, className }: SettingsListEmptyStateProps) {
+  return (
+    <SettingsInset className={cn("border-dashed py-6 text-center text-sm text-muted-foreground", className)}>
+      {children}
+    </SettingsInset>
+  );
+}
+
+
+export interface SettingsListTitleProps {
+  children: React.ReactNode;
+}
+
+export function SettingsListTitle({ children }: SettingsListTitleProps) {
+  return <div className="flex flex-wrap items-center gap-2">{children}</div>;
+}
+
+export interface SettingsListItemTitleProps {
+  children: React.ReactNode;
+}
+
+export function SettingsListItemTitle({ children }: SettingsListItemTitleProps) {
+  return <span className="truncate font-medium text-dls-text">{children}</span>;
+}
+
+export interface SettingsListItemProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsListItem({ children, className }: SettingsListItemProps) {
+  return (
+    <div
+      className={cn(
+        "flex items-center justify-between rounded-xl px-3 py-2 text-left text-sm transition-colors hover:bg-muted/10 hover:border-border border border-transparent",
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+interface SettingsListItemContentProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsListItemContent({ children, className }: SettingsListItemContentProps) {
+  return <div className={cn("flex min-w-0 flex-col gap-y-1 pr-4", className)}>{children}</div>;
+}
+
+interface SettingsListItemActionsProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsListItemActions({ children, className }: SettingsListItemActionsProps) {
+  return <div className={cn("flex shrink-0 items-center gap-2", className)}>{children}</div>;
+}
+
+interface SettingsListItemDescriptionProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsListItemDescription({ children, className }: SettingsListItemDescriptionProps) {
+  return <div className={cn("mt-0.5 text-muted-foreground text-xs truncate", className)}>{children}</div>;
+}
+
+export function SettingsListSearchInput({
+  placeholder = "Search...",
+  ...props
+}: React.ComponentProps<"input">) {
+  return (
+    <InputGroup>
+      <InputGroupInput placeholder={placeholder} {...props} />
+      <InputGroupAddon align="inline-start">
+        <SearchIcon className="text-muted-foreground" />
+      </InputGroupAddon>
+    </InputGroup>
+  )
+}
diff --git a/apps/app/src/react-app/domains/settings/settings-section.tsx b/apps/app/src/react-app/domains/settings/settings-section.tsx
new file mode 100644
index 0000000000..44b125e991
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/settings-section.tsx
@@ -0,0 +1,178 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+import { RefreshCcw } from "lucide-react";
+import { cva } from "class-variance-authority";
+import { Button } from "@/components/ui/button";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
+
+type SettingsTone = "ready" | "warning" | "neutral" | "error";
+
+export interface SpinnerProps {
+  className?: string;
+  size?: number;
+  spinning?: boolean;
+}
+
+export function Spinner({
+  className,
+  size = 13,
+  spinning = true,
+}: SpinnerProps) {
+  return <RefreshCcw size={size} className={cn(spinning && "animate-spin", className)} />;
+}
+
+export interface RefreshButtonProps extends Omit<React.ComponentProps<typeof Button>, "onClick"> {
+  busy: boolean;
+  onRefresh: () => void | Promise<void>;
+}
+
+export function RefreshButton({
+  busy,
+  children,
+  className,
+  onRefresh,
+  ...props
+}: RefreshButtonProps) {
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={(
+          <Button
+            variant="ghost"
+            size="icon-sm"
+            className={cn("text-muted-foreground", className)}
+            onClick={() => void onRefresh()}
+            {...props}
+          >
+            <span className="sr-only">{children}</span>
+            <Spinner className="size-3.5" spinning={busy} />
+          </Button>
+        )}
+      />
+      <TooltipContent>{children}</TooltipContent>
+    </Tooltip>
+  );
+}
+
+export interface SettingsLayoutProps {
+  children: React.ReactNode;
+  className?: string;
+}
+
+export function SettingsStack({ children, className }: SettingsLayoutProps) {
+  return <div className={cn("flex w-full max-w-3xl flex-col gap-y-6", className)}>{children}</div>;
+}
+
+export function SettingsSection({ children, className }: SettingsLayoutProps) {
+  return (
+    <div className={cn("flex flex-col gap-6", className)}>
+      {children}
+    </div>
+  );
+}
+
+export function SettingsInset({ children, className }: SettingsLayoutProps) {
+  return (
+    <div className={cn("border border-dls-border rounded-2xl p-4", className)}>
+      {children}
+    </div>
+  );
+}
+
+
+export function SettingsPill({ children, className }: SettingsLayoutProps) {
+  return (
+    <span
+      className={cn(
+        "inline-flex items-center gap-1.5 rounded-full border border-dls-border bg-dls-hover px-2.5 py-1 text-xs font-medium text-muted-foreground",
+        className,
+      )}
+    >
+      {children}
+    </span>
+  );
+}
+
+const statusDotVariants = cva("", {
+  variants: {
+    tone: {
+      ready: "bg-green-9",
+      warning: "bg-amber-9",
+      error: "bg-red-9",
+      neutral: "bg-gray-8",
+    },
+  },
+});
+
+export interface SettingsStatusBadgeProps {
+  label: string;
+  tone: SettingsTone;
+  className?: string;
+}
+
+export function SettingsStatusBadge({ label, tone, className }: SettingsStatusBadgeProps) {
+  return (
+    <div
+      className={cn(
+        "flex min-h-8 items-center justify-start gap-2 text-center font-medium rounded-xl px-3 py-0 text-xs text-muted-foreground shrink-0",
+        className,
+      )}
+    >
+      <span className={cn("h-2 w-2 rounded-full", statusDotVariants({ tone }))} />
+      {label}
+    </div>
+  );
+}
+
+export interface SettingsNoticeProps extends SettingsLayoutProps {
+  tone?: "neutral" | "error";
+}
+
+export function SettingsNotice({
+  children,
+  tone = "neutral",
+  className,
+}: SettingsNoticeProps) {
+  return (
+    <div
+      className={cn(
+        "rounded-xl border border-dls-border bg-dls-hover px-3 py-2 text-xs text-muted-foreground",
+        tone === "error" && "border-red-7/30 bg-red-1/40 text-red-11",
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+export type SettingsSectionHeaderProps = SettingsLayoutProps;
+
+export function SettingsSectionHeader({ children, className }: SettingsSectionHeaderProps) {
+  return (
+    <div className={cn("flex flex-col gap-3 md:flex-row md:items-start justify-between", className)}>
+      {children}
+    </div>
+  );
+}
+
+export function SettingsSectionHeaderContent({ children, className }: SettingsLayoutProps) {
+  return <div className={cn("flex flex-col gap-1", className)}>{children}</div>;
+}
+
+export function SettingsSectionHeaderTitle({ children, className }: SettingsLayoutProps) {
+  return (
+    <div className={cn("flex items-center gap-2 text-base font-medium text-dls-text", className)}>
+      {children}
+    </div>
+  );
+}
+
+export function SettingsSectionHeaderDescription({ children, className }: SettingsLayoutProps) {
+  return <div className={cn("text-sm text-muted-foreground", className)}>{children}</div>;
+}
+
+export function SettingsSectionHeaderActions({ children, className }: SettingsLayoutProps) {
+  return <div className={cn("flex flex-wrap items-center gap-2", className)}>{children}</div>;
+}
diff --git a/apps/app/src/react-app/domains/settings/shell/panel.tsx b/apps/app/src/react-app/domains/settings/shell/panel.tsx
new file mode 100644
index 0000000000..087952aeb6
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/shell/panel.tsx
@@ -0,0 +1,123 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+import { RefreshCcw } from "lucide-react";
+
+import { cn } from "@/lib/utils";
+import { Button } from "../../../design-system/button";
+
+type SettingsContentProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsContent(props: SettingsContentProps) {
+  return <div className="min-w-0 min-h-0 flex-1 overflow-y-auto flex flex-col gap-8 p-8 items-center">{props.children}</div>;
+}
+
+type SettingsPanelProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsPanel(props: SettingsPanelProps) {
+  return (
+    <div
+      className={cn(
+        "flex flex-col gap-3 md:flex-row md:items-center md:justify-between lg:max-w-3xl w-full",
+      )}
+    >
+      {props.children}
+    </div>
+  );
+}
+
+type SettingsPanelHeadingProps = {
+  children: React.ReactNode;
+  className?: string;
+};
+
+export function SettingsPanelHeading(props: SettingsPanelHeadingProps) {
+  return <div className={cn("flex flex-col gap-y-1", props.className)}>{props.children}</div>;
+}
+
+type SettingsPanelTitleProps = {
+  children: React.ReactNode;
+  className?: string;
+};
+
+export function SettingsPanelTitle(props: SettingsPanelTitleProps) {
+  return <h2 className={cn("text-xl font-semibold tracking-tight", props.className)}>{props.children}</h2>;
+}
+
+type SettingsPanelDescriptionProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsPanelDescription(props: SettingsPanelDescriptionProps) {
+  return <p className="text-sm text-muted-foreground">{props.children}</p>;
+}
+
+type SettingsPanelToolbarProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsPanelToolbar(props: SettingsPanelToolbarProps) {
+  return <div className="mt-4 flex flex-col gap-y-2 md:mt-0 md:max-w-sm md:text-right">{props.children}</div>;
+}
+
+type SettingsPanelToolbarActionsProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsPanelToolbarActions(props: SettingsPanelToolbarActionsProps) {
+  return <div className="flex flex-wrap items-center gap-2 md:justify-end">{props.children}</div>;
+}
+
+type SettingsPanelToolbarStatusProps = {
+  tone?: string;
+  title?: string;
+  spinning?: boolean;
+  children: React.ReactNode;
+};
+
+export function SettingsPanelToolbarStatus(props: SettingsPanelToolbarStatusProps) {
+  return (
+    <div
+      className={cn(
+        "flex items-center gap-2 rounded-full border px-3 py-1.5 text-xs shadow-sm",
+        props.tone ?? "bg-gray-4/60 text-gray-11 border-gray-7/50",
+      )}
+      title={props.title}
+    >
+      {props.spinning ? <RefreshCcw size={12} className="animate-spin" /> : null}
+      <span className="tabular-nums whitespace-nowrap">{props.children}</span>
+    </div>
+  );
+}
+
+type SettingsPanelToolbarButtonProps = {
+  disabled?: boolean;
+  title?: string;
+  onClick?: () => void;
+  children: React.ReactNode;
+};
+
+export function SettingsPanelToolbarButton(props: SettingsPanelToolbarButtonProps) {
+  return (
+    <Button
+      variant="outline"
+      className="h-8 rounded-full border-gray-6/60 bg-gray-1/70 px-3 py-0 text-xs hover:bg-gray-2/70"
+      onClick={props.onClick}
+      disabled={props.disabled}
+      title={props.title}
+    >
+      {props.children}
+    </Button>
+  );
+}
+
+type SettingsPanelToolbarMessageProps = {
+  children: React.ReactNode;
+};
+
+export function SettingsPanelToolbarMessage(props: SettingsPanelToolbarMessageProps) {
+  return <div className="text-xs leading-relaxed text-amber-11/90 md:max-w-sm">{props.children}</div>;
+}
diff --git a/apps/app/src/react-app/domains/settings/shell/settings-page.tsx b/apps/app/src/react-app/domains/settings/shell/settings-page.tsx
new file mode 100644
index 0000000000..61689a0cb7
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/shell/settings-page.tsx
@@ -0,0 +1,240 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+import {
+  Bug,
+  Cloud,
+  Cog,
+  Paintbrush,
+  Puzzle,
+  RefreshCcw,
+  ShieldCheck,
+  Sparkles,
+  Terminal,
+  Wrench,
+} from "lucide-react";
+
+import {
+  Sidebar,
+  SidebarContent,
+  SidebarGroup,
+  SidebarGroupContent,
+  SidebarGroupLabel,
+  SidebarInset,
+  SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarProvider,
+} from "@/components/ui/sidebar";
+import { t } from "../../../../i18n";
+import type { SettingsTab } from "../../../../app/types";
+import {
+  SettingsContent,
+  SettingsPanel,
+  SettingsPanelDescription,
+  SettingsPanelHeading,
+  SettingsPanelTitle,
+  SettingsPanelToolbar,
+  SettingsPanelToolbarActions,
+  SettingsPanelToolbarButton,
+  SettingsPanelToolbarMessage,
+  SettingsPanelToolbarStatus,
+} from "./panel";
+
+export function getSettingsTabIcon(tab: SettingsTab) {
+  switch (tab) {
+    case "den":
+      return Cloud;
+    case "skills":
+      return Sparkles;
+    case "extensions":
+      return Puzzle;
+    case "environment":
+      return Terminal;
+    case "advanced":
+      return Wrench;
+    case "appearance":
+      return Paintbrush;
+    case "updates":
+      return RefreshCcw;
+    case "recovery":
+      return ShieldCheck;
+    case "debug":
+      return Bug;
+    default:
+      return Cog;
+  }
+}
+
+export function getSettingsTabLabel(tab: SettingsTab) {
+  switch (tab) {
+    case "den":
+      return t("settings.tab_cloud");
+    case "skills":
+      return t("settings.tab_skills");
+    case "extensions":
+      return t("settings.tab_extensions");
+    case "environment":
+      return t("settings.tab_environment");
+    case "advanced":
+      return t("settings.tab_advanced");
+    case "appearance":
+      return t("settings.tab_appearance");
+    case "updates":
+      return t("settings.tab_updates");
+    case "recovery":
+      return t("settings.tab_recovery");
+    case "debug":
+      return t("settings.tab_debug");
+    default:
+      return t("settings.tab_general");
+  }
+}
+
+export function getSettingsTabDescription(tab: SettingsTab) {
+  switch (tab) {
+    case "den":
+      return t("settings.tab_description_den");
+    case "skills":
+      return t("settings.tab_description_skills");
+    case "extensions":
+      return t("settings.tab_description_extensions");
+    case "environment":
+      return t("settings.tab_description_environment");
+    case "advanced":
+      return t("settings.tab_description_advanced");
+    case "appearance":
+      return t("settings.tab_description_appearance");
+    case "updates":
+      return t("settings.tab_description_updates");
+    case "recovery":
+      return t("settings.tab_description_recovery");
+    case "debug":
+      return t("settings.tab_description_debug");
+    default:
+      return t("settings.tab_description_general");
+  }
+}
+
+export function getWorkspaceSettingsTabs(): SettingsTab[] {
+  return ["general", "skills", "extensions", "advanced"];
+}
+
+export function getGlobalSettingsTabs(developerMode: boolean): SettingsTab[] {
+  const tabs: SettingsTab[] = ["den", "appearance", "environment", "updates", "recovery"];
+  if (developerMode) tabs.push("debug");
+  return tabs;
+}
+
+type SettingsPageProps = {
+  activeTab: SettingsTab;
+  onSelectTab: (tab: SettingsTab) => void;
+  developerMode: boolean;
+  showUpdateToolbar?: boolean;
+  updateToolbarTone?: string;
+  updateToolbarTitle?: string;
+  updateToolbarSpinning?: boolean;
+  updateToolbarLabel?: string;
+  updateToolbarActionLabel?: string | null;
+  updateToolbarDisabled?: boolean;
+  updateRestartBlockedMessage?: string | null;
+  onUpdateToolbarAction?: () => void;
+  children: React.ReactNode;
+};
+
+export function SettingsPage(props: SettingsPageProps) {
+  const workspaceTabs = getWorkspaceSettingsTabs();
+  const globalTabs = getGlobalSettingsTabs(props.developerMode);
+
+  return (
+    <SidebarProvider className="relative min-h-full min-w-0">
+        <Sidebar collapsible="none" className="absolute inset-0">
+          <SidebarContent>
+            <SidebarGroup>
+              <SidebarGroupLabel>{t("settings.group_workspace")}</SidebarGroupLabel>
+              <SidebarGroupContent>
+                <SidebarMenu>
+                  {workspaceTabs.map((tab) => {
+                    const Icon = getSettingsTabIcon(tab);
+                    return (
+                      <SidebarMenuItem key={tab}>
+                        <SidebarMenuButton
+                          type="button"
+                          isActive={props.activeTab === tab}
+                          onClick={() => props.onSelectTab(tab)}
+                        >
+                          <Icon />
+                          <span>{getSettingsTabLabel(tab)}</span>
+                        </SidebarMenuButton>
+                      </SidebarMenuItem>
+                    );
+                  })}
+                </SidebarMenu>
+              </SidebarGroupContent>
+            </SidebarGroup>
+
+            <SidebarGroup>
+              <SidebarGroupLabel>{t("settings.group_global")}</SidebarGroupLabel>
+              <SidebarGroupContent>
+                <SidebarMenu>
+                  {globalTabs.map((tab) => {
+                    const Icon = getSettingsTabIcon(tab);
+                    return (
+                      <SidebarMenuItem key={tab}>
+                        <SidebarMenuButton
+                          type="button"
+                          isActive={props.activeTab === tab}
+                          onClick={() => props.onSelectTab(tab)}
+                        >
+                          <Icon />
+                          <span>{getSettingsTabLabel(tab)}</span>
+                        </SidebarMenuButton>
+                      </SidebarMenuItem>
+                    );
+                  })}
+                </SidebarMenu>
+              </SidebarGroupContent>
+            </SidebarGroup>
+          </SidebarContent>
+        </Sidebar>
+
+        <SidebarInset className="h-full min-w-0 w-full max-w-full overflow-hidden">
+        <SettingsContent>
+          <SettingsPanel>
+            <SettingsPanelHeading>
+              <SettingsPanelTitle>{getSettingsTabLabel(props.activeTab)}</SettingsPanelTitle>
+              <SettingsPanelDescription>{getSettingsTabDescription(props.activeTab)}</SettingsPanelDescription>
+            </SettingsPanelHeading>
+
+            {props.showUpdateToolbar && props.activeTab === "general" ? (
+              <SettingsPanelToolbar>
+                <SettingsPanelToolbarActions>
+                  <SettingsPanelToolbarStatus
+                    tone={props.updateToolbarTone}
+                    title={props.updateToolbarTitle}
+                    spinning={props.updateToolbarSpinning}
+                  >
+                    {props.updateToolbarLabel}
+                  </SettingsPanelToolbarStatus>
+                  {props.updateToolbarActionLabel ? (
+                    <SettingsPanelToolbarButton
+                      onClick={props.onUpdateToolbarAction}
+                      disabled={props.updateToolbarDisabled}
+                      title={props.updateRestartBlockedMessage ?? ""}
+                    >
+                      {props.updateToolbarActionLabel}
+                    </SettingsPanelToolbarButton>
+                  ) : null}
+                </SettingsPanelToolbarActions>
+                {props.updateRestartBlockedMessage ? (
+                  <SettingsPanelToolbarMessage>{props.updateRestartBlockedMessage}</SettingsPanelToolbarMessage>
+                ) : null}
+              </SettingsPanelToolbar>
+            ) : null}
+          </SettingsPanel>
+
+          {props.children}
+        </SettingsContent>
+        </SidebarInset>
+    </SidebarProvider>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/shell/settings-shell.tsx b/apps/app/src/react-app/domains/settings/shell/settings-shell.tsx
new file mode 100644
index 0000000000..511f7e5cf0
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/shell/settings-shell.tsx
@@ -0,0 +1,106 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+import { X } from "lucide-react";
+
+import { Button } from "@/components/ui/button";
+import { t } from "../../../../i18n";
+import { SettingsPage, getSettingsTabLabel } from "./settings-page";
+import { WorkspaceSessionList } from "../../session/sidebar/workspace-session-list";
+
+type SettingsPageChromeProps = Omit<React.ComponentProps<typeof SettingsPage>, "children">;
+
+export type SettingsShellProps = SettingsPageChromeProps & {
+  selectedWorkspaceName: string;
+  headerStatus?: string;
+  busyHint?: string | null;
+  workspaceSessionListProps: React.ComponentProps<typeof WorkspaceSessionList>;
+  onClose: () => void;
+  sidebarTopSlot?: React.ReactNode;
+  headerLeadingSlot?: React.ReactNode;
+  sidebarWidth?: number;
+  onSidebarResizeStart?: React.PointerEventHandler<HTMLDivElement>;
+  children: React.ReactNode;
+  error?: string | null;
+  errorSlot?: React.ReactNode;
+  modalSlot?: React.ReactNode;
+  footer?: React.ReactNode;
+};
+
+export function SettingsShell(props: SettingsShellProps) {
+  const title = getSettingsTabLabel(props.activeTab);
+
+  return (
+    <div className="h-[100dvh] min-h-screen w-full overflow-hidden bg-[var(--dls-app-bg)] p-3 text-gray-12 md:p-4">
+      <div className="flex h-full w-full gap-3 md:gap-4">
+        <aside
+          className="relative hidden shrink-0 flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-sidebar p-2.5 lg:flex"
+          style={props.sidebarWidth ? { width: `${props.sidebarWidth}px`, minWidth: `${props.sidebarWidth}px` } : undefined}
+        >
+          {props.sidebarTopSlot ? <div className="shrink-0">{props.sidebarTopSlot}</div> : null}
+          <div className="flex min-h-0 flex-1">
+            <WorkspaceSessionList {...props.workspaceSessionListProps} />
+          </div>
+          {props.onSidebarResizeStart ? (
+            <div
+              className="absolute right-0 top-3 hidden h-[calc(100%-24px)] w-2 translate-x-1/2 cursor-col-resize rounded-full bg-transparent transition-colors hover:bg-gray-6/40 md:block"
+              onPointerDown={props.onSidebarResizeStart}
+              title={t("session.resize_workspace_column")}
+              aria-label={t("session.resize_workspace_column")}
+            />
+          ) : null}
+        </aside>
+
+        <main className="flex min-w-0 flex-1 flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface">
+          <header className="shrink-0 flex h-12 items-center justify-between border-b border-dls-border bg-dls-surface px-4 md:px-6">
+            <div className="flex min-w-0 items-center gap-3">
+              {props.headerLeadingSlot}
+              <h1 className="truncate text-[15px] font-semibold text-dls-text">{title}</h1>
+              <span className="hidden truncate text-[13px] text-dls-secondary lg:inline">
+                {props.selectedWorkspaceName}
+              </span>
+              {props.developerMode && props.headerStatus ? (
+                <span className="hidden text-[12px] text-dls-secondary lg:inline">
+                  {props.headerStatus}
+                </span>
+              ) : null}
+              {props.busyHint ? (
+                <span className="hidden text-[12px] text-dls-secondary lg:inline">
+                  {props.busyHint}
+                </span>
+              ) : null}
+            </div>
+            <div className="flex items-center text-gray-10">
+              <Button
+                variant="ghost"
+                type="button"
+                className="flex h-9 w-9 items-center justify-center rounded-md text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text"
+                onClick={props.onClose}
+                title={t("dashboard.close_settings")}
+                aria-label={t("dashboard.close_settings")}
+              >
+                <X size={18} />
+              </Button>
+            </div>
+          </header>
+
+          <div className="flex min-h-0 flex-1 flex-col">
+            <SettingsPage {...props}>{props.children}</SettingsPage>
+
+            {props.error ? (
+              <div className="mx-auto max-w-5xl px-6 pb-24 md:px-10 md:pb-10">
+                <div className="flex flex-col gap-y-3 rounded-2xl border border-red-7/20 bg-red-1/40 px-5 py-4 text-sm text-red-12">
+                  <div>{props.error}</div>
+                  {props.errorSlot}
+                </div>
+              </div>
+            ) : null}
+
+            {props.modalSlot}
+          </div>
+
+          {props.footer}
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/shell/tabs.tsx b/apps/app/src/react-app/domains/settings/shell/tabs.tsx
new file mode 100644
index 0000000000..ac634a3d8b
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/shell/tabs.tsx
@@ -0,0 +1,68 @@
+/** @jsxImportSource react */
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+type TabsSidebarProps = {
+  children: React.ReactNode;
+};
+
+export function TabsSidebar(props: TabsSidebarProps) {
+  return (
+    <aside className={cn("space-y-6 md:sticky md:top-4 md:self-start")}>{props.children}</aside>
+  );
+}
+
+type TabsGroupProps = {
+  children: React.ReactNode;
+};
+
+export function TabsGroup(props: TabsGroupProps) {
+  return (
+    <div className={cn("rounded-[24px] border border-dls-border bg-dls-sidebar p-3")}>
+      {props.children}
+    </div>
+  );
+}
+
+type TabsGroupTitleProps = {
+  children: React.ReactNode;
+};
+
+export function TabsGroupTitle(props: TabsGroupTitleProps) {
+  return (
+    <div className={cn("mb-2 px-2 text-[11px] font-medium uppercase tracking-[0.18em] text-gray-8")}>
+      {props.children}
+    </div>
+  );
+}
+
+type TabsListProps = {
+  children: React.ReactNode;
+};
+
+export function TabsList(props: TabsListProps) {
+  return <div className={cn("space-y-1")}>{props.children}</div>;
+}
+
+type TabsTriggerProps = {
+  active: boolean;
+  onSelect: () => void;
+  children: React.ReactNode;
+};
+
+export function TabsTrigger(props: TabsTriggerProps) {
+  return (
+    <button
+      type="button"
+      className={cn(
+        "flex w-full items-center justify-between rounded-xl px-3 py-2.5 text-left text-[13px] font-medium transition-colors text-gray-10 hover:bg-dls-surface/50 hover:text-dls-text",
+        props.active &&
+          "bg-dls-surface text-dls-text shadow-sm hover:bg-dls-surface hover:text-dls-text",
+      )}
+      onClick={props.onSelect}
+    >
+      <span>{props.children}</span>
+    </button>
+  );
+}
diff --git a/apps/app/src/react-app/domains/settings/state/debug-view-model.ts b/apps/app/src/react-app/domains/settings/state/debug-view-model.ts
new file mode 100644
index 0000000000..f36c6f86e9
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/debug-view-model.ts
@@ -0,0 +1,1141 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+
+import {
+  appBuildInfo as appBuildInfoCmd,
+  engineInfo as engineInfoCmd,
+  engineStart as engineStartCmd,
+  nukeOpenworkAndOpencodeConfigAndExit,
+  openDesktopUrl,
+  openworkServerInfo as openworkServerInfoCmd,
+  openworkServerRestart as openworkServerRestartCmd,
+  pickFile,
+  revealDesktopItemInDir,
+  resetOpenworkState,
+  sandboxDebugProbe as sandboxDebugProbeCmd,
+  updaterEnvironment as updaterEnvironmentCmd,
+  workspaceBootstrap as workspaceBootstrapCmd,
+  type AppBuildInfo,
+  type EngineInfo,
+  type OpenworkServerInfo,
+  type SandboxDebugProbeResult,
+} from "../../../../app/lib/desktop";
+import {
+  ELECTRON_ALPHA_RELEASE_PAGE_URL,
+  resolveElectronAlphaArtifact,
+  type ElectronAlphaArtifact,
+} from "../../../../app/lib/electron-alpha";
+import {
+  migrateToElectron,
+  writeMigrationSnapshotFromTauri,
+} from "../../../../app/lib/migration";
+import {
+  writeOpenworkServerSettings,
+} from "../../../../app/lib/openwork-server";
+import {
+  clearStartupPreference,
+  isDesktopRuntime,
+  isElectronRuntime,
+  isMacPlatform,
+  isTauriRuntime,
+  safeStringify,
+} from "../../../../app/utils";
+import { t } from "../../../../i18n";
+import type { DebugViewProps } from "../pages/debug-view";
+import type { ReleaseChannel } from "../../../../app/types";
+import type { OpenworkServerStore, OpenworkServerStoreSnapshot } from "../../connections/openwork-server-store";
+
+const STARTUP_PREFERENCE_KEY = "openwork.startupPreference";
+const ENGINE_SOURCE_KEY = "openwork.engineSource";
+const ENGINE_CUSTOM_BIN_KEY = "openwork.engineCustomBinPath";
+const OPENCODE_ENABLE_EXA_KEY = "openwork.opencodeEnableExa";
+
+type ResetModalMode = "onboarding" | "all";
+
+type UseDebugViewModelOptions = {
+  developerMode: boolean;
+  openworkServerStore: OpenworkServerStore;
+  openworkServerSnapshot: OpenworkServerStoreSnapshot;
+  runtimeWorkspaceId: string | null;
+  selectedWorkspaceRoot: string;
+  setRouteError: (value: string | null) => void;
+};
+
+function readStoredString(key: string, fallback: string): string {
+  if (typeof window === "undefined") return fallback;
+  try {
+    return window.localStorage.getItem(key) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+function writeStoredString(key: string, value: string): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(key, value);
+  } catch {
+    // ignore persistence failures
+  }
+}
+
+function clearStoredString(key: string): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.removeItem(key);
+  } catch {
+    // ignore persistence failures
+  }
+}
+
+function downloadTextAsFile(filename: string, content: string, mimeType: string) {
+  if (typeof window === "undefined") return;
+  const blob = new Blob([content], { type: mimeType });
+  const url = URL.createObjectURL(blob);
+  try {
+    const anchor = document.createElement("a");
+    anchor.href = url;
+    anchor.download = filename;
+    anchor.style.display = "none";
+    document.body.appendChild(anchor);
+    anchor.click();
+    anchor.remove();
+  } finally {
+    URL.revokeObjectURL(url);
+  }
+}
+
+function readEngineSource(): "path" | "sidecar" | "custom" {
+  const raw = readStoredString(ENGINE_SOURCE_KEY, "sidecar");
+  return raw === "path" || raw === "sidecar" || raw === "custom" ? raw : "sidecar";
+}
+
+function readOpencodeEnableExa(): boolean {
+  return readStoredString(OPENCODE_ENABLE_EXA_KEY, "0") === "1";
+}
+
+function statusPill(
+  running: boolean,
+  connectedLabel?: string,
+  disconnectedLabel?: string,
+): { label: string; className: string } {
+  return running
+    ? {
+        label: connectedLabel ?? t("status.connected"),
+        className: "border-green-7/30 bg-green-7/10 text-green-11",
+      }
+    : {
+        label: disconnectedLabel ?? t("status.disconnected_label"),
+        className: "border-gray-7/30 bg-gray-4/50 text-gray-11",
+      };
+}
+
+function auditStatusPill(status: "idle" | "loading" | "error"): {
+  label: string;
+  className: string;
+} {
+  if (status === "loading") {
+    return {
+      label: t("settings.loading"),
+      className: "border-blue-7/30 bg-blue-7/10 text-blue-11",
+    };
+  }
+  if (status === "error") {
+    return {
+      label: t("settings.error"),
+      className: "border-red-7/30 bg-red-7/10 text-red-11",
+    };
+  }
+  return {
+    label: t("settings.idle"),
+    className: "border-gray-7/30 bg-gray-4/50 text-gray-11",
+  };
+}
+
+function describeEngine(info: EngineInfo | null) {
+  const running = Boolean(info?.running);
+  return {
+    ...statusPill(running),
+    lines: [
+      t("settings.debug_base_url", undefined, { url: info?.baseUrl ?? "—" }),
+      t("settings.debug_runtime", undefined, { runtime: info?.runtime ?? "—" }),
+      t("settings.diag_opencode_binary", undefined, { binary: formatOpencodeBinary(info) }),
+      t("settings.debug_pid", undefined, { pid: info?.pid ? String(info.pid) : "—" }),
+      t("settings.debug_hostname", undefined, { hostname: info?.hostname ?? "—" }),
+      t("settings.debug_port", undefined, { port: info?.port ? String(info.port) : "—" }),
+    ],
+    stdout: info?.lastStdout ?? null,
+    stderr: info?.lastStderr ?? null,
+    error: null as string | null,
+  };
+}
+
+function formatOpencodeBinary(info: EngineInfo | null) {
+  return formatBinaryWithSource(info?.opencodeBinPath, info?.opencodeBinSource);
+}
+
+function formatManagedOpencodeBinary(info: OpenworkServerInfo | null) {
+  return formatBinaryWithSource(
+    info?.managedOpencodeBinPath,
+    info?.managedOpencodeBinSource,
+  );
+}
+
+function formatBinaryWithSource(path: string | null | undefined, source: string | null | undefined) {
+  const binary = path?.trim();
+  if (!binary) return "—";
+  const sourceLabel = source?.trim();
+  return sourceLabel ? `${binary} (${sourceLabel})` : binary;
+}
+
+function describeOpenworkServer(info: OpenworkServerInfo | null) {
+  const running = Boolean(info?.running);
+  return {
+    ...statusPill(running),
+    lines: [
+      t("settings.debug_base_url", undefined, { url: info?.baseUrl ?? "—" }),
+      t("settings.diag_opencode_binary", undefined, { binary: formatManagedOpencodeBinary(info) }),
+      t("settings.debug_connect_url", undefined, { url: info?.connectUrl ?? "—" }),
+      t("settings.debug_lan_url", undefined, { url: info?.lanUrl ?? "—" }),
+      t("settings.debug_mdns_url", undefined, { url: info?.mdnsUrl ?? "—" }),
+      t("settings.debug_pid", undefined, { pid: info?.pid ? String(info.pid) : "—" }),
+      t("settings.debug_remote_access", undefined, {
+        value: info?.remoteAccessEnabled ? t("settings.on") : t("settings.off"),
+      }),
+    ],
+    stdout: info?.lastStdout ?? null,
+    stderr: info?.lastStderr ?? null,
+    error: null as string | null,
+  };
+}
+
+function describeOpencodeConnect(engine: EngineInfo | null) {
+  const running = Boolean(engine?.baseUrl);
+  return {
+    ...statusPill(running),
+    lines: [
+      t("settings.debug_base_url", undefined, { url: engine?.baseUrl ?? "—" }),
+      t("settings.debug_project_dir", undefined, { path: engine?.projectDir ?? "—" }),
+      t("settings.debug_runtime", undefined, { runtime: engine?.runtime ?? "—" }),
+    ],
+    metricsLines: [] as string[],
+    error: null as string | null,
+  };
+}
+
+export function useDebugViewModel(options: UseDebugViewModelOptions) {
+  const {
+    developerMode,
+    openworkServerStore,
+    openworkServerSnapshot,
+    runtimeWorkspaceId,
+    selectedWorkspaceRoot,
+    setRouteError,
+  } = options;
+
+  const optionsRef = useRef(options);
+  optionsRef.current = options;
+
+  const [engineInfoState, setEngineInfoState] = useState<EngineInfo | null>(null);
+  const [appBuild, setAppBuild] = useState<AppBuildInfo | null>(null);
+  const [runtimeDebugStatus, setRuntimeDebugStatus] = useState<string | null>(null);
+  const [sandboxProbeBusy, setSandboxProbeBusy] = useState(false);
+  const [sandboxProbeResult, setSandboxProbeResult] = useState<SandboxDebugProbeResult | null>(null);
+  const [sandboxProbeStatus, setSandboxProbeStatus] = useState<string | null>(null);
+  const [opencodeRestarting, setOpencodeRestarting] = useState(false);
+  const [openworkServerRestarting, setOpenworkServerRestarting] = useState(false);
+  const [opencodeServiceStatus, setOpencodeServiceStatus] = useState<{
+    tone: "success" | "error";
+    message: string;
+  } | null>(null);
+  const [openworkServiceStatus, setOpenworkServiceStatus] = useState<{
+    tone: "success" | "error";
+    message: string;
+  } | null>(null);
+  const [opencodeLogStatus, setOpencodeLogStatus] = useState<string | null>(null);
+  const [openworkLogStatus, setOpenworkLogStatus] = useState<string | null>(null);
+  const [serviceRestartError, setServiceRestartError] = useState<string | null>(null);
+  const [resetModalBusy, setResetModalBusy] = useState(false);
+  const [nukeConfigBusy, setNukeConfigBusy] = useState(false);
+  const [nukeConfigStatus, setNukeConfigStatus] = useState<string | null>(null);
+  const [engineSource, setEngineSourceState] = useState<"path" | "sidecar" | "custom">(readEngineSource);
+  const [engineCustomBinPath, setEngineCustomBinPath] = useState<string>(() =>
+    readStoredString(ENGINE_CUSTOM_BIN_KEY, ""),
+  );
+  const [developerLog, setDeveloperLog] = useState<string[]>([]);
+  const [developerLogStatus, setDeveloperLogStatus] = useState<string | null>(null);
+  const [electronMigrationUrl, setElectronMigrationUrl] = useState("");
+  const [electronMigrationSha256, setElectronMigrationSha256] = useState("");
+  const [electronMigrationSha512, setElectronMigrationSha512] = useState("");
+  const [electronMigrationArtifact, setElectronMigrationArtifact] = useState<ElectronAlphaArtifact | null>(null);
+  const [electronMigrationBusy, setElectronMigrationBusy] = useState(false);
+  const [electronMigrationStatus, setElectronMigrationStatus] = useState<string | null>(null);
+  const [electronAlphaUpdaterBusy, setElectronAlphaUpdaterBusy] = useState(false);
+  const [electronAlphaUpdaterStatus, setElectronAlphaUpdaterStatus] = useState<string | null>(null);
+  const [electronAlphaUpdaterChannel, setElectronAlphaUpdaterChannel] = useState<ReleaseChannel>("stable");
+
+  const refreshEngineInfo = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    try {
+      const info = await engineInfoCmd();
+      setEngineInfoState(info);
+    } catch {
+      setEngineInfoState(null);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (!developerMode) return;
+    void (async () => {
+      if (!isDesktopRuntime()) return;
+      try {
+        const build = await appBuildInfoCmd();
+        setAppBuild(build);
+      } catch {
+        setAppBuild(null);
+      }
+    })();
+  }, [developerMode]);
+
+  useEffect(() => {
+    if (!developerMode) return;
+    void refreshEngineInfo();
+    const interval = window.setInterval(() => {
+      void refreshEngineInfo();
+    }, 10_000);
+    return () => window.clearInterval(interval);
+  }, [developerMode, refreshEngineInfo]);
+
+  const pushDeveloperLog = useCallback((message: string) => {
+    const timestamp = new Date().toISOString();
+    setDeveloperLog((current) => {
+      const next = [...current, `${timestamp} ${message}`];
+      return next.length > 500 ? next.slice(next.length - 500) : next;
+    });
+  }, []);
+
+  const runtimeSummary = useMemo(
+    () => ({
+      appVersionLabel: appBuild?.version ?? "—",
+      appCommitLabel: appBuild?.gitSha ?? "—",
+      opencodeVersionLabel: engineInfoState?.baseUrl ? "managed" : "—",
+      openworkServerVersionLabel: openworkServerSnapshot.openworkServerDiagnostics?.version ?? "—",
+    }),
+    [
+      appBuild?.gitSha,
+      appBuild?.version,
+      engineInfoState?.baseUrl,
+      openworkServerSnapshot.openworkServerDiagnostics?.version,
+    ],
+  );
+
+  const runtimeDebugReport = useMemo(() => {
+    return {
+      collectedAt: new Date().toISOString(),
+      app: appBuild ?? null,
+      engine: engineInfoState,
+      openworkServer: {
+        hostInfo: openworkServerSnapshot.openworkServerHostInfo,
+        diagnostics: openworkServerSnapshot.openworkServerDiagnostics,
+        capabilities: openworkServerSnapshot.openworkServerCapabilities,
+        settings: openworkServerSnapshot.openworkServerSettings,
+        status: openworkServerSnapshot.openworkServerStatus,
+        url: openworkServerSnapshot.openworkServerUrl,
+      },
+      runtimeWorkspaceId,
+      selectedWorkspaceRoot,
+    };
+  }, [
+    appBuild,
+    engineInfoState,
+    openworkServerSnapshot.openworkServerCapabilities,
+    openworkServerSnapshot.openworkServerDiagnostics,
+    openworkServerSnapshot.openworkServerHostInfo,
+    openworkServerSnapshot.openworkServerSettings,
+    openworkServerSnapshot.openworkServerStatus,
+    openworkServerSnapshot.openworkServerUrl,
+    runtimeWorkspaceId,
+    selectedWorkspaceRoot,
+  ]);
+
+  const runtimeDebugReportJson = useMemo(
+    () => safeStringify(runtimeDebugReport),
+    [runtimeDebugReport],
+  );
+
+  const engineCard = useMemo(() => describeEngine(engineInfoState), [engineInfoState]);
+  const openworkCard = useMemo(
+    () => describeOpenworkServer(openworkServerSnapshot.openworkServerHostInfo),
+    [openworkServerSnapshot.openworkServerHostInfo],
+  );
+  const opencodeConnectCard = useMemo(
+    () => describeOpencodeConnect(engineInfoState),
+    [engineInfoState],
+  );
+
+  const onCopyRuntimeDebugReport = useCallback(async () => {
+    try {
+      await navigator.clipboard.writeText(runtimeDebugReportJson);
+      setRuntimeDebugStatus(t("settings.copied_debug_report"));
+    } catch (error) {
+      setRuntimeDebugStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [runtimeDebugReportJson]);
+
+  const onExportRuntimeDebugReport = useCallback(async () => {
+    try {
+      downloadTextAsFile(
+        `openwork-runtime-${new Date().toISOString().replace(/[:.]/g, "-")}.json`,
+        runtimeDebugReportJson,
+        "application/json",
+      );
+      setRuntimeDebugStatus(t("settings.exported_debug_report"));
+    } catch (error) {
+      setRuntimeDebugStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [runtimeDebugReportJson]);
+
+  const onClearDeveloperLog = useCallback(() => {
+    setDeveloperLog([]);
+    setDeveloperLogStatus("Cleared developer log.");
+  }, []);
+
+  const onCopyDeveloperLog = useCallback(async () => {
+    try {
+      await navigator.clipboard.writeText(developerLog.join("\n"));
+      setDeveloperLogStatus("Copied developer log to clipboard.");
+    } catch (error) {
+      setDeveloperLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [developerLog]);
+
+  const onExportDeveloperLog = useCallback(async () => {
+    try {
+      downloadTextAsFile(
+        `openwork-developer-${new Date().toISOString().replace(/[:.]/g, "-")}.log`,
+        developerLog.join("\n"),
+        "text/plain",
+      );
+      setDeveloperLogStatus("Exported developer log.");
+    } catch (error) {
+      setDeveloperLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [developerLog]);
+
+  const onOpenElectronPreviewRelease = useCallback(async () => {
+    try {
+      await openDesktopUrl(ELECTRON_ALPHA_RELEASE_PAGE_URL);
+      setElectronMigrationStatus("Opened the rolling Electron alpha release. Download links live there after dev builds finish.");
+    } catch (error) {
+      setElectronMigrationStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, []);
+
+  const onSetElectronMigrationUrl = useCallback((value: string) => {
+    setElectronMigrationUrl(value);
+    setElectronMigrationArtifact(null);
+  }, []);
+
+  const onSetElectronMigrationSha512 = useCallback((value: string) => {
+    setElectronMigrationSha512(value);
+    setElectronMigrationArtifact(null);
+  }, []);
+
+  const electronMigrationArtifactLabel = useMemo(() => {
+    if (!electronMigrationArtifact) return null;
+    return `Resolved v${electronMigrationArtifact.version} (${electronMigrationArtifact.arch}) · ${electronMigrationArtifact.path}`;
+  }, [electronMigrationArtifact]);
+
+  const onResolveElectronAlphaArtifact = useCallback(async () => {
+    if (!isTauriRuntime()) {
+      setElectronMigrationStatus("Electron alpha migration resolution is only available in the Tauri desktop app.");
+      return;
+    }
+    if (!isMacPlatform()) {
+      setElectronMigrationStatus("Electron alpha migration is macOS-only for now.");
+      return;
+    }
+    setElectronMigrationBusy(true);
+    setElectronMigrationStatus(null);
+    try {
+      const artifact = await resolveElectronAlphaArtifact("arm64");
+      setElectronMigrationArtifact(artifact);
+      setElectronMigrationUrl(artifact.url);
+      setElectronMigrationSha512(artifact.sha512);
+      setElectronMigrationSha256("");
+      setElectronMigrationStatus(
+        `Resolved Electron alpha v${artifact.version} from latest-mac.yml. Review Advanced if you need to override the artifact URL.`,
+      );
+      pushDeveloperLog(`resolved Electron alpha artifact version=${artifact.version} path=${artifact.path}`);
+    } catch (error) {
+      setElectronMigrationStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setElectronMigrationBusy(false);
+    }
+  }, [pushDeveloperLog]);
+
+  const onRevealElectronMigrationBackup = useCallback(async () => {
+    if (!isTauriRuntime() && !isElectronRuntime()) {
+      setElectronMigrationStatus("Migration backup reveal is available only in the desktop app.");
+      return;
+    }
+    try {
+      const env = await updaterEnvironmentCmd();
+      const appBundlePath = env.appBundlePath?.trim();
+      if (!appBundlePath) {
+        setElectronMigrationStatus("Could not resolve the current OpenWork.app bundle path.");
+        return;
+      }
+      await revealDesktopItemInDir(`${appBundlePath}.migrate-bak`);
+      setElectronMigrationStatus("Requested Finder reveal for OpenWork.app.migrate-bak. The backup exists after an install handoff completes.");
+    } catch (error) {
+      setElectronMigrationStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, []);
+
+  const onPrepareElectronMigrationSnapshot = useCallback(async () => {
+    if (!isTauriRuntime()) {
+      setElectronMigrationStatus("Migration snapshot export is only available in the Tauri desktop app.");
+      return;
+    }
+    setElectronMigrationBusy(true);
+    setElectronMigrationStatus(null);
+    try {
+      const result = await writeMigrationSnapshotFromTauri();
+      if (!result.ok) {
+        throw new Error(result.reason ?? "Failed to write migration snapshot.");
+      }
+      setElectronMigrationStatus(
+        `Prepared Electron migration data (${result.keyCount} localStorage key${result.keyCount === 1 ? "" : "s"}). This did not replace or quit Tauri.`,
+      );
+      pushDeveloperLog(`prepared Electron migration snapshot keyCount=${result.keyCount}`);
+    } catch (error) {
+      setElectronMigrationStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setElectronMigrationBusy(false);
+    }
+  }, [pushDeveloperLog]);
+
+  const onInstallElectronPreviewFromTauri = useCallback(async () => {
+    if (!isTauriRuntime()) {
+      setElectronMigrationStatus("Electron install handoff is only available in the Tauri desktop app.");
+      return;
+    }
+
+    const url = electronMigrationUrl.trim();
+    if (!url) {
+      setElectronMigrationStatus("Paste a trusted Electron artifact URL before starting the install handoff.");
+      return;
+    }
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:") {
+        setElectronMigrationStatus("Electron artifact URLs must use https://.");
+        return;
+      }
+    } catch {
+      setElectronMigrationStatus("Paste a valid https:// Electron artifact URL before starting the install handoff.");
+      return;
+    }
+
+    const confirmed =
+      typeof window === "undefined" ||
+      window.confirm(
+        "This debug-only migration action first writes a migration snapshot, then starts the Tauri → Electron handoff. On macOS, the installer swaps OpenWork.app in place and keeps OpenWork.app.migrate-bak for rollback. Tauri stable updates remain unchanged. Continue?",
+      );
+    if (!confirmed) return;
+
+    const doubleConfirmed =
+      typeof window === "undefined" ||
+      window.confirm(
+        "Final confirmation: quit Tauri and start installing the resolved Electron alpha now? The current app bundle will be moved to OpenWork.app.migrate-bak before replacement.",
+      );
+    if (!doubleConfirmed) {
+      setElectronMigrationStatus("Install handoff cancelled before any app replacement step.");
+      return;
+    }
+
+    setElectronMigrationBusy(true);
+    setElectronMigrationStatus(null);
+    try {
+      const snapshot = await writeMigrationSnapshotFromTauri();
+      if (!snapshot.ok) {
+        throw new Error(snapshot.reason ?? "Failed to write migration snapshot.");
+      }
+      pushDeveloperLog(`prepared Electron migration snapshot before install keyCount=${snapshot.keyCount}`);
+      const result = await migrateToElectron({
+        url,
+        sha256: electronMigrationSha256.trim() || undefined,
+        sha512: electronMigrationSha512.trim() || undefined,
+      });
+      if (!result.ok) {
+        throw new Error(result.reason ?? "Electron install handoff failed.");
+      }
+      setElectronMigrationStatus("Electron install handoff started. Tauri will quit if the native handoff accepted the request.");
+    } catch (error) {
+      setElectronMigrationStatus(error instanceof Error ? error.message : safeStringify(error));
+      setElectronMigrationBusy(false);
+    }
+  }, [electronMigrationSha256, electronMigrationSha512, electronMigrationUrl, pushDeveloperLog]);
+
+  useEffect(() => {
+    if (!developerMode || !isElectronRuntime()) return;
+    const bridge = window.__OPENWORK_ELECTRON__?.updater;
+    if (!bridge?.getChannel) return;
+    let cancelled = false;
+    void bridge.getChannel()
+      .then((state) => {
+        if (cancelled) return;
+        setElectronAlphaUpdaterChannel(state.channel ?? "stable");
+      })
+      .catch(() => undefined);
+    return () => {
+      cancelled = true;
+    };
+  }, [developerMode]);
+
+  const onSetElectronAlphaUpdaterChannel = useCallback(async (channel: ReleaseChannel) => {
+    if (!isElectronRuntime()) {
+      setElectronAlphaUpdaterStatus("Electron updater channels are available only in the Electron desktop app.");
+      return;
+    }
+    if (channel === "alpha" && !isMacPlatform()) {
+      setElectronAlphaUpdaterStatus("Electron alpha updates are macOS-only for now.");
+      return;
+    }
+    const bridge = window.__OPENWORK_ELECTRON__?.updater;
+    if (!bridge?.setChannel) {
+      setElectronAlphaUpdaterStatus("Electron updater bridge is unavailable.");
+      return;
+    }
+    setElectronAlphaUpdaterBusy(true);
+    setElectronAlphaUpdaterStatus(null);
+    try {
+      const state = await bridge.setChannel(channel);
+      setElectronAlphaUpdaterChannel(state.channel ?? channel);
+      setElectronAlphaUpdaterStatus(
+        `Subscribed Electron updater to ${state.channel ?? channel} (${state.feedUrl}).`,
+      );
+      pushDeveloperLog(`set Electron updater channel=${state.channel ?? channel}`);
+    } catch (error) {
+      setElectronAlphaUpdaterStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setElectronAlphaUpdaterBusy(false);
+    }
+  }, [pushDeveloperLog]);
+
+  const onCheckElectronAlphaUpdates = useCallback(async () => {
+    if (!isElectronRuntime()) {
+      setElectronAlphaUpdaterStatus("Electron update checks are available only in the Electron desktop app.");
+      return;
+    }
+    const bridge = window.__OPENWORK_ELECTRON__?.updater;
+    if (!bridge?.check) {
+      setElectronAlphaUpdaterStatus("Electron updater bridge is unavailable.");
+      return;
+    }
+    setElectronAlphaUpdaterBusy(true);
+    setElectronAlphaUpdaterStatus(null);
+    try {
+      const result = await bridge.check();
+      if (result.channel) setElectronAlphaUpdaterChannel(result.channel);
+      if (result.reason === "unavailable") {
+        setElectronAlphaUpdaterStatus("Electron updater is available only in packaged Electron builds.");
+        return;
+      }
+      if (result.reason) {
+        setElectronAlphaUpdaterStatus(result.reason);
+        return;
+      }
+      setElectronAlphaUpdaterStatus(
+        result.available
+          ? `Update available: v${result.latestVersion ?? "unknown"} on ${result.channel ?? electronAlphaUpdaterChannel}. Use Settings → Updates to download and install.`
+          : `No Electron update available on ${result.channel ?? electronAlphaUpdaterChannel}.`,
+      );
+    } catch (error) {
+      setElectronAlphaUpdaterStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setElectronAlphaUpdaterBusy(false);
+    }
+  }, [electronAlphaUpdaterChannel]);
+
+  const onRunSandboxDebugProbe = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    setSandboxProbeBusy(true);
+    setSandboxProbeStatus(null);
+    try {
+      const result = await sandboxDebugProbeCmd();
+      setSandboxProbeResult(result);
+      setSandboxProbeStatus(
+        result.ready
+          ? t("settings.sandbox_probe_success")
+          : (result.error ?? t("settings.sandbox_error")),
+      );
+      pushDeveloperLog(`sandbox probe ready=${String(result.ready)}`);
+    } catch (error) {
+      setSandboxProbeStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setSandboxProbeBusy(false);
+    }
+  }, [pushDeveloperLog]);
+
+  const [startupStatus, setStartupStatus] = useState<string | null>(null);
+
+  const onStopHost = useCallback(async () => {
+    clearStartupPreference();
+    setStartupStatus(t("settings.startup_reset_hint"));
+  }, []);
+
+  const onResetStartupPreference = useCallback(async () => {
+    clearStartupPreference();
+    setStartupStatus(t("settings.startup_reset_hint"));
+  }, []);
+
+  const onSetEngineSource = useCallback((value: "path" | "sidecar" | "custom") => {
+    setEngineSourceState(value);
+    writeStoredString(ENGINE_SOURCE_KEY, value);
+  }, []);
+
+  const onPickEngineBinary = useCallback(async () => {
+    if (!isDesktopRuntime()) {
+      setServiceRestartError(t("settings.sandbox_requires_desktop"));
+      return;
+    }
+    try {
+      const target = await pickFile({ title: t("settings.custom_binary_label"), multiple: false });
+      if (typeof target === "string" && target.trim()) {
+        setEngineCustomBinPath(target);
+        writeStoredString(ENGINE_CUSTOM_BIN_KEY, target);
+      }
+    } catch (error) {
+      setServiceRestartError(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, []);
+
+  const onClearEngineCustomBinPath = useCallback(() => {
+    setEngineCustomBinPath("");
+    clearStoredString(ENGINE_CUSTOM_BIN_KEY);
+  }, []);
+
+  const bootFullEngineStack = useCallback(async () => {
+    const workspacePath = optionsRef.current.selectedWorkspaceRoot.trim();
+    if (!workspacePath) {
+      throw new Error(
+        "Select a local workspace before starting the local server/engine.",
+      );
+    }
+
+    // Collect ALL local workspace paths so openwork-server is started with
+    // --workspace <path> for every registered local workspace. Mirrors the
+    // Solid reference (context/workspace.ts::resolveWorkspacePaths) so that
+    // `client.listWorkspaces()` later returns the full set, not just the
+    // active one.
+    const workspacePaths = [workspacePath];
+    try {
+      const list = await workspaceBootstrapCmd();
+      for (const entry of list?.workspaces ?? []) {
+        if (entry.workspaceType === "remote") continue;
+        const path = entry.path?.trim() ?? "";
+        if (path && !workspacePaths.includes(path)) workspacePaths.push(path);
+      }
+    } catch {
+      // best-effort: fall back to just the active workspace path
+    }
+
+    const info = await engineStartCmd(workspacePath, {
+      runtime: "direct",
+      workspacePaths,
+      opencodeEnableExa: readOpencodeEnableExa(),
+      openworkRemoteAccess:
+        optionsRef.current.openworkServerSnapshot.openworkServerSettings
+          .remoteAccessEnabled === true,
+    });
+
+    // engine_start restarts openwork-server on a NEW port and lets that server
+    // manage OpenCode. Re-read host info and persist the fresh URL/token.
+    try {
+      const hostInfo = await openworkServerInfoCmd();
+      if (hostInfo?.baseUrl) {
+        writeOpenworkServerSettings({
+          urlOverride: hostInfo.baseUrl,
+          token: hostInfo.ownerToken?.trim() || hostInfo.clientToken?.trim() || undefined,
+          hostToken: hostInfo.hostToken?.trim() || undefined,
+          portOverride: hostInfo.port ?? undefined,
+          remoteAccessEnabled: hostInfo.remoteAccessEnabled === true,
+        });
+        if (typeof window !== "undefined") {
+          window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+        }
+      }
+    } catch {
+      // best-effort: if this fails, the host-info poller will catch up in ~10s.
+    }
+
+    await openworkServerStore.reconnectOpenworkServer();
+    await refreshEngineInfo();
+    return info;
+  }, [openworkServerStore, refreshEngineInfo]);
+
+  const onRestartOpencode = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    setOpencodeRestarting(true);
+    setOpencodeServiceStatus(null);
+    setServiceRestartError(null);
+    try {
+      await bootFullEngineStack();
+      setOpencodeServiceStatus({
+        tone: "success",
+        message: t("settings.restart_succeeded_template", undefined, { service: "OpenCode" }),
+      });
+      pushDeveloperLog("Restarted OpenCode via engine_start");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      setOpencodeServiceStatus({
+        tone: "error",
+        message: `${t("settings.restart_failed_template", undefined, { service: "OpenCode" })} ${message}`,
+      });
+      setServiceRestartError(message);
+    } finally {
+      setOpencodeRestarting(false);
+    }
+  }, [bootFullEngineStack, pushDeveloperLog]);
+
+  const onRestartOpenworkServer = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    setOpenworkServerRestarting(true);
+    setOpenworkServiceStatus(null);
+    setServiceRestartError(null);
+    try {
+      await openworkServerRestartCmd({
+        remoteAccessEnabled: openworkServerSnapshot.openworkServerSettings.remoteAccessEnabled === true,
+      });
+      setOpenworkServiceStatus({
+        tone: "success",
+        message: t("settings.restart_succeeded_template", undefined, { service: "OpenWork server" }),
+      });
+      pushDeveloperLog("Restarted openwork-server");
+      await openworkServerStore.reconnectOpenworkServer();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      setOpenworkServiceStatus({
+        tone: "error",
+        message: `${t("settings.restart_failed_template", undefined, { service: "OpenWork server" })} ${message}`,
+      });
+      setServiceRestartError(message);
+    } finally {
+      setOpenworkServerRestarting(false);
+    }
+  }, [
+    openworkServerSnapshot.openworkServerSettings.remoteAccessEnabled,
+    openworkServerStore,
+    pushDeveloperLog,
+  ]);
+
+  const formatServiceLogs = useCallback(
+    (stdout: string | null | undefined, stderr: string | null | undefined): string => {
+      const out = (stdout ?? "").toString().trim();
+      const err = (stderr ?? "").toString().trim();
+      const sections: string[] = [];
+      if (out) sections.push(`# stdout\n${out}`);
+      if (err) sections.push(`# stderr\n${err}`);
+      return sections.join("\n\n");
+    },
+    [],
+  );
+
+  const onCopyOpencodeLogs = useCallback(async () => {
+    const text = formatServiceLogs(engineInfoState?.lastStdout, engineInfoState?.lastStderr);
+    if (!text) {
+      setOpencodeLogStatus(t("settings.no_logs_captured"));
+      return;
+    }
+    try {
+      await navigator.clipboard.writeText(text);
+      setOpencodeLogStatus(t("settings.copied_service_logs", undefined, { service: "OpenCode" }));
+    } catch (error) {
+      setOpencodeLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [engineInfoState?.lastStderr, engineInfoState?.lastStdout, formatServiceLogs]);
+
+  const onExportOpencodeLogs = useCallback(async () => {
+    const text = formatServiceLogs(engineInfoState?.lastStdout, engineInfoState?.lastStderr);
+    if (!text) {
+      setOpencodeLogStatus(t("settings.no_logs_captured"));
+      return;
+    }
+    try {
+      downloadTextAsFile(
+        `openwork-opencode-${new Date().toISOString().replace(/[:.]/g, "-")}.log`,
+        text,
+        "text/plain",
+      );
+      setOpencodeLogStatus(t("settings.exported_developer_log"));
+    } catch (error) {
+      setOpencodeLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [engineInfoState?.lastStderr, engineInfoState?.lastStdout, formatServiceLogs]);
+
+  const onCopyOpenworkLogs = useCallback(async () => {
+    const info = openworkServerSnapshot.openworkServerHostInfo;
+    const text = formatServiceLogs(info?.lastStdout, info?.lastStderr);
+    if (!text) {
+      setOpenworkLogStatus(t("settings.no_logs_captured"));
+      return;
+    }
+    try {
+      await navigator.clipboard.writeText(text);
+      setOpenworkLogStatus(t("settings.copied_service_logs", undefined, { service: "OpenWork server" }));
+    } catch (error) {
+      setOpenworkLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [formatServiceLogs, openworkServerSnapshot.openworkServerHostInfo]);
+
+  const onExportOpenworkLogs = useCallback(async () => {
+    const info = openworkServerSnapshot.openworkServerHostInfo;
+    const text = formatServiceLogs(info?.lastStdout, info?.lastStderr);
+    if (!text) {
+      setOpenworkLogStatus(t("settings.no_logs_captured"));
+      return;
+    }
+    try {
+      downloadTextAsFile(
+        `openwork-server-${new Date().toISOString().replace(/[:.]/g, "-")}.log`,
+        text,
+        "text/plain",
+      );
+      setOpenworkLogStatus(t("settings.exported_developer_log"));
+    } catch (error) {
+      setOpenworkLogStatus(error instanceof Error ? error.message : safeStringify(error));
+    }
+  }, [formatServiceLogs, openworkServerSnapshot.openworkServerHostInfo]);
+
+  const [resetStatus, setResetStatus] = useState<string | null>(null);
+
+  const onOpenResetModal = useCallback(
+    (mode: ResetModalMode) => {
+      if (!isDesktopRuntime()) return;
+      const message =
+        mode === "all"
+          ? "Reset ALL OpenWork app data? Open sessions and workspaces will be removed."
+          : "Reset onboarding state only?";
+      if (typeof window !== "undefined" && !window.confirm(message)) {
+        return;
+      }
+      setResetModalBusy(true);
+      setResetStatus(null);
+      void resetOpenworkState(mode)
+        .then(() => {
+          setResetStatus(
+            mode === "all"
+              ? "Reset OpenWork state. Restart the app to see changes."
+              : "Reset onboarding state.",
+          );
+          pushDeveloperLog(`reset_openwork_state mode=${mode}`);
+        })
+        .catch((error) => {
+          setRouteError(error instanceof Error ? error.message : safeStringify(error));
+        })
+        .finally(() => {
+          setResetModalBusy(false);
+        });
+    },
+    [pushDeveloperLog, setRouteError],
+  );
+
+  const onNukeOpenworkAndOpencodeConfig = useCallback(async () => {
+    if (!isDesktopRuntime()) return;
+    const confirmed =
+      typeof window === "undefined"
+        ? true
+        : window.confirm(
+            "Delete ALL local OpenWork + OpenCode config and quit? This cannot be undone.",
+          );
+    if (!confirmed) return;
+    setNukeConfigBusy(true);
+    setNukeConfigStatus(null);
+    try {
+      await nukeOpenworkAndOpencodeConfigAndExit();
+    } catch (error) {
+      setNukeConfigStatus(error instanceof Error ? error.message : safeStringify(error));
+    } finally {
+      setNukeConfigBusy(false);
+    }
+  }, []);
+
+  const [workspaceDebugEventsStatus, setWorkspaceDebugEventsStatus] = useState<string | null>(null);
+  const onClearWorkspaceDebugEvents = useCallback(async () => {
+    setWorkspaceDebugEventsStatus("Workspace debug events are not retained in the React route yet.");
+  }, []);
+
+  const debugProps: DebugViewProps = useMemo(
+    () => ({
+      developerMode,
+      busy: false,
+      anyActiveRuns: false,
+      startupPreference: "server",
+      startupLabel:
+        openworkServerSnapshot.openworkServerStatus === "connected"
+          ? t("settings.openwork_server_label")
+          : t("status.disconnected_label"),
+      runtimeSummary,
+      runtimeDebugReportJson,
+      runtimeDebugStatus,
+      onCopyRuntimeDebugReport,
+      onExportRuntimeDebugReport,
+      developerLogRecordCount: developerLog.length,
+      developerLogText: developerLog.join("\n"),
+      developerLogStatus,
+      onClearDeveloperLog,
+      onCopyDeveloperLog,
+      onExportDeveloperLog,
+      electronMigrationAvailable: isTauriRuntime(),
+      electronMigrationUrl,
+      electronMigrationSha256,
+      electronMigrationSha512,
+      electronMigrationArtifactLabel,
+      electronMigrationBusy,
+      electronMigrationStatus,
+      electronPreviewReleaseUrl: ELECTRON_ALPHA_RELEASE_PAGE_URL,
+      onSetElectronMigrationUrl,
+      onSetElectronMigrationSha256: setElectronMigrationSha256,
+      onSetElectronMigrationSha512,
+      onOpenElectronPreviewRelease,
+      onResolveElectronAlphaArtifact,
+      onRevealElectronMigrationBackup,
+      onPrepareElectronMigrationSnapshot,
+      onInstallElectronPreviewFromTauri,
+      electronAlphaUpdaterAvailable: isElectronRuntime() && isMacPlatform(),
+      electronAlphaUpdaterBusy,
+      electronAlphaUpdaterStatus,
+      electronAlphaUpdaterChannel,
+      onSetElectronAlphaUpdaterChannel,
+      onCheckElectronAlphaUpdates,
+      sandboxProbeBusy,
+      sandboxProbeResult,
+      sandboxProbeStatus,
+      onRunSandboxDebugProbe,
+      onStopHost,
+      onResetStartupPreference,
+      engineSource,
+      onSetEngineSource,
+      engineCustomBinPath,
+      engineCustomBinPathLabel: engineCustomBinPath.trim() || t("settings.no_custom_path_set"),
+      onPickEngineBinary,
+      onClearEngineCustomBinPath,
+      onOpenResetModal,
+      resetModalBusy,
+      resetStatus,
+      startupStatus,
+      workspaceDebugEventsStatus,
+      opencodeRestarting,
+      openworkServerRestarting,
+      opencodeServiceStatus,
+      openworkServiceStatus,
+      opencodeLogStatus,
+      openworkLogStatus,
+      onCopyOpencodeLogs,
+      onExportOpencodeLogs,
+      onCopyOpenworkLogs,
+      onExportOpenworkLogs,
+      serviceRestartError,
+      onRestartOpencode,
+      onRestartOpenworkServer,
+      engineCard,
+      opencodeConnectCard,
+      openworkCard,
+      openworkServerDiagnostics: openworkServerSnapshot.openworkServerDiagnostics,
+      runtimeWorkspaceId,
+      openworkServerCapabilities: openworkServerSnapshot.openworkServerCapabilities,
+      pendingPermissions: {},
+      events: [],
+      workspaceDebugEvents: [],
+      safeStringify,
+      onClearWorkspaceDebugEvents,
+      openworkAuditEntries: openworkServerSnapshot.openworkAuditEntries,
+      openworkAuditStatus: auditStatusPill(openworkServerSnapshot.openworkAuditStatus),
+      openworkAuditError: openworkServerSnapshot.openworkAuditError,
+      opencodeConnectStatus: null,
+      opencodeDevModeEnabled: appBuild?.openworkDevMode === true,
+      nukeConfigBusy,
+      nukeConfigStatus,
+      onNukeOpenworkAndOpencodeConfig,
+    }),
+    [
+      appBuild?.openworkDevMode,
+      developerLog,
+      developerLogStatus,
+      developerMode,
+      electronMigrationBusy,
+      electronMigrationArtifactLabel,
+      electronMigrationSha256,
+      electronMigrationSha512,
+      electronMigrationStatus,
+      electronMigrationUrl,
+      electronAlphaUpdaterBusy,
+      electronAlphaUpdaterChannel,
+      electronAlphaUpdaterStatus,
+      engineCard,
+      engineCustomBinPath,
+      engineSource,
+      nukeConfigBusy,
+      nukeConfigStatus,
+      onClearDeveloperLog,
+      onClearEngineCustomBinPath,
+      onClearWorkspaceDebugEvents,
+      onCopyDeveloperLog,
+      onCopyRuntimeDebugReport,
+      onExportDeveloperLog,
+      onExportRuntimeDebugReport,
+      onInstallElectronPreviewFromTauri,
+      onCheckElectronAlphaUpdates,
+      onNukeOpenworkAndOpencodeConfig,
+      onOpenElectronPreviewRelease,
+      onOpenResetModal,
+      onPrepareElectronMigrationSnapshot,
+      onPickEngineBinary,
+      onResolveElectronAlphaArtifact,
+      onRevealElectronMigrationBackup,
+      onResetStartupPreference,
+      onRestartOpencode,
+      onRestartOpenworkServer,
+      onRunSandboxDebugProbe,
+      onSetElectronAlphaUpdaterChannel,
+      onSetElectronMigrationSha512,
+      onSetElectronMigrationUrl,
+      onSetEngineSource,
+      onStopHost,
+      onCopyOpencodeLogs,
+      onCopyOpenworkLogs,
+      onExportOpencodeLogs,
+      onExportOpenworkLogs,
+      opencodeConnectCard,
+      opencodeLogStatus,
+      opencodeRestarting,
+      opencodeServiceStatus,
+      openworkCard,
+      openworkLogStatus,
+      openworkServiceStatus,
+      openworkServerRestarting,
+      resetStatus,
+      startupStatus,
+      workspaceDebugEventsStatus,
+      openworkServerSnapshot.openworkAuditEntries,
+      openworkServerSnapshot.openworkAuditError,
+      openworkServerSnapshot.openworkAuditStatus,
+      openworkServerSnapshot.openworkServerCapabilities,
+      openworkServerSnapshot.openworkServerDiagnostics,
+      openworkServerSnapshot.openworkServerStatus,
+      resetModalBusy,
+      runtimeDebugReportJson,
+      runtimeDebugStatus,
+      runtimeSummary,
+      runtimeWorkspaceId,
+      sandboxProbeBusy,
+      sandboxProbeResult,
+      sandboxProbeStatus,
+      serviceRestartError,
+    ],
+  );
+
+  return debugProps;
+}
diff --git a/apps/app/src/react-app/domains/settings/state/electron-updater-state.ts b/apps/app/src/react-app/domains/settings/state/electron-updater-state.ts
new file mode 100644
index 0000000000..fd34e55c1e
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/electron-updater-state.ts
@@ -0,0 +1,366 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useRef, useState } from "react";
+
+import type { DenDesktopConfig } from "../../../../app/lib/den";
+import { isAlphaUpdateAllowed, isUpdateAllowed } from "../../../../app/lib/version-gate";
+import type { ReleaseChannel } from "../../../../app/types";
+import { isElectronRuntime, isTauriRuntime, safeStringify } from "../../../../app/utils";
+
+export type SettingsUpdateStatus = {
+  state: "idle" | "checking" | "available" | "downloading" | "ready" | "error";
+  lastCheckedAt?: number | null;
+  version?: string;
+  date?: string;
+  notes?: string;
+  totalBytes?: number | null;
+  downloadedBytes?: number;
+  message?: string;
+} | null;
+
+type ElectronUpdaterBridge = NonNullable<Window["__OPENWORK_ELECTRON__"]>["updater"] & {
+  onDownloadProgress?: (callback: (data: { transferred: number; total: number; percent: number; bytesPerSecond: number }) => void) => (() => void);
+};
+type TauriUpdate = {
+  version?: string;
+  date?: string;
+  body?: string;
+  downloadAndInstall?: (handler?: (event: unknown) => void) => Promise<void>;
+};
+
+type UseElectronUpdaterStateOptions = {
+  releaseChannel: ReleaseChannel;
+  onReleaseChannelChange: (next: ReleaseChannel) => void;
+  updateAutoDownload: boolean;
+  desktopConfig: DenDesktopConfig | null | undefined;
+  setError: (message: string | null) => void;
+};
+
+function electronUpdaterBridge(): ElectronUpdaterBridge | null {
+  if (typeof window === "undefined") return null;
+  return window.__OPENWORK_ELECTRON__?.updater ?? null;
+}
+
+function describeError(error: unknown) {
+  if (error instanceof Error) return error.message;
+  const serialized = safeStringify(error);
+  return serialized && serialized !== "{}" ? serialized : String(error);
+}
+
+function releaseNotesToText(value: unknown): string | undefined {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    return value
+      .map((entry) => {
+        if (typeof entry === "string") return entry;
+        if (entry && typeof entry === "object" && "note" in entry) {
+          return String((entry as { note?: unknown }).note ?? "");
+        }
+        return "";
+      })
+      .filter(Boolean)
+      .join("\n\n") || undefined;
+  }
+  return undefined;
+}
+
+function updateProgress(event: unknown): { downloaded?: number; total?: number } | null {
+  if (!event || typeof event !== "object") return null;
+  const data = event as { data?: unknown };
+  if (!data.data || typeof data.data !== "object") return null;
+  const payload = data.data as { chunkLength?: unknown; contentLength?: unknown };
+  return {
+    downloaded: typeof payload.chunkLength === "number" ? payload.chunkLength : undefined,
+    total: typeof payload.contentLength === "number" ? payload.contentLength : undefined,
+  };
+}
+
+export function useElectronUpdaterState(options: UseElectronUpdaterStateOptions) {
+  const { releaseChannel, onReleaseChannelChange, updateAutoDownload, desktopConfig, setError } = options;
+  const [updateStatus, setUpdateStatus] = useState<SettingsUpdateStatus>(null);
+  const [appVersion, setAppVersion] = useState<string | null>(null);
+  const [updateEnv, setUpdateEnv] = useState<{ supported?: boolean; reason?: string | null } | null>(null);
+  const tauriUpdateRef = useRef<TauriUpdate | null>(null);
+
+  useEffect(() => {
+    if (isTauriRuntime()) {
+      let cancelled = false;
+      void import("@tauri-apps/api/app")
+        .then(({ getVersion }) => getVersion())
+        .then((version) => {
+          if (!cancelled) setAppVersion(version ?? null);
+        })
+        .catch(() => undefined);
+      return () => {
+        cancelled = true;
+      };
+    }
+
+    if (!isElectronRuntime()) return;
+    const bridge = electronUpdaterBridge();
+    if (!bridge?.getChannel) {
+      setUpdateEnv({ supported: false, reason: "Electron updater bridge is unavailable." });
+      return;
+    }
+    let cancelled = false;
+    void bridge
+      .getChannel()
+      .then(async (state) => {
+        if (cancelled) return;
+        setAppVersion(state.currentVersion ?? null);
+        if (state.channel && state.channel !== releaseChannel && bridge.setChannel) {
+          const nextState = await bridge.setChannel(releaseChannel);
+          if (cancelled) return;
+          setAppVersion(nextState.currentVersion ?? null);
+          if (nextState.channel && nextState.channel !== releaseChannel) {
+            onReleaseChannelChange(nextState.channel);
+          }
+        }
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setUpdateEnv({ supported: false, reason: "Electron updater bridge is unavailable." });
+        }
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [onReleaseChannelChange, releaseChannel]);
+
+  const downloadUpdate = useCallback(async () => {
+    if (isTauriRuntime()) {
+      let update = tauriUpdateRef.current;
+      if (!update) {
+        const { check } = await import("@tauri-apps/plugin-updater");
+        update = (await check()) as TauriUpdate | null;
+        tauriUpdateRef.current = update;
+      }
+      if (!update?.downloadAndInstall) {
+        setUpdateStatus({ state: "idle", lastCheckedAt: Date.now() });
+        return;
+      }
+      const allowed = update.version
+        ? releaseChannel === "alpha"
+          ? await isAlphaUpdateAllowed(update.version, desktopConfig)
+          : await isUpdateAllowed(update.version, desktopConfig)
+        : true;
+      if (!allowed) {
+        tauriUpdateRef.current = null;
+        setUpdateStatus({ state: "idle", lastCheckedAt: Date.now() });
+        return;
+      }
+      let downloadedBytes = 0;
+      setUpdateStatus({
+        state: "downloading",
+        version: update.version,
+        date: update.date,
+        notes: update.body,
+        downloadedBytes: 0,
+        totalBytes: null,
+      });
+      await update.downloadAndInstall((event) => {
+        const progress = updateProgress(event);
+        if (!progress) return;
+        downloadedBytes += progress.downloaded ?? 0;
+        setUpdateStatus((current) => ({
+          ...(current ?? {}),
+          state: "downloading",
+          downloadedBytes,
+          totalBytes: progress.total ?? current?.totalBytes ?? null,
+        }));
+      });
+      setUpdateStatus((current) => ({
+        ...(current ?? {}),
+        state: "ready",
+        downloadedBytes,
+      }));
+      return;
+    }
+
+    const bridge = electronUpdaterBridge();
+    if (!bridge?.download) {
+      const message = "Electron updater downloads are available only in the Electron desktop app.";
+      setUpdateStatus({ state: "error", message });
+      setError(message);
+      return;
+    }
+
+    // Subscribe to incremental progress events from the main process so
+    // the UI updates in real time instead of staying stuck at 0 bytes.
+    let unsubProgress: (() => void) | null = null;
+    if (bridge.onDownloadProgress) {
+      unsubProgress = bridge.onDownloadProgress((data) => {
+        setUpdateStatus((current) => ({
+          ...(current ?? {}),
+          state: "downloading",
+          downloadedBytes: data.transferred ?? 0,
+          totalBytes: data.total ?? current?.totalBytes ?? null,
+        }));
+      });
+    }
+
+    setUpdateStatus((current) => ({
+      ...(current ?? {}),
+      state: "downloading",
+      downloadedBytes: current?.downloadedBytes ?? 0,
+      totalBytes: current?.totalBytes ?? null,
+    }));
+    try {
+      const result = await bridge.download();
+      if (!result?.ok) {
+        setUpdateStatus({ state: "error", message: result?.reason ?? "Update download failed." });
+        return;
+      }
+      setUpdateStatus((current) => ({
+        ...(current ?? {}),
+        state: "ready",
+      }));
+    } finally {
+      unsubProgress?.();
+    }
+  }, [desktopConfig, releaseChannel, setError]);
+
+  const checkForUpdates = useCallback(async () => {
+    if (isTauriRuntime()) {
+      setUpdateStatus({ state: "checking" });
+      try {
+        const { check } = await import("@tauri-apps/plugin-updater");
+        const update = (await check()) as TauriUpdate | null;
+        const allowed = !update?.version
+          ? true
+          : releaseChannel === "alpha"
+            ? await isAlphaUpdateAllowed(update.version, desktopConfig)
+            : await isUpdateAllowed(update.version, desktopConfig);
+        if (!allowed) {
+          tauriUpdateRef.current = null;
+          setUpdateStatus({ state: "idle", lastCheckedAt: Date.now() });
+          return;
+        }
+        tauriUpdateRef.current = update;
+        const nextStatus: Exclude<SettingsUpdateStatus, null> = update
+          ? {
+              state: "available",
+              lastCheckedAt: Date.now(),
+              version: update.version,
+              date: update.date,
+              notes: update.body,
+            }
+          : { state: "idle", lastCheckedAt: Date.now() };
+        setUpdateStatus(nextStatus);
+        if (update && updateAutoDownload) {
+          await downloadUpdate();
+        }
+      } catch (error) {
+        setUpdateStatus({ state: "error", message: describeError(error) });
+      }
+      return;
+    }
+
+    const bridge = electronUpdaterBridge();
+    if (!bridge?.check) {
+      const message = "Electron update checks are available only in the Electron desktop app.";
+      setUpdateStatus({ state: "error", message });
+      setError(message);
+      return;
+    }
+
+    setUpdateStatus({ state: "checking" });
+    try {
+      const result = await bridge.check();
+      setAppVersion(result.currentVersion ?? null);
+      if (result.channel && result.channel !== releaseChannel) {
+        onReleaseChannelChange(result.channel);
+      }
+      if (result.reason === "unavailable") {
+        setUpdateStatus({
+          state: "idle",
+          message: "Auto-updates are available in packaged builds only.",
+        });
+        return;
+      }
+      if (result.reason) {
+        setUpdateStatus({ state: "error", message: result.reason });
+        return;
+      }
+
+      const availableAllowed = result.available && result.latestVersion
+        ? releaseChannel === "alpha"
+          ? await isAlphaUpdateAllowed(result.latestVersion, desktopConfig)
+          : await isUpdateAllowed(result.latestVersion, desktopConfig)
+        : result.available;
+      const nextStatus: Exclude<SettingsUpdateStatus, null> = availableAllowed
+        ? {
+            state: "available",
+            lastCheckedAt: Date.now(),
+            version: result.latestVersion ?? undefined,
+            date: result.releaseDate ?? undefined,
+            notes: releaseNotesToText(result.releaseNotes),
+          }
+        : {
+            state: "idle",
+            lastCheckedAt: Date.now(),
+            version: result.latestVersion ?? undefined,
+            date: result.releaseDate ?? undefined,
+            notes: releaseNotesToText(result.releaseNotes),
+          };
+      setUpdateStatus(nextStatus);
+      if (availableAllowed && updateAutoDownload) {
+        await downloadUpdate();
+      }
+    } catch (error) {
+      setUpdateStatus({ state: "error", message: describeError(error) });
+    }
+  }, [desktopConfig, downloadUpdate, onReleaseChannelChange, releaseChannel, setError, updateAutoDownload]);
+
+  const installUpdateAndRestart = useCallback(async () => {
+    if (isTauriRuntime()) {
+      try {
+        const { relaunch } = await import("@tauri-apps/plugin-process");
+        await relaunch();
+      } catch (error) {
+        setUpdateStatus({ state: "error", message: describeError(error) });
+      }
+      return;
+    }
+
+    const bridge = electronUpdaterBridge();
+    if (!bridge?.installAndRestart) {
+      const message = "Electron update install is available only in the Electron desktop app.";
+      setUpdateStatus({ state: "error", message });
+      setError(message);
+      return;
+    }
+    const result = await bridge.installAndRestart();
+    if (!result?.ok) {
+      setUpdateStatus({ state: "error", message: result?.reason ?? "Update install failed." });
+    }
+  }, [setError]);
+
+  const setReleaseChannel = useCallback(
+    async (next: ReleaseChannel) => {
+      onReleaseChannelChange(next);
+      const bridge = electronUpdaterBridge();
+      if (!bridge?.setChannel) return;
+      try {
+        const state = await bridge.setChannel(next);
+        setAppVersion(state.currentVersion ?? null);
+        if (state.channel && state.channel !== next) {
+          onReleaseChannelChange(state.channel);
+        }
+        setUpdateStatus({ state: "idle", lastCheckedAt: null });
+      } catch (error) {
+        setUpdateStatus({ state: "error", message: describeError(error) });
+      }
+    },
+    [onReleaseChannelChange],
+  );
+
+  return {
+    appVersion,
+    updateEnv,
+    updateStatus,
+    checkForUpdates,
+    downloadUpdate,
+    installUpdateAndRestart,
+    setReleaseChannel,
+  };
+}
diff --git a/apps/app/src/react-app/domains/settings/state/extensions-store.ts b/apps/app/src/react-app/domains/settings/state/extensions-store.ts
new file mode 100644
index 0000000000..1e472fbdde
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/extensions-store.ts
@@ -0,0 +1,2532 @@
+import * as React from "react";
+
+import { applyEdits, modify } from "jsonc-parser";
+
+import { t } from "../../../../i18n";
+import type {
+  Client,
+  DenOrgSkillCard,
+  HubSkillCard,
+  HubSkillRepo,
+  PluginScope,
+  ReloadReason,
+  ReloadTrigger,
+  SkillCard,
+} from "../../../../app/types";
+import { addOpencodeCacheHint, isDesktopRuntime, normalizeDirectoryPath } from "../../../../app/utils";
+import skillCreatorTemplate from "../../../../app/data/skill-creator.md?raw";
+import {
+  isPluginInstalled,
+  loadPluginsFromConfig as loadPluginsFromConfigHelpers,
+  parsePluginListFromContent,
+  stripPluginVersion,
+} from "../../../../app/utils/plugins";
+import {
+  importSkill,
+  installSkillTemplate,
+  joinDesktopPath,
+  listLocalSkills,
+  openDesktopPath,
+  pickDirectory,
+  readLocalSkill,
+  readOpencodeConfig,
+  revealDesktopItemInDir,
+  uninstallSkill as uninstallSkillCommand,
+  workspaceOpenworkRead,
+  workspaceOpenworkWrite,
+  writeLocalSkill,
+  writeOpencodeConfig,
+  type OpencodeConfigFile,
+} from "../../../../app/lib/desktop";
+import type {
+  OpenworkHubRepo,
+  OpenworkServerCapabilities,
+  OpenworkServerClient,
+  OpenworkServerStatus,
+} from "../../../../app/lib/openwork-server";
+import {
+  createDenClient,
+  fetchDenOrgSkillsCatalog,
+  readDenSettings,
+  type DenOrgMarketplaceResolved,
+  type DenOrgPlugin,
+  type DenOrgPluginResolved,
+  type DenOrgSkillHub,
+} from "../../../../app/lib/den";
+import {
+  readWorkspaceCloudImports,
+  withWorkspaceCloudImports,
+  type CloudImportedPlugin,
+  type CloudImportedPluginFile,
+  type CloudImportedSkill,
+  type CloudImportedSkillHub,
+} from "../../../../app/cloud/import-state";
+import type { OpenworkServerStore } from "../../connections/openwork-server-store";
+
+const OPENCODE_SKILL_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const DEFAULT_HUB_REPO: HubSkillRepo = {
+  owner: "different-ai",
+  repo: "openwork-hub",
+  ref: "main",
+};
+const HUB_REPOS_STORAGE_KEY = "openwork.skills.hubRepos.v1";
+
+type SetStateAction<T> = T | ((current: T) => T);
+
+type PluginListEntry = {
+  name: string;
+  source: "config" | "dir.project" | "dir.global";
+  removable: boolean;
+};
+
+export type ExtensionsStoreSnapshot = {
+  workspaceContextKey: string;
+  skills: SkillCard[];
+  skillsStatus: string | null;
+  hubSkills: HubSkillCard[];
+  hubSkillsStatus: string | null;
+  cloudOrgSkills: DenOrgSkillCard[];
+  cloudOrgSkillsStatus: string | null;
+  importedCloudSkills: Record<string, CloudImportedSkill>;
+  cloudOrgSkillHubs: DenOrgSkillHub[];
+  cloudOrgSkillHubsStatus: string | null;
+  importedCloudSkillHubs: Record<string, CloudImportedSkillHub>;
+  cloudOrgMarketplaces: DenOrgMarketplaceResolved[];
+  cloudOrgMarketplacesStatus: string | null;
+  importedCloudPlugins: Record<string, CloudImportedPlugin>;
+  hubRepo: HubSkillRepo | null;
+  hubRepos: HubSkillRepo[];
+  pluginScope: PluginScope;
+  pluginConfig: OpencodeConfigFile | null;
+  pluginConfigPath: string | null;
+  pluginList: PluginListEntry[];
+  pluginInput: string;
+  pluginStatus: string | null;
+  activePluginGuide: string | null;
+  sidebarPluginList: string[];
+  sidebarPluginStatus: string | null;
+  skillsStale: boolean;
+  pluginsStale: boolean;
+  hubSkillsStale: boolean;
+  cloudOrgSkillsStale: boolean;
+};
+
+type MutableState = {
+  skillsContextKey: string;
+  pluginsContextKey: string;
+  hubSkillsContextKey: string;
+  cloudOrgSkillsContextKey: string;
+  skills: SkillCard[];
+  skillsStatus: string | null;
+  hubSkills: HubSkillCard[];
+  hubSkillsStatus: string | null;
+  cloudOrgSkills: DenOrgSkillCard[];
+  cloudOrgSkillsStatus: string | null;
+  importedCloudSkills: Record<string, CloudImportedSkill>;
+  cloudOrgSkillHubs: DenOrgSkillHub[];
+  cloudOrgSkillHubsStatus: string | null;
+  importedCloudSkillHubs: Record<string, CloudImportedSkillHub>;
+  cloudOrgMarketplaces: DenOrgMarketplaceResolved[];
+  cloudOrgMarketplacesStatus: string | null;
+  importedCloudPlugins: Record<string, CloudImportedPlugin>;
+  hubRepo: HubSkillRepo | null;
+  hubRepos: HubSkillRepo[];
+  pluginScope: PluginScope;
+  pluginConfig: OpencodeConfigFile | null;
+  pluginConfigPath: string | null;
+  pluginList: PluginListEntry[];
+  pluginInput: string;
+  pluginStatus: string | null;
+  activePluginGuide: string | null;
+  sidebarPluginList: string[];
+  sidebarPluginStatus: string | null;
+};
+
+export type ExtensionsStore = ReturnType<typeof createExtensionsStore>;
+
+function extractSkillBodyMarkdown(skillText: string): string {
+  const trimmed = skillText.trim();
+  if (!trimmed.startsWith("---")) return trimmed;
+  const rest = trimmed.slice(3);
+  const end = rest.indexOf("\n---");
+  if (end === -1) return trimmed;
+  return rest.slice(end + 4).replace(/^\s*\n?/, "");
+}
+
+function slugifyOpencodeSkillName(title: string): string {
+  let base = title
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  if (!base) base = "skill";
+  if (base.length > 64) base = base.slice(0, 64).replace(/-+$/g, "");
+  if (!OPENCODE_SKILL_NAME_RE.test(base)) base = "skill";
+  return base;
+}
+
+function uniqueSkillInstallName(base: string, taken: Set<string>, stableSuffix: string): string {
+  const suffixSource = stableSuffix.replace(/[^a-z0-9]+/g, "").slice(-8) || "org";
+  let candidate = base;
+  if (!taken.has(candidate)) return candidate;
+  for (let n = 1; n < 50; n += 1) {
+    const extra = `${suffixSource}${n}`;
+    const trimmedBase = base.slice(0, Math.max(1, 64 - extra.length - 1));
+    candidate = `${trimmedBase}-${extra}`.replace(/^-+|-+$/g, "").slice(0, 64);
+    if (OPENCODE_SKILL_NAME_RE.test(candidate) && !taken.has(candidate)) return candidate;
+  }
+  return `skill-${suffixSource}`.slice(0, 64);
+}
+
+function toConfigPluginListEntries(names: string[]): PluginListEntry[] {
+  const next: PluginListEntry[] = [];
+  const seen = new Set<string>();
+  for (const rawName of names) {
+    const name = rawName.trim();
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    next.push({ name, source: "config", removable: true });
+  }
+  return next;
+}
+
+function toProjectPluginListEntries(
+  items: Array<{ spec: string; source: string }>,
+): PluginListEntry[] {
+  const byName = new Map<string, PluginListEntry>();
+  for (const item of items) {
+    const name = item.spec.trim();
+    if (!name) continue;
+    const source: PluginListEntry["source"] =
+      item.source === "dir.project" || item.source === "dir.global"
+        ? item.source
+        : "config";
+    const entry: PluginListEntry = {
+      name,
+      source,
+      removable: source === "config",
+    };
+    const existing = byName.get(name);
+    if (!existing || (entry.removable && !existing.removable)) {
+      byName.set(name, entry);
+    }
+  }
+  return [...byName.values()];
+}
+
+export function createExtensionsStore(options: {
+  client: () => Client | null;
+  projectDir: () => string;
+  selectedWorkspaceId: () => string;
+  selectedWorkspaceRoot: () => string;
+  workspaceType: () => "local" | "remote";
+  openworkServer: OpenworkServerStore;
+  openworkServerConnection?: () => {
+    openworkServerClient: OpenworkServerClient | null;
+    openworkServerStatus: OpenworkServerStatus;
+    openworkServerCapabilities: OpenworkServerCapabilities | null;
+  };
+  runtimeWorkspaceId: () => string | null;
+  setBusy: (value: boolean) => void;
+  setBusyLabel: (value: string | null) => void;
+  setBusyStartedAt: (value: number | null) => void;
+  setError: (value: string | null) => void;
+  markReloadRequired?: (reason: ReloadReason, trigger?: ReloadTrigger) => void;
+}) {
+  const listeners = new Set<() => void>();
+
+  let disposed = false;
+  let started = false;
+  let stopOpenworkSubscription: (() => void) | null = null;
+  let stopDenSessionListener: (() => void) | null = null;
+  let lastWorkspaceContextKey = "";
+  let snapshot: ExtensionsStoreSnapshot;
+
+  let refreshSkillsInFlight = false;
+  let refreshPluginsInFlight = false;
+  let refreshHubSkillsInFlight = false;
+  let refreshCloudOrgSkillsInFlight = false;
+  let refreshCloudOrgSkillHubsInFlight = false;
+  let refreshCloudOrgMarketplacesInFlight = false;
+  let refreshSkillsAborted = false;
+  let refreshPluginsAborted = false;
+  let refreshHubSkillsAborted = false;
+  let refreshCloudOrgSkillsAborted = false;
+  let refreshCloudOrgSkillHubsAborted = false;
+  let refreshCloudOrgMarketplacesAborted = false;
+  let skillsLoaded = false;
+  let hubSkillsLoaded = false;
+  let cloudOrgSkillsLoaded = false;
+  let cloudOrgSkillHubsLoaded = false;
+  let cloudOrgMarketplacesLoaded = false;
+  let skillsRoot = "";
+  let hubSkillsLoadKey = "";
+  let cloudOrgSkillsLoadKey = "";
+  let cloudOrgSkillHubsLoadKey = "";
+  let cloudOrgMarketplacesLoadKey = "";
+
+  let state: MutableState = {
+    skillsContextKey: "",
+    pluginsContextKey: "",
+    hubSkillsContextKey: "",
+    cloudOrgSkillsContextKey: "",
+    skills: [],
+    skillsStatus: null,
+    hubSkills: [],
+    hubSkillsStatus: null,
+    cloudOrgSkills: [],
+    cloudOrgSkillsStatus: null,
+    importedCloudSkills: {},
+    cloudOrgSkillHubs: [],
+    cloudOrgSkillHubsStatus: null,
+    importedCloudSkillHubs: {},
+    cloudOrgMarketplaces: [],
+    cloudOrgMarketplacesStatus: null,
+    importedCloudPlugins: {},
+    hubRepo: DEFAULT_HUB_REPO,
+    hubRepos: [DEFAULT_HUB_REPO],
+    pluginScope: "project",
+    pluginConfig: null,
+    pluginConfigPath: null,
+    pluginList: [],
+    pluginInput: "",
+    pluginStatus: null,
+    activePluginGuide: null,
+    sidebarPluginList: [],
+    sidebarPluginStatus: null,
+  };
+
+  const emitChange = () => {
+    for (const listener of listeners) listener();
+  };
+
+  const getWorkspaceContextKey = () => {
+    const workspaceId = options.selectedWorkspaceId().trim();
+    const root = normalizeDirectoryPath(options.selectedWorkspaceRoot().trim());
+    const runtimeWorkspaceId = (options.runtimeWorkspaceId() ?? "").trim();
+    const workspaceType = options.workspaceType();
+    return `${workspaceType}:${workspaceId}:${root}:${runtimeWorkspaceId}`;
+  };
+
+  const getOpenworkServerSnapshot = () => {
+    const snapshot = options.openworkServer.getSnapshot();
+    const connection = options.openworkServerConnection?.();
+    if (!connection?.openworkServerClient) return snapshot;
+    return {
+      ...snapshot,
+      openworkServerClient: connection.openworkServerClient,
+      openworkServerStatus: connection.openworkServerStatus,
+      openworkServerCapabilities: connection.openworkServerCapabilities,
+    };
+  };
+
+  const refreshSnapshot = () => {
+    const workspaceContextKey = getWorkspaceContextKey();
+    const orgId = readDenSettings().activeOrgId?.trim() ?? "";
+    snapshot = {
+      workspaceContextKey,
+      skills: state.skills,
+      skillsStatus: state.skillsStatus,
+      hubSkills: state.hubSkills,
+      hubSkillsStatus: state.hubSkillsStatus,
+      cloudOrgSkills: state.cloudOrgSkills,
+      cloudOrgSkillsStatus: state.cloudOrgSkillsStatus,
+      importedCloudSkills: state.importedCloudSkills,
+      cloudOrgSkillHubs: state.cloudOrgSkillHubs,
+      cloudOrgSkillHubsStatus: state.cloudOrgSkillHubsStatus,
+      importedCloudSkillHubs: state.importedCloudSkillHubs,
+      cloudOrgMarketplaces: state.cloudOrgMarketplaces,
+      cloudOrgMarketplacesStatus: state.cloudOrgMarketplacesStatus,
+      importedCloudPlugins: state.importedCloudPlugins,
+      hubRepo: state.hubRepo,
+      hubRepos: state.hubRepos,
+      pluginScope: state.pluginScope,
+      pluginConfig: state.pluginConfig,
+      pluginConfigPath: state.pluginConfigPath,
+      pluginList: state.pluginList,
+      pluginInput: state.pluginInput,
+      pluginStatus: state.pluginStatus,
+      activePluginGuide: state.activePluginGuide,
+      sidebarPluginList: state.sidebarPluginList,
+      sidebarPluginStatus: state.sidebarPluginStatus,
+      skillsStale: state.skillsContextKey !== workspaceContextKey,
+      pluginsStale: state.pluginsContextKey !== workspaceContextKey,
+      hubSkillsStale: state.hubSkillsContextKey !== workspaceContextKey,
+      cloudOrgSkillsStale: state.cloudOrgSkillsContextKey !== `${workspaceContextKey}::${orgId}`,
+    };
+  };
+
+  const mutateState = (updater: (current: MutableState) => MutableState) => {
+    state = updater(state);
+    refreshSnapshot();
+    emitChange();
+  };
+
+  const setStateField = <K extends keyof MutableState>(key: K, value: MutableState[K]) => {
+    if (Object.is(state[key], value)) return;
+    mutateState((current) => ({ ...current, [key]: value }));
+  };
+
+  const applyStateAction = <T,>(current: T, next: SetStateAction<T>) =>
+    typeof next === "function" ? (next as (value: T) => T)(current) : next;
+
+  const formatSkillPath = (location: string) => location.replace(/[/\\]SKILL\.md$/i, "");
+
+  const normalizeHubRepo = (input?: Partial<HubSkillRepo> | null): HubSkillRepo | null => {
+    const owner = input?.owner?.trim() || "";
+    const repo = input?.repo?.trim() || "";
+    const ref = input?.ref?.trim() || DEFAULT_HUB_REPO.ref;
+    if (!owner || !repo) return null;
+    return { owner, repo, ref };
+  };
+
+  const hubRepoKey = (repo: HubSkillRepo) => `${repo.owner}/${repo.repo}@${repo.ref}`;
+
+  const normalizeHubRepoList = (items: unknown[]): HubSkillRepo[] => {
+    const seen = new Set<string>();
+    const next: HubSkillRepo[] = [];
+    for (const item of items) {
+      if (!item || typeof item !== "object") continue;
+      const record = item as Record<string, unknown>;
+      const normalized = normalizeHubRepo({
+        owner: typeof record.owner === "string" ? record.owner : undefined,
+        repo: typeof record.repo === "string" ? record.repo : undefined,
+        ref: typeof record.ref === "string" ? record.ref : undefined,
+      });
+      if (!normalized) continue;
+      const key = hubRepoKey(normalized);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      next.push(normalized);
+    }
+    return next;
+  };
+
+  const readWorkspaceOpenworkConfigRecord = async (): Promise<Record<string, unknown>> => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.config?.read;
+
+    if (canUseOpenworkServer) {
+      const config = await openworkClient.getConfig(openworkWorkspaceId);
+      return config.openwork ?? {};
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      return await workspaceOpenworkRead({ workspacePath: root }) as unknown as Record<string, unknown>;
+    }
+
+    return {};
+  };
+
+  const writeWorkspaceOpenworkConfigRecord = async (config: Record<string, unknown>) => {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.config?.write;
+
+    if (canUseOpenworkServer) {
+      await openworkClient.patchConfig(openworkWorkspaceId, { openwork: config });
+      return true;
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime() && root) {
+      const result = await workspaceOpenworkWrite({
+        workspacePath: root,
+        config: config as never,
+      });
+      if (!result.ok) {
+        throw new Error(result.stderr || result.stdout || "Failed to write .opencode/openwork.json");
+      }
+      return true;
+    }
+
+    return false;
+  };
+
+  const refreshImportedCloudSkillHubs = async () => {
+    try {
+      const config = await readWorkspaceOpenworkConfigRecord();
+      const cloudImports = readWorkspaceCloudImports(config);
+      setStateField("importedCloudSkillHubs", cloudImports.skillHubs);
+      return cloudImports.skillHubs;
+    } catch {
+      setStateField("importedCloudSkillHubs", {});
+      return {};
+    }
+  };
+
+  const refreshImportedCloudSkills = async () => {
+    try {
+      const config = await readWorkspaceOpenworkConfigRecord();
+      const cloudImports = readWorkspaceCloudImports(config);
+      setStateField("importedCloudSkills", cloudImports.skills);
+      return cloudImports.skills;
+    } catch {
+      setStateField("importedCloudSkills", {});
+      return {};
+    }
+  };
+
+  const refreshImportedCloudPlugins = async () => {
+    try {
+      const config = await readWorkspaceOpenworkConfigRecord();
+      const cloudImports = readWorkspaceCloudImports(config);
+      setStateField("importedCloudPlugins", cloudImports.plugins);
+      return cloudImports.plugins;
+    } catch {
+      setStateField("importedCloudPlugins", {});
+      return {};
+    }
+  };
+
+  const persistImportedCloudSkillHubs = async (nextSkillHubs: Record<string, CloudImportedSkillHub>) => {
+    const config = await readWorkspaceOpenworkConfigRecord();
+    const cloudImports = readWorkspaceCloudImports(config);
+    const nextConfig = withWorkspaceCloudImports(config, {
+      ...cloudImports,
+      skillHubs: nextSkillHubs,
+    });
+    const persisted = await writeWorkspaceOpenworkConfigRecord(nextConfig);
+    if (!persisted) {
+      throw new Error("OpenWork server unavailable. Connect to manage imported cloud skill hubs.");
+    }
+    setStateField("importedCloudSkillHubs", nextSkillHubs);
+  };
+
+  const persistImportedCloudSkills = async (nextSkills: Record<string, CloudImportedSkill>) => {
+    const config = await readWorkspaceOpenworkConfigRecord();
+    const cloudImports = readWorkspaceCloudImports(config);
+    const nextConfig = withWorkspaceCloudImports(config, {
+      ...cloudImports,
+      skills: nextSkills,
+    });
+    const persisted = await writeWorkspaceOpenworkConfigRecord(nextConfig);
+    if (!persisted) {
+      throw new Error("OpenWork server unavailable. Connect to manage imported cloud skills.");
+    }
+    setStateField("importedCloudSkills", nextSkills);
+  };
+
+  const persistImportedCloudPlugins = async (nextPlugins: Record<string, CloudImportedPlugin>) => {
+    const config = await readWorkspaceOpenworkConfigRecord();
+    const cloudImports = readWorkspaceCloudImports(config);
+    const nextConfig = withWorkspaceCloudImports(config, {
+      ...cloudImports,
+      plugins: nextPlugins,
+    });
+    const persisted = await writeWorkspaceOpenworkConfigRecord(nextConfig);
+    if (!persisted) {
+      throw new Error("OpenWork server unavailable. Connect to manage imported cloud plugins.");
+    }
+    setStateField("importedCloudPlugins", nextPlugins);
+  };
+
+  const buildCloudSkillContent = (name: string, description: string, body: string) => {
+    const safeDescription = description.replace(/\s+/g, " ").trim();
+    const normalizedBody = body.replace(/^\s*\n?/, "");
+    return [
+      "---",
+      `name: ${JSON.stringify(name)}`,
+      `description: ${JSON.stringify(safeDescription)}`,
+      "---",
+      "",
+      normalizedBody,
+    ].join("\n");
+  };
+
+  const upsertWorkspaceSkill = async (
+    name: string,
+    content: string,
+    description: string,
+    optionsOverride?: { overwrite?: boolean },
+  ) => {
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const root = options.selectedWorkspaceRoot().trim();
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.write;
+
+    if (canUseOpenworkServer) {
+      await openworkClient.upsertSkill(openworkWorkspaceId, {
+        name,
+        content,
+        description,
+      });
+      return;
+    }
+
+    if (isRemoteWorkspace) {
+      throw new Error("OpenWork server unavailable. Connect to import skills.");
+    }
+
+    if (!isDesktopRuntime()) {
+      throw new Error(t("skills.desktop_required"));
+    }
+
+    if (!isLocalWorkspace || !root) {
+      throw new Error(t("skills.pick_workspace_first"));
+    }
+
+    const result = await installSkillTemplate(root, name, content, {
+      overwrite: optionsOverride?.overwrite ?? false,
+    });
+    if (!result.ok) {
+      throw new Error(result.stderr || result.stdout || t("skills.install_failed"));
+    }
+  };
+
+  const buildImportedSkillNameMap = (imported?: CloudImportedSkillHub | null) => {
+    const mapping = new Map<string, string>();
+    if (!imported) return mapping;
+    imported.skillIds.forEach((skillId, index) => {
+      const name = imported.skillNames[index]?.trim();
+      if (skillId.trim() && name) {
+        mapping.set(skillId.trim(), name);
+      }
+    });
+    return mapping;
+  };
+
+  const findImportedCloudSkill = (cloudSkillId: string) => snapshot.importedCloudSkills[cloudSkillId] ?? null;
+
+  const persistImportedCloudSkillRecord = async (skill: DenOrgSkillCard, installedName: string) => {
+    const imported = findImportedCloudSkill(skill.id);
+    const nextSkills = {
+      ...snapshot.importedCloudSkills,
+      [skill.id]: {
+        cloudSkillId: skill.id,
+        installedName,
+        title: skill.title,
+        description: skill.description,
+        shared: skill.shared,
+        updatedAt: skill.updatedAt,
+        importedAt: imported?.importedAt ?? Date.now(),
+      },
+    } satisfies Record<string, CloudImportedSkill>;
+    await persistImportedCloudSkills(nextSkills);
+    return nextSkills[skill.id];
+  };
+
+  const deleteWorkspaceSkill = async (name: string) => {
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const root = options.selectedWorkspaceRoot().trim();
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.write;
+
+    if (canUseOpenworkServer) {
+      await openworkClient.deleteSkill(openworkWorkspaceId, name);
+      return;
+    }
+
+    if (isRemoteWorkspace) {
+      throw new Error("OpenWork server unavailable. Connect to remove skills.");
+    }
+
+    if (!isDesktopRuntime()) {
+      throw new Error(t("skills.desktop_required"));
+    }
+
+    if (!isLocalWorkspace || !root) {
+      throw new Error(t("skills.pick_workspace_first"));
+    }
+
+    const result = await uninstallSkillCommand(root, name);
+    if (!result.ok) {
+      throw new Error(result.stderr || result.stdout || t("skills.uninstall_failed"));
+    }
+  };
+
+  const applyCloudOrgSkillHubImport = async (hub: DenOrgSkillHub, imported?: CloudImportedSkillHub | null) => {
+    const importedNameMap = buildImportedSkillNameMap(imported);
+    const taken = new Set(snapshot.skills.map((skill) => skill.name));
+    imported?.skillNames.forEach((name) => {
+      if (name.trim()) taken.delete(name.trim());
+    });
+
+    const nextSkillNames: string[] = [];
+    const nextSkillIds: string[] = [];
+
+    for (const skill of hub.skills) {
+      const preferredName = importedNameMap.get(skill.id)?.trim() ?? "";
+      const installName =
+        preferredName && !nextSkillNames.includes(preferredName)
+          ? preferredName
+          : uniqueSkillInstallName(slugifyOpencodeSkillName(skill.title), taken, skill.id);
+      taken.add(installName);
+      nextSkillNames.push(installName);
+      nextSkillIds.push(skill.id);
+
+      const rawDesc = (skill.description?.trim() || skill.title).trim();
+      const description = rawDesc.slice(0, 1024) || skill.title.slice(0, 1024) || "Skill";
+      const body = extractSkillBodyMarkdown(skill.skillText);
+      const content = buildCloudSkillContent(installName, description, body);
+      await upsertWorkspaceSkill(installName, content, description, {
+        overwrite: Boolean(preferredName),
+      });
+    }
+
+    const removedSkillNames = (imported?.skillNames ?? []).filter((name) => !nextSkillNames.includes(name));
+    for (const name of removedSkillNames) {
+      await deleteWorkspaceSkill(name);
+    }
+
+    return { nextSkillNames, nextSkillIds, removedSkillNames };
+  };
+
+  const slugifyConfigObjectName = (title: string, fallback: string) => {
+    const slug = slugifyOpencodeSkillName(title || fallback);
+    return slug === "skill" && fallback ? slugifyOpencodeSkillName(fallback) : slug;
+  };
+
+  const pluginNamespace = (pluginName: string, pluginId: string) => {
+    const base = slugifyConfigObjectName(pluginName, pluginId);
+    return `${base.replace(/-plugin$/, "")}-plugin`;
+  };
+
+  const normalizePluginSourcePath = (path: string, objectType: string, namespace: string) => {
+    const parts = path.trim().replace(/^\/+/, "").split("/").filter(Boolean);
+    if (parts.length === 0 || parts.some((part) => part === ".." || part === ".")) return "";
+
+    const folderByType: Record<string, string> = {
+      agent: "agents",
+      command: "commands",
+      context: "context",
+      hook: "hooks",
+      mcp: "mcps",
+      skill: "skills",
+      tool: "tools",
+    };
+    const folder = folderByType[objectType];
+    if (!folder) return "";
+    const opencodeIndex = parts.findIndex((part) => part === ".opencode");
+    const searchParts = opencodeIndex >= 0 ? parts.slice(opencodeIndex + 1) : parts;
+    const folderIndex = searchParts.findIndex((part) => part === folder);
+    if (folderIndex < 0 || folderIndex === searchParts.length - 1) return "";
+    const rest = searchParts.slice(folderIndex + 1);
+    if (rest[0] === namespace) return [".opencode", folder, ...rest].join("/");
+    return [".opencode", folder, namespace, ...rest].join("/");
+  };
+
+  const getPluginObjectInstallPath = (
+    object: NonNullable<DenOrgPluginResolved["memberships"][number]["configObject"]>,
+    namespace: string,
+  ) => {
+    const existing = normalizePluginSourcePath(object.currentRelativePath ?? "", object.objectType, namespace);
+    if (existing) {
+      if (object.objectType === "skill" && !/\/SKILL\.md$/i.test(existing)) {
+        const skillName = existing.split("/").filter(Boolean).at(-1) ?? slugifyConfigObjectName(object.title, object.id);
+        return `.opencode/skills/${namespace}/${skillName}/SKILL.md`;
+      }
+      return existing;
+    }
+    const name = slugifyConfigObjectName(object.title, object.id);
+    switch (object.objectType) {
+      case "skill":
+        return `.opencode/skills/${namespace}/${name}/SKILL.md`;
+      case "agent":
+        return `.opencode/agents/${namespace}/${name}.md`;
+      case "command":
+        return `.opencode/commands/${namespace}/${name}.md`;
+      case "mcp":
+        return `.opencode/mcps/${namespace}/${name}.json`;
+      case "hook":
+        return `.opencode/hooks/${namespace}/${name}.json`;
+      case "tool":
+        return `.opencode/tools/${namespace}/${name}.ts`;
+      case "context":
+        return `.opencode/context/${namespace}/${name}.md`;
+      default:
+        return `.opencode/plugins/${namespace}/${name}.txt`;
+    }
+  };
+
+  const pluginReloadReason = (objectType: string): ReloadReason => {
+    switch (objectType) {
+      case "skill":
+        return "skills";
+      case "agent":
+        return "agents";
+      case "command":
+        return "commands";
+      case "mcp":
+        return "mcp";
+      default:
+        return "config";
+    }
+  };
+
+  const writePluginWorkspaceFile = async (path: string, content: string) => {
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    if (
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      typeof openworkClient.writeWorkspaceFile === "function"
+    ) {
+      await openworkClient.writeWorkspaceFile(openworkWorkspaceId, { path, content, force: true });
+      return;
+    }
+    throw new Error("OpenWork server unavailable. Connect to import plugin files into this workspace.");
+  };
+
+  const applyCloudOrgPluginImport = async (
+    marketplaceId: string | null,
+    resolved: DenOrgPluginResolved,
+  ): Promise<CloudImportedPluginFile[]> => {
+    const files: CloudImportedPluginFile[] = [];
+    const existing = snapshot.importedCloudPlugins[resolved.plugin.id];
+    const namespace = pluginNamespace(resolved.plugin.name, resolved.plugin.id);
+
+    for (const membership of resolved.memberships) {
+      const object = membership.configObject;
+      const version = object?.latestVersion ?? null;
+      if (!object || object.status !== "active" || version?.rawSourceText == null) continue;
+
+      const path = getPluginObjectInstallPath(object, namespace);
+      let content = version.rawSourceText;
+      if (object.objectType === "skill") {
+        const rawDesc = (object.description?.trim() || object.title).trim();
+        const description = rawDesc.slice(0, 1024) || object.title.slice(0, 1024) || "Skill";
+        const installName = path.match(/^\.opencode\/skills\/[^/]+\/([^/]+)\/SKILL\.md$/)?.[1] ?? slugifyConfigObjectName(object.title, object.id);
+        content = buildCloudSkillContent(installName, description, extractSkillBodyMarkdown(content));
+      }
+      await writePluginWorkspaceFile(path, content);
+
+      files.push({
+        configObjectId: object.id,
+        versionId: version.id,
+        objectType: object.objectType,
+        title: object.title,
+        path,
+        updatedAt: object.updatedAt,
+      });
+      options.markReloadRequired?.(pluginReloadReason(object.objectType), {
+        type:
+          object.objectType === "skill" || object.objectType === "agent" || object.objectType === "command" || object.objectType === "mcp"
+            ? object.objectType
+            : "config",
+        name: object.title,
+        action: existing ? "updated" : "added",
+      });
+    }
+
+    const nextPlugins = {
+      ...snapshot.importedCloudPlugins,
+      [resolved.plugin.id]: {
+        pluginId: resolved.plugin.id,
+        marketplaceId,
+        name: resolved.plugin.name,
+        description: resolved.plugin.description,
+        updatedAt: resolved.plugin.updatedAt,
+        files,
+        importedAt: existing?.importedAt ?? Date.now(),
+      },
+    } satisfies Record<string, CloudImportedPlugin>;
+    await persistImportedCloudPlugins(nextPlugins);
+    return files;
+  };
+
+  const persistHubRepos = () => {
+    if (typeof window === "undefined") return;
+    try {
+      window.localStorage.setItem(
+        HUB_REPOS_STORAGE_KEY,
+        JSON.stringify({ selected: state.hubRepo, repos: state.hubRepos }),
+      );
+    } catch {
+      // ignore
+    }
+  };
+
+  const invalidateWorkspaceCaches = () => {
+    skillsLoaded = false;
+    hubSkillsLoaded = false;
+    cloudOrgSkillsLoaded = false;
+    cloudOrgSkillHubsLoaded = false;
+    cloudOrgMarketplacesLoaded = false;
+    skillsRoot = "";
+    hubSkillsLoadKey = "";
+    cloudOrgSkillsLoadKey = "";
+    cloudOrgSkillHubsLoadKey = "";
+    cloudOrgMarketplacesLoadKey = "";
+  };
+
+  const touch = () => {
+    refreshSnapshot();
+    emitChange();
+  };
+
+  async function refreshHubSkills(optionsOverride?: { force?: boolean }) {
+    const root = options.selectedWorkspaceRoot().trim();
+    const repo = snapshot.hubRepo;
+    const loadKey = `${root}::${repo ? hubRepoKey(repo) : "none"}`;
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkSnapshot.openworkServerCapabilities?.hub?.skills?.read;
+
+    if (loadKey !== hubSkillsLoadKey) {
+      hubSkillsLoaded = false;
+    }
+
+    if (!optionsOverride?.force && hubSkillsLoaded) return;
+    if (refreshHubSkillsInFlight) return;
+
+    refreshHubSkillsInFlight = true;
+    refreshHubSkillsAborted = false;
+
+    try {
+      setStateField("hubSkillsStatus", null);
+
+      if (!repo) {
+        mutateState((current) => ({
+          ...current,
+          hubSkills: [],
+          hubSkillsStatus: "No hub repo selected. Add a GitHub repo to browse skills.",
+        }));
+        hubSkillsLoaded = true;
+        hubSkillsLoadKey = loadKey;
+        return;
+      }
+
+      if (canUseOpenworkServer) {
+        const response = await openworkClient.listHubSkills({
+          repo: {
+            owner: repo.owner,
+            repo: repo.repo,
+            ref: repo.ref,
+          },
+        });
+        if (refreshHubSkillsAborted) return;
+        const next: HubSkillCard[] = Array.isArray(response?.items)
+          ? response.items.map((entry) => ({
+              name: String(entry.name ?? ""),
+              description: typeof entry.description === "string" ? entry.description : undefined,
+              trigger: typeof entry.trigger === "string" ? entry.trigger : undefined,
+              source: entry.source,
+            }))
+          : [];
+        mutateState((current) => ({
+          ...current,
+          hubSkills: next,
+          hubSkillsStatus: next.length ? null : "No hub skills found.",
+          hubSkillsContextKey: getWorkspaceContextKey(),
+        }));
+        hubSkillsLoaded = true;
+        hubSkillsLoadKey = loadKey;
+        return;
+      }
+
+      const listingRes = await fetch(
+        `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`,
+        { headers: { Accept: "application/vnd.github+json" } },
+      );
+      if (!listingRes.ok) {
+        throw new Error(`Failed to fetch hub catalog (${listingRes.status})`);
+      }
+      const listing = (await listingRes.json()) as unknown;
+      const dirs: string[] = Array.isArray(listing)
+        ? listing
+            .filter((entry) => entry && typeof entry === "object" && (entry as { type?: string }).type === "dir")
+            .map((entry) => String((entry as { name?: string }).name ?? ""))
+            .filter(Boolean)
+        : [];
+
+      const next: HubSkillCard[] = dirs.map((dirName) => ({
+        name: dirName,
+        source: { owner: repo.owner, repo: repo.repo, ref: repo.ref, path: `skills/${dirName}` },
+      }));
+
+      if (refreshHubSkillsAborted) return;
+      const sorted = next.slice().sort((a, b) => a.name.localeCompare(b.name));
+      mutateState((current) => ({
+        ...current,
+        hubSkills: sorted,
+        hubSkillsStatus: sorted.length ? null : "No hub skills found.",
+        hubSkillsContextKey: getWorkspaceContextKey(),
+      }));
+      hubSkillsLoaded = true;
+      hubSkillsLoadKey = loadKey;
+    } catch (error) {
+      if (refreshHubSkillsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        hubSkills: [],
+        hubSkillsStatus: error instanceof Error ? error.message : "Failed to load hub skills.",
+      }));
+    } finally {
+      refreshHubSkillsInFlight = false;
+    }
+  }
+
+  async function refreshCloudOrgSkills(optionsOverride?: { force?: boolean }) {
+    const root = options.selectedWorkspaceRoot().trim();
+    const wk = getWorkspaceContextKey();
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const orgId = settings.activeOrgId?.trim() ?? "";
+    const loadKey = `${wk}::${orgId}`;
+
+    if (!root) {
+      mutateState((current) => ({
+        ...current,
+        cloudOrgSkills: [],
+        cloudOrgSkillsStatus: null,
+        cloudOrgSkillsContextKey: loadKey,
+      }));
+      cloudOrgSkillsLoaded = true;
+      cloudOrgSkillsLoadKey = loadKey;
+      return;
+    }
+
+    if (loadKey !== cloudOrgSkillsLoadKey) {
+      cloudOrgSkillsLoaded = false;
+    }
+
+    if (!optionsOverride?.force && cloudOrgSkillsLoaded) {
+      await refreshImportedCloudSkills();
+      return;
+    }
+    if (refreshCloudOrgSkillsInFlight) return;
+
+    refreshCloudOrgSkillsInFlight = true;
+    refreshCloudOrgSkillsAborted = false;
+
+    try {
+      setStateField("cloudOrgSkillsStatus", null);
+
+      if (!token || !orgId) {
+        mutateState((current) => ({
+          ...current,
+          cloudOrgSkills: [],
+          cloudOrgSkillsStatus: null,
+          cloudOrgSkillsContextKey: loadKey,
+        }));
+        cloudOrgSkillsLoaded = true;
+        cloudOrgSkillsLoadKey = loadKey;
+        await refreshImportedCloudSkills();
+        return;
+      }
+
+      const client = createDenClient({ baseUrl: settings.baseUrl, apiBaseUrl: settings.apiBaseUrl, token });
+      const catalog = await fetchDenOrgSkillsCatalog(client, orgId);
+      if (refreshCloudOrgSkillsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgSkills: catalog,
+        cloudOrgSkillsStatus: null,
+        cloudOrgSkillsContextKey: loadKey,
+      }));
+      cloudOrgSkillsLoaded = true;
+      cloudOrgSkillsLoadKey = loadKey;
+      await refreshImportedCloudSkills();
+    } catch (error) {
+      if (refreshCloudOrgSkillsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgSkills: [],
+        cloudOrgSkillsStatus:
+          error instanceof Error ? error.message : t("skills.cloud_org_load_failed"),
+      }));
+    } finally {
+      refreshCloudOrgSkillsInFlight = false;
+    }
+  }
+
+  async function refreshCloudOrgSkillHubs(optionsOverride?: { force?: boolean }) {
+    const wk = getWorkspaceContextKey();
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const orgId = settings.activeOrgId?.trim() ?? "";
+    const loadKey = `${wk}::${orgId}`;
+
+    if (loadKey !== cloudOrgSkillHubsLoadKey) {
+      cloudOrgSkillHubsLoaded = false;
+    }
+
+    if (!optionsOverride?.force && cloudOrgSkillHubsLoaded) {
+      await refreshImportedCloudSkillHubs();
+      return;
+    }
+    if (refreshCloudOrgSkillHubsInFlight) return;
+
+    refreshCloudOrgSkillHubsInFlight = true;
+    refreshCloudOrgSkillHubsAborted = false;
+
+    try {
+      setStateField("cloudOrgSkillHubsStatus", null);
+
+      if (!token || !orgId) {
+        mutateState((current) => ({
+          ...current,
+          cloudOrgSkillHubs: [],
+          cloudOrgSkillHubsStatus: null,
+        }));
+        cloudOrgSkillHubsLoaded = true;
+        cloudOrgSkillHubsLoadKey = loadKey;
+        await refreshImportedCloudSkillHubs();
+        return;
+      }
+
+      const client = createDenClient({ baseUrl: settings.baseUrl, apiBaseUrl: settings.apiBaseUrl, token });
+      const hubs = await client.listOrgSkillHubs(orgId);
+      if (refreshCloudOrgSkillHubsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgSkillHubs: hubs,
+        cloudOrgSkillHubsStatus: null,
+      }));
+      cloudOrgSkillHubsLoaded = true;
+      cloudOrgSkillHubsLoadKey = loadKey;
+      await refreshImportedCloudSkillHubs();
+    } catch (error) {
+      if (refreshCloudOrgSkillHubsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgSkillHubs: [],
+        cloudOrgSkillHubsStatus:
+          error instanceof Error ? error.message : "Failed to load organization skill hubs.",
+      }));
+    } finally {
+      refreshCloudOrgSkillHubsInFlight = false;
+    }
+  }
+
+  async function refreshCloudOrgMarketplaces(optionsOverride?: { force?: boolean }) {
+    const wk = getWorkspaceContextKey();
+    const settings = readDenSettings();
+    const token = settings.authToken?.trim() ?? "";
+    const orgId = settings.activeOrgId?.trim() ?? "";
+    const loadKey = `${wk}::${orgId}`;
+
+    if (loadKey !== cloudOrgMarketplacesLoadKey) {
+      cloudOrgMarketplacesLoaded = false;
+    }
+
+    if (!optionsOverride?.force && cloudOrgMarketplacesLoaded) {
+      await refreshImportedCloudPlugins();
+      return;
+    }
+    if (refreshCloudOrgMarketplacesInFlight) return;
+
+    refreshCloudOrgMarketplacesInFlight = true;
+    refreshCloudOrgMarketplacesAborted = false;
+
+    try {
+      setStateField("cloudOrgMarketplacesStatus", null);
+
+      if (!token || !orgId) {
+        mutateState((current) => ({
+          ...current,
+          cloudOrgMarketplaces: [],
+          cloudOrgMarketplacesStatus: null,
+        }));
+        cloudOrgMarketplacesLoaded = true;
+        cloudOrgMarketplacesLoadKey = loadKey;
+        await refreshImportedCloudPlugins();
+        return;
+      }
+
+      const client = createDenClient({ baseUrl: settings.baseUrl, apiBaseUrl: settings.apiBaseUrl, token });
+      const marketplaces = await client.listOrgMarketplaces(orgId);
+      const resolved = await Promise.all(
+        marketplaces.map((marketplace) => client.getOrgMarketplaceResolved(orgId, marketplace.id)),
+      );
+      if (refreshCloudOrgMarketplacesAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgMarketplaces: resolved,
+        cloudOrgMarketplacesStatus: null,
+      }));
+      cloudOrgMarketplacesLoaded = true;
+      cloudOrgMarketplacesLoadKey = loadKey;
+      await refreshImportedCloudPlugins();
+    } catch (error) {
+      if (refreshCloudOrgMarketplacesAborted) return;
+      mutateState((current) => ({
+        ...current,
+        cloudOrgMarketplaces: [],
+        cloudOrgMarketplacesStatus:
+          error instanceof Error ? error.message : "Failed to load organization marketplaces.",
+      }));
+    } finally {
+      refreshCloudOrgMarketplacesInFlight = false;
+    }
+  }
+
+  async function importCloudOrgPlugin(
+    marketplaceId: string | null,
+    plugin: DenOrgPlugin,
+  ): Promise<{ ok: boolean; message: string; files: CloudImportedPluginFile[] }> {
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("cloudOrgMarketplacesStatus", null);
+
+    try {
+      const settings = readDenSettings();
+      const token = settings.authToken?.trim() ?? "";
+      const orgId = settings.activeOrgId?.trim() ?? "";
+      if (!token || !orgId) throw new Error("Sign in to OpenWork Cloud and choose an organization first.");
+      const client = createDenClient({ baseUrl: settings.baseUrl, apiBaseUrl: settings.apiBaseUrl, token });
+      const resolved = await client.getOrgPluginResolved(orgId, plugin);
+      const files = await applyCloudOrgPluginImport(marketplaceId, resolved);
+      await refreshSkills({ force: true });
+      await refreshCloudOrgMarketplaces({ force: true });
+      return {
+        ok: true,
+        message: `Imported ${plugin.name} with ${files.length} file${files.length === 1 ? "" : "s"}.`,
+        files,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message, files: [] };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function importCloudOrgSkillHub(hub: DenOrgSkillHub): Promise<{ ok: boolean; message: string; importedNames: string[] }> {
+    const importedNames: string[] = [];
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      const applied = await applyCloudOrgSkillHubImport(hub, snapshot.importedCloudSkillHubs[hub.id]);
+      importedNames.push(...applied.nextSkillNames);
+      const nextImports = {
+        ...snapshot.importedCloudSkillHubs,
+        [hub.id]: {
+          hubId: hub.id,
+          name: hub.name,
+          skillNames: applied.nextSkillNames,
+          skillIds: applied.nextSkillIds,
+          importedAt: Date.now(),
+        },
+      };
+      await persistImportedCloudSkillHubs(nextImports);
+      options.markReloadRequired?.("skills", { type: "skill", name: hub.name, action: "added" });
+      await refreshSkills({ force: true });
+      await refreshCloudOrgSkills({ force: true });
+      await refreshCloudOrgSkillHubs({ force: true });
+      return {
+        ok: true,
+        message: `Imported ${hub.skills.length} skill${hub.skills.length === 1 ? "" : "s"} from ${hub.name}.`,
+        importedNames,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message, importedNames };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function syncCloudOrgSkillHub(hub: DenOrgSkillHub): Promise<{ ok: boolean; message: string; importedNames: string[] }> {
+    const imported = snapshot.importedCloudSkillHubs[hub.id];
+    if (!imported) return importCloudOrgSkillHub(hub);
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      const applied = await applyCloudOrgSkillHubImport(hub, imported);
+      const nextImports = {
+        ...snapshot.importedCloudSkillHubs,
+        [hub.id]: {
+          hubId: hub.id,
+          name: hub.name,
+          skillNames: applied.nextSkillNames,
+          skillIds: applied.nextSkillIds,
+          importedAt: imported.importedAt ?? Date.now(),
+        },
+      };
+      await persistImportedCloudSkillHubs(nextImports);
+      options.markReloadRequired?.("skills", { type: "skill", name: hub.name, action: "added" });
+      await refreshSkills({ force: true });
+      await refreshCloudOrgSkills({ force: true });
+      await refreshCloudOrgSkillHubs({ force: true });
+      return { ok: true, message: `Synced ${hub.name} from cloud.`, importedNames: applied.nextSkillNames };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message, importedNames: [] };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function removeCloudOrgSkillHub(hubId: string): Promise<{ ok: boolean; message: string; removedNames: string[] }> {
+    const imported = snapshot.importedCloudSkillHubs[hubId];
+    if (!imported) {
+      return { ok: false, message: "This skill hub has not been imported into the workspace.", removedNames: [] };
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      for (const name of imported.skillNames) {
+        await deleteWorkspaceSkill(name);
+        options.markReloadRequired?.("skills", { type: "skill", name, action: "removed" });
+      }
+
+      const nextImports = { ...snapshot.importedCloudSkillHubs };
+      delete nextImports[hubId];
+      await persistImportedCloudSkillHubs(nextImports);
+      await refreshSkills({ force: true });
+      await refreshCloudOrgSkills({ force: true });
+      await refreshCloudOrgSkillHubs({ force: true });
+      return {
+        ok: true,
+        message: `Removed ${imported.skillNames.length} imported skill${imported.skillNames.length === 1 ? "" : "s"} from ${imported.name}.`,
+        removedNames: imported.skillNames,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message, removedNames: [] };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function installHubSkill(name: string): Promise<{ ok: boolean; message: string }> {
+    const trimmed = name.trim();
+    if (!trimmed) return { ok: false, message: "Skill name is required." };
+    const repo = snapshot.hubRepo;
+    if (!repo) return { ok: false, message: "Select a hub repo before installing skills." };
+
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.hub?.skills?.install;
+
+    if (!canUseOpenworkServer) {
+      if (isRemoteWorkspace) return { ok: false, message: "OpenWork server unavailable. Connect to install skills." };
+      return { ok: false, message: "Hub install requires OpenWork server." };
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      const repoOverride: OpenworkHubRepo = { owner: repo.owner, repo: repo.repo, ref: repo.ref };
+      const result = await openworkClient.installHubSkill(openworkWorkspaceId, trimmed, { repo: repoOverride });
+      await refreshSkills({ force: true });
+      await refreshHubSkills({ force: true });
+      if (!result?.ok) return { ok: false, message: "Install failed." };
+      return { ok: true, message: `Installed ${trimmed}.` };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function installCloudOrgSkill(skill: DenOrgSkillCard): Promise<{ ok: boolean; message: string }> {
+    const existingImport = findImportedCloudSkill(skill.id);
+    const installedNames = new Set(snapshot.skills.map((entry) => entry.name));
+    const preferredName = existingImport?.installedName?.trim() ?? "";
+    if (preferredName) installedNames.delete(preferredName);
+    const installName = preferredName || uniqueSkillInstallName(slugifyOpencodeSkillName(skill.title), installedNames, skill.id);
+    const rawDesc = (skill.description?.trim() || skill.title).trim();
+    const description = rawDesc.slice(0, 1024) || skill.title.slice(0, 1024) || "Skill";
+    const body = extractSkillBodyMarkdown(skill.skillText);
+    const content = buildCloudSkillContent(installName, description, body);
+    const action = existingImport ? "updated" : "added";
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      await upsertWorkspaceSkill(installName, content, description, { overwrite: Boolean(existingImport) });
+      await persistImportedCloudSkillRecord(skill, installName);
+      options.markReloadRequired?.("skills", { type: "skill", name: installName, action });
+      await refreshSkills({ force: true });
+      await refreshCloudOrgSkills({ force: true });
+      return {
+        ok: true,
+        message: t(existingImport ? "skills.cloud_updated" : "skills.cloud_installed", { name: installName }),
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function syncCloudOrgSkill(skill: DenOrgSkillCard): Promise<{ ok: boolean; message: string }> {
+    return installCloudOrgSkill(skill);
+  }
+
+  async function removeCloudOrgSkill(cloudSkillId: string): Promise<{ ok: boolean; message: string; removedName: string | null }> {
+    const imported = findImportedCloudSkill(cloudSkillId);
+    if (!imported) {
+      return { ok: false, message: "This cloud skill has not been installed into the workspace.", removedName: null };
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+
+    try {
+      if (snapshot.skills.some((skill) => skill.name === imported.installedName)) {
+        await deleteWorkspaceSkill(imported.installedName);
+      }
+      const nextImports = { ...snapshot.importedCloudSkills };
+      delete nextImports[cloudSkillId];
+      await persistImportedCloudSkills(nextImports);
+      options.markReloadRequired?.("skills", { type: "skill", name: imported.installedName, action: "removed" });
+      await refreshSkills({ force: true });
+      await refreshCloudOrgSkills({ force: true });
+      return {
+        ok: true,
+        message: t("skills.cloud_removed", { name: imported.installedName }),
+        removedName: imported.installedName,
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+      return { ok: false, message, removedName: null };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  const isPluginInstalledByName = (pluginName: string, aliases: string[] = []) =>
+    isPluginInstalled(snapshot.pluginList.map((entry) => entry.name), pluginName, aliases);
+
+  const loadPluginsFromConfig = (config: OpencodeConfigFile | null) => {
+    const nextPluginNames: string[] = [];
+    let nextPluginStatus: string | null = null;
+    loadPluginsFromConfigHelpers(
+      config,
+      (value) => {
+        nextPluginNames.splice(0, nextPluginNames.length, ...applyStateAction(nextPluginNames, value));
+      },
+      (message) => {
+        nextPluginStatus = message;
+      },
+    );
+    mutateState((current) => ({
+      ...current,
+      pluginList: toConfigPluginListEntries(nextPluginNames),
+      pluginStatus: nextPluginStatus,
+    }));
+  };
+
+  async function refreshSkills(optionsOverride?: { force?: boolean }) {
+    const root = options.selectedWorkspaceRoot().trim();
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.read;
+
+    if (!root) {
+      mutateState((current) => ({
+        ...current,
+        skills: [],
+        skillsStatus: t("skills.pick_workspace_first"),
+      }));
+      return;
+    }
+
+    if (canUseOpenworkServer) {
+      if (root !== skillsRoot) skillsLoaded = false;
+      if (!optionsOverride?.force && skillsLoaded) return;
+      if (refreshSkillsInFlight) return;
+
+      refreshSkillsInFlight = true;
+      refreshSkillsAborted = false;
+      try {
+        setStateField("skillsStatus", null);
+        const response = await openworkClient.listSkills(openworkWorkspaceId, { includeGlobal: isLocalWorkspace });
+        if (refreshSkillsAborted) return;
+        const next: SkillCard[] = Array.isArray(response.items)
+          ? response.items.map((entry) => ({
+              name: entry.name,
+              description: entry.description,
+              path: entry.path,
+              trigger: entry.trigger,
+            }))
+          : [];
+        mutateState((current) => ({
+          ...current,
+          skills: next,
+          skillsStatus: next.length ? null : t("skills.no_skills_found"),
+          skillsContextKey: getWorkspaceContextKey(),
+        }));
+        skillsLoaded = true;
+        skillsRoot = root;
+      } catch (error) {
+        if (refreshSkillsAborted) return;
+        mutateState((current) => ({
+          ...current,
+          skills: [],
+          skillsStatus: error instanceof Error ? error.message : t("skills.failed_to_load"),
+        }));
+      } finally {
+        refreshSkillsInFlight = false;
+      }
+      return;
+    }
+
+    if (isLocalWorkspace && isDesktopRuntime()) {
+      if (root !== skillsRoot) skillsLoaded = false;
+      if (!optionsOverride?.force && skillsLoaded) return;
+      if (refreshSkillsInFlight) return;
+
+      refreshSkillsInFlight = true;
+      refreshSkillsAborted = false;
+      try {
+        setStateField("skillsStatus", null);
+        const local = await listLocalSkills(root);
+        if (refreshSkillsAborted) return;
+        const next: SkillCard[] = Array.isArray(local)
+          ? local.map((entry) => ({
+              name: entry.name,
+              description: entry.description,
+              path: entry.path,
+              trigger: entry.trigger,
+            }))
+          : [];
+        mutateState((current) => ({
+          ...current,
+          skills: next,
+          skillsStatus: next.length ? null : t("skills.no_skills_found"),
+          skillsContextKey: getWorkspaceContextKey(),
+        }));
+        skillsLoaded = true;
+        skillsRoot = root;
+      } catch (error) {
+        if (refreshSkillsAborted) return;
+        mutateState((current) => ({
+          ...current,
+          skills: [],
+          skillsStatus: error instanceof Error ? error.message : t("skills.failed_to_load"),
+        }));
+      } finally {
+        refreshSkillsInFlight = false;
+      }
+      return;
+    }
+
+    const client = options.client();
+    if (!client) {
+      mutateState((current) => ({
+        ...current,
+        skills: [],
+        skillsStatus: "OpenWork server unavailable. Connect to load skills.",
+      }));
+      return;
+    }
+
+    if (root !== skillsRoot) skillsLoaded = false;
+    if (!optionsOverride?.force && skillsLoaded) return;
+    if (refreshSkillsInFlight) return;
+
+    refreshSkillsInFlight = true;
+    refreshSkillsAborted = false;
+    try {
+      setStateField("skillsStatus", null);
+      const rawClient = client as unknown as { _client?: { get: (input: { url: string }) => Promise<unknown> } };
+      if (!rawClient._client) throw new Error("OpenCode client unavailable.");
+      const result = await rawClient._client.get({ url: "/skill" }) as {
+        data?: Array<{ name: string; description: string; location: string }>;
+        error?: unknown;
+      };
+      if (result?.data === undefined) {
+        const err = result?.error;
+        const message = err instanceof Error ? err.message : typeof err === "string" ? err : t("skills.failed_to_load");
+        throw new Error(message);
+      }
+      if (refreshSkillsAborted) return;
+      const next: SkillCard[] = Array.isArray(result.data)
+        ? result.data.map((entry) => ({
+            name: entry.name,
+            description: entry.description,
+            path: formatSkillPath(entry.location),
+          }))
+        : [];
+      mutateState((current) => ({
+        ...current,
+        skills: next,
+        skillsStatus: next.length ? null : t("skills.no_skills_found"),
+        skillsContextKey: getWorkspaceContextKey(),
+      }));
+      skillsLoaded = true;
+      skillsRoot = root;
+    } catch (error) {
+      if (refreshSkillsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        skills: [],
+        skillsStatus: error instanceof Error ? error.message : t("skills.failed_to_load"),
+      }));
+    } finally {
+      refreshSkillsInFlight = false;
+    }
+  }
+
+  async function refreshPlugins(scopeOverride?: PluginScope) {
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.plugins?.read;
+
+    if (refreshPluginsInFlight) return;
+    refreshPluginsInFlight = true;
+    refreshPluginsAborted = false;
+
+    const scope = scopeOverride ?? snapshot.pluginScope;
+    const targetDir = options.projectDir().trim();
+
+    if (scope !== "project" && !isLocalWorkspace) {
+      mutateState((current) => ({
+        ...current,
+        pluginStatus: "Global plugins are only available for local workers.",
+        pluginList: [],
+        sidebarPluginStatus: "Global plugins require a local worker.",
+        sidebarPluginList: [],
+      }));
+      refreshPluginsInFlight = false;
+      return;
+    }
+
+    if (scope === "project" && canUseOpenworkServer) {
+      mutateState((current) => ({
+        ...current,
+        pluginConfig: null,
+        pluginConfigPath: `opencode.json (${isRemoteWorkspace ? "remote" : "openwork"} server)`,
+      }));
+
+      try {
+        mutateState((current) => ({ ...current, pluginStatus: null, sidebarPluginStatus: null }));
+        if (refreshPluginsAborted) return;
+        const result = await openworkClient.listPlugins(openworkWorkspaceId, { includeGlobal: false });
+        if (refreshPluginsAborted) return;
+        const projectItems = result.items.filter((item) => item.scope === "project");
+        const list = toProjectPluginListEntries(projectItems);
+        mutateState((current) => ({
+          ...current,
+          pluginList: list,
+          sidebarPluginList: list.map((entry) => entry.name),
+          pluginStatus: list.length ? null : "No plugins configured yet.",
+          sidebarPluginStatus: null,
+          pluginsContextKey: getWorkspaceContextKey(),
+        }));
+      } catch (error) {
+        if (refreshPluginsAborted) return;
+        mutateState((current) => ({
+          ...current,
+          pluginList: [],
+          sidebarPluginList: [],
+          sidebarPluginStatus: "Failed to load plugins.",
+          pluginStatus: error instanceof Error ? error.message : "Failed to load plugins.",
+        }));
+      } finally {
+        refreshPluginsInFlight = false;
+      }
+      return;
+    }
+
+    if (!isDesktopRuntime()) {
+      mutateState((current) => ({
+        ...current,
+        pluginStatus: t("skills.plugin_management_host_only"),
+        pluginList: [],
+        sidebarPluginStatus: t("skills.plugins_host_only"),
+        sidebarPluginList: [],
+      }));
+      refreshPluginsInFlight = false;
+      return;
+    }
+
+    if (!isLocalWorkspace && !canUseOpenworkServer) {
+      mutateState((current) => ({
+        ...current,
+        pluginStatus: "OpenWork server unavailable. Connect to manage plugins.",
+        pluginList: [],
+        sidebarPluginStatus: "Connect an OpenWork server to load plugins.",
+        sidebarPluginList: [],
+      }));
+      refreshPluginsInFlight = false;
+      return;
+    }
+
+    if (scope === "project" && !targetDir) {
+      mutateState((current) => ({
+        ...current,
+        pluginStatus: t("skills.pick_project_for_plugins"),
+        pluginList: [],
+        sidebarPluginStatus: t("skills.pick_project_for_active"),
+        sidebarPluginList: [],
+      }));
+      refreshPluginsInFlight = false;
+      return;
+    }
+
+    try {
+      mutateState((current) => ({ ...current, pluginStatus: null, sidebarPluginStatus: null }));
+      if (refreshPluginsAborted) return;
+      const config = await readOpencodeConfig(scope, targetDir);
+      if (refreshPluginsAborted) return;
+      mutateState((current) => ({ ...current, pluginConfig: config, pluginConfigPath: config.path ?? null }));
+
+      if (!config.exists) {
+        mutateState((current) => ({
+          ...current,
+          pluginList: [],
+          pluginStatus: t("skills.no_opencode_found"),
+          sidebarPluginList: [],
+          sidebarPluginStatus: t("skills.no_opencode_workspace"),
+        }));
+        return;
+      }
+
+      let nextSidebarPluginList: string[] = [];
+      let nextSidebarPluginStatus: string | null = null;
+      try {
+        nextSidebarPluginList = parsePluginListFromContent(config.content ?? "");
+      } catch {
+        nextSidebarPluginList = [];
+        nextSidebarPluginStatus = t("skills.failed_parse_opencode");
+      }
+
+      const nextPluginNames: string[] = [];
+      let nextPluginStatus: string | null = null;
+      loadPluginsFromConfigHelpers(
+        config,
+        (value) => {
+          nextPluginNames.splice(0, nextPluginNames.length, ...applyStateAction(nextPluginNames, value));
+        },
+        (message) => {
+          nextPluginStatus = message;
+        },
+      );
+
+      mutateState((current) => ({
+        ...current,
+        pluginList: toConfigPluginListEntries(nextPluginNames),
+        pluginStatus: nextPluginStatus,
+        sidebarPluginList: nextSidebarPluginList,
+        sidebarPluginStatus: nextSidebarPluginStatus,
+        pluginsContextKey: getWorkspaceContextKey(),
+      }));
+    } catch (error) {
+      if (refreshPluginsAborted) return;
+      mutateState((current) => ({
+        ...current,
+        pluginConfig: null,
+        pluginConfigPath: null,
+        pluginList: [],
+        pluginStatus: error instanceof Error ? error.message : t("skills.failed_load_opencode"),
+        sidebarPluginStatus: t("skills.failed_load_active"),
+        sidebarPluginList: [],
+      }));
+    } finally {
+      refreshPluginsInFlight = false;
+    }
+  }
+
+  async function addPlugin(pluginNameOverride?: string) {
+    const pluginName = (pluginNameOverride ?? snapshot.pluginInput).trim();
+    const isManualInput = pluginNameOverride == null;
+    const triggerName = stripPluginVersion(pluginName);
+
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.plugins?.write;
+
+    if (!pluginName) {
+      if (isManualInput) setStateField("pluginStatus", t("skills.enter_plugin_name"));
+      return;
+    }
+
+    if (snapshot.pluginScope !== "project" && !isLocalWorkspace) {
+      setStateField("pluginStatus", "Global plugins are only available for local workers.");
+      return;
+    }
+
+    if (snapshot.pluginScope === "project" && canUseOpenworkServer) {
+      try {
+        setStateField("pluginStatus", null);
+        await openworkClient.addPlugin(openworkWorkspaceId, pluginName);
+        options.markReloadRequired?.("plugins", { type: "plugin", name: triggerName, action: "added" });
+        if (isManualInput) setStateField("pluginInput", "");
+        await refreshPlugins("project");
+      } catch (error) {
+        setStateField("pluginStatus", error instanceof Error ? error.message : "Failed to add plugin.");
+      }
+      return;
+    }
+
+    if (!isDesktopRuntime()) {
+      setStateField("pluginStatus", t("skills.plugin_management_host_only"));
+      return;
+    }
+
+    if (!isLocalWorkspace && !canUseOpenworkServer) {
+      setStateField("pluginStatus", "OpenWork server unavailable. Connect to manage plugins.");
+      return;
+    }
+
+    const scope = snapshot.pluginScope;
+    const targetDir = options.projectDir().trim();
+
+    if (scope === "project" && !targetDir) {
+      setStateField("pluginStatus", t("skills.pick_project_for_plugins"));
+      return;
+    }
+
+    try {
+      setStateField("pluginStatus", null);
+      const config = await readOpencodeConfig(scope, targetDir);
+      const raw = config.content ?? "";
+
+      if (!raw.trim()) {
+        const payload = { $schema: "https://opencode.ai/config.json", plugin: [pluginName] };
+        await writeOpencodeConfig(scope, targetDir, `${JSON.stringify(payload, null, 2)}\n`);
+        options.markReloadRequired?.("plugins", { type: "plugin", name: triggerName, action: "added" });
+        if (isManualInput) setStateField("pluginInput", "");
+        await refreshPlugins(scope);
+        return;
+      }
+
+      const plugins = parsePluginListFromContent(raw);
+      const desired = stripPluginVersion(pluginName).toLowerCase();
+      if (plugins.some((entry) => stripPluginVersion(entry).toLowerCase() === desired)) {
+        setStateField("pluginStatus", t("skills.plugin_already_listed"));
+        return;
+      }
+
+      const next = [...plugins, pluginName];
+      const edits = modify(raw, ["plugin"], next, { formattingOptions: { insertSpaces: true, tabSize: 2 } });
+      const updated = applyEdits(raw, edits);
+      await writeOpencodeConfig(scope, targetDir, updated);
+      options.markReloadRequired?.("plugins", { type: "plugin", name: triggerName, action: "added" });
+      if (isManualInput) setStateField("pluginInput", "");
+      await refreshPlugins(scope);
+    } catch (error) {
+      setStateField("pluginStatus", error instanceof Error ? error.message : t("skills.failed_update_opencode"));
+    }
+  }
+
+  async function removePlugin(pluginName: string) {
+    const name = pluginName.trim();
+    if (!name) return;
+    const triggerName = stripPluginVersion(name);
+    const existingPlugin = snapshot.pluginList.find((entry) => entry.name === name);
+    if (existingPlugin && !existingPlugin.removable) {
+      setStateField("pluginStatus", "Directory-discovered plugins are read-only.");
+      return;
+    }
+
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.plugins?.write;
+
+    if (snapshot.pluginScope !== "project" && !isLocalWorkspace) {
+      setStateField("pluginStatus", "Global plugins are only available for local workers.");
+      return;
+    }
+
+    if (snapshot.pluginScope === "project" && canUseOpenworkServer) {
+      try {
+        setStateField("pluginStatus", null);
+        await openworkClient.removePlugin(openworkWorkspaceId, name);
+        options.markReloadRequired?.("plugins", { type: "plugin", name: triggerName, action: "removed" });
+        await refreshPlugins("project");
+      } catch (error) {
+        setStateField("pluginStatus", error instanceof Error ? error.message : "Failed to remove plugin.");
+      }
+      return;
+    }
+
+    if (!isDesktopRuntime()) {
+      setStateField("pluginStatus", t("skills.plugin_management_host_only"));
+      return;
+    }
+
+    if (!isLocalWorkspace && !canUseOpenworkServer) {
+      setStateField("pluginStatus", "OpenWork server unavailable. Connect to manage plugins.");
+      return;
+    }
+
+    const scope = snapshot.pluginScope;
+    const targetDir = options.projectDir().trim();
+    if (scope === "project" && !targetDir) {
+      setStateField("pluginStatus", t("skills.pick_project_for_plugins"));
+      return;
+    }
+
+    try {
+      setStateField("pluginStatus", null);
+      const config = await readOpencodeConfig(scope, targetDir);
+      const raw = config.content ?? "";
+      if (!raw.trim()) {
+        setStateField("pluginStatus", "No plugins configured yet.");
+        return;
+      }
+
+      const plugins = parsePluginListFromContent(raw);
+      const desired = stripPluginVersion(name).toLowerCase();
+      const next = plugins.filter((entry) => stripPluginVersion(entry).toLowerCase() !== desired);
+      if (next.length === plugins.length) {
+        setStateField("pluginStatus", "Plugin not found.");
+        return;
+      }
+
+      const edits = modify(raw, ["plugin"], next, { formattingOptions: { insertSpaces: true, tabSize: 2 } });
+      const updated = applyEdits(raw, edits);
+      await writeOpencodeConfig(scope, targetDir, updated);
+      options.markReloadRequired?.("plugins", { type: "plugin", name: triggerName, action: "removed" });
+      await refreshPlugins(scope);
+    } catch (error) {
+      setStateField("pluginStatus", error instanceof Error ? error.message : t("skills.failed_update_opencode"));
+    }
+  }
+
+  async function importLocalSkill() {
+    const isLocalWorkspace = options.workspaceType() === "local";
+    if (!isDesktopRuntime()) {
+      options.setError(t("skills.desktop_required"));
+      return;
+    }
+    if (!isLocalWorkspace) {
+      options.setError("Local workers are required to import skills.");
+      return;
+    }
+    const targetDir = options.projectDir().trim();
+    if (!targetDir) {
+      options.setError(t("skills.pick_project_first"));
+      return;
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+    try {
+      const selection = await pickDirectory({ title: t("skills.select_skill_folder") });
+      const sourceDir = typeof selection === "string" ? selection : Array.isArray(selection) ? selection[0] : null;
+      if (!sourceDir) return;
+      const inferredName = sourceDir.split(/[\\/]/).filter(Boolean).pop();
+      const result = await importSkill(targetDir, sourceDir, { overwrite: false });
+      if (!result.ok) {
+        setStateField("skillsStatus", result.stderr || result.stdout || t("skills.import_failed").replace("{status}", String(result.status)));
+      } else {
+        setStateField("skillsStatus", result.stdout || t("skills.imported"));
+        options.markReloadRequired?.("skills", { type: "skill", name: inferredName, action: "added" });
+      }
+      await refreshSkills({ force: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function installSkillCreator(): Promise<{ ok: boolean; message: string }> {
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.write;
+
+    if (canUseOpenworkServer) {
+      options.setBusy(true);
+      options.setError(null);
+      setStateField("skillsStatus", t("skills.installing_skill_creator"));
+      try {
+        await openworkClient.upsertSkill(openworkWorkspaceId, { name: "skill-creator", content: skillCreatorTemplate });
+        const message = t("skills.skill_creator_installed");
+        setStateField("skillsStatus", message);
+        options.markReloadRequired?.("skills", { type: "skill", name: "skill-creator", action: "added" });
+        await refreshSkills({ force: true });
+        return { ok: true, message };
+      } catch (error) {
+        const raw = error instanceof Error ? error.message : t("skills.unknown_error");
+        const message = addOpencodeCacheHint(raw);
+        setStateField("skillsStatus", message);
+        options.setError(message);
+        return { ok: false, message };
+      } finally {
+        options.setBusy(false);
+      }
+    }
+
+    if (isRemoteWorkspace) {
+      const message = "OpenWork server unavailable. Connect to install skills.";
+      setStateField("skillsStatus", message);
+      return { ok: false, message };
+    }
+    if (!isDesktopRuntime()) {
+      const message = t("skills.desktop_required");
+      setStateField("skillsStatus", message);
+      return { ok: false, message };
+    }
+    if (!isLocalWorkspace) {
+      const message = "Local workers are required to install skills.";
+      options.setError(message);
+      setStateField("skillsStatus", message);
+      return { ok: false, message };
+    }
+
+    const targetDir = options.selectedWorkspaceRoot().trim();
+    if (!targetDir) {
+      const message = t("skills.pick_workspace_first");
+      setStateField("skillsStatus", message);
+      return { ok: false, message };
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", t("skills.installing_skill_creator"));
+    try {
+      const result = await installSkillTemplate(targetDir, "skill-creator", skillCreatorTemplate, { overwrite: false });
+      if (!result.ok && /already exists/i.test(result.stderr)) {
+        const message = t("skills.skill_creator_already_installed");
+        setStateField("skillsStatus", message);
+        await refreshSkills({ force: true });
+        return { ok: true, message };
+      }
+      if (!result.ok) {
+        const message = result.stderr || result.stdout || t("skills.install_failed");
+        setStateField("skillsStatus", message);
+        await refreshSkills({ force: true });
+        return { ok: false, message };
+      }
+      const message = result.stdout || t("skills.skill_creator_installed");
+      setStateField("skillsStatus", message);
+      options.markReloadRequired?.("skills", { type: "skill", name: "skill-creator", action: "added" });
+      await refreshSkills({ force: true });
+      return { ok: true, message };
+    } catch (error) {
+      const raw = error instanceof Error ? error.message : t("skills.unknown_error");
+      const message = addOpencodeCacheHint(raw);
+      setStateField("skillsStatus", message);
+      options.setError(message);
+      return { ok: false, message };
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function revealSkillsFolder() {
+    if (!isDesktopRuntime()) {
+      setStateField("skillsStatus", t("skills.desktop_required"));
+      return;
+    }
+    const root = options.selectedWorkspaceRoot().trim();
+    if (!root) {
+      setStateField("skillsStatus", t("skills.pick_workspace_first"));
+      return;
+    }
+
+    try {
+      const opencodeSkills = await joinDesktopPath(root, ".opencode", "skills");
+      const claudeSkills = await joinDesktopPath(root, ".claude", "skills");
+      const legacySkills = await joinDesktopPath(root, ".opencode", "skill");
+      const tryOpen = async (target: string) => {
+        try {
+          await openDesktopPath(target);
+          return true;
+        } catch {
+          return false;
+        }
+      };
+      if (await tryOpen(opencodeSkills)) return;
+      if (await tryOpen(claudeSkills)) return;
+      if (await tryOpen(legacySkills)) return;
+      await revealDesktopItemInDir(opencodeSkills);
+    } catch (error) {
+      setStateField("skillsStatus", error instanceof Error ? error.message : t("skills.reveal_failed"));
+    }
+  }
+
+  async function uninstallSkill(name: string) {
+    const root = options.selectedWorkspaceRoot().trim();
+    if (!root) {
+      setStateField("skillsStatus", t("skills.pick_workspace_first"));
+      return;
+    }
+    const trimmed = name.trim();
+    if (!trimmed) return;
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+    try {
+      await deleteWorkspaceSkill(trimmed);
+      setStateField("skillsStatus", t("skills.uninstalled"));
+      options.markReloadRequired?.("skills", { type: "skill", name: trimmed, action: "removed" });
+      await refreshSkills({ force: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      setStateField("skillsStatus", message);
+      options.setError(addOpencodeCacheHint(message));
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  async function readSkill(name: string): Promise<{ name: string; path: string; content: string } | null> {
+    const trimmed = name.trim();
+    if (!trimmed) return null;
+    const root = options.selectedWorkspaceRoot().trim();
+    if (!root) {
+      setStateField("skillsStatus", t("skills.pick_workspace_first"));
+      return null;
+    }
+
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.read;
+
+    if (canUseOpenworkServer) {
+      try {
+        setStateField("skillsStatus", null);
+        const result = await openworkClient.getSkill(openworkWorkspaceId, trimmed, { includeGlobal: isLocalWorkspace });
+        return { name: result.item.name, path: result.item.path, content: result.content };
+      } catch (error) {
+        setStateField("skillsStatus", error instanceof Error ? error.message : t("skills.failed_to_load"));
+        return null;
+      }
+    }
+
+    if (isRemoteWorkspace) {
+      setStateField("skillsStatus", "OpenWork server unavailable. Connect to view skills.");
+      return null;
+    }
+    if (!isDesktopRuntime()) {
+      setStateField("skillsStatus", t("skills.desktop_required"));
+      return null;
+    }
+    if (!isLocalWorkspace) {
+      setStateField("skillsStatus", "Local workers are required to view skills.");
+      return null;
+    }
+
+    try {
+      setStateField("skillsStatus", null);
+      const result = await readLocalSkill(root, trimmed);
+      return { name: trimmed, path: result.path, content: result.content };
+    } catch (error) {
+      setStateField("skillsStatus", error instanceof Error ? error.message : t("skills.failed_to_load"));
+      return null;
+    }
+  }
+
+  async function saveSkill(input: { name: string; content: string; description?: string }) {
+    const trimmed = input.name.trim();
+    if (!trimmed) return;
+    const root = options.selectedWorkspaceRoot().trim();
+    if (!root) {
+      setStateField("skillsStatus", t("skills.pick_workspace_first"));
+      return;
+    }
+
+    const isRemoteWorkspace = options.workspaceType() === "remote";
+    const isLocalWorkspace = options.workspaceType() === "local";
+    const openworkSnapshot = getOpenworkServerSnapshot();
+    const openworkClient = openworkSnapshot.openworkServerClient;
+    const openworkWorkspaceId = options.runtimeWorkspaceId();
+    const canUseOpenworkServer =
+      openworkSnapshot.openworkServerStatus === "connected" &&
+      openworkClient &&
+      openworkWorkspaceId &&
+      openworkSnapshot.openworkServerCapabilities?.skills?.write;
+
+    if (canUseOpenworkServer) {
+      options.setBusy(true);
+      options.setError(null);
+      setStateField("skillsStatus", null);
+      try {
+        await openworkClient.upsertSkill(openworkWorkspaceId, {
+          name: trimmed,
+          content: input.content,
+          description: input.description,
+        });
+        options.markReloadRequired?.("skills", { type: "skill", name: trimmed, action: "updated" });
+        await refreshSkills({ force: true });
+        setStateField("skillsStatus", "Saved.");
+      } catch (error) {
+        const message = error instanceof Error ? error.message : t("skills.unknown_error");
+        options.setError(addOpencodeCacheHint(message));
+      } finally {
+        options.setBusy(false);
+      }
+      return;
+    }
+
+    if (isRemoteWorkspace) {
+      setStateField("skillsStatus", "OpenWork server unavailable. Connect to edit skills.");
+      return;
+    }
+    if (!isDesktopRuntime()) {
+      setStateField("skillsStatus", t("skills.desktop_required"));
+      return;
+    }
+    if (!isLocalWorkspace) {
+      setStateField("skillsStatus", "Local workers are required to edit skills.");
+      return;
+    }
+
+    options.setBusy(true);
+    options.setError(null);
+    setStateField("skillsStatus", null);
+    try {
+      const result = await writeLocalSkill(root, trimmed, input.content);
+      if (!result.ok) {
+        setStateField("skillsStatus", result.stderr || result.stdout || t("skills.unknown_error"));
+      } else {
+        setStateField("skillsStatus", result.stdout || "Saved.");
+        options.markReloadRequired?.("skills", { type: "skill", name: trimmed, action: "updated" });
+      }
+      await refreshSkills({ force: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t("skills.unknown_error");
+      options.setError(addOpencodeCacheHint(message));
+    } finally {
+      options.setBusy(false);
+    }
+  }
+
+  function abortRefreshes() {
+    refreshSkillsAborted = true;
+    refreshPluginsAborted = true;
+    refreshHubSkillsAborted = true;
+    refreshCloudOrgSkillsAborted = true;
+    refreshCloudOrgSkillHubsAborted = true;
+    refreshCloudOrgMarketplacesAborted = true;
+  }
+
+  function ensureSkillsFresh() {
+    if (!snapshot.skillsStale) return;
+    void refreshSkills({ force: true });
+  }
+
+  function ensurePluginsFresh(scopeOverride?: PluginScope) {
+    if (!snapshot.pluginsStale) return;
+    void refreshPlugins(scopeOverride);
+  }
+
+  function ensureHubSkillsFresh() {
+    if (!snapshot.hubSkillsStale) return;
+    void refreshHubSkills({ force: true });
+  }
+
+  function ensureCloudOrgSkillsFresh() {
+    if (!snapshot.cloudOrgSkillsStale) return;
+    void refreshCloudOrgSkills({ force: true });
+  }
+
+  const setHubRepo = (repoInput: Partial<HubSkillRepo> | null, optionsOverride?: { remember?: boolean }) => {
+    const next = normalizeHubRepo(repoInput);
+    mutateState((current) => ({ ...current, hubRepo: next }));
+    hubSkillsLoaded = false;
+    if (optionsOverride?.remember === false || !next) {
+      persistHubRepos();
+      return;
+    }
+    mutateState((current) => {
+      const seen = new Set<string>();
+      const merged = [next, ...current.hubRepos];
+      const deduped: HubSkillRepo[] = [];
+      for (const item of merged) {
+        const key = hubRepoKey(item);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        deduped.push(item);
+      }
+      return { ...current, hubRepos: deduped };
+    });
+    persistHubRepos();
+  };
+
+  const addHubRepo = (repoInput: Partial<HubSkillRepo>) => {
+    const next = normalizeHubRepo(repoInput);
+    if (!next) return;
+    setHubRepo(next);
+  };
+
+  const removeHubRepo = (repoInput: Partial<HubSkillRepo>) => {
+    const target = normalizeHubRepo(repoInput);
+    if (!target) return;
+    const targetKey = hubRepoKey(target);
+    const nextRepos = snapshot.hubRepos.filter((item) => hubRepoKey(item) !== targetKey);
+    mutateState((current) => ({ ...current, hubRepos: nextRepos }));
+    const activeRepo = snapshot.hubRepo;
+    if (activeRepo && hubRepoKey(activeRepo) === targetKey) {
+      mutateState((current) => ({
+        ...current,
+        hubRepo: nextRepos[0] ?? null,
+        hubSkills: nextRepos.length ? current.hubSkills : [],
+        hubSkillsStatus: nextRepos.length ? current.hubSkillsStatus : "No hub repo selected. Add a GitHub repo to browse skills.",
+      }));
+      hubSkillsLoaded = false;
+      if (!nextRepos.length) {
+        hubSkillsLoadKey = "";
+      }
+    }
+    persistHubRepos();
+  };
+
+  const start = () => {
+    if (started) return;
+    // StrictMode double-mount re-arms after dispose.
+    disposed = false;
+    started = true;
+
+    if (typeof window !== "undefined") {
+      try {
+        const raw = window.localStorage.getItem(HUB_REPOS_STORAGE_KEY);
+        if (raw) {
+          const parsed = JSON.parse(raw) as { selected?: unknown; repos?: unknown[]; custom?: unknown[] };
+          const storedRepos = Array.isArray(parsed?.repos)
+            ? normalizeHubRepoList(parsed.repos)
+            : Array.isArray(parsed?.custom)
+              ? normalizeHubRepoList(parsed.custom)
+              : [];
+          const selected = parsed?.selected && typeof parsed.selected === "object"
+            ? normalizeHubRepo(parsed.selected as Partial<HubSkillRepo>)
+            : null;
+          const selectedKey = selected ? hubRepoKey(selected) : null;
+          const hasSelected = selectedKey ? storedRepos.some((item) => hubRepoKey(item) === selectedKey) : false;
+          const nextRepos = selected && !hasSelected ? [selected, ...storedRepos] : storedRepos;
+          mutateState((current) => ({
+            ...current,
+            hubRepos: nextRepos.length ? nextRepos : current.hubRepos,
+            hubRepo: selected && nextRepos.length ? selected : nextRepos[0] ?? current.hubRepo,
+          }));
+        }
+      } catch {
+        // ignore
+      }
+
+      const onDenSessionUpdated = () => {
+        cloudOrgSkillsLoaded = false;
+        cloudOrgSkillHubsLoaded = false;
+        cloudOrgMarketplacesLoaded = false;
+        mutateState((current) => ({ ...current, cloudOrgSkillsContextKey: "" }));
+      };
+      window.addEventListener("openwork-den-session-updated", onDenSessionUpdated);
+      stopDenSessionListener = () => window.removeEventListener("openwork-den-session-updated", onDenSessionUpdated);
+    }
+
+    stopOpenworkSubscription = options.openworkServer.subscribe(() => {
+      syncFromOptions();
+    });
+
+    syncFromOptions();
+  };
+
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    started = false;
+    abortRefreshes();
+    stopOpenworkSubscription?.();
+    stopOpenworkSubscription = null;
+    stopDenSessionListener?.();
+    stopDenSessionListener = null;
+    listeners.clear();
+  };
+
+  const syncFromOptions = () => {
+    if (disposed) return;
+    const key = getWorkspaceContextKey();
+    if (key === lastWorkspaceContextKey) return;
+    lastWorkspaceContextKey = key;
+    invalidateWorkspaceCaches();
+    touch();
+    if (!key || key === "::::") return;
+    void refreshSkills({ force: true });
+    void refreshPlugins();
+    void refreshImportedCloudSkills();
+    void refreshImportedCloudSkillHubs();
+    void refreshImportedCloudPlugins();
+  };
+
+  refreshSnapshot();
+
+  const subscribe = (listener: () => void) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+
+  const getSnapshot = () => snapshot;
+
+  return {
+    subscribe,
+    getSnapshot,
+    start,
+    dispose,
+    syncFromOptions,
+    skills: () => snapshot.skills,
+    skillsStatus: () => snapshot.skillsStatus,
+    hubSkills: () => snapshot.hubSkills,
+    hubSkillsStatus: () => snapshot.hubSkillsStatus,
+    cloudOrgSkills: () => snapshot.cloudOrgSkills,
+    cloudOrgSkillsStatus: () => snapshot.cloudOrgSkillsStatus,
+    importedCloudSkills: () => snapshot.importedCloudSkills,
+    cloudOrgSkillHubs: () => snapshot.cloudOrgSkillHubs,
+    cloudOrgSkillHubsStatus: () => snapshot.cloudOrgSkillHubsStatus,
+    importedCloudSkillHubs: () => snapshot.importedCloudSkillHubs,
+    cloudOrgMarketplaces: () => snapshot.cloudOrgMarketplaces,
+    cloudOrgMarketplacesStatus: () => snapshot.cloudOrgMarketplacesStatus,
+    importedCloudPlugins: () => snapshot.importedCloudPlugins,
+    hubRepo: () => snapshot.hubRepo,
+    hubRepos: () => snapshot.hubRepos,
+    get pluginScope() {
+      return snapshot.pluginScope;
+    },
+    setPluginScope(value: SetStateAction<PluginScope>) {
+      const resolved = applyStateAction(state.pluginScope, value);
+      setStateField("pluginScope", resolved);
+    },
+    pluginConfig: () => snapshot.pluginConfig,
+    pluginConfigPath: () => snapshot.pluginConfigPath,
+    pluginList: () => snapshot.pluginList,
+    pluginInput: () => snapshot.pluginInput,
+    setPluginInput(value: SetStateAction<string>) {
+      const resolved = applyStateAction(state.pluginInput, value);
+      setStateField("pluginInput", resolved);
+    },
+    pluginStatus: () => snapshot.pluginStatus,
+    activePluginGuide: () => snapshot.activePluginGuide,
+    setActivePluginGuide(value: SetStateAction<string | null>) {
+      const resolved = applyStateAction(state.activePluginGuide, value);
+      setStateField("activePluginGuide", resolved);
+    },
+    sidebarPluginList: () => snapshot.sidebarPluginList,
+    sidebarPluginStatus: () => snapshot.sidebarPluginStatus,
+    workspaceContextKey: () => snapshot.workspaceContextKey,
+    skillsStale: () => snapshot.skillsStale,
+    pluginsStale: () => snapshot.pluginsStale,
+    hubSkillsStale: () => snapshot.hubSkillsStale,
+    cloudOrgSkillsStale: () => snapshot.cloudOrgSkillsStale,
+    isPluginInstalledByName,
+    refreshSkills,
+    refreshHubSkills,
+    refreshCloudOrgSkills,
+    refreshCloudOrgSkillHubs,
+    refreshCloudOrgMarketplaces,
+    setHubRepo,
+    addHubRepo,
+    removeHubRepo,
+    refreshPlugins,
+    addPlugin,
+    removePlugin,
+    importLocalSkill,
+    installSkillCreator,
+    installHubSkill,
+    installCloudOrgSkill,
+    syncCloudOrgSkill,
+    removeCloudOrgSkill,
+    importCloudOrgSkillHub,
+    syncCloudOrgSkillHub,
+    removeCloudOrgSkillHub,
+    importCloudOrgPlugin,
+    revealSkillsFolder,
+    uninstallSkill,
+    readSkill,
+    saveSkill,
+    abortRefreshes,
+    ensureSkillsFresh,
+    ensurePluginsFresh,
+    ensureHubSkillsFresh,
+    ensureCloudOrgSkillsFresh,
+  };
+}
+
+export function useExtensionsStoreSnapshot(store: ExtensionsStore) {
+  return React.useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+}
diff --git a/apps/app/src/react-app/domains/settings/state/feature-flags-preferences.ts b/apps/app/src/react-app/domains/settings/state/feature-flags-preferences.ts
new file mode 100644
index 0000000000..591a589540
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/feature-flags-preferences.ts
@@ -0,0 +1,25 @@
+import { useCallback } from "react";
+
+import { useLocal } from "../../../kernel/local-provider";
+
+export function useFeatureFlagsPreferences() {
+  const { prefs, setPrefs } = useLocal();
+
+  const microsandboxCreateSandboxEnabled =
+    prefs.featureFlags?.microsandboxCreateSandbox === true;
+
+  const toggleMicrosandboxCreateSandbox = useCallback(() => {
+    setPrefs((previous) => ({
+      ...previous,
+      featureFlags: {
+        ...previous.featureFlags,
+        microsandboxCreateSandbox: !previous.featureFlags?.microsandboxCreateSandbox,
+      },
+    }));
+  }, [setPrefs]);
+
+  return {
+    microsandboxCreateSandboxEnabled,
+    toggleMicrosandboxCreateSandbox,
+  };
+}
diff --git a/apps/app/src/react-app/domains/settings/state/messaging-view-state.ts b/apps/app/src/react-app/domains/settings/state/messaging-view-state.ts
new file mode 100644
index 0000000000..50d836b8ba
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/messaging-view-state.ts
@@ -0,0 +1,962 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  OpenworkServerError,
+  type OpenworkOpenCodeRouterHealthSnapshot,
+  type OpenworkOpenCodeRouterIdentityItem,
+  type OpenworkOpenCodeRouterSendResult,
+  type OpenworkServerClient,
+  type OpenworkServerStatus,
+  type OpenworkWorkspaceFileContent,
+} from "../../../../app/lib/openwork-server";
+import { t } from "../../../../i18n";
+import type {
+  MessagingChannel,
+  MessagingViewExpandedChannel,
+  MessagingViewProps,
+  MessagingViewTab,
+} from "../pages/messaging-view";
+
+const OPENCODE_ROUTER_AGENT_FILE_PATH = ".opencode/agents/opencode-router.md";
+const OPENCODE_ROUTER_AGENT_FILE_TEMPLATE = `# OpenCodeRouter Messaging Agent
+
+Use this file to define how the assistant responds in Slack/Telegram for this workspace.
+
+Examples:
+- Keep responses concise and action-oriented.
+- Use tools directly; never ask end users to run router commands.
+- Never expose raw peer IDs or Telegram chat IDs unless the user explicitly asks for debug output.
+- Never ask end users for peer IDs or identity IDs.
+- For outbound delivery, call opencode_router_status and opencode_router_send yourself.
+- If Telegram says chat not found, tell the user the recipient must message the bot first (for example /start), then retry.
+`;
+
+function formatRequestError(error: unknown): string {
+  if (error instanceof OpenworkServerError) {
+    return `${error.message} (${error.status})`;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+
+function isOpenCodeRouterSnapshot(
+  value: unknown,
+): value is OpenworkOpenCodeRouterHealthSnapshot {
+  if (!value || typeof value !== "object") return false;
+  const record = value as Record<string, unknown>;
+  return (
+    typeof record.ok === "boolean" &&
+    typeof record.opencode === "object" &&
+    typeof record.channels === "object" &&
+    typeof record.config === "object"
+  );
+}
+
+function isOpenCodeRouterIdentities(
+  value: unknown,
+): value is { ok: boolean; items: OpenworkOpenCodeRouterIdentityItem[] } {
+  if (!value || typeof value !== "object") return false;
+  const record = value as Record<string, unknown>;
+  return typeof record.ok === "boolean" && Array.isArray(record.items);
+}
+
+function getTelegramUsernameFromResult(value: unknown): string | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const bot = record.bot;
+  if (!bot || typeof bot !== "object") return null;
+  const username = (bot as Record<string, unknown>).username;
+  if (typeof username !== "string") return null;
+  const normalized = username.trim().replace(/^@+/, "");
+  return normalized || null;
+}
+
+function readMessagingEnabledFromOpenworkConfig(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value as Record<string, unknown>;
+  const messaging = record.messaging;
+  if (!messaging || typeof messaging !== "object" || Array.isArray(messaging)) {
+    return false;
+  }
+  return (messaging as Record<string, unknown>).enabled === true;
+}
+
+type UseMessagingViewPropsOptions = {
+  busy: boolean;
+  openworkServerStatus: OpenworkServerStatus;
+  openworkServerUrl: string;
+  openworkServerClient: OpenworkServerClient | null;
+  openworkReconnectBusy: boolean;
+  reconnectOpenworkServer: () => Promise<boolean>;
+  restartMessagingWorker: () => Promise<boolean>;
+  workspaceId: string | null;
+  selectedWorkspaceRoot: string;
+};
+
+export function useMessagingViewProps(
+  options: UseMessagingViewPropsOptions,
+): MessagingViewProps {
+  const [refreshing, setRefreshing] = useState(false);
+  const [health, setHealth] = useState<OpenworkOpenCodeRouterHealthSnapshot | null>(null);
+  const [healthError, setHealthError] = useState<string | null>(null);
+  const [telegramIdentities, setTelegramIdentities] = useState<OpenworkOpenCodeRouterIdentityItem[]>([]);
+  const [telegramIdentitiesError, setTelegramIdentitiesError] = useState<string | null>(null);
+  const [slackIdentities, setSlackIdentities] = useState<OpenworkOpenCodeRouterIdentityItem[]>([]);
+  const [slackIdentitiesError, setSlackIdentitiesError] = useState<string | null>(null);
+
+  const [telegramToken, setTelegramToken] = useState("");
+  const [telegramEnabled, setTelegramEnabled] = useState(true);
+  const [telegramSaving, setTelegramSaving] = useState(false);
+  const [telegramStatus, setTelegramStatus] = useState<string | null>(null);
+  const [telegramError, setTelegramError] = useState<string | null>(null);
+  const [telegramBotUsername, setTelegramBotUsername] = useState<string | null>(null);
+  const [telegramPairingCode, setTelegramPairingCode] = useState<string | null>(null);
+  const [publicTelegramWarningOpen, setPublicTelegramWarningOpen] = useState(false);
+
+  const [slackBotToken, setSlackBotToken] = useState("");
+  const [slackAppToken, setSlackAppToken] = useState("");
+  const [slackEnabled, setSlackEnabled] = useState(true);
+  const [slackSaving, setSlackSaving] = useState(false);
+  const [slackStatus, setSlackStatus] = useState<string | null>(null);
+  const [slackError, setSlackError] = useState<string | null>(null);
+
+  const [activeTab, setActiveTab] = useState<MessagingViewTab>("general");
+  const [expandedChannel, setExpandedChannel] =
+    useState<MessagingViewExpandedChannel>("telegram");
+
+  const [agentLoading, setAgentLoading] = useState(false);
+  const [agentSaving, setAgentSaving] = useState(false);
+  const [agentExists, setAgentExists] = useState(false);
+  const [agentContent, setAgentContent] = useState("");
+  const [agentDraft, setAgentDraft] = useState("");
+  const [agentBaseUpdatedAt, setAgentBaseUpdatedAt] = useState<number | null>(null);
+  const [agentStatus, setAgentStatus] = useState<string | null>(null);
+  const [agentError, setAgentError] = useState<string | null>(null);
+  const [agentAutoHealAttempted, setAgentAutoHealAttempted] = useState(false);
+
+  const [sendChannel, setSendChannel] = useState<MessagingChannel>("telegram");
+  const [sendDirectory, setSendDirectory] = useState("");
+  const [sendPeerId, setSendPeerId] = useState("");
+  const [sendAutoBind, setSendAutoBind] = useState(true);
+  const [sendText, setSendText] = useState("");
+  const [sendBusy, setSendBusy] = useState(false);
+  const [sendStatus, setSendStatus] = useState<string | null>(null);
+  const [sendError, setSendError] = useState<string | null>(null);
+  const [sendResult, setSendResult] =
+    useState<OpenworkOpenCodeRouterSendResult | null>(null);
+
+  const [reconnectStatus, setReconnectStatus] = useState<string | null>(null);
+  const [reconnectError, setReconnectError] = useState<string | null>(null);
+  const [messagingEnabled, setMessagingEnabled] = useState(false);
+  const [messagingSaving, setMessagingSaving] = useState(false);
+  const [messagingStatus, setMessagingStatus] = useState<string | null>(null);
+  const [messagingError, setMessagingError] = useState<string | null>(null);
+  const [messagingRiskOpen, setMessagingRiskOpen] = useState(false);
+  const [messagingRestartRequired, setMessagingRestartRequired] = useState(false);
+  const [messagingRestartPromptOpen, setMessagingRestartPromptOpen] =
+    useState(false);
+  const [messagingRestartBusy, setMessagingRestartBusy] = useState(false);
+  const [messagingDisableConfirmOpen, setMessagingDisableConfirmOpen] =
+    useState(false);
+  const [messagingRestartAction, setMessagingRestartAction] = useState<
+    "enable" | "disable"
+  >("enable");
+
+  const workspaceId = options.workspaceId?.trim() || null;
+  const scopedOpenworkBaseUrl = useMemo(() => {
+    const baseUrl = options.openworkServerUrl.trim();
+    if (!baseUrl) return "";
+    return buildOpenworkWorkspaceBaseUrl(baseUrl, workspaceId) ?? baseUrl;
+  }, [options.openworkServerUrl, workspaceId]);
+  const serverReady =
+    options.openworkServerStatus === "connected" &&
+    Boolean(options.openworkServerClient);
+  const agentDirty = agentDraft !== agentContent;
+
+  const resetAgentState = useCallback(() => {
+    setAgentLoading(false);
+    setAgentSaving(false);
+    setAgentExists(false);
+    setAgentContent("");
+    setAgentDraft("");
+    setAgentBaseUpdatedAt(null);
+    setAgentStatus(null);
+    setAgentError(null);
+    setAgentAutoHealAttempted(false);
+  }, []);
+
+  const loadAgentFile = useCallback(async () => {
+    if (agentLoading) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) {
+      resetAgentState();
+      setAgentError(t("identities.agent_worker_scope_unavailable"));
+      return;
+    }
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    setAgentLoading(true);
+    setAgentError(null);
+    try {
+      const result = (await client.readWorkspaceFile(
+        id,
+        OPENCODE_ROUTER_AGENT_FILE_PATH,
+      )) as OpenworkWorkspaceFileContent;
+      const nextContent = result.content ?? "";
+      setAgentExists(true);
+      setAgentContent(nextContent);
+      setAgentDraft(nextContent);
+      setAgentBaseUpdatedAt(
+        typeof result.updatedAt === "number" ? result.updatedAt : null,
+      );
+    } catch (error) {
+      if (error instanceof OpenworkServerError && error.status === 404) {
+        setAgentExists(false);
+        setAgentContent("");
+        setAgentDraft("");
+        setAgentBaseUpdatedAt(null);
+        return;
+      }
+      setAgentError(formatRequestError(error));
+    } finally {
+      setAgentLoading(false);
+    }
+  }, [agentLoading, options.openworkServerClient, resetAgentState, serverReady, workspaceId]);
+
+  const createDefaultAgentFile = useCallback(async () => {
+    if (agentSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    setAgentSaving(true);
+    setAgentStatus(null);
+    setAgentError(null);
+    try {
+      const result = await client.writeWorkspaceFile(id, {
+        path: OPENCODE_ROUTER_AGENT_FILE_PATH,
+        content: OPENCODE_ROUTER_AGENT_FILE_TEMPLATE,
+      });
+      setAgentExists(true);
+      setAgentContent(OPENCODE_ROUTER_AGENT_FILE_TEMPLATE);
+      setAgentDraft(OPENCODE_ROUTER_AGENT_FILE_TEMPLATE);
+      setAgentBaseUpdatedAt(
+        typeof result.updatedAt === "number" ? result.updatedAt : null,
+      );
+      setAgentStatus(t("identities.agent_created"));
+    } catch (error) {
+      setAgentError(formatRequestError(error));
+    } finally {
+      setAgentSaving(false);
+    }
+  }, [agentSaving, options.openworkServerClient, serverReady, workspaceId]);
+
+  useEffect(() => {
+    if (!messagingEnabled) return;
+    if (agentLoading || agentSaving || agentDirty) return;
+    if (agentExists) return;
+    if (agentAutoHealAttempted) return;
+    if (!workspaceId) return;
+
+    setAgentAutoHealAttempted(true);
+    void createDefaultAgentFile();
+  }, [
+    agentAutoHealAttempted,
+    agentDirty,
+    agentExists,
+    agentLoading,
+    agentSaving,
+    createDefaultAgentFile,
+    messagingEnabled,
+    workspaceId,
+  ]);
+
+  const saveAgentFile = useCallback(async () => {
+    if (agentSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    setAgentSaving(true);
+    setAgentStatus(null);
+    setAgentError(null);
+    try {
+      const result = await client.writeWorkspaceFile(id, {
+        path: OPENCODE_ROUTER_AGENT_FILE_PATH,
+        content: agentDraft,
+        baseUpdatedAt: agentBaseUpdatedAt,
+      });
+      setAgentExists(true);
+      setAgentContent(agentDraft);
+      setAgentBaseUpdatedAt(
+        typeof result.updatedAt === "number" ? result.updatedAt : null,
+      );
+      setAgentStatus(t("identities.agent_saved"));
+    } catch (error) {
+      if (error instanceof OpenworkServerError && error.status === 409) {
+        setAgentError(t("identities.agent_file_changed"));
+      } else {
+        setAgentError(formatRequestError(error));
+      }
+    } finally {
+      setAgentSaving(false);
+    }
+  }, [agentBaseUpdatedAt, agentDraft, agentSaving, options.openworkServerClient, serverReady, workspaceId]);
+
+  const sendTestMessage = useCallback(async () => {
+    if (sendBusy) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+    const text = sendText.trim();
+    if (!text) return;
+
+    setSendBusy(true);
+    setSendStatus(null);
+    setSendError(null);
+    setSendResult(null);
+    try {
+      const result = await client.sendOpenCodeRouterMessage(id, {
+        channel: sendChannel,
+        text,
+        ...(sendDirectory.trim() ? { directory: sendDirectory.trim() } : {}),
+        ...(sendPeerId.trim() ? { peerId: sendPeerId.trim() } : {}),
+        ...(sendAutoBind ? { autoBind: true } : {}),
+      });
+      setSendResult(result);
+      const base = t("identities.dispatched_messages", undefined, {
+        sent: result.sent,
+        attempted: result.attempted,
+      });
+      setSendStatus(
+        result.reason?.trim() ? `${base} ${result.reason.trim()}` : base,
+      );
+    } catch (error) {
+      setSendError(formatRequestError(error));
+    } finally {
+      setSendBusy(false);
+    }
+  }, [
+    options.openworkServerClient,
+    sendAutoBind,
+    sendBusy,
+    sendChannel,
+    sendDirectory,
+    sendPeerId,
+    sendText,
+    serverReady,
+    workspaceId,
+  ]);
+
+  const refreshAll = useCallback(async (nextOptions?: { force?: boolean }) => {
+    if (refreshing && !nextOptions?.force) return;
+    if (!serverReady) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+    const id = workspaceId;
+
+    setRefreshing(true);
+    try {
+      setHealthError(null);
+      setTelegramIdentitiesError(null);
+      setSlackIdentitiesError(null);
+      setMessagingError(null);
+
+      if (!id) {
+        setHealth(null);
+        setTelegramIdentities([]);
+        setTelegramBotUsername(null);
+        setTelegramPairingCode(null);
+        setSlackIdentities([]);
+        setHealthError(t("identities.worker_scope_unavailable_detail"));
+        setTelegramIdentitiesError(t("identities.worker_scope_unavailable"));
+        setSlackIdentitiesError(t("identities.worker_scope_unavailable"));
+        resetAgentState();
+        setSendStatus(null);
+        setSendError(null);
+        setSendResult(null);
+        return;
+      }
+
+      const config = await client.getConfig(id).catch(() => null);
+      const isModuleEnabled = readMessagingEnabledFromOpenworkConfig(config?.openwork);
+      setMessagingEnabled(isModuleEnabled);
+
+      if (!isModuleEnabled) {
+        setMessagingRestartRequired(false);
+        setHealth(null);
+        setHealthError(null);
+        setTelegramIdentities([]);
+        setTelegramIdentitiesError(null);
+        setTelegramBotUsername(null);
+        setTelegramPairingCode(null);
+        setSlackIdentities([]);
+        setSlackIdentitiesError(null);
+        if (!agentDirty && !agentSaving) {
+          void loadAgentFile();
+        }
+        return;
+      }
+
+      const [healthRes, tgRes, slackRes, telegramInfo] = await Promise.all([
+        client.getOpenCodeRouterHealth(id),
+        client.getOpenCodeRouterTelegramIdentities(id),
+        client.getOpenCodeRouterSlackIdentities(id),
+        client.getOpenCodeRouterTelegram(id).catch(() => null),
+      ]);
+
+      setTelegramBotUsername(getTelegramUsernameFromResult(telegramInfo));
+
+      if (isOpenCodeRouterSnapshot(healthRes.json)) {
+        setHealth(healthRes.json);
+        setMessagingRestartRequired(false);
+      } else {
+        setHealth(null);
+        if (!healthRes.ok) {
+          const message =
+            healthRes.json && typeof (healthRes.json as any).message === "string"
+              ? String((healthRes.json as any).message)
+              : t("identities.health_unavailable_status", undefined, {
+                  status: healthRes.status,
+                });
+          setHealthError(message);
+        }
+        setMessagingRestartRequired(true);
+      }
+
+      if (isOpenCodeRouterIdentities(tgRes)) {
+        setTelegramIdentities(tgRes.items ?? []);
+        if (!tgRes.items?.length) {
+          setTelegramPairingCode(null);
+        }
+      } else {
+        setTelegramIdentities([]);
+        setTelegramPairingCode(null);
+        setTelegramIdentitiesError(t("identities.telegram_unavailable"));
+      }
+
+      if (isOpenCodeRouterIdentities(slackRes)) {
+        setSlackIdentities(slackRes.items ?? []);
+      } else {
+        setSlackIdentities([]);
+        setSlackIdentitiesError(t("identities.slack_unavailable"));
+      }
+
+      if (!agentDirty && !agentSaving) {
+        void loadAgentFile();
+      }
+    } catch (error) {
+      const message = formatRequestError(error);
+      setHealth(null);
+      setTelegramIdentities([]);
+      setTelegramBotUsername(null);
+      setSlackIdentities([]);
+      setHealthError(message);
+      setTelegramIdentitiesError(message);
+      setSlackIdentitiesError(message);
+      if (messagingEnabled) {
+        setMessagingRestartRequired(true);
+      }
+    } finally {
+      setRefreshing(false);
+    }
+  }, [
+    agentDirty,
+    agentSaving,
+    loadAgentFile,
+    messagingEnabled,
+    options.openworkServerClient,
+    refreshing,
+    resetAgentState,
+    serverReady,
+    workspaceId,
+  ]);
+
+  const refreshAllRef = useRef(refreshAll);
+
+  useEffect(() => {
+    refreshAllRef.current = refreshAll;
+  }, [refreshAll]);
+
+  const repairAndReconnect = useCallback(async () => {
+    if (options.openworkReconnectBusy) return;
+    setReconnectStatus(null);
+    setReconnectError(null);
+
+    const ok = await options.reconnectOpenworkServer();
+    if (!ok) {
+      setReconnectError(t("identities.reconnect_failed"));
+      return;
+    }
+
+    setReconnectStatus(t("identities.reconnected_refreshing"));
+    await refreshAll({ force: true });
+    setReconnectStatus(t("identities.reconnected"));
+  }, [options, refreshAll]);
+
+  const enableMessagingModule = useCallback(async () => {
+    if (messagingSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    setMessagingSaving(true);
+    setMessagingStatus(null);
+    setMessagingError(null);
+    try {
+      await client.patchConfig(id, {
+        openwork: {
+          messaging: {
+            enabled: true,
+          },
+        },
+      });
+      setMessagingEnabled(true);
+      setMessagingRestartRequired(true);
+      setMessagingRiskOpen(false);
+      setMessagingRestartAction("enable");
+      setMessagingRestartPromptOpen(true);
+      setMessagingStatus(t("identities.messaging_enabled_restart"));
+      await refreshAll({ force: true });
+    } catch (error) {
+      setMessagingError(formatRequestError(error));
+    } finally {
+      setMessagingSaving(false);
+    }
+  }, [messagingSaving, options.openworkServerClient, refreshAll, serverReady, workspaceId]);
+
+  const disableMessagingModule = useCallback(async () => {
+    if (messagingSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    setMessagingSaving(true);
+    setMessagingStatus(null);
+    setMessagingError(null);
+    try {
+      await client.patchConfig(id, {
+        openwork: {
+          messaging: {
+            enabled: false,
+          },
+        },
+      });
+      setMessagingEnabled(false);
+      setMessagingDisableConfirmOpen(false);
+      setMessagingRestartRequired(true);
+      setMessagingRestartAction("disable");
+      setMessagingRestartPromptOpen(true);
+      setMessagingStatus(t("identities.messaging_disabled_restart"));
+      await refreshAll({ force: true });
+    } catch (error) {
+      setMessagingError(formatRequestError(error));
+    } finally {
+      setMessagingSaving(false);
+    }
+  }, [messagingSaving, options.openworkServerClient, refreshAll, serverReady, workspaceId]);
+
+  const restartMessagingWorker = useCallback(async () => {
+    if (messagingRestartBusy) return;
+    setMessagingRestartBusy(true);
+    setMessagingError(null);
+    setMessagingStatus(null);
+    try {
+      const ok = await options.restartMessagingWorker();
+      if (!ok) {
+        setMessagingError(t("identities.restart_failed"));
+        return;
+      }
+      setMessagingRestartPromptOpen(false);
+      setMessagingRestartRequired(false);
+      setMessagingStatus(t("identities.worker_restarted_refreshing"));
+      await refreshAll({ force: true });
+      setMessagingStatus(t("identities.worker_restarted"));
+    } catch (error) {
+      setMessagingError(formatRequestError(error));
+    } finally {
+      setMessagingRestartBusy(false);
+    }
+  }, [messagingRestartBusy, options.restartMessagingWorker, refreshAll]);
+
+  const upsertTelegram = useCallback(async (access: "public" | "private") => {
+    if (telegramSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    const token = telegramToken.trim();
+    if (!token) return;
+
+    setTelegramSaving(true);
+    setTelegramStatus(null);
+    setTelegramError(null);
+    try {
+      const result = await client.upsertOpenCodeRouterTelegramIdentity(id, {
+        token,
+        enabled: telegramEnabled,
+        access,
+      });
+      if (result.ok) {
+        const pairingCode =
+          typeof result.telegram?.pairingCode === "string"
+            ? result.telegram.pairingCode.trim()
+            : "";
+        if (access === "private" && pairingCode) {
+          setTelegramPairingCode(pairingCode);
+          setTelegramStatus(
+            t("identities.telegram_private_saved_pair", undefined, {
+              code: pairingCode,
+            }),
+          );
+        } else {
+          setTelegramPairingCode(null);
+        }
+        const username = (result.telegram as any)?.bot?.username;
+        if (username) {
+          const normalized = String(username).trim().replace(/^@+/, "");
+          setTelegramBotUsername(normalized || null);
+          if (access !== "private" || !pairingCode) {
+            setTelegramStatus(
+              t("identities.telegram_saved_username", undefined, {
+                username: normalized || String(username),
+              }),
+            );
+          }
+        } else if (access !== "private" || !pairingCode) {
+          setTelegramStatus(
+            result.applied === false
+              ? t("identities.telegram_saved_pending")
+              : t("identities.telegram_saved"),
+          );
+        }
+      } else {
+        setTelegramError(t("identities.telegram_save_failed"));
+      }
+      if (typeof result.applyError === "string" && result.applyError.trim()) {
+        setTelegramError(result.applyError.trim());
+      }
+      setTelegramToken("");
+      void refreshAll({ force: true });
+    } catch (error) {
+      setTelegramError(formatRequestError(error));
+    } finally {
+      setTelegramSaving(false);
+    }
+  }, [
+    options.openworkServerClient,
+    refreshAll,
+    serverReady,
+    telegramEnabled,
+    telegramSaving,
+    telegramToken,
+    workspaceId,
+  ]);
+
+  const deleteTelegram = useCallback(async (identityId: string) => {
+    if (telegramSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+    if (!identityId.trim()) return;
+
+    setTelegramSaving(true);
+    setTelegramStatus(null);
+    setTelegramError(null);
+    try {
+      const result = await client.deleteOpenCodeRouterTelegramIdentity(id, identityId);
+      if (result.ok) {
+        setTelegramBotUsername(null);
+        setTelegramPairingCode(null);
+        setTelegramStatus(
+          result.applied === false
+            ? t("identities.telegram_deleted_pending")
+            : t("identities.telegram_deleted"),
+        );
+      } else {
+        setTelegramError(t("identities.telegram_delete_failed"));
+      }
+      if (typeof result.applyError === "string" && result.applyError.trim()) {
+        setTelegramError(result.applyError.trim());
+      }
+      void refreshAll({ force: true });
+    } catch (error) {
+      setTelegramError(formatRequestError(error));
+    } finally {
+      setTelegramSaving(false);
+    }
+  }, [options.openworkServerClient, refreshAll, serverReady, telegramSaving, workspaceId]);
+
+  const copyTelegramPairingCode = useCallback(async () => {
+    if (!telegramPairingCode) return;
+    try {
+      await navigator.clipboard.writeText(telegramPairingCode);
+      setTelegramStatus(t("identities.pairing_code_copied"));
+    } catch {
+      setTelegramError(t("identities.pairing_code_copy_failed"));
+    }
+  }, [telegramPairingCode]);
+
+  const upsertSlack = useCallback(async () => {
+    if (slackSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+
+    const botToken = slackBotToken.trim();
+    const appToken = slackAppToken.trim();
+    if (!botToken || !appToken) return;
+
+    setSlackSaving(true);
+    setSlackStatus(null);
+    setSlackError(null);
+    try {
+      const result = await client.upsertOpenCodeRouterSlackIdentity(id, {
+        botToken,
+        appToken,
+        enabled: slackEnabled,
+      });
+      if (result.ok) {
+        setSlackStatus(
+          result.applied === false
+            ? t("identities.telegram_saved_pending")
+            : t("identities.telegram_saved"),
+        );
+      } else {
+        setSlackError(t("identities.telegram_save_failed"));
+      }
+      if (typeof result.applyError === "string" && result.applyError.trim()) {
+        setSlackError(result.applyError.trim());
+      }
+      setSlackBotToken("");
+      setSlackAppToken("");
+      void refreshAll({ force: true });
+    } catch (error) {
+      setSlackError(formatRequestError(error));
+    } finally {
+      setSlackSaving(false);
+    }
+  }, [
+    options.openworkServerClient,
+    refreshAll,
+    serverReady,
+    slackAppToken,
+    slackBotToken,
+    slackEnabled,
+    slackSaving,
+    workspaceId,
+  ]);
+
+  const deleteSlack = useCallback(async (identityId: string) => {
+    if (slackSaving) return;
+    if (!serverReady) return;
+    const id = workspaceId;
+    if (!id) return;
+    const client = options.openworkServerClient;
+    if (!client) return;
+    if (!identityId.trim()) return;
+
+    setSlackSaving(true);
+    setSlackStatus(null);
+    setSlackError(null);
+    try {
+      const result = await client.deleteOpenCodeRouterSlackIdentity(id, identityId);
+      if (result.ok) {
+        setSlackStatus(
+          result.applied === false
+            ? t("identities.telegram_deleted_pending")
+            : t("identities.telegram_deleted"),
+        );
+      } else {
+        setSlackError(t("identities.telegram_delete_failed"));
+      }
+      if (typeof result.applyError === "string" && result.applyError.trim()) {
+        setSlackError(result.applyError.trim());
+      }
+      void refreshAll({ force: true });
+    } catch (error) {
+      setSlackError(formatRequestError(error));
+    } finally {
+      setSlackSaving(false);
+    }
+  }, [options.openworkServerClient, refreshAll, serverReady, slackSaving, workspaceId]);
+
+  useEffect(() => {
+    setHealth(null);
+    setHealthError(null);
+    setTelegramIdentities([]);
+    setTelegramIdentitiesError(null);
+    setTelegramBotUsername(null);
+    setTelegramPairingCode(null);
+    setSlackIdentities([]);
+    setSlackIdentitiesError(null);
+    resetAgentState();
+    setSendStatus(null);
+    setSendError(null);
+    setSendResult(null);
+    setReconnectStatus(null);
+    setReconnectError(null);
+    setMessagingEnabled(false);
+    setMessagingSaving(false);
+    setMessagingStatus(null);
+    setMessagingError(null);
+    setMessagingRiskOpen(false);
+    setMessagingRestartRequired(false);
+    setMessagingRestartPromptOpen(false);
+    setMessagingRestartBusy(false);
+    setMessagingDisableConfirmOpen(false);
+    setMessagingRestartAction("enable");
+    setActiveTab("general");
+    setExpandedChannel("telegram");
+  }, [resetAgentState, scopedOpenworkBaseUrl, workspaceId]);
+
+  useEffect(() => {
+    void refreshAllRef.current({ force: true });
+    const interval = window.setInterval(() => {
+      void refreshAllRef.current();
+    }, 10_000);
+    return () => window.clearInterval(interval);
+  }, [scopedOpenworkBaseUrl, serverReady, workspaceId]);
+
+  return {
+    busy: options.busy,
+    showHeader: false,
+    openworkServerStatus: options.openworkServerStatus,
+    openworkServerUrl: options.openworkServerUrl,
+    scopedOpenworkBaseUrl,
+    workspaceId,
+    selectedWorkspaceRoot: options.selectedWorkspaceRoot,
+    refreshing,
+    openworkReconnectBusy: options.openworkReconnectBusy,
+    reconnectStatus,
+    reconnectError,
+    health,
+    healthError,
+    messagingEnabled,
+    messagingSaving,
+    messagingStatus,
+    messagingError,
+    messagingRestartRequired,
+    messagingRestartBusy,
+    activeTab,
+    expandedChannel,
+    telegram: {
+      identities: telegramIdentities,
+      identitiesError: telegramIdentitiesError,
+      token: telegramToken,
+      enabled: telegramEnabled,
+      saving: telegramSaving,
+      status: telegramStatus,
+      error: telegramError,
+      botUsername: telegramBotUsername,
+      pairingCode: telegramPairingCode,
+    },
+    slack: {
+      identities: slackIdentities,
+      identitiesError: slackIdentitiesError,
+      botToken: slackBotToken,
+      appToken: slackAppToken,
+      enabled: slackEnabled,
+      saving: slackSaving,
+      status: slackStatus,
+      error: slackError,
+    },
+    agent: {
+      loading: agentLoading,
+      saving: agentSaving,
+      exists: agentExists,
+      content: agentContent,
+      draft: agentDraft,
+      status: agentStatus,
+      error: agentError,
+    },
+    sendTest: {
+      channel: sendChannel,
+      directory: sendDirectory,
+      peerId: sendPeerId,
+      autoBind: sendAutoBind,
+      text: sendText,
+      busy: sendBusy,
+      status: sendStatus,
+      error: sendError,
+      result: sendResult,
+    },
+    modals: {
+      messagingRiskOpen,
+      messagingRestartPromptOpen,
+      messagingRestartAction,
+      messagingDisableConfirmOpen,
+      publicTelegramWarningOpen,
+    },
+    onRepairAndReconnect: repairAndReconnect,
+    onRefresh: () => refreshAll({ force: true }),
+    onSelectTab: setActiveTab,
+    onToggleExpandedChannel: (channel) =>
+      setExpandedChannel((prev) => (prev === channel ? null : channel)),
+    onOpenMessagingRisk: () => setMessagingRiskOpen(true),
+    onCancelMessagingRisk: () => {
+      if (messagingSaving) return;
+      setMessagingRiskOpen(false);
+    },
+    onConfirmEnableMessaging: enableMessagingModule,
+    onOpenDisableMessagingConfirm: () => setMessagingDisableConfirmOpen(true),
+    onCancelDisableMessagingConfirm: () => {
+      if (messagingSaving) return;
+      setMessagingDisableConfirmOpen(false);
+    },
+    onConfirmDisableMessaging: disableMessagingModule,
+    onCancelRestartPrompt: () => {
+      if (messagingRestartBusy) return;
+      setMessagingRestartPromptOpen(false);
+    },
+    onConfirmRestartMessagingWorker: restartMessagingWorker,
+    onTelegramTokenChange: setTelegramToken,
+    onTelegramEnabledChange: setTelegramEnabled,
+    onOpenPublicTelegramWarning: () => setPublicTelegramWarningOpen(true),
+    onCancelPublicTelegramWarning: () => setPublicTelegramWarningOpen(false),
+    onConfirmPublicTelegram: async () => {
+      setPublicTelegramWarningOpen(false);
+      await upsertTelegram("public");
+    },
+    onConnectPrivateTelegram: async () => {
+      await upsertTelegram("private");
+    },
+    onDeleteTelegram: deleteTelegram,
+    onCopyTelegramPairingCode: copyTelegramPairingCode,
+    onHideTelegramPairingCode: () => setTelegramPairingCode(null),
+    onSlackBotTokenChange: setSlackBotToken,
+    onSlackAppTokenChange: setSlackAppToken,
+    onSlackEnabledChange: setSlackEnabled,
+    onConnectSlack: upsertSlack,
+    onDeleteSlack: deleteSlack,
+    onLoadAgentFile: loadAgentFile,
+    onCreateDefaultAgentFile: createDefaultAgentFile,
+    onChangeAgentDraft: setAgentDraft,
+    onSaveAgentFile: saveAgentFile,
+    onChangeSendChannel: setSendChannel,
+    onChangeSendPeerId: setSendPeerId,
+    onChangeSendDirectory: setSendDirectory,
+    onChangeSendAutoBind: setSendAutoBind,
+    onChangeSendText: setSendText,
+    onSendTestMessage: sendTestMessage,
+  } satisfies MessagingViewProps;
+}
diff --git a/apps/app/src/react-app/domains/settings/state/model-controls-provider.tsx b/apps/app/src/react-app/domains/settings/state/model-controls-provider.tsx
new file mode 100644
index 0000000000..64961a377d
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/model-controls-provider.tsx
@@ -0,0 +1,30 @@
+/** @jsxImportSource react */
+import { createContext, useContext, type ReactNode } from "react";
+
+import type { ModelControlsStore } from "./model-controls-store";
+
+const ModelControlsContext = createContext<ModelControlsStore | null>(null);
+
+type ModelControlsProviderProps = {
+  store: ModelControlsStore;
+  children: ReactNode;
+};
+
+export function ModelControlsProvider({
+  store,
+  children,
+}: ModelControlsProviderProps) {
+  return (
+    <ModelControlsContext.Provider value={store}>
+      {children}
+    </ModelControlsContext.Provider>
+  );
+}
+
+export function useModelControls(): ModelControlsStore {
+  const context = useContext(ModelControlsContext);
+  if (!context) {
+    throw new Error("useModelControls must be used within a ModelControlsProvider");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/domains/settings/state/model-controls-store.ts b/apps/app/src/react-app/domains/settings/state/model-controls-store.ts
new file mode 100644
index 0000000000..2d6b74d471
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/model-controls-store.ts
@@ -0,0 +1,37 @@
+import type { ModelRef } from "../../../../app/types";
+
+export type ModelBehaviorOption = { value: string | null; label: string };
+
+export type ModelControlsStore = {
+  selectedSessionModelLabel: string;
+  openSessionModelPicker: (options?: {
+    returnFocusTarget?: "none" | "composer";
+  }) => void;
+  sessionModelVariantLabel: string;
+  sessionModelVariant: string | null;
+  sessionModelBehaviorOptions: ModelBehaviorOption[];
+  setSessionModelVariant: (value: string | null) => void;
+  defaultModelLabel: string;
+  defaultModelRef: string;
+  openDefaultModelPicker: () => void;
+  autoCompactContext: boolean;
+  toggleAutoCompactContext: () => void;
+  autoCompactContextBusy: boolean;
+  defaultModelVariantLabel: string;
+  editDefaultModelVariant: () => void;
+};
+
+export type ModelControlsOptions = ModelControlsStore;
+
+// In React the store is constructed externally (via a hook that reads the
+// Zustand kernel store + model-config state) and passed to ModelControlsProvider
+// as a plain object. We keep this helper so call sites mirror the Solid factory.
+export function createModelControlsStore(
+  options: ModelControlsOptions,
+): ModelControlsStore {
+  return options;
+}
+
+// Re-export ModelRef so downstream React modules can consume the type without
+// reaching back into app/types.
+export type { ModelRef };
diff --git a/apps/app/src/react-app/domains/settings/state/session-display-preferences.ts b/apps/app/src/react-app/domains/settings/state/session-display-preferences.ts
new file mode 100644
index 0000000000..56552e0380
--- /dev/null
+++ b/apps/app/src/react-app/domains/settings/state/session-display-preferences.ts
@@ -0,0 +1,35 @@
+import { useCallback } from "react";
+
+import { useLocal } from "../../../kernel/local-provider";
+
+type BooleanUpdater = boolean | ((current: boolean) => boolean);
+
+export function useSessionDisplayPreferences() {
+  const { prefs, setPrefs } = useLocal();
+
+  const setShowThinking = useCallback(
+    (value: BooleanUpdater) => {
+      setPrefs((previous) => ({
+        ...previous,
+        showThinking:
+          typeof value === "function" ? value(previous.showThinking) : value,
+      }));
+    },
+    [setPrefs],
+  );
+
+  const toggleShowThinking = useCallback(() => {
+    setShowThinking((current) => !current);
+  }, [setShowThinking]);
+
+  const resetSessionDisplayPreferences = useCallback(() => {
+    setShowThinking(false);
+  }, [setShowThinking]);
+
+  return {
+    showThinking: prefs.showThinking,
+    setShowThinking,
+    toggleShowThinking,
+    resetSessionDisplayPreferences,
+  };
+}
diff --git a/apps/app/src/react-app/domains/shell-feedback/reload-workspace-toast.tsx b/apps/app/src/react-app/domains/shell-feedback/reload-workspace-toast.tsx
new file mode 100644
index 0000000000..a410786d78
--- /dev/null
+++ b/apps/app/src/react-app/domains/shell-feedback/reload-workspace-toast.tsx
@@ -0,0 +1,178 @@
+/** @jsxImportSource react */
+import { AlertTriangle, RefreshCcw, X } from "lucide-react";
+
+import type { ReloadTrigger } from "../../../app/types";
+
+export type ReloadWorkspaceToastProps = {
+  open: boolean;
+  title: string;
+  description: string;
+  trigger?: ReloadTrigger | null;
+  warning?: string;
+  blockedReason?: string | null;
+  error?: string | null;
+  reloadLabel: string;
+  dismissLabel: string;
+  busy?: boolean;
+  canReload: boolean;
+  hasActiveRuns: boolean;
+  onReload: () => void;
+  onDismiss: () => void;
+};
+
+const buttonBaseClass =
+  "inline-flex items-center justify-center rounded-full px-3 py-1.5 text-xs font-medium transition-colors focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.18)] disabled:cursor-not-allowed disabled:opacity-60";
+const primaryButtonClass = `${buttonBaseClass} bg-[var(--dls-accent)] text-white hover:bg-[var(--dls-accent-hover)]`;
+const dangerButtonClass = `${buttonBaseClass} bg-red-9 text-white hover:bg-red-10`;
+const ghostButtonClass = `${buttonBaseClass} border border-transparent bg-transparent text-dls-text hover:bg-[var(--dls-hover)]`;
+
+function describeTrigger(
+  description: string,
+  trigger?: ReloadTrigger | null,
+): string {
+  if (!trigger) return description;
+  const { type, name, action } = trigger;
+  const trimmedName = name?.trim();
+  const verb =
+    action === "removed"
+      ? "was removed"
+      : action === "added"
+        ? "was added"
+        : action === "updated"
+          ? "was updated"
+          : "changed";
+
+  if (type === "skill") {
+    return trimmedName
+      ? `Skill '${trimmedName}' ${verb}. Reload to use it.`
+      : "Skills changed. Reload to apply.";
+  }
+  if (type === "plugin") {
+    return trimmedName
+      ? `Plugin '${trimmedName}' ${verb}. Reload to activate.`
+      : "Plugins changed. Reload to apply.";
+  }
+  if (type === "mcp") {
+    return trimmedName
+      ? `MCP '${trimmedName}' ${verb}. Reload to connect.`
+      : "MCP config changed. Reload to apply.";
+  }
+  if (type === "config") {
+    return trimmedName
+      ? `Config '${trimmedName}' ${verb}. Reload to apply.`
+      : "Config changed. Reload to apply.";
+  }
+  if (type === "agent") {
+    return trimmedName
+      ? `Agent '${trimmedName}' ${verb}. Reload to use it.`
+      : "Agents changed. Reload to apply.";
+  }
+  if (type === "command") {
+    return trimmedName
+      ? `Command '${trimmedName}' ${verb}. Reload to use it.`
+      : "Commands changed. Reload to apply.";
+  }
+  return "Config changed. Reload to apply.";
+}
+
+export function ReloadWorkspaceToast(props: ReloadWorkspaceToastProps) {
+  if (!props.open) return null;
+
+  const bodyHasContent =
+    Boolean(props.description) ||
+    Boolean(props.error) ||
+    Boolean(props.warning) ||
+    Boolean(props.blockedReason);
+
+  return (
+    <div className="w-full max-w-[24rem] overflow-hidden rounded-[1.4rem] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)] backdrop-blur-xl animate-in fade-in slide-in-from-top-4 duration-300">
+      <div className="flex items-start gap-3 px-4 py-4">
+        <div
+          className={`flex h-10 w-10 shrink-0 items-center justify-center rounded-2xl border ${
+            props.hasActiveRuns
+              ? "border-amber-6/40 bg-amber-4/80 text-amber-11"
+              : "border-sky-6/40 bg-sky-4/80 text-sky-11"
+          }`.trim()}
+        >
+          <RefreshCcw
+            size={18}
+            className={props.busy ? "animate-spin" : undefined}
+          />
+        </div>
+
+        <div className="min-w-0 flex-1">
+          <div className="flex items-start justify-between gap-3">
+            <div className="min-w-0">
+              <div className="flex items-center gap-2">
+                <span className="text-sm font-semibold text-gray-12 truncate">
+                  {props.title}
+                </span>
+                {props.hasActiveRuns ? (
+                  <span className="inline-flex items-center gap-1 rounded-full bg-amber-4 px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.18em] text-amber-11">
+                    Active tasks
+                  </span>
+                ) : null}
+              </div>
+
+              {bodyHasContent ? (
+                <div className="mt-1 space-y-1 text-sm leading-relaxed text-gray-10">
+                  <div>
+                    {props.hasActiveRuns ? (
+                      <span className="font-medium text-amber-11">
+                        Reloading will stop active tasks.
+                      </span>
+                    ) : props.error ? (
+                      <span className="font-medium text-red-11">
+                        {props.error}
+                      </span>
+                    ) : (
+                      describeTrigger(props.description, props.trigger)
+                    )}
+                  </div>
+                  {props.warning ? (
+                    <div className="flex items-start gap-2 rounded-2xl border border-amber-6/40 bg-amber-3/70 px-3 py-2 text-xs text-amber-11">
+                      <AlertTriangle size={14} className="mt-0.5 shrink-0" />
+                      <span>{props.warning}</span>
+                    </div>
+                  ) : null}
+                  {props.blockedReason ? (
+                    <div className="text-xs text-gray-9">
+                      Blocked: {props.blockedReason}
+                    </div>
+                  ) : null}
+                </div>
+              ) : null}
+            </div>
+
+            <button
+              type="button"
+              onClick={() => props.onDismiss()}
+              className="rounded-full p-1 text-gray-9 transition hover:bg-gray-3 hover:text-gray-12"
+              aria-label={props.dismissLabel}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          <div className="mt-3 flex flex-wrap items-center gap-2">
+            <button
+              type="button"
+              className={props.hasActiveRuns ? dangerButtonClass : primaryButtonClass}
+              onClick={() => props.onReload()}
+              disabled={props.busy || !props.canReload}
+            >
+              {props.reloadLabel}
+            </button>
+            <button
+              type="button"
+              className={ghostButtonClass}
+              onClick={() => props.onDismiss()}
+            >
+              {props.dismissLabel}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/shell-feedback/status-toast.tsx b/apps/app/src/react-app/domains/shell-feedback/status-toast.tsx
new file mode 100644
index 0000000000..ed3bdf18e6
--- /dev/null
+++ b/apps/app/src/react-app/domains/shell-feedback/status-toast.tsx
@@ -0,0 +1,91 @@
+/** @jsxImportSource react */
+import { AlertTriangle, CheckCircle2, CircleAlert, Info, X } from "lucide-react";
+
+export type StatusToastProps = {
+  open: boolean;
+  title: string;
+  description?: string | null;
+  tone?: "success" | "info" | "warning" | "error";
+  actionLabel?: string;
+  onAction?: () => void;
+  dismissLabel?: string;
+  onDismiss: () => void;
+};
+
+export function StatusToast(props: StatusToastProps) {
+  if (!props.open) return null;
+  const tone = props.tone ?? "info";
+
+  const tileClass =
+    tone === "success"
+      ? "border-emerald-6/40 bg-emerald-4/80 text-emerald-11"
+      : tone === "warning"
+        ? "border-amber-6/40 bg-amber-4/80 text-amber-11"
+        : tone === "error"
+          ? "border-red-6/40 bg-red-4/80 text-red-11"
+          : "border-sky-6/40 bg-sky-4/80 text-sky-11";
+
+  const Icon =
+    tone === "success"
+      ? CheckCircle2
+      : tone === "warning"
+        ? AlertTriangle
+        : tone === "error"
+          ? CircleAlert
+          : Info;
+
+  return (
+    <div className="w-full max-w-[24rem] overflow-hidden rounded-[1.4rem] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)] backdrop-blur-xl animate-in fade-in slide-in-from-top-4 duration-300">
+      <div className="flex items-start gap-3 px-4 py-4">
+        <div
+          className={`mt-0.5 flex h-10 w-10 shrink-0 items-center justify-center rounded-2xl border ${tileClass}`.trim()}
+        >
+          <Icon size={18} />
+        </div>
+
+        <div className="min-w-0 flex-1">
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <div className="text-sm font-semibold text-gray-12">
+                {props.title}
+              </div>
+              {props.description?.trim() ? (
+                <p className="mt-1 text-sm leading-relaxed text-gray-10">
+                  {props.description}
+                </p>
+              ) : null}
+            </div>
+
+            <button
+              type="button"
+              onClick={props.onDismiss}
+              className="rounded-full p-1 text-gray-9 transition hover:bg-gray-3 hover:text-gray-12"
+              aria-label={props.dismissLabel ?? "Dismiss"}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          {props.actionLabel && props.onAction ? (
+            <div className="mt-3 flex items-center gap-2">
+              <button
+                type="button"
+                className="inline-flex items-center justify-center rounded-full bg-[var(--dls-accent)] px-3 py-1.5 text-xs font-medium text-white transition-colors hover:bg-[var(--dls-accent-hover)]"
+                onClick={() => props.onAction?.()}
+              >
+                {props.actionLabel}
+              </button>
+              <button
+                type="button"
+                className="inline-flex items-center justify-center rounded-full border border-transparent bg-transparent px-3 py-1.5 text-xs font-medium text-dls-text transition-colors hover:bg-[var(--dls-hover)]"
+                onClick={props.onDismiss}
+              >
+                {props.dismissLabel ?? "Dismiss"}
+              </button>
+            </div>
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/shell-feedback/status-toasts.tsx b/apps/app/src/react-app/domains/shell-feedback/status-toasts.tsx
new file mode 100644
index 0000000000..873f0df551
--- /dev/null
+++ b/apps/app/src/react-app/domains/shell-feedback/status-toasts.tsx
@@ -0,0 +1,141 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+import { StatusToast } from "./status-toast";
+
+export type AppStatusToastTone = "success" | "info" | "warning" | "error";
+
+export type AppStatusToastInput = {
+  title: string;
+  description?: string | null;
+  tone?: AppStatusToastTone;
+  actionLabel?: string;
+  onAction?: () => void;
+  dismissLabel?: string;
+  durationMs?: number;
+};
+
+export type AppStatusToast = AppStatusToastInput & {
+  id: string;
+};
+
+export type StatusToastsStore = {
+  toasts: AppStatusToast[];
+  showToast: (input: AppStatusToastInput) => string;
+  dismissToast: (id: string) => void;
+  clearToasts: () => void;
+};
+
+const StatusToastsContext = createContext<StatusToastsStore | null>(null);
+
+const defaultDurationForTone = (tone: AppStatusToastTone) => {
+  if (tone === "warning" || tone === "error") return 4200;
+  return 3200;
+};
+
+type StatusToastsProviderProps = {
+  children: ReactNode;
+};
+
+export function StatusToastsProvider({ children }: StatusToastsProviderProps) {
+  const [toasts, setToasts] = useState<AppStatusToast[]>([]);
+  const timersRef = useRef(new Map<string, number>());
+  const counterRef = useRef(0);
+
+  const dismissToast = useCallback((id: string) => {
+    const timer = timersRef.current.get(id);
+    if (timer) {
+      window.clearTimeout(timer);
+      timersRef.current.delete(id);
+    }
+    setToasts((current) => current.filter((toast) => toast.id !== id));
+  }, []);
+
+  const showToast = useCallback(
+    (input: AppStatusToastInput) => {
+      const id = `status-toast-${Date.now()}-${counterRef.current++}`;
+      const tone = input.tone ?? "info";
+      const toast: AppStatusToast = { ...input, tone, id };
+      setToasts((current) => [...current, toast].slice(-4));
+
+      const duration = input.durationMs ?? defaultDurationForTone(tone);
+      if (duration > 0) {
+        const timer = window.setTimeout(() => {
+          timersRef.current.delete(id);
+          setToasts((current) => current.filter((item) => item.id !== id));
+        }, duration);
+        timersRef.current.set(id, timer);
+      }
+      return id;
+    },
+    [],
+  );
+
+  const clearToasts = useCallback(() => {
+    for (const timer of timersRef.current.values()) {
+      window.clearTimeout(timer);
+    }
+    timersRef.current.clear();
+    setToasts([]);
+  }, []);
+
+  useEffect(() => {
+    return () => {
+      const timers = timersRef.current;
+      for (const timer of timers.values()) {
+        window.clearTimeout(timer);
+      }
+      timers.clear();
+    };
+  }, []);
+
+  const store = useMemo<StatusToastsStore>(
+    () => ({ toasts, showToast, dismissToast, clearToasts }),
+    [clearToasts, dismissToast, showToast, toasts],
+  );
+
+  return (
+    <StatusToastsContext.Provider value={store}>
+      {children}
+    </StatusToastsContext.Provider>
+  );
+}
+
+export function useStatusToasts(): StatusToastsStore {
+  const context = useContext(StatusToastsContext);
+  if (!context) {
+    throw new Error("useStatusToasts must be used within a StatusToastsProvider");
+  }
+  return context;
+}
+
+export function StatusToastsViewport() {
+  const { toasts, dismissToast } = useStatusToasts();
+  return (
+    <>
+      {toasts.map((toast) => (
+        <div key={toast.id} className="pointer-events-auto">
+          <StatusToast
+            open
+            tone={toast.tone}
+            title={toast.title}
+            description={toast.description ?? null}
+            actionLabel={toast.actionLabel}
+            onAction={toast.onAction}
+            dismissLabel={toast.dismissLabel ?? "Dismiss"}
+            onDismiss={() => dismissToast(toast.id)}
+          />
+        </div>
+      ))}
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/domains/shell-feedback/top-right-notifications.tsx b/apps/app/src/react-app/domains/shell-feedback/top-right-notifications.tsx
new file mode 100644
index 0000000000..22834d8af6
--- /dev/null
+++ b/apps/app/src/react-app/domains/shell-feedback/top-right-notifications.tsx
@@ -0,0 +1,44 @@
+/** @jsxImportSource react */
+import type { ReloadTrigger } from "../../../app/types";
+
+import { ReloadWorkspaceToast } from "./reload-workspace-toast";
+import { StatusToastsViewport } from "./status-toasts";
+
+export type TopRightNotificationsProps = {
+  reloadOpen: boolean;
+  reloadTitle: string;
+  reloadDescription: string;
+  reloadTrigger?: ReloadTrigger | null;
+  reloadError?: string | null;
+  reloadLabel: string;
+  dismissLabel: string;
+  reloadBusy?: boolean;
+  canReload: boolean;
+  hasActiveRuns: boolean;
+  onReload: () => void;
+  onDismissReload: () => void;
+};
+
+export function TopRightNotifications(props: TopRightNotificationsProps) {
+  return (
+    <div className="pointer-events-none fixed right-4 top-4 z-50 flex w-[min(24rem,calc(100vw-1.5rem))] max-w-full flex-col gap-3 sm:right-6 sm:top-6">
+      <div className="pointer-events-auto">
+        <ReloadWorkspaceToast
+          open={props.reloadOpen}
+          title={props.reloadTitle}
+          description={props.reloadDescription}
+          trigger={props.reloadTrigger}
+          error={props.reloadError}
+          reloadLabel={props.reloadLabel}
+          dismissLabel={props.dismissLabel}
+          busy={props.reloadBusy}
+          canReload={props.canReload}
+          hasActiveRuns={props.hasActiveRuns}
+          onReload={props.onReload}
+          onDismiss={props.onDismissReload}
+        />
+      </div>
+      <StatusToastsViewport />
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/create-remote-workspace-modal.tsx b/apps/app/src/react-app/domains/workspace/create-remote-workspace-modal.tsx
new file mode 100644
index 0000000000..5220e1ba90
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/create-remote-workspace-modal.tsx
@@ -0,0 +1,149 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useRef, useState } from "react";
+import { X } from "lucide-react";
+
+import { t } from "../../../i18n";
+import {
+  errorBannerClass,
+  modalBodyClass,
+  modalHeaderButtonClass,
+  modalHeaderClass,
+  modalOverlayClass,
+  modalShellClass,
+  modalSubtitleClass,
+  modalTitleClass,
+  pillGhostClass,
+  pillPrimaryClass,
+} from "./modal-styles";
+import { RemoteWorkspaceFields } from "./remote-workspace-fields";
+import type { CreateRemoteWorkspaceModalProps } from "./types";
+
+export function CreateRemoteWorkspaceModal(
+  props: CreateRemoteWorkspaceModalProps,
+) {
+  const inputRef = useRef<HTMLInputElement | null>(null);
+
+  const [openworkHostUrl, setOpenworkHostUrl] = useState("");
+  const [openworkToken, setOpenworkToken] = useState("");
+  const [openworkTokenVisible, setOpenworkTokenVisible] = useState(false);
+  const [directory, setDirectory] = useState("");
+  const [displayName, setDisplayName] = useState("");
+
+  const showClose = props.showClose ?? true;
+  const title = props.title ?? t("dashboard.create_remote_workspace_title");
+  const subtitle =
+    props.subtitle ?? t("dashboard.create_remote_workspace_subtitle");
+  const confirmLabel =
+    props.confirmLabel ?? t("dashboard.create_remote_workspace_confirm");
+  const isInline = props.inline ?? false;
+  const submitting = props.submitting ?? false;
+
+  const canSubmit = useMemo(() => {
+    if (submitting) return false;
+    return openworkHostUrl.trim().length > 0;
+  }, [openworkHostUrl, submitting]);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const frame = requestAnimationFrame(() => inputRef.current?.focus());
+    return () => cancelAnimationFrame(frame);
+  }, [props.open]);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const defaults = props.initialValues ?? {};
+    setOpenworkHostUrl(defaults.openworkHostUrl?.trim() ?? "");
+    setOpenworkToken(defaults.openworkToken?.trim() ?? "");
+    setOpenworkTokenVisible(false);
+    setDirectory(defaults.directory?.trim() ?? "");
+    setDisplayName(defaults.displayName?.trim() ?? "");
+  }, [props.initialValues, props.open]);
+
+  if (!props.open && !isInline) {
+    return null;
+  }
+
+  const content = (
+    <div className={`${modalShellClass} max-w-[560px]`}>
+      <div className={modalHeaderClass}>
+        <div className="min-w-0">
+          <h3 className={modalTitleClass}>{title}</h3>
+          <p className={modalSubtitleClass}>{subtitle}</p>
+        </div>
+        {showClose ? (
+          <button
+            onClick={props.onClose}
+            disabled={submitting}
+            className={modalHeaderButtonClass}
+          >
+            <X size={18} />
+          </button>
+        ) : null}
+      </div>
+
+      <div className={modalBodyClass}>
+        <RemoteWorkspaceFields
+          hostUrl={openworkHostUrl}
+          onHostUrlInput={setOpenworkHostUrl}
+          token={openworkToken}
+          tokenVisible={openworkTokenVisible}
+          onTokenInput={setOpenworkToken}
+          onToggleTokenVisible={() =>
+            setOpenworkTokenVisible((prev) => !prev)
+          }
+          displayName={displayName}
+          onDisplayNameInput={setDisplayName}
+          directory={directory}
+          onDirectoryInput={setDirectory}
+          showDirectory
+          submitting={submitting}
+          hostInputRef={inputRef}
+          title="Remote server details"
+          description="Use the URL your OpenWork server shared with you. Add a token only if the server needs one."
+        />
+      </div>
+
+      <div className="space-y-3 border-t border-dls-border px-6 py-5">
+        {props.error ? (
+          <div className={errorBannerClass}>{props.error}</div>
+        ) : null}
+        <div className="flex justify-end gap-3">
+          {showClose ? (
+            <button
+              type="button"
+              onClick={props.onClose}
+              disabled={submitting}
+              className={pillGhostClass}
+            >
+              {t("common.cancel")}
+            </button>
+          ) : null}
+          <button
+            type="button"
+            onClick={() =>
+              props.onConfirm({
+                openworkHostUrl: openworkHostUrl.trim(),
+                openworkToken: openworkToken.trim(),
+                directory: directory.trim() ? directory.trim() : null,
+                displayName: displayName.trim() ? displayName.trim() : null,
+              })
+            }
+            disabled={!canSubmit}
+            title={
+              !openworkHostUrl.trim()
+                ? t("dashboard.remote_base_url_required")
+                : undefined
+            }
+            className={pillPrimaryClass}
+          >
+            {confirmLabel}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+
+  return (
+    <div className={isInline ? "w-full" : modalOverlayClass}>{content}</div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/create-workspace-local-panel.tsx b/apps/app/src/react-app/domains/workspace/create-workspace-local-panel.tsx
new file mode 100644
index 0000000000..4791cd3ffd
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/create-workspace-local-panel.tsx
@@ -0,0 +1,346 @@
+/** @jsxImportSource react */
+import { Check, FolderPlus, Loader2, XCircle } from "lucide-react";
+
+import type { WorkspacePreset } from "../../../app/types";
+import { t } from "../../../i18n";
+import {
+  errorBannerClass,
+  modalBodyClass,
+  modalFooterClass,
+  pillGhostClass,
+  pillPrimaryClass,
+  pillSecondaryClass,
+  sectionBodyClass,
+  sectionTitleClass,
+  softCardClass,
+  surfaceCardClass,
+  tagClass,
+  warningBannerClass,
+} from "./modal-styles";
+
+export type CreateWorkspaceProgressStep = {
+  key: string;
+  label: string;
+  status: "pending" | "active" | "done" | "error";
+  detail?: string | null;
+};
+
+export type CreateWorkspaceProgressSnapshot = {
+  runId: string;
+  startedAt: number;
+  stage: string;
+  error: string | null;
+  steps: CreateWorkspaceProgressStep[];
+  logs: string[];
+};
+
+export type CreateWorkspaceLocalPanelProps = {
+  selectedFolder: string | null;
+  hasSelectedFolder: boolean;
+  pickingFolder: boolean;
+  onPickFolder: () => void;
+  submitting: boolean;
+  localError: string | null;
+  onClose: () => void;
+  onSubmit: () => void;
+  confirmLabel?: string;
+  workerLabel?: string;
+  onConfirmWorker?: (preset: WorkspacePreset, folder: string | null) => void;
+  preset: WorkspacePreset;
+  workerSubmitting: boolean;
+  workerDisabled: boolean;
+  workerDisabledReason: string | null;
+  workerCtaLabel?: string;
+  workerCtaDescription?: string;
+  onWorkerCta?: () => void;
+  workerRetryLabel?: string;
+  onWorkerRetry?: () => void;
+  workerDebugLines: string[];
+  progress: CreateWorkspaceProgressSnapshot | null;
+  elapsedSeconds: number;
+  showProgressDetails: boolean;
+  onToggleProgressDetails: () => void;
+};
+
+function stepIcon(status: CreateWorkspaceProgressStep["status"]) {
+  if (status === "done")
+    return <XCircle size={16} className="text-emerald-10" />;
+  if (status === "active")
+    return <Loader2 size={16} className="animate-spin text-dls-accent" />;
+  if (status === "error") return <XCircle size={16} className="text-red-10" />;
+  return <div className="h-4 w-4 rounded-full border-2 border-dls-border" />;
+}
+
+function stepTextClass(status: CreateWorkspaceProgressStep["status"]) {
+  if (status === "done") return "text-dls-text font-medium";
+  if (status === "active") return "text-dls-text font-semibold";
+  if (status === "error") return "text-red-11 font-medium";
+  return "text-dls-secondary";
+}
+
+export function CreateWorkspaceLocalPanel(
+  props: CreateWorkspaceLocalPanelProps,
+) {
+  const progress = props.progress;
+
+  return (
+    <>
+      <div
+        className={`${modalBodyClass} transition-opacity duration-300 ${props.submitting ? "pointer-events-none opacity-40" : "opacity-100"}`}
+      >
+        <div className="space-y-4">
+          <div className={surfaceCardClass}>
+            <div className={sectionTitleClass}>
+              {t("welcome.folder_title")}
+            </div>
+            <div className={`${sectionBodyClass} mt-2`}>
+              {t("welcome.folder_explanation")}
+            </div>
+            <ul className="mt-3 space-y-1.5 pl-1">
+              <li className="flex items-start gap-2 text-[13px] text-dls-secondary">
+                <Check size={14} className="mt-0.5 shrink-0 text-emerald-10" />
+                {t("welcome.folder_read")}
+              </li>
+              <li className="flex items-start gap-2 text-[13px] text-dls-secondary">
+                <Check size={14} className="mt-0.5 shrink-0 text-emerald-10" />
+                {t("welcome.folder_write")}
+              </li>
+              <li className="flex items-start gap-2 text-[13px] text-dls-secondary">
+                <Check size={14} className="mt-0.5 shrink-0 text-emerald-10" />
+                {t("welcome.folder_anything")}
+              </li>
+            </ul>
+            <div className="mt-2 text-[12px] text-dls-secondary italic">
+              {t("welcome.folder_drop_hint")}
+            </div>
+
+            <div className="mt-4 rounded-[20px] border border-dls-border bg-dls-hover px-4 py-3">
+              {props.hasSelectedFolder ? (
+                <span className="block truncate font-mono text-[12px] text-dls-text">
+                  {props.selectedFolder}
+                </span>
+              ) : (
+                <span className="text-[14px] text-dls-secondary">
+                  No folder selected yet.
+                </span>
+              )}
+            </div>
+            <div className="mt-4">
+              <button
+                type="button"
+                onClick={props.onPickFolder}
+                disabled={props.pickingFolder || props.submitting}
+                className={pillSecondaryClass}
+              >
+                {props.pickingFolder ? (
+                  <Loader2 size={14} className="animate-spin" />
+                ) : (
+                  <FolderPlus size={14} />
+                )}
+                {props.hasSelectedFolder
+                  ? t("dashboard.change")
+                  : "Select folder"}
+              </button>
+            </div>
+          </div>
+
+        </div>
+      </div>
+
+      <div className={modalFooterClass}>
+        {props.submitting && progress ? (
+          <div className={softCardClass}>
+            <div className="flex items-start justify-between gap-3">
+              <div className="min-w-0">
+                <div className="flex items-center gap-2 text-[12px] font-semibold text-dls-text">
+                  {progress.error ? (
+                    <XCircle size={14} className="text-red-11" />
+                  ) : (
+                    <Loader2 size={14} className="animate-spin text-dls-accent" />
+                  )}
+                  Sandbox setup
+                </div>
+                <div className="mt-1 truncate text-[14px] leading-snug text-dls-text">
+                  {progress.stage}
+                </div>
+                <div className="mt-1 font-mono text-[10px] uppercase tracking-wider text-dls-secondary">
+                  {props.elapsedSeconds}s
+                </div>
+              </div>
+              <button
+                type="button"
+                className={pillGhostClass}
+                onClick={props.onToggleProgressDetails}
+              >
+                {props.showProgressDetails ? "Hide logs" : "Show logs"}
+              </button>
+            </div>
+
+            {progress.error ? (
+              <div className={`mt-3 ${errorBannerClass}`}>{progress.error}</div>
+            ) : null}
+
+            <div className="mt-4 grid gap-2.5">
+              {progress.steps.map((step) => (
+                <div key={step.key} className="flex items-center gap-3">
+                  <div className="flex h-5 w-5 shrink-0 items-center justify-center">
+                    {stepIcon(step.status)}
+                  </div>
+                  <div className="flex min-w-0 flex-1 items-center justify-between gap-2">
+                    <div
+                      className={`text-[12px] ${stepTextClass(step.status)} transition-colors duration-200`.trim()}
+                    >
+                      {step.label}
+                    </div>
+                    {step.detail?.trim() ? (
+                      <div
+                        className={`${tagClass} max-w-[120px] truncate font-mono`}
+                      >
+                        {step.detail}
+                      </div>
+                    ) : null}
+                  </div>
+                </div>
+              ))}
+            </div>
+
+            {props.showProgressDetails && progress.logs.length > 0 ? (
+              <div className={`mt-3 ${softCardClass}`}>
+                <div className="mb-2 text-[10px] font-semibold uppercase tracking-wide text-dls-secondary">
+                  Live logs
+                </div>
+                <div className="max-h-[120px] space-y-0.5 overflow-y-auto">
+                  {progress.logs.slice(-10).map((line, index) => (
+                    <div
+                      key={`${progress.runId}-log-${index}`}
+                      className="break-all font-mono text-[10px] leading-tight text-dls-text"
+                    >
+                      {line}
+                    </div>
+                  ))}
+                </div>
+              </div>
+            ) : null}
+          </div>
+        ) : null}
+
+        {props.onConfirmWorker &&
+        props.workerDisabled &&
+        props.workerDisabledReason ? (
+          <div className={warningBannerClass}>
+            <div className="font-semibold text-amber-12">
+              {t("dashboard.sandbox_get_ready_title")}
+            </div>
+            <div className="mt-1 leading-relaxed">
+              {props.workerDisabledReason || props.workerCtaDescription}
+            </div>
+            <div className="mt-3 flex flex-wrap items-center gap-2">
+              {props.onWorkerCta && props.workerCtaLabel?.trim() ? (
+                <button
+                  type="button"
+                  className={pillSecondaryClass}
+                  onClick={props.onWorkerCta}
+                  disabled={props.submitting}
+                >
+                  {props.workerCtaLabel}
+                </button>
+              ) : null}
+              {props.onWorkerRetry && props.workerRetryLabel?.trim() ? (
+                <button
+                  type="button"
+                  className={pillGhostClass}
+                  onClick={props.onWorkerRetry}
+                  disabled={props.submitting}
+                >
+                  {props.workerRetryLabel}
+                </button>
+              ) : null}
+            </div>
+            {props.workerDebugLines.length > 0 ? (
+              <details
+                className={`mt-3 ${softCardClass} text-[11px] text-dls-text`}
+              >
+                <summary className="cursor-pointer text-[12px] font-semibold text-dls-text">
+                  Docker debug details
+                </summary>
+                <div className="mt-2 space-y-1 break-words font-mono">
+                  {props.workerDebugLines.map((line, index) => (
+                    <div key={`docker-line-${index}`}>{line}</div>
+                  ))}
+                </div>
+              </details>
+            ) : null}
+          </div>
+        ) : null}
+
+        {props.localError ? (
+          <div className="mb-3 whitespace-pre-line rounded-[20px] border border-red-7/20 bg-red-1/40 px-4 py-3 text-[13px] text-red-11">
+            {props.localError}
+          </div>
+        ) : null}
+
+        <div className="flex justify-end gap-3">
+          <button
+            type="button"
+            onClick={props.onClose}
+            disabled={props.submitting}
+            className={pillGhostClass}
+          >
+            {t("common.cancel")}
+          </button>
+          {props.onConfirmWorker ? (
+            <button
+              type="button"
+              onClick={() =>
+                props.onConfirmWorker?.(props.preset, props.selectedFolder)
+              }
+              disabled={
+                !props.selectedFolder ||
+                props.submitting ||
+                props.workerSubmitting ||
+                props.workerDisabled
+              }
+              title={
+                !props.selectedFolder
+                  ? t("dashboard.choose_folder_continue")
+                  : props.workerDisabledReason || undefined
+              }
+              className={pillSecondaryClass}
+            >
+              {props.workerSubmitting ? (
+                <span className="inline-flex items-center gap-2">
+                  <Loader2 size={16} className="animate-spin" />
+                  {t("dashboard.sandbox_checking_docker")}
+                </span>
+              ) : (
+                (props.workerLabel ??
+                  t("dashboard.create_sandbox_confirm"))
+              )}
+            </button>
+          ) : null}
+          <button
+            type="button"
+            onClick={() => void props.onSubmit()}
+            disabled={!props.selectedFolder || props.submitting}
+            title={
+              !props.selectedFolder
+                ? t("dashboard.choose_folder_continue")
+                : undefined
+            }
+            className={pillPrimaryClass}
+          >
+            {props.submitting ? (
+              <span className="inline-flex items-center gap-2">
+                <Loader2 size={16} className="animate-spin" />
+                Creating…
+              </span>
+            ) : (
+              (props.confirmLabel ??
+                t("dashboard.create_workspace_confirm"))
+            )}
+          </button>
+        </div>
+      </div>
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/create-workspace-modal.tsx b/apps/app/src/react-app/domains/workspace/create-workspace-modal.tsx
new file mode 100644
index 0000000000..527e607b1f
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/create-workspace-modal.tsx
@@ -0,0 +1,629 @@
+/** @jsxImportSource react */
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { ArrowLeft, Cloud, FolderPlus, Globe, Loader2, X } from "lucide-react";
+
+import { t } from "../../../i18n";
+import {
+  buildDenAuthUrl,
+  createDenClient,
+  type DenOrgSummary,
+  type DenWorkerSummary,
+  readDenSettings,
+  resolveDenBaseUrls,
+  writeDenSettings,
+} from "../../../app/lib/den";
+import type { WorkspacePreset } from "../../../app/types";
+import { usePlatform } from "../../kernel/platform";
+import { CreateWorkspaceLocalPanel } from "./create-workspace-local-panel";
+import { CreateWorkspaceSharedPanel } from "./create-workspace-shared-panel";
+import {
+  modalBodyClass,
+  modalHeaderButtonClass,
+  modalHeaderClass,
+  modalOverlayClass,
+  modalShellClass,
+  modalSubtitleClass,
+  modalTitleClass,
+  pillGhostClass,
+  pillPrimaryClass,
+  tagClass,
+} from "./modal-styles";
+import { WorkspaceOptionCard } from "./option-card";
+import { RemoteWorkspaceFields } from "./remote-workspace-fields";
+import type {
+  CreateWorkspaceModalProps,
+  CreateWorkspaceScreen,
+  RemoteWorkspaceInput,
+} from "./types";
+
+function workerStatusMeta(status: string) {
+  const normalized = status.trim().toLowerCase();
+  switch (normalized) {
+    case "healthy":
+      return {
+        label: t("dashboard.worker_status_ready"),
+        tone: "ready" as const,
+        canOpen: true,
+      };
+    case "provisioning":
+    case "starting":
+      return {
+        label: t("dashboard.worker_status_starting"),
+        tone: "warning" as const,
+        canOpen: false,
+      };
+    case "failed":
+    case "error":
+      return {
+        label: t("dashboard.worker_status_attention"),
+        tone: "error" as const,
+        canOpen: false,
+      };
+    case "stopped":
+      return {
+        label: t("dashboard.worker_status_stopped"),
+        tone: "neutral" as const,
+        canOpen: false,
+      };
+    default:
+      return {
+        label: normalized
+          ? `${normalized.slice(0, 1).toUpperCase()}${normalized.slice(1)}`
+          : t("common.unknown"),
+        tone: "neutral" as const,
+        canOpen: normalized === "ready",
+      };
+  }
+}
+
+function workerSecondaryLine(worker: DenWorkerSummary) {
+  const parts = [worker.provider?.trim() || t("dashboard.cloud_worker")];
+  if (worker.instanceUrl?.trim()) parts.push(worker.instanceUrl.trim());
+  return parts.join(" · ");
+}
+
+export function CreateWorkspaceModal(props: CreateWorkspaceModalProps) {
+  const remoteUrlRef = useRef<HTMLInputElement | null>(null);
+  const platform = usePlatform();
+
+  const [screen, setScreen] = useState<CreateWorkspaceScreen>("chooser");
+  const preset = props.defaultPreset ?? "starter";
+  const [selectedFolder, setSelectedFolder] = useState<string | null>(null);
+  const [pickingFolder, setPickingFolder] = useState(false);
+  const [showProgressDetails, setShowProgressDetails] = useState(false);
+  const [now, setNow] = useState(() => Date.now());
+  const [cloudSettings, setCloudSettings] = useState(() => readDenSettings());
+  const [remoteUrl, setRemoteUrl] = useState("");
+  const [remoteToken, setRemoteToken] = useState("");
+  const [remoteDisplayName, setRemoteDisplayName] = useState("");
+  const [remoteTokenVisible, setRemoteTokenVisible] = useState(false);
+  const [orgs, setOrgs] = useState<DenOrgSummary[]>([]);
+  const [activeOrgId, setActiveOrgId] = useState("");
+  const [orgsBusy, setOrgsBusy] = useState(false);
+  const [orgsError, setOrgsError] = useState<string | null>(null);
+  const [workers, setWorkers] = useState<DenWorkerSummary[]>([]);
+  const [workersBusy, setWorkersBusy] = useState(false);
+  const [workersError, setWorkersError] = useState<string | null>(null);
+  const [openingWorkerId, setOpeningWorkerId] = useState<string | null>(null);
+  const [workerSearch, setWorkerSearch] = useState("");
+
+  const showClose = props.showClose ?? true;
+  const isInline = props.inline ?? false;
+  const submitting = props.submitting ?? false;
+  const remoteSubmitting = props.remoteSubmitting ?? false;
+  const workerSubmitting = props.workerSubmitting ?? false;
+  const progress = props.submittingProgress ?? null;
+  const workerDisabled = Boolean(props.workerDisabled);
+  const workerDisabledReason = (props.workerDisabledReason ?? "").trim();
+  const workerDebugLines = useMemo(
+    () => (props.workerDebugLines ?? []).map((line) => line.trim()).filter(Boolean),
+    [props.workerDebugLines],
+  );
+  const hasSelectedFolder = Boolean(selectedFolder?.trim());
+  const localError = (props.localError ?? "").trim() || null;
+  const remoteError = (props.remoteError ?? "").trim() || null;
+  const isSignedIn = Boolean(cloudSettings.authToken?.trim());
+  const denClient = useMemo(
+    () =>
+      createDenClient({
+        baseUrl: cloudSettings.baseUrl,
+        token: cloudSettings.authToken ?? "",
+      }),
+    [cloudSettings.authToken, cloudSettings.baseUrl],
+  );
+  const elapsedSeconds = useMemo(() => {
+    if (!progress?.startedAt) return 0;
+    return Math.max(0, Math.floor((now - progress.startedAt) / 1000));
+  }, [now, progress]);
+  const filteredWorkers = useMemo(() => {
+    const query = workerSearch.trim().toLowerCase();
+    if (!query) return workers;
+    return workers.filter((worker) => {
+      const haystack = [
+        worker.workerName,
+        worker.provider,
+        worker.instanceUrl,
+        worker.status,
+      ]
+        .filter(Boolean)
+        .join(" ")
+        .toLowerCase();
+      return haystack.includes(query);
+    });
+  }, [workerSearch, workers]);
+
+  const modalWidthClass =
+    screen === "shared" ? "max-w-[640px]" : "max-w-[560px]";
+
+  const headerTitle = (() => {
+    switch (screen) {
+      case "local":
+        return t("dashboard.create_local_workspace_title");
+      case "remote":
+        return t("dashboard.create_remote_custom_title");
+      case "shared":
+        return t("dashboard.create_shared_title");
+      default:
+        return props.title ?? t("dashboard.create_workspace_title");
+    }
+  })();
+
+  const headerSubtitle = (() => {
+    switch (screen) {
+      case "local":
+        return t("dashboard.create_local_workspace_subtitle");
+      case "remote":
+        return t("dashboard.create_remote_custom_subtitle");
+      case "shared":
+        return isSignedIn
+          ? t("dashboard.create_shared_subtitle_signed_in")
+          : t("dashboard.create_shared_subtitle_signed_out");
+      default:
+        return props.subtitle ?? t("dashboard.create_workspace_subtitle");
+    }
+  })();
+
+  // Reset state when the modal opens.
+  useEffect(() => {
+    if (!props.open) return;
+    const settings = readDenSettings();
+    setScreen("chooser");
+    setCloudSettings(settings);
+    setRemoteUrl("");
+    setRemoteToken("");
+    setRemoteDisplayName("");
+    setRemoteTokenVisible(false);
+    setWorkerSearch("");
+    setOrgs([]);
+    setWorkers([]);
+    setOrgsError(null);
+    setWorkersError(null);
+    setActiveOrgId(settings.activeOrgId?.trim() ?? "");
+  }, [props.open]);
+
+  // React to Den session changes.
+  useEffect(() => {
+    if (!props.open && !isInline) return;
+    const handler = () => {
+      const settings = readDenSettings();
+      setCloudSettings(settings);
+      setActiveOrgId(settings.activeOrgId?.trim() ?? "");
+    };
+    window.addEventListener(
+      "openwork-den-session-updated",
+      handler as EventListener,
+    );
+    return () =>
+      window.removeEventListener(
+        "openwork-den-session-updated",
+        handler as EventListener,
+      );
+  }, [isInline, props.open]);
+
+  // Tick the "elapsed" clock while submitting.
+  useEffect(() => {
+    if (!submitting) {
+      setShowProgressDetails(false);
+      return;
+    }
+    const id = window.setInterval(() => setNow(Date.now()), 500);
+    return () => window.clearInterval(id);
+  }, [submitting]);
+
+  // Focus the URL field when the remote screen opens.
+  useEffect(() => {
+    if (!props.open) return;
+    if (screen !== "remote") return;
+    const frame = requestAnimationFrame(() => remoteUrlRef.current?.focus());
+    return () => cancelAnimationFrame(frame);
+  }, [props.open, screen]);
+
+  const applyActiveOrg = useCallback(
+    (nextOrg: DenOrgSummary | null) => {
+      setActiveOrgId(nextOrg?.id ?? "");
+      const nextSettings = {
+        ...cloudSettings,
+        activeOrgId: nextOrg?.id ?? null,
+        activeOrgSlug: nextOrg?.slug ?? null,
+        activeOrgName: nextOrg?.name ?? null,
+      };
+      writeDenSettings(nextSettings);
+      setCloudSettings(nextSettings);
+    },
+    [cloudSettings],
+  );
+
+  const refreshOrgs = useCallback(async () => {
+    if (!isSignedIn) return;
+    setOrgsBusy(true);
+    setOrgsError(null);
+    try {
+      const { orgs: nextOrgs, defaultOrgId } = await denClient.listOrgs();
+      setOrgs(nextOrgs);
+      const preferred = cloudSettings.activeOrgId?.trim();
+      const nextActive =
+        nextOrgs.find((org) => org.id === preferred) ??
+        nextOrgs.find((org) => org.id === defaultOrgId) ??
+        nextOrgs[0] ??
+        null;
+      applyActiveOrg(nextActive);
+    } catch (error) {
+      setOrgsError(
+        error instanceof Error
+          ? error.message
+          : t("dashboard.error_load_orgs"),
+      );
+    } finally {
+      setOrgsBusy(false);
+    }
+  }, [
+    applyActiveOrg,
+    cloudSettings.activeOrgId,
+    denClient,
+    isSignedIn,
+  ]);
+
+  const refreshWorkers = useCallback(
+    async (orgId = activeOrgId.trim()) => {
+      if (!orgId || !isSignedIn) return;
+      setWorkersBusy(true);
+      setWorkersError(null);
+      try {
+        const nextWorkers = await denClient.listWorkers(orgId);
+        setWorkers(nextWorkers);
+      } catch (error) {
+        setWorkersError(
+          error instanceof Error
+            ? error.message
+            : t("dashboard.error_load_shared_workspaces"),
+        );
+      } finally {
+        setWorkersBusy(false);
+      }
+    },
+    [activeOrgId, denClient, isSignedIn],
+  );
+
+  // Load orgs/workers when the shared tab is active and signed in.
+  useEffect(() => {
+    if (!props.open || screen !== "shared" || !isSignedIn) return;
+    void refreshOrgs();
+  }, [isSignedIn, props.open, refreshOrgs, screen]);
+
+  useEffect(() => {
+    if (!props.open || screen !== "shared" || !isSignedIn) return;
+    const orgId = activeOrgId.trim();
+    if (!orgId) return;
+    void refreshWorkers(orgId);
+  }, [activeOrgId, isSignedIn, props.open, refreshWorkers, screen]);
+
+  const handlePickFolder = async () => {
+    if (pickingFolder) return;
+    setPickingFolder(true);
+    try {
+      await new Promise((resolve) =>
+        requestAnimationFrame(() => resolve(null)),
+      );
+      const next = await props.onPickFolder();
+      if (next) setSelectedFolder(next);
+    } finally {
+      setPickingFolder(false);
+    }
+  };
+
+  const openCloudSignIn = () => {
+    platform.openLink(buildDenAuthUrl(cloudSettings.baseUrl, "sign-in"));
+  };
+
+  const openCloudDashboard = () => {
+    platform.openLink(resolveDenBaseUrls(cloudSettings.baseUrl).baseUrl);
+  };
+
+  const handleRemoteSubmit = async () => {
+    if (!props.onConfirmRemote) return;
+    await Promise.resolve(
+      props.onConfirmRemote({
+        openworkHostUrl: remoteUrl.trim(),
+        openworkToken: remoteToken.trim() || null,
+        directory: null,
+        displayName: remoteDisplayName.trim() || null,
+        closeModal: true,
+      }),
+    );
+  };
+
+  const handleOpenWorker = async (worker: DenWorkerSummary) => {
+    if (!props.onConfirmRemote) return;
+    const orgId = activeOrgId.trim();
+    if (!orgId) {
+      setWorkersError(t("dashboard.error_choose_org"));
+      return;
+    }
+    setOpeningWorkerId(worker.workerId);
+    setWorkersError(null);
+    try {
+      const tokens = await denClient.getWorkerTokens(worker.workerId, orgId);
+      const openworkUrl = tokens.openworkUrl?.trim() ?? "";
+      const accessToken =
+        tokens.ownerToken?.trim() || tokens.clientToken?.trim() || "";
+      if (!openworkUrl || !accessToken) {
+        throw new Error(t("dashboard.error_workspace_not_ready"));
+      }
+      const ok = await Promise.resolve(
+        props.onConfirmRemote({
+          openworkHostUrl: openworkUrl,
+          openworkToken: accessToken,
+          openworkClientToken: tokens.clientToken?.trim() || null,
+          openworkHostToken: tokens.hostToken?.trim() || null,
+          directory: null,
+          displayName: worker.workerName,
+          closeModal: true,
+        }),
+      );
+      if (ok === false) {
+        throw new Error(
+          t("dashboard.error_connect_worker", {
+            name: worker.workerName,
+          }),
+        );
+      }
+    } catch (error) {
+      setWorkersError(
+        error instanceof Error
+          ? error.message
+          : t("dashboard.error_connect_worker", {
+              name: worker.workerName,
+            }),
+      );
+    } finally {
+      setOpeningWorkerId(null);
+    }
+  };
+
+  const handleLocalSubmit = async () => {
+    props.onConfirm(preset, selectedFolder);
+  };
+
+  if (!props.open && !isInline) {
+    return null;
+  }
+
+  const content = (
+    <div className={`${modalShellClass} ${modalWidthClass}`}>
+      <div className={modalHeaderClass}>
+        <div className="flex min-w-0 items-start gap-3">
+          {screen !== "chooser" ? (
+            <button
+              type="button"
+              onClick={() => setScreen("chooser")}
+              disabled={submitting || remoteSubmitting}
+              className={modalHeaderButtonClass}
+              aria-label={t("dashboard.modal_back")}
+            >
+              <ArrowLeft size={18} />
+            </button>
+          ) : null}
+          <div className="min-w-0">
+            <h3 className={modalTitleClass}>{headerTitle}</h3>
+            <p className={modalSubtitleClass}>{headerSubtitle}</p>
+          </div>
+        </div>
+        {showClose ? (
+          <button
+            type="button"
+            onClick={props.onClose}
+            disabled={submitting || remoteSubmitting}
+            className={modalHeaderButtonClass}
+            aria-label={t("dashboard.modal_close")}
+          >
+            <X size={18} />
+          </button>
+        ) : null}
+      </div>
+
+      {screen === "chooser" ? (
+        <div className={modalBodyClass}>
+          <div className="space-y-3">
+            <WorkspaceOptionCard
+              title={t("dashboard.create_local_workspace_title")}
+              description={
+                props.localDisabled
+                  ? props.localDisabledReason?.trim() ||
+                    t("dashboard.chooser_local_desc")
+                  : t("dashboard.chooser_local_desc")
+              }
+              icon={FolderPlus}
+              onClick={() => setScreen("local")}
+              disabled={props.localDisabled}
+              endAdornment={
+                props.localDisabled ? (
+                  <span className={tagClass}>
+                    {t("dashboard.desktop_badge")}
+                  </span>
+                ) : undefined
+              }
+            />
+            <WorkspaceOptionCard
+              title={t("dashboard.create_remote_custom_title")}
+              description={t("dashboard.chooser_remote_desc")}
+              icon={Globe}
+              onClick={() => setScreen("remote")}
+            />
+            <WorkspaceOptionCard
+              title={t("dashboard.create_shared_title")}
+              description={t("dashboard.chooser_shared_desc")}
+              icon={Cloud}
+              onClick={() => setScreen("shared")}
+            />
+
+            {props.onImportConfig ? (
+              <div className="pt-2">
+                <button
+                  type="button"
+                  onClick={() => props.onImportConfig?.()}
+                  disabled={props.importingConfig}
+                  className={pillGhostClass}
+                >
+                  {props.importingConfig ? (
+                    <span className="inline-flex items-center gap-2">
+                      <Loader2 size={14} className="animate-spin" />
+                      {t("dashboard.importing")}
+                    </span>
+                  ) : (
+                    t("dashboard.import_config")
+                  )}
+                </button>
+              </div>
+            ) : null}
+          </div>
+        </div>
+      ) : null}
+
+      {screen === "local" ? (
+        <CreateWorkspaceLocalPanel
+          selectedFolder={selectedFolder}
+          hasSelectedFolder={hasSelectedFolder}
+          pickingFolder={pickingFolder}
+          onPickFolder={() => void handlePickFolder()}
+          submitting={submitting}
+          localError={localError}
+          onClose={props.onClose}
+          onSubmit={() => void handleLocalSubmit()}
+          confirmLabel={props.confirmLabel}
+          workerLabel={props.workerLabel}
+          onConfirmWorker={props.onConfirmWorker}
+          preset={preset}
+          workerSubmitting={workerSubmitting}
+          workerDisabled={workerDisabled}
+          workerDisabledReason={workerDisabledReason}
+          workerCtaLabel={props.workerCtaLabel}
+          workerCtaDescription={props.workerCtaDescription}
+          onWorkerCta={props.onWorkerCta}
+          workerRetryLabel={props.workerRetryLabel}
+          onWorkerRetry={props.onWorkerRetry}
+          workerDebugLines={workerDebugLines}
+          progress={progress}
+          elapsedSeconds={elapsedSeconds}
+          showProgressDetails={showProgressDetails}
+          onToggleProgressDetails={() =>
+            setShowProgressDetails((prev) => !prev)
+          }
+        />
+      ) : null}
+
+      {screen === "remote" ? (
+        <>
+          <div className={modalBodyClass}>
+            <RemoteWorkspaceFields
+              hostUrl={remoteUrl}
+              onHostUrlInput={setRemoteUrl}
+              token={remoteToken}
+              tokenVisible={remoteTokenVisible}
+              onTokenInput={setRemoteToken}
+              onToggleTokenVisible={() =>
+                setRemoteTokenVisible((prev) => !prev)
+              }
+              displayName={remoteDisplayName}
+              onDisplayNameInput={setRemoteDisplayName}
+              submitting={remoteSubmitting}
+              hostInputRef={remoteUrlRef}
+              title={t("dashboard.remote_server_details_title")}
+              description={t("dashboard.remote_server_details_hint")}
+            />
+          </div>
+          <div className="space-y-3 border-t border-dls-border px-6 py-5">
+            {remoteError ? (
+              <div className="rounded-[20px] border border-red-7/20 bg-red-1/40 px-4 py-3 text-[13px] text-red-11">
+                {remoteError}
+              </div>
+            ) : null}
+            <div className="flex justify-end gap-3">
+              <button
+                type="button"
+                className={pillGhostClass}
+                onClick={props.onClose}
+                disabled={remoteSubmitting}
+              >
+                {t("common.cancel")}
+              </button>
+              <button
+                type="button"
+                className={pillPrimaryClass}
+                disabled={!remoteUrl.trim() || remoteSubmitting}
+                onClick={() => void handleRemoteSubmit()}
+              >
+                {remoteSubmitting ? (
+                  <span className="inline-flex items-center gap-2">
+                    <Loader2 size={16} className="animate-spin" />
+                    {t("dashboard.connecting")}
+                  </span>
+                ) : (
+                  t("dashboard.connect_remote_button")
+                )}
+              </button>
+            </div>
+          </div>
+        </>
+      ) : null}
+
+      {screen === "shared" ? (
+        <CreateWorkspaceSharedPanel
+          signedIn={isSignedIn}
+          orgs={orgs}
+          activeOrgId={activeOrgId}
+          onActiveOrgChange={(orgId) => {
+            const nextOrg = orgs.find((org) => org.id === orgId) ?? null;
+            applyActiveOrg(nextOrg);
+          }}
+          orgsBusy={orgsBusy}
+          orgsError={orgsError}
+          workers={workers}
+          workersBusy={workersBusy}
+          workersError={workersError}
+          workerSearch={workerSearch}
+          onWorkerSearchInput={setWorkerSearch}
+          filteredWorkers={filteredWorkers}
+          openingWorkerId={openingWorkerId}
+          workerStatusMeta={(status) => workerStatusMeta(status)}
+          workerSecondaryLine={(worker) => workerSecondaryLine(worker)}
+          onOpenWorker={(worker) => void handleOpenWorker(worker)}
+          onOpenCloudSignIn={openCloudSignIn}
+          onRefreshWorkers={() => void refreshWorkers()}
+          onOpenCloudDashboard={openCloudDashboard}
+        />
+      ) : null}
+    </div>
+  );
+
+  return (
+    <div className={isInline ? "w-full" : modalOverlayClass}>{content}</div>
+  );
+}
+
+export type { RemoteWorkspaceInput };
diff --git a/apps/app/src/react-app/domains/workspace/create-workspace-shared-panel.tsx b/apps/app/src/react-app/domains/workspace/create-workspace-shared-panel.tsx
new file mode 100644
index 0000000000..3ed8eea793
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/create-workspace-shared-panel.tsx
@@ -0,0 +1,257 @@
+/** @jsxImportSource react */
+import { useMemo } from "react";
+import { Boxes, Cloud, Loader2, RefreshCcw, Search } from "lucide-react";
+
+import type { DenOrgSummary, DenWorkerSummary } from "../../../app/lib/den";
+import {
+  errorBannerClass,
+  iconTileClass,
+  inputClass,
+  modalBodyClass,
+  pillGhostClass,
+  pillPrimaryClass,
+  pillSecondaryClass,
+  sectionBodyClass,
+  sectionTitleClass,
+  surfaceCardClass,
+} from "./modal-styles";
+
+type WorkerStatusMeta = {
+  label: string;
+  tone: "ready" | "warning" | "neutral" | "error";
+  canOpen: boolean;
+};
+
+const statusBadgeClass = (tone: WorkerStatusMeta["tone"]): string => {
+  switch (tone) {
+    case "ready":
+      return "border-emerald-7/30 bg-emerald-3/40 text-emerald-11";
+    case "warning":
+      return "border-amber-7/30 bg-amber-3/40 text-amber-11";
+    case "error":
+      return "border-red-7/30 bg-red-3/40 text-red-11";
+    default:
+      return "border-dls-border bg-dls-hover text-dls-secondary";
+  }
+};
+
+export type CreateWorkspaceSharedPanelProps = {
+  signedIn: boolean;
+  orgs: DenOrgSummary[];
+  activeOrgId: string;
+  onActiveOrgChange: (orgId: string) => void;
+  orgsBusy: boolean;
+  orgsError: string | null;
+  workers: DenWorkerSummary[];
+  workersBusy: boolean;
+  workersError: string | null;
+  workerSearch: string;
+  onWorkerSearchInput: (value: string) => void;
+  filteredWorkers: DenWorkerSummary[];
+  openingWorkerId: string | null;
+  workerStatusMeta: (status: string) => WorkerStatusMeta;
+  workerSecondaryLine: (worker: DenWorkerSummary) => string;
+  onOpenWorker: (worker: DenWorkerSummary) => void;
+  onOpenCloudSignIn: () => void;
+  onRefreshWorkers: () => void;
+  onOpenCloudDashboard: () => void;
+};
+
+export function CreateWorkspaceSharedPanel(
+  props: CreateWorkspaceSharedPanelProps,
+) {
+  const activeOrg = useMemo(
+    () => props.orgs.find((org) => org.id === props.activeOrgId) ?? null,
+    [props.activeOrgId, props.orgs],
+  );
+
+  if (!props.signedIn) {
+    return (
+      <div className={modalBodyClass}>
+        <div className="flex min-h-[320px] items-center justify-center">
+          <div
+            className={`${surfaceCardClass} w-full max-w-[420px] p-8 text-center`}
+          >
+            <div className="mx-auto flex h-14 w-14 items-center justify-center rounded-2xl border border-dls-border bg-dls-hover text-dls-text">
+              <Cloud size={24} />
+            </div>
+            <div className="mt-5 text-[20px] font-semibold tracking-[-0.3px] text-dls-text">
+              Sign in to OpenWork Cloud
+            </div>
+            <div className="mt-2 text-[14px] leading-6 text-dls-secondary">
+              Access remote workers shared with your organization.
+            </div>
+            <div className="mt-6 flex justify-center">
+              <button
+                type="button"
+                className={pillPrimaryClass}
+                onClick={props.onOpenCloudSignIn}
+              >
+                Continue with Cloud
+              </button>
+            </div>
+            <div className="mt-3 text-[12px] text-dls-secondary">
+              You’ll pick a team and connect to an existing workspace next.
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className={modalBodyClass}>
+      <div className="space-y-4">
+        <div className={surfaceCardClass}>
+          <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+            <div>
+              <div className={sectionTitleClass}>Shared workspaces</div>
+              <div className={sectionBodyClass}>
+                Choose your organization, then connect to a cloud worker in one
+                step.
+              </div>
+            </div>
+            <div className="flex min-w-0 items-center gap-2">
+              <select
+                value={props.activeOrgId}
+                onChange={(event) =>
+                  props.onActiveOrgChange(event.currentTarget.value)
+                }
+                disabled={props.orgsBusy || props.orgs.length === 0}
+                className={`${inputClass} h-11 min-w-[180px] py-2 font-medium`}
+              >
+                {props.orgs.map((org) => (
+                  <option key={org.id} value={org.id}>
+                    {org.name}
+                  </option>
+                ))}
+              </select>
+              <button
+                type="button"
+                className={pillSecondaryClass}
+                onClick={props.onRefreshWorkers}
+                disabled={props.workersBusy || !props.activeOrgId.trim()}
+                title={activeOrg?.name ?? undefined}
+              >
+                <RefreshCcw
+                  size={13}
+                  className={props.workersBusy ? "animate-spin" : ""}
+                />
+                Refresh
+              </button>
+            </div>
+          </div>
+
+          <div className="mt-4">
+            <label className="flex items-center gap-3 rounded-xl border border-dls-border bg-dls-surface px-4 py-3">
+              <Search size={15} className="shrink-0 text-dls-secondary" />
+              <input
+                type="text"
+                value={props.workerSearch}
+                onChange={(event) =>
+                  props.onWorkerSearchInput(event.currentTarget.value)
+                }
+                placeholder="Search shared workspaces"
+                className="min-w-0 flex-1 border-none bg-transparent text-[14px] text-dls-text outline-none placeholder:text-dls-secondary"
+              />
+            </label>
+          </div>
+        </div>
+
+        {props.orgsError ? (
+          <div className={errorBannerClass}>{props.orgsError}</div>
+        ) : null}
+        {props.workersError ? (
+          <div className={errorBannerClass}>{props.workersError}</div>
+        ) : null}
+
+        {props.workersBusy && props.workers.length === 0 ? (
+          <div className={`${surfaceCardClass} text-[14px] text-dls-secondary`}>
+            Loading shared workspaces…
+          </div>
+        ) : null}
+
+        {!props.workersBusy && props.filteredWorkers.length === 0 ? (
+          <div className={`${surfaceCardClass} text-[14px] text-dls-secondary`}>
+            {props.workerSearch.trim()
+              ? "No shared workspaces match that search."
+              : "No shared workspaces available yet."}
+          </div>
+        ) : null}
+
+        <div className="space-y-3">
+          {props.filteredWorkers.map((worker) => {
+            const status = props.workerStatusMeta(worker.status);
+            const isConnecting = props.openingWorkerId === worker.workerId;
+            return (
+              <div
+                key={worker.workerId}
+                className={`${surfaceCardClass} transition-all duration-150 hover:border-dls-border hover:shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)]`}
+              >
+                <div className="flex items-center gap-4">
+                  <div className={iconTileClass}>
+                    <Boxes size={18} />
+                  </div>
+                  <div className="min-w-0 flex-1">
+                    <div className="flex flex-wrap items-center gap-2">
+                      <div className="truncate text-[14px] font-medium text-dls-text">
+                        {worker.workerName}
+                      </div>
+                      <span
+                        className={`inline-flex items-center gap-1 rounded-full border px-2.5 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] ${statusBadgeClass(status.tone)}`.trim()}
+                      >
+                        <span className="h-1.5 w-1.5 rounded-full bg-current opacity-80" />
+                        {status.label}
+                      </span>
+                    </div>
+                    <div className="mt-1 truncate text-[12px] text-dls-secondary">
+                      {props.workerSecondaryLine(worker)}
+                    </div>
+                  </div>
+                  <button
+                    type="button"
+                    className={pillSecondaryClass}
+                    disabled={
+                      props.openingWorkerId !== null || !status.canOpen
+                    }
+                    title={
+                      !status.canOpen
+                        ? "This workspace is not ready to connect yet."
+                        : undefined
+                    }
+                    onClick={() => props.onOpenWorker(worker)}
+                  >
+                    {isConnecting ? (
+                      <span className="inline-flex items-center gap-2">
+                        <Loader2 size={13} className="animate-spin" />
+                        Connecting
+                      </span>
+                    ) : (
+                      "Connect"
+                    )}
+                  </button>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+
+        {props.workersBusy && props.workers.length > 0 ? (
+          <div className="text-[12px] text-dls-secondary">
+            Refreshing workspaces…
+          </div>
+        ) : null}
+
+        <div className="pt-2">
+          <button
+            type="button"
+            className={pillGhostClass}
+            onClick={props.onOpenCloudDashboard}
+          >
+            Open cloud dashboard
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/modal-styles.ts b/apps/app/src/react-app/domains/workspace/modal-styles.ts
new file mode 100644
index 0000000000..c7cdb915e4
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/modal-styles.ts
@@ -0,0 +1,80 @@
+export const modalOverlayClass =
+  "fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm p-4 animate-in fade-in duration-200";
+
+export const modalShellClass =
+  "flex max-h-[90vh] w-full flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]";
+
+export const modalHeaderClass =
+  "flex items-start justify-between gap-4 border-b border-dls-border px-6 py-5";
+
+export const modalBodyClass = "flex-1 overflow-y-auto px-6 py-6";
+
+export const modalFooterClass = "space-y-3 border-t border-dls-border px-6 py-5";
+
+export const modalHeaderButtonClass =
+  "inline-flex h-9 w-9 items-center justify-center rounded-full text-dls-secondary transition-colors hover:bg-dls-hover hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-50";
+
+export const modalTitleClass =
+  "text-[20px] font-semibold tracking-[-0.3px] text-dls-text";
+
+export const modalSubtitleClass = "mt-1 text-[14px] leading-6 text-dls-secondary";
+
+export const surfaceCardClass =
+  "rounded-[20px] border border-dls-border bg-dls-surface p-5";
+
+export const softCardClass =
+  "rounded-[20px] border border-dls-border bg-dls-hover p-4";
+
+export const interactiveCardClass =
+  "rounded-[20px] border border-dls-border bg-dls-surface p-5 text-left transition-all duration-150 hover:border-dls-border hover:shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)] focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.16)]";
+
+export const iconTileClass =
+  "flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-dls-border bg-dls-hover text-dls-secondary";
+
+export const sectionTitleClass =
+  "text-[15px] font-medium tracking-[-0.2px] text-dls-text";
+
+export const sectionBodyClass = "mt-1 text-[13px] leading-relaxed text-dls-secondary";
+
+export const inputLabelClass = "text-[13px] font-medium text-dls-text";
+
+export const inputHintClass = "text-[12px] leading-5 text-dls-secondary";
+
+export const inputClass =
+  "w-full rounded-xl border border-dls-border bg-dls-surface px-4 py-3 text-[14px] text-dls-text placeholder:text-dls-secondary focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.12)] disabled:cursor-not-allowed disabled:opacity-60";
+
+export const subtleInputClass =
+  "w-full rounded-xl border border-dls-border bg-dls-hover px-4 py-3 text-[14px] text-dls-text placeholder:text-dls-secondary focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.12)] disabled:cursor-not-allowed disabled:opacity-60";
+
+const pillButtonBaseClass =
+  "inline-flex items-center justify-center gap-1.5 rounded-full px-4 py-2 text-[13px] font-medium transition-colors focus:outline-none focus:ring-2 focus:ring-[rgba(var(--dls-accent-rgb),0.18)] disabled:cursor-not-allowed disabled:opacity-60";
+
+export const pillPrimaryClass = `${pillButtonBaseClass} bg-dls-accent text-white hover:bg-[var(--dls-accent-hover)]`;
+
+export const pillSecondaryClass = `${pillButtonBaseClass} border border-dls-border bg-dls-surface text-dls-text hover:bg-dls-hover`;
+
+export const pillGhostClass = `${pillButtonBaseClass} border border-dls-border bg-dls-surface text-dls-secondary hover:bg-dls-hover hover:text-dls-text`;
+
+export const tagClass =
+  "inline-flex items-center rounded-md border border-dls-border bg-dls-hover px-2 py-1 text-[11px] text-dls-secondary";
+
+export const infoBannerClass =
+  "rounded-[20px] border border-dls-border bg-dls-hover px-4 py-3 text-[13px] text-dls-secondary";
+
+export const warningBannerClass =
+  "rounded-[20px] border border-amber-7/20 bg-amber-3/30 px-4 py-3 text-[13px] text-amber-11";
+
+export const errorBannerClass =
+  "rounded-[20px] border border-red-7/20 bg-red-1/40 px-4 py-3 text-[13px] text-red-11";
+
+export const successBannerClass =
+  "rounded-[20px] border border-emerald-7/20 bg-emerald-3/30 px-4 py-3 text-[13px] text-emerald-11";
+
+export const modalNoticeNeutralClass =
+  "rounded-xl border border-dls-border bg-dls-hover px-3 py-2.5 text-[13px] leading-relaxed text-dls-text";
+
+export const modalNoticeSuccessClass =
+  "rounded-xl border border-dls-border bg-emerald-2/25 px-3 py-2.5 text-[13px] leading-relaxed text-dls-text";
+
+export const modalNoticeErrorClass =
+  "rounded-xl border border-dls-border bg-red-2/20 px-3 py-2.5 text-[13px] leading-relaxed text-dls-text";
diff --git a/apps/app/src/react-app/domains/workspace/option-card.tsx b/apps/app/src/react-app/domains/workspace/option-card.tsx
new file mode 100644
index 0000000000..87f28114df
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/option-card.tsx
@@ -0,0 +1,51 @@
+/** @jsxImportSource react */
+import type { ComponentType, ReactNode } from "react";
+import { ChevronRight } from "lucide-react";
+
+import {
+  iconTileClass,
+  interactiveCardClass,
+  sectionBodyClass,
+  sectionTitleClass,
+} from "./modal-styles";
+
+export type WorkspaceOptionCardProps = {
+  title: string;
+  description: string;
+  icon: ComponentType<{ size?: number; className?: string }>;
+  onClick?: () => void;
+  disabled?: boolean;
+  endAdornment?: ReactNode;
+};
+
+export function WorkspaceOptionCard({
+  title,
+  description,
+  icon: Icon,
+  onClick,
+  disabled,
+  endAdornment,
+}: WorkspaceOptionCardProps) {
+  return (
+    <button
+      type="button"
+      onClick={() => onClick?.()}
+      disabled={disabled}
+      className={`${interactiveCardClass} group flex w-full items-center gap-4 disabled:cursor-not-allowed disabled:opacity-60`}
+    >
+      <div className={iconTileClass}>
+        <Icon size={18} />
+      </div>
+      <div className="min-w-0 flex-1">
+        <div className={sectionTitleClass}>{title}</div>
+        <div className={sectionBodyClass}>{description}</div>
+      </div>
+      {endAdornment ?? (
+        <ChevronRight
+          size={18}
+          className="shrink-0 text-dls-secondary transition-transform group-hover:translate-x-0.5"
+        />
+      )}
+    </button>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/remote-access-restart.ts b/apps/app/src/react-app/domains/workspace/remote-access-restart.ts
new file mode 100644
index 0000000000..41ece77140
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/remote-access-restart.ts
@@ -0,0 +1,84 @@
+import { useCallback, useState } from "react";
+
+import { openworkServerRestart, type OpenworkServerInfo } from "../../../app/lib/desktop";
+import {
+  readOpenworkServerSettings,
+  writeOpenworkServerSettings,
+} from "../../../app/lib/openwork-server";
+import { t } from "../../../i18n";
+
+export type RemoteAccessRestartPhase =
+  | "idle"
+  | "restarting"
+  | "reconnecting"
+  | "failed";
+
+type UseRemoteAccessRestartOptions = {
+  isEnabled: () => boolean;
+  onHostInfo: (info: OpenworkServerInfo) => void;
+  onSettingsChanged: () => void;
+};
+
+export function useRemoteAccessRestart(options: UseRemoteAccessRestartOptions) {
+  const [phase, setPhase] = useState<RemoteAccessRestartPhase>("idle");
+  const [error, setError] = useState<string | null>(null);
+
+  const save = useCallback(
+    async (enabled: boolean) => {
+      if (phase === "restarting" || phase === "reconnecting") return;
+
+      const previous = readOpenworkServerSettings();
+      const next = { ...previous, remoteAccessEnabled: enabled };
+
+      setPhase("restarting");
+      setError(null);
+      writeOpenworkServerSettings(next);
+      options.onSettingsChanged();
+
+      try {
+        const info = await openworkServerRestart({ remoteAccessEnabled: enabled });
+        options.onHostInfo(info);
+        setPhase("idle");
+      } catch (caught) {
+        writeOpenworkServerSettings(previous);
+        options.onSettingsChanged();
+        setError(caught instanceof Error ? caught.message : t("app.error_remote_access"));
+        setPhase("failed");
+      }
+    },
+    [options, phase],
+  );
+
+  const reset = useCallback(() => {
+    if (phase === "failed") {
+      setPhase("idle");
+      setError(null);
+    }
+  }, [phase]);
+
+  return {
+    busy: phase === "restarting" || phase === "reconnecting",
+    error,
+    phase,
+    reset,
+    save,
+    status: statusForPhase(phase, options.isEnabled()),
+  };
+}
+
+function statusForPhase(phase: RemoteAccessRestartPhase, enabled: boolean) {
+  switch (phase) {
+    case "restarting":
+      return "Restarting worker…";
+    case "reconnecting":
+      return "Reconnecting to worker…";
+    case "failed":
+      return enabled
+        ? "Remote access may still be on. Check connection details or retry."
+        : "Remote access is still off. You can retry when ready.";
+    default:
+      return enabled
+        ? "Remote access is currently enabled."
+        : "Remote access is currently disabled.";
+  }
+}
diff --git a/apps/app/src/react-app/domains/workspace/remote-workspace-diagnostics.ts b/apps/app/src/react-app/domains/workspace/remote-workspace-diagnostics.ts
new file mode 100644
index 0000000000..6a52f2c46a
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/remote-workspace-diagnostics.ts
@@ -0,0 +1,345 @@
+import type { WorkspaceConnectionState } from "../../../app/types";
+import type { WorkspaceInfo } from "../../../app/lib/desktop";
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  createOpenworkServerClient,
+  normalizeOpenworkServerUrl,
+  parseOpenworkWorkspaceIdFromUrl,
+  type OpenworkServerClient,
+} from "../../../app/lib/openwork-server";
+import { redactTokenLikeText } from "../../../app/utils";
+
+export type RemoteWorkspaceConnectionTarget = {
+  kind: "openwork";
+  baseUrl: string;
+  endpointLabel: string;
+  token: string;
+  workspaceId: string | null;
+};
+
+type TargetResult =
+  | { ok: true; target: RemoteWorkspaceConnectionTarget }
+  | { ok: false; state: WorkspaceConnectionState };
+
+export type RemoteWorkspaceConnectionResult = {
+  ok: boolean;
+  state: WorkspaceConnectionState;
+  target?: RemoteWorkspaceConnectionTarget;
+};
+
+type TestOptions = {
+  now?: () => number;
+  createClient?: (target: RemoteWorkspaceConnectionTarget) => Pick<
+    OpenworkServerClient,
+    "health" | "capabilities" | "status" | "listWorkspaces"
+  > | Promise<Pick<OpenworkServerClient, "health" | "capabilities" | "status" | "listWorkspaces">>;
+};
+
+function trim(value: string | null | undefined) {
+  return value?.trim() ?? "";
+}
+
+function fail(message: string, checkedAt = Date.now()): RemoteWorkspaceConnectionResult {
+  return {
+    ok: false,
+    state: {
+      status: "error",
+      message,
+      checkedAt,
+    },
+  };
+}
+
+function endpointLabel(baseUrl: string) {
+  try {
+    const url = new URL(baseUrl);
+    const path = url.pathname.replace(/\/+$/, "");
+    return `${url.host}${path && path !== "/" ? path : ""}`;
+  } catch {
+    return baseUrl;
+  }
+}
+
+function isValidHttpEndpoint(baseUrl: string) {
+  try {
+    const url = new URL(baseUrl);
+    return (url.protocol === "http:" || url.protocol === "https:") && Boolean(url.host);
+  } catch {
+    return false;
+  }
+}
+
+function describeUnknownError(error: unknown) {
+  return redactRemoteDiagnosticText(error instanceof Error ? error.message : String(error || "Unknown error"));
+}
+
+function isServerErrorStatus(error: unknown, status: number | number[]) {
+  const expected = Array.isArray(status) ? status : [status];
+  const actual =
+    error && typeof error === "object" && "status" in error
+      ? Number((error as { status?: unknown }).status)
+      : NaN;
+  return expected.includes(actual);
+}
+
+function rejectedTokenMessage(target: RemoteWorkspaceConnectionTarget) {
+  return `Token was rejected by ${target.endpointLabel}. Edit connection and reconnect the worker.`;
+}
+
+export function redactRemoteDiagnosticText(value: string): string {
+  return redactTokenLikeText(value);
+}
+
+export function getRemoteWorkspaceConnectionKey(workspace: WorkspaceInfo): string {
+  return [
+    workspace.id,
+    workspace.workspaceType,
+    workspace.remoteType ?? "",
+    trim(workspace.baseUrl),
+    trim(workspace.openworkHostUrl),
+    trim(workspace.openworkWorkspaceId),
+    trim(workspace.openworkToken),
+    trim(workspace.openworkClientToken),
+    trim(workspace.openworkHostToken),
+  ].join("\u001f");
+}
+
+function displayWorkspaceName(workspace: unknown) {
+  if (!workspace || typeof workspace !== "object") return "";
+  const value = workspace as {
+    displayName?: string | null;
+    openworkWorkspaceName?: string | null;
+    name?: string | null;
+    id?: string | null;
+  };
+  return (
+    trim(value.displayName) ||
+    trim(value.openworkWorkspaceName) ||
+    trim(value.name) ||
+    trim(value.id)
+  );
+}
+
+function defaultCreateClient(target: RemoteWorkspaceConnectionTarget) {
+  return createOpenworkServerClient({
+    baseUrl: target.baseUrl,
+    token: target.token || undefined,
+  });
+}
+
+export function resolveRemoteWorkspaceConnectionTarget(workspace: WorkspaceInfo): TargetResult {
+  if (workspace.workspaceType !== "remote") {
+    return {
+      ok: false,
+      state: {
+        status: "error",
+        message: "Only remote workers can be tested.",
+        checkedAt: Date.now(),
+      },
+    };
+  }
+
+  if (workspace.remoteType && workspace.remoteType !== "openwork") {
+    return {
+      ok: false,
+      state: {
+        status: "error",
+        message: "Connection diagnostics are only available for OpenWork remote workers.",
+        checkedAt: Date.now(),
+      },
+    };
+  }
+
+  const rawHostUrl = trim(workspace.openworkHostUrl) || trim(workspace.baseUrl);
+  if (!rawHostUrl) {
+    return {
+      ok: false,
+      state: {
+        status: "error",
+        message: "Remote worker URL is missing. Edit connection and add a server URL.",
+        checkedAt: Date.now(),
+      },
+    };
+  }
+
+  const normalizedHostUrl = normalizeOpenworkServerUrl(rawHostUrl);
+  if (!normalizedHostUrl || !isValidHttpEndpoint(normalizedHostUrl)) {
+    return {
+      ok: false,
+      state: {
+        status: "error",
+        message: "Remote worker URL is invalid. Edit connection and use an http:// or https:// URL.",
+        checkedAt: Date.now(),
+      },
+    };
+  }
+
+  const workspaceId =
+    trim(workspace.openworkWorkspaceId) ||
+    parseOpenworkWorkspaceIdFromUrl(normalizedHostUrl) ||
+    parseOpenworkWorkspaceIdFromUrl(trim(workspace.baseUrl)) ||
+    null;
+  const baseUrl = workspaceId
+    ? buildOpenworkWorkspaceBaseUrl(normalizedHostUrl, workspaceId) ?? normalizedHostUrl
+    : normalizedHostUrl;
+  const token =
+    trim(workspace.openworkToken) ||
+    trim(workspace.openworkClientToken) ||
+    trim(workspace.openworkHostToken);
+
+  return {
+    ok: true,
+    target: {
+      kind: "openwork",
+      baseUrl,
+      endpointLabel: endpointLabel(baseUrl),
+      token,
+      workspaceId,
+    },
+  };
+}
+
+export async function testRemoteWorkspaceConnection(
+  workspace: WorkspaceInfo,
+  options: TestOptions = {},
+): Promise<RemoteWorkspaceConnectionResult> {
+  const checkedAt = options.now?.() ?? Date.now();
+  const targetResult = resolveRemoteWorkspaceConnectionTarget(workspace);
+  if (!targetResult.ok) {
+    return {
+      ok: false,
+      state: {
+        ...targetResult.state,
+        checkedAt,
+      },
+    };
+  }
+
+  const { target } = targetResult;
+  const client = await (options.createClient?.(target) ?? defaultCreateClient(target));
+
+  try {
+    const health = await client.health();
+    if (!health?.ok) {
+      return fail(
+        `Cannot reach ${target.endpointLabel}. Health check returned an unhealthy response.`,
+        checkedAt,
+      );
+    }
+  } catch (error) {
+    return fail(
+      `Cannot reach ${target.endpointLabel}. Health check failed: ${describeUnknownError(error)}`,
+      checkedAt,
+    );
+  }
+
+  if (!target.token) {
+    return fail(
+      `Token is missing for ${target.endpointLabel}. Edit connection and paste a valid OpenWork token.`,
+      checkedAt,
+    );
+  }
+
+  try {
+    await client.capabilities();
+  } catch (error) {
+    if (isServerErrorStatus(error, [401, 403])) {
+      return fail(rejectedTokenMessage(target), checkedAt);
+    }
+    return fail(
+      `Connected to ${target.endpointLabel}, but capabilities failed: ${describeUnknownError(error)}`,
+      checkedAt,
+    );
+  }
+
+  if (target.workspaceId) {
+    try {
+      const status = await client.status();
+      const name = displayWorkspaceName(status.workspace) || target.workspaceId;
+      return {
+        ok: true,
+        target,
+        state: {
+          status: "connected",
+          message: `Connected to ${name}.`,
+          checkedAt,
+        },
+      };
+    } catch (error) {
+      if (isServerErrorStatus(error, 404)) {
+        return fail(
+          `Workspace ${target.workspaceId} was not found on ${target.endpointLabel}. Reconnect the worker.`,
+          checkedAt,
+        );
+      }
+      if (isServerErrorStatus(error, 403)) {
+        return fail(
+          `Workspace ${target.workspaceId} is not authorized on ${target.endpointLabel}. Check the token or server access rules.`,
+          checkedAt,
+        );
+      }
+      return fail(
+        `Connected to ${target.endpointLabel}, but workspace status failed: ${describeUnknownError(error)}`,
+        checkedAt,
+      );
+    }
+  }
+
+  try {
+    const list = await client.listWorkspaces();
+    const active =
+      list.items.find((item) => item.id === list.activeId) ??
+      list.items[0] ??
+      null;
+    const name = displayWorkspaceName(active) || target.endpointLabel;
+    return {
+      ok: true,
+      target,
+      state: {
+        status: "connected",
+        message: `Connected to ${name}.`,
+        checkedAt,
+      },
+    };
+  } catch (error) {
+    if (isServerErrorStatus(error, [401, 403])) {
+      return fail(rejectedTokenMessage(target), checkedAt);
+    }
+    return fail(
+      `Connected to ${target.endpointLabel}, but workspace list failed: ${describeUnknownError(error)}`,
+      checkedAt,
+    );
+  }
+}
+
+export async function diagnoseRemoteWorkspaceTaskLoadFailure(
+  workspace: WorkspaceInfo,
+  taskLoadError: string,
+  options: TestOptions = {},
+): Promise<WorkspaceConnectionState> {
+  const checkedAt = options.now?.() ?? Date.now();
+  const fallback = redactRemoteDiagnosticText(trim(taskLoadError) || "Remote worker connection failed.");
+
+  try {
+    const diagnostic = await testRemoteWorkspaceConnection(workspace, options);
+    if (diagnostic.ok) {
+      return {
+        status: "error",
+        message: `Worker is reachable, but tasks failed to load: ${fallback}`,
+        checkedAt: diagnostic.state.checkedAt ?? checkedAt,
+      };
+    }
+
+    return {
+      status: "error",
+      message: diagnostic.state.message?.trim() || fallback,
+      checkedAt: diagnostic.state.checkedAt ?? checkedAt,
+    };
+  } catch (error) {
+    return {
+      status: "error",
+      message: fallback || describeUnknownError(error),
+      checkedAt,
+    };
+  }
+}
diff --git a/apps/app/src/react-app/domains/workspace/remote-workspace-fields.tsx b/apps/app/src/react-app/domains/workspace/remote-workspace-fields.tsx
new file mode 100644
index 0000000000..3e7e4b2e61
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/remote-workspace-fields.tsx
@@ -0,0 +1,141 @@
+/** @jsxImportSource react */
+import type { Ref } from "react";
+import { Globe } from "lucide-react";
+
+import {
+  iconTileClass,
+  inputClass,
+  inputHintClass,
+  inputLabelClass,
+  pillSecondaryClass,
+  surfaceCardClass,
+} from "./modal-styles";
+
+export type RemoteWorkspaceFieldsProps = {
+  hostUrl: string;
+  onHostUrlInput: (value: string) => void;
+  token: string;
+  tokenVisible: boolean;
+  onTokenInput: (value: string) => void;
+  onToggleTokenVisible: () => void;
+  displayName: string;
+  onDisplayNameInput: (value: string) => void;
+  directory?: string;
+  onDirectoryInput?: (value: string) => void;
+  showDirectory?: boolean;
+  submitting?: boolean;
+  hostInputRef?: Ref<HTMLInputElement>;
+  title: string;
+  description: string;
+};
+
+export function RemoteWorkspaceFields({
+  hostUrl,
+  onHostUrlInput,
+  token,
+  tokenVisible,
+  onTokenInput,
+  onToggleTokenVisible,
+  displayName,
+  onDisplayNameInput,
+  directory,
+  onDirectoryInput,
+  showDirectory,
+  submitting,
+  hostInputRef,
+  title,
+  description,
+}: RemoteWorkspaceFieldsProps) {
+  return (
+    <div className={surfaceCardClass}>
+      <div className="flex items-start gap-3">
+        <div className={iconTileClass}>
+          <Globe size={17} />
+        </div>
+        <div className="min-w-0">
+          <div className="text-[15px] font-medium tracking-[-0.2px] text-dls-text">
+            {title}
+          </div>
+          <div className="mt-1 text-[13px] leading-relaxed text-dls-secondary">
+            {description}
+          </div>
+        </div>
+      </div>
+
+      <div className="mt-5 grid gap-4">
+        <label className="grid gap-2">
+          <span className={inputLabelClass}>Worker URL</span>
+          <input
+            ref={hostInputRef}
+            type="url"
+            value={hostUrl}
+            onChange={(event) => onHostUrlInput(event.currentTarget.value)}
+            placeholder="https://worker.example.com"
+            disabled={submitting}
+            className={inputClass}
+          />
+          <span className={inputHintClass}>
+            Paste the OpenWork worker URL you want to connect to.
+          </span>
+        </label>
+
+        <label className="grid gap-2">
+          <span className={inputLabelClass}>Access token</span>
+          <div className="flex items-center gap-2 rounded-xl border border-dls-border bg-dls-surface p-1.5">
+            <input
+              type={tokenVisible ? "text" : "password"}
+              value={token}
+              onChange={(event) => onTokenInput(event.currentTarget.value)}
+              placeholder="Optional"
+              disabled={submitting}
+              className="min-w-0 flex-1 border-none bg-transparent px-2 py-1.5 text-[14px] text-dls-text outline-none placeholder:text-dls-secondary"
+            />
+            <button
+              type="button"
+              className={pillSecondaryClass}
+              onClick={onToggleTokenVisible}
+              disabled={submitting}
+            >
+              {tokenVisible ? "Hide" : "Show"}
+            </button>
+          </div>
+          <span className={inputHintClass}>
+            Add a token only if the worker requires one.
+          </span>
+        </label>
+
+        {showDirectory ? (
+          <label className="grid gap-2">
+            <span className={inputLabelClass}>Remote directory</span>
+            <input
+              type="text"
+              value={directory ?? ""}
+              onChange={(event) => onDirectoryInput?.(event.currentTarget.value)}
+              placeholder="Optional"
+              disabled={submitting}
+              className={inputClass}
+            />
+            <span className={inputHintClass}>
+              Optionally target a directory within that remote worker.
+            </span>
+          </label>
+        ) : null}
+
+        <label className="grid gap-2">
+          <span className={inputLabelClass}>
+            Display name{" "}
+            <span className="font-normal text-dls-secondary">(optional)</span>
+          </span>
+          <input
+            type="text"
+            value={displayName}
+            onChange={(event) => onDisplayNameInput(event.currentTarget.value)}
+            placeholder="Worker name"
+            disabled={submitting}
+            className={inputClass}
+          />
+        </label>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/rename-workspace-modal.tsx b/apps/app/src/react-app/domains/workspace/rename-workspace-modal.tsx
new file mode 100644
index 0000000000..d7178aa479
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/rename-workspace-modal.tsx
@@ -0,0 +1,100 @@
+/** @jsxImportSource react */
+import { useEffect, useRef } from "react";
+import { X } from "lucide-react";
+
+import { t } from "../../../i18n";
+import { inputClass, pillGhostClass, pillPrimaryClass, pillSecondaryClass } from "./modal-styles";
+
+export type RenameWorkspaceModalProps = {
+  open: boolean;
+  title: string;
+  busy: boolean;
+  canSave: boolean;
+  onClose: () => void;
+  onSave: () => void;
+  onTitleChange: (value: string) => void;
+};
+
+export function RenameWorkspaceModal(props: RenameWorkspaceModalProps) {
+  const inputRef = useRef<HTMLInputElement | null>(null);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const frame = requestAnimationFrame(() => {
+      inputRef.current?.focus();
+      inputRef.current?.select();
+    });
+    return () => cancelAnimationFrame(frame);
+  }, [props.open]);
+
+  if (!props.open) return null;
+
+  return (
+    <div className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-center justify-center p-4">
+      <div className="bg-gray-2 border border-gray-6/70 w-full max-w-lg rounded-2xl shadow-2xl overflow-hidden">
+        <div className="p-6">
+          <div className="flex items-start justify-between gap-4">
+            <div>
+              <h3 className="text-lg font-semibold text-gray-12">
+                {t("workspace.rename_title")}
+              </h3>
+              <p className="text-sm text-gray-11 mt-1">
+                {t("workspace.rename_description")}
+              </p>
+            </div>
+            <button
+              type="button"
+              className={`${pillGhostClass} !p-2 rounded-full`}
+              onClick={props.onClose}
+            >
+              <X size={16} />
+            </button>
+          </div>
+
+          <div className="mt-6">
+            <label className="mb-1.5 block text-[13px] font-medium text-dls-text">
+              {t("workspace.rename_label")}
+            </label>
+            <input
+              ref={inputRef}
+              type="text"
+              value={props.title}
+              onChange={(event) => props.onTitleChange(event.currentTarget.value)}
+              onKeyDown={(event) => {
+                if (
+                  event.key !== "Enter" ||
+                  event.nativeEvent.isComposing ||
+                  event.keyCode === 229
+                )
+                  return;
+                event.preventDefault();
+                if (props.canSave) props.onSave();
+              }}
+              placeholder={t("workspace.rename_placeholder")}
+              className={`${inputClass} bg-gray-3`}
+            />
+          </div>
+
+          <div className="mt-6 flex justify-end gap-2">
+            <button
+              type="button"
+              className={pillSecondaryClass}
+              onClick={props.onClose}
+              disabled={props.busy}
+            >
+              {t("common.cancel")}
+            </button>
+            <button
+              type="button"
+              className={pillPrimaryClass}
+              onClick={props.onSave}
+              disabled={!props.canSave}
+            >
+              {t("common.save")}
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/share-workspace-access-panel.tsx b/apps/app/src/react-app/domains/workspace/share-workspace-access-panel.tsx
new file mode 100644
index 0000000000..f27ec13d6c
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/share-workspace-access-panel.tsx
@@ -0,0 +1,256 @@
+/** @jsxImportSource react */
+import {
+  Check,
+  ChevronDown,
+  Copy,
+  Eye,
+  EyeOff,
+} from "lucide-react";
+
+import {
+  errorBannerClass,
+  iconTileClass,
+  inputClass,
+  pillGhostClass,
+  pillSecondaryClass,
+  softCardClass,
+  surfaceCardClass,
+  warningBannerClass,
+} from "./modal-styles";
+import type { ShareField } from "./types";
+
+const isInviteField = (label: string) => /invite link/i.test(label);
+const isCollaboratorField = (label: string) =>
+  /collaborator token/i.test(label);
+const isPasswordField = (label: string) =>
+  /owner token|connected token|access token|password/i.test(label);
+const isWorkerUrlField = (label: string) => /worker url/i.test(label);
+
+const displayFieldLabel = (field: ShareField) => {
+  if (isPasswordField(field.label)) return "Password";
+  if (isWorkerUrlField(field.label)) return "Worker URL";
+  return field.label;
+};
+
+export type ShareWorkspaceAccessPanelProps = {
+  fields: ShareField[];
+  copiedKey: string | null;
+  onCopy: (value: string, key: string) => void;
+  revealedByKey: Record<string, boolean>;
+  onToggleReveal: (key: string) => void;
+  collaboratorExpanded: boolean;
+  onToggleCollaboratorExpanded: () => void;
+  remoteAccess?: {
+    enabled: boolean;
+    busy: boolean;
+    error?: string | null;
+    status?: string | null;
+    onSave: (enabled: boolean) => void | Promise<void>;
+  };
+  remoteAccessEnabled: boolean;
+  onRemoteAccessEnabledChange: (value: boolean) => void;
+  note?: string | null;
+};
+
+export function ShareWorkspaceAccessPanel(
+  props: ShareWorkspaceAccessPanelProps,
+) {
+  const accessFields = props.fields.filter(
+    (field) => !isInviteField(field.label),
+  );
+  const collaboratorField =
+    accessFields.find((field) => isCollaboratorField(field.label)) ?? null;
+  const primaryAccessFields = accessFields.filter(
+    (field) => !isCollaboratorField(field.label),
+  );
+  const remoteAccessNeedsEnable = Boolean(
+    props.remoteAccess && !props.remoteAccess.enabled && !props.remoteAccessEnabled,
+  );
+  const remoteSaveDisabled = props.remoteAccess
+    ? props.remoteAccess.busy ||
+      (props.remoteAccess.enabled &&
+        props.remoteAccessEnabled === props.remoteAccess.enabled)
+    : true;
+  const remoteSaveLabel = props.remoteAccess?.busy
+    ? "Saving…"
+    : remoteAccessNeedsEnable
+      ? "Enable remote access"
+      : props.remoteAccess?.enabled === false && props.remoteAccessEnabled
+        ? "Save & restart worker"
+        : "Save";
+
+  const renderCredentialField = (
+    field: ShareField,
+    index: number,
+    keyPrefix: string,
+  ) => {
+    const key = `${keyPrefix}:${field.label}:${index}`;
+    const isSecret = Boolean(field.secret);
+    const revealed = Boolean(props.revealedByKey[key]);
+
+    return (
+      <div>
+        <label className="mb-1.5 block text-[13px] font-medium text-dls-text">
+          {displayFieldLabel(field)}
+        </label>
+        <div className="relative flex items-center gap-2">
+          <input
+            type={isSecret && !revealed ? "password" : "text"}
+            readOnly
+            value={field.value || field.placeholder || ""}
+            className={`${inputClass} font-mono text-[12px]`}
+          />
+          {isSecret ? (
+            <button
+              type="button"
+              onClick={() => props.onToggleReveal(key)}
+              disabled={!field.value}
+              className={pillSecondaryClass}
+              title={revealed ? "Hide password" : "Reveal password"}
+            >
+              {revealed ? <EyeOff size={14} /> : <Eye size={14} />}
+            </button>
+          ) : null}
+          <button
+            type="button"
+            onClick={() => props.onCopy(field.value, key)}
+            disabled={!field.value}
+            className={pillSecondaryClass}
+            title="Copy"
+          >
+            {props.copiedKey === key ? (
+              <Check size={14} className="text-emerald-600" />
+            ) : (
+              <Copy size={14} />
+            )}
+          </button>
+        </div>
+        {field.hint?.trim() ? (
+          <p className="mt-1.5 text-[12px] text-dls-secondary">{field.hint}</p>
+        ) : null}
+      </div>
+    );
+  };
+
+  return (
+    <div className="space-y-5 pt-2 animate-in fade-in slide-in-from-right-4 duration-300">
+      <div className={warningBannerClass}>
+        <span className="leading-relaxed">
+          {props.remoteAccess
+            ? "These credentials grant live access to this workspace. Sharing this workspace remotely may allow anyone with access to your network to control your worker."
+            : "Share with trusted people only. These credentials grant live access to this workspace."}
+        </span>
+      </div>
+
+      {props.remoteAccess ? (
+        <div className={surfaceCardClass}>
+          <div className="flex items-start justify-between gap-3">
+            <div>
+              <h3 className="text-[18px] font-semibold tracking-[-0.3px] text-dls-text">
+                Remote access
+              </h3>
+              <p className="mt-1 text-[14px] leading-relaxed text-dls-secondary">
+                Off by default. Turn this on only when you want this worker
+                reachable from another machine.
+              </p>
+            </div>
+            <label className="relative inline-flex shrink-0 cursor-pointer items-center">
+              <input
+                type="checkbox"
+                className="peer sr-only"
+                checked={props.remoteAccessEnabled}
+                onChange={(event) =>
+                  props.onRemoteAccessEnabledChange(event.currentTarget.checked)
+                }
+                disabled={props.remoteAccess.busy}
+              />
+              <div className="h-6 w-11 rounded-full bg-gray-300 transition-colors peer-checked:bg-[var(--dls-accent)] peer-disabled:opacity-50 after:absolute after:left-[2px] after:top-[2px] after:h-5 after:w-5 after:rounded-full after:bg-white after:transition-transform peer-checked:after:translate-x-5" />
+            </label>
+          </div>
+
+          <div className="mt-4 flex items-center justify-between gap-3">
+            <div className="text-[13px] text-dls-secondary">
+              {props.remoteAccess.status?.trim() ||
+                (props.remoteAccess.enabled
+                  ? "Remote access is currently enabled."
+                  : "Remote access is currently disabled.")}
+            </div>
+            <button
+              type="button"
+              onClick={() => {
+                if (remoteAccessNeedsEnable) {
+                  props.onRemoteAccessEnabledChange(true);
+                  return;
+                }
+                void props.remoteAccess?.onSave(props.remoteAccessEnabled);
+              }}
+              disabled={remoteSaveDisabled}
+              className={pillSecondaryClass}
+            >
+              {remoteSaveLabel}
+            </button>
+          </div>
+
+          {props.remoteAccess.error?.trim() ? (
+            <div className={`mt-4 ${errorBannerClass}`}>
+              {props.remoteAccess.error}
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+
+      {primaryAccessFields.length > 0 ? (
+        <div className={surfaceCardClass}>
+          <div className="mb-4 text-[13px] font-medium text-dls-text">
+            Connection details
+          </div>
+          <div className="space-y-4">
+            {primaryAccessFields.map((field, index) => (
+              <div key={`${field.label}-${index}`}>
+                {renderCredentialField(field, index, "primary")}
+              </div>
+            ))}
+          </div>
+        </div>
+      ) : (
+        <div
+          className={`${softCardClass} text-[13px] leading-relaxed text-dls-secondary`}
+        >
+          Enable remote access and click Save to restart the worker and reveal
+          the live connection details for this workspace.
+        </div>
+      )}
+
+      {collaboratorField ? (
+        <div className="pt-1">
+          <button
+            type="button"
+            className={pillGhostClass}
+            onClick={props.onToggleCollaboratorExpanded}
+            aria-expanded={props.collaboratorExpanded}
+          >
+            <span>Optional collaborator access</span>
+            <ChevronDown
+              size={13}
+              className={`shrink-0 transition-transform ${
+                props.collaboratorExpanded ? "rotate-180" : ""
+              }`}
+            />
+          </button>
+          {props.collaboratorExpanded ? (
+            <div className={`${softCardClass} mt-3`}>
+              <div className="mb-3 text-[12px] text-dls-secondary">
+                Routine access without permission approvals.
+              </div>
+              {renderCredentialField(collaboratorField, 0, "collaborator")}
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+
+      {props.note?.trim() ? (
+        <div className="px-1 text-[12px] text-dls-secondary">{props.note}</div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/share-workspace-modal.tsx b/apps/app/src/react-app/domains/workspace/share-workspace-modal.tsx
new file mode 100644
index 0000000000..bc54c50312
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/share-workspace-modal.tsx
@@ -0,0 +1,183 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { ArrowLeft, MonitorUp, X } from "lucide-react";
+
+import { t } from "../../../i18n";
+import {
+  modalHeaderButtonClass,
+  modalHeaderClass,
+  modalOverlayClass,
+  modalShellClass,
+  modalSubtitleClass,
+  modalTitleClass,
+  tagClass,
+} from "./modal-styles";
+import { WorkspaceOptionCard } from "./option-card";
+import { ShareWorkspaceAccessPanel } from "./share-workspace-access-panel";
+import type { ShareView, ShareWorkspaceModalProps } from "./types";
+
+export function ShareWorkspaceModal(props: ShareWorkspaceModalProps) {
+  const [activeView, setActiveView] = useState<ShareView>("chooser");
+  const [revealedByKey, setRevealedByKey] = useState<Record<string, boolean>>(
+    {},
+  );
+  const [copiedKey, setCopiedKey] = useState<string | null>(null);
+  const [collaboratorExpanded, setCollaboratorExpanded] = useState(false);
+  const [remoteAccessEnabled, setRemoteAccessEnabled] = useState(false);
+
+  const title = props.title ?? t("share.title");
+  const workspaceBadge = useMemo(() => {
+    const raw = props.workspaceName?.trim() || t("share.workspace_fallback");
+    const parts = raw.split(/[\\/]/).filter(Boolean);
+    return parts[parts.length - 1] || raw;
+  }, [props.workspaceName]);
+
+  // Reset state whenever the modal opens.
+  useEffect(() => {
+    if (!props.open) return;
+    setActiveView("chooser");
+    setRevealedByKey({});
+    setCopiedKey(null);
+    setCollaboratorExpanded(false);
+    setRemoteAccessEnabled(props.remoteAccess?.enabled === true);
+  }, [props.open, props.remoteAccess?.enabled, props.workspaceName]);
+
+  // Mirror remote-access-enabled changes from the parent while open.
+  useEffect(() => {
+    if (!props.open) return;
+    setRemoteAccessEnabled(props.remoteAccess?.enabled === true);
+  }, [props.open, props.remoteAccess?.enabled]);
+
+  // Escape key handling: chooser closes the modal, sub-views step back.
+  useEffect(() => {
+    if (!props.open) return;
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key !== "Escape") return;
+      event.preventDefault();
+      setActiveView((view) => {
+        if (view === "chooser") {
+          props.onClose();
+          return view;
+        }
+        return "chooser";
+      });
+    };
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+  }, [props]);
+
+  const goBack = useCallback(() => {
+    setActiveView("chooser");
+  }, []);
+
+  const handleCopy = useCallback(async (value: string, key: string) => {
+    const text = value?.trim() ?? "";
+    if (!text) return;
+    try {
+      await navigator.clipboard.writeText(text);
+      setCopiedKey(key);
+      window.setTimeout(() => {
+        setCopiedKey((current) => (current === key ? null : current));
+      }, 2000);
+    } catch {
+      // ignore clipboard failures
+    }
+  }, []);
+
+  const headerTitle = (() => {
+    switch (activeView) {
+      case "access":
+        return t("share.view_access");
+      default:
+        return title;
+    }
+  })();
+
+  const headerSubtitle = (() => {
+    switch (activeView) {
+      case "access":
+        return t("share.subtitle_access");
+      default:
+        return props.workspaceDetail?.trim() || t("share.chooser_subtitle");
+    }
+  })();
+
+  if (!props.open) return null;
+
+  return (
+    <div className={`${modalOverlayClass} items-start pt-[10vh]`}>
+      <div
+        className={`${modalShellClass} max-h-[78vh] max-w-[640px]`}
+        role="dialog"
+        aria-modal="true"
+      >
+        <div className={modalHeaderClass}>
+          <div className="flex min-w-0 items-start gap-3">
+            {activeView !== "chooser" ? (
+              <button
+                onClick={goBack}
+                className={modalHeaderButtonClass}
+                aria-label={t("share.back_hint")}
+              >
+                <ArrowLeft size={16} />
+              </button>
+            ) : null}
+            <div className="min-w-0">
+              <div className="flex flex-wrap items-center gap-2">
+                <h2 className={modalTitleClass}>{headerTitle}</h2>
+                {activeView === "chooser" ? (
+                  <span className={tagClass}>{workspaceBadge}</span>
+                ) : null}
+              </div>
+              <p className={modalSubtitleClass}>{headerSubtitle}</p>
+            </div>
+          </div>
+          <button
+            onClick={props.onClose}
+            className={modalHeaderButtonClass}
+            aria-label={t("share.close_hint")}
+            title={t("share.close_hint")}
+          >
+            <X size={16} />
+          </button>
+        </div>
+
+        <div className="flex-1 overflow-y-auto px-6 pb-7 pt-2 scrollbar-hide">
+          {activeView === "chooser" ? (
+            <div className="space-y-4 animate-in fade-in slide-in-from-bottom-3 duration-300">
+              <WorkspaceOptionCard
+                title={t("share.option_access_title")}
+                description={t("share.option_access_desc")}
+                icon={MonitorUp}
+                onClick={() => setActiveView("access")}
+              />
+            </div>
+          ) : null}
+
+          {activeView === "access" ? (
+            <ShareWorkspaceAccessPanel
+              fields={props.fields}
+              copiedKey={copiedKey}
+              onCopy={(value, key) => void handleCopy(value, key)}
+              revealedByKey={revealedByKey}
+              onToggleReveal={(key) =>
+                setRevealedByKey((prev) => ({
+                  ...prev,
+                  [key]: !prev[key],
+                }))
+              }
+              collaboratorExpanded={collaboratorExpanded}
+              onToggleCollaboratorExpanded={() =>
+                setCollaboratorExpanded((value) => !value)
+              }
+              remoteAccess={props.remoteAccess}
+              remoteAccessEnabled={remoteAccessEnabled}
+              onRemoteAccessEnabledChange={setRemoteAccessEnabled}
+              note={props.note}
+            />
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/domains/workspace/share-workspace-state.ts b/apps/app/src/react-app/domains/workspace/share-workspace-state.ts
new file mode 100644
index 0000000000..1b34d1c872
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/share-workspace-state.ts
@@ -0,0 +1,283 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useState } from "react";
+
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  createOpenworkServerClient,
+  parseOpenworkWorkspaceIdFromUrl,
+} from "../../../app/lib/openwork-server";
+import type {
+  EngineInfo,
+  OpenworkServerInfo,
+  WorkspaceInfo,
+} from "../../../app/lib/desktop";
+import type { OpenworkServerSettings } from "../../../app/lib/openwork-server";
+import { t } from "../../../i18n";
+import { isDesktopRuntime, normalizeDirectoryPath } from "../../../app/utils";
+
+export type ShareWorkspaceState = ReturnType<typeof useShareWorkspaceState>;
+
+type UseShareWorkspaceStateOptions = {
+  workspaces: WorkspaceInfo[];
+  openworkServerHostInfo: OpenworkServerInfo | null;
+  openworkServerSettings: OpenworkServerSettings;
+  engineInfo: EngineInfo | null;
+  exportWorkspaceBusy: boolean;
+  openLink: (url: string) => void;
+  workspaceLabel: (workspace: WorkspaceInfo) => string;
+};
+
+export function useShareWorkspaceState(options: UseShareWorkspaceStateOptions) {
+  const [shareWorkspaceId, setShareWorkspaceId] = useState<string | null>(null);
+  const [shareLocalOpenworkWorkspaceId, setShareLocalOpenworkWorkspaceId] = useState<string | null>(null);
+
+  const openShareWorkspace = useCallback((workspaceId: string) => {
+    setShareWorkspaceId(workspaceId);
+  }, []);
+
+  const closeShareWorkspace = useCallback(() => {
+    setShareWorkspaceId(null);
+  }, []);
+
+  const shareWorkspace = useMemo(() => {
+    const id = shareWorkspaceId;
+    if (!id) return null;
+    return options.workspaces.find((workspace) => workspace.id === id) ?? null;
+  }, [options.workspaces, shareWorkspaceId]);
+
+  const shareWorkspaceName = useMemo(() => {
+    return shareWorkspace ? options.workspaceLabel(shareWorkspace) : "";
+  }, [options, shareWorkspace]);
+
+  const shareWorkspaceDetail = useMemo(() => {
+    const workspace = shareWorkspace;
+    if (!workspace) return "";
+    if (workspace.workspaceType === "remote") {
+      if (workspace.remoteType === "openwork") {
+        const hostUrl = workspace.openworkHostUrl?.trim() || workspace.baseUrl?.trim() || "";
+        const mounted = buildOpenworkWorkspaceBaseUrl(
+          hostUrl,
+          workspace.openworkWorkspaceId,
+        );
+        return mounted || hostUrl;
+      }
+      return workspace.baseUrl?.trim() || "";
+    }
+    return workspace.path?.trim() || "";
+  }, [shareWorkspace]);
+
+  useEffect(() => {
+    void shareWorkspaceId;
+  }, [shareWorkspaceId]);
+
+  useEffect(() => {
+    const workspace = shareWorkspace;
+    const baseUrl = options.openworkServerHostInfo?.baseUrl?.trim() ?? "";
+    const token =
+      options.openworkServerHostInfo?.ownerToken?.trim() ||
+      options.openworkServerHostInfo?.clientToken?.trim() ||
+      "";
+    const workspacePath = workspace?.workspaceType === "local" ? (workspace.path?.trim() ?? "") : "";
+
+    if (
+      !workspace ||
+      workspace.workspaceType !== "local" ||
+      !workspacePath ||
+      !baseUrl ||
+      !token
+    ) {
+      setShareLocalOpenworkWorkspaceId(null);
+      return;
+    }
+
+    let cancelled = false;
+    setShareLocalOpenworkWorkspaceId(null);
+
+    void (async () => {
+      try {
+        const client = createOpenworkServerClient({ baseUrl, token });
+        const response = await client.listWorkspaces();
+        if (cancelled) return;
+        const items = Array.isArray(response.items) ? response.items : [];
+        const targetPath = normalizeDirectoryPath(workspacePath);
+        const match = items.find(
+          (entry) => normalizeDirectoryPath(entry.path) === targetPath,
+        );
+        setShareLocalOpenworkWorkspaceId(match?.id ?? null);
+      } catch {
+        if (!cancelled) setShareLocalOpenworkWorkspaceId(null);
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [options.openworkServerHostInfo, shareWorkspace]);
+
+  const shareFields = useMemo(() => {
+    const workspace = shareWorkspace;
+    if (!workspace) {
+      return [] as Array<{
+        label: string;
+        value: string;
+        secret?: boolean;
+        placeholder?: string;
+        hint?: string;
+      }>;
+    }
+
+    if (workspace.workspaceType !== "remote") {
+      if (options.openworkServerHostInfo?.remoteAccessEnabled !== true) {
+        return [];
+      }
+      const hostUrl =
+        options.openworkServerHostInfo?.connectUrl?.trim() ||
+        options.openworkServerHostInfo?.lanUrl?.trim() ||
+        options.openworkServerHostInfo?.mdnsUrl?.trim() ||
+        options.openworkServerHostInfo?.baseUrl?.trim() ||
+        "";
+      const mountedUrl = shareLocalOpenworkWorkspaceId
+        ? buildOpenworkWorkspaceBaseUrl(hostUrl, shareLocalOpenworkWorkspaceId)
+        : null;
+      const url = mountedUrl || hostUrl;
+      const ownerToken = options.openworkServerHostInfo?.ownerToken?.trim() || "";
+      const collaboratorToken = options.openworkServerHostInfo?.clientToken?.trim() || "";
+      return [
+        {
+          label: t("session.share_worker_url"),
+          value: url,
+          placeholder: !isDesktopRuntime()
+            ? t("session.share_desktop_app_required")
+            : t("session.share_starting_server"),
+          hint: mountedUrl
+            ? t("session.share_worker_url_phones_hint")
+            : hostUrl
+              ? t("session.share_worker_url_resolving_hint")
+              : undefined,
+        },
+        {
+          label: t("session.share_password"),
+          value: ownerToken,
+          secret: true,
+          placeholder: isDesktopRuntime() ? "-" : t("session.share_desktop_app_required"),
+          hint: mountedUrl
+            ? t("session.share_worker_url_phones_hint")
+            : t("session.share_owner_permission_hint"),
+        },
+        {
+          label: t("session.share_collaborator_label"),
+          value: collaboratorToken,
+          secret: true,
+          placeholder: isDesktopRuntime() ? "-" : t("session.share_desktop_app_required"),
+          hint: mountedUrl
+            ? t("session.share_collaborator_hint")
+            : t("session.share_collaborator_host_hint"),
+        },
+      ];
+    }
+
+    if (workspace.remoteType === "openwork") {
+      const hostUrl = workspace.openworkHostUrl?.trim() || workspace.baseUrl?.trim() || "";
+      const url =
+        buildOpenworkWorkspaceBaseUrl(hostUrl, workspace.openworkWorkspaceId) ||
+        hostUrl;
+      const token =
+        workspace.openworkToken?.trim() ||
+        options.openworkServerSettings.token?.trim() ||
+        "";
+      return [
+        {
+          label: t("session.share_worker_url"),
+          value: url,
+        },
+        {
+          label: t("session.share_password"),
+          value: token,
+          secret: true,
+          placeholder: token ? undefined : t("session.share_set_token_hint"),
+          hint: t("session.share_connected_with_hint"),
+        },
+      ];
+    }
+
+    const baseUrl = workspace.baseUrl?.trim() || workspace.path?.trim() || "";
+    const directory = workspace.directory?.trim() || "";
+    return [
+      {
+        label: t("session.share_opencode_base_url"),
+        value: baseUrl,
+      },
+      {
+        label: t("common.path"),
+        value: directory,
+        placeholder: t("common.default_parens"),
+      },
+    ];
+  }, [
+    options.openworkServerHostInfo,
+    options.openworkServerSettings,
+    shareLocalOpenworkWorkspaceId,
+    shareWorkspace,
+  ]);
+
+  const shareNote = useMemo(() => {
+    const workspace = shareWorkspace;
+    if (!workspace) return null;
+    if (workspace.workspaceType === "local" && options.engineInfo?.runtime === "direct") {
+      return t("session.share_note_direct_runtime");
+    }
+    return null;
+  }, [options.engineInfo, shareWorkspace]);
+
+  const shareServiceDisabledReason = useMemo(() => {
+    const workspace = shareWorkspace;
+    if (!workspace) return t("session.share_select_workspace");
+    if (workspace.workspaceType === "remote" && workspace.remoteType !== "openwork") {
+      return t("session.share_openwork_workers_only");
+    }
+    if (workspace.workspaceType !== "remote") {
+      const baseUrl = options.openworkServerHostInfo?.baseUrl?.trim() ?? "";
+      const token =
+        options.openworkServerHostInfo?.ownerToken?.trim() ||
+        options.openworkServerHostInfo?.clientToken?.trim() ||
+        "";
+      if (!baseUrl || !token) {
+        return t("session.share_local_host_not_ready");
+      }
+    } else {
+      const hostUrl = workspace.openworkHostUrl?.trim() || workspace.baseUrl?.trim() || "";
+      const token =
+        workspace.openworkToken?.trim() ||
+        options.openworkServerSettings.token?.trim() ||
+        "";
+      if (!hostUrl) return t("session.share_missing_host_url");
+      if (!token) return t("session.share_missing_token");
+    }
+    return null;
+  }, [options.openworkServerHostInfo, options.openworkServerSettings, shareWorkspace]);
+
+  const exportDisabledReason = useMemo(() => {
+    const workspace = shareWorkspace;
+    if (!workspace) return t("session.export_desktop_only_local");
+    if (workspace.workspaceType === "remote") {
+      return t("session.export_local_only");
+    }
+    if (!isDesktopRuntime()) return t("session.export_desktop_only");
+    if (options.exportWorkspaceBusy) return t("session.export_already_running");
+    return null;
+  }, [options.exportWorkspaceBusy, shareWorkspace]);
+
+  return {
+    shareWorkspaceId,
+    shareWorkspaceOpen: Boolean(shareWorkspaceId),
+    openShareWorkspace,
+    closeShareWorkspace,
+    shareWorkspace,
+    shareWorkspaceName,
+    shareWorkspaceDetail,
+    shareFields,
+    shareNote,
+    shareServiceDisabledReason,
+    exportDisabledReason,
+  };
+}
diff --git a/apps/app/src/react-app/domains/workspace/types.ts b/apps/app/src/react-app/domains/workspace/types.ts
new file mode 100644
index 0000000000..59649b6f72
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/types.ts
@@ -0,0 +1,114 @@
+import type { WorkspacePreset } from "../../../app/types";
+
+export type CreateWorkspaceScreen = "chooser" | "local" | "remote" | "shared";
+
+export type RemoteWorkspaceInput = {
+  openworkHostUrl?: string | null;
+  openworkToken?: string | null;
+  openworkClientToken?: string | null;
+  openworkHostToken?: string | null;
+  directory?: string | null;
+  displayName?: string | null;
+  closeModal?: boolean;
+};
+
+export type CreateWorkspaceProgress = {
+  runId: string;
+  startedAt: number;
+  stage: string;
+  error: string | null;
+  steps: Array<{
+    key: string;
+    label: string;
+    status: "pending" | "active" | "done" | "error";
+    detail?: string | null;
+  }>;
+  logs: string[];
+};
+
+export type CreateWorkspaceModalProps = {
+  open: boolean;
+  onClose: () => void;
+  onConfirm: (preset: WorkspacePreset, folder: string | null) => void;
+  onConfirmRemote?: (input: RemoteWorkspaceInput) => Promise<boolean> | boolean | void;
+  onConfirmWorker?: (preset: WorkspacePreset, folder: string | null) => void;
+  onPickFolder: () => Promise<string | null>;
+  onImportConfig?: () => void;
+  importingConfig?: boolean;
+  submitting?: boolean;
+  localError?: string | null;
+  remoteSubmitting?: boolean;
+  remoteError?: string | null;
+  inline?: boolean;
+  showClose?: boolean;
+  defaultPreset?: WorkspacePreset;
+  title?: string;
+  subtitle?: string;
+  confirmLabel?: string;
+  workerLabel?: string;
+  workerDisabled?: boolean;
+  workerDisabledReason?: string | null;
+  workerCtaLabel?: string;
+  workerCtaDescription?: string;
+  onWorkerCta?: () => void;
+  workerRetryLabel?: string;
+  onWorkerRetry?: () => void;
+  workerDebugLines?: string[];
+  workerSubmitting?: boolean;
+  submittingProgress?: CreateWorkspaceProgress | null;
+  localDisabled?: boolean;
+  localDisabledReason?: string | null;
+};
+
+export type CreateRemoteWorkspaceModalProps = {
+  open: boolean;
+  onClose: () => void;
+  onConfirm: (input: {
+    openworkHostUrl?: string | null;
+    openworkToken?: string | null;
+    directory?: string | null;
+    displayName?: string | null;
+  }) => void;
+  initialValues?: {
+    openworkHostUrl?: string | null;
+    openworkToken?: string | null;
+    directory?: string | null;
+    displayName?: string | null;
+  };
+  submitting?: boolean;
+  error?: string | null;
+  inline?: boolean;
+  showClose?: boolean;
+  title?: string;
+  subtitle?: string;
+  confirmLabel?: string;
+};
+
+export type ShareField = {
+  label: string;
+  value: string;
+  secret?: boolean;
+  placeholder?: string;
+  hint?: string;
+};
+
+export type ShareView = "chooser" | "access";
+
+export type ShareWorkspaceModalProps = {
+  open: boolean;
+  onClose: () => void;
+  title?: string;
+  workspaceName: string;
+  workspaceDetail?: string | null;
+  fields: ShareField[];
+  remoteAccess?: {
+    enabled: boolean;
+    busy: boolean;
+    error?: string | null;
+    status?: string | null;
+    onSave: (enabled: boolean) => void | Promise<void>;
+  };
+  note?: string | null;
+  onExportConfig?: () => void;
+  exportDisabledReason?: string | null;
+};
diff --git a/apps/app/src/react-app/domains/workspace/use-remote-workspace-connection-editor.ts b/apps/app/src/react-app/domains/workspace/use-remote-workspace-connection-editor.ts
new file mode 100644
index 0000000000..4072b227d4
--- /dev/null
+++ b/apps/app/src/react-app/domains/workspace/use-remote-workspace-connection-editor.ts
@@ -0,0 +1,115 @@
+/** @jsxImportSource react */
+import { useCallback, useMemo, useState } from "react";
+
+import {
+  workspaceUpdateRemote,
+  type WorkspaceInfo,
+} from "../../../app/lib/desktop";
+import { t } from "../../../i18n";
+import type { RemoteWorkspaceInput } from "./types";
+
+function describeEditorError(error: unknown) {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  try {
+    const serialized = JSON.stringify(error);
+    return serialized && serialized !== "{}" ? serialized : t("app.unknown_error");
+  } catch {
+    return t("app.unknown_error");
+  }
+}
+
+export function useRemoteWorkspaceConnectionEditor<TWorkspace extends WorkspaceInfo>(input: {
+  workspaces: TWorkspace[];
+  onSaved: (workspaceId: string) => void | Promise<void>;
+}) {
+  const { onSaved, workspaces } = input;
+  const [workspaceId, setWorkspaceId] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const workspace = useMemo(
+    () =>
+      workspaceId
+        ? workspaces.find(
+            (item) =>
+              item.id === workspaceId && item.workspaceType === "remote",
+          ) ?? null
+        : null,
+    [workspaces, workspaceId],
+  );
+
+  const initialValues = useMemo(
+    () => ({
+      openworkHostUrl: workspace?.openworkHostUrl ?? workspace?.baseUrl ?? "",
+      openworkToken:
+        workspace?.openworkToken ??
+        workspace?.openworkClientToken ??
+        workspace?.openworkHostToken ??
+        "",
+      directory: workspace?.directory ?? workspace?.path ?? "",
+      displayName: workspace?.displayName ?? workspace?.name ?? "",
+    }),
+    [workspace],
+  );
+
+  const open = useCallback(
+    (nextWorkspaceId: string) => {
+      const next = workspaces.find((item) => item.id === nextWorkspaceId);
+      if (!next || next.workspaceType !== "remote") return;
+      setWorkspaceId(nextWorkspaceId);
+      setError(null);
+    },
+    [workspaces],
+  );
+
+  const close = useCallback(() => {
+    if (busy) return;
+    setWorkspaceId(null);
+    setError(null);
+  }, [busy]);
+
+  const save = useCallback(
+    async (fields: RemoteWorkspaceInput) => {
+      const id = workspaceId?.trim() ?? "";
+      const baseUrl = fields.openworkHostUrl?.trim() ?? "";
+      if (!id || !baseUrl) {
+        setError(t("dashboard.remote_base_url_required"));
+        return;
+      }
+
+      setBusy(true);
+      setError(null);
+      try {
+        await workspaceUpdateRemote({
+          workspaceId: id,
+          baseUrl,
+          openworkHostUrl: baseUrl,
+          openworkToken: fields.openworkToken?.trim() ?? "",
+          openworkClientToken: "",
+          openworkHostToken: "",
+          displayName: fields.displayName?.trim() || null,
+          directory: fields.directory?.trim() || null,
+          remoteType: "openwork",
+        });
+        await onSaved(id);
+        setWorkspaceId(null);
+      } catch (nextError) {
+        setError(describeEditorError(nextError));
+      } finally {
+        setBusy(false);
+      }
+    },
+    [onSaved, workspaceId],
+  );
+
+  return {
+    workspace,
+    busy,
+    error,
+    initialValues,
+    open,
+    close,
+    save,
+  };
+}
diff --git a/apps/app/src/react-app/infra/query-client.ts b/apps/app/src/react-app/infra/query-client.ts
new file mode 100644
index 0000000000..c5f2ea19fe
--- /dev/null
+++ b/apps/app/src/react-app/infra/query-client.ts
@@ -0,0 +1,12 @@
+import { QueryClient } from "@tanstack/react-query";
+
+type QueryClientGlobal = typeof globalThis & {
+  __owReactQueryClient?: QueryClient;
+};
+
+export function getReactQueryClient(): QueryClient {
+  const target = globalThis as QueryClientGlobal;
+  if (target.__owReactQueryClient) return target.__owReactQueryClient;
+  target.__owReactQueryClient = new QueryClient();
+  return target.__owReactQueryClient;
+}
diff --git a/apps/app/src/react-app/kernel/global-sdk-provider.tsx b/apps/app/src/react-app/kernel/global-sdk-provider.tsx
new file mode 100644
index 0000000000..188912b0dd
--- /dev/null
+++ b/apps/app/src/react-app/kernel/global-sdk-provider.tsx
@@ -0,0 +1,224 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import {
+  createOpencodeClient,
+  type Event,
+} from "@opencode-ai/sdk/v2/client";
+
+import { usePlatform } from "./platform";
+import { useServer } from "./server-provider";
+
+type OpencodeClient = ReturnType<typeof createOpencodeClient>;
+
+type Listener = (payload: Event) => void;
+
+export type GlobalEventEmitter = {
+  on: (channel: string, listener: Listener) => () => void;
+  off: (channel: string, listener: Listener) => void;
+  emit: (channel: string, payload: Event) => void;
+};
+
+function createEmitter(): GlobalEventEmitter {
+  const listeners = new Map<string, Set<Listener>>();
+  return {
+    on(channel, listener) {
+      let bucket = listeners.get(channel);
+      if (!bucket) {
+        bucket = new Set();
+        listeners.set(channel, bucket);
+      }
+      bucket.add(listener);
+      return () => this.off(channel, listener);
+    },
+    off(channel, listener) {
+      const bucket = listeners.get(channel);
+      if (!bucket) return;
+      bucket.delete(listener);
+      if (bucket.size === 0) listeners.delete(channel);
+    },
+    emit(channel, payload) {
+      const bucket = listeners.get(channel);
+      if (!bucket) return;
+      for (const listener of bucket) listener(payload);
+    },
+  };
+}
+
+type GlobalSDKContextValue = {
+  url: string;
+  client: OpencodeClient;
+  event: GlobalEventEmitter;
+};
+
+const GlobalSDKContext = createContext<GlobalSDKContextValue | undefined>(
+  undefined,
+);
+
+function readOpenworkToken(): string {
+  if (typeof window === "undefined") return "";
+  try {
+    return (window.localStorage.getItem("openwork.server.token") ?? "").trim();
+  } catch {
+    return "";
+  }
+}
+
+type GlobalSDKProviderProps = {
+  children: ReactNode;
+};
+
+export function GlobalSDKProvider({ children }: GlobalSDKProviderProps) {
+  const server = useServer();
+  const platform = usePlatform();
+  const emitterRef = useRef<GlobalEventEmitter | null>(null);
+  if (!emitterRef.current) {
+    emitterRef.current = createEmitter();
+  }
+  const emitter = emitterRef.current;
+
+  const token = readOpenworkToken();
+  const headers =
+    token && server.url.includes("/opencode")
+      ? { Authorization: `Bearer ${token}` }
+      : undefined;
+
+  const [client, setClient] = useState<OpencodeClient>(() =>
+    createOpencodeClient({
+      baseUrl: server.url,
+      headers,
+      fetch: platform.fetch,
+      throwOnError: true,
+    }),
+  );
+
+  useEffect(() => {
+    setClient(
+      createOpencodeClient({
+        baseUrl: server.url,
+        headers,
+        fetch: platform.fetch,
+        throwOnError: true,
+      }),
+    );
+  }, [platform.fetch, server.url]);
+
+  useEffect(() => {
+    const baseUrl = server.url;
+    const isHealthy = server.healthy === true;
+    if (!baseUrl || !isHealthy) return;
+
+    const abort = new AbortController();
+    const eventClient = createOpencodeClient({
+      baseUrl,
+      headers,
+      signal: abort.signal,
+      fetch: platform.fetch,
+    });
+
+    type Queued = { directory: string; payload: Event };
+    let queue: Array<Queued | undefined> = [];
+    const coalesced = new Map<string, number>();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let last = 0;
+
+    const keyForEvent = (directory: string, payload: Event): string | undefined => {
+      if (payload.type === "session.status")
+        return `session.status:${directory}:${payload.properties.sessionID}`;
+      if (payload.type === "lsp.updated") return `lsp.updated:${directory}`;
+      if (payload.type === "todo.updated")
+        return `todo.updated:${directory}:${payload.properties.sessionID}`;
+      if (payload.type === "mcp.tools.changed")
+        return `mcp.tools.changed:${directory}:${payload.properties.server}`;
+      if (payload.type === "message.part.updated") {
+        const part = payload.properties.part;
+        return `message.part.updated:${directory}:${part.messageID}:${part.id}`;
+      }
+      return undefined;
+    };
+
+    const flush = () => {
+      if (timer) clearTimeout(timer);
+      timer = undefined;
+      const events = queue;
+      queue = [];
+      coalesced.clear();
+      if (!events.length) return;
+      last = Date.now();
+      for (const entry of events) {
+        if (!entry) continue;
+        emitter.emit(entry.directory, entry.payload);
+      }
+    };
+
+    const schedule = () => {
+      if (timer) return;
+      const elapsed = Date.now() - last;
+      timer = setTimeout(flush, Math.max(0, 16 - elapsed));
+    };
+
+    void (async () => {
+      const subscription = await eventClient.event.subscribe(undefined, {
+        signal: abort.signal,
+      });
+      let yielded = Date.now();
+
+      for await (const event of subscription.stream as AsyncIterable<unknown>) {
+        const record = event as Event & { directory?: string; payload?: Event };
+        const payload = record.payload ?? record;
+        if (!payload?.type) continue;
+        const directory =
+          typeof record.directory === "string" ? record.directory : "global";
+        const key = keyForEvent(directory, payload);
+        if (key) {
+          const index = coalesced.get(key);
+          if (index !== undefined) queue[index] = undefined;
+          coalesced.set(key, queue.length);
+        }
+        queue.push({ directory, payload });
+        schedule();
+
+        if (Date.now() - yielded < 8) continue;
+        yielded = Date.now();
+        await new Promise<void>((resolve) => setTimeout(resolve, 0));
+      }
+    })()
+      .finally(flush)
+      .catch(() => undefined);
+
+    return () => {
+      abort.abort();
+      flush();
+    };
+    // headers is re-derived from local storage; rerun only when server URL or health flips.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [emitter, platform.fetch, server.healthy, server.url]);
+
+  const value = useMemo<GlobalSDKContextValue>(
+    () => ({
+      url: server.url,
+      client,
+      event: emitter,
+    }),
+    [client, emitter, server.url],
+  );
+
+  return (
+    <GlobalSDKContext.Provider value={value}>{children}</GlobalSDKContext.Provider>
+  );
+}
+
+export function useGlobalSDK(): GlobalSDKContextValue {
+  const context = useContext(GlobalSDKContext);
+  if (!context) {
+    throw new Error("Global SDK context is missing");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/kernel/global-sync-provider.tsx b/apps/app/src/react-app/kernel/global-sync-provider.tsx
new file mode 100644
index 0000000000..c6dff22ed4
--- /dev/null
+++ b/apps/app/src/react-app/kernel/global-sync-provider.tsx
@@ -0,0 +1,408 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import type {
+  Config,
+  ConfigProvidersResponse,
+  Event,
+  GlobalHealthResponse,
+  LspStatus,
+  Message,
+  Part,
+  Project,
+  ProviderAuthResponse,
+  ProviderListResponse,
+  Session,
+  VcsInfo,
+} from "@opencode-ai/sdk/v2/client";
+
+import { t } from "../../i18n";
+import { unwrap } from "../../app/lib/opencode";
+import type { McpStatusMap, TodoItem } from "../../app/types";
+import { safeStringify } from "../../app/utils";
+import {
+  filterProviderList,
+  mapConfigProvidersToList,
+} from "../../app/utils/providers";
+
+import { useGlobalSDK } from "./global-sdk-provider";
+
+export type WorkspaceState = {
+  status: "idle" | "loading" | "partial" | "ready";
+  session: Session[];
+  session_status: Record<string, string>;
+  message: Record<string, Message[]>;
+  part: Record<string, Part[]>;
+  todo: Record<string, TodoItem[]>;
+};
+
+type ProjectMeta = {
+  name?: string;
+  icon?: Project["icon"];
+};
+
+export type GlobalState = {
+  ready: boolean;
+  error?: string;
+  serverVersion?: string;
+  config: Config;
+  provider: ProviderListResponse;
+  providerAuth: ProviderAuthResponse;
+  mcp: Record<string, McpStatusMap>;
+  lsp: Record<string, LspStatus[]>;
+  project: Project[];
+  projectMeta: Record<string, ProjectMeta>;
+  vcs: Record<string, VcsInfo | null>;
+};
+
+type GlobalSyncContextValue = {
+  data: GlobalState;
+  setData: (updater: (previous: GlobalState) => GlobalState) => void;
+  refresh: () => Promise<void>;
+  refreshDirectory: (directory: string) => Promise<void>;
+  getWorkspace: (directory: string) => WorkspaceState;
+  setWorkspace: (
+    directory: string,
+    updater: (previous: WorkspaceState) => WorkspaceState,
+  ) => void;
+};
+
+const GlobalSyncContext = createContext<GlobalSyncContextValue | undefined>(
+  undefined,
+);
+
+const DEFAULT_PROVIDER: ProviderListResponse = {
+  all: [],
+  connected: [],
+  default: {},
+};
+
+const INITIAL_GLOBAL_STATE: GlobalState = {
+  ready: false,
+  error: undefined,
+  serverVersion: undefined,
+  config: {},
+  provider: DEFAULT_PROVIDER,
+  providerAuth: {},
+  mcp: {},
+  lsp: {},
+  project: [],
+  projectMeta: {},
+  vcs: {},
+};
+
+const createWorkspaceState = (): WorkspaceState => ({
+  status: "idle",
+  session: [],
+  session_status: {},
+  message: {},
+  part: {},
+  todo: {},
+});
+
+const keyFor = (directory: string) => directory || "global";
+
+type GlobalSyncProviderProps = {
+  children: ReactNode;
+};
+
+export function GlobalSyncProvider({ children }: GlobalSyncProviderProps) {
+  const globalSDK = useGlobalSDK();
+  const [state, setState] = useState<GlobalState>(INITIAL_GLOBAL_STATE);
+  const workspacesRef = useRef(new Map<string, WorkspaceState>());
+  const subscriptionsRef = useRef(new Map<string, () => void>());
+  const latestStateRef = useRef<GlobalState>(state);
+  latestStateRef.current = state;
+
+  const setField = useCallback(
+    <K extends keyof GlobalState>(key: K, value: GlobalState[K]) => {
+      setState((previous) => ({ ...previous, [key]: value }));
+    },
+    [],
+  );
+
+  const setError = useCallback((error: unknown) => {
+    const message =
+      error instanceof Error ? error.message : safeStringify(error);
+    setState((previous) => ({
+      ...previous,
+      error: message || t("app.unknown_error"),
+    }));
+  }, []);
+
+  const setProjectMetaForProjects = useCallback((projects: Project[]) => {
+    const next: Record<string, ProjectMeta> = {};
+    for (const project of projects) {
+      if (!project?.worktree) continue;
+      next[project.worktree] = {
+        name: project.name,
+        icon: project.icon,
+      };
+    }
+    setField("projectMeta", next);
+  }, [setField]);
+
+  const refreshConfig = useCallback(async () => {
+    const result = unwrap(await globalSDK.client.config.get());
+    setField("config", result);
+  }, [globalSDK.client, setField]);
+
+  const refreshProviders = useCallback(async () => {
+    let disabledProviders =
+      latestStateRef.current.config.disabled_providers ?? [];
+    try {
+      const config = unwrap(await globalSDK.client.config.get());
+      disabledProviders = Array.isArray(config.disabled_providers)
+        ? config.disabled_providers
+        : [];
+    } catch {
+      // ignore config read failures
+    }
+    try {
+      const result = filterProviderList(
+        unwrap(await globalSDK.client.provider.list()),
+        disabledProviders,
+      );
+      setField("provider", result);
+    } catch {
+      const fallback = unwrap(
+        await globalSDK.client.config.providers(),
+      ) as ConfigProvidersResponse;
+      setField(
+        "provider",
+        filterProviderList(
+          {
+            all: mapConfigProvidersToList(fallback.providers),
+            connected: [],
+            default: fallback.default,
+          },
+          disabledProviders,
+        ),
+      );
+    }
+  }, [globalSDK.client, setField]);
+
+  const refreshProviderAuth = useCallback(async () => {
+    try {
+      const result = await globalSDK.client.provider.auth();
+      setField("providerAuth", result.data ?? {});
+    } catch {
+      setField("providerAuth", {});
+    }
+  }, [globalSDK.client, setField]);
+
+  const refreshMcp = useCallback(
+    async (directory?: string) => {
+      const result = unwrap(
+        await globalSDK.client.mcp.status({ directory }),
+      ) as McpStatusMap;
+      setState((previous) => ({
+        ...previous,
+        mcp: { ...previous.mcp, [keyFor(directory ?? "")]: result },
+      }));
+    },
+    [globalSDK.client],
+  );
+
+  const refreshLsp = useCallback(
+    async (directory?: string) => {
+      const result = unwrap(
+        await globalSDK.client.lsp.status({ directory }),
+      ) as LspStatus[];
+      setState((previous) => ({
+        ...previous,
+        lsp: { ...previous.lsp, [keyFor(directory ?? "")]: result },
+      }));
+    },
+    [globalSDK.client],
+  );
+
+  const refreshVcs = useCallback(
+    async (directory: string) => {
+      try {
+        const result = unwrap(
+          await globalSDK.client.vcs.get({ directory }),
+        ) as VcsInfo;
+        setState((previous) => ({
+          ...previous,
+          vcs: { ...previous.vcs, [keyFor(directory)]: result ?? null },
+        }));
+      } catch {
+        setState((previous) => ({
+          ...previous,
+          vcs: { ...previous.vcs, [keyFor(directory)]: null },
+        }));
+      }
+    },
+    [globalSDK.client],
+  );
+
+  const refreshProjects = useCallback(async () => {
+    const projects = unwrap(
+      await globalSDK.client.project.list(),
+    ) as Project[];
+    setField("project", projects);
+    setProjectMetaForProjects(projects);
+    await Promise.allSettled(
+      projects
+        .map((project) => project.worktree)
+        .filter(
+          (worktree): worktree is string =>
+            typeof worktree === "string" && worktree.length > 0,
+        )
+        .map((worktree) => refreshVcs(worktree)),
+    );
+  }, [globalSDK.client, refreshVcs, setField, setProjectMetaForProjects]);
+
+  const refreshDirectory = useCallback(
+    async (directory: string) => {
+      if (!directory) return;
+      await Promise.allSettled([
+        refreshMcp(directory),
+        refreshLsp(directory),
+        refreshVcs(directory),
+      ]);
+    },
+    [refreshLsp, refreshMcp, refreshVcs],
+  );
+
+  const refresh = useCallback(async () => {
+    setState((previous) => ({ ...previous, ready: false, error: undefined }));
+    try {
+      const health = unwrap(
+        await globalSDK.client.global.health(),
+      ) as GlobalHealthResponse;
+      if (!health?.healthy) {
+        setField("error", "Server reported unhealthy status.");
+        return;
+      }
+      const previousVersion = latestStateRef.current.serverVersion;
+      if (previousVersion && health.version !== previousVersion) {
+        setState((previous) => ({
+          ...previous,
+          mcp: {},
+          lsp: {},
+          project: [],
+          projectMeta: {},
+          vcs: {},
+        }));
+      }
+      setField("serverVersion", health.version);
+    } catch (error) {
+      setError(error);
+      return;
+    }
+
+    const results = await Promise.allSettled([
+      refreshConfig(),
+      refreshProviders(),
+      refreshProviderAuth(),
+      refreshMcp(),
+      refreshLsp(),
+      refreshProjects(),
+    ]);
+
+    for (const result of results) {
+      if (result.status === "rejected") {
+        setError(result.reason);
+      }
+    }
+
+    setField("ready", true);
+  }, [
+    globalSDK.client,
+    refreshConfig,
+    refreshLsp,
+    refreshMcp,
+    refreshProjects,
+    refreshProviderAuth,
+    refreshProviders,
+    setError,
+    setField,
+  ]);
+
+  useEffect(() => {
+    if (!globalSDK.url) return;
+    void refresh();
+  }, [globalSDK.url, refresh]);
+
+  // Listen for directory-scoped change events and refresh the matching slices.
+  useEffect(() => {
+    const globalKey = keyFor("");
+    if (subscriptionsRef.current.has(globalKey)) return;
+    const unsubscribe = globalSDK.event.on(globalKey, (payload: Event) => {
+      if (payload.type === "lsp.updated") void refreshLsp();
+      if (payload.type === "mcp.tools.changed") void refreshMcp();
+    });
+    subscriptionsRef.current.set(globalKey, unsubscribe);
+    return () => {
+      subscriptionsRef.current.delete(globalKey);
+      unsubscribe();
+    };
+  }, [globalSDK.event, refreshLsp, refreshMcp]);
+
+  const getWorkspace = useCallback((directory: string) => {
+    const key = keyFor(directory);
+    const existing = workspacesRef.current.get(key);
+    if (existing) return existing;
+    const next = createWorkspaceState();
+    workspacesRef.current.set(key, next);
+    void refreshDirectory(directory);
+    if (!subscriptionsRef.current.has(key)) {
+      const unsubscribe = globalSDK.event.on(key, (payload: Event) => {
+        if (payload.type === "lsp.updated") void refreshLsp(directory);
+        if (payload.type === "mcp.tools.changed") void refreshMcp(directory);
+      });
+      subscriptionsRef.current.set(key, unsubscribe);
+    }
+    return next;
+  }, [globalSDK.event, refreshDirectory, refreshLsp, refreshMcp]);
+
+  const setWorkspace = useCallback(
+    (
+      directory: string,
+      updater: (previous: WorkspaceState) => WorkspaceState,
+    ) => {
+      const key = keyFor(directory);
+      const current =
+        workspacesRef.current.get(key) ?? createWorkspaceState();
+      const next = updater(current);
+      workspacesRef.current.set(key, next);
+    },
+    [],
+  );
+
+  const value = useMemo<GlobalSyncContextValue>(
+    () => ({
+      data: state,
+      setData: (updater) => setState(updater),
+      refresh,
+      refreshDirectory,
+      getWorkspace,
+      setWorkspace,
+    }),
+    [getWorkspace, refresh, refreshDirectory, setWorkspace, state],
+  );
+
+  return (
+    <GlobalSyncContext.Provider value={value}>
+      {children}
+    </GlobalSyncContext.Provider>
+  );
+}
+
+export function useGlobalSync(): GlobalSyncContextValue {
+  const context = useContext(GlobalSyncContext);
+  if (!context) {
+    throw new Error("Global sync context is missing");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/kernel/local-provider.tsx b/apps/app/src/react-app/kernel/local-provider.tsx
new file mode 100644
index 0000000000..9ca1ffee37
--- /dev/null
+++ b/apps/app/src/react-app/kernel/local-provider.tsx
@@ -0,0 +1,177 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+import { THINKING_PREF_KEY } from "../../app/constants";
+import { coerceReleaseChannel } from "../../app/lib/release-channels";
+import type { ModelRef, ReleaseChannel, SettingsTab, View } from "../../app/types";
+import { readStoredDefaultModel } from "./model-config";
+
+export type LocalUIState = {
+  view: View;
+  tab: SettingsTab;
+};
+
+export type LocalPreferences = {
+  showThinking: boolean;
+  modelVariant: string | null;
+  defaultModel: ModelRef | null;
+  /**
+   * Release channel the desktop app is subscribed to. Defaults to
+   * "stable". Alpha is only honored on macOS; the updater helper falls
+   * back to stable elsewhere.
+   */
+  releaseChannel: ReleaseChannel;
+  featureFlags: {
+    microsandboxCreateSandbox: boolean;
+  };
+  /**
+   * Set to true after the user completes the welcome/onboarding flow
+   * (creates or connects their first workspace). When false and the
+   * workspace list is empty, the app redirects to /welcome.
+   */
+  hasCompletedOnboarding: boolean;
+};
+
+type LocalContextValue = {
+  ui: LocalUIState;
+  setUi: (updater: (previous: LocalUIState) => LocalUIState) => void;
+  prefs: LocalPreferences;
+  setPrefs: (updater: (previous: LocalPreferences) => LocalPreferences) => void;
+  ready: boolean;
+};
+
+const LocalContext = createContext<LocalContextValue | undefined>(undefined);
+
+const UI_STORAGE_KEY = "openwork.ui";
+const PREFS_STORAGE_KEY = "openwork.preferences";
+
+const INITIAL_UI: LocalUIState = { view: "settings", tab: "general" };
+const INITIAL_PREFS: LocalPreferences = {
+  showThinking: false,
+  modelVariant: null,
+  defaultModel: null,
+  releaseChannel: "stable",
+  featureFlags: { microsandboxCreateSandbox: false },
+  hasCompletedOnboarding: false,
+};
+
+function readPersisted<T>(key: string, fallback: T): T {
+  if (typeof window === "undefined") return fallback;
+  try {
+    const raw = window.localStorage.getItem(key);
+    if (!raw) return fallback;
+    const parsed = JSON.parse(raw) as unknown;
+    if (parsed && typeof parsed === "object") {
+      return { ...fallback, ...(parsed as Record<string, unknown>) } as T;
+    }
+    return fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+function writePersisted(key: string, value: unknown) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(key, JSON.stringify(value));
+  } catch {
+    // ignore quota errors
+  }
+}
+
+type LocalProviderProps = {
+  children: ReactNode;
+};
+
+export function LocalProvider({ children }: LocalProviderProps) {
+  const [ui, setUiRaw] = useState<LocalUIState>(() =>
+    readPersisted(UI_STORAGE_KEY, INITIAL_UI),
+  );
+  const [prefs, setPrefsRaw] = useState<LocalPreferences>(() => {
+    const persisted = readPersisted(PREFS_STORAGE_KEY, INITIAL_PREFS);
+    if (persisted.defaultModel) {
+      return persisted;
+    }
+    return {
+      ...persisted,
+      defaultModel: readStoredDefaultModel(),
+    };
+  });
+  const [ready, setReady] = useState(false);
+  const migratedThinkingRef = useRef(false);
+
+  useEffect(() => {
+    writePersisted(UI_STORAGE_KEY, ui);
+  }, [ui]);
+
+  useEffect(() => {
+    writePersisted(PREFS_STORAGE_KEY, prefs);
+  }, [prefs]);
+
+  useEffect(() => {
+    setReady(true);
+  }, []);
+
+  useEffect(() => {
+    if (!ready) return;
+    if (typeof window === "undefined") return;
+    if (migratedThinkingRef.current) return;
+    migratedThinkingRef.current = true;
+
+    const raw = window.localStorage.getItem(THINKING_PREF_KEY);
+    if (raw == null) return;
+
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed === "boolean") {
+        setPrefsRaw((previous) => ({ ...previous, showThinking: parsed }));
+      }
+    } catch {
+      // ignore invalid legacy values
+    }
+
+    try {
+      window.localStorage.removeItem(THINKING_PREF_KEY);
+    } catch {
+      // ignore
+    }
+  }, [ready]);
+
+  const setUi = useCallback(
+    (updater: (previous: LocalUIState) => LocalUIState) => {
+      setUiRaw(updater);
+    },
+    [],
+  );
+
+  const setPrefs = useCallback(
+    (updater: (previous: LocalPreferences) => LocalPreferences) => {
+      setPrefsRaw(updater);
+    },
+    [],
+  );
+
+  const value = useMemo<LocalContextValue>(
+    () => ({ ui, setUi, prefs, setPrefs, ready }),
+    [prefs, ready, setPrefs, setUi, ui],
+  );
+
+  return <LocalContext.Provider value={value}>{children}</LocalContext.Provider>;
+}
+
+export function useLocal(): LocalContextValue {
+  const context = useContext(LocalContext);
+  if (!context) {
+    throw new Error("Local context is missing");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/kernel/model-config.ts b/apps/app/src/react-app/kernel/model-config.ts
new file mode 100644
index 0000000000..be9c9efbb5
--- /dev/null
+++ b/apps/app/src/react-app/kernel/model-config.ts
@@ -0,0 +1,189 @@
+import { useCallback, useEffect, useState } from "react";
+
+import {
+  DEFAULT_MODEL,
+  MODEL_PREF_KEY,
+  SESSION_MODEL_PREF_KEY,
+  VARIANT_PREF_KEY,
+} from "../../app/constants";
+import type { ModelRef } from "../../app/types";
+import {
+  formatModelRef,
+  parseModelRef,
+} from "../../app/utils";
+import { normalizeModelBehaviorValue } from "../../app/lib/model-behavior";
+
+export type SessionChoiceOverride = {
+  model?: ModelRef | null;
+  variant?: string | null;
+};
+
+export type ModelPickerTarget = "default" | "session";
+
+const hasOwn = <K extends PropertyKey>(
+  value: object,
+  key: K,
+): value is Record<K, unknown> =>
+  Object.prototype.hasOwnProperty.call(value, key);
+
+export function sessionModelOverridesKey(workspaceId: string): string {
+  return `${SESSION_MODEL_PREF_KEY}.${workspaceId}`;
+}
+
+export function workspaceModelVariantsKey(workspaceId: string): string {
+  return `${VARIANT_PREF_KEY}.${workspaceId}`;
+}
+
+const normalizeVariantOverride = (value: unknown) => {
+  if (typeof value === "string") return normalizeModelBehaviorValue(value);
+  if (value == null) return null;
+  return null;
+};
+
+const parseStoredModel = (value: unknown) => {
+  if (typeof value === "string") return parseModelRef(value);
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  if (
+    typeof record.providerID === "string" &&
+    typeof record.modelID === "string"
+  ) {
+    return { providerID: record.providerID, modelID: record.modelID };
+  }
+  return null;
+};
+
+const normalizeSessionChoice = (
+  value: SessionChoiceOverride | null | undefined,
+): SessionChoiceOverride | null => {
+  if (!value || typeof value !== "object") return null;
+  const next: SessionChoiceOverride = {};
+  if (value.model) next.model = value.model;
+  if (hasOwn(value, "variant")) {
+    next.variant = normalizeModelBehaviorValue(value.variant ?? null);
+  }
+  return hasOwn(next, "variant") || next.model ? next : null;
+};
+
+export function parseSessionChoiceOverrides(
+  raw: string | null,
+): Record<string, SessionChoiceOverride> {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw) as Record<string, unknown>;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+
+    const next: Record<string, SessionChoiceOverride> = {};
+    for (const [sessionId, value] of Object.entries(parsed)) {
+      if (typeof value === "string") {
+        const model = parseModelRef(value);
+        if (model) next[sessionId] = { model };
+        continue;
+      }
+      if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+      const record = value as Record<string, unknown>;
+      const model = parseStoredModel(record.model ?? record);
+      const choice = normalizeSessionChoice({
+        ...(model ? { model } : {}),
+        ...(hasOwn(record, "variant")
+          ? { variant: normalizeVariantOverride(record.variant) }
+          : {}),
+      });
+      if (choice) next[sessionId] = choice;
+    }
+    return next;
+  } catch {
+    return {};
+  }
+}
+
+export function serializeSessionChoiceOverrides(
+  overrides: Record<string, SessionChoiceOverride>,
+): string | null {
+  const entries = Object.entries(overrides)
+    .map(
+      ([sessionId, choice]) =>
+        [sessionId, normalizeSessionChoice(choice)] as const,
+    )
+    .filter(
+      (entry): entry is readonly [string, SessionChoiceOverride] =>
+        Boolean(entry[1]),
+    );
+
+  if (!entries.length) return null;
+
+  const payload: Record<string, { model?: string; variant?: string | null }> =
+    {};
+  for (const [sessionId, choice] of entries) {
+    const next: { model?: string; variant?: string | null } = {};
+    if (choice.model) next.model = formatModelRef(choice.model);
+    if (hasOwn(choice, "variant")) next.variant = choice.variant ?? null;
+    payload[sessionId] = next;
+  }
+  return JSON.stringify(payload);
+}
+
+export function parseWorkspaceModelVariants(
+  raw: string | null,
+  fallbackModel: ModelRef = DEFAULT_MODEL,
+): Record<string, string> {
+  if (!raw || !raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      const normalized = normalizeModelBehaviorValue(raw);
+      return normalized ? { [formatModelRef(fallbackModel)]: normalized } : {};
+    }
+    const next: Record<string, string> = {};
+    for (const [key, value] of Object.entries(
+      parsed as Record<string, unknown>,
+    )) {
+      const normalized = normalizeVariantOverride(value);
+      if (normalized) next[key] = normalized;
+    }
+    return next;
+  } catch {
+    const normalized = normalizeModelBehaviorValue(raw);
+    return normalized ? { [formatModelRef(fallbackModel)]: normalized } : {};
+  }
+}
+
+export function readStoredDefaultModel(): ModelRef {
+  if (typeof window === "undefined") return DEFAULT_MODEL;
+  try {
+    const stored = window.localStorage.getItem(MODEL_PREF_KEY);
+    return parseModelRef(stored) ?? DEFAULT_MODEL;
+  } catch {
+    return DEFAULT_MODEL;
+  }
+}
+
+export function writeStoredDefaultModel(model: ModelRef): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(MODEL_PREF_KEY, formatModelRef(model));
+  } catch {
+    // ignore quota errors
+  }
+}
+
+/**
+ * Minimal React hook covering the default model picker state. The richer
+ * session/workspace model overrides from context/model-config.ts will be
+ * ported incrementally as the session and settings surfaces migrate.
+ */
+export function useDefaultModel(): [ModelRef, (next: ModelRef) => void] {
+  const [model, setModel] = useState<ModelRef>(() => readStoredDefaultModel());
+
+  useEffect(() => {
+    writeStoredDefaultModel(model);
+  }, [model]);
+
+  const update = useCallback((next: ModelRef) => {
+    setModel(next);
+  }, []);
+
+  return [model, update];
+}
diff --git a/apps/app/src/react-app/kernel/platform.tsx b/apps/app/src/react-app/kernel/platform.tsx
new file mode 100644
index 0000000000..5a0158b2bf
--- /dev/null
+++ b/apps/app/src/react-app/kernel/platform.tsx
@@ -0,0 +1,130 @@
+/** @jsxImportSource react */
+import { createContext, useContext, type ReactNode } from "react";
+
+import { openDesktopUrl, relaunchDesktopApp } from "../../app/lib/desktop";
+import { isDesktopRuntime } from "../../app/utils";
+
+export type SyncStorage = {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+};
+
+export type AsyncStorage = {
+  getItem(key: string): Promise<string | null>;
+  setItem(key: string, value: string): Promise<void>;
+  removeItem(key: string): Promise<void>;
+};
+
+export type Platform = {
+  platform: "web" | "desktop";
+  os?: "macos" | "windows" | "linux";
+  version?: string;
+  openLink(url: string): void;
+  restart(): Promise<void>;
+  notify(title: string, description?: string, href?: string): Promise<void>;
+  storage?: (name?: string) => SyncStorage | AsyncStorage;
+  checkUpdate?: () => Promise<{ updateAvailable: boolean; version?: string }>;
+  update?: () => Promise<void>;
+  fetch?: typeof fetch;
+  getDefaultServerUrl?: () => Promise<string | null>;
+  setDefaultServerUrl?: (url: string | null) => Promise<void>;
+};
+
+const PlatformContext = createContext<Platform | undefined>(undefined);
+
+type PlatformProviderProps = {
+  value: Platform;
+  children: ReactNode;
+};
+
+export function PlatformProvider({ value, children }: PlatformProviderProps) {
+  return (
+    <PlatformContext.Provider value={value}>
+      {children}
+    </PlatformContext.Provider>
+  );
+}
+
+export function usePlatform(): Platform {
+  const context = useContext(PlatformContext);
+  if (!context) {
+    throw new Error("Platform context is missing");
+  }
+  return context;
+}
+
+function shouldOpenInCurrentTab(url: string) {
+  return /^(mailto|tel):/i.test(url.trim());
+}
+
+export function createDefaultPlatform(): Platform {
+  return {
+    platform: isDesktopRuntime() ? "desktop" : "web",
+    openLink(url: string) {
+      if (isDesktopRuntime()) {
+        void openDesktopUrl(url).catch(() => {
+          if (shouldOpenInCurrentTab(url)) {
+            window.location.href = url;
+            return;
+          }
+          window.open(url, "_blank");
+        });
+        return;
+      }
+
+      if (shouldOpenInCurrentTab(url)) {
+        window.location.href = url;
+        return;
+      }
+
+      window.open(url, "_blank");
+    },
+    restart: async () => {
+      if (isDesktopRuntime()) {
+        await relaunchDesktopApp();
+        return;
+      }
+
+      window.location.reload();
+    },
+    notify: async (title, description, href) => {
+      if (!("Notification" in window)) return;
+
+      const permission =
+        Notification.permission === "default"
+          ? await Notification.requestPermission().catch(() => "denied")
+          : Notification.permission;
+
+      if (permission !== "granted") return;
+
+      const inView = document.visibilityState === "visible" && document.hasFocus();
+      if (inView) return;
+
+      await Promise.resolve()
+        .then(() => {
+          const notification = new Notification(title, {
+            body: description ?? "",
+          });
+          notification.onclick = () => {
+            window.focus();
+            if (href) {
+              window.history.pushState(null, "", href);
+              window.dispatchEvent(new PopStateEvent("popstate"));
+            }
+            notification.close();
+          };
+        })
+        .catch(() => undefined);
+    },
+    storage: (name) => {
+      const prefix = name ? `${name}:` : "";
+      return {
+        getItem: (key) => window.localStorage.getItem(prefix + key),
+        setItem: (key, value) => window.localStorage.setItem(prefix + key, value),
+        removeItem: (key) => window.localStorage.removeItem(prefix + key),
+      };
+    },
+    fetch,
+  };
+}
diff --git a/apps/app/src/react-app/kernel/selectors.ts b/apps/app/src/react-app/kernel/selectors.ts
new file mode 100644
index 0000000000..de7f7980a0
--- /dev/null
+++ b/apps/app/src/react-app/kernel/selectors.ts
@@ -0,0 +1,12 @@
+import type { OpenworkStore } from "./store";
+
+export const selectActiveWorkspace = (state: OpenworkStore) =>
+  state.workspaces.find(
+    (workspace) => workspace.id === state.activeWorkspaceId,
+  ) ?? null;
+
+export const selectServerStatus = (state: OpenworkStore) => state.server.status;
+
+export const selectServerUrl = (state: OpenworkStore) => state.server.url;
+
+export const selectErrorBanner = (state: OpenworkStore) => state.errorBanner;
diff --git a/apps/app/src/react-app/kernel/server-provider.tsx b/apps/app/src/react-app/kernel/server-provider.tsx
new file mode 100644
index 0000000000..0470e351be
--- /dev/null
+++ b/apps/app/src/react-app/kernel/server-provider.tsx
@@ -0,0 +1,228 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+
+import { desktopFetch } from "../../app/lib/desktop";
+import { isWebDeployment } from "../../app/lib/openwork-deployment";
+import { isDesktopRuntime } from "../../app/utils";
+
+export function normalizeServerUrl(input: string): string | undefined {
+  const trimmed = input.trim();
+  if (!trimmed) return;
+  const withProtocol = /^https?:\/\//.test(trimmed) ? trimmed : `http://${trimmed}`;
+  return withProtocol.replace(/\/+$/, "");
+}
+
+export function serverDisplayName(url: string): string {
+  if (!url) return "";
+  return url.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+}
+
+type ServerContextValue = {
+  url: string;
+  name: string;
+  list: string[];
+  healthy: boolean | undefined;
+  setActive: (url: string) => void;
+  add: (url: string) => void;
+  remove: (url: string) => void;
+};
+
+const ServerContext = createContext<ServerContextValue | undefined>(undefined);
+
+function readStoredList(): string[] {
+  if (typeof window === "undefined") return [];
+  try {
+    const raw = window.localStorage.getItem("openwork.server.list");
+    const parsed = raw ? (JSON.parse(raw) as unknown) : [];
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
+function readStoredActive(): string {
+  if (typeof window === "undefined") return "";
+  try {
+    const stored = window.localStorage.getItem("openwork.server.active");
+    return typeof stored === "string" ? stored : "";
+  } catch {
+    return "";
+  }
+}
+
+function readOpenworkToken(): string {
+  if (typeof window === "undefined") return "";
+  try {
+    return (window.localStorage.getItem("openwork.server.token") ?? "").trim();
+  } catch {
+    return "";
+  }
+}
+
+async function checkHealth(url: string): Promise<boolean> {
+  if (!url) return false;
+  const token = readOpenworkToken();
+  const headers =
+    token && url.includes("/opencode") ? { Authorization: `Bearer ${token}` } : undefined;
+  const client = createOpencodeClient({
+    baseUrl: url,
+    headers,
+    signal: AbortSignal.timeout(3000),
+    fetch: isDesktopRuntime() ? desktopFetch : undefined,
+  });
+  return client.global
+    .health()
+    .then((result) => result.data?.healthy === true)
+    .catch(() => false);
+}
+
+type ServerProviderProps = {
+  children: ReactNode;
+  defaultUrl: string;
+};
+
+export function ServerProvider({ children, defaultUrl }: ServerProviderProps) {
+  const [list, setList] = useState<string[]>([]);
+  const [active, setActiveRaw] = useState<string>("");
+  const [healthy, setHealthy] = useState<boolean | undefined>(undefined);
+  const readyRef = useRef(false);
+
+  useEffect(() => {
+    if (readyRef.current) return;
+    if (typeof window === "undefined") return;
+
+    const fallback = normalizeServerUrl(defaultUrl) ?? "";
+
+    // Hosted web deployments served by OpenWork must reuse the OpenCode proxy
+    // rather than any persisted localhost target.
+    const forceProxy =
+      !isDesktopRuntime() &&
+      isWebDeployment() &&
+      (import.meta.env.PROD ||
+        (typeof import.meta.env?.VITE_OPENWORK_URL === "string" &&
+          import.meta.env.VITE_OPENWORK_URL.trim().length > 0));
+
+    if (forceProxy && fallback) {
+      setList([fallback]);
+      setActiveRaw(fallback);
+      readyRef.current = true;
+      return;
+    }
+
+    const storedList = readStoredList();
+    const storedActive = normalizeServerUrl(readStoredActive());
+
+    const initialList = storedList.length ? storedList : fallback ? [fallback] : [];
+    const initialActive = storedActive || initialList[0] || fallback || "";
+
+    setList(initialList);
+    setActiveRaw(initialActive);
+    readyRef.current = true;
+  }, [defaultUrl]);
+
+  useEffect(() => {
+    if (!readyRef.current) return;
+    if (typeof window === "undefined") return;
+    try {
+      window.localStorage.setItem("openwork.server.list", JSON.stringify(list));
+      window.localStorage.setItem("openwork.server.active", active);
+    } catch {
+      // ignore
+    }
+  }, [active, list]);
+
+  useEffect(() => {
+    if (!active) return;
+    if (isDesktopRuntime() && !active.includes("/opencode")) {
+      // Desktop React routes now talk to OpenWork server workspace-mounted
+      // `/opencode` URLs directly. Ignore old persisted raw OpenCode daemon
+      // URLs here; their ephemeral ports go stale across restarts and otherwise
+      // produce noisy `/global/health` connection-refused polling forever.
+      setHealthy(undefined);
+      return;
+    }
+    setHealthy(undefined);
+
+    let cancelled = false;
+    let busy = false;
+
+    const run = () => {
+      if (busy) return;
+      busy = true;
+      void checkHealth(active)
+        .then((next) => {
+          if (cancelled) return;
+          setHealthy(next);
+        })
+        .finally(() => {
+          busy = false;
+        });
+    };
+
+    run();
+    const interval = window.setInterval(run, 10_000);
+
+    return () => {
+      cancelled = true;
+      window.clearInterval(interval);
+    };
+  }, [active]);
+
+  const setActive = useCallback((input: string) => {
+    const next = normalizeServerUrl(input);
+    if (!next) return;
+    setActiveRaw(next);
+  }, []);
+
+  const add = useCallback((input: string) => {
+    const next = normalizeServerUrl(input);
+    if (!next) return;
+    setList((current) => (current.includes(next) ? current : [...current, next]));
+    setActiveRaw(next);
+  }, []);
+
+  const remove = useCallback((input: string) => {
+    const next = normalizeServerUrl(input);
+    if (!next) return;
+    setList((current) => current.filter((item) => item !== next));
+    setActiveRaw((current) => {
+      if (current !== next) return current;
+      // Read latest list after the filter above through functional updater.
+      const remaining = readStoredList().filter((item) => item !== next);
+      return remaining[0] ?? "";
+    });
+  }, []);
+
+  const value = useMemo<ServerContextValue>(
+    () => ({
+      url: active,
+      name: serverDisplayName(active),
+      list,
+      healthy,
+      setActive,
+      add,
+      remove,
+    }),
+    [active, add, healthy, list, remove, setActive],
+  );
+
+  return <ServerContext.Provider value={value}>{children}</ServerContext.Provider>;
+}
+
+export function useServer(): ServerContextValue {
+  const context = useContext(ServerContext);
+  if (!context) {
+    throw new Error("Server context is missing");
+  }
+  return context;
+}
diff --git a/apps/app/src/react-app/kernel/store.ts b/apps/app/src/react-app/kernel/store.ts
new file mode 100644
index 0000000000..b428bd5846
--- /dev/null
+++ b/apps/app/src/react-app/kernel/store.ts
@@ -0,0 +1,59 @@
+import { create } from "zustand";
+
+import type {
+  OpenworkServerCapabilities,
+  OpenworkServerDiagnostics,
+  OpenworkWorkspaceInfo,
+} from "../../app/lib/openwork-server";
+
+export type ServerState = {
+  url: string;
+  token: string;
+  status: "idle" | "connecting" | "connected" | "error";
+  error: string | null;
+  version: string | null;
+  capabilities: OpenworkServerCapabilities | null;
+  diagnostics: OpenworkServerDiagnostics | null;
+};
+
+const INITIAL_SERVER: ServerState = {
+  url: "",
+  token: "",
+  status: "idle",
+  error: null,
+  version: null,
+  capabilities: null,
+  diagnostics: null,
+};
+
+export type OpenworkStore = {
+  bootstrapping: boolean;
+  server: ServerState;
+  workspaces: OpenworkWorkspaceInfo[];
+  activeWorkspaceId: string | null;
+  selectedSessionId: string | null;
+  errorBanner: string | null;
+  setBootstrapping: (value: boolean) => void;
+  setServer: (server: ServerState) => void;
+  setWorkspaces: (workspaces: OpenworkWorkspaceInfo[]) => void;
+  setActiveWorkspaceId: (workspaceId: string | null) => void;
+  setSelectedSessionId: (sessionId: string | null) => void;
+  setErrorBanner: (message: string | null) => void;
+  clearErrorBanner: () => void;
+};
+
+export const useOpenworkStore = create<OpenworkStore>((set) => ({
+  bootstrapping: true,
+  server: INITIAL_SERVER,
+  workspaces: [],
+  activeWorkspaceId: null,
+  selectedSessionId: null,
+  errorBanner: null,
+  setBootstrapping: (value) => set({ bootstrapping: value }),
+  setServer: (server) => set({ server }),
+  setWorkspaces: (workspaces) => set({ workspaces }),
+  setActiveWorkspaceId: (workspaceId) => set({ activeWorkspaceId: workspaceId }),
+  setSelectedSessionId: (sessionId) => set({ selectedSessionId: sessionId }),
+  setErrorBanner: (message) => set({ errorBanner: message }),
+  clearErrorBanner: () => set({ errorBanner: null }),
+}));
diff --git a/apps/app/src/react-app/kernel/system-state.ts b/apps/app/src/react-app/kernel/system-state.ts
new file mode 100644
index 0000000000..eddc800dc9
--- /dev/null
+++ b/apps/app/src/react-app/kernel/system-state.ts
@@ -0,0 +1,271 @@
+import { useCallback, useMemo, useState } from "react";
+
+import type {
+  ReloadReason,
+  ReloadTrigger,
+  ResetOpenworkMode,
+} from "../../app/types";
+import { relaunchDesktopApp, resetOpenworkState } from "../../app/lib/desktop";
+import {
+  addOpencodeCacheHint,
+  isDesktopRuntime,
+  safeStringify,
+} from "../../app/utils";
+import { t } from "../../i18n";
+
+export type ReloadState = {
+  reloadPending: boolean;
+  reloadReasons: ReloadReason[];
+  reloadLastTriggeredAt: number | null;
+  reloadTrigger: ReloadTrigger | null;
+  reloadBusy: boolean;
+  reloadError: string | null;
+};
+
+export type ResetState = {
+  resetModalOpen: boolean;
+  resetModalMode: ResetOpenworkMode;
+  resetModalText: string;
+  resetModalBusy: boolean;
+};
+
+export type SystemStateControls = {
+  reload: ReloadState;
+  reloadCopy: { title: string; body: string };
+  markReloadRequired: (reason: ReloadReason, trigger?: ReloadTrigger) => void;
+  clearReloadRequired: () => void;
+  reloadWorkspaceEngine: () => Promise<void>;
+  canReloadWorkspaceEngine: boolean;
+  reset: ResetState;
+  openResetModal: (mode: ResetOpenworkMode) => void;
+  closeResetModal: () => void;
+  setResetModalText: (value: string) => void;
+  confirmReset: () => Promise<void>;
+  setError: (message: string | null) => void;
+};
+
+function clearOpenworkLocalStorage(mode: ResetOpenworkMode) {
+  if (typeof window === "undefined") return;
+  try {
+    if (mode === "all") {
+      window.localStorage.clear();
+      return;
+    }
+    const keys = Object.keys(window.localStorage);
+    for (const key of keys) {
+      if (key.includes("openwork")) window.localStorage.removeItem(key);
+    }
+    window.localStorage.removeItem("openwork_mode_pref");
+  } catch {
+    // ignore
+  }
+}
+
+type UseSystemStateOptions = {
+  hasActiveRuns: () => boolean;
+  reloadWorkspaceEngine?: () => Promise<boolean>;
+  canReloadWorkspaceEngine?: () => boolean;
+  onReloadComplete?: () => void | Promise<void>;
+  setError: (message: string | null) => void;
+};
+
+export function useSystemState(
+  options: UseSystemStateOptions,
+): SystemStateControls {
+  const [reloadPending, setReloadPending] = useState(false);
+  const [reloadReasons, setReloadReasons] = useState<ReloadReason[]>([]);
+  const [reloadLastTriggeredAt, setReloadLastTriggeredAt] = useState<
+    number | null
+  >(null);
+  const [reloadTrigger, setReloadTrigger] = useState<ReloadTrigger | null>(null);
+  const [reloadBusy, setReloadBusy] = useState(false);
+  const [reloadError, setReloadError] = useState<string | null>(null);
+
+  const [resetModalOpen, setResetModalOpen] = useState(false);
+  const [resetModalMode, setResetModalMode] =
+    useState<ResetOpenworkMode>("onboarding");
+  const [resetModalText, setResetModalText] = useState("");
+  const [resetModalBusy, setResetModalBusy] = useState(false);
+
+  const markReloadRequired = useCallback(
+    (reason: ReloadReason, trigger?: ReloadTrigger) => {
+      setReloadPending(true);
+      setReloadLastTriggeredAt(Date.now());
+      setReloadReasons((current) =>
+        current.includes(reason) ? current : [...current, reason],
+      );
+      setReloadTrigger(
+        trigger ??
+          ({
+            type:
+              reason === "plugins"
+                ? "plugin"
+                : reason === "skills"
+                  ? "skill"
+                  : reason === "agents"
+                    ? "agent"
+                    : reason === "commands"
+                      ? "command"
+                      : reason,
+          } as ReloadTrigger),
+      );
+    },
+    [],
+  );
+
+  const clearReloadRequired = useCallback(() => {
+    setReloadPending(false);
+    setReloadReasons([]);
+    setReloadTrigger(null);
+    setReloadError(null);
+  }, []);
+
+  const reloadCopy = useMemo(() => {
+    const title = t("system.reload_required");
+    const bodyKey =
+      reloadReasons.length === 1 && reloadReasons[0] === "plugins"
+        ? "system.reload_body_plugins"
+        : reloadReasons.length === 1 && reloadReasons[0] === "skills"
+          ? "system.reload_body_skills"
+          : reloadReasons.length === 1 && reloadReasons[0] === "agents"
+            ? "system.reload_body_agents"
+            : reloadReasons.length === 1 && reloadReasons[0] === "commands"
+              ? "system.reload_body_commands"
+              : reloadReasons.length === 1 && reloadReasons[0] === "config"
+                ? "system.reload_body_config"
+                : reloadReasons.length === 1 && reloadReasons[0] === "mcp"
+                  ? "system.reload_body_mcp"
+                  : reloadReasons.length > 0
+                    ? "system.reload_body_mixed"
+                    : "system.reload_body_default";
+    return { title, body: t(bodyKey) };
+  }, [reloadReasons]);
+
+  const canReloadWorkspaceEngine =
+    !reloadBusy && options.canReloadWorkspaceEngine?.() !== false;
+
+  const reloadWorkspaceEngine = useCallback(async () => {
+    if (reloadBusy) return;
+    if (options.canReloadWorkspaceEngine?.() === false) {
+      setReloadError(t("system.reload_unavailable"));
+      return;
+    }
+    setReloadBusy(true);
+    setReloadError(null);
+    options.setError(null);
+    try {
+      const ok = options.reloadWorkspaceEngine
+        ? await options.reloadWorkspaceEngine()
+        : false;
+      if (ok === false) {
+        setReloadError(t("system.reload_failed"));
+        return;
+      }
+      await options.onReloadComplete?.();
+      clearReloadRequired();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : safeStringify(error);
+      setReloadError(message || t("system.reload_failed"));
+    } finally {
+      setReloadBusy(false);
+    }
+  }, [clearReloadRequired, options, reloadBusy]);
+
+  const openResetModal = useCallback(
+    (mode: ResetOpenworkMode) => {
+      if (options.hasActiveRuns()) {
+        options.setError(t("system.stop_active_runs_before_reset"));
+        return;
+      }
+      options.setError(null);
+      setResetModalMode(mode);
+      setResetModalText("");
+      setResetModalOpen(true);
+    },
+    [options],
+  );
+
+  const closeResetModal = useCallback(() => {
+    if (resetModalBusy) return;
+    setResetModalOpen(false);
+  }, [resetModalBusy]);
+
+  const confirmReset = useCallback(async () => {
+    if (resetModalBusy) return;
+    if (options.hasActiveRuns()) {
+      options.setError(t("system.stop_active_runs_before_reset"));
+      return;
+    }
+    if (resetModalText.trim().toUpperCase() !== "RESET") return;
+
+    setResetModalBusy(true);
+    options.setError(null);
+
+    try {
+      if (isDesktopRuntime()) {
+        await resetOpenworkState(resetModalMode);
+      }
+      clearOpenworkLocalStorage(resetModalMode);
+      if (isDesktopRuntime()) {
+        await relaunchDesktopApp();
+      } else {
+        window.location.reload();
+      }
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : safeStringify(error);
+      options.setError(addOpencodeCacheHint(message));
+      setResetModalBusy(false);
+    }
+  }, [options, resetModalBusy, resetModalMode, resetModalText]);
+
+  return useMemo<SystemStateControls>(
+    () => ({
+      reload: {
+        reloadPending,
+        reloadReasons,
+        reloadLastTriggeredAt,
+        reloadTrigger,
+        reloadBusy,
+        reloadError,
+      },
+      reloadCopy,
+      markReloadRequired,
+      clearReloadRequired,
+      reloadWorkspaceEngine,
+      canReloadWorkspaceEngine,
+      reset: {
+        resetModalOpen,
+        resetModalMode,
+        resetModalText,
+        resetModalBusy,
+      },
+      openResetModal,
+      closeResetModal,
+      setResetModalText,
+      confirmReset,
+      setError: options.setError,
+    }),
+    [
+      clearReloadRequired,
+      closeResetModal,
+      confirmReset,
+      markReloadRequired,
+      openResetModal,
+      options.setError,
+      reloadCopy,
+      reloadBusy,
+      reloadWorkspaceEngine,
+      canReloadWorkspaceEngine,
+      reloadError,
+      reloadLastTriggeredAt,
+      reloadPending,
+      reloadReasons,
+      reloadTrigger,
+      resetModalBusy,
+      resetModalMode,
+      resetModalOpen,
+      resetModalText,
+    ],
+  );
+}
diff --git a/apps/app/src/react-app/shell/app-inspector.ts b/apps/app/src/react-app/shell/app-inspector.ts
new file mode 100644
index 0000000000..4acf4a6c5c
--- /dev/null
+++ b/apps/app/src/react-app/shell/app-inspector.ts
@@ -0,0 +1,128 @@
+/**
+ * Lightweight runtime-inspection surface for the React app.
+ *
+ * The goal is to give agents/humans a single readable snapshot of routing,
+ * workspaces, sessions, composer draft, boot phase, and the last
+ * refreshRouteState() call — without crawling the UI tree.
+ *
+ * Consumers read via `window.__openwork` from a devtools console or from
+ * Chrome-MCP `evaluate_script`. The surface is intentionally plain JSON so
+ * it survives postMessage-style bridges.
+ *
+ * Writers are any component that wants to publish a named slice via
+ * `publishInspectorSlice("route", () => ({...}))`. Slices expose a pull
+ * function so we never hold stale snapshots.
+ */
+export type InspectorSliceGetter = () => unknown;
+
+type InspectorAPI = {
+  version: number;
+  snapshot(): Record<string, unknown>;
+  slice(name: string): unknown;
+  listSlices(): string[];
+  /** Returns the last N records from the event log. */
+  events(limit?: number): Array<{ at: number; name: string; data: unknown }>;
+  /** Push a timestamped event for later inspection. */
+  record(name: string, data?: unknown): void;
+  /** Clear the in-memory event log. */
+  clearEvents(): void;
+};
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __openwork: InspectorAPI | undefined;
+}
+
+const INSPECTOR_VERSION = 1;
+const EVENT_BUFFER_MAX = 200;
+
+type Registry = {
+  slices: Map<string, InspectorSliceGetter>;
+  events: Array<{ at: number; name: string; data: unknown }>;
+  installed: boolean;
+};
+
+const registry: Registry = {
+  slices: new Map(),
+  events: [],
+  installed: false,
+};
+
+function safeCall(getter: InspectorSliceGetter): unknown {
+  try {
+    return getter();
+  } catch (error) {
+    return {
+      __inspectorError:
+        error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function buildSnapshot(): Record<string, unknown> {
+  const snapshot: Record<string, unknown> = {};
+  for (const [name, getter] of registry.slices) {
+    snapshot[name] = safeCall(getter);
+  }
+  snapshot.__events = registry.events.slice(-20);
+  return snapshot;
+}
+
+function installIfNeeded() {
+  if (registry.installed) return;
+  if (typeof window === "undefined") return;
+
+  const api: InspectorAPI = {
+    version: INSPECTOR_VERSION,
+    snapshot: buildSnapshot,
+    slice(name) {
+      const getter = registry.slices.get(name);
+      return getter ? safeCall(getter) : undefined;
+    },
+    listSlices() {
+      return Array.from(registry.slices.keys()).sort();
+    },
+    events(limit) {
+      const requested = typeof limit === "number" && limit > 0 ? limit : 50;
+      return registry.events.slice(-requested);
+    },
+    record(name, data) {
+      registry.events.push({ at: Date.now(), name, data: data ?? null });
+      if (registry.events.length > EVENT_BUFFER_MAX) {
+        registry.events.splice(0, registry.events.length - EVENT_BUFFER_MAX);
+      }
+    },
+    clearEvents() {
+      registry.events = [];
+    },
+  };
+
+  Object.defineProperty(window, "__openwork", {
+    value: api,
+    configurable: true,
+    writable: false,
+  });
+
+  registry.installed = true;
+}
+
+export function publishInspectorSlice(
+  name: string,
+  getter: InspectorSliceGetter,
+): () => void {
+  installIfNeeded();
+  registry.slices.set(name, getter);
+  return () => {
+    const current = registry.slices.get(name);
+    if (current === getter) registry.slices.delete(name);
+  };
+}
+
+export function recordInspectorEvent(name: string, data?: unknown) {
+  installIfNeeded();
+  window.__openwork?.record(name, data);
+}
+
+export function ensureInspectorInstalled() {
+  installIfNeeded();
+}
diff --git a/apps/app/src/react-app/shell/app-root.tsx b/apps/app/src/react-app/shell/app-root.tsx
new file mode 100644
index 0000000000..b831de9cb5
--- /dev/null
+++ b/apps/app/src/react-app/shell/app-root.tsx
@@ -0,0 +1,162 @@
+/** @jsxImportSource react */
+
+import { useEffect, useState, type ReactNode } from "react";
+import { Navigate, Route, Routes, useLocation, useNavigate } from "react-router-dom";
+
+import { readDenBootstrapConfig } from "../../app/lib/den";
+import { denSettingsChangedEvent } from "../../app/lib/den-session-events";
+import { useDenAuth } from "../domains/cloud/den-auth-provider";
+import { ForcedSigninPage } from "../domains/cloud/forced-signin-page";
+import { useDesktopFontZoomBehavior } from "./font-zoom";
+import { LoadingOverlay } from "./loading-overlay";
+import { DevProfiler, DevProfilerOverlay } from "./dev-profiler";
+import { ReactRenderWatchdogOverlay } from "./react-render-watchdog-overlay";
+import { OpenworkControlProvider, OpenworkRouteControlActions } from "./control/control-provider";
+import { SessionRoute } from "./session-route";
+import { SettingsRoute } from "./settings-route";
+import { WelcomeRoute } from "./welcome-route";
+
+type DenSigninGateProps = {
+  children: ReactNode;
+};
+
+/**
+ * Forced-signin gate ported from the Solid shell.
+ *
+ * When the desktop bootstrap config has `requireSignin: true` (persisted by
+ * the Tauri shell via `desktop-bootstrap.json`), the UI is held at `/signin`
+ * until the user authenticates with Den. When sign-in is NOT required, we
+ * never let users land on `/signin` — redirect them to `/session` instead.
+ *
+ * While we're still checking the Den session AND sign-in is required, we
+ * render nothing so the transcript/settings never flash behind the gate.
+ */
+function DenSigninGate({ children }: DenSigninGateProps) {
+  const denAuth = useDenAuth();
+  const location = useLocation();
+  const navigate = useNavigate();
+  // The bootstrap file is read synchronously; re-read on settings-changed so a
+  // developer-mode override flips the gate live without a reload.
+  const [requireSignin, setRequireSignin] = useState(
+    () => readDenBootstrapConfig().requireSignin,
+  );
+
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+
+    const handler = () => {
+      setRequireSignin(readDenBootstrapConfig().requireSignin);
+    };
+
+    window.addEventListener(denSettingsChangedEvent, handler);
+    return () => {
+      window.removeEventListener(denSettingsChangedEvent, handler);
+    };
+  }, []);
+
+  useEffect(() => {
+    // Wait for the first auth check so we don't bounce the user between
+    // `/session` and `/signin` every navigation while we figure out if
+    // their cached token is still valid.
+    if (denAuth.status === "checking") return;
+
+    const path = location.pathname.toLowerCase();
+    const onSignin = path === "/signin" || path.startsWith("/signin/");
+
+    if (requireSignin) {
+      if (!denAuth.isSignedIn && !onSignin) {
+        navigate("/signin", { replace: true });
+      } else if (denAuth.isSignedIn && onSignin) {
+        navigate("/session", { replace: true });
+      }
+    } else if (onSignin) {
+      navigate("/session", { replace: true });
+    }
+  }, [
+    denAuth.isSignedIn,
+    denAuth.status,
+    location.pathname,
+    navigate,
+    requireSignin,
+  ]);
+
+  if (requireSignin && denAuth.status === "checking") {
+    return <ForcedSigninPage developerMode={false} />;
+  }
+
+  return <>{children}</>;
+}
+
+export function AppRoot() {
+  useDesktopFontZoomBehavior();
+
+  return (
+    <>
+      <DevProfiler id="AppRoot">
+        <OpenworkControlProvider>
+          <OpenworkRouteControlActions />
+          <DenSigninGate>
+            <Routes>
+              <Route
+                path="/signin"
+                element={
+                  <DevProfiler id="SigninRoute">
+                    <ForcedSigninPage developerMode={false} />
+                  </DevProfiler>
+                }
+              />
+              <Route
+                path="/welcome"
+                element={
+                  <DevProfiler id="WelcomeRoute">
+                    <WelcomeRoute />
+                  </DevProfiler>
+                }
+              />
+              <Route
+                path="/session"
+                element={
+                  <DevProfiler id="SessionRoute">
+                    <SessionRoute />
+                  </DevProfiler>
+                }
+              />
+              <Route
+                path="/session/:sessionId"
+                element={
+                  <DevProfiler id="SessionRoute">
+                    <SessionRoute />
+                  </DevProfiler>
+                }
+              />
+              <Route
+                path="/settings/*"
+                element={
+                  <DevProfiler id="SettingsRoute">
+                    <SettingsRoute />
+                  </DevProfiler>
+                }
+              />
+              {/* Default + fallback: land on the session view. Users open
+                  settings deliberately via the sidebar or command palette. */}
+              <Route path="/" element={<Navigate to="/session" replace />} />
+              <Route path="*" element={<Navigate to="/session" replace />} />
+            </Routes>
+          </DenSigninGate>
+        </OpenworkControlProvider>
+        <LoadingOverlay />
+      </DevProfiler>
+      {/*
+        DevProfilerOverlay sits OUTSIDE the AppRoot <Profiler> zone on
+        purpose. The overlay re-renders on every emit() to refresh its
+        table, and any commit inside a <Profiler> is recorded as a
+        commit on that zone. Mounting the overlay inside AppRoot would
+        inflate AppRoot's commit count by hundreds of overlay
+        self-renders for every real user-visible commit, masking the
+        true app-level signal.
+      */}
+      <DevProfilerOverlay />
+      <ReactRenderWatchdogOverlay />
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/shell/boot-state.tsx b/apps/app/src/react-app/shell/boot-state.tsx
new file mode 100644
index 0000000000..536c74f784
--- /dev/null
+++ b/apps/app/src/react-app/shell/boot-state.tsx
@@ -0,0 +1,151 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+export type BootPhaseId =
+  | "idle"
+  | "bootstrapping-workspaces"
+  | "starting-openwork-server"
+  | "starting-engine"
+  | "activating-workspace"
+  | "ready"
+  | "error";
+
+export type BootStateSnapshot = {
+  phase: BootPhaseId;
+  message: string;
+  detail: string | null;
+  startedAt: number | null;
+  completedAt: number | null;
+  error: string | null;
+};
+
+type BootStateContextValue = BootStateSnapshot & {
+  routeReady: boolean;
+  setPhase: (phase: BootPhaseId, detail?: string | null) => void;
+  setError: (message: string | null) => void;
+  markReady: () => void;
+  markRouteReady: () => void;
+};
+
+const DEFAULT_STATE: BootStateSnapshot = {
+  phase: "idle",
+  message: "",
+  detail: null,
+  startedAt: null,
+  completedAt: null,
+  error: null,
+};
+
+const PHASE_MESSAGES: Record<BootPhaseId, string> = {
+  idle: "",
+  "bootstrapping-workspaces": "Loading your workspaces",
+  "starting-openwork-server": "Starting the OpenWork server",
+  "starting-engine": "Preparing workspace",
+  "activating-workspace": "Activating your workspace",
+  ready: "Ready",
+  error: "Something went wrong",
+};
+
+const BootStateContext = createContext<BootStateContextValue | null>(null);
+
+export function BootStateProvider({ children }: { children: ReactNode }) {
+  const [snapshot, setSnapshot] = useState<BootStateSnapshot>(DEFAULT_STATE);
+  // Once the main route has finished its first successful refresh (workspaces
+  // + sessions fetched), we consider the app "interactive". This is a one-way
+  // latch so subsequent background refreshes never re-show the overlay.
+  const [routeReady, setRouteReady] = useState(false);
+  const startedAtRef = useRef<number | null>(null);
+
+  const setPhase = useCallback((phase: BootPhaseId, detail?: string | null) => {
+    setSnapshot((current) => {
+      const nextStartedAt =
+        current.phase === "idle" && phase !== "idle"
+          ? (startedAtRef.current = Date.now())
+          : (startedAtRef.current ?? current.startedAt);
+      return {
+        ...current,
+        phase,
+        message: PHASE_MESSAGES[phase] ?? current.message,
+        detail: detail ?? null,
+        startedAt: nextStartedAt,
+        completedAt: phase === "ready" ? Date.now() : null,
+        error: phase === "error" ? current.error : null,
+      };
+    });
+  }, []);
+
+  const setError = useCallback((message: string | null) => {
+    setSnapshot((current) => ({
+      ...current,
+      error: message,
+      phase: message ? "error" : current.phase,
+      message: message ? PHASE_MESSAGES.error : current.message,
+    }));
+  }, []);
+
+  const markReady = useCallback(() => {
+    setSnapshot((current) => ({
+      ...current,
+      phase: "ready",
+      message: PHASE_MESSAGES.ready,
+      detail: null,
+      completedAt: Date.now(),
+      error: null,
+    }));
+  }, []);
+
+  const markRouteReady = useCallback(() => {
+    setRouteReady(true);
+  }, []);
+
+  const value = useMemo<BootStateContextValue>(
+    () => ({ ...snapshot, routeReady, setPhase, setError, markReady, markRouteReady }),
+    [markReady, markRouteReady, routeReady, setError, setPhase, snapshot],
+  );
+
+  return <BootStateContext.Provider value={value}>{children}</BootStateContext.Provider>;
+}
+
+export function useBootState(): BootStateContextValue {
+  const value = useContext(BootStateContext);
+  if (!value) {
+    throw new Error("useBootState must be used inside <BootStateProvider>");
+  }
+  return value;
+}
+
+/**
+ * Overlay stays up until BOTH the desktop boot hook has reported `ready` AND
+ * the main route has completed its first refresh (`routeReady`). After that
+ * we hold for ~160ms so the fade feels intentional instead of a flicker.
+ */
+export function useBootOverlayVisible(): boolean {
+  const { phase, routeReady } = useBootState();
+  // HMR can remount the provider while the route tree stays mounted. In that
+  // state the boot phase falls back to `idle`, but the already-rendered route
+  // is interactive and can mark itself ready again. Treat `idle + routeReady`
+  // the same as `ready + routeReady` so the full-screen boot overlay never
+  // becomes a permanent pointer-events blocker during development.
+  const canHide = routeReady && (phase === "ready" || phase === "idle");
+  const [visible, setVisible] = useState(!canHide);
+
+  useEffect(() => {
+    if (canHide) {
+      const handle = window.setTimeout(() => setVisible(false), 160);
+      return () => window.clearTimeout(handle);
+    }
+    setVisible(true);
+    return undefined;
+  }, [canHide]);
+
+  return visible;
+}
diff --git a/apps/app/src/react-app/shell/command-palette.tsx b/apps/app/src/react-app/shell/command-palette.tsx
new file mode 100644
index 0000000000..2406277a78
--- /dev/null
+++ b/apps/app/src/react-app/shell/command-palette.tsx
@@ -0,0 +1,378 @@
+/** @jsxImportSource react */
+import {
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type KeyboardEvent as ReactKeyboardEvent,
+} from "react";
+import { Search, X } from "lucide-react";
+
+import { t } from "../../i18n";
+
+export type PaletteItem = {
+  id: string;
+  title: string;
+  detail?: string;
+  meta?: string;
+  action: () => void;
+};
+
+type PaletteMode = "root" | "sessions";
+
+export type SessionOption = {
+  workspaceId: string;
+  sessionId: string;
+  title: string;
+  workspaceTitle: string;
+  updatedAt: number;
+  searchText: string;
+  isActive: boolean;
+};
+
+export type CommandPaletteProps = {
+  open: boolean;
+  onClose: () => void;
+  /** Called when a session row is chosen. */
+  onOpenSession: (workspaceId: string, sessionId: string) => void;
+  /** Called when "New session" is chosen. */
+  onCreateNewSession: () => void;
+  /** Called when "Open settings" is chosen. Accepts an optional route to jump straight to a tab. */
+  onOpenSettings: (route?: string) => void;
+  /** Optional — open a URL in the user's browser. Falls back to window.open. */
+  onOpenUrl?: (url: string) => void;
+  /** Optional: sessions for the second mode. */
+  sessions: SessionOption[];
+};
+
+/**
+ * React command palette (Cmd/Ctrl+K).
+ *
+ * - Root mode: "New session", "Open settings", and a link into the Sessions submode.
+ * - Sessions submode: fuzzy list of every session across workspaces.
+ */
+export function CommandPalette(props: CommandPaletteProps) {
+  const [mode, setMode] = useState<PaletteMode>("root");
+  const [query, setQuery] = useState("");
+  const [activeIndex, setActiveIndex] = useState(0);
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const optionRefs = useRef<Array<HTMLButtonElement | null>>([]);
+
+  useEffect(() => {
+    if (!props.open) {
+      setMode("root");
+      setQuery("");
+      setActiveIndex(0);
+      return;
+    }
+    const id = window.setTimeout(() => {
+      inputRef.current?.focus();
+    }, 10);
+    return () => window.clearTimeout(id);
+  }, [props.open]);
+
+  const openUrl = (url: string) => {
+    if (props.onOpenUrl) {
+      props.onOpenUrl(url);
+    } else if (typeof window !== "undefined") {
+      window.open(url, "_blank", "noopener");
+    }
+  };
+
+  const rootItems = useMemo<PaletteItem[]>(() => {
+    const items: PaletteItem[] = [
+      {
+        id: "new-session",
+        title: t("session.cmd_new_session_title"),
+        detail: t("session.cmd_new_session_detail"),
+        meta: t("session.cmd_new_session_meta"),
+        action: () => {
+          props.onClose();
+          props.onCreateNewSession();
+        },
+      },
+      {
+        id: "sessions",
+        title: t("session.cmd_sessions_title"),
+        detail: t("session.cmd_sessions_detail", undefined, {
+          count: props.sessions.length.toLocaleString(),
+        }),
+        meta: t("session.cmd_sessions_meta"),
+        action: () => {
+          setMode("sessions");
+          setQuery("");
+          setActiveIndex(0);
+          window.setTimeout(() => inputRef.current?.focus(), 0);
+        },
+      },
+      {
+        id: "open-settings",
+        title: t("settings.tab_general"),
+        detail: t("settings.tab_description_general"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings();
+        },
+      },
+      // Top-bar shortcuts — these used to be selectable via Cmd+K and were
+      // missing after the React port. Each one mirrors one of the icons at
+      // the bottom-right of the session surface (documentation / feedback)
+      // plus every settings tab the user is likely to reach for.
+      {
+        id: "open-docs",
+        title: t("session.support_docs"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          openUrl("https://openwork.dev/docs");
+        },
+      },
+      {
+        id: "open-feedback",
+        title: t("session.support_feedback"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          openUrl("https://openwork.dev/feedback");
+        },
+      },
+      {
+        id: "settings-skills",
+        title: t("settings.tab_skills"),
+        detail: t("settings.tab_description_skills"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings("/settings/skills");
+        },
+      },
+      {
+        id: "settings-extensions",
+        title: t("settings.tab_extensions"),
+        detail: t("settings.tab_description_extensions"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings("/settings/extensions");
+        },
+      },
+      {
+        id: "settings-appearance",
+        title: t("settings.tab_appearance"),
+        detail: t("settings.tab_description_appearance"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings("/settings/appearance");
+        },
+      },
+      {
+        id: "settings-recovery",
+        title: t("settings.tab_recovery"),
+        detail: t("settings.tab_description_recovery"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings("/settings/recovery");
+        },
+      },
+      {
+        id: "settings-updates",
+        title: t("settings.tab_updates"),
+        detail: t("settings.tab_description_updates"),
+        meta: t("session.cmd_settings_meta"),
+        action: () => {
+          props.onClose();
+          props.onOpenSettings("/settings/updates");
+        },
+      },
+    ];
+    const q = query.trim().toLowerCase();
+    if (!q) return items;
+    return items.filter((item) =>
+      `${item.title} ${item.detail ?? ""}`.toLowerCase().includes(q),
+    );
+  }, [props, query]);
+
+  const sessionItems = useMemo<PaletteItem[]>(() => {
+    const q = query.trim().toLowerCase();
+    const candidates = q
+      ? props.sessions.filter((item) => item.searchText.includes(q))
+      : props.sessions;
+    return candidates.slice(0, 80).map((item) => ({
+      id: `session:${item.workspaceId}:${item.sessionId}`,
+      title: item.title,
+      detail: item.workspaceTitle,
+      meta: item.isActive
+        ? t("session.cmd_current_workspace")
+        : t("session.cmd_switch"),
+      action: () => {
+        props.onClose();
+        props.onOpenSession(item.workspaceId, item.sessionId);
+      },
+    }));
+  }, [props, query]);
+
+  const items = mode === "sessions" ? sessionItems : rootItems;
+
+  useEffect(() => {
+    if (activeIndex >= items.length) setActiveIndex(0);
+  }, [activeIndex, items.length]);
+
+  useEffect(() => {
+    if (!props.open) return;
+    const target = optionRefs.current[activeIndex];
+    target?.scrollIntoView({ block: "nearest" });
+  }, [activeIndex, items.length, props.open]);
+
+  const handleKey = (event: ReactKeyboardEvent<HTMLElement>) => {
+    if (event.key === "Escape") {
+      event.preventDefault();
+      if (mode !== "root") {
+        setMode("root");
+        setQuery("");
+        setActiveIndex(0);
+        window.setTimeout(() => inputRef.current?.focus(), 0);
+        return;
+      }
+      props.onClose();
+      return;
+    }
+    if (event.key === "ArrowDown") {
+      event.preventDefault();
+      if (items.length === 0) return;
+      setActiveIndex((current) => (current + 1) % items.length);
+      return;
+    }
+    if (event.key === "ArrowUp") {
+      event.preventDefault();
+      if (items.length === 0) return;
+      setActiveIndex((current) => (current - 1 + items.length) % items.length);
+      return;
+    }
+    if (event.key === "Enter") {
+      event.preventDefault();
+      const item = items[activeIndex];
+      if (item) item.action();
+      return;
+    }
+    if (event.key === "Backspace" && !query && mode !== "root") {
+      event.preventDefault();
+      setMode("root");
+      setActiveIndex(0);
+    }
+  };
+
+  if (!props.open) return null;
+
+  const placeholder =
+    mode === "sessions"
+      ? t("session.palette_placeholder_sessions")
+      : t("session.palette_placeholder_actions");
+
+  const title =
+    mode === "sessions"
+      ? t("session.palette_title_sessions")
+      : t("session.palette_title_actions");
+
+  return (
+    <div
+      className="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-start justify-center p-4 overflow-y-auto"
+      onClick={props.onClose}
+      onKeyDown={handleKey}
+    >
+      <div
+        className="w-full max-w-2xl mt-12 rounded-2xl border border-dls-border bg-dls-surface shadow-2xl overflow-hidden"
+        onClick={(event) => event.stopPropagation()}
+      >
+        <div className="border-b border-dls-border px-4 py-3 space-y-2">
+          <div className="flex items-center gap-2">
+            {mode !== "root" ? (
+              <button
+                type="button"
+                className="h-8 px-2 rounded-md text-xs text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors"
+                onClick={() => {
+                  setMode("root");
+                  setQuery("");
+                  setActiveIndex(0);
+                  window.setTimeout(() => inputRef.current?.focus(), 0);
+                }}
+              >
+                {t("common.back")}
+              </button>
+            ) : null}
+            <Search size={14} className="text-dls-secondary shrink-0" />
+            <input
+              ref={inputRef}
+              type="text"
+              value={query}
+              onChange={(event) => {
+                setQuery(event.currentTarget.value);
+                setActiveIndex(0);
+              }}
+              placeholder={placeholder}
+              className="min-w-0 flex-1 bg-transparent text-sm text-dls-text placeholder:text-dls-secondary focus:outline-none"
+              aria-label={title}
+            />
+            <button
+              type="button"
+              className="h-8 w-8 rounded-md text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors flex items-center justify-center"
+              onClick={props.onClose}
+              aria-label={t("common.close")}
+            >
+              <X size={14} />
+            </button>
+          </div>
+        </div>
+        <div className="max-h-[60vh] overflow-y-auto py-2">
+          {items.length === 0 ? (
+            <div className="px-4 py-6 text-sm text-dls-secondary text-center">
+              {t("session.palette_no_matches")}
+            </div>
+          ) : (
+            <ul>
+              {items.map((item, index) => (
+                <li key={item.id}>
+                  <button
+                    ref={(element) => {
+                      optionRefs.current[index] = element;
+                    }}
+                    type="button"
+                    className={`w-full px-4 py-2.5 flex items-start gap-3 text-left transition-colors ${
+                      index === activeIndex
+                        ? "bg-dls-hover"
+                        : "hover:bg-dls-hover/60"
+                    }`}
+                    onMouseEnter={() => setActiveIndex(index)}
+                    onClick={() => item.action()}
+                  >
+                    <div className="flex-1 min-w-0">
+                      <div className="text-sm font-medium text-dls-text truncate">
+                        {item.title}
+                      </div>
+                      {item.detail ? (
+                        <div className="text-xs text-dls-secondary truncate">
+                          {item.detail}
+                        </div>
+                      ) : null}
+                    </div>
+                    {item.meta ? (
+                      <div className="text-[10px] uppercase tracking-wide text-dls-secondary shrink-0">
+                        {item.meta}
+                      </div>
+                    ) : null}
+                  </button>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+        <div className="border-t border-dls-border px-4 py-2 text-[11px] text-dls-secondary flex items-center gap-3">
+          <span>{t("session.palette_hint_navigate")}</span>
+          <span>{t("session.palette_hint_run")}</span>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/control/control-provider.tsx b/apps/app/src/react-app/shell/control/control-provider.tsx
new file mode 100644
index 0000000000..eb89393e1a
--- /dev/null
+++ b/apps/app/src/react-app/shell/control/control-provider.tsx
@@ -0,0 +1,454 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import { useLocation, useNavigate } from "react-router-dom";
+
+export type OpenworkControlSideEffect = "none" | "navigation" | "mutation" | "external";
+
+export type OpenworkControlActionArg = {
+  name: string;
+  type?: "string" | "number" | "boolean" | "object" | "array" | "unknown";
+  required?: boolean;
+  description?: string;
+};
+
+export type OpenworkControlActionMetadata = {
+  id: string;
+  label: string;
+  description?: string;
+  sideEffect: OpenworkControlSideEffect;
+  requiresConfirmation: boolean;
+  requiresArgs: boolean;
+  hasPreviewArgs: boolean;
+  previewArgs?: unknown;
+  args?: OpenworkControlActionArg[];
+  disabled: boolean;
+  busy: boolean;
+};
+
+export type OpenworkControlSnapshot = {
+  version: number;
+  enabled: boolean;
+  route: string;
+  status: "off" | "ready" | "acting";
+  busyActionId: string | null;
+  narration: string;
+  actions: OpenworkControlActionMetadata[];
+};
+
+export type OpenworkControlResult =
+  | { ok: true; actionId: string; result?: unknown }
+  | { ok: false; actionId: string; error: string };
+
+export type OpenworkControlHelpers = {
+  setNarration: (text: string) => void;
+};
+
+export type OpenworkControlTargetRef = {
+  readonly current: HTMLElement | null;
+};
+
+export type OpenworkControlAction = {
+  id: string;
+  label: string;
+  description?: string;
+  sideEffect?: OpenworkControlSideEffect;
+  requiresConfirmation?: boolean;
+  requiresArgs?: boolean;
+  args?: OpenworkControlActionArg[];
+  previewArgs?: unknown;
+  disabled?: boolean;
+  targetRef?: OpenworkControlTargetRef;
+  execute: (args: unknown, helpers: OpenworkControlHelpers) => unknown | Promise<unknown>;
+};
+
+type ControlActionRef = {
+  readonly current: OpenworkControlAction | null;
+};
+
+type RegisteredAction = {
+  id: string;
+  order: number;
+  token: symbol;
+  ref: ControlActionRef;
+};
+
+type SpotlightState = {
+  visible: boolean;
+  phase: "target" | "press";
+  rect: { x: number; y: number; width: number; height: number } | null;
+};
+
+type OpenworkControlContextValue = {
+  enabled: boolean;
+  setEnabled: (enabled: boolean) => void;
+  route: string;
+  narration: string;
+  busyActionId: string | null;
+  actions: OpenworkControlActionMetadata[];
+  registerAction: (actionId: string, actionRef: ControlActionRef) => () => void;
+  executeAction: (actionId: string, args?: unknown) => Promise<OpenworkControlResult>;
+  snapshot: () => OpenworkControlSnapshot;
+};
+
+type OpenworkControlAPI = {
+  version: number;
+  snapshot: () => OpenworkControlSnapshot;
+  listActions: () => OpenworkControlActionMetadata[];
+  execute: (actionId: string, args?: unknown) => Promise<OpenworkControlResult>;
+  setEnabled: (enabled: boolean) => void;
+  subscribe: (listener: (snapshot: OpenworkControlSnapshot) => void) => () => void;
+};
+
+declare global {
+  interface Window {
+    __openworkControl?: OpenworkControlAPI;
+  }
+}
+
+const CONTROL_API_VERSION = 1;
+const OpenworkControlContext = createContext<OpenworkControlContextValue | null>(null);
+const SPOTLIGHT_TIMING_MS = Object.freeze({
+  missingTarget: 80,
+  scrollIntoView: 180,
+  target: 260,
+  press: 130,
+  release: 80,
+  done: 280,
+});
+
+const wait = (ms: number) => new Promise((resolve) => window.setTimeout(resolve, ms));
+
+function describeError(error: unknown) {
+  return error instanceof Error ? error.message : String(error || "Unknown error");
+}
+
+function returnedActionError(result: unknown) {
+  if (!result || typeof result !== "object") return null;
+  const payload = result as { ok?: unknown; error?: unknown };
+  if (payload.ok !== false) return null;
+  return typeof payload.error === "string" && payload.error.trim()
+    ? payload.error
+    : "Action returned an error.";
+}
+
+function isBrowser() {
+  return typeof window !== "undefined" && typeof document !== "undefined";
+}
+
+function metadataForAction(registered: RegisteredAction, busyActionId: string | null): OpenworkControlActionMetadata {
+  const action = registered.ref.current;
+  return {
+    id: registered.id,
+    label: action?.label ?? registered.id,
+    description: action?.description,
+    sideEffect: action?.sideEffect ?? "none",
+    requiresConfirmation: action?.requiresConfirmation === true,
+    requiresArgs: action?.requiresArgs === true,
+    hasPreviewArgs: action?.previewArgs !== undefined,
+    previewArgs: action?.previewArgs,
+    args: action?.args,
+    disabled: action?.disabled === true,
+    busy: busyActionId === registered.id,
+  };
+}
+
+function ControlModeSpotlight({ spotlight }: { spotlight: SpotlightState }) {
+  const rect = spotlight.rect;
+  if (!spotlight.visible || !rect) return null;
+
+  const pad = spotlight.phase === "press" ? 8 : 12;
+  return (
+    <div
+      className="pointer-events-none fixed z-[9998] rounded-[18px] bg-[rgba(var(--dls-accent-rgb),0.1)] shadow-[0_0_0_9999px_rgba(7,10,18,0.08),0_0_36px_rgba(var(--dls-accent-rgb),0.32),inset_0_0_0_1px_rgba(var(--dls-accent-rgb),0.24)] transition-all duration-200 ease-out"
+      style={{
+        left: `${rect.x - pad}px`,
+        top: `${rect.y - pad}px`,
+        width: `${rect.width + pad * 2}px`,
+        height: `${rect.height + pad * 2}px`,
+        transform: spotlight.phase === "press" ? "scale(0.985)" : "scale(1)",
+      }}
+    />
+  );
+}
+
+export function OpenworkControlProvider({ children }: { children: ReactNode }) {
+  const location = useLocation();
+  const actionsRef = useRef(new Map<string, RegisteredAction>());
+  const listenersRef = useRef(new Set<(snapshot: OpenworkControlSnapshot) => void>());
+  const nextOrderRef = useRef(1);
+  const [version, setVersion] = useState(0);
+  const [enabledState, setEnabledState] = useState(false);
+  const [busyActionId, setBusyActionId] = useState<string | null>(null);
+  const [narration, setNarration] = useState("Control mode is off.");
+  const [spotlight, setSpotlight] = useState<SpotlightState>({ visible: false, phase: "target", rect: null });
+  const busyActionIdRef = useRef<string | null>(null);
+  const spotlightRunRef = useRef(0);
+
+  const route = `${location.pathname}${location.search}${location.hash}`;
+  const enabled = enabledState;
+  const status: OpenworkControlSnapshot["status"] = !enabled ? "off" : busyActionId ? "acting" : "ready";
+
+  const setEnabled = useCallback((nextEnabled: boolean) => {
+    setEnabledState(nextEnabled);
+  }, []);
+
+  const listActionMetadata = useCallback((nextBusyActionId = busyActionId) => {
+    return Array.from(actionsRef.current.values())
+      .sort((left, right) => left.order - right.order)
+      .map((action) => metadataForAction(action, nextBusyActionId));
+  }, [busyActionId, version]);
+
+  const actions = useMemo(() => {
+    return listActionMetadata();
+  }, [listActionMetadata]);
+
+  const snapshot = useCallback((): OpenworkControlSnapshot => ({
+    version: CONTROL_API_VERSION,
+    enabled,
+    route,
+    status,
+    busyActionId,
+    narration,
+    actions: listActionMetadata(),
+  }), [busyActionId, enabled, listActionMetadata, narration, route, status]);
+
+  const registerAction = useCallback((actionId: string, actionRef: ControlActionRef) => {
+    const token = Symbol(actionId);
+    const previous = actionsRef.current.get(actionId);
+    actionsRef.current.set(actionId, {
+      id: actionId,
+      order: previous?.order ?? nextOrderRef.current++,
+      token,
+      ref: actionRef,
+    });
+    setVersion((current) => current + 1);
+
+    return () => {
+      const current = actionsRef.current.get(actionId);
+      if (current?.token === token) {
+        actionsRef.current.delete(actionId);
+        setVersion((value) => value + 1);
+      }
+    };
+  }, []);
+
+  const playTargetChoreography = useCallback(async (action: OpenworkControlAction, runId: number) => {
+    if (!isBrowser()) return;
+    const stillCurrent = () => spotlightRunRef.current === runId;
+    const target = action.targetRef?.current;
+    if (!target) {
+      await wait(SPOTLIGHT_TIMING_MS.missingTarget);
+      return;
+    }
+
+    target.scrollIntoView({ block: "center", inline: "nearest", behavior: "smooth" });
+    await wait(SPOTLIGHT_TIMING_MS.scrollIntoView);
+    if (!stillCurrent() || !target.isConnected) return;
+    const rect = target.getBoundingClientRect();
+    setSpotlight({
+      visible: true,
+      phase: "target",
+      rect: {
+        x: rect.left,
+        y: rect.top,
+        width: rect.width,
+        height: rect.height,
+      },
+    });
+    await wait(SPOTLIGHT_TIMING_MS.target);
+    if (!stillCurrent()) return;
+    setSpotlight((current) => ({ ...current, phase: "press" }));
+    await wait(SPOTLIGHT_TIMING_MS.press);
+    if (!stillCurrent()) return;
+    setSpotlight((current) => ({ ...current, phase: "target" }));
+    await wait(SPOTLIGHT_TIMING_MS.release);
+  }, []);
+
+  const executeAction = useCallback(async (actionId: string, args?: unknown): Promise<OpenworkControlResult> => {
+    const registered = actionsRef.current.get(actionId);
+    const action = registered?.ref.current;
+    if (!registered || !action) return { ok: false, actionId, error: `Unknown action: ${actionId}` };
+    if (action.disabled) return { ok: false, actionId, error: `Action is disabled: ${action.label}` };
+    if (busyActionIdRef.current) return { ok: false, actionId, error: `Already acting: ${busyActionIdRef.current}` };
+
+    if (action.requiresConfirmation && isBrowser()) {
+      const confirmed = window.confirm(`Allow Control Mode to ${action.label}?`);
+      if (!confirmed) return { ok: false, actionId, error: "User cancelled action." };
+    }
+
+    const runId = spotlightRunRef.current + 1;
+    spotlightRunRef.current = runId;
+    busyActionIdRef.current = action.id;
+    setEnabled(true);
+    setBusyActionId(action.id);
+    setNarration(`Moving to ${action.label}…`);
+
+    try {
+      await playTargetChoreography(action, runId);
+      setNarration(`Running ${action.label}…`);
+      const effectiveArgs = args === undefined ? action.previewArgs : args;
+      const result = await action.execute(effectiveArgs, { setNarration });
+      const resultError = returnedActionError(result);
+      if (resultError) {
+        setNarration(`Could not ${action.label}: ${resultError}`);
+        if (spotlightRunRef.current === runId) {
+          setSpotlight({ visible: false, phase: "target", rect: null });
+        }
+        return { ok: false, actionId, error: resultError };
+      }
+      setNarration(`Done: ${action.label}`);
+      await wait(SPOTLIGHT_TIMING_MS.done);
+      if (spotlightRunRef.current === runId) {
+        setSpotlight({ visible: false, phase: "target", rect: null });
+      }
+      return { ok: true, actionId, result };
+    } catch (error) {
+      const message = describeError(error);
+      setNarration(`Could not ${action.label}: ${message}`);
+      if (spotlightRunRef.current === runId) {
+        setSpotlight({ visible: false, phase: "target", rect: null });
+      }
+      return { ok: false, actionId, error: message };
+    } finally {
+      if (busyActionIdRef.current === action.id) busyActionIdRef.current = null;
+      setBusyActionId(null);
+    }
+  }, [playTargetChoreography, setEnabled]);
+
+  const value = useMemo<OpenworkControlContextValue>(() => ({
+    enabled,
+    setEnabled,
+    route,
+    narration,
+    busyActionId,
+    actions,
+    registerAction,
+    executeAction,
+    snapshot,
+  }), [actions, busyActionId, enabled, executeAction, narration, registerAction, route, setEnabled, snapshot]);
+
+  useEffect(() => {
+    if (!enabled) {
+      setNarration("Control mode is off.");
+    } else if (narration === "Control mode is off.") {
+      setNarration("Ready. A controller can inspect and run visible actions.");
+    }
+  }, [enabled, narration]);
+
+  useEffect(() => {
+    if (!isBrowser()) return;
+
+    const api: OpenworkControlAPI = {
+      version: CONTROL_API_VERSION,
+      snapshot,
+      listActions: () => snapshot().actions,
+      execute: executeAction,
+      setEnabled,
+      subscribe(listener) {
+        listenersRef.current.add(listener);
+        listener(snapshot());
+        return () => {
+          listenersRef.current.delete(listener);
+        };
+      },
+    };
+
+    window.__openworkControl = api;
+    return () => {
+      if (window.__openworkControl === api) {
+        delete window.__openworkControl;
+      }
+    };
+  }, [executeAction, setEnabled, snapshot]);
+
+  useEffect(() => {
+    busyActionIdRef.current = busyActionId;
+  }, [busyActionId]);
+
+  useEffect(() => {
+    const next = snapshot();
+    listenersRef.current.forEach((listener) => listener(next));
+  }, [snapshot, version]);
+
+  return (
+    <OpenworkControlContext.Provider value={value}>
+      {children}
+      <ControlModeSpotlight spotlight={spotlight} />
+    </OpenworkControlContext.Provider>
+  );
+}
+
+export function useOpenworkControl() {
+  return useContext(OpenworkControlContext);
+}
+
+export function useControlAction(action: OpenworkControlAction | null | false | undefined) {
+  const control = useOpenworkControl();
+  const registerAction = control?.registerAction;
+  const latestActionRef = useRef<OpenworkControlAction | null>(action || null);
+  latestActionRef.current = action || null;
+  const actionId = action ? action.id : null;
+
+  useEffect(() => {
+    if (!registerAction || !actionId) return undefined;
+    return registerAction(actionId, latestActionRef);
+  }, [actionId, registerAction]);
+}
+
+export function OpenworkRouteControlActions() {
+  const navigate = useNavigate();
+
+  const actions = useMemo<OpenworkControlAction[]>(() => [
+    {
+      id: "route.session",
+      label: "Open sessions",
+      description: "Navigate to the main session view.",
+      sideEffect: "navigation",
+      execute: () => navigate("/session"),
+    },
+    {
+      id: "route.settings.general",
+      label: "Open general settings",
+      description: "Navigate to general settings.",
+      sideEffect: "navigation",
+      execute: () => navigate("/settings/general"),
+    },
+    {
+      id: "route.settings.extensions",
+      label: "Open MCP and extension settings",
+      description: "Navigate to extension and MCP settings.",
+      sideEffect: "navigation",
+      execute: () => navigate("/settings/extensions"),
+    },
+    {
+      id: "route.settings.skills",
+      label: "Open skills settings",
+      description: "Navigate to skills settings.",
+      sideEffect: "navigation",
+      execute: () => navigate("/settings/skills"),
+    },
+    {
+      id: "route.settings.appearance",
+      label: "Open appearance settings",
+      description: "Navigate to appearance settings.",
+      sideEffect: "navigation",
+      execute: () => navigate("/settings/appearance"),
+    },
+  ], [navigate]);
+
+  useControlAction(actions[0]);
+  useControlAction(actions[1]);
+  useControlAction(actions[2]);
+  useControlAction(actions[3]);
+  useControlAction(actions[4]);
+  return null;
+}
diff --git a/apps/app/src/react-app/shell/debug-logger.ts b/apps/app/src/react-app/shell/debug-logger.ts
new file mode 100644
index 0000000000..b796d68116
--- /dev/null
+++ b/apps/app/src/react-app/shell/debug-logger.ts
@@ -0,0 +1,433 @@
+/**
+ * Dev observability client. Forwards browser console logs, uncaught errors,
+ * promise rejections, and fetch activity to the openwork-server `/dev/log`
+ * sink so an operator can tail a single file and see everything the React
+ * shell is doing — especially right before a hang.
+ *
+ * Also powers a lightweight hang detector: a heartbeat runs every 1s; if the
+ * main thread doesn't service the heartbeat within 3s we log a stall event.
+ *
+ * Everything here is a no-op in prod builds (checked via `import.meta.env`).
+ */
+
+import { publishInspectorSlice, recordInspectorEvent } from "./app-inspector";
+
+type LogLevel = "log" | "info" | "warn" | "error" | "debug";
+
+type DevLogEntry = {
+  level: LogLevel | "uncaught" | "unhandledRejection" | "hang" | "meta" | "fetch";
+  source?: string;
+  url?: string;
+  message?: string;
+  stack?: string;
+  durationMs?: number;
+  status?: number;
+  method?: string;
+  args?: unknown[];
+  extra?: Record<string, unknown>;
+  sessionKey?: string;
+};
+
+let started = false;
+let flushTimer: ReturnType<typeof setTimeout> | null = null;
+let queue: DevLogEntry[] = [];
+let serverUrlRef: () => string | Promise<string> = () => readFallbackServerUrl();
+const pendingFetches = new Map<number, { url: string; method: string; startedAt: number }>();
+let nextFetchId = 1;
+let lastHeartbeat = Date.now();
+let hangHandle: ReturnType<typeof setInterval> | null = null;
+// Reference to the un-wrapped fetch. We use it from inside `flushQueue` so our
+// own POST to /dev/log doesn't go through the wrapper (which would recurse
+// and also spam the log with its own activity).
+let nativeFetchRef: typeof fetch = typeof window !== "undefined" ? window.fetch.bind(window) : (globalThis.fetch as typeof fetch);
+let originalFetchRef: typeof fetch | null = null;
+let nativeConsoleRef: Record<LogLevel, (...args: unknown[]) => void> | null = null;
+let windowErrorHandlerRef: ((event: ErrorEvent) => void) | null = null;
+let windowUnhandledRejectionHandlerRef: ((event: PromiseRejectionEvent) => void) | null = null;
+let visibilityHandlerRef: (() => void) | null = null;
+let disposeInspectorSliceRef: (() => void) | null = null;
+const sessionKey = `react-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+
+// Cached availability of the server-side /dev/log sink, keyed by base URL.
+// Prevents the debug-logger from spamming 404s into the console when the
+// pnpm dev process was started WITHOUT OPENWORK_DEV_LOG_FILE set. The
+// sink returns 404 in that case and the browser logs every failed POST.
+// We probe once per base URL and disable posting for the remainder of the
+// session when the probe fails.
+const sinkAvailabilityByBase = new Map<string, boolean>();
+const sinkProbePromises = new Map<string, Promise<boolean>>();
+
+async function sinkIsAvailable(base: string): Promise<boolean> {
+  const cached = sinkAvailabilityByBase.get(base);
+  if (typeof cached === "boolean") return cached;
+  let pending = sinkProbePromises.get(base);
+  if (pending) return pending;
+  pending = nativeFetchRef(`${base.replace(/\/+$/, "")}/dev/log`, {
+    method: "GET",
+    keepalive: true,
+  })
+    .then(async (response) => {
+      if (!response.ok) return false;
+      // Server returns 200 + `{ok:true}` when the sink is enabled and
+      // 200 + `{ok:false, reason:"dev_log_disabled"}` otherwise, so the
+      // probe itself never logs a 404 to the console.
+      try {
+        const body = (await response.json()) as { ok?: boolean };
+        return body.ok === true;
+      } catch {
+        return false;
+      }
+    })
+    .catch(() => false)
+    .then((ok) => {
+      sinkAvailabilityByBase.set(base, ok);
+      sinkProbePromises.delete(base);
+      return ok;
+    });
+  sinkProbePromises.set(base, pending);
+  return pending;
+}
+
+function readFallbackServerUrl(): string {
+  if (typeof window === "undefined") return "";
+  try {
+    return window.localStorage.getItem("openwork.server.urlOverride") ?? "";
+  } catch {
+    return "";
+  }
+}
+
+function safeStringify(input: unknown, depth = 0): unknown {
+  if (depth > 3) return "[…]";
+  if (input === null || typeof input !== "object") {
+    if (typeof input === "function") return `[function ${(input as Function).name || "anonymous"}]`;
+    if (typeof input === "bigint") return input.toString();
+    if (typeof input === "symbol") return input.toString();
+    return input;
+  }
+  if (input instanceof Error) {
+    return { name: input.name, message: input.message, stack: input.stack };
+  }
+  if (Array.isArray(input)) {
+    return input.slice(0, 25).map((item) => safeStringify(item, depth + 1));
+  }
+  const out: Record<string, unknown> = {};
+  let count = 0;
+  for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+    if (count++ > 25) {
+      out.__truncated = true;
+      break;
+    }
+    try {
+      out[key] = safeStringify(value, depth + 1);
+    } catch {
+      out[key] = "[unserializable]";
+    }
+  }
+  return out;
+}
+
+function scheduleFlush() {
+  if (flushTimer) return;
+  flushTimer = setTimeout(() => {
+    flushTimer = null;
+    void flushQueue();
+  }, 500);
+}
+
+async function flushQueue() {
+  if (queue.length === 0) return;
+  const base = await serverUrlRef();
+  if (!base) return;
+
+  // Skip the POST entirely when we know the sink is disabled, otherwise
+  // every dev session without OPENWORK_DEV_LOG_FILE set spams 404s.
+  const available = await sinkIsAvailable(base);
+  if (!available) {
+    // Drop the queued entries; they're still retained in
+    // window.__openwork.events() for any operator who needs them.
+    queue = [];
+    return;
+  }
+
+  const batch = queue;
+  queue = [];
+  try {
+    await nativeFetchRef(`${base.replace(/\/+$/, "")}/dev/log`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(batch),
+      keepalive: true,
+    });
+  } catch {
+    // Keep this silent; we don't want the logger to itself create a log
+    // storm when the server is unreachable. Events are still retained in
+    // window.__openwork.events().
+  }
+}
+
+function enqueue(entry: DevLogEntry) {
+  queue.push({ sessionKey, ...entry });
+  if (queue.length > 200) queue.splice(0, queue.length - 200);
+  recordInspectorEvent(`log.${entry.level}`, entry);
+  scheduleFlush();
+}
+
+export function recordDebugLog(entry: DevLogEntry) {
+  if (!started || !isEnabled()) {
+    recordInspectorEvent(`log.${entry.level}`, entry);
+    return;
+  }
+  enqueue(entry);
+}
+
+function isEnabled(): boolean {
+  if (typeof window === "undefined") return false;
+  // Always on in dev; explicit opt-out via `localStorage.openwork.debug.disableLogger = "1"`.
+  try {
+    if (window.localStorage.getItem("openwork.debug.disableLogger") === "1") return false;
+  } catch {
+    // ignore
+  }
+  const env = (import.meta as unknown as { env?: Record<string, unknown> }).env ?? {};
+  if (env.PROD === true) {
+    return window.localStorage.getItem("openwork.debug.enableLoggerInProd") === "1";
+  }
+  return true;
+}
+
+export function startDebugLogger(opts?: { serverUrl?: () => string | Promise<string> }) {
+  if (started) return;
+  if (!isEnabled()) return;
+  started = true;
+  if (opts?.serverUrl) serverUrlRef = opts.serverUrl;
+
+  // Patch console
+  const nativeConsole: Record<LogLevel, (...args: unknown[]) => void> = {
+    log: console.log.bind(console),
+    info: console.info.bind(console),
+    warn: console.warn.bind(console),
+    error: console.error.bind(console),
+    debug: console.debug.bind(console),
+  };
+  nativeConsoleRef = nativeConsole;
+  (Object.keys(nativeConsole) as LogLevel[]).forEach((level) => {
+    const original = nativeConsole[level];
+    console[level] = (...args: unknown[]) => {
+      try {
+        enqueue({
+          level,
+          url: typeof location !== "undefined" ? location.pathname + location.search : undefined,
+          message: typeof args[0] === "string" ? args[0] : undefined,
+          args: args.map((arg) => safeStringify(arg)),
+        });
+      } catch {
+        // ignore
+      }
+      original(...args);
+    };
+  });
+
+  // Window errors
+  const handleWindowError = (event: ErrorEvent) => {
+    const target = event.error as Error | undefined;
+    enqueue({
+      level: "uncaught",
+      source: event.filename,
+      message: event.message,
+      stack: target?.stack,
+      extra: { line: event.lineno, col: event.colno },
+    });
+  };
+  windowErrorHandlerRef = handleWindowError;
+  window.addEventListener("error", handleWindowError);
+
+  const handleUnhandledRejection = (event: PromiseRejectionEvent) => {
+    const reason = event.reason;
+    enqueue({
+      level: "unhandledRejection",
+      message: reason instanceof Error ? reason.message : typeof reason === "string" ? reason : undefined,
+      stack: reason instanceof Error ? reason.stack : undefined,
+      extra: { reason: safeStringify(reason) as Record<string, unknown> },
+    });
+  };
+  windowUnhandledRejectionHandlerRef = handleUnhandledRejection;
+  window.addEventListener("unhandledrejection", handleUnhandledRejection);
+
+  // Fetch wrapping (so we can see which requests are hanging around a stall).
+  // We capture the native reference here and reuse it inside `flushQueue` so
+  // our own POST to /dev/log doesn't go through the wrapper (which would make
+  // the logger log itself forever).
+  const nativeFetch = window.fetch.bind(window);
+  originalFetchRef = nativeFetch;
+  nativeFetchRef = nativeFetch;
+  window.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const id = nextFetchId++;
+    let url = "";
+    let method = "GET";
+    try {
+      if (typeof input === "string") {
+        url = input;
+      } else if (input instanceof URL) {
+        url = input.toString();
+      } else if (input instanceof Request) {
+        url = input.url;
+        method = input.method;
+      }
+      if (init?.method) method = init.method;
+    } catch {
+      // ignore
+    }
+    const isDevLogCall = url.includes("/dev/log");
+    if (!isDevLogCall) {
+      pendingFetches.set(id, { url, method, startedAt: Date.now() });
+    }
+    try {
+      const response = await nativeFetch(input as RequestInfo, init);
+      if (!isDevLogCall) {
+        const duration = Date.now() - (pendingFetches.get(id)?.startedAt ?? Date.now());
+        enqueue({
+          level: "fetch",
+          method,
+          url,
+          status: response.status,
+          durationMs: duration,
+        });
+      }
+      return response;
+    } catch (error) {
+      if (!isDevLogCall) {
+        const duration = Date.now() - (pendingFetches.get(id)?.startedAt ?? Date.now());
+        enqueue({
+          level: "fetch",
+          method,
+          url,
+          status: 0,
+          durationMs: duration,
+          message: error instanceof Error ? error.message : String(error),
+        });
+      }
+      throw error;
+    } finally {
+      if (!isDevLogCall) pendingFetches.delete(id);
+    }
+  }) as typeof window.fetch;
+
+  // Heartbeat / hang detector.
+  // A long heartbeat gap has two possible causes:
+  // 1. A real JS-thread stall (bug) — usually 3-10s.
+  // 2. macOS threw the webview into App Nap / backgrounding throttle when
+  //    the window wasn't focused — gaps can be minutes, not a real "hang".
+  // We split them so alarms only fire for case 1.
+  const HANG_THRESHOLD_MS = 3000;
+  const RESUME_THRESHOLD_MS = 10_000;
+  lastHeartbeat = Date.now();
+  hangHandle = setInterval(() => {
+    const now = Date.now();
+    const gap = now - lastHeartbeat;
+    if (gap > HANG_THRESHOLD_MS) {
+      const level = gap >= RESUME_THRESHOLD_MS ? ("meta" as const) : ("hang" as const);
+      enqueue({
+        level,
+        durationMs: gap,
+        message:
+          level === "hang"
+            ? `Main thread stalled ~${gap}ms`
+            : `Webview resumed after ~${Math.round(gap / 1000)}s throttled/background (NOT a hang)`,
+        extra: {
+          resume: level !== "hang",
+          pendingFetchCount: pendingFetches.size,
+          pendingFetchSamples: Array.from(pendingFetches.values())
+            .slice(0, 5)
+            .map((entry) => ({
+              url: entry.url,
+              method: entry.method,
+              ageMs: Date.now() - entry.startedAt,
+            })),
+          visibility: typeof document !== "undefined" ? document.visibilityState : "unknown",
+        },
+      });
+    }
+    lastHeartbeat = now;
+  }, 1000);
+
+  // Track visibility changes for diagnostics only. Route-level code owns any
+  // refresh behavior so the logger does not accidentally fan out network calls.
+  if (typeof document !== "undefined") {
+    const handleVisibilityChange = () => {
+      enqueue({
+        level: "meta",
+        message: `visibilitychange: ${document.visibilityState}`,
+        extra: { visibility: document.visibilityState },
+      });
+    };
+    visibilityHandlerRef = handleVisibilityChange;
+    document.addEventListener("visibilitychange", handleVisibilityChange);
+  }
+
+  disposeInspectorSliceRef = publishInspectorSlice("debug", () => ({
+    enabled: true,
+    sessionKey,
+    pendingFetchCount: pendingFetches.size,
+    pendingFetches: Array.from(pendingFetches.values()).map((entry) => ({
+      url: entry.url,
+      method: entry.method,
+      ageMs: Date.now() - entry.startedAt,
+    })),
+    memory: readMemoryUsage(),
+    queueSize: queue.length,
+  }));
+
+  enqueue({ level: "meta", message: "debug-logger started", extra: { userAgent: navigator.userAgent } });
+}
+
+function readMemoryUsage(): Record<string, unknown> | null {
+  if (typeof performance === "undefined") return null;
+  const mem = (performance as unknown as { memory?: { totalJSHeapSize: number; usedJSHeapSize: number; jsHeapSizeLimit: number } }).memory;
+  if (!mem) return null;
+  return {
+    usedMb: Math.round((mem.usedJSHeapSize / (1024 * 1024)) * 10) / 10,
+    totalMb: Math.round((mem.totalJSHeapSize / (1024 * 1024)) * 10) / 10,
+    limitMb: Math.round((mem.jsHeapSizeLimit / (1024 * 1024)) * 10) / 10,
+  };
+}
+
+export function stopDebugLogger() {
+  if (!started) return;
+  if (flushTimer) {
+    clearTimeout(flushTimer);
+    flushTimer = null;
+  }
+  if (hangHandle) clearInterval(hangHandle);
+  hangHandle = null;
+  if (windowErrorHandlerRef) {
+    window.removeEventListener("error", windowErrorHandlerRef);
+    windowErrorHandlerRef = null;
+  }
+  if (windowUnhandledRejectionHandlerRef) {
+    window.removeEventListener("unhandledrejection", windowUnhandledRejectionHandlerRef);
+    windowUnhandledRejectionHandlerRef = null;
+  }
+  if (typeof document !== "undefined" && visibilityHandlerRef) {
+    document.removeEventListener("visibilitychange", visibilityHandlerRef);
+    visibilityHandlerRef = null;
+  }
+  if (disposeInspectorSliceRef) {
+    disposeInspectorSliceRef();
+    disposeInspectorSliceRef = null;
+  }
+  if (originalFetchRef && typeof window !== "undefined") {
+    window.fetch = originalFetchRef;
+    nativeFetchRef = originalFetchRef;
+    originalFetchRef = null;
+  }
+  if (nativeConsoleRef) {
+    (Object.keys(nativeConsoleRef) as LogLevel[]).forEach((level) => {
+      console[level] = nativeConsoleRef![level];
+    });
+    nativeConsoleRef = null;
+  }
+  pendingFetches.clear();
+  queue = [];
+  started = false;
+}
diff --git a/apps/app/src/react-app/shell/desktop-local-openwork.ts b/apps/app/src/react-app/shell/desktop-local-openwork.ts
new file mode 100644
index 0000000000..7f5a75c154
--- /dev/null
+++ b/apps/app/src/react-app/shell/desktop-local-openwork.ts
@@ -0,0 +1,108 @@
+import {
+  engineInfo,
+  engineStart,
+  openworkServerInfo,
+} from "../../app/lib/desktop";
+import { readOpenworkServerSettings, writeOpenworkServerSettings } from "../../app/lib/openwork-server";
+import { safeStringify } from "../../app/utils";
+import { recordInspectorEvent } from "./app-inspector";
+
+type LocalWorkspaceLike = {
+  id: string;
+  name?: string | null;
+  displayNameResolved?: string | null;
+  path?: string | null;
+  workspaceType?: "local" | "remote" | string | null;
+};
+
+type EnsureDesktopLocalOpenworkOptions = {
+  route: "session" | "settings";
+  workspace: LocalWorkspaceLike | null | undefined;
+  allWorkspaces: LocalWorkspaceLike[];
+};
+
+function emitOpenworkSettingsChanged() {
+  try {
+    window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+  } catch {
+    // ignore browser event dispatch failures
+  }
+}
+
+function describeError(error: unknown) {
+  if (error instanceof Error) return error.message;
+  const serialized = safeStringify(error);
+  return serialized && serialized !== "{}" ? serialized : "Unknown error";
+}
+
+export async function ensureDesktopLocalOpenworkConnection(
+  options: EnsureDesktopLocalOpenworkOptions,
+) {
+  const workspace = options.workspace;
+  const workspaceRoot = workspace?.path?.trim() ?? "";
+  if (!workspace || workspace.workspaceType !== "local" || !workspaceRoot) {
+    return null;
+  }
+
+  const workspacePaths = Array.from(
+    new Set(
+      options.allWorkspaces
+        .filter((item) => item.workspaceType === "local")
+        .map((item) => item.path?.trim() ?? "")
+        .filter((path) => path.length > 0),
+    ),
+  );
+  if (!workspacePaths.includes(workspaceRoot)) {
+    workspacePaths.unshift(workspaceRoot);
+  }
+
+  recordInspectorEvent("route.local_openwork.ensure.start", {
+    route: options.route,
+    workspaceId: workspace.id,
+    workspaceRoot,
+  });
+
+  try {
+    const engine = await engineInfo().catch(() => null);
+    if (!engine?.running || !engine.baseUrl) {
+      await engineStart(workspaceRoot, {
+        runtime: "direct",
+        workspacePaths,
+        openworkRemoteAccess: readOpenworkServerSettings().remoteAccessEnabled === true,
+      });
+    }
+
+    const info = await openworkServerInfo();
+    if (!info?.baseUrl) {
+      throw new Error("OpenWork server did not report a base URL after activation.");
+    }
+
+    writeOpenworkServerSettings({
+      urlOverride: info.baseUrl,
+      token: info.ownerToken?.trim() || info.clientToken?.trim() || undefined,
+      hostToken: info.hostToken?.trim() || undefined,
+      portOverride: info.port ?? undefined,
+      remoteAccessEnabled: info.remoteAccessEnabled === true,
+    });
+    emitOpenworkSettingsChanged();
+
+    recordInspectorEvent("route.local_openwork.ensure.success", {
+      route: options.route,
+      workspaceId: workspace.id,
+      workspaceRoot,
+      baseUrl: info.baseUrl,
+    });
+
+    return info;
+  } catch (error) {
+    const message = describeError(error);
+    console.error(`[${options.route}-route] local workspace reconnect failed`, error);
+    recordInspectorEvent("route.local_openwork.ensure.error", {
+      route: options.route,
+      workspaceId: workspace.id,
+      workspaceRoot,
+      message,
+    });
+    throw new Error(message);
+  }
+}
diff --git a/apps/app/src/react-app/shell/desktop-runtime-boot.ts b/apps/app/src/react-app/shell/desktop-runtime-boot.ts
new file mode 100644
index 0000000000..2a95108205
--- /dev/null
+++ b/apps/app/src/react-app/shell/desktop-runtime-boot.ts
@@ -0,0 +1,286 @@
+/** @jsxImportSource react */
+import { useEffect } from "react";
+
+import {
+  engineInfo,
+  engineStart,
+  openworkServerInfo,
+  resolveWorkspaceListSelectedId,
+  runtimeBootstrap,
+  workspaceBootstrap,
+  workspaceSetRuntimeActive,
+  workspaceSetSelected,
+} from "../../app/lib/desktop";
+import { ingestMigrationSnapshotOnElectronBoot } from "../../app/lib/migration";
+import {
+  hydrateOpenworkServerSettingsFromEnv,
+  readOpenworkServerSettings,
+  writeOpenworkServerSettings,
+} from "../../app/lib/openwork-server";
+import { isDesktopRuntime, isElectronRuntime, safeStringify } from "../../app/utils";
+import { useServer } from "../kernel/server-provider";
+import { useBootState } from "./boot-state";
+
+// Module-scoped latch so React Strict-Mode's "mount-unmount-remount" cycle in
+// dev only triggers the boot sequence once per app launch, and the async work
+// keeps running across the transient unmount.
+let BOOT_STARTED = false;
+
+function isOpenworkServerReady(info?: {
+  running?: boolean | null;
+  baseUrl?: string | null;
+  ownerToken?: string | null;
+  clientToken?: string | null;
+}) {
+  return Boolean(
+    info?.running === true &&
+      info.baseUrl?.trim() &&
+      (info.ownerToken?.trim() || info.clientToken?.trim()),
+  );
+}
+
+/**
+ * On desktop (Tauri) startup:
+ *   1) bootstrap the workspace list
+ *   2) if a local workspace is selected, restart the embedded OpenWork server
+ *   3) start the OpenCode engine pointed at the workspace
+ *   4) activate the workspace on the running OpenWork server
+ *   5) notify React routes that fresh desktop runtime info is available. Electron
+ *      routes read live runtime info directly instead of persisting ephemeral
+ *      localhost ports/tokens into OpenWork settings.
+ *
+ * Safe to call multiple times — gated by a `didBoot` ref so it runs once per mount.
+ */
+export function useDesktopRuntimeBoot() {
+  const { setPhase, setError, markReady } = useBootState();
+  const { setActive } = useServer();
+
+  useEffect(() => {
+    if (!isDesktopRuntime()) {
+      // Web/headless: nothing to spawn, we're instantly "ready".
+      markReady();
+      return;
+    }
+    if (BOOT_STARTED) return;
+    BOOT_STARTED = true;
+
+    void (async () => {
+      try {
+        // On Electron specifically: if the previous Tauri install dropped
+        // a migration snapshot, fold it into localStorage before any of
+        // the boot code reads workspace preferences. Idempotent across
+        // launches (the helper only writes keys that are still empty
+        // and acks the file after ingestion).
+        if (isElectronRuntime()) {
+          const hydrated = await ingestMigrationSnapshotOnElectronBoot();
+          if (hydrated > 0) {
+            // eslint-disable-next-line no-console -- valuable one-time signal
+            console.info(`[migration] hydrated ${hydrated} localStorage keys from Tauri snapshot`);
+          }
+        }
+        hydrateOpenworkServerSettingsFromEnv();
+
+        setPhase("bootstrapping-workspaces");
+        const list = await workspaceBootstrap().catch(() => null);
+        if (!list) {
+          markReady();
+          return;
+        }
+
+        const selectedId = resolveWorkspaceListSelectedId(list);
+        const workspace = selectedId
+          ? list.workspaces.find((w) => w.id === selectedId)
+          : undefined;
+        if (!workspace || workspace.workspaceType === "remote") {
+          markReady();
+          return;
+        }
+
+        const workspaceRoot = workspace.path?.trim();
+        if (!workspaceRoot) {
+          markReady();
+          return;
+        }
+
+        if (isElectronRuntime()) {
+          setPhase("starting-engine", "Starting your workspace");
+          const boot = (await runtimeBootstrap().catch((error) => ({
+            ok: false,
+            error: error instanceof Error ? error.message : safeStringify(error),
+          }))) as {
+            ok?: boolean;
+            skipped?: boolean;
+            error?: string;
+            engine?: { baseUrl?: string | null };
+            openworkServer?: {
+              running?: boolean | null;
+              baseUrl?: string | null;
+              ownerToken?: string | null;
+              clientToken?: string | null;
+              port?: number | null;
+              remoteAccessEnabled?: boolean;
+            };
+          };
+
+          if (boot.ok === false) {
+            setError(boot.error || "Failed to start OpenWork runtime");
+            return;
+          }
+
+          if (!boot.skipped && !isOpenworkServerReady(boot.openworkServer)) {
+            setError("OpenWork server did not finish starting. Please restart OpenWork.");
+            return;
+          }
+
+          if (boot.engine?.baseUrl) {
+            setActive(boot.engine.baseUrl);
+          }
+          const serverInfo = boot.openworkServer;
+          if (serverInfo?.baseUrl) {
+            try {
+              window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+            } catch {
+              /* ignore */
+            }
+          }
+          markReady();
+          return;
+        }
+
+        // FAST PATH ─────────────────────────────────────────────────────
+        // Cheap status probe: if engine is already running just publish the
+        // current openwork-server base URL + token and finish in <1s.
+        // This mirrors Solid's bootstrap at context/workspace.ts:3883-3907
+        // ("localAttachExisting"), which never restarts a running stack.
+        try {
+          const engine = await engineInfo();
+          if (engine?.running && engine.baseUrl) {
+            setActive(engine.baseUrl);
+            const fresh = await openworkServerInfo().catch(() => null);
+            if (fresh?.baseUrl) {
+              writeOpenworkServerSettings({
+                urlOverride: fresh.baseUrl,
+                token:
+                  fresh.ownerToken?.trim() ||
+                  fresh.clientToken?.trim() ||
+                  undefined,
+                hostToken: fresh.hostToken?.trim() || undefined,
+                portOverride: fresh.port ?? undefined,
+                remoteAccessEnabled: fresh.remoteAccessEnabled === true,
+              });
+              try {
+                window.dispatchEvent(
+                  new CustomEvent("openwork-server-settings-changed"),
+                );
+              } catch {
+                /* ignore */
+              }
+            }
+            markReady();
+            return;
+          }
+        } catch {
+          // engineInfo is best-effort; fall through to the slow path.
+        }
+
+        // SLOW PATH ─────────────────────────────────────────────────────
+        // No running engine. Tauri now mirrors Electron: engine_start boots
+        // openwork-server and lets that server manage OpenCode.
+        const localPaths = list.workspaces
+          .filter((entry) => entry.workspaceType !== "remote")
+          .map((entry) => entry.path?.trim() ?? "")
+          .filter((path): path is string => path.length > 0);
+        const workspacePathsFor = (root: string) => {
+          const paths = [root];
+          for (const path of localPaths) {
+            if (!paths.includes(path)) paths.push(path);
+          }
+          return paths;
+        };
+
+        setPhase("starting-engine", "Starting your workspace");
+        let engineStartResult = await engineStart(workspaceRoot, {
+          runtime: "direct",
+          workspacePaths: workspacePathsFor(workspaceRoot),
+          openworkRemoteAccess: readOpenworkServerSettings().remoteAccessEnabled === true,
+        }).catch((error) => {
+          console.warn("[desktop-boot] engineStart failed:", error);
+          return null;
+        });
+
+        if (!engineStartResult) {
+          const fallback = list.workspaces.find((entry) => {
+            const path = entry.path?.trim() ?? "";
+            return entry.workspaceType !== "remote" && path && path !== workspaceRoot;
+          });
+          const fallbackRoot = fallback?.path?.trim() ?? "";
+          if (fallback && fallbackRoot) {
+            console.warn("[desktop-boot] selected workspace failed; trying fallback workspace", {
+              selectedWorkspaceId: workspace.id,
+              fallbackWorkspaceId: fallback.id,
+            });
+            setPhase("starting-engine", "Starting another workspace");
+            engineStartResult = await engineStart(fallbackRoot, {
+              runtime: "direct",
+              workspacePaths: workspacePathsFor(fallbackRoot).filter((path) => path !== workspaceRoot),
+              openworkRemoteAccess: readOpenworkServerSettings().remoteAccessEnabled === true,
+            }).catch((error) => {
+              console.warn("[desktop-boot] fallback engineStart failed:", error);
+              setError(error instanceof Error ? error.message : safeStringify(error));
+              return null;
+            });
+            if (engineStartResult) {
+              void workspaceSetSelected(fallback.id).catch(() => undefined);
+              void workspaceSetRuntimeActive(fallback.id).catch(() => undefined);
+            }
+          } else {
+            setError("Failed to start the selected workspace.");
+          }
+        }
+
+        if (engineStartResult) {
+          if (engineStartResult.baseUrl) {
+            setActive(engineStartResult.baseUrl);
+          }
+          try {
+            const freshInfo = await openworkServerInfo();
+            if (freshInfo?.baseUrl) {
+              writeOpenworkServerSettings({
+                urlOverride: freshInfo.baseUrl,
+                token:
+                  freshInfo.ownerToken?.trim() ||
+                  freshInfo.clientToken?.trim() ||
+                  undefined,
+                hostToken: freshInfo.hostToken?.trim() || undefined,
+                portOverride: freshInfo.port ?? undefined,
+                remoteAccessEnabled: freshInfo.remoteAccessEnabled === true,
+              });
+              try {
+                window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+              } catch {
+                /* ignore */
+              }
+            }
+          } catch (error) {
+            console.warn("[desktop-boot] post-engineStart openworkServerInfo failed:", error);
+          }
+        }
+
+        markReady();
+      } catch (error) {
+        console.warn("[desktop-boot] fatal:", error);
+        setError(error instanceof Error ? error.message : safeStringify(error));
+      }
+    })();
+  }, [markReady, setActive, setError, setPhase]);
+}
+
+/**
+ * Component wrapper that must be rendered inside <BootStateProvider>. It runs
+ * the boot hook exactly once per app mount so callers don't have to think
+ * about React Strict-Mode double-invocation.
+ */
+export function DesktopRuntimeBoot(): null {
+  useDesktopRuntimeBoot();
+  return null;
+}
diff --git a/apps/app/src/react-app/shell/dev-profiler.tsx b/apps/app/src/react-app/shell/dev-profiler.tsx
new file mode 100644
index 0000000000..bc8f7e7e90
--- /dev/null
+++ b/apps/app/src/react-app/shell/dev-profiler.tsx
@@ -0,0 +1,410 @@
+/** @jsxImportSource react */
+
+/**
+ * Dev-only React profiler + overlay.
+ *
+ * <DevProfiler id="SessionSurface"> wraps a subtree with React's built-in
+ * <Profiler>. It aggregates commits per id (count, total time, self time,
+ * last commit timestamp, recent burst).
+ *
+ * <DevProfilerOverlay /> renders a small floating card in the bottom-right
+ * that shows the hottest zones. Toggle with Cmd+Shift+P or set
+ * localStorage.openwork.debug.profilerOverlay = "1" / "0".
+ *
+ * In prod builds the wrapper is a pass-through (no Profiler overhead) and
+ * the overlay renders null.
+ *
+ * Findings also land on window.__openwork.slice("profiler") so external
+ * tools / Chrome MCP can read them.
+ */
+
+import {
+  Profiler,
+  useEffect,
+  useRef,
+  useState,
+  type PropsWithChildren,
+  type ProfilerOnRenderCallback,
+  type ReactNode,
+} from "react";
+
+import { publishInspectorSlice } from "./app-inspector";
+
+type CommitRecord = {
+  id: string;
+  phase: "mount" | "update" | "nested-update";
+  actualMs: number;
+  baseMs: number;
+  commitAt: number;
+};
+
+type ZoneStats = {
+  id: string;
+  commitCount: number;
+  totalActualMs: number;
+  totalBaseMs: number;
+  lastActualMs: number;
+  lastBaseMs: number;
+  lastCommitAt: number;
+  lastPhase: CommitRecord["phase"];
+  mountCount: number;
+  updateCount: number;
+};
+
+type ProfilerState = {
+  zonesById: Map<string, ZoneStats>;
+  recent: CommitRecord[];
+};
+
+// Profiler is OFF BY DEFAULT, even in dev builds.
+//
+// Running React's <Profiler> under sustained streaming commits causes the
+// browser's performance timeline to accumulate `measure` entries faster than
+// it can reclaim them; React-dom's own `logComponentRender` eventually hits
+// "Failed to execute 'measure' on 'Performance': Data cannot be cloned, out
+// of memory" and the webview freezes mid-stream. That matches the "stream
+// produces 2 words then the app blocks" symptom.
+//
+// Explicit opt-ins:
+//   - VITE_OPENWORK_PROFILER=1 at `pnpm dev`
+//   - window.localStorage.setItem("openwork.debug.profiler", "1")
+// When off, <DevProfiler> is a pure pass-through (no <Profiler> mounted) and
+// the overlay renders null.
+const PROFILER_ENABLED = (() => {
+  if (typeof window === "undefined") return false;
+  try {
+    const env = (import.meta as unknown as { env?: Record<string, unknown> }).env ?? {};
+    const flag = env.VITE_OPENWORK_PROFILER;
+    if (flag === "1" || flag === "true" || flag === true) return true;
+  } catch {
+    // ignore
+  }
+  try {
+    if (window.localStorage.getItem("openwork.debug.profiler") === "1") return true;
+  } catch {
+    // ignore
+  }
+  return false;
+})();
+
+const RECENT_MAX = 200;
+
+const state: ProfilerState = {
+  zonesById: new Map(),
+  recent: [],
+};
+
+const subscribers = new Set<() => void>();
+
+function emit() {
+  for (const fn of subscribers) {
+    try {
+      fn();
+    } catch {
+      // ignore faulty subscribers
+    }
+  }
+}
+
+function readSnapshot() {
+  const zones = Array.from(state.zonesById.values()).sort(
+    (a, b) => b.commitCount - a.commitCount,
+  );
+  return {
+    zones,
+    recent: state.recent.slice(-20),
+    totalCommits: zones.reduce((acc, z) => acc + z.commitCount, 0),
+    totalActualMs: Math.round(zones.reduce((acc, z) => acc + z.totalActualMs, 0) * 10) / 10,
+  };
+}
+
+// Register a top-level inspector slice so the snapshot is accessible via
+// window.__openwork.slice("profiler") — even for operators who aren't
+// looking at the overlay.
+if (typeof window !== "undefined") {
+  publishInspectorSlice("profiler", readSnapshot);
+}
+
+function recordCommit(record: CommitRecord) {
+  // Fast path: when nobody is listening (overlay hidden, no external
+  // reader), don't mutate the map at all. This is critical — otherwise the
+  // overlay renders, re-renders itself inside the profiler zone, records
+  // its own commit, schedules another emit, re-renders, and so on forever.
+  // With zero subscribers we also never schedule an rAF, so the profiler
+  // is effectively free when it's off.
+  if (subscribers.size === 0) return;
+
+  const prev = state.zonesById.get(record.id);
+  if (!prev) {
+    state.zonesById.set(record.id, {
+      id: record.id,
+      commitCount: 1,
+      totalActualMs: record.actualMs,
+      totalBaseMs: record.baseMs,
+      lastActualMs: record.actualMs,
+      lastBaseMs: record.baseMs,
+      lastCommitAt: record.commitAt,
+      lastPhase: record.phase,
+      mountCount: record.phase === "mount" ? 1 : 0,
+      updateCount: record.phase === "mount" ? 0 : 1,
+    });
+  } else {
+    prev.commitCount += 1;
+    prev.totalActualMs += record.actualMs;
+    prev.totalBaseMs += record.baseMs;
+    prev.lastActualMs = record.actualMs;
+    prev.lastBaseMs = record.baseMs;
+    prev.lastCommitAt = record.commitAt;
+    prev.lastPhase = record.phase;
+    if (record.phase === "mount") prev.mountCount += 1;
+    else prev.updateCount += 1;
+  }
+  state.recent.push(record);
+  if (state.recent.length > RECENT_MAX) {
+    state.recent.splice(0, state.recent.length - RECENT_MAX);
+  }
+  // Notify overlay subscribers. We throttle via rAF so a burst of commits
+  // during a stream doesn't flood setState.
+  scheduleEmit();
+}
+
+let emitScheduled = false;
+function scheduleEmit() {
+  if (emitScheduled) return;
+  if (typeof window === "undefined") return;
+  if (subscribers.size === 0) return;
+  emitScheduled = true;
+  window.requestAnimationFrame(() => {
+    emitScheduled = false;
+    emit();
+  });
+}
+
+const onRender: ProfilerOnRenderCallback = (
+  id,
+  phase,
+  actualDuration,
+  baseDuration,
+  _startTime,
+  commitTime,
+) => {
+  recordCommit({
+    id,
+    phase: phase as CommitRecord["phase"],
+    actualMs: Math.round(actualDuration * 10) / 10,
+    baseMs: Math.round(baseDuration * 10) / 10,
+    commitAt: commitTime,
+  });
+};
+
+/**
+ * Zone wrapper. In prod this is a pass-through and the Profiler is never
+ * mounted so we don't pay the runtime cost.
+ */
+export function DevProfiler({
+  id,
+  children,
+}: PropsWithChildren<{ id: string }>): ReactNode {
+  if (!PROFILER_ENABLED) return children as ReactNode;
+  return (
+    <Profiler id={id} onRender={onRender}>
+      {children}
+    </Profiler>
+  );
+}
+
+function readOverlayStoredPreference(): boolean | null {
+  if (typeof window === "undefined") return null;
+  try {
+    const raw = window.localStorage.getItem("openwork.debug.profilerOverlay");
+    if (raw === "1") return true;
+    if (raw === "0") return false;
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function writeOverlayStoredPreference(value: boolean) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem("openwork.debug.profilerOverlay", value ? "1" : "0");
+  } catch {
+    // ignore
+  }
+}
+
+export function useDevProfilerSnapshot() {
+  const [snapshot, setSnapshot] = useState(readSnapshot);
+  useEffect(() => {
+    const tick = () => setSnapshot(readSnapshot());
+    subscribers.add(tick);
+    return () => {
+      subscribers.delete(tick);
+    };
+  }, []);
+  return snapshot;
+}
+
+export function DevProfilerOverlay() {
+  if (!PROFILER_ENABLED) return null;
+  return <DevProfilerOverlayToggle />;
+}
+
+/**
+ * Owns only visibility state + the global keybind. Does NOT subscribe to
+ * profiler snapshots. When the user toggles the overlay on, it mounts
+ * <DevProfilerOverlayVisible/> which is the only component that subscribes.
+ * This means when the overlay is hidden there are zero subscribers and
+ * `recordCommit` short-circuits — the profiler becomes free.
+ */
+function DevProfilerOverlayToggle() {
+  const stored = readOverlayStoredPreference();
+  const [visible, setVisible] = useState(stored === null ? false : stored);
+
+  useEffect(() => {
+    const handler = (event: KeyboardEvent) => {
+      const metaOrCtrl = event.metaKey || event.ctrlKey;
+      if (!metaOrCtrl || !event.shiftKey) return;
+      if (event.key.toLowerCase() !== "p") return;
+      event.preventDefault();
+      setVisible((prev) => {
+        writeOverlayStoredPreference(!prev);
+        return !prev;
+      });
+    };
+    window.addEventListener("keydown", handler);
+    return () => window.removeEventListener("keydown", handler);
+  }, []);
+
+  if (!visible) return null;
+  return <DevProfilerOverlayVisible onHide={() => {
+    writeOverlayStoredPreference(false);
+    setVisible(false);
+  }} />;
+}
+
+function DevProfilerOverlayVisible({ onHide }: { onHide: () => void }) {
+  const [collapsed, setCollapsed] = useState(false);
+  const snapshot = useDevProfilerSnapshot();
+  const lastCommitByIdRef = useRef<Record<string, number>>({});
+
+  // Flash zones whose lastCommitAt changed since the previous render so
+  // operators can spot hot spots.
+  const flashing = new Set<string>();
+  const now = performance.now();
+  for (const zone of snapshot.zones) {
+    const prev = lastCommitByIdRef.current[zone.id];
+    if (prev !== zone.lastCommitAt) {
+      lastCommitByIdRef.current[zone.id] = zone.lastCommitAt;
+      if (now - zone.lastCommitAt < 500) {
+        flashing.add(zone.id);
+      }
+    }
+  }
+
+  const topZones = snapshot.zones.slice(0, 12);
+
+  return (
+    <div
+      className="pointer-events-auto fixed bottom-3 right-3 z-[1100] w-[280px] overflow-hidden rounded-lg border border-dls-border bg-dls-canvas/95 text-[11px] text-dls-text backdrop-blur-sm"
+      role="status"
+      aria-live="polite"
+    >
+      <div className="flex items-center justify-between border-b border-dls-border px-2.5 py-1.5">
+        <div className="flex items-center gap-2">
+          <span className="font-mono text-[10px] uppercase tracking-[0.14em] text-dls-secondary">
+            react profiler
+          </span>
+          <span className="text-[10px] text-dls-secondary">
+            {snapshot.totalCommits} commits · {snapshot.totalActualMs}ms
+          </span>
+        </div>
+        <div className="flex items-center gap-1">
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={() => {
+              state.zonesById.clear();
+              state.recent.length = 0;
+              emit();
+            }}
+            title="Reset counters"
+          >
+            reset
+          </button>
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={() => setCollapsed((value) => !value)}
+            title="Collapse"
+          >
+            {collapsed ? "+" : "–"}
+          </button>
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={onHide}
+            title="Hide (Cmd+Shift+P to toggle)"
+          >
+            ×
+          </button>
+        </div>
+      </div>
+      {collapsed ? null : (
+        <div className="max-h-[50vh] overflow-y-auto">
+          {topZones.length === 0 ? (
+            <div className="px-3 py-3 text-dls-secondary">
+              No profiler data yet. Interact with the app.
+            </div>
+          ) : (
+            <table className="w-full border-collapse">
+              <thead>
+                <tr className="text-[10px] uppercase tracking-[0.1em] text-dls-secondary">
+                  <th className="px-2 py-1 text-left font-medium">zone</th>
+                  <th className="px-2 py-1 text-right font-medium">#</th>
+                  <th className="px-2 py-1 text-right font-medium">last</th>
+                  <th className="px-2 py-1 text-right font-medium">total</th>
+                </tr>
+              </thead>
+              <tbody>
+                {topZones.map((zone) => {
+                  const isFlashing = flashing.has(zone.id);
+                  return (
+                    <tr
+                      key={zone.id}
+                      className={`border-t border-dls-border transition-colors ${
+                        isFlashing ? "bg-[rgba(var(--dls-accent-rgb),0.14)]" : ""
+                      }`}
+                    >
+                      <td className="px-2 py-1 font-mono text-[11px] text-dls-text">
+                        <span className="block truncate" title={zone.id}>
+                          {zone.id}
+                        </span>
+                        <span className="block text-[9px] uppercase tracking-[0.1em] text-dls-secondary">
+                          {zone.mountCount}m · {zone.updateCount}u
+                        </span>
+                      </td>
+                      <td className="px-2 py-1 text-right tabular-nums">
+                        {zone.commitCount}
+                      </td>
+                      <td className="px-2 py-1 text-right tabular-nums text-dls-secondary">
+                        {zone.lastActualMs}ms
+                      </td>
+                      <td className="px-2 py-1 text-right tabular-nums text-dls-secondary">
+                        {Math.round(zone.totalActualMs)}ms
+                      </td>
+                    </tr>
+                  );
+                })}
+              </tbody>
+            </table>
+          )}
+        </div>
+      )}
+      <div className="border-t border-dls-border px-2.5 py-1 text-[10px] text-dls-secondary">
+        Cmd+Shift+P to toggle. Prod builds: off.
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/dot-ticker.tsx b/apps/app/src/react-app/shell/dot-ticker.tsx
new file mode 100644
index 0000000000..112375eafb
--- /dev/null
+++ b/apps/app/src/react-app/shell/dot-ticker.tsx
@@ -0,0 +1,53 @@
+/** @jsxImportSource react */
+/**
+ * A small row of dots (`:: :: ::`) that illuminate one after another from left
+ * to right. Deliberately quiet: no shadow, no card, no glass — just a few
+ * pixels of accent light walking across a track.
+ *
+ * Used for: awaiting first response token, preparing workspace, any "alive
+ * but idle" state where we want a rhythmic beat that doesn't compete with the
+ * rest of the UI.
+ */
+export type OwDotTickerProps = {
+  /**
+   * Compact rows for inline hints ("sm"), default rows for the composer wait
+   * state ("md"), and the larger row used on the boot overlay ("lg").
+   */
+  size?: "sm" | "md" | "lg";
+  /** Total number of dots in the track. Defaults to 7. */
+  count?: number;
+  className?: string;
+};
+
+const SIZE_CONFIG: Record<NonNullable<OwDotTickerProps["size"]>, {
+  dotSize: string;
+  gap: string;
+}> = {
+  sm: { dotSize: "h-[3px] w-[3px]", gap: "gap-[5px]" },
+  md: { dotSize: "h-1 w-1", gap: "gap-1.5" },
+  lg: { dotSize: "h-[6px] w-[6px]", gap: "gap-2" },
+};
+
+export function OwDotTicker(props: OwDotTickerProps) {
+  const size = props.size ?? "md";
+  const count = Math.max(3, Math.min(props.count ?? 7, 12));
+  const config = SIZE_CONFIG[size];
+  const duration = 1.4;
+  const step = duration / count;
+
+  return (
+    <div
+      className={`inline-flex items-center ${config.gap} ${props.className ?? ""}`}
+      role="presentation"
+      aria-hidden="true"
+    >
+      {Array.from({ length: count }).map((_, index) => (
+        <span
+          key={index}
+          className={`ow-dot-ticker rounded-full ${config.dotSize}`}
+          style={{ animationDelay: `${(index * step).toFixed(3)}s` }}
+        />
+      ))}
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/font-zoom.ts b/apps/app/src/react-app/shell/font-zoom.ts
new file mode 100644
index 0000000000..c93795e20e
--- /dev/null
+++ b/apps/app/src/react-app/shell/font-zoom.ts
@@ -0,0 +1,62 @@
+/** @jsxImportSource react */
+import { useEffect } from "react";
+
+import {
+  FONT_ZOOM_STEP,
+  applyFontZoom,
+  normalizeFontZoom,
+  parseFontZoomShortcut,
+  persistFontZoom,
+  readStoredFontZoom,
+} from "../../app/lib/font-zoom";
+import { setDesktopZoomFactor } from "../../app/lib/desktop";
+import { isDesktopRuntime } from "../../app/utils";
+
+export function useDesktopFontZoomBehavior() {
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (!isDesktopRuntime()) return;
+
+    const applyAndPersistFontZoom = (value: number) => {
+      const next = normalizeFontZoom(value);
+      persistFontZoom(window.localStorage, next);
+
+      void setDesktopZoomFactor(next)
+        .then((applied) => {
+          if (applied) {
+            document.documentElement.style.removeProperty("--openwork-font-size");
+            return;
+          }
+          applyFontZoom(document.documentElement.style, next);
+        })
+        .catch(() => {
+          applyFontZoom(document.documentElement.style, next);
+        });
+
+      return next;
+    };
+
+    let fontZoom = applyAndPersistFontZoom(readStoredFontZoom(window.localStorage) ?? 1);
+
+    const handleZoomShortcut = (event: KeyboardEvent) => {
+      const action = parseFontZoomShortcut(event);
+      if (!action) return;
+
+      if (action === "in") {
+        fontZoom = applyAndPersistFontZoom(fontZoom + FONT_ZOOM_STEP);
+      } else if (action === "out") {
+        fontZoom = applyAndPersistFontZoom(fontZoom - FONT_ZOOM_STEP);
+      } else {
+        fontZoom = applyAndPersistFontZoom(1);
+      }
+
+      event.preventDefault();
+      event.stopPropagation();
+    };
+
+    window.addEventListener("keydown", handleZoomShortcut, true);
+    return () => {
+      window.removeEventListener("keydown", handleZoomShortcut, true);
+    };
+  }, []);
+}
diff --git a/apps/app/src/react-app/shell/loading-overlay.tsx b/apps/app/src/react-app/shell/loading-overlay.tsx
new file mode 100644
index 0000000000..f1c85ff738
--- /dev/null
+++ b/apps/app/src/react-app/shell/loading-overlay.tsx
@@ -0,0 +1,38 @@
+/** @jsxImportSource react */
+import { useBootState, useBootOverlayVisible } from "./boot-state";
+import { OwDotTicker } from "./dot-ticker";
+
+/**
+ * Quiet, opaque boot overlay. Solid surface fill so nothing bleeds through.
+ * A minimal typographic beat plus a small dot ticker. Fades once both the
+ * boot hook and the first route load are ready.
+ */
+export function LoadingOverlay() {
+  const visible = useBootOverlayVisible();
+  const { phase, message, error } = useBootState();
+
+  if (!visible) return null;
+
+  const fading = phase === "ready";
+
+  return (
+    <div
+      className={`pointer-events-auto fixed inset-0 z-[1000] flex items-center justify-center bg-dls-surface transition-opacity duration-[160ms] ${
+        fading ? "opacity-0" : "opacity-100"
+      }`}
+      aria-live="polite"
+      aria-busy={!fading}
+      role="status"
+    >
+      <div className="flex w-full max-w-[320px] flex-col items-center gap-4 px-6 text-center">
+        <OwDotTicker size="md" />
+        <div className="text-[12px] leading-5 text-dls-secondary">
+          {message || "Preparing workspace"}
+        </div>
+        {error ? (
+          <div className="text-[12px] leading-5 text-red-11">{error}</div>
+        ) : null}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/migration-prompt.tsx b/apps/app/src/react-app/shell/migration-prompt.tsx
new file mode 100644
index 0000000000..7998d27370
--- /dev/null
+++ b/apps/app/src/react-app/shell/migration-prompt.tsx
@@ -0,0 +1,197 @@
+/** @jsxImportSource react */
+/**
+ * Migration prompt — one-time modal that nudges Tauri users over to the
+ * Electron build. Dormant unless the build was produced with
+ * `VITE_OPENWORK_MIGRATION_RELEASE=1` or the dev override
+ * `VITE_OPENWORK_FORCE_MIGRATION_PROMPT=1` is set, so landing this code
+ * on dev has zero user impact until a flag is explicitly flipped.
+ */
+import { useCallback, useEffect, useState, type ReactElement } from "react";
+
+import {
+  deferMigration,
+  isMigrationDeferred,
+  migrateToElectron,
+  writeMigrationSnapshotFromTauri,
+} from "../../app/lib/migration";
+import { appBuildInfo } from "../../app/lib/desktop";
+import { isTauriRuntime } from "../../app/utils";
+
+type MigrationConfig = {
+  /**
+   * URL template for the Electron artifact on the matching release. The
+   * release script substitutes {arch} at build time. On macOS we expect a
+   * .zip (the .app bundle is swapped in place — see migrate_to_electron
+   * Rust command).
+   */
+  macUrl?: string;
+  macArm64Url?: string;
+  macX64Url?: string;
+  /** Optional sha256 check. */
+  macSha256?: string;
+  /** Windows installer URL. Stub until we wire the Rust path. */
+  windowsUrl?: string;
+  windowsX64Url?: string;
+  /** Linux AppImage URL. Stub until we wire the Rust path. */
+  linuxUrl?: string;
+  linuxArm64Url?: string;
+  linuxX64Url?: string;
+};
+
+function readBuildTimeConfig(): MigrationConfig | null {
+  const env = (import.meta as unknown as { env?: Record<string, string> }).env ?? {};
+  const isMigrationRelease = env.VITE_OPENWORK_MIGRATION_RELEASE === "1";
+  // Dev override: set VITE_OPENWORK_FORCE_MIGRATION_PROMPT=1 in .env.local
+  // to test the migration flow without cutting a release build.
+  const isDevForced = env.VITE_OPENWORK_FORCE_MIGRATION_PROMPT === "1";
+  if (!isMigrationRelease && !isDevForced) return null;
+  return {
+    macUrl: env.VITE_OPENWORK_MIGRATION_MAC_URL ?? (isDevForced ? "https://github.com/different-ai/openwork/releases/latest" : undefined),
+    macArm64Url: env.VITE_OPENWORK_MIGRATION_MAC_ARM64_URL,
+    macX64Url: env.VITE_OPENWORK_MIGRATION_MAC_X64_URL,
+    macSha256: env.VITE_OPENWORK_MIGRATION_MAC_SHA256,
+    windowsUrl: env.VITE_OPENWORK_MIGRATION_WINDOWS_URL ?? (isDevForced ? "https://github.com/different-ai/openwork/releases/latest" : undefined),
+    windowsX64Url: env.VITE_OPENWORK_MIGRATION_WINDOWS_X64_URL,
+    linuxUrl: env.VITE_OPENWORK_MIGRATION_LINUX_URL ?? (isDevForced ? "https://github.com/different-ai/openwork/releases/latest" : undefined),
+    linuxArm64Url: env.VITE_OPENWORK_MIGRATION_LINUX_ARM64_URL,
+    linuxX64Url: env.VITE_OPENWORK_MIGRATION_LINUX_X64_URL,
+  };
+}
+
+async function currentPlatformUrl(cfg: MigrationConfig): Promise<{ url?: string; sha256?: string }> {
+  let build: Awaited<ReturnType<typeof appBuildInfo>> | null = null;
+  try {
+    build = await appBuildInfo();
+  } catch {
+    build = null;
+  }
+
+  const os = build?.os;
+  const arch = build?.arch;
+  if (os === "macos" || os === "darwin") {
+    if (arch === "aarch64" || arch === "arm64") return { url: cfg.macArm64Url ?? cfg.macUrl, sha256: cfg.macSha256 };
+    if (arch === "x86_64" || arch === "x64") return { url: cfg.macX64Url ?? cfg.macUrl, sha256: cfg.macSha256 };
+    return { url: cfg.macUrl, sha256: cfg.macSha256 };
+  }
+  if (os === "windows" || os === "win32") {
+    if (arch === "x86_64" || arch === "x64") return { url: cfg.windowsX64Url ?? cfg.windowsUrl };
+    return { url: cfg.windowsUrl };
+  }
+  if (os === "linux") {
+    if (arch === "aarch64" || arch === "arm64") return { url: cfg.linuxArm64Url ?? cfg.linuxUrl };
+    if (arch === "x86_64" || arch === "x64") return { url: cfg.linuxX64Url ?? cfg.linuxUrl };
+    return { url: cfg.linuxUrl };
+  }
+
+  if (typeof navigator === "undefined") return {};
+  const ua = navigator.userAgent.toLowerCase();
+  if (ua.includes("mac")) {
+    return { url: cfg.macUrl, sha256: cfg.macSha256 };
+  }
+  if (ua.includes("windows") || ua.includes("win64") || ua.includes("win32")) {
+    return { url: cfg.windowsUrl };
+  }
+  return { url: cfg.linuxUrl };
+}
+
+export function MigrationPrompt(): ReactElement | null {
+  const [open, setOpen] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [config, setConfig] = useState<MigrationConfig | null>(null);
+
+  useEffect(() => {
+    // Only Tauri shows this modal. Electron users are already on the
+    // target runtime.
+    if (!isTauriRuntime()) return;
+    const cfg = readBuildTimeConfig();
+    if (!cfg) return;
+    if (isMigrationDeferred()) return;
+    setConfig(cfg);
+    setOpen(true);
+  }, []);
+
+  const handleInstall = useCallback(async () => {
+    if (!config) return;
+    setBusy(true);
+    setError(null);
+    try {
+      const { url, sha256 } = await currentPlatformUrl(config);
+      if (!url) {
+        throw new Error(
+          "Automatic migration isn't available for this platform yet. Please upgrade manually from the release page.",
+        );
+      }
+      const snapshot = await writeMigrationSnapshotFromTauri();
+      if (!snapshot.ok) {
+        throw new Error(
+          snapshot.reason ??
+            "Failed to capture workspace state before migration.",
+        );
+      }
+      const result = await migrateToElectron({ url, sha256 });
+      if (!result.ok) {
+        throw new Error(result.reason ?? "Migration handoff failed.");
+      }
+      // On success, the Rust command kicks off a detached shell script that
+      // swaps the .app bundle and relaunches. Tauri will exit on its own
+      // shortly — leave the dialog in its loading state until that happens.
+    } catch (e) {
+      setBusy(false);
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, [config]);
+
+  const handleLater = useCallback(() => {
+    deferMigration();
+    setOpen(false);
+  }, []);
+
+  if (!open) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="openwork-migration-title"
+    >
+      <div className="w-[min(440px,90vw)] rounded-[24px] border border-dls-border bg-dls-surface p-6 shadow-xl">
+        <h2
+          id="openwork-migration-title"
+          className="text-lg font-semibold text-gray-12"
+        >
+          OpenWork is moving to a new engine
+        </h2>
+        <p className="mt-3 text-sm leading-relaxed text-gray-11">
+          We're upgrading the desktop shell. The install takes ~30 seconds and
+          keeps all your workspaces, sessions, and tokens exactly where they
+          are. You'll be back in OpenWork automatically when it's done.
+        </p>
+        {error ? (
+          <div className="mt-3 rounded-md border border-red-7/50 bg-red-3 px-3 py-2 text-xs text-red-11">
+            {error}
+          </div>
+        ) : null}
+        <div className="mt-5 flex items-center justify-end gap-2">
+          <button
+            type="button"
+            className="rounded-full px-4 py-2 text-sm text-gray-11 hover:bg-gray-4"
+            onClick={handleLater}
+            disabled={busy}
+          >
+            Later
+          </button>
+          <button
+            type="button"
+            className="rounded-full bg-gray-12 px-4 py-2 text-sm font-medium text-gray-1 hover:bg-gray-12/90 disabled:opacity-60"
+            onClick={handleInstall}
+            disabled={busy}
+          >
+            {busy ? "Installing…" : "Install now"}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/openwork-connection.ts b/apps/app/src/react-app/shell/openwork-connection.ts
new file mode 100644
index 0000000000..9724582c04
--- /dev/null
+++ b/apps/app/src/react-app/shell/openwork-connection.ts
@@ -0,0 +1,80 @@
+import {
+  isLoopbackOpenworkServerUrl,
+  normalizeOpenworkServerUrl,
+  readOpenworkServerSettings,
+} from "../../app/lib/openwork-server";
+import { openworkServerInfo, type OpenworkServerInfo } from "../../app/lib/desktop";
+import { isDesktopRuntime } from "../../app/utils";
+
+export type OpenworkConnectionSource = "desktop-runtime" | "stored-settings" | "empty";
+
+export type ResolvedOpenworkConnection = {
+  normalizedBaseUrl: string;
+  resolvedToken: string;
+  resolvedHostToken: string;
+  hostInfo: OpenworkServerInfo | null;
+  source: OpenworkConnectionSource;
+};
+
+function hasUsableConnection(url: string, token: string) {
+  return url.trim().length > 0 && token.trim().length > 0;
+}
+
+/**
+ * Resolve the OpenWork server connection for routes that consume the server API.
+ *
+ * Local desktop-hosted servers expose ephemeral loopback ports and freshly
+ * minted tokens on every boot, so live runtime info is the source of truth
+ * there. Stored settings remain the fallback for remote/manual server
+ * connections and for desktop cases where the runtime bridge is unavailable.
+ */
+export async function resolveOpenworkConnection(): Promise<ResolvedOpenworkConnection> {
+  let staleDesktopRuntimeBaseUrl = "";
+
+  if (isDesktopRuntime()) {
+    try {
+      const info = await openworkServerInfo();
+      const normalizedBaseUrl =
+        normalizeOpenworkServerUrl(info.connectUrl ?? info.baseUrl ?? info.lanUrl ?? info.mdnsUrl ?? "") ??
+        "";
+      const resolvedToken = info.ownerToken?.trim() || info.clientToken?.trim() || "";
+      if (info.running === true && hasUsableConnection(normalizedBaseUrl, resolvedToken)) {
+        return {
+          normalizedBaseUrl,
+          resolvedToken,
+          resolvedHostToken: info.hostToken?.trim() || "",
+          hostInfo: info,
+          source: "desktop-runtime",
+        };
+      }
+      staleDesktopRuntimeBaseUrl = normalizedBaseUrl;
+    } catch {
+      // Fall through to stored settings for remote/manual connections.
+    }
+  }
+
+  const settings = readOpenworkServerSettings();
+  const normalizedBaseUrl = normalizeOpenworkServerUrl(settings.urlOverride ?? "") ?? "";
+  const resolvedToken = settings.token?.trim() ?? "";
+  const resolvedHostToken =
+    normalizedBaseUrl && isLoopbackOpenworkServerUrl(normalizedBaseUrl)
+      ? settings.hostToken?.trim() ?? ""
+      : "";
+  const storedConnectionIsStaleDesktopRuntime = Boolean(
+    isDesktopRuntime() &&
+      staleDesktopRuntimeBaseUrl &&
+      normalizedBaseUrl === staleDesktopRuntimeBaseUrl,
+  );
+  const source =
+    !storedConnectionIsStaleDesktopRuntime && hasUsableConnection(normalizedBaseUrl, resolvedToken)
+      ? "stored-settings"
+      : "empty";
+
+  return {
+    normalizedBaseUrl: source === "empty" ? "" : normalizedBaseUrl,
+    resolvedToken: source === "empty" ? "" : resolvedToken,
+    resolvedHostToken: source === "empty" ? "" : resolvedHostToken,
+    hostInfo: null,
+    source,
+  };
+}
diff --git a/apps/app/src/react-app/shell/providers.tsx b/apps/app/src/react-app/shell/providers.tsx
new file mode 100644
index 0000000000..439505ba76
--- /dev/null
+++ b/apps/app/src/react-app/shell/providers.tsx
@@ -0,0 +1,81 @@
+/** @jsxImportSource react */
+import { useEffect, type ReactNode } from "react";
+
+import { isWebDeployment } from "../../app/lib/openwork-deployment";
+import { hydrateOpenworkServerSettingsFromEnv } from "../../app/lib/openwork-server";
+import { isDesktopRuntime } from "../../app/utils";
+import { DenAuthProvider } from "../domains/cloud/den-auth-provider";
+import { DesktopConfigProvider } from "../domains/cloud/desktop-config-provider";
+import { RestrictionNoticeProvider } from "../domains/cloud/restriction-notice-provider";
+import { StatusToastsProvider } from "../domains/shell-feedback/status-toasts";
+import { LocalProvider } from "../kernel/local-provider";
+import { ServerProvider } from "../kernel/server-provider";
+import { BootStateProvider } from "./boot-state";
+import { DesktopRuntimeBoot } from "./desktop-runtime-boot";
+import { startDebugLogger, stopDebugLogger } from "./debug-logger";
+import { MigrationPrompt } from "./migration-prompt";
+import { resolveOpenworkConnection } from "./openwork-connection";
+import { ReloadCoordinatorProvider } from "./reload-coordinator";
+
+function resolveDefaultServerUrl(): string {
+  if (isDesktopRuntime()) return "http://127.0.0.1:4096";
+
+  const openworkUrl =
+    typeof import.meta.env?.VITE_OPENWORK_URL === "string"
+      ? import.meta.env.VITE_OPENWORK_URL.trim()
+      : "";
+  if (openworkUrl) {
+    return `${openworkUrl.replace(/\/+$/, "")}/opencode`;
+  }
+
+  if (isWebDeployment() && import.meta.env.PROD && typeof window !== "undefined") {
+    return `${window.location.origin}/opencode`;
+  }
+
+  const envUrl =
+    typeof import.meta.env?.VITE_OPENCODE_URL === "string"
+      ? import.meta.env.VITE_OPENCODE_URL.trim()
+      : "";
+  return envUrl || "http://127.0.0.1:4096";
+}
+
+type AppProvidersProps = {
+  children: ReactNode;
+};
+
+export function AppProviders({ children }: AppProvidersProps) {
+  hydrateOpenworkServerSettingsFromEnv();
+
+  useEffect(() => {
+    // Start the dev observability forwarder. Reads the current openwork-server
+    // URL on every flush so reconnects after port changes still work. In prod
+    // builds `startDebugLogger` is a no-op.
+    startDebugLogger({
+      serverUrl: async () => (await resolveOpenworkConnection()).normalizedBaseUrl,
+    });
+    return () => {
+      stopDebugLogger();
+    };
+  }, []);
+
+  const defaultUrl = resolveDefaultServerUrl();
+  return (
+    <BootStateProvider>
+      <ServerProvider defaultUrl={defaultUrl}>
+        <DesktopRuntimeBoot />
+        <DenAuthProvider>
+          <DesktopConfigProvider>
+            <RestrictionNoticeProvider>
+              <LocalProvider>
+                <StatusToastsProvider>
+                  <ReloadCoordinatorProvider>{children}</ReloadCoordinatorProvider>
+                </StatusToastsProvider>
+              </LocalProvider>
+            </RestrictionNoticeProvider>
+          </DesktopConfigProvider>
+        </DenAuthProvider>
+        <MigrationPrompt />
+      </ServerProvider>
+    </BootStateProvider>
+  );
+}
diff --git a/apps/app/src/react-app/shell/react-render-watchdog-overlay.tsx b/apps/app/src/react-app/shell/react-render-watchdog-overlay.tsx
new file mode 100644
index 0000000000..72f1b4db76
--- /dev/null
+++ b/apps/app/src/react-app/shell/react-render-watchdog-overlay.tsx
@@ -0,0 +1,144 @@
+/** @jsxImportSource react */
+import { useEffect, useState } from "react";
+
+import {
+  readReactRenderWatchdogSnapshot,
+  resetReactRenderWatchdogStats,
+} from "./react-render-watchdog";
+
+function readStoredPreference(): boolean {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.localStorage.getItem("openwork.debug.renderOverlay") === "1";
+  } catch {
+    return false;
+  }
+}
+
+function writeStoredPreference(value: boolean) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem("openwork.debug.renderOverlay", value ? "1" : "0");
+  } catch {
+    // ignore
+  }
+}
+
+export function ReactRenderWatchdogOverlay() {
+  const [visible, setVisible] = useState(readStoredPreference);
+  const [collapsed, setCollapsed] = useState(false);
+  const [snapshot, setSnapshot] = useState(readReactRenderWatchdogSnapshot);
+
+  useEffect(() => {
+    const handler = (event: KeyboardEvent) => {
+      const metaOrCtrl = event.metaKey || event.ctrlKey;
+      if (!metaOrCtrl || !event.shiftKey) return;
+      if (event.key.toLowerCase() !== "l") return;
+      event.preventDefault();
+      setVisible((current) => {
+        writeStoredPreference(!current);
+        return !current;
+      });
+    };
+    window.addEventListener("keydown", handler);
+    return () => window.removeEventListener("keydown", handler);
+  }, []);
+
+  useEffect(() => {
+    if (!visible) return;
+    const tick = () => setSnapshot(readReactRenderWatchdogSnapshot());
+    tick();
+    const interval = window.setInterval(tick, 500);
+    return () => window.clearInterval(interval);
+  }, [visible]);
+
+  if (!visible) return null;
+
+  const hot = snapshot.slice(0, 12);
+
+  return (
+    <div className="pointer-events-auto fixed bottom-3 left-3 z-[1100] w-[320px] overflow-hidden rounded-lg border border-dls-border bg-dls-canvas/95 text-[11px] text-dls-text shadow-lg backdrop-blur-sm">
+      <div className="flex items-center justify-between border-b border-dls-border px-2.5 py-1.5">
+        <div>
+          <div className="font-mono text-[10px] uppercase tracking-[0.14em] text-dls-secondary">
+            render watchdog
+          </div>
+          <div className="text-[10px] text-dls-secondary">
+            hottest committed React surfaces
+          </div>
+        </div>
+        <div className="flex items-center gap-1">
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={() => {
+              resetReactRenderWatchdogStats();
+              setSnapshot([]);
+            }}
+          >
+            reset
+          </button>
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={() => setCollapsed((value) => !value)}
+          >
+            {collapsed ? "+" : "–"}
+          </button>
+          <button
+            type="button"
+            className="rounded px-1.5 py-0.5 text-[10px] text-dls-secondary hover:bg-dls-hover"
+            onClick={() => {
+              writeStoredPreference(false);
+              setVisible(false);
+            }}
+            title="Hide (Cmd+Shift+L to toggle)"
+          >
+            ×
+          </button>
+        </div>
+      </div>
+      {collapsed ? null : (
+        <div className="max-h-[50vh] overflow-y-auto">
+          {hot.length === 0 ? (
+            <div className="px-3 py-3 text-dls-secondary">
+              No render samples yet. Interact with the app.
+            </div>
+          ) : (
+            <table className="w-full border-collapse">
+              <thead>
+                <tr className="text-[10px] uppercase tracking-[0.1em] text-dls-secondary">
+                  <th className="px-2 py-1 text-left font-medium">surface</th>
+                  <th className="px-2 py-1 text-right font-medium">2s</th>
+                  <th className="px-2 py-1 text-right font-medium">total</th>
+                  <th className="px-2 py-1 text-right font-medium">last</th>
+                </tr>
+              </thead>
+              <tbody>
+                {hot.map((item) => (
+                  <tr key={item.name} className="border-t border-dls-border">
+                    <td className="max-w-[160px] px-2 py-1 font-mono text-[11px] text-dls-text">
+                      <span className="block truncate" title={item.name}>{item.name}</span>
+                    </td>
+                    <td className="px-2 py-1 text-right tabular-nums">
+                      {item.windowCommits}
+                    </td>
+                    <td className="px-2 py-1 text-right tabular-nums text-dls-secondary">
+                      {item.totalCommits}
+                    </td>
+                    <td className="px-2 py-1 text-right tabular-nums text-dls-secondary">
+                      {Math.round(item.lastCommitAgeMs)}ms
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+        </div>
+      )}
+      <div className="border-t border-dls-border px-2.5 py-1 text-[10px] text-dls-secondary">
+        Cmd+Shift+L toggles. Also available in window.__openwork.slice("reactRenderWatchdog").
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/react-app/shell/react-render-watchdog.ts b/apps/app/src/react-app/shell/react-render-watchdog.ts
new file mode 100644
index 0000000000..f45ccb2d70
--- /dev/null
+++ b/apps/app/src/react-app/shell/react-render-watchdog.ts
@@ -0,0 +1,105 @@
+/** @jsxImportSource react */
+import { useEffect } from "react";
+
+import { publishInspectorSlice, recordInspectorEvent } from "./app-inspector";
+import { recordDebugLog } from "./debug-logger";
+
+type RenderWatchdogDetails = Record<string, unknown>;
+
+type RenderWatchdogStats = {
+  name: string;
+  totalCommits: number;
+  windowCommits: number;
+  windowStartedAt: number;
+  lastCommitAt: number;
+  lastWarnAt: number;
+  lastDetails?: RenderWatchdogDetails;
+};
+
+const WINDOW_MS = 2_000;
+const WARN_COMMIT_THRESHOLD = 40;
+const WARN_COOLDOWN_MS = 5_000;
+const statsByName = new Map<string, RenderWatchdogStats>();
+let inspectorInstalled = false;
+
+export function readReactRenderWatchdogSnapshot() {
+  return Array.from(statsByName.values())
+    .map((stats) => ({
+      name: stats.name,
+      totalCommits: stats.totalCommits,
+      windowCommits: stats.windowCommits,
+      windowAgeMs: Math.max(0, Date.now() - stats.windowStartedAt),
+      lastCommitAgeMs: Math.max(0, Date.now() - stats.lastCommitAt),
+      lastWarnAgeMs: stats.lastWarnAt > 0 ? Math.max(0, Date.now() - stats.lastWarnAt) : null,
+      lastDetails: stats.lastDetails ?? null,
+    }))
+    .sort((a, b) => b.windowCommits - a.windowCommits || b.totalCommits - a.totalCommits);
+}
+
+export function resetReactRenderWatchdogStats() {
+  statsByName.clear();
+}
+
+function installInspectorSlice() {
+  if (inspectorInstalled) return;
+  inspectorInstalled = true;
+  publishInspectorSlice("reactRenderWatchdog", () => ({
+    windowMs: WINDOW_MS,
+    warnCommitThreshold: WARN_COMMIT_THRESHOLD,
+    components: readReactRenderWatchdogSnapshot(),
+  }));
+}
+
+function recordCommit(name: string, details?: RenderWatchdogDetails) {
+  installInspectorSlice();
+  const now = Date.now();
+  let stats = statsByName.get(name);
+  if (!stats) {
+    stats = {
+      name,
+      totalCommits: 0,
+      windowCommits: 0,
+      windowStartedAt: now,
+      lastCommitAt: now,
+      lastWarnAt: 0,
+    };
+    statsByName.set(name, stats);
+  }
+
+  if (now - stats.windowStartedAt > WINDOW_MS) {
+    stats.windowStartedAt = now;
+    stats.windowCommits = 0;
+  }
+
+  stats.totalCommits += 1;
+  stats.windowCommits += 1;
+  stats.lastCommitAt = now;
+  stats.lastDetails = details;
+
+  if (
+    stats.windowCommits >= WARN_COMMIT_THRESHOLD &&
+    now - stats.lastWarnAt > WARN_COOLDOWN_MS
+  ) {
+    stats.lastWarnAt = now;
+    const payload = {
+      component: name,
+      windowCommits: stats.windowCommits,
+      windowMs: WINDOW_MS,
+      totalCommits: stats.totalCommits,
+      details: details ?? null,
+    };
+    recordInspectorEvent("react.render_loop_suspected", payload);
+    recordDebugLog({
+      level: "warn",
+      source: "react-render-watchdog",
+      message: "react.render_loop_suspected",
+      extra: payload,
+    });
+  }
+}
+
+export function useReactRenderWatchdog(name: string, details?: RenderWatchdogDetails) {
+  useEffect(() => {
+    recordCommit(name, details);
+  });
+}
diff --git a/apps/app/src/react-app/shell/reload-coordinator.tsx b/apps/app/src/react-app/shell/reload-coordinator.tsx
new file mode 100644
index 0000000000..2dc4060fc6
--- /dev/null
+++ b/apps/app/src/react-app/shell/reload-coordinator.tsx
@@ -0,0 +1,151 @@
+/** @jsxImportSource react */
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+
+import type { ReloadReason, ReloadTrigger } from "../../app/types";
+import { t } from "../../i18n";
+import { ReloadWorkspaceToast } from "../domains/shell-feedback/reload-workspace-toast";
+import { StatusToastsViewport } from "../domains/shell-feedback/status-toasts";
+import { useSystemState } from "../kernel/system-state";
+
+type ReloadSession = { id: string; title: string };
+
+export type WorkspaceReloadControls = {
+  canReloadWorkspaceEngine: () => boolean;
+  reloadWorkspaceEngine: () => Promise<boolean>;
+  activeSessions?: () => ReloadSession[];
+  stopSession?: (sessionId: string) => void | Promise<void>;
+};
+
+type ReloadCoordinatorContextValue = {
+  markReloadRequired: (reason: ReloadReason, trigger?: ReloadTrigger) => void;
+  clearReloadRequired: () => void;
+  reloadWorkspaceEngine: () => Promise<void>;
+  canReloadWorkspaceEngine: boolean;
+  registerWorkspaceReloadControls: (controls: WorkspaceReloadControls | null) => () => void;
+};
+
+const ReloadCoordinatorContext = createContext<ReloadCoordinatorContextValue | null>(null);
+
+export function ReloadCoordinatorProvider({ children }: { children: ReactNode }) {
+  const controlsRef = useRef<WorkspaceReloadControls | null>(null);
+  const [activeSessions, setActiveSessions] = useState<ReloadSession[]>([]);
+
+  const registerWorkspaceReloadControls = useCallback((controls: WorkspaceReloadControls | null) => {
+    controlsRef.current = controls;
+    setActiveSessions(controls?.activeSessions?.() ?? []);
+    return () => {
+      if (controlsRef.current === controls) {
+        controlsRef.current = null;
+        setActiveSessions([]);
+      }
+    };
+  }, []);
+
+  const hasActiveRuns = useCallback(() => activeSessions.length > 0, [activeSessions.length]);
+  const canReloadWorkspaceEngine = useCallback(
+    () => controlsRef.current?.canReloadWorkspaceEngine() === true,
+    [],
+  );
+  const reloadWorkspaceEngine = useCallback(async () => {
+    const controls = controlsRef.current;
+    if (!controls?.reloadWorkspaceEngine) return false;
+    return controls.reloadWorkspaceEngine();
+  }, []);
+  const ignoreError = useCallback(() => {}, []);
+
+  const systemStateOptions = useMemo(
+    () => ({
+      hasActiveRuns,
+      canReloadWorkspaceEngine,
+      reloadWorkspaceEngine,
+      setError: ignoreError,
+    }),
+    [canReloadWorkspaceEngine, hasActiveRuns, ignoreError, reloadWorkspaceEngine],
+  );
+
+  const systemState = useSystemState(systemStateOptions);
+
+  useEffect(() => {
+    const handler = (event: Event) => {
+      const detail = (event as CustomEvent<{ reason?: ReloadReason; trigger?: ReloadTrigger }>).detail;
+      systemState.markReloadRequired(detail?.reason ?? "config", detail?.trigger);
+    };
+    window.addEventListener("openwork-reload-required", handler);
+    return () => window.removeEventListener("openwork-reload-required", handler);
+  }, [systemState.markReloadRequired]);
+
+  const forceStopActiveSessionsAndReload = useCallback(async () => {
+    const controls = controlsRef.current;
+    if (controls?.stopSession) {
+      for (const session of activeSessions) {
+        await Promise.resolve(controls.stopSession(session.id)).catch(() => undefined);
+      }
+    }
+    await systemState.reloadWorkspaceEngine();
+  }, [activeSessions, systemState.reloadWorkspaceEngine]);
+
+  const value = useMemo<ReloadCoordinatorContextValue>(
+    () => ({
+      markReloadRequired: systemState.markReloadRequired,
+      clearReloadRequired: systemState.clearReloadRequired,
+      reloadWorkspaceEngine: systemState.reloadWorkspaceEngine,
+      canReloadWorkspaceEngine: systemState.canReloadWorkspaceEngine,
+      registerWorkspaceReloadControls,
+    }),
+    [
+      registerWorkspaceReloadControls,
+      systemState.canReloadWorkspaceEngine,
+      systemState.clearReloadRequired,
+      systemState.markReloadRequired,
+      systemState.reloadWorkspaceEngine,
+    ],
+  );
+
+  return (
+    <ReloadCoordinatorContext.Provider value={value}>
+      {children}
+      <div className="pointer-events-none fixed right-4 top-4 z-50 flex w-[min(24rem,calc(100vw-1.5rem))] max-w-full flex-col gap-3 sm:right-6 sm:top-6">
+        <div className="pointer-events-auto">
+          <ReloadWorkspaceToast
+            open={systemState.reload.reloadPending && activeSessions.length === 0}
+            title={systemState.reloadCopy.title}
+            description={systemState.reloadCopy.body}
+            trigger={systemState.reload.reloadTrigger}
+            error={systemState.reload.reloadError}
+            reloadLabel={
+              activeSessions.length > 0 ? t("app.reload_stop_tasks") : t("app.reload_now")
+            }
+            dismissLabel={t("app.reload_later")}
+            busy={systemState.reload.reloadBusy}
+            canReload={systemState.canReloadWorkspaceEngine}
+            hasActiveRuns={activeSessions.length > 0}
+            onReload={() => {
+              void (activeSessions.length > 0
+                ? forceStopActiveSessionsAndReload()
+                : systemState.reloadWorkspaceEngine());
+            }}
+            onDismiss={systemState.clearReloadRequired}
+          />
+        </div>
+        <StatusToastsViewport />
+      </div>
+    </ReloadCoordinatorContext.Provider>
+  );
+}
+
+export function useReloadCoordinator(): ReloadCoordinatorContextValue {
+  const value = useContext(ReloadCoordinatorContext);
+  if (!value) {
+    throw new Error("useReloadCoordinator must be used inside <ReloadCoordinatorProvider>");
+  }
+  return value;
+}
diff --git a/apps/app/src/react-app/shell/session-memory.ts b/apps/app/src/react-app/shell/session-memory.ts
new file mode 100644
index 0000000000..710ef523c6
--- /dev/null
+++ b/apps/app/src/react-app/shell/session-memory.ts
@@ -0,0 +1,94 @@
+/**
+ * Thin localStorage wrapper for the React shell's "remember what the user had
+ * open" behavior. Keys mirror those the Solid app used so users don't lose
+ * their spot when switching between shells during the port.
+ */
+
+const ACTIVE_WORKSPACE_KEY = "openwork.react.activeWorkspace";
+const SESSION_BY_WORKSPACE_KEY = "openwork.react.sessionByWorkspace";
+
+function safeGet(key: string): string | null {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+
+function safeSet(key: string, value: string | null): void {
+  if (typeof window === "undefined") return;
+  try {
+    if (value === null || value === "") {
+      window.localStorage.removeItem(key);
+      return;
+    }
+    window.localStorage.setItem(key, value);
+  } catch {
+    // ignore storage errors (quota, privacy modes, etc.)
+  }
+}
+
+export function readActiveWorkspaceId(): string | null {
+  const value = safeGet(ACTIVE_WORKSPACE_KEY);
+  return value?.trim() || null;
+}
+
+export function writeActiveWorkspaceId(id: string | null): void {
+  safeSet(ACTIVE_WORKSPACE_KEY, id?.trim() || null);
+}
+
+type SessionByWorkspace = Record<string, string>;
+
+function readSessionByWorkspaceMap(): SessionByWorkspace {
+  const raw = safeGet(SESSION_BY_WORKSPACE_KEY);
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const result: SessionByWorkspace = {};
+      for (const [key, value] of Object.entries(parsed as Record<string, unknown>)) {
+        if (typeof key === "string" && typeof value === "string") {
+          result[key] = value;
+        }
+      }
+      return result;
+    }
+  } catch {
+    // ignore malformed payload
+  }
+  return {};
+}
+
+export function readLastSessionFor(workspaceId: string): string | null {
+  const id = workspaceId?.trim();
+  if (!id) return null;
+  return readSessionByWorkspaceMap()[id] ?? null;
+}
+
+export function writeLastSessionFor(workspaceId: string, sessionId: string | null): void {
+  const wsId = workspaceId?.trim();
+  if (!wsId) return;
+  const map = readSessionByWorkspaceMap();
+  const normalized = sessionId?.trim() || "";
+  if (!normalized) {
+    if (!(wsId in map)) return;
+    delete map[wsId];
+  } else {
+    if (map[wsId] === normalized) return;
+    map[wsId] = normalized;
+  }
+  safeSet(SESSION_BY_WORKSPACE_KEY, Object.keys(map).length ? JSON.stringify(map) : null);
+}
+
+export function forgetWorkspaceMemory(workspaceId: string): void {
+  const wsId = workspaceId?.trim();
+  if (!wsId) return;
+  const map = readSessionByWorkspaceMap();
+  if (wsId in map) {
+    delete map[wsId];
+    safeSet(SESSION_BY_WORKSPACE_KEY, Object.keys(map).length ? JSON.stringify(map) : null);
+  }
+  const active = readActiveWorkspaceId();
+  if (active === wsId) writeActiveWorkspaceId(null);
+}
diff --git a/apps/app/src/react-app/shell/session-route.tsx b/apps/app/src/react-app/shell/session-route.tsx
new file mode 100644
index 0000000000..dd6e779474
--- /dev/null
+++ b/apps/app/src/react-app/shell/session-route.tsx
@@ -0,0 +1,2146 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import { useNavigate, useParams } from "react-router-dom";
+import type {
+  AgentPartInput,
+  ConfigProvidersResponse,
+  FilePartInput,
+  ProviderListResponse,
+  TextPartInput,
+} from "@opencode-ai/sdk/v2/client";
+
+import { createClient, unwrap } from "../../app/lib/opencode";
+import { listCommands, shellInSession } from "../../app/lib/opencode-session";
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  createOpenworkServerClient,
+  readOpenworkServerSettings,
+  type OpenworkServerClient,
+  type OpenworkWorkspaceInfo,
+} from "../../app/lib/openwork-server";
+import { buildOpenworkEnvRuntimeKey } from "../../app/lib/openwork-env-runtime";
+import {
+  engineInfo,
+  revealDesktopItemInDir,
+  pickDirectory,
+  resolveWorkspaceListSelectedId,
+  workspaceBootstrap,
+  workspaceCreate,
+  workspaceCreateRemote,
+  workspaceExportConfig,
+  workspaceForget,
+  workspaceSetRuntimeActive,
+  workspaceSetSelected,
+  workspaceUpdateDisplayName,
+  type EngineInfo,
+  type OpenworkServerInfo,
+  type WorkspaceInfo,
+  type WorkspaceList,
+} from "../../app/lib/desktop";
+import type {
+  ComposerAttachment,
+  ComposerDraft,
+  ComposerPart,
+  ModelOption,
+  ModelRef,
+  PendingPermission,
+  SlashCommandOption,
+  TodoItem,
+  WorkspacePreset,
+  WorkspaceConnectionState,
+  ProviderListItem,
+  WorkspaceSessionGroup,
+} from "../../app/types";
+import { buildFeedbackUrl } from "../../app/lib/feedback";
+import {
+  getWorkspaceTaskLoadErrorDisplay,
+  isDesktopRuntime,
+  isSandboxWorkspace,
+  normalizeDirectoryPath,
+  safeStringify,
+} from "../../app/utils";
+import { t } from "../../i18n";
+import { useLocal } from "../kernel/local-provider";
+import { usePlatform } from "../kernel/platform";
+import { SessionPage } from "../domains/session/chat/session-page";
+import { isDesktopProviderBlocked } from "../../app/cloud/desktop-app-restrictions";
+import { useCheckDesktopRestriction } from "../domains/cloud/desktop-config-provider";
+import { useRestrictionNotice } from "../domains/cloud/restriction-notice-provider";
+import { ReactSessionRuntime } from "../domains/session/sync/runtime-sync";
+import { buildOpenworkEnvSystemContext } from "../domains/session/sync/env-context";
+import {
+  permissionKey as reactPermissionKey,
+  seedPermissionState,
+} from "../domains/session/sync/session-sync";
+import { CreateRemoteWorkspaceModal } from "../domains/workspace/create-remote-workspace-modal";
+import { CreateWorkspaceModal } from "../domains/workspace/create-workspace-modal";
+import { useRemoteAccessRestart } from "../domains/workspace/remote-access-restart";
+import { RenameWorkspaceModal } from "../domains/workspace/rename-workspace-modal";
+import { useRemoteWorkspaceConnectionEditor } from "../domains/workspace/use-remote-workspace-connection-editor";
+import {
+  diagnoseRemoteWorkspaceTaskLoadFailure,
+  getRemoteWorkspaceConnectionKey,
+  testRemoteWorkspaceConnection,
+} from "../domains/workspace/remote-workspace-diagnostics";
+import { useShareWorkspaceState } from "../domains/workspace/share-workspace-state";
+import { ModelPickerModal } from "../domains/session/modals/model-picker-modal";
+import { CommandPalette, type SessionOption as PaletteSessionOption } from "./command-palette";
+import { getDisplaySessionTitle } from "../../app/lib/session-title";
+import { useBootState } from "./boot-state";
+import {
+  forgetWorkspaceMemory,
+  readActiveWorkspaceId,
+  readLastSessionFor,
+  writeActiveWorkspaceId,
+  writeLastSessionFor,
+} from "./session-memory";
+import {
+  publishInspectorSlice,
+  recordInspectorEvent,
+} from "./app-inspector";
+import { useControlAction, type OpenworkControlAction } from "./control/control-provider";
+import { useReactRenderWatchdog } from "./react-render-watchdog";
+import { getModelBehaviorSummary } from "../../app/lib/model-behavior";
+import { filterProviderList, mapConfigProvidersToList } from "../../app/utils/providers";
+import { ensureDesktopLocalOpenworkConnection } from "./desktop-local-openwork";
+import { resolveOpenworkConnection } from "./openwork-connection";
+import { useReloadCoordinator } from "./reload-coordinator";
+import { getReactQueryClient } from "../infra/query-client";
+import { useStatusToasts } from "../domains/shell-feedback/status-toasts";
+import { useSessionControlActions } from "../domains/session/control/session-control-actions";
+
+type RouteWorkspace = OpenworkWorkspaceInfo & {
+  displayNameResolved: string;
+};
+
+function mapDesktopWorkspace(workspace: WorkspaceInfo): RouteWorkspace {
+  return {
+    ...workspace,
+    displayNameResolved:
+      workspace.displayName?.trim() ||
+      workspace.name?.trim() ||
+      workspace.path?.trim() ||
+      t("session.workspace_fallback"),
+  };
+}
+
+/**
+ * Serialize an SDK error value into a string that parseSessionError can parse.
+ * Preserves the original shape (name, data, message) as JSON when possible,
+ * so the session surface can detect ProviderModelNotFoundError and offer
+ * recovery actions like "Change model".
+ */
+function serializeSDKError(error: unknown): string {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  if (typeof error === "object" && error !== null) {
+    try {
+      return JSON.stringify(error);
+    } catch {
+      const msg = (error as Record<string, unknown>).message;
+      return typeof msg === "string" ? msg : String(error);
+    }
+  }
+  return String(error);
+}
+
+function folderNameFromPath(path: string) {
+  const normalized = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? "workspace";
+}
+
+function isTransientStartupError(message: string | null | undefined) {
+  const value = (message ?? "").toLowerCase();
+  return (
+    value.includes("timed out") ||
+    value.includes("failed to fetch") ||
+    value.includes("connection") ||
+    value.includes("not ready")
+  );
+}
+
+function workspaceLabel(workspace: OpenworkWorkspaceInfo) {
+  return (
+    workspace.displayName?.trim() ||
+    workspace.openworkWorkspaceName?.trim() ||
+    workspace.name?.trim() ||
+    workspace.path?.trim() ||
+    t("session.workspace_fallback")
+  );
+}
+
+function describeRouteError(error: unknown) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  const serialized = safeStringify(error);
+  return serialized && serialized !== "{}" ? serialized : t("app.unknown_error");
+}
+
+function describeWorkspaceCreateError(error: unknown) {
+  const message = describeRouteError(error);
+  const lower = message.toLowerCase();
+  if (
+    lower.includes("operation timed out") ||
+    lower.includes("os error 60") ||
+    lower.includes("etimedout")
+  ) {
+    return `${message}\n\nOpenWork could not read the workspace config before the filesystem timed out. This often happens when the folder is still syncing from iCloud Drive or another remote folder. Wait for the folder to finish downloading, move the workspace to a local folder, or try again.`;
+  }
+  return message;
+}
+
+const emptyPendingPermissions: PendingPermission[] = [];
+
+function useQueryCacheState<T>(queryKey: readonly unknown[] | null, fallback: T): T {
+  const queryClient = getReactQueryClient();
+  return useSyncExternalStore(
+    (callback) => (queryKey ? queryClient.getQueryCache().subscribe(callback) : () => {}),
+    () => (queryKey ? queryClient.getQueryData<T>(queryKey) ?? fallback : fallback),
+    () => fallback,
+  );
+}
+
+function mergeRouteWorkspaces(
+  serverWorkspaces: OpenworkWorkspaceInfo[],
+  desktopWorkspaces: RouteWorkspace[],
+): RouteWorkspace[] {
+  const desktopById = new Map(desktopWorkspaces.map((workspace) => [workspace.id, workspace]));
+  const desktopByPath = new Map(
+    desktopWorkspaces
+      .map((workspace) => [normalizeDirectoryPath(workspace.path ?? ""), workspace] as const)
+      .filter(([path]) => path.length > 0),
+  );
+
+  const mergedServer = serverWorkspaces.map((workspace) => {
+    const match =
+      desktopById.get(workspace.id) ??
+      desktopByPath.get(normalizeDirectoryPath(workspace.path ?? ""));
+    const merged = match
+      ? {
+          ...workspace,
+          displayName: workspace.displayName?.trim()
+            ? workspace.displayName
+            : match.displayName,
+          name: match.name?.trim() ? match.name : workspace.name,
+        }
+      : workspace;
+    return {
+      ...merged,
+      displayNameResolved: workspaceLabel(merged),
+    };
+  });
+
+  const mergedIds = new Set(mergedServer.map((workspace) => workspace.id));
+  const mergedPaths = new Set(
+    mergedServer
+      .map((workspace) => normalizeDirectoryPath(workspace.path ?? ""))
+      .filter((path) => path.length > 0),
+  );
+
+  const missingDesktop = desktopWorkspaces.filter((workspace) => {
+    if (mergedIds.has(workspace.id)) return false;
+    const normalizedPath = normalizeDirectoryPath(workspace.path ?? "");
+    if (normalizedPath && mergedPaths.has(normalizedPath)) return false;
+    return true;
+  });
+
+  return [...mergedServer, ...missingDesktop];
+}
+
+function toSessionGroups(
+  workspaces: RouteWorkspace[],
+  sessionsByWorkspaceId: Record<string, any[]>,
+  errorsByWorkspaceId: Record<string, string | null>,
+  loadingWorkspaceIds: Set<string>,
+): WorkspaceSessionGroup[] {
+  return workspaces.map((workspace) => ({
+    workspace,
+    sessions: (sessionsByWorkspaceId[workspace.id] ?? []) as WorkspaceSessionGroup["sessions"],
+    status: loadingWorkspaceIds.has(workspace.id)
+      ? "loading"
+      : errorsByWorkspaceId[workspace.id]
+        ? "error"
+        : "ready",
+    error: errorsByWorkspaceId[workspace.id],
+  }));
+}
+
+function isActiveSessionStatus(status: unknown) {
+  return status === "running" || status === "retry" || status === "busy";
+}
+
+function getSessionStatus(session: any) {
+  return session?.status ?? session?.state ?? session?.runStatus ?? null;
+}
+
+async function fileToDataUrl(file: File) {
+  return await new Promise<string>((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onerror = () => reject(new Error(`Failed to read attachment: ${file.name}`));
+    reader.onload = () => resolve(typeof reader.result === "string" ? reader.result : "");
+    reader.readAsDataURL(file);
+  });
+}
+
+async function draftToParts(draft: ComposerDraft, workspaceRoot: string) {
+  const parts: Array<TextPartInput | FilePartInput | AgentPartInput> = [];
+  const root = workspaceRoot.trim();
+
+  const toAbsolutePath = (path: string) => {
+    const trimmed = path.trim();
+    if (!trimmed) return "";
+    if (trimmed.startsWith("/")) return trimmed;
+    if (/^[a-zA-Z]:\\/.test(trimmed)) return trimmed;
+    if (!root) return "";
+    return `${root}/${trimmed}`.replace(/\/\/+/g, "/");
+  };
+
+  const filenameFromPath = (path: string) => {
+    const normalized = path.replace(/\\/g, "/");
+    const segments = normalized.split("/").filter(Boolean);
+    return segments[segments.length - 1] ?? "file";
+  };
+
+  for (const part of draft.parts) {
+    if (part.type === "text") {
+      parts.push({ type: "text", text: part.text });
+      continue;
+    }
+    if (part.type === "paste") {
+      parts.push({ type: "text", text: part.text });
+      continue;
+    }
+    if (part.type === "agent") {
+      parts.push({ type: "agent", name: part.name });
+      continue;
+    }
+    if (part.type === "file") {
+      const absolute = toAbsolutePath(part.path);
+      if (!absolute) continue;
+      parts.push({
+        type: "file",
+        mime: "text/plain",
+        url: `file://${absolute}`,
+        filename: filenameFromPath(part.path),
+      });
+    }
+  }
+
+  for (const attachment of draft.attachments) {
+    parts.push({
+      type: "file",
+      url: await fileToDataUrl(attachment.file),
+      filename: attachment.name,
+      mime: attachment.mimeType,
+    });
+  }
+
+  return parts;
+}
+
+export function SessionRoute() {
+  const navigate = useNavigate();
+  const platform = usePlatform();
+  const local = useLocal();
+  const reloadCoordinator = useReloadCoordinator();
+  const { showToast } = useStatusToasts();
+  const checkDesktopRestriction = useCheckDesktopRestriction();
+  const restrictionNotice = useRestrictionNotice();
+  const params = useParams<{ sessionId?: string }>();
+  const selectedSessionId = params.sessionId?.trim() || null;
+
+  const { markRouteReady: markBootRouteReady } = useBootState();
+  const [loading, setLoading] = useState(true);
+  const [client, setClient] = useState<OpenworkServerClient | null>(null);
+  const [baseUrl, setBaseUrl] = useState("");
+  const [token, setToken] = useState("");
+  const [workspaces, setWorkspaces] = useState<RouteWorkspace[]>([]);
+  const [sessionsByWorkspaceId, setSessionsByWorkspaceId] = useState<Record<string, any[]>>({});
+  const [errorsByWorkspaceId, setErrorsByWorkspaceId] = useState<Record<string, string | null>>({});
+  const [workspaceConnectionOverrides, setWorkspaceConnectionOverrides] = useState<Record<string, WorkspaceConnectionState>>({});
+  const [routeError, setRouteError] = useState<string | null>(null);
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = useState<string>(() => readActiveWorkspaceId() ?? "");
+  const [selectedAgent, setSelectedAgent] = useState<string | null>(null);
+  // One-way latch for "a refreshRouteState is currently running"; prevents
+  // overlapping route refreshes from queueing up when the user clicks fast.
+  const refreshInFlightRef = useRef(false);
+  const reloadEventCursorByWorkspaceRef = useRef<Record<string, number | null>>({});
+  const workspacesRef = useRef<RouteWorkspace[]>([]);
+  const remoteWorkspaceCheckRunRef = useRef<Record<string, string>>({});
+  const remoteWorkspaceCheckRunCounterRef = useRef(0);
+  const sessionsByWorkspaceIdRef = useRef<Record<string, any[]>>({});
+  const startupRetryTimerRef = useRef<number | null>(null);
+  const [retryingWorkspaceIds, setRetryingWorkspaceIds] = useState<string[]>([]);
+  const launchActivatedWorkspaceIdsRef = useRef(new Set<string>());
+  const [createWorkspaceOpen, setCreateWorkspaceOpen] = useState(false);
+  const [createWorkspaceBusy, setCreateWorkspaceBusy] = useState(false);
+  const [createWorkspaceError, setCreateWorkspaceError] = useState<string | null>(null);
+  const [createWorkspaceRemoteBusy, setCreateWorkspaceRemoteBusy] = useState(false);
+  const [createWorkspaceRemoteError, setCreateWorkspaceRemoteError] = useState<string | null>(null);
+  const [renameWorkspaceId, setRenameWorkspaceId] = useState<string | null>(null);
+  const [renameWorkspaceTitle, setRenameWorkspaceTitle] = useState("");
+  const [renameWorkspaceBusy, setRenameWorkspaceBusy] = useState(false);
+  const [commandPaletteOpen, setCommandPaletteOpen] = useState(false);
+  // Model picker modal state (ported from settings-route; previously the
+  // session "Pick a model" button navigated to /settings/general, which is a
+  // dead-end). Loads providers lazily when the modal opens.
+  const [modelPickerOpen, setModelPickerOpen] = useState(false);
+  const [modelPickerQuery, setModelPickerQuery] = useState("");
+  const [modelOptions, setModelOptions] = useState<ModelOption[]>([]);
+  const [providers, setProviders] = useState<ProviderListItem[]>([]);
+  const [providerConnectedIds, setProviderConnectedIds] = useState<string[]>([]);
+  const [permissionReplyBusy, setPermissionReplyBusy] = useState(false);
+  const permissionReplyBusyRef = useRef(false);
+  // Provider catalog cache. Used to compute the reasoning/thinking variant
+  // options for whichever model is currently selected so the composer's
+  // behavior pill actually shows its options (bug: was empty before).
+  const [providerCatalog, setProviderCatalog] = useState<Record<string, Record<string, any>>>({});
+  const [openworkServerHostInfoState, setOpenworkServerHostInfoState] = useState<OpenworkServerInfo | null>(null);
+  useReactRenderWatchdog("SessionRoute", {
+    selectedSessionId,
+    selectedWorkspaceId,
+    loading,
+    workspaceCount: workspaces.length,
+    sessionGroupCount: Object.keys(sessionsByWorkspaceId).length,
+    commandPaletteOpen,
+    modelPickerOpen,
+  });
+  const [openworkServerSettingsVersion, setOpenworkServerSettingsVersion] = useState(0);
+  const [engineReloadVersion, setEngineReloadVersion] = useState(0);
+  const [routeEngineInfo, setRouteEngineInfo] = useState<EngineInfo | null>(null);
+  const reconnectAttemptedWorkspaceIdRef = useRef("");
+
+  const openworkServerSettings = useMemo(
+    () => readOpenworkServerSettings(),
+    [openworkServerSettingsVersion],
+  );
+
+  const shareWorkspaceState = useShareWorkspaceState({
+    workspaces,
+    openworkServerHostInfo: openworkServerHostInfoState,
+    openworkServerSettings,
+    engineInfo: routeEngineInfo,
+    exportWorkspaceBusy: false,
+    openLink: (url) => platform.openLink(url),
+    workspaceLabel,
+  });
+
+  const activeReloadBlockingSessions = useMemo(
+    () =>
+      Object.values(sessionsByWorkspaceId)
+        .flat()
+        .filter((session) => isActiveSessionStatus(getSessionStatus(session)))
+        .map((session: any) => ({
+          id: String(session?.id ?? ""),
+          title:
+            String(session?.title ?? session?.slug ?? session?.id ?? "").trim() ||
+            t("session.untitled"),
+        }))
+        .filter((session) => session.id.length > 0),
+    [sessionsByWorkspaceId],
+  );
+
+  const backgroundSessionLoadInFlight = useRef<Map<string, number>>(new Map());
+  const loadWorkspaceSessionsInBackground = useCallback(
+    async (openworkClient: OpenworkServerClient, workspaces: RouteWorkspace[]) => {
+      const MAX_ATTEMPTS = 6;
+      const backoffMs = (attempt: number) => Math.min(500 * Math.pow(2, attempt), 4_000);
+
+      const fetchOnce = async (workspace: RouteWorkspace, attempt: number): Promise<void> => {
+        const startedAt = backgroundSessionLoadInFlight.current.get(workspace.id) ?? 0;
+        if (startedAt && Date.now() - startedAt < 5_000) return;
+        const requestStartedAt = Date.now();
+        backgroundSessionLoadInFlight.current.set(workspace.id, requestStartedAt);
+        try {
+          const response = await openworkClient.listSessions(workspace.id, { limit: 200 });
+          const workspaceRoot = normalizeDirectoryPath(workspace.path ?? "");
+          const items = workspaceRoot
+            ? (response.items ?? []).filter((session: any) =>
+                normalizeDirectoryPath(session?.directory ?? "") === workspaceRoot,
+              )
+            : (response.items ?? []);
+          setSessionsByWorkspaceId((current) => ({ ...current, [workspace.id]: items }));
+          setErrorsByWorkspaceId((current) => ({ ...current, [workspace.id]: null }));
+          setWorkspaceConnectionOverrides((current) => {
+            if (current[workspace.id]?.status !== "error") return current;
+            const next = { ...current };
+            delete next[workspace.id];
+            return next;
+          });
+          setRetryingWorkspaceIds((current) =>
+            current.includes(workspace.id) ? current.filter((id) => id !== workspace.id) : current,
+          );
+        } catch (error) {
+          const message = error instanceof Error ? error.message : t("app.unknown_error");
+          // The first cold call to OpenCode's /session endpoint often hits
+          // the 12s server timeout while the daemon finishes warming up
+          // its index. Retry silently with backoff until we get a response
+          // or run out of attempts — the sidebar keeps its "loading" state
+          // in the meantime instead of flashing "error" next to the
+          // workspace name.
+          if (attempt + 1 < MAX_ATTEMPTS && isTransientStartupError(message)) {
+            if (backgroundSessionLoadInFlight.current.get(workspace.id) === requestStartedAt) {
+              backgroundSessionLoadInFlight.current.delete(workspace.id);
+            }
+            await new Promise((r) => window.setTimeout(r, backoffMs(attempt)));
+            await fetchOnce(workspace, attempt + 1);
+            return;
+          }
+          // Final failure: keep local workspace startup quiet, but give
+          // remote workers a precise endpoint/token/workspace diagnostic.
+          if (workspace.workspaceType === "remote") {
+            const connectionState = await diagnoseRemoteWorkspaceTaskLoadFailure(workspace, message);
+            setErrorsByWorkspaceId((current) => ({
+              ...current,
+              [workspace.id]: connectionState.message ?? "Remote worker connection failed.",
+            }));
+            setWorkspaceConnectionOverrides((current) => {
+              if (current[workspace.id]?.status === "connecting") return current;
+              return {
+                ...current,
+                [workspace.id]: connectionState,
+              };
+            });
+          }
+          setRetryingWorkspaceIds((current) =>
+            current.includes(workspace.id) ? current.filter((id) => id !== workspace.id) : current,
+          );
+        } finally {
+          if (backgroundSessionLoadInFlight.current.get(workspace.id) === requestStartedAt) {
+            backgroundSessionLoadInFlight.current.delete(workspace.id);
+          }
+        }
+      };
+
+      await Promise.all(workspaces.map((workspace) => fetchOnce(workspace, 0)));
+    },
+    [],
+  );
+
+  const refreshRouteState = useCallback(async () => {
+    // Dedupe: if a refresh is already running, skip this call. Fast workspace
+    // switches used to fire 5-6 overlapping refreshRouteState() calls which
+    // each fetched workspaces + sessions for every workspace. That workload
+    // multiplied quickly on the event loop and caused the UI to freeze.
+    if (refreshInFlightRef.current) return;
+    refreshInFlightRef.current = true;
+    setLoading(true);
+    setRouteError(null);
+    let desktopList = null as Awaited<ReturnType<typeof workspaceBootstrap>> | null;
+    let desktopWorkspaces = workspacesRef.current;
+    let routeReadyAfterRefresh = true;
+    try {
+      if (isDesktopRuntime()) {
+        try {
+          desktopList = await workspaceBootstrap();
+          desktopWorkspaces = (desktopList.workspaces ?? []).map(mapDesktopWorkspace);
+        } catch (error) {
+          const message = describeRouteError(error);
+          console.error("[session-route] workspaceBootstrap failed", error);
+          recordInspectorEvent("route.workspace_bootstrap.error", {
+            route: "session",
+            message,
+            preservedWorkspaceCount: workspacesRef.current.length,
+          });
+          desktopWorkspaces = workspacesRef.current;
+        }
+      }
+
+      const { normalizedBaseUrl, resolvedToken, resolvedHostToken, hostInfo } = await resolveOpenworkConnection();
+      setOpenworkServerHostInfoState(hostInfo);
+      if (!normalizedBaseUrl || !resolvedToken) {
+        setClient(null);
+        setBaseUrl("");
+        setToken("");
+        setWorkspaces(desktopWorkspaces);
+        setSessionsByWorkspaceId({});
+        setErrorsByWorkspaceId({});
+        setSelectedWorkspaceId(resolveWorkspaceListSelectedId(desktopList) || desktopWorkspaces[0]?.id || "");
+        return;
+      }
+
+      const openworkClient = createOpenworkServerClient({
+        baseUrl: normalizedBaseUrl,
+        token: resolvedToken,
+        hostToken: resolvedHostToken || undefined,
+      });
+      const list = await openworkClient.listWorkspaces();
+      const nextWorkspaces = mergeRouteWorkspaces(list.items, desktopWorkspaces);
+
+      // Preserve any sessions we already have cached so switching routes
+      // doesn't erase the sidebar while we refetch.
+      const cachedEntries = nextWorkspaces.map((workspace) => ({
+        workspaceId: workspace.id,
+        sessions: sessionsByWorkspaceIdRef.current[workspace.id] ?? [],
+      }));
+      // Prefer, in order: the URL-selected workspace (if it owns the session),
+      // the user's last-active workspace from localStorage, the desktop's
+      // activeId, the server's activeId, then the first known workspace.
+      const persistedActiveId = readActiveWorkspaceId();
+      let nextWorkspaceId =
+        (persistedActiveId && nextWorkspaces.some((w) => w.id === persistedActiveId)
+          ? persistedActiveId
+          : "") ||
+        resolveWorkspaceListSelectedId(desktopList) ||
+        list.activeId?.trim() ||
+        nextWorkspaces[0]?.id ||
+        "";
+      if (selectedSessionId) {
+        const match = cachedEntries.find((entry) =>
+          entry.sessions.some((session: any) => session?.id === selectedSessionId),
+        );
+        if (match?.workspaceId) nextWorkspaceId = match.workspaceId;
+      }
+
+      setClient(openworkClient);
+      setBaseUrl(normalizedBaseUrl);
+      setToken(resolvedToken);
+      setWorkspaces(nextWorkspaces);
+      setSessionsByWorkspaceId(Object.fromEntries(cachedEntries.map((entry) => [entry.workspaceId, entry.sessions])));
+      setErrorsByWorkspaceId((previous) => {
+        const next: Record<string, string | null> = {};
+        for (const workspace of nextWorkspaces) {
+          next[workspace.id] = previous[workspace.id] ?? null;
+        }
+        return next;
+      });
+      setRetryingWorkspaceIds(
+        cachedEntries.find((entry) => entry.workspaceId === nextWorkspaceId)?.sessions.length === 0 && nextWorkspaceId
+          ? [nextWorkspaceId]
+          : [],
+      );
+      setSelectedWorkspaceId(nextWorkspaceId);
+      writeActiveWorkspaceId(nextWorkspaceId || null);
+      // Mark the chosen workspace as active on the server so that the
+      // OpenCode engine bound to it re-reads opencode.jsonc and applies
+      // permissions. Fire-and-forget; the route is idempotent and any
+      // transport failure is non-fatal. See issue #870.
+      if (nextWorkspaceId && !launchActivatedWorkspaceIdsRef.current.has(nextWorkspaceId)) {
+        launchActivatedWorkspaceIdsRef.current.add(nextWorkspaceId);
+        void openworkClient.activateWorkspace(nextWorkspaceId).catch(() => undefined);
+      }
+      recordInspectorEvent("route.refresh.complete", {
+        workspaces: nextWorkspaces.length,
+        selectedWorkspaceId: nextWorkspaceId,
+        errors: {},
+      });
+
+      // Session list comes from OpenCode's index and can be slow on cold
+      // boot. Kick it off in the background instead of blocking the route
+      // so the UI is interactive immediately; the sidebar shows a
+      // loading state per-workspace until the list arrives.
+      const selectedWorkspace = nextWorkspaces.find((workspace) => workspace.id === nextWorkspaceId);
+      if (selectedWorkspace) {
+        void loadWorkspaceSessionsInBackground(openworkClient, [selectedWorkspace]);
+      }
+    } catch (error) {
+      const message = describeRouteError(error);
+      console.error("[session-route] refreshRouteState failed", error);
+      recordInspectorEvent("route.refresh.error", {
+        route: "session",
+        message,
+        preservedWorkspaceCount: desktopWorkspaces.length,
+      });
+      setRouteError(message);
+      if (desktopWorkspaces.length > 0) {
+        setWorkspaces(desktopWorkspaces);
+        setSelectedWorkspaceId((current) =>
+          current || resolveWorkspaceListSelectedId(desktopList) || desktopWorkspaces[0]?.id || "",
+        );
+      }
+    } finally {
+      setLoading(false);
+      refreshInFlightRef.current = false;
+      // Tell the boot overlay the first route data load has completed so
+      // the overlay dismisses after BOTH the desktop boot and the workspace
+      // list/sessions are ready.
+      if (routeReadyAfterRefresh) {
+        markBootRouteReady();
+      }
+    }
+  }, [loadWorkspaceSessionsInBackground, markBootRouteReady, selectedSessionId]);
+
+  const remoteAccessRestart = useRemoteAccessRestart({
+    isEnabled: () => openworkServerSettings.remoteAccessEnabled === true,
+    onHostInfo: setOpenworkServerHostInfoState,
+    onSettingsChanged: () => setOpenworkServerSettingsVersion((value) => value + 1),
+  });
+
+  const reloadWorkspaceEngineFromUi = useCallback(async () => {
+    if (!client || !selectedWorkspaceId) {
+      setRouteError(t("app.error_connect_first"));
+      return false;
+    }
+    await client.reloadEngine(selectedWorkspaceId);
+    setEngineReloadVersion((v) => v + 1);
+    try {
+      window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+    } catch {
+      // ignore browser event dispatch failures
+    }
+    await refreshRouteState();
+    return true;
+  }, [client, refreshRouteState, selectedWorkspaceId]);
+
+  useEffect(() => {
+    return reloadCoordinator.registerWorkspaceReloadControls({
+      canReloadWorkspaceEngine: () => Boolean(client && selectedWorkspaceId),
+      reloadWorkspaceEngine: reloadWorkspaceEngineFromUi,
+      activeSessions: () => activeReloadBlockingSessions,
+    });
+  }, [activeReloadBlockingSessions, client, reloadCoordinator, reloadWorkspaceEngineFromUi, selectedWorkspaceId]);
+
+  useEffect(() => {
+    if (!client || !selectedWorkspaceId) return;
+    let cancelled = false;
+
+    const pollReloadEvents = async () => {
+      const currentCursor = reloadEventCursorByWorkspaceRef.current[selectedWorkspaceId];
+      try {
+        const response = await client.listReloadEvents(
+          selectedWorkspaceId,
+          typeof currentCursor === "number" ? { since: currentCursor } : undefined,
+        );
+        if (cancelled) return;
+        reloadEventCursorByWorkspaceRef.current[selectedWorkspaceId] =
+          typeof response.cursor === "number"
+            ? response.cursor
+            : Math.max(currentCursor ?? 0, ...((response.items ?? []).map((item: any) => Number(item.seq) || 0)));
+        // The first poll establishes the server cursor so historical reload
+        // events don't show a stale toast on route entry. Subsequent polls mark
+        // new filesystem/server-side mutations, including skills created by an
+        // agent while the session page is open.
+        if (currentCursor === undefined || currentCursor === null) return;
+        for (const event of response.items ?? []) {
+          reloadCoordinator.markReloadRequired(event.reason, event.trigger);
+        }
+      } catch {
+        // Reload-event polling is best-effort; normal route health checks still
+        // surface connection failures.
+      }
+    };
+
+    void pollReloadEvents();
+    const interval = window.setInterval(() => void pollReloadEvents(), 3000);
+    return () => {
+      cancelled = true;
+      window.clearInterval(interval);
+    };
+  }, [client, reloadCoordinator, selectedWorkspaceId]);
+
+  useEffect(() => {
+    if (!client || !selectedWorkspaceId || !selectedSessionId) return;
+    let cancelled = false;
+
+    const refreshSelectedSessionTitle = async () => {
+      try {
+        const response = await client.getSession(selectedWorkspaceId, selectedSessionId);
+        if (cancelled || !response.item) return;
+        setSessionsByWorkspaceId((current) => {
+          const list = current[selectedWorkspaceId] ?? [];
+          const index = list.findIndex((session: any) => session?.id === selectedSessionId);
+          if (index < 0) return current;
+          const nextSession = { ...list[index], ...response.item };
+          if (JSON.stringify(nextSession) === JSON.stringify(list[index])) return current;
+          const nextList = [...list];
+          nextList[index] = nextSession;
+          return { ...current, [selectedWorkspaceId]: nextList };
+        });
+      } catch {
+        // Best-effort title sync; the session surface still owns messages.
+      }
+    };
+
+    void refreshSelectedSessionTitle();
+    const interval = window.setInterval(() => void refreshSelectedSessionTitle(), 3_000);
+    return () => {
+      cancelled = true;
+      window.clearInterval(interval);
+    };
+  }, [client, selectedSessionId, selectedWorkspaceId]);
+
+  useEffect(() => {
+    workspacesRef.current = workspaces;
+  }, [workspaces]);
+
+  useEffect(() => {
+    const activeWorkspaceIds = new Set(workspaces.map((workspace) => workspace.id));
+    setWorkspaceConnectionOverrides((current) => {
+      let changed = false;
+      const next: Record<string, WorkspaceConnectionState> = {};
+      for (const [workspaceId, state] of Object.entries(current)) {
+        if (activeWorkspaceIds.has(workspaceId)) {
+          next[workspaceId] = state;
+        } else {
+          changed = true;
+        }
+      }
+      return changed ? next : current;
+    });
+  }, [workspaces]);
+
+  useEffect(() => {
+    sessionsByWorkspaceIdRef.current = sessionsByWorkspaceId;
+  }, [sessionsByWorkspaceId]);
+
+  const handleRemoteWorkspaceConnectionSaved = useCallback(
+    async (workspaceId: string) => {
+      delete remoteWorkspaceCheckRunRef.current[workspaceId];
+      setWorkspaceConnectionOverrides((current) => {
+        const next = { ...current };
+        delete next[workspaceId];
+        return next;
+      });
+      setErrorsByWorkspaceId((current) => ({ ...current, [workspaceId]: null }));
+      setRetryingWorkspaceIds((current) => current.filter((id) => id !== workspaceId));
+      await refreshRouteState();
+    },
+    [refreshRouteState],
+  );
+
+  const remoteWorkspaceConnectionEditor = useRemoteWorkspaceConnectionEditor({
+    workspaces,
+    onSaved: handleRemoteWorkspaceConnectionSaved,
+  });
+
+  useEffect(() => {
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        if (cancelled) return;
+        await refreshRouteState();
+      } finally {
+        if (cancelled) return;
+      }
+    })();
+
+    const handleSettingsChange = () => {
+      setOpenworkServerSettingsVersion((value) => value + 1);
+      // Self-heal: if the previous refresh got stuck mid-flight (e.g. macOS
+      // backgrounded the webview and never let a fetch resolve), clear the
+      // guard so a re-entry after resume actually goes through.
+      refreshInFlightRef.current = false;
+      void refreshRouteState();
+    };
+    window.addEventListener("openwork-server-settings-changed", handleSettingsChange);
+
+    // Also retry on visibility flip independently — even when nobody else
+    // dispatches the settings event.
+    const handleVisibility = () => {
+      if (typeof document === "undefined") return;
+      if (document.visibilityState !== "visible") return;
+      refreshInFlightRef.current = false;
+      void refreshRouteState();
+    };
+    if (typeof document !== "undefined") {
+      document.addEventListener("visibilitychange", handleVisibility);
+    }
+
+    return () => {
+      cancelled = true;
+      if (startupRetryTimerRef.current !== null) {
+        window.clearTimeout(startupRetryTimerRef.current);
+        startupRetryTimerRef.current = null;
+      }
+      window.removeEventListener("openwork-server-settings-changed", handleSettingsChange);
+      if (typeof document !== "undefined") {
+        document.removeEventListener("visibilitychange", handleVisibility);
+      }
+    };
+  }, [refreshRouteState]);
+
+  useEffect(() => {
+    if (!isDesktopRuntime()) return;
+    let cancelled = false;
+    void engineInfo()
+      .then((info) => {
+        if (!cancelled) setRouteEngineInfo(info);
+      })
+      .catch(() => {
+        if (!cancelled) setRouteEngineInfo(null);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  // Inspector wiring: publish the route's current state so an external
+  // operator (or an AI driver like Chrome MCP) can call
+  // `window.__openwork.snapshot()` or `window.__openwork.slice("route")` and
+  // see workspaces / sessions / connection info without walking the DOM.
+  useEffect(() => {
+    const dispose = publishInspectorSlice("route", () => ({
+      loading,
+      retryingWorkspaceIds,
+      baseUrl,
+      tokenPresent: token.length > 0,
+      connected: Boolean(client),
+      routeError,
+      selectedSessionId,
+      selectedWorkspaceId,
+      persistedActiveWorkspaceId: readActiveWorkspaceId(),
+      workspaces: workspaces.map((workspace) => ({
+        id: workspace.id,
+        displayNameResolved: workspace.displayNameResolved,
+        workspaceType: workspace.workspaceType,
+        path: workspace.path,
+        sessionCount: (sessionsByWorkspaceId[workspace.id] ?? []).length,
+        loading: retryingWorkspaceIds.includes(workspace.id),
+        error: errorsByWorkspaceId[workspace.id] ?? null,
+      })),
+      sessionsByWorkspaceId: Object.fromEntries(
+        Object.entries(sessionsByWorkspaceId).map(([wsId, items]) => [
+          wsId,
+          (items ?? []).map((session: any) => ({
+            id: session?.id ?? null,
+            title: session?.title ?? null,
+            directory: session?.directory ?? null,
+          })),
+        ]),
+      ),
+    }));
+    return dispose;
+  }, [
+    baseUrl,
+    client,
+    errorsByWorkspaceId,
+    loading,
+    retryingWorkspaceIds,
+    selectedSessionId,
+    selectedWorkspaceId,
+    routeError,
+    sessionsByWorkspaceId,
+    token,
+    workspaces,
+  ]);
+
+  // Once workspaces + sessions are loaded and the URL has no sessionId, try to
+  // restore the last session the user opened in the active workspace.
+  useEffect(() => {
+    if (loading) return;
+    if (selectedSessionId) return;
+    if (!selectedWorkspaceId) return;
+    const remembered = readLastSessionFor(selectedWorkspaceId);
+    if (!remembered) return;
+    const sessions = sessionsByWorkspaceId[selectedWorkspaceId] ?? [];
+    if (!sessions.some((session: any) => session?.id === remembered)) return;
+    navigate(`/session/${remembered}`, { replace: true });
+  }, [loading, navigate, selectedSessionId, selectedWorkspaceId, sessionsByWorkspaceId]);
+
+  // Redirect to /welcome when no workspaces exist and the user hasn't
+  // completed onboarding. This fires after the initial route refresh so
+  // `loading` is false and we know for sure there are zero workspaces.
+  useEffect(() => {
+    if (loading) return;
+    if (workspaces.length > 0) return;
+    if (local.prefs.hasCompletedOnboarding) return;
+    navigate("/welcome", { replace: true });
+  }, [loading, local.prefs.hasCompletedOnboarding, navigate, workspaces.length]);
+
+  // NOTE: Blueprint seeding was removed from the route.
+  // It was firing `materializeBlueprintSessions` + a session re-fetch on every
+  // workspace change, which cascaded setState updates and froze the UI after
+  // a few rapid switches. Empty workspaces now simply show "No tasks yet." and
+  // the user creates their first session explicitly via "New task". Seeding
+  // can be reintroduced later as a one-shot triggered from a button or from
+  // the onboarding flow, not from the route effect loop.
+
+  const workspaceSessionGroups = useMemo(
+    () => toSessionGroups(workspaces, sessionsByWorkspaceId, errorsByWorkspaceId, new Set(retryingWorkspaceIds)),
+    [errorsByWorkspaceId, retryingWorkspaceIds, sessionsByWorkspaceId, workspaces],
+  );
+
+  const selectedWorkspace = useMemo(
+    () => workspaces.find((workspace) => workspace.id === selectedWorkspaceId) ?? workspaces[0] ?? null,
+    [selectedWorkspaceId, workspaces],
+  );
+  const workspaceConnectionStateById = useMemo(() => {
+    const next: Record<string, WorkspaceConnectionState> = { ...workspaceConnectionOverrides };
+    for (const workspace of workspaces) {
+      if (workspace.workspaceType !== "remote") continue;
+      const error = errorsByWorkspaceId[workspace.id]?.trim();
+      if (!error || next[workspace.id]?.status === "connecting") continue;
+      next[workspace.id] ??= {
+        status: "error",
+        message: getWorkspaceTaskLoadErrorDisplay(workspace, error).message || error,
+        checkedAt: null,
+      };
+    }
+    return next;
+  }, [errorsByWorkspaceId, workspaceConnectionOverrides, workspaces]);
+
+  useEffect(() => {
+    if (!isDesktopRuntime()) return;
+    if (loading) return;
+    if (client) {
+      reconnectAttemptedWorkspaceIdRef.current = "";
+      return;
+    }
+    if (!selectedWorkspace || selectedWorkspace.workspaceType !== "local") return;
+    const workspaceId = selectedWorkspace.id?.trim() ?? "";
+    if (!workspaceId || reconnectAttemptedWorkspaceIdRef.current === workspaceId) return;
+    reconnectAttemptedWorkspaceIdRef.current = workspaceId;
+
+    void ensureDesktopLocalOpenworkConnection({
+      route: "session",
+      workspace: selectedWorkspace,
+      allWorkspaces: workspaces,
+    }).catch((error) => {
+      const message = error instanceof Error ? error.message : describeRouteError(error);
+      setRouteError(message);
+    });
+  }, [client, loading, selectedWorkspace, workspaces]);
+
+  const selectedWorkspaceRoot = selectedWorkspace?.path?.trim() || "";
+  const opencodeBaseUrl = useMemo(() => {
+    if (!selectedWorkspaceId || !baseUrl) return "";
+    const mounted = buildOpenworkWorkspaceBaseUrl(baseUrl, selectedWorkspaceId) ?? baseUrl;
+    return `${mounted.replace(/\/+$|\/+$/g, "")}/opencode`;
+  }, [baseUrl, selectedWorkspaceId]);
+  const selectedWorkspaceIsLoading = retryingWorkspaceIds.includes(selectedWorkspaceId);
+  const selectedWorkspaceError = errorsByWorkspaceId[selectedWorkspaceId] ?? null;
+  // Boot-level loading blocks the whole UI. Session-list retries only fill the
+  // sidebar; they must not gate the composer/New task.
+  const effectiveLoading = loading;
+
+  const opencodeClient = useMemo(
+    () =>
+      opencodeBaseUrl && token && !selectedWorkspaceError
+        ? createClient(opencodeBaseUrl, selectedWorkspaceRoot || undefined, {
+            token,
+            mode: "openwork",
+          })
+        : null,
+    [opencodeBaseUrl, selectedWorkspaceError, selectedWorkspaceRoot, token],
+  );
+  const canCreateTask = Boolean(
+    opencodeClient && selectedWorkspaceId && !loading && !selectedWorkspaceError,
+  );
+  const permissionQueryKey = useMemo(
+    () =>
+      selectedWorkspaceId && selectedSessionId
+        ? reactPermissionKey(selectedWorkspaceId, selectedSessionId)
+        : null,
+    [selectedSessionId, selectedWorkspaceId],
+  );
+  const pendingPermissions = useQueryCacheState<PendingPermission[]>(
+    permissionQueryKey,
+    emptyPendingPermissions,
+  );
+  useEffect(() => {
+    if (!opencodeClient || !selectedWorkspaceId || !selectedSessionId) return;
+    let cancelled = false;
+    const directory = selectedWorkspaceRoot || undefined;
+    void (async () => {
+      const snapshotStartedAt = Date.now();
+      try {
+        const list = unwrap(await opencodeClient.permission.list({ directory }));
+        if (!cancelled) {
+          seedPermissionState(selectedWorkspaceId, selectedSessionId, list, { snapshotStartedAt });
+        }
+      } catch {
+        // Keep event-synced permission state if the snapshot read fails.
+        // Hiding a pending approval can block the running task.
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [opencodeClient, selectedSessionId, selectedWorkspaceId, selectedWorkspaceRoot]);
+
+  const activePermission = pendingPermissions[0] ?? null;
+  const respondPermission = useCallback(
+    async (requestID: string, reply: "once" | "always" | "reject") => {
+      if (!opencodeClient || !selectedWorkspaceId || !selectedSessionId) return;
+      if (permissionReplyBusyRef.current) return;
+      permissionReplyBusyRef.current = true;
+      setPermissionReplyBusy(true);
+      try {
+        unwrap(
+          await opencodeClient.permission.reply({
+            requestID,
+            reply,
+            directory: selectedWorkspaceRoot || undefined,
+          }),
+        );
+        getReactQueryClient().setQueryData<PendingPermission[]>(
+          reactPermissionKey(selectedWorkspaceId, selectedSessionId),
+          (current = []) => current.filter((permission) => permission.id !== requestID),
+        );
+      } catch (error) {
+        showToast({
+          title: t("app.error_request_failed"),
+          description: describeRouteError(error),
+          tone: "error",
+        });
+      } finally {
+        permissionReplyBusyRef.current = false;
+        setPermissionReplyBusy(false);
+      }
+    },
+    [opencodeClient, selectedSessionId, selectedWorkspaceId, selectedWorkspaceRoot, showToast],
+  );
+  const showPreparingStatus =
+    effectiveLoading ||
+    (!canCreateTask && !routeError && !selectedWorkspaceError);
+
+  useEffect(() => {
+    if (!opencodeClient) {
+      setProviders([]);
+      setProviderConnectedIds([]);
+      return;
+    }
+
+    let cancelled = false;
+
+    const applyProviderState = (value: ProviderListResponse) => {
+      if (cancelled) return;
+      setProviders((value.all ?? []) as ProviderListItem[]);
+      setProviderConnectedIds(value.connected ?? []);
+    };
+
+    void (async () => {
+      let disabledProviders: string[] = [];
+      try {
+        const config = unwrap(
+          await opencodeClient.config.get({
+            directory: selectedWorkspaceRoot || undefined,
+          }),
+        ) as { disabled_providers?: string[] };
+        disabledProviders = Array.isArray(config.disabled_providers)
+          ? config.disabled_providers
+          : [];
+      } catch {
+        // ignore config read failures and continue with provider discovery
+      }
+
+      try {
+        applyProviderState(
+          filterProviderList(
+            unwrap(await opencodeClient.provider.list()),
+            disabledProviders,
+          ),
+        );
+      } catch {
+        try {
+          const fallback = unwrap(
+            await opencodeClient.config.providers({
+              directory: selectedWorkspaceRoot || undefined,
+            }),
+          ) as ConfigProvidersResponse;
+          applyProviderState(
+            filterProviderList(
+              {
+                all: mapConfigProvidersToList(
+                  fallback.providers,
+                ) as ProviderListResponse["all"],
+                connected: [],
+                default: fallback.default,
+              },
+              disabledProviders,
+            ),
+          );
+        } catch {
+          if (cancelled) return;
+          setProviders([]);
+          setProviderConnectedIds([]);
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [opencodeClient, selectedWorkspaceRoot]);
+
+  const modelLabel = local.prefs.defaultModel
+    ? `${local.prefs.defaultModel.providerID}/${local.prefs.defaultModel.modelID}`
+    : t("session.default_model");
+
+  // Prefetch the full provider catalog once so `getModelBehaviorSummary` has
+  // everything it needs to expose the reasoning/thinking variants the active
+  // model supports — without waiting for the model picker to open. Cached
+  // as providerID → modelID → ProviderModel.
+  useEffect(() => {
+    if (!opencodeClient) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await opencodeClient.config.providers({
+          directory: selectedWorkspaceRoot || undefined,
+        });
+        const data = (res as { data?: { providers?: Array<{ id: string; models: Record<string, any> }> } }).data;
+        if (cancelled || !data?.providers) return;
+        const next: Record<string, Record<string, any>> = {};
+        for (const provider of data.providers) {
+          next[provider.id] = { ...(provider.models ?? {}) };
+        }
+        setProviderCatalog(next);
+      } catch {
+        // best-effort cache; UI will fall back to empty variant options.
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [opencodeClient, selectedWorkspaceRoot]);
+
+  // Compute behavior (reasoning/thinking variant) options for the current
+  // default model. This is what the composer renders as its variant pill.
+  const { modelVariantLabel, modelBehaviorOptions } = useMemo(() => {
+    const ref = local.prefs.defaultModel;
+    const variant = local.prefs.modelVariant ?? null;
+    if (!ref) {
+      return { modelVariantLabel: t("settings.default_label"), modelBehaviorOptions: [] as { value: string | null; label: string }[] };
+    }
+    const model = providerCatalog[ref.providerID]?.[ref.modelID];
+    if (!model) {
+      return { modelVariantLabel: variant ?? t("settings.default_label"), modelBehaviorOptions: [] as { value: string | null; label: string }[] };
+    }
+    const summary = getModelBehaviorSummary(ref.providerID, model, variant);
+    return { modelVariantLabel: summary.label, modelBehaviorOptions: summary.options };
+  }, [local.prefs.defaultModel, local.prefs.modelVariant, providerCatalog]);
+
+  // Load the picker list lazily the first time the modal opens. Uses the
+  // cached catalog when available, otherwise re-fetches.
+  useEffect(() => {
+    if (!modelPickerOpen || !opencodeClient) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await opencodeClient.config.providers({
+          directory: selectedWorkspaceRoot || undefined,
+        });
+        const data = (res as {
+          data?: {
+            providers?: Array<{
+              id: string;
+              name: string;
+              models: Record<string, { id: string; name: string }>;
+            }>;
+          };
+        }).data;
+        if (cancelled || !data?.providers) return;
+        const options: ModelOption[] = [];
+        for (const provider of data.providers) {
+          const modelIds = Object.keys(provider.models);
+          const hasModels = modelIds.length > 0;
+          for (const id of modelIds) {
+            const model = provider.models[id];
+            options.push({
+              providerID: provider.id,
+              modelID: id,
+              title: model.name || id,
+              description: provider.name,
+              behaviorTitle: "Reasoning",
+              behaviorLabel: "Default",
+              behaviorDescription: "",
+              behaviorValue: null,
+              isFree: false,
+              isConnected: hasModels,
+            });
+          }
+        }
+        setModelOptions(options);
+      } catch {
+        // Silent: the picker surfaces an empty list rather than blocking the UI.
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [modelPickerOpen, opencodeClient, selectedWorkspaceRoot]);
+
+  // Apply org-level restrictions (dev #1505) on top of the raw model list
+  // so the picker never surfaces blocked options:
+  //   - `blockZenModel` hides the built-in OpenCode provider entries
+  //   - `disallowNonCloudModels` hides providers that aren't currently
+  //     connected via cloud (a provider with models[] filled counts as
+  //     connected in this list — see the loader above)
+  const allowedModelOptions = useMemo(() => {
+    const restrictToCloud = checkDesktopRestriction({
+      restriction: "disallowNonCloudModels",
+    });
+    return modelOptions.filter((option) => {
+      if (
+        isDesktopProviderBlocked({
+          providerId: option.providerID,
+          checkRestriction: checkDesktopRestriction,
+        })
+      ) {
+        return false;
+      }
+      if (restrictToCloud && !option.isConnected) {
+        return false;
+      }
+      return true;
+    });
+  }, [checkDesktopRestriction, modelOptions]);
+
+  const listSlashCommands = useCallback(async (): Promise<SlashCommandOption[]> => {
+    // engineReloadVersion is included so the callback identity changes after
+    // an engine reload, which invalidates the composer's command list cache
+    // and causes it to re-fetch (picking up newly created skills).
+    void engineReloadVersion;
+    if (!opencodeClient) return [];
+    return listCommands(opencodeClient, selectedWorkspaceRoot || undefined);
+  }, [engineReloadVersion, opencodeClient, selectedWorkspaceRoot]);
+
+  const surfaceProps = useMemo(() => {
+    if (!client || !selectedWorkspaceId || !selectedSessionId || !opencodeBaseUrl || !token || !opencodeClient) {
+      return null;
+    }
+
+    // Transient-safety: when the user switches workspaces the URL-driven
+    // selectedSessionId may still point at a session from the old workspace
+    // for one render tick. Only block rendering when we KNOW the session
+    // belongs to a different workspace (i.e., it exists in another
+    // workspace's list). A brand-new session that hasn't been refreshed
+    // into any list yet must still render so "New task" feels instant.
+    let sessionOwnedByOtherWorkspace = false;
+    for (const [workspaceId, sessions] of Object.entries(sessionsByWorkspaceId)) {
+      if (workspaceId === selectedWorkspaceId) continue;
+      if ((sessions ?? []).some((session: any) => session?.id === selectedSessionId)) {
+        sessionOwnedByOtherWorkspace = true;
+        break;
+      }
+    }
+    if (sessionOwnedByOtherWorkspace) {
+      return null;
+    }
+
+    return {
+      client,
+      workspaceId: selectedWorkspaceId,
+      workspaceRoot: selectedWorkspaceRoot,
+      sessionId: selectedSessionId,
+      opencodeBaseUrl,
+      openworkToken: token,
+      developerMode: false,
+      modelLabel,
+      onModelClick: () => {
+        setModelPickerQuery("");
+        setModelPickerOpen(true);
+      },
+      onOpenSettingsSection: (section: "commands" | "skills" | "mcps" | "plugins") => {
+        navigate(section === "skills" ? "/settings/skills" : section === "mcps" ? "/settings/mcp" : section === "plugins" ? "/settings/den" : "/settings/general");
+      },
+      onSendDraft: async (draft: ComposerDraft) => {
+        const text = (draft.resolvedText ?? draft.text).trim();
+        if (!text && draft.attachments.length === 0) return;
+
+        if (draft.mode === "shell") {
+          await shellInSession(opencodeClient, selectedSessionId, text);
+          return;
+        }
+
+        if (draft.command) {
+          const result = await opencodeClient.session.command({
+            sessionID: selectedSessionId,
+            command: draft.command.name,
+            arguments: draft.command.arguments,
+          });
+          if (result.error) {
+            throw new Error(serializeSDKError(result.error));
+          }
+          return;
+        }
+
+        const parts = await draftToParts(draft, selectedWorkspaceRoot);
+        const envRuntimeKey = buildOpenworkEnvRuntimeKey({
+          baseUrl: client?.baseUrl ?? null,
+          pid: openworkServerHostInfoState?.pid ?? null,
+          port: openworkServerHostInfoState?.port ?? null,
+        });
+        const envSystemContext = await buildOpenworkEnvSystemContext(client, {
+          cacheKey: selectedSessionId,
+          runtimeKey: envRuntimeKey,
+        });
+        const result = await opencodeClient.session.promptAsync({
+          sessionID: selectedSessionId,
+          parts,
+          model: local.prefs.defaultModel ?? undefined,
+          agent: selectedAgent ?? undefined,
+          ...(local.prefs.modelVariant ? { variant: local.prefs.modelVariant } : {}),
+          ...(envSystemContext ? { system: envSystemContext } : {}),
+        });
+        if (result.error) {
+          throw new Error(serializeSDKError(result.error));
+        }
+      },
+      onDraftChange: () => {
+        // Draft persistence will be wired once the full React shell owns session state.
+      },
+      attachmentsEnabled: true,
+      attachmentsDisabledReason: null,
+      modelVariantLabel,
+      modelVariant: local.prefs.modelVariant ?? null,
+      modelBehaviorOptions,
+      onModelVariantChange: (value: string | null) => {
+        local.setPrefs((previous) => ({ ...previous, modelVariant: value }));
+      },
+      agentLabel: selectedAgent ? selectedAgent.charAt(0).toUpperCase() + selectedAgent.slice(1) : t("session.default_agent"),
+      selectedAgent,
+      listAgents: async () => {
+        const list = unwrap(await opencodeClient.app.agents());
+        return list.filter((agent) => !agent.hidden && agent.mode !== "subagent");
+      },
+      onSelectAgent: (agent: string | null) => setSelectedAgent(agent),
+      listCommands: listSlashCommands,
+      recentFiles: [],
+      searchFiles: async (query: string) => {
+        const trimmed = query.trim();
+        if (!trimmed) return [];
+        const result = unwrap(
+          await opencodeClient.find.files({
+            query: trimmed,
+            dirs: "true",
+            limit: 50,
+            directory: selectedWorkspaceRoot || undefined,
+          }),
+        );
+        return result;
+      },
+      isRemoteWorkspace: selectedWorkspace?.workspaceType === "remote",
+      isSandboxWorkspace: selectedWorkspace ? isSandboxWorkspace(selectedWorkspace) : false,
+      onChangeModel: (model: { providerID: string; modelID: string }) => {
+        local.setPrefs((previous) => ({ ...previous, defaultModel: model }));
+      },
+    };
+  }, [
+    client,
+    local,
+    listSlashCommands,
+    modelLabel,
+    navigate,
+    opencodeBaseUrl,
+    opencodeClient,
+    selectedAgent,
+    selectedSessionId,
+    selectedWorkspace,
+    selectedWorkspaceId,
+    selectedWorkspaceRoot,
+    sessionsByWorkspaceId,
+    token,
+  ]);
+
+  const handleOpenCreateWorkspace = useCallback(() => {
+    // Respect the org-level `blockMultipleWorkspaces` restriction (dev
+    // #1505). If the checker returns true, the admin has disabled
+    // adding further workspaces; surface a friendly notice instead of
+    // opening the modal.
+    if (
+      workspaces.length > 0 &&
+      checkDesktopRestriction({ restriction: "blockMultipleWorkspaces" })
+    ) {
+      restrictionNotice.show({
+        title: "Additional workspaces are restricted",
+        message:
+          "Your organization administrator has restricted access to adding additional workspaces.",
+      });
+      return;
+    }
+    setCreateWorkspaceRemoteError(null);
+    setCreateWorkspaceOpen(true);
+  }, [checkDesktopRestriction, restrictionNotice, workspaces.length]);
+
+  const handleOpenRenameWorkspace = useCallback((workspaceId: string) => {
+    const workspace = workspaces.find((item) => item.id === workspaceId);
+    if (!workspace) return;
+    setRenameWorkspaceId(workspaceId);
+    setRenameWorkspaceTitle(
+      workspace.displayName?.trim() ||
+        workspace.name?.trim() ||
+        workspace.path?.trim() ||
+        "",
+    );
+  }, [workspaces]);
+
+  const handleSaveRenameWorkspace = useCallback(async () => {
+    if (!renameWorkspaceId) return;
+    const trimmed = renameWorkspaceTitle.trim();
+    if (!trimmed) return;
+    setRenameWorkspaceBusy(true);
+    try {
+      // Rename on both ends so the sidebar reflects the change regardless of
+      // which list wins the next refresh (server-provided routeWorkspaces or
+      // desktop-provided workspaceBootstrap results). Either call failing on
+      // its own should NOT block the other — the user's intent was "rename
+      // this workspace" and a soft failure in one store is recoverable.
+      if (isDesktopRuntime()) {
+        await workspaceUpdateDisplayName({
+          workspaceId: renameWorkspaceId,
+          displayName: trimmed,
+        }).catch(() => undefined);
+      }
+      if (client) {
+        await client
+          .updateWorkspaceDisplayName(renameWorkspaceId, trimmed)
+          .catch(() => undefined);
+      }
+      setRenameWorkspaceId(null);
+      setRenameWorkspaceTitle("");
+      await refreshRouteState();
+    } finally {
+      setRenameWorkspaceBusy(false);
+    }
+  }, [client, refreshRouteState, renameWorkspaceId, renameWorkspaceTitle]);
+
+  const handleRevealWorkspace = useCallback(async (workspaceId: string) => {
+    const workspace = workspaces.find((item) => item.id === workspaceId);
+    const path = workspace?.path?.trim();
+    if (!path || !isDesktopRuntime()) return;
+    try {
+      await revealDesktopItemInDir(path);
+    } catch {
+      // ignore
+    }
+  }, [workspaces]);
+
+  const handleShareWorkspace = useCallback((workspaceId: string) => {
+    shareWorkspaceState.openShareWorkspace(workspaceId);
+  }, [shareWorkspaceState]);
+
+  const handleSaveShareRemoteAccess = useCallback(
+    async (enabled: boolean) => {
+      if (!isDesktopRuntime()) return;
+      await remoteAccessRestart.save(enabled);
+    },
+    [remoteAccessRestart],
+  );
+
+  const handleExportWorkspaceConfig = useCallback(
+    async (workspaceId: string) => {
+      if (!isDesktopRuntime()) return;
+      const workspace = workspaces.find((item) => item.id === workspaceId) ?? null;
+      if (!workspace) return;
+      const outputPath = await pickDirectory({
+        title: `Choose where to export ${workspaceLabel(workspace)}`,
+      });
+      const targetPath = Array.isArray(outputPath) ? outputPath[0] : outputPath;
+      if (!targetPath) return;
+      await workspaceExportConfig({ workspaceId, outputPath: targetPath });
+      try {
+        await revealDesktopItemInDir(targetPath);
+      } catch {
+        // ignore reveal failures
+      }
+    },
+    [workspaces],
+  );
+
+  const handleForgetWorkspace = useCallback(
+    async (workspaceId: string) => {
+      if (typeof window !== "undefined") {
+        const message =
+          t("workspace_list.remove_confirm") ||
+          "Remove this workspace from the sidebar?";
+        if (!window.confirm(message)) return;
+      }
+      // Remove from both stores so the next refresh can't resurrect the row
+      // from whichever list wins the merge.
+      if (isDesktopRuntime()) {
+        await workspaceForget(workspaceId).catch(() => undefined);
+      }
+      if (client) {
+        await client.deleteWorkspace(workspaceId).catch(() => undefined);
+      }
+      if (selectedWorkspaceId === workspaceId) {
+        setSelectedWorkspaceId("");
+        writeActiveWorkspaceId(null);
+        navigate("/session");
+      }
+      forgetWorkspaceMemory(workspaceId);
+      await refreshRouteState();
+    },
+    [client, navigate, refreshRouteState, selectedWorkspaceId],
+  );
+
+  const runRemoteWorkspaceConnectionCheck = useCallback(
+    async (workspaceId: string, mode: "test" | "recover") => {
+      const workspace = workspacesRef.current.find((item) => item.id === workspaceId);
+      if (!workspace || workspace.workspaceType !== "remote") return false;
+      const connectionKey = getRemoteWorkspaceConnectionKey(workspace);
+      remoteWorkspaceCheckRunCounterRef.current += 1;
+      const runId = String(remoteWorkspaceCheckRunCounterRef.current);
+      remoteWorkspaceCheckRunRef.current[workspaceId] = runId;
+
+      setWorkspaceConnectionOverrides((current) => ({
+        ...current,
+        [workspaceId]: {
+          status: "connecting",
+          message: t("config.testing_connection"),
+          checkedAt: null,
+        },
+      }));
+
+      const result = await testRemoteWorkspaceConnection(workspace);
+      const currentWorkspace = workspacesRef.current.find((item) => item.id === workspaceId);
+      if (
+        remoteWorkspaceCheckRunRef.current[workspaceId] !== runId ||
+        !currentWorkspace ||
+        getRemoteWorkspaceConnectionKey(currentWorkspace) !== connectionKey
+      ) {
+        if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+          delete remoteWorkspaceCheckRunRef.current[workspaceId];
+        }
+        return false;
+      }
+      setWorkspaceConnectionOverrides((current) => ({
+        ...current,
+        [workspaceId]: result.state,
+      }));
+
+      if (!result.ok) {
+        setErrorsByWorkspaceId((current) => ({
+          ...current,
+          [workspaceId]: result.state.message ?? "Remote worker connection failed.",
+        }));
+        if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+          delete remoteWorkspaceCheckRunRef.current[workspaceId];
+        }
+        return false;
+      }
+
+      setErrorsByWorkspaceId((current) => ({ ...current, [workspaceId]: null }));
+      setRetryingWorkspaceIds((current) => current.filter((id) => id !== workspaceId));
+      if (mode === "recover") {
+        await refreshRouteState();
+      }
+      if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+        delete remoteWorkspaceCheckRunRef.current[workspaceId];
+      }
+      return true;
+    },
+    [refreshRouteState],
+  );
+
+  const handleCreateTaskInWorkspace = useCallback(async (workspaceId: string) => {
+    const workspace = workspaces.find((item) => item.id === workspaceId);
+    if (
+      !workspace ||
+      !token ||
+      !baseUrl ||
+      loading ||
+      retryingWorkspaceIds.includes(workspaceId) ||
+      errorsByWorkspaceId[workspaceId]
+    ) {
+      return;
+    }
+    const workspaceOpencodeBaseUrl = `${(buildOpenworkWorkspaceBaseUrl(baseUrl, workspace.id) ?? baseUrl).replace(/\/+$|\/+$/g, "")}/opencode`;
+    const workspaceClient = createClient(
+      workspaceOpencodeBaseUrl,
+      workspace.path?.trim() || undefined,
+      { token, mode: "openwork" },
+    );
+    try {
+      const session = unwrap(
+        await workspaceClient.session.create({ directory: workspace.path?.trim() || undefined }),
+      );
+      setSelectedWorkspaceId(workspaceId);
+      writeActiveWorkspaceId(workspaceId || null);
+      writeLastSessionFor(workspaceId, session.id);
+      setSessionsByWorkspaceId((current) => ({
+        ...current,
+        [workspaceId]: [session as any, ...(current[workspaceId] ?? [])],
+      }));
+      navigate(`/session/${session.id}`);
+      void refreshRouteState();
+    } catch (error) {
+      const message = describeRouteError(error);
+      setRouteError(message);
+      if (isTransientStartupError(message)) {
+        setRetryingWorkspaceIds((current) => Array.from(new Set([...current, workspaceId])));
+        if (startupRetryTimerRef.current === null) {
+          startupRetryTimerRef.current = window.setTimeout(() => {
+            startupRetryTimerRef.current = null;
+            refreshInFlightRef.current = false;
+            void refreshRouteState();
+          }, 1_000);
+        }
+      }
+    }
+  }, [baseUrl, errorsByWorkspaceId, loading, navigate, refreshRouteState, retryingWorkspaceIds, token, workspaces]);
+
+  // Global shortcuts:
+  //   Cmd/Ctrl+N  -> new task in selected workspace
+  //   Cmd/Ctrl+K  -> toggle command palette
+  useEffect(() => {
+    const handler = (event: KeyboardEvent) => {
+      const isMac = typeof navigator !== "undefined" && /Mac/i.test(navigator.platform);
+      const mod = isMac ? event.metaKey : event.ctrlKey;
+      if (!mod) return;
+      if (event.shiftKey || event.altKey) return;
+
+      const target = event.target as HTMLElement | null;
+      const inEditable =
+        !!target &&
+        (target.tagName === "INPUT" ||
+          target.tagName === "TEXTAREA" ||
+          target.isContentEditable);
+
+      const key = event.key?.toLowerCase();
+      if (key === "n" && !inEditable) {
+        event.preventDefault();
+        if (canCreateTask && selectedWorkspaceId) {
+          void handleCreateTaskInWorkspace(selectedWorkspaceId);
+        }
+        return;
+      }
+      if (key === "k") {
+        event.preventDefault();
+        setCommandPaletteOpen((value) => !value);
+      }
+    };
+    window.addEventListener("keydown", handler);
+    return () => window.removeEventListener("keydown", handler);
+  }, [canCreateTask, handleCreateTaskInWorkspace, selectedWorkspaceId]);
+
+  const navigateToSessionForControl = useCallback((sessionId: string) => {
+    navigate(`/session/${sessionId}`);
+  }, [navigate]);
+
+  const navigateToSessionRootForControl = useCallback(() => {
+    navigate("/session");
+  }, [navigate]);
+
+  const openModelPickerForControl = useCallback(() => {
+    setModelPickerOpen(true);
+  }, []);
+
+  useSessionControlActions({
+    workspaces,
+    sessionsByWorkspaceId,
+    selectedWorkspaceId,
+    selectedWorkspaceRoot,
+    selectedSessionId,
+    canCreateTask,
+    openworkClient: client,
+    opencodeClient,
+    navigateToSession: navigateToSessionForControl,
+    navigateToSessionRoot: navigateToSessionRootForControl,
+    createTaskInWorkspace: handleCreateTaskInWorkspace,
+    openModelPicker: openModelPickerForControl,
+    refreshRouteState,
+  });
+
+  const commandPaletteControlAction = useMemo<OpenworkControlAction>(() => ({
+    id: "command_palette.open",
+    label: "Open the command palette",
+    description: "Open the in-app command palette so the next choice is visible.",
+    sideEffect: "none",
+    execute: () => setCommandPaletteOpen(true),
+  }), []);
+  useControlAction(commandPaletteControlAction);
+
+  const paletteSessionOptions = useMemo<PaletteSessionOption[]>(() => {
+    const out: PaletteSessionOption[] = [];
+    for (const workspace of workspaces) {
+      const workspaceTitle =
+        workspace.displayName?.trim() ||
+        workspace.name?.trim() ||
+        workspace.path?.trim() ||
+        t("session.workspace_fallback");
+      const list = sessionsByWorkspaceId[workspace.id] ?? [];
+      for (const session of list) {
+        const sessionId = (session as { id?: string }).id?.trim() ?? "";
+        if (!sessionId) continue;
+        const title = getDisplaySessionTitle(
+          (session as { title?: string }).title ?? "",
+        );
+        const updatedAt =
+          (session as { time?: { updated?: number; created?: number } }).time
+            ?.updated ??
+          (session as { time?: { updated?: number; created?: number } }).time
+            ?.created ??
+          0;
+        out.push({
+          workspaceId: workspace.id,
+          sessionId,
+          title,
+          workspaceTitle,
+          updatedAt,
+          searchText: `${title} ${workspaceTitle}`.toLowerCase(),
+          isActive: workspace.id === selectedWorkspaceId,
+        });
+      }
+    }
+    out.sort((a, b) => {
+      if (a.isActive !== b.isActive) return a.isActive ? -1 : 1;
+      return b.updatedAt - a.updatedAt;
+    });
+    return out;
+  }, [sessionsByWorkspaceId, selectedWorkspaceId, workspaces]);
+
+  const handleCreateWorkspace = useCallback(async (preset: WorkspacePreset, folder: string | null) => {
+    if (!folder) return;
+    setCreateWorkspaceBusy(true);
+    setCreateWorkspaceError(null);
+    try {
+      const workspaceName = folderNameFromPath(folder);
+      const list = await workspaceCreate({
+        folderPath: folder,
+        name: workspaceName,
+        preset,
+      });
+      const createdId = resolveWorkspaceListSelectedId(list) || list.workspaces[list.workspaces.length - 1]?.id || "";
+      if (createdId) {
+        await workspaceSetSelected(createdId).catch(() => undefined);
+        await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+      }
+      // Register the workspace with the running openwork-server so
+      // listWorkspaces() reflects it immediately. Without this the UI only
+      // picks up the new workspace after an app restart (because the server
+      // is launched with a fixed --workspace list at boot and the bridge
+      // write only updates desktop-side state).
+      if (client) {
+        await client
+          .createLocalWorkspace({ folderPath: folder, name: workspaceName, preset })
+          .catch(() => undefined);
+      }
+      setCreateWorkspaceOpen(false);
+      // Mark onboarding complete so the /welcome redirect never fires again.
+      local.setPrefs((prev) => ({ ...prev, hasCompletedOnboarding: true }));
+      await refreshRouteState();
+      if (createdId) {
+        navigate("/settings/general");
+      }
+    } catch (error) {
+      setCreateWorkspaceError(describeWorkspaceCreateError(error));
+    } finally {
+      setCreateWorkspaceBusy(false);
+    }
+  }, [client, local, navigate, refreshRouteState]);
+
+  const handleCreateRemoteWorkspace = useCallback(async (input: {
+    openworkHostUrl?: string | null;
+    openworkToken?: string | null;
+    directory?: string | null;
+    displayName?: string | null;
+  }) => {
+    const baseUrlValue = input.openworkHostUrl?.trim() ?? "";
+    if (!baseUrlValue) return false;
+    setCreateWorkspaceRemoteBusy(true);
+    setCreateWorkspaceRemoteError(null);
+    try {
+      const list = await workspaceCreateRemote({
+        baseUrl: baseUrlValue,
+        openworkHostUrl: baseUrlValue,
+        openworkToken: input.openworkToken?.trim() || null,
+        displayName: input.displayName?.trim() || null,
+        directory: input.directory?.trim() || null,
+        remoteType: "openwork",
+      });
+      const createdId = resolveWorkspaceListSelectedId(list) || list.workspaces[list.workspaces.length - 1]?.id || "";
+      if (createdId) {
+        await workspaceSetSelected(createdId).catch(() => undefined);
+        await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+      }
+      setCreateWorkspaceOpen(false);
+      // Mark onboarding complete so the /welcome redirect never fires again.
+      local.setPrefs((prev) => ({ ...prev, hasCompletedOnboarding: true }));
+      await refreshRouteState();
+      return true;
+    } catch (error) {
+      setCreateWorkspaceRemoteError(error instanceof Error ? error.message : t("app.unknown_error"));
+      return false;
+    } finally {
+      setCreateWorkspaceRemoteBusy(false);
+    }
+  }, [local, refreshRouteState]);
+
+  return (
+    <>
+    {opencodeClient && selectedWorkspaceId && opencodeBaseUrl && token ? (
+      <ReactSessionRuntime
+        workspaceId={selectedWorkspaceId}
+        sessionId={selectedSessionId}
+        opencodeBaseUrl={opencodeBaseUrl}
+        openworkToken={token}
+      />
+    ) : null}
+    <SessionPage
+      selectedSessionId={selectedSessionId}
+      selectedWorkspaceId={selectedWorkspaceId}
+      selectedWorkspaceDisplay={selectedWorkspace ? {
+        id: selectedWorkspace.id,
+        name: selectedWorkspace.name ?? undefined,
+        displayName: selectedWorkspace.displayNameResolved,
+        workspaceType: selectedWorkspace.workspaceType,
+      } : { workspaceType: "local" }}
+      selectedWorkspaceRoot={selectedWorkspaceRoot}
+      runtimeWorkspaceId={selectedWorkspaceId || null}
+      workspaces={workspaces}
+      clientConnected={canCreateTask}
+      openworkServerStatus={client ? "connected" : "disconnected"}
+      openworkServerClient={client}
+      openworkServerToken={token}
+      developerMode={false}
+      headerStatus={canCreateTask ? t("status.connected") : t("session.loading_detail")}
+      busyHint={effectiveLoading ? t("session.loading_detail") : null}
+      startupPhase={effectiveLoading ? "nativeInit" : "ready"}
+      providerConnectedIds={providerConnectedIds}
+      providers={providers}
+      mcpConnectedCount={0}
+      onSendFeedback={() => {
+        platform.openLink(
+          buildFeedbackUrl({
+            entrypoint: "status-bar",
+          }),
+        );
+      }}
+      onOpenSettings={() => navigate("/settings/general")}
+      sidebar={{
+        workspaceSessionGroups,
+        selectedWorkspaceId,
+        selectedSessionId,
+        developerMode: false,
+        sessionStatusById: {},
+        connectingWorkspaceId: null,
+        workspaceConnectionStateById,
+        newTaskDisabled: !canCreateTask,
+        sidebarHydratedFromCache: Object.values(sessionsByWorkspaceId).some((list) => list.length > 0),
+        startupPhase: effectiveLoading ? "nativeInit" : "ready",
+        onSelectWorkspace: async (workspaceId) => {
+          if (workspaceId === selectedWorkspaceId) return true;
+          setSelectedWorkspaceId(workspaceId);
+          writeActiveWorkspaceId(workspaceId || null);
+          const workspace = workspaces.find((item) => item.id === workspaceId);
+          if (client && workspace && !sessionsByWorkspaceId[workspaceId]?.length) {
+            setRetryingWorkspaceIds((current) => Array.from(new Set([...current, workspaceId])));
+            void loadWorkspaceSessionsInBackground(client, [workspace]);
+          }
+          // Fire Tauri updates but don't await them — they're bookkeeping and
+          // awaiting 2 IPC roundtrips on every click used to stall rapid
+          // workspace switches behind a queue.
+          if (isDesktopRuntime()) {
+            void workspaceSetSelected(workspaceId).catch(() => undefined);
+            void workspaceSetRuntimeActive(workspaceId).catch(() => undefined);
+          }
+          // Tell the OpenWork server this workspace is now active so it can
+          // emit a config reload event that the OpenCode engine picks up.
+          // Without this, the permissions from opencode.jsonc are never
+          // applied on the workspace the user is already on at launch. See
+          // issue #870.
+          if (workspaceId && client) {
+            void client
+              .activateWorkspace(workspaceId)
+              .catch(() => undefined);
+          }
+          // If we remember what the user last opened here and that session
+          // still exists in our local list, navigate. Otherwise stay put.
+          const remembered = readLastSessionFor(workspaceId);
+          if (remembered && remembered !== selectedSessionId) {
+            const known = sessionsByWorkspaceId[workspaceId];
+            if (known?.some((session: any) => session?.id === remembered)) {
+              navigate(`/session/${remembered}`);
+            }
+          }
+          return true;
+        },
+        onOpenSession: (workspaceId, sessionId) => {
+          setSelectedWorkspaceId(workspaceId);
+          writeActiveWorkspaceId(workspaceId || null);
+          writeLastSessionFor(workspaceId, sessionId);
+          navigate(`/session/${sessionId}`);
+        },
+        onPrefetchSession: () => {},
+        onCreateTaskInWorkspace: async (workspaceId) => {
+          void handleCreateTaskInWorkspace(workspaceId);
+          return;
+          const workspace = workspaces.find((item) => item.id === workspaceId)!;
+          if (!workspace || !token || !baseUrl) return;
+          const workspaceOpencodeBaseUrl = `${(buildOpenworkWorkspaceBaseUrl(baseUrl, workspace.id) ?? baseUrl).replace(/\/+$|\/+$/g, "")}/opencode`;
+          const workspaceClient = createClient(
+            workspaceOpencodeBaseUrl,
+            workspace.path?.trim() || undefined,
+            { token, mode: "openwork" },
+          );
+          const session = unwrap(
+            await workspaceClient.session.create({ directory: workspace.path?.trim() || undefined }),
+          );
+          // Make sure the new session is the active pair before navigating
+          // so the surface renders the new id immediately instead of going
+          // through the "unknown session" render tick.
+          setSelectedWorkspaceId(workspaceId);
+          writeActiveWorkspaceId(workspaceId || null);
+          writeLastSessionFor(workspaceId, session.id);
+          setSessionsByWorkspaceId((current) => ({
+            ...current,
+            [workspaceId]: [session as any, ...(current[workspaceId] ?? [])],
+          }));
+          navigate(`/session/${session.id}`);
+          // Refresh in the background so the new session picks up its real
+          // metadata (title, timestamps) as soon as the server knows them.
+          void refreshRouteState();
+        },
+        onOpenRenameWorkspace: handleOpenRenameWorkspace,
+        onShareWorkspace: handleShareWorkspace,
+        onRevealWorkspace: (id) => void handleRevealWorkspace(id),
+        onRecoverWorkspace: (workspaceId) => runRemoteWorkspaceConnectionCheck(workspaceId, "recover"),
+        onTestWorkspaceConnection: (workspaceId) => runRemoteWorkspaceConnectionCheck(workspaceId, "test"),
+        onEditWorkspaceConnection: remoteWorkspaceConnectionEditor.open,
+        onForgetWorkspace: (id) => void handleForgetWorkspace(id),
+        onOpenCreateWorkspace: handleOpenCreateWorkspace,
+      }}
+      surface={surfaceProps}
+      history={{
+        canUndo: false,
+        canRedo: false,
+        busyAction: null,
+        onUndo: () => {},
+        onRedo: () => {},
+      }}
+      todos={[] satisfies TodoItem[]}
+      sessionLoadingById={(sessionId) => effectiveLoading && Boolean(sessionId && sessionId === selectedSessionId)}
+      shareWorkspaceModal={
+        shareWorkspaceState.shareWorkspaceOpen
+          ? {
+              open: true,
+              onClose: shareWorkspaceState.closeShareWorkspace,
+              workspaceName: shareWorkspaceState.shareWorkspaceName,
+              workspaceDetail: shareWorkspaceState.shareWorkspaceDetail,
+              fields: shareWorkspaceState.shareFields,
+              remoteAccess:
+                isDesktopRuntime() && shareWorkspaceState.shareWorkspace?.workspaceType === "local"
+                  ? {
+                      enabled: openworkServerSettings.remoteAccessEnabled === true,
+                      busy: remoteAccessRestart.busy,
+                      error: remoteAccessRestart.error,
+                      status: remoteAccessRestart.status,
+                      onSave: handleSaveShareRemoteAccess,
+                    }
+                  : undefined,
+              note: shareWorkspaceState.shareNote,
+              onExportConfig:
+                shareWorkspaceState.exportDisabledReason === null
+                  ? () => {
+                      const id = shareWorkspaceState.shareWorkspaceId;
+                      if (!id) return;
+                      void handleExportWorkspaceConfig(id);
+                    }
+                  : undefined,
+              exportDisabledReason: shareWorkspaceState.exportDisabledReason,
+            }
+          : null
+      }
+      activePermission={activePermission}
+      permissionReplyBusy={permissionReplyBusy}
+      respondPermission={respondPermission}
+      safeStringify={safeStringify}
+      onRenameSession={
+        opencodeClient
+          ? async (sessionId, nextTitle) => {
+              const trimmed = nextTitle.trim();
+              if (!trimmed) return;
+              await opencodeClient.session.update({
+                sessionID: sessionId,
+                title: trimmed,
+                directory: selectedWorkspaceRoot || undefined,
+              });
+              await refreshRouteState();
+            }
+          : undefined
+      }
+      onDeleteSession={
+        client && selectedWorkspaceId
+          ? async (sessionId) => {
+              await client.deleteSession(selectedWorkspaceId, sessionId);
+              if (selectedSessionId === sessionId) {
+                navigate("/session");
+              }
+              await refreshRouteState();
+            }
+          : undefined
+      }
+      statusBar={showPreparingStatus ? {
+        statusLabel: "Preparing workspace",
+        statusDetail: t("session.loading_detail"),
+        statusDotClass: "bg-amber-9",
+        statusPingClass: "bg-amber-9/35 animate-ping",
+        statusPulse: true,
+      } : undefined}
+    />
+    <CreateWorkspaceModal
+      open={createWorkspaceOpen}
+      onClose={() => {
+        setCreateWorkspaceOpen(false);
+        setCreateWorkspaceError(null);
+      }}
+      onConfirm={handleCreateWorkspace}
+      onConfirmRemote={handleCreateRemoteWorkspace}
+      onPickFolder={() => pickDirectory({ title: t("onboarding.authorize_folder") }) as Promise<string | null>}
+      submitting={createWorkspaceBusy}
+      localError={createWorkspaceError}
+      remoteSubmitting={createWorkspaceRemoteBusy}
+      remoteError={createWorkspaceRemoteError}
+    />
+    <CreateRemoteWorkspaceModal
+      open={remoteWorkspaceConnectionEditor.workspace !== null}
+      onClose={remoteWorkspaceConnectionEditor.close}
+      onConfirm={(input) => void remoteWorkspaceConnectionEditor.save(input)}
+      initialValues={remoteWorkspaceConnectionEditor.initialValues}
+      submitting={remoteWorkspaceConnectionEditor.busy}
+      error={remoteWorkspaceConnectionEditor.error}
+      title={t("dashboard.edit_remote_workspace_title")}
+      subtitle={t("dashboard.edit_remote_workspace_subtitle")}
+      confirmLabel={t("dashboard.edit_remote_workspace_confirm")}
+    />
+    <RenameWorkspaceModal
+      open={renameWorkspaceId !== null}
+      title={renameWorkspaceTitle}
+      busy={renameWorkspaceBusy}
+      canSave={!renameWorkspaceBusy && renameWorkspaceTitle.trim().length > 0}
+      onClose={() => {
+        if (renameWorkspaceBusy) return;
+        setRenameWorkspaceId(null);
+        setRenameWorkspaceTitle("");
+      }}
+      onSave={() => void handleSaveRenameWorkspace()}
+      onTitleChange={setRenameWorkspaceTitle}
+    />
+    <CommandPalette
+      open={commandPaletteOpen}
+      onClose={() => setCommandPaletteOpen(false)}
+      onCreateNewSession={() => {
+        if (selectedWorkspaceId) {
+          void handleCreateTaskInWorkspace(selectedWorkspaceId);
+        }
+      }}
+      onOpenSession={(_workspaceId, sessionId) => navigate(`/session/${sessionId}`)}
+      onOpenSettings={(route) => navigate(route ?? "/settings/general")}
+      sessions={paletteSessionOptions}
+    />
+    <ModelPickerModal
+      open={modelPickerOpen}
+      options={allowedModelOptions}
+      filteredOptions={allowedModelOptions.filter((opt) => {
+        const q = modelPickerQuery.trim().toLowerCase();
+        if (!q) return true;
+        return (
+          opt.title.toLowerCase().includes(q) ||
+          opt.providerID.toLowerCase().includes(q) ||
+          opt.modelID.toLowerCase().includes(q)
+        );
+      })}
+      query={modelPickerQuery}
+      setQuery={setModelPickerQuery}
+      target="default"
+      current={local.prefs.defaultModel ?? ({ providerID: "", modelID: "" } satisfies ModelRef)}
+      onSelect={(next: ModelRef) => {
+        local.setPrefs((previous) => ({ ...previous, defaultModel: next }));
+        setModelPickerOpen(false);
+      }}
+      onBehaviorChange={() => {}}
+      onOpenSettings={() => {
+        setModelPickerOpen(false);
+        navigate("/settings/general");
+      }}
+      onClose={() => setModelPickerOpen(false)}
+    />
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/shell/settings-route.tsx b/apps/app/src/react-app/shell/settings-route.tsx
new file mode 100644
index 0000000000..b872710ef8
--- /dev/null
+++ b/apps/app/src/react-app/shell/settings-route.tsx
@@ -0,0 +1,1704 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Navigate, useLocation, useNavigate } from "react-router-dom";
+
+import { SUGGESTED_PLUGINS } from "../../app/constants";
+import { createClient } from "../../app/lib/opencode";
+import {
+  buildOpenworkWorkspaceBaseUrl,
+  createOpenworkServerClient,
+  isLoopbackOpenworkServerUrl,
+  readOpenworkServerSettings,
+  type OpenworkServerCapabilities,
+  type OpenworkServerClient,
+  type OpenworkWorkspaceInfo,
+} from "../../app/lib/openwork-server";
+import { buildOpenworkEnvRuntimeKey } from "../../app/lib/openwork-env-runtime";
+import type {
+  Client,
+  ProviderListItem,
+  SettingsTab,
+  WorkspaceConnectionState,
+  WorkspaceDisplay,
+  WorkspacePreset,
+  WorkspaceSessionGroup,
+} from "../../app/types";
+import { getWorkspaceTaskLoadErrorDisplay, isSandboxWorkspace } from "../../app/utils";
+import { currentLocale, t, setLocale, type Language } from "../../i18n";
+import { createConnectionsStore, useConnectionsStoreSnapshot } from "../domains/connections/store";
+import { createOpenworkServerStore, useOpenworkServerStoreSnapshot } from "../domains/connections/openwork-server-store";
+import { createProviderAuthStore, useProviderAuthStoreSnapshot } from "../domains/connections/provider-auth/store";
+import ProviderAuthModal from "../domains/connections/provider-auth/provider-auth-modal";
+import ConnectionsModals from "../domains/connections/modals";
+import { GeneralSettingsView } from "../domains/settings/pages/general-view";
+import { AdvancedView } from "../domains/settings/pages/advanced-view";
+import { AppearanceView } from "../domains/settings/pages/appearance-view";
+import { DebugView } from "../domains/settings/pages/debug-view";
+import { DenView } from "../domains/settings/pages/den-view";
+import { EnvironmentView } from "../domains/settings/pages/environment-view";
+import { ExtensionsView } from "../domains/settings/pages/extensions-view";
+import { McpView } from "../domains/settings/pages/mcp-view";
+import { RecoveryView } from "../domains/settings/pages/recovery-view";
+import { MessagingView } from "../domains/settings/pages/messaging-view";
+import { SkillsView } from "../domains/settings/pages/skills-view";
+import { UpdatesView } from "../domains/settings/pages/updates-view";
+import { useDebugViewModel } from "../domains/settings/state/debug-view-model";
+import { useMessagingViewProps } from "../domains/settings/state/messaging-view-state";
+import { useElectronUpdaterState } from "../domains/settings/state/electron-updater-state";
+import { useBootState } from "./boot-state";
+import { SettingsShell } from "../domains/settings/shell/settings-shell";
+import { createExtensionsStore, useExtensionsStoreSnapshot } from "../domains/settings/state/extensions-store";
+import { usePlatform } from "../kernel/platform";
+import { useLocal } from "../kernel/local-provider";
+import {
+  DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+  MAX_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+  MIN_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+  useWorkspaceShellLayout,
+} from "./workspace-shell-layout";
+import {
+  openworkServerInfo,
+  openworkServerRestart,
+  engineStart,
+  pickDirectory,
+  resolveWorkspaceListSelectedId,
+  workspaceBootstrap,
+  workspaceCreate,
+  workspaceCreateRemote,
+  workspaceSetRuntimeActive,
+  workspaceSetSelected,
+  type WorkspaceInfo,
+} from "../../app/lib/desktop";
+import { isDesktopProviderBlocked } from "../../app/cloud/desktop-app-restrictions";
+import { useCheckDesktopRestriction, useDesktopConfig } from "../domains/cloud/desktop-config-provider";
+import { useCloudProviderAutoSync } from "../domains/cloud/use-cloud-provider-auto-sync";
+import { isDesktopRuntime, isElectronRuntime, isMacPlatform, normalizeDirectoryPath, safeStringify } from "../../app/utils";
+import { CreateRemoteWorkspaceModal } from "../domains/workspace/create-remote-workspace-modal";
+import { CreateWorkspaceModal } from "../domains/workspace/create-workspace-modal";
+import { useRemoteWorkspaceConnectionEditor } from "../domains/workspace/use-remote-workspace-connection-editor";
+import {
+  diagnoseRemoteWorkspaceTaskLoadFailure,
+  getRemoteWorkspaceConnectionKey,
+  testRemoteWorkspaceConnection,
+} from "../domains/workspace/remote-workspace-diagnostics";
+import { ModelPickerModal } from "../domains/session/modals/model-picker-modal";
+import type { ModelOption, ModelRef } from "../../app/types";
+import { recordInspectorEvent } from "./app-inspector";
+import { ensureDesktopLocalOpenworkConnection } from "./desktop-local-openwork";
+import { resolveOpenworkConnection } from "./openwork-connection";
+import { abortSessionSafe } from "../../app/lib/opencode-session";
+import { useReloadCoordinator } from "./reload-coordinator";
+import { buildFeedbackUrl } from "../../app/lib/feedback";
+
+type RouteWorkspace = OpenworkWorkspaceInfo & {
+  displayNameResolved: string;
+};
+
+const ROUTE_OPENWORK_CAPABILITIES: OpenworkServerCapabilities = {
+  skills: { read: true, write: true, source: "openwork" },
+  plugins: { read: true, write: true },
+  mcp: { read: true, write: true },
+  commands: { read: true, write: true },
+  config: { read: true, write: true },
+};
+
+function mapDesktopWorkspace(workspace: WorkspaceInfo): RouteWorkspace {
+  return {
+    ...workspace,
+    displayNameResolved:
+      workspace.displayName?.trim() ||
+      workspace.name?.trim() ||
+      workspace.path?.trim() ||
+      t("session.workspace_fallback"),
+  };
+}
+
+function describeRouteError(error: unknown) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  const serialized = safeStringify(error);
+  return serialized && serialized !== "{}" ? serialized : t("app.unknown_error");
+}
+
+function describeWorkspaceCreateError(error: unknown) {
+  const message = describeRouteError(error);
+  const lower = message.toLowerCase();
+  if (
+    lower.includes("operation timed out") ||
+    lower.includes("os error 60") ||
+    lower.includes("etimedout")
+  ) {
+    return `${message}\n\nOpenWork could not read the workspace config before the filesystem timed out. This often happens when the folder is still syncing from iCloud Drive or another remote folder. Wait for the folder to finish downloading, move the workspace to a local folder, or try again.`;
+  }
+  return message;
+}
+
+function mergeRouteWorkspaces(
+  serverWorkspaces: OpenworkWorkspaceInfo[],
+  desktopWorkspaces: RouteWorkspace[],
+): RouteWorkspace[] {
+  const desktopById = new Map(desktopWorkspaces.map((workspace) => [workspace.id, workspace]));
+  const desktopByPath = new Map(
+    desktopWorkspaces
+      .map((workspace) => [normalizeDirectoryPath(workspace.path ?? ""), workspace] as const)
+      .filter(([path]) => path.length > 0),
+  );
+
+  const mergedServer = serverWorkspaces.map((workspace) => {
+    const match =
+      desktopById.get(workspace.id) ??
+      desktopByPath.get(normalizeDirectoryPath(workspace.path ?? ""));
+    const merged = match
+      ? {
+          ...workspace,
+          displayName: workspace.displayName?.trim()
+            ? workspace.displayName
+            : match.displayName,
+          name: match.name?.trim() ? match.name : workspace.name,
+        }
+      : workspace;
+    return {
+      ...merged,
+      displayNameResolved: workspaceLabel(merged),
+    };
+  });
+
+  const mergedIds = new Set(mergedServer.map((workspace) => workspace.id));
+  const mergedPaths = new Set(
+    mergedServer
+      .map((workspace) => normalizeDirectoryPath(workspace.path ?? ""))
+      .filter((path) => path.length > 0),
+  );
+
+  const missingDesktop = desktopWorkspaces.filter((workspace) => {
+    if (mergedIds.has(workspace.id)) return false;
+    const normalizedPath = normalizeDirectoryPath(workspace.path ?? "");
+    if (normalizedPath && mergedPaths.has(normalizedPath)) return false;
+    return true;
+  });
+
+  return [...mergedServer, ...missingDesktop];
+}
+
+function reconcileSelectedWorkspaceId(
+  currentId: string,
+  serverList: { activeId?: string | null },
+  desktopList: Awaited<ReturnType<typeof workspaceBootstrap>> | null,
+  workspaces: RouteWorkspace[],
+) {
+  const current = currentId.trim();
+  const serverIds = new Set(workspaces.map((workspace) => workspace.id));
+  if (current && serverIds.has(current)) return current;
+
+  const desktopSelectedId = resolveWorkspaceListSelectedId(desktopList);
+  const desktopSelected = desktopSelectedId
+    ? desktopList?.workspaces?.find((workspace) => workspace.id === desktopSelectedId)
+    : null;
+  const currentDesktop = current
+    ? desktopList?.workspaces?.find((workspace) => workspace.id === current)
+    : null;
+  const selectedPath = normalizeDirectoryPath((currentDesktop ?? desktopSelected)?.path ?? "");
+
+  if (selectedPath) {
+    const pathMatch = workspaces.find(
+      (workspace) => normalizeDirectoryPath(workspace.path ?? "") === selectedPath,
+    );
+    if (pathMatch) return pathMatch.id;
+  }
+
+  return serverList.activeId?.trim() || desktopSelectedId || workspaces[0]?.id || "";
+}
+
+function folderNameFromPath(path: string) {
+  const normalized = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? "workspace";
+}
+
+type PersistedThemeMode = "light" | "dark" | "system";
+
+const SETTINGS_THEME_KEY = "openwork.react.settings.theme-mode";
+const SETTINGS_HIDE_TITLEBAR_KEY = "openwork.react.settings.hide-titlebar";
+const SETTINGS_UPDATE_AUTO_CHECK_KEY = "openwork.react.settings.update-auto-check";
+const SETTINGS_UPDATE_AUTO_DOWNLOAD_KEY = "openwork.react.settings.update-auto-download";
+
+function workspaceLabel(workspace: OpenworkWorkspaceInfo) {
+  return (
+    workspace.displayName?.trim() ||
+    workspace.openworkWorkspaceName?.trim() ||
+    workspace.name?.trim() ||
+    workspace.path?.trim() ||
+    t("session.workspace_fallback")
+  );
+}
+
+function toSessionGroups(
+  workspaces: RouteWorkspace[],
+  sessionsByWorkspaceId: Record<string, any[]>,
+  errorsByWorkspaceId: Record<string, string | null>,
+): WorkspaceSessionGroup[] {
+  return workspaces.map((workspace) => ({
+    workspace,
+    sessions: (sessionsByWorkspaceId[workspace.id] ?? []) as WorkspaceSessionGroup["sessions"],
+    status: errorsByWorkspaceId[workspace.id] ? "error" : "ready",
+    error: errorsByWorkspaceId[workspace.id],
+  }));
+}
+
+function isActiveSessionStatus(status: unknown) {
+  return status === "running" || status === "retry" || status === "busy";
+}
+
+function getSessionStatus(session: any) {
+  return session?.status ?? session?.state ?? session?.runStatus ?? null;
+}
+
+function parseSettingsPath(pathname: string): {
+  tab: SettingsTab;
+  redirectPath: string | null;
+  extensionsSection?: "all" | "mcp" | "plugins";
+} {
+  const trimmed = pathname.replace(/^\/settings\/?/, "").replace(/^\/+|\/+$/g, "");
+  if (!trimmed) {
+    return { tab: "general", redirectPath: "/settings/general" };
+  }
+
+  const [head, tail] = trimmed.split("/");
+  switch (head) {
+    case "general":
+    case "den":
+    case "skills":
+    case "advanced":
+    case "appearance":
+    case "environment":
+    case "updates":
+    case "recovery":
+    case "debug":
+      return { tab: head, redirectPath: null };
+    case "extensions":
+      if (tail === "mcp") return { tab: "extensions", redirectPath: null, extensionsSection: "mcp" };
+      if (tail === "plugins") return { tab: "extensions", redirectPath: null, extensionsSection: "plugins" };
+      return { tab: "extensions", redirectPath: null, extensionsSection: "all" };
+    default:
+      return { tab: "general", redirectPath: "/settings/general" };
+  }
+}
+
+function readStoredBoolean(key: string, fallback: boolean) {
+  if (typeof window === "undefined") return fallback;
+  try {
+    const raw = window.localStorage.getItem(key);
+    if (raw == null) return fallback;
+    return raw === "1";
+  } catch {
+    return fallback;
+  }
+}
+
+function writeStoredBoolean(key: string, value: boolean) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(key, value ? "1" : "0");
+  } catch {
+    // ignore persistence failures
+  }
+}
+
+function readStoredThemeMode(): PersistedThemeMode {
+  if (typeof window === "undefined") return "system";
+  try {
+    const raw = window.localStorage.getItem(SETTINGS_THEME_KEY);
+    return raw === "light" || raw === "dark" || raw === "system" ? raw : "system";
+  } catch {
+    return "system";
+  }
+}
+
+function applyThemeMode(mode: PersistedThemeMode) {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  const prefersDark = window.matchMedia?.("(prefers-color-scheme: dark)").matches ?? false;
+  const resolved = mode === "system" ? (prefersDark ? "dark" : "light") : mode;
+  document.documentElement.dataset.theme = resolved;
+}
+
+export function SettingsRoute() {
+  const navigate = useNavigate();
+  const location = useLocation();
+  const local = useLocal();
+  const platform = usePlatform();
+  const checkDesktopRestriction = useCheckDesktopRestriction();
+  const desktopConfig = useDesktopConfig();
+  const reloadCoordinator = useReloadCoordinator();
+  const route = parseSettingsPath(location.pathname);
+
+  const [loading, setLoading] = useState(true);
+  const [workspaces, setWorkspaces] = useState<RouteWorkspace[]>([]);
+  const [sessionsByWorkspaceId, setSessionsByWorkspaceId] = useState<Record<string, any[]>>({});
+  const [errorsByWorkspaceId, setErrorsByWorkspaceId] = useState<Record<string, string | null>>({});
+  const [workspaceConnectionOverrides, setWorkspaceConnectionOverrides] = useState<Record<string, WorkspaceConnectionState>>({});
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = useState("");
+  const [baseUrl, setBaseUrl] = useState("");
+  const [token, setToken] = useState("");
+  const [openworkClient, setOpenworkClient] = useState<OpenworkServerClient | null>(null);
+  const [activeClient, setActiveClient] = useState<Client | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [busyLabel, setBusyLabel] = useState<string | null>(null);
+  const [routeError, setRouteError] = useState<string | null>(null);
+  const workspacesRef = useRef<RouteWorkspace[]>([]);
+  const refreshInFlightRef = useRef(false);
+  const reconnectAttemptedWorkspaceIdRef = useRef("");
+  const refreshMcpServersRef = useRef<(() => void | Promise<void>) | null>(null);
+  const notifyMcpReloadingRef = useRef<(() => void) | null>(null);
+  const pollMcpServersAfterReloadRef = useRef<(() => void | Promise<void>) | null>(null);
+  const remoteWorkspaceCheckRunRef = useRef<Record<string, string>>({});
+  const remoteWorkspaceCheckRunCounterRef = useRef(0);
+  const [providers, setProviders] = useState<ProviderListItem[]>([]);
+  const [providerDefaults, setProviderDefaults] = useState<Record<string, string>>({});
+  const [providerConnectedIds, setProviderConnectedIds] = useState<string[]>([]);
+  const [disabledProviders, setDisabledProviders] = useState<string[]>([]);
+  const [developerMode, setDeveloperMode] = useState(false);
+  const [themeMode, setThemeMode] = useState<PersistedThemeMode>(readStoredThemeMode);
+  const [hideTitlebar, setHideTitlebar] = useState(() => readStoredBoolean(SETTINGS_HIDE_TITLEBAR_KEY, false));
+  const [updateAutoCheck, setUpdateAutoCheck] = useState(() =>
+    readStoredBoolean(SETTINGS_UPDATE_AUTO_CHECK_KEY, true),
+  );
+  const [updateAutoDownload, setUpdateAutoDownload] = useState(() =>
+    readStoredBoolean(SETTINGS_UPDATE_AUTO_DOWNLOAD_KEY, true),
+  );
+  const [configActionStatus, setConfigActionStatus] = useState<string | null>(null);
+  const [revealConfigBusy, setRevealConfigBusy] = useState(false);
+  const [resetConfigBusy, setResetConfigBusy] = useState(false);
+  const [createWorkspaceOpen, setCreateWorkspaceOpen] = useState(false);
+  const [createWorkspaceBusy, setCreateWorkspaceBusy] = useState(false);
+  const [createWorkspaceError, setCreateWorkspaceError] = useState<string | null>(null);
+  const [createWorkspaceRemoteBusy, setCreateWorkspaceRemoteBusy] = useState(false);
+  const [createWorkspaceRemoteError, setCreateWorkspaceRemoteError] = useState<string | null>(null);
+  const [modelPickerOpen, setModelPickerOpen] = useState(false);
+  const [modelPickerQuery, setModelPickerQuery] = useState("");
+  const [modelOptions, setModelOptions] = useState<ModelOption[]>([]);
+  const emptyWorkspaceDisplay = useMemo<WorkspaceDisplay>(
+    () => ({
+      id: "",
+      name: t("session.workspace_fallback"),
+      path: "",
+      preset: "starter",
+      workspaceType: "local",
+    }),
+    [],
+  );
+
+  const routeStateRef = useRef({
+    activeClient: null as Client | null,
+    selectedWorkspaceId: "",
+    selectedWorkspaceRoot: "",
+    selectedWorkspaceType: "local" as "local" | "remote",
+    runtimeWorkspaceId: null as string | null,
+    openworkServerClient: null as OpenworkServerClient | null,
+    openworkServerStatus: "disconnected" as "connected" | "disconnected",
+    openworkServerCapabilities: null as OpenworkServerCapabilities | null,
+    selectedWorkspaceDisplay: emptyWorkspaceDisplay as WorkspaceDisplay,
+    providerItems: [] as ProviderListItem[],
+    providerDefaults: {} as Record<string, string>,
+    providerConnectedIds: [] as string[],
+    disabledProviders: [] as string[],
+    developerMode: false,
+  });
+
+  const selectedWorkspace = useMemo(
+    () => workspaces.find((workspace) => workspace.id === selectedWorkspaceId) ?? workspaces[0] ?? null,
+    [selectedWorkspaceId, workspaces],
+  );
+  const workspaceConnectionStateById = useMemo(() => {
+    const next: Record<string, WorkspaceConnectionState> = { ...workspaceConnectionOverrides };
+    for (const workspace of workspaces) {
+      if (workspace.workspaceType !== "remote") continue;
+      const error = errorsByWorkspaceId[workspace.id]?.trim();
+      if (!error || next[workspace.id]?.status === "connecting") continue;
+      next[workspace.id] ??= {
+        status: "error",
+        message: getWorkspaceTaskLoadErrorDisplay(workspace, error).message || error,
+        checkedAt: null,
+      };
+    }
+    return next;
+  }, [errorsByWorkspaceId, workspaceConnectionOverrides, workspaces]);
+  const selectedWorkspaceRoot = selectedWorkspace?.path?.trim() || "";
+  const selectedWorkspaceDisplay = useMemo<WorkspaceDisplay>(
+    () =>
+      selectedWorkspace
+        ? {
+            id: selectedWorkspace.id,
+            name: selectedWorkspace.name ?? selectedWorkspace.displayNameResolved,
+            path: selectedWorkspace.path ?? "",
+            preset: "starter",
+            workspaceType: selectedWorkspace.workspaceType ?? "local",
+            displayName: selectedWorkspace.displayNameResolved,
+            openworkWorkspaceName: selectedWorkspace.openworkWorkspaceName,
+          }
+        : emptyWorkspaceDisplay,
+    [emptyWorkspaceDisplay, selectedWorkspace],
+  );
+
+  routeStateRef.current = {
+    activeClient,
+    selectedWorkspaceId,
+    selectedWorkspaceRoot,
+    selectedWorkspaceType: selectedWorkspace?.workspaceType ?? "local",
+    runtimeWorkspaceId: selectedWorkspace?.id ?? null,
+    openworkServerClient: openworkClient,
+    openworkServerStatus: openworkClient ? "connected" : "disconnected",
+    openworkServerCapabilities: openworkClient ? ROUTE_OPENWORK_CAPABILITIES : null,
+    selectedWorkspaceDisplay,
+    providerItems: providers,
+    providerDefaults,
+    providerConnectedIds,
+    disabledProviders,
+    developerMode,
+  };
+
+  const activeReloadBlockingSessions = useMemo(
+    () =>
+      Object.values(sessionsByWorkspaceId)
+        .flat()
+        .filter((session) => isActiveSessionStatus(getSessionStatus(session)))
+        .map((session: any) => ({
+          id: String(session?.id ?? ""),
+          title:
+            String(session?.title ?? session?.slug ?? session?.id ?? "").trim() ||
+            t("session.untitled"),
+        }))
+        .filter((session) => session.id.length > 0),
+    [sessionsByWorkspaceId],
+  );
+
+  const reloadWorkspaceEngineFromUi = useCallback(async () => {
+    const workspaceId = routeStateRef.current.runtimeWorkspaceId?.trim() || selectedWorkspaceId.trim();
+    if (!openworkClient || !workspaceId) {
+      setRouteError(t("app.error_connect_first"));
+      return false;
+    }
+
+    await openworkClient.reloadEngine(workspaceId);
+
+    try {
+      window.dispatchEvent(new CustomEvent("openwork-server-settings-changed"));
+    } catch {
+      // ignore browser event dispatch failures
+    }
+
+    // OpenCode reconnects MCPs async after dispose — the store polls until
+    // statuses settle so users don't have to collapse/expand the card.
+    void pollMcpServersAfterReloadRef.current?.();
+
+    return true;
+  }, [openworkClient, selectedWorkspaceId]);
+
+  useEffect(() => {
+    return reloadCoordinator.registerWorkspaceReloadControls({
+      canReloadWorkspaceEngine: () => Boolean(openworkClient && (selectedWorkspace?.id || selectedWorkspaceId)),
+      reloadWorkspaceEngine: reloadWorkspaceEngineFromUi,
+      activeSessions: () => activeReloadBlockingSessions,
+      stopSession: async (sessionId) => {
+        if (!activeClient) return;
+        await abortSessionSafe(activeClient, sessionId);
+      },
+    });
+  }, [
+    activeClient,
+    activeReloadBlockingSessions,
+    openworkClient,
+    reloadCoordinator,
+    reloadWorkspaceEngineFromUi,
+    selectedWorkspace?.id,
+    selectedWorkspaceId,
+  ]);
+
+  const shellLayout = useWorkspaceShellLayout({
+    expandedRightWidth: 320,
+    defaultLeftWidth: DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+    minLeftWidth: MIN_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+    maxLeftWidth: MAX_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+  });
+
+  const openworkServerStore = useMemo(
+    () =>
+      createOpenworkServerStore({
+        startupPreference: () => {
+          // In desktop mode, loopback URLs are ephemeral local runtime details.
+          // Only non-loopback stored URLs indicate an explicit remote/manual
+          // server connection preference.
+          if (!isDesktopRuntime()) return "server";
+          const stored = readOpenworkServerSettings();
+          const storedUrl = stored.urlOverride?.trim() ?? "";
+          return storedUrl && !isLoopbackOpenworkServerUrl(storedUrl) ? "server" : "local";
+        },
+        documentVisible: () => typeof document === "undefined" || document.visibilityState === "visible",
+        developerMode: () => routeStateRef.current.developerMode,
+        runtimeWorkspaceId: () => routeStateRef.current.runtimeWorkspaceId,
+        activeClient: () => routeStateRef.current.activeClient,
+        selectedWorkspaceDisplay: () => routeStateRef.current.selectedWorkspaceDisplay,
+        restartLocalServer: async () => {
+          if (!isDesktopRuntime()) return false;
+          try {
+            await openworkServerRestart({
+              remoteAccessEnabled:
+                readOpenworkServerSettings().remoteAccessEnabled === true,
+            });
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        createRemoteWorkspaceFlow: async () => false,
+      }),
+    [],
+  );
+  const connectionsStore = useMemo(
+    () =>
+      createConnectionsStore({
+        client: () => routeStateRef.current.activeClient,
+        setClient: setActiveClient,
+        projectDir: () => routeStateRef.current.selectedWorkspaceRoot,
+        selectedWorkspaceId: () => routeStateRef.current.selectedWorkspaceId,
+        selectedWorkspaceRoot: () => routeStateRef.current.selectedWorkspaceRoot,
+        workspaceType: () => routeStateRef.current.selectedWorkspaceType,
+        openworkServer: openworkServerStore,
+        runtimeWorkspaceId: () => routeStateRef.current.runtimeWorkspaceId,
+        developerMode: () => routeStateRef.current.developerMode,
+        markReloadRequired: reloadCoordinator.markReloadRequired,
+      }),
+    [openworkServerStore, reloadCoordinator.markReloadRequired],
+  );
+  refreshMcpServersRef.current = connectionsStore.refreshMcpServers;
+  notifyMcpReloadingRef.current = connectionsStore.notifyMcpReloading;
+  pollMcpServersAfterReloadRef.current = connectionsStore.pollMcpServersAfterReload;
+  const providerAuthStore = useMemo(
+    () =>
+      createProviderAuthStore({
+        client: () => routeStateRef.current.activeClient,
+        providers: () => routeStateRef.current.providerItems,
+        providerDefaults: () => routeStateRef.current.providerDefaults,
+        providerConnectedIds: () => routeStateRef.current.providerConnectedIds,
+        disabledProviders: () => routeStateRef.current.disabledProviders,
+        selectedWorkspaceDisplay: () => routeStateRef.current.selectedWorkspaceDisplay,
+        selectedWorkspaceRoot: () => routeStateRef.current.selectedWorkspaceRoot,
+        runtimeWorkspaceId: () => routeStateRef.current.runtimeWorkspaceId,
+        openworkServer: openworkServerStore,
+        setProviders,
+        setProviderDefaults,
+        setProviderConnectedIds,
+        setDisabledProviders,
+        markOpencodeConfigReloadRequired: () => {
+          setConfigActionStatus(t("settings.config_updated"));
+          reloadCoordinator.markReloadRequired("config", {
+            type: "config",
+            name: "opencode.json",
+            action: "updated",
+          });
+        },
+      }),
+    [openworkServerStore, reloadCoordinator.markReloadRequired],
+  );
+  const extensionsStore = useMemo(
+    () =>
+      createExtensionsStore({
+        client: () => routeStateRef.current.activeClient,
+        projectDir: () => routeStateRef.current.selectedWorkspaceRoot,
+        selectedWorkspaceId: () => routeStateRef.current.selectedWorkspaceId,
+        selectedWorkspaceRoot: () => routeStateRef.current.selectedWorkspaceRoot,
+        workspaceType: () => routeStateRef.current.selectedWorkspaceType,
+        openworkServer: openworkServerStore,
+        openworkServerConnection: () => ({
+          openworkServerClient: routeStateRef.current.openworkServerClient,
+          openworkServerStatus: routeStateRef.current.openworkServerStatus,
+          openworkServerCapabilities: routeStateRef.current.openworkServerCapabilities,
+        }),
+        runtimeWorkspaceId: () => routeStateRef.current.runtimeWorkspaceId,
+        setBusy,
+        setBusyLabel,
+        setBusyStartedAt: () => {},
+        setError: setRouteError,
+        markReloadRequired: reloadCoordinator.markReloadRequired,
+      }),
+    [openworkServerStore, reloadCoordinator.markReloadRequired],
+  );
+  const openworkServerSnapshot = useOpenworkServerStoreSnapshot(openworkServerStore);
+  const connectionsSnapshot = useConnectionsStoreSnapshot(connectionsStore);
+  const providerAuthSnapshot = useProviderAuthStoreSnapshot(providerAuthStore);
+  useExtensionsStoreSnapshot(extensionsStore);
+
+  const debugViewProps = useDebugViewModel({
+    developerMode,
+    openworkServerStore,
+    openworkServerSnapshot,
+    runtimeWorkspaceId: selectedWorkspace?.id ?? null,
+    selectedWorkspaceRoot,
+    setRouteError,
+  });
+  const onReleaseChannelChange = useCallback(
+    (next: "stable" | "alpha") => {
+      local.setPrefs((previous) => ({ ...previous, releaseChannel: next }));
+    },
+    [local],
+  );
+  const electronUpdaterState = useElectronUpdaterState({
+    releaseChannel: local.prefs.releaseChannel ?? "stable",
+    onReleaseChannelChange,
+    updateAutoDownload,
+    desktopConfig: desktopConfig.config,
+    setError: setRouteError,
+  });
+
+  const workspaceSessionGroups = useMemo(
+    () => toSessionGroups(workspaces, sessionsByWorkspaceId, errorsByWorkspaceId),
+    [errorsByWorkspaceId, sessionsByWorkspaceId, workspaces],
+  );
+
+  const opencodeBaseUrl = useMemo(() => {
+    if (!selectedWorkspaceId || !baseUrl) return "";
+    const mounted = buildOpenworkWorkspaceBaseUrl(baseUrl, selectedWorkspaceId) ?? baseUrl;
+    return `${mounted.replace(/\/+$/, "")}/opencode`;
+  }, [baseUrl, selectedWorkspaceId]);
+
+  const opencodeClient = useMemo(
+    () =>
+      opencodeBaseUrl && token
+        ? createClient(opencodeBaseUrl, selectedWorkspaceRoot || undefined, {
+            token,
+            mode: "openwork",
+          })
+        : null,
+    [opencodeBaseUrl, selectedWorkspaceRoot, token],
+  );
+
+  useEffect(() => {
+    setActiveClient(opencodeClient);
+  }, [opencodeClient]);
+
+  useEffect(() => {
+    if (!modelPickerOpen || !opencodeClient) return;
+    let cancelled = false;
+    void providerAuthStore.refreshProviders();
+    void (async () => {
+      try {
+        const res = await opencodeClient.config.providers({
+          directory: selectedWorkspaceRoot || undefined,
+        });
+        const data = (res as { data?: { providers?: Array<{ id: string; name: string; source?: string; models: Record<string, { id: string; name: string }> }> } }).data;
+        if (cancelled || !data?.providers) return;
+        const options: ModelOption[] = [];
+        for (const provider of data.providers) {
+          const modelIds = Object.keys(provider.models);
+          const hasModels = modelIds.length > 0;
+          for (const id of modelIds) {
+            const model = provider.models[id];
+            options.push({
+              providerID: provider.id,
+              modelID: id,
+              title: model.name || id,
+              description: provider.name,
+              behaviorTitle: "Reasoning",
+              behaviorLabel: "Default",
+              behaviorDescription: "",
+              behaviorValue: null,
+              isFree: false,
+              isConnected: hasModels,
+            });
+          }
+        }
+        setModelOptions(options);
+      } catch (error) {
+        setRouteError(
+          error instanceof Error
+            ? error.message
+            : t("app.unknown_error"),
+        );
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [modelPickerOpen, opencodeClient, selectedWorkspaceRoot]);
+
+  useEffect(() => {
+    local.setUi((previous) => ({ ...previous, view: "settings", tab: route.tab }));
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- local is stable via context
+  }, [route.tab]);
+
+  useEffect(() => {
+    applyThemeMode(themeMode);
+    if (typeof window !== "undefined") {
+      window.localStorage.setItem(SETTINGS_THEME_KEY, themeMode);
+    }
+  }, [themeMode]);
+
+  useEffect(() => {
+    writeStoredBoolean(SETTINGS_HIDE_TITLEBAR_KEY, hideTitlebar);
+  }, [hideTitlebar]);
+
+  useEffect(() => {
+    writeStoredBoolean(SETTINGS_UPDATE_AUTO_CHECK_KEY, updateAutoCheck);
+  }, [updateAutoCheck]);
+
+  useEffect(() => {
+    writeStoredBoolean(SETTINGS_UPDATE_AUTO_DOWNLOAD_KEY, updateAutoDownload);
+  }, [updateAutoDownload]);
+
+  const { markRouteReady: markBootRouteReady } = useBootState();
+  const refreshRouteState = useMemo(() => async () => {
+    if (refreshInFlightRef.current) return;
+    refreshInFlightRef.current = true;
+    setLoading(true);
+    setRouteError(null);
+    let desktopList = null as Awaited<ReturnType<typeof workspaceBootstrap>> | null;
+    let desktopWorkspaces = workspacesRef.current;
+    try {
+      if (isDesktopRuntime()) {
+        try {
+          desktopList = await workspaceBootstrap();
+          desktopWorkspaces = (desktopList.workspaces ?? []).map(mapDesktopWorkspace);
+        } catch (error) {
+          const message = describeRouteError(error);
+          console.error("[settings-route] workspaceBootstrap failed", error);
+          recordInspectorEvent("route.workspace_bootstrap.error", {
+            route: "settings",
+            message,
+            preservedWorkspaceCount: workspacesRef.current.length,
+          });
+          desktopWorkspaces = workspacesRef.current;
+        }
+      }
+      const { normalizedBaseUrl, resolvedToken, resolvedHostToken } = await resolveOpenworkConnection();
+
+      if (!normalizedBaseUrl || !resolvedToken) {
+        setOpenworkClient(null);
+        setBaseUrl("");
+        setToken("");
+        setWorkspaces(desktopWorkspaces);
+        setSessionsByWorkspaceId({});
+        setErrorsByWorkspaceId({});
+        setSelectedWorkspaceId(resolveWorkspaceListSelectedId(desktopList) || desktopWorkspaces[0]?.id || "");
+        return;
+      }
+
+      const client = createOpenworkServerClient({
+        baseUrl: normalizedBaseUrl,
+        token: resolvedToken,
+        hostToken: resolvedHostToken || undefined,
+      });
+      const list = await client.listWorkspaces();
+      const serverWorkspaceIds = new Set(list.items.map((workspace) => workspace.id));
+      const nextWorkspaces = mergeRouteWorkspaces(list.items, desktopWorkspaces);
+      const sessionEntries = await Promise.all(
+        nextWorkspaces.map(async (workspace) => {
+          if (!serverWorkspaceIds.has(workspace.id)) {
+            return { workspaceId: workspace.id, sessions: [], error: null as string | null };
+          }
+          try {
+            const response = await client.listSessions(workspace.id, { limit: 200 });
+            const workspaceRoot = normalizeDirectoryPath(workspace.path ?? "");
+            const items = workspaceRoot
+              ? (response.items ?? []).filter((session: any) =>
+                  normalizeDirectoryPath(session?.directory ?? "") === workspaceRoot,
+                )
+              : (response.items ?? []);
+            return {
+              workspaceId: workspace.id,
+              sessions: items,
+              error: null as string | null,
+              connectionState: null as WorkspaceConnectionState | null,
+            };
+          } catch (error) {
+            const fallback = error instanceof Error ? error.message : t("app.unknown_error");
+            if (workspace.workspaceType === "remote") {
+              const connectionState = await diagnoseRemoteWorkspaceTaskLoadFailure(workspace, fallback);
+              return {
+                workspaceId: workspace.id,
+                sessions: [],
+                error: connectionState.message ?? "Remote worker connection failed.",
+                connectionState,
+              };
+            }
+            return {
+              workspaceId: workspace.id,
+              sessions: [],
+              error: fallback,
+              connectionState: null,
+            };
+          }
+        }),
+      );
+
+      setOpenworkClient(client);
+      setBaseUrl(normalizedBaseUrl);
+      setToken(resolvedToken);
+      setWorkspaces(nextWorkspaces);
+      setSessionsByWorkspaceId(Object.fromEntries(sessionEntries.map((entry) => [entry.workspaceId, entry.sessions])));
+      setErrorsByWorkspaceId(Object.fromEntries(sessionEntries.map((entry) => [entry.workspaceId, entry.error])));
+      setWorkspaceConnectionOverrides((current) => {
+        const next = { ...current };
+        for (const entry of sessionEntries) {
+          if (entry.connectionState) {
+            next[entry.workspaceId] = entry.connectionState;
+          } else if (next[entry.workspaceId]?.status === "error") {
+            delete next[entry.workspaceId];
+          }
+        }
+        return next;
+      });
+      setSelectedWorkspaceId((current) =>
+        reconcileSelectedWorkspaceId(current, list, desktopList, nextWorkspaces),
+      );
+    } catch (error) {
+      const message = describeRouteError(error);
+      console.error("[settings-route] refreshRouteState failed", error);
+      recordInspectorEvent("route.refresh.error", {
+        route: "settings",
+        message,
+        preservedWorkspaceCount: desktopWorkspaces.length,
+      });
+      setRouteError(message);
+      if (desktopWorkspaces.length > 0) {
+        setWorkspaces(desktopWorkspaces);
+        setSelectedWorkspaceId((current) => current || resolveWorkspaceListSelectedId(desktopList) || desktopWorkspaces[0]?.id || "");
+      }
+    } finally {
+      setLoading(false);
+      refreshInFlightRef.current = false;
+      // Settings can be the first route a user lands on (direct link, deep
+      // link, or after reload). Let the boot overlay dismiss once we've
+      // completed our first data load.
+      markBootRouteReady();
+    }
+  }, [markBootRouteReady]);
+
+  useEffect(() => {
+    workspacesRef.current = workspaces;
+  }, [workspaces]);
+
+  useEffect(() => {
+    const activeWorkspaceIds = new Set(workspaces.map((workspace) => workspace.id));
+    setWorkspaceConnectionOverrides((current) => {
+      let changed = false;
+      const next: Record<string, WorkspaceConnectionState> = {};
+      for (const [workspaceId, state] of Object.entries(current)) {
+        if (activeWorkspaceIds.has(workspaceId)) {
+          next[workspaceId] = state;
+        } else {
+          changed = true;
+        }
+      }
+      return changed ? next : current;
+    });
+  }, [workspaces]);
+
+  const handleRemoteWorkspaceConnectionSaved = useCallback(
+    async (workspaceId: string) => {
+      delete remoteWorkspaceCheckRunRef.current[workspaceId];
+      setWorkspaceConnectionOverrides((current) => {
+        const next = { ...current };
+        delete next[workspaceId];
+        return next;
+      });
+      setErrorsByWorkspaceId((current) => ({ ...current, [workspaceId]: null }));
+      await refreshRouteState();
+    },
+    [refreshRouteState],
+  );
+
+  const remoteWorkspaceConnectionEditor = useRemoteWorkspaceConnectionEditor({
+    workspaces,
+    onSaved: handleRemoteWorkspaceConnectionSaved,
+  });
+
+  const runRemoteWorkspaceConnectionCheck = useCallback(
+    async (workspaceId: string, mode: "test" | "recover") => {
+      const workspace = workspacesRef.current.find((item) => item.id === workspaceId);
+      if (!workspace || workspace.workspaceType !== "remote") return false;
+      const connectionKey = getRemoteWorkspaceConnectionKey(workspace);
+      remoteWorkspaceCheckRunCounterRef.current += 1;
+      const runId = String(remoteWorkspaceCheckRunCounterRef.current);
+      remoteWorkspaceCheckRunRef.current[workspaceId] = runId;
+
+      setWorkspaceConnectionOverrides((current) => ({
+        ...current,
+        [workspaceId]: {
+          status: "connecting",
+          message: t("config.testing_connection"),
+          checkedAt: null,
+        },
+      }));
+
+      const result = await testRemoteWorkspaceConnection(workspace);
+      const currentWorkspace = workspacesRef.current.find((item) => item.id === workspaceId);
+      if (
+        remoteWorkspaceCheckRunRef.current[workspaceId] !== runId ||
+        !currentWorkspace ||
+        getRemoteWorkspaceConnectionKey(currentWorkspace) !== connectionKey
+      ) {
+        if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+          delete remoteWorkspaceCheckRunRef.current[workspaceId];
+        }
+        return false;
+      }
+      setWorkspaceConnectionOverrides((current) => ({
+        ...current,
+        [workspaceId]: result.state,
+      }));
+
+      if (!result.ok) {
+        setErrorsByWorkspaceId((current) => ({
+          ...current,
+          [workspaceId]: result.state.message ?? "Remote worker connection failed.",
+        }));
+        if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+          delete remoteWorkspaceCheckRunRef.current[workspaceId];
+        }
+        return false;
+      }
+
+      setErrorsByWorkspaceId((current) => ({ ...current, [workspaceId]: null }));
+      if (mode === "recover") {
+        await refreshRouteState();
+      }
+      if (remoteWorkspaceCheckRunRef.current[workspaceId] === runId) {
+        delete remoteWorkspaceCheckRunRef.current[workspaceId];
+      }
+      return true;
+    },
+    [refreshRouteState],
+  );
+
+  useEffect(() => {
+    if (!isDesktopRuntime()) return;
+    if (loading) return;
+    if (openworkClient) {
+      reconnectAttemptedWorkspaceIdRef.current = "";
+      return;
+    }
+    if (!selectedWorkspace || selectedWorkspace.workspaceType !== "local") return;
+    const workspaceId = selectedWorkspace.id?.trim() ?? "";
+    if (!workspaceId || reconnectAttemptedWorkspaceIdRef.current === workspaceId) return;
+    reconnectAttemptedWorkspaceIdRef.current = workspaceId;
+
+    void ensureDesktopLocalOpenworkConnection({
+      route: "settings",
+      workspace: selectedWorkspace,
+      allWorkspaces: workspaces,
+    }).catch((error) => {
+      const message = error instanceof Error ? error.message : describeRouteError(error);
+      setRouteError(message);
+    });
+  }, [loading, openworkClient, selectedWorkspace, workspaces]);
+
+  useEffect(() => {
+    void refreshRouteState();
+    const handleSettingsChange = () => {
+      void refreshRouteState();
+    };
+    window.addEventListener("openwork-server-settings-changed", handleSettingsChange);
+    return () => {
+      window.removeEventListener("openwork-server-settings-changed", handleSettingsChange);
+    };
+  }, [refreshRouteState]);
+
+  useEffect(() => {
+    openworkServerStore.start();
+    connectionsStore.start();
+    providerAuthStore.start();
+    extensionsStore.start();
+
+    return () => {
+      extensionsStore.dispose();
+      providerAuthStore.dispose();
+      connectionsStore.dispose();
+      openworkServerStore.dispose();
+    };
+  }, [connectionsStore, extensionsStore, openworkServerStore, providerAuthStore]);
+
+  // Periodically reconcile workspace-imported cloud providers from Den while
+  // signed in (dev #1509 "auto-sync cloud providers"). Mounted here because
+  // the settings route owns the provider-auth store.
+  useCloudProviderAutoSync(providerAuthStore.runCloudProviderSync);
+
+  useEffect(() => {
+    if (route.tab !== "den") return;
+    void providerAuthStore.runCloudProviderSync("settings_cloud_opened");
+  }, [providerAuthStore, route.tab]);
+
+  useEffect(() => {
+    openworkServerStore.syncFromOptions();
+    connectionsStore.syncFromOptions();
+    providerAuthStore.syncFromOptions();
+    extensionsStore.syncFromOptions();
+  }, [
+    activeClient,
+    connectionsStore,
+    extensionsStore,
+    openworkServerStore,
+    providerAuthStore,
+    selectedWorkspace?.id,
+    selectedWorkspace?.workspaceType,
+    selectedWorkspaceRoot,
+  ]);
+
+  useEffect(() => {
+    if (!activeClient) {
+      setProviders([]);
+      setProviderDefaults({});
+      setProviderConnectedIds([]);
+      setDisabledProviders([]);
+      return;
+    }
+    void providerAuthStore.refreshProviders();
+    void connectionsStore.refreshMcpServers();
+  }, [activeClient, connectionsStore, providerAuthStore, selectedWorkspace?.id]);
+
+  const selectedWorkspaceName = selectedWorkspace?.displayNameResolved ?? t("session.workspace_fallback");
+  const workspaceType = selectedWorkspace?.workspaceType ?? "local";
+  const isRemoteWorkspace = workspaceType === "remote";
+  const canWriteWorkspaceSkills =
+    !isRemoteWorkspace || openworkServerSnapshot.openworkServerCanWriteSkills;
+  const canWriteWorkspacePlugins =
+    !isRemoteWorkspace || openworkServerSnapshot.openworkServerCanWritePlugins;
+  const skillsAccessHint =
+    isRemoteWorkspace && !canWriteWorkspaceSkills ? t("app.skills_hint_readonly") : null;
+  const pluginsAccessHint =
+    isRemoteWorkspace && !canWriteWorkspacePlugins ? t("app.plugins_hint_readonly") : null;
+  const defaultModelLabel = local.prefs.defaultModel
+    ? `${local.prefs.defaultModel.providerID}/${local.prefs.defaultModel.modelID}`
+    : t("session.default_model");
+  const defaultModelRef = local.prefs.defaultModel
+    ? `${local.prefs.defaultModel.providerID}/${local.prefs.defaultModel.modelID}`
+    : t("settings.default_label");
+  const defaultModelVariantLabel = local.prefs.modelVariant ?? t("settings.default_label");
+  const providerStatusLabel = providerConnectedIds.length > 0 ? t("status.connected") : t("status.disconnected_label");
+  const providerStatusStyle = providerConnectedIds.length > 0
+    ? "bg-green-7/10 text-green-11 border-green-7/20"
+    : "bg-gray-4/60 text-gray-11 border-gray-7/50";
+  const providerSummary = providerConnectedIds.length > 0
+    ? t("status.providers_connected", { count: providerConnectedIds.length })
+    : t("settings.no_providers_connected");
+  const connectedProviders = providers
+    .filter((provider) => providerConnectedIds.includes(provider.id))
+    .map((provider) => ({
+      id: provider.id,
+      name: provider.name ?? provider.id,
+    }));
+  const mcpConnectedAppsCount = connectionsSnapshot.mcpServers.length;
+  const routeOpenworkStatus = openworkClient ? "connected" : "disconnected";
+  const routeOpenworkCapabilities: OpenworkServerCapabilities | null = openworkClient
+    ? ROUTE_OPENWORK_CAPABILITIES
+    : null;
+  const environmentRuntimeKey = buildOpenworkEnvRuntimeKey({
+    baseUrl: openworkServerSnapshot.openworkServerBaseUrl || openworkServerSnapshot.openworkServerUrl,
+    pid: openworkServerSnapshot.openworkServerHostInfo?.pid ?? null,
+    port: openworkServerSnapshot.openworkServerHostInfo?.port ?? null,
+  });
+
+  const handleApplyEnvironmentChanges = async () => {
+    if (!isDesktopRuntime()) {
+      throw new Error(t("settings.environment.apply_unavailable"));
+    }
+    if (activeReloadBlockingSessions.length > 0) {
+      throw new Error(t("settings.environment.apply_blocked_active_tasks"));
+    }
+    if (!selectedWorkspaceRoot) {
+      throw new Error(t("settings.environment.apply_no_local_workspace"));
+    }
+    const workspacePaths = Array.from(
+      new Set(
+        workspaces
+          .filter((workspace) => workspace.workspaceType !== "remote")
+          .map((workspace) => workspace.path?.trim() ?? "")
+          .filter((path) => path.length > 0),
+      ),
+    );
+    if (!workspacePaths.includes(selectedWorkspaceRoot)) {
+      workspacePaths.unshift(selectedWorkspaceRoot);
+    }
+    await engineStart(selectedWorkspaceRoot, {
+      preferSidecar: true,
+      runtime: "direct",
+      workspacePaths,
+      openworkRemoteAccess: openworkServerSnapshot.openworkServerSettings.remoteAccessEnabled === true,
+    });
+    const reconnected = await openworkServerStore.reconnectOpenworkServer();
+    if (!reconnected) {
+      await refreshRouteState().catch(() => {});
+      return { statusMessage: t("settings.environment.apply_refresh_failed") };
+    }
+    await refreshRouteState();
+  };
+
+  const handleOpenCreateWorkspace = () => {
+    setCreateWorkspaceError(null);
+    setCreateWorkspaceRemoteError(null);
+    setCreateWorkspaceOpen(true);
+  };
+
+  const handleCreateWorkspace = async (preset: WorkspacePreset, folder: string | null) => {
+    if (!folder) return;
+    setCreateWorkspaceBusy(true);
+    setCreateWorkspaceError(null);
+    try {
+      const workspaceName = folderNameFromPath(folder);
+      const list = await workspaceCreate({
+        folderPath: folder,
+        name: workspaceName,
+        preset,
+      });
+      const createdId = resolveWorkspaceListSelectedId(list) || list.workspaces[list.workspaces.length - 1]?.id || "";
+      if (createdId) {
+        await workspaceSetSelected(createdId).catch(() => undefined);
+        await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+      }
+      // Register the workspace with the running openwork-server so
+      // listWorkspaces() reflects it immediately. Without this the UI only
+      // picks up the new workspace after an app restart (because the server
+      // is launched with a fixed --workspace list at boot and the bridge
+      // write only updates desktop-side state).
+      if (openworkClient) {
+        await openworkClient
+          .createLocalWorkspace({ folderPath: folder, name: workspaceName, preset })
+          .catch(() => undefined);
+      }
+      setCreateWorkspaceOpen(false);
+      await refreshRouteState();
+    } catch (error) {
+      setCreateWorkspaceError(describeWorkspaceCreateError(error));
+    } finally {
+      setCreateWorkspaceBusy(false);
+    }
+  };
+
+  const handleCreateRemoteWorkspace = async (input: {
+    openworkHostUrl?: string | null;
+    openworkToken?: string | null;
+    directory?: string | null;
+    displayName?: string | null;
+  }) => {
+    const baseUrlValue = input.openworkHostUrl?.trim() ?? "";
+    if (!baseUrlValue) return false;
+    setCreateWorkspaceRemoteBusy(true);
+    setCreateWorkspaceRemoteError(null);
+    try {
+      const list = await workspaceCreateRemote({
+        baseUrl: baseUrlValue,
+        openworkHostUrl: baseUrlValue,
+        openworkToken: input.openworkToken?.trim() || null,
+        displayName: input.displayName?.trim() || null,
+        directory: input.directory?.trim() || null,
+        remoteType: "openwork",
+      });
+      const createdId = resolveWorkspaceListSelectedId(list) || list.workspaces[list.workspaces.length - 1]?.id || "";
+      if (createdId) {
+        await workspaceSetSelected(createdId).catch(() => undefined);
+        await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+      }
+      setCreateWorkspaceOpen(false);
+      await refreshRouteState();
+      return true;
+    } catch (error) {
+      setCreateWorkspaceRemoteError(error instanceof Error ? error.message : t("app.unknown_error"));
+      return false;
+    } finally {
+      setCreateWorkspaceRemoteBusy(false);
+    }
+  };
+
+  const handleReconnectMessagingServer = useCallback(async () => {
+    const ok = await openworkServerStore.reconnectOpenworkServer();
+    if (ok) {
+      await refreshRouteState();
+    }
+    return ok;
+  }, [openworkServerStore, refreshRouteState]);
+
+  const handleRestartLocalServer = useCallback(async () => {
+    if (!isDesktopRuntime()) return false;
+    try {
+      await openworkServerRestart({
+        remoteAccessEnabled:
+          readOpenworkServerSettings().remoteAccessEnabled === true,
+      });
+      await openworkServerStore.reconnectOpenworkServer();
+      await refreshRouteState();
+      return true;
+    } catch {
+      return false;
+    }
+  }, [openworkServerStore, refreshRouteState]);
+
+  const handleRestartMessagingWorker = useCallback(async () => {
+    if (!isDesktopRuntime()) return false;
+
+    try {
+      await openworkServerRestart({
+        remoteAccessEnabled:
+          readOpenworkServerSettings().remoteAccessEnabled === true,
+      });
+      await openworkServerStore.reconnectOpenworkServer();
+      await refreshRouteState();
+      return true;
+    } catch {
+      return false;
+    }
+  }, [openworkServerStore, refreshRouteState]);
+
+  const messagingViewProps = useMessagingViewProps({
+    busy,
+    openworkServerStatus: openworkServerSnapshot.openworkServerStatus,
+    openworkServerUrl: openworkServerSnapshot.openworkServerUrl,
+    openworkServerClient:
+      openworkClient ?? openworkServerSnapshot.openworkServerClient,
+    openworkReconnectBusy: openworkServerSnapshot.openworkReconnectBusy,
+    reconnectOpenworkServer: handleReconnectMessagingServer,
+    restartMessagingWorker: handleRestartMessagingWorker,
+    workspaceId: selectedWorkspace?.id ?? null,
+    selectedWorkspaceRoot,
+  });
+
+  if (route.redirectPath) {
+    return <Navigate to={route.redirectPath} replace />;
+  }
+
+  const settingsView = (() => {
+    switch (route.tab) {
+      case "general":
+        return (
+          <GeneralSettingsView
+            authorizedFoldersPanel={{
+              openworkServerClient: openworkClient,
+              openworkServerStatus: routeOpenworkStatus,
+              openworkServerCapabilities: routeOpenworkCapabilities,
+              runtimeWorkspaceId: selectedWorkspace?.id ?? null,
+              selectedWorkspaceRoot,
+              activeWorkspaceType: workspaceType,
+              onConfigUpdated: () => {
+                setConfigActionStatus(t("settings.config_updated"));
+                void providerAuthStore.refreshProviders();
+                void connectionsStore.refreshMcpServers();
+              },
+            }}
+            busy={busy}
+            providerAuthBusy={providerAuthSnapshot.providerAuthBusy}
+            providerStatusLabel={providerStatusLabel}
+            providerStatusStyle={providerStatusStyle}
+            providerSummary={providerSummary}
+            connectedProviders={connectedProviders}
+            disconnectingProviderId={null}
+            providerConnectError={providerAuthSnapshot.providerAuthError}
+            providerDisconnectStatus={configActionStatus}
+            providerDisconnectError={null}
+            onOpenProviderAuth={() => providerAuthStore.openProviderAuthModal()}
+            onDisconnectProvider={async (providerId) => {
+              await providerAuthStore.disconnectProvider(providerId);
+            }}
+            canDisconnectProvider={() => true}
+            defaultModelLabel={defaultModelLabel}
+            defaultModelRef={defaultModelRef}
+            onChangeDefaultModel={() => {
+              setModelPickerQuery("");
+              setModelPickerOpen(true);
+            }}
+            showThinking={local.prefs.showThinking}
+            onToggleShowThinking={() => {
+              local.setPrefs((previous) => ({ ...previous, showThinking: !previous.showThinking }));
+            }}
+            defaultModelVariantLabel={defaultModelVariantLabel}
+            onConfigureModelBehavior={() => {
+              setRouteError("Model behavior picker is not wired into the React settings route yet.");
+            }}
+            autoCompactContext={false}
+            autoCompactContextBusy={false}
+            onToggleAutoCompactContext={() => {
+              setRouteError("Auto-compact controls are not wired into the React settings route yet.");
+            }}
+            onSendFeedback={() => platform.openLink(buildFeedbackUrl({ entrypoint: "settings" }))}
+            onJoinDiscord={() => platform.openLink("https://discord.gg/VEhNQXxYMB")}
+            onReportIssue={() => platform.openLink("https://github.com/different-ai/openwork/issues/new?template=bug.yml")}
+          />
+        );
+      case "automations":
+        return (
+          <AutomationsView
+            automations={automationsStore}
+            busy={busy}
+            selectedWorkspaceRoot={selectedWorkspaceRoot}
+            createSessionAndOpen={async () => undefined}
+            newTaskDisabled={!opencodeClient}
+            schedulerInstalled={false}
+            canEditPlugins={canWriteWorkspacePlugins}
+            addPlugin={async () => {
+              setRouteError("Scheduler plugin install is not wired into the React settings route yet.");
+            }}
+            reloadWorkspaceEngine={reloadCoordinator.reloadWorkspaceEngine}
+            reloadBusy={false}
+            canReloadWorkspace={reloadCoordinator.canReloadWorkspaceEngine}
+            openLink={(url) => platform.openLink(url)}
+          />
+        );
+      case "skills":
+        return (
+          <SkillsView
+            workspaceName={selectedWorkspaceName}
+            busy={busy}
+            canInstallSkillCreator={canWriteWorkspaceSkills}
+            canUseDesktopTools={!isRemoteWorkspace}
+            accessHint={skillsAccessHint}
+            extensions={extensionsStore}
+            onOpenLink={(url) => platform.openLink(url)}
+            createSessionAndOpen={async (_command?: string): Promise<string | undefined> => {
+              navigate("/session");
+              return undefined;
+            }}
+          />
+        );
+      case "extensions":
+        return (
+          <ExtensionsView
+            busy={busy}
+            selectedWorkspaceRoot={selectedWorkspaceRoot}
+            isRemoteWorkspace={isRemoteWorkspace}
+            canEditPlugins={canWriteWorkspacePlugins}
+            canUseGlobalScope={!isRemoteWorkspace}
+            accessHint={pluginsAccessHint}
+            suggestedPlugins={SUGGESTED_PLUGINS}
+            extensions={extensionsStore}
+            mcpConnectedAppsCount={mcpConnectedAppsCount}
+            initialSection={route.extensionsSection}
+            setSectionRoute={(section) => navigate(`/settings/extensions/${section}`)}
+            onRefresh={() => {
+              void connectionsStore.refreshMcpServers();
+              void extensionsStore.refreshPlugins();
+            }}
+            mcpView={
+              <McpView
+                busy={busy}
+                selectedWorkspaceRoot={selectedWorkspaceRoot}
+                isRemoteWorkspace={isRemoteWorkspace}
+                mcpServers={connectionsSnapshot.mcpServers}
+                mcpStatus={connectionsSnapshot.mcpStatus}
+                mcpLastUpdatedAt={connectionsSnapshot.mcpLastUpdatedAt}
+                mcpStatuses={connectionsSnapshot.mcpStatuses}
+                mcpConnectingName={connectionsSnapshot.mcpConnectingName}
+                selectedMcp={connectionsSnapshot.selectedMcp}
+                setSelectedMcp={(name) => connectionsStore.setSelectedMcp(name)}
+                quickConnect={connectionsStore.quickConnect}
+                connectMcp={(entry) => {
+                  void connectionsStore.connectMcp(entry);
+                }}
+                authorizeMcp={(entry) => {
+                  void connectionsStore.authorizeMcp(entry);
+                }}
+                logoutMcpAuth={(name) => connectionsStore.logoutMcpAuth(name)}
+                removeMcp={(name) => {
+                  void connectionsStore.removeMcp(name);
+                }}
+                setMcpEnabled={
+                  routeOpenworkStatus === "connected" && routeOpenworkCapabilities?.mcp?.write
+                    ? (name, enabled) => connectionsStore.setMcpEnabled(name, enabled)
+                    : undefined
+                }
+                readConfigFile={(scope) => connectionsStore.readMcpConfigFile(scope)}
+                showHeader={false}
+              />
+            }
+          />
+        );
+      case "den":
+        return (
+          <DenView
+            developerMode={developerMode}
+            extensions={extensionsStore}
+            openLink={(url) => platform.openLink(url)}
+            connectRemoteWorkspace={async () => false}
+            cloudOrgProviders={providerAuthSnapshot.cloudOrgProviders}
+            importedCloudProviders={providerAuthSnapshot.importedCloudProviders}
+            refreshCloudOrgProviders={providerAuthStore.refreshCloudOrgProviders}
+            connectCloudProvider={providerAuthStore.connectCloudProvider}
+            removeCloudProvider={providerAuthStore.removeCloudProvider}
+          />
+        );
+      case "advanced":
+        return (
+          <AdvancedView
+            busy={busy}
+            baseUrl={opencodeBaseUrl}
+            headerStatus={openworkServerSnapshot.openworkServerStatus}
+            clientConnected={Boolean(opencodeClient)}
+            opencodeConnectStatus={null}
+            openworkServerStatus={openworkServerSnapshot.openworkServerStatus}
+            openworkServerUrl={openworkServerSnapshot.openworkServerUrl}
+            openworkReconnectBusy={openworkServerSnapshot.openworkReconnectBusy}
+            reconnectOpenworkServer={openworkServerStore.reconnectOpenworkServer}
+            engineInfo={null}
+            restartLocalServer={handleRestartLocalServer}
+            stopHost={() => {}}
+            developerMode={developerMode}
+            toggleDeveloperMode={() => setDeveloperMode((current) => !current)}
+            opencodeDevModeEnabled={false}
+            openDebugDeepLink={async () => ({ ok: false, message: "Debug deep links are not wired into the React settings route yet." })}
+            opencodeEnableExa={false}
+            toggleOpencodeEnableExa={() => {
+              setRouteError("EXA controls are not wired into the React settings route yet.");
+            }}
+            microsandboxCreateSandboxEnabled={local.prefs.featureFlags.microsandboxCreateSandbox}
+            toggleMicrosandboxCreateSandbox={() => {
+              local.setPrefs((previous) => ({
+                ...previous,
+                featureFlags: {
+                  ...previous.featureFlags,
+                  microsandboxCreateSandbox: !previous.featureFlags.microsandboxCreateSandbox,
+                },
+              }));
+            }}
+            configView={{
+              busy,
+              clientConnected: Boolean(opencodeClient),
+              anyActiveRuns: false,
+              openworkServerStatus: openworkServerSnapshot.openworkServerStatus,
+              openworkServerUrl: openworkServerSnapshot.openworkServerUrl,
+              openworkServerSettings: openworkServerSnapshot.openworkServerSettings,
+              openworkServerHostInfo: openworkServerSnapshot.openworkServerHostInfo,
+              runtimeWorkspaceId: selectedWorkspace?.id ?? null,
+              updateOpenworkServerSettings: openworkServerStore.updateOpenworkServerSettings,
+              resetOpenworkServerSettings: openworkServerStore.resetOpenworkServerSettings,
+              testOpenworkServerConnection: openworkServerStore.testOpenworkServerConnection,
+              canReloadWorkspace: reloadCoordinator.canReloadWorkspaceEngine,
+              reloadWorkspaceEngine: reloadCoordinator.reloadWorkspaceEngine,
+              reloadBusy: false,
+              reloadError: routeError,
+              developerMode,
+            }}
+          />
+        );
+      case "appearance":
+        return (
+          <AppearanceView
+            busy={busy}
+            themeMode={themeMode}
+            setThemeMode={setThemeMode}
+            language={currentLocale() as Language}
+            setLanguage={setLocale}
+            hideTitlebar={hideTitlebar}
+            toggleHideTitlebar={() => setHideTitlebar((current) => !current)}
+          />
+        );
+      case "updates":
+        return (
+          <UpdatesView
+            busy={busy}
+            webDeployment={platform.platform === "web"}
+            appVersion={electronUpdaterState.appVersion}
+            updateEnv={electronUpdaterState.updateEnv}
+            updateAutoCheck={updateAutoCheck}
+            toggleUpdateAutoCheck={() => setUpdateAutoCheck((current) => !current)}
+            updateAutoDownload={updateAutoDownload}
+            toggleUpdateAutoDownload={() => setUpdateAutoDownload((current) => !current)}
+            updateStatus={electronUpdaterState.updateStatus}
+            anyActiveRuns={activeReloadBlockingSessions.length > 0}
+            checkForUpdates={electronUpdaterState.checkForUpdates}
+            downloadUpdate={electronUpdaterState.downloadUpdate}
+            installUpdateAndRestart={electronUpdaterState.installUpdateAndRestart}
+            releaseChannel={local.prefs.releaseChannel ?? "stable"}
+            onReleaseChannelChange={electronUpdaterState.setReleaseChannel}
+            alphaChannelSupported={isElectronRuntime() && isMacPlatform()}
+          />
+        );
+      case "recovery":
+        return (
+          <RecoveryView
+            anyActiveRuns={false}
+            workspaceConfigPath={selectedWorkspaceRoot ? `${selectedWorkspaceRoot}/opencode.json` : ""}
+            revealConfigBusy={revealConfigBusy}
+            onRevealWorkspaceConfig={async () => {
+              setRevealConfigBusy(true);
+              setConfigActionStatus("Reveal workspace config is not wired into the React settings route yet.");
+              setRevealConfigBusy(false);
+            }}
+            resetConfigBusy={resetConfigBusy}
+            onResetAppConfigDefaults={async () => {
+              setResetConfigBusy(true);
+              setConfigActionStatus("Reset app config defaults is not wired into the React settings route yet.");
+              setResetConfigBusy(false);
+            }}
+            configActionStatus={configActionStatus}
+            cacheRepairBusy={false}
+            cacheRepairResult={null}
+            onRepairOpencodeCache={() => {
+              setRouteError("Cache repair is not wired into the React settings route yet.");
+            }}
+            dockerCleanupBusy={false}
+            dockerCleanupResult={null}
+            onCleanupOpenworkDockerContainers={() => {
+              setRouteError("Docker cleanup is not wired into the React settings route yet.");
+            }}
+          />
+        );
+      case "environment":
+        return (
+          <EnvironmentView
+            client={openworkServerSnapshot.openworkServerClient}
+            isRemoteWorkspace={isRemoteWorkspace}
+            onStatusMessage={setConfigActionStatus}
+            onApplyChanges={isDesktopRuntime() && !isRemoteWorkspace ? handleApplyEnvironmentChanges : undefined}
+            applyBlocked={activeReloadBlockingSessions.length > 0}
+            applyBlockedReason={
+              activeReloadBlockingSessions.length > 0
+                ? t("settings.environment.apply_blocked_active_tasks")
+                : null
+            }
+            runtimeKey={environmentRuntimeKey}
+          />
+        );
+      case "messaging":
+        return <MessagingView {...messagingViewProps} />;
+      case "debug":
+        return <DebugView {...debugViewProps} />;
+      default:
+        return null;
+    }
+  })();
+
+  return (
+    <>
+      <SettingsShell
+        activeTab={route.tab}
+        onSelectTab={(tab) => navigate(`/settings/${tab}`)}
+        developerMode={developerMode}
+        selectedWorkspaceName={selectedWorkspaceName}
+        headerStatus={routeOpenworkStatus}
+        busyHint={loading ? t("session.loading_detail") : busyLabel}
+        workspaceSessionListProps={{
+          workspaceSessionGroups,
+          selectedWorkspaceId,
+          developerMode,
+          selectedSessionId: null,
+          connectingWorkspaceId: null,
+          workspaceConnectionStateById,
+          newTaskDisabled: !opencodeClient,
+          onSelectWorkspace: async (workspaceId) => {
+            setSelectedWorkspaceId(workspaceId);
+            return true;
+          },
+          onOpenSession: (_workspaceId, sessionId) => navigate(`/session/${sessionId}`),
+          onCreateTaskInWorkspace: () => navigate("/session"),
+          onOpenRenameWorkspace: () => {},
+          onShareWorkspace: () => {},
+          onRevealWorkspace: () => {},
+          onRecoverWorkspace: (workspaceId) => runRemoteWorkspaceConnectionCheck(workspaceId, "recover"),
+          onTestWorkspaceConnection: (workspaceId) => runRemoteWorkspaceConnectionCheck(workspaceId, "test"),
+          onEditWorkspaceConnection: remoteWorkspaceConnectionEditor.open,
+          onForgetWorkspace: () => {},
+          onOpenCreateWorkspace: handleOpenCreateWorkspace,
+        }}
+        onClose={() => navigate("/session")}
+        sidebarWidth={shellLayout.leftSidebarWidth}
+        onSidebarResizeStart={shellLayout.startLeftSidebarResize}
+        error={routeError}
+      >
+        {settingsView}
+      </SettingsShell>
+
+      <ProviderAuthModal
+        open={providerAuthSnapshot.providerAuthModalOpen}
+        loading={false}
+        submitting={providerAuthSnapshot.providerAuthBusy}
+        error={providerAuthSnapshot.providerAuthError}
+        preferredProviderId={providerAuthSnapshot.providerAuthPreferredProviderId}
+        workerType={providerAuthSnapshot.providerAuthWorkerType}
+        // Hide any provider the org blocks at the desktop layer so users
+        // can't connect a forbidden one (dev #1505). Same helper covers
+        // opencode-provider gating via the `blockZenModel` restriction.
+        providers={providerAuthSnapshot.providerAuthProviders.filter(
+          (provider) =>
+            !isDesktopProviderBlocked({
+              providerId: provider.id,
+              checkRestriction: checkDesktopRestriction,
+            }),
+        )}
+        connectedProviderIds={providerConnectedIds}
+        authMethods={providerAuthSnapshot.providerAuthMethods}
+        onSelect={providerAuthStore.startProviderAuth}
+        onSubmitApiKey={providerAuthStore.submitProviderApiKey}
+        onConnectCloudProvider={providerAuthStore.connectCloudProvider}
+        onSubmitOAuth={providerAuthStore.completeProviderAuthOAuth}
+        onRefreshProviders={providerAuthStore.refreshProviders}
+        onClose={() => providerAuthStore.closeProviderAuthModal()}
+      />
+      <CreateWorkspaceModal
+        open={createWorkspaceOpen}
+        onClose={() => {
+          setCreateWorkspaceOpen(false);
+          setCreateWorkspaceError(null);
+        }}
+        onConfirm={handleCreateWorkspace}
+        onConfirmRemote={handleCreateRemoteWorkspace}
+        onPickFolder={() => pickDirectory({ title: t("onboarding.authorize_folder") }) as Promise<string | null>}
+        submitting={createWorkspaceBusy}
+        localError={createWorkspaceError}
+        remoteSubmitting={createWorkspaceRemoteBusy}
+        remoteError={createWorkspaceRemoteError}
+      />
+      <CreateRemoteWorkspaceModal
+        open={remoteWorkspaceConnectionEditor.workspace !== null}
+        onClose={remoteWorkspaceConnectionEditor.close}
+        onConfirm={(input) => void remoteWorkspaceConnectionEditor.save(input)}
+        initialValues={remoteWorkspaceConnectionEditor.initialValues}
+        submitting={remoteWorkspaceConnectionEditor.busy}
+        error={remoteWorkspaceConnectionEditor.error}
+        title={t("dashboard.edit_remote_workspace_title")}
+        subtitle={t("dashboard.edit_remote_workspace_subtitle")}
+        confirmLabel={t("dashboard.edit_remote_workspace_confirm")}
+      />
+      <ConnectionsModals
+        client={activeClient}
+        projectDir={selectedWorkspaceRoot}
+        reloadBlocked={activeReloadBlockingSessions.length > 0}
+        activeSessions={activeReloadBlockingSessions}
+        isRemoteWorkspace={selectedWorkspace?.workspaceType === "remote"}
+        onForceStopSession={(sessionId) => {
+          if (!activeClient) return undefined;
+          return abortSessionSafe(activeClient, sessionId);
+        }}
+        onReloadEngine={reloadCoordinator.reloadWorkspaceEngine}
+        modalState={{
+          mcpAuthModalOpen: connectionsSnapshot.mcpAuthModalOpen,
+          mcpAuthEntry: connectionsSnapshot.mcpAuthEntry,
+          mcpAuthNeedsReload: connectionsSnapshot.mcpAuthNeedsReload,
+        }}
+        onCloseMcpAuthModal={() => connectionsStore.closeMcpAuthModal()}
+        onCompleteMcpAuthModal={() => connectionsStore.completeMcpAuthModal()}
+      />
+      <ModelPickerModal
+        open={modelPickerOpen}
+        options={modelOptions}
+        filteredOptions={modelOptions.filter((opt) => {
+          const q = modelPickerQuery.trim().toLowerCase();
+          if (!q) return true;
+          return (
+            opt.title.toLowerCase().includes(q) ||
+            opt.providerID.toLowerCase().includes(q) ||
+            opt.modelID.toLowerCase().includes(q)
+          );
+        })}
+        query={modelPickerQuery}
+        setQuery={setModelPickerQuery}
+        target="default"
+        current={
+          local.prefs.defaultModel ?? { providerID: "", modelID: "" }
+        }
+        onSelect={(next: ModelRef) => {
+          local.setPrefs((prev) => ({ ...prev, defaultModel: next }));
+          setModelPickerOpen(false);
+        }}
+        onBehaviorChange={() => {}}
+        onOpenSettings={() => {}}
+        onClose={() => setModelPickerOpen(false)}
+      />
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/shell/startup-deep-links.ts b/apps/app/src/react-app/shell/startup-deep-links.ts
new file mode 100644
index 0000000000..5d4994f36d
--- /dev/null
+++ b/apps/app/src/react-app/shell/startup-deep-links.ts
@@ -0,0 +1,27 @@
+import {
+  pushPendingDeepLinks,
+} from "../../app/lib/deep-link-bridge";
+import { subscribeDesktopDeepLinks } from "../../app/lib/desktop";
+import { isDesktopRuntime } from "../../app/utils";
+
+let started = false;
+
+export function startDeepLinkBridge(): void {
+  if (typeof window === "undefined" || started) return;
+  started = true;
+
+  if (!isDesktopRuntime()) {
+    pushPendingDeepLinks(window, [window.location.href]);
+    return;
+  }
+
+  void (async () => {
+    try {
+      await subscribeDesktopDeepLinks((urls) => {
+        pushPendingDeepLinks(window, urls);
+      });
+    } catch {
+      // ignore startup failures
+    }
+  })();
+}
diff --git a/apps/app/src/react-app/shell/welcome-route.tsx b/apps/app/src/react-app/shell/welcome-route.tsx
new file mode 100644
index 0000000000..e95b8c541e
--- /dev/null
+++ b/apps/app/src/react-app/shell/welcome-route.tsx
@@ -0,0 +1,187 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useState } from "react";
+import { useNavigate } from "react-router-dom";
+
+import { t } from "../../i18n";
+import {
+  pickDirectory,
+  resolveWorkspaceListSelectedId,
+  workspaceCreate,
+  workspaceCreateRemote,
+  workspaceSetRuntimeActive,
+  workspaceSetSelected,
+} from "../../app/lib/desktop";
+import { isDesktopRuntime } from "../../app/utils";
+import { useLocal } from "../kernel/local-provider";
+import { WelcomePage } from "../domains/onboarding/welcome-page";
+import { CreateWorkspaceModal } from "../domains/workspace/create-workspace-modal";
+import { resolveOpenworkConnection } from "./openwork-connection";
+import { createOpenworkServerClient } from "../../app/lib/openwork-server";
+import { writeActiveWorkspaceId } from "./session-memory";
+
+function folderNameFromPath(path: string) {
+  const normalized = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? "workspace";
+}
+
+/**
+ * WelcomeRoute: full-screen welcome page shown on first launch when
+ * the user has no workspaces and has not completed onboarding.
+ *
+ * Clicking "Get started" opens the CreateWorkspaceModal. Once a
+ * workspace is created, hasCompletedOnboarding is set and the user
+ * is redirected to /session.
+ */
+export function WelcomeRoute() {
+  const navigate = useNavigate();
+  const local = useLocal();
+  const [modalOpen, setModalOpen] = useState(false);
+  const [createBusy, setCreateBusy] = useState(false);
+  const [createError, setCreateError] = useState<string | null>(null);
+  const [remoteBusy, setRemoteBusy] = useState(false);
+  const [remoteError, setRemoteError] = useState<string | null>(null);
+
+  // If user already completed onboarding, redirect away immediately.
+  useEffect(() => {
+    if (local.prefs.hasCompletedOnboarding) {
+      navigate("/session", { replace: true });
+    }
+  }, [local.prefs.hasCompletedOnboarding, navigate]);
+
+  const markOnboardingComplete = useCallback(() => {
+    local.setPrefs((prev) => ({ ...prev, hasCompletedOnboarding: true }));
+  }, [local]);
+
+  const handleCreateWorkspace = useCallback(
+    async (_preset: string, folder: string | null) => {
+      if (!folder) return;
+      setCreateBusy(true);
+      setCreateError(null);
+      try {
+        const workspaceName = folderNameFromPath(folder);
+        const list = await workspaceCreate({
+          folderPath: folder,
+          name: workspaceName,
+          preset: "starter",
+        });
+        const createdId =
+          resolveWorkspaceListSelectedId(list) ||
+          list.workspaces[list.workspaces.length - 1]?.id ||
+          "";
+        if (createdId) {
+          await workspaceSetSelected(createdId).catch(() => undefined);
+          await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+          writeActiveWorkspaceId(createdId);
+        }
+        // Register with the running openwork-server if available.
+        try {
+          const { normalizedBaseUrl, resolvedToken, resolvedHostToken } =
+            await resolveOpenworkConnection();
+          if (normalizedBaseUrl && resolvedToken) {
+            const openworkClient = createOpenworkServerClient({
+              baseUrl: normalizedBaseUrl,
+              token: resolvedToken,
+              hostToken: resolvedHostToken || undefined,
+            });
+            await openworkClient
+              .createLocalWorkspace({
+                folderPath: folder,
+                name: workspaceName,
+                preset: "starter",
+              })
+              .catch(() => undefined);
+          }
+        } catch {
+          // Best-effort server registration.
+        }
+        markOnboardingComplete();
+        setModalOpen(false);
+        navigate("/settings/general", { replace: true });
+      } catch (error) {
+        setCreateError(
+          error instanceof Error ? error.message : "Failed to create workspace.",
+        );
+      } finally {
+        setCreateBusy(false);
+      }
+    },
+    [markOnboardingComplete, navigate],
+  );
+
+  const handleCreateRemote = useCallback(
+    async (input: {
+      openworkHostUrl?: string | null;
+      openworkToken?: string | null;
+      directory?: string | null;
+      displayName?: string | null;
+    }) => {
+      const baseUrlValue = input.openworkHostUrl?.trim() ?? "";
+      if (!baseUrlValue) return false;
+      setRemoteBusy(true);
+      setRemoteError(null);
+      try {
+        const list = await workspaceCreateRemote({
+          baseUrl: baseUrlValue,
+          openworkHostUrl: baseUrlValue,
+          openworkToken: input.openworkToken?.trim() || null,
+          displayName: input.displayName?.trim() || null,
+          directory: input.directory?.trim() || null,
+          remoteType: "openwork",
+        });
+        const createdId =
+          resolveWorkspaceListSelectedId(list) ||
+          list.workspaces[list.workspaces.length - 1]?.id ||
+          "";
+        if (createdId) {
+          await workspaceSetSelected(createdId).catch(() => undefined);
+          await workspaceSetRuntimeActive(createdId).catch(() => undefined);
+          writeActiveWorkspaceId(createdId);
+        }
+        markOnboardingComplete();
+        setModalOpen(false);
+        navigate("/session", { replace: true });
+        return true;
+      } catch (error) {
+        setRemoteError(
+          error instanceof Error ? error.message : "Connection failed.",
+        );
+        return false;
+      } finally {
+        setRemoteBusy(false);
+      }
+    },
+    [markOnboardingComplete, navigate],
+  );
+
+  return (
+    <>
+      <WelcomePage onGetStarted={() => setModalOpen(true)} />
+      <CreateWorkspaceModal
+        open={modalOpen}
+        onClose={() => {
+          setModalOpen(false);
+          setCreateError(null);
+          setRemoteError(null);
+        }}
+        onConfirm={handleCreateWorkspace}
+        onConfirmRemote={handleCreateRemote}
+        onPickFolder={() =>
+          pickDirectory({ title: t("onboarding.authorize_folder") }) as Promise<
+            string | null
+          >
+        }
+        submitting={createBusy}
+        localError={createError}
+        remoteSubmitting={remoteBusy}
+        remoteError={remoteError}
+        localDisabled={!isDesktopRuntime()}
+        localDisabledReason={
+          isDesktopRuntime()
+            ? undefined
+            : t("app.local_disabled_reason")
+        }
+      />
+    </>
+  );
+}
diff --git a/apps/app/src/react-app/shell/workspace-shell-layout.ts b/apps/app/src/react-app/shell/workspace-shell-layout.ts
new file mode 100644
index 0000000000..7e23d55d25
--- /dev/null
+++ b/apps/app/src/react-app/shell/workspace-shell-layout.ts
@@ -0,0 +1,151 @@
+/** @jsxImportSource react */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+
+const LEFT_SIDEBAR_WIDTH_KEY = "openwork.workspace-shell.left-width.v1";
+const RIGHT_SIDEBAR_EXPANDED_KEY = "openwork.workspace-shell.right-expanded.v3";
+
+export const DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH = 260;
+export const MIN_WORKSPACE_LEFT_SIDEBAR_WIDTH = 220;
+export const MAX_WORKSPACE_LEFT_SIDEBAR_WIDTH = 420;
+export const DEFAULT_WORKSPACE_RIGHT_SIDEBAR_COLLAPSED_WIDTH = 72;
+
+type WorkspaceShellLayoutOptions = {
+  defaultLeftWidth?: number;
+  minLeftWidth?: number;
+  maxLeftWidth?: number;
+  collapsedRightWidth?: number;
+  expandedRightWidth: number;
+};
+
+function readStorage(key: string): string | null {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+
+function writeStorage(key: string, value: string) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(key, value);
+  } catch {
+    // ignore persistence failures
+  }
+}
+
+function clampNumber(value: number, min: number, max: number) {
+  return Math.min(max, Math.max(min, value));
+}
+
+export function useWorkspaceShellLayout(options: WorkspaceShellLayoutOptions) {
+  const minLeftWidth = Math.max(180, options.minLeftWidth ?? MIN_WORKSPACE_LEFT_SIDEBAR_WIDTH);
+  const maxLeftWidth = Math.max(minLeftWidth, options.maxLeftWidth ?? MAX_WORKSPACE_LEFT_SIDEBAR_WIDTH);
+  const defaultLeftWidth = clampNumber(
+    options.defaultLeftWidth ?? DEFAULT_WORKSPACE_LEFT_SIDEBAR_WIDTH,
+    minLeftWidth,
+    maxLeftWidth,
+  );
+  const collapsedRightWidth = Math.max(
+    56,
+    options.collapsedRightWidth ?? DEFAULT_WORKSPACE_RIGHT_SIDEBAR_COLLAPSED_WIDTH,
+  );
+  const expandedRightWidth = Math.max(collapsedRightWidth, options.expandedRightWidth);
+
+  const readLeftSidebarWidth = useCallback(() => {
+    const raw = readStorage(LEFT_SIDEBAR_WIDTH_KEY);
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed)) return defaultLeftWidth;
+    return clampNumber(parsed, minLeftWidth, maxLeftWidth);
+  }, [defaultLeftWidth, maxLeftWidth, minLeftWidth]);
+
+  const readRightSidebarExpanded = useCallback(() => {
+    const raw = readStorage(RIGHT_SIDEBAR_EXPANDED_KEY);
+    if (raw == null) return false;
+    return raw === "1";
+  }, []);
+
+  const [leftSidebarWidth, setLeftSidebarWidth] = useState(readLeftSidebarWidth);
+  const [rightSidebarExpanded, setRightSidebarExpanded] = useState(readRightSidebarExpanded);
+  const dragCleanupRef = useRef<(() => void) | null>(null);
+
+  useEffect(() => {
+    writeStorage(
+      LEFT_SIDEBAR_WIDTH_KEY,
+      String(clampNumber(leftSidebarWidth, minLeftWidth, maxLeftWidth)),
+    );
+  }, [leftSidebarWidth, maxLeftWidth, minLeftWidth]);
+
+  useEffect(() => {
+    writeStorage(RIGHT_SIDEBAR_EXPANDED_KEY, rightSidebarExpanded ? "1" : "0");
+  }, [rightSidebarExpanded]);
+
+  const rightSidebarWidth = useMemo(
+    () => (rightSidebarExpanded ? expandedRightWidth : collapsedRightWidth),
+    [collapsedRightWidth, expandedRightWidth, rightSidebarExpanded],
+  );
+
+  const stopLeftSidebarResize = useCallback(() => {
+    dragCleanupRef.current?.();
+    dragCleanupRef.current = null;
+    if (typeof document === "undefined") return;
+    document.body.style.removeProperty("cursor");
+    document.body.style.removeProperty("user-select");
+  }, []);
+
+  const startLeftSidebarResize = useCallback(
+    (event: PointerEvent | React.PointerEvent<HTMLElement>) => {
+      if (event.button !== 0 || typeof window === "undefined") return;
+
+      stopLeftSidebarResize();
+      const initialX = event.clientX;
+      const initialWidth = leftSidebarWidth;
+
+      const handleMove = (moveEvent: PointerEvent) => {
+        const delta = moveEvent.clientX - initialX;
+        setLeftSidebarWidth(clampNumber(initialWidth + delta, minLeftWidth, maxLeftWidth));
+      };
+
+      const handleStop = () => {
+        stopLeftSidebarResize();
+      };
+
+      window.addEventListener("pointermove", handleMove);
+      window.addEventListener("pointerup", handleStop);
+      window.addEventListener("pointercancel", handleStop);
+      dragCleanupRef.current = () => {
+        window.removeEventListener("pointermove", handleMove);
+        window.removeEventListener("pointerup", handleStop);
+        window.removeEventListener("pointercancel", handleStop);
+      };
+
+      if (typeof document !== "undefined") {
+        document.body.style.cursor = "col-resize";
+        document.body.style.userSelect = "none";
+      }
+
+      event.preventDefault();
+    },
+    [leftSidebarWidth, maxLeftWidth, minLeftWidth, stopLeftSidebarResize],
+  );
+
+  const toggleRightSidebar = useCallback(() => {
+    setRightSidebarExpanded((current) => !current);
+  }, []);
+
+  useEffect(() => {
+    return () => {
+      stopLeftSidebarResize();
+    };
+  }, [stopLeftSidebarResize]);
+
+  return {
+    leftSidebarWidth,
+    rightSidebarExpanded,
+    rightSidebarWidth,
+    setRightSidebarExpanded,
+    startLeftSidebarResize,
+    toggleRightSidebar,
+  };
+}
diff --git a/apps/app/src/styles/colors.css b/apps/app/src/styles/colors.css
new file mode 100644
index 0000000000..0ea347a7ea
--- /dev/null
+++ b/apps/app/src/styles/colors.css
@@ -0,0 +1,3040 @@
+/* LLM AGENTS, PLEASE DONT READ THIS WHOLE FILE, Check the following lines: 3-5, 774-790, 1546-1570, 2290-2320. These are the Radix UI colors generated from the source CSS files and adapted to work properly */
+
+:root {
+  --amber-1: #fefdfb;
+  --amber-2: #fefbe9;
+  --amber-3: #fff7c2;
+  --amber-4: #ffee9c;
+  --amber-5: #fbe577;
+  --amber-6: #f3d673;
+  --amber-7: #e9c162;
+  --amber-8: #e2a336;
+  --amber-9: #ffc53d;
+  --amber-10: #ffba18;
+  --amber-11: #ab6400;
+  --amber-12: #4f3422;
+  --amber-a1: #c0800004;
+  --amber-a2: #f4d10016;
+  --amber-a3: #ffde003d;
+  --amber-a4: #ffd40063;
+  --amber-a5: #f8cf0088;
+  --amber-a6: #eab5008c;
+  --amber-a7: #dc9b009d;
+  --amber-a8: #da8a00c9;
+  --amber-a9: #ffb300c2;
+  --amber-a10: #ffb300e7;
+  --amber-a11: #ab6400;
+  --amber-a12: #341500dd;
+  --black-a1: rgba(0, 0, 0, 0.05);
+  --black-a2: rgba(0, 0, 0, 0.1);
+  --black-a3: rgba(0, 0, 0, 0.15);
+  --black-a4: rgba(0, 0, 0, 0.2);
+  --black-a5: rgba(0, 0, 0, 0.3);
+  --black-a6: rgba(0, 0, 0, 0.4);
+  --black-a7: rgba(0, 0, 0, 0.5);
+  --black-a8: rgba(0, 0, 0, 0.6);
+  --black-a9: rgba(0, 0, 0, 0.7);
+  --black-a10: rgba(0, 0, 0, 0.8);
+  --black-a11: rgba(0, 0, 0, 0.9);
+  --black-a12: rgba(0, 0, 0, 0.95);
+  --blue-1: #fbfdff;
+  --blue-2: #f4faff;
+  --blue-3: #e6f4fe;
+  --blue-4: #d5efff;
+  --blue-5: #c2e5ff;
+  --blue-6: #acd8fc;
+  --blue-7: #8ec8f6;
+  --blue-8: #5eb1ef;
+  --blue-9: #0090ff;
+  --blue-10: #0588f0;
+  --blue-11: #0d74ce;
+  --blue-12: #113264;
+  --blue-a1: #0080ff04;
+  --blue-a2: #008cff0b;
+  --blue-a3: #008ff519;
+  --blue-a4: #009eff2a;
+  --blue-a5: #0093ff3d;
+  --blue-a6: #0088f653;
+  --blue-a7: #0083eb71;
+  --blue-a8: #0084e6a1;
+  --blue-a9: #0090ff;
+  --blue-a10: #0086f0fa;
+  --blue-a11: #006dcbf2;
+  --blue-a12: #002359ee;
+  --bronze-1: #fdfcfc;
+  --bronze-2: #fdf7f5;
+  --bronze-3: #f6edea;
+  --bronze-4: #efe4df;
+  --bronze-5: #e7d9d3;
+  --bronze-6: #dfcdc5;
+  --bronze-7: #d3bcb3;
+  --bronze-8: #c2a499;
+  --bronze-9: #a18072;
+  --bronze-10: #957468;
+  --bronze-11: #7d5e54;
+  --bronze-12: #43302b;
+  --bronze-a1: #55000003;
+  --bronze-a2: #cc33000a;
+  --bronze-a3: #92250015;
+  --bronze-a4: #80280020;
+  --bronze-a5: #7423002c;
+  --bronze-a6: #7324003a;
+  --bronze-a7: #6c1f004c;
+  --bronze-a8: #671c0066;
+  --bronze-a9: #551a008d;
+  --bronze-a10: #4c150097;
+  --bronze-a11: #3d0f00ab;
+  --bronze-a12: #1d0600d4;
+  --brown-1: #fefdfc;
+  --brown-2: #fcf9f6;
+  --brown-3: #f6eee7;
+  --brown-4: #f0e4d9;
+  --brown-5: #ebdaca;
+  --brown-6: #e4cdb7;
+  --brown-7: #dcbc9f;
+  --brown-8: #cea37e;
+  --brown-9: #ad7f58;
+  --brown-10: #a07553;
+  --brown-11: #815e46;
+  --brown-12: #3e332e;
+  --brown-a1: #aa550003;
+  --brown-a2: #aa550009;
+  --brown-a3: #a04b0018;
+  --brown-a4: #9b4a0026;
+  --brown-a5: #9f4d0035;
+  --brown-a6: #a04e0048;
+  --brown-a7: #a34e0060;
+  --brown-a8: #9f4a0081;
+  --brown-a9: #823c00a7;
+  --brown-a10: #723300ac;
+  --brown-a11: #522100b9;
+  --brown-a12: #140600d1;
+  --crimson-1: #fffcfd;
+  --crimson-2: #fef7f9;
+  --crimson-3: #ffe9f0;
+  --crimson-4: #fedce7;
+  --crimson-5: #facedd;
+  --crimson-6: #f3bed1;
+  --crimson-7: #eaacc3;
+  --crimson-8: #e093b2;
+  --crimson-9: #e93d82;
+  --crimson-10: #df3478;
+  --crimson-11: #cb1d63;
+  --crimson-12: #621639;
+  --crimson-a1: #ff005503;
+  --crimson-a2: #e0004008;
+  --crimson-a3: #ff005216;
+  --crimson-a4: #f8005123;
+  --crimson-a5: #e5004f31;
+  --crimson-a6: #d0004b41;
+  --crimson-a7: #bf004753;
+  --crimson-a8: #b6004a6c;
+  --crimson-a9: #e2005bc2;
+  --crimson-a10: #d70056cb;
+  --crimson-a11: #c4004fe2;
+  --crimson-a12: #530026e9;
+  --cyan-1: #fafdfe;
+  --cyan-2: #f2fafb;
+  --cyan-3: #def7f9;
+  --cyan-4: #caf1f6;
+  --cyan-5: #b5e9f0;
+  --cyan-6: #9ddde7;
+  --cyan-7: #7dcedc;
+  --cyan-8: #3db9cf;
+  --cyan-9: #00a2c7;
+  --cyan-10: #0797b9;
+  --cyan-11: #107d98;
+  --cyan-12: #0d3c48;
+  --cyan-a1: #0099cc05;
+  --cyan-a2: #009db10d;
+  --cyan-a3: #00c2d121;
+  --cyan-a4: #00bcd435;
+  --cyan-a5: #01b4cc4a;
+  --cyan-a6: #00a7c162;
+  --cyan-a7: #009fbb82;
+  --cyan-a8: #00a3c0c2;
+  --cyan-a9: #00a2c7;
+  --cyan-a10: #0094b7f8;
+  --cyan-a11: #007491ef;
+  --cyan-a12: #00323ef2;
+  --gold-1: #fdfdfc;
+  --gold-2: #faf9f2;
+  --gold-3: #f2f0e7;
+  --gold-4: #eae6db;
+  --gold-5: #e1dccf;
+  --gold-6: #d8d0bf;
+  --gold-7: #cbc0aa;
+  --gold-8: #b9a88d;
+  --gold-9: #978365;
+  --gold-10: #8c7a5e;
+  --gold-11: #71624b;
+  --gold-12: #3b352b;
+  --gold-a1: #55550003;
+  --gold-a2: #9d8a000d;
+  --gold-a3: #75600018;
+  --gold-a4: #6b4e0024;
+  --gold-a5: #60460030;
+  --gold-a6: #64440040;
+  --gold-a7: #63420055;
+  --gold-a8: #633d0072;
+  --gold-a9: #5332009a;
+  --gold-a10: #492d00a1;
+  --gold-a11: #362100b4;
+  --gold-a12: #130c00d4;
+  --grass-1: #fbfefb;
+  --grass-2: #f5fbf5;
+  --grass-3: #e9f6e9;
+  --grass-4: #daf1db;
+  --grass-5: #c9e8ca;
+  --grass-6: #b2ddb5;
+  --grass-7: #94ce9a;
+  --grass-8: #65ba74;
+  --grass-9: #46a758;
+  --grass-10: #3e9b4f;
+  --grass-11: #2a7e3b;
+  --grass-12: #203c25;
+  --grass-a1: #00c00004;
+  --grass-a2: #0099000a;
+  --grass-a3: #00970016;
+  --grass-a4: #009f0725;
+  --grass-a5: #00930536;
+  --grass-a6: #008f0a4d;
+  --grass-a7: #018b0f6b;
+  --grass-a8: #008d199a;
+  --grass-a9: #008619b9;
+  --grass-a10: #007b17c1;
+  --grass-a11: #006514d5;
+  --grass-a12: #002006df;
+  --gray-1: #fcfcfc;
+  --gray-2: #f9f9f9;
+  --gray-3: #f0f0f0;
+  --gray-4: #e8e8e8;
+  --gray-5: #e0e0e0;
+  --gray-6: #d9d9d9;
+  --gray-7: #cecece;
+  --gray-8: #bbbbbb;
+  --gray-9: #8d8d8d;
+  --gray-10: #838383;
+  --gray-11: #646464;
+  --gray-12: #202020;
+  --gray-a1: #00000003;
+  --gray-a2: #00000006;
+  --gray-a3: #0000000f;
+  --gray-a4: #00000017;
+  --gray-a5: #0000001f;
+  --gray-a6: #00000026;
+  --gray-a7: #00000031;
+  --gray-a8: #00000044;
+  --gray-a9: #00000072;
+  --gray-a10: #0000007c;
+  --gray-a11: #0000009b;
+  --gray-a12: #000000df;
+  --green-1: #fbfefc;
+  --green-2: #f4fbf6;
+  --green-3: #e6f6eb;
+  --green-4: #d6f1df;
+  --green-5: #c4e8d1;
+  --green-6: #adddc0;
+  --green-7: #8eceaa;
+  --green-8: #5bb98b;
+  --green-9: #30a46c;
+  --green-10: #2b9a66;
+  --green-11: #218358;
+  --green-12: #193b2d;
+  --green-a1: #00c04004;
+  --green-a2: #00a32f0b;
+  --green-a3: #00a43319;
+  --green-a4: #00a83829;
+  --green-a5: #019c393b;
+  --green-a6: #00963c52;
+  --green-a7: #00914071;
+  --green-a8: #00924ba4;
+  --green-a9: #008f4acf;
+  --green-a10: #008647d4;
+  --green-a11: #00713fde;
+  --green-a12: #002616e6;
+  --indigo-1: #fdfdfe;
+  --indigo-2: #f7f9ff;
+  --indigo-3: #edf2fe;
+  --indigo-4: #e1e9ff;
+  --indigo-5: #d2deff;
+  --indigo-6: #c1d0ff;
+  --indigo-7: #abbdf9;
+  --indigo-8: #8da4ef;
+  --indigo-9: #3e63dd;
+  --indigo-10: #3358d4;
+  --indigo-11: #3a5bc7;
+  --indigo-12: #1f2d5c;
+  --indigo-a1: #00008002;
+  --indigo-a2: #0040ff08;
+  --indigo-a3: #0047f112;
+  --indigo-a4: #0044ff1e;
+  --indigo-a5: #0044ff2d;
+  --indigo-a6: #003eff3e;
+  --indigo-a7: #0037ed54;
+  --indigo-a8: #0034dc72;
+  --indigo-a9: #0031d2c1;
+  --indigo-a10: #002ec9cc;
+  --indigo-a11: #002bb7c5;
+  --indigo-a12: #001046e0;
+  --iris-1: #fdfdff;
+  --iris-2: #f8f8ff;
+  --iris-3: #f0f1fe;
+  --iris-4: #e6e7ff;
+  --iris-5: #dadcff;
+  --iris-6: #cbcdff;
+  --iris-7: #b8baf8;
+  --iris-8: #9b9ef0;
+  --iris-9: #5b5bd6;
+  --iris-10: #5151cd;
+  --iris-11: #5753c6;
+  --iris-12: #272962;
+  --iris-a1: #0000ff02;
+  --iris-a2: #0000ff07;
+  --iris-a3: #0011ee0f;
+  --iris-a4: #000bff19;
+  --iris-a5: #000eff25;
+  --iris-a6: #000aff34;
+  --iris-a7: #0008e647;
+  --iris-a8: #0008d964;
+  --iris-a9: #0000c0a4;
+  --iris-a10: #0000b6ae;
+  --iris-a11: #0600abac;
+  --iris-a12: #000246d8;
+  --jade-1: #fbfefd;
+  --jade-2: #f4fbf7;
+  --jade-3: #e6f7ed;
+  --jade-4: #d6f1e3;
+  --jade-5: #c3e9d7;
+  --jade-6: #acdec8;
+  --jade-7: #8bceb6;
+  --jade-8: #56ba9f;
+  --jade-9: #29a383;
+  --jade-10: #26997b;
+  --jade-11: #208368;
+  --jade-12: #1d3b31;
+  --jade-a1: #00c08004;
+  --jade-a2: #00a3460b;
+  --jade-a3: #00ae4819;
+  --jade-a4: #00a85129;
+  --jade-a5: #00a2553c;
+  --jade-a6: #009a5753;
+  --jade-a7: #00945f74;
+  --jade-a8: #00976ea9;
+  --jade-a9: #00916bd6;
+  --jade-a10: #008764d9;
+  --jade-a11: #007152df;
+  --jade-a12: #002217e2;
+  --lime-1: #fcfdfa;
+  --lime-2: #f8faf3;
+  --lime-3: #eef6d6;
+  --lime-4: #e2f0bd;
+  --lime-5: #d3e7a6;
+  --lime-6: #c2da91;
+  --lime-7: #abc978;
+  --lime-8: #8db654;
+  --lime-9: #bdee63;
+  --lime-10: #b0e64c;
+  --lime-11: #5c7c2f;
+  --lime-12: #37401c;
+  --lime-a1: #66990005;
+  --lime-a2: #6b95000c;
+  --lime-a3: #96c80029;
+  --lime-a4: #8fc60042;
+  --lime-a5: #81bb0059;
+  --lime-a6: #72aa006e;
+  --lime-a7: #61990087;
+  --lime-a8: #559200ab;
+  --lime-a9: #93e4009c;
+  --lime-a10: #8fdc00b3;
+  --lime-a11: #375f00d0;
+  --lime-a12: #1e2900e3;
+  --mauve-1: #fdfcfd;
+  --mauve-2: #faf9fb;
+  --mauve-3: #f2eff3;
+  --mauve-4: #eae7ec;
+  --mauve-5: #e3dfe6;
+  --mauve-6: #dbd8e0;
+  --mauve-7: #d0cdd7;
+  --mauve-8: #bcbac7;
+  --mauve-9: #8e8c99;
+  --mauve-10: #84828e;
+  --mauve-11: #65636d;
+  --mauve-12: #211f26;
+  --mauve-a1: #55005503;
+  --mauve-a2: #2b005506;
+  --mauve-a3: #30004010;
+  --mauve-a4: #20003618;
+  --mauve-a5: #20003820;
+  --mauve-a6: #14003527;
+  --mauve-a7: #10003332;
+  --mauve-a8: #08003145;
+  --mauve-a9: #05001d73;
+  --mauve-a10: #0500197d;
+  --mauve-a11: #0400119c;
+  --mauve-a12: #020008e0;
+  --mint-1: #f9fefd;
+  --mint-2: #f2fbf9;
+  --mint-3: #ddf9f2;
+  --mint-4: #c8f4e9;
+  --mint-5: #b3ecde;
+  --mint-6: #9ce0d0;
+  --mint-7: #7ecfbd;
+  --mint-8: #4cbba5;
+  --mint-9: #86ead4;
+  --mint-10: #7de0cb;
+  --mint-11: #027864;
+  --mint-12: #16433c;
+  --mint-a1: #00d5aa06;
+  --mint-a2: #00b18a0d;
+  --mint-a3: #00d29e22;
+  --mint-a4: #00cc9937;
+  --mint-a5: #00c0914c;
+  --mint-a6: #00b08663;
+  --mint-a7: #00a17d81;
+  --mint-a8: #009e7fb3;
+  --mint-a9: #00d3a579;
+  --mint-a10: #00c39982;
+  --mint-a11: #007763fd;
+  --mint-a12: #00312ae9;
+  --olive-1: #fcfdfc;
+  --olive-2: #f8faf8;
+  --olive-3: #eff1ef;
+  --olive-4: #e7e9e7;
+  --olive-5: #dfe2df;
+  --olive-6: #d7dad7;
+  --olive-7: #cccfcc;
+  --olive-8: #b9bcb8;
+  --olive-9: #898e87;
+  --olive-10: #7f847d;
+  --olive-11: #60655f;
+  --olive-12: #1d211c;
+  --olive-a1: #00550003;
+  --olive-a2: #00490007;
+  --olive-a3: #00200010;
+  --olive-a4: #00160018;
+  --olive-a5: #00180020;
+  --olive-a6: #00140028;
+  --olive-a7: #000f0033;
+  --olive-a8: #040f0047;
+  --olive-a9: #050f0078;
+  --olive-a10: #040e0082;
+  --olive-a11: #020a00a0;
+  --olive-a12: #010600e3;
+  --orange-1: #fefcfb;
+  --orange-2: #fff7ed;
+  --orange-3: #ffefd6;
+  --orange-4: #ffdfb5;
+  --orange-5: #ffd19a;
+  --orange-6: #ffc182;
+  --orange-7: #f5ae73;
+  --orange-8: #ec9455;
+  --orange-9: #f76b15;
+  --orange-10: #ef5f00;
+  --orange-11: #cc4e00;
+  --orange-12: #582d1d;
+  --orange-a1: #c0400004;
+  --orange-a2: #ff8e0012;
+  --orange-a3: #ff9c0029;
+  --orange-a4: #ff91014a;
+  --orange-a5: #ff8b0065;
+  --orange-a6: #ff81007d;
+  --orange-a7: #ed6c008c;
+  --orange-a8: #e35f00aa;
+  --orange-a9: #f65e00ea;
+  --orange-a10: #ef5f00;
+  --orange-a11: #cc4e00;
+  --orange-a12: #431200e2;
+  --pink-1: #fffcfe;
+  --pink-2: #fef7fb;
+  --pink-3: #fee9f5;
+  --pink-4: #fbdcef;
+  --pink-5: #f6cee7;
+  --pink-6: #efbfdd;
+  --pink-7: #e7acd0;
+  --pink-8: #dd93c2;
+  --pink-9: #d6409f;
+  --pink-10: #cf3897;
+  --pink-11: #c2298a;
+  --pink-12: #651249;
+  --pink-a1: #ff00aa03;
+  --pink-a2: #e0008008;
+  --pink-a3: #f4008c16;
+  --pink-a4: #e2008b23;
+  --pink-a5: #d1008331;
+  --pink-a6: #c0007840;
+  --pink-a7: #b6006f53;
+  --pink-a8: #af006f6c;
+  --pink-a9: #c8007fbf;
+  --pink-a10: #c2007ac7;
+  --pink-a11: #b60074d6;
+  --pink-a12: #59003bed;
+  --plum-1: #fefcff;
+  --plum-2: #fdf7fd;
+  --plum-3: #fbebfb;
+  --plum-4: #f7def8;
+  --plum-5: #f2d1f3;
+  --plum-6: #e9c2ec;
+  --plum-7: #deade3;
+  --plum-8: #cf91d8;
+  --plum-9: #ab4aba;
+  --plum-10: #a144af;
+  --plum-11: #953ea3;
+  --plum-12: #53195d;
+  --plum-a1: #aa00ff03;
+  --plum-a2: #c000c008;
+  --plum-a3: #cc00cc14;
+  --plum-a4: #c200c921;
+  --plum-a5: #b700bd2e;
+  --plum-a6: #a400b03d;
+  --plum-a7: #9900a852;
+  --plum-a8: #9000a56e;
+  --plum-a9: #89009eb5;
+  --plum-a10: #7f0092bb;
+  --plum-a11: #730086c1;
+  --plum-a12: #40004be6;
+  --purple-1: #fefcfe;
+  --purple-2: #fbf7fe;
+  --purple-3: #f7edfe;
+  --purple-4: #f2e2fc;
+  --purple-5: #ead5f9;
+  --purple-6: #e0c4f4;
+  --purple-7: #d1afec;
+  --purple-8: #be93e4;
+  --purple-9: #8e4ec6;
+  --purple-10: #8347b9;
+  --purple-11: #8145b5;
+  --purple-12: #402060;
+  --purple-a1: #aa00aa03;
+  --purple-a2: #8000e008;
+  --purple-a3: #8e00f112;
+  --purple-a4: #8d00e51d;
+  --purple-a5: #8000db2a;
+  --purple-a6: #7a01d03b;
+  --purple-a7: #6d00c350;
+  --purple-a8: #6600c06c;
+  --purple-a9: #5c00adb1;
+  --purple-a10: #53009eb8;
+  --purple-a11: #52009aba;
+  --purple-a12: #250049df;
+  --red-1: #fffcfc;
+  --red-2: #fff7f7;
+  --red-3: #feebec;
+  --red-4: #ffdbdc;
+  --red-5: #ffcdce;
+  --red-6: #fdbdbe;
+  --red-7: #f4a9aa;
+  --red-8: #eb8e90;
+  --red-9: #e5484d;
+  --red-10: #dc3e42;
+  --red-11: #ce2c31;
+  --red-12: #641723;
+  --red-a1: #ff000003;
+  --red-a2: #ff000008;
+  --red-a3: #f3000d14;
+  --red-a4: #ff000824;
+  --red-a5: #ff000632;
+  --red-a6: #f8000442;
+  --red-a7: #df000356;
+  --red-a8: #d2000571;
+  --red-a9: #db0007b7;
+  --red-a10: #d10005c1;
+  --red-a11: #c40006d3;
+  --red-a12: #55000de8;
+  --ruby-1: #fffcfd;
+  --ruby-2: #fff7f8;
+  --ruby-3: #feeaed;
+  --ruby-4: #ffdce1;
+  --ruby-5: #ffced6;
+  --ruby-6: #f8bfc8;
+  --ruby-7: #efacb8;
+  --ruby-8: #e592a3;
+  --ruby-9: #e54666;
+  --ruby-10: #dc3b5d;
+  --ruby-11: #ca244d;
+  --ruby-12: #64172b;
+  --ruby-a1: #ff005503;
+  --ruby-a2: #ff002008;
+  --ruby-a3: #f3002515;
+  --ruby-a4: #ff002523;
+  --ruby-a5: #ff002a31;
+  --ruby-a6: #e4002440;
+  --ruby-a7: #ce002553;
+  --ruby-a8: #c300286d;
+  --ruby-a9: #db002cb9;
+  --ruby-a10: #d2002cc4;
+  --ruby-a11: #c10030db;
+  --ruby-a12: #550016e8;
+  --sage-1: #fbfdfc;
+  --sage-2: #f7f9f8;
+  --sage-3: #eef1f0;
+  --sage-4: #e6e9e8;
+  --sage-5: #dfe2e0;
+  --sage-6: #d7dad9;
+  --sage-7: #cbcfcd;
+  --sage-8: #b8bcba;
+  --sage-9: #868e8b;
+  --sage-10: #7c8481;
+  --sage-11: #5f6563;
+  --sage-12: #1a211e;
+  --sage-a1: #00804004;
+  --sage-a2: #00402008;
+  --sage-a3: #002d1e11;
+  --sage-a4: #001f1519;
+  --sage-a5: #00180820;
+  --sage-a6: #00140d28;
+  --sage-a7: #00140a34;
+  --sage-a8: #000f0847;
+  --sage-a9: #00110b79;
+  --sage-a10: #00100a83;
+  --sage-a11: #000a07a0;
+  --sage-a12: #000805e5;
+  --sand-1: #fdfdfc;
+  --sand-2: #f9f9f8;
+  --sand-3: #f1f0ef;
+  --sand-4: #e9e8e6;
+  --sand-5: #e2e1de;
+  --sand-6: #dad9d6;
+  --sand-7: #cfceca;
+  --sand-8: #bcbbb5;
+  --sand-9: #8d8d86;
+  --sand-10: #82827c;
+  --sand-11: #63635e;
+  --sand-12: #21201c;
+  --sand-a1: #55550003;
+  --sand-a2: #25250007;
+  --sand-a3: #20100010;
+  --sand-a4: #1f150019;
+  --sand-a5: #1f180021;
+  --sand-a6: #19130029;
+  --sand-a7: #19140035;
+  --sand-a8: #1915014a;
+  --sand-a9: #0f0f0079;
+  --sand-a10: #0c0c0083;
+  --sand-a11: #080800a1;
+  --sand-a12: #060500e3;
+  --sky-1: #f9feff;
+  --sky-2: #f1fafd;
+  --sky-3: #e1f6fd;
+  --sky-4: #d1f0fa;
+  --sky-5: #bee7f5;
+  --sky-6: #a9daed;
+  --sky-7: #8dcae3;
+  --sky-8: #60b3d7;
+  --sky-9: #7ce2fe;
+  --sky-10: #74daf8;
+  --sky-11: #00749e;
+  --sky-12: #1d3e56;
+  --sky-a1: #00d5ff06;
+  --sky-a2: #00a4db0e;
+  --sky-a3: #00b3ee1e;
+  --sky-a4: #00ace42e;
+  --sky-a5: #00a1d841;
+  --sky-a6: #0092ca56;
+  --sky-a7: #0089c172;
+  --sky-a8: #0085bf9f;
+  --sky-a9: #00c7fe83;
+  --sky-a10: #00bcf38b;
+  --sky-a11: #00749e;
+  --sky-a12: #002540e2;
+  --slate-1: #fcfcfd;
+  --slate-2: #f9f9fb;
+  --slate-3: #f0f0f3;
+  --slate-4: #e8e8ec;
+  --slate-5: #e0e1e6;
+  --slate-6: #d9d9e0;
+  --slate-7: #cdced6;
+  --slate-8: #b9bbc6;
+  --slate-9: #8b8d98;
+  --slate-10: #80838d;
+  --slate-11: #60646c;
+  --slate-12: #1c2024;
+  --slate-a1: #00005503;
+  --slate-a2: #00005506;
+  --slate-a3: #0000330f;
+  --slate-a4: #00002d17;
+  --slate-a5: #0009321f;
+  --slate-a6: #00002f26;
+  --slate-a7: #00062e32;
+  --slate-a8: #00083046;
+  --slate-a9: #00051d74;
+  --slate-a10: #00071b7f;
+  --slate-a11: #0007149f;
+  --slate-a12: #000509e3;
+  --teal-1: #fafefd;
+  --teal-2: #f3fbf9;
+  --teal-3: #e0f8f3;
+  --teal-4: #ccf3ea;
+  --teal-5: #b8eae0;
+  --teal-6: #a1ded2;
+  --teal-7: #83cdc1;
+  --teal-8: #53b9ab;
+  --teal-9: #12a594;
+  --teal-10: #0d9b8a;
+  --teal-11: #008573;
+  --teal-12: #0d3d38;
+  --teal-a1: #00cc9905;
+  --teal-a2: #00aa800c;
+  --teal-a3: #00c69d1f;
+  --teal-a4: #00c39633;
+  --teal-a5: #00b49047;
+  --teal-a6: #00a6855e;
+  --teal-a7: #0099807c;
+  --teal-a8: #009783ac;
+  --teal-a9: #009e8ced;
+  --teal-a10: #009684f2;
+  --teal-a11: #008573;
+  --teal-a12: #00332df2;
+  --tomato-1: #fffcfc;
+  --tomato-2: #fff8f7;
+  --tomato-3: #feebe7;
+  --tomato-4: #ffdcd3;
+  --tomato-5: #ffcdc2;
+  --tomato-6: #fdbdaf;
+  --tomato-7: #f5a898;
+  --tomato-8: #ec8e7b;
+  --tomato-9: #e54d2e;
+  --tomato-10: #dd4425;
+  --tomato-11: #d13415;
+  --tomato-12: #5c271f;
+  --tomato-a1: #ff000003;
+  --tomato-a2: #ff200008;
+  --tomato-a3: #f52b0018;
+  --tomato-a4: #ff35002c;
+  --tomato-a5: #ff2e003d;
+  --tomato-a6: #f92d0050;
+  --tomato-a7: #e7280067;
+  --tomato-a8: #db250084;
+  --tomato-a9: #df2600d1;
+  --tomato-a10: #d72400da;
+  --tomato-a11: #cd2200ea;
+  --tomato-a12: #460900e0;
+  --violet-1: #fdfcfe;
+  --violet-2: #faf8ff;
+  --violet-3: #f4f0fe;
+  --violet-4: #ebe4ff;
+  --violet-5: #e1d9ff;
+  --violet-6: #d4cafe;
+  --violet-7: #c2b5f5;
+  --violet-8: #aa99ec;
+  --violet-9: #6e56cf;
+  --violet-10: #654dc4;
+  --violet-11: #6550b9;
+  --violet-12: #2f265f;
+  --violet-a1: #5500aa03;
+  --violet-a2: #4900ff07;
+  --violet-a3: #4400ee0f;
+  --violet-a4: #4300ff1b;
+  --violet-a5: #3600ff26;
+  --violet-a6: #3100fb35;
+  --violet-a7: #2d01dd4a;
+  --violet-a8: #2b00d066;
+  --violet-a9: #2400b7a9;
+  --violet-a10: #2300abb2;
+  --violet-a11: #1f0099af;
+  --violet-a12: #0b0043d9;
+  --white-a1: rgba(255, 255, 255, 0.05);
+  --white-a2: rgba(255, 255, 255, 0.1);
+  --white-a3: rgba(255, 255, 255, 0.15);
+  --white-a4: rgba(255, 255, 255, 0.2);
+  --white-a5: rgba(255, 255, 255, 0.3);
+  --white-a6: rgba(255, 255, 255, 0.4);
+  --white-a7: rgba(255, 255, 255, 0.5);
+  --white-a8: rgba(255, 255, 255, 0.6);
+  --white-a9: rgba(255, 255, 255, 0.7);
+  --white-a10: rgba(255, 255, 255, 0.8);
+  --white-a11: rgba(255, 255, 255, 0.9);
+  --white-a12: rgba(255, 255, 255, 0.95);
+  --yellow-1: #fdfdf9;
+  --yellow-2: #fefce9;
+  --yellow-3: #fffab8;
+  --yellow-4: #fff394;
+  --yellow-5: #ffe770;
+  --yellow-6: #f3d768;
+  --yellow-7: #e4c767;
+  --yellow-8: #d5ae39;
+  --yellow-9: #ffe629;
+  --yellow-10: #ffdc00;
+  --yellow-11: #9e6c00;
+  --yellow-12: #473b1f;
+  --yellow-a1: #aaaa0006;
+  --yellow-a2: #f4dd0016;
+  --yellow-a3: #ffee0047;
+  --yellow-a4: #ffe3016b;
+  --yellow-a5: #ffd5008f;
+  --yellow-a6: #ebbc0097;
+  --yellow-a7: #d2a10098;
+  --yellow-a8: #c99700c6;
+  --yellow-a9: #ffe100d6;
+  --yellow-a10: #ffdc00;
+  --yellow-a11: #9e6c00;
+  --yellow-a12: #2e2000e0;
+}
+
+@supports (color: color(display-p3 1 1 1)) {
+  @media (color-gamut: p3) {
+    :root {
+      --amber-1: color(display-p3 0.995 0.992 0.985);
+      --amber-2: color(display-p3 0.994 0.986 0.921);
+      --amber-3: color(display-p3 0.994 0.969 0.782);
+      --amber-4: color(display-p3 0.989 0.937 0.65);
+      --amber-5: color(display-p3 0.97 0.902 0.527);
+      --amber-6: color(display-p3 0.936 0.844 0.506);
+      --amber-7: color(display-p3 0.89 0.762 0.443);
+      --amber-8: color(display-p3 0.85 0.65 0.3);
+      --amber-9: color(display-p3 1 0.77 0.26);
+      --amber-10: color(display-p3 0.959 0.741 0.274);
+      --amber-11: color(display-p3 0.64 0.4 0);
+      --amber-12: color(display-p3 0.294 0.208 0.145);
+      --amber-a1: color(display-p3 0.757 0.514 0.024 / 0.016);
+      --amber-a2: color(display-p3 0.902 0.804 0.008 / 0.079);
+      --amber-a3: color(display-p3 0.965 0.859 0.004 / 0.22);
+      --amber-a4: color(display-p3 0.969 0.82 0.004 / 0.35);
+      --amber-a5: color(display-p3 0.933 0.796 0.004 / 0.475);
+      --amber-a6: color(display-p3 0.875 0.682 0.004 / 0.495);
+      --amber-a7: color(display-p3 0.804 0.573 0 / 0.557);
+      --amber-a8: color(display-p3 0.788 0.502 0 / 0.699);
+      --amber-a9: color(display-p3 1 0.686 0 / 0.742);
+      --amber-a10: color(display-p3 0.945 0.643 0 / 0.726);
+      --amber-a11: color(display-p3 0.64 0.4 0);
+      --amber-a12: color(display-p3 0.294 0.208 0.145);
+      --black-a1: color(display-p3 0 0 0 / 0.05);
+      --black-a2: color(display-p3 0 0 0 / 0.1);
+      --black-a3: color(display-p3 0 0 0 / 0.15);
+      --black-a4: color(display-p3 0 0 0 / 0.2);
+      --black-a5: color(display-p3 0 0 0 / 0.3);
+      --black-a6: color(display-p3 0 0 0 / 0.4);
+      --black-a7: color(display-p3 0 0 0 / 0.5);
+      --black-a8: color(display-p3 0 0 0 / 0.6);
+      --black-a9: color(display-p3 0 0 0 / 0.7);
+      --black-a10: color(display-p3 0 0 0 / 0.8);
+      --black-a11: color(display-p3 0 0 0 / 0.9);
+      --black-a12: color(display-p3 0 0 0 / 0.95);
+      --blue-1: color(display-p3 0.986 0.992 0.999);
+      --blue-2: color(display-p3 0.96 0.979 0.998);
+      --blue-3: color(display-p3 0.912 0.956 0.991);
+      --blue-4: color(display-p3 0.853 0.932 1);
+      --blue-5: color(display-p3 0.788 0.894 0.998);
+      --blue-6: color(display-p3 0.709 0.843 0.976);
+      --blue-7: color(display-p3 0.606 0.777 0.947);
+      --blue-8: color(display-p3 0.451 0.688 0.917);
+      --blue-9: color(display-p3 0.247 0.556 0.969);
+      --blue-10: color(display-p3 0.234 0.523 0.912);
+      --blue-11: color(display-p3 0.15 0.44 0.84);
+      --blue-12: color(display-p3 0.102 0.193 0.379);
+      --blue-a1: color(display-p3 0.024 0.514 1 / 0.016);
+      --blue-a2: color(display-p3 0.024 0.514 0.906 / 0.04);
+      --blue-a3: color(display-p3 0.012 0.506 0.914 / 0.087);
+      --blue-a4: color(display-p3 0.008 0.545 1 / 0.146);
+      --blue-a5: color(display-p3 0.004 0.502 0.984 / 0.212);
+      --blue-a6: color(display-p3 0.004 0.463 0.922 / 0.291);
+      --blue-a7: color(display-p3 0.004 0.431 0.863 / 0.393);
+      --blue-a8: color(display-p3 0 0.427 0.851 / 0.55);
+      --blue-a9: color(display-p3 0 0.412 0.961 / 0.753);
+      --blue-a10: color(display-p3 0 0.376 0.886 / 0.765);
+      --blue-a11: color(display-p3 0.15 0.44 0.84);
+      --blue-a12: color(display-p3 0.102 0.193 0.379);
+      --bronze-1: color(display-p3 0.991 0.988 0.988);
+      --bronze-2: color(display-p3 0.989 0.97 0.961);
+      --bronze-3: color(display-p3 0.958 0.932 0.919);
+      --bronze-4: color(display-p3 0.929 0.894 0.877);
+      --bronze-5: color(display-p3 0.898 0.853 0.832);
+      --bronze-6: color(display-p3 0.861 0.805 0.778);
+      --bronze-7: color(display-p3 0.812 0.739 0.706);
+      --bronze-8: color(display-p3 0.741 0.647 0.606);
+      --bronze-9: color(display-p3 0.611 0.507 0.455);
+      --bronze-10: color(display-p3 0.563 0.461 0.414);
+      --bronze-11: color(display-p3 0.471 0.373 0.336);
+      --bronze-12: color(display-p3 0.251 0.191 0.172);
+      --bronze-a1: color(display-p3 0.349 0.024 0.024 / 0.012);
+      --bronze-a2: color(display-p3 0.71 0.22 0.024 / 0.04);
+      --bronze-a3: color(display-p3 0.482 0.2 0.008 / 0.083);
+      --bronze-a4: color(display-p3 0.424 0.133 0.004 / 0.122);
+      --bronze-a5: color(display-p3 0.4 0.145 0.004 / 0.169);
+      --bronze-a6: color(display-p3 0.388 0.125 0.004 / 0.224);
+      --bronze-a7: color(display-p3 0.365 0.11 0.004 / 0.295);
+      --bronze-a8: color(display-p3 0.341 0.102 0.004 / 0.393);
+      --bronze-a9: color(display-p3 0.29 0.094 0 / 0.546);
+      --bronze-a10: color(display-p3 0.255 0.082 0 / 0.585);
+      --bronze-a11: color(display-p3 0.471 0.373 0.336);
+      --bronze-a12: color(display-p3 0.251 0.191 0.172);
+      --brown-1: color(display-p3 0.995 0.992 0.989);
+      --brown-2: color(display-p3 0.987 0.976 0.964);
+      --brown-3: color(display-p3 0.959 0.936 0.909);
+      --brown-4: color(display-p3 0.934 0.897 0.855);
+      --brown-5: color(display-p3 0.909 0.856 0.798);
+      --brown-6: color(display-p3 0.88 0.808 0.73);
+      --brown-7: color(display-p3 0.841 0.742 0.639);
+      --brown-8: color(display-p3 0.782 0.647 0.514);
+      --brown-9: color(display-p3 0.651 0.505 0.368);
+      --brown-10: color(display-p3 0.601 0.465 0.344);
+      --brown-11: color(display-p3 0.485 0.374 0.288);
+      --brown-12: color(display-p3 0.236 0.202 0.183);
+      --brown-a1: color(display-p3 0.675 0.349 0.024 / 0.012);
+      --brown-a2: color(display-p3 0.675 0.349 0.024 / 0.036);
+      --brown-a3: color(display-p3 0.573 0.314 0.012 / 0.091);
+      --brown-a4: color(display-p3 0.545 0.302 0.008 / 0.146);
+      --brown-a5: color(display-p3 0.561 0.29 0.004 / 0.204);
+      --brown-a6: color(display-p3 0.553 0.294 0.004 / 0.271);
+      --brown-a7: color(display-p3 0.557 0.286 0.004 / 0.361);
+      --brown-a8: color(display-p3 0.549 0.275 0.004 / 0.487);
+      --brown-a9: color(display-p3 0.447 0.22 0 / 0.632);
+      --brown-a10: color(display-p3 0.388 0.188 0 / 0.655);
+      --brown-a11: color(display-p3 0.485 0.374 0.288);
+      --brown-a12: color(display-p3 0.236 0.202 0.183);
+      --crimson-1: color(display-p3 0.998 0.989 0.992);
+      --crimson-2: color(display-p3 0.991 0.969 0.976);
+      --crimson-3: color(display-p3 0.987 0.917 0.941);
+      --crimson-4: color(display-p3 0.975 0.866 0.904);
+      --crimson-5: color(display-p3 0.953 0.813 0.864);
+      --crimson-6: color(display-p3 0.921 0.755 0.817);
+      --crimson-7: color(display-p3 0.88 0.683 0.761);
+      --crimson-8: color(display-p3 0.834 0.592 0.694);
+      --crimson-9: color(display-p3 0.843 0.298 0.507);
+      --crimson-10: color(display-p3 0.807 0.266 0.468);
+      --crimson-11: color(display-p3 0.731 0.195 0.388);
+      --crimson-12: color(display-p3 0.352 0.111 0.221);
+      --crimson-a1: color(display-p3 0.675 0.024 0.349 / 0.012);
+      --crimson-a2: color(display-p3 0.757 0.02 0.267 / 0.032);
+      --crimson-a3: color(display-p3 0.859 0.008 0.294 / 0.083);
+      --crimson-a4: color(display-p3 0.827 0.008 0.298 / 0.134);
+      --crimson-a5: color(display-p3 0.753 0.008 0.275 / 0.189);
+      --crimson-a6: color(display-p3 0.682 0.004 0.247 / 0.244);
+      --crimson-a7: color(display-p3 0.62 0.004 0.251 / 0.318);
+      --crimson-a8: color(display-p3 0.6 0.004 0.251 / 0.408);
+      --crimson-a9: color(display-p3 0.776 0 0.298 / 0.702);
+      --crimson-a10: color(display-p3 0.737 0 0.275 / 0.734);
+      --crimson-a11: color(display-p3 0.731 0.195 0.388);
+      --crimson-a12: color(display-p3 0.352 0.111 0.221);
+      --cyan-1: color(display-p3 0.982 0.992 0.996);
+      --cyan-2: color(display-p3 0.955 0.981 0.984);
+      --cyan-3: color(display-p3 0.888 0.965 0.975);
+      --cyan-4: color(display-p3 0.821 0.941 0.959);
+      --cyan-5: color(display-p3 0.751 0.907 0.935);
+      --cyan-6: color(display-p3 0.671 0.862 0.9);
+      --cyan-7: color(display-p3 0.564 0.8 0.854);
+      --cyan-8: color(display-p3 0.388 0.715 0.798);
+      --cyan-9: color(display-p3 0.282 0.627 0.765);
+      --cyan-10: color(display-p3 0.264 0.583 0.71);
+      --cyan-11: color(display-p3 0.08 0.48 0.63);
+      --cyan-12: color(display-p3 0.108 0.232 0.277);
+      --cyan-a1: color(display-p3 0.02 0.608 0.804 / 0.02);
+      --cyan-a2: color(display-p3 0.02 0.557 0.647 / 0.044);
+      --cyan-a3: color(display-p3 0.004 0.694 0.796 / 0.114);
+      --cyan-a4: color(display-p3 0.004 0.678 0.784 / 0.181);
+      --cyan-a5: color(display-p3 0.004 0.624 0.733 / 0.248);
+      --cyan-a6: color(display-p3 0.004 0.584 0.706 / 0.33);
+      --cyan-a7: color(display-p3 0.004 0.541 0.667 / 0.436);
+      --cyan-a8: color(display-p3 0 0.533 0.667 / 0.612);
+      --cyan-a9: color(display-p3 0 0.482 0.675 / 0.718);
+      --cyan-a10: color(display-p3 0 0.435 0.608 / 0.738);
+      --cyan-a11: color(display-p3 0.08 0.48 0.63);
+      --cyan-a12: color(display-p3 0.108 0.232 0.277);
+      --gold-1: color(display-p3 0.992 0.992 0.989);
+      --gold-2: color(display-p3 0.98 0.976 0.953);
+      --gold-3: color(display-p3 0.947 0.94 0.909);
+      --gold-4: color(display-p3 0.914 0.904 0.865);
+      --gold-5: color(display-p3 0.88 0.865 0.816);
+      --gold-6: color(display-p3 0.84 0.818 0.756);
+      --gold-7: color(display-p3 0.788 0.753 0.677);
+      --gold-8: color(display-p3 0.715 0.66 0.565);
+      --gold-9: color(display-p3 0.579 0.517 0.41);
+      --gold-10: color(display-p3 0.538 0.479 0.38);
+      --gold-11: color(display-p3 0.433 0.386 0.305);
+      --gold-12: color(display-p3 0.227 0.209 0.173);
+      --gold-a1: color(display-p3 0.349 0.349 0.024 / 0.012);
+      --gold-a2: color(display-p3 0.592 0.514 0.024 / 0.048);
+      --gold-a3: color(display-p3 0.4 0.357 0.012 / 0.091);
+      --gold-a4: color(display-p3 0.357 0.298 0.008 / 0.134);
+      --gold-a5: color(display-p3 0.345 0.282 0.004 / 0.185);
+      --gold-a6: color(display-p3 0.341 0.263 0.004 / 0.244);
+      --gold-a7: color(display-p3 0.345 0.235 0.004 / 0.322);
+      --gold-a8: color(display-p3 0.345 0.22 0.004 / 0.436);
+      --gold-a9: color(display-p3 0.286 0.18 0 / 0.589);
+      --gold-a10: color(display-p3 0.255 0.161 0 / 0.62);
+      --gold-a11: color(display-p3 0.433 0.386 0.305);
+      --gold-a12: color(display-p3 0.227 0.209 0.173);
+      --grass-1: color(display-p3 0.986 0.996 0.985);
+      --grass-2: color(display-p3 0.966 0.983 0.964);
+      --grass-3: color(display-p3 0.923 0.965 0.917);
+      --grass-4: color(display-p3 0.872 0.94 0.865);
+      --grass-5: color(display-p3 0.811 0.908 0.802);
+      --grass-6: color(display-p3 0.733 0.864 0.724);
+      --grass-7: color(display-p3 0.628 0.803 0.622);
+      --grass-8: color(display-p3 0.477 0.72 0.482);
+      --grass-9: color(display-p3 0.38 0.647 0.378);
+      --grass-10: color(display-p3 0.344 0.598 0.342);
+      --grass-11: color(display-p3 0.263 0.488 0.261);
+      --grass-12: color(display-p3 0.151 0.233 0.153);
+      --grass-a1: color(display-p3 0.024 0.757 0.024 / 0.016);
+      --grass-a2: color(display-p3 0.024 0.565 0.024 / 0.036);
+      --grass-a3: color(display-p3 0.059 0.576 0.008 / 0.083);
+      --grass-a4: color(display-p3 0.035 0.565 0.008 / 0.134);
+      --grass-a5: color(display-p3 0.047 0.545 0.008 / 0.197);
+      --grass-a6: color(display-p3 0.031 0.502 0.004 / 0.275);
+      --grass-a7: color(display-p3 0.012 0.482 0.004 / 0.377);
+      --grass-a8: color(display-p3 0 0.467 0.008 / 0.522);
+      --grass-a9: color(display-p3 0.008 0.435 0 / 0.624);
+      --grass-a10: color(display-p3 0.008 0.388 0 / 0.659);
+      --grass-a11: color(display-p3 0.263 0.488 0.261);
+      --grass-a12: color(display-p3 0.151 0.233 0.153);
+      --gray-1: color(display-p3 0.988 0.988 0.988);
+      --gray-2: color(display-p3 0.975 0.975 0.975);
+      --gray-3: color(display-p3 0.939 0.939 0.939);
+      --gray-4: color(display-p3 0.908 0.908 0.908);
+      --gray-5: color(display-p3 0.88 0.88 0.88);
+      --gray-6: color(display-p3 0.849 0.849 0.849);
+      --gray-7: color(display-p3 0.807 0.807 0.807);
+      --gray-8: color(display-p3 0.732 0.732 0.732);
+      --gray-9: color(display-p3 0.553 0.553 0.553);
+      --gray-10: color(display-p3 0.512 0.512 0.512);
+      --gray-11: color(display-p3 0.392 0.392 0.392);
+      --gray-12: color(display-p3 0.125 0.125 0.125);
+      --gray-a1: color(display-p3 0 0 0 / 0.012);
+      --gray-a2: color(display-p3 0 0 0 / 0.024);
+      --gray-a3: color(display-p3 0 0 0 / 0.063);
+      --gray-a4: color(display-p3 0 0 0 / 0.09);
+      --gray-a5: color(display-p3 0 0 0 / 0.122);
+      --gray-a6: color(display-p3 0 0 0 / 0.153);
+      --gray-a7: color(display-p3 0 0 0 / 0.192);
+      --gray-a8: color(display-p3 0 0 0 / 0.267);
+      --gray-a9: color(display-p3 0 0 0 / 0.447);
+      --gray-a10: color(display-p3 0 0 0 / 0.486);
+      --gray-a11: color(display-p3 0 0 0 / 0.608);
+      --gray-a12: color(display-p3 0 0 0 / 0.875);
+      --green-1: color(display-p3 0.986 0.996 0.989);
+      --green-2: color(display-p3 0.963 0.983 0.967);
+      --green-3: color(display-p3 0.913 0.964 0.925);
+      --green-4: color(display-p3 0.859 0.94 0.879);
+      --green-5: color(display-p3 0.796 0.907 0.826);
+      --green-6: color(display-p3 0.718 0.863 0.761);
+      --green-7: color(display-p3 0.61 0.801 0.675);
+      --green-8: color(display-p3 0.451 0.715 0.559);
+      --green-9: color(display-p3 0.332 0.634 0.442);
+      --green-10: color(display-p3 0.308 0.595 0.417);
+      --green-11: color(display-p3 0.19 0.5 0.32);
+      --green-12: color(display-p3 0.132 0.228 0.18);
+      --green-a1: color(display-p3 0.024 0.757 0.267 / 0.016);
+      --green-a2: color(display-p3 0.024 0.565 0.129 / 0.036);
+      --green-a3: color(display-p3 0.012 0.596 0.145 / 0.087);
+      --green-a4: color(display-p3 0.008 0.588 0.145 / 0.142);
+      --green-a5: color(display-p3 0.004 0.541 0.157 / 0.204);
+      --green-a6: color(display-p3 0.004 0.518 0.157 / 0.283);
+      --green-a7: color(display-p3 0.004 0.486 0.165 / 0.389);
+      --green-a8: color(display-p3 0 0.478 0.2 / 0.55);
+      --green-a9: color(display-p3 0 0.455 0.165 / 0.667);
+      --green-a10: color(display-p3 0 0.416 0.153 / 0.691);
+      --green-a11: color(display-p3 0.19 0.5 0.32);
+      --green-a12: color(display-p3 0.132 0.228 0.18);
+      --indigo-1: color(display-p3 0.992 0.992 0.996);
+      --indigo-2: color(display-p3 0.971 0.977 0.998);
+      --indigo-3: color(display-p3 0.933 0.948 0.992);
+      --indigo-4: color(display-p3 0.885 0.914 1);
+      --indigo-5: color(display-p3 0.831 0.87 1);
+      --indigo-6: color(display-p3 0.767 0.814 0.995);
+      --indigo-7: color(display-p3 0.685 0.74 0.957);
+      --indigo-8: color(display-p3 0.569 0.639 0.916);
+      --indigo-9: color(display-p3 0.276 0.384 0.837);
+      --indigo-10: color(display-p3 0.234 0.343 0.801);
+      --indigo-11: color(display-p3 0.256 0.354 0.755);
+      --indigo-12: color(display-p3 0.133 0.175 0.348);
+      --indigo-a1: color(display-p3 0.02 0.02 0.51 / 0.008);
+      --indigo-a2: color(display-p3 0.024 0.161 0.863 / 0.028);
+      --indigo-a3: color(display-p3 0.008 0.239 0.886 / 0.067);
+      --indigo-a4: color(display-p3 0.004 0.247 1 / 0.114);
+      --indigo-a5: color(display-p3 0.004 0.235 1 / 0.169);
+      --indigo-a6: color(display-p3 0.004 0.208 0.984 / 0.232);
+      --indigo-a7: color(display-p3 0.004 0.176 0.863 / 0.314);
+      --indigo-a8: color(display-p3 0.004 0.165 0.812 / 0.432);
+      --indigo-a9: color(display-p3 0 0.153 0.773 / 0.726);
+      --indigo-a10: color(display-p3 0 0.137 0.737 / 0.765);
+      --indigo-a11: color(display-p3 0.256 0.354 0.755);
+      --indigo-a12: color(display-p3 0.133 0.175 0.348);
+      --iris-1: color(display-p3 0.992 0.992 0.999);
+      --iris-2: color(display-p3 0.972 0.973 0.998);
+      --iris-3: color(display-p3 0.943 0.945 0.992);
+      --iris-4: color(display-p3 0.902 0.906 1);
+      --iris-5: color(display-p3 0.857 0.861 1);
+      --iris-6: color(display-p3 0.799 0.805 0.987);
+      --iris-7: color(display-p3 0.721 0.727 0.955);
+      --iris-8: color(display-p3 0.61 0.619 0.918);
+      --iris-9: color(display-p3 0.357 0.357 0.81);
+      --iris-10: color(display-p3 0.318 0.318 0.774);
+      --iris-11: color(display-p3 0.337 0.326 0.748);
+      --iris-12: color(display-p3 0.154 0.161 0.371);
+      --iris-a1: color(display-p3 0.02 0.02 1 / 0.008);
+      --iris-a2: color(display-p3 0.024 0.024 0.863 / 0.028);
+      --iris-a3: color(display-p3 0.004 0.071 0.871 / 0.059);
+      --iris-a4: color(display-p3 0.012 0.051 1 / 0.099);
+      --iris-a5: color(display-p3 0.008 0.035 1 / 0.142);
+      --iris-a6: color(display-p3 0 0.02 0.941 / 0.2);
+      --iris-a7: color(display-p3 0.004 0.02 0.847 / 0.279);
+      --iris-a8: color(display-p3 0.004 0.024 0.788 / 0.389);
+      --iris-a9: color(display-p3 0 0 0.706 / 0.644);
+      --iris-a10: color(display-p3 0 0 0.667 / 0.683);
+      --iris-a11: color(display-p3 0.337 0.326 0.748);
+      --iris-a12: color(display-p3 0.154 0.161 0.371);
+      --jade-1: color(display-p3 0.986 0.996 0.992);
+      --jade-2: color(display-p3 0.962 0.983 0.969);
+      --jade-3: color(display-p3 0.912 0.965 0.932);
+      --jade-4: color(display-p3 0.858 0.941 0.893);
+      --jade-5: color(display-p3 0.795 0.909 0.847);
+      --jade-6: color(display-p3 0.715 0.864 0.791);
+      --jade-7: color(display-p3 0.603 0.802 0.718);
+      --jade-8: color(display-p3 0.44 0.72 0.629);
+      --jade-9: color(display-p3 0.319 0.63 0.521);
+      --jade-10: color(display-p3 0.299 0.592 0.488);
+      --jade-11: color(display-p3 0.15 0.5 0.37);
+      --jade-12: color(display-p3 0.142 0.229 0.194);
+      --jade-a1: color(display-p3 0.024 0.757 0.514 / 0.016);
+      --jade-a2: color(display-p3 0.024 0.612 0.22 / 0.04);
+      --jade-a3: color(display-p3 0.012 0.596 0.235 / 0.087);
+      --jade-a4: color(display-p3 0.008 0.588 0.255 / 0.142);
+      --jade-a5: color(display-p3 0.004 0.561 0.251 / 0.204);
+      --jade-a6: color(display-p3 0.004 0.525 0.278 / 0.287);
+      --jade-a7: color(display-p3 0.004 0.506 0.29 / 0.397);
+      --jade-a8: color(display-p3 0 0.506 0.337 / 0.561);
+      --jade-a9: color(display-p3 0 0.459 0.298 / 0.683);
+      --jade-a10: color(display-p3 0 0.42 0.271 / 0.702);
+      --jade-a11: color(display-p3 0.15 0.5 0.37);
+      --jade-a12: color(display-p3 0.142 0.229 0.194);
+      --lime-1: color(display-p3 0.989 0.992 0.981);
+      --lime-2: color(display-p3 0.975 0.98 0.954);
+      --lime-3: color(display-p3 0.939 0.965 0.851);
+      --lime-4: color(display-p3 0.896 0.94 0.76);
+      --lime-5: color(display-p3 0.843 0.903 0.678);
+      --lime-6: color(display-p3 0.778 0.852 0.599);
+      --lime-7: color(display-p3 0.694 0.784 0.508);
+      --lime-8: color(display-p3 0.585 0.707 0.378);
+      --lime-9: color(display-p3 0.78 0.928 0.466);
+      --lime-10: color(display-p3 0.734 0.896 0.397);
+      --lime-11: color(display-p3 0.386 0.482 0.227);
+      --lime-12: color(display-p3 0.222 0.25 0.128);
+      --lime-a1: color(display-p3 0.412 0.608 0.02 / 0.02);
+      --lime-a2: color(display-p3 0.514 0.592 0.024 / 0.048);
+      --lime-a3: color(display-p3 0.584 0.765 0.008 / 0.15);
+      --lime-a4: color(display-p3 0.561 0.757 0.004 / 0.24);
+      --lime-a5: color(display-p3 0.514 0.698 0.004 / 0.322);
+      --lime-a6: color(display-p3 0.443 0.627 0 / 0.4);
+      --lime-a7: color(display-p3 0.376 0.561 0.004 / 0.491);
+      --lime-a8: color(display-p3 0.333 0.529 0 / 0.624);
+      --lime-a9: color(display-p3 0.588 0.867 0 / 0.534);
+      --lime-a10: color(display-p3 0.561 0.827 0 / 0.604);
+      --lime-a11: color(display-p3 0.386 0.482 0.227);
+      --lime-a12: color(display-p3 0.222 0.25 0.128);
+      --mauve-1: color(display-p3 0.991 0.988 0.992);
+      --mauve-2: color(display-p3 0.98 0.976 0.984);
+      --mauve-3: color(display-p3 0.946 0.938 0.952);
+      --mauve-4: color(display-p3 0.915 0.906 0.925);
+      --mauve-5: color(display-p3 0.886 0.876 0.901);
+      --mauve-6: color(display-p3 0.856 0.846 0.875);
+      --mauve-7: color(display-p3 0.814 0.804 0.84);
+      --mauve-8: color(display-p3 0.735 0.728 0.777);
+      --mauve-9: color(display-p3 0.555 0.549 0.596);
+      --mauve-10: color(display-p3 0.514 0.508 0.552);
+      --mauve-11: color(display-p3 0.395 0.388 0.424);
+      --mauve-12: color(display-p3 0.128 0.122 0.147);
+      --mauve-a1: color(display-p3 0.349 0.024 0.349 / 0.012);
+      --mauve-a2: color(display-p3 0.184 0.024 0.349 / 0.024);
+      --mauve-a3: color(display-p3 0.129 0.008 0.255 / 0.063);
+      --mauve-a4: color(display-p3 0.094 0.012 0.216 / 0.095);
+      --mauve-a5: color(display-p3 0.098 0.008 0.224 / 0.126);
+      --mauve-a6: color(display-p3 0.055 0.004 0.18 / 0.153);
+      --mauve-a7: color(display-p3 0.067 0.008 0.184 / 0.197);
+      --mauve-a8: color(display-p3 0.02 0.004 0.176 / 0.271);
+      --mauve-a9: color(display-p3 0.02 0.004 0.106 / 0.451);
+      --mauve-a10: color(display-p3 0.012 0.004 0.09 / 0.491);
+      --mauve-a11: color(display-p3 0.016 0 0.059 / 0.612);
+      --mauve-a12: color(display-p3 0.008 0 0.027 / 0.879);
+      --mint-1: color(display-p3 0.98 0.995 0.992);
+      --mint-2: color(display-p3 0.957 0.985 0.977);
+      --mint-3: color(display-p3 0.888 0.972 0.95);
+      --mint-4: color(display-p3 0.819 0.951 0.916);
+      --mint-5: color(display-p3 0.747 0.918 0.873);
+      --mint-6: color(display-p3 0.668 0.87 0.818);
+      --mint-7: color(display-p3 0.567 0.805 0.744);
+      --mint-8: color(display-p3 0.42 0.724 0.649);
+      --mint-9: color(display-p3 0.62 0.908 0.834);
+      --mint-10: color(display-p3 0.585 0.871 0.797);
+      --mint-11: color(display-p3 0.203 0.463 0.397);
+      --mint-12: color(display-p3 0.136 0.259 0.236);
+      --mint-a1: color(display-p3 0.02 0.804 0.608 / 0.02);
+      --mint-a2: color(display-p3 0.02 0.647 0.467 / 0.044);
+      --mint-a3: color(display-p3 0.004 0.761 0.553 / 0.114);
+      --mint-a4: color(display-p3 0.004 0.741 0.545 / 0.181);
+      --mint-a5: color(display-p3 0.004 0.678 0.51 / 0.255);
+      --mint-a6: color(display-p3 0.004 0.616 0.463 / 0.334);
+      --mint-a7: color(display-p3 0.004 0.549 0.412 / 0.432);
+      --mint-a8: color(display-p3 0 0.529 0.392 / 0.581);
+      --mint-a9: color(display-p3 0.004 0.765 0.569 / 0.381);
+      --mint-a10: color(display-p3 0.004 0.69 0.51 / 0.416);
+      --mint-a11: color(display-p3 0.203 0.463 0.397);
+      --mint-a12: color(display-p3 0.136 0.259 0.236);
+      --olive-1: color(display-p3 0.989 0.992 0.989);
+      --olive-2: color(display-p3 0.974 0.98 0.973);
+      --olive-3: color(display-p3 0.939 0.945 0.937);
+      --olive-4: color(display-p3 0.907 0.914 0.905);
+      --olive-5: color(display-p3 0.878 0.885 0.875);
+      --olive-6: color(display-p3 0.846 0.855 0.843);
+      --olive-7: color(display-p3 0.803 0.812 0.8);
+      --olive-8: color(display-p3 0.727 0.738 0.723);
+      --olive-9: color(display-p3 0.541 0.556 0.532);
+      --olive-10: color(display-p3 0.5 0.515 0.491);
+      --olive-11: color(display-p3 0.38 0.395 0.374);
+      --olive-12: color(display-p3 0.117 0.129 0.111);
+      --olive-a1: color(display-p3 0.024 0.349 0.024 / 0.012);
+      --olive-a2: color(display-p3 0.024 0.302 0.024 / 0.028);
+      --olive-a3: color(display-p3 0.008 0.129 0.008 / 0.063);
+      --olive-a4: color(display-p3 0.012 0.094 0.012 / 0.095);
+      --olive-a5: color(display-p3 0.035 0.098 0.008 / 0.126);
+      --olive-a6: color(display-p3 0.027 0.078 0.004 / 0.157);
+      --olive-a7: color(display-p3 0.02 0.059 0 / 0.2);
+      --olive-a8: color(display-p3 0.02 0.059 0.004 / 0.279);
+      --olive-a9: color(display-p3 0.02 0.051 0.004 / 0.467);
+      --olive-a10: color(display-p3 0.024 0.047 0 / 0.51);
+      --olive-a11: color(display-p3 0.012 0.039 0 / 0.628);
+      --olive-a12: color(display-p3 0.008 0.024 0 / 0.891);
+      --orange-1: color(display-p3 0.995 0.988 0.985);
+      --orange-2: color(display-p3 0.994 0.968 0.934);
+      --orange-3: color(display-p3 0.989 0.938 0.85);
+      --orange-4: color(display-p3 1 0.874 0.687);
+      --orange-5: color(display-p3 1 0.821 0.583);
+      --orange-6: color(display-p3 0.975 0.767 0.545);
+      --orange-7: color(display-p3 0.919 0.693 0.486);
+      --orange-8: color(display-p3 0.877 0.597 0.379);
+      --orange-9: color(display-p3 0.9 0.45 0.2);
+      --orange-10: color(display-p3 0.87 0.409 0.164);
+      --orange-11: color(display-p3 0.76 0.34 0);
+      --orange-12: color(display-p3 0.323 0.185 0.127);
+      --orange-a1: color(display-p3 0.757 0.267 0.024 / 0.016);
+      --orange-a2: color(display-p3 0.886 0.533 0.008 / 0.067);
+      --orange-a3: color(display-p3 0.922 0.584 0.008 / 0.15);
+      --orange-a4: color(display-p3 1 0.604 0.004 / 0.314);
+      --orange-a5: color(display-p3 1 0.569 0.004 / 0.416);
+      --orange-a6: color(display-p3 0.949 0.494 0.004 / 0.455);
+      --orange-a7: color(display-p3 0.839 0.408 0 / 0.514);
+      --orange-a8: color(display-p3 0.804 0.349 0 / 0.62);
+      --orange-a9: color(display-p3 0.878 0.314 0 / 0.8);
+      --orange-a10: color(display-p3 0.843 0.29 0 / 0.836);
+      --orange-a11: color(display-p3 0.76 0.34 0);
+      --orange-a12: color(display-p3 0.323 0.185 0.127);
+      --pink-1: color(display-p3 0.998 0.989 0.996);
+      --pink-2: color(display-p3 0.992 0.97 0.985);
+      --pink-3: color(display-p3 0.981 0.917 0.96);
+      --pink-4: color(display-p3 0.963 0.867 0.932);
+      --pink-5: color(display-p3 0.939 0.815 0.899);
+      --pink-6: color(display-p3 0.907 0.756 0.859);
+      --pink-7: color(display-p3 0.869 0.683 0.81);
+      --pink-8: color(display-p3 0.825 0.59 0.751);
+      --pink-9: color(display-p3 0.775 0.297 0.61);
+      --pink-10: color(display-p3 0.748 0.27 0.581);
+      --pink-11: color(display-p3 0.698 0.219 0.528);
+      --pink-12: color(display-p3 0.363 0.101 0.279);
+      --pink-a1: color(display-p3 0.675 0.024 0.675 / 0.012);
+      --pink-a2: color(display-p3 0.757 0.02 0.51 / 0.032);
+      --pink-a3: color(display-p3 0.765 0.008 0.529 / 0.083);
+      --pink-a4: color(display-p3 0.737 0.008 0.506 / 0.134);
+      --pink-a5: color(display-p3 0.663 0.004 0.451 / 0.185);
+      --pink-a6: color(display-p3 0.616 0.004 0.424 / 0.244);
+      --pink-a7: color(display-p3 0.596 0.004 0.412 / 0.318);
+      --pink-a8: color(display-p3 0.573 0.004 0.404 / 0.412);
+      --pink-a9: color(display-p3 0.682 0 0.447 / 0.702);
+      --pink-a10: color(display-p3 0.655 0 0.424 / 0.73);
+      --pink-a11: color(display-p3 0.698 0.219 0.528);
+      --pink-a12: color(display-p3 0.363 0.101 0.279);
+      --plum-1: color(display-p3 0.995 0.988 0.999);
+      --plum-2: color(display-p3 0.988 0.971 0.99);
+      --plum-3: color(display-p3 0.973 0.923 0.98);
+      --plum-4: color(display-p3 0.953 0.875 0.966);
+      --plum-5: color(display-p3 0.926 0.825 0.945);
+      --plum-6: color(display-p3 0.89 0.765 0.916);
+      --plum-7: color(display-p3 0.84 0.686 0.877);
+      --plum-8: color(display-p3 0.775 0.58 0.832);
+      --plum-9: color(display-p3 0.624 0.313 0.708);
+      --plum-10: color(display-p3 0.587 0.29 0.667);
+      --plum-11: color(display-p3 0.543 0.263 0.619);
+      --plum-12: color(display-p3 0.299 0.114 0.352);
+      --plum-a1: color(display-p3 0.675 0.024 1 / 0.012);
+      --plum-a2: color(display-p3 0.58 0.024 0.58 / 0.028);
+      --plum-a3: color(display-p3 0.655 0.008 0.753 / 0.079);
+      --plum-a4: color(display-p3 0.627 0.008 0.722 / 0.126);
+      --plum-a5: color(display-p3 0.58 0.004 0.69 / 0.177);
+      --plum-a6: color(display-p3 0.537 0.004 0.655 / 0.236);
+      --plum-a7: color(display-p3 0.49 0.004 0.616 / 0.314);
+      --plum-a8: color(display-p3 0.471 0.004 0.6 / 0.42);
+      --plum-a9: color(display-p3 0.451 0 0.576 / 0.687);
+      --plum-a10: color(display-p3 0.42 0 0.529 / 0.71);
+      --plum-a11: color(display-p3 0.543 0.263 0.619);
+      --plum-a12: color(display-p3 0.299 0.114 0.352);
+      --purple-1: color(display-p3 0.995 0.988 0.996);
+      --purple-2: color(display-p3 0.983 0.971 0.993);
+      --purple-3: color(display-p3 0.963 0.931 0.989);
+      --purple-4: color(display-p3 0.937 0.888 0.981);
+      --purple-5: color(display-p3 0.904 0.837 0.966);
+      --purple-6: color(display-p3 0.86 0.774 0.942);
+      --purple-7: color(display-p3 0.799 0.69 0.91);
+      --purple-8: color(display-p3 0.719 0.583 0.874);
+      --purple-9: color(display-p3 0.523 0.318 0.751);
+      --purple-10: color(display-p3 0.483 0.289 0.7);
+      --purple-11: color(display-p3 0.473 0.281 0.687);
+      --purple-12: color(display-p3 0.234 0.132 0.363);
+      --purple-a1: color(display-p3 0.675 0.024 0.675 / 0.012);
+      --purple-a2: color(display-p3 0.443 0.024 0.722 / 0.028);
+      --purple-a3: color(display-p3 0.506 0.008 0.835 / 0.071);
+      --purple-a4: color(display-p3 0.451 0.004 0.831 / 0.114);
+      --purple-a5: color(display-p3 0.431 0.004 0.788 / 0.165);
+      --purple-a6: color(display-p3 0.384 0.004 0.745 / 0.228);
+      --purple-a7: color(display-p3 0.357 0.004 0.71 / 0.31);
+      --purple-a8: color(display-p3 0.322 0.004 0.702 / 0.416);
+      --purple-a9: color(display-p3 0.298 0 0.639 / 0.683);
+      --purple-a10: color(display-p3 0.271 0 0.58 / 0.71);
+      --purple-a11: color(display-p3 0.473 0.281 0.687);
+      --purple-a12: color(display-p3 0.234 0.132 0.363);
+      --red-1: color(display-p3 0.998 0.989 0.988);
+      --red-2: color(display-p3 0.995 0.971 0.971);
+      --red-3: color(display-p3 0.985 0.925 0.925);
+      --red-4: color(display-p3 0.999 0.866 0.866);
+      --red-5: color(display-p3 0.984 0.812 0.811);
+      --red-6: color(display-p3 0.955 0.751 0.749);
+      --red-7: color(display-p3 0.915 0.675 0.672);
+      --red-8: color(display-p3 0.872 0.575 0.572);
+      --red-9: color(display-p3 0.83 0.329 0.324);
+      --red-10: color(display-p3 0.798 0.294 0.285);
+      --red-11: color(display-p3 0.744 0.234 0.222);
+      --red-12: color(display-p3 0.36 0.115 0.143);
+      --red-a1: color(display-p3 0.675 0.024 0.024 / 0.012);
+      --red-a2: color(display-p3 0.863 0.024 0.024 / 0.028);
+      --red-a3: color(display-p3 0.792 0.008 0.008 / 0.075);
+      --red-a4: color(display-p3 1 0.008 0.008 / 0.134);
+      --red-a5: color(display-p3 0.918 0.008 0.008 / 0.189);
+      --red-a6: color(display-p3 0.831 0.02 0.004 / 0.251);
+      --red-a7: color(display-p3 0.741 0.016 0.004 / 0.33);
+      --red-a8: color(display-p3 0.698 0.012 0.004 / 0.428);
+      --red-a9: color(display-p3 0.749 0.008 0 / 0.675);
+      --red-a10: color(display-p3 0.714 0.012 0 / 0.714);
+      --red-a11: color(display-p3 0.744 0.234 0.222);
+      --red-a12: color(display-p3 0.36 0.115 0.143);
+      --ruby-1: color(display-p3 0.998 0.989 0.992);
+      --ruby-2: color(display-p3 0.995 0.971 0.974);
+      --ruby-3: color(display-p3 0.983 0.92 0.928);
+      --ruby-4: color(display-p3 0.987 0.869 0.885);
+      --ruby-5: color(display-p3 0.968 0.817 0.839);
+      --ruby-6: color(display-p3 0.937 0.758 0.786);
+      --ruby-7: color(display-p3 0.897 0.685 0.721);
+      --ruby-8: color(display-p3 0.851 0.588 0.639);
+      --ruby-9: color(display-p3 0.83 0.323 0.408);
+      --ruby-10: color(display-p3 0.795 0.286 0.375);
+      --ruby-11: color(display-p3 0.728 0.211 0.311);
+      --ruby-12: color(display-p3 0.36 0.115 0.171);
+      --ruby-a1: color(display-p3 0.675 0.024 0.349 / 0.012);
+      --ruby-a2: color(display-p3 0.863 0.024 0.024 / 0.028);
+      --ruby-a3: color(display-p3 0.804 0.008 0.11 / 0.079);
+      --ruby-a4: color(display-p3 0.91 0.008 0.125 / 0.13);
+      --ruby-a5: color(display-p3 0.831 0.004 0.133 / 0.185);
+      --ruby-a6: color(display-p3 0.745 0.004 0.118 / 0.244);
+      --ruby-a7: color(display-p3 0.678 0.004 0.114 / 0.314);
+      --ruby-a8: color(display-p3 0.639 0.004 0.125 / 0.412);
+      --ruby-a9: color(display-p3 0.753 0 0.129 / 0.679);
+      --ruby-a10: color(display-p3 0.714 0 0.125 / 0.714);
+      --ruby-a11: color(display-p3 0.728 0.211 0.311);
+      --ruby-a12: color(display-p3 0.36 0.115 0.171);
+      --sage-1: color(display-p3 0.986 0.992 0.988);
+      --sage-2: color(display-p3 0.97 0.977 0.974);
+      --sage-3: color(display-p3 0.935 0.944 0.94);
+      --sage-4: color(display-p3 0.904 0.913 0.909);
+      --sage-5: color(display-p3 0.875 0.885 0.88);
+      --sage-6: color(display-p3 0.844 0.854 0.849);
+      --sage-7: color(display-p3 0.8 0.811 0.806);
+      --sage-8: color(display-p3 0.725 0.738 0.732);
+      --sage-9: color(display-p3 0.531 0.556 0.546);
+      --sage-10: color(display-p3 0.492 0.515 0.506);
+      --sage-11: color(display-p3 0.377 0.395 0.389);
+      --sage-12: color(display-p3 0.107 0.129 0.118);
+      --sage-a1: color(display-p3 0.024 0.514 0.267 / 0.016);
+      --sage-a2: color(display-p3 0.02 0.267 0.145 / 0.032);
+      --sage-a3: color(display-p3 0.008 0.184 0.125 / 0.067);
+      --sage-a4: color(display-p3 0.012 0.094 0.051 / 0.095);
+      --sage-a5: color(display-p3 0.008 0.098 0.035 / 0.126);
+      --sage-a6: color(display-p3 0.004 0.078 0.027 / 0.157);
+      --sage-a7: color(display-p3 0 0.059 0.039 / 0.2);
+      --sage-a8: color(display-p3 0.004 0.047 0.031 / 0.275);
+      --sage-a9: color(display-p3 0.004 0.059 0.035 / 0.471);
+      --sage-a10: color(display-p3 0 0.047 0.031 / 0.51);
+      --sage-a11: color(display-p3 0 0.031 0.02 / 0.624);
+      --sage-a12: color(display-p3 0 0.027 0.012 / 0.895);
+      --sand-1: color(display-p3 0.992 0.992 0.989);
+      --sand-2: color(display-p3 0.977 0.977 0.973);
+      --sand-3: color(display-p3 0.943 0.942 0.936);
+      --sand-4: color(display-p3 0.913 0.912 0.903);
+      --sand-5: color(display-p3 0.885 0.883 0.873);
+      --sand-6: color(display-p3 0.854 0.852 0.839);
+      --sand-7: color(display-p3 0.813 0.81 0.794);
+      --sand-8: color(display-p3 0.738 0.734 0.713);
+      --sand-9: color(display-p3 0.553 0.553 0.528);
+      --sand-10: color(display-p3 0.511 0.511 0.488);
+      --sand-11: color(display-p3 0.388 0.388 0.37);
+      --sand-12: color(display-p3 0.129 0.126 0.111);
+      --sand-a1: color(display-p3 0.349 0.349 0.024 / 0.012);
+      --sand-a2: color(display-p3 0.161 0.161 0.024 / 0.028);
+      --sand-a3: color(display-p3 0.067 0.067 0.008 / 0.063);
+      --sand-a4: color(display-p3 0.129 0.129 0.012 / 0.099);
+      --sand-a5: color(display-p3 0.098 0.067 0.008 / 0.126);
+      --sand-a6: color(display-p3 0.102 0.075 0.004 / 0.161);
+      --sand-a7: color(display-p3 0.098 0.098 0.004 / 0.208);
+      --sand-a8: color(display-p3 0.086 0.075 0.004 / 0.287);
+      --sand-a9: color(display-p3 0.051 0.051 0.004 / 0.471);
+      --sand-a10: color(display-p3 0.047 0.047 0 / 0.514);
+      --sand-a11: color(display-p3 0.031 0.031 0 / 0.632);
+      --sand-a12: color(display-p3 0.024 0.02 0 / 0.891);
+      --sky-1: color(display-p3 0.98 0.995 0.999);
+      --sky-2: color(display-p3 0.953 0.98 0.99);
+      --sky-3: color(display-p3 0.899 0.963 0.989);
+      --sky-4: color(display-p3 0.842 0.937 0.977);
+      --sky-5: color(display-p3 0.777 0.9 0.954);
+      --sky-6: color(display-p3 0.701 0.851 0.921);
+      --sky-7: color(display-p3 0.604 0.785 0.879);
+      --sky-8: color(display-p3 0.457 0.696 0.829);
+      --sky-9: color(display-p3 0.585 0.877 0.983);
+      --sky-10: color(display-p3 0.555 0.845 0.959);
+      --sky-11: color(display-p3 0.193 0.448 0.605);
+      --sky-12: color(display-p3 0.145 0.241 0.329);
+      --sky-a1: color(display-p3 0.02 0.804 1 / 0.02);
+      --sky-a2: color(display-p3 0.024 0.592 0.757 / 0.048);
+      --sky-a3: color(display-p3 0.004 0.655 0.886 / 0.102);
+      --sky-a4: color(display-p3 0.004 0.604 0.851 / 0.157);
+      --sky-a5: color(display-p3 0.004 0.565 0.792 / 0.224);
+      --sky-a6: color(display-p3 0.004 0.502 0.737 / 0.299);
+      --sky-a7: color(display-p3 0.004 0.459 0.694 / 0.397);
+      --sky-a8: color(display-p3 0 0.435 0.682 / 0.542);
+      --sky-a9: color(display-p3 0.004 0.71 0.965 / 0.416);
+      --sky-a10: color(display-p3 0.004 0.647 0.914 / 0.444);
+      --sky-a11: color(display-p3 0.193 0.448 0.605);
+      --sky-a12: color(display-p3 0.145 0.241 0.329);
+      --slate-1: color(display-p3 0.988 0.988 0.992);
+      --slate-2: color(display-p3 0.976 0.976 0.984);
+      --slate-3: color(display-p3 0.94 0.941 0.953);
+      --slate-4: color(display-p3 0.908 0.909 0.925);
+      --slate-5: color(display-p3 0.88 0.881 0.901);
+      --slate-6: color(display-p3 0.85 0.852 0.876);
+      --slate-7: color(display-p3 0.805 0.808 0.838);
+      --slate-8: color(display-p3 0.727 0.733 0.773);
+      --slate-9: color(display-p3 0.547 0.553 0.592);
+      --slate-10: color(display-p3 0.503 0.512 0.549);
+      --slate-11: color(display-p3 0.379 0.392 0.421);
+      --slate-12: color(display-p3 0.113 0.125 0.14);
+      --slate-a1: color(display-p3 0.024 0.024 0.349 / 0.012);
+      --slate-a2: color(display-p3 0.024 0.024 0.349 / 0.024);
+      --slate-a3: color(display-p3 0.004 0.004 0.204 / 0.059);
+      --slate-a4: color(display-p3 0.012 0.012 0.184 / 0.091);
+      --slate-a5: color(display-p3 0.004 0.039 0.2 / 0.122);
+      --slate-a6: color(display-p3 0.008 0.008 0.165 / 0.15);
+      --slate-a7: color(display-p3 0.008 0.027 0.184 / 0.197);
+      --slate-a8: color(display-p3 0.004 0.031 0.176 / 0.275);
+      --slate-a9: color(display-p3 0.004 0.02 0.106 / 0.455);
+      --slate-a10: color(display-p3 0.004 0.027 0.098 / 0.499);
+      --slate-a11: color(display-p3 0 0.02 0.063 / 0.62);
+      --slate-a12: color(display-p3 0 0.012 0.031 / 0.887);
+      --teal-1: color(display-p3 0.983 0.996 0.992);
+      --teal-2: color(display-p3 0.958 0.983 0.976);
+      --teal-3: color(display-p3 0.895 0.971 0.952);
+      --teal-4: color(display-p3 0.831 0.949 0.92);
+      --teal-5: color(display-p3 0.761 0.914 0.878);
+      --teal-6: color(display-p3 0.682 0.864 0.825);
+      --teal-7: color(display-p3 0.581 0.798 0.756);
+      --teal-8: color(display-p3 0.433 0.716 0.671);
+      --teal-9: color(display-p3 0.297 0.637 0.581);
+      --teal-10: color(display-p3 0.275 0.599 0.542);
+      --teal-11: color(display-p3 0.08 0.5 0.43);
+      --teal-12: color(display-p3 0.11 0.235 0.219);
+      --teal-a1: color(display-p3 0.024 0.757 0.514 / 0.016);
+      --teal-a2: color(display-p3 0.02 0.647 0.467 / 0.044);
+      --teal-a3: color(display-p3 0.004 0.741 0.557 / 0.106);
+      --teal-a4: color(display-p3 0.004 0.702 0.537 / 0.169);
+      --teal-a5: color(display-p3 0.004 0.643 0.494 / 0.24);
+      --teal-a6: color(display-p3 0.004 0.569 0.447 / 0.318);
+      --teal-a7: color(display-p3 0.004 0.518 0.424 / 0.42);
+      --teal-a8: color(display-p3 0 0.506 0.424 / 0.569);
+      --teal-a9: color(display-p3 0 0.482 0.404 / 0.702);
+      --teal-a10: color(display-p3 0 0.451 0.369 / 0.726);
+      --teal-a11: color(display-p3 0.08 0.5 0.43);
+      --teal-a12: color(display-p3 0.11 0.235 0.219);
+      --tomato-1: color(display-p3 0.998 0.989 0.988);
+      --tomato-2: color(display-p3 0.994 0.974 0.969);
+      --tomato-3: color(display-p3 0.985 0.924 0.909);
+      --tomato-4: color(display-p3 0.996 0.868 0.835);
+      --tomato-5: color(display-p3 0.98 0.812 0.77);
+      --tomato-6: color(display-p3 0.953 0.75 0.698);
+      --tomato-7: color(display-p3 0.917 0.673 0.611);
+      --tomato-8: color(display-p3 0.875 0.575 0.502);
+      --tomato-9: color(display-p3 0.831 0.345 0.231);
+      --tomato-10: color(display-p3 0.802 0.313 0.2);
+      --tomato-11: color(display-p3 0.755 0.259 0.152);
+      --tomato-12: color(display-p3 0.335 0.165 0.132);
+      --tomato-a1: color(display-p3 0.675 0.024 0.024 / 0.012);
+      --tomato-a2: color(display-p3 0.757 0.145 0.02 / 0.032);
+      --tomato-a3: color(display-p3 0.831 0.184 0.012 / 0.091);
+      --tomato-a4: color(display-p3 0.976 0.192 0.004 / 0.165);
+      --tomato-a5: color(display-p3 0.918 0.192 0.004 / 0.232);
+      --tomato-a6: color(display-p3 0.847 0.173 0.004 / 0.302);
+      --tomato-a7: color(display-p3 0.788 0.165 0.004 / 0.389);
+      --tomato-a8: color(display-p3 0.749 0.153 0.004 / 0.499);
+      --tomato-a9: color(display-p3 0.78 0.149 0 / 0.769);
+      --tomato-a10: color(display-p3 0.757 0.141 0 / 0.8);
+      --tomato-a11: color(display-p3 0.755 0.259 0.152);
+      --tomato-a12: color(display-p3 0.335 0.165 0.132);
+      --violet-1: color(display-p3 0.991 0.988 0.995);
+      --violet-2: color(display-p3 0.978 0.974 0.998);
+      --violet-3: color(display-p3 0.953 0.943 0.993);
+      --violet-4: color(display-p3 0.916 0.897 1);
+      --violet-5: color(display-p3 0.876 0.851 1);
+      --violet-6: color(display-p3 0.825 0.793 0.981);
+      --violet-7: color(display-p3 0.752 0.712 0.943);
+      --violet-8: color(display-p3 0.654 0.602 0.902);
+      --violet-9: color(display-p3 0.417 0.341 0.784);
+      --violet-10: color(display-p3 0.381 0.306 0.741);
+      --violet-11: color(display-p3 0.383 0.317 0.702);
+      --violet-12: color(display-p3 0.179 0.15 0.359);
+      --violet-a1: color(display-p3 0.349 0.024 0.675 / 0.012);
+      --violet-a2: color(display-p3 0.161 0.024 0.863 / 0.028);
+      --violet-a3: color(display-p3 0.204 0.004 0.871 / 0.059);
+      --violet-a4: color(display-p3 0.196 0.004 1 / 0.102);
+      --violet-a5: color(display-p3 0.165 0.008 1 / 0.15);
+      --violet-a6: color(display-p3 0.153 0.004 0.906 / 0.208);
+      --violet-a7: color(display-p3 0.141 0.004 0.796 / 0.287);
+      --violet-a8: color(display-p3 0.133 0.004 0.753 / 0.397);
+      --violet-a9: color(display-p3 0.114 0 0.675 / 0.659);
+      --violet-a10: color(display-p3 0.11 0 0.627 / 0.695);
+      --violet-a11: color(display-p3 0.383 0.317 0.702);
+      --violet-a12: color(display-p3 0.179 0.15 0.359);
+      --white-a1: color(display-p3 1 1 1 / 0.05);
+      --white-a2: color(display-p3 1 1 1 / 0.1);
+      --white-a3: color(display-p3 1 1 1 / 0.15);
+      --white-a4: color(display-p3 1 1 1 / 0.2);
+      --white-a5: color(display-p3 1 1 1 / 0.3);
+      --white-a6: color(display-p3 1 1 1 / 0.4);
+      --white-a7: color(display-p3 1 1 1 / 0.5);
+      --white-a8: color(display-p3 1 1 1 / 0.6);
+      --white-a9: color(display-p3 1 1 1 / 0.7);
+      --white-a10: color(display-p3 1 1 1 / 0.8);
+      --white-a11: color(display-p3 1 1 1 / 0.9);
+      --white-a12: color(display-p3 1 1 1 / 0.95);
+      --yellow-1: color(display-p3 0.992 0.992 0.978);
+      --yellow-2: color(display-p3 0.995 0.99 0.922);
+      --yellow-3: color(display-p3 0.997 0.982 0.749);
+      --yellow-4: color(display-p3 0.992 0.953 0.627);
+      --yellow-5: color(display-p3 0.984 0.91 0.51);
+      --yellow-6: color(display-p3 0.934 0.847 0.474);
+      --yellow-7: color(display-p3 0.876 0.785 0.46);
+      --yellow-8: color(display-p3 0.811 0.689 0.313);
+      --yellow-9: color(display-p3 1 0.92 0.22);
+      --yellow-10: color(display-p3 0.977 0.868 0.291);
+      --yellow-11: color(display-p3 0.6 0.44 0);
+      --yellow-12: color(display-p3 0.271 0.233 0.137);
+      --yellow-a1: color(display-p3 0.675 0.675 0.024 / 0.024);
+      --yellow-a2: color(display-p3 0.953 0.855 0.008 / 0.079);
+      --yellow-a3: color(display-p3 0.988 0.925 0.004 / 0.251);
+      --yellow-a4: color(display-p3 0.98 0.875 0.004 / 0.373);
+      --yellow-a5: color(display-p3 0.969 0.816 0.004 / 0.491);
+      --yellow-a6: color(display-p3 0.875 0.71 0 / 0.526);
+      --yellow-a7: color(display-p3 0.769 0.604 0 / 0.542);
+      --yellow-a8: color(display-p3 0.725 0.549 0 / 0.687);
+      --yellow-a9: color(display-p3 1 0.898 0 / 0.781);
+      --yellow-a10: color(display-p3 0.969 0.812 0 / 0.71);
+      --yellow-a11: color(display-p3 0.6 0.44 0);
+      --yellow-a12: color(display-p3 0.271 0.233 0.137);
+    }
+    [data-theme="dark"] {
+        --amber-1: color(display-p3 0.082 0.07 0.05);
+        --amber-2: color(display-p3 0.111 0.094 0.064);
+        --amber-3: color(display-p3 0.178 0.128 0.049);
+        --amber-4: color(display-p3 0.239 0.156 0);
+        --amber-5: color(display-p3 0.29 0.193 0);
+        --amber-6: color(display-p3 0.344 0.245 0.076);
+        --amber-7: color(display-p3 0.422 0.314 0.141);
+        --amber-8: color(display-p3 0.535 0.399 0.189);
+        --amber-9: color(display-p3 1 0.77 0.26);
+        --amber-10: color(display-p3 1 0.87 0.15);
+        --amber-11: color(display-p3 1 0.8 0.29);
+        --amber-12: color(display-p3 0.984 0.909 0.726);
+        --amber-a1: color(display-p3 0.992 0.298 0 / 0.017);
+        --amber-a2: color(display-p3 0.988 0.651 0 / 0.047);
+        --amber-a3: color(display-p3 1 0.6 0 / 0.118);
+        --amber-a4: color(display-p3 1 0.557 0 / 0.185);
+        --amber-a5: color(display-p3 1 0.592 0 / 0.24);
+        --amber-a6: color(display-p3 1 0.659 0.094 / 0.299);
+        --amber-a7: color(display-p3 1 0.714 0.263 / 0.383);
+        --amber-a8: color(display-p3 0.996 0.729 0.306 / 0.5);
+        --amber-a9: color(display-p3 1 0.769 0.259);
+        --amber-a10: color(display-p3 1 0.871 0.149);
+        --amber-a11: color(display-p3 1 0.8 0.29);
+        --amber-a12: color(display-p3 0.984 0.909 0.726);
+        --blue-1: color(display-p3 0.057 0.081 0.122);
+        --blue-2: color(display-p3 0.072 0.098 0.147);
+        --blue-3: color(display-p3 0.078 0.154 0.27);
+        --blue-4: color(display-p3 0.033 0.197 0.37);
+        --blue-5: color(display-p3 0.08 0.245 0.441);
+        --blue-6: color(display-p3 0.14 0.298 0.511);
+        --blue-7: color(display-p3 0.195 0.361 0.6);
+        --blue-8: color(display-p3 0.239 0.434 0.72);
+        --blue-9: color(display-p3 0.247 0.556 0.969);
+        --blue-10: color(display-p3 0.344 0.612 0.973);
+        --blue-11: color(display-p3 0.49 0.72 1);
+        --blue-12: color(display-p3 0.788 0.898 0.99);
+        --blue-a1: color(display-p3 0 0.333 1 / 0.059);
+        --blue-a2: color(display-p3 0.114 0.435 0.988 / 0.085);
+        --blue-a3: color(display-p3 0.122 0.463 1 / 0.219);
+        --blue-a4: color(display-p3 0 0.467 1 / 0.324);
+        --blue-a5: color(display-p3 0.098 0.51 1 / 0.4);
+        --blue-a6: color(display-p3 0.224 0.557 1 / 0.475);
+        --blue-a7: color(display-p3 0.294 0.584 1 / 0.572);
+        --blue-a8: color(display-p3 0.314 0.592 1 / 0.702);
+        --blue-a9: color(display-p3 0.251 0.573 0.996 / 0.967);
+        --blue-a10: color(display-p3 0.357 0.631 1 / 0.971);
+        --blue-a11: color(display-p3 0.49 0.72 1);
+        --blue-a12: color(display-p3 0.788 0.898 0.99);
+        --bronze-1: color(display-p3 0.076 0.067 0.063);
+        --bronze-2: color(display-p3 0.106 0.097 0.093);
+        --bronze-3: color(display-p3 0.147 0.132 0.125);
+        --bronze-4: color(display-p3 0.185 0.166 0.156);
+        --bronze-5: color(display-p3 0.227 0.202 0.19);
+        --bronze-6: color(display-p3 0.278 0.246 0.23);
+        --bronze-7: color(display-p3 0.343 0.302 0.281);
+        --bronze-8: color(display-p3 0.426 0.374 0.347);
+        --bronze-9: color(display-p3 0.611 0.507 0.455);
+        --bronze-10: color(display-p3 0.66 0.556 0.504);
+        --bronze-11: color(display-p3 0.81 0.707 0.655);
+        --bronze-12: color(display-p3 0.921 0.88 0.854);
+        --bronze-a1: color(display-p3 0.941 0.067 0 / 0.009);
+        --bronze-a2: color(display-p3 0.98 0.8 0.706 / 0.043);
+        --bronze-a3: color(display-p3 0.988 0.851 0.761 / 0.085);
+        --bronze-a4: color(display-p3 0.996 0.839 0.78 / 0.127);
+        --bronze-a5: color(display-p3 0.996 0.863 0.773 / 0.173);
+        --bronze-a6: color(display-p3 1 0.863 0.796 / 0.227);
+        --bronze-a7: color(display-p3 1 0.867 0.8 / 0.295);
+        --bronze-a8: color(display-p3 1 0.859 0.788 / 0.387);
+        --bronze-a9: color(display-p3 1 0.82 0.733 / 0.585);
+        --bronze-a10: color(display-p3 1 0.839 0.761 / 0.635);
+        --bronze-a11: color(display-p3 0.81 0.707 0.655);
+        --bronze-a12: color(display-p3 0.921 0.88 0.854);
+        --brown-1: color(display-p3 0.071 0.067 0.059);
+        --brown-2: color(display-p3 0.107 0.095 0.087);
+        --brown-3: color(display-p3 0.151 0.13 0.115);
+        --brown-4: color(display-p3 0.191 0.161 0.138);
+        --brown-5: color(display-p3 0.235 0.194 0.162);
+        --brown-6: color(display-p3 0.291 0.237 0.192);
+        --brown-7: color(display-p3 0.365 0.295 0.232);
+        --brown-8: color(display-p3 0.469 0.377 0.287);
+        --brown-9: color(display-p3 0.651 0.505 0.368);
+        --brown-10: color(display-p3 0.697 0.557 0.423);
+        --brown-11: color(display-p3 0.835 0.715 0.597);
+        --brown-12: color(display-p3 0.938 0.885 0.802);
+        --brown-a1: color(display-p3 0.855 0.071 0 / 0.005);
+        --brown-a2: color(display-p3 0.98 0.706 0.525 / 0.043);
+        --brown-a3: color(display-p3 0.996 0.745 0.576 / 0.093);
+        --brown-a4: color(display-p3 1 0.765 0.592 / 0.135);
+        --brown-a5: color(display-p3 1 0.761 0.588 / 0.181);
+        --brown-a6: color(display-p3 1 0.773 0.592 / 0.24);
+        --brown-a7: color(display-p3 0.996 0.776 0.58 / 0.32);
+        --brown-a8: color(display-p3 1 0.78 0.573 / 0.433);
+        --brown-a9: color(display-p3 1 0.769 0.549 / 0.627);
+        --brown-a10: color(display-p3 1 0.792 0.596 / 0.677);
+        --brown-a11: color(display-p3 0.835 0.715 0.597);
+        --brown-a12: color(display-p3 0.938 0.885 0.802);
+        --crimson-1: color(display-p3 0.093 0.068 0.078);
+        --crimson-2: color(display-p3 0.117 0.078 0.095);
+        --crimson-3: color(display-p3 0.203 0.091 0.143);
+        --crimson-4: color(display-p3 0.277 0.087 0.182);
+        --crimson-5: color(display-p3 0.332 0.115 0.22);
+        --crimson-6: color(display-p3 0.394 0.162 0.268);
+        --crimson-7: color(display-p3 0.489 0.222 0.336);
+        --crimson-8: color(display-p3 0.638 0.289 0.429);
+        --crimson-9: color(display-p3 0.843 0.298 0.507);
+        --crimson-10: color(display-p3 0.864 0.364 0.539);
+        --crimson-11: color(display-p3 1 0.56 0.66);
+        --crimson-12: color(display-p3 0.966 0.834 0.906);
+        --crimson-a1: color(display-p3 0.984 0.071 0.463 / 0.03);
+        --crimson-a2: color(display-p3 0.996 0.282 0.569 / 0.055);
+        --crimson-a3: color(display-p3 0.996 0.227 0.573 / 0.148);
+        --crimson-a4: color(display-p3 1 0.157 0.569 / 0.227);
+        --crimson-a5: color(display-p3 1 0.231 0.604 / 0.286);
+        --crimson-a6: color(display-p3 1 0.337 0.643 / 0.349);
+        --crimson-a7: color(display-p3 1 0.416 0.663 / 0.454);
+        --crimson-a8: color(display-p3 0.996 0.427 0.651 / 0.614);
+        --crimson-a9: color(display-p3 1 0.345 0.596 / 0.832);
+        --crimson-a10: color(display-p3 1 0.42 0.62 / 0.853);
+        --crimson-a11: color(display-p3 1 0.56 0.66);
+        --crimson-a12: color(display-p3 0.966 0.834 0.906);
+        --cyan-1: color(display-p3 0.053 0.085 0.098);
+        --cyan-2: color(display-p3 0.072 0.105 0.122);
+        --cyan-3: color(display-p3 0.073 0.168 0.209);
+        --cyan-4: color(display-p3 0.063 0.216 0.277);
+        --cyan-5: color(display-p3 0.091 0.267 0.336);
+        --cyan-6: color(display-p3 0.137 0.324 0.4);
+        --cyan-7: color(display-p3 0.186 0.398 0.484);
+        --cyan-8: color(display-p3 0.23 0.496 0.6);
+        --cyan-9: color(display-p3 0.282 0.627 0.765);
+        --cyan-10: color(display-p3 0.331 0.675 0.801);
+        --cyan-11: color(display-p3 0.446 0.79 0.887);
+        --cyan-12: color(display-p3 0.757 0.919 0.962);
+        --cyan-a1: color(display-p3 0 0.647 0.992 / 0.034);
+        --cyan-a2: color(display-p3 0.133 0.733 1 / 0.059);
+        --cyan-a3: color(display-p3 0.122 0.741 0.996 / 0.152);
+        --cyan-a4: color(display-p3 0.051 0.725 1 / 0.227);
+        --cyan-a5: color(display-p3 0.149 0.757 1 / 0.29);
+        --cyan-a6: color(display-p3 0.267 0.792 1 / 0.358);
+        --cyan-a7: color(display-p3 0.333 0.808 1 / 0.446);
+        --cyan-a8: color(display-p3 0.357 0.816 1 / 0.572);
+        --cyan-a9: color(display-p3 0.357 0.82 1 / 0.748);
+        --cyan-a10: color(display-p3 0.4 0.839 1 / 0.786);
+        --cyan-a11: color(display-p3 0.446 0.79 0.887);
+        --cyan-a12: color(display-p3 0.757 0.919 0.962);
+        --gold-1: color(display-p3 0.071 0.071 0.067);
+        --gold-2: color(display-p3 0.104 0.101 0.09);
+        --gold-3: color(display-p3 0.141 0.136 0.122);
+        --gold-4: color(display-p3 0.177 0.17 0.152);
+        --gold-5: color(display-p3 0.217 0.207 0.185);
+        --gold-6: color(display-p3 0.265 0.252 0.225);
+        --gold-7: color(display-p3 0.327 0.31 0.277);
+        --gold-8: color(display-p3 0.407 0.384 0.342);
+        --gold-9: color(display-p3 0.579 0.517 0.41);
+        --gold-10: color(display-p3 0.628 0.566 0.463);
+        --gold-11: color(display-p3 0.784 0.728 0.635);
+        --gold-12: color(display-p3 0.906 0.887 0.855);
+        --gold-a1: color(display-p3 0.855 0.855 0.071 / 0.005);
+        --gold-a2: color(display-p3 0.98 0.89 0.616 / 0.043);
+        --gold-a3: color(display-p3 1 0.949 0.753 / 0.08);
+        --gold-a4: color(display-p3 1 0.933 0.8 / 0.118);
+        --gold-a5: color(display-p3 1 0.949 0.804 / 0.16);
+        --gold-a6: color(display-p3 1 0.925 0.8 / 0.215);
+        --gold-a7: color(display-p3 1 0.945 0.831 / 0.278);
+        --gold-a8: color(display-p3 1 0.937 0.82 / 0.366);
+        --gold-a9: color(display-p3 0.996 0.882 0.69 / 0.551);
+        --gold-a10: color(display-p3 1 0.894 0.725 / 0.601);
+        --gold-a11: color(display-p3 0.784 0.728 0.635);
+        --gold-a12: color(display-p3 0.906 0.887 0.855);
+        --grass-1: color(display-p3 0.062 0.083 0.067);
+        --grass-2: color(display-p3 0.083 0.103 0.085);
+        --grass-3: color(display-p3 0.118 0.163 0.122);
+        --grass-4: color(display-p3 0.142 0.225 0.15);
+        --grass-5: color(display-p3 0.178 0.279 0.186);
+        --grass-6: color(display-p3 0.217 0.337 0.224);
+        --grass-7: color(display-p3 0.258 0.4 0.264);
+        --grass-8: color(display-p3 0.302 0.47 0.305);
+        --grass-9: color(display-p3 0.38 0.647 0.378);
+        --grass-10: color(display-p3 0.426 0.694 0.426);
+        --grass-11: color(display-p3 0.535 0.807 0.542);
+        --grass-12: color(display-p3 0.797 0.936 0.776);
+        --grass-a1: color(display-p3 0 0.992 0.071 / 0.017);
+        --grass-a2: color(display-p3 0.482 0.996 0.584 / 0.038);
+        --grass-a3: color(display-p3 0.549 0.992 0.588 / 0.106);
+        --grass-a4: color(display-p3 0.51 0.996 0.557 / 0.169);
+        --grass-a5: color(display-p3 0.553 1 0.588 / 0.227);
+        --grass-a6: color(display-p3 0.584 1 0.608 / 0.29);
+        --grass-a7: color(display-p3 0.604 1 0.616 / 0.358);
+        --grass-a8: color(display-p3 0.608 1 0.62 / 0.433);
+        --grass-a9: color(display-p3 0.573 1 0.569 / 0.622);
+        --grass-a10: color(display-p3 0.6 0.996 0.6 / 0.673);
+        --grass-a11: color(display-p3 0.535 0.807 0.542);
+        --grass-a12: color(display-p3 0.797 0.936 0.776);
+        --gray-1: color(display-p3 0.067 0.067 0.067);
+        --gray-2: color(display-p3 0.098 0.098 0.098);
+        --gray-3: color(display-p3 0.135 0.135 0.135);
+        --gray-4: color(display-p3 0.163 0.163 0.163);
+        --gray-5: color(display-p3 0.192 0.192 0.192);
+        --gray-6: color(display-p3 0.228 0.228 0.228);
+        --gray-7: color(display-p3 0.283 0.283 0.283);
+        --gray-8: color(display-p3 0.375 0.375 0.375);
+        --gray-9: color(display-p3 0.431 0.431 0.431);
+        --gray-10: color(display-p3 0.484 0.484 0.484);
+        --gray-11: color(display-p3 0.706 0.706 0.706);
+        --gray-12: color(display-p3 0.933 0.933 0.933);
+        --gray-a1: color(display-p3 0 0 0 / 0);
+        --gray-a2: color(display-p3 1 1 1 / 0.034);
+        --gray-a3: color(display-p3 1 1 1 / 0.071);
+        --gray-a4: color(display-p3 1 1 1 / 0.105);
+        --gray-a5: color(display-p3 1 1 1 / 0.134);
+        --gray-a6: color(display-p3 1 1 1 / 0.172);
+        --gray-a7: color(display-p3 1 1 1 / 0.231);
+        --gray-a8: color(display-p3 1 1 1 / 0.332);
+        --gray-a9: color(display-p3 1 1 1 / 0.391);
+        --gray-a10: color(display-p3 1 1 1 / 0.445);
+        --gray-a11: color(display-p3 1 1 1 / 0.685);
+        --gray-a12: color(display-p3 1 1 1 / 0.929);
+        --green-1: color(display-p3 0.062 0.083 0.071);
+        --green-2: color(display-p3 0.079 0.106 0.09);
+        --green-3: color(display-p3 0.1 0.173 0.133);
+        --green-4: color(display-p3 0.115 0.229 0.166);
+        --green-5: color(display-p3 0.147 0.282 0.206);
+        --green-6: color(display-p3 0.185 0.338 0.25);
+        --green-7: color(display-p3 0.227 0.403 0.298);
+        --green-8: color(display-p3 0.27 0.479 0.351);
+        --green-9: color(display-p3 0.332 0.634 0.442);
+        --green-10: color(display-p3 0.357 0.682 0.474);
+        --green-11: color(display-p3 0.434 0.828 0.573);
+        --green-12: color(display-p3 0.747 0.938 0.807);
+        --green-a1: color(display-p3 0 0.992 0.298 / 0.017);
+        --green-a2: color(display-p3 0.341 0.98 0.616 / 0.043);
+        --green-a3: color(display-p3 0.376 0.996 0.655 / 0.114);
+        --green-a4: color(display-p3 0.341 0.996 0.635 / 0.173);
+        --green-a5: color(display-p3 0.408 1 0.678 / 0.232);
+        --green-a6: color(display-p3 0.475 1 0.706 / 0.29);
+        --green-a7: color(display-p3 0.514 1 0.706 / 0.362);
+        --green-a8: color(display-p3 0.529 1 0.718 / 0.442);
+        --green-a9: color(display-p3 0.502 0.996 0.682 / 0.61);
+        --green-a10: color(display-p3 0.506 1 0.682 / 0.66);
+        --green-a11: color(display-p3 0.434 0.828 0.573);
+        --green-a12: color(display-p3 0.747 0.938 0.807);
+        --indigo-1: color(display-p3 0.068 0.074 0.118);
+        --indigo-2: color(display-p3 0.081 0.089 0.144);
+        --indigo-3: color(display-p3 0.105 0.141 0.275);
+        --indigo-4: color(display-p3 0.129 0.18 0.369);
+        --indigo-5: color(display-p3 0.163 0.22 0.439);
+        --indigo-6: color(display-p3 0.203 0.262 0.5);
+        --indigo-7: color(display-p3 0.245 0.309 0.575);
+        --indigo-8: color(display-p3 0.285 0.362 0.674);
+        --indigo-9: color(display-p3 0.276 0.384 0.837);
+        --indigo-10: color(display-p3 0.354 0.445 0.866);
+        --indigo-11: color(display-p3 0.63 0.69 1);
+        --indigo-12: color(display-p3 0.848 0.881 0.99);
+        --indigo-a1: color(display-p3 0.071 0.212 0.996 / 0.055);
+        --indigo-a2: color(display-p3 0.251 0.345 0.988 / 0.085);
+        --indigo-a3: color(display-p3 0.243 0.404 1 / 0.223);
+        --indigo-a4: color(display-p3 0.263 0.42 1 / 0.324);
+        --indigo-a5: color(display-p3 0.314 0.451 1 / 0.4);
+        --indigo-a6: color(display-p3 0.361 0.49 1 / 0.467);
+        --indigo-a7: color(display-p3 0.388 0.51 1 / 0.547);
+        --indigo-a8: color(display-p3 0.404 0.518 1 / 0.652);
+        --indigo-a9: color(display-p3 0.318 0.451 1 / 0.824);
+        --indigo-a10: color(display-p3 0.404 0.506 1 / 0.858);
+        --indigo-a11: color(display-p3 0.63 0.69 1);
+        --indigo-a12: color(display-p3 0.848 0.881 0.99);
+        --iris-1: color(display-p3 0.075 0.075 0.114);
+        --iris-2: color(display-p3 0.089 0.086 0.14);
+        --iris-3: color(display-p3 0.128 0.134 0.272);
+        --iris-4: color(display-p3 0.153 0.165 0.382);
+        --iris-5: color(display-p3 0.192 0.201 0.44);
+        --iris-6: color(display-p3 0.239 0.241 0.491);
+        --iris-7: color(display-p3 0.291 0.289 0.565);
+        --iris-8: color(display-p3 0.35 0.345 0.673);
+        --iris-9: color(display-p3 0.357 0.357 0.81);
+        --iris-10: color(display-p3 0.428 0.416 0.843);
+        --iris-11: color(display-p3 0.685 0.662 1);
+        --iris-12: color(display-p3 0.878 0.875 0.986);
+        --iris-a1: color(display-p3 0.224 0.224 0.992 / 0.051);
+        --iris-a2: color(display-p3 0.361 0.314 1 / 0.08);
+        --iris-a3: color(display-p3 0.357 0.373 1 / 0.219);
+        --iris-a4: color(display-p3 0.325 0.361 1 / 0.337);
+        --iris-a5: color(display-p3 0.38 0.4 1 / 0.4);
+        --iris-a6: color(display-p3 0.447 0.447 1 / 0.454);
+        --iris-a7: color(display-p3 0.486 0.486 1 / 0.534);
+        --iris-a8: color(display-p3 0.502 0.494 1 / 0.652);
+        --iris-a9: color(display-p3 0.431 0.431 1 / 0.799);
+        --iris-a10: color(display-p3 0.502 0.486 1 / 0.832);
+        --iris-a11: color(display-p3 0.685 0.662 1);
+        --iris-a12: color(display-p3 0.878 0.875 0.986);
+        --jade-1: color(display-p3 0.059 0.083 0.071);
+        --jade-2: color(display-p3 0.078 0.11 0.094);
+        --jade-3: color(display-p3 0.091 0.176 0.138);
+        --jade-4: color(display-p3 0.102 0.228 0.177);
+        --jade-5: color(display-p3 0.133 0.279 0.221);
+        --jade-6: color(display-p3 0.174 0.334 0.273);
+        --jade-7: color(display-p3 0.219 0.402 0.335);
+        --jade-8: color(display-p3 0.263 0.488 0.411);
+        --jade-9: color(display-p3 0.319 0.63 0.521);
+        --jade-10: color(display-p3 0.338 0.68 0.555);
+        --jade-11: color(display-p3 0.4 0.835 0.656);
+        --jade-12: color(display-p3 0.734 0.934 0.838);
+        --jade-a1: color(display-p3 0 0.992 0.298 / 0.017);
+        --jade-a2: color(display-p3 0.318 0.988 0.651 / 0.047);
+        --jade-a3: color(display-p3 0.267 1 0.667 / 0.118);
+        --jade-a4: color(display-p3 0.275 0.996 0.702 / 0.173);
+        --jade-a5: color(display-p3 0.361 1 0.741 / 0.227);
+        --jade-a6: color(display-p3 0.439 1 0.796 / 0.286);
+        --jade-a7: color(display-p3 0.49 1 0.804 / 0.362);
+        --jade-a8: color(display-p3 0.506 1 0.835 / 0.45);
+        --jade-a9: color(display-p3 0.478 0.996 0.816 / 0.606);
+        --jade-a10: color(display-p3 0.478 1 0.816 / 0.656);
+        --jade-a11: color(display-p3 0.4 0.835 0.656);
+        --jade-a12: color(display-p3 0.734 0.934 0.838);
+        --lime-1: color(display-p3 0.067 0.073 0.048);
+        --lime-2: color(display-p3 0.086 0.1 0.067);
+        --lime-3: color(display-p3 0.13 0.16 0.099);
+        --lime-4: color(display-p3 0.172 0.214 0.126);
+        --lime-5: color(display-p3 0.213 0.266 0.153);
+        --lime-6: color(display-p3 0.257 0.321 0.182);
+        --lime-7: color(display-p3 0.307 0.383 0.215);
+        --lime-8: color(display-p3 0.365 0.456 0.25);
+        --lime-9: color(display-p3 0.78 0.928 0.466);
+        --lime-10: color(display-p3 0.865 0.995 0.519);
+        --lime-11: color(display-p3 0.771 0.893 0.485);
+        --lime-12: color(display-p3 0.905 0.966 0.753);
+        --lime-a1: color(display-p3 0.067 0.941 0 / 0.009);
+        --lime-a2: color(display-p3 0.584 0.996 0.071 / 0.038);
+        --lime-a3: color(display-p3 0.69 1 0.38 / 0.101);
+        --lime-a4: color(display-p3 0.729 1 0.435 / 0.16);
+        --lime-a5: color(display-p3 0.745 1 0.471 / 0.215);
+        --lime-a6: color(display-p3 0.769 1 0.482 / 0.274);
+        --lime-a7: color(display-p3 0.769 1 0.506 / 0.341);
+        --lime-a8: color(display-p3 0.784 1 0.51 / 0.416);
+        --lime-a9: color(display-p3 0.839 1 0.502 / 0.925);
+        --lime-a10: color(display-p3 0.871 1 0.522 / 0.996);
+        --lime-a11: color(display-p3 0.771 0.893 0.485);
+        --lime-a12: color(display-p3 0.905 0.966 0.753);
+        --mauve-1: color(display-p3 0.07 0.067 0.074);
+        --mauve-2: color(display-p3 0.101 0.098 0.105);
+        --mauve-3: color(display-p3 0.138 0.134 0.144);
+        --mauve-4: color(display-p3 0.167 0.161 0.175);
+        --mauve-5: color(display-p3 0.196 0.189 0.206);
+        --mauve-6: color(display-p3 0.232 0.225 0.245);
+        --mauve-7: color(display-p3 0.286 0.277 0.302);
+        --mauve-8: color(display-p3 0.383 0.373 0.408);
+        --mauve-9: color(display-p3 0.434 0.428 0.467);
+        --mauve-10: color(display-p3 0.487 0.48 0.519);
+        --mauve-11: color(display-p3 0.707 0.7 0.735);
+        --mauve-12: color(display-p3 0.933 0.933 0.94);
+        --mauve-a1: color(display-p3 0 0 0 / 0);
+        --mauve-a2: color(display-p3 0.996 0.992 1 / 0.034);
+        --mauve-a3: color(display-p3 0.937 0.933 0.992 / 0.077);
+        --mauve-a4: color(display-p3 0.957 0.918 0.996 / 0.111);
+        --mauve-a5: color(display-p3 0.937 0.906 0.996 / 0.145);
+        --mauve-a6: color(display-p3 0.953 0.925 0.996 / 0.183);
+        --mauve-a7: color(display-p3 0.945 0.929 1 / 0.246);
+        --mauve-a8: color(display-p3 0.937 0.918 1 / 0.361);
+        --mauve-a9: color(display-p3 0.933 0.918 1 / 0.424);
+        --mauve-a10: color(display-p3 0.941 0.925 1 / 0.479);
+        --mauve-a11: color(display-p3 0.965 0.961 1 / 0.712);
+        --mauve-a12: color(display-p3 0.992 0.992 1 / 0.937);
+        --mint-1: color(display-p3 0.059 0.082 0.081);
+        --mint-2: color(display-p3 0.068 0.104 0.105);
+        --mint-3: color(display-p3 0.077 0.17 0.168);
+        --mint-4: color(display-p3 0.068 0.224 0.22);
+        --mint-5: color(display-p3 0.104 0.275 0.264);
+        --mint-6: color(display-p3 0.154 0.332 0.313);
+        --mint-7: color(display-p3 0.207 0.403 0.373);
+        --mint-8: color(display-p3 0.258 0.49 0.441);
+        --mint-9: color(display-p3 0.62 0.908 0.834);
+        --mint-10: color(display-p3 0.725 0.954 0.898);
+        --mint-11: color(display-p3 0.482 0.825 0.733);
+        --mint-12: color(display-p3 0.807 0.955 0.887);
+        --mint-a1: color(display-p3 0 0.992 0.992 / 0.017);
+        --mint-a2: color(display-p3 0.071 0.98 0.98 / 0.043);
+        --mint-a3: color(display-p3 0.176 0.996 0.996 / 0.11);
+        --mint-a4: color(display-p3 0.071 0.996 0.973 / 0.169);
+        --mint-a5: color(display-p3 0.243 1 0.949 / 0.223);
+        --mint-a6: color(display-p3 0.369 1 0.933 / 0.286);
+        --mint-a7: color(display-p3 0.459 1 0.914 / 0.362);
+        --mint-a8: color(display-p3 0.49 1 0.89 / 0.454);
+        --mint-a9: color(display-p3 0.678 0.996 0.914 / 0.904);
+        --mint-a10: color(display-p3 0.761 1 0.941 / 0.95);
+        --mint-a11: color(display-p3 0.482 0.825 0.733);
+        --mint-a12: color(display-p3 0.807 0.955 0.887);
+        --olive-1: color(display-p3 0.067 0.07 0.063);
+        --olive-2: color(display-p3 0.095 0.098 0.091);
+        --olive-3: color(display-p3 0.131 0.135 0.126);
+        --olive-4: color(display-p3 0.158 0.163 0.153);
+        --olive-5: color(display-p3 0.186 0.192 0.18);
+        --olive-6: color(display-p3 0.221 0.229 0.215);
+        --olive-7: color(display-p3 0.273 0.284 0.266);
+        --olive-8: color(display-p3 0.365 0.382 0.359);
+        --olive-9: color(display-p3 0.414 0.438 0.404);
+        --olive-10: color(display-p3 0.467 0.49 0.458);
+        --olive-11: color(display-p3 0.69 0.709 0.682);
+        --olive-12: color(display-p3 0.927 0.933 0.926);
+        --olive-a1: color(display-p3 0 0 0 / 0);
+        --olive-a2: color(display-p3 0.984 0.988 0.976 / 0.03);
+        --olive-a3: color(display-p3 0.992 0.996 0.988 / 0.068);
+        --olive-a4: color(display-p3 0.953 0.996 0.949 / 0.102);
+        --olive-a5: color(display-p3 0.969 1 0.965 / 0.131);
+        --olive-a6: color(display-p3 0.973 1 0.969 / 0.169);
+        --olive-a7: color(display-p3 0.98 1 0.961 / 0.228);
+        --olive-a8: color(display-p3 0.961 1 0.957 / 0.334);
+        --olive-a9: color(display-p3 0.949 1 0.922 / 0.397);
+        --olive-a10: color(display-p3 0.953 1 0.941 / 0.452);
+        --olive-a11: color(display-p3 0.976 1 0.965 / 0.688);
+        --olive-a12: color(display-p3 0.992 1 0.992 / 0.929);
+        --orange-1: color(display-p3 0.088 0.07 0.057);
+        --orange-2: color(display-p3 0.113 0.089 0.061);
+        --orange-3: color(display-p3 0.189 0.12 0.056);
+        --orange-4: color(display-p3 0.262 0.132 0);
+        --orange-5: color(display-p3 0.315 0.168 0.016);
+        --orange-6: color(display-p3 0.376 0.219 0.088);
+        --orange-7: color(display-p3 0.465 0.283 0.147);
+        --orange-8: color(display-p3 0.601 0.359 0.201);
+        --orange-9: color(display-p3 0.9 0.45 0.2);
+        --orange-10: color(display-p3 0.98 0.51 0.23);
+        --orange-11: color(display-p3 1 0.63 0.38);
+        --orange-12: color(display-p3 0.98 0.883 0.775);
+        --orange-a1: color(display-p3 0.961 0.247 0 / 0.022);
+        --orange-a2: color(display-p3 0.992 0.529 0 / 0.051);
+        --orange-a3: color(display-p3 0.996 0.486 0 / 0.131);
+        --orange-a4: color(display-p3 0.996 0.384 0 / 0.211);
+        --orange-a5: color(display-p3 1 0.455 0 / 0.265);
+        --orange-a6: color(display-p3 1 0.529 0.129 / 0.332);
+        --orange-a7: color(display-p3 1 0.569 0.251 / 0.429);
+        --orange-a8: color(display-p3 1 0.584 0.302 / 0.572);
+        --orange-a9: color(display-p3 1 0.494 0.216 / 0.895);
+        --orange-a10: color(display-p3 1 0.522 0.235 / 0.979);
+        --orange-a11: color(display-p3 1 0.63 0.38);
+        --orange-a12: color(display-p3 0.98 0.883 0.775);
+        --pink-1: color(display-p3 0.093 0.068 0.089);
+        --pink-2: color(display-p3 0.121 0.073 0.11);
+        --pink-3: color(display-p3 0.198 0.098 0.179);
+        --pink-4: color(display-p3 0.271 0.095 0.231);
+        --pink-5: color(display-p3 0.32 0.127 0.273);
+        --pink-6: color(display-p3 0.382 0.177 0.326);
+        --pink-7: color(display-p3 0.477 0.238 0.405);
+        --pink-8: color(display-p3 0.612 0.304 0.51);
+        --pink-9: color(display-p3 0.775 0.297 0.61);
+        --pink-10: color(display-p3 0.808 0.356 0.645);
+        --pink-11: color(display-p3 1 0.535 0.78);
+        --pink-12: color(display-p3 0.964 0.826 0.912);
+        --pink-a1: color(display-p3 0.984 0.071 0.855 / 0.03);
+        --pink-a2: color(display-p3 1 0.2 0.8 / 0.059);
+        --pink-a3: color(display-p3 1 0.294 0.886 / 0.139);
+        --pink-a4: color(display-p3 1 0.192 0.82 / 0.219);
+        --pink-a5: color(display-p3 1 0.282 0.827 / 0.274);
+        --pink-a6: color(display-p3 1 0.396 0.835 / 0.337);
+        --pink-a7: color(display-p3 1 0.459 0.831 / 0.442);
+        --pink-a8: color(display-p3 1 0.478 0.827 / 0.585);
+        --pink-a9: color(display-p3 1 0.373 0.784 / 0.761);
+        --pink-a10: color(display-p3 1 0.435 0.792 / 0.795);
+        --pink-a11: color(display-p3 1 0.535 0.78);
+        --pink-a12: color(display-p3 0.964 0.826 0.912);
+        --plum-1: color(display-p3 0.09 0.068 0.092);
+        --plum-2: color(display-p3 0.118 0.077 0.121);
+        --plum-3: color(display-p3 0.192 0.105 0.202);
+        --plum-4: color(display-p3 0.25 0.121 0.271);
+        --plum-5: color(display-p3 0.293 0.152 0.319);
+        --plum-6: color(display-p3 0.343 0.198 0.372);
+        --plum-7: color(display-p3 0.424 0.262 0.461);
+        --plum-8: color(display-p3 0.54 0.341 0.595);
+        --plum-9: color(display-p3 0.624 0.313 0.708);
+        --plum-10: color(display-p3 0.666 0.365 0.748);
+        --plum-11: color(display-p3 0.86 0.602 0.933);
+        --plum-12: color(display-p3 0.936 0.836 0.949);
+        --plum-a1: color(display-p3 0.973 0.071 0.973 / 0.026);
+        --plum-a2: color(display-p3 0.933 0.267 1 / 0.059);
+        --plum-a3: color(display-p3 0.918 0.333 0.996 / 0.148);
+        --plum-a4: color(display-p3 0.91 0.318 1 / 0.219);
+        --plum-a5: color(display-p3 0.914 0.388 1 / 0.269);
+        --plum-a6: color(display-p3 0.906 0.463 1 / 0.328);
+        --plum-a7: color(display-p3 0.906 0.529 1 / 0.425);
+        --plum-a8: color(display-p3 0.906 0.553 1 / 0.568);
+        --plum-a9: color(display-p3 0.875 0.427 1 / 0.69);
+        --plum-a10: color(display-p3 0.886 0.471 0.996 / 0.732);
+        --plum-a11: color(display-p3 0.86 0.602 0.933);
+        --plum-a12: color(display-p3 0.936 0.836 0.949);
+        --purple-1: color(display-p3 0.09 0.068 0.103);
+        --purple-2: color(display-p3 0.113 0.082 0.134);
+        --purple-3: color(display-p3 0.175 0.112 0.224);
+        --purple-4: color(display-p3 0.224 0.137 0.297);
+        --purple-5: color(display-p3 0.264 0.167 0.349);
+        --purple-6: color(display-p3 0.311 0.208 0.406);
+        --purple-7: color(display-p3 0.381 0.266 0.496);
+        --purple-8: color(display-p3 0.49 0.349 0.649);
+        --purple-9: color(display-p3 0.523 0.318 0.751);
+        --purple-10: color(display-p3 0.57 0.373 0.791);
+        --purple-11: color(display-p3 0.8 0.62 1);
+        --purple-12: color(display-p3 0.913 0.854 0.971);
+        --purple-a1: color(display-p3 0.686 0.071 0.996 / 0.038);
+        --purple-a2: color(display-p3 0.722 0.286 0.996 / 0.072);
+        --purple-a3: color(display-p3 0.718 0.349 0.996 / 0.169);
+        --purple-a4: color(display-p3 0.702 0.353 1 / 0.248);
+        --purple-a5: color(display-p3 0.718 0.404 1 / 0.303);
+        --purple-a6: color(display-p3 0.733 0.455 1 / 0.366);
+        --purple-a7: color(display-p3 0.753 0.506 1 / 0.458);
+        --purple-a8: color(display-p3 0.749 0.522 1 / 0.622);
+        --purple-a9: color(display-p3 0.686 0.408 1 / 0.736);
+        --purple-a10: color(display-p3 0.71 0.459 1 / 0.778);
+        --purple-a11: color(display-p3 0.8 0.62 1);
+        --purple-a12: color(display-p3 0.913 0.854 0.971);
+        --red-1: color(display-p3 0.093 0.068 0.067);
+        --red-2: color(display-p3 0.118 0.077 0.079);
+        --red-3: color(display-p3 0.211 0.081 0.099);
+        --red-4: color(display-p3 0.287 0.079 0.113);
+        --red-5: color(display-p3 0.348 0.11 0.142);
+        --red-6: color(display-p3 0.414 0.16 0.183);
+        --red-7: color(display-p3 0.508 0.224 0.236);
+        --red-8: color(display-p3 0.659 0.298 0.297);
+        --red-9: color(display-p3 0.83 0.329 0.324);
+        --red-10: color(display-p3 0.861 0.403 0.387);
+        --red-11: color(display-p3 1 0.57 0.55);
+        --red-12: color(display-p3 0.971 0.826 0.852);
+        --red-a1: color(display-p3 0.984 0.071 0.071 / 0.03);
+        --red-a2: color(display-p3 0.996 0.282 0.282 / 0.055);
+        --red-a3: color(display-p3 1 0.169 0.271 / 0.156);
+        --red-a4: color(display-p3 1 0.118 0.267 / 0.236);
+        --red-a5: color(display-p3 1 0.212 0.314 / 0.303);
+        --red-a6: color(display-p3 1 0.318 0.38 / 0.374);
+        --red-a7: color(display-p3 1 0.4 0.424 / 0.475);
+        --red-a8: color(display-p3 1 0.431 0.431 / 0.635);
+        --red-a9: color(display-p3 1 0.388 0.384 / 0.82);
+        --red-a10: color(display-p3 1 0.463 0.447 / 0.853);
+        --red-a11: color(display-p3 1 0.57 0.55);
+        --red-a12: color(display-p3 0.971 0.826 0.852);
+        --ruby-1: color(display-p3 0.093 0.068 0.074);
+        --ruby-2: color(display-p3 0.113 0.083 0.089);
+        --ruby-3: color(display-p3 0.208 0.088 0.117);
+        --ruby-4: color(display-p3 0.279 0.092 0.147);
+        --ruby-5: color(display-p3 0.337 0.12 0.18);
+        --ruby-6: color(display-p3 0.401 0.166 0.223);
+        --ruby-7: color(display-p3 0.495 0.224 0.281);
+        --ruby-8: color(display-p3 0.652 0.295 0.359);
+        --ruby-9: color(display-p3 0.83 0.323 0.408);
+        --ruby-10: color(display-p3 0.857 0.392 0.455);
+        --ruby-11: color(display-p3 1 0.57 0.59);
+        --ruby-12: color(display-p3 0.968 0.83 0.88);
+        --ruby-a1: color(display-p3 0.984 0.071 0.329 / 0.03);
+        --ruby-a2: color(display-p3 0.992 0.376 0.529 / 0.051);
+        --ruby-a3: color(display-p3 0.996 0.196 0.404 / 0.152);
+        --ruby-a4: color(display-p3 1 0.173 0.416 / 0.227);
+        --ruby-a5: color(display-p3 1 0.259 0.459 / 0.29);
+        --ruby-a6: color(display-p3 1 0.341 0.506 / 0.358);
+        --ruby-a7: color(display-p3 1 0.412 0.541 / 0.458);
+        --ruby-a8: color(display-p3 1 0.431 0.537 / 0.627);
+        --ruby-a9: color(display-p3 1 0.376 0.482 / 0.82);
+        --ruby-a10: color(display-p3 1 0.447 0.522 / 0.849);
+        --ruby-a11: color(display-p3 1 0.57 0.59);
+        --ruby-a12: color(display-p3 0.968 0.83 0.88);
+        --sage-1: color(display-p3 0.064 0.07 0.067);
+        --sage-2: color(display-p3 0.092 0.098 0.094);
+        --sage-3: color(display-p3 0.128 0.135 0.131);
+        --sage-4: color(display-p3 0.155 0.164 0.159);
+        --sage-5: color(display-p3 0.183 0.193 0.188);
+        --sage-6: color(display-p3 0.218 0.23 0.224);
+        --sage-7: color(display-p3 0.269 0.285 0.277);
+        --sage-8: color(display-p3 0.362 0.382 0.373);
+        --sage-9: color(display-p3 0.398 0.438 0.421);
+        --sage-10: color(display-p3 0.453 0.49 0.474);
+        --sage-11: color(display-p3 0.685 0.709 0.697);
+        --sage-12: color(display-p3 0.927 0.933 0.93);
+        --sage-a1: color(display-p3 0 0 0 / 0);
+        --sage-a2: color(display-p3 0.976 0.988 0.984 / 0.03);
+        --sage-a3: color(display-p3 0.992 0.945 0.941 / 0.072);
+        --sage-a4: color(display-p3 0.988 0.996 0.992 / 0.102);
+        --sage-a5: color(display-p3 0.992 1 0.996 / 0.131);
+        --sage-a6: color(display-p3 0.973 1 0.976 / 0.173);
+        --sage-a7: color(display-p3 0.957 1 0.976 / 0.233);
+        --sage-a8: color(display-p3 0.957 1 0.984 / 0.334);
+        --sage-a9: color(display-p3 0.902 1 0.957 / 0.397);
+        --sage-a10: color(display-p3 0.929 1 0.973 / 0.452);
+        --sage-a11: color(display-p3 0.969 1 0.988 / 0.688);
+        --sage-a12: color(display-p3 0.992 1 0.996 / 0.929);
+        --sand-1: color(display-p3 0.067 0.067 0.063);
+        --sand-2: color(display-p3 0.098 0.098 0.094);
+        --sand-3: color(display-p3 0.135 0.135 0.129);
+        --sand-4: color(display-p3 0.164 0.163 0.156);
+        --sand-5: color(display-p3 0.193 0.192 0.183);
+        --sand-6: color(display-p3 0.23 0.229 0.217);
+        --sand-7: color(display-p3 0.285 0.282 0.267);
+        --sand-8: color(display-p3 0.384 0.378 0.357);
+        --sand-9: color(display-p3 0.434 0.428 0.403);
+        --sand-10: color(display-p3 0.487 0.481 0.456);
+        --sand-11: color(display-p3 0.707 0.703 0.68);
+        --sand-12: color(display-p3 0.933 0.933 0.926);
+        --sand-a1: color(display-p3 0 0 0 / 0);
+        --sand-a2: color(display-p3 0.992 0.992 0.988 / 0.034);
+        --sand-a3: color(display-p3 0.996 0.996 0.992 / 0.072);
+        --sand-a4: color(display-p3 0.992 0.992 0.953 / 0.106);
+        --sand-a5: color(display-p3 1 1 0.965 / 0.135);
+        --sand-a6: color(display-p3 1 0.976 0.929 / 0.177);
+        --sand-a7: color(display-p3 1 0.984 0.929 / 0.236);
+        --sand-a8: color(display-p3 1 0.976 0.925 / 0.341);
+        --sand-a9: color(display-p3 1 0.98 0.925 / 0.395);
+        --sand-a10: color(display-p3 1 0.992 0.933 / 0.45);
+        --sand-a11: color(display-p3 1 0.996 0.961 / 0.685);
+        --sand-a12: color(display-p3 1 1 0.992 / 0.929);
+        --sky-1: color(display-p3 0.056 0.078 0.116);
+        --sky-2: color(display-p3 0.075 0.101 0.149);
+        --sky-3: color(display-p3 0.089 0.154 0.244);
+        --sky-4: color(display-p3 0.106 0.207 0.323);
+        --sky-5: color(display-p3 0.135 0.261 0.394);
+        --sky-6: color(display-p3 0.17 0.322 0.469);
+        --sky-7: color(display-p3 0.205 0.394 0.557);
+        --sky-8: color(display-p3 0.232 0.48 0.665);
+        --sky-9: color(display-p3 0.585 0.877 0.983);
+        --sky-10: color(display-p3 0.718 0.925 0.991);
+        --sky-11: color(display-p3 0.536 0.772 0.924);
+        --sky-12: color(display-p3 0.799 0.947 0.993);
+        --sky-a1: color(display-p3 0 0.282 0.996 / 0.055);
+        --sky-a2: color(display-p3 0.157 0.467 0.992 / 0.089);
+        --sky-a3: color(display-p3 0.192 0.522 0.996 / 0.19);
+        --sky-a4: color(display-p3 0.212 0.584 1 / 0.274);
+        --sky-a5: color(display-p3 0.259 0.631 1 / 0.349);
+        --sky-a6: color(display-p3 0.302 0.655 1 / 0.433);
+        --sky-a7: color(display-p3 0.329 0.686 1 / 0.526);
+        --sky-a8: color(display-p3 0.325 0.71 1 / 0.643);
+        --sky-a9: color(display-p3 0.592 0.894 1 / 0.984);
+        --sky-a10: color(display-p3 0.722 0.933 1 / 0.992);
+        --sky-a11: color(display-p3 0.536 0.772 0.924);
+        --sky-a12: color(display-p3 0.799 0.947 0.993);
+        --slate-1: color(display-p3 0.067 0.067 0.074);
+        --slate-2: color(display-p3 0.095 0.098 0.105);
+        --slate-3: color(display-p3 0.13 0.135 0.145);
+        --slate-4: color(display-p3 0.156 0.163 0.176);
+        --slate-5: color(display-p3 0.183 0.191 0.206);
+        --slate-6: color(display-p3 0.215 0.226 0.244);
+        --slate-7: color(display-p3 0.265 0.28 0.302);
+        --slate-8: color(display-p3 0.357 0.381 0.409);
+        --slate-9: color(display-p3 0.415 0.431 0.463);
+        --slate-10: color(display-p3 0.469 0.483 0.514);
+        --slate-11: color(display-p3 0.692 0.704 0.728);
+        --slate-12: color(display-p3 0.93 0.933 0.94);
+        --slate-a1: color(display-p3 0 0 0 / 0);
+        --slate-a2: color(display-p3 0.875 0.992 1 / 0.034);
+        --slate-a3: color(display-p3 0.882 0.933 0.992 / 0.077);
+        --slate-a4: color(display-p3 0.882 0.953 0.996 / 0.111);
+        --slate-a5: color(display-p3 0.878 0.929 0.996 / 0.145);
+        --slate-a6: color(display-p3 0.882 0.949 0.996 / 0.183);
+        --slate-a7: color(display-p3 0.882 0.929 1 / 0.246);
+        --slate-a8: color(display-p3 0.871 0.937 1 / 0.361);
+        --slate-a9: color(display-p3 0.898 0.937 1 / 0.42);
+        --slate-a10: color(display-p3 0.918 0.945 1 / 0.475);
+        --slate-a11: color(display-p3 0.949 0.969 0.996 / 0.708);
+        --slate-a12: color(display-p3 0.988 0.992 1 / 0.937);
+        --teal-1: color(display-p3 0.059 0.083 0.079);
+        --teal-2: color(display-p3 0.075 0.11 0.107);
+        --teal-3: color(display-p3 0.087 0.175 0.165);
+        --teal-4: color(display-p3 0.087 0.227 0.214);
+        --teal-5: color(display-p3 0.12 0.277 0.261);
+        --teal-6: color(display-p3 0.162 0.335 0.314);
+        --teal-7: color(display-p3 0.205 0.406 0.379);
+        --teal-8: color(display-p3 0.245 0.489 0.453);
+        --teal-9: color(display-p3 0.297 0.637 0.581);
+        --teal-10: color(display-p3 0.319 0.69 0.62);
+        --teal-11: color(display-p3 0.388 0.835 0.719);
+        --teal-12: color(display-p3 0.734 0.934 0.87);
+        --teal-a1: color(display-p3 0 0.992 0.761 / 0.017);
+        --teal-a2: color(display-p3 0.235 0.988 0.902 / 0.047);
+        --teal-a3: color(display-p3 0.235 1 0.898 / 0.118);
+        --teal-a4: color(display-p3 0.18 0.996 0.929 / 0.173);
+        --teal-a5: color(display-p3 0.31 1 0.933 / 0.227);
+        --teal-a6: color(display-p3 0.396 1 0.933 / 0.286);
+        --teal-a7: color(display-p3 0.443 1 0.925 / 0.366);
+        --teal-a8: color(display-p3 0.459 1 0.925 / 0.454);
+        --teal-a9: color(display-p3 0.443 0.996 0.906 / 0.61);
+        --teal-a10: color(display-p3 0.439 0.996 0.89 / 0.669);
+        --teal-a11: color(display-p3 0.388 0.835 0.719);
+        --teal-a12: color(display-p3 0.734 0.934 0.87);
+        --tomato-1: color(display-p3 0.09 0.068 0.067);
+        --tomato-2: color(display-p3 0.115 0.084 0.076);
+        --tomato-3: color(display-p3 0.205 0.097 0.083);
+        --tomato-4: color(display-p3 0.282 0.099 0.077);
+        --tomato-5: color(display-p3 0.339 0.129 0.101);
+        --tomato-6: color(display-p3 0.398 0.179 0.141);
+        --tomato-7: color(display-p3 0.487 0.245 0.194);
+        --tomato-8: color(display-p3 0.629 0.322 0.248);
+        --tomato-9: color(display-p3 0.831 0.345 0.231);
+        --tomato-10: color(display-p3 0.862 0.415 0.298);
+        --tomato-11: color(display-p3 1 0.585 0.455);
+        --tomato-12: color(display-p3 0.959 0.833 0.802);
+        --tomato-a1: color(display-p3 0.973 0.071 0.071 / 0.026);
+        --tomato-a2: color(display-p3 0.992 0.376 0.224 / 0.051);
+        --tomato-a3: color(display-p3 0.996 0.282 0.176 / 0.148);
+        --tomato-a4: color(display-p3 1 0.204 0.118 / 0.232);
+        --tomato-a5: color(display-p3 1 0.286 0.192 / 0.29);
+        --tomato-a6: color(display-p3 1 0.392 0.278 / 0.353);
+        --tomato-a7: color(display-p3 1 0.459 0.349 / 0.45);
+        --tomato-a8: color(display-p3 1 0.49 0.369 / 0.601);
+        --tomato-a9: color(display-p3 1 0.408 0.267 / 0.82);
+        --tomato-a10: color(display-p3 1 0.478 0.341 / 0.853);
+        --tomato-a11: color(display-p3 1 0.585 0.455);
+        --tomato-a12: color(display-p3 0.959 0.833 0.802);
+        --violet-1: color(display-p3 0.077 0.071 0.118);
+        --violet-2: color(display-p3 0.101 0.084 0.141);
+        --violet-3: color(display-p3 0.154 0.123 0.256);
+        --violet-4: color(display-p3 0.191 0.148 0.345);
+        --violet-5: color(display-p3 0.226 0.182 0.396);
+        --violet-6: color(display-p3 0.269 0.223 0.449);
+        --violet-7: color(display-p3 0.326 0.277 0.53);
+        --violet-8: color(display-p3 0.399 0.346 0.656);
+        --violet-9: color(display-p3 0.417 0.341 0.784);
+        --violet-10: color(display-p3 0.477 0.402 0.823);
+        --violet-11: color(display-p3 0.72 0.65 1);
+        --violet-12: color(display-p3 0.883 0.867 0.986);
+        --violet-a1: color(display-p3 0.282 0.141 0.996 / 0.055);
+        --violet-a2: color(display-p3 0.51 0.263 1 / 0.08);
+        --violet-a3: color(display-p3 0.494 0.337 0.996 / 0.202);
+        --violet-a4: color(display-p3 0.49 0.345 1 / 0.299);
+        --violet-a5: color(display-p3 0.525 0.392 1 / 0.353);
+        --violet-a6: color(display-p3 0.569 0.455 1 / 0.408);
+        --violet-a7: color(display-p3 0.588 0.494 1 / 0.496);
+        --violet-a8: color(display-p3 0.596 0.51 1 / 0.631);
+        --violet-a9: color(display-p3 0.522 0.424 1 / 0.769);
+        --violet-a10: color(display-p3 0.576 0.482 1 / 0.811);
+        --violet-a11: color(display-p3 0.72 0.65 1);
+        --violet-a12: color(display-p3 0.883 0.867 0.986);
+        --yellow-1: color(display-p3 0.078 0.069 0.047);
+        --yellow-2: color(display-p3 0.103 0.094 0.063);
+        --yellow-3: color(display-p3 0.168 0.137 0.039);
+        --yellow-4: color(display-p3 0.209 0.169 0);
+        --yellow-5: color(display-p3 0.255 0.209 0);
+        --yellow-6: color(display-p3 0.31 0.261 0.07);
+        --yellow-7: color(display-p3 0.389 0.331 0.135);
+        --yellow-8: color(display-p3 0.497 0.42 0.182);
+        --yellow-9: color(display-p3 1 0.92 0.22);
+        --yellow-10: color(display-p3 1 1 0.456);
+        --yellow-11: color(display-p3 0.948 0.885 0.392);
+        --yellow-12: color(display-p3 0.959 0.934 0.731);
+        --yellow-a1: color(display-p3 0.973 0.369 0 / 0.013);
+        --yellow-a2: color(display-p3 0.996 0.792 0 / 0.038);
+        --yellow-a3: color(display-p3 0.996 0.71 0 / 0.11);
+        --yellow-a4: color(display-p3 0.996 0.741 0 / 0.152);
+        --yellow-a5: color(display-p3 0.996 0.765 0 / 0.202);
+        --yellow-a6: color(display-p3 0.996 0.816 0.082 / 0.261);
+        --yellow-a7: color(display-p3 1 0.831 0.263 / 0.345);
+        --yellow-a8: color(display-p3 1 0.831 0.314 / 0.463);
+        --yellow-a9: color(display-p3 1 0.922 0.22);
+        --yellow-a10: color(display-p3 1 1 0.455);
+        --yellow-a11: color(display-p3 0.948 0.885 0.392);
+        --yellow-a12: color(display-p3 0.959 0.934 0.731);
+}
+  }
+}
+
+[data-theme="dark"] {
+    --amber-1: #16120c;
+    --amber-2: #1d180f;
+    --amber-3: #302008;
+    --amber-4: #3f2700;
+    --amber-5: #4d3000;
+    --amber-6: #5c3d05;
+    --amber-7: #714f19;
+    --amber-8: #8f6424;
+    --amber-9: #ffc53d;
+    --amber-10: #ffd60a;
+    --amber-11: #ffca16;
+    --amber-12: #ffe7b3;
+    --amber-a1: #e63c0006;
+    --amber-a2: #fd9b000d;
+    --amber-a3: #fa820022;
+    --amber-a4: #fc820032;
+    --amber-a5: #fd8b0041;
+    --amber-a6: #fd9b0051;
+    --amber-a7: #ffab2567;
+    --amber-a8: #ffae3587;
+    --amber-a9: #ffc53d;
+    --amber-a10: #ffd60a;
+    --amber-a11: #ffca16;
+    --amber-a12: #ffe7b3;
+    --blue-1: #0d1520;
+    --blue-2: #111927;
+    --blue-3: #0d2847;
+    --blue-4: #003362;
+    --blue-5: #004074;
+    --blue-6: #104d87;
+    --blue-7: #205d9e;
+    --blue-8: #2870bd;
+    --blue-9: #0090ff;
+    --blue-10: #3b9eff;
+    --blue-11: #70b8ff;
+    --blue-12: #c2e6ff;
+    --blue-a1: #004df211;
+    --blue-a2: #1166fb18;
+    --blue-a3: #0077ff3a;
+    --blue-a4: #0075ff57;
+    --blue-a5: #0081fd6b;
+    --blue-a6: #0f89fd7f;
+    --blue-a7: #2a91fe98;
+    --blue-a8: #3094feb9;
+    --blue-a9: #0090ff;
+    --blue-a10: #3b9eff;
+    --blue-a11: #70b8ff;
+    --blue-a12: #c2e6ff;
+    --bronze-1: #141110;
+    --bronze-2: #1c1917;
+    --bronze-3: #262220;
+    --bronze-4: #302a27;
+    --bronze-5: #3b3330;
+    --bronze-6: #493e3a;
+    --bronze-7: #5a4c47;
+    --bronze-8: #6f5f58;
+    --bronze-9: #a18072;
+    --bronze-10: #ae8c7e;
+    --bronze-11: #d4b3a5;
+    --bronze-12: #ede0d9;
+    --bronze-a1: #d1110004;
+    --bronze-a2: #fbbc910c;
+    --bronze-a3: #faceb817;
+    --bronze-a4: #facdb622;
+    --bronze-a5: #ffd2c12d;
+    --bronze-a6: #ffd1c03c;
+    --bronze-a7: #fdd0c04f;
+    --bronze-a8: #ffd6c565;
+    --bronze-a9: #fec7b09b;
+    --bronze-a10: #fecab5a9;
+    --bronze-a11: #ffd7c6d1;
+    --bronze-a12: #fff1e9ec;
+    --brown-1: #12110f;
+    --brown-2: #1c1816;
+    --brown-3: #28211d;
+    --brown-4: #322922;
+    --brown-5: #3e3128;
+    --brown-6: #4d3c2f;
+    --brown-7: #614a39;
+    --brown-8: #7c5f46;
+    --brown-9: #ad7f58;
+    --brown-10: #b88c67;
+    --brown-11: #dbb594;
+    --brown-12: #f2e1ca;
+    --brown-a1: #91110002;
+    --brown-a2: #fba67c0c;
+    --brown-a3: #fcb58c19;
+    --brown-a4: #fbbb8a24;
+    --brown-a5: #fcb88931;
+    --brown-a6: #fdba8741;
+    --brown-a7: #ffbb8856;
+    --brown-a8: #ffbe8773;
+    --brown-a9: #feb87da8;
+    --brown-a10: #ffc18cb3;
+    --brown-a11: #fed1aad9;
+    --brown-a12: #feecd4f2;
+    --crimson-1: #191114;
+    --crimson-2: #201318;
+    --crimson-3: #381525;
+    --crimson-4: #4d122f;
+    --crimson-5: #5c1839;
+    --crimson-6: #6d2545;
+    --crimson-7: #873356;
+    --crimson-8: #b0436e;
+    --crimson-9: #e93d82;
+    --crimson-10: #ee518a;
+    --crimson-11: #ff92ad;
+    --crimson-12: #fdd3e8;
+    --crimson-a1: #f4126709;
+    --crimson-a2: #f22f7a11;
+    --crimson-a3: #fe2a8b2a;
+    --crimson-a4: #fd158741;
+    --crimson-a5: #fd278f51;
+    --crimson-a6: #fe459763;
+    --crimson-a7: #fd559b7f;
+    --crimson-a8: #fe5b9bab;
+    --crimson-a9: #fe418de8;
+    --crimson-a10: #ff5693ed;
+    --crimson-a11: #ff92ad;
+    --crimson-a12: #ffd5eafd;
+    --cyan-1: #0b161a;
+    --cyan-2: #101b20;
+    --cyan-3: #082c36;
+    --cyan-4: #003848;
+    --cyan-5: #004558;
+    --cyan-6: #045468;
+    --cyan-7: #12677e;
+    --cyan-8: #11809c;
+    --cyan-9: #00a2c7;
+    --cyan-10: #23afd0;
+    --cyan-11: #4ccce6;
+    --cyan-12: #b6ecf7;
+    --cyan-a1: #0091f70a;
+    --cyan-a2: #02a7f211;
+    --cyan-a3: #00befd28;
+    --cyan-a4: #00baff3b;
+    --cyan-a5: #00befd4d;
+    --cyan-a6: #00c7fd5e;
+    --cyan-a7: #14cdff75;
+    --cyan-a8: #11cfff95;
+    --cyan-a9: #00cfffc3;
+    --cyan-a10: #28d6ffcd;
+    --cyan-a11: #52e1fee5;
+    --cyan-a12: #bbf3fef7;
+    --gold-1: #121211;
+    --gold-2: #1b1a17;
+    --gold-3: #24231f;
+    --gold-4: #2d2b26;
+    --gold-5: #38352e;
+    --gold-6: #444039;
+    --gold-7: #544f46;
+    --gold-8: #696256;
+    --gold-9: #978365;
+    --gold-10: #a39073;
+    --gold-11: #cbb99f;
+    --gold-12: #e8e2d9;
+    --gold-a1: #91911102;
+    --gold-a2: #f9e29d0b;
+    --gold-a3: #f8ecbb15;
+    --gold-a4: #ffeec41e;
+    --gold-a5: #feecc22a;
+    --gold-a6: #feebcb37;
+    --gold-a7: #ffedcd48;
+    --gold-a8: #fdeaca5f;
+    --gold-a9: #ffdba690;
+    --gold-a10: #fedfb09d;
+    --gold-a11: #fee7c6c8;
+    --gold-a12: #fef7ede7;
+    --grass-1: #0e1511;
+    --grass-2: #141a15;
+    --grass-3: #1b2a1e;
+    --grass-4: #1d3a24;
+    --grass-5: #25482d;
+    --grass-6: #2d5736;
+    --grass-7: #366740;
+    --grass-8: #3e7949;
+    --grass-9: #46a758;
+    --grass-10: #53b365;
+    --grass-11: #71d083;
+    --grass-12: #c2f0c2;
+    --grass-a1: #00de1205;
+    --grass-a2: #5ef7780a;
+    --grass-a3: #70fe8c1b;
+    --grass-a4: #57ff802c;
+    --grass-a5: #68ff8b3b;
+    --grass-a6: #71ff8f4b;
+    --grass-a7: #77fd925d;
+    --grass-a8: #77fd9070;
+    --grass-a9: #65ff82a1;
+    --grass-a10: #72ff8dae;
+    --grass-a11: #89ff9fcd;
+    --grass-a12: #ceffceef;
+    --gray-1: #111111;
+    --gray-2: #191919;
+    --gray-3: #222222;
+    --gray-4: #2a2a2a;
+    --gray-5: #313131;
+    --gray-6: #3a3a3a;
+    --gray-7: #484848;
+    --gray-8: #606060;
+    --gray-9: #6e6e6e;
+    --gray-10: #7b7b7b;
+    --gray-11: #b4b4b4;
+    --gray-12: #eeeeee;
+    --gray-a1: #00000000;
+    --gray-a2: #ffffff09;
+    --gray-a3: #ffffff12;
+    --gray-a4: #ffffff1b;
+    --gray-a5: #ffffff22;
+    --gray-a6: #ffffff2c;
+    --gray-a7: #ffffff3b;
+    --gray-a8: #ffffff55;
+    --gray-a9: #ffffff64;
+    --gray-a10: #ffffff72;
+    --gray-a11: #ffffffaf;
+    --gray-a12: #ffffffed;
+    --green-1: #0e1512;
+    --green-2: #121b17;
+    --green-3: #132d21;
+    --green-4: #113b29;
+    --green-5: #174933;
+    --green-6: #20573e;
+    --green-7: #28684a;
+    --green-8: #2f7c57;
+    --green-9: #30a46c;
+    --green-10: #33b074;
+    --green-11: #3dd68c;
+    --green-12: #b1f1cb;
+    --green-a1: #00de4505;
+    --green-a2: #29f99d0b;
+    --green-a3: #22ff991e;
+    --green-a4: #11ff992d;
+    --green-a5: #2bffa23c;
+    --green-a6: #44ffaa4b;
+    --green-a7: #50fdac5e;
+    --green-a8: #54ffad73;
+    --green-a9: #44ffa49e;
+    --green-a10: #43fea4ab;
+    --green-a11: #46fea5d4;
+    --green-a12: #bbffd7f0;
+    --indigo-1: #11131f;
+    --indigo-2: #141726;
+    --indigo-3: #182449;
+    --indigo-4: #1d2e62;
+    --indigo-5: #253974;
+    --indigo-6: #304384;
+    --indigo-7: #3a4f97;
+    --indigo-8: #435db1;
+    --indigo-9: #3e63dd;
+    --indigo-10: #5472e4;
+    --indigo-11: #9eb1ff;
+    --indigo-12: #d6e1ff;
+    --indigo-a1: #1133ff0f;
+    --indigo-a2: #3354fa17;
+    --indigo-a3: #2f62ff3c;
+    --indigo-a4: #3566ff57;
+    --indigo-a5: #4171fd6b;
+    --indigo-a6: #5178fd7c;
+    --indigo-a7: #5a7fff90;
+    --indigo-a8: #5b81feac;
+    --indigo-a9: #4671ffdb;
+    --indigo-a10: #5c7efee3;
+    --indigo-a11: #9eb1ff;
+    --indigo-a12: #d6e1ff;
+    --iris-1: #13131e;
+    --iris-2: #171625;
+    --iris-3: #202248;
+    --iris-4: #262a65;
+    --iris-5: #303374;
+    --iris-6: #3d3e82;
+    --iris-7: #4a4a95;
+    --iris-8: #5958b1;
+    --iris-9: #5b5bd6;
+    --iris-10: #6e6ade;
+    --iris-11: #b1a9ff;
+    --iris-12: #e0dffe;
+    --iris-a1: #3636fe0e;
+    --iris-a2: #564bf916;
+    --iris-a3: #525bff3b;
+    --iris-a4: #4d58ff5a;
+    --iris-a5: #5b62fd6b;
+    --iris-a6: #6d6ffd7a;
+    --iris-a7: #7777fe8e;
+    --iris-a8: #7b7afeac;
+    --iris-a9: #6a6afed4;
+    --iris-a10: #7d79ffdc;
+    --iris-a11: #b1a9ff;
+    --iris-a12: #e1e0fffe;
+    --jade-1: #0d1512;
+    --jade-2: #121c18;
+    --jade-3: #0f2e22;
+    --jade-4: #0b3b2c;
+    --jade-5: #114837;
+    --jade-6: #1b5745;
+    --jade-7: #246854;
+    --jade-8: #2a7e68;
+    --jade-9: #29a383;
+    --jade-10: #27b08b;
+    --jade-11: #1fd8a4;
+    --jade-12: #adf0d4;
+    --jade-a1: #00de4505;
+    --jade-a2: #27fba60c;
+    --jade-a3: #02f99920;
+    --jade-a4: #00ffaa2d;
+    --jade-a5: #11ffb63b;
+    --jade-a6: #34ffc24b;
+    --jade-a7: #45fdc75e;
+    --jade-a8: #48ffcf75;
+    --jade-a9: #38feca9d;
+    --jade-a10: #31fec7ab;
+    --jade-a11: #21fec0d6;
+    --jade-a12: #b8ffe1ef;
+    --lime-1: #11130c;
+    --lime-2: #151a10;
+    --lime-3: #1f2917;
+    --lime-4: #29371d;
+    --lime-5: #334423;
+    --lime-6: #3d522a;
+    --lime-7: #496231;
+    --lime-8: #577538;
+    --lime-9: #bdee63;
+    --lime-10: #d4ff70;
+    --lime-11: #bde56c;
+    --lime-12: #e3f7ba;
+    --lime-a1: #11bb0003;
+    --lime-a2: #78f7000a;
+    --lime-a3: #9bfd4c1a;
+    --lime-a4: #a7fe5c29;
+    --lime-a5: #affe6537;
+    --lime-a6: #b2fe6d46;
+    --lime-a7: #b6ff6f57;
+    --lime-a8: #b6fd6d6c;
+    --lime-a9: #caff69ed;
+    --lime-a10: #d4ff70;
+    --lime-a11: #d1fe77e4;
+    --lime-a12: #e9febff7;
+    --mauve-1: #121113;
+    --mauve-2: #1a191b;
+    --mauve-3: #232225;
+    --mauve-4: #2b292d;
+    --mauve-5: #323035;
+    --mauve-6: #3c393f;
+    --mauve-7: #49474e;
+    --mauve-8: #625f69;
+    --mauve-9: #6f6d78;
+    --mauve-10: #7c7a85;
+    --mauve-11: #b5b2bc;
+    --mauve-12: #eeeef0;
+    --mauve-a1: #00000000;
+    --mauve-a2: #f5f4f609;
+    --mauve-a3: #ebeaf814;
+    --mauve-a4: #eee5f81d;
+    --mauve-a5: #efe6fe25;
+    --mauve-a6: #f1e6fd30;
+    --mauve-a7: #eee9ff40;
+    --mauve-a8: #eee7ff5d;
+    --mauve-a9: #eae6fd6e;
+    --mauve-a10: #ece9fd7c;
+    --mauve-a11: #f5f1ffb7;
+    --mauve-a12: #fdfdffef;
+    --mint-1: #0e1515;
+    --mint-2: #0f1b1b;
+    --mint-3: #092c2b;
+    --mint-4: #003a38;
+    --mint-5: #004744;
+    --mint-6: #105650;
+    --mint-7: #1e685f;
+    --mint-8: #277f70;
+    --mint-9: #86ead4;
+    --mint-10: #a8f5e5;
+    --mint-11: #58d5ba;
+    --mint-12: #c4f5e1;
+    --mint-a1: #00dede05;
+    --mint-a2: #00f9f90b;
+    --mint-a3: #00fff61d;
+    --mint-a4: #00fff42c;
+    --mint-a5: #00fff23a;
+    --mint-a6: #0effeb4a;
+    --mint-a7: #34fde55e;
+    --mint-a8: #41ffdf76;
+    --mint-a9: #92ffe7e9;
+    --mint-a10: #aefeedf5;
+    --mint-a11: #67ffded2;
+    --mint-a12: #cbfee9f5;
+    --olive-1: #111210;
+    --olive-2: #181917;
+    --olive-3: #212220;
+    --olive-4: #282a27;
+    --olive-5: #2f312e;
+    --olive-6: #383a36;
+    --olive-7: #454843;
+    --olive-8: #5c625b;
+    --olive-9: #687066;
+    --olive-10: #767d74;
+    --olive-11: #afb5ad;
+    --olive-12: #eceeec;
+    --olive-a1: #00000000;
+    --olive-a2: #f1f2f008;
+    --olive-a3: #f4f5f312;
+    --olive-a4: #f3fef21a;
+    --olive-a5: #f2fbf122;
+    --olive-a6: #f4faed2c;
+    --olive-a7: #f2fced3b;
+    --olive-a8: #edfdeb57;
+    --olive-a9: #ebfde766;
+    --olive-a10: #f0fdec74;
+    --olive-a11: #f6fef4b0;
+    --olive-a12: #fdfffded;
+    --orange-1: #17120e;
+    --orange-2: #1e160f;
+    --orange-3: #331e0b;
+    --orange-4: #462100;
+    --orange-5: #562800;
+    --orange-6: #66350c;
+    --orange-7: #7e451d;
+    --orange-8: #a35829;
+    --orange-9: #f76b15;
+    --orange-10: #ff801f;
+    --orange-11: #ffa057;
+    --orange-12: #ffe0c2;
+    --orange-a1: #ec360007;
+    --orange-a2: #fe6d000e;
+    --orange-a3: #fb6a0025;
+    --orange-a4: #ff590039;
+    --orange-a5: #ff61004a;
+    --orange-a6: #fd75045c;
+    --orange-a7: #ff832c75;
+    --orange-a8: #fe84389d;
+    --orange-a9: #fe6d15f7;
+    --orange-a10: #ff801f;
+    --orange-a11: #ffa057;
+    --orange-a12: #ffe0c2;
+    --pink-1: #191117;
+    --pink-2: #21121d;
+    --pink-3: #37172f;
+    --pink-4: #4b143d;
+    --pink-5: #591c47;
+    --pink-6: #692955;
+    --pink-7: #833869;
+    --pink-8: #a84885;
+    --pink-9: #d6409f;
+    --pink-10: #de51a8;
+    --pink-11: #ff8dcc;
+    --pink-12: #fdd1ea;
+    --pink-a1: #f412bc09;
+    --pink-a2: #f420bb12;
+    --pink-a3: #fe37cc29;
+    --pink-a4: #fc1ec43f;
+    --pink-a5: #fd35c24e;
+    --pink-a6: #fd51c75f;
+    --pink-a7: #fd62c87b;
+    --pink-a8: #ff68c8a2;
+    --pink-a9: #fe49bcd4;
+    --pink-a10: #ff5cc0dc;
+    --pink-a11: #ff8dcc;
+    --pink-a12: #ffd3ecfd;
+    --plum-1: #181118;
+    --plum-2: #201320;
+    --plum-3: #351a35;
+    --plum-4: #451d47;
+    --plum-5: #512454;
+    --plum-6: #5e3061;
+    --plum-7: #734079;
+    --plum-8: #92549c;
+    --plum-9: #ab4aba;
+    --plum-10: #b658c4;
+    --plum-11: #e796f3;
+    --plum-12: #f4d4f4;
+    --plum-a1: #f112f108;
+    --plum-a2: #f22ff211;
+    --plum-a3: #fd4cfd27;
+    --plum-a4: #f646ff3a;
+    --plum-a5: #f455ff48;
+    --plum-a6: #f66dff56;
+    --plum-a7: #f07cfd70;
+    --plum-a8: #ee84ff95;
+    --plum-a9: #e961feb6;
+    --plum-a10: #ed70ffc0;
+    --plum-a11: #f19cfef3;
+    --plum-a12: #feddfef4;
+    --purple-1: #18111b;
+    --purple-2: #1e1523;
+    --purple-3: #301c3b;
+    --purple-4: #3d224e;
+    --purple-5: #48295c;
+    --purple-6: #54346b;
+    --purple-7: #664282;
+    --purple-8: #8457aa;
+    --purple-9: #8e4ec6;
+    --purple-10: #9a5cd0;
+    --purple-11: #d19dff;
+    --purple-12: #ecd9fa;
+    --purple-a1: #b412f90b;
+    --purple-a2: #b744f714;
+    --purple-a3: #c150ff2d;
+    --purple-a4: #bb53fd42;
+    --purple-a5: #be5cfd51;
+    --purple-a6: #c16dfd61;
+    --purple-a7: #c378fd7a;
+    --purple-a8: #c47effa4;
+    --purple-a9: #b661ffc2;
+    --purple-a10: #bc6fffcd;
+    --purple-a11: #d19dff;
+    --purple-a12: #f1ddfffa;
+    --red-1: #191111;
+    --red-2: #201314;
+    --red-3: #3b1219;
+    --red-4: #500f1c;
+    --red-5: #611623;
+    --red-6: #72232d;
+    --red-7: #8c333a;
+    --red-8: #b54548;
+    --red-9: #e5484d;
+    --red-10: #ec5d5e;
+    --red-11: #ff9592;
+    --red-12: #ffd1d9;
+    --red-a1: #f4121209;
+    --red-a2: #f22f3e11;
+    --red-a3: #ff173f2d;
+    --red-a4: #fe0a3b44;
+    --red-a5: #ff204756;
+    --red-a6: #ff3e5668;
+    --red-a7: #ff536184;
+    --red-a8: #ff5d61b0;
+    --red-a9: #fe4e54e4;
+    --red-a10: #ff6465eb;
+    --red-a11: #ff9592;
+    --red-a12: #ffd1d9;
+    --ruby-1: #191113;
+    --ruby-2: #1e1517;
+    --ruby-3: #3a141e;
+    --ruby-4: #4e1325;
+    --ruby-5: #5e1a2e;
+    --ruby-6: #6f2539;
+    --ruby-7: #883447;
+    --ruby-8: #b3445a;
+    --ruby-9: #e54666;
+    --ruby-10: #ec5a72;
+    --ruby-11: #ff949d;
+    --ruby-12: #fed2e1;
+    --ruby-a1: #f4124a09;
+    --ruby-a2: #fe5a7f0e;
+    --ruby-a3: #ff235d2c;
+    --ruby-a4: #fd195e42;
+    --ruby-a5: #fe2d6b53;
+    --ruby-a6: #ff447665;
+    --ruby-a7: #ff577d80;
+    --ruby-a8: #ff5c7cae;
+    --ruby-a9: #fe4c70e4;
+    --ruby-a10: #ff617beb;
+    --ruby-a11: #ff949d;
+    --ruby-a12: #ffd3e2fe;
+    --sage-1: #101211;
+    --sage-2: #171918;
+    --sage-3: #202221;
+    --sage-4: #272a29;
+    --sage-5: #2e3130;
+    --sage-6: #373b39;
+    --sage-7: #444947;
+    --sage-8: #5b625f;
+    --sage-9: #63706b;
+    --sage-10: #717d79;
+    --sage-11: #adb5b2;
+    --sage-12: #eceeed;
+    --sage-a1: #00000000;
+    --sage-a2: #f0f2f108;
+    --sage-a3: #f3f5f412;
+    --sage-a4: #f2fefd1a;
+    --sage-a5: #f1fbfa22;
+    --sage-a6: #edfbf42d;
+    --sage-a7: #edfcf73c;
+    --sage-a8: #ebfdf657;
+    --sage-a9: #dffdf266;
+    --sage-a10: #e5fdf674;
+    --sage-a11: #f4fefbb0;
+    --sage-a12: #fdfffeed;
+    --sand-1: #111110;
+    --sand-2: #191918;
+    --sand-3: #222221;
+    --sand-4: #2a2a28;
+    --sand-5: #31312e;
+    --sand-6: #3b3a37;
+    --sand-7: #494844;
+    --sand-8: #62605b;
+    --sand-9: #6f6d66;
+    --sand-10: #7c7b74;
+    --sand-11: #b5b3ad;
+    --sand-12: #eeeeec;
+    --sand-a1: #00000000;
+    --sand-a2: #f4f4f309;
+    --sand-a3: #f6f6f513;
+    --sand-a4: #fefef31b;
+    --sand-a5: #fbfbeb23;
+    --sand-a6: #fffaed2d;
+    --sand-a7: #fffbed3c;
+    --sand-a8: #fff9eb57;
+    --sand-a9: #fffae965;
+    --sand-a10: #fffdee73;
+    --sand-a11: #fffcf4b0;
+    --sand-a12: #fffffded;
+    --sky-1: #0d141f;
+    --sky-2: #111a27;
+    --sky-3: #112840;
+    --sky-4: #113555;
+    --sky-5: #154467;
+    --sky-6: #1b537b;
+    --sky-7: #1f6692;
+    --sky-8: #197cae;
+    --sky-9: #7ce2fe;
+    --sky-10: #a8eeff;
+    --sky-11: #75c7f0;
+    --sky-12: #c2f3ff;
+    --sky-a1: #0044ff0f;
+    --sky-a2: #1171fb18;
+    --sky-a3: #1184fc33;
+    --sky-a4: #128fff49;
+    --sky-a5: #1c9dfd5d;
+    --sky-a6: #28a5ff72;
+    --sky-a7: #2badfe8b;
+    --sky-a8: #1db2fea9;
+    --sky-a9: #7ce3fffe;
+    --sky-a10: #a8eeff;
+    --sky-a11: #7cd3ffef;
+    --sky-a12: #c2f3ff;
+    --slate-1: #111113;
+    --slate-2: #18191b;
+    --slate-3: #212225;
+    --slate-4: #272a2d;
+    --slate-5: #2e3135;
+    --slate-6: #363a3f;
+    --slate-7: #43484e;
+    --slate-8: #5a6169;
+    --slate-9: #696e77;
+    --slate-10: #777b84;
+    --slate-11: #b0b4ba;
+    --slate-12: #edeef0;
+    --slate-a1: #00000000;
+    --slate-a2: #d8f4f609;
+    --slate-a3: #ddeaf814;
+    --slate-a4: #d3edf81d;
+    --slate-a5: #d9edfe25;
+    --slate-a6: #d6ebfd30;
+    --slate-a7: #d9edff40;
+    --slate-a8: #d9edff5d;
+    --slate-a9: #dfebfd6d;
+    --slate-a10: #e5edfd7b;
+    --slate-a11: #f1f7feb5;
+    --slate-a12: #fcfdffef;
+    --teal-1: #0d1514;
+    --teal-2: #111c1b;
+    --teal-3: #0d2d2a;
+    --teal-4: #023b37;
+    --teal-5: #084843;
+    --teal-6: #145750;
+    --teal-7: #1c6961;
+    --teal-8: #207e73;
+    --teal-9: #12a594;
+    --teal-10: #0eb39e;
+    --teal-11: #0bd8b6;
+    --teal-12: #adf0dd;
+    --teal-a1: #00deab05;
+    --teal-a2: #12fbe60c;
+    --teal-a3: #00ffe61e;
+    --teal-a4: #00ffe92d;
+    --teal-a5: #00ffea3b;
+    --teal-a6: #1cffe84b;
+    --teal-a7: #2efde85f;
+    --teal-a8: #32ffe775;
+    --teal-a9: #13ffe49f;
+    --teal-a10: #0dffe0ae;
+    --teal-a11: #0afed5d6;
+    --teal-a12: #b8ffebef;
+    --tomato-1: #181111;
+    --tomato-2: #1f1513;
+    --tomato-3: #391714;
+    --tomato-4: #4e1511;
+    --tomato-5: #5e1c16;
+    --tomato-6: #6e2920;
+    --tomato-7: #853a2d;
+    --tomato-8: #ac4d39;
+    --tomato-9: #e54d2e;
+    --tomato-10: #ec6142;
+    --tomato-11: #ff977d;
+    --tomato-12: #fbd3cb;
+    --tomato-a1: #f1121208;
+    --tomato-a2: #ff55330f;
+    --tomato-a3: #ff35232b;
+    --tomato-a4: #fd201142;
+    --tomato-a5: #fe332153;
+    --tomato-a6: #ff4f3864;
+    --tomato-a7: #fd644a7d;
+    --tomato-a8: #fe6d4ea7;
+    --tomato-a9: #fe5431e4;
+    --tomato-a10: #ff6847eb;
+    --tomato-a11: #ff977d;
+    --tomato-a12: #ffd6cefb;
+    --violet-1: #14121f;
+    --violet-2: #1b1525;
+    --violet-3: #291f43;
+    --violet-4: #33255b;
+    --violet-5: #3c2e69;
+    --violet-6: #473876;
+    --violet-7: #56468b;
+    --violet-8: #6958ad;
+    --violet-9: #6e56cf;
+    --violet-10: #7d66d9;
+    --violet-11: #baa7ff;
+    --violet-12: #e2ddfe;
+    --violet-a1: #4422ff0f;
+    --violet-a2: #853ff916;
+    --violet-a3: #8354fe36;
+    --violet-a4: #7d51fd50;
+    --violet-a5: #845ffd5f;
+    --violet-a6: #8f6cfd6d;
+    --violet-a7: #9879ff83;
+    --violet-a8: #977dfea8;
+    --violet-a9: #8668ffcc;
+    --violet-a10: #9176fed7;
+    --violet-a11: #baa7ff;
+    --violet-a12: #e3defffe;
+    --yellow-1: #14120b;
+    --yellow-2: #1b180f;
+    --yellow-3: #2d2305;
+    --yellow-4: #362b00;
+    --yellow-5: #433500;
+    --yellow-6: #524202;
+    --yellow-7: #665417;
+    --yellow-8: #836a21;
+    --yellow-9: #ffe629;
+    --yellow-10: #ffff57;
+    --yellow-11: #f5e147;
+    --yellow-12: #f6eeb4;
+    --yellow-a1: #d1510004;
+    --yellow-a2: #f9b4000b;
+    --yellow-a3: #ffaa001e;
+    --yellow-a4: #fdb70028;
+    --yellow-a5: #febb0036;
+    --yellow-a6: #fec40046;
+    --yellow-a7: #fdcb225c;
+    --yellow-a8: #fdca327b;
+    --yellow-a9: #ffe629;
+    --yellow-a10: #ffff57;
+    --yellow-a11: #fee949f5;
+    --yellow-a12: #fef6baf6;
+}
\ No newline at end of file
diff --git a/apps/app/src/styles/tailwind-colors.ts b/apps/app/src/styles/tailwind-colors.ts
new file mode 100644
index 0000000000..3be5ee9fce
--- /dev/null
+++ b/apps/app/src/styles/tailwind-colors.ts
@@ -0,0 +1,814 @@
+export const tailwindSafelist = {
+  pattern:
+        /^(bg|text|border)-(bronze|gold|brown|orange|tomato|red|ruby|crimson|pink|plum|purple|violet|iris|indigo|blue|cyan|teal|jade|green|grass|gray|mauve|slate|sage|olive|sand|sky|mint|lime|yellow|amber)-([1-9]|10|11|12)$/,
+}
+
+// Radix UI Colors
+export const radixColors = {
+  bronze: {
+    1: 'var(--bronze-1)',
+    2: 'var(--bronze-2)',
+    3: 'var(--bronze-3)',
+    4: 'var(--bronze-4)',
+    5: 'var(--bronze-5)',
+    6: 'var(--bronze-6)',
+    7: 'var(--bronze-7)',
+    8: 'var(--bronze-8)',
+    9: 'var(--bronze-9)',
+    10: 'var(--bronze-10)',
+    11: 'var(--bronze-11)',
+    12: 'var(--bronze-12)',
+    a1: 'var(--bronze-a1)',
+    a2: 'var(--bronze-a2)',
+    a3: 'var(--bronze-a3)',
+    a4: 'var(--bronze-a4)',
+    a5: 'var(--bronze-a5)',
+    a6: 'var(--bronze-a6)',
+    a7: 'var(--bronze-a7)',
+    a8: 'var(--bronze-a8)',
+    a9: 'var(--bronze-a9)',
+    a10: 'var(--bronze-a10)',
+    a11: 'var(--bronze-a11)',
+    a12: 'var(--bronze-a12)',
+  },
+  gold: {
+    1: 'var(--gold-1)',
+    2: 'var(--gold-2)',
+    3: 'var(--gold-3)',
+    4: 'var(--gold-4)',
+    5: 'var(--gold-5)',
+    6: 'var(--gold-6)',
+    7: 'var(--gold-7)',
+    8: 'var(--gold-8)',
+    9: 'var(--gold-9)',
+    10: 'var(--gold-10)',
+    11: 'var(--gold-11)',
+    12: 'var(--gold-12)',
+    a1: 'var(--gold-a1)',
+    a2: 'var(--gold-a2)',
+    a3: 'var(--gold-a3)',
+    a4: 'var(--gold-a4)',
+    a5: 'var(--gold-a5)',
+    a6: 'var(--gold-a6)',
+    a7: 'var(--gold-a7)',
+    a8: 'var(--gold-a8)',
+    a9: 'var(--gold-a9)',
+    a10: 'var(--gold-a10)',
+    a11: 'var(--gold-a11)',
+    a12: 'var(--gold-a12)',
+  },
+  brown: {
+    1: 'var(--brown-1)',
+    2: 'var(--brown-2)',
+    3: 'var(--brown-3)',
+    4: 'var(--brown-4)',
+    5: 'var(--brown-5)',
+    6: 'var(--brown-6)',
+    7: 'var(--brown-7)',
+    8: 'var(--brown-8)',
+    9: 'var(--brown-9)',
+    10: 'var(--brown-10)',
+    11: 'var(--brown-11)',
+    12: 'var(--brown-12)',
+    a1: 'var(--brown-a1)',
+    a2: 'var(--brown-a2)',
+    a3: 'var(--brown-a3)',
+    a4: 'var(--brown-a4)',
+    a5: 'var(--brown-a5)',
+    a6: 'var(--brown-a6)',
+    a7: 'var(--brown-a7)',
+    a8: 'var(--brown-a8)',
+    a9: 'var(--brown-a9)',
+    a10: 'var(--brown-a10)',
+    a11: 'var(--brown-a11)',
+    a12: 'var(--brown-a12)',
+  },
+  orange: {
+    1: 'var(--orange-1)',
+    2: 'var(--orange-2)',
+    3: 'var(--orange-3)',
+    4: 'var(--orange-4)',
+    5: 'var(--orange-5)',
+    6: 'var(--orange-6)',
+    7: 'var(--orange-7)',
+    8: 'var(--orange-8)',
+    9: 'var(--orange-9)',
+    10: 'var(--orange-10)',
+    11: 'var(--orange-11)',
+    12: 'var(--orange-12)',
+    a1: 'var(--orange-a1)',
+    a2: 'var(--orange-a2)',
+    a3: 'var(--orange-a3)',
+    a4: 'var(--orange-a4)',
+    a5: 'var(--orange-a5)',
+    a6: 'var(--orange-a6)',
+    a7: 'var(--orange-a7)',
+    a8: 'var(--orange-a8)',
+    a9: 'var(--orange-a9)',
+    a10: 'var(--orange-a10)',
+    a11: 'var(--orange-a11)',
+    a12: 'var(--orange-a12)',
+  },
+  tomato: {
+    1: 'var(--tomato-1)',
+    2: 'var(--tomato-2)',
+    3: 'var(--tomato-3)',
+    4: 'var(--tomato-4)',
+    5: 'var(--tomato-5)',
+    6: 'var(--tomato-6)',
+    7: 'var(--tomato-7)',
+    8: 'var(--tomato-8)',
+    9: 'var(--tomato-9)',
+    10: 'var(--tomato-10)',
+    11: 'var(--tomato-11)',
+    12: 'var(--tomato-12)',
+    a1: 'var(--tomato-a1)',
+    a2: 'var(--tomato-a2)',
+    a3: 'var(--tomato-a3)',
+    a4: 'var(--tomato-a4)',
+    a5: 'var(--tomato-a5)',
+    a6: 'var(--tomato-a6)',
+    a7: 'var(--tomato-a7)',
+    a8: 'var(--tomato-a8)',
+    a9: 'var(--tomato-a9)',
+    a10: 'var(--tomato-a10)',
+    a11: 'var(--tomato-a11)',
+    a12: 'var(--tomato-a12)',
+  },
+  red: {
+    1: 'var(--red-1)',
+    2: 'var(--red-2)',
+    3: 'var(--red-3)',
+    4: 'var(--red-4)',
+    5: 'var(--red-5)',
+    6: 'var(--red-6)',
+    7: 'var(--red-7)',
+    8: 'var(--red-8)',
+    9: 'var(--red-9)',
+    10: 'var(--red-10)',
+    11: 'var(--red-11)',
+    12: 'var(--red-12)',
+    a1: 'var(--red-a1)',
+    a2: 'var(--red-a2)',
+    a3: 'var(--red-a3)',
+    a4: 'var(--red-a4)',
+    a5: 'var(--red-a5)',
+    a6: 'var(--red-a6)',
+    a7: 'var(--red-a7)',
+    a8: 'var(--red-a8)',
+    a9: 'var(--red-a9)',
+    a10: 'var(--red-a10)',
+    a11: 'var(--red-a11)',
+    a12: 'var(--red-a12)',
+  },
+  ruby: {
+    1: 'var(--ruby-1)',
+    2: 'var(--ruby-2)',
+    3: 'var(--ruby-3)',
+    4: 'var(--ruby-4)',
+    5: 'var(--ruby-5)',
+    6: 'var(--ruby-6)',
+    7: 'var(--ruby-7)',
+    8: 'var(--ruby-8)',
+    9: 'var(--ruby-9)',
+    10: 'var(--ruby-10)',
+    11: 'var(--ruby-11)',
+    12: 'var(--ruby-12)',
+    a1: 'var(--ruby-a1)',
+    a2: 'var(--ruby-a2)',
+    a3: 'var(--ruby-a3)',
+    a4: 'var(--ruby-a4)',
+    a5: 'var(--ruby-a5)',
+    a6: 'var(--ruby-a6)',
+    a7: 'var(--ruby-a7)',
+    a8: 'var(--ruby-a8)',
+    a9: 'var(--ruby-a9)',
+    a10: 'var(--ruby-a10)',
+    a11: 'var(--ruby-a11)',
+    a12: 'var(--ruby-a12)',
+  },
+  crimson: {
+    1: 'var(--crimson-1)',
+    2: 'var(--crimson-2)',
+    3: 'var(--crimson-3)',
+    4: 'var(--crimson-4)',
+    5: 'var(--crimson-5)',
+    6: 'var(--crimson-6)',
+    7: 'var(--crimson-7)',
+    8: 'var(--crimson-8)',
+    9: 'var(--crimson-9)',
+    10: 'var(--crimson-10)',
+    11: 'var(--crimson-11)',
+    12: 'var(--crimson-12)',
+    a1: 'var(--crimson-a1)',
+    a2: 'var(--crimson-a2)',
+    a3: 'var(--crimson-a3)',
+    a4: 'var(--crimson-a4)',
+    a5: 'var(--crimson-a5)',
+    a6: 'var(--crimson-a6)',
+    a7: 'var(--crimson-a7)',
+    a8: 'var(--crimson-a8)',
+    a9: 'var(--crimson-a9)',
+    a10: 'var(--crimson-a10)',
+    a11: 'var(--crimson-a11)',
+    a12: 'var(--crimson-a12)',
+  },
+  pink: {
+    1: 'var(--pink-1)',
+    2: 'var(--pink-2)',
+    3: 'var(--pink-3)',
+    4: 'var(--pink-4)',
+    5: 'var(--pink-5)',
+    6: 'var(--pink-6)',
+    7: 'var(--pink-7)',
+    8: 'var(--pink-8)',
+    9: 'var(--pink-9)',
+    10: 'var(--pink-10)',
+    11: 'var(--pink-11)',
+    12: 'var(--pink-12)',
+    a1: 'var(--pink-a1)',
+    a2: 'var(--pink-a2)',
+    a3: 'var(--pink-a3)',
+    a4: 'var(--pink-a4)',
+    a5: 'var(--pink-a5)',
+    a6: 'var(--pink-a6)',
+    a7: 'var(--pink-a7)',
+    a8: 'var(--pink-a8)',
+    a9: 'var(--pink-a9)',
+    a10: 'var(--pink-a10)',
+    a11: 'var(--pink-a11)',
+    a12: 'var(--pink-a12)',
+  },
+  plum: {
+    1: 'var(--plum-1)',
+    2: 'var(--plum-2)',
+    3: 'var(--plum-3)',
+    4: 'var(--plum-4)',
+    5: 'var(--plum-5)',
+    6: 'var(--plum-6)',
+    7: 'var(--plum-7)',
+    8: 'var(--plum-8)',
+    9: 'var(--plum-9)',
+    10: 'var(--plum-10)',
+    11: 'var(--plum-11)',
+    12: 'var(--plum-12)',
+    a1: 'var(--plum-a1)',
+    a2: 'var(--plum-a2)',
+    a3: 'var(--plum-a3)',
+    a4: 'var(--plum-a4)',
+    a5: 'var(--plum-a5)',
+    a6: 'var(--plum-a6)',
+    a7: 'var(--plum-a7)',
+    a8: 'var(--plum-a8)',
+    a9: 'var(--plum-a9)',
+    a10: 'var(--plum-a10)',
+    a11: 'var(--plum-a11)',
+    a12: 'var(--plum-a12)',
+  },
+  purple: {
+    1: 'var(--purple-1)',
+    2: 'var(--purple-2)',
+    3: 'var(--purple-3)',
+    4: 'var(--purple-4)',
+    5: 'var(--purple-5)',
+    6: 'var(--purple-6)',
+    7: 'var(--purple-7)',
+    8: 'var(--purple-8)',
+    9: 'var(--purple-9)',
+    10: 'var(--purple-10)',
+    11: 'var(--purple-11)',
+    12: 'var(--purple-12)',
+    a1: 'var(--purple-a1)',
+    a2: 'var(--purple-a2)',
+    a3: 'var(--purple-a3)',
+    a4: 'var(--purple-a4)',
+    a5: 'var(--purple-a5)',
+    a6: 'var(--purple-a6)',
+    a7: 'var(--purple-a7)',
+    a8: 'var(--purple-a8)',
+    a9: 'var(--purple-a9)',
+    a10: 'var(--purple-a10)',
+    a11: 'var(--purple-a11)',
+    a12: 'var(--purple-a12)',
+  },
+  violet: {
+    1: 'var(--violet-1)',
+    2: 'var(--violet-2)',
+    3: 'var(--violet-3)',
+    4: 'var(--violet-4)',
+    5: 'var(--violet-5)',
+    6: 'var(--violet-6)',
+    7: 'var(--violet-7)',
+    8: 'var(--violet-8)',
+    9: 'var(--violet-9)',
+    10: 'var(--violet-10)',
+    11: 'var(--violet-11)',
+    12: 'var(--violet-12)',
+    a1: 'var(--violet-a1)',
+    a2: 'var(--violet-a2)',
+    a3: 'var(--violet-a3)',
+    a4: 'var(--violet-a4)',
+    a5: 'var(--violet-a5)',
+    a6: 'var(--violet-a6)',
+    a7: 'var(--violet-a7)',
+    a8: 'var(--violet-a8)',
+    a9: 'var(--violet-a9)',
+    a10: 'var(--violet-a10)',
+    a11: 'var(--violet-a11)',
+    a12: 'var(--violet-a12)',
+  },
+  iris: {
+    1: 'var(--iris-1)',
+    2: 'var(--iris-2)',
+    3: 'var(--iris-3)',
+    4: 'var(--iris-4)',
+    5: 'var(--iris-5)',
+    6: 'var(--iris-6)',
+    7: 'var(--iris-7)',
+    8: 'var(--iris-8)',
+    9: 'var(--iris-9)',
+    10: 'var(--iris-10)',
+    11: 'var(--iris-11)',
+    12: 'var(--iris-12)',
+    a1: 'var(--iris-a1)',
+    a2: 'var(--iris-a2)',
+    a3: 'var(--iris-a3)',
+    a4: 'var(--iris-a4)',
+    a5: 'var(--iris-a5)',
+    a6: 'var(--iris-a6)',
+    a7: 'var(--iris-a7)',
+    a8: 'var(--iris-a8)',
+    a9: 'var(--iris-a9)',
+    a10: 'var(--iris-a10)',
+    a11: 'var(--iris-a11)',
+    a12: 'var(--iris-a12)',
+  },
+  indigo: {
+    1: 'var(--indigo-1)',
+    2: 'var(--indigo-2)',
+    3: 'var(--indigo-3)',
+    4: 'var(--indigo-4)',
+    5: 'var(--indigo-5)',
+    6: 'var(--indigo-6)',
+    7: 'var(--indigo-7)',
+    8: 'var(--indigo-8)',
+    9: 'var(--indigo-9)',
+    10: 'var(--indigo-10)',
+    11: 'var(--indigo-11)',
+    12: 'var(--indigo-12)',
+    a1: 'var(--indigo-a1)',
+    a2: 'var(--indigo-a2)',
+    a3: 'var(--indigo-a3)',
+    a4: 'var(--indigo-a4)',
+    a5: 'var(--indigo-a5)',
+    a6: 'var(--indigo-a6)',
+    a7: 'var(--indigo-a7)',
+    a8: 'var(--indigo-a8)',
+    a9: 'var(--indigo-a9)',
+    a10: 'var(--indigo-a10)',
+    a11: 'var(--indigo-a11)',
+    a12: 'var(--indigo-a12)',
+  },
+  blue: {
+    1: 'var(--blue-1)',
+    2: 'var(--blue-2)',
+    3: 'var(--blue-3)',
+    4: 'var(--blue-4)',
+    5: 'var(--blue-5)',
+    6: 'var(--blue-6)',
+    7: 'var(--blue-7)',
+    8: 'var(--blue-8)',
+    9: 'var(--blue-9)',
+    10: 'var(--blue-10)',
+    11: 'var(--blue-11)',
+    12: 'var(--blue-12)',
+    a1: 'var(--blue-a1)',
+    a2: 'var(--blue-a2)',
+    a3: 'var(--blue-a3)',
+    a4: 'var(--blue-a4)',
+    a5: 'var(--blue-a5)',
+    a6: 'var(--blue-a6)',
+    a7: 'var(--blue-a7)',
+    a8: 'var(--blue-a8)',
+    a9: 'var(--blue-a9)',
+    a10: 'var(--blue-a10)',
+    a11: 'var(--blue-a11)',
+    a12: 'var(--blue-a12)',
+  },
+  cyan: {
+    1: 'var(--cyan-1)',
+    2: 'var(--cyan-2)',
+    3: 'var(--cyan-3)',
+    4: 'var(--cyan-4)',
+    5: 'var(--cyan-5)',
+    6: 'var(--cyan-6)',
+    7: 'var(--cyan-7)',
+    8: 'var(--cyan-8)',
+    9: 'var(--cyan-9)',
+    10: 'var(--cyan-10)',
+    11: 'var(--cyan-11)',
+    12: 'var(--cyan-12)',
+    a1: 'var(--cyan-a1)',
+    a2: 'var(--cyan-a2)',
+    a3: 'var(--cyan-a3)',
+    a4: 'var(--cyan-a4)',
+    a5: 'var(--cyan-a5)',
+    a6: 'var(--cyan-a6)',
+    a7: 'var(--cyan-a7)',
+    a8: 'var(--cyan-a8)',
+    a9: 'var(--cyan-a9)',
+    a10: 'var(--cyan-a10)',
+    a11: 'var(--cyan-a11)',
+    a12: 'var(--cyan-a12)',
+  },
+  teal: {
+    1: 'var(--teal-1)',
+    2: 'var(--teal-2)',
+    3: 'var(--teal-3)',
+    4: 'var(--teal-4)',
+    5: 'var(--teal-5)',
+    6: 'var(--teal-6)',
+    7: 'var(--teal-7)',
+    8: 'var(--teal-8)',
+    9: 'var(--teal-9)',
+    10: 'var(--teal-10)',
+    11: 'var(--teal-11)',
+    12: 'var(--teal-12)',
+    a1: 'var(--teal-a1)',
+    a2: 'var(--teal-a2)',
+    a3: 'var(--teal-a3)',
+    a4: 'var(--teal-a4)',
+    a5: 'var(--teal-a5)',
+    a6: 'var(--teal-a6)',
+    a7: 'var(--teal-a7)',
+    a8: 'var(--teal-a8)',
+    a9: 'var(--teal-a9)',
+    a10: 'var(--teal-a10)',
+    a11: 'var(--teal-a11)',
+    a12: 'var(--teal-a12)',
+  },
+  jade: {
+    1: 'var(--jade-1)',
+    2: 'var(--jade-2)',
+    3: 'var(--jade-3)',
+    4: 'var(--jade-4)',
+    5: 'var(--jade-5)',
+    6: 'var(--jade-6)',
+    7: 'var(--jade-7)',
+    8: 'var(--jade-8)',
+    9: 'var(--jade-9)',
+    10: 'var(--jade-10)',
+    11: 'var(--jade-11)',
+    12: 'var(--jade-12)',
+    a1: 'var(--jade-a1)',
+    a2: 'var(--jade-a2)',
+    a3: 'var(--jade-a3)',
+    a4: 'var(--jade-a4)',
+    a5: 'var(--jade-a5)',
+    a6: 'var(--jade-a6)',
+    a7: 'var(--jade-a7)',
+    a8: 'var(--jade-a8)',
+    a9: 'var(--jade-a9)',
+    a10: 'var(--jade-a10)',
+    a11: 'var(--jade-a11)',
+    a12: 'var(--jade-a12)',
+  },
+  green: {
+    1: 'var(--green-1)',
+    2: 'var(--green-2)',
+    3: 'var(--green-3)',
+    4: 'var(--green-4)',
+    5: 'var(--green-5)',
+    6: 'var(--green-6)',
+    7: 'var(--green-7)',
+    8: 'var(--green-8)',
+    9: 'var(--green-9)',
+    10: 'var(--green-10)',
+    11: 'var(--green-11)',
+    12: 'var(--green-12)',
+    a1: 'var(--green-a1)',
+    a2: 'var(--green-a2)',
+    a3: 'var(--green-a3)',
+    a4: 'var(--green-a4)',
+    a5: 'var(--green-a5)',
+    a6: 'var(--green-a6)',
+    a7: 'var(--green-a7)',
+    a8: 'var(--green-a8)',
+    a9: 'var(--green-a9)',
+    a10: 'var(--green-a10)',
+    a11: 'var(--green-a11)',
+    a12: 'var(--green-a12)',
+  },
+  grass: {
+    1: 'var(--grass-1)',
+    2: 'var(--grass-2)',
+    3: 'var(--grass-3)',
+    4: 'var(--grass-4)',
+    5: 'var(--grass-5)',
+    6: 'var(--grass-6)',
+    7: 'var(--grass-7)',
+    8: 'var(--grass-8)',
+    9: 'var(--grass-9)',
+    10: 'var(--grass-10)',
+    11: 'var(--grass-11)',
+    12: 'var(--grass-12)',
+    a1: 'var(--grass-a1)',
+    a2: 'var(--grass-a2)',
+    a3: 'var(--grass-a3)',
+    a4: 'var(--grass-a4)',
+    a5: 'var(--grass-a5)',
+    a6: 'var(--grass-a6)',
+    a7: 'var(--grass-a7)',
+    a8: 'var(--grass-a8)',
+    a9: 'var(--grass-a9)',
+    a10: 'var(--grass-a10)',
+    a11: 'var(--grass-a11)',
+    a12: 'var(--grass-a12)',
+  },
+  sky: {
+    1: 'var(--sky-1)',
+    2: 'var(--sky-2)',
+    3: 'var(--sky-3)',
+    4: 'var(--sky-4)',
+    5: 'var(--sky-5)',
+    6: 'var(--sky-6)',
+    7: 'var(--sky-7)',
+    8: 'var(--sky-8)',
+    9: 'var(--sky-9)',
+    10: 'var(--sky-10)',
+    11: 'var(--sky-11)',
+    12: 'var(--sky-12)',
+    a1: 'var(--sky-a1)',
+    a2: 'var(--sky-a2)',
+    a3: 'var(--sky-a3)',
+    a4: 'var(--sky-a4)',
+    a5: 'var(--sky-a5)',
+    a6: 'var(--sky-a6)',
+    a7: 'var(--sky-a7)',
+    a8: 'var(--sky-a8)',
+    a9: 'var(--sky-a9)',
+    a10: 'var(--sky-a10)',
+    a11: 'var(--sky-a11)',
+    a12: 'var(--sky-a12)',
+  },
+  mint: {
+    1: 'var(--mint-1)',
+    2: 'var(--mint-2)',
+    3: 'var(--mint-3)',
+    4: 'var(--mint-4)',
+    5: 'var(--mint-5)',
+    6: 'var(--mint-6)',
+    7: 'var(--mint-7)',
+    8: 'var(--mint-8)',
+    9: 'var(--mint-9)',
+    10: 'var(--mint-10)',
+    11: 'var(--mint-11)',
+    12: 'var(--mint-12)',
+    a1: 'var(--mint-a1)',
+    a2: 'var(--mint-a2)',
+    a3: 'var(--mint-a3)',
+    a4: 'var(--mint-a4)',
+    a5: 'var(--mint-a5)',
+    a6: 'var(--mint-a6)',
+    a7: 'var(--mint-a7)',
+    a8: 'var(--mint-a8)',
+    a9: 'var(--mint-a9)',
+    a10: 'var(--mint-a10)',
+    a11: 'var(--mint-a11)',
+    a12: 'var(--mint-a12)',
+  },
+  lime: {
+    1: 'var(--lime-1)',
+    2: 'var(--lime-2)',
+    3: 'var(--lime-3)',
+    4: 'var(--lime-4)',
+    5: 'var(--lime-5)',
+    6: 'var(--lime-6)',
+    7: 'var(--lime-7)',
+    8: 'var(--lime-8)',
+    9: 'var(--lime-9)',
+    10: 'var(--lime-10)',
+    11: 'var(--lime-11)',
+    12: 'var(--lime-12)',
+    a1: 'var(--lime-a1)',
+    a2: 'var(--lime-a2)',
+    a3: 'var(--lime-a3)',
+    a4: 'var(--lime-a4)',
+    a5: 'var(--lime-a5)',
+    a6: 'var(--lime-a6)',
+    a7: 'var(--lime-a7)',
+    a8: 'var(--lime-a8)',
+    a9: 'var(--lime-a9)',
+    a10: 'var(--lime-a10)',
+    a11: 'var(--lime-a11)',
+    a12: 'var(--lime-a12)',
+  },
+  yellow: {
+    1: 'var(--yellow-1)',
+    2: 'var(--yellow-2)',
+    3: 'var(--yellow-3)',
+    4: 'var(--yellow-4)',
+    5: 'var(--yellow-5)',
+    6: 'var(--yellow-6)',
+    7: 'var(--yellow-7)',
+    8: 'var(--yellow-8)',
+    9: 'var(--yellow-9)',
+    10: 'var(--yellow-10)',
+    11: 'var(--yellow-11)',
+    12: 'var(--yellow-12)',
+    a1: 'var(--yellow-a1)',
+    a2: 'var(--yellow-a2)',
+    a3: 'var(--yellow-a3)',
+    a4: 'var(--yellow-a4)',
+    a5: 'var(--yellow-a5)',
+    a6: 'var(--yellow-a6)',
+    a7: 'var(--yellow-a7)',
+    a8: 'var(--yellow-a8)',
+    a9: 'var(--yellow-a9)',
+    a10: 'var(--yellow-a10)',
+    a11: 'var(--yellow-a11)',
+    a12: 'var(--yellow-a12)',
+  },
+  amber: {
+    1: 'var(--amber-1)',
+    2: 'var(--amber-2)',
+    3: 'var(--amber-3)',
+    4: 'var(--amber-4)',
+    5: 'var(--amber-5)',
+    6: 'var(--amber-6)',
+    7: 'var(--amber-7)',
+    8: 'var(--amber-8)',
+    9: 'var(--amber-9)',
+    10: 'var(--amber-10)',
+    11: 'var(--amber-11)',
+    12: 'var(--amber-12)',
+    a1: 'var(--amber-a1)',
+    a2: 'var(--amber-a2)',
+    a3: 'var(--amber-a3)',
+    a4: 'var(--amber-a4)',
+    a5: 'var(--amber-a5)',
+    a6: 'var(--amber-a6)',
+    a7: 'var(--amber-a7)',
+    a8: 'var(--amber-a8)',
+    a9: 'var(--amber-a9)',
+    a10: 'var(--amber-a10)',
+    a11: 'var(--amber-a11)',
+    a12: 'var(--amber-a12)',
+  },
+  gray: {
+    1: 'var(--gray-1)',
+    2: 'var(--gray-2)',
+    3: 'var(--gray-3)',
+    4: 'var(--gray-4)',
+    5: 'var(--gray-5)',
+    6: 'var(--gray-6)',
+    7: 'var(--gray-7)',
+    8: 'var(--gray-8)',
+    9: 'var(--gray-9)',
+    10: 'var(--gray-10)',
+    11: 'var(--gray-11)',
+    12: 'var(--gray-12)',
+    a1: 'var(--gray-a1)',
+    a2: 'var(--gray-a2)',
+    a3: 'var(--gray-a3)',
+    a4: 'var(--gray-a4)',
+    a5: 'var(--gray-a5)',
+    a6: 'var(--gray-a6)',
+    a7: 'var(--gray-a7)',
+    a8: 'var(--gray-a8)',
+    a9: 'var(--gray-a9)',
+    a10: 'var(--gray-a10)',
+    a11: 'var(--gray-a11)',
+    a12: 'var(--gray-a12)',
+  },
+  mauve: {
+    1: 'var(--mauve-1)',
+    2: 'var(--mauve-2)',
+    3: 'var(--mauve-3)',
+    4: 'var(--mauve-4)',
+    5: 'var(--mauve-5)',
+    6: 'var(--mauve-6)',
+    7: 'var(--mauve-7)',
+    8: 'var(--mauve-8)',
+    9: 'var(--mauve-9)',
+    10: 'var(--mauve-10)',
+    11: 'var(--mauve-11)',
+    12: 'var(--mauve-12)',
+    a1: 'var(--mauve-a1)',
+    a2: 'var(--mauve-a2)',
+    a3: 'var(--mauve-a3)',
+    a4: 'var(--mauve-a4)',
+    a5: 'var(--mauve-a5)',
+    a6: 'var(--mauve-a6)',
+    a7: 'var(--mauve-a7)',
+    a8: 'var(--mauve-a8)',
+    a9: 'var(--mauve-a9)',
+    a10: 'var(--mauve-a10)',
+    a11: 'var(--mauve-a11)',
+    a12: 'var(--mauve-a12)',
+  },
+  slate: {
+    1: 'var(--slate-1)',
+    2: 'var(--slate-2)',
+    3: 'var(--slate-3)',
+    4: 'var(--slate-4)',
+    5: 'var(--slate-5)',
+    6: 'var(--slate-6)',
+    7: 'var(--slate-7)',
+    8: 'var(--slate-8)',
+    9: 'var(--slate-9)',
+    10: 'var(--slate-10)',
+    11: 'var(--slate-11)',
+    12: 'var(--slate-12)',
+    a1: 'var(--slate-a1)',
+    a2: 'var(--slate-a2)',
+    a3: 'var(--slate-a3)',
+    a4: 'var(--slate-a4)',
+    a5: 'var(--slate-a5)',
+    a6: 'var(--slate-a6)',
+    a7: 'var(--slate-a7)',
+    a8: 'var(--slate-a8)',
+    a9: 'var(--slate-a9)',
+    a10: 'var(--slate-a10)',
+    a11: 'var(--slate-a11)',
+    a12: 'var(--slate-a12)',
+  },
+  sage: {
+    1: 'var(--sage-1)',
+    2: 'var(--sage-2)',
+    3: 'var(--sage-3)',
+    4: 'var(--sage-4)',
+    5: 'var(--sage-5)',
+    6: 'var(--sage-6)',
+    7: 'var(--sage-7)',
+    8: 'var(--sage-8)',
+    9: 'var(--sage-9)',
+    10: 'var(--sage-10)',
+    11: 'var(--sage-11)',
+    12: 'var(--sage-12)',
+    a1: 'var(--sage-a1)',
+    a2: 'var(--sage-a2)',
+    a3: 'var(--sage-a3)',
+    a4: 'var(--sage-a4)',
+    a5: 'var(--sage-a5)',
+    a6: 'var(--sage-a6)',
+    a7: 'var(--sage-a7)',
+    a8: 'var(--sage-a8)',
+    a9: 'var(--sage-a9)',
+    a10: 'var(--sage-a10)',
+    a11: 'var(--sage-a11)',
+    a12: 'var(--sage-a12)',
+  },
+  olive: {
+    1: 'var(--olive-1)',
+    2: 'var(--olive-2)',
+    3: 'var(--olive-3)',
+    4: 'var(--olive-4)',
+    5: 'var(--olive-5)',
+    6: 'var(--olive-6)',
+    7: 'var(--olive-7)',
+    8: 'var(--olive-8)',
+    9: 'var(--olive-9)',
+    10: 'var(--olive-10)',
+    11: 'var(--olive-11)',
+    12: 'var(--olive-12)',
+    a1: 'var(--olive-a1)',
+    a2: 'var(--olive-a2)',
+    a3: 'var(--olive-a3)',
+    a4: 'var(--olive-a4)',
+    a5: 'var(--olive-a5)',
+    a6: 'var(--olive-a6)',
+    a7: 'var(--olive-a7)',
+    a8: 'var(--olive-a8)',
+    a9: 'var(--olive-a9)',
+    a10: 'var(--olive-a10)',
+    a11: 'var(--olive-a11)',
+    a12: 'var(--olive-a12)',
+  },
+  sand: {
+    1: 'var(--sand-1)',
+    2: 'var(--sand-2)',
+    3: 'var(--sand-3)',
+    4: 'var(--sand-4)',
+    5: 'var(--sand-5)',
+    6: 'var(--sand-6)',
+    7: 'var(--sand-7)',
+    8: 'var(--sand-8)',
+    9: 'var(--sand-9)',
+    10: 'var(--sand-10)',
+    11: 'var(--sand-11)',
+    12: 'var(--sand-12)',
+    a1: 'var(--sand-a1)',
+    a2: 'var(--sand-a2)',
+    a3: 'var(--sand-a3)',
+    a4: 'var(--sand-a4)',
+    a5: 'var(--sand-a5)',
+    a6: 'var(--sand-a6)',
+    a7: 'var(--sand-a7)',
+    a8: 'var(--sand-a8)',
+    a9: 'var(--sand-a9)',
+    a10: 'var(--sand-a10)',
+    a11: 'var(--sand-a11)',
+    a12: 'var(--sand-a12)',
+  },
+}
\ No newline at end of file
diff --git a/apps/app/tailwind.config.ts b/apps/app/tailwind.config.ts
new file mode 100644
index 0000000000..69116bbe7b
--- /dev/null
+++ b/apps/app/tailwind.config.ts
@@ -0,0 +1,29 @@
+import { radixColors, tailwindSafelist } from './src/styles/tailwind-colors';
+export default {
+  content: ["./index.html", "./src/**/*.{ts,tsx}"],
+darkMode: 'class',
+safelist: [
+    tailwindSafelist
+  ],
+  theme: {
+    // OVERRIDE the base theme completely instead of extending it
+    colors: {
+      ...radixColors,
+      dls: {
+        surface: "var(--dls-surface)",
+        background: "var(--dls-background)",
+        canvas: "var(--dls-canvas)",
+        "surface-muted": "var(--dls-surface-muted)",
+        sidebar: "var(--dls-sidebar)",
+        border: "var(--dls-border)",
+        accent: "var(--dls-accent)",
+        text: "var(--dls-text-primary)",
+        secondary: "var(--dls-text-secondary)",
+        hover: "var(--dls-hover)",
+        active: "var(--dls-active)",
+      },
+      white: "#ffffff",
+      black: "#000000",
+    }
+  }
+};
diff --git a/apps/app/tests/env-context.test.ts b/apps/app/tests/env-context.test.ts
new file mode 100644
index 0000000000..1c5cc26015
--- /dev/null
+++ b/apps/app/tests/env-context.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, test } from "bun:test";
+
+import type { OpenworkServerClient } from "../src/app/lib/openwork-server";
+import {
+  buildOpenworkEnvSystemContext,
+  clearOpenworkEnvSystemContextCache,
+} from "../src/react-app/domains/session/sync/env-context";
+
+function client(keys: string[], calls: { count: number }): OpenworkServerClient {
+  return {
+    baseUrl: "http://127.0.0.1:3000",
+    listUserEnvKeys: async () => {
+      calls.count += 1;
+      return { keys };
+    },
+  } as OpenworkServerClient;
+}
+
+describe("buildOpenworkEnvSystemContext", () => {
+  test("lists configured key names without inventing secret values", async () => {
+    clearOpenworkEnvSystemContextCache();
+    const calls = { count: 0 };
+    const context = await buildOpenworkEnvSystemContext(
+      client(["NBA_LIVE_KEY", "bad-key", "ANTHROPIC_API_KEY", "NBA_LIVE_KEY"], calls),
+      {
+        cacheKey: "session-a",
+        readPendingChanges: () => false,
+      },
+    );
+
+    expect(context).toContain("- ANTHROPIC_API_KEY");
+    expect(context).toContain("- NBA_LIVE_KEY");
+    expect(context).not.toContain("bad-key");
+    expect(context).not.toContain("sk-ant-secret");
+    expect(calls.count).toBe(1);
+  });
+
+  test("caches key context per session", async () => {
+    clearOpenworkEnvSystemContextCache();
+    const calls = { count: 0 };
+    const server = client(["OPENROUTER_API_KEY"], calls);
+
+    await buildOpenworkEnvSystemContext(server, {
+      cacheKey: "session-a",
+      readPendingChanges: () => false,
+    });
+    await buildOpenworkEnvSystemContext(server, {
+      cacheKey: "session-a",
+      readPendingChanges: () => false,
+    });
+    await buildOpenworkEnvSystemContext(server, {
+      cacheKey: "session-b",
+      readPendingChanges: () => false,
+    });
+
+    expect(calls.count).toBe(2);
+  });
+
+  test("does not truncate long key lists", async () => {
+    clearOpenworkEnvSystemContextCache();
+    const calls = { count: 0 };
+    const keys = Array.from({ length: 90 }, (_, index) => `KEY_${index}`);
+    const context = await buildOpenworkEnvSystemContext(client(keys, calls), {
+      cacheKey: "session-a",
+      readPendingChanges: () => false,
+    });
+
+    expect(context).toContain("- KEY_0");
+    expect(context).toContain("- KEY_89");
+    expect(context).not.toContain("and 10 more");
+  });
+
+  test("skips context while environment changes are pending", async () => {
+    clearOpenworkEnvSystemContextCache();
+    const calls = { count: 0 };
+    const context = await buildOpenworkEnvSystemContext(client(["ANTHROPIC_API_KEY"], calls), {
+      cacheKey: "session-a",
+      readPendingChanges: () => true,
+    });
+
+    expect(context).toBeUndefined();
+    expect(calls.count).toBe(0);
+  });
+});
diff --git a/apps/app/tests/openwork-env-runtime.test.ts b/apps/app/tests/openwork-env-runtime.test.ts
new file mode 100644
index 0000000000..0b75ff00c5
--- /dev/null
+++ b/apps/app/tests/openwork-env-runtime.test.ts
@@ -0,0 +1,90 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  buildOpenworkEnvRuntimeKey,
+  readOpenworkEnvPendingChanges,
+  writeOpenworkEnvPendingChanges,
+} from "../src/app/lib/openwork-env-runtime";
+
+const originalWindow = globalThis.window;
+
+function memoryStorage(): Storage {
+  const map = new Map<string, string>();
+  return {
+    get length() {
+      return map.size;
+    },
+    clear() {
+      map.clear();
+    },
+    getItem(key: string) {
+      return map.get(key) ?? null;
+    },
+    key(index: number) {
+      return Array.from(map.keys())[index] ?? null;
+    },
+    removeItem(key: string) {
+      map.delete(key);
+    },
+    setItem(key: string, value: string) {
+      map.set(key, value);
+    },
+  };
+}
+
+describe("openwork env runtime", () => {
+  beforeEach(() => {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: {
+        localStorage: memoryStorage(),
+        sessionStorage: memoryStorage(),
+      },
+    });
+  });
+
+  afterEach(() => {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      value: originalWindow,
+    });
+  });
+
+  test("persists pending changes across browser sessions", () => {
+    const runtimeKey = "http://127.0.0.1:8787::pid:123";
+    writeOpenworkEnvPendingChanges(true, runtimeKey);
+    expect(readOpenworkEnvPendingChanges(runtimeKey)).toBe(true);
+
+    window.sessionStorage.clear();
+    expect(readOpenworkEnvPendingChanges(runtimeKey)).toBe(true);
+
+    writeOpenworkEnvPendingChanges(false);
+    expect(readOpenworkEnvPendingChanges(runtimeKey)).toBe(false);
+  });
+
+  test("reads legacy sessionStorage pending state", () => {
+    window.sessionStorage.setItem("openwork.settings.environment.pendingChanges", "1");
+
+    expect(readOpenworkEnvPendingChanges()).toBe(true);
+  });
+
+  test("clears pending changes after the runtime changes", () => {
+    writeOpenworkEnvPendingChanges(true, "http://127.0.0.1:8787::pid:123");
+
+    expect(readOpenworkEnvPendingChanges("http://127.0.0.1:8787::pid:456")).toBe(false);
+    expect(readOpenworkEnvPendingChanges("http://127.0.0.1:8787::pid:456")).toBe(false);
+  });
+
+  test("builds a stable runtime key from server identity", () => {
+    expect(buildOpenworkEnvRuntimeKey({
+      baseUrl: "http://127.0.0.1:8787/",
+      pid: 123,
+      port: 8787,
+    })).toBe("http://127.0.0.1:8787::pid:123");
+    expect(buildOpenworkEnvRuntimeKey({
+      baseUrl: "http://127.0.0.1:8787",
+      port: 8787,
+    })).toBe("http://127.0.0.1:8787::port:8787");
+    expect(buildOpenworkEnvRuntimeKey({})).toBeUndefined();
+  });
+});
diff --git a/apps/app/tests/permission-approval-modal.test.ts b/apps/app/tests/permission-approval-modal.test.ts
new file mode 100644
index 0000000000..33ed1bd720
--- /dev/null
+++ b/apps/app/tests/permission-approval-modal.test.ts
@@ -0,0 +1,96 @@
+import { describe, expect, test } from "bun:test";
+import React from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import type { PendingPermission } from "../src/app/types";
+
+import {
+  PermissionApprovalModal,
+  permissionDetailRows,
+} from "../src/react-app/domains/session/chat/permission-approval-modal";
+
+function pendingPermission(overrides: Partial<PendingPermission> = {}): PendingPermission {
+  return {
+    id: "permission-1",
+    sessionID: "session-1",
+    permission: "bash",
+    patterns: ["rm -rf dist"],
+    metadata: {},
+    always: {
+      session: false,
+      project: false,
+    },
+    receivedAt: 1,
+    ...overrides,
+  };
+}
+
+describe("permission approval modal helpers", () => {
+  test("surfaces risk-bearing metadata as review rows", () => {
+    expect(
+      permissionDetailRows({
+        command: "rm -rf dist",
+        description: "Remove build output",
+        cwd: "/workspace/project",
+        filepath: "/workspace/project/src/app.ts",
+        diff: "-old\n+new",
+        output: "not shown before approval",
+      }).map((row) => [row.label, row.value]),
+    ).toEqual([
+      ["Command", "rm -rf dist"],
+      ["Description", "Remove build output"],
+      ["Working directory", "/workspace/project"],
+      ["File", "/workspace/project/src/app.ts"],
+      ["Diff", "-old\n+new"],
+    ]);
+  });
+
+  test("deduplicates alternate file metadata keys", () => {
+    expect(
+      permissionDetailRows({
+        filepath: "/workspace/project/a.ts",
+        filePath: "/workspace/project/b.ts",
+      }).map((row) => [row.label, row.value]),
+    ).toEqual([["File", "/workspace/project/a.ts"]]);
+  });
+
+  test("summarizes apply-patch file metadata", () => {
+    expect(
+      permissionDetailRows({
+        files: [
+          { type: "add", relativePath: "src/new.ts" },
+          { type: "delete", filePath: "/workspace/project/src/old.ts" },
+          { type: "", path: "src/update.ts" },
+        ],
+      }).map((row) => [row.label, row.value]),
+    ).toEqual([
+      ["Files", "add: src/new.ts\ndelete: /workspace/project/src/old.ts\nchange: src/update.ts"],
+    ]);
+  });
+
+  test("keeps keyboard order on the safer one-shot approval before session approval", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(PermissionApprovalModal, {
+        permission: pendingPermission(),
+        respondPermission: () => {},
+      }),
+    );
+
+    const buttonLabels = Array.from(html.matchAll(/<button\b[\s\S]*?<\/button>/g)).map((match) =>
+      match[0].replace(/<[^>]*>/g, "").trim(),
+    );
+
+    expect(buttonLabels).toEqual(["Deny", "Allow once", "Allow for session"]);
+  });
+
+  test("uses readable labels for generic permission titles", () => {
+    const html = renderToStaticMarkup(
+      React.createElement(PermissionApprovalModal, {
+        permission: pendingPermission({ permission: "todowrite" }),
+        respondPermission: () => {},
+      }),
+    );
+
+    expect(html).toContain("Approve Todo write?");
+    expect(html).not.toContain("Approve todowrite?");
+  });
+});
diff --git a/apps/app/tests/session-sync-permissions.test.ts b/apps/app/tests/session-sync-permissions.test.ts
new file mode 100644
index 0000000000..ec72c168c3
--- /dev/null
+++ b/apps/app/tests/session-sync-permissions.test.ts
@@ -0,0 +1,81 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import type { PermissionRequest } from "@opencode-ai/sdk/v2/client";
+
+import { getReactQueryClient } from "../src/react-app/infra/query-client";
+import {
+  permissionKey,
+  seedPermissionState,
+} from "../src/react-app/domains/session/sync/session-sync";
+
+function permission(id: string, sessionID: string): PermissionRequest {
+  return {
+    id,
+    sessionID,
+    permission: "bash",
+    patterns: ["echo ok"],
+    metadata: {},
+    always: {
+      session: false,
+      project: false,
+    },
+  };
+}
+
+afterEach(() => {
+  getReactQueryClient().clear();
+});
+
+describe("session permission sync", () => {
+  test("seeds only permissions for the selected session", () => {
+    seedPermissionState("workspace-a", "session-a", [
+      permission("perm-a", "session-a"),
+      permission("perm-b", "session-b"),
+    ]);
+
+    expect(getReactQueryClient().getQueryData(permissionKey("workspace-a", "session-a"))).toMatchObject([
+      { id: "perm-a", sessionID: "session-a", permission: "bash" },
+    ]);
+  });
+
+  test("preserves received time when refreshing an existing permission", () => {
+    seedPermissionState("workspace-a", "session-a", [permission("perm-a", "session-a")]);
+    const first = getReactQueryClient().getQueryData<Array<{ id: string; receivedAt: number }>>(
+      permissionKey("workspace-a", "session-a"),
+    )!;
+
+    seedPermissionState("workspace-a", "session-a", [permission("perm-a", "session-a")]);
+    const second = getReactQueryClient().getQueryData<Array<{ id: string; receivedAt: number }>>(
+      permissionKey("workspace-a", "session-a"),
+    )!;
+
+    expect(second[0]!.receivedAt).toBe(first[0]!.receivedAt);
+  });
+
+  test("keeps live permissions that arrive after a snapshot starts", () => {
+    getReactQueryClient().setQueryData(permissionKey("workspace-a", "session-a"), [
+      {
+        ...permission("perm-live", "session-a"),
+        receivedAt: 200,
+      },
+    ]);
+
+    seedPermissionState("workspace-a", "session-a", [], { snapshotStartedAt: 100 });
+
+    expect(getReactQueryClient().getQueryData(permissionKey("workspace-a", "session-a"))).toMatchObject([
+      { id: "perm-live", sessionID: "session-a", permission: "bash" },
+    ]);
+  });
+
+  test("drops stale permissions that predate a fresh snapshot", () => {
+    getReactQueryClient().setQueryData(permissionKey("workspace-a", "session-a"), [
+      {
+        ...permission("perm-stale", "session-a"),
+        receivedAt: 100,
+      },
+    ]);
+
+    seedPermissionState("workspace-a", "session-a", [], { snapshotStartedAt: 200 });
+
+    expect(getReactQueryClient().getQueryData(permissionKey("workspace-a", "session-a"))).toEqual([]);
+  });
+});
diff --git a/apps/app/tsconfig.json b/apps/app/tsconfig.json
new file mode 100644
index 0000000000..f3719f9cfa
--- /dev/null
+++ b/apps/app/tsconfig.json
@@ -0,0 +1,38 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "module": "ESNext",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx",
+    "jsxImportSource": "react",
+    "moduleResolution": "Bundler",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "types": ["vite/client", "node"]
+  },
+  "include": [
+    "src/index.react.tsx",
+    "src/components/**/*",
+    "src/i18n/**/*",
+    "src/lib/**/*",
+    "src/react-app/**/*",
+    "src/app/lib/**/*",
+    "src/app/bundles/**/*",
+    "src/app/cloud/**/*",
+    "src/app/data/**/*",
+    "src/app/utils/**/*",
+    "src/app/constants.ts",
+    "src/app/types.ts",
+    "src/app/theme.ts",
+    "src/app/mcp.ts",
+    "vite.config.ts"
+  ]
+}
diff --git a/apps/app/vercel.json b/apps/app/vercel.json
new file mode 100644
index 0000000000..316c9da8de
--- /dev/null
+++ b/apps/app/vercel.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": "vite",
+  "buildCommand": "pnpm run build:web",
+  "outputDirectory": "dist",
+  "rewrites": [
+    {
+      "source": "/(.*)",
+      "destination": "/index.html"
+    }
+  ]
+}
diff --git a/apps/app/vite.config.ts b/apps/app/vite.config.ts
new file mode 100644
index 0000000000..b3b96cdc1e
--- /dev/null
+++ b/apps/app/vite.config.ts
@@ -0,0 +1,110 @@
+import os from "node:os";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import tailwindcss from "@tailwindcss/vite";
+
+const portValue = Number.parseInt(process.env.PORT ?? "", 10);
+const devPort = Number.isFinite(portValue) && portValue > 0 ? portValue : 5173;
+const allowedHosts = new Set<string>();
+const envAllowedHosts = process.env.VITE_ALLOWED_HOSTS ?? "";
+
+const addHost = (value?: string | null) => {
+  const trimmed = value?.trim();
+  if (!trimmed) return;
+  allowedHosts.add(trimmed);
+};
+
+envAllowedHosts.split(",").forEach(addHost);
+addHost(process.env.OPENWORK_PUBLIC_HOST ?? null);
+const hostname = os.hostname();
+addHost(hostname);
+const shortHostname = hostname.split(".")[0];
+if (shortHostname && shortHostname !== hostname) {
+  addHost(shortHostname);
+}
+const appRoot = resolve(fileURLToPath(new URL(".", import.meta.url)));
+const appPackagePath = resolve(appRoot, "package.json");
+const desktopPackagePath = resolve(appRoot, "..", "desktop", "package.json");
+
+function readPackageVersion(packagePath: string): string | null {
+  if (!existsSync(packagePath)) return null;
+
+  const parsed = JSON.parse(readFileSync(packagePath, "utf8")) as { version?: string };
+  return parsed.version?.trim() || null;
+}
+
+const buildAppVersion =
+  process.env.VITE_OPENWORK_APP_VERSION?.trim() ||
+  readPackageVersion(desktopPackagePath) ||
+  readPackageVersion(appPackagePath) ||
+  "0.0.0";
+
+// Load the Tauri → Electron migration-release fragment if present. Written
+// by scripts/migration/01-cut-migration-release.mjs for the specific
+// release commit; absent otherwise so every other build has the migration
+// prompt dormant. Pre-parsed here so Vite's define/import.meta.env picks
+// up the keys without a custom plugin.
+function loadMigrationReleaseEnv(): Record<string, string> {
+  const fragmentPath = resolve(appRoot, ".env.migration-release");
+  if (!existsSync(fragmentPath)) return {};
+  const out: Record<string, string> = {};
+  const raw = readFileSync(fragmentPath, "utf8");
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq < 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    if (!key.startsWith("VITE_")) continue;
+    out[key] = trimmed.slice(eq + 1).trim();
+  }
+  return out;
+}
+const migrationReleaseEnv = loadMigrationReleaseEnv();
+
+// Electron packaged builds load index.html via `file://`, so asset URLs
+// must be relative. Tauri serves via its own protocol so absolute paths
+// work there. Gate on an env var the electron build script sets.
+const isElectronPackagedBuild = process.env.OPENWORK_ELECTRON_BUILD === "1";
+
+export default defineConfig({
+  base: isElectronPackagedBuild ? "./" : "/",
+  define: {
+    ...Object.fromEntries(
+      Object.entries(migrationReleaseEnv).map(([k, v]) => [
+        `import.meta.env.${k}`,
+        JSON.stringify(v),
+      ]),
+    ),
+    "import.meta.env.VITE_OPENWORK_APP_VERSION": JSON.stringify(buildAppVersion),
+  },
+  plugins: [
+    {
+      name: "openwork-dev-server-id",
+      configureServer(server) {
+        server.middlewares.use("/__openwork_dev_server_id", (_req, res) => {
+          res.setHeader("Content-Type", "application/json");
+          res.end(JSON.stringify({ appRoot }));
+        });
+      },
+    },
+    tailwindcss(),
+    react(),
+  ],
+  server: {
+    port: devPort,
+    strictPort: true,
+    ...(allowedHosts.size > 0 ? { allowedHosts: Array.from(allowedHosts) } : {}),
+  },
+  build: {
+    target: "esnext",
+  },
+  resolve: {
+    alias: {
+      "@": resolve(appRoot, "src"),
+    },
+  },
+});
diff --git a/apps/desktop/electron-builder.yml b/apps/desktop/electron-builder.yml
new file mode 100644
index 0000000000..47212bd9dc
--- /dev/null
+++ b/apps/desktop/electron-builder.yml
@@ -0,0 +1,105 @@
+# IMPORTANT: appId intentionally matches the Tauri shell so both builds share
+# the same macOS bundle identifier, keychain entries, Launchpad slot, and TCC
+# permissions. In-place migration from Tauri to Electron depends on this.
+appId: com.differentai.openwork
+productName: OpenWork
+protocols:
+  - name: OpenWork
+    schemes:
+      - openwork
+directories:
+  output: dist-electron
+files:
+  - electron/**/*
+  - package.json
+extraResources:
+  - from: ../app/dist
+    to: app-dist
+asar: true
+npmRebuild: false
+afterPack: scripts/electron-after-pack.cjs
+afterSign: scripts/electron-after-sign.cjs
+# electron-updater feed. Matches the existing release workflow's GitHub target
+# so both Tauri (latest.json) and Electron (latest*.yml) can live on the same
+# release assets during the migration window.
+publish:
+  - provider: github
+    owner: different-ai
+    repo: openwork
+    releaseType: release
+mac:
+  icon: resources/icons/icon.icns
+  category: public.app-category.developer-tools
+  hardenedRuntime: true
+  gatekeeperAssess: false
+  notarize: false
+  extraResources:
+    - from: resources/sidecars
+      to: sidecars
+      filter:
+        - opencode
+        - opencode-aarch64-apple-darwin
+        - opencode-x86_64-apple-darwin
+        - openwork-server
+        - openwork-server-aarch64-apple-darwin
+        - openwork-server-x86_64-apple-darwin
+        - openwork-orchestrator
+        - openwork-orchestrator-aarch64-apple-darwin
+        - openwork-orchestrator-x86_64-apple-darwin
+        - chrome-devtools-mcp
+        - chrome-devtools-mcp-aarch64-apple-darwin
+        - chrome-devtools-mcp-x86_64-apple-darwin
+        - versions.json
+        - versions.json-aarch64-apple-darwin
+        - versions.json-x86_64-apple-darwin
+  target:
+    - dmg
+    - zip
+linux:
+  icon: resources/icons/icon.png
+  extraResources:
+    - from: resources/sidecars
+      to: sidecars
+      filter:
+        - opencode
+        - opencode-aarch64-unknown-linux-gnu
+        - opencode-x86_64-unknown-linux-gnu
+        - openwork-server
+        - openwork-server-aarch64-unknown-linux-gnu
+        - openwork-server-x86_64-unknown-linux-gnu
+        - openwork-orchestrator
+        - openwork-orchestrator-aarch64-unknown-linux-gnu
+        - openwork-orchestrator-x86_64-unknown-linux-gnu
+        - chrome-devtools-mcp
+        - chrome-devtools-mcp-aarch64-unknown-linux-gnu
+        - chrome-devtools-mcp-x86_64-unknown-linux-gnu
+        - versions.json
+        - versions.json-aarch64-unknown-linux-gnu
+        - versions.json-x86_64-unknown-linux-gnu
+  target:
+    - AppImage
+    - tar.gz
+win:
+  icon: resources/icons/icon.ico
+  extraResources:
+    - from: resources/sidecars
+      to: sidecars
+      filter:
+        - opencode.exe
+        - opencode-aarch64-pc-windows-msvc.exe
+        - opencode-x86_64-pc-windows-msvc.exe
+        - openwork-server.exe
+        - openwork-server-aarch64-pc-windows-msvc.exe
+        - openwork-server-x86_64-pc-windows-msvc.exe
+        - openwork-orchestrator.exe
+        - openwork-orchestrator-aarch64-pc-windows-msvc.exe
+        - openwork-orchestrator-x86_64-pc-windows-msvc.exe
+        - chrome-devtools-mcp.exe
+        - chrome-devtools-mcp-aarch64-pc-windows-msvc.exe
+        - chrome-devtools-mcp-x86_64-pc-windows-msvc.exe
+        - versions.json
+        - versions.json-aarch64-pc-windows-msvc.exe
+        - versions.json-x86_64-pc-windows-msvc.exe
+  target:
+    - nsis
+artifactName: openwork-${os}-${arch}-${version}.${ext}
diff --git a/apps/desktop/electron/main.mjs b/apps/desktop/electron/main.mjs
new file mode 100644
index 0000000000..8fb30b8037
--- /dev/null
+++ b/apps/desktop/electron/main.mjs
@@ -0,0 +1,1625 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { existsSync } from "node:fs";
+import {
+  cp,
+  mkdir,
+  readFile,
+  readdir,
+  realpath,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { app, BrowserWindow, dialog, ipcMain, nativeImage, shell } from "electron";
+import { registerMigrationIpc } from "./migration.mjs";
+import { createRuntimeManager } from "./runtime.mjs";
+import { registerUpdaterIpc } from "./updater.mjs";
+import { exportWorkspaceConfig, importWorkspaceConfig } from "./workspace-archive.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const NATIVE_DEEP_LINK_EVENT = "openwork:deep-link-native";
+const TAURI_APP_IDENTIFIER = "com.differentai.openwork";
+const DEV_APP_IDENTIFIER = "com.differentai.openwork.dev";
+const DESKTOP_PROTOCOL_SCHEME = "openwork";
+const isDevMode = process.env.OPENWORK_DEV_MODE === "1";
+const APP_NAME = isDevMode ? "OpenWork - Dev" : "OpenWork";
+const APP_IDENTIFIER = isDevMode ? DEV_APP_IDENTIFIER : TAURI_APP_IDENTIFIER;
+
+// Production Electron shares the same on-disk state folder as the Tauri shell
+// so in-place migration is a no-op for almost every file. Dev mode uses the
+// separate dev identifier so it can run beside the production app.
+//
+// Override via OPENWORK_ELECTRON_USERDATA so dogfooders can isolate their
+// Electron install from the real Tauri app.
+app.setName(APP_NAME);
+app.setAppUserModelId(APP_IDENTIFIER);
+if (app.isPackaged) {
+  app.setAsDefaultProtocolClient(DESKTOP_PROTOCOL_SCHEME);
+}
+const userDataOverride = process.env.OPENWORK_ELECTRON_USERDATA?.trim();
+if (userDataOverride) {
+  app.setPath("userData", userDataOverride);
+} else {
+  app.setPath(
+    "userData",
+    path.join(app.getPath("appData"), APP_IDENTIFIER),
+  );
+}
+
+// Resolve and cache the app icon (reused for BrowserWindow + mac dock).
+// Packaged builds ship icons via electron-builder config, but for `dev:electron`
+// the Electron default icon is shown without this.
+function resolveAppIconPath() {
+  const candidates = [
+    // Dev: match Tauri's separate dev icon so the dev app is visibly distinct.
+    ...(isDevMode
+      ? [
+          path.resolve(__dirname, "../resources/icons/dev/icon.png"),
+          path.resolve(__dirname, "../resources/icons/dev/128x128@2x.png"),
+          path.resolve(__dirname, "../resources/icons/dev/icon-dev.icns"),
+        ]
+      : []),
+    // Repo-relative path to the Electron resource icon set.
+    path.resolve(__dirname, "../resources/icons/icon.png"),
+    // Packaged: electron-builder copies extraResources but we fall back to this
+    // if custom packaging ever exposes the icon here.
+    path.join(process.resourcesPath ?? "", "icons", "icon.png"),
+  ];
+  for (const candidate of candidates) {
+    if (candidate && existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+const APP_ICON_PATH = resolveAppIconPath();
+const APP_ICON_IMAGE = APP_ICON_PATH ? nativeImage.createFromPath(APP_ICON_PATH) : null;
+
+if (process.platform === "darwin" && APP_ICON_IMAGE && !APP_ICON_IMAGE.isEmpty() && app.dock) {
+  app.dock.setIcon(APP_ICON_IMAGE);
+}
+
+// Optional: expose Chrome DevTools Protocol so external tools (chrome-devtools
+// MCP, raw CDP clients, etc.) can attach to this Electron instance.
+// Enable by setting OPENWORK_ELECTRON_REMOTE_DEBUG_PORT=<port> before launch.
+const remoteDebugPort = Number.parseInt(
+  process.env.OPENWORK_ELECTRON_REMOTE_DEBUG_PORT?.trim() ?? "",
+  10,
+);
+if (Number.isFinite(remoteDebugPort) && remoteDebugPort > 0) {
+  app.commandLine.appendSwitch("remote-debugging-port", String(remoteDebugPort));
+  app.commandLine.appendSwitch("remote-debugging-address", "127.0.0.1");
+}
+const DEFAULT_DEN_BASE_URL = "https://app.openworklabs.com";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:4096";
+
+function envFlagDisabled(name) {
+  const value = process.env[name]?.trim().toLowerCase();
+  return value === "0" || value === "false" || value === "off";
+}
+
+async function installReactDevToolsForDev() {
+  if (app.isPackaged || envFlagDisabled("OPENWORK_REACT_DEVTOOLS")) return;
+  try {
+    const mod = await import("electron-devtools-installer");
+    const installExtension =
+      typeof mod.installExtension === "function"
+        ? mod.installExtension
+        : typeof mod.default === "function"
+          ? mod.default
+          : typeof mod.default?.installExtension === "function"
+            ? mod.default.installExtension
+            : null;
+    const reactDevtools = mod.REACT_DEVELOPER_TOOLS ?? mod.default?.REACT_DEVELOPER_TOOLS;
+    if (typeof installExtension !== "function" || !reactDevtools) {
+      throw new Error("electron-devtools-installer did not expose React DevTools");
+    }
+    const name = await installExtension(reactDevtools);
+    console.info(`[devtools] installed ${name}`);
+  } catch (error) {
+    console.warn("[devtools] failed to install React Developer Tools", error);
+  }
+}
+
+const EMPTY_WORKSPACE_LIST = Object.freeze({
+  selectedId: "",
+  watchedId: null,
+  activeId: null,
+  workspaces: [],
+});
+
+const IDLE_ENGINE_INFO = Object.freeze({
+  running: false,
+  runtime: "direct",
+  baseUrl: null,
+  projectDir: null,
+  hostname: null,
+  port: null,
+  opencodeUsername: null,
+  opencodePassword: null,
+  opencodeBinPath: null,
+  opencodeBinSource: null,
+  pid: null,
+  lastStdout: null,
+  lastStderr: null,
+});
+
+const IDLE_OPENWORK_SERVER_INFO = Object.freeze({
+  running: false,
+  remoteAccessEnabled: false,
+  host: null,
+  port: null,
+  baseUrl: null,
+  connectUrl: null,
+  mdnsUrl: null,
+  lanUrl: null,
+  clientToken: null,
+  ownerToken: null,
+  hostToken: null,
+  managedOpencodeBinPath: null,
+  managedOpencodeBinSource: null,
+  pid: null,
+  lastStdout: null,
+  lastStderr: null,
+});
+
+const IDLE_ROUTER_INFO = Object.freeze({
+  running: false,
+  version: null,
+  workspacePath: null,
+  opencodeUrl: null,
+  healthPort: null,
+  pid: null,
+  lastStdout: null,
+  lastStderr: null,
+});
+
+let mainWindow = null;
+const pendingDeepLinks = [];
+let uiControlServer = null;
+let uiControlDiscoveryPath = null;
+const uiControlToken = randomBytes(32).toString("hex");
+
+function normalizePlatform(value) {
+  if (value === "darwin" || value === "linux") return value;
+  if (value === "win32") return "windows";
+  return "linux";
+}
+
+function forwardedDeepLinks(argv) {
+  return argv
+    .slice(1)
+    .map((entry) => entry.trim())
+    .filter(
+      (entry) =>
+        entry.startsWith("openwork://") ||
+        entry.startsWith("openwork-dev://") ||
+        entry.startsWith("https://") ||
+        entry.startsWith("http://"),
+    );
+}
+
+function queueDeepLinks(urls) {
+  const nextUrls = urls.filter(Boolean);
+  if (nextUrls.length === 0) return;
+  pendingDeepLinks.push(...nextUrls);
+  if (mainWindow?.webContents) {
+    mainWindow.webContents.send(NATIVE_DEEP_LINK_EVENT, nextUrls);
+  }
+}
+
+function flushPendingDeepLinks() {
+  if (!mainWindow?.webContents || pendingDeepLinks.length === 0) return;
+  const urls = pendingDeepLinks.splice(0, pendingDeepLinks.length);
+  mainWindow.webContents.send(NATIVE_DEEP_LINK_EVENT, urls);
+}
+
+function desktopBootstrapPath() {
+  if (process.env.OPENWORK_DESKTOP_BOOTSTRAP_PATH?.trim()) {
+    return process.env.OPENWORK_DESKTOP_BOOTSTRAP_PATH.trim();
+  }
+  return path.join(os.homedir(), ".config", "openwork", "desktop-bootstrap.json");
+}
+
+function workspaceStatePath() {
+  return path.join(app.getPath("userData"), "openwork-workspaces.json");
+}
+
+// Earlier Electron alpha builds copied Tauri's openwork-workspaces.json into an
+// Electron-only workspace-state.json. Keep importing that file when the shared
+// canonical file is missing, but write openwork-workspaces.json going forward so
+// Tauri rollback and Electron both read the same desktop workspace state.
+function legacyElectronWorkspaceStatePath() {
+  return path.join(app.getPath("userData"), "workspace-state.json");
+}
+
+async function migrateLegacyElectronWorkspaceStateIfNeeded() {
+  const current = workspaceStatePath();
+  const legacy = legacyElectronWorkspaceStatePath();
+  try {
+    if (existsSync(current)) return false;
+    if (!existsSync(legacy)) return false;
+    await mkdir(path.dirname(current), { recursive: true });
+    const raw = await readFile(legacy, "utf8");
+    await writeFile(current, raw, "utf8");
+    console.info(
+      "[migration] copied workspace-state.json → openwork-workspaces.json",
+    );
+    return true;
+  } catch (error) {
+    console.warn("[migration] legacy Electron workspace-state copy failed", error);
+    return false;
+  }
+}
+
+function configHomePath() {
+  if (process.env.XDG_CONFIG_HOME?.trim()) {
+    return process.env.XDG_CONFIG_HOME.trim();
+  }
+  if (process.platform === "win32" && process.env.APPDATA?.trim()) {
+    return process.env.APPDATA.trim();
+  }
+  return path.join(os.homedir(), ".config");
+}
+
+function globalOpencodeRoot() {
+  return path.join(configHomePath(), "opencode");
+}
+
+function execResult(ok, stdout = "", stderr = "", status = ok ? 0 : 1) {
+  return { ok, status, stdout, stderr };
+}
+
+async function pathExists(targetPath) {
+  try {
+    await stat(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function isDirectory(targetPath) {
+  try {
+    return (await stat(targetPath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+async function readJsonFile(targetPath, fallback) {
+  try {
+    const raw = await readFile(targetPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+
+function normalizeDesktopBootstrapConfig(input) {
+  const baseUrl = typeof input?.baseUrl === "string" ? input.baseUrl.trim() : "";
+  if (!baseUrl) {
+    throw new Error("baseUrl is required");
+  }
+
+  const apiBaseUrl =
+    typeof input?.apiBaseUrl === "string" && input.apiBaseUrl.trim().length > 0
+      ? input.apiBaseUrl.trim()
+      : null;
+
+  return {
+    baseUrl,
+    apiBaseUrl,
+    requireSignin: input?.requireSignin === true,
+  };
+}
+
+async function getDesktopBootstrapConfig() {
+  try {
+    const raw = await readFile(desktopBootstrapPath(), "utf8");
+    return normalizeDesktopBootstrapConfig(JSON.parse(raw));
+  } catch {
+    return {
+      baseUrl: DEFAULT_DEN_BASE_URL,
+      apiBaseUrl: null,
+      requireSignin: false,
+    };
+  }
+}
+
+async function setDesktopBootstrapConfig(config) {
+  const normalized = normalizeDesktopBootstrapConfig(config);
+  const outputPath = desktopBootstrapPath();
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(normalized, null, 2)}\n`, "utf8");
+  return normalized;
+}
+
+function sanitizeCommandName(raw) {
+  const trimmed = String(raw ?? "").trim().replace(/^\/+/, "");
+  if (!trimmed) return null;
+  const safe = Array.from(trimmed)
+    .filter((char) => /[A-Za-z0-9_-]/.test(char))
+    .join("");
+  return safe || null;
+}
+
+function escapeYamlScalar(value) {
+  return JSON.stringify(String(value ?? ""));
+}
+
+function serializeCommandFrontmatter(command) {
+  const template = String(command?.template ?? "").trim();
+  if (!template) {
+    throw new Error("command.template is required");
+  }
+
+  let output = "---\n";
+  if (typeof command?.description === "string" && command.description.trim()) {
+    output += `description: ${escapeYamlScalar(command.description.trim())}\n`;
+  }
+  if (typeof command?.agent === "string" && command.agent.trim()) {
+    output += `agent: ${escapeYamlScalar(command.agent.trim())}\n`;
+  }
+  if (typeof command?.model === "string" && command.model.trim()) {
+    output += `model: ${escapeYamlScalar(command.model.trim())}\n`;
+  }
+  if (command?.subtask === true) {
+    output += "subtask: true\n";
+  }
+  output += `---\n\n${template}\n`;
+  return output;
+}
+
+function validateSkillName(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(trimmed)) {
+    throw new Error("skill name must be kebab-case");
+  }
+  return trimmed;
+}
+
+function defaultWorkspaceOpenworkConfig(workspacePath, preset = null) {
+  return {
+    version: 1,
+    workspace: workspacePath
+      ? {
+          name: path.basename(workspacePath) || "Workspace",
+          createdAt: Date.now(),
+          preset: preset || null,
+        }
+      : null,
+    authorizedRoots: workspacePath ? [workspacePath] : [],
+    reload: null,
+  };
+}
+
+async function normalizeLocalWorkspacePath(rawPath) {
+  const trimmed = String(rawPath ?? "").trim();
+  if (!trimmed) return "";
+  const expanded = trimmed === "~"
+    ? os.homedir()
+    : trimmed.startsWith("~/") || trimmed.startsWith("~\\")
+      ? path.join(os.homedir(), trimmed.slice(2))
+      : trimmed;
+  const resolved = path.resolve(expanded);
+  return realpath(resolved).catch(() => resolved);
+}
+
+function normalizeWorkspacePathKey(value) {
+  const trimmed = String(value ?? "").trim();
+  return trimmed ? path.resolve(trimmed).replace(/\\/g, "/").toLowerCase() : "";
+}
+
+function stableWorkspaceId(value) {
+  return `ws_${createHash("sha256").update(String(value)).digest("hex").slice(0, 12)}`;
+}
+
+function localWorkspaceId(workspacePath) {
+  return stableWorkspaceId(workspacePath);
+}
+
+function remoteWorkspaceId(baseUrl, directory) {
+  const key = String(directory ?? "").trim()
+    ? `remote::${baseUrl}::${String(directory).trim()}`
+    : `remote::${baseUrl}`;
+  return stableWorkspaceId(key);
+}
+
+function openworkRemoteWorkspaceId(hostUrl, workspaceId) {
+  const key = String(workspaceId ?? "").trim()
+    ? `openwork::${hostUrl}::${String(workspaceId).trim()}`
+    : `openwork::${hostUrl}`;
+  return stableWorkspaceId(key);
+}
+
+async function readWorkspaceOpenworkConfig(workspacePath) {
+  const openworkPath = path.join(workspacePath, ".opencode", "openwork.json");
+  if (!(await pathExists(openworkPath))) {
+    return defaultWorkspaceOpenworkConfig(workspacePath);
+  }
+  const raw = await readFile(openworkPath, "utf8");
+  return JSON.parse(raw);
+}
+
+async function writeWorkspaceOpenworkConfig(workspacePath, config) {
+  const openworkPath = path.join(workspacePath, ".opencode", "openwork.json");
+  await mkdir(path.dirname(openworkPath), { recursive: true });
+  await writeFile(openworkPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  return execResult(true, `Wrote ${openworkPath}`);
+}
+
+async function readWorkspaceState() {
+  const state = await readJsonFile(workspaceStatePath(), EMPTY_WORKSPACE_LIST);
+  return {
+    selectedId:
+      typeof state?.selectedId === "string"
+        ? state.selectedId
+        : typeof state?.selectedWorkspaceId === "string"
+          ? state.selectedWorkspaceId
+          : typeof state?.activeId === "string"
+            ? state.activeId
+            : "",
+    watchedId:
+      typeof state?.watchedId === "string"
+        ? state.watchedId
+        : typeof state?.watchedWorkspaceId === "string"
+          ? state.watchedWorkspaceId
+          : null,
+    activeId: typeof state?.activeId === "string" ? state.activeId : null,
+    workspaces: Array.isArray(state?.workspaces) ? state.workspaces : [],
+  };
+}
+
+async function writeWorkspaceState(nextState) {
+  const outputPath = workspaceStatePath();
+  const selectedId = String(nextState?.selectedId ?? nextState?.activeId ?? "");
+  const watchedId = typeof nextState?.watchedId === "string" ? nextState.watchedId : "";
+  const output = {
+    ...nextState,
+    // Tauri's Rust state uses selectedWorkspaceId/watchedWorkspaceId on disk
+    // (with activeId as a legacy alias). Keep Electron's selectedId/watchedId
+    // too so older Electron builds can still read the same file.
+    selectedId,
+    selectedWorkspaceId: selectedId,
+    watchedId: watchedId || null,
+    watchedWorkspaceId: watchedId,
+    activeId: selectedId || null,
+  };
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(output, null, 2)}\n`, "utf8");
+  return output;
+}
+
+const runtimeManager = createRuntimeManager({
+  app,
+  desktopRoot: path.resolve(__dirname, ".."),
+  listLocalWorkspacePaths: async () =>
+    (await readWorkspaceState())
+      .workspaces
+      .filter((entry) => entry?.workspaceType !== "remote")
+      .map((entry) => String(entry?.path ?? "").trim())
+      .filter(Boolean),
+});
+
+let runtimeDisposedForQuit = false;
+let runtimeBootstrapPromise = null;
+
+async function disposeRuntimeBeforeQuit() {
+  if (runtimeDisposedForQuit) return;
+  runtimeDisposedForQuit = true;
+  await runtimeManager.dispose().catch(() => undefined);
+}
+
+function assertOpenworkServerReady(info) {
+  if (!info?.running) {
+    throw new Error("OpenWork server did not stay running after startup.");
+  }
+  if (!info.baseUrl) {
+    throw new Error("OpenWork server did not report a base URL after startup.");
+  }
+  if (!info.ownerToken && !info.clientToken) {
+    throw new Error("OpenWork server did not report an access token after startup.");
+  }
+  return info;
+}
+
+async function bootRuntimeForSelectedWorkspace() {
+  const list = await readWorkspaceState();
+  const selectedId = list.selectedId || list.activeId || list.workspaces[0]?.id || "";
+  const workspace = selectedId
+    ? list.workspaces.find((entry) => entry?.id === selectedId)
+    : list.workspaces[0];
+  const workspaceRoot = String(workspace?.path ?? "").trim();
+  if (!workspaceRoot || workspace?.workspaceType === "remote") {
+    return { ok: true, skipped: true, reason: "no-local-workspace" };
+  }
+
+  const workspacePaths = [];
+  for (const entry of list.workspaces) {
+    if (entry?.workspaceType === "remote") continue;
+    const workspacePath = String(entry?.path ?? "").trim();
+    if (workspacePath && !workspacePaths.includes(workspacePath)) workspacePaths.push(workspacePath);
+  }
+  if (!workspacePaths.includes(workspaceRoot)) workspacePaths.unshift(workspaceRoot);
+
+  let bootWorkspace = workspace;
+  let bootWorkspaceRoot = workspaceRoot;
+  let engine;
+  try {
+    engine = await runtimeManager.engineStart(workspaceRoot, {
+      runtime: "direct",
+      workspacePaths,
+    });
+  } catch (error) {
+    const fallback = list.workspaces.find((entry) => {
+      const candidatePath = String(entry?.path ?? "").trim();
+      return entry?.workspaceType !== "remote" && candidatePath && candidatePath !== workspaceRoot;
+    });
+    const fallbackRoot = String(fallback?.path ?? "").trim();
+    if (!fallback || !fallbackRoot) throw error;
+    console.warn("[runtime] selected workspace failed during boot; trying fallback workspace", {
+      selectedWorkspaceId: workspace?.id ?? null,
+      fallbackWorkspaceId: fallback.id ?? null,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    const fallbackWorkspacePaths = [
+      fallbackRoot,
+      ...workspacePaths.filter((entry) => entry !== fallbackRoot && entry !== workspaceRoot),
+    ];
+    engine = await runtimeManager.engineStart(fallbackRoot, {
+      runtime: "direct",
+      workspacePaths: fallbackWorkspacePaths,
+    });
+    bootWorkspace = fallback;
+    bootWorkspaceRoot = fallbackRoot;
+    await writeWorkspaceState({
+      ...list,
+      selectedId: String(fallback.id ?? ""),
+      watchedId: String(fallback.id ?? ""),
+    }).catch(() => undefined);
+  }
+  await runtimeManager.orchestratorWorkspaceActivate({
+    workspacePath: bootWorkspaceRoot,
+    name: bootWorkspace.name ?? bootWorkspace.displayName ?? null,
+  }).catch(() => undefined);
+  const openworkServer = assertOpenworkServerReady(await runtimeManager.openworkServerInfo());
+  return { ok: true, skipped: false, engine, openworkServer, workspaceId: bootWorkspace.id ?? null };
+}
+
+function ensureRuntimeBootstrap() {
+  if (!runtimeBootstrapPromise) {
+    runtimeBootstrapPromise = bootRuntimeForSelectedWorkspace().catch((error) => ({
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    }));
+  }
+  return runtimeBootstrapPromise;
+}
+
+function normalizeWorkspaceEntry(input) {
+  return {
+    id: String(input.id),
+    name: String(input.name ?? "Workspace"),
+    path: String(input.path ?? ""),
+    preset: String(input.preset ?? "starter"),
+    workspaceType: input.workspaceType === "remote" ? "remote" : "local",
+    remoteType: input.remoteType ?? null,
+    baseUrl: input.baseUrl ?? null,
+    directory: input.directory ?? null,
+    displayName: input.displayName ?? null,
+    openworkHostUrl: input.openworkHostUrl ?? null,
+    openworkToken: input.openworkToken ?? null,
+    openworkClientToken: input.openworkClientToken ?? null,
+    openworkHostToken: input.openworkHostToken ?? null,
+    openworkWorkspaceId: input.openworkWorkspaceId ?? null,
+    openworkWorkspaceName: input.openworkWorkspaceName ?? null,
+    sandboxBackend: input.sandboxBackend ?? null,
+    sandboxRunId: input.sandboxRunId ?? null,
+    sandboxContainerName: input.sandboxContainerName ?? null,
+  };
+}
+
+async function mutateWorkspaceState(mutator) {
+  const current = await readWorkspaceState();
+  const next = await mutator({ ...current, workspaces: [...current.workspaces] });
+  return writeWorkspaceState(next);
+}
+
+function resolveOpencodeConfigPath(scope, projectDir) {
+  let root;
+  if (scope === "project") {
+    if (!String(projectDir ?? "").trim()) {
+      throw new Error("projectDir is required");
+    }
+    root = projectDir;
+  } else if (scope === "global") {
+    root = globalOpencodeRoot();
+  } else {
+    throw new Error("scope must be 'project' or 'global'");
+  }
+
+  const jsoncPath = path.join(root, "opencode.jsonc");
+  const jsonPath = path.join(root, "opencode.json");
+  return { jsoncPath, jsonPath };
+}
+
+async function readOpencodeConfig(scope, projectDir) {
+  const { jsoncPath, jsonPath } = resolveOpencodeConfigPath(scope, projectDir);
+  const chosenPath = (await pathExists(jsoncPath)) ? jsoncPath : (await pathExists(jsonPath)) ? jsonPath : jsoncPath;
+  const exists = await pathExists(chosenPath);
+  return {
+    path: chosenPath,
+    exists,
+    content: exists ? await readFile(chosenPath, "utf8") : null,
+  };
+}
+
+async function writeOpencodeConfig(scope, projectDir, content) {
+  const { jsoncPath, jsonPath } = resolveOpencodeConfigPath(scope, projectDir);
+  const targetPath = (await pathExists(jsoncPath)) ? jsoncPath : (await pathExists(jsonPath)) ? jsonPath : jsoncPath;
+  await mkdir(path.dirname(targetPath), { recursive: true });
+  await writeFile(targetPath, content, "utf8");
+  return execResult(true, `Wrote ${targetPath}`);
+}
+
+function resolveCommandsDir(scope, projectDir) {
+  if (scope === "workspace") {
+    if (!String(projectDir ?? "").trim()) {
+      throw new Error("projectDir is required");
+    }
+    return path.join(projectDir, ".opencode", "commands");
+  }
+  if (scope === "global") {
+    return path.join(globalOpencodeRoot(), "commands");
+  }
+  throw new Error("scope must be 'workspace' or 'global'");
+}
+
+async function listCommandNames(scope, projectDir) {
+  const commandsDir = resolveCommandsDir(scope, projectDir);
+  if (!(await isDirectory(commandsDir))) {
+    return [];
+  }
+  const entries = await readdir(commandsDir, { withFileTypes: true });
+  return entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
+    .map((entry) => entry.name.replace(/\.md$/, ""))
+    .sort();
+}
+
+async function writeCommandFile(scope, projectDir, command) {
+  const safeName = sanitizeCommandName(command?.name);
+  if (!safeName) {
+    throw new Error("command.name is required");
+  }
+  const commandsDir = resolveCommandsDir(scope, projectDir);
+  await mkdir(commandsDir, { recursive: true });
+  const filePath = path.join(commandsDir, `${safeName}.md`);
+  await writeFile(filePath, serializeCommandFrontmatter({ ...command, name: safeName }), "utf8");
+  return execResult(true, `Wrote ${filePath}`);
+}
+
+async function deleteCommandFile(scope, projectDir, name) {
+  const safeName = sanitizeCommandName(name);
+  if (!safeName) {
+    throw new Error("name is required");
+  }
+  const commandsDir = resolveCommandsDir(scope, projectDir);
+  const filePath = path.join(commandsDir, `${safeName}.md`);
+  if (await pathExists(filePath)) {
+    await rm(filePath, { force: true });
+  }
+  return execResult(true, `Deleted ${filePath}`);
+}
+
+async function collectProjectSkillRoots(projectDir) {
+  const roots = [];
+  let current = path.resolve(projectDir);
+
+  while (true) {
+    const opencodeSkills = path.join(current, ".opencode", "skills");
+    const legacySkills = path.join(current, ".opencode", "skill");
+    const claudeSkills = path.join(current, ".claude", "skills");
+
+    if (await isDirectory(opencodeSkills)) roots.push(opencodeSkills);
+    if (await isDirectory(legacySkills)) roots.push(legacySkills);
+    if (await isDirectory(claudeSkills)) roots.push(claudeSkills);
+
+    if (await pathExists(path.join(current, ".git"))) {
+      break;
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+
+  return roots;
+}
+
+async function collectGlobalSkillRoots() {
+  const roots = [];
+  const candidates = [
+    path.join(globalOpencodeRoot(), "skills"),
+    path.join(os.homedir(), ".claude", "skills"),
+    path.join(os.homedir(), ".agents", "skills"),
+    path.join(os.homedir(), ".agent", "skills"),
+  ];
+
+  for (const candidate of candidates) {
+    if (await isDirectory(candidate)) {
+      roots.push(candidate);
+    }
+  }
+
+  return roots;
+}
+
+async function collectSkillRoots(projectDir) {
+  const roots = [...(await collectProjectSkillRoots(projectDir)), ...(await collectGlobalSkillRoots())];
+  return roots.filter((value, index) => roots.indexOf(value) === index);
+}
+
+async function findSkillDirsInRoot(root) {
+  const found = [];
+  if (!(await isDirectory(root))) return found;
+
+  const entries = await readdir(root, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const direct = path.join(root, entry.name);
+    if (await pathExists(path.join(direct, "SKILL.md"))) {
+      found.push(direct);
+      continue;
+    }
+
+    const nestedEntries = await readdir(direct, { withFileTypes: true }).catch(() => []);
+    for (const nested of nestedEntries) {
+      if (!nested.isDirectory()) continue;
+      const nestedDir = path.join(direct, nested.name);
+      if (await pathExists(path.join(nestedDir, "SKILL.md"))) {
+        found.push(nestedDir);
+      }
+    }
+  }
+
+  return found;
+}
+
+function extractFrontmatterValue(raw, keys) {
+  const match = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return null;
+  for (const line of match[1].split(/\r?\n/)) {
+    const separator = line.indexOf(":");
+    if (separator <= 0) continue;
+    const key = line.slice(0, separator).trim().toLowerCase();
+    if (!keys.includes(key)) continue;
+    const value = line.slice(separator + 1).trim().replace(/^['"]|['"]$/g, "");
+    if (value) return value;
+  }
+  return null;
+}
+
+function extractTrigger(raw) {
+  return extractFrontmatterValue(raw, ["trigger", "when"]);
+}
+
+function extractDescription(raw) {
+  let inFrontmatter = false;
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (trimmed === "---") {
+      inFrontmatter = !inFrontmatter;
+      continue;
+    }
+    if (inFrontmatter || trimmed.startsWith("#")) continue;
+    const cleaned = trimmed.replace(/`/g, "");
+    return cleaned.length > 180 ? `${cleaned.slice(0, 180)}...` : cleaned;
+  }
+  return null;
+}
+
+async function listLocalSkills(projectDir) {
+  if (!String(projectDir ?? "").trim()) {
+    throw new Error("projectDir is required");
+  }
+
+  const seen = new Set();
+  const out = [];
+  for (const root of await collectSkillRoots(projectDir)) {
+    for (const skillDir of await findSkillDirsInRoot(root)) {
+      const name = path.basename(skillDir);
+      if (seen.has(name)) continue;
+      seen.add(name);
+      let raw = "";
+      try {
+        raw = await readFile(path.join(skillDir, "SKILL.md"), "utf8");
+      } catch {
+        raw = "";
+      }
+      out.push({
+        name,
+        path: skillDir,
+        description: extractDescription(raw) ?? undefined,
+        trigger: extractTrigger(raw) ?? undefined,
+      });
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+async function findSkillFile(projectDir, name) {
+  const safeName = validateSkillName(name);
+  for (const root of await collectSkillRoots(projectDir)) {
+    const direct = path.join(root, safeName, "SKILL.md");
+    if (await pathExists(direct)) return direct;
+
+    const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const nested = path.join(root, entry.name, safeName, "SKILL.md");
+      if (await pathExists(nested)) return nested;
+    }
+  }
+  return null;
+}
+
+async function ensureProjectSkillRoot(projectDir) {
+  if (!String(projectDir ?? "").trim()) {
+    throw new Error("projectDir is required");
+  }
+  const opencodeRoot = path.join(projectDir, ".opencode");
+  const legacy = path.join(opencodeRoot, "skill");
+  const modern = path.join(opencodeRoot, "skills");
+  if ((await isDirectory(legacy)) && !(await pathExists(modern))) {
+    await rename(legacy, modern);
+  }
+  await mkdir(modern, { recursive: true });
+  return modern;
+}
+
+function engineDoctor(options = {}) {
+  return runtimeManager.engineDoctor(options);
+}
+
+function activeWindowFromEvent(event) {
+  return BrowserWindow.fromWebContents(event.sender) ?? mainWindow ?? undefined;
+}
+
+async function handleDesktopInvoke(event, command, ...args) {
+  switch (command) {
+    case "workspaceBootstrap":
+      return readWorkspaceState();
+    case "workspaceSetSelected":
+      return mutateWorkspaceState((state) => {
+        const workspaceId = typeof args[0] === "string" ? args[0] : "";
+        state.selectedId = workspaceId;
+        state.activeId = workspaceId || null;
+        return state;
+      });
+    case "workspaceSetRuntimeActive":
+      return mutateWorkspaceState((state) => {
+        state.watchedId = typeof args[0] === "string" && args[0].trim() ? args[0] : null;
+        return state;
+      });
+    case "workspaceCreate": {
+      const input = args[0] ?? {};
+      const rawFolderPath = String(input.folderPath ?? "").trim();
+      if (!rawFolderPath) throw new Error("folderPath is required");
+      const folderPath = await normalizeLocalWorkspacePath(rawFolderPath);
+      await mkdir(folderPath, { recursive: true });
+      const preset = String(input.preset ?? "starter");
+      const workspace = normalizeWorkspaceEntry({
+        id: localWorkspaceId(folderPath),
+        name: String(input.name ?? (path.basename(folderPath) || "Workspace")),
+        displayName: String(input.name ?? (path.basename(folderPath) || "Workspace")),
+        path: folderPath,
+        preset,
+        workspaceType: "local",
+      });
+      await mkdir(path.join(folderPath, ".opencode"), { recursive: true });
+      await writeWorkspaceOpenworkConfig(folderPath, defaultWorkspaceOpenworkConfig(folderPath, preset));
+      return mutateWorkspaceState((state) => {
+        const workspacePathKey = normalizeWorkspacePathKey(workspace.path);
+        state.workspaces = state.workspaces.filter(
+          (entry) => entry.id !== workspace.id && normalizeWorkspacePathKey(entry.path) !== workspacePathKey,
+        );
+        state.workspaces.push(workspace);
+        state.selectedId = workspace.id;
+        state.activeId = workspace.id;
+        state.watchedId = workspace.id;
+        return state;
+      });
+    }
+    case "workspaceCreateRemote": {
+      const input = args[0] ?? {};
+      const baseUrl = String(input.baseUrl ?? "").trim();
+      if (!baseUrl) throw new Error("baseUrl is required");
+      if (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://")) {
+        throw new Error("baseUrl must start with http:// or https://");
+      }
+      const remoteType = input.remoteType === "opencode" ? "opencode" : "openwork";
+      const directory = typeof input.directory === "string" && input.directory.trim() ? input.directory.trim() : null;
+      const openworkHostUrl = typeof input.openworkHostUrl === "string" && input.openworkHostUrl.trim()
+        ? input.openworkHostUrl.trim()
+        : null;
+      const openworkWorkspaceId = typeof input.openworkWorkspaceId === "string" && input.openworkWorkspaceId.trim()
+        ? input.openworkWorkspaceId.trim()
+        : null;
+      const id = remoteType === "openwork"
+        ? openworkRemoteWorkspaceId(openworkHostUrl ?? baseUrl, openworkWorkspaceId)
+        : remoteWorkspaceId(baseUrl, directory);
+      const workspace = normalizeWorkspaceEntry({
+        id,
+        name: String(input.displayName ?? input.openworkWorkspaceName ?? "Remote workspace"),
+        displayName: input.displayName ?? null,
+        path: directory ?? "",
+        preset: "remote",
+        workspaceType: "remote",
+        remoteType,
+        baseUrl,
+        directory,
+        openworkHostUrl,
+        openworkToken: input.openworkToken ?? null,
+        openworkClientToken: input.openworkClientToken ?? null,
+        openworkHostToken: input.openworkHostToken ?? null,
+        openworkWorkspaceId,
+        openworkWorkspaceName: input.openworkWorkspaceName ?? null,
+        sandboxBackend: input.sandboxBackend ?? null,
+        sandboxRunId: input.sandboxRunId ?? null,
+        sandboxContainerName: input.sandboxContainerName ?? null,
+      });
+      return mutateWorkspaceState((state) => {
+        state.workspaces = state.workspaces.filter((entry) => entry.id !== workspace.id);
+        state.workspaces.push(workspace);
+        state.selectedId = workspace.id;
+        state.activeId = workspace.id;
+        return state;
+      });
+    }
+    case "workspaceUpdateRemote": {
+      const input = args[0] ?? {};
+      const workspaceId = String(input.workspaceId ?? "").trim();
+      if (!workspaceId) throw new Error("workspaceId is required");
+      return mutateWorkspaceState((state) => {
+        state.workspaces = state.workspaces.map((entry) =>
+          entry.id === workspaceId ? { ...entry, ...input } : entry,
+        );
+        return state;
+      });
+    }
+    case "workspaceUpdateDisplayName": {
+      const input = args[0] ?? {};
+      const workspaceId = String(input.workspaceId ?? "").trim();
+      if (!workspaceId) throw new Error("workspaceId is required");
+      return mutateWorkspaceState((state) => {
+        state.workspaces = state.workspaces.map((entry) =>
+          entry.id === workspaceId ? { ...entry, displayName: input.displayName ?? null } : entry,
+        );
+        return state;
+      });
+    }
+    case "workspaceForget": {
+      const workspaceId = String(args[0] ?? "").trim();
+      if (!workspaceId) throw new Error("workspaceId is required");
+      return mutateWorkspaceState((state) => {
+        state.workspaces = state.workspaces.filter((entry) => entry.id !== workspaceId);
+        if (state.selectedId === workspaceId) state.selectedId = "";
+        if (state.activeId === workspaceId) state.activeId = null;
+        if (state.watchedId === workspaceId) state.watchedId = null;
+        return state;
+      });
+    }
+    case "workspaceAddAuthorizedRoot": {
+      const input = args[0] ?? {};
+      const workspacePath = String(input.workspacePath ?? "").trim();
+      const authorizedRoot = String(input.folderPath ?? input.authorizedRoot ?? "").trim();
+      if (!workspacePath || !authorizedRoot) {
+        throw new Error("workspacePath and folderPath are required");
+      }
+      const config = await readWorkspaceOpenworkConfig(workspacePath);
+      if (!Array.isArray(config.authorizedRoots)) {
+        config.authorizedRoots = [];
+      }
+      if (!config.authorizedRoots.includes(authorizedRoot)) {
+        config.authorizedRoots.push(authorizedRoot);
+      }
+      return writeWorkspaceOpenworkConfig(workspacePath, config);
+    }
+    case "workspaceOpenworkRead":
+      return readWorkspaceOpenworkConfig(String(args[0]?.workspacePath ?? "").trim());
+    case "workspaceOpenworkWrite":
+      return writeWorkspaceOpenworkConfig(
+        String(args[0]?.workspacePath ?? "").trim(),
+        args[0]?.config ?? defaultWorkspaceOpenworkConfig(""),
+      );
+    case "workspaceExportConfig": {
+      const input = args[0] ?? {};
+      const workspaceId = String(input.workspaceId ?? "").trim();
+      const outputPath = String(input.outputPath ?? "").trim();
+      if (!workspaceId) throw new Error("workspaceId is required");
+      if (!outputPath) throw new Error("outputPath is required");
+      const state = await readWorkspaceState();
+      const workspace = state.workspaces.find((entry) => entry.id === workspaceId);
+      if (!workspace) throw new Error("Unknown workspaceId");
+      return exportWorkspaceConfig({ workspace, outputPath });
+    }
+    case "workspaceImportConfig": {
+      const input = args[0] ?? {};
+      const archivePath = String(input.archivePath ?? "").trim();
+      const targetDirRaw = String(input.targetDir ?? "").trim();
+      if (!archivePath) throw new Error("archivePath is required");
+      if (!targetDirRaw) throw new Error("targetDir is required");
+      const targetDir = await normalizeLocalWorkspacePath(targetDirRaw);
+      const imported = await importWorkspaceConfig({
+        archivePath,
+        targetDir,
+        name: input.name ?? null,
+      });
+      const workspace = normalizeWorkspaceEntry({
+        id: localWorkspaceId(targetDir),
+        name: imported.workspaceName,
+        displayName: null,
+        path: targetDir,
+        preset: imported.preset,
+        workspaceType: "local",
+      });
+      return mutateWorkspaceState((state) => {
+        const workspacePathKey = normalizeWorkspacePathKey(workspace.path);
+        state.workspaces = state.workspaces.filter(
+          (entry) => entry.id !== workspace.id && normalizeWorkspacePathKey(entry.path) !== workspacePathKey,
+        );
+        state.workspaces.push(workspace);
+        state.selectedId = workspace.id;
+        state.activeId = workspace.id;
+        state.watchedId = workspace.id;
+        return state;
+      });
+    }
+    case "opencodeCommandList":
+      return listCommandNames(String(args[0]?.scope ?? "").trim(), String(args[0]?.projectDir ?? "").trim());
+    case "opencodeCommandWrite":
+      return writeCommandFile(
+        String(args[0]?.scope ?? "").trim(),
+        String(args[0]?.projectDir ?? "").trim(),
+        args[0]?.command ?? {},
+      );
+    case "opencodeCommandDelete":
+      return deleteCommandFile(
+        String(args[0]?.scope ?? "").trim(),
+        String(args[0]?.projectDir ?? "").trim(),
+        String(args[0]?.name ?? "").trim(),
+      );
+    case "engineStart": {
+      const projectDir = String(args[0] ?? "").trim();
+      const options = args[1] ?? {};
+      return runtimeManager.engineStart(projectDir, options);
+    }
+    case "prepareFreshRuntime":
+      return runtimeManager.prepareFreshRuntime();
+    case "runtimeBootstrap":
+      return ensureRuntimeBootstrap();
+    case "runtimeStatus":
+      return runtimeManager.runtimeStatus();
+    case "engineStop":
+      return runtimeManager.engineStop();
+    case "engineRestart":
+      return runtimeManager.engineRestart(args[0] ?? {});
+    case "engineInfo":
+      return runtimeManager.engineInfo();
+    case "engineDoctor":
+      return engineDoctor(args[0]);
+    case "engineInstall":
+      return runtimeManager.engineInstall();
+    case "orchestratorStatus": {
+      return runtimeManager.orchestratorStatus();
+    }
+    case "orchestratorWorkspaceActivate": {
+      return runtimeManager.orchestratorWorkspaceActivate(args[0] ?? {});
+    }
+    case "orchestratorInstanceDispose":
+      return runtimeManager.orchestratorInstanceDispose(String(args[0] ?? "").trim());
+    case "appBuildInfo":
+      return {
+        version: app.getVersion(),
+        gitSha: process.env.OPENWORK_GIT_SHA ?? null,
+        buildEpoch: process.env.OPENWORK_BUILD_EPOCH ?? null,
+        openworkDevMode: process.env.OPENWORK_DEV_MODE === "1",
+      };
+    case "getDesktopBootstrapConfig":
+      return getDesktopBootstrapConfig();
+    case "setDesktopBootstrapConfig":
+      return setDesktopBootstrapConfig(args[0] ?? {});
+    case "nukeOpenworkAndOpencodeConfigAndExit": {
+      await rm(app.getPath("userData"), { recursive: true, force: true });
+      app.exit(0);
+      return undefined;
+    }
+    case "orchestratorStartDetached": {
+      return runtimeManager.orchestratorStartDetached(args[0] ?? {});
+    }
+    case "sandboxDoctor":
+      return runtimeManager.sandboxDoctor();
+    case "sandboxStop":
+      return runtimeManager.sandboxStop(String(args[0] ?? "").trim());
+    case "sandboxCleanupOpenworkContainers":
+      return runtimeManager.sandboxCleanupOpenworkContainers();
+    case "sandboxDebugProbe":
+      return runtimeManager.sandboxDebugProbe();
+    case "openworkServerInfo":
+      return runtimeManager.openworkServerInfo();
+    case "openworkServerRestart":
+      return runtimeManager.openworkServerRestart(args[0] ?? {});
+    case "pickDirectory": {
+      const options = args[0] ?? {};
+      /** @type {import("electron").OpenDialogOptions["properties"]} */
+      const properties = options.multiple
+        ? ["openDirectory", "createDirectory", "multiSelections"]
+        : ["openDirectory", "createDirectory"];
+      const result = await dialog.showOpenDialog(activeWindowFromEvent(event), {
+        title: options.title,
+        defaultPath: options.defaultPath,
+        properties,
+      });
+      if (result.canceled) return null;
+      return options.multiple ? result.filePaths : (result.filePaths[0] ?? null);
+    }
+    case "pickFile": {
+      const options = args[0] ?? {};
+      /** @type {import("electron").OpenDialogOptions["properties"]} */
+      const properties = options.multiple ? ["openFile", "multiSelections"] : ["openFile"];
+      const result = await dialog.showOpenDialog(activeWindowFromEvent(event), {
+        title: options.title,
+        defaultPath: options.defaultPath,
+        filters: options.filters,
+        properties,
+      });
+      if (result.canceled) return null;
+      return options.multiple ? result.filePaths : (result.filePaths[0] ?? null);
+    }
+    case "saveFile": {
+      const options = args[0] ?? {};
+      const result = await dialog.showSaveDialog(activeWindowFromEvent(event), {
+        title: options.title,
+        defaultPath: options.defaultPath,
+        filters: options.filters,
+      });
+      return result.canceled ? null : (result.filePath ?? null);
+    }
+    case "importSkill": {
+      const projectDir = String(args[0] ?? "").trim();
+      const sourceDir = String(args[1] ?? "").trim();
+      const overwrite = args[2]?.overwrite === true;
+      if (!projectDir || !sourceDir) {
+        throw new Error("projectDir and sourceDir are required");
+      }
+      const skillRoot = await ensureProjectSkillRoot(projectDir);
+      const name = validateSkillName(path.basename(sourceDir));
+      const destination = path.join(skillRoot, name);
+      if (await pathExists(destination)) {
+        if (!overwrite) {
+          return execResult(false, "", `Skill already exists at ${destination}`);
+        }
+        await rm(destination, { recursive: true, force: true });
+      }
+      await cp(sourceDir, destination, { recursive: true });
+      return execResult(true, `Imported skill to ${destination}`);
+    }
+    case "installSkillTemplate": {
+      const projectDir = String(args[0] ?? "").trim();
+      const name = validateSkillName(args[1]);
+      const content = String(args[2] ?? "");
+      const overwrite = args[3]?.overwrite === true;
+      const skillRoot = await ensureProjectSkillRoot(projectDir);
+      const destination = path.join(skillRoot, name);
+      if (await pathExists(destination)) {
+        if (!overwrite) {
+          return execResult(false, "", `Skill already exists at ${destination}`);
+        }
+        await rm(destination, { recursive: true, force: true });
+      }
+      await mkdir(destination, { recursive: true });
+      await writeFile(path.join(destination, "SKILL.md"), content, "utf8");
+      return execResult(true, `Installed skill to ${destination}`);
+    }
+    case "listLocalSkills":
+      return listLocalSkills(String(args[0] ?? "").trim());
+    case "readLocalSkill": {
+      const projectDir = String(args[0] ?? "").trim();
+      const skillPath = await findSkillFile(projectDir, args[1]);
+      if (!skillPath) {
+        throw new Error("Skill not found");
+      }
+      return { path: skillPath, content: await readFile(skillPath, "utf8") };
+    }
+    case "writeLocalSkill": {
+      const projectDir = String(args[0] ?? "").trim();
+      const skillPath = await findSkillFile(projectDir, args[1]);
+      if (!skillPath) {
+        return execResult(false, "", "Skill not found");
+      }
+      const content = String(args[2] ?? "");
+      const next = content.endsWith("\n") ? content : `${content}\n`;
+      await writeFile(skillPath, next, "utf8");
+      return execResult(true, `Saved skill ${path.basename(path.dirname(skillPath))}`);
+    }
+    case "uninstallSkill": {
+      const projectDir = String(args[0] ?? "").trim();
+      const skillPath = await findSkillFile(projectDir, args[1]);
+      if (!skillPath) {
+        return execResult(false, "", "Skill not found in .opencode/skills or .claude/skills");
+      }
+      await rm(path.dirname(skillPath), { recursive: true, force: true });
+      return execResult(true, `Removed skill ${args[1]}`);
+    }
+    case "updaterEnvironment": {
+      const executablePath = app.isPackaged ? app.getPath("exe") : process.execPath;
+      return {
+        supported: true,
+        reason: null,
+        executablePath,
+        appBundlePath:
+          process.platform === "darwin"
+            ? path.resolve(executablePath, "../../..")
+            : path.dirname(executablePath),
+      };
+    }
+    case "readOpencodeConfig":
+      return readOpencodeConfig(String(args[0] ?? "").trim(), String(args[1] ?? "").trim());
+    case "writeOpencodeConfig":
+      return writeOpencodeConfig(
+        String(args[0] ?? "").trim(),
+        String(args[1] ?? "").trim(),
+        String(args[2] ?? ""),
+      );
+    case "resetOpenworkState": {
+      await rm(workspaceStatePath(), { force: true });
+      await rm(desktopBootstrapPath(), { force: true });
+      return undefined;
+    }
+    case "resetOpencodeCache":
+      return { removed: [], missing: [], errors: [] };
+    case "opencodeMcpAuth":
+      return runtimeManager.opencodeMcpAuth(String(args[0] ?? "").trim(), String(args[1] ?? "").trim());
+    case "setWindowDecorations":
+      return undefined;
+    case "__openPath": {
+      const target = String(args[0] ?? "").trim();
+      if (!target) return "Path is required.";
+      return shell.openPath(target);
+    }
+    case "__revealItemInDir": {
+      const target = String(args[0] ?? "").trim();
+      if (!target) return undefined;
+      shell.showItemInFolder(target);
+      return undefined;
+    }
+    case "__fetch": {
+      const url = String(args[0] ?? "").trim();
+      const init = args[1] ?? {};
+      if (!url) throw new Error("URL is required.");
+      const response = await fetch(url, {
+        method: typeof init.method === "string" ? init.method : undefined,
+        headers: init.headers && typeof init.headers === "object" ? init.headers : undefined,
+        body: typeof init.body === "string" ? init.body : undefined,
+      });
+      return {
+        status: response.status,
+        statusText: response.statusText,
+        headers: Array.from(response.headers.entries()),
+        body: await response.text(),
+      };
+    }
+    case "__homeDir":
+      return os.homedir();
+    case "__joinPath":
+      return path.join(...args.map((value) => String(value ?? "")));
+    case "__setZoomFactor": {
+      const factor = Number(args[0]);
+      const window = activeWindowFromEvent(event);
+      if (!window || !Number.isFinite(factor) || factor <= 0) {
+        return false;
+      }
+      window.webContents.setZoomFactor(factor);
+      return true;
+    }
+    default:
+      throw new Error(`Electron desktop bridge method is not implemented yet: ${command}`);
+  }
+}
+
+function sendJsonResponse(response, statusCode, payload) {
+  response.writeHead(statusCode, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Cache-Control": "no-store",
+  });
+  response.end(JSON.stringify(payload));
+}
+
+function readJsonRequestBody(request) {
+  return new Promise((resolve, reject) => {
+    let raw = "";
+    request.setEncoding("utf8");
+    request.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > 128_000) {
+        reject(new Error("Request body too large"));
+        request.destroy();
+      }
+    });
+    request.on("end", () => {
+      if (!raw.trim()) {
+        resolve({});
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("Request body must be JSON"));
+      }
+    });
+    request.on("error", reject);
+  });
+}
+
+function authorizedUiControlRequest(request) {
+  const auth = request.headers.authorization ?? "";
+  return auth === `Bearer ${uiControlToken}`;
+}
+
+function jsonForJavaScript(value) {
+  return JSON.stringify(JSON.stringify(value ?? {}));
+}
+
+async function evaluateOpenworkControl(expression, options = {}) {
+  const win = await createMainWindow();
+  if (options.focus === true) {
+    win.show();
+    if (win.isMinimized()) win.restore();
+    win.focus();
+  }
+  return win.webContents.executeJavaScript(expression, true);
+}
+
+async function runOpenworkControlCommand(command, args = {}) {
+  const argsJsonLiteral = jsonForJavaScript(args);
+  if (command === "snapshot") {
+    return evaluateOpenworkControl(`(async () => {
+      const control = window.__openworkControl;
+      if (!control) return { ok: false, error: "OpenWork control surface is not available yet." };
+      control.setEnabled?.(true);
+      return { ok: true, ...control.snapshot() };
+    })()`);
+  }
+  if (command === "actions") {
+    return evaluateOpenworkControl(`(async () => {
+      const control = window.__openworkControl;
+      if (!control) return { ok: false, error: "OpenWork control surface is not available yet." };
+      control.setEnabled?.(true);
+      return { ok: true, actions: control.listActions() };
+    })()`);
+  }
+  if (command === "execute") {
+    return evaluateOpenworkControl(`(async () => {
+      const control = window.__openworkControl;
+      const input = JSON.parse(${argsJsonLiteral});
+      if (!control) return { ok: false, error: "OpenWork control surface is not available yet." };
+      if (!input || typeof input.actionId !== "string" || !input.actionId.trim()) {
+        return { ok: false, error: "Missing OpenWork actionId." };
+      }
+      control.setEnabled?.(true);
+      return control.execute(input.actionId, input.args ?? {});
+    })()`, { focus: true });
+  }
+  return { ok: false, error: `Unknown OpenWork control command: ${command}` };
+}
+
+async function startUiControlServer() {
+  if (uiControlServer) return;
+  uiControlServer = createServer(async (request, response) => {
+    try {
+      const url = new URL(request.url ?? "/", "http://127.0.0.1");
+      if (request.method === "GET" && url.pathname === "/health") {
+        sendJsonResponse(response, 200, { ok: true, app: APP_NAME, version: 1 });
+        return;
+      }
+      if (!authorizedUiControlRequest(request)) {
+        sendJsonResponse(response, 401, { ok: false, error: "Unauthorized" });
+        return;
+      }
+      if (request.method === "GET" && url.pathname === "/snapshot") {
+        sendJsonResponse(response, 200, await runOpenworkControlCommand("snapshot"));
+        return;
+      }
+      if (request.method === "GET" && url.pathname === "/actions") {
+        sendJsonResponse(response, 200, await runOpenworkControlCommand("actions"));
+        return;
+      }
+      if (request.method === "POST" && url.pathname === "/execute") {
+        sendJsonResponse(response, 200, await runOpenworkControlCommand("execute", await readJsonRequestBody(request)));
+        return;
+      }
+      sendJsonResponse(response, 404, { ok: false, error: "Not found" });
+    } catch (error) {
+      sendJsonResponse(response, 500, { ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+  await new Promise((resolve, reject) => {
+    uiControlServer.once("error", reject);
+    uiControlServer.listen(0, "127.0.0.1", () => resolve(undefined));
+  });
+  const address = uiControlServer.address();
+  const port = typeof address === "object" && address ? address.port : null;
+  if (!port) throw new Error("Could not start OpenWork UI control bridge.");
+  uiControlDiscoveryPath = path.join(app.getPath("userData"), "openwork-ui-control.json");
+  await writeFile(
+    uiControlDiscoveryPath,
+    `${JSON.stringify({ version: 1, app: APP_NAME, identifier: APP_IDENTIFIER, platform: process.platform, baseUrl: `http://127.0.0.1:${port}`, token: uiControlToken }, null, 2)}\n`,
+    "utf8",
+  );
+}
+
+async function stopUiControlServer() {
+  if (uiControlDiscoveryPath) {
+    await rm(uiControlDiscoveryPath, { force: true }).catch(() => undefined);
+    uiControlDiscoveryPath = null;
+  }
+  if (!uiControlServer) return;
+  await new Promise((resolve) => uiControlServer.close(() => resolve(undefined)));
+  uiControlServer = null;
+}
+
+async function createMainWindow() {
+  if (mainWindow) return mainWindow;
+
+  const preloadPath = path.join(__dirname, "preload.mjs");
+  mainWindow = new BrowserWindow({
+    width: 1180,
+    height: 820,
+    title: APP_NAME,
+    show: false,
+    ...(APP_ICON_IMAGE && !APP_ICON_IMAGE.isEmpty() ? { icon: APP_ICON_IMAGE } : {}),
+    webPreferences: {
+      preload: preloadPath,
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: false,
+    },
+  });
+
+  if (isDevMode) {
+    mainWindow.on("page-title-updated", (event) => {
+      event.preventDefault();
+      mainWindow?.setTitle(APP_NAME);
+    });
+    mainWindow.setTitle(APP_NAME);
+  }
+
+  mainWindow.once("ready-to-show", () => {
+    if (isDevMode) {
+      mainWindow?.setTitle(APP_NAME);
+    }
+    mainWindow?.show();
+    flushPendingDeepLinks();
+  });
+
+  mainWindow.on("closed", () => {
+    mainWindow = null;
+  });
+
+  mainWindow.webContents.setWindowOpenHandler(({ url }) => {
+    const local =
+      url.startsWith("file://") ||
+      url.startsWith("http://127.0.0.1") ||
+      url.startsWith("http://localhost");
+    if (!local) {
+      void shell.openExternal(url);
+      return { action: "deny" };
+    }
+    return { action: "allow" };
+  });
+
+  const startUrl = process.env.OPENWORK_ELECTRON_START_URL?.trim() || process.env.ELECTRON_START_URL?.trim();
+  if (startUrl) {
+    await mainWindow.loadURL(startUrl);
+  } else {
+    const packagedIndexPath = path.join(process.resourcesPath, "app-dist", "index.html");
+    const devIndexPath = path.resolve(__dirname, "../../app/dist/index.html");
+    await mainWindow.loadFile(app.isPackaged ? packagedIndexPath : devIndexPath);
+  }
+
+  return mainWindow;
+}
+
+ipcMain.handle("openwork:desktop", handleDesktopInvoke);
+ipcMain.handle("openwork:shell:openExternal", async (_event, url) => {
+  if (typeof url === "string" && url.trim().length > 0) {
+    await shell.openExternal(url);
+  }
+});
+ipcMain.handle("openwork:shell:relaunch", async () => {
+  app.relaunch();
+  app.exit(0);
+});
+
+registerMigrationIpc({ app, ipcMain });
+const { ensureAutoUpdater } = registerUpdaterIpc({ app, ipcMain, getMainWindow: () => mainWindow });
+
+if (!app.requestSingleInstanceLock()) {
+  app.quit();
+} else {
+  app.on("before-quit", (event) => {
+    if (runtimeDisposedForQuit) return;
+    event.preventDefault();
+    void Promise.all([disposeRuntimeBeforeQuit(), stopUiControlServer()]).finally(() => app.quit());
+  });
+
+  app.on("second-instance", async (_event, argv) => {
+    const win = await createMainWindow();
+    if (win.isMinimized()) {
+      win.restore();
+    }
+    win.show();
+    win.focus();
+    queueDeepLinks(forwardedDeepLinks(argv));
+  });
+
+  app.on("open-url", async (event, url) => {
+    event.preventDefault();
+    await createMainWindow();
+    queueDeepLinks([url]);
+  });
+
+  app.whenReady().then(async () => {
+    await installReactDevToolsForDev();
+    await runtimeManager.prepareFreshRuntime().catch(() => undefined);
+
+    // Use Tauri's existing workspace state file as canonical so rollback and
+    // Electron see the same workspace list. Import the short-lived
+    // Electron-only filename only when the shared file is missing.
+    await migrateLegacyElectronWorkspaceStateIfNeeded();
+    await startUiControlServer().catch((error) => {
+      console.warn("[ui-control] failed to start", error);
+    });
+    runtimeBootstrapPromise = bootRuntimeForSelectedWorkspace().catch((error) => ({
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    }));
+
+    queueDeepLinks(forwardedDeepLinks(process.argv));
+    const win = await createMainWindow();
+    win.webContents.on("did-finish-load", () => {
+      flushPendingDeepLinks();
+    });
+
+    // Kick the packaged-only updater after the window is up so the user
+    // sees a working app first. This is a no-op in dev.
+    void ensureAutoUpdater().then((updater) => {
+      if (!updater) return;
+      void updater.checkForUpdates().catch(() => undefined);
+    });
+  });
+
+  app.on("activate", async () => {
+    if (BrowserWindow.getAllWindows().length === 0) {
+      await createMainWindow();
+      return;
+    }
+    const win = await createMainWindow();
+    win.show();
+    win.focus();
+  });
+
+  app.on("window-all-closed", () => {
+    if (process.platform !== "darwin") {
+      app.quit();
+    }
+  });
+}
diff --git a/apps/desktop/electron/migration.mjs b/apps/desktop/electron/migration.mjs
new file mode 100644
index 0000000000..0c14a704a5
--- /dev/null
+++ b/apps/desktop/electron/migration.mjs
@@ -0,0 +1,49 @@
+import { existsSync } from "node:fs";
+import { readFile, rename } from "node:fs/promises";
+import path from "node:path";
+
+const MIGRATION_SNAPSHOT_FILENAME = "migration-snapshot.v1.json";
+const MIGRATION_SNAPSHOT_DONE_FILENAME = "migration-snapshot.v1.done.json";
+
+function migrationSnapshotPath(app, done = false) {
+  return path.join(
+    app.getPath("userData"),
+    done ? MIGRATION_SNAPSHOT_DONE_FILENAME : MIGRATION_SNAPSHOT_FILENAME,
+  );
+}
+
+// Migration snapshot: one-way handoff from the last Tauri release into the
+// first Electron launch. The Tauri shell writes migration-snapshot.v1.json
+// into app_data_dir before it kicks off the Electron installer. Electron
+// renders the workspace list / session-by-workspace preferences from it on
+// first boot and then marks it .done so subsequent boots don't re-import.
+export function registerMigrationIpc({ app, ipcMain }) {
+  ipcMain.handle("openwork:migration:read", async () => {
+    const snapshotPath = migrationSnapshotPath(app);
+    if (!existsSync(snapshotPath)) return null;
+    try {
+      const raw = await readFile(snapshotPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object" && parsed.version === 1) {
+        return parsed;
+      }
+      return null;
+    } catch (error) {
+      console.warn("[migration] failed to read snapshot", error);
+      return null;
+    }
+  });
+
+  ipcMain.handle("openwork:migration:ack", async () => {
+    const snapshotPath = migrationSnapshotPath(app);
+    const donePath = migrationSnapshotPath(app, true);
+    if (!existsSync(snapshotPath)) return { ok: true, moved: false };
+    try {
+      await rename(snapshotPath, donePath);
+      return { ok: true, moved: true };
+    } catch (error) {
+      console.warn("[migration] failed to rename snapshot", error);
+      return { ok: false, moved: false };
+    }
+  });
+}
diff --git a/apps/desktop/electron/preload.mjs b/apps/desktop/electron/preload.mjs
new file mode 100644
index 0000000000..8591b2f39c
--- /dev/null
+++ b/apps/desktop/electron/preload.mjs
@@ -0,0 +1,66 @@
+import { contextBridge, ipcRenderer } from "electron";
+
+const NATIVE_DEEP_LINK_EVENT = "openwork:deep-link-native";
+
+function normalizePlatform(value) {
+  if (value === "darwin" || value === "linux") return value;
+  if (value === "win32") return "windows";
+  return "linux";
+}
+
+contextBridge.exposeInMainWorld("__OPENWORK_ELECTRON__", {
+  invokeDesktop(command, ...args) {
+    return ipcRenderer.invoke("openwork:desktop", command, ...args);
+  },
+  shell: {
+    openExternal(url) {
+      return ipcRenderer.invoke("openwork:shell:openExternal", url);
+    },
+    relaunch() {
+      return ipcRenderer.invoke("openwork:shell:relaunch");
+    },
+  },
+  migration: {
+    readSnapshot() {
+      return ipcRenderer.invoke("openwork:migration:read");
+    },
+    ackSnapshot() {
+      return ipcRenderer.invoke("openwork:migration:ack");
+    },
+  },
+  updater: {
+    getChannel() {
+      return ipcRenderer.invoke("openwork:updater:getChannel");
+    },
+    setChannel(channel) {
+      return ipcRenderer.invoke("openwork:updater:setChannel", channel);
+    },
+    check() {
+      return ipcRenderer.invoke("openwork:updater:check");
+    },
+    download() {
+      return ipcRenderer.invoke("openwork:updater:download");
+    },
+    installAndRestart() {
+      return ipcRenderer.invoke("openwork:updater:installAndRestart");
+    },
+    /** Subscribe to incremental download progress from electron-updater. */
+    onDownloadProgress(callback) {
+      const handler = (_event, data) => callback(data);
+      ipcRenderer.on("openwork:updater:download-progress", handler);
+      return () => {
+        ipcRenderer.removeListener("openwork:updater:download-progress", handler);
+      };
+    },
+  },
+  meta: {
+    initialDeepLinks: [],
+    platform: normalizePlatform(process.platform),
+    version: process.versions.electron,
+  },
+});
+
+ipcRenderer.on(NATIVE_DEEP_LINK_EVENT, (_event, urls) => {
+  if (typeof window === "undefined") return;
+  window.dispatchEvent(new CustomEvent(NATIVE_DEEP_LINK_EVENT, { detail: urls }));
+});
diff --git a/apps/desktop/electron/runtime.mjs b/apps/desktop/electron/runtime.mjs
new file mode 100644
index 0000000000..a3ac971869
--- /dev/null
+++ b/apps/desktop/electron/runtime.mjs
@@ -0,0 +1,1737 @@
+import { randomUUID } from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+const DIRECT_RUNTIME = "direct";
+const ORCHESTRATOR_RUNTIME = "openwork-orchestrator";
+const OPENWORK_SERVER_PORT_RANGE_START = 48_000;
+const OPENWORK_SERVER_PORT_RANGE_END = 51_000;
+
+function truncateOutput(value, limit = 8000) {
+  const text = String(value ?? "");
+  return text.length <= limit ? text : text.slice(text.length - limit);
+}
+
+function appendOutput(state, key, chunk) {
+  const next = `${state[key] ?? ""}${String(chunk ?? "")}`;
+  state[key] = truncateOutput(next);
+}
+
+function normalizeWorkspaceKey(value) {
+  const trimmed = String(value ?? "").trim();
+  if (!trimmed) return "";
+  return path.resolve(trimmed).replace(/\\/g, "/").toLowerCase();
+}
+
+function nowMs() {
+  return Date.now();
+}
+
+function createEngineState() {
+  return {
+    child: null,
+    childExited: true,
+    runtime: DIRECT_RUNTIME,
+    projectDir: null,
+    hostname: null,
+    port: null,
+    baseUrl: null,
+    opencodeUsername: null,
+    opencodePassword: null,
+    opencodeBinPath: null,
+    opencodeBinSource: null,
+    lastStdout: null,
+    lastStderr: null,
+  };
+}
+
+function snapshotEngineState(state) {
+  const child = state.childExited ? null : state.child;
+  return {
+    running: Boolean(child && child.exitCode === null && !child.killed),
+    runtime: state.runtime,
+    baseUrl: state.baseUrl,
+    projectDir: state.projectDir,
+    hostname: state.hostname,
+    port: state.port,
+    opencodeUsername: state.opencodeUsername,
+    opencodePassword: state.opencodePassword,
+    opencodeBinPath: state.opencodeBinPath,
+    opencodeBinSource: state.opencodeBinSource,
+    pid: child?.pid ?? null,
+    lastStdout: state.lastStdout,
+    lastStderr: state.lastStderr,
+  };
+}
+
+function createOpenworkServerState() {
+  return {
+    child: null,
+    childExited: true,
+    remoteAccessEnabled: false,
+    host: null,
+    port: null,
+    baseUrl: null,
+    connectUrl: null,
+    mdnsUrl: null,
+    lanUrl: null,
+    clientToken: null,
+    ownerToken: null,
+    hostToken: null,
+    managedOpencodeBinPath: null,
+    managedOpencodeBinSource: null,
+    lastStdout: null,
+    lastStderr: null,
+  };
+}
+
+function snapshotOpenworkServerState(state) {
+  const child = state.childExited ? null : state.child;
+  return {
+    running: Boolean(child && child.exitCode === null && !child.killed),
+    remoteAccessEnabled: state.remoteAccessEnabled,
+    host: state.host,
+    port: state.port,
+    baseUrl: state.baseUrl,
+    connectUrl: state.connectUrl,
+    mdnsUrl: state.mdnsUrl,
+    lanUrl: state.lanUrl,
+    clientToken: state.clientToken,
+    ownerToken: state.ownerToken,
+    hostToken: state.hostToken,
+    managedOpencodeBinPath: state.managedOpencodeBinPath,
+    managedOpencodeBinSource: state.managedOpencodeBinSource,
+    pid: child?.pid ?? null,
+    lastStdout: state.lastStdout,
+    lastStderr: state.lastStderr,
+  };
+}
+
+function assertOpenworkServerReady(snapshot) {
+  if (!snapshot?.running) {
+    throw new Error("OpenWork server did not stay running after startup.");
+  }
+  if (!snapshot.baseUrl) {
+    throw new Error("OpenWork server did not report a base URL after startup.");
+  }
+  if (!snapshot.ownerToken && !snapshot.clientToken) {
+    throw new Error("OpenWork server did not report an access token after startup.");
+  }
+  return snapshot;
+}
+
+function createOrchestratorState() {
+  return {
+    child: null,
+    childExited: true,
+    dataDir: null,
+    baseUrl: null,
+    daemonPort: null,
+    lastStdout: null,
+    lastStderr: null,
+  };
+}
+
+async function fileExists(targetPath) {
+  try {
+    await readFile(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function readJsonFile(targetPath, fallback) {
+  try {
+    const raw = await readFile(targetPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+
+function selectLanAddress() {
+  const interfaces = os.networkInterfaces();
+  for (const entries of Object.values(interfaces)) {
+    for (const entry of entries ?? []) {
+      if (entry && entry.family === "IPv4" && entry.internal === false) {
+        return entry.address;
+      }
+    }
+  }
+  return null;
+}
+
+function buildConnectUrls(port) {
+  const hostname = os.hostname().trim();
+  const mdnsUrl = hostname ? `http://${hostname.replace(/\.local$/i, "")}.local:${port}` : null;
+  const lan = selectLanAddress();
+  const lanUrl = lan ? `http://${lan}:${port}` : null;
+  return {
+    connectUrl: lanUrl ?? mdnsUrl,
+    mdnsUrl,
+    lanUrl,
+  };
+}
+
+function targetTriple() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "aarch64-unknown-linux-gnu" : "x86_64-unknown-linux-gnu";
+  }
+  if (process.platform === "win32") {
+    return process.arch === "arm64" ? "aarch64-pc-windows-msvc" : "x86_64-pc-windows-msvc";
+  }
+  return null;
+}
+
+function binaryFileNames(baseName) {
+  const ext = process.platform === "win32" ? ".exe" : "";
+  const triple = targetTriple();
+  return [
+    triple ? `${baseName}-${triple}${ext}` : null,
+    `${baseName}${ext}`,
+  ].filter(Boolean);
+}
+
+function isDirectory(targetPath) {
+  try {
+    return statSync(targetPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function nvmVersionBinPaths(home) {
+  const base = path.join(home, ".nvm", "versions", "node");
+  try {
+    return readdirSync(base, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => path.join(base, entry.name, "bin"))
+      .filter(isDirectory)
+      .sort()
+      .reverse();
+  } catch {
+    return [];
+  }
+}
+
+function pathHelperEntries() {
+  if (process.platform !== "darwin") return [];
+  const result = spawnSync("/usr/libexec/path_helper", ["-s"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  if (result.status !== 0) return [];
+  const stdout = String(result.stdout ?? "");
+  const match = stdout.match(/PATH="([^"]+)"/) ?? stdout.match(/PATH=([^;\n]+)/);
+  return match?.[1]?.split(path.delimiter).filter(Boolean) ?? [];
+}
+
+function extraPathEntries() {
+  const home = os.homedir();
+  const candidates = [];
+
+  if (process.platform === "darwin") {
+    candidates.push(
+      ...pathHelperEntries(),
+      "/opt/homebrew/bin",
+      "/opt/homebrew/sbin",
+      "/usr/local/bin",
+      "/usr/local/sbin",
+      path.join(home, ".nvm", "current", "bin"),
+      ...nvmVersionBinPaths(home),
+      path.join(home, ".fnm", "current", "bin"),
+      path.join(home, ".volta", "bin"),
+      path.join(home, "Library", "pnpm"),
+      path.join(home, ".bun", "bin"),
+      path.join(home, ".cargo", "bin"),
+      path.join(home, ".pyenv", "shims"),
+      path.join(home, ".local", "bin"),
+    );
+  }
+
+  if (process.platform === "linux") {
+    candidates.push(
+      "/usr/local/bin",
+      "/usr/local/sbin",
+      path.join(home, ".nvm", "current", "bin"),
+      ...nvmVersionBinPaths(home),
+      path.join(home, ".fnm", "current", "bin"),
+      path.join(home, ".volta", "bin"),
+      path.join(home, ".local", "share", "pnpm"),
+      path.join(home, ".bun", "bin"),
+      path.join(home, ".cargo", "bin"),
+      path.join(home, ".pyenv", "shims"),
+      path.join(home, ".local", "bin"),
+    );
+  }
+
+  if (process.platform === "win32") {
+    candidates.push(
+      path.join(home, ".volta", "bin"),
+      path.join(home, ".bun", "bin"),
+      path.join(home, ".cargo", "bin"),
+      process.env.APPDATA ? path.join(process.env.APPDATA, "npm") : null,
+      process.env.LOCALAPPDATA ? path.join(process.env.LOCALAPPDATA, "pnpm") : null,
+    );
+  }
+
+  return candidates.filter((entry) => entry && isDirectory(entry));
+}
+
+function enrichedPath(sidecarDirs, currentPath) {
+  const entries = [
+    ...sidecarDirs.filter(isDirectory),
+    ...extraPathEntries(),
+    ...String(currentPath ?? "").split(path.delimiter).filter(Boolean),
+  ];
+  const deduped = entries.filter((entry, index) => entries.indexOf(entry) === index);
+  return deduped.length > 0 ? deduped.join(path.delimiter) : null;
+}
+
+async function portAvailable(host, port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.unref();
+    server.once("error", () => resolve(false));
+    server.listen({ host, port }, () => {
+      server.close(() => resolve(true));
+    });
+  });
+}
+
+async function findFreePort(host = "127.0.0.1") {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.unref();
+    server.once("error", reject);
+    server.listen({ host, port: 0 }, () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(() => reject(new Error("Failed to allocate a free port.")));
+        return;
+      }
+      const { port } = address;
+      server.close(() => resolve(port));
+    });
+  });
+}
+
+async function waitForHttpOk(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError = "Request did not succeed.";
+
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) {
+        return response;
+      }
+      lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 200));
+  }
+
+  throw new Error(lastError);
+}
+
+async function fetchJson(url, options = {}, timeoutMs = 3000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, {
+      ...options,
+      signal: controller.signal,
+      headers: {
+        Accept: "application/json",
+        ...(options.headers ?? {}),
+      },
+    });
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`);
+    }
+    return await response.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// Resolves ~/.config/openwork/env.json (or %APPDATA%\openwork\env.json on
+// Windows) — must agree byte-for-byte with apps/server/src/env-file.ts and
+// apps/desktop/src-tauri/src/env_file.rs. Honor OPENWORK_ENV_STORE override.
+function resolveUserEnvFilePath() {
+  const override = String(process.env.OPENWORK_ENV_STORE ?? "").trim();
+  if (override) return path.resolve(override);
+  if (process.platform === "win32") {
+    const appData = String(process.env.APPDATA ?? "").trim();
+    const root = appData || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(root, "openwork", "env.json");
+  }
+  return path.join(os.homedir(), ".config", "openwork", "env.json");
+}
+
+const USER_ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const USER_ENV_RESERVED_PREFIXES = ["OPENWORK_", "OPENCODE_"];
+
+// Synchronous, best-effort; absent or malformed returns {}. Reserved prefixes
+// are stripped so a tampered file can never shadow OPENWORK_* / OPENCODE_*.
+function loadUserEnvFile() {
+  try {
+    const raw = readFileSync(resolveUserEnvFilePath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || !Array.isArray(parsed.variables)) return {};
+    const out = {};
+    for (const entry of parsed.variables) {
+      if (!entry || typeof entry !== "object") continue;
+      const { key, value } = entry;
+      if (typeof key !== "string" || typeof value !== "string") continue;
+      if (!USER_ENV_KEY_PATTERN.test(key)) continue;
+      if (USER_ENV_RESERVED_PREFIXES.some((p) => key.startsWith(p))) continue;
+      out[key] = value;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+export function createRuntimeManager({ app, desktopRoot, listLocalWorkspacePaths }) {
+  const engineState = createEngineState();
+  const openworkServerState = createOpenworkServerState();
+  const orchestratorState = createOrchestratorState();
+
+  // Serialize engine lifecycle operations. Without this, concurrent renderer
+  // invocations of engineStart/engineStop/engineRestart race: each call's
+  // stopAllRuntimeChildren kills the previous call's freshly-spawned
+  // orchestrator daemon, and the prior call then times out its /health probe.
+  let runtimeLifecycleQueue = Promise.resolve();
+  let lifecycleState = "idle";
+  function withRuntimeLifecycle(fn) {
+    const next = runtimeLifecycleQueue.then(fn, fn);
+    runtimeLifecycleQueue = next.catch(() => {});
+    return next;
+  }
+
+  const userDataDir = app.getPath("userData");
+  const sidecarDirs = [
+    path.join(desktopRoot, "resources", "sidecars"),
+    process.resourcesPath ? path.join(process.resourcesPath, "sidecars") : null,
+    path.join(path.dirname(app.getPath("exe")), "sidecars"),
+  ].filter(Boolean);
+
+  function openworkServerTokenStorePath() {
+    return path.join(userDataDir, "openwork-server-tokens.json");
+  }
+
+  function openworkServerStatePath() {
+    return path.join(userDataDir, "openwork-server-state.json");
+  }
+
+  function managedOpencodeWorkdir() {
+    return path.join(userDataDir, "managed-opencode-workdir");
+  }
+
+  function orchestratorDataDir() {
+    const envDir = process.env.OPENWORK_DATA_DIR?.trim();
+    if (envDir) return envDir;
+    return path.join(app.getPath("home"), ".openwork", "openwork-orchestrator");
+  }
+
+  function orchestratorStatePath(dataDir) {
+    return path.join(dataDir, "openwork-orchestrator-state.json");
+  }
+
+  function orchestratorAuthPath(dataDir) {
+    return path.join(dataDir, "openwork-orchestrator-auth.json");
+  }
+
+  async function readOrchestratorStateFile(dataDir) {
+    return readJsonFile(orchestratorStatePath(dataDir), null);
+  }
+
+  async function readOrchestratorAuthFile(dataDir) {
+    return readJsonFile(orchestratorAuthPath(dataDir), null);
+  }
+
+  async function writeOrchestratorAuthFile(dataDir, auth) {
+    const filePath = orchestratorAuthPath(dataDir);
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, `${JSON.stringify({ ...auth, updatedAt: nowMs() }, null, 2)}\n`, "utf8");
+  }
+
+  async function clearOrchestratorAuthFile(dataDir) {
+    await rm(orchestratorAuthPath(dataDir), { force: true });
+  }
+
+  async function requestOrchestratorShutdown(dataDir) {
+    const state = await readOrchestratorStateFile(dataDir);
+    const baseUrl = state?.daemon?.baseUrl?.trim();
+    if (!baseUrl) return false;
+    try {
+      await fetch(`${baseUrl.replace(/\/+$/, "")}/shutdown`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  async function loadTokenStore() {
+    return readJsonFile(openworkServerTokenStorePath(), { version: 1, workspaces: {} });
+  }
+
+  async function saveTokenStore(store) {
+    const filePath = openworkServerTokenStorePath();
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, `${JSON.stringify(store, null, 2)}\n`, "utf8");
+  }
+
+  async function loadPortState() {
+    return readJsonFile(openworkServerStatePath(), {
+      version: 3,
+      workspacePorts: {},
+      preferredPort: null,
+    });
+  }
+
+  async function savePortState(state) {
+    const filePath = openworkServerStatePath();
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+  }
+
+  async function loadOrCreateWorkspaceTokens(workspaceKey) {
+    const store = await loadTokenStore();
+    const normalized = normalizeWorkspaceKey(workspaceKey);
+    if (store.workspaces?.[normalized]) {
+      return store.workspaces[normalized];
+    }
+    const next = {
+      clientToken: randomUUID(),
+      hostToken: randomUUID(),
+      ownerToken: null,
+      updatedAt: nowMs(),
+    };
+    store.workspaces ??= {};
+    store.workspaces[normalized] = next;
+    await saveTokenStore(store);
+    return next;
+  }
+
+  async function persistWorkspaceOwnerToken(workspaceKey, ownerToken) {
+    const store = await loadTokenStore();
+    const normalized = normalizeWorkspaceKey(workspaceKey);
+    if (!store.workspaces?.[normalized]) return;
+    store.workspaces[normalized].ownerToken = ownerToken;
+    store.workspaces[normalized].updatedAt = nowMs();
+    await saveTokenStore(store);
+  }
+
+  async function readPreferredOpenworkPort(workspaceKey) {
+    const state = await loadPortState();
+    const normalized = normalizeWorkspaceKey(workspaceKey);
+    if (normalized && state.workspacePorts?.[normalized]) {
+      return state.workspacePorts[normalized];
+    }
+    return state.preferredPort ?? null;
+  }
+
+  async function persistPreferredOpenworkPort(workspaceKey, port) {
+    const state = await loadPortState();
+    const normalized = normalizeWorkspaceKey(workspaceKey);
+    state.version = 3;
+    state.workspacePorts ??= {};
+    if (normalized) {
+      state.workspacePorts[normalized] = port;
+      state.preferredPort = null;
+    } else {
+      state.preferredPort = port;
+    }
+    await savePortState(state);
+  }
+
+  async function resolveOpenworkPort(host, workspaceKey) {
+    // Use a fresh port every boot. Persisted preferred ports made prod starts
+    // fragile when an old sidecar held the previous port or shutdown was
+    // unclean; Electron publishes the chosen URL to React after boot.
+    return findFreePort(host);
+  }
+
+  async function ensureDevModePaths() {
+    const root = path.join(userDataDir, "openwork-dev-data");
+    const paths = {
+      homeDir: path.join(root, "home"),
+      xdgConfigHome: path.join(root, "xdg", "config"),
+      xdgDataHome: path.join(root, "xdg", "data"),
+      xdgCacheHome: path.join(root, "xdg", "cache"),
+      xdgStateHome: path.join(root, "xdg", "state"),
+      opencodeConfigDir: path.join(root, "config", "opencode"),
+    };
+
+    for (const dir of Object.values(paths)) {
+      await mkdir(dir, { recursive: true });
+    }
+    await mkdir(path.join(paths.xdgDataHome, "opencode"), { recursive: true });
+    return paths;
+  }
+
+  async function buildChildEnv(extra = {}) {
+    /** @type {NodeJS.ProcessEnv} */
+    // User env is layered first so process.env + any caller overrides always
+    // win. See apps/server/src/env-file.ts and src-tauri/src/env_file.rs —
+    // all three loaders must agree on path + reserved-keys policy.
+    const env = {
+      ...loadUserEnvFile(),
+      ...process.env,
+      BUN_CONFIG_DNS_RESULT_ORDER: "verbatim",
+      ...extra,
+    };
+    const pathKey =
+      Object.prototype.hasOwnProperty.call(env, "PATH") ||
+      !Object.prototype.hasOwnProperty.call(env, "Path")
+        ? "PATH"
+        : "Path";
+    const pathEnv = enrichedPath(sidecarDirs, env[pathKey]);
+    if (pathEnv) {
+      env[pathKey] = pathEnv;
+    }
+    if (process.env.OPENWORK_DEV_MODE === "1") {
+      const devPaths = await ensureDevModePaths();
+      env.OPENWORK_DEV_MODE = "1";
+      env.HOME = devPaths.homeDir;
+      env.USERPROFILE = devPaths.homeDir;
+      env.XDG_CONFIG_HOME = devPaths.xdgConfigHome;
+      env.XDG_DATA_HOME = devPaths.xdgDataHome;
+      env.XDG_CACHE_HOME = devPaths.xdgCacheHome;
+      env.XDG_STATE_HOME = devPaths.xdgStateHome;
+      env.OPENCODE_CONFIG_DIR = devPaths.opencodeConfigDir;
+      env.OPENCODE_TEST_HOME = devPaths.homeDir;
+    }
+    return env;
+  }
+
+  function resolveBinaryInfo(baseName, extraPaths = []) {
+    for (const directory of [...sidecarDirs, ...extraPaths]) {
+      for (const fileName of binaryFileNames(baseName)) {
+        const candidate = path.join(directory, fileName);
+        if (existsSync(candidate)) {
+          return { path: candidate, source: "bundled" };
+        }
+      }
+    }
+
+    const pathEntries = (enrichedPath([], process.env.PATH) ?? "")
+      .split(path.delimiter)
+      .filter(Boolean);
+    for (const entry of pathEntries) {
+      for (const fileName of binaryFileNames(baseName)) {
+        const candidate = path.join(entry, fileName);
+        if (existsSync(candidate)) {
+          return { path: candidate, source: "path" };
+        }
+      }
+    }
+
+    if (baseName === "opencode") {
+      for (const candidate of [
+        path.join(app.getPath("home"), ".opencode", "bin", process.platform === "win32" ? "opencode.exe" : "opencode"),
+        path.join("/opt/homebrew/bin", process.platform === "win32" ? "opencode.exe" : "opencode"),
+        path.join("/usr/local/bin", process.platform === "win32" ? "opencode.exe" : "opencode"),
+        path.join("/usr/bin", process.platform === "win32" ? "opencode.exe" : "opencode"),
+      ]) {
+        if (existsSync(candidate)) {
+          return { path: candidate, source: "known-location" };
+        }
+      }
+    }
+
+    return null;
+  }
+
+  function resolveBinary(baseName, extraPaths = []) {
+    return resolveBinaryInfo(baseName, extraPaths)?.path ?? null;
+  }
+
+  function resolveOpencodeBinary(opencodeBinPath) {
+    const explicitPath = typeof opencodeBinPath === "string" ? opencodeBinPath.trim() : "";
+    return explicitPath ? { path: explicitPath, source: "custom" } : resolveBinaryInfo("opencode");
+  }
+
+  function resolveDockerCandidates() {
+    const candidates = [];
+    const seen = new Set();
+
+    for (const key of ["OPENWORK_DOCKER_BIN", "OPENWRK_DOCKER_BIN", "DOCKER_BIN"]) {
+      const value = process.env[key]?.trim();
+      if (value && !seen.has(value)) {
+        seen.add(value);
+        candidates.push(value);
+      }
+    }
+
+    for (const entry of (process.env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
+      const candidate = path.join(entry, process.platform === "win32" ? "docker.exe" : "docker");
+      if (!seen.has(candidate)) {
+        seen.add(candidate);
+        candidates.push(candidate);
+      }
+    }
+
+    for (const candidate of [
+      "/opt/homebrew/bin/docker",
+      "/usr/local/bin/docker",
+      "/Applications/Docker.app/Contents/Resources/bin/docker",
+    ]) {
+      if (!seen.has(candidate)) {
+        seen.add(candidate);
+        candidates.push(candidate);
+      }
+    }
+
+    return candidates.filter((candidate) => existsSync(candidate));
+  }
+
+  function runDockerCommandDetailed(args, timeoutMs = 8000) {
+    const tried = [...resolveDockerCandidates(), process.platform === "win32" ? "docker.exe" : "docker"];
+    const errors = [];
+
+    for (const program of tried) {
+      try {
+        const result = spawnSync(program, args, {
+          encoding: "utf8",
+          timeout: timeoutMs,
+          windowsHide: true,
+        });
+        return {
+          program,
+          status: typeof result.status === "number" ? result.status : -1,
+          stdout: result.stdout ?? "",
+          stderr: result.stderr ?? "",
+        };
+      } catch (error) {
+        errors.push(error instanceof Error ? error.message : String(error));
+      }
+    }
+
+    throw new Error(
+      `Failed to run docker: ${errors.join("; ")} (Set OPENWORK_DOCKER_BIN to your docker binary if needed)`,
+    );
+  }
+
+  function parseDockerClientVersion(stdout) {
+    const line = String(stdout ?? "").split(/\r?\n/)[0]?.trim() ?? "";
+    return line.toLowerCase().startsWith("docker version") ? line : null;
+  }
+
+  function parseDockerServerVersion(stdout) {
+    for (const line of String(stdout ?? "").split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("Server Version:")) {
+        return trimmed.slice("Server Version:".length).trim() || null;
+      }
+    }
+    return null;
+  }
+
+  function deriveOrchestratorContainerName(runId) {
+    const sanitized = String(runId ?? "")
+      .replace(/[^a-zA-Z0-9_.-]+/g, "-")
+      .slice(0, 24);
+    return `openwork-orchestrator-${sanitized}`;
+  }
+
+  async function listOpenworkManagedContainers() {
+    const result = runDockerCommandDetailed(["ps", "-a", "--format", "{{.Names}}"], 8000);
+    if (result.status !== 0) {
+      const combined = `${result.stdout.trim()}\n${result.stderr.trim()}`.trim();
+      throw new Error(combined || `docker ps -a failed (status ${result.status})`);
+    }
+    return result.stdout
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((name) => name && (name.startsWith("openwork-orchestrator-") || name.startsWith("openwork-dev-") || name.startsWith("openwrk-")))
+      .sort();
+  }
+
+  async function runShellCommand(program, args, options = {}) {
+    const result = spawnSync(program, args, {
+      encoding: "utf8",
+      cwd: options.cwd,
+      env: options.env,
+      shell: false,
+      windowsHide: true,
+      timeout: options.timeoutMs,
+    });
+    return {
+      status: typeof result.status === "number" ? result.status : -1,
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+    };
+  }
+
+  function engineDoctor(options = {}) {
+    const resolved = resolveOpencodeBinary(options?.opencodeBinPath);
+    if (!resolved?.path) {
+      return {
+        found: false,
+        inPath: false,
+        resolvedPath: null,
+        resolvedSource: null,
+        version: null,
+        supportsServe: false,
+        notes: ["OpenCode binary not found in bundled sidecars or PATH."],
+        serveHelpStatus: null,
+        serveHelpStdout: null,
+        serveHelpStderr: null,
+      };
+    }
+
+    const versionResult = spawnSync(resolved.path, ["--version"], { encoding: "utf8" });
+    const helpResult = spawnSync(resolved.path, ["serve", "--help"], { encoding: "utf8" });
+    const notes = [`Using ${resolved.source}: ${resolved.path}`];
+    if (versionResult.status !== 0) {
+      notes.push("OpenCode version probe failed.");
+    }
+    if (helpResult.status !== 0) {
+      notes.push("OpenCode serve --help probe failed.");
+    }
+
+    return {
+      found: true,
+      inPath: resolved.source === "path",
+      resolvedPath: resolved.path,
+      resolvedSource: resolved.source,
+      version: versionResult.stdout?.trim() || versionResult.stderr?.trim() || null,
+      supportsServe: helpResult.status === 0,
+      notes,
+      serveHelpStatus: typeof helpResult.status === "number" ? helpResult.status : null,
+      serveHelpStdout: helpResult.stdout?.trim() || null,
+      serveHelpStderr: helpResult.stderr?.trim() || null,
+    };
+  }
+
+  async function pinnedOpencodeInstallCommand() {
+    const constantsPath = path.resolve(desktopRoot, "../../constants.json");
+    const payload = JSON.parse(await readFile(constantsPath, "utf8"));
+    const version = String(payload?.opencodeVersion ?? "").trim().replace(/^v/, "");
+    if (!version) {
+      throw new Error("constants.json is missing opencodeVersion");
+    }
+    return `curl -fsSL https://opencode.ai/install | bash -s -- --version ${version} --no-modify-path`;
+  }
+
+  function spawnManagedChild(state, program, args, options = {}) {
+    const child = spawn(program, args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    });
+
+    state.child = child;
+    state.childExited = false;
+    state.lastStdout = null;
+    state.lastStderr = null;
+
+    child.stdout?.on("data", (chunk) => appendOutput(state, "lastStdout", chunk.toString()));
+    child.stderr?.on("data", (chunk) => appendOutput(state, "lastStderr", chunk.toString()));
+    child.on("exit", (code) => {
+      state.childExited = true;
+      if (code != null && code !== 0) {
+        appendOutput(state, "lastStderr", `Process exited with code ${code}.\n`);
+      }
+      options.onExit?.(code);
+    });
+    child.on("error", (error) => {
+      state.childExited = true;
+      appendOutput(state, "lastStderr", `${error instanceof Error ? error.message : String(error)}\n`);
+    });
+
+    return child;
+  }
+
+  function processMatchesSidecar(command) {
+    const value = String(command ?? "");
+    return sidecarDirs.some((dir) => value.includes(dir)) &&
+      (
+        value.includes("openwork-orchestrator") ||
+        value.includes("openwork-server") ||
+        value.includes("opencode serve")
+      );
+  }
+
+  function killProcessId(pid, signal = "SIGTERM") {
+    if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid) return;
+    try {
+      process.kill(pid, signal);
+    } catch {
+      // Process already exited or is not ours.
+    }
+  }
+
+  async function cleanupPackagedSidecars() {
+    if (!app.isPackaged) return;
+
+    // First ask the previously recorded orchestrator daemon to shut itself and
+    // its OpenCode child down. This handles the happy path without relying on
+    // process-list parsing.
+    await requestOrchestratorShutdown(orchestratorState.dataDir || orchestratorDataDir()).catch(() => false);
+    await new Promise((resolve) => setTimeout(resolve, 300));
+
+    // Safety net: an unclean Electron quit can orphan sidecars. Packaged builds
+    // should always own a fresh runtime per app launch, so remove any leftover
+    // sidecars from this app bundle before choosing ports for the new runtime.
+    const result = spawnSync("ps", ["-Ao", "pid=,command="], { encoding: "utf8" });
+    const rows = String(result.stdout ?? "").split(/\r?\n/);
+    const pids = [];
+    for (const row of rows) {
+      const match = row.match(/^\s*(\d+)\s+(.+)$/);
+      if (!match) continue;
+      const pid = Number(match[1]);
+      const command = match[2] ?? "";
+      if (processMatchesSidecar(command)) pids.push(pid);
+    }
+    for (const pid of pids) killProcessId(pid, "SIGTERM");
+    if (pids.length > 0) {
+      await new Promise((resolve) => setTimeout(resolve, 500));
+      for (const pid of pids) killProcessId(pid, "SIGKILL");
+    }
+  }
+
+  async function stopChild(state, options = {}) {
+    const child = state.child;
+    state.child = null;
+    state.childExited = true;
+    if (!child || child.exitCode != null || child.killed) return;
+
+    if (options.requestShutdown) {
+      try {
+        const shutdownRequested = await options.requestShutdown();
+        if (shutdownRequested) {
+          await new Promise((resolve) => setTimeout(resolve, 750));
+        }
+      } catch {
+        // ignore
+      }
+    }
+
+    if (child.exitCode == null && !child.killed) {
+      child.kill("SIGTERM");
+      await new Promise((resolve) => setTimeout(resolve, 500));
+      if (child.exitCode == null && !child.killed) {
+        child.kill("SIGKILL");
+      }
+    }
+  }
+
+  async function ensureOpencodeConfig(projectDir) {
+    const configPath = path.join(projectDir, "opencode.json");
+    if (await fileExists(configPath)) return;
+    await mkdir(projectDir, { recursive: true });
+    await writeFile(
+      configPath,
+      `${JSON.stringify({ $schema: "https://opencode.ai/config.json" }, null, 2)}\n`,
+      "utf8",
+    );
+  }
+
+  function generateManagedCredentials() {
+    return [randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, ""), randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "")];
+  }
+
+  async function issueOwnerToken(baseUrl, hostToken) {
+    const payload = await fetchJson(
+      `${baseUrl.replace(/\/+$/, "")}/tokens`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-OpenWork-Host-Token": hostToken,
+        },
+        body: JSON.stringify({ scope: "owner", label: "OpenWork desktop owner token" }),
+      },
+      5000,
+    );
+    const token = typeof payload?.token === "string" ? payload.token.trim() : "";
+    return token || null;
+  }
+
+  async function startOpenworkServer(options) {
+    await stopChild(openworkServerState);
+
+    const workspacePaths = options.workspacePaths.filter((value) => value.trim().length > 0);
+    const activeWorkspace = workspacePaths[0] ?? "";
+    const host = options.remoteAccessEnabled ? "0.0.0.0" : "127.0.0.1";
+    const port = await resolveOpenworkPort(host, activeWorkspace);
+    const baseUrl = `http://127.0.0.1:${port}`;
+    const tokens = await loadOrCreateWorkspaceTokens(activeWorkspace);
+    const program = resolveBinary("openwork-server");
+    if (!program) {
+      throw new Error("Failed to locate openwork-server.");
+    }
+
+    const args = [
+      "--host",
+      host,
+      "--port",
+      String(port),
+      "--cors",
+      "*",
+      "--approval",
+      "auto",
+      ...workspacePaths.flatMap((workspacePath) => ["--workspace", workspacePath]),
+      ...(options.opencodeBaseUrl ? ["--opencode-base-url", options.opencodeBaseUrl] : []),
+      ...(activeWorkspace ? ["--opencode-directory", activeWorkspace] : []),
+    ];
+
+    const managedOpencode = options.manageOpencode ? resolveOpencodeBinary(options.opencodeBinPath) : null;
+    openworkServerState.managedOpencodeBinPath = managedOpencode?.path ?? null;
+    openworkServerState.managedOpencodeBinSource = managedOpencode?.source ?? null;
+    if (options.manageOpencode) {
+      engineState.opencodeBinPath = managedOpencode?.path ?? null;
+      engineState.opencodeBinSource = managedOpencode?.source ?? null;
+    }
+
+    const env = await buildChildEnv({
+      OPENWORK_TOKEN: tokens.clientToken,
+      OPENWORK_HOST_TOKEN: tokens.hostToken,
+      ...(options.manageOpencode ? { OPENWORK_MANAGE_OPENCODE: "1" } : {}),
+      ...(options.manageOpencode ? { OPENWORK_OPENCODE_BIN: managedOpencode?.path ?? "" } : {}),
+      ...(options.manageOpencode ? { OPENWORK_MANAGED_OPENCODE_CWD: managedOpencodeWorkdir() } : {}),
+      ...(options.opencodeUsername ? { OPENWORK_OPENCODE_USERNAME: options.opencodeUsername } : {}),
+      ...(options.opencodePassword ? { OPENWORK_OPENCODE_PASSWORD: options.opencodePassword } : {}),
+    });
+
+    spawnManagedChild(openworkServerState, program, args, {
+      cwd: activeWorkspace || desktopRoot,
+      env,
+    });
+
+    openworkServerState.remoteAccessEnabled = options.remoteAccessEnabled;
+    openworkServerState.host = host;
+    openworkServerState.port = port;
+    openworkServerState.baseUrl = baseUrl;
+    openworkServerState.clientToken = tokens.clientToken;
+    openworkServerState.hostToken = tokens.hostToken;
+
+    const connectUrls = options.remoteAccessEnabled ? buildConnectUrls(port) : { connectUrl: null, mdnsUrl: null, lanUrl: null };
+    openworkServerState.connectUrl = connectUrls.connectUrl;
+    openworkServerState.mdnsUrl = connectUrls.mdnsUrl;
+    openworkServerState.lanUrl = connectUrls.lanUrl;
+
+    await waitForHttpOk(`${baseUrl}/health`, 10_000);
+    // Owner tokens live in the OpenWork server token store, which can be reset
+    // independently from the desktop runtime token cache. Always mint a fresh
+    // owner token for the newly-started server instead of trusting the cached
+    // value; otherwise the renderer can receive a stale bearer token and all
+    // workspace calls fail with 401.
+    const ownerToken = await issueOwnerToken(baseUrl, tokens.hostToken);
+    openworkServerState.ownerToken = ownerToken;
+    if (ownerToken) {
+      await persistWorkspaceOwnerToken(activeWorkspace, ownerToken);
+    }
+    if (ownerToken) {
+      try {
+        const list = await fetchJson(`${baseUrl}/workspaces`, {
+          headers: { Authorization: `Bearer ${ownerToken}` },
+        }, 5000);
+        const first = Array.isArray(list?.items) ? list.items[0] : undefined;
+        const opencode = first?.opencode;
+        if (opencode?.baseUrl) {
+          engineState.runtime = DIRECT_RUNTIME;
+          engineState.projectDir = opencode.directory ?? activeWorkspace ?? null;
+          engineState.hostname = new URL(opencode.baseUrl).hostname;
+          engineState.port = Number(new URL(opencode.baseUrl).port) || null;
+          engineState.baseUrl = opencode.baseUrl;
+          engineState.opencodeUsername = opencode.username ?? null;
+          engineState.opencodePassword = opencode.password ?? null;
+          engineState.child = null;
+          engineState.childExited = false;
+        }
+      } catch (error) {
+        appendOutput(openworkServerState, "lastStderr", `OpenWork server workspace probe: ${error instanceof Error ? error.message : String(error)}\n`);
+      }
+    }
+    await persistPreferredOpenworkPort(activeWorkspace, port);
+    return snapshotOpenworkServerState(openworkServerState);
+  }
+
+  async function resolveOrchestratorBaseUrl() {
+    if (orchestratorState.baseUrl) {
+      return orchestratorState.baseUrl;
+    }
+    const stateFile = await readOrchestratorStateFile(orchestratorState.dataDir || orchestratorDataDir());
+    const baseUrl = stateFile?.daemon?.baseUrl?.trim();
+    if (!baseUrl) {
+      throw new Error("orchestrator daemon is not running");
+    }
+    return baseUrl;
+  }
+
+  async function startOrchestratorRuntime(projectDir, options = {}) {
+    const dataDir = orchestratorDataDir();
+    await mkdir(dataDir, { recursive: true });
+    const daemonPort = await findFreePort("127.0.0.1");
+    const opencodePort = await findFreePort("127.0.0.1");
+    const [username, password] = generateManagedCredentials();
+
+    const orchestratorProgram = resolveBinary("openwork-orchestrator") ?? resolveBinary("openwork");
+    if (!orchestratorProgram) {
+      throw new Error("Failed to locate openwork-orchestrator.");
+    }
+
+    const opencodeBinary = resolveOpencodeBinary(options.opencodeBinPath);
+    if (!opencodeBinary?.path) {
+      throw new Error("Failed to locate opencode.");
+    }
+
+    const env = await buildChildEnv({
+      OPENWORK_INTERNAL_ALLOW_OPENCODE_CREDENTIALS: "1",
+      OPENWORK_OPENCODE_USERNAME: username,
+      OPENWORK_OPENCODE_PASSWORD: password,
+      ...(options.opencodeEnableExa === true ? { OPENCODE_ENABLE_EXA: "1" } : {}),
+    });
+
+    const args = [
+      "daemon",
+      "run",
+      "--data-dir",
+      dataDir,
+      "--daemon-host",
+      "127.0.0.1",
+      "--daemon-port",
+      String(daemonPort),
+      "--opencode-bin",
+      opencodeBinary.path,
+      "--opencode-host",
+      "127.0.0.1",
+      "--opencode-workdir",
+      projectDir,
+      "--opencode-port",
+      String(opencodePort),
+      "--allow-external",
+      "--cors",
+      "*",
+    ];
+
+    spawnManagedChild(orchestratorState, orchestratorProgram, args, { env });
+    orchestratorState.dataDir = dataDir;
+    orchestratorState.daemonPort = daemonPort;
+    orchestratorState.baseUrl = `http://127.0.0.1:${daemonPort}`;
+
+    await writeOrchestratorAuthFile(dataDir, {
+      opencodeUsername: username,
+      opencodePassword: password,
+      projectDir,
+    });
+
+    const health = await waitForHttpOk(`${orchestratorState.baseUrl}/health`, 180_000).then((response) => response.json());
+    const opencode = health?.opencode;
+    if (!opencode?.port) {
+      throw new Error("Orchestrator did not report OpenCode status.");
+    }
+
+    engineState.runtime = ORCHESTRATOR_RUNTIME;
+    engineState.projectDir = projectDir;
+    engineState.hostname = "127.0.0.1";
+    engineState.port = opencode.port;
+    engineState.baseUrl = `http://127.0.0.1:${opencode.port}`;
+    engineState.opencodeUsername = username;
+    engineState.opencodePassword = password;
+    engineState.opencodeBinPath = opencodeBinary.path;
+    engineState.opencodeBinSource = opencodeBinary.source;
+
+    return snapshotEngineState(engineState);
+  }
+
+  async function startDirectRuntime(projectDir, options = {}) {
+    const opencodeBinary = resolveOpencodeBinary(options.opencodeBinPath);
+    if (!opencodeBinary?.path) {
+      throw new Error("Failed to locate opencode.");
+    }
+
+    const port = await findFreePort("127.0.0.1");
+    const [username, password] = generateManagedCredentials();
+    const env = await buildChildEnv({
+      OPENCODE_SERVER_USERNAME: username,
+      OPENCODE_SERVER_PASSWORD: password,
+    });
+
+    spawnManagedChild(
+      engineState,
+      opencodeBinary.path,
+      ["serve", "--hostname", "127.0.0.1", "--port", String(port), "--cors", "*"],
+      {
+        cwd: projectDir,
+        env,
+      },
+    );
+
+    engineState.runtime = DIRECT_RUNTIME;
+    engineState.projectDir = projectDir;
+    engineState.hostname = "127.0.0.1";
+    engineState.port = port;
+    engineState.baseUrl = `http://127.0.0.1:${port}`;
+    engineState.opencodeUsername = username;
+    engineState.opencodePassword = password;
+    engineState.opencodeBinPath = opencodeBinary.path;
+    engineState.opencodeBinSource = opencodeBinary.source;
+
+    await waitForHttpOk(`${engineState.baseUrl}/health`, 10_000).catch(() => undefined);
+    return snapshotEngineState(engineState);
+  }
+
+  async function stopAllRuntimeChildren() {
+    await stopChild(openworkServerState);
+    await stopChild(orchestratorState, {
+      requestShutdown: () => requestOrchestratorShutdown(orchestratorState.dataDir || orchestratorDataDir()),
+    });
+    await clearOrchestratorAuthFile(orchestratorState.dataDir || orchestratorDataDir()).catch(() => undefined);
+    await stopChild(engineState);
+
+    Object.assign(engineState, createEngineState());
+    Object.assign(openworkServerState, createOpenworkServerState());
+    Object.assign(orchestratorState, createOrchestratorState());
+  }
+
+  async function prepareFreshRuntime() {
+    lifecycleState = "cleaning";
+    await stopAllRuntimeChildren();
+    await cleanupPackagedSidecars();
+    lifecycleState = "idle";
+  }
+
+  async function ensureOpenwork(options) {
+    let openworkServer;
+    try {
+      openworkServer = await startOpenworkServer({
+        workspacePaths: options.workspacePaths,
+        opencodeBaseUrl: engineState.baseUrl,
+        opencodeUsername: engineState.opencodeUsername,
+        opencodePassword: engineState.opencodePassword,
+        remoteAccessEnabled: options.remoteAccessEnabled,
+        manageOpencode: options.manageOpencode === true,
+        opencodeBinPath: options.opencodeBinPath,
+      });
+    } catch (error) {
+      appendOutput(engineState, "lastStderr", `OpenWork server: ${error instanceof Error ? error.message : String(error)}\n`);
+      throw error;
+    }
+
+    assertOpenworkServerReady(openworkServer);
+  }
+
+  async function engineStart(projectDir, options = {}) {
+    const safeProjectDir = String(projectDir ?? "").trim();
+    if (!safeProjectDir) {
+      throw new Error("projectDir is required");
+    }
+    await mkdir(safeProjectDir, { recursive: true });
+    await ensureOpencodeConfig(safeProjectDir);
+    await prepareFreshRuntime();
+
+    const workspacePaths = [safeProjectDir, ...((options.workspacePaths ?? []).filter(Boolean))].filter(
+      (value, index, list) => list.indexOf(value) === index,
+    );
+    const runtime = DIRECT_RUNTIME;
+
+    try {
+      lifecycleState = "starting";
+      engineState.runtime = runtime;
+      engineState.projectDir = safeProjectDir;
+      engineState.child = null;
+      engineState.childExited = true;
+
+      await ensureOpenwork({
+        projectDir: safeProjectDir,
+        workspacePaths,
+        remoteAccessEnabled: options.openworkRemoteAccess === true,
+        manageOpencode: true,
+        opencodeBinPath: options.opencodeBinPath,
+      });
+
+      lifecycleState = "healthy";
+      return snapshotEngineState(engineState);
+    } catch (error) {
+      lifecycleState = "error";
+      throw error;
+    }
+  }
+
+  async function engineStop() {
+    lifecycleState = "stopping";
+    await stopAllRuntimeChildren();
+    lifecycleState = "idle";
+    return snapshotEngineState(engineState);
+  }
+
+  async function engineRestart(options = {}) {
+    const projectDir = engineState.projectDir;
+    if (!projectDir) {
+      throw new Error("OpenCode is not configured for a local workspace");
+    }
+    return engineStart(projectDir, {
+      runtime: engineState.runtime,
+      workspacePaths: [projectDir],
+      opencodeEnableExa: options.opencodeEnableExa,
+      openworkRemoteAccess: options.openworkRemoteAccess,
+    });
+  }
+
+  async function engineInfo() {
+    return { ...snapshotEngineState(engineState), lifecycleState };
+  }
+
+  async function runtimeStatus() {
+    return {
+      lifecycleState,
+      engine: await engineInfo(),
+      openworkServer: snapshotOpenworkServerState(openworkServerState),
+    };
+  }
+
+  async function openworkServerInfo() {
+    return snapshotOpenworkServerState(openworkServerState);
+  }
+
+  async function openworkServerRestart(options = {}) {
+    const workspacePaths = (await listLocalWorkspacePaths()).filter(Boolean);
+    return startOpenworkServer({
+      workspacePaths,
+      opencodeBaseUrl: engineState.baseUrl,
+      opencodeUsername: engineState.opencodeUsername,
+      opencodePassword: engineState.opencodePassword,
+      remoteAccessEnabled: options.remoteAccessEnabled === true,
+    });
+  }
+
+  async function orchestratorStatus() {
+    const engine = snapshotEngineState(engineState);
+    const openworkServer = snapshotOpenworkServerState(openworkServerState);
+    const workspaces = engine.projectDir
+      ? [{ id: normalizeWorkspaceKey(engine.projectDir), path: engine.projectDir, name: path.basename(engine.projectDir) || "Workspace" }]
+      : [];
+    return {
+      running: engine.running,
+      dataDir: null,
+      daemon: openworkServer.running
+        ? { baseUrl: openworkServer.baseUrl, port: openworkServer.port, pid: openworkServer.pid, runtime: "direct" }
+        : null,
+      opencode: engine.running
+        ? { baseUrl: engine.baseUrl, port: engine.port, pid: engine.pid, projectDir: engine.projectDir, runtime: "direct" }
+        : null,
+      cliVersion: null,
+      sidecar: null,
+      binaries: null,
+      activeId: workspaces[0]?.id ?? null,
+      workspaceCount: workspaces.length,
+      workspaces,
+      lastError: engine.lastStderr,
+    };
+  }
+
+  async function orchestratorWorkspaceActivate(input) {
+    const workspacePath = String(input?.workspacePath ?? "").trim();
+    if (!workspacePath) {
+      throw new Error("workspacePath is required");
+    }
+    const resolved = path.resolve(workspacePath);
+    if (normalizeWorkspaceKey(engineState.projectDir) !== normalizeWorkspaceKey(resolved)) {
+      await engineStart(resolved, {
+        runtime: DIRECT_RUNTIME,
+        workspacePaths: [resolved],
+      });
+    }
+    return {
+      id: normalizeWorkspaceKey(resolved),
+      path: resolved,
+      name: input?.name ?? (path.basename(resolved) || "Workspace"),
+    };
+  }
+
+  async function orchestratorInstanceDispose(workspacePath) {
+    if (normalizeWorkspaceKey(engineState.projectDir) === normalizeWorkspaceKey(workspacePath)) {
+      return true;
+    }
+    return true;
+  }
+
+  async function engineInstall() {
+    if (process.platform === "win32") {
+      return {
+        ok: false,
+        status: -1,
+        stdout: "",
+        stderr:
+          "Guided install is not supported on Windows yet. Install the OpenWork-pinned OpenCode version manually, then restart OpenWork.",
+      };
+    }
+
+    const installDir = path.join(app.getPath("home"), ".opencode", "bin");
+    const command = await pinnedOpencodeInstallCommand();
+    const result = await runShellCommand("bash", ["-lc", command], {
+      env: { ...(await buildChildEnv()), OPENCODE_INSTALL_DIR: installDir },
+      timeoutMs: 180_000,
+    });
+    return {
+      ok: result.status === 0,
+      status: result.status,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    };
+  }
+
+  async function opencodeMcpAuth(projectDir, serverName) {
+    const safeProjectDir = String(projectDir ?? "").trim();
+    const safeServerName = String(serverName ?? "").trim();
+    if (!safeProjectDir) {
+      throw new Error("project_dir is required");
+    }
+    if (!safeServerName) {
+      throw new Error("server_name is required");
+    }
+
+    const program = resolveBinary("opencode");
+    if (!program) {
+      throw new Error("Failed to locate opencode.");
+    }
+
+    const result = await runShellCommand(program, ["mcp", "auth", safeServerName], {
+      cwd: safeProjectDir,
+      env: await buildChildEnv(),
+      timeoutMs: 120_000,
+    });
+    return {
+      ok: result.status === 0,
+      status: result.status,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    };
+  }
+
+  async function sandboxDoctor() {
+    const candidates = resolveDockerCandidates();
+    const debug = {
+      candidates,
+      selectedBin: null,
+      versionCommand: null,
+      infoCommand: null,
+    };
+
+    let version;
+    try {
+      version = runDockerCommandDetailed(["--version"], 2000);
+    } catch (error) {
+      return {
+        installed: false,
+        daemonRunning: false,
+        permissionOk: false,
+        ready: false,
+        clientVersion: null,
+        serverVersion: null,
+        error: error instanceof Error ? error.message : String(error),
+        debug,
+      };
+    }
+
+    debug.selectedBin = version.program;
+    debug.versionCommand = {
+      status: version.status,
+      stdout: truncateOutput(version.stdout, 1200),
+      stderr: truncateOutput(version.stderr, 1200),
+    };
+
+    const clientVersion = parseDockerClientVersion(version.stdout);
+    if (version.status !== 0) {
+      return {
+        installed: false,
+        daemonRunning: false,
+        permissionOk: false,
+        ready: false,
+        clientVersion: null,
+        serverVersion: null,
+        error: `docker --version failed (status ${version.status}): ${version.stderr.trim()}`,
+        debug,
+      };
+    }
+
+    let info;
+    try {
+      info = runDockerCommandDetailed(["info"], 8000);
+    } catch (error) {
+      return {
+        installed: true,
+        daemonRunning: false,
+        permissionOk: false,
+        ready: false,
+        clientVersion,
+        serverVersion: null,
+        error: error instanceof Error ? error.message : String(error),
+        debug,
+      };
+    }
+
+    debug.infoCommand = {
+      status: info.status,
+      stdout: truncateOutput(info.stdout, 1200),
+      stderr: truncateOutput(info.stderr, 1200),
+    };
+
+    if (info.status === 0) {
+      return {
+        installed: true,
+        daemonRunning: true,
+        permissionOk: true,
+        ready: true,
+        clientVersion,
+        serverVersion: parseDockerServerVersion(info.stdout),
+        error: null,
+        debug,
+      };
+    }
+
+    const combined = `${info.stdout.trim()}\n${info.stderr.trim()}`.trim().toLowerCase();
+    const permissionOk = !combined.includes("permission denied") && !combined.includes("access is denied");
+    const daemonRunning = !combined.includes("cannot connect to the docker daemon") && !combined.includes("is the docker daemon running") && !combined.includes("connection refused") && !combined.includes("no such file or directory");
+
+    return {
+      installed: true,
+      daemonRunning,
+      permissionOk,
+      ready: false,
+      clientVersion,
+      serverVersion: null,
+      error: `${info.stdout.trim()}\n${info.stderr.trim()}`.trim() || `docker info failed (status ${info.status})`,
+      debug,
+    };
+  }
+
+  async function sandboxStop(containerName) {
+    const name = String(containerName ?? "").trim();
+    if (!name) {
+      throw new Error("containerName is required");
+    }
+    if (!name.startsWith("openwork-orchestrator-")) {
+      throw new Error("Refusing to stop container: expected name starting with 'openwork-orchestrator-'");
+    }
+    if (!/^[A-Za-z0-9_.-]+$/.test(name)) {
+      throw new Error("containerName contains invalid characters");
+    }
+    const result = runDockerCommandDetailed(["stop", name], 15_000);
+    return {
+      ok: result.status === 0,
+      status: result.status,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    };
+  }
+
+  async function sandboxCleanupOpenworkContainers() {
+    const candidates = await listOpenworkManagedContainers().catch((error) => {
+      throw error;
+    });
+    const removed = [];
+    const errors = [];
+
+    for (const name of candidates) {
+      try {
+        const result = runDockerCommandDetailed(["rm", "-f", name], 20_000);
+        if (result.status === 0) {
+          removed.push(name);
+        } else {
+          errors.push(`${name}: exit ${result.status}: ${(result.stdout + "\n" + result.stderr).trim()}`);
+        }
+      } catch (error) {
+        errors.push(`${name}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+
+    return { candidates, removed, errors };
+  }
+
+  async function orchestratorStartDetached(options = {}) {
+    const workspacePath = String(options.workspacePath ?? "").trim();
+    if (!workspacePath) {
+      throw new Error("workspacePath is required");
+    }
+
+    const sandboxBackend = String(options.sandboxBackend ?? "none").trim().toLowerCase();
+    if (!["none", "docker", "microsandbox"].includes(sandboxBackend)) {
+      throw new Error("sandboxBackend must be one of: none, docker, microsandbox");
+    }
+
+    const wantsDockerSandbox = sandboxBackend === "docker" || sandboxBackend === "microsandbox";
+    const runId = String(options.runId ?? randomUUID()).trim();
+    const containerName = wantsDockerSandbox ? deriveOrchestratorContainerName(runId) : null;
+    const port = await findFreePort("127.0.0.1");
+    const token = String(options.openworkToken ?? randomUUID()).trim();
+    const hostToken = String(options.openworkHostToken ?? randomUUID()).trim();
+    const openworkUrl = `http://127.0.0.1:${port}`;
+    const program = resolveBinary("openwork-orchestrator") ?? resolveBinary("openwork");
+    if (!program) {
+      throw new Error("Failed to locate openwork orchestrator.");
+    }
+
+    const args = [
+      "start",
+      "--workspace",
+      workspacePath,
+      "--approval",
+      "auto",
+      "--detach",
+      "--openwork-port",
+      String(port),
+      "--run-id",
+      runId,
+      ...(wantsDockerSandbox ? ["--sandbox", "docker"] : []),
+      ...(options.sandboxImageRef ? ["--sandbox-image", String(options.sandboxImageRef)] : []),
+    ];
+
+    const child = spawn(program, args, {
+      env: { ...(await buildChildEnv()), OPENWORK_TOKEN: token, OPENWORK_HOST_TOKEN: hostToken },
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.unref();
+
+    await waitForHttpOk(`${openworkUrl}/health`, wantsDockerSandbox ? 90_000 : 12_000);
+    const ownerToken = await issueOwnerToken(openworkUrl, hostToken).catch(() => null);
+
+    return {
+      openworkUrl,
+      token,
+      ownerToken,
+      hostToken,
+      port,
+      sandboxBackend: wantsDockerSandbox ? sandboxBackend : null,
+      sandboxRunId: wantsDockerSandbox ? runId : null,
+      sandboxContainerName: containerName,
+    };
+  }
+
+  async function sandboxDebugProbe() {
+    const startedAt = nowMs();
+    const runId = `probe-${randomUUID()}`;
+    const workspacePath = path.join(os.tmpdir(), `openwork-sandbox-probe-${randomUUID()}`);
+    await mkdir(workspacePath, { recursive: true });
+
+    const doctor = await sandboxDoctor();
+    let detachedHost = null;
+    let dockerInspect = null;
+    let dockerLogs = null;
+    let error = null;
+    const cleanupErrors = [];
+    let containerRemoved = false;
+    let workspaceRemoved = false;
+    let removeResult = null;
+
+    if (doctor.ready) {
+      try {
+        detachedHost = await orchestratorStartDetached({
+          workspacePath,
+          sandboxBackend: "docker",
+          runId,
+        });
+        const containerName = detachedHost.sandboxContainerName ?? deriveOrchestratorContainerName(runId);
+        try {
+          const inspectResult = runDockerCommandDetailed(["inspect", containerName], 6000);
+          dockerInspect = {
+            status: inspectResult.status,
+            stdout: truncateOutput(inspectResult.stdout, 48000),
+            stderr: truncateOutput(inspectResult.stderr, 48000),
+          };
+        } catch (inspectError) {
+          cleanupErrors.push(`docker inspect failed: ${inspectError instanceof Error ? inspectError.message : String(inspectError)}`);
+        }
+        try {
+          const logsResult = runDockerCommandDetailed(["logs", "--timestamps", "--tail", "400", containerName], 8000);
+          dockerLogs = {
+            status: logsResult.status,
+            stdout: truncateOutput(logsResult.stdout, 48000),
+            stderr: truncateOutput(logsResult.stderr, 48000),
+          };
+        } catch (logsError) {
+          cleanupErrors.push(`docker logs failed: ${logsError instanceof Error ? logsError.message : String(logsError)}`);
+        }
+
+        try {
+          const rmResult = runDockerCommandDetailed(["rm", "-f", containerName], 20_000);
+          containerRemoved = rmResult.status === 0;
+          removeResult = {
+            status: rmResult.status,
+            stdout: truncateOutput(rmResult.stdout, 48000),
+            stderr: truncateOutput(rmResult.stderr, 48000),
+          };
+        } catch (removeError) {
+          cleanupErrors.push(`docker rm -f ${containerName} failed: ${removeError instanceof Error ? removeError.message : String(removeError)}`);
+        }
+      } catch (probeError) {
+        error = `Sandbox probe failed to start: ${probeError instanceof Error ? probeError.message : String(probeError)}`;
+      }
+    } else {
+      error = doctor.error ?? "Docker is not ready for sandbox creation";
+    }
+
+    try {
+      await rm(workspacePath, { recursive: true, force: true });
+      workspaceRemoved = true;
+    } catch (workspaceError) {
+      cleanupErrors.push(`Failed to remove probe workspace: ${workspaceError instanceof Error ? workspaceError.message : String(workspaceError)}`);
+    }
+
+    return {
+      startedAt,
+      finishedAt: nowMs(),
+      runId,
+      workspacePath,
+      ready: doctor.ready && !error,
+      doctor,
+      detachedHost,
+      dockerInspect,
+      dockerLogs,
+      cleanup: {
+        containerName: detachedHost?.sandboxContainerName ?? null,
+        containerRemoved,
+        removeResult,
+        workspaceRemoved,
+        errors: cleanupErrors,
+      },
+      error,
+    };
+  }
+
+  return {
+    engineStart: (projectDir, options) => withRuntimeLifecycle(() => engineStart(projectDir, options)),
+    engineStop: () => withRuntimeLifecycle(() => engineStop()),
+    engineRestart: (options) => withRuntimeLifecycle(() => engineRestart(options)),
+    prepareFreshRuntime: () => withRuntimeLifecycle(() => prepareFreshRuntime()),
+    dispose: () => withRuntimeLifecycle(() => stopAllRuntimeChildren()),
+    runtimeStatus,
+    engineInfo,
+    engineDoctor,
+    engineInstall,
+    openworkServerInfo,
+    openworkServerRestart,
+    orchestratorStatus,
+    orchestratorWorkspaceActivate,
+    orchestratorInstanceDispose,
+    orchestratorStartDetached,
+    opencodeMcpAuth,
+    sandboxDoctor,
+    sandboxStop,
+    sandboxCleanupOpenworkContainers,
+    sandboxDebugProbe,
+  };
+}
diff --git a/apps/desktop/electron/updater.mjs b/apps/desktop/electron/updater.mjs
new file mode 100644
index 0000000000..f5c96a6ee1
--- /dev/null
+++ b/apps/desktop/electron/updater.mjs
@@ -0,0 +1,199 @@
+import { readFile, mkdir, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ELECTRON_UPDATER_CHANNEL_FILENAME = "electron-updater-channel.v1.json";
+
+// In dev mode, app.getVersion() returns the Electron framework version
+// (e.g. "35.7.5") instead of the OpenWork app version. Read from
+// package.json so the UI always shows the correct version.
+const __updater_dirname = path.dirname(fileURLToPath(import.meta.url));
+let _cachedAppVersion = null;
+function resolveAppVersion(app) {
+  if (_cachedAppVersion) return _cachedAppVersion;
+  const electronVersion = app.getVersion();
+  // If packaged, app.getVersion() is correct (set by electron-builder).
+  if (app.isPackaged) {
+    _cachedAppVersion = electronVersion;
+    return electronVersion;
+  }
+  // In dev, read from package.json.
+  try {
+    const pkgPath = path.resolve(__updater_dirname, "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    _cachedAppVersion = pkg.version || electronVersion;
+  } catch {
+    _cachedAppVersion = electronVersion;
+  }
+  return _cachedAppVersion;
+}
+const ELECTRON_UPDATER_FEEDS = Object.freeze({
+  stable: "https://github.com/different-ai/openwork/releases/latest/download",
+  alpha: "https://github.com/different-ai/openwork/releases/download/alpha-macos-latest",
+});
+
+function normalizeElectronUpdaterChannel(value) {
+  if (value === "alpha" && process.platform === "darwin") return "alpha";
+  return "stable";
+}
+
+function electronUpdaterChannelPath(app) {
+  return path.join(app.getPath("userData"), ELECTRON_UPDATER_CHANNEL_FILENAME);
+}
+
+async function readElectronUpdaterChannel(app) {
+  try {
+    const raw = await readFile(electronUpdaterChannelPath(app), "utf8");
+    const parsed = JSON.parse(raw);
+    return normalizeElectronUpdaterChannel(parsed?.channel);
+  } catch {
+    return "stable";
+  }
+}
+
+async function writeElectronUpdaterChannel(app, channel) {
+  const normalized = normalizeElectronUpdaterChannel(channel);
+  const outputPath = electronUpdaterChannelPath(app);
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(
+    outputPath,
+    `${JSON.stringify({ channel: normalized, writtenAt: new Date().toISOString() }, null, 2)}\n`,
+    "utf8",
+  );
+  return normalized;
+}
+
+function electronUpdaterFeedUrl(channel) {
+  return ELECTRON_UPDATER_FEEDS[normalizeElectronUpdaterChannel(channel)];
+}
+
+function updaterChannelState(app, channel) {
+  const normalized = normalizeElectronUpdaterChannel(channel);
+  return {
+    channel: normalized,
+    feedUrl: electronUpdaterFeedUrl(normalized),
+    currentVersion: resolveAppVersion(app),
+  };
+}
+
+async function applyElectronUpdaterFeed(app, updater) {
+  const channel = await readElectronUpdaterChannel(app);
+  const state = updaterChannelState(app, channel);
+  updater.allowPrerelease = state.channel === "alpha";
+  if (updater?.setFeedURL) {
+    updater.setFeedURL({ provider: "generic", url: state.feedUrl });
+  }
+  return state;
+}
+
+// electron-updater wiring. Packaged-only; dev builds skip this so the
+// updater doesn't try to probe a non-existent release channel.
+export function registerUpdaterIpc({ app, ipcMain, getMainWindow }) {
+  let autoUpdaterInstance = null;
+  let autoUpdaterLoaded = false;
+
+  function sendToRenderer(channel, data) {
+    try {
+      const win = typeof getMainWindow === "function" ? getMainWindow() : null;
+      if (win?.webContents && !win.isDestroyed()) {
+        win.webContents.send(channel, data);
+      }
+    } catch {
+      // Window may be closed; swallow send failures.
+    }
+  }
+
+  async function ensureAutoUpdater() {
+    if (!app.isPackaged) return null;
+    if (autoUpdaterLoaded) return autoUpdaterInstance;
+    autoUpdaterLoaded = true;
+    try {
+      const mod = await import("electron-updater");
+      autoUpdaterInstance = mod.autoUpdater ?? mod.default?.autoUpdater ?? null;
+      if (autoUpdaterInstance) {
+        autoUpdaterInstance.autoDownload = false;
+        autoUpdaterInstance.autoInstallOnAppQuit = true;
+        autoUpdaterInstance.on("error", (err) => {
+          console.warn("[updater] error", err);
+        });
+        // Forward download progress to the renderer so the UI can show
+        // incremental bytes instead of staying stuck at 0.
+        autoUpdaterInstance.on("download-progress", (info) => {
+          sendToRenderer("openwork:updater:download-progress", {
+            bytesPerSecond: info.bytesPerSecond ?? 0,
+            percent: info.percent ?? 0,
+            transferred: info.transferred ?? 0,
+            total: info.total ?? 0,
+            delta: info.delta ?? 0,
+          });
+        });
+        await applyElectronUpdaterFeed(app, autoUpdaterInstance);
+      }
+    } catch (error) {
+      console.warn("[updater] electron-updater not available", error);
+      autoUpdaterInstance = null;
+    }
+    return autoUpdaterInstance;
+  }
+
+  ipcMain.handle("openwork:updater:getChannel", async () => {
+    const channel = await readElectronUpdaterChannel(app);
+    return updaterChannelState(app, channel);
+  });
+
+  ipcMain.handle("openwork:updater:setChannel", async (_event, rawChannel) => {
+    const channel = await writeElectronUpdaterChannel(app, rawChannel);
+    const updater = await ensureAutoUpdater();
+    if (updater) {
+      return applyElectronUpdaterFeed(app, updater);
+    }
+    return updaterChannelState(app, channel);
+  });
+
+  ipcMain.handle("openwork:updater:check", async () => {
+    const updater = await ensureAutoUpdater();
+    const channelState = updater
+      ? await applyElectronUpdaterFeed(app, updater)
+      : updaterChannelState(app, await readElectronUpdaterChannel(app));
+    if (!updater) return { available: false, reason: "unavailable", ...channelState };
+    try {
+      const result = await updater.checkForUpdates();
+      const info = result?.updateInfo ?? null;
+      return {
+        available: Boolean(info && info.version && info.version !== resolveAppVersion(app)),
+        currentVersion: resolveAppVersion(app),
+        latestVersion: info?.version ?? null,
+        releaseDate: info?.releaseDate ?? null,
+        releaseNotes: info?.releaseNotes ?? null,
+        ...channelState,
+      };
+    } catch (error) {
+      return { available: false, reason: String(error?.message ?? error), ...channelState };
+    }
+  });
+
+  ipcMain.handle("openwork:updater:download", async () => {
+    const updater = await ensureAutoUpdater();
+    if (!updater) return { ok: false, reason: "unavailable" };
+    try {
+      await updater.downloadUpdate();
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, reason: String(error?.message ?? error) };
+    }
+  });
+
+  ipcMain.handle("openwork:updater:installAndRestart", async () => {
+    const updater = await ensureAutoUpdater();
+    if (!updater) return { ok: false, reason: "unavailable" };
+    try {
+      updater.quitAndInstall(false, true);
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, reason: String(error?.message ?? error) };
+    }
+  });
+
+  return { ensureAutoUpdater };
+}
diff --git a/apps/desktop/electron/workspace-archive.mjs b/apps/desktop/electron/workspace-archive.mjs
new file mode 100644
index 0000000000..54b3de924c
--- /dev/null
+++ b/apps/desktop/electron/workspace-archive.mjs
@@ -0,0 +1,321 @@
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import zlib from "node:zlib";
+
+const ZIP_LOCAL_FILE_HEADER = 0x04034b50;
+const ZIP_CENTRAL_DIRECTORY_HEADER = 0x02014b50;
+const ZIP_END_OF_CENTRAL_DIRECTORY = 0x06054b50;
+
+function nowMs() {
+  return Date.now();
+}
+
+function isSecretName(name) {
+  const lower = String(name ?? "").toLowerCase();
+  if (lower === ".env" || lower.startsWith(".env.")) return true;
+  if (lower === "credentials.json" || lower === "credentials.yml" || lower === "credentials.yaml") return true;
+  return lower.endsWith(".key") || lower.endsWith(".pem") || lower.endsWith(".p12") || lower.endsWith(".pfx");
+}
+
+function normalizeZipPath(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+
+async function pathExists(targetPath) {
+  try {
+    await stat(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function isDirectoryEmpty(targetPath) {
+  try {
+    const entries = await readdir(targetPath);
+    return entries.length === 0;
+  } catch {
+    return true;
+  }
+}
+
+async function collectFiles(root, current = root) {
+  const out = [];
+  const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    const absolute = path.join(current, entry.name);
+    if (entry.isDirectory()) {
+      out.push(...(await collectFiles(root, absolute)));
+    } else if (entry.isFile()) {
+      const rel = normalizeZipPath(path.relative(root, absolute));
+      out.push({ absolute, rel });
+    }
+  }
+  return out;
+}
+
+async function collectWorkspaceEntries(workspaceRoot) {
+  const entries = [];
+  const excluded = [];
+
+  const configPath = path.join(workspaceRoot, "opencode.json");
+  if (await pathExists(configPath)) {
+    if (isSecretName(path.basename(configPath))) {
+      excluded.push("opencode.json");
+    } else {
+      entries.push({ absolute: configPath, rel: "opencode.json" });
+    }
+  }
+
+  const opencodeDir = path.join(workspaceRoot, ".opencode");
+  if (await pathExists(opencodeDir)) {
+    for (const file of await collectFiles(workspaceRoot, opencodeDir)) {
+      if (isSecretName(path.basename(file.absolute))) {
+        if (!excluded.includes(file.rel)) excluded.push(file.rel);
+        continue;
+      }
+      entries.push(file);
+    }
+  }
+
+  return { entries, excluded };
+}
+
+let crcTable = null;
+function crc32(buffer) {
+  if (!crcTable) {
+    crcTable = new Uint32Array(256);
+    for (let n = 0; n < 256; n += 1) {
+      let c = n;
+      for (let k = 0; k < 8; k += 1) {
+        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+      }
+      crcTable[n] = c >>> 0;
+    }
+  }
+
+  let crc = 0xffffffff;
+  for (const byte of buffer) crc = crcTable[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function localFileHeader(nameBuffer, data, checksum) {
+  const header = Buffer.alloc(30);
+  header.writeUInt32LE(ZIP_LOCAL_FILE_HEADER, 0);
+  header.writeUInt16LE(20, 4);
+  header.writeUInt16LE(0, 6);
+  header.writeUInt16LE(0, 8);
+  header.writeUInt16LE(0, 10);
+  header.writeUInt16LE(0, 12);
+  header.writeUInt32LE(checksum, 14);
+  header.writeUInt32LE(data.length, 18);
+  header.writeUInt32LE(data.length, 22);
+  header.writeUInt16LE(nameBuffer.length, 26);
+  header.writeUInt16LE(0, 28);
+  return header;
+}
+
+function centralDirectoryHeader(nameBuffer, data, checksum, offset) {
+  const header = Buffer.alloc(46);
+  header.writeUInt32LE(ZIP_CENTRAL_DIRECTORY_HEADER, 0);
+  header.writeUInt16LE(20, 4);
+  header.writeUInt16LE(20, 6);
+  header.writeUInt16LE(0, 8);
+  header.writeUInt16LE(0, 10);
+  header.writeUInt16LE(0, 12);
+  header.writeUInt16LE(0, 14);
+  header.writeUInt32LE(checksum, 16);
+  header.writeUInt32LE(data.length, 20);
+  header.writeUInt32LE(data.length, 24);
+  header.writeUInt16LE(nameBuffer.length, 28);
+  header.writeUInt16LE(0, 30);
+  header.writeUInt16LE(0, 32);
+  header.writeUInt16LE(0, 34);
+  header.writeUInt16LE(0, 36);
+  header.writeUInt32LE(0, 38);
+  header.writeUInt32LE(offset, 42);
+  return header;
+}
+
+function endOfCentralDirectory(entryCount, centralSize, centralOffset) {
+  const header = Buffer.alloc(22);
+  header.writeUInt32LE(ZIP_END_OF_CENTRAL_DIRECTORY, 0);
+  header.writeUInt16LE(0, 4);
+  header.writeUInt16LE(0, 6);
+  header.writeUInt16LE(entryCount, 8);
+  header.writeUInt16LE(entryCount, 10);
+  header.writeUInt32LE(centralSize, 12);
+  header.writeUInt32LE(centralOffset, 16);
+  header.writeUInt16LE(0, 20);
+  return header;
+}
+
+async function writeZip(outputPath, files) {
+  const chunks = [];
+  const central = [];
+  let offset = 0;
+
+  for (const file of files) {
+    const nameBuffer = Buffer.from(file.name, "utf8");
+    const data = Buffer.isBuffer(file.data) ? file.data : Buffer.from(file.data);
+    const checksum = crc32(data);
+    const local = localFileHeader(nameBuffer, data, checksum);
+    chunks.push(local, nameBuffer, data);
+    central.push(centralDirectoryHeader(nameBuffer, data, checksum, offset), nameBuffer);
+    offset += local.length + nameBuffer.length + data.length;
+  }
+
+  const centralOffset = offset;
+  const centralSize = central.reduce((sum, chunk) => sum + chunk.length, 0);
+  chunks.push(...central, endOfCentralDirectory(files.length, centralSize, centralOffset));
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, Buffer.concat(chunks));
+}
+
+function findEndOfCentralDirectory(buffer) {
+  const start = Math.max(0, buffer.length - 0xffff - 22);
+  for (let offset = buffer.length - 22; offset >= start; offset -= 1) {
+    if (buffer.readUInt32LE(offset) === ZIP_END_OF_CENTRAL_DIRECTORY) return offset;
+  }
+  throw new Error("Failed to find ZIP central directory.");
+}
+
+function listZipEntries(buffer) {
+  const eocd = findEndOfCentralDirectory(buffer);
+  const count = buffer.readUInt16LE(eocd + 10);
+  const centralOffset = buffer.readUInt32LE(eocd + 16);
+  const entries = [];
+  let cursor = centralOffset;
+  for (let i = 0; i < count; i += 1) {
+    if (buffer.readUInt32LE(cursor) !== ZIP_CENTRAL_DIRECTORY_HEADER) {
+      throw new Error("Invalid ZIP central directory entry.");
+    }
+    const method = buffer.readUInt16LE(cursor + 10);
+    const compressedSize = buffer.readUInt32LE(cursor + 20);
+    const uncompressedSize = buffer.readUInt32LE(cursor + 24);
+    const nameLength = buffer.readUInt16LE(cursor + 28);
+    const extraLength = buffer.readUInt16LE(cursor + 30);
+    const commentLength = buffer.readUInt16LE(cursor + 32);
+    const localOffset = buffer.readUInt32LE(cursor + 42);
+    const name = buffer.toString("utf8", cursor + 46, cursor + 46 + nameLength);
+    entries.push({ name, method, compressedSize, uncompressedSize, localOffset });
+    cursor += 46 + nameLength + extraLength + commentLength;
+  }
+  return entries;
+}
+
+function readZipEntryData(buffer, entry) {
+  const cursor = entry.localOffset;
+  if (buffer.readUInt32LE(cursor) !== ZIP_LOCAL_FILE_HEADER) {
+    throw new Error(`Invalid ZIP local header for ${entry.name}.`);
+  }
+  const nameLength = buffer.readUInt16LE(cursor + 26);
+  const extraLength = buffer.readUInt16LE(cursor + 28);
+  const dataStart = cursor + 30 + nameLength + extraLength;
+  const compressed = buffer.subarray(dataStart, dataStart + entry.compressedSize);
+  if (entry.method === 0) return compressed;
+  if (entry.method === 8) return zlib.inflateRawSync(compressed, { finishFlush: zlib.constants.Z_SYNC_FLUSH });
+  throw new Error(`Unsupported ZIP compression method ${entry.method} for ${entry.name}.`);
+}
+
+function isSafeArchivePath(name) {
+  if (!name || name.startsWith("/") || /^[A-Za-z]:/.test(name)) return false;
+  const normalized = normalizeZipPath(name);
+  return !normalized.split("/").some((part) => part === ".." || part === "");
+}
+
+function defaultOpenworkConfig(targetDir, preset = "starter") {
+  return {
+    version: 1,
+    workspace: {
+      name: path.basename(targetDir) || "Workspace",
+      createdAt: nowMs(),
+      preset,
+    },
+    authorizedRoots: [targetDir],
+    reload: null,
+  };
+}
+
+export async function exportWorkspaceConfig({ workspace, outputPath }) {
+  if (!workspace?.path || workspace.workspaceType === "remote") {
+    throw new Error("Workspace export is only supported for local workspaces");
+  }
+  const workspaceRoot = workspace.path;
+  if (!(await pathExists(workspaceRoot))) {
+    throw new Error(`Workspace path not found: ${workspaceRoot}`);
+  }
+
+  const { entries, excluded } = await collectWorkspaceEntries(workspaceRoot);
+  if (entries.length === 0) throw new Error("No workspace config files found to export");
+
+  const files = [];
+  const included = [];
+  for (const entry of entries) {
+    files.push({ name: entry.rel, data: await readFile(entry.absolute) });
+    included.push(entry.rel);
+  }
+  files.push({
+    name: "manifest.json",
+    data: `${JSON.stringify({
+      version: 1,
+      createdAtMs: nowMs(),
+      workspace: { id: workspace.id, name: workspace.name, path: workspace.path },
+      included,
+      excluded,
+    }, null, 2)}\n`,
+  });
+  await writeZip(outputPath, files);
+  return { outputPath, included: included.length, excluded };
+}
+
+export async function importWorkspaceConfig({ archivePath, targetDir, name }) {
+  if (await pathExists(targetDir)) {
+    if (!(await isDirectoryEmpty(targetDir))) throw new Error("Target folder must be empty");
+  }
+  await mkdir(targetDir, { recursive: true });
+
+  const buffer = await readFile(archivePath);
+  for (const entry of listZipEntries(buffer)) {
+    if (entry.name === "manifest.json" || entry.name.endsWith("/")) continue;
+    if (!isSafeArchivePath(entry.name)) throw new Error("Archive contains an unsafe path");
+    if (!(entry.name === "opencode.json" || entry.name.startsWith(".opencode/"))) continue;
+    if (isSecretName(path.basename(entry.name))) continue;
+    const outPath = path.join(targetDir, ...entry.name.split("/"));
+    await mkdir(path.dirname(outPath), { recursive: true });
+    await writeFile(outPath, readZipEntryData(buffer, entry));
+  }
+
+  const opencodeDir = path.join(targetDir, ".opencode");
+  if (!(await pathExists(opencodeDir))) throw new Error("Archive is missing .opencode config");
+
+  const openworkPath = path.join(opencodeDir, "openwork.json");
+  let preset = "starter";
+  let workspaceName = typeof name === "string" && name.trim() ? name.trim() : null;
+
+  if (await pathExists(openworkPath)) {
+    const raw = await readFile(openworkPath, "utf8");
+    try {
+      const config = JSON.parse(raw);
+      config.authorizedRoots = [targetDir];
+      if (!workspaceName && typeof config.workspace?.name === "string" && config.workspace.name.trim()) {
+        workspaceName = config.workspace.name.trim();
+      }
+      if (typeof config.workspace?.preset === "string" && config.workspace.preset.trim()) {
+        preset = config.workspace.preset.trim();
+      }
+      await writeFile(openworkPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    } catch {
+      const config = defaultOpenworkConfig(targetDir, preset);
+      await writeFile(openworkPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    }
+  } else {
+    const config = defaultOpenworkConfig(targetDir, preset);
+    await writeFile(openworkPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  }
+
+  return {
+    workspaceName: workspaceName || path.basename(targetDir) || "Workspace",
+    preset,
+  };
+}
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
new file mode 100644
index 0000000000..22e3d85c8e
--- /dev/null
+++ b/apps/desktop/package.json
@@ -0,0 +1,38 @@
+{
+  "name": "@openwork/desktop",
+  "private": true,
+  "version": "0.13.3",
+  "description": "OpenWork desktop shell",
+  "author": {
+    "name": "OpenWork",
+    "email": "support@openworklabs.com"
+  },
+  "main": "electron/main.mjs",
+  "type": "module",
+  "scripts": {
+    "dev": "node ./scripts/electron-dev.mjs",
+    "dev:tauri": "OPENWORK_DEV_MODE=1 OPENWORK_DATA_DIR=\"$HOME/.openwork/openwork-orchestrator-dev\" tauri dev --config src-tauri/tauri.dev.conf.json --config \"{\\\"build\\\":{\\\"devUrl\\\":\\\"http://localhost:${PORT:-5173}\\\"}}\"",
+    "dev:electron": "node ./scripts/electron-dev.mjs",
+    "dev:windows": "node ./scripts/dev-windows.mjs",
+    "dev:windows:x64": "node ./scripts/dev-windows.mjs x64",
+    "build": "tauri build",
+    "build:electron": "node ./scripts/electron-build.mjs",
+    "package:electron": "pnpm run build:electron && pnpm exec electron-builder --config electron-builder.yml",
+    "package:electron:dir": "pnpm run build:electron && pnpm exec electron-builder --config electron-builder.yml --dir",
+    "electron": "pnpm exec electron ./electron/main.mjs",
+    "check:electron": "node ./scripts/check-electron-bridge.mjs",
+    "typecheck:electron": "pnpm --dir ../server exec tsc -p ../desktop/tsconfig.electron.json --noEmit",
+    "prepare:sidecar": "node ./scripts/prepare-sidecar.mjs"
+  },
+  "dependencies": {
+    "electron-updater": "^6.3.9"
+  },
+  "devDependencies": {
+    "@tauri-apps/cli": "^2.0.0",
+    "electron": "^35.0.0",
+    "electron-builder": "^25.1.8",
+    "electron-devtools-installer": "^4.0.0"
+  },
+  "packageManager": "pnpm@10.27.0",
+  "opencodeRouterVersion": "0.13.3"
+}
diff --git a/apps/desktop/resources/icons/dev/128x128.png b/apps/desktop/resources/icons/dev/128x128.png
new file mode 100644
index 0000000000..a23059f23f
Binary files /dev/null and b/apps/desktop/resources/icons/dev/128x128.png differ
diff --git a/apps/desktop/resources/icons/dev/128x128@2x.png b/apps/desktop/resources/icons/dev/128x128@2x.png
new file mode 100644
index 0000000000..54e89594f2
Binary files /dev/null and b/apps/desktop/resources/icons/dev/128x128@2x.png differ
diff --git a/apps/desktop/resources/icons/dev/32x32.png b/apps/desktop/resources/icons/dev/32x32.png
new file mode 100644
index 0000000000..ff485548eb
Binary files /dev/null and b/apps/desktop/resources/icons/dev/32x32.png differ
diff --git a/apps/desktop/resources/icons/dev/icon-dev.icns b/apps/desktop/resources/icons/dev/icon-dev.icns
new file mode 100644
index 0000000000..092f4b307b
Binary files /dev/null and b/apps/desktop/resources/icons/dev/icon-dev.icns differ
diff --git a/apps/desktop/resources/icons/dev/icon.png b/apps/desktop/resources/icons/dev/icon.png
new file mode 100644
index 0000000000..2dfa6987fd
Binary files /dev/null and b/apps/desktop/resources/icons/dev/icon.png differ
diff --git a/apps/desktop/resources/icons/icon.icns b/apps/desktop/resources/icons/icon.icns
new file mode 100644
index 0000000000..8bf7d28a1b
Binary files /dev/null and b/apps/desktop/resources/icons/icon.icns differ
diff --git a/apps/desktop/resources/icons/icon.ico b/apps/desktop/resources/icons/icon.ico
new file mode 100644
index 0000000000..8c7a2448fb
Binary files /dev/null and b/apps/desktop/resources/icons/icon.ico differ
diff --git a/apps/desktop/resources/icons/icon.png b/apps/desktop/resources/icons/icon.png
new file mode 100644
index 0000000000..558c56d93e
Binary files /dev/null and b/apps/desktop/resources/icons/icon.png differ
diff --git a/apps/desktop/scripts/check-electron-bridge.mjs b/apps/desktop/scripts/check-electron-bridge.mjs
new file mode 100644
index 0000000000..1205d31cd2
--- /dev/null
+++ b/apps/desktop/scripts/check-electron-bridge.mjs
@@ -0,0 +1,43 @@
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const desktopRoot = resolve(__dirname, "..");
+const repoRoot = resolve(desktopRoot, "../..");
+
+const desktopBridgePath = resolve(repoRoot, "apps/app/src/app/lib/desktop.ts");
+const electronMainPath = resolve(desktopRoot, "electron/main.mjs");
+
+const desktopBridgeSource = readFileSync(desktopBridgePath, "utf8");
+const electronMainSource = readFileSync(electronMainPath, "utf8");
+
+const destructure = desktopBridgeSource.match(/const\s*\{([\s\S]*?)\}\s*=\s*desktopBridge;/);
+if (!destructure?.[1]) {
+  throw new Error(`Could not find desktopBridge export destructure in ${desktopBridgePath}`);
+}
+
+const clientOnlyBridgeMethods = new Set([
+  // Pure helper implemented in apps/app/src/app/lib/desktop-tauri.ts and
+  // intentionally satisfied inside the renderer proxy, not over Electron IPC.
+  "resolveWorkspaceListSelectedId",
+]);
+
+const bridgeMethods = destructure[1]
+  .split(/\r?\n/)
+  .map((line) => line.replace(/\/\/.*$/, "").trim().replace(/,$/, ""))
+  .filter(Boolean)
+  .filter((name) => !clientOnlyBridgeMethods.has(name));
+
+const electronHandlers = new Set(
+  Array.from(electronMainSource.matchAll(/case\s+"([^"]+)"\s*:/g)).map((match) => match[1]),
+);
+
+const missing = bridgeMethods.filter((name) => !electronHandlers.has(name));
+if (missing.length > 0) {
+  console.error("Electron desktop bridge is missing IPC handlers:");
+  for (const name of missing) console.error(`- ${name}`);
+  process.exit(1);
+}
+
+console.log(`Electron desktop bridge covers ${bridgeMethods.length} renderer methods.`);
diff --git a/apps/desktop/scripts/chrome-devtools-mcp-shim.ts b/apps/desktop/scripts/chrome-devtools-mcp-shim.ts
new file mode 100644
index 0000000000..e45354d202
--- /dev/null
+++ b/apps/desktop/scripts/chrome-devtools-mcp-shim.ts
@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+
+const packageSpec =
+  process.env.OPENWORK_CHROME_DEVTOOLS_MCP_SPEC?.trim() ||
+  process.env.CHROME_DEVTOOLS_MCP_SPEC?.trim() ||
+  "chrome-devtools-mcp@0.17.0";
+
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const args = ["exec", "--yes", packageSpec, "--", ...process.argv.slice(2)];
+
+const child = spawn(npmCommand, args, {
+  stdio: "inherit",
+  env: {
+    ...process.env,
+    npm_config_yes: "true",
+  },
+});
+
+child.on("error", (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("ENOENT")) {
+    console.error(
+      "Control Chrome requires npm (Node.js). Install Node.js or configure mcp.chrome-devtools.command to a local chrome-devtools-mcp binary."
+    );
+  } else {
+    console.error(`Failed to start chrome-devtools-mcp via npm exec: ${message}`);
+  }
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code ?? 1);
+});
diff --git a/apps/desktop/scripts/dev-windows.mjs b/apps/desktop/scripts/dev-windows.mjs
new file mode 100644
index 0000000000..b16f5911a6
--- /dev/null
+++ b/apps/desktop/scripts/dev-windows.mjs
@@ -0,0 +1,120 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pnpmCmd = process.platform === "win32" ? "corepack.cmd" : "pnpm";
+const pnpmArgs = process.platform === "win32" ? ["pnpm"] : [];
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const tauriDebugDir = resolve(scriptDir, "../src-tauri/target/debug");
+const port = Number.parseInt(process.env.PORT ?? "", 10);
+const resolvedPort = Number.isFinite(port) && port > 0 ? port : 5173;
+const requestedTarget = process.argv[2] === "x64" ? "x64" : null;
+const hostArch = process.arch === "arm64" ? "arm64" : "x64";
+const targetArch = requestedTarget ?? hostArch;
+const tauriTarget = targetArch === "x64" && hostArch === "arm64" ? "x86_64-pc-windows-msvc" : null;
+const llvmBin = process.env.LLVM_BIN || "C:\\Program Files\\LLVM\\bin";
+
+const stopStaleSidecars = () => {
+  if (process.platform !== "win32") return;
+
+  const targetDir = tauriDebugDir.replace(/\\/g, "\\\\");
+  const command = [
+    `$targetDir = \"${targetDir}\"`,
+    "$names = @('opencode.exe','openwork-server.exe','openwork-orchestrator.exe','chrome-devtools-mcp.exe')",
+    "Get-CimInstance Win32_Process | Where-Object {",
+    "  $_.ExecutablePath -and $_.ExecutablePath.StartsWith($targetDir, [System.StringComparison]::OrdinalIgnoreCase) -and $names.Contains([System.IO.Path]::GetFileName($_.ExecutablePath))",
+    "} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
+  ].join("; ");
+
+  spawnSync("powershell.exe", ["-NoProfile", "-Command", command], {
+    stdio: "ignore",
+  });
+};
+
+const loadWindowsBuildEnv = () => {
+  if (process.platform !== "win32") return {};
+
+  const vsDevCmd =
+    process.env.VSDEVCMD_PATH ||
+    "C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\BuildTools\\Common7\\Tools\\VsDevCmd.bat";
+
+  if (!existsSync(vsDevCmd)) return {};
+
+  const command = `\"${vsDevCmd}\" -arch=${targetArch} -host_arch=${hostArch} >nul && set`;
+  const result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+  });
+
+  if (result.status !== 0 || !result.stdout) {
+    return {};
+  }
+
+  return Object.fromEntries(
+    result.stdout
+      .split(/\r?\n/)
+      .filter((line) => line.includes("="))
+      .map((line) => {
+        const index = line.indexOf("=");
+        return [line.slice(0, index), line.slice(index + 1)];
+      }),
+  );
+};
+
+const windowsBuildEnv = loadWindowsBuildEnv();
+stopStaleSidecars();
+const mergedPath = [
+  existsSync(llvmBin) ? llvmBin : null,
+  windowsBuildEnv.Path || windowsBuildEnv.PATH || process.env.Path || process.env.PATH || null,
+]
+  .filter(Boolean)
+  .join(";");
+
+const env = {
+  ...process.env,
+  ...windowsBuildEnv,
+  OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE || "1",
+  OPENWORK_DATA_DIR:
+    process.env.OPENWORK_DATA_DIR ||
+    `${homedir()}${process.platform === "win32" ? "\\" : "/"}.openwork${process.platform === "win32" ? "\\" : "/"}openwork-orchestrator-dev`,
+  OPENWORK_USE_COREPACK_PNPM: "1",
+  PORT: String(resolvedPort),
+  CC: process.env.CC || "clang",
+  CXX: process.env.CXX || "clang++",
+  CLANG_PATH: process.env.CLANG_PATH || (existsSync(llvmBin) ? `${llvmBin}\\clang.exe` : "clang"),
+  ...(tauriTarget
+    ? {
+        CC_x86_64_pc_windows_msvc: process.env.CC_x86_64_pc_windows_msvc || "clang",
+        TAURI_ENV_TARGET_TRIPLE: tauriTarget,
+        CARGO_BUILD_TARGET: tauriTarget,
+      }
+    : {
+        CC_aarch64_pc_windows_msvc: process.env.CC_aarch64_pc_windows_msvc || "clang",
+      }),
+};
+
+if (mergedPath) {
+  env.PATH = mergedPath;
+  env.Path = mergedPath;
+}
+
+const result = spawnSync(
+  pnpmCmd,
+  [
+    ...pnpmArgs,
+    "exec",
+    "tauri",
+    "dev",
+    ...(tauriTarget ? ["--target", tauriTarget] : []),
+    "--config",
+    "src-tauri/tauri.dev.conf.json",
+  ],
+  {
+    stdio: "inherit",
+    env,
+    shell: process.platform === "win32",
+  },
+);
+
+process.exit(result.status ?? 1);
diff --git a/apps/desktop/scripts/electron-after-pack.cjs b/apps/desktop/scripts/electron-after-pack.cjs
new file mode 100644
index 0000000000..5fab867ffa
--- /dev/null
+++ b/apps/desktop/scripts/electron-after-pack.cjs
@@ -0,0 +1,88 @@
+const fs = require("node:fs");
+const path = require("node:path");
+
+const sidecarBases = [
+  "opencode",
+  "openwork-server",
+  "openwork-orchestrator",
+  "chrome-devtools-mcp",
+];
+
+function targetTriple(platformName, arch) {
+  if (platformName === "darwin") {
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    if (arch === "x64") return "x86_64-apple-darwin";
+  }
+  if (platformName === "linux") {
+    if (arch === "arm64") return "aarch64-unknown-linux-gnu";
+    if (arch === "x64") return "x86_64-unknown-linux-gnu";
+  }
+  if (platformName === "win32") {
+    if (arch === "arm64") return "aarch64-pc-windows-msvc";
+    if (arch === "x64") return "x86_64-pc-windows-msvc";
+  }
+  return null;
+}
+
+function resolveSidecarsDir(context) {
+  if (context.electronPlatformName === "darwin") {
+    const entries = fs.existsSync(context.appOutDir) ? fs.readdirSync(context.appOutDir) : [];
+    const appName = entries.find((entry) => entry.endsWith(".app"));
+    return appName ? path.join(context.appOutDir, appName, "Contents", "Resources", "sidecars") : null;
+  }
+  return path.join(context.appOutDir, "resources", "sidecars");
+}
+
+function copyExecutableTargetToAlias(sidecarsDir, targetName, aliasName) {
+  const targetPath = path.join(sidecarsDir, targetName);
+  if (!fs.existsSync(targetPath)) {
+    throw new Error(`Missing packaged sidecar for target: ${targetName}`);
+  }
+
+  const aliasPath = path.join(sidecarsDir, aliasName);
+  fs.copyFileSync(targetPath, aliasPath);
+  try {
+    fs.chmodSync(aliasPath, 0o755);
+  } catch {
+    // Windows and some filesystems may ignore chmod.
+  }
+}
+
+async function afterPack(context) {
+  const triple = targetTriple(context.electronPlatformName, context.arch);
+  if (!triple) return;
+
+  const sidecarsDir = resolveSidecarsDir(context);
+  if (!sidecarsDir || !fs.existsSync(sidecarsDir)) return;
+
+  const isWindows = context.electronPlatformName === "win32";
+  const executableSuffix = isWindows ? ".exe" : "";
+  const keep = new Set();
+
+  for (const base of sidecarBases) {
+    const aliasName = `${base}${executableSuffix}`;
+    const targetName = `${base}-${triple}${executableSuffix}`;
+    copyExecutableTargetToAlias(sidecarsDir, targetName, aliasName);
+    keep.add(aliasName);
+    keep.add(targetName);
+  }
+
+  const versionsAlias = "versions.json";
+  const versionsTarget = `versions.json-${triple}${executableSuffix}`;
+  const versionsTargetPath = path.join(sidecarsDir, versionsTarget);
+  if (!fs.existsSync(versionsTargetPath)) {
+    throw new Error(`Missing packaged sidecar metadata for target: ${versionsTarget}`);
+  }
+  fs.copyFileSync(versionsTargetPath, path.join(sidecarsDir, versionsAlias));
+  keep.add(versionsAlias);
+  keep.add(versionsTarget);
+
+  for (const entry of fs.readdirSync(sidecarsDir)) {
+    if (!keep.has(entry)) {
+      fs.rmSync(path.join(sidecarsDir, entry), { force: true, recursive: true });
+    }
+  }
+}
+
+module.exports = afterPack;
+module.exports.default = afterPack;
diff --git a/apps/desktop/scripts/electron-after-sign.cjs b/apps/desktop/scripts/electron-after-sign.cjs
new file mode 100644
index 0000000000..6ce53ed4af
--- /dev/null
+++ b/apps/desktop/scripts/electron-after-sign.cjs
@@ -0,0 +1,59 @@
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, rmSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const path = require("node:path");
+
+function run(command, args) {
+  const result = spawnSync(command, args, { stdio: "inherit" });
+  if (result.status !== 0) {
+    throw new Error(`${command} ${args.join(" ")} failed with status ${result.status}`);
+  }
+}
+
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} is required to notarize the Electron macOS app`);
+  }
+  return value;
+}
+
+async function afterSign(context) {
+  if (context.electronPlatformName !== "darwin") return;
+
+  if (process.env.MACOS_NOTARIZE !== "true") {
+    console.warn("[electron-after-sign] MACOS_NOTARIZE is not true; skipping notarization.");
+    return;
+  }
+
+  const appName = `${context.packager.appInfo.productFilename}.app`;
+  const appPath = path.join(context.appOutDir, appName);
+  const notaryTempDir = mkdtempSync(path.join(tmpdir(), "openwork-electron-notary-"));
+  const notaryZipPath = path.join(notaryTempDir, `${context.packager.appInfo.productFilename}-notary.zip`);
+  const keyPath = requireEnv("APPLE_API_KEY_PATH");
+  const keyId = requireEnv("APPLE_API_KEY");
+  const issuer = requireEnv("APPLE_API_ISSUER");
+
+  try {
+    run("ditto", ["-c", "-k", "--keepParent", appPath, notaryZipPath]);
+    run("xcrun", [
+      "notarytool",
+      "submit",
+      notaryZipPath,
+      "--key",
+      keyPath,
+      "--key-id",
+      keyId,
+      "--issuer",
+      issuer,
+      "--wait",
+    ]);
+    run("xcrun", ["stapler", "staple", appPath]);
+    run("xcrun", ["stapler", "validate", appPath]);
+  } finally {
+    rmSync(notaryTempDir, { recursive: true, force: true });
+  }
+}
+
+module.exports = afterSign;
+module.exports.default = afterSign;
diff --git a/apps/desktop/scripts/electron-build.mjs b/apps/desktop/scripts/electron-build.mjs
new file mode 100644
index 0000000000..9a5925ea92
--- /dev/null
+++ b/apps/desktop/scripts/electron-build.mjs
@@ -0,0 +1,50 @@
+import { spawnSync } from "node:child_process";
+import { readdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const desktopRoot = resolve(__dirname, "..");
+const repoRoot = resolve(desktopRoot, "../..");
+const electronSidecarDir = resolve(desktopRoot, "resources", "sidecars");
+const electronRoot = resolve(desktopRoot, "electron");
+
+const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
+const nodeCmd = process.execPath;
+
+function run(command, args, cwd, env) {
+  const result = spawnSync(command, args, {
+    cwd,
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    env: env ? { ...process.env, ...env } : process.env,
+  });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+run(nodeCmd, [resolve(__dirname, "prepare-sidecar.mjs"), "--force", "--outdir", electronSidecarDir], desktopRoot);
+// OPENWORK_ELECTRON_BUILD tells Vite to emit relative asset paths so
+// index.html resolves /assets/* correctly when loaded via file:// from
+// inside the packaged .app bundle.
+run(pnpmCmd, ["--filter", "@openwork/app", "build"], repoRoot, {
+  OPENWORK_ELECTRON_BUILD: "1",
+});
+for (const fileName of readdirSync(electronRoot).filter((name) => name.endsWith(".mjs")).sort()) {
+  run(nodeCmd, ["--check", resolve(electronRoot, fileName)], repoRoot);
+}
+run(nodeCmd, [resolve(__dirname, "check-electron-bridge.mjs")], repoRoot);
+
+process.stdout.write(
+  `${JSON.stringify(
+    {
+      ok: true,
+      renderer: "apps/app/dist",
+      electronMain: "apps/desktop/electron/main.mjs",
+      electronPreload: "apps/desktop/electron/preload.mjs",
+    },
+    null,
+    2,
+  )}\n`,
+);
diff --git a/apps/desktop/scripts/electron-dev.mjs b/apps/desktop/scripts/electron-dev.mjs
new file mode 100644
index 0000000000..363f146dfe
--- /dev/null
+++ b/apps/desktop/scripts/electron-dev.mjs
@@ -0,0 +1,255 @@
+import { spawn, spawnSync } from "node:child_process";
+import net from "node:net";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const desktopRoot = resolve(__dirname, "..");
+const repoRoot = resolve(desktopRoot, "../..");
+const electronSidecarDir = resolve(desktopRoot, "resources", "sidecars");
+const defaultDevDataDir = resolve(
+  process.env.HOME ?? process.env.USERPROFILE ?? repoRoot,
+  ".openwork",
+  "openwork-orchestrator-dev",
+);
+
+const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
+const nodeCmd = process.execPath;
+const portValue = Number.parseInt(process.env.PORT ?? "", 10);
+const devPort = Number.isFinite(portValue) && portValue > 0 ? portValue : 5173;
+const explicitStartUrl = process.env.OPENWORK_ELECTRON_START_URL?.trim() || "";
+const startUrl = explicitStartUrl || `http://localhost:${devPort}`;
+const viteProbeUrls = explicitStartUrl
+  ? [explicitStartUrl]
+  : [
+      `http://127.0.0.1:${devPort}`,
+      `http://[::1]:${devPort}`,
+      `http://localhost:${devPort}`,
+    ];
+
+function run(command, args, options = {}) {
+  return spawn(command, args, {
+    stdio: ["ignore", "inherit", "inherit"],
+    shell: process.platform === "win32",
+    ...options,
+  });
+}
+
+function runSync(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    ...options,
+  });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+async function fetchWithTimeout(url, timeoutMs = 4000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function probeHost(host, port) {
+  return new Promise((resolveCheck) => {
+    const socket = net.createConnection({ host, port });
+    const onDone = (ready) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolveCheck(ready);
+    };
+    socket.setTimeout(1200);
+    socket.once("connect", () => onDone(true));
+    socket.once("timeout", () => onDone(false));
+    socket.once("error", () => onDone(false));
+  });
+}
+
+async function looksLikeVite(url) {
+  try {
+    const response = await fetchWithTimeout(`${url}/@vite/client`);
+    if (!response.ok) return false;
+    const body = await response.text();
+    return body.includes("@vite/client") || body.includes("import.meta.hot");
+  } catch {
+    return false;
+  }
+}
+
+async function portIsOpenForVite(url) {
+  try {
+    const parsed = new URL(url);
+    const host = parsed.hostname.replace(/^\[|\]$/g, "");
+    const port = Number.parseInt(parsed.port || (parsed.protocol === "https:" ? "443" : "80"), 10);
+    if (!Number.isFinite(port)) return false;
+    return probeHost(host, port);
+  } catch {
+    return false;
+  }
+}
+
+async function waitForVite(url, timeoutMs = 60_000) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    for (const candidate of [url, ...viteProbeUrls].filter(Boolean)) {
+      if (await looksLikeVite(candidate)) {
+        return candidate;
+      }
+    }
+    for (const candidate of [url, ...viteProbeUrls].filter(Boolean)) {
+      if (await portIsOpenForVite(candidate)) {
+        return candidate;
+      }
+    }
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 500));
+  }
+  throw new Error(`Timed out waiting for Vite dev server at ${viteProbeUrls.join(", ")}`);
+}
+
+function signalTree(child, signal) {
+  if (!child?.pid) return;
+  if (process.platform === "win32") {
+    try {
+      spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+    } catch {
+      // ignore
+    }
+    return;
+  }
+
+  try {
+    process.kill(-child.pid, signal);
+  } catch {
+    try {
+      child.kill(signal);
+    } catch {
+      // ignore
+    }
+  }
+}
+
+function restoreTerminal() {
+  try {
+    if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+      process.stdin.setRawMode(false);
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function waitForExit(child, timeoutMs) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise((resolveWait) => {
+    let settled = false;
+    const finish = (clean) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off("exit", onExit);
+      resolveWait(clean);
+    };
+    const onExit = () => finish(true);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    child.once("exit", onExit);
+  });
+}
+
+async function waitForChildren(children, timeoutMs) {
+  const results = await Promise.all(children.map((child) => waitForExit(child, timeoutMs)));
+  return results.every(Boolean);
+}
+
+let uiChild = null;
+let electronChild = null;
+let stopping = false;
+
+async function stopAll(exitCode = 0) {
+  if (stopping) return;
+  stopping = true;
+  restoreTerminal();
+
+  const children = [electronChild, uiChild].filter(Boolean);
+  for (const child of children) signalTree(child, "SIGINT");
+
+  const stoppedCleanly = await waitForChildren(children, 2_000);
+  if (!stoppedCleanly) {
+    for (const child of children) signalTree(child, "SIGTERM");
+    await waitForChildren(children, 1_000);
+  }
+
+  restoreTerminal();
+  process.exit(exitCode);
+}
+
+process.once("SIGINT", () => void stopAll(130));
+process.once("SIGTERM", () => void stopAll(143));
+
+runSync(nodeCmd, [resolve(__dirname, "prepare-sidecar.mjs"), "--force", "--outdir", electronSidecarDir], { cwd: desktopRoot });
+
+const initialProbeUrls = [startUrl, ...viteProbeUrls].filter(Boolean);
+let viteReady = false;
+for (const candidate of initialProbeUrls) {
+  if (await looksLikeVite(candidate)) {
+    viteReady = true;
+    break;
+  }
+}
+
+if (!viteReady) {
+  for (const candidate of initialProbeUrls) {
+    if (await portIsOpenForVite(candidate)) {
+      viteReady = true;
+      break;
+    }
+  }
+}
+
+if (!viteReady) {
+  uiChild = run(pnpmCmd, ["-w", "dev:ui"], {
+    cwd: repoRoot,
+    detached: process.platform !== "win32",
+    env: {
+      ...process.env,
+      PORT: String(devPort),
+      OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE ?? "1",
+      OPENWORK_DATA_DIR: process.env.OPENWORK_DATA_DIR ?? defaultDevDataDir,
+    },
+  });
+}
+
+const resolvedStartUrl = await waitForVite(startUrl);
+
+// Default Electron CDP on a stable dev port so chrome-devtools MCP / raw CDP
+// clients can attach without each launch picking a random port. Override with
+// OPENWORK_ELECTRON_REMOTE_DEBUG_PORT=<port> or set to "0" to disable.
+const defaultCdpPort = "9823";
+const cdpPortRaw = process.env.OPENWORK_ELECTRON_REMOTE_DEBUG_PORT?.trim() ?? defaultCdpPort;
+const cdpPort = cdpPortRaw === "" || cdpPortRaw === "0" ? "" : cdpPortRaw;
+
+electronChild = run(pnpmCmd, ["exec", "electron", "./electron/main.mjs"], {
+  cwd: desktopRoot,
+  detached: process.platform !== "win32",
+  env: {
+    ...process.env,
+    OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE ?? "1",
+    OPENWORK_DATA_DIR: process.env.OPENWORK_DATA_DIR ?? defaultDevDataDir,
+    OPENWORK_ELECTRON_START_URL: resolvedStartUrl,
+    ...(cdpPort ? { OPENWORK_ELECTRON_REMOTE_DEBUG_PORT: cdpPort } : {}),
+  },
+});
+
+if (cdpPort) {
+  console.log(`[openwork] Electron CDP exposed at http://127.0.0.1:${cdpPort}`);
+}
+
+electronChild.on("exit", (code) => {
+  if (stopping) return;
+  void stopAll(code ?? 0);
+});
diff --git a/apps/desktop/scripts/prepare-sidecar.mjs b/apps/desktop/scripts/prepare-sidecar.mjs
new file mode 100644
index 0000000000..c492d6954f
--- /dev/null
+++ b/apps/desktop/scripts/prepare-sidecar.mjs
@@ -0,0 +1,711 @@
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import {
+  chmodSync,
+  closeSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readSync,
+  readdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "fs";
+import { dirname, join, resolve } from "path";
+import { tmpdir } from "os";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const readArg = (name) => {
+  const raw = process.argv.slice(2);
+  const direct = raw.find((arg) => arg.startsWith(`${name}=`));
+  if (direct) return direct.split("=")[1];
+  const index = raw.indexOf(name);
+  if (index >= 0 && raw[index + 1]) return raw[index + 1];
+  return null;
+};
+
+const hasFlag = (name) => process.argv.slice(2).includes(name);
+const forceBuild = hasFlag("--force") || process.env.OPENWORK_SIDECAR_FORCE_BUILD === "1";
+const sidecarOverride = process.env.OPENWORK_SIDECAR_DIR?.trim() || readArg("--outdir");
+const sidecarDir = sidecarOverride ? resolve(sidecarOverride) : join(__dirname, "..", "src-tauri", "sidecars");
+const constantsPath = resolve(__dirname, "..", "..", "..", "constants.json");
+
+const opencodeGithubRepo = (() => {
+  const raw =
+    process.env.OPENCODE_GITHUB_REPO?.trim() ||
+    process.env.OPENWORK_OPENCODE_GITHUB_REPO?.trim() ||
+    "anomalyco/opencode";
+  const normalized = raw
+    .replace(/^https:\/\/github\.com\//i, "")
+    .replace(/\.git$/i, "")
+    .trim();
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(normalized)) {
+    return "anomalyco/opencode";
+  }
+  return normalized;
+})();
+const opencodeVersion = (() => {
+  try {
+    const raw = readFileSync(constantsPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.opencodeVersion === "string" ? parsed.opencodeVersion.trim() || null : null;
+  } catch {
+    return null;
+  }
+})();
+
+const normalizeVersion = (value) => {
+  const raw = String(value ?? "").trim();
+  if (!raw) return null;
+  if (raw.toLowerCase() === "latest") return null;
+  return raw.startsWith("v") ? raw.slice(1) : raw;
+};
+
+const opencodeAssetOverride = process.env.OPENCODE_ASSET?.trim() || null;
+const chromeDevtoolsMcpVersion =
+  process.env.CHROME_DEVTOOLS_MCP_VERSION?.trim() ||
+  process.env.OPENWORK_CHROME_DEVTOOLS_MCP_VERSION?.trim() ||
+  "0.17.0";
+
+// Target triple for native platform binaries
+const resolvedTargetTriple = (() => {
+  const envTarget =
+    process.env.TAURI_ENV_TARGET_TRIPLE ??
+    process.env.CARGO_CFG_TARGET_TRIPLE ??
+    process.env.TARGET;
+  if (envTarget) return envTarget;
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "aarch64-unknown-linux-gnu" : "x86_64-unknown-linux-gnu";
+  }
+  if (process.platform === "win32") {
+    return process.arch === "arm64" ? "aarch64-pc-windows-msvc" : "x86_64-pc-windows-msvc";
+  }
+  return null;
+})();
+const isWindowsTarget = process.platform === "win32" || resolvedTargetTriple?.includes("windows") === true;
+
+const bunTarget = (() => {
+  switch (resolvedTargetTriple) {
+    case "aarch64-apple-darwin":
+      return "bun-darwin-arm64";
+    case "x86_64-apple-darwin":
+      return "bun-darwin-x64-baseline";
+    case "aarch64-unknown-linux-gnu":
+      return "bun-linux-arm64";
+    case "x86_64-unknown-linux-gnu":
+      return "bun-linux-x64-baseline";
+    // Windows baseline artifacts intermittently fail to extract in CI
+    // with Bun 1.3.6. Use the stable x64 target here for now.
+    case "x86_64-pc-windows-msvc":
+      return "bun-windows-x64";
+    case "aarch64-pc-windows-msvc":
+      return "bun-windows-arm64";
+    default:
+      return null;
+  }
+})();
+
+const opencodeBaseName = isWindowsTarget ? "opencode.exe" : "opencode";
+const opencodePath = join(sidecarDir, opencodeBaseName);
+const opencodeTargetName = resolvedTargetTriple
+  ? `opencode-${resolvedTargetTriple}${isWindowsTarget ? ".exe" : ""}`
+  : null;
+const opencodeTargetPath = opencodeTargetName ? join(sidecarDir, opencodeTargetName) : null;
+
+const opencodeCandidatePath = opencodeTargetPath ?? opencodePath;
+let existingOpencodeVersion = null;
+
+// openwork-server paths
+const openworkServerBaseName = "openwork-server";
+const openworkServerName = isWindowsTarget ? `${openworkServerBaseName}.exe` : openworkServerBaseName;
+const openworkServerPath = join(sidecarDir, openworkServerName);
+const openworkServerBuildName = bunTarget
+  ? `${openworkServerBaseName}-${bunTarget}${bunTarget.includes("windows") ? ".exe" : ""}`
+  : openworkServerName;
+const openworkServerBuildPath = join(sidecarDir, openworkServerBuildName);
+const openworkServerTargetTriple = resolvedTargetTriple;
+const openworkServerTargetName = openworkServerTargetTriple
+  ? `${openworkServerBaseName}-${openworkServerTargetTriple}${openworkServerTargetTriple.includes("windows") ? ".exe" : ""}`
+  : null;
+const openworkServerTargetPath = openworkServerTargetName ? join(sidecarDir, openworkServerTargetName) : null;
+
+const openworkServerDir = resolve(__dirname, "..", "..", "server");
+
+const resolveBuildScript = (dir) => {
+  const scriptPath = resolve(dir, "script", "build.ts");
+  if (existsSync(scriptPath)) return scriptPath;
+  const scriptsPath = resolve(dir, "scripts", "build.ts");
+  if (existsSync(scriptsPath)) return scriptsPath;
+  return scriptPath;
+};
+
+// orchestrator paths
+const orchestratorBaseName = "openwork-orchestrator";
+const orchestratorName =
+  isWindowsTarget ? `${orchestratorBaseName}.exe` : orchestratorBaseName;
+const orchestratorPath = join(sidecarDir, orchestratorName);
+const orchestratorBuildName = bunTarget
+  ? `${orchestratorBaseName}-${bunTarget}${bunTarget.includes("windows") ? ".exe" : ""}`
+  : orchestratorName;
+const orchestratorBuildPath = join(sidecarDir, orchestratorBuildName);
+const orchestratorTargetTriple = resolvedTargetTriple;
+const orchestratorTargetName = orchestratorTargetTriple
+  ? `${orchestratorBaseName}-${orchestratorTargetTriple}${orchestratorTargetTriple.includes("windows") ? ".exe" : ""}`
+  : null;
+const orchestratorTargetPath = orchestratorTargetName ? join(sidecarDir, orchestratorTargetName) : null;
+const orchestratorDir = resolve(__dirname, "..", "..", "orchestrator");
+
+// chrome-devtools-mcp shim sidecar
+const chromeDevtoolsBaseName = "chrome-devtools-mcp";
+const chromeDevtoolsName = isWindowsTarget ? `${chromeDevtoolsBaseName}.exe` : chromeDevtoolsBaseName;
+const chromeDevtoolsPath = join(sidecarDir, chromeDevtoolsName);
+const chromeDevtoolsBuildName = bunTarget
+  ? `${chromeDevtoolsBaseName}-${bunTarget}${bunTarget.includes("windows") ? ".exe" : ""}`
+  : chromeDevtoolsName;
+const chromeDevtoolsBuildPath = join(sidecarDir, chromeDevtoolsBuildName);
+const chromeDevtoolsTargetTriple = resolvedTargetTriple;
+const chromeDevtoolsTargetName = chromeDevtoolsTargetTriple
+  ? `${chromeDevtoolsBaseName}-${chromeDevtoolsTargetTriple}${chromeDevtoolsTargetTriple.includes("windows") ? ".exe" : ""}`
+  : null;
+const chromeDevtoolsTargetPath = chromeDevtoolsTargetName ? join(sidecarDir, chromeDevtoolsTargetName) : null;
+const chromeDevtoolsShimPath = resolve(__dirname, "chrome-devtools-mcp-shim.ts");
+
+const readHeader = (filePath, length = 256) => {
+  const fd = openSync(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(length);
+    const bytesRead = readSync(fd, buffer, 0, length, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+};
+
+const isStubBinary = (filePath) => {
+  try {
+    const stat = statSync(filePath);
+    if (!stat.isFile()) return true;
+    if (stat.size < 1024) return true;
+    const header = readHeader(filePath);
+    if (header.startsWith("#!")) return true;
+    if (header.includes("Sidecar missing") || header.includes("Bun is required")) return true;
+  } catch {
+    return true;
+  }
+  return false;
+};
+
+const readDirectory = (dir) => {
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  return entries.flatMap((entry) => {
+    const next = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      return readDirectory(next);
+    }
+    if (entry.isFile()) {
+      return [next];
+    }
+    return [];
+  });
+};
+
+const findOpencodeBinary = (dir) => {
+  const candidates = readDirectory(dir);
+  return (
+    candidates.find((file) => file.endsWith(`/${opencodeBaseName}`) || file.endsWith(`\\${opencodeBaseName}`)) ??
+    candidates.find((file) => file.endsWith("/opencode.exe") || file.endsWith("\\opencode.exe")) ??
+    candidates.find((file) => file.endsWith("/opencode") || file.endsWith("\\opencode")) ??
+    null
+  );
+};
+
+const readBinaryVersion = (filePath) => {
+  try {
+    const result = spawnSync(filePath, ["--version"], { encoding: "utf8" });
+    if (result.status === 0 && result.stdout) return result.stdout.trim();
+  } catch {
+    // ignore
+  }
+  return null;
+};
+
+const sha256File = (filePath) => {
+  const hash = createHash("sha256");
+  hash.update(readFileSync(filePath));
+  return hash.digest("hex");
+};
+
+const adHocSignDarwin = (filePath) => {
+  if (process.platform !== "darwin" || !filePath || !existsSync(filePath)) return;
+  const remove = spawnSync("codesign", ["--remove-signature", filePath], {
+    encoding: "utf8",
+  });
+  if (remove.error && remove.error.code === "ENOENT") {
+    throw new Error("codesign is required to prepare runnable macOS sidecars");
+  }
+
+  const sign = spawnSync("codesign", ["--force", "--sign", "-", filePath], {
+    encoding: "utf8",
+  });
+  if (sign.error) {
+    if (sign.error.code === "ENOENT") {
+      throw new Error("codesign is required to prepare runnable macOS sidecars");
+    }
+    throw sign.error;
+  }
+  if (sign.status !== 0) {
+    const stderr = sign.stderr?.trim();
+    throw new Error(`Failed to codesign ${filePath}${stderr ? `: ${stderr}` : ""}`);
+  }
+};
+
+const adHocSignDarwinSidecars = (paths) => {
+  if (process.platform !== "darwin") return;
+  for (const filePath of [...new Set(paths.filter(Boolean))]) {
+    adHocSignDarwin(filePath);
+  }
+};
+
+const parseChecksum = (content, assetName) => {
+  const lines = content.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const [hash, name] = trimmed.split(/\s+/);
+    if (name === assetName) return hash.toLowerCase();
+    if (trimmed.endsWith(` ${assetName}`)) {
+      return trimmed.split(/\s+/)[0]?.toLowerCase() ?? null;
+    }
+  }
+  return null;
+};
+
+let didBuildOpenworkServer = false;
+const shouldBuildOpenworkServer =
+  forceBuild || !existsSync(openworkServerBuildPath) || isStubBinary(openworkServerBuildPath);
+
+if (shouldBuildOpenworkServer) {
+  mkdirSync(sidecarDir, { recursive: true });
+  if (existsSync(openworkServerBuildPath)) {
+    try {
+      unlinkSync(openworkServerBuildPath);
+    } catch {
+      // ignore
+    }
+  }
+  const openworkServerScript = resolveBuildScript(openworkServerDir);
+  if (!existsSync(openworkServerScript)) {
+    console.error(`OpenWork server build script not found at ${openworkServerScript}`);
+    process.exit(1);
+  }
+  const openworkServerArgs = [openworkServerScript, "--outdir", sidecarDir, "--filename", "openwork-server"];
+  if (bunTarget) {
+    openworkServerArgs.push("--target", bunTarget);
+  }
+  const buildResult = spawnSync("bun", openworkServerArgs, {
+    cwd: openworkServerDir,
+    stdio: "inherit",
+    shell: true,
+  });
+
+  if (buildResult.status !== 0) {
+    process.exit(buildResult.status ?? 1);
+  }
+
+  didBuildOpenworkServer = true;
+}
+
+if (existsSync(openworkServerBuildPath)) {
+  const shouldCopyCanonical = didBuildOpenworkServer || !existsSync(openworkServerPath) || isStubBinary(openworkServerPath);
+  if (shouldCopyCanonical && openworkServerBuildPath !== openworkServerPath) {
+    try {
+      if (existsSync(openworkServerPath)) {
+        unlinkSync(openworkServerPath);
+      }
+    } catch {
+      // ignore
+    }
+    copyFileSync(openworkServerBuildPath, openworkServerPath);
+  }
+
+  if (openworkServerTargetPath) {
+    const shouldCopyTarget =
+      didBuildOpenworkServer || !existsSync(openworkServerTargetPath) || isStubBinary(openworkServerTargetPath);
+    if (shouldCopyTarget && openworkServerBuildPath !== openworkServerTargetPath) {
+      try {
+        if (existsSync(openworkServerTargetPath)) {
+          unlinkSync(openworkServerTargetPath);
+        }
+      } catch {
+        // ignore
+      }
+      copyFileSync(openworkServerBuildPath, openworkServerTargetPath);
+    }
+  }
+}
+
+if (!existingOpencodeVersion && opencodeCandidatePath) {
+  existingOpencodeVersion =
+    existsSync(opencodeCandidatePath) && !isStubBinary(opencodeCandidatePath)
+      ? readBinaryVersion(opencodeCandidatePath)
+      : null;
+}
+
+const normalizedOpencodeVersion = normalizeVersion(opencodeVersion);
+
+if (!normalizedOpencodeVersion) {
+  console.error(
+    `OpenCode version could not be resolved from ${constantsPath}.`
+  );
+  process.exit(1);
+}
+
+const opencodeAssetByTarget = {
+  "aarch64-apple-darwin": "opencode-darwin-arm64.zip",
+  "x86_64-apple-darwin": "opencode-darwin-x64-baseline.zip",
+  "x86_64-unknown-linux-gnu": "opencode-linux-x64-baseline.tar.gz",
+  "aarch64-unknown-linux-gnu": "opencode-linux-arm64.tar.gz",
+  "x86_64-pc-windows-msvc": "opencode-windows-x64-baseline.zip",
+  "aarch64-pc-windows-msvc": "opencode-windows-arm64.zip",
+};
+
+const opencodeAsset =
+  opencodeAssetOverride ?? (resolvedTargetTriple ? opencodeAssetByTarget[resolvedTargetTriple] : null);
+
+const opencodeUrl = opencodeAsset
+  ? `https://github.com/${opencodeGithubRepo}/releases/download/v${normalizedOpencodeVersion}/${opencodeAsset}`
+  : null;
+
+const shouldDownloadOpencode =
+  !opencodeCandidatePath ||
+  !existsSync(opencodeCandidatePath) ||
+  isStubBinary(opencodeCandidatePath) ||
+  !existingOpencodeVersion ||
+  existingOpencodeVersion !== normalizedOpencodeVersion;
+
+if (!shouldDownloadOpencode) {
+  console.log(`OpenCode sidecar already present (${existingOpencodeVersion}).`);
+}
+
+if (shouldDownloadOpencode) {
+  if (!opencodeAsset || !opencodeUrl) {
+    console.error(
+      `No OpenCode asset configured for target ${resolvedTargetTriple ?? "unknown"}. Set OPENCODE_ASSET to override.`
+    );
+    process.exit(1);
+  }
+
+  mkdirSync(sidecarDir, { recursive: true });
+
+  const stamp = Date.now();
+  const archivePath = join(tmpdir(), `opencode-${stamp}-${opencodeAsset}`);
+  const extractDir = join(tmpdir(), `opencode-${stamp}`);
+
+  mkdirSync(extractDir, { recursive: true });
+
+  if (process.platform === "win32") {
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const psScript = [
+      "$ErrorActionPreference = 'Stop'",
+      `Invoke-WebRequest -Uri ${psQuote(opencodeUrl)} -OutFile ${psQuote(archivePath)}`,
+      `Expand-Archive -Path ${psQuote(archivePath)} -DestinationPath ${psQuote(extractDir)} -Force`,
+    ].join("; ");
+
+    const result = spawnSync("powershell", ["-NoProfile", "-Command", psScript], {
+      stdio: "inherit",
+    });
+
+    if (result.status !== 0) {
+      process.exit(result.status ?? 1);
+    }
+  } else {
+    const downloadResult = spawnSync("curl", ["-fsSL", "-o", archivePath, opencodeUrl], {
+      stdio: "inherit",
+    });
+    if (downloadResult.status !== 0) {
+      process.exit(downloadResult.status ?? 1);
+    }
+
+    mkdirSync(extractDir, { recursive: true });
+
+    if (opencodeAsset.endsWith(".zip")) {
+      const unzipResult = spawnSync("unzip", ["-q", archivePath, "-d", extractDir], {
+        stdio: "inherit",
+      });
+      if (unzipResult.status !== 0) {
+        process.exit(unzipResult.status ?? 1);
+      }
+    } else if (opencodeAsset.endsWith(".tar.gz")) {
+      const tarResult = spawnSync("tar", ["-xzf", archivePath, "-C", extractDir], {
+        stdio: "inherit",
+      });
+      if (tarResult.status !== 0) {
+        process.exit(tarResult.status ?? 1);
+      }
+    } else {
+      console.error(`Unknown OpenCode archive type: ${opencodeAsset}`);
+      process.exit(1);
+    }
+  }
+
+  const extractedBinary = findOpencodeBinary(extractDir);
+  if (!extractedBinary) {
+    console.error("OpenCode binary not found after extraction.");
+    process.exit(1);
+  }
+
+  const opencodeTargets = [opencodeTargetPath, opencodePath].filter(Boolean);
+  for (const target of opencodeTargets) {
+    try {
+      if (existsSync(target)) {
+        unlinkSync(target);
+      }
+    } catch {
+      // ignore
+    }
+    copyFileSync(extractedBinary, target);
+    try {
+      chmodSync(target, 0o755);
+    } catch {
+      // ignore
+    }
+  }
+
+  console.log(`OpenCode sidecar updated to ${normalizedOpencodeVersion}.`);
+}
+
+// Build orchestrator sidecar
+let didBuildOrchestrator = false;
+const shouldBuildOrchestrator =
+  forceBuild || !existsSync(orchestratorBuildPath) || isStubBinary(orchestratorBuildPath);
+if (shouldBuildOrchestrator) {
+  mkdirSync(sidecarDir, { recursive: true });
+  if (existsSync(orchestratorBuildPath)) {
+    try {
+      unlinkSync(orchestratorBuildPath);
+    } catch {
+      // ignore
+    }
+  }
+  const orchestratorBuildScript = resolveBuildScript(orchestratorDir);
+  if (!existsSync(orchestratorBuildScript)) {
+    console.error(`Orchestrator build script not found at ${orchestratorBuildScript}`);
+    process.exit(1);
+  }
+  const orchestratorArgs = [
+    orchestratorBuildScript,
+    "--outdir",
+    sidecarDir,
+    "--filename",
+    orchestratorBaseName,
+  ];
+  if (bunTarget) {
+    orchestratorArgs.push("--target", bunTarget);
+  }
+  const result = spawnSync("bun", orchestratorArgs, {
+    cwd: orchestratorDir,
+    stdio: "inherit",
+    shell: true,
+    env: {
+      ...process.env,
+      NODE_ENV: "production",
+      BUN_ENV: "production",
+    },
+  });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+
+  didBuildOrchestrator = true;
+}
+
+if (existsSync(orchestratorBuildPath)) {
+  const shouldCopyCanonical =
+    didBuildOrchestrator || !existsSync(orchestratorPath) || isStubBinary(orchestratorPath);
+  if (shouldCopyCanonical && orchestratorBuildPath !== orchestratorPath) {
+    try {
+      if (existsSync(orchestratorPath)) unlinkSync(orchestratorPath);
+    } catch {
+      // ignore
+    }
+    copyFileSync(orchestratorBuildPath, orchestratorPath);
+  }
+
+  if (orchestratorTargetPath) {
+    const shouldCopyTarget =
+      didBuildOrchestrator ||
+      !existsSync(orchestratorTargetPath) ||
+      isStubBinary(orchestratorTargetPath);
+    if (shouldCopyTarget && orchestratorBuildPath !== orchestratorTargetPath) {
+      try {
+        if (existsSync(orchestratorTargetPath)) unlinkSync(orchestratorTargetPath);
+      } catch {
+        // ignore
+      }
+      copyFileSync(orchestratorBuildPath, orchestratorTargetPath);
+    }
+  }
+}
+
+// Build chrome-devtools-mcp shim sidecar
+let didBuildChromeDevtools = false;
+const shouldBuildChromeDevtools =
+  forceBuild || !existsSync(chromeDevtoolsBuildPath) || isStubBinary(chromeDevtoolsBuildPath);
+if (shouldBuildChromeDevtools) {
+  mkdirSync(sidecarDir, { recursive: true });
+  if (existsSync(chromeDevtoolsBuildPath)) {
+    try {
+      unlinkSync(chromeDevtoolsBuildPath);
+    } catch {
+      // ignore
+    }
+  }
+
+  if (!existsSync(chromeDevtoolsShimPath)) {
+    console.error(`Chrome DevTools MCP shim source not found at ${chromeDevtoolsShimPath}`);
+    process.exit(1);
+  }
+
+  const chromeDevtoolsArgs = [
+    "build",
+    "--compile",
+    chromeDevtoolsShimPath,
+    "--outfile",
+    chromeDevtoolsBuildPath,
+  ];
+  if (bunTarget) {
+    chromeDevtoolsArgs.push("--target", bunTarget);
+  }
+
+  const result = spawnSync("bun", chromeDevtoolsArgs, {
+    cwd: __dirname,
+    stdio: "inherit",
+    shell: true,
+    env: {
+      ...process.env,
+      NODE_ENV: "production",
+      BUN_ENV: "production",
+    },
+  });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+
+  didBuildChromeDevtools = true;
+}
+
+if (existsSync(chromeDevtoolsBuildPath)) {
+  const shouldCopyCanonical =
+    didBuildChromeDevtools || !existsSync(chromeDevtoolsPath) || isStubBinary(chromeDevtoolsPath);
+  if (shouldCopyCanonical && chromeDevtoolsBuildPath !== chromeDevtoolsPath) {
+    try {
+      if (existsSync(chromeDevtoolsPath)) unlinkSync(chromeDevtoolsPath);
+    } catch {
+      // ignore
+    }
+    copyFileSync(chromeDevtoolsBuildPath, chromeDevtoolsPath);
+  }
+
+  if (chromeDevtoolsTargetPath) {
+    const shouldCopyTarget =
+      didBuildChromeDevtools ||
+      !existsSync(chromeDevtoolsTargetPath) ||
+      isStubBinary(chromeDevtoolsTargetPath);
+    if (shouldCopyTarget && chromeDevtoolsBuildPath !== chromeDevtoolsTargetPath) {
+      try {
+        if (existsSync(chromeDevtoolsTargetPath)) unlinkSync(chromeDevtoolsTargetPath);
+      } catch {
+        // ignore
+      }
+      copyFileSync(chromeDevtoolsBuildPath, chromeDevtoolsTargetPath);
+    }
+  }
+}
+
+adHocSignDarwinSidecars([
+  opencodePath,
+  opencodeTargetPath,
+  openworkServerBuildPath,
+  openworkServerPath,
+  openworkServerTargetPath,
+  orchestratorBuildPath,
+  orchestratorPath,
+  orchestratorTargetPath,
+  chromeDevtoolsBuildPath,
+  chromeDevtoolsPath,
+  chromeDevtoolsTargetPath,
+]);
+
+const openworkServerVersion = (() => {
+  try {
+    const raw = readFileSync(resolve(openworkServerDir, "package.json"), "utf8");
+    return String(JSON.parse(raw).version ?? "").trim();
+  } catch {
+    return null;
+  }
+})();
+
+const orchestratorVersion = (() => {
+  try {
+    const raw = readFileSync(resolve(orchestratorDir, "package.json"), "utf8");
+    return String(JSON.parse(raw).version ?? "").trim();
+  } catch {
+    return null;
+  }
+})();
+
+const versions = {
+  opencode: {
+    version: normalizedOpencodeVersion,
+    sha256: opencodeCandidatePath && existsSync(opencodeCandidatePath) ? sha256File(opencodeCandidatePath) : null,
+  },
+  "openwork-server": {
+    version: openworkServerVersion,
+    sha256: existsSync(openworkServerPath) ? sha256File(openworkServerPath) : null,
+  },
+  "openwork-orchestrator": {
+    version: orchestratorVersion,
+    sha256: existsSync(orchestratorPath) ? sha256File(orchestratorPath) : null,
+  },
+  "chrome-devtools-mcp": {
+    version: chromeDevtoolsMcpVersion,
+    sha256: existsSync(chromeDevtoolsPath) ? sha256File(chromeDevtoolsPath) : null,
+  },
+};
+
+const missing = Object.entries(versions)
+  .filter(([, info]) => !info.version || !info.sha256)
+  .map(([name]) => name);
+
+if (missing.length) {
+  console.error(`Sidecar version metadata incomplete for: ${missing.join(", ")}`);
+  process.exit(1);
+}
+
+const versionsPath = join(sidecarDir, "versions.json");
+try {
+  mkdirSync(sidecarDir, { recursive: true });
+  const content = JSON.stringify(versions, null, 2) + "\n";
+  writeFileSync(versionsPath, content, "utf8");
+  if (resolvedTargetTriple) {
+    const targetSuffix = isWindowsTarget ? ".exe" : "";
+    const targetVersionsPath = join(sidecarDir, `versions.json-${resolvedTargetTriple}${targetSuffix}`);
+    writeFileSync(targetVersionsPath, content, "utf8");
+  }
+} catch (error) {
+  console.error(`Failed to write versions.json: ${error}`);
+  process.exit(1);
+}
diff --git a/apps/desktop/scripts/tauri-before-build.mjs b/apps/desktop/scripts/tauri-before-build.mjs
new file mode 100644
index 0000000000..f752e64588
--- /dev/null
+++ b/apps/desktop/scripts/tauri-before-build.mjs
@@ -0,0 +1,18 @@
+import { spawnSync } from "node:child_process";
+
+const pnpmCmd = process.platform === "win32" ? "corepack.cmd" : "pnpm";
+const pnpmArgs = process.platform === "win32" ? ["pnpm"] : [];
+
+const runPnpm = (args) => {
+  const result = spawnSync(pnpmCmd, [...pnpmArgs, ...args], {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+  });
+
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+};
+
+runPnpm(["-C", "../..", "--filter", "@openwork/desktop", "run", "prepare:sidecar"]);
+runPnpm(["--filter", "@openwork/app", "build"]);
diff --git a/apps/desktop/scripts/tauri-before-dev.mjs b/apps/desktop/scripts/tauri-before-dev.mjs
new file mode 100644
index 0000000000..87f05579b1
--- /dev/null
+++ b/apps/desktop/scripts/tauri-before-dev.mjs
@@ -0,0 +1,327 @@
+import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const useCorepackPnpm = process.platform === "win32" && process.env.OPENWORK_USE_COREPACK_PNPM === "1";
+const pnpmCmd = useCorepackPnpm ? "corepack.cmd" : process.platform === "win32" ? "pnpm.cmd" : "pnpm";
+const pnpmArgs = useCorepackPnpm ? ["pnpm"] : [];
+
+const readPort = () => {
+  const value = Number.parseInt(process.env.PORT ?? "", 10);
+  return Number.isFinite(value) && value > 0 ? value : 5173;
+};
+
+const hostOverride = process.env.OPENWORK_DEV_HOST?.trim() || null;
+const port = readPort();
+const baseUrls = (hostOverride ? [hostOverride] : ["127.0.0.1", "localhost"]).map((host) => `http://${host}:${port}`);
+const expectedAppRoot = resolve(fileURLToPath(new URL("../../app", import.meta.url)));
+
+const fetchWithTimeout = async (url, { timeoutMs = 1200 } = {}) => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { signal: controller.signal, redirect: "manual" });
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+const killProcessTree = (child) => {
+  if (!child?.pid) return;
+
+  if (process.platform === "win32") {
+    // Best-effort: kill process + children.
+    try {
+      spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+    } catch {
+      // ignore
+    }
+    return;
+  }
+
+  // If spawned detached, pid is also the process group id.
+  try {
+    process.kill(-child.pid, "SIGTERM");
+  } catch {
+    try {
+      child.kill("SIGTERM");
+    } catch {
+      // ignore
+    }
+  }
+
+  // Escalate if it doesn't stop quickly.
+  const timer = setTimeout(() => {
+    try {
+      process.kill(-child.pid, "SIGKILL");
+    } catch {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+        // ignore
+      }
+    }
+  }, 1500);
+  timer.unref?.();
+};
+
+const holdOpenUntilSignal = ({ uiChild, watchedViteUrl } = {}) => {
+  // Node 25+ may exit with a non-zero status when it detects an unsettled
+  // top-level await. We avoid top-level await entirely and keep the event loop
+  // alive with a timer until Tauri stops the dev process.
+  const timer = setInterval(() => {}, 60_000);
+  let watchTimer = null;
+  let watchInFlight = false;
+
+  let stopping = false;
+
+  const stop = (code = 0) => {
+    if (stopping) return;
+    stopping = true;
+
+    if (uiChild) {
+      killProcessTree(uiChild);
+    }
+
+    if (watchTimer) {
+      clearInterval(watchTimer);
+    }
+    clearInterval(timer);
+    process.exit(code);
+  };
+
+  if (watchedViteUrl) {
+    watchTimer = setInterval(async () => {
+      if (stopping || watchInFlight) return;
+      watchInFlight = true;
+      try {
+        if (!(await looksLikeVite(watchedViteUrl))) {
+          console.error(
+            `[openwork] Reused UI dev server at ${watchedViteUrl} is no longer reachable; stopping desktop dev.`
+          );
+          stop(1);
+        }
+      } finally {
+        watchInFlight = false;
+      }
+    }, 2500);
+  }
+
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+};
+
+const portHasHttpServer = async (baseUrl) => {
+  try {
+    await fetchWithTimeout(baseUrl, { timeoutMs: 900 });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const looksLikeVite = async (baseUrl) => {
+  try {
+    const res = await fetchWithTimeout(`${baseUrl}/@vite/client`, { timeoutMs: 1200 });
+    if (!res.ok) return false;
+
+    const contentType = (res.headers.get("content-type") || "").toLowerCase();
+    if (contentType.includes("javascript")) return true;
+
+    const body = await res.text();
+    return body.includes("import.meta.hot") || body.includes("@vite/client");
+  } catch {
+    return false;
+  }
+};
+
+const fetchOpenWorkDevServerId = async (baseUrl) => {
+  try {
+    const res = await fetchWithTimeout(`${baseUrl}/__openwork_dev_server_id`, { timeoutMs: 1200 });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data?.appRoot === "string" ? resolve(data.appRoot) : null;
+  } catch {
+    return null;
+  }
+};
+
+const runPrepareSidecars = () => {
+  const prepareScript = resolve(fileURLToPath(new URL("./prepare-sidecar.mjs", import.meta.url)));
+  const args = [prepareScript];
+  if (process.env.OPENWORK_SIDECAR_FORCE_BUILD !== "0") {
+    args.push("--force");
+  }
+  const result = spawnSync(process.execPath, args, {
+    stdio: "inherit",
+  });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+};
+
+const readLinuxReleaseInfo = () => {
+  try {
+    const content = readFileSync("/etc/os-release", "utf8");
+    const values = new Map();
+    for (const line of content.split(/\r?\n/)) {
+      if (!line || line.startsWith("#") || !line.includes("=")) continue;
+      const separator = line.indexOf("=");
+      const key = line.slice(0, separator);
+      const rawValue = line.slice(separator + 1).trim();
+      const value = rawValue.replace(/^"|"$/g, "");
+      values.set(key, value);
+    }
+    return {
+      id: values.get("ID") ?? "",
+      like: values.get("ID_LIKE") ?? "",
+      prettyName: values.get("PRETTY_NAME") ?? values.get("NAME") ?? "Linux",
+    };
+  } catch {
+    return { id: "", like: "", prettyName: "Linux" };
+  }
+};
+
+const getLinuxDesktopDependencyHint = () => {
+  const release = readLinuxReleaseInfo();
+  const family = `${release.id} ${release.like}`.toLowerCase();
+
+  if (family.includes("arch")) {
+    return "Install the missing desktop dependency and retry:\n  sudo pacman -S --needed webkit2gtk-4.1";
+  }
+
+  if (family.includes("ubuntu") || family.includes("debian")) {
+    return (
+      "Install the missing desktop dependencies and retry:\n" +
+      "  sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev"
+    );
+  }
+
+  if (family.includes("fedora") || family.includes("rhel")) {
+    return (
+      "Install the missing desktop dependencies and retry:\n" +
+      "  sudo dnf install webkit2gtk4.1-devel openssl-devel curl wget file libappindicator-gtk3-devel librsvg2-devel"
+    );
+  }
+
+  return `Install WebKitGTK 4.1 development packages for ${release.prettyName} so pkg-config can resolve both webkit2gtk-4.1 and javascriptcoregtk-4.1, then retry.`;
+};
+
+const ensureLinuxDesktopDependencies = () => {
+  if (process.platform !== "linux") return;
+
+  const requiredPkgConfigs = ["webkit2gtk-4.1", "javascriptcoregtk-4.1"];
+  const missing = requiredPkgConfigs.filter((pkg) => {
+    const result = spawnSync("pkg-config", ["--exists", pkg], { stdio: "ignore" });
+    return result.status !== 0;
+  });
+
+  if (missing.length === 0) return;
+
+  console.error(
+    "[openwork] Missing Linux desktop system dependencies required by Tauri:\n" +
+      `  ${missing.join(", ")}\n\n` +
+      `${getLinuxDesktopDependencyHint()}\n\n` +
+      "If you only need the web UI, run `pnpm dev:ui`."
+  );
+  process.exit(1);
+};
+
+const runUiDevServer = () => {
+  const uiArgs =
+    process.platform === "win32"
+      ? [...pnpmArgs, "--filter", "@openwork/app", "dev:windows"]
+      : [...pnpmArgs, "-w", "dev:ui"];
+  const child = spawn(pnpmCmd, uiArgs, {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    detached: process.platform !== "win32",
+    env: {
+      ...process.env,
+      // Make sure vite sees the intended port.
+      PORT: String(port),
+      OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE || "1",
+    },
+  });
+
+  const forwardSignal = (signal) => {
+    try {
+      child.kill(signal);
+    } catch {
+      // ignore
+    }
+  };
+
+  process.on("SIGINT", () => forwardSignal("SIGINT"));
+  process.on("SIGTERM", () => forwardSignal("SIGTERM"));
+
+  child.on("exit", (code, signal) => {
+    if (signal) process.exit(0);
+    process.exit(code ?? 0);
+  });
+
+  return child;
+};
+
+runPrepareSidecars();
+ensureLinuxDesktopDependencies();
+
+const main = async () => {
+  let detectedViteUrl = null;
+  let detectedViteAppRoot = null;
+  for (const candidate of baseUrls) {
+    if (await looksLikeVite(candidate)) {
+      detectedViteUrl = candidate;
+      detectedViteAppRoot = await fetchOpenWorkDevServerId(candidate);
+      break;
+    }
+  }
+
+  if (detectedViteUrl) {
+    if (detectedViteAppRoot && detectedViteAppRoot !== expectedAppRoot) {
+      console.error(
+        `[openwork] Found a Vite dev server at ${detectedViteUrl}, but it serves a different checkout:\n` +
+          `  running app root: ${detectedViteAppRoot}\n` +
+          `  expected app root: ${expectedAppRoot}\n\n` +
+          `Stop the other dev server or run with a different PORT (for example: PORT=5174 pnpm dev).`
+      );
+      process.exit(1);
+    }
+    if (!detectedViteAppRoot) {
+      console.error(
+        `[openwork] Found a Vite dev server at ${detectedViteUrl}, but could not verify which checkout it belongs to.\n` +
+          `Stop the other dev server or run with a different PORT (for example: PORT=5174 pnpm dev).`
+      );
+      process.exit(1);
+    }
+    console.log(`[openwork] UI dev server already running at ${detectedViteUrl} (reusing).`);
+    holdOpenUntilSignal({ watchedViteUrl: detectedViteUrl });
+    return;
+  }
+
+  let portInUse = false;
+  for (const candidate of baseUrls) {
+    if (await portHasHttpServer(candidate)) {
+      portInUse = true;
+      break;
+    }
+  }
+
+  if (portInUse) {
+    console.error(
+      `[openwork] Port ${port} is in use, but it does not look like a Vite dev server.\n` +
+        `Set PORT to a free port (e.g. PORT=5174) or stop the process using port ${port}.`
+    );
+    process.exit(1);
+  }
+
+  console.log(`[openwork] Starting UI dev server on port ${port}...`);
+  const uiChild = runUiDevServer();
+  holdOpenUntilSignal({ uiChild });
+};
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});
diff --git a/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
similarity index 58%
rename from src-tauri/Cargo.lock
rename to apps/desktop/src-tauri/Cargo.lock
index 50259f9d7c..f69dad18ef 100644
--- a/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -8,6 +8,17 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -43,9 +54,149 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+dependencies = [
+ "async-channel",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if",
+ "event-listener",
+ "futures-lite",
+ "rustix",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if",
+ "futures-core",
+ "futures-io",
+ "rustix",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "atk"
@@ -94,6 +245,27 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -102,9 +274,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 dependencies = [
  "serde_core",
 ]
@@ -127,6 +299,19 @@ dependencies = [
  "objc2",
 ]
 
+[[package]]
+name = "blocking"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.2"
@@ -150,15 +335,15 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytemuck"
-version = "1.24.0"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 
 [[package]]
 name = "byteorder"
@@ -168,20 +353,40 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "cairo-rs"
 version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "cairo-sys-rs",
  "glib",
  "libc",
@@ -229,7 +434,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_json",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -239,16 +444,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77"
 dependencies = [
  "serde",
- "toml 0.9.11+spec-1.1.0",
+ "toml 0.9.12+spec-1.1.0",
 ]
 
 [[package]]
 name = "cc"
-version = "1.2.52"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd4932aefd12402b36c60956a4fe0035421f544799057659ff86f923657aada3"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
  "find-msvc-tools",
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
@@ -285,11 +492,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chrono"
-version = "0.4.42"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
  "num-traits",
@@ -297,6 +510,16 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -307,6 +530,41 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "constant_time_eq"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
+
 [[package]]
 name = "convert_case"
 version = "0.4.0"
@@ -319,10 +577,39 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
+ "percent-encoding",
  "time",
  "version_check",
 ]
 
+[[package]]
+name = "cookie_store"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "log",
+ "publicsuffix",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -341,12 +628,12 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "core-graphics"
-version = "0.24.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa95a34622365fa5bbf40b20b75dba8dfa8c94c734aea8ac9a5ca38af14316f1"
+checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97"
 dependencies = [
- "bitflags 2.10.0",
- "core-foundation",
+ "bitflags 2.11.1",
+ "core-foundation 0.10.1",
  "core-graphics-types",
  "foreign-types",
  "libc",
@@ -358,8 +645,8 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
 dependencies = [
- "bitflags 2.10.0",
- "core-foundation",
+ "bitflags 2.11.1",
+ "core-foundation 0.10.1",
  "libc",
 ]
 
@@ -396,6 +683,12 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -423,6 +716,19 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf 0.13.1",
+ "smallvec",
+]
+
 [[package]]
 name = "cssparser-macros"
 version = "0.6.1"
@@ -430,7 +736,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -440,14 +746,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
 dependencies = [
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "darling"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -455,39 +761,55 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
 dependencies = [
- "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
+[[package]]
+name = "data-url"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
+
 [[package]]
 name = "deranged"
-version = "0.5.5"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "powerfmt",
  "serde_core",
 ]
 
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "derive_more"
 version = "0.99.20"
@@ -498,7 +820,28 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -509,6 +852,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -532,19 +876,13 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "dispatch"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
-
 [[package]]
 name = "dispatch2"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89a09f22a6c6069a18470eb92d2298acf25463f14256d24778e1230d789a2aec"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "block2",
  "libc",
  "objc2",
@@ -558,7 +896,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -581,7 +919,40 @@ checksum = "0fbbb781877580993a8707ec48672673ec7b81eeba04cfd2310bd28c08e47c8f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "dlv-list"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
+dependencies = [
+ "const-random",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "dom_query"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89"
+dependencies = [
+ "bit-set",
+ "cssparser 0.36.0",
+ "foldhash 0.2.0",
+ "html5ever 0.38.0",
+ "precomputed-hash",
+ "selectors 0.36.1",
+ "tendril 0.5.0",
 ]
 
 [[package]]
@@ -620,16 +991,22 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
 [[package]]
 name = "embed-resource"
-version = "3.0.6"
+version = "3.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55a075fc573c64510038d7ee9abc7990635863992f83ebc52c8b433b8411a02e"
+checksum = "c31a88c8d26de40ed18fe748c547845aa39de1db3afd958f8cb91579f3644bcb"
 dependencies = [
  "cc",
  "memchr",
  "rustc_version",
- "toml 0.9.11+spec-1.1.0",
+ "toml 1.1.2+spec-1.1.0",
  "vswhom",
  "winreg",
 ]
@@ -641,22 +1018,95 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
 
 [[package]]
-name = "equivalent"
-version = "1.0.2"
+name = "encoding_rs"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
 
 [[package]]
-name = "erased-serde"
-version = "0.4.9"
+name = "endi"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e8918065695684b2b0702da20382d5ae6065cf3327bc2d6436bd49a71ce9f3"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "erased-serde"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
 dependencies = [
  "serde",
  "serde_core",
  "typeid",
 ]
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
 [[package]]
 name = "fdeflate"
 version = "0.3.7"
@@ -676,17 +1126,28 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.7"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f449e6c6c08c865631d4890cfacf252b3d396c9bcc83adb6623cdb02a8336c41"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "flate2"
-version = "1.1.8"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b375d6465b98090a5f25b1c7703f3859783755aa9a80433b36e0379a3ec2f369"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -698,6 +1159,18 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -716,7 +1189,7 @@ checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -734,6 +1207,15 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fsevent-sys"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "futf"
 version = "0.1.5"
@@ -746,24 +1228,24 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -772,38 +1254,51 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-core",
  "futures-io",
@@ -812,7 +1307,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -934,6 +1428,16 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "gethostname"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0176e0459c2e4a1fe232f984bca6890e681076abb9934f6cea7c326f3fc47818"
+dependencies = [
+ "libc",
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.1.16"
@@ -952,8 +1456,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -961,11 +1467,26 @@ name = "getrandom"
 version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "wasip2",
+ "wasip3",
 ]
 
 [[package]]
@@ -1006,7 +1527,7 @@ version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -1034,7 +1555,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1113,7 +1634,26 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
 ]
 
 [[package]]
@@ -1124,9 +1664,24 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.16.1"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
 
 [[package]]
 name = "heck"
@@ -1140,12 +1695,27 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.29.1"
@@ -1154,10 +1724,20 @@ checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
 dependencies = [
  "log",
  "mac",
- "markup5ever",
+ "markup5ever 0.14.1",
  "match_token",
 ]
 
+[[package]]
+name = "html5ever"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2"
+dependencies = [
+ "log",
+ "markup5ever 0.38.0",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -1199,35 +1779,50 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2",
  "http",
  "http-body",
  "httparse",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.7",
+]
+
 [[package]]
 name = "hyper-util"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "http",
  "http-body",
@@ -1237,16 +1832,18 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry 0.6.1",
 ]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.64"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -1268,9 +1865,9 @@ dependencies = [
 
 [[package]]
 name = "ico"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc50b891e4acf8fe0e71ef88ec43ad82ee07b3810ad09de10f1d01f072ed4b98"
+checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371"
 dependencies = [
  "byteorder",
  "png",
@@ -1278,12 +1875,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -1291,9 +1889,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1304,9 +1902,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1318,15 +1916,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -1338,15 +1936,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1357,6 +1955,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -1376,9 +1980,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -1397,12 +2001,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.0",
  "serde",
  "serde_core",
 ]
@@ -1416,27 +2020,75 @@ dependencies = [
  "cfb",
 ]
 
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "iri-string"
-version = "0.7.10"
+version = "0.7.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+checksum = "25e659a4bb38e810ebc252e53b5814ff908a8c58c2a9ce2fae1bbec24cbf4e20"
 dependencies = [
  "memchr",
  "serde",
 ]
 
+[[package]]
+name = "is-docker"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "is-wsl"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5"
+dependencies = [
+ "is-docker",
+ "once_cell",
+]
+
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "javascriptcore-rs"
@@ -1470,7 +2122,7 @@ dependencies = [
  "cesu8",
  "cfg-if",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.1",
  "log",
  "thiserror 1.0.69",
  "walkdir",
@@ -1478,71 +2130,166 @@ dependencies = [
 ]
 
 [[package]]
-name = "jni-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
-
-[[package]]
-name = "js-sys"
-version = "0.3.83"
+name = "jni"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
 dependencies = [
- "once_cell",
- "wasm-bindgen",
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
-name = "json-patch"
-version = "3.0.1"
+name = "jni-macros"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
 dependencies = [
- "jsonptr",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.117",
 ]
 
 [[package]]
-name = "jsonptr"
-version = "0.6.3"
+name = "jni-sys"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
 dependencies = [
- "serde",
- "serde_json",
+ "jni-sys 0.4.1",
 ]
 
 [[package]]
-name = "keyboard-types"
-version = "0.7.0"
+name = "jni-sys"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
 dependencies = [
- "bitflags 2.10.0",
- "serde",
- "unicode-segmentation",
+ "jni-sys-macros",
 ]
 
 [[package]]
-name = "kuchikiki"
-version = "0.8.8-speedreader"
+name = "jni-sys-macros"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02cb977175687f33fa4afa0c95c112b987ea1443e5a51c8f8ff27dc618270cc2"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
 dependencies = [
- "cssparser",
- "html5ever",
- "indexmap 2.13.0",
- "selectors",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
-name = "lazy_static"
-version = "1.5.0"
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.97"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json-patch"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
+dependencies = [
+ "jsonptr",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "json5"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
+dependencies = [
+ "pest",
+ "pest_derive",
+ "serde",
+]
+
+[[package]]
+name = "jsonptr"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "keyboard-types"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
+dependencies = [
+ "bitflags 2.11.1",
+ "serde",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "kqueue"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "kuchikiki"
+version = "0.8.8-speedreader"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02cb977175687f33fa4afa0c95c112b987ea1443e5a51c8f8ff27dc618270cc2"
+dependencies = [
+ "cssparser 0.29.6",
+ "html5ever 0.29.1",
+ "indexmap 2.14.0",
+ "selectors 0.24.0",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libappindicator"
@@ -1570,9 +2317,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libloading"
@@ -1586,19 +2333,45 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.12"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "libc",
+ "plain",
+ "redox_syscall 0.7.4",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "local-ip-address"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612ed4ea9ce5acfb5d26339302528a5e1e59dfed95e9e11af3c083236ff1d15d"
+dependencies = [
+ "libc",
+ "neli",
+ "thiserror 1.0.69",
+ "windows-sys 0.48.0",
+]
 
 [[package]]
 name = "lock_api"
@@ -1615,6 +2388,12 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -1630,9 +2409,20 @@ dependencies = [
  "log",
  "phf 0.11.3",
  "phf_codegen 0.11.3",
- "string_cache",
- "string_cache_codegen",
- "tendril",
+ "string_cache 0.8.9",
+ "string_cache_codegen 0.5.4",
+ "tendril 0.4.3",
+]
+
+[[package]]
+name = "markup5ever"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862"
+dependencies = [
+ "log",
+ "tendril 0.5.0",
+ "web_atoms",
 ]
 
 [[package]]
@@ -1643,7 +2433,7 @@ checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1654,9 +2444,9 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "memoffset"
@@ -1673,6 +2463,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minisign-verify"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1685,9 +2481,21 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
@@ -1696,9 +2504,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.17.1"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01c1738382f66ed56b3b9c8119e794a2e23148ac8ea214eda86622d4cb9d415a"
+checksum = "7c9fec5a4e89860383d778d10563a605838f8f0b2f9303868937e5ff32e86177"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -1711,7 +2519,7 @@ dependencies = [
  "once_cell",
  "png",
  "serde",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "windows-sys 0.60.2",
 ]
 
@@ -1721,8 +2529,8 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
 dependencies = [
- "bitflags 2.10.0",
- "jni-sys",
+ "bitflags 2.11.1",
+ "jni-sys 0.3.1",
  "log",
  "ndk-sys",
  "num_enum",
@@ -1742,7 +2550,32 @@ version = "0.6.0+11769913"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
 dependencies = [
- "jni-sys",
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "neli"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93062a0dce6da2517ea35f301dfc88184ce18d3601ec786a727a87bf535deca9"
+dependencies = [
+ "byteorder",
+ "libc",
+ "log",
+ "neli-proc-macros",
+]
+
+[[package]]
+name = "neli-proc-macros"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c8034b7fbb6f9455b2a96c19e6edf8dc9fc34c70449938d8ee3b4df363f61fe"
+dependencies = [
+ "either",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -1757,11 +2590,30 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.11.1",
+ "crossbeam-channel",
+ "filetime",
+ "fsevent-sys",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio 0.8.11",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 
 [[package]]
 name = "num-traits"
@@ -1774,9 +2626,9 @@ dependencies = [
 
 [[package]]
 name = "num_enum"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
 dependencies = [
  "num_enum_derive",
  "rustversion",
@@ -1784,21 +2636,21 @@ dependencies = [
 
 [[package]]
 name = "num_enum_derive"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "proc-macro-crate 3.4.0",
+ "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "objc2"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c2599ce0ec54857b29ce62166b0ed9b4f6f1a70ccc9a71165b6154caca8c05"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
 dependencies = [
  "objc2-encode",
  "objc2-exception-helper",
@@ -1810,40 +2662,10 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "block2",
- "libc",
  "objc2",
- "objc2-cloud-kit",
- "objc2-core-data",
  "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-core-image",
- "objc2-core-text",
- "objc2-core-video",
- "objc2-foundation",
- "objc2-quartz-core",
-]
-
-[[package]]
-name = "objc2-cloud-kit"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
-dependencies = [
- "bitflags 2.10.0",
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-data"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
-dependencies = [
- "bitflags 2.10.0",
- "objc2",
  "objc2-foundation",
 ]
 
@@ -1853,7 +2675,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "dispatch2",
  "objc2",
 ]
@@ -1864,48 +2686,13 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "dispatch2",
  "objc2",
  "objc2-core-foundation",
  "objc2-io-surface",
 ]
 
-[[package]]
-name = "objc2-core-image"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
-dependencies = [
- "objc2",
- "objc2-foundation",
-]
-
-[[package]]
-name = "objc2-core-text"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
-dependencies = [
- "bitflags 2.10.0",
- "objc2",
- "objc2-core-foundation",
- "objc2-core-graphics",
-]
-
-[[package]]
-name = "objc2-core-video"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d425caf1df73233f29fd8a5c3e5edbc30d2d4307870f802d18f00d83dc5141a6"
-dependencies = [
- "bitflags 2.10.0",
- "objc2",
- "objc2-core-foundation",
- "objc2-core-graphics",
- "objc2-io-surface",
-]
-
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -1927,7 +2714,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "block2",
  "libc",
  "objc2",
@@ -1940,19 +2727,21 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-core-foundation",
 ]
 
 [[package]]
-name = "objc2-javascript-core"
+name = "objc2-osa-kit"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a1e6550c4caed348956ce3370c9ffeca70bb1dbed4fa96112e7c6170e074586"
+checksum = "f112d1746737b0da274ef79a23aac283376f335f4095a083a267a082f21db0c0"
 dependencies = [
+ "bitflags 2.11.1",
  "objc2",
- "objc2-core-foundation",
+ "objc2-app-kit",
+ "objc2-foundation",
 ]
 
 [[package]]
@@ -1961,30 +2750,19 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-core-foundation",
  "objc2-foundation",
 ]
 
-[[package]]
-name = "objc2-security"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe137109bd1e8b5a99390f77a7d8b2961dafc1a1c5db8f2e60329ad6d895a"
-dependencies = [
- "bitflags 2.10.0",
- "objc2",
- "objc2-core-foundation",
-]
-
 [[package]]
 name = "objc2-ui-kit"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-core-foundation",
  "objc2-foundation",
@@ -1996,31 +2774,66 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "block2",
  "objc2",
  "objc2-app-kit",
  "objc2-core-foundation",
  "objc2-foundation",
- "objc2-javascript-core",
- "objc2-security",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "open"
+version = "5.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f3bab717c29a857abf75fcef718d441ec7cb2725f937343c734740a985d37fd"
+dependencies = [
+ "dunce",
+ "is-wsl",
+ "libc",
+ "pathdiff",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openwork"
-version = "0.1.1"
+version = "0.13.3"
 dependencies = [
+ "dirs",
+ "gethostname",
+ "json5",
+ "local-ip-address",
+ "notify",
+ "objc2",
+ "objc2-foundation",
  "serde",
  "serde_json",
+ "sha2",
  "tauri",
  "tauri-build",
+ "tauri-plugin-deep-link",
  "tauri-plugin-dialog",
+ "tauri-plugin-http",
+ "tauri-plugin-opener",
+ "tauri-plugin-process",
+ "tauri-plugin-shell",
+ "tauri-plugin-single-instance",
+ "tauri-plugin-updater",
+ "ureq",
+ "uuid",
+ "walkdir",
+ "zip 0.6.6",
 ]
 
 [[package]]
@@ -2029,6 +2842,50 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
+[[package]]
+name = "ordered-multimap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+dependencies = [
+ "dlv-list",
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "osakit"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "732c71caeaa72c065bb69d7ea08717bd3f4863a4f451402fc9513e29dbd5261b"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+ "objc2-osa-kit",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "pango"
 version = "0.18.3"
@@ -2054,6 +2911,12 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -2072,17 +2935,89 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.5.18",
  "smallvec",
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "pathdiff"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
+
+[[package]]
+name = "pbkdf2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+dependencies = [
+ "digest",
+ "hmac",
+ "password-hash",
+ "sha2",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "pest"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
+dependencies = [
+ "pest",
+ "sha2",
+]
+
 [[package]]
 name = "phf"
 version = "0.8.0"
@@ -2113,6 +3048,17 @@ dependencies = [
  "phf_shared 0.11.3",
 ]
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
+ "serde",
+]
+
 [[package]]
 name = "phf_codegen"
 version = "0.8.0"
@@ -2133,6 +3079,16 @@ dependencies = [
  "phf_shared 0.11.3",
 ]
 
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+]
+
 [[package]]
 name = "phf_generator"
 version = "0.8.0"
@@ -2150,7 +3106,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
  "phf_shared 0.10.0",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -2160,7 +3116,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared 0.11.3",
- "rand 0.8.5",
+ "rand 0.8.6",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared 0.13.1",
 ]
 
 [[package]]
@@ -2187,7 +3153,20 @@ dependencies = [
  "phf_shared 0.11.3",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2214,35 +3193,55 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
 dependencies = [
- "siphasher 1.0.1",
+ "siphasher 1.0.2",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher 1.0.2",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
-name = "pin-utils"
-version = "0.1.0"
+name = "piper"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
 
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
 name = "plist"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "740ebea15c5d1428f910cd1a5f52cebf8d25006245ed8ade92702f4943d91e07"
+checksum = "092791278e026273c1b65bbdcfbba3a300f2994c896bd01ab01da613c29c46f1"
 dependencies = [
  "base64 0.22.1",
- "indexmap 2.13.0",
+ "indexmap 2.14.0",
  "quick-xml",
  "serde",
  "time",
@@ -2261,11 +3260,25 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -2291,6 +3304,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "1.3.1"
@@ -2313,11 +3336,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml_edit 0.25.11+spec-1.1.0",
 ]
 
 [[package]]
@@ -2352,27 +3375,98 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.105"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "publicsuffix"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42ea446cab60335f76979ec15e12619a2165b5ae2c12166bef27d283a9fadf"
+dependencies = [
+ "idna",
+ "psl-types",
+]
+
 [[package]]
 name = "quick-xml"
-version = "0.38.4"
+version = "0.39.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
+checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"
 dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "quote"
-version = "1.0.43"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -2383,6 +3477,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -2399,15 +3499,25 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -2422,10 +3532,20 @@ dependencies = [
 name = "rand_chacha"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2446,6 +3566,15 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@@ -2476,7 +3605,16 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f450ad9c3b1da563fb6948a8e0fb0fb9269711c9c73d9ea1de5058c79c8d643a"
+dependencies = [
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -2487,7 +3625,7 @@ checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -2507,14 +3645,14 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2524,9 +3662,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2535,9 +3673,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "reqwest"
@@ -2547,22 +3685,69 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "cookie",
+ "cookie_store",
+ "encoding_rs",
  "futures-core",
- "futures-util",
+ "h2",
  "http",
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
  "percent-encoding",
  "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-http",
@@ -2598,6 +3783,36 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rust-ini"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
+dependencies = [
+ "cfg-if",
+ "ordered-multimap",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -2607,6 +3822,94 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.11.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni 0.22.4",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -2615,9 +3918,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -2628,6 +3931,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "schemars"
 version = "0.8.22"
@@ -2657,9 +3969,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e910108742c57a770f492731f99be216a52fadd361b06c8fb59d74ccc267d2"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
 dependencies = [
  "dyn-clone",
  "ref-cast",
@@ -2676,7 +3988,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2685,6 +3997,29 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.11.1",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "selectors"
 version = "0.24.0"
@@ -2692,22 +4027,41 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c37578180969d00692904465fb7f6b3d50b9a2b952b87c23d0e2e5cb5013416"
 dependencies = [
  "bitflags 1.3.2",
- "cssparser",
- "derive_more",
+ "cssparser 0.29.6",
+ "derive_more 0.99.20",
  "fxhash",
  "log",
  "phf 0.8.0",
  "phf_codegen 0.8.0",
  "precomputed-hash",
- "servo_arc",
+ "servo_arc 0.2.0",
+ "smallvec",
+]
+
+[[package]]
+name = "selectors"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c"
+dependencies = [
+ "bitflags 2.11.1",
+ "cssparser 0.36.0",
+ "derive_more 2.1.1",
+ "log",
+ "new_debug_unreachable",
+ "phf 0.13.1",
+ "phf_codegen 0.13.1",
+ "precomputed-hash",
+ "rustc-hash",
+ "servo_arc 0.4.3",
  "smallvec",
 ]
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 dependencies = [
  "serde",
  "serde_core",
@@ -2752,7 +4106,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2763,7 +4117,7 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2787,7 +4141,7 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2801,9 +4155,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
  "serde_core",
 ]
@@ -2822,17 +4176,17 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.16.1"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7"
+checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
 dependencies = [
  "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.13.0",
+ "indexmap 2.14.0",
  "schemars 0.9.0",
- "schemars 1.2.0",
+ "schemars 1.2.1",
  "serde_core",
  "serde_json",
  "serde_with_macros",
@@ -2841,14 +4195,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.16.1"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52a8e3ca0ca629121f70ab50f95249e5a6f925cc0f6ffe8256c45b728875706c"
+checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2870,7 +4224,7 @@ checksum = "772ee033c0916d670af7860b6e1ef7d658a4629a6d0b4c8c3e67f09b3765b75d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2883,6 +4237,26 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -2894,17 +4268,75 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "shared_child"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e362d9935bc50f019969e2f9ecd66786612daae13e8f277be7bfb66e8bed3f7"
+dependencies = [
+ "libc",
+ "sigchld",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "sigchld"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47106eded3c154e70176fc83df9737335c94ce22f821c32d17ed1db1f83badb1"
+dependencies = [
+ "libc",
+ "os_pipe",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
 [[package]]
 name = "simd-adler32"
-version = "0.3.8"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "siphasher"
@@ -2914,15 +4346,15 @@ checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
 
 [[package]]
 name = "siphasher"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
@@ -2932,12 +4364,12 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2955,7 +4387,7 @@ dependencies = [
  "objc2-foundation",
  "objc2-quartz-core",
  "raw-window-handle",
- "redox_syscall",
+ "redox_syscall 0.5.18",
  "tracing",
  "wasm-bindgen",
  "web-sys",
@@ -3007,6 +4439,18 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared 0.13.1",
+ "precomputed-hash",
+]
+
 [[package]]
 name = "string_cache_codegen"
 version = "0.5.4"
@@ -3019,12 +4463,30 @@ dependencies = [
  "quote",
 ]
 
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -3049,9 +4511,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3075,7 +4537,28 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.11.1",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
 ]
 
 [[package]]
@@ -3093,23 +4576,22 @@ dependencies = [
 
 [[package]]
 name = "tao"
-version = "0.34.5"
+version = "0.34.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3a753bdc39c07b192151523a3f77cd0394aa75413802c883a0f6f6a0e5ee2e7"
+checksum = "9103edf55f2da3c82aea4c7fab7c4241032bfeea0e71fa557d98e00e7ce7cc20"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "block2",
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-graphics",
  "crossbeam-channel",
- "dispatch",
+ "dispatch2",
  "dlopen2",
  "dpi",
  "gdkwayland-sys",
  "gdkx11-sys",
  "gtk",
- "jni",
- "lazy_static",
+ "jni 0.21.1",
  "libc",
  "log",
  "ndk",
@@ -3121,7 +4603,6 @@ dependencies = [
  "once_cell",
  "parking_lot",
  "raw-window-handle",
- "scopeguard",
  "tao-macros",
  "unicode-segmentation",
  "url",
@@ -3135,11 +4616,22 @@ dependencies = [
 name = "tao-macros"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4e16beb8b2ac17db28eab8bca40e62dbfbb34c0fcdc6d9826b11b7b5d047dfd"
+checksum = "f4e16beb8b2ac17db28eab8bca40e62dbfbb34c0fcdc6d9826b11b7b5d047dfd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
+ "filetime",
+ "libc",
+ "xattr",
 ]
 
 [[package]]
@@ -3150,9 +4642,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "tauri"
-version = "2.9.5"
+version = "2.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a3868da5508446a7cd08956d523ac3edf0a8bc20bf7e4038f9a95c2800d2033"
+checksum = "da77cc00fb9028caf5b5d4650f75e31f1ef3693459dfca7f7e506d1ecef0ba2d"
 dependencies = [
  "anyhow",
  "bytes",
@@ -3165,7 +4657,7 @@ dependencies = [
  "gtk",
  "heck 0.5.0",
  "http",
- "jni",
+ "jni 0.21.1",
  "libc",
  "log",
  "mime",
@@ -3178,7 +4670,7 @@ dependencies = [
  "percent-encoding",
  "plist",
  "raw-window-handle",
- "reqwest",
+ "reqwest 0.13.3",
  "serde",
  "serde_json",
  "serde_repr",
@@ -3189,7 +4681,7 @@ dependencies = [
  "tauri-runtime",
  "tauri-runtime-wry",
  "tauri-utils",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tokio",
  "tray-icon",
  "url",
@@ -3201,9 +4693,9 @@ dependencies = [
 
 [[package]]
 name = "tauri-build"
-version = "2.5.3"
+version = "2.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17fcb8819fd16463512a12f531d44826ce566f486d7ccd211c9c8cebdaec4e08"
+checksum = "4bbc990d1dbf57a8e1c7fa2327f2a614d8b757805603c1b9ba5c81bade09fd4d"
 dependencies = [
  "anyhow",
  "cargo_toml",
@@ -3217,15 +4709,15 @@ dependencies = [
  "serde_json",
  "tauri-utils",
  "tauri-winres",
- "toml 0.9.11+spec-1.1.0",
+ "toml 0.9.12+spec-1.1.0",
  "walkdir",
 ]
 
 [[package]]
 name = "tauri-codegen"
-version = "2.5.2"
+version = "2.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa9844cefcf99554a16e0a278156ae73b0d8680bbc0e2ad1e4287aadd8489cf"
+checksum = "d4a24476afd977c5d5d169f72425868613d82747916dd29e0a357c84c4bd6d29"
 dependencies = [
  "base64 0.22.1",
  "brotli",
@@ -3239,9 +4731,9 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "syn 2.0.114",
+ "syn 2.0.117",
  "tauri-utils",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "time",
  "url",
  "uuid",
@@ -3250,23 +4742,23 @@ dependencies = [
 
 [[package]]
 name = "tauri-macros"
-version = "2.5.2"
+version = "2.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3764a12f886d8245e66b7ee9b43ccc47883399be2019a61d80cf0f4117446fde"
+checksum = "d39b349a98dadaffebb73f0a40dcd1f23c999211e5a2e744403db384d0c33de7"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
  "tauri-codegen",
  "tauri-utils",
 ]
 
 [[package]]
 name = "tauri-plugin"
-version = "2.5.2"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1d0a4860b7ff570c891e1d2a586bf1ede205ff858fbc305e0b5ae5d14c1377"
+checksum = "ddde7d51c907b940fb573006cdda9a642d6a7c8153657e88f8a5c3c9290cd4aa"
 dependencies = [
  "anyhow",
  "glob",
@@ -3275,15 +4767,36 @@ dependencies = [
  "serde",
  "serde_json",
  "tauri-utils",
- "toml 0.9.11+spec-1.1.0",
+ "toml 0.9.12+spec-1.1.0",
  "walkdir",
 ]
 
+[[package]]
+name = "tauri-plugin-deep-link"
+version = "2.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94deb2e2e4641514ac496db2cddcfc850d6fc9d51ea17b82292a0490bd20ba5b"
+dependencies = [
+ "dunce",
+ "plist",
+ "rust-ini",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+ "windows-registry 0.5.3",
+ "windows-result 0.3.4",
+]
+
 [[package]]
 name = "tauri-plugin-dialog"
-version = "2.5.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05416b57601eca8666b5ec4186f5b1dc826ed35263b4797ad6641e58da6bc6c3"
+checksum = "a1fa4150c95ae391946cc8b8f905ab14797427caba3a8a2f79628e956da91809"
 dependencies = [
  "log",
  "raw-window-handle",
@@ -3293,19 +4806,21 @@ dependencies = [
  "tauri",
  "tauri-plugin",
  "tauri-plugin-fs",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "url",
 ]
 
 [[package]]
 name = "tauri-plugin-fs"
-version = "2.4.5"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed390cc669f937afeb8b28032ce837bac8ea023d975a2e207375ec05afaf1804"
+checksum = "36e1ec28b79f3d0683f4507e1615c36292c0ea6716668770d4396b9b39871ed8"
 dependencies = [
  "anyhow",
  "dunce",
  "glob",
+ "log",
+ "objc2-foundation",
  "percent-encoding",
  "schemars 0.8.22",
  "serde",
@@ -3314,22 +4829,148 @@ dependencies = [
  "tauri",
  "tauri-plugin",
  "tauri-utils",
- "thiserror 2.0.17",
- "toml 0.9.11+spec-1.1.0",
+ "thiserror 2.0.18",
+ "toml 0.9.12+spec-1.1.0",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-http"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfba7d4ec72763f9d1fdf73c217747f01e2c84b08b87a8cacd2f94f35853f84d"
+dependencies = [
+ "bytes",
+ "cookie_store",
+ "data-url",
+ "http",
+ "regex",
+ "reqwest 0.12.28",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.18",
+ "tokio",
+ "url",
+ "urlpattern",
+]
+
+[[package]]
+name = "tauri-plugin-opener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc624469b06f59f5a29f874bbc61a2ed737c0f9c23ef09855a292c389c42e83f"
+dependencies = [
+ "dunce",
+ "glob",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "open",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "thiserror 2.0.18",
+ "url",
+ "windows",
+ "zbus",
+]
+
+[[package]]
+name = "tauri-plugin-process"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d55511a7bf6cd70c8767b02c97bf8134fa434daf3926cfc1be0a0f94132d165a"
+dependencies = [
+ "tauri",
+ "tauri-plugin",
+]
+
+[[package]]
+name = "tauri-plugin-shell"
+version = "2.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8457dbf9e2bab1edd8df22bb2c20857a59a9868e79cb3eac5ed639eec4d0c73b"
+dependencies = [
+ "encoding_rs",
+ "log",
+ "open",
+ "os_pipe",
+ "regex",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "shared_child",
+ "tauri",
+ "tauri-plugin",
+ "thiserror 2.0.18",
+ "tokio",
+]
+
+[[package]]
+name = "tauri-plugin-single-instance"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc61e4822b8f74d68278e09161d3e3fdd1b14b9eb781e24edccaabf10c420e8c"
+dependencies = [
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin-deep-link",
+ "thiserror 2.0.18",
+ "tracing",
+ "windows-sys 0.60.2",
+ "zbus",
+]
+
+[[package]]
+name = "tauri-plugin-updater"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af"
+dependencies = [
+ "base64 0.22.1",
+ "dirs",
+ "flate2",
+ "futures-util",
+ "http",
+ "infer",
+ "log",
+ "minisign-verify",
+ "osakit",
+ "percent-encoding",
+ "reqwest 0.13.3",
+ "rustls",
+ "semver",
+ "serde",
+ "serde_json",
+ "tar",
+ "tauri",
+ "tauri-plugin",
+ "tempfile",
+ "thiserror 2.0.18",
+ "time",
+ "tokio",
  "url",
+ "windows-sys 0.60.2",
+ "zip 4.6.1",
 ]
 
 [[package]]
 name = "tauri-runtime"
-version = "2.9.2"
+version = "2.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f766fe9f3d1efc4b59b17e7a891ad5ed195fa8d23582abb02e6c9a01137892"
+checksum = "2826d79a3297ed08cd6ea7f412644ef58e32969504bc4fbd8d7dbeabc4445ea2"
 dependencies = [
  "cookie",
  "dpi",
  "gtk",
  "http",
- "jni",
+ "jni 0.21.1",
  "objc2",
  "objc2-ui-kit",
  "objc2-web-kit",
@@ -3337,7 +4978,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tauri-utils",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "url",
  "webkit2gtk",
  "webview2-com",
@@ -3346,17 +4987,16 @@ dependencies = [
 
 [[package]]
 name = "tauri-runtime-wry"
-version = "2.9.3"
+version = "2.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "187a3f26f681bdf028f796ccf57cf478c1ee422c50128e5a0a6ebeb3f5910065"
+checksum = "e11ea2e6f801d275fdd890d6c9603736012742a1c33b96d0db788c9cdebf7f9e"
 dependencies = [
  "gtk",
  "http",
- "jni",
+ "jni 0.21.1",
  "log",
  "objc2",
  "objc2-app-kit",
- "objc2-foundation",
  "once_cell",
  "percent-encoding",
  "raw-window-handle",
@@ -3373,9 +5013,9 @@ dependencies = [
 
 [[package]]
 name = "tauri-utils"
-version = "2.8.1"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a423c51176eb3616ee9b516a9fa67fed5f0e78baaba680e44eb5dd2cc37490"
+checksum = "219a1f983a2af3653f75b5747f76733b0da7ff03069c7a41901a5eb3ace4557d"
 dependencies = [
  "anyhow",
  "brotli",
@@ -3383,7 +5023,7 @@ dependencies = [
  "ctor",
  "dunce",
  "glob",
- "html5ever",
+ "html5ever 0.29.1",
  "http",
  "infer",
  "json-patch",
@@ -3401,8 +5041,8 @@ dependencies = [
  "serde_json",
  "serde_with",
  "swift-rs",
- "thiserror 2.0.17",
- "toml 0.9.11+spec-1.1.0",
+ "thiserror 2.0.18",
+ "toml 0.9.12+spec-1.1.0",
  "url",
  "urlpattern",
  "uuid",
@@ -3411,13 +5051,26 @@ dependencies = [
 
 [[package]]
 name = "tauri-winres"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1087b111fe2b005e42dbdc1990fc18593234238d47453b0c99b7de1c9ab2c1e0"
+checksum = "cc65d45c68858bfe420dd29e834b5d15dbecf8a07a8a16cf4d532c7b1f69d4b6"
 dependencies = [
  "dunce",
  "embed-resource",
- "toml 0.9.11+spec-1.1.0",
+ "toml 1.1.2+spec-1.1.0",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3431,6 +5084,16 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "tendril"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4790fc369d5a530f4b544b094e31388b9b3a37c0f4652ade4505945f5660d24"
+dependencies = [
+ "new_debug_unreachable",
+ "utf-8",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -3442,11 +5105,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.17",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -3457,25 +5120,25 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.45"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
@@ -3488,44 +5151,90 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.25"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
 ]
 
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.52.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
 dependencies = [
  "bytes",
  "libc",
- "mio",
+ "mio 1.2.0",
  "pin-project-lite",
  "socket2",
+ "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -3553,17 +5262,32 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.11+spec-1.1.0"
+version = "0.9.12+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
- "indexmap 2.13.0",
+ "indexmap 2.14.0",
  "serde_core",
- "serde_spanned 1.0.4",
+ "serde_spanned 1.1.1",
  "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "toml_writer",
- "winnow 0.7.14",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+dependencies = [
+ "indexmap 2.14.0",
+ "serde_core",
+ "serde_spanned 1.1.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 1.0.2",
 ]
 
 [[package]]
@@ -3584,13 +5308,22 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.13.0",
+ "indexmap 2.14.0",
  "toml_datetime 0.6.3",
  "winnow 0.5.40",
 ]
@@ -3601,7 +5334,7 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
 dependencies = [
- "indexmap 2.13.0",
+ "indexmap 2.14.0",
  "serde",
  "serde_spanned 0.6.9",
  "toml_datetime 0.6.3",
@@ -3610,30 +5343,30 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.23.10+spec-1.0.0"
+version = "0.25.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
+checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
 dependencies = [
- "indexmap 2.13.0",
- "toml_datetime 0.7.5+spec-1.1.0",
+ "indexmap 2.14.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 0.7.14",
+ "winnow 1.0.2",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow 0.7.14",
+ "winnow 1.0.2",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
 
 [[package]]
 name = "tower"
@@ -3656,7 +5389,7 @@ version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.1",
  "bytes",
  "futures-util",
  "http",
@@ -3687,9 +5420,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "pin-project-lite",
+ "tracing-attributes",
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "tracing-core"
 version = "0.1.36"
@@ -3717,7 +5462,7 @@ dependencies = [
  "once_cell",
  "png",
  "serde",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "windows-sys 0.60.2",
 ]
 
@@ -3735,9 +5480,26 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "unic-char-property"
@@ -3782,15 +5544,45 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
+dependencies = [
+ "base64 0.22.1",
+ "flate2",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "url",
+ "webpki-roots 0.26.11",
+]
 
 [[package]]
 name = "url"
@@ -3831,11 +5623,11 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.19.0"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
  "serde_core",
  "wasm-bindgen",
@@ -3906,18 +5698,27 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.106"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
+checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3928,22 +5729,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.56"
+version = "0.4.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
+checksum = "af934872acec734c2d80e6617bbb5ff4f12b052dd8e6332b0817bce889516084"
 dependencies = [
- "cfg-if",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.106"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
+checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3951,54 +5749,110 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.106"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
+checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.106"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
+checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
-name = "wasm-streams"
-version = "0.4.2"
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.14.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.11.1",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+checksum = "2eadbac71025cd7b0834f20d1fe8472e8495821b4e9801eb0a60bd1f19827602"
 dependencies = [
- "futures-util",
  "js-sys",
  "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
 ]
 
 [[package]]
-name = "web-sys"
-version = "0.3.83"
+name = "web-time"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web_atoms"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7cff6eef815df1834fd250e3a2ff436044d82a9f1bc1980ca1dbdf07effc538"
+dependencies = [
+ "phf 0.13.1",
+ "phf_codegen 0.13.1",
+ "string_cache 0.9.0",
+ "string_cache_codegen 0.6.1",
+]
+
 [[package]]
 name = "webkit2gtk"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76b1bc1e54c581da1e9f179d0b38512ba358fb1af2d634a1affe42e37172361a"
+checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
 dependencies = [
  "bitflags 1.3.2",
  "cairo-rs",
@@ -4020,9 +5874,9 @@ dependencies = [
 
 [[package]]
 name = "webkit2gtk-sys"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62daa38afc514d1f8f12b8693d30d5993ff77ced33ce30cd04deebc267a6d57c"
+checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
 dependencies = [
  "bitflags 1.3.2",
  "cairo-sys-rs",
@@ -4038,6 +5892,33 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.38.2"
@@ -4060,7 +5941,7 @@ checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -4069,7 +5950,7 @@ version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c"
 dependencies = [
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "windows",
  "windows-core 0.61.2",
 ]
@@ -4187,7 +6068,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -4198,7 +6079,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -4223,6 +6104,28 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+dependencies = [
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -4268,6 +6171,24 @@ dependencies = [
  "windows-targets 0.42.2",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
@@ -4310,6 +6231,21 @@ dependencies = [
  "windows_x86_64_msvc 0.42.2",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -4367,6 +6303,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
@@ -4385,6 +6327,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
@@ -4403,6 +6351,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -4433,6 +6387,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
@@ -4451,6 +6411,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
@@ -4469,6 +6435,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
@@ -4487,6 +6459,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -4510,9 +6488,15 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
 dependencies = [
  "memchr",
 ]
@@ -4529,36 +6513,123 @@ dependencies = [
 
 [[package]]
 name = "wit-bindgen"
-version = "0.46.0"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "indexmap 2.14.0",
+ "prettyplease",
+ "syn 2.0.117",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.1",
+ "indexmap 2.14.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.14.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
 
 [[package]]
 name = "writeable"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "wry"
-version = "0.53.5"
+version = "0.54.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728b7d4c8ec8d81cab295e0b5b8a4c263c0d41a785fb8f8c4df284e5411140a2"
+checksum = "e5a8135d8676225e5744de000d4dff5a082501bf7db6a1c1495034f8c314edbc"
 dependencies = [
  "base64 0.22.1",
  "block2",
  "cookie",
  "crossbeam-channel",
  "dirs",
+ "dom_query",
  "dpi",
  "dunce",
  "gdkx11",
  "gtk",
- "html5ever",
  "http",
  "javascriptcore-rs",
- "jni",
- "kuchikiki",
+ "jni 0.21.1",
  "libc",
  "ndk",
  "objc2",
@@ -4573,7 +6644,7 @@ dependencies = [
  "sha2",
  "soup3",
  "tao-macros",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "url",
  "webkit2gtk",
  "webkit2gtk-sys",
@@ -4605,11 +6676,21 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -4618,62 +6699,129 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
  "synstructure",
 ]
 
+[[package]]
+name = "zbus"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3bcbf15c8708d7fc1be0c993622e0a5cbd5e8b52bfa40afa4c3e0cd8d724ac1"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix",
+ "serde",
+ "serde_repr",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow 1.0.2",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51fa5406ad9175a8c825a931f8cf347116b531b3634fcb0b627c290f1f2516ff"
+dependencies = [
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7074f3e50b894eac91750142016d30d0a89be8e67dbfd9704fb875825760e52d"
+dependencies = [
+ "serde",
+ "winnow 1.0.2",
+ "zvariant",
+]
+
 [[package]]
 name = "zerocopy"
-version = "0.8.33"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.33"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -4682,9 +6830,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -4693,17 +6841,118 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "zip"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+dependencies = [
+ "aes",
+ "byteorder",
+ "bzip2",
+ "constant_time_eq",
+ "crc32fast",
+ "crossbeam-utils",
+ "flate2",
+ "hmac",
+ "pbkdf2",
+ "sha1",
+ "time",
+ "zstd",
+]
+
+[[package]]
+name = "zip"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "indexmap 2.14.0",
+ "memchr",
 ]
 
 [[package]]
 name = "zmij"
-version = "1.0.14"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zstd"
+version = "0.11.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20cc960326ece64f010d2d2107537f26dc589a6573a316bd5b1dba685fa5fde4"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "5.0.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2a5585e04f9eea4b2a3d1eca508c4dee9592a89ef6f450c11719da0726f4db"
+dependencies = [
+ "libc",
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "zvariant"
+version = "5.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db0ecb8987cf5e92653c57c098f7f0e39a03112edb796f4fe089fb7eaa14ff"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow 1.0.2",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b949b639ab1b4bed763aa7481ba0e368af68d8b55532f8ed4bec86a59f2ca98"
+dependencies = [
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "3.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd8f3f50b848df28f887acb68e41201b5aea6bc8a8dacc00fb40635ff9a72fea"
+checksum = "6d464f5733ffa07a3164d656f18533caace9d0638596721355d73256a410d691"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 2.0.117",
+ "winnow 1.0.2",
+]
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
new file mode 100644
index 0000000000..9492df9e20
--- /dev/null
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -0,0 +1,53 @@
+[package]
+name = "openwork"
+version = "0.13.3"
+description = "OpenWork"
+authors = ["Different AI"]
+edition = "2021"
+default-run = "OpenWork-Dev"
+
+[lib]
+name = "openwork"
+
+[[bin]]
+name = "OpenWork-Dev"
+path = "src/main.rs"
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+json5 = "0.4"
+notify = "6.1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+dirs = "6"
+tauri = { version = "2", features = [] }
+tauri-plugin-deep-link = "2"
+sha2 = "0.10"
+tauri-plugin-dialog = "2"
+tauri-plugin-http = "2.5.6"
+tauri-plugin-opener = "2.5.3"
+tauri-plugin-shell = "2"
+uuid = { version = "1", features = ["v4"] }
+ureq = { version = "2.10", features = ["json"] }
+gethostname = "0.4"
+local-ip-address = "0.5"
+walkdir = "2.5"
+zip = "0.6"
+
+[profile.release]
+panic = "abort"
+codegen-units = 1
+lto = true
+opt-level = "s"
+strip = true
+
+[target.'cfg(any(target_os = "macos", windows, target_os = "linux"))'.dependencies]
+tauri-plugin-process = "2.3.1"
+tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
+tauri-plugin-updater = "2.9.0"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.6"
+objc2-foundation = { version = "0.3", features = ["NSProcessInfo", "NSString"] }
diff --git a/apps/desktop/src-tauri/Info.dev.plist b/apps/desktop/src-tauri/Info.dev.plist
new file mode 100644
index 0000000000..17fc762c49
--- /dev/null
+++ b/apps/desktop/src-tauri/Info.dev.plist
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleIdentifier</key>
+  <string>com.differentai.openwork.dev</string>
+  <key>CFBundleName</key>
+  <string>OpenWork - Dev</string>
+  <key>CFBundleDisplayName</key>
+  <string>OpenWork - Dev</string>
+  <key>CFBundleURLTypes</key>
+  <array>
+    <dict>
+      <key>CFBundleTypeRole</key>
+      <string>Editor</string>
+      <key>CFBundleURLName</key>
+      <string>com.differentai.openwork.dev openwork-dev</string>
+      <key>CFBundleURLSchemes</key>
+      <array>
+        <string>openwork-dev</string>
+      </array>
+    </dict>
+  </array>
+</dict>
+</plist>
diff --git a/apps/desktop/src-tauri/build.rs b/apps/desktop/src-tauri/build.rs
new file mode 100644
index 0000000000..fab3a407d2
--- /dev/null
+++ b/apps/desktop/src-tauri/build.rs
@@ -0,0 +1,524 @@
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+use std::process::Command;
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+fn main() {
+    emit_build_info();
+    emit_desktop_bootstrap_seed();
+    ensure_opencode_sidecar();
+    ensure_openwork_server_sidecar();
+    ensure_orchestrator_sidecar();
+    ensure_chrome_devtools_mcp_sidecar();
+    ensure_versions_manifest();
+    tauri_build::build();
+}
+
+fn ensure_chrome_devtools_mcp_sidecar() {
+    let target = env::var("CARGO_CFG_TARGET_TRIPLE")
+        .or_else(|_| env::var("TARGET"))
+        .or_else(|_| env::var("TAURI_ENV_TARGET_TRIPLE"))
+        .unwrap_or_default();
+    if target.is_empty() {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| PathBuf::from("."));
+    let sidecar_dir = manifest_dir.join("sidecars");
+
+    let canonical_name = if target.contains("windows") {
+        "chrome-devtools-mcp.exe"
+    } else {
+        "chrome-devtools-mcp"
+    };
+
+    let mut target_name = format!("chrome-devtools-mcp-{target}");
+    if target.contains("windows") {
+        target_name.push_str(".exe");
+    }
+
+    let dest_path = sidecar_dir.join(canonical_name);
+    let target_dest_path = sidecar_dir.join(target_name);
+
+    let profile = env::var("PROFILE").unwrap_or_default();
+    if !dest_path.exists() {
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+    if !target_dest_path.exists() {
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+}
+
+fn ensure_versions_manifest() {
+    let profile = env::var("PROFILE").unwrap_or_default();
+    if profile == "release" {
+        return;
+    }
+
+    let target = env::var("CARGO_CFG_TARGET_TRIPLE")
+        .or_else(|_| env::var("TARGET"))
+        .or_else(|_| env::var("TAURI_ENV_TARGET_TRIPLE"))
+        .unwrap_or_default();
+    if target.is_empty() {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| PathBuf::from("."));
+    let sidecar_dir = manifest_dir.join("sidecars");
+    let canonical_path = sidecar_dir.join("versions.json");
+    let target_path = sidecar_dir.join(format!("versions.json-{target}"));
+
+    if canonical_path.exists() && target_path.exists() {
+        return;
+    }
+
+    if fs::create_dir_all(&sidecar_dir).is_err() {
+        return;
+    }
+
+    if !canonical_path.exists() {
+        let _ = fs::write(&canonical_path, "{}\n");
+    }
+    if !target_path.exists() {
+        let _ = fs::write(&target_path, "{}\n");
+    }
+}
+
+fn emit_build_info() {
+    let sha = env::var("OPENWORK_GIT_SHA")
+        .ok()
+        .and_then(|value| {
+            let trimmed = value.trim().to_string();
+            if trimmed.is_empty() {
+                None
+            } else {
+                Some(trimmed)
+            }
+        })
+        .or_else(|| {
+            let output = Command::new("git")
+                .args(["rev-parse", "HEAD"])
+                .output()
+                .ok()?;
+            if !output.status.success() {
+                return None;
+            }
+            let value = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            if value.is_empty() {
+                None
+            } else {
+                Some(value)
+            }
+        });
+    if let Some(value) = sha {
+        println!("cargo:rustc-env=OPENWORK_GIT_SHA={}", value);
+    }
+
+    let build_epoch = env::var("SOURCE_DATE_EPOCH")
+        .ok()
+        .and_then(|value| {
+            let trimmed = value.trim().to_string();
+            if trimmed.is_empty() {
+                None
+            } else {
+                Some(trimmed)
+            }
+        })
+        .or_else(|| {
+            // Best-effort fallback; not reproducible, but useful in dev builds.
+            let now = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .ok()?
+                .as_secs();
+            Some(now.to_string())
+        });
+
+    if let Some(value) = build_epoch {
+        println!("cargo:rustc-env=OPENWORK_BUILD_EPOCH={}", value);
+    }
+}
+
+fn emit_desktop_bootstrap_seed() {
+    for key in [
+        "OPENWORK_DESKTOP_DEN_BASE_URL",
+        "OPENWORK_DESKTOP_DEN_API_BASE_URL",
+        "OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN",
+        "VITE_DEN_BASE_URL",
+        "VITE_DEN_API_BASE_URL",
+        "VITE_DEN_REQUIRE_SIGNIN",
+    ] {
+        println!("cargo:rerun-if-env-changed={key}");
+    }
+
+    if let Some(value) = env::var("OPENWORK_DESKTOP_DEN_BASE_URL")
+        .ok()
+        .or_else(|| env::var("VITE_DEN_BASE_URL").ok())
+        .map(|entry| entry.trim().to_string())
+        .filter(|entry| !entry.is_empty())
+    {
+        println!("cargo:rustc-env=OPENWORK_DESKTOP_DEN_BASE_URL={value}");
+    }
+
+    if let Some(value) = env::var("OPENWORK_DESKTOP_DEN_API_BASE_URL")
+        .ok()
+        .or_else(|| env::var("VITE_DEN_API_BASE_URL").ok())
+        .map(|entry| entry.trim().to_string())
+        .filter(|entry| !entry.is_empty())
+    {
+        println!("cargo:rustc-env=OPENWORK_DESKTOP_DEN_API_BASE_URL={value}");
+    }
+
+    if let Some(value) = env::var("OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN")
+        .ok()
+        .or_else(|| env::var("VITE_DEN_REQUIRE_SIGNIN").ok())
+        .map(|entry| entry.trim().to_string())
+        .filter(|entry| !entry.is_empty())
+    {
+        println!("cargo:rustc-env=OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN={value}");
+    }
+}
+
+fn ensure_orchestrator_sidecar() {
+    let target = env::var("CARGO_CFG_TARGET_TRIPLE")
+        .or_else(|_| env::var("TARGET"))
+        .or_else(|_| env::var("TAURI_ENV_TARGET_TRIPLE"))
+        .unwrap_or_default();
+    if target.is_empty() {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| PathBuf::from("."));
+    let sidecar_dir = manifest_dir.join("sidecars");
+
+    let canonical_name = if target.contains("windows") {
+        "openwork-orchestrator.exe"
+    } else {
+        "openwork-orchestrator"
+    };
+    let mut target_name = format!("openwork-orchestrator-{target}");
+    if target.contains("windows") {
+        target_name.push_str(".exe");
+    }
+
+    let dest_path = sidecar_dir.join(canonical_name);
+    let target_dest_path = sidecar_dir.join(target_name);
+
+    let profile = env::var("PROFILE").unwrap_or_default();
+    if !dest_path.exists() {
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+    if !target_dest_path.exists() {
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+
+    if dest_path.exists() && target_dest_path.exists() {
+        return;
+    }
+
+    if target_dest_path.exists() && !dest_path.exists() {
+        if copy_sidecar(&target_dest_path, &dest_path, &target) {
+            return;
+        }
+    }
+
+    let source_path = env::var("OPENWORK_ORCHESTRATOR_BIN_PATH")
+        .ok()
+        .map(PathBuf::from)
+        .filter(|path| path.is_file())
+        .or_else(|| {
+            find_in_path(if target.contains("windows") {
+                "openwork.exe"
+            } else {
+                "openwork"
+            })
+        });
+
+    let Some(source_path) = source_path else {
+        println!(
+            "cargo:warning=orchestrator sidecar missing at {} (set OPENWORK_ORCHESTRATOR_BIN_PATH or install openwork-orchestrator)",
+            dest_path.display()
+        );
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+        return;
+    };
+
+    if fs::create_dir_all(&sidecar_dir).is_err() {
+        return;
+    }
+
+    let copied = copy_sidecar(&source_path, &dest_path, &target);
+    if copied {
+        #[cfg(unix)]
+        {
+            let _ = fs::set_permissions(&dest_path, fs::Permissions::from_mode(0o755));
+        }
+        let _ = copy_sidecar(&dest_path, &target_dest_path, &target);
+    } else {
+        println!(
+            "cargo:warning=Failed to copy orchestrator sidecar from {} to {}",
+            source_path.display(),
+            dest_path.display()
+        );
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+
+    if !dest_path.exists() {
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+    if !target_dest_path.exists() {
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+}
+
+fn ensure_opencode_sidecar() {
+    let target = env::var("CARGO_CFG_TARGET_TRIPLE")
+        .or_else(|_| env::var("TARGET"))
+        .or_else(|_| env::var("TAURI_ENV_TARGET_TRIPLE"))
+        .unwrap_or_default();
+    if target.is_empty() {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| PathBuf::from("."));
+    let sidecar_dir = manifest_dir.join("sidecars");
+
+    let canonical_name = if target.contains("windows") {
+        "opencode.exe"
+    } else {
+        "opencode"
+    };
+
+    let mut target_name = format!("opencode-{target}");
+    if target.contains("windows") {
+        target_name.push_str(".exe");
+    }
+
+    let dest_path = sidecar_dir.join(canonical_name);
+    let target_dest_path = sidecar_dir.join(target_name);
+
+    let profile = env::var("PROFILE").unwrap_or_default();
+    if !dest_path.exists() {
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+    if !target_dest_path.exists() {
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+
+    if dest_path.exists() && target_dest_path.exists() {
+        return;
+    }
+
+    if target_dest_path.exists() && !dest_path.exists() {
+        if copy_sidecar(&target_dest_path, &dest_path, &target) {
+            return;
+        }
+    }
+
+    let source_path = env::var("OPENCODE_BIN_PATH")
+        .ok()
+        .map(PathBuf::from)
+        .filter(|path| path.is_file())
+        .or_else(|| {
+            find_in_path(if target.contains("windows") {
+                "opencode.exe"
+            } else {
+                "opencode"
+            })
+        });
+
+    let Some(source_path) = source_path else {
+        println!(
+      "cargo:warning=OpenCode sidecar missing at {} (set OPENCODE_BIN_PATH or install OpenCode)",
+      dest_path.display()
+    );
+
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+        return;
+    };
+
+    if fs::create_dir_all(&sidecar_dir).is_err() {
+        return;
+    }
+
+    let copied = copy_sidecar(&source_path, &dest_path, &target);
+
+    if copied {
+        #[cfg(unix)]
+        {
+            let _ = fs::set_permissions(&dest_path, fs::Permissions::from_mode(0o755));
+        }
+        let _ = copy_sidecar(&dest_path, &target_dest_path, &target);
+    } else {
+        println!(
+            "cargo:warning=Failed to copy OpenCode sidecar from {} to {}",
+            source_path.display(),
+            dest_path.display()
+        );
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+}
+
+fn ensure_openwork_server_sidecar() {
+    let target = env::var("CARGO_CFG_TARGET_TRIPLE")
+        .or_else(|_| env::var("TARGET"))
+        .or_else(|_| env::var("TAURI_ENV_TARGET_TRIPLE"))
+        .unwrap_or_default();
+    if target.is_empty() {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| PathBuf::from("."));
+    let sidecar_dir = manifest_dir.join("sidecars");
+
+    let canonical_name = if target.contains("windows") {
+        "openwork-server.exe"
+    } else {
+        "openwork-server"
+    };
+
+    let mut target_name = format!("openwork-server-{target}");
+    if target.contains("windows") {
+        target_name.push_str(".exe");
+    }
+
+    let dest_path = sidecar_dir.join(canonical_name);
+    let target_dest_path = sidecar_dir.join(target_name);
+
+    if dest_path.exists() {
+        return;
+    }
+
+    if target_dest_path.exists() {
+        if copy_sidecar(&target_dest_path, &dest_path, &target) {
+            return;
+        }
+    }
+
+    let source_path = env::var("OPENWORK_SERVER_BIN_PATH")
+        .ok()
+        .map(PathBuf::from)
+        .filter(|path| path.is_file())
+        .or_else(|| {
+            find_in_path(if target.contains("windows") {
+                "openwork-server.exe"
+            } else {
+                "openwork-server"
+            })
+        });
+
+    let profile = env::var("PROFILE").unwrap_or_default();
+
+    let Some(source_path) = source_path else {
+        println!(
+      "cargo:warning=OpenWork server sidecar missing at {} (set OPENWORK_SERVER_BIN_PATH or install openwork-server)",
+      dest_path.display()
+    );
+
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+        return;
+    };
+
+    if fs::create_dir_all(&sidecar_dir).is_err() {
+        return;
+    }
+
+    let copied = copy_sidecar(&source_path, &dest_path, &target);
+
+    if copied {
+        #[cfg(unix)]
+        {
+            let _ = fs::set_permissions(&dest_path, fs::Permissions::from_mode(0o755));
+        }
+        let _ = copy_sidecar(&dest_path, &target_dest_path, &target);
+    } else {
+        println!(
+            "cargo:warning=Failed to copy OpenWork server sidecar from {} to {}",
+            source_path.display(),
+            dest_path.display()
+        );
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+
+    if !dest_path.exists() {
+        create_debug_stub(&dest_path, &sidecar_dir, &profile, &target);
+    }
+    if !target_dest_path.exists() {
+        create_debug_stub(&target_dest_path, &sidecar_dir, &profile, &target);
+    }
+}
+
+fn copy_sidecar(source_path: &PathBuf, dest_path: &PathBuf, target: &str) -> bool {
+    let mut copied = fs::copy(source_path, dest_path).is_ok();
+
+    #[cfg(unix)]
+    if !copied {
+        if std::os::unix::fs::symlink(source_path, dest_path).is_ok() {
+            copied = true;
+        }
+    }
+
+    #[cfg(windows)]
+    if !copied {
+        if fs::hard_link(source_path, dest_path).is_ok() {
+            copied = true;
+        }
+    }
+
+    if copied {
+        #[cfg(unix)]
+        {
+            let _ = fs::set_permissions(dest_path, fs::Permissions::from_mode(0o755));
+        }
+    } else if target.contains("windows") {
+        let _ = fs::remove_file(dest_path);
+    }
+
+    copied
+}
+
+fn find_in_path(binary: &str) -> Option<PathBuf> {
+    let paths = env::var_os("PATH")?;
+    env::split_paths(&paths).find_map(|dir| {
+        let candidate = dir.join(binary);
+        if candidate.is_file() {
+            Some(candidate)
+        } else {
+            None
+        }
+    })
+}
+
+fn create_debug_stub(dest_path: &PathBuf, sidecar_dir: &PathBuf, profile: &str, target: &str) {
+    if profile == "release" || target.contains("windows") {
+        return;
+    }
+
+    if fs::create_dir_all(sidecar_dir).is_err() {
+        return;
+    }
+
+    let stub = "#!/usr/bin/env bash\n\
+echo 'Sidecar missing. Install the binary or set the *_BIN_PATH env var.'\n\
+exit 1\n";
+    if fs::write(dest_path, stub).is_ok() {
+        #[cfg(unix)]
+        let _ = fs::set_permissions(dest_path, fs::Permissions::from_mode(0o755));
+    }
+}
diff --git a/apps/desktop/src-tauri/capabilities/default.json b/apps/desktop/src-tauri/capabilities/default.json
new file mode 100644
index 0000000000..c82aae77b3
--- /dev/null
+++ b/apps/desktop/src-tauri/capabilities/default.json
@@ -0,0 +1,28 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "openwork-default",
+  "description": "Default OpenWork capability (UI permissions)",
+  "windows": ["*"],
+  "permissions": [
+    "core:default",
+    "core:webview:allow-set-webview-zoom",
+    "deep-link:default",
+    "dialog:allow-open",
+    "dialog:allow-save",
+    "updater:default",
+    "process:default",
+    "opener:allow-reveal-item-in-dir",
+    "opener:allow-open-path",
+    "opener:allow-open-url",
+    "opener:allow-default-urls",
+    {
+      "identifier": "http:default",
+      "allow": [
+        { "url": "http://*" },
+        { "url": "https://*" },
+        { "url": "http://*:*/*" },
+        { "url": "https://*:*/*" }
+      ]
+    }
+  ]
+}
diff --git a/apps/desktop/src-tauri/entitlements.plist b/apps/desktop/src-tauri/entitlements.plist
new file mode 100644
index 0000000000..a7674bbe9b
--- /dev/null
+++ b/apps/desktop/src-tauri/entitlements.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.disable-executable-page-protection</key>
+  <true/>
+</dict>
+</plist>
diff --git a/src-tauri/gen/schemas/acl-manifests.json b/apps/desktop/src-tauri/gen/schemas/acl-manifests.json
similarity index 76%
rename from src-tauri/gen/schemas/acl-manifests.json
rename to apps/desktop/src-tauri/gen/schemas/acl-manifests.json
index db9d3be4a5..43edbd6580 100644
--- a/src-tauri/gen/schemas/acl-manifests.json
+++ b/apps/desktop/src-tauri/gen/schemas/acl-manifests.json
@@ -1 +1 @@
-{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-internal-toggle-maximize"]},"permissions":{"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-ask","allow-confirm","allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope.","commands":{"allow":["ask"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope.","commands":{"allow":["confirm"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope.","commands":{"allow":[],"deny":["ask"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope.","commands":{"allow":[],"deny":["confirm"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null}}
\ No newline at end of file
+{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-internal-toggle-maximize"]},"permissions":{"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"deep-link":{"default_permission":{"identifier":"default","description":"Allows reading the opened deep link via the get_current command","permissions":["allow-get-current"]},"permissions":{"allow-get-current":{"identifier":"allow-get-current","description":"Enables the get_current command without any pre-configured scope.","commands":{"allow":["get_current"],"deny":[]}},"allow-is-registered":{"identifier":"allow-is-registered","description":"Enables the is_registered command without any pre-configured scope.","commands":{"allow":["is_registered"],"deny":[]}},"allow-register":{"identifier":"allow-register","description":"Enables the register command without any pre-configured scope.","commands":{"allow":["register"],"deny":[]}},"allow-unregister":{"identifier":"allow-unregister","description":"Enables the unregister command without any pre-configured scope.","commands":{"allow":["unregister"],"deny":[]}},"deny-get-current":{"identifier":"deny-get-current","description":"Denies the get_current command without any pre-configured scope.","commands":{"allow":[],"deny":["get_current"]}},"deny-is-registered":{"identifier":"deny-is-registered","description":"Denies the is_registered command without any pre-configured scope.","commands":{"allow":[],"deny":["is_registered"]}},"deny-register":{"identifier":"deny-register","description":"Denies the register command without any pre-configured scope.","commands":{"allow":[],"deny":["register"]}},"deny-unregister":{"identifier":"deny-unregister","description":"Denies the unregister command without any pre-configured scope.","commands":{"allow":[],"deny":["unregister"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null},"http":{"default_permission":{"identifier":"default","description":"This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n","permissions":["allow-fetch","allow-fetch-cancel","allow-fetch-send","allow-fetch-read-body","allow-fetch-cancel-body"]},"permissions":{"allow-fetch":{"identifier":"allow-fetch","description":"Enables the fetch command without any pre-configured scope.","commands":{"allow":["fetch"],"deny":[]}},"allow-fetch-cancel":{"identifier":"allow-fetch-cancel","description":"Enables the fetch_cancel command without any pre-configured scope.","commands":{"allow":["fetch_cancel"],"deny":[]}},"allow-fetch-cancel-body":{"identifier":"allow-fetch-cancel-body","description":"Enables the fetch_cancel_body command without any pre-configured scope.","commands":{"allow":["fetch_cancel_body"],"deny":[]}},"allow-fetch-read-body":{"identifier":"allow-fetch-read-body","description":"Enables the fetch_read_body command without any pre-configured scope.","commands":{"allow":["fetch_read_body"],"deny":[]}},"allow-fetch-send":{"identifier":"allow-fetch-send","description":"Enables the fetch_send command without any pre-configured scope.","commands":{"allow":["fetch_send"],"deny":[]}},"deny-fetch":{"identifier":"deny-fetch","description":"Denies the fetch command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch"]}},"deny-fetch-cancel":{"identifier":"deny-fetch-cancel","description":"Denies the fetch_cancel command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_cancel"]}},"deny-fetch-cancel-body":{"identifier":"deny-fetch-cancel-body","description":"Denies the fetch_cancel_body command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_cancel_body"]}},"deny-fetch-read-body":{"identifier":"deny-fetch-read-body","description":"Denies the fetch_read_body command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_read_body"]}},"deny-fetch-send":{"identifier":"deny-fetch-send","description":"Denies the fetch_send command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_send"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"description":"A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"},{"properties":{"url":{"description":"A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"}],"description":"HTTP scope entry.","title":"HttpScopeEntry"}},"opener":{"default_permission":{"identifier":"default","description":"This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer","permissions":["allow-open-url","allow-reveal-item-in-dir","allow-default-urls"]},"permissions":{"allow-default-urls":{"identifier":"allow-default-urls","description":"This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.","commands":{"allow":[],"deny":[]},"scope":{"allow":[{"url":"mailto:*"},{"url":"tel:*"},{"url":"http://*"},{"url":"https://*"}]}},"allow-open-path":{"identifier":"allow-open-path","description":"Enables the open_path command without any pre-configured scope.","commands":{"allow":["open_path"],"deny":[]}},"allow-open-url":{"identifier":"allow-open-url","description":"Enables the open_url command without any pre-configured scope.","commands":{"allow":["open_url"],"deny":[]}},"allow-reveal-item-in-dir":{"identifier":"allow-reveal-item-in-dir","description":"Enables the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":["reveal_item_in_dir"],"deny":[]}},"deny-open-path":{"identifier":"deny-open-path","description":"Denies the open_path command without any pre-configured scope.","commands":{"allow":[],"deny":["open_path"]}},"deny-open-url":{"identifier":"deny-open-url","description":"Denies the open_url command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url"]}},"deny-reveal-item-in-dir":{"identifier":"deny-reveal-item-in-dir","description":"Denies the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":[],"deny":["reveal_item_in_dir"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this url with, for example: firefox."},"url":{"description":"A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"},{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this path with, for example: xdg-open."},"path":{"description":"A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"}},"required":["path"],"type":"object"}],"definitions":{"Application":{"anyOf":[{"description":"Open in default application.","type":"null"},{"description":"If true, allow open with any application.","type":"boolean"},{"description":"Allow specific application to open with.","type":"string"}],"description":"Opener scope application."}},"description":"Opener scope entry.","title":"OpenerScopeEntry"}},"process":{"default_permission":{"identifier":"default","description":"This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n","permissions":["allow-exit","allow-restart"]},"permissions":{"allow-exit":{"identifier":"allow-exit","description":"Enables the exit command without any pre-configured scope.","commands":{"allow":["exit"],"deny":[]}},"allow-restart":{"identifier":"allow-restart","description":"Enables the restart command without any pre-configured scope.","commands":{"allow":["restart"],"deny":[]}},"deny-exit":{"identifier":"deny-exit","description":"Denies the exit command without any pre-configured scope.","commands":{"allow":[],"deny":["exit"]}},"deny-restart":{"identifier":"deny-restart","description":"Denies the restart command without any pre-configured scope.","commands":{"allow":[],"deny":["restart"]}}},"permission_sets":{},"global_scope_schema":null},"shell":{"default_permission":{"identifier":"default","description":"This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n","permissions":["allow-open"]},"permissions":{"allow-execute":{"identifier":"allow-execute","description":"Enables the execute command without any pre-configured scope.","commands":{"allow":["execute"],"deny":[]}},"allow-kill":{"identifier":"allow-kill","description":"Enables the kill command without any pre-configured scope.","commands":{"allow":["kill"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-spawn":{"identifier":"allow-spawn","description":"Enables the spawn command without any pre-configured scope.","commands":{"allow":["spawn"],"deny":[]}},"allow-stdin-write":{"identifier":"allow-stdin-write","description":"Enables the stdin_write command without any pre-configured scope.","commands":{"allow":["stdin_write"],"deny":[]}},"deny-execute":{"identifier":"deny-execute","description":"Denies the execute command without any pre-configured scope.","commands":{"allow":[],"deny":["execute"]}},"deny-kill":{"identifier":"deny-kill","description":"Denies the kill command without any pre-configured scope.","commands":{"allow":[],"deny":["kill"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-spawn":{"identifier":"deny-spawn","description":"Denies the spawn command without any pre-configured scope.","commands":{"allow":[],"deny":["spawn"]}},"deny-stdin-write":{"identifier":"deny-stdin-write","description":"Denies the stdin_write command without any pre-configured scope.","commands":{"allow":[],"deny":["stdin_write"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"cmd":{"description":"The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"}},"required":["cmd","name"],"type":"object"},{"additionalProperties":false,"properties":{"args":{"allOf":[{"$ref":"#/definitions/ShellScopeEntryAllowedArgs"}],"description":"The allowed arguments for the command execution."},"name":{"description":"The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.","type":"string"},"sidecar":{"description":"If this command is a sidecar command.","type":"boolean"}},"required":["name","sidecar"],"type":"object"}],"definitions":{"ShellScopeEntryAllowedArg":{"anyOf":[{"description":"A non-configurable argument that is passed to the command in the order it was specified.","type":"string"},{"additionalProperties":false,"description":"A variable that is set while calling the command from the webview API.","properties":{"raw":{"default":false,"description":"Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.","type":"boolean"},"validator":{"description":"[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>","type":"string"}},"required":["validator"],"type":"object"}],"description":"A command argument allowed to be executed by the webview API."},"ShellScopeEntryAllowedArgs":{"anyOf":[{"description":"Use a simple boolean to allow all or disable all arguments to this command configuration.","type":"boolean"},{"description":"A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.","items":{"$ref":"#/definitions/ShellScopeEntryAllowedArg"},"type":"array"}],"description":"A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration."}},"description":"Shell scope entry.","title":"ShellScopeEntry"}},"updater":{"default_permission":{"identifier":"default","description":"This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n","permissions":["allow-check","allow-download","allow-install","allow-download-and-install"]},"permissions":{"allow-check":{"identifier":"allow-check","description":"Enables the check command without any pre-configured scope.","commands":{"allow":["check"],"deny":[]}},"allow-download":{"identifier":"allow-download","description":"Enables the download command without any pre-configured scope.","commands":{"allow":["download"],"deny":[]}},"allow-download-and-install":{"identifier":"allow-download-and-install","description":"Enables the download_and_install command without any pre-configured scope.","commands":{"allow":["download_and_install"],"deny":[]}},"allow-install":{"identifier":"allow-install","description":"Enables the install command without any pre-configured scope.","commands":{"allow":["install"],"deny":[]}},"deny-check":{"identifier":"deny-check","description":"Denies the check command without any pre-configured scope.","commands":{"allow":[],"deny":["check"]}},"deny-download":{"identifier":"deny-download","description":"Denies the download command without any pre-configured scope.","commands":{"allow":[],"deny":["download"]}},"deny-download-and-install":{"identifier":"deny-download-and-install","description":"Denies the download_and_install command without any pre-configured scope.","commands":{"allow":[],"deny":["download_and_install"]}},"deny-install":{"identifier":"deny-install","description":"Denies the install command without any pre-configured scope.","commands":{"allow":[],"deny":["install"]}}},"permission_sets":{},"global_scope_schema":null}}
\ No newline at end of file
diff --git a/apps/desktop/src-tauri/gen/schemas/capabilities.json b/apps/desktop/src-tauri/gen/schemas/capabilities.json
new file mode 100644
index 0000000000..9ac87af2e8
--- /dev/null
+++ b/apps/desktop/src-tauri/gen/schemas/capabilities.json
@@ -0,0 +1 @@
+{"openwork-default":{"identifier":"openwork-default","description":"Default OpenWork capability (UI permissions)","local":true,"windows":["*"],"permissions":["core:default","core:webview:allow-set-webview-zoom","deep-link:default","dialog:allow-open","dialog:allow-save","updater:default","process:default","opener:allow-reveal-item-in-dir","opener:allow-open-path","opener:allow-open-url","opener:allow-default-urls",{"identifier":"http:default","allow":[{"url":"http://*"},{"url":"https://*"},{"url":"http://*:*/*"},{"url":"https://*:*/*"}]}]}}
\ No newline at end of file
diff --git a/apps/desktop/src-tauri/gen/schemas/desktop-schema.json b/apps/desktop/src-tauri/gen/schemas/desktop-schema.json
new file mode 100644
index 0000000000..2587586dd0
--- /dev/null
+++ b/apps/desktop/src-tauri/gen/schemas/desktop-schema.json
@@ -0,0 +1,3205 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "CapabilityFile",
+  "description": "Capability formats accepted in a capability file.",
+  "anyOf": [
+    {
+      "description": "A single capability.",
+      "allOf": [
+        {
+          "$ref": "#/definitions/Capability"
+        }
+      ]
+    },
+    {
+      "description": "A list of capabilities.",
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Capability"
+      }
+    },
+    {
+      "description": "A list of capabilities.",
+      "type": "object",
+      "required": [
+        "capabilities"
+      ],
+      "properties": {
+        "capabilities": {
+          "description": "The list of capabilities.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Capability"
+          }
+        }
+      }
+    }
+  ],
+  "definitions": {
+    "Capability": {
+      "description": "A grouping and boundary mechanism developers can use to isolate access to the IPC layer.\n\nIt controls application windows' and webviews' fine grained access to the Tauri core, application, or plugin commands. If a webview or its window is not matching any capability then it has no access to the IPC layer at all.\n\nThis can be done to create groups of windows, based on their required system access, which can reduce impact of frontend vulnerabilities in less privileged windows. Windows can be added to a capability by exact name (e.g. `main-window`) or glob patterns like `*` or `admin-*`. A Window can have none, one, or multiple associated capabilities.\n\n## Example\n\n```json { \"identifier\": \"main-user-files-write\", \"description\": \"This capability allows the `main` window on macOS and Windows access to `filesystem` write related commands and `dialog` commands to enable programmatic access to files selected by the user.\", \"windows\": [ \"main\" ], \"permissions\": [ \"core:default\", \"dialog:open\", { \"identifier\": \"fs:allow-write-text-file\", \"allow\": [{ \"path\": \"$HOME/test.txt\" }] }, ], \"platforms\": [\"macOS\",\"windows\"] } ```",
+      "type": "object",
+      "required": [
+        "identifier",
+        "permissions"
+      ],
+      "properties": {
+        "identifier": {
+          "description": "Identifier of the capability.\n\n## Example\n\n`main-user-files-write`",
+          "type": "string"
+        },
+        "description": {
+          "description": "Description of what the capability is intended to allow on associated windows.\n\nIt should contain a description of what the grouped permissions should allow.\n\n## Example\n\nThis capability allows the `main` window access to `filesystem` write related commands and `dialog` commands to enable programmatic access to files selected by the user.",
+          "default": "",
+          "type": "string"
+        },
+        "remote": {
+          "description": "Configure remote URLs that can use the capability permissions.\n\nThis setting is optional and defaults to not being set, as our default use case is that the content is served from our local application.\n\n:::caution Make sure you understand the security implications of providing remote sources with local system access. :::\n\n## Example\n\n```json { \"urls\": [\"https://*.mydomain.dev\"] } ```",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/CapabilityRemote"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "local": {
+          "description": "Whether this capability is enabled for local app URLs or not. Defaults to `true`.",
+          "default": true,
+          "type": "boolean"
+        },
+        "windows": {
+          "description": "List of windows that are affected by this capability. Can be a glob pattern.\n\nIf a window label matches any of the patterns in this list, the capability will be enabled on all the webviews of that window, regardless of the value of [`Self::webviews`].\n\nOn multiwebview windows, prefer specifying [`Self::webviews`] and omitting [`Self::windows`] for a fine grained access control.\n\n## Example\n\n`[\"main\"]`",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "webviews": {
+          "description": "List of webviews that are affected by this capability. Can be a glob pattern.\n\nThe capability will be enabled on all the webviews whose label matches any of the patterns in this list, regardless of whether the webview's window label matches a pattern in [`Self::windows`].\n\n## Example\n\n`[\"sub-webview-one\", \"sub-webview-two\"]`",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "permissions": {
+          "description": "List of permissions attached to this capability.\n\nMust include the plugin name as prefix in the form of `${plugin-name}:${permission-name}`. For commands directly implemented in the application itself only `${permission-name}` is required.\n\n## Example\n\n```json [ \"core:default\", \"shell:allow-open\", \"dialog:open\", { \"identifier\": \"fs:allow-write-text-file\", \"allow\": [{ \"path\": \"$HOME/test.txt\" }] } ] ```",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PermissionEntry"
+          },
+          "uniqueItems": true
+        },
+        "platforms": {
+          "description": "Limit which target platforms this capability applies to.\n\nBy default all platforms are targeted.\n\n## Example\n\n`[\"macOS\",\"windows\"]`",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Target"
+          }
+        }
+      }
+    },
+    "CapabilityRemote": {
+      "description": "Configuration for remote URLs that are associated with the capability.",
+      "type": "object",
+      "required": [
+        "urls"
+      ],
+      "properties": {
+        "urls": {
+          "description": "Remote domains this capability refers to using the [URLPattern standard](https://urlpattern.spec.whatwg.org/).\n\n## Examples\n\n- \"https://*.mydomain.dev\": allows subdomains of mydomain.dev - \"https://mydomain.dev/api/*\": allows any subpath of mydomain.dev/api",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "PermissionEntry": {
+      "description": "An entry for a permission value in a [`Capability`] can be either a raw permission [`Identifier`] or an object that references a permission and extends its scope.",
+      "anyOf": [
+        {
+          "description": "Reference a permission or permission set by identifier.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/Identifier"
+            }
+          ]
+        },
+        {
+          "description": "Reference a permission or permission set by identifier and extends its scope.",
+          "type": "object",
+          "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+                        "type": "string",
+                        "const": "http:default",
+                        "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+                      },
+                      {
+                        "description": "Enables the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch",
+                        "markdownDescription": "Enables the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel",
+                        "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel-body",
+                        "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-read-body",
+                        "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-send",
+                        "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch",
+                        "markdownDescription": "Denies the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel",
+                        "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel-body",
+                        "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-read-body",
+                        "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-send",
+                        "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+                        "type": "string",
+                        "const": "opener:default",
+                        "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+                      },
+                      {
+                        "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+                        "type": "string",
+                        "const": "opener:allow-default-urls",
+                        "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+                      },
+                      {
+                        "description": "Enables the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-path",
+                        "markdownDescription": "Enables the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-url",
+                        "markdownDescription": "Enables the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-reveal-item-in-dir",
+                        "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-path",
+                        "markdownDescription": "Denies the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-url",
+                        "markdownDescription": "Denies the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-reveal-item-in-dir",
+                        "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+                        "type": "string",
+                        "const": "shell:default",
+                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+                      },
+                      {
+                        "description": "Enables the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-execute",
+                        "markdownDescription": "Enables the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-kill",
+                        "markdownDescription": "Enables the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-open",
+                        "markdownDescription": "Enables the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-spawn",
+                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-stdin-write",
+                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-execute",
+                        "markdownDescription": "Denies the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-kill",
+                        "markdownDescription": "Denies the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-open",
+                        "markdownDescription": "Denies the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-spawn",
+                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-stdin-write",
+                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                },
+                "allow": {
+                  "description": "Data that defines what is allowed by the scope.",
+                  "type": [
+                    "array",
+                    "null"
+                  ],
+                  "items": {
+                    "$ref": "#/definitions/Value"
+                  }
+                },
+                "deny": {
+                  "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
+                  "type": [
+                    "array",
+                    "null"
+                  ],
+                  "items": {
+                    "$ref": "#/definitions/Value"
+                  }
+                }
+              }
+            }
+          ],
+          "required": [
+            "identifier"
+          ]
+        }
+      ]
+    },
+    "Identifier": {
+      "description": "Permission identifier",
+      "oneOf": [
+        {
+          "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
+          "type": "string",
+          "const": "core:default",
+          "markdownDescription": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`"
+        },
+        {
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`",
+          "type": "string",
+          "const": "core:app:default",
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`"
+        },
+        {
+          "description": "Enables the app_hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-app-hide",
+          "markdownDescription": "Enables the app_hide command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the app_show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-app-show",
+          "markdownDescription": "Enables the app_show command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the bundle_type command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-bundle-type",
+          "markdownDescription": "Enables the bundle_type command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the default_window_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-default-window-icon",
+          "markdownDescription": "Enables the default_window_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-fetch-data-store-identifiers",
+          "markdownDescription": "Enables the fetch_data_store_identifiers command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-identifier",
+          "markdownDescription": "Enables the identifier command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-name",
+          "markdownDescription": "Enables the name command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-register-listener",
+          "markdownDescription": "Enables the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_data_store command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-remove-data-store",
+          "markdownDescription": "Enables the remove_data_store command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-remove-listener",
+          "markdownDescription": "Enables the remove_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_app_theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-set-app-theme",
+          "markdownDescription": "Enables the set_app_theme command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_dock_visibility command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-set-dock-visibility",
+          "markdownDescription": "Enables the set_dock_visibility command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the tauri_version command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-tauri-version",
+          "markdownDescription": "Enables the tauri_version command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the version command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-version",
+          "markdownDescription": "Enables the version command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the app_hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-app-hide",
+          "markdownDescription": "Denies the app_hide command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the app_show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-app-show",
+          "markdownDescription": "Denies the app_show command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the bundle_type command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-bundle-type",
+          "markdownDescription": "Denies the bundle_type command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the default_window_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-default-window-icon",
+          "markdownDescription": "Denies the default_window_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-fetch-data-store-identifiers",
+          "markdownDescription": "Denies the fetch_data_store_identifiers command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the identifier command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-identifier",
+          "markdownDescription": "Denies the identifier command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the name command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-name",
+          "markdownDescription": "Denies the name command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-register-listener",
+          "markdownDescription": "Denies the register_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_data_store command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-remove-data-store",
+          "markdownDescription": "Denies the remove_data_store command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_listener command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-remove-listener",
+          "markdownDescription": "Denies the remove_listener command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_app_theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-set-app-theme",
+          "markdownDescription": "Denies the set_app_theme command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_dock_visibility command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-set-dock-visibility",
+          "markdownDescription": "Denies the set_dock_visibility command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the tauri_version command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-tauri-version",
+          "markdownDescription": "Denies the tauri_version command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the version command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-version",
+          "markdownDescription": "Denies the version command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-listen`\n- `allow-unlisten`\n- `allow-emit`\n- `allow-emit-to`",
+          "type": "string",
+          "const": "core:event:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-listen`\n- `allow-unlisten`\n- `allow-emit`\n- `allow-emit-to`"
+        },
+        {
+          "description": "Enables the emit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:allow-emit",
+          "markdownDescription": "Enables the emit command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the emit_to command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:allow-emit-to",
+          "markdownDescription": "Enables the emit_to command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the listen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:allow-listen",
+          "markdownDescription": "Enables the listen command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unlisten command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:allow-unlisten",
+          "markdownDescription": "Enables the unlisten command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the emit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:deny-emit",
+          "markdownDescription": "Denies the emit command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the emit_to command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:deny-emit-to",
+          "markdownDescription": "Denies the emit_to command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the listen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:deny-listen",
+          "markdownDescription": "Denies the listen command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unlisten command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:event:deny-unlisten",
+          "markdownDescription": "Denies the unlisten command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-from-bytes`\n- `allow-from-path`\n- `allow-rgba`\n- `allow-size`",
+          "type": "string",
+          "const": "core:image:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-from-bytes`\n- `allow-from-path`\n- `allow-rgba`\n- `allow-size`"
+        },
+        {
+          "description": "Enables the from_bytes command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:allow-from-bytes",
+          "markdownDescription": "Enables the from_bytes command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the from_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:allow-from-path",
+          "markdownDescription": "Enables the from_path command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:allow-new",
+          "markdownDescription": "Enables the new command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the rgba command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:allow-rgba",
+          "markdownDescription": "Enables the rgba command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:allow-size",
+          "markdownDescription": "Enables the size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the from_bytes command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:deny-from-bytes",
+          "markdownDescription": "Denies the from_bytes command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the from_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:deny-from-path",
+          "markdownDescription": "Denies the from_path command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:deny-new",
+          "markdownDescription": "Denies the new command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the rgba command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:deny-rgba",
+          "markdownDescription": "Denies the rgba command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:image:deny-size",
+          "markdownDescription": "Denies the size command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-append`\n- `allow-prepend`\n- `allow-insert`\n- `allow-remove`\n- `allow-remove-at`\n- `allow-items`\n- `allow-get`\n- `allow-popup`\n- `allow-create-default`\n- `allow-set-as-app-menu`\n- `allow-set-as-window-menu`\n- `allow-text`\n- `allow-set-text`\n- `allow-is-enabled`\n- `allow-set-enabled`\n- `allow-set-accelerator`\n- `allow-set-as-windows-menu-for-nsapp`\n- `allow-set-as-help-menu-for-nsapp`\n- `allow-is-checked`\n- `allow-set-checked`\n- `allow-set-icon`",
+          "type": "string",
+          "const": "core:menu:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-append`\n- `allow-prepend`\n- `allow-insert`\n- `allow-remove`\n- `allow-remove-at`\n- `allow-items`\n- `allow-get`\n- `allow-popup`\n- `allow-create-default`\n- `allow-set-as-app-menu`\n- `allow-set-as-window-menu`\n- `allow-text`\n- `allow-set-text`\n- `allow-is-enabled`\n- `allow-set-enabled`\n- `allow-set-accelerator`\n- `allow-set-as-windows-menu-for-nsapp`\n- `allow-set-as-help-menu-for-nsapp`\n- `allow-is-checked`\n- `allow-set-checked`\n- `allow-set-icon`"
+        },
+        {
+          "description": "Enables the append command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-append",
+          "markdownDescription": "Enables the append command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create_default command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-create-default",
+          "markdownDescription": "Enables the create_default command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-get",
+          "markdownDescription": "Enables the get command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the insert command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-insert",
+          "markdownDescription": "Enables the insert command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_checked command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-is-checked",
+          "markdownDescription": "Enables the is_checked command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-is-enabled",
+          "markdownDescription": "Enables the is_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the items command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-items",
+          "markdownDescription": "Enables the items command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-new",
+          "markdownDescription": "Enables the new command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the popup command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-popup",
+          "markdownDescription": "Enables the popup command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the prepend command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-prepend",
+          "markdownDescription": "Enables the prepend command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-remove",
+          "markdownDescription": "Enables the remove command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_at command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-remove-at",
+          "markdownDescription": "Enables the remove_at command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_accelerator command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-accelerator",
+          "markdownDescription": "Enables the set_accelerator command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_as_app_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-as-app-menu",
+          "markdownDescription": "Enables the set_as_app_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-as-help-menu-for-nsapp",
+          "markdownDescription": "Enables the set_as_help_menu_for_nsapp command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_as_window_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-as-window-menu",
+          "markdownDescription": "Enables the set_as_window_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-as-windows-menu-for-nsapp",
+          "markdownDescription": "Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_checked command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-checked",
+          "markdownDescription": "Enables the set_checked command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-enabled",
+          "markdownDescription": "Enables the set_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-icon",
+          "markdownDescription": "Enables the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_text command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-set-text",
+          "markdownDescription": "Enables the set_text command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the text command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:allow-text",
+          "markdownDescription": "Enables the text command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the append command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-append",
+          "markdownDescription": "Denies the append command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create_default command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-create-default",
+          "markdownDescription": "Denies the create_default command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-get",
+          "markdownDescription": "Denies the get command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the insert command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-insert",
+          "markdownDescription": "Denies the insert command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_checked command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-is-checked",
+          "markdownDescription": "Denies the is_checked command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-is-enabled",
+          "markdownDescription": "Denies the is_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the items command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-items",
+          "markdownDescription": "Denies the items command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-new",
+          "markdownDescription": "Denies the new command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the popup command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-popup",
+          "markdownDescription": "Denies the popup command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the prepend command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-prepend",
+          "markdownDescription": "Denies the prepend command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-remove",
+          "markdownDescription": "Denies the remove command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_at command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-remove-at",
+          "markdownDescription": "Denies the remove_at command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_accelerator command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-accelerator",
+          "markdownDescription": "Denies the set_accelerator command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_as_app_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-as-app-menu",
+          "markdownDescription": "Denies the set_as_app_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-as-help-menu-for-nsapp",
+          "markdownDescription": "Denies the set_as_help_menu_for_nsapp command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_as_window_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-as-window-menu",
+          "markdownDescription": "Denies the set_as_window_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-as-windows-menu-for-nsapp",
+          "markdownDescription": "Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_checked command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-checked",
+          "markdownDescription": "Denies the set_checked command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-enabled",
+          "markdownDescription": "Denies the set_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-icon",
+          "markdownDescription": "Denies the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_text command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-set-text",
+          "markdownDescription": "Denies the set_text command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the text command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:menu:deny-text",
+          "markdownDescription": "Denies the text command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-resolve-directory`\n- `allow-resolve`\n- `allow-normalize`\n- `allow-join`\n- `allow-dirname`\n- `allow-extname`\n- `allow-basename`\n- `allow-is-absolute`",
+          "type": "string",
+          "const": "core:path:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-resolve-directory`\n- `allow-resolve`\n- `allow-normalize`\n- `allow-join`\n- `allow-dirname`\n- `allow-extname`\n- `allow-basename`\n- `allow-is-absolute`"
+        },
+        {
+          "description": "Enables the basename command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-basename",
+          "markdownDescription": "Enables the basename command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the dirname command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-dirname",
+          "markdownDescription": "Enables the dirname command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the extname command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-extname",
+          "markdownDescription": "Enables the extname command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_absolute command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-is-absolute",
+          "markdownDescription": "Enables the is_absolute command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the join command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-join",
+          "markdownDescription": "Enables the join command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the normalize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-normalize",
+          "markdownDescription": "Enables the normalize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the resolve command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-resolve",
+          "markdownDescription": "Enables the resolve command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the resolve_directory command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:allow-resolve-directory",
+          "markdownDescription": "Enables the resolve_directory command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the basename command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-basename",
+          "markdownDescription": "Denies the basename command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the dirname command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-dirname",
+          "markdownDescription": "Denies the dirname command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the extname command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-extname",
+          "markdownDescription": "Denies the extname command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_absolute command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-is-absolute",
+          "markdownDescription": "Denies the is_absolute command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the join command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-join",
+          "markdownDescription": "Denies the join command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the normalize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-normalize",
+          "markdownDescription": "Denies the normalize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the resolve command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-resolve",
+          "markdownDescription": "Denies the resolve command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the resolve_directory command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:path:deny-resolve-directory",
+          "markdownDescription": "Denies the resolve_directory command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-close`",
+          "type": "string",
+          "const": "core:resources:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-close`"
+        },
+        {
+          "description": "Enables the close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:resources:allow-close",
+          "markdownDescription": "Enables the close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:resources:deny-close",
+          "markdownDescription": "Denies the close command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`",
+          "type": "string",
+          "const": "core:tray:default",
+          "markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`"
+        },
+        {
+          "description": "Enables the get_by_id command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-get-by-id",
+          "markdownDescription": "Enables the get_by_id command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-new",
+          "markdownDescription": "Enables the new command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the remove_by_id command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-remove-by-id",
+          "markdownDescription": "Enables the remove_by_id command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-icon",
+          "markdownDescription": "Enables the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_icon_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-icon-as-template",
+          "markdownDescription": "Enables the set_icon_as_template command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-menu",
+          "markdownDescription": "Enables the set_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_show_menu_on_left_click command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-show-menu-on-left-click",
+          "markdownDescription": "Enables the set_show_menu_on_left_click command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_temp_dir_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-temp-dir-path",
+          "markdownDescription": "Enables the set_temp_dir_path command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-title",
+          "markdownDescription": "Enables the set_title command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_tooltip command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-tooltip",
+          "markdownDescription": "Enables the set_tooltip command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:allow-set-visible",
+          "markdownDescription": "Enables the set_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_by_id command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-get-by-id",
+          "markdownDescription": "Denies the get_by_id command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the new command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-new",
+          "markdownDescription": "Denies the new command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the remove_by_id command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-remove-by-id",
+          "markdownDescription": "Denies the remove_by_id command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-icon",
+          "markdownDescription": "Denies the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_icon_as_template command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-icon-as-template",
+          "markdownDescription": "Denies the set_icon_as_template command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_menu command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-menu",
+          "markdownDescription": "Denies the set_menu command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_show_menu_on_left_click command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-show-menu-on-left-click",
+          "markdownDescription": "Denies the set_show_menu_on_left_click command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_temp_dir_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-temp-dir-path",
+          "markdownDescription": "Denies the set_temp_dir_path command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-title",
+          "markdownDescription": "Denies the set_title command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_tooltip command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-tooltip",
+          "markdownDescription": "Denies the set_tooltip command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:tray:deny-set-visible",
+          "markdownDescription": "Denies the set_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-webviews`\n- `allow-webview-position`\n- `allow-webview-size`\n- `allow-internal-toggle-devtools`",
+          "type": "string",
+          "const": "core:webview:default",
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-webviews`\n- `allow-webview-position`\n- `allow-webview-size`\n- `allow-internal-toggle-devtools`"
+        },
+        {
+          "description": "Enables the clear_all_browsing_data command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-clear-all-browsing-data",
+          "markdownDescription": "Enables the clear_all_browsing_data command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create_webview command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-create-webview",
+          "markdownDescription": "Enables the create_webview command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create_webview_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-create-webview-window",
+          "markdownDescription": "Enables the create_webview_window command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_all_webviews command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-get-all-webviews",
+          "markdownDescription": "Enables the get_all_webviews command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the internal_toggle_devtools command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-internal-toggle-devtools",
+          "markdownDescription": "Enables the internal_toggle_devtools command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the print command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-print",
+          "markdownDescription": "Enables the print command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the reparent command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-reparent",
+          "markdownDescription": "Enables the reparent command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_auto_resize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-auto-resize",
+          "markdownDescription": "Enables the set_webview_auto_resize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_background_color command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-background-color",
+          "markdownDescription": "Enables the set_webview_background_color command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_focus command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-focus",
+          "markdownDescription": "Enables the set_webview_focus command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-position",
+          "markdownDescription": "Enables the set_webview_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-size",
+          "markdownDescription": "Enables the set_webview_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_webview_zoom command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-set-webview-zoom",
+          "markdownDescription": "Enables the set_webview_zoom command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the webview_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-webview-close",
+          "markdownDescription": "Enables the webview_close command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the webview_hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-webview-hide",
+          "markdownDescription": "Enables the webview_hide command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the webview_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-webview-position",
+          "markdownDescription": "Enables the webview_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the webview_show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-webview-show",
+          "markdownDescription": "Enables the webview_show command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the webview_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:allow-webview-size",
+          "markdownDescription": "Enables the webview_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the clear_all_browsing_data command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-clear-all-browsing-data",
+          "markdownDescription": "Denies the clear_all_browsing_data command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create_webview command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-create-webview",
+          "markdownDescription": "Denies the create_webview command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create_webview_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-create-webview-window",
+          "markdownDescription": "Denies the create_webview_window command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_all_webviews command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-get-all-webviews",
+          "markdownDescription": "Denies the get_all_webviews command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the internal_toggle_devtools command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-internal-toggle-devtools",
+          "markdownDescription": "Denies the internal_toggle_devtools command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the print command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-print",
+          "markdownDescription": "Denies the print command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the reparent command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-reparent",
+          "markdownDescription": "Denies the reparent command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_auto_resize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-auto-resize",
+          "markdownDescription": "Denies the set_webview_auto_resize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_background_color command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-background-color",
+          "markdownDescription": "Denies the set_webview_background_color command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_focus command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-focus",
+          "markdownDescription": "Denies the set_webview_focus command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-position",
+          "markdownDescription": "Denies the set_webview_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-size",
+          "markdownDescription": "Denies the set_webview_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_webview_zoom command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-set-webview-zoom",
+          "markdownDescription": "Denies the set_webview_zoom command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the webview_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-webview-close",
+          "markdownDescription": "Denies the webview_close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the webview_hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-webview-hide",
+          "markdownDescription": "Denies the webview_hide command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the webview_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-webview-position",
+          "markdownDescription": "Denies the webview_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the webview_show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-webview-show",
+          "markdownDescription": "Denies the webview_show command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the webview_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:webview:deny-webview-size",
+          "markdownDescription": "Denies the webview_size command without any pre-configured scope."
+        },
+        {
+          "description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`",
+          "type": "string",
+          "const": "core:window:default",
+          "markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`"
+        },
+        {
+          "description": "Enables the available_monitors command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-available-monitors",
+          "markdownDescription": "Enables the available_monitors command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the center command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-center",
+          "markdownDescription": "Enables the center command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-close",
+          "markdownDescription": "Enables the close command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the create command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-create",
+          "markdownDescription": "Enables the create command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the current_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-current-monitor",
+          "markdownDescription": "Enables the current_monitor command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the cursor_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-cursor-position",
+          "markdownDescription": "Enables the cursor_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the destroy command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-destroy",
+          "markdownDescription": "Enables the destroy command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the get_all_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-get-all-windows",
+          "markdownDescription": "Enables the get_all_windows command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-hide",
+          "markdownDescription": "Enables the hide command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the inner_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-inner-position",
+          "markdownDescription": "Enables the inner_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the inner_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-inner-size",
+          "markdownDescription": "Enables the inner_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the internal_toggle_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-internal-toggle-maximize",
+          "markdownDescription": "Enables the internal_toggle_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_always_on_top command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-always-on-top",
+          "markdownDescription": "Enables the is_always_on_top command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_closable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-closable",
+          "markdownDescription": "Enables the is_closable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_decorated command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-decorated",
+          "markdownDescription": "Enables the is_decorated command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-enabled",
+          "markdownDescription": "Enables the is_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_focused command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-focused",
+          "markdownDescription": "Enables the is_focused command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-fullscreen",
+          "markdownDescription": "Enables the is_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_maximizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-maximizable",
+          "markdownDescription": "Enables the is_maximizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_maximized command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-maximized",
+          "markdownDescription": "Enables the is_maximized command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_minimizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-minimizable",
+          "markdownDescription": "Enables the is_minimizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_minimized command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-minimized",
+          "markdownDescription": "Enables the is_minimized command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_resizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-resizable",
+          "markdownDescription": "Enables the is_resizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-is-visible",
+          "markdownDescription": "Enables the is_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-maximize",
+          "markdownDescription": "Enables the maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-minimize",
+          "markdownDescription": "Enables the minimize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the monitor_from_point command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-monitor-from-point",
+          "markdownDescription": "Enables the monitor_from_point command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the outer_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-outer-position",
+          "markdownDescription": "Enables the outer_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the outer_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-outer-size",
+          "markdownDescription": "Enables the outer_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the primary_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-primary-monitor",
+          "markdownDescription": "Enables the primary_monitor command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the request_user_attention command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-request-user-attention",
+          "markdownDescription": "Enables the request_user_attention command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the scale_factor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-scale-factor",
+          "markdownDescription": "Enables the scale_factor command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_always_on_bottom command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-always-on-bottom",
+          "markdownDescription": "Enables the set_always_on_bottom command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_always_on_top command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-always-on-top",
+          "markdownDescription": "Enables the set_always_on_top command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_background_color command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-background-color",
+          "markdownDescription": "Enables the set_background_color command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_badge_count command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-badge-count",
+          "markdownDescription": "Enables the set_badge_count command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_badge_label command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-badge-label",
+          "markdownDescription": "Enables the set_badge_label command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_closable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-closable",
+          "markdownDescription": "Enables the set_closable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_content_protected command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-content-protected",
+          "markdownDescription": "Enables the set_content_protected command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_cursor_grab command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-cursor-grab",
+          "markdownDescription": "Enables the set_cursor_grab command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_cursor_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-cursor-icon",
+          "markdownDescription": "Enables the set_cursor_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_cursor_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-cursor-position",
+          "markdownDescription": "Enables the set_cursor_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_cursor_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-cursor-visible",
+          "markdownDescription": "Enables the set_cursor_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_decorations command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-decorations",
+          "markdownDescription": "Enables the set_decorations command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_effects command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-effects",
+          "markdownDescription": "Enables the set_effects command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-enabled",
+          "markdownDescription": "Enables the set_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_focus command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-focus",
+          "markdownDescription": "Enables the set_focus command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_focusable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-focusable",
+          "markdownDescription": "Enables the set_focusable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-fullscreen",
+          "markdownDescription": "Enables the set_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-icon",
+          "markdownDescription": "Enables the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_ignore_cursor_events command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-ignore-cursor-events",
+          "markdownDescription": "Enables the set_ignore_cursor_events command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_max_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-max-size",
+          "markdownDescription": "Enables the set_max_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_maximizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-maximizable",
+          "markdownDescription": "Enables the set_maximizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_min_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-min-size",
+          "markdownDescription": "Enables the set_min_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_minimizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-minimizable",
+          "markdownDescription": "Enables the set_minimizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_overlay_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-overlay-icon",
+          "markdownDescription": "Enables the set_overlay_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-position",
+          "markdownDescription": "Enables the set_position command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_progress_bar command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-progress-bar",
+          "markdownDescription": "Enables the set_progress_bar command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_resizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-resizable",
+          "markdownDescription": "Enables the set_resizable command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_shadow command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-shadow",
+          "markdownDescription": "Enables the set_shadow command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_simple_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-simple-fullscreen",
+          "markdownDescription": "Enables the set_simple_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-size",
+          "markdownDescription": "Enables the set_size command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_size_constraints command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-size-constraints",
+          "markdownDescription": "Enables the set_size_constraints command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_skip_taskbar command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-skip-taskbar",
+          "markdownDescription": "Enables the set_skip_taskbar command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-theme",
+          "markdownDescription": "Enables the set_theme command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-title",
+          "markdownDescription": "Enables the set_title command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_title_bar_style command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-title-bar-style",
+          "markdownDescription": "Enables the set_title_bar_style command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the set_visible_on_all_workspaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-visible-on-all-workspaces",
+          "markdownDescription": "Enables the set_visible_on_all_workspaces command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-show",
+          "markdownDescription": "Enables the show command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the start_dragging command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-start-dragging",
+          "markdownDescription": "Enables the start_dragging command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the start_resize_dragging command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-start-resize-dragging",
+          "markdownDescription": "Enables the start_resize_dragging command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-theme",
+          "markdownDescription": "Enables the theme command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-title",
+          "markdownDescription": "Enables the title command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the toggle_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-toggle-maximize",
+          "markdownDescription": "Enables the toggle_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unmaximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-unmaximize",
+          "markdownDescription": "Enables the unmaximize command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unminimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-unminimize",
+          "markdownDescription": "Enables the unminimize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the available_monitors command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-available-monitors",
+          "markdownDescription": "Denies the available_monitors command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the center command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-center",
+          "markdownDescription": "Denies the center command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the close command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-close",
+          "markdownDescription": "Denies the close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the create command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-create",
+          "markdownDescription": "Denies the create command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the current_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-current-monitor",
+          "markdownDescription": "Denies the current_monitor command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the cursor_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-cursor-position",
+          "markdownDescription": "Denies the cursor_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the destroy command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-destroy",
+          "markdownDescription": "Denies the destroy command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_all_windows command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-get-all-windows",
+          "markdownDescription": "Denies the get_all_windows command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the hide command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-hide",
+          "markdownDescription": "Denies the hide command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the inner_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-inner-position",
+          "markdownDescription": "Denies the inner_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the inner_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-inner-size",
+          "markdownDescription": "Denies the inner_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the internal_toggle_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-internal-toggle-maximize",
+          "markdownDescription": "Denies the internal_toggle_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_always_on_top command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-always-on-top",
+          "markdownDescription": "Denies the is_always_on_top command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_closable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-closable",
+          "markdownDescription": "Denies the is_closable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_decorated command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-decorated",
+          "markdownDescription": "Denies the is_decorated command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-enabled",
+          "markdownDescription": "Denies the is_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_focused command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-focused",
+          "markdownDescription": "Denies the is_focused command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-fullscreen",
+          "markdownDescription": "Denies the is_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_maximizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-maximizable",
+          "markdownDescription": "Denies the is_maximizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_maximized command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-maximized",
+          "markdownDescription": "Denies the is_maximized command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_minimizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-minimizable",
+          "markdownDescription": "Denies the is_minimizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_minimized command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-minimized",
+          "markdownDescription": "Denies the is_minimized command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_resizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-resizable",
+          "markdownDescription": "Denies the is_resizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-is-visible",
+          "markdownDescription": "Denies the is_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-maximize",
+          "markdownDescription": "Denies the maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-minimize",
+          "markdownDescription": "Denies the minimize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the monitor_from_point command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-monitor-from-point",
+          "markdownDescription": "Denies the monitor_from_point command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the outer_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-outer-position",
+          "markdownDescription": "Denies the outer_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the outer_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-outer-size",
+          "markdownDescription": "Denies the outer_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the primary_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-primary-monitor",
+          "markdownDescription": "Denies the primary_monitor command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the request_user_attention command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-request-user-attention",
+          "markdownDescription": "Denies the request_user_attention command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the scale_factor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-scale-factor",
+          "markdownDescription": "Denies the scale_factor command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_always_on_bottom command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-always-on-bottom",
+          "markdownDescription": "Denies the set_always_on_bottom command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_always_on_top command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-always-on-top",
+          "markdownDescription": "Denies the set_always_on_top command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_background_color command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-background-color",
+          "markdownDescription": "Denies the set_background_color command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_badge_count command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-badge-count",
+          "markdownDescription": "Denies the set_badge_count command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_badge_label command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-badge-label",
+          "markdownDescription": "Denies the set_badge_label command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_closable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-closable",
+          "markdownDescription": "Denies the set_closable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_content_protected command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-content-protected",
+          "markdownDescription": "Denies the set_content_protected command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_cursor_grab command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-cursor-grab",
+          "markdownDescription": "Denies the set_cursor_grab command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_cursor_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-cursor-icon",
+          "markdownDescription": "Denies the set_cursor_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_cursor_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-cursor-position",
+          "markdownDescription": "Denies the set_cursor_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_cursor_visible command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-cursor-visible",
+          "markdownDescription": "Denies the set_cursor_visible command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_decorations command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-decorations",
+          "markdownDescription": "Denies the set_decorations command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_effects command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-effects",
+          "markdownDescription": "Denies the set_effects command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_enabled command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-enabled",
+          "markdownDescription": "Denies the set_enabled command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_focus command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-focus",
+          "markdownDescription": "Denies the set_focus command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_focusable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-focusable",
+          "markdownDescription": "Denies the set_focusable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-fullscreen",
+          "markdownDescription": "Denies the set_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-icon",
+          "markdownDescription": "Denies the set_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_ignore_cursor_events command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-ignore-cursor-events",
+          "markdownDescription": "Denies the set_ignore_cursor_events command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_max_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-max-size",
+          "markdownDescription": "Denies the set_max_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_maximizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-maximizable",
+          "markdownDescription": "Denies the set_maximizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_min_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-min-size",
+          "markdownDescription": "Denies the set_min_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_minimizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-minimizable",
+          "markdownDescription": "Denies the set_minimizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_overlay_icon command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-overlay-icon",
+          "markdownDescription": "Denies the set_overlay_icon command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_position command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-position",
+          "markdownDescription": "Denies the set_position command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_progress_bar command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-progress-bar",
+          "markdownDescription": "Denies the set_progress_bar command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_resizable command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-resizable",
+          "markdownDescription": "Denies the set_resizable command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_shadow command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-shadow",
+          "markdownDescription": "Denies the set_shadow command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_simple_fullscreen command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-simple-fullscreen",
+          "markdownDescription": "Denies the set_simple_fullscreen command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_size command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-size",
+          "markdownDescription": "Denies the set_size command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_size_constraints command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-size-constraints",
+          "markdownDescription": "Denies the set_size_constraints command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_skip_taskbar command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-skip-taskbar",
+          "markdownDescription": "Denies the set_skip_taskbar command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-theme",
+          "markdownDescription": "Denies the set_theme command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-title",
+          "markdownDescription": "Denies the set_title command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_title_bar_style command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-title-bar-style",
+          "markdownDescription": "Denies the set_title_bar_style command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the set_visible_on_all_workspaces command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-visible-on-all-workspaces",
+          "markdownDescription": "Denies the set_visible_on_all_workspaces command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the show command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-show",
+          "markdownDescription": "Denies the show command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the start_dragging command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-start-dragging",
+          "markdownDescription": "Denies the start_dragging command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the start_resize_dragging command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-start-resize-dragging",
+          "markdownDescription": "Denies the start_resize_dragging command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the theme command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-theme",
+          "markdownDescription": "Denies the theme command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the title command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-title",
+          "markdownDescription": "Denies the title command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the toggle_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-toggle-maximize",
+          "markdownDescription": "Denies the toggle_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unmaximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-unmaximize",
+          "markdownDescription": "Denies the unmaximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unminimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-unminimize",
+          "markdownDescription": "Denies the unminimize command without any pre-configured scope."
+        },
+        {
+          "description": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`",
+          "type": "string",
+          "const": "deep-link:default",
+          "markdownDescription": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`"
+        },
+        {
+          "description": "Enables the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-get-current",
+          "markdownDescription": "Enables the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-is-registered",
+          "markdownDescription": "Enables the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-register",
+          "markdownDescription": "Enables the register command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-unregister",
+          "markdownDescription": "Enables the unregister command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-get-current",
+          "markdownDescription": "Denies the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-is-registered",
+          "markdownDescription": "Denies the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-register",
+          "markdownDescription": "Denies the register command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-unregister",
+          "markdownDescription": "Denies the unregister command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-message`\n- `allow-save`\n- `allow-open`",
+          "type": "string",
+          "const": "dialog:default",
+          "markdownDescription": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-message`\n- `allow-save`\n- `allow-open`"
+        },
+        {
+          "description": "Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)",
+          "type": "string",
+          "const": "dialog:allow-ask",
+          "markdownDescription": "Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)"
+        },
+        {
+          "description": "Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)",
+          "type": "string",
+          "const": "dialog:allow-confirm",
+          "markdownDescription": "Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)"
+        },
+        {
+          "description": "Enables the message command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:allow-message",
+          "markdownDescription": "Enables the message command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:allow-open",
+          "markdownDescription": "Enables the open command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the save command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:allow-save",
+          "markdownDescription": "Enables the save command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)",
+          "type": "string",
+          "const": "dialog:deny-ask",
+          "markdownDescription": "Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)"
+        },
+        {
+          "description": "Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)",
+          "type": "string",
+          "const": "dialog:deny-confirm",
+          "markdownDescription": "Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)"
+        },
+        {
+          "description": "Denies the message command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:deny-message",
+          "markdownDescription": "Denies the message command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:deny-open",
+          "markdownDescription": "Denies the open command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the save command without any pre-configured scope.",
+          "type": "string",
+          "const": "dialog:deny-save",
+          "markdownDescription": "Denies the save command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+          "type": "string",
+          "const": "http:default",
+          "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+        },
+        {
+          "description": "Enables the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch",
+          "markdownDescription": "Enables the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel",
+          "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel-body",
+          "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-read-body",
+          "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-send",
+          "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch",
+          "markdownDescription": "Denies the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel",
+          "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel-body",
+          "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-read-body",
+          "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-send",
+          "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+          "type": "string",
+          "const": "opener:default",
+          "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+        },
+        {
+          "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+          "type": "string",
+          "const": "opener:allow-default-urls",
+          "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+        },
+        {
+          "description": "Enables the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-path",
+          "markdownDescription": "Enables the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-url",
+          "markdownDescription": "Enables the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-reveal-item-in-dir",
+          "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-path",
+          "markdownDescription": "Denies the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-url",
+          "markdownDescription": "Denies the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-reveal-item-in-dir",
+          "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
+          "type": "string",
+          "const": "process:default",
+          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
+        },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-restart",
+          "markdownDescription": "Enables the restart command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-restart",
+          "markdownDescription": "Denies the restart command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+          "type": "string",
+          "const": "shell:default",
+          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+        },
+        {
+          "description": "Enables the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-execute",
+          "markdownDescription": "Enables the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-kill",
+          "markdownDescription": "Enables the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-open",
+          "markdownDescription": "Enables the open command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-spawn",
+          "markdownDescription": "Enables the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-stdin-write",
+          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-execute",
+          "markdownDescription": "Denies the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-kill",
+          "markdownDescription": "Denies the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-open",
+          "markdownDescription": "Denies the open command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-spawn",
+          "markdownDescription": "Denies the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-stdin-write",
+          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`",
+          "type": "string",
+          "const": "updater:default",
+          "markdownDescription": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`"
+        },
+        {
+          "description": "Enables the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-check",
+          "markdownDescription": "Enables the check command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download",
+          "markdownDescription": "Enables the download command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download-and-install",
+          "markdownDescription": "Enables the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-install",
+          "markdownDescription": "Enables the install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-check",
+          "markdownDescription": "Denies the check command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download",
+          "markdownDescription": "Denies the download command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download-and-install",
+          "markdownDescription": "Denies the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-install",
+          "markdownDescription": "Denies the install command without any pre-configured scope."
+        }
+      ]
+    },
+    "Value": {
+      "description": "All supported ACL values.",
+      "anyOf": [
+        {
+          "description": "Represents a null JSON value.",
+          "type": "null"
+        },
+        {
+          "description": "Represents a [`bool`].",
+          "type": "boolean"
+        },
+        {
+          "description": "Represents a valid ACL [`Number`].",
+          "allOf": [
+            {
+              "$ref": "#/definitions/Number"
+            }
+          ]
+        },
+        {
+          "description": "Represents a [`String`].",
+          "type": "string"
+        },
+        {
+          "description": "Represents a list of other [`Value`]s.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Value"
+          }
+        },
+        {
+          "description": "Represents a map of [`String`] keys to [`Value`]s.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/Value"
+          }
+        }
+      ]
+    },
+    "Number": {
+      "description": "A valid ACL number.",
+      "anyOf": [
+        {
+          "description": "Represents an [`i64`].",
+          "type": "integer",
+          "format": "int64"
+        },
+        {
+          "description": "Represents a [`f64`].",
+          "type": "number",
+          "format": "double"
+        }
+      ]
+    },
+    "Target": {
+      "description": "Platform target.",
+      "oneOf": [
+        {
+          "description": "MacOS.",
+          "type": "string",
+          "enum": [
+            "macOS"
+          ]
+        },
+        {
+          "description": "Windows.",
+          "type": "string",
+          "enum": [
+            "windows"
+          ]
+        },
+        {
+          "description": "Linux.",
+          "type": "string",
+          "enum": [
+            "linux"
+          ]
+        },
+        {
+          "description": "Android.",
+          "type": "string",
+          "enum": [
+            "android"
+          ]
+        },
+        {
+          "description": "iOS.",
+          "type": "string",
+          "enum": [
+            "iOS"
+          ]
+        }
+      ]
+    },
+    "Application": {
+      "description": "Opener scope application.",
+      "anyOf": [
+        {
+          "description": "Open in default application.",
+          "type": "null"
+        },
+        {
+          "description": "If true, allow open with any application.",
+          "type": "boolean"
+        },
+        {
+          "description": "Allow specific application to open with.",
+          "type": "string"
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArg": {
+      "description": "A command argument allowed to be executed by the webview API.",
+      "anyOf": [
+        {
+          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
+          "type": "string"
+        },
+        {
+          "description": "A variable that is set while calling the command from the webview API.",
+          "type": "object",
+          "required": [
+            "validator"
+          ],
+          "properties": {
+            "raw": {
+              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
+              "default": false,
+              "type": "boolean"
+            },
+            "validator": {
+              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArgs": {
+      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
+      "anyOf": [
+        {
+          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
+          "type": "boolean"
+        },
+        {
+          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
+          }
+        }
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/src-tauri/gen/schemas/macOS-schema.json b/apps/desktop/src-tauri/gen/schemas/macOS-schema.json
similarity index 68%
rename from src-tauri/gen/schemas/macOS-schema.json
rename to apps/desktop/src-tauri/gen/schemas/macOS-schema.json
index 5aa9e8779d..2587586dd0 100644
--- a/src-tauri/gen/schemas/macOS-schema.json
+++ b/apps/desktop/src-tauri/gen/schemas/macOS-schema.json
@@ -134,6 +134,522 @@
           "description": "Reference a permission or permission set by identifier and extends its scope.",
           "type": "object",
           "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+                        "type": "string",
+                        "const": "http:default",
+                        "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+                      },
+                      {
+                        "description": "Enables the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch",
+                        "markdownDescription": "Enables the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel",
+                        "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel-body",
+                        "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-read-body",
+                        "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-send",
+                        "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch",
+                        "markdownDescription": "Denies the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel",
+                        "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel-body",
+                        "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-read-body",
+                        "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-send",
+                        "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+                        "type": "string",
+                        "const": "opener:default",
+                        "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+                      },
+                      {
+                        "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+                        "type": "string",
+                        "const": "opener:allow-default-urls",
+                        "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+                      },
+                      {
+                        "description": "Enables the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-path",
+                        "markdownDescription": "Enables the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-url",
+                        "markdownDescription": "Enables the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-reveal-item-in-dir",
+                        "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-path",
+                        "markdownDescription": "Denies the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-url",
+                        "markdownDescription": "Denies the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-reveal-item-in-dir",
+                        "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+                        "type": "string",
+                        "const": "shell:default",
+                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+                      },
+                      {
+                        "description": "Enables the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-execute",
+                        "markdownDescription": "Enables the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-kill",
+                        "markdownDescription": "Enables the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-open",
+                        "markdownDescription": "Enables the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-spawn",
+                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-stdin-write",
+                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-execute",
+                        "markdownDescription": "Denies the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-kill",
+                        "markdownDescription": "Denies the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-open",
+                        "markdownDescription": "Denies the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-spawn",
+                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-stdin-write",
+                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
             {
               "properties": {
                 "identifier": {
@@ -2145,22 +2661,76 @@
           "markdownDescription": "Denies the unminimize command without any pre-configured scope."
         },
         {
-          "description": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-ask`\n- `allow-confirm`\n- `allow-message`\n- `allow-save`\n- `allow-open`",
+          "description": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`",
+          "type": "string",
+          "const": "deep-link:default",
+          "markdownDescription": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`"
+        },
+        {
+          "description": "Enables the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-get-current",
+          "markdownDescription": "Enables the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-is-registered",
+          "markdownDescription": "Enables the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-register",
+          "markdownDescription": "Enables the register command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-unregister",
+          "markdownDescription": "Enables the unregister command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-get-current",
+          "markdownDescription": "Denies the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-is-registered",
+          "markdownDescription": "Denies the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-register",
+          "markdownDescription": "Denies the register command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-unregister",
+          "markdownDescription": "Denies the unregister command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-message`\n- `allow-save`\n- `allow-open`",
           "type": "string",
           "const": "dialog:default",
-          "markdownDescription": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-ask`\n- `allow-confirm`\n- `allow-message`\n- `allow-save`\n- `allow-open`"
+          "markdownDescription": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-message`\n- `allow-save`\n- `allow-open`"
         },
         {
-          "description": "Enables the ask command without any pre-configured scope.",
+          "description": "Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)",
           "type": "string",
           "const": "dialog:allow-ask",
-          "markdownDescription": "Enables the ask command without any pre-configured scope."
+          "markdownDescription": "Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)"
         },
         {
-          "description": "Enables the confirm command without any pre-configured scope.",
+          "description": "Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)",
           "type": "string",
           "const": "dialog:allow-confirm",
-          "markdownDescription": "Enables the confirm command without any pre-configured scope."
+          "markdownDescription": "Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)"
         },
         {
           "description": "Enables the message command without any pre-configured scope.",
@@ -2181,16 +2751,16 @@
           "markdownDescription": "Enables the save command without any pre-configured scope."
         },
         {
-          "description": "Denies the ask command without any pre-configured scope.",
+          "description": "Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)",
           "type": "string",
           "const": "dialog:deny-ask",
-          "markdownDescription": "Denies the ask command without any pre-configured scope."
+          "markdownDescription": "Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)"
         },
         {
-          "description": "Denies the confirm command without any pre-configured scope.",
+          "description": "Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)",
           "type": "string",
           "const": "dialog:deny-confirm",
-          "markdownDescription": "Denies the confirm command without any pre-configured scope."
+          "markdownDescription": "Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)"
         },
         {
           "description": "Denies the message command without any pre-configured scope.",
@@ -2209,6 +2779,270 @@
           "type": "string",
           "const": "dialog:deny-save",
           "markdownDescription": "Denies the save command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+          "type": "string",
+          "const": "http:default",
+          "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+        },
+        {
+          "description": "Enables the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch",
+          "markdownDescription": "Enables the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel",
+          "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel-body",
+          "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-read-body",
+          "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-send",
+          "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch",
+          "markdownDescription": "Denies the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel",
+          "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel-body",
+          "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-read-body",
+          "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-send",
+          "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+          "type": "string",
+          "const": "opener:default",
+          "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+        },
+        {
+          "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+          "type": "string",
+          "const": "opener:allow-default-urls",
+          "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+        },
+        {
+          "description": "Enables the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-path",
+          "markdownDescription": "Enables the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-url",
+          "markdownDescription": "Enables the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-reveal-item-in-dir",
+          "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-path",
+          "markdownDescription": "Denies the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-url",
+          "markdownDescription": "Denies the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-reveal-item-in-dir",
+          "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
+          "type": "string",
+          "const": "process:default",
+          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
+        },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-restart",
+          "markdownDescription": "Enables the restart command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-restart",
+          "markdownDescription": "Denies the restart command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+          "type": "string",
+          "const": "shell:default",
+          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+        },
+        {
+          "description": "Enables the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-execute",
+          "markdownDescription": "Enables the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-kill",
+          "markdownDescription": "Enables the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-open",
+          "markdownDescription": "Enables the open command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-spawn",
+          "markdownDescription": "Enables the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-stdin-write",
+          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-execute",
+          "markdownDescription": "Denies the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-kill",
+          "markdownDescription": "Denies the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-open",
+          "markdownDescription": "Denies the open command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-spawn",
+          "markdownDescription": "Denies the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-stdin-write",
+          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`",
+          "type": "string",
+          "const": "updater:default",
+          "markdownDescription": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`"
+        },
+        {
+          "description": "Enables the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-check",
+          "markdownDescription": "Enables the check command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download",
+          "markdownDescription": "Enables the download command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download-and-install",
+          "markdownDescription": "Enables the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-install",
+          "markdownDescription": "Enables the install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-check",
+          "markdownDescription": "Denies the check command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download",
+          "markdownDescription": "Denies the download command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download-and-install",
+          "markdownDescription": "Denies the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-install",
+          "markdownDescription": "Denies the install command without any pre-configured scope."
         }
       ]
     },
@@ -2305,6 +3139,67 @@
           ]
         }
       ]
+    },
+    "Application": {
+      "description": "Opener scope application.",
+      "anyOf": [
+        {
+          "description": "Open in default application.",
+          "type": "null"
+        },
+        {
+          "description": "If true, allow open with any application.",
+          "type": "boolean"
+        },
+        {
+          "description": "Allow specific application to open with.",
+          "type": "string"
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArg": {
+      "description": "A command argument allowed to be executed by the webview API.",
+      "anyOf": [
+        {
+          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
+          "type": "string"
+        },
+        {
+          "description": "A variable that is set while calling the command from the webview API.",
+          "type": "object",
+          "required": [
+            "validator"
+          ],
+          "properties": {
+            "raw": {
+              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
+              "default": false,
+              "type": "boolean"
+            },
+            "validator": {
+              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArgs": {
+      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
+      "anyOf": [
+        {
+          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
+          "type": "boolean"
+        },
+        {
+          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
+          }
+        }
+      ]
     }
   }
 }
\ No newline at end of file
diff --git a/src-tauri/gen/schemas/desktop-schema.json b/apps/desktop/src-tauri/gen/schemas/windows-schema.json
similarity index 69%
rename from src-tauri/gen/schemas/desktop-schema.json
rename to apps/desktop/src-tauri/gen/schemas/windows-schema.json
index 5aa9e8779d..edf1c7ae6c 100644
--- a/src-tauri/gen/schemas/desktop-schema.json
+++ b/apps/desktop/src-tauri/gen/schemas/windows-schema.json
@@ -134,6 +134,522 @@
           "description": "Reference a permission or permission set by identifier and extends its scope.",
           "type": "object",
           "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+                        "type": "string",
+                        "const": "http:default",
+                        "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+                      },
+                      {
+                        "description": "Enables the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch",
+                        "markdownDescription": "Enables the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel",
+                        "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-cancel-body",
+                        "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-read-body",
+                        "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:allow-fetch-send",
+                        "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch",
+                        "markdownDescription": "Denies the fetch command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel",
+                        "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-cancel-body",
+                        "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_read_body command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-read-body",
+                        "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the fetch_send command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "http:deny-fetch-send",
+                        "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "HttpScopeEntry",
+                      "description": "HTTP scope entry.",
+                      "anyOf": [
+                        {
+                          "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                          "type": "string"
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "url": {
+                              "description": "A URL that can be accessed by the webview when using the HTTP APIs. Wildcards can be used following the URL pattern standard.\n\nSee [the URL Pattern spec](https://urlpattern.spec.whatwg.org/) for more information.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin on port 443\n\n- \"https://*:*\" : allows all HTTPS origin on any port\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+                        "type": "string",
+                        "const": "opener:default",
+                        "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+                      },
+                      {
+                        "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+                        "type": "string",
+                        "const": "opener:allow-default-urls",
+                        "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+                      },
+                      {
+                        "description": "Enables the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-path",
+                        "markdownDescription": "Enables the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-open-url",
+                        "markdownDescription": "Enables the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:allow-reveal-item-in-dir",
+                        "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_path command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-path",
+                        "markdownDescription": "Denies the open_path command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open_url command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-open-url",
+                        "markdownDescription": "Denies the open_url command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "opener:deny-reveal-item-in-dir",
+                        "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "OpenerScopeEntry",
+                      "description": "Opener scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "url"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this url with, for example: firefox.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "url": {
+                              "description": "A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"",
+                              "type": "string"
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "path"
+                          ],
+                          "properties": {
+                            "app": {
+                              "description": "An application to open this path with, for example: xdg-open.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/Application"
+                                }
+                              ]
+                            },
+                            "path": {
+                              "description": "A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "identifier": {
+                    "anyOf": [
+                      {
+                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+                        "type": "string",
+                        "const": "shell:default",
+                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+                      },
+                      {
+                        "description": "Enables the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-execute",
+                        "markdownDescription": "Enables the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-kill",
+                        "markdownDescription": "Enables the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-open",
+                        "markdownDescription": "Enables the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-spawn",
+                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Enables the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:allow-stdin-write",
+                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the execute command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-execute",
+                        "markdownDescription": "Denies the execute command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the kill command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-kill",
+                        "markdownDescription": "Denies the kill command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the open command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-open",
+                        "markdownDescription": "Denies the open command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the spawn command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-spawn",
+                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
+                      },
+                      {
+                        "description": "Denies the stdin_write command without any pre-configured scope.",
+                        "type": "string",
+                        "const": "shell:deny-stdin-write",
+                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+                      }
+                    ]
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "allow": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  },
+                  "deny": {
+                    "items": {
+                      "title": "ShellScopeEntry",
+                      "description": "Shell scope entry.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "required": [
+                            "cmd",
+                            "name"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "cmd": {
+                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
+                              "type": "string"
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "object",
+                          "required": [
+                            "name",
+                            "sidecar"
+                          ],
+                          "properties": {
+                            "args": {
+                              "description": "The allowed arguments for the command execution.",
+                              "allOf": [
+                                {
+                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
+                                }
+                              ]
+                            },
+                            "name": {
+                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
+                              "type": "string"
+                            },
+                            "sidecar": {
+                              "description": "If this command is a sidecar command.",
+                              "type": "boolean"
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      ]
+                    }
+                  }
+                }
+              },
+              "properties": {
+                "identifier": {
+                  "description": "Identifier of the permission or permission set.",
+                  "allOf": [
+                    {
+                      "$ref": "#/definitions/Identifier"
+                    }
+                  ]
+                }
+              }
+            },
             {
               "properties": {
                 "identifier": {
@@ -2144,6 +2660,60 @@
           "const": "core:window:deny-unminimize",
           "markdownDescription": "Denies the unminimize command without any pre-configured scope."
         },
+        {
+          "description": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`",
+          "type": "string",
+          "const": "deep-link:default",
+          "markdownDescription": "Allows reading the opened deep link via the get_current command\n#### This default permission set includes:\n\n- `allow-get-current`"
+        },
+        {
+          "description": "Enables the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-get-current",
+          "markdownDescription": "Enables the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-is-registered",
+          "markdownDescription": "Enables the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-register",
+          "markdownDescription": "Enables the register command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:allow-unregister",
+          "markdownDescription": "Enables the unregister command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the get_current command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-get-current",
+          "markdownDescription": "Denies the get_current command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the is_registered command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-is-registered",
+          "markdownDescription": "Denies the is_registered command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the register command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-register",
+          "markdownDescription": "Denies the register command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the unregister command without any pre-configured scope.",
+          "type": "string",
+          "const": "deep-link:deny-unregister",
+          "markdownDescription": "Denies the unregister command without any pre-configured scope."
+        },
         {
           "description": "This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n\n#### This default permission set includes:\n\n- `allow-ask`\n- `allow-confirm`\n- `allow-message`\n- `allow-save`\n- `allow-open`",
           "type": "string",
@@ -2209,6 +2779,270 @@
           "type": "string",
           "const": "dialog:deny-save",
           "markdownDescription": "Denies the save command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`",
+          "type": "string",
+          "const": "http:default",
+          "markdownDescription": "This permission set configures what kind of\nfetch operations are available from the http plugin.\n\nThis enables all fetch operations but does not\nallow explicitly any origins to be fetched. This needs to\nbe manually configured before usage.\n\n#### Granted Permissions\n\nAll fetch operations are enabled.\n\n\n#### This default permission set includes:\n\n- `allow-fetch`\n- `allow-fetch-cancel`\n- `allow-fetch-send`\n- `allow-fetch-read-body`\n- `allow-fetch-cancel-body`"
+        },
+        {
+          "description": "Enables the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch",
+          "markdownDescription": "Enables the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel",
+          "markdownDescription": "Enables the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-cancel-body",
+          "markdownDescription": "Enables the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-read-body",
+          "markdownDescription": "Enables the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:allow-fetch-send",
+          "markdownDescription": "Enables the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch",
+          "markdownDescription": "Denies the fetch command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel",
+          "markdownDescription": "Denies the fetch_cancel command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_cancel_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-cancel-body",
+          "markdownDescription": "Denies the fetch_cancel_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_read_body command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-read-body",
+          "markdownDescription": "Denies the fetch_read_body command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the fetch_send command without any pre-configured scope.",
+          "type": "string",
+          "const": "http:deny-fetch-send",
+          "markdownDescription": "Denies the fetch_send command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
+          "type": "string",
+          "const": "opener:default",
+          "markdownDescription": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`"
+        },
+        {
+          "description": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.",
+          "type": "string",
+          "const": "opener:allow-default-urls",
+          "markdownDescription": "This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application."
+        },
+        {
+          "description": "Enables the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-path",
+          "markdownDescription": "Enables the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-open-url",
+          "markdownDescription": "Enables the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:allow-reveal-item-in-dir",
+          "markdownDescription": "Enables the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_path command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-path",
+          "markdownDescription": "Denies the open_path command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open_url command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-open-url",
+          "markdownDescription": "Denies the open_url command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the reveal_item_in_dir command without any pre-configured scope.",
+          "type": "string",
+          "const": "opener:deny-reveal-item-in-dir",
+          "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
+          "type": "string",
+          "const": "process:default",
+          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
+        },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:allow-restart",
+          "markdownDescription": "Enables the restart command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the restart command without any pre-configured scope.",
+          "type": "string",
+          "const": "process:deny-restart",
+          "markdownDescription": "Denies the restart command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
+          "type": "string",
+          "const": "shell:default",
+          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
+        },
+        {
+          "description": "Enables the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-execute",
+          "markdownDescription": "Enables the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-kill",
+          "markdownDescription": "Enables the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-open",
+          "markdownDescription": "Enables the open command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-spawn",
+          "markdownDescription": "Enables the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:allow-stdin-write",
+          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the execute command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-execute",
+          "markdownDescription": "Denies the execute command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the kill command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-kill",
+          "markdownDescription": "Denies the kill command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the open command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-open",
+          "markdownDescription": "Denies the open command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the spawn command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-spawn",
+          "markdownDescription": "Denies the spawn command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the stdin_write command without any pre-configured scope.",
+          "type": "string",
+          "const": "shell:deny-stdin-write",
+          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`",
+          "type": "string",
+          "const": "updater:default",
+          "markdownDescription": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`"
+        },
+        {
+          "description": "Enables the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-check",
+          "markdownDescription": "Enables the check command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download",
+          "markdownDescription": "Enables the download command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-download-and-install",
+          "markdownDescription": "Enables the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:allow-install",
+          "markdownDescription": "Enables the install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-check",
+          "markdownDescription": "Denies the check command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download",
+          "markdownDescription": "Denies the download command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-download-and-install",
+          "markdownDescription": "Denies the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "updater:deny-install",
+          "markdownDescription": "Denies the install command without any pre-configured scope."
         }
       ]
     },
@@ -2305,6 +3139,67 @@
           ]
         }
       ]
+    },
+    "Application": {
+      "description": "Opener scope application.",
+      "anyOf": [
+        {
+          "description": "Open in default application.",
+          "type": "null"
+        },
+        {
+          "description": "If true, allow open with any application.",
+          "type": "boolean"
+        },
+        {
+          "description": "Allow specific application to open with.",
+          "type": "string"
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArg": {
+      "description": "A command argument allowed to be executed by the webview API.",
+      "anyOf": [
+        {
+          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
+          "type": "string"
+        },
+        {
+          "description": "A variable that is set while calling the command from the webview API.",
+          "type": "object",
+          "required": [
+            "validator"
+          ],
+          "properties": {
+            "raw": {
+              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
+              "default": false,
+              "type": "boolean"
+            },
+            "validator": {
+              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "ShellScopeEntryAllowedArgs": {
+      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
+      "anyOf": [
+        {
+          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
+          "type": "boolean"
+        },
+        {
+          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
+          }
+        }
+      ]
     }
   }
 }
\ No newline at end of file
diff --git a/apps/desktop/src-tauri/icons/128x128.png b/apps/desktop/src-tauri/icons/128x128.png
new file mode 100644
index 0000000000..b94133d675
Binary files /dev/null and b/apps/desktop/src-tauri/icons/128x128.png differ
diff --git a/apps/desktop/src-tauri/icons/128x128@2x.png b/apps/desktop/src-tauri/icons/128x128@2x.png
new file mode 100644
index 0000000000..cc91e51dd5
Binary files /dev/null and b/apps/desktop/src-tauri/icons/128x128@2x.png differ
diff --git a/apps/desktop/src-tauri/icons/32x32.png b/apps/desktop/src-tauri/icons/32x32.png
new file mode 100644
index 0000000000..db2f3cc841
Binary files /dev/null and b/apps/desktop/src-tauri/icons/32x32.png differ
diff --git a/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml b/apps/desktop/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml
similarity index 100%
rename from src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml
rename to apps/desktop/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml
diff --git a/src-tauri/icons/android/values/ic_launcher_background.xml b/apps/desktop/src-tauri/icons/android/values/ic_launcher_background.xml
similarity index 100%
rename from src-tauri/icons/android/values/ic_launcher_background.xml
rename to apps/desktop/src-tauri/icons/android/values/ic_launcher_background.xml
diff --git a/apps/desktop/src-tauri/icons/icon.icns b/apps/desktop/src-tauri/icons/icon.icns
new file mode 100644
index 0000000000..8bf7d28a1b
Binary files /dev/null and b/apps/desktop/src-tauri/icons/icon.icns differ
diff --git a/apps/desktop/src-tauri/icons/icon.ico b/apps/desktop/src-tauri/icons/icon.ico
new file mode 100644
index 0000000000..8c7a2448fb
Binary files /dev/null and b/apps/desktop/src-tauri/icons/icon.ico differ
diff --git a/apps/desktop/src-tauri/icons/icon.png b/apps/desktop/src-tauri/icons/icon.png
new file mode 100644
index 0000000000..558c56d93e
Binary files /dev/null and b/apps/desktop/src-tauri/icons/icon.png differ
diff --git a/apps/desktop/src-tauri/src/bun_env.rs b/apps/desktop/src-tauri/src/bun_env.rs
new file mode 100644
index 0000000000..539554f97e
--- /dev/null
+++ b/apps/desktop/src-tauri/src/bun_env.rs
@@ -0,0 +1,153 @@
+const SAFE_DNS_RESULT_ORDER: &str = "verbatim";
+
+fn is_valid_dns_result_order(value: &str) -> bool {
+    let normalized = value.trim().to_ascii_lowercase();
+    normalized == "ipv4first" || normalized == "verbatim"
+}
+
+fn sanitize_dns_result_order_args(raw: &str) -> Option<String> {
+    let tokens: Vec<&str> = raw.split_whitespace().collect();
+    let mut kept = Vec::new();
+    let mut changed = false;
+    let mut index = 0usize;
+
+    while index < tokens.len() {
+        let token = tokens[index];
+
+        if let Some(order) = token.strip_prefix("--dns-result-order=") {
+            if is_valid_dns_result_order(order) {
+                kept.push(token.to_string());
+            } else {
+                changed = true;
+            }
+            index += 1;
+            continue;
+        }
+
+        if token == "--dns-result-order" {
+            match tokens.get(index + 1).copied() {
+                Some(order) if is_valid_dns_result_order(order) => {
+                    kept.push(token.to_string());
+                    kept.push(order.to_string());
+                }
+                Some(_) | None => {
+                    changed = true;
+                }
+            }
+            index += 2;
+            continue;
+        }
+
+        kept.push(token.to_string());
+        index += 1;
+    }
+
+    if !changed {
+        return None;
+    }
+
+    Some(kept.join(" "))
+}
+
+pub fn bun_env_overrides() -> Vec<(&'static str, String)> {
+    let mut overrides = vec![(
+        "BUN_CONFIG_DNS_RESULT_ORDER",
+        SAFE_DNS_RESULT_ORDER.to_string(),
+    )];
+
+    if let Ok(value) = std::env::var("BUN_OPTIONS") {
+        if let Some(sanitized) = sanitize_dns_result_order_args(&value) {
+            overrides.push(("BUN_OPTIONS", sanitized));
+        }
+    }
+
+    if let Ok(value) = std::env::var("NODE_OPTIONS") {
+        if let Some(sanitized) = sanitize_dns_result_order_args(&value) {
+            overrides.push(("NODE_OPTIONS", sanitized));
+        }
+    }
+
+    overrides
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    struct EnvVarGuard {
+        key: &'static str,
+        original: Option<String>,
+    }
+
+    impl EnvVarGuard {
+        fn set(key: &'static str, value: &str) -> Self {
+            let original = std::env::var(key).ok();
+            std::env::set_var(key, value);
+            Self { key, original }
+        }
+
+        fn clear(key: &'static str) -> Self {
+            let original = std::env::var(key).ok();
+            std::env::remove_var(key);
+            Self { key, original }
+        }
+    }
+
+    impl Drop for EnvVarGuard {
+        fn drop(&mut self) {
+            match &self.original {
+                Some(value) => std::env::set_var(self.key, value),
+                None => std::env::remove_var(self.key),
+            }
+        }
+    }
+
+    #[test]
+    fn strips_invalid_dns_result_order_from_bun_options() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+        let _bun_options =
+            EnvVarGuard::set("BUN_OPTIONS", "--smol --dns-result-order=ipv6first --hot");
+        let _node_options = EnvVarGuard::clear("NODE_OPTIONS");
+
+        let overrides = bun_env_overrides();
+        let bun_override = overrides
+            .iter()
+            .find(|(key, _)| *key == "BUN_OPTIONS")
+            .map(|(_, value)| value.clone());
+
+        assert_eq!(bun_override.as_deref(), Some("--smol --hot"));
+    }
+
+    #[test]
+    fn strips_invalid_split_dns_result_order_from_node_options() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+        let _bun_options = EnvVarGuard::clear("BUN_OPTIONS");
+        let _node_options = EnvVarGuard::set(
+            "NODE_OPTIONS",
+            "--max-old-space-size=4096 --dns-result-order weird",
+        );
+
+        let overrides = bun_env_overrides();
+        let node_override = overrides
+            .iter()
+            .find(|(key, _)| *key == "NODE_OPTIONS")
+            .map(|(_, value)| value.clone());
+
+        assert_eq!(node_override.as_deref(), Some("--max-old-space-size=4096"));
+    }
+
+    #[test]
+    fn keeps_valid_dns_result_order_flags() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+        let _bun_options = EnvVarGuard::set("BUN_OPTIONS", "--dns-result-order=ipv4first");
+        let _node_options = EnvVarGuard::set("NODE_OPTIONS", "--dns-result-order verbatim");
+
+        let overrides = bun_env_overrides();
+
+        assert!(!overrides.iter().any(|(key, _)| *key == "BUN_OPTIONS"));
+        assert!(!overrides.iter().any(|(key, _)| *key == "NODE_OPTIONS"));
+    }
+}
diff --git a/apps/desktop/src-tauri/src/commands/command_files.rs b/apps/desktop/src-tauri/src/commands/command_files.rs
new file mode 100644
index 0000000000..7d70bed938
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/command_files.rs
@@ -0,0 +1,114 @@
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+
+use crate::types::{ExecResult, OpencodeCommand};
+use crate::workspace::commands::{sanitize_command_name, serialize_command_frontmatter};
+
+fn resolve_commands_dir(scope: &str, project_dir: &str) -> Result<PathBuf, String> {
+    match scope {
+        "workspace" => {
+            if project_dir.trim().is_empty() {
+                return Err("projectDir is required".to_string());
+            }
+            Ok(PathBuf::from(project_dir)
+                .join(".opencode")
+                .join("commands"))
+        }
+        "global" => {
+            let base = if let Ok(dir) = env::var("XDG_CONFIG_HOME") {
+                PathBuf::from(dir)
+            } else if let Ok(home) = env::var("HOME") {
+                PathBuf::from(home).join(".config")
+            } else {
+                return Err("Unable to resolve config directory".to_string());
+            };
+            Ok(base.join("opencode").join("commands"))
+        }
+        _ => Err("scope must be 'workspace' or 'global'".to_string()),
+    }
+}
+
+fn list_command_names(dir: &PathBuf) -> Result<Vec<String>, String> {
+    if !dir.exists() {
+        return Ok(Vec::new());
+    }
+
+    let mut names = Vec::new();
+    for entry in fs::read_dir(dir).map_err(|e| format!("Failed to read {}: {e}", dir.display()))? {
+        let entry = entry.map_err(|e| format!("Failed to read entry: {e}"))?;
+        let path = entry.path();
+        if path.extension().and_then(|ext| ext.to_str()) != Some("md") {
+            continue;
+        }
+        if let Some(stem) = path.file_stem().and_then(|s| s.to_str()) {
+            names.push(stem.to_string());
+        }
+    }
+    names.sort();
+    Ok(names)
+}
+
+#[tauri::command]
+pub fn opencode_command_list(scope: String, project_dir: String) -> Result<Vec<String>, String> {
+    let dir = resolve_commands_dir(scope.trim(), project_dir.trim())?;
+    list_command_names(&dir)
+}
+
+#[tauri::command]
+pub fn opencode_command_write(
+    scope: String,
+    project_dir: String,
+    command: OpencodeCommand,
+) -> Result<ExecResult, String> {
+    let scope = scope.trim();
+    let safe_name = sanitize_command_name(&command.name)
+        .ok_or_else(|| "command.name is required".to_string())?;
+
+    let dir = resolve_commands_dir(scope, project_dir.trim())?;
+    if let Some(parent) = dir.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+    }
+    fs::create_dir_all(&dir).map_err(|e| format!("Failed to create {}: {e}", dir.display()))?;
+
+    let payload = OpencodeCommand {
+        name: safe_name.clone(),
+        ..command
+    };
+    let file_path = dir.join(format!("{safe_name}.md"));
+    let serialized = serialize_command_frontmatter(&payload)?;
+    fs::write(&file_path, serialized)
+        .map_err(|e| format!("Failed to write {}: {e}", file_path.display()))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Wrote {}", file_path.display()),
+        stderr: String::new(),
+    })
+}
+
+#[tauri::command]
+pub fn opencode_command_delete(
+    scope: String,
+    project_dir: String,
+    name: String,
+) -> Result<ExecResult, String> {
+    let scope = scope.trim();
+    let safe_name = sanitize_command_name(&name).ok_or_else(|| "name is required".to_string())?;
+    let dir = resolve_commands_dir(scope, project_dir.trim())?;
+    let file_path = dir.join(format!("{safe_name}.md"));
+
+    if file_path.exists() {
+        fs::remove_file(&file_path)
+            .map_err(|e| format!("Failed to delete {}: {e}", file_path.display()))?;
+    }
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Deleted {}", file_path.display()),
+        stderr: String::new(),
+    })
+}
diff --git a/apps/desktop/src-tauri/src/commands/config.rs b/apps/desktop/src-tauri/src/commands/config.rs
new file mode 100644
index 0000000000..e362fbc13d
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/config.rs
@@ -0,0 +1,19 @@
+use crate::config::{read_opencode_config as read_inner, write_opencode_config as write_inner};
+use crate::types::{ExecResult, OpencodeConfigFile};
+
+#[tauri::command]
+pub fn read_opencode_config(
+    scope: String,
+    project_dir: String,
+) -> Result<OpencodeConfigFile, String> {
+    read_inner(scope.trim(), &project_dir)
+}
+
+#[tauri::command]
+pub fn write_opencode_config(
+    scope: String,
+    project_dir: String,
+    content: String,
+) -> Result<ExecResult, String> {
+    write_inner(scope.trim(), &project_dir, &content)
+}
diff --git a/apps/desktop/src-tauri/src/commands/desktop_bootstrap.rs b/apps/desktop/src-tauri/src/commands/desktop_bootstrap.rs
new file mode 100644
index 0000000000..9793eaea9f
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/desktop_bootstrap.rs
@@ -0,0 +1,16 @@
+use crate::desktop_bootstrap::{
+    read_or_init_desktop_bootstrap_config, save_desktop_bootstrap_config,
+};
+use crate::types::DesktopBootstrapConfig;
+
+#[tauri::command]
+pub fn get_desktop_bootstrap_config() -> Result<DesktopBootstrapConfig, String> {
+    read_or_init_desktop_bootstrap_config()
+}
+
+#[tauri::command]
+pub fn set_desktop_bootstrap_config(
+    config: DesktopBootstrapConfig,
+) -> Result<DesktopBootstrapConfig, String> {
+    save_desktop_bootstrap_config(&config)
+}
diff --git a/apps/desktop/src-tauri/src/commands/engine.rs b/apps/desktop/src-tauri/src/commands/engine.rs
new file mode 100644
index 0000000000..9551748893
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/engine.rs
@@ -0,0 +1,437 @@
+use tauri::{AppHandle, Manager, State};
+
+use crate::config::{read_opencode_config, write_opencode_config};
+use crate::engine::doctor::{opencode_serve_help, opencode_version, resolve_engine_path};
+use crate::engine::manager::EngineManager;
+use crate::openwork_server::{manager::OpenworkServerManager, start_openwork_server};
+use crate::types::{EngineDoctorResult, EngineInfo, EngineRuntime, ExecResult};
+use crate::utils::truncate_output;
+use serde::Deserialize;
+use serde_json::json;
+
+struct EnvVarGuard {
+    key: &'static str,
+    original: Option<std::ffi::OsString>,
+}
+
+impl EnvVarGuard {
+    fn apply(key: &'static str, value: Option<&str>) -> Self {
+        let original = std::env::var_os(key);
+        match value {
+            Some(next) if !next.trim().is_empty() => {
+                std::env::set_var(key, next.trim());
+            }
+            _ => {
+                std::env::remove_var(key);
+            }
+        }
+        Self { key, original }
+    }
+}
+
+impl Drop for EnvVarGuard {
+    fn drop(&mut self) {
+        match &self.original {
+            Some(value) => std::env::set_var(self.key, value),
+            None => std::env::remove_var(self.key),
+        }
+    }
+}
+
+fn pinned_opencode_version() -> String {
+    let constants = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../../constants.json"
+    ));
+    let parsed: serde_json::Value =
+        serde_json::from_str(constants).expect("constants.json must be valid JSON");
+    parsed["opencodeVersion"]
+        .as_str()
+        .expect("constants.json must include opencodeVersion")
+        .trim()
+        .trim_start_matches('v')
+        .to_string()
+}
+
+fn pinned_opencode_install_command() -> String {
+    format!(
+        "curl -fsSL https://opencode.ai/install | bash -s -- --version {} --no-modify-path",
+        pinned_opencode_version()
+    )
+}
+
+#[derive(Debug, Deserialize)]
+struct OpenworkWorkspaceListResponse {
+    #[serde(default)]
+    items: Vec<OpenworkWorkspaceEntry>,
+}
+
+#[derive(Debug, Deserialize)]
+struct OpenworkWorkspaceEntry {
+    opencode: Option<OpenworkWorkspaceOpencode>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct OpenworkWorkspaceOpencode {
+    base_url: String,
+    directory: Option<String>,
+    username: Option<String>,
+    password: Option<String>,
+}
+
+fn parse_base_url_host(base_url: &str) -> Option<String> {
+    let without_scheme = base_url
+        .split_once("://")
+        .map(|(_, rest)| rest)
+        .unwrap_or(base_url);
+    let host_port = without_scheme.split('/').next()?.trim();
+    let host = host_port
+        .rsplit_once(':')
+        .map(|(host, _)| host)
+        .unwrap_or(host_port);
+    if host.is_empty() {
+        None
+    } else {
+        Some(host.trim_matches(['[', ']']).to_string())
+    }
+}
+
+fn parse_base_url_port(base_url: &str) -> Option<u16> {
+    let without_scheme = base_url
+        .split_once("://")
+        .map(|(_, rest)| rest)
+        .unwrap_or(base_url);
+    let host_port = without_scheme.split('/').next()?.trim();
+    host_port
+        .rsplit_once(':')
+        .and_then(|(_, port)| port.parse::<u16>().ok())
+}
+
+fn opencode_bin_source(notes: &[String], in_path: bool) -> Option<String> {
+    if notes
+        .iter()
+        .any(|note| note.contains("Using OPENCODE_BIN_PATH"))
+    {
+        return Some("custom".to_string());
+    }
+    if notes
+        .iter()
+        .any(|note| note.contains("Using bundled sidecar"))
+    {
+        return Some("bundled".to_string());
+    }
+    if in_path {
+        return Some("path".to_string());
+    }
+    if notes.iter().any(|note| note.starts_with("Found at ")) {
+        return Some("known-location".to_string());
+    }
+
+    None
+}
+
+fn probe_openwork_managed_opencode(
+    server_base_url: &str,
+    owner_token: &str,
+) -> Result<Option<OpenworkWorkspaceOpencode>, String> {
+    let response = ureq::get(&format!(
+        "{}/workspaces",
+        server_base_url.trim_end_matches('/')
+    ))
+    .set("Authorization", &format!("Bearer {owner_token}"))
+    .call()
+    .map_err(|error| error.to_string())?;
+    let payload: OpenworkWorkspaceListResponse = response
+        .into_json()
+        .map_err(|error| format!("Failed to parse OpenWork workspaces response: {error}"))?;
+
+    Ok(payload.items.into_iter().find_map(|entry| {
+        entry
+            .opencode
+            .filter(|opencode| !opencode.base_url.trim().is_empty())
+    }))
+}
+
+#[tauri::command]
+pub fn engine_info(manager: State<EngineManager>) -> EngineInfo {
+    let mut state = manager.inner.lock().expect("engine mutex poisoned");
+    EngineManager::snapshot_locked(&mut state)
+}
+
+#[tauri::command]
+pub fn engine_stop(
+    manager: State<EngineManager>,
+    openwork_manager: State<OpenworkServerManager>,
+) -> EngineInfo {
+    let mut state = manager.inner.lock().expect("engine mutex poisoned");
+    EngineManager::stop_locked(&mut state);
+    if let Ok(mut openwork_state) = openwork_manager.inner.lock() {
+        OpenworkServerManager::stop_locked(&mut openwork_state);
+    }
+    EngineManager::snapshot_locked(&mut state)
+}
+
+#[tauri::command]
+pub fn engine_restart(
+    app: AppHandle,
+    manager: State<EngineManager>,
+    openwork_manager: State<OpenworkServerManager>,
+    opencode_enable_exa: Option<bool>,
+    openwork_remote_access: Option<bool>,
+) -> Result<EngineInfo, String> {
+    let project_dir = {
+        let state = manager.inner.lock().expect("engine mutex poisoned");
+        state
+            .project_dir
+            .clone()
+            .ok_or_else(|| "OpenCode is not configured for a local workspace".to_string())?
+    };
+
+    let workspace_paths = vec![project_dir.clone()];
+    engine_start(
+        app,
+        manager,
+        openwork_manager,
+        project_dir,
+        None,
+        None,
+        opencode_enable_exa,
+        openwork_remote_access,
+        None,
+        Some(workspace_paths),
+    )
+}
+
+#[tauri::command]
+pub fn engine_doctor(
+    app: AppHandle,
+    prefer_sidecar: Option<bool>,
+    opencode_bin_path: Option<String>,
+) -> EngineDoctorResult {
+    let prefer_sidecar = prefer_sidecar.unwrap_or(true);
+    let resource_dir = app.path().resource_dir().ok();
+
+    let current_bin_dir = tauri::process::current_binary(&app.env())
+        .ok()
+        .and_then(|path| path.parent().map(|parent| parent.to_path_buf()));
+
+    let _guard = EnvVarGuard::apply("OPENCODE_BIN_PATH", opencode_bin_path.as_deref());
+
+    let (resolved, in_path, notes) = resolve_engine_path(
+        prefer_sidecar,
+        resource_dir.as_deref(),
+        current_bin_dir.as_deref(),
+    );
+    let resolved_source = opencode_bin_source(&notes, in_path);
+
+    let (version, supports_serve, serve_help_status, serve_help_stdout, serve_help_stderr) =
+        match resolved.as_ref() {
+            Some(path) => {
+                let (ok, status, stdout, stderr) = opencode_serve_help(path.as_os_str());
+                (
+                    opencode_version(path.as_os_str()),
+                    ok,
+                    status,
+                    stdout,
+                    stderr,
+                )
+            }
+            None => (None, false, None, None, None),
+        };
+
+    EngineDoctorResult {
+        found: resolved.is_some(),
+        in_path,
+        resolved_path: resolved.map(|path| path.to_string_lossy().to_string()),
+        resolved_source,
+        version,
+        supports_serve,
+        notes,
+        serve_help_status,
+        serve_help_stdout,
+        serve_help_stderr,
+    }
+}
+
+#[tauri::command]
+pub fn engine_install() -> Result<ExecResult, String> {
+    #[cfg(windows)]
+    {
+        return Ok(ExecResult {
+      ok: false,
+      status: -1,
+      stdout: String::new(),
+      stderr: "Guided install is not supported on Windows yet. Install the OpenWork-pinned OpenCode version manually, then restart OpenWork.".to_string(),
+    });
+    }
+
+    #[cfg(not(windows))]
+    {
+        let install_dir = crate::paths::home_dir()
+            .unwrap_or_else(|| std::path::PathBuf::from("."))
+            .join(".opencode")
+            .join("bin");
+
+        let output = std::process::Command::new("bash")
+            .arg("-lc")
+            .arg(pinned_opencode_install_command())
+            .env("OPENCODE_INSTALL_DIR", install_dir)
+            .output()
+            .map_err(|e| format!("Failed to run installer: {e}"))?;
+
+        let status = output.status.code().unwrap_or(-1);
+        Ok(ExecResult {
+            ok: output.status.success(),
+            status,
+            stdout: String::from_utf8_lossy(&output.stdout).to_string(),
+            stderr: String::from_utf8_lossy(&output.stderr).to_string(),
+        })
+    }
+}
+
+#[tauri::command]
+pub fn engine_start(
+    app: AppHandle,
+    manager: State<EngineManager>,
+    openwork_manager: State<OpenworkServerManager>,
+    project_dir: String,
+    prefer_sidecar: Option<bool>,
+    opencode_bin_path: Option<String>,
+    _opencode_enable_exa: Option<bool>,
+    openwork_remote_access: Option<bool>,
+    _runtime: Option<EngineRuntime>,
+    workspace_paths: Option<Vec<String>>,
+) -> Result<EngineInfo, String> {
+    let project_dir = project_dir.trim().to_string();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    // OpenCode is spawned with `current_dir(project_dir)`. If the user selected a
+    // workspace path that doesn't exist yet (common during onboarding), spawning
+    // fails with `os error 2`.
+    std::fs::create_dir_all(&project_dir)
+        .map_err(|e| format!("Failed to create projectDir directory: {e}"))?;
+
+    let config = read_opencode_config("project", &project_dir)?;
+    if !config.exists {
+        let content = serde_json::to_string_pretty(&json!({
+            "$schema": "https://opencode.ai/config.json",
+        }))
+        .map_err(|e| format!("Failed to serialize opencode config: {e}"))?;
+        let write_result = write_opencode_config("project", &project_dir, &format!("{content}\n"))?;
+        if !write_result.ok {
+            return Err(write_result.stderr);
+        }
+    }
+
+    let mut workspace_paths = workspace_paths.unwrap_or_default();
+    workspace_paths.retain(|path| !path.trim().is_empty());
+    workspace_paths.retain(|path| path.trim() != project_dir);
+    workspace_paths.insert(0, project_dir.clone());
+
+    let openwork_remote_access_enabled = openwork_remote_access.unwrap_or(false);
+
+    let mut state = manager.inner.lock().expect("engine mutex poisoned");
+    EngineManager::stop_locked(&mut state);
+    state.runtime = EngineRuntime::Direct;
+
+    let resource_dir = app.path().resource_dir().ok();
+    let current_bin_dir = tauri::process::current_binary(&app.env())
+        .ok()
+        .and_then(|path| path.parent().map(|parent| parent.to_path_buf()));
+    let prefer_sidecar = prefer_sidecar.unwrap_or(true);
+    let _guard = EnvVarGuard::apply("OPENCODE_BIN_PATH", opencode_bin_path.as_deref());
+    let (program, in_path, notes) = resolve_engine_path(
+        prefer_sidecar,
+        resource_dir.as_deref(),
+        current_bin_dir.as_deref(),
+    );
+    let opencode_bin_source = opencode_bin_source(&notes, in_path);
+    let Some(program) = program else {
+        let notes_text = notes.join("\n");
+        let install_command = pinned_opencode_install_command();
+        return Err(format!(
+            "OpenCode CLI not found.\n\nInstall with:\n- {install_command}\n\nNotes:\n{notes_text}"
+        ));
+    };
+
+    let opencode_bin = program.to_string_lossy().to_string();
+    let opencode_bin_path = Some(opencode_bin.clone());
+    drop(state);
+
+    if let Ok(mut openwork_state) = openwork_manager.inner.lock() {
+        OpenworkServerManager::stop_locked(&mut openwork_state);
+    }
+
+    let openwork_info = start_openwork_server(
+        &app,
+        &openwork_manager,
+        &workspace_paths,
+        None,
+        None,
+        None,
+        openwork_remote_access_enabled,
+        true,
+        Some(&opencode_bin),
+        opencode_bin_source.as_deref(),
+    )?;
+
+    let managed_opencode = match (
+        openwork_info.base_url.as_deref(),
+        openwork_info.owner_token.as_deref(),
+    ) {
+        (Some(server_base_url), Some(owner_token)) => {
+            probe_openwork_managed_opencode(server_base_url, owner_token)
+        }
+        _ => Err("OpenWork server did not report a base URL and owner token".to_string()),
+    };
+
+    match managed_opencode {
+        Ok(Some(opencode)) => {
+            if let Ok(mut state) = manager.inner.lock() {
+                state.runtime = EngineRuntime::Direct;
+                state.child = None;
+                state.child_exited = false;
+                state.project_dir = opencode.directory.clone().or(Some(project_dir.clone()));
+                state.hostname = parse_base_url_host(&opencode.base_url);
+                state.port = parse_base_url_port(&opencode.base_url);
+                state.base_url = Some(opencode.base_url.clone());
+                state.opencode_username = opencode.username.clone();
+                state.opencode_password = opencode.password.clone();
+                state.opencode_bin_path = opencode_bin_path.clone();
+                state.opencode_bin_source = opencode_bin_source.clone();
+                state.last_stdout = None;
+                state.last_stderr = None;
+            }
+        }
+        Ok(None) => {
+            if let Ok(mut state) = manager.inner.lock() {
+                state.runtime = EngineRuntime::Direct;
+                state.project_dir = Some(project_dir.clone());
+                state.opencode_bin_path = opencode_bin_path.clone();
+                state.opencode_bin_source = opencode_bin_source.clone();
+                state.last_stderr = Some(truncate_output(
+                    "OpenWork server did not report a managed OpenCode workspace",
+                    8000,
+                ));
+            }
+        }
+        Err(error) => {
+            if let Ok(mut state) = manager.inner.lock() {
+                state.runtime = EngineRuntime::Direct;
+                state.project_dir = Some(project_dir.clone());
+                state.opencode_bin_path = opencode_bin_path.clone();
+                state.opencode_bin_source = opencode_bin_source.clone();
+                state.last_stderr = Some(truncate_output(
+                    &format!("OpenWork server workspace probe: {error}"),
+                    8000,
+                ));
+            }
+        }
+    }
+
+    let mut state = manager.inner.lock().expect("engine mutex poisoned");
+    Ok(EngineManager::snapshot_locked(&mut state))
+}
diff --git a/apps/desktop/src-tauri/src/commands/migration.rs b/apps/desktop/src-tauri/src/commands/migration.rs
new file mode 100644
index 0000000000..e93f74ae28
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/migration.rs
@@ -0,0 +1,297 @@
+use serde::Deserialize;
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use tauri::{AppHandle, Manager};
+
+const MIGRATION_SNAPSHOT_FILENAME: &str = "migration-snapshot.v1.json";
+const MIGRATION_INSTALLER_LOG: &str = "migration-install.log";
+
+#[derive(Debug, Deserialize)]
+pub struct MigrationSnapshotPayload {
+    pub version: u32,
+    #[serde(rename = "writtenAt")]
+    pub written_at: Option<i64>,
+    pub source: Option<String>,
+    pub keys: HashMap<String, String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct MigrateToElectronRequest {
+    /// Full URL to the Electron artifact. On macOS we expect a .zip (not a
+    /// .dmg) so we can swap the .app bundle in place without the user
+    /// having to drag anything. On Windows: a .exe NSIS installer. On
+    /// Linux: an AppImage.
+    pub url: String,
+    /// Optional sha256 to verify before we touch the filesystem.
+    #[serde(default)]
+    pub sha256: Option<String>,
+    /// Optional electron-builder sha512 (base64) from latest-mac.yml.
+    #[serde(default)]
+    pub sha512: Option<String>,
+    /// Optional override for where the new OpenWork bundle should land on
+    /// macOS. Defaults to replacing the currently-running .app in place.
+    #[serde(default)]
+    pub target_app_path: Option<String>,
+}
+
+fn migration_snapshot_path(app: &AppHandle) -> Result<PathBuf, String> {
+    let data_dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("Failed to resolve app_data_dir: {e}"))?;
+    fs::create_dir_all(&data_dir).map_err(|e| format!("Failed to create app_data_dir: {e}"))?;
+    Ok(data_dir.join(MIGRATION_SNAPSHOT_FILENAME))
+}
+
+/// Snapshot workspace-related localStorage keys into app_data_dir so the
+/// next-launch Electron shell can hydrate them. Called by the last Tauri
+/// release right before it kicks off the Electron installer.
+#[tauri::command]
+pub fn write_migration_snapshot(
+    app: AppHandle,
+    snapshot: MigrationSnapshotPayload,
+) -> Result<(), String> {
+    if snapshot.version != 1 {
+        return Err(format!(
+            "Unsupported migration snapshot version: {}",
+            snapshot.version
+        ));
+    }
+
+    let path = migration_snapshot_path(&app)?;
+    let serialized = serde_json::json!({
+        "version": snapshot.version,
+        "writtenAt": snapshot.written_at,
+        "source": snapshot.source.unwrap_or_else(|| "tauri".to_string()),
+        "keys": snapshot.keys,
+    });
+    let contents = serde_json::to_string_pretty(&serialized)
+        .map_err(|e| format!("Failed to serialize snapshot: {e}"))?;
+    fs::write(&path, contents).map_err(|e| format!("Failed to write snapshot: {e}"))?;
+
+    println!(
+        "[migration] wrote {} key(s) to {}",
+        snapshot.keys.len(),
+        path.display()
+    );
+
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+fn current_app_bundle_path() -> Result<PathBuf, String> {
+    // Tauri's running .app is <something>/Contents/MacOS/OpenWork. Walk up
+    // two directories to get to <something>.app.
+    let exe = std::env::current_exe().map_err(|e| format!("current_exe failed: {e}"))?;
+    let bundle = exe
+        .parent()
+        .and_then(|p| p.parent())
+        .and_then(|p| p.parent())
+        .ok_or_else(|| "unexpected .app layout".to_string())?;
+    if bundle.extension().and_then(|s| s.to_str()) != Some("app") {
+        return Err(format!(
+            "resolved bundle is not an .app: {}",
+            bundle.display()
+        ));
+    }
+    Ok(bundle.to_path_buf())
+}
+
+#[cfg(target_os = "macos")]
+fn write_macos_migration_script(
+    app: &AppHandle,
+    url: &str,
+    sha256: Option<&str>,
+    sha512: Option<&str>,
+    target: &std::path::Path,
+    tauri_pid: u32,
+) -> Result<PathBuf, String> {
+    let cache = app
+        .path()
+        .app_cache_dir()
+        .map_err(|e| format!("Failed to resolve cache dir: {e}"))?;
+    fs::create_dir_all(&cache).map_err(|e| format!("Failed to create cache dir: {e}"))?;
+
+    let log_path = cache.join(MIGRATION_INSTALLER_LOG);
+    let script_path = cache.join("openwork-migrate.sh");
+
+    let sha256_check = match sha256 {
+        Some(hash) => format!(
+            r#"
+expected="{hash}"
+actual=$(shasum -a 256 "$ZIP" | awk '{{print $1}}')
+if [ "$actual" != "$expected" ]; then
+  echo "sha256 mismatch: got $actual, expected $expected" >&2
+  exit 1
+fi
+"#
+        ),
+        None => String::new(),
+    };
+
+    let sha512_check = match sha512 {
+        Some(hash) => format!(
+            r#"
+expected_sha512="{hash}"
+actual_sha512=$(openssl dgst -sha512 -binary "$ZIP" | openssl base64 -A)
+if [ "$actual_sha512" != "$expected_sha512" ]; then
+  echo "sha512 mismatch: got $actual_sha512, expected $expected_sha512" >&2
+  exit 1
+fi
+"#
+        ),
+        None => String::new(),
+    };
+
+    // The script runs detached AFTER Tauri exits. It downloads the Electron
+    // zip, verifies Apple code signing, swaps the .app bundle, and relaunches.
+    let script = format!(
+        r#"#!/bin/bash
+set -euo pipefail
+exec >>"{log}" 2>&1
+echo "[migration] script start $(date -u +%FT%TZ)"
+
+TARGET="{target}"
+URL="{url}"
+TAURI_PID="{tauri_pid}"
+WORK=$(mktemp -d /tmp/openwork-migrate-XXXXXX)
+ZIP="$WORK/OpenWork-electron.zip"
+
+# Wait for Tauri to fully exit before touching the .app bundle. A fixed
+# sleep races on slower machines and can leave the old bundle locked while
+# the migration script tries to replace it.
+echo "[migration] waiting for Tauri pid $TAURI_PID to exit"
+for i in {{1..60}}; do
+  if ! kill -0 "$TAURI_PID" 2>/dev/null; then
+    echo "[migration] Tauri exited after ${{i}}s"
+    break
+  fi
+  sleep 1
+done
+
+if kill -0 "$TAURI_PID" 2>/dev/null; then
+  echo "[migration] Tauri pid $TAURI_PID still running after 60s; aborting bundle swap" >&2
+  exit 1
+fi
+
+# Give LaunchServices and filesystem watchers one final beat to release the
+# old bundle after the process disappears.
+sleep 2
+
+echo "[migration] downloading $URL"
+curl --fail --location --silent --show-error --output "$ZIP" "$URL"
+{sha256}
+{sha512}
+
+echo "[migration] extracting"
+/usr/bin/unzip -q "$ZIP" -d "$WORK"
+
+NEW_APP=$(find "$WORK" -maxdepth 2 -name 'OpenWork.app' -type d | head -n 1)
+if [ -z "$NEW_APP" ]; then
+  echo "[migration] no OpenWork.app in zip" >&2
+  exit 1
+fi
+
+echo "[migration] verifying signature on $NEW_APP"
+/usr/bin/codesign --verify --deep --strict "$NEW_APP"
+
+echo "[migration] swapping bundle at $TARGET"
+BACKUP="$TARGET.migrate-bak"
+rm -rf "$BACKUP"
+mv "$TARGET" "$BACKUP"
+mv "$NEW_APP" "$TARGET"
+
+echo "[migration] launching new bundle"
+/usr/bin/open "$TARGET"
+
+echo "[migration] done $(date -u +%FT%TZ)"
+"#,
+        log = log_path.display(),
+        target = target.display(),
+        url = url,
+        tauri_pid = tauri_pid,
+        sha256 = sha256_check,
+        sha512 = sha512_check,
+    );
+
+    fs::write(&script_path, script).map_err(|e| format!("Failed to write script: {e}"))?;
+    let mut perms = fs::metadata(&script_path)
+        .map_err(|e| format!("Failed to stat script: {e}"))?
+        .permissions();
+    use std::os::unix::fs::PermissionsExt;
+    perms.set_mode(0o755);
+    fs::set_permissions(&script_path, perms).map_err(|e| format!("Failed to chmod script: {e}"))?;
+
+    Ok(script_path)
+}
+
+#[cfg(target_os = "macos")]
+fn spawn_macos_migration_script(script_path: &std::path::Path) -> Result<(), String> {
+    // nohup + background so the script survives this process exiting.
+    Command::new("/bin/bash")
+        .arg("-c")
+        .arg(format!(
+            "nohup bash \"{}\" >/dev/null 2>&1 &",
+            script_path.display()
+        ))
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .map_err(|e| format!("Failed to spawn migration script: {e}"))?;
+    Ok(())
+}
+
+/// Download the Electron installer, verify it, swap the .app bundle, and
+/// relaunch — then exit this Tauri process so the script can finish the
+/// handoff. The previous .app is kept at `<app>.migrate-bak` for rollback.
+///
+/// The caller (renderer) is expected to have already invoked
+/// `write_migration_snapshot` so the new Electron shell can hydrate
+/// localStorage on first launch.
+#[tauri::command]
+pub async fn migrate_to_electron(
+    app: AppHandle,
+    request: MigrateToElectronRequest,
+) -> Result<(), String> {
+    #[cfg(target_os = "macos")]
+    {
+        let target = match request.target_app_path {
+            Some(path) => PathBuf::from(path),
+            None => current_app_bundle_path()?,
+        };
+        let script = write_macos_migration_script(
+            &app,
+            &request.url,
+            request.sha256.as_deref(),
+            request.sha512.as_deref(),
+            &target,
+            std::process::id(),
+        )?;
+        spawn_macos_migration_script(&script)?;
+        // Give the script a moment to daemonize before we exit.
+        std::thread::sleep(std::time::Duration::from_millis(400));
+        app.exit(0);
+        Ok(())
+    }
+
+    #[cfg(target_os = "windows")]
+    {
+        // TODO(migration-windows): download the NSIS .exe, run with
+        // /S /D=<install-dir>, wait for exit, relaunch. For now, open
+        // the installer in the user's browser.
+        let _ = request;
+        let _ = app;
+        Err("Windows migrate_to_electron is not wired yet — handle via manual install".to_string())
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        // TODO(migration-linux): handle AppImage + tarball installs.
+        let _ = request;
+        let _ = app;
+        Err("Linux migrate_to_electron is not wired yet — handle via manual install".to_string())
+    }
+}
diff --git a/apps/desktop/src-tauri/src/commands/misc.rs b/apps/desktop/src-tauri/src/commands/misc.rs
new file mode 100644
index 0000000000..cd6bf394d5
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/misc.rs
@@ -0,0 +1,497 @@
+use std::collections::HashSet;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use crate::engine::doctor::resolve_engine_path;
+use crate::engine::manager::EngineManager;
+use crate::openwork_server::manager::OpenworkServerManager;
+use crate::orchestrator;
+use crate::orchestrator::manager::OrchestratorManager;
+use crate::paths::{candidate_xdg_config_dirs, candidate_xdg_data_dirs, home_dir};
+use crate::platform::command_for_program;
+use crate::types::{ExecResult, WorkspaceOpenworkConfig};
+use crate::workspace::state::load_workspace_state;
+use tauri::{AppHandle, Manager, State};
+
+fn pinned_opencode_install_command() -> String {
+    let constants = include_str!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../../constants.json"
+    ));
+    let parsed: serde_json::Value =
+        serde_json::from_str(constants).expect("constants.json must be valid JSON");
+    let version = parsed["opencodeVersion"]
+        .as_str()
+        .expect("constants.json must include opencodeVersion")
+        .trim()
+        .trim_start_matches('v');
+    format!(
+        "curl -fsSL https://opencode.ai/install | bash -s -- --version {} --no-modify-path",
+        version
+    )
+}
+
+#[derive(serde::Serialize)]
+pub struct CacheResetResult {
+    pub removed: Vec<String>,
+    pub missing: Vec<String>,
+    pub errors: Vec<String>,
+}
+
+#[derive(serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AppBuildInfo {
+    pub version: String,
+    pub git_sha: Option<String>,
+    pub build_epoch: Option<String>,
+    pub openwork_dev_mode: bool,
+    pub os: &'static str,
+    pub arch: &'static str,
+}
+
+fn env_truthy(key: &str) -> bool {
+    matches!(
+        std::env::var(key)
+            .ok()
+            .map(|value| value.trim().to_ascii_lowercase()),
+        Some(value) if value == "1" || value == "true" || value == "yes" || value == "on"
+    )
+}
+
+fn opencode_cache_candidates() -> Vec<PathBuf> {
+    let mut candidates: Vec<PathBuf> = Vec::new();
+
+    if let Ok(value) = std::env::var("XDG_CACHE_HOME") {
+        let trimmed = value.trim();
+        if !trimmed.is_empty() {
+            candidates.push(PathBuf::from(trimmed).join("opencode"));
+        }
+    }
+
+    if let Some(home) = home_dir() {
+        candidates.push(home.join(".cache").join("opencode"));
+
+        #[cfg(target_os = "macos")]
+        {
+            candidates.push(home.join("Library").join("Caches").join("opencode"));
+        }
+    }
+
+    #[cfg(windows)]
+    {
+        if let Ok(value) = std::env::var("LOCALAPPDATA") {
+            let trimmed = value.trim();
+            if !trimmed.is_empty() {
+                candidates.push(PathBuf::from(trimmed).join("opencode"));
+            }
+        }
+        if let Ok(value) = std::env::var("APPDATA") {
+            let trimmed = value.trim();
+            if !trimmed.is_empty() {
+                candidates.push(PathBuf::from(trimmed).join("opencode"));
+            }
+        }
+    }
+
+    let mut seen = HashSet::new();
+    candidates
+        .into_iter()
+        .filter(|path| seen.insert(path.to_string_lossy().to_string()))
+        .collect()
+}
+
+fn push_opencode_env_path(candidates: &mut Vec<PathBuf>, key: &str) {
+    let Ok(value) = std::env::var(key) else {
+        return;
+    };
+    let trimmed = value.trim();
+    if trimmed.is_empty() {
+        return;
+    }
+    candidates.push(PathBuf::from(trimmed).join("opencode"));
+}
+
+fn opencode_standard_state_paths() -> Vec<PathBuf> {
+    let mut candidates: Vec<PathBuf> = Vec::new();
+
+    push_opencode_env_path(&mut candidates, "XDG_CONFIG_HOME");
+    push_opencode_env_path(&mut candidates, "XDG_DATA_HOME");
+    push_opencode_env_path(&mut candidates, "XDG_STATE_HOME");
+    candidates.extend(opencode_cache_candidates());
+
+    for dir in candidate_xdg_config_dirs() {
+        candidates.push(dir.join("opencode"));
+    }
+
+    for dir in candidate_xdg_data_dirs() {
+        candidates.push(dir.join("opencode"));
+    }
+
+    if let Some(home) = home_dir() {
+        candidates.push(home.join(".local").join("state").join("opencode"));
+
+        #[cfg(target_os = "macos")]
+        {
+            candidates.push(
+                home.join("Library")
+                    .join("Application Support")
+                    .join("opencode"),
+            );
+        }
+    }
+
+    let mut seen = HashSet::new();
+    candidates
+        .into_iter()
+        .filter(|path| seen.insert(path.to_string_lossy().to_string()))
+        .collect()
+}
+
+fn current_openwork_state_paths(app: &AppHandle) -> Result<Vec<PathBuf>, String> {
+    let mut paths = vec![
+        app.path()
+            .app_cache_dir()
+            .map_err(|e| format!("Failed to resolve app cache dir: {e}"))?,
+        app.path()
+            .app_config_dir()
+            .map_err(|e| format!("Failed to resolve app config dir: {e}"))?,
+        app.path()
+            .app_local_data_dir()
+            .map_err(|e| format!("Failed to resolve app local data dir: {e}"))?,
+        app.path()
+            .app_data_dir()
+            .map_err(|e| format!("Failed to resolve app data dir: {e}"))?,
+        PathBuf::from(orchestrator::resolve_orchestrator_data_dir()),
+    ];
+
+    if let Some(home) = home_dir() {
+        paths.push(
+            home.join("OpenWork")
+                .join("Welcome")
+                .join(".opencode")
+                .join("openwork.json"),
+        );
+    }
+
+    Ok(paths)
+}
+
+fn stop_host_services(
+    engine_manager: &State<EngineManager>,
+    orchestrator_manager: &State<OrchestratorManager>,
+    openwork_manager: &State<OpenworkServerManager>,
+) {
+    if let Ok(mut engine) = engine_manager.inner.lock() {
+        EngineManager::stop_locked(&mut engine);
+    }
+    if let Ok(mut orchestrator_state) = orchestrator_manager.inner.lock() {
+        OrchestratorManager::stop_locked(&mut orchestrator_state);
+    }
+    if let Ok(mut openwork_state) = openwork_manager.inner.lock() {
+        OpenworkServerManager::stop_locked(&mut openwork_state);
+    }
+}
+
+fn remove_path_if_exists(path: &Path) -> Result<(), String> {
+    if !path.exists() {
+        return Ok(());
+    }
+
+    if path.is_dir() {
+        fs::remove_dir_all(path)
+            .map_err(|e| format!("Failed to remove directory {}: {e}", path.display()))
+    } else {
+        fs::remove_file(path).map_err(|e| format!("Failed to remove file {}: {e}", path.display()))
+    }
+}
+
+fn validate_server_name(name: &str) -> Result<String, String> {
+    let trimmed = name.trim();
+    if trimmed.is_empty() {
+        return Err("server_name is required".to_string());
+    }
+
+    if trimmed.starts_with('-') {
+        return Err("server_name must not start with '-'".to_string());
+    }
+
+    if !trimmed
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_')
+    {
+        return Err("server_name must be alphanumeric with '-' or '_'".to_string());
+    }
+
+    Ok(trimmed.to_string())
+}
+
+fn read_workspace_openwork_config(
+    workspace_path: &Path,
+) -> Result<WorkspaceOpenworkConfig, String> {
+    let openwork_path = workspace_path.join(".opencode").join("openwork.json");
+    if !openwork_path.exists() {
+        let mut cfg = WorkspaceOpenworkConfig::default();
+        let workspace_value = workspace_path.to_string_lossy().to_string();
+        if !workspace_value.trim().is_empty() {
+            cfg.authorized_roots.push(workspace_value);
+        }
+        return Ok(cfg);
+    }
+
+    let raw = fs::read_to_string(&openwork_path)
+        .map_err(|e| format!("Failed to read {}: {e}", openwork_path.display()))?;
+
+    serde_json::from_str::<WorkspaceOpenworkConfig>(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", openwork_path.display()))
+}
+
+fn load_authorized_roots(app: &AppHandle) -> Result<Vec<PathBuf>, String> {
+    let state = load_workspace_state(app)?;
+    let mut roots = Vec::new();
+
+    for workspace in state.workspaces {
+        let workspace_path = PathBuf::from(&workspace.path);
+        let mut config = read_workspace_openwork_config(&workspace_path)?;
+
+        if config.authorized_roots.is_empty() {
+            config.authorized_roots.push(workspace.path.clone());
+        }
+
+        for root in config.authorized_roots {
+            let trimmed = root.trim();
+            if !trimmed.is_empty() {
+                roots.push(PathBuf::from(trimmed));
+            }
+        }
+    }
+
+    if roots.is_empty() {
+        return Err("No authorized roots configured".to_string());
+    }
+
+    Ok(roots)
+}
+
+fn validate_project_dir(app: &AppHandle, project_dir: &str) -> Result<PathBuf, String> {
+    let trimmed = project_dir.trim();
+    if trimmed.is_empty() {
+        return Err("project_dir is required".to_string());
+    }
+
+    let project_path = PathBuf::from(trimmed);
+    if !project_path.is_absolute() {
+        return Err("project_dir must be an absolute path".to_string());
+    }
+
+    let canonical = fs::canonicalize(&project_path)
+        .map_err(|e| format!("Failed to resolve project_dir: {e}"))?;
+
+    if !canonical.is_dir() {
+        return Err("project_dir must be a directory".to_string());
+    }
+
+    let roots = load_authorized_roots(app)?;
+    let mut allowed = false;
+    for root in roots {
+        let Ok(root) = fs::canonicalize(&root) else {
+            continue;
+        };
+        if canonical.starts_with(&root) {
+            allowed = true;
+            break;
+        }
+    }
+
+    if !allowed {
+        return Err("project_dir is not within an authorized root".to_string());
+    }
+
+    Ok(canonical)
+}
+
+fn resolve_opencode_program(
+    app: &AppHandle,
+    prefer_sidecar: bool,
+    opencode_bin_path: Option<String>,
+) -> Result<PathBuf, String> {
+    if let Some(custom) = opencode_bin_path {
+        let trimmed = custom.trim();
+        if !trimmed.is_empty() {
+            return Ok(PathBuf::from(trimmed));
+        }
+    }
+
+    let resource_dir = app.path().resource_dir().ok();
+    let current_bin_dir = tauri::process::current_binary(&app.env())
+        .ok()
+        .and_then(|path| path.parent().map(|parent| parent.to_path_buf()));
+
+    let (program, _in_path, notes) = resolve_engine_path(
+        prefer_sidecar,
+        resource_dir.as_deref(),
+        current_bin_dir.as_deref(),
+    );
+
+    program.ok_or_else(|| {
+        let notes_text = notes.join("\n");
+        let install_command = pinned_opencode_install_command();
+        format!(
+            "OpenCode CLI not found.\n\nInstall with:\n- {install_command}\n\nNotes:\n{notes_text}"
+        )
+    })
+}
+
+#[tauri::command]
+pub fn reset_opencode_cache() -> Result<CacheResetResult, String> {
+    let candidates = opencode_cache_candidates();
+    let mut removed = Vec::new();
+    let mut missing = Vec::new();
+    let mut errors = Vec::new();
+
+    for path in candidates {
+        if path.exists() {
+            if let Err(err) = std::fs::remove_dir_all(&path) {
+                errors.push(format!("Failed to remove {}: {err}", path.display()));
+            } else {
+                removed.push(path.to_string_lossy().to_string());
+            }
+        } else {
+            missing.push(path.to_string_lossy().to_string());
+        }
+    }
+
+    Ok(CacheResetResult {
+        removed,
+        missing,
+        errors,
+    })
+}
+
+#[tauri::command]
+pub fn reset_openwork_state(
+    app: tauri::AppHandle,
+    mode: String,
+    engine_manager: State<EngineManager>,
+    orchestrator_manager: State<OrchestratorManager>,
+    openwork_manager: State<OpenworkServerManager>,
+) -> Result<(), String> {
+    let mode = mode.trim();
+    if mode != "onboarding" && mode != "all" {
+        return Err("mode must be 'onboarding' or 'all'".to_string());
+    }
+
+    stop_host_services(&engine_manager, &orchestrator_manager, &openwork_manager);
+
+    let mut paths = vec![
+        app.path()
+            .app_cache_dir()
+            .map_err(|e| format!("Failed to resolve app cache dir: {e}"))?,
+        app.path()
+            .app_config_dir()
+            .map_err(|e| format!("Failed to resolve app config dir: {e}"))?,
+        app.path()
+            .app_local_data_dir()
+            .map_err(|e| format!("Failed to resolve app local data dir: {e}"))?,
+    ];
+
+    if mode == "all" {
+        paths.push(
+            app.path()
+                .app_data_dir()
+                .map_err(|e| format!("Failed to resolve app data dir: {e}"))?,
+        );
+        paths.push(PathBuf::from(orchestrator::resolve_orchestrator_data_dir()));
+    }
+
+    let mut seen = HashSet::new();
+    for path in paths {
+        let key = path.to_string_lossy().to_string();
+        if seen.insert(key) {
+            remove_path_if_exists(&path)?;
+        }
+    }
+
+    Ok(())
+}
+
+#[tauri::command]
+pub fn app_build_info(app: AppHandle) -> AppBuildInfo {
+    let version = app.package_info().version.to_string();
+    let git_sha = option_env!("OPENWORK_GIT_SHA").map(|value| value.to_string());
+    let build_epoch = option_env!("OPENWORK_BUILD_EPOCH").map(|value| value.to_string());
+    AppBuildInfo {
+        version,
+        git_sha,
+        build_epoch,
+        openwork_dev_mode: env_truthy("OPENWORK_DEV_MODE"),
+        os: std::env::consts::OS,
+        arch: std::env::consts::ARCH,
+    }
+}
+
+#[tauri::command]
+pub fn nuke_openwork_and_opencode_config_and_exit(
+    app: AppHandle,
+    engine_manager: State<EngineManager>,
+    orchestrator_manager: State<OrchestratorManager>,
+    openwork_manager: State<OpenworkServerManager>,
+) -> Result<(), String> {
+    stop_host_services(&engine_manager, &orchestrator_manager, &openwork_manager);
+
+    let dev_mode = env_truthy("OPENWORK_DEV_MODE");
+    let mut paths = current_openwork_state_paths(&app)?;
+    if dev_mode {
+        // In dev mode, the current app + orchestrator directories are already isolated
+        // by the dev app identity and OPENWORK_DATA_DIR, so only clear those dev paths.
+    } else {
+        // In production, clear the normal app/orchestrator paths plus the standard
+        // user OpenCode config/data/cache/state locations.
+        paths.extend(opencode_standard_state_paths());
+    }
+
+    let mut seen = HashSet::new();
+    for path in paths {
+        let key = path.to_string_lossy().to_string();
+        if seen.insert(key) {
+            remove_path_if_exists(&path)?;
+        }
+    }
+
+    app.exit(0);
+    Ok(())
+}
+
+/// Run `opencode mcp auth <server_name>` in the given project directory.
+/// This spawns the process detached so the OAuth flow can open a browser.
+#[tauri::command]
+pub fn opencode_mcp_auth(
+    app: AppHandle,
+    project_dir: String,
+    server_name: String,
+) -> Result<ExecResult, String> {
+    let project_dir = validate_project_dir(&app, &project_dir)?;
+    let server_name = validate_server_name(&server_name)?;
+
+    let program = resolve_opencode_program(&app, true, None)?;
+
+    let mut command = command_for_program(&program);
+    for (key, value) in crate::bun_env::bun_env_overrides() {
+        command.env(key, value);
+    }
+
+    let output = command
+        .arg("mcp")
+        .arg("auth")
+        .arg(server_name)
+        .current_dir(&project_dir)
+        .output()
+        .map_err(|e| format!("Failed to run opencode mcp auth: {e}"))?;
+
+    let status = output.status.code().unwrap_or(-1);
+    Ok(ExecResult {
+        ok: output.status.success(),
+        status,
+        stdout: String::from_utf8_lossy(&output.stdout).to_string(),
+        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
+    })
+}
diff --git a/apps/desktop/src-tauri/src/commands/mod.rs b/apps/desktop/src-tauri/src/commands/mod.rs
new file mode 100644
index 0000000000..c0526447da
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/mod.rs
@@ -0,0 +1,12 @@
+pub mod command_files;
+pub mod config;
+pub mod desktop_bootstrap;
+pub mod engine;
+pub mod migration;
+pub mod misc;
+pub mod openwork_server;
+pub mod orchestrator;
+pub mod skills;
+pub mod updater;
+pub mod window;
+pub mod workspace;
diff --git a/apps/desktop/src-tauri/src/commands/openwork_server.rs b/apps/desktop/src-tauri/src/commands/openwork_server.rs
new file mode 100644
index 0000000000..502884379f
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/openwork_server.rs
@@ -0,0 +1,72 @@
+use tauri::{AppHandle, State};
+
+use crate::engine::manager::EngineManager;
+use crate::openwork_server::manager::OpenworkServerManager;
+use crate::openwork_server::start_openwork_server;
+use crate::types::{OpenworkServerInfo, WorkspaceType};
+use crate::workspace::state::load_workspace_state;
+
+#[tauri::command]
+pub fn openwork_server_info(manager: State<OpenworkServerManager>) -> OpenworkServerInfo {
+    let mut state = manager
+        .inner
+        .lock()
+        .expect("openwork server mutex poisoned");
+    OpenworkServerManager::snapshot_locked(&mut state)
+}
+
+#[tauri::command]
+pub fn openwork_server_restart(
+    app: AppHandle,
+    manager: State<OpenworkServerManager>,
+    engine_manager: State<EngineManager>,
+    remote_access_enabled: Option<bool>,
+) -> Result<OpenworkServerInfo, String> {
+    let (workspace_paths, opencode_url, opencode_username, opencode_password) = {
+        let engine = engine_manager
+            .inner
+            .lock()
+            .map_err(|_| "engine mutex poisoned".to_string())?;
+        let mut workspace_paths = Vec::new();
+        if let Some(project_dir) = engine.project_dir.clone() {
+            let trimmed = project_dir.trim().to_string();
+            if !trimmed.is_empty() {
+                workspace_paths.push(trimmed);
+            }
+        }
+        (
+            workspace_paths,
+            engine.base_url.clone(),
+            engine.opencode_username.clone(),
+            engine.opencode_password.clone(),
+        )
+    };
+
+    let mut workspace_paths = workspace_paths;
+    if workspace_paths.is_empty() {
+        let state = load_workspace_state(&app)?;
+        for workspace in state.workspaces {
+            if workspace.workspace_type != WorkspaceType::Local {
+                continue;
+            }
+            let trimmed = workspace.path.trim().to_string();
+            if trimmed.is_empty() || workspace_paths.iter().any(|path| path == &trimmed) {
+                continue;
+            }
+            workspace_paths.push(trimmed);
+        }
+    }
+
+    start_openwork_server(
+        &app,
+        &manager,
+        &workspace_paths,
+        opencode_url.as_deref(),
+        opencode_username.as_deref(),
+        opencode_password.as_deref(),
+        remote_access_enabled.unwrap_or(false),
+        false,
+        None,
+        None,
+    )
+}
diff --git a/apps/desktop/src-tauri/src/commands/orchestrator.rs b/apps/desktop/src-tauri/src/commands/orchestrator.rs
new file mode 100644
index 0000000000..753293a47e
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/orchestrator.rs
@@ -0,0 +1,1630 @@
+use serde::Serialize;
+use serde_json::{json, Value};
+use std::collections::HashSet;
+use std::env;
+use std::io::Read;
+use std::net::TcpListener;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::sync::mpsc::{self, RecvTimeoutError};
+use std::time::{Duration, Instant};
+use std::time::{SystemTime, UNIX_EPOCH};
+use tauri::AppHandle;
+use tauri::Emitter;
+use tauri_plugin_shell::ShellExt;
+use uuid::Uuid;
+
+use crate::platform::configure_hidden;
+use crate::types::ExecResult;
+
+const SANDBOX_PROGRESS_EVENT: &str = "openwork://sandbox-create-progress";
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrchestratorDetachedHost {
+    pub openwork_url: String,
+    pub token: String,
+    pub owner_token: Option<String>,
+    pub host_token: String,
+    pub port: u16,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sandbox_backend: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sandbox_run_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sandbox_container_name: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxDoctorResult {
+    pub installed: bool,
+    pub daemon_running: bool,
+    pub permission_ok: bool,
+    pub ready: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub client_version: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub server_version: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub debug: Option<SandboxDoctorDebug>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxDoctorDebug {
+    pub candidates: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub selected_bin: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub version_command: Option<SandboxDoctorCommandDebug>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub info_command: Option<SandboxDoctorCommandDebug>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxDoctorCommandDebug {
+    pub status: i32,
+    pub stdout: String,
+    pub stderr: String,
+}
+
+struct DockerCommandResult {
+    status: i32,
+    stdout: String,
+    stderr: String,
+    program: String,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OpenworkDockerCleanupResult {
+    pub candidates: Vec<String>,
+    pub removed: Vec<String>,
+    pub errors: Vec<String>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxDebugProbeCleanup {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub container_name: Option<String>,
+    pub container_removed: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub remove_result: Option<SandboxDoctorCommandDebug>,
+    pub workspace_removed: bool,
+    pub errors: Vec<String>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxDebugProbeResult {
+    pub started_at: u64,
+    pub finished_at: u64,
+    pub run_id: String,
+    pub workspace_path: String,
+    pub ready: bool,
+    pub doctor: SandboxDoctorResult,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub detached_host: Option<OrchestratorDetachedHost>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub docker_inspect: Option<SandboxDoctorCommandDebug>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub docker_logs: Option<SandboxDoctorCommandDebug>,
+    pub cleanup: SandboxDebugProbeCleanup,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+fn run_local_command(program: &str, args: &[&str]) -> Result<(i32, String, String), String> {
+    let mut command = Command::new(program);
+    configure_hidden(&mut command);
+    let output = command
+        .args(args)
+        .output()
+        .map_err(|e| format!("Failed to run {program}: {e}"))?;
+    let status = output.status.code().unwrap_or(-1);
+    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
+    Ok((status, stdout, stderr))
+}
+
+/// Maximum time to wait for pipe reader threads to complete after child termination.
+/// This bounds the join operation to prevent indefinite blocking.
+const READER_JOIN_TIMEOUT_MS: u64 = 2000;
+
+fn recv_pipe_bytes(label: &str, rx: &mpsc::Receiver<Vec<u8>>, deadline: Instant) -> Vec<u8> {
+    let remaining = deadline.saturating_duration_since(Instant::now());
+    match rx.recv_timeout(remaining) {
+        Ok(bytes) => bytes,
+        Err(RecvTimeoutError::Timeout) => {
+            eprintln!(
+                "[timeout-helper] {label} reader timed out after {}ms",
+                remaining.as_millis()
+            );
+            Vec::new()
+        }
+        Err(RecvTimeoutError::Disconnected) => {
+            eprintln!("[timeout-helper] {label} reader disconnected");
+            Vec::new()
+        }
+    }
+}
+
+fn run_local_command_with_timeout(
+    program: &str,
+    args: &[&str],
+    timeout: Duration,
+) -> Result<(i32, String, String), String> {
+    let mut command = Command::new(program);
+    configure_hidden(&mut command);
+    let mut child = command
+        .args(args)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|e| format!("Failed to run {program}: {e}"))?;
+
+    let mut stdout_pipe = child.stdout.take();
+    let mut stderr_pipe = child.stderr.take();
+
+    // Use channels to collect output with bounded wait on join.
+    // This prevents indefinite blocking if pipe readers don't complete.
+    let (stdout_tx, stdout_rx) = mpsc::channel();
+    let (stderr_tx, stderr_rx) = mpsc::channel();
+
+    let stdout_handle = std::thread::spawn(move || {
+        let mut buf = Vec::new();
+        if let Some(mut reader) = stdout_pipe.take() {
+            let _ = reader.read_to_end(&mut buf);
+        }
+        let _ = stdout_tx.send(buf);
+    });
+
+    let stderr_handle = std::thread::spawn(move || {
+        let mut buf = Vec::new();
+        if let Some(mut reader) = stderr_pipe.take() {
+            let _ = reader.read_to_end(&mut buf);
+        }
+        let _ = stderr_tx.send(buf);
+    });
+
+    let poll = Duration::from_millis(25);
+    let start = Instant::now();
+    let mut timed_out = false;
+    let mut exit_status: Option<std::process::ExitStatus> = None;
+    let join_timeout = Duration::from_millis(READER_JOIN_TIMEOUT_MS);
+
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                exit_status = Some(status);
+                break;
+            }
+            Ok(None) => {
+                if start.elapsed() >= timeout {
+                    timed_out = true;
+                    eprintln!(
+                        "[timeout-helper] Killing {program} after {}ms timeout",
+                        timeout.as_millis()
+                    );
+                    let _ = child.kill();
+                    let _ = child.wait();
+                    break;
+                }
+                std::thread::sleep(poll);
+            }
+            Err(err) => {
+                eprintln!("[timeout-helper] Error waiting for {program}: {err}");
+                let _ = child.kill();
+                let _ = child.wait();
+                let join_deadline = Instant::now() + join_timeout;
+                let stdout_bytes = recv_pipe_bytes("stdout", &stdout_rx, join_deadline);
+                let stderr_bytes = recv_pipe_bytes("stderr", &stderr_rx, join_deadline);
+                let stdout = String::from_utf8_lossy(&stdout_bytes).to_string();
+                let stderr = String::from_utf8_lossy(&stderr_bytes).to_string();
+                return Err(format!(
+                    "Failed to wait for {program}: {err} (stdout: {}, stderr: {})",
+                    stdout.trim(),
+                    stderr.trim()
+                ));
+            }
+        }
+    }
+
+    // Wait for reader threads with bounded timeout.
+    // This prevents indefinite blocking in edge cases where pipe readers stall.
+    let join_deadline = Instant::now() + join_timeout;
+    let stdout_bytes = recv_pipe_bytes("stdout", &stdout_rx, join_deadline);
+    let stderr_bytes = recv_pipe_bytes("stderr", &stderr_rx, join_deadline);
+
+    // Detach the thread handles (they will finish or be leaked, but won't block us)
+    drop(stdout_handle);
+    drop(stderr_handle);
+
+    let stdout = String::from_utf8_lossy(&stdout_bytes).to_string();
+    let stderr = String::from_utf8_lossy(&stderr_bytes).to_string();
+
+    if timed_out {
+        let arg_list = args.join(" ");
+        eprintln!(
+            "[timeout-helper] Command timed out: {program} {arg_list} (stdout: {} bytes, stderr: {} bytes)",
+            stdout.len(),
+            stderr.len()
+        );
+        return Err(format!(
+            "Timed out after {}ms running {program} {arg_list}",
+            timeout.as_millis()
+        ));
+    }
+
+    let status = exit_status.and_then(|s| s.code()).unwrap_or(-1);
+    Ok((status, stdout, stderr))
+}
+
+fn is_executable_file(path: &Path) -> bool {
+    if !path.is_file() {
+        return false;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        if let Ok(meta) = std::fs::metadata(path) {
+            let mode = meta.permissions().mode();
+            return (mode & 0o111) != 0;
+        }
+    }
+    true
+}
+
+fn parse_path_export_value(output: &str) -> Option<String> {
+    // `path_helper -s` prints shell exports, e.g.:
+    //   PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"; export PATH;
+    for line in output.lines() {
+        let trimmed = line.trim();
+        if !trimmed.starts_with("PATH=") {
+            continue;
+        }
+        let after = trimmed.strip_prefix("PATH=")?;
+        let after = after.trim();
+        // Strip leading quote (single or double)
+        let quote = after.chars().next()?;
+        if quote != '"' && quote != '\'' {
+            continue;
+        }
+        let mut value = after[1..].to_string();
+        if let Some(end) = value.find(quote) {
+            value.truncate(end);
+            return Some(value);
+        }
+    }
+    None
+}
+
+fn resolve_docker_candidates() -> Vec<PathBuf> {
+    let mut out: Vec<PathBuf> = Vec::new();
+    let mut seen: HashSet<PathBuf> = HashSet::new();
+
+    // 1) Explicit override (most reliable in odd environments)
+    for key in ["OPENWORK_DOCKER_BIN", "OPENWRK_DOCKER_BIN", "DOCKER_BIN"] {
+        if let Some(value) = env::var_os(key) {
+            let raw = value.to_string_lossy().trim().to_string();
+            if !raw.is_empty() {
+                let path = PathBuf::from(raw);
+                if seen.insert(path.clone()) {
+                    out.push(path);
+                }
+            }
+        }
+    }
+
+    // 2) PATH from current process
+    if let Some(paths) = env::var_os("PATH") {
+        for dir in env::split_paths(&paths) {
+            let candidate = dir.join("docker");
+            if seen.insert(candidate.clone()) {
+                out.push(candidate);
+            }
+        }
+    }
+
+    // 3) macOS default login PATH via path_helper
+    if cfg!(target_os = "macos") {
+        if let Ok((status, stdout, _stderr)) =
+            run_local_command("/usr/libexec/path_helper", &["-s"])
+        {
+            if status == 0 {
+                if let Some(path_value) = parse_path_export_value(&stdout) {
+                    for dir in env::split_paths(&path_value) {
+                        let candidate = dir.join("docker");
+                        if seen.insert(candidate.clone()) {
+                            out.push(candidate);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    // 4) Well-known locations (Homebrew + Docker Desktop)
+    for raw in [
+        "/opt/homebrew/bin/docker",
+        "/usr/local/bin/docker",
+        "/Applications/Docker.app/Contents/Resources/bin/docker",
+    ] {
+        let path = PathBuf::from(raw);
+        if seen.insert(path.clone()) {
+            out.push(path);
+        }
+    }
+
+    // Keep only plausible executable files.
+    out.into_iter()
+        .filter(|path| is_executable_file(path))
+        .collect()
+}
+
+fn run_docker_command(args: &[&str], timeout: Duration) -> Result<(i32, String, String), String> {
+    let result = run_docker_command_detailed(args, timeout)?;
+    Ok((result.status, result.stdout, result.stderr))
+}
+
+fn run_docker_command_detailed(
+    args: &[&str],
+    timeout: Duration,
+) -> Result<DockerCommandResult, String> {
+    // On macOS, GUI apps may not inherit the user's shell PATH (e.g. missing /opt/homebrew/bin).
+    // We resolve candidates conservatively and prefer an explicit override when provided.
+    let candidates = resolve_docker_candidates();
+
+    // As a final fallback, try invoking `docker` by name (in case the OS resolves it differently).
+    // This keeps behavior consistent with CLI environments.
+    let mut tried: Vec<String> = candidates
+        .iter()
+        .map(|p| p.to_string_lossy().to_string())
+        .collect();
+    tried.push("docker".to_string());
+
+    let mut errors: Vec<String> = Vec::new();
+    for program in tried {
+        match run_local_command_with_timeout(&program, args, timeout) {
+            Ok((status, stdout, stderr)) => {
+                return Ok(DockerCommandResult {
+                    status,
+                    stdout,
+                    stderr,
+                    program,
+                })
+            }
+            Err(err) => errors.push(err),
+        }
+    }
+
+    let hint = "Set OPENWORK_DOCKER_BIN (or OPENWRK_DOCKER_BIN) to your docker binary, e.g. /opt/homebrew/bin/docker";
+    Err(format!(
+        "Failed to run docker: {} ({})",
+        errors.join("; "),
+        hint
+    ))
+}
+
+fn parse_docker_client_version(stdout: &str) -> Option<String> {
+    // Example: "Docker version 26.1.1, build 4cf5afa"
+    let line = stdout.lines().next().unwrap_or("").trim();
+    if !line.to_lowercase().starts_with("docker version") {
+        return None;
+    }
+    Some(line.to_string())
+}
+
+fn parse_docker_server_version(stdout: &str) -> Option<String> {
+    // Example line in `docker info` output: " Server Version: 26.1.1"
+    for line in stdout.lines() {
+        let trimmed = line.trim();
+        if let Some(rest) = trimmed.strip_prefix("Server Version:") {
+            let value = rest.trim();
+            if !value.is_empty() {
+                return Some(value.to_string());
+            }
+        }
+    }
+    None
+}
+
+fn truncate_for_debug(input: &str) -> String {
+    const MAX_LEN: usize = 1200;
+    let trimmed = input.trim();
+    if trimmed.len() <= MAX_LEN {
+        return trimmed.to_string();
+    }
+    format!("{}...[truncated]", &trimmed[..MAX_LEN])
+}
+
+fn truncate_for_report(input: &str) -> String {
+    const MAX_LEN: usize = 48_000;
+    let trimmed = input.trim();
+    if trimmed.len() <= MAX_LEN {
+        return trimmed.to_string();
+    }
+    format!("{}...[truncated]", &trimmed[..MAX_LEN])
+}
+
+fn is_sensitive_progress_key(key: &str) -> bool {
+    let normalized = key.trim().to_ascii_lowercase();
+    matches!(
+        normalized.as_str(),
+        "token"
+            | "hosttoken"
+            | "ownertoken"
+            | "collaboratortoken"
+            | "password"
+            | "opencodepassword"
+            | "opencodeusername"
+            | "authorization"
+    ) || ((key.starts_with("OPENWORK_") || key.starts_with("OPENCODE_") || key.starts_with("DEN_"))
+        && (key.contains("TOKEN") || key.contains("PASSWORD") || key.contains("USERNAME")))
+}
+
+fn redact_progress_value(value: serde_json::Value, key: Option<&str>) -> serde_json::Value {
+    if let Some(key) = key {
+        if is_sensitive_progress_key(key) {
+            return serde_json::Value::String("[REDACTED]".to_string());
+        }
+    }
+
+    match value {
+        serde_json::Value::Object(map) => serde_json::Value::Object(
+            map.into_iter()
+                .map(|(entry_key, entry_value)| {
+                    let redacted = redact_progress_value(entry_value, Some(&entry_key));
+                    (entry_key, redacted)
+                })
+                .collect(),
+        ),
+        serde_json::Value::Array(items) => serde_json::Value::Array(
+            items
+                .into_iter()
+                .map(|item| redact_progress_value(item, key))
+                .collect(),
+        ),
+        serde_json::Value::String(text) => serde_json::Value::String(text),
+        other => other,
+    }
+}
+
+fn to_command_debug(result: DockerCommandResult) -> SandboxDoctorCommandDebug {
+    SandboxDoctorCommandDebug {
+        status: result.status,
+        stdout: truncate_for_report(&result.stdout),
+        stderr: truncate_for_report(&result.stderr),
+    }
+}
+
+fn derive_orchestrator_container_name(run_id: &str) -> String {
+    // Must match openwork-orchestrator's docker naming scheme:
+    // `openwork-orchestrator-${runId.replace(/[^a-zA-Z0-9_.-]+/g, "-").slice(0, 24)}`
+    let mut sanitized = String::new();
+    for ch in run_id.chars() {
+        let ok = ch.is_ascii_alphanumeric() || ch == '_' || ch == '.' || ch == '-';
+        sanitized.push(if ok { ch } else { '-' });
+    }
+    if sanitized.len() > 24 {
+        sanitized.truncate(24);
+    }
+    format!("openwork-orchestrator-{sanitized}")
+}
+
+fn is_openwork_managed_container(name: &str) -> bool {
+    name.starts_with("openwork-orchestrator-")
+        || name.starts_with("openwork-dev-")
+        || name.starts_with("openwrk-")
+}
+
+fn list_openwork_managed_containers() -> Result<Vec<String>, String> {
+    let (status, stdout, stderr) = run_docker_command(
+        &["ps", "-a", "--format", "{{.Names}}"],
+        Duration::from_secs(8),
+    )?;
+    if status != 0 {
+        let combined = format!("{}\n{}", stdout.trim(), stderr.trim())
+            .trim()
+            .to_string();
+        let detail = if combined.is_empty() {
+            format!("docker ps -a failed (status {status})")
+        } else {
+            format!("docker ps -a failed (status {status}): {combined}")
+        };
+        return Err(detail);
+    }
+
+    let mut names: Vec<String> = stdout
+        .lines()
+        .map(|line| line.trim().to_string())
+        .filter(|name| !name.is_empty() && is_openwork_managed_container(name))
+        .collect();
+    names.sort();
+    names.dedup();
+    Ok(names)
+}
+
+fn allocate_free_port() -> Result<u16, String> {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .map_err(|e| format!("Failed to allocate free port: {e}"))?;
+    let port = listener
+        .local_addr()
+        .map_err(|e| format!("Failed to read allocated port: {e}"))?
+        .port();
+    Ok(port)
+}
+
+fn now_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+fn emit_sandbox_progress(
+    app: &AppHandle,
+    run_id: &str,
+    stage: &str,
+    message: &str,
+    payload: serde_json::Value,
+) {
+    let payload = redact_progress_value(payload, None);
+    let at = now_ms();
+    let elapsed = payload
+        .get("elapsedMs")
+        .and_then(|value| value.as_u64())
+        .map(|value| format!("{value}ms"))
+        .unwrap_or_else(|| "n/a".to_string());
+    let payload_brief = truncate_for_debug(&payload.to_string());
+    eprintln!(
+        "[sandbox-create][at={at}][runId={run_id}][stage={stage}][elapsed={elapsed}] {message} payload={payload_brief}"
+    );
+    let event_payload = json!({
+        "runId": run_id,
+        "stage": stage,
+        "message": message,
+        "at": at,
+        "payload": payload,
+    });
+    let _ = app.emit(SANDBOX_PROGRESS_EVENT, event_payload);
+}
+
+fn docker_container_state(container_name: &str) -> Result<Option<String>, String> {
+    let result = match run_docker_command_detailed(
+        &["inspect", "-f", "{{.State.Status}}", container_name],
+        Duration::from_secs(2),
+    ) {
+        Ok(result) => result,
+        Err(err) => {
+            return Err(format!("docker inspect failed: {err}"));
+        }
+    };
+    let status = result.status;
+    let stdout = result.stdout;
+    let stderr = result.stderr;
+    if status == 0 {
+        let trimmed = stdout.trim().to_string();
+        return Ok(if trimmed.is_empty() {
+            None
+        } else {
+            Some(trimmed)
+        });
+    }
+
+    let combined = format!("{}\n{}", stdout.trim(), stderr.trim()).to_lowercase();
+    if combined.contains("no such object")
+        || combined.contains("not found")
+        || combined.contains("does not exist")
+    {
+        return Ok(None);
+    }
+
+    // If docker returned something unexpected, don't block progress reporting.
+    Err(format!(
+        "docker inspect {} returned status {} (stderr: {})",
+        result.program,
+        status,
+        truncate_for_debug(&stderr)
+    ))
+}
+
+fn format_sandbox_start_timeout_error(
+    elapsed_ms: u64,
+    openwork_url: &str,
+    last_error: Option<&str>,
+    container_state: Option<&str>,
+    container_probe_error: Option<&str>,
+) -> String {
+    let mut details = vec![
+        format!("stage=openwork.healthcheck"),
+        format!("elapsed_ms={elapsed_ms}"),
+        format!("url={openwork_url}"),
+        format!("last_error={}", last_error.unwrap_or("none")),
+        format!("container_state={}", container_state.unwrap_or("unknown")),
+    ];
+
+    if let Some(probe_error) = container_probe_error {
+        details.push(format!("container_probe_error={probe_error}"));
+    }
+
+    format!(
+        "Timed out waiting for OpenWork server ({})",
+        details.join(", ")
+    )
+}
+
+fn issue_owner_token(openwork_url: &str, host_token: &str) -> Result<String, String> {
+    let response = ureq::post(&format!("{}/tokens", openwork_url.trim_end_matches('/')))
+        .set("X-OpenWork-Host-Token", host_token)
+        .set("Content-Type", "application/json")
+        .send_string(r#"{"scope":"owner","label":"OpenWork detached owner token"}"#)
+        .map_err(|err| err.to_string())?;
+
+    let payload: Value = response
+        .into_json()
+        .map_err(|err| format!("Failed to parse owner token response: {err}"))?;
+
+    payload
+        .get("token")
+        .and_then(|value| value.as_str())
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| "OpenWork server did not return an owner token".to_string())
+}
+
+#[tauri::command]
+pub fn orchestrator_start_detached(
+    app: AppHandle,
+    workspace_path: String,
+    sandbox_backend: Option<String>,
+    sandbox_image_ref: Option<String>,
+    run_id: Option<String>,
+    openwork_token: Option<String>,
+    openwork_host_token: Option<String>,
+) -> Result<OrchestratorDetachedHost, String> {
+    let start_ts = now_ms();
+    let workspace_path = workspace_path.trim().to_string();
+    if workspace_path.is_empty() {
+        return Err("workspacePath is required".to_string());
+    }
+
+    let sandbox_backend = sandbox_backend
+        .unwrap_or_else(|| "none".to_string())
+        .trim()
+        .to_lowercase();
+    if sandbox_backend != "none" && sandbox_backend != "docker" && sandbox_backend != "microsandbox"
+    {
+        return Err("sandboxBackend must be one of: none, docker, microsandbox".to_string());
+    }
+    let wants_docker_sandbox = sandbox_backend == "docker" || sandbox_backend == "microsandbox";
+    let wants_microsandbox = sandbox_backend == "microsandbox";
+    let sandbox_image_ref = sandbox_image_ref
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+    let sandbox_run_id = run_id
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| Uuid::new_v4().to_string());
+    let sandbox_container_name = if wants_docker_sandbox {
+        Some(derive_orchestrator_container_name(&sandbox_run_id))
+    } else {
+        None
+    };
+    eprintln!(
+        "[sandbox-create][at={start_ts}][runId={}][stage=entry] workspacePath={} sandboxBackend={} container={}",
+        sandbox_run_id,
+        workspace_path,
+        if wants_microsandbox {
+            "microsandbox"
+        } else if wants_docker_sandbox {
+            "docker"
+        } else {
+            "none"
+        },
+        sandbox_container_name.as_deref().unwrap_or("<none>")
+    );
+
+    let port = allocate_free_port()?;
+    let token = openwork_token
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| Uuid::new_v4().to_string());
+    let host_token = openwork_host_token
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| Uuid::new_v4().to_string());
+    let openwork_url = format!("http://127.0.0.1:{port}");
+
+    emit_sandbox_progress(
+        &app,
+        &sandbox_run_id,
+        "init",
+        "Starting sandbox...",
+        json!({
+            "workspacePath": workspace_path,
+            "openworkUrl": openwork_url,
+            "port": port,
+            "sandboxBackend": if wants_microsandbox {
+                "microsandbox"
+            } else if wants_docker_sandbox {
+                "docker"
+            } else {
+                "none"
+            },
+            "sandboxImageRef": sandbox_image_ref.clone(),
+            "containerName": sandbox_container_name,
+        }),
+    );
+
+    if wants_docker_sandbox {
+        let candidates = resolve_docker_candidates()
+            .into_iter()
+            .map(|p| p.to_string_lossy().to_string())
+            .collect::<Vec<_>>();
+        let resolved = candidates.first().cloned();
+        emit_sandbox_progress(
+            &app,
+            &sandbox_run_id,
+            "docker.config",
+            "Inspecting Docker configuration...",
+            json!({
+                "candidateCount": candidates.len(),
+                "resolvedDockerBin": resolved,
+                "hasOpenworkDockerBinOverride": env::var("OPENWORK_DOCKER_BIN").ok().is_some(),
+                "hasOpenwrkDockerBinOverride": env::var("OPENWRK_DOCKER_BIN").ok().is_some(),
+                "hasDockerBinOverride": env::var("DOCKER_BIN").ok().is_some(),
+            }),
+        );
+    }
+
+    let (command, command_label) = match app.shell().sidecar("openwork-orchestrator") {
+        Ok(command) => (command, "sidecar:openwork-orchestrator".to_string()),
+        Err(_) => (app.shell().command("openwork"), "path:openwork".to_string()),
+    };
+
+    // Start a dedicated host stack for this workspace.
+    // We pass explicit tokens and a free port so the UI can connect deterministically.
+    {
+        let mut args: Vec<String> = vec![
+            "start".to_string(),
+            "--workspace".to_string(),
+            workspace_path.clone(),
+            "--approval".to_string(),
+            "auto".to_string(),
+            "--detach".to_string(),
+            "--openwork-port".to_string(),
+            port.to_string(),
+            "--run-id".to_string(),
+            sandbox_run_id.clone(),
+        ];
+
+        if wants_docker_sandbox {
+            args.push("--sandbox".to_string());
+            args.push("docker".to_string());
+            if let Some(image_ref) = sandbox_image_ref.as_deref() {
+                args.push("--sandbox-image".to_string());
+                args.push(image_ref.to_string());
+            }
+        }
+
+        // Convert to &str for the shell command builder.
+        let mut str_args: Vec<&str> = Vec::with_capacity(args.len());
+        for arg in &args {
+            str_args.push(arg.as_str());
+        }
+
+        emit_sandbox_progress(
+            &app,
+            &sandbox_run_id,
+            "spawn.config",
+            "Launching sandbox host...",
+            json!({
+                "command": command_label,
+                "workspacePath": workspace_path,
+                "openworkUrl": openwork_url,
+                "argCount": args.len(),
+                "hasDockerOverrides": env::var("OPENWORK_DOCKER_BIN").ok().is_some()
+                    || env::var("OPENWRK_DOCKER_BIN").ok().is_some()
+                    || env::var("DOCKER_BIN").ok().is_some(),
+            }),
+        );
+
+        let mut command = command.args(str_args);
+        for (key, value) in crate::env_file::load_user_env_file() {
+            command = command.env(key, value);
+        }
+        if let Err(err) = command
+            .env("OPENWORK_TOKEN", token.clone())
+            .env("OPENWORK_HOST_TOKEN", host_token.clone())
+            .spawn()
+        {
+            emit_sandbox_progress(
+                &app,
+                &sandbox_run_id,
+                "spawn.error",
+                "Failed to launch sandbox host.",
+                json!({
+                    "error": err.to_string(),
+                    "command": command_label,
+                }),
+            );
+            return Err(format!("Failed to start openwork orchestrator: {err}"));
+        }
+        eprintln!(
+            "[sandbox-create][at={}][runId={}][stage=spawn] launched openwork sidecar for detached sandbox host",
+            now_ms(),
+            sandbox_run_id
+        );
+    }
+
+    emit_sandbox_progress(
+        &app,
+        &sandbox_run_id,
+        "spawned",
+        "Sandbox process launched. Waiting for OpenWork server...",
+        json!({
+            "openworkUrl": openwork_url,
+        }),
+    );
+
+    let health_timeout_ms = if wants_docker_sandbox { 90_000 } else { 12_000 };
+    let start = Instant::now();
+    let mut last_tick = Instant::now() - Duration::from_secs(5);
+    let mut last_container_check = Instant::now() - Duration::from_secs(10);
+    let mut last_container_state: Option<String> = None;
+    let mut last_container_probe_error: Option<String> = None;
+    let mut last_error: Option<String> = None;
+
+    while start.elapsed() < Duration::from_millis(health_timeout_ms) {
+        let elapsed_ms = start.elapsed().as_millis() as u64;
+
+        if wants_docker_sandbox {
+            if last_container_check.elapsed() > Duration::from_millis(1500) {
+                last_container_check = Instant::now();
+                if let Some(name) = sandbox_container_name.as_deref() {
+                    match docker_container_state(name) {
+                        Ok(state) => {
+                            if state != last_container_state {
+                                last_container_state = state.clone();
+                                let label =
+                                    state.clone().unwrap_or_else(|| "not-created".to_string());
+                                emit_sandbox_progress(
+                                    &app,
+                                    &sandbox_run_id,
+                                    "docker.container",
+                                    &format!("Sandbox container: {label}"),
+                                    json!({
+                                        "containerName": name,
+                                        "containerState": state,
+                                        "elapsedMs": elapsed_ms,
+                                    }),
+                                );
+                            }
+                            if last_container_probe_error.is_some() {
+                                last_container_probe_error = None;
+                            }
+                        }
+                        Err(err) => {
+                            if last_container_probe_error.as_deref() != Some(err.as_str()) {
+                                last_container_probe_error = Some(err.clone());
+                                emit_sandbox_progress(
+                                    &app,
+                                    &sandbox_run_id,
+                                    "docker.inspect",
+                                    "Docker inspect returned an error while probing sandbox container.",
+                                    json!({
+                                        "containerName": name,
+                                        "error": err,
+                                        "elapsedMs": elapsed_ms,
+                                    }),
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        match ureq::get(&format!("{}/health", openwork_url.trim_end_matches('/'))).call() {
+            Ok(response) if response.status() >= 200 && response.status() < 300 => {
+                emit_sandbox_progress(
+                    &app,
+                    &sandbox_run_id,
+                    "openwork.healthy",
+                    "OpenWork server is ready.",
+                    json!({
+                        "openworkUrl": openwork_url,
+                        "elapsedMs": elapsed_ms,
+                        "containerState": last_container_state,
+                    }),
+                );
+                last_error = None;
+                break;
+            }
+            Ok(response) => {
+                last_error = Some(format!("HTTP {}", response.status()));
+            }
+            Err(err) => {
+                last_error = Some(err.to_string());
+            }
+        }
+
+        if last_tick.elapsed() > Duration::from_millis(850) {
+            last_tick = Instant::now();
+            emit_sandbox_progress(
+                &app,
+                &sandbox_run_id,
+                "openwork.waiting",
+                "Waiting for OpenWork server...",
+                json!({
+                    "openworkUrl": openwork_url,
+                    "elapsedMs": elapsed_ms,
+                    "lastError": last_error,
+                    "containerState": last_container_state,
+                    "containerProbeError": last_container_probe_error,
+                }),
+            );
+        }
+
+        std::thread::sleep(Duration::from_millis(200));
+    }
+
+    if start.elapsed() >= Duration::from_millis(health_timeout_ms) {
+        let elapsed_ms = start.elapsed().as_millis() as u64;
+        let message = format_sandbox_start_timeout_error(
+            elapsed_ms,
+            &openwork_url,
+            last_error.as_deref(),
+            last_container_state.as_deref(),
+            last_container_probe_error.as_deref(),
+        );
+        emit_sandbox_progress(
+            &app,
+            &sandbox_run_id,
+            "error",
+            "Sandbox failed to start.",
+            json!({
+                "error": message,
+                "elapsedMs": elapsed_ms,
+                "openworkUrl": openwork_url,
+                "containerState": last_container_state,
+                "containerProbeError": last_container_probe_error,
+            }),
+        );
+        eprintln!(
+            "[sandbox-create][at={}][runId={}][stage=timeout] health wait timed out after {}ms error={}",
+            now_ms(),
+            sandbox_run_id,
+            elapsed_ms,
+            message
+        );
+        return Err(message);
+    }
+
+    eprintln!(
+        "[sandbox-create][at={}][runId={}][stage=complete] detached sandbox host ready in {}ms url={}",
+        now_ms(),
+        sandbox_run_id,
+        start.elapsed().as_millis(),
+        openwork_url
+    );
+
+    let owner_token = issue_owner_token(&openwork_url, &host_token).ok();
+
+    Ok(OrchestratorDetachedHost {
+        openwork_url,
+        token,
+        owner_token,
+        host_token,
+        port,
+        sandbox_backend: if wants_docker_sandbox {
+            Some(if wants_microsandbox {
+                "microsandbox".to_string()
+            } else {
+                "docker".to_string()
+            })
+        } else {
+            None
+        },
+        sandbox_run_id: if wants_docker_sandbox {
+            Some(sandbox_run_id)
+        } else {
+            None
+        },
+        sandbox_container_name,
+    })
+}
+
+#[tauri::command]
+pub fn sandbox_doctor() -> SandboxDoctorResult {
+    let doctor_start = Instant::now();
+    eprintln!("[sandbox-doctor][at={}] start", now_ms());
+    let candidates = resolve_docker_candidates()
+        .into_iter()
+        .map(|p| p.to_string_lossy().to_string())
+        .collect::<Vec<_>>();
+    let mut debug = SandboxDoctorDebug {
+        candidates,
+        selected_bin: None,
+        version_command: None,
+        info_command: None,
+    };
+
+    let version = match run_docker_command_detailed(&["--version"], Duration::from_secs(2)) {
+        Ok(result) => result,
+        Err(err) => {
+            eprintln!(
+                "[sandbox-doctor][at={}][elapsed={}ms] docker --version failed: {}",
+                now_ms(),
+                doctor_start.elapsed().as_millis(),
+                err
+            );
+            return SandboxDoctorResult {
+                installed: false,
+                daemon_running: false,
+                permission_ok: false,
+                ready: false,
+                client_version: None,
+                server_version: None,
+                error: Some(err),
+                debug: Some(debug),
+            };
+        }
+    };
+
+    debug.selected_bin = Some(version.program.clone());
+    eprintln!(
+        "[sandbox-doctor][at={}][elapsed={}ms] docker --version via {} status={}",
+        now_ms(),
+        doctor_start.elapsed().as_millis(),
+        version.program,
+        version.status
+    );
+    debug.version_command = Some(SandboxDoctorCommandDebug {
+        status: version.status,
+        stdout: truncate_for_debug(&version.stdout),
+        stderr: truncate_for_debug(&version.stderr),
+    });
+
+    let status = version.status;
+    let stdout = version.stdout;
+    let stderr = version.stderr;
+
+    if status != 0 {
+        eprintln!(
+            "[sandbox-doctor][at={}][elapsed={}ms] docker --version non-zero status={} stderr={}",
+            now_ms(),
+            doctor_start.elapsed().as_millis(),
+            status,
+            truncate_for_debug(&stderr)
+        );
+        return SandboxDoctorResult {
+            installed: false,
+            daemon_running: false,
+            permission_ok: false,
+            ready: false,
+            client_version: None,
+            server_version: None,
+            error: Some(format!(
+                "docker --version failed (status {status}): {}",
+                stderr.trim()
+            )),
+            debug: Some(debug),
+        };
+    }
+
+    let client_version = parse_docker_client_version(&stdout);
+
+    // `docker info` is a good readiness check (installed + daemon reachable + perms).
+    let info = match run_docker_command_detailed(&["info"], Duration::from_secs(8)) {
+        Ok(result) => result,
+        Err(err) => {
+            eprintln!(
+                "[sandbox-doctor][at={}][elapsed={}ms] docker info failed: {}",
+                now_ms(),
+                doctor_start.elapsed().as_millis(),
+                err
+            );
+            return SandboxDoctorResult {
+                installed: true,
+                daemon_running: false,
+                permission_ok: false,
+                ready: false,
+                client_version,
+                server_version: None,
+                error: Some(err),
+                debug: Some(debug),
+            };
+        }
+    };
+
+    debug.info_command = Some(SandboxDoctorCommandDebug {
+        status: info.status,
+        stdout: truncate_for_debug(&info.stdout),
+        stderr: truncate_for_debug(&info.stderr),
+    });
+    eprintln!(
+        "[sandbox-doctor][at={}][elapsed={}ms] docker info status={}",
+        now_ms(),
+        doctor_start.elapsed().as_millis(),
+        info.status
+    );
+
+    let info_status = info.status;
+    let info_stdout = info.stdout;
+    let info_stderr = info.stderr;
+
+    if info_status == 0 {
+        let server_version = parse_docker_server_version(&info_stdout);
+        eprintln!(
+            "[sandbox-doctor][at={}][elapsed={}ms] ready=true serverVersion={}",
+            now_ms(),
+            doctor_start.elapsed().as_millis(),
+            server_version.as_deref().unwrap_or("<unknown>")
+        );
+        return SandboxDoctorResult {
+            installed: true,
+            daemon_running: true,
+            permission_ok: true,
+            ready: true,
+            client_version,
+            server_version,
+            error: None,
+            debug: Some(debug),
+        };
+    }
+
+    let combined = format!("{}\n{}", info_stdout.trim(), info_stderr.trim())
+        .trim()
+        .to_string();
+    let lower = combined.to_lowercase();
+    let permission_ok = !lower.contains("permission denied")
+        && !lower.contains("got permission denied")
+        && !lower.contains("access is denied");
+    let daemon_running = !lower.contains("cannot connect to the docker daemon")
+        && !lower.contains("is the docker daemon running")
+        && !lower.contains("error during connect")
+        && !lower.contains("connection refused")
+        && !lower.contains("failed to connect to the docker api")
+        && !lower.contains("dial unix")
+        && !lower.contains("connect: no such file or directory")
+        && !lower.contains("no such file or directory");
+
+    SandboxDoctorResult {
+        installed: true,
+        daemon_running,
+        permission_ok,
+        ready: false,
+        client_version,
+        server_version: None,
+        error: Some(if combined.is_empty() {
+            format!("docker info failed (status {info_status})")
+        } else {
+            combined
+        }),
+        debug: Some(debug),
+    }
+}
+
+#[tauri::command]
+pub fn sandbox_stop(container_name: String) -> Result<ExecResult, String> {
+    let name = container_name.trim().to_string();
+    if name.is_empty() {
+        return Err("containerName is required".to_string());
+    }
+    if !name.starts_with("openwork-orchestrator-") {
+        return Err(
+            "Refusing to stop container: expected name starting with 'openwork-orchestrator-'"
+                .to_string(),
+        );
+    }
+    if !name
+        .chars()
+        .all(|ch| ch.is_ascii_alphanumeric() || ch == '_' || ch == '.' || ch == '-')
+    {
+        return Err("containerName contains invalid characters".to_string());
+    }
+
+    let (status, stdout, stderr) = run_docker_command(&["stop", &name], Duration::from_secs(15))?;
+    Ok(ExecResult {
+        ok: status == 0,
+        status,
+        stdout,
+        stderr,
+    })
+}
+
+#[tauri::command]
+pub fn sandbox_cleanup_openwork_containers() -> Result<OpenworkDockerCleanupResult, String> {
+    let candidates = list_openwork_managed_containers()?;
+    if candidates.is_empty() {
+        return Ok(OpenworkDockerCleanupResult {
+            candidates,
+            removed: Vec::new(),
+            errors: Vec::new(),
+        });
+    }
+
+    let mut removed = Vec::new();
+    let mut errors = Vec::new();
+
+    for name in &candidates {
+        match run_docker_command(&["rm", "-f", name.as_str()], Duration::from_secs(20)) {
+            Ok((status, stdout, stderr)) => {
+                if status == 0 {
+                    removed.push(name.clone());
+                } else {
+                    let combined = format!("{}\n{}", stdout.trim(), stderr.trim())
+                        .trim()
+                        .to_string();
+                    let detail = if combined.is_empty() {
+                        format!("exit {status}")
+                    } else {
+                        format!("exit {status}: {}", truncate_for_debug(&combined))
+                    };
+                    errors.push(format!("{name}: {detail}"));
+                }
+            }
+            Err(err) => errors.push(format!("{name}: {err}")),
+        }
+    }
+
+    Ok(OpenworkDockerCleanupResult {
+        candidates,
+        removed,
+        errors,
+    })
+}
+
+#[tauri::command]
+pub fn sandbox_debug_probe(app: AppHandle) -> SandboxDebugProbeResult {
+    let started_at = now_ms();
+    let run_id = format!("probe-{}", Uuid::new_v4());
+    let workspace_dir = env::temp_dir().join(format!("openwork-sandbox-probe-{}", Uuid::new_v4()));
+    let workspace_path = workspace_dir.to_string_lossy().to_string();
+
+    let mut cleanup_errors: Vec<String> = Vec::new();
+    let mut workspace_removed = false;
+
+    if let Err(err) = std::fs::create_dir_all(&workspace_dir) {
+        return SandboxDebugProbeResult {
+            started_at,
+            finished_at: now_ms(),
+            run_id,
+            workspace_path,
+            ready: false,
+            doctor: sandbox_doctor(),
+            detached_host: None,
+            docker_inspect: None,
+            docker_logs: None,
+            cleanup: SandboxDebugProbeCleanup {
+                container_name: None,
+                container_removed: false,
+                remove_result: None,
+                workspace_removed,
+                errors: vec![format!("Failed to create probe workspace: {err}")],
+            },
+            error: Some(format!("Failed to create sandbox probe workspace: {err}")),
+        };
+    }
+
+    let doctor = sandbox_doctor();
+    let mut detached_host: Option<OrchestratorDetachedHost> = None;
+    let mut docker_inspect: Option<SandboxDoctorCommandDebug> = None;
+    let mut docker_logs: Option<SandboxDoctorCommandDebug> = None;
+    let mut error: Option<String> = None;
+
+    if doctor.ready {
+        match orchestrator_start_detached(
+            app,
+            workspace_path.clone(),
+            Some("docker".to_string()),
+            None,
+            Some(run_id.clone()),
+            None,
+            None,
+        ) {
+            Ok(host) => {
+                let container_name = host
+                    .sandbox_container_name
+                    .clone()
+                    .unwrap_or_else(|| derive_orchestrator_container_name(&run_id));
+
+                match run_docker_command_detailed(
+                    &["inspect", container_name.as_str()],
+                    Duration::from_secs(6),
+                ) {
+                    Ok(result) => {
+                        docker_inspect = Some(to_command_debug(result));
+                    }
+                    Err(err) => {
+                        cleanup_errors.push(format!("docker inspect failed: {err}"));
+                    }
+                }
+
+                match run_docker_command_detailed(
+                    &[
+                        "logs",
+                        "--timestamps",
+                        "--tail",
+                        "400",
+                        container_name.as_str(),
+                    ],
+                    Duration::from_secs(8),
+                ) {
+                    Ok(result) => {
+                        docker_logs = Some(to_command_debug(result));
+                    }
+                    Err(err) => {
+                        cleanup_errors.push(format!("docker logs failed: {err}"));
+                    }
+                }
+
+                detached_host = Some(host);
+            }
+            Err(err) => {
+                error = Some(format!("Sandbox probe failed to start: {err}"));
+            }
+        }
+    } else {
+        error = Some(
+            doctor
+                .error
+                .as_deref()
+                .unwrap_or("Docker is not ready for sandbox creation")
+                .to_string(),
+        );
+    }
+
+    let container_name = detached_host
+        .as_ref()
+        .and_then(|host| host.sandbox_container_name.clone())
+        .or_else(|| {
+            if doctor.ready {
+                Some(derive_orchestrator_container_name(&run_id))
+            } else {
+                None
+            }
+        });
+
+    let mut container_removed = false;
+    let mut remove_result: Option<SandboxDoctorCommandDebug> = None;
+
+    if let Some(name) = container_name.clone() {
+        match run_docker_command_detailed(&["rm", "-f", name.as_str()], Duration::from_secs(20)) {
+            Ok(result) => {
+                container_removed = result.status == 0;
+                remove_result = Some(to_command_debug(result));
+            }
+            Err(err) => {
+                cleanup_errors.push(format!("docker rm -f {name} failed: {err}"));
+            }
+        }
+    }
+
+    if let Err(err) = std::fs::remove_dir_all(&workspace_dir) {
+        cleanup_errors.push(format!("Failed to remove probe workspace: {err}"));
+    } else {
+        workspace_removed = true;
+    }
+
+    let ready = doctor.ready && error.is_none();
+    SandboxDebugProbeResult {
+        started_at,
+        finished_at: now_ms(),
+        run_id,
+        workspace_path,
+        ready,
+        doctor,
+        detached_host,
+        docker_inspect,
+        docker_logs,
+        cleanup: SandboxDebugProbeCleanup {
+            container_name,
+            container_removed,
+            remove_result,
+            workspace_removed,
+            errors: cleanup_errors,
+        },
+        error,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    use std::fs;
+    use std::path::Path;
+    use std::sync::{Mutex, OnceLock};
+
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt;
+
+    static ENV_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+
+    struct EnvGuard {
+        key: &'static str,
+        prev: Option<String>,
+    }
+
+    impl EnvGuard {
+        fn set(key: &'static str, value: String) -> Self {
+            let prev = std::env::var(key).ok();
+            std::env::set_var(key, value);
+            Self { key, prev }
+        }
+
+        fn unset(key: &'static str) -> Self {
+            let prev = std::env::var(key).ok();
+            std::env::remove_var(key);
+            Self { key, prev }
+        }
+    }
+
+    impl Drop for EnvGuard {
+        fn drop(&mut self) {
+            match self.prev.take() {
+                Some(value) => std::env::set_var(self.key, value),
+                None => std::env::remove_var(self.key),
+            }
+        }
+    }
+
+    #[cfg(unix)]
+    fn write_executable(path: &Path, contents: &str) {
+        fs::write(path, contents).expect("write script");
+        let mut perms = fs::metadata(path).expect("metadata").permissions();
+        perms.set_mode(0o755);
+        fs::set_permissions(path, perms).expect("chmod");
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn docker_command_falls_back_after_timeout() {
+        let _lock = ENV_LOCK
+            .get_or_init(|| Mutex::new(()))
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+
+        let tmp =
+            std::env::temp_dir().join(format!("openwork-docker-timeout-test-{}", Uuid::new_v4()));
+        fs::create_dir_all(&tmp).expect("create tmp dir");
+
+        let slow = tmp.join("slow-docker");
+        let fast = tmp.join("docker");
+
+        write_executable(&slow, "#!/bin/sh\nexec /bin/sleep 5\n");
+        write_executable(
+            &fast,
+            r#"#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "Docker version 0.0.0, build test"
+  exit 0
+fi
+if [ "$1" = "info" ]; then
+  echo "Server Version: 0.0.0"
+  exit 0
+fi
+exit 0
+"#,
+        );
+
+        let _path = EnvGuard::set("PATH", tmp.to_string_lossy().to_string());
+        let _docker = EnvGuard::set("OPENWORK_DOCKER_BIN", slow.to_string_lossy().to_string());
+        let _docker_alt = EnvGuard::unset("OPENWRK_DOCKER_BIN");
+        let _docker_bin = EnvGuard::unset("DOCKER_BIN");
+
+        let (status, stdout, _stderr) =
+            run_docker_command(&["--version"], Duration::from_millis(300))
+                .expect("docker --version");
+        assert_eq!(status, 0);
+        assert!(stdout.contains("Docker version 0.0.0"));
+
+        let _ = fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn local_command_timeout_returns_when_descendant_keeps_pipe_open() {
+        let tmp =
+            std::env::temp_dir().join(format!("openwork-timeout-pipe-test-{}", Uuid::new_v4()));
+        fs::create_dir_all(&tmp).expect("create tmp dir");
+
+        let pid_file = tmp.join("descendant.pid");
+        let sticky = tmp.join("sticky-command");
+        write_executable(
+            &sticky,
+            &format!(
+                "#!/bin/sh\nsleep 20 &\necho $! > \"{}\"\nexec /bin/sleep 20\n",
+                pid_file.display()
+            ),
+        );
+
+        let start = Instant::now();
+        let result = run_local_command_with_timeout(
+            sticky.to_str().expect("sticky-command path"),
+            &["--version"],
+            Duration::from_millis(300),
+        );
+        let elapsed = start.elapsed();
+
+        assert!(result.is_err());
+        assert!(
+            elapsed < Duration::from_millis(3_500),
+            "expected bounded timeout, got {elapsed:?}"
+        );
+
+        if let Ok(pid) = fs::read_to_string(&pid_file) {
+            let _ = std::process::Command::new("kill")
+                .args(["-9", pid.trim()])
+                .status();
+        }
+        let _ = fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn sandbox_start_timeout_error_includes_stage_diagnostics() {
+        let message = format_sandbox_start_timeout_error(
+            90_000,
+            "http://127.0.0.1:43210",
+            Some("Connection refused (os error 61)"),
+            Some("created"),
+            Some("No such container"),
+        );
+
+        assert!(message.contains("stage=openwork.healthcheck"));
+        assert!(message.contains("elapsed_ms=90000"));
+        assert!(message.contains("url=http://127.0.0.1:43210"));
+        assert!(message.contains("last_error=Connection refused (os error 61)"));
+        assert!(message.contains("container_state=created"));
+        assert!(message.contains("container_probe_error=No such container"));
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn sandbox_doctor_uses_override_docker_bin() {
+        let _lock = ENV_LOCK
+            .get_or_init(|| Mutex::new(()))
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+
+        let tmp =
+            std::env::temp_dir().join(format!("openwork-docker-doctor-test-{}", Uuid::new_v4()));
+        fs::create_dir_all(&tmp).expect("create tmp dir");
+
+        let fast = tmp.join("docker");
+        write_executable(
+            &fast,
+            r#"#!/bin/sh
+if [ "$1" = "--version" ]; then
+  echo "Docker version 0.0.0, build test"
+  exit 0
+fi
+if [ "$1" = "info" ]; then
+  echo "Server Version: 0.0.0"
+  exit 0
+fi
+exit 0
+"#,
+        );
+
+        let _path = EnvGuard::set("PATH", tmp.to_string_lossy().to_string());
+        let _docker = EnvGuard::set("OPENWORK_DOCKER_BIN", fast.to_string_lossy().to_string());
+        let _docker_alt = EnvGuard::unset("OPENWRK_DOCKER_BIN");
+        let _docker_bin = EnvGuard::unset("DOCKER_BIN");
+
+        let result = sandbox_doctor();
+        assert!(result.installed);
+        assert!(result.ready);
+        assert_eq!(result.server_version.as_deref(), Some("0.0.0"));
+
+        let _ = fs::remove_dir_all(&tmp);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/commands/skills.rs b/apps/desktop/src-tauri/src/commands/skills.rs
new file mode 100644
index 0000000000..e7c547bde6
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/skills.rs
@@ -0,0 +1,643 @@
+use serde::Serialize;
+use std::collections::HashSet;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use crate::fs::copy_dir_recursive;
+use crate::paths::{candidate_xdg_config_dirs, home_dir};
+use crate::types::ExecResult;
+
+fn ensure_project_skill_root(project_dir: &str) -> Result<PathBuf, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let base = PathBuf::from(project_dir).join(".opencode");
+    let legacy = base.join("skill");
+    let modern = base.join("skills");
+
+    if legacy.is_dir() && !modern.exists() {
+        fs::rename(&legacy, &modern).map_err(|e| {
+            format!(
+                "Failed to move {} -> {}: {e}",
+                legacy.display(),
+                modern.display()
+            )
+        })?;
+    }
+
+    fs::create_dir_all(&modern)
+        .map_err(|e| format!("Failed to create {}: {e}", modern.display()))?;
+    Ok(modern)
+}
+
+fn collect_project_skill_roots(project_dir: &Path) -> Vec<PathBuf> {
+    let mut roots = Vec::new();
+    let mut current = Some(project_dir);
+
+    while let Some(dir) = current {
+        let opencode_root = dir.join(".opencode").join("skills");
+        if opencode_root.is_dir() {
+            roots.push(opencode_root);
+        } else {
+            let legacy_root = dir.join(".opencode").join("skill");
+            if legacy_root.is_dir() {
+                roots.push(legacy_root);
+            }
+        }
+
+        let claude_root = dir.join(".claude").join("skills");
+        if claude_root.is_dir() {
+            roots.push(claude_root);
+        }
+
+        if dir.join(".git").exists() {
+            break;
+        }
+
+        current = dir.parent();
+    }
+
+    roots
+}
+
+fn collect_global_skill_roots() -> Vec<PathBuf> {
+    let mut roots = Vec::new();
+    for dir in candidate_xdg_config_dirs() {
+        let opencode_root = dir.join("opencode").join("skills");
+        if opencode_root.is_dir() {
+            roots.push(opencode_root);
+        }
+    }
+
+    if let Some(home) = home_dir() {
+        let claude_root = home.join(".claude").join("skills");
+        if claude_root.is_dir() {
+            roots.push(claude_root);
+        }
+
+        let agents_root = home.join(".agents").join("skills");
+        if agents_root.is_dir() {
+            roots.push(agents_root);
+        }
+
+        let legacy_agents_root = home.join(".agent").join("skills");
+        if legacy_agents_root.is_dir() {
+            roots.push(legacy_agents_root);
+        }
+    }
+
+    roots
+}
+
+fn collect_skill_roots(project_dir: &str) -> Result<Vec<PathBuf>, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let mut roots = Vec::new();
+    let project_path = PathBuf::from(project_dir);
+    roots.extend(collect_project_skill_roots(&project_path));
+    roots.extend(collect_global_skill_roots());
+
+    let mut seen = HashSet::new();
+    let mut unique = Vec::new();
+    for root in roots {
+        let key = root.to_string_lossy().to_string();
+        if seen.insert(key) {
+            unique.push(root);
+        }
+    }
+
+    Ok(unique)
+}
+
+fn validate_skill_name(name: &str) -> Result<String, String> {
+    let trimmed = name.trim();
+    if trimmed.is_empty() {
+        return Err("skill name is required".to_string());
+    }
+
+    if !trimmed
+        .chars()
+        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-')
+    {
+        return Err("skill name must be kebab-case".to_string());
+    }
+
+    if trimmed.starts_with('-') || trimmed.ends_with('-') || trimmed.contains("--") {
+        return Err("skill name must be kebab-case".to_string());
+    }
+
+    Ok(trimmed.to_string())
+}
+
+fn gather_skills(
+    root: &Path,
+    seen: &mut HashSet<String>,
+    out: &mut Vec<PathBuf>,
+) -> Result<(), String> {
+    if !root.is_dir() {
+        return Ok(());
+    }
+
+    for entry in
+        fs::read_dir(root).map_err(|e| format!("Failed to read {}: {e}", root.display()))?
+    {
+        let entry = entry.map_err(|e| e.to_string())?;
+        let file_type = entry.file_type().map_err(|e| e.to_string())?;
+        if !file_type.is_dir() {
+            continue;
+        }
+
+        let path = entry.path();
+        if path.join("SKILL.md").is_file() {
+            // Direct skill: <root>/<name>/SKILL.md
+            let Some(name) = path.file_name().and_then(|s| s.to_str()) else {
+                continue;
+            };
+            if seen.insert(name.to_string()) {
+                out.push(path);
+            }
+        } else {
+            // Domain/category folder: <root>/<domain>/<name>/SKILL.md – scan one level deeper.
+            // This supports the convention where global skills are organised as
+            //   skills/<domain>/<skill-name>/SKILL.md
+            // in addition to the flat   skills/<skill-name>/SKILL.md  layout.
+            if let Ok(sub_entries) = fs::read_dir(&path) {
+                for sub_entry in sub_entries.flatten() {
+                    let Ok(sub_ft) = sub_entry.file_type() else {
+                        continue;
+                    };
+                    if !sub_ft.is_dir() {
+                        continue;
+                    }
+                    let sub_path = sub_entry.path();
+                    if !sub_path.join("SKILL.md").is_file() {
+                        continue;
+                    }
+                    let Some(name) = sub_path.file_name().and_then(|s| s.to_str()) else {
+                        continue;
+                    };
+                    if seen.insert(name.to_string()) {
+                        out.push(sub_path);
+                    }
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn find_skill_file_in_root(root: &Path, name: &str) -> Option<PathBuf> {
+    let direct = root.join(name).join("SKILL.md");
+    if direct.is_file() {
+        return Some(direct);
+    }
+
+    let entries = fs::read_dir(root).ok()?;
+    for entry in entries.flatten() {
+        let Ok(file_type) = entry.file_type() else {
+            continue;
+        };
+        if !file_type.is_dir() {
+            continue;
+        }
+        let candidate = entry.path().join(name).join("SKILL.md");
+        if candidate.is_file() {
+            return Some(candidate);
+        }
+    }
+
+    None
+}
+
+fn collect_skill_dirs_by_name(root: &Path, name: &str) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+
+    let direct = root.join(name);
+    if direct.join("SKILL.md").is_file() {
+        out.push(direct);
+    }
+
+    if let Ok(entries) = fs::read_dir(root) {
+        for entry in entries.flatten() {
+            let Ok(file_type) = entry.file_type() else {
+                continue;
+            };
+            if !file_type.is_dir() {
+                continue;
+            }
+            let candidate = entry.path().join(name);
+            if candidate.join("SKILL.md").is_file() {
+                out.push(candidate);
+            }
+        }
+    }
+
+    out
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct LocalSkillCard {
+    pub name: String,
+    pub path: String,
+    pub description: Option<String>,
+    pub trigger: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct LocalSkillContent {
+    pub path: String,
+    pub content: String,
+}
+
+fn extract_frontmatter_value(raw: &str, keys: &[&str]) -> Option<String> {
+    let mut lines = raw.lines();
+    let first = lines.next()?.trim();
+    if first != "---" {
+        return None;
+    }
+
+    for line in lines {
+        let trimmed = line.trim();
+        if trimmed == "---" {
+            break;
+        }
+        if trimmed.is_empty() {
+            continue;
+        }
+        let Some((key, value)) = trimmed.split_once(':') else {
+            continue;
+        };
+        if !keys
+            .iter()
+            .any(|candidate| candidate.eq_ignore_ascii_case(key.trim()))
+        {
+            continue;
+        }
+        let mut cleaned = value.trim().to_string();
+        if (cleaned.starts_with('"') && cleaned.ends_with('"'))
+            || (cleaned.starts_with('\'') && cleaned.ends_with('\''))
+        {
+            if cleaned.len() >= 2 {
+                cleaned = cleaned[1..cleaned.len() - 1].to_string();
+            }
+        }
+        let cleaned = cleaned.trim();
+        if cleaned.is_empty() {
+            continue;
+        }
+        return Some(cleaned.to_string());
+    }
+
+    None
+}
+
+fn extract_trigger(raw: &str) -> Option<String> {
+    if let Some(frontmatter) = extract_frontmatter_value(raw, &["trigger", "when"]) {
+        return Some(frontmatter);
+    }
+
+    let mut in_frontmatter = false;
+    let mut in_when_section = false;
+
+    for line in raw.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        if trimmed == "---" {
+            in_frontmatter = !in_frontmatter;
+            continue;
+        }
+        if in_frontmatter {
+            continue;
+        }
+        if trimmed.starts_with('#') {
+            let heading = trimmed.trim_start_matches('#').trim();
+            in_when_section = heading.eq_ignore_ascii_case("When to use");
+            continue;
+        }
+        if !in_when_section {
+            continue;
+        }
+
+        let cleaned = trimmed
+            .trim_start_matches(|c: char| c == '-' || c == '*' || c == '+')
+            .trim_start_matches(|c: char| c.is_whitespace())
+            .trim_start_matches(|c: char| c.is_ascii_digit() || c == '.' || c == ')')
+            .trim();
+        if !cleaned.is_empty() {
+            return Some(cleaned.to_string());
+        }
+    }
+
+    None
+}
+
+fn extract_description(raw: &str) -> Option<String> {
+    // Keep this lightweight: take the first non-empty line that isn't a header or frontmatter marker.
+    let mut in_frontmatter = false;
+
+    for line in raw.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        if trimmed == "---" {
+            in_frontmatter = !in_frontmatter;
+            continue;
+        }
+        if in_frontmatter {
+            continue;
+        }
+        if trimmed.starts_with('#') {
+            continue;
+        }
+
+        let cleaned = trimmed.replace('`', "");
+        if cleaned.is_empty() {
+            continue;
+        }
+
+        let max = 180;
+        let truncated: String = cleaned.chars().take(max).collect();
+        if truncated.len() < cleaned.len() {
+            return Some(format!("{}...", truncated));
+        }
+        return Some(cleaned);
+    }
+
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::extract_description;
+
+    #[test]
+    fn extract_description_truncates_multibyte_text_without_panicking() {
+        let raw = &"て".repeat(181);
+
+        let description = extract_description(raw).expect("description should be present");
+
+        assert!(description.ends_with("..."));
+        assert!(description.is_char_boundary(description.len()));
+        assert_eq!(description.chars().count(), 183);
+    }
+
+    #[test]
+    fn extract_description_keeps_short_text_unchanged() {
+        let raw = "Short description";
+
+        let description = extract_description(raw).expect("description should be present");
+
+        assert_eq!(description, "Short description");
+    }
+}
+
+#[tauri::command]
+pub fn list_local_skills(project_dir: String) -> Result<Vec<LocalSkillCard>, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let skill_roots = collect_skill_roots(project_dir)?;
+    let mut found: Vec<PathBuf> = Vec::new();
+    let mut seen = HashSet::new();
+    for root in skill_roots {
+        gather_skills(&root, &mut seen, &mut found)?;
+    }
+
+    let mut out = Vec::new();
+    for path in found {
+        let Some(name) = path.file_name().and_then(|s| s.to_str()) else {
+            continue;
+        };
+
+        let (description, trigger) = match fs::read_to_string(path.join("SKILL.md")) {
+            Ok(raw) => (extract_description(&raw), extract_trigger(&raw)),
+            Err(_) => (None, None),
+        };
+
+        out.push(LocalSkillCard {
+            name: name.to_string(),
+            path: path.to_string_lossy().to_string(),
+            description,
+            trigger,
+        });
+    }
+
+    out.sort_by(|a, b| a.name.cmp(&b.name));
+    Ok(out)
+}
+
+#[tauri::command]
+pub fn read_local_skill(project_dir: String, name: String) -> Result<LocalSkillContent, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let name = validate_skill_name(&name)?;
+    let roots = collect_skill_roots(project_dir)?;
+
+    for root in roots {
+        let Some(path) = find_skill_file_in_root(&root, &name) else {
+            continue;
+        };
+        let raw = fs::read_to_string(&path)
+            .map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+        return Ok(LocalSkillContent {
+            path: path.to_string_lossy().to_string(),
+            content: raw,
+        });
+    }
+
+    Err("Skill not found".to_string())
+}
+
+#[tauri::command]
+pub fn write_local_skill(
+    project_dir: String,
+    name: String,
+    content: String,
+) -> Result<ExecResult, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let name = validate_skill_name(&name)?;
+    let roots = collect_skill_roots(project_dir)?;
+    let mut target: Option<PathBuf> = None;
+
+    for root in roots {
+        if let Some(path) = find_skill_file_in_root(&root, &name) {
+            target = Some(path);
+            break;
+        }
+    }
+
+    let Some(path) = target else {
+        return Ok(ExecResult {
+            ok: false,
+            status: 1,
+            stdout: String::new(),
+            stderr: "Skill not found".to_string(),
+        });
+    };
+
+    let next = if content.ends_with('\n') {
+        content
+    } else {
+        format!("{}\n", content)
+    };
+    fs::write(&path, next).map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Saved skill {}", name),
+        stderr: String::new(),
+    })
+}
+
+#[tauri::command]
+pub fn install_skill_template(
+    project_dir: String,
+    name: String,
+    content: String,
+    overwrite: bool,
+) -> Result<ExecResult, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let name = validate_skill_name(&name)?;
+    let skill_root = ensure_project_skill_root(project_dir)?;
+    let dest = skill_root.join(&name);
+
+    if dest.exists() {
+        if overwrite {
+            fs::remove_dir_all(&dest).map_err(|e| {
+                format!(
+                    "Failed to remove existing skill dir {}: {e}",
+                    dest.display()
+                )
+            })?;
+        } else {
+            return Ok(ExecResult {
+                ok: false,
+                status: 1,
+                stdout: String::new(),
+                stderr: format!("Skill already exists at {}", dest.display()),
+            });
+        }
+    }
+
+    fs::create_dir_all(&dest).map_err(|e| format!("Failed to create {}: {e}", dest.display()))?;
+    fs::write(dest.join("SKILL.md"), content)
+        .map_err(|e| format!("Failed to write SKILL.md: {e}"))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Installed skill to {}", dest.display()),
+        stderr: String::new(),
+    })
+}
+
+#[tauri::command]
+pub fn uninstall_skill(project_dir: String, name: String) -> Result<ExecResult, String> {
+    let project_dir = project_dir.trim();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let name = validate_skill_name(&name)?;
+    let skill_roots = collect_skill_roots(project_dir)?;
+    let mut removed = false;
+
+    for root in skill_roots {
+        for dest in collect_skill_dirs_by_name(&root, &name) {
+            fs::remove_dir_all(&dest)
+                .map_err(|e| format!("Failed to remove {}: {e}", dest.display()))?;
+            removed = true;
+        }
+    }
+
+    if !removed {
+        return Ok(ExecResult {
+            ok: false,
+            status: 1,
+            stdout: String::new(),
+            stderr: "Skill not found in .opencode/skills or .claude/skills".to_string(),
+        });
+    }
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Removed skill {}", name),
+        stderr: String::new(),
+    })
+}
+
+#[tauri::command]
+pub fn import_skill(
+    project_dir: String,
+    source_dir: String,
+    overwrite: bool,
+) -> Result<ExecResult, String> {
+    let project_dir = project_dir.trim().to_string();
+    if project_dir.is_empty() {
+        return Err("projectDir is required".to_string());
+    }
+
+    let source_dir = source_dir.trim().to_string();
+    if source_dir.is_empty() {
+        return Err("sourceDir is required".to_string());
+    }
+
+    let src = std::path::PathBuf::from(&source_dir);
+    let name = src
+        .file_name()
+        .and_then(|s| s.to_str())
+        .ok_or_else(|| "Failed to infer skill name from directory".to_string())?;
+
+    let dest = std::path::PathBuf::from(&project_dir)
+        .join(".opencode")
+        .join("skills")
+        .join(name);
+
+    if dest.exists() {
+        if overwrite {
+            std::fs::remove_dir_all(&dest).map_err(|e| {
+                format!(
+                    "Failed to remove existing skill dir {}: {e}",
+                    dest.display()
+                )
+            })?;
+        } else {
+            return Err(format!("Skill already exists at {}", dest.display()));
+        }
+    }
+
+    copy_dir_recursive(&src, &dest)?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Imported skill to {}", dest.display()),
+        stderr: String::new(),
+    })
+}
diff --git a/apps/desktop/src-tauri/src/commands/updater.rs b/apps/desktop/src-tauri/src/commands/updater.rs
new file mode 100644
index 0000000000..e0f0e64c82
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/updater.rs
@@ -0,0 +1,7 @@
+use crate::types::UpdaterEnvironment;
+use crate::updater::updater_environment as updater_environment_inner;
+
+#[tauri::command]
+pub fn updater_environment(_app: tauri::AppHandle) -> UpdaterEnvironment {
+    updater_environment_inner()
+}
diff --git a/apps/desktop/src-tauri/src/commands/window.rs b/apps/desktop/src-tauri/src/commands/window.rs
new file mode 100644
index 0000000000..34503de641
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/window.rs
@@ -0,0 +1,15 @@
+use tauri::{AppHandle, Manager};
+
+/// Set window decorations (titlebar) visibility.
+/// When `decorations` is false, the native titlebar is hidden.
+/// This is useful for tiling window managers on Linux (e.g., Hyprland, i3, sway).
+#[tauri::command]
+pub fn set_window_decorations(app: AppHandle, decorations: bool) -> Result<(), String> {
+    let window = app
+        .get_webview_window("main")
+        .ok_or_else(|| "Main window not found".to_string())?;
+
+    window
+        .set_decorations(decorations)
+        .map_err(|e| format!("Failed to set decorations: {e}"))
+}
diff --git a/apps/desktop/src-tauri/src/commands/workspace.rs b/apps/desktop/src-tauri/src/commands/workspace.rs
new file mode 100644
index 0000000000..c08ed186a1
--- /dev/null
+++ b/apps/desktop/src-tauri/src/commands/workspace.rs
@@ -0,0 +1,1013 @@
+use std::fs;
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::types::{
+    ExecResult, RemoteType, WorkspaceInfo, WorkspaceList, WorkspaceOpenworkConfig, WorkspaceType,
+};
+use crate::workspace::files::ensure_workspace_files;
+use crate::workspace::state::{
+    load_workspace_state, load_workspace_state_fast, normalize_local_workspace_path,
+    save_workspace_state, stable_workspace_id, stable_workspace_id_for_openwork,
+    stable_workspace_id_for_remote,
+};
+use crate::workspace::watch::{update_workspace_watch, WorkspaceWatchState};
+use serde::Serialize;
+use tauri::{Manager, State};
+use walkdir::WalkDir;
+use zip::write::FileOptions;
+use zip::{CompressionMethod, ZipArchive, ZipWriter};
+
+fn build_workspace_list(state: crate::types::WorkspaceState) -> WorkspaceList {
+    let watched_id = if state.watched_workspace_id.trim().is_empty() {
+        None
+    } else {
+        Some(state.watched_workspace_id)
+    };
+    WorkspaceList {
+        selected_id: state.selected_workspace_id,
+        watched_id,
+        workspaces: state.workspaces,
+    }
+}
+
+fn update_watched_workspace(
+    app: &tauri::AppHandle,
+    watch_state: State<WorkspaceWatchState>,
+    state: &crate::types::WorkspaceState,
+) -> Result<(), String> {
+    let watched_workspace = state
+        .workspaces
+        .iter()
+        .find(|workspace| workspace.id == state.watched_workspace_id);
+    update_workspace_watch(app, watch_state, watched_workspace)
+}
+
+fn schedule_watched_workspace_update(app: &tauri::AppHandle, state: crate::types::WorkspaceState) {
+    let app_handle = app.clone();
+    tauri::async_runtime::spawn(async move {
+        let watch_state = app_handle.state::<WorkspaceWatchState>();
+        if let Err(error) = update_watched_workspace(&app_handle, watch_state, &state) {
+            eprintln!("[workspace] deferred watcher update failed: {error}");
+        }
+    });
+}
+
+#[tauri::command]
+pub fn workspace_bootstrap(
+    app: tauri::AppHandle,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] bootstrap");
+    let mut state = load_workspace_state(&app)?;
+
+    if !state
+        .workspaces
+        .iter()
+        .any(|w| w.id == state.selected_workspace_id)
+    {
+        state.selected_workspace_id = state
+            .workspaces
+            .first()
+            .map(|entry| entry.id.clone())
+            .unwrap_or_default();
+    }
+
+    if !state
+        .workspaces
+        .iter()
+        .any(|w| w.id == state.watched_workspace_id)
+    {
+        state.watched_workspace_id = state.selected_workspace_id.clone();
+    }
+
+    save_workspace_state(&app, &state)?;
+    let _ = watch_state;
+    schedule_watched_workspace_update(&app, state.clone());
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_forget(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] forget request: {workspace_id}");
+    let mut state = load_workspace_state(&app)?;
+    let id = workspace_id.trim();
+
+    if id.is_empty() {
+        return Err("workspaceId is required".to_string());
+    }
+
+    let before = state.workspaces.len();
+    state.workspaces.retain(|w| w.id != id);
+    if before == state.workspaces.len() {
+        return Err("Unknown workspaceId".to_string());
+    }
+
+    if state.selected_workspace_id == id {
+        state.selected_workspace_id = state
+            .workspaces
+            .first()
+            .map(|entry| entry.id.clone())
+            .unwrap_or_else(|| "".to_string());
+    }
+
+    if state.watched_workspace_id == id {
+        state.watched_workspace_id = state.selected_workspace_id.clone();
+    }
+
+    if state.workspaces.is_empty() {
+        state.selected_workspace_id.clear();
+        state.watched_workspace_id.clear();
+    }
+
+    save_workspace_state(&app, &state)?;
+    update_watched_workspace(&app, watch_state, &state)?;
+    println!("[workspace] forget complete");
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_set_selected(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] set_selected request: {workspace_id}");
+    let mut state = load_workspace_state_fast(&app)?;
+    let id = workspace_id.trim();
+
+    if id.is_empty() {
+        return Err("workspaceId is required".to_string());
+    }
+
+    if !state.workspaces.iter().any(|w| w.id == id) {
+        return Err("Unknown workspaceId".to_string());
+    }
+
+    state.selected_workspace_id = id.to_string();
+    save_workspace_state(&app, &state)?;
+    println!("[workspace] set_selected complete: {id}");
+
+    let _ = watch_state;
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_set_runtime_active(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] set_runtime_active request: {workspace_id}");
+    let mut state = load_workspace_state_fast(&app)?;
+    let id = workspace_id.trim();
+
+    if id.is_empty() {
+        state.watched_workspace_id.clear();
+    } else {
+        if !state.workspaces.iter().any(|w| w.id == id) {
+            return Err("Unknown workspaceId".to_string());
+        }
+        state.watched_workspace_id = id.to_string();
+    }
+
+    save_workspace_state(&app, &state)?;
+    let _ = watch_state;
+    schedule_watched_workspace_update(&app, state.clone());
+    println!(
+        "[workspace] set_runtime_active complete: {}",
+        if id.is_empty() { "(cleared)" } else { id }
+    );
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_set_active(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    workspace_set_runtime_active(app, workspace_id, watch_state)
+}
+
+#[tauri::command]
+pub fn workspace_update_display_name(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    display_name: Option<String>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] update display name request: {workspace_id}");
+    let mut state = load_workspace_state(&app)?;
+    let id = workspace_id.trim();
+
+    if id.is_empty() {
+        return Err("workspaceId is required".to_string());
+    }
+
+    let next_name = display_name
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    let workspace = state.workspaces.iter_mut().find(|w| w.id == id);
+    match workspace {
+        Some(entry) => {
+            entry.display_name = next_name;
+        }
+        None => return Err("Unknown workspaceId".to_string()),
+    }
+
+    save_workspace_state(&app, &state)?;
+    println!("[workspace] update display name complete: {id}");
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_create(
+    app: tauri::AppHandle,
+    folder_path: String,
+    name: String,
+    preset: String,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] create local request");
+    let mut folder = folder_path.trim().to_string();
+    if folder.is_empty() {
+        return Err("folderPath is required".to_string());
+    }
+
+    let workspace_name = name.trim().to_string();
+    if workspace_name.is_empty() {
+        return Err("name is required".to_string());
+    }
+
+    let preset = preset.trim().to_string();
+    let preset = if preset.is_empty() {
+        "starter".to_string()
+    } else {
+        preset
+    };
+
+    fs::create_dir_all(&folder).map_err(|e| format!("Failed to create workspace folder: {e}"))?;
+    folder = normalize_local_workspace_path(&folder);
+
+    let id = stable_workspace_id(&folder);
+
+    ensure_workspace_files(&folder, &preset)?;
+
+    let mut state = load_workspace_state(&app)?;
+
+    state.workspaces.retain(|w| w.id != id);
+    state.workspaces.push(WorkspaceInfo {
+        id: id.clone(),
+        name: workspace_name,
+        path: folder,
+        preset,
+        workspace_type: WorkspaceType::Local,
+        remote_type: None,
+        base_url: None,
+        directory: None,
+        display_name: None,
+        openwork_host_url: None,
+        openwork_token: None,
+        openwork_client_token: None,
+        openwork_host_token: None,
+        openwork_workspace_id: None,
+        openwork_workspace_name: None,
+        sandbox_backend: None,
+        sandbox_run_id: None,
+        sandbox_container_name: None,
+    });
+
+    state.selected_workspace_id = id.clone();
+    save_workspace_state(&app, &state)?;
+    println!("[workspace] create local complete: {id}");
+
+    let _ = watch_state;
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_create_remote(
+    app: tauri::AppHandle,
+    base_url: String,
+    directory: Option<String>,
+    display_name: Option<String>,
+    remote_type: Option<RemoteType>,
+    openwork_host_url: Option<String>,
+    openwork_token: Option<String>,
+    openwork_client_token: Option<String>,
+    openwork_host_token: Option<String>,
+    openwork_workspace_id: Option<String>,
+    openwork_workspace_name: Option<String>,
+    sandbox_backend: Option<String>,
+    sandbox_run_id: Option<String>,
+    sandbox_container_name: Option<String>,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] create remote request");
+    let base_url = base_url.trim().to_string();
+    let remote_type = remote_type.unwrap_or_default();
+    if base_url.is_empty() {
+        return Err("baseUrl is required".to_string());
+    }
+    if !base_url.starts_with("http://") && !base_url.starts_with("https://") {
+        return Err("baseUrl must start with http:// or https://".to_string());
+    }
+
+    let directory = directory
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+    let display_name = display_name
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    let openwork_host_url = openwork_host_url
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    let openwork_token = openwork_token
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    let openwork_client_token = openwork_client_token
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    let openwork_host_token = openwork_host_token
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+
+    if remote_type == RemoteType::Openwork {
+        let host_url = openwork_host_url.clone().unwrap_or_default();
+        if host_url.is_empty() {
+            return Err("openworkHostUrl is required for OpenWork remote".to_string());
+        }
+        if !host_url.starts_with("http://") && !host_url.starts_with("https://") {
+            return Err("openworkHostUrl must start with http:// or https://".to_string());
+        }
+    }
+
+    let id = if remote_type == RemoteType::Openwork {
+        stable_workspace_id_for_openwork(
+            openwork_host_url.as_deref().unwrap_or(""),
+            openwork_workspace_id.as_deref(),
+        )
+    } else {
+        stable_workspace_id_for_remote(&base_url, directory.as_deref())
+    };
+    let name = openwork_workspace_name
+        .clone()
+        .filter(|value| !value.trim().is_empty())
+        .or_else(|| display_name.clone())
+        .unwrap_or_else(|| {
+            if remote_type == RemoteType::Openwork {
+                openwork_host_url
+                    .clone()
+                    .unwrap_or_else(|| base_url.clone())
+            } else {
+                base_url.clone()
+            }
+        });
+    let path = directory.clone().unwrap_or_default();
+
+    let mut state = load_workspace_state(&app)?;
+    state.workspaces.retain(|w| w.id != id);
+    state.workspaces.push(WorkspaceInfo {
+        id: id.clone(),
+        name,
+        path,
+        preset: "remote".to_string(),
+        workspace_type: WorkspaceType::Remote,
+        remote_type: Some(remote_type),
+        base_url: Some(base_url),
+        directory,
+        display_name,
+        openwork_host_url,
+        openwork_token,
+        openwork_client_token,
+        openwork_host_token,
+        openwork_workspace_id,
+        openwork_workspace_name,
+        sandbox_backend: sandbox_backend
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty()),
+        sandbox_run_id: sandbox_run_id
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty()),
+        sandbox_container_name: sandbox_container_name
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty()),
+    });
+    state.selected_workspace_id = id.clone();
+    save_workspace_state(&app, &state)?;
+    println!("[workspace] create remote complete: {id}");
+
+    let _ = watch_state;
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_update_remote(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    base_url: Option<String>,
+    directory: Option<String>,
+    display_name: Option<String>,
+    remote_type: Option<RemoteType>,
+    openwork_host_url: Option<String>,
+    openwork_token: Option<String>,
+    openwork_client_token: Option<String>,
+    openwork_host_token: Option<String>,
+    openwork_workspace_id: Option<String>,
+    openwork_workspace_name: Option<String>,
+    sandbox_backend: Option<String>,
+    sandbox_run_id: Option<String>,
+    sandbox_container_name: Option<String>,
+) -> Result<WorkspaceList, String> {
+    println!("[workspace] update remote request: {workspace_id}");
+    let mut state = load_workspace_state(&app)?;
+    let id = workspace_id.trim();
+    if id.is_empty() {
+        return Err("workspaceId is required".to_string());
+    }
+
+    let entry = state.workspaces.iter_mut().find(|w| w.id == id);
+    let Some(entry) = entry else {
+        return Err("Unknown workspaceId".to_string());
+    };
+
+    if entry.workspace_type != WorkspaceType::Remote {
+        return Err("workspaceId is not remote".to_string());
+    }
+
+    if let Some(next_base_url) = base_url
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        if !next_base_url.starts_with("http://") && !next_base_url.starts_with("https://") {
+            return Err("baseUrl must start with http:// or https://".to_string());
+        }
+        entry.base_url = Some(next_base_url);
+    }
+
+    let next_directory = directory
+        .as_ref()
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+    if directory.is_some() {
+        entry.directory = next_directory.clone();
+        entry.path = next_directory.unwrap_or_default();
+    }
+
+    if let Some(next_name) = display_name
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        entry.display_name = Some(next_name.clone());
+        entry.name = next_name;
+    }
+
+    if let Some(next_remote_type) = remote_type {
+        entry.remote_type = Some(next_remote_type);
+    }
+
+    if let Some(next_host_url) = openwork_host_url
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        if !next_host_url.starts_with("http://") && !next_host_url.starts_with("https://") {
+            return Err("openworkHostUrl must start with http:// or https://".to_string());
+        }
+        entry.openwork_host_url = Some(next_host_url);
+    }
+
+    if openwork_token.is_some() {
+        entry.openwork_token = openwork_token
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty());
+    }
+
+    if openwork_client_token.is_some() {
+        entry.openwork_client_token = openwork_client_token
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty());
+    }
+
+    if openwork_host_token.is_some() {
+        entry.openwork_host_token = openwork_host_token
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty());
+    }
+
+    if openwork_workspace_id.is_some() {
+        entry.openwork_workspace_id = openwork_workspace_id
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty());
+    }
+
+    if let Some(next_name) = openwork_workspace_name
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        entry.openwork_workspace_name = Some(next_name.clone());
+        if entry.display_name.is_none() {
+            entry.name = next_name;
+        }
+    }
+
+    if let Some(next_backend) = sandbox_backend
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        entry.sandbox_backend = Some(next_backend);
+    }
+
+    if let Some(next_run_id) = sandbox_run_id
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        entry.sandbox_run_id = Some(next_run_id);
+    }
+
+    if let Some(next_container) = sandbox_container_name
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        entry.sandbox_container_name = Some(next_container);
+    }
+
+    save_workspace_state(&app, &state)?;
+    println!("[workspace] update remote complete: {id}");
+
+    Ok(build_workspace_list(state))
+}
+
+#[tauri::command]
+pub fn workspace_add_authorized_root(
+    _app: tauri::AppHandle,
+    workspace_path: String,
+    folder_path: String,
+) -> Result<ExecResult, String> {
+    let workspace_path = workspace_path.trim().to_string();
+    let folder_path = folder_path.trim().to_string();
+
+    if workspace_path.is_empty() {
+        return Err("workspacePath is required".to_string());
+    }
+    if folder_path.is_empty() {
+        return Err("folderPath is required".to_string());
+    }
+
+    let openwork_path = PathBuf::from(&workspace_path)
+        .join(".opencode")
+        .join("openwork.json");
+
+    if let Some(parent) = openwork_path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+    }
+
+    let mut config: WorkspaceOpenworkConfig = if openwork_path.exists() {
+        let raw = fs::read_to_string(&openwork_path)
+            .map_err(|e| format!("Failed to read {}: {e}", openwork_path.display()))?;
+        serde_json::from_str(&raw).unwrap_or_default()
+    } else {
+        let mut cfg = WorkspaceOpenworkConfig::default();
+        if !cfg.authorized_roots.iter().any(|p| p == &workspace_path) {
+            cfg.authorized_roots.push(workspace_path.clone());
+        }
+        cfg
+    };
+
+    if !config.authorized_roots.iter().any(|p| p == &folder_path) {
+        config.authorized_roots.push(folder_path);
+    }
+
+    fs::write(
+        &openwork_path,
+        serde_json::to_string_pretty(&config).map_err(|e| e.to_string())?,
+    )
+    .map_err(|e| format!("Failed to write {}: {e}", openwork_path.display()))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: "Updated authorizedRoots".to_string(),
+        stderr: String::new(),
+    })
+}
+
+#[tauri::command]
+pub fn workspace_openwork_read(
+    _app: tauri::AppHandle,
+    workspace_path: String,
+) -> Result<WorkspaceOpenworkConfig, String> {
+    let workspace_path = workspace_path.trim().to_string();
+    if workspace_path.is_empty() {
+        return Err("workspacePath is required".to_string());
+    }
+
+    let openwork_path = PathBuf::from(&workspace_path)
+        .join(".opencode")
+        .join("openwork.json");
+
+    if !openwork_path.exists() {
+        let mut cfg = WorkspaceOpenworkConfig::default();
+        cfg.authorized_roots.push(workspace_path);
+        return Ok(cfg);
+    }
+
+    let raw = fs::read_to_string(&openwork_path)
+        .map_err(|e| format!("Failed to read {}: {e}", openwork_path.display()))?;
+
+    serde_json::from_str::<WorkspaceOpenworkConfig>(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", openwork_path.display()))
+}
+
+#[tauri::command]
+pub fn workspace_openwork_write(
+    _app: tauri::AppHandle,
+    workspace_path: String,
+    config: WorkspaceOpenworkConfig,
+) -> Result<ExecResult, String> {
+    let workspace_path = workspace_path.trim().to_string();
+    if workspace_path.is_empty() {
+        return Err("workspacePath is required".to_string());
+    }
+
+    let openwork_path = PathBuf::from(&workspace_path)
+        .join(".opencode")
+        .join("openwork.json");
+
+    if let Some(parent) = openwork_path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+    }
+
+    fs::write(
+        &openwork_path,
+        serde_json::to_string_pretty(&config).map_err(|e| e.to_string())?,
+    )
+    .map_err(|e| format!("Failed to write {}: {e}", openwork_path.display()))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Wrote {}", openwork_path.display()),
+        stderr: String::new(),
+    })
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceExportSummary {
+    pub output_path: String,
+    pub included: usize,
+    pub excluded: Vec<String>,
+}
+
+fn now_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+fn normalize_zip_path(path: &Path) -> String {
+    path.to_string_lossy().replace('\\', "/")
+}
+
+fn is_secret_name(name: &str) -> bool {
+    let lower = name.to_lowercase();
+    if lower == ".env" || lower.starts_with(".env.") {
+        return true;
+    }
+    if lower == "credentials.json" || lower == "credentials.yml" || lower == "credentials.yaml" {
+        return true;
+    }
+    if lower.ends_with(".key")
+        || lower.ends_with(".pem")
+        || lower.ends_with(".p12")
+        || lower.ends_with(".pfx")
+    {
+        return true;
+    }
+    false
+}
+
+fn should_exclude(path: &Path) -> bool {
+    let name = path
+        .file_name()
+        .and_then(|entry| entry.to_str())
+        .unwrap_or("");
+    is_secret_name(name)
+}
+
+fn collect_workspace_entries(
+    workspace_root: &Path,
+) -> Result<(Vec<(PathBuf, String)>, Vec<String>), String> {
+    let mut entries: Vec<(PathBuf, String)> = Vec::new();
+    let mut excluded: Vec<String> = Vec::new();
+
+    let config_path = workspace_root.join("opencode.json");
+    if config_path.exists() && config_path.is_file() {
+        if should_exclude(&config_path) {
+            excluded.push("opencode.json".to_string());
+        } else {
+            entries.push((config_path, "opencode.json".to_string()));
+        }
+    }
+
+    let opencode_dir = workspace_root.join(".opencode");
+    if opencode_dir.exists() {
+        for entry in WalkDir::new(&opencode_dir) {
+            let entry = entry.map_err(|e| e.to_string())?;
+            if !entry.file_type().is_file() {
+                continue;
+            }
+            let absolute = entry.path().to_path_buf();
+            let rel = absolute
+                .strip_prefix(workspace_root)
+                .map_err(|e| format!("Failed to compute relative path: {e}"))?;
+            let rel_str = normalize_zip_path(rel);
+            if should_exclude(&absolute) {
+                if !excluded.contains(&rel_str) {
+                    excluded.push(rel_str);
+                }
+                continue;
+            }
+            entries.push((absolute, rel_str));
+        }
+    }
+
+    Ok((entries, excluded))
+}
+
+#[tauri::command]
+pub fn workspace_export_config(
+    app: tauri::AppHandle,
+    workspace_id: String,
+    output_path: String,
+) -> Result<WorkspaceExportSummary, String> {
+    let workspace_id = workspace_id.trim().to_string();
+    if workspace_id.is_empty() {
+        return Err("workspaceId is required".to_string());
+    }
+    let output_path = output_path.trim().to_string();
+    if output_path.is_empty() {
+        return Err("outputPath is required".to_string());
+    }
+
+    let state = load_workspace_state(&app)?;
+    let workspace = state
+        .workspaces
+        .iter()
+        .find(|w| w.id == workspace_id)
+        .ok_or_else(|| "Unknown workspaceId".to_string())?;
+
+    if workspace.workspace_type != WorkspaceType::Local {
+        return Err("Workspace export is only supported for local workspaces".to_string());
+    }
+
+    let workspace_root = PathBuf::from(&workspace.path);
+    if !workspace_root.exists() {
+        return Err(format!(
+            "Workspace path not found: {}",
+            workspace_root.display()
+        ));
+    }
+
+    let output_path = PathBuf::from(&output_path);
+    if let Some(parent) = output_path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create export folder {}: {e}", parent.display()))?;
+    }
+
+    let (entries, excluded_paths) = collect_workspace_entries(&workspace_root)?;
+    if entries.is_empty() {
+        return Err("No workspace config files found to export".to_string());
+    }
+
+    let file = fs::File::create(&output_path)
+        .map_err(|e| format!("Failed to create {}: {e}", output_path.display()))?;
+    let mut zip = ZipWriter::new(file);
+    let options = FileOptions::default().compression_method(CompressionMethod::Deflated);
+    let mut included_paths: Vec<String> = Vec::new();
+
+    for (src, rel) in entries {
+        let mut input =
+            fs::File::open(&src).map_err(|e| format!("Failed to read {}: {e}", src.display()))?;
+        zip.start_file(rel.clone(), options)
+            .map_err(|e| format!("Failed to add {}: {e}", rel))?;
+        let mut buffer = Vec::new();
+        input
+            .read_to_end(&mut buffer)
+            .map_err(|e| format!("Failed to read {}: {e}", src.display()))?;
+        zip.write_all(&buffer)
+            .map_err(|e| format!("Failed to write {}: {e}", src.display()))?;
+        included_paths.push(rel);
+    }
+
+    let included_count = included_paths.len();
+    let excluded_summary = excluded_paths.clone();
+    let manifest = serde_json::json!({
+        "version": 1,
+        "createdAtMs": now_ms(),
+        "workspace": {
+            "id": workspace.id.clone(),
+            "name": workspace.name.clone(),
+            "path": workspace.path.clone()
+        },
+        "included": included_paths,
+        "excluded": excluded_paths,
+    });
+    let manifest_json = serde_json::to_string_pretty(&manifest).map_err(|e| e.to_string())?;
+    zip.start_file("manifest.json", options)
+        .map_err(|e| format!("Failed to add manifest: {e}"))?;
+    zip.write_all(manifest_json.as_bytes())
+        .map_err(|e| format!("Failed to write manifest: {e}"))?;
+
+    zip.finish()
+        .map_err(|e| format!("Failed to finalize export: {e}"))?;
+
+    Ok(WorkspaceExportSummary {
+        output_path: output_path.to_string_lossy().to_string(),
+        included: included_count,
+        excluded: excluded_summary,
+    })
+}
+
+#[tauri::command]
+pub fn workspace_import_config(
+    app: tauri::AppHandle,
+    archive_path: String,
+    target_dir: String,
+    name: Option<String>,
+    watch_state: State<WorkspaceWatchState>,
+) -> Result<WorkspaceList, String> {
+    let archive_path = archive_path.trim().to_string();
+    if archive_path.is_empty() {
+        return Err("archivePath is required".to_string());
+    }
+    let target_dir = target_dir.trim().to_string();
+    if target_dir.is_empty() {
+        return Err("targetDir is required".to_string());
+    }
+
+    let target_path = PathBuf::from(&target_dir);
+    if target_path.exists() {
+        let mut entries = fs::read_dir(&target_path)
+            .map_err(|e| format!("Failed to read {}: {e}", target_path.display()))?;
+        if entries.next().is_some() {
+            return Err("Target folder must be empty".to_string());
+        }
+    }
+
+    fs::create_dir_all(&target_path)
+        .map_err(|e| format!("Failed to create {}: {e}", target_path.display()))?;
+
+    let file = fs::File::open(&archive_path)
+        .map_err(|e| format!("Failed to open {}: {e}", archive_path))?;
+    let mut archive = ZipArchive::new(file).map_err(|e| format!("Failed to read archive: {e}"))?;
+
+    for i in 0..archive.len() {
+        let mut entry = archive.by_index(i).map_err(|e| e.to_string())?;
+        let name = entry.name().to_string();
+        if name == "manifest.json" {
+            continue;
+        }
+        let entry_path = Path::new(&name);
+        if entry_path.components().any(|component| match component {
+            std::path::Component::ParentDir
+            | std::path::Component::RootDir
+            | std::path::Component::Prefix(_) => true,
+            _ => false,
+        }) {
+            return Err("Archive contains an unsafe path".to_string());
+        }
+        if !(name == "opencode.json" || name.starts_with(".opencode/")) {
+            continue;
+        }
+        if let Some(file_name) = entry_path.file_name().and_then(|entry| entry.to_str()) {
+            if is_secret_name(file_name) {
+                continue;
+            }
+        }
+        let out_path = target_path.join(Path::new(&name));
+        if let Some(parent) = out_path.parent() {
+            fs::create_dir_all(parent)
+                .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+        }
+        if entry.name().ends_with('/') {
+            fs::create_dir_all(&out_path)
+                .map_err(|e| format!("Failed to create {}: {e}", out_path.display()))?;
+            continue;
+        }
+        let mut buffer = Vec::new();
+        entry
+            .read_to_end(&mut buffer)
+            .map_err(|e| format!("Failed to read archive entry: {e}"))?;
+        fs::write(&out_path, buffer)
+            .map_err(|e| format!("Failed to write {}: {e}", out_path.display()))?;
+    }
+
+    let opencode_dir = target_path.join(".opencode");
+    if !opencode_dir.exists() {
+        return Err("Archive is missing .opencode config".to_string());
+    }
+
+    let openwork_path = target_path.join(".opencode").join("openwork.json");
+    let mut preset = "starter".to_string();
+    let mut workspace_name = name.clone().filter(|value| !value.trim().is_empty());
+
+    if openwork_path.exists() {
+        let raw = fs::read_to_string(&openwork_path)
+            .map_err(|e| format!("Failed to read {}: {e}", openwork_path.display()))?;
+        if let Ok(mut config) = serde_json::from_str::<WorkspaceOpenworkConfig>(&raw) {
+            config.authorized_roots = vec![target_dir.clone()];
+            if let Some(workspace) = &config.workspace {
+                if workspace_name.is_none() {
+                    workspace_name = workspace
+                        .name
+                        .clone()
+                        .filter(|value| !value.trim().is_empty());
+                }
+                if let Some(next_preset) = &workspace.preset {
+                    if !next_preset.trim().is_empty() {
+                        preset = next_preset.clone();
+                    }
+                }
+            }
+            fs::write(
+                &openwork_path,
+                serde_json::to_string_pretty(&config).map_err(|e| e.to_string())?,
+            )
+            .map_err(|e| format!("Failed to write {}: {e}", openwork_path.display()))?;
+        }
+    } else {
+        let config = WorkspaceOpenworkConfig::new(&target_dir, &preset, now_ms());
+        if let Some(parent) = openwork_path.parent() {
+            fs::create_dir_all(parent)
+                .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+        }
+        fs::write(
+            &openwork_path,
+            serde_json::to_string_pretty(&config).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| format!("Failed to write {}: {e}", openwork_path.display()))?;
+    }
+
+    let name = workspace_name
+        .unwrap_or_else(|| {
+            target_path
+                .file_name()
+                .and_then(|entry| entry.to_str())
+                .unwrap_or("Workspace")
+                .to_string()
+        })
+        .trim()
+        .to_string();
+
+    let target_dir = normalize_local_workspace_path(&target_dir);
+    let id = stable_workspace_id(&target_dir);
+
+    let mut state = load_workspace_state(&app)?;
+    state.workspaces.retain(|w| w.id != id);
+    state.workspaces.push(WorkspaceInfo {
+        id: id.clone(),
+        name,
+        path: target_dir.clone(),
+        preset,
+        workspace_type: WorkspaceType::Local,
+        remote_type: None,
+        base_url: None,
+        directory: None,
+        display_name: None,
+        openwork_host_url: None,
+        openwork_token: None,
+        openwork_client_token: None,
+        openwork_host_token: None,
+        openwork_workspace_id: None,
+        openwork_workspace_name: None,
+        sandbox_backend: None,
+        sandbox_run_id: None,
+        sandbox_container_name: None,
+    });
+    state.selected_workspace_id = id.clone();
+    save_workspace_state(&app, &state)?;
+    let _ = watch_state;
+
+    Ok(build_workspace_list(state))
+}
diff --git a/apps/desktop/src-tauri/src/config.rs b/apps/desktop/src-tauri/src/config.rs
new file mode 100644
index 0000000000..a24506a9e3
--- /dev/null
+++ b/apps/desktop/src-tauri/src/config.rs
@@ -0,0 +1,95 @@
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+
+use crate::types::{ExecResult, OpencodeConfigFile};
+
+fn opencode_config_candidates(
+    scope: &str,
+    project_dir: &str,
+) -> Result<Vec<PathBuf>, String> {
+    match scope {
+        "project" => {
+            if project_dir.trim().is_empty() {
+                return Err("projectDir is required".to_string());
+            }
+            let root = PathBuf::from(project_dir);
+            Ok(vec![
+                root.join("opencode.jsonc"),
+                root.join("opencode.json"),
+                root.join(".opencode").join("opencode.jsonc"),
+                root.join(".opencode").join("opencode.json"),
+            ])
+        }
+        "global" => {
+            let base = if let Ok(dir) = env::var("XDG_CONFIG_HOME") {
+                PathBuf::from(dir)
+            } else if let Ok(home) = env::var("HOME") {
+                PathBuf::from(home).join(".config")
+            } else {
+                return Err("Unable to resolve config directory".to_string());
+            };
+
+            let root = base.join("opencode");
+            Ok(vec![root.join("opencode.jsonc"), root.join("opencode.json")])
+        }
+        _ => Err("scope must be 'project' or 'global'".to_string()),
+    }
+}
+
+pub fn resolve_opencode_config_path(scope: &str, project_dir: &str) -> Result<PathBuf, String> {
+    let candidates = opencode_config_candidates(scope, project_dir)?;
+
+    for path in &candidates {
+        if path.exists() {
+            return Ok(path.clone());
+        }
+    }
+
+    candidates
+        .into_iter()
+        .next()
+        .ok_or_else(|| "No config path candidates available".to_string())
+}
+
+pub fn read_opencode_config(scope: &str, project_dir: &str) -> Result<OpencodeConfigFile, String> {
+    let path = resolve_opencode_config_path(scope.trim(), project_dir)?;
+    let exists = path.exists();
+
+    let content = if exists {
+        Some(
+            fs::read_to_string(&path)
+                .map_err(|e| format!("Failed to read {}: {e}", path.display()))?,
+        )
+    } else {
+        None
+    };
+
+    Ok(OpencodeConfigFile {
+        path: path.to_string_lossy().to_string(),
+        exists,
+        content,
+    })
+}
+
+pub fn write_opencode_config(
+    scope: &str,
+    project_dir: &str,
+    content: &str,
+) -> Result<ExecResult, String> {
+    let path = resolve_opencode_config_path(scope.trim(), project_dir)?;
+
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create config dir {}: {e}", parent.display()))?;
+    }
+
+    fs::write(&path, content).map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+
+    Ok(ExecResult {
+        ok: true,
+        status: 0,
+        stdout: format!("Wrote {}", path.display()),
+        stderr: String::new(),
+    })
+}
diff --git a/apps/desktop/src-tauri/src/desktop_bootstrap.rs b/apps/desktop/src-tauri/src/desktop_bootstrap.rs
new file mode 100644
index 0000000000..35e8dfc686
--- /dev/null
+++ b/apps/desktop/src-tauri/src/desktop_bootstrap.rs
@@ -0,0 +1,151 @@
+use std::env;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use crate::types::DesktopBootstrapConfig;
+
+const DESKTOP_BOOTSTRAP_FILE_NAME: &str = "desktop-bootstrap.json";
+const DESKTOP_BOOTSTRAP_PATH_ENV: &str = "OPENWORK_DESKTOP_BOOTSTRAP_PATH";
+const DEFAULT_DEN_BASE_URL: &str = "https://app.openworklabs.com";
+
+fn trim_to_option(value: Option<&'static str>) -> Option<String> {
+    value.and_then(|entry| {
+        let trimmed = entry.trim();
+        if trimmed.is_empty() {
+            None
+        } else {
+            Some(trimmed.to_string())
+        }
+    })
+}
+
+fn env_truthy(value: Option<&'static str>) -> bool {
+    matches!(
+        value.map(|entry| entry.trim().to_ascii_lowercase()),
+        Some(value) if matches!(value.as_str(), "1" | "true" | "yes" | "on")
+    )
+}
+
+fn normalize_desktop_bootstrap_config(
+    config: &DesktopBootstrapConfig,
+) -> Result<DesktopBootstrapConfig, String> {
+    let base_url = config.base_url.trim().to_string();
+    if base_url.is_empty() {
+        return Err("baseUrl is required".to_string());
+    }
+
+    Ok(DesktopBootstrapConfig {
+        base_url,
+        api_base_url: config
+            .api_base_url
+            .as_ref()
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty()),
+        require_signin: config.require_signin,
+    })
+}
+
+fn default_desktop_bootstrap_config() -> DesktopBootstrapConfig {
+    DesktopBootstrapConfig {
+        base_url: DEFAULT_DEN_BASE_URL.to_string(),
+        api_base_url: None,
+        require_signin: false,
+    }
+}
+
+fn seed_desktop_bootstrap_config() -> Result<DesktopBootstrapConfig, String> {
+    normalize_desktop_bootstrap_config(&DesktopBootstrapConfig {
+        base_url: trim_to_option(
+            option_env!("OPENWORK_DESKTOP_DEN_BASE_URL").or(option_env!("VITE_DEN_BASE_URL")),
+        )
+        .unwrap_or_else(|| DEFAULT_DEN_BASE_URL.to_string()),
+        api_base_url: trim_to_option(
+            option_env!("OPENWORK_DESKTOP_DEN_API_BASE_URL")
+                .or(option_env!("VITE_DEN_API_BASE_URL")),
+        ),
+        require_signin: env_truthy(
+            option_env!("OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN")
+                .or(option_env!("VITE_DEN_REQUIRE_SIGNIN")),
+        ),
+    })
+}
+
+fn is_non_default_seed(config: &DesktopBootstrapConfig) -> bool {
+    let default_config = default_desktop_bootstrap_config();
+    config.base_url != default_config.base_url
+        || config.api_base_url != default_config.api_base_url
+        || config.require_signin != default_config.require_signin
+}
+
+fn desktop_bootstrap_path() -> Result<PathBuf, String> {
+    if let Some(explicit) = env::var_os(DESKTOP_BOOTSTRAP_PATH_ENV) {
+        let path = PathBuf::from(explicit);
+        if !path.as_os_str().is_empty() {
+            return Ok(path);
+        }
+    }
+
+    let config_root = dirs::home_dir()
+        .ok_or_else(|| "Failed to resolve a desktop bootstrap config directory".to_string())?
+        .join(".config")
+        .join("openwork");
+    Ok(config_root.join(DESKTOP_BOOTSTRAP_FILE_NAME))
+}
+
+fn ensure_parent_dir(path: &Path) -> Result<(), String> {
+    let Some(parent) = path.parent() else {
+        return Err(format!(
+            "Bootstrap path {} has no parent directory",
+            path.display()
+        ));
+    };
+
+    fs::create_dir_all(parent).map_err(|e| format!("Failed to create {}: {e}", parent.display()))
+}
+
+pub fn load_desktop_bootstrap_config() -> Result<Option<DesktopBootstrapConfig>, String> {
+    let path = desktop_bootstrap_path()?;
+    if !path.exists() {
+        return Ok(None);
+    }
+
+    let raw =
+        fs::read_to_string(&path).map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+    let parsed = serde_json::from_str::<DesktopBootstrapConfig>(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", path.display()))?;
+    Ok(Some(normalize_desktop_bootstrap_config(&parsed)?))
+}
+
+pub fn save_desktop_bootstrap_config(
+    config: &DesktopBootstrapConfig,
+) -> Result<DesktopBootstrapConfig, String> {
+    let path = desktop_bootstrap_path()?;
+    ensure_parent_dir(&path)?;
+
+    let normalized = normalize_desktop_bootstrap_config(config)?;
+    fs::write(
+        &path,
+        serde_json::to_string_pretty(&normalized).map_err(|e| e.to_string())?,
+    )
+    .map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+
+    Ok(normalized)
+}
+
+pub fn read_or_init_desktop_bootstrap_config() -> Result<DesktopBootstrapConfig, String> {
+    let seeded = seed_desktop_bootstrap_config()?;
+    let existing = load_desktop_bootstrap_config()?;
+
+    if is_non_default_seed(&seeded) {
+        if existing.as_ref() != Some(&seeded) {
+            save_desktop_bootstrap_config(&seeded)?;
+        }
+        return Ok(seeded);
+    }
+
+    if let Some(config) = existing {
+        return Ok(config);
+    }
+
+    Ok(seeded)
+}
diff --git a/apps/desktop/src-tauri/src/engine/doctor.rs b/apps/desktop/src-tauri/src/engine/doctor.rs
new file mode 100644
index 0000000000..f955c32704
--- /dev/null
+++ b/apps/desktop/src-tauri/src/engine/doctor.rs
@@ -0,0 +1,251 @@
+use std::ffi::OsStr;
+use std::path::Path;
+
+use crate::engine::paths::{
+    resolve_opencode_env_override, resolve_opencode_executable,
+    resolve_opencode_executable_without_override,
+};
+use crate::platform::command_for_program;
+use crate::utils::truncate_output;
+
+pub fn opencode_version(program: &OsStr) -> Option<String> {
+    let mut command = command_for_program(Path::new(program));
+    for (key, value) in crate::bun_env::bun_env_overrides() {
+        command.env(key, value);
+    }
+    let output = command.arg("--version").output().ok()?;
+    let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+
+    if !stdout.is_empty() {
+        return Some(stdout);
+    }
+    if !stderr.is_empty() {
+        return Some(stderr);
+    }
+
+    None
+}
+
+pub fn opencode_serve_help(program: &OsStr) -> (bool, Option<i32>, Option<String>, Option<String>) {
+    let mut command = command_for_program(Path::new(program));
+    for (key, value) in crate::bun_env::bun_env_overrides() {
+        command.env(key, value);
+    }
+
+    match command.arg("serve").arg("--help").output() {
+        Ok(output) => {
+            let status = output.status.code();
+            let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            let ok = output.status.success();
+
+            let stdout = if stdout.is_empty() {
+                None
+            } else {
+                Some(truncate_output(&stdout, 4000))
+            };
+            let stderr = if stderr.is_empty() {
+                None
+            } else {
+                Some(truncate_output(&stderr, 4000))
+            };
+
+            (ok, status, stdout, stderr)
+        }
+        Err(_) => (false, None, None, None),
+    }
+}
+
+pub fn resolve_sidecar_candidate(
+    prefer_sidecar: bool,
+    resource_dir: Option<&Path>,
+    current_bin_dir: Option<&Path>,
+) -> (Option<std::path::PathBuf>, Vec<String>) {
+    if !prefer_sidecar {
+        return (None, Vec::new());
+    }
+
+    let mut notes = Vec::new();
+
+    let mut candidates = Vec::new();
+
+    if let Some(current_bin_dir) = current_bin_dir {
+        candidates.push(current_bin_dir.join(crate::engine::paths::opencode_executable_name()));
+    }
+
+    if let Some(resource_dir) = resource_dir {
+        candidates.push(
+            resource_dir
+                .join("sidecars")
+                .join(crate::engine::paths::opencode_executable_name()),
+        );
+        candidates.push(resource_dir.join(crate::engine::paths::opencode_executable_name()));
+    }
+
+    candidates.push(
+        std::path::PathBuf::from("src-tauri/sidecars")
+            .join(crate::engine::paths::opencode_executable_name()),
+    );
+
+    for candidate in candidates {
+        if candidate.is_file() {
+            notes.push(format!("Using bundled sidecar: {}", candidate.display()));
+            return (Some(candidate), notes);
+        }
+
+        notes.push(format!("Sidecar missing: {}", candidate.display()));
+    }
+
+    (None, notes)
+}
+
+pub fn resolve_engine_path(
+    prefer_sidecar: bool,
+    resource_dir: Option<&Path>,
+    current_bin_dir: Option<&Path>,
+) -> (Option<std::path::PathBuf>, bool, Vec<String>) {
+    if !prefer_sidecar {
+        return resolve_opencode_executable();
+    }
+
+    let (override_path, mut notes) = resolve_opencode_env_override();
+    if let Some(path) = override_path {
+        return (Some(path), false, notes);
+    }
+
+    let (sidecar, sidecar_notes) =
+        resolve_sidecar_candidate(prefer_sidecar, resource_dir, current_bin_dir);
+    notes.extend(sidecar_notes);
+
+    let (resolved, in_path, more_notes) = match sidecar {
+        Some(path) => (Some(path), false, Vec::new()),
+        None => resolve_opencode_executable_without_override(),
+    };
+
+    notes.extend(more_notes);
+    (resolved, in_path, notes)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    struct EnvVarGuard {
+        key: &'static str,
+        original: Option<String>,
+    }
+
+    impl EnvVarGuard {
+        fn set(key: &'static str, value: &std::path::Path) -> Self {
+            let original = std::env::var(key).ok();
+            std::env::set_var(key, value);
+            Self { key, original }
+        }
+
+        fn clear(key: &'static str) -> Self {
+            let original = std::env::var(key).ok();
+            std::env::remove_var(key);
+            Self { key, original }
+        }
+    }
+
+    impl Drop for EnvVarGuard {
+        fn drop(&mut self) {
+            match &self.original {
+                Some(value) => std::env::set_var(self.key, value),
+                None => std::env::remove_var(self.key),
+            }
+        }
+    }
+
+    #[cfg(not(windows))]
+    fn unique_temp_dir(name: &str) -> std::path::PathBuf {
+        use std::time::{SystemTime, UNIX_EPOCH};
+
+        let nanos = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or(0);
+
+        let mut dir = std::env::temp_dir();
+        dir.push(format!("openwork-{name}-{}-{}", std::process::id(), nanos));
+        dir
+    }
+
+    #[test]
+    #[cfg(not(windows))]
+    fn resolves_sidecar_from_current_binary_dir() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+        let _guard = EnvVarGuard::clear("OPENCODE_BIN_PATH");
+
+        let dir = unique_temp_dir("sidecar-test");
+        std::fs::create_dir_all(&dir).expect("create temp dir");
+
+        let sidecar_path = dir.join(crate::engine::paths::opencode_executable_name());
+        std::fs::write(&sidecar_path, b"").expect("create fake sidecar");
+
+        let (resolved, notes) = resolve_sidecar_candidate(true, None, Some(dir.as_path()));
+        assert_eq!(resolved.as_ref(), Some(&sidecar_path));
+        assert!(
+            notes
+                .iter()
+                .any(|note| note.contains("Using bundled sidecar")),
+            "missing success note: {:?}",
+            notes
+        );
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    #[cfg(not(windows))]
+    fn resolve_engine_path_prefers_sidecar() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+        let _guard = EnvVarGuard::clear("OPENCODE_BIN_PATH");
+
+        let dir = unique_temp_dir("engine-path-test");
+        std::fs::create_dir_all(&dir).expect("create temp dir");
+
+        let sidecar_path = dir.join(crate::engine::paths::opencode_executable_name());
+        std::fs::write(&sidecar_path, b"").expect("create fake sidecar");
+
+        let (resolved, in_path, _notes) = resolve_engine_path(true, None, Some(dir.as_path()));
+        assert_eq!(resolved.as_ref(), Some(&sidecar_path));
+        assert!(!in_path);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    #[cfg(not(windows))]
+    fn resolve_engine_path_honors_env_override() {
+        let _lock = ENV_LOCK.lock().expect("lock env");
+
+        let override_dir = unique_temp_dir("opencode-override");
+        std::fs::create_dir_all(&override_dir).expect("create override dir");
+
+        let override_path = override_dir.join("opencode-custom");
+        std::fs::write(&override_path, b"").expect("create override file");
+
+        let _guard = EnvVarGuard::set("OPENCODE_BIN_PATH", &override_path);
+
+        let sidecar_dir = unique_temp_dir("sidecar-override-test");
+        std::fs::create_dir_all(&sidecar_dir).expect("create sidecar dir");
+        let sidecar_path = sidecar_dir.join(crate::engine::paths::opencode_executable_name());
+        std::fs::write(&sidecar_path, b"").expect("create fake sidecar");
+
+        let (resolved, _in_path, notes) =
+            resolve_engine_path(true, None, Some(sidecar_dir.as_path()));
+        assert_eq!(resolved.as_ref(), Some(&override_path));
+        assert!(notes
+            .iter()
+            .any(|note| note.contains("Using OPENCODE_BIN_PATH")));
+
+        let _ = std::fs::remove_dir_all(&override_dir);
+        let _ = std::fs::remove_dir_all(&sidecar_dir);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/engine/manager.rs b/apps/desktop/src-tauri/src/engine/manager.rs
new file mode 100644
index 0000000000..0d0f75b049
--- /dev/null
+++ b/apps/desktop/src-tauri/src/engine/manager.rs
@@ -0,0 +1,75 @@
+use std::sync::{Arc, Mutex};
+
+use tauri_plugin_shell::process::CommandChild;
+
+use crate::types::{EngineInfo, EngineRuntime};
+
+#[derive(Default)]
+pub struct EngineManager {
+    pub inner: Arc<Mutex<EngineState>>,
+}
+
+#[derive(Default)]
+pub struct EngineState {
+    pub runtime: EngineRuntime,
+    pub child: Option<CommandChild>,
+    pub child_exited: bool,
+    pub project_dir: Option<String>,
+    pub hostname: Option<String>,
+    pub port: Option<u16>,
+    pub base_url: Option<String>,
+    pub opencode_username: Option<String>,
+    pub opencode_password: Option<String>,
+    pub opencode_bin_path: Option<String>,
+    pub opencode_bin_source: Option<String>,
+    pub last_stdout: Option<String>,
+    pub last_stderr: Option<String>,
+}
+
+impl EngineManager {
+    pub fn snapshot_locked(state: &mut EngineState) -> EngineInfo {
+        let (running, pid) = match state.child.as_ref() {
+            None if !state.child_exited && state.base_url.is_some() => (true, None),
+            None => (false, None),
+            Some(_child) if state.child_exited => {
+                state.child = None;
+                (false, None)
+            }
+            Some(child) => (true, Some(child.pid())),
+        };
+
+        EngineInfo {
+            running,
+            runtime: state.runtime.clone(),
+            base_url: state.base_url.clone(),
+            project_dir: state.project_dir.clone(),
+            hostname: state.hostname.clone(),
+            port: state.port,
+            opencode_username: state.opencode_username.clone(),
+            opencode_password: state.opencode_password.clone(),
+            opencode_bin_path: state.opencode_bin_path.clone(),
+            opencode_bin_source: state.opencode_bin_source.clone(),
+            pid,
+            last_stdout: state.last_stdout.clone(),
+            last_stderr: state.last_stderr.clone(),
+        }
+    }
+
+    pub fn stop_locked(state: &mut EngineState) {
+        if let Some(child) = state.child.take() {
+            let _ = child.kill();
+        }
+        state.child_exited = true;
+        state.runtime = EngineRuntime::Direct;
+        state.base_url = None;
+        state.project_dir = None;
+        state.hostname = None;
+        state.port = None;
+        state.opencode_username = None;
+        state.opencode_password = None;
+        state.opencode_bin_path = None;
+        state.opencode_bin_source = None;
+        state.last_stdout = None;
+        state.last_stderr = None;
+    }
+}
diff --git a/apps/desktop/src-tauri/src/engine/mod.rs b/apps/desktop/src-tauri/src/engine/mod.rs
new file mode 100644
index 0000000000..5525adf69c
--- /dev/null
+++ b/apps/desktop/src-tauri/src/engine/mod.rs
@@ -0,0 +1,3 @@
+pub mod doctor;
+pub mod manager;
+pub mod paths;
diff --git a/apps/desktop/src-tauri/src/engine/paths.rs b/apps/desktop/src-tauri/src/engine/paths.rs
new file mode 100644
index 0000000000..5fe19767d7
--- /dev/null
+++ b/apps/desktop/src-tauri/src/engine/paths.rs
@@ -0,0 +1,126 @@
+use std::path::PathBuf;
+
+use crate::paths::{home_dir, resolve_in_path};
+
+#[cfg(windows)]
+const OPENCODE_EXECUTABLE: &str = "opencode.exe";
+
+#[cfg(windows)]
+const OPENCODE_CMD: &str = "opencode.cmd";
+
+#[cfg(not(windows))]
+const OPENCODE_EXECUTABLE: &str = "opencode";
+
+pub fn opencode_executable_name() -> &'static str {
+    OPENCODE_EXECUTABLE
+}
+
+pub fn candidate_opencode_paths() -> Vec<PathBuf> {
+    let mut candidates = Vec::new();
+
+    if let Some(home) = home_dir() {
+        candidates.push(home.join(".opencode").join("bin").join(OPENCODE_EXECUTABLE));
+    }
+
+    #[cfg(windows)]
+    {
+        if let Some(app_data) = std::env::var_os("APPDATA") {
+            let base = PathBuf::from(app_data).join("npm");
+            candidates.push(base.join(OPENCODE_EXECUTABLE));
+            candidates.push(base.join(OPENCODE_CMD));
+        }
+
+        if let Some(local_app_data) = std::env::var_os("LOCALAPPDATA") {
+            let base = PathBuf::from(&local_app_data);
+            let npm = base.join("npm");
+            candidates.push(npm.join(OPENCODE_EXECUTABLE));
+            candidates.push(npm.join(OPENCODE_CMD));
+            candidates.push(base.join("OpenCode").join(OPENCODE_EXECUTABLE));
+        }
+
+        if let Some(home) = home_dir() {
+            let scoop = home.join("scoop").join("shims");
+            candidates.push(scoop.join(OPENCODE_EXECUTABLE));
+            candidates.push(scoop.join(OPENCODE_CMD));
+        }
+
+        candidates
+            .push(PathBuf::from("C:\\ProgramData\\chocolatey\\bin").join(OPENCODE_EXECUTABLE));
+        candidates.push(PathBuf::from("C:\\ProgramData\\chocolatey\\bin").join(OPENCODE_CMD));
+    }
+
+    #[cfg(not(windows))]
+    {
+        candidates.push(PathBuf::from("/opt/homebrew/bin").join(OPENCODE_EXECUTABLE));
+        candidates.push(PathBuf::from("/usr/local/bin").join(OPENCODE_EXECUTABLE));
+        candidates.push(PathBuf::from("/usr/bin").join(OPENCODE_EXECUTABLE));
+        candidates.push(PathBuf::from("/usr/local/bin").join(OPENCODE_EXECUTABLE));
+    }
+
+    candidates
+}
+
+pub(crate) fn resolve_opencode_env_override() -> (Option<PathBuf>, Vec<String>) {
+    let mut notes = Vec::new();
+
+    if let Ok(custom) = std::env::var("OPENCODE_BIN_PATH") {
+        let custom = custom.trim();
+        if !custom.is_empty() {
+            let candidate = PathBuf::from(custom);
+            if candidate.is_file() {
+                notes.push(format!("Using OPENCODE_BIN_PATH: {}", candidate.display()));
+                return (Some(candidate), notes);
+            }
+            notes.push(format!(
+                "OPENCODE_BIN_PATH set but missing: {}",
+                candidate.display()
+            ));
+        }
+    }
+
+    (None, notes)
+}
+
+fn resolve_opencode_executable_impl(
+    mut notes: Vec<String>,
+) -> (Option<PathBuf>, bool, Vec<String>) {
+    if let Some(path) = resolve_in_path(OPENCODE_EXECUTABLE) {
+        notes.push(format!("Found in PATH: {}", path.display()));
+        return (Some(path), true, notes);
+    }
+
+    #[cfg(windows)]
+    {
+        if let Some(path) = resolve_in_path(OPENCODE_CMD) {
+            notes.push(format!("Found in PATH: {}", path.display()));
+            return (Some(path), true, notes);
+        }
+    }
+
+    notes.push("Not found on PATH".to_string());
+
+    for candidate in candidate_opencode_paths() {
+        if candidate.is_file() {
+            notes.push(format!("Found at {}", candidate.display()));
+            return (Some(candidate), false, notes);
+        }
+
+        notes.push(format!("Missing: {}", candidate.display()));
+    }
+
+    (None, false, notes)
+}
+
+pub fn resolve_opencode_executable() -> (Option<PathBuf>, bool, Vec<String>) {
+    let (override_path, notes) = resolve_opencode_env_override();
+    if let Some(path) = override_path {
+        return (Some(path), false, notes);
+    }
+
+    resolve_opencode_executable_impl(notes)
+}
+
+pub(crate) fn resolve_opencode_executable_without_override() -> (Option<PathBuf>, bool, Vec<String>)
+{
+    resolve_opencode_executable_impl(Vec::new())
+}
diff --git a/apps/desktop/src-tauri/src/env_file.rs b/apps/desktop/src-tauri/src/env_file.rs
new file mode 100644
index 0000000000..439fccfd6f
--- /dev/null
+++ b/apps/desktop/src-tauri/src/env_file.rs
@@ -0,0 +1,192 @@
+use std::fs;
+use std::path::PathBuf;
+
+use serde::Deserialize;
+
+// User-level env file. Matched byte-for-byte by:
+//   apps/server/src/env-file.ts             (CRUD + server routes)
+//   apps/desktop/electron/runtime.mjs       (Electron spawn)
+//   apps/orchestrator/src/cli.ts            (orchestrator spawn)
+// If any of those change their path resolution or reserved-prefix policy,
+// update this file in the same PR.
+
+const RESERVED_PREFIXES: &[&str] = &["OPENWORK_", "OPENCODE_"];
+
+#[derive(Debug, Deserialize)]
+struct EnvFile {
+    #[serde(default)]
+    variables: Vec<EnvRecord>,
+}
+
+#[derive(Debug, Deserialize)]
+struct EnvRecord {
+    key: String,
+    value: String,
+}
+
+fn resolve_user_env_file_path() -> Option<PathBuf> {
+    if let Ok(override_path) = std::env::var("OPENWORK_ENV_STORE") {
+        let trimmed = override_path.trim();
+        if !trimmed.is_empty() {
+            return Some(PathBuf::from(trimmed));
+        }
+    }
+
+    #[cfg(target_os = "windows")]
+    {
+        let root = std::env::var("APPDATA")
+            .ok()
+            .filter(|value| !value.trim().is_empty())
+            .map(PathBuf::from)
+            .or_else(|| dirs::home_dir().map(|home| home.join("AppData").join("Roaming")));
+        return root.map(|base| base.join("openwork").join("env.json"));
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    {
+        dirs::home_dir().map(|home| home.join(".config").join("openwork").join("env.json"))
+    }
+}
+
+fn is_valid_env_key(key: &str) -> bool {
+    let mut chars = key.chars();
+    match chars.next() {
+        Some(first) if first.is_ascii_alphabetic() || first == '_' => {}
+        _ => return false,
+    }
+    chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
+}
+
+fn is_reserved_env_key(key: &str) -> bool {
+    RESERVED_PREFIXES.iter().any(|prefix| key.starts_with(prefix))
+}
+
+/// Best-effort load of the user-level env file. Absent, unreadable, or
+/// malformed files return an empty vector; reserved-prefix keys are always
+/// stripped so a tampered file cannot shadow OpenWork / OpenCode internals.
+pub fn load_user_env_file() -> Vec<(String, String)> {
+    let Some(path) = resolve_user_env_file_path() else {
+        return Vec::new();
+    };
+    let Ok(raw) = fs::read_to_string(&path) else {
+        return Vec::new();
+    };
+    let Ok(parsed) = serde_json::from_str::<EnvFile>(&raw) else {
+        return Vec::new();
+    };
+    parsed
+        .variables
+        .into_iter()
+        .filter(|record| is_valid_env_key(&record.key) && !is_reserved_env_key(&record.key))
+        .map(|record| (record.key, record.value))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+    use std::sync::Mutex;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+    static NONCE: AtomicU64 = AtomicU64::new(0);
+
+    fn unique_env_path() -> PathBuf {
+        let nonce = NONCE.fetch_add(1, Ordering::Relaxed);
+        let epoch = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or(0);
+        let dir = std::env::temp_dir()
+            .join(format!("openwork-env-file-{epoch}-{nonce}"));
+        fs::create_dir_all(&dir).expect("mkdir tmp");
+        dir.join("env.json")
+    }
+
+    struct EnvStoreGuard {
+        path: PathBuf,
+        original: Option<String>,
+    }
+
+    impl EnvStoreGuard {
+        fn set(path: PathBuf) -> Self {
+            let original = std::env::var("OPENWORK_ENV_STORE").ok();
+            std::env::set_var("OPENWORK_ENV_STORE", &path);
+            Self { path, original }
+        }
+    }
+
+    impl Drop for EnvStoreGuard {
+        fn drop(&mut self) {
+            match &self.original {
+                Some(value) => std::env::set_var("OPENWORK_ENV_STORE", value),
+                None => std::env::remove_var("OPENWORK_ENV_STORE"),
+            }
+            if let Some(parent) = self.path.parent() {
+                let _ = fs::remove_dir_all(parent);
+            }
+        }
+    }
+
+    #[test]
+    fn returns_empty_when_file_is_missing() {
+        let _lock = ENV_LOCK.lock().expect("lock");
+        let path = unique_env_path();
+        let _guard = EnvStoreGuard::set(path);
+        assert!(load_user_env_file().is_empty());
+    }
+
+    #[test]
+    fn returns_empty_on_invalid_json() {
+        let _lock = ENV_LOCK.lock().expect("lock");
+        let path = unique_env_path();
+        fs::write(&path, "{ not json").expect("write");
+        let _guard = EnvStoreGuard::set(path);
+        assert!(load_user_env_file().is_empty());
+    }
+
+    #[test]
+    fn loads_well_formed_entries() {
+        let _lock = ENV_LOCK.lock().expect("lock");
+        let path = unique_env_path();
+        fs::write(
+            &path,
+            r#"{"schemaVersion":1,"updatedAt":0,"variables":[
+                {"key":"ANTHROPIC_API_KEY","value":"sk-ant","updatedAt":0},
+                {"key":"GCLOUD_PROJECT","value":"p","updatedAt":0}
+            ]}"#,
+        )
+        .expect("write");
+        let _guard = EnvStoreGuard::set(path);
+        let loaded = load_user_env_file();
+        assert_eq!(loaded.len(), 2);
+        assert!(
+            loaded
+                .iter()
+                .any(|(k, v)| k == "ANTHROPIC_API_KEY" && v == "sk-ant")
+        );
+    }
+
+    #[test]
+    fn strips_reserved_and_malformed_keys() {
+        let _lock = ENV_LOCK.lock().expect("lock");
+        let path = unique_env_path();
+        fs::write(
+            &path,
+            r#"{"schemaVersion":1,"updatedAt":0,"variables":[
+                {"key":"OPENWORK_TOKEN","value":"stolen","updatedAt":0},
+                {"key":"OPENCODE_SERVER_PASSWORD","value":"stolen","updatedAt":0},
+                {"key":"has-dash","value":"nope","updatedAt":0},
+                {"key":"1BAD","value":"nope","updatedAt":0},
+                {"key":"ANTHROPIC_API_KEY","value":"ok","updatedAt":0}
+            ]}"#,
+        )
+        .expect("write");
+        let _guard = EnvStoreGuard::set(path);
+        let loaded = load_user_env_file();
+        assert_eq!(loaded.len(), 1);
+        assert_eq!(loaded[0].0, "ANTHROPIC_API_KEY");
+    }
+}
diff --git a/apps/desktop/src-tauri/src/fs.rs b/apps/desktop/src-tauri/src/fs.rs
new file mode 100644
index 0000000000..c61e1b8d63
--- /dev/null
+++ b/apps/desktop/src-tauri/src/fs.rs
@@ -0,0 +1,37 @@
+use std::fs;
+use std::path::Path;
+
+pub fn copy_dir_recursive(src: &Path, dest: &Path) -> Result<(), String> {
+    if !src.is_dir() {
+        return Err(format!("Source is not a directory: {}", src.display()));
+    }
+
+    fs::create_dir_all(dest)
+        .map_err(|e| format!("Failed to create dir {}: {e}", dest.display()))?;
+
+    for entry in
+        fs::read_dir(src).map_err(|e| format!("Failed to read dir {}: {e}", src.display()))?
+    {
+        let entry = entry.map_err(|e| e.to_string())?;
+        let file_type = entry.file_type().map_err(|e| e.to_string())?;
+
+        let from = entry.path();
+        let to = dest.join(entry.file_name());
+
+        if file_type.is_dir() {
+            copy_dir_recursive(&from, &to)?;
+            continue;
+        }
+
+        if file_type.is_file() {
+            fs::copy(&from, &to).map_err(|e| {
+                format!("Failed to copy {} -> {}: {e}", from.display(), to.display())
+            })?;
+            continue;
+        }
+
+        // Skip symlinks and other non-regular entries.
+    }
+
+    Ok(())
+}
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
new file mode 100644
index 0000000000..eaf4c9bf9f
--- /dev/null
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -0,0 +1,237 @@
+mod bun_env;
+mod commands;
+mod config;
+mod desktop_bootstrap;
+mod engine;
+mod env_file;
+mod fs;
+mod openwork_server;
+mod orchestrator;
+mod paths;
+mod platform;
+mod types;
+mod updater;
+mod utils;
+mod workspace;
+
+pub use types::*;
+
+use commands::command_files::{
+    opencode_command_delete, opencode_command_list, opencode_command_write,
+};
+use commands::config::{read_opencode_config, write_opencode_config};
+use commands::desktop_bootstrap::{get_desktop_bootstrap_config, set_desktop_bootstrap_config};
+use commands::engine::{
+    engine_doctor, engine_info, engine_install, engine_restart, engine_start, engine_stop,
+};
+use commands::migration::{migrate_to_electron, write_migration_snapshot};
+use commands::misc::{
+    app_build_info, nuke_openwork_and_opencode_config_and_exit, opencode_mcp_auth,
+    reset_opencode_cache, reset_openwork_state,
+};
+use commands::openwork_server::{openwork_server_info, openwork_server_restart};
+use commands::orchestrator::{
+    orchestrator_start_detached, sandbox_cleanup_openwork_containers, sandbox_debug_probe,
+    sandbox_doctor, sandbox_stop,
+};
+use commands::skills::{
+    import_skill, install_skill_template, list_local_skills, read_local_skill, uninstall_skill,
+    write_local_skill,
+};
+use commands::updater::updater_environment;
+use commands::window::set_window_decorations;
+use commands::workspace::{
+    workspace_add_authorized_root, workspace_bootstrap, workspace_create, workspace_create_remote,
+    workspace_export_config, workspace_forget, workspace_import_config, workspace_openwork_read,
+    workspace_openwork_write, workspace_set_active, workspace_set_runtime_active,
+    workspace_set_selected, workspace_update_display_name, workspace_update_remote,
+};
+use engine::manager::EngineManager;
+use openwork_server::manager::OpenworkServerManager;
+use orchestrator::manager::OrchestratorManager;
+use tauri::{AppHandle, Emitter, Manager, RunEvent, WindowEvent};
+use workspace::watch::WorkspaceWatchState;
+
+const NATIVE_DEEP_LINK_EVENT: &str = "openwork:deep-link-native";
+
+#[cfg(target_os = "macos")]
+fn set_dev_app_name() {
+    if std::env::var("OPENWORK_DEV_MODE").ok().as_deref() != Some("1") {
+        return;
+    }
+
+    let Some(_mtm) = objc2::MainThreadMarker::new() else {
+        return;
+    };
+
+    objc2_foundation::NSProcessInfo::processInfo()
+        .setProcessName(&objc2_foundation::NSString::from_str("OpenWork - Dev"));
+}
+
+#[cfg(not(target_os = "macos"))]
+fn set_dev_app_name() {}
+
+fn forwarded_deep_links(args: &[String]) -> Vec<String> {
+    args.iter()
+        .skip(1)
+        .filter_map(|arg| {
+            let trimmed = arg.trim();
+            if trimmed.starts_with("openwork://")
+                || trimmed.starts_with("openwork-dev://")
+                || trimmed.starts_with("https://")
+                || trimmed.starts_with("http://")
+            {
+                Some(trimmed.to_string())
+            } else {
+                None
+            }
+        })
+        .collect()
+}
+
+fn emit_native_deep_links(app_handle: &AppHandle, urls: Vec<String>) {
+    if urls.is_empty() {
+        return;
+    }
+
+    let _ = app_handle.emit(NATIVE_DEEP_LINK_EVENT, urls);
+}
+
+fn emit_forwarded_deep_links(app_handle: &AppHandle, args: &[String]) {
+    let urls = forwarded_deep_links(args);
+    emit_native_deep_links(app_handle, urls);
+}
+
+fn show_main_window(app_handle: &AppHandle) {
+    if let Some(window) = app_handle.get_webview_window("main") {
+        let _ = window.show();
+        let _ = window.unminimize();
+        let _ = window.set_focus();
+    }
+}
+
+fn stop_managed_services(app_handle: &tauri::AppHandle) {
+    if let Ok(mut engine) = app_handle.state::<EngineManager>().inner.lock() {
+        EngineManager::stop_locked(&mut engine);
+    }
+    if let Ok(mut orchestrator) = app_handle.state::<OrchestratorManager>().inner.lock() {
+        OrchestratorManager::stop_locked(&mut orchestrator);
+    }
+    if let Ok(mut openwork_server) = app_handle.state::<OpenworkServerManager>().inner.lock() {
+        OpenworkServerManager::stop_locked(&mut openwork_server);
+    }
+}
+
+pub fn run() {
+    let builder = tauri::Builder::default()
+        .plugin(tauri_plugin_single_instance::init(|app, args, _cwd| {
+            show_main_window(app);
+            emit_forwarded_deep_links(app, &args);
+        }))
+        .plugin(tauri_plugin_deep_link::init())
+        .plugin(tauri_plugin_dialog::init())
+        .plugin(tauri_plugin_http::init())
+        .plugin(tauri_plugin_opener::init());
+
+    #[cfg(desktop)]
+    let builder = builder
+        .plugin(tauri_plugin_process::init())
+        .plugin(tauri_plugin_shell::init())
+        .plugin(tauri_plugin_updater::Builder::new().build());
+
+    let app = builder
+        .setup(|_| {
+            set_dev_app_name();
+            Ok(())
+        })
+        .manage(EngineManager::default())
+        .manage(OrchestratorManager::default())
+        .manage(OpenworkServerManager::default())
+        .manage(WorkspaceWatchState::default())
+        .invoke_handler(tauri::generate_handler![
+            engine_start,
+            engine_stop,
+            engine_info,
+            engine_doctor,
+            engine_install,
+            engine_restart,
+            orchestrator_start_detached,
+            sandbox_doctor,
+            sandbox_debug_probe,
+            sandbox_stop,
+            sandbox_cleanup_openwork_containers,
+            openwork_server_info,
+            openwork_server_restart,
+            workspace_bootstrap,
+            workspace_set_selected,
+            workspace_set_runtime_active,
+            workspace_set_active,
+            workspace_create,
+            workspace_create_remote,
+            workspace_update_display_name,
+            workspace_update_remote,
+            workspace_forget,
+            workspace_add_authorized_root,
+            workspace_export_config,
+            workspace_import_config,
+            opencode_command_list,
+            opencode_command_write,
+            opencode_command_delete,
+            workspace_openwork_read,
+            workspace_openwork_write,
+            import_skill,
+            install_skill_template,
+            list_local_skills,
+            read_local_skill,
+            uninstall_skill,
+            write_local_skill,
+            read_opencode_config,
+            write_opencode_config,
+            get_desktop_bootstrap_config,
+            set_desktop_bootstrap_config,
+            updater_environment,
+            migrate_to_electron,
+            write_migration_snapshot,
+            app_build_info,
+            nuke_openwork_and_opencode_config_and_exit,
+            reset_openwork_state,
+            reset_opencode_cache,
+            opencode_mcp_auth,
+            set_window_decorations
+        ])
+        .build(tauri::generate_context!())
+        .expect("error while building OpenWork");
+
+    // Best-effort cleanup on app exit. Without this, background sidecars can keep
+    // running after the UI quits (especially during dev), leading to stale ports.
+    app.run(|app_handle, event| match event {
+        RunEvent::ExitRequested { .. } | RunEvent::Exit => stop_managed_services(&app_handle),
+        // On macOS the default behavior is to keep the process alive after the
+        // last window closes. We want parity with Windows/Linux: closing the
+        // main window quits the app.
+        #[cfg(target_os = "macos")]
+        RunEvent::WindowEvent {
+            label,
+            event: WindowEvent::CloseRequested { .. },
+            ..
+        } if label == "main" => {
+            app_handle.exit(0);
+        }
+        #[cfg(target_os = "macos")]
+        RunEvent::Opened { urls } => {
+            let urls = urls
+                .into_iter()
+                .map(|url| url.to_string())
+                .collect::<Vec<_>>();
+            show_main_window(&app_handle);
+            emit_native_deep_links(&app_handle, urls);
+        }
+        // Always raise/refocus the main window on dock-icon clicks, even if
+        // it's already visible but behind other apps or on another Space.
+        #[cfg(target_os = "macos")]
+        RunEvent::Reopen { .. } => {
+            show_main_window(&app_handle);
+        }
+        _ => {}
+    });
+}
diff --git a/src-tauri/src/main.rs b/apps/desktop/src-tauri/src/main.rs
similarity index 79%
rename from src-tauri/src/main.rs
rename to apps/desktop/src-tauri/src/main.rs
index 59e446a24c..ba2723577f 100644
--- a/src-tauri/src/main.rs
+++ b/apps/desktop/src-tauri/src/main.rs
@@ -1,5 +1,5 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 fn main() {
-  openwork::run();
+    openwork::run();
 }
diff --git a/apps/desktop/src-tauri/src/openwork_server/manager.rs b/apps/desktop/src-tauri/src/openwork_server/manager.rs
new file mode 100644
index 0000000000..b2ab67db55
--- /dev/null
+++ b/apps/desktop/src-tauri/src/openwork_server/manager.rs
@@ -0,0 +1,83 @@
+use std::sync::{Arc, Mutex};
+
+use tauri_plugin_shell::process::CommandChild;
+
+use crate::types::OpenworkServerInfo;
+
+#[derive(Default)]
+pub struct OpenworkServerManager {
+    pub inner: Arc<Mutex<OpenworkServerState>>,
+}
+
+#[derive(Default)]
+pub struct OpenworkServerState {
+    pub child: Option<CommandChild>,
+    pub child_exited: bool,
+    pub remote_access_enabled: bool,
+    pub host: Option<String>,
+    pub port: Option<u16>,
+    pub base_url: Option<String>,
+    pub connect_url: Option<String>,
+    pub mdns_url: Option<String>,
+    pub lan_url: Option<String>,
+    pub client_token: Option<String>,
+    pub owner_token: Option<String>,
+    pub host_token: Option<String>,
+    pub managed_opencode_bin_path: Option<String>,
+    pub managed_opencode_bin_source: Option<String>,
+    pub last_stdout: Option<String>,
+    pub last_stderr: Option<String>,
+}
+
+impl OpenworkServerManager {
+    pub fn snapshot_locked(state: &mut OpenworkServerState) -> OpenworkServerInfo {
+        let (running, pid) = match state.child.as_ref() {
+            None => (false, None),
+            Some(_child) if state.child_exited => {
+                state.child = None;
+                (false, None)
+            }
+            Some(child) => (true, Some(child.pid())),
+        };
+
+        OpenworkServerInfo {
+            running,
+            remote_access_enabled: state.remote_access_enabled,
+            host: state.host.clone(),
+            port: state.port,
+            base_url: state.base_url.clone(),
+            connect_url: state.connect_url.clone(),
+            mdns_url: state.mdns_url.clone(),
+            lan_url: state.lan_url.clone(),
+            client_token: state.client_token.clone(),
+            owner_token: state.owner_token.clone(),
+            host_token: state.host_token.clone(),
+            managed_opencode_bin_path: state.managed_opencode_bin_path.clone(),
+            managed_opencode_bin_source: state.managed_opencode_bin_source.clone(),
+            pid,
+            last_stdout: state.last_stdout.clone(),
+            last_stderr: state.last_stderr.clone(),
+        }
+    }
+
+    pub fn stop_locked(state: &mut OpenworkServerState) {
+        if let Some(child) = state.child.take() {
+            let _ = child.kill();
+        }
+        state.child_exited = true;
+        state.remote_access_enabled = false;
+        state.host = None;
+        state.port = None;
+        state.base_url = None;
+        state.connect_url = None;
+        state.mdns_url = None;
+        state.lan_url = None;
+        state.client_token = None;
+        state.owner_token = None;
+        state.host_token = None;
+        state.managed_opencode_bin_path = None;
+        state.managed_opencode_bin_source = None;
+        state.last_stdout = None;
+        state.last_stderr = None;
+    }
+}
diff --git a/apps/desktop/src-tauri/src/openwork_server/mod.rs b/apps/desktop/src-tauri/src/openwork_server/mod.rs
new file mode 100644
index 0000000000..7c167e7774
--- /dev/null
+++ b/apps/desktop/src-tauri/src/openwork_server/mod.rs
@@ -0,0 +1,735 @@
+use gethostname::gethostname;
+use local_ip_address::local_ip;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::{HashMap, HashSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::thread;
+use std::time::{Duration, Instant};
+use tauri::AppHandle;
+use tauri::Manager;
+use tauri_plugin_shell::process::CommandEvent;
+use uuid::Uuid;
+
+use crate::types::OpenworkServerInfo;
+use crate::utils::now_ms;
+use crate::utils::truncate_output;
+use crate::workspace::state::normalize_local_workspace_path;
+
+pub mod manager;
+pub mod spawn;
+
+use manager::OpenworkServerManager;
+use spawn::{resolve_openwork_port, spawn_openwork_server};
+
+fn generate_token() -> String {
+    Uuid::new_v4().to_string()
+}
+
+const OPENWORK_SERVER_TOKEN_STORE_VERSION: u32 = 1;
+const OPENWORK_SERVER_STATE_VERSION: u32 = 3;
+const LEGACY_FIXED_OPENWORK_PORT: u16 = 8787;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PersistedOpenworkServerTokens {
+    #[serde(alias = "client_token")]
+    client_token: String,
+    #[serde(alias = "host_token")]
+    host_token: String,
+    #[serde(default, alias = "owner_token")]
+    owner_token: Option<String>,
+    #[serde(alias = "updated_at")]
+    updated_at: u64,
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PersistedOpenworkServerTokenStore {
+    version: u32,
+    #[serde(default)]
+    workspaces: HashMap<String, PersistedOpenworkServerTokens>,
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PersistedOpenworkServerState {
+    version: u32,
+    #[serde(default, alias = "workspace_ports")]
+    workspace_ports: HashMap<String, u16>,
+    #[serde(default, alias = "preferred_port")]
+    preferred_port: Option<u16>,
+}
+
+fn openwork_server_token_store_path(app: &AppHandle) -> Result<PathBuf, String> {
+    let data_dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("Failed to resolve app data dir: {e}"))?;
+    Ok(data_dir.join("openwork-server-tokens.json"))
+}
+
+fn openwork_server_state_path(app: &AppHandle) -> Result<PathBuf, String> {
+    let data_dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("Failed to resolve app data dir: {e}"))?;
+    Ok(data_dir.join("openwork-server-state.json"))
+}
+
+fn normalize_workspace_key(workspace_key: &str) -> String {
+    let trimmed = workspace_key.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+    normalize_local_workspace_path(trimmed)
+}
+
+fn load_openwork_server_token_store(
+    path: &Path,
+) -> Result<PersistedOpenworkServerTokenStore, String> {
+    if !path.exists() {
+        return Ok(PersistedOpenworkServerTokenStore {
+            version: OPENWORK_SERVER_TOKEN_STORE_VERSION,
+            workspaces: HashMap::new(),
+        });
+    }
+
+    let raw =
+        fs::read_to_string(path).map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+    let mut store: PersistedOpenworkServerTokenStore = serde_json::from_str(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", path.display()))?;
+    if store.version < OPENWORK_SERVER_TOKEN_STORE_VERSION {
+        store.version = OPENWORK_SERVER_TOKEN_STORE_VERSION;
+    }
+    Ok(store)
+}
+
+fn save_openwork_server_token_store(
+    path: &Path,
+    store: &PersistedOpenworkServerTokenStore,
+) -> Result<(), String> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+    }
+    let payload = serde_json::to_string_pretty(store).map_err(|e| e.to_string())?;
+    fs::write(path, payload).map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+    Ok(())
+}
+
+fn load_openwork_server_state(path: &Path) -> Result<PersistedOpenworkServerState, String> {
+    if !path.exists() {
+        return Ok(PersistedOpenworkServerState {
+            version: OPENWORK_SERVER_STATE_VERSION,
+            workspace_ports: HashMap::new(),
+            preferred_port: None,
+        });
+    }
+
+    let raw =
+        fs::read_to_string(path).map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+    let payload: Value = serde_json::from_str(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", path.display()))?;
+    let mut state = parse_openwork_server_state_value(&payload)
+        .map_err(|e| format!("Failed to parse {}: {e}", path.display()))?;
+    if state.version < OPENWORK_SERVER_STATE_VERSION {
+        if state.version < 2 && state.preferred_port == Some(LEGACY_FIXED_OPENWORK_PORT) {
+            state.preferred_port = None;
+        }
+        if state.version < 3 && state.preferred_port == Some(LEGACY_FIXED_OPENWORK_PORT) {
+            state.preferred_port = None;
+        }
+        state.version = OPENWORK_SERVER_STATE_VERSION;
+    }
+    Ok(state)
+}
+
+fn parse_openwork_server_state_value(
+    payload: &Value,
+) -> Result<PersistedOpenworkServerState, String> {
+    let version = payload
+        .get("version")
+        .and_then(|value| value.as_u64())
+        .and_then(|value| u32::try_from(value).ok())
+        .unwrap_or(OPENWORK_SERVER_STATE_VERSION);
+    let mut workspace_ports = HashMap::new();
+    merge_workspace_ports(payload, "workspace_ports", &mut workspace_ports)?;
+    merge_workspace_ports(payload, "workspacePorts", &mut workspace_ports)?;
+
+    Ok(PersistedOpenworkServerState {
+        version,
+        workspace_ports,
+        preferred_port: parse_optional_port(payload, &["preferredPort", "preferred_port"]),
+    })
+}
+
+fn merge_workspace_ports(
+    payload: &Value,
+    field_name: &str,
+    ports: &mut HashMap<String, u16>,
+) -> Result<(), String> {
+    let Some(value) = payload.get(field_name) else {
+        return Ok(());
+    };
+    if value.is_null() {
+        return Ok(());
+    }
+    let Some(object) = value.as_object() else {
+        return Err(format!("{field_name} must be an object"));
+    };
+    for (workspace_key, port_value) in object {
+        let Some(port) = port_value
+            .as_u64()
+            .and_then(|value| u16::try_from(value).ok())
+        else {
+            return Err(format!(
+                "{field_name}.{workspace_key} must be a valid TCP port"
+            ));
+        };
+        let normalized = normalize_workspace_key(workspace_key);
+        if !normalized.is_empty() {
+            ports.insert(normalized, port);
+        }
+    }
+    Ok(())
+}
+
+fn parse_optional_port(payload: &Value, field_names: &[&str]) -> Option<u16> {
+    for field_name in field_names {
+        let Some(value) = payload.get(*field_name) else {
+            continue;
+        };
+        if value.is_null() {
+            continue;
+        }
+        if let Some(port) = value.as_u64().and_then(|value| u16::try_from(value).ok()) {
+            return Some(port);
+        }
+    }
+    None
+}
+
+fn save_openwork_server_state(
+    path: &Path,
+    state: &PersistedOpenworkServerState,
+) -> Result<(), String> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+    }
+    let payload = serde_json::to_string_pretty(state).map_err(|e| e.to_string())?;
+    fs::write(path, payload).map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+    Ok(())
+}
+
+#[cfg(test)]
+fn read_preferred_openwork_port_at_path(
+    path: &Path,
+    workspace_key: &str,
+) -> Result<Option<u16>, String> {
+    let state = load_openwork_server_state(path)?;
+    let normalized = normalize_workspace_key(workspace_key);
+    if !normalized.is_empty() {
+        if let Some(port) = state.workspace_ports.get(&normalized) {
+            return Ok(Some(*port));
+        }
+    }
+    if !state.workspace_ports.is_empty() {
+        return Ok(None);
+    }
+    Ok(state.preferred_port)
+}
+
+fn reserved_openwork_ports_at_path(
+    path: &Path,
+    exclude_workspace_key: &str,
+) -> Result<HashSet<u16>, String> {
+    let state = load_openwork_server_state(path)?;
+    let excluded = normalize_workspace_key(exclude_workspace_key);
+    let mut reserved = HashSet::new();
+    for (workspace_key, port) in state.workspace_ports {
+        if workspace_key == excluded {
+            continue;
+        }
+        reserved.insert(port);
+    }
+    if excluded.is_empty() {
+        if let Some(port) = state.preferred_port {
+            reserved.insert(port);
+        }
+    }
+    Ok(reserved)
+}
+
+fn reserved_openwork_ports(
+    app: &AppHandle,
+    exclude_workspace_key: &str,
+) -> Result<HashSet<u16>, String> {
+    let path = openwork_server_state_path(app)?;
+    reserved_openwork_ports_at_path(&path, exclude_workspace_key)
+}
+
+fn persist_preferred_openwork_port_at_path(
+    path: &Path,
+    workspace_key: &str,
+    port: u16,
+) -> Result<(), String> {
+    let mut state = load_openwork_server_state(path)?;
+    state.version = OPENWORK_SERVER_STATE_VERSION;
+    let normalized = normalize_workspace_key(workspace_key);
+    if normalized.is_empty() {
+        state.preferred_port = Some(port);
+    } else {
+        state.workspace_ports.insert(normalized, port);
+        state.preferred_port = None;
+    }
+    save_openwork_server_state(path, &state)
+}
+
+fn persist_preferred_openwork_port(
+    app: &AppHandle,
+    workspace_key: &str,
+    port: u16,
+) -> Result<(), String> {
+    let path = openwork_server_state_path(app)?;
+    persist_preferred_openwork_port_at_path(&path, workspace_key, port)
+}
+
+fn load_or_create_workspace_tokens(
+    app: &AppHandle,
+    workspace_key: &str,
+) -> Result<PersistedOpenworkServerTokens, String> {
+    let path = openwork_server_token_store_path(app)?;
+    load_or_create_workspace_tokens_at_path(&path, workspace_key)
+}
+
+fn load_or_create_workspace_tokens_at_path(
+    path: &Path,
+    workspace_key: &str,
+) -> Result<PersistedOpenworkServerTokens, String> {
+    let mut store = load_openwork_server_token_store(path)?;
+    let normalized = normalize_workspace_key(workspace_key);
+    if let Some(tokens) = store.workspaces.get(&normalized) {
+        return Ok(tokens.clone());
+    }
+
+    let tokens = PersistedOpenworkServerTokens {
+        client_token: generate_token(),
+        host_token: generate_token(),
+        owner_token: None,
+        updated_at: now_ms(),
+    };
+    store.workspaces.insert(normalized, tokens.clone());
+    save_openwork_server_token_store(path, &store)?;
+    Ok(tokens)
+}
+
+fn persist_workspace_owner_token(
+    app: &AppHandle,
+    workspace_key: &str,
+    owner_token: &str,
+) -> Result<(), String> {
+    let path = openwork_server_token_store_path(app)?;
+    persist_workspace_owner_token_at_path(&path, workspace_key, owner_token)
+}
+
+fn persist_workspace_owner_token_at_path(
+    path: &Path,
+    workspace_key: &str,
+    owner_token: &str,
+) -> Result<(), String> {
+    let mut store = load_openwork_server_token_store(path)?;
+    let normalized = normalize_workspace_key(workspace_key);
+    let Some(tokens) = store.workspaces.get_mut(&normalized) else {
+        return Ok(());
+    };
+    tokens.owner_token = Some(owner_token.to_string());
+    tokens.updated_at = now_ms();
+    save_openwork_server_token_store(path, &store)
+}
+
+fn wait_for_openwork_health(base_url: &str, timeout: Duration) -> Result<(), String> {
+    let deadline = Instant::now() + timeout;
+    let health_url = format!("{}/health", base_url.trim_end_matches('/'));
+    let mut last_error = "OpenWork server did not become healthy".to_string();
+
+    while Instant::now() < deadline {
+        match ureq::get(&health_url).call() {
+            Ok(response) if response.status() >= 200 && response.status() < 300 => return Ok(()),
+            Ok(response) => {
+                last_error = format!(
+                    "OpenWork server health check returned {}",
+                    response.status()
+                )
+            }
+            Err(error) => last_error = error.to_string(),
+        }
+        thread::sleep(Duration::from_millis(200));
+    }
+
+    Err(last_error)
+}
+
+fn issue_owner_token(base_url: &str, host_token: &str) -> Result<String, String> {
+    let response = ureq::post(&format!("{}/tokens", base_url.trim_end_matches('/')))
+        .set("X-OpenWork-Host-Token", host_token)
+        .set("Content-Type", "application/json")
+        .send_string(r#"{"scope":"owner","label":"OpenWork desktop owner token"}"#)
+        .map_err(|error| error.to_string())?;
+
+    let payload: Value = response
+        .into_json()
+        .map_err(|error| format!("Failed to parse owner token response: {error}"))?;
+
+    payload
+        .get("token")
+        .and_then(|value| value.as_str())
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| "OpenWork server did not return an owner token".to_string())
+}
+
+fn build_urls(port: u16) -> (Option<String>, Option<String>, Option<String>) {
+    let hostname = gethostname().to_string_lossy().trim().to_string();
+    let mdns_url = if hostname.is_empty() {
+        None
+    } else {
+        let trimmed = hostname.trim_end_matches(".local");
+        Some(format!("http://{trimmed}.local:{port}"))
+    };
+
+    let lan_url = local_ip().ok().map(|ip| format!("http://{ip}:{port}"));
+    let connect_url = lan_url.clone().or(mdns_url.clone());
+
+    (connect_url, mdns_url, lan_url)
+}
+
+pub fn start_openwork_server(
+    app: &AppHandle,
+    manager: &OpenworkServerManager,
+    workspace_paths: &[String],
+    opencode_base_url: Option<&str>,
+    opencode_username: Option<&str>,
+    opencode_password: Option<&str>,
+    remote_access_enabled: bool,
+    manage_opencode: bool,
+    opencode_bin_path: Option<&str>,
+    opencode_bin_source: Option<&str>,
+) -> Result<OpenworkServerInfo, String> {
+    let mut state = manager
+        .inner
+        .lock()
+        .map_err(|_| "openwork server mutex poisoned".to_string())?;
+    OpenworkServerManager::stop_locked(&mut state);
+
+    let host = if remote_access_enabled {
+        "0.0.0.0".to_string()
+    } else {
+        "127.0.0.1".to_string()
+    };
+    let active_workspace = workspace_paths
+        .first()
+        .map(|path| path.as_str())
+        .unwrap_or("");
+    let reserved_ports = reserved_openwork_ports(app, active_workspace)?;
+    // Match Electron: choose a fresh server port for each boot. The renderer is
+    // updated with the new URL after startup, which avoids stale sidecar ports.
+    let port = resolve_openwork_port(&host, None, &reserved_ports)?;
+    let workspace_tokens = load_or_create_workspace_tokens(app, active_workspace)?;
+    let client_token = workspace_tokens.client_token.clone();
+    let host_token = workspace_tokens.host_token.clone();
+
+    let (mut rx, child) = spawn_openwork_server(
+        app,
+        &host,
+        port,
+        workspace_paths,
+        &client_token,
+        &host_token,
+        opencode_base_url,
+        if active_workspace.is_empty() {
+            None
+        } else {
+            Some(active_workspace)
+        },
+        opencode_username,
+        opencode_password,
+        manage_opencode,
+        opencode_bin_path,
+    )?;
+
+    state.child = Some(child);
+    state.child_exited = false;
+    state.remote_access_enabled = remote_access_enabled;
+    state.host = Some(host.clone());
+    state.port = Some(port);
+    state.base_url = Some(format!("http://127.0.0.1:{port}"));
+    let base_url = state
+        .base_url
+        .clone()
+        .unwrap_or_else(|| format!("http://127.0.0.1:{port}"));
+    let (connect_url, mdns_url, lan_url) = if remote_access_enabled {
+        build_urls(port)
+    } else {
+        (None, None, None)
+    };
+    state.connect_url = connect_url;
+    state.mdns_url = mdns_url;
+    state.lan_url = lan_url;
+    state.client_token = Some(client_token);
+    state.managed_opencode_bin_path = if manage_opencode {
+        opencode_bin_path.map(|value| value.to_string())
+    } else {
+        None
+    };
+    state.managed_opencode_bin_source = if manage_opencode {
+        opencode_bin_source.map(|value| value.to_string())
+    } else {
+        None
+    };
+    if let Err(error) = wait_for_openwork_health(&base_url, Duration::from_secs(10)) {
+        OpenworkServerManager::stop_locked(&mut state);
+        return Err(error);
+    }
+    // Owner tokens can be reset independently inside openwork-server. Mint a
+    // fresh token after every start instead of trusting the desktop cache.
+    let owner_token = match issue_owner_token(&base_url, &host_token) {
+        Ok(token) => token,
+        Err(error) => {
+            OpenworkServerManager::stop_locked(&mut state);
+            return Err(error);
+        }
+    };
+    state.owner_token = Some(owner_token.clone());
+    let _ = persist_workspace_owner_token(app, active_workspace, &owner_token);
+    state.host_token = Some(host_token);
+    state.last_stdout = None;
+    state.last_stderr = None;
+    let _ = persist_preferred_openwork_port(app, active_workspace, port);
+
+    let state_handle = manager.inner.clone();
+
+    tauri::async_runtime::spawn(async move {
+        while let Some(event) = rx.recv().await {
+            match event {
+                CommandEvent::Stdout(line_bytes) => {
+                    let line = String::from_utf8_lossy(&line_bytes).to_string();
+                    if let Ok(mut state) = state_handle.try_lock() {
+                        let next =
+                            state.last_stdout.as_deref().unwrap_or_default().to_string() + &line;
+                        state.last_stdout = Some(truncate_output(&next, 8000));
+                    }
+                }
+                CommandEvent::Stderr(line_bytes) => {
+                    let line = String::from_utf8_lossy(&line_bytes).to_string();
+                    if let Ok(mut state) = state_handle.try_lock() {
+                        let next =
+                            state.last_stderr.as_deref().unwrap_or_default().to_string() + &line;
+                        state.last_stderr = Some(truncate_output(&next, 8000));
+                    }
+                }
+                CommandEvent::Terminated(payload) => {
+                    if let Ok(mut state) = state_handle.try_lock() {
+                        state.child_exited = true;
+                        if let Some(code) = payload.code {
+                            let next = format!("OpenWork server exited (code {code}).");
+                            state.last_stderr = Some(truncate_output(&next, 8000));
+                        }
+                    }
+                }
+                CommandEvent::Error(message) => {
+                    if let Ok(mut state) = state_handle.try_lock() {
+                        state.child_exited = true;
+                        let next =
+                            state.last_stderr.as_deref().unwrap_or_default().to_string() + &message;
+                        state.last_stderr = Some(truncate_output(&next, 8000));
+                    }
+                }
+                _ => {}
+            }
+        }
+    });
+
+    Ok(OpenworkServerManager::snapshot_locked(&mut state))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn unique_temp_path(name: &str) -> PathBuf {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock before unix epoch")
+            .as_nanos();
+        std::env::temp_dir().join(format!("openwork-server-{name}-{nonce}.json"))
+    }
+
+    #[test]
+    fn reuses_tokens_for_the_same_workspace_after_restart() {
+        let path = unique_temp_path("reuse");
+        let first = load_or_create_workspace_tokens_at_path(&path, "/tmp/workspace")
+            .expect("create first token set");
+        let second = load_or_create_workspace_tokens_at_path(&path, "/tmp/workspace")
+            .expect("load existing token set");
+
+        assert_eq!(first.client_token, second.client_token);
+        assert_eq!(first.host_token, second.host_token);
+        assert_eq!(first.owner_token, second.owner_token);
+
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn reads_electron_camel_case_token_entries() {
+        let path = unique_temp_path("camel-token");
+        fs::write(
+            &path,
+            r#"{
+  "version": 1,
+  "workspaces": {
+    "/tmp/workspace": {
+      "clientToken": "client",
+      "hostToken": "host",
+      "ownerToken": "owner",
+      "updatedAt": 123
+    }
+  }
+}"#,
+        )
+        .expect("write camel token store");
+
+        let tokens = load_or_create_workspace_tokens_at_path(&path, "/tmp/workspace")
+            .expect("load camel token entry");
+
+        assert_eq!(tokens.client_token, "client");
+        assert_eq!(tokens.host_token, "host");
+        assert_eq!(tokens.owner_token.as_deref(), Some("owner"));
+        assert_eq!(tokens.updated_at, 123);
+
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn reads_electron_camel_case_port_state() {
+        let path = unique_temp_path("camel-port");
+        fs::write(
+            &path,
+            r#"{
+  "version": 3,
+  "workspacePorts": {
+    "/tmp/workspace": 49123
+  },
+  "preferredPort": 49124
+}"#,
+        )
+        .expect("write camel port state");
+
+        let preferred = read_preferred_openwork_port_at_path(&path, "/tmp/workspace")
+            .expect("read camel preferred port");
+        let reserved = reserved_openwork_ports_at_path(&path, "/tmp/other")
+            .expect("read camel reserved ports");
+
+        assert_eq!(preferred, Some(49_123));
+        assert!(reserved.contains(&49_123));
+
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn reads_mixed_case_port_state_without_duplicate_field_error() {
+        let path = unique_temp_path("mixed-port");
+        fs::write(
+            &path,
+            r#"{
+  "version": 3,
+  "workspace_ports": {
+    "/tmp/workspace": 49000
+  },
+  "preferred_port": null,
+  "workspacePorts": {
+    "/tmp/workspace": 49123,
+    "/tmp/other": 49124
+  },
+  "preferredPort": null
+}"#,
+        )
+        .expect("write mixed port state");
+
+        let preferred = read_preferred_openwork_port_at_path(&path, "/tmp/workspace")
+            .expect("read mixed preferred port");
+        let reserved = reserved_openwork_ports_at_path(&path, "/tmp/workspace")
+            .expect("read mixed reserved ports");
+
+        assert_eq!(preferred, Some(49_123));
+        assert!(!reserved.contains(&49_123));
+        assert!(reserved.contains(&49_124));
+
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn migrates_legacy_fixed_port_to_no_preference() {
+        let path = unique_temp_path("port-migrate");
+        fs::write(&path, r#"{"version":1,"preferred_port":8787}"#).expect("write legacy state");
+
+        let state = load_openwork_server_state(&path).expect("load migrated state");
+        assert_eq!(state.version, OPENWORK_SERVER_STATE_VERSION);
+        assert_eq!(state.preferred_port, None);
+        assert!(state.workspace_ports.is_empty());
+
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn reuses_workspace_tokens_across_canonical_path_aliases() {
+        let path = unique_temp_path("token-path-alias");
+        let workspace = PathBuf::from(format!(
+            "/tmp/openwork-workspace-token-alias-{}-{}",
+            std::process::id(),
+            now_ms()
+        ));
+        fs::create_dir_all(&workspace).expect("create temp workspace");
+        let canonical = fs::canonicalize(&workspace).expect("canonical workspace path");
+
+        let first = load_or_create_workspace_tokens_at_path(&path, &workspace.to_string_lossy())
+            .expect("store tokens using raw path");
+        let second = load_or_create_workspace_tokens_at_path(&path, &canonical.to_string_lossy())
+            .expect("load tokens using canonical path");
+
+        assert_eq!(first.client_token, second.client_token);
+        assert_eq!(first.host_token, second.host_token);
+
+        let _ = fs::remove_file(path);
+        let _ = fs::remove_dir_all(workspace);
+    }
+
+    #[test]
+    fn reuses_workspace_port_across_canonical_path_aliases() {
+        let path = unique_temp_path("port-path-alias");
+        let workspace = PathBuf::from(format!(
+            "/tmp/openwork-workspace-port-alias-{}-{}",
+            std::process::id(),
+            now_ms()
+        ));
+        fs::create_dir_all(&workspace).expect("create temp workspace");
+        let canonical = fs::canonicalize(&workspace).expect("canonical workspace path");
+
+        persist_preferred_openwork_port_at_path(&path, &workspace.to_string_lossy(), 49_123)
+            .expect("persist preferred port using raw path");
+
+        let preferred = read_preferred_openwork_port_at_path(&path, &canonical.to_string_lossy())
+            .expect("read preferred port using canonical path");
+        let reserved = reserved_openwork_ports_at_path(&path, &canonical.to_string_lossy())
+            .expect("read reserved ports using canonical path");
+
+        assert_eq!(preferred, Some(49_123));
+        assert!(!reserved.contains(&49_123));
+
+        let _ = fs::remove_file(path);
+        let _ = fs::remove_dir_all(workspace);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/openwork_server/spawn.rs b/apps/desktop/src-tauri/src/openwork_server/spawn.rs
new file mode 100644
index 0000000000..37b77cf668
--- /dev/null
+++ b/apps/desktop/src-tauri/src/openwork_server/spawn.rs
@@ -0,0 +1,267 @@
+use std::collections::HashSet;
+use std::net::TcpListener;
+use std::path::Path;
+use std::thread;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use tauri::async_runtime::Receiver;
+use tauri::AppHandle;
+use tauri_plugin_shell::process::{CommandChild, CommandEvent};
+use tauri_plugin_shell::ShellExt;
+
+use crate::paths::resolve_process_working_dir;
+
+pub const OPENWORK_PORT_RANGE_START: u16 = 48_000;
+pub const OPENWORK_PORT_RANGE_END: u16 = 51_000;
+const PREFERRED_PORT_RETRY_ATTEMPTS: usize = 20;
+const PREFERRED_PORT_RETRY_DELAY_MS: u64 = 50;
+
+fn bind_available_port(host: &str, port: u16) -> bool {
+    TcpListener::bind((host, port)).is_ok()
+}
+
+fn range_port_count() -> usize {
+    usize::from(OPENWORK_PORT_RANGE_END - OPENWORK_PORT_RANGE_START) + 1
+}
+
+fn random_range_offset() -> usize {
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .subsec_nanos();
+    usize::try_from(nanos).unwrap_or(0) % range_port_count()
+}
+
+fn wait_for_preferred_port(host: &str, port: u16) -> bool {
+    for attempt in 0..=PREFERRED_PORT_RETRY_ATTEMPTS {
+        if bind_available_port(host, port) {
+            return true;
+        }
+        if attempt < PREFERRED_PORT_RETRY_ATTEMPTS {
+            thread::sleep(Duration::from_millis(PREFERRED_PORT_RETRY_DELAY_MS));
+        }
+    }
+    false
+}
+
+pub fn resolve_openwork_port(
+    host: &str,
+    preferred_port: Option<u16>,
+    reserved_ports: &HashSet<u16>,
+) -> Result<u16, String> {
+    if let Some(port) = preferred_port.filter(|port| *port > 0) {
+        if !reserved_ports.contains(&port) && wait_for_preferred_port(host, port) {
+            return Ok(port);
+        }
+    }
+
+    let count = range_port_count();
+    let start = random_range_offset();
+    for step in 0..count {
+        let index = (start + step) % count;
+        let port = OPENWORK_PORT_RANGE_START + u16::try_from(index).unwrap_or(0);
+        if reserved_ports.contains(&port) {
+            continue;
+        }
+        if bind_available_port(host, port) {
+            return Ok(port);
+        }
+    }
+
+    for _ in 0..32 {
+        let listener = TcpListener::bind((host, 0)).map_err(|e| e.to_string())?;
+        let port = listener.local_addr().map_err(|e| e.to_string())?.port();
+        if reserved_ports.contains(&port) {
+            drop(listener);
+            continue;
+        }
+        drop(listener);
+        return Ok(port);
+    }
+
+    Err("Failed to find a free OpenWork server port".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{resolve_openwork_port, OPENWORK_PORT_RANGE_END, OPENWORK_PORT_RANGE_START};
+    use std::collections::HashSet;
+    use std::net::TcpListener;
+    use std::time::Duration;
+
+    #[test]
+    fn uses_preferred_port_when_available() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).expect("bind test listener");
+        let port = listener.local_addr().expect("listener addr").port();
+        drop(listener);
+
+        let resolved = resolve_openwork_port("127.0.0.1", Some(port), &HashSet::new())
+            .expect("resolve preferred port");
+        assert_eq!(resolved, port);
+    }
+
+    #[test]
+    fn falls_back_to_ephemeral_port_when_preferred_port_is_unavailable() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).expect("bind preferred port");
+        let preferred_port = listener.local_addr().expect("listener addr").port();
+        let resolved = resolve_openwork_port("127.0.0.1", Some(preferred_port), &HashSet::new())
+            .expect("resolve fallback port");
+        assert_ne!(resolved, preferred_port);
+        drop(listener);
+    }
+
+    #[test]
+    fn uses_range_port_when_no_preference_exists() {
+        let resolved =
+            resolve_openwork_port("127.0.0.1", None, &HashSet::new()).expect("resolve range port");
+        assert!(resolved >= OPENWORK_PORT_RANGE_START);
+        assert!(resolved <= OPENWORK_PORT_RANGE_END);
+    }
+
+    #[test]
+    fn skips_reserved_ports_from_other_workspaces() {
+        let reserved = HashSet::from([OPENWORK_PORT_RANGE_START]);
+        let resolved =
+            resolve_openwork_port("127.0.0.1", Some(OPENWORK_PORT_RANGE_START), &reserved)
+                .expect("resolve non-reserved port");
+        assert_ne!(resolved, OPENWORK_PORT_RANGE_START);
+        assert!(resolved >= OPENWORK_PORT_RANGE_START);
+        assert!(resolved <= OPENWORK_PORT_RANGE_END);
+    }
+
+    #[test]
+    fn waits_briefly_to_reuse_preferred_port_during_restart() {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).expect("bind preferred port");
+        let preferred_port = listener.local_addr().expect("listener addr").port();
+
+        let release = std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(150));
+            drop(listener);
+        });
+
+        let resolved = resolve_openwork_port("127.0.0.1", Some(preferred_port), &HashSet::new())
+            .expect("resolve restarted preferred port");
+
+        release.join().expect("join release thread");
+        assert_eq!(resolved, preferred_port);
+    }
+}
+
+pub fn build_openwork_args(
+    host: &str,
+    port: u16,
+    workspace_paths: &[String],
+    opencode_base_url: Option<&str>,
+    opencode_directory: Option<&str>,
+) -> Vec<String> {
+    let mut args = vec![
+        "--host".to_string(),
+        host.to_string(),
+        "--port".to_string(),
+        port.to_string(),
+        // Always allow all origins since the OpenWork server is designed to accept
+        // remote connections from client devices (phones, laptops) which may use
+        // different origins (localhost dev servers, tauri apps, web browsers).
+        "--cors".to_string(),
+        "*".to_string(),
+        // Auto-approve write operations when running from the desktop app.
+        // The user is already authenticated as host and in control of the UI.
+        "--approval".to_string(),
+        "auto".to_string(),
+    ];
+
+    for workspace_path in workspace_paths {
+        if !workspace_path.trim().is_empty() {
+            args.push("--workspace".to_string());
+            args.push(workspace_path.to_string());
+        }
+    }
+
+    if let Some(base_url) = opencode_base_url {
+        if !base_url.trim().is_empty() {
+            args.push("--opencode-base-url".to_string());
+            args.push(base_url.to_string());
+        }
+    }
+
+    if let Some(directory) = opencode_directory {
+        if !directory.trim().is_empty() {
+            args.push("--opencode-directory".to_string());
+            args.push(directory.to_string());
+        }
+    }
+
+    args
+}
+
+pub fn spawn_openwork_server(
+    app: &AppHandle,
+    host: &str,
+    port: u16,
+    workspace_paths: &[String],
+    token: &str,
+    host_token: &str,
+    opencode_base_url: Option<&str>,
+    opencode_directory: Option<&str>,
+    opencode_username: Option<&str>,
+    opencode_password: Option<&str>,
+    manage_opencode: bool,
+    opencode_bin_path: Option<&str>,
+) -> Result<(Receiver<CommandEvent>, CommandChild), String> {
+    let command = match app.shell().sidecar("openwork-server") {
+        Ok(command) => command,
+        Err(_) => app.shell().command("openwork-server"),
+    };
+
+    let args = build_openwork_args(
+        host,
+        port,
+        workspace_paths,
+        opencode_base_url,
+        opencode_directory,
+    );
+    let cwd = workspace_paths
+        .first()
+        .map(|path| Path::new(path))
+        .unwrap_or_else(|| Path::new("."));
+    let cwd = resolve_process_working_dir(app, cwd, "openwork-server")?;
+    let mut command = command.args(args).current_dir(cwd);
+
+    // User env first so it can never override OPENWORK_TOKEN / credentials.
+    for (key, value) in crate::env_file::load_user_env_file() {
+        command = command.env(key, value);
+    }
+
+    command = command
+        .env("OPENWORK_TOKEN", token)
+        .env("OPENWORK_HOST_TOKEN", host_token);
+
+    if manage_opencode {
+        command = command.env("OPENWORK_MANAGE_OPENCODE", "1");
+        if let Some(path) = opencode_bin_path {
+            if !path.trim().is_empty() {
+                command = command.env("OPENWORK_OPENCODE_BIN", path);
+            }
+        }
+    }
+
+    if let Some(username) = opencode_username {
+        if !username.trim().is_empty() {
+            command = command.env("OPENWORK_OPENCODE_USERNAME", username);
+        }
+    }
+
+    if let Some(password) = opencode_password {
+        if !password.trim().is_empty() {
+            command = command.env("OPENWORK_OPENCODE_PASSWORD", password);
+        }
+    }
+
+    for (key, value) in crate::bun_env::bun_env_overrides() {
+        command = command.env(key, value);
+    }
+
+    command
+        .spawn()
+        .map_err(|e| format!("Failed to start OpenWork server: {e}"))
+}
diff --git a/apps/desktop/src-tauri/src/orchestrator/manager.rs b/apps/desktop/src-tauri/src/orchestrator/manager.rs
new file mode 100644
index 0000000000..2f3e398a59
--- /dev/null
+++ b/apps/desktop/src-tauri/src/orchestrator/manager.rs
@@ -0,0 +1,50 @@
+use std::sync::{Arc, Mutex};
+
+use tauri_plugin_shell::process::CommandChild;
+
+use crate::orchestrator;
+
+#[derive(Default)]
+pub struct OrchestratorManager {
+    pub inner: Arc<Mutex<OrchestratorState>>,
+}
+
+#[derive(Default)]
+pub struct OrchestratorState {
+    pub child: Option<CommandChild>,
+    pub child_exited: bool,
+    pub data_dir: Option<String>,
+    pub last_stdout: Option<String>,
+    pub last_stderr: Option<String>,
+}
+
+impl OrchestratorManager {
+    pub fn stop_locked(state: &mut OrchestratorState) {
+        let data_dir = state
+            .data_dir
+            .clone()
+            .unwrap_or_else(orchestrator::resolve_orchestrator_data_dir);
+
+        let shutdown_requested = match orchestrator::request_orchestrator_shutdown(&data_dir) {
+            Ok(requested) => requested,
+            Err(error) => {
+                eprintln!("[orchestrator] Failed to request shutdown: {error}");
+                false
+            }
+        };
+
+        if let Some(child) = state.child.take() {
+            // Prefer daemon-owned graceful shutdown so openwork-orchestrator can
+            // terminate its managed OpenCode child before exiting.
+            if !shutdown_requested {
+                let _ = child.kill();
+            }
+        }
+
+        orchestrator::clear_orchestrator_auth(&data_dir);
+        state.child_exited = true;
+        state.data_dir = None;
+        state.last_stdout = None;
+        state.last_stderr = None;
+    }
+}
diff --git a/apps/desktop/src-tauri/src/orchestrator/mod.rs b/apps/desktop/src-tauri/src/orchestrator/mod.rs
new file mode 100644
index 0000000000..e0729b0599
--- /dev/null
+++ b/apps/desktop/src-tauri/src/orchestrator/mod.rs
@@ -0,0 +1,148 @@
+use std::env;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use serde::Deserialize;
+
+use crate::paths::home_dir;
+
+pub mod manager;
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrchestratorDaemonState {
+    pub base_url: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrchestratorStateFile {
+    pub daemon: Option<OrchestratorDaemonState>,
+}
+
+pub fn resolve_orchestrator_data_dir() -> String {
+    let env_dir = env::var("OPENWORK_DATA_DIR")
+        .ok()
+        .filter(|value| !value.trim().is_empty());
+
+    if let Some(dir) = env_dir {
+        return dir;
+    }
+
+    if let Some(home) = home_dir() {
+        return home
+            .join(".openwork")
+            .join("openwork-orchestrator")
+            .to_string_lossy()
+            .to_string();
+    }
+
+    ".openwork/openwork-orchestrator".to_string()
+}
+
+fn orchestrator_state_path(data_dir: &str) -> PathBuf {
+    Path::new(data_dir).join("openwork-orchestrator-state.json")
+}
+
+fn orchestrator_auth_path(data_dir: &str) -> PathBuf {
+    Path::new(data_dir).join("openwork-orchestrator-auth.json")
+}
+
+pub fn clear_orchestrator_auth(data_dir: &str) {
+    let path = orchestrator_auth_path(data_dir);
+    let _ = fs::remove_file(path);
+}
+
+pub fn read_orchestrator_state(data_dir: &str) -> Option<OrchestratorStateFile> {
+    let path = orchestrator_state_path(data_dir);
+    let payload = fs::read_to_string(path).ok()?;
+    serde_json::from_str(&payload).ok()
+}
+
+pub fn request_orchestrator_shutdown(data_dir: &str) -> Result<bool, String> {
+    let base_url = read_orchestrator_state(data_dir)
+        .and_then(|state| state.daemon.map(|daemon| daemon.base_url))
+        .map(|url| url.trim().to_string())
+        .filter(|url| !url.is_empty());
+
+    let Some(base_url) = base_url else {
+        return Ok(false);
+    };
+
+    let url = format!("{}/shutdown", base_url.trim_end_matches('/'));
+    let agent = ureq::AgentBuilder::new()
+        .timeout(std::time::Duration::from_millis(1500))
+        .build();
+
+    agent
+        .post(&url)
+        .set("Accept", "application/json")
+        .set("Content-Type", "application/json")
+        .send_string("")
+        .map_err(|e| format!("Failed to request orchestrator shutdown at {url}: {e}"))?;
+
+    Ok(true)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::request_orchestrator_shutdown;
+    use std::fs;
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+    use std::thread;
+    use uuid::Uuid;
+
+    #[test]
+    fn request_shutdown_returns_false_without_state() {
+        let dir = std::env::temp_dir().join(format!(
+            "openwork-orchestrator-shutdown-missing-{}",
+            Uuid::new_v4()
+        ));
+        fs::create_dir_all(&dir).expect("create test dir");
+
+        let stopped = request_orchestrator_shutdown(&dir.to_string_lossy()).expect("request");
+        assert!(!stopped);
+
+        let _ = fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn request_shutdown_posts_to_daemon_endpoint() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind shutdown listener");
+        let port = listener.local_addr().expect("listener addr").port();
+
+        let handle = thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("accept shutdown request");
+            let mut buffer = [0u8; 2048];
+            let bytes = stream.read(&mut buffer).expect("read request");
+            let request = String::from_utf8_lossy(&buffer[..bytes]);
+            assert!(request.starts_with("POST /shutdown "));
+            stream
+                .write_all(
+                    b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+                )
+                .expect("write response");
+        });
+
+        let dir = std::env::temp_dir().join(format!(
+            "openwork-orchestrator-shutdown-state-{}",
+            Uuid::new_v4()
+        ));
+        fs::create_dir_all(&dir).expect("create state dir");
+        let state_path = dir.join("openwork-orchestrator-state.json");
+        fs::write(
+            &state_path,
+            format!(
+                "{{\"daemon\":{{\"pid\":1,\"port\":{port},\"baseUrl\":\"http://127.0.0.1:{port}\",\"startedAt\":1}}}}"
+            ),
+        )
+        .expect("write state file");
+
+        let stopped = request_orchestrator_shutdown(&dir.to_string_lossy()).expect("request");
+        assert!(stopped);
+
+        handle.join().expect("server thread");
+        let _ = fs::remove_dir_all(dir);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/paths.rs b/apps/desktop/src-tauri/src/paths.rs
new file mode 100644
index 0000000000..bf5fd80ac9
--- /dev/null
+++ b/apps/desktop/src-tauri/src/paths.rs
@@ -0,0 +1,143 @@
+use std::env;
+use std::path::{Path, PathBuf};
+
+#[cfg(windows)]
+use std::fs::{self, OpenOptions};
+#[cfg(windows)]
+use std::time::{SystemTime, UNIX_EPOCH};
+#[cfg(windows)]
+use tauri::Manager;
+
+#[cfg(target_os = "macos")]
+const MACOS_APP_SUPPORT_DIR: &str = "Library/Application Support";
+
+pub fn home_dir() -> Option<PathBuf> {
+    if let Ok(home) = env::var("HOME") {
+        if !home.trim().is_empty() {
+            return Some(PathBuf::from(home));
+        }
+    }
+
+    if let Ok(profile) = env::var("USERPROFILE") {
+        if !profile.trim().is_empty() {
+            return Some(PathBuf::from(profile));
+        }
+    }
+
+    None
+}
+
+pub fn candidate_xdg_data_dirs() -> Vec<PathBuf> {
+    let mut candidates = Vec::new();
+    let Some(home) = home_dir() else {
+        return candidates;
+    };
+
+    candidates.push(home.join(".local").join("share"));
+    candidates.push(home.join(".config"));
+
+    #[cfg(target_os = "macos")]
+    {
+        candidates.push(home.join(MACOS_APP_SUPPORT_DIR));
+    }
+
+    candidates
+}
+
+pub fn candidate_xdg_config_dirs() -> Vec<PathBuf> {
+    let mut candidates = Vec::new();
+    let Some(home) = home_dir() else {
+        return candidates;
+    };
+
+    candidates.push(home.join(".config"));
+
+    #[cfg(target_os = "macos")]
+    {
+        candidates.push(home.join(MACOS_APP_SUPPORT_DIR));
+    }
+
+    candidates
+}
+
+pub fn path_entries() -> Vec<PathBuf> {
+    let mut entries = Vec::new();
+    let Some(path) = env::var_os("PATH") else {
+        return entries;
+    };
+
+    entries.extend(env::split_paths(&path));
+    entries
+}
+
+pub fn resolve_in_path(name: &str) -> Option<PathBuf> {
+    for dir in path_entries() {
+        let candidate = dir.join(name);
+        if candidate.is_file() {
+            return Some(candidate);
+        }
+    }
+    None
+}
+
+#[cfg(windows)]
+fn writable_probe_name() -> String {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_nanos())
+        .unwrap_or(0);
+    format!(".openwork-write-test-{}-{nonce}", std::process::id())
+}
+
+#[cfg(windows)]
+fn ensure_dir_writable(path: &Path) -> bool {
+    if fs::create_dir_all(path).is_err() {
+        return false;
+    }
+
+    let probe = path.join(writable_probe_name());
+    match OpenOptions::new().write(true).create_new(true).open(&probe) {
+        Ok(_) => {
+            let _ = fs::remove_file(&probe);
+            true
+        }
+        Err(_) => false,
+    }
+}
+
+pub fn resolve_process_working_dir(
+    app: &tauri::AppHandle,
+    preferred: &Path,
+    fallback_name: &str,
+) -> Result<PathBuf, String> {
+    #[cfg(not(windows))]
+    {
+        let _ = app;
+        let _ = fallback_name;
+        return Ok(preferred.to_path_buf());
+    }
+
+    #[cfg(windows)]
+    {
+        if ensure_dir_writable(preferred) {
+            return Ok(preferred.to_path_buf());
+        }
+
+        let fallback = app
+            .path()
+            .app_local_data_dir()
+            .map_err(|e| format!("Failed to resolve app local data dir: {e}"))?
+            .join("runtime-cwd")
+            .join(fallback_name);
+
+        if ensure_dir_writable(&fallback) {
+            return Ok(fallback);
+        }
+
+        Err(format!(
+            "Failed to find a writable working directory. Preferred: {} Fallback: {}",
+            preferred.display(),
+            fallback.display()
+        ))
+    }
+}
diff --git a/apps/desktop/src-tauri/src/platform/mod.rs b/apps/desktop/src-tauri/src/platform/mod.rs
new file mode 100644
index 0000000000..8def1353d0
--- /dev/null
+++ b/apps/desktop/src-tauri/src/platform/mod.rs
@@ -0,0 +1,9 @@
+#[cfg(not(windows))]
+mod unix;
+#[cfg(windows)]
+mod windows;
+
+#[cfg(not(windows))]
+pub use unix::{command_for_program, configure_hidden};
+#[cfg(windows)]
+pub use windows::{command_for_program, configure_hidden};
diff --git a/apps/desktop/src-tauri/src/platform/unix.rs b/apps/desktop/src-tauri/src/platform/unix.rs
new file mode 100644
index 0000000000..1469895643
--- /dev/null
+++ b/apps/desktop/src-tauri/src/platform/unix.rs
@@ -0,0 +1,8 @@
+use std::path::Path;
+use std::process::Command;
+
+pub fn command_for_program(program: &Path) -> Command {
+    Command::new(program)
+}
+
+pub fn configure_hidden(_command: &mut Command) {}
diff --git a/apps/desktop/src-tauri/src/platform/windows.rs b/apps/desktop/src-tauri/src/platform/windows.rs
new file mode 100644
index 0000000000..48b725c9ae
--- /dev/null
+++ b/apps/desktop/src-tauri/src/platform/windows.rs
@@ -0,0 +1,29 @@
+use std::os::windows::process::CommandExt;
+use std::path::Path;
+use std::process::Command;
+
+const CREATE_NO_WINDOW: u32 = 0x08000000;
+
+pub fn command_for_program(program: &Path) -> Command {
+    if program
+        .extension()
+        .and_then(|ext| ext.to_str())
+        .map(|ext| ext.eq_ignore_ascii_case("cmd"))
+        .unwrap_or(false)
+    {
+        let mut command = Command::new("cmd");
+        command
+            .arg("/C")
+            .arg(program)
+            .creation_flags(CREATE_NO_WINDOW);
+        return command;
+    }
+
+    let mut command = Command::new(program);
+    command.creation_flags(CREATE_NO_WINDOW);
+    command
+}
+
+pub fn configure_hidden(command: &mut Command) {
+    command.creation_flags(CREATE_NO_WINDOW);
+}
diff --git a/apps/desktop/src-tauri/src/types.rs b/apps/desktop/src-tauri/src/types.rs
new file mode 100644
index 0000000000..54c199bf06
--- /dev/null
+++ b/apps/desktop/src-tauri/src/types.rs
@@ -0,0 +1,286 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceOpenworkConfig {
+    pub version: u32,
+    pub workspace: Option<WorkspaceOpenworkWorkspace>,
+    #[serde(default, alias = "authorizedRoots")]
+    pub authorized_roots: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reload: Option<WorkspaceOpenworkReload>,
+}
+
+impl Default for WorkspaceOpenworkConfig {
+    fn default() -> Self {
+        Self {
+            version: 1,
+            workspace: None,
+            authorized_roots: Vec::new(),
+            reload: None,
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceOpenworkReload {
+    pub auto: Option<bool>,
+    pub resume: Option<bool>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceOpenworkWorkspace {
+    pub name: Option<String>,
+    #[serde(default, alias = "createdAt")]
+    pub created_at: Option<u64>,
+    #[serde(default, alias = "preset")]
+    pub preset: Option<String>,
+}
+
+impl WorkspaceOpenworkConfig {
+    pub fn new(workspace_path: &str, preset: &str, now_ms: u64) -> Self {
+        let root = std::path::PathBuf::from(workspace_path);
+        let inferred_name = root
+            .file_name()
+            .and_then(|s| s.to_str())
+            .unwrap_or("Workspace")
+            .to_string();
+
+        Self {
+            version: 1,
+            workspace: Some(WorkspaceOpenworkWorkspace {
+                name: Some(inferred_name),
+                created_at: Some(now_ms),
+                preset: Some(preset.to_string()),
+            }),
+            authorized_roots: vec![workspace_path.to_string()],
+            reload: None,
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum EngineRuntime {
+    Direct,
+}
+
+impl Default for EngineRuntime {
+    fn default() -> Self {
+        EngineRuntime::Direct
+    }
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct EngineInfo {
+    pub running: bool,
+    pub runtime: EngineRuntime,
+    pub base_url: Option<String>,
+    pub project_dir: Option<String>,
+    pub hostname: Option<String>,
+    pub port: Option<u16>,
+    pub opencode_username: Option<String>,
+    pub opencode_password: Option<String>,
+    pub opencode_bin_path: Option<String>,
+    pub opencode_bin_source: Option<String>,
+    pub pid: Option<u32>,
+    pub last_stdout: Option<String>,
+    pub last_stderr: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct OpenworkServerInfo {
+    pub running: bool,
+    pub remote_access_enabled: bool,
+    pub host: Option<String>,
+    pub port: Option<u16>,
+    pub base_url: Option<String>,
+    pub connect_url: Option<String>,
+    pub mdns_url: Option<String>,
+    pub lan_url: Option<String>,
+    pub client_token: Option<String>,
+    pub owner_token: Option<String>,
+    pub host_token: Option<String>,
+    pub managed_opencode_bin_path: Option<String>,
+    pub managed_opencode_bin_source: Option<String>,
+    pub pid: Option<u32>,
+    pub last_stdout: Option<String>,
+    pub last_stderr: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct EngineDoctorResult {
+    pub found: bool,
+    pub in_path: bool,
+    pub resolved_path: Option<String>,
+    pub resolved_source: Option<String>,
+    pub version: Option<String>,
+    pub supports_serve: bool,
+    pub notes: Vec<String>,
+    pub serve_help_status: Option<i32>,
+    pub serve_help_stdout: Option<String>,
+    pub serve_help_stderr: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct ExecResult {
+    pub ok: bool,
+    pub status: i32,
+    pub stdout: String,
+    pub stderr: String,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct OpencodeConfigFile {
+    pub path: String,
+    pub exists: bool,
+    pub content: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct UpdaterEnvironment {
+    pub supported: bool,
+    pub reason: Option<String>,
+    pub executable_path: Option<String>,
+    pub app_bundle_path: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct DesktopBootstrapConfig {
+    pub base_url: String,
+    #[serde(default)]
+    pub api_base_url: Option<String>,
+    #[serde(default)]
+    pub require_signin: bool,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum WorkspaceType {
+    Local,
+    Remote,
+}
+
+impl Default for WorkspaceType {
+    fn default() -> Self {
+        WorkspaceType::Local
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum RemoteType {
+    Opencode,
+    Openwork,
+}
+
+impl Default for RemoteType {
+    fn default() -> Self {
+        RemoteType::Opencode
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceInfo {
+    pub id: String,
+    pub name: String,
+    pub path: String,
+    pub preset: String,
+    #[serde(default)]
+    pub workspace_type: WorkspaceType,
+    #[serde(default)]
+    pub remote_type: Option<RemoteType>,
+    #[serde(default)]
+    pub base_url: Option<String>,
+    #[serde(default)]
+    pub directory: Option<String>,
+    #[serde(default)]
+    pub display_name: Option<String>,
+    #[serde(default)]
+    pub openwork_host_url: Option<String>,
+    #[serde(default)]
+    pub openwork_token: Option<String>,
+    #[serde(default)]
+    pub openwork_client_token: Option<String>,
+    #[serde(default)]
+    pub openwork_host_token: Option<String>,
+    #[serde(default)]
+    pub openwork_workspace_id: Option<String>,
+    #[serde(default)]
+    pub openwork_workspace_name: Option<String>,
+
+    // Sandbox lifecycle metadata (desktop-managed)
+    #[serde(default)]
+    pub sandbox_backend: Option<String>,
+    #[serde(default)]
+    pub sandbox_run_id: Option<String>,
+    #[serde(default)]
+    pub sandbox_container_name: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceList {
+    // UI-selected workspace persisted by desktop.
+    pub selected_id: String,
+    // Runtime/watch target currently followed by the desktop host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub watched_id: Option<String>,
+    pub workspaces: Vec<WorkspaceInfo>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct OpencodeCommand {
+    pub name: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    pub template: String,
+    #[serde(default)]
+    pub agent: Option<String>,
+    #[serde(default)]
+    pub model: Option<String>,
+    #[serde(default)]
+    pub subtask: Option<bool>,
+}
+
+fn default_workspace_state_version() -> u8 {
+    1
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspaceState {
+    #[serde(default = "default_workspace_state_version")]
+    pub version: u8,
+    // Legacy activeId values map to the UI-selected workspace.
+    #[serde(default, alias = "activeId")]
+    pub selected_workspace_id: String,
+    // Legacy watchedWorkspaceId values track the runtime/watch target.
+    #[serde(default, alias = "watchedWorkspaceId")]
+    pub watched_workspace_id: String,
+    pub workspaces: Vec<WorkspaceInfo>,
+}
+
+impl Default for WorkspaceState {
+    fn default() -> Self {
+        Self {
+            version: WORKSPACE_STATE_VERSION,
+            selected_workspace_id: String::new(),
+            watched_workspace_id: String::new(),
+            workspaces: Vec::new(),
+        }
+    }
+}
+
+pub const WORKSPACE_STATE_VERSION: u8 = 5;
diff --git a/apps/desktop/src-tauri/src/updater.rs b/apps/desktop/src-tauri/src/updater.rs
new file mode 100644
index 0000000000..95fc9a084a
--- /dev/null
+++ b/apps/desktop/src-tauri/src/updater.rs
@@ -0,0 +1,51 @@
+use std::path::Path;
+
+use crate::types::UpdaterEnvironment;
+
+fn is_mac_dmg_or_translocated(path: &Path) -> bool {
+    let path_str = path.to_string_lossy();
+    path_str.contains("/Volumes/") || path_str.contains("AppTranslocation")
+}
+
+pub fn updater_environment() -> UpdaterEnvironment {
+    let executable_path = std::env::current_exe().ok();
+
+    let app_bundle_path = executable_path
+        .as_ref()
+        .and_then(|exe| exe.parent())
+        .and_then(|p| p.parent())
+        .and_then(|p| p.parent())
+        .map(|p| p.to_path_buf());
+
+    let mut supported = true;
+    let mut reason: Option<String> = None;
+
+    if let Some(exe) = executable_path.as_ref() {
+        if is_mac_dmg_or_translocated(exe) {
+            supported = false;
+            reason = Some(
+        "OpenWork is running from a mounted disk image. Install it to Applications to enable updates."
+          .to_string(),
+      );
+        }
+    }
+
+    if supported {
+        if let Some(bundle) = app_bundle_path.as_ref() {
+            if is_mac_dmg_or_translocated(bundle) {
+                supported = false;
+                reason = Some(
+          "OpenWork is running from a mounted disk image. Install it to Applications to enable updates."
+            .to_string(),
+        );
+            }
+        }
+    }
+
+    UpdaterEnvironment {
+        supported,
+        reason,
+        executable_path: executable_path.map(|p| p.to_string_lossy().to_string()),
+        app_bundle_path: app_bundle_path.map(|p| p.to_string_lossy().to_string()),
+    }
+}
diff --git a/apps/desktop/src-tauri/src/utils.rs b/apps/desktop/src-tauri/src/utils.rs
new file mode 100644
index 0000000000..cbe3f71ed0
--- /dev/null
+++ b/apps/desktop/src-tauri/src/utils.rs
@@ -0,0 +1,19 @@
+use std::time::{SystemTime, UNIX_EPOCH};
+
+pub fn now_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_millis() as u64
+}
+
+pub fn truncate_output(input: &str, max_chars: usize) -> String {
+    if input.len() <= max_chars {
+        return input.to_string();
+    }
+
+    input
+        .chars()
+        .skip(input.chars().count() - max_chars)
+        .collect()
+}
diff --git a/apps/desktop/src-tauri/src/workspace/commands.rs b/apps/desktop/src-tauri/src/workspace/commands.rs
new file mode 100644
index 0000000000..6d0ed2a43d
--- /dev/null
+++ b/apps/desktop/src-tauri/src/workspace/commands.rs
@@ -0,0 +1,82 @@
+use crate::types::OpencodeCommand;
+
+pub fn sanitize_command_name(raw: &str) -> Option<String> {
+    let trimmed = raw.trim().trim_start_matches('/');
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    let mut out = String::new();
+    for ch in trimmed.chars() {
+        if ch.is_ascii_alphanumeric() || ch == '_' || ch == '-' {
+            out.push(ch);
+        }
+    }
+
+    if out.is_empty() {
+        return None;
+    }
+
+    Some(out)
+}
+
+pub fn serialize_command_frontmatter(command: &OpencodeCommand) -> Result<String, String> {
+    fn escape_yaml_scalar(value: &str) -> String {
+        let mut out = String::with_capacity(value.len() + 2);
+        out.push('"');
+        for ch in value.chars() {
+            match ch {
+                '\\' => out.push_str("\\\\"),
+                '"' => out.push_str("\\\""),
+                '\n' => out.push_str("\\n"),
+                '\r' => out.push_str("\\r"),
+                '\t' => out.push_str("\\t"),
+                _ => out.push(ch),
+            }
+        }
+        out.push('"');
+        out
+    }
+
+    let template = command.template.trim();
+    if template.is_empty() {
+        return Err("command.template is required".to_string());
+    }
+
+    let mut out = String::new();
+    out.push_str("---\n");
+    if let Some(description) = command
+        .description
+        .as_ref()
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+    {
+        out.push_str(&format!(
+            "description: {}\n",
+            escape_yaml_scalar(description)
+        ));
+    }
+    if let Some(agent) = command
+        .agent
+        .as_ref()
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+    {
+        out.push_str(&format!("agent: {}\n", escape_yaml_scalar(agent)));
+    }
+    if let Some(model) = command
+        .model
+        .as_ref()
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+    {
+        out.push_str(&format!("model: {}\n", escape_yaml_scalar(model)));
+    }
+    if command.subtask.unwrap_or(false) {
+        out.push_str("subtask: true\n");
+    }
+    out.push_str("---\n\n");
+    out.push_str(template);
+    out.push('\n');
+    Ok(out)
+}
diff --git a/apps/desktop/src-tauri/src/workspace/files.rs b/apps/desktop/src-tauri/src/workspace/files.rs
new file mode 100644
index 0000000000..7c18d05f27
--- /dev/null
+++ b/apps/desktop/src-tauri/src/workspace/files.rs
@@ -0,0 +1,618 @@
+use std::collections::HashSet;
+use std::fs;
+use std::io::{Cursor, Read};
+use std::path::{Path, PathBuf};
+use std::sync::{LazyLock, Mutex};
+use std::time::Duration;
+
+use zip::ZipArchive;
+
+use crate::types::{OpencodeCommand, WorkspaceOpenworkConfig};
+use crate::utils::now_ms;
+use crate::workspace::commands::{sanitize_command_name, serialize_command_frontmatter};
+
+pub fn merge_plugins(existing: Vec<String>, required: &[&str]) -> Vec<String> {
+    let mut out = existing;
+    for plugin in required {
+        if !out.iter().any(|entry| entry == plugin) {
+            out.push(plugin.to_string());
+        }
+    }
+    out
+}
+
+fn seed_workspace_guide(skill_root: &PathBuf) -> Result<(), String> {
+    let guide_dir = skill_root.join("workspace-guide");
+    if guide_dir.exists() {
+        return Ok(());
+    }
+
+    fs::create_dir_all(&guide_dir)
+        .map_err(|e| format!("Failed to create {}: {e}", guide_dir.display()))?;
+
+    let doc = r#"---
+name: workspace-guide
+description: Workspace guide to introduce OpenWork and onboard new users.
+---
+
+# Welcome to OpenWork
+
+Hi, I'm Ben and this is OpenWork. It's an open-source alternative to Claude's cowork. It helps you work on your files with AI and automate the mundane tasks so you don't have to.
+
+Before we start, use the question tool to ask:
+"Are you more technical or non-technical? I'll tailor the explanation."
+
+## If the person is non-technical
+OpenWork feels like a chat app, but it can safely work with the files you allow. Put files in this workspace and I can summarize them, create new ones, or help organize them.
+
+Try:
+- "Summarize the files in this workspace."
+- "Create a checklist for my week."
+- "Draft a short summary from this document."
+
+## Skills and plugins (simple)
+Skills add new capabilities. Plugins add advanced features like scheduling or browser automation. We can add them later when you're ready.
+
+## If the person is technical
+OpenWork is a GUI for OpenCode. Everything that works in OpenCode works here.
+
+Most reliable setup today:
+1) Install the OpenWork-pinned OpenCode version
+2) Configure providers there (models and API keys)
+3) Come back to OpenWork and start a session
+
+Skills:
+- Install from the Skills tab, or add them to this workspace.
+- Docs: https://opencode.ai/docs/skills
+
+Plugins:
+- Configure in opencode.json or use the Plugins tab.
+- Docs: https://opencode.ai/docs/plugins/
+
+MCP servers:
+- Add external tools via opencode.json.
+- Docs: https://opencode.ai/docs/mcp-servers/
+
+Config reference:
+- Docs: https://opencode.ai/docs/config/
+
+End with two friendly next actions to try in OpenWork."#;
+
+    fs::write(guide_dir.join("SKILL.md"), doc)
+        .map_err(|e| format!("Failed to write SKILL.md: {e}"))?;
+
+    Ok(())
+}
+
+fn seed_get_started_skill(skill_root: &PathBuf) -> Result<(), String> {
+    let skill_dir = skill_root.join("get-started");
+    if skill_dir.exists() {
+        return Ok(());
+    }
+
+    fs::create_dir_all(&skill_dir)
+        .map_err(|e| format!("Failed to create {}: {e}", skill_dir.display()))?;
+
+    let doc = r#"---
+name: get-started
+description: Guide users through the get started setup and Chrome DevTools demo.
+---
+
+## When to use
+- Always load this skill when the user says \"get started\".
+
+## What to do
+- Reply with these four lines, exactly and in order:
+  1) hey there welcome this is openwork
+  2) we've pre-configured you with a couple tools
+  3) Get Started
+  4) write \"hey go on google.com\"
+
+## Then
+- If the user writes \"go on google.com\" (or \"hey go on google.com\"), use the chrome-devtools MCP to open the site.
+- After the navigation completes, reply: \"I'm on <site>\" where <site> is the final URL or page title they asked for.
+"#;
+
+    fs::write(skill_dir.join("SKILL.md"), doc)
+        .map_err(|e| format!("Failed to write SKILL.md: {e}"))?;
+
+    Ok(())
+}
+
+fn seed_openwork_agent(agent_root: &PathBuf) -> Result<(), String> {
+    let agent_path = agent_root.join("openwork.md");
+    if agent_path.exists() {
+        return Ok(());
+    }
+
+    fs::create_dir_all(agent_root)
+        .map_err(|e| format!("Failed to create {}: {e}", agent_root.display()))?;
+
+    let doc = r#"---
+description: OpenWork default agent (safe, mobile-first, self-referential)
+mode: primary
+temperature: 0.2
+---
+
+You are OpenWork.
+
+When the user refers to \"you\", they mean the OpenWork app and the current workspace.
+
+Your job:
+- Help the user work on files safely.
+- Automate repeatable work.
+- Keep behavior portable and reproducible.
+
+Memory (two kinds)
+1) Behavior memory (shareable, in git)
+- `.opencode/skills/**`
+- `.opencode/agents/**`
+- repo docs
+
+2) Private memory (never commit)
+- Tokens, IDs, credentials
+- Local DBs/logs/config files (gitignored)
+- Notion pages/databases (if configured via MCP)
+
+Hard rule: never copy private memory into repo files verbatim. Store only redacted summaries, schemas/templates, and stable pointers.
+
+Reconstruction-first
+- Do not assume env vars or prior setup.
+- If required state is missing, ask one targeted question.
+- After the user provides it, store it in private memory and continue.
+
+Verification-first
+- If you change code, run the smallest meaningful test or smoke check.
+- If you touch UI or remote behavior, validate end-to-end and capture logs on failure.
+
+Incremental adoption loop
+- Do the task once end-to-end.
+- If steps repeat, factor them into a skill.
+- If the work becomes ongoing, create/refine an agent role.
+- If it should run regularly, schedule it and store outputs in private memory.
+
+Specific User Requests
+- If a user asks you to do something with a broswer, like 'open a new tab', check if you have access to the chrome-devtools-mcp - if not, then ask the user to add the 'Control Chrome' extension using the sidebar or via the worker settings.
+"#;
+
+    fs::write(&agent_path, doc)
+        .map_err(|e| format!("Failed to write {}: {e}", agent_path.display()))?;
+
+    Ok(())
+}
+
+const ENTERPRISE_ARCHIVE_URL: &str =
+    "https://github.com/different-ai/openwork-enterprise/archive/refs/heads/main.zip";
+const ENTERPRISE_SEED_MARKER: &str = ".openwork-enterprise-creators";
+static ENTERPRISE_SEED_IN_FLIGHT: LazyLock<Mutex<HashSet<String>>> =
+    LazyLock::new(|| Mutex::new(HashSet::new()));
+
+fn enterprise_seed_marker_path(root: &Path) -> PathBuf {
+    root.join(".opencode").join(ENTERPRISE_SEED_MARKER)
+}
+
+fn spawn_enterprise_creator_skills_seed(root: PathBuf, skill_root: PathBuf) {
+    let marker_path = enterprise_seed_marker_path(&root);
+    if marker_path.exists() {
+        return;
+    }
+
+    let key = root.to_string_lossy().to_string();
+    {
+        let mut in_flight = ENTERPRISE_SEED_IN_FLIGHT
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        if !in_flight.insert(key.clone()) {
+            return;
+        }
+    }
+
+    std::thread::spawn(move || {
+        println!(
+            "[workspace] Seeding creator skills in background for {}",
+            root.display()
+        );
+
+        let result = seed_enterprise_creator_skills(&root, &skill_root);
+        match result {
+            Ok(()) => println!(
+                "[workspace] Finished seeding creator skills for {}",
+                root.display()
+            ),
+            Err(err) => println!(
+                "[workspace] Failed to seed creator skills in background for {}: {err}",
+                root.display()
+            ),
+        }
+
+        let mut in_flight = ENTERPRISE_SEED_IN_FLIGHT
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        in_flight.remove(&key);
+    });
+}
+
+fn seed_enterprise_creator_skills(root: &PathBuf, skill_root: &PathBuf) -> Result<(), String> {
+    let marker_path = enterprise_seed_marker_path(root);
+    if marker_path.exists() {
+        return Ok(());
+    }
+
+    let mut existing = HashSet::new();
+    if let Ok(entries) = fs::read_dir(skill_root) {
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().to_string();
+            if !name.is_empty() {
+                existing.insert(name);
+            }
+        }
+    }
+
+    let agent = ureq::AgentBuilder::new()
+        .redirects(5)
+        .timeout_connect(Duration::from_secs(5))
+        .timeout_read(Duration::from_secs(20))
+        .build();
+    let response = agent
+        .get(ENTERPRISE_ARCHIVE_URL)
+        .call()
+        .map_err(|e| format!("Failed to download enterprise archive: {e}"))?;
+
+    let mut buffer = Vec::new();
+    response
+        .into_reader()
+        .read_to_end(&mut buffer)
+        .map_err(|e| format!("Failed to read enterprise archive: {e}"))?;
+
+    let cursor = Cursor::new(buffer);
+    let mut archive =
+        ZipArchive::new(cursor).map_err(|e| format!("Failed to open enterprise archive: {e}"))?;
+
+    for i in 0..archive.len() {
+        let mut entry = archive
+            .by_index(i)
+            .map_err(|e| format!("Failed to read enterprise entry: {e}"))?;
+        let name = entry.name().to_string();
+        let entry_path = Path::new(&name);
+        if entry_path.components().any(|component| match component {
+            std::path::Component::ParentDir
+            | std::path::Component::RootDir
+            | std::path::Component::Prefix(_) => true,
+            _ => false,
+        }) {
+            continue;
+        }
+
+        let parts: Vec<String> = entry_path
+            .components()
+            .map(|component| component.as_os_str().to_string_lossy().to_string())
+            .collect();
+        if parts.len() < 5 {
+            continue;
+        }
+        if parts[1] != ".opencode" || parts[2] != "skills" {
+            continue;
+        }
+
+        let skill_name = &parts[3];
+        if !skill_name.ends_with("-creator") {
+            continue;
+        }
+        if existing.contains(skill_name) {
+            continue;
+        }
+
+        let dest_root = skill_root.join(skill_name);
+        let mut dest_path = dest_root.clone();
+        for part in parts.iter().skip(4) {
+            dest_path = dest_path.join(part);
+        }
+
+        if name.ends_with('/') {
+            fs::create_dir_all(&dest_path)
+                .map_err(|e| format!("Failed to create {}: {e}", dest_path.display()))?;
+            continue;
+        }
+
+        if let Some(parent) = dest_path.parent() {
+            fs::create_dir_all(parent)
+                .map_err(|e| format!("Failed to create {}: {e}", parent.display()))?;
+        }
+
+        let mut file_buffer = Vec::new();
+        entry
+            .read_to_end(&mut file_buffer)
+            .map_err(|e| format!("Failed to read enterprise entry: {e}"))?;
+        fs::write(&dest_path, file_buffer)
+            .map_err(|e| format!("Failed to write {}: {e}", dest_path.display()))?;
+    }
+
+    fs::write(&marker_path, "seeded\n")
+        .map_err(|e| format!("Failed to write {}: {e}", marker_path.display()))?;
+
+    Ok(())
+}
+
+fn seed_commands(commands_dir: &PathBuf, preset: &str) -> Result<(), String> {
+    if fs::read_dir(commands_dir)
+        .map_err(|e| format!("Failed to read {}: {e}", commands_dir.display()))?
+        .next()
+        .is_some()
+    {
+        return Ok(());
+    }
+
+    let defaults = vec![
+    OpencodeCommand {
+      name: "learn-files".to_string(),
+      description: Some("Safe, practical file workflows".to_string()),
+      template: "Show me how to interact with files in this workspace. Include safe examples for reading, summarizing, and editing.".to_string(),
+      agent: None,
+      model: None,
+      subtask: None,
+    },
+    OpencodeCommand {
+      name: "learn-skills".to_string(),
+      description: Some("How skills work and how to create your own".to_string()),
+      template: "Explain what skills are, how to use them, and how to create a new skill for this workspace.".to_string(),
+      agent: None,
+      model: None,
+      subtask: None,
+    },
+    OpencodeCommand {
+      name: "learn-plugins".to_string(),
+      description: Some("What plugins are and how to install them".to_string()),
+      template: "Explain what plugins are and how to install them in this workspace.".to_string(),
+      agent: None,
+      model: None,
+      subtask: None,
+    },
+  ];
+
+    let mut defaults = defaults;
+    if preset == "starter" {
+        defaults.push(OpencodeCommand {
+            name: "Get Started".to_string(),
+            description: Some("Get started".to_string()),
+            template: "get started".to_string(),
+            agent: None,
+            model: None,
+            subtask: None,
+        });
+    }
+
+    for command in defaults {
+        let Some(name) = sanitize_command_name(&command.name) else {
+            continue;
+        };
+
+        let file_path = commands_dir.join(format!("{name}.md"));
+        if file_path.exists() {
+            continue;
+        }
+
+        let serialized = serialize_command_frontmatter(&command)?;
+        fs::write(&file_path, serialized)
+            .map_err(|e| format!("Failed to write {}: {e}", file_path.display()))?;
+    }
+
+    Ok(())
+}
+
+fn resolve_workspace_opencode_config_path(root: &Path) -> PathBuf {
+    let config_path_jsonc = root.join("opencode.jsonc");
+    let config_path_json = root.join("opencode.json");
+    let hidden_config_path_jsonc = root.join(".opencode").join("opencode.jsonc");
+    let hidden_config_path_json = root.join(".opencode").join("opencode.json");
+
+    if config_path_jsonc.exists() {
+        config_path_jsonc
+    } else if config_path_json.exists() {
+        config_path_json
+    } else if hidden_config_path_jsonc.exists() {
+        hidden_config_path_jsonc
+    } else if hidden_config_path_json.exists() {
+        hidden_config_path_json
+    } else {
+        config_path_jsonc
+    }
+}
+
+pub fn ensure_workspace_files(workspace_path: &str, preset: &str) -> Result<(), String> {
+    let root = PathBuf::from(workspace_path);
+
+    let skill_root = root.join(".opencode").join("skills");
+    fs::create_dir_all(&skill_root)
+        .map_err(|e| format!("Failed to create .opencode/skills: {e}"))?;
+    seed_workspace_guide(&skill_root)?;
+    if preset == "starter" {
+        seed_get_started_skill(&skill_root)?;
+        spawn_enterprise_creator_skills_seed(root.clone(), skill_root.clone());
+    }
+
+    let agents_dir = root.join(".opencode").join("agents");
+    fs::create_dir_all(&agents_dir)
+        .map_err(|e| format!("Failed to create .opencode/agents: {e}"))?;
+    seed_openwork_agent(&agents_dir)?;
+
+    let commands_dir = root.join(".opencode").join("commands");
+    fs::create_dir_all(&commands_dir)
+        .map_err(|e| format!("Failed to create .opencode/commands: {e}"))?;
+    seed_commands(&commands_dir, preset)?;
+
+    let config_path = resolve_workspace_opencode_config_path(&root);
+
+    let config_exists = config_path.exists();
+    let mut config_changed = !config_exists;
+    let mut config: serde_json::Value = if config_exists {
+        let raw = fs::read_to_string(&config_path)
+            .map_err(|e| format!("Failed to read {}: {e}", config_path.display()))?;
+        json5::from_str(&raw).unwrap_or_else(|_| serde_json::json!({}))
+    } else {
+        serde_json::json!({
+          "$schema": "https://opencode.ai/config.json"
+        })
+    };
+
+    if !config.is_object() {
+        config = serde_json::json!({
+          "$schema": "https://opencode.ai/config.json"
+        });
+        config_changed = true;
+    }
+
+    if let Some(obj) = config.as_object_mut() {
+        let current = obj
+            .get("default_agent")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .trim();
+        if current.is_empty() {
+            obj.insert(
+                "default_agent".to_string(),
+                serde_json::Value::String("openwork".to_string()),
+            );
+            config_changed = true;
+        }
+    }
+
+    let required_plugins: Vec<&str> = vec![];
+
+    let should_seed_chrome_mcp = matches!(preset, "starter");
+
+    if !required_plugins.is_empty() {
+        let plugins_value = config
+            .get("plugin")
+            .cloned()
+            .unwrap_or_else(|| serde_json::json!([]));
+
+        let existing_plugins: Vec<String> = match plugins_value {
+            serde_json::Value::Array(arr) => arr
+                .into_iter()
+                .filter_map(|v| v.as_str().map(|s| s.to_string()))
+                .collect(),
+            serde_json::Value::String(s) => vec![s],
+            _ => vec![],
+        };
+
+        let merged = merge_plugins(existing_plugins.clone(), &required_plugins);
+        if merged != existing_plugins {
+            config_changed = true;
+        }
+        if let Some(obj) = config.as_object_mut() {
+            obj.insert(
+                "plugin".to_string(),
+                serde_json::Value::Array(
+                    merged.into_iter().map(serde_json::Value::String).collect(),
+                ),
+            );
+        }
+    }
+
+    if should_seed_chrome_mcp {
+        if let Some(obj) = config.as_object_mut() {
+            let mcp_value = obj
+                .get("mcp")
+                .cloned()
+                .unwrap_or_else(|| serde_json::json!({}));
+
+            let mut mcp_obj = match mcp_value {
+                serde_json::Value::Object(map) => map,
+                _ => serde_json::Map::new(),
+            };
+
+            if !mcp_obj.contains_key("chrome-devtools") {
+                mcp_obj.insert(
+                    "chrome-devtools".to_string(),
+                    serde_json::json!({
+                      "type": "local",
+                      "command": ["npx", "-y", "chrome-devtools-mcp@latest"]
+                    }),
+                );
+                config_changed = true;
+            }
+
+            obj.insert("mcp".to_string(), serde_json::Value::Object(mcp_obj));
+        }
+    }
+
+    if config_changed {
+        fs::write(
+            &config_path,
+            serde_json::to_string_pretty(&config).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| format!("Failed to write {}: {e}", config_path.display()))?;
+    }
+
+    let openwork_path = root.join(".opencode").join("openwork.json");
+    if !openwork_path.exists() {
+        let openwork = WorkspaceOpenworkConfig::new(workspace_path, preset, now_ms());
+
+        fs::create_dir_all(openwork_path.parent().unwrap())
+            .map_err(|e| format!("Failed to create {}: {e}", openwork_path.display()))?;
+
+        fs::write(
+            &openwork_path,
+            serde_json::to_string_pretty(&openwork).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| format!("Failed to write {}: {e}", openwork_path.display()))?;
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_workspace_opencode_config_path;
+    use std::fs;
+    use std::path::PathBuf;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn temp_workspace_root() -> PathBuf {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!("openwork-workspace-files-{unique}"));
+        fs::create_dir_all(&path).unwrap();
+        path
+    }
+
+    #[test]
+    fn prefers_hidden_opencode_jsonc_when_root_config_is_missing() {
+        let root = temp_workspace_root();
+        let hidden = root.join(".opencode").join("opencode.jsonc");
+        fs::create_dir_all(hidden.parent().unwrap()).unwrap();
+        fs::write(&hidden, "{}\n").unwrap();
+
+        let resolved = resolve_workspace_opencode_config_path(&root);
+        assert_eq!(resolved, hidden);
+
+        let _ = fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn prefers_root_config_over_hidden_config() {
+        let root = temp_workspace_root();
+        let root_jsonc = root.join("opencode.jsonc");
+        let hidden = root.join(".opencode").join("opencode.jsonc");
+        fs::create_dir_all(hidden.parent().unwrap()).unwrap();
+        fs::write(&root_jsonc, "{}\n").unwrap();
+        fs::write(&hidden, "{}\n").unwrap();
+
+        let resolved = resolve_workspace_opencode_config_path(&root);
+        assert_eq!(resolved, root_jsonc);
+
+        let _ = fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn falls_back_to_root_jsonc_path_when_no_config_exists() {
+        let root = temp_workspace_root();
+
+        let resolved = resolve_workspace_opencode_config_path(&root);
+        assert_eq!(resolved, root.join("opencode.jsonc"));
+
+        let _ = fs::remove_dir_all(root);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/workspace/mod.rs b/apps/desktop/src-tauri/src/workspace/mod.rs
new file mode 100644
index 0000000000..83063faca9
--- /dev/null
+++ b/apps/desktop/src-tauri/src/workspace/mod.rs
@@ -0,0 +1,4 @@
+pub mod commands;
+pub mod files;
+pub mod state;
+pub mod watch;
diff --git a/apps/desktop/src-tauri/src/workspace/state.rs b/apps/desktop/src-tauri/src/workspace/state.rs
new file mode 100644
index 0000000000..c80552b2d0
--- /dev/null
+++ b/apps/desktop/src-tauri/src/workspace/state.rs
@@ -0,0 +1,360 @@
+use std::fs;
+use std::path::PathBuf;
+
+use sha2::{Digest, Sha256};
+use tauri::Manager;
+
+use crate::paths::home_dir;
+use crate::types::{WorkspaceState, WorkspaceType, WORKSPACE_STATE_VERSION};
+
+pub fn stable_workspace_id(path: &str) -> String {
+    let digest = Sha256::digest(path.as_bytes());
+    let hex = format!("{:x}", digest);
+    format!("ws_{}", &hex[..12])
+}
+
+pub fn normalize_local_workspace_path(path: &str) -> String {
+    let trimmed = path.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+
+    let expanded = if trimmed == "~" {
+        home_dir().unwrap_or_else(|| PathBuf::from(trimmed))
+    } else if trimmed.starts_with("~/") || trimmed.starts_with("~\\") {
+        if let Some(home) = home_dir() {
+            let suffix = trimmed[2..].trim_start_matches(['/', '\\']);
+            home.join(suffix)
+        } else {
+            PathBuf::from(trimmed)
+        }
+    } else {
+        PathBuf::from(trimmed)
+    };
+
+    let normalized = fs::canonicalize(&expanded).unwrap_or(expanded);
+    normalized.to_string_lossy().to_string()
+}
+
+pub fn normalize_local_workspace_path_fast(path: &str) -> String {
+    let trimmed = path.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+
+    let expanded = if trimmed == "~" {
+        home_dir().unwrap_or_else(|| PathBuf::from(trimmed))
+    } else if trimmed.starts_with("~/") || trimmed.starts_with("~\\") {
+        if let Some(home) = home_dir() {
+            let suffix = trimmed[2..].trim_start_matches(['/', '\\']);
+            home.join(suffix)
+        } else {
+            PathBuf::from(trimmed)
+        }
+    } else {
+        PathBuf::from(trimmed)
+    };
+
+    expanded.to_string_lossy().to_string()
+}
+
+pub fn openwork_state_paths(app: &tauri::AppHandle) -> Result<(PathBuf, PathBuf), String> {
+    let data_dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("Failed to resolve app data dir: {e}"))?;
+    let file_path = data_dir.join("openwork-workspaces.json");
+    Ok((data_dir, file_path))
+}
+
+pub fn repair_workspace_state(state: &mut WorkspaceState) {
+    let mut changed_ids = false;
+    let old_selected_workspace_id = state.selected_workspace_id.clone();
+    let old_watched_workspace_id = state.watched_workspace_id.clone();
+    for workspace in state.workspaces.iter_mut() {
+        let next_id = match workspace.workspace_type {
+            WorkspaceType::Local => {
+                // Canonicalize only currently selected/watched entries. Full canonicalization across
+                // every workspace can block startup/switch paths when mounts are slow.
+                let canonicalize_for_active_workspace = workspace.id == old_selected_workspace_id
+                    || workspace.id == old_watched_workspace_id;
+                let normalized = if canonicalize_for_active_workspace {
+                    normalize_local_workspace_path(&workspace.path)
+                } else {
+                    normalize_local_workspace_path_fast(&workspace.path)
+                };
+                if !normalized.is_empty() {
+                    workspace.path = normalized;
+                }
+                stable_workspace_id(&workspace.path)
+            }
+            WorkspaceType::Remote => {
+                if workspace.remote_type == Some(crate::types::RemoteType::Openwork) {
+                    stable_workspace_id_for_openwork(
+                        workspace.openwork_host_url.as_deref().unwrap_or(""),
+                        workspace.openwork_workspace_id.as_deref(),
+                    )
+                } else {
+                    stable_workspace_id_for_remote(
+                        workspace.base_url.as_deref().unwrap_or(""),
+                        workspace.directory.as_deref(),
+                    )
+                }
+            }
+        };
+
+        if workspace.id != next_id {
+            if old_selected_workspace_id == workspace.id {
+                state.selected_workspace_id = next_id.clone();
+            }
+            if old_watched_workspace_id == workspace.id {
+                state.watched_workspace_id = next_id.clone();
+            }
+            workspace.id = next_id;
+            changed_ids = true;
+        }
+    }
+
+    if state.version < WORKSPACE_STATE_VERSION {
+        state.version = WORKSPACE_STATE_VERSION;
+    }
+
+    if changed_ids && state.selected_workspace_id.is_empty() {
+        state.selected_workspace_id = state
+            .workspaces
+            .first()
+            .map(|workspace| workspace.id.clone())
+            .unwrap_or_default();
+    }
+
+    if !state.watched_workspace_id.is_empty()
+        && !state
+            .workspaces
+            .iter()
+            .any(|workspace| workspace.id == state.watched_workspace_id)
+    {
+        state.watched_workspace_id.clear();
+    }
+
+    if state.watched_workspace_id.is_empty() {
+        state.watched_workspace_id = state.selected_workspace_id.clone();
+    }
+}
+
+pub fn load_workspace_state(app: &tauri::AppHandle) -> Result<WorkspaceState, String> {
+    let (_, path) = openwork_state_paths(app)?;
+    if !path.exists() {
+        return Ok(WorkspaceState::default());
+    }
+
+    let raw =
+        fs::read_to_string(&path).map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+    let mut state: WorkspaceState = serde_json::from_str(&raw)
+        .map_err(|e| format!("Failed to parse {}: {e}", path.display()))?;
+    repair_workspace_state(&mut state);
+
+    Ok(state)
+}
+
+pub fn load_workspace_state_fast(app: &tauri::AppHandle) -> Result<WorkspaceState, String> {
+    let (_, path) = openwork_state_paths(app)?;
+    if !path.exists() {
+        return Ok(WorkspaceState::default());
+    }
+
+    let raw =
+        fs::read_to_string(&path).map_err(|e| format!("Failed to read {}: {e}", path.display()))?;
+    serde_json::from_str(&raw).map_err(|e| format!("Failed to parse {}: {e}", path.display()))
+}
+
+pub fn save_workspace_state(app: &tauri::AppHandle, state: &WorkspaceState) -> Result<(), String> {
+    let (dir, path) = openwork_state_paths(app)?;
+    fs::create_dir_all(&dir).map_err(|e| format!("Failed to create {}: {e}", dir.display()))?;
+    fs::write(
+        &path,
+        serde_json::to_string_pretty(state).map_err(|e| e.to_string())?,
+    )
+    .map_err(|e| format!("Failed to write {}: {e}", path.display()))?;
+    Ok(())
+}
+
+pub fn stable_workspace_id_for_remote(base_url: &str, directory: Option<&str>) -> String {
+    let mut key = format!("remote::{base_url}");
+    if let Some(dir) = directory {
+        if !dir.trim().is_empty() {
+            key.push_str("::");
+            key.push_str(dir.trim());
+        }
+    }
+    stable_workspace_id(&key)
+}
+
+pub fn stable_workspace_id_for_openwork(host_url: &str, workspace_id: Option<&str>) -> String {
+    let mut key = format!("openwork::{host_url}");
+    if let Some(id) = workspace_id {
+        if !id.trim().is_empty() {
+            key.push_str("::");
+            key.push_str(id.trim());
+        }
+    }
+    stable_workspace_id(&key)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{normalize_local_workspace_path, repair_workspace_state, stable_workspace_id};
+    use crate::types::{WorkspaceInfo, WorkspaceState, WorkspaceType};
+    use std::fs;
+
+    #[test]
+    fn normalize_local_workspace_path_expands_home_prefix() {
+        let home = crate::paths::home_dir().expect("home dir");
+        let expected = home.join("OpenWork").join("openwork-state-test-expand");
+        let actual = normalize_local_workspace_path("~/OpenWork/openwork-state-test-expand");
+        assert_eq!(actual, expected.to_string_lossy());
+    }
+
+    #[test]
+    fn normalize_local_workspace_path_keeps_canonical_id_stable() {
+        let temp = std::env::temp_dir().join(format!(
+            "openwork-workspace-state-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("clock")
+                .as_nanos()
+        ));
+        let nested = temp.join("starter");
+        fs::create_dir_all(&nested).expect("create temp workspace");
+
+        let raw = format!("{}/../starter", nested.display());
+        let normalized = normalize_local_workspace_path(&raw);
+
+        let canonical = fs::canonicalize(&nested).expect("canonical starter workspace");
+        assert_eq!(normalized, canonical.to_string_lossy());
+        assert_eq!(
+            stable_workspace_id(&normalized),
+            stable_workspace_id(&canonical.to_string_lossy())
+        );
+
+        let _ = fs::remove_dir_all(&temp);
+    }
+
+    #[test]
+    fn repair_workspace_state_preserves_selected_and_watched_ids_independently() {
+        let temp = std::env::temp_dir().join(format!(
+            "openwork-workspace-state-selected-watched-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("clock")
+                .as_nanos()
+        ));
+        let first = temp.join("first");
+        let second = temp.join("second");
+        fs::create_dir_all(&first).expect("create first workspace");
+        fs::create_dir_all(&second).expect("create second workspace");
+
+        let mut state = WorkspaceState {
+            version: 1,
+            selected_workspace_id: "selected-legacy".to_string(),
+            watched_workspace_id: "watched-legacy".to_string(),
+            workspaces: vec![
+                WorkspaceInfo {
+                    id: "selected-legacy".to_string(),
+                    name: "First".to_string(),
+                    path: first.to_string_lossy().to_string(),
+                    preset: "starter".to_string(),
+                    workspace_type: WorkspaceType::Local,
+                    remote_type: None,
+                    base_url: None,
+                    directory: None,
+                    display_name: None,
+                    openwork_host_url: None,
+                    openwork_token: None,
+                    openwork_client_token: None,
+                    openwork_host_token: None,
+                    openwork_workspace_id: None,
+                    openwork_workspace_name: None,
+                    sandbox_backend: None,
+                    sandbox_run_id: None,
+                    sandbox_container_name: None,
+                },
+                WorkspaceInfo {
+                    id: "watched-legacy".to_string(),
+                    name: "Second".to_string(),
+                    path: second.to_string_lossy().to_string(),
+                    preset: "starter".to_string(),
+                    workspace_type: WorkspaceType::Local,
+                    remote_type: None,
+                    base_url: None,
+                    directory: None,
+                    display_name: None,
+                    openwork_host_url: None,
+                    openwork_token: None,
+                    openwork_client_token: None,
+                    openwork_host_token: None,
+                    openwork_workspace_id: None,
+                    openwork_workspace_name: None,
+                    sandbox_backend: None,
+                    sandbox_run_id: None,
+                    sandbox_container_name: None,
+                },
+            ],
+        };
+
+        repair_workspace_state(&mut state);
+
+        assert_ne!(state.selected_workspace_id, state.watched_workspace_id);
+        assert_eq!(state.selected_workspace_id, state.workspaces[0].id);
+        assert_eq!(state.watched_workspace_id, state.workspaces[1].id);
+
+        let _ = fs::remove_dir_all(&temp);
+    }
+
+    #[test]
+    fn repair_workspace_state_defaults_watched_id_to_selected_when_missing() {
+        let temp = std::env::temp_dir().join(format!(
+            "openwork-workspace-state-default-watch-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .expect("clock")
+                .as_nanos()
+        ));
+        let first = temp.join("first");
+        fs::create_dir_all(&first).expect("create workspace");
+
+        let mut state = WorkspaceState {
+            version: 1,
+            selected_workspace_id: "selected-legacy".to_string(),
+            watched_workspace_id: "missing-legacy".to_string(),
+            workspaces: vec![WorkspaceInfo {
+                id: "selected-legacy".to_string(),
+                name: "First".to_string(),
+                path: first.to_string_lossy().to_string(),
+                preset: "starter".to_string(),
+                workspace_type: WorkspaceType::Local,
+                remote_type: None,
+                base_url: None,
+                directory: None,
+                display_name: None,
+                openwork_host_url: None,
+                openwork_token: None,
+                openwork_client_token: None,
+                openwork_host_token: None,
+                openwork_workspace_id: None,
+                openwork_workspace_name: None,
+                sandbox_backend: None,
+                sandbox_run_id: None,
+                sandbox_container_name: None,
+            }],
+        };
+
+        repair_workspace_state(&mut state);
+
+        assert_eq!(state.watched_workspace_id, state.selected_workspace_id);
+
+        let _ = fs::remove_dir_all(&temp);
+    }
+}
diff --git a/apps/desktop/src-tauri/src/workspace/watch.rs b/apps/desktop/src-tauri/src/workspace/watch.rs
new file mode 100644
index 0000000000..5bb7a4ddc3
--- /dev/null
+++ b/apps/desktop/src-tauri/src/workspace/watch.rs
@@ -0,0 +1,174 @@
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use notify::{Event, EventKind, RecommendedWatcher, RecursiveMode, Watcher};
+use serde_json::json;
+use tauri::{AppHandle, Emitter, State};
+
+use crate::types::{WorkspaceInfo, WorkspaceType};
+
+const RELOAD_EVENT: &str = "openwork://reload-required";
+
+#[derive(Default)]
+pub struct WorkspaceWatchState {
+    watcher: Mutex<Option<RecommendedWatcher>>,
+    last_emit: Arc<Mutex<Option<Instant>>>,
+    root: Mutex<Option<PathBuf>>,
+}
+
+fn normalize_path(path: &Path) -> String {
+    path.to_string_lossy().replace('\\', "/")
+}
+
+fn reason_for_path(path: &Path) -> Option<&'static str> {
+    let normalized = normalize_path(path);
+    let lower = normalized.to_lowercase();
+
+    // Ignore OpenWork metadata files — they don't affect the OpenCode engine.
+    if lower.ends_with("/openwork.json") {
+        return None;
+    }
+
+    // Specific .opencode subdirectories map to distinct reasons.
+    if lower.contains("/.opencode/skills/") || lower.ends_with("/.opencode/skills") {
+        return Some("skills");
+    }
+    if lower.contains("/.opencode/agents/") || lower.contains("/.opencode/agent/") {
+        return Some("agents");
+    }
+    if lower.contains("/.opencode/commands/") || lower.contains("/.opencode/command/") {
+        return Some("commands");
+    }
+    if lower.contains("/.opencode/plugins/") {
+        return Some("plugins");
+    }
+
+    // opencode.json / opencode.jsonc at the workspace root or inside .opencode/
+    if lower.ends_with("/opencode.json") || lower.ends_with("/opencode.jsonc") {
+        return Some("config");
+    }
+
+    // AGENTS.md at the workspace root triggers agent reload.
+    if lower.ends_with("/agents.md") && !lower.contains("/.opencode/") {
+        return Some("agents");
+    }
+
+    // Any other file inside .opencode/ that isn't already matched above
+    // (e.g. .opencode/opencode.db, .opencode/opencode.json handled above).
+    // We intentionally do NOT emit for unknown .opencode files to be conservative.
+    None
+}
+
+fn should_emit(last_emit: &Arc<Mutex<Option<Instant>>>) -> bool {
+    let mut guard = last_emit
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    let now = Instant::now();
+    if let Some(previous) = *guard {
+        if now.duration_since(previous) < Duration::from_millis(750) {
+            return false;
+        }
+    }
+    *guard = Some(now);
+    true
+}
+
+pub fn update_workspace_watch(
+    app: &AppHandle,
+    state: State<WorkspaceWatchState>,
+    workspace: Option<&WorkspaceInfo>,
+) -> Result<(), String> {
+    let mut watcher_guard = state
+        .watcher
+        .lock()
+        .map_err(|_| "Failed to lock workspace watcher".to_string())?;
+    *watcher_guard = None;
+    *state
+        .root
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner()) = None;
+
+    let Some(active) = workspace else {
+        return Ok(());
+    };
+    if active.workspace_type != WorkspaceType::Local {
+        return Ok(());
+    }
+
+    let root = PathBuf::from(active.path.trim());
+    if root.as_os_str().is_empty() {
+        return Ok(());
+    }
+
+    let app_handle = app.clone();
+    let last_emit = state.last_emit.clone();
+    let mut watcher = notify::recommended_watcher(move |result| {
+        let event: Event = match result {
+            Ok(event) => event,
+            Err(_) => return,
+        };
+
+        match event.kind {
+            EventKind::Create(_) | EventKind::Remove(_) => {}
+            EventKind::Modify(mod_kind) => match mod_kind {
+                notify::event::ModifyKind::Data(_)
+                | notify::event::ModifyKind::Name(_)
+                | notify::event::ModifyKind::Any => {}
+                _ => return,
+            },
+            _ => return,
+        }
+
+        for path in event.paths {
+            if path.is_dir() {
+                continue;
+            }
+
+            let Some(reason) = reason_for_path(&path) else {
+                continue;
+            };
+
+            let lower = path.to_string_lossy().to_lowercase();
+            if lower.ends_with(".ds_store")
+                || lower.ends_with("desktop.ini")
+                || lower.ends_with(".localized")
+                || lower.ends_with(".db")
+                || lower.ends_with(".db-journal")
+                || lower.ends_with(".db-wal")
+                || lower.ends_with(".db-shm")
+            {
+                continue;
+            }
+
+            if !should_emit(&last_emit) {
+                break;
+            }
+            let payload = json!({
+                "reason": reason,
+                "path": path.to_string_lossy().to_string(),
+            });
+            let _ = app_handle.emit(RELOAD_EVENT, payload);
+            break;
+        }
+    })
+    .map_err(|e| format!("Failed to create workspace watcher: {e}"))?;
+
+    watcher
+        .watch(&root, RecursiveMode::NonRecursive)
+        .map_err(|e| format!("Failed to watch workspace root: {e}"))?;
+
+    let opencode_dir = root.join(".opencode");
+    if opencode_dir.exists() {
+        watcher
+            .watch(&opencode_dir, RecursiveMode::Recursive)
+            .map_err(|e| format!("Failed to watch .opencode: {e}"))?;
+    }
+
+    *state
+        .root
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner()) = Some(root);
+    *watcher_guard = Some(watcher);
+    Ok(())
+}
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
new file mode 100644
index 0000000000..1148d2a05b
--- /dev/null
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -0,0 +1,62 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "OpenWork",
+  "version": "0.13.3",
+  "identifier": "com.differentai.openwork",
+  "build": {
+    "beforeDevCommand": "node ./scripts/tauri-before-dev.mjs",
+    "beforeBuildCommand": "node ./scripts/tauri-before-build.mjs",
+    "devUrl": "http://localhost:5173",
+    "frontendDist": "../../app/dist"
+  },
+  "app": {
+    "windows": [
+      {
+        "title": "OpenWork",
+        "width": 1180,
+        "height": 820,
+        "resizable": true
+      }
+    ],
+    "security": {
+      "csp": null
+    }
+  },
+  "bundle": {
+    "createUpdaterArtifacts": true,
+    "macOS": {
+      "entitlements": "./entitlements.plist"
+    },
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ],
+    "resources": {
+      "sidecars/versions.json": "versions.json"
+    },
+    "externalBin": [
+      "sidecars/opencode",
+      "sidecars/openwork-server",
+      "sidecars/openwork-orchestrator",
+      "sidecars/chrome-devtools-mcp"
+    ]
+  },
+  "plugins": {
+    "deep-link": {
+      "desktop": {
+        "schemes": [
+          "openwork"
+        ]
+      }
+    },
+    "updater": {
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDUwNDdCNTAwMTcxNUUxQTQKUldTazRSVVhBTFZIVUpNRi9OQnNRaElZY1NUWUQxS1ZJOTFUeUdPd2d6ZnFmMW5QV2xJQ1hXTTkK",
+      "endpoints": [
+        "https://github.com/different-ai/openwork/releases/latest/download/latest.json"
+      ]
+    }
+  }
+}
diff --git a/apps/desktop/src-tauri/tauri.dev.conf.json b/apps/desktop/src-tauri/tauri.dev.conf.json
new file mode 100644
index 0000000000..eef16f1692
--- /dev/null
+++ b/apps/desktop/src-tauri/tauri.dev.conf.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "OpenWork Dev",
+  "identifier": "com.differentai.openwork.dev",
+  "bundle": {
+    "icon": [
+      "../resources/icons/dev/32x32.png",
+      "../resources/icons/dev/128x128.png",
+      "../resources/icons/dev/128x128@2x.png",
+      "../resources/icons/dev/icon-dev.icns"
+    ],
+    "macOS": {
+      "bundleName": "OpenWork - Dev",
+      "infoPlist": "./Info.dev.plist"
+    }
+  },
+  "app": {
+    "windows": [
+      {
+        "title": "OpenWork - Dev",
+        "width": 1180,
+        "height": 820,
+        "resizable": true
+      }
+    ]
+  },
+  "plugins": {
+    "deep-link": {
+      "desktop": {
+        "schemes": [
+          "openwork-dev"
+        ]
+      }
+    }
+  }
+}
diff --git a/apps/desktop/tsconfig.electron.json b/apps/desktop/tsconfig.electron.json
new file mode 100644
index 0000000000..1fc8fb1857
--- /dev/null
+++ b/apps/desktop/tsconfig.electron.json
@@ -0,0 +1,22 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "allowJs": true,
+    "checkJs": true,
+    "noEmit": true,
+    "strict": false,
+    "skipLibCheck": true,
+    "typeRoots": [
+      "../server/node_modules/@types"
+    ],
+    "types": ["node"]
+  },
+  "include": [
+    "electron/**/*.mjs",
+    "scripts/check-electron-bridge.mjs",
+    "scripts/electron-build.mjs",
+    "scripts/electron-dev.mjs"
+  ]
+}
diff --git a/apps/opencode-router/.env.example b/apps/opencode-router/.env.example
new file mode 100644
index 0000000000..ac92d9ba22
--- /dev/null
+++ b/apps/opencode-router/.env.example
@@ -0,0 +1,24 @@
+OPENCODE_URL=http://127.0.0.1:4096
+OPENCODE_DIRECTORY=
+OPENCODE_SERVER_USERNAME=
+OPENCODE_SERVER_PASSWORD=
+
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_ENABLED=true
+
+SLACK_BOT_TOKEN=
+SLACK_APP_TOKEN=
+SLACK_ENABLED=true
+
+OPENCODE_ROUTER_DATA_DIR=~/.openwork/opencode-router
+OPENCODE_ROUTER_DB_PATH=~/.openwork/opencode-router/opencode-router.db
+OPENCODE_ROUTER_CONFIG_PATH=~/.openwork/opencode-router/opencode-router.json
+# Preferred health server port override
+OPENCODE_ROUTER_HEALTH_PORT=3005
+# Alias for OPENCODE_ROUTER_HEALTH_PORT (optional)
+PORT=
+TOOL_UPDATES_ENABLED=false
+GROUPS_ENABLED=false
+TOOL_OUTPUT_LIMIT=1200
+PERMISSION_MODE=allow
+LOG_LEVEL=info
diff --git a/apps/opencode-router/README.md b/apps/opencode-router/README.md
new file mode 100644
index 0000000000..149e3d0d11
--- /dev/null
+++ b/apps/opencode-router/README.md
@@ -0,0 +1,188 @@
+# opencode-router
+
+Simple Slack + Telegram bridge + directory router for a running `opencode` server.
+
+Runtime requirement: Bun 1.3+ (`bun --version`).
+
+## Install + Run
+
+One-command install (recommended):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/different-ai/openwork/dev/apps/opencode-router/install.sh | bash
+```
+
+Install from npm:
+
+```bash
+npm install -g opencode-router
+```
+
+Quick run without global install:
+
+```bash
+npx --yes opencode-router --help
+```
+
+Then configure identities and start.
+
+1) One-command setup (installs deps, builds, creates `.env` if missing):
+
+```bash
+pnpm -C apps/opencode-router setup
+```
+
+2) (Optional) Fill in `apps/opencode-router/.env` (see `.env.example`).
+
+Required:
+- `OPENCODE_URL`
+- `OPENCODE_DIRECTORY`
+
+Recommended:
+- `OPENCODE_SERVER_USERNAME`
+- `OPENCODE_SERVER_PASSWORD`
+
+3) Run the router:
+
+```bash
+opencode-router start
+```
+
+## Telegram
+
+Telegram support is configured via identities. You can either:
+- Use env vars for a single bot: `TELEGRAM_BOT_TOKEN=...`
+  - Or add multiple bots to the config file (`opencode-router.json`) using the CLI:
+
+```bash
+opencode-router telegram add <token> --id default
+opencode-router telegram list
+```
+
+Important for direct sends and bindings:
+- Telegram targets must use numeric `chat_id` values.
+- `@username` values are not valid direct `peerId` targets for router sends.
+- If a user has not started a chat with the bot yet, Telegram may return `chat not found`.
+- Private Telegram identities can require first-chat pairing with `/pair <code>` before commands are accepted.
+
+## Slack (Socket Mode)
+
+Slack support uses Socket Mode and replies in threads when @mentioned in channels.
+
+1) Create a Slack app.
+2) Enable Socket Mode and generate an app token (`xapp-...`).
+3) Add bot token scopes:
+   - `chat:write`
+   - `app_mentions:read`
+   - `im:history`
+   - `files:read`
+   - `files:write`
+4) Subscribe to events (bot events):
+   - `app_mention`
+   - `message.im`
+5) Set env vars (or save via `opencode-router slack add ...`):
+    - `SLACK_BOT_TOKEN=xoxb-...`
+    - `SLACK_APP_TOKEN=xapp-...`
+    - `SLACK_ENABLED=true`
+
+To add multiple Slack apps:
+
+```bash
+opencode-router slack add <xoxb> <xapp> --id default
+opencode-router slack list
+```
+
+## Identity-Scoped Routing
+
+The router routes messages based on `(channel, identityId, peerId) -> directory` bindings.
+
+```bash
+opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
+opencode-router bindings list
+```
+
+## Health Server (Local HTTP)
+
+The router can expose a small local HTTP server for health/config and simple message dispatch.
+
+- `OPENCODE_ROUTER_HEALTH_PORT` controls the port (OpenWork defaults to a random free port when using `openwork`).
+- `PORT` is also accepted as a convenience if the above are unset.
+- `OPENCODE_ROUTER_HEALTH_HOST` controls bind host (default: `127.0.0.1`).
+
+Send a message to all peers bound to a directory:
+
+```bash
+curl -sS "http://127.0.0.1:${OPENCODE_ROUTER_HEALTH_PORT:-3005}/send" \
+  -H 'Content-Type: application/json' \
+  -d '{"channel":"telegram","directory":"/path/to/workdir","text":"hello"}'
+```
+
+Send text + media in one request:
+
+```bash
+curl -sS "http://127.0.0.1:${OPENCODE_ROUTER_HEALTH_PORT:-3005}/send" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "channel":"slack",
+    "peerId":"D12345678",
+    "text":"Here is the export",
+    "parts":[
+      {"type":"file","filePath":"./artifacts/report.pdf"},
+      {"type":"image","filePath":"./artifacts/plot.png","caption":"latest trend"}
+    ]
+  }'
+```
+
+Supported media part types:
+- `image`
+- `audio`
+- `file`
+
+Each media part accepts:
+- `filePath` (absolute path, or relative to the send directory/workspace root)
+- optional `caption`
+- optional `filename`
+- optional `mimeType`
+
+## Commands
+
+```bash
+opencode-router start
+opencode-router status
+
+opencode-router telegram list
+opencode-router telegram add <token> --id default
+
+opencode-router slack list
+opencode-router slack add <xoxb> <xapp> --id default
+
+opencode-router bindings list
+opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
+
+opencode-router send --channel telegram --identity default --to <chatId> --message "hello"
+opencode-router send --channel telegram --identity default --to <chatId> --image ./plot.png --caption "plot"
+opencode-router send --channel slack --identity default --to D123 --file ./report.pdf
+```
+
+## Defaults
+
+- SQLite at `~/.openwork/opencode-router/opencode-router.db` unless overridden.
+- Config stored at `~/.openwork/opencode-router/opencode-router.json` (created by `opencode-router` or `pnpm -C apps/opencode-router setup`).
+- Group chats are disabled unless `GROUPS_ENABLED=true`.
+
+## Tests
+
+`test:smoke` requires a running `opencode` server (default: `http://127.0.0.1:4096`).
+
+```bash
+opencode serve --port 4096 --hostname 127.0.0.1
+pnpm -C apps/opencode-router test:smoke
+```
+
+Other test suites:
+
+```bash
+pnpm -C apps/opencode-router test:unit
+pnpm -C apps/opencode-router test:cli
+pnpm -C apps/opencode-router test:npx
+```
diff --git a/apps/opencode-router/bin/opencode-router.mjs b/apps/opencode-router/bin/opencode-router.mjs
new file mode 100755
index 0000000000..6b6f9d1116
--- /dev/null
+++ b/apps/opencode-router/bin/opencode-router.mjs
@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { basename } from "node:path";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = fileURLToPath(new URL("..", import.meta.url));
+const args = process.argv.slice(2);
+
+const compiledBinaryName = process.platform === "win32" ? "opencode-router.exe" : "opencode-router";
+const compiledBinary = fileURLToPath(new URL(`./dist/bin/${compiledBinaryName}`, `${new URL("../", import.meta.url)}`));
+const builtCli = fileURLToPath(new URL("./dist/cli.js", `${new URL("../", import.meta.url)}`));
+const sourceCli = fileURLToPath(new URL("./src/cli.ts", `${new URL("../", import.meta.url)}`));
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, { stdio: "inherit" });
+  if (result.error) {
+    if (result.error.code === "ENOENT") {
+      console.error(`Missing runtime dependency: ${command}`);
+      process.exit(1);
+    }
+    throw result.error;
+  }
+  process.exit(result.status ?? 1);
+}
+
+if (existsSync(compiledBinary)) {
+  run(compiledBinary, args);
+}
+
+if (existsSync(builtCli)) {
+  run("bun", [builtCli, ...args]);
+}
+
+if (existsSync(sourceCli)) {
+  run("bun", [sourceCli, ...args]);
+}
+
+console.error(
+  `Unable to find an opencode-router entrypoint in ${basename(packageRoot)}. Build the package or run it from a source checkout with Bun available.`,
+);
+process.exit(1);
diff --git a/apps/opencode-router/install.sh b/apps/opencode-router/install.sh
new file mode 100644
index 0000000000..7e8db8ae26
--- /dev/null
+++ b/apps/opencode-router/install.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+OPENCODE_ROUTER_REF="${OPENCODE_ROUTER_REF:-dev}"
+OPENCODE_ROUTER_REPO="${OPENCODE_ROUTER_REPO:-https://github.com/different-ai/openwork.git}"
+OPENCODE_ROUTER_INSTALL_DIR="${OPENCODE_ROUTER_INSTALL_DIR:-$HOME/.openwork/opencode-router/openwork}"
+OPENCODE_ROUTER_BIN_DIR="${OPENCODE_ROUTER_BIN_DIR:-$HOME/.local/bin}"
+OPENCODE_ROUTER_INSTALL_METHOD="${OPENCODE_ROUTER_INSTALL_METHOD:-npm}"
+
+usage() {
+  cat <<'EOF'
+opencode-router installer
+
+Requires: bun (runtime) and node/npm.
+
+Environment variables:
+  OPENCODE_ROUTER_INSTALL_DIR  Install directory (default: ~/.openwork/opencode-router/openwork)
+  OPENCODE_ROUTER_REPO         Git repo (default: https://github.com/different-ai/openwork.git)
+  OPENCODE_ROUTER_REF          Git ref/branch (default: dev)
+  OPENCODE_ROUTER_BIN_DIR      Bin directory for shims (default: ~/.local/bin)
+  OPENCODE_ROUTER_INSTALL_METHOD  Install method: npm|git (default: npm)
+
+Example:
+  OPENCODE_ROUTER_INSTALL_DIR=~/opencode-router curl -fsSL https://raw.githubusercontent.com/different-ai/openwork/dev/apps/opencode-router/install.sh | bash
+EOF
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+
+require_bin() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing $1. Please install it and retry." >&2
+    exit 1
+  fi
+}
+
+require_bin node
+require_bin bun
+
+CUSTOM_SHIM_CREATED=false
+
+if [[ "$OPENCODE_ROUTER_INSTALL_METHOD" == "npm" ]]; then
+  require_bin npm
+  echo "Installing opencode-router via npm..."
+  npm install -g opencode-router
+else
+  require_bin git
+  if ! command -v pnpm >/dev/null 2>&1; then
+    if command -v corepack >/dev/null 2>&1; then
+      corepack enable >/dev/null 2>&1 || true
+      corepack prepare pnpm@10.27.0 --activate
+    else
+      echo "pnpm is required. Install pnpm or enable corepack, then retry." >&2
+      exit 1
+    fi
+  fi
+
+  if [[ -d "$OPENCODE_ROUTER_INSTALL_DIR/.git" ]]; then
+    echo "Updating opencode-router source in $OPENCODE_ROUTER_INSTALL_DIR"
+    git -C "$OPENCODE_ROUTER_INSTALL_DIR" fetch origin --prune
+    if git -C "$OPENCODE_ROUTER_INSTALL_DIR" show-ref --verify --quiet "refs/remotes/origin/$OPENCODE_ROUTER_REF"; then
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" checkout -B "$OPENCODE_ROUTER_REF" "origin/$OPENCODE_ROUTER_REF"
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" pull --ff-only origin "$OPENCODE_ROUTER_REF"
+    else
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" checkout -f
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" pull --ff-only
+    fi
+  else
+    echo "Cloning opencode-router source to $OPENCODE_ROUTER_INSTALL_DIR"
+    mkdir -p "$OPENCODE_ROUTER_INSTALL_DIR"
+    git clone --depth 1 "$OPENCODE_ROUTER_REPO" "$OPENCODE_ROUTER_INSTALL_DIR"
+    if git -C "$OPENCODE_ROUTER_INSTALL_DIR" show-ref --verify --quiet "refs/remotes/origin/$OPENCODE_ROUTER_REF"; then
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" checkout -B "$OPENCODE_ROUTER_REF" "origin/$OPENCODE_ROUTER_REF"
+    fi
+  fi
+
+  if [[ ! -d "$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router" ]]; then
+    echo "opencode-router package not found on ref '$OPENCODE_ROUTER_REF'. Trying dev/main..." >&2
+    git -C "$OPENCODE_ROUTER_INSTALL_DIR" fetch origin --prune
+    if git -C "$OPENCODE_ROUTER_INSTALL_DIR" show-ref --verify --quiet refs/remotes/origin/dev; then
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" checkout -B dev origin/dev
+    elif git -C "$OPENCODE_ROUTER_INSTALL_DIR" show-ref --verify --quiet refs/remotes/origin/main; then
+      git -C "$OPENCODE_ROUTER_INSTALL_DIR" checkout -B main origin/main
+    fi
+  fi
+
+  if [[ ! -d "$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router" ]]; then
+    echo "opencode-router package not found after checkout. Aborting." >&2
+    exit 1
+  fi
+
+  echo "Installing dependencies..."
+  pnpm -C "$OPENCODE_ROUTER_INSTALL_DIR" install
+
+  echo "Building opencode-router..."
+  pnpm -C "$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router" build
+
+  ENV_PATH="$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router/.env"
+  ENV_EXAMPLE="$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router/.env.example"
+  if [[ ! -f "$ENV_PATH" ]]; then
+    if [[ -f "$ENV_EXAMPLE" ]]; then
+      cp "$ENV_EXAMPLE" "$ENV_PATH"
+      echo "Created $ENV_PATH"
+    else
+      cat <<EOF > "$ENV_PATH"
+OPENCODE_URL=http://127.0.0.1:4096
+OPENCODE_DIRECTORY=
+TELEGRAM_BOT_TOKEN=
+SLACK_BOT_TOKEN=
+SLACK_APP_TOKEN=
+EOF
+      echo "Created $ENV_PATH (minimal)"
+    fi
+  fi
+
+  mkdir -p "$OPENCODE_ROUTER_BIN_DIR"
+  cat <<EOF > "$OPENCODE_ROUTER_BIN_DIR/opencode-router"
+#!/usr/bin/env bash
+set -euo pipefail
+bun "$OPENCODE_ROUTER_INSTALL_DIR/apps/opencode-router/dist/cli.js" "$@"
+EOF
+  chmod 755 "$OPENCODE_ROUTER_BIN_DIR/opencode-router"
+  CUSTOM_SHIM_CREATED=true
+fi
+
+if [[ "$CUSTOM_SHIM_CREATED" == "true" ]] && ! echo ":$PATH:" | grep -q ":$OPENCODE_ROUTER_BIN_DIR:"; then
+  shell_name="$(basename "${SHELL:-}" 2>/dev/null || true)"
+  case "$shell_name" in
+    fish)
+      echo "Add to PATH (fish): set -Ux PATH $OPENCODE_ROUTER_BIN_DIR \$PATH"
+      ;;
+    zsh)
+      echo "Add to PATH (zsh):  echo 'export PATH=\"$OPENCODE_ROUTER_BIN_DIR:\$PATH\"' >> ~/.zshrc"
+      ;;
+    bash)
+      echo "Add to PATH (bash): echo 'export PATH=\"$OPENCODE_ROUTER_BIN_DIR:\$PATH\"' >> ~/.bashrc"
+      ;;
+    *)
+      echo "Add to PATH: export PATH=\"$OPENCODE_ROUTER_BIN_DIR:\$PATH\""
+      ;;
+  esac
+fi
+
+cat <<EOF
+
+opencode-router installed.
+
+Next steps:
+1) Verify install: opencode-router --help
+2) Add Telegram identity: opencode-router telegram add <token> --id default
+3) Start router: opencode-router start
+EOF
diff --git a/apps/opencode-router/package.json b/apps/opencode-router/package.json
new file mode 100644
index 0000000000..86021a22ce
--- /dev/null
+++ b/apps/opencode-router/package.json
@@ -0,0 +1,60 @@
+{
+  "name": "opencode-router",
+  "version": "0.13.3",
+  "description": "opencode-router: Slack + Telegram bridge + directory routing for a running opencode server",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "opencode-router": "bin/opencode-router.mjs"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/different-ai/openwork.git",
+    "directory": "apps/opencode-router"
+  },
+  "keywords": [
+    "opencode",
+    "router",
+    "slack",
+    "telegram",
+    "bridge",
+    "bot"
+  ],
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    ".env.example",
+    "install.sh"
+  ],
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 bun src/cli.ts",
+    "build": "tsc -p tsconfig.json",
+    "prepack": "node -e \"const fs=require('fs'); fs.rmSync('dist', { recursive: true, force: true });\" && tsc -p tsconfig.json",
+    "build:bin": "bun ./script/build.ts --outdir dist/bin --filename opencode-router",
+    "build:bin:all": "bun ./script/build.ts --outdir dist/bin --filename opencode-router --target bun-darwin-arm64 --target bun-darwin-x64 --target bun-linux-x64 --target bun-linux-arm64 --target bun-windows-x64",
+    "build:binary": "bun ./script/build.ts --outdir dist/bin --filename opencode-router",
+    "start": "bun dist/cli.js start",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "setup": "bun scripts/setup.mjs",
+    "test:unit": "pnpm build && bun test test/*.test.js",
+    "test:smoke": "bun scripts/smoke.mjs",
+    "test:cli": "pnpm build && bun scripts/test-cli.mjs",
+    "test:npx": "bun scripts/test-npx.mjs"
+  },
+  "dependencies": {
+    "@opencode-ai/sdk": "^1.4.9",
+    "@slack/socket-mode": "^2.0.5",
+    "@slack/web-api": "^7.13.0",
+    "commander": "^12.1.0",
+    "dotenv": "^16.4.7",
+    "grammy": "^1.39.3",
+    "pino": "^9.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "bun-types": "^1.3.6",
+    "typescript": "^5.6.3"
+  }
+}
diff --git a/apps/opencode-router/script/build.ts b/apps/opencode-router/script/build.ts
new file mode 100644
index 0000000000..8e63b1d7a3
--- /dev/null
+++ b/apps/opencode-router/script/build.ts
@@ -0,0 +1,121 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const bunRuntime = (globalThis as typeof globalThis & {
+  Bun?: {
+    build?: (...args: any[]) => Promise<any>;
+    argv?: string[];
+  };
+}).Bun;
+
+if (!bunRuntime?.build || !bunRuntime.argv) {
+  console.error("This script must be run with Bun.");
+  process.exit(1);
+}
+
+const bun = bunRuntime as { build: (...args: any[]) => Promise<any>; argv: string[] };
+
+type BuildOptions = {
+  targets: string[];
+  outdir: string;
+  filename: string;
+};
+
+function readArgs(argv: string[]): BuildOptions {
+  const options: BuildOptions = {
+    targets: [],
+    outdir: resolve("dist", "bin"),
+    filename: "opencode-router",
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value) continue;
+
+    if (value === "--target") {
+      const next = argv[index + 1];
+      if (next) {
+        options.targets.push(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--target=")) {
+      const next = value.slice("--target=".length).trim();
+      if (next) options.targets.push(next);
+      continue;
+    }
+
+    if (value === "--outdir") {
+      const next = argv[index + 1];
+      if (next) {
+        options.outdir = resolve(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--outdir=")) {
+      const next = value.slice("--outdir=".length).trim();
+      if (next) options.outdir = resolve(next);
+      continue;
+    }
+
+    if (value === "--filename") {
+      const next = argv[index + 1];
+      if (next) {
+        options.filename = next;
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--filename=")) {
+      const next = value.slice("--filename=".length).trim();
+      if (next) options.filename = next;
+    }
+  }
+
+  return options;
+}
+
+function outputName(filename: string, target?: string) {
+  const needsExe = target ? target.includes("windows") : process.platform === "win32";
+  const suffix = target ? `-${target}` : "";
+  const ext = needsExe ? ".exe" : "";
+  return `${filename}${suffix}${ext}`;
+}
+
+async function buildOnce(entrypoint: string, outdir: string, filename: string, target?: string) {
+  mkdirSync(outdir, { recursive: true });
+  const outfile = join(outdir, outputName(filename, target));
+
+  const args = ["build", entrypoint, "--compile", "--outfile", outfile];
+  const pkgPath = resolve("package.json");
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { version?: string };
+    if (typeof pkg.version === "string" && pkg.version.trim()) {
+      args.push("--define", `__OPENCODE_ROUTER_VERSION__=\"${pkg.version.trim()}\"`);
+    }
+  } catch {
+    // ignore
+  }
+  if (target) {
+    args.push("--target", target);
+  }
+
+  const result = spawnSync("bun", args, { stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+const options = readArgs(bun.argv.slice(2));
+const entrypoint = resolve("src", "cli.ts");
+const targets = options.targets.length ? options.targets : [undefined];
+
+for (const target of targets) {
+  await buildOnce(entrypoint, options.outdir, options.filename, target);
+}
diff --git a/apps/opencode-router/scripts/setup.mjs b/apps/opencode-router/scripts/setup.mjs
new file mode 100644
index 0000000000..2a1504592f
--- /dev/null
+++ b/apps/opencode-router/scripts/setup.mjs
@@ -0,0 +1,26 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(scriptDir, "..");
+const rootDir = path.resolve(packageDir, "..", "..");
+
+const envPath = path.join(packageDir, ".env");
+const envExamplePath = path.join(packageDir, ".env.example");
+
+const install = spawnSync("pnpm", ["install"], { cwd: rootDir, stdio: "inherit" });
+if (install.status !== 0) {
+  process.exit(install.status ?? 1);
+}
+
+const build = spawnSync("pnpm", ["-C", packageDir, "build"], { cwd: rootDir, stdio: "inherit" });
+if (build.status !== 0) {
+  process.exit(build.status ?? 1);
+}
+
+if (!existsSync(envPath) && existsSync(envExamplePath)) {
+  copyFileSync(envExamplePath, envPath);
+  console.log("Created .env from .env.example");
+}
diff --git a/apps/opencode-router/scripts/smoke.mjs b/apps/opencode-router/scripts/smoke.mjs
new file mode 100644
index 0000000000..11ed1e00c4
--- /dev/null
+++ b/apps/opencode-router/scripts/smoke.mjs
@@ -0,0 +1,51 @@
+import assert from "node:assert/strict";
+import { Buffer } from "node:buffer";
+
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+
+const args = new Set(process.argv.slice(2));
+const requireReply = args.has("--reply");
+
+const baseUrl = process.env.OPENCODE_URL ?? "http://127.0.0.1:4096";
+const directory = process.env.OPENCODE_DIRECTORY ?? process.cwd();
+
+const headers = {};
+if (process.env.OPENCODE_SERVER_USERNAME && process.env.OPENCODE_SERVER_PASSWORD) {
+  const token = Buffer.from(
+    `${process.env.OPENCODE_SERVER_USERNAME}:${process.env.OPENCODE_SERVER_PASSWORD}`,
+  ).toString("base64");
+  headers.Authorization = `Basic ${token}`;
+}
+
+const client = createOpencodeClient({
+  baseUrl,
+  directory,
+  headers: Object.keys(headers).length ? headers : undefined,
+  responseStyle: "data",
+  throwOnError: true,
+});
+
+const health = await client.global.health();
+assert.equal(health.healthy, true);
+
+const session = await client.session.create({ title: "opencodeRouter smoke" });
+assert.ok(session?.id);
+
+await client.session.prompt({
+  sessionID: session.id,
+  noReply: !requireReply,
+  parts: [{ type: "text", text: "ping" }],
+});
+
+const messages = await client.session.messages({ sessionID: session.id, limit: 20 });
+assert.ok(Array.isArray(messages));
+
+console.log(
+  JSON.stringify({
+    ok: true,
+    baseUrl,
+    directory,
+    sessionID: session.id,
+    messageCount: messages.length,
+  }),
+);
diff --git a/apps/opencode-router/scripts/test-cli.mjs b/apps/opencode-router/scripts/test-cli.mjs
new file mode 100644
index 0000000000..816de44878
--- /dev/null
+++ b/apps/opencode-router/scripts/test-cli.mjs
@@ -0,0 +1,101 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+const cliPath = path.resolve("dist", "cli.js");
+
+function run(cmd, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      ...options,
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+      if (options.expectTimeout) {
+        resolve({ code: null, stdout, stderr, timedOut: true });
+        return;
+      }
+      reject(new Error(`Timeout running ${cmd} ${args.join(" ")}`));
+    }, options.timeoutMs ?? 5000);
+
+    child.on("close", (code) => {
+      if (timedOut) return;
+      clearTimeout(timeout);
+      resolve({ code, stdout, stderr, timedOut: false });
+    });
+
+    if (options.input) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    }
+  });
+}
+
+async function runHelp() {
+  const result = await run("bun", [cliPath, "--help"], { timeoutMs: 3000 });
+  if (result.code !== 0) {
+    throw new Error(`Help failed: ${result.stderr}`);
+  }
+  if (!result.stdout.includes("Slack + Telegram")) {
+    throw new Error("Help output missing expected header");
+  }
+}
+
+async function runConfigCommands() {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "opencodeRouter-"));
+  const env = {
+    ...process.env,
+    OPENCODE_ROUTER_DATA_DIR: tempDir,
+    OPENCODE_ROUTER_DB_PATH: path.join(tempDir, "opencode-router.db"),
+    OPENCODE_ROUTER_CONFIG_PATH: path.join(tempDir, "opencode-router.json"),
+    OPENCODE_DIRECTORY: tempDir,
+  };
+
+  const setResult = await run("bun", [cliPath, "config", "set", "channels.telegram.enabled", "false"], {
+    env,
+    timeoutMs: 5000,
+  });
+  if (setResult.code !== 0) {
+    throw new Error(`Config set failed: ${setResult.stderr}`);
+  }
+
+  const getResult = await run("bun", [cliPath, "config", "get", "channels.telegram.enabled"], {
+    env,
+    timeoutMs: 5000,
+  });
+  if (getResult.code !== 0) {
+    throw new Error(`Config get failed: ${getResult.stderr}`);
+  }
+  if (!(`${getResult.stdout}${getResult.stderr}`.includes("false"))) {
+    throw new Error("Config get output missing expected value");
+  }
+
+  const statusResult = await run("bun", [cliPath, "status", "--json"], { env, timeoutMs: 5000 });
+  if (statusResult.code !== 0) {
+    throw new Error(`Status failed: ${statusResult.stderr}`);
+  }
+
+  // Ensure identities subcommands are present.
+  const tgList = await run("bun", [cliPath, "telegram", "list", "--json"], { env, timeoutMs: 5000 });
+  if (tgList.code !== 0) {
+    throw new Error(`Telegram list failed: ${tgList.stderr}`);
+  }
+}
+
+await runHelp();
+await runConfigCommands();
+console.log("CLI smoke tests passed");
diff --git a/apps/opencode-router/scripts/test-npx.mjs b/apps/opencode-router/scripts/test-npx.mjs
new file mode 100644
index 0000000000..b1e6965e56
--- /dev/null
+++ b/apps/opencode-router/scripts/test-npx.mjs
@@ -0,0 +1,87 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+function run(cmd, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      ...options,
+    });
+    let stdout = "";
+    let stderr = "";
+
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    const timeout = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`Timeout running ${cmd} ${args.join(" ")}`));
+    }, options.timeoutMs ?? 60000);
+
+    child.on("close", (code) => {
+      clearTimeout(timeout);
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+
+const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const tempCache = await fs.mkdtemp(path.join(os.tmpdir(), "opencodeRouter-npx-"));
+const env = {
+  ...process.env,
+  npm_config_yes: "true",
+  NPM_CONFIG_CACHE: tempCache,
+};
+
+const packed = await run("npm", ["pack", "--silent"], {
+  cwd: packageDir,
+  env,
+  timeoutMs: 60000,
+});
+
+if (packed.code !== 0) {
+  throw new Error(packed.stderr || "npm pack failed");
+}
+
+const tarball = packed.stdout
+  .split(/\r?\n/g)
+  .map((line) => line.trim())
+  .filter(Boolean)
+  .at(-1);
+
+if (!tarball) {
+  throw new Error("npm pack did not return a tarball name");
+}
+
+const tarballPath = path.join(packageDir, tarball);
+
+try {
+  const result = await run(
+    "npx",
+    ["--yes", "--package", tarballPath, "opencode-router", "--help"],
+    {
+      env,
+      timeoutMs: 60000,
+    },
+  );
+
+  if (result.code !== 0) {
+    throw new Error(result.stderr || "npx opencode-router failed");
+  }
+
+  if (!result.stdout.includes("opencode-router") && !result.stdout.includes("owpenbot")) {
+    throw new Error("npx output missing expected command name");
+  }
+
+  console.log("npx opencode-router ok");
+} finally {
+  await fs.rm(tarballPath, { force: true });
+  await fs.rm(tempCache, { recursive: true, force: true });
+}
diff --git a/apps/opencode-router/src/bridge.ts b/apps/opencode-router/src/bridge.ts
new file mode 100644
index 0000000000..b06c3fed5e
--- /dev/null
+++ b/apps/opencode-router/src/bridge.ts
@@ -0,0 +1,2270 @@
+import { setTimeout as delay } from "node:timers/promises";
+
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+import type { Logger } from "pino";
+
+import type { Config, ChannelName, OpenCodeRouterConfigFile } from "./config.js";
+import { readConfigFile, writeConfigFile } from "./config.js";
+import { BridgeStore } from "./db.js";
+import { classifyDeliveryError } from "./delivery.js";
+import { normalizeEvent } from "./events.js";
+import { startHealthServer, type HealthSnapshot } from "./health.js";
+import { type InboundMessagePart, type MessageDeliveryResult, type OutboundMessagePart, normalizeOutboundParts, summarizeInboundPartsForPrompt, summarizeInboundPartsForReporter, textFromInboundParts } from "./media.js";
+import { MediaStore } from "./media-store.js";
+import { buildPermissionRules, createClient } from "./opencode.js";
+import { isWithinWorkspaceRootPath, normalizeScopedDirectoryPath } from "./path-scope.js";
+import { chunkText, formatInputSummary, truncateText } from "./text.js";
+import { createSlackAdapter } from "./slack.js";
+import { createTelegramAdapter, isTelegramPeerId } from "./telegram.js";
+
+type Adapter = {
+  key: string;
+  name: ChannelName;
+  identityId: string;
+  maxTextLength: number;
+  start(): Promise<void>;
+  stop(): Promise<void>;
+  sendMessage?: (peerId: string, message: { parts: OutboundMessagePart[] }) => Promise<MessageDeliveryResult>;
+  sendText(peerId: string, text: string): Promise<void>;
+  sendFile?: (peerId: string, filePath: string, caption?: string) => Promise<void>;
+  sendTyping?: (peerId: string) => Promise<void>;
+};
+
+type AdapterStartResult =
+  | { status: "started" }
+  | { status: "timeout" }
+  | { status: "error"; error: unknown };
+
+async function startAdapterBounded(
+  adapter: Adapter,
+  options: { timeoutMs: number; onError?: (error: unknown) => void },
+): Promise<AdapterStartResult> {
+  const outcome = adapter
+    .start()
+    .then(() => ({ ok: true as const }))
+    .catch((error) => ({ ok: false as const, error }));
+
+  if (options.onError) {
+    void outcome.then((result) => {
+      if (!result.ok) {
+        options.onError?.(result.error);
+      }
+    });
+  }
+
+  const winner = await Promise.race([
+    outcome.then((result) => ({ kind: "outcome" as const, result })),
+    delay(options.timeoutMs).then(() => ({ kind: "timeout" as const })),
+  ]);
+
+  if (winner.kind === "timeout") return { status: "timeout" };
+  if (winner.result.ok) return { status: "started" };
+  return { status: "error", error: winner.result.error };
+}
+
+type OutboundKind = "reply" | "system" | "tool";
+
+type BridgeDeps = {
+  client?: ReturnType<typeof createClient>;
+  clientFactory?: (directory: string) => ReturnType<typeof createClient>;
+  store?: BridgeStore;
+  adapters?: Map<string, Adapter>;
+  disableEventStream?: boolean;
+  disableHealthServer?: boolean;
+};
+
+export type BridgeReporter = {
+  onStatus?: (message: string) => void;
+  onInbound?: (message: {
+    channel: ChannelName;
+    identityId: string;
+    peerId: string;
+    text: string;
+    fromMe?: boolean;
+  }) => void;
+  onOutbound?: (message: {
+    channel: ChannelName;
+    identityId: string;
+    peerId: string;
+    text: string;
+    kind: OutboundKind;
+  }) => void;
+};
+
+type InboundMessage = {
+  channel: ChannelName;
+  identityId: string;
+  peerId: string;
+  text: string;
+  parts?: InboundMessagePart[];
+  raw: unknown;
+  fromMe?: boolean;
+};
+
+type SendTargetDelivery = {
+  identityId: string;
+  peerId: string;
+  attemptedParts: number;
+  sentParts: number;
+  partResults: MessageDeliveryResult["partResults"];
+};
+
+type ModelRef = {
+  providerID: string;
+  modelID: string;
+};
+
+type RunState = {
+  key: string;
+  directory: string;
+  sessionID: string;
+  channel: ChannelName;
+  identityId: string;
+  adapterKey: string;
+  peerId: string;
+  peerKey: string;
+  toolUpdatesEnabled: boolean;
+  seenToolStates: Map<string, string>;
+  thinkingLabel?: string;
+  thinkingActive?: boolean;
+};
+
+const TOOL_LABELS: Record<string, string> = {
+  bash: "bash",
+  read: "read",
+  write: "write",
+  edit: "edit",
+  patch: "patch",
+  multiedit: "edit",
+  grep: "grep",
+  glob: "glob",
+  task: "agent",
+  webfetch: "webfetch",
+};
+
+const CHANNEL_LABELS: Record<ChannelName, string> = {
+  telegram: "Telegram",
+  slack: "Slack",
+};
+
+const TYPING_INTERVAL_MS = 6000;
+const OPENCODE_ROUTER_AGENT_FILE_RELATIVE_PATH = ".opencode/agents/opencode-router.md";
+const OPENCODE_ROUTER_AGENT_MAX_CHARS = 16_000;
+const DEFAULT_MESSAGING_AGENT_INSTRUCTIONS = [
+  "Respond for non-technical users first.",
+  "Do not tell users to run router commands; use tools on their behalf.",
+  "Never expose raw peer IDs or Telegram chat IDs unless the user explicitly asks for debug details.",
+  "Do not ask end users for peer IDs or identity IDs.",
+  "For Telegram send requests, try delivery immediately using existing bindings or direct tool calls.",
+  "If Telegram returns 'chat not found', explain that the recipient must message the bot first (for example with /start), then ask the user to retry.",
+  "Keep status updates concise and action-oriented.",
+].join("\n");
+
+type MessagingAgentConfig = {
+  filePath: string;
+  loaded: boolean;
+  selectedAgent?: string;
+  instructions: string;
+};
+
+// Model presets for quick switching
+const MODEL_PRESETS: Record<string, ModelRef> = {
+  opus: { providerID: "anthropic", modelID: "claude-opus-4-5-20251101" },
+  codex: { providerID: "openai", modelID: "gpt-5.2-codex" },
+};
+
+// Per-user model overrides (channel:peerId -> ModelRef)
+const userModelOverrides = new Map<string, ModelRef>();
+
+function getUserModelKey(channel: ChannelName, identityId: string, peerId: string): string {
+  return `${channel}:${identityId}:${peerId}`;
+}
+
+function getUserModel(channel: ChannelName, identityId: string, peerId: string, defaultModel?: ModelRef): ModelRef | undefined {
+  const key = getUserModelKey(channel, identityId, peerId);
+  return userModelOverrides.get(key) ?? defaultModel;
+}
+
+function setUserModel(channel: ChannelName, identityId: string, peerId: string, model: ModelRef | undefined): void {
+  const key = getUserModelKey(channel, identityId, peerId);
+  if (model) {
+    userModelOverrides.set(key, model);
+  } else {
+    userModelOverrides.delete(key);
+  }
+}
+
+function adapterKey(channel: ChannelName, identityId: string): string {
+  return `${channel}:${identityId}`;
+}
+
+function invalidTelegramPeerIdError(): Error & { status?: number } {
+  const error = new Error(
+    "Telegram requires a numeric chat_id for direct targets. Usernames like @name cannot be used as peerId.",
+  ) as Error & { status?: number };
+  error.status = 400;
+  return error;
+}
+
+const PAIRING_CODE_HASH_PATTERN = /^[a-f0-9]{64}$/;
+
+function normalizeTelegramAccess(value: unknown): "public" | "private" {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return raw === "private" ? "private" : "public";
+}
+
+function normalizePairingCodeHash(value: unknown): string {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (!PAIRING_CODE_HASH_PATTERN.test(raw)) return "";
+  return raw;
+}
+
+function normalizePairingCodeValue(value: string): string {
+  return value.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
+}
+
+function hashPairingCode(value: string): string {
+  return createHash("sha256").update(normalizePairingCodeValue(value)).digest("hex");
+}
+
+function extractPairingCodeFromCommand(text: string): string {
+  const trimmed = text.trim();
+  const match = trimmed.match(/^\/pair(?:@[A-Za-z0-9_]+)?\s+(.+)$/i);
+  if (!match?.[1]) return "";
+  return normalizePairingCodeValue(match[1]);
+}
+
+function normalizeIdentityId(value: string | undefined): string {
+  const trimmed = (value ?? "").trim();
+  if (!trimmed) return "default";
+  const safe = trimmed.replace(/[^a-zA-Z0-9_.-]+/g, "-");
+  const cleaned = safe.replace(/^-+|-+$/g, "").slice(0, 48);
+  return cleaned || "default";
+}
+
+export async function startBridge(config: Config, logger: Logger, reporter?: BridgeReporter, deps: BridgeDeps = {}) {
+  const reportStatus = reporter?.onStatus;
+  const clients = new Map<string, ReturnType<typeof createClient>>();
+  const defaultDirectory = config.opencodeDirectory;
+  const workspaceRoot = resolve(defaultDirectory || process.cwd());
+  const mediaStore = new MediaStore(join(workspaceRoot, ".opencode-router", "media"));
+  await mediaStore.ensureReady();
+  const workspaceAgentFilePath = join(workspaceRoot, OPENCODE_ROUTER_AGENT_FILE_RELATIVE_PATH);
+  const agentPromptCache = new Map<string, { mtimeMs: number; config: MessagingAgentConfig }>();
+  let latestAgentConfig: MessagingAgentConfig = {
+    filePath: workspaceAgentFilePath,
+    loaded: false,
+    instructions: "",
+  };
+
+  const parseMessagingAgentFile = (content: string): { selectedAgent?: string; instructions: string } => {
+    const lines = content.split(/\r?\n/);
+    let start = 0;
+    while (start < lines.length && !lines[start]?.trim()) {
+      start += 1;
+    }
+
+    let selectedAgent: string | undefined;
+    if (start < lines.length) {
+      const first = lines[start]?.trim() ?? "";
+      const match = first.match(/^@agent\s+([A-Za-z0-9_.:/-]+)$/);
+      if (match?.[1]) {
+        selectedAgent = match[1];
+        lines.splice(start, 1);
+      }
+    }
+
+    const instructions = lines.join("\n").trim();
+    return { ...(selectedAgent ? { selectedAgent } : {}), instructions };
+  };
+
+  const loadMessagingAgentConfig = async (): Promise<MessagingAgentConfig> => {
+    const filePath = workspaceAgentFilePath;
+    try {
+      const info = await stat(filePath);
+      if (!info.isFile()) {
+        agentPromptCache.delete(filePath);
+        latestAgentConfig = { filePath, loaded: false, instructions: "" };
+        return latestAgentConfig;
+      }
+
+      const cached = agentPromptCache.get(filePath);
+      if (cached && cached.mtimeMs === info.mtimeMs) {
+        latestAgentConfig = cached.config;
+        return latestAgentConfig;
+      }
+
+      const raw = (await readFile(filePath, "utf8")).trim();
+      if (!raw) {
+        const next: MessagingAgentConfig = { filePath, loaded: false, instructions: "" };
+        agentPromptCache.set(filePath, { mtimeMs: info.mtimeMs, config: next });
+        latestAgentConfig = next;
+        return next;
+      }
+
+      const truncated = raw.length > OPENCODE_ROUTER_AGENT_MAX_CHARS ? raw.slice(0, OPENCODE_ROUTER_AGENT_MAX_CHARS) : raw;
+      const parsed = parseMessagingAgentFile(truncated);
+      const next: MessagingAgentConfig = {
+        filePath,
+        loaded: Boolean(parsed.instructions || parsed.selectedAgent),
+        ...(parsed.selectedAgent ? { selectedAgent: parsed.selectedAgent } : {}),
+        instructions: parsed.instructions,
+      };
+      agentPromptCache.set(filePath, { mtimeMs: info.mtimeMs, config: next });
+      latestAgentConfig = next;
+      return next;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException)?.code;
+      if (code === "ENOENT") {
+        agentPromptCache.delete(filePath);
+        latestAgentConfig = { filePath, loaded: false, instructions: "" };
+        return latestAgentConfig;
+      }
+      logger.warn({ error, filePath }, "failed to load opencode-router agent file");
+      latestAgentConfig = { filePath, loaded: false, instructions: "" };
+      return latestAgentConfig;
+    }
+  };
+
+  const isDangerousRootDirectory = (dir: string) => {
+    const normalized = dir.trim();
+    if (!normalized) return true;
+    if (process.platform !== "win32") {
+      return normalized === "/";
+    }
+    // Windows roots like C:, C:/, C:\
+    return /^[a-zA-Z]:\/?$/.test(normalized.replace(/\\/g, "/"));
+  };
+
+  const resolveIdentityDirectory = (channel: ChannelName, identityId: string): string => {
+    const id = identityId.trim();
+    if (!id) return "";
+    if (channel === "telegram") {
+      const bot = config.telegramBots.find((entry) => entry.id === id);
+      return typeof (bot as any)?.directory === "string" ? String((bot as any).directory).trim() : "";
+    }
+    const app = config.slackApps.find((entry) => entry.id === id);
+    return typeof (app as any)?.directory === "string" ? String((app as any).directory).trim() : "";
+  };
+
+  const resolveTelegramIdentityAccess = (
+    identityId: string,
+  ): { access: "public" | "private"; pairingCodeHash: string } => {
+    const id = identityId.trim();
+    if (!id) {
+      return { access: "public", pairingCodeHash: "" };
+    }
+    const bot = config.telegramBots.find((entry) => entry.id === id);
+    if (!bot) {
+      return { access: "public", pairingCodeHash: "" };
+    }
+    const access = normalizeTelegramAccess((bot as any).access);
+    const pairingCodeHash = normalizePairingCodeHash((bot as any).pairingCodeHash);
+    if (access !== "private") {
+      return { access: "public", pairingCodeHash: "" };
+    }
+    return { access: "private", pairingCodeHash };
+  };
+
+  const listIdentityConfigs = (channel: ChannelName): Array<{ id: string; directory: string }> => {
+    if (channel === "telegram") {
+      return config.telegramBots.map((bot) => ({ id: bot.id, directory: (bot.directory ?? "").trim() }));
+    }
+    return config.slackApps.map((app) => ({ id: app.id, directory: (app.directory ?? "").trim() }));
+  };
+
+  const getClient = (directory?: string | null) => {
+    const resolved = (directory ?? "").trim() || defaultDirectory;
+    if (deps.client && resolved === defaultDirectory) {
+      return deps.client;
+    }
+    const existing = clients.get(resolved);
+    if (existing) return existing;
+    const next = deps.clientFactory ? deps.clientFactory(resolved) : createClient(config, resolved);
+    clients.set(resolved, next);
+    return next;
+  };
+
+  const rootClient = getClient(defaultDirectory);
+  const store = deps.store ?? new BridgeStore(config.dbPath);
+
+  logger.debug(
+    {
+      configPath: config.configPath,
+      opencodeUrl: config.opencodeUrl,
+      opencodeDirectory: config.opencodeDirectory,
+      telegramBots: config.telegramBots.map((bot) => ({ id: bot.id, enabled: bot.enabled !== false })),
+      slackApps: config.slackApps.map((app) => ({ id: app.id, enabled: app.enabled !== false })),
+      groupsEnabled: config.groupsEnabled,
+      permissionMode: config.permissionMode,
+      toolUpdatesEnabled: config.toolUpdatesEnabled,
+    },
+    "bridge config",
+  );
+
+  const adapters = deps.adapters ?? new Map<string, Adapter>();
+  const usingInjectedAdapters = Boolean(deps.adapters);
+
+  if (!usingInjectedAdapters) {
+    const enabledTelegram = config.telegramBots.filter((bot) => bot.enabled !== false);
+    if (enabledTelegram.length === 0) {
+      logger.info("telegram adapters disabled");
+      reportStatus?.("Telegram adapters disabled.");
+    }
+    for (const bot of enabledTelegram) {
+      const key = adapterKey("telegram", bot.id);
+      logger.debug({ identityId: bot.id }, "telegram adapter enabled");
+      const base = createTelegramAdapter(bot, config, logger, handleInbound, mediaStore);
+      adapters.set(key, { ...base, key });
+    }
+
+    const enabledSlack = config.slackApps.filter((app) => app.enabled !== false);
+    if (enabledSlack.length === 0) {
+      logger.info("slack adapters disabled");
+      reportStatus?.("Slack adapters disabled.");
+    }
+    for (const app of enabledSlack) {
+      const key = adapterKey("slack", app.id);
+      logger.debug({ identityId: app.id }, "slack adapter enabled");
+      const base = createSlackAdapter(app, config, logger, handleInbound, undefined, mediaStore);
+      adapters.set(key, { ...base, key });
+    }
+  }
+
+  const keyForSession = (directory: string, sessionID: string) => `${directory}::${sessionID}`;
+
+  const sessionQueue = new Map<string, Promise<void>>();
+  const activeRuns = new Map<string, RunState>();
+  const sessionModels = new Map<string, ModelRef>();
+  const typingLoops = new Map<string, NodeJS.Timeout>();
+
+  const formatPeer = (_channel: ChannelName, peerId: string) => peerId;
+
+  const normalizeDirectory = (input: string) =>
+    normalizeScopedDirectoryPath(input, process.platform);
+
+  const workspaceRootNormalized = normalizeDirectory(workspaceRoot);
+
+  const isWithinWorkspaceRoot = (candidate: string) => {
+    return isWithinWorkspaceRootPath({
+      workspaceRoot,
+      candidate,
+      platform: process.platform,
+    });
+  };
+
+  const resolveScopedDirectory = (input: string): { ok: true; directory: string } | { ok: false; error: string } => {
+    const trimmed = input.trim();
+    if (!trimmed) return { ok: false, error: "Directory is required." };
+    const resolved = resolve(isAbsolute(trimmed) ? trimmed : join(workspaceRoot, trimmed));
+    if (!isWithinWorkspaceRoot(resolved)) {
+      return {
+        ok: false,
+        error: `Directory must stay within workspace root: ${workspaceRootNormalized}`,
+      };
+    }
+    return { ok: true, directory: normalizeDirectory(resolved) };
+  };
+
+  const formatModelLabel = (model?: ModelRef) =>
+    model ? `${model.providerID}/${model.modelID}` : null;
+
+  const extractModelRef = (info: unknown): ModelRef | null => {
+    if (!info || typeof info !== "object") return null;
+    const record = info as { role?: unknown; model?: unknown };
+    if (record.role !== "user") return null;
+    if (!record.model || typeof record.model !== "object") return null;
+    const model = record.model as { providerID?: unknown; modelID?: unknown };
+    if (typeof model.providerID !== "string" || typeof model.modelID !== "string") return null;
+    return { providerID: model.providerID, modelID: model.modelID };
+  };
+
+  const reportThinking = (run: RunState) => {
+    if (!reportStatus) return;
+    const modelLabel = formatModelLabel(sessionModels.get(run.key));
+    const nextLabel = modelLabel ? `Thinking (${modelLabel})` : "Thinking...";
+    if (run.thinkingLabel === nextLabel && run.thinkingActive) return;
+    run.thinkingLabel = nextLabel;
+    run.thinkingActive = true;
+    reportStatus(
+      `[${CHANNEL_LABELS[run.channel]}/${run.identityId}] ${formatPeer(run.channel, run.peerId)} ${nextLabel}`,
+    );
+  };
+
+  const reportDone = (run: RunState) => {
+    if (!reportStatus || !run.thinkingActive) return;
+    const modelLabel = formatModelLabel(sessionModels.get(run.key));
+    const suffix = modelLabel ? ` (${modelLabel})` : "";
+    reportStatus(`[${CHANNEL_LABELS[run.channel]}/${run.identityId}] ${formatPeer(run.channel, run.peerId)} Done${suffix}`);
+    run.thinkingActive = false;
+  };
+
+  const startTyping = (run: RunState) => {
+    const adapter = adapters.get(run.adapterKey);
+    if (!adapter?.sendTyping) return;
+    if (typingLoops.has(run.key)) return;
+    const sendTyping = async () => {
+      try {
+        await adapter.sendTyping?.(run.peerId);
+      } catch (error) {
+        logger.warn({ error, channel: run.channel, identityId: run.identityId }, "typing update failed");
+      }
+    };
+    void sendTyping();
+    const timer = setInterval(sendTyping, TYPING_INTERVAL_MS);
+    typingLoops.set(run.key, timer);
+  };
+
+  const stopTyping = (key: string) => {
+    const timer = typingLoops.get(key);
+    if (!timer) return;
+    clearInterval(timer);
+    typingLoops.delete(key);
+  };
+
+  let opencodeHealthy = false;
+  let opencodeVersion: string | undefined;
+
+  const HEALTH_SLOW_INTERVAL_MS = 30_000;
+  const HEALTH_FAST_INTERVAL_MS = 1_000;
+  let healthIntervalMs = HEALTH_FAST_INTERVAL_MS;
+  let healthTimer: NodeJS.Timeout | null = null;
+
+  async function refreshHealth() {
+    try {
+      const health = await rootClient.global.health();
+      opencodeHealthy = Boolean((health as { healthy?: boolean }).healthy);
+      opencodeVersion = (health as { version?: string }).version;
+    } catch (error) {
+      logger.warn({ error }, "failed to reach opencode health");
+      opencodeHealthy = false;
+    }
+
+    // After initial startup, switch to a slower poll once OpenCode is healthy.
+    if (opencodeHealthy && healthIntervalMs !== HEALTH_SLOW_INTERVAL_MS) {
+      healthIntervalMs = HEALTH_SLOW_INTERVAL_MS;
+      if (healthTimer) {
+        clearInterval(healthTimer);
+      }
+      healthTimer = setInterval(refreshHealth, healthIntervalMs);
+    }
+  }
+
+  await refreshHealth();
+  healthTimer = setInterval(refreshHealth, healthIntervalMs);
+
+  // Mutable runtime state for groups (persisted to config file)
+  let groupsEnabled = config.groupsEnabled;
+
+  const startOfToday = (now: number) => {
+    const day = new Date(now);
+    day.setHours(0, 0, 0, 0);
+    return day.getTime();
+  };
+
+  let activityDayStart = startOfToday(Date.now());
+  let inboundToday = 0;
+  let outboundToday = 0;
+  let lastInboundAt: number | undefined;
+  let lastOutboundAt: number | undefined;
+
+  const ensureActivityDay = (now: number) => {
+    const nextDayStart = startOfToday(now);
+    if (nextDayStart === activityDayStart) return;
+    activityDayStart = nextDayStart;
+    inboundToday = 0;
+    outboundToday = 0;
+  };
+
+  const recordInboundActivity = (now: number) => {
+    ensureActivityDay(now);
+    inboundToday += 1;
+    lastInboundAt = now;
+  };
+
+  const recordOutboundActivity = (now: number) => {
+    ensureActivityDay(now);
+    outboundToday += 1;
+    lastOutboundAt = now;
+  };
+
+  await loadMessagingAgentConfig();
+
+  const outboundMediaMaxBytesRaw = Number.parseInt(process.env.OPENCODE_ROUTER_MAX_MEDIA_BYTES ?? "", 10);
+  const outboundMediaMaxBytes =
+    Number.isFinite(outboundMediaMaxBytesRaw) && outboundMediaMaxBytesRaw > 0
+      ? outboundMediaMaxBytesRaw
+      : 50 * 1024 * 1024;
+
+  const resolveOutboundParts = async (
+    baseDirectory: string,
+    input: { text?: string; parts?: unknown },
+  ): Promise<OutboundMessagePart[]> => {
+    const normalized = normalizeOutboundParts(input);
+    if (normalized.length === 0) {
+      const error = new Error("text or parts is required") as Error & { status?: number };
+      error.status = 400;
+      throw error;
+    }
+
+    const resolved: OutboundMessagePart[] = [];
+    for (const part of normalized) {
+      if (part.type === "text") {
+        resolved.push(part);
+        continue;
+      }
+
+      const file = await mediaStore.resolveOutboundFile({
+        filePath: part.filePath,
+        baseDirectory,
+        maxBytes: outboundMediaMaxBytes,
+      });
+      resolved.push({
+        ...part,
+        filePath: file.filePath,
+        ...(part.filename ? {} : { filename: file.filename }),
+      });
+    }
+
+    return resolved;
+  };
+
+  const deliverParts = async (
+    channel: ChannelName,
+    identityId: string,
+    peerId: string,
+    parts: OutboundMessagePart[],
+    options: { kind?: OutboundKind; display?: boolean } = {},
+  ): Promise<MessageDeliveryResult> => {
+    const adapter = adapters.get(adapterKey(channel, identityId));
+    if (!adapter) {
+      return {
+        attemptedParts: parts.length,
+        sentParts: 0,
+        partResults: parts.map((part, index) => ({
+          index,
+          type: part.type,
+          sent: false,
+          error: "Adapter not running",
+          code: "not_found",
+          retryable: false,
+        })),
+      };
+    }
+
+    const kind = options.kind ?? "system";
+    if (options.display !== false) {
+      for (const part of parts) {
+        const preview =
+          part.type === "text"
+            ? truncateText(part.text, 240)
+            : `[${part.type}] ${part.filename || part.filePath}`;
+        reporter?.onOutbound?.({ channel, identityId, peerId, text: preview, kind });
+      }
+    }
+
+    recordOutboundActivity(Date.now());
+
+    if (adapter.sendMessage) {
+      try {
+        return await adapter.sendMessage(peerId, { parts });
+      } catch (error) {
+        const classified = classifyDeliveryError(error);
+        return {
+          attemptedParts: parts.length,
+          sentParts: 0,
+          partResults: parts.map((part, index) => ({
+            index,
+            type: part.type,
+            sent: false,
+            error: classified.message,
+            code: classified.code,
+            retryable: classified.retryable,
+          })),
+        };
+      }
+    }
+
+    const partResults: MessageDeliveryResult["partResults"] = [];
+    let sentParts = 0;
+    for (let index = 0; index < parts.length; index += 1) {
+      const part = parts[index];
+      try {
+        if (part.type === "text") {
+          const chunks = chunkText(part.text, adapter.maxTextLength);
+          for (const chunk of chunks) {
+            await adapter.sendText(peerId, chunk);
+          }
+        } else if (adapter.sendFile) {
+          await adapter.sendFile(peerId, part.filePath, part.caption);
+        } else {
+          throw new Error(`Adapter does not support ${part.type} media`);
+        }
+
+        sentParts += 1;
+        partResults.push({ index, type: part.type, sent: true });
+      } catch (error) {
+        const classified = classifyDeliveryError(error);
+        partResults.push({
+          index,
+          type: part.type,
+          sent: false,
+          error: classified.message,
+          code: classified.code,
+          retryable: classified.retryable,
+        });
+      }
+    }
+
+    return {
+      attemptedParts: parts.length,
+      sentParts,
+      partResults,
+    };
+  };
+
+  let stopHealthServer: (() => void) | null = null;
+  if (!deps.disableHealthServer && config.healthPort) {
+    stopHealthServer = await startHealthServer(
+      config.healthPort,
+      (): HealthSnapshot => ({
+        ok: opencodeHealthy,
+        opencode: {
+          url: config.opencodeUrl,
+          healthy: opencodeHealthy,
+          version: opencodeVersion,
+        },
+        channels: {
+          telegram: Array.from(adapters.keys()).some((key) => key.startsWith("telegram:")),
+          // WhatsApp removed; keep field for backward compatibility.
+          whatsapp: false,
+          slack: Array.from(adapters.keys()).some((key) => key.startsWith("slack:")),
+        },
+        config: {
+          groupsEnabled,
+        },
+        activity: {
+          dayStart: activityDayStart,
+          inboundToday,
+          outboundToday,
+          ...(typeof lastInboundAt === "number" ? { lastInboundAt } : {}),
+          ...(typeof lastOutboundAt === "number" ? { lastOutboundAt } : {}),
+          ...(typeof lastInboundAt === "number" || typeof lastOutboundAt === "number"
+            ? { lastMessageAt: Math.max(lastInboundAt ?? 0, lastOutboundAt ?? 0) }
+            : {}),
+        },
+        agent: {
+          scope: "workspace",
+          path: latestAgentConfig.filePath,
+          loaded: latestAgentConfig.loaded,
+          ...(latestAgentConfig.selectedAgent ? { selected: latestAgentConfig.selectedAgent } : {}),
+        },
+      }),
+      logger,
+      {
+        getGroupsEnabled: () => groupsEnabled,
+        setGroupsEnabled: async (enabled: boolean) => {
+          groupsEnabled = enabled;
+          // Also update config so adapters see the change
+          (config as any).groupsEnabled = enabled;
+          
+          // Persist to config file
+          const { config: current } = readConfigFile(config.configPath);
+          const next: OpenCodeRouterConfigFile = {
+            ...current,
+            groupsEnabled: enabled,
+          };
+          next.version = next.version ?? 1;
+          writeConfigFile(config.configPath, next);
+          config.configFile = next;
+          
+          logger.info({ groupsEnabled: enabled }, "groups config updated");
+          return { groupsEnabled: enabled };
+        },
+
+        listTelegramIdentities: async () => {
+          return {
+            items: config.telegramBots.map((bot) => ({
+              id: bot.id,
+              enabled: bot.enabled !== false,
+              running: adapters.has(adapterKey("telegram", bot.id)),
+              access: normalizeTelegramAccess((bot as any).access),
+              pairingRequired: normalizeTelegramAccess((bot as any).access) === "private",
+            })),
+          };
+        },
+        upsertTelegramIdentity: async (input: {
+          id?: string;
+          token: string;
+          enabled?: boolean;
+          directory?: string;
+          access?: "public" | "private";
+          pairingCodeHash?: string;
+        }) => {
+          const token = input.token?.trim() ?? "";
+          if (!token) throw new Error("token is required");
+          const id = normalizeIdentityId(input.id);
+          if (id === "env") throw new Error("identity id 'env' is reserved");
+          const enabled = input.enabled !== false;
+          const directoryInput = typeof input.directory === "string" ? input.directory.trim() : "";
+          const requestedAccess =
+            typeof input.access === "string" && input.access.trim() ? normalizeTelegramAccess(input.access) : undefined;
+          const requestedPairingCodeHash = normalizePairingCodeHash(input.pairingCodeHash);
+
+          // Persist to config file.
+          const { config: current } = readConfigFile(config.configPath);
+          const telegram = current.channels?.telegram;
+          const bots = Array.isArray((telegram as any)?.bots) ? (((telegram as any).bots as unknown[]) ?? []) : [];
+          const nextBots: any[] = [];
+          let found = false;
+          for (const entry of bots) {
+            if (!entry || typeof entry !== "object") continue;
+            const record = entry as Record<string, unknown>;
+            const entryId = normalizeIdentityId(typeof record.id === "string" ? record.id : "default");
+            if (entryId !== id) {
+              nextBots.push(entry);
+              continue;
+            }
+            found = true;
+            const existingDirectory = typeof record.directory === "string" ? record.directory.trim() : "";
+            const directory = directoryInput || existingDirectory;
+            const existingAccess = normalizeTelegramAccess(record.access);
+            const existingPairingCodeHash = normalizePairingCodeHash(record.pairingCodeHash);
+            const access = requestedAccess ?? existingAccess;
+            const pairingCodeHash = access === "private" ? requestedPairingCodeHash || existingPairingCodeHash : "";
+            if (access === "private" && !pairingCodeHash) {
+              throw new Error("pairingCodeHash is required when Telegram access is private");
+            }
+            nextBots.push({
+              id,
+              token,
+              enabled,
+              ...(directory ? { directory } : {}),
+              access,
+              ...(access === "private" ? { pairingCodeHash } : {}),
+            });
+          }
+          if (!found) {
+            const access = requestedAccess ?? "public";
+            const pairingCodeHash = access === "private" ? requestedPairingCodeHash : "";
+            if (access === "private" && !pairingCodeHash) {
+              throw new Error("pairingCodeHash is required when Telegram access is private");
+            }
+            nextBots.push({
+              id,
+              token,
+              enabled,
+              ...(directoryInput ? { directory: directoryInput } : {}),
+              access,
+              ...(access === "private" ? { pairingCodeHash } : {}),
+            });
+          }
+
+          const next: OpenCodeRouterConfigFile = {
+            ...current,
+            channels: {
+              ...current.channels,
+              telegram: {
+                ...(current.channels?.telegram ?? {}),
+                enabled: true,
+                bots: nextBots,
+              },
+            },
+          };
+          next.version = next.version ?? 1;
+          writeConfigFile(config.configPath, next);
+          config.configFile = next;
+
+          // Update runtime identity list.
+          const existingIdx = config.telegramBots.findIndex((bot) => bot.id === id);
+          let runtimeAccess: "public" | "private" = requestedAccess ?? "public";
+          let runtimePairingCodeHash = requestedPairingCodeHash;
+          if (existingIdx >= 0) {
+            const prev = config.telegramBots[existingIdx];
+            const nextDirectory = directoryInput || (prev as any)?.directory || undefined;
+            const prevAccess = normalizeTelegramAccess((prev as any)?.access);
+            const prevPairingCodeHash = normalizePairingCodeHash((prev as any)?.pairingCodeHash);
+            runtimeAccess = requestedAccess ?? prevAccess;
+            runtimePairingCodeHash = runtimeAccess === "private" ? requestedPairingCodeHash || prevPairingCodeHash : "";
+            if (runtimeAccess === "private" && !runtimePairingCodeHash) {
+              throw new Error("pairingCodeHash is required when Telegram access is private");
+            }
+            config.telegramBots[existingIdx] = {
+              id,
+              token,
+              enabled,
+              ...(nextDirectory ? { directory: String(nextDirectory).trim() } : {}),
+              access: runtimeAccess,
+              ...(runtimeAccess === "private" ? { pairingCodeHash: runtimePairingCodeHash } : {}),
+            };
+          } else {
+            runtimeAccess = requestedAccess ?? "public";
+            runtimePairingCodeHash = runtimeAccess === "private" ? requestedPairingCodeHash : "";
+            if (runtimeAccess === "private" && !runtimePairingCodeHash) {
+              throw new Error("pairingCodeHash is required when Telegram access is private");
+            }
+            config.telegramBots.push({
+              id,
+              token,
+              enabled,
+              ...(directoryInput ? { directory: directoryInput } : {}),
+              access: runtimeAccess,
+              ...(runtimeAccess === "private" ? { pairingCodeHash: runtimePairingCodeHash } : {}),
+            });
+          }
+
+          // Start/stop adapter.
+          const key = adapterKey("telegram", id);
+          const existing = adapters.get(key);
+          if (!enabled) {
+            if (existing) {
+              try {
+                await existing.stop();
+              } catch (error) {
+                logger.warn({ error, channel: "telegram", identityId: id }, "failed to stop telegram adapter");
+              }
+              adapters.delete(key);
+            }
+            return {
+              id,
+              enabled: false,
+              access: runtimeAccess,
+              pairingRequired: runtimeAccess === "private",
+              applied: true,
+            };
+          }
+
+          if (existing) {
+            try {
+              await existing.stop();
+            } catch (error) {
+              logger.warn({ error, channel: "telegram", identityId: id }, "failed to stop existing telegram adapter");
+            }
+            adapters.delete(key);
+          }
+          const base = createTelegramAdapter(
+            {
+              id,
+              token,
+              enabled,
+              ...(directoryInput ? { directory: directoryInput } : {}),
+              access: runtimeAccess,
+              ...(runtimeAccess === "private" && runtimePairingCodeHash
+                ? { pairingCodeHash: runtimePairingCodeHash }
+                : {}),
+            },
+            config,
+            logger,
+            handleInbound,
+            mediaStore,
+          );
+          const adapter = { ...base, key };
+          adapters.set(key, adapter);
+
+          const startResult = await startAdapterBounded(adapter, {
+            timeoutMs: 2_500,
+            onError: (error) => {
+              logger.error({ error, channel: "telegram", identityId: id }, "telegram adapter start failed");
+              adapters.delete(key);
+            },
+          });
+
+          if (startResult.status === "timeout") {
+            return {
+              id,
+              enabled: true,
+              access: runtimeAccess,
+              pairingRequired: runtimeAccess === "private",
+              applied: false,
+              starting: true,
+            };
+          }
+          if (startResult.status === "error") {
+            return {
+              id,
+              enabled: true,
+              access: runtimeAccess,
+              pairingRequired: runtimeAccess === "private",
+              applied: false,
+              error: String(startResult.error),
+            };
+          }
+          return {
+            id,
+            enabled: true,
+            access: runtimeAccess,
+            pairingRequired: runtimeAccess === "private",
+            applied: true,
+          };
+        },
+        deleteTelegramIdentity: async (rawId: string) => {
+          const id = normalizeIdentityId(rawId);
+          if (id === "env") throw new Error("env identity cannot be deleted");
+
+          const { config: current } = readConfigFile(config.configPath);
+          const telegram = current.channels?.telegram;
+          const bots = Array.isArray((telegram as any)?.bots) ? (((telegram as any).bots as unknown[]) ?? []) : [];
+          const nextBots: any[] = [];
+          let deleted = false;
+          for (const entry of bots) {
+            if (!entry || typeof entry !== "object") continue;
+            const record = entry as Record<string, unknown>;
+            const entryId = normalizeIdentityId(typeof record.id === "string" ? record.id : "default");
+            if (entryId === id) {
+              deleted = true;
+              continue;
+            }
+            nextBots.push(entry);
+          }
+          const next: OpenCodeRouterConfigFile = {
+            ...current,
+            channels: {
+              ...current.channels,
+              telegram: {
+                ...(current.channels?.telegram ?? {}),
+                bots: nextBots,
+              },
+            },
+          };
+          next.version = next.version ?? 1;
+          writeConfigFile(config.configPath, next);
+          config.configFile = next;
+
+          config.telegramBots.splice(
+            0,
+            config.telegramBots.length,
+            ...config.telegramBots.filter((bot) => bot.id !== id),
+          );
+
+          const key = adapterKey("telegram", id);
+          const existing = adapters.get(key);
+          if (existing) {
+            try {
+              await existing.stop();
+            } catch (error) {
+              logger.warn({ error, channel: "telegram", identityId: id }, "failed to stop telegram adapter");
+            }
+            adapters.delete(key);
+          }
+          return { id, deleted };
+        },
+
+        listSlackIdentities: async () => {
+          return {
+            items: config.slackApps.map((app) => ({
+              id: app.id,
+              enabled: app.enabled !== false,
+              running: adapters.has(adapterKey("slack", app.id)),
+            })),
+          };
+        },
+        upsertSlackIdentity: async (input: { id?: string; botToken: string; appToken: string; enabled?: boolean; directory?: string }) => {
+          const botToken = input.botToken?.trim() ?? "";
+          const appToken = input.appToken?.trim() ?? "";
+          if (!botToken || !appToken) throw new Error("botToken and appToken are required");
+          const id = normalizeIdentityId(input.id);
+          if (id === "env") throw new Error("identity id 'env' is reserved");
+          const enabled = input.enabled !== false;
+          const directoryInput = typeof input.directory === "string" ? input.directory.trim() : "";
+
+          const { config: current } = readConfigFile(config.configPath);
+          const slack = current.channels?.slack;
+          const apps = Array.isArray((slack as any)?.apps) ? (((slack as any).apps as unknown[]) ?? []) : [];
+          const nextApps: any[] = [];
+          let found = false;
+          for (const entry of apps) {
+            if (!entry || typeof entry !== "object") continue;
+            const record = entry as Record<string, unknown>;
+            const entryId = normalizeIdentityId(typeof record.id === "string" ? record.id : "default");
+            if (entryId !== id) {
+              nextApps.push(entry);
+              continue;
+            }
+            found = true;
+            const existingDirectory = typeof record.directory === "string" ? record.directory.trim() : "";
+            const directory = directoryInput || existingDirectory;
+            nextApps.push({ id, botToken, appToken, enabled, ...(directory ? { directory } : {}) });
+          }
+          if (!found) {
+            nextApps.push({ id, botToken, appToken, enabled, ...(directoryInput ? { directory: directoryInput } : {}) });
+          }
+
+          const next: OpenCodeRouterConfigFile = {
+            ...current,
+            channels: {
+              ...current.channels,
+              slack: {
+                ...(current.channels?.slack ?? {}),
+                enabled: true,
+                apps: nextApps,
+              },
+            },
+          };
+          next.version = next.version ?? 1;
+          writeConfigFile(config.configPath, next);
+          config.configFile = next;
+
+          const existingIdx = config.slackApps.findIndex((app) => app.id === id);
+          if (existingIdx >= 0) {
+            const prev = config.slackApps[existingIdx];
+            const nextDirectory = directoryInput || (prev as any)?.directory || undefined;
+            config.slackApps[existingIdx] = {
+              id,
+              botToken,
+              appToken,
+              enabled,
+              ...(nextDirectory ? { directory: String(nextDirectory).trim() } : {}),
+            };
+          } else {
+            config.slackApps.push({ id, botToken, appToken, enabled, ...(directoryInput ? { directory: directoryInput } : {}) });
+          }
+
+          const key = adapterKey("slack", id);
+          const existing = adapters.get(key);
+          if (!enabled) {
+            if (existing) {
+              try {
+                await existing.stop();
+              } catch (error) {
+                logger.warn({ error, channel: "slack", identityId: id }, "failed to stop slack adapter");
+              }
+              adapters.delete(key);
+            }
+            return { id, enabled: false, applied: true };
+          }
+
+          if (existing) {
+            try {
+              await existing.stop();
+            } catch (error) {
+              logger.warn({ error, channel: "slack", identityId: id }, "failed to stop existing slack adapter");
+            }
+            adapters.delete(key);
+          }
+          const base = createSlackAdapter(
+            { id, botToken, appToken, enabled, ...(directoryInput ? { directory: directoryInput } : {}) },
+            config,
+            logger,
+            handleInbound,
+            undefined,
+            mediaStore,
+          );
+          const adapter = { ...base, key };
+          adapters.set(key, adapter);
+
+          const startResult = await startAdapterBounded(adapter, {
+            timeoutMs: 2_500,
+            onError: (error) => {
+              logger.error({ error, channel: "slack", identityId: id }, "slack adapter start failed");
+              adapters.delete(key);
+            },
+          });
+
+          if (startResult.status === "timeout") {
+            return { id, enabled: true, applied: false, starting: true };
+          }
+          if (startResult.status === "error") {
+            return { id, enabled: true, applied: false, error: String(startResult.error) };
+          }
+          return { id, enabled: true, applied: true };
+        },
+        deleteSlackIdentity: async (rawId: string) => {
+          const id = normalizeIdentityId(rawId);
+          if (id === "env") throw new Error("env identity cannot be deleted");
+
+          const { config: current } = readConfigFile(config.configPath);
+          const slack = current.channels?.slack;
+          const apps = Array.isArray((slack as any)?.apps) ? (((slack as any).apps as unknown[]) ?? []) : [];
+          const nextApps: any[] = [];
+          let deleted = false;
+          for (const entry of apps) {
+            if (!entry || typeof entry !== "object") continue;
+            const record = entry as Record<string, unknown>;
+            const entryId = normalizeIdentityId(typeof record.id === "string" ? record.id : "default");
+            if (entryId === id) {
+              deleted = true;
+              continue;
+            }
+            nextApps.push(entry);
+          }
+          const next: OpenCodeRouterConfigFile = {
+            ...current,
+            channels: {
+              ...current.channels,
+              slack: {
+                ...(current.channels?.slack ?? {}),
+                apps: nextApps,
+              },
+            },
+          };
+          next.version = next.version ?? 1;
+          writeConfigFile(config.configPath, next);
+          config.configFile = next;
+
+          config.slackApps.splice(0, config.slackApps.length, ...config.slackApps.filter((app) => app.id !== id));
+
+          const key = adapterKey("slack", id);
+          const existing = adapters.get(key);
+          if (existing) {
+            try {
+              await existing.stop();
+            } catch (error) {
+              logger.warn({ error, channel: "slack", identityId: id }, "failed to stop slack adapter");
+            }
+            adapters.delete(key);
+          }
+          return { id, deleted };
+        },
+
+        listBindings: async (filters?: { channel?: string; identityId?: string }) => {
+          const channelRaw = filters?.channel?.trim().toLowerCase();
+          const identityIdRaw = filters?.identityId?.trim();
+          let channel: ChannelName | undefined;
+          if (channelRaw) {
+            if (channelRaw === "telegram" || channelRaw === "slack") {
+              channel = channelRaw as ChannelName;
+            } else {
+              throw new Error("Invalid channel");
+            }
+          }
+          const identityId = identityIdRaw ? normalizeIdentityId(identityIdRaw) : undefined;
+          const bindings = store.listBindings({ ...(channel ? { channel } : {}), ...(identityId ? { identityId } : {}) });
+          return {
+            items: bindings.map((entry) => ({
+              channel: entry.channel,
+              identityId: entry.identity_id,
+              peerId: entry.peer_id,
+              directory: entry.directory,
+              updatedAt: entry.updated_at,
+            })),
+          };
+        },
+        setBinding: async (input: { channel: string; identityId?: string; peerId: string; directory: string }) => {
+          const channel = input.channel.trim().toLowerCase();
+          if (channel !== "telegram" && channel !== "slack") {
+            throw new Error("Invalid channel");
+          }
+          const identityId = normalizeIdentityId(input.identityId);
+          const peerKey = input.peerId.trim();
+          const directory = input.directory.trim();
+          if (!peerKey || !directory) {
+            throw new Error("peerId and directory are required");
+          }
+          if (channel === "telegram" && !isTelegramPeerId(peerKey)) {
+            throw invalidTelegramPeerIdError();
+          }
+          const scoped = resolveScopedDirectory(directory);
+          if (!scoped.ok) {
+            const error = new Error(scoped.error) as Error & { status?: number };
+            error.status = 400;
+            throw error;
+          }
+          const normalizedDir = scoped.directory;
+          store.upsertBinding(channel as ChannelName, identityId, peerKey, normalizedDir);
+          store.deleteSession(channel as ChannelName, identityId, peerKey);
+          ensureEventSubscription(normalizedDir);
+        },
+        clearBinding: async (input: { channel: string; identityId?: string; peerId: string }) => {
+          const channel = input.channel.trim().toLowerCase();
+          if (channel !== "telegram" && channel !== "slack") {
+            throw new Error("Invalid channel");
+          }
+          const identityId = normalizeIdentityId(input.identityId);
+          const peerKey = input.peerId.trim();
+          if (!peerKey) {
+            throw new Error("peerId is required");
+          }
+          store.deleteBinding(channel as ChannelName, identityId, peerKey);
+          store.deleteSession(channel as ChannelName, identityId, peerKey);
+        },
+
+        sendMessage: async (input: {
+          channel: string;
+          identityId?: string;
+          directory?: string;
+          peerId?: string;
+          text?: string;
+          parts?: OutboundMessagePart[];
+          autoBind?: boolean;
+        }) => {
+          const channelRaw = input.channel.trim().toLowerCase();
+          if (channelRaw !== "telegram" && channelRaw !== "slack") {
+            throw new Error("Invalid channel");
+          }
+          const channel = channelRaw as ChannelName;
+          const identityId = input.identityId?.trim() ? normalizeIdentityId(input.identityId) : undefined;
+          const directoryInput = (input.directory ?? "").trim();
+          const peerId = (input.peerId ?? "").trim();
+          const autoBind = input.autoBind === true;
+
+          if (!directoryInput && !peerId) {
+            throw new Error("directory or peerId is required");
+          }
+          if (channel === "telegram" && peerId && !isTelegramPeerId(peerId)) {
+            throw invalidTelegramPeerIdError();
+          }
+
+          const normalizedDir = directoryInput ? (() => {
+            const scoped = resolveScopedDirectory(directoryInput);
+            if (!scoped.ok) {
+              const error = new Error(scoped.error) as Error & { status?: number };
+              error.status = 400;
+              throw error;
+            }
+            return scoped.directory;
+          })() : "";
+
+          const baseDirectory = normalizedDir || workspaceRoot;
+          const outboundParts = await resolveOutboundParts(baseDirectory, {
+            text: input.text,
+            parts: input.parts,
+          });
+
+          const makeTargetError = (
+            targetIdentityId: string,
+            targetPeerId: string,
+            errorMessage: string,
+            errorCode = "not_found",
+          ): SendTargetDelivery => ({
+            identityId: targetIdentityId,
+            peerId: targetPeerId,
+            attemptedParts: outboundParts.length,
+            sentParts: 0,
+            partResults: outboundParts.map((part, index) => ({
+              index,
+              type: part.type,
+              sent: false,
+              error: errorMessage,
+              code: errorCode,
+              retryable: false,
+            })),
+          });
+
+          const deliveryFailed = (delivery: MessageDeliveryResult) =>
+            delivery.attemptedParts > 0 && delivery.sentParts < delivery.attemptedParts;
+
+          const primaryFailureMessage = (delivery: MessageDeliveryResult) =>
+            delivery.partResults.find((part) => !part.sent)?.error || "Delivery failed";
+
+          const resolveSendIdentityId = () => {
+            if (identityId) return identityId;
+            if (normalizedDir) {
+              const configured = listIdentityConfigs(channel).find((entry) => {
+                if (!entry.directory) return false;
+                if (!adapters.has(adapterKey(channel, entry.id))) return false;
+                return normalizeDirectory(entry.directory) === normalizedDir;
+              });
+              if (configured?.id) return configured.id;
+            }
+            const active = Array.from(adapters.values()).find((adapter) => adapter.name === channel);
+            return active?.identityId;
+          };
+
+          const targetIdentityId = resolveSendIdentityId();
+          if (peerId && !targetIdentityId) {
+            return {
+              channel,
+              directory: normalizedDir || workspaceRootNormalized,
+              peerId,
+              attempted: 0,
+              sent: 0,
+              reason: `No ${channel} adapter is running for direct send`,
+              targets: [],
+            };
+          }
+
+          if (peerId && targetIdentityId) {
+            const adapter = adapters.get(adapterKey(channel, targetIdentityId));
+            if (!adapter) {
+              const target = makeTargetError(targetIdentityId, peerId, "Adapter not running");
+              return {
+                channel,
+                directory: normalizedDir || workspaceRootNormalized,
+                identityId: targetIdentityId,
+                peerId,
+                attempted: 1,
+                sent: 0,
+                failures: [{ identityId: targetIdentityId, peerId, error: "Adapter not running" }],
+                targets: [target],
+              };
+            }
+
+            if (autoBind && normalizedDir) {
+              store.upsertBinding(channel, targetIdentityId, peerId, normalizedDir);
+              store.deleteSession(channel, targetIdentityId, peerId);
+              ensureEventSubscription(normalizedDir);
+            }
+
+            const delivery = await deliverParts(channel, targetIdentityId, peerId, outboundParts, {
+              kind: "system",
+              display: false,
+            });
+            const failed = deliveryFailed(delivery);
+            return {
+              channel,
+              directory: normalizedDir || workspaceRootNormalized,
+              identityId: targetIdentityId,
+              peerId,
+              attempted: 1,
+              sent: failed ? 0 : 1,
+              ...(failed
+                ? {
+                    failures: [
+                      {
+                        identityId: targetIdentityId,
+                        peerId,
+                        error: primaryFailureMessage(delivery),
+                      },
+                    ],
+                  }
+                : {}),
+              targets: [
+                {
+                  identityId: targetIdentityId,
+                  peerId,
+                  attemptedParts: delivery.attemptedParts,
+                  sentParts: delivery.sentParts,
+                  partResults: delivery.partResults,
+                },
+              ],
+            };
+          }
+
+          const bindings = store.listBindings({
+            channel,
+            ...(identityId ? { identityId } : {}),
+            directory: normalizedDir,
+          });
+          if (bindings.length === 0) {
+            return {
+              channel,
+              directory: normalizedDir,
+              ...(identityId ? { identityId } : {}),
+              attempted: 0,
+              sent: 0,
+              reason: `No bound conversations for ${channel}${identityId ? `/${identityId}` : ""} at directory ${normalizedDir}`,
+              targets: [],
+            };
+          }
+
+          const failures: Array<{ identityId: string; peerId: string; error: string }> = [];
+          const targets: SendTargetDelivery[] = [];
+          let attempted = 0;
+          let sent = 0;
+          for (const binding of bindings) {
+            attempted += 1;
+            if (channel === "telegram" && !isTelegramPeerId(binding.peer_id)) {
+              store.deleteBinding(channel, binding.identity_id, binding.peer_id);
+              store.deleteSession(channel, binding.identity_id, binding.peer_id);
+              const target = makeTargetError(
+                binding.identity_id,
+                binding.peer_id,
+                "Invalid Telegram peerId binding removed (expected numeric chat_id)",
+                "invalid_target",
+              );
+              targets.push(target);
+              failures.push({
+                identityId: binding.identity_id,
+                peerId: binding.peer_id,
+                error: "Invalid Telegram peerId binding removed (expected numeric chat_id)",
+              });
+              continue;
+            }
+            const adapter = adapters.get(adapterKey(channel, binding.identity_id));
+            if (!adapter) {
+              const target = makeTargetError(binding.identity_id, binding.peer_id, "Adapter not running");
+              targets.push(target);
+              failures.push({
+                identityId: binding.identity_id,
+                peerId: binding.peer_id,
+                error: "Adapter not running",
+              });
+              continue;
+            }
+            const delivery = await deliverParts(channel, binding.identity_id, binding.peer_id, outboundParts, {
+              kind: "system",
+              display: false,
+            });
+            targets.push({
+              identityId: binding.identity_id,
+              peerId: binding.peer_id,
+              attemptedParts: delivery.attemptedParts,
+              sentParts: delivery.sentParts,
+              partResults: delivery.partResults,
+            });
+            if (deliveryFailed(delivery)) {
+              failures.push({
+                identityId: binding.identity_id,
+                peerId: binding.peer_id,
+                error: primaryFailureMessage(delivery),
+              });
+            } else {
+              sent += 1;
+            }
+          }
+
+          return {
+            channel,
+            directory: normalizedDir,
+            ...(identityId ? { identityId } : {}),
+            attempted,
+            sent,
+            ...(failures.length ? { failures } : {}),
+            targets,
+          };
+        },
+      },
+    );
+  }
+
+  const eventSubscriptions = new Map<string, AbortController>();
+
+  const ensureEventSubscription = (directory: string) => {
+    if (deps.disableEventStream) return;
+    const resolved = directory.trim() || defaultDirectory;
+    if (!resolved) return;
+    if (eventSubscriptions.has(resolved)) return;
+
+    const abort = new AbortController();
+    eventSubscriptions.set(resolved, abort);
+    const client = getClient(resolved);
+
+    void (async () => {
+      const subscription = await client.event.subscribe(undefined, { signal: abort.signal });
+      for await (const raw of subscription.stream as AsyncIterable<unknown>) {
+        const event = normalizeEvent(raw as any);
+        if (!event) continue;
+
+        if (event.type === "message.updated") {
+          if (event.properties && typeof event.properties === "object") {
+            const record = event.properties as Record<string, unknown>;
+            const info = record.info as Record<string, unknown> | undefined;
+            const sessionID = typeof info?.sessionID === "string" ? (info.sessionID as string) : null;
+            const model = extractModelRef(info);
+            if (sessionID && model) {
+              const key = keyForSession(resolved, sessionID);
+              sessionModels.set(key, model);
+              const run = activeRuns.get(key);
+              if (run) reportThinking(run);
+            }
+          }
+        }
+
+        if (event.type === "session.status") {
+          if (event.properties && typeof event.properties === "object") {
+            const record = event.properties as Record<string, unknown>;
+            const sessionID = typeof record.sessionID === "string" ? record.sessionID : null;
+            const status = record.status as { type?: unknown } | undefined;
+            if (sessionID && (status?.type === "busy" || status?.type === "retry")) {
+              const run = activeRuns.get(keyForSession(resolved, sessionID));
+              if (run) {
+                reportThinking(run);
+                startTyping(run);
+              }
+            }
+          }
+        }
+
+        if (event.type === "session.idle") {
+          if (event.properties && typeof event.properties === "object") {
+            const record = event.properties as Record<string, unknown>;
+            const sessionID = typeof record.sessionID === "string" ? record.sessionID : null;
+            if (sessionID) {
+              const key = keyForSession(resolved, sessionID);
+              stopTyping(key);
+              const run = activeRuns.get(key);
+              if (run) reportDone(run);
+            }
+          }
+        }
+
+        if (event.type === "message.part.updated") {
+          const part = (event.properties as { part?: any })?.part;
+          if (!part?.sessionID) continue;
+          const run = activeRuns.get(keyForSession(resolved, part.sessionID));
+          if (!run || !run.toolUpdatesEnabled) continue;
+          if (part.type !== "tool") continue;
+
+          const callId = part.callID as string | undefined;
+          if (!callId) continue;
+          const state = part.state as { status?: string; input?: Record<string, unknown>; output?: string; title?: string };
+          const status = state?.status ?? "unknown";
+          if (run.seenToolStates.get(callId) === status) continue;
+          run.seenToolStates.set(callId, status);
+
+          const label = TOOL_LABELS[part.tool] ?? part.tool;
+          const title = state.title || truncateText(formatInputSummary(state.input ?? {}), 120) || "running";
+          let message = `[tool] ${label} ${status}: ${title}`;
+
+          if (status === "completed" && state.output) {
+            const output = truncateText(state.output.trim(), config.toolOutputLimit);
+            if (output) message += `\n${output}`;
+          }
+
+          await sendText(run.channel, run.identityId, run.peerId, message, { kind: "tool" });
+        }
+
+        if (event.type === "permission.asked") {
+          const permission = event.properties as { id?: string; sessionID?: string };
+          if (!permission?.id || !permission.sessionID) continue;
+          const response = config.permissionMode === "deny" ? "reject" : "always";
+          await client.permission.respond({
+            sessionID: permission.sessionID,
+            permissionID: permission.id,
+            response,
+          });
+          if (response === "reject") {
+            const run = activeRuns.get(keyForSession(resolved, permission.sessionID));
+            if (run) {
+              await sendText(run.channel, run.identityId, run.peerId, "Permission denied. Update configuration to allow tools.", {
+                kind: "system",
+              });
+            }
+          }
+        }
+      }
+    })().catch((error) => {
+      if (abort.signal.aborted) return;
+      logger.error({ error, directory: resolved }, "event stream closed");
+    });
+  };
+
+  ensureEventSubscription(defaultDirectory);
+
+  async function sendText(
+    channel: ChannelName,
+    identityId: string,
+    peerId: string,
+    text: string,
+    options: { kind?: OutboundKind; display?: boolean } = {},
+  ) {
+    const parts: OutboundMessagePart[] =
+      text.startsWith("FILE:") && text.substring(5).trim()
+        ? [{ type: "file", filePath: text.substring(5).trim() }]
+        : [{ type: "text", text }];
+    const delivery = await deliverParts(channel, identityId, peerId, parts, options);
+    if (delivery.sentParts < delivery.attemptedParts) {
+      const message = delivery.partResults.find((part) => !part.sent)?.error || "Failed to send message";
+      throw new Error(message);
+    }
+  }
+
+  async function handleTelegramPairingGate(input: {
+    identityId: string;
+    peerKey: string;
+    peerId: string;
+    text: string;
+    bindingDirectory?: string;
+    sessionDirectory?: string;
+  }): Promise<"continue" | "handled"> {
+    const access = resolveTelegramIdentityAccess(input.identityId);
+    if (access.access !== "private") {
+      return "continue";
+    }
+
+    const hasKnownBinding = Boolean(input.bindingDirectory?.trim() || input.sessionDirectory?.trim());
+    if (hasKnownBinding) {
+      return "continue";
+    }
+
+    const pairingCode = extractPairingCodeFromCommand(input.text);
+    if (!pairingCode) {
+      await sendText(
+        "telegram",
+        input.identityId,
+        input.peerId,
+        "This Telegram bot is private. Ask your OpenWork host for the pairing code, then send /pair <code>.",
+        { kind: "system" },
+      );
+      return "handled";
+    }
+
+    if (!access.pairingCodeHash) {
+      await sendText(
+        "telegram",
+        input.identityId,
+        input.peerId,
+        "This Telegram bot is private but missing a pairing code. Ask your OpenWork host to reconnect it.",
+        { kind: "system" },
+      );
+      return "handled";
+    }
+
+    if (hashPairingCode(pairingCode) !== access.pairingCodeHash) {
+      await sendText("telegram", input.identityId, input.peerId, "Invalid pairing code. Try again with /pair <code>.", {
+        kind: "system",
+      });
+      return "handled";
+    }
+
+    const identityDirectory = resolveIdentityDirectory("telegram", input.identityId);
+    const boundDirectoryCandidate = identityDirectory || defaultDirectory;
+    const hasExplicitBinding = Boolean(identityDirectory);
+    if (!boundDirectoryCandidate || (!hasExplicitBinding && isDangerousRootDirectory(boundDirectoryCandidate))) {
+      await sendText(
+        "telegram",
+        input.identityId,
+        input.peerId,
+        "No workspace directory configured for this identity. Ask your OpenWork host to set it, or reply with /dir <path>.",
+        { kind: "system" },
+      );
+      return "handled";
+    }
+
+    const scopedBound = resolveScopedDirectory(boundDirectoryCandidate);
+    if (!scopedBound.ok) {
+      await sendText("telegram", input.identityId, input.peerId, scopedBound.error, { kind: "system" });
+      return "handled";
+    }
+
+    const boundDirectory = scopedBound.directory;
+    store.upsertBinding("telegram", input.identityId, input.peerKey, boundDirectory);
+    store.deleteSession("telegram", input.identityId, input.peerKey);
+    ensureEventSubscription(boundDirectory);
+    logger.info(
+      { channel: "telegram", identityId: input.identityId, peerId: input.peerKey, directory: boundDirectory },
+      "telegram private identity paired",
+    );
+    await sendText(
+      "telegram",
+      input.identityId,
+      input.peerId,
+      "Pairing successful. This chat is now linked to your worker.",
+      { kind: "system" },
+    );
+    return "handled";
+  }
+
+  async function handleInbound(message: InboundMessage) {
+    const adapter = adapters.get(adapterKey(message.channel, message.identityId));
+    if (!adapter) return;
+    recordInboundActivity(Date.now());
+    const normalizedParts: InboundMessagePart[] =
+      Array.isArray(message.parts) && message.parts.length
+        ? message.parts
+        : message.text.trim()
+          ? [{ type: "text", text: message.text }]
+          : [];
+    const inboundText = textFromInboundParts(normalizedParts, message.text).trim();
+    let inbound: InboundMessage = {
+      ...message,
+      text: inboundText,
+      ...(normalizedParts.length ? { parts: normalizedParts } : {}),
+    };
+
+    if (inbound.fromMe) {
+      logger.debug(
+        {
+          channel: inbound.channel,
+          identityId: inbound.identityId,
+          peerId: inbound.peerId,
+        },
+        "inbound ignored (self-authored)",
+      );
+      return;
+    }
+
+    const reporterInboundText =
+      inbound.text || summarizeInboundPartsForReporter(inbound.parts) || "[empty message]";
+    logger.debug(
+      {
+        channel: inbound.channel,
+        identityId: inbound.identityId,
+        peerId: inbound.peerId,
+        fromMe: inbound.fromMe,
+        length: reporterInboundText.length,
+        preview: truncateText(reporterInboundText.trim(), 120),
+      },
+      "inbound received",
+    );
+    logger.info(
+      { channel: inbound.channel, identityId: inbound.identityId, peerId: inbound.peerId, length: reporterInboundText.length },
+      "received message",
+    );
+    const peerKey = inbound.peerId;
+    const trimmedText = inbound.text.trim();
+    let binding = store.getBinding(inbound.channel, inbound.identityId, peerKey);
+    let session = store.getSession(inbound.channel, inbound.identityId, peerKey);
+
+    if (inbound.channel === "telegram") {
+      const pairingGate = await handleTelegramPairingGate({
+        identityId: inbound.identityId,
+        peerKey,
+        peerId: inbound.peerId,
+        text: trimmedText,
+        ...(binding?.directory?.trim() ? { bindingDirectory: binding.directory } : {}),
+        ...(session?.directory?.trim() ? { sessionDirectory: session.directory ?? undefined } : {}),
+      });
+      if (pairingGate === "handled") return;
+      binding = store.getBinding(inbound.channel, inbound.identityId, peerKey);
+      session = store.getSession(inbound.channel, inbound.identityId, peerKey);
+    }
+
+    // Handle bot commands
+    if (trimmedText.startsWith("/")) {
+      const commandHandled = await handleCommand(
+        inbound.channel,
+        inbound.identityId,
+        peerKey,
+        inbound.peerId,
+        trimmedText,
+      );
+      if (commandHandled) return;
+    }
+
+    reporter?.onInbound?.({
+      channel: inbound.channel,
+      identityId: inbound.identityId,
+      peerId: inbound.peerId,
+      text: reporterInboundText,
+      fromMe: inbound.fromMe,
+    });
+
+    const identityDirectory = resolveIdentityDirectory(inbound.channel, inbound.identityId);
+
+    const boundDirectoryCandidate =
+      binding?.directory?.trim() || session?.directory?.trim() || identityDirectory || defaultDirectory;
+
+    const hasExplicitBinding = Boolean(binding?.directory?.trim() || session?.directory?.trim() || identityDirectory);
+    if (!boundDirectoryCandidate || (!hasExplicitBinding && isDangerousRootDirectory(boundDirectoryCandidate))) {
+      await sendText(
+        inbound.channel,
+        inbound.identityId,
+        inbound.peerId,
+        "No workspace directory configured for this identity. Ask your OpenWork host to set it, or reply with /dir <path>.",
+        { kind: "system" },
+      );
+      return;
+    }
+
+    const scopedBound = resolveScopedDirectory(boundDirectoryCandidate);
+    if (!scopedBound.ok) {
+      await sendText(inbound.channel, inbound.identityId, inbound.peerId, scopedBound.error, { kind: "system" });
+      return;
+    }
+    const boundDirectory = scopedBound.directory;
+
+    const shouldAutoBind = !(
+      inbound.channel === "telegram" && resolveTelegramIdentityAccess(inbound.identityId).access === "private"
+    );
+    if (shouldAutoBind && !binding?.directory?.trim()) {
+      store.upsertBinding(inbound.channel, inbound.identityId, peerKey, boundDirectory);
+    }
+
+    ensureEventSubscription(boundDirectory);
+
+    const sessionID =
+      session?.session_id && normalizeDirectory(session?.directory ?? "") === normalizeDirectory(boundDirectory)
+        ? session.session_id
+        : await createSession({
+            channel: inbound.channel,
+            identityId: inbound.identityId,
+            peerId: inbound.peerId,
+            peerKey,
+            directory: boundDirectory,
+          });
+    const key = keyForSession(boundDirectory, sessionID);
+    logger.debug(
+      {
+        sessionID,
+        channel: inbound.channel,
+        peerId: inbound.peerId,
+        reused: Boolean(session?.session_id),
+      },
+      "session resolved",
+    );
+
+    enqueue(key, async () => {
+      const runState: RunState = {
+        key,
+        directory: boundDirectory,
+        sessionID,
+        channel: inbound.channel,
+        identityId: inbound.identityId,
+        adapterKey: adapterKey(inbound.channel, inbound.identityId),
+        peerId: inbound.peerId,
+        peerKey,
+        toolUpdatesEnabled: config.toolUpdatesEnabled,
+        seenToolStates: new Map(),
+      };
+      activeRuns.set(key, runState);
+      reportThinking(runState);
+      startTyping(runState);
+      try {
+        const effectiveModel = getUserModel(inbound.channel, inbound.identityId, peerKey, config.model);
+        const messagingAgent = await loadMessagingAgentConfig();
+        const effectiveInstructions = [messagingAgent.instructions, DEFAULT_MESSAGING_AGENT_INSTRUCTIONS]
+          .map((value) => value.trim())
+          .filter(Boolean)
+          .join("\n\n");
+        const attachmentSummary = summarizeInboundPartsForPrompt(inbound.parts);
+        const incomingText = inbound.text || "(no text; user sent media)";
+        const promptText = [
+          "You are handling a Slack/Telegram message via OpenWork.",
+          `Workspace agent file: ${messagingAgent.filePath}`,
+          ...(messagingAgent.selectedAgent ? [`Selected OpenCode agent: ${messagingAgent.selectedAgent}`] : []),
+          "Follow these workspace messaging instructions:",
+          effectiveInstructions,
+          "",
+          "Incoming user message:",
+          incomingText,
+          ...(attachmentSummary.length ? ["", "Incoming attachments:", ...attachmentSummary] : []),
+        ].join("\n");
+        logger.debug(
+          {
+            sessionID,
+            length: inbound.text.length,
+            model: effectiveModel,
+            agent: messagingAgent.selectedAgent,
+          },
+          "prompt start",
+        );
+
+        type PromptPart = { type?: string; text?: string; ignored?: boolean };
+
+        const extractReply = (parts: PromptPart[]) =>
+          parts
+            .filter((part) => part.type === "text" && !part.ignored)
+            .map((part) => part.text ?? "")
+            .join("\n")
+            .trim();
+
+        const logPromptResponse = (attempt: "initial" | "retry", parts: PromptPart[]) => {
+          const textParts = parts.filter((part) => part.type === "text" && !part.ignored);
+          logger.debug(
+            {
+              sessionID,
+              attempt,
+              partCount: parts.length,
+              textCount: textParts.length,
+              partTypes: parts.map((p) => p.type),
+              ignoredCount: parts.filter((p) => p.ignored).length,
+            },
+            "prompt response",
+          );
+        };
+
+        const runPrompt = async (): Promise<PromptPart[]> => {
+          const response = await getClient(boundDirectory).session.prompt({
+            sessionID,
+            parts: [{ type: "text", text: promptText }],
+            ...(effectiveModel ? { model: effectiveModel } : {}),
+            ...(messagingAgent.selectedAgent ? { agent: messagingAgent.selectedAgent } : {}),
+          });
+          return (response as { parts?: PromptPart[] }).parts ?? [];
+        };
+
+        let parts = await runPrompt();
+        logPromptResponse("initial", parts);
+        let reply = extractReply(parts);
+
+        if (!reply && !parts.some((part) => part.type === "tool")) {
+          logger.warn({ sessionID }, "prompt returned no visible text; retrying once");
+          parts = await runPrompt();
+          logPromptResponse("retry", parts);
+          reply = extractReply(parts);
+        }
+
+        if (reply) {
+          logger.debug({ sessionID, replyLength: reply.length }, "reply built");
+          await sendText(inbound.channel, inbound.identityId, inbound.peerId, reply, { kind: "reply" });
+        } else {
+          logger.warn(
+            { sessionID, partTypes: parts.map((part) => part.type), ignoredCount: parts.filter((part) => part.ignored).length },
+            "prompt returned no visible text; clearing session",
+          );
+          store.deleteSession(inbound.channel, inbound.identityId, peerKey);
+          await sendText(
+            inbound.channel,
+            inbound.identityId,
+            inbound.peerId,
+            "No visible response was generated. I reset this chat session in case stale state was blocking replies. Send your message again.",
+            {
+              kind: "system",
+            },
+          );
+        }
+      } catch (error) {
+        // Log full error details for debugging
+        const errorDetails = {
+          message: error instanceof Error ? error.message : String(error),
+          name: error instanceof Error ? error.name : undefined,
+          stack: error instanceof Error ? error.stack?.split("\n").slice(0, 3).join("\n") : undefined,
+          cause: error instanceof Error ? (error as any).cause : undefined,
+          status: (error as any)?.status ?? (error as any)?.statusCode ?? undefined,
+        };
+        logger.error({ error: errorDetails, sessionID }, "prompt failed");
+        
+        // Extract meaningful error details
+        let errorMessage = "Error: failed to reach OpenCode.";
+        if (error instanceof Error) {
+          const msg = error.message || "";
+          // Check for common error patterns
+          if (msg.includes("401") || msg.includes("Unauthorized")) {
+            errorMessage = "Error: OpenCode authentication failed (401). Check credentials.";
+          } else if (msg.includes("403") || msg.includes("Forbidden")) {
+            errorMessage = "Error: OpenCode access forbidden (403).";
+          } else if (msg.includes("404") || msg.includes("Not Found")) {
+            errorMessage = "Error: OpenCode endpoint not found (404).";
+          } else if (msg.includes("429") || msg.includes("rate limit")) {
+            errorMessage = "Error: Rate limited. Please wait and try again.";
+          } else if (msg.includes("500") || msg.includes("Internal Server")) {
+            errorMessage = "Error: OpenCode server error (500).";
+          } else if (msg.includes("model") || msg.includes("provider")) {
+            errorMessage = `Error: Model/provider issue - ${msg.slice(0, 100)}`;
+          } else if (msg.includes("ECONNREFUSED") || msg.includes("connection")) {
+            errorMessage = "Error: Cannot connect to OpenCode. Is it running?";
+          } else if (msg.trim()) {
+            // Include the actual error message (truncated)
+            errorMessage = `Error: ${msg.slice(0, 150)}`;
+          }
+        }
+        
+        await sendText(inbound.channel, inbound.identityId, inbound.peerId, errorMessage, {
+          kind: "system",
+        });
+      } finally {
+        stopTyping(key);
+        reportDone(runState);
+        activeRuns.delete(key);
+      }
+    });
+  }
+
+  async function handleCommand(
+    channel: ChannelName,
+    identityId: string,
+    peerKey: string,
+    peerId: string,
+    text: string,
+  ): Promise<boolean> {
+    const parts = text.slice(1).split(/\s+/);
+    const command = parts[0]?.toLowerCase();
+    const args = parts.slice(1);
+
+    // Model switching commands
+    if (command && MODEL_PRESETS[command]) {
+      const model = MODEL_PRESETS[command];
+      setUserModel(channel, identityId, peerKey, model);
+      await sendText(channel, identityId, peerId, `Model switched to ${model.providerID}/${model.modelID}`, {
+        kind: "system",
+      });
+      logger.info({ channel, peerId: peerKey, model }, "model switched via command");
+      return true;
+    }
+
+    // /model command - show current model
+    if (command === "model") {
+      const current = getUserModel(channel, identityId, peerKey, config.model);
+      const modelStr = current ? `${current.providerID}/${current.modelID}` : "default";
+      await sendText(channel, identityId, peerId, `Current model: ${modelStr}`, { kind: "system" });
+      return true;
+    }
+
+    // /reset command - clear model override and session
+    if (command === "reset") {
+      setUserModel(channel, identityId, peerKey, undefined);
+      store.deleteSession(channel, identityId, peerKey);
+      await sendText(channel, identityId, peerId, "Session and model reset. Send a message to start fresh.", {
+        kind: "system",
+      });
+      logger.info({ channel, peerId: peerKey }, "session and model reset");
+      return true;
+    }
+
+    if (command === "pair") {
+      if (channel !== "telegram") {
+        await sendText(channel, identityId, peerId, "Pairing is only available for Telegram private bots.", {
+          kind: "system",
+        });
+        return true;
+      }
+      const binding = store.getBinding(channel, identityId, peerKey);
+      const session = store.getSession(channel, identityId, peerKey);
+      const pairingGate = await handleTelegramPairingGate({
+        identityId,
+        peerKey,
+        peerId,
+        text,
+        ...(binding?.directory?.trim() ? { bindingDirectory: binding.directory } : {}),
+        ...(session?.directory?.trim() ? { sessionDirectory: session.directory ?? undefined } : {}),
+      });
+      if (pairingGate === "handled") return true;
+      await sendText(channel, identityId, peerId, "This chat is already paired.", { kind: "system" });
+      return true;
+    }
+
+    if (command === "dir" || command === "cd") {
+      const next = args.join(" ").trim();
+      if (!next) {
+        const binding = store.getBinding(channel, identityId, peerKey);
+        const current =
+          binding?.directory?.trim() || store.getSession(channel, identityId, peerKey)?.directory?.trim() || defaultDirectory;
+        await sendText(channel, identityId, peerId, `Current directory: ${current || "(none)"}`, { kind: "system" });
+        return true;
+      }
+      const scoped = resolveScopedDirectory(next);
+      if (!scoped.ok) {
+        await sendText(channel, identityId, peerId, scoped.error, { kind: "system" });
+        return true;
+      }
+      const normalized = scoped.directory;
+      store.upsertBinding(channel, identityId, peerKey, normalized);
+      store.deleteSession(channel, identityId, peerKey);
+      ensureEventSubscription(normalized);
+      await sendText(channel, identityId, peerId, `Directory set to: ${normalized}`, { kind: "system" });
+      return true;
+    }
+
+    if (command === "agent") {
+      const config = await loadMessagingAgentConfig();
+      await sendText(
+        channel,
+        identityId,
+        peerId,
+        [
+          `Scope: workspace`,
+          `Agent file: ${config.filePath}`,
+          `OpenCode agent: ${config.selectedAgent ?? "(none)"}`,
+          `Status: ${config.loaded ? "loaded" : "missing or empty"}`,
+        ].join("\n"),
+        { kind: "system" },
+      );
+      return true;
+    }
+
+    // /help command
+    if (command === "help") {
+      const helpText = `/opus - Claude Opus 4.5\n/codex - GPT 5.2 Codex\n/pair <code> - pair this chat with a private Telegram bot\n/dir <path> - bind this chat to a workspace directory\n/dir - show current directory\n/agent - show workspace agent scope/path\n/model - show current\n/reset - start fresh\n/help - this`;
+      await sendText(channel, identityId, peerId, helpText, { kind: "system" });
+      return true;
+    }
+
+    // Unknown command - don't handle, let it pass through as a message
+    return false;
+  }
+
+  async function createSession(input: {
+    channel: ChannelName;
+    identityId: string;
+    peerId: string;
+    peerKey: string;
+    directory: string;
+  }): Promise<string> {
+    const title = `opencode-router ${input.channel}/${input.identityId} ${input.peerId}`;
+    const session = await getClient(input.directory).session.create({
+      title,
+      permission: buildPermissionRules(config.permissionMode),
+    });
+    const sessionID = (session as { id?: string }).id;
+    if (!sessionID) throw new Error("Failed to create session");
+    store.upsertSession(input.channel, input.identityId, input.peerKey, sessionID, input.directory);
+    logger.info(
+      { sessionID, channel: input.channel, identityId: input.identityId, peerId: input.peerKey, directory: input.directory },
+      "session created",
+    );
+    reportStatus?.(
+      `${CHANNEL_LABELS[input.channel]}/${input.identityId} session created for ${formatPeer(input.channel, input.peerId)} (ID: ${sessionID}).`,
+    );
+    await sendText(input.channel, input.identityId, input.peerId, "🧭 Session started.", { kind: "system" });
+    return sessionID;
+  }
+
+  function enqueue(key: string, task: () => Promise<void>) {
+    const previous = sessionQueue.get(key) ?? Promise.resolve();
+    const next = previous
+      .then(task)
+      .catch((error) => {
+        logger.error({ error }, "session task failed");
+      })
+      .finally(() => {
+        if (sessionQueue.get(key) === next) {
+          sessionQueue.delete(key);
+        }
+      });
+    sessionQueue.set(key, next);
+  }
+
+  for (const adapter of Array.from(adapters.values())) {
+    const startResult = await startAdapterBounded(adapter, {
+      timeoutMs: 8_000,
+      onError: (error) => {
+        logger.error({ error, channel: adapter.name, identityId: adapter.identityId }, "adapter start failed");
+        adapters.delete(adapter.key);
+      },
+    });
+
+    if (startResult.status === "timeout") {
+      logger.warn({ channel: adapter.name, identityId: adapter.identityId, timeoutMs: 8_000 }, "adapter start timed out");
+      reportStatus?.(`${CHANNEL_LABELS[adapter.name]}/${adapter.identityId} adapter starting...`);
+      continue;
+    }
+
+    if (startResult.status === "error") {
+      reportStatus?.(`${CHANNEL_LABELS[adapter.name]}/${adapter.identityId} adapter failed to start.`);
+      continue;
+    }
+
+    reportStatus?.(`${CHANNEL_LABELS[adapter.name]}/${adapter.identityId} adapter started.`);
+  }
+
+  logger.info({ channels: Array.from(adapters.keys()) }, "bridge started");
+  reportStatus?.(`Bridge running. Logs: ${config.logFile}`);
+
+  return {
+    async stop() {
+      if (healthTimer) {
+        clearInterval(healthTimer);
+        healthTimer = null;
+      }
+      if (stopHealthServer) stopHealthServer();
+      for (const abort of eventSubscriptions.values()) {
+        abort.abort();
+      }
+      eventSubscriptions.clear();
+      for (const timer of typingLoops.values()) {
+        clearInterval(timer);
+      }
+      typingLoops.clear();
+      for (const adapter of adapters.values()) {
+        await adapter.stop();
+      }
+      store.close();
+      await delay(50);
+    },
+    async dispatchInbound(message: {
+      channel: ChannelName;
+      identityId?: string;
+      peerId: string;
+      text?: string;
+      parts?: InboundMessagePart[];
+      raw?: unknown;
+      fromMe?: boolean;
+    }) {
+      const identityId = (message.identityId ?? "default").trim() || "default";
+      await handleInbound({
+        channel: message.channel,
+        identityId,
+        peerId: message.peerId,
+        text: message.text ?? "",
+        ...(Array.isArray(message.parts) ? { parts: message.parts } : {}),
+        raw: message.raw ?? null,
+        fromMe: message.fromMe,
+      });
+
+      // For tests and programmatic callers: wait for the session queue to drain.
+      const peerKey = message.peerId;
+      const session = store.getSession(message.channel, identityId, peerKey);
+      const sessionID = session?.session_id;
+      const directory =
+        session?.directory?.trim() || store.getBinding(message.channel, identityId, peerKey)?.directory?.trim() || defaultDirectory;
+      const pending = sessionID && directory ? sessionQueue.get(keyForSession(directory, sessionID)) : null;
+      if (pending) {
+        await pending;
+      }
+    },
+  };
+}
diff --git a/apps/opencode-router/src/cli.ts b/apps/opencode-router/src/cli.ts
new file mode 100644
index 0000000000..e586d0e149
--- /dev/null
+++ b/apps/opencode-router/src/cli.ts
@@ -0,0 +1,635 @@
+#!/usr/bin/env bun
+import fs from "node:fs";
+import { readFile as readFileAsync } from "node:fs/promises";
+import path from "node:path";
+
+import { Command } from "commander";
+import { Bot, InputFile } from "grammy";
+import { WebClient } from "@slack/web-api";
+
+import { startBridge, type BridgeReporter } from "./bridge.js";
+import {
+  loadConfig,
+  readConfigFile,
+  writeConfigFile,
+  type ChannelName,
+  type OpenCodeRouterConfigFile,
+  type SlackIdentity,
+  type TelegramIdentity,
+} from "./config.js";
+import { BridgeStore } from "./db.js";
+import { createLogger } from "./logger.js";
+import { createClient } from "./opencode.js";
+import { parseSlackPeerId } from "./slack.js";
+import { truncateText } from "./text.js";
+
+declare const __OPENCODE_ROUTER_VERSION__: string | undefined;
+
+const VERSION = (() => {
+  if (typeof __OPENCODE_ROUTER_VERSION__ === "string" && __OPENCODE_ROUTER_VERSION__.trim()) {
+    return __OPENCODE_ROUTER_VERSION__.trim();
+  }
+  try {
+    const pkgPath = new URL("../package.json", import.meta.url);
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8")) as { version?: string };
+    if (typeof pkg.version === "string" && pkg.version.trim()) {
+      return pkg.version.trim();
+    }
+  } catch {
+    // ignore
+  }
+  return "0.0.0";
+})();
+
+function outputJson(data: unknown) {
+  console.log(JSON.stringify(data, null, 2));
+}
+
+function outputError(message: string, exitCode = 1): never {
+  if (program.opts().json) {
+    outputJson({ error: message });
+  } else {
+    console.error(`Error: ${message}`);
+  }
+  process.exit(exitCode);
+}
+
+function createAppLogger(config: ReturnType<typeof loadConfig>) {
+  return createLogger(config.logLevel, { logFile: config.logFile });
+}
+
+function createConsoleReporter(): BridgeReporter {
+  const formatChannel = (channel: ChannelName, identityId: string) => {
+    const name = channel === "telegram" ? "Telegram" : "Slack";
+    return `${name}/${identityId}`;
+  };
+
+  const printBlock = (prefix: string, text: string) => {
+    const lines = text.split(/\r?\n/).map((line) => truncateText(line.trim(), 240));
+    const [first, ...rest] = lines.length ? lines : ["(empty)"];
+    console.log(`${prefix} ${first}`);
+    for (const line of rest) {
+      console.log(`${" ".repeat(prefix.length)} ${line}`);
+    }
+  };
+
+  return {
+    onStatus(message) {
+      console.log(message);
+    },
+    onInbound({ channel, identityId, peerId, text, fromMe }) {
+      const base = fromMe ? `${peerId} (me)` : peerId;
+      const prefix = `[${formatChannel(channel, identityId)}] ${base} >`;
+      printBlock(prefix, text);
+    },
+    onOutbound({ channel, identityId, peerId, text, kind }) {
+      const marker = kind === "reply" ? "<" : kind === "tool" ? "*" : "!";
+      const prefix = `[${formatChannel(channel, identityId)}] ${peerId} ${marker}`;
+      printBlock(prefix, text);
+    },
+  };
+}
+
+function updateConfig(configPath: string, updater: (cfg: OpenCodeRouterConfigFile) => OpenCodeRouterConfigFile) {
+  const { config } = readConfigFile(configPath);
+  const base = config ?? { version: 1 };
+  const next = updater(base);
+  next.version = next.version ?? 1;
+  writeConfigFile(configPath, next);
+  return next;
+}
+
+function normalizeIdentityId(value: string | undefined): string {
+  const trimmed = (value ?? "").trim();
+  if (!trimmed) return "default";
+  const safe = trimmed.replace(/[^a-zA-Z0-9_.-]+/g, "-");
+  const cleaned = safe.replace(/^-+|-+$/g, "").slice(0, 48);
+  return cleaned || "default";
+}
+
+function upsertTelegramBot(cfg: OpenCodeRouterConfigFile, identity: TelegramIdentity): OpenCodeRouterConfigFile {
+  const next = { ...cfg };
+  next.channels = next.channels ?? {};
+  const existing = next.channels.telegram ?? {};
+  const bots = Array.isArray(existing.bots) ? existing.bots.slice() : [];
+  const id = normalizeIdentityId(identity.id);
+  const filtered = bots.filter((b) => normalizeIdentityId(b.id) !== id);
+  filtered.push({ id, token: identity.token, enabled: identity.enabled !== false });
+  next.channels.telegram = { ...existing, enabled: true, bots: filtered };
+  return next;
+}
+
+function deleteTelegramBot(cfg: OpenCodeRouterConfigFile, idRaw: string): { next: OpenCodeRouterConfigFile; deleted: boolean } {
+  const id = normalizeIdentityId(idRaw);
+  const next = { ...cfg };
+  next.channels = next.channels ?? {};
+  const existing = next.channels.telegram ?? {};
+  const bots = Array.isArray(existing.bots) ? existing.bots.slice() : [];
+  const filtered = bots.filter((b) => normalizeIdentityId(b.id) !== id);
+  const deleted = filtered.length !== bots.length;
+  next.channels.telegram = { ...existing, bots: filtered };
+  return { next, deleted };
+}
+
+function upsertSlackApp(cfg: OpenCodeRouterConfigFile, identity: SlackIdentity): OpenCodeRouterConfigFile {
+  const next = { ...cfg };
+  next.channels = next.channels ?? {};
+  const existing = next.channels.slack ?? {};
+  const apps = Array.isArray(existing.apps) ? existing.apps.slice() : [];
+  const id = normalizeIdentityId(identity.id);
+  const filtered = apps.filter((a) => normalizeIdentityId(a.id) !== id);
+  filtered.push({ id, botToken: identity.botToken, appToken: identity.appToken, enabled: identity.enabled !== false });
+  next.channels.slack = { ...existing, enabled: true, apps: filtered };
+  return next;
+}
+
+function deleteSlackApp(cfg: OpenCodeRouterConfigFile, idRaw: string): { next: OpenCodeRouterConfigFile; deleted: boolean } {
+  const id = normalizeIdentityId(idRaw);
+  const next = { ...cfg };
+  next.channels = next.channels ?? {};
+  const existing = next.channels.slack ?? {};
+  const apps = Array.isArray(existing.apps) ? existing.apps.slice() : [];
+  const filtered = apps.filter((a) => normalizeIdentityId(a.id) !== id);
+  const deleted = filtered.length !== apps.length;
+  next.channels.slack = { ...existing, apps: filtered };
+  return { next, deleted };
+}
+
+async function runStart(pathOverride?: string, options?: { opencodeUrl?: string }) {
+  if (pathOverride?.trim()) {
+    process.env.OPENCODE_DIRECTORY = pathOverride.trim();
+  }
+  if (options?.opencodeUrl?.trim()) {
+    process.env.OPENCODE_URL = options.opencodeUrl.trim();
+  }
+  const config = loadConfig();
+  const logger = createAppLogger(config);
+  const reporter = createConsoleReporter();
+  if (!process.env.OPENCODE_DIRECTORY) {
+    process.env.OPENCODE_DIRECTORY = config.opencodeDirectory;
+  }
+  const bridge = await startBridge(config, logger, reporter);
+  if (process.stdout.isTTY) {
+    reporter.onStatus?.("Commands: opencode-router identities, opencode-router bindings, opencode-router status");
+  }
+
+  const shutdown = async () => {
+    logger.info("shutting down");
+    await bridge.stop();
+    process.exit(0);
+  };
+
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+const program = new Command();
+
+program
+  .name("opencode-router")
+  .version(VERSION)
+  .description("opencode-router: Slack + Telegram bridge + directory routing")
+  .option("--json", "Output in JSON format", false);
+
+program
+  .command("start")
+  .description("Start the bridge")
+  .argument("[path]", "opencode workspace path")
+  .option("--opencode-url <url>", "opencode server URL")
+  .action((pathArg?: string, options?: { opencodeUrl?: string }) => runStart(pathArg, options));
+
+program
+  .command("serve")
+  .description("Start the bridge (headless)")
+  .argument("[path]", "opencode workspace path")
+  .option("--opencode-url <url>", "opencode server URL")
+  .action((pathArg?: string, options?: { opencodeUrl?: string }) => runStart(pathArg, options));
+
+program
+  .command("health")
+  .description("Check opencode health (exit 0 if healthy, 1 if not)")
+  .action(async () => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    try {
+      const client = createClient(config);
+      const health = await client.global.health();
+      const healthy = Boolean((health as { healthy?: boolean }).healthy);
+      if (useJson) {
+        outputJson({
+          healthy,
+          opencodeUrl: config.opencodeUrl,
+          identities: {
+            telegram: config.telegramBots.map((b) => ({ id: b.id, enabled: b.enabled !== false })),
+            slack: config.slackApps.map((a) => ({ id: a.id, enabled: a.enabled !== false })),
+          },
+        });
+      } else {
+        console.log(`Healthy: ${healthy ? "yes" : "no"}`);
+        console.log(`opencode URL: ${config.opencodeUrl}`);
+      }
+      process.exit(healthy ? 0 : 1);
+    } catch (error) {
+      if (useJson) {
+        outputJson({
+          healthy: false,
+          error: String(error),
+          opencodeUrl: config.opencodeUrl,
+        });
+      } else {
+        console.log("Healthy: no");
+        console.log(`Error: ${String(error)}`);
+      }
+      process.exit(1);
+    }
+  });
+
+program
+  .command("status")
+  .description("Show identity and opencode status")
+  .action(() => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const telegram = config.telegramBots.map((b) => ({ id: b.id, enabled: b.enabled !== false }));
+    const slack = config.slackApps.map((a) => ({ id: a.id, enabled: a.enabled !== false }));
+    if (useJson) {
+      outputJson({
+        config: config.configPath,
+        healthPort: config.healthPort ?? null,
+        telegram,
+        slack,
+        opencode: { url: config.opencodeUrl, directory: config.opencodeDirectory },
+      });
+      return;
+    }
+    console.log(`Config: ${config.configPath}`);
+    console.log(`Health port: ${config.healthPort ?? "(not set)"}`);
+    console.log(`Telegram bots: ${telegram.length}`);
+    console.log(`Slack apps: ${slack.length}`);
+    console.log(`opencode URL: ${config.opencodeUrl}`);
+  });
+
+// -----------------------------------------------------------------------------
+// Config helpers
+// -----------------------------------------------------------------------------
+
+const configCmd = program.command("config").description("Manage configuration");
+
+configCmd
+  .command("get")
+  .argument("[key]", "Config key to get (dot notation)")
+  .description("Get config value(s)")
+  .action((key?: string) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const { config: configFile } = readConfigFile(config.configPath);
+    if (!key) {
+      if (useJson) outputJson(configFile);
+      else console.log(JSON.stringify(configFile, null, 2));
+      return;
+    }
+
+    const keys = key.split(".");
+    let current: any = configFile as any;
+    for (const k of keys) {
+      if (current === null || current === undefined || typeof current !== "object") {
+        current = undefined;
+        break;
+      }
+      current = current[k];
+    }
+
+    if (useJson) outputJson({ [key]: current });
+    else console.log(`${key}: ${current === undefined ? "(not set)" : typeof current === "object" ? JSON.stringify(current, null, 2) : current}`);
+  });
+
+configCmd
+  .command("set")
+  .argument("<key>", "Config key to set (dot notation)")
+  .argument("<value>", "Value to set (JSON for arrays/objects)")
+  .description("Set config value")
+  .action((key: string, value: string) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const parsed = (() => {
+      try {
+        return JSON.parse(value);
+      } catch {
+        return value;
+      }
+    })();
+
+    const updated = updateConfig(config.configPath, (cfg) => {
+      const next: any = { ...cfg };
+      const keys = key.split(".");
+      let cur: any = next;
+      for (let i = 0; i < keys.length - 1; i++) {
+        const k = keys[i];
+        if (cur[k] === undefined || cur[k] === null || typeof cur[k] !== "object") cur[k] = {};
+        cur = cur[k];
+      }
+      cur[keys[keys.length - 1]] = parsed;
+      return next as OpenCodeRouterConfigFile;
+    });
+
+    if (useJson) outputJson({ success: true, key, value: parsed, config: updated });
+    else console.log(`Set ${key} = ${JSON.stringify(parsed)}`);
+  });
+
+// -----------------------------------------------------------------------------
+// Identities
+// -----------------------------------------------------------------------------
+
+const telegram = program.command("telegram").description("Telegram identities");
+
+telegram
+  .command("list")
+  .description("List Telegram bot identities")
+  .action(() => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const items = config.telegramBots.map((b) => ({ id: b.id, enabled: b.enabled !== false }));
+    if (useJson) outputJson({ items });
+    else for (const item of items) console.log(`${item.id} ${item.enabled ? "enabled" : "disabled"}`);
+  });
+
+telegram
+  .command("add")
+  .argument("<token>", "Telegram bot token")
+  .option("--id <id>", "Identity id (default: default)")
+  .option("--disabled", "Add identity but disable it", false)
+  .description("Add or update a Telegram bot identity")
+  .action((token: string, opts: { id?: string; disabled?: boolean }) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const id = normalizeIdentityId(opts.id);
+    const enabled = !opts.disabled;
+    updateConfig(config.configPath, (cfg) => upsertTelegramBot(cfg, { id, token: token.trim(), enabled }));
+    if (useJson) outputJson({ success: true, id, enabled });
+    else console.log(`Saved Telegram identity: ${id}`);
+  });
+
+telegram
+  .command("remove")
+  .argument("<id>", "Identity id")
+  .description("Remove a Telegram bot identity")
+  .action((idRaw: string) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const { next, deleted } = deleteTelegramBot(readConfigFile(config.configPath).config, idRaw);
+    writeConfigFile(config.configPath, next);
+    if (useJson) outputJson({ success: deleted, id: normalizeIdentityId(idRaw) });
+    else console.log(deleted ? `Removed Telegram identity: ${normalizeIdentityId(idRaw)}` : "Identity not found.");
+    process.exit(deleted ? 0 : 1);
+  });
+
+const slack = program.command("slack").description("Slack identities");
+
+slack
+  .command("list")
+  .description("List Slack app identities")
+  .action(() => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const items = config.slackApps.map((a) => ({ id: a.id, enabled: a.enabled !== false }));
+    if (useJson) outputJson({ items });
+    else for (const item of items) console.log(`${item.id} ${item.enabled ? "enabled" : "disabled"}`);
+  });
+
+slack
+  .command("add")
+  .argument("<botToken>", "Slack bot token (xoxb-...)")
+  .argument("<appToken>", "Slack app token (xapp-...)")
+  .option("--id <id>", "Identity id (default: default)")
+  .option("--disabled", "Add identity but disable it", false)
+  .description("Add or update a Slack app identity")
+  .action((botToken: string, appToken: string, opts: { id?: string; disabled?: boolean }) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const id = normalizeIdentityId(opts.id);
+    const enabled = !opts.disabled;
+    updateConfig(config.configPath, (cfg) =>
+      upsertSlackApp(cfg, { id, botToken: botToken.trim(), appToken: appToken.trim(), enabled }),
+    );
+    if (useJson) outputJson({ success: true, id, enabled });
+    else console.log(`Saved Slack identity: ${id}`);
+  });
+
+slack
+  .command("remove")
+  .argument("<id>", "Identity id")
+  .description("Remove a Slack identity")
+  .action((idRaw: string) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const { next, deleted } = deleteSlackApp(readConfigFile(config.configPath).config, idRaw);
+    writeConfigFile(config.configPath, next);
+    if (useJson) outputJson({ success: deleted, id: normalizeIdentityId(idRaw) });
+    else console.log(deleted ? `Removed Slack identity: ${normalizeIdentityId(idRaw)}` : "Identity not found.");
+    process.exit(deleted ? 0 : 1);
+  });
+
+// -----------------------------------------------------------------------------
+// Bindings
+// -----------------------------------------------------------------------------
+
+const bindings = program.command("bindings").description("Manage identity-scoped bindings");
+
+bindings
+  .command("list")
+  .option("--channel <channel>", "telegram|slack")
+  .option("--identity <id>", "Identity id")
+  .description("List bindings")
+  .action((opts: { channel?: string; identity?: string }) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const store = new BridgeStore(config.dbPath);
+    const channelRaw = opts.channel?.trim().toLowerCase();
+    const identityId = opts.identity?.trim() ? normalizeIdentityId(opts.identity) : undefined;
+    const channel: ChannelName | undefined =
+      channelRaw === "telegram" || channelRaw === "slack" ? (channelRaw as ChannelName) : channelRaw ? (outputError("Invalid channel"), undefined) : undefined;
+    const items = store
+      .listBindings({ ...(channel ? { channel } : {}), ...(identityId ? { identityId } : {}) })
+      .map((b) => ({
+        channel: b.channel,
+        identityId: b.identity_id,
+        peerId: b.peer_id,
+        directory: b.directory,
+        updatedAt: b.updated_at,
+      }));
+    store.close();
+    if (useJson) outputJson({ items });
+    else for (const item of items) console.log(`${item.channel}/${item.identityId} ${item.peerId} -> ${item.directory}`);
+  });
+
+bindings
+  .command("set")
+  .requiredOption("--channel <channel>", "telegram|slack")
+  .requiredOption("--identity <id>", "Identity id")
+  .requiredOption("--peer <peerId>", "Peer id")
+  .requiredOption("--dir <directory>", "Directory")
+  .description("Set a binding")
+  .action((opts: { channel: string; identity: string; peer: string; dir: string }) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const store = new BridgeStore(config.dbPath);
+    const channelRaw = opts.channel.trim().toLowerCase();
+    if (channelRaw !== "telegram" && channelRaw !== "slack") outputError("Invalid channel");
+    const identityId = normalizeIdentityId(opts.identity);
+    const peerId = opts.peer.trim();
+    const directory = opts.dir.trim();
+    if (!peerId || !directory) outputError("peer and dir are required");
+    store.upsertBinding(channelRaw as ChannelName, identityId, peerId, directory);
+    store.deleteSession(channelRaw as ChannelName, identityId, peerId);
+    store.close();
+    if (useJson) outputJson({ success: true });
+    else console.log("Binding saved.");
+  });
+
+bindings
+  .command("clear")
+  .requiredOption("--channel <channel>", "telegram|slack")
+  .requiredOption("--identity <id>", "Identity id")
+  .requiredOption("--peer <peerId>", "Peer id")
+  .description("Clear a binding")
+  .action((opts: { channel: string; identity: string; peer: string }) => {
+    const useJson = program.opts().json;
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const store = new BridgeStore(config.dbPath);
+    const channelRaw = opts.channel.trim().toLowerCase();
+    if (channelRaw !== "telegram" && channelRaw !== "slack") outputError("Invalid channel");
+    const identityId = normalizeIdentityId(opts.identity);
+    const peerId = opts.peer.trim();
+    const ok = store.deleteBinding(channelRaw as ChannelName, identityId, peerId);
+    store.deleteSession(channelRaw as ChannelName, identityId, peerId);
+    store.close();
+    if (useJson) outputJson({ success: ok });
+    else console.log(ok ? "Binding removed." : "Binding not found.");
+    process.exit(ok ? 0 : 1);
+  });
+
+// -----------------------------------------------------------------------------
+// Send helper
+// -----------------------------------------------------------------------------
+
+program
+  .command("send")
+  .description("Send a test message and/or media")
+  .requiredOption("--channel <channel>", "telegram or slack")
+  .requiredOption("--identity <id>", "Identity id")
+  .requiredOption("--to <recipient>", "Recipient ID (chat ID or peerId)")
+  .option("--message <text>", "Message text to send")
+  .option("--image <path>", "Image file path")
+  .option("--audio <path>", "Audio file path")
+  .option("--file <path>", "File path")
+  .option("--caption <text>", "Caption for media upload")
+  .action(async (opts: {
+    channel: string;
+    identity: string;
+    to: string;
+    message?: string;
+    image?: string;
+    audio?: string;
+    file?: string;
+    caption?: string;
+  }) => {
+    const useJson = program.opts().json;
+    const channelRaw = opts.channel.trim().toLowerCase();
+    if (channelRaw !== "telegram" && channelRaw !== "slack") {
+      outputError("Invalid channel. Must be 'telegram' or 'slack'.");
+    }
+
+    const config = loadConfig(process.env, { requireOpencode: false });
+    const identityId = normalizeIdentityId(opts.identity);
+    const to = opts.to.trim();
+    const message = typeof opts.message === "string" ? opts.message : "";
+    const media = [
+      ...(opts.image?.trim() ? [{ type: "image" as const, filePath: path.resolve(opts.image.trim()) }] : []),
+      ...(opts.audio?.trim() ? [{ type: "audio" as const, filePath: path.resolve(opts.audio.trim()) }] : []),
+      ...(opts.file?.trim() ? [{ type: "file" as const, filePath: path.resolve(opts.file.trim()) }] : []),
+    ];
+    const caption = typeof opts.caption === "string" ? opts.caption.trim() : "";
+
+    if (!message.trim() && media.length === 0) {
+      outputError("Provide at least one of --message, --image, --audio, or --file.");
+    }
+
+    try {
+      if (channelRaw === "telegram") {
+        const bot = config.telegramBots.find((b) => b.id === identityId);
+        if (!bot) throw new Error(`Telegram identity not found: ${identityId}`);
+        const tg = new Bot(bot.token);
+        const chatId = Number(to);
+        if (!Number.isFinite(chatId)) {
+          throw new Error("Telegram recipient must be numeric chat_id.");
+        }
+        if (message.trim()) {
+          await tg.api.sendMessage(chatId, message);
+        }
+        for (const item of media) {
+          if (item.type === "image") {
+            await tg.api.sendPhoto(chatId, new InputFile(item.filePath), {
+              ...(caption ? { caption } : {}),
+            });
+          } else if (item.type === "audio") {
+            await tg.api.sendAudio(chatId, new InputFile(item.filePath), {
+              ...(caption ? { caption } : {}),
+            });
+          } else {
+            await tg.api.sendDocument(chatId, new InputFile(item.filePath), {
+              ...(caption ? { caption } : {}),
+            });
+          }
+        }
+      } else {
+        const app = config.slackApps.find((a) => a.id === identityId);
+        if (!app) throw new Error(`Slack identity not found: ${identityId}`);
+        const web = new WebClient(app.botToken);
+        const peer = parseSlackPeerId(to);
+        if (!peer.channelId) throw new Error("Invalid recipient for Slack.");
+        if (message.trim()) {
+          await web.chat.postMessage({
+            channel: peer.channelId,
+            text: message,
+            ...(peer.threadTs ? { thread_ts: peer.threadTs } : {}),
+          } as any);
+        }
+        for (const item of media) {
+          const fileData = await readFileAsync(item.filePath);
+          await (web as any).files.uploadV2({
+            channel_id: peer.channelId,
+            file: fileData,
+            filename: path.basename(item.filePath),
+            ...(peer.threadTs ? { thread_ts: peer.threadTs } : {}),
+            ...(caption ? { initial_comment: caption } : {}),
+          });
+        }
+      }
+
+      if (useJson)
+        outputJson({
+          success: true,
+          sent: {
+            text: Boolean(message.trim()),
+            media: media.map((item) => ({ type: item.type, filePath: item.filePath })),
+          },
+        });
+      else console.log("Message sent.");
+      process.exit(0);
+    } catch (error) {
+      if (useJson) outputJson({ success: false, error: String(error) });
+      else console.error(`Failed to send message: ${String(error)}`);
+      process.exit(1);
+    }
+  });
+
+program.action(() => {
+  program.outputHelp();
+});
+
+program.parseAsync(process.argv).catch((error) => {
+  const useJson = program.opts().json;
+  if (useJson) outputJson({ error: String(error) });
+  else console.error(error);
+  process.exitCode = 1;
+});
diff --git a/apps/opencode-router/src/config.ts b/apps/opencode-router/src/config.ts
new file mode 100644
index 0000000000..831b9242ca
--- /dev/null
+++ b/apps/opencode-router/src/config.ts
@@ -0,0 +1,296 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import dotenv from "dotenv";
+
+const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(moduleDir, "..");
+dotenv.config({ path: path.join(packageDir, ".env") });
+dotenv.config();
+
+export type ChannelName = "telegram" | "slack";
+
+export type TelegramIdentity = {
+  id: string;
+  token: string;
+  enabled?: boolean;
+  // Optional default workspace directory to route peers into.
+  // When set, opencodeRouter will auto-bind new peerIds to this directory.
+  directory?: string;
+  // Optional access mode. Private mode requires `/pair <code>` before first use.
+  access?: "public" | "private";
+  // sha256 hash (hex) of normalized pairing code for private mode.
+  pairingCodeHash?: string;
+};
+
+export type SlackIdentity = {
+  id: string;
+  botToken: string;
+  appToken: string;
+  enabled?: boolean;
+  directory?: string;
+};
+
+export type OpenCodeRouterConfigFile = {
+  version: number;
+  opencodeUrl?: string;
+  opencodeDirectory?: string;
+  groupsEnabled?: boolean;
+  channels?: {
+    telegram?: {
+      enabled?: boolean;
+      // New format (multi-bot)
+      bots?: TelegramIdentity[];
+      // Legacy (single)
+      token?: string;
+    };
+    slack?: {
+      enabled?: boolean;
+      // New format (multi-app)
+      apps?: SlackIdentity[];
+      // Legacy (single)
+      botToken?: string;
+      appToken?: string;
+    };
+  };
+};
+
+export type ModelRef = {
+  providerID: string;
+  modelID: string;
+};
+
+export type Config = {
+  configPath: string;
+  configFile: OpenCodeRouterConfigFile;
+  opencodeUrl: string;
+  opencodeDirectory: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  model?: ModelRef;
+  telegramBots: TelegramIdentity[];
+  slackApps: SlackIdentity[];
+  dataDir: string;
+  dbPath: string;
+  logFile: string;
+  toolUpdatesEnabled: boolean;
+  groupsEnabled: boolean;
+  permissionMode: "allow" | "deny";
+  toolOutputLimit: number;
+  healthPort?: number;
+  logLevel: string;
+};
+
+type EnvLike = NodeJS.ProcessEnv;
+
+function parseBoolean(value: string | undefined, fallback: boolean): boolean {
+  if (value === undefined) return fallback;
+  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
+}
+
+function parseInteger(value: string | undefined): number | undefined {
+  if (!value) return undefined;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function parseList(value: string | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function parseModel(value: string | undefined): ModelRef | undefined {
+  if (!value?.trim()) return undefined;
+  const parts = value.trim().split("/");
+  if (parts.length < 2) return undefined;
+  const providerID = parts[0];
+  const modelID = parts.slice(1).join("/");
+  if (!providerID || !modelID) return undefined;
+  return { providerID, modelID };
+}
+
+function expandHome(value: string): string {
+  if (!value.startsWith("~/")) return value;
+  return path.join(os.homedir(), value.slice(2));
+}
+
+function resolveConfigPath(dataDir: string, env: EnvLike): string {
+  const override = env.OPENCODE_ROUTER_CONFIG_PATH?.trim();
+  if (override) return expandHome(override);
+  return path.join(dataDir, "opencode-router.json");
+}
+
+export function readConfigFile(configPath: string): { exists: boolean; config: OpenCodeRouterConfigFile } {
+  try {
+    const raw = fs.readFileSync(configPath, "utf-8");
+    const parsed = JSON.parse(raw) as OpenCodeRouterConfigFile;
+    return { exists: true, config: parsed };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return { exists: false, config: { version: 1 } };
+    }
+    throw error;
+  }
+}
+
+export function writeConfigFile(configPath: string, config: OpenCodeRouterConfigFile) {
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+
+function normalizeId(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) return "";
+  const safe = trimmed.replace(/[^a-zA-Z0-9_.-]+/g, "-");
+  return safe.replace(/^-+|-+$/g, "").slice(0, 48) || "default";
+}
+
+const PAIRING_CODE_HASH_PATTERN = /^[a-f0-9]{64}$/;
+
+function normalizeTelegramAccess(value: unknown): "public" | "private" {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return raw === "private" ? "private" : "public";
+}
+
+function normalizePairingCodeHash(value: unknown): string {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (!PAIRING_CODE_HASH_PATTERN.test(raw)) return "";
+  return raw;
+}
+
+function coerceTelegramBots(file: OpenCodeRouterConfigFile): TelegramIdentity[] {
+  const telegram = file.channels?.telegram;
+  const bots = Array.isArray((telegram as any)?.bots) ? ((telegram as any).bots as unknown[]) : [];
+  const normalized: TelegramIdentity[] = [];
+  for (const entry of bots) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry as Record<string, unknown>;
+    const token = typeof record.token === "string" ? record.token.trim() : "";
+    if (!token) continue;
+    const id = normalizeId(typeof record.id === "string" ? record.id : "default");
+    const directory = typeof record.directory === "string" ? record.directory.trim() : "";
+    const access = normalizeTelegramAccess(record.access);
+    const pairingCodeHash = normalizePairingCodeHash(record.pairingCodeHash);
+    normalized.push({
+      id,
+      token,
+      enabled: record.enabled === undefined ? true : record.enabled === true,
+      ...(directory ? { directory } : {}),
+      ...(access === "private" ? { access, ...(pairingCodeHash ? { pairingCodeHash } : {}) } : { access: "public" }),
+    });
+  }
+  if (normalized.length) return normalized;
+
+  // Legacy single-bot migration (in-memory).
+  const legacyToken = typeof (telegram as any)?.token === "string" ? String((telegram as any).token).trim() : "";
+  if (legacyToken) {
+    return [{ id: "default", token: legacyToken, enabled: true }];
+  }
+  return [];
+}
+
+function coerceSlackApps(file: OpenCodeRouterConfigFile): SlackIdentity[] {
+  const slack = file.channels?.slack;
+  const apps = Array.isArray((slack as any)?.apps) ? ((slack as any).apps as unknown[]) : [];
+  const normalized: SlackIdentity[] = [];
+  for (const entry of apps) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry as Record<string, unknown>;
+    const botToken = typeof record.botToken === "string" ? record.botToken.trim() : "";
+    const appToken = typeof record.appToken === "string" ? record.appToken.trim() : "";
+    if (!botToken || !appToken) continue;
+    const id = normalizeId(typeof record.id === "string" ? record.id : "default");
+    const directory = typeof record.directory === "string" ? record.directory.trim() : "";
+    normalized.push({
+      id,
+      botToken,
+      appToken,
+      enabled: record.enabled === undefined ? true : record.enabled === true,
+      ...(directory ? { directory } : {}),
+    });
+  }
+  if (normalized.length) return normalized;
+
+  // Legacy single-app migration (in-memory).
+  const legacyBot = typeof (slack as any)?.botToken === "string" ? String((slack as any).botToken).trim() : "";
+  const legacyApp = typeof (slack as any)?.appToken === "string" ? String((slack as any).appToken).trim() : "";
+  if (legacyBot && legacyApp) {
+    return [{ id: "default", botToken: legacyBot, appToken: legacyApp, enabled: true }];
+  }
+  return [];
+}
+
+export function loadConfig(
+  env: EnvLike = process.env,
+  options: { requireOpencode?: boolean } = {},
+): Config {
+  const requireOpencode = options.requireOpencode ?? false;
+
+  const defaultDataDir = path.join(os.homedir(), ".openwork", "opencode-router");
+  const dataDir = expandHome(env.OPENCODE_ROUTER_DATA_DIR ?? defaultDataDir);
+  const dbPath = expandHome(env.OPENCODE_ROUTER_DB_PATH ?? path.join(dataDir, "opencode-router.db"));
+  const logFile = expandHome(env.OPENCODE_ROUTER_LOG_FILE ?? path.join(dataDir, "logs", "opencode-router.log"));
+  const configPath = resolveConfigPath(dataDir, env);
+  let { config: configFile } = readConfigFile(configPath);
+  const opencodeDirectory = env.OPENCODE_DIRECTORY?.trim() || configFile.opencodeDirectory || "";
+  if (!opencodeDirectory && requireOpencode) {
+    throw new Error("OPENCODE_DIRECTORY is required");
+  }
+  const resolvedDirectory = opencodeDirectory || process.cwd();
+
+  const toolOutputLimit = parseInteger(env.TOOL_OUTPUT_LIMIT) ?? 1200;
+  const permissionMode = env.PERMISSION_MODE?.toLowerCase() === "deny" ? "deny" : "allow";
+
+  // Identities are loaded from config. Env vars are still supported as a convenience
+  // for single-identity setups.
+  const telegramBots = coerceTelegramBots(configFile);
+  const slackApps = coerceSlackApps(configFile);
+
+  const envTelegram = env.TELEGRAM_BOT_TOKEN?.trim() ?? "";
+  if (envTelegram && !telegramBots.some((bot) => bot.token === envTelegram)) {
+    telegramBots.unshift({ id: "env", token: envTelegram, enabled: true });
+  }
+  const envSlackBot = env.SLACK_BOT_TOKEN?.trim() ?? "";
+  const envSlackApp = env.SLACK_APP_TOKEN?.trim() ?? "";
+  if (envSlackBot && envSlackApp && !slackApps.some((app) => app.botToken === envSlackBot && app.appToken === envSlackApp)) {
+    slackApps.unshift({ id: "env", botToken: envSlackBot, appToken: envSlackApp, enabled: true });
+  }
+  const healthPort =
+    parseInteger(env.OPENCODE_ROUTER_HEALTH_PORT) ??
+    // Convenience alias (common on PaaS / local experiments)
+    parseInteger(env.PORT) ??
+    3005;
+  const model = parseModel(env.OPENCODE_ROUTER_MODEL);
+
+  const telegramEnabledDefault = configFile.channels?.telegram?.enabled ?? true;
+  const slackEnabledDefault = configFile.channels?.slack?.enabled ?? true;
+
+  return {
+    configPath,
+    configFile,
+    opencodeUrl: env.OPENCODE_URL?.trim() || configFile.opencodeUrl || "http://127.0.0.1:4096",
+    opencodeDirectory: resolvedDirectory,
+    opencodeUsername: env.OPENCODE_SERVER_USERNAME?.trim() || undefined,
+    opencodePassword: env.OPENCODE_SERVER_PASSWORD?.trim() || undefined,
+    model,
+    telegramBots: telegramBots.map((bot) => ({ ...bot, enabled: bot.enabled !== false && parseBoolean(env.TELEGRAM_ENABLED, telegramEnabledDefault) })),
+    slackApps: slackApps.map((app) => ({
+      ...app,
+      enabled: app.enabled !== false && parseBoolean(env.SLACK_ENABLED, slackEnabledDefault),
+    })),
+    dataDir,
+    dbPath,
+    logFile,
+    toolUpdatesEnabled: parseBoolean(env.TOOL_UPDATES_ENABLED, false),
+    groupsEnabled: parseBoolean(env.GROUPS_ENABLED, configFile.groupsEnabled ?? false),
+    permissionMode,
+    toolOutputLimit,
+    healthPort,
+    logLevel: env.LOG_LEVEL?.trim() || "info",
+  };
+}
diff --git a/apps/opencode-router/src/db.ts b/apps/opencode-router/src/db.ts
new file mode 100644
index 0000000000..bc1e738cfe
--- /dev/null
+++ b/apps/opencode-router/src/db.ts
@@ -0,0 +1,260 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import type { ChannelName } from "./config.js";
+
+type SessionRow = {
+  channel: ChannelName;
+  identity_id: string;
+  peer_id: string;
+  session_id: string;
+  directory?: string | null;
+  created_at: number;
+  updated_at: number;
+};
+
+type BindingRow = {
+  channel: ChannelName;
+  identity_id: string;
+  peer_id: string;
+  directory: string;
+  created_at: number;
+  updated_at: number;
+};
+
+type AllowlistRow = {
+  channel: ChannelName;
+  peer_id: string;
+  created_at: number;
+};
+
+export class BridgeStore {
+  private db: Database;
+
+  constructor(private readonly dbPath: string) {
+    this.ensureDir();
+    this.db = new Database(dbPath, { create: true });
+    this.db.exec("PRAGMA journal_mode = WAL");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS sessions (
+        channel TEXT NOT NULL,
+        identity_id TEXT NOT NULL,
+        peer_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        directory TEXT,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (channel, identity_id, peer_id)
+      );
+      CREATE TABLE IF NOT EXISTS allowlist (
+        channel TEXT NOT NULL,
+        peer_id TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (channel, peer_id)
+      );
+      CREATE TABLE IF NOT EXISTS bindings (
+        channel TEXT NOT NULL,
+        identity_id TEXT NOT NULL,
+        peer_id TEXT NOT NULL,
+        directory TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (channel, identity_id, peer_id)
+      );
+      CREATE TABLE IF NOT EXISTS settings (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+
+    this.migrate();
+  }
+
+  private migrate() {
+    // Sessions: migrate from legacy (channel, peer_id) PK to identity-scoped PK.
+    const sessionColumns = this.db
+      .prepare("PRAGMA table_info(sessions)")
+      .all() as Array<{ name?: string }>;
+    const hasSessionIdentity = sessionColumns.some((column) => column.name === "identity_id");
+    if (!hasSessionIdentity) {
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS sessions_v2 (
+          channel TEXT NOT NULL,
+          identity_id TEXT NOT NULL,
+          peer_id TEXT NOT NULL,
+          session_id TEXT NOT NULL,
+          directory TEXT,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (channel, identity_id, peer_id)
+        );
+      `);
+      // Copy existing rows, defaulting identity_id to "default".
+      this.db.exec(`
+        INSERT OR IGNORE INTO sessions_v2 (channel, identity_id, peer_id, session_id, directory, created_at, updated_at)
+        SELECT channel, 'default', peer_id, session_id, NULL, created_at, updated_at FROM sessions;
+      `);
+      this.db.exec("DROP TABLE sessions");
+      this.db.exec("ALTER TABLE sessions_v2 RENAME TO sessions");
+    }
+
+    // Bindings: migrate from legacy (channel, peer_id) PK to identity-scoped PK.
+    const bindingColumns = this.db
+      .prepare("PRAGMA table_info(bindings)")
+      .all() as Array<{ name?: string }>;
+    const hasBindingIdentity = bindingColumns.some((column) => column.name === "identity_id");
+    if (!hasBindingIdentity) {
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS bindings_v2 (
+          channel TEXT NOT NULL,
+          identity_id TEXT NOT NULL,
+          peer_id TEXT NOT NULL,
+          directory TEXT NOT NULL,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (channel, identity_id, peer_id)
+        );
+      `);
+      this.db.exec(`
+        INSERT OR IGNORE INTO bindings_v2 (channel, identity_id, peer_id, directory, created_at, updated_at)
+        SELECT channel, 'default', peer_id, directory, created_at, updated_at FROM bindings;
+      `);
+      this.db.exec("DROP TABLE bindings");
+      this.db.exec("ALTER TABLE bindings_v2 RENAME TO bindings");
+    }
+
+    // Cleanup: WhatsApp pairing table is no longer used.
+    try {
+      this.db.exec("DROP TABLE IF EXISTS pairing_requests");
+    } catch {
+      // ignore
+    }
+  }
+
+  private ensureDir() {
+    const dir = path.dirname(this.dbPath);
+    fs.mkdirSync(dir, { recursive: true });
+  }
+
+  getSession(channel: ChannelName, identityId: string, peerId: string): SessionRow | null {
+    const stmt = this.db.prepare(
+      "SELECT channel, identity_id, peer_id, session_id, directory, created_at, updated_at FROM sessions WHERE channel = ? AND identity_id = ? AND peer_id = ?",
+    );
+    const row = stmt.get(channel, identityId, peerId) as SessionRow | null;
+    return row ?? null;
+  }
+
+  upsertSession(channel: ChannelName, identityId: string, peerId: string, sessionId: string, directory?: string | null) {
+    const now = Date.now();
+    const stmt = this.db.prepare(
+      `INSERT INTO sessions (channel, identity_id, peer_id, session_id, directory, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(channel, identity_id, peer_id) DO UPDATE SET session_id = excluded.session_id, directory = excluded.directory, updated_at = excluded.updated_at`,
+    );
+    stmt.run(channel, identityId, peerId, sessionId, directory ?? null, now, now);
+  }
+
+  deleteSession(channel: ChannelName, identityId: string, peerId: string): boolean {
+    const stmt = this.db.prepare("DELETE FROM sessions WHERE channel = ? AND identity_id = ? AND peer_id = ?");
+    const result = stmt.run(channel, identityId, peerId);
+    return result.changes > 0;
+  }
+
+  getBinding(channel: ChannelName, identityId: string, peerId: string): BindingRow | null {
+    const stmt = this.db.prepare(
+      "SELECT channel, identity_id, peer_id, directory, created_at, updated_at FROM bindings WHERE channel = ? AND identity_id = ? AND peer_id = ?",
+    );
+    const row = stmt.get(channel, identityId, peerId) as BindingRow | null;
+    return row ?? null;
+  }
+
+  upsertBinding(channel: ChannelName, identityId: string, peerId: string, directory: string) {
+    const now = Date.now();
+    const stmt = this.db.prepare(
+      `INSERT INTO bindings (channel, identity_id, peer_id, directory, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(channel, identity_id, peer_id) DO UPDATE SET directory = excluded.directory, updated_at = excluded.updated_at`,
+    );
+    stmt.run(channel, identityId, peerId, directory, now, now);
+  }
+
+  deleteBinding(channel: ChannelName, identityId: string, peerId: string): boolean {
+    const stmt = this.db.prepare("DELETE FROM bindings WHERE channel = ? AND identity_id = ? AND peer_id = ?");
+    const result = stmt.run(channel, identityId, peerId);
+    return result.changes > 0;
+  }
+
+  listBindings(filters: { channel?: ChannelName; identityId?: string; directory?: string } = {}): BindingRow[] {
+    const where: string[] = [];
+    const args: Array<string> = [];
+    if (filters.channel) {
+      where.push("channel = ?");
+      args.push(filters.channel);
+    }
+    if (filters.identityId) {
+      where.push("identity_id = ?");
+      args.push(filters.identityId);
+    }
+    if (filters.directory) {
+      where.push("directory = ?");
+      args.push(filters.directory);
+    }
+
+    const clause = where.length ? ` WHERE ${where.join(" AND ")}` : "";
+    const stmt = this.db.prepare(
+      `SELECT channel, identity_id, peer_id, directory, created_at, updated_at FROM bindings${clause} ORDER BY updated_at DESC`,
+    );
+    return stmt.all(...args) as BindingRow[];
+  }
+
+  isAllowed(channel: ChannelName, peerId: string): boolean {
+    const stmt = this.db.prepare(
+      "SELECT channel, peer_id, created_at FROM allowlist WHERE channel = ? AND peer_id = ?",
+    );
+    return Boolean(stmt.get(channel, peerId));
+  }
+
+  allowPeer(channel: ChannelName, peerId: string) {
+    const now = Date.now();
+    const stmt = this.db.prepare(
+      `INSERT INTO allowlist (channel, peer_id, created_at)
+       VALUES (?, ?, ?)
+       ON CONFLICT(channel, peer_id) DO UPDATE SET created_at = excluded.created_at`,
+    );
+    stmt.run(channel, peerId, now);
+  }
+
+  seedAllowlist(channel: ChannelName, peers: Iterable<string>) {
+    const insert = this.db.prepare(
+      `INSERT INTO allowlist (channel, peer_id, created_at)
+       VALUES (?, ?, ?)
+       ON CONFLICT(channel, peer_id) DO NOTHING`,
+    );
+    const now = Date.now();
+    const transaction = this.db.transaction(() => {
+      for (const peer of peers) {
+        insert.run(channel, peer, now);
+      }
+    });
+    transaction();
+  }
+
+  getSetting(key: string): string | null {
+    const stmt = this.db.prepare("SELECT value FROM settings WHERE key = ?");
+    const row = stmt.get(key) as { value?: string } | null;
+    return row?.value ?? null;
+  }
+
+  setSetting(key: string, value: string) {
+    const stmt = this.db.prepare(
+      "INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+    );
+    stmt.run(key, value);
+  }
+
+  close() {
+    this.db.close();
+  }
+}
diff --git a/apps/opencode-router/src/delivery.ts b/apps/opencode-router/src/delivery.ts
new file mode 100644
index 0000000000..0fb49bff18
--- /dev/null
+++ b/apps/opencode-router/src/delivery.ts
@@ -0,0 +1,157 @@
+export type DeliveryErrorCode =
+  | "auth"
+  | "forbidden"
+  | "not_found"
+  | "invalid_target"
+  | "rate_limited"
+  | "payload_too_large"
+  | "unsupported_media"
+  | "network"
+  | "timeout"
+  | "unknown";
+
+export type DeliveryError = {
+  code: DeliveryErrorCode;
+  message: string;
+  retryable: boolean;
+  status?: number;
+};
+
+const RETRYABLE_NETWORK_CODES = new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+  "ETIMEDOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+]);
+
+function coerceStatus(error: unknown): number | undefined {
+  if (!error || typeof error !== "object") return undefined;
+  const record = error as {
+    status?: unknown;
+    statusCode?: unknown;
+    code?: unknown;
+    error_code?: unknown;
+    response?: { status?: unknown };
+    data?: { status?: unknown };
+  };
+
+  const maybe = [
+    record.status,
+    record.statusCode,
+    record.error_code,
+    record.response?.status,
+    record.data?.status,
+  ];
+
+  for (const value of maybe) {
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function coerceCode(error: unknown): string {
+  if (!error || typeof error !== "object") return "";
+  const code = (error as { code?: unknown }).code;
+  return typeof code === "string" ? code.trim().toUpperCase() : "";
+}
+
+function coerceMessage(error: unknown): string {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  return "Unknown delivery error";
+}
+
+export function classifyDeliveryError(error: unknown): DeliveryError {
+  const status = coerceStatus(error);
+  const code = coerceCode(error);
+  const message = coerceMessage(error);
+  const lower = message.toLowerCase();
+
+  if (status === 401 || lower.includes("invalid_auth") || lower.includes("unauthorized")) {
+    return { code: "auth", message, retryable: false, status };
+  }
+  if (status === 403 || lower.includes("forbidden") || lower.includes("not_in_channel")) {
+    return { code: "forbidden", message, retryable: false, status };
+  }
+  if (status === 404 || lower.includes("chat not found") || lower.includes("channel_not_found")) {
+    return { code: "not_found", message, retryable: false, status };
+  }
+  if (status === 400 && (lower.includes("chat_id") || lower.includes("invalid peer") || lower.includes("invalid slack peer"))) {
+    return { code: "invalid_target", message, retryable: false, status };
+  }
+  if (status === 429 || lower.includes("rate limit") || lower.includes("too many requests")) {
+    return { code: "rate_limited", message, retryable: true, status };
+  }
+  if (status === 413 || lower.includes("too large") || lower.includes("file_too_large")) {
+    return { code: "payload_too_large", message, retryable: false, status };
+  }
+  if (lower.includes("unsupported") || lower.includes("cannot upload") || lower.includes("not allowed for this message type")) {
+    return { code: "unsupported_media", message, retryable: false, status };
+  }
+  if (status === 408 || lower.includes("timeout") || lower.includes("timed out")) {
+    return { code: "timeout", message, retryable: true, status };
+  }
+  if ((status !== undefined && status >= 500) || RETRYABLE_NETWORK_CODES.has(code) || lower.includes("fetch failed")) {
+    return { code: "network", message, retryable: true, status };
+  }
+
+  return { code: "unknown", message, retryable: false, status };
+}
+
+type RetryLogger = {
+  warn?: (payload: unknown, message?: string) => void;
+};
+
+function withJitter(baseMs: number): number {
+  const jitter = Math.floor(Math.random() * Math.max(1, Math.floor(baseMs * 0.2)));
+  return baseMs + jitter;
+}
+
+export async function withDeliveryRetry<T>(
+  operation: string,
+  run: () => Promise<T>,
+  options: {
+    maxAttempts?: number;
+    baseDelayMs?: number;
+    maxDelayMs?: number;
+    logger?: RetryLogger;
+  } = {},
+): Promise<T> {
+  const maxAttempts = Math.max(1, options.maxAttempts ?? 3);
+  const baseDelayMs = Math.max(50, options.baseDelayMs ?? 250);
+  const maxDelayMs = Math.max(baseDelayMs, options.maxDelayMs ?? 4_000);
+
+  let attempt = 0;
+  for (;;) {
+    attempt += 1;
+    try {
+      return await run();
+    } catch (error) {
+      const classified = classifyDeliveryError(error);
+      if (!classified.retryable || attempt >= maxAttempts) {
+        throw error;
+      }
+
+      const delayMs = Math.min(maxDelayMs, withJitter(baseDelayMs * 2 ** (attempt - 1)));
+      options.logger?.warn?.(
+        {
+          operation,
+          attempt,
+          maxAttempts,
+          delayMs,
+          code: classified.code,
+          status: classified.status,
+          message: classified.message,
+        },
+        "delivery operation failed; retrying",
+      );
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+}
diff --git a/apps/opencode-router/src/events.ts b/apps/opencode-router/src/events.ts
new file mode 100644
index 0000000000..b7fa374aba
--- /dev/null
+++ b/apps/opencode-router/src/events.ts
@@ -0,0 +1,21 @@
+type RawEvent = {
+  type?: string;
+  properties?: unknown;
+  payload?: { type?: string; properties?: unknown };
+};
+
+export type NormalizedEvent = {
+  type: string;
+  properties?: any;
+};
+
+export function normalizeEvent(raw: RawEvent | null | undefined): NormalizedEvent | null {
+  if (!raw) return null;
+  if (typeof raw.type === "string") {
+    return { type: raw.type, properties: raw.properties };
+  }
+  if (raw.payload && typeof raw.payload.type === "string") {
+    return { type: raw.payload.type, properties: raw.payload.properties };
+  }
+  return null;
+}
diff --git a/apps/opencode-router/src/health.ts b/apps/opencode-router/src/health.ts
new file mode 100644
index 0000000000..c5b2ffb3e3
--- /dev/null
+++ b/apps/opencode-router/src/health.ts
@@ -0,0 +1,697 @@
+import http from "node:http";
+
+import type { Logger } from "pino";
+
+import type { OutboundMessagePart, PartDeliveryResult } from "./media.js";
+
+export type HealthSnapshot = {
+  ok: boolean;
+  opencode: {
+    url: string;
+    healthy: boolean;
+    version?: string;
+  };
+  channels: {
+    telegram: boolean;
+    whatsapp: boolean;
+    slack: boolean;
+  };
+  config: {
+    groupsEnabled: boolean;
+  };
+  activity?: {
+    dayStart: number;
+    inboundToday: number;
+    outboundToday: number;
+    lastInboundAt?: number;
+    lastOutboundAt?: number;
+    lastMessageAt?: number;
+  };
+  agent?: {
+    scope: "workspace";
+    path: string;
+    loaded: boolean;
+    selected?: string;
+  };
+};
+
+export type GroupsConfigResult = {
+  groupsEnabled: boolean;
+};
+
+export type TelegramIdentityItem = {
+  id: string;
+  enabled: boolean;
+  running: boolean;
+  access?: "public" | "private";
+  pairingRequired?: boolean;
+};
+
+export type SlackIdentityItem = {
+  id: string;
+  enabled: boolean;
+  running: boolean;
+};
+
+export type TelegramIdentitiesResult = {
+  items: TelegramIdentityItem[];
+};
+
+export type SlackIdentitiesResult = {
+  items: SlackIdentityItem[];
+};
+
+export type UpsertIdentityResult = {
+  id: string;
+  enabled: boolean;
+  access?: "public" | "private";
+  pairingRequired?: boolean;
+  applied?: boolean;
+  starting?: boolean;
+  error?: string;
+};
+
+export type DeleteIdentityResult = {
+  id: string;
+  deleted: boolean;
+  applied?: boolean;
+  starting?: boolean;
+  error?: string;
+};
+
+export type TelegramIdentityUpsertInput = {
+  id?: string;
+  token: string;
+  enabled?: boolean;
+  directory?: string;
+  access?: "public" | "private";
+  pairingCodeHash?: string;
+};
+
+export type SlackIdentityUpsertInput = {
+  id?: string;
+  botToken: string;
+  appToken: string;
+  enabled?: boolean;
+  directory?: string;
+};
+
+export type BindingItem = {
+  channel: string;
+  identityId: string;
+  peerId: string;
+  directory: string;
+  updatedAt?: number;
+};
+
+export type BindingsListResult = {
+  items: BindingItem[];
+};
+
+export type SendMessageInput = {
+  channel: string;
+  identityId?: string;
+  directory?: string;
+  peerId?: string;
+  autoBind?: boolean;
+  text?: string;
+  parts?: OutboundMessagePart[];
+};
+
+export type SendMessageResult = {
+  channel: string;
+  directory: string;
+  identityId?: string;
+  peerId?: string;
+  attempted: number;
+  sent: number;
+  failures?: Array<{ identityId: string; peerId: string; error: string }>;
+  targets?: Array<{
+    identityId: string;
+    peerId: string;
+    attemptedParts: number;
+    sentParts: number;
+    partResults: PartDeliveryResult[];
+  }>;
+  reason?: string;
+};
+
+export type HealthHandlers = {
+  setGroupsEnabled?: (enabled: boolean) => Promise<GroupsConfigResult>;
+  getGroupsEnabled?: () => boolean;
+  listTelegramIdentities?: () => Promise<TelegramIdentitiesResult>;
+  upsertTelegramIdentity?: (input: TelegramIdentityUpsertInput) => Promise<UpsertIdentityResult>;
+  deleteTelegramIdentity?: (id: string) => Promise<DeleteIdentityResult>;
+  listSlackIdentities?: () => Promise<SlackIdentitiesResult>;
+  upsertSlackIdentity?: (input: SlackIdentityUpsertInput) => Promise<UpsertIdentityResult>;
+  deleteSlackIdentity?: (id: string) => Promise<DeleteIdentityResult>;
+  listBindings?: (filters?: { channel?: string; identityId?: string }) => Promise<BindingsListResult>;
+  setBinding?: (input: { channel: string; identityId?: string; peerId: string; directory: string }) => Promise<void>;
+  clearBinding?: (input: { channel: string; identityId?: string; peerId: string }) => Promise<void>;
+  sendMessage?: (input: SendMessageInput) => Promise<SendMessageResult>;
+};
+
+export async function startHealthServer(
+  port: number,
+  getStatus: () => HealthSnapshot,
+  logger: Logger,
+  handlers: HealthHandlers = {},
+) {
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      const requestOrigin = req.headers.origin;
+      if (requestOrigin) {
+        res.setHeader("Access-Control-Allow-Origin", requestOrigin);
+        res.setHeader("Vary", "Origin");
+      } else {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+      }
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+
+      const requestHeaders = req.headers["access-control-request-headers"];
+      if (Array.isArray(requestHeaders)) {
+        res.setHeader("Access-Control-Allow-Headers", requestHeaders.join(", "));
+      } else if (typeof requestHeaders === "string" && requestHeaders.trim()) {
+        res.setHeader("Access-Control-Allow-Headers", requestHeaders);
+      } else {
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      }
+
+      if (req.headers["access-control-request-private-network"] === "true") {
+        res.setHeader("Access-Control-Allow-Private-Network", "true");
+      }
+
+      if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+
+      const pathname = req.url ? new URL(req.url, "http://localhost").pathname : "";
+
+      if (!pathname || pathname === "/" || pathname === "/health") {
+        const snapshot = getStatus();
+        res.writeHead(snapshot.ok ? 200 : 503, {
+          "Content-Type": "application/json",
+        });
+        res.end(JSON.stringify(snapshot));
+        return;
+      }
+
+      // Legacy alias: POST /config/telegram-token -> upsert telegram identity "default".
+      if (pathname === "/config/telegram-token" && req.method === "POST") {
+        if (!handlers.upsertTelegramIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const token = typeof payload.token === "string" ? payload.token.trim() : "";
+          if (!token) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Token is required" }));
+            return;
+          }
+          const result = await handlers.upsertTelegramIdentity({ id: "default", token, enabled: true });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, telegram: result }));
+          return;
+        } catch (error) {
+          const statusRaw = (error as any)?.status;
+          const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
+          return;
+        }
+      }
+
+      // Legacy alias: POST /config/slack-tokens -> upsert slack identity "default".
+      if (pathname === "/config/slack-tokens" && req.method === "POST") {
+        if (!handlers.upsertSlackIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const botToken = typeof payload.botToken === "string" ? payload.botToken.trim() : "";
+          const appToken = typeof payload.appToken === "string" ? payload.appToken.trim() : "";
+          if (!botToken || !appToken) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Slack botToken and appToken are required" }));
+            return;
+          }
+          const result = await handlers.upsertSlackIdentity({ id: "default", botToken, appToken, enabled: true });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, slack: result }));
+          return;
+        } catch (error) {
+          const statusRaw = (error as any)?.status;
+          const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
+          return;
+        }
+      }
+
+      // GET /identities/telegram
+      if (pathname === "/identities/telegram" && req.method === "GET") {
+        if (!handlers.listTelegramIdentities) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        try {
+          const result = await handlers.listTelegramIdentities();
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, ...result }));
+          return;
+        } catch (error) {
+          const statusRaw = (error as any)?.status;
+          const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
+          return;
+        }
+      }
+
+      // POST /identities/telegram
+      if (pathname === "/identities/telegram" && req.method === "POST") {
+        if (!handlers.upsertTelegramIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const token = typeof payload.token === "string" ? payload.token.trim() : "";
+          const id = typeof payload.id === "string" ? payload.id.trim() : undefined;
+          const directory = typeof payload.directory === "string" ? payload.directory.trim() : undefined;
+          const access = typeof payload.access === "string" ? payload.access.trim() : undefined;
+          const pairingCodeHash = typeof payload.pairingCodeHash === "string" ? payload.pairingCodeHash.trim() : undefined;
+          const enabled = payload.enabled === undefined ? undefined : payload.enabled === true || payload.enabled === "true";
+          if (!token) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "token is required" }));
+            return;
+          }
+          const result = await handlers.upsertTelegramIdentity({
+            id,
+            token,
+            ...(enabled === undefined ? {} : { enabled }),
+            ...(directory ? { directory } : {}),
+            ...(access ? { access: access as "public" | "private" } : {}),
+            ...(pairingCodeHash ? { pairingCodeHash } : {}),
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, telegram: result }));
+          return;
+        } catch (error) {
+          const statusRaw = (error as any)?.status;
+          const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
+          return;
+        }
+      }
+
+      // DELETE /identities/telegram/:id
+      if (pathname.startsWith("/identities/telegram/") && req.method === "DELETE") {
+        if (!handlers.deleteTelegramIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        const id = pathname.slice("/identities/telegram/".length).trim();
+        if (!id) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "id is required" }));
+          return;
+        }
+        try {
+          const result = await handlers.deleteTelegramIdentity(id);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, telegram: result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      // GET /identities/slack
+      if (pathname === "/identities/slack" && req.method === "GET") {
+        if (!handlers.listSlackIdentities) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        try {
+          const result = await handlers.listSlackIdentities();
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, ...result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      // POST /identities/slack
+      if (pathname === "/identities/slack" && req.method === "POST") {
+        if (!handlers.upsertSlackIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const botToken = typeof payload.botToken === "string" ? payload.botToken.trim() : "";
+          const appToken = typeof payload.appToken === "string" ? payload.appToken.trim() : "";
+          const id = typeof payload.id === "string" ? payload.id.trim() : undefined;
+          const directory = typeof payload.directory === "string" ? payload.directory.trim() : undefined;
+          const enabled = payload.enabled === undefined ? undefined : payload.enabled === true || payload.enabled === "true";
+          if (!botToken || !appToken) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "botToken and appToken are required" }));
+            return;
+          }
+          const result = await handlers.upsertSlackIdentity({
+            id,
+            botToken,
+            appToken,
+            ...(enabled === undefined ? {} : { enabled }),
+            ...(directory ? { directory } : {}),
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, slack: result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      // DELETE /identities/slack/:id
+      if (pathname.startsWith("/identities/slack/") && req.method === "DELETE") {
+        if (!handlers.deleteSlackIdentity) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+        const id = pathname.slice("/identities/slack/".length).trim();
+        if (!id) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "id is required" }));
+          return;
+        }
+        try {
+          const result = await handlers.deleteSlackIdentity(id);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, slack: result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      // GET /config/groups - get current groups setting
+      if (pathname === "/config/groups" && req.method === "GET") {
+        if (!handlers.getGroupsEnabled) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        const groupsEnabled = handlers.getGroupsEnabled();
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, groupsEnabled }));
+        return;
+      }
+
+      // POST /config/groups - set groups enabled
+      if (pathname === "/config/groups" && req.method === "POST") {
+        if (!handlers.setGroupsEnabled) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const enabled = payload.enabled === true || payload.enabled === "true";
+
+          const result = await handlers.setGroupsEnabled(enabled);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, ...result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      if (pathname === "/bindings" && req.method === "GET") {
+        if (!handlers.listBindings) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        try {
+          const parsed = req.url ? new URL(req.url, "http://localhost") : null;
+          const channel = typeof parsed?.searchParams.get("channel") === "string" ? parsed?.searchParams.get("channel") ?? undefined : undefined;
+          const identityId = typeof parsed?.searchParams.get("identityId") === "string" ? parsed?.searchParams.get("identityId") ?? undefined : undefined;
+          const result = await handlers.listBindings({
+            ...(channel?.trim() ? { channel: channel.trim() } : {}),
+            ...(identityId?.trim() ? { identityId: identityId.trim() } : {}),
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, ...result }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      if (pathname === "/bindings" && req.method === "POST") {
+        if (!handlers.setBinding && !handlers.clearBinding) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const channel = typeof payload.channel === "string" ? payload.channel.trim() : "";
+          const identityId = typeof payload.identityId === "string" ? payload.identityId.trim() : "";
+          const peerId = typeof payload.peerId === "string" ? payload.peerId.trim() : "";
+          const directory = typeof payload.directory === "string" ? payload.directory.trim() : "";
+
+          if (!channel || !peerId) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "channel and peerId are required" }));
+            return;
+          }
+
+          if (!directory) {
+            if (!handlers.clearBinding) {
+              res.writeHead(404, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+              return;
+            }
+            await handlers.clearBinding({ channel, identityId: identityId || undefined, peerId });
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+          }
+
+          if (!handlers.setBinding) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+            return;
+          }
+          await handlers.setBinding({ channel, identityId: identityId || undefined, peerId, directory });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true }));
+          return;
+        } catch (error) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error) }));
+          return;
+        }
+      }
+
+      if (pathname === "/send" && req.method === "POST") {
+        if (!handlers.sendMessage) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Not supported" }));
+          return;
+        }
+
+        let raw = "";
+        for await (const chunk of req) {
+          raw += chunk.toString();
+          if (raw.length > 1024 * 1024) {
+            res.writeHead(413, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+            return;
+          }
+        }
+
+        try {
+          const payload = JSON.parse(raw || "{}");
+          const channel = typeof payload.channel === "string" ? payload.channel.trim() : "";
+          const identityId = typeof payload.identityId === "string" ? payload.identityId.trim() : "";
+          const directory = typeof payload.directory === "string" ? payload.directory.trim() : "";
+          const peerId = typeof payload.peerId === "string" ? payload.peerId.trim() : "";
+          const autoBind = payload.autoBind === true;
+          const text = typeof payload.text === "string" ? payload.text : "";
+          const parts = Array.isArray(payload.parts) ? (payload.parts as OutboundMessagePart[]) : undefined;
+          const hasText = text.trim().length > 0;
+          const hasParts = Array.isArray(parts) && parts.length > 0;
+          if (!channel || (!hasText && !hasParts) || (!directory && !peerId)) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(
+              JSON.stringify({
+                ok: false,
+                error: "channel, at least one of text/parts, and either directory or peerId are required",
+              }),
+            );
+            return;
+          }
+
+          const result = await handlers.sendMessage({
+            channel,
+            ...(identityId ? { identityId } : {}),
+            ...(directory ? { directory } : {}),
+            ...(peerId ? { peerId } : {}),
+            ...(autoBind ? { autoBind: true } : {}),
+            ...(hasText ? { text } : {}),
+            ...(hasParts ? { parts } : {}),
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, ...result }));
+          return;
+        } catch (error) {
+          const statusRaw = (error as any)?.status;
+          const status = typeof statusRaw === "number" && statusRaw >= 400 && statusRaw < 600 ? statusRaw : 500;
+          res.writeHead(status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(error instanceof Error ? error.message : error) }));
+          return;
+        }
+      }
+
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: "Not found" }));
+    })().catch((error) => {
+      logger.error({ error }, "health server request failed");
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: "Internal error" }));
+    });
+  });
+
+  const host = (process.env.OPENCODE_ROUTER_HEALTH_HOST ?? "").trim() || "127.0.0.1";
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      const onError = (error: unknown) => {
+        server.removeListener("listening", onListening);
+        reject(error);
+      };
+      const onListening = () => {
+        server.removeListener("error", onError);
+        resolve();
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(port, host);
+    });
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | undefined)?.code;
+    if (code === "EADDRINUSE") {
+      throw new Error(
+        `Failed to start health server on ${host}:${port}. Port is in use. ` +
+          `Set OPENCODE_ROUTER_HEALTH_PORT, OPENCODE_ROUTER_HEALTH_PORT, or PORT to a free port.`,
+      );
+    }
+    throw error;
+  }
+
+  const address = server.address();
+  const actualPort = typeof address === "object" && address ? address.port : port;
+  logger.info({ host, port: actualPort }, "health server listening");
+
+  return () => {
+    server.close();
+  };
+}
diff --git a/apps/opencode-router/src/logger.ts b/apps/opencode-router/src/logger.ts
new file mode 100644
index 0000000000..01cc05952c
--- /dev/null
+++ b/apps/opencode-router/src/logger.ts
@@ -0,0 +1,17 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import pino from "pino";
+
+export function createLogger(level: string, options?: { logFile?: string }) {
+  if (options?.logFile) {
+    fs.mkdirSync(path.dirname(options.logFile), { recursive: true });
+    const destination = pino.destination({ dest: options.logFile, sync: false });
+    return pino({ level, base: undefined }, destination);
+  }
+
+  return pino({
+    level,
+    base: undefined,
+  });
+}
diff --git a/apps/opencode-router/src/media-store.ts b/apps/opencode-router/src/media-store.ts
new file mode 100644
index 0000000000..24077765aa
--- /dev/null
+++ b/apps/opencode-router/src/media-store.ts
@@ -0,0 +1,174 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, stat, writeFile } from "node:fs/promises";
+import { basename, extname, isAbsolute, join, resolve } from "node:path";
+
+import type { MediaKind } from "./media.js";
+
+export type StoredMediaFile = {
+  filePath: string;
+  filename: string;
+  sizeBytes: number;
+  mimeType?: string;
+};
+
+function sanitizeSegment(value: string): string {
+  const safe = value.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+  return safe || "unknown";
+}
+
+function extensionFromMime(mimeType: string | undefined, kind: MediaKind): string {
+  const value = (mimeType ?? "").toLowerCase();
+  if (value === "image/jpeg") return ".jpg";
+  if (value === "image/png") return ".png";
+  if (value === "image/webp") return ".webp";
+  if (value === "audio/ogg") return ".ogg";
+  if (value === "audio/mpeg") return ".mp3";
+  if (value === "audio/mp4") return ".m4a";
+  if (value === "application/pdf") return ".pdf";
+  if (kind === "image") return ".jpg";
+  if (kind === "audio") return ".ogg";
+  return ".bin";
+}
+
+function sanitizeFilename(filename: string, fallbackPrefix: string, fallbackExt: string): string {
+  const trimmed = filename.trim();
+  if (!trimmed) return `${fallbackPrefix}${fallbackExt}`;
+
+  const base = basename(trimmed)
+    .replace(/[^a-zA-Z0-9_.-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  if (!base) return `${fallbackPrefix}${fallbackExt}`;
+  if (extname(base)) return base;
+  return `${base}${fallbackExt}`;
+}
+
+export class MediaStore {
+  constructor(private readonly rootDir: string) {}
+
+  async ensureReady(): Promise<void> {
+    await mkdir(this.rootDir, { recursive: true });
+  }
+
+  private inboundDir(channel: string, identityId: string, peerId: string): string {
+    const now = new Date();
+    const day = now.toISOString().slice(0, 10);
+    return join(
+      this.rootDir,
+      "inbound",
+      day,
+      sanitizeSegment(channel),
+      sanitizeSegment(identityId),
+      sanitizeSegment(peerId),
+    );
+  }
+
+  async saveInboundBuffer(input: {
+    channel: string;
+    identityId: string;
+    peerId: string;
+    kind: MediaKind;
+    buffer: Uint8Array;
+    filename?: string;
+    mimeType?: string;
+  }): Promise<StoredMediaFile> {
+    const dir = this.inboundDir(input.channel, input.identityId, input.peerId);
+    await mkdir(dir, { recursive: true });
+
+    const defaultExt = extensionFromMime(input.mimeType, input.kind);
+    const safeFilename = sanitizeFilename(
+      input.filename ?? "",
+      `${input.kind}-${Date.now()}-${randomUUID().slice(0, 8)}`,
+      defaultExt,
+    );
+    const filePath = join(dir, safeFilename);
+
+    await writeFile(filePath, input.buffer);
+
+    return {
+      filePath,
+      filename: safeFilename,
+      sizeBytes: input.buffer.byteLength,
+      ...(input.mimeType ? { mimeType: input.mimeType } : {}),
+    };
+  }
+
+  async downloadInbound(input: {
+    channel: string;
+    identityId: string;
+    peerId: string;
+    kind: MediaKind;
+    url: string;
+    headers?: Record<string, string>;
+    filename?: string;
+    mimeType?: string;
+  }): Promise<StoredMediaFile> {
+    const response = await fetch(input.url, {
+      headers: input.headers,
+    });
+
+    if (!response.ok) {
+      const error = new Error(`Failed to download media (${response.status})`) as Error & {
+        status?: number;
+      };
+      error.status = response.status;
+      throw error;
+    }
+
+    const mimeType = input.mimeType || response.headers.get("content-type") || undefined;
+    const arrayBuffer = await response.arrayBuffer();
+    return this.saveInboundBuffer({
+      channel: input.channel,
+      identityId: input.identityId,
+      peerId: input.peerId,
+      kind: input.kind,
+      buffer: new Uint8Array(arrayBuffer),
+      ...(input.filename ? { filename: input.filename } : {}),
+      ...(mimeType ? { mimeType } : {}),
+    });
+  }
+
+  async resolveOutboundFile(input: {
+    filePath: string;
+    baseDirectory: string;
+    maxBytes?: number;
+  }): Promise<StoredMediaFile> {
+    const raw = input.filePath.trim();
+    if (!raw) {
+      const error = new Error("filePath is required") as Error & { status?: number };
+      error.status = 400;
+      throw error;
+    }
+
+    const resolved = isAbsolute(raw) ? resolve(raw) : resolve(input.baseDirectory, raw);
+    let info;
+    try {
+      info = await stat(resolved);
+    } catch (error) {
+      const wrapped = new Error(`File not found: ${resolved}`) as Error & { status?: number };
+      wrapped.status = 404;
+      (wrapped as any).cause = error;
+      throw wrapped;
+    }
+
+    if (!info.isFile()) {
+      const error = new Error(`Not a file: ${resolved}`) as Error & { status?: number };
+      error.status = 400;
+      throw error;
+    }
+
+    if (typeof input.maxBytes === "number" && Number.isFinite(input.maxBytes) && info.size > input.maxBytes) {
+      const error = new Error(
+        `File exceeds maximum allowed size (${info.size} > ${Math.floor(input.maxBytes)} bytes): ${resolved}`,
+      ) as Error & { status?: number };
+      error.status = 413;
+      throw error;
+    }
+
+    return {
+      filePath: resolved,
+      filename: basename(resolved),
+      sizeBytes: info.size,
+    };
+  }
+}
diff --git a/apps/opencode-router/src/media.ts b/apps/opencode-router/src/media.ts
new file mode 100644
index 0000000000..5cf1c6836b
--- /dev/null
+++ b/apps/opencode-router/src/media.ts
@@ -0,0 +1,163 @@
+import { basename } from "node:path";
+
+export type MediaKind = "image" | "audio" | "file";
+
+export type InboundMediaAttachment = {
+  id: string;
+  kind: MediaKind;
+  source: "telegram" | "slack";
+  status: "ready" | "failed";
+  filePath?: string;
+  filename?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  providerFileId?: string;
+  providerFileUniqueId?: string;
+  providerUrl?: string;
+  error?: string;
+};
+
+export type InboundMessagePart =
+  | { type: "text"; text: string }
+  | { type: "media"; media: InboundMediaAttachment; caption?: string };
+
+export type OutboundMessagePart =
+  | { type: "text"; text: string }
+  | {
+      type: MediaKind;
+      filePath: string;
+      caption?: string;
+      filename?: string;
+      mimeType?: string;
+    };
+
+export type PartDeliveryResult = {
+  index: number;
+  type: "text" | MediaKind;
+  sent: boolean;
+  error?: string;
+  code?: string;
+  retryable?: boolean;
+};
+
+export type MessageDeliveryResult = {
+  attemptedParts: number;
+  sentParts: number;
+  partResults: PartDeliveryResult[];
+};
+
+function asTrimmedString(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function parseTextPart(value: unknown): OutboundMessagePart | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as { type?: unknown; text?: unknown };
+  if (record.type !== "text") return null;
+  const text = typeof record.text === "string" ? record.text : "";
+  if (!text.trim()) return null;
+  return { type: "text", text };
+}
+
+function parseMediaPart(value: unknown): OutboundMessagePart | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as {
+    type?: unknown;
+    filePath?: unknown;
+    caption?: unknown;
+    filename?: unknown;
+    mimeType?: unknown;
+  };
+  if (record.type !== "image" && record.type !== "audio" && record.type !== "file") return null;
+  const filePath = asTrimmedString(record.filePath);
+  if (!filePath) return null;
+
+  const caption = typeof record.caption === "string" ? record.caption : undefined;
+  const filename = asTrimmedString(record.filename) || undefined;
+  const mimeType = asTrimmedString(record.mimeType) || undefined;
+
+  return {
+    type: record.type,
+    filePath,
+    ...(caption ? { caption } : {}),
+    ...(filename ? { filename } : {}),
+    ...(mimeType ? { mimeType } : {}),
+  };
+}
+
+export function normalizeOutboundParts(input: { text?: string; parts?: unknown }): OutboundMessagePart[] {
+  const normalized: OutboundMessagePart[] = [];
+  const text = typeof input.text === "string" ? input.text : "";
+
+  if (text.trim()) {
+    normalized.push({ type: "text", text });
+  }
+
+  if (Array.isArray(input.parts)) {
+    for (const item of input.parts) {
+      const textPart = parseTextPart(item);
+      if (textPart) {
+        normalized.push(textPart);
+        continue;
+      }
+
+      const mediaPart = parseMediaPart(item);
+      if (mediaPart) {
+        normalized.push(mediaPart);
+      }
+    }
+  }
+
+  return normalized;
+}
+
+export function textFromInboundParts(parts: InboundMessagePart[] | undefined, fallbackText = ""): string {
+  if (!Array.isArray(parts) || parts.length === 0) return fallbackText;
+  const texts = parts
+    .filter((part): part is { type: "text"; text: string } => part.type === "text")
+    .map((part) => part.text)
+    .filter((value) => value.trim().length > 0);
+  if (texts.length === 0) return fallbackText;
+  return texts.join("\n");
+}
+
+function formatBytes(sizeBytes: number | undefined): string {
+  if (typeof sizeBytes !== "number" || !Number.isFinite(sizeBytes) || sizeBytes < 0) return "";
+  if (sizeBytes < 1024) return `${sizeBytes}B`;
+  if (sizeBytes < 1024 * 1024) return `${(sizeBytes / 1024).toFixed(1)}KB`;
+  return `${(sizeBytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+
+export function summarizeInboundPartsForPrompt(parts: InboundMessagePart[] | undefined): string[] {
+  if (!Array.isArray(parts) || parts.length === 0) return [];
+
+  const mediaParts = parts.filter((part): part is { type: "media"; media: InboundMediaAttachment; caption?: string } => part.type === "media");
+  if (mediaParts.length === 0) return [];
+
+  return mediaParts.map((part, index) => {
+    const media = part.media;
+    const label = `[${media.kind}]`;
+    const filename = media.filename || (media.filePath ? basename(media.filePath) : "(unnamed)");
+    const details: string[] = [];
+    if (media.mimeType) details.push(media.mimeType);
+    const prettySize = formatBytes(media.sizeBytes);
+    if (prettySize) details.push(prettySize);
+
+    if (media.status === "ready") {
+      const pathLabel = media.filePath ? `path=${media.filePath}` : "path=(missing)";
+      if (part.caption?.trim()) details.push(`caption=${JSON.stringify(part.caption.trim())}`);
+      details.push(pathLabel);
+      return `${index + 1}. ${label} ${filename}${details.length ? ` (${details.join(", ")})` : ""}`;
+    }
+
+    const reason = media.error?.trim() || "download failed";
+    return `${index + 1}. ${label} ${filename} (failed: ${reason})`;
+  });
+}
+
+export function summarizeInboundPartsForReporter(parts: InboundMessagePart[] | undefined): string {
+  if (!Array.isArray(parts) || parts.length === 0) return "";
+  const mediaCount = parts.filter((part) => part.type === "media").length;
+  if (!mediaCount) return "";
+  return mediaCount === 1 ? "[1 media attachment]" : `[${mediaCount} media attachments]`;
+}
diff --git a/apps/opencode-router/src/opencode.ts b/apps/opencode-router/src/opencode.ts
new file mode 100644
index 0000000000..d9949f96fa
--- /dev/null
+++ b/apps/opencode-router/src/opencode.ts
@@ -0,0 +1,43 @@
+import { Buffer } from "node:buffer";
+
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+
+import type { Config } from "./config.js";
+
+type Client = ReturnType<typeof createOpencodeClient>;
+
+export function createClient(config: Config, directory?: string): Client {
+  const headers: Record<string, string> = {};
+  if (config.opencodeUsername && config.opencodePassword) {
+    const token = Buffer.from(`${config.opencodeUsername}:${config.opencodePassword}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  }
+
+  return createOpencodeClient({
+    baseUrl: config.opencodeUrl,
+    directory: directory ?? config.opencodeDirectory,
+    headers: Object.keys(headers).length ? headers : undefined,
+    responseStyle: "data",
+    throwOnError: true,
+  });
+}
+
+export function buildPermissionRules(mode: Config["permissionMode"]) {
+  if (mode === "deny") {
+    return [
+      {
+        permission: "*",
+        pattern: "*",
+        action: "deny" as const,
+      },
+    ];
+  }
+
+  return [
+    {
+      permission: "*",
+      pattern: "*",
+      action: "allow" as const,
+    },
+  ];
+}
diff --git a/apps/opencode-router/src/path-scope.ts b/apps/opencode-router/src/path-scope.ts
new file mode 100644
index 0000000000..9cc337e2f8
--- /dev/null
+++ b/apps/opencode-router/src/path-scope.ts
@@ -0,0 +1,42 @@
+import { isAbsolute, relative, resolve } from "node:path";
+
+export function normalizeScopedDirectoryPath(input: string, platform = process.platform) {
+  const trimmed = input.trim();
+  if (!trimmed) return "";
+  const withoutVerbatim = /^\\\\\?\\UNC[\\/]/i.test(trimmed)
+    ? `\\${trimmed.slice(8)}`
+    : /^\\\\\?\\[a-zA-Z]:[\\/]/.test(trimmed)
+      ? trimmed.slice(4)
+      : trimmed;
+  const unified = withoutVerbatim.replace(/\\/g, "/");
+  const withoutTrailing = unified.replace(/\/+$/, "");
+  const normalized = withoutTrailing || "/";
+  return platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+
+export function isWithinWorkspaceRootPath(input: {
+  workspaceRoot: string;
+  candidate: string;
+  platform?: NodeJS.Platform;
+}) {
+  const platform = input.platform ?? process.platform;
+  const rootForComparison =
+    platform === "win32"
+      ? normalizeScopedDirectoryPath(input.workspaceRoot, platform)
+      : input.workspaceRoot;
+  const resolved = resolve(input.candidate || input.workspaceRoot);
+  const resolvedForComparison =
+    platform === "win32"
+      ? normalizeScopedDirectoryPath(resolved, platform)
+      : resolved;
+  const relativePath = relative(rootForComparison, resolvedForComparison);
+  if (!relativePath || relativePath === ".") return true;
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) return false;
+  const boundary = rootForComparison.endsWith("/")
+    ? rootForComparison
+    : `${rootForComparison}/`;
+  return (
+    resolvedForComparison === rootForComparison ||
+    resolvedForComparison.startsWith(boundary)
+  );
+}
diff --git a/apps/opencode-router/src/slack.ts b/apps/opencode-router/src/slack.ts
new file mode 100644
index 0000000000..8c964a171f
--- /dev/null
+++ b/apps/opencode-router/src/slack.ts
@@ -0,0 +1,459 @@
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+
+import type { Logger } from "pino";
+
+import { SocketModeClient } from "@slack/socket-mode";
+import { WebClient } from "@slack/web-api";
+
+import type { Config, SlackIdentity } from "./config.js";
+import { classifyDeliveryError, withDeliveryRetry } from "./delivery.js";
+import type { InboundMessagePart, MediaKind, MessageDeliveryResult, OutboundMessagePart } from "./media.js";
+import type { MediaStore } from "./media-store.js";
+
+export type InboundMessage = {
+  channel: "slack";
+  identityId: string;
+  peerId: string;
+  text: string;
+  parts?: InboundMessagePart[];
+  raw: unknown;
+};
+
+export type MessageHandler = (message: InboundMessage) => Promise<void> | void;
+
+export type SlackAdapter = {
+  name: "slack";
+  identityId: string;
+  maxTextLength: number;
+  start(): Promise<void>;
+  stop(): Promise<void>;
+  sendMessage(peerId: string, message: { parts: OutboundMessagePart[] }): Promise<MessageDeliveryResult>;
+  sendText(peerId: string, text: string): Promise<void>;
+};
+
+export type SlackDeps = {
+  WebClient: typeof WebClient;
+  SocketModeClient: typeof SocketModeClient;
+};
+
+export type SlackPeer = {
+  channelId: string;
+  threadTs?: string;
+};
+
+// `peerId` encoding:
+// - DMs:   D12345678
+// - Threads in channels: C12345678|1700000000.000100
+// Using `|` avoids clashing with ALLOW_FROM's channel:peer parsing.
+export function formatSlackPeerId(peer: SlackPeer): string {
+  if (!peer.threadTs) return peer.channelId;
+  return `${peer.channelId}|${peer.threadTs}`;
+}
+
+export function parseSlackPeerId(peerId: string): SlackPeer {
+  const trimmed = peerId.trim();
+  if (!trimmed) return { channelId: "" };
+  const [channelId, threadTs] = trimmed.split("|");
+  if (channelId && threadTs) return { channelId, threadTs };
+  return { channelId: channelId || trimmed };
+}
+
+export function stripSlackMention(text: string, botUserId: string | null): string {
+  let next = text ?? "";
+  if (botUserId) {
+    const token = `<@${botUserId}>`;
+    next = next.split(token).join(" ");
+  }
+  next = next.replace(/^\s*[:,-]+\s*/, "");
+  return next.trim();
+}
+
+const MAX_TEXT_LENGTH = 39_000;
+
+type SlackEvent = {
+  type?: unknown;
+  channel?: unknown;
+  text?: unknown;
+  user?: unknown;
+  bot_id?: unknown;
+  subtype?: unknown;
+  thread_ts?: unknown;
+  ts?: unknown;
+  files?: unknown;
+};
+
+type SlackFileCandidate = {
+  id: string;
+  url: string;
+  filename?: string;
+  mimeType?: string;
+  sizeBytes?: number;
+  kind: MediaKind;
+};
+
+export function createSlackAdapter(
+  identity: SlackIdentity,
+  config: Config,
+  logger: Logger,
+  onMessage: MessageHandler,
+  deps: SlackDeps = { WebClient, SocketModeClient },
+  mediaStore?: MediaStore,
+): SlackAdapter {
+  const botToken = identity.botToken?.trim() ?? "";
+  const appToken = identity.appToken?.trim() ?? "";
+  if (!botToken) {
+    throw new Error("Slack bot token is required for Slack adapter");
+  }
+  if (!appToken) {
+    throw new Error("Slack app token is required for Slack adapter");
+  }
+
+  const log = logger.child({ channel: "slack", identityId: identity.id });
+  const web = new deps.WebClient(botToken);
+  const socket = new deps.SocketModeClient({ appToken });
+
+  let botUserId: string | null = null;
+  let started = false;
+
+  const parseSlackFiles = (value: unknown): SlackFileCandidate[] => {
+    if (!Array.isArray(value)) return [];
+    const files: SlackFileCandidate[] = [];
+    for (const item of value) {
+      if (!item || typeof item !== "object") continue;
+      const record = item as {
+        id?: unknown;
+        url_private_download?: unknown;
+        url_private?: unknown;
+        name?: unknown;
+        mimetype?: unknown;
+        size?: unknown;
+      };
+      const id = typeof record.id === "string" ? record.id : "";
+      const url =
+        typeof record.url_private_download === "string"
+          ? record.url_private_download
+          : typeof record.url_private === "string"
+            ? record.url_private
+            : "";
+      if (!id || !url) continue;
+      const mimeType = typeof record.mimetype === "string" ? record.mimetype : undefined;
+      const kind: MediaKind =
+        typeof mimeType === "string" && mimeType.startsWith("image/")
+          ? "image"
+          : typeof mimeType === "string" && mimeType.startsWith("audio/")
+            ? "audio"
+            : "file";
+      files.push({
+        id,
+        url,
+        kind,
+        ...(typeof record.name === "string" ? { filename: record.name } : {}),
+        ...(mimeType ? { mimeType } : {}),
+        ...(typeof record.size === "number" ? { sizeBytes: record.size } : {}),
+      });
+    }
+    return files;
+  };
+
+  const downloadSlackFile = async (peerId: string, candidate: SlackFileCandidate): Promise<InboundMessagePart> => {
+    if (!mediaStore) {
+      return {
+        type: "media",
+        media: {
+          id: candidate.id,
+          kind: candidate.kind,
+          source: "slack",
+          status: "failed",
+          ...(candidate.filename ? { filename: candidate.filename } : {}),
+          ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          ...(typeof candidate.sizeBytes === "number" ? { sizeBytes: candidate.sizeBytes } : {}),
+          providerFileId: candidate.id,
+          providerUrl: candidate.url,
+          error: "media store unavailable",
+        },
+      };
+    }
+
+    try {
+      const stored = await withDeliveryRetry(
+        "slack.download",
+        () =>
+          mediaStore.downloadInbound({
+            channel: "slack",
+            identityId: identity.id,
+            peerId,
+            kind: candidate.kind,
+            url: candidate.url,
+            headers: {
+              Authorization: `Bearer ${botToken}`,
+            },
+            ...(candidate.filename ? { filename: candidate.filename } : {}),
+            ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          }),
+        { logger: log },
+      );
+
+      return {
+        type: "media",
+        media: {
+          id: candidate.id,
+          kind: candidate.kind,
+          source: "slack",
+          status: "ready",
+          filePath: stored.filePath,
+          filename: stored.filename,
+          ...(stored.mimeType ? { mimeType: stored.mimeType } : {}),
+          sizeBytes: stored.sizeBytes,
+          providerFileId: candidate.id,
+          providerUrl: candidate.url,
+        },
+      };
+    } catch (error) {
+      const classified = classifyDeliveryError(error);
+      return {
+        type: "media",
+        media: {
+          id: candidate.id,
+          kind: candidate.kind,
+          source: "slack",
+          status: "failed",
+          ...(candidate.filename ? { filename: candidate.filename } : {}),
+          ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          ...(typeof candidate.sizeBytes === "number" ? { sizeBytes: candidate.sizeBytes } : {}),
+          providerFileId: candidate.id,
+          providerUrl: candidate.url,
+          error: `${classified.code}: ${classified.message}`,
+        },
+      };
+    }
+  };
+
+  const safeAck = async (ack: unknown) => {
+    if (typeof ack !== "function") return;
+    try {
+      await ack();
+    } catch (error) {
+      log.warn({ error }, "slack ack failed");
+    }
+  };
+
+  const shouldIgnore = (
+    event: SlackEvent,
+  ):
+    | { ok: true }
+    | {
+        ok: false;
+        channelId: string;
+        textRaw: string;
+        userId: string | null;
+        files: SlackFileCandidate[];
+        threadTs: string | null;
+        ts: string | null;
+      } => {
+    const channelId = typeof event.channel === "string" ? event.channel : "";
+    const textRaw = typeof event.text === "string" ? event.text : "";
+    const userId = typeof event.user === "string" ? event.user : null;
+    const botId = typeof event.bot_id === "string" ? event.bot_id : null;
+    const subtype = typeof event.subtype === "string" ? event.subtype : null;
+    const files = parseSlackFiles(event.files);
+    const hasFiles = files.length > 0;
+    const threadTs = typeof event.thread_ts === "string" ? event.thread_ts : null;
+    const ts = typeof event.ts === "string" ? event.ts : null;
+
+    // Avoid loops / non-user messages.
+    if (botId) return { ok: true };
+    if (subtype && subtype !== "" && subtype !== "file_share") return { ok: true };
+    if (userId && botUserId && userId === botUserId) return { ok: true };
+    if (!channelId || (!textRaw.trim() && !hasFiles)) return { ok: true };
+
+    return { ok: false, channelId, textRaw, userId, files, threadTs, ts };
+  };
+
+  socket.on("message", async (args: unknown) => {
+    const ack = (args as { ack?: unknown })?.ack;
+    await safeAck(ack);
+
+    const event = (args as { event?: unknown })?.event as SlackEvent | undefined;
+    if (!event || typeof event !== "object") return;
+    const filtered = shouldIgnore(event);
+    if (filtered.ok) return;
+
+    // Only respond to direct messages by default.
+    const isDm = filtered.channelId.startsWith("D");
+    if (!isDm) return;
+
+    const peerId = formatSlackPeerId({ channelId: filtered.channelId, ...(filtered.threadTs ? { threadTs: filtered.threadTs } : {}) });
+    const parts: InboundMessagePart[] = [];
+    if (filtered.textRaw.trim()) {
+      parts.push({ type: "text", text: filtered.textRaw.trim() });
+    }
+    for (const file of filtered.files) {
+      parts.push(await downloadSlackFile(peerId, file));
+    }
+    if (parts.length === 0) return;
+    const text = parts
+      .filter((part): part is { type: "text"; text: string } => part.type === "text")
+      .map((part) => part.text)
+      .join("\n")
+      .trim();
+
+    try {
+      await onMessage({
+        channel: "slack",
+        identityId: identity.id,
+        peerId,
+        text,
+        parts,
+        raw: event,
+      });
+    } catch (error) {
+      log.error({ error, peerId }, "slack inbound handler failed");
+    }
+  });
+
+  socket.on("app_mention", async (args: unknown) => {
+    const ack = (args as { ack?: unknown })?.ack;
+    await safeAck(ack);
+
+    const event = (args as { event?: unknown })?.event as SlackEvent | undefined;
+    if (!event || typeof event !== "object") return;
+    const filtered = shouldIgnore(event);
+    if (filtered.ok) return;
+
+    const rootThread = filtered.threadTs || filtered.ts;
+    const peerId = formatSlackPeerId({ channelId: filtered.channelId, ...(rootThread ? { threadTs: rootThread } : {}) });
+    const text = stripSlackMention(filtered.textRaw, botUserId);
+    const parts: InboundMessagePart[] = [];
+    if (text) {
+      parts.push({ type: "text", text });
+    }
+    for (const file of filtered.files) {
+      parts.push(await downloadSlackFile(peerId, file));
+    }
+    if (parts.length === 0) return;
+    const promptText = parts
+      .filter((part): part is { type: "text"; text: string } => part.type === "text")
+      .map((part) => part.text)
+      .join("\n")
+      .trim();
+
+    try {
+      await onMessage({
+        channel: "slack",
+        identityId: identity.id,
+        peerId,
+        text: promptText,
+        parts,
+        raw: event,
+      });
+    } catch (error) {
+      log.error({ error, peerId }, "slack inbound handler failed");
+    }
+  });
+
+  const sendMessageInternal = async (
+    peerId: string,
+    message: { parts: OutboundMessagePart[] },
+  ): Promise<MessageDeliveryResult> => {
+    const peer = parseSlackPeerId(peerId);
+    if (!peer.channelId) {
+      const error = new Error("Invalid Slack peerId") as Error & { status?: number };
+      error.status = 400;
+      throw error;
+    }
+
+    const partResults: MessageDeliveryResult["partResults"] = [];
+    let sentParts = 0;
+
+    for (let index = 0; index < message.parts.length; index += 1) {
+      const part = message.parts[index];
+      try {
+        if (part.type === "text") {
+          await withDeliveryRetry(
+            "slack.postMessage",
+            () =>
+              web.chat.postMessage({
+                channel: peer.channelId,
+                text: part.text,
+                ...(peer.threadTs ? { thread_ts: peer.threadTs } : {}),
+              } as any),
+            { logger: log },
+          );
+        } else {
+          const fileData = await readFile(part.filePath);
+          const filename = part.filename || basename(part.filePath);
+          await withDeliveryRetry(
+            "slack.uploadFile",
+            () =>
+              (web as any).files.uploadV2({
+                channel_id: peer.channelId,
+                file: fileData,
+                filename,
+                ...(peer.threadTs ? { thread_ts: peer.threadTs } : {}),
+                ...(part.caption?.trim() ? { initial_comment: part.caption.trim() } : {}),
+              }),
+            { logger: log },
+          );
+        }
+
+        sentParts += 1;
+        partResults.push({ index, type: part.type, sent: true });
+      } catch (error) {
+        const classified = classifyDeliveryError(error);
+        partResults.push({
+          index,
+          type: part.type,
+          sent: false,
+          error: classified.message,
+          code: classified.code,
+          retryable: classified.retryable,
+        });
+      }
+    }
+
+    return {
+      attemptedParts: message.parts.length,
+      sentParts,
+      partResults,
+    };
+  };
+
+  return {
+    name: "slack",
+    identityId: identity.id,
+    maxTextLength: MAX_TEXT_LENGTH,
+    async start() {
+      if (started) return;
+      log.debug("slack adapter starting");
+      const auth = await web.auth.test();
+      botUserId = typeof (auth as any)?.user_id === "string" ? (auth as any).user_id : null;
+      await socket.start();
+      started = true;
+      log.info({ botUserId }, "slack adapter started");
+    },
+    async stop() {
+      if (!started) return;
+      started = false;
+      try {
+        // socket-mode client uses a websocket; disconnect when stopping.
+        await socket.disconnect();
+      } catch (error) {
+        log.warn({ error }, "slack adapter stop failed");
+      }
+      log.info("slack adapter stopped");
+    },
+    async sendMessage(peerId: string, message: { parts: OutboundMessagePart[] }) {
+      return sendMessageInternal(peerId, message);
+    },
+    async sendText(peerId: string, text: string) {
+      const result = await sendMessageInternal(peerId, {
+        parts: [{ type: "text", text }],
+      });
+      if (result.sentParts === 0) {
+        const firstError = result.partResults.find((part) => !part.sent)?.error;
+        throw new Error(firstError || "Failed to deliver Slack text message");
+      }
+    },
+  };
+}
diff --git a/apps/opencode-router/src/telegram.ts b/apps/opencode-router/src/telegram.ts
new file mode 100644
index 0000000000..d4c52b70f6
--- /dev/null
+++ b/apps/opencode-router/src/telegram.ts
@@ -0,0 +1,440 @@
+import { Bot, InputFile, type BotError, type Context } from "grammy";
+import type { Logger } from "pino";
+
+import type { Config, TelegramIdentity } from "./config.js";
+import { classifyDeliveryError, withDeliveryRetry } from "./delivery.js";
+import type { InboundMessagePart, MediaKind, MessageDeliveryResult, OutboundMessagePart } from "./media.js";
+import type { MediaStore } from "./media-store.js";
+import { chunkText } from "./text.js";
+
+export type InboundMessage = {
+  channel: "telegram";
+  identityId: string;
+  peerId: string;
+  text: string;
+  parts?: InboundMessagePart[];
+  raw: unknown;
+  fromMe?: boolean;
+};
+
+export type MessageHandler = (message: InboundMessage) => Promise<void> | void;
+
+export type TelegramAdapter = {
+  name: "telegram";
+  identityId: string;
+  maxTextLength: number;
+  start(): Promise<void>;
+  stop(): Promise<void>;
+  sendMessage(peerId: string, message: { parts: OutboundMessagePart[] }): Promise<MessageDeliveryResult>;
+  sendText(peerId: string, text: string): Promise<void>;
+};
+
+const MAX_TEXT_LENGTH = 4096;
+
+const TELEGRAM_CHAT_ID_PATTERN = /^-?\d+$/;
+
+export function isTelegramPeerId(peerId: string): boolean {
+  return TELEGRAM_CHAT_ID_PATTERN.test(peerId.trim());
+}
+
+export function parseTelegramPeerId(peerId: string): number | null {
+  const trimmed = peerId.trim();
+  if (!isTelegramPeerId(trimmed)) return null;
+  const parsed = Number(trimmed);
+  if (!Number.isFinite(parsed)) return null;
+  return parsed;
+}
+
+function invalidTelegramPeerIdError(): Error & { status?: number } {
+  const error = new Error(
+    "Telegram peerId must be a numeric chat_id. Usernames like @name are not valid direct targets.",
+  ) as Error & { status?: number };
+  error.status = 400;
+  return error;
+}
+
+export function createTelegramAdapter(
+  identity: TelegramIdentity,
+  config: Config,
+  logger: Logger,
+  onMessage: MessageHandler,
+  mediaStore?: MediaStore,
+  deps: { Bot?: typeof Bot } = {},
+): TelegramAdapter {
+  const token = identity.token?.trim() ?? "";
+  if (!token) {
+    throw new Error("Telegram token is required for Telegram adapter");
+  }
+
+  const log = logger.child({ channel: "telegram", identityId: identity.id });
+  log.debug({ tokenPresent: true }, "telegram adapter init");
+  const BotImpl = deps.Bot ?? Bot;
+  const bot = new BotImpl(token);
+
+  type TelegramMediaCandidate = {
+    kind: MediaKind;
+    fileId: string;
+    fileUniqueId?: string;
+    filename?: string;
+    mimeType?: string;
+    sizeBytes?: number;
+  };
+
+  const truncateCaption = (value: string | undefined) => {
+    const text = (value ?? "").trim();
+    if (!text) return undefined;
+    return text.length <= 1024 ? text : text.slice(0, 1024);
+  };
+
+  const extractMediaCandidates = (message: any): TelegramMediaCandidate[] => {
+    const candidates: TelegramMediaCandidate[] = [];
+
+    if (Array.isArray(message?.photo) && message.photo.length > 0) {
+      const largest = message.photo[message.photo.length - 1];
+      if (largest?.file_id) {
+        candidates.push({
+          kind: "image",
+          fileId: String(largest.file_id),
+          fileUniqueId: typeof largest.file_unique_id === "string" ? largest.file_unique_id : undefined,
+          filename:
+            typeof largest.file_unique_id === "string"
+              ? `photo-${largest.file_unique_id}.jpg`
+              : `photo-${String(largest.file_id)}.jpg`,
+          mimeType: "image/jpeg",
+          sizeBytes: typeof largest.file_size === "number" ? largest.file_size : undefined,
+        });
+      }
+    }
+
+    if (message?.document?.file_id) {
+      const document = message.document;
+      const mimeType = typeof document.mime_type === "string" ? document.mime_type : undefined;
+      const normalizedKind: MediaKind =
+        typeof mimeType === "string" && mimeType.startsWith("image/")
+          ? "image"
+          : typeof mimeType === "string" && mimeType.startsWith("audio/")
+            ? "audio"
+            : "file";
+      candidates.push({
+        kind: normalizedKind,
+        fileId: String(document.file_id),
+        fileUniqueId: typeof document.file_unique_id === "string" ? document.file_unique_id : undefined,
+        filename: typeof document.file_name === "string" ? document.file_name : undefined,
+        mimeType,
+        sizeBytes: typeof document.file_size === "number" ? document.file_size : undefined,
+      });
+    }
+
+    if (message?.audio?.file_id) {
+      const audio = message.audio;
+      candidates.push({
+        kind: "audio",
+        fileId: String(audio.file_id),
+        fileUniqueId: typeof audio.file_unique_id === "string" ? audio.file_unique_id : undefined,
+        filename: typeof audio.file_name === "string" ? audio.file_name : undefined,
+        mimeType: typeof audio.mime_type === "string" ? audio.mime_type : undefined,
+        sizeBytes: typeof audio.file_size === "number" ? audio.file_size : undefined,
+      });
+    }
+
+    if (message?.voice?.file_id) {
+      const voice = message.voice;
+      candidates.push({
+        kind: "audio",
+        fileId: String(voice.file_id),
+        fileUniqueId: typeof voice.file_unique_id === "string" ? voice.file_unique_id : undefined,
+        filename:
+          typeof voice.file_unique_id === "string"
+            ? `voice-${voice.file_unique_id}.ogg`
+            : `voice-${String(voice.file_id)}.ogg`,
+        mimeType: "audio/ogg",
+        sizeBytes: typeof voice.file_size === "number" ? voice.file_size : undefined,
+      });
+    }
+
+    return candidates;
+  };
+
+  const downloadCandidate = async (
+    chatId: string,
+    candidate: TelegramMediaCandidate,
+  ): Promise<InboundMessagePart> => {
+    if (!mediaStore) {
+      return {
+        type: "media",
+        media: {
+          id: candidate.fileUniqueId || candidate.fileId,
+          kind: candidate.kind,
+          source: "telegram",
+          status: "failed",
+          providerFileId: candidate.fileId,
+          ...(candidate.fileUniqueId ? { providerFileUniqueId: candidate.fileUniqueId } : {}),
+          ...(candidate.filename ? { filename: candidate.filename } : {}),
+          ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          ...(typeof candidate.sizeBytes === "number" ? { sizeBytes: candidate.sizeBytes } : {}),
+          error: "media store unavailable",
+        },
+      };
+    }
+
+    try {
+      const file = await withDeliveryRetry(
+        "telegram.getFile",
+        () => bot.api.getFile(candidate.fileId),
+        { logger: log },
+      );
+      const filePath = typeof (file as any)?.file_path === "string" ? String((file as any).file_path) : "";
+      if (!filePath) {
+        throw new Error(`Telegram file path missing for file_id ${candidate.fileId}`);
+      }
+
+      const url = `https://api.telegram.org/file/bot${token}/${filePath}`;
+      const stored = await withDeliveryRetry(
+        "telegram.download",
+        () =>
+          mediaStore.downloadInbound({
+            channel: "telegram",
+            identityId: identity.id,
+            peerId: chatId,
+            kind: candidate.kind,
+            url,
+            ...(candidate.filename ? { filename: candidate.filename } : {}),
+            ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          }),
+        { logger: log },
+      );
+
+      return {
+        type: "media",
+        media: {
+          id: candidate.fileUniqueId || candidate.fileId,
+          kind: candidate.kind,
+          source: "telegram",
+          status: "ready",
+          filePath: stored.filePath,
+          filename: stored.filename,
+          ...(stored.mimeType ? { mimeType: stored.mimeType } : {}),
+          sizeBytes: stored.sizeBytes,
+          providerFileId: candidate.fileId,
+          ...(candidate.fileUniqueId ? { providerFileUniqueId: candidate.fileUniqueId } : {}),
+          providerUrl: url,
+        },
+      };
+    } catch (error) {
+      const classified = classifyDeliveryError(error);
+      return {
+        type: "media",
+        media: {
+          id: candidate.fileUniqueId || candidate.fileId,
+          kind: candidate.kind,
+          source: "telegram",
+          status: "failed",
+          providerFileId: candidate.fileId,
+          ...(candidate.fileUniqueId ? { providerFileUniqueId: candidate.fileUniqueId } : {}),
+          ...(candidate.filename ? { filename: candidate.filename } : {}),
+          ...(candidate.mimeType ? { mimeType: candidate.mimeType } : {}),
+          ...(typeof candidate.sizeBytes === "number" ? { sizeBytes: candidate.sizeBytes } : {}),
+          error: `${classified.code}: ${classified.message}`,
+        },
+      };
+    }
+  };
+
+  bot.catch((err: BotError<Context>) => {
+    log.error({ error: err.error }, "telegram bot error");
+  });
+
+  bot.on("message", async (ctx: Context) => {
+    const msg = ctx.message;
+    if (!msg?.chat) return;
+
+    const fromId = typeof msg.from?.id === "number" ? msg.from.id : null;
+    const selfId = typeof ctx.me?.id === "number" ? ctx.me.id : null;
+    const fromMe = fromId !== null && selfId !== null && fromId === selfId;
+    const fromBot = msg.from?.is_bot === true;
+    if (fromMe || fromBot) {
+      log.debug({ chatId: msg.chat.id, fromId, selfId }, "telegram message ignored (bot-originated)");
+      return;
+    }
+
+    const mediaCandidates = extractMediaCandidates(msg as any);
+    const hasMedia = mediaCandidates.length > 0;
+
+    const chatType = msg.chat.type as string;
+    const isGroup = chatType === "group" || chatType === "supergroup" || chatType === "channel";
+    
+    // In groups, check if groups are enabled
+    if (isGroup && !config.groupsEnabled) {
+      log.debug({ chatId: msg.chat.id, chatType }, "telegram message ignored (groups disabled)");
+      return;
+    }
+
+    let text = msg.text ?? msg.caption ?? "";
+
+    // In groups, only respond if the bot is @mentioned
+    if (isGroup) {
+      const botUsername = ctx.me?.username;
+      if (!botUsername) {
+        log.debug({ chatId: msg.chat.id }, "telegram message ignored (bot username unknown)");
+        return;
+      }
+      
+      const mentionPattern = new RegExp(`@${botUsername}\\b`, "i");
+      if (!mentionPattern.test(text)) {
+        log.debug({ chatId: msg.chat.id, botUsername }, "telegram message ignored (not mentioned)");
+        return;
+      }
+      
+      // Strip the @mention from the message
+      text = text.replace(mentionPattern, "").trim();
+      if (!text && !hasMedia) {
+        log.debug({ chatId: msg.chat.id }, "telegram message ignored (empty after removing mention)");
+        return;
+      }
+    }
+
+    if (!text.trim() && !hasMedia) {
+      return;
+    }
+
+    const parts: InboundMessagePart[] = [];
+    if (text.trim()) {
+      parts.push({ type: "text", text: text.trim() });
+    }
+
+    for (const candidate of mediaCandidates) {
+      const part = await downloadCandidate(String(msg.chat.id), candidate);
+      if ((msg.caption ?? "").trim() && part.type === "media") {
+        parts.push({ ...part, caption: msg.caption?.trim() });
+      } else {
+        parts.push(part);
+      }
+    }
+
+    const textForPrompt = parts
+      .filter((part): part is { type: "text"; text: string } => part.type === "text")
+      .map((part) => part.text)
+      .join("\n")
+      .trim();
+    const preview = textForPrompt || `${parts.filter((part) => part.type === "media").length} media attachment(s)`;
+
+    log.debug(
+      { chatId: msg.chat.id, chatType, isGroup, length: textForPrompt.length, preview: preview.slice(0, 120) },
+      "telegram message received",
+    );
+
+    try {
+      await onMessage({
+        channel: "telegram",
+        identityId: identity.id,
+        peerId: String(msg.chat.id),
+        text: textForPrompt,
+        parts,
+        raw: msg,
+        fromMe,
+      });
+    } catch (error) {
+      log.error({ error, peerId: msg.chat.id }, "telegram inbound handler failed");
+    }
+  });
+
+  const sendMessageInternal = async (
+    peerId: string,
+    message: { parts: OutboundMessagePart[] },
+  ): Promise<MessageDeliveryResult> => {
+    const chatId = parseTelegramPeerId(peerId);
+    if (chatId === null) {
+      throw invalidTelegramPeerIdError();
+    }
+
+    const partResults: MessageDeliveryResult["partResults"] = [];
+    let sentParts = 0;
+
+    for (let index = 0; index < message.parts.length; index += 1) {
+      const part = message.parts[index];
+      try {
+        if (part.type === "text") {
+          const chunks = chunkText(part.text, MAX_TEXT_LENGTH);
+          for (const chunk of chunks) {
+            await withDeliveryRetry("telegram.sendMessage", () => bot.api.sendMessage(chatId, chunk), {
+              logger: log,
+            });
+          }
+        } else if (part.type === "image") {
+          await withDeliveryRetry(
+            "telegram.sendPhoto",
+            () =>
+              bot.api.sendPhoto(chatId, new InputFile(part.filePath, part.filename), {
+                ...(truncateCaption(part.caption) ? { caption: truncateCaption(part.caption) } : {}),
+              }),
+            { logger: log },
+          );
+        } else if (part.type === "audio") {
+          await withDeliveryRetry(
+            "telegram.sendAudio",
+            () =>
+              bot.api.sendAudio(chatId, new InputFile(part.filePath, part.filename), {
+                ...(truncateCaption(part.caption) ? { caption: truncateCaption(part.caption) } : {}),
+              }),
+            { logger: log },
+          );
+        } else {
+          await withDeliveryRetry(
+            "telegram.sendDocument",
+            () =>
+              bot.api.sendDocument(chatId, new InputFile(part.filePath, part.filename), {
+                ...(truncateCaption(part.caption) ? { caption: truncateCaption(part.caption) } : {}),
+              }),
+            { logger: log },
+          );
+        }
+
+        sentParts += 1;
+        partResults.push({ index, type: part.type, sent: true });
+      } catch (error) {
+        const classified = classifyDeliveryError(error);
+        partResults.push({
+          index,
+          type: part.type,
+          sent: false,
+          error: classified.message,
+          code: classified.code,
+          retryable: classified.retryable,
+        });
+      }
+    }
+
+    return {
+      attemptedParts: message.parts.length,
+      sentParts,
+      partResults,
+    };
+  };
+
+  return {
+    name: "telegram",
+    identityId: identity.id,
+    maxTextLength: MAX_TEXT_LENGTH,
+    async start() {
+      log.debug("telegram adapter starting");
+      await bot.start();
+      log.info("telegram adapter started");
+    },
+    async stop() {
+      bot.stop();
+      log.info("telegram adapter stopped");
+    },
+    async sendMessage(peerId: string, message: { parts: OutboundMessagePart[] }) {
+      return sendMessageInternal(peerId, message);
+    },
+    async sendText(peerId: string, text: string) {
+      const result = await sendMessageInternal(peerId, {
+        parts: [{ type: "text", text }],
+      });
+      if (result.sentParts === 0) {
+        const firstError = result.partResults.find((part) => !part.sent)?.error;
+        throw new Error(firstError || "Failed to deliver Telegram text message");
+      }
+    },
+  };
+}
diff --git a/apps/opencode-router/src/text.ts b/apps/opencode-router/src/text.ts
new file mode 100644
index 0000000000..bd4b5cc32a
--- /dev/null
+++ b/apps/opencode-router/src/text.ts
@@ -0,0 +1,38 @@
+export function chunkText(input: string, limit: number): string[] {
+  if (input.length <= limit) return [input];
+  const chunks: string[] = [];
+  let current = "";
+
+  for (const line of input.split(/\n/)) {
+    if ((current + line).length + 1 > limit) {
+      if (current) chunks.push(current.trimEnd());
+      current = "";
+    }
+    if (line.length > limit) {
+      for (let i = 0; i < line.length; i += limit) {
+        const slice = line.slice(i, i + limit);
+        if (slice.length) chunks.push(slice);
+      }
+      continue;
+    }
+    current += current ? `\n${line}` : line;
+  }
+
+  if (current.trim().length) chunks.push(current.trimEnd());
+  return chunks.length ? chunks : [input];
+}
+
+export function truncateText(text: string, limit: number): string {
+  if (text.length <= limit) return text;
+  return `${text.slice(0, Math.max(0, limit - 1))}…`;
+}
+
+export function formatInputSummary(input: Record<string, unknown>): string {
+  const entries = Object.entries(input);
+  if (!entries.length) return "";
+  try {
+    return JSON.stringify(input);
+  } catch {
+    return entries.map(([key, value]) => `${key}=${String(value)}`).join(", ");
+  }
+}
diff --git a/apps/opencode-router/test/bridge-e2e.test.js b/apps/opencode-router/test/bridge-e2e.test.js
new file mode 100644
index 0000000000..db808d2c74
--- /dev/null
+++ b/apps/opencode-router/test/bridge-e2e.test.js
@@ -0,0 +1,164 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { startBridge } from "../dist/bridge.js";
+
+function createLoggerStub() {
+  const base = {
+    child() {
+      return base;
+    },
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+  return base;
+}
+
+test("bridge end-to-end: inbound -> prompt -> outbound", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-e2e-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+
+  const sent = [];
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const fakeClient = {
+    global: {
+      health: async () => ({ healthy: true, version: "test" }),
+    },
+    session: {
+      create: async () => ({ id: "session-1" }),
+      prompt: async () => ({ parts: [{ type: "text", text: "pong" }] }),
+    },
+  };
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort: undefined,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: fakeClient,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+      disableHealthServer: true,
+    },
+  );
+
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D123", text: "ping", raw: {} });
+
+  assert.equal(sent.length, 2);
+  assert.equal(sent[0].peerId, "D123");
+  assert.equal(sent[1].peerId, "D123");
+  assert.ok(sent[0].text.includes("Session started."));
+  assert.equal(sent[1].text, "pong");
+
+  await bridge.stop();
+});
+
+test("bridge recovers from empty prompt replies by clearing stale session", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-e2e-empty-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+
+  const sent = [];
+  let sessionCounter = 0;
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const fakeClient = {
+    global: {
+      health: async () => ({ healthy: true, version: "test" }),
+    },
+    session: {
+      create: async () => {
+        sessionCounter += 1;
+        return { id: `session-${sessionCounter}` };
+      },
+      prompt: async ({ sessionID }) => {
+        if (sessionID === "session-1") {
+          return { parts: [] };
+        }
+        return { parts: [{ type: "text", text: "fresh reply" }] };
+      },
+    },
+  };
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort: undefined,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: fakeClient,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+      disableHealthServer: true,
+    },
+  );
+
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D123", text: "first", raw: {} });
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D123", text: "second", raw: {} });
+
+  assert.equal(sessionCounter, 2);
+  assert.ok(
+    sent.some((message) =>
+      message.text.includes("No visible response was generated. I reset this chat session in case stale state was blocking replies."),
+    ),
+  );
+  assert.ok(sent.some((message) => message.text === "fresh reply"));
+
+  await bridge.stop();
+});
diff --git a/apps/opencode-router/test/bridge-multiworkspace.test.js b/apps/opencode-router/test/bridge-multiworkspace.test.js
new file mode 100644
index 0000000000..a8a6f8c344
--- /dev/null
+++ b/apps/opencode-router/test/bridge-multiworkspace.test.js
@@ -0,0 +1,182 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { startBridge } from "../dist/bridge.js";
+
+function createLoggerStub() {
+  const base = {
+    child() {
+      return base;
+    },
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+  return base;
+}
+
+test("bridge: routes sessions per peer directory binding within workspace", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-multiws-"));
+  const wsA = path.join(dir, "ws-a");
+  const wsB = path.join(wsA, "project-b");
+  fs.mkdirSync(wsA, { recursive: true });
+  fs.mkdirSync(wsB, { recursive: true });
+
+  const dbPath = path.join(dir, "opencode-router.db");
+  const sent = [];
+  const created = [];
+  const prompted = [];
+
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const clientFactory = (directory) => {
+    const dirLabel = directory;
+    return {
+      global: {
+        health: async () => ({ healthy: true, version: "test" }),
+      },
+      session: {
+        create: async () => {
+          created.push(dirLabel);
+          return { id: `session-${created.length}` };
+        },
+        prompt: async () => {
+          prompted.push(dirLabel);
+          return { parts: [{ type: "text", text: `pong:${path.basename(dirLabel)}` }] };
+        },
+      },
+    };
+  };
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: wsA,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort: undefined,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      clientFactory,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+      disableHealthServer: true,
+    },
+  );
+
+  // Bind peer A to ws-a
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-A", text: `/dir ${wsA}`, raw: {} });
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-A", text: "ping", raw: {} });
+
+  // Bind peer B to ws-b
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-B", text: `/dir ${wsB}`, raw: {} });
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-B", text: "ping", raw: {} });
+
+  // Ensure prompts were routed to different workspace subdirectories
+  assert.ok(prompted.includes(wsA));
+  assert.ok(prompted.includes(wsB));
+
+  // Ensure output includes per-directory pong
+  const output = sent.map((m) => `${m.peerId}:${m.text}`).join("\n");
+  assert.ok(output.includes("D-A:pong:ws-a"));
+  assert.ok(output.includes("D-B:pong:project-b"));
+
+  await bridge.stop();
+});
+
+test("bridge: rejects /dir outside workspace root", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-multiws-"));
+  const wsA = path.join(dir, "ws-a");
+  const outside = path.join(dir, "outside");
+  fs.mkdirSync(wsA, { recursive: true });
+  fs.mkdirSync(outside, { recursive: true });
+
+  const dbPath = path.join(dir, "opencode-router.db");
+  const prompted = [];
+  const sent = [];
+
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const clientFactory = (directory) => ({
+    global: { health: async () => ({ healthy: true, version: "test" }) },
+    session: {
+      create: async () => ({ id: "session-1" }),
+      prompt: async () => {
+        prompted.push(directory);
+        return { parts: [{ type: "text", text: "pong" }] };
+      },
+    },
+  });
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: wsA,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort: undefined,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      clientFactory,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+      disableHealthServer: true,
+    },
+  );
+
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-OUT", text: `/dir ${outside}`, raw: {} });
+  await bridge.dispatchInbound({ channel: "slack", identityId: "default", peerId: "D-OUT", text: "ping", raw: {} });
+
+  assert.ok(sent.some((m) => m.text.includes("Directory must stay within workspace root")));
+  assert.ok(prompted.every((dirPath) => dirPath === wsA));
+
+  await bridge.stop();
+});
diff --git a/apps/opencode-router/test/db.test.js b/apps/opencode-router/test/db.test.js
new file mode 100644
index 0000000000..854c10e897
--- /dev/null
+++ b/apps/opencode-router/test/db.test.js
@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { BridgeStore } from "../dist/db.js";
+
+test("BridgeStore allowlist and sessions", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+
+  assert.equal(store.isAllowed("telegram", "123"), false);
+  store.allowPeer("telegram", "123");
+  assert.equal(store.isAllowed("telegram", "123"), true);
+
+  store.upsertSession("telegram", "default", "123", "session-1");
+  const row = store.getSession("telegram", "default", "123");
+  assert.equal(row?.session_id, "session-1");
+
+  store.upsertBinding("slack", "app-1", "D123", "/tmp/ws");
+  const binding = store.getBinding("slack", "app-1", "D123");
+  assert.equal(binding?.directory, "/tmp/ws");
+
+  store.close();
+});
diff --git a/apps/opencode-router/test/health-send.test.js b/apps/opencode-router/test/health-send.test.js
new file mode 100644
index 0000000000..06e174f5bf
--- /dev/null
+++ b/apps/opencode-router/test/health-send.test.js
@@ -0,0 +1,446 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import net from "node:net";
+import assert from "node:assert/strict";
+
+import { startBridge } from "../dist/bridge.js";
+import { BridgeStore } from "../dist/db.js";
+
+function createLoggerStub() {
+  const base = {
+    child() {
+      return base;
+    },
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+  return base;
+}
+
+async function freePort() {
+  const server = net.createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  await new Promise((resolve) => server.close(resolve));
+  return port;
+}
+
+test("health /send delivers to directory bindings", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+
+  const sent = [];
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  store.upsertBinding("slack", "default", "D123", dir.replace(/\\/g, "/").replace(/\/+$/, "") || "/");
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ channel: "slack", directory: dir, text: "hello" }),
+  });
+  assert.equal(response.status, 200);
+  const json = await response.json();
+  assert.equal(json.ok, true);
+  assert.equal(json.sent, 1);
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].peerId, "D123");
+  assert.equal(sent[0].text, "hello");
+
+  await bridge.stop();
+  store.close();
+});
+
+test("health /send reports no-op when no bindings exist", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map(),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ channel: "slack", directory: dir, text: "hello" }),
+  });
+  assert.equal(response.status, 200);
+  const json = await response.json();
+  assert.equal(json.ok, true);
+  assert.equal(json.attempted, 0);
+  assert.equal(json.sent, 0);
+  assert.equal(typeof json.reason, "string");
+
+  await bridge.stop();
+  store.close();
+});
+
+test("health /send can deliver directly with peerId", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+
+  const sent = [];
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ channel: "slack", peerId: "D555", text: "hello-direct" }),
+  });
+  assert.equal(response.status, 200);
+  const json = await response.json();
+  assert.equal(json.ok, true);
+  assert.equal(json.peerId, "D555");
+  assert.equal(json.sent, 1);
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].peerId, "D555");
+  assert.equal(sent[0].text, "hello-direct");
+
+  await bridge.stop();
+  store.close();
+});
+
+test("health /send can deliver file parts end-to-end", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-media-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+  const sourceFile = path.join(dir, "payload.txt");
+  fs.writeFileSync(sourceFile, "payload-from-test");
+
+  const deliveries = [];
+  const slackAdapter = {
+    key: "slack:default",
+    name: "slack",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      deliveries.push({ peerId, text });
+    },
+    async sendMessage(peerId, message) {
+      deliveries.push({ peerId, message });
+      const mediaPart = message.parts.find((part) => part.type === "file");
+      assert.ok(mediaPart);
+      assert.equal(path.isAbsolute(mediaPart.filePath), true);
+      assert.equal(fs.readFileSync(mediaPart.filePath, "utf8"), "payload-from-test");
+      return {
+        attemptedParts: message.parts.length,
+        sentParts: message.parts.length,
+        partResults: message.parts.map((part, index) => ({
+          index,
+          type: part.type,
+          sent: true,
+        })),
+      };
+    },
+  };
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map([["slack:default", slackAdapter]]),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      channel: "slack",
+      peerId: "D999",
+      parts: [{ type: "file", filePath: "payload.txt" }],
+    }),
+  });
+  assert.equal(response.status, 200);
+  const json = await response.json();
+  assert.equal(json.ok, true);
+  assert.equal(json.sent, 1);
+  assert.equal(Array.isArray(json.targets), true);
+  assert.equal(json.targets[0].sentParts, 1);
+  assert.equal(deliveries.length, 1);
+
+  await bridge.stop();
+  store.close();
+});
+
+test("health /send rejects invalid telegram direct peerId", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map(),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ channel: "telegram", peerId: "@hotkartoffel", text: "hello-direct" }),
+  });
+  assert.equal(response.status, 400);
+  const json = await response.json();
+  assert.equal(json.ok, false);
+  assert.match(String(json.error || ""), /numeric chat_id/i);
+
+  await bridge.stop();
+  store.close();
+});
+
+test("health /send removes invalid telegram bindings and still sends valid ones", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "opencodeRouter-health-send-"));
+  const dbPath = path.join(dir, "opencode-router.db");
+  const store = new BridgeStore(dbPath);
+  const healthPort = await freePort();
+
+  const sent = [];
+  const telegramAdapter = {
+    key: "telegram:default",
+    name: "telegram",
+    identityId: "default",
+    maxTextLength: 39_000,
+    async start() {},
+    async stop() {},
+    async sendText(peerId, text) {
+      sent.push({ peerId, text });
+    },
+  };
+
+  const normalizedDir = dir.replace(/\\/g, "/").replace(/\/+$/, "") || "/";
+  store.upsertBinding("telegram", "default", "@bad-target", normalizedDir);
+  store.upsertBinding("telegram", "default", "351743020", normalizedDir);
+
+  const bridge = await startBridge(
+    {
+      configPath: path.join(dir, "opencode-router.json"),
+      configFile: { version: 1 },
+      opencodeUrl: "http://127.0.0.1:4096",
+      opencodeDirectory: dir,
+      telegramBots: [],
+      slackApps: [],
+      dataDir: dir,
+      dbPath,
+      logFile: path.join(dir, "opencode-router.log"),
+      toolUpdatesEnabled: false,
+      groupsEnabled: false,
+      permissionMode: "allow",
+      toolOutputLimit: 1200,
+      healthPort,
+      logLevel: "silent",
+    },
+    createLoggerStub(),
+    undefined,
+    {
+      client: {
+        global: {
+          health: async () => ({ healthy: true, version: "test" }),
+        },
+      },
+      store,
+      adapters: new Map([["telegram:default", telegramAdapter]]),
+      disableEventStream: true,
+    },
+  );
+
+  const response = await fetch(`http://127.0.0.1:${healthPort}/send`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ channel: "telegram", directory: dir, text: "hello" }),
+  });
+  assert.equal(response.status, 200);
+  const json = await response.json();
+  assert.equal(json.ok, true);
+  assert.equal(json.attempted, 2);
+  assert.equal(json.sent, 1);
+  assert.equal(Array.isArray(json.failures), true);
+  assert.equal(json.failures.length, 1);
+  assert.match(String(json.failures[0].error || ""), /invalid telegram peerid binding removed/i);
+
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].peerId, "351743020");
+  assert.equal(sent[0].text, "hello");
+
+  assert.equal(store.getBinding("telegram", "default", "@bad-target"), null);
+  assert.notEqual(store.getBinding("telegram", "default", "351743020"), null);
+
+  await bridge.stop();
+  store.close();
+});
diff --git a/apps/opencode-router/test/path-scope.test.js b/apps/opencode-router/test/path-scope.test.js
new file mode 100644
index 0000000000..45ec20d331
--- /dev/null
+++ b/apps/opencode-router/test/path-scope.test.js
@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  isWithinWorkspaceRootPath,
+  normalizeScopedDirectoryPath,
+} from "../dist/path-scope.js";
+
+test("normalizeScopedDirectoryPath strips Windows verbatim prefixes", () => {
+  const workspaceRoot = String.raw`G:\project\openwork_project`;
+  const candidate = String.raw`\\?\G:\project\openwork_project`;
+
+  assert.equal(
+    normalizeScopedDirectoryPath(workspaceRoot, "win32"),
+    "g:/project/openwork_project",
+  );
+  assert.equal(
+    normalizeScopedDirectoryPath(candidate, "win32"),
+    "g:/project/openwork_project",
+  );
+});
+
+test("isWithinWorkspaceRootPath accepts Windows verbatim aliases for workspace root", () => {
+  const workspaceRoot = String.raw`G:\project\openwork_project`;
+  const candidate = String.raw`\\?\G:\project\openwork_project`;
+
+  assert.equal(
+    isWithinWorkspaceRootPath({
+      workspaceRoot,
+      candidate,
+      platform: "win32",
+    }),
+    true,
+  );
+});
+
+test("isWithinWorkspaceRootPath still rejects directories outside the workspace root", () => {
+  const workspaceRoot = String.raw`G:\project\openwork_project`;
+  const candidate = String.raw`\\?\G:\project\outside`;
+
+  assert.equal(
+    isWithinWorkspaceRootPath({
+      workspaceRoot,
+      candidate,
+      platform: "win32",
+    }),
+    false,
+  );
+});
diff --git a/apps/opencode-router/test/slack.test.js b/apps/opencode-router/test/slack.test.js
new file mode 100644
index 0000000000..273c0820df
--- /dev/null
+++ b/apps/opencode-router/test/slack.test.js
@@ -0,0 +1,273 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { MediaStore } from "../dist/media-store.js";
+import {
+  createSlackAdapter,
+  formatSlackPeerId,
+  parseSlackPeerId,
+  stripSlackMention,
+} from "../dist/slack.js";
+
+function createLoggerStub() {
+  const base = {
+    child() {
+      return base;
+    },
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+  return base;
+}
+
+test("slack peerId encoding", () => {
+  assert.deepEqual(parseSlackPeerId("D123"), { channelId: "D123" });
+  assert.deepEqual(parseSlackPeerId("C123|1700000000.000100"), {
+    channelId: "C123",
+    threadTs: "1700000000.000100",
+  });
+  assert.equal(formatSlackPeerId({ channelId: "D123" }), "D123");
+  assert.equal(
+    formatSlackPeerId({ channelId: "C123", threadTs: "1700000000.000100" }),
+    "C123|1700000000.000100",
+  );
+});
+
+test("stripSlackMention removes bot mention and punctuation", () => {
+  assert.equal(stripSlackMention("<@UBOT> hello", "UBOT"), "hello");
+  assert.equal(stripSlackMention("<@UBOT>: hello", "UBOT"), "hello");
+  assert.equal(stripSlackMention("<@UBOT> - hello", "UBOT"), "hello");
+  assert.equal(stripSlackMention("hello", "UBOT"), "hello");
+});
+
+test("createSlackAdapter routes DM + app mentions", async () => {
+  const logger = createLoggerStub();
+  const inbound = [];
+  let socketInstance;
+  let webInstance;
+
+  class FakeWebClient {
+    constructor(token) {
+      this.token = token;
+      this.posts = [];
+      this.uploads = [];
+      webInstance = this;
+      this.auth = {
+        test: async () => ({ ok: true, user_id: "UBOT" }),
+      };
+      this.chat = {
+        postMessage: async (payload) => {
+          this.posts.push(payload);
+          return { ok: true };
+        },
+      };
+      this.files = {
+        uploadV2: async (payload) => {
+          this.uploads.push(payload);
+          return { ok: true };
+        },
+      };
+    }
+  }
+
+  class FakeSocketModeClient {
+    constructor(opts) {
+      this.opts = opts;
+      this.handlers = new Map();
+      this.acks = [];
+      socketInstance = this;
+    }
+    on(event, handler) {
+      this.handlers.set(event, handler);
+    }
+    async start() {
+      this.started = true;
+    }
+    async ack(envelopeId) {
+      this.acks.push(envelopeId);
+    }
+    async disconnect() {
+      this.started = false;
+    }
+    async emit(event, args) {
+      const handler = this.handlers.get(event);
+      if (handler) {
+        await handler(args);
+      }
+    }
+  }
+
+  const adapter = createSlackAdapter(
+    {
+      id: "default",
+      botToken: "xoxb-test",
+      appToken: "xapp-test",
+      enabled: true,
+    },
+    { groupsEnabled: false },
+    logger,
+    async (msg) => inbound.push(msg),
+    { WebClient: FakeWebClient, SocketModeClient: FakeSocketModeClient },
+  );
+
+  await adapter.start();
+  assert.equal(socketInstance.started, true);
+
+  await socketInstance.emit("message", {
+    ack: async () => socketInstance.acks.push("a1"),
+    event: {
+      type: "message",
+      channel: "D123",
+      user: "U1",
+      text: "hi",
+      ts: "1700000000.000001",
+    },
+  });
+
+  await socketInstance.emit("app_mention", {
+    ack: async () => socketInstance.acks.push("a2"),
+    event: {
+      type: "app_mention",
+      channel: "C123",
+      user: "U2",
+      text: "<@UBOT> run tests",
+      ts: "1700000000.000100",
+    },
+  });
+
+  assert.deepEqual(socketInstance.acks, ["a1", "a2"]);
+  assert.equal(inbound.length, 2);
+  assert.equal(inbound[0].channel, "slack");
+  assert.equal(inbound[0].identityId, "default");
+  assert.equal(inbound[0].peerId, "D123");
+  assert.equal(inbound[0].text, "hi");
+  assert.equal(inbound[1].identityId, "default");
+  assert.equal(inbound[1].peerId, "C123|1700000000.000100");
+  assert.equal(inbound[1].text, "run tests");
+
+  await adapter.sendText("D123", "ok");
+  await adapter.sendText("C123|1700000000.000100", "ok-thread");
+
+  const mediaFile = path.join(os.tmpdir(), `opencode-router-slack-${Date.now()}.txt`);
+  fs.writeFileSync(mediaFile, "hello from file");
+  const mediaResult = await adapter.sendMessage("D123", {
+    parts: [{ type: "file", filePath: mediaFile }],
+  });
+
+  assert.equal(webInstance.posts.length, 2);
+  assert.deepEqual(webInstance.posts[0], { channel: "D123", text: "ok" });
+  assert.deepEqual(webInstance.posts[1], { channel: "C123", text: "ok-thread", thread_ts: "1700000000.000100" });
+  assert.equal(mediaResult.sentParts, 1);
+  assert.equal(webInstance.uploads.length, 1);
+  assert.equal(webInstance.uploads[0].channel_id, "D123");
+  assert.equal(Buffer.isBuffer(webInstance.uploads[0].file), true);
+  assert.equal(webInstance.uploads[0].filename, path.basename(mediaFile));
+
+  await adapter.stop();
+  assert.equal(socketInstance.started, false);
+});
+
+test("createSlackAdapter downloads inbound files into media store", async () => {
+  const logger = createLoggerStub();
+  const inbound = [];
+  let socketInstance;
+
+  class FakeWebClient {
+    constructor(token) {
+      this.token = token;
+      this.auth = {
+        test: async () => ({ ok: true, user_id: "UBOT" }),
+      };
+      this.chat = {
+        postMessage: async () => ({ ok: true }),
+      };
+      this.files = {
+        uploadV2: async () => ({ ok: true }),
+      };
+    }
+  }
+
+  class FakeSocketModeClient {
+    constructor() {
+      this.handlers = new Map();
+      socketInstance = this;
+    }
+    on(event, handler) {
+      this.handlers.set(event, handler);
+    }
+    async start() {}
+    async disconnect() {}
+    async emit(event, args) {
+      const handler = this.handlers.get(event);
+      if (handler) {
+        await handler(args);
+      }
+    }
+  }
+
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "opencode-router-slack-media-"));
+  const mediaStore = new MediaStore(path.join(tempDir, "media"));
+  await mediaStore.ensureReady();
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () =>
+    new Response("downloaded-slack-file", {
+      status: 200,
+      headers: { "content-type": "text/plain" },
+    });
+
+  try {
+    const adapter = createSlackAdapter(
+      {
+        id: "default",
+        botToken: "xoxb-test",
+        appToken: "xapp-test",
+        enabled: true,
+      },
+      { groupsEnabled: false },
+      logger,
+      async (msg) => inbound.push(msg),
+      { WebClient: FakeWebClient, SocketModeClient: FakeSocketModeClient },
+      mediaStore,
+    );
+
+    await adapter.start();
+
+    await socketInstance.emit("message", {
+      ack: async () => {},
+      event: {
+        type: "message",
+        subtype: "file_share",
+        channel: "D123",
+        user: "U1",
+        files: [
+          {
+            id: "F1",
+            url_private_download: "https://files.example.com/download/F1",
+            name: "report.txt",
+            mimetype: "text/plain",
+            size: 22,
+          },
+        ],
+      },
+    });
+
+    assert.equal(inbound.length, 1);
+    const mediaPart = inbound[0].parts.find((part) => part.type === "media");
+    assert.ok(mediaPart);
+    assert.equal(mediaPart.media.status, "ready");
+    const downloadedPath = mediaPart.media.filePath;
+    assert.ok(downloadedPath);
+    assert.equal(fs.existsSync(downloadedPath), true);
+    assert.equal(fs.readFileSync(downloadedPath, "utf8"), "downloaded-slack-file");
+
+    await adapter.stop();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/apps/opencode-router/test/telegram.test.js b/apps/opencode-router/test/telegram.test.js
new file mode 100644
index 0000000000..7624a32062
--- /dev/null
+++ b/apps/opencode-router/test/telegram.test.js
@@ -0,0 +1,204 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { MediaStore } from "../dist/media-store.js";
+import { createTelegramAdapter } from "../dist/telegram.js";
+
+function createLoggerStub() {
+  const base = {
+    child() {
+      return base;
+    },
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+  return base;
+}
+
+let lastFakeBot = null;
+
+class FakeBot {
+  constructor(token) {
+    this.token = token;
+    this.handlers = new Map();
+    this.me = { id: 999, username: "routerbot" };
+    this.calls = {
+      sendMessage: [],
+      sendPhoto: [],
+      sendAudio: [],
+      sendDocument: [],
+      getFile: [],
+    };
+    this.api = {
+      sendMessage: async (chatId, text) => {
+        this.calls.sendMessage.push({ chatId, text });
+        return { ok: true };
+      },
+      sendPhoto: async (chatId, file, options) => {
+        this.calls.sendPhoto.push({ chatId, file, options });
+        return { ok: true };
+      },
+      sendAudio: async (chatId, file, options) => {
+        this.calls.sendAudio.push({ chatId, file, options });
+        return { ok: true };
+      },
+      sendDocument: async (chatId, file, options) => {
+        this.calls.sendDocument.push({ chatId, file, options });
+        return { ok: true };
+      },
+      getFile: async (fileId) => {
+        this.calls.getFile.push({ fileId });
+        return { file_path: `downloads/${fileId}.bin` };
+      },
+    };
+    lastFakeBot = this;
+  }
+
+  catch(handler) {
+    this.errorHandler = handler;
+  }
+
+  on(event, handler) {
+    this.handlers.set(event, handler);
+  }
+
+  async start() {
+    this.started = true;
+  }
+
+  stop() {
+    this.started = false;
+  }
+
+  async emitMessage(message) {
+    const handler = this.handlers.get("message");
+    if (handler) {
+      await handler({ message, me: this.me });
+    }
+  }
+}
+
+test("createTelegramAdapter sends text/images/audio/files", async () => {
+  const logger = createLoggerStub();
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "opencode-router-tg-send-"));
+  const imagePath = path.join(tempDir, "sample.jpg");
+  const audioPath = path.join(tempDir, "sample.ogg");
+  const filePath = path.join(tempDir, "sample.txt");
+  fs.writeFileSync(imagePath, "img");
+  fs.writeFileSync(audioPath, "aud");
+  fs.writeFileSync(filePath, "doc");
+
+  const adapter = createTelegramAdapter(
+    {
+      id: "default",
+      token: "tg-token",
+      enabled: true,
+    },
+    { groupsEnabled: false },
+    logger,
+    async () => {},
+    undefined,
+    { Bot: FakeBot },
+  );
+
+  const result = await adapter.sendMessage("12345", {
+    parts: [
+      { type: "text", text: "hello" },
+      { type: "image", filePath: imagePath, caption: "image caption" },
+      { type: "audio", filePath: audioPath },
+      { type: "file", filePath },
+    ],
+  });
+
+  assert.equal(result.attemptedParts, 4);
+  assert.equal(result.sentParts, 4);
+  assert.ok(lastFakeBot);
+  assert.equal(lastFakeBot.calls.sendMessage.length, 1);
+  assert.equal(lastFakeBot.calls.sendPhoto.length, 1);
+  assert.equal(lastFakeBot.calls.sendAudio.length, 1);
+  assert.equal(lastFakeBot.calls.sendDocument.length, 1);
+});
+
+test("createTelegramAdapter downloads inbound media to store", async () => {
+  const logger = createLoggerStub();
+  const inbound = [];
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "opencode-router-tg-inbound-"));
+  const mediaStore = new MediaStore(path.join(tempDir, "media"));
+  await mediaStore.ensureReady();
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () =>
+    new Response("telegram-media", {
+      status: 200,
+      headers: { "content-type": "image/jpeg" },
+    });
+
+  try {
+    const adapter = createTelegramAdapter(
+      {
+        id: "default",
+        token: "tg-token",
+        enabled: true,
+      },
+      { groupsEnabled: false },
+      logger,
+      async (message) => inbound.push(message),
+      mediaStore,
+      { Bot: FakeBot },
+    );
+
+    await lastFakeBot.emitMessage({
+      chat: { id: 777, type: "private" },
+      caption: "here is photo",
+      photo: [{ file_id: "FILE123", file_unique_id: "UNIQ123", file_size: 13 }],
+    });
+
+    assert.equal(inbound.length, 1);
+    assert.equal(inbound[0].text, "here is photo");
+    const mediaPart = inbound[0].parts.find((part) => part.type === "media");
+    assert.ok(mediaPart);
+    assert.equal(mediaPart.media.status, "ready");
+    assert.ok(mediaPart.media.filePath);
+    assert.equal(fs.existsSync(mediaPart.media.filePath), true);
+    assert.equal(fs.readFileSync(mediaPart.media.filePath, "utf8"), "telegram-media");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("createTelegramAdapter ignores bot-originated inbound messages", async () => {
+  const logger = createLoggerStub();
+  const inbound = [];
+
+  createTelegramAdapter(
+    {
+      id: "default",
+      token: "tg-token",
+      enabled: true,
+    },
+    { groupsEnabled: false },
+    logger,
+    async (message) => inbound.push(message),
+    undefined,
+    { Bot: FakeBot },
+  );
+
+  await lastFakeBot.emitMessage({
+    chat: { id: 777, type: "private" },
+    from: { id: 999, is_bot: true },
+    text: "bot says hi",
+  });
+
+  await lastFakeBot.emitMessage({
+    chat: { id: 777, type: "private" },
+    from: { id: 123, is_bot: true },
+    text: "another bot says hi",
+  });
+
+  assert.equal(inbound.length, 0);
+});
diff --git a/apps/opencode-router/tsconfig.json b/apps/opencode-router/tsconfig.json
new file mode 100644
index 0000000000..d5509c4d5f
--- /dev/null
+++ b/apps/opencode-router/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "types": ["bun-types", "node"]
+  },
+  "include": ["src"]
+}
diff --git a/apps/orchestrator/README.md b/apps/orchestrator/README.md
new file mode 100644
index 0000000000..c6990d3759
--- /dev/null
+++ b/apps/orchestrator/README.md
@@ -0,0 +1,233 @@
+# OpenWork Orchestrator
+
+Host orchestrator for opencode + OpenWork server + opencode-router. This is a CLI-first way to run host mode without the desktop UI.
+
+Published on npm as `openwork-orchestrator` and installs the `openwork` command.
+
+## Quick start
+
+```bash
+npm install -g openwork-orchestrator
+openwork start --workspace /path/to/workspace --approval auto
+```
+
+When run in a TTY, `openwork` shows an interactive status dashboard with service health, ports, and
+connection details. Use `openwork serve` or `--no-tui` for log-only mode.
+
+```bash
+openwork serve --workspace /path/to/workspace
+```
+
+`openwork` ships as a compiled binary, so Bun is not required at runtime.
+
+If npm skips the optional platform package, `postinstall` falls back to downloading the matching
+binary from the `openwork-orchestrator-v<version>` GitHub release. Override the download host with
+`OPENWORK_ORCHESTRATOR_DOWNLOAD_BASE_URL` when you need to use a mirror.
+
+`openwork` downloads and caches the `openwork-server`, `opencode-router`, and `opencode` sidecars on
+first run using a SHA-256 manifest. Use `--sidecar-dir` or `OPENWORK_SIDECAR_DIR` to control the
+cache location, and `--sidecar-base-url` / `--sidecar-manifest` to point at a custom host.
+
+Use `--sidecar-source` to control where `openwork-server` and `opencode-router` are resolved
+(`auto` | `bundled` | `downloaded` | `external`), and `--opencode-source` to control
+`opencode` resolution. Set `OPENWORK_SIDECAR_SOURCE` / `OPENWORK_OPENCODE_SOURCE` to
+apply the same policies via env vars.
+
+By default the manifest is fetched from
+`https://github.com/different-ai/openwork/releases/download/openwork-orchestrator-v<version>/openwork-orchestrator-sidecars.json`.
+
+OpenCode Router is optional. If it exits, `openwork` continues running unless you pass
+`--opencode-router-required` or set `OPENWORK_OPENCODE_ROUTER_REQUIRED=1`.
+
+For development overrides only, set `OPENWORK_ALLOW_EXTERNAL=1` or pass `--allow-external` to use
+locally installed `openwork-server` or `opencode-router` binaries.
+
+Add `--verbose` (or `OPENWORK_VERBOSE=1`) to print extra diagnostics about resolved binaries.
+
+OpenCode hot reload is enabled by default when launched via `openwork`.
+Tune it with:
+
+- `--opencode-hot-reload` / `--no-opencode-hot-reload`
+- `--opencode-hot-reload-debounce-ms <ms>`
+- `--opencode-hot-reload-cooldown-ms <ms>`
+
+Equivalent env vars:
+
+- `OPENWORK_OPENCODE_HOT_RELOAD` (router mode)
+- `OPENWORK_OPENCODE_HOT_RELOAD_DEBOUNCE_MS`
+- `OPENWORK_OPENCODE_HOT_RELOAD_COOLDOWN_MS`
+- `OPENWORK_OPENCODE_HOT_RELOAD` (start/serve mode)
+- `OPENWORK_OPENCODE_HOT_RELOAD_DEBOUNCE_MS`
+- `OPENWORK_OPENCODE_HOT_RELOAD_COOLDOWN_MS`
+
+Or from source:
+
+```bash
+pnpm --filter openwork-orchestrator dev -- \
+  start --workspace /path/to/workspace --approval auto --allow-external
+```
+
+When `OPENWORK_DEV_MODE=1` is set, orchestrator uses an isolated OpenCode dev state for config, auth, data, cache, and state. OpenWork's repo-level `pnpm dev` commands enable this automatically so local development does not reuse your personal OpenCode environment.
+
+The command prints pairing URLs by default and withholds live credentials from stdout to avoid leaking them into shell history or collected logs. Use `--json` only when you explicitly need the raw pairing secrets in command output.
+
+Use `--detach` to keep services running and exit the dashboard. The detach summary includes the
+OpenWork URL and a redacted `opencode attach` command, while keeping live credentials out of the detached summary.
+
+## Sandbox mode (Docker / Apple container)
+
+`openwork` can run the sidecars inside a Linux container boundary while still mounting your workspace
+from the host.
+
+```bash
+# Auto-pick sandbox backend (prefers Apple container on supported Macs)
+openwork start --sandbox auto --workspace /path/to/workspace --approval auto
+
+# Explicit backends
+openwork start --sandbox docker --workspace /path/to/workspace --approval auto
+openwork start --sandbox container --workspace /path/to/workspace --approval auto
+```
+
+Notes:
+
+- `--sandbox auto` prefers Apple `container` on supported Macs (arm64), otherwise Docker.
+- Docker backend requires `docker` on your PATH.
+- Apple container backend requires the `container` CLI (https://github.com/apple/container).
+- In sandbox mode, sidecars are resolved for a Linux target (and `--sidecar-source` / `--opencode-source`
+  are effectively `downloaded`).
+- Custom `--*-bin` overrides are not supported in sandbox mode yet.
+- Use `--sandbox-image` to pick an image with the toolchain you want available to OpenCode.
+- Use `--sandbox-persist-dir` to control the host directory mounted at `/persist` inside the container.
+
+### Extra mounts (allowlisted)
+
+You can add explicit, validated mounts into `/workspace/extra/*`:
+
+```bash
+openwork start --sandbox auto --sandbox-mount "/path/on/host:datasets:ro" --workspace /path/to/workspace
+```
+
+Additional mounts are blocked unless you create an allowlist at:
+
+- `~/.config/openwork/sandbox-mount-allowlist.json`
+
+Override with `OPENWORK_SANDBOX_MOUNT_ALLOWLIST`.
+
+## Logging
+
+`openwork` emits a unified log stream from OpenCode, OpenWork server, and opencode-router. Use JSON format for
+structured, OpenTelemetry-friendly logs and a stable run id for correlation.
+
+```bash
+OPENWORK_LOG_FORMAT=json openwork start --workspace /path/to/workspace
+```
+
+Use `--run-id` or `OPENWORK_RUN_ID` to supply your own correlation id.
+
+OpenCode runs at `INFO` by default, which produces large log files in
+`~/.local/share/opencode/log/`. Pass `--opencode-log-level <DEBUG|INFO|WARN|ERROR>` (or set
+`OPENWORK_OPENCODE_LOG_LEVEL`) to forward `--log-level` to managed `opencode serve` and reduce log
+volume.
+
+OpenWork server logs every request with method, path, status, and duration. Disable this when running
+`openwork-server` directly by setting `OPENWORK_LOG_REQUESTS=0` or passing `--no-log-requests`.
+
+## Router daemon (multi-workspace)
+
+The router keeps a single OpenCode process alive and switches workspaces JIT using the `directory` parameter.
+
+```bash
+openwork daemon start
+openwork workspace add /path/to/workspace-a
+openwork workspace add /path/to/workspace-b
+openwork workspace list --json
+openwork workspace path <id>
+openwork instance dispose <id>
+```
+
+Use `OPENWORK_DATA_DIR` or `--data-dir` to isolate router state in tests.
+
+## Pairing notes
+
+- Use the **OpenWork connect URL** and **client token** to connect a remote OpenWork client.
+- The OpenWork server advertises the **OpenCode connect URL** plus optional basic auth credentials to the client.
+
+## Approvals (manual mode)
+
+```bash
+openwork approvals list \
+  --openwork-url http://<host>:8787 \
+  --host-token <token>
+
+openwork approvals reply <id> --allow \
+  --openwork-url http://<host>:8787 \
+  --host-token <token>
+```
+
+## Health checks
+
+```bash
+openwork status \
+  --openwork-url http://<host>:8787 \
+  --opencode-url http://<host>:4096
+```
+
+## File sessions (JIT catalog + batch read/write)
+
+Create a short-lived workspace file session and sync files in batches:
+
+```bash
+# Create writable session
+openwork files session create \
+  --openwork-url http://<host>:8787 \
+  --token <client-token> \
+  --workspace-id <workspace-id> \
+  --write \
+  --json
+
+# Fetch catalog snapshot
+openwork files catalog <session-id> \
+  --openwork-url http://<host>:8787 \
+  --token <client-token> \
+  --limit 200 \
+  --json
+
+# Read one or more files
+openwork files read <session-id> \
+  --openwork-url http://<host>:8787 \
+  --token <client-token> \
+  --paths "README.md,notes/todo.md" \
+  --json
+
+# Write a file (inline content or --file)
+openwork files write <session-id> \
+  --openwork-url http://<host>:8787 \
+  --token <client-token> \
+  --path notes/todo.md \
+  --content "hello from openwork" \
+  --json
+
+# Watch change events and close session
+openwork files events <session-id> --openwork-url http://<host>:8787 --token <client-token> --since 0 --json
+openwork files session close <session-id> --openwork-url http://<host>:8787 --token <client-token> --json
+```
+
+## Smoke checks
+
+```bash
+openwork start --workspace /path/to/workspace --check --check-events
+```
+
+This starts the services, verifies health + SSE events, then exits cleanly.
+
+## Local development
+
+Point to source CLIs for fast iteration:
+
+```bash
+openwork start \
+  --workspace /path/to/workspace \
+  --allow-external \
+  --openwork-server-bin apps/server/src/cli.ts \
+  --opencode-router-bin apps/opencode-router/dist/cli.js
+```
diff --git a/apps/orchestrator/bin/openwork b/apps/orchestrator/bin/openwork
new file mode 100755
index 0000000000..b338b5350e
--- /dev/null
+++ b/apps/orchestrator/bin/openwork
@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+const childProcess = require("child_process")
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+function run(target) {
+  const result = childProcess.spawnSync(target, process.argv.slice(2), {
+    stdio: "inherit",
+  })
+  if (result.error) {
+    console.error(result.error.message)
+    process.exit(1)
+  }
+  const code = typeof result.status === "number" ? result.status : 0
+  process.exit(code)
+}
+
+const envPath = process.env.OPENWORK_ORCHESTRATOR_BIN_PATH
+if (envPath) {
+  run(envPath)
+}
+
+const platformMap = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows",
+}
+
+const archMap = {
+  x64: "x64",
+  arm64: "arm64",
+  arm: "arm",
+}
+
+let platform = platformMap[os.platform()]
+if (!platform) {
+  platform = os.platform()
+}
+
+let arch = archMap[os.arch()]
+if (!arch) {
+  arch = os.arch()
+}
+
+const pkg = `openwork-orchestrator-${platform}-${arch}`
+const binary = platform === "windows" ? "openwork.exe" : "openwork"
+const fallback = path.join(__dirname, "..", "dist", "bin", binary)
+
+let pkgJsonPath
+try {
+  pkgJsonPath = require.resolve(`${pkg}/package.json`)
+} catch {
+  if (fs.existsSync(fallback)) {
+    run(fallback)
+  }
+  console.error(
+    `openwork: no prebuilt binary package found for ${platform}/${arch}.\n` +
+      `Try reinstalling openwork-orchestrator or installing the platform package manually: ${pkg}`,
+  )
+  process.exit(1)
+}
+
+const resolved = path.join(path.dirname(pkgJsonPath), "bin", binary)
+run(resolved)
diff --git a/apps/orchestrator/bunfig.toml b/apps/orchestrator/bunfig.toml
new file mode 100644
index 0000000000..7693482f3b
--- /dev/null
+++ b/apps/orchestrator/bunfig.toml
@@ -0,0 +1 @@
+preload = ["@opentui/solid/preload"]
diff --git a/apps/orchestrator/package.json b/apps/orchestrator/package.json
new file mode 100644
index 0000000000..b7ecb39a4d
--- /dev/null
+++ b/apps/orchestrator/package.json
@@ -0,0 +1,65 @@
+{
+  "name": "openwork-orchestrator",
+  "version": "0.13.3",
+  "description": "OpenWork host orchestrator for opencode + OpenWork server + opencode-router",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 bun src/cli.ts",
+    "build": "tsc -p tsconfig.json",
+    "build:bin": "node scripts/clean-dist.mjs && bun ./script/build.ts --outdir dist/bin --filename openwork",
+    "build:bin:all": "node scripts/clean-dist.mjs && bun ./script/build.ts --outdir dist/bin --filename openwork --target bun-darwin-arm64 --target bun-darwin-x64 --target bun-linux-x64 --target bun-linux-arm64 --target bun-windows-x64",
+    "build:bin:bundled": "node scripts/clean-dist.mjs && node ../desktop/scripts/prepare-sidecar.mjs --outdir dist && bun ./script/build.ts --outdir dist --filename openwork && bun scripts/build-bin.ts",
+    "build:sidecars": "node scripts/build-sidecars.mjs",
+    "typecheck": "tsc -p tsconfig.typecheck.json",
+    "test:router": "pnpm build && node scripts/router.mjs",
+    "test:files": "pnpm build && node scripts/files-session.mjs",
+    "prepublishOnly": "node -e \"console.error('openwork-orchestrator is published via apps/orchestrator/scripts/publish-npm.mjs (meta + platform packages)'); process.exit(1);\""
+  },
+  "files": [
+    "dist",
+    "bin",
+    "script",
+    "scripts",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/different-ai/openwork.git",
+    "directory": "apps/orchestrator"
+  },
+  "homepage": "https://github.com/different-ai/openwork/tree/dev/apps/orchestrator",
+  "bugs": {
+    "url": "https://github.com/different-ai/openwork/issues"
+  },
+  "keywords": [
+    "openwork",
+    "opencode",
+    "orchestrator",
+    "cli",
+    "agent"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@opencode-ai/sdk": "^1.4.9",
+    "@opentui/core": "0.1.77",
+    "@opentui/solid": "0.1.77",
+    "opencode-router": "0.13.3",
+    "openwork-server": "0.13.3",
+    "solid-js": "1.9.9"
+  },
+  "devDependencies": {
+    "@opentui/core-darwin-arm64": "0.1.77",
+    "@opentui/core-darwin-x64": "0.1.77",
+    "@opentui/core-linux-arm64": "0.1.77",
+    "@opentui/core-linux-x64": "0.1.77",
+    "@opentui/core-win32-x64": "0.1.77",
+    "@types/node": "^22.10.2",
+    "bun-types": "^1.3.6",
+    "typescript": "^5.6.3"
+  },
+  "packageManager": "pnpm@10.27.0"
+}
diff --git a/apps/orchestrator/script/build.ts b/apps/orchestrator/script/build.ts
new file mode 100644
index 0000000000..58cccd9361
--- /dev/null
+++ b/apps/orchestrator/script/build.ts
@@ -0,0 +1,150 @@
+import { mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import solidPlugin from "../node_modules/@opentui/solid/scripts/solid-plugin";
+
+const bunRuntime = (globalThis as typeof globalThis & {
+  Bun?: {
+    build?: (...args: any[]) => Promise<any>;
+    argv?: string[];
+  };
+}).Bun;
+
+if (!bunRuntime?.build || !bunRuntime.argv) {
+  console.error("This script must be run with Bun.");
+  process.exit(1);
+}
+
+const bun = bunRuntime as { build: (...args: any[]) => Promise<any>; argv: string[] };
+
+type BuildOptions = {
+  targets: string[];
+  outdir: string;
+  filename: string;
+};
+
+function readArgs(argv: string[]): BuildOptions {
+  const options: BuildOptions = {
+    targets: [],
+    outdir: resolve("dist", "bin"),
+    filename: "openwork",
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value) continue;
+
+    if (value === "--target") {
+      const next = argv[index + 1];
+      if (next) {
+        options.targets.push(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--target=")) {
+      const next = value.slice("--target=".length).trim();
+      if (next) options.targets.push(next);
+      continue;
+    }
+
+    if (value === "--outdir") {
+      const next = argv[index + 1];
+      if (next) {
+        options.outdir = resolve(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--outdir=")) {
+      const next = value.slice("--outdir=".length).trim();
+      if (next) options.outdir = resolve(next);
+      continue;
+    }
+
+    if (value === "--filename") {
+      const next = argv[index + 1];
+      if (next) {
+        options.filename = next;
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--filename=")) {
+      const next = value.slice("--filename=".length).trim();
+      if (next) options.filename = next;
+    }
+  }
+
+  return options;
+}
+
+function outputName(filename: string, target?: string) {
+  const needsExe = target ? target.includes("windows") : process.platform === "win32";
+  const suffix = target ? `-${target}` : "";
+  const ext = needsExe ? ".exe" : "";
+  return `${filename}${suffix}${ext}`;
+}
+
+function defaultTarget(): string {
+  const os = process.platform === "win32" ? "windows" : process.platform;
+  return `bun-${os}-${process.arch}`;
+}
+
+async function buildOnce(entrypoint: string, outdir: string, filename: string, target?: string) {
+  mkdirSync(outdir, { recursive: true });
+  const outfile = join(outdir, outputName(filename, target));
+  const define: Record<string, string> = {};
+  const pkgPath = resolve("package.json");
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { version?: string };
+    if (typeof pkg.version === "string" && pkg.version.trim()) {
+      define.__OPENWORK_ORCHESTRATOR_VERSION__ = `\"${pkg.version.trim()}\"`;
+    }
+  } catch {
+    // ignore
+  }
+  try {
+    const constants = JSON.parse(
+      readFileSync(resolve("..", "..", "constants.json"), "utf8"),
+    ) as { opencodeVersion?: string };
+    if (
+      typeof constants.opencodeVersion === "string" &&
+      constants.opencodeVersion.trim()
+    ) {
+      define.__OPENWORK_PINNED_OPENCODE_VERSION__ = `\"${constants.opencodeVersion
+        .trim()
+        .replace(/^v/, "")}\"`;
+    }
+  } catch {
+    // ignore
+  }
+
+  const resolvedTarget = target ?? defaultTarget();
+  const result = await bun.build({
+    tsconfig: "./tsconfig.json",
+    plugins: [solidPlugin],
+    entrypoints: [entrypoint],
+    define,
+    compile: {
+      target: resolvedTarget,
+      outfile,
+    },
+  });
+  if (!result.success) {
+    for (const log of result.logs) {
+      console.error(log);
+    }
+    process.exit(1);
+  }
+}
+
+const options = readArgs(bun.argv.slice(2));
+const entrypoint = resolve("src", "cli.ts");
+const targets = options.targets.length ? options.targets : [undefined];
+
+for (const target of targets) {
+  await buildOnce(entrypoint, options.outdir, options.filename, target);
+}
diff --git a/apps/orchestrator/scripts/build-bin.ts b/apps/orchestrator/scripts/build-bin.ts
new file mode 100644
index 0000000000..798ccade00
--- /dev/null
+++ b/apps/orchestrator/scripts/build-bin.ts
@@ -0,0 +1,48 @@
+import { existsSync } from "node:fs";
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+type VersionInfo = {
+  version: string;
+  sha256: string;
+};
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const repoRoot = resolve(root, "..", "..");
+const targetDir = resolve(root, "dist");
+
+const serverBin = resolve(root, "..", "server", "dist", "bin", "openwork-server");
+const routerRepo = process.env.OPENCODE_ROUTER_DIR?.trim() || resolve(repoRoot, "apps", "opencode-router");
+if (!existsSync(resolve(routerRepo, "package.json"))) {
+  throw new Error("OpenCodeRouter package not found. Expected apps/opencode-router in the monorepo.");
+}
+const routerBin = resolve(routerRepo, "dist", "bin", "opencode-router");
+
+const serverPkg = JSON.parse(
+  await readFile(resolve(root, "..", "server", "package.json"), "utf8"),
+) as { version: string };
+const routerPkg = JSON.parse(await readFile(resolve(routerRepo, "package.json"), "utf8")) as { version: string };
+
+await mkdir(targetDir, { recursive: true });
+await copyFile(serverBin, resolve(targetDir, "openwork-server"));
+await copyFile(routerBin, resolve(targetDir, "opencode-router"));
+
+const sha256 = async (path: string) => {
+  const data = await readFile(path);
+  return createHash("sha256").update(data).digest("hex");
+};
+
+const versions = {
+  "openwork-server": {
+    version: serverPkg.version,
+    sha256: await sha256(resolve(targetDir, "openwork-server")),
+  },
+  "opencode-router": {
+    version: routerPkg.version,
+    sha256: await sha256(resolve(targetDir, "opencode-router")),
+  },
+} as Record<string, VersionInfo>;
+
+await writeFile(resolve(targetDir, "versions.json"), `${JSON.stringify(versions, null, 2)}\n`, "utf8");
diff --git a/apps/orchestrator/scripts/build-opencode-router.mjs b/apps/orchestrator/scripts/build-opencode-router.mjs
new file mode 100644
index 0000000000..bb09baf0e1
--- /dev/null
+++ b/apps/orchestrator/scripts/build-opencode-router.mjs
@@ -0,0 +1,39 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const repoRoot = resolve(root, "..", "..");
+
+function resolveOpencodeRouterRepo() {
+  const envPath = process.env.OPENCODE_ROUTER_DIR?.trim();
+  const candidates = [envPath, resolve(repoRoot, "apps", "opencode-router")].filter(Boolean);
+
+  for (const candidate of candidates) {
+    if (candidate && existsSync(resolve(candidate, "package.json"))) {
+      return candidate;
+    }
+  }
+
+  throw new Error("OpenCodeRouter package not found. Expected apps/opencode-router in the monorepo.");
+}
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+const routerRepo = resolveOpencodeRouterRepo();
+run("pnpm", ["install"], repoRoot);
+const pkg = JSON.parse(readFileSync(resolve(routerRepo, "package.json"), "utf8"));
+const scripts = pkg?.scripts ?? {};
+if (scripts["build:bin"]) {
+  run("pnpm", ["--filter", "opencode-router", "build:bin"], repoRoot);
+} else if (scripts["build:binary"]) {
+  run("pnpm", ["--filter", "opencode-router", "build:binary"], repoRoot);
+} else {
+  run("bun", ["build", "--compile", "src/cli.ts", "--outfile", "dist/bin/opencode-router"], routerRepo);
+}
diff --git a/apps/orchestrator/scripts/build-sidecars.mjs b/apps/orchestrator/scripts/build-sidecars.mjs
new file mode 100644
index 0000000000..85e065cbf1
--- /dev/null
+++ b/apps/orchestrator/scripts/build-sidecars.mjs
@@ -0,0 +1,129 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const repoRoot = resolve(root, "..", "..");
+const outdir = resolve(root, "dist", "sidecars");
+
+const orchestratorPkg = JSON.parse(
+  readFileSync(resolve(root, "package.json"), "utf8"),
+);
+const orchestratorVersion = String(orchestratorPkg.version ?? "").trim();
+if (!orchestratorVersion) {
+  throw new Error(
+    "openwork-orchestrator version missing in apps/orchestrator/package.json",
+  );
+}
+
+const sourceDateEpoch = process.env.SOURCE_DATE_EPOCH
+  ? Number(process.env.SOURCE_DATE_EPOCH)
+  : null;
+const generatedAt = Number.isFinite(sourceDateEpoch)
+  ? new Date(sourceDateEpoch * 1000).toISOString()
+  : new Date().toISOString();
+
+const serverPkg = JSON.parse(
+  readFileSync(resolve(repoRoot, "apps", "server", "package.json"), "utf8"),
+);
+const serverVersion = String(serverPkg.version ?? "").trim();
+if (!serverVersion) {
+  throw new Error(
+    "openwork-server version missing in apps/server/package.json",
+  );
+}
+
+const routerPkg = JSON.parse(
+  readFileSync(
+    resolve(repoRoot, "apps", "opencode-router", "package.json"),
+    "utf8",
+  ),
+);
+const routerVersion = String(routerPkg.version ?? "").trim();
+if (!routerVersion) {
+  throw new Error(
+    "opencode-router version missing in apps/opencode-router/package.json",
+  );
+}
+
+const run = (command, args, cwd) => {
+  const result = spawnSync(command, args, { cwd, stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+};
+
+run("pnpm", ["--filter", "openwork-server", "build:bin:all"], repoRoot);
+run("pnpm", ["--filter", "opencode-router", "build:bin:all"], repoRoot);
+
+const targets = [
+  { id: "darwin-arm64", bun: "bun-darwin-arm64" },
+  { id: "darwin-x64", bun: "bun-darwin-x64" },
+  { id: "linux-x64", bun: "bun-linux-x64" },
+  { id: "linux-arm64", bun: "bun-linux-arm64" },
+  { id: "windows-x64", bun: "bun-windows-x64" },
+];
+
+const sha256File = (path) => {
+  const data = readFileSync(path);
+  return createHash("sha256").update(data).digest("hex");
+};
+
+const serverDir = resolve(repoRoot, "apps", "server", "dist", "bin");
+const routerDir = resolve(repoRoot, "apps", "opencode-router", "dist", "bin");
+
+mkdirSync(outdir, { recursive: true });
+
+const entries = {
+  "openwork-server": { version: serverVersion, targets: {} },
+  "opencode-router": { version: routerVersion, targets: {} },
+};
+
+for (const target of targets) {
+  const ext = target.id.startsWith("windows") ? ".exe" : "";
+  const serverSrc = join(serverDir, `openwork-server-${target.bun}${ext}`);
+  if (!existsSync(serverSrc)) {
+    throw new Error(`Missing openwork-server binary at ${serverSrc}`);
+  }
+  const serverDest = join(outdir, `openwork-server-${target.id}${ext}`);
+  copyFileSync(serverSrc, serverDest);
+
+  const routerSrc = join(routerDir, `opencode-router-${target.bun}${ext}`);
+  if (!existsSync(routerSrc)) {
+    throw new Error(`Missing opencode-router binary at ${routerSrc}`);
+  }
+  const routerDest = join(outdir, `opencode-router-${target.id}${ext}`);
+  copyFileSync(routerSrc, routerDest);
+
+  entries["openwork-server"].targets[target.id] = {
+    asset: basename(serverDest),
+    sha256: sha256File(serverDest),
+    size: statSync(serverDest).size,
+  };
+  entries["opencode-router"].targets[target.id] = {
+    asset: basename(routerDest),
+    sha256: sha256File(routerDest),
+    size: statSync(routerDest).size,
+  };
+}
+
+const manifest = {
+  version: orchestratorVersion,
+  generatedAt,
+  entries,
+};
+
+writeFileSync(
+  join(outdir, "openwork-orchestrator-sidecars.json"),
+  `${JSON.stringify(manifest, null, 2)}\n`,
+  "utf8",
+);
diff --git a/apps/orchestrator/scripts/clean-dist.mjs b/apps/orchestrator/scripts/clean-dist.mjs
new file mode 100644
index 0000000000..1754df0b48
--- /dev/null
+++ b/apps/orchestrator/scripts/clean-dist.mjs
@@ -0,0 +1,6 @@
+import { rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+await rm(resolve(root, "dist"), { recursive: true, force: true });
diff --git a/apps/orchestrator/scripts/files-session.mjs b/apps/orchestrator/scripts/files-session.mjs
new file mode 100644
index 0000000000..bd5b66e70c
--- /dev/null
+++ b/apps/orchestrator/scripts/files-session.mjs
@@ -0,0 +1,312 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const cliPath = resolve(__dirname, "..", "dist", "cli.js");
+const serverCliPath = resolve(__dirname, "..", "..", "server", "src", "cli.ts");
+
+async function findFreePort() {
+  return new Promise((resolvePort, reject) => {
+    const server = createServer();
+    server.unref();
+    server.once("error", (error) => reject(error));
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close();
+        reject(new Error("Failed to allocate free port"));
+        return;
+      }
+      server.close(() => resolvePort(address.port));
+    });
+  });
+}
+
+async function waitFor(url, timeoutMs = 10_000, pollMs = 200) {
+  const start = Date.now();
+  let lastError;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) return;
+      lastError = new Error(`HTTP ${response.status}`);
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, pollMs));
+  }
+  throw lastError ?? new Error("Timed out waiting for endpoint");
+}
+
+async function fetchJson(url, init) {
+  const response = await fetch(url, init);
+  let payload = null;
+  try {
+    payload = await response.json();
+  } catch {
+    payload = null;
+  }
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}${payload?.message ? ` ${payload.message}` : ""}`);
+  }
+  return payload;
+}
+
+async function runCli(args) {
+  const child = spawn("node", [cliPath, ...args], { stdio: ["ignore", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk;
+  });
+
+  const [code] = await once(child, "exit");
+  if (code !== 0) {
+    throw new Error(stderr.trim() || `openwork CLI failed with code ${code}`);
+  }
+
+  const trimmed = stdout.trim();
+  return trimmed ? JSON.parse(trimmed) : null;
+}
+
+const root = await mkdtemp(join(tmpdir(), "openwork-file-session-"));
+const workspace = join(root, "workspace");
+await mkdir(join(workspace, "notes"), { recursive: true });
+await writeFile(join(workspace, "notes", "remote.md"), "hello from remote\n", "utf8");
+
+const port = await findFreePort();
+const token = "test-client-token";
+const hostToken = "test-host-token";
+const openworkUrl = `http://127.0.0.1:${port}`;
+
+const server = spawn(
+  "bun",
+  [
+    serverCliPath,
+    "--host",
+    "127.0.0.1",
+    "--port",
+    String(port),
+    "--workspace",
+    workspace,
+    "--approval",
+    "auto",
+    "--token",
+    token,
+    "--host-token",
+    hostToken,
+  ],
+  { stdio: ["ignore", "pipe", "pipe"] },
+);
+
+let serverStderr = "";
+server.stderr.setEncoding("utf8");
+server.stderr.on("data", (chunk) => {
+  serverStderr += chunk;
+});
+
+try {
+  await waitFor(`${openworkUrl}/health`);
+
+  const workspaces = await fetchJson(`${openworkUrl}/workspaces`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  const workspaceId = workspaces?.items?.[0]?.id;
+  assert.ok(workspaceId, "workspace id should be available");
+
+  const created = await runCli([
+    "files",
+    "session",
+    "create",
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--workspace-id",
+    workspaceId,
+    "--write",
+    "--json",
+  ]);
+  const sessionId = created?.session?.id;
+  assert.ok(sessionId, "session id should be created");
+  assert.equal(created.session.workspaceId, workspaceId);
+  assert.equal(created.session.canWrite, true);
+
+  const snapshot = await runCli([
+    "files",
+    "catalog",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--json",
+  ]);
+  const catalogItem = snapshot.items.find((item) => item.path === "notes/remote.md");
+  assert.ok(catalogItem, "catalog should include notes/remote.md");
+
+  const firstRead = await runCli([
+    "files",
+    "read",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--path",
+    "notes/remote.md",
+    "--json",
+  ]);
+  assert.equal(firstRead.items[0].ok, true);
+  const firstRevision = firstRead.items[0].revision;
+  const firstContent = Buffer.from(firstRead.items[0].contentBase64, "base64").toString("utf8");
+  assert.equal(firstContent, "hello from remote\n");
+
+  const wrote = await runCli([
+    "files",
+    "write",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--path",
+    "notes/remote.md",
+    "--content",
+    "updated by openwork cli\n",
+    "--if-match",
+    firstRevision,
+    "--json",
+  ]);
+  assert.equal(wrote.items[0].ok, true);
+  const updatedRevision = wrote.items[0].revision;
+
+  const diskContent = await readFile(join(workspace, "notes", "remote.md"), "utf8");
+  assert.equal(diskContent, "updated by openwork cli\n");
+
+  await writeFile(join(workspace, "notes", "remote.md"), "changed outside session\n", "utf8");
+  const staleWrite = await runCli([
+    "files",
+    "write",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--path",
+    "notes/remote.md",
+    "--content",
+    "should conflict\n",
+    "--if-match",
+    updatedRevision,
+    "--json",
+  ]);
+  assert.equal(staleWrite.items[0].ok, false);
+  assert.equal(staleWrite.items[0].code, "conflict");
+
+  const mkdirResult = await runCli([
+    "files",
+    "mkdir",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--path",
+    "notes/archive",
+    "--json",
+  ]);
+  assert.equal(mkdirResult.items[0].ok, true);
+
+  const renameResult = await runCli([
+    "files",
+    "rename",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--from",
+    "notes/remote.md",
+    "--to",
+    "notes/archive/remote.md",
+    "--json",
+  ]);
+  assert.equal(renameResult.items[0].ok, true);
+
+  const deleteResult = await runCli([
+    "files",
+    "delete",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--path",
+    "notes/archive/remote.md",
+    "--json",
+  ]);
+  assert.equal(deleteResult.items[0].ok, true);
+
+  const events = await runCli([
+    "files",
+    "events",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--since",
+    "0",
+    "--json",
+  ]);
+  const eventTypes = new Set(events.items.map((item) => item.type));
+  assert.ok(eventTypes.has("write"), "events should include write");
+  assert.ok(eventTypes.has("rename"), "events should include rename");
+  assert.ok(eventTypes.has("delete"), "events should include delete");
+
+  const closed = await runCli([
+    "files",
+    "session",
+    "close",
+    sessionId,
+    "--openwork-url",
+    openworkUrl,
+    "--token",
+    token,
+    "--json",
+  ]);
+  assert.equal(closed.ok, true);
+
+  console.log(JSON.stringify({ ok: true, openworkUrl, workspaceId, sessionId }, null, 2));
+} catch (error) {
+  console.error(
+    JSON.stringify(
+      {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+        stderr: serverStderr.trim() || undefined,
+      },
+      null,
+      2,
+    ),
+  );
+  process.exitCode = 1;
+} finally {
+  if (server.exitCode === null) {
+    server.kill("SIGTERM");
+    await Promise.race([once(server, "exit"), new Promise((resolveDelay) => setTimeout(resolveDelay, 3000))]);
+  }
+  await rm(root, { recursive: true, force: true });
+}
diff --git a/apps/orchestrator/scripts/postinstall.mjs b/apps/orchestrator/scripts/postinstall.mjs
new file mode 100755
index 0000000000..a2ee712b5b
--- /dev/null
+++ b/apps/orchestrator/scripts/postinstall.mjs
@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import os from "os"
+import { createRequire } from "module"
+import { fileURLToPath } from "node:url"
+
+const require = createRequire(import.meta.url)
+const rootDir = dirname(fileURLToPath(import.meta.url))
+
+function detect() {
+  const platformMap = {
+    darwin: "darwin",
+    linux: "linux",
+    win32: "windows",
+  }
+  const archMap = {
+    x64: "x64",
+    arm64: "arm64",
+    arm: "arm",
+  }
+
+  const platform = platformMap[os.platform()] || os.platform()
+  const arch = archMap[os.arch()] || os.arch()
+  return { platform, arch }
+}
+
+function packageName() {
+  const { platform, arch } = detect()
+  return `openwork-orchestrator-${platform}-${arch}`
+}
+
+function binaryName() {
+  const { platform } = detect()
+  return platform === "windows" ? "openwork.exe" : "openwork"
+}
+
+function fallbackAssetName() {
+  const { platform, arch } = detect()
+  return `openwork-bun-${platform}-${arch}${platform === "windows" ? ".exe" : ""}`
+}
+
+function fallbackBinaryPath() {
+  return join(rootDir, "dist", "bin", binaryName())
+}
+
+function readOwnVersion() {
+  const pkg = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"))
+  const version = String(pkg.version || "").trim()
+  if (!version) {
+    throw new Error("openwork-orchestrator: package version is missing")
+  }
+  return version
+}
+
+function resolveFallbackBaseUrl(version) {
+  const override = String(process.env.OPENWORK_ORCHESTRATOR_DOWNLOAD_BASE_URL || "").trim()
+  if (override) {
+    return override.replace(/\/$/, "")
+  }
+  return `https://github.com/different-ai/openwork/releases/download/openwork-orchestrator-v${version}`
+}
+
+async function downloadFallbackBinary() {
+  const version = readOwnVersion()
+  const asset = fallbackAssetName()
+  const url = `${resolveFallbackBaseUrl(version)}/${asset}`
+  const destination = fallbackBinaryPath()
+
+  console.log(`openwork-orchestrator: downloading fallback binary ${asset}`)
+  const response = await fetch(url)
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status} ${response.statusText}) from ${url}`)
+  }
+
+  const buffer = Buffer.from(await response.arrayBuffer())
+  mkdirSync(dirname(destination), { recursive: true })
+  writeFileSync(destination, buffer)
+  if (binaryName() !== "openwork.exe") {
+    chmodSync(destination, 0o755)
+  }
+
+  console.log(`openwork-orchestrator: installed fallback binary at ${destination}`)
+}
+
+async function main() {
+  try {
+    const pkg = packageName()
+    require.resolve(`${pkg}/package.json`)
+    console.log(`openwork-orchestrator: verified platform package: ${pkg}`)
+    return
+  } catch {
+    if (existsSync(fallbackBinaryPath())) {
+      console.log(`openwork-orchestrator: using existing fallback binary at ${fallbackBinaryPath()}`)
+      return
+    }
+  }
+
+  try {
+    await downloadFallbackBinary()
+  } catch (error) {
+    const pkg = packageName()
+    const message = error instanceof Error ? error.message : String(error)
+    console.error(
+      `openwork-orchestrator: failed to locate platform binary package (${pkg}).\n` +
+        `Your package manager may have skipped optionalDependencies, or the package asset is unavailable.\n` +
+        `Fallback download failed: ${message}\n` +
+        `Try installing it manually: npm i -g ${pkg}`,
+    )
+    process.exit(1)
+  }
+}
+
+await main()
diff --git a/apps/orchestrator/scripts/publish-npm.mjs b/apps/orchestrator/scripts/publish-npm.mjs
new file mode 100755
index 0000000000..5c5910170f
--- /dev/null
+++ b/apps/orchestrator/scripts/publish-npm.mjs
@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process"
+import { existsSync } from "node:fs"
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync, copyFileSync } from "node:fs"
+import { basename, dirname, join, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)))
+
+const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"))
+const version = String(pkg.version || "").trim()
+if (!version) {
+  throw new Error("openwork-orchestrator version missing in apps/orchestrator/package.json")
+}
+
+const outroot = join(root, "dist", "npm")
+rmSync(outroot, { recursive: true, force: true })
+mkdirSync(outroot, { recursive: true })
+const constantsSrc = resolve(root, "..", "..", "constants.json")
+if (!existsSync(constantsSrc)) {
+  throw new Error(`Missing constants.json at ${constantsSrc}`)
+}
+
+const tag = String(process.env.NPM_TAG || "").trim()
+const dry = String(process.env.DRY_RUN || "").trim() === "1"
+
+const targets = [
+  { id: "darwin-arm64", bun: "bun-darwin-arm64", os: "darwin", cpu: "arm64" },
+  { id: "darwin-x64", bun: "bun-darwin-x64", os: "darwin", cpu: "x64" },
+  { id: "linux-x64", bun: "bun-linux-x64", os: "linux", cpu: "x64" },
+  { id: "linux-arm64", bun: "bun-linux-arm64", os: "linux", cpu: "arm64" },
+  { id: "windows-x64", bun: "bun-windows-x64", os: "win32", cpu: "x64" },
+]
+
+function run(cmd, args, cwd) {
+  const res = spawnSync(cmd, args, { cwd, stdio: "inherit" })
+  if (res.status !== 0) {
+    process.exit(res.status ?? 1)
+  }
+}
+
+function packageVersionExists(name) {
+  const res = spawnSync("npm", ["view", `${name}@${version}`, "version"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+  })
+  return res.status === 0 && res.stdout.trim() === version
+}
+
+function writeJson(filepath, data) {
+  writeFileSync(filepath, `${JSON.stringify(data, null, 2)}\n`, "utf8")
+}
+
+function platformPkgName(target) {
+  const platform = target.id.split("-")[0]
+  const arch = target.id.split("-").slice(1).join("-")
+  return `openwork-orchestrator-${platform}-${arch}`
+}
+
+const optionalDependencies = {}
+const published = []
+
+for (const target of targets) {
+  const name = platformPkgName(target)
+  optionalDependencies[name] = version
+
+  const ext = target.id.startsWith("windows") ? ".exe" : ""
+  const src = join(root, "dist", "bin", `openwork-${target.bun}${ext}`)
+  if (!existsSync(src)) {
+    throw new Error(`Missing openwork binary at ${src}. Run: pnpm --filter openwork-orchestrator build:bin:all`)
+  }
+
+  const dir = join(outroot, name)
+  const bindir = join(dir, "bin")
+  mkdirSync(bindir, { recursive: true })
+
+  const dest = join(bindir, `openwork${ext}`)
+  copyFileSync(src, dest)
+  if (!target.id.startsWith("windows")) {
+    chmodSync(dest, 0o755)
+  }
+
+  writeJson(join(dir, "package.json"), {
+    name,
+    version,
+    description: "Platform binary for openwork-orchestrator",
+    license: "MIT",
+    os: [target.os],
+    cpu: [target.cpu],
+    bin: {
+      openwork: `./bin/openwork${ext}`,
+      "openwork-orchestrator": `./bin/openwork${ext}`,
+    },
+    files: ["bin"],
+  })
+
+  published.push({ name, dir })
+}
+
+const meta = join(outroot, "openwork-orchestrator")
+mkdirSync(join(meta, "bin"), { recursive: true })
+
+const wrapperSrc = join(root, "bin", "openwork")
+if (!existsSync(wrapperSrc)) {
+  throw new Error(`Missing wrapper at ${wrapperSrc}`)
+}
+copyFileSync(wrapperSrc, join(meta, "bin", "openwork"))
+chmodSync(join(meta, "bin", "openwork"), 0o755)
+
+const postinstallSrc = join(root, "scripts", "postinstall.mjs")
+if (!existsSync(postinstallSrc)) {
+  throw new Error(`Missing postinstall at ${postinstallSrc}`)
+}
+copyFileSync(postinstallSrc, join(meta, basename(postinstallSrc)))
+copyFileSync(constantsSrc, join(meta, "constants.json"))
+
+writeJson(join(meta, "package.json"), {
+  name: "openwork-orchestrator",
+  version,
+  description: "OpenWork host orchestrator for opencode + OpenWork server + opencode-router",
+  license: "MIT",
+  bin: {
+    openwork: "./bin/openwork",
+    "openwork-orchestrator": "./bin/openwork",
+  },
+  scripts: {
+    postinstall: "node ./postinstall.mjs",
+  },
+  optionalDependencies,
+  files: ["bin", "postinstall.mjs", "constants.json"],
+})
+
+published.push({ name: "openwork-orchestrator", dir: meta })
+
+for (const item of published) {
+  if (dry) {
+    console.log(`Packing (dry run) ${item.name} from ${item.dir}`)
+    run("npm", ["pack"], item.dir)
+    continue
+  }
+
+  const args = ["publish", "--access", "public"]
+  if (tag) args.push("--tag", tag)
+  if (packageVersionExists(item.name)) {
+    console.log(`Skipping ${item.name}@${version}; already published`)
+    continue
+  }
+  console.log(`Publishing ${item.name} from ${item.dir}`)
+  run("npm", args, item.dir)
+}
diff --git a/apps/orchestrator/scripts/router.mjs b/apps/orchestrator/scripts/router.mjs
new file mode 100644
index 0000000000..4112f45309
--- /dev/null
+++ b/apps/orchestrator/scripts/router.mjs
@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { mkdtemp, mkdir, realpath, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const cliPath = resolve(__dirname, "..", "dist", "cli.js");
+
+async function findFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.unref();
+    server.once("error", (err) => reject(err));
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close();
+        reject(new Error("Failed to allocate free port"));
+        return;
+      }
+      const port = address.port;
+      server.close(() => resolve(port));
+    });
+  });
+}
+
+async function waitFor(url, timeoutMs = 10_000, pollMs = 250) {
+  const start = Date.now();
+  let lastError;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) return;
+      lastError = new Error(`HTTP ${response.status}`);
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw lastError ?? new Error("Timed out waiting for daemon");
+}
+
+async function runCli(args, dataDir) {
+  const child = spawn("node", [cliPath, ...args], {
+    env: {
+      ...process.env,
+      OPENWORK_DATA_DIR: dataDir,
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  let stdout = "";
+  let stderr = "";
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk;
+  });
+
+  const [code] = await once(child, "exit");
+  if (code !== 0) {
+    throw new Error(stderr.trim() || `openwork failed with code ${code}`);
+  }
+  const trimmed = stdout.trim();
+  return trimmed ? JSON.parse(trimmed) : null;
+}
+
+async function canonicalPath(input) {
+  try {
+    return await realpath(input);
+  } catch {
+    return resolve(input);
+  }
+}
+
+const root = await mkdtemp(join(tmpdir(), "openwork-orchestrator-router-"));
+const dataDir = join(root, "data");
+const workspaceA = join(root, "ws-a");
+const workspaceB = join(root, "ws-b");
+await mkdir(workspaceA, { recursive: true });
+await mkdir(workspaceB, { recursive: true });
+
+const daemonPort = await findFreePort();
+const opencodePort = await findFreePort();
+const daemonUrl = `http://127.0.0.1:${daemonPort}`;
+
+const daemon = spawn(
+  "node",
+  [
+    cliPath,
+    "daemon",
+    "run",
+    "--data-dir",
+    dataDir,
+    "--daemon-host",
+    "127.0.0.1",
+    "--daemon-port",
+    String(daemonPort),
+    "--opencode-port",
+    String(opencodePort),
+  ],
+  {
+    env: {
+      ...process.env,
+      OPENWORK_DATA_DIR: dataDir,
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+  },
+);
+
+try {
+  await waitFor(`${daemonUrl}/health`);
+
+  const addedA = await runCli(["workspace", "add", workspaceA, "--json"], dataDir);
+  const addedB = await runCli(["workspace", "add", workspaceB, "--json"], dataDir);
+  const idA = addedA.workspace.id;
+  const idB = addedB.workspace.id;
+
+  const status1 = await runCli(["daemon", "status", "--json"], dataDir);
+  const pid1 = status1.opencode.pid;
+
+  const pathA = await runCli(["workspace", "path", idA, "--json"], dataDir);
+  const pathB = await runCli(["workspace", "path", idB, "--json"], dataDir);
+
+  assert.equal(await canonicalPath(pathA.path.directory), await canonicalPath(workspaceA));
+  assert.equal(await canonicalPath(pathB.path.directory), await canonicalPath(workspaceB));
+
+  const status2 = await runCli(["daemon", "status", "--json"], dataDir);
+  const pid2 = status2.opencode.pid;
+  assert.equal(pid1, pid2);
+
+  const disposed = await runCli(["instance", "dispose", idA, "--json"], dataDir);
+  assert.equal(disposed.disposed, true);
+
+  const pathA2 = await runCli(["workspace", "path", idA, "--json"], dataDir);
+  assert.equal(await canonicalPath(pathA2.path.directory), await canonicalPath(workspaceA));
+
+  await runCli(["daemon", "stop", "--json"], dataDir);
+  await Promise.race([once(daemon, "exit"), new Promise((resolve) => setTimeout(resolve, 3000))]);
+
+  console.log(JSON.stringify({ ok: true, dataDir, daemonUrl, workspaces: [idA, idB] }, null, 2));
+} catch (error) {
+  console.error(
+    JSON.stringify(
+      { ok: false, error: error instanceof Error ? error.message : String(error), daemonUrl },
+      null,
+      2,
+    ),
+  );
+  process.exitCode = 1;
+  try {
+    await runCli(["daemon", "stop", "--json"], dataDir);
+  } catch {
+    // ignore
+  }
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
diff --git a/apps/orchestrator/src/cli.ts b/apps/orchestrator/src/cli.ts
new file mode 100644
index 0000000000..e7b549517f
--- /dev/null
+++ b/apps/orchestrator/src/cli.ts
@@ -0,0 +1,8761 @@
+#!/usr/bin/env node
+import {
+  spawn,
+  type ChildProcess,
+  type SpawnOptions,
+} from "node:child_process";
+import { randomBytes, randomUUID, createHash } from "node:crypto";
+import {
+  chmod,
+  copyFile,
+  cp,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  stat,
+  writeFile,
+  realpath,
+} from "node:fs/promises";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { createServer as createNetServer } from "node:net";
+import { createServer as createHttpServer } from "node:http";
+import { homedir, hostname, networkInterfaces, platform, tmpdir } from "node:os";
+import {
+  basename,
+  delimiter,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep,
+} from "node:path";
+import { fileURLToPath } from "node:url";
+import { access } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { once } from "node:events";
+
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+import type { TuiHandle } from "./tui/app.js";
+
+type ApprovalMode = "manual" | "auto";
+
+type SandboxMode = "none" | "auto" | "docker" | "container";
+
+type ResolvedSandboxMode = "none" | "docker" | "container";
+
+type LogFormat = "pretty" | "json";
+
+type LogLevel = "debug" | "info" | "warn" | "error";
+
+type LogAttributes = Record<string, unknown>;
+
+type LoggerChild = {
+  log: (level: LogLevel, message: string, attributes?: LogAttributes) => void;
+  debug: (message: string, attributes?: LogAttributes) => void;
+  info: (message: string, attributes?: LogAttributes) => void;
+  warn: (message: string, attributes?: LogAttributes) => void;
+  error: (message: string, attributes?: LogAttributes) => void;
+};
+
+type Logger = {
+  format: LogFormat;
+  output: "stdout" | "silent";
+  log: (
+    level: LogLevel,
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => void;
+  debug: (
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => void;
+  info: (
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => void;
+  warn: (
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => void;
+  error: (
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => void;
+  child: (component: string, attributes?: LogAttributes) => LoggerChild;
+};
+
+type LogEvent = {
+  time: number;
+  level: LogLevel;
+  message: string;
+  component?: string;
+  attributes?: LogAttributes;
+};
+
+type OpencodeHotReload = {
+  enabled: boolean;
+  debounceMs: number;
+  cooldownMs: number;
+};
+
+type OpenCodeRouterHealthSnapshot = {
+  ok: boolean;
+  opencode: {
+    url: string;
+    healthy: boolean;
+    version?: string;
+  };
+  channels: {
+    telegram: boolean;
+    whatsapp: boolean;
+    slack: boolean;
+  };
+  config: {
+    groupsEnabled: boolean;
+  };
+};
+
+const FALLBACK_VERSION = "0.1.0";
+
+declare const __OPENWORK_ORCHESTRATOR_VERSION__: string | undefined;
+declare const __OPENWORK_PINNED_OPENCODE_VERSION__: string | undefined;
+const DEFAULT_OPENWORK_PORT = 8787;
+const DEFAULT_APPROVAL_TIMEOUT = 30000;
+const MANAGED_OPENCODE_CREDENTIAL_LENGTH = 512;
+const INTERNAL_OPENCODE_CREDENTIALS_ENV =
+  "OPENWORK_INTERNAL_ALLOW_OPENCODE_CREDENTIALS";
+const DEFAULT_OPENCODE_HOT_RELOAD_DEBOUNCE_MS = 700;
+const DEFAULT_OPENCODE_HOT_RELOAD_COOLDOWN_MS = 1500;
+const DEFAULT_ACTIVITY_WINDOW_MS = 5 * 60_000;
+const DEFAULT_ACTIVITY_HEARTBEAT_INTERVAL_MS = 5 * 60_000;
+
+const SANDBOX_INTERNAL_OPENCODE_PORT = 4096;
+const SANDBOX_INTERNAL_OPENWORK_PORT = DEFAULT_OPENWORK_PORT;
+// OpenCodeRouter defaults its health server to 3005 when not overridden. In sandbox
+// mode we keep the *internal* port stable and only vary the published host
+// port to avoid collisions.
+const SANDBOX_INTERNAL_OPENCODE_ROUTER_HEALTH_PORT = 3005;
+const OPENWORK_DEV_DATA_DIR = "openwork-dev-data";
+
+const SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH =
+  "/persist/.config/opencode";
+const SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH =
+  "/persist/.openwork-host-opencode-data";
+const CLI_SOURCE_DIR = dirname(fileURLToPath(import.meta.url));
+const ORCHESTRATOR_ROOT_DIR = resolve(CLI_SOURCE_DIR, "..");
+const REPO_ROOT_DIR = resolve(ORCHESTRATOR_ROOT_DIR, "..", "..");
+
+type ParsedArgs = {
+  positionals: string[];
+  flags: Map<string, string | boolean>;
+};
+
+type ChildHandle = {
+  name: string;
+  child: ReturnType<typeof spawn>;
+};
+
+type VersionInfo = {
+  version: string;
+  sha256: string;
+};
+
+type SidecarName = "openwork-server" | "opencode-router" | "opencode";
+
+type SidecarTarget =
+  | "darwin-arm64"
+  | "darwin-x64"
+  | "linux-x64"
+  | "linux-arm64"
+  | "windows-x64"
+  | "windows-arm64";
+
+type VersionManifest = {
+  dir: string;
+  entries: Record<string, VersionInfo>;
+};
+
+type RemoteSidecarAsset = {
+  asset?: string;
+  url?: string;
+  sha256?: string;
+  size?: number;
+};
+
+type RemoteSidecarEntry = {
+  version: string;
+  targets: Record<string, RemoteSidecarAsset>;
+};
+
+type RemoteSidecarManifest = {
+  version: string;
+  generatedAt?: string;
+  entries: Record<string, RemoteSidecarEntry>;
+};
+
+type SidecarConfig = {
+  dir: string;
+  baseUrl: string;
+  manifestUrl: string;
+  target: SidecarTarget | null;
+};
+
+type BinarySource = "bundled" | "external" | "downloaded";
+
+type BinarySourcePreference = "auto" | "bundled" | "downloaded" | "external";
+
+type ResolvedBinary = {
+  bin: string;
+  source: BinarySource;
+  expectedVersion?: string;
+};
+
+type BinaryDiagnostics = {
+  path: string;
+  source: BinarySource;
+  expectedVersion?: string;
+  actualVersion?: string;
+};
+
+type RuntimeServiceName = "openwork-server" | "opencode" | "opencode-router";
+
+type RuntimeServiceSnapshot = {
+  name: RuntimeServiceName;
+  enabled: boolean;
+  running: boolean;
+  source?: BinarySource;
+  path?: string;
+  targetVersion?: string;
+  actualVersion?: string;
+  upgradeAvailable: boolean;
+};
+
+type RuntimeUpgradeState = {
+  status: "idle" | "running" | "failed";
+  startedAt: number | null;
+  finishedAt: number | null;
+  error: string | null;
+  operationId: string | null;
+  services: RuntimeServiceName[];
+};
+
+type SidecarDiagnostics = {
+  dir: string;
+  baseUrl: string;
+  manifestUrl: string;
+  target: SidecarTarget | null;
+  source: BinarySourcePreference;
+  opencodeSource: BinarySourcePreference;
+  allowExternal: boolean;
+};
+
+type WorkerActivityHeartbeatConfig = {
+  enabled: boolean;
+  workerId: string;
+  url: string;
+  token: string;
+  intervalMs: number;
+  activeWindowMs: number;
+};
+
+type RouterWorkspaceType = "local" | "remote";
+
+type RouterWorkspace = {
+  id: string;
+  name: string;
+  path: string;
+  workspaceType: RouterWorkspaceType;
+  baseUrl?: string;
+  directory?: string;
+  createdAt: number;
+  lastUsedAt?: number;
+};
+
+type RouterDaemonState = {
+  pid: number;
+  port: number;
+  baseUrl: string;
+  startedAt: number;
+};
+
+type RouterOpencodeState = {
+  pid: number;
+  port: number;
+  baseUrl: string;
+  startedAt: number;
+};
+
+type RouterBinaryInfo = {
+  path: string;
+  source: BinarySource;
+  expectedVersion?: string;
+  actualVersion?: string;
+};
+
+type RouterBinaryState = {
+  opencode?: RouterBinaryInfo;
+};
+
+type RouterSidecarState = {
+  dir: string;
+  baseUrl: string;
+  manifestUrl: string;
+  target: SidecarTarget | null;
+  source: BinarySourcePreference;
+  opencodeSource: BinarySourcePreference;
+  allowExternal: boolean;
+};
+
+type RouterState = {
+  version: number;
+  daemon?: RouterDaemonState;
+  opencode?: RouterOpencodeState;
+  cliVersion?: string;
+  sidecar?: RouterSidecarState;
+  binaries?: RouterBinaryState;
+  activeId: string;
+  workspaces: RouterWorkspace[];
+};
+
+type OpencodeStateLayout = {
+  devMode: boolean;
+  rootDir: string;
+  configDir: string;
+  env: NodeJS.ProcessEnv;
+  importConfigDir?: string;
+  importDataDir?: string;
+};
+
+type FieldsResult<T> = {
+  data?: T;
+  error?: unknown;
+  request?: Request;
+  response?: Response;
+};
+
+function parseArgs(argv: string[]): ParsedArgs {
+  const flags = new Map<string, string | boolean>();
+  const positionals: string[] = [];
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (!arg) continue;
+    if (arg === "-h") {
+      flags.set("help", true);
+      continue;
+    }
+    if (arg === "-v") {
+      flags.set("version", true);
+      continue;
+    }
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+
+    const trimmed = arg.slice(2);
+    if (!trimmed) continue;
+
+    if (trimmed.startsWith("no-")) {
+      flags.set(trimmed.slice(3), false);
+      continue;
+    }
+
+    const [key, inlineValue] = trimmed.split("=");
+    if (inlineValue !== undefined) {
+      flags.set(key, inlineValue);
+      continue;
+    }
+
+    const next = argv[i + 1];
+    if (next && !next.startsWith("--")) {
+      flags.set(key, next);
+      i += 1;
+    } else {
+      flags.set(key, true);
+    }
+  }
+
+  return { positionals, flags };
+}
+
+function parseList(value?: string): string[] {
+  if (!value) return [];
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed))
+        return parsed.map((item) => String(item)).filter(Boolean);
+    } catch {
+      return [];
+    }
+  }
+  return trimmed
+    .split(/[,;]/)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function readFlag(
+  flags: Map<string, string | boolean>,
+  key: string,
+): string | undefined {
+  const value = flags.get(key);
+  if (value === undefined || value === null) return undefined;
+  if (typeof value === "boolean") return value ? "true" : "false";
+  return value;
+}
+
+function readBool(
+  flags: Map<string, string | boolean>,
+  key: string,
+  fallback: boolean,
+  envKey?: string,
+): boolean {
+  const raw = flags.get(key);
+  if (raw !== undefined) {
+    if (typeof raw === "boolean") return raw;
+    const normalized = String(raw).toLowerCase();
+    if (["false", "0", "no"].includes(normalized)) return false;
+    if (["true", "1", "yes"].includes(normalized)) return true;
+  }
+
+  const envValue = envKey ? process.env[envKey] : undefined;
+  if (envValue) {
+    const normalized = envValue.toLowerCase();
+    if (["false", "0", "no"].includes(normalized)) return false;
+    if (["true", "1", "yes"].includes(normalized)) return true;
+  }
+
+  return fallback;
+}
+
+function readOptionalBool(value: unknown): boolean | undefined {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized)) return true;
+    if (["false", "0", "no", "off"].includes(normalized)) return false;
+  }
+  return undefined;
+}
+
+function readNumber(
+  flags: Map<string, string | boolean>,
+  key: string,
+  fallback: number | undefined,
+  envKey?: string,
+): number | undefined {
+  const raw = flags.get(key);
+  if (raw !== undefined) {
+    const parsed = Number(raw);
+    if (!Number.isNaN(parsed)) return parsed;
+  }
+  if (envKey) {
+    const envValue = process.env[envKey];
+    if (envValue) {
+      const parsed = Number(envValue);
+      if (!Number.isNaN(parsed)) return parsed;
+    }
+  }
+  return fallback;
+}
+
+function readOpencodeHotReload(
+  flags: Map<string, string | boolean>,
+  defaults?: Partial<OpencodeHotReload>,
+  env?: {
+    enabled?: string;
+    debounceMs?: string;
+    cooldownMs?: string;
+  },
+): OpencodeHotReload {
+  const enabled = readBool(
+    flags,
+    "opencode-hot-reload",
+    defaults?.enabled ?? true,
+    env?.enabled,
+  );
+  const debounceRaw = readNumber(
+    flags,
+    "opencode-hot-reload-debounce-ms",
+    defaults?.debounceMs ?? DEFAULT_OPENCODE_HOT_RELOAD_DEBOUNCE_MS,
+    env?.debounceMs,
+  );
+  const cooldownRaw = readNumber(
+    flags,
+    "opencode-hot-reload-cooldown-ms",
+    defaults?.cooldownMs ?? DEFAULT_OPENCODE_HOT_RELOAD_COOLDOWN_MS,
+    env?.cooldownMs,
+  );
+  const debounceMs =
+    typeof debounceRaw === "number" &&
+    Number.isFinite(debounceRaw) &&
+    debounceRaw >= 50
+      ? Math.floor(debounceRaw)
+      : DEFAULT_OPENCODE_HOT_RELOAD_DEBOUNCE_MS;
+  const cooldownMs =
+    typeof cooldownRaw === "number" &&
+    Number.isFinite(cooldownRaw) &&
+    cooldownRaw >= 100
+      ? Math.floor(cooldownRaw)
+      : DEFAULT_OPENCODE_HOT_RELOAD_COOLDOWN_MS;
+  return {
+    enabled,
+    debounceMs,
+    cooldownMs,
+  };
+}
+
+function readBinarySource(
+  flags: Map<string, string | boolean>,
+  key: string,
+  fallback: BinarySourcePreference,
+  envKey?: string,
+): BinarySourcePreference {
+  const raw =
+    readFlag(flags, key) ?? (envKey ? process.env[envKey] : undefined);
+  if (!raw) return fallback;
+  const normalized = String(raw).trim().toLowerCase();
+  if (
+    normalized === "auto" ||
+    normalized === "bundled" ||
+    normalized === "downloaded" ||
+    normalized === "external"
+  ) {
+    return normalized as BinarySourcePreference;
+  }
+  throw new Error(
+    `Invalid ${key} value: ${raw}. Use auto|bundled|downloaded|external.`,
+  );
+}
+
+function readLogFormat(
+  flags: Map<string, string | boolean>,
+  key: string,
+  fallback: LogFormat,
+  envKey?: string,
+): LogFormat {
+  const raw =
+    readFlag(flags, key) ?? (envKey ? process.env[envKey] : undefined);
+  if (!raw) return fallback;
+  const normalized = String(raw).trim().toLowerCase();
+  if (normalized === "json") return "json";
+  if (
+    normalized === "pretty" ||
+    normalized === "text" ||
+    normalized === "human"
+  )
+    return "pretty";
+  throw new Error(`Invalid ${key} value: ${raw}. Use pretty|json.`);
+}
+
+function readSandboxMode(
+  flags: Map<string, string | boolean>,
+  key: string,
+  fallback: SandboxMode,
+  envKey?: string,
+): SandboxMode {
+  const raw =
+    readFlag(flags, key) ?? (envKey ? process.env[envKey] : undefined);
+  if (!raw) return fallback;
+  const normalized = String(raw).trim().toLowerCase();
+  if (
+    normalized === "none" ||
+    normalized === "auto" ||
+    normalized === "docker" ||
+    normalized === "container"
+  ) {
+    return normalized as SandboxMode;
+  }
+  throw new Error(
+    `Invalid ${key} value: ${raw}. Use none|auto|docker|container.`,
+  );
+}
+
+type SandboxAllowedRoot = {
+  path: string;
+  allowReadWrite?: boolean;
+  description?: string;
+};
+
+type SandboxMountAllowlist = {
+  allowedRoots: SandboxAllowedRoot[];
+  blockedPatterns?: string[];
+};
+
+type SandboxMount = {
+  hostPath: string;
+  containerPath: string;
+  readonly: boolean;
+};
+
+const DEFAULT_SANDBOX_BLOCKED_PATTERNS = [
+  ".ssh",
+  ".gnupg",
+  ".gpg",
+  ".aws",
+  ".azure",
+  ".gcloud",
+  ".kube",
+  ".docker",
+  "credentials",
+  ".env",
+  ".netrc",
+  ".npmrc",
+  ".pypirc",
+  "id_rsa",
+  "id_ed25519",
+  "private_key",
+  ".secret",
+];
+
+let cachedSandboxAllowlist: SandboxMountAllowlist | null | undefined;
+let cachedSandboxAllowlistError: string | null = null;
+
+function resolveSandboxAllowlistPath(): string {
+  const override = process.env.OPENWORK_SANDBOX_MOUNT_ALLOWLIST?.trim();
+  if (override) return resolve(override);
+  return join(homedir(), ".config", "openwork", "sandbox-mount-allowlist.json");
+}
+
+function expandTildePath(input: string): string {
+  const trimmed = input.trim();
+  if (!trimmed) return trimmed;
+  if (trimmed === "~") return homedir();
+  if (trimmed.startsWith("~/")) return join(homedir(), trimmed.slice(2));
+  return trimmed;
+}
+
+async function isDir(input: string): Promise<boolean> {
+  try {
+    return (await stat(input)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+async function resolveHostOpencodeGlobalConfigDir(): Promise<string | null> {
+  const enabled =
+    (
+      process.env.OPENWORK_SANDBOX_MOUNT_OPENCODE_CONFIG ??
+      (internalDevModeFromEnv() ? "0" : "1")
+    ).trim() !== "0";
+  if (!enabled) return null;
+
+  const candidates: string[] = [];
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  if (xdg) candidates.push(join(xdg, "opencode"));
+  candidates.push(join(homedir(), ".config", "opencode"));
+  if (process.platform === "darwin") {
+    candidates.push(
+      join(homedir(), "Library", "Application Support", "opencode"),
+    );
+  }
+
+  const files = ["opencode.jsonc", "opencode.json", "config.json", "AGENTS.md"];
+  for (const candidate of Array.from(
+    new Set(candidates.map((item) => resolve(expandTildePath(item)))),
+  )) {
+    if (!(await isDir(candidate))) continue;
+    for (const file of files) {
+      try {
+        await access(join(candidate, file));
+        return candidate;
+      } catch {
+        // keep looking
+      }
+    }
+
+    // Fall back to any non-empty config directory. Some setups keep
+    // provider/auth material in files that are not part of the strict list above.
+    try {
+      const entries = await readdir(candidate);
+      if (entries.length > 0) return candidate;
+    } catch {
+      // keep looking
+    }
+  }
+
+  return null;
+}
+
+async function resolveHostOpencodeGlobalDataDir(): Promise<string | null> {
+  const enabled =
+    (
+      process.env.OPENWORK_SANDBOX_MOUNT_OPENCODE_CONFIG ??
+      (internalDevModeFromEnv() ? "0" : "1")
+    ).trim() !== "0";
+  if (!enabled) return null;
+
+  const candidates: string[] = [];
+  const xdgData = process.env.XDG_DATA_HOME?.trim();
+  if (xdgData) candidates.push(join(xdgData, "opencode"));
+  candidates.push(join(homedir(), ".local", "share", "opencode"));
+  if (process.platform === "darwin") {
+    candidates.push(
+      join(homedir(), "Library", "Application Support", "opencode"),
+    );
+  }
+
+  const files = ["auth.json", "mcp-auth.json"];
+  for (const candidate of Array.from(
+    new Set(candidates.map((item) => resolve(expandTildePath(item)))),
+  )) {
+    if (!(await isDir(candidate))) continue;
+    for (const file of files) {
+      try {
+        await access(join(candidate, file));
+        return candidate;
+      } catch {
+        // keep looking
+      }
+    }
+  }
+
+  return null;
+}
+
+async function realpathOrNull(input: string): Promise<string | null> {
+  try {
+    return await realpath(input);
+  } catch {
+    return null;
+  }
+}
+
+function matchesBlockedPattern(
+  real: string,
+  patterns: string[],
+): string | null {
+  const parts = real.split(sep);
+  for (const pattern of patterns) {
+    for (const part of parts) {
+      if (part === pattern || part.includes(pattern)) return pattern;
+    }
+    if (real.includes(pattern)) return pattern;
+  }
+  return null;
+}
+
+async function findAllowedRoot(
+  real: string,
+  roots: SandboxAllowedRoot[],
+): Promise<SandboxAllowedRoot | null> {
+  for (const root of roots) {
+    const expanded = resolve(expandTildePath(root.path));
+    const realRoot = await realpathOrNull(expanded);
+    if (!realRoot) continue;
+    const rel = relative(realRoot, real);
+    if (!rel.startsWith("..") && !isAbsolute(rel)) {
+      return root;
+    }
+  }
+  return null;
+}
+
+async function loadSandboxAllowlist(): Promise<SandboxMountAllowlist | null> {
+  if (cachedSandboxAllowlist !== undefined) return cachedSandboxAllowlist;
+  if (cachedSandboxAllowlistError) return null;
+
+  const path = resolveSandboxAllowlistPath();
+  try {
+    if (!(await fileExists(path))) {
+      cachedSandboxAllowlistError = `Mount allowlist not found at ${path}`;
+      cachedSandboxAllowlist = null;
+      return null;
+    }
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw) as SandboxMountAllowlist;
+    if (
+      !parsed ||
+      typeof parsed !== "object" ||
+      !Array.isArray(parsed.allowedRoots)
+    ) {
+      throw new Error("allowedRoots must be an array");
+    }
+    const blocked = Array.isArray(parsed.blockedPatterns)
+      ? parsed.blockedPatterns
+      : [];
+    parsed.blockedPatterns = [
+      ...new Set([...DEFAULT_SANDBOX_BLOCKED_PATTERNS, ...blocked]),
+    ];
+    cachedSandboxAllowlist = parsed;
+    return parsed;
+  } catch (error) {
+    cachedSandboxAllowlistError =
+      error instanceof Error ? error.message : String(error);
+    cachedSandboxAllowlist = null;
+    return null;
+  }
+}
+
+function isValidSandboxContainerSubPath(value: string): boolean {
+  const trimmed = value.trim();
+  if (!trimmed) return false;
+  if (trimmed.includes("..")) return false;
+  if (trimmed.startsWith("/")) return false;
+  if (trimmed.includes("\\")) return false;
+  const parts = trimmed.split("/").filter(Boolean);
+  if (!parts.length) return false;
+  if (parts.some((part) => part === "." || part === "..")) return false;
+  return true;
+}
+
+function parseSandboxMountSpec(spec: string): {
+  hostPath: string;
+  containerSubPath: string;
+  requestedReadWrite: boolean;
+} {
+  const trimmed = spec.trim();
+  if (!trimmed) {
+    throw new Error("Empty --sandbox-mount entry");
+  }
+
+  let requestedReadWrite = true;
+  let base = trimmed;
+  if (trimmed.endsWith(":ro")) {
+    requestedReadWrite = false;
+    base = trimmed.slice(0, -3);
+  } else if (trimmed.endsWith(":rw")) {
+    requestedReadWrite = true;
+    base = trimmed.slice(0, -3);
+  }
+
+  const idx = base.indexOf(":");
+  if (idx <= 0 || idx >= base.length - 1) {
+    throw new Error(
+      `Invalid --sandbox-mount value: ${spec}. Use hostPath:subpath[:ro|rw].`,
+    );
+  }
+
+  const hostPath = base.slice(0, idx).trim();
+  const containerSubPath = base.slice(idx + 1).trim();
+  if (!hostPath)
+    throw new Error(
+      `Invalid --sandbox-mount value: ${spec}. Host path is empty.`,
+    );
+  if (!containerSubPath)
+    throw new Error(
+      `Invalid --sandbox-mount value: ${spec}. Container subpath is empty.`,
+    );
+
+  return { hostPath, containerSubPath, requestedReadWrite };
+}
+
+function generateSandboxAllowlistTemplate(): string {
+  const template: SandboxMountAllowlist = {
+    allowedRoots: [
+      {
+        path: "~/projects",
+        allowReadWrite: true,
+        description: "Development projects",
+      },
+      {
+        path: "~/Documents",
+        allowReadWrite: false,
+        description: "Documents (read-only)",
+      },
+    ],
+    blockedPatterns: ["password", "secret", "token"],
+  };
+  return JSON.stringify(template, null, 2);
+}
+
+async function resolveSandboxExtraMounts(
+  specs: string[],
+  sandboxMode: ResolvedSandboxMode,
+): Promise<SandboxMount[]> {
+  if (!specs.length) return [];
+  const allowlistPath = resolveSandboxAllowlistPath();
+  const allowlist = await loadSandboxAllowlist();
+  if (!allowlist) {
+    const template = generateSandboxAllowlistTemplate();
+    throw new Error(
+      `Additional sandbox mounts are blocked. Create ${allowlistPath} to enable.\n\nExample:\n${template}`,
+    );
+  }
+  const blocked = allowlist.blockedPatterns ?? DEFAULT_SANDBOX_BLOCKED_PATTERNS;
+  const roots = allowlist.allowedRoots;
+
+  const mounts: SandboxMount[] = [];
+  for (const spec of specs) {
+    const parsed = parseSandboxMountSpec(spec);
+    if (!isValidSandboxContainerSubPath(parsed.containerSubPath)) {
+      throw new Error(
+        `Invalid sandbox container subpath: "${parsed.containerSubPath}". Use a relative path without "/" prefix or "..".`,
+      );
+    }
+    const expanded = resolve(expandTildePath(parsed.hostPath));
+    const real = await realpathOrNull(expanded);
+    if (!real) {
+      throw new Error(
+        `Sandbox mount host path does not exist: ${parsed.hostPath} (expanded: ${expanded})`,
+      );
+    }
+    const blockedMatch = matchesBlockedPattern(real, blocked);
+    if (blockedMatch) {
+      throw new Error(
+        `Sandbox mount rejected (blocked pattern "${blockedMatch}"): ${real}`,
+      );
+    }
+    const allowedRoot = await findAllowedRoot(real, roots);
+    if (!allowedRoot) {
+      const allowedList = roots
+        .map((root) => resolve(expandTildePath(root.path)))
+        .join(", ");
+      throw new Error(
+        `Sandbox mount rejected: ${real} is not under any allowed root. Allowed: ${allowedList}`,
+      );
+    }
+    const allowReadWrite = allowedRoot.allowReadWrite === true;
+    const readonly = parsed.requestedReadWrite ? !allowReadWrite : true;
+    if (sandboxMode === "container") {
+      const info = await stat(real);
+      if (!info.isDirectory()) {
+        throw new Error(
+          `Apple container sandbox mounts must be directories: ${real}`,
+        );
+      }
+    }
+    mounts.push({
+      hostPath: real,
+      containerPath: `/workspace/extra/${parsed.containerSubPath}`,
+      readonly,
+    });
+  }
+  return mounts;
+}
+
+async function fileExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function resolveCliVersion(): Promise<string> {
+  if (
+    typeof __OPENWORK_ORCHESTRATOR_VERSION__ === "string" &&
+    __OPENWORK_ORCHESTRATOR_VERSION__.trim()
+  ) {
+    return __OPENWORK_ORCHESTRATOR_VERSION__.trim();
+  }
+  const candidates = [
+    join(dirname(process.execPath), "..", "package.json"),
+    join(dirname(fileURLToPath(import.meta.url)), "..", "package.json"),
+  ];
+
+  for (const candidate of candidates) {
+    if (await fileExists(candidate)) {
+      try {
+        const raw = await readFile(candidate, "utf8");
+        const parsed = JSON.parse(raw) as { version?: string };
+        if (parsed.version) return parsed.version;
+      } catch {
+        // ignore
+      }
+    }
+  }
+
+  return FALLBACK_VERSION;
+}
+
+async function readPinnedOpencodeVersion(): Promise<string | undefined> {
+  if (
+    typeof __OPENWORK_PINNED_OPENCODE_VERSION__ === "string" &&
+    __OPENWORK_PINNED_OPENCODE_VERSION__.trim()
+  ) {
+    return __OPENWORK_PINNED_OPENCODE_VERSION__.trim();
+  }
+
+  const candidates = [
+    join(dirname(process.execPath), "..", "constants.json"),
+    join(dirname(fileURLToPath(import.meta.url)), "..", "constants.json"),
+    join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "constants.json"),
+  ];
+
+  for (const candidate of candidates) {
+    if (await fileExists(candidate)) {
+      try {
+        const raw = await readFile(candidate, "utf8");
+        const parsed = JSON.parse(raw) as { opencodeVersion?: unknown };
+        const value =
+          typeof parsed.opencodeVersion === "string"
+            ? parsed.opencodeVersion.trim()
+            : "";
+        if (!value) continue;
+        return value.startsWith("v") ? value.slice(1) : value;
+      } catch {
+        // ignore
+      }
+    }
+  }
+
+  return undefined;
+}
+
+async function isExecutable(path: string): Promise<boolean> {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function readPathHelperPaths(): Promise<string[]> {
+  if (process.platform !== "darwin") return [];
+  return await new Promise((resolve) => {
+    const child = spawnProcess("/usr/libexec/path_helper", ["-s"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    let stdout = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.on("error", () => resolve([]));
+    child.on("exit", (code) => {
+      if (code !== 0) {
+        resolve([]);
+        return;
+      }
+      const match =
+        stdout.match(/PATH="([^"]+)"/) ?? stdout.match(/PATH=([^;\n]+)/);
+      if (!match) {
+        resolve([]);
+        return;
+      }
+      resolve(match[1].split(":").filter(Boolean));
+    });
+  });
+}
+
+async function resolveDockerCandidates(): Promise<string[]> {
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const push = (value: string) => {
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    out.push(trimmed);
+  };
+
+  for (const key of [
+    "OPENWORK_DOCKER_BIN",
+    "OPENWRK_DOCKER_BIN",
+    "DOCKER_BIN",
+  ]) {
+    const value = process.env[key];
+    if (value) push(value);
+  }
+
+  const addFromPath = (value?: string | null) => {
+    if (!value) return;
+    for (const dir of value.split(delimiter)) {
+      if (!dir.trim()) continue;
+      push(join(dir, "docker"));
+    }
+  };
+
+  addFromPath(process.env.PATH ?? "");
+
+  if (process.platform === "darwin") {
+    const helperPaths = await readPathHelperPaths();
+    for (const dir of helperPaths) {
+      push(join(dir, "docker"));
+    }
+  }
+
+  for (const raw of [
+    "/opt/homebrew/bin/docker",
+    "/usr/local/bin/docker",
+    "/Applications/Docker.app/Contents/Resources/bin/docker",
+  ]) {
+    push(raw);
+  }
+
+  const valid: string[] = [];
+  for (const candidate of out) {
+    if (await isExecutable(candidate)) {
+      valid.push(candidate);
+    }
+  }
+  return valid;
+}
+
+async function resolveDockerCommand(): Promise<string> {
+  const candidates = await resolveDockerCandidates();
+  return candidates[0] ?? "docker";
+}
+
+async function ensureWorkspace(workspace: string): Promise<string> {
+  const resolved = resolve(workspace);
+  await mkdir(resolved, { recursive: true });
+
+  const configPathJsonc = join(resolved, "opencode.jsonc");
+  const configPathJson = join(resolved, "opencode.json");
+  const hasJsonc = await fileExists(configPathJsonc);
+  const hasJson = await fileExists(configPathJson);
+
+  if (!hasJsonc && !hasJson) {
+    const payload = JSON.stringify(
+      { $schema: "https://opencode.ai/config.json" },
+      null,
+      2,
+    );
+    await writeFile(configPathJsonc, `${payload}\n`, "utf8");
+  }
+
+  return resolved;
+}
+
+async function canBind(host: string, port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const server = createNetServer();
+    server.once("error", () => {
+      server.close();
+      resolve(false);
+    });
+    server.listen(port, host, () => {
+      server.close(() => resolve(true));
+    });
+  });
+}
+
+async function findFreePort(host: string): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createNetServer();
+    server.unref();
+    server.once("error", (err) => reject(err));
+    server.listen(0, host, () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close();
+        reject(new Error("Failed to allocate free port"));
+        return;
+      }
+      const port = address.port;
+      server.close(() => resolve(port));
+    });
+  });
+}
+
+async function resolvePort(
+  preferred: number | undefined,
+  host: string,
+  fallback?: number,
+): Promise<number> {
+  if (preferred && (await canBind(host, preferred))) {
+    return preferred;
+  }
+  if (fallback && fallback !== preferred && (await canBind(host, fallback))) {
+    return fallback;
+  }
+  return findFreePort(host);
+}
+
+function isCompiledBunBinary(): boolean {
+  try {
+    const entryPath = fileURLToPath(import.meta.url);
+    return entryPath.startsWith("/$bunfs/");
+  } catch {
+    return false;
+  }
+}
+
+function resolveLanIp(): string | null {
+  const interfaces = networkInterfaces();
+  for (const key of Object.keys(interfaces)) {
+    const entries = interfaces[key];
+    if (!entries) continue;
+    for (const entry of entries) {
+      if (entry.family !== "IPv4" || entry.internal) continue;
+      return entry.address;
+    }
+  }
+  return null;
+}
+
+function resolveConnectUrl(
+  port: number,
+  overrideHost?: string,
+): { connectUrl?: string; lanUrl?: string; mdnsUrl?: string } {
+  if (overrideHost) {
+    const trimmed = overrideHost.trim();
+    if (trimmed) {
+      const url = `http://${trimmed}:${port}`;
+      return { connectUrl: url, lanUrl: url };
+    }
+  }
+
+  const host = hostname().trim();
+  const mdnsUrl = host
+    ? `http://${host.replace(/\.local$/, "")}.local:${port}`
+    : undefined;
+  const lanIp = resolveLanIp();
+  const lanUrl = lanIp ? `http://${lanIp}:${port}` : undefined;
+  const connectUrl = lanUrl ?? mdnsUrl;
+  return { connectUrl, lanUrl, mdnsUrl };
+}
+
+function encodeBasicAuth(username: string, password: string): string {
+  return Buffer.from(`${username}:${password}`, "utf8").toString("base64");
+}
+
+function isLoopbackHost(host: string): boolean {
+  const normalized = host.trim().toLowerCase();
+  return (
+    normalized === "127.0.0.1" ||
+    normalized === "localhost" ||
+    normalized === "::1"
+  );
+}
+
+function randomCredential(length: number): string {
+  return randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
+}
+
+function generateManagedOpencodeCredentials(): {
+  username: string;
+  password: string;
+} {
+  return {
+    username: randomCredential(MANAGED_OPENCODE_CREDENTIAL_LENGTH),
+    password: randomCredential(MANAGED_OPENCODE_CREDENTIAL_LENGTH),
+  };
+}
+
+function resolveManagedOpencodeCredentials(args: ParsedArgs): {
+  username: string;
+  password: string;
+} {
+  const explicitUsernameFlag = args.flags.get("opencode-username");
+  const explicitPasswordFlag = args.flags.get("opencode-password");
+  const requestedUsername =
+    typeof explicitUsernameFlag === "string"
+      ? explicitUsernameFlag
+      : process.env.OPENWORK_OPENCODE_USERNAME ??
+        process.env.OPENCODE_SERVER_USERNAME;
+  const requestedPassword =
+    typeof explicitPasswordFlag === "string"
+      ? explicitPasswordFlag
+      : process.env.OPENWORK_OPENCODE_PASSWORD ??
+        process.env.OPENCODE_SERVER_PASSWORD;
+  const allowInjectedCredentials =
+    (process.env[INTERNAL_OPENCODE_CREDENTIALS_ENV] ?? "").trim() === "1";
+  const hasExplicitCredentialFlags =
+    typeof explicitUsernameFlag === "string" ||
+    typeof explicitPasswordFlag === "string";
+
+  if (
+    hasExplicitCredentialFlags &&
+    ((requestedUsername && !requestedPassword) ||
+      (!requestedUsername && requestedPassword))
+  ) {
+    throw new Error(
+      "OpenCode credentials must include both username and password.",
+    );
+  }
+
+  if (requestedUsername && requestedPassword && hasExplicitCredentialFlags) {
+    if (!allowInjectedCredentials) {
+      throw new Error(
+        "OpenCode credentials are managed by OpenWork. Custom --opencode-username/--opencode-password values are not supported.",
+      );
+    }
+    return {
+      username: requestedUsername,
+      password: requestedPassword,
+    };
+  }
+
+  if (requestedUsername && requestedPassword && allowInjectedCredentials) {
+    return {
+      username: requestedUsername,
+      password: requestedPassword,
+    };
+  }
+
+  return generateManagedOpencodeCredentials();
+}
+
+function assertManagedOpencodeAuth(args: ParsedArgs) {
+  const authEnabled = readBool(
+    args.flags,
+    "opencode-auth",
+    true,
+    "OPENWORK_OPENCODE_AUTH",
+  );
+  if (!authEnabled) {
+    throw new Error(
+      "OpenCode basic auth is always enabled when OpenWork launches OpenCode.",
+    );
+  }
+}
+
+function resolveManagedOpencodeHost(requestedHost?: string): string {
+  const normalized = requestedHost?.trim();
+  if (!normalized) return "127.0.0.1";
+  if (!isLoopbackHost(normalized)) {
+    throw new Error(
+      `OpenCode must stay on loopback. Unsupported --opencode-host value: ${normalized}`,
+    );
+  }
+  return normalized === "localhost" ? "127.0.0.1" : normalized;
+}
+
+const OPENCODE_LOG_LEVELS = ["DEBUG", "INFO", "WARN", "ERROR"] as const;
+
+function resolveOpencodeLogLevel(requested?: string): string | undefined {
+  const trimmed = requested?.trim();
+  if (!trimmed) return undefined;
+  const normalized = trimmed.toUpperCase();
+  if (!(OPENCODE_LOG_LEVELS as readonly string[]).includes(normalized)) {
+    throw new Error(
+      `Unsupported --opencode-log-level value: ${requested}. Expected one of: ${OPENCODE_LOG_LEVELS.join(", ")}.`,
+    );
+  }
+  return normalized;
+}
+
+function resolveOpenworkRemoteAccess(args: ParsedArgs): boolean {
+  const explicitHost =
+    readFlag(args.flags, "openwork-host") ?? process.env.OPENWORK_HOST;
+  const remoteAccessRequested =
+    readBool(args.flags, "remote-access", false, "OPENWORK_REMOTE_ACCESS") ||
+    explicitHost?.trim() === "0.0.0.0";
+
+  if (explicitHost) {
+    const normalized = explicitHost.trim();
+    if (!normalized) return remoteAccessRequested;
+    if (normalized === "0.0.0.0") return true;
+    if (!isLoopbackHost(normalized)) {
+      throw new Error(
+        `Unsupported --openwork-host value: ${normalized}. Use loopback by default or --remote-access for shared access.`,
+      );
+    }
+  }
+
+  return remoteAccessRequested;
+}
+
+function unwrap<T>(result: FieldsResult<T>): T {
+  if (result.data !== undefined) {
+    return result.data;
+  }
+  const message =
+    result.error instanceof Error
+      ? result.error.message
+      : typeof result.error === "string"
+        ? result.error
+        : JSON.stringify(result.error);
+  throw new Error(message || "Unknown error");
+}
+
+function parsePositiveNumberEnv(
+  value: string | undefined,
+  fallback: number,
+): number {
+  const raw = value?.trim();
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+  return parsed;
+}
+
+function parseSessionActivityAt(session: unknown): number | null {
+  if (!session || typeof session !== "object") return null;
+  const record = session as {
+    time?: { updated?: number; created?: number };
+  };
+  const updated = record.time?.updated;
+  if (typeof updated === "number" && Number.isFinite(updated) && updated > 0) {
+    return updated;
+  }
+  const created = record.time?.created;
+  if (typeof created === "number" && Number.isFinite(created) && created > 0) {
+    return created;
+  }
+  return null;
+}
+
+function resolveWorkerActivityHeartbeatConfig(): WorkerActivityHeartbeatConfig {
+  const enabled = (process.env.DEN_ACTIVITY_HEARTBEAT_ENABLED ?? "")
+    .trim()
+    .toLowerCase();
+  const provider = (process.env.DEN_RUNTIME_PROVIDER ?? "").trim().toLowerCase();
+  const workerId = (process.env.DEN_WORKER_ID ?? "").trim();
+  const url = (process.env.DEN_ACTIVITY_HEARTBEAT_URL ?? "").trim();
+  const token = (process.env.DEN_ACTIVITY_HEARTBEAT_TOKEN ?? "").trim();
+
+  const featureEnabled =
+    enabled === "1" || enabled === "true" || enabled === "yes";
+
+  if (!featureEnabled || provider !== "daytona" || !workerId || !url || !token) {
+    return {
+      enabled: false,
+      workerId: "",
+      url: "",
+      token: "",
+      intervalMs: DEFAULT_ACTIVITY_HEARTBEAT_INTERVAL_MS,
+      activeWindowMs: DEFAULT_ACTIVITY_WINDOW_MS,
+    };
+  }
+
+  const intervalSeconds = parsePositiveNumberEnv(
+    process.env.DEN_ACTIVITY_HEARTBEAT_INTERVAL_SECONDS,
+    DEFAULT_ACTIVITY_HEARTBEAT_INTERVAL_MS / 1000,
+  );
+  const activeWindowSeconds = parsePositiveNumberEnv(
+    process.env.DEN_ACTIVITY_WINDOW_SECONDS,
+    DEFAULT_ACTIVITY_WINDOW_MS / 1000,
+  );
+
+  return {
+    enabled: true,
+    workerId,
+    url,
+    token,
+    intervalMs: Math.round(intervalSeconds * 1000),
+    activeWindowMs: Math.round(activeWindowSeconds * 1000),
+  };
+}
+
+async function postWorkerActivityHeartbeat(input: {
+  config: WorkerActivityHeartbeatConfig;
+  opencodeClient: ReturnType<typeof createOpencodeClient>;
+  logger: Logger;
+}) {
+  if (!input.config.enabled) return;
+
+  const sessions = unwrap(await input.opencodeClient.session.list({ limit: 200 }));
+  let latestActivityAt = 0;
+  for (const session of sessions) {
+    const ts = parseSessionActivityAt(session);
+    if (ts && ts > latestActivityAt) {
+      latestActivityAt = ts;
+    }
+  }
+
+  const now = Date.now();
+  const isActiveRecently =
+    latestActivityAt > 0 && now - latestActivityAt <= input.config.activeWindowMs;
+
+  const payload = {
+    sentAt: new Date(now).toISOString(),
+    isActiveRecently,
+    lastActivityAt:
+      latestActivityAt > 0 ? new Date(latestActivityAt).toISOString() : null,
+    openSessionCount: sessions.length,
+  };
+
+  const response = await fetch(input.config.url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${input.config.token}`,
+    },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(10_000),
+  });
+
+  if (!response.ok) {
+    throw new Error(`heartbeat_failed:${response.status}`);
+  }
+
+  input.logger.debug(
+    "Worker activity heartbeat sent",
+    {
+      workerId: input.config.workerId,
+      isActiveRecently,
+      lastActivityAt: payload.lastActivityAt,
+      openSessionCount: payload.openSessionCount,
+    },
+    "openwork-orchestrator",
+  );
+}
+
+function prefixStream(
+  stream: NodeJS.ReadableStream | null,
+  label: string,
+  level: "stdout" | "stderr",
+  logger: Logger,
+  pid?: number,
+): void {
+  if (!stream) return;
+  stream.setEncoding("utf8");
+  let buffer = "";
+  stream.on("data", (chunk) => {
+    buffer += chunk;
+    const lines = buffer.split(/\r?\n/);
+    buffer = lines.pop() ?? "";
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      if (
+        logger.output === "stdout" &&
+        logger.format === "json" &&
+        looksLikeOtelLogLine(line)
+      ) {
+        process.stdout.write(`${line}\n`);
+        continue;
+      }
+      const severity: LogLevel = level === "stderr" ? "error" : "info";
+      logger.log(severity, line, { stream: level, pid }, label);
+    }
+  });
+  stream.on("end", () => {
+    if (!buffer.trim()) return;
+    if (
+      logger.output === "stdout" &&
+      logger.format === "json" &&
+      looksLikeOtelLogLine(buffer)
+    ) {
+      process.stdout.write(`${buffer}\n`);
+      return;
+    }
+    const severity: LogLevel = level === "stderr" ? "error" : "info";
+    logger.log(severity, buffer, { stream: level, pid }, label);
+  });
+}
+
+function shouldUseBun(bin: string): boolean {
+  if (!bin.endsWith(`${join("dist", "cli.js")}`)) return false;
+  if (bin.includes("openwork-server")) return true;
+  return bin.includes(`${join("packages", "server")}`);
+}
+
+function resolveBinCommand(bin: string): {
+  command: string;
+  prefixArgs: string[];
+} {
+  if (bin.endsWith(".ts")) {
+    return { command: "bun", prefixArgs: [bin, "--"] };
+  }
+  if (bin.endsWith(".js")) {
+    if (shouldUseBun(bin)) {
+      return { command: "bun", prefixArgs: [bin, "--"] };
+    }
+    return { command: "node", prefixArgs: [bin, "--"] };
+  }
+  return { command: bin, prefixArgs: [] };
+}
+
+async function readVersionManifest(): Promise<VersionManifest | null> {
+  const binDir = dirname(process.execPath);
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const envManifestPath = process.env.OPENWORK_VERSION_MANIFEST?.trim();
+  const envSidecarDir = process.env.OPENWORK_BUNDLED_SIDECAR_DIR?.trim();
+  const candidates = [
+    ...(envManifestPath
+      ? [
+          {
+            manifestPath: envManifestPath,
+            dir: envSidecarDir || dirname(envManifestPath),
+          },
+        ]
+      : []),
+    { manifestPath: join(binDir, "versions.json"), dir: binDir },
+    // macOS treats files in Contents/MacOS as executable code, so the manifest
+    // is bundled as a resource while sidecar binaries remain next to execPath.
+    { manifestPath: join(binDir, "..", "Resources", "versions.json"), dir: binDir },
+    { manifestPath: join(moduleDir, "versions.json"), dir: moduleDir },
+  ];
+  for (const { manifestPath, dir } of candidates) {
+    if (await fileExists(manifestPath)) {
+      try {
+        const payload = await readFile(manifestPath, "utf8");
+        const entries = JSON.parse(payload) as Record<string, VersionInfo>;
+        return { dir, entries };
+      } catch {
+        return { dir, entries: {} };
+      }
+    }
+  }
+  return null;
+}
+
+const remoteManifestCache = new Map<
+  string,
+  Promise<RemoteSidecarManifest | null>
+>();
+
+let cachedExtraPathEntries: string[] | null = null;
+
+function isDirectory(path: string): boolean {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function splitPathEntries(value?: string): string[] {
+  if (!value) return [];
+  return value.split(delimiter).map((entry) => entry.trim()).filter(Boolean);
+}
+
+function pushPath(entries: string[], path?: string | null) {
+  if (!path) return;
+  const candidate = resolve(path.trim());
+  if (!isDirectory(candidate)) return;
+  if (!entries.includes(candidate)) entries.push(candidate);
+}
+
+function nvmVersionBinPaths(home: string): string[] {
+  const base = join(home, ".nvm", "versions", "node");
+  try {
+    return readdirSync(base, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => join(base, entry.name, "bin"))
+      .filter(isDirectory)
+      .sort()
+      .reverse();
+  } catch {
+    return [];
+  }
+}
+
+function resolveExtraPathEntries(): string[] {
+  if (cachedExtraPathEntries) return cachedExtraPathEntries;
+
+  const entries: string[] = [];
+  const sidecarOverride =
+    process.env.OPENWRK_SIDECAR_DIR ?? process.env.OPENWORK_SIDECAR_DIR;
+  const sidecarCandidates = [
+    sidecarOverride,
+    dirname(process.execPath),
+    join(dirname(process.execPath), "sidecars"),
+    join(ORCHESTRATOR_ROOT_DIR, "dist"),
+    resolve(REPO_ROOT_DIR, "apps", "desktop", "src-tauri", "sidecars"),
+  ];
+  for (const candidate of sidecarCandidates) {
+    pushPath(entries, candidate);
+  }
+
+  const home = homedir();
+  if (process.platform === "darwin") {
+    for (const candidate of [
+      "/opt/homebrew/bin",
+      "/opt/homebrew/sbin",
+      "/usr/local/bin",
+      "/usr/local/sbin",
+      join(home, ".nvm", "current", "bin"),
+      ...nvmVersionBinPaths(home),
+      join(home, ".fnm", "current", "bin"),
+      join(home, ".volta", "bin"),
+      join(home, "Library", "pnpm"),
+      join(home, ".bun", "bin"),
+      join(home, ".cargo", "bin"),
+      join(home, ".pyenv", "shims"),
+      join(home, ".local", "bin"),
+    ]) {
+      pushPath(entries, candidate);
+    }
+  }
+
+  if (process.platform === "linux") {
+    for (const candidate of [
+      "/usr/local/bin",
+      "/usr/local/sbin",
+      join(home, ".nvm", "current", "bin"),
+      ...nvmVersionBinPaths(home),
+      join(home, ".fnm", "current", "bin"),
+      join(home, ".volta", "bin"),
+      join(home, ".local", "share", "pnpm"),
+      join(home, ".bun", "bin"),
+      join(home, ".cargo", "bin"),
+      join(home, ".pyenv", "shims"),
+      join(home, ".local", "bin"),
+    ]) {
+      pushPath(entries, candidate);
+    }
+  }
+
+  if (process.platform === "win32") {
+    for (const candidate of [
+      join(home, ".volta", "bin"),
+      join(home, ".bun", "bin"),
+      join(home, ".cargo", "bin"),
+      process.env.APPDATA ? join(process.env.APPDATA, "npm") : null,
+      process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, "pnpm") : null,
+    ]) {
+      pushPath(entries, candidate);
+    }
+  }
+
+  cachedExtraPathEntries = entries;
+  return entries;
+}
+
+// Resolves ~/.config/openwork/env.json (or %APPDATA%\openwork\env.json on
+// Windows) — must agree byte-for-byte with apps/server/src/env-file.ts and
+// apps/desktop/src-tauri/src/env_file.rs. Honor OPENWORK_ENV_STORE override.
+function resolveUserEnvFilePath(): string {
+  const override = (process.env.OPENWORK_ENV_STORE ?? "").trim();
+  if (override) return resolve(override);
+  if (platform() === "win32") {
+    const appData = (process.env.APPDATA ?? "").trim();
+    const root = appData || join(homedir(), "AppData", "Roaming");
+    return join(root, "openwork", "env.json");
+  }
+  return join(homedir(), ".config", "openwork", "env.json");
+}
+
+const USER_ENV_RESERVED_PREFIXES = ["OPENWORK_", "OPENCODE_"] as const;
+
+// Synchronous, best-effort, never throws. Absent or malformed files return {}.
+// Reads on every spawn so UI edits are picked up on the next child start.
+function loadUserEnvFile(): Record<string, string> {
+  try {
+    const raw = readFileSync(resolveUserEnvFilePath(), "utf8");
+    const parsed = JSON.parse(raw) as { variables?: unknown };
+    if (!Array.isArray(parsed.variables)) return {};
+    const out: Record<string, string> = {};
+    for (const entry of parsed.variables) {
+      if (!entry || typeof entry !== "object") continue;
+      const { key, value } = entry as { key?: unknown; value?: unknown };
+      if (typeof key !== "string" || typeof value !== "string") continue;
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+      if (USER_ENV_RESERVED_PREFIXES.some((p) => key.startsWith(p))) continue;
+      out[key] = value;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+function buildSpawnEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const base = env ?? process.env;
+  // User env is layered first so existing process.env / caller overrides
+  // always win. This is what makes Linux GUI launches work: the shell env
+  // is empty for ANTHROPIC_API_KEY, the user file supplies it, but anything
+  // the shell or spawn-site already set (OPENWORK_TOKEN, etc.) is untouched.
+  const merged: NodeJS.ProcessEnv = { ...loadUserEnvFile() };
+  for (const [key, value] of Object.entries(base)) {
+    if (value !== undefined) merged[key] = value;
+  }
+  const pathKey =
+    Object.prototype.hasOwnProperty.call(merged, "PATH") ||
+    !Object.prototype.hasOwnProperty.call(merged, "Path")
+      ? "PATH"
+      : "Path";
+  const currentPath = pathKey === "PATH" ? merged.PATH : merged.Path;
+  const entries = [
+    ...resolveExtraPathEntries(),
+    ...splitPathEntries(currentPath),
+  ];
+  const deduped = entries.filter((entry, index) => entries.indexOf(entry) === index);
+  if (!deduped.length) return merged;
+  return { ...merged, [pathKey]: deduped.join(delimiter) };
+}
+
+function resolveSidecarTarget(): SidecarTarget | null {
+  if (process.platform === "darwin") {
+    if (process.arch === "arm64") return "darwin-arm64";
+    if (process.arch === "x64") return "darwin-x64";
+    return null;
+  }
+  if (process.platform === "linux") {
+    if (process.arch === "arm64") return "linux-arm64";
+    if (process.arch === "x64") return "linux-x64";
+    return null;
+  }
+  if (process.platform === "win32") {
+    if (process.arch === "arm64") return "windows-arm64";
+    if (process.arch === "x64") return "windows-x64";
+    return null;
+  }
+  return null;
+}
+
+function resolveSandboxSidecarTarget(
+  mode: ResolvedSandboxMode,
+): SidecarTarget | null {
+  if (mode === "none") return resolveSidecarTarget();
+  // Sandbox runs inside Linux (docker / container).
+  if (process.arch === "arm64") return "linux-arm64";
+  if (process.arch === "x64") return "linux-x64";
+  return null;
+}
+
+function resolveSidecarConfigForTarget(
+  flags: Map<string, string | boolean>,
+  cliVersion: string,
+  targetOverride: SidecarTarget | null,
+): SidecarConfig {
+  const baseUrl = resolveSidecarBaseUrl(flags, cliVersion);
+  return {
+    dir: resolveSidecarDir(flags),
+    baseUrl,
+    manifestUrl: resolveSidecarManifestUrl(flags, baseUrl),
+    target: targetOverride,
+  };
+}
+
+function spawnProcess(
+  command: string,
+  args: string[],
+  options: SpawnOptions = {},
+) {
+  const env = buildSpawnEnv(options.env);
+  const resolvedOptions = { ...options, env };
+  if (process.platform === "win32") {
+    return spawn(command, args, { ...resolvedOptions, windowsHide: true });
+  }
+  return spawn(command, args, resolvedOptions);
+}
+
+async function probeCommand(
+  command: string,
+  args: string[],
+  timeoutMs = 2500,
+): Promise<boolean> {
+  return await new Promise((resolve) => {
+    const child = spawnProcess(command, args, {
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    const timeout = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+        // ignore
+      }
+      resolve(false);
+    }, timeoutMs);
+    child.on("error", () => {
+      clearTimeout(timeout);
+      resolve(false);
+    });
+    child.on("exit", (code) => {
+      clearTimeout(timeout);
+      resolve(code === 0);
+    });
+  });
+}
+
+async function resolveSandboxMode(
+  mode: SandboxMode,
+): Promise<ResolvedSandboxMode> {
+  if (mode === "none") return "none";
+  if (mode === "docker") return "docker";
+  if (mode === "container") return "container";
+
+  // auto
+  if (process.platform === "darwin" && process.arch === "arm64") {
+    const containerOk = await probeCommand("container", ["--version"]);
+    if (containerOk) return "container";
+  }
+
+  const dockerCommand = await resolveDockerCommand();
+  const dockerOk = await probeCommand(dockerCommand, ["version"]);
+  if (dockerOk) return "docker";
+
+  const containerOk = await probeCommand("container", ["--version"]);
+  if (containerOk) return "container";
+  return "none";
+}
+
+function shQuote(value: string): string {
+  if (!value) return "''";
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+
+function addEnvPassThroughArgs(args: string[], names: string[]) {
+  for (const name of names) {
+    args.push("--env", name);
+  }
+}
+
+const SANDBOX_INTERNAL_ENV_NAMES = [
+  "OPENWORK_TOKEN",
+  "OPENWORK_HOST_TOKEN",
+  "OPENCODE_SERVER_USERNAME",
+  "OPENCODE_SERVER_PASSWORD",
+  "OPENWORK_OPENCODE_USERNAME",
+  "OPENWORK_OPENCODE_PASSWORD",
+] as const;
+
+function sandboxEnvPassThroughNames(userEnv: Record<string, string>): string[] {
+  return [...SANDBOX_INTERNAL_ENV_NAMES, ...Object.keys(userEnv).sort()].filter(
+    (name, index, names) => names.indexOf(name) === index,
+  );
+}
+
+function resolveSidecarDir(flags: Map<string, string | boolean>): string {
+  const override =
+    readFlag(flags, "sidecar-dir") ?? process.env.OPENWORK_SIDECAR_DIR;
+  if (override && override.trim()) return resolve(override.trim());
+  return join(resolveRouterDataDir(flags), "sidecars");
+}
+
+function resolveSidecarBaseUrl(
+  flags: Map<string, string | boolean>,
+  cliVersion: string,
+): string {
+  const override =
+    readFlag(flags, "sidecar-base-url") ??
+    process.env.OPENWORK_SIDECAR_BASE_URL;
+  if (override && override.trim()) return override.trim();
+  return `https://github.com/different-ai/openwork/releases/download/openwork-orchestrator-v${cliVersion}`;
+}
+
+function resolveSidecarManifestUrl(
+  flags: Map<string, string | boolean>,
+  baseUrl: string,
+): string {
+  const override =
+    readFlag(flags, "sidecar-manifest") ??
+    process.env.OPENWORK_SIDECAR_MANIFEST_URL;
+  if (override && override.trim()) return override.trim();
+  return `${baseUrl.replace(/\/$/, "")}/openwork-orchestrator-sidecars.json`;
+}
+
+function resolveSidecarConfig(
+  flags: Map<string, string | boolean>,
+  cliVersion: string,
+): SidecarConfig {
+  const baseUrl = resolveSidecarBaseUrl(flags, cliVersion);
+  return {
+    dir: resolveSidecarDir(flags),
+    baseUrl,
+    manifestUrl: resolveSidecarManifestUrl(flags, baseUrl),
+    target: resolveSidecarTarget(),
+  };
+}
+
+async function fetchRemoteManifest(
+  url: string,
+): Promise<RemoteSidecarManifest | null> {
+  const cached = remoteManifestCache.get(url);
+  if (cached) return cached;
+  const task = (async () => {
+    try {
+      const response = await fetch(url);
+      if (!response.ok) return null;
+      return (await response.json()) as RemoteSidecarManifest;
+    } catch {
+      return null;
+    }
+  })();
+  remoteManifestCache.set(url, task);
+  return task;
+}
+
+function resolveAssetUrl(
+  baseUrl: string,
+  asset?: string,
+  url?: string,
+): string | null {
+  if (url && url.trim()) return url.trim();
+  if (asset && asset.trim())
+    return `${baseUrl.replace(/\/$/, "")}/${asset.trim()}`;
+  return null;
+}
+
+function resolveAssetName(asset?: string, url?: string): string | null {
+  if (asset && asset.trim()) return asset.trim();
+  if (url && url.trim()) {
+    try {
+      return basename(new URL(url).pathname);
+    } catch {
+      const parts = url.split("/").filter(Boolean);
+      return parts.length ? parts[parts.length - 1] : null;
+    }
+  }
+  return null;
+}
+
+async function downloadToPath(url: string, dest: string): Promise<void> {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url} (HTTP ${response.status})`);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  await mkdir(dirname(dest), { recursive: true });
+  const tmpPath = `${dest}.tmp-${randomUUID()}`;
+  await writeFile(tmpPath, buffer);
+  await rename(tmpPath, dest);
+}
+
+async function ensureExecutable(path: string): Promise<void> {
+  if (process.platform === "win32") return;
+  try {
+    await chmod(path, 0o755);
+  } catch {
+    // ignore
+  }
+}
+
+async function downloadSidecarBinary(options: {
+  name: SidecarName;
+  sidecar: SidecarConfig;
+  expectedVersion?: string;
+}): Promise<ResolvedBinary | null> {
+  if (!options.sidecar.target) return null;
+  const manifest = await fetchRemoteManifest(options.sidecar.manifestUrl);
+  if (!manifest) return null;
+  const entry = manifest.entries[options.name];
+  if (!entry) return null;
+  if (options.expectedVersion && entry.version !== options.expectedVersion) {
+    return null;
+  }
+  const targetInfo = entry.targets[options.sidecar.target];
+  if (!targetInfo) return null;
+
+  const assetName = resolveAssetName(targetInfo.asset, targetInfo.url);
+  const assetUrl = resolveAssetUrl(
+    options.sidecar.baseUrl,
+    targetInfo.asset,
+    targetInfo.url,
+  );
+  if (!assetName || !assetUrl) return null;
+
+  const targetDir = join(
+    options.sidecar.dir,
+    entry.version,
+    options.sidecar.target,
+  );
+  const targetPath = join(targetDir, assetName);
+  if (await fileExists(targetPath)) {
+    if (targetInfo.sha256) {
+      try {
+        await verifyBinary(targetPath, {
+          version: entry.version,
+          sha256: targetInfo.sha256,
+        });
+        await ensureExecutable(targetPath);
+        return {
+          bin: targetPath,
+          source: "downloaded",
+          expectedVersion: entry.version,
+        };
+      } catch {
+        await rm(targetPath, { force: true });
+      }
+    } else {
+      await ensureExecutable(targetPath);
+      return {
+        bin: targetPath,
+        source: "downloaded",
+        expectedVersion: entry.version,
+      };
+    }
+  }
+
+  await downloadToPath(assetUrl, targetPath);
+  if (targetInfo.sha256) {
+    await verifyBinary(targetPath, {
+      version: entry.version,
+      sha256: targetInfo.sha256,
+    });
+  }
+  await ensureExecutable(targetPath);
+  return {
+    bin: targetPath,
+    source: "downloaded",
+    expectedVersion: entry.version,
+  };
+}
+
+function resolveOpencodeAsset(target: SidecarTarget): string | null {
+  const assets: Record<SidecarTarget, string> = {
+    "darwin-arm64": "opencode-darwin-arm64.zip",
+    "darwin-x64": "opencode-darwin-x64-baseline.zip",
+    "linux-x64": "opencode-linux-x64-baseline.tar.gz",
+    "linux-arm64": "opencode-linux-arm64.tar.gz",
+    "windows-x64": "opencode-windows-x64-baseline.zip",
+    "windows-arm64": "opencode-windows-arm64.zip",
+  };
+  return assets[target] ?? null;
+}
+
+async function runCommand(
+  command: string,
+  args: string[],
+  cwd?: string,
+): Promise<void> {
+  const child = spawnProcess(command, args, { cwd, stdio: "inherit" });
+  const result = await Promise.race([
+    once(child, "exit").then(([code]) => ({ type: "exit" as const, code })),
+    once(child, "error").then(([error]) => ({ type: "error" as const, error })),
+  ]);
+  if (result.type === "error") {
+    throw new Error(
+      `Command failed: ${command} ${args.join(" ")}: ${String(result.error)}`,
+    );
+  }
+  if (result.code !== 0) {
+    throw new Error(`Command failed: ${command} ${args.join(" ")}`);
+  }
+}
+
+async function resolveOpencodeDownload(
+  sidecar: SidecarConfig,
+  expectedVersion?: string,
+): Promise<string | null> {
+  if (!expectedVersion) return null;
+  if (!sidecar.target) return null;
+
+  const assetOverride =
+    process.env.OPENWORK_OPENCODE_ASSET ?? process.env.OPENCODE_ASSET;
+  const asset = assetOverride?.trim() || resolveOpencodeAsset(sidecar.target);
+  if (!asset) return null;
+
+  const version = expectedVersion.startsWith("v")
+    ? expectedVersion.slice(1)
+    : expectedVersion;
+  const url = `https://github.com/anomalyco/opencode/releases/download/v${version}/${asset}`;
+  const targetDir = join(sidecar.dir, "opencode", version, sidecar.target);
+  const targetPath = join(
+    targetDir,
+    process.platform === "win32" ? "opencode.exe" : "opencode",
+  );
+
+  const hostTarget = resolveSidecarTarget();
+  const runnableOnHost = hostTarget !== null && sidecar.target === hostTarget;
+
+  if (await fileExists(targetPath)) {
+    if (!runnableOnHost) {
+      await ensureExecutable(targetPath);
+      return targetPath;
+    }
+    const actual = await readCliVersion(targetPath);
+    if (actual === version) {
+      await ensureExecutable(targetPath);
+      return targetPath;
+    }
+  }
+
+  await mkdir(targetDir, { recursive: true });
+  const stamp = Date.now();
+  const archivePath = join(
+    tmpdir(),
+    `openwork-orchestrator-opencode-${stamp}-${asset}`,
+  );
+  const extractDir = await mkdtemp(
+    join(tmpdir(), "openwork-orchestrator-opencode-"),
+  );
+
+  try {
+    await downloadToPath(url, archivePath);
+    if (process.platform === "win32") {
+      const psQuote = (value: string) => `'${value.replace(/'/g, "''")}'`;
+      const psScript = [
+        "$ErrorActionPreference = 'Stop'",
+        `Expand-Archive -Path ${psQuote(archivePath)} -DestinationPath ${psQuote(extractDir)} -Force`,
+      ].join("; ");
+      await runCommand("powershell", ["-NoProfile", "-Command", psScript]);
+    } else if (asset.endsWith(".zip")) {
+      await runCommand("unzip", ["-q", archivePath, "-d", extractDir]);
+    } else if (asset.endsWith(".tar.gz")) {
+      await runCommand("tar", ["-xzf", archivePath, "-C", extractDir]);
+    } else {
+      throw new Error(`Unsupported opencode asset type: ${asset}`);
+    }
+
+    const entries = await readdir(extractDir, { withFileTypes: true });
+    const queue = entries.map((entry) => join(extractDir, entry.name));
+    let candidate: string | null = null;
+    while (queue.length) {
+      const current = queue.shift();
+      if (!current) break;
+      const statInfo = await stat(current);
+      if (statInfo.isDirectory()) {
+        const nested = await readdir(current, { withFileTypes: true });
+        queue.push(...nested.map((entry) => join(current, entry.name)));
+        continue;
+      }
+      const base = basename(current);
+      if (base === "opencode" || base === "opencode.exe") {
+        candidate = current;
+        break;
+      }
+    }
+
+    if (!candidate) {
+      throw new Error("OpenCode binary not found after extraction.");
+    }
+
+    await copyFile(candidate, targetPath);
+    await ensureExecutable(targetPath);
+    return targetPath;
+  } finally {
+    await rm(extractDir, { recursive: true, force: true });
+    await rm(archivePath, { force: true });
+  }
+}
+
+async function sha256File(path: string): Promise<string> {
+  const data = await readFile(path);
+  return createHash("sha256").update(data).digest("hex");
+}
+
+async function verifyBinary(
+  path: string,
+  expected?: VersionInfo,
+): Promise<void> {
+  if (!expected) return;
+  const hash = await sha256File(path);
+  if (hash !== expected.sha256) {
+    throw new Error(`Integrity check failed for ${path}`);
+  }
+}
+
+async function resolveBundledBinary(
+  manifest: VersionManifest | null,
+  name: string,
+): Promise<string | null> {
+  if (!manifest) return null;
+  const candidates = [join(manifest.dir, name)];
+  if (process.platform === "win32") {
+    candidates.push(join(manifest.dir, `${name}.exe`));
+  }
+  for (const bundled of candidates) {
+    if (!(await isExecutable(bundled))) continue;
+    // Desktop bundles may be code-signed after we generate versions.json, which
+    // mutates the on-disk bytes and makes a precomputed sha256 unstable.
+    // Linux bundles remain byte-stable, so keep integrity verification there.
+    if (process.platform === "linux") {
+      await verifyBinary(bundled, manifest.entries[name]);
+    }
+    return bundled;
+  }
+  return null;
+}
+
+async function readPackageVersion(path: string): Promise<string | undefined> {
+  try {
+    const payload = await readFile(path, "utf8");
+    const parsed = JSON.parse(payload) as { version?: string };
+    if (typeof parsed.version === "string") return parsed.version;
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function resolveOpenCodeRouterRepoDir(): Promise<string | null> {
+  const envPath = process.env.OPENCODE_ROUTER_DIR?.trim();
+  const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+  const repoRoot = resolve(root, "..", "..");
+  const candidates = [
+    envPath,
+    resolve(repoRoot, "packages", "opencode-router"),
+  ].filter(Boolean) as string[];
+
+  for (const candidate of candidates) {
+    const pkgPath = join(candidate, "package.json");
+    if (await fileExists(pkgPath)) return candidate;
+  }
+
+  return null;
+}
+
+async function resolveExpectedVersion(
+  manifest: VersionManifest | null,
+  name: SidecarName,
+): Promise<string | undefined> {
+  if (name !== "opencode") {
+    const manifestVersion = manifest?.entries[name]?.version;
+    if (manifestVersion) return manifestVersion;
+  }
+
+  try {
+    const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+    if (name === "openwork-server") {
+      const localPath = join(root, "..", "server", "package.json");
+      const localVersion = await readPackageVersion(localPath);
+      if (localVersion) return localVersion;
+    }
+    if (name === "opencode-router") {
+      const repoDir = await resolveOpenCodeRouterRepoDir();
+      const localPath = repoDir
+        ? join(repoDir, "package.json")
+        : join(root, "..", "opencode-router", "package.json");
+      const localVersion = await readPackageVersion(localPath);
+      if (localVersion) return localVersion;
+    }
+    if (name === "opencode") {
+      const pinnedVersion = await readPinnedOpencodeVersion();
+      if (pinnedVersion) return pinnedVersion;
+    }
+  } catch {
+    // ignore
+  }
+
+  const require = createRequire(import.meta.url);
+  if (name === "openwork-server") {
+    try {
+      const pkgPath = require.resolve("openwork-server/package.json");
+      const version = await readPackageVersion(pkgPath);
+      if (version) return version;
+    } catch {
+      // ignore
+    }
+  }
+  if (name === "opencode-router") {
+    try {
+      const pkgPath = require.resolve("opencode-router/package.json");
+      const version = await readPackageVersion(pkgPath);
+      if (version) return version;
+    } catch {
+      // ignore
+    }
+  }
+
+  return undefined;
+}
+
+function parseVersion(output: string): string | undefined {
+  const match = output.match(/\d+\.\d+\.\d+(?:-[\w.-]+)?/);
+  return match?.[0];
+}
+
+async function readCliVersion(
+  bin: string,
+  timeoutMs = 4000,
+): Promise<string | undefined> {
+  const resolved = resolveBinCommand(bin);
+  const child = spawnProcess(
+    resolved.command,
+    [...resolved.prefixArgs, "--version"],
+    {
+      // Avoid picking up a local bunfig.toml preload from the caller's cwd.
+      // (Notably, packages/orchestrator/bunfig.toml preloads @opentui/solid/preload which
+      // breaks running bun-compiled binaries like opencodeRouter during version checks.)
+      cwd: tmpdir(),
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  );
+  let output = "";
+  child.stdout?.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.stderr?.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+
+  const result = await Promise.race([
+    once(child, "close").then(() => "close"),
+    once(child, "error").then(() => "error"),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs, "timeout")),
+  ]);
+
+  if (result === "timeout") {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+      // ignore
+    }
+    return undefined;
+  }
+
+  if (result === "error") {
+    return undefined;
+  }
+
+  return parseVersion(output.trim());
+}
+
+async function captureCommandOutput(
+  bin: string,
+  args: string[],
+  options?: { env?: NodeJS.ProcessEnv; timeoutMs?: number },
+): Promise<string> {
+  const resolved = resolveBinCommand(bin);
+  const child = spawnProcess(
+    resolved.command,
+    [...resolved.prefixArgs, ...args],
+    {
+      cwd: tmpdir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      env: options?.env ?? process.env,
+    },
+  );
+  let output = "";
+  child.stdout?.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.stderr?.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+
+  type CaptureResult =
+    | "timeout"
+    | "error"
+    | {
+        type: "close";
+        code: number | null;
+        signal: NodeJS.Signals | null;
+      };
+
+  const timeoutMs = options?.timeoutMs ?? 30_000;
+  const result = await Promise.race<CaptureResult>([
+    once(child, "close").then(([code, signal]) => ({
+      type: "close" as const,
+      code: (code ?? null) as number | null,
+      signal: (signal ?? null) as NodeJS.Signals | null,
+    })),
+    once(child, "error").then(() => "error" as const),
+    new Promise<CaptureResult>((resolve) =>
+      setTimeout(resolve, timeoutMs, "timeout"),
+    ),
+  ]);
+
+  if (result === "timeout") {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+      // ignore
+    }
+    throw new Error("Command timed out");
+  }
+
+  if (result === "error") {
+    throw new Error("Command failed to run");
+  }
+
+  const code = result.code;
+  if (code !== 0) {
+    const suffix = output.trim() ? `\n${output.trim()}` : "";
+    throw new Error(`Command failed: ${bin} ${args.join(" ")}${suffix}`);
+  }
+
+  return output.trim();
+}
+
+function assertVersionMatch(
+  name: string,
+  expected: string | undefined,
+  actual: string | undefined,
+  context: string,
+): void {
+  if (!expected) return;
+  if (!actual) {
+    throw new Error(
+      `Unable to determine ${name} version from ${context}. Expected ${expected}.`,
+    );
+  }
+  if (expected !== actual) {
+    throw new Error(
+      `${name} version mismatch: expected ${expected}, got ${actual}.`,
+    );
+  }
+}
+
+function resolveBinPath(bin: string): string {
+  if (bin.includes("/") || bin.startsWith(".")) {
+    return resolve(process.cwd(), bin);
+  }
+  return bin;
+}
+
+function isPathLikeBinary(bin: string): boolean {
+  return bin.includes("/") || bin.startsWith(".");
+}
+
+async function assertSandboxBinaryFile(
+  name: string,
+  bin: string,
+): Promise<void> {
+  const lower = bin.toLowerCase();
+  if (lower.endsWith(".js") || lower.endsWith(".ts")) {
+    throw new Error(
+      `Sandbox mode requires ${name} to be a native binary (got ${bin}). Use downloaded sidecars or pass a Linux binary path.`,
+    );
+  }
+  if (!isPathLikeBinary(bin)) {
+    throw new Error(
+      `Sandbox mode requires ${name} to be a file path (got ${bin}). Use downloaded sidecars or pass --${name}-bin with a Linux binary path.`,
+    );
+  }
+  const resolved = resolve(process.cwd(), bin);
+  if (!(await fileExists(resolved))) {
+    throw new Error(
+      `Sandbox mode could not find ${name} binary at ${resolved}.`,
+    );
+  }
+}
+
+async function resolveOpenworkServerBin(options: {
+  explicit?: string;
+  manifest: VersionManifest | null;
+  allowExternal: boolean;
+  sidecar: SidecarConfig;
+  source: BinarySourcePreference;
+}): Promise<ResolvedBinary> {
+  if (options.explicit && !options.allowExternal) {
+    throw new Error("openwork-server-bin requires --allow-external");
+  }
+  if (
+    options.explicit &&
+    options.source !== "auto" &&
+    options.source !== "external"
+  ) {
+    throw new Error(
+      "openwork-server-bin requires --sidecar-source external or auto",
+    );
+  }
+
+  const expectedVersion = await resolveExpectedVersion(
+    options.manifest,
+    "openwork-server",
+  );
+  const resolveExternal = async (): Promise<ResolvedBinary> => {
+    if (!options.allowExternal) {
+      throw new Error("External openwork-server requires --allow-external");
+    }
+    if (options.explicit) {
+      const resolved = resolveBinPath(options.explicit);
+      if (
+        (resolved.includes("/") || resolved.startsWith(".")) &&
+        !(await fileExists(resolved))
+      ) {
+        throw new Error(`openwork-server-bin not found: ${resolved}`);
+      }
+      return { bin: resolved, source: "external", expectedVersion };
+    }
+
+    const require = createRequire(import.meta.url);
+    try {
+      const pkgPath = require.resolve("openwork-server/package.json");
+      const pkgDir = dirname(pkgPath);
+      const binaryPath = join(pkgDir, "dist", "bin", "openwork-server");
+      if (await isExecutable(binaryPath)) {
+        return { bin: binaryPath, source: "external", expectedVersion };
+      }
+      const cliPath = join(pkgDir, "dist", "cli.js");
+      if (await isExecutable(cliPath)) {
+        return { bin: cliPath, source: "external", expectedVersion };
+      }
+    } catch {
+      // ignore
+    }
+
+    return { bin: "openwork-server", source: "external", expectedVersion };
+  };
+
+  if (options.source === "bundled") {
+    const bundled = await resolveBundledBinary(
+      options.manifest,
+      "openwork-server",
+    );
+    if (!bundled) {
+      throw new Error(
+        "Bundled openwork-server binary missing. Build with pnpm --filter openwork-orchestrator build:bin:bundled.",
+      );
+    }
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.source === "downloaded") {
+    const downloaded = await downloadSidecarBinary({
+      name: "openwork-server",
+      sidecar: options.sidecar,
+    });
+    if (!downloaded) {
+      throw new Error(
+        "openwork-server download failed. Check sidecar manifest or base URL.",
+      );
+    }
+    return downloaded;
+  }
+
+  if (options.source === "external") {
+    return resolveExternal();
+  }
+
+  const bundled = await resolveBundledBinary(
+    options.manifest,
+    "openwork-server",
+  );
+  if (bundled && !(options.allowExternal && options.explicit)) {
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.explicit) {
+    return resolveExternal();
+  }
+
+  const downloaded = await downloadSidecarBinary({
+    name: "openwork-server",
+    sidecar: options.sidecar,
+  });
+  if (downloaded) return downloaded;
+
+  if (!options.allowExternal) {
+    throw new Error(
+      "Bundled openwork-server binary missing and download failed. Use --allow-external or --sidecar-source external.",
+    );
+  }
+
+  return resolveExternal();
+}
+
+async function resolveOpencodeBin(options: {
+  explicit?: string;
+  manifest: VersionManifest | null;
+  allowExternal: boolean;
+  sidecar: SidecarConfig;
+  source: BinarySourcePreference;
+}): Promise<ResolvedBinary> {
+  if (options.explicit && !options.allowExternal) {
+    throw new Error("opencode-bin requires --allow-external");
+  }
+  if (
+    options.explicit &&
+    options.source !== "auto" &&
+    options.source !== "external"
+  ) {
+    throw new Error("opencode-bin requires --opencode-source external or auto");
+  }
+
+  const expectedVersion = await resolveExpectedVersion(
+    options.manifest,
+    "opencode",
+  );
+  const resolveExternal = async (): Promise<ResolvedBinary> => {
+    if (!options.allowExternal) {
+      throw new Error("External opencode requires --allow-external");
+    }
+    if (options.explicit) {
+      const resolved = resolveBinPath(options.explicit);
+      if (
+        (resolved.includes("/") || resolved.startsWith(".")) &&
+        !(await fileExists(resolved))
+      ) {
+        throw new Error(`opencode-bin not found: ${resolved}`);
+      }
+      return { bin: resolved, source: "external", expectedVersion };
+    }
+    return { bin: "opencode", source: "external", expectedVersion };
+  };
+
+  if (options.source === "bundled") {
+    const bundled = await resolveBundledBinary(options.manifest, "opencode");
+    if (!bundled) {
+      throw new Error(
+        "Bundled opencode binary missing. Build with pnpm --filter openwork-orchestrator build:bin:bundled.",
+      );
+    }
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.source === "downloaded") {
+    const downloaded = await downloadSidecarBinary({
+      name: "opencode",
+      sidecar: options.sidecar,
+      expectedVersion,
+    });
+    if (downloaded) return downloaded;
+    const opencodeDownloaded = await resolveOpencodeDownload(
+      options.sidecar,
+      expectedVersion,
+    );
+    if (opencodeDownloaded) {
+      return { bin: opencodeDownloaded, source: "downloaded", expectedVersion };
+    }
+    throw new Error(
+      "opencode download failed. Check sidecar manifest/network access, or update constants.json.",
+    );
+  }
+
+  if (options.source === "external") {
+    return resolveExternal();
+  }
+
+  const bundled = await resolveBundledBinary(options.manifest, "opencode");
+  if (bundled && !(options.allowExternal && options.explicit)) {
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.explicit) {
+    return resolveExternal();
+  }
+
+  const downloaded = await downloadSidecarBinary({
+    name: "opencode",
+    sidecar: options.sidecar,
+    expectedVersion,
+  });
+  if (downloaded) return downloaded;
+
+  const opencodeDownloaded = await resolveOpencodeDownload(
+    options.sidecar,
+    expectedVersion,
+  );
+  if (opencodeDownloaded) {
+    return { bin: opencodeDownloaded, source: "downloaded", expectedVersion };
+  }
+
+  if (!options.allowExternal) {
+    throw new Error(
+      "Bundled opencode binary missing and download failed. Use --allow-external or --opencode-source external.",
+    );
+  }
+
+  return resolveExternal();
+}
+
+async function resolveOpenCodeRouterBin(options: {
+  explicit?: string;
+  manifest: VersionManifest | null;
+  allowExternal: boolean;
+  sidecar: SidecarConfig;
+  source: BinarySourcePreference;
+}): Promise<ResolvedBinary> {
+  if (options.explicit && !options.allowExternal) {
+    throw new Error("opencode-router-bin requires --allow-external");
+  }
+  if (
+    options.explicit &&
+    options.source !== "auto" &&
+    options.source !== "external"
+  ) {
+    throw new Error(
+      "opencode-router-bin requires --sidecar-source external or auto",
+    );
+  }
+
+  const expectedVersion = await resolveExpectedVersion(
+    options.manifest,
+    "opencode-router",
+  );
+  const resolveExternal = async (): Promise<ResolvedBinary> => {
+    if (!options.allowExternal) {
+      throw new Error("External opencodeRouter requires --allow-external");
+    }
+    if (options.explicit) {
+      const resolved = resolveBinPath(options.explicit);
+      if (
+        (resolved.includes("/") || resolved.startsWith(".")) &&
+        !(await fileExists(resolved))
+      ) {
+        throw new Error(`opencode-router-bin not found: ${resolved}`);
+      }
+      return { bin: resolved, source: "external", expectedVersion };
+    }
+
+    const repoDir = await resolveOpenCodeRouterRepoDir();
+    if (repoDir) {
+      const binPath = join(repoDir, "dist", "bin", "opencode-router");
+      if (await isExecutable(binPath)) {
+        return { bin: binPath, source: "external", expectedVersion };
+      }
+      const cliPath = join(repoDir, "dist", "cli.js");
+      if (await fileExists(cliPath)) {
+        return { bin: cliPath, source: "external", expectedVersion };
+      }
+    }
+
+    const require = createRequire(import.meta.url);
+    try {
+      const pkgPath = require.resolve("opencode-router/package.json");
+      const pkgDir = dirname(pkgPath);
+      const binaryPath = join(pkgDir, "dist", "bin", "opencode-router");
+      if (await isExecutable(binaryPath)) {
+        return { bin: binaryPath, source: "external", expectedVersion };
+      }
+      const cliPath = join(pkgDir, "dist", "cli.js");
+      if (await isExecutable(cliPath)) {
+        return { bin: cliPath, source: "external", expectedVersion };
+      }
+    } catch {
+      // ignore
+    }
+
+    throw new Error(
+      "opencode-router binary not found. Install the opencode-router dependency or pass --opencode-router-bin with --allow-external.",
+    );
+  };
+
+  if (options.source === "bundled") {
+    const bundled = await resolveBundledBinary(
+      options.manifest,
+      "opencode-router",
+    );
+    if (!bundled) {
+      throw new Error(
+        "Bundled opencodeRouter binary missing. Build with pnpm --filter openwork-orchestrator build:bin:bundled.",
+      );
+    }
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.source === "downloaded") {
+    const downloaded = await downloadSidecarBinary({
+      name: "opencode-router",
+      sidecar: options.sidecar,
+    });
+    if (!downloaded) {
+      throw new Error(
+        "opencodeRouter download failed. Check sidecar manifest or base URL.",
+      );
+    }
+    return downloaded;
+  }
+
+  if (options.source === "external") {
+    return resolveExternal();
+  }
+
+  const bundled = await resolveBundledBinary(
+    options.manifest,
+    "opencode-router",
+  );
+  if (bundled && !(options.allowExternal && options.explicit)) {
+    return { bin: bundled, source: "bundled", expectedVersion };
+  }
+
+  if (options.explicit) {
+    return resolveExternal();
+  }
+
+  const downloaded = await downloadSidecarBinary({
+    name: "opencode-router",
+    sidecar: options.sidecar,
+  });
+  if (downloaded) return downloaded;
+
+  if (!options.allowExternal) {
+    throw new Error(
+      "Bundled opencodeRouter binary missing and download failed. Use --allow-external or --sidecar-source external.",
+    );
+  }
+
+  return resolveExternal();
+}
+
+function resolveRouterDataDir(flags: Map<string, string | boolean>): string {
+  const override = readFlag(flags, "data-dir") ?? process.env.OPENWORK_DATA_DIR;
+  if (override && override.trim()) {
+    return resolve(override.trim());
+  }
+  return join(homedir(), ".openwork", "openwork-orchestrator");
+}
+
+function resolveWorkspaceOpenworkConfigPath(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "openwork.json");
+}
+
+function resolveOpencodeRouterConfigPath(): string {
+  const override = process.env.OPENCODE_ROUTER_CONFIG_PATH?.trim();
+  if (override) return resolve(override.replace(/^~\//, `${homedir()}/`));
+  const dataDir =
+    process.env.OPENCODE_ROUTER_DATA_DIR?.trim() ||
+    join(homedir(), ".openwork", "opencode-router");
+  const expanded = dataDir.replace(/^~\//, `${homedir()}/`);
+  return join(resolve(expanded), "opencode-router.json");
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function readMessagingEnabledFromOpenworkConfig(
+  openworkConfig: Record<string, unknown>,
+): boolean | undefined {
+  const messaging = asRecord(openworkConfig.messaging);
+  return readOptionalBool(messaging.enabled);
+}
+
+function hasConfiguredMessagingServices(routerConfig: Record<string, unknown>): boolean {
+  const channels = asRecord(routerConfig.channels);
+
+  const telegram = asRecord(channels.telegram);
+  const legacyTelegramToken =
+    typeof telegram.token === "string" ? telegram.token.trim() : "";
+  if (legacyTelegramToken) return true;
+  const telegramBots = Array.isArray(telegram.bots) ? telegram.bots : [];
+  if (
+    telegramBots.some((bot) => {
+      const record = asRecord(bot);
+      return (
+        typeof record.token === "string" && record.token.trim().length > 0
+      );
+    })
+  ) {
+    return true;
+  }
+
+  const slack = asRecord(channels.slack);
+  const legacySlackBotToken =
+    typeof slack.botToken === "string" ? slack.botToken.trim() : "";
+  const legacySlackAppToken =
+    typeof slack.appToken === "string" ? slack.appToken.trim() : "";
+  if (legacySlackBotToken && legacySlackAppToken) return true;
+  const slackApps = Array.isArray(slack.apps) ? slack.apps : [];
+  if (
+    slackApps.some((app) => {
+      const record = asRecord(app);
+      const botToken =
+        typeof record.botToken === "string" ? record.botToken.trim() : "";
+      const appToken =
+        typeof record.appToken === "string" ? record.appToken.trim() : "";
+      return Boolean(botToken && appToken);
+    })
+  ) {
+    return true;
+  }
+
+  return false;
+}
+
+async function resolveOpencodeRouterEnabled(
+  flags: Map<string, string | boolean>,
+  workspaceRoot: string,
+  logger: Logger,
+): Promise<{
+  enabled: boolean;
+  source: "flag" | "env" | "workspace-config" | "inferred";
+}> {
+  const flagValue = flags.get("opencode-router");
+  const parsedFlag = readOptionalBool(flagValue);
+  if (parsedFlag !== undefined) {
+    return { enabled: parsedFlag, source: "flag" };
+  }
+
+  const envValue = readOptionalBool(
+    process.env.OPENWORK_OPENCODE_ROUTER,
+  );
+  if (envValue !== undefined) {
+    return { enabled: envValue, source: "env" };
+  }
+
+  const openworkConfigPath = resolveWorkspaceOpenworkConfigPath(workspaceRoot);
+  let openworkConfig: Record<string, unknown> = {};
+  try {
+    const raw = await readFile(openworkConfigPath, "utf8");
+    openworkConfig = asRecord(JSON.parse(raw));
+  } catch {
+    openworkConfig = {};
+  }
+
+  const configured = readMessagingEnabledFromOpenworkConfig(openworkConfig);
+  if (configured !== undefined) {
+    return { enabled: configured, source: "workspace-config" };
+  }
+
+  let inferredEnabled = false;
+  const routerConfigPath = resolveOpencodeRouterConfigPath();
+  try {
+    const raw = await readFile(routerConfigPath, "utf8");
+    inferredEnabled = hasConfiguredMessagingServices(asRecord(JSON.parse(raw)));
+  } catch {
+    inferredEnabled = false;
+  }
+
+  const nextOpenworkConfig: Record<string, unknown> = {
+    ...openworkConfig,
+    messaging: {
+      ...asRecord(openworkConfig.messaging),
+      enabled: inferredEnabled,
+    },
+  };
+
+  try {
+    await mkdir(dirname(openworkConfigPath), { recursive: true });
+    await writeFile(
+      openworkConfigPath,
+      `${JSON.stringify(nextOpenworkConfig, null, 2)}\n`,
+      "utf8",
+    );
+  } catch (error) {
+    logger.warn(
+      "Failed to persist messaging enabled default",
+      {
+        path: openworkConfigPath,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      "openwork-orchestrator",
+    );
+  }
+
+  return { enabled: inferredEnabled, source: "inferred" };
+}
+
+function resolveInternalDevMode(flags: Map<string, string | boolean>): boolean {
+  return readBool(flags, "internal-dev-mode", false, "OPENWORK_DEV_MODE");
+}
+
+function internalDevModeFromEnv(): boolean {
+  const value = process.env.OPENWORK_DEV_MODE?.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes" || value === "on";
+}
+
+function resolveOpencodeStateLayout(options: {
+  dataDir: string;
+  workspace: string;
+  devMode: boolean;
+}): OpencodeStateLayout {
+  if (!options.devMode) {
+    return {
+      devMode: false,
+      rootDir: join(options.dataDir, "opencode-config"),
+      configDir: join(options.dataDir, "opencode-config"),
+      env: {},
+    };
+  }
+
+  const rootDir = join(options.dataDir, OPENWORK_DEV_DATA_DIR);
+  const homeDir = join(rootDir, "home");
+  const xdgConfigHome = join(rootDir, "xdg", "config");
+  const xdgDataHome = join(rootDir, "xdg", "data");
+  const xdgCacheHome = join(rootDir, "xdg", "cache");
+  const xdgStateHome = join(rootDir, "xdg", "state");
+  const configDir = join(rootDir, "config", "opencode");
+
+  return {
+    devMode: true,
+    rootDir,
+    configDir,
+    importConfigDir:
+      process.env.OPENWORK_DEV_OPENCODE_IMPORT_CONFIG_DIR?.trim() || undefined,
+    importDataDir:
+      process.env.OPENWORK_DEV_OPENCODE_IMPORT_DATA_DIR?.trim() || undefined,
+    env: {
+      OPENWORK_DEV_MODE: "1",
+      OPENCODE_TEST_HOME: homeDir,
+      HOME: homeDir,
+      XDG_CONFIG_HOME: xdgConfigHome,
+      XDG_DATA_HOME: xdgDataHome,
+      XDG_CACHE_HOME: xdgCacheHome,
+      XDG_STATE_HOME: xdgStateHome,
+      OPENCODE_CONFIG_DIR: configDir,
+    },
+  };
+}
+
+async function ensureOpencodeStateLayout(
+  layout: OpencodeStateLayout,
+): Promise<void> {
+  await mkdir(layout.configDir, { recursive: true });
+  if (!layout.devMode) return;
+
+  const homeDir = layout.env.HOME;
+  const xdgConfigHome = layout.env.XDG_CONFIG_HOME;
+  const xdgDataHome = layout.env.XDG_DATA_HOME;
+  const xdgCacheHome = layout.env.XDG_CACHE_HOME;
+  const xdgStateHome = layout.env.XDG_STATE_HOME;
+  const opencodeDataDir = xdgDataHome
+    ? join(xdgDataHome, "opencode")
+    : undefined;
+
+  for (const dir of [
+    layout.rootDir,
+    homeDir,
+    xdgConfigHome,
+    xdgDataHome,
+    xdgCacheHome,
+    xdgStateHome,
+    opencodeDataDir,
+  ]) {
+    if (!dir) continue;
+    await mkdir(dir, { recursive: true });
+  }
+
+  if (layout.importConfigDir && (await isDir(layout.importConfigDir))) {
+    const entries = await readdir(layout.configDir).catch(() => [] as string[]);
+    if (entries.length === 0) {
+      await cp(layout.importConfigDir, layout.configDir, {
+        recursive: true,
+        force: false,
+      }).catch(() => undefined);
+    }
+  }
+
+  if (
+    layout.importDataDir &&
+    opencodeDataDir &&
+    (await isDir(layout.importDataDir))
+  ) {
+    for (const file of ["auth.json", "mcp-auth.json"]) {
+      const dest = join(opencodeDataDir, file);
+      if (await fileExists(dest)) continue;
+      const source = join(layout.importDataDir, file);
+      if (await fileExists(source)) {
+        await copyFile(source, dest).catch(() => undefined);
+      }
+    }
+  }
+}
+
+function routerStatePath(dataDir: string): string {
+  return join(dataDir, "openwork-orchestrator-state.json");
+}
+
+function nowMs(): number {
+  return Date.now();
+}
+
+async function loadRouterState(path: string): Promise<RouterState> {
+  try {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw) as RouterState;
+    if (!parsed.workspaces) parsed.workspaces = [];
+    if (!parsed.activeId) parsed.activeId = "";
+    if (!parsed.version) parsed.version = 1;
+    return parsed;
+  } catch {
+    return {
+      version: 1,
+      daemon: undefined,
+      opencode: undefined,
+      cliVersion: undefined,
+      sidecar: undefined,
+      binaries: undefined,
+      activeId: "",
+      workspaces: [],
+    };
+  }
+}
+
+async function saveRouterState(
+  path: string,
+  state: RouterState,
+): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  const payload = JSON.stringify(state, null, 2);
+  await writeFile(path, `${payload}\n`, "utf8");
+}
+
+function normalizeWorkspacePath(input: string): string {
+  return resolve(input).replace(/[\\/]+$/, "");
+}
+
+function workspaceIdForLocal(path: string): string {
+  return `ws-${createHash("sha1").update(path).digest("hex").slice(0, 12)}`;
+}
+
+function workspaceIdForRemote(
+  baseUrl: string,
+  directory?: string | null,
+): string {
+  const key = directory ? `${baseUrl}::${directory}` : baseUrl;
+  return `ws-${createHash("sha1").update(key).digest("hex").slice(0, 12)}`;
+}
+
+function opencodeRouterSendToolSource(): string {
+  return [
+    'import { tool } from "@opencode-ai/plugin"',
+    "",
+    "const redactTarget = (value) => {",
+    "  const text = String(value || '').trim()",
+    "  if (!text) return ''",
+    "  if (text.length <= 6) return 'hidden'",
+    "  return `${text.slice(0, 2)}…${text.slice(-2)}`",
+    "}",
+    "",
+    "const buildGuidance = (result) => {",
+    "  const sent = Number(result?.sent || 0)",
+    "  const attempted = Number(result?.attempted || 0)",
+    "  const reason = String(result?.reason || '')",
+    "  const failures = Array.isArray(result?.failures) ? result.failures : []",
+    "",
+    "  if (sent > 0 && failures.length === 0) return 'Delivered successfully.'",
+    "  if (sent > 0) return 'Delivered to at least one conversation, but some targets failed.'",
+    "",
+    "  const chatNotFound = failures.some((item) => /chat not found/i.test(String(item?.error || '')))",
+    "  if (chatNotFound) {",
+    "    return 'Delivery failed because the recipient has not started a chat with the bot yet. Ask them to send /start, then retry.'",
+    "  }",
+    "",
+    "  if (/No bound conversations/i.test(reason)) {",
+    "    return 'No linked conversation found for this workspace yet. Ask the recipient to message the bot first, then retry.'",
+    "  }",
+    "",
+    "  if (attempted === 0) return 'No eligible delivery target found.'",
+    "  return 'Delivery failed. Retry after confirming the recipient and bot linkage.'",
+    "}",
+    "",
+    "export default tool({",
+    '  description: "Send a message via opencodeRouter (Telegram/Slack) to a peer or directory bindings.",',
+    "  args: {",
+    '    text: tool.schema.string().describe("Message text to send"),',
+    '    channel: tool.schema.enum(["telegram", "slack"]).optional().describe("Channel to send on (default: telegram)"),',
+    '    identityId: tool.schema.string().optional().describe("OpenCodeRouter identity id (default: all identities)"),',
+    '    directory: tool.schema.string().optional().describe("Directory to target for fan-out (default: current session directory)"),',
+    '    peerId: tool.schema.string().optional().describe("Direct destination peer id (chat/thread id)"),',
+    '    autoBind: tool.schema.boolean().optional().describe("When direct sending, bind peerId to directory if provided"),',
+    "  },",
+    "  async execute(args, context) {",
+    '    const rawPort = (process.env.OPENCODE_ROUTER_HEALTH_PORT || "3005").trim()',
+    "    const port = Number(rawPort)",
+    "    if (!Number.isFinite(port) || port <= 0) {",
+    "      throw new Error(`Invalid OPENCODE_ROUTER_HEALTH_PORT: ${rawPort}`)",
+    "    }",
+    '    const channel = (args.channel || "telegram").trim()',
+    '    if (channel !== "telegram" && channel !== "slack") {',
+    '      throw new Error("channel must be telegram or slack")',
+    "    }",
+    '    const text = String(args.text || "")',
+    '    if (!text.trim()) throw new Error("text is required")',
+    '    const directory = (args.directory || context.directory || "").trim()',
+    '    const peerId = String(args.peerId || "").trim()',
+    '    if (!directory && !peerId) throw new Error("Either directory or peerId is required")',
+    "    const payload = {",
+    "      channel,",
+    "      text,",
+    "      ...(args.identityId ? { identityId: String(args.identityId) } : {}),",
+    "      ...(directory ? { directory } : {}),",
+    "      ...(peerId ? { peerId } : {}),",
+    "      ...(args.autoBind === true ? { autoBind: true } : {}),",
+    "    }",
+    "    const response = await fetch(`http://127.0.0.1:${port}/send`, {",
+    '      method: "POST",',
+    '      headers: { "Content-Type": "application/json" },',
+    "      body: JSON.stringify(payload),",
+    "    })",
+    "    const body = await response.text()",
+    "    let json = null",
+    "    try {",
+    "      json = JSON.parse(body)",
+    "    } catch {",
+    "      json = null",
+    "    }",
+    "    if (!response.ok) {",
+    "      throw new Error(`opencodeRouter /send failed (${response.status}): ${body}`)",
+    "    }",
+    "",
+    "    const sent = Number(json?.sent || 0)",
+    "    const attempted = Number(json?.attempted || 0)",
+    "    const reason = typeof json?.reason === 'string' ? json.reason : ''",
+    "    const failuresRaw = Array.isArray(json?.failures) ? json.failures : []",
+    "    const failures = failuresRaw.map((item) => ({",
+    "      identityId: String(item?.identityId || ''),",
+    "      error: String(item?.error || 'delivery failed'),",
+    "      ...(item?.peerId ? { target: redactTarget(item.peerId) } : {}),",
+    "    }))",
+    "",
+    "    const result = {",
+    "      ok: true,",
+    "      channel,",
+    "      sent,",
+    "      attempted,",
+    "      guidance: buildGuidance({ sent, attempted, reason, failures }),",
+    "      ...(reason ? { reason } : {}),",
+    "      ...(failures.length ? { failures } : {}),",
+    "    }",
+    "    return JSON.stringify(result, null, 2)",
+    "  },",
+    "})",
+    "",
+  ].join("\n");
+}
+
+function opencodeRouterStatusToolSource(): string {
+  return [
+    'import { tool } from "@opencode-ai/plugin"',
+    "",
+    "const redactTarget = (value) => {",
+    "  const text = String(value || '').trim()",
+    "  if (!text) return ''",
+    "  if (text.length <= 6) return 'hidden'",
+    "  return `${text.slice(0, 2)}…${text.slice(-2)}`",
+    "}",
+    "",
+    "const isNumericTelegramPeerId = (value) => /^-?\\d+$/.test(String(value || '').trim())",
+    "",
+    "export default tool({",
+    '  description: "Check opencodeRouter messaging readiness (health, identities, bindings).",',
+    "  args: {",
+    '    channel: tool.schema.enum(["telegram", "slack"]).optional().describe("Channel to inspect (default: telegram)"),',
+    '    identityId: tool.schema.string().optional().describe("Identity id to scope checks"),',
+    '    directory: tool.schema.string().optional().describe("Directory to inspect bindings for (default: current session directory)"),',
+    '    peerId: tool.schema.string().optional().describe("Peer id to inspect bindings for"),',
+    '    includeBindings: tool.schema.boolean().optional().describe("Include binding details (default: false)"),',
+    "  },",
+    "  async execute(args, context) {",
+    '    const rawPort = (process.env.OPENCODE_ROUTER_HEALTH_PORT || "3005").trim()',
+    "    const port = Number(rawPort)",
+    "    if (!Number.isFinite(port) || port <= 0) {",
+    "      throw new Error(`Invalid OPENCODE_ROUTER_HEALTH_PORT: ${rawPort}`)",
+    "    }",
+    '    const channel = (args.channel || "telegram").trim()',
+    '    if (channel !== "telegram" && channel !== "slack") {',
+    '      throw new Error("channel must be telegram or slack")',
+    "    }",
+    '    const identityId = String(args.identityId || "").trim()',
+    '    const directory = (args.directory || context.directory || "").trim()',
+    '    const peerId = String(args.peerId || "").trim()',
+    "    const targetValid = channel !== 'telegram' || !peerId || isNumericTelegramPeerId(peerId)",
+    "    const includeBindings = args.includeBindings === true",
+    "",
+    "    const fetchJson = async (path) => {",
+    "      const response = await fetch(`http://127.0.0.1:${port}${path}`)",
+    "      const body = await response.text()",
+    "      let json = null",
+    "      try {",
+    "        json = JSON.parse(body)",
+    "      } catch {",
+    "        json = null",
+    "      }",
+    "      if (!response.ok) {",
+    '        return { ok: false, status: response.status, json, error: typeof json?.error === "string" ? json.error : body }',
+    "      }",
+    "      return { ok: true, status: response.status, json }",
+    "    }",
+    "",
+    "    const health = await fetchJson('/health')",
+    "    const identities = await fetchJson(`/identities/${channel}`)",
+    "    let bindings = null",
+    "    if (includeBindings) {",
+    "      const search = new URLSearchParams()",
+    "      search.set('channel', channel)",
+    "      if (identityId) search.set('identityId', identityId)",
+    "      bindings = await fetchJson(`/bindings?${search.toString()}`)",
+    "    }",
+    "",
+    "    const identityItems = Array.isArray(identities?.json?.items) ? identities.json.items : []",
+    "    const scopedIdentityItems = identityId",
+    "      ? identityItems.filter((item) => String(item?.id || '').trim() === identityId)",
+    "      : identityItems",
+    "    const runningItems = scopedIdentityItems.filter((item) => item && item.enabled === true && item.running === true)",
+    "    const enabledItems = scopedIdentityItems.filter((item) => item && item.enabled === true)",
+    "",
+    "    const bindingItems = Array.isArray(bindings?.json?.items) ? bindings.json.items : []",
+    "    const filteredBindings = bindingItems.filter((item) => {",
+    "      if (!item || typeof item !== 'object') return false",
+    "      if (directory && String(item.directory || '').trim() !== directory) return false",
+    "      if (peerId && String(item.peerId || '').trim() !== peerId) return false",
+    "      return true",
+    "    })",
+    "    const publicBindings = filteredBindings.map((item) => ({",
+    "      channel: String(item.channel || channel),",
+    "      identityId: String(item.identityId || ''),",
+    "      directory: String(item.directory || ''),",
+    "      ...(item?.peerId ? { target: redactTarget(item.peerId) } : {}),",
+    "      updatedAt: item?.updatedAt,",
+    "    }))",
+    "",
+    "    let ready = false",
+    "    let guidance = ''",
+    "    let nextAction = ''",
+    "    if (!health.ok) {",
+    "      guidance = 'OpenCode Router health endpoint is unavailable'",
+    "      nextAction = 'check_router_health'",
+    "    } else if (!identities.ok) {",
+    "      guidance = `Identity lookup failed for ${channel}`",
+    "      nextAction = 'check_identity_config'",
+    "    } else if (runningItems.length === 0) {",
+    "      guidance = `No running ${channel} identity`",
+    "      nextAction = 'start_identity'",
+    "    } else if (!targetValid) {",
+    "      guidance = 'Telegram direct targets must be numeric chat IDs. Prefer linked conversations over asking users for raw IDs.'",
+    "      nextAction = 'use_linked_conversation'",
+    "    } else if (peerId) {",
+    "      ready = true",
+    "      guidance = 'Ready for direct send'",
+    "      nextAction = 'send_direct'",
+    "    } else if (directory) {",
+    "      ready = filteredBindings.length > 0",
+    "      guidance = ready",
+    "        ? 'Ready for directory fan-out send'",
+    "        : channel === 'telegram'",
+    "          ? 'No linked Telegram conversations yet. Ask the recipient to message your bot (for example /start), then retry.'",
+    "          : 'No linked conversations found for this directory yet'",
+    "      nextAction = ready ? 'send_directory' : channel === 'telegram' ? 'wait_for_recipient_start' : 'link_conversation'",
+    "    } else {",
+    "      ready = true",
+    "      guidance = 'Ready. Provide a message target (peer or directory).'",
+    "      nextAction = 'choose_target'",
+    "    }",
+    "",
+    "    const result = {",
+    "      ok: health.ok && identities.ok && (!bindings || bindings.ok),",
+    "      ready,",
+    "      guidance,",
+    "      nextAction,",
+    "      channel,",
+    "      ...(identityId ? { identityId } : {}),",
+    "      ...(directory ? { directory } : {}),",
+    "      ...(peerId ? { targetProvided: true } : {}),",
+    "      ...(peerId ? { targetValid } : {}),",
+    "      health: {",
+    "        ok: health.ok,",
+    "        status: health.status,",
+    "        error: health.ok ? undefined : health.error,",
+    "        snapshot: health.ok ? health.json : undefined,",
+    "      },",
+    "      identities: {",
+    "        ok: identities.ok,",
+    "        status: identities.status,",
+    "        error: identities.ok ? undefined : identities.error,",
+    "        configured: scopedIdentityItems.length,",
+    "        enabled: enabledItems.length,",
+    "        running: runningItems.length,",
+    "        items: scopedIdentityItems,",
+    "      },",
+    "      ...(includeBindings",
+    "        ? {",
+    "            bindings: {",
+    "              ok: Boolean(bindings?.ok),",
+    "              status: bindings?.status,",
+    "              error: bindings?.ok ? undefined : bindings?.error,",
+    "              count: filteredBindings.length,",
+    "              items: publicBindings,",
+    "            },",
+    "          }",
+    "        : {}),",
+    "    }",
+    "    return JSON.stringify(result, null, 2)",
+    "  },",
+    "})",
+    "",
+  ].join("\n");
+}
+
+async function ensureOpencodeManagedTools(configDir: string): Promise<void> {
+  const toolsDir = join(configDir, "tools");
+  await mkdir(toolsDir, { recursive: true });
+  const writeManagedTool = async (name: string, source: string) => {
+    const toolPath = join(toolsDir, name);
+    const content = `${source}\n`;
+    try {
+      const existing = await readFile(toolPath, "utf8");
+      if (existing === content) return;
+    } catch {
+      // ignore
+    }
+    await writeFile(toolPath, content, "utf8");
+  };
+
+  await writeManagedTool(
+    "opencode_router_send.ts",
+    opencodeRouterSendToolSource(),
+  );
+  await writeManagedTool(
+    "opencode_router_status.ts",
+    opencodeRouterStatusToolSource(),
+  );
+}
+
+function findWorkspace(
+  state: RouterState,
+  input: string,
+): RouterWorkspace | undefined {
+  const trimmed = input.trim();
+  if (!trimmed) return undefined;
+  const direct = state.workspaces.find(
+    (entry) => entry.id === trimmed || entry.name === trimmed,
+  );
+  if (direct) return direct;
+  const normalized = normalizeWorkspacePath(trimmed);
+  return state.workspaces.find(
+    (entry) => entry.path && normalizeWorkspacePath(entry.path) === normalized,
+  );
+}
+
+function isProcessAlive(pid?: number): boolean {
+  if (!pid || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function resolveSelfCommand(): { command: string; prefixArgs: string[] } {
+  const arg1 = process.argv[1];
+  if (!arg1) return { command: process.argv[0], prefixArgs: [] };
+  if (arg1.endsWith(".js") || arg1.endsWith(".ts")) {
+    return { command: process.argv[0], prefixArgs: [arg1] };
+  }
+  return { command: process.argv[0], prefixArgs: [] };
+}
+
+async function waitForHealthy(
+  url: string,
+  timeoutMs = 10_000,
+  pollMs = 250,
+): Promise<void> {
+  const start = Date.now();
+  let lastError: string | null = null;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(`${url.replace(/\/$/, "")}/health`);
+      if (response.ok) return;
+      lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(lastError ?? "Timed out waiting for health check");
+}
+
+async function fetchOpenCodeRouterHealth(
+  baseUrl: string,
+): Promise<OpenCodeRouterHealthSnapshot> {
+  return (await fetchJson(
+    `${baseUrl.replace(/\/$/, "")}/health`,
+  )) as OpenCodeRouterHealthSnapshot;
+}
+
+async function fetchOpenCodeRouterHealthViaOpenwork(
+  openworkUrl: string,
+  token: string,
+): Promise<OpenCodeRouterHealthSnapshot> {
+  const url = `${openworkUrl.replace(/\/$/, "")}/opencode-router/health`;
+  return (await fetchJson(url, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+  })) as OpenCodeRouterHealthSnapshot;
+}
+
+async function waitForOpenCodeRouterHealthy(
+  baseUrl: string,
+  timeoutMs = 10_000,
+  pollMs = 500,
+) {
+  const start = Date.now();
+  let lastError: string | null = null;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(`${baseUrl.replace(/\/$/, "")}/health`);
+      if (response.ok) {
+        return (await response.json()) as OpenCodeRouterHealthSnapshot;
+      }
+      lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(lastError ?? "Timed out waiting for opencodeRouter health");
+}
+
+async function waitForOpenCodeRouterHealthyViaOpenwork(
+  openworkUrl: string,
+  token: string,
+  timeoutMs = 10_000,
+  pollMs = 500,
+): Promise<OpenCodeRouterHealthSnapshot> {
+  const url = `${openworkUrl.replace(/\/$/, "")}/opencode-router/health`;
+  const start = Date.now();
+  let lastError: string | null = null;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(url, {
+        headers: {
+          Authorization: `Bearer ${token}`,
+        },
+      });
+      if (response.ok) {
+        return (await response.json()) as OpenCodeRouterHealthSnapshot;
+      }
+      lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(
+    lastError ??
+      "Timed out waiting for opencodeRouter health via openwork-server",
+  );
+}
+
+async function waitForOpencodeHealthy(
+  client: ReturnType<typeof createOpencodeClient>,
+  timeoutMs = 10_000,
+  pollMs = 250,
+) {
+  const start = Date.now();
+  let lastError: string | null = null;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const health = unwrap(await client.global.health());
+      if (health?.healthy) return health;
+      lastError = "Server reported unhealthy";
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+
+    try {
+      // Some environments have a broken OpenCode /health probe even while the
+      // core API surface is already usable. Accept a successful path lookup as
+      // readiness so session APIs can come up in those runtimes.
+      unwrap(await client.path.get());
+      return { healthy: true, degraded: true, reason: lastError ?? undefined };
+    } catch (error) {
+      if (!lastError) {
+        lastError = error instanceof Error ? error.message : String(error);
+      }
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(lastError ?? "Timed out waiting for OpenCode health");
+}
+
+/**
+ * In sandbox mode the released openwork-server binary may not have our latest
+ * token/proxy changes.  Instead of relying on the OpenCode SDK client (which
+ * sends Bearer auth that the proxy may not understand yet), we do a simple
+ * HTTP fetch through the proxy path.  The server's /opencode/* proxy already
+ * forwards to the internal opencode port; we just need to check that it
+ * returns a 2xx from /opencode/health (or falls through to opencode's own
+ * /health endpoint).
+ *
+ * We try multiple path patterns because:
+ * - `/opencode/health` — most common OpenCode health endpoint proxied by the
+ *   server's catch-all /opencode/* route.
+ * - `/health` on the openwork-server itself — already verified by the caller,
+ *   but serves as a fallback signal.
+ */
+async function waitForHealthyViaProxy(
+  proxyBaseUrl: string,
+  token: string,
+  timeoutMs = 10_000,
+  pollMs = 250,
+): Promise<void> {
+  const start = Date.now();
+  let lastError: string | null = null;
+  const headers: Record<string, string> = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+
+  while (Date.now() - start < timeoutMs) {
+    try {
+      // Try the proxied opencode health endpoint.
+      const res = await fetch(`${proxyBaseUrl}/health`, {
+        headers,
+        signal: AbortSignal.timeout(2000),
+      });
+      if (res.ok) return;
+      // Some older server versions may return 401/403 on the proxy but that
+      // still proves the server is up and proxying.  Accept any non-5xx as
+      // "alive" — the real auth validation happens in verifyOpenworkServer.
+      if (res.status < 500) return;
+      lastError = `Proxy returned ${res.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(
+    lastError ?? "Timed out waiting for OpenCode health via proxy",
+  );
+}
+
+function printHelp(): void {
+  const message = [
+    "openwork",
+    "",
+    "Usage:",
+    "  openwork start [--workspace <path>] [options]",
+    "  openwork serve [--workspace <path>] [options]",
+    "  openwork daemon [run|start|stop|status] [options]",
+    "  openwork workspace <action> [options]",
+    "  openwork instance dispose <id> [options]",
+    "  openwork approvals list --openwork-url <url> --host-token <token>",
+    "  openwork approvals reply <id> --allow|--deny --openwork-url <url> --host-token <token>",
+    "  openwork files <action> [options]",
+    "  openwork status [--openwork-url <url>] [--opencode-url <url>]",
+    "",
+    "Commands:",
+    "  start                   Start OpenCode + OpenWork server + OpenCodeRouter",
+    "  serve                   Start services and stream logs (no TUI)",
+    "  daemon                  Run orchestrator router daemon (multi-workspace)",
+    "  workspace               Manage workspaces (add/list/switch/path)",
+    "  instance                Manage workspace instances (dispose)",
+    "  approvals list           List pending approval requests",
+    "  approvals reply <id>     Approve or deny a request",
+    "  files                   Manage file sessions and batch file sync",
+    "  status                  Check OpenCode/OpenWork health",
+    "",
+    "Options:",
+    "  --workspace <path>        Workspace directory (default: cwd)",
+    "  --data-dir <path>         Data dir for orchestrator router state",
+    "  --daemon-host <host>      Host for orchestrator router daemon (default: 127.0.0.1)",
+    "  --daemon-port <port>      Port for orchestrator router daemon (default: random)",
+    "  --opencode-bin <path>     Path to opencode binary (requires --allow-external)",
+    "  --opencode-host <host>    Bind host for opencode serve (loopback only, default: 127.0.0.1)",
+    "  --opencode-port <port>    Port for opencode serve (default: random)",
+    "  --opencode-workdir <p>    Workdir for router-managed opencode serve",
+    "  --opencode-log-level <l>  Log level for opencode serve (DEBUG, INFO, WARN, ERROR; default: opencode default)",
+    "  --opencode-auth           OpenCode basic auth is always enabled",
+    "  --opencode-hot-reload     Enable OpenCode hot reload (default: true)",
+    "  --opencode-hot-reload-debounce-ms <ms>  Debounce window for hot reload triggers (default: 700)",
+    "  --opencode-hot-reload-cooldown-ms <ms>  Minimum interval between hot reloads (default: 1500)",
+    "  --opencode-username <u>   Internal-only override for managed OpenCode auth username",
+    "  --opencode-password <p>   Internal-only override for managed OpenCode auth password",
+    "  --openwork-host <host>    Bind host for openwork-server (default: 127.0.0.1)",
+    "  --openwork-port <port>    Port for openwork-server (default: 8787)",
+    "  --remote-access           Expose OpenWork on 0.0.0.0 for remote sharing",
+    "  --openwork-token <token>  Client token for openwork-server",
+    "  --openwork-host-token <t> Host token for approvals",
+    "  --workspace-id <id>       Workspace id for file session commands",
+    "  --session-id <id>         File session id for file session commands",
+    "  --path <path>             Workspace-relative file path",
+    "  --paths <list>            Comma-separated list of workspace-relative file paths",
+    "  --ttl-seconds <n>         File session TTL in seconds",
+    "  --content <text>          Inline content for file writes",
+    "  --content-base64 <b64>    Base64 content for file writes",
+    "  --file <path>             Local file path for file writes",
+    "  --if-match <revision>     Revision precondition for file writes",
+    "  --from <path>             Source path for rename",
+    "  --to <path>               Destination path for rename",
+    "  --write                   Request writable file session",
+    "  --force                   Force write despite revision mismatch",
+    "  --recursive               Recursive delete for files delete",
+    "  --approval <mode>         manual | auto (default: manual)",
+    "  --approval-timeout <ms>   Approval timeout in ms",
+    "  --read-only               Start OpenWork server in read-only mode",
+    "  --cors <origins>          Comma-separated CORS origins or *",
+    "  --connect-host <host>     Override LAN host used for pairing URLs",
+    "  --openwork-server-bin <p> Path to openwork-server binary (requires --allow-external)",
+    "  --opencode-router-bin <path>     Path to opencodeRouter binary (requires --allow-external)",
+    "  --opencode-router-health-port <p> Health server port for opencodeRouter (default: random)",
+    "  --opencode-router                Enable opencodeRouter sidecar (default from workspace messaging config)",
+    "  --no-opencode-router             Disable opencodeRouter sidecar",
+    "  --opencode-router-required       Exit if opencodeRouter stops",
+    "  --allow-external          Allow external sidecar binaries (dev only, required for custom bins)",
+    "  --sidecar-dir <path>      Cache directory for downloaded sidecars",
+    "  --sidecar-base-url <url>  Base URL for sidecar downloads",
+    "  --sidecar-manifest <url>  Override sidecar manifest URL",
+    "  --sidecar-source <mode>   auto | bundled | downloaded | external",
+    "  --opencode-source <mode>  auto | bundled | downloaded | external",
+    "  --check                   Run health checks then exit",
+    "  --check-events            Verify SSE events during check",
+    "  --tui                     Force interactive dashboard (TTY only)",
+    "  --no-tui                  Disable interactive dashboard",
+    "  --detach                  Detach after start and keep services running",
+    "  --sandbox <mode>          none | auto | docker | container (default: none)",
+    "  --sandbox-image <ref>     Container image for sandbox mode",
+    "  --sandbox-persist-dir <p> Persist dir mounted into sandbox (default: per-workspace)",
+    "  --sandbox-mount <specs>   Extra mounts (validated): hostPath:subpath[:ro|rw] (requires allowlist)",
+    "  --json                    Output JSON when applicable",
+    "  --verbose                 Print additional diagnostics",
+    "  --log-format <format>     Log output format: pretty | json",
+    "  --color                   Force ANSI color output",
+    "  --no-color                Disable ANSI color output",
+    "  --run-id <id>             Correlation id for logs (default: random UUID)",
+    "  --help                    Show help",
+    "  --version                 Show version",
+  ].join("\n");
+  console.log(message);
+}
+
+async function stopChild(
+  child: ReturnType<typeof spawn>,
+  timeoutMs = 2500,
+): Promise<void> {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    child.kill("SIGTERM");
+  } catch {
+    return;
+  }
+  const exited = await Promise.race([
+    once(child, "exit").then(() => true),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs, false)),
+  ]);
+  if (exited) return;
+  try {
+    child.kill("SIGKILL");
+  } catch {
+    return;
+  }
+  await Promise.race([
+    once(child, "exit").then(() => true),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs, false)),
+  ]);
+}
+
+async function startOpencode(options: {
+  bin: string;
+  workspace: string;
+  stateLayout?: OpencodeStateLayout;
+  hotReload: OpencodeHotReload;
+  bindHost: string;
+  port: number;
+  username?: string;
+  password?: string;
+  corsOrigins: string[];
+  logger: Logger;
+  runId: string;
+  logFormat: LogFormat;
+  logLevel?: string;
+  opencodeRouterHealthPort?: number;
+}) {
+  const args = [
+    "serve",
+    "--hostname",
+    options.bindHost,
+    "--port",
+    String(options.port),
+  ];
+  if (options.logLevel) {
+    args.push("--log-level", options.logLevel);
+  }
+  for (const origin of options.corsOrigins) {
+    args.push("--cors", origin);
+  }
+
+  const child = spawnProcess(options.bin, args, {
+    cwd: options.workspace,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      ...(options.stateLayout?.env ?? {}),
+      OPENCODE_CLIENT: "openwork-orchestrator",
+      OPENWORK: "1",
+      OPENWORK_RUN_ID: options.runId,
+      OPENWORK_LOG_FORMAT: options.logFormat,
+      OTEL_RESOURCE_ATTRIBUTES: mergeResourceAttributes(
+        {
+          "service.name": "opencode",
+          "service.instance.id": options.runId,
+        },
+        process.env.OTEL_RESOURCE_ATTRIBUTES,
+      ),
+      ...(options.username
+        ? { OPENCODE_SERVER_USERNAME: options.username }
+        : {}),
+      ...(options.password
+        ? { OPENCODE_SERVER_PASSWORD: options.password }
+        : {}),
+      ...(options.stateLayout?.configDir
+        ? { OPENCODE_CONFIG_DIR: options.stateLayout.configDir }
+        : {}),
+      OPENCODE_HOT_RELOAD: options.hotReload.enabled ? "1" : "0",
+      OPENCODE_HOT_RELOAD_DEBOUNCE_MS: String(options.hotReload.debounceMs),
+      OPENCODE_HOT_RELOAD_COOLDOWN_MS: String(options.hotReload.cooldownMs),
+      ...(options.opencodeRouterHealthPort
+        ? {
+            OPENCODE_ROUTER_HEALTH_PORT: String(
+              options.opencodeRouterHealthPort,
+            ),
+          }
+        : {}),
+    },
+  });
+
+  prefixStream(
+    child.stdout,
+    "opencode",
+    "stdout",
+    options.logger,
+    child.pid ?? undefined,
+  );
+  prefixStream(
+    child.stderr,
+    "opencode",
+    "stderr",
+    options.logger,
+    child.pid ?? undefined,
+  );
+
+  return child;
+}
+
+async function startOpenworkServer(options: {
+  bin: string;
+  host: string;
+  port: number;
+  workspace: string;
+  token: string;
+  hostToken: string;
+  approvalMode: ApprovalMode;
+  approvalTimeoutMs: number;
+  readOnly: boolean;
+  corsOrigins: string[];
+  opencodeBaseUrl?: string;
+  opencodeDirectory?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  opencodeRouterHealthPort?: number;
+  opencodeRouterDataDir?: string;
+  controlBaseUrl?: string;
+  controlToken?: string;
+  logger: Logger;
+  runId: string;
+  logFormat: LogFormat;
+}) {
+  const args = [
+    "--host",
+    options.host,
+    "--port",
+    String(options.port),
+    "--workspace",
+    options.workspace,
+    "--approval",
+    options.approvalMode,
+    "--approval-timeout",
+    String(options.approvalTimeoutMs),
+  ];
+
+  if (options.readOnly) {
+    args.push("--read-only");
+  }
+
+  if (options.corsOrigins.length) {
+    args.push("--cors", options.corsOrigins.join(","));
+  }
+
+  if (options.opencodeBaseUrl) {
+    args.push("--opencode-base-url", options.opencodeBaseUrl);
+  }
+  if (options.opencodeDirectory) {
+    args.push("--opencode-directory", options.opencodeDirectory);
+  }
+  if (options.logFormat) {
+    args.push("--log-format", options.logFormat);
+  }
+
+  const resolved = resolveBinCommand(options.bin);
+  const child = spawnProcess(
+    resolved.command,
+    [...resolved.prefixArgs, ...args],
+    {
+      cwd: options.workspace,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        OPENWORK_TOKEN: options.token,
+        OPENWORK_HOST_TOKEN: options.hostToken,
+        OPENWORK_RUN_ID: options.runId,
+        OPENWORK_LOG_FORMAT: options.logFormat,
+        OTEL_RESOURCE_ATTRIBUTES: mergeResourceAttributes(
+          {
+            "service.name": "openwork-server",
+            "service.instance.id": options.runId,
+          },
+          process.env.OTEL_RESOURCE_ATTRIBUTES,
+        ),
+        ...(options.opencodeRouterHealthPort
+          ? {
+              OPENCODE_ROUTER_HEALTH_PORT: String(
+                options.opencodeRouterHealthPort,
+              ),
+            }
+          : {}),
+        ...(options.opencodeRouterDataDir
+          ? { OPENCODE_ROUTER_DATA_DIR: options.opencodeRouterDataDir }
+          : {}),
+        ...(options.opencodeBaseUrl
+          ? { OPENWORK_OPENCODE_BASE_URL: options.opencodeBaseUrl }
+          : {}),
+        ...(options.opencodeDirectory
+          ? { OPENWORK_OPENCODE_DIRECTORY: options.opencodeDirectory }
+          : {}),
+        ...(options.opencodeUsername
+          ? { OPENWORK_OPENCODE_USERNAME: options.opencodeUsername }
+          : {}),
+        ...(options.opencodePassword
+          ? { OPENWORK_OPENCODE_PASSWORD: options.opencodePassword }
+          : {}),
+        ...(options.controlBaseUrl
+          ? { OPENWORK_CONTROL_BASE_URL: options.controlBaseUrl }
+          : {}),
+        ...(options.controlToken
+          ? { OPENWORK_CONTROL_TOKEN: options.controlToken }
+          : {}),
+      },
+    },
+  );
+
+  prefixStream(
+    child.stdout,
+    "openwork-server",
+    "stdout",
+    options.logger,
+    child.pid ?? undefined,
+  );
+  prefixStream(
+    child.stderr,
+    "openwork-server",
+    "stderr",
+    options.logger,
+    child.pid ?? undefined,
+  );
+
+  return child;
+}
+
+async function startOpenCodeRouter(options: {
+  bin: string;
+  workspace: string;
+  opencodeUrl?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  opencodeRouterHealthPort?: number;
+  opencodeRouterDataDir?: string;
+  logger: Logger;
+  runId: string;
+  logFormat: LogFormat;
+}) {
+  const args = ["serve", options.workspace];
+  if (options.opencodeUrl) {
+    const supports = await opencodeRouterSupportsOpencodeUrl(options.bin);
+    if (supports) {
+      args.push("--opencode-url", options.opencodeUrl);
+    }
+  }
+
+  const resolved = resolveBinCommand(options.bin);
+  const child = spawnProcess(
+    resolved.command,
+    [...resolved.prefixArgs, ...args],
+    {
+      cwd: options.workspace,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        OPENWORK_RUN_ID: options.runId,
+        OPENWORK_LOG_FORMAT: options.logFormat,
+        OTEL_RESOURCE_ATTRIBUTES: mergeResourceAttributes(
+          {
+            "service.name": "opencode-router",
+            "service.instance.id": options.runId,
+          },
+          process.env.OTEL_RESOURCE_ATTRIBUTES,
+        ),
+        ...(options.opencodeUrl ? { OPENCODE_URL: options.opencodeUrl } : {}),
+        OPENCODE_DIRECTORY: options.workspace,
+        ...(options.opencodeRouterHealthPort
+          ? {
+              OPENCODE_ROUTER_HEALTH_PORT: String(
+                options.opencodeRouterHealthPort,
+              ),
+            }
+          : {}),
+        ...(options.opencodeRouterDataDir
+          ? { OPENCODE_ROUTER_DATA_DIR: options.opencodeRouterDataDir }
+          : {}),
+        ...(options.opencodeUsername
+          ? { OPENCODE_SERVER_USERNAME: options.opencodeUsername }
+          : {}),
+        ...(options.opencodePassword
+          ? { OPENCODE_SERVER_PASSWORD: options.opencodePassword }
+          : {}),
+      },
+    },
+  );
+
+  prefixStream(
+    child.stdout,
+    "opencode-router",
+    "stdout",
+    options.logger,
+    child.pid ?? undefined,
+  );
+  prefixStream(
+    child.stderr,
+    "opencode-router",
+    "stderr",
+    options.logger,
+    child.pid ?? undefined,
+  );
+
+  return child;
+}
+
+async function opencodeRouterSupportsOpencodeUrl(
+  bin: string,
+): Promise<boolean> {
+  const resolved = resolveBinCommand(bin);
+  return new Promise((resolve) => {
+    const child = spawnProcess(
+      resolved.command,
+      [...resolved.prefixArgs, "--help"],
+      {
+        cwd: tmpdir(),
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
+    let output = "";
+    const timeout = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+        // ignore
+      }
+      resolve(output.includes("--opencode-url"));
+    }, 1500);
+
+    const onChunk = (chunk: unknown) => {
+      output += String(chunk ?? "");
+    };
+
+    child.stdout?.on("data", onChunk);
+    child.stderr?.on("data", onChunk);
+
+    child.on("exit", () => {
+      clearTimeout(timeout);
+      resolve(output.includes("--opencode-url"));
+    });
+    child.on("error", () => {
+      clearTimeout(timeout);
+      resolve(false);
+    });
+  });
+}
+
+async function stopDockerContainer(
+  name: string,
+  dockerCommand: string,
+): Promise<void> {
+  if (!name.trim()) return;
+  await new Promise<void>((resolve) => {
+    const child = spawnProcess(dockerCommand, ["stop", name], {
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    child.on("error", () => resolve());
+    child.on("exit", () => resolve());
+  });
+}
+
+async function stopAppleContainer(name: string): Promise<void> {
+  if (!name.trim()) return;
+  await new Promise<void>((resolve) => {
+    const child = spawnProcess("container", ["stop", name], {
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    child.on("error", () => resolve());
+    child.on("exit", () => resolve());
+  });
+}
+
+async function runQuiet(
+  command: string,
+  args: string[],
+  timeoutMs = 60_000,
+): Promise<void> {
+  const child = spawnProcess(command, args, {
+    stdio: ["ignore", "ignore", "ignore"],
+  });
+  type QuietResult =
+    | { type: "exit"; code: number | null }
+    | { type: "error"; error: unknown }
+    | { type: "timeout" };
+
+  const result = await Promise.race<QuietResult>([
+    once(child, "exit").then(([code]) => ({
+      type: "exit" as const,
+      code: (code ?? null) as number | null,
+    })),
+    once(child, "error").then(([error]) => ({ type: "error" as const, error })),
+    new Promise<QuietResult>((resolve) =>
+      setTimeout(resolve, timeoutMs, { type: "timeout" as const }),
+    ),
+  ]);
+  if (result.type === "timeout") {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+      // ignore
+    }
+    throw new Error(`Command timed out: ${command} ${args.join(" ")}`);
+  }
+  if (result.type === "error") {
+    throw new Error(
+      `Command failed: ${command} ${args.join(" ")}: ${String(result.error)}`,
+    );
+  }
+  if (result.code !== 0) {
+    throw new Error(`Command failed: ${command} ${args.join(" ")}`);
+  }
+}
+
+async function ensureAppleContainerSystemReady(): Promise<void> {
+  if (process.platform !== "darwin") {
+    throw new Error("Apple container backend is only supported on macOS");
+  }
+  if (process.arch !== "arm64") {
+    throw new Error("Apple container backend requires Apple silicon (arm64)");
+  }
+  if (!(await probeCommand("container", ["--version"]))) {
+    throw new Error(
+      "Apple container CLI not found. Install https://github.com/apple/container",
+    );
+  }
+  // Best-effort: start the background system service.
+  try {
+    await runQuiet("container", ["system", "start"], 90_000);
+  } catch {
+    // Ignore; older versions may not require an explicit start.
+  }
+}
+
+async function stageSandboxRuntime(options: {
+  persistDir: string;
+  containerName: string;
+  sidecars: {
+    opencode: string;
+    openworkServer: string;
+    opencodeRouter?: string | null;
+  };
+  detach: boolean;
+}): Promise<{
+  baseDir: string;
+  rootInContainer: string;
+  entrypointHostPath: string;
+  cleanup: () => Promise<void>;
+}> {
+  const baseDir = join(
+    options.persistDir,
+    "openwork-orchestrator-sandbox",
+    options.containerName,
+  );
+  await mkdir(baseDir, { recursive: true });
+
+  const sidecarsDir = join(baseDir, "sidecars");
+  await mkdir(sidecarsDir, { recursive: true });
+  const entrypointHostPath = join(baseDir, "entrypoint.sh");
+
+  const stagedOpencode = join(sidecarsDir, "opencode");
+  const stagedOpenwork = join(sidecarsDir, "openwork-server");
+  await copyFile(options.sidecars.opencode, stagedOpencode);
+  await copyFile(options.sidecars.openworkServer, stagedOpenwork);
+  await ensureExecutable(stagedOpencode);
+  await ensureExecutable(stagedOpenwork);
+
+  if (options.sidecars.opencodeRouter) {
+    const stagedOpenCodeRouter = join(sidecarsDir, "opencode-router");
+    await copyFile(options.sidecars.opencodeRouter, stagedOpenCodeRouter);
+    await ensureExecutable(stagedOpenCodeRouter);
+  }
+
+  const rootInContainer = `/persist/openwork-orchestrator-sandbox/${options.containerName}`;
+  const cleanup = async () => {
+    if (options.detach) return;
+    try {
+      await rm(baseDir, { recursive: true, force: true });
+    } catch {
+      // ignore
+    }
+  };
+
+  return { baseDir, rootInContainer, entrypointHostPath, cleanup };
+}
+
+async function writeSandboxEntrypoint(options: {
+  entrypointHostPath: string;
+  rootInContainer: string;
+  opencodeConfigDirInContainer: string;
+  backend: "docker" | "container";
+  opencode: {
+    corsOrigins: string[];
+    username?: string;
+    password?: string;
+    hotReload: OpencodeHotReload;
+    logLevel?: string;
+  };
+  openwork: {
+    token: string;
+    hostToken: string;
+    approvalMode: ApprovalMode;
+    approvalTimeoutMs: number;
+    readOnly: boolean;
+    corsOrigins: string[];
+    opencodeUsername?: string;
+    opencodePassword?: string;
+    logFormat: LogFormat;
+    opencodeRouterEnabled: boolean;
+  };
+  runId: string;
+  logFormat: LogFormat;
+}): Promise<void> {
+  const opencodeBin = `${options.rootInContainer}/sidecars/opencode`;
+  const openworkBin = `${options.rootInContainer}/sidecars/openwork-server`;
+  const opencodeRouterBin = `${options.rootInContainer}/sidecars/opencode-router`;
+  const workspaceDir = "/workspace";
+  const opencodeConfigDir = options.opencodeConfigDirInContainer;
+  const hostOpencodeConfigDir = SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH;
+  const hostOpencodeDataDir =
+    SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH;
+
+  const opencodeCors = options.opencode.corsOrigins
+    .map((origin) => `--cors ${shQuote(origin)}`)
+    .join(" ");
+
+  const opencodeLogLevelArg = options.opencode.logLevel
+    ? `--log-level ${shQuote(options.opencode.logLevel)}`
+    : "";
+
+  const openworkCors = options.openwork.corsOrigins.length
+    ? `--cors ${shQuote(options.openwork.corsOrigins.join(","))}`
+    : "";
+
+  const requiredSecretEnv = [
+    ': "${OPENWORK_TOKEN:?OPENWORK_TOKEN is required}"',
+    ': "${OPENWORK_HOST_TOKEN:?OPENWORK_HOST_TOKEN is required}"',
+    options.opencode.username
+      ? ': "${OPENCODE_SERVER_USERNAME:?OPENCODE_SERVER_USERNAME is required}"'
+      : "",
+    options.opencode.password
+      ? ': "${OPENCODE_SERVER_PASSWORD:?OPENCODE_SERVER_PASSWORD is required}"'
+      : "",
+    options.openwork.opencodeUsername
+      ? ': "${OPENWORK_OPENCODE_USERNAME:?OPENWORK_OPENCODE_USERNAME is required}"'
+      : "",
+    options.openwork.opencodePassword
+      ? ': "${OPENWORK_OPENCODE_PASSWORD:?OPENWORK_OPENCODE_PASSWORD is required}"'
+      : "",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+  const opencodeRouterEnv = options.openwork.opencodeRouterEnabled
+    ? `export OPENCODE_ROUTER_HEALTH_PORT=${shQuote(String(SANDBOX_INTERNAL_OPENCODE_ROUTER_HEALTH_PORT))}`
+    : "";
+  const openworkDevMode = (process.env.OPENWORK_DEV_MODE ?? "").trim() === "1";
+  const sandboxHomeDir = openworkDevMode ? "/persist/openwork-dev-data/home" : "/persist";
+
+  const script = [
+    "set -eu",
+    `export HOME=${shQuote(sandboxHomeDir)}`,
+    `export OPENCODE_TEST_HOME=${shQuote(sandboxHomeDir)}`,
+    'export XDG_CONFIG_HOME="$HOME/.config"',
+    'export XDG_CACHE_HOME="$HOME/.cache"',
+    'export XDG_DATA_HOME="$HOME/.local/share"',
+    'export XDG_STATE_HOME="$HOME/.local/state"',
+    `export PATH=${shQuote(`${options.rootInContainer}/sidecars`)}:"\${PATH:-}"`,
+    'mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME"',
+    // Do not `cd` into the mounted workspace: bun-compiled sidecars read bunfig.toml
+    // from cwd, and user workspaces may include preloads that break startup.
+    `cd ${shQuote("/persist")}`,
+    `export OPENCODE_DIRECTORY=${shQuote(workspaceDir)}`,
+    `export OPENCODE_CONFIG_DIR=${shQuote(opencodeConfigDir)}`,
+    `mkdir -p ${shQuote(opencodeConfigDir)}`,
+    `if [ -d ${shQuote(hostOpencodeConfigDir)} ]; then cp -R ${shQuote(`${hostOpencodeConfigDir}/.`)} ${shQuote(opencodeConfigDir)} 2>/dev/null || true; fi`,
+    'mkdir -p "$XDG_DATA_HOME/opencode"',
+    `if [ -d ${shQuote(hostOpencodeDataDir)} ]; then cp ${shQuote(`${hostOpencodeDataDir}/auth.json`)} \"$XDG_DATA_HOME/opencode/auth.json\" 2>/dev/null || true; cp ${shQuote(`${hostOpencodeDataDir}/mcp-auth.json`)} \"$XDG_DATA_HOME/opencode/mcp-auth.json\" 2>/dev/null || true; fi`,
+    `export OPENCODE_URL=${shQuote(`http://127.0.0.1:${SANDBOX_INTERNAL_OPENCODE_PORT}`)}`,
+    `export OPENCODE_CLIENT=openwork-orchestrator`,
+    `export OPENCODE_HOT_RELOAD=${shQuote(options.opencode.hotReload.enabled ? "1" : "0")}`,
+    `export OPENCODE_HOT_RELOAD_DEBOUNCE_MS=${shQuote(String(options.opencode.hotReload.debounceMs))}`,
+    `export OPENCODE_HOT_RELOAD_COOLDOWN_MS=${shQuote(String(options.opencode.hotReload.cooldownMs))}`,
+    `export OPENWORK=1`,
+    `export OPENWORK_DEV_MODE=${shQuote(openworkDevMode ? "1" : "0")}`,
+    `export OPENWORK_RUN_ID=${shQuote(options.runId)}`,
+    `export OPENWORK_LOG_FORMAT=${shQuote(options.logFormat)}`,
+    `export OPENWORK_SANDBOX_ENABLED=1`,
+    `export OPENWORK_SANDBOX_BACKEND=${shQuote(options.backend)}`,
+    opencodeRouterEnv,
+    requiredSecretEnv,
+    'opencode_pid=""',
+    'opencodeRouter_pid=""',
+    "cleanup() {",
+    '  if [ -n "$opencodeRouter_pid" ]; then kill "$opencodeRouter_pid" 2>/dev/null || true; fi',
+    '  if [ -n "$opencode_pid" ]; then kill "$opencode_pid" 2>/dev/null || true; fi',
+    "}",
+    "trap cleanup INT TERM",
+    `${shQuote(opencodeBin)} serve --hostname 127.0.0.1 --port ${shQuote(String(SANDBOX_INTERNAL_OPENCODE_PORT))}${opencodeLogLevelArg ? ` ${opencodeLogLevelArg}` : ""} ${opencodeCors} &`,
+    "opencode_pid=$!",
+    options.openwork.opencodeRouterEnabled
+      ? `${shQuote(opencodeRouterBin)} serve ${shQuote(workspaceDir)} &`
+      : "",
+    options.openwork.opencodeRouterEnabled ? "opencodeRouter_pid=$!" : "",
+    `exec ${shQuote(openworkBin)} --host 0.0.0.0 --port ${shQuote(String(SANDBOX_INTERNAL_OPENWORK_PORT))}` +
+      ` --workspace ${shQuote(workspaceDir)}` +
+      ` --approval ${shQuote(options.openwork.approvalMode)}` +
+      ` --approval-timeout ${shQuote(String(options.openwork.approvalTimeoutMs))}` +
+      (options.openwork.readOnly ? " --read-only" : "") +
+      ` --opencode-base-url ${shQuote(`http://127.0.0.1:${SANDBOX_INTERNAL_OPENCODE_PORT}`)}` +
+      ` --opencode-directory ${shQuote(workspaceDir)}` +
+      ` --log-format ${shQuote(options.openwork.logFormat)}` +
+      (options.openwork.opencodeRouterEnabled
+        ? ` --opencode-router-health-port ${shQuote(String(SANDBOX_INTERNAL_OPENCODE_ROUTER_HEALTH_PORT))}`
+        : "") +
+      (openworkCors ? ` ${openworkCors}` : ""),
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+  await writeFile(options.entrypointHostPath, `${script}\n`, "utf8");
+}
+
+async function startDockerSandbox(options: {
+  image: string;
+  dockerCommand: string;
+  containerName: string;
+  workspace: string;
+  persistDir: string;
+  opencodeConfigDir: string;
+  extraMounts: SandboxMount[];
+  sidecars: {
+    opencode: string;
+    openworkServer: string;
+    opencodeRouter?: string | null;
+  };
+  ports: { openwork: number; opencodeRouterHealth?: number | null };
+  opencode: {
+    corsOrigins: string[];
+    username?: string;
+    password?: string;
+    hotReload: OpencodeHotReload;
+    logLevel?: string;
+  };
+  openwork: {
+    token: string;
+    hostToken: string;
+    approvalMode: ApprovalMode;
+    approvalTimeoutMs: number;
+    readOnly: boolean;
+    corsOrigins: string[];
+    opencodeUsername?: string;
+    opencodePassword?: string;
+    logFormat: LogFormat;
+  };
+  runId: string;
+  logFormat: LogFormat;
+  detach: boolean;
+  logger: Logger;
+}): Promise<{ child: ReturnType<typeof spawn>; cleanup: () => Promise<void> }> {
+  const staged = await stageSandboxRuntime({
+    persistDir: options.persistDir,
+    containerName: options.containerName,
+    sidecars: options.sidecars,
+    detach: options.detach,
+  });
+
+  await writeSandboxEntrypoint({
+    entrypointHostPath: staged.entrypointHostPath,
+    rootInContainer: staged.rootInContainer,
+    opencodeConfigDirInContainer: "/opencode-config",
+    backend: "docker",
+    opencode: options.opencode,
+    openwork: {
+      token: options.openwork.token,
+      hostToken: options.openwork.hostToken,
+      approvalMode: options.openwork.approvalMode,
+      approvalTimeoutMs: options.openwork.approvalTimeoutMs,
+      readOnly: options.openwork.readOnly,
+      corsOrigins: options.openwork.corsOrigins,
+      opencodeUsername: options.openwork.opencodeUsername,
+      opencodePassword: options.openwork.opencodePassword,
+      logFormat: options.openwork.logFormat,
+      opencodeRouterEnabled: !!options.sidecars.opencodeRouter,
+    },
+    runId: options.runId,
+    logFormat: options.logFormat,
+  });
+
+  const args: string[] = [
+    "run",
+    "--rm",
+    "--name",
+    options.containerName,
+    "-p",
+    `127.0.0.1:${options.ports.openwork}:${SANDBOX_INTERNAL_OPENWORK_PORT}`,
+    "-v",
+    `${options.workspace}:/workspace`,
+    "-v",
+    `${options.persistDir}:/persist`,
+    "-v",
+    `${options.opencodeConfigDir}:/opencode-config`,
+  ];
+
+  const hostOpencodeConfig = await resolveHostOpencodeGlobalConfigDir();
+  const hasOpencodeConfigMount = options.extraMounts.some(
+    (mount) =>
+      mount.containerPath === SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH,
+  );
+  if (hostOpencodeConfig && !hasOpencodeConfigMount) {
+    args.push(
+      "-v",
+      `${hostOpencodeConfig}:${SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH}:ro`,
+    );
+    options.logger.debug("sandbox: mounted host opencode config", {
+      hostPath: hostOpencodeConfig,
+      containerPath: SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH,
+    });
+  }
+
+  const hostOpencodeData = await resolveHostOpencodeGlobalDataDir();
+  const hasOpencodeDataMount = options.extraMounts.some(
+    (mount) =>
+      mount.containerPath ===
+      SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH,
+  );
+  if (hostOpencodeData && !hasOpencodeDataMount) {
+    args.push(
+      "-v",
+      `${hostOpencodeData}:${SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH}:ro`,
+    );
+    options.logger.debug("sandbox: mounted host opencode data", {
+      hostPath: hostOpencodeData,
+      containerPath: SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH,
+    });
+  }
+
+  if (options.sidecars.opencodeRouter && options.ports.opencodeRouterHealth) {
+    args.push(
+      "-p",
+      `127.0.0.1:${options.ports.opencodeRouterHealth}:${SANDBOX_INTERNAL_OPENCODE_ROUTER_HEALTH_PORT}`,
+    );
+  }
+
+  const userEnv = loadUserEnvFile();
+  addEnvPassThroughArgs(args, sandboxEnvPassThroughNames(userEnv));
+
+  for (const mount of options.extraMounts) {
+    const suffix = mount.readonly ? ":ro" : "";
+    args.push("-v", `${mount.hostPath}:${mount.containerPath}${suffix}`);
+  }
+
+  if (options.detach) {
+    args.push("-d");
+  }
+
+  const scriptInContainer = `${staged.rootInContainer}/entrypoint.sh`;
+  args.push(options.image, "sh", scriptInContainer);
+
+  options.logger.debug("sandbox: docker run", {
+    dockerCommand: options.dockerCommand,
+    args,
+    containerName: options.containerName,
+    workspace: options.workspace,
+    persistDir: options.persistDir,
+  });
+
+  const child = spawnProcess(options.dockerCommand, args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...userEnv,
+      ...process.env,
+      OPENWORK_TOKEN: options.openwork.token,
+      OPENWORK_HOST_TOKEN: options.openwork.hostToken,
+      ...(options.opencode.username
+        ? { OPENCODE_SERVER_USERNAME: options.opencode.username }
+        : {}),
+      ...(options.opencode.password
+        ? { OPENCODE_SERVER_PASSWORD: options.opencode.password }
+        : {}),
+      ...(options.openwork.opencodeUsername
+        ? { OPENWORK_OPENCODE_USERNAME: options.openwork.opencodeUsername }
+        : {}),
+      ...(options.openwork.opencodePassword
+        ? { OPENWORK_OPENCODE_PASSWORD: options.openwork.opencodePassword }
+        : {}),
+    },
+  });
+  prefixStream(
+    child.stdout,
+    "sandbox",
+    "stdout",
+    options.logger,
+    child.pid ?? undefined,
+  );
+  prefixStream(
+    child.stderr,
+    "sandbox",
+    "stderr",
+    options.logger,
+    child.pid ?? undefined,
+  );
+
+  return { child, cleanup: staged.cleanup };
+}
+
+async function startAppleContainerSandbox(options: {
+  image: string;
+  containerName: string;
+  workspace: string;
+  persistDir: string;
+  opencodeConfigDir: string;
+  extraMounts: SandboxMount[];
+  sidecars: {
+    opencode: string;
+    openworkServer: string;
+    opencodeRouter?: string | null;
+  };
+  ports: { openwork: number; opencodeRouterHealth?: number | null };
+  opencode: {
+    corsOrigins: string[];
+    username?: string;
+    password?: string;
+    hotReload: OpencodeHotReload;
+    logLevel?: string;
+  };
+  openwork: {
+    token: string;
+    hostToken: string;
+    approvalMode: ApprovalMode;
+    approvalTimeoutMs: number;
+    readOnly: boolean;
+    corsOrigins: string[];
+    opencodeUsername?: string;
+    opencodePassword?: string;
+    logFormat: LogFormat;
+  };
+  runId: string;
+  logFormat: LogFormat;
+  detach: boolean;
+  logger: Logger;
+}): Promise<{ child: ReturnType<typeof spawn>; cleanup: () => Promise<void> }> {
+  await ensureAppleContainerSystemReady();
+
+  const staged = await stageSandboxRuntime({
+    persistDir: options.persistDir,
+    containerName: options.containerName,
+    sidecars: options.sidecars,
+    detach: options.detach,
+  });
+
+  await writeSandboxEntrypoint({
+    entrypointHostPath: staged.entrypointHostPath,
+    rootInContainer: staged.rootInContainer,
+    opencodeConfigDirInContainer: "/opencode-config",
+    backend: "container",
+    opencode: options.opencode,
+    openwork: {
+      token: options.openwork.token,
+      hostToken: options.openwork.hostToken,
+      approvalMode: options.openwork.approvalMode,
+      approvalTimeoutMs: options.openwork.approvalTimeoutMs,
+      readOnly: options.openwork.readOnly,
+      corsOrigins: options.openwork.corsOrigins,
+      opencodeUsername: options.openwork.opencodeUsername,
+      opencodePassword: options.openwork.opencodePassword,
+      logFormat: options.openwork.logFormat,
+      opencodeRouterEnabled: !!options.sidecars.opencodeRouter,
+    },
+    runId: options.runId,
+    logFormat: options.logFormat,
+  });
+
+  const args: string[] = [
+    "run",
+    "--rm",
+    "--name",
+    options.containerName,
+    "-p",
+    `127.0.0.1:${options.ports.openwork}:${SANDBOX_INTERNAL_OPENWORK_PORT}`,
+    "-v",
+    `${options.workspace}:/workspace`,
+    "-v",
+    `${options.persistDir}:/persist`,
+    "-v",
+    `${options.opencodeConfigDir}:/opencode-config`,
+  ];
+
+  const hostOpencodeConfig = await resolveHostOpencodeGlobalConfigDir();
+  const hasOpencodeConfigMount = options.extraMounts.some(
+    (mount) =>
+      mount.containerPath === SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH,
+  );
+  if (hostOpencodeConfig && !hasOpencodeConfigMount) {
+    args.push(
+      "--mount",
+      `type=bind,source=${hostOpencodeConfig},target=${SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH},readonly`,
+    );
+    options.logger.debug("sandbox: mounted host opencode config", {
+      hostPath: hostOpencodeConfig,
+      containerPath: SANDBOX_OPENCODE_GLOBAL_CONFIG_CONTAINER_PATH,
+    });
+  }
+
+  const hostOpencodeData = await resolveHostOpencodeGlobalDataDir();
+  const hasOpencodeDataMount = options.extraMounts.some(
+    (mount) =>
+      mount.containerPath ===
+      SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH,
+  );
+  if (hostOpencodeData && !hasOpencodeDataMount) {
+    args.push(
+      "--mount",
+      `type=bind,source=${hostOpencodeData},target=${SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH},readonly`,
+    );
+    options.logger.debug("sandbox: mounted host opencode data", {
+      hostPath: hostOpencodeData,
+      containerPath: SANDBOX_OPENCODE_GLOBAL_DATA_IMPORT_CONTAINER_PATH,
+    });
+  }
+
+  if (options.sidecars.opencodeRouter && options.ports.opencodeRouterHealth) {
+    args.push(
+      "-p",
+      `127.0.0.1:${options.ports.opencodeRouterHealth}:${SANDBOX_INTERNAL_OPENCODE_ROUTER_HEALTH_PORT}`,
+    );
+  }
+
+  const userEnv = loadUserEnvFile();
+  addEnvPassThroughArgs(args, sandboxEnvPassThroughNames(userEnv));
+
+  for (const mount of options.extraMounts) {
+    if (mount.readonly) {
+      args.push(
+        "--mount",
+        `type=bind,source=${mount.hostPath},target=${mount.containerPath},readonly`,
+      );
+    } else {
+      args.push("-v", `${mount.hostPath}:${mount.containerPath}`);
+    }
+  }
+
+  if (options.detach) {
+    args.push("-d");
+  }
+
+  const scriptInContainer = `${staged.rootInContainer}/entrypoint.sh`;
+  args.push(options.image, "sh", scriptInContainer);
+
+  const child = spawnProcess("container", args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...userEnv,
+      ...process.env,
+      OPENWORK_TOKEN: options.openwork.token,
+      OPENWORK_HOST_TOKEN: options.openwork.hostToken,
+      ...(options.opencode.username
+        ? { OPENCODE_SERVER_USERNAME: options.opencode.username }
+        : {}),
+      ...(options.opencode.password
+        ? { OPENCODE_SERVER_PASSWORD: options.opencode.password }
+        : {}),
+      ...(options.openwork.opencodeUsername
+        ? { OPENWORK_OPENCODE_USERNAME: options.openwork.opencodeUsername }
+        : {}),
+      ...(options.openwork.opencodePassword
+        ? { OPENWORK_OPENCODE_PASSWORD: options.openwork.opencodePassword }
+        : {}),
+    },
+  });
+  prefixStream(
+    child.stdout,
+    "sandbox",
+    "stdout",
+    options.logger,
+    child.pid ?? undefined,
+  );
+  prefixStream(
+    child.stderr,
+    "sandbox",
+    "stderr",
+    options.logger,
+    child.pid ?? undefined,
+  );
+
+  return { child, cleanup: staged.cleanup };
+}
+
+async function verifyOpenCodeRouterVersion(
+  binary: ResolvedBinary,
+): Promise<string | undefined> {
+  if (binary.source !== "external") {
+    return binary.expectedVersion;
+  }
+  const actual = await readCliVersion(binary.bin);
+  assertVersionMatch(
+    "opencode-router",
+    binary.expectedVersion,
+    actual,
+    binary.bin,
+  );
+  return actual;
+}
+
+async function verifyOpencodeVersion(
+  binary: ResolvedBinary,
+): Promise<string | undefined> {
+  const actual = await readCliVersion(binary.bin);
+  // When the binary was explicitly provided via --opencode-bin (source "external"),
+  // a strict version check would break desktop app users whenever a new opencode
+  // release ships on GitHub before OpenWork updates its bundled binary. Log a
+  // warning instead of throwing so the caller can still proceed.
+  if (
+    binary.source === "external" &&
+    binary.expectedVersion &&
+    actual &&
+    binary.expectedVersion !== actual
+  ) {
+    process.stderr.write(
+      `[openwork-orchestrator] Warning: opencode version mismatch (expected ${binary.expectedVersion}, got ${actual}). Proceeding with ${binary.bin}.\n`,
+    );
+    return actual;
+  }
+  assertVersionMatch("opencode", binary.expectedVersion, actual, binary.bin);
+  return actual;
+}
+
+async function verifyOpenworkServer(input: {
+  baseUrl: string;
+  token: string;
+  hostToken: string;
+  expectedVersion?: string;
+  expectedWorkspace: string;
+  expectedOpencodeBaseUrl?: string;
+  expectedOpencodeDirectory?: string;
+  expectedOpencodeUsername?: string;
+  expectedOpencodePassword?: string;
+}): Promise<string | undefined> {
+  const health = await fetchJson(`${input.baseUrl}/health`);
+  const actualVersion =
+    typeof health?.version === "string" ? health.version : undefined;
+  assertVersionMatch(
+    "openwork-server",
+    input.expectedVersion,
+    actualVersion,
+    `${input.baseUrl}/health`,
+  );
+
+  const headers = { Authorization: `Bearer ${input.token}` };
+  const workspaces = await fetchJson(`${input.baseUrl}/workspaces`, {
+    headers,
+  });
+  const items = Array.isArray(workspaces?.items)
+    ? (workspaces.items as Array<Record<string, unknown>>)
+    : [];
+  if (!items.length) {
+    throw new Error("OpenWork server returned no workspaces");
+  }
+
+  const expectedPath = normalizeWorkspacePath(input.expectedWorkspace);
+  const matched = items.find((item) => {
+    const candidate = item as { path?: string };
+    const path = typeof candidate.path === "string" ? candidate.path : "";
+    return path && normalizeWorkspacePath(path) === expectedPath;
+  }) as
+    | {
+        id?: string;
+        path?: string;
+        opencode?: {
+          baseUrl?: string;
+          directory?: string;
+          username?: string;
+          password?: string;
+        };
+      }
+    | undefined;
+
+  if (!matched) {
+    throw new Error(
+      `OpenWork server workspace mismatch. Expected ${expectedPath}.`,
+    );
+  }
+
+  const opencode = matched.opencode;
+  if (
+    input.expectedOpencodeBaseUrl &&
+    opencode?.baseUrl !== input.expectedOpencodeBaseUrl
+  ) {
+    throw new Error(
+      `OpenWork server OpenCode base URL mismatch: expected ${input.expectedOpencodeBaseUrl}, got ${opencode?.baseUrl ?? "<missing>"}.`,
+    );
+  }
+  if (
+    input.expectedOpencodeDirectory &&
+    opencode?.directory !== input.expectedOpencodeDirectory
+  ) {
+    throw new Error(
+      `OpenWork server OpenCode directory mismatch: expected ${input.expectedOpencodeDirectory}, got ${opencode?.directory ?? "<missing>"}.`,
+    );
+  }
+  if (
+    input.expectedOpencodeUsername &&
+    opencode?.username !== input.expectedOpencodeUsername
+  ) {
+    throw new Error("OpenWork server OpenCode username mismatch.");
+  }
+  if (
+    input.expectedOpencodePassword &&
+    opencode?.password !== input.expectedOpencodePassword
+  ) {
+    throw new Error("OpenWork server OpenCode password mismatch.");
+  }
+
+  const hostHeaders = { "X-OpenWork-Host-Token": input.hostToken };
+  await fetchJson(`${input.baseUrl}/approvals`, { headers: hostHeaders });
+
+  return actualVersion;
+}
+
+async function installGlobalPackages(packages: string[]): Promise<void> {
+  if (!packages.length) return;
+  await captureCommandOutput("npm", ["install", "-g", ...packages], {
+    timeoutMs: 5 * 60_000,
+  });
+}
+
+function buildRuntimeServiceSnapshot(input: {
+  name: RuntimeServiceName;
+  enabled: boolean;
+  running: boolean;
+  binary?: ResolvedBinary | null;
+  actualVersion?: string;
+}): RuntimeServiceSnapshot {
+  const targetVersion = input.binary?.expectedVersion;
+  const actualVersion = input.actualVersion;
+  return {
+    name: input.name,
+    enabled: input.enabled,
+    running: input.enabled ? input.running : false,
+    source: input.binary?.source,
+    path: input.binary?.bin,
+    targetVersion,
+    actualVersion,
+    upgradeAvailable: Boolean(
+      input.enabled &&
+      targetVersion &&
+      actualVersion &&
+      targetVersion !== actualVersion,
+    ),
+  };
+}
+
+async function runChecks(input: {
+  opencodeClient: ReturnType<typeof createOpencodeClient>;
+  openworkUrl: string;
+  openworkToken: string;
+  hostToken: string;
+  checkEvents: boolean;
+}) {
+  const baseUrl = input.openworkUrl.replace(/\/$/, "");
+  const headers = { Authorization: `Bearer ${input.openworkToken}` };
+  const hostHeaders = { "X-OpenWork-Host-Token": input.hostToken };
+  const workspaces = await fetchJson(`${baseUrl}/workspaces`, { headers });
+  if (!workspaces?.items?.length) {
+    throw new Error("OpenWork server returned no workspaces");
+  }
+
+  const workspaceId = workspaces.items[0].id as string;
+  await fetchJson(`${baseUrl}/workspace/${workspaceId}/config`, { headers });
+
+  // Smoke test: mounted opencodeRouter proxy and auth behavior.
+  // - /w/:id/opencode-router/health is client-readable
+  // - other /w/:id/opencode-router/* requires host/owner auth
+  const owMountBase = `${baseUrl}/w/${encodeURIComponent(workspaceId)}/opencode-router`;
+  const owHealthRes = await fetch(`${owMountBase}/health`, {
+    headers,
+    signal: AbortSignal.timeout(3000),
+  });
+  if (owHealthRes.status >= 500) {
+    throw new Error(
+      `opencodeRouter mount proxy returned ${owHealthRes.status}`,
+    );
+  }
+  const owConfigured = owHealthRes.status !== 404;
+  if (owConfigured) {
+    const clientRes = await fetch(`${owMountBase}/config/groups`, {
+      headers,
+      signal: AbortSignal.timeout(3000),
+    });
+    if (clientRes.status === 200) {
+      throw new Error(
+        "opencodeRouter mount proxy /config/groups should require host auth",
+      );
+    }
+    if (clientRes.status !== 401 && clientRes.status !== 403) {
+      throw new Error(
+        `opencodeRouter mount proxy /config/groups unexpected status: ${clientRes.status}`,
+      );
+    }
+
+    const hostRes = await fetch(`${owMountBase}/config/groups`, {
+      headers: hostHeaders,
+      signal: AbortSignal.timeout(3000),
+    });
+    if (hostRes.status >= 500) {
+      throw new Error(
+        `opencodeRouter mount proxy (host auth) returned ${hostRes.status}`,
+      );
+    }
+    if (hostRes.status === 401 || hostRes.status === 403) {
+      throw new Error(
+        "opencodeRouter mount proxy /config/groups rejected host auth",
+      );
+    }
+  }
+
+  const created = await input.opencodeClient.session.create({
+    title: "OpenWork headless check",
+  });
+  const createdSession = unwrap(created);
+  unwrap(
+    await input.opencodeClient.session.messages({
+      sessionID: createdSession.id,
+      limit: 10,
+    }),
+  );
+
+  if (input.checkEvents) {
+    const events: { type: string }[] = [];
+    const controller = new AbortController();
+    const subscription = await input.opencodeClient.event.subscribe(undefined, {
+      signal: controller.signal,
+    });
+    const reader = (async () => {
+      try {
+        for await (const raw of subscription.stream) {
+          const normalized = normalizeEvent(raw);
+          if (!normalized) continue;
+          events.push(normalized);
+          if (events.length >= 10) break;
+        }
+      } catch {
+        // ignore
+      }
+    })();
+
+    unwrap(
+      await input.opencodeClient.session.create({
+        title: "OpenWork headless check events",
+      }),
+    );
+    await new Promise((resolve) => setTimeout(resolve, 1200));
+    controller.abort();
+    await Promise.race([
+      reader,
+      new Promise((resolve) => setTimeout(resolve, 500)),
+    ]);
+
+    if (!events.length) {
+      throw new Error("No SSE events observed during check");
+    }
+  }
+}
+
+/**
+ * Lighter check suite for sandbox mode.  Uses only raw HTTP against the
+ * openwork-server endpoints — no OpenCode SDK calls that rely on Bearer
+ * auth through the proxy (since the released server binary may predate our
+ * token/proxy changes).
+ */
+async function runSandboxChecks(input: {
+  openworkUrl: string;
+  openworkToken: string;
+  hostToken: string;
+}) {
+  const baseUrl = input.openworkUrl.replace(/\/$/, "");
+  const headers = { Authorization: `Bearer ${input.openworkToken}` };
+  const hostHeaders = { "X-OpenWork-Host-Token": input.hostToken };
+
+  // 1. Server health
+  const health = await fetchJson(`${baseUrl}/health`);
+  if (!health || typeof health !== "object") {
+    throw new Error("openwork-server /health returned invalid payload");
+  }
+
+  // 2. Workspaces list
+  const workspaces = await fetchJson(`${baseUrl}/workspaces`, { headers });
+  if (!workspaces?.items?.length) {
+    throw new Error("openwork-server returned no workspaces");
+  }
+  const workspaceId = workspaces.items[0].id as string;
+
+  // 3. Workspace config
+  await fetchJson(`${baseUrl}/workspace/${workspaceId}/config`, { headers });
+
+  // 4. Approvals endpoint (host auth)
+  await fetchJson(`${baseUrl}/approvals`, { headers: hostHeaders });
+
+  // 5. Proxy is reachable (even if auth is rejected — non-5xx proves the
+  //    server is proxying to a running opencode)
+  const proxyRes = await fetch(`${baseUrl}/opencode/health`, {
+    headers,
+    signal: AbortSignal.timeout(3000),
+  });
+  if (proxyRes.status >= 500) {
+    throw new Error(`opencode proxy returned ${proxyRes.status}`);
+  }
+
+  // 6. opencodeRouter proxy is reachable (if configured)
+  const owRes = await fetch(`${baseUrl}/opencode-router/health`, {
+    headers,
+    signal: AbortSignal.timeout(3000),
+  });
+  if (owRes.status >= 500) {
+    throw new Error(`opencodeRouter proxy returned ${owRes.status}`);
+  }
+
+  // 7. Mounted opencodeRouter proxy + auth behavior (if configured)
+  if (owRes.status !== 404) {
+    const owMountBase = `${baseUrl}/w/${encodeURIComponent(workspaceId)}/opencode-router`;
+    const mountHealth = await fetch(`${owMountBase}/health`, {
+      headers,
+      signal: AbortSignal.timeout(3000),
+    });
+    if (mountHealth.status >= 500) {
+      throw new Error(
+        `opencodeRouter mount proxy returned ${mountHealth.status}`,
+      );
+    }
+    const mountClient = await fetch(`${owMountBase}/config/groups`, {
+      headers,
+      signal: AbortSignal.timeout(3000),
+    });
+    if (mountClient.status === 200) {
+      throw new Error(
+        "opencodeRouter mount proxy /config/groups should require host auth",
+      );
+    }
+    if (mountClient.status !== 401 && mountClient.status !== 403) {
+      throw new Error(
+        `opencodeRouter mount proxy /config/groups unexpected status: ${mountClient.status}`,
+      );
+    }
+    const mountHost = await fetch(`${owMountBase}/config/groups`, {
+      headers: hostHeaders,
+      signal: AbortSignal.timeout(3000),
+    });
+    if (mountHost.status >= 500) {
+      throw new Error(
+        `opencodeRouter mount proxy (host auth) returned ${mountHost.status}`,
+      );
+    }
+    if (mountHost.status === 401 || mountHost.status === 403) {
+      throw new Error(
+        "opencodeRouter mount proxy /config/groups rejected host auth",
+      );
+    }
+  }
+}
+
+async function fetchJson(url: string, init?: RequestInit): Promise<any> {
+  const response = await fetch(url, init);
+  let payload: any = null;
+  try {
+    payload = await response.json();
+  } catch {
+    payload = null;
+  }
+  if (!response.ok) {
+    const message = payload?.message ? ` ${payload.message}` : "";
+    throw new Error(`HTTP ${response.status}${message}`);
+  }
+  return payload;
+}
+
+async function issueOpenworkOwnerToken(
+  baseUrl: string,
+  hostToken: string,
+  label = "OpenWork owner token",
+): Promise<string> {
+  const payload = await fetchJson(`${baseUrl.replace(/\/$/, "")}/tokens`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-OpenWork-Host-Token": hostToken,
+    },
+    body: JSON.stringify({ scope: "owner", label }),
+  });
+  const token = typeof payload?.token === "string" ? payload.token.trim() : "";
+  if (!token) {
+    throw new Error("OpenWork server did not return an owner token");
+  }
+  return token;
+}
+
+function normalizeEvent(raw: unknown): { type: string } | null {
+  if (!raw || typeof raw !== "object") return null;
+  const record = raw as Record<string, unknown>;
+  if (typeof record.type === "string") return { type: record.type };
+  const payload = record.payload as Record<string, unknown> | undefined;
+  if (payload && typeof payload.type === "string")
+    return { type: payload.type };
+  return null;
+}
+
+async function waitForRouterHealthy(
+  baseUrl: string,
+  timeoutMs = 10_000,
+  pollMs = 250,
+): Promise<void> {
+  const start = Date.now();
+  let lastError: string | null = null;
+  const url = baseUrl.replace(/\/$/, "");
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const response = await fetch(`${url}/health`);
+      if (response.ok) return;
+      lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  throw new Error(lastError ?? "Timed out waiting for daemon health");
+}
+
+function outputResult(payload: unknown, json: boolean): void {
+  if (json) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (typeof payload === "string") {
+    console.log(payload);
+    return;
+  }
+  console.log(JSON.stringify(payload, null, 2));
+}
+
+function outputError(error: unknown, json: boolean): void {
+  const message = error instanceof Error ? error.message : String(error);
+  if (json) {
+    console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+    return;
+  }
+  console.error(message);
+}
+
+function createVerboseLogger(
+  enabled: boolean,
+  logger?: Logger,
+  component = "openwork-orchestrator",
+) {
+  return (message: string) => {
+    if (!enabled) return;
+    if (logger) {
+      logger.debug(message, undefined, component);
+      return;
+    }
+    console.log(`[${component}] ${message}`);
+  };
+}
+
+const LOG_LEVEL_NUMBERS: Record<LogLevel, number> = {
+  debug: 5,
+  info: 9,
+  warn: 13,
+  error: 17,
+};
+
+const ANSI = {
+  reset: "\x1b[0m",
+  gray: "\x1b[90m",
+  red: "\x1b[31m",
+  yellow: "\x1b[33m",
+  green: "\x1b[32m",
+  cyan: "\x1b[36m",
+  magenta: "\x1b[35m",
+};
+
+function colorize(input: string, color: string, enabled: boolean): string {
+  if (!enabled) return input;
+  return `${color}${input}${ANSI.reset}`;
+}
+
+function toUnixNano(): string {
+  return (BigInt(Date.now()) * 1_000_000n).toString();
+}
+
+function mergeResourceAttributes(
+  additional: Record<string, string>,
+  existing?: string,
+): string {
+  const entries = new Map<string, string>();
+  if (existing) {
+    for (const part of existing.split(",")) {
+      const trimmed = part.trim();
+      if (!trimmed) continue;
+      const [key, ...rest] = trimmed.split("=");
+      if (!key || rest.length === 0) continue;
+      entries.set(key, rest.join("=").replace(/,/g, ";"));
+    }
+  }
+  for (const [key, value] of Object.entries(additional)) {
+    if (!key) continue;
+    if (value === undefined || value === null) continue;
+    entries.set(key, String(value).replace(/,/g, ";"));
+  }
+  return Array.from(entries.entries())
+    .map(([key, value]) => `${key}=${value}`)
+    .join(",");
+}
+
+const REDACTED_LOG_VALUE = "[REDACTED]";
+
+const SENSITIVE_FLAG_NAMES = [
+  "--token",
+  "--host-token",
+  "--openwork-token",
+  "--openwork-host-token",
+  "--opencode-password",
+  "--opencode-username",
+];
+
+const SENSITIVE_ATTRIBUTE_KEYS = new Set([
+  "token",
+  "hosttoken",
+  "ownertoken",
+  "collaboratortoken",
+  "controltoken",
+  "authorization",
+  "password",
+  "opencodepassword",
+  "opencodeusername",
+  "bottoken",
+  "apptoken",
+]);
+
+function escapeRegExp(input: string): string {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function isSensitiveAttributeKey(key?: string): boolean {
+  const trimmed = key?.trim() ?? "";
+  if (!trimmed) return false;
+  const normalized = trimmed.toLowerCase();
+  if (SENSITIVE_ATTRIBUTE_KEYS.has(normalized)) return true;
+  return (
+    (trimmed.startsWith("OPENWORK_") ||
+      trimmed.startsWith("OPENCODE_") ||
+      trimmed.startsWith("DEN_")) &&
+    /TOKEN|PASSWORD|USERNAME|AUTHORIZATION/.test(trimmed)
+  );
+}
+
+function redactSensitiveString(input: string): string {
+  let redacted = input;
+  redacted = redacted.replace(/\b(Bearer)\s+[^\s"']+/gi, "$1 [REDACTED]");
+  redacted = redacted.replace(/\b(Basic)\s+[A-Za-z0-9+/=]+/g, "$1 [REDACTED]");
+  redacted = redacted.replace(
+    /((?:OPENWORK|OPENCODE|DEN)_[A-Z0-9_]*(?:TOKEN|PASSWORD|USERNAME|AUTHORIZATION)[A-Z0-9_]*=)([^\s]+)/g,
+    `$1${REDACTED_LOG_VALUE}`,
+  );
+  redacted = redacted.replace(
+    /("?(?:token|hostToken|ownerToken|collaboratorToken|controlToken|password|authorization|opencodePassword|opencodeUsername|botToken|appToken)"?\s*[:=]\s*")([^"]*)(")/g,
+    `$1${REDACTED_LOG_VALUE}$3`,
+  );
+  redacted = redacted.replace(
+    /("?(?:token|hostToken|ownerToken|collaboratorToken|controlToken|password|authorization|opencodePassword|opencodeUsername|botToken|appToken)"?\s*[:=]\s*)([^,\s}]+)/g,
+    `$1${REDACTED_LOG_VALUE}`,
+  );
+  for (const flag of SENSITIVE_FLAG_NAMES) {
+    redacted = redacted.replace(
+      new RegExp(`(${escapeRegExp(flag)}\\s+)([^\\s]+)`, "g"),
+      `$1${REDACTED_LOG_VALUE}`,
+    );
+  }
+  return redacted;
+}
+
+function redactLogValue(value: unknown, key?: string): unknown {
+  if (isSensitiveAttributeKey(key)) {
+    return REDACTED_LOG_VALUE;
+  }
+  if (value === null || value === undefined) {
+    return value;
+  }
+  if (typeof value === "string") {
+    return redactSensitiveString(value);
+  }
+  if (
+    typeof value === "number" ||
+    typeof value === "boolean" ||
+    typeof value === "bigint"
+  ) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactLogValue(item, key));
+  }
+  if (value instanceof Error) {
+    return `${value.name}: ${redactSensitiveString(value.message)}`;
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>).map(
+      ([entryKey, entryValue]) => [
+        entryKey,
+        redactLogValue(entryValue, entryKey),
+      ],
+    );
+    return Object.fromEntries(entries);
+  }
+  return redactSensitiveString(String(value));
+}
+
+function createLogger(options: {
+  format: LogFormat;
+  runId: string;
+  serviceName: string;
+  serviceVersion?: string;
+  output?: "stdout" | "silent";
+  color?: boolean;
+  onLog?: (event: LogEvent) => void;
+}): Logger {
+  const host = hostname().trim();
+  const resource: Record<string, string> = {
+    "service.name": options.serviceName,
+    "service.instance.id": options.runId,
+  };
+  if (options.serviceVersion) {
+    resource["service.version"] = options.serviceVersion;
+  }
+  if (host) {
+    resource["host.name"] = host;
+  }
+  const baseAttributes: LogAttributes = {
+    "run.id": options.runId,
+    "process.pid": process.pid,
+  };
+  const output = options.output ?? "stdout";
+  const colorEnabled = options.color ?? false;
+  const componentColors: Record<string, string> = {
+    "openwork-orchestrator": ANSI.gray,
+    opencode: ANSI.cyan,
+    "openwork-server": ANSI.green,
+    opencodeRouter: ANSI.magenta,
+    "openwork-orchestrator-router": ANSI.cyan,
+  };
+  const levelColors: Record<LogLevel, string> = {
+    debug: ANSI.gray,
+    info: ANSI.gray,
+    warn: ANSI.yellow,
+    error: ANSI.red,
+  };
+
+  const emit = (
+    level: LogLevel,
+    message: string,
+    attributes?: LogAttributes,
+    component?: string,
+  ) => {
+    const mergedAttributes: LogAttributes = {
+      ...baseAttributes,
+      ...(component ? { "service.component": component } : {}),
+      ...(attributes ?? {}),
+    };
+    const redactedMessage = redactSensitiveString(message);
+    const redactedAttributes = redactLogValue(mergedAttributes) as LogAttributes;
+    options.onLog?.({
+      time: Date.now(),
+      level,
+      message: redactedMessage,
+      component,
+      attributes: redactedAttributes,
+    });
+    if (output === "silent") return;
+    if (options.format === "json") {
+      const record = {
+        timeUnixNano: toUnixNano(),
+        severityText: level.toUpperCase(),
+        severityNumber: LOG_LEVEL_NUMBERS[level],
+        body: redactedMessage,
+        attributes: redactedAttributes,
+        resource,
+      };
+      process.stdout.write(`${JSON.stringify(record)}\n`);
+      return;
+    }
+    const label = component ?? options.serviceName;
+    const tagLabel = label ? `[${label}]` : "";
+    const levelTag = level === "info" ? "" : level.toUpperCase();
+    const coloredLabel = tagLabel
+      ? colorize(tagLabel, componentColors[label] ?? ANSI.gray, colorEnabled)
+      : "";
+    const coloredLevel = levelTag
+      ? colorize(levelTag, levelColors[level] ?? ANSI.gray, colorEnabled)
+      : "";
+    const tag = [coloredLabel, coloredLevel].filter(Boolean).join(" ");
+    const line = tag ? `${tag} ${redactedMessage}` : redactedMessage;
+    process.stdout.write(`${line}\n`);
+  };
+
+  const child = (
+    component: string,
+    attributes?: LogAttributes,
+  ): LoggerChild => ({
+    log: (level, message, attrs) =>
+      emit(
+        level,
+        message,
+        { ...(attributes ?? {}), ...(attrs ?? {}) },
+        component,
+      ),
+    debug: (message, attrs) =>
+      emit(
+        "debug",
+        message,
+        { ...(attributes ?? {}), ...(attrs ?? {}) },
+        component,
+      ),
+    info: (message, attrs) =>
+      emit(
+        "info",
+        message,
+        { ...(attributes ?? {}), ...(attrs ?? {}) },
+        component,
+      ),
+    warn: (message, attrs) =>
+      emit(
+        "warn",
+        message,
+        { ...(attributes ?? {}), ...(attrs ?? {}) },
+        component,
+      ),
+    error: (message, attrs) =>
+      emit(
+        "error",
+        message,
+        { ...(attributes ?? {}), ...(attrs ?? {}) },
+        component,
+      ),
+  });
+
+  return {
+    format: options.format,
+    output,
+    log: emit,
+    debug: (message, attrs, component) =>
+      emit("debug", message, attrs, component),
+    info: (message, attrs, component) =>
+      emit("info", message, attrs, component),
+    warn: (message, attrs, component) =>
+      emit("warn", message, attrs, component),
+    error: (message, attrs, component) =>
+      emit("error", message, attrs, component),
+    child,
+  };
+}
+
+function looksLikeOtelLogLine(line: string): boolean {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return false;
+  try {
+    const parsed = JSON.parse(trimmed) as Record<string, unknown>;
+    if (!parsed || typeof parsed !== "object") return false;
+    return (
+      typeof parsed.timeUnixNano === "string" &&
+      typeof parsed.severityText === "string"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function buildAttachCommand(input: {
+  url: string;
+  workspace: string;
+  username?: string;
+  password?: string;
+}): string {
+  const parts: string[] = [];
+  if (input.username && input.password) {
+    parts.push(`OPENCODE_SERVER_USERNAME=${input.username}`);
+  }
+  if (input.password) {
+    parts.push(`OPENCODE_SERVER_PASSWORD=${input.password}`);
+  }
+  parts.push("opencode", "attach", input.url, "--dir", input.workspace);
+  return parts.join(" ");
+}
+
+async function runClipboardCommand(
+  command: string,
+  args: string[],
+  text: string,
+): Promise<boolean> {
+  return await new Promise((resolve) => {
+    const child = spawnProcess(command, args, {
+      stdio: ["pipe", "ignore", "ignore"],
+    });
+    child.on("error", () => resolve(false));
+    child.stdin?.write(text);
+    child.stdin?.end();
+    child.on("exit", (code) => resolve(code === 0));
+  });
+}
+
+async function copyToClipboard(
+  text: string,
+): Promise<{ copied: boolean; error?: string }> {
+  const platform = process.platform;
+  const commands: Array<{ command: string; args: string[] }> = [];
+  if (platform === "darwin") {
+    commands.push({ command: "pbcopy", args: [] });
+  } else if (platform === "win32") {
+    commands.push({ command: "clip", args: [] });
+  } else {
+    commands.push({ command: "wl-copy", args: [] });
+    commands.push({ command: "xclip", args: ["-selection", "clipboard"] });
+    commands.push({ command: "xsel", args: ["--clipboard", "--input"] });
+  }
+  for (const entry of commands) {
+    try {
+      const ok = await runClipboardCommand(entry.command, entry.args, text);
+      if (ok) return { copied: true };
+    } catch {
+      // ignore
+    }
+  }
+  return { copied: false, error: "Clipboard unavailable" };
+}
+
+async function spawnRouterDaemon(
+  args: ParsedArgs,
+  dataDir: string,
+  host: string,
+  port: number,
+) {
+  const self = resolveSelfCommand();
+  const commandArgs = [
+    ...self.prefixArgs,
+    "daemon",
+    "run",
+    "--data-dir",
+    dataDir,
+    "--daemon-host",
+    host,
+    "--daemon-port",
+    String(port),
+  ];
+
+  const opencodeBin =
+    readFlag(args.flags, "opencode-bin") ?? process.env.OPENWORK_OPENCODE_BIN;
+  assertManagedOpencodeAuth(args);
+  const opencodeHost = resolveManagedOpencodeHost(
+    readFlag(args.flags, "opencode-host") ?? process.env.OPENWORK_OPENCODE_HOST,
+  );
+  const opencodePort =
+    readFlag(args.flags, "opencode-port") ?? process.env.OPENWORK_OPENCODE_PORT;
+  const opencodeWorkdir =
+    readFlag(args.flags, "opencode-workdir") ??
+    process.env.OPENWORK_OPENCODE_WORKDIR;
+  const opencodeLogLevel = resolveOpencodeLogLevel(
+    readFlag(args.flags, "opencode-log-level") ??
+      process.env.OPENWORK_OPENCODE_LOG_LEVEL,
+  );
+  const opencodeHotReload =
+    readFlag(args.flags, "opencode-hot-reload") ??
+    process.env.OPENWORK_OPENCODE_HOT_RELOAD;
+  const opencodeHotReloadDebounceMs =
+    readFlag(args.flags, "opencode-hot-reload-debounce-ms") ??
+    process.env.OPENWORK_OPENCODE_HOT_RELOAD_DEBOUNCE_MS;
+  const opencodeHotReloadCooldownMs =
+    readFlag(args.flags, "opencode-hot-reload-cooldown-ms") ??
+    process.env.OPENWORK_OPENCODE_HOT_RELOAD_COOLDOWN_MS;
+  const opencodeCredentials = resolveManagedOpencodeCredentials(args);
+  const opencodeUsername = opencodeCredentials.username;
+  const opencodePassword = opencodeCredentials.password;
+  const corsValue =
+    readFlag(args.flags, "cors") ?? process.env.OPENWORK_OPENCODE_CORS;
+  const allowExternal = readBool(
+    args.flags,
+    "allow-external",
+    false,
+    "OPENWORK_ALLOW_EXTERNAL",
+  );
+  const sidecarSource =
+    readFlag(args.flags, "sidecar-source") ??
+    process.env.OPENWORK_SIDECAR_SOURCE;
+  const opencodeSource =
+    readFlag(args.flags, "opencode-source") ??
+    process.env.OPENWORK_OPENCODE_SOURCE;
+  const verbose = readBool(args.flags, "verbose", false, "OPENWORK_VERBOSE");
+  const logFormat =
+    readFlag(args.flags, "log-format") ?? process.env.OPENWORK_LOG_FORMAT;
+  const runId = readFlag(args.flags, "run-id") ?? process.env.OPENWORK_RUN_ID;
+
+  if (opencodeBin) commandArgs.push("--opencode-bin", opencodeBin);
+  if (opencodeHost) commandArgs.push("--opencode-host", opencodeHost);
+  if (opencodePort) commandArgs.push("--opencode-port", String(opencodePort));
+  if (opencodeWorkdir) commandArgs.push("--opencode-workdir", opencodeWorkdir);
+  if (opencodeLogLevel)
+    commandArgs.push("--opencode-log-level", opencodeLogLevel);
+  if (opencodeHotReload)
+    commandArgs.push("--opencode-hot-reload", opencodeHotReload);
+  if (opencodeHotReloadDebounceMs)
+    commandArgs.push(
+      "--opencode-hot-reload-debounce-ms",
+      String(opencodeHotReloadDebounceMs),
+    );
+  if (opencodeHotReloadCooldownMs)
+    commandArgs.push(
+      "--opencode-hot-reload-cooldown-ms",
+      String(opencodeHotReloadCooldownMs),
+    );
+  if (corsValue) commandArgs.push("--cors", corsValue);
+  if (allowExternal) commandArgs.push("--allow-external");
+  if (sidecarSource) commandArgs.push("--sidecar-source", sidecarSource);
+  if (opencodeSource) commandArgs.push("--opencode-source", opencodeSource);
+  if (verbose) commandArgs.push("--verbose");
+  if (logFormat) commandArgs.push("--log-format", String(logFormat));
+  if (runId) commandArgs.push("--run-id", String(runId));
+
+  const child = spawnProcess(self.command, commandArgs, {
+    detached: true,
+    stdio: "ignore",
+    env: {
+      ...process.env,
+      OPENWORK_OPENCODE_USERNAME: opencodeUsername,
+      OPENWORK_OPENCODE_PASSWORD: opencodePassword,
+    },
+  });
+  child.unref();
+}
+
+async function ensureRouterDaemon(
+  args: ParsedArgs,
+  autoStart = true,
+): Promise<{ baseUrl: string; dataDir: string }> {
+  const dataDir = resolveRouterDataDir(args.flags);
+  const statePath = routerStatePath(dataDir);
+  const state = await loadRouterState(statePath);
+  const existing = state.daemon;
+  if (existing && existing.baseUrl && isProcessAlive(existing.pid)) {
+    try {
+      await waitForRouterHealthy(existing.baseUrl, 1500, 150);
+      return { baseUrl: existing.baseUrl, dataDir };
+    } catch {
+      // fallthrough
+    }
+  }
+
+  if (!autoStart) {
+    throw new Error("orchestrator daemon is not running");
+  }
+
+  const host = readFlag(args.flags, "daemon-host") ?? "127.0.0.1";
+  const port = await resolvePort(
+    readNumber(args.flags, "daemon-port", undefined, "OPENWORK_DAEMON_PORT"),
+    "127.0.0.1",
+  );
+  const baseUrl = `http://${host}:${port}`;
+  await spawnRouterDaemon(args, dataDir, host, port);
+  await waitForRouterHealthy(baseUrl, 10_000, 250);
+  return { baseUrl, dataDir };
+}
+
+async function requestRouter(
+  args: ParsedArgs,
+  method: string,
+  path: string,
+  body?: unknown,
+  autoStart = true,
+) {
+  const { baseUrl } = await ensureRouterDaemon(args, autoStart);
+  const url = `${baseUrl.replace(/\/$/, "")}${path}`;
+  const headers: Record<string, string> = {};
+  let payload: string | undefined;
+  if (body !== undefined) {
+    payload = JSON.stringify(body);
+    headers["Content-Type"] = "application/json";
+  }
+  return fetchJson(url, {
+    method,
+    headers,
+    body: payload,
+  });
+}
+
+async function runDaemonCommand(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const subcommand = args.positionals[1] ?? "run";
+
+  try {
+    if (subcommand === "run" || subcommand === "foreground") {
+      await runRouterDaemon(args);
+      return;
+    }
+    if (subcommand === "start") {
+      const { baseUrl } = await ensureRouterDaemon(args, true);
+      const status = await fetchJson(`${baseUrl.replace(/\/$/, "")}/health`);
+      outputResult({ ok: true, baseUrl, ...status }, outputJson);
+      return;
+    }
+    if (subcommand === "status") {
+      const { baseUrl } = await ensureRouterDaemon(args, false);
+      const status = await fetchJson(`${baseUrl.replace(/\/$/, "")}/health`);
+      outputResult({ ok: true, baseUrl, ...status }, outputJson);
+      return;
+    }
+    if (subcommand === "stop") {
+      const { baseUrl } = await ensureRouterDaemon(args, false);
+      await fetchJson(`${baseUrl.replace(/\/$/, "")}/shutdown`, {
+        method: "POST",
+      });
+      outputResult({ ok: true }, outputJson);
+      return;
+    }
+    throw new Error("daemon requires start|stop|status|run");
+  } catch (error) {
+    outputError(error, outputJson);
+    process.exitCode = 1;
+  }
+}
+
+async function runWorkspaceCommand(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const subcommand = args.positionals[1];
+  const id = args.positionals[2];
+
+  try {
+    if (subcommand === "add") {
+      if (!id) throw new Error("workspace path is required");
+      const name = readFlag(args.flags, "name");
+      const result = await requestRouter(args, "POST", "/workspaces", {
+        path: id,
+        name: name ?? null,
+      });
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    if (subcommand === "add-remote") {
+      if (!id) throw new Error("baseUrl is required");
+      const directory = readFlag(args.flags, "directory");
+      const name = readFlag(args.flags, "name");
+      const result = await requestRouter(args, "POST", "/workspaces/remote", {
+        baseUrl: id,
+        directory: directory ?? null,
+        name: name ?? null,
+      });
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    if (subcommand === "list") {
+      const result = await requestRouter(args, "GET", "/workspaces");
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    if (subcommand === "switch") {
+      if (!id) throw new Error("workspace id is required");
+      const result = await requestRouter(
+        args,
+        "POST",
+        `/workspaces/${encodeURIComponent(id)}/activate`,
+      );
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    if (subcommand === "info") {
+      if (!id) throw new Error("workspace id is required");
+      const result = await requestRouter(
+        args,
+        "GET",
+        `/workspaces/${encodeURIComponent(id)}`,
+      );
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    if (subcommand === "path") {
+      if (!id) throw new Error("workspace id is required");
+      const result = await requestRouter(
+        args,
+        "GET",
+        `/workspaces/${encodeURIComponent(id)}/path`,
+      );
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    throw new Error("workspace requires add|add-remote|list|switch|info|path");
+  } catch (error) {
+    outputError(error, outputJson);
+    process.exitCode = 1;
+  }
+}
+
+async function runInstanceCommand(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const subcommand = args.positionals[1];
+  const id = args.positionals[2];
+
+  try {
+    if (subcommand === "dispose") {
+      if (!id) throw new Error("workspace id is required");
+      const result = await requestRouter(
+        args,
+        "POST",
+        `/instances/${encodeURIComponent(id)}/dispose`,
+      );
+      outputResult({ ok: true, ...result }, outputJson);
+      return;
+    }
+    throw new Error("instance requires dispose");
+  } catch (error) {
+    outputError(error, outputJson);
+    process.exitCode = 1;
+  }
+}
+
+async function runRouterDaemon(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const verbose = readBool(args.flags, "verbose", false, "OPENWORK_VERBOSE");
+  const logFormat = readLogFormat(
+    args.flags,
+    "log-format",
+    "pretty",
+    "OPENWORK_LOG_FORMAT",
+  );
+  const colorEnabled =
+    readBool(args.flags, "color", process.stdout.isTTY, "OPENWORK_COLOR") &&
+    !process.env.NO_COLOR;
+  const runId =
+    readFlag(args.flags, "run-id") ??
+    process.env.OPENWORK_RUN_ID ??
+    randomUUID();
+  const cliVersion = await resolveCliVersion();
+  const logger = createLogger({
+    format: logFormat,
+    runId,
+    serviceName: "openwork-orchestrator",
+    serviceVersion: cliVersion,
+    output: "stdout",
+    color: colorEnabled,
+  });
+  const logVerbose = createVerboseLogger(
+    verbose && !outputJson,
+    logger,
+    "openwork-orchestrator",
+  );
+  const sidecarSourceInput = readBinarySource(
+    args.flags,
+    "sidecar-source",
+    "auto",
+    "OPENWORK_SIDECAR_SOURCE",
+  );
+  const opencodeSourceInput = readBinarySource(
+    args.flags,
+    "opencode-source",
+    "auto",
+    "OPENWORK_OPENCODE_SOURCE",
+  );
+  const sidecarSource = sidecarSourceInput;
+  const opencodeSource = opencodeSourceInput;
+  const dataDir = resolveRouterDataDir(args.flags);
+  const statePath = routerStatePath(dataDir);
+  let state = await loadRouterState(statePath);
+
+  const host = readFlag(args.flags, "daemon-host") ?? "127.0.0.1";
+  const port = await resolvePort(
+    readNumber(args.flags, "daemon-port", undefined, "OPENWORK_DAEMON_PORT"),
+    "127.0.0.1",
+  );
+
+  const opencodeBin =
+    readFlag(args.flags, "opencode-bin") ?? process.env.OPENWORK_OPENCODE_BIN;
+  assertManagedOpencodeAuth(args);
+  const opencodeHost = resolveManagedOpencodeHost(
+    readFlag(args.flags, "opencode-host") ?? process.env.OPENWORK_OPENCODE_HOST,
+  );
+  const opencodeCredentials = resolveManagedOpencodeCredentials(args);
+  const opencodeUsername = opencodeCredentials.username;
+  const opencodePassword = opencodeCredentials.password;
+  const authHeaders = {
+    Authorization: `Basic ${encodeBasicAuth(opencodeCredentials.username, opencodeCredentials.password)}`,
+  };
+  const opencodePort = await resolvePort(
+    readNumber(
+      args.flags,
+      "opencode-port",
+      state.opencode?.port,
+      "OPENWORK_OPENCODE_PORT",
+    ),
+    "127.0.0.1",
+    state.opencode?.port,
+  );
+  const opencodeLogLevel = resolveOpencodeLogLevel(
+    readFlag(args.flags, "opencode-log-level") ??
+      process.env.OPENWORK_OPENCODE_LOG_LEVEL,
+  );
+  const opencodeHotReload = readOpencodeHotReload(
+    args.flags,
+    {
+      enabled: true,
+      debounceMs: DEFAULT_OPENCODE_HOT_RELOAD_DEBOUNCE_MS,
+      cooldownMs: DEFAULT_OPENCODE_HOT_RELOAD_COOLDOWN_MS,
+    },
+    {
+      enabled: "OPENWORK_OPENCODE_HOT_RELOAD",
+      debounceMs: "OPENWORK_OPENCODE_HOT_RELOAD_DEBOUNCE_MS",
+      cooldownMs: "OPENWORK_OPENCODE_HOT_RELOAD_COOLDOWN_MS",
+    },
+  );
+  const corsValue =
+    readFlag(args.flags, "cors") ??
+    process.env.OPENWORK_OPENCODE_CORS ??
+    "http://localhost:5173,tauri://localhost,http://tauri.localhost";
+  const corsOrigins = parseList(corsValue);
+  const opencodeWorkdirFlag =
+    readFlag(args.flags, "opencode-workdir") ??
+    process.env.OPENWORK_OPENCODE_WORKDIR;
+  const activeWorkspace = state.workspaces.find(
+    (entry) => entry.id === state.activeId && entry.workspaceType === "local",
+  );
+  const opencodeWorkdir =
+    opencodeWorkdirFlag ?? activeWorkspace?.path ?? process.cwd();
+  const resolvedWorkdir = await ensureWorkspace(opencodeWorkdir);
+  const devMode = resolveInternalDevMode(args.flags);
+  const opencodeStateLayout = resolveOpencodeStateLayout({
+    dataDir,
+    workspace: resolvedWorkdir,
+    devMode,
+  });
+  const opencodeConfigDir = opencodeStateLayout.configDir;
+  await ensureOpencodeStateLayout(opencodeStateLayout);
+  await ensureOpencodeManagedTools(opencodeConfigDir);
+  logger.info(
+    "Daemon starting",
+    { runId, logFormat, workdir: resolvedWorkdir, host, port },
+    "openwork-orchestrator",
+  );
+
+  const sidecar = resolveSidecarConfig(args.flags, cliVersion);
+  const allowExternal = readBool(
+    args.flags,
+    "allow-external",
+    false,
+    "OPENWORK_ALLOW_EXTERNAL",
+  );
+  const manifest = await readVersionManifest();
+  logVerbose(`cli version: ${cliVersion}`);
+  logVerbose(`sidecar target: ${sidecar.target ?? "unknown"}`);
+  logVerbose(`sidecar dir: ${sidecar.dir}`);
+  logVerbose(`sidecar base URL: ${sidecar.baseUrl}`);
+  logVerbose(`sidecar manifest: ${sidecar.manifestUrl}`);
+  logVerbose(`sidecar source: ${sidecarSource}`);
+  logVerbose(`opencode source: ${opencodeSource}`);
+  logVerbose(
+    `opencode hot reload: ${opencodeHotReload.enabled ? "on" : "off"} (debounce=${opencodeHotReload.debounceMs}ms cooldown=${opencodeHotReload.cooldownMs}ms)`,
+  );
+  logVerbose(`allow external: ${allowExternal ? "true" : "false"}`);
+  let opencodeBinary = await resolveOpencodeBin({
+    explicit: opencodeBin,
+    manifest,
+    allowExternal,
+    sidecar,
+    source: opencodeSource,
+  });
+  logVerbose(`opencode bin: ${opencodeBinary.bin} (${opencodeBinary.source})`);
+
+  let opencodeChild: ReturnType<typeof spawn> | null = null;
+
+  const updateDiagnostics = (actualVersion?: string) => {
+    state.cliVersion = cliVersion;
+    state.sidecar = {
+      dir: sidecar.dir,
+      baseUrl: sidecar.baseUrl,
+      manifestUrl: sidecar.manifestUrl,
+      target: sidecar.target,
+      source: sidecarSource,
+      opencodeSource,
+      allowExternal,
+    };
+    state.binaries = {
+      opencode: {
+        path: opencodeBinary.bin,
+        source: opencodeBinary.source,
+        expectedVersion: opencodeBinary.expectedVersion,
+        actualVersion,
+      },
+    };
+  };
+
+  const ensureOpencode = async () => {
+    const existing = state.opencode;
+    if (existing && isProcessAlive(existing.pid)) {
+      const client = createOpencodeClient({
+        baseUrl: existing.baseUrl,
+        directory: resolvedWorkdir,
+        headers: authHeaders,
+      });
+      try {
+        await waitForOpencodeHealthy(client, 2000, 200);
+        if (!state.sidecar || !state.cliVersion || !state.binaries?.opencode) {
+          updateDiagnostics(state.binaries?.opencode?.actualVersion);
+          await saveRouterState(statePath, state);
+        }
+        return { baseUrl: existing.baseUrl, client };
+      } catch {
+        // restart
+      }
+    }
+
+    if (opencodeChild) {
+      await stopChild(opencodeChild);
+    }
+
+    const opencodeActualVersion = await verifyOpencodeVersion(opencodeBinary);
+    logVerbose(`opencode version: ${opencodeActualVersion ?? "unknown"}`);
+    const child = await startOpencode({
+      bin: opencodeBinary.bin,
+      workspace: resolvedWorkdir,
+      stateLayout: opencodeStateLayout,
+      hotReload: opencodeHotReload,
+      bindHost: opencodeHost,
+      port: opencodePort,
+      username: opencodeCredentials.username,
+      password: opencodeCredentials.password,
+      corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+      logger,
+      runId,
+      logFormat,
+      logLevel: opencodeLogLevel,
+    });
+    opencodeChild = child;
+    logger.info("Process spawned", { pid: child.pid ?? 0 }, "opencode");
+    const baseUrl = `http://${opencodeHost}:${opencodePort}`;
+    const client = createOpencodeClient({
+      baseUrl,
+      directory: resolvedWorkdir,
+      headers: authHeaders,
+    });
+    logger.info("Waiting for health", { url: baseUrl }, "opencode");
+    await waitForOpencodeHealthy(client);
+    logger.info("Healthy", { url: baseUrl }, "opencode");
+    state.opencode = {
+      pid: child.pid ?? 0,
+      port: opencodePort,
+      baseUrl,
+      startedAt: nowMs(),
+    };
+    updateDiagnostics(opencodeActualVersion);
+    await saveRouterState(statePath, state);
+    return { baseUrl, client };
+  };
+
+  await ensureOpencode();
+
+  const server = createHttpServer(async (req, res) => {
+    const startedAt = Date.now();
+    const method = req.method ?? "GET";
+    const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+    res.on("finish", () => {
+      logger.info(
+        "Router request",
+        {
+          method,
+          path: url.pathname,
+          status: res.statusCode,
+          durationMs: Date.now() - startedAt,
+          activeId: state.activeId,
+        },
+        "openwork-orchestrator-router",
+      );
+    });
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+
+    if (req.method === "OPTIONS") {
+      res.statusCode = 204;
+      res.end();
+      return;
+    }
+    const parts = url.pathname.split("/").filter(Boolean);
+
+    const send = (status: number, payload: unknown) => {
+      res.statusCode = status;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify(payload));
+    };
+
+    const readBody = async () => {
+      const chunks: Buffer[] = [];
+      for await (const chunk of req) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      if (!chunks.length) return null;
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if (!raw.trim()) return null;
+      return JSON.parse(raw);
+    };
+
+    try {
+      if (req.method === "GET" && url.pathname === "/health") {
+        send(200, {
+          ok: true,
+          daemon: state.daemon ?? null,
+          opencode: state.opencode ?? null,
+          activeId: state.activeId,
+          workspaceCount: state.workspaces.length,
+          cliVersion: state.cliVersion ?? null,
+          sidecar: state.sidecar ?? null,
+          binaries: state.binaries ?? null,
+        });
+        return;
+      }
+
+      if (req.method === "GET" && url.pathname === "/workspaces") {
+        send(200, { activeId: state.activeId, workspaces: state.workspaces });
+        return;
+      }
+
+      if (req.method === "POST" && url.pathname === "/workspaces") {
+        const body = await readBody();
+        const pathInput =
+          typeof body?.path === "string" ? body.path.trim() : "";
+        if (!pathInput) {
+          send(400, { error: "path is required" });
+          return;
+        }
+        const resolved = await ensureWorkspace(pathInput);
+        const id = workspaceIdForLocal(resolved);
+        const name =
+          typeof body?.name === "string" && body.name.trim()
+            ? body.name.trim()
+            : (resolved.split(/[\\/]/).filter(Boolean).pop() ?? "Workspace");
+        const existing = state.workspaces.find((entry) => entry.id === id);
+        const entry: RouterWorkspace = {
+          id,
+          name,
+          path: resolved,
+          workspaceType: "local",
+          createdAt: existing?.createdAt ?? nowMs(),
+          lastUsedAt: nowMs(),
+        };
+        state.workspaces = state.workspaces.filter((item) => item.id !== id);
+        state.workspaces.push(entry);
+        if (!state.activeId) state.activeId = id;
+        await saveRouterState(statePath, state);
+        send(200, { activeId: state.activeId, workspace: entry });
+        return;
+      }
+
+      if (req.method === "POST" && url.pathname === "/workspaces/remote") {
+        const body = await readBody();
+        const baseUrl =
+          typeof body?.baseUrl === "string" ? body.baseUrl.trim() : "";
+        if (
+          !baseUrl ||
+          (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://"))
+        ) {
+          send(400, { error: "baseUrl must start with http:// or https://" });
+          return;
+        }
+        const directory =
+          typeof body?.directory === "string" ? body.directory.trim() : "";
+        const id = workspaceIdForRemote(baseUrl, directory || undefined);
+        const name =
+          typeof body?.name === "string" && body.name.trim()
+            ? body.name.trim()
+            : baseUrl;
+        const existing = state.workspaces.find((entry) => entry.id === id);
+        const entry: RouterWorkspace = {
+          id,
+          name,
+          path: directory,
+          workspaceType: "remote",
+          baseUrl,
+          directory: directory || undefined,
+          createdAt: existing?.createdAt ?? nowMs(),
+          lastUsedAt: nowMs(),
+        };
+        state.workspaces = state.workspaces.filter((item) => item.id !== id);
+        state.workspaces.push(entry);
+        if (!state.activeId) state.activeId = id;
+        await saveRouterState(statePath, state);
+        send(200, { activeId: state.activeId, workspace: entry });
+        return;
+      }
+
+      if (
+        parts[0] === "workspaces" &&
+        parts.length === 2 &&
+        req.method === "GET"
+      ) {
+        const workspace = findWorkspace(
+          state,
+          decodeURIComponent(parts[1] ?? ""),
+        );
+        if (!workspace) {
+          send(404, { error: "workspace not found" });
+          return;
+        }
+        send(200, { workspace });
+        return;
+      }
+
+      if (
+        parts[0] === "workspaces" &&
+        parts.length === 3 &&
+        parts[2] === "activate" &&
+        req.method === "POST"
+      ) {
+        const workspace = findWorkspace(
+          state,
+          decodeURIComponent(parts[1] ?? ""),
+        );
+        if (!workspace) {
+          send(404, { error: "workspace not found" });
+          return;
+        }
+        state.activeId = workspace.id;
+        workspace.lastUsedAt = nowMs();
+        await saveRouterState(statePath, state);
+        send(200, { activeId: state.activeId, workspace });
+        return;
+      }
+
+      if (
+        parts[0] === "workspaces" &&
+        parts.length === 3 &&
+        parts[2] === "path" &&
+        req.method === "GET"
+      ) {
+        const workspace = findWorkspace(
+          state,
+          decodeURIComponent(parts[1] ?? ""),
+        );
+        if (!workspace) {
+          send(404, { error: "workspace not found" });
+          return;
+        }
+        const isRemote = workspace.workspaceType === "remote";
+        const baseUrl = isRemote
+          ? (workspace.baseUrl ?? "")
+          : (await ensureOpencode()).baseUrl;
+        if (!baseUrl) {
+          send(400, { error: "workspace baseUrl missing" });
+          return;
+        }
+        const directory = isRemote
+          ? (workspace.directory ?? "")
+          : workspace.path;
+        const client = createOpencodeClient({
+          baseUrl,
+          directory: directory ? directory : undefined,
+          headers: authHeaders,
+        });
+        const pathInfo = unwrap(await client.path.get());
+        workspace.lastUsedAt = nowMs();
+        await saveRouterState(statePath, state);
+        send(200, { workspace, path: pathInfo });
+        return;
+      }
+
+      if (
+        parts[0] === "instances" &&
+        parts.length === 3 &&
+        parts[2] === "dispose" &&
+        req.method === "POST"
+      ) {
+        const workspace = findWorkspace(
+          state,
+          decodeURIComponent(parts[1] ?? ""),
+        );
+        if (!workspace) {
+          send(404, { error: "workspace not found" });
+          return;
+        }
+        const isRemote = workspace.workspaceType === "remote";
+        const baseUrl = isRemote
+          ? (workspace.baseUrl ?? "")
+          : (await ensureOpencode()).baseUrl;
+        if (!baseUrl) {
+          send(400, { error: "workspace baseUrl missing" });
+          return;
+        }
+        const directory = isRemote
+          ? (workspace.directory ?? "")
+          : workspace.path;
+        const response = await fetch(
+          `${baseUrl.replace(/\/$/, "")}/instance/dispose?directory=${encodeURIComponent(directory)}`,
+          { method: "POST", headers: authHeaders },
+        );
+        const ok = response.ok ? await response.json() : false;
+        workspace.lastUsedAt = nowMs();
+        await saveRouterState(statePath, state);
+        send(200, { disposed: ok });
+        return;
+      }
+
+      if (req.method === "POST" && url.pathname === "/shutdown") {
+        send(200, { ok: true });
+        await shutdown();
+        return;
+      }
+
+      send(404, { error: "not found" });
+    } catch (error) {
+      send(500, {
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  });
+
+  const shutdown = async () => {
+    logger.info(
+      "Daemon shutting down",
+      { host, port },
+      "openwork-orchestrator-router",
+    );
+    try {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    } catch {
+      // ignore
+    }
+
+    if (opencodeChild) {
+      await stopChild(opencodeChild);
+      opencodeChild = null;
+    }
+
+    state.daemon = undefined;
+    if (state.opencode && !isProcessAlive(state.opencode.pid)) {
+      state.opencode = undefined;
+    }
+    await saveRouterState(statePath, state);
+    process.exit(0);
+  };
+
+  server.listen(port, host, async () => {
+    state.daemon = {
+      pid: process.pid,
+      port,
+      baseUrl: `http://${host}:${port}`,
+      startedAt: nowMs(),
+    };
+    await saveRouterState(statePath, state);
+    if (outputJson) {
+      outputResult({ ok: true, daemon: state.daemon }, true);
+    } else {
+      if (logFormat === "json") {
+        logger.info(
+          "Daemon running",
+          { host, port },
+          "openwork-orchestrator-router",
+        );
+      } else {
+        console.log(`orchestrator daemon running on ${host}:${port}`);
+      }
+    }
+  });
+
+  process.on("SIGINT", () => shutdown());
+  process.on("SIGTERM", () => shutdown());
+  await new Promise(() => undefined);
+}
+
+function readOpenworkClientAuth(args: ParsedArgs): {
+  openworkUrl: string;
+  token: string;
+} {
+  const openworkUrl =
+    readFlag(args.flags, "openwork-url") ??
+    process.env.OPENWORK_URL ??
+    process.env.OPENWORK_SERVER_URL ??
+    "";
+  const token =
+    readFlag(args.flags, "token") ??
+    readFlag(args.flags, "openwork-token") ??
+    process.env.OPENWORK_TOKEN ??
+    "";
+
+  if (!openworkUrl || !token) {
+    throw new Error("openwork-url and token are required");
+  }
+
+  return { openworkUrl, token };
+}
+
+function readSessionId(args: ParsedArgs, fallbackIndex: number): string {
+  const sessionId =
+    readFlag(args.flags, "session-id") ?? args.positionals[fallbackIndex] ?? "";
+  const trimmed = sessionId.trim();
+  if (!trimmed) {
+    throw new Error("session-id is required");
+  }
+  return trimmed;
+}
+
+async function runFiles(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const subcommand = args.positionals[1] ?? "";
+  const { openworkUrl, token } = readOpenworkClientAuth(args);
+  const baseUrl = openworkUrl.replace(/\/$/, "");
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${token}`,
+  };
+
+  try {
+    if (subcommand === "session") {
+      const action = args.positionals[2] ?? "create";
+      if (action === "create") {
+        const workspaceId =
+          readFlag(args.flags, "workspace-id") ?? args.positionals[3] ?? "";
+        if (!workspaceId.trim()) {
+          throw new Error("workspace-id is required for files session create");
+        }
+        const ttlSeconds = readNumber(args.flags, "ttl-seconds", undefined);
+        const writeRequested = readBool(args.flags, "write", true);
+        const result = await fetchJson(
+          `${baseUrl}/workspace/${encodeURIComponent(workspaceId.trim())}/files/sessions`,
+          {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+              ...(typeof ttlSeconds === "number" ? { ttlSeconds } : {}),
+              write: writeRequested,
+            }),
+          },
+        );
+        outputResult(result, outputJson);
+        return;
+      }
+      if (action === "renew") {
+        const sessionId = readSessionId(args, 3);
+        const ttlSeconds = readNumber(args.flags, "ttl-seconds", undefined);
+        const result = await fetchJson(
+          `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/renew`,
+          {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+              ...(typeof ttlSeconds === "number" ? { ttlSeconds } : {}),
+            }),
+          },
+        );
+        outputResult(result, outputJson);
+        return;
+      }
+      if (action === "close" || action === "delete") {
+        const sessionId = readSessionId(args, 3);
+        const result = await fetchJson(
+          `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}`,
+          {
+            method: "DELETE",
+            headers,
+          },
+        );
+        outputResult(result, outputJson);
+        return;
+      }
+      throw new Error("files session requires create|renew|close");
+    }
+
+    if (subcommand === "catalog") {
+      const sessionId = readSessionId(args, 2);
+      const params = new URLSearchParams();
+      const prefix = readFlag(args.flags, "prefix");
+      const after = readFlag(args.flags, "after");
+      const limit = readNumber(args.flags, "limit", undefined);
+      const includeDirs = readBool(args.flags, "include-dirs", true);
+      if (prefix?.trim()) params.set("prefix", prefix.trim());
+      if (after?.trim()) params.set("after", after.trim());
+      if (typeof limit === "number") params.set("limit", String(limit));
+      if (!includeDirs) params.set("includeDirs", "false");
+      const query = params.toString();
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/catalog/snapshot${query ? `?${query}` : ""}`,
+        {
+          headers,
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "events") {
+      const sessionId = readSessionId(args, 2);
+      const since = readNumber(args.flags, "since", undefined);
+      const query =
+        typeof since === "number"
+          ? `?since=${encodeURIComponent(String(since))}`
+          : "";
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/catalog/events${query}`,
+        {
+          headers,
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "read") {
+      const sessionId = readSessionId(args, 2);
+      const pathsRaw = readFlag(args.flags, "paths");
+      const singlePath = readFlag(args.flags, "path") ?? args.positionals[3];
+      const paths = pathsRaw
+        ? parseList(pathsRaw)
+        : singlePath
+          ? [singlePath]
+          : [];
+      if (!paths.length) {
+        throw new Error("path or paths is required for files read");
+      }
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/read-batch`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ paths }),
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "write") {
+      const sessionId = readSessionId(args, 2);
+      const path = readFlag(args.flags, "path") ?? args.positionals[3] ?? "";
+      if (!path.trim()) {
+        throw new Error("path is required for files write");
+      }
+
+      let contentBase64 = readFlag(args.flags, "content-base64") ?? "";
+      if (!contentBase64) {
+        const inlineContent = readFlag(args.flags, "content");
+        if (inlineContent !== undefined) {
+          contentBase64 = Buffer.from(inlineContent, "utf8").toString("base64");
+        }
+      }
+      if (!contentBase64) {
+        const filePath = readFlag(args.flags, "file");
+        if (filePath?.trim()) {
+          const fileBytes = await readFile(resolve(filePath.trim()));
+          contentBase64 = Buffer.from(fileBytes).toString("base64");
+        }
+      }
+      if (!contentBase64) {
+        throw new Error(
+          "provide one of --content, --content-base64, or --file",
+        );
+      }
+
+      const ifMatchRevision = readFlag(args.flags, "if-match");
+      const force = readBool(args.flags, "force", false);
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/write-batch`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            writes: [
+              {
+                path: path.trim(),
+                contentBase64,
+                ...(ifMatchRevision?.trim()
+                  ? { ifMatchRevision: ifMatchRevision.trim() }
+                  : {}),
+                ...(force ? { force: true } : {}),
+              },
+            ],
+          }),
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "mkdir") {
+      const sessionId = readSessionId(args, 2);
+      const path = readFlag(args.flags, "path") ?? args.positionals[3] ?? "";
+      if (!path.trim()) throw new Error("path is required for files mkdir");
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/ops`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            operations: [{ type: "mkdir", path: path.trim() }],
+          }),
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "delete") {
+      const sessionId = readSessionId(args, 2);
+      const path = readFlag(args.flags, "path") ?? args.positionals[3] ?? "";
+      if (!path.trim()) throw new Error("path is required for files delete");
+      const recursive = readBool(args.flags, "recursive", false);
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/ops`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            operations: [
+              {
+                type: "delete",
+                path: path.trim(),
+                ...(recursive ? { recursive: true } : {}),
+              },
+            ],
+          }),
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    if (subcommand === "rename") {
+      const sessionId = readSessionId(args, 2);
+      const from = readFlag(args.flags, "from") ?? args.positionals[3] ?? "";
+      const to = readFlag(args.flags, "to") ?? args.positionals[4] ?? "";
+      if (!from.trim() || !to.trim()) {
+        throw new Error("from and to are required for files rename");
+      }
+      const result = await fetchJson(
+        `${baseUrl}/files/sessions/${encodeURIComponent(sessionId)}/ops`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            operations: [{ type: "rename", from: from.trim(), to: to.trim() }],
+          }),
+        },
+      );
+      outputResult(result, outputJson);
+      return;
+    }
+
+    throw new Error(
+      "files requires session|catalog|events|read|write|mkdir|delete|rename",
+    );
+  } catch (error) {
+    outputError(error, outputJson);
+    process.exitCode = 1;
+  }
+}
+
+async function runApprovals(args: ParsedArgs) {
+  const subcommand = args.positionals[1];
+  if (!subcommand || (subcommand !== "list" && subcommand !== "reply")) {
+    throw new Error("approvals requires 'list' or 'reply'");
+  }
+
+  const openworkUrl =
+    readFlag(args.flags, "openwork-url") ??
+    process.env.OPENWORK_URL ??
+    process.env.OPENWORK_SERVER_URL ??
+    "";
+  const hostToken =
+    readFlag(args.flags, "host-token") ?? process.env.OPENWORK_HOST_TOKEN ?? "";
+
+  if (!openworkUrl || !hostToken) {
+    throw new Error("openwork-url and host-token are required for approvals");
+  }
+
+  const headers = {
+    "Content-Type": "application/json",
+    "X-OpenWork-Host-Token": hostToken,
+  };
+
+  if (subcommand === "list") {
+    const response = await fetch(
+      `${openworkUrl.replace(/\/$/, "")}/approvals`,
+      { headers },
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to list approvals: ${response.status}`);
+    }
+    const body = await response.json();
+    console.log(JSON.stringify(body, null, 2));
+    return;
+  }
+
+  const approvalId = args.positionals[2];
+  if (!approvalId) {
+    throw new Error("approval id is required for approvals reply");
+  }
+
+  const allow = readBool(args.flags, "allow", false);
+  const deny = readBool(args.flags, "deny", false);
+  if (allow === deny) {
+    throw new Error("use --allow or --deny");
+  }
+
+  const payload = { reply: allow ? "allow" : "deny" };
+  const response = await fetch(
+    `${openworkUrl.replace(/\/$/, "")}/approvals/${approvalId}`,
+    {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload),
+    },
+  );
+  if (!response.ok) {
+    throw new Error(`Failed to reply to approval: ${response.status}`);
+  }
+  const body = await response.json();
+  console.log(JSON.stringify(body, null, 2));
+}
+
+async function runStatus(args: ParsedArgs) {
+  const openworkUrl =
+    readFlag(args.flags, "openwork-url") ?? process.env.OPENWORK_URL ?? "";
+  const opencodeUrl =
+    readFlag(args.flags, "opencode-url") ?? process.env.OPENCODE_URL ?? "";
+  const username =
+    readFlag(args.flags, "opencode-username") ??
+    process.env.OPENCODE_SERVER_USERNAME;
+  const password =
+    readFlag(args.flags, "opencode-password") ??
+    process.env.OPENCODE_SERVER_PASSWORD;
+  const outputJson = readBool(args.flags, "json", false);
+
+  const status: Record<string, unknown> = {};
+
+  if (openworkUrl) {
+    try {
+      await waitForHealthy(openworkUrl, 5000, 400);
+      status.openwork = { ok: true, url: openworkUrl };
+    } catch (error) {
+      status.openwork = { ok: false, url: openworkUrl, error: String(error) };
+    }
+  }
+
+  if (opencodeUrl) {
+    try {
+      const headers: Record<string, string> = {};
+      if (username && password) {
+        headers.Authorization = `Basic ${encodeBasicAuth(username, password)}`;
+      }
+      const client = createOpencodeClient({
+        baseUrl: opencodeUrl,
+        headers,
+      });
+      const health = await waitForOpencodeHealthy(client, 5000, 400);
+      status.opencode = { ok: true, url: opencodeUrl, health };
+    } catch (error) {
+      status.opencode = { ok: false, url: opencodeUrl, error: String(error) };
+    }
+  }
+
+  if (outputJson) {
+    console.log(JSON.stringify(status, null, 2));
+  } else {
+    if (status.openwork) {
+      const openwork = status.openwork as {
+        ok: boolean;
+        url: string;
+        error?: string;
+      };
+      console.log(
+        `OpenWork server: ${openwork.ok ? "ok" : "error"} (${openwork.url})`,
+      );
+      if (openwork.error) console.log(`  ${openwork.error}`);
+    }
+    if (status.opencode) {
+      const opencode = status.opencode as {
+        ok: boolean;
+        url: string;
+        error?: string;
+      };
+      console.log(
+        `OpenCode server: ${opencode.ok ? "ok" : "error"} (${opencode.url})`,
+      );
+      if (opencode.error) console.log(`  ${opencode.error}`);
+    }
+  }
+}
+
+async function runStart(args: ParsedArgs) {
+  const outputJson = readBool(args.flags, "json", false);
+  const checkOnly = readBool(args.flags, "check", false);
+  const checkEvents = readBool(args.flags, "check-events", false);
+  const verbose = readBool(args.flags, "verbose", false, "OPENWORK_VERBOSE");
+  const logFormat = readLogFormat(
+    args.flags,
+    "log-format",
+    "pretty",
+    "OPENWORK_LOG_FORMAT",
+  );
+  const detachRequested = readBool(
+    args.flags,
+    "detach",
+    false,
+    "OPENWORK_DETACH",
+  );
+  const defaultTui =
+    process.stdout.isTTY && !outputJson && !checkOnly && !checkEvents;
+  const tuiRequested = readBool(args.flags, "tui", defaultTui);
+  let useTui =
+    tuiRequested &&
+    !detachRequested &&
+    !outputJson &&
+    !checkOnly &&
+    !checkEvents &&
+    logFormat === "pretty";
+  const colorPreferred =
+    readBool(args.flags, "color", process.stdout.isTTY, "OPENWORK_COLOR") &&
+    !process.env.NO_COLOR;
+  const runId =
+    readFlag(args.flags, "run-id") ??
+    process.env.OPENWORK_RUN_ID ??
+    randomUUID();
+  const cliVersion = await resolveCliVersion();
+  const compiledBinary = isCompiledBunBinary();
+  let tui: TuiHandle | undefined;
+  let restoreConsoleError: (() => void) | undefined;
+  const baseLoggerOptions = {
+    format: logFormat,
+    runId,
+    serviceName: "openwork-orchestrator",
+    serviceVersion: cliVersion,
+    onLog: (event: LogEvent) => {
+      if (!tui) return;
+      const component = event.component ?? "openwork-orchestrator";
+      const tuiComponent =
+        component === "opencode-router" ? "router" : component;
+      tui.pushLog({
+        time: event.time,
+        level: event.level,
+        component: tuiComponent,
+        message: event.message,
+      });
+    },
+  };
+  let logger = createLogger({
+    ...baseLoggerOptions,
+    output: useTui ? "silent" : "stdout",
+    color: useTui ? false : colorPreferred,
+  });
+  let logVerbose = createVerboseLogger(
+    verbose && !outputJson,
+    logger,
+    "openwork-orchestrator",
+  );
+  const switchToPlainOutput = (error: string) => {
+    if (!useTui) return;
+    useTui = false;
+    restoreConsoleError?.();
+    restoreConsoleError = undefined;
+    tui?.stop();
+    tui = undefined;
+    logger = createLogger({
+      ...baseLoggerOptions,
+      output: "stdout",
+      color: colorPreferred,
+    });
+    logVerbose = createVerboseLogger(
+      verbose && !outputJson,
+      logger,
+      "openwork-orchestrator",
+    );
+    logger.warn(
+      "TUI failed to start; falling back to plain output. Use `openwork serve` for explicit non-TUI mode.",
+      { error },
+      "openwork-orchestrator",
+    );
+  };
+  const sidecarSourceInput = readBinarySource(
+    args.flags,
+    "sidecar-source",
+    "auto",
+    "OPENWORK_SIDECAR_SOURCE",
+  );
+  const opencodeSourceInput = readBinarySource(
+    args.flags,
+    "opencode-source",
+    "auto",
+    "OPENWORK_OPENCODE_SOURCE",
+  );
+
+  const workspace =
+    readFlag(args.flags, "workspace") ??
+    process.env.OPENWORK_WORKSPACE ??
+    process.cwd();
+  const resolvedWorkspace = await ensureWorkspace(workspace);
+  logger.info(
+    "Run starting",
+    { workspace: resolvedWorkspace, logFormat, runId },
+    "openwork-orchestrator",
+  );
+
+  const sandboxRequested = readSandboxMode(
+    args.flags,
+    "sandbox",
+    "none",
+    "OPENWORK_SANDBOX",
+  );
+  const sandboxMode = await resolveSandboxMode(sandboxRequested);
+  const sandboxImage =
+    readFlag(args.flags, "sandbox-image") ??
+    process.env.OPENWORK_SANDBOX_IMAGE ??
+    "debian:bookworm-slim";
+  const sandboxPersistOverride =
+    readFlag(args.flags, "sandbox-persist-dir") ??
+    process.env.OPENWORK_SANDBOX_PERSIST_DIR;
+  const dataDir = resolveRouterDataDir(args.flags);
+  const devMode = resolveInternalDevMode(args.flags);
+  const opencodeStateLayout = resolveOpencodeStateLayout({
+    dataDir,
+    workspace: resolvedWorkspace,
+    devMode,
+  });
+  const opencodeConfigDir = opencodeStateLayout.configDir;
+  await ensureOpencodeStateLayout(opencodeStateLayout);
+  await ensureOpencodeManagedTools(opencodeConfigDir);
+  const opencodeRouterDataDir =
+    sandboxMode === "none"
+      ? join(dataDir, "opencode-router", workspaceIdForLocal(resolvedWorkspace))
+      : null;
+  if (opencodeRouterDataDir) {
+    await mkdir(opencodeRouterDataDir, { recursive: true });
+  }
+  const sandboxPersistDir = resolve(
+    sandboxPersistOverride?.trim()
+      ? sandboxPersistOverride.trim()
+      : join(dataDir, "sandbox", workspaceIdForLocal(resolvedWorkspace)),
+  );
+  if (sandboxMode !== "none") {
+    await mkdir(sandboxPersistDir, { recursive: true });
+  }
+
+  const sandboxMountValue =
+    readFlag(args.flags, "sandbox-mount") ?? process.env.OPENWORK_SANDBOX_MOUNT;
+  const sandboxMountSpecs = parseList(sandboxMountValue);
+  const sandboxExtraMounts =
+    sandboxMode !== "none" && sandboxMountSpecs.length
+      ? await resolveSandboxExtraMounts(sandboxMountSpecs, sandboxMode)
+      : [];
+
+  const explicitOpencodeBin =
+    readFlag(args.flags, "opencode-bin") ?? process.env.OPENWORK_OPENCODE_BIN;
+  const explicitOpenworkServerBin =
+    readFlag(args.flags, "openwork-server-bin") ??
+    process.env.OPENWORK_SERVER_BIN;
+  const explicitOpenCodeRouterBin =
+    readFlag(args.flags, "opencode-router-bin") ??
+    process.env.OPENCODE_ROUTER_BIN;
+  assertManagedOpencodeAuth(args);
+  const opencodeBindHost = resolveManagedOpencodeHost(
+    readFlag(args.flags, "opencode-host") ??
+      process.env.OPENWORK_OPENCODE_BIND_HOST,
+  );
+  const opencodePort =
+    sandboxMode !== "none"
+      ? SANDBOX_INTERNAL_OPENCODE_PORT
+      : await resolvePort(
+          readNumber(
+            args.flags,
+            "opencode-port",
+            undefined,
+            "OPENWORK_OPENCODE_PORT",
+          ),
+          "127.0.0.1",
+        );
+  const opencodeLogLevel = resolveOpencodeLogLevel(
+    readFlag(args.flags, "opencode-log-level") ??
+      process.env.OPENWORK_OPENCODE_LOG_LEVEL,
+  );
+  const opencodeHotReload = readOpencodeHotReload(
+    args.flags,
+    {
+      enabled: true,
+      debounceMs: DEFAULT_OPENCODE_HOT_RELOAD_DEBOUNCE_MS,
+      cooldownMs: DEFAULT_OPENCODE_HOT_RELOAD_COOLDOWN_MS,
+    },
+    {
+      enabled: "OPENWORK_OPENCODE_HOT_RELOAD",
+      debounceMs: "OPENWORK_OPENCODE_HOT_RELOAD_DEBOUNCE_MS",
+      cooldownMs: "OPENWORK_OPENCODE_HOT_RELOAD_COOLDOWN_MS",
+    },
+  );
+  const opencodeCredentials = resolveManagedOpencodeCredentials(args);
+  const opencodeUsername = opencodeCredentials.username;
+  const opencodePassword = opencodeCredentials.password;
+
+  const remoteAccessEnabled = resolveOpenworkRemoteAccess(args);
+  const openworkHost = remoteAccessEnabled ? "0.0.0.0" : "127.0.0.1";
+  const openworkPort = await resolvePort(
+    readNumber(args.flags, "openwork-port", undefined, "OPENWORK_PORT"),
+    "127.0.0.1",
+  );
+  // Always choose a free opencodeRouter health port by default (avoid conflicts with
+  // other local processes using 3005).
+  const opencodeRouterHealthPort = await resolvePort(
+    readNumber(
+      args.flags,
+      "opencode-router-health-port",
+      undefined,
+      "OPENCODE_ROUTER_HEALTH_PORT",
+    ),
+    "127.0.0.1",
+  );
+  const openworkToken =
+    readFlag(args.flags, "openwork-token") ??
+    process.env.OPENWORK_TOKEN ??
+    randomUUID();
+  const openworkHostToken =
+    readFlag(args.flags, "openwork-host-token") ??
+    process.env.OPENWORK_HOST_TOKEN ??
+    randomUUID();
+  const approvalMode =
+    (readFlag(args.flags, "approval") as ApprovalMode | undefined) ??
+    (process.env.OPENWORK_APPROVAL_MODE as ApprovalMode | undefined) ??
+    "manual";
+  const approvalTimeoutMs = readNumber(
+    args.flags,
+    "approval-timeout",
+    DEFAULT_APPROVAL_TIMEOUT,
+    "OPENWORK_APPROVAL_TIMEOUT_MS",
+  ) as number;
+  const readOnly = readBool(
+    args.flags,
+    "read-only",
+    false,
+    "OPENWORK_READONLY",
+  );
+  const corsValue =
+    readFlag(args.flags, "cors") ?? process.env.OPENWORK_CORS_ORIGINS ?? "*";
+  const corsOrigins = parseList(corsValue);
+  const connectHost = readFlag(args.flags, "connect-host");
+
+  const manifest = await readVersionManifest();
+  const allowExternal = readBool(
+    args.flags,
+    "allow-external",
+    false,
+    "OPENWORK_ALLOW_EXTERNAL",
+  );
+  const sidecarTarget = resolveSandboxSidecarTarget(sandboxMode);
+  const sidecar = resolveSidecarConfigForTarget(
+    args.flags,
+    cliVersion,
+    sidecarTarget,
+  );
+
+  let sidecarSource = sidecarSourceInput;
+  let opencodeSource = opencodeSourceInput;
+  if (sandboxMode !== "none") {
+    if (sidecarSourceInput === "bundled") {
+      throw new Error("Sandbox mode does not support --sidecar-source bundled");
+    }
+    if (opencodeSourceInput === "bundled") {
+      throw new Error(
+        "Sandbox mode does not support --opencode-source bundled",
+      );
+    }
+    // In sandbox mode, we must run Linux binaries inside the container. When
+    // custom *-bin paths are provided, treat the source as external so we don't
+    // accidentally pick host (darwin) bundled binaries.
+    if (sidecarSourceInput === "auto") {
+      sidecarSource =
+        explicitOpenworkServerBin || explicitOpenCodeRouterBin
+          ? "external"
+          : "downloaded";
+    }
+    if (opencodeSourceInput === "auto") {
+      opencodeSource = explicitOpencodeBin ? "external" : "downloaded";
+    }
+  }
+  const dockerCommand =
+    sandboxMode === "docker" ? await resolveDockerCommand() : null;
+  logVerbose(`cli version: ${cliVersion}`);
+  logVerbose(`sandbox: ${sandboxMode}`);
+  if (dockerCommand) {
+    logVerbose(`docker bin: ${dockerCommand}`);
+  }
+  if (sandboxMode !== "none") {
+    logVerbose(`sandbox image: ${sandboxImage}`);
+    logVerbose(`sandbox persist dir: ${sandboxPersistDir}`);
+    if (sandboxExtraMounts.length) {
+      logVerbose(`sandbox mounts: ${sandboxExtraMounts.length}`);
+    }
+  }
+  logVerbose(`sidecar target: ${sidecar.target ?? "unknown"}`);
+  logVerbose(`sidecar dir: ${sidecar.dir}`);
+  logVerbose(`sidecar base URL: ${sidecar.baseUrl}`);
+  logVerbose(`sidecar manifest: ${sidecar.manifestUrl}`);
+  logVerbose(`sidecar source: ${sidecarSource}`);
+  logVerbose(`opencode source: ${opencodeSource}`);
+  logVerbose(
+    `opencode hot reload: ${opencodeHotReload.enabled ? "on" : "off"} (debounce=${opencodeHotReload.debounceMs}ms cooldown=${opencodeHotReload.cooldownMs}ms)`,
+  );
+  logVerbose(`allow external: ${allowExternal ? "true" : "false"}`);
+  let opencodeBinary = await resolveOpencodeBin({
+    explicit: explicitOpencodeBin,
+    manifest,
+    allowExternal,
+    sidecar,
+    source: opencodeSource,
+  });
+
+  if (sandboxMode !== "none") {
+    if (sandboxMode === "docker") {
+      if (!(await probeCommand(dockerCommand ?? "docker", ["version"]))) {
+        throw new Error(
+          `Docker is required for --sandbox docker. Install Docker Desktop and ensure '${dockerCommand ?? "docker"}' is available.`,
+        );
+      }
+    }
+    if (sandboxMode === "container") {
+      if (process.platform !== "darwin") {
+        throw new Error("Apple container backend is only supported on macOS");
+      }
+      if (process.arch !== "arm64") {
+        throw new Error(
+          "Apple container backend requires Apple silicon (arm64)",
+        );
+      }
+      if (!(await probeCommand("container", ["--version"]))) {
+        throw new Error(
+          "Apple container CLI not found. Install https://github.com/apple/container",
+        );
+      }
+    }
+  }
+  const opencodeRouterMode = await resolveOpencodeRouterEnabled(
+    args.flags,
+    resolvedWorkspace,
+    logger,
+  );
+  const opencodeRouterEnabled = opencodeRouterMode.enabled;
+  const opencodeRouterRequired = readBool(
+    args.flags,
+    "opencode-router-required",
+    false,
+    "OPENWORK_OPENCODE_ROUTER_REQUIRED",
+  );
+  logVerbose(
+    `opencodeRouter enabled: ${opencodeRouterEnabled ? "true" : "false"} (${opencodeRouterMode.source})`,
+  );
+  let openworkServerBinary = await resolveOpenworkServerBin({
+    explicit: explicitOpenworkServerBin,
+    manifest,
+    allowExternal,
+    sidecar,
+    source: sidecarSource,
+  });
+  let opencodeRouterBinary = opencodeRouterEnabled
+    ? await resolveOpenCodeRouterBin({
+        explicit: explicitOpenCodeRouterBin,
+        manifest,
+        allowExternal,
+        sidecar,
+        source: sidecarSource,
+      })
+    : null;
+
+  if (sandboxMode !== "none") {
+    // Ensure the binaries we stage into the container are actual files.
+    await assertSandboxBinaryFile("opencode", opencodeBinary.bin);
+    await assertSandboxBinaryFile("openwork-server", openworkServerBinary.bin);
+    if (opencodeRouterBinary) {
+      await assertSandboxBinaryFile(
+        "opencode-router",
+        opencodeRouterBinary.bin,
+      );
+    }
+  }
+  let opencodeRouterActualVersion: string | undefined;
+  logVerbose(`opencode bin: ${opencodeBinary.bin} (${opencodeBinary.source})`);
+  logVerbose(
+    `openwork-server bin: ${openworkServerBinary.bin} (${openworkServerBinary.source})`,
+  );
+  if (opencodeRouterBinary) {
+    logVerbose(
+      `opencodeRouter bin: ${opencodeRouterBinary.bin} (${opencodeRouterBinary.source})`,
+    );
+  }
+
+  const openworkBaseUrl = `http://127.0.0.1:${openworkPort}`;
+  const openworkConnect = remoteAccessEnabled
+    ? resolveConnectUrl(openworkPort, connectHost)
+    : {};
+  const openworkConnectUrl = openworkConnect.connectUrl ?? openworkBaseUrl;
+
+  const opencodeBaseUrl =
+    sandboxMode !== "none"
+      ? `${openworkBaseUrl}/opencode`
+      : `http://127.0.0.1:${opencodePort}`;
+  const opencodeConnectUrl =
+    sandboxMode !== "none"
+      ? `${openworkConnectUrl.replace(/\/$/, "")}/opencode`
+      : opencodeBaseUrl;
+
+  const attachCommand =
+    sandboxMode !== "none"
+      ? `OpenCode is proxied via ${opencodeConnectUrl} (requires OpenWork token)`
+      : buildAttachCommand({
+          url: opencodeConnectUrl,
+          workspace: resolvedWorkspace,
+          username: opencodeUsername,
+          password: opencodeCredentials.password,
+        });
+
+  const opencodeRouterHealthUrl = `http://127.0.0.1:${opencodeRouterHealthPort}`;
+  const opencodeRouterEnv: NodeJS.ProcessEnv = {
+    ...process.env,
+    OPENCODE_DIRECTORY: resolvedWorkspace,
+    OPENCODE_URL: opencodeConnectUrl,
+    ...(opencodeUsername ? { OPENCODE_SERVER_USERNAME: opencodeUsername } : {}),
+    ...(opencodePassword ? { OPENCODE_SERVER_PASSWORD: opencodePassword } : {}),
+    ...(opencodeRouterEnabled
+      ? { OPENCODE_ROUTER_HEALTH_PORT: String(opencodeRouterHealthPort) }
+      : {}),
+  };
+
+  const children: ChildHandle[] = [];
+  let shuttingDown = false;
+  let detached = false;
+  let sandboxContainerName: string | null = null;
+  let sandboxStop: ((name: string) => Promise<void>) | null = null;
+  let sandboxStopCommand: string | null = null;
+  let sandboxCleanup: (() => Promise<void>) | null = null;
+  let opencodeChild: ChildProcess | null = null;
+  let openworkChild: ChildProcess | null = null;
+  let opencodeRouterChild: ChildProcess | null = null;
+  let controlServer: ReturnType<typeof createHttpServer> | null = null;
+  const controlPort = await resolvePort(undefined, "127.0.0.1");
+  const controlToken = randomUUID();
+  const controlBaseUrl = `http://127.0.0.1:${controlPort}`;
+  let opencodeActualVersion: string | undefined;
+  let openworkActualVersion: string | undefined;
+  let openworkOwnerToken: string | undefined;
+  const startedAt = Date.now();
+  let opencodeRouterHealthInterval: NodeJS.Timeout | null = null;
+  const workerActivityHeartbeat = resolveWorkerActivityHeartbeatConfig();
+  let workerActivityHeartbeatInterval: NodeJS.Timeout | null = null;
+  const restartingServices = new Set<string>();
+  const runtimeUpgradeState: RuntimeUpgradeState = {
+    status: "idle",
+    startedAt: null,
+    finishedAt: null,
+    error: null,
+    operationId: null,
+    services: [],
+  };
+  const removeChildHandle = (name: string) => {
+    const index = children.findIndex((handle) => handle.name === name);
+    if (index >= 0) children.splice(index, 1);
+  };
+  const getRuntimeSnapshot = () => {
+    const services = [
+      buildRuntimeServiceSnapshot({
+        name: "openwork-server",
+        enabled: true,
+        running: Boolean(openworkChild && isProcessAlive(openworkChild.pid)),
+        binary: openworkServerBinary,
+        actualVersion: openworkActualVersion,
+      }),
+      buildRuntimeServiceSnapshot({
+        name: "opencode",
+        enabled: true,
+        running: Boolean(opencodeChild && isProcessAlive(opencodeChild.pid)),
+        binary: opencodeBinary,
+        actualVersion: opencodeActualVersion,
+      }),
+      buildRuntimeServiceSnapshot({
+        name: "opencode-router",
+        enabled: Boolean(opencodeRouterEnabled && opencodeRouterBinary),
+        running: Boolean(
+          opencodeRouterChild && isProcessAlive(opencodeRouterChild.pid),
+        ),
+        binary: opencodeRouterBinary,
+        actualVersion: opencodeRouterActualVersion,
+      }),
+    ];
+    return {
+      ok: true,
+      orchestrator: {
+        version: cliVersion,
+        startedAt,
+      },
+      worker: {
+        workspace: resolvedWorkspace,
+        sandboxMode,
+      },
+      upgrade: {
+        ...runtimeUpgradeState,
+      },
+      services,
+    };
+  };
+  const restartOpencode = async () => {
+    if (sandboxMode !== "none") {
+      throw new Error(
+        "Runtime upgrade is not supported while sandbox mode is enabled",
+      );
+    }
+    if (opencodeChild) {
+      restartingServices.add("opencode");
+      removeChildHandle("opencode");
+      await stopChild(opencodeChild);
+      opencodeChild = null;
+    }
+    opencodeActualVersion = await verifyOpencodeVersion(opencodeBinary);
+    const child = await startOpencode({
+      bin: opencodeBinary.bin,
+      workspace: resolvedWorkspace,
+      stateLayout: opencodeStateLayout,
+      hotReload: opencodeHotReload,
+      bindHost: opencodeBindHost,
+      port: opencodePort,
+      username: opencodeUsername,
+      password: opencodePassword,
+      corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+      logger,
+      runId,
+      logFormat,
+      logLevel: opencodeLogLevel,
+      opencodeRouterHealthPort: opencodeRouterEnabled
+        ? opencodeRouterHealthPort
+        : undefined,
+    });
+    opencodeChild = child;
+    children.push({ name: "opencode", child });
+    logger.info(
+      "Process spawned",
+      { pid: child.pid ?? 0, cause: "runtime-upgrade" },
+      "opencode",
+    );
+    child.on("exit", (code, signal) => handleExit("opencode", code, signal));
+    child.on("error", (error) => handleSpawnError("opencode", error));
+    await waitForOpencodeHealthy(
+      createOpencodeClient({
+        baseUrl: opencodeBaseUrl,
+        directory: resolvedWorkspace,
+        headers:
+          opencodeUsername && opencodePassword
+            ? {
+          Authorization: `Basic ${encodeBasicAuth(opencodeCredentials.username, opencodeCredentials.password)}`,
+              }
+            : undefined,
+      }),
+    );
+  };
+  const restartOpenworkServer = async () => {
+    if (sandboxMode !== "none") {
+      throw new Error(
+        "Runtime upgrade is not supported while sandbox mode is enabled",
+      );
+    }
+    if (openworkChild) {
+      restartingServices.add("openwork-server");
+      removeChildHandle("openwork-server");
+      await stopChild(openworkChild);
+      openworkChild = null;
+    }
+    const child = await startOpenworkServer({
+      bin: openworkServerBinary.bin,
+      host: openworkHost,
+      port: openworkPort,
+      workspace: resolvedWorkspace,
+      token: openworkToken,
+      hostToken: openworkHostToken,
+      approvalMode: approvalMode === "auto" ? "auto" : "manual",
+      approvalTimeoutMs,
+      readOnly,
+      corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+      opencodeBaseUrl: opencodeConnectUrl,
+      opencodeDirectory: resolvedWorkspace,
+      opencodeUsername,
+      opencodePassword,
+      opencodeRouterHealthPort: opencodeRouterEnabled
+        ? opencodeRouterHealthPort
+        : undefined,
+      opencodeRouterDataDir: opencodeRouterEnabled
+        ? (opencodeRouterDataDir ?? undefined)
+        : undefined,
+      logger,
+      runId,
+      logFormat,
+      controlBaseUrl,
+      controlToken,
+    });
+    openworkChild = child;
+    children.push({ name: "openwork-server", child });
+    logger.info(
+      "Process spawned",
+      { pid: child.pid ?? 0, cause: "runtime-upgrade" },
+      "openwork-server",
+    );
+    child.on("exit", (code, signal) =>
+      handleExit("openwork-server", code, signal),
+    );
+    child.on("error", (error) => handleSpawnError("openwork-server", error));
+    await waitForHealthy(openworkBaseUrl);
+    openworkActualVersion = await verifyOpenworkServer({
+      baseUrl: openworkBaseUrl,
+      token: openworkToken,
+      hostToken: openworkHostToken,
+      expectedVersion: openworkServerBinary.expectedVersion,
+      expectedWorkspace: resolvedWorkspace,
+      expectedOpencodeBaseUrl: opencodeConnectUrl,
+      expectedOpencodeDirectory: resolvedWorkspace,
+      expectedOpencodeUsername: opencodeUsername,
+      expectedOpencodePassword: opencodePassword,
+    });
+  };
+  const restartOpenCodeRouter = async () => {
+    if (
+      !opencodeRouterEnabled ||
+      !opencodeRouterBinary ||
+      sandboxMode !== "none"
+    ) {
+      return;
+    }
+    if (opencodeRouterChild) {
+      restartingServices.add("opencode-router");
+      removeChildHandle("opencode-router");
+      await stopChild(opencodeRouterChild);
+      opencodeRouterChild = null;
+    }
+    opencodeRouterActualVersion =
+      await verifyOpenCodeRouterVersion(opencodeRouterBinary);
+    opencodeRouterChild = await startOpenCodeRouter({
+      bin: opencodeRouterBinary.bin,
+      workspace: resolvedWorkspace,
+      opencodeUrl: opencodeConnectUrl,
+      opencodeUsername,
+      opencodePassword,
+      opencodeRouterHealthPort,
+      opencodeRouterDataDir: opencodeRouterDataDir ?? undefined,
+      logger,
+      runId,
+      logFormat,
+    });
+    children.push({ name: "opencode-router", child: opencodeRouterChild });
+    opencodeRouterChild.on("exit", (code, signal) =>
+      handleExit("opencode-router", code, signal),
+    );
+    opencodeRouterChild.on("error", (error) =>
+      handleSpawnError("opencode-router", error),
+    );
+    await waitForOpenCodeRouterHealthy(
+      `http://127.0.0.1:${opencodeRouterHealthPort}`,
+      10_000,
+      400,
+    );
+  };
+  const performRuntimeUpgrade = async (services: RuntimeServiceName[]) => {
+    const opId = randomUUID();
+    runtimeUpgradeState.status = "running";
+    runtimeUpgradeState.startedAt = Date.now();
+    runtimeUpgradeState.finishedAt = null;
+    runtimeUpgradeState.error = null;
+    runtimeUpgradeState.operationId = opId;
+    runtimeUpgradeState.services = services;
+    try {
+      if (sandboxMode !== "none") {
+        throw new Error(
+          "Runtime upgrade is only supported for non-sandbox workers",
+        );
+      }
+      if (
+        services.includes("openwork-server") &&
+        openworkServerBinary.source === "external" &&
+        openworkServerBinary.expectedVersion
+      ) {
+        await installGlobalPackages([
+          `openwork-server@${openworkServerBinary.expectedVersion}`,
+        ]);
+      }
+      if (
+        services.includes("opencode-router") &&
+        opencodeRouterBinary?.source === "external" &&
+        opencodeRouterBinary.expectedVersion
+      ) {
+        await installGlobalPackages([
+          `opencode-router@${opencodeRouterBinary.expectedVersion}`,
+        ]);
+      }
+      if (services.includes("openwork-server")) {
+        openworkServerBinary = await resolveOpenworkServerBin({
+          explicit: explicitOpenworkServerBin,
+          manifest,
+          allowExternal,
+          sidecar,
+          source: sidecarSource,
+        });
+      }
+      if (services.includes("opencode")) {
+        opencodeBinary = await resolveOpencodeBin({
+          explicit: explicitOpencodeBin,
+          manifest,
+          allowExternal,
+          sidecar,
+          source: opencodeSource,
+        });
+      }
+      if (services.includes("opencode-router") && opencodeRouterEnabled) {
+        opencodeRouterBinary = await resolveOpenCodeRouterBin({
+          explicit: explicitOpenCodeRouterBin,
+          manifest,
+          allowExternal,
+          sidecar,
+          source: sidecarSource,
+        });
+      }
+      if (services.includes("opencode")) {
+        await restartOpencode();
+      }
+      if (services.includes("opencode-router")) {
+        await restartOpenCodeRouter();
+      }
+      if (
+        services.includes("openwork-server") ||
+        services.includes("opencode")
+      ) {
+        await restartOpenworkServer();
+      }
+      runtimeUpgradeState.status = "idle";
+      runtimeUpgradeState.finishedAt = Date.now();
+    } catch (error) {
+      runtimeUpgradeState.status = "failed";
+      runtimeUpgradeState.finishedAt = Date.now();
+      runtimeUpgradeState.error =
+        error instanceof Error ? error.message : String(error);
+      logger.error(
+        "Runtime upgrade failed",
+        { error: runtimeUpgradeState.error, services },
+        "openwork-orchestrator",
+      );
+    }
+  };
+  const shutdown = async () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    restoreConsoleError?.();
+    restoreConsoleError = undefined;
+    if (opencodeRouterHealthInterval) {
+      clearInterval(opencodeRouterHealthInterval);
+      opencodeRouterHealthInterval = null;
+    }
+    if (workerActivityHeartbeatInterval) {
+      clearInterval(workerActivityHeartbeatInterval);
+      workerActivityHeartbeatInterval = null;
+    }
+    if (controlServer) {
+      await new Promise<void>((resolve) =>
+        controlServer?.close(() => resolve()),
+      );
+      controlServer = null;
+    }
+    logger.info(
+      "Shutting down",
+      { children: children.map((handle) => handle.name) },
+      "openwork-orchestrator",
+    );
+    if (sandboxContainerName && sandboxStop) {
+      await sandboxStop(sandboxContainerName);
+    }
+    await Promise.all(children.map((handle) => stopChild(handle.child)));
+    if (sandboxCleanup) {
+      await sandboxCleanup();
+      sandboxCleanup = null;
+    }
+  };
+
+  const detachChildren = () => {
+    detached = true;
+    for (const handle of children) {
+      try {
+        handle.child.unref();
+      } catch {
+        // ignore
+      }
+      handle.child.stdout?.removeAllListeners();
+      handle.child.stderr?.removeAllListeners();
+      handle.child.stdout?.destroy();
+      handle.child.stderr?.destroy();
+    }
+  };
+
+  const handleQuit = async () => {
+    tui?.stop();
+    await shutdown();
+    process.exit(0);
+  };
+
+  const handleDetach = async () => {
+    if (detached) return;
+    restoreConsoleError?.();
+    restoreConsoleError = undefined;
+    if (opencodeRouterHealthInterval) {
+      clearInterval(opencodeRouterHealthInterval);
+      opencodeRouterHealthInterval = null;
+    }
+    if (workerActivityHeartbeatInterval) {
+      clearInterval(workerActivityHeartbeatInterval);
+      workerActivityHeartbeatInterval = null;
+    }
+    tui?.stop();
+    detachChildren();
+    const summary = [
+      "Detached. Services still running:",
+      ...children.map(
+        (handle) => `- ${handle.name} (pid ${handle.child.pid ?? "unknown"})`,
+      ),
+      ...(sandboxContainerName && sandboxStopCommand
+        ? [
+            `- sandbox (${sandboxStopCommand.split(" ")[0]} container ${sandboxContainerName})`,
+            `Stop: ${sandboxStopCommand} ${sandboxContainerName}`,
+          ]
+        : []),
+      `OpenWork URL: ${openworkConnectUrl}`,
+      "Credentials withheld from detached stdout.",
+      ...(openworkOwnerToken ? ["OpenWork owner token issued."] : []),
+      `OpenCode URL: ${opencodeConnectUrl}`,
+      `Attach: ${redactSensitiveString(attachCommand)}`,
+      "Use `--json` only when you explicitly need the raw tokens or passwords in command output.",
+    ].join("\n");
+    process.stdout.write(`${summary}\n`);
+    process.exit(0);
+  };
+
+  if (useTui) {
+    if (compiledBinary) {
+      const originalConsoleError = console.error.bind(console);
+      restoreConsoleError = () => {
+        console.error = originalConsoleError;
+      };
+      console.error = (...items: unknown[]) => {
+        const text = items
+          .map((item) => {
+            if (typeof item === "string") return item;
+            if (item instanceof Error) return `${item.name}: ${item.message}`;
+            return String(item);
+          })
+          .join(" ");
+        if (
+          text.includes("React is not defined") ||
+          text.includes("/$bunfs/root/openwork-orchestrator") ||
+          text.includes("/$bunfs/root/openwork")
+        ) {
+          switchToPlainOutput(text);
+        }
+        originalConsoleError(...items);
+      };
+    }
+    try {
+      const { startOrchestratorTui } = await import("./tui/app.js");
+      tui = startOrchestratorTui({
+        version: cliVersion,
+        connect: {
+          runId,
+          workspace: resolvedWorkspace,
+          openworkUrl: openworkConnectUrl,
+          openworkToken,
+          ownerToken: openworkOwnerToken,
+          hostToken: openworkHostToken,
+          opencodeUrl: opencodeConnectUrl,
+          opencodePassword:
+            sandboxMode !== "none"
+              ? undefined
+              : (opencodePassword ?? undefined),
+          opencodeUsername:
+            sandboxMode !== "none"
+              ? undefined
+              : (opencodeUsername ?? undefined),
+          attachCommand,
+        },
+        services: [
+          {
+            name: "opencode",
+            label: "opencode",
+            status: "starting",
+            port: opencodePort,
+          },
+          {
+            name: "openwork-server",
+            label: "openwork-server",
+            status: "starting",
+            port: openworkPort,
+          },
+          {
+            name: "router",
+            label: "opencode-router",
+            status: opencodeRouterEnabled ? "starting" : "disabled",
+            port: sandboxMode !== "none" ? undefined : opencodeRouterHealthPort,
+          },
+        ],
+        onQuit: handleQuit,
+        onDetach: handleDetach,
+        onCopyAttach: async () => {
+          const result = await copyToClipboard(attachCommand);
+          return { command: attachCommand, ...result };
+        },
+        onCopySelection: async (text) => copyToClipboard(text),
+        onRouterHealth: async () =>
+          fetchOpenCodeRouterHealthViaOpenwork(openworkBaseUrl, openworkToken),
+        onRouterTelegramIdentities: async () => {
+          const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/identities/telegram`;
+          const result = await fetchJson(url, {
+            headers: {
+              "X-OpenWork-Host-Token": openworkHostToken,
+            },
+          });
+          const items = Array.isArray(result?.items) ? result.items : [];
+          return { items };
+        },
+        onRouterSlackIdentities: async () => {
+          const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/identities/slack`;
+          const result = await fetchJson(url, {
+            headers: {
+              "X-OpenWork-Host-Token": openworkHostToken,
+            },
+          });
+          const items = Array.isArray(result?.items) ? result.items : [];
+          return { items };
+        },
+        onRouterSetGroupsEnabled: async (enabled) => {
+          try {
+            const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/config/groups`;
+            await fetchJson(url, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "X-OpenWork-Host-Token": openworkHostToken,
+              },
+              body: JSON.stringify({ enabled }),
+            });
+            return { ok: true };
+          } catch (error) {
+            return {
+              ok: false,
+              error: error instanceof Error ? error.message : String(error),
+            };
+          }
+        },
+        onRouterSetTelegramToken: async (token) => {
+          try {
+            const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/identities/telegram`;
+            await fetchJson(url, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "X-OpenWork-Host-Token": openworkHostToken,
+              },
+              body: JSON.stringify({ id: "default", token, enabled: true }),
+            });
+            return { ok: true };
+          } catch (error) {
+            return {
+              ok: false,
+              error: error instanceof Error ? error.message : String(error),
+            };
+          }
+        },
+        onRouterSetSlackTokens: async (botToken, appToken) => {
+          try {
+            const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/identities/slack`;
+            await fetchJson(url, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "X-OpenWork-Host-Token": openworkHostToken,
+              },
+              body: JSON.stringify({
+                id: "default",
+                botToken,
+                appToken,
+                enabled: true,
+              }),
+            });
+            return { ok: true };
+          } catch (error) {
+            return {
+              ok: false,
+              error: error instanceof Error ? error.message : String(error),
+            };
+          }
+        },
+      });
+      tui.setUptimeStart(startedAt);
+    } catch (error) {
+      switchToPlainOutput(
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+  }
+
+  const tuiServiceName = (name: string) =>
+    name === "opencode-router" ? "router" : name;
+
+  const handleExit = (
+    name: string,
+    code: number | null,
+    signal: NodeJS.Signals | null,
+  ) => {
+    if (shuttingDown || detached) return;
+    if (restartingServices.has(name)) {
+      restartingServices.delete(name);
+      return;
+    }
+    const reason =
+      code !== null ? `code ${code}` : signal ? `signal ${signal}` : "unknown";
+    const services =
+      name === "sandbox"
+        ? ["opencode", "openwork-server", "router"]
+        : [tuiServiceName(name)];
+    for (const service of services) {
+      tui?.updateService(service, { status: "stopped", message: reason });
+    }
+    logger.error("Process exited", { reason, code, signal }, name);
+    void shutdown().then(() => process.exit(code ?? 1));
+  };
+
+  const handleSpawnError = (name: string, error: unknown) => {
+    if (shuttingDown || detached) return;
+    tui?.updateService(tuiServiceName(name), {
+      status: "error",
+      message: String(error),
+    });
+    logger.error("Process failed to start", { error: String(error) }, name);
+    void shutdown().then(() => process.exit(1));
+  };
+
+  try {
+    opencodeActualVersion =
+      sandboxMode !== "none"
+        ? opencodeBinary.expectedVersion
+        : await verifyOpencodeVersion(opencodeBinary);
+    let opencodeClient: ReturnType<typeof createOpencodeClient>;
+
+    controlServer = createHttpServer(async (req, res) => {
+      const method = req.method ?? "GET";
+      const url = new URL(req.url ?? "/", controlBaseUrl);
+      res.setHeader("Content-Type", "application/json");
+      const authHeader = req.headers.authorization ?? "";
+      if (authHeader !== `Bearer ${controlToken}`) {
+        res.statusCode = 401;
+        res.end(JSON.stringify({ ok: false, error: "unauthorized" }));
+        return;
+      }
+      if (method === "GET" && url.pathname === "/runtime/versions") {
+        res.statusCode = 200;
+        res.end(JSON.stringify(getRuntimeSnapshot()));
+        return;
+      }
+      if (method === "POST" && url.pathname === "/runtime/upgrade") {
+        const chunks: Buffer[] = [];
+        for await (const chunk of req) {
+          chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        }
+        let body: { services?: RuntimeServiceName[] } | null = null;
+        try {
+          body = chunks.length
+            ? (JSON.parse(Buffer.concat(chunks).toString("utf8")) as {
+                services?: RuntimeServiceName[];
+              })
+            : null;
+        } catch {
+          body = null;
+        }
+        const requested = Array.isArray(body?.services)
+          ? body.services
+          : ["openwork-server", "opencode"];
+        const services = Array.from(
+          new Set(
+            requested.filter(
+              (item): item is RuntimeServiceName =>
+                item === "openwork-server" ||
+                item === "opencode" ||
+                item === "opencode-router",
+            ),
+          ),
+        );
+        if (!services.length) {
+          res.statusCode = 400;
+          res.end(JSON.stringify({ ok: false, error: "invalid_services" }));
+          return;
+        }
+        if (runtimeUpgradeState.status === "running") {
+          res.statusCode = 409;
+          res.end(
+            JSON.stringify({
+              ok: false,
+              error: "upgrade_in_progress",
+              upgrade: runtimeUpgradeState,
+            }),
+          );
+          return;
+        }
+        res.statusCode = 202;
+        res.end(
+          JSON.stringify({
+            ok: true,
+            started: true,
+            services,
+            upgrade: { ...runtimeUpgradeState, status: "running" },
+          }),
+        );
+        void performRuntimeUpgrade(services);
+        return;
+      }
+      res.statusCode = 404;
+      res.end(JSON.stringify({ ok: false, error: "not_found" }));
+    });
+    await new Promise<void>((resolve, reject) => {
+      controlServer?.once("error", reject);
+      controlServer?.listen(controlPort, "127.0.0.1", () => resolve());
+    });
+
+    if (sandboxMode !== "none") {
+      const containerName = `openwork-orchestrator-${runId.replace(/[^a-zA-Z0-9_.-]+/g, "-").slice(0, 24)}`;
+      sandboxContainerName = containerName;
+
+      sandboxStop =
+        sandboxMode === "container"
+          ? stopAppleContainer
+          : (name: string) =>
+              stopDockerContainer(name, dockerCommand ?? "docker");
+      sandboxStopCommand =
+        sandboxMode === "container" ? "container stop" : "docker stop";
+      const opencodeInternalBaseUrl = `http://127.0.0.1:${SANDBOX_INTERNAL_OPENCODE_PORT}`;
+
+      const sandboxChild =
+        sandboxMode === "container"
+          ? await startAppleContainerSandbox({
+              image: sandboxImage,
+              containerName,
+              workspace: resolvedWorkspace,
+              persistDir: sandboxPersistDir,
+              opencodeConfigDir,
+              extraMounts: sandboxExtraMounts,
+              sidecars: {
+                opencode: opencodeBinary.bin,
+                openworkServer: openworkServerBinary.bin,
+                opencodeRouter: opencodeRouterEnabled
+                  ? (opencodeRouterBinary?.bin ?? null)
+                  : null,
+              },
+              ports: {
+                openwork: openworkPort,
+                // In sandbox mode, opencodeRouter is only reachable via openwork-server
+                // proxy (/opencode-router/*). Do not publish a separate host port.
+                opencodeRouterHealth: null,
+              },
+              opencode: {
+                corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+                username: opencodeUsername,
+                password: opencodePassword,
+                hotReload: opencodeHotReload,
+                logLevel: opencodeLogLevel,
+              },
+              openwork: {
+                token: openworkToken,
+                hostToken: openworkHostToken,
+                approvalMode: approvalMode === "auto" ? "auto" : "manual",
+                approvalTimeoutMs,
+                readOnly,
+                corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+                opencodeUsername,
+                opencodePassword,
+                logFormat,
+              },
+              runId,
+              logFormat,
+              detach: detachRequested,
+              logger,
+            })
+          : await startDockerSandbox({
+              image: sandboxImage,
+              dockerCommand: dockerCommand ?? "docker",
+              containerName,
+              workspace: resolvedWorkspace,
+              persistDir: sandboxPersistDir,
+              opencodeConfigDir,
+              extraMounts: sandboxExtraMounts,
+              sidecars: {
+                opencode: opencodeBinary.bin,
+                openworkServer: openworkServerBinary.bin,
+                opencodeRouter: opencodeRouterEnabled
+                  ? (opencodeRouterBinary?.bin ?? null)
+                  : null,
+              },
+              ports: {
+                openwork: openworkPort,
+                // In sandbox mode, opencodeRouter is only reachable via openwork-server
+                // proxy (/opencode-router/*). Do not publish a separate host port.
+                opencodeRouterHealth: null,
+              },
+              opencode: {
+                corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+                username: opencodeUsername,
+                password: opencodePassword,
+                hotReload: opencodeHotReload,
+                logLevel: opencodeLogLevel,
+              },
+              openwork: {
+                token: openworkToken,
+                hostToken: openworkHostToken,
+                approvalMode: approvalMode === "auto" ? "auto" : "manual",
+                approvalTimeoutMs,
+                readOnly,
+                corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+                opencodeUsername,
+                opencodePassword,
+                logFormat,
+              },
+              runId,
+              logFormat,
+              detach: detachRequested,
+              logger,
+            });
+
+      sandboxCleanup = sandboxChild.cleanup;
+      tui?.updateService("opencode", {
+        status: "running",
+        port: SANDBOX_INTERNAL_OPENCODE_PORT,
+      });
+      tui?.updateService("openwork-server", {
+        status: "running",
+        port: openworkPort,
+      });
+      if (opencodeRouterEnabled) {
+        tui?.updateService("router", { status: "running", port: undefined });
+      }
+
+      if (!detachRequested) {
+        children.push({ name: "sandbox", child: sandboxChild.child });
+        logger.info(
+          "Process spawned",
+          { pid: sandboxChild.child.pid ?? 0, containerName },
+          "sandbox",
+        );
+        sandboxChild.child.on("exit", (code, signal) =>
+          handleExit("sandbox", code, signal),
+        );
+        sandboxChild.child.on("error", (error) =>
+          handleSpawnError("sandbox", error),
+        );
+      } else {
+        // docker run -d exits quickly; the container continues to run.
+        logger.info("Sandbox detached", { containerName }, "sandbox");
+      }
+
+      logger.info(
+        "Waiting for health",
+        { url: openworkBaseUrl },
+        "openwork-server",
+      );
+      await waitForHealthy(openworkBaseUrl);
+      logger.info("Healthy", { url: openworkBaseUrl }, "openwork-server");
+      tui?.updateService("openwork-server", { status: "healthy" });
+
+      opencodeClient = createOpencodeClient({
+        baseUrl: `${openworkBaseUrl.replace(/\/$/, "")}/opencode`,
+        headers: { Authorization: `Bearer ${openworkToken}` },
+      });
+
+      // In sandbox mode, the released openwork-server binary may not have our
+      // latest proxy/auth changes yet.  Instead of using the OpenCode SDK client
+      // (which relies on the proxy handling Bearer tokens), do a direct health
+      // check against the openwork-server's own /opencode proxy path.  If the
+      // server is healthy *and* is proxying to a healthy opencode, we're good.
+      logger.info(
+        "Waiting for health (proxy)",
+        { url: `${openworkBaseUrl}/opencode` },
+        "opencode",
+      );
+      await waitForHealthyViaProxy(
+        `${openworkBaseUrl.replace(/\/$/, "")}/opencode`,
+        openworkToken,
+      );
+      logger.info(
+        "Healthy (proxy)",
+        { url: `${openworkBaseUrl}/opencode` },
+        "opencode",
+      );
+      tui?.updateService("opencode", { status: "healthy" });
+
+      try {
+        openworkActualVersion = await verifyOpenworkServer({
+          baseUrl: openworkBaseUrl,
+          token: openworkToken,
+          hostToken: openworkHostToken,
+          expectedVersion: openworkServerBinary.expectedVersion,
+          expectedWorkspace: "/workspace",
+          expectedOpencodeBaseUrl: opencodeInternalBaseUrl,
+          expectedOpencodeDirectory: "/workspace",
+          expectedOpencodeUsername: opencodeUsername,
+          expectedOpencodePassword: opencodePassword,
+        });
+      } catch (verifyError) {
+        // In sandbox mode the released server binary may differ from the
+        // expected version or lack capabilities we just added locally.  Log
+        // the mismatch but don't abort — the health checks above already
+        // proved the server is running and proxying correctly.
+        logger.warn(
+          "Sandbox server verification warning (non-fatal)",
+          { error: String(verifyError) },
+          "openwork-server",
+        );
+      }
+      openworkOwnerToken = await issueOpenworkOwnerToken(
+        openworkBaseUrl,
+        openworkHostToken,
+        "OpenWork sandbox owner token",
+      );
+      tui?.setConnectInfo({ ownerToken: openworkOwnerToken });
+      logVerbose(
+        `openwork-server version: ${openworkActualVersion ?? "unknown"}`,
+      );
+    } else {
+      const startedOpencodeChild = await startOpencode({
+        bin: opencodeBinary.bin,
+        workspace: resolvedWorkspace,
+        stateLayout: opencodeStateLayout,
+        hotReload: opencodeHotReload,
+        bindHost: opencodeBindHost,
+        port: opencodePort,
+        username: opencodeUsername,
+        password: opencodePassword,
+        corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+        logger,
+        runId,
+        logFormat,
+        logLevel: opencodeLogLevel,
+        opencodeRouterHealthPort: opencodeRouterEnabled
+          ? opencodeRouterHealthPort
+          : undefined,
+      });
+      opencodeChild = startedOpencodeChild;
+      children.push({ name: "opencode", child: startedOpencodeChild });
+      tui?.updateService("opencode", {
+        status: "running",
+        pid: startedOpencodeChild.pid ?? undefined,
+        port: opencodePort,
+      });
+      logger.info(
+        "Process spawned",
+        { pid: startedOpencodeChild.pid ?? 0 },
+        "opencode",
+      );
+      startedOpencodeChild.on("exit", (code, signal) =>
+        handleExit("opencode", code, signal),
+      );
+      startedOpencodeChild.on("error", (error) =>
+        handleSpawnError("opencode", error),
+      );
+
+      const authHeaders: Record<string, string> = {};
+      if (opencodeUsername && opencodePassword) {
+        authHeaders.Authorization = `Basic ${encodeBasicAuth(opencodeUsername, opencodePassword)}`;
+      }
+      opencodeClient = createOpencodeClient({
+        baseUrl: opencodeBaseUrl,
+        directory: resolvedWorkspace,
+        headers: Object.keys(authHeaders).length ? authHeaders : undefined,
+      });
+
+      logger.info("Waiting for health", { url: opencodeBaseUrl }, "opencode");
+      await waitForOpencodeHealthy(opencodeClient);
+      logger.info("Healthy", { url: opencodeBaseUrl }, "opencode");
+      tui?.updateService("opencode", { status: "healthy" });
+
+      let opencodeRouterReady = false;
+      if (opencodeRouterEnabled) {
+        if (!opencodeRouterBinary) {
+          throw new Error("OpenCodeRouter binary missing.");
+        }
+        opencodeRouterActualVersion =
+          await verifyOpenCodeRouterVersion(opencodeRouterBinary);
+        logVerbose(
+          `opencodeRouter version: ${opencodeRouterActualVersion ?? "unknown"}`,
+        );
+
+        try {
+          const startedOpenCodeRouterChild = await startOpenCodeRouter({
+            bin: opencodeRouterBinary.bin,
+            workspace: resolvedWorkspace,
+            opencodeUrl: opencodeConnectUrl,
+            opencodeUsername,
+            opencodePassword,
+            opencodeRouterHealthPort,
+            opencodeRouterDataDir: opencodeRouterDataDir ?? undefined,
+            logger,
+            runId,
+            logFormat,
+          });
+          opencodeRouterChild = startedOpenCodeRouterChild;
+          children.push({
+            name: "opencode-router",
+            child: startedOpenCodeRouterChild,
+          });
+          tui?.updateService("router", {
+            status: "running",
+            pid: startedOpenCodeRouterChild.pid ?? undefined,
+            port: opencodeRouterHealthPort,
+          });
+          logger.info(
+            "Process spawned",
+            { pid: startedOpenCodeRouterChild.pid ?? 0 },
+            "opencode-router",
+          );
+          startedOpenCodeRouterChild.on("exit", (code, signal) => {
+            if (restartingServices.has("opencode-router")) {
+              restartingServices.delete("opencode-router");
+              return;
+            }
+            if (opencodeRouterRequired) {
+              handleExit("opencode-router", code, signal);
+              return;
+            }
+            const reason =
+              code !== null
+                ? `code ${code}`
+                : signal
+                  ? `signal ${signal}`
+                  : "unknown";
+            tui?.updateService("router", {
+              status: "stopped",
+              message: reason,
+            });
+            logger.warn(
+              "Process exited, continuing without opencodeRouter",
+              { reason, code, signal },
+              "opencode-router",
+            );
+          });
+          startedOpenCodeRouterChild.on("error", (error) =>
+            handleSpawnError("opencode-router", error),
+          );
+
+          const healthBaseUrl = `http://127.0.0.1:${opencodeRouterHealthPort}`;
+          logger.info(
+            "Waiting for health",
+            { url: healthBaseUrl },
+            "opencode-router",
+          );
+          const health = await waitForOpenCodeRouterHealthy(
+            healthBaseUrl,
+            10_000,
+            400,
+          );
+          tui?.setRouterHealth(health);
+          tui?.updateService("router", {
+            status: health.ok ? "healthy" : "running",
+          });
+          logger.info(
+            "Healthy",
+            { url: healthBaseUrl, ok: health.ok },
+            "opencode-router",
+          );
+          opencodeRouterReady = true;
+        } catch (error) {
+          if (opencodeRouterRequired) {
+            throw error;
+          }
+          const message =
+            error instanceof Error ? error.message : String(error);
+          logger.warn(
+            "OpenCodeRouter failed to start, continuing without it",
+            { error: message },
+            "opencode-router",
+          );
+          tui?.updateService("router", { status: "stopped", message });
+          if (opencodeRouterChild) {
+            try {
+              opencodeRouterChild.kill();
+            } catch {
+              // ignore
+            }
+          }
+          opencodeRouterChild = null;
+          opencodeRouterReady = false;
+        }
+      }
+
+      const startedOpenworkChild = await startOpenworkServer({
+        bin: openworkServerBinary.bin,
+        host: openworkHost,
+        port: openworkPort,
+        workspace: resolvedWorkspace,
+        token: openworkToken,
+        hostToken: openworkHostToken,
+        approvalMode: approvalMode === "auto" ? "auto" : "manual",
+        approvalTimeoutMs,
+        readOnly,
+        corsOrigins: corsOrigins.length ? corsOrigins : ["*"],
+        opencodeBaseUrl: opencodeConnectUrl,
+        opencodeDirectory: resolvedWorkspace,
+        opencodeUsername,
+        opencodePassword,
+        opencodeRouterHealthPort: opencodeRouterEnabled
+          ? opencodeRouterHealthPort
+          : undefined,
+        opencodeRouterDataDir: opencodeRouterEnabled
+          ? (opencodeRouterDataDir ?? undefined)
+          : undefined,
+        logger,
+        runId,
+        logFormat,
+        controlBaseUrl,
+        controlToken,
+      });
+      openworkChild = startedOpenworkChild;
+      children.push({ name: "openwork-server", child: startedOpenworkChild });
+      tui?.updateService("openwork-server", {
+        status: "running",
+        pid: startedOpenworkChild.pid ?? undefined,
+        port: openworkPort,
+      });
+      logger.info(
+        "Process spawned",
+        { pid: startedOpenworkChild.pid ?? 0 },
+        "openwork-server",
+      );
+      startedOpenworkChild.on("exit", (code, signal) =>
+        handleExit("openwork-server", code, signal),
+      );
+      startedOpenworkChild.on("error", (error) =>
+        handleSpawnError("openwork-server", error),
+      );
+
+      logger.info(
+        "Waiting for health",
+        { url: openworkBaseUrl },
+        "openwork-server",
+      );
+      await waitForHealthy(openworkBaseUrl);
+      logger.info("Healthy", { url: openworkBaseUrl }, "openwork-server");
+      tui?.updateService("openwork-server", { status: "healthy" });
+
+      openworkActualVersion = await verifyOpenworkServer({
+        baseUrl: openworkBaseUrl,
+        token: openworkToken,
+        hostToken: openworkHostToken,
+        expectedVersion: openworkServerBinary.expectedVersion,
+        expectedWorkspace: resolvedWorkspace,
+        expectedOpencodeBaseUrl: opencodeConnectUrl,
+        expectedOpencodeDirectory: resolvedWorkspace,
+        expectedOpencodeUsername: opencodeUsername,
+        expectedOpencodePassword: opencodePassword,
+      });
+      openworkOwnerToken = await issueOpenworkOwnerToken(
+        openworkBaseUrl,
+        openworkHostToken,
+        "OpenWork owner token",
+      );
+      tui?.setConnectInfo({ ownerToken: openworkOwnerToken });
+      logVerbose(
+        `openwork-server version: ${openworkActualVersion ?? "unknown"}`,
+      );
+
+      if (opencodeRouterReady && !opencodeRouterHealthInterval) {
+        opencodeRouterHealthInterval = setInterval(() => {
+          fetchOpenCodeRouterHealthViaOpenwork(openworkBaseUrl, openworkToken)
+            .then((health) => {
+              tui?.setRouterHealth(health);
+              if (health.ok) {
+                tui?.updateService("router", { status: "healthy" });
+              }
+            })
+            .catch(() => undefined);
+        }, 15_000);
+      }
+    }
+
+    if (opencodeRouterEnabled) {
+      if (sandboxMode !== "none") {
+        // OpenCodeRouter is started inside the sandbox container; just probe health.
+        opencodeRouterActualVersion = opencodeRouterBinary?.expectedVersion;
+        logVerbose(
+          `opencodeRouter version: ${opencodeRouterActualVersion ?? "unknown"}`,
+        );
+        try {
+          const url = `${openworkBaseUrl.replace(/\/$/, "")}/opencode-router/health`;
+          logger.info("Waiting for health", { url }, "opencode-router");
+          const health = await waitForOpenCodeRouterHealthyViaOpenwork(
+            openworkBaseUrl,
+            openworkToken,
+          );
+          tui?.setRouterHealth(health);
+          tui?.updateService("router", {
+            status: health.ok ? "healthy" : "running",
+          });
+          logger.info("Healthy", { url, ok: health.ok }, "opencode-router");
+        } catch (error) {
+          logger.warn(
+            "OpenCodeRouter health check failed",
+            { error: String(error) },
+            "opencode-router",
+          );
+          tui?.updateService("router", {
+            status: "running",
+            message: String(error),
+          });
+        }
+        if (!opencodeRouterHealthInterval) {
+          opencodeRouterHealthInterval = setInterval(() => {
+            fetchOpenCodeRouterHealthViaOpenwork(openworkBaseUrl, openworkToken)
+              .then((health) => {
+                tui?.setRouterHealth(health);
+                if (health.ok) {
+                  tui?.updateService("router", { status: "healthy" });
+                }
+              })
+              .catch(() => undefined);
+          }, 15_000);
+        }
+      } else {
+        // In host mode, opencodeRouter is started before openwork-server so we can
+        // confirm health before wiring the proxy.
+      }
+    }
+
+    if (workerActivityHeartbeat.enabled && !checkOnly) {
+      logger.info(
+        "Worker activity heartbeat enabled",
+        {
+          workerId: workerActivityHeartbeat.workerId,
+          intervalMs: workerActivityHeartbeat.intervalMs,
+          activeWindowMs: workerActivityHeartbeat.activeWindowMs,
+        },
+        "openwork-orchestrator",
+      );
+      const runHeartbeat = () => {
+        void postWorkerActivityHeartbeat({
+          config: workerActivityHeartbeat,
+          opencodeClient,
+          logger,
+        }).catch((error) => {
+          logger.warn(
+            "Worker activity heartbeat failed",
+            { error: error instanceof Error ? error.message : String(error) },
+            "openwork-orchestrator",
+          );
+        });
+      };
+      runHeartbeat();
+      workerActivityHeartbeatInterval = setInterval(
+        runHeartbeat,
+        workerActivityHeartbeat.intervalMs,
+      );
+    }
+
+    const payload = {
+      runId,
+      workspace: resolvedWorkspace,
+      approval: {
+        mode: approvalMode,
+        timeoutMs: approvalTimeoutMs,
+        readOnly,
+      },
+      opencode: {
+        baseUrl: opencodeBaseUrl,
+        connectUrl: opencodeConnectUrl,
+        username: sandboxMode !== "none" ? undefined : opencodeUsername,
+        password: sandboxMode !== "none" ? undefined : opencodePassword,
+        bindHost: opencodeBindHost,
+        port: opencodePort,
+        hotReload: opencodeHotReload,
+        version: opencodeActualVersion,
+      },
+      openwork: {
+        baseUrl: openworkBaseUrl,
+        connectUrl: openworkConnectUrl,
+        host: openworkHost,
+        port: openworkPort,
+        collaboratorToken: openworkToken,
+        ownerToken: openworkOwnerToken,
+        token: openworkToken,
+        hostToken: openworkHostToken,
+        version: openworkActualVersion,
+      },
+      opencodeRouter: {
+        enabled: opencodeRouterEnabled,
+        version: opencodeRouterEnabled
+          ? opencodeRouterActualVersion
+          : undefined,
+        healthPort: sandboxMode !== "none" ? null : opencodeRouterHealthPort,
+      },
+      diagnostics: {
+        cliVersion,
+        sidecar: {
+          dir: sidecar.dir,
+          baseUrl: sidecar.baseUrl,
+          manifestUrl: sidecar.manifestUrl,
+          target: sidecar.target,
+          source: sidecarSource,
+          opencodeSource,
+          allowExternal,
+        } as SidecarDiagnostics,
+        binaries: {
+          opencode: {
+            path: opencodeBinary.bin,
+            source: opencodeBinary.source,
+            expectedVersion: opencodeBinary.expectedVersion,
+            actualVersion: opencodeActualVersion,
+          } as BinaryDiagnostics,
+          openworkServer: {
+            path: openworkServerBinary.bin,
+            source: openworkServerBinary.source,
+            expectedVersion: openworkServerBinary.expectedVersion,
+            actualVersion: openworkActualVersion,
+          } as BinaryDiagnostics,
+          opencodeRouter: opencodeRouterBinary
+            ? ({
+                path: opencodeRouterBinary.bin,
+                source: opencodeRouterBinary.source,
+                expectedVersion: opencodeRouterBinary.expectedVersion,
+                actualVersion: opencodeRouterActualVersion,
+              } as BinaryDiagnostics)
+            : null,
+        },
+      },
+    };
+
+    if (outputJson) {
+      console.log(JSON.stringify(payload, null, 2));
+    } else if (useTui) {
+      logger.info(
+        "Ready",
+        {
+          workspace: payload.workspace,
+          opencode: payload.opencode,
+          openwork: payload.openwork,
+          opencodeRouter: payload.opencodeRouter,
+        },
+        "openwork-orchestrator",
+      );
+    } else if (logFormat === "json") {
+      logger.info(
+        "Ready",
+        {
+          workspace: payload.workspace,
+          opencode: payload.opencode,
+          openwork: payload.openwork,
+          opencodeRouter: payload.opencodeRouter,
+        },
+        "openwork-orchestrator",
+      );
+    } else {
+      console.log("OpenWork orchestrator running");
+      console.log(`Run ID: ${runId}`);
+      console.log(`Workspace: ${payload.workspace}`);
+      console.log(`OpenCode: ${payload.opencode.baseUrl}`);
+      console.log(`OpenCode connect URL: ${payload.opencode.connectUrl}`);
+      if (payload.opencode.username && payload.opencode.password) {
+        console.log("OpenCode auth: managed credentials configured (withheld from stdout)");
+      }
+      console.log(`OpenWork server: ${payload.openwork.baseUrl}`);
+      console.log(`OpenWork connect URL: ${payload.openwork.connectUrl}`);
+      console.log("OpenWork collaborator token: issued (withheld from stdout)");
+      console.log("  Routine remote access for shared workers.");
+      if (payload.openwork.ownerToken) {
+        console.log("OpenWork owner token: issued (withheld from stdout)");
+        console.log(
+          "  Use this when the remote client must answer permission prompts.",
+        );
+      }
+      console.log("OpenWork host admin token: issued (withheld from stdout)");
+      console.log(
+        "  Internal host/admin token for approvals CLI and host-only APIs.",
+      );
+      console.log(
+        "Use `--json` only when you explicitly need raw credentials in command output.",
+      );
+    }
+
+    if (detachRequested) {
+      await handleDetach();
+    }
+
+    if (checkOnly) {
+      try {
+        if (sandboxMode !== "none") {
+          // In sandbox mode the released server binary may not support the
+          // Bearer-through-proxy auth that the OpenCode SDK client expects.
+          // Run a lighter set of checks: openwork-server endpoints + proxy
+          // health.  Full SDK checks (session create, SSE events) are deferred
+          // until the modified server binary is released.
+          await runSandboxChecks({
+            openworkUrl: openworkBaseUrl,
+            openworkToken,
+            hostToken: openworkHostToken,
+          });
+        } else {
+          await runChecks({
+            opencodeClient,
+            openworkUrl: openworkBaseUrl,
+            openworkToken,
+            hostToken: openworkHostToken,
+            checkEvents,
+          });
+        }
+        logger.info("Checks ok", { checkEvents }, "openwork-orchestrator");
+        if (!outputJson && logFormat === "pretty") {
+          console.log("Checks: ok");
+        }
+      } catch (error) {
+        logger.error(
+          "Checks failed",
+          { error: String(error) },
+          "openwork-orchestrator",
+        );
+        await shutdown();
+        tui?.stop();
+        process.exit(1);
+      }
+      await shutdown();
+      tui?.stop();
+      process.exit(0);
+    }
+
+    process.on("SIGINT", () => shutdown().then(() => process.exit(0)));
+    process.on("SIGTERM", () => shutdown().then(() => process.exit(0)));
+    await new Promise(() => undefined);
+  } catch (error) {
+    await shutdown();
+    tui?.stop();
+    logger.error(
+      "Run failed",
+      { error: error instanceof Error ? error.message : String(error) },
+      "openwork-orchestrator",
+    );
+    process.exit(1);
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (readBool(args.flags, "help", false) || args.flags.get("help") === true) {
+    printHelp();
+    return;
+  }
+  if (
+    readBool(args.flags, "version", false) ||
+    args.flags.get("version") === true
+  ) {
+    console.log(await resolveCliVersion());
+    return;
+  }
+
+  const command = args.positionals[0] ?? "start";
+  if (command === "start") {
+    await runStart(args);
+    return;
+  }
+  if (command === "serve") {
+    args.flags.set("tui", false);
+    await runStart(args);
+    return;
+  }
+  if (command === "daemon") {
+    await runDaemonCommand(args);
+    return;
+  }
+  if (command === "workspace" || command === "workspaces") {
+    await runWorkspaceCommand(args);
+    return;
+  }
+  if (command === "instance") {
+    await runInstanceCommand(args);
+    return;
+  }
+  if (command === "approvals") {
+    await runApprovals(args);
+    return;
+  }
+  if (command === "files") {
+    await runFiles(args);
+    return;
+  }
+  if (command === "status") {
+    await runStatus(args);
+    return;
+  }
+
+  printHelp();
+  process.exitCode = 1;
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});
diff --git a/apps/orchestrator/src/tui/app.tsx b/apps/orchestrator/src/tui/app.tsx
new file mode 100644
index 0000000000..c3eeed7f30
--- /dev/null
+++ b/apps/orchestrator/src/tui/app.tsx
@@ -0,0 +1,889 @@
+import { RGBA, TextAttributes, type InputRenderable, type KeyEvent, type TabSelectRenderable } from "@opentui/core";
+import { render, useKeyboard, useRenderer, useSelectionHandler, useTerminalDimensions } from "@opentui/solid";
+import { For, Show, createEffect, createMemo, createSignal, onCleanup } from "solid-js";
+import { createStore } from "solid-js/store";
+
+export type TuiLogLevel = "debug" | "info" | "warn" | "error";
+
+export type TuiServiceStatus = "starting" | "running" | "healthy" | "stopped" | "disabled" | "error";
+
+export type TuiService = {
+  name: string;
+  label: string;
+  status: TuiServiceStatus;
+  pid?: number;
+  port?: number;
+  message?: string;
+};
+
+export type TuiConnectInfo = {
+  runId: string;
+  workspace: string;
+  openworkUrl: string;
+  openworkToken: string;
+  ownerToken?: string;
+  hostToken: string;
+  opencodeUrl: string;
+  opencodePassword?: string;
+  opencodeUsername?: string;
+  attachCommand: string;
+};
+
+export type TuiRouterHealth = {
+  ok: boolean;
+  opencode: {
+    url: string;
+    healthy: boolean;
+    version?: string;
+  };
+  channels: {
+    telegram: boolean;
+    slack: boolean;
+    // Legacy field (kept for backward compatibility with older builds).
+    whatsapp?: boolean;
+  };
+  config: {
+    groupsEnabled: boolean;
+  };
+};
+
+// Backward-compatible name (older logs + code paths still say opencodeRouter).
+export type TuiOpenCodeRouterHealth = TuiRouterHealth;
+
+export type TuiRouterIdentityItem = {
+  id: string;
+  enabled: boolean;
+  running: boolean;
+};
+
+export type TuiRouterIdentityList = {
+  items: TuiRouterIdentityItem[];
+};
+
+export type TuiLogEntry = {
+  time: number;
+  level: TuiLogLevel;
+  component: string;
+  message: string;
+};
+
+export type TuiHandle = {
+  updateService: (name: string, update: Partial<TuiService>) => void;
+  setConnectInfo: (info: Partial<TuiConnectInfo>) => void;
+  setRouterHealth: (health: TuiRouterHealth | null) => void;
+  pushLog: (entry: TuiLogEntry) => void;
+  setUptimeStart: (time: number) => void;
+  stop: () => void;
+};
+
+type TuiOptions = {
+  version: string;
+  connect: TuiConnectInfo;
+  services: TuiService[];
+  onQuit: () => void | Promise<void>;
+  onDetach: () => void | Promise<void>;
+  onCopyAttach: () => Promise<{ command: string; copied: boolean; error?: string }>;
+  onCopySelection?: (text: string) => Promise<{ copied: boolean; error?: string }>;
+  onRouterHealth: () => Promise<TuiRouterHealth>;
+  onRouterTelegramIdentities: () => Promise<TuiRouterIdentityList>;
+  onRouterSlackIdentities: () => Promise<TuiRouterIdentityList>;
+  onRouterSetGroupsEnabled: (enabled: boolean) => Promise<{ ok: boolean; error?: string }>;
+  onRouterSetTelegramToken: (token: string) => Promise<{ ok: boolean; error?: string }>;
+  onRouterSetSlackTokens: (botToken: string, appToken: string) => Promise<{ ok: boolean; error?: string }>;
+};
+
+type ViewName = "overview" | "logs" | "help" | "router";
+
+const MAX_LOGS = 800;
+
+const theme = {
+  text: RGBA.fromInts(235, 235, 235),
+  textMuted: RGBA.fromInts(150, 150, 160),
+  border: RGBA.fromInts(70, 70, 80),
+  accent: RGBA.fromInts(120, 180, 255),
+  success: RGBA.fromInts(90, 210, 140),
+  warning: RGBA.fromInts(240, 200, 90),
+  error: RGBA.fromInts(240, 120, 120),
+  panel: RGBA.fromInts(28, 28, 32),
+} as const;
+
+const statusLabel: Record<TuiServiceStatus, string> = {
+  starting: "Starting",
+  running: "Running",
+  healthy: "Healthy",
+  stopped: "Stopped",
+  disabled: "Disabled",
+  error: "Error",
+};
+
+const statusColor: Record<TuiServiceStatus, RGBA> = {
+  starting: theme.warning,
+  running: theme.accent,
+  healthy: theme.success,
+  stopped: theme.textMuted,
+  disabled: theme.textMuted,
+  error: theme.error,
+};
+
+const levelColor: Record<TuiLogLevel, RGBA> = {
+  debug: theme.textMuted,
+  info: theme.text,
+  warn: theme.warning,
+  error: theme.error,
+};
+
+const levelCycle: Array<"all" | TuiLogLevel> = ["all", "info", "warn", "error", "debug"];
+
+const serviceCycle = ["all", "openwork-orchestrator", "opencode", "openwork-server", "router"];
+
+const viewTabs: Array<{ name: string; description: string; value: ViewName }> = [
+  { name: "Overview", description: "Overview", value: "overview" },
+  { name: "Logs", description: "Logs", value: "logs" },
+  { name: "Router", description: "opencode-router", value: "router" },
+  { name: "Help", description: "Help", value: "help" },
+];
+
+const viewIndexByName = new Map(viewTabs.map((entry, index) => [entry.value, index]));
+
+function formatDuration(ms: number) {
+  if (ms < 1000) return `${ms}ms`;
+  if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`;
+  const minutes = Math.floor(ms / 60000);
+  const seconds = Math.floor((ms % 60000) / 1000);
+  if (minutes < 60) return `${minutes}m ${seconds}s`;
+  const hours = Math.floor(minutes / 60);
+  const mins = minutes % 60;
+  return `${hours}h ${mins}m`;
+}
+
+function formatTime(ms: number) {
+  const date = new Date(ms);
+  return date.toLocaleTimeString(undefined, { timeStyle: "short" });
+}
+
+function clamp(value: number, min: number, max: number) {
+  return Math.max(min, Math.min(max, value));
+}
+
+export function startOrchestratorTui(options: TuiOptions): TuiHandle {
+  let stop: (() => void) | undefined;
+  const api: TuiHandle = {
+    updateService: () => undefined,
+    setConnectInfo: () => undefined,
+    setRouterHealth: () => undefined,
+    pushLog: () => undefined,
+    setUptimeStart: () => undefined,
+    stop: () => stop?.(),
+  };
+
+  render(
+    () => {
+      const renderer = useRenderer();
+      const dimensions = useTerminalDimensions();
+      renderer.disableStdoutInterception();
+
+      const [state, setState] = createStore({
+        view: "overview" as ViewName,
+        follow: true,
+        serviceFilter: "all" as (typeof serviceCycle)[number],
+        levelFilter: "all" as (typeof levelCycle)[number],
+        scrollOffset: 0,
+        logs: [] as TuiLogEntry[],
+        services: options.services as TuiService[],
+        connect: options.connect,
+        routerHealth: null as TuiRouterHealth | null,
+        routerTelegramIdentities: null as TuiRouterIdentityList | null,
+        routerSlackIdentities: null as TuiRouterIdentityList | null,
+        routerTelegramToken: "",
+        routerSlackTokens: "",
+        routerTelegramEditing: false,
+        routerSlackEditing: false,
+        routerAutoLoaded: false,
+        uptimeStart: Date.now(),
+      });
+
+      api.updateService = (name, update) => {
+        setState("services", (items) =>
+          items.map((item) => (item.name === name ? { ...item, ...update } : item)),
+        );
+      };
+
+      api.setConnectInfo = (info) => {
+        setState("connect", (prev) => ({ ...prev, ...info }));
+      };
+
+      api.setRouterHealth = (health) => {
+        setState("routerHealth", health);
+      };
+
+      api.pushLog = (entry) => {
+        setState("logs", (prev) => {
+          const next = [...prev, entry];
+          return next.length > MAX_LOGS ? next.slice(next.length - MAX_LOGS) : next;
+        });
+        if (state.follow) {
+          setState("scrollOffset", 0);
+        }
+      };
+
+      api.setUptimeStart = (time) => {
+        setState("uptimeStart", time);
+      };
+
+      stop = () => renderer.destroy();
+
+      const [now, setNow] = createSignal(Date.now());
+      const interval = setInterval(() => setNow(Date.now()), 1000);
+      onCleanup(() => clearInterval(interval));
+
+      const [toast, setToast] = createSignal<string | null>(null);
+      let toastTimer: NodeJS.Timeout | undefined;
+      const showToast = (message: string) => {
+        if (toastTimer) clearTimeout(toastTimer);
+        setToast(message);
+        toastTimer = setTimeout(() => setToast(null), 2500);
+      };
+      onCleanup(() => {
+        if (toastTimer) clearTimeout(toastTimer);
+      });
+
+      const setView = (view: ViewName) => {
+        setState("view", view);
+        if (view !== "router") {
+          setState("routerTelegramEditing", false);
+          setState("routerSlackEditing", false);
+        }
+      };
+
+      const refreshRouter = async (opts: { toastOnSuccess?: string } = {}) => {
+        const [health, telegram, slack] = await Promise.allSettled([
+          options.onRouterHealth(),
+          options.onRouterTelegramIdentities(),
+          options.onRouterSlackIdentities(),
+        ]);
+
+        const errors: string[] = [];
+        if (health.status === "fulfilled") {
+          api.setRouterHealth(health.value);
+        } else {
+          errors.push(`health: ${String(health.reason)}`);
+        }
+
+        if (telegram.status === "fulfilled") {
+          setState("routerTelegramIdentities", telegram.value);
+        } else {
+          setState("routerTelegramIdentities", null);
+          errors.push(`telegram: ${String(telegram.reason)}`);
+        }
+
+        if (slack.status === "fulfilled") {
+          setState("routerSlackIdentities", slack.value);
+        } else {
+          setState("routerSlackIdentities", null);
+          errors.push(`slack: ${String(slack.reason)}`);
+        }
+
+        if (errors.length) {
+          showToast(`Router refresh error: ${errors[0]}`);
+          return;
+        }
+
+        if (opts.toastOnSuccess) {
+          showToast(opts.toastOnSuccess);
+        }
+      };
+
+      createEffect(() => {
+        if (state.view !== "router") return;
+        if (state.routerAutoLoaded) return;
+        setState("routerAutoLoaded", true);
+        void refreshRouter();
+      });
+
+      let tabSelect: TabSelectRenderable | undefined;
+      const tabWidth = createMemo(() => {
+        const width = Math.max(0, dimensions().width - 4);
+        return Math.max(12, Math.floor(width / viewTabs.length));
+      });
+      createEffect(() => {
+        if (!tabSelect) return;
+        const index = viewIndexByName.get(state.view) ?? 0;
+        if (tabSelect.getSelectedIndex() !== index) {
+          tabSelect.setSelectedIndex(index);
+        }
+      });
+
+      const copySelection = async (text: string) => {
+        let copied = false;
+        let error: string | undefined;
+        if (options.onCopySelection) {
+          try {
+            const result = await options.onCopySelection(text);
+            copied = result.copied;
+            error = result.error;
+          } catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+          }
+        }
+        if (!copied && renderer.isOsc52Supported()) {
+          copied = renderer.copyToClipboardOSC52(text);
+        }
+        if (!copied) {
+          if (error) {
+            showToast(`Selection copy failed: ${error}`);
+          }
+          return;
+        }
+        showToast("Selection copied");
+      };
+
+      let lastCopiedSelection = "";
+      useSelectionHandler((selection) => {
+        if (!selection || !selection.isActive) {
+          lastCopiedSelection = "";
+          return;
+        }
+        const text = selection.getSelectedText();
+        if (!text) {
+          lastCopiedSelection = "";
+          return;
+        }
+        if (selection.isDragging) return;
+        if (text === lastCopiedSelection) return;
+        lastCopiedSelection = text;
+        void copySelection(text);
+      });
+
+      let telegramTokenInput: InputRenderable | undefined;
+      let slackTokensInput: InputRenderable | undefined;
+
+      const logHeight = createMemo(() => {
+        const height = dimensions().height;
+        return clamp(height - 9, 4, height);
+      });
+
+      const filteredLogs = createMemo(() => {
+        return state.logs.filter((entry) => {
+          if (state.serviceFilter !== "all" && entry.component !== state.serviceFilter) return false;
+          if (state.levelFilter !== "all" && entry.level !== state.levelFilter) return false;
+          return true;
+        });
+      });
+
+      const visibleLogs = createMemo(() => {
+        const items = filteredLogs();
+        const total = items.length;
+        const height = logHeight();
+        const offset = clamp(state.scrollOffset, 0, Math.max(0, total - height));
+        const start = Math.max(0, total - height - offset);
+        return items.slice(start, start + height);
+      });
+
+      const uptimeLabel = createMemo(() => formatDuration(now() - state.uptimeStart));
+
+      const healthLabel = createMemo(() => {
+        const active = state.services.filter((item) => item.status !== "disabled");
+        if (!active.length) return "No services";
+        const unhealthy = active.find((item) => item.status === "error" || item.status === "stopped");
+        if (unhealthy) return "Degraded";
+        const healthy = active.every((item) => item.status === "healthy" || item.status === "running");
+        return healthy ? "All green" : "Starting";
+      });
+
+      const routerStatus = createMemo(() => {
+        if (!state.routerHealth) return "Pending";
+        return state.routerHealth.ok ? "Healthy" : "Needs attention";
+      });
+
+      const actions = (view: ViewName) => {
+        if (view === "logs") {
+          return "[B] Back  [F] Follow  [S] Service  [E] Level  [D] Detach  [Q] Quit";
+        }
+        if (view === "help") {
+          return "[B] Back  [D] Detach  [Q] Quit";
+        }
+        if (view === "router") {
+          return "[B] Back  [R] Refresh  [T] Telegram token  [S] Slack tokens  [G] Toggle groups  [D] Detach  [Q] Quit";
+        }
+        return "[L] Logs  [W] Router  [C] Copy attach command  [D] Detach  [Q] Quit";
+      };
+
+      useKeyboard((evt: KeyEvent) => {
+        if (evt.ctrl && evt.name === "c") {
+          evt.preventDefault();
+          void options.onQuit();
+          return;
+        }
+        if (evt.name === "q") {
+          evt.preventDefault();
+          void options.onQuit();
+          return;
+        }
+        if (evt.name === "d") {
+          evt.preventDefault();
+          void options.onDetach();
+          return;
+        }
+        if (state.routerTelegramEditing || state.routerSlackEditing) {
+          if (evt.name === "escape") {
+            evt.preventDefault();
+            setState("routerTelegramEditing", false);
+            setState("routerSlackEditing", false);
+            telegramTokenInput?.blur();
+            slackTokensInput?.blur();
+          }
+          return;
+        }
+        if (evt.name === "l") {
+          evt.preventDefault();
+          setView("logs");
+          return;
+        }
+        if (evt.name === "w") {
+          evt.preventDefault();
+          setView("router");
+          return;
+        }
+        if (evt.name === "h" || evt.name === "?") {
+          evt.preventDefault();
+          setView("help");
+          return;
+        }
+        if (evt.name === "b" || evt.name === "o") {
+          evt.preventDefault();
+          setView("overview");
+          return;
+        }
+        if (evt.name === "c") {
+          evt.preventDefault();
+          options
+            .onCopyAttach()
+            .then((result) => {
+              const label = result.copied
+                ? "Attach command copied"
+                : `Attach command ready${result.error ? `: ${result.error}` : ""}`;
+              showToast(label);
+            })
+            .catch((error) => {
+              showToast(`Attach command error: ${String(error)}`);
+            });
+          return;
+        }
+        if (state.view === "router") {
+          if (evt.name === "b" || evt.name === "o") {
+            evt.preventDefault();
+            setView("overview");
+            return;
+          }
+          if (evt.name === "r") {
+            evt.preventDefault();
+            void refreshRouter({ toastOnSuccess: "Router refreshed" });
+            return;
+          }
+          if (evt.name === "g") {
+            evt.preventDefault();
+            const current = state.routerHealth?.config?.groupsEnabled;
+            if (typeof current !== "boolean") {
+              showToast("Refresh router first");
+              return;
+            }
+            const next = !current;
+            options
+              .onRouterSetGroupsEnabled(next)
+              .then((result) => {
+                if (!result.ok) {
+                  showToast(result.error ? `Groups error: ${result.error}` : "Groups update failed");
+                  return;
+                }
+                showToast(next ? "Groups enabled" : "Groups disabled");
+                void refreshRouter();
+              })
+              .catch((error) => {
+                showToast(`Groups error: ${String(error)}`);
+              });
+            return;
+          }
+          if (evt.name === "t") {
+            evt.preventDefault();
+            setState("routerSlackEditing", false);
+            setState("routerTelegramEditing", true);
+            setTimeout(() => telegramTokenInput?.focus(), 1);
+            return;
+          }
+          if (evt.name === "s") {
+            evt.preventDefault();
+            setState("routerTelegramEditing", false);
+            setState("routerSlackEditing", true);
+            setTimeout(() => slackTokensInput?.focus(), 1);
+            return;
+          }
+        }
+        if (state.view !== "logs") return;
+        if (evt.name === "f") {
+          evt.preventDefault();
+          setState("follow", !state.follow);
+          if (!state.follow) {
+            setState("scrollOffset", 0);
+          }
+          return;
+        }
+        if (evt.name === "s") {
+          evt.preventDefault();
+          const next = serviceCycle[(serviceCycle.indexOf(state.serviceFilter) + 1) % serviceCycle.length];
+          setState("serviceFilter", next);
+          setState("scrollOffset", 0);
+          return;
+        }
+        if (evt.name === "e") {
+          evt.preventDefault();
+          const next = levelCycle[(levelCycle.indexOf(state.levelFilter) + 1) % levelCycle.length];
+          setState("levelFilter", next);
+          setState("scrollOffset", 0);
+          return;
+        }
+        if (evt.name === "up" || evt.name === "k") {
+          evt.preventDefault();
+          setState("follow", false);
+          setState("scrollOffset", (value) => value + 1);
+          return;
+        }
+        if (evt.name === "down" || evt.name === "j") {
+          evt.preventDefault();
+          setState("scrollOffset", (value) => Math.max(0, value - 1));
+          return;
+        }
+        if (evt.name === "pageup") {
+          evt.preventDefault();
+          setState("follow", false);
+          setState("scrollOffset", (value) => value + logHeight());
+          return;
+        }
+        if (evt.name === "pagedown") {
+          evt.preventDefault();
+          setState("scrollOffset", (value) => Math.max(0, value - logHeight()));
+        }
+      });
+
+      return (
+        <box flexDirection="column" width={dimensions().width} height={dimensions().height} paddingLeft={2} paddingRight={2}>
+          <box flexDirection="row" justifyContent="space-between" paddingTop={1}>
+            <text fg={theme.text} attributes={TextAttributes.BOLD}>
+              openwork · {state.view}
+            </text>
+            <text fg={theme.textMuted}>v{options.version}</text>
+          </box>
+          <text fg={theme.textMuted}>run id: {state.connect.runId}</text>
+
+          <box paddingTop={1}>
+            <tab_select
+              ref={(node) => {
+                tabSelect = node;
+                if (tabSelect) {
+                  const index = viewIndexByName.get(state.view) ?? 0;
+                  tabSelect.setSelectedIndex(index);
+                }
+              }}
+              options={viewTabs}
+              tabWidth={tabWidth()}
+              showDescription={false}
+              showUnderline={true}
+              wrapSelection={true}
+              backgroundColor={theme.panel}
+              textColor={theme.textMuted}
+              focusedBackgroundColor={theme.border}
+              focusedTextColor={theme.text}
+              selectedBackgroundColor={theme.accent}
+              selectedTextColor={theme.panel}
+              selectedDescriptionColor={theme.text}
+              onSelect={(_, option) => {
+                if (!option?.value) return;
+                setView(option.value as ViewName);
+              }}
+            />
+          </box>
+
+          <Show when={state.view === "overview"}>
+            <box flexDirection="row" gap={4} paddingTop={1}>
+              <box width={Math.floor(dimensions().width / 2) - 4} flexDirection="column" gap={1}>
+                <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                  Services
+                </text>
+                <For each={state.services}>
+                  {(service) => (
+                    <box flexDirection="row" gap={1}>
+                      <text fg={statusColor[service.status]}>●</text>
+                      <text fg={theme.text}>{service.label}</text>
+                      <text fg={theme.textMuted}>{statusLabel[service.status]}</text>
+                    </box>
+                  )}
+                </For>
+                <box paddingTop={1}>
+                  <text fg={theme.textMuted}>Health: {healthLabel()}</text>
+                  <text fg={theme.textMuted}>Uptime: {uptimeLabel()}</text>
+                </box>
+                <box paddingTop={1}>
+                  <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                    Ports
+                  </text>
+                  <For each={state.services.filter((item) => item.port)}>
+                    {(service) => (
+                      <text fg={theme.textMuted}>
+                        {service.label}: {service.port}
+                      </text>
+                    )}
+                  </For>
+                </box>
+              </box>
+              <box width={Math.floor(dimensions().width / 2) - 4} flexDirection="column" gap={1}>
+                <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                  Connect
+                </text>
+                <text fg={theme.textMuted}>OpenWork URL (LAN)</text>
+                <text fg={theme.text}>{state.connect.openworkUrl}</text>
+                <text fg={theme.textMuted}>OpenWork Collaborator Token</text>
+                <text fg={theme.text}>{state.connect.openworkToken}</text>
+                <Show when={state.connect.ownerToken}>
+                  <text fg={theme.textMuted}>OpenWork Owner Token</text>
+                  <text fg={theme.text}>{state.connect.ownerToken}</text>
+                </Show>
+                <text fg={theme.textMuted}>OpenWork Host Admin Token</text>
+                <text fg={theme.text}>{state.connect.hostToken}</text>
+                <text fg={theme.textMuted}>OpenCode URL</text>
+                <text fg={theme.text}>{state.connect.opencodeUrl}</text>
+                <Show when={state.connect.opencodePassword}>
+                  <text fg={theme.textMuted}>OpenCode Server Password</text>
+                  <text fg={theme.text}>{state.connect.opencodePassword}</text>
+                </Show>
+                <text fg={theme.textMuted}>Attach command</text>
+                <text fg={theme.text}>{state.connect.attachCommand}</text>
+              </box>
+            </box>
+          </Show>
+
+          <Show when={state.view === "logs"}>
+            <box flexDirection="column" paddingTop={1} gap={1}>
+              <text fg={theme.textMuted}>
+                Filters: {state.serviceFilter} · level: {state.levelFilter} · follow: {state.follow ? "on" : "off"}
+              </text>
+              <box flexDirection="column" gap={0}>
+                <For each={visibleLogs()}>
+                  {(entry) => (
+                    <box flexDirection="row" gap={1}>
+                      <text fg={theme.textMuted}>{formatTime(entry.time)}</text>
+                      <text fg={theme.textMuted}>[{entry.component}]</text>
+                      <text fg={levelColor[entry.level]}>{entry.message}</text>
+                    </box>
+                  )}
+                </For>
+              </box>
+            </box>
+          </Show>
+
+          <Show when={state.view === "router"}>
+            <box flexDirection="column" paddingTop={1} gap={1}>
+              <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                opencode-router
+              </text>
+
+              <text fg={theme.textMuted}>Health: {routerStatus()}</text>
+              <Show when={state.routerHealth}>
+                <text fg={theme.textMuted}>
+                  OpenCode: {state.routerHealth?.opencode.healthy ? "healthy" : "down"}
+                  {state.routerHealth?.opencode.version ? ` (${state.routerHealth?.opencode.version})` : ""}
+                </text>
+                <text fg={theme.textMuted}>
+                  Telegram: {state.routerHealth?.channels.telegram ? "enabled" : "not configured"}
+                </text>
+                <text fg={theme.textMuted}>Slack: {state.routerHealth?.channels.slack ? "enabled" : "not configured"}</text>
+                <text fg={theme.textMuted}>
+                  Groups enabled: {state.routerHealth?.config.groupsEnabled ? "yes" : "no"} (press [G] to toggle)
+                </text>
+              </Show>
+              <Show when={!state.routerHealth}>
+                <text fg={theme.textMuted}>Press [R] to refresh router status.</text>
+              </Show>
+
+              <box paddingTop={1}>
+                <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                  Identities
+                </text>
+              </box>
+
+              <box flexDirection="row" gap={4}>
+                <box width={Math.floor(dimensions().width / 2) - 4} flexDirection="column" gap={0}>
+                  <text fg={theme.textMuted}>Telegram</text>
+                  <Show when={state.routerTelegramIdentities}>
+                    <For each={state.routerTelegramIdentities?.items ?? []}>
+                      {(item) => (
+                        <text fg={item.running ? theme.success : theme.textMuted}>
+                          {item.running ? "●" : "○"} {item.id} {item.enabled ? "" : "(disabled)"}
+                        </text>
+                      )}
+                    </For>
+                    <Show when={(state.routerTelegramIdentities?.items ?? []).length === 0}>
+                      <text fg={theme.textMuted}>(none)</text>
+                    </Show>
+                  </Show>
+                  <Show when={!state.routerTelegramIdentities}>
+                    <text fg={theme.textMuted}>Press [R] to load identities.</text>
+                  </Show>
+                </box>
+
+                <box width={Math.floor(dimensions().width / 2) - 4} flexDirection="column" gap={0}>
+                  <text fg={theme.textMuted}>Slack</text>
+                  <Show when={state.routerSlackIdentities}>
+                    <For each={state.routerSlackIdentities?.items ?? []}>
+                      {(item) => (
+                        <text fg={item.running ? theme.success : theme.textMuted}>
+                          {item.running ? "●" : "○"} {item.id} {item.enabled ? "" : "(disabled)"}
+                        </text>
+                      )}
+                    </For>
+                    <Show when={(state.routerSlackIdentities?.items ?? []).length === 0}>
+                      <text fg={theme.textMuted}>(none)</text>
+                    </Show>
+                  </Show>
+                  <Show when={!state.routerSlackIdentities}>
+                    <text fg={theme.textMuted}>Press [R] to load identities.</text>
+                  </Show>
+                </box>
+              </box>
+
+              <box paddingTop={1}>
+                <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                  Configure
+                </text>
+              </box>
+
+              <text fg={theme.textMuted}>Telegram token (default identity)</text>
+              <input
+                value={state.routerTelegramToken}
+                placeholder="Paste token and press enter"
+                focused={state.routerTelegramEditing}
+                onInput={(value) => setState("routerTelegramToken", value)}
+                onSubmit={(value) => {
+                  const token = typeof value === "string" ? value.trim() : "";
+                  if (!token) {
+                    showToast("Telegram token required");
+                    return;
+                  }
+                  options
+                    .onRouterSetTelegramToken(token)
+                    .then((result) => {
+                      if (!result.ok) {
+                        showToast(result.error ? `Telegram error: ${result.error}` : "Telegram token failed");
+                        return;
+                      }
+                      setState("routerTelegramToken", "");
+                      setState("routerTelegramEditing", false);
+                      telegramTokenInput?.blur();
+                      showToast("Telegram identity saved");
+                      void refreshRouter();
+                    })
+                    .catch((error) => {
+                      showToast(`Telegram error: ${String(error)}`);
+                    });
+                }}
+                ref={(node) => {
+                  telegramTokenInput = node;
+                  if (state.routerTelegramEditing) {
+                    setTimeout(() => telegramTokenInput?.focus(), 1);
+                  }
+                }}
+              />
+
+              <text fg={theme.textMuted}>Slack tokens (default identity)</text>
+              <input
+                value={state.routerSlackTokens}
+                placeholder="Paste xoxb-... xapp-... and press enter"
+                focused={state.routerSlackEditing}
+                onInput={(value) => setState("routerSlackTokens", value)}
+                onSubmit={(value) => {
+                  const raw = typeof value === "string" ? value.trim() : "";
+                  if (!raw) {
+                    showToast("Slack tokens required");
+                    return;
+                  }
+
+                  const parts = raw.split(/[\s,]+/).map((p) => p.trim()).filter(Boolean);
+                  const botToken = parts.find((p) => p.startsWith("xoxb-")) ?? parts[0];
+                  const appToken = parts.find((p) => p.startsWith("xapp-")) ?? parts[1];
+                  if (!botToken || !appToken) {
+                    showToast("Expected: xoxb-... xapp-...");
+                    return;
+                  }
+
+                  options
+                    .onRouterSetSlackTokens(botToken, appToken)
+                    .then((result) => {
+                      if (!result.ok) {
+                        showToast(result.error ? `Slack error: ${result.error}` : "Slack tokens failed");
+                        return;
+                      }
+                      setState("routerSlackTokens", "");
+                      setState("routerSlackEditing", false);
+                      slackTokensInput?.blur();
+                      showToast("Slack identity saved");
+                      void refreshRouter();
+                    })
+                    .catch((error) => {
+                      showToast(`Slack error: ${String(error)}`);
+                    });
+                }}
+                ref={(node) => {
+                  slackTokensInput = node;
+                  if (state.routerSlackEditing) {
+                    setTimeout(() => slackTokensInput?.focus(), 1);
+                  }
+                }}
+              />
+            </box>
+          </Show>
+
+          <Show when={state.view === "help"}>
+            <box flexDirection="column" paddingTop={1} gap={1}>
+              <text fg={theme.text} attributes={TextAttributes.BOLD}>
+                Shortcuts
+              </text>
+              <text fg={theme.textMuted}>L: Logs</text>
+              <text fg={theme.textMuted}>W: Router</text>
+              <text fg={theme.textMuted}>C: Copy attach command</text>
+              <text fg={theme.textMuted}>R: Refresh router</text>
+              <text fg={theme.textMuted}>G: Toggle groups (router)</text>
+              <text fg={theme.textMuted}>T: Telegram token (router)</text>
+              <text fg={theme.textMuted}>S: Slack tokens (router)</text>
+              <text fg={theme.textMuted}>D: Detach</text>
+              <text fg={theme.textMuted}>Q: Quit</text>
+              <text fg={theme.textMuted}>Mouse: click tabs</text>
+              <text fg={theme.textMuted}>Mouse: select text to copy</text>
+            </box>
+          </Show>
+
+          <box paddingTop={1}>
+            <Show when={toast()}>
+              {(val) => <text fg={theme.accent}>{val()}</text>}
+            </Show>
+          </box>
+
+          <box paddingTop={1}>
+            <text fg={theme.textMuted}>Actions: {actions(state.view)}</text>
+          </box>
+        </box>
+      );
+    },
+    {
+      targetFps: 60,
+      gatherStats: false,
+      exitOnCtrlC: false,
+      useMouse: true,
+      enableMouseMovement: true,
+      useKittyKeyboard: {},
+      autoFocus: false,
+      consoleOptions: {
+        keyBindings: [{ name: "y", ctrl: true, action: "copy-selection" }],
+      },
+    },
+  );
+
+  return api;
+}
diff --git a/apps/orchestrator/src/tui/opentui-jsx.d.ts b/apps/orchestrator/src/tui/opentui-jsx.d.ts
new file mode 100644
index 0000000000..ea6be5db8d
--- /dev/null
+++ b/apps/orchestrator/src/tui/opentui-jsx.d.ts
@@ -0,0 +1,5 @@
+declare namespace JSX {
+  interface IntrinsicElements {
+    [elementName: string]: any;
+  }
+}
diff --git a/apps/orchestrator/tsconfig.json b/apps/orchestrator/tsconfig.json
new file mode 100644
index 0000000000..67d2728c70
--- /dev/null
+++ b/apps/orchestrator/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "jsxImportSource": "@opentui/solid",
+    "lib": ["ESNext", "DOM", "DOM.Iterable"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "types": ["bun-types", "node"]
+  },
+  "include": ["src"]
+}
diff --git a/apps/orchestrator/tsconfig.typecheck.json b/apps/orchestrator/tsconfig.typecheck.json
new file mode 100644
index 0000000000..a6146a87c9
--- /dev/null
+++ b/apps/orchestrator/tsconfig.typecheck.json
@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "jsxImportSource": "@opentui/solid"
+  }
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/.opencode/openwork.json b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/.opencode/openwork.json
new file mode 100644
index 0000000000..15c2c71e3b
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/.opencode/openwork.json
@@ -0,0 +1,13 @@
+{
+  "authorizedRoots": [],
+  "blueprint": null,
+  "reload": null,
+  "version": 1,
+  "workspace": {
+    "configDir": "/Users/benjaminshafii/openwork-enterprise/_repos/openwork/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config",
+    "createdAt": 1777342554599,
+    "dataDir": null,
+    "name": "Control Workspace",
+    "preset": "remote"
+  }
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/opencode.jsonc b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/opencode.jsonc
new file mode 100644
index 0000000000..3da141795e
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_2d329df6f18e/config/opencode.jsonc
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permission": {}
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/openwork.json b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/openwork.json
new file mode 100644
index 0000000000..2bb620935f
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/openwork.json
@@ -0,0 +1,83 @@
+{
+  "authorizedRoots": [],
+  "blueprint": {
+    "emptyState": {
+      "title": "What do you want to do?",
+      "body": "Pick a starting point or just type below.",
+      "starters": [
+        {
+          "id": "csv-help",
+          "kind": "prompt",
+          "title": "Work on a CSV",
+          "description": "Clean up or generate spreadsheet data.",
+          "prompt": "Help me create or edit CSV files on this computer."
+        },
+        {
+          "id": "starter-connect-openai",
+          "kind": "action",
+          "title": "Connect ChatGPT",
+          "description": "Add your OpenAi provider so ChatGPT models are ready in new sessions.",
+          "action": "connect-openai"
+        },
+        {
+          "id": "browser-automation",
+          "kind": "session",
+          "title": "Automate Chrome",
+          "description": "Start a browser automation conversation right away.",
+          "prompt": "Help me connect to Chrome and automate a repetitive task."
+        }
+      ]
+    },
+    "sessions": [
+      {
+        "id": "welcome-to-openwork",
+        "title": "Welcome to OpenWork",
+        "openOnFirstLoad": true,
+        "messages": [
+          {
+            "role": "assistant",
+            "text": "Hi welcome to OpenWork!\n\nPeople use us to write .csv files on their computer, connect to Chrome and automate repetitive tasks, and sync contacts to Notion.\n\nBut the only limit is your imagination.\n\nWhat would you want to do?"
+          }
+        ]
+      },
+      {
+        "id": "csv-playbook",
+        "title": "CSV workflow ideas",
+        "messages": [
+          {
+            "role": "assistant",
+            "text": "I can help you generate, clean, merge, and summarize CSV files. What kind of CSV work do you want to automate?"
+          },
+          {
+            "role": "user",
+            "text": "I want to combine exports from multiple tools into one clean CSV."
+          }
+        ]
+      }
+    ],
+    "materialized": {
+      "sessions": {
+        "hydratedAt": 1774738380543,
+        "items": [
+          {
+            "templateId": "welcome-to-openwork",
+            "sessionId": "ses_2c9596908ffe4xGJ5q7VOZZbo5"
+          },
+          {
+            "templateId": "csv-playbook",
+            "sessionId": "ses_2c9596901ffen48qY950InNt4g"
+          }
+        ]
+      }
+    }
+  },
+  "reload": null,
+  "version": 1,
+  "workspace": {
+    "configDir": "/Users/benjaminshafii/openwork-enterprise/_repos/openwork/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config",
+    "createdAt": 1774738380342,
+    "dataDir": "/Users/benjaminshafii/Library/Mobile Documents/com~apple~CloudDocs/openwork/8",
+    "name": "8",
+    "preset": "starter"
+  }
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md
new file mode 100644
index 0000000000..47f290caa2
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: agent-creator
+description: Create new OpenCode agents with a gpt-5.2-codex default.
+---
+
+## Quick Usage (Already Configured)
+
+### Create a project agent
+```bash
+opencode agent create
+```
+
+### Agent file locations
+- Project agents: `.opencode/agents/<name>.md`
+- Global agents: `~/.config/opencode/agents/<name>.md`
+
+## Default model
+
+Use `gpt-5.2-codex` as the default model for new agents unless a workflow needs a different model.
+
+## Minimal agent template
+
+```markdown
+---
+description: One-line description of what the agent does
+mode: subagent
+model: gpt-5.2-codex
+tools:
+  write: false
+  edit: false
+  bash: false
+---
+You are a specialized agent. Describe your task, boundaries, and expected output.
+```
+
+## Notes from OpenCode docs
+
+- Agent files are markdown with YAML frontmatter.
+- The markdown filename becomes the agent name.
+- Set `mode` to `primary`, `subagent`, or `all`.
+- If no model is specified, subagents inherit the caller model.
+- `tools` controls per-agent tool access.
+
+## Reference
+
+Follow the official OpenCode agent docs: https://opencode.ai/docs/agents/
+
+## First-Time Setup (If Not Configured)
+
+1. Run `opencode agent create` and choose project scope.
+2. Paste in the default template above and adjust tools as needed.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/command-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/command-creator/SKILL.md
new file mode 100644
index 0000000000..0e91240950
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/command-creator/SKILL.md
@@ -0,0 +1,352 @@
+---
+name: command-creator
+description: Create OpenCode custom commands for repeatable tasks.
+---
+
+## Quick Usage (Already Configured)
+
+### Create a new command file
+```bash
+mkdir -p .opencode/commands
+```
+
+Create `.opencode/commands/<name>.md` with frontmatter and a prompt template.
+
+### Command file example
+```
+---
+description: Run tests with coverage
+agent: build
+model: gpt-5.2-codex
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+```
+
+## Prompt config essentials
+
+- Use `$ARGUMENTS` for all arguments, or `$1`, `$2`, `$3` for positional args.
+- Use `!\`command\`` to inject shell output into the prompt.
+- Use `@path/to/file` to include file contents in the prompt.
+
+## Notes from OpenCode docs
+
+- Command files live in `.opencode/commands/` (project) or `~/.config/opencode/commands/` (global).
+- The markdown filename becomes the command name (e.g., `test.md` → `/test`).
+- JSON config also supports commands in `opencode.json` under `command`.
+- Custom commands can override built-ins like `/init`, `/undo`, `/redo`, `/share`, `/help`.
+
+## Reference
+
+Follow the official OpenCode command docs: https://opencode.ai/docs/commands/
+Use the docs as the escape hatch when unsure.
+
+## Docs snapshot
+
+Skip to content
+OpenCode
+
+Search
+⌘
+K
+Intro
+Config
+Providers
+Network
+Enterprise
+Troubleshooting
+Migrating to 1.0
+TUI
+CLI
+Web
+IDE
+Zen
+Share
+GitHub
+GitLab
+Tools
+Rules
+Agents
+Models
+Themes
+Keybinds
+Commands
+Formatters
+Permissions
+LSP Servers
+MCP servers
+ACP Support
+Agent Skills
+Custom Tools
+SDK
+Server
+Plugins
+Ecosystem
+On this page
+Overview
+Create command files
+Configure
+JSON
+Markdown
+Prompt config
+Arguments
+Shell output
+File references
+Options
+Template
+Description
+Agent
+Subtask
+Model
+Built-in
+Commands
+Create custom commands for repetitive tasks.
+
+Custom commands let you specify a prompt you want to run when that command is executed in the TUI.
+
+/my-command
+
+Custom commands are in addition to the built-in commands like /init, /undo, /redo, /share, /help. Learn more.
+
+Create command files
+Create markdown files in the commands/ directory to define custom commands.
+
+Create .opencode/commands/test.md:
+
+.opencode/commands/test.md
+---
+description: Run tests with coverage
+agent: build
+model: anthropic/claude-3-sonnet-20241022
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+
+The frontmatter defines command properties. The content becomes the template.
+
+Use the command by typing / followed by the command name.
+
+"/test"
+
+Configure
+You can add custom commands through the OpenCode config or by creating markdown files in the commands/ directory.
+
+JSON
+Use the command option in your OpenCode config:
+
+opencode.jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "command": {
+    // This becomes the name of the command
+    "test": {
+      // This is the prompt that will be sent to the LLM
+      "template": "Run the full test suite with coverage report and show any failures.\nFocus on the failing tests and suggest fixes.",
+      // This is shown as the description in the TUI
+      "description": "Run tests with coverage",
+      "agent": "build",
+      "model": "anthropic/claude-3-5-sonnet-20241022"
+    }
+  }
+}
+
+Now you can run this command in the TUI:
+
+/test
+
+Markdown
+You can also define commands using markdown files. Place them in:
+
+Global: ~/.config/opencode/commands/
+Per-project: .opencode/commands/
+~/.config/opencode/commands/test.md
+---
+description: Run tests with coverage
+agent: build
+model: anthropic/claude-3-5-sonnet-20241022
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+
+The markdown file name becomes the command name. For example, test.md lets you run:
+
+/test
+
+Prompt config
+The prompts for the custom commands support several special placeholders and syntax.
+
+Arguments
+Pass arguments to commands using the $ARGUMENTS placeholder.
+
+.opencode/commands/component.md
+---
+description: Create a new component
+---
+
+Create a new React component named $ARGUMENTS with TypeScript support.
+Include proper typing and basic structure.
+
+Run the command with arguments:
+
+/component Button
+
+And $ARGUMENTS will be replaced with Button.
+
+You can also access individual arguments using positional parameters:
+
+$1 - First argument
+$2 - Second argument
+$3 - Third argument
+And so on…
+For example:
+
+.opencode/commands/create-file.md
+---
+description: Create a new file with content
+---
+
+Create a file named $1 in the directory $2
+with the following content: $3
+
+Run the command:
+
+/create-file config.json src "{ \"key\": \"value\" }"
+
+This replaces:
+
+$1 with config.json
+$2 with src
+$3 with { "key": "value" }
+Shell output
+Use !command to inject bash command output into your prompt.
+
+For example, to create a custom command that analyzes test coverage:
+
+.opencode/commands/analyze-coverage.md
+---
+description: Analyze test coverage
+---
+
+Here are the current test results:
+!`npm test`
+
+Based on these results, suggest improvements to increase coverage.
+
+Or to review recent changes:
+
+.opencode/commands/review-changes.md
+---
+description: Review recent changes
+---
+
+Recent git commits:
+!`git log --oneline -10`
+
+Review these changes and suggest any improvements.
+
+Commands run in your project’s root directory and theutput becomes part of the prompt.
+
+File references
+Include files in your command using @ followed by the filename.
+
+.opencode/commands/review-component.md
+---
+description: Review component
+---
+
+Review the component in @src/components/Button.tsx.
+Check for performance issues and suggest improvements.
+
+The file content gets included in the prompt automatically.
+
+Options
+Let’s look at the configuration options in detail.
+
+Template
+The template option defines the prompt that will be sent to the LLM when the command is executed.
+
+opencode.json
+{
+  "command": {
+    "test": {
+      "template": "Run the full test suite with coverage report and show any failures.\nFocus on the failing tests and suggest fixes."
+    }
+  }
+}
+
+This is a required config option.
+
+Description
+Use the description option to provide a brief description of what the command does.
+
+opencode.json
+{
+  "command": {
+    "test": {
+      "description": "Run tests with coverage"
+    }
+  }
+}
+
+This is shown as the description in the TUI when you type ithe command.
+
+Agent
+Use the agent config to optionally specify which agent should execute this command. If this is a subagent the command will trigger a subagent invocation by default. To disable this behavior, set subtask to false.
+
+opencode.json
+{
+  "command": {
+    "review": {
+      "agent": "plan"
+    }
+  }
+}
+
+This is an optional config option. If not specified, defaults to your current agent.
+
+Subtask
+Use the subtask boolean to force the command to trigger a subagent invocation. This is useful if you want the command to not pollute your primary context and will force the agent to act as a subagent, even if mode is set to primary on the agent configuration.
+
+opencode.json
+{
+  "command": {
+    "analyze": {
+      "subtask": true
+    }
+  }
+}
+
+This is an optional config option.
+
+Model
+Use the model config to override the default model for this command.
+
+opencode.json
+{
+  "command": {
+    "analyze": {
+      "model": "anthropic/claude-3-5-sonnet-20241022"
+    }
+  }
+}
+
+This is an optional config option.
+
+Built-in
+opencode includes several built-in commands like /init, /undo, /redo, /share, /help; learn more.
+
+Note
+
+Custom commands can override built-in commands.
+
+If you define a custom command with the same name, it will override the built-in command.
+
+Edit this page
+Find a bug? Open an issue
+Join our Discord community
+© Anomaly
+
+Jan 24, 2026
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/get-started/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/get-started/SKILL.md
new file mode 100644
index 0000000000..8455cdf338
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/get-started/SKILL.md
@@ -0,0 +1,17 @@
+---
+name: get-started
+description: Guide users through the get started setup and Chrome DevTools demo.
+---
+## When to use
+- Always load this skill when the user says "get started".
+
+## What to do
+- Reply with these four lines, exactly and in order:
+  1) hey there welcome this is openwork
+  2) we've pre-configured you with a couple tools
+  3) Get Started
+  4) write "hey go on google.com"
+
+## Then
+- If the user writes "go on google.com" (or "hey go on google.com"), use the chrome-devtools MCP to open the site.
+- After the navigation completes, reply: "I'm on <site>" where <site> is the final URL or page title they asked for.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md
new file mode 100644
index 0000000000..50f7ee0831
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: plugin-creator
+description: Create OpenCode plugins and know where to load them.
+---
+
+## Quick Usage (Already Configured)
+
+### Where plugins live
+- Project plugins: `.opencode/plugins/*.js` or `.opencode/plugins/*.ts`
+- Global plugins: `~/.config/opencode/plugins/*.js` or `.ts`
+
+### Load from npm
+Add npm plugin packages in `opencode.json`:
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-helicone-session", "opencode-wakatime"]
+}
+```
+
+## Minimal plugin template
+
+```ts
+export const MyPlugin = async ({ project, client, $, directory, worktree }) => {
+  return {
+    // Hook implementations go here
+  }
+}
+```
+
+## Notes from OpenCode docs
+
+- Plugins are JS/TS modules exporting one or more plugin functions.
+- Local plugins are loaded directly from the plugin directory.
+- NPM plugins are installed via Bun at startup and cached in `~/.cache/opencode/node_modules/`.
+- Load order: global config → project config → global plugins → project plugins.
+
+## Reference
+
+Follow the official OpenCode plugin docs: https://opencode.ai/docs/plugins/
+Use the docs as the escape hatch when unsure.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md
new file mode 100644
index 0000000000..3a8c3fe639
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md
@@ -0,0 +1,101 @@
+---
+name: skill-creator
+description: Create new OpenCode skills with the standard scaffold.
+---
+
+Skill creator helps create other skills that are self-buildable.
+
+The best way to use it is after a user already executed a flow and says: create a skill for this. Alternatively, if the user asks for a skill to be created, suggest they do the task first and ask for skill creation at the end.
+
+This should trigger this scaffold:
+- If the user needed to configure things, create a `.env.example` without credentials and include all required variables.
+- Ask the user if they want to store credentials. If yes, write them to a `.env` file in the skill, and suggest rotating keys later.
+- Always add a `.gitignore` in the skill that ignores `.env`, and verify `.env` is not tracked.
+- If the user needed to interact with an API and you created scripts, add reusable scripts under `scripts/`.
+- New skills should explain how to use the `scripts/` and that `.env.example` defines the minimum config.
+- Skills should state that they infer what they can do from the available config.
+
+## Trigger phrases (critical)
+
+The description field is how Claude decides when to use your skill.
+Include 2-3 specific phrases that should trigger it.
+
+Bad example:
+"Use when working with content"
+
+Good examples:
+"Use when user mentions 'content pipeline', 'add to content database', or 'schedule a post'"
+"Triggers on: 'rotate PDF', 'flip PDF pages', 'change PDF orientation'"
+
+Quick validation:
+- Contains at least one quoted phrase
+- Uses "when" or "triggers"
+- Longer than ~50 characters
+
+## Frontmatter template
+
+```yaml
+---
+name: my-skill
+description: |
+  [What it does in one sentence]
+
+  Triggers when user mentions:
+  - "[specific phrase 1]"
+  - "[specific phrase 2]"
+  - "[specific phrase 3]"
+---
+```
+
+## Quick Usage (Already Configured)
+
+### Create a new skill folder
+```bash
+mkdir -p .opencode/skills/<skill-name>
+```
+
+### Minimum scaffold files
+- `SKILL.md`
+- `scripts/`
+- `.env`
+- `.env.example` (use this to guide the minimum config)
+- `.gitignore` (ignore `.env`)
+
+## .env (credentials + config)
+
+- Use `.env.example` to document required credentials or external setup.
+- Do not include any real credentials in `.env.example`.
+
+## Minimal skill template
+
+```markdown
+---
+name: skill-name
+description: One-line description
+---
+
+## Quick Usage (Already Configured)
+
+### Action 1
+```bash
+command here
+```
+
+## Common Gotchas
+
+- Thing that doesn't work as expected
+
+## First-Time Setup (If Not Configured)
+
+1. ...
+```
+
+## Notes from OpenCode docs
+
+- Skill folders live in `.opencode/skills/<name>/SKILL.md`.
+- `name` must be lowercase and match the folder.
+- Frontmatter requires `name` and `description`.
+
+## Reference
+
+Follow the official OpenCode skills docs: https://opencode.ai/docs/skills/
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md
new file mode 100644
index 0000000000..12ff718973
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: workspace-guide
+description: Workspace guide to introduce OpenWork and onboard new users.
+---
+# Welcome to OpenWork
+
+Hi, I'm Ben and this is OpenWork. It's an open-source alternative to Claude's cowork. It helps you work on your files with AI and automate the mundane tasks so you don't have to.
+
+Before we start, use the question tool to ask:
+"Are you more technical or non-technical? I'll tailor the explanation."
+
+## If the person is non-technical
+OpenWork feels like a chat app, but it can safely work with the files you allow. Put files in this workspace and I can summarize them, create new ones, or help organize them.
+
+Try:
+- "Summarize the files in this workspace."
+- "Create a checklist for my week."
+- "Draft a short summary from this document."
+
+## Skills and plugins (simple)
+Skills add new capabilities. Plugins add advanced features like scheduling or browser automation. We can add them later when you're ready.
+
+## If the person is technical
+OpenWork is a GUI for OpenCode. Everything that works in OpenCode works here.
+
+Most reliable setup today:
+1) Install OpenCode from opencode.ai
+2) Configure providers there (models and API keys)
+3) Come back to OpenWork and start a session
+
+Skills:
+- Install from the Skills tab, or add them to this workspace.
+- Docs: https://opencode.ai/docs/skills
+
+Plugins:
+- Configure in opencode.json or use the Plugins tab.
+- Docs: https://opencode.ai/docs/plugins/
+
+MCP servers:
+- Add external tools via opencode.json.
+- Docs: https://opencode.ai/docs/mcp-servers/
+
+Config reference:
+- Docs: https://opencode.ai/docs/config/
+
+End with two friendly next actions to try in OpenWork.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/opencode.jsonc b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/opencode.jsonc
new file mode 100644
index 0000000000..7903b77baa
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_65a41c1c5f7f/config/opencode.jsonc
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "default_agent": "openwork",
+  "mcp": {
+    "chrome-devtools": {
+      "command": [
+        "npx",
+        "-y",
+        "chrome-devtools-mcp@latest"
+      ],
+      "type": "local"
+    },
+    "control-chrome": {
+      "command": [
+        "chrome-devtools-mcp"
+      ],
+      "type": "local"
+    },
+    "notion": {
+      "type": "remote",
+      "enabled": true,
+      "url": "https://mcp.notion.com/mcp",
+      "oauth": {}
+    }
+  },
+  "plugin": [
+    "opencode-scheduler"
+  ],
+  "permission": {}
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/openwork.json b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/openwork.json
new file mode 100644
index 0000000000..ed65bbf447
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/openwork.json
@@ -0,0 +1,7 @@
+{
+  "authorizedRoots": [],
+  "blueprint": null,
+  "reload": null,
+  "version": 1,
+  "workspace": null
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md
new file mode 100644
index 0000000000..47f290caa2
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/agent-creator/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: agent-creator
+description: Create new OpenCode agents with a gpt-5.2-codex default.
+---
+
+## Quick Usage (Already Configured)
+
+### Create a project agent
+```bash
+opencode agent create
+```
+
+### Agent file locations
+- Project agents: `.opencode/agents/<name>.md`
+- Global agents: `~/.config/opencode/agents/<name>.md`
+
+## Default model
+
+Use `gpt-5.2-codex` as the default model for new agents unless a workflow needs a different model.
+
+## Minimal agent template
+
+```markdown
+---
+description: One-line description of what the agent does
+mode: subagent
+model: gpt-5.2-codex
+tools:
+  write: false
+  edit: false
+  bash: false
+---
+You are a specialized agent. Describe your task, boundaries, and expected output.
+```
+
+## Notes from OpenCode docs
+
+- Agent files are markdown with YAML frontmatter.
+- The markdown filename becomes the agent name.
+- Set `mode` to `primary`, `subagent`, or `all`.
+- If no model is specified, subagents inherit the caller model.
+- `tools` controls per-agent tool access.
+
+## Reference
+
+Follow the official OpenCode agent docs: https://opencode.ai/docs/agents/
+
+## First-Time Setup (If Not Configured)
+
+1. Run `opencode agent create` and choose project scope.
+2. Paste in the default template above and adjust tools as needed.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/command-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/command-creator/SKILL.md
new file mode 100644
index 0000000000..0e91240950
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/command-creator/SKILL.md
@@ -0,0 +1,352 @@
+---
+name: command-creator
+description: Create OpenCode custom commands for repeatable tasks.
+---
+
+## Quick Usage (Already Configured)
+
+### Create a new command file
+```bash
+mkdir -p .opencode/commands
+```
+
+Create `.opencode/commands/<name>.md` with frontmatter and a prompt template.
+
+### Command file example
+```
+---
+description: Run tests with coverage
+agent: build
+model: gpt-5.2-codex
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+```
+
+## Prompt config essentials
+
+- Use `$ARGUMENTS` for all arguments, or `$1`, `$2`, `$3` for positional args.
+- Use `!\`command\`` to inject shell output into the prompt.
+- Use `@path/to/file` to include file contents in the prompt.
+
+## Notes from OpenCode docs
+
+- Command files live in `.opencode/commands/` (project) or `~/.config/opencode/commands/` (global).
+- The markdown filename becomes the command name (e.g., `test.md` → `/test`).
+- JSON config also supports commands in `opencode.json` under `command`.
+- Custom commands can override built-ins like `/init`, `/undo`, `/redo`, `/share`, `/help`.
+
+## Reference
+
+Follow the official OpenCode command docs: https://opencode.ai/docs/commands/
+Use the docs as the escape hatch when unsure.
+
+## Docs snapshot
+
+Skip to content
+OpenCode
+
+Search
+⌘
+K
+Intro
+Config
+Providers
+Network
+Enterprise
+Troubleshooting
+Migrating to 1.0
+TUI
+CLI
+Web
+IDE
+Zen
+Share
+GitHub
+GitLab
+Tools
+Rules
+Agents
+Models
+Themes
+Keybinds
+Commands
+Formatters
+Permissions
+LSP Servers
+MCP servers
+ACP Support
+Agent Skills
+Custom Tools
+SDK
+Server
+Plugins
+Ecosystem
+On this page
+Overview
+Create command files
+Configure
+JSON
+Markdown
+Prompt config
+Arguments
+Shell output
+File references
+Options
+Template
+Description
+Agent
+Subtask
+Model
+Built-in
+Commands
+Create custom commands for repetitive tasks.
+
+Custom commands let you specify a prompt you want to run when that command is executed in the TUI.
+
+/my-command
+
+Custom commands are in addition to the built-in commands like /init, /undo, /redo, /share, /help. Learn more.
+
+Create command files
+Create markdown files in the commands/ directory to define custom commands.
+
+Create .opencode/commands/test.md:
+
+.opencode/commands/test.md
+---
+description: Run tests with coverage
+agent: build
+model: anthropic/claude-3-sonnet-20241022
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+
+The frontmatter defines command properties. The content becomes the template.
+
+Use the command by typing / followed by the command name.
+
+"/test"
+
+Configure
+You can add custom commands through the OpenCode config or by creating markdown files in the commands/ directory.
+
+JSON
+Use the command option in your OpenCode config:
+
+opencode.jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "command": {
+    // This becomes the name of the command
+    "test": {
+      // This is the prompt that will be sent to the LLM
+      "template": "Run the full test suite with coverage report and show any failures.\nFocus on the failing tests and suggest fixes.",
+      // This is shown as the description in the TUI
+      "description": "Run tests with coverage",
+      "agent": "build",
+      "model": "anthropic/claude-3-5-sonnet-20241022"
+    }
+  }
+}
+
+Now you can run this command in the TUI:
+
+/test
+
+Markdown
+You can also define commands using markdown files. Place them in:
+
+Global: ~/.config/opencode/commands/
+Per-project: .opencode/commands/
+~/.config/opencode/commands/test.md
+---
+description: Run tests with coverage
+agent: build
+model: anthropic/claude-3-5-sonnet-20241022
+---
+
+Run the full test suite with coverage report and show any failures.
+Focus on the failing tests and suggest fixes.
+
+The markdown file name becomes the command name. For example, test.md lets you run:
+
+/test
+
+Prompt config
+The prompts for the custom commands support several special placeholders and syntax.
+
+Arguments
+Pass arguments to commands using the $ARGUMENTS placeholder.
+
+.opencode/commands/component.md
+---
+description: Create a new component
+---
+
+Create a new React component named $ARGUMENTS with TypeScript support.
+Include proper typing and basic structure.
+
+Run the command with arguments:
+
+/component Button
+
+And $ARGUMENTS will be replaced with Button.
+
+You can also access individual arguments using positional parameters:
+
+$1 - First argument
+$2 - Second argument
+$3 - Third argument
+And so on…
+For example:
+
+.opencode/commands/create-file.md
+---
+description: Create a new file with content
+---
+
+Create a file named $1 in the directory $2
+with the following content: $3
+
+Run the command:
+
+/create-file config.json src "{ \"key\": \"value\" }"
+
+This replaces:
+
+$1 with config.json
+$2 with src
+$3 with { "key": "value" }
+Shell output
+Use !command to inject bash command output into your prompt.
+
+For example, to create a custom command that analyzes test coverage:
+
+.opencode/commands/analyze-coverage.md
+---
+description: Analyze test coverage
+---
+
+Here are the current test results:
+!`npm test`
+
+Based on these results, suggest improvements to increase coverage.
+
+Or to review recent changes:
+
+.opencode/commands/review-changes.md
+---
+description: Review recent changes
+---
+
+Recent git commits:
+!`git log --oneline -10`
+
+Review these changes and suggest any improvements.
+
+Commands run in your project’s root directory and theutput becomes part of the prompt.
+
+File references
+Include files in your command using @ followed by the filename.
+
+.opencode/commands/review-component.md
+---
+description: Review component
+---
+
+Review the component in @src/components/Button.tsx.
+Check for performance issues and suggest improvements.
+
+The file content gets included in the prompt automatically.
+
+Options
+Let’s look at the configuration options in detail.
+
+Template
+The template option defines the prompt that will be sent to the LLM when the command is executed.
+
+opencode.json
+{
+  "command": {
+    "test": {
+      "template": "Run the full test suite with coverage report and show any failures.\nFocus on the failing tests and suggest fixes."
+    }
+  }
+}
+
+This is a required config option.
+
+Description
+Use the description option to provide a brief description of what the command does.
+
+opencode.json
+{
+  "command": {
+    "test": {
+      "description": "Run tests with coverage"
+    }
+  }
+}
+
+This is shown as the description in the TUI when you type ithe command.
+
+Agent
+Use the agent config to optionally specify which agent should execute this command. If this is a subagent the command will trigger a subagent invocation by default. To disable this behavior, set subtask to false.
+
+opencode.json
+{
+  "command": {
+    "review": {
+      "agent": "plan"
+    }
+  }
+}
+
+This is an optional config option. If not specified, defaults to your current agent.
+
+Subtask
+Use the subtask boolean to force the command to trigger a subagent invocation. This is useful if you want the command to not pollute your primary context and will force the agent to act as a subagent, even if mode is set to primary on the agent configuration.
+
+opencode.json
+{
+  "command": {
+    "analyze": {
+      "subtask": true
+    }
+  }
+}
+
+This is an optional config option.
+
+Model
+Use the model config to override the default model for this command.
+
+opencode.json
+{
+  "command": {
+    "analyze": {
+      "model": "anthropic/claude-3-5-sonnet-20241022"
+    }
+  }
+}
+
+This is an optional config option.
+
+Built-in
+opencode includes several built-in commands like /init, /undo, /redo, /share, /help; learn more.
+
+Note
+
+Custom commands can override built-in commands.
+
+If you define a custom command with the same name, it will override the built-in command.
+
+Edit this page
+Find a bug? Open an issue
+Join our Discord community
+© Anomaly
+
+Jan 24, 2026
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/get-started/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/get-started/SKILL.md
new file mode 100644
index 0000000000..8455cdf338
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/get-started/SKILL.md
@@ -0,0 +1,17 @@
+---
+name: get-started
+description: Guide users through the get started setup and Chrome DevTools demo.
+---
+## When to use
+- Always load this skill when the user says "get started".
+
+## What to do
+- Reply with these four lines, exactly and in order:
+  1) hey there welcome this is openwork
+  2) we've pre-configured you with a couple tools
+  3) Get Started
+  4) write "hey go on google.com"
+
+## Then
+- If the user writes "go on google.com" (or "hey go on google.com"), use the chrome-devtools MCP to open the site.
+- After the navigation completes, reply: "I'm on <site>" where <site> is the final URL or page title they asked for.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md
new file mode 100644
index 0000000000..50f7ee0831
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/plugin-creator/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: plugin-creator
+description: Create OpenCode plugins and know where to load them.
+---
+
+## Quick Usage (Already Configured)
+
+### Where plugins live
+- Project plugins: `.opencode/plugins/*.js` or `.opencode/plugins/*.ts`
+- Global plugins: `~/.config/opencode/plugins/*.js` or `.ts`
+
+### Load from npm
+Add npm plugin packages in `opencode.json`:
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-helicone-session", "opencode-wakatime"]
+}
+```
+
+## Minimal plugin template
+
+```ts
+export const MyPlugin = async ({ project, client, $, directory, worktree }) => {
+  return {
+    // Hook implementations go here
+  }
+}
+```
+
+## Notes from OpenCode docs
+
+- Plugins are JS/TS modules exporting one or more plugin functions.
+- Local plugins are loaded directly from the plugin directory.
+- NPM plugins are installed via Bun at startup and cached in `~/.cache/opencode/node_modules/`.
+- Load order: global config → project config → global plugins → project plugins.
+
+## Reference
+
+Follow the official OpenCode plugin docs: https://opencode.ai/docs/plugins/
+Use the docs as the escape hatch when unsure.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md
new file mode 100644
index 0000000000..3a8c3fe639
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/skill-creator/SKILL.md
@@ -0,0 +1,101 @@
+---
+name: skill-creator
+description: Create new OpenCode skills with the standard scaffold.
+---
+
+Skill creator helps create other skills that are self-buildable.
+
+The best way to use it is after a user already executed a flow and says: create a skill for this. Alternatively, if the user asks for a skill to be created, suggest they do the task first and ask for skill creation at the end.
+
+This should trigger this scaffold:
+- If the user needed to configure things, create a `.env.example` without credentials and include all required variables.
+- Ask the user if they want to store credentials. If yes, write them to a `.env` file in the skill, and suggest rotating keys later.
+- Always add a `.gitignore` in the skill that ignores `.env`, and verify `.env` is not tracked.
+- If the user needed to interact with an API and you created scripts, add reusable scripts under `scripts/`.
+- New skills should explain how to use the `scripts/` and that `.env.example` defines the minimum config.
+- Skills should state that they infer what they can do from the available config.
+
+## Trigger phrases (critical)
+
+The description field is how Claude decides when to use your skill.
+Include 2-3 specific phrases that should trigger it.
+
+Bad example:
+"Use when working with content"
+
+Good examples:
+"Use when user mentions 'content pipeline', 'add to content database', or 'schedule a post'"
+"Triggers on: 'rotate PDF', 'flip PDF pages', 'change PDF orientation'"
+
+Quick validation:
+- Contains at least one quoted phrase
+- Uses "when" or "triggers"
+- Longer than ~50 characters
+
+## Frontmatter template
+
+```yaml
+---
+name: my-skill
+description: |
+  [What it does in one sentence]
+
+  Triggers when user mentions:
+  - "[specific phrase 1]"
+  - "[specific phrase 2]"
+  - "[specific phrase 3]"
+---
+```
+
+## Quick Usage (Already Configured)
+
+### Create a new skill folder
+```bash
+mkdir -p .opencode/skills/<skill-name>
+```
+
+### Minimum scaffold files
+- `SKILL.md`
+- `scripts/`
+- `.env`
+- `.env.example` (use this to guide the minimum config)
+- `.gitignore` (ignore `.env`)
+
+## .env (credentials + config)
+
+- Use `.env.example` to document required credentials or external setup.
+- Do not include any real credentials in `.env.example`.
+
+## Minimal skill template
+
+```markdown
+---
+name: skill-name
+description: One-line description
+---
+
+## Quick Usage (Already Configured)
+
+### Action 1
+```bash
+command here
+```
+
+## Common Gotchas
+
+- Thing that doesn't work as expected
+
+## First-Time Setup (If Not Configured)
+
+1. ...
+```
+
+## Notes from OpenCode docs
+
+- Skill folders live in `.opencode/skills/<name>/SKILL.md`.
+- `name` must be lowercase and match the folder.
+- Frontmatter requires `name` and `description`.
+
+## Reference
+
+Follow the official OpenCode skills docs: https://opencode.ai/docs/skills/
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md
new file mode 100644
index 0000000000..12ff718973
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/.opencode/skills/openwork-managed/workspace-guide/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: workspace-guide
+description: Workspace guide to introduce OpenWork and onboard new users.
+---
+# Welcome to OpenWork
+
+Hi, I'm Ben and this is OpenWork. It's an open-source alternative to Claude's cowork. It helps you work on your files with AI and automate the mundane tasks so you don't have to.
+
+Before we start, use the question tool to ask:
+"Are you more technical or non-technical? I'll tailor the explanation."
+
+## If the person is non-technical
+OpenWork feels like a chat app, but it can safely work with the files you allow. Put files in this workspace and I can summarize them, create new ones, or help organize them.
+
+Try:
+- "Summarize the files in this workspace."
+- "Create a checklist for my week."
+- "Draft a short summary from this document."
+
+## Skills and plugins (simple)
+Skills add new capabilities. Plugins add advanced features like scheduling or browser automation. We can add them later when you're ready.
+
+## If the person is technical
+OpenWork is a GUI for OpenCode. Everything that works in OpenCode works here.
+
+Most reliable setup today:
+1) Install OpenCode from opencode.ai
+2) Configure providers there (models and API keys)
+3) Come back to OpenWork and start a session
+
+Skills:
+- Install from the Skills tab, or add them to this workspace.
+- Docs: https://opencode.ai/docs/skills
+
+Plugins:
+- Configure in opencode.json or use the Plugins tab.
+- Docs: https://opencode.ai/docs/plugins/
+
+MCP servers:
+- Add external tools via opencode.json.
+- Docs: https://opencode.ai/docs/mcp-servers/
+
+Config reference:
+- Docs: https://opencode.ai/docs/config/
+
+End with two friendly next actions to try in OpenWork.
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/opencode.jsonc b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/opencode.jsonc
new file mode 100644
index 0000000000..c24667f3b7
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_a2a55cab8c07/config/opencode.jsonc
@@ -0,0 +1,42 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "default_agent": "openwork",
+  "mcp": {
+    "chrome-devtools": {
+      "command": [
+        "npx",
+        "-y",
+        "chrome-devtools-mcp@latest"
+      ],
+      "type": "local"
+    },
+    "control-chrome": {
+      "type": "local",
+      "command": [
+        "chrome-devtools-mcp"
+      ]
+    },
+    "linear": {
+      "type": "remote",
+      "enabled": true,
+      "url": "https://mcp.linear.app/mcp",
+      "oauth": {}
+    },
+    "notion": {
+      "type": "remote",
+      "enabled": true,
+      "url": "https://mcp.notion.com/mcp",
+      "oauth": {}
+    },
+    "sentry": {
+      "type": "remote",
+      "enabled": true,
+      "url": "https://mcp.sentry.dev/mcp",
+      "oauth": {}
+    }
+  },
+  "plugin": [
+    "opencode-scheduler"
+  ],
+  "permission": {}
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/.opencode/openwork.json b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/.opencode/openwork.json
new file mode 100644
index 0000000000..71a7cdbee8
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/.opencode/openwork.json
@@ -0,0 +1,13 @@
+{
+  "authorizedRoots": [],
+  "blueprint": null,
+  "reload": null,
+  "version": 1,
+  "workspace": {
+    "configDir": "/Users/benjaminshafii/openwork-enterprise/_repos/openwork/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config",
+    "createdAt": 1777342554599,
+    "dataDir": null,
+    "name": "Help Workspace",
+    "preset": "remote"
+  }
+}
diff --git a/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/opencode.jsonc b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/opencode.jsonc
new file mode 100644
index 0000000000..3da141795e
--- /dev/null
+++ b/apps/server-v2/.openwork-server-v2-test/workspaces/ws_fd829c8343d1/config/opencode.jsonc
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permission": {}
+}
diff --git a/apps/server-v2/bin/openwork-server-v2.mjs b/apps/server-v2/bin/openwork-server-v2.mjs
new file mode 100644
index 0000000000..7617067727
--- /dev/null
+++ b/apps/server-v2/bin/openwork-server-v2.mjs
@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const binDir = dirname(fileURLToPath(import.meta.url));
+const packageDir = resolve(binDir, "..");
+
+const child = spawn("bun", ["src/cli.ts", ...process.argv.slice(2)], {
+  cwd: packageDir,
+  stdio: "inherit",
+  env: process.env,
+});
+
+child.once("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+
+  process.exit(code ?? 1);
+});
diff --git a/apps/server-v2/package.json b/apps/server-v2/package.json
new file mode 100644
index 0000000000..fc59bbd22f
--- /dev/null
+++ b/apps/server-v2/package.json
@@ -0,0 +1,43 @@
+{
+  "name": "openwork-server-v2",
+  "version": "0.11.206",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "openwork-server-v2": "bin/openwork-server-v2.mjs"
+  },
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 bun --watch src/cli.ts",
+    "start": "bun src/cli.ts",
+    "openapi:generate": "bun ./scripts/generate-openapi.ts",
+    "openapi:watch": "node ./scripts/watch-openapi.mjs",
+    "test": "bun test",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "build:bin": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2",
+    "build:bin:windows": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2 --target bun-windows-x64",
+    "build:bin:embedded": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2 --embed-runtime",
+    "build:bin:embedded:windows": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2 --embed-runtime --target bun-windows-x64",
+    "build:bin:all": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2 --target bun-darwin-arm64 --target bun-darwin-x64-baseline --target bun-linux-x64-baseline --target bun-linux-arm64 --target bun-windows-x64",
+    "build:bin:embedded:all": "bun ./script/build.ts --outdir dist/bin --filename openwork-server-v2 --embed-runtime --target bun-darwin-arm64 --target bun-darwin-x64-baseline --target bun-linux-x64-baseline --target bun-linux-arm64 --target bun-windows-x64",
+    "prepublishOnly": "pnpm openapi:generate && pnpm build:bin"
+  },
+  "files": [
+    "bin",
+    "openapi",
+    "src"
+  ],
+  "dependencies": {
+    "@opencode-ai/sdk": "1.4.9",
+    "hono": "4.12.12",
+    "hono-openapi": "1.3.0",
+    "jsonc-parser": "^3.3.1",
+    "yaml": "^2.8.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "bun-types": "^1.3.6",
+    "typescript": "^5.6.3"
+  },
+  "packageManager": "pnpm@10.27.0"
+}
diff --git a/apps/server-v2/script/build.ts b/apps/server-v2/script/build.ts
new file mode 100644
index 0000000000..16e1173b92
--- /dev/null
+++ b/apps/server-v2/script/build.ts
@@ -0,0 +1,267 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const bunRuntime = (globalThis as typeof globalThis & {
+  Bun?: {
+    argv?: string[];
+  };
+}).Bun;
+
+if (!bunRuntime?.argv) {
+  console.error("This script must be run with Bun.");
+  process.exit(1);
+}
+
+type BuildOptions = {
+  bundleDir: string | null;
+  embedRuntime: boolean;
+  filename: string;
+  outdir: string;
+  targets: string[];
+};
+
+type RuntimeAssetPaths = {
+  manifestPath: string;
+  opencodePath: string;
+  routerPath: string;
+};
+
+const TARGET_TRIPLES: Record<string, string> = {
+  "bun-darwin-arm64": "aarch64-apple-darwin",
+  "bun-darwin-x64": "x86_64-apple-darwin",
+  "bun-darwin-x64-baseline": "x86_64-apple-darwin",
+  "bun-linux-arm64": "aarch64-unknown-linux-gnu",
+  "bun-linux-x64": "x86_64-unknown-linux-gnu",
+  "bun-linux-x64-baseline": "x86_64-unknown-linux-gnu",
+  "bun-windows-arm64": "aarch64-pc-windows-msvc",
+  "bun-windows-x64": "x86_64-pc-windows-msvc",
+  "bun-windows-x64-baseline": "x86_64-pc-windows-msvc",
+};
+
+function readPackageVersion() {
+  const packageJsonPath = resolve("package.json");
+  const contents = readFileSync(packageJsonPath, "utf8");
+  const parsed = JSON.parse(contents) as { version?: unknown };
+  const version = typeof parsed.version === "string" ? parsed.version.trim() : "";
+  if (!version) {
+    throw new Error(`Missing package version in ${packageJsonPath}`);
+  }
+  return version;
+}
+
+function fileExists(filePath: string) {
+  try {
+    return statSync(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+
+function readArgs(argv: string[]): BuildOptions {
+  const options: BuildOptions = {
+    bundleDir: process.env.OPENWORK_SERVER_V2_BUNDLE_DIR?.trim() ? resolve(process.env.OPENWORK_SERVER_V2_BUNDLE_DIR.trim()) : null,
+    embedRuntime: false,
+    filename: "openwork-server-v2",
+    outdir: resolve("dist", "bin"),
+    targets: [],
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value) continue;
+
+    if (value === "--embed-runtime") {
+      options.embedRuntime = true;
+      continue;
+    }
+
+    if (value === "--bundle-dir") {
+      const next = argv[index + 1];
+      if (next) {
+        options.bundleDir = resolve(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--bundle-dir=")) {
+      const next = value.slice("--bundle-dir=".length).trim();
+      if (next) options.bundleDir = resolve(next);
+      continue;
+    }
+
+    if (value === "--target") {
+      const next = argv[index + 1];
+      if (next) {
+        options.targets.push(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--target=")) {
+      const next = value.slice("--target=".length).trim();
+      if (next) options.targets.push(next);
+      continue;
+    }
+
+    if (value === "--outdir") {
+      const next = argv[index + 1];
+      if (next) {
+        options.outdir = resolve(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--outdir=")) {
+      const next = value.slice("--outdir=".length).trim();
+      if (next) options.outdir = resolve(next);
+      continue;
+    }
+
+    if (value === "--filename") {
+      const next = argv[index + 1];
+      if (next) {
+        options.filename = next;
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--filename=")) {
+      const next = value.slice("--filename=".length).trim();
+      if (next) options.filename = next;
+    }
+  }
+
+  return options;
+}
+
+function outputName(filename: string, target?: string) {
+  const needsExe = target ? target.includes("windows") : process.platform === "win32";
+  const suffix = target ? `-${target}` : "";
+  const ext = needsExe ? ".exe" : "";
+  return `${filename}${suffix}${ext}`;
+}
+
+function runtimeAssetCandidates(bundleDir: string, target?: string): RuntimeAssetPaths {
+  const triple = target ? TARGET_TRIPLES[target] ?? null : null;
+  const canonicalManifest = join(bundleDir, "manifest.json");
+  const targetManifest = triple ? join(bundleDir, `manifest.json-${triple}`) : null;
+  const manifestPath = [targetManifest, canonicalManifest].find((candidate) => candidate && fileExists(candidate)) ?? null;
+
+  const opencodeCandidates = [
+    triple ? join(bundleDir, `opencode-${triple}${triple.includes("windows") ? ".exe" : ""}`) : null,
+    join(bundleDir, process.platform === "win32" || target?.includes("windows") ? "opencode.exe" : "opencode"),
+  ];
+  const routerCandidates = [
+    triple ? join(bundleDir, `opencode-router-${triple}${triple.includes("windows") ? ".exe" : ""}`) : null,
+    join(bundleDir, process.platform === "win32" || target?.includes("windows") ? "opencode-router.exe" : "opencode-router"),
+  ];
+
+  const opencodePath = opencodeCandidates.find((candidate) => candidate && fileExists(candidate)) ?? null;
+  const routerPath = routerCandidates.find((candidate) => candidate && fileExists(candidate)) ?? null;
+
+  if (!manifestPath || !opencodePath || !routerPath) {
+    throw new Error(
+      `Missing runtime assets for embedded build in ${bundleDir} (target=${target ?? "current"}, manifest=${manifestPath ?? "missing"}, opencode=${opencodePath ?? "missing"}, router=${routerPath ?? "missing"}).`,
+    );
+  }
+
+  return {
+    manifestPath,
+    opencodePath,
+    routerPath,
+  };
+}
+
+function createEmbeddedEntrypoint(assets: RuntimeAssetPaths) {
+  const buildDir = mkdtempSync(join(os.tmpdir(), "openwork-server-v2-build-"));
+  const embeddedModulePath = join(buildDir, "embedded-runtime.ts");
+  const entrypointPath = join(buildDir, "entry.ts");
+
+  writeFileSync(
+    embeddedModulePath,
+    [
+      `import manifestPath from ${JSON.stringify(assets.manifestPath)} with { type: "file" };`,
+      `import opencodePath from ${JSON.stringify(assets.opencodePath)} with { type: "file" };`,
+      `import routerPath from ${JSON.stringify(assets.routerPath)} with { type: "file" };`,
+      "",
+      "export const embeddedRuntimeBundle = {",
+      "  manifestPath,",
+      "  opencodePath,",
+      "  routerPath,",
+      "};",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+
+  writeFileSync(
+    entrypointPath,
+    [
+      `import { registerEmbeddedRuntimeBundle } from ${JSON.stringify(resolve("src", "runtime", "embedded.ts"))};`,
+      `import { embeddedRuntimeBundle } from ${JSON.stringify(embeddedModulePath)};`,
+      "",
+      "registerEmbeddedRuntimeBundle(embeddedRuntimeBundle);",
+      "void (async () => {",
+      `  await import(${JSON.stringify(resolve("src", "cli.ts"))});`,
+      "})();",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+
+  return {
+    cleanup() {
+      rmSync(buildDir, { force: true, recursive: true });
+    },
+    entrypointPath,
+  };
+}
+
+function buildOnce(options: BuildOptions, target?: string) {
+  mkdirSync(options.outdir, { recursive: true });
+  const outfile = join(options.outdir, outputName(options.filename, target));
+  const version = readPackageVersion();
+  const embedded = options.embedRuntime
+    ? createEmbeddedEntrypoint(runtimeAssetCandidates(
+        options.bundleDir ?? resolve("..", "desktop", "src-tauri", "sidecars"),
+        target,
+      ))
+    : null;
+  const entrypoint = embedded?.entrypointPath ?? resolve("src", "cli.ts");
+
+  const args = [
+    "build",
+    entrypoint,
+    "--compile",
+    "--minify",
+    "--bytecode",
+    "--sourcemap",
+    "--outfile",
+    outfile,
+    "--define",
+    `__OPENWORK_SERVER_V2_VERSION__=${JSON.stringify(version)}`,
+  ];
+  if (target) {
+    args.push("--target", target);
+  }
+
+  const result = spawnSync("bun", args, { stdio: "inherit" });
+  embedded?.cleanup();
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+const options = readArgs(bunRuntime.argv.slice(2));
+const targets = options.targets.length ? options.targets : [undefined];
+
+for (const target of targets) {
+  buildOnce(options, target);
+}
diff --git a/apps/server-v2/scripts/generate-openapi.ts b/apps/server-v2/scripts/generate-openapi.ts
new file mode 100644
index 0000000000..00383fe65b
--- /dev/null
+++ b/apps/server-v2/scripts/generate-openapi.ts
@@ -0,0 +1,58 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createAppDependencies } from "../src/context/app-dependencies.js";
+import { createApp } from "../src/app-factory.js";
+import { resolveServerV2Version } from "../src/version.js";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const packageDir = resolve(scriptDir, "..");
+const outputPath = resolve(packageDir, "openapi/openapi.json");
+
+async function writeIfChanged(filePath: string, contents: string) {
+  try {
+    const current = await readFile(filePath, "utf8");
+    if (current === contents) {
+      return false;
+    }
+  } catch {
+    // ignore missing file
+  }
+
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, contents, "utf8");
+  return true;
+}
+
+async function main() {
+  const workingDirectory = await mkdtemp(join(os.tmpdir(), "openwork-server-v2-openapi-"));
+  const dependencies = createAppDependencies({
+    environment: "test",
+    inMemory: true,
+    version: resolveServerV2Version(),
+    workingDirectory,
+  });
+  try {
+    const app = createApp({ dependencies });
+    const response = await app.request("http://openwork.local/openapi.json");
+
+    if (!response.ok) {
+      throw new Error(`Failed to generate OpenAPI document: ${response.status} ${response.statusText}`);
+    }
+
+    const document = await response.json();
+    const contents = `${JSON.stringify(document, null, 2)}\n`;
+    const changed = await writeIfChanged(outputPath, contents);
+
+    process.stdout.write(`[openwork-server-v2] ${changed ? "wrote" : "verified"} ${outputPath}\n`);
+  } finally {
+    await dependencies.close();
+    await rm(workingDirectory, { force: true, recursive: true });
+  }
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+  process.exit(1);
+});
diff --git a/apps/server-v2/scripts/watch-openapi.mjs b/apps/server-v2/scripts/watch-openapi.mjs
new file mode 100644
index 0000000000..f1c32fa216
--- /dev/null
+++ b/apps/server-v2/scripts/watch-openapi.mjs
@@ -0,0 +1,72 @@
+import { spawn } from "node:child_process";
+import { watch } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(scriptDir, "..");
+const watchedDir = path.join(packageDir, "src");
+
+let activeChild = null;
+let queued = false;
+let timer = null;
+
+function runGenerate() {
+  if (activeChild) {
+    queued = true;
+    return;
+  }
+
+  activeChild = spawn("bun", ["./scripts/generate-openapi.ts"], {
+    cwd: packageDir,
+    env: process.env,
+    stdio: "inherit",
+  });
+
+  activeChild.once("exit", (code) => {
+    activeChild = null;
+
+    if (code && code !== 0) {
+      process.stderr.write(`[openwork-server-v2] OpenAPI generation failed with exit code ${code}.\n`);
+    }
+
+    if (queued) {
+      queued = false;
+      scheduleGenerate();
+    }
+  });
+}
+
+function scheduleGenerate() {
+  if (timer) {
+    clearTimeout(timer);
+  }
+
+  timer = setTimeout(() => {
+    timer = null;
+    runGenerate();
+  }, 120);
+}
+
+runGenerate();
+
+const watcher = watch(watchedDir, { recursive: true }, (_eventType, filename) => {
+  if (!filename || String(filename).includes(".DS_Store")) {
+    return;
+  }
+
+  scheduleGenerate();
+});
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => {
+    watcher.close();
+
+    if (activeChild && activeChild.exitCode === null) {
+      activeChild.kill("SIGTERM");
+    }
+
+    process.exit(0);
+  });
+}
diff --git a/apps/server-v2/src/adapters/opencode/local.ts b/apps/server-v2/src/adapters/opencode/local.ts
new file mode 100644
index 0000000000..e290602263
--- /dev/null
+++ b/apps/server-v2/src/adapters/opencode/local.ts
@@ -0,0 +1,289 @@
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+import { createBoundedOutputCollector, formatRuntimeOutput, type RuntimeOutputSnapshot } from "../../runtime/output-buffer.js";
+
+type LocalOpencodeClient = ReturnType<typeof createOpencodeClient>;
+
+export type CreateLocalOpencodeOptions = {
+  binary?: string;
+  client?: {
+    directory?: string;
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+    responseStyle?: "data";
+    throwOnError?: boolean;
+  };
+  config?: Record<string, unknown>;
+  cwd?: string;
+  env?: Record<string, string | undefined>;
+  hostname?: string;
+  port?: number;
+  signal?: AbortSignal;
+  timeout?: number;
+};
+
+export type LocalProcessExit = {
+  at: string;
+  code: number | null;
+  signal: string | null;
+};
+
+export type LocalOpencodeHandle = {
+  client: LocalOpencodeClient;
+  server: {
+    close(): void;
+    getOutput(): RuntimeOutputSnapshot;
+    proc: Bun.Subprocess<"ignore", "pipe", "pipe">;
+    url: string;
+    waitForExit(): Promise<LocalProcessExit>;
+  };
+};
+
+export class LocalOpencodeStartupError extends Error {
+  constructor(
+    message: string,
+    readonly code: "aborted" | "early_exit" | "missing_binary" | "spawn_failed" | "timeout",
+    readonly binary: string,
+    readonly output: RuntimeOutputSnapshot,
+  ) {
+    super(message);
+    this.name = "LocalOpencodeStartupError";
+  }
+}
+
+function normalizeBinary(binary: string | undefined) {
+  const value = binary?.trim() ?? "";
+  if (!value) {
+    throw new LocalOpencodeStartupError(
+      "Failed to start OpenCode: no explicit binary path was provided.",
+      "missing_binary",
+      value,
+      { combined: [], stderr: [], stdout: [], totalLines: 0, truncated: false },
+    );
+  }
+  return value;
+}
+
+function parseReadinessUrl(line: string) {
+  const match = line.match(/https?:\/\/\S+/);
+  return match?.[0] ?? null;
+}
+
+function buildSpawnErrorMessage(binary: string, error: unknown) {
+  const text = error instanceof Error ? error.message : String(error);
+  if (text.includes("ENOENT") || text.includes("executable file not found") || text.includes("No such file")) {
+    return `Failed to start OpenCode: executable not found at ${binary}`;
+  }
+  return `Failed to start OpenCode from ${binary}: ${text}`;
+}
+
+export async function createLocalOpencode(options: CreateLocalOpencodeOptions = {}): Promise<LocalOpencodeHandle> {
+  const binary = normalizeBinary(options.binary);
+  const hostname = options.hostname ?? "127.0.0.1";
+  const port = options.port ?? 4096;
+  const timeoutMs = options.timeout ?? 5_000;
+  let resolveReady: ((url: string) => void) | null = null;
+  const output = createBoundedOutputCollector({
+    maxBytes: 16_384,
+    maxLines: 200,
+    onLine(line) {
+      const readinessUrl = parseReadinessUrl(line.text);
+      if (readinessUrl && /listening/i.test(line.text)) {
+        resolveReady?.(readinessUrl);
+      }
+    },
+  });
+
+  const args = [
+    binary,
+    "serve",
+    `--hostname=${hostname}`,
+    `--port=${port}`,
+  ];
+
+  if (typeof options.config?.logLevel === "string" && options.config.logLevel.trim()) {
+    args.push(`--log-level=${options.config.logLevel.trim()}`);
+  }
+
+  let proc: Bun.Subprocess<"ignore", "pipe", "pipe">;
+  try {
+    proc = Bun.spawn(args, {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        ...options.env,
+        OPENCODE_CONFIG_CONTENT: JSON.stringify(options.config ?? {}),
+      },
+      stderr: "pipe",
+      stdin: "ignore",
+      stdout: "pipe",
+    });
+  } catch (error) {
+    throw new LocalOpencodeStartupError(buildSpawnErrorMessage(binary, error), "spawn_failed", binary, output.snapshot());
+  }
+
+  let settled = false;
+  let timeoutHandle: ReturnType<typeof setTimeout> | null = null;
+  let abortListener: (() => void) | null = null;
+
+  const waitForExit = async (): Promise<LocalProcessExit> => {
+    const code = await proc.exited;
+    return {
+      at: new Date().toISOString(),
+      code,
+      signal: "signalCode" in proc && typeof proc.signalCode === "string" ? proc.signalCode : null,
+    };
+  };
+
+  const pump = async (streamName: "stdout" | "stderr", stream: ReadableStream<Uint8Array> | null) => {
+    if (!stream) {
+      return;
+    }
+
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+          output.finish(streamName);
+          return;
+        }
+        const text = decoder.decode(value, { stream: true });
+        output.pushChunk(streamName, text);
+      }
+    } finally {
+      output.finish(streamName);
+      reader.releaseLock();
+    }
+  };
+
+  const startup = await new Promise<{ client: LocalOpencodeClient; url: string }>((resolve, reject) => {
+    const rejectOnce = (error: LocalOpencodeStartupError) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      if (abortListener && options.signal) {
+        options.signal.removeEventListener("abort", abortListener);
+      }
+      reject(error);
+    };
+
+    const resolveOnce = (url: string) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      if (abortListener && options.signal) {
+        options.signal.removeEventListener("abort", abortListener);
+      }
+      resolve({
+        client: createOpencodeClient({
+          baseUrl: url,
+          directory: options.client?.directory,
+          fetch: options.client?.fetch,
+          headers: options.client?.headers,
+          responseStyle: options.client?.responseStyle ?? "data",
+          throwOnError: options.client?.throwOnError ?? true,
+        }),
+        url,
+      });
+    };
+
+    resolveReady = resolveOnce;
+    void pump("stdout", proc.stdout);
+    void pump("stderr", proc.stderr);
+
+    void waitForExit().then((exit) => {
+      if (settled) {
+        return;
+      }
+
+      const snapshot = output.snapshot();
+      rejectOnce(
+        new LocalOpencodeStartupError(
+          `OpenCode exited before becoming ready (${exit.code === null ? "no exit code" : `exit code ${exit.code}`}).\nCollected output:\n${formatRuntimeOutput(snapshot)}`,
+          "early_exit",
+          binary,
+          snapshot,
+        ),
+      );
+    });
+
+    timeoutHandle = setTimeout(() => {
+      if (settled) {
+        return;
+      }
+
+      proc.kill();
+      const snapshot = output.snapshot();
+      rejectOnce(
+        new LocalOpencodeStartupError(
+          `OpenCode did not become ready within ${timeoutMs}ms.\nCollected output:\n${formatRuntimeOutput(snapshot)}`,
+          "timeout",
+          binary,
+          snapshot,
+        ),
+      );
+    }, timeoutMs);
+
+    if (options.signal) {
+      if (options.signal.aborted) {
+        proc.kill();
+        rejectOnce(
+          new LocalOpencodeStartupError(
+            `OpenCode startup aborted for ${binary}.`,
+            "aborted",
+            binary,
+            output.snapshot(),
+          ),
+        );
+        return;
+      }
+
+      abortListener = () => {
+        proc.kill();
+        rejectOnce(
+          new LocalOpencodeStartupError(
+            `OpenCode startup aborted for ${binary}.`,
+            "aborted",
+            binary,
+            output.snapshot(),
+          ),
+        );
+      };
+      options.signal.addEventListener("abort", abortListener, { once: true });
+    }
+  }).catch((error) => {
+    if (!settled) {
+      proc.kill();
+    }
+
+    if (error instanceof LocalOpencodeStartupError) {
+      throw error;
+    }
+
+    throw new LocalOpencodeStartupError(buildSpawnErrorMessage(binary, error), "spawn_failed", binary, output.snapshot());
+  });
+
+  return {
+    client: startup.client,
+    server: {
+      close() {
+        proc.kill();
+      },
+      getOutput() {
+        return output.snapshot();
+      },
+      proc,
+      url: startup.url,
+      waitForExit,
+    },
+  };
+}
diff --git a/apps/server-v2/src/adapters/process-info.ts b/apps/server-v2/src/adapters/process-info.ts
new file mode 100644
index 0000000000..4d6d69b6e3
--- /dev/null
+++ b/apps/server-v2/src/adapters/process-info.ts
@@ -0,0 +1,21 @@
+import os from "node:os";
+
+export type ProcessInfoAdapter = {
+  environment: string;
+  hostname: string;
+  pid: number;
+  platform: NodeJS.Platform;
+  runtime: "bun";
+  runtimeVersion: string | null;
+};
+
+export function createProcessInfoAdapter(environment: string = process.env.NODE_ENV ?? "development"): ProcessInfoAdapter {
+  return {
+    environment,
+    hostname: os.hostname(),
+    pid: process.pid,
+    platform: process.platform,
+    runtime: "bun",
+    runtimeVersion: globalThis.Bun?.version ?? null,
+  };
+}
diff --git a/apps/server-v2/src/adapters/remote-openwork.ts b/apps/server-v2/src/adapters/remote-openwork.ts
new file mode 100644
index 0000000000..0a72cd2d30
--- /dev/null
+++ b/apps/server-v2/src/adapters/remote-openwork.ts
@@ -0,0 +1,158 @@
+import { HTTPException } from "hono/http-exception";
+import type { ServerRecord, WorkspaceRecord } from "../database/types.js";
+import { RouteError } from "../http.js";
+
+function encodeBasicAuth(username: string, password: string) {
+  return Buffer.from(`${username}:${password}`, "utf8").toString("base64");
+}
+
+function pickString(record: Record<string, unknown> | null | undefined, keys: string[]) {
+  for (const key of keys) {
+    const value = record?.[key];
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return null;
+}
+
+export function buildRemoteOpenworkHeaders(server: ServerRecord) {
+  const auth = server.auth && typeof server.auth === "object" ? server.auth as Record<string, unknown> : null;
+  const headers: Record<string, string> = {
+    Accept: "application/json",
+  };
+  const bearer = pickString(auth, ["openworkClientToken", "openworkToken", "authToken", "token", "bearerToken"]);
+  const hostToken = pickString(auth, ["openworkHostToken", "hostToken"]);
+  const username = pickString(auth, ["username", "user"]);
+  const password = pickString(auth, ["password", "pass"]);
+
+  if (bearer) {
+    headers.Authorization = `Bearer ${bearer}`;
+  } else if (username && password) {
+    headers.Authorization = `Basic ${encodeBasicAuth(username, password)}`;
+  }
+
+  if (hostToken) {
+    headers["X-OpenWork-Host-Token"] = hostToken;
+  }
+
+  return headers;
+}
+
+function normalizeBaseUrl(value: string) {
+  return value.replace(/\/+$/, "");
+}
+
+function unwrapEnvelope<T>(payload: unknown): T {
+  if (payload && typeof payload === "object" && "ok" in (payload as Record<string, unknown>)) {
+    const record = payload as Record<string, unknown>;
+    if (record.ok === true && "data" in record) {
+      return record.data as T;
+    }
+    if (record.ok === false) {
+      const error = record.error && typeof record.error === "object" ? record.error as Record<string, unknown> : {};
+      const code = typeof error.code === "string" ? error.code : "bad_gateway";
+      const message = typeof error.message === "string" ? error.message : "Remote OpenWork request failed.";
+      throw new RouteError(502, code as any, message);
+    }
+  }
+  return payload as T;
+}
+
+export function resolveRemoteWorkspaceTarget(server: ServerRecord, workspace: WorkspaceRecord) {
+  const serverBaseUrl = server.baseUrl?.trim();
+  if (!serverBaseUrl) {
+    throw new RouteError(502, "bad_gateway", `Remote server ${server.id} is missing a base URL.`);
+  }
+  const remoteWorkspaceId = workspace.remoteWorkspaceId?.trim();
+  if (!remoteWorkspaceId) {
+    throw new RouteError(502, "bad_gateway", `Remote workspace ${workspace.id} is missing a remote workspace identifier.`);
+  }
+  return {
+    remoteWorkspaceId,
+    serverBaseUrl: normalizeBaseUrl(serverBaseUrl),
+  };
+}
+
+export async function requestRemoteOpenwork<T>(input: {
+  body?: unknown;
+  method?: string;
+  path: string;
+  server: ServerRecord;
+  timeoutMs?: number;
+}): Promise<T> {
+  const baseUrl = input.server.baseUrl?.trim();
+  if (!baseUrl) {
+    throw new RouteError(502, "bad_gateway", `Remote server ${input.server.id} is missing a base URL.`);
+  }
+
+  const response = await fetch(`${normalizeBaseUrl(baseUrl)}${input.path}`, {
+    body: input.body === undefined ? undefined : JSON.stringify(input.body),
+    headers: {
+      ...buildRemoteOpenworkHeaders(input.server),
+      ...(input.body === undefined ? {} : { "Content-Type": "application/json" }),
+    },
+    method: input.method ?? (input.body === undefined ? "GET" : "POST"),
+    signal: AbortSignal.timeout(input.timeoutMs ?? 10_000),
+  });
+
+  const text = await response.text();
+  const payload = text.trim() ? JSON.parse(text) : null;
+
+  if (response.status === 404) {
+    throw new HTTPException(404, { message: typeof (payload as any)?.message === "string" ? (payload as any).message : "Remote resource not found." });
+  }
+  if (response.status === 401) {
+    throw new RouteError(502, "bad_gateway", "Remote OpenWork server rejected the stored credentials.");
+  }
+  if (response.status === 403) {
+    throw new RouteError(502, "bad_gateway", "Remote OpenWork server rejected the stored permissions.");
+  }
+  if (!response.ok) {
+    const message = typeof (payload as any)?.error?.message === "string"
+      ? (payload as any).error.message
+      : typeof (payload as any)?.message === "string"
+        ? (payload as any).message
+        : `Remote OpenWork request failed with status ${response.status}.`;
+    throw new RouteError(502, "bad_gateway", message);
+  }
+
+  return unwrapEnvelope<T>(payload);
+}
+
+export async function requestRemoteOpenworkRaw(input: {
+  body?: BodyInit | null;
+  contentType?: string | null;
+  method?: string;
+  path: string;
+  server: ServerRecord;
+  timeoutMs?: number;
+}) {
+  const baseUrl = input.server.baseUrl?.trim();
+  if (!baseUrl) {
+    throw new RouteError(502, "bad_gateway", `Remote server ${input.server.id} is missing a base URL.`);
+  }
+
+  const response = await fetch(`${normalizeBaseUrl(baseUrl)}${input.path}`, {
+    body: input.body ?? undefined,
+    headers: {
+      ...buildRemoteOpenworkHeaders(input.server),
+      ...(input.contentType ? { "Content-Type": input.contentType } : {}),
+    },
+    method: input.method ?? (input.body ? "POST" : "GET"),
+    signal: AbortSignal.timeout(input.timeoutMs ?? 15_000),
+  });
+
+  if (response.status === 404) {
+    throw new HTTPException(404, { message: "Remote resource not found." });
+  }
+  if (response.status === 401 || response.status === 403) {
+    throw new RouteError(502, "bad_gateway", "Remote OpenWork server rejected the stored credentials.");
+  }
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new RouteError(502, "bad_gateway", text.trim() || `Remote OpenWork request failed with status ${response.status}.`);
+  }
+
+  return response;
+}
diff --git a/apps/server-v2/src/adapters/sessions/local-opencode.ts b/apps/server-v2/src/adapters/sessions/local-opencode.ts
new file mode 100644
index 0000000000..70b11ec54e
--- /dev/null
+++ b/apps/server-v2/src/adapters/sessions/local-opencode.ts
@@ -0,0 +1,23 @@
+import { RouteError } from "../../http.js";
+import type { RuntimeService } from "../../services/runtime-service.js";
+import type { WorkspaceRecord } from "../../database/types.js";
+import { createOpenCodeSessionBackend } from "./opencode-backend.js";
+
+export function createLocalOpencodeSessionAdapter(input: {
+  runtime: RuntimeService;
+  workspace: WorkspaceRecord;
+}) {
+  const runtimeHealth = input.runtime.getOpencodeHealth();
+  if (!runtimeHealth.baseUrl || !runtimeHealth.running) {
+    throw new RouteError(
+      503,
+      "service_unavailable",
+      "Local OpenCode runtime is not available for session operations.",
+    );
+  }
+
+  return createOpenCodeSessionBackend({
+    baseUrl: runtimeHealth.baseUrl,
+    directory: input.workspace.dataDir,
+  });
+}
diff --git a/apps/server-v2/src/adapters/sessions/opencode-backend.ts b/apps/server-v2/src/adapters/sessions/opencode-backend.ts
new file mode 100644
index 0000000000..7ddf86be90
--- /dev/null
+++ b/apps/server-v2/src/adapters/sessions/opencode-backend.ts
@@ -0,0 +1,293 @@
+import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
+import type {
+  SessionMessageRecord,
+  SessionRecord,
+  SessionSnapshotRecord,
+  SessionStatusRecord,
+  SessionTodoRecord,
+  WorkspaceEventRecord,
+} from "../../schemas/sessions.js";
+import {
+  parseSessionData,
+  parseSessionListData,
+  parseSessionMessageData,
+  parseSessionMessagesData,
+  parseSessionStatusesData,
+  parseSessionTodosData,
+  parseWorkspaceEventData,
+} from "../../schemas/sessions.js";
+
+export class OpenCodeBackendError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+    message: string,
+    readonly details?: unknown,
+  ) {
+    super(message);
+    this.name = "OpenCodeBackendError";
+  }
+}
+
+type OpenCodeBackendOptions = {
+  baseUrl: string;
+  directory?: string | null;
+  headers?: Record<string, string>;
+};
+
+type RequestOptions = {
+  body?: unknown;
+  method?: string;
+  query?: Record<string, string | number | boolean | undefined>;
+  signal?: AbortSignal;
+};
+
+function buildDirectoryHeader(directory?: string | null) {
+  const trimmed = directory?.trim() ?? "";
+  if (!trimmed) {
+    return null;
+  }
+  return /[^\x00-\x7F]/.test(trimmed) ? encodeURIComponent(trimmed) : trimmed;
+}
+
+function buildUrl(baseUrl: string, path: string, query?: RequestOptions["query"]) {
+  const url = new URL(path, `${baseUrl.replace(/\/+$/, "")}/`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value === undefined) {
+      continue;
+    }
+    url.searchParams.set(key, String(value));
+  }
+  return url;
+}
+
+async function parseJsonResponse(response: Response) {
+  const text = await response.text();
+  if (!text.trim()) {
+    return null;
+  }
+  try {
+    return JSON.parse(text) as unknown;
+  } catch {
+    return text;
+  }
+}
+
+function toBackendError(response: Response, payload: unknown) {
+  const record = payload && typeof payload === "object" ? payload as Record<string, unknown> : null;
+  const code = typeof record?.code === "string" ? record.code : "opencode_request_failed";
+  const message = typeof record?.message === "string" ? record.message : response.statusText || "OpenCode request failed.";
+  const details = record?.details;
+  return new OpenCodeBackendError(response.status, code, message, details);
+}
+
+export type OpenCodeSessionBackend = ReturnType<typeof createOpenCodeSessionBackend>;
+
+export function createOpenCodeSessionBackend(options: OpenCodeBackendOptions) {
+  const normalizedBaseUrl = options.baseUrl.replace(/\/+$/, "");
+  const baseHeaders = { ...(options.headers ?? {}) };
+  const directoryHeader = buildDirectoryHeader(options.directory);
+  if (directoryHeader) {
+    baseHeaders["x-opencode-directory"] = directoryHeader;
+  }
+
+  const eventClient = createOpencodeClient({
+    baseUrl: normalizedBaseUrl,
+    directory: options.directory ?? undefined,
+    headers: Object.keys(baseHeaders).length ? baseHeaders : undefined,
+    responseStyle: "data",
+    throwOnError: true,
+  });
+
+  async function requestJson(path: string, request: RequestOptions = {}) {
+    const url = buildUrl(normalizedBaseUrl, path, request.query);
+    const response = await fetch(url, {
+      method: request.method ?? "GET",
+      headers: {
+        ...(request.body !== undefined ? { "Content-Type": "application/json" } : {}),
+        ...baseHeaders,
+      },
+      body: request.body !== undefined ? JSON.stringify(request.body) : undefined,
+      signal: request.signal,
+    });
+
+    const payload = await parseJsonResponse(response);
+    if (!response.ok) {
+      throw toBackendError(response, payload);
+    }
+    return payload;
+  }
+
+  async function requestVoid(path: string, request: RequestOptions = {}) {
+    const url = buildUrl(normalizedBaseUrl, path, request.query);
+    const response = await fetch(url, {
+      method: request.method ?? "POST",
+      headers: {
+        ...(request.body !== undefined ? { "Content-Type": "application/json" } : {}),
+        ...baseHeaders,
+      },
+      body: request.body !== undefined ? JSON.stringify(request.body) : undefined,
+      signal: request.signal,
+    });
+
+    if (!response.ok) {
+      throw toBackendError(response, await parseJsonResponse(response));
+    }
+  }
+
+  return {
+    async abortSession(sessionId: string) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/abort`, { method: "POST" });
+    },
+
+    async command(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/command`, { body, method: "POST" });
+    },
+
+    async createSession(body: Record<string, unknown>) {
+      return parseSessionData(await requestJson("/session", { body, method: "POST" }));
+    },
+
+    async deleteMessage(sessionId: string, messageId: string) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}`, {
+        method: "DELETE",
+      });
+    },
+
+    async deleteMessagePart(sessionId: string, messageId: string, partId: string) {
+      await requestVoid(
+        `/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}/part/${encodeURIComponent(partId)}`,
+        { method: "DELETE" },
+      );
+    },
+
+    async deleteSession(sessionId: string) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
+    },
+
+    async forkSession(sessionId: string, body: Record<string, unknown>) {
+      return parseSessionData(await requestJson(`/session/${encodeURIComponent(sessionId)}/fork`, { body, method: "POST" }));
+    },
+
+    async getMessage(sessionId: string, messageId: string) {
+      return parseSessionMessageData(
+        await requestJson(`/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}`),
+      );
+    },
+
+    async getSession(sessionId: string) {
+      return parseSessionData(await requestJson(`/session/${encodeURIComponent(sessionId)}`));
+    },
+
+    async getSessionSnapshot(sessionId: string, input?: { limit?: number }) {
+      const [session, messages, todos, statuses] = await Promise.all([
+        this.getSession(sessionId),
+        this.listMessages(sessionId, input),
+        this.listTodos(sessionId),
+        this.listStatuses(),
+      ]);
+
+      return {
+        messages,
+        session,
+        status: statuses[sessionId] ?? { type: "idle" },
+        todos,
+      } satisfies SessionSnapshotRecord;
+    },
+
+    async initSession(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/init`, { body, method: "POST" });
+    },
+
+    async listMessages(sessionId: string, input?: { limit?: number }) {
+      return parseSessionMessagesData(
+        await requestJson(`/session/${encodeURIComponent(sessionId)}/message`, {
+          query: { limit: input?.limit },
+        }),
+      );
+    },
+
+    async listSessions(input?: { limit?: number; roots?: boolean; search?: string; start?: number }) {
+      return parseSessionListData(await requestJson("/session", { query: input }));
+    },
+
+    async listStatuses() {
+      return parseSessionStatusesData(await requestJson("/session/status"));
+    },
+
+    async listTodos(sessionId: string) {
+      return parseSessionTodosData(await requestJson(`/session/${encodeURIComponent(sessionId)}/todo`));
+    },
+
+    async promptAsync(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/prompt_async`, { body, method: "POST" });
+    },
+
+    async revert(sessionId: string, body: { messageID: string }) {
+      return parseSessionData(await requestJson(`/session/${encodeURIComponent(sessionId)}/revert`, { body, method: "POST" }));
+    },
+
+    async sendMessage(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/message`, { body, method: "POST" });
+    },
+
+    async shareSession(sessionId: string) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/share`, { method: "POST" });
+    },
+
+    async shell(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/shell`, { body, method: "POST" });
+    },
+
+    async streamEvents(signal?: AbortSignal): Promise<AsyncIterable<WorkspaceEventRecord>> {
+      const subscription = await eventClient.event.subscribe(undefined, { signal });
+      const source = subscription.stream as AsyncIterable<unknown>;
+      const iterator = async function* () {
+        for await (const event of source) {
+          if (!event || typeof event !== "object") {
+            continue;
+          }
+
+          const record = event as Record<string, unknown>;
+          if (typeof record.type === "string") {
+            yield parseWorkspaceEventData({
+              properties: record.properties,
+              type: record.type,
+            });
+            continue;
+          }
+
+          const payload = record.payload;
+          if (payload && typeof payload === "object" && typeof (payload as Record<string, unknown>).type === "string") {
+            yield parseWorkspaceEventData(payload);
+          }
+        }
+      };
+
+      return iterator();
+    },
+
+    async summarizeSession(sessionId: string, body: Record<string, unknown>) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/summarize`, { body, method: "POST" });
+    },
+
+    async unshareSession(sessionId: string) {
+      await requestVoid(`/session/${encodeURIComponent(sessionId)}/share`, { method: "DELETE" });
+    },
+
+    async unrevert(sessionId: string) {
+      return parseSessionData(await requestJson(`/session/${encodeURIComponent(sessionId)}/unrevert`, { method: "POST" }));
+    },
+
+    async updateMessagePart(sessionId: string, messageId: string, partId: string, body: Record<string, unknown>) {
+      await requestVoid(
+        `/session/${encodeURIComponent(sessionId)}/message/${encodeURIComponent(messageId)}/part/${encodeURIComponent(partId)}`,
+        { body, method: "PATCH" },
+      );
+    },
+
+    async updateSession(sessionId: string, body: Record<string, unknown>) {
+      return parseSessionData(await requestJson(`/session/${encodeURIComponent(sessionId)}`, { body, method: "PATCH" }));
+    },
+  };
+}
diff --git a/apps/server-v2/src/adapters/sessions/remote-openwork.ts b/apps/server-v2/src/adapters/sessions/remote-openwork.ts
new file mode 100644
index 0000000000..1ad6452fbe
--- /dev/null
+++ b/apps/server-v2/src/adapters/sessions/remote-openwork.ts
@@ -0,0 +1,33 @@
+import { RouteError } from "../../http.js";
+import type { ServerRecord, WorkspaceRecord } from "../../database/types.js";
+import { createOpenCodeSessionBackend } from "./opencode-backend.js";
+import { buildRemoteOpenworkHeaders } from "../remote-openwork.js";
+
+export function createRemoteOpenworkSessionAdapter(input: {
+  server: ServerRecord;
+  workspace: WorkspaceRecord;
+}) {
+  if (!input.server.baseUrl) {
+    throw new RouteError(502, "bad_gateway", "Remote workspace server is missing a base URL.");
+  }
+
+  const remoteType = input.workspace.notes?.remoteType === "opencode" ? "opencode" : "openwork";
+  const remoteWorkspaceId = input.workspace.remoteWorkspaceId?.trim() ?? "";
+
+  if (remoteType === "openwork") {
+    if (!remoteWorkspaceId) {
+      throw new RouteError(502, "bad_gateway", "Remote OpenWork workspace is missing its remote workspace identifier.");
+    }
+
+    return createOpenCodeSessionBackend({
+      baseUrl: `${input.server.baseUrl.replace(/\/+$/, "")}/w/${encodeURIComponent(remoteWorkspaceId)}/opencode`,
+      headers: buildRemoteOpenworkHeaders(input.server),
+    });
+  }
+
+  return createOpenCodeSessionBackend({
+    baseUrl: input.server.baseUrl,
+    directory: typeof input.workspace.notes?.directory === "string" ? input.workspace.notes.directory : undefined,
+    headers: buildRemoteOpenworkHeaders(input.server),
+  });
+}
diff --git a/apps/server-v2/src/app-factory.ts b/apps/server-v2/src/app-factory.ts
new file mode 100644
index 0000000000..da78b8ef1f
--- /dev/null
+++ b/apps/server-v2/src/app-factory.ts
@@ -0,0 +1,44 @@
+import { Hono } from "hono";
+import type { AppDependencies } from "./context/app-dependencies.js";
+import { createAppDependencies } from "./context/app-dependencies.js";
+import type { AppBindings } from "./context/request-context.js";
+import { requestContextMiddleware } from "./context/request-context.js";
+import { buildErrorResponse } from "./http.js";
+import { errorHandlingMiddleware } from "./middleware/error-handler.js";
+import { requestLoggerMiddleware } from "./middleware/request-logger.js";
+import { requestIdMiddleware } from "./middleware/request-id.js";
+import { responseFinalizerMiddleware } from "./middleware/response-finalizer.js";
+import { registerRoutes } from "./routes/index.js";
+
+export type CreateAppOptions = {
+  dependencies?: AppDependencies;
+};
+
+export function createApp(options: CreateAppOptions = {}) {
+  const dependencies = options.dependencies ?? createAppDependencies();
+  const app = new Hono<AppBindings>();
+
+  app.use("*", requestIdMiddleware);
+  app.use("*", requestContextMiddleware(dependencies));
+  app.use("*", responseFinalizerMiddleware);
+  app.use("*", requestLoggerMiddleware);
+  app.use("*", errorHandlingMiddleware);
+
+  registerRoutes(app, dependencies);
+
+  app.notFound((c) => {
+    const requestId = c.get("requestId");
+    return c.json(
+      buildErrorResponse({
+        requestId,
+        code: "not_found",
+        message: `Route not found: ${new URL(c.req.url).pathname}`,
+      }),
+      404,
+    );
+  });
+
+  return app;
+}
+
+export type AppType = ReturnType<typeof createApp>;
diff --git a/apps/server-v2/src/app.test.ts b/apps/server-v2/src/app.test.ts
new file mode 100644
index 0000000000..8bf663bdf2
--- /dev/null
+++ b/apps/server-v2/src/app.test.ts
@@ -0,0 +1,338 @@
+import { afterEach, expect, test } from "bun:test";
+import { createApp } from "./app.js";
+import { createAppDependencies } from "./context/app-dependencies.js";
+
+afterEach(() => {
+  delete process.env.OPENWORK_TOKEN;
+  delete process.env.OPENWORK_HOST_TOKEN;
+});
+
+function createTestApp(options?: { requireAuth?: boolean; seedRegistry?: boolean }) {
+  if (options?.requireAuth) {
+    process.env.OPENWORK_TOKEN = "client-token";
+    process.env.OPENWORK_HOST_TOKEN = "host-token";
+  }
+
+  const dependencies = createAppDependencies({
+    environment: "test",
+    inMemory: true,
+    legacy: {
+      desktopDataDir: `/tmp/openwork-server-v2-test-desktop-${Math.random().toString(16).slice(2)}`,
+      orchestratorDataDir: `/tmp/openwork-server-v2-test-orchestrator-${Math.random().toString(16).slice(2)}`,
+    },
+    runtime: {
+      bootstrapPolicy: "disabled",
+    },
+    startedAt: new Date("2026-04-14T00:00:00.000Z"),
+    version: "0.0.0-test",
+  });
+
+  if (options?.seedRegistry) {
+    dependencies.persistence.registry.importLocalWorkspace({
+      dataDir: "/tmp/openwork-phase5-local",
+      displayName: "Alpha Local",
+      status: "ready",
+    });
+    dependencies.persistence.registry.importRemoteWorkspace({
+      baseUrl: "https://remote.example.com/w/alpha",
+      directory: "/srv/remote-alpha",
+      displayName: "Remote Alpha",
+      legacyNotes: {
+        source: "test",
+      },
+      remoteType: "openwork",
+      remoteWorkspaceId: "alpha",
+      serverAuth: { openworkToken: "secret" },
+      serverBaseUrl: "https://remote.example.com",
+      serverHostingKind: "self_hosted",
+      serverLabel: "remote.example.com",
+      workspaceStatus: "ready",
+    });
+  }
+
+  return {
+    app: createApp({ dependencies }),
+    dependencies,
+  };
+}
+
+test("root info uses the shared success envelope and route conventions", async () => {
+  const { app } = createTestApp();
+  const response = await app.request("http://openwork.local/");
+  const body = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(response.headers.get("x-request-id")).toBe(body.meta.requestId);
+  expect(body).toMatchObject({
+    ok: true,
+    data: {
+      service: "openwork-server-v2",
+      routes: {
+        system: "/system",
+        workspaces: "/workspaces",
+        workspaceResource: "/workspaces/:workspaceId",
+      },
+      contract: {
+        source: "hono-openapi",
+        sdkPackage: "@openwork/server-sdk",
+      },
+    },
+  });
+});
+
+test("system health returns a consistent envelope", async () => {
+  const { app } = createTestApp();
+  const response = await app.request("http://openwork.local/system/health");
+  const body = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(body.ok).toBe(true);
+  expect(body.data.status).toBe("ok");
+  expect(body.data.database.kind).toBe("sqlite");
+  expect(["ready", "warning"]).toContain(body.data.database.status);
+});
+
+test("system metadata includes phase 10 registry, runtime, and cutover state", async () => {
+  const { app } = createTestApp();
+  const response = await app.request("http://openwork.local/system/meta");
+  const body = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(body.data.foundation.phase).toBe(10);
+  expect(body.data.foundation.startup.registry.localServerId).toBe("srv_local");
+  expect(body.data.foundation.startup.registry.hiddenWorkspaceIds).toHaveLength(2);
+  expect(body.data.runtimeSupervisor.bootstrapPolicy).toBe("disabled");
+});
+
+test("openapi route is generated from the live Hono app", async () => {
+  const { app } = createTestApp();
+  const response = await app.request("http://openwork.local/openapi.json");
+  const document = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(document.openapi).toBe("3.1.0");
+  expect(document.info.title).toBe("OpenWork Server V2");
+  expect(document.paths["/system/health"].get.operationId).toBe("getSystemHealth");
+  expect(document.paths["/system/meta"].get.operationId).toBe("getSystemMeta");
+  expect(document.paths["/system/capabilities"].get.operationId).toBe("getSystemCapabilities");
+  expect(document.paths["/system/status"].get.operationId).toBe("getSystemStatus");
+  expect(document.paths["/system/opencode/health"].get.operationId).toBe("getSystemOpencodeHealth");
+  expect(document.paths["/system/runtime/versions"].get.operationId).toBe("getSystemRuntimeVersions");
+  expect(document.paths["/system/runtime/upgrade"].post.operationId).toBe("postSystemRuntimeUpgrade");
+  expect(document.paths["/system/servers/connect"].post.operationId).toBe("postSystemServersConnect");
+  expect(document.paths["/workspaces"].get.operationId).toBe("getWorkspaces");
+  expect(document.paths["/workspaces/local"].post.operationId).toBe("postWorkspacesLocal");
+  expect(document.paths["/workspaces/{workspaceId}/config"].get.operationId).toBe("getWorkspacesByWorkspaceIdConfig");
+  expect(document.paths["/system/cloud-signin"].get.operationId).toBe("getSystemCloudSignin");
+  expect(document.paths["/system/managed/mcps"].get.operationId).toBe("getSystemManagedMcps");
+  expect(document.paths["/system/router/identities/telegram"].get.operationId).toBe("getSystemRouterIdentitiesTelegram");
+  expect(document.paths["/workspaces/{workspaceId}/export"].get.operationId).toBe("getWorkspacesByWorkspaceIdExport");
+  expect(document.paths["/workspaces/{workspaceId}/reload-events"].get.operationId).toBe("getWorkspacesByWorkspaceIdReloadEvents");
+  expect(document.paths["/workspaces/{workspaceId}/sessions"].get.operationId).toBe("getWorkspacesByWorkspaceIdSessions");
+  expect(document.paths["/workspaces/{workspaceId}/events"].get.operationId).toBe("getWorkspacesByWorkspaceIdEvents");
+});
+
+test("runtime routes expose the initial server-owned status surfaces", async () => {
+  const { app } = createTestApp();
+
+  const [opencodeResponse, routerResponse, runtimeResponse] = await Promise.all([
+    app.request("http://openwork.local/system/opencode/health"),
+    app.request("http://openwork.local/system/router/health"),
+    app.request("http://openwork.local/system/runtime/summary"),
+  ]);
+
+  const opencodeBody = await opencodeResponse.json();
+  const routerBody = await routerResponse.json();
+  const runtimeBody = await runtimeResponse.json();
+
+  expect(opencodeResponse.status).toBe(200);
+  expect(opencodeBody.data.status).toBe("disabled");
+  expect(routerBody.data.status).toBe("disabled");
+  expect(runtimeBody.data.bootstrapPolicy).toBe("disabled");
+});
+
+test("not found routes use the shared error envelope", async () => {
+  const { app } = createTestApp();
+  const response = await app.request("http://openwork.local/nope");
+  const body = await response.json();
+
+  expect(response.status).toBe(404);
+  expect(response.headers.get("x-request-id")).toBe(body.error.requestId);
+  expect(body).toMatchObject({
+    ok: false,
+    error: {
+      code: "not_found",
+    },
+  });
+});
+
+test("system status reports registry summary and capabilities", async () => {
+  const { app } = createTestApp({ seedRegistry: true });
+  const response = await app.request("http://openwork.local/system/status");
+  const body = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(body.data.registry).toMatchObject({
+    hiddenWorkspaceCount: 2,
+    remoteServerCount: 1,
+    totalServers: 2,
+    visibleWorkspaceCount: 2,
+  });
+  expect(body.data.capabilities.transport.v2).toBe(true);
+  expect(body.data.capabilities.registry.remoteServerConnections).toBe(true);
+  expect(body.data.auth.required).toBe(false);
+});
+
+test("workspace list excludes hidden workspaces by default", async () => {
+  const { app } = createTestApp({ seedRegistry: true });
+  const response = await app.request("http://openwork.local/workspaces");
+  const body = await response.json();
+
+  expect(response.status).toBe(200);
+  expect(body.data.items).toHaveLength(2);
+  expect(body.data.items.map((item: any) => item.displayName).sort()).toEqual(["Alpha Local", "Remote Alpha"]);
+  expect(body.data.items.find((item: any) => item.displayName === "Remote Alpha")?.backend.kind).toBe("remote_openwork");
+});
+
+test("workspace detail hides internal workspaces from non-host readers", async () => {
+  const { app, dependencies } = createTestApp({ requireAuth: true, seedRegistry: true });
+  const hiddenWorkspaceId = dependencies.persistence.registry.ensureHiddenWorkspace("control").id;
+
+  const clientResponse = await app.request(`http://openwork.local/workspaces/${hiddenWorkspaceId}`, {
+    headers: {
+      Authorization: "Bearer client-token",
+    },
+  });
+  const hostResponse = await app.request(`http://openwork.local/workspaces/${hiddenWorkspaceId}`, {
+    headers: {
+      "X-OpenWork-Host-Token": "host-token",
+    },
+  });
+
+  expect(clientResponse.status).toBe(404);
+  expect(hostResponse.status).toBe(200);
+});
+
+test("auth-protected registry reads require client or host scope", async () => {
+  const { app } = createTestApp({ requireAuth: true, seedRegistry: true });
+
+  const anonymous = await app.request("http://openwork.local/workspaces");
+  const client = await app.request("http://openwork.local/workspaces", {
+    headers: {
+      Authorization: "Bearer client-token",
+    },
+  });
+  const clientHidden = await app.request("http://openwork.local/workspaces?includeHidden=true", {
+    headers: {
+      Authorization: "Bearer client-token",
+    },
+  });
+  const hostInventory = await app.request("http://openwork.local/system/servers", {
+    headers: {
+      "X-OpenWork-Host-Token": "host-token",
+    },
+  });
+
+  expect(anonymous.status).toBe(401);
+  expect(client.status).toBe(200);
+  expect(clientHidden.status).toBe(403);
+  expect(hostInventory.status).toBe(200);
+});
+
+test("host-scoped remote server connect syncs remote workspaces into the local registry", async () => {
+  const remote = Bun.serve({
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname === "/workspaces") {
+        return Response.json({
+          ok: true,
+          data: {
+            items: [
+              {
+                backend: {
+                  kind: "local_opencode",
+                  local: { configDir: "/srv/config", dataDir: "/srv/project-alpha", opencodeProjectId: null },
+                  remote: null,
+                  serverId: "srv_local",
+                },
+                createdAt: new Date().toISOString(),
+                displayName: "Remote Project Alpha",
+                hidden: false,
+                id: "remote-alpha",
+                kind: "local",
+                notes: null,
+                preset: "starter",
+                runtime: { backendKind: "local_opencode", health: null, lastError: null, lastSessionRefreshAt: null, lastSyncAt: null, updatedAt: null },
+                server: { auth: { configured: false, scheme: "none" }, baseUrl: null, capabilities: {}, hostingKind: "self_hosted", id: "srv_local", isEnabled: true, isLocal: true, kind: "local", label: "Remote", lastSeenAt: null, source: "seeded", updatedAt: new Date().toISOString() },
+                slug: "remote-project-alpha",
+                status: "ready",
+                updatedAt: new Date().toISOString(),
+              },
+            ],
+          },
+          meta: { requestId: "owreq_remote_1", timestamp: new Date().toISOString() },
+        });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+
+  try {
+    const { app } = createTestApp({ requireAuth: true });
+    const response = await app.request("http://openwork.local/system/servers/connect", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-OpenWork-Host-Token": "host-token",
+      },
+      body: JSON.stringify({
+        baseUrl: `http://127.0.0.1:${remote.port}`,
+        token: "remote-token",
+        workspaceId: "remote-alpha",
+      }),
+    });
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.data.server.kind).toBe("remote");
+    expect(body.data.selectedWorkspaceId).toMatch(/^ws_/);
+    expect(body.data.workspaces[0].backend.kind).toBe("remote_openwork");
+    expect(body.data.workspaces[0].backend.remote.remoteWorkspaceId).toBe("remote-alpha");
+  } finally {
+    remote.stop(true);
+  }
+});
+
+test("remote server connect returns a gateway error when the remote server rejects credentials", async () => {
+  const remote = Bun.serve({
+    fetch() {
+      return Response.json({ ok: false, error: { code: "unauthorized", message: "bad token", requestId: "owreq_remote_bad_auth" } }, { status: 401 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+
+  try {
+    const { app } = createTestApp({ requireAuth: true });
+    const response = await app.request("http://openwork.local/system/servers/connect", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-OpenWork-Host-Token": "host-token",
+      },
+      body: JSON.stringify({
+        baseUrl: `http://127.0.0.1:${remote.port}`,
+        token: "wrong-token",
+      }),
+    });
+    const body = await response.json();
+
+    expect(response.status).toBe(502);
+    expect(body.ok).toBe(false);
+    expect(body.error.code).toBe("bad_gateway");
+  } finally {
+    remote.stop(true);
+  }
+});
diff --git a/apps/server-v2/src/app.ts b/apps/server-v2/src/app.ts
new file mode 100644
index 0000000000..011250d589
--- /dev/null
+++ b/apps/server-v2/src/app.ts
@@ -0,0 +1,4 @@
+export { createApp, type AppType, type CreateAppOptions } from "./app-factory.js";
+import { createApp } from "./app-factory.js";
+
+export const app = createApp();
diff --git a/apps/server-v2/src/bootstrap/server.ts b/apps/server-v2/src/bootstrap/server.ts
new file mode 100644
index 0000000000..e661f2be04
--- /dev/null
+++ b/apps/server-v2/src/bootstrap/server.ts
@@ -0,0 +1,83 @@
+import { createApp } from "../app.js";
+import { createAppDependencies, type AppDependencies } from "../context/app-dependencies.js";
+import { resolveServerV2Version } from "../version.js";
+
+export type StartServerOptions = {
+  dependencies?: AppDependencies;
+  host?: string;
+  port?: number;
+  silent?: boolean;
+};
+
+export type StartedServer = {
+  app: ReturnType<typeof createApp>;
+  dependencies: AppDependencies;
+  host: string;
+  port: number;
+  server: Bun.Server<unknown>;
+  stop(): Promise<void>;
+  url: string;
+};
+
+function resolvePort(value: number | undefined) {
+  if (value === undefined) {
+    return 3100;
+  }
+
+  if (!Number.isInteger(value) || value < 0 || value > 65535) {
+    throw new Error(`Invalid port: ${value}`);
+  }
+
+  return value;
+}
+
+export function startServer(options: StartServerOptions = {}): StartedServer {
+  const host = options.host ?? process.env.OPENWORK_SERVER_V2_HOST ?? "127.0.0.1";
+  const port = resolvePort(options.port ?? Number.parseInt(process.env.OPENWORK_SERVER_V2_PORT ?? "3100", 10));
+  const version = resolveServerV2Version();
+  const dependencies = options.dependencies ?? createAppDependencies({
+    localServer: {
+      baseUrl: port === 0 ? null : `http://${host}:${port}`,
+      hostingKind: process.env.OPENWORK_SERVER_V2_HOSTING_KIND === "desktop" ? "desktop" : "self_hosted",
+      label: "Local OpenWork Server",
+    },
+    version,
+  });
+  const app = createApp({ dependencies });
+  const server = Bun.serve({
+    fetch: app.fetch,
+    hostname: host,
+    port,
+  });
+  const url = server.url.toString();
+  const resolvedPort = new URL(url).port;
+  dependencies.services.registry.attachLocalServerBaseUrl(url);
+  if (dependencies.services.runtime.getBootstrapPolicy() === "eager") {
+    void dependencies.services.runtime.bootstrap().catch(() => undefined);
+  }
+
+  if (!options.silent) {
+    console.info(
+      JSON.stringify({
+        bootstrap: dependencies.database.getStartupDiagnostics(),
+        host,
+        port: Number(resolvedPort || port),
+        scope: "openwork-server-v2.start",
+        url,
+      }),
+    );
+  }
+
+  return {
+    app,
+    dependencies,
+    host,
+    port: Number(resolvedPort || port),
+    server,
+    async stop() {
+      server.stop(true);
+      await dependencies.close();
+    },
+    url,
+  };
+}
diff --git a/apps/server-v2/src/cli.ts b/apps/server-v2/src/cli.ts
new file mode 100644
index 0000000000..80b2e8ee73
--- /dev/null
+++ b/apps/server-v2/src/cli.ts
@@ -0,0 +1,72 @@
+import process from "node:process";
+import { startServer } from "./bootstrap/server.js";
+
+function printHelp() {
+  process.stdout.write([
+    "openwork-server-v2",
+    "",
+    "Options:",
+    "  --host <host>   Hostname to bind. Defaults to 127.0.0.1.",
+    "  --port <port>   Port to bind. Defaults to 3100.",
+    "  --help          Show this help text.",
+    "",
+  ].join("\n"));
+}
+
+function parseArgs(argv: Array<string>) {
+  let host: string | undefined;
+  let port: number | undefined;
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+
+    if (argument === "--help") {
+      printHelp();
+      process.exit(0);
+    }
+
+    if (argument === "--host") {
+      host = argv[index + 1];
+      index += 1;
+      continue;
+    }
+
+    if (argument === "--port") {
+      const rawPort = argv[index + 1];
+      if (!rawPort) {
+        throw new Error("Missing value for --port.");
+      }
+      port = Number.parseInt(rawPort, 10);
+      index += 1;
+      continue;
+    }
+
+    throw new Error(`Unknown argument: ${argument}`);
+  }
+
+  return { host, port };
+}
+
+async function main() {
+  const { host, port } = parseArgs(process.argv.slice(2));
+  const runtime = startServer({ host, port });
+
+  const shutdown = async (signal: NodeJS.Signals) => {
+    console.info(JSON.stringify({ scope: "openwork-server-v2.stop", signal }));
+    await runtime.stop();
+    process.exit(0);
+  };
+
+  for (const signal of ["SIGINT", "SIGTERM"] as const) {
+    process.on(signal, () => {
+      void shutdown(signal);
+    });
+  }
+
+  await new Promise(() => undefined);
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+  process.exit(1);
+});
diff --git a/apps/server-v2/src/context/app-dependencies.ts b/apps/server-v2/src/context/app-dependencies.ts
new file mode 100644
index 0000000000..0ceb1d9de2
--- /dev/null
+++ b/apps/server-v2/src/context/app-dependencies.ts
@@ -0,0 +1,207 @@
+import { createAuthService, type AuthService } from "../services/auth-service.js";
+import { createCapabilitiesService, type CapabilitiesService } from "../services/capabilities-service.js";
+import { createConfigMaterializationService, type ConfigMaterializationService } from "../services/config-materialization-service.js";
+import { createManagedResourceService, type ManagedResourceService } from "../services/managed-resource-service.js";
+import { createProcessInfoAdapter, type ProcessInfoAdapter } from "../adapters/process-info.js";
+import { createServerPersistence, type ServerPersistence } from "../database/persistence.js";
+import { createSqliteDatabaseStatusProvider, type DatabaseStatusProvider } from "../database/status-provider.js";
+import type { RuntimeAssetService } from "../runtime/assets.js";
+import type { RegistryService } from "../services/registry-service.js";
+import { createRouterProductService, type RouterProductService } from "../services/router-product-service.js";
+import { createServerRegistryService, type ServerRegistryService } from "../services/server-registry-service.js";
+import { createRuntimeService, type RuntimeService } from "../services/runtime-service.js";
+import { createWorkspaceFileService, type WorkspaceFileService } from "../services/workspace-file-service.js";
+import { createWorkspaceSessionService, type WorkspaceSessionService } from "../services/workspace-session-service.js";
+import { createSystemService, type SystemService } from "../services/system-service.js";
+import { createWorkspaceRegistryService, type WorkspaceRegistryService } from "../services/workspace-registry-service.js";
+import { createRemoteServerService, type RemoteServerService } from "../services/remote-server-service.js";
+import { resolveServerV2Version } from "../version.js";
+
+export type AppDependencies = {
+  database: DatabaseStatusProvider;
+  environment: string;
+  persistence: ServerPersistence;
+  processInfo: ProcessInfoAdapter;
+  services: {
+      auth: AuthService;
+      capabilities: CapabilitiesService;
+      config: ConfigMaterializationService;
+      files: WorkspaceFileService;
+      managed: ManagedResourceService;
+      registry: RegistryService;
+      remoteServers: RemoteServerService;
+      router: RouterProductService;
+      runtime: RuntimeService;
+    sessions: WorkspaceSessionService;
+    serverRegistry: ServerRegistryService;
+    system: SystemService;
+    workspaceRegistry: WorkspaceRegistryService;
+  };
+  startedAt: Date;
+  version: string;
+  close(): Promise<void>;
+};
+
+type CreateAppDependenciesOverrides = Partial<Omit<AppDependencies, "services" | "close" | "database" | "persistence">> & {
+  inMemory?: boolean;
+  legacy?: {
+    cloudSigninJson?: string;
+    cloudSigninPath?: string;
+    desktopDataDir?: string;
+    orchestratorDataDir?: string;
+  };
+  localServer?: {
+    baseUrl?: string | null;
+    hostingKind?: "cloud" | "desktop" | "self_hosted";
+    label?: string;
+  };
+  persistence?: ServerPersistence;
+  runtime?: {
+    assetService?: RuntimeAssetService;
+    bootstrapPolicy?: "disabled" | "eager" | "manual";
+    restartPolicy?: {
+      backoffMs?: number;
+      maxAttempts?: number;
+      windowMs?: number;
+    };
+  };
+  workingDirectory?: string;
+};
+
+function isTruthy(value: string | undefined) {
+  if (!value) {
+    return false;
+  }
+
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+
+function resolveLocalHostingKind(explicit?: "cloud" | "desktop" | "self_hosted") {
+  if (explicit) {
+    return explicit;
+  }
+
+  const fromEnv = process.env.OPENWORK_SERVER_V2_HOSTING_KIND?.trim();
+  if (fromEnv === "desktop" || fromEnv === "self_hosted" || fromEnv === "cloud") {
+    return fromEnv;
+  }
+
+  if (isTruthy(process.env.OPENWORK_DESKTOP_HOSTED) || Boolean(process.env.TAURI_ENV_PLATFORM)) {
+    return "desktop";
+  }
+
+  return "self_hosted";
+}
+
+export function createAppDependencies(overrides: CreateAppDependenciesOverrides = {}): AppDependencies {
+  const environment = overrides.environment ?? process.env.NODE_ENV ?? "development";
+  const startedAt = overrides.startedAt ?? new Date();
+  const version = overrides.version ?? resolveServerV2Version();
+  const processInfo = overrides.processInfo ?? createProcessInfoAdapter(environment);
+  const persistence = overrides.persistence ?? createServerPersistence({
+    environment,
+    inMemory: overrides.inMemory,
+    legacy: overrides.legacy,
+    localServer: {
+      baseUrl: overrides.localServer?.baseUrl ?? null,
+      hostingKind: resolveLocalHostingKind(overrides.localServer?.hostingKind),
+      label: overrides.localServer?.label ?? "Local OpenWork Server",
+    },
+    version,
+    workingDirectory: overrides.workingDirectory,
+  });
+  const database = createSqliteDatabaseStatusProvider({ diagnostics: persistence.diagnostics });
+  const auth = createAuthService();
+  const serverRegistry = createServerRegistryService({
+    localServerId: persistence.registry.localServerId,
+    repositories: persistence.repositories,
+  });
+  const workspaceRegistry = createWorkspaceRegistryService({
+    repositories: persistence.repositories,
+    servers: serverRegistry,
+  });
+  const runtime = createRuntimeService({
+    assetService: overrides.runtime?.assetService,
+    bootstrapPolicy: overrides.runtime?.bootstrapPolicy,
+    environment,
+    repositories: persistence.repositories,
+    restartPolicy: overrides.runtime?.restartPolicy,
+    serverId: persistence.registry.localServerId,
+    serverVersion: version,
+    workingDirectory: persistence.workingDirectory,
+  });
+  const capabilities = createCapabilitiesService({
+    auth,
+    runtime,
+  });
+  const config = createConfigMaterializationService({
+    repositories: persistence.repositories,
+    serverId: persistence.registry.localServerId,
+    workingDirectory: persistence.workingDirectory,
+  });
+  const sessions = createWorkspaceSessionService({
+    repositories: persistence.repositories,
+    runtime,
+  });
+  const files = createWorkspaceFileService({
+    config,
+    registry: persistence.registry,
+    repositories: persistence.repositories,
+    runtime,
+    serverId: persistence.registry.localServerId,
+  });
+  const managed = createManagedResourceService({
+    config,
+    files,
+    repositories: persistence.repositories,
+    serverId: persistence.registry.localServerId,
+    workingDirectory: persistence.workingDirectory,
+  });
+  const router = createRouterProductService({
+    repositories: persistence.repositories,
+    runtime,
+    serverId: persistence.registry.localServerId,
+  });
+  const remoteServers = createRemoteServerService({
+    repositories: persistence.repositories,
+  });
+  return {
+    database,
+    environment,
+    persistence,
+    processInfo,
+    services: {
+      auth,
+      capabilities,
+      config,
+      files,
+      managed,
+      registry: persistence.registry,
+      remoteServers,
+      router,
+      runtime,
+      sessions,
+      serverRegistry,
+      system: createSystemService({
+        auth,
+        capabilities,
+        database,
+        environment,
+        processInfo,
+        serverRegistry,
+        runtime,
+        startedAt,
+        version,
+        workspaceRegistry,
+      }),
+      workspaceRegistry,
+    },
+    startedAt,
+    version,
+    async close() {
+      await files.dispose();
+      await runtime.dispose();
+      persistence.close();
+    },
+  };
+}
diff --git a/apps/server-v2/src/context/request-context.ts b/apps/server-v2/src/context/request-context.ts
new file mode 100644
index 0000000000..6932ee2680
--- /dev/null
+++ b/apps/server-v2/src/context/request-context.ts
@@ -0,0 +1,39 @@
+import type { Context, MiddlewareHandler } from "hono";
+import type { AppDependencies } from "./app-dependencies.js";
+import type { RequestActor } from "../services/auth-service.js";
+
+export type RequestContext = {
+  actor: RequestActor;
+  dependencies: AppDependencies;
+  receivedAt: Date;
+  requestId: string;
+  services: AppDependencies["services"];
+};
+
+export type AppBindings = {
+  Variables: {
+    requestContext: RequestContext;
+    requestId: string;
+  };
+};
+
+export function createRequestContext(dependencies: AppDependencies, requestId: string, headers: Headers): RequestContext {
+  return {
+    actor: dependencies.services.auth.resolveActor(headers),
+    dependencies,
+    receivedAt: new Date(),
+    requestId,
+    services: dependencies.services,
+  };
+}
+
+export function requestContextMiddleware(dependencies: AppDependencies): MiddlewareHandler<AppBindings> {
+  return async (c, next) => {
+    c.set("requestContext", createRequestContext(dependencies, c.get("requestId"), c.req.raw.headers));
+    await next();
+  };
+}
+
+export function getRequestContext(c: Pick<Context<AppBindings>, "get">): RequestContext {
+  return c.get("requestContext");
+}
diff --git a/apps/server-v2/src/contract.test.ts b/apps/server-v2/src/contract.test.ts
new file mode 100644
index 0000000000..63bd0754a0
--- /dev/null
+++ b/apps/server-v2/src/contract.test.ts
@@ -0,0 +1,64 @@
+import { expect, test } from "bun:test";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const repoDir = path.resolve(packageDir, "../..");
+
+async function runCommand(command: Array<string>, cwd: string) {
+  const child = Bun.spawn(command, {
+    cwd,
+    env: process.env,
+    stderr: "pipe",
+    stdout: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+
+  return { exitCode, stderr, stdout };
+}
+
+test("openapi generation writes the committed server-v2 contract", async () => {
+  const result = await runCommand(["bun", "./scripts/generate-openapi.ts"], packageDir);
+
+  expect(result.exitCode).toBe(0);
+  expect(result.stdout).toContain("apps/server-v2/openapi/openapi.json");
+
+  const openApiContents = await Bun.file(path.join(packageDir, "openapi/openapi.json")).text();
+  expect(openApiContents).toContain('"/system/health"');
+  expect(openApiContents).toContain('"getSystemHealth"');
+  expect(openApiContents).toContain('"/system/status"');
+  expect(openApiContents).toContain('"/system/cloud-signin"');
+  expect(openApiContents).toContain('"/system/managed/mcps"');
+  expect(openApiContents).toContain('"/system/router/identities/telegram"');
+  expect(openApiContents).toContain('"/workspaces"');
+  expect(openApiContents).toContain('"/workspaces/{workspaceId}/export"');
+  expect(openApiContents).toContain('"/workspaces/{workspaceId}/sessions"');
+  expect(openApiContents).toContain('"/workspaces/{workspaceId}/events"');
+  expect(openApiContents).toContain('"/system/opencode/health"');
+  expect(openApiContents).toContain('"/system/runtime/versions"');
+});
+
+test("sdk generation succeeds from the server-v2 openapi document", async () => {
+  const result = await runCommand(["pnpm", "--filter", "@openwork/server-sdk", "generate"], repoDir);
+
+  expect(result.exitCode).toBe(0);
+
+  const sdkIndex = await Bun.file(path.join(repoDir, "packages/openwork-server-sdk/generated/index.ts")).text();
+  expect(sdkIndex).toContain("getSystemHealth");
+  expect(sdkIndex).toContain("getSystemStatus");
+  expect(sdkIndex).toContain("getSystemCloudSignin");
+  expect(sdkIndex).toContain("getSystemManagedMcps");
+  expect(sdkIndex).toContain("getSystemRouterIdentitiesTelegram");
+  expect(sdkIndex).toContain("getWorkspaces");
+  expect(sdkIndex).toContain("getWorkspacesByWorkspaceIdExport");
+  expect(sdkIndex).toContain("getWorkspacesByWorkspaceIdSessions");
+  expect(sdkIndex).toContain("getWorkspacesByWorkspaceIdEvents");
+  expect(sdkIndex).toContain("GetSystemHealthResponse");
+  expect(sdkIndex).toContain("getSystemOpencodeHealth");
+  expect(sdkIndex).toContain("getSystemRuntimeVersions");
+});
diff --git a/apps/server-v2/src/database/identifiers.ts b/apps/server-v2/src/database/identifiers.ts
new file mode 100644
index 0000000000..981e85ebcb
--- /dev/null
+++ b/apps/server-v2/src/database/identifiers.ts
@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+
+function stableHash(value: string) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export function createStableId(prefix: string, key: string) {
+  return `${prefix}_${stableHash(key).slice(0, 12)}`;
+}
+
+export function createServerId(kind: "local" | "remote", key: string) {
+  if (kind === "local") {
+    return "srv_local";
+  }
+
+  return createStableId("srv", `remote::${key}`);
+}
+
+export function createLocalWorkspaceId(dataDir: string) {
+  return createStableId("ws", dataDir);
+}
+
+export function createRemoteWorkspaceId(input: {
+  baseUrl: string;
+  directory?: string | null;
+  remoteWorkspaceId?: string | null;
+  remoteType: "openwork" | "opencode";
+}) {
+  if (input.remoteType === "openwork") {
+    const key = ["openwork", input.baseUrl, input.remoteWorkspaceId?.trim() ?? ""]
+      .filter(Boolean)
+      .join("::");
+    return createStableId("ws", key);
+  }
+
+  const key = ["remote", input.baseUrl, input.directory?.trim() ?? ""]
+    .filter(Boolean)
+    .join("::");
+  return createStableId("ws", key);
+}
+
+export function createInternalWorkspaceId(kind: "control" | "help") {
+  return createStableId("ws", `internal::${kind}`);
+}
+
+export function slugifyWorkspaceValue(value: string, fallback: string) {
+  const normalized = value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  return normalized || fallback;
+}
+
+export function deriveWorkspaceSlugSource(input: {
+  dataDir?: string | null;
+  displayName: string;
+  fallback: string;
+}) {
+  const baseName = input.dataDir ? path.basename(input.dataDir) : "";
+  return slugifyWorkspaceValue(input.displayName || baseName, input.fallback);
+}
diff --git a/apps/server-v2/src/database/json.ts b/apps/server-v2/src/database/json.ts
new file mode 100644
index 0000000000..a5cc0afbdd
--- /dev/null
+++ b/apps/server-v2/src/database/json.ts
@@ -0,0 +1,15 @@
+export function parseJsonValue<T>(value: string | null | undefined, fallback: T): T {
+  if (!value) {
+    return fallback;
+  }
+
+  try {
+    return JSON.parse(value) as T;
+  } catch {
+    return fallback;
+  }
+}
+
+export function stringifyJsonValue(value: unknown): string {
+  return JSON.stringify(value ?? null);
+}
diff --git a/apps/server-v2/src/database/migrations/0001-registry-runtime.ts b/apps/server-v2/src/database/migrations/0001-registry-runtime.ts
new file mode 100644
index 0000000000..8b6d11dd5c
--- /dev/null
+++ b/apps/server-v2/src/database/migrations/0001-registry-runtime.ts
@@ -0,0 +1,70 @@
+export const phase2RegistryRuntimeMigration = {
+  name: "registry-runtime",
+  sql: `
+    CREATE TABLE IF NOT EXISTS servers (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL CHECK (kind IN ('local', 'remote')),
+      hosting_kind TEXT NOT NULL CHECK (hosting_kind IN ('desktop', 'self_hosted', 'cloud')),
+      label TEXT NOT NULL,
+      base_url TEXT,
+      auth_json TEXT,
+      capabilities_json TEXT NOT NULL DEFAULT '{}',
+      is_local INTEGER NOT NULL DEFAULT 0,
+      is_enabled INTEGER NOT NULL DEFAULT 1,
+      source TEXT NOT NULL DEFAULT 'seeded',
+      notes_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      last_seen_at TEXT
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_servers_single_local ON servers (is_local) WHERE is_local = 1;
+
+    CREATE TABLE IF NOT EXISTS workspaces (
+      id TEXT PRIMARY KEY,
+      server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+      kind TEXT NOT NULL CHECK (kind IN ('local', 'remote', 'control', 'help')),
+      display_name TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      is_hidden INTEGER NOT NULL DEFAULT 0,
+      status TEXT NOT NULL CHECK (status IN ('ready', 'imported', 'attention')),
+      opencode_project_id TEXT,
+      remote_workspace_id TEXT,
+      data_dir TEXT,
+      config_dir TEXT,
+      notes_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_workspaces_slug ON workspaces (slug);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_workspaces_local_data_dir ON workspaces (data_dir) WHERE data_dir IS NOT NULL;
+    CREATE INDEX IF NOT EXISTS idx_workspaces_server ON workspaces (server_id);
+
+    CREATE TABLE IF NOT EXISTS server_runtime_state (
+      server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+      runtime_version TEXT,
+      opencode_status TEXT NOT NULL DEFAULT 'unknown',
+      opencode_version TEXT,
+      opencode_base_url TEXT,
+      router_status TEXT NOT NULL DEFAULT 'disabled',
+      router_version TEXT,
+      restart_policy_json TEXT,
+      last_started_at TEXT,
+      last_exit_json TEXT,
+      health_json TEXT,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_runtime_state (
+      workspace_id TEXT PRIMARY KEY REFERENCES workspaces(id) ON DELETE CASCADE,
+      backend_kind TEXT NOT NULL CHECK (backend_kind IN ('local_opencode', 'remote_openwork')),
+      last_sync_at TEXT,
+      last_session_refresh_at TEXT,
+      last_error_json TEXT,
+      health_json TEXT,
+      updated_at TEXT NOT NULL
+    );
+  `,
+  version: "0001",
+} as const;
diff --git a/apps/server-v2/src/database/migrations/0002-managed-state.ts b/apps/server-v2/src/database/migrations/0002-managed-state.ts
new file mode 100644
index 0000000000..2e68e8ead5
--- /dev/null
+++ b/apps/server-v2/src/database/migrations/0002-managed-state.ts
@@ -0,0 +1,145 @@
+export const phase2ManagedStateMigration = {
+  name: "managed-state",
+  sql: `
+    CREATE TABLE IF NOT EXISTS mcps (
+      id TEXT PRIMARY KEY,
+      item_kind TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      item_key TEXT,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      auth_json TEXT,
+      metadata_json TEXT,
+      source TEXT NOT NULL CHECK (source IN ('openwork_managed', 'imported', 'discovered', 'cloud_synced')),
+      cloud_item_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS skills (
+      id TEXT PRIMARY KEY,
+      item_kind TEXT NOT NULL DEFAULT 'skill',
+      display_name TEXT NOT NULL,
+      item_key TEXT,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      auth_json TEXT,
+      metadata_json TEXT,
+      source TEXT NOT NULL CHECK (source IN ('openwork_managed', 'imported', 'discovered', 'cloud_synced')),
+      cloud_item_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS plugins (
+      id TEXT PRIMARY KEY,
+      item_kind TEXT NOT NULL DEFAULT 'plugin',
+      display_name TEXT NOT NULL,
+      item_key TEXT,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      auth_json TEXT,
+      metadata_json TEXT,
+      source TEXT NOT NULL CHECK (source IN ('openwork_managed', 'imported', 'discovered', 'cloud_synced')),
+      cloud_item_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS provider_configs (
+      id TEXT PRIMARY KEY,
+      item_kind TEXT NOT NULL DEFAULT 'provider',
+      display_name TEXT NOT NULL,
+      item_key TEXT,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      auth_json TEXT,
+      metadata_json TEXT,
+      source TEXT NOT NULL CHECK (source IN ('openwork_managed', 'imported', 'discovered', 'cloud_synced')),
+      cloud_item_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_mcps (
+      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      item_id TEXT NOT NULL REFERENCES mcps(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (workspace_id, item_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_skills (
+      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      item_id TEXT NOT NULL REFERENCES skills(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (workspace_id, item_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_plugins (
+      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      item_id TEXT NOT NULL REFERENCES plugins(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (workspace_id, item_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_provider_configs (
+      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      item_id TEXT NOT NULL REFERENCES provider_configs(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (workspace_id, item_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS cloud_signin (
+      id TEXT PRIMARY KEY,
+      server_id TEXT NOT NULL UNIQUE REFERENCES servers(id) ON DELETE CASCADE,
+      cloud_base_url TEXT NOT NULL,
+      user_id TEXT,
+      org_id TEXT,
+      auth_json TEXT,
+      metadata_json TEXT,
+      last_validated_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_shares (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      access_key TEXT,
+      status TEXT NOT NULL CHECK (status IN ('active', 'revoked', 'disabled')),
+      last_used_at TEXT,
+      audit_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      revoked_at TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS router_identities (
+      id TEXT PRIMARY KEY,
+      server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+      kind TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      auth_json TEXT,
+      is_enabled INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS router_bindings (
+      id TEXT PRIMARY KEY,
+      server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+      router_identity_id TEXT NOT NULL REFERENCES router_identities(id) ON DELETE CASCADE,
+      binding_key TEXT NOT NULL,
+      config_json TEXT NOT NULL DEFAULT '{}',
+      is_enabled INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_workspace_shares_workspace ON workspace_shares (workspace_id);
+    CREATE INDEX IF NOT EXISTS idx_router_identities_server ON router_identities (server_id);
+    CREATE INDEX IF NOT EXISTS idx_router_bindings_server ON router_bindings (server_id);
+  `,
+  version: "0002",
+} as const;
diff --git a/apps/server-v2/src/database/migrations/0003-files-config.ts b/apps/server-v2/src/database/migrations/0003-files-config.ts
new file mode 100644
index 0000000000..c8a38dfe8c
--- /dev/null
+++ b/apps/server-v2/src/database/migrations/0003-files-config.ts
@@ -0,0 +1,18 @@
+export const phase7FilesConfigMigration = {
+  name: "files-config",
+  sql: `
+    CREATE TABLE IF NOT EXISTS server_config_state (
+      server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+      opencode_json TEXT NOT NULL DEFAULT '{}',
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS workspace_config_state (
+      workspace_id TEXT PRIMARY KEY REFERENCES workspaces(id) ON DELETE CASCADE,
+      openwork_json TEXT NOT NULL DEFAULT '{}',
+      opencode_json TEXT NOT NULL DEFAULT '{}',
+      updated_at TEXT NOT NULL
+    );
+  `,
+  version: "0003",
+} as const;
diff --git a/apps/server-v2/src/database/migrations/index.ts b/apps/server-v2/src/database/migrations/index.ts
new file mode 100644
index 0000000000..b2bdd73870
--- /dev/null
+++ b/apps/server-v2/src/database/migrations/index.ts
@@ -0,0 +1,92 @@
+import { createHash } from "node:crypto";
+import type { Database } from "bun:sqlite";
+import type { MigrationResult } from "../types.js";
+import { phase2RegistryRuntimeMigration } from "./0001-registry-runtime.js";
+import { phase2ManagedStateMigration } from "./0002-managed-state.js";
+import { phase7FilesConfigMigration } from "./0003-files-config.js";
+
+const migrations = [phase2RegistryRuntimeMigration, phase2ManagedStateMigration, phase7FilesConfigMigration].map((migration) => ({
+  ...migration,
+  checksum: createHash("sha256").update(migration.sql).digest("hex"),
+}));
+
+export function runMigrations(database: Database): MigrationResult {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      version TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      checksum TEXT NOT NULL,
+      applied_at TEXT NOT NULL
+    );
+  `);
+
+  const existingRows = database
+    .query("SELECT version, checksum FROM schema_migrations ORDER BY version")
+    .all() as Array<{ checksum: string; version: string }>;
+  const existing = new Map(existingRows.map((row) => [row.version, row.checksum]));
+  const applied: string[] = [];
+
+  const applyMigration = database.transaction((migration: (typeof migrations)[number]) => {
+    database.exec(migration.sql);
+    database
+      .query(
+        `
+          INSERT INTO schema_migrations (version, name, checksum, applied_at)
+          VALUES (?1, ?2, ?3, ?4)
+        `,
+      )
+      .run(migration.version, migration.name, migration.checksum, new Date().toISOString());
+  });
+
+  for (const migration of migrations) {
+    const currentChecksum = existing.get(migration.version);
+    if (currentChecksum) {
+      if (currentChecksum !== migration.checksum) {
+        throw new Error(
+          `Migration checksum mismatch for ${migration.version}. Expected ${migration.checksum} but found ${currentChecksum}.`,
+        );
+      }
+      continue;
+    }
+
+    applyMigration(migration);
+    applied.push(migration.version);
+  }
+
+  return {
+    applied,
+    currentVersion: migrations[migrations.length - 1]?.version ?? "0000",
+    totalApplied: existing.size + applied.length,
+  };
+}
+
+export function runSpecificMigrations(database: Database, versions: string[]) {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      version TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      checksum TEXT NOT NULL,
+      applied_at TEXT NOT NULL
+    );
+  `);
+
+  const applyMigration = database.transaction((migration: (typeof migrations)[number]) => {
+    database.exec(migration.sql);
+    database
+      .query(
+        `
+          INSERT INTO schema_migrations (version, name, checksum, applied_at)
+          VALUES (?1, ?2, ?3, ?4)
+        `,
+      )
+      .run(migration.version, migration.name, migration.checksum, new Date().toISOString());
+  });
+
+  for (const version of versions) {
+    const migration = migrations.find((candidate) => candidate.version === version);
+    if (!migration) {
+      throw new Error(`Unknown migration version: ${version}`);
+    }
+    applyMigration(migration);
+  }
+}
diff --git a/apps/server-v2/src/database/persistence.test.ts b/apps/server-v2/src/database/persistence.test.ts
new file mode 100644
index 0000000000..4914a0de06
--- /dev/null
+++ b/apps/server-v2/src/database/persistence.test.ts
@@ -0,0 +1,271 @@
+import { afterEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { Database } from "bun:sqlite";
+import { createServerPersistence } from "./persistence.js";
+import { runSpecificMigrations } from "./migrations/index.js";
+import { ensureServerWorkingDirectoryLayout, resolveServerWorkingDirectory } from "./working-directory.js";
+
+const cleanupPaths: string[] = [];
+
+afterEach(() => {
+  while (cleanupPaths.length > 0) {
+    const target = cleanupPaths.pop();
+    if (!target) {
+      continue;
+    }
+
+    fs.rmSync(target, { force: true, recursive: true });
+  }
+});
+
+function makeTempDir(name: string) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), `${name}-`));
+  cleanupPaths.push(directory);
+  return directory;
+}
+
+function createPersistence(overrides: Partial<Parameters<typeof createServerPersistence>[0]> = {}) {
+  return createServerPersistence({
+    environment: "development",
+    localServer: {
+      baseUrl: null,
+      hostingKind: "self_hosted",
+      label: "Local OpenWork Server",
+    },
+    version: "0.0.0-test",
+    ...overrides,
+  });
+}
+
+test("fresh bootstrap seeds the local server and hidden workspaces", () => {
+  const workingDirectory = makeTempDir("openwork-server-v2-phase2-fresh");
+  const persistence = createPersistence({ workingDirectory });
+
+  expect(persistence.diagnostics.mode).toBe("fresh");
+  expect(persistence.repositories.servers.getById(persistence.registry.localServerId)).not.toBeNull();
+
+  const hiddenWorkspaces = persistence.repositories.workspaces.list({ includeHidden: true }).filter((workspace) => workspace.isHidden);
+  expect(hiddenWorkspaces.map((workspace) => workspace.kind).sort()).toEqual(["control", "help"]);
+  for (const workspace of hiddenWorkspaces) {
+    expect(workspace.configDir).toBeTruthy();
+    expect(fs.existsSync(workspace.configDir!)).toBe(true);
+  }
+
+  persistence.close();
+});
+
+test("migration runner upgrades an existing database from the first migration", () => {
+  const rootDir = makeTempDir("openwork-server-v2-phase2-upgrade");
+  const workingDirectory = resolveServerWorkingDirectory({ environment: "development", explicitRootDir: rootDir });
+  ensureServerWorkingDirectoryLayout(workingDirectory);
+  const database = new Database(workingDirectory.databasePath, { create: true });
+  runSpecificMigrations(database, ["0001"]);
+  database.close(false);
+
+  const persistence = createPersistence({ workingDirectory: rootDir });
+
+  expect(persistence.diagnostics.mode).toBe("existing");
+  expect(persistence.diagnostics.migrations.applied).toEqual(["0002", "0003"]);
+  expect(persistence.repositories.providerConfigs.list()).toEqual([]);
+
+  persistence.close();
+});
+
+test("legacy workspace import only runs once across repeated boots", () => {
+  const rootDir = makeTempDir("openwork-server-v2-phase2-idempotent");
+  const desktopDataDir = makeTempDir("openwork-server-v2-phase2-desktop");
+  const orchestratorDataDir = makeTempDir("openwork-server-v2-phase2-orchestrator");
+  const localWorkspaceDir = makeTempDir("openwork-server-v2-phase2-local-workspace");
+  const orchestratorOnlyWorkspaceDir = makeTempDir("openwork-server-v2-phase2-orch-only-workspace");
+
+  fs.writeFileSync(
+    path.join(desktopDataDir, "openwork-workspaces.json"),
+    JSON.stringify(
+      {
+        selectedWorkspaceId: "ws_legacy_selected",
+        watchedWorkspaceId: "ws_legacy_selected",
+        workspaces: [
+          {
+            id: "ws_legacy_selected",
+            name: "Local Test",
+            path: localWorkspaceDir,
+            preset: "starter",
+            workspaceType: "local",
+          },
+          {
+            id: "ws_remote_legacy",
+            name: "Remote Test",
+            workspaceType: "remote",
+            remoteType: "openwork",
+            baseUrl: "https://remote.example.com/w/remote-one",
+            openworkHostUrl: "https://remote.example.com",
+            openworkWorkspaceId: "remote-one",
+            openworkToken: "client-token",
+          },
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+
+  fs.writeFileSync(
+    path.join(orchestratorDataDir, "openwork-orchestrator-state.json"),
+    JSON.stringify(
+      {
+        activeId: "orch-1",
+        cliVersion: "0.11.206",
+        daemon: {
+          baseUrl: "http://127.0.0.1:4321",
+          pid: 123,
+          port: 4321,
+          startedAt: Date.now(),
+        },
+        opencode: {
+          baseUrl: "http://127.0.0.1:4322",
+          pid: 456,
+          port: 4322,
+          startedAt: Date.now(),
+        },
+        workspaces: [
+          {
+            id: "orch-1",
+            name: "Local Test",
+            path: localWorkspaceDir,
+            workspaceType: "local",
+          },
+          {
+            id: "orch-2",
+            name: "Orchestrator Only",
+            path: orchestratorOnlyWorkspaceDir,
+            workspaceType: "local",
+          },
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+
+  const first = createPersistence({
+    legacy: {
+      cloudSigninJson: JSON.stringify({
+        authToken: "den-token",
+        baseUrl: "https://app.openworklabs.com",
+        userId: "user-1",
+      }),
+      desktopDataDir,
+      orchestratorDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+
+  const firstServers = first.repositories.servers.list();
+  const firstVisibleWorkspaces = first.repositories.workspaces.list();
+  expect(firstServers).toHaveLength(2);
+  expect(firstVisibleWorkspaces).toHaveLength(3);
+  expect(first.repositories.cloudSignin.getPrimary()?.cloudBaseUrl).toBe("https://app.openworklabs.com");
+  first.close();
+
+  const second = createPersistence({
+    legacy: {
+      desktopDataDir,
+      orchestratorDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+
+  expect(second.diagnostics.mode).toBe("existing");
+  expect(second.repositories.servers.list()).toHaveLength(2);
+  expect(second.repositories.workspaces.list()).toHaveLength(3);
+  expect(second.repositories.workspaces.list({ includeHidden: true })).toHaveLength(5);
+  expect(second.diagnostics.importReports.desktopWorkspaceState.status).toBe("skipped");
+  expect(second.diagnostics.importReports.orchestratorState.status).toBe("skipped");
+  expect(second.diagnostics.legacyWorkspaceImport.completedAt).toBeTruthy();
+  expect(second.diagnostics.legacyWorkspaceImport.skipped).toBe(true);
+  second.close();
+});
+
+test("deleted legacy-imported workspace stays deleted after restart", () => {
+  const rootDir = makeTempDir("openwork-server-v2-phase2-delete-persist");
+  const desktopDataDir = makeTempDir("openwork-server-v2-phase2-delete-desktop");
+  const localWorkspaceDir = makeTempDir("openwork-server-v2-phase2-delete-workspace");
+
+  fs.writeFileSync(
+    path.join(desktopDataDir, "openwork-workspaces.json"),
+    JSON.stringify(
+      {
+        selectedWorkspaceId: "ws_legacy_selected",
+        workspaces: [
+          {
+            id: "ws_legacy_selected",
+            name: "Local Test",
+            path: localWorkspaceDir,
+            preset: "starter",
+            workspaceType: "local",
+          },
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+
+  const first = createPersistence({
+    legacy: {
+      desktopDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+
+  const normalizedWorkspaceDir = fs.realpathSync.native(localWorkspaceDir);
+  const importedWorkspace = first.repositories.workspaces
+    .list()
+    .find((workspace) => workspace.dataDir === normalizedWorkspaceDir);
+  expect(importedWorkspace).not.toBeUndefined();
+  first.close();
+
+  const second = createPersistence({
+    legacy: {
+      desktopDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+  expect(second.diagnostics.importReports.desktopWorkspaceState.status).toBe("skipped");
+  expect(second.repositories.workspaces.deleteById(importedWorkspace!.id)).toBe(true);
+  expect(second.repositories.workspaces.list().some((workspace) => workspace.id === importedWorkspace!.id)).toBe(false);
+  second.close();
+
+  const third = createPersistence({
+    legacy: {
+      desktopDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+  expect(third.diagnostics.importReports.desktopWorkspaceState.status).toBe("skipped");
+  expect(third.repositories.workspaces.list().some((workspace) => workspace.id === importedWorkspace!.id)).toBe(false);
+  third.close();
+});
+
+test("corrupt legacy workspace state is surfaced without blocking bootstrap", () => {
+  const rootDir = makeTempDir("openwork-server-v2-phase2-corrupt");
+  const desktopDataDir = makeTempDir("openwork-server-v2-phase2-corrupt-desktop");
+  const orchestratorDataDir = makeTempDir("openwork-server-v2-phase2-corrupt-orchestrator");
+  fs.writeFileSync(path.join(desktopDataDir, "openwork-workspaces.json"), "{not-json");
+
+  const persistence = createPersistence({
+    legacy: {
+      desktopDataDir,
+      orchestratorDataDir,
+    },
+    workingDirectory: rootDir,
+  });
+
+  expect(persistence.diagnostics.importReports.desktopWorkspaceState.status).toBe("error");
+  expect(persistence.repositories.servers.list()).toHaveLength(1);
+  expect(persistence.repositories.workspaces.list({ includeHidden: true })).toHaveLength(2);
+
+  persistence.close();
+});
diff --git a/apps/server-v2/src/database/persistence.ts b/apps/server-v2/src/database/persistence.ts
new file mode 100644
index 0000000000..3d31f661f8
--- /dev/null
+++ b/apps/server-v2/src/database/persistence.ts
@@ -0,0 +1,728 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { Database } from "bun:sqlite";
+import { z } from "zod";
+import { createRepositories, type ServerRepositories } from "./repositories.js";
+import type { StartupDiagnostics, HostingKind, ImportSourceReport, JsonObject } from "./types.js";
+import { runMigrations } from "./migrations/index.js";
+import { ensureServerWorkingDirectoryLayout, resolveServerWorkingDirectory, type ServerWorkingDirectory } from "./working-directory.js";
+import { createRegistryService, type RegistryService } from "../services/registry-service.js";
+
+const legacyWorkspaceSchema = z.object({
+  baseUrl: z.string().optional().nullable(),
+  directory: z.string().optional().nullable(),
+  displayName: z.string().optional().nullable(),
+  id: z.string(),
+  name: z.string().optional().default(""),
+  openworkClientToken: z.string().optional().nullable(),
+  openworkHostToken: z.string().optional().nullable(),
+  openworkHostUrl: z.string().optional().nullable(),
+  openworkToken: z.string().optional().nullable(),
+  openworkWorkspaceId: z.string().optional().nullable(),
+  openworkWorkspaceName: z.string().optional().nullable(),
+  path: z.string().default(""),
+  preset: z.string().optional().nullable(),
+  remoteType: z.enum(["openwork", "opencode"]).optional().nullable(),
+  sandboxBackend: z.string().optional().nullable(),
+  sandboxContainerName: z.string().optional().nullable(),
+  sandboxRunId: z.string().optional().nullable(),
+  workspaceType: z.enum(["local", "remote"]),
+});
+
+const legacyWorkspaceStateSchema = z.object({
+  activeId: z.string().optional().nullable(),
+  selectedWorkspaceId: z.string().optional().nullable(),
+  version: z.number().optional(),
+  watchedWorkspaceId: z.string().optional().nullable(),
+  workspaces: z.array(legacyWorkspaceSchema),
+});
+
+const orchestratorStateSchema = z.object({
+  activeId: z.string().optional().nullable(),
+  binaries: z.object({
+    opencode: z.object({
+      actualVersion: z.string().optional().nullable(),
+      expectedVersion: z.string().optional().nullable(),
+      path: z.string().optional().nullable(),
+      source: z.string().optional().nullable(),
+    }).optional().nullable(),
+  }).optional().nullable(),
+  cliVersion: z.string().optional().nullable(),
+  daemon: z.object({
+    baseUrl: z.string(),
+    pid: z.number(),
+    port: z.number(),
+    startedAt: z.number(),
+  }).optional().nullable(),
+  opencode: z.object({
+    baseUrl: z.string(),
+    pid: z.number(),
+    port: z.number(),
+    startedAt: z.number(),
+  }).optional().nullable(),
+  workspaces: z.array(z.object({
+    baseUrl: z.string().optional().nullable(),
+    createdAt: z.number().optional().nullable(),
+    directory: z.string().optional().nullable(),
+    id: z.string(),
+    lastUsedAt: z.number().optional().nullable(),
+    name: z.string().optional().default(""),
+    path: z.string(),
+    workspaceType: z.string(),
+  })).default([]),
+});
+
+const orchestratorAuthSchema = z.object({
+  opencodePassword: z.string().optional().nullable(),
+  opencodeUsername: z.string().optional().nullable(),
+  projectDir: z.string().optional().nullable(),
+  updatedAt: z.number().optional().nullable(),
+});
+
+const cloudSigninSchema = z.object({
+  activeOrgId: z.string().optional().nullable(),
+  activeOrgName: z.string().optional().nullable(),
+  activeOrgSlug: z.string().optional().nullable(),
+  authToken: z.string().optional().nullable(),
+  baseUrl: z.string().optional().nullable(),
+  cloudBaseUrl: z.string().optional().nullable(),
+  lastValidatedAt: z.string().optional().nullable(),
+  orgId: z.string().optional().nullable(),
+  userId: z.string().optional().nullable(),
+});
+
+type CreateServerPersistenceOptions = {
+  environment: string;
+  inMemory?: boolean;
+  legacy?: {
+    cloudSigninJson?: string;
+    cloudSigninPath?: string;
+    desktopDataDir?: string;
+    orchestratorDataDir?: string;
+  };
+  localServer: {
+    baseUrl?: string | null;
+    hostingKind: HostingKind;
+    label: string;
+  };
+  version: string;
+  workingDirectory?: string;
+};
+
+export type ServerPersistence = {
+  close(): void;
+  database: Database;
+  diagnostics: StartupDiagnostics;
+  registry: RegistryService;
+  repositories: ServerRepositories;
+  workingDirectory: ServerWorkingDirectory;
+};
+
+function isTruthy(value: string | undefined) {
+  if (!value) {
+    return false;
+  }
+
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+
+function normalizeWorkspacePath(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+
+  const expanded = trimmed === "~"
+    ? os.homedir()
+    : trimmed.startsWith("~/") || trimmed.startsWith("~\\")
+      ? path.join(os.homedir(), trimmed.slice(2))
+      : trimmed;
+
+  try {
+    return fs.realpathSync.native(expanded);
+  } catch {
+    return path.resolve(expanded);
+  }
+}
+
+function normalizeUrl(value: string | null | undefined) {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    return null;
+  }
+
+  const withProtocol = /^https?:\/\//.test(trimmed) ? trimmed : `http://${trimmed}`;
+  try {
+    const url = new URL(withProtocol);
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+function stripWorkspaceMount(value: string | null | undefined) {
+  const normalized = normalizeUrl(value);
+  if (!normalized) {
+    return null;
+  }
+
+  const url = new URL(normalized);
+  const segments = url.pathname.split("/").filter(Boolean);
+  const last = segments[segments.length - 1] ?? "";
+  const prev = segments[segments.length - 2] ?? "";
+  if (prev === "w" && last) {
+    url.pathname = `/${segments.slice(0, -2).join("/")}`;
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+function parseWorkspaceIdFromUrl(value: string | null | undefined) {
+  const normalized = normalizeUrl(value);
+  if (!normalized) {
+    return null;
+  }
+
+  try {
+    const url = new URL(normalized);
+    const segments = url.pathname.split("/").filter(Boolean);
+    const last = segments[segments.length - 1] ?? "";
+    const prev = segments[segments.length - 2] ?? "";
+    return prev === "w" && last ? decodeURIComponent(last) : null;
+  } catch {
+    return null;
+  }
+}
+
+function detectRemoteHostingKind(value: string) {
+  const normalized = normalizeUrl(value);
+  if (!normalized) {
+    return "self_hosted" as const;
+  }
+
+  const hostname = new URL(normalized).hostname.toLowerCase();
+  if (
+    hostname === "app.openworklabs.com" ||
+    hostname === "app.openwork.software" ||
+    hostname.endsWith(".openworklabs.com") ||
+    hostname.endsWith(".openwork.software")
+  ) {
+    return "cloud" as const;
+  }
+
+  return "self_hosted" as const;
+}
+
+function legacyDesktopDataDirCandidates(explicitDir?: string) {
+  if (explicitDir?.trim()) {
+    return [path.resolve(explicitDir)];
+  }
+
+  const candidates: string[] = [];
+  const home = os.homedir();
+  const names = ["com.differentai.openwork.dev", "com.differentai.openwork", "OpenWork Dev", "OpenWork"];
+  if (process.platform === "darwin") {
+    for (const name of names) {
+      candidates.push(path.join(home, "Library", "Application Support", name));
+    }
+  } else if (process.platform === "win32") {
+    const appData = process.env.APPDATA?.trim() || path.join(home, "AppData", "Roaming");
+    for (const name of names) {
+      candidates.push(path.join(appData, name));
+    }
+  } else {
+    const xdgDataHome = process.env.XDG_DATA_HOME?.trim() || path.join(home, ".local", "share");
+    for (const name of names) {
+      candidates.push(path.join(xdgDataHome, name));
+    }
+  }
+
+  return Array.from(new Set(candidates));
+}
+
+function legacyOrchestratorDirCandidates(explicitDir?: string) {
+  if (explicitDir?.trim()) {
+    return [path.resolve(explicitDir)];
+  }
+
+  const candidates: string[] = [];
+  const fromEnv = process.env.OPENWORK_DATA_DIR?.trim();
+  if (fromEnv) {
+    candidates.push(path.resolve(fromEnv));
+  }
+
+  const home = os.homedir();
+  for (const name of ["openwork-orchestrator-dev-react", "openwork-orchestrator-dev", "openwork-orchestrator"]) {
+    candidates.push(path.join(home, ".openwork", name));
+  }
+
+  return Array.from(new Set(candidates));
+}
+
+function readTextIfExists(filePath: string | null) {
+  if (!filePath) {
+    return null;
+  }
+
+  try {
+    return fs.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function resolveExistingFile(candidates: string[], fileName: string) {
+  for (const directory of candidates) {
+    const filePath = path.join(directory, fileName);
+    if (fs.existsSync(filePath)) {
+      return filePath;
+    }
+  }
+
+  return null;
+}
+
+function fromUnixTimestamp(value: number | null | undefined) {
+  if (!value) {
+    return null;
+  }
+
+  const milliseconds = value > 10_000_000_000 ? value : value * 1000;
+  return new Date(milliseconds).toISOString();
+}
+
+function createEmptyReport(status: ImportSourceReport["status"], sourcePath: string | null, details: JsonObject = {}): ImportSourceReport {
+  return {
+    details,
+    sourcePath,
+    status,
+    warnings: [],
+  };
+}
+
+function mergeReportWarnings(report: ImportSourceReport, warnings: string[]) {
+  report.warnings.push(...warnings);
+  return report;
+}
+
+function asJsonObject(value: unknown): JsonObject | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+
+  return value as JsonObject;
+}
+
+function readLegacyWorkspaceImportCompletedAt(value: JsonObject | null | undefined) {
+  const startup = asJsonObject(value?.startup);
+  const legacyWorkspaceImport = asJsonObject(startup?.legacyWorkspaceImport);
+  const completedAt = legacyWorkspaceImport?.completedAt;
+  return typeof completedAt === "string" && completedAt.trim() ? completedAt.trim() : null;
+}
+
+function summarizeMode(inMemory: boolean, databasePath: string) {
+  if (inMemory) {
+    return "fresh" as const;
+  }
+
+  return fs.existsSync(databasePath) ? "existing" as const : "fresh" as const;
+}
+
+export function createServerPersistence(options: CreateServerPersistenceOptions): ServerPersistence {
+  const inMemory = options.inMemory ?? (isTruthy(process.env.OPENWORK_SERVER_V2_IN_MEMORY) || options.environment === "test");
+  const workingDirectory = resolveServerWorkingDirectory({
+    environment: options.environment,
+    explicitRootDir: options.workingDirectory,
+  });
+  if (!inMemory) {
+    ensureServerWorkingDirectoryLayout(workingDirectory);
+  }
+
+  const mode = summarizeMode(inMemory, workingDirectory.databasePath);
+  const database = new Database(inMemory ? ":memory:" : workingDirectory.databasePath, { create: true });
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA synchronous = NORMAL");
+
+  const migrations = runMigrations(database);
+  const repositories = createRepositories(database);
+  const registry = createRegistryService({
+    localServerCapabilities: {
+      configRoutes: true,
+      capabilitiesRoutes: true,
+      contractLoop: true,
+      fileRoutes: true,
+      managedConfigTables: true,
+      phase: 9,
+      remoteServerConnections: true,
+      remoteWorkspaceDiscovery: true,
+      reloadOwnership: true,
+      rootMounted: true,
+      runtimeRoutes: true,
+      runtimeSupervision: true,
+      runtimeStateTables: true,
+      version: options.version,
+      workspaceReadRoutes: true,
+      workspaceRegistry: true,
+    },
+    repositories,
+    workingDirectory,
+  });
+
+  const localServer = registry.ensureLocalServer({
+    baseUrl: options.localServer.baseUrl ?? null,
+    hostingKind: options.localServer.hostingKind,
+    label: options.localServer.label,
+    notes: {
+      workingDirectory: workingDirectory.rootDir,
+    },
+  });
+
+  const controlWorkspace = registry.ensureHiddenWorkspace("control");
+  const helpWorkspace = registry.ensureHiddenWorkspace("help");
+
+  const existingRuntimeState = repositories.serverRuntimeState.getByServerId(registry.localServerId);
+  const priorLegacyWorkspaceImportCompletedAt = readLegacyWorkspaceImportCompletedAt(existingRuntimeState?.health);
+  const shouldImportLegacyWorkspaceState = !priorLegacyWorkspaceImportCompletedAt;
+
+  const desktopWorkspaceFile = resolveExistingFile(
+    legacyDesktopDataDirCandidates(options.legacy?.desktopDataDir),
+    "openwork-workspaces.json",
+  );
+  const desktopWorkspaceReport = !shouldImportLegacyWorkspaceState
+    ? createEmptyReport("skipped", desktopWorkspaceFile, {
+        completedAt: priorLegacyWorkspaceImportCompletedAt,
+        reason: "Legacy workspace import already completed on an earlier Server V2 startup.",
+      })
+    : desktopWorkspaceFile
+      ? createEmptyReport("imported", desktopWorkspaceFile)
+      : createEmptyReport("unavailable", null, { reason: "No legacy desktop workspace registry file was found." });
+
+  if (shouldImportLegacyWorkspaceState && desktopWorkspaceFile) {
+    try {
+      const parsed = legacyWorkspaceStateSchema.parse(JSON.parse(readTextIfExists(desktopWorkspaceFile) ?? "{}"));
+      let localImported = 0;
+      let remoteImported = 0;
+      const importedWorkspaceIds: string[] = [];
+      for (const workspace of parsed.workspaces) {
+        if (workspace.workspaceType === "local") {
+          const dataDir = normalizeWorkspacePath(workspace.path);
+          if (!dataDir) {
+            desktopWorkspaceReport.warnings.push(`Skipped local workspace ${workspace.id} because its path was empty.`);
+            continue;
+          }
+          const record = registry.importLocalWorkspace({
+            dataDir,
+            displayName: (workspace.displayName?.trim() || workspace.name || path.basename(dataDir)).trim(),
+            legacyNotes: {
+              legacyDesktop: {
+                displayName: workspace.displayName ?? null,
+                legacyId: workspace.id,
+                name: workspace.name,
+                preset: workspace.preset ?? null,
+                source: "openwork-workspaces.json",
+              },
+            },
+            status: "imported",
+          });
+          localImported += 1;
+          importedWorkspaceIds.push(record.id);
+          continue;
+        }
+
+        const remoteType = workspace.remoteType === "openwork" ? "openwork" : "opencode";
+        const openworkServerBaseUrl = stripWorkspaceMount(workspace.openworkHostUrl ?? workspace.baseUrl ?? "");
+        const remoteServerBaseUrl = openworkServerBaseUrl ?? normalizeUrl(workspace.baseUrl) ?? "";
+        if (!remoteServerBaseUrl) {
+          desktopWorkspaceReport.warnings.push(`Skipped remote workspace ${workspace.id} because no valid base URL was found.`);
+          continue;
+        }
+
+        const auth: JsonObject = {};
+        if (workspace.openworkToken?.trim()) auth.openworkToken = workspace.openworkToken.trim();
+        if (workspace.openworkClientToken?.trim()) auth.openworkClientToken = workspace.openworkClientToken.trim();
+        if (workspace.openworkHostToken?.trim()) auth.openworkHostToken = workspace.openworkHostToken.trim();
+
+        const record = registry.importRemoteWorkspace({
+          baseUrl: normalizeUrl(workspace.baseUrl) ?? remoteServerBaseUrl,
+          directory: workspace.directory?.trim() || null,
+          displayName:
+            workspace.openworkWorkspaceName?.trim() ||
+            workspace.displayName?.trim() ||
+            workspace.name ||
+            remoteServerBaseUrl,
+          legacyNotes: {
+            legacyDesktop: {
+              baseUrl: workspace.baseUrl ?? null,
+              directory: workspace.directory ?? null,
+              displayName: workspace.displayName ?? null,
+              legacyId: workspace.id,
+              openworkHostUrl: workspace.openworkHostUrl ?? null,
+              sandboxBackend: workspace.sandboxBackend ?? null,
+              sandboxContainerName: workspace.sandboxContainerName ?? null,
+              sandboxRunId: workspace.sandboxRunId ?? null,
+            },
+          },
+          remoteType,
+          remoteWorkspaceId:
+            workspace.openworkWorkspaceId?.trim() ||
+            parseWorkspaceIdFromUrl(workspace.openworkHostUrl ?? null) ||
+            parseWorkspaceIdFromUrl(workspace.baseUrl ?? null),
+          serverAuth: Object.keys(auth).length > 0 ? auth : null,
+          serverBaseUrl: remoteServerBaseUrl,
+          serverHostingKind: detectRemoteHostingKind(remoteServerBaseUrl),
+          serverLabel: new URL(remoteServerBaseUrl).host,
+          workspaceStatus: "imported",
+        });
+        remoteImported += 1;
+        importedWorkspaceIds.push(record.id);
+      }
+
+      desktopWorkspaceReport.details = {
+        importedWorkspaceIds,
+        localImported,
+        remoteImported,
+        selectedWorkspaceId: parsed.selectedWorkspaceId?.trim() || parsed.activeId?.trim() || null,
+        watchedWorkspaceId: parsed.watchedWorkspaceId?.trim() || null,
+      };
+    } catch (error) {
+      desktopWorkspaceReport.status = "error";
+      desktopWorkspaceReport.details = {
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  const orchestratorStateFile = resolveExistingFile(
+    legacyOrchestratorDirCandidates(options.legacy?.orchestratorDataDir),
+    "openwork-orchestrator-state.json",
+  );
+  const orchestratorStateReport = !shouldImportLegacyWorkspaceState
+    ? createEmptyReport("skipped", orchestratorStateFile, {
+        completedAt: priorLegacyWorkspaceImportCompletedAt,
+        reason: "Legacy workspace import already completed on an earlier Server V2 startup.",
+      })
+    : orchestratorStateFile
+      ? createEmptyReport("imported", orchestratorStateFile)
+      : createEmptyReport("unavailable", null, { reason: "No legacy orchestrator state snapshot was found." });
+
+  if (shouldImportLegacyWorkspaceState && orchestratorStateFile) {
+    try {
+      const parsed = orchestratorStateSchema.parse(JSON.parse(readTextIfExists(orchestratorStateFile) ?? "{}"));
+      let importedWorkspaceCount = 0;
+      const importedWorkspaceIds: string[] = [];
+      for (const workspace of parsed.workspaces) {
+        if (workspace.workspaceType !== "local") {
+          continue;
+        }
+
+        const normalizedPath = normalizeWorkspacePath(workspace.path);
+        if (!normalizedPath) {
+          continue;
+        }
+
+        const record = registry.importLocalWorkspace({
+          dataDir: normalizedPath,
+          displayName: workspace.name?.trim() || path.basename(normalizedPath),
+          legacyNotes: {
+            legacyOrchestrator: {
+              baseUrl: workspace.baseUrl ?? null,
+              createdAt: fromUnixTimestamp(workspace.createdAt ?? null),
+              directory: workspace.directory ?? null,
+              lastUsedAt: fromUnixTimestamp(workspace.lastUsedAt ?? null),
+              legacyId: workspace.id,
+            },
+          },
+          status: "imported",
+        });
+        importedWorkspaceCount += 1;
+        importedWorkspaceIds.push(record.id);
+      }
+
+      const existingRuntimeState = repositories.serverRuntimeState.getByServerId(registry.localServerId);
+      repositories.serverRuntimeState.upsert({
+        health: {
+          ...(existingRuntimeState?.health ?? {}),
+          orchestrator: {
+            activeLegacyWorkspaceId: parsed.activeId?.trim() || null,
+            daemonBaseUrl: parsed.daemon?.baseUrl ?? null,
+            workspaceCount: parsed.workspaces.length,
+          },
+        },
+        lastExit: existingRuntimeState?.lastExit ?? null,
+        lastStartedAt: fromUnixTimestamp(parsed.daemon?.startedAt ?? parsed.opencode?.startedAt ?? null),
+        opencodeBaseUrl: parsed.opencode?.baseUrl ?? existingRuntimeState?.opencodeBaseUrl ?? null,
+        opencodeStatus: parsed.opencode ? "detected" : existingRuntimeState?.opencodeStatus ?? "unknown",
+        opencodeVersion:
+          parsed.binaries?.opencode?.actualVersion ?? parsed.cliVersion ?? existingRuntimeState?.opencodeVersion ?? null,
+        restartPolicy: existingRuntimeState?.restartPolicy ?? null,
+        routerStatus: existingRuntimeState?.routerStatus ?? "disabled",
+        routerVersion: existingRuntimeState?.routerVersion ?? null,
+        runtimeVersion: parsed.cliVersion ?? existingRuntimeState?.runtimeVersion ?? options.version,
+        serverId: registry.localServerId,
+      });
+
+      orchestratorStateReport.details = {
+        activeLegacyWorkspaceId: parsed.activeId?.trim() || null,
+        importedWorkspaceCount,
+        importedWorkspaceIds,
+        opencodeBaseUrl: parsed.opencode?.baseUrl ?? null,
+      };
+    } catch (error) {
+      orchestratorStateReport.status = "error";
+      orchestratorStateReport.details = {
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  const orchestratorAuthFile = resolveExistingFile(
+    legacyOrchestratorDirCandidates(options.legacy?.orchestratorDataDir),
+    "openwork-orchestrator-auth.json",
+  );
+  const orchestratorAuthReport = orchestratorAuthFile
+    ? createEmptyReport("skipped", orchestratorAuthFile)
+    : createEmptyReport("unavailable", null, { reason: "No legacy orchestrator auth snapshot was found." });
+
+  if (orchestratorAuthFile) {
+    try {
+      const parsed = orchestratorAuthSchema.parse(JSON.parse(readTextIfExists(orchestratorAuthFile) ?? "{}"));
+      const normalizedProjectDir = parsed.projectDir ? normalizeWorkspacePath(parsed.projectDir) : null;
+      const matchedWorkspace = normalizedProjectDir
+        ? repositories.workspaces
+            .list({ includeHidden: true })
+            .find((workspace) => workspace.dataDir === normalizedProjectDir)
+        : null;
+      orchestratorAuthReport.details = {
+        credentialsDetected: Boolean(parsed.opencodeUsername?.trim() || parsed.opencodePassword?.trim()),
+        matchedWorkspaceId: matchedWorkspace?.id ?? null,
+        projectDir: normalizedProjectDir,
+        updatedAt: fromUnixTimestamp(parsed.updatedAt ?? null),
+      };
+      orchestratorAuthReport.warnings.push(
+        "Legacy orchestrator OpenCode credentials were detected but were not imported because they are transitional host secrets, not durable Phase 2 registry state.",
+      );
+    } catch (error) {
+      orchestratorAuthReport.status = "error";
+      orchestratorAuthReport.details = {
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  const cloudSigninFile =
+    options.legacy?.cloudSigninPath?.trim() ||
+    resolveExistingFile(legacyDesktopDataDirCandidates(options.legacy?.desktopDataDir), "openwork-cloud-signin.json");
+  const cloudSigninReport = options.legacy?.cloudSigninJson?.trim() || cloudSigninFile
+    ? createEmptyReport("imported", cloudSigninFile ?? "env:OPENWORK_SERVER_V2_CLOUD_SIGNIN_JSON")
+    : createEmptyReport(
+        "unavailable",
+        null,
+        {
+          reason:
+            "No server-readable cloud signin snapshot was found. The current desktop app still persists cloud auth in browser localStorage, so later phases need an explicit handoff path.",
+        },
+      );
+
+  const cloudSigninRaw = options.legacy?.cloudSigninJson?.trim() || readTextIfExists(cloudSigninFile ?? null);
+  if (cloudSigninRaw) {
+    try {
+      const parsed = cloudSigninSchema.parse(JSON.parse(cloudSigninRaw));
+      const cloudBaseUrl = normalizeUrl(parsed.cloudBaseUrl ?? parsed.baseUrl ?? "");
+      if (!cloudBaseUrl) {
+        throw new Error("Cloud signin snapshot did not include a valid base URL.");
+      }
+
+      repositories.cloudSignin.upsert({
+        auth: parsed.authToken?.trim() ? { authToken: parsed.authToken.trim() } : null,
+        cloudBaseUrl,
+        id: "cloud_primary",
+        lastValidatedAt: parsed.lastValidatedAt?.trim() || null,
+        metadata: {
+          activeOrgName: parsed.activeOrgName?.trim() || null,
+          activeOrgSlug: parsed.activeOrgSlug?.trim() || null,
+        },
+        orgId: parsed.orgId?.trim() || parsed.activeOrgId?.trim() || null,
+        serverId: registry.localServerId,
+        userId: parsed.userId?.trim() || null,
+      });
+
+      cloudSigninReport.details = {
+        cloudBaseUrl,
+        imported: true,
+        orgId: parsed.orgId?.trim() || parsed.activeOrgId?.trim() || null,
+        userId: parsed.userId?.trim() || null,
+      };
+    } catch (error) {
+      cloudSigninReport.status = "error";
+      cloudSigninReport.details = {
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  const legacyWorkspaceImportCompletedAt = priorLegacyWorkspaceImportCompletedAt
+    ?? (desktopWorkspaceReport.status !== "error" && orchestratorStateReport.status !== "error"
+      ? new Date().toISOString()
+      : null);
+  const diagnostics: StartupDiagnostics = {
+    completedAt: new Date().toISOString(),
+    importReports: {
+      cloudSignin: cloudSigninReport,
+      desktopWorkspaceState: desktopWorkspaceReport,
+      orchestratorAuth: orchestratorAuthReport,
+      orchestratorState: orchestratorStateReport,
+    },
+    legacyWorkspaceImport: {
+      completedAt: legacyWorkspaceImportCompletedAt,
+      skipped: !shouldImportLegacyWorkspaceState,
+    },
+    mode,
+    migrations,
+    registry: {
+      hiddenWorkspaceIds: [controlWorkspace.id, helpWorkspace.id],
+      localServerCreated: localServer.created,
+      localServerId: localServer.server.id,
+      totalServers: repositories.servers.count(),
+      totalVisibleWorkspaces: repositories.workspaces.countVisible(),
+    },
+    warnings: [
+      ...desktopWorkspaceReport.warnings,
+      ...orchestratorStateReport.warnings,
+      ...orchestratorAuthReport.warnings,
+      ...cloudSigninReport.warnings,
+    ],
+    workingDirectory: {
+      databasePath: inMemory ? ":memory:" : workingDirectory.databasePath,
+      rootDir: workingDirectory.rootDir,
+      workspacesDir: workingDirectory.workspacesDir,
+    },
+  };
+
+  repositories.serverRuntimeState.upsert({
+    health: {
+      startup: diagnostics,
+    },
+    lastExit: existingRuntimeState?.lastExit ?? null,
+    lastStartedAt: existingRuntimeState?.lastStartedAt ?? null,
+    opencodeBaseUrl: existingRuntimeState?.opencodeBaseUrl ?? null,
+    opencodeStatus: existingRuntimeState?.opencodeStatus ?? "unknown",
+    opencodeVersion: existingRuntimeState?.opencodeVersion ?? options.version,
+    restartPolicy: existingRuntimeState?.restartPolicy ?? null,
+    routerStatus: existingRuntimeState?.routerStatus ?? "disabled",
+    routerVersion: existingRuntimeState?.routerVersion ?? null,
+    runtimeVersion: existingRuntimeState?.runtimeVersion ?? options.version,
+    serverId: registry.localServerId,
+  });
+
+  return {
+    close() {
+      database.close(false);
+    },
+    database,
+    diagnostics,
+    registry,
+    repositories,
+    workingDirectory,
+  };
+}
diff --git a/apps/server-v2/src/database/repositories.ts b/apps/server-v2/src/database/repositories.ts
new file mode 100644
index 0000000000..c0910408f7
--- /dev/null
+++ b/apps/server-v2/src/database/repositories.ts
@@ -0,0 +1,1072 @@
+import type { Database } from "bun:sqlite";
+import { parseJsonValue, stringifyJsonValue } from "./json.js";
+import type {
+  CloudSigninRecord,
+  ManagedConfigRecord,
+  RouterBindingRecord,
+  RouterIdentityRecord,
+  ServerConfigStateRecord,
+  ServerRecord,
+  ServerRuntimeStateRecord,
+  WorkspaceAssignmentRecord,
+  WorkspaceConfigStateRecord,
+  WorkspaceRecord,
+  WorkspaceRuntimeStateRecord,
+  WorkspaceShareRecord,
+} from "./types.js";
+
+function toBoolean(value: number | boolean | null | undefined) {
+  return Boolean(value);
+}
+
+function toSqlBoolean(value: boolean) {
+  return value ? 1 : 0;
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+type RawServerRow = {
+  auth_json: string | null;
+  base_url: string | null;
+  capabilities_json: string;
+  created_at: string;
+  hosting_kind: ServerRecord["hostingKind"];
+  id: string;
+  is_enabled: number;
+  is_local: number;
+  kind: ServerRecord["kind"];
+  label: string;
+  last_seen_at: string | null;
+  notes_json: string | null;
+  source: string;
+  updated_at: string;
+};
+
+type RawWorkspaceRow = {
+  config_dir: string | null;
+  created_at: string;
+  data_dir: string | null;
+  display_name: string;
+  id: string;
+  is_hidden: number;
+  kind: WorkspaceRecord["kind"];
+  notes_json: string | null;
+  opencode_project_id: string | null;
+  remote_workspace_id: string | null;
+  server_id: string;
+  slug: string;
+  status: WorkspaceRecord["status"];
+  updated_at: string;
+};
+
+type RawServerRuntimeStateRow = {
+  health_json: string | null;
+  last_exit_json: string | null;
+  last_started_at: string | null;
+  opencode_base_url: string | null;
+  opencode_status: string;
+  opencode_version: string | null;
+  restart_policy_json: string | null;
+  router_status: string;
+  router_version: string | null;
+  runtime_version: string | null;
+  server_id: string;
+  updated_at: string;
+};
+
+type RawWorkspaceRuntimeStateRow = {
+  backend_kind: WorkspaceRuntimeStateRecord["backendKind"];
+  health_json: string | null;
+  last_error_json: string | null;
+  last_session_refresh_at: string | null;
+  last_sync_at: string | null;
+  updated_at: string;
+  workspace_id: string;
+};
+
+type RawServerConfigStateRow = {
+  opencode_json: string;
+  server_id: string;
+  updated_at: string;
+};
+
+type RawWorkspaceConfigStateRow = {
+  openwork_json: string;
+  opencode_json: string;
+  updated_at: string;
+  workspace_id: string;
+};
+
+type RawManagedConfigRow = {
+  auth_json: string | null;
+  cloud_item_id: string | null;
+  config_json: string;
+  created_at: string;
+  display_name: string;
+  id: string;
+  item_key: string | null;
+  metadata_json: string | null;
+  source: ManagedConfigRecord["source"];
+  updated_at: string;
+};
+
+type RawCloudSigninRow = {
+  auth_json: string | null;
+  cloud_base_url: string;
+  created_at: string;
+  id: string;
+  last_validated_at: string | null;
+  metadata_json: string | null;
+  org_id: string | null;
+  server_id: string;
+  updated_at: string;
+  user_id: string | null;
+};
+
+type RawWorkspaceShareRow = {
+  access_key: string | null;
+  audit_json: string | null;
+  created_at: string;
+  id: string;
+  last_used_at: string | null;
+  revoked_at: string | null;
+  status: WorkspaceShareRecord["status"];
+  updated_at: string;
+  workspace_id: string;
+};
+
+type RawRouterIdentityRow = {
+  auth_json: string | null;
+  config_json: string;
+  created_at: string;
+  display_name: string;
+  id: string;
+  is_enabled: number;
+  kind: string;
+  server_id: string;
+  updated_at: string;
+};
+
+type RawRouterBindingRow = {
+  binding_key: string;
+  config_json: string;
+  created_at: string;
+  id: string;
+  is_enabled: number;
+  router_identity_id: string;
+  server_id: string;
+  updated_at: string;
+};
+
+function mapServer(row: RawServerRow | null | undefined): ServerRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    auth: parseJsonValue(row.auth_json, null),
+    baseUrl: row.base_url,
+    capabilities: parseJsonValue(row.capabilities_json, {}),
+    createdAt: row.created_at,
+    hostingKind: row.hosting_kind,
+    id: row.id,
+    isEnabled: toBoolean(row.is_enabled),
+    isLocal: toBoolean(row.is_local),
+    kind: row.kind,
+    label: row.label,
+    lastSeenAt: row.last_seen_at,
+    notes: parseJsonValue(row.notes_json, null),
+    source: row.source,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapWorkspace(row: RawWorkspaceRow | null | undefined): WorkspaceRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    configDir: row.config_dir,
+    createdAt: row.created_at,
+    dataDir: row.data_dir,
+    displayName: row.display_name,
+    id: row.id,
+    isHidden: toBoolean(row.is_hidden),
+    kind: row.kind,
+    notes: parseJsonValue(row.notes_json, null),
+    opencodeProjectId: row.opencode_project_id,
+    remoteWorkspaceId: row.remote_workspace_id,
+    serverId: row.server_id,
+    slug: row.slug,
+    status: row.status,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapServerRuntimeState(row: RawServerRuntimeStateRow | null | undefined): ServerRuntimeStateRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    health: parseJsonValue(row.health_json, null),
+    lastExit: parseJsonValue(row.last_exit_json, null),
+    lastStartedAt: row.last_started_at,
+    opencodeBaseUrl: row.opencode_base_url,
+    opencodeStatus: row.opencode_status,
+    opencodeVersion: row.opencode_version,
+    restartPolicy: parseJsonValue(row.restart_policy_json, null),
+    routerStatus: row.router_status,
+    routerVersion: row.router_version,
+    runtimeVersion: row.runtime_version,
+    serverId: row.server_id,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapWorkspaceRuntimeState(row: RawWorkspaceRuntimeStateRow | null | undefined): WorkspaceRuntimeStateRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    backendKind: row.backend_kind,
+    health: parseJsonValue(row.health_json, null),
+    lastError: parseJsonValue(row.last_error_json, null),
+    lastSessionRefreshAt: row.last_session_refresh_at,
+    lastSyncAt: row.last_sync_at,
+    updatedAt: row.updated_at,
+    workspaceId: row.workspace_id,
+  };
+}
+
+function mapServerConfigState(row: RawServerConfigStateRow | null | undefined): ServerConfigStateRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    opencode: parseJsonValue(row.opencode_json, {}),
+    serverId: row.server_id,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapWorkspaceConfigState(row: RawWorkspaceConfigStateRow | null | undefined): WorkspaceConfigStateRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    openwork: parseJsonValue(row.openwork_json, {}),
+    opencode: parseJsonValue(row.opencode_json, {}),
+    updatedAt: row.updated_at,
+    workspaceId: row.workspace_id,
+  };
+}
+
+function mapManagedConfig(row: RawManagedConfigRow | null | undefined): ManagedConfigRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    auth: parseJsonValue(row.auth_json, null),
+    cloudItemId: row.cloud_item_id,
+    config: parseJsonValue(row.config_json, {}),
+    createdAt: row.created_at,
+    displayName: row.display_name,
+    id: row.id,
+    key: row.item_key,
+    metadata: parseJsonValue(row.metadata_json, null),
+    source: row.source,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapCloudSignin(row: RawCloudSigninRow | null | undefined): CloudSigninRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    auth: parseJsonValue(row.auth_json, null),
+    cloudBaseUrl: row.cloud_base_url,
+    createdAt: row.created_at,
+    id: row.id,
+    lastValidatedAt: row.last_validated_at,
+    metadata: parseJsonValue(row.metadata_json, null),
+    orgId: row.org_id,
+    serverId: row.server_id,
+    updatedAt: row.updated_at,
+    userId: row.user_id,
+  };
+}
+
+function mapWorkspaceShare(row: RawWorkspaceShareRow | null | undefined): WorkspaceShareRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    accessKey: row.access_key,
+    audit: parseJsonValue(row.audit_json, null),
+    createdAt: row.created_at,
+    id: row.id,
+    lastUsedAt: row.last_used_at,
+    revokedAt: row.revoked_at,
+    status: row.status,
+    updatedAt: row.updated_at,
+    workspaceId: row.workspace_id,
+  };
+}
+
+function mapRouterIdentity(row: RawRouterIdentityRow | null | undefined): RouterIdentityRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    auth: parseJsonValue(row.auth_json, null),
+    config: parseJsonValue(row.config_json, {}),
+    createdAt: row.created_at,
+    displayName: row.display_name,
+    id: row.id,
+    isEnabled: toBoolean(row.is_enabled),
+    kind: row.kind,
+    serverId: row.server_id,
+    updatedAt: row.updated_at,
+  };
+}
+
+function mapRouterBinding(row: RawRouterBindingRow | null | undefined): RouterBindingRecord | null {
+  if (!row) {
+    return null;
+  }
+
+  return {
+    bindingKey: row.binding_key,
+    config: parseJsonValue(row.config_json, {}),
+    createdAt: row.created_at,
+    id: row.id,
+    isEnabled: toBoolean(row.is_enabled),
+    routerIdentityId: row.router_identity_id,
+    serverId: row.server_id,
+    updatedAt: row.updated_at,
+  };
+}
+
+export class ServersRepository {
+  constructor(private readonly database: Database) {}
+
+  getById(id: string) {
+    return mapServer(this.database.query("SELECT * FROM servers WHERE id = ?1").get(id) as RawServerRow | null);
+  }
+
+  list() {
+    return (this.database.query("SELECT * FROM servers ORDER BY is_local DESC, updated_at DESC").all() as RawServerRow[]).map(mapServer).filter(Boolean) as ServerRecord[];
+  }
+
+  count() {
+    const row = this.database.query("SELECT COUNT(1) AS count FROM servers").get() as { count?: number } | null;
+    return row?.count ?? 0;
+  }
+
+  upsert(input: Omit<ServerRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO servers (
+            id, kind, hosting_kind, label, base_url, auth_json, capabilities_json, is_local,
+            is_enabled, source, notes_json, created_at, updated_at, last_seen_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14)
+          ON CONFLICT(id) DO UPDATE SET
+            kind = excluded.kind,
+            hosting_kind = excluded.hosting_kind,
+            label = excluded.label,
+            base_url = excluded.base_url,
+            auth_json = excluded.auth_json,
+            capabilities_json = excluded.capabilities_json,
+            is_local = excluded.is_local,
+            is_enabled = excluded.is_enabled,
+            source = excluded.source,
+            notes_json = excluded.notes_json,
+            updated_at = excluded.updated_at,
+            last_seen_at = excluded.last_seen_at
+        `,
+      )
+      .run(
+        input.id,
+        input.kind,
+        input.hostingKind,
+        input.label,
+        input.baseUrl,
+        stringifyJsonValue(input.auth),
+        stringifyJsonValue(input.capabilities),
+        toSqlBoolean(input.isLocal),
+        toSqlBoolean(input.isEnabled),
+        input.source,
+        stringifyJsonValue(input.notes),
+        createdAt,
+        updatedAt,
+        input.lastSeenAt,
+      );
+
+    return this.getById(input.id)!;
+  }
+}
+
+export class WorkspacesRepository {
+  constructor(private readonly database: Database) {}
+
+  deleteById(id: string) {
+    const existing = this.getById(id);
+    if (!existing) {
+      return false;
+    }
+    this.database.query("DELETE FROM workspaces WHERE id = ?1").run(id);
+    return true;
+  }
+
+  getById(id: string) {
+    return mapWorkspace(this.database.query("SELECT * FROM workspaces WHERE id = ?1").get(id) as RawWorkspaceRow | null);
+  }
+
+  getBySlug(slug: string) {
+    return mapWorkspace(this.database.query("SELECT * FROM workspaces WHERE slug = ?1").get(slug) as RawWorkspaceRow | null);
+  }
+
+  list(input?: { includeHidden?: boolean }) {
+    const includeHidden = input?.includeHidden ?? false;
+    const query = includeHidden
+      ? "SELECT * FROM workspaces ORDER BY is_hidden ASC, display_name COLLATE NOCASE ASC"
+      : "SELECT * FROM workspaces WHERE is_hidden = 0 ORDER BY display_name COLLATE NOCASE ASC";
+    return (this.database.query(query).all() as RawWorkspaceRow[]).map(mapWorkspace).filter(Boolean) as WorkspaceRecord[];
+  }
+
+  listByServerId(serverId: string, input?: { includeHidden?: boolean }) {
+    const includeHidden = input?.includeHidden ?? false;
+    const query = includeHidden
+      ? "SELECT * FROM workspaces WHERE server_id = ?1 ORDER BY is_hidden ASC, display_name COLLATE NOCASE ASC"
+      : "SELECT * FROM workspaces WHERE server_id = ?1 AND is_hidden = 0 ORDER BY display_name COLLATE NOCASE ASC";
+    return (this.database.query(query).all(serverId) as RawWorkspaceRow[]).map(mapWorkspace).filter(Boolean) as WorkspaceRecord[];
+  }
+
+  countVisible() {
+    const row = this.database.query("SELECT COUNT(1) AS count FROM workspaces WHERE is_hidden = 0").get() as { count?: number } | null;
+    return row?.count ?? 0;
+  }
+
+  findSlugConflict(slug: string, excludeWorkspaceId?: string) {
+    const row = excludeWorkspaceId
+      ? (this.database
+          .query("SELECT * FROM workspaces WHERE slug = ?1 AND id != ?2")
+          .get(slug, excludeWorkspaceId) as RawWorkspaceRow | null)
+      : (this.database.query("SELECT * FROM workspaces WHERE slug = ?1").get(slug) as RawWorkspaceRow | null);
+    return mapWorkspace(row);
+  }
+
+  upsert(input: Omit<WorkspaceRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO workspaces (
+            id, server_id, kind, display_name, slug, is_hidden, status, opencode_project_id,
+            remote_workspace_id, data_dir, config_dir, notes_json, created_at, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14)
+          ON CONFLICT(id) DO UPDATE SET
+            server_id = excluded.server_id,
+            kind = excluded.kind,
+            display_name = excluded.display_name,
+            slug = excluded.slug,
+            is_hidden = excluded.is_hidden,
+            status = excluded.status,
+            opencode_project_id = excluded.opencode_project_id,
+            remote_workspace_id = excluded.remote_workspace_id,
+            data_dir = excluded.data_dir,
+            config_dir = excluded.config_dir,
+            notes_json = excluded.notes_json,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.id,
+        input.serverId,
+        input.kind,
+        input.displayName,
+        input.slug,
+        toSqlBoolean(input.isHidden),
+        input.status,
+        input.opencodeProjectId,
+        input.remoteWorkspaceId,
+        input.dataDir,
+        input.configDir,
+        stringifyJsonValue(input.notes),
+        createdAt,
+        updatedAt,
+      );
+    return this.getById(input.id)!;
+  }
+}
+
+export class ServerRuntimeStateRepository {
+  constructor(private readonly database: Database) {}
+
+  getByServerId(serverId: string) {
+    return mapServerRuntimeState(
+      this.database.query("SELECT * FROM server_runtime_state WHERE server_id = ?1").get(serverId) as RawServerRuntimeStateRow | null,
+    );
+  }
+
+  upsert(input: Omit<ServerRuntimeStateRecord, "updatedAt"> & { updatedAt?: string }) {
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO server_runtime_state (
+            server_id, runtime_version, opencode_status, opencode_version, opencode_base_url,
+            router_status, router_version, restart_policy_json, last_started_at, last_exit_json,
+            health_json, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)
+          ON CONFLICT(server_id) DO UPDATE SET
+            runtime_version = excluded.runtime_version,
+            opencode_status = excluded.opencode_status,
+            opencode_version = excluded.opencode_version,
+            opencode_base_url = excluded.opencode_base_url,
+            router_status = excluded.router_status,
+            router_version = excluded.router_version,
+            restart_policy_json = excluded.restart_policy_json,
+            last_started_at = excluded.last_started_at,
+            last_exit_json = excluded.last_exit_json,
+            health_json = excluded.health_json,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.serverId,
+        input.runtimeVersion,
+        input.opencodeStatus,
+        input.opencodeVersion,
+        input.opencodeBaseUrl,
+        input.routerStatus,
+        input.routerVersion,
+        stringifyJsonValue(input.restartPolicy),
+        input.lastStartedAt,
+        stringifyJsonValue(input.lastExit),
+        stringifyJsonValue(input.health),
+        updatedAt,
+      );
+    return this.getByServerId(input.serverId)!;
+  }
+}
+
+export class WorkspaceRuntimeStateRepository {
+  constructor(private readonly database: Database) {}
+
+  getByWorkspaceId(workspaceId: string) {
+    return mapWorkspaceRuntimeState(
+      this.database.query("SELECT * FROM workspace_runtime_state WHERE workspace_id = ?1").get(workspaceId) as RawWorkspaceRuntimeStateRow | null,
+    );
+  }
+
+  upsert(input: Omit<WorkspaceRuntimeStateRecord, "updatedAt"> & { updatedAt?: string }) {
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO workspace_runtime_state (
+            workspace_id, backend_kind, last_sync_at, last_session_refresh_at, last_error_json,
+            health_json, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+          ON CONFLICT(workspace_id) DO UPDATE SET
+            backend_kind = excluded.backend_kind,
+            last_sync_at = excluded.last_sync_at,
+            last_session_refresh_at = excluded.last_session_refresh_at,
+            last_error_json = excluded.last_error_json,
+            health_json = excluded.health_json,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.workspaceId,
+        input.backendKind,
+        input.lastSyncAt,
+        input.lastSessionRefreshAt,
+        stringifyJsonValue(input.lastError),
+        stringifyJsonValue(input.health),
+        updatedAt,
+      );
+    return this.getByWorkspaceId(input.workspaceId)!;
+  }
+}
+
+export class ServerConfigStateRepository {
+  constructor(private readonly database: Database) {}
+
+  getByServerId(serverId: string) {
+    return mapServerConfigState(
+      this.database.query("SELECT * FROM server_config_state WHERE server_id = ?1").get(serverId) as RawServerConfigStateRow | null,
+    );
+  }
+
+  upsert(input: Omit<ServerConfigStateRecord, "updatedAt"> & { updatedAt?: string }) {
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO server_config_state (server_id, opencode_json, updated_at)
+          VALUES (?1, ?2, ?3)
+          ON CONFLICT(server_id) DO UPDATE SET
+            opencode_json = excluded.opencode_json,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(input.serverId, stringifyJsonValue(input.opencode), updatedAt);
+    return this.getByServerId(input.serverId)!;
+  }
+}
+
+export class WorkspaceConfigStateRepository {
+  constructor(private readonly database: Database) {}
+
+  getByWorkspaceId(workspaceId: string) {
+    return mapWorkspaceConfigState(
+      this.database.query("SELECT * FROM workspace_config_state WHERE workspace_id = ?1").get(workspaceId) as RawWorkspaceConfigStateRow | null,
+    );
+  }
+
+  upsert(input: Omit<WorkspaceConfigStateRecord, "updatedAt"> & { updatedAt?: string }) {
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO workspace_config_state (workspace_id, openwork_json, opencode_json, updated_at)
+          VALUES (?1, ?2, ?3, ?4)
+          ON CONFLICT(workspace_id) DO UPDATE SET
+            openwork_json = excluded.openwork_json,
+            opencode_json = excluded.opencode_json,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.workspaceId,
+        stringifyJsonValue(input.openwork),
+        stringifyJsonValue(input.opencode),
+        updatedAt,
+      );
+    return this.getByWorkspaceId(input.workspaceId)!;
+  }
+}
+
+export class ManagedConfigRepository {
+  constructor(
+    private readonly database: Database,
+    private readonly tableName: "mcps" | "skills" | "plugins" | "provider_configs",
+  ) {}
+
+  getById(id: string) {
+    return mapManagedConfig(
+      this.database.query(`SELECT * FROM ${this.tableName} WHERE id = ?1`).get(id) as RawManagedConfigRow | null,
+    );
+  }
+
+  findByKey(key: string) {
+    return (this.database
+      .query(`SELECT * FROM ${this.tableName} WHERE item_key = ?1 ORDER BY updated_at DESC`)
+      .all(key) as RawManagedConfigRow[]).map(mapManagedConfig).filter(Boolean) as ManagedConfigRecord[];
+  }
+
+  list() {
+    return (this.database
+      .query(`SELECT * FROM ${this.tableName} ORDER BY updated_at DESC`)
+      .all() as RawManagedConfigRow[]).map(mapManagedConfig).filter(Boolean) as ManagedConfigRecord[];
+  }
+
+  deleteById(id: string) {
+    const existing = this.getById(id);
+    if (!existing) {
+      return false;
+    }
+    this.database.query(`DELETE FROM ${this.tableName} WHERE id = ?1`).run(id);
+    return true;
+  }
+
+  upsert(input: Omit<ManagedConfigRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    const itemKind = this.tableName === "mcps"
+      ? "mcp"
+      : this.tableName === "plugins"
+        ? "plugin"
+        : this.tableName === "provider_configs"
+          ? "provider"
+          : "skill";
+    this.database
+      .query(
+        `
+          INSERT INTO ${this.tableName} (
+            id, item_kind, display_name, item_key, config_json, auth_json, metadata_json,
+            source, cloud_item_id, created_at, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)
+          ON CONFLICT(id) DO UPDATE SET
+            item_kind = excluded.item_kind,
+            display_name = excluded.display_name,
+            item_key = excluded.item_key,
+            config_json = excluded.config_json,
+            auth_json = excluded.auth_json,
+            metadata_json = excluded.metadata_json,
+            source = excluded.source,
+            cloud_item_id = excluded.cloud_item_id,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.id,
+        itemKind,
+        input.displayName,
+        input.key,
+        stringifyJsonValue(input.config),
+        stringifyJsonValue(input.auth),
+        stringifyJsonValue(input.metadata),
+        input.source,
+        input.cloudItemId,
+        createdAt,
+        updatedAt,
+      );
+    return this.getById(input.id)!;
+  }
+}
+
+export class WorkspaceAssignmentRepository {
+  constructor(
+    private readonly database: Database,
+    private readonly tableName:
+      | "workspace_mcps"
+      | "workspace_skills"
+      | "workspace_plugins"
+      | "workspace_provider_configs",
+  ) {}
+
+  listForWorkspace(workspaceId: string) {
+    return (this.database
+      .query(`SELECT workspace_id, item_id, created_at, updated_at FROM ${this.tableName} WHERE workspace_id = ?1`)
+      .all(workspaceId) as Array<{
+      created_at: string;
+      item_id: string;
+      updated_at: string;
+      workspace_id: string;
+    }>).map((row) => ({
+      createdAt: row.created_at,
+      itemId: row.item_id,
+      updatedAt: row.updated_at,
+      workspaceId: row.workspace_id,
+    })) as WorkspaceAssignmentRecord[];
+  }
+
+  listForItem(itemId: string) {
+    return (this.database
+      .query(`SELECT workspace_id, item_id, created_at, updated_at FROM ${this.tableName} WHERE item_id = ?1`)
+      .all(itemId) as Array<{
+      created_at: string;
+      item_id: string;
+      updated_at: string;
+      workspace_id: string;
+    }>).map((row) => ({
+      createdAt: row.created_at,
+      itemId: row.item_id,
+      updatedAt: row.updated_at,
+      workspaceId: row.workspace_id,
+    })) as WorkspaceAssignmentRecord[];
+  }
+
+  deleteForItem(itemId: string) {
+    this.database.query(`DELETE FROM ${this.tableName} WHERE item_id = ?1`).run(itemId);
+  }
+
+  replaceAssignments(workspaceId: string, itemIds: string[]) {
+    const replace = this.database.transaction((nextItemIds: string[]) => {
+      this.database.query(`DELETE FROM ${this.tableName} WHERE workspace_id = ?1`).run(workspaceId);
+      const timestamp = nowIso();
+      const insert = this.database.query(
+        `INSERT INTO ${this.tableName} (workspace_id, item_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4)`,
+      );
+      for (const itemId of nextItemIds) {
+        insert.run(workspaceId, itemId, timestamp, timestamp);
+      }
+    });
+
+    replace(itemIds);
+    return this.listForWorkspace(workspaceId);
+  }
+}
+
+export class CloudSigninRepository {
+  constructor(private readonly database: Database) {}
+
+  getPrimary() {
+    return mapCloudSignin(this.database.query("SELECT * FROM cloud_signin LIMIT 1").get() as RawCloudSigninRow | null);
+  }
+
+  upsert(input: Omit<CloudSigninRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO cloud_signin (
+            id, server_id, cloud_base_url, user_id, org_id, auth_json, metadata_json,
+            last_validated_at, created_at, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+          ON CONFLICT(id) DO UPDATE SET
+            server_id = excluded.server_id,
+            cloud_base_url = excluded.cloud_base_url,
+            user_id = excluded.user_id,
+            org_id = excluded.org_id,
+            auth_json = excluded.auth_json,
+            metadata_json = excluded.metadata_json,
+            last_validated_at = excluded.last_validated_at,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.id,
+        input.serverId,
+        input.cloudBaseUrl,
+        input.userId,
+        input.orgId,
+        stringifyJsonValue(input.auth),
+        stringifyJsonValue(input.metadata),
+        input.lastValidatedAt,
+        createdAt,
+        updatedAt,
+      );
+    return this.getPrimary()!;
+  }
+
+  deletePrimary() {
+    this.database.query("DELETE FROM cloud_signin").run();
+  }
+}
+
+export class WorkspaceSharesRepository {
+  constructor(private readonly database: Database) {}
+
+  getById(id: string) {
+    return mapWorkspaceShare(this.database.query("SELECT * FROM workspace_shares WHERE id = ?1").get(id) as RawWorkspaceShareRow | null);
+  }
+
+  listByWorkspace(workspaceId: string) {
+    return (this.database
+      .query("SELECT * FROM workspace_shares WHERE workspace_id = ?1 ORDER BY updated_at DESC")
+      .all(workspaceId) as RawWorkspaceShareRow[]).map(mapWorkspaceShare).filter(Boolean) as WorkspaceShareRecord[];
+  }
+
+  getLatestByWorkspace(workspaceId: string) {
+    return mapWorkspaceShare(
+      this.database.query("SELECT * FROM workspace_shares WHERE workspace_id = ?1 ORDER BY updated_at DESC LIMIT 1").get(workspaceId) as RawWorkspaceShareRow | null,
+    );
+  }
+
+  upsert(input: Omit<WorkspaceShareRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO workspace_shares (
+            id, workspace_id, access_key, status, last_used_at, audit_json, created_at, updated_at, revoked_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+          ON CONFLICT(id) DO UPDATE SET
+            workspace_id = excluded.workspace_id,
+            access_key = excluded.access_key,
+            status = excluded.status,
+            last_used_at = excluded.last_used_at,
+            audit_json = excluded.audit_json,
+            updated_at = excluded.updated_at,
+            revoked_at = excluded.revoked_at
+        `,
+      )
+      .run(
+        input.id,
+        input.workspaceId,
+        input.accessKey,
+        input.status,
+        input.lastUsedAt,
+        stringifyJsonValue(input.audit),
+        createdAt,
+        updatedAt,
+        input.revokedAt,
+      );
+    return this.listByWorkspace(input.workspaceId).find((item) => item.id === input.id)!;
+  }
+}
+
+export class RouterIdentitiesRepository {
+  constructor(private readonly database: Database) {}
+
+  getById(id: string) {
+    return mapRouterIdentity(this.database.query("SELECT * FROM router_identities WHERE id = ?1").get(id) as RawRouterIdentityRow | null);
+  }
+
+  listByServer(serverId: string) {
+    return (this.database
+      .query("SELECT * FROM router_identities WHERE server_id = ?1 ORDER BY updated_at DESC")
+      .all(serverId) as RawRouterIdentityRow[]).map(mapRouterIdentity).filter(Boolean) as RouterIdentityRecord[];
+  }
+
+  deleteById(id: string) {
+    const existing = this.getById(id);
+    if (!existing) {
+      return false;
+    }
+    this.database.query("DELETE FROM router_identities WHERE id = ?1").run(id);
+    return true;
+  }
+
+  upsert(input: Omit<RouterIdentityRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO router_identities (
+            id, server_id, kind, display_name, config_json, auth_json, is_enabled, created_at, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+          ON CONFLICT(id) DO UPDATE SET
+            server_id = excluded.server_id,
+            kind = excluded.kind,
+            display_name = excluded.display_name,
+            config_json = excluded.config_json,
+            auth_json = excluded.auth_json,
+            is_enabled = excluded.is_enabled,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.id,
+        input.serverId,
+        input.kind,
+        input.displayName,
+        stringifyJsonValue(input.config),
+        stringifyJsonValue(input.auth),
+        toSqlBoolean(input.isEnabled),
+        createdAt,
+        updatedAt,
+      );
+    return this.listByServer(input.serverId).find((item) => item.id === input.id)!;
+  }
+}
+
+export class RouterBindingsRepository {
+  constructor(private readonly database: Database) {}
+
+  getById(id: string) {
+    return mapRouterBinding(this.database.query("SELECT * FROM router_bindings WHERE id = ?1").get(id) as RawRouterBindingRow | null);
+  }
+
+  listByServer(serverId: string) {
+    return (this.database
+      .query("SELECT * FROM router_bindings WHERE server_id = ?1 ORDER BY updated_at DESC")
+      .all(serverId) as RawRouterBindingRow[]).map(mapRouterBinding).filter(Boolean) as RouterBindingRecord[];
+  }
+
+  deleteById(id: string) {
+    const existing = this.getById(id);
+    if (!existing) {
+      return false;
+    }
+    this.database.query("DELETE FROM router_bindings WHERE id = ?1").run(id);
+    return true;
+  }
+
+  upsert(input: Omit<RouterBindingRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+    const createdAt = input.createdAt ?? nowIso();
+    const updatedAt = input.updatedAt ?? nowIso();
+    this.database
+      .query(
+        `
+          INSERT INTO router_bindings (
+            id, server_id, router_identity_id, binding_key, config_json, is_enabled, created_at, updated_at
+          )
+          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
+          ON CONFLICT(id) DO UPDATE SET
+            server_id = excluded.server_id,
+            router_identity_id = excluded.router_identity_id,
+            binding_key = excluded.binding_key,
+            config_json = excluded.config_json,
+            is_enabled = excluded.is_enabled,
+            updated_at = excluded.updated_at
+        `,
+      )
+      .run(
+        input.id,
+        input.serverId,
+        input.routerIdentityId,
+        input.bindingKey,
+        stringifyJsonValue(input.config),
+        toSqlBoolean(input.isEnabled),
+        createdAt,
+        updatedAt,
+      );
+    return this.listByServer(input.serverId).find((item) => item.id === input.id)!;
+  }
+}
+
+export type ServerRepositories = {
+  cloudSignin: CloudSigninRepository;
+  mcps: ManagedConfigRepository;
+  plugins: ManagedConfigRepository;
+  providerConfigs: ManagedConfigRepository;
+  routerBindings: RouterBindingsRepository;
+  routerIdentities: RouterIdentitiesRepository;
+  serverConfigState: ServerConfigStateRepository;
+  serverRuntimeState: ServerRuntimeStateRepository;
+  servers: ServersRepository;
+  skills: ManagedConfigRepository;
+  workspaceConfigState: WorkspaceConfigStateRepository;
+  workspaceMcps: WorkspaceAssignmentRepository;
+  workspacePlugins: WorkspaceAssignmentRepository;
+  workspaceProviderConfigs: WorkspaceAssignmentRepository;
+  workspaceRuntimeState: WorkspaceRuntimeStateRepository;
+  workspaceShares: WorkspaceSharesRepository;
+  workspaceSkills: WorkspaceAssignmentRepository;
+  workspaces: WorkspacesRepository;
+};
+
+export function createRepositories(database: Database): ServerRepositories {
+  return {
+    cloudSignin: new CloudSigninRepository(database),
+    mcps: new ManagedConfigRepository(database, "mcps"),
+    plugins: new ManagedConfigRepository(database, "plugins"),
+    providerConfigs: new ManagedConfigRepository(database, "provider_configs"),
+    routerBindings: new RouterBindingsRepository(database),
+    routerIdentities: new RouterIdentitiesRepository(database),
+    serverConfigState: new ServerConfigStateRepository(database),
+    serverRuntimeState: new ServerRuntimeStateRepository(database),
+    servers: new ServersRepository(database),
+    skills: new ManagedConfigRepository(database, "skills"),
+    workspaceConfigState: new WorkspaceConfigStateRepository(database),
+    workspaceMcps: new WorkspaceAssignmentRepository(database, "workspace_mcps"),
+    workspacePlugins: new WorkspaceAssignmentRepository(database, "workspace_plugins"),
+    workspaceProviderConfigs: new WorkspaceAssignmentRepository(database, "workspace_provider_configs"),
+    workspaceRuntimeState: new WorkspaceRuntimeStateRepository(database),
+    workspaceShares: new WorkspaceSharesRepository(database),
+    workspaceSkills: new WorkspaceAssignmentRepository(database, "workspace_skills"),
+    workspaces: new WorkspacesRepository(database),
+  };
+}
diff --git a/apps/server-v2/src/database/status-provider.ts b/apps/server-v2/src/database/status-provider.ts
new file mode 100644
index 0000000000..ed3ebb0dc4
--- /dev/null
+++ b/apps/server-v2/src/database/status-provider.ts
@@ -0,0 +1,54 @@
+import type { StartupDiagnostics } from "./types.js";
+
+export type DatabaseStatus = {
+  bootstrapMode: "fresh" | "existing";
+  configured: true;
+  importWarnings: number;
+  kind: "sqlite";
+  migrations: {
+    appliedThisRun: string[];
+    currentVersion: string;
+    totalApplied: number;
+  };
+  path: string;
+  phaseOwner: 2;
+  status: "ready" | "warning";
+  summary: string;
+  workingDirectory: string;
+};
+
+export type DatabaseStatusProvider = {
+  getStartupDiagnostics(): StartupDiagnostics;
+  getStatus(): DatabaseStatus;
+};
+
+export function createSqliteDatabaseStatusProvider(input: { diagnostics: StartupDiagnostics }): DatabaseStatusProvider {
+  return {
+    getStartupDiagnostics() {
+      return input.diagnostics;
+    },
+
+    getStatus() {
+      const warningCount = input.diagnostics.warnings.length;
+      const appliedThisRun = input.diagnostics.migrations.applied;
+      const totalVisibleWorkspaces = input.diagnostics.registry.totalVisibleWorkspaces;
+      const totalServers = input.diagnostics.registry.totalServers;
+      return {
+        bootstrapMode: input.diagnostics.mode,
+        configured: true,
+        importWarnings: warningCount,
+        kind: "sqlite",
+        migrations: {
+          appliedThisRun,
+          currentVersion: input.diagnostics.migrations.currentVersion,
+          totalApplied: input.diagnostics.migrations.totalApplied,
+        },
+        path: input.diagnostics.workingDirectory.databasePath,
+        phaseOwner: 2,
+        status: warningCount > 0 ? "warning" : "ready",
+        summary: `SQLite ready with ${totalServers} server record(s), ${totalVisibleWorkspaces} visible workspace(s), and ${warningCount} import warning(s).`,
+        workingDirectory: input.diagnostics.workingDirectory.rootDir,
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/database/types.ts b/apps/server-v2/src/database/types.ts
new file mode 100644
index 0000000000..c2fc9b7f17
--- /dev/null
+++ b/apps/server-v2/src/database/types.ts
@@ -0,0 +1,199 @@
+export type ServerKind = "local" | "remote";
+export type HostingKind = "desktop" | "self_hosted" | "cloud";
+export type WorkspaceKind = "local" | "remote" | "control" | "help";
+export type WorkspaceStatus = "ready" | "imported" | "attention";
+export type BackendKind = "local_opencode" | "remote_openwork";
+export type ImportStatus = "error" | "imported" | "skipped" | "unavailable";
+
+export type JsonObject = Record<string, unknown>;
+
+export type ServerRecord = {
+  auth: JsonObject | null;
+  baseUrl: string | null;
+  capabilities: JsonObject;
+  createdAt: string;
+  hostingKind: HostingKind;
+  id: string;
+  isEnabled: boolean;
+  isLocal: boolean;
+  kind: ServerKind;
+  label: string;
+  lastSeenAt: string | null;
+  notes: JsonObject | null;
+  source: string;
+  updatedAt: string;
+};
+
+export type WorkspaceRecord = {
+  configDir: string | null;
+  createdAt: string;
+  dataDir: string | null;
+  displayName: string;
+  id: string;
+  isHidden: boolean;
+  kind: WorkspaceKind;
+  notes: JsonObject | null;
+  opencodeProjectId: string | null;
+  remoteWorkspaceId: string | null;
+  serverId: string;
+  slug: string;
+  status: WorkspaceStatus;
+  updatedAt: string;
+};
+
+export type ServerRuntimeStateRecord = {
+  health: JsonObject | null;
+  lastExit: JsonObject | null;
+  lastStartedAt: string | null;
+  opencodeBaseUrl: string | null;
+  opencodeStatus: string;
+  opencodeVersion: string | null;
+  restartPolicy: JsonObject | null;
+  routerStatus: string;
+  routerVersion: string | null;
+  runtimeVersion: string | null;
+  serverId: string;
+  updatedAt: string;
+};
+
+export type WorkspaceRuntimeStateRecord = {
+  backendKind: BackendKind;
+  health: JsonObject | null;
+  lastError: JsonObject | null;
+  lastSessionRefreshAt: string | null;
+  lastSyncAt: string | null;
+  updatedAt: string;
+  workspaceId: string;
+};
+
+export type ServerConfigStateRecord = {
+  opencode: JsonObject;
+  serverId: string;
+  updatedAt: string;
+};
+
+export type WorkspaceConfigStateRecord = {
+  openwork: JsonObject;
+  opencode: JsonObject;
+  updatedAt: string;
+  workspaceId: string;
+};
+
+export type ManagedSource = "cloud_synced" | "discovered" | "imported" | "openwork_managed";
+
+export type ManagedConfigRecord = {
+  auth: JsonObject | null;
+  cloudItemId: string | null;
+  config: JsonObject;
+  createdAt: string;
+  displayName: string;
+  id: string;
+  key: string | null;
+  metadata: JsonObject | null;
+  source: ManagedSource;
+  updatedAt: string;
+};
+
+export type WorkspaceAssignmentRecord = {
+  createdAt: string;
+  itemId: string;
+  updatedAt: string;
+  workspaceId: string;
+};
+
+export type CloudSigninRecord = {
+  auth: JsonObject | null;
+  cloudBaseUrl: string;
+  createdAt: string;
+  id: string;
+  lastValidatedAt: string | null;
+  metadata: JsonObject | null;
+  orgId: string | null;
+  serverId: string;
+  updatedAt: string;
+  userId: string | null;
+};
+
+export type WorkspaceShareRecord = {
+  accessKey: string | null;
+  audit: JsonObject | null;
+  createdAt: string;
+  id: string;
+  lastUsedAt: string | null;
+  revokedAt: string | null;
+  status: "active" | "disabled" | "revoked";
+  updatedAt: string;
+  workspaceId: string;
+};
+
+export type RouterIdentityRecord = {
+  auth: JsonObject | null;
+  config: JsonObject;
+  createdAt: string;
+  displayName: string;
+  id: string;
+  isEnabled: boolean;
+  kind: string;
+  serverId: string;
+  updatedAt: string;
+};
+
+export type RouterBindingRecord = {
+  config: JsonObject;
+  createdAt: string;
+  bindingKey: string;
+  id: string;
+  isEnabled: boolean;
+  routerIdentityId: string;
+  serverId: string;
+  updatedAt: string;
+};
+
+export type MigrationRecord = {
+  appliedAt: string;
+  checksum: string;
+  name: string;
+  version: string;
+};
+
+export type MigrationResult = {
+  applied: string[];
+  currentVersion: string;
+  totalApplied: number;
+};
+
+export type ImportSourceReport = {
+  details: JsonObject;
+  sourcePath: string | null;
+  status: ImportStatus;
+  warnings: string[];
+};
+
+export type StartupDiagnostics = {
+  completedAt: string;
+  importReports: {
+    cloudSignin: ImportSourceReport;
+    desktopWorkspaceState: ImportSourceReport;
+    orchestratorAuth: ImportSourceReport;
+    orchestratorState: ImportSourceReport;
+  };
+  legacyWorkspaceImport: {
+    completedAt: string | null;
+    skipped: boolean;
+  };
+  mode: "fresh" | "existing";
+  migrations: MigrationResult;
+  registry: {
+    hiddenWorkspaceIds: string[];
+    localServerCreated: boolean;
+    localServerId: string;
+    totalServers: number;
+    totalVisibleWorkspaces: number;
+  };
+  warnings: string[];
+  workingDirectory: {
+    databasePath: string;
+    rootDir: string;
+    workspacesDir: string;
+  };
+};
diff --git a/apps/server-v2/src/database/working-directory.ts b/apps/server-v2/src/database/working-directory.ts
new file mode 100644
index 0000000000..4b66f716a6
--- /dev/null
+++ b/apps/server-v2/src/database/working-directory.ts
@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export type ServerWorkingDirectory = {
+  databaseDir: string;
+  databasePath: string;
+  importsDir: string;
+  managedDir: string;
+  managedMcpDir: string;
+  managedPluginDir: string;
+  managedProviderDir: string;
+  managedSkillDir: string;
+  rootDir: string;
+  runtimeDir: string;
+  workspacesDir: string;
+};
+
+type ResolveServerWorkingDirectoryOptions = {
+  environment: string;
+  explicitRootDir?: string;
+};
+
+function isTruthy(value: string | undefined) {
+  if (!value) {
+    return false;
+  }
+
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+
+function resolvePlatformDataRoot() {
+  const home = os.homedir();
+  const devMode = isTruthy(process.env.OPENWORK_DEV_MODE);
+  const folderName = devMode ? "com.differentai.openwork.dev" : "com.differentai.openwork";
+
+  if (process.platform === "darwin") {
+    return path.join(home, "Library", "Application Support", folderName);
+  }
+
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA?.trim() || path.join(home, "AppData", "Roaming");
+    return path.join(appData, folderName);
+  }
+
+  const xdgDataHome = process.env.XDG_DATA_HOME?.trim() || path.join(home, ".local", "share");
+  return path.join(xdgDataHome, folderName);
+}
+
+function resolveRootDir(options: ResolveServerWorkingDirectoryOptions) {
+  if (options.explicitRootDir?.trim()) {
+    return path.resolve(options.explicitRootDir.trim());
+  }
+
+  const override = process.env.OPENWORK_SERVER_V2_WORKDIR?.trim();
+  if (override) {
+    return path.resolve(override);
+  }
+
+  const sharedDataDir = process.env.OPENWORK_DATA_DIR?.trim();
+  if (sharedDataDir) {
+    return path.join(path.resolve(sharedDataDir), "server-v2");
+  }
+
+  if (options.environment === "test") {
+    return path.join(process.cwd(), ".openwork-server-v2-test");
+  }
+
+  return path.join(resolvePlatformDataRoot(), "server-v2");
+}
+
+export function resolveServerWorkingDirectory(options: ResolveServerWorkingDirectoryOptions): ServerWorkingDirectory {
+  const rootDir = resolveRootDir(options);
+  const databaseDir = path.join(rootDir, "state");
+  const managedDir = path.join(rootDir, "managed");
+
+  return {
+    databaseDir,
+    databasePath: path.join(databaseDir, "openwork-server-v2.sqlite"),
+    importsDir: path.join(rootDir, "imports"),
+    managedDir,
+    managedMcpDir: path.join(managedDir, "mcps"),
+    managedPluginDir: path.join(managedDir, "plugins"),
+    managedProviderDir: path.join(managedDir, "providers"),
+    managedSkillDir: path.join(managedDir, "skills"),
+    rootDir,
+    runtimeDir: path.join(rootDir, "runtime"),
+    workspacesDir: path.join(rootDir, "workspaces"),
+  };
+}
+
+export function ensureServerWorkingDirectoryLayout(layout: ServerWorkingDirectory) {
+  for (const directory of [
+    layout.rootDir,
+    layout.databaseDir,
+    layout.importsDir,
+    layout.managedDir,
+    layout.managedMcpDir,
+    layout.managedPluginDir,
+    layout.managedProviderDir,
+    layout.managedSkillDir,
+    layout.runtimeDir,
+    layout.workspacesDir,
+  ]) {
+    fs.mkdirSync(directory, { recursive: true });
+  }
+}
+
+export function resolveWorkspaceConfigDir(layout: ServerWorkingDirectory, workspaceId: string) {
+  return path.join(layout.workspacesDir, workspaceId, "config");
+}
+
+export function ensureWorkspaceConfigDir(layout: ServerWorkingDirectory, workspaceId: string) {
+  const directory = resolveWorkspaceConfigDir(layout, workspaceId);
+  fs.mkdirSync(directory, { recursive: true });
+  return directory;
+}
diff --git a/apps/server-v2/src/files.test.ts b/apps/server-v2/src/files.test.ts
new file mode 100644
index 0000000000..2dd2a71de2
--- /dev/null
+++ b/apps/server-v2/src/files.test.ts
@@ -0,0 +1,350 @@
+import { afterEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createApp } from "./app.js";
+import { createAppDependencies } from "./context/app-dependencies.js";
+
+const tempRoots: string[] = [];
+
+afterEach(() => {
+  while (tempRoots.length) {
+    const next = tempRoots.pop();
+    if (!next) continue;
+    fs.rmSync(next, { force: true, recursive: true });
+  }
+});
+
+function createTempRoot(label: string) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `${label}-`));
+  tempRoots.push(root);
+  return root;
+}
+
+function createTestApp() {
+  const root = createTempRoot("openwork-server-v2-phase7");
+  const dependencies = createAppDependencies({
+    environment: "test",
+    inMemory: true,
+    runtime: {
+      bootstrapPolicy: "disabled",
+    },
+    startedAt: new Date("2026-04-14T00:00:00.000Z"),
+    version: "0.0.0-test",
+    workingDirectory: path.join(root, "server-v2"),
+  });
+
+  return {
+    app: createApp({ dependencies }),
+    dependencies,
+    root,
+  };
+}
+
+test("local workspace creation and config routes use server-owned config directories", async () => {
+  const { app, dependencies, root } = createTestApp();
+  const workspaceRoot = path.join(root, "workspace-alpha");
+
+  const createResponse = await app.request("http://openwork.local/workspaces/local", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ folderPath: workspaceRoot, name: "Alpha", preset: "starter" }),
+  });
+  const created = await createResponse.json();
+  const workspaceId = created.data.id as string;
+
+  expect(createResponse.status).toBe(200);
+  expect(created.data.backend.local.dataDir).toBe(workspaceRoot);
+  expect(created.data.backend.local.configDir).toContain(`/workspaces/${workspaceId}/config`);
+
+  const configResponse = await app.request(`http://openwork.local/workspaces/${workspaceId}/config`);
+  const configBody = await configResponse.json();
+  expect(configResponse.status).toBe(200);
+  expect(configBody.data.stored.openwork.authorizedRoots).toEqual([]);
+  expect(configBody.data.effective.openwork.authorizedRoots).toEqual([]);
+  expect(configBody.data.effective.opencode.permission?.external_directory).toBeUndefined();
+
+  const patchResponse = await app.request(`http://openwork.local/workspaces/${workspaceId}/config`, {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      openwork: { reload: { auto: true } },
+      opencode: { permission: { external_directory: { [`${path.join(root, "shared-data")}/*`]: "allow" } } },
+    }),
+  });
+  const patched = await patchResponse.json();
+  expect(patchResponse.status).toBe(200);
+  expect(patched.data.stored.openwork.reload.auto).toBe(true);
+  expect(patched.data.stored.openwork.authorizedRoots).toEqual([]);
+  expect(patched.data.effective.openwork.authorizedRoots).toEqual([path.join(root, "shared-data")]);
+  expect(patched.data.effective.opencode.permission.external_directory[`${path.join(root, "shared-data")}/*`]).toBe("allow");
+  expect(patched.data.effective.opencode.permission.external_directory[`${workspaceRoot}/*`]).toBeUndefined();
+
+  const rawResponse = await app.request(`http://openwork.local/workspaces/${workspaceId}/config/opencode-raw?scope=project`);
+  const rawBody = await rawResponse.json();
+  expect(rawResponse.status).toBe(200);
+  expect(rawBody.data.content).toContain("external_directory");
+  expect(rawBody.data.path).toContain(`/workspaces/${workspaceId}/config/opencode.jsonc`);
+
+  const persistedWorkspace = dependencies.persistence.repositories.workspaces.getById(workspaceId);
+  expect(persistedWorkspace?.configDir).toBeTruthy();
+  expect(fs.existsSync(path.join(persistedWorkspace!.configDir!, "opencode.jsonc"))).toBe(true);
+  expect(fs.existsSync(path.join(workspaceRoot, "opencode.jsonc"))).toBe(true);
+});
+
+test("file routes cover simple content, file sessions, inbox, artifacts, and reload events", async () => {
+  const { app, root } = createTestApp();
+  const workspaceRoot = path.join(root, "workspace-beta");
+
+  const createResponse = await app.request("http://openwork.local/workspaces/local", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ folderPath: workspaceRoot, name: "Beta", preset: "starter" }),
+  });
+  const created = await createResponse.json();
+  const workspaceId = created.data.id as string;
+
+  const contentWrite = await app.request(`http://openwork.local/workspaces/${workspaceId}/files/content`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ path: "notes/today.md", content: "hello phase 7" }),
+  });
+  const contentWriteBody = await contentWrite.json();
+  expect(contentWrite.status).toBe(200);
+  expect(contentWriteBody.data.path).toBe("notes/today.md");
+
+  const contentRead = await app.request(`http://openwork.local/workspaces/${workspaceId}/files/content?path=notes/today.md`);
+  const contentReadBody = await contentRead.json();
+  expect(contentRead.status).toBe(200);
+  expect(contentReadBody.data.content).toBe("hello phase 7");
+
+  const sessionCreate = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ write: true }),
+  });
+  const sessionBody = await sessionCreate.json();
+  const fileSessionId = sessionBody.data.id as string;
+  expect(sessionCreate.status).toBe(200);
+
+  const writeBatch = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions/${fileSessionId}/write-batch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ writes: [{ path: "docs/readme.txt", contentBase64: Buffer.from("file-session").toString("base64") }] }),
+  });
+  const writeBatchBody = await writeBatch.json();
+  expect(writeBatch.status).toBe(200);
+
+  const staleBatch = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions/${fileSessionId}/write-batch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      writes: [{
+        path: "docs/readme.txt",
+        contentBase64: Buffer.from("stale").toString("base64"),
+        ifMatchRevision: "1:1",
+      }],
+    }),
+  });
+  const staleBatchBody = await staleBatch.json();
+  expect(staleBatch.status).toBe(200);
+  expect(staleBatchBody.data.items[0].code).toBe("conflict");
+  expect(staleBatchBody.data.items[0].currentRevision).toBe(writeBatchBody.data.items[0].revision);
+
+  const readBatch = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions/${fileSessionId}/read-batch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ paths: ["docs/readme.txt"] }),
+  });
+  const readBatchBody = await readBatch.json();
+  expect(readBatch.status).toBe(200);
+  expect(Buffer.from(readBatchBody.data.items[0].contentBase64, "base64").toString("utf8")).toBe("file-session");
+
+  const ops = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions/${fileSessionId}/operations`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ operations: [{ type: "rename", from: "docs/readme.txt", to: "docs/renamed.txt" }] }),
+  });
+  expect(ops.status).toBe(200);
+
+  const catalog = await app.request(`http://openwork.local/workspaces/${workspaceId}/file-sessions/${fileSessionId}/catalog/snapshot?prefix=docs`);
+  const catalogBody = await catalog.json();
+  expect(catalog.status).toBe(200);
+  expect(catalogBody.data.items.some((item: any) => item.path === "docs/renamed.txt")).toBe(true);
+
+  const upload = await app.request(`http://openwork.local/workspaces/${workspaceId}/inbox`, {
+    method: "POST",
+    body: (() => {
+      const form = new FormData();
+      form.append("file", new File(["hello inbox"], "hello.txt", { type: "text/plain" }));
+      return form;
+    })(),
+  });
+  const uploadBody = await upload.json();
+  expect(upload.status).toBe(200);
+  expect(uploadBody.data.path).toBe("hello.txt");
+
+  const inboxList = await app.request(`http://openwork.local/workspaces/${workspaceId}/inbox`);
+  const inboxListBody = await inboxList.json();
+  expect(inboxList.status).toBe(200);
+  expect(inboxListBody.data.items[0].name).toBe("hello.txt");
+
+  const outboxDir = path.join(workspaceRoot, ".opencode", "openwork", "outbox");
+  fs.mkdirSync(outboxDir, { recursive: true });
+  fs.writeFileSync(path.join(outboxDir, "artifact.bin"), "artifact", "utf8");
+
+  const artifacts = await app.request(`http://openwork.local/workspaces/${workspaceId}/artifacts`);
+  const artifactsBody = await artifacts.json();
+  expect(artifacts.status).toBe(200);
+  expect(artifactsBody.data.items[0].path).toBe("artifact.bin");
+
+  const reloads = await app.request(`http://openwork.local/workspaces/${workspaceId}/reload-events`);
+  const reloadBody = await reloads.json();
+  expect(reloads.status).toBe(200);
+  expect(reloadBody.data.items.length).toBeGreaterThan(0);
+  expect(reloadBody.data.items.some((item: any) => item.reason === "config")).toBe(true);
+
+  const disposed = await app.request(`http://openwork.local/workspaces/${workspaceId}/dispose`, {
+    method: "POST",
+  });
+  const disposedBody = await disposed.json();
+  expect(disposed.status).toBe(200);
+  expect(disposedBody.data.disposed).toBe(true);
+});
+
+test("remote workspace config and file routes proxy through the local server", async () => {
+  const remote = Bun.serve({
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname === "/workspaces/remote-alpha/config" && request.method === "GET") {
+        return Response.json({
+          ok: true,
+          data: {
+            effective: { opencode: { permission: { external_directory: { "/srv/alpha/*": "allow" } } }, openwork: {} },
+            materialized: { compatibilityOpencodePath: null, compatibilityOpenworkPath: null, configDir: "/srv/config", configOpenworkPath: "/srv/config/.opencode/openwork.json", configOpencodePath: "/srv/config/opencode.jsonc" },
+            stored: { openwork: { reload: { auto: true } }, opencode: {} },
+            updatedAt: new Date().toISOString(),
+            workspaceId: "remote-alpha",
+          },
+          meta: { requestId: "owreq_remote_cfg_1", timestamp: new Date().toISOString() },
+        });
+      }
+      if (url.pathname === "/workspaces/remote-alpha/config" && request.method === "PATCH") {
+        return Response.json({
+          ok: true,
+          data: {
+            effective: { opencode: { permission: { external_directory: { "/srv/alpha/*": "allow", "/srv/shared/*": "allow" } } }, openwork: {} },
+            materialized: { compatibilityOpencodePath: null, compatibilityOpenworkPath: null, configDir: "/srv/config", configOpenworkPath: "/srv/config/.opencode/openwork.json", configOpencodePath: "/srv/config/opencode.jsonc" },
+            stored: { openwork: { reload: { auto: true } }, opencode: {} },
+            updatedAt: new Date().toISOString(),
+            workspaceId: "remote-alpha",
+          },
+          meta: { requestId: "owreq_remote_cfg_2", timestamp: new Date().toISOString() },
+        });
+      }
+      if (url.pathname === "/workspaces/remote-alpha/files/content" && request.method === "GET") {
+        return Response.json({ ok: true, data: { path: "notes.md", content: "remote hello", bytes: 12, updatedAt: 42 }, meta: { requestId: "owreq_remote_file_1", timestamp: new Date().toISOString() } });
+      }
+      if (url.pathname === "/workspaces/remote-alpha/files/content" && request.method === "POST") {
+        return Response.json({ ok: true, data: { path: "notes.md", bytes: 12, revision: "42:12", updatedAt: 43 }, meta: { requestId: "owreq_remote_file_2", timestamp: new Date().toISOString() } });
+      }
+      if (url.pathname === "/workspaces/remote-alpha/reload-events" && request.method === "GET") {
+        return Response.json({ ok: true, data: { cursor: 1, items: [{ id: "evt_remote_1", reason: "config", seq: 1, timestamp: Date.now(), workspaceId: "remote-alpha" }] }, meta: { requestId: "owreq_remote_reload_1", timestamp: new Date().toISOString() } });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+
+  try {
+    const { app, dependencies } = createTestApp();
+    const workspace = dependencies.persistence.registry.importRemoteWorkspace({
+      baseUrl: `http://127.0.0.1:${remote.port}`,
+      displayName: "Remote Alpha",
+      legacyNotes: {},
+      remoteType: "openwork",
+      remoteWorkspaceId: "remote-alpha",
+      serverAuth: { openworkToken: "remote-token" },
+      serverBaseUrl: `http://127.0.0.1:${remote.port}`,
+      serverHostingKind: "self_hosted",
+      serverLabel: `127.0.0.1:${remote.port}`,
+      workspaceStatus: "ready",
+    });
+
+    const config = await app.request(`http://openwork.local/workspaces/${workspace.id}/config`);
+    const configBody = await config.json();
+    expect(config.status).toBe(200);
+    expect(configBody.data.stored.openwork.reload.auto).toBe(true);
+
+    const patched = await app.request(`http://openwork.local/workspaces/${workspace.id}/config`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ opencode: { permission: { external_directory: { "/srv/shared/*": "allow" } } } }),
+    });
+    expect(patched.status).toBe(200);
+
+    const contentRead = await app.request(`http://openwork.local/workspaces/${workspace.id}/files/content?path=notes.md`);
+    const contentBody = await contentRead.json();
+    expect(contentRead.status).toBe(200);
+    expect(contentBody.data.content).toBe("remote hello");
+
+    const contentWrite = await app.request(`http://openwork.local/workspaces/${workspace.id}/files/content`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ path: "notes.md", content: "remote hello" }),
+    });
+    const contentWriteBody = await contentWrite.json();
+    expect(contentWrite.status).toBe(200);
+    expect(contentWriteBody.data.revision).toBe("42:12");
+
+    const reloads = await app.request(`http://openwork.local/workspaces/${workspace.id}/reload-events`);
+    const reloadBody = await reloads.json();
+    expect(reloads.status).toBe(200);
+    expect(reloadBody.data.items[0].workspaceId).toBe("remote-alpha");
+  } finally {
+    remote.stop(true);
+  }
+});
+
+test("reconciliation absorbs recognized managed items from local workspace files", async () => {
+  const { dependencies, root } = createTestApp();
+  const workspaceRoot = path.join(root, "workspace-gamma");
+  fs.mkdirSync(path.join(workspaceRoot, ".opencode", "skills", "manual-skill"), { recursive: true });
+  fs.writeFileSync(path.join(workspaceRoot, "opencode.jsonc"), JSON.stringify({
+    $schema: "https://opencode.ai/config.json",
+    mcp: {
+      demo: { type: "local", command: ["demo"] },
+    },
+    plugin: ["demo-plugin"],
+    provider: {
+      openai: { options: { apiKey: "redacted" } },
+    },
+  }, null, 2), "utf8");
+  fs.writeFileSync(path.join(workspaceRoot, ".opencode", "skills", "manual-skill", "SKILL.md"), "---\nname: manual-skill\ndescription: Manual skill\n---\n\nhello\n", "utf8");
+
+  const workspace = dependencies.persistence.registry.importLocalWorkspace({
+    dataDir: workspaceRoot,
+    displayName: "Gamma",
+    status: "ready",
+  });
+
+  dependencies.services.config.reconcileAllWorkspaces();
+
+  const mcps = dependencies.persistence.repositories.workspaceMcps.listForWorkspace(workspace.id);
+  const plugins = dependencies.persistence.repositories.workspacePlugins.listForWorkspace(workspace.id);
+  const providers = dependencies.persistence.repositories.workspaceProviderConfigs.listForWorkspace(workspace.id);
+  const skills = dependencies.persistence.repositories.workspaceSkills.listForWorkspace(workspace.id);
+  const snapshot = await dependencies.services.config.getWorkspaceConfigSnapshot(workspace.id);
+
+  expect(mcps).toHaveLength(1);
+  expect(plugins).toHaveLength(1);
+  expect(providers).toHaveLength(1);
+  expect(skills).toHaveLength(1);
+  expect(snapshot.stored.opencode.mcp).toBeUndefined();
+  expect((snapshot.effective.opencode.mcp as any).demo.type).toBe("local");
+  expect(snapshot.effective.opencode.plugin).toContain("demo-plugin");
+  expect((snapshot.effective.opencode.provider as any).openai.options.apiKey).toBe("redacted");
+});
diff --git a/apps/server-v2/src/http.ts b/apps/server-v2/src/http.ts
new file mode 100644
index 0000000000..5315de5134
--- /dev/null
+++ b/apps/server-v2/src/http.ts
@@ -0,0 +1,80 @@
+export type ResponseMeta = {
+  requestId: string;
+  timestamp: string;
+};
+
+export type SuccessResponse<TData> = {
+  ok: true;
+  data: TData;
+  meta: ResponseMeta;
+};
+
+export type ErrorCode =
+  | "bad_gateway"
+  | "conflict"
+  | "forbidden"
+  | "internal_error"
+  | "invalid_request"
+  | "not_found"
+  | "not_implemented"
+  | "service_unavailable"
+  | "unauthorized";
+
+export type ErrorDetail = {
+  message: string;
+  path?: Array<string | number>;
+};
+
+export type ErrorResponse = {
+  ok: false;
+  error: {
+    code: ErrorCode;
+    message: string;
+    requestId: string;
+    details?: Array<ErrorDetail>;
+  };
+};
+
+export class RouteError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: ErrorCode,
+    message: string,
+    readonly details?: Array<ErrorDetail>,
+  ) {
+    super(message);
+    this.name = "RouteError";
+  }
+}
+
+export function createResponseMeta(requestId: string, now: Date = new Date()): ResponseMeta {
+  return {
+    requestId,
+    timestamp: now.toISOString(),
+  };
+}
+
+export function buildSuccessResponse<TData>(requestId: string, data: TData, now: Date = new Date()): SuccessResponse<TData> {
+  return {
+    ok: true,
+    data,
+    meta: createResponseMeta(requestId, now),
+  };
+}
+
+export function buildErrorResponse(input: {
+  requestId: string;
+  code: ErrorCode;
+  message: string;
+  details?: Array<ErrorDetail>;
+}): ErrorResponse {
+  return {
+    ok: false,
+    error: {
+      code: input.code,
+      message: input.message,
+      requestId: input.requestId,
+      details: input.details,
+    },
+  };
+}
diff --git a/apps/server-v2/src/index.ts b/apps/server-v2/src/index.ts
new file mode 100644
index 0000000000..e7f38dfba9
--- /dev/null
+++ b/apps/server-v2/src/index.ts
@@ -0,0 +1,4 @@
+export { app, createApp, type AppType, type CreateAppOptions } from "./app.js";
+export { startServer, type StartServerOptions, type StartedServer } from "./bootstrap/server.js";
+export { createAppDependencies, type AppDependencies } from "./context/app-dependencies.js";
+export { routeNamespaces, routePaths, workspaceResourcePattern, workspaceRoutePath } from "./routes/route-paths.js";
diff --git a/apps/server-v2/src/managed.test.ts b/apps/server-v2/src/managed.test.ts
new file mode 100644
index 0000000000..6e27bbf2a0
--- /dev/null
+++ b/apps/server-v2/src/managed.test.ts
@@ -0,0 +1,266 @@
+import { afterEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createApp } from "./app.js";
+import { createAppDependencies } from "./context/app-dependencies.js";
+
+const tempRoots: string[] = [];
+const envBackup = {
+  home: process.env.HOME,
+  publisherBaseUrl: process.env.OPENWORK_PUBLISHER_BASE_URL,
+  publisherOrigin: process.env.OPENWORK_PUBLISHER_REQUEST_ORIGIN,
+};
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  while (tempRoots.length) {
+    const next = tempRoots.pop();
+    if (!next) continue;
+    fs.rmSync(next, { force: true, recursive: true });
+  }
+  process.env.OPENWORK_PUBLISHER_BASE_URL = envBackup.publisherBaseUrl;
+  process.env.OPENWORK_PUBLISHER_REQUEST_ORIGIN = envBackup.publisherOrigin;
+  process.env.HOME = envBackup.home;
+  globalThis.fetch = originalFetch;
+});
+
+function createTempRoot(label: string) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `${label}-`));
+  tempRoots.push(root);
+  return root;
+}
+
+function createTestApp(label: string) {
+  const root = createTempRoot(label);
+  const dependencies = createAppDependencies({
+    environment: "test",
+    inMemory: true,
+    runtime: {
+      bootstrapPolicy: "disabled",
+    },
+    startedAt: new Date("2026-04-15T00:00:00.000Z"),
+    version: "0.0.0-test",
+    workingDirectory: path.join(root, "server-v2"),
+  });
+  return {
+    app: createApp({ dependencies }),
+    dependencies,
+    root,
+  };
+}
+
+test("managed resource routes cover MCPs, plugins, skills, shares, export/import, cloud signin, bundles, and router state", async () => {
+  const { app, dependencies, root } = createTestApp("openwork-server-v2-phase8-managed");
+  const workspaceRoot = path.join(root, "workspace-managed");
+  fs.mkdirSync(path.join(workspaceRoot, ".opencode", "tools"), { recursive: true });
+  fs.writeFileSync(path.join(workspaceRoot, ".opencode", "tools", "demo.txt"), "tool-secret", "utf8");
+
+  const createResponse = await app.request("http://openwork.local/workspaces/local", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ folderPath: workspaceRoot, name: "Managed", preset: "starter" }),
+  });
+  const created = await createResponse.json();
+  const workspaceId = created.data.id as string;
+
+  const mcpAdded = await app.request(`http://openwork.local/workspace/${workspaceId}/mcp`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name: "demo", config: { command: ["demo"], type: "local" } }),
+  });
+  const pluginsAdded = await app.request(`http://openwork.local/workspace/${workspaceId}/plugins`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ spec: "demo-plugin" }),
+  });
+  const skillAdded = await app.request(`http://openwork.local/workspace/${workspaceId}/skills`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ content: "## When To Use\n- Demo\n", description: "Demo skill", name: "demo-skill" }),
+  });
+  const systemManagedMcps = await app.request("http://openwork.local/system/managed/mcps");
+  const shareExposed = await app.request(`http://openwork.local/workspaces/${workspaceId}/share`, { method: "POST" });
+  const shareBody = await shareExposed.json();
+  const exportConflict = await app.request(`http://openwork.local/workspaces/${workspaceId}/export?sensitive=auto`);
+  const exportSafe = await app.request(`http://openwork.local/workspaces/${workspaceId}/export?sensitive=exclude`);
+  const exportSafeBody = await exportSafe.json();
+
+  expect(mcpAdded.status).toBe(200);
+  expect((await mcpAdded.json()).items[0].name).toBe("demo");
+  expect(pluginsAdded.status).toBe(200);
+  expect((await pluginsAdded.json()).items[0].spec).toBe("demo-plugin");
+  expect(skillAdded.status).toBe(200);
+  expect((await skillAdded.json()).name).toBe("demo-skill");
+  expect(systemManagedMcps.status).toBe(200);
+  expect((await systemManagedMcps.json()).data.items[0].workspaceIds).toContain(workspaceId);
+  expect(shareExposed.status).toBe(200);
+  expect(shareBody.data.status).toBe("active");
+  expect(typeof shareBody.data.accessKey).toBe("string");
+  expect(exportConflict.status).toBe(409);
+  expect((await exportConflict.json()).code).toBe("workspace_export_requires_decision");
+  expect(exportSafe.status).toBe(200);
+  expect(exportSafeBody.data.skills[0].name).toBe("demo-skill");
+
+  const importRoot = path.join(root, "workspace-imported");
+  const createImportWorkspace = await app.request("http://openwork.local/workspaces/local", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ folderPath: importRoot, name: "Imported", preset: "starter" }),
+  });
+  const importedWorkspaceId = (await createImportWorkspace.json()).data.id as string;
+  const importResult = await app.request(`http://openwork.local/workspaces/${importedWorkspaceId}/import`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(exportSafeBody.data),
+  });
+  const importedSkills = await app.request(`http://openwork.local/workspace/${importedWorkspaceId}/skills`);
+  expect(importResult.status).toBe(200);
+  expect((await importedSkills.json()).items[0].name).toBe("demo-skill");
+  const importedSkillRecord = dependencies.persistence.repositories.skills.list().find((item) => item.key === "demo-skill" && item.source === "imported");
+  expect(importedSkillRecord?.source).toBe("imported");
+  expect((importedSkillRecord?.metadata as any)?.importedVia).toBe("portable_bundle");
+
+  globalThis.fetch = Object.assign(
+    async (input: URL | RequestInfo, init?: RequestInit | BunFetchRequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("/skills/hub-skill/SKILL.md")) {
+        return new Response("---\nname: hub-skill\ndescription: Hub skill\ntrigger: Help with hub flows\n---\n\nUse for hub tasks\n", {
+          headers: { "Content-Type": "text/plain" },
+          status: 200,
+        });
+      }
+      return originalFetch(input, init);
+    },
+    { preconnect: originalFetch.preconnect },
+  ) as typeof fetch;
+  const hubInstall = await app.request(`http://openwork.local/workspace/${workspaceId}/skills/hub/hub-skill`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ overwrite: true }),
+  });
+  expect(hubInstall.status).toBe(200);
+  const hubSkillRecord = dependencies.persistence.repositories.skills.list().find((item) => item.key === "hub-skill");
+  expect(hubSkillRecord?.source).toBe("imported");
+  expect((hubSkillRecord?.metadata as any)?.install?.kind).toBe("hub");
+  globalThis.fetch = originalFetch;
+
+  const cloudServer = Bun.serve({
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname === "/v1/me") {
+        return Response.json({ user: { id: "usr_123" } });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+  tempRoots.push(path.join(root, `cloud-server-${cloudServer.port}`));
+  try {
+    const cloudPersist = await app.request("http://openwork.local/system/cloud-signin", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ auth: { authToken: "token-demo" }, cloudBaseUrl: `http://127.0.0.1:${cloudServer.port}` }),
+    });
+    const cloudValidated = await app.request("http://openwork.local/system/cloud-signin/validate", { method: "POST" });
+    const cloudCleared = await app.request("http://openwork.local/system/cloud-signin", { method: "DELETE" });
+    expect(cloudPersist.status).toBe(200);
+    expect(cloudValidated.status).toBe(200);
+    expect((await cloudValidated.json()).data.ok).toBe(true);
+    expect(cloudCleared.status).toBe(200);
+    expect((await cloudCleared.json()).data).toBeNull();
+  } finally {
+    cloudServer.stop(true);
+  }
+
+  const publisherServer = Bun.serve({
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname === "/v1/bundles" && request.method === "POST") {
+        return Response.json({ url: `${url.origin}/b/demo-bundle` });
+      }
+      if (url.pathname === "/b/demo-bundle/data" && request.method === "GET") {
+        return Response.json({ schemaVersion: 1, type: "skills-set", name: "Demo", skills: [] });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+  process.env.OPENWORK_PUBLISHER_BASE_URL = `http://127.0.0.1:${publisherServer.port}`;
+  process.env.OPENWORK_PUBLISHER_REQUEST_ORIGIN = "http://127.0.0.1:3000";
+  try {
+    const publish = await app.request("http://openwork.local/share/bundles/publish", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bundleType: "skills-set", payload: { ok: true } }),
+    });
+    const publishBody = await publish.json();
+    const fetchBundle = await app.request("http://openwork.local/share/bundles/fetch", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bundleUrl: publishBody.data.url }),
+    });
+    expect(publish.status).toBe(200);
+    expect(fetchBundle.status).toBe(200);
+    expect((await fetchBundle.json()).data.type).toBe("skills-set");
+  } finally {
+    publisherServer.stop(true);
+  }
+
+  const routerSendServer = Bun.serve({
+    fetch(request) {
+      const url = new URL(request.url);
+      if (url.pathname === "/send" && request.method === "POST") {
+        return Response.json({ attempted: 1, channel: "telegram", directory: workspaceRoot, ok: true, sent: 1 });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    hostname: "127.0.0.1",
+    port: 0,
+  });
+  try {
+    dependencies.services.runtime.getRouterHealth = () => ({
+      baseUrl: `http://127.0.0.1:${routerSendServer.port}`,
+      binaryPath: null,
+      diagnostics: { combined: [], stderr: [], stdout: [], totalLines: 0, truncated: false },
+      enablement: { enabled: true, enabledBindingCount: 0, enabledIdentityCount: 0, forced: false, reason: "test" },
+      healthUrl: `http://127.0.0.1:${routerSendServer.port}`,
+      lastError: null,
+      lastExit: null,
+      lastReadyAt: null,
+      lastStartedAt: null,
+      manifest: null,
+      materialization: null,
+      pid: null,
+      running: true,
+      source: "development",
+      status: "running",
+      version: "test",
+    });
+    dependencies.services.runtime.applyRouterConfig = async () => dependencies.services.runtime.getRouterHealth();
+    const telegramIdentity = await app.request(`http://openwork.local/workspace/${workspaceId}/opencode-router/identities/telegram`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ access: "private", token: "123456:demo" }),
+    });
+    const bindings = await app.request(`http://openwork.local/workspace/${workspaceId}/opencode-router/bindings`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ channel: "telegram", directory: workspaceRoot, peerId: "peer-1" }),
+    });
+    const send = await app.request(`http://openwork.local/workspace/${workspaceId}/opencode-router/send`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ channel: "telegram", directory: workspaceRoot, text: "hello" }),
+    });
+    expect(telegramIdentity.status).toBe(200);
+    expect((await telegramIdentity.json()).telegram.pairingCode).toBeTruthy();
+    expect(bindings.status).toBe(200);
+    expect(send.status).toBe(200);
+    expect((await send.json()).sent).toBe(1);
+  } finally {
+    routerSendServer.stop(true);
+  }
+});
diff --git a/apps/server-v2/src/middleware/error-handler.ts b/apps/server-v2/src/middleware/error-handler.ts
new file mode 100644
index 0000000000..332a4eef92
--- /dev/null
+++ b/apps/server-v2/src/middleware/error-handler.ts
@@ -0,0 +1,94 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { ZodError } from "zod";
+import { buildErrorResponse, RouteError } from "../http.js";
+import type { AppBindings } from "../context/request-context.js";
+
+export const errorHandlingMiddleware: MiddlewareHandler<AppBindings> = async (c, next) => {
+  try {
+    await next();
+  } catch (error) {
+    const requestId = c.get("requestId") ?? `owreq_${crypto.randomUUID()}`;
+    const routeLike = error && typeof error === "object"
+      ? error as { code?: unknown; details?: unknown; message?: unknown; status?: unknown }
+      : null;
+
+    if (error instanceof HTTPException) {
+      const status = error.status;
+      const code = status === 401
+        ? "unauthorized"
+        : status === 403
+          ? "forbidden"
+          : status === 404
+            ? "not_found"
+            : "invalid_request";
+      const body = buildErrorResponse({
+        requestId,
+        code,
+        message: error.message || (code === "not_found" ? "Route not found." : "Request failed."),
+      });
+      return c.json(body, status);
+    }
+
+    if (error instanceof RouteError) {
+      return c.json(
+        buildErrorResponse({
+          requestId,
+          code: error.code,
+          message: error.message,
+          details: error.details,
+        }),
+        error.status as any,
+      );
+    }
+
+    if (
+      routeLike
+      && typeof routeLike.status === "number"
+      && typeof routeLike.code === "string"
+      && typeof routeLike.message === "string"
+    ) {
+      return c.json(
+        buildErrorResponse({
+          requestId,
+          code: routeLike.code as any,
+          message: routeLike.message,
+          details: Array.isArray(routeLike.details) ? routeLike.details as any : undefined,
+        }),
+        routeLike.status as any,
+      );
+    }
+
+    if (error instanceof ZodError) {
+      const body = buildErrorResponse({
+        requestId,
+        code: "invalid_request",
+        message: "Request validation failed.",
+        details: error.issues.map((issue) => ({
+          message: issue.message,
+          path: issue.path.filter((segment): segment is string | number => typeof segment === "string" || typeof segment === "number"),
+        })),
+      });
+      return c.json(body, 400);
+    }
+
+    const message = error instanceof Error ? error.message : "Unexpected server error.";
+
+    console.error(
+      JSON.stringify({
+        message,
+        requestId,
+        scope: "openwork-server-v2.error",
+      }),
+    );
+
+    return c.json(
+      buildErrorResponse({
+        requestId,
+        code: "internal_error",
+        message: "Unexpected server error.",
+      }),
+      500,
+    );
+  }
+};
diff --git a/apps/server-v2/src/middleware/request-id.ts b/apps/server-v2/src/middleware/request-id.ts
new file mode 100644
index 0000000000..166ea526c1
--- /dev/null
+++ b/apps/server-v2/src/middleware/request-id.ts
@@ -0,0 +1,20 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppBindings } from "../context/request-context.js";
+
+export const REQUEST_ID_HEADER = "X-Request-Id";
+
+function normalizeIncomingRequestId(value: string | undefined) {
+  const trimmed = value?.trim();
+
+  if (!trimmed) {
+    return null;
+  }
+
+  return trimmed.slice(0, 200);
+}
+
+export const requestIdMiddleware: MiddlewareHandler<AppBindings> = async (c, next) => {
+  const requestId = normalizeIncomingRequestId(c.req.header(REQUEST_ID_HEADER)) ?? `owreq_${crypto.randomUUID()}`;
+  c.set("requestId", requestId);
+  await next();
+};
diff --git a/apps/server-v2/src/middleware/request-logger.ts b/apps/server-v2/src/middleware/request-logger.ts
new file mode 100644
index 0000000000..424cfabaee
--- /dev/null
+++ b/apps/server-v2/src/middleware/request-logger.ts
@@ -0,0 +1,22 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppBindings } from "../context/request-context.js";
+
+export const requestLoggerMiddleware: MiddlewareHandler<AppBindings> = async (c, next) => {
+  const startedAt = performance.now();
+
+  await next();
+
+  const durationMs = Number((performance.now() - startedAt).toFixed(1));
+  const url = new URL(c.req.url);
+
+  console.info(
+    JSON.stringify({
+      durationMs,
+      method: c.req.method,
+      path: url.pathname,
+      requestId: c.get("requestId"),
+      scope: "openwork-server-v2.request",
+      status: c.res.status,
+    }),
+  );
+};
diff --git a/apps/server-v2/src/middleware/response-finalizer.ts b/apps/server-v2/src/middleware/response-finalizer.ts
new file mode 100644
index 0000000000..6e329eadf6
--- /dev/null
+++ b/apps/server-v2/src/middleware/response-finalizer.ts
@@ -0,0 +1,16 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppBindings } from "../context/request-context.js";
+import { REQUEST_ID_HEADER } from "./request-id.js";
+
+export const responseFinalizerMiddleware: MiddlewareHandler<AppBindings> = async (c, next) => {
+  await next();
+
+  const requestId = c.get("requestId");
+  if (requestId) {
+    c.header(REQUEST_ID_HEADER, requestId);
+  }
+
+  if (!c.res.headers.has("Cache-Control")) {
+    c.header("Cache-Control", "no-store");
+  }
+};
diff --git a/apps/server-v2/src/openapi.ts b/apps/server-v2/src/openapi.ts
new file mode 100644
index 0000000000..a469ed9636
--- /dev/null
+++ b/apps/server-v2/src/openapi.ts
@@ -0,0 +1,91 @@
+import { resolver } from "hono-openapi";
+import type { z } from "zod";
+import {
+  forbiddenErrorSchema,
+  internalErrorSchema,
+  invalidRequestErrorSchema,
+  notFoundErrorSchema,
+  unauthorizedErrorSchema,
+} from "./schemas/errors.js";
+
+function toPascalCase(value: string) {
+  return value
+    .replace(/[^a-zA-Z0-9]+/g, " ")
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+}
+
+export function buildOperationId(method: string, path: string) {
+  const parts = path
+    .split("/")
+    .filter(Boolean)
+    .map((part) => {
+      if (part.startsWith(":")) {
+        return `by-${part.slice(1)}`;
+      }
+
+      if (part === "*") {
+        return "wildcard";
+      }
+
+      return part;
+    });
+
+  if (parts.length === 0) {
+    return `${method.toLowerCase()}Root`;
+  }
+
+  return [method.toLowerCase(), ...parts]
+    .map(toPascalCase)
+    .join("")
+    .replace(/^[A-Z]/, (char) => char.toLowerCase());
+}
+
+export function jsonResponse(description: string, schema: z.ZodTypeAny) {
+  return {
+    description,
+    content: {
+      "application/json": {
+        schema: resolver(schema),
+      },
+    },
+  };
+}
+
+export function withCommonErrorResponses<TResponses extends Record<number, unknown>>(
+  responses: TResponses,
+  options: {
+    includeForbidden?: boolean;
+    includeNotFound?: boolean;
+    includeInvalidRequest?: boolean;
+    includeUnauthorized?: boolean;
+  } = {},
+) {
+  return {
+    ...responses,
+    ...(options.includeInvalidRequest
+      ? {
+          400: jsonResponse("Request validation failed.", invalidRequestErrorSchema),
+        }
+      : {}),
+    ...(options.includeUnauthorized
+      ? {
+          401: jsonResponse("Authentication is required for this route.", unauthorizedErrorSchema),
+        }
+      : {}),
+    ...(options.includeForbidden
+      ? {
+          403: jsonResponse("The authenticated actor does not have access to this route.", forbiddenErrorSchema),
+        }
+      : {}),
+    ...(options.includeNotFound
+      ? {
+          404: jsonResponse("The requested route was not found.", notFoundErrorSchema),
+        }
+      : {}),
+    500: jsonResponse("The server failed to complete the request.", internalErrorSchema),
+  };
+}
diff --git a/apps/server-v2/src/routes/files.ts b/apps/server-v2/src/routes/files.ts
new file mode 100644
index 0000000000..6c1138d39d
--- /dev/null
+++ b/apps/server-v2/src/routes/files.ts
@@ -0,0 +1,640 @@
+import type { Context, Hono } from "hono";
+import { describeRoute, resolver } from "hono-openapi";
+import { HTTPException } from "hono/http-exception";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildSuccessResponse } from "../http.js";
+import { jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import {
+  rawOpencodeConfigQuerySchema,
+  rawOpencodeConfigResponseSchema,
+  rawOpencodeConfigWriteRequestSchema,
+  workspaceConfigPatchRequestSchema,
+  workspaceConfigResponseSchema,
+} from "../schemas/config.js";
+import {
+  binaryListResponseSchema,
+  binaryUploadResponseSchema,
+  engineReloadResponseSchema,
+  fileBatchReadRequestSchema,
+  fileBatchReadResponseSchema,
+  fileBatchWriteRequestSchema,
+  fileCatalogSnapshotResponseSchema,
+  fileMutationResultSchema,
+  fileOperationsRequestSchema,
+  fileSessionCreateRequestSchema,
+  fileSessionIdParamsSchema,
+  fileSessionResponseSchema,
+  reloadEventsResponseSchema,
+  simpleContentQuerySchema,
+  simpleContentResponseSchema,
+  simpleContentWriteRequestSchema,
+  workspaceActivationResponseSchema,
+  workspaceCreateLocalRequestSchema,
+  workspaceDisposeResponseSchema,
+  workspaceDeleteResponseSchema,
+} from "../schemas/files.js";
+import { workspaceDetailResponseSchema } from "../schemas/registry.js";
+import { routePaths } from "./route-paths.js";
+
+function parseQuery<T>(schema: { parse(input: unknown): T }, url: string) {
+  const searchParams = new URL(url).searchParams;
+  const query: Record<string, string> = {};
+  for (const [key, value] of searchParams.entries()) {
+    query[key] = value;
+  }
+  return schema.parse(query);
+}
+
+async function parseJsonBody<T>(schema: { parse(input: unknown): T }, request: Request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/json")) {
+    return schema.parse({});
+  }
+  return schema.parse(await request.json());
+}
+
+function readActorKey(c: Context<AppBindings>) {
+  const requestContext = getRequestContext(c);
+  requestContext.services.auth.requireVisibleRead(requestContext.actor);
+  const authorization = c.req.raw.headers.get("authorization")?.trim() ?? "";
+  const hostToken = c.req.raw.headers.get("x-openwork-host-token")?.trim() ?? "";
+  return {
+    actorKey: requestContext.actor.kind === "host" ? hostToken || authorization : authorization,
+    actorKind: requestContext.actor.kind === "host" ? "host" as const : "client" as const,
+    requestContext,
+  };
+}
+
+function requireWorkspaceAccess(c: Context<AppBindings>) {
+  const { requestContext, actorKey, actorKind } = readActorKey(c);
+  const workspaceId = c.req.param("workspaceId") ?? "";
+  const workspace = requestContext.services.workspaceRegistry.getById(workspaceId, {
+    includeHidden: requestContext.actor.kind === "host",
+  });
+  if (!workspace) {
+    throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+  }
+  return { actorKey, actorKind, requestContext, workspaceId };
+}
+
+function createBinaryResponse(inputValue: { buffer?: Uint8Array; filePath?: string; filename: string; size: number }) {
+  const headers = new Headers();
+  headers.set("Content-Type", "application/octet-stream");
+  headers.set("Content-Disposition", `attachment; filename="${inputValue.filename}"`);
+  headers.set("Content-Length", String(inputValue.size));
+  return new Response(inputValue.buffer ?? (Bun as any).file(inputValue.filePath!), { headers, status: 200 });
+}
+
+export function registerFileRoutes(app: Hono<AppBindings>) {
+  app.post(
+    routePaths.workspaces.createLocal,
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Create a local workspace",
+      description: "Creates a local workspace, initializes starter files, creates the Server V2 config directory, and reconciles the new workspace into managed config state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Local workspace created successfully.", workspaceDetailResponseSchema),
+      }, { includeForbidden: true, includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireHost(requestContext.actor);
+      const body = await parseJsonBody(workspaceCreateLocalRequestSchema, c.req.raw);
+      const workspace = await requestContext.services.files.createLocalWorkspace({
+        folderPath: body.folderPath,
+        name: body.name,
+        preset: body.preset ?? "starter",
+      });
+      const detail = requestContext.services.workspaceRegistry.getById(workspace.id, { includeHidden: true });
+      return c.json(buildSuccessResponse(requestContext.requestId, detail));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.activate(),
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Activate a workspace",
+      description: "Marks a workspace as the active local workspace for migration-era host flows that still expect an active workspace concept.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace activated successfully.", workspaceActivationResponseSchema),
+      }, { includeForbidden: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+      const activeWorkspaceId = requestContext.services.files.activateWorkspace(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { activeWorkspaceId }));
+    },
+  );
+
+  app.patch(
+    routePaths.workspaces.displayName(),
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Update workspace display name",
+      description: "Updates the persisted display name for a workspace record during migration.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace detail returned successfully.", workspaceDetailResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext } = readActorKey(c);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+      const body = await c.req.json();
+      const displayName = typeof body?.displayName === "string" ? body.displayName : null;
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      requestContext.services.files.updateWorkspaceDisplayName(workspaceId, displayName);
+      const detail = requestContext.services.workspaceRegistry.getById(workspaceId, { includeHidden: requestContext.actor.kind === "host" });
+      return c.json(buildSuccessResponse(requestContext.requestId, detail));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.byId(),
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Delete workspace",
+      description: "Deletes a workspace record from the local Server V2 registry during migration-era host flows.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace deleted successfully.", workspaceDeleteResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext } = readActorKey(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+      const result = requestContext.services.files.deleteWorkspace(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.dispose(),
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Dispose workspace runtime instance",
+      description: "Disposes the runtime instance associated with the workspace through Server V2 and refreshes managed runtime supervision where required.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace runtime instance disposed successfully.", workspaceDisposeResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext } = readActorKey(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+      const result = await requestContext.services.files.disposeWorkspaceInstance(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.config(),
+    describeRoute({
+      tags: ["Config"],
+      summary: "Read workspace config",
+      description: "Returns stored and effective workspace config along with the materialized config paths managed by Server V2.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace config returned successfully.", workspaceConfigResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const snapshot = await requestContext.services.config.getWorkspaceConfigSnapshot(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, snapshot));
+    },
+  );
+
+  app.patch(
+    routePaths.workspaces.config(),
+    describeRoute({
+      tags: ["Config"],
+      summary: "Patch workspace config",
+      description: "Updates stored workspace OpenWork/OpenCode config, absorbs recognized managed sections into the database, and rematerializes the effective config files.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace config updated successfully.", workspaceConfigResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const body = await parseJsonBody(workspaceConfigPatchRequestSchema, c.req.raw);
+      const snapshot = await requestContext.services.config.patchWorkspaceConfig(workspaceId, body);
+      if (body.opencode) {
+        requestContext.services.files.emitReloadEvent(workspaceId, "config", {
+          action: "updated",
+          name: "opencode.jsonc",
+          path: snapshot.materialized.configOpencodePath ?? undefined,
+          type: "config",
+        });
+      }
+      if (body.openwork) {
+        requestContext.services.files.emitReloadEvent(workspaceId, "config", {
+          action: "updated",
+          name: "openwork.json",
+          path: snapshot.materialized.configOpenworkPath ?? undefined,
+          type: "config",
+        });
+      }
+      await requestContext.services.files.recordWorkspaceAudit(
+        workspaceId,
+        "config.patch",
+        snapshot.materialized.configOpencodePath ?? snapshot.materialized.configOpenworkPath ?? workspaceId,
+        "Patched workspace config through Server V2.",
+      );
+      return c.json(buildSuccessResponse(requestContext.requestId, snapshot));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.rawOpencodeConfig(),
+    describeRoute({
+      tags: ["Config"],
+      summary: "Read raw OpenCode config text",
+      description: "Returns the editable raw OpenCode config text for project or global scope, generated from the server-owned config state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Raw OpenCode config returned successfully.", rawOpencodeConfigResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const query = parseQuery(rawOpencodeConfigQuerySchema, c.req.url);
+      const result = await requestContext.services.config.readRawOpencodeConfig(workspaceId, query.scope ?? "project");
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.rawOpencodeConfig(),
+    describeRoute({
+      tags: ["Config"],
+      summary: "Write raw OpenCode config text",
+      description: "Parses raw OpenCode config text, absorbs recognized managed sections into the database, and rematerializes the effective config files.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Raw OpenCode config written successfully.", rawOpencodeConfigResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const body = await parseJsonBody(rawOpencodeConfigWriteRequestSchema, c.req.raw);
+      const result = body.scope === "global"
+        ? requestContext.services.config.writeGlobalOpencodeConfig(body.content)
+        : await requestContext.services.config.writeWorkspaceRawOpencodeConfig(workspaceId, body.content);
+      if (body.scope !== "global") {
+        requestContext.services.files.emitReloadEvent(workspaceId, "config", {
+          action: "updated",
+          name: "opencode.jsonc",
+          path: result.path ?? undefined,
+          type: "config",
+        });
+        await requestContext.services.files.recordWorkspaceAudit(
+          workspaceId,
+          "config.raw.write",
+          result.path ?? workspaceId,
+          "Updated raw OpenCode config through Server V2.",
+        );
+      }
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.reloadEvents(),
+    describeRoute({
+      tags: ["Reload"],
+      summary: "List reload events",
+      description: "Returns workspace-scoped reload events emitted by Server V2 after config/file mutations, watched changes, or reconciliation work.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Reload events returned successfully.", reloadEventsResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const since = Number(new URL(c.req.url).searchParams.get("since") ?? "0");
+      const result = await requestContext.services.files.getReloadEvents(workspaceId, Number.isFinite(since) ? since : 0);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.engineReload(),
+    describeRoute({
+      tags: ["Reload"],
+      summary: "Reload the local engine",
+      description: "Restarts the local OpenCode runtime through the Server V2 runtime supervisor for the selected local workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace engine reloaded successfully.", engineReloadResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const result = await requestContext.services.files.reloadWorkspaceEngine(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.fileSessions.base(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Create a workspace file session",
+      description: "Creates a server-owned file session for a local workspace and returns the session metadata used for file catalog and mutation routes.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file session created successfully.", fileSessionResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const body = await parseJsonBody(fileSessionCreateRequestSchema, c.req.raw);
+      const session = await requestContext.services.files.createWorkspaceFileSession(workspaceId, { actorKey, actorKind, ...body });
+      return c.json(buildSuccessResponse(requestContext.requestId, session));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.fileSessions.renew(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Renew a workspace file session",
+      description: "Extends the lifetime of an existing workspace file session.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file session renewed successfully.", fileSessionResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const body = await parseJsonBody(fileSessionCreateRequestSchema, c.req.raw);
+      const session = await requestContext.services.files.renewWorkspaceFileSession(workspaceId, params.fileSessionId, actorKey, actorKind, body.ttlSeconds);
+      return c.json(buildSuccessResponse(requestContext.requestId, session));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.fileSessions.byId(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Close a workspace file session",
+      description: "Closes a workspace file session and releases its temporary server-side catalog state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file session closed successfully.", workspaceActivationResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      await requestContext.services.files.closeWorkspaceFileSession(workspaceId, params.fileSessionId, actorKey, actorKind);
+      return c.json(buildSuccessResponse(requestContext.requestId, { activeWorkspaceId: workspaceId }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.fileSessions.catalogSnapshot(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Get a file catalog snapshot",
+      description: "Returns the file catalog snapshot for a workspace file session.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file catalog returned successfully.", fileCatalogSnapshotResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const query = new URL(c.req.url).searchParams;
+      const result = await requestContext.services.files.listFileSessionCatalogSnapshot(workspaceId, params.fileSessionId, actorKey, actorKind, {
+        after: query.get("after"),
+        includeDirs: query.get("includeDirs") !== "false",
+        limit: query.get("limit"),
+        prefix: query.get("prefix"),
+      });
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.fileSessions.catalogEvents(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "List file session catalog events",
+      description: "Returns file mutation events recorded for a workspace file session since the requested cursor.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file session events returned successfully.", fileMutationResultSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const result = requestContext.services.files.listFileSessionEvents(workspaceId, params.fileSessionId, actorKey, actorKind, new URL(c.req.url).searchParams.get("since"));
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.fileSessions.readBatch(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Read a batch of files",
+      description: "Reads a batch of files through the server-owned file session model.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace files read successfully.", fileBatchReadResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const body = await parseJsonBody(fileBatchReadRequestSchema, c.req.raw);
+      const result = await requestContext.services.files.readWorkspaceFiles(workspaceId, params.fileSessionId, actorKey, actorKind, body.paths);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.fileSessions.writeBatch(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Write a batch of files",
+      description: "Writes a batch of files with revision-aware conflict handling through the server-owned file session model.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace files written successfully.", fileMutationResultSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const body = await parseJsonBody(fileBatchWriteRequestSchema, c.req.raw);
+      const result = await requestContext.services.files.writeWorkspaceFiles(workspaceId, params.fileSessionId, actorKey, actorKind, body.writes);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.fileSessions.operations(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Run file operations",
+      description: "Runs mkdir, rename, and delete operations through the server-owned file session model.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace file operations applied successfully.", fileMutationResultSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { actorKey, actorKind, requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const params = fileSessionIdParamsSchema.parse(c.req.param());
+      const body = await parseJsonBody(fileOperationsRequestSchema, c.req.raw);
+      const result = await requestContext.services.files.workspaceFileOperations(workspaceId, params.fileSessionId, actorKey, actorKind, body.operations);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.simpleContent(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Read simple content",
+      description: "Reads markdown-oriented content for lighter file flows without using the full file session model.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace content returned successfully.", simpleContentResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const query = parseQuery(simpleContentQuerySchema, c.req.url);
+      const result = await requestContext.services.files.readSimpleContent(workspaceId, query.path);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.simpleContent(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Write simple content",
+      description: "Writes markdown-oriented content with basic conflict handling for lighter file flows.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace content written successfully.", simpleContentResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const body = await parseJsonBody(simpleContentWriteRequestSchema, c.req.raw);
+      const result = await requestContext.services.files.writeSimpleContent(workspaceId, body);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.inbox.base(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "List inbox items",
+      description: "Returns uploadable inbox items for the selected workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace inbox returned successfully.", binaryListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const result = await requestContext.services.files.listInbox(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.inbox.byId(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Download inbox item",
+      description: "Downloads one inbox file for the selected workspace.",
+      responses: withCommonErrorResponses({
+        200: {
+          description: "Inbox item downloaded successfully.",
+          content: {
+            "application/octet-stream": {
+              schema: resolver(simpleContentResponseSchema),
+            },
+          },
+        },
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const result = await requestContext.services.files.downloadInboxItem(workspaceId, c.req.param("inboxId") ?? "");
+      return createBinaryResponse({
+        buffer: (result as { buffer?: Uint8Array }).buffer,
+        filePath: (result as { absolutePath?: string }).absolutePath,
+        filename: result.filename,
+        size: result.size,
+      });
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.inbox.base(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Upload inbox item",
+      description: "Uploads one file into the managed inbox area for the selected workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace inbox item uploaded successfully.", binaryUploadResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const form = await c.req.raw.formData();
+      const file = form.get("file");
+      if (!(file instanceof File)) {
+        throw new HTTPException(400, { message: "Form field 'file' is required." });
+      }
+      const requestedPath = (new URL(c.req.url).searchParams.get("path") ?? String(form.get("path") ?? "")).trim();
+      const result = await requestContext.services.files.uploadInboxItem(workspaceId, requestedPath, file);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.artifacts.base(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "List artifacts",
+      description: "Returns downloadable artifact items for the selected workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace artifacts returned successfully.", binaryListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const result = await requestContext.services.files.listArtifacts(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.artifacts.byId(),
+    describeRoute({
+      tags: ["Files"],
+      summary: "Download artifact",
+      description: "Downloads one artifact file for the selected workspace.",
+      responses: withCommonErrorResponses({
+        200: {
+          description: "Artifact downloaded successfully.",
+          content: {
+            "application/octet-stream": {
+              schema: resolver(simpleContentResponseSchema),
+            },
+          },
+        },
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspaceAccess(c);
+      const result = await requestContext.services.files.downloadArtifact(workspaceId, c.req.param("artifactId") ?? "");
+      return createBinaryResponse({
+        buffer: (result as { buffer?: Uint8Array }).buffer,
+        filePath: (result as { absolutePath?: string }).absolutePath,
+        filename: result.filename,
+        size: result.size,
+      });
+    },
+  );
+}
diff --git a/apps/server-v2/src/routes/index.ts b/apps/server-v2/src/routes/index.ts
new file mode 100644
index 0000000000..9bfc6bcaec
--- /dev/null
+++ b/apps/server-v2/src/routes/index.ts
@@ -0,0 +1,18 @@
+import type { Hono } from "hono";
+import type { AppDependencies } from "../context/app-dependencies.js";
+import type { AppBindings } from "../context/request-context.js";
+import { registerFileRoutes } from "./files.js";
+import { registerManagedRoutes } from "./managed.js";
+import { registerRuntimeRoutes } from "./runtime.js";
+import { registerSessionRoutes } from "./sessions.js";
+import { registerSystemRoutes } from "./system.js";
+import { registerWorkspaceRoutes } from "./workspaces.js";
+
+export function registerRoutes(app: Hono<AppBindings>, dependencies: AppDependencies) {
+  registerSystemRoutes(app, dependencies);
+  registerRuntimeRoutes(app);
+  registerWorkspaceRoutes(app);
+  registerFileRoutes(app);
+  registerManagedRoutes(app);
+  registerSessionRoutes(app);
+}
diff --git a/apps/server-v2/src/routes/managed.ts b/apps/server-v2/src/routes/managed.ts
new file mode 100644
index 0000000000..2409abe6be
--- /dev/null
+++ b/apps/server-v2/src/routes/managed.ts
@@ -0,0 +1,764 @@
+import type { Context, Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildSuccessResponse, RouteError } from "../http.js";
+import { jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import {
+  cloudSigninResponseSchema,
+  cloudSigninValidationResponseSchema,
+  cloudSigninWriteSchema,
+  hubSkillInstallResponseSchema,
+  hubSkillInstallWriteSchema,
+  hubSkillListResponseSchema,
+  managedAssignmentWriteSchema,
+  managedDeleteResponseSchema,
+  managedItemListResponseSchema,
+  managedItemResponseSchema,
+  managedItemWriteSchema,
+  routerBindingListResponseSchema,
+  routerBindingWriteSchema,
+  routerHealthResponseSchemaCompat,
+  routerIdentityListResponseSchema,
+  routerMutationResponseSchema,
+  routerSendWriteSchema,
+  routerSlackWriteSchema,
+  routerTelegramInfoResponseSchema,
+  routerTelegramWriteSchema,
+  sharedBundleFetchResponseSchema,
+  sharedBundleFetchWriteSchema,
+  sharedBundlePublishResponseSchema,
+  sharedBundlePublishWriteSchema,
+  workspaceExportResponseSchema,
+  workspaceImportResponseSchema,
+  workspaceImportWriteSchema,
+  workspaceMcpListResponseSchema,
+  workspaceMcpWriteSchema,
+  workspacePluginListResponseSchema,
+  workspacePluginWriteSchema,
+  workspaceShareResponseSchema,
+  workspaceSkillDeleteResponseSchema,
+  workspaceSkillListResponseSchema,
+  workspaceSkillResponseSchema,
+  workspaceSkillWriteSchema,
+} from "../schemas/managed.js";
+import { routePaths } from "./route-paths.js";
+
+function parseJsonBody<T>(schema: { parse(input: unknown): T }, request: Request) {
+  return request.json().then((body) => schema.parse(body));
+}
+
+function requireVisible(c: Context<AppBindings>) {
+  const requestContext = getRequestContext(c);
+  requestContext.services.auth.requireVisibleRead(requestContext.actor);
+  return requestContext;
+}
+
+function requireWorkspace(c: Context<AppBindings>) {
+  const requestContext = requireVisible(c);
+  const workspaceId = c.req.param("workspaceId") ?? "";
+  return { requestContext, workspaceId };
+}
+
+function addCompatibilityRoute(
+  app: Hono<AppBindings>,
+  method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT",
+  path: string,
+  handler: (c: Context<AppBindings>) => Promise<Response> | Response,
+) {
+  if (method === "GET") app.get(path, handler);
+  if (method === "POST") app.post(path, handler);
+  if (method === "PUT") app.put(path, handler);
+  if (method === "PATCH") app.patch(path, handler);
+  if (method === "DELETE") app.delete(path, handler);
+}
+
+export function registerManagedRoutes(app: Hono<AppBindings>) {
+  for (const kind of ["mcps", "plugins", "providerConfigs", "skills"] as const) {
+    app.get(
+      routePaths.system.managed.list(kind),
+      describeRoute({
+        tags: ["Managed"],
+        summary: `List managed ${kind}`,
+        description: `Returns the server-owned ${kind} records and explicit workspace assignments.`,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`Managed ${kind} returned successfully.`, managedItemListResponseSchema),
+        }, { includeUnauthorized: true }),
+      }),
+      (c) => {
+        const requestContext = requireVisible(c);
+        return c.json(buildSuccessResponse(requestContext.requestId, { items: requestContext.services.managed.listManaged(kind) }));
+      },
+    );
+
+    app.post(
+      routePaths.system.managed.list(kind),
+      describeRoute({
+        tags: ["Managed"],
+        summary: `Create managed ${kind.slice(0, -1)}`,
+        description: `Creates a server-owned ${kind.slice(0, -1)} record and optionally assigns it to workspaces.`,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`Managed ${kind.slice(0, -1)} created successfully.`, managedItemResponseSchema),
+        }, { includeInvalidRequest: true, includeUnauthorized: true }),
+      }),
+      async (c) => {
+        const requestContext = requireVisible(c);
+        const body = await parseJsonBody(managedItemWriteSchema, c.req.raw);
+        return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.createManaged(kind, body)));
+      },
+    );
+
+    app.put(
+      routePaths.system.managed.item(kind),
+      describeRoute({
+        tags: ["Managed"],
+        summary: `Update managed ${kind.slice(0, -1)}`,
+        description: `Updates a server-owned ${kind.slice(0, -1)} record.`,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`Managed ${kind.slice(0, -1)} updated successfully.`, managedItemResponseSchema),
+        }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+      }),
+      async (c) => {
+        const requestContext = requireVisible(c);
+        const itemId = c.req.param("itemId") ?? "";
+        const body = await parseJsonBody(managedItemWriteSchema, c.req.raw);
+        return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.updateManaged(kind, itemId, body)));
+      },
+    );
+
+    app.put(
+      routePaths.system.managed.assignments(kind),
+      describeRoute({
+        tags: ["Managed"],
+        summary: `Assign managed ${kind.slice(0, -1)} to workspaces`,
+        description: `Replaces the workspace assignments for a server-owned managed item.`,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`Managed ${kind.slice(0, -1)} assignments updated successfully.`, managedItemResponseSchema),
+        }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+      }),
+      async (c) => {
+        const requestContext = requireVisible(c);
+        const itemId = c.req.param("itemId") ?? "";
+        const body = await parseJsonBody(managedAssignmentWriteSchema, c.req.raw);
+        return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.updateAssignments(kind, itemId, body.workspaceIds)));
+      },
+    );
+
+    app.delete(
+      routePaths.system.managed.item(kind),
+      describeRoute({
+        tags: ["Managed"],
+        summary: `Delete managed ${kind.slice(0, -1)}`,
+        description: `Deletes a server-owned managed item and removes its workspace assignments.`,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`Managed ${kind.slice(0, -1)} deleted successfully.`, managedDeleteResponseSchema),
+        }, { includeNotFound: true, includeUnauthorized: true }),
+      }),
+      async (c) => {
+        const requestContext = requireVisible(c);
+        const itemId = c.req.param("itemId") ?? "";
+        return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.deleteManaged(kind, itemId)));
+      },
+    );
+  }
+
+  app.get(
+    routePaths.system.cloudSignin,
+    describeRoute({
+      tags: ["Cloud"],
+      summary: "Read cloud signin state",
+      description: "Returns the server-owned cloud signin record when one is configured.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Cloud signin returned successfully.", cloudSigninResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.getCloudSignin()));
+    },
+  );
+
+  app.put(
+    routePaths.system.cloudSignin,
+    describeRoute({
+      tags: ["Cloud"],
+      summary: "Persist cloud signin state",
+      description: "Stores cloud signin metadata in the server-owned database.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Cloud signin persisted successfully.", cloudSigninResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(cloudSigninWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.upsertCloudSignin(body)));
+    },
+  );
+
+  app.post(
+    "/system/cloud-signin/validate",
+    describeRoute({
+      tags: ["Cloud"],
+      summary: "Validate cloud signin state",
+      description: "Validates the stored cloud signin token against the configured cloud base URL.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Cloud signin validated successfully.", cloudSigninValidationResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.validateCloudSignin()));
+    },
+  );
+
+  app.delete(
+    routePaths.system.cloudSignin,
+    describeRoute({
+      tags: ["Cloud"],
+      summary: "Clear cloud signin state",
+      description: "Removes the server-owned cloud signin record for the current OpenWork server.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Cloud signin cleared successfully.", cloudSigninResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.clearCloudSignin()));
+    },
+  );
+
+  app.get(
+    routePaths.system.router.health,
+    describeRoute({
+      tags: ["Router"],
+      summary: "Read router product health",
+      description: "Returns the product-facing router health snapshot built from server-owned router state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router product health returned successfully.", routerHealthResponseSchemaCompat),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.router.getHealth()));
+    },
+  );
+
+  app.post(
+    routePaths.system.router.apply,
+    describeRoute({
+      tags: ["Router"],
+      summary: "Apply router state",
+      description: "Rematerializes the effective router config and reconciles the supervised router process.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router state applied successfully.", routerMutationResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.apply()));
+    },
+  );
+
+  app.get(
+    routePaths.system.router.identities("telegram"),
+    describeRoute({
+      tags: ["Router"],
+      summary: "List Telegram identities",
+      description: "Returns the server-owned Telegram router identities.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Telegram identities returned successfully.", routerIdentityListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.router.listTelegramIdentities()));
+    },
+  );
+
+  app.post(
+    routePaths.system.router.identities("telegram"),
+    describeRoute({
+      tags: ["Router"],
+      summary: "Upsert Telegram identity",
+      description: "Creates or updates a server-owned Telegram router identity.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Telegram identity upserted successfully.", routerMutationResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(routerTelegramWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.upsertTelegramIdentity(body)));
+    },
+  );
+
+  app.get(
+    routePaths.system.router.identities("slack"),
+    describeRoute({
+      tags: ["Router"],
+      summary: "List Slack identities",
+      description: "Returns the server-owned Slack router identities.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Slack identities returned successfully.", routerIdentityListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.router.listSlackIdentities()));
+    },
+  );
+
+  app.post(
+    routePaths.system.router.identities("slack"),
+    describeRoute({
+      tags: ["Router"],
+      summary: "Upsert Slack identity",
+      description: "Creates or updates a server-owned Slack router identity.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Slack identity upserted successfully.", routerMutationResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(routerSlackWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.upsertSlackIdentity(body)));
+    },
+  );
+
+  app.get(
+    routePaths.system.router.telegram,
+    describeRoute({
+      tags: ["Router"],
+      summary: "Read Telegram router info",
+      description: "Returns the current Telegram identity readiness summary for the router product surface.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Telegram router info returned successfully.", routerTelegramInfoResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.getTelegramInfo()));
+    },
+  );
+
+  app.get(
+    routePaths.system.router.bindings,
+    describeRoute({
+      tags: ["Router"],
+      summary: "List router bindings",
+      description: "Returns the effective server-owned router bindings.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router bindings returned successfully.", routerBindingListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = requireVisible(c);
+      const url = new URL(c.req.url);
+      const channel = url.searchParams.get("channel")?.trim() || undefined;
+      const identityId = url.searchParams.get("identityId")?.trim() || undefined;
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.router.listBindings({ channel, identityId })));
+    },
+  );
+
+  app.post(
+    routePaths.system.router.bindings,
+    describeRoute({
+      tags: ["Router"],
+      summary: "Set router binding",
+      description: "Creates or updates a server-owned router binding.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router binding updated successfully.", routerMutationResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(routerBindingWriteSchema, c.req.raw);
+      if (!body.directory?.trim()) {
+        throw new RouteError(400, "invalid_request", "System router binding writes require a directory.");
+      }
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.setBinding({ channel: body.channel, directory: body.directory, identityId: body.identityId, peerId: body.peerId })));
+    },
+  );
+
+  app.post(
+    routePaths.system.router.send,
+    describeRoute({
+      tags: ["Router"],
+      summary: "Send router message",
+      description: "Sends an outbound router message through the supervised router runtime.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router message delivered successfully.", routerMutationResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(routerSendWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.router.sendMessage(body)));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.share(),
+    describeRoute({
+      tags: ["Shares"],
+      summary: "Read workspace share",
+      description: "Returns the current workspace-scoped share record for a local workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace share returned successfully.", workspaceShareResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.getWorkspaceShare(workspaceId)));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.share(),
+    describeRoute({
+      tags: ["Shares"],
+      summary: "Expose workspace share",
+      description: "Creates or rotates a workspace-scoped share access key for a local workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace share exposed successfully.", workspaceShareResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.exposeWorkspaceShare(workspaceId)));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.share(),
+    describeRoute({
+      tags: ["Shares"],
+      summary: "Revoke workspace share",
+      description: "Revokes the current workspace-scoped share access key for a local workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace share revoked successfully.", workspaceShareResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.revokeWorkspaceShare(workspaceId)));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.export(),
+    describeRoute({
+      tags: ["Bundles"],
+      summary: "Export workspace",
+      description: "Builds a portable workspace export from the server-owned config and managed-resource state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace exported successfully.", workspaceExportResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      const sensitiveMode = (new URL(c.req.url).searchParams.get("sensitive")?.trim() as "auto" | "exclude" | "include" | null) ?? "auto";
+      const result = await requestContext.services.managed.exportWorkspace(workspaceId, { sensitiveMode: sensitiveMode === "exclude" || sensitiveMode === "include" || sensitiveMode === "auto" ? sensitiveMode : "auto" });
+      if ("conflict" in result) {
+        return c.json({ code: "workspace_export_requires_decision", details: { warnings: result.warnings }, message: "This workspace includes sensitive config. Choose whether to exclude it or include it before exporting." }, 409);
+      }
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.import(),
+    describeRoute({
+      tags: ["Bundles"],
+      summary: "Import workspace",
+      description: "Applies a portable workspace import through the server-owned config and managed-resource model.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace imported successfully.", workspaceImportResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      const body = await parseJsonBody(workspaceImportWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.importWorkspace(workspaceId, body)));
+    },
+  );
+
+  app.post(
+    "/share/bundles/publish",
+    describeRoute({
+      tags: ["Bundles"],
+      summary: "Publish shared bundle",
+      description: "Publishes a trusted shared bundle through the configured OpenWork bundle publisher.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Shared bundle published successfully.", sharedBundlePublishResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(sharedBundlePublishWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.publishSharedBundle(body)));
+    },
+  );
+
+  app.post(
+    "/share/bundles/fetch",
+    describeRoute({
+      tags: ["Bundles"],
+      summary: "Fetch shared bundle",
+      description: "Fetches a trusted shared bundle through the configured OpenWork bundle publisher.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Shared bundle fetched successfully.", sharedBundleFetchResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const body = await parseJsonBody(sharedBundleFetchWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.fetchSharedBundle(body.bundleUrl, { timeoutMs: body.timeoutMs })));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.mcp(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "List workspace MCPs",
+      description: "Returns the effective workspace MCP records backed by server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace MCPs returned successfully.", workspaceMcpListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items: requestContext.services.managed.listWorkspaceMcp(workspaceId) }));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.mcp(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "Add workspace MCP",
+      description: "Creates or updates a workspace-scoped MCP through server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace MCP updated successfully.", workspaceMcpListResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      const body = await parseJsonBody(workspaceMcpWriteSchema, c.req.raw);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.addWorkspaceMcp(workspaceId, body)));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.plugins(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "List workspace plugins",
+      description: "Returns the effective workspace plugins backed by server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace plugins returned successfully.", workspacePluginListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.managed.listWorkspacePlugins(workspaceId)));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.plugins(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "Add workspace plugin",
+      description: "Creates or updates a workspace-scoped plugin through server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace plugins updated successfully.", workspacePluginListResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+      async (c) => {
+        const { requestContext, workspaceId } = requireWorkspace(c);
+        const body = await parseJsonBody(workspacePluginWriteSchema, c.req.raw);
+        return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.addWorkspacePlugin(workspaceId, body.spec)));
+      },
+    );
+
+  app.get(
+    routePaths.workspaces.skills(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "List workspace skills",
+      description: "Returns the effective workspace skills backed by server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace skills returned successfully.", workspaceSkillListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items: requestContext.services.managed.listWorkspaceSkills(workspaceId) }));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.skills(),
+    describeRoute({
+      tags: ["Managed"],
+      summary: "Upsert workspace skill",
+      description: "Creates or updates a workspace-scoped skill through server-owned managed state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace skill updated successfully.", workspaceSkillResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      const body = await parseJsonBody(workspaceSkillWriteSchema, c.req.raw);
+      const item = await requestContext.services.managed.upsertWorkspaceSkill(workspaceId, body);
+      return c.json(buildSuccessResponse(requestContext.requestId, { content: requestContext.services.managed.getWorkspaceSkill(workspaceId, item.name).content, item }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.hubSkills,
+    describeRoute({
+      tags: ["Managed"],
+      summary: "List hub skills",
+      description: "Returns the available Skill Hub catalog backed by trusted GitHub sources.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Hub skills returned successfully.", hubSkillListResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = requireVisible(c);
+      const url = new URL(c.req.url);
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.listHubSkills({ owner: url.searchParams.get("owner") ?? undefined, ref: url.searchParams.get("ref") ?? undefined, repo: url.searchParams.get("repo") ?? undefined })));
+    },
+  );
+
+  app.post(
+    `${routePaths.workspaces.skills()}/hub/:name`,
+    describeRoute({
+      tags: ["Managed"],
+      summary: "Install hub skill",
+      description: "Installs a trusted Skill Hub skill into server-owned managed state for a workspace.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Hub skill installed successfully.", hubSkillInstallResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireWorkspace(c);
+      const body = await parseJsonBody(hubSkillInstallWriteSchema, c.req.raw).catch(() => ({} as any));
+      return c.json(buildSuccessResponse(requestContext.requestId, await requestContext.services.managed.installHubSkill(workspaceId, { name: c.req.param("name") ?? "", overwrite: body.overwrite, repo: body.repo })));
+    },
+  );
+
+  addCompatibilityRoute(app, "GET", "/workspace/:workspaceId/mcp", (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json({ items: requestContext.services.managed.listWorkspaceMcp(workspaceId) });
+  });
+  addCompatibilityRoute(app, "POST", "/workspace/:workspaceId/mcp", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    const body = await parseJsonBody(workspaceMcpWriteSchema, c.req.raw);
+    return c.json(await requestContext.services.managed.addWorkspaceMcp(workspaceId, body));
+  });
+  addCompatibilityRoute(app, "DELETE", "/workspace/:workspaceId/mcp/:name", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(await requestContext.services.managed.removeWorkspaceMcp(workspaceId, c.req.param("name") ?? ""));
+  });
+  addCompatibilityRoute(app, "DELETE", "/workspace/:workspaceId/mcp/:name/auth", (c) => c.json({ ok: true }));
+
+  addCompatibilityRoute(app, "GET", "/workspace/:workspaceId/plugins", (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(requestContext.services.managed.listWorkspacePlugins(workspaceId));
+  });
+  addCompatibilityRoute(app, "POST", "/workspace/:workspaceId/plugins", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    const body = await parseJsonBody(workspacePluginWriteSchema, c.req.raw);
+    return c.json(await requestContext.services.managed.addWorkspacePlugin(workspaceId, body.spec));
+  });
+  addCompatibilityRoute(app, "DELETE", "/workspace/:workspaceId/plugins/:name", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(await requestContext.services.managed.removeWorkspacePlugin(workspaceId, c.req.param("name") ?? ""));
+  });
+
+  addCompatibilityRoute(app, "GET", "/workspace/:workspaceId/skills", (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json({ items: requestContext.services.managed.listWorkspaceSkills(workspaceId) });
+  });
+  addCompatibilityRoute(app, "GET", "/workspace/:workspaceId/skills/:name", (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(requestContext.services.managed.getWorkspaceSkill(workspaceId, c.req.param("name") ?? ""));
+  });
+  addCompatibilityRoute(app, "POST", "/workspace/:workspaceId/skills", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    const body = await parseJsonBody(workspaceSkillWriteSchema, c.req.raw);
+    return c.json(await requestContext.services.managed.upsertWorkspaceSkill(workspaceId, body));
+  });
+  addCompatibilityRoute(app, "DELETE", "/workspace/:workspaceId/skills/:name", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(await requestContext.services.managed.deleteWorkspaceSkill(workspaceId, c.req.param("name") ?? ""));
+  });
+  addCompatibilityRoute(app, "GET", "/hub/skills", async (c) => {
+    const requestContext = requireVisible(c);
+    const url = new URL(c.req.url);
+    return c.json(await requestContext.services.managed.listHubSkills({ owner: url.searchParams.get("owner") ?? undefined, ref: url.searchParams.get("ref") ?? undefined, repo: url.searchParams.get("repo") ?? undefined }));
+  });
+  addCompatibilityRoute(app, "POST", "/workspace/:workspaceId/skills/hub/:name", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    const body = await parseJsonBody(hubSkillInstallWriteSchema, c.req.raw).catch(() => ({} as any));
+    return c.json({ ok: true, ...(await requestContext.services.managed.installHubSkill(workspaceId, { name: c.req.param("name") ?? "", overwrite: body.overwrite, repo: body.repo })) });
+  });
+
+  const workspaceRouterPaths = [
+    "/workspace/:workspaceId/opencode-router",
+    routePaths.workspaces.router.base(),
+  ];
+  for (const basePath of workspaceRouterPaths) {
+    addCompatibilityRoute(app, "GET", `${basePath}/health`, (c) => {
+      requireWorkspace(c);
+      return c.json(getRequestContext(c).services.router.getHealth());
+    });
+    addCompatibilityRoute(app, "POST", `${basePath}/telegram-token`, async (c) => c.json(await getRequestContext(c).services.router.setTelegramToken((await parseJsonBody(routerTelegramWriteSchema, c.req.raw)).token)));
+    addCompatibilityRoute(app, "GET", `${basePath}/telegram`, async (c) => c.json(await getRequestContext(c).services.router.getTelegramInfo()));
+    addCompatibilityRoute(app, "POST", `${basePath}/telegram-enabled`, async (c) => {
+      const body = await c.req.json();
+      return c.json(await getRequestContext(c).services.router.setTelegramEnabled(body.enabled === true, { clearToken: body.clearToken === true }));
+    });
+    addCompatibilityRoute(app, "GET", `${basePath}/identities/telegram`, (c) => c.json(getRequestContext(c).services.router.listTelegramIdentities()));
+    addCompatibilityRoute(app, "POST", `${basePath}/identities/telegram`, async (c) => c.json(await getRequestContext(c).services.router.upsertTelegramIdentity(await parseJsonBody(routerTelegramWriteSchema, c.req.raw))));
+    addCompatibilityRoute(app, "DELETE", `${basePath}/identities/telegram/:identityId`, async (c) => c.json(await getRequestContext(c).services.router.deleteTelegramIdentity(c.req.param("identityId") ?? "")));
+    addCompatibilityRoute(app, "GET", `${basePath}/identities/slack`, (c) => c.json(getRequestContext(c).services.router.listSlackIdentities()));
+    addCompatibilityRoute(app, "POST", `${basePath}/identities/slack`, async (c) => c.json(await getRequestContext(c).services.router.upsertSlackIdentity(await parseJsonBody(routerSlackWriteSchema, c.req.raw))));
+    addCompatibilityRoute(app, "DELETE", `${basePath}/identities/slack/:identityId`, async (c) => c.json(await getRequestContext(c).services.router.deleteSlackIdentity(c.req.param("identityId") ?? "")));
+    addCompatibilityRoute(app, "POST", `${basePath}/slack-tokens`, async (c) => {
+      const body = await parseJsonBody(routerSlackWriteSchema, c.req.raw);
+      return c.json(await getRequestContext(c).services.router.setSlackTokens(body.botToken, body.appToken));
+    });
+    addCompatibilityRoute(app, "GET", `${basePath}/bindings`, (c) => {
+      const requestContext = getRequestContext(c);
+      const url = new URL(c.req.url);
+      return c.json(requestContext.services.router.listBindings({ channel: url.searchParams.get("channel") ?? undefined, identityId: url.searchParams.get("identityId") ?? undefined }));
+    });
+    addCompatibilityRoute(app, "POST", `${basePath}/bindings`, async (c) => {
+      const requestContext = getRequestContext(c);
+      const body = await parseJsonBody(routerBindingWriteSchema, c.req.raw);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+      const workspace = requestContext.services.workspaceRegistry.getById(workspaceId, { includeHidden: true });
+      const directory = body.directory?.trim() || workspace?.backend.local?.dataDir || "";
+      return c.json(await requestContext.services.router.setBinding({ channel: body.channel, directory, identityId: body.identityId, peerId: body.peerId }));
+    });
+    addCompatibilityRoute(app, "POST", `${basePath}/send`, async (c) => c.json(await getRequestContext(c).services.router.sendMessage(await parseJsonBody(routerSendWriteSchema, c.req.raw))));
+  }
+
+  addCompatibilityRoute(app, "GET", "/workspace/:workspaceId/export", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    const sensitiveMode = (new URL(c.req.url).searchParams.get("sensitive")?.trim() as "auto" | "exclude" | "include" | null) ?? "auto";
+    const result = await requestContext.services.managed.exportWorkspace(workspaceId, { sensitiveMode: sensitiveMode === "exclude" || sensitiveMode === "include" || sensitiveMode === "auto" ? sensitiveMode : "auto" });
+    if ("conflict" in result) {
+      return c.json({ code: "workspace_export_requires_decision", details: { warnings: result.warnings }, message: "This workspace includes sensitive config. Choose whether to exclude it or include it before exporting." }, 409);
+    }
+    return c.json(result);
+  });
+  addCompatibilityRoute(app, "POST", "/workspace/:workspaceId/import", async (c) => {
+    const { requestContext, workspaceId } = requireWorkspace(c);
+    return c.json(await requestContext.services.managed.importWorkspace(workspaceId, await c.req.json()));
+  });
+}
diff --git a/apps/server-v2/src/routes/route-paths.ts b/apps/server-v2/src/routes/route-paths.ts
new file mode 100644
index 0000000000..b441040589
--- /dev/null
+++ b/apps/server-v2/src/routes/route-paths.ts
@@ -0,0 +1,183 @@
+const WORKSPACE_ID_PARAMETER = ":workspaceId";
+
+export const routeNamespaces = {
+  root: "/",
+  openapi: "/openapi.json",
+  system: "/system",
+  workspaces: "/workspaces",
+} as const;
+
+export function workspaceRoutePath(workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${routeNamespaces.workspaces}/${workspaceId}`;
+}
+
+function workspaceSessionsBasePath(workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${workspaceRoutePath(workspaceId)}/sessions`;
+}
+
+function workspaceSessionPath(sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${workspaceSessionsBasePath(workspaceId)}/${sessionId}`;
+}
+
+function workspaceSessionMessagesPath(sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${workspaceSessionPath(sessionId, workspaceId)}/messages`;
+}
+
+function workspaceFileSessionsBasePath(workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${workspaceRoutePath(workspaceId)}/file-sessions`;
+}
+
+function workspaceFileSessionPath(fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) {
+  return `${workspaceFileSessionsBasePath(workspaceId)}/${fileSessionId}`;
+}
+
+function workspaceSessionMessagePath(
+  messageId: string = ":messageId",
+  sessionId: string = ":sessionId",
+  workspaceId: string = WORKSPACE_ID_PARAMETER,
+) {
+  return `${workspaceSessionMessagesPath(sessionId, workspaceId)}/${messageId}`;
+}
+
+export const workspaceResourcePattern = workspaceRoutePath();
+
+export const routePaths = {
+  root: routeNamespaces.root,
+  openapiDocument: routeNamespaces.openapi,
+  system: {
+    base: routeNamespaces.system,
+    capabilities: `${routeNamespaces.system}/capabilities`,
+    cloudSignin: `${routeNamespaces.system}/cloud-signin`,
+    health: `${routeNamespaces.system}/health`,
+    managed: {
+      item: (kind: string, itemId: string = ":itemId") => `${routeNamespaces.system}/managed/${kind}/${itemId}`,
+      list: (kind: string) => `${routeNamespaces.system}/managed/${kind}`,
+      assignments: (kind: string, itemId: string = ":itemId") => `${routeNamespaces.system}/managed/${kind}/${itemId}/assignments`,
+    },
+    meta: `${routeNamespaces.system}/meta`,
+    opencodeHealth: `${routeNamespaces.system}/opencode/health`,
+    router: {
+      apply: `${routeNamespaces.system}/router/apply`,
+      bindings: `${routeNamespaces.system}/router/bindings`,
+      health: `${routeNamespaces.system}/router/product-health`,
+      identities: (kind: string) => `${routeNamespaces.system}/router/identities/${kind}`,
+      telegram: `${routeNamespaces.system}/router/telegram`,
+      send: `${routeNamespaces.system}/router/send`,
+    },
+    routerHealth: `${routeNamespaces.system}/router/health`,
+    servers: `${routeNamespaces.system}/servers`,
+    serverById: (serverId: string = ":serverId") => `${routeNamespaces.system}/servers/${serverId}`,
+    serverConnect: `${routeNamespaces.system}/servers/connect`,
+    serverSync: (serverId: string = ":serverId") => `${routeNamespaces.system}/servers/${serverId}/sync`,
+    status: `${routeNamespaces.system}/status`,
+    runtime: {
+      upgrade: `${routeNamespaces.system}/runtime/upgrade`,
+      summary: `${routeNamespaces.system}/runtime/summary`,
+      versions: `${routeNamespaces.system}/runtime/versions`,
+    },
+  },
+  workspaces: {
+    base: routeNamespaces.workspaces,
+    createLocal: `${routeNamespaces.workspaces}/local`,
+    byId: workspaceRoutePath,
+    dispose: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/dispose`,
+    events: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/events`,
+    activate: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/activate`,
+    displayName: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/display-name`,
+    artifacts: {
+      base: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/artifacts`,
+      byId: (artifactId: string = ":artifactId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceRoutePath(workspaceId)}/artifacts/${artifactId}`,
+    },
+    config: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/config`,
+    engineReload: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/engine/reload`,
+    export: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/export`,
+    fileSessions: {
+      base: workspaceFileSessionsBasePath,
+      byId: workspaceFileSessionPath,
+      renew: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/renew`,
+      catalogSnapshot: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/catalog/snapshot`,
+      catalogEvents: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/catalog/events`,
+      readBatch: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/read-batch`,
+      writeBatch: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/write-batch`,
+      operations: (fileSessionId: string = ":fileSessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceFileSessionPath(fileSessionId, workspaceId)}/operations`,
+    },
+    inbox: {
+      base: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/inbox`,
+      byId: (inboxId: string = ":inboxId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceRoutePath(workspaceId)}/inbox/${inboxId}`,
+    },
+    import: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/import`,
+    mcp: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/mcp`,
+    plugins: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/plugins`,
+    rawOpencodeConfig: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/config/opencode-raw`,
+    reloadEvents: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/reload-events`,
+    router: {
+      base: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router`,
+      bindings: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/bindings`,
+      health: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/health`,
+      identities: {
+        slack: (workspaceId: string = WORKSPACE_ID_PARAMETER, identityId: string = ":identityId") => `${workspaceRoutePath(workspaceId)}/opencode-router/identities/slack/${identityId}`,
+        slackBase: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/identities/slack`,
+        telegram: (workspaceId: string = WORKSPACE_ID_PARAMETER, identityId: string = ":identityId") => `${workspaceRoutePath(workspaceId)}/opencode-router/identities/telegram/${identityId}`,
+        telegramBase: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/identities/telegram`,
+      },
+      send: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/send`,
+      slackTokens: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/slack-tokens`,
+      telegram: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/telegram`,
+      telegramEnabled: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/telegram-enabled`,
+      telegramToken: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/opencode-router/telegram-token`,
+    },
+    share: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/share`,
+    sessions: {
+      base: workspaceSessionsBasePath,
+      byId: workspaceSessionPath,
+      statuses: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceSessionsBasePath(workspaceId)}/status`,
+      messages: {
+        base: workspaceSessionMessagesPath,
+        byId: workspaceSessionMessagePath,
+        partById: (
+          partId: string = ":partId",
+          messageId: string = ":messageId",
+          sessionId: string = ":sessionId",
+          workspaceId: string = WORKSPACE_ID_PARAMETER,
+        ) => `${workspaceSessionMessagePath(messageId, sessionId, workspaceId)}/parts/${partId}`,
+      },
+      promptAsync: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/prompt_async`,
+      command: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/command`,
+      shell: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/shell`,
+      todo: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/todo`,
+      status: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/status`,
+      snapshot: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/snapshot`,
+      init: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/init`,
+      fork: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/fork`,
+      abort: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/abort`,
+      share: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/share`,
+      summarize: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/summarize`,
+      revert: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/revert`,
+      unrevert: (sessionId: string = ":sessionId", workspaceId: string = WORKSPACE_ID_PARAMETER) =>
+        `${workspaceSessionPath(sessionId, workspaceId)}/unrevert`,
+    },
+    skills: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/skills`,
+    hubSkills: "/hub/skills",
+    simpleContent: (workspaceId: string = WORKSPACE_ID_PARAMETER) => `${workspaceRoutePath(workspaceId)}/files/content`,
+  },
+} as const;
diff --git a/apps/server-v2/src/routes/runtime.ts b/apps/server-v2/src/routes/runtime.ts
new file mode 100644
index 0000000000..ddaa55d025
--- /dev/null
+++ b/apps/server-v2/src/routes/runtime.ts
@@ -0,0 +1,101 @@
+import type { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildSuccessResponse } from "../http.js";
+import { jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import {
+  opencodeHealthResponseSchema,
+  routerHealthResponseSchema,
+  runtimeSummaryResponseSchema,
+  runtimeUpgradeResponseSchema,
+  runtimeVersionsResponseSchema,
+} from "../schemas/runtime.js";
+import { routePaths } from "./route-paths.js";
+
+export function registerRuntimeRoutes(app: Hono<AppBindings>) {
+  app.get(
+    routePaths.system.opencodeHealth,
+    describeRoute({
+      tags: ["Runtime"],
+      summary: "Get OpenCode health",
+      description: "Returns the server-owned OpenCode runtime health, version, URL, and recent diagnostics.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("OpenCode runtime health returned successfully.", opencodeHealthResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.runtime.getOpencodeHealth()));
+    },
+  );
+
+  app.get(
+    routePaths.system.routerHealth,
+    describeRoute({
+      tags: ["Runtime"],
+      summary: "Get router health",
+      description: "Returns the server-owned opencode-router health, enablement decision, and recent diagnostics.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Router runtime health returned successfully.", routerHealthResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.runtime.getRouterHealth()));
+    },
+  );
+
+  app.get(
+    routePaths.system.runtime.summary,
+    describeRoute({
+      tags: ["Runtime"],
+      summary: "Get runtime summary",
+      description: "Returns the current runtime supervision summary, manifest, restart policy, and child process state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Runtime summary returned successfully.", runtimeSummaryResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.runtime.getRuntimeSummary()));
+    },
+  );
+
+  app.get(
+    routePaths.system.runtime.versions,
+    describeRoute({
+      tags: ["Runtime"],
+      summary: "Get runtime versions",
+      description: "Returns the active and pinned runtime versions that Server V2 resolved for OpenCode and opencode-router.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Runtime versions returned successfully.", runtimeVersionsResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.runtime.getRuntimeVersions()));
+    },
+  );
+
+  app.post(
+    routePaths.system.runtime.upgrade,
+    describeRoute({
+      tags: ["Runtime"],
+      summary: "Upgrade runtime assets",
+      description: "Re-resolves the pinned runtime bundle through Server V2, restarts managed children, and returns the resulting runtime summary plus upgrade state.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Runtime upgraded successfully.", runtimeUpgradeResponseSchema),
+      }, { includeForbidden: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireHost(requestContext.actor);
+      const result = await requestContext.services.runtime.upgradeRuntime();
+      return c.json(buildSuccessResponse(requestContext.requestId, result));
+    },
+  );
+}
diff --git a/apps/server-v2/src/routes/sessions.ts b/apps/server-v2/src/routes/sessions.ts
new file mode 100644
index 0000000000..688d731338
--- /dev/null
+++ b/apps/server-v2/src/routes/sessions.ts
@@ -0,0 +1,531 @@
+import type { Context, Hono } from "hono";
+import { describeRoute, resolver } from "hono-openapi";
+import { HTTPException } from "hono/http-exception";
+import { TextEncoder } from "node:util";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildSuccessResponse } from "../http.js";
+import { jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import {
+  acceptedActionResponseSchema,
+  commandRequestSchema,
+  deletedActionResponseSchema,
+  messageIdParamsSchema,
+  messageListResponseSchema,
+  messagePartParamsSchema,
+  messagePartUpdateRequestSchema,
+  messageResponseSchema,
+  messageSendRequestSchema,
+  promptAsyncRequestSchema,
+  revertRequestSchema,
+  sessionCreateRequestSchema,
+  sessionForkRequestSchema,
+  sessionIdParamsSchema,
+  sessionListQuerySchema,
+  sessionListResponseSchema,
+  sessionMessagesQuerySchema,
+  sessionResponseSchema,
+  sessionSnapshotResponseSchema,
+  sessionStatusResponseSchema,
+  sessionStatusesResponseSchema,
+  sessionSummarizeRequestSchema,
+  sessionTodoListResponseSchema,
+  sessionUpdateRequestSchema,
+  shellRequestSchema,
+  workspaceEventSchema,
+} from "../schemas/sessions.js";
+import { routePaths } from "./route-paths.js";
+
+function parseQuery<T>(schema: { parse(input: unknown): T }, url: string) {
+  const searchParams = new URL(url).searchParams;
+  const query: Record<string, string> = {};
+  for (const [key, value] of searchParams.entries()) {
+    query[key] = value;
+  }
+  return schema.parse(query);
+}
+
+async function parseBody<T>(schema: { parse(input: unknown): T }, request: Request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/json")) {
+    return schema.parse({});
+  }
+  return schema.parse(await request.json());
+}
+
+function requireReadableWorkspace(c: Context<AppBindings>) {
+  const requestContext = getRequestContext(c);
+  requestContext.services.auth.requireVisibleRead(requestContext.actor);
+  const workspaceId = c.req.param("workspaceId") ?? "";
+  const workspace = requestContext.services.workspaceRegistry.getById(
+    workspaceId,
+    { includeHidden: requestContext.actor.kind === "host" },
+  );
+  if (!workspace) {
+    throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+  }
+  return { requestContext, workspaceId };
+}
+
+function createSseResponse(stream: AsyncIterable<unknown>, signal?: AbortSignal) {
+  const encoder = new TextEncoder();
+  let eventId = 0;
+  const iterator = stream[Symbol.asyncIterator]();
+  return new Response(new ReadableStream({
+    async start(controller) {
+      try {
+        while (true) {
+          const next = await iterator.next();
+          if (next.done) {
+            controller.close();
+            return;
+          }
+          eventId += 1;
+          controller.enqueue(encoder.encode(`id: ${eventId}\ndata: ${JSON.stringify(next.value)}\n\n`));
+        }
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel() {
+      if (typeof iterator.return === "function") {
+        await iterator.return();
+      }
+    },
+  }), {
+    headers: {
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "Content-Type": "text/event-stream",
+    },
+  });
+}
+
+export function registerSessionRoutes(app: Hono<AppBindings>) {
+  app.get(
+    routePaths.workspaces.sessions.base(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "List workspace sessions",
+      description: "Returns the normalized session inventory for the resolved local OpenCode or remote OpenWork workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace sessions returned successfully.", sessionListResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const query = parseQuery(sessionListQuerySchema, c.req.url);
+      const items = await requestContext.services.sessions.listSessions(workspaceId, query);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.statuses(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "List workspace session statuses",
+      description: "Returns the latest normalized session status map for the resolved workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session statuses returned successfully.", sessionStatusesResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const items = await requestContext.services.sessions.listSessionStatuses(workspaceId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items }));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.sessions.base(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Create a workspace session",
+      description: "Creates a new session inside the resolved workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session created successfully.", sessionResponseSchema),
+      }, { includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const body = await parseBody(sessionCreateRequestSchema, c.req.raw);
+      const session = await requestContext.services.sessions.createSession(workspaceId, body as Record<string, unknown>);
+      return c.json(buildSuccessResponse(requestContext.requestId, session));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.byId(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Get workspace session detail",
+      description: "Returns one normalized session by workspace and session identifier.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session returned successfully.", sessionResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const session = await requestContext.services.sessions.getSession(workspaceId, params.sessionId);
+      return c.json(buildSuccessResponse(requestContext.requestId, session));
+    },
+  );
+
+  app.patch(
+    routePaths.workspaces.sessions.byId(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Update a workspace session",
+      description: "Updates a normalized session inside the resolved workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session updated successfully.", sessionResponseSchema),
+      }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const body = await parseBody(sessionUpdateRequestSchema, c.req.raw);
+      const session = await requestContext.services.sessions.updateSession(workspaceId, params.sessionId, body as Record<string, unknown>);
+      return c.json(buildSuccessResponse(requestContext.requestId, session));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.sessions.byId(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Delete a workspace session",
+      description: "Deletes a session inside the resolved workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session deleted successfully.", deletedActionResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      await requestContext.services.sessions.deleteSession(workspaceId, params.sessionId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { deleted: true }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.status(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Get one session status",
+      description: "Returns the normalized status for a single session.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session status returned successfully.", sessionStatusResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const status = await requestContext.services.sessions.getSessionStatus(workspaceId, params.sessionId);
+      return c.json(buildSuccessResponse(requestContext.requestId, status));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.todo(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "List one session todos",
+      description: "Returns the normalized todo list for a single session.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session todos returned successfully.", sessionTodoListResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const items = await requestContext.services.sessions.listTodos(workspaceId, params.sessionId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.snapshot(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Get one session snapshot",
+      description: "Returns session detail, messages, todos, and status in one normalized payload for detail surfaces.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session snapshot returned successfully.", sessionSnapshotResponseSchema),
+      }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const query = parseQuery(sessionMessagesQuerySchema, c.req.url);
+      const snapshot = await requestContext.services.sessions.getSessionSnapshot(workspaceId, params.sessionId, query);
+      return c.json(buildSuccessResponse(requestContext.requestId, snapshot));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.messages.base(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "List session messages",
+      description: "Returns the normalized message list for a single session.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session messages returned successfully.", messageListResponseSchema),
+      }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const query = parseQuery(sessionMessagesQuerySchema, c.req.url);
+      const items = await requestContext.services.sessions.listMessages(workspaceId, params.sessionId, query);
+      return c.json(buildSuccessResponse(requestContext.requestId, { items }));
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.sessions.messages.byId(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "Get one session message",
+      description: "Returns one normalized message by workspace, session, and message identifier.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session message returned successfully.", messageResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = messageIdParamsSchema.parse(c.req.param());
+      const message = await requestContext.services.sessions.getMessage(workspaceId, params.sessionId, params.messageId);
+      return c.json(buildSuccessResponse(requestContext.requestId, message));
+    },
+  );
+
+  app.post(
+    routePaths.workspaces.sessions.messages.base(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "Send a session message",
+      description: "Sends a normalized message payload to the resolved workspace backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session message accepted successfully.", acceptedActionResponseSchema),
+      }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      const body = await parseBody(messageSendRequestSchema, c.req.raw);
+      await requestContext.services.sessions.sendMessage(workspaceId, params.sessionId, body as Record<string, unknown>);
+      return c.json(buildSuccessResponse(requestContext.requestId, { accepted: true }));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.sessions.messages.byId(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "Delete a session message",
+      description: "Deletes one message inside the resolved session backend.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session message deleted successfully.", deletedActionResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = messageIdParamsSchema.parse(c.req.param());
+      await requestContext.services.sessions.deleteMessage(workspaceId, params.sessionId, params.messageId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { deleted: true }));
+    },
+  );
+
+  app.patch(
+    routePaths.workspaces.sessions.messages.partById(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "Update a session message part",
+      description: "Updates one message part inside the resolved session backend where the upstream backend supports it.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session message part updated successfully.", acceptedActionResponseSchema),
+      }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c as never);
+      const params = messagePartParamsSchema.parse(c.req.param());
+      const body = await parseBody(messagePartUpdateRequestSchema, c.req.raw);
+      await requestContext.services.sessions.updateMessagePart(
+        workspaceId,
+        params.sessionId,
+        params.messageId,
+        params.partId,
+        body as Record<string, unknown>,
+      );
+      return c.json(buildSuccessResponse(requestContext.requestId, { accepted: true }));
+    },
+  );
+
+  app.delete(
+    routePaths.workspaces.sessions.messages.partById(),
+    describeRoute({
+      tags: ["Messages"],
+      summary: "Delete a session message part",
+      description: "Deletes one message part inside the resolved session backend where the upstream backend supports it.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace session message part deleted successfully.", deletedActionResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c as never);
+      const params = messagePartParamsSchema.parse(c.req.param());
+      await requestContext.services.sessions.deleteMessagePart(workspaceId, params.sessionId, params.messageId, params.partId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { deleted: true }));
+    },
+  );
+
+  const actionRoute = (
+    path: string,
+    summary: string,
+    description: string,
+    handler: (input: {
+      body: Record<string, unknown>;
+      requestContext: ReturnType<typeof getRequestContext>;
+      sessionId: string;
+      workspaceId: string;
+    }) => Promise<unknown>,
+    bodySchema?: { parse(input: unknown): Record<string, unknown> },
+    responseSchema: any = acceptedActionResponseSchema,
+  ) => {
+    app.post(
+      path,
+      describeRoute({
+        tags: ["Sessions"],
+        summary,
+        description,
+        responses: withCommonErrorResponses({
+          200: jsonResponse(`${summary} completed successfully.`, responseSchema),
+        }, { includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+      }),
+      async (c) => {
+        const { requestContext, workspaceId } = requireReadableWorkspace(c);
+        const params = sessionIdParamsSchema.parse(c.req.param());
+        const body = bodySchema ? await parseBody(bodySchema, c.req.raw) : {};
+        const result = await handler({ body, requestContext, sessionId: params.sessionId, workspaceId });
+        return c.json(buildSuccessResponse(requestContext.requestId, result ?? { accepted: true }));
+      },
+    );
+  };
+
+  actionRoute(
+    routePaths.workspaces.sessions.init(),
+    "Initialize a session",
+    "Runs the upstream session init primitive through the workspace-first API.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.initSession(workspaceId, sessionId, body),
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.fork(),
+    "Fork a session",
+    "Forks a session inside the resolved workspace backend.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.forkSession(workspaceId, sessionId, body),
+    sessionForkRequestSchema as never,
+    sessionResponseSchema,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.abort(),
+    "Abort a session",
+    "Aborts an in-flight session run through the workspace-first API.",
+    ({ requestContext, sessionId, workspaceId }) => requestContext.services.sessions.abortSession(workspaceId, sessionId),
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.share(),
+    "Share a session",
+    "Calls the upstream share primitive when the resolved backend supports it.",
+    ({ requestContext, sessionId, workspaceId }) => requestContext.services.sessions.shareSession(workspaceId, sessionId),
+  );
+  app.delete(
+    routePaths.workspaces.sessions.share(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Unshare a session",
+      description: "Calls the upstream unshare primitive when the resolved backend supports it.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Session unshared successfully.", acceptedActionResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const params = sessionIdParamsSchema.parse(c.req.param());
+      await requestContext.services.sessions.unshareSession(workspaceId, params.sessionId);
+      return c.json(buildSuccessResponse(requestContext.requestId, { accepted: true }));
+    },
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.summarize(),
+    "Summarize a session",
+    "Runs the upstream summarize or compact primitive for the selected session.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.summarizeSession(workspaceId, sessionId, body),
+    sessionSummarizeRequestSchema as never,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.promptAsync(),
+    "Send an async prompt",
+    "Sends a prompt_async request to the resolved session backend for composer flows.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.promptAsync(workspaceId, sessionId, body),
+    promptAsyncRequestSchema as never,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.command(),
+    "Run a session command",
+    "Runs a slash-command style session command through the workspace-first API.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.command(workspaceId, sessionId, body),
+    commandRequestSchema as never,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.shell(),
+    "Run a session shell command",
+    "Runs a shell command inside the resolved session backend.",
+    ({ body, requestContext, sessionId, workspaceId }) => requestContext.services.sessions.shell(workspaceId, sessionId, body),
+    shellRequestSchema as never,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.revert(),
+    "Revert session history",
+    "Reverts a session to the requested message boundary.",
+    ({ body, requestContext, sessionId, workspaceId }) =>
+      requestContext.services.sessions.revert(workspaceId, sessionId, body as { messageID: string }),
+    revertRequestSchema as never,
+    sessionResponseSchema,
+  );
+  actionRoute(
+    routePaths.workspaces.sessions.unrevert(),
+    "Restore reverted session history",
+    "Restores previously reverted session history.",
+    ({ requestContext, sessionId, workspaceId }) => requestContext.services.sessions.unrevert(workspaceId, sessionId),
+    undefined,
+    sessionResponseSchema,
+  );
+
+  app.get(
+    routePaths.workspaces.events(),
+    describeRoute({
+      tags: ["Sessions"],
+      summary: "Stream workspace events",
+      description: "Streams normalized session and message events for one workspace over Server-Sent Events.",
+      responses: withCommonErrorResponses({
+        200: {
+          description: "Workspace events streamed successfully.",
+          content: {
+            "text/event-stream": {
+              schema: resolver(workspaceEventSchema),
+            },
+          },
+        },
+      }, { includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const { requestContext, workspaceId } = requireReadableWorkspace(c);
+      const abort = new AbortController();
+      c.req.raw.signal.addEventListener("abort", () => abort.abort(), { once: true });
+      const stream = await requestContext.services.sessions.streamWorkspaceEvents(workspaceId, abort.signal);
+      return createSseResponse(stream, abort.signal);
+    },
+  );
+}
diff --git a/apps/server-v2/src/routes/system.ts b/apps/server-v2/src/routes/system.ts
new file mode 100644
index 0000000000..d70a8ab4c0
--- /dev/null
+++ b/apps/server-v2/src/routes/system.ts
@@ -0,0 +1,319 @@
+import type { Hono } from "hono";
+import { describeRoute, openAPIRouteHandler } from "hono-openapi";
+import { HTTPException } from "hono/http-exception";
+import type { AppDependencies } from "../context/app-dependencies.js";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildErrorResponse, buildSuccessResponse, RouteError } from "../http.js";
+import { buildOperationId, jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import {
+  capabilitiesResponseSchema,
+  remoteServerConnectRequestSchema,
+  remoteServerConnectResponseSchema,
+  remoteServerSyncRequestSchema,
+  serverInventoryListResponseSchema,
+  systemStatusResponseSchema,
+} from "../schemas/registry.js";
+import { healthResponseSchema, metadataResponseSchema, openApiDocumentSchema, rootInfoResponseSchema } from "../schemas/system.js";
+import { routePaths } from "./route-paths.js";
+
+type ServerV2App = Hono<AppBindings>;
+
+function toWorkspaceSummary(workspace: ReturnType<AppDependencies["services"]["workspaceRegistry"]["serializeWorkspace"]>) {
+  const { notes: _notes, ...summary } = workspace;
+  return summary;
+}
+
+async function parseJsonBody<T>(schema: { parse(input: unknown): T }, request: Request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/json")) {
+    return schema.parse({});
+  }
+  return schema.parse(await request.json());
+}
+
+function buildRouteErrorJson(requestId: string, error: unknown) {
+  if (error instanceof HTTPException) {
+    const status = error.status;
+    const code = status === 401
+      ? "unauthorized"
+      : status === 403
+        ? "forbidden"
+        : status === 404
+          ? "not_found"
+          : "invalid_request";
+    return {
+      body: buildErrorResponse({
+        code,
+        message: error.message || (code === "not_found" ? "Route not found." : "Request failed."),
+        requestId,
+      }),
+      status,
+    };
+  }
+  if (error instanceof RouteError) {
+    return {
+      body: buildErrorResponse({
+        code: error.code,
+        details: error.details,
+        message: error.message,
+        requestId,
+      }),
+      status: error.status,
+    };
+  }
+  const routeLike = error && typeof error === "object"
+    ? error as { code?: unknown; details?: unknown; message?: unknown; status?: unknown }
+    : null;
+  if (routeLike && typeof routeLike.status === "number" && typeof routeLike.code === "string" && typeof routeLike.message === "string") {
+    return {
+      body: buildErrorResponse({
+        code: routeLike.code as any,
+        details: Array.isArray(routeLike.details) ? routeLike.details as any : undefined,
+        message: routeLike.message,
+        requestId,
+      }),
+      status: routeLike.status,
+    };
+  }
+  return null;
+}
+
+function createOpenApiDocumentation(version: string) {
+  return {
+    openapi: "3.1.0",
+    info: {
+        title: "OpenWork Server V2",
+        version,
+        description: [
+          "OpenAPI contract for the standalone OpenWork Server V2 runtime and durable registry state.",
+          "",
+          "Phase 10 makes Server V2 the default runtime, keeps release/runtime assets in a managed extracted directory, and closes the remaining cutover tooling around the standalone contract.",
+        ].join("\n"),
+    },
+    servers: [{ url: "/" }],
+    tags: [
+      {
+        name: "System",
+        description: "Server-level operational routes and contract metadata.",
+      },
+      {
+        name: "Workspaces",
+        description: "Workspace-first resources will live under /workspaces/:workspaceId.",
+      },
+      {
+        name: "Runtime",
+        description: "Server-owned runtime supervision, versions, and child process health.",
+      },
+      {
+        name: "Sessions",
+        description: "Workspace-first session and streaming primitives backed by OpenCode or remote OpenWork servers.",
+      },
+      {
+        name: "Messages",
+        description: "Workspace-first message history and mutation primitives nested under sessions.",
+      },
+      {
+        name: "Config",
+        description: "Workspace-scoped config projection, raw config editing, and materialization owned by Server V2.",
+      },
+      {
+        name: "Files",
+        description: "Workspace-scoped file sessions, simple content routes, inbox, and artifact surfaces owned by Server V2.",
+      },
+      {
+        name: "Reload",
+        description: "Workspace-scoped reload events, reconciliation, and explicit runtime reload controls.",
+      },
+    ],
+  };
+}
+
+export function registerSystemRoutes(app: ServerV2App, dependencies: AppDependencies) {
+  app.get(
+    routePaths.root,
+    describeRoute({
+      tags: ["System"],
+      summary: "Get server root information",
+      description: "Returns the root metadata for the standalone Server V2 process and its route conventions.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Server root information returned successfully.", rootInfoResponseSchema),
+      }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.getRootInfo()));
+    },
+  );
+
+  app.get(
+    routePaths.system.health,
+    describeRoute({
+      tags: ["System"],
+      summary: "Check Server V2 health",
+      description: "Returns a lightweight health response for the standalone Server V2 process.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Server health returned successfully.", healthResponseSchema),
+      }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.getHealth()));
+    },
+  );
+
+  app.get(
+    routePaths.system.meta,
+    describeRoute({
+      tags: ["System"],
+      summary: "Get foundation metadata",
+      description: "Returns middleware ordering, route namespace conventions, sqlite bootstrap status, and startup import diagnostics.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Server metadata returned successfully.", metadataResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.getMetadata(requestContext.actor)));
+    },
+  );
+
+  app.get(
+    routePaths.system.capabilities,
+    describeRoute({
+      tags: ["System"],
+      summary: "Get server capabilities",
+      description: "Returns the typed Server V2 capability model, including auth requirements and migrated registry/runtime read slices.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Server capabilities returned successfully.", capabilitiesResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.getCapabilities(requestContext.actor)));
+    },
+  );
+
+  app.get(
+    routePaths.system.status,
+    describeRoute({
+      tags: ["System"],
+      summary: "Get normalized system status",
+      description: "Returns normalized status, registry summary, auth requirements, runtime summary, and capabilities for app startup and settings surfaces.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("System status returned successfully.", systemStatusResponseSchema),
+      }, { includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.getStatus(requestContext.actor)));
+    },
+  );
+
+  app.get(
+    routePaths.system.servers,
+    describeRoute({
+      tags: ["System"],
+      summary: "List known server targets",
+      description: "Returns the local server registry inventory. This is host-scoped because it can reveal internal server connection metadata.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Server inventory returned successfully.", serverInventoryListResponseSchema),
+      }, { includeForbidden: true, includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireHost(requestContext.actor);
+      return c.json(buildSuccessResponse(requestContext.requestId, requestContext.services.system.listServers()));
+    },
+  );
+
+  app.post(
+    routePaths.system.serverConnect,
+    describeRoute({
+      tags: ["System"],
+      summary: "Connect a remote OpenWork server",
+      description: "Validates a remote OpenWork server through the local Server V2 process, stores the remote connection metadata, and syncs the discovered remote workspaces into the local canonical registry.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Remote OpenWork server connected successfully.", remoteServerConnectResponseSchema),
+      }, { includeForbidden: true, includeInvalidRequest: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireHost(requestContext.actor);
+      const body = await parseJsonBody(remoteServerConnectRequestSchema, c.req.raw);
+      let result;
+      try {
+        result = await requestContext.services.remoteServers.connect(body);
+      } catch (error) {
+        const resolved = buildRouteErrorJson(requestContext.requestId, error);
+        if (resolved) {
+          return c.json(resolved.body, resolved.status as any);
+        }
+        throw error;
+      }
+      return c.json(buildSuccessResponse(requestContext.requestId, {
+        selectedWorkspaceId: result.selectedWorkspaceId,
+        server: requestContext.services.serverRegistry.serialize(result.server, { includeBaseUrl: true }),
+        workspaces: result.workspaces.map((workspace) => toWorkspaceSummary(requestContext.services.workspaceRegistry.serializeWorkspace(workspace))),
+      }));
+    },
+  );
+
+  app.post(
+    routePaths.system.serverSync(),
+    describeRoute({
+      tags: ["System"],
+      summary: "Sync a remote OpenWork server",
+      description: "Refreshes the remote workspace inventory for a stored remote OpenWork server and updates the local canonical registry mapping.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Remote OpenWork server synced successfully.", remoteServerConnectResponseSchema),
+      }, { includeForbidden: true, includeInvalidRequest: true, includeNotFound: true, includeUnauthorized: true }),
+    }),
+    async (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireHost(requestContext.actor);
+      const body = await parseJsonBody(remoteServerSyncRequestSchema, c.req.raw);
+      const serverId = c.req.param("serverId") ?? "";
+      let result;
+      try {
+        result = await requestContext.services.remoteServers.sync(serverId, body);
+      } catch (error) {
+        const resolved = buildRouteErrorJson(requestContext.requestId, error);
+        if (resolved) {
+          return c.json(resolved.body, resolved.status as any);
+        }
+        throw error;
+      }
+      return c.json(buildSuccessResponse(requestContext.requestId, {
+        selectedWorkspaceId: result.selectedWorkspaceId,
+        server: requestContext.services.serverRegistry.serialize(result.server, { includeBaseUrl: true }),
+        workspaces: result.workspaces.map((workspace) => toWorkspaceSummary(requestContext.services.workspaceRegistry.serializeWorkspace(workspace))),
+      }));
+    },
+  );
+
+  app.get(
+    routePaths.openapiDocument,
+    describeRoute({
+      tags: ["System"],
+      summary: "Get the OpenAPI document",
+      description: "Returns the machine-readable OpenAPI 3.1 document generated from the Hono route definitions.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("OpenAPI document returned successfully.", openApiDocumentSchema),
+      }),
+    }),
+    openAPIRouteHandler(app, {
+      documentation: createOpenApiDocumentation(dependencies.version),
+      includeEmptyPaths: true,
+      exclude: [routePaths.openapiDocument],
+      excludeMethods: ["OPTIONS"],
+      defaultOptions: {
+        ALL: {
+          operationId: (route) => buildOperationId(route.method, route.path),
+        },
+      },
+    }),
+  );
+}
diff --git a/apps/server-v2/src/routes/workspaces.ts b/apps/server-v2/src/routes/workspaces.ts
new file mode 100644
index 0000000000..bb77b5e250
--- /dev/null
+++ b/apps/server-v2/src/routes/workspaces.ts
@@ -0,0 +1,73 @@
+import type { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { HTTPException } from "hono/http-exception";
+import { getRequestContext, type AppBindings } from "../context/request-context.js";
+import { buildSuccessResponse } from "../http.js";
+import { jsonResponse, withCommonErrorResponses } from "../openapi.js";
+import { workspaceDetailResponseSchema, workspaceListResponseSchema } from "../schemas/registry.js";
+import { routePaths } from "./route-paths.js";
+
+function readIncludeHidden(url: string) {
+  const value = new URL(url).searchParams.get("includeHidden")?.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes";
+}
+
+export function registerWorkspaceRoutes(app: Hono<AppBindings>) {
+  app.get(
+    routePaths.workspaces.base,
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "List workspaces",
+      description: "Returns the canonical workspace inventory from the server-owned registry. Hidden control/help workspaces are excluded unless the caller asks for them with host scope.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace inventory returned successfully.", workspaceListResponseSchema),
+      }, { includeForbidden: true, includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+
+      const includeHidden = readIncludeHidden(c.req.url);
+      if (includeHidden) {
+        requestContext.services.auth.requireHost(requestContext.actor);
+      }
+
+      return c.json(
+        buildSuccessResponse(
+          requestContext.requestId,
+          requestContext.services.system.listWorkspaces({ includeHidden }),
+        ),
+      );
+    },
+  );
+
+  app.get(
+    routePaths.workspaces.byId(),
+    describeRoute({
+      tags: ["Workspaces"],
+      summary: "Get workspace detail",
+      description: "Returns the canonical workspace detail shape for a single workspace, including backend resolution and runtime summary fields.",
+      responses: withCommonErrorResponses({
+        200: jsonResponse("Workspace detail returned successfully.", workspaceDetailResponseSchema),
+      }, { includeNotFound: true, includeUnauthorized: true }),
+    }),
+    (c) => {
+      const requestContext = getRequestContext(c);
+      requestContext.services.auth.requireVisibleRead(requestContext.actor);
+      const workspaceId = c.req.param("workspaceId") ?? "";
+
+      const workspace = requestContext.services.system.getWorkspace(
+        workspaceId,
+        { includeHidden: requestContext.actor.kind === "host" },
+      );
+
+      if (!workspace) {
+        throw new HTTPException(404, {
+          message: `Workspace not found: ${workspaceId}`,
+        });
+      }
+
+      return c.json(buildSuccessResponse(requestContext.requestId, workspace));
+    },
+  );
+}
diff --git a/apps/server-v2/src/runtime/assets.test.ts b/apps/server-v2/src/runtime/assets.test.ts
new file mode 100644
index 0000000000..c374fcffd3
--- /dev/null
+++ b/apps/server-v2/src/runtime/assets.test.ts
@@ -0,0 +1,275 @@
+import { afterEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { createRuntimeAssetService } from "./assets.js";
+import { registerEmbeddedRuntimeBundle } from "./embedded.js";
+import { resolveRuntimeTarget, type RuntimeManifest } from "./manifest.js";
+
+const cleanupPaths: string[] = [];
+const ENV_KEYS = [
+  "OPENWORK_SERVER_V2_RUNTIME_BUNDLE_DIR",
+  "OPENWORK_SERVER_V2_RUNTIME_SOURCE",
+  "OPENWORK_SERVER_V2_RUNTIME_RELEASE_DIR",
+  "OPENWORK_SERVER_V2_RUNTIME_MANIFEST_PATH",
+];
+const originalEnv = new Map(ENV_KEYS.map((key) => [key, process.env[key]]));
+
+afterEach(() => {
+  for (const [key, value] of originalEnv.entries()) {
+    if (typeof value === "string") {
+      process.env[key] = value;
+    } else {
+      delete process.env[key];
+    }
+  }
+  while (cleanupPaths.length > 0) {
+    const target = cleanupPaths.pop();
+    if (target) {
+      fs.rmSync(target, { force: true, recursive: true });
+    }
+  }
+  registerEmbeddedRuntimeBundle(undefined);
+});
+
+function makeTempDir(name: string) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), `${name}-`));
+  cleanupPaths.push(directory);
+  return directory;
+}
+
+async function sha256(filePath: string) {
+  const contents = await Bun.file(filePath).arrayBuffer();
+  return createHash("sha256").update(Buffer.from(contents)).digest("hex");
+}
+
+function writeVersionedBinary(filePath: string, version: string) {
+  const script = [
+    "#!/bin/sh",
+    'if [ "$1" = "--version" ]; then',
+    `  echo ${JSON.stringify(version)}`,
+    "  exit 0",
+    "fi",
+    "exit 0",
+    "",
+  ].join("\n");
+  fs.writeFileSync(filePath, script, "utf8");
+  fs.chmodSync(filePath, 0o755);
+}
+
+test("release runtime assets use manifest versions without reading repo metadata", async () => {
+  const target = resolveRuntimeTarget();
+  if (!target) {
+    throw new Error("Unsupported test target.");
+  }
+
+  const releaseRoot = makeTempDir("openwork-server-v2-release-assets");
+  const opencodePath = path.join(releaseRoot, process.platform === "win32" ? "opencode.exe" : "opencode");
+  const routerPath = path.join(releaseRoot, process.platform === "win32" ? "opencode-router.exe" : "opencode-router");
+  writeVersionedBinary(opencodePath, "1.4.9");
+  writeVersionedBinary(routerPath, "0.11.206");
+
+  const manifest: RuntimeManifest = {
+    files: {
+      opencode: {
+        path: path.basename(opencodePath),
+        sha256: await sha256(opencodePath),
+        size: fs.statSync(opencodePath).size,
+      },
+      "opencode-router": {
+        path: path.basename(routerPath),
+        sha256: await sha256(routerPath),
+        size: fs.statSync(routerPath).size,
+      },
+    },
+    generatedAt: new Date().toISOString(),
+    manifestVersion: 1,
+    opencodeVersion: "1.4.9",
+    rootDir: releaseRoot,
+    routerVersion: "0.11.206",
+    serverVersion: "0.0.0-test",
+    source: "release",
+    target,
+  };
+  const manifestPath = path.join(releaseRoot, "manifest.json");
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+
+  process.env.OPENWORK_SERVER_V2_RUNTIME_SOURCE = "release";
+  process.env.OPENWORK_SERVER_V2_RUNTIME_RELEASE_DIR = releaseRoot;
+  process.env.OPENWORK_SERVER_V2_RUNTIME_MANIFEST_PATH = manifestPath;
+
+  const service = createRuntimeAssetService({
+    environment: "test",
+    serverVersion: "0.0.0-test",
+    workingDirectory: {
+      databaseDir: releaseRoot,
+      databasePath: path.join(releaseRoot, "db.sqlite"),
+      importsDir: path.join(releaseRoot, "imports"),
+      managedDir: path.join(releaseRoot, "managed"),
+      managedMcpDir: path.join(releaseRoot, "managed", "mcps"),
+      managedPluginDir: path.join(releaseRoot, "managed", "plugins"),
+      managedProviderDir: path.join(releaseRoot, "managed", "providers"),
+      managedSkillDir: path.join(releaseRoot, "managed", "skills"),
+      rootDir: releaseRoot,
+      runtimeDir: releaseRoot,
+      workspacesDir: path.join(releaseRoot, "workspaces"),
+    },
+  });
+
+  const bundle = await service.resolveRuntimeBundle();
+  expect(bundle.opencode.version).toBe("1.4.9");
+  expect(bundle.router.version).toBe("0.11.206");
+  expect(bundle.manifest.source).toBe("release");
+});
+
+test("release runtime assets extract into the managed runtime directory and survive source bundle removal", async () => {
+  const target = resolveRuntimeTarget();
+  if (!target) {
+    throw new Error("Unsupported test target.");
+  }
+
+  const bundleRoot = makeTempDir("openwork-server-v2-release-bundle");
+  const runtimeRoot = makeTempDir("openwork-server-v2-runtime-root");
+  const runtimeDir = path.join(runtimeRoot, "runtime");
+  fs.mkdirSync(runtimeDir, { recursive: true });
+
+  const opencodePath = path.join(bundleRoot, process.platform === "win32" ? "opencode.exe" : "opencode");
+  const routerPath = path.join(bundleRoot, process.platform === "win32" ? "opencode-router.exe" : "opencode-router");
+  writeVersionedBinary(opencodePath, "1.4.9");
+  writeVersionedBinary(routerPath, "0.11.206");
+
+  const manifest: RuntimeManifest = {
+    files: {
+      opencode: {
+        path: path.basename(opencodePath),
+        sha256: await sha256(opencodePath),
+        size: fs.statSync(opencodePath).size,
+      },
+      "opencode-router": {
+        path: path.basename(routerPath),
+        sha256: await sha256(routerPath),
+        size: fs.statSync(routerPath).size,
+      },
+    },
+    generatedAt: new Date().toISOString(),
+    manifestVersion: 1,
+    opencodeVersion: "1.4.9",
+    rootDir: bundleRoot,
+    routerVersion: "0.11.206",
+    serverVersion: "0.0.0-test",
+    source: "release",
+    target,
+  };
+  fs.writeFileSync(path.join(bundleRoot, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+
+  process.env.OPENWORK_SERVER_V2_RUNTIME_SOURCE = "release";
+  process.env.OPENWORK_SERVER_V2_RUNTIME_BUNDLE_DIR = bundleRoot;
+
+  const workingDirectory = {
+    databaseDir: runtimeRoot,
+    databasePath: path.join(runtimeRoot, "db.sqlite"),
+    importsDir: path.join(runtimeRoot, "imports"),
+    managedDir: path.join(runtimeRoot, "managed"),
+    managedMcpDir: path.join(runtimeRoot, "managed", "mcps"),
+    managedPluginDir: path.join(runtimeRoot, "managed", "plugins"),
+    managedProviderDir: path.join(runtimeRoot, "managed", "providers"),
+    managedSkillDir: path.join(runtimeRoot, "managed", "skills"),
+    rootDir: runtimeRoot,
+    runtimeDir,
+    workspacesDir: path.join(runtimeRoot, "workspaces"),
+  };
+
+  const service = createRuntimeAssetService({
+    environment: "test",
+    serverVersion: "0.0.0-test",
+    workingDirectory,
+  });
+
+  const firstBundle = await service.resolveRuntimeBundle();
+  const extractedRoot = path.join(runtimeDir, "0.0.0-test");
+  expect(firstBundle.opencode.absolutePath).toBe(path.join(extractedRoot, path.basename(opencodePath)));
+  expect(firstBundle.router.absolutePath).toBe(path.join(extractedRoot, path.basename(routerPath)));
+  expect(fs.existsSync(path.join(extractedRoot, "manifest.json"))).toBe(true);
+
+  fs.rmSync(bundleRoot, { recursive: true, force: true });
+
+  const secondBundle = await service.resolveRuntimeBundle();
+  expect(secondBundle.opencode.absolutePath).toBe(firstBundle.opencode.absolutePath);
+  expect(secondBundle.router.absolutePath).toBe(firstBundle.router.absolutePath);
+});
+
+test("release runtime assets can extract from an embedded runtime bundle", async () => {
+  const target = resolveRuntimeTarget();
+  if (!target) {
+    throw new Error("Unsupported test target.");
+  }
+
+  const bundleRoot = makeTempDir("openwork-server-v2-embedded-bundle");
+  const runtimeRoot = makeTempDir("openwork-server-v2-embedded-runtime-root");
+  const runtimeDir = path.join(runtimeRoot, "runtime");
+  fs.mkdirSync(runtimeDir, { recursive: true });
+
+  const opencodePath = path.join(bundleRoot, process.platform === "win32" ? "opencode.exe" : "opencode");
+  const routerPath = path.join(bundleRoot, process.platform === "win32" ? "opencode-router.exe" : "opencode-router");
+  const manifestPath = path.join(bundleRoot, "manifest.json");
+  writeVersionedBinary(opencodePath, "1.4.9");
+  writeVersionedBinary(routerPath, "0.11.206");
+
+  const manifest: RuntimeManifest = {
+    files: {
+      opencode: {
+        path: path.basename(opencodePath),
+        sha256: await sha256(opencodePath),
+        size: fs.statSync(opencodePath).size,
+      },
+      "opencode-router": {
+        path: path.basename(routerPath),
+        sha256: await sha256(routerPath),
+        size: fs.statSync(routerPath).size,
+      },
+    },
+    generatedAt: new Date().toISOString(),
+    manifestVersion: 1,
+    opencodeVersion: "1.4.9",
+    rootDir: bundleRoot,
+    routerVersion: "0.11.206",
+    serverVersion: "0.0.0-test",
+    source: "release",
+    target,
+  };
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+
+  process.env.OPENWORK_SERVER_V2_RUNTIME_SOURCE = "release";
+  delete process.env.OPENWORK_SERVER_V2_RUNTIME_BUNDLE_DIR;
+
+  registerEmbeddedRuntimeBundle({
+    manifestPath,
+    opencodePath,
+    routerPath,
+  });
+
+  const service = createRuntimeAssetService({
+    environment: "test",
+    serverVersion: "0.0.0-test",
+    workingDirectory: {
+      databaseDir: runtimeRoot,
+      databasePath: path.join(runtimeRoot, "db.sqlite"),
+      importsDir: path.join(runtimeRoot, "imports"),
+      managedDir: path.join(runtimeRoot, "managed"),
+      managedMcpDir: path.join(runtimeRoot, "managed", "mcps"),
+      managedPluginDir: path.join(runtimeRoot, "managed", "plugins"),
+      managedProviderDir: path.join(runtimeRoot, "managed", "providers"),
+      managedSkillDir: path.join(runtimeRoot, "managed", "skills"),
+      rootDir: runtimeRoot,
+      runtimeDir,
+      workspacesDir: path.join(runtimeRoot, "workspaces"),
+    },
+  });
+
+  const bundle = await service.resolveRuntimeBundle();
+  const extractedRoot = path.join(runtimeDir, "0.0.0-test");
+  expect(bundle.opencode.absolutePath).toBe(path.join(extractedRoot, path.basename(opencodePath)));
+  expect(bundle.router.absolutePath).toBe(path.join(extractedRoot, path.basename(routerPath)));
+  expect(fs.existsSync(path.join(extractedRoot, "manifest.json"))).toBe(true);
+});
diff --git a/apps/server-v2/src/runtime/assets.ts b/apps/server-v2/src/runtime/assets.ts
new file mode 100644
index 0000000000..010e363c27
--- /dev/null
+++ b/apps/server-v2/src/runtime/assets.ts
@@ -0,0 +1,867 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import type { ServerWorkingDirectory } from "../database/working-directory.js";
+import { getEmbeddedRuntimeBundle, type EmbeddedRuntimeBundle } from "./embedded.js";
+import {
+  resolveBunTarget,
+  resolveRuntimeTarget,
+  runtimeBinaryFilename,
+  type ResolvedRuntimeBinary,
+  type ResolvedRuntimeBundle,
+  type RuntimeAssetName,
+  type RuntimeAssetSource,
+  type RuntimeManifest,
+  type RuntimeTarget,
+} from "./manifest.js";
+
+type RuntimeAssetServiceOptions = {
+  environment: string;
+  serverVersion: string;
+  workingDirectory: ServerWorkingDirectory;
+};
+
+type ReleaseBundleSource =
+  | { kind: "directory"; rootDir: string }
+  | { bundle: EmbeddedRuntimeBundle; kind: "embedded" };
+
+function isTruthy(value: string | undefined) {
+  if (!value) {
+    return false;
+  }
+
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+
+function normalizeVersion(value: string) {
+  const trimmed = value.trim();
+  return trimmed.startsWith("v") ? trimmed.slice(1) : trimmed;
+}
+
+function dirnameFromMetaUrl(metaUrl: string) {
+  return path.dirname(fileURLToPath(metaUrl));
+}
+
+function findRepoRoot(startDir: string) {
+  let current = startDir;
+  while (true) {
+    const constantsPath = path.join(current, "constants.json");
+    const serverV2PackagePath = path.join(current, "apps", "server-v2", "package.json");
+    if (fs.existsSync(constantsPath) && fs.existsSync(serverV2PackagePath)) {
+      return current;
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+async function readJson<T>(filePath: string): Promise<T> {
+  return JSON.parse(await readFile(filePath, "utf8")) as T;
+}
+
+async function sha256File(filePath: string) {
+  const contents = await readFile(filePath);
+  return createHash("sha256").update(contents).digest("hex");
+}
+
+async function ensureExecutable(filePath: string) {
+  if (process.platform === "win32") {
+    return;
+  }
+
+  await chmod(filePath, 0o755);
+}
+
+async function sleep(ms: number) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function fileExists(filePath: string) {
+  try {
+    await stat(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function directoryExists(directoryPath: string) {
+  try {
+    const details = await stat(directoryPath);
+    return details.isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+async function readJsonOrNull<T>(filePath: string): Promise<T | null> {
+  try {
+    return JSON.parse(await readFile(filePath, "utf8")) as T;
+  } catch {
+    return null;
+  }
+}
+
+function isProcessAlive(pid: number | null | undefined) {
+  if (!pid || !Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && (error as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+async function captureProcess(command: string[], options: { cwd?: string; env?: Record<string, string | undefined>; timeoutMs?: number } = {}) {
+  const child = Bun.spawn(command, {
+    cwd: options.cwd,
+    env: {
+      ...process.env,
+      ...options.env,
+    },
+    stderr: "pipe",
+    stdout: "pipe",
+  });
+
+  const stdoutPromise = new Response(child.stdout).text();
+  const stderrPromise = new Response(child.stderr).text();
+  const timeoutMs = options.timeoutMs ?? 120_000;
+
+  const timeout = setTimeout(() => {
+    child.kill();
+  }, timeoutMs);
+
+  try {
+    const exitCode = await child.exited;
+    const [stdout, stderr] = await Promise.all([stdoutPromise, stderrPromise]);
+    if (exitCode !== 0) {
+      const message = [stdout.trim(), stderr.trim()].filter(Boolean).join("\n");
+      throw new Error(message || `Command failed with exit code ${exitCode}: ${command.join(" ")}`);
+    }
+    return { stderr, stdout };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function parseVersion(output: string) {
+  const match = output.match(/\d+\.\d+\.\d+(?:-[\w.-]+)?/);
+  return match?.[0] ?? null;
+}
+
+async function readBinaryVersion(binaryPath: string) {
+  try {
+    const result = await captureProcess([binaryPath, "--version"], { cwd: os.tmpdir(), timeoutMs: 4_000 });
+    return parseVersion(`${result.stdout}\n${result.stderr}`);
+  } catch {
+    return null;
+  }
+}
+
+function resolveOpencodeAsset(target: RuntimeTarget) {
+  const assets: Record<RuntimeTarget, string> = {
+    "darwin-arm64": "opencode-darwin-arm64.zip",
+    "darwin-x64": "opencode-darwin-x64-baseline.zip",
+    "linux-arm64": "opencode-linux-arm64.tar.gz",
+    "linux-x64": "opencode-linux-x64-baseline.tar.gz",
+    "windows-arm64": "opencode-windows-arm64.zip",
+    "windows-x64": "opencode-windows-x64-baseline.zip",
+  };
+  return assets[target];
+}
+
+async function downloadToPath(url: string, destinationPath: string) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url} (HTTP ${response.status}).`);
+  }
+
+  const contents = Buffer.from(await response.arrayBuffer());
+  await mkdir(path.dirname(destinationPath), { recursive: true });
+  const temporaryPath = `${destinationPath}.tmp-${Date.now()}`;
+  await writeFile(temporaryPath, contents);
+  await rename(temporaryPath, destinationPath);
+}
+
+async function extractOpencodeArchive(archivePath: string, extractDir: string) {
+  if (process.platform === "win32") {
+    const quotedArchive = `'${archivePath.replace(/'/g, "''")}'`;
+    const quotedExtract = `'${extractDir.replace(/'/g, "''")}'`;
+    await captureProcess([
+      "powershell",
+      "-NoProfile",
+      "-Command",
+      `$ErrorActionPreference = 'Stop'; Expand-Archive -Path ${quotedArchive} -DestinationPath ${quotedExtract} -Force`,
+    ]);
+    return;
+  }
+
+  if (archivePath.endsWith(".zip")) {
+    await captureProcess(["unzip", "-q", archivePath, "-d", extractDir]);
+    return;
+  }
+
+  if (archivePath.endsWith(".tar.gz")) {
+    await captureProcess(["tar", "-xzf", archivePath, "-C", extractDir]);
+    return;
+  }
+
+  throw new Error(`Unsupported OpenCode archive format: ${archivePath}`);
+}
+
+async function findFileRecursively(rootDir: string, matcher: (fileName: string) => boolean): Promise<string | null> {
+  const queue = [rootDir];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (!current) {
+      continue;
+    }
+
+    const entries = await fs.promises.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const absolutePath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        queue.push(absolutePath);
+        continue;
+      }
+
+      if (matcher(entry.name)) {
+        return absolutePath;
+      }
+    }
+  }
+
+  return null;
+}
+
+async function writeIfChanged(filePath: string, contents: string) {
+  const existing = await readFile(filePath, "utf8").catch(() => null);
+  if (existing === contents) {
+    return;
+  }
+
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, contents);
+}
+
+export type RuntimeAssetService = ReturnType<typeof createRuntimeAssetService>;
+
+export function createRuntimeAssetService(options: RuntimeAssetServiceOptions) {
+  const runtimeTarget = resolveRuntimeTarget();
+  if (!runtimeTarget) {
+    throw new Error(`Unsupported runtime target ${process.platform}/${process.arch} for Server V2 runtime assets.`);
+  }
+
+  const serverVersion = options.serverVersion;
+  const repoRoot = findRepoRoot(path.resolve(dirnameFromMetaUrl(import.meta.url), "..", "..", "..", ".."));
+  const runtimeSourcePreference = process.env.OPENWORK_SERVER_V2_RUNTIME_SOURCE?.trim().toLowerCase();
+  const bundleRootOverride = process.env.OPENWORK_SERVER_V2_RUNTIME_BUNDLE_DIR?.trim();
+  const releaseRootOverride = process.env.OPENWORK_SERVER_V2_RUNTIME_RELEASE_DIR?.trim();
+  const manifestPathOverride = process.env.OPENWORK_SERVER_V2_RUNTIME_MANIFEST_PATH?.trim();
+
+  const developmentRoot = repoRoot ? path.join(repoRoot, ".local", "runtime-assets") : null;
+  const releaseRoot = releaseRootOverride?.trim()
+    ? path.resolve(releaseRootOverride)
+    : path.join(options.workingDirectory.runtimeDir, serverVersion);
+  let registeredLeaseCleanup = false;
+  let releaseRuntimeRootPromise: Promise<{ manifest: RuntimeManifest; rootDir: string }> | null = null;
+  let cachedReleaseBundleSource: ReleaseBundleSource | null | undefined;
+
+  const resolveAdjacentBundleRoot = () => {
+    const candidates = [path.dirname(process.execPath)];
+    for (const candidate of candidates) {
+      const manifestPath = manifestPathOverride?.trim()
+        ? path.resolve(manifestPathOverride)
+        : path.join(candidate, "manifest.json");
+      const manifestExists = fs.existsSync(manifestPath);
+      if (!manifestExists) {
+        continue;
+      }
+      return candidate;
+    }
+    return null;
+  };
+
+  const resolveReleaseBundleRoot = (): ReleaseBundleSource | null => {
+    if (cachedReleaseBundleSource !== undefined) {
+      return cachedReleaseBundleSource;
+    }
+
+    if (bundleRootOverride?.trim()) {
+      cachedReleaseBundleSource = {
+        kind: "directory",
+        rootDir: path.resolve(bundleRootOverride),
+      };
+      return cachedReleaseBundleSource;
+    }
+
+    const adjacentBundleRoot = resolveAdjacentBundleRoot();
+    if (adjacentBundleRoot) {
+      cachedReleaseBundleSource = {
+        kind: "directory",
+        rootDir: adjacentBundleRoot,
+      };
+      return cachedReleaseBundleSource;
+    }
+
+    const embeddedBundle = getEmbeddedRuntimeBundle();
+    if (embeddedBundle) {
+      cachedReleaseBundleSource = {
+        bundle: embeddedBundle,
+        kind: "embedded",
+      };
+      return cachedReleaseBundleSource;
+    }
+
+    cachedReleaseBundleSource = null;
+    return cachedReleaseBundleSource;
+  };
+
+  const resolveSource = (): RuntimeAssetSource => {
+    if (runtimeSourcePreference === "development") {
+      if (!developmentRoot) {
+        throw new Error("Development runtime assets requested, but the repo root could not be resolved.");
+      }
+      return "development";
+    }
+
+    if (runtimeSourcePreference === "release") {
+      return "release";
+    }
+
+    if (resolveReleaseBundleRoot()) {
+      return "release";
+    }
+
+    if (developmentRoot) {
+      return "development";
+    }
+
+    return "release";
+  };
+
+  const resolveRootDir = (source: RuntimeAssetSource) => (source === "development" ? developmentRoot! : releaseRoot);
+
+  const readPinnedOpencodeVersion = async () => {
+    const candidates = [
+      repoRoot ? path.join(repoRoot, "constants.json") : null,
+      path.resolve(dirnameFromMetaUrl(import.meta.url), "..", "..", "..", "..", "constants.json"),
+    ].filter(Boolean) as string[];
+
+    for (const candidate of candidates) {
+      if (!fs.existsSync(candidate)) {
+        continue;
+      }
+
+      const parsed = await readJson<{ opencodeVersion?: string }>(candidate);
+      const value = parsed.opencodeVersion?.trim() ?? "";
+      if (value) {
+        return normalizeVersion(value);
+      }
+    }
+
+    throw new Error("Unable to resolve the pinned OpenCode version from constants.json.");
+  };
+
+  const readRouterVersion = async () => {
+    const candidates = [
+      repoRoot ? path.join(repoRoot, "apps", "opencode-router", "package.json") : null,
+      path.resolve(dirnameFromMetaUrl(import.meta.url), "..", "..", "..", "opencode-router", "package.json"),
+    ].filter(Boolean) as string[];
+
+    for (const candidate of candidates) {
+      if (!fs.existsSync(candidate)) {
+        continue;
+      }
+
+      const parsed = await readJson<{ version?: string }>(candidate);
+      const value = parsed.version?.trim() ?? "";
+      if (value) {
+        return normalizeVersion(value);
+      }
+    }
+
+    throw new Error("Unable to resolve the local opencode-router version.");
+  };
+
+  const materializeManifest = async (source: RuntimeAssetSource, opencode: ResolvedRuntimeBinary, router: ResolvedRuntimeBinary) => {
+    const rootDir = resolveRootDir(source);
+    const manifest: RuntimeManifest = {
+      files: {
+        opencode: {
+          path: path.relative(rootDir, opencode.absolutePath),
+          sha256: opencode.sha256,
+          size: opencode.size,
+        },
+        "opencode-router": {
+          path: path.relative(rootDir, router.absolutePath),
+          sha256: router.sha256,
+          size: router.size,
+        },
+      },
+      generatedAt: new Date().toISOString(),
+      manifestVersion: 1,
+      opencodeVersion: opencode.version,
+      rootDir,
+      routerVersion: router.version,
+      serverVersion,
+      source,
+      target: runtimeTarget,
+    };
+
+    const manifestPath =
+      source === "release"
+        ? path.join(rootDir, "manifest.json")
+        : path.join(rootDir, "manifests", runtimeTarget, `openwork-server-v2-${serverVersion}.json`);
+    await writeIfChanged(`${manifestPath}`, `${JSON.stringify(manifest, null, 2)}\n`);
+    return manifest;
+  };
+
+  const releaseManifestPath = (rootDir: string) => path.join(rootDir, "manifest.json");
+  const sourceManifestPath = (rootDir: string) =>
+    manifestPathOverride?.trim() ? path.resolve(manifestPathOverride) : releaseManifestPath(rootDir);
+
+  const validateManifestRoot = async (rootDir: string, manifest: RuntimeManifest) => {
+    for (const name of ["opencode", "opencode-router"] as const) {
+      const entry = manifest.files[name];
+      if (!entry) {
+        return false;
+      }
+
+      const binaryPath = path.resolve(rootDir, entry.path);
+      if (!(await fileExists(binaryPath))) {
+        return false;
+      }
+
+      const checksum = await sha256File(binaryPath);
+      if (checksum !== entry.sha256) {
+        return false;
+      }
+    }
+
+    return true;
+  };
+
+  const leasePathForRoot = (rootDir: string) => path.join(rootDir, ".runtime-lease.json");
+
+  const cleanupLease = async (rootDir: string) => {
+    await rm(leasePathForRoot(rootDir), { force: true });
+  };
+
+  const markRuntimeLease = async (rootDir: string) => {
+    await writeFile(
+      leasePathForRoot(rootDir),
+      `${JSON.stringify({ pid: process.pid, serverVersion, updatedAt: new Date().toISOString() }, null, 2)}\n`,
+      "utf8",
+    );
+
+    if (!registeredLeaseCleanup) {
+      registeredLeaseCleanup = true;
+      for (const signal of ["SIGINT", "SIGTERM", "beforeExit", "exit"] as const) {
+        process.once(signal, () => {
+          void cleanupLease(rootDir);
+        });
+      }
+    }
+  };
+
+  const isLiveLease = async (rootDir: string) => {
+    const lease = await readJsonOrNull<{ pid?: number }>(leasePathForRoot(rootDir));
+    return isProcessAlive(typeof lease?.pid === "number" ? lease.pid : null);
+  };
+
+  const cleanupReleaseArtifacts = async (currentRoot: string) => {
+    const parentDir = path.dirname(currentRoot);
+    if (!(await directoryExists(parentDir))) {
+      return;
+    }
+
+    const entries = await readdir(parentDir, { withFileTypes: true });
+    const runtimeRoots: Array<{ absolutePath: string; mtimeMs: number }> = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+
+      const absolutePath = path.join(parentDir, entry.name);
+      if (absolutePath === currentRoot) {
+        continue;
+      }
+
+      if (entry.name.startsWith(`${path.basename(currentRoot)}.extract-`) || entry.name.startsWith(`${path.basename(currentRoot)}.replace-`)) {
+        await rm(absolutePath, { force: true, recursive: true });
+        continue;
+      }
+
+      const manifest = await readJsonOrNull<RuntimeManifest>(path.join(absolutePath, "manifest.json"));
+      if (!manifest) {
+        continue;
+      }
+
+      const details = await stat(absolutePath).catch(() => null);
+      runtimeRoots.push({
+        absolutePath,
+        mtimeMs: details?.mtimeMs ?? 0,
+      });
+    }
+
+    runtimeRoots.sort((left, right) => right.mtimeMs - left.mtimeMs);
+    const keep = new Set(runtimeRoots.slice(0, 2).map((item) => item.absolutePath));
+    for (const candidate of runtimeRoots) {
+      if (keep.has(candidate.absolutePath)) {
+        continue;
+      }
+      if (await isLiveLease(candidate.absolutePath)) {
+        continue;
+      }
+      await rm(candidate.absolutePath, { force: true, recursive: true });
+    }
+  };
+
+  const readReleaseManifest = async (source: ReleaseBundleSource | { kind: "directory"; rootDir: string }) => {
+    const manifestPath = source.kind === "embedded"
+      ? source.bundle.manifestPath
+      : sourceManifestPath(source.rootDir);
+    if (!fs.existsSync(manifestPath)) {
+      throw new Error(`Release runtime manifest not found at ${manifestPath}.`);
+    }
+
+    return readJson<RuntimeManifest>(manifestPath);
+  };
+
+  const resolveReleaseSourceBinary = (source: ReleaseBundleSource, name: RuntimeAssetName, relativePath: string) => {
+    if (source.kind === "embedded") {
+      return name === "opencode" ? source.bundle.opencodePath : source.bundle.routerPath;
+    }
+
+    return path.resolve(source.rootDir, relativePath);
+  };
+
+  const copyReleaseSourceBinary = async (sourcePath: string, targetPath: string) => {
+    const contents = await readFile(sourcePath);
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    await writeFile(targetPath, contents);
+  };
+
+  const acquireExtractionLock = async (rootDir: string) => {
+    const lockDir = `${rootDir}.lock`;
+    const ownerPath = path.join(lockDir, "owner.json");
+    const startedAt = Date.now();
+    await mkdir(path.dirname(lockDir), { recursive: true });
+
+    while (Date.now() - startedAt < 15_000) {
+      try {
+        await mkdir(lockDir);
+        await writeFile(
+          ownerPath,
+          `${JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }, null, 2)}\n`,
+          "utf8",
+        );
+        return async () => {
+          await rm(lockDir, { force: true, recursive: true });
+        };
+      } catch (error) {
+        const code = error instanceof Error && "code" in error ? (error as NodeJS.ErrnoException).code : null;
+        if (code !== "EEXIST") {
+          throw error;
+        }
+
+        const owner = await readJsonOrNull<{ createdAt?: string; pid?: number }>(ownerPath);
+        const ownerAgeMs = owner?.createdAt ? Date.now() - Date.parse(owner.createdAt) : Number.POSITIVE_INFINITY;
+        if (!isProcessAlive(typeof owner?.pid === "number" ? owner.pid : null) && ownerAgeMs > 5_000) {
+          await rm(lockDir, { force: true, recursive: true });
+          continue;
+        }
+
+        await sleep(100);
+      }
+    }
+
+    throw new Error(`Timed out waiting for the runtime extraction lock at ${lockDir}.`);
+  };
+
+  const ensureReleaseRuntimeRoot = async () => {
+    if (releaseRuntimeRootPromise) {
+      return releaseRuntimeRootPromise;
+    }
+
+    releaseRuntimeRootPromise = (async () => {
+      const rootDir = resolveRootDir("release");
+      const bundleSource = resolveReleaseBundleRoot();
+
+      if (!bundleSource || (bundleSource.kind === "directory" && path.resolve(bundleSource.rootDir) === path.resolve(rootDir))) {
+        const manifest = await readReleaseManifest({ kind: "directory", rootDir });
+        if (!(await validateManifestRoot(rootDir, manifest))) {
+          throw new Error(`Release runtime manifest at ${releaseManifestPath(rootDir)} does not match the extracted runtime contents.`);
+        }
+        await markRuntimeLease(rootDir);
+        await cleanupReleaseArtifacts(rootDir);
+        return { manifest, rootDir };
+      }
+
+      const unlock = await acquireExtractionLock(rootDir);
+      try {
+        const existingManifest = await readJsonOrNull<RuntimeManifest>(releaseManifestPath(rootDir));
+        if (existingManifest && (await validateManifestRoot(rootDir, existingManifest))) {
+          await markRuntimeLease(rootDir);
+          await cleanupReleaseArtifacts(rootDir);
+          return { manifest: existingManifest, rootDir };
+        }
+
+        const sourceManifest = await readReleaseManifest(bundleSource);
+        const bundleLabel = bundleSource.kind === "embedded" ? "embedded runtime bundle" : bundleSource.rootDir;
+        const tempRoot = `${rootDir}.extract-${process.pid}-${Date.now()}`;
+        const backupRoot = `${rootDir}.replace-${Date.now()}`;
+        await rm(tempRoot, { force: true, recursive: true });
+        await mkdir(tempRoot, { recursive: true });
+
+        for (const name of ["opencode", "opencode-router"] as const) {
+          const entry = sourceManifest.files[name];
+          if (!entry) {
+            throw new Error(`Release runtime manifest in ${bundleLabel} is missing the ${name} entry.`);
+          }
+          const sourcePath = resolveReleaseSourceBinary(bundleSource, name, entry.path);
+          if (!(await fileExists(sourcePath))) {
+            throw new Error(`Release runtime source binary for ${name} was expected at ${sourcePath}, but it was not found.`);
+          }
+          const targetPath = path.resolve(tempRoot, entry.path);
+          await copyReleaseSourceBinary(sourcePath, targetPath);
+          await ensureExecutable(targetPath);
+        }
+
+        const extractedManifest: RuntimeManifest = {
+          ...sourceManifest,
+          generatedAt: new Date().toISOString(),
+          rootDir,
+        };
+        await writeFile(releaseManifestPath(tempRoot), `${JSON.stringify(extractedManifest, null, 2)}\n`, "utf8");
+
+        if (await directoryExists(rootDir)) {
+          await rm(backupRoot, { force: true, recursive: true });
+          await rename(rootDir, backupRoot);
+        }
+
+        await rename(tempRoot, rootDir);
+        await rm(backupRoot, { force: true, recursive: true });
+
+        await markRuntimeLease(rootDir);
+        await cleanupReleaseArtifacts(rootDir);
+        return { manifest: extractedManifest, rootDir };
+      } finally {
+        await unlock();
+      }
+    })();
+
+    try {
+      return await releaseRuntimeRootPromise;
+    } catch (error) {
+      releaseRuntimeRootPromise = null;
+      throw error;
+    }
+  };
+
+  const buildResolvedBinary = async (
+    source: RuntimeAssetSource,
+    name: RuntimeAssetName,
+    absolutePath: string,
+    version: string,
+  ): Promise<ResolvedRuntimeBinary> => {
+    const details = await stat(absolutePath);
+    return {
+      absolutePath,
+      name,
+      sha256: await sha256File(absolutePath),
+      size: details.size,
+      source,
+      stagedRoot: resolveRootDir(source),
+      target: runtimeTarget,
+      version,
+    };
+  };
+
+  const ensureDevelopmentOpencodeBinary = async (version: string) => {
+    const rootDir = resolveRootDir("development");
+    const targetDir = path.join(rootDir, "opencode", runtimeTarget, `v${version}`);
+    const targetPath = path.join(targetDir, runtimeBinaryFilename("opencode", runtimeTarget));
+    if (await fileExists(targetPath)) {
+      const actualVersion = await readBinaryVersion(targetPath);
+      if (!actualVersion || actualVersion === version) {
+        await ensureExecutable(targetPath);
+        return targetPath;
+      }
+      await rm(targetPath, { force: true });
+    }
+
+    const asset = resolveOpencodeAsset(runtimeTarget);
+    const archivePath = path.join(os.tmpdir(), `openwork-server-v2-opencode-${Date.now()}-${asset}`);
+    const extractDir = await mkdtemp(path.join(os.tmpdir(), "openwork-server-v2-opencode-"));
+    const downloadUrl = `https://github.com/anomalyco/opencode/releases/download/v${version}/${asset}`;
+
+    try {
+      await downloadToPath(downloadUrl, archivePath);
+      await extractOpencodeArchive(archivePath, extractDir);
+      const extractedBinary = await findFileRecursively(extractDir, (fileName) => fileName === "opencode" || fileName === "opencode.exe");
+      if (!extractedBinary) {
+        throw new Error(`Downloaded OpenCode archive did not contain an opencode binary for ${runtimeTarget}.`);
+      }
+
+      await mkdir(targetDir, { recursive: true });
+      await copyFile(extractedBinary, targetPath);
+      await ensureExecutable(targetPath);
+      return targetPath;
+    } catch (error) {
+      throw new Error(
+        `Failed to download the pinned OpenCode ${version} artifact for ${runtimeTarget}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    } finally {
+      await rm(extractDir, { force: true, recursive: true });
+      await rm(archivePath, { force: true });
+    }
+  };
+
+  const ensureDevelopmentRouterBinary = async (version: string) => {
+    if (!repoRoot) {
+      throw new Error("Cannot build opencode-router in development mode because the repo root could not be resolved.");
+    }
+
+    const rootDir = resolveRootDir("development");
+    const targetDir = path.join(rootDir, "opencode-router", runtimeTarget, `v${version}`);
+    const targetPath = path.join(targetDir, runtimeBinaryFilename("opencode-router", runtimeTarget));
+    if (await fileExists(targetPath)) {
+      const actualVersion = await readBinaryVersion(targetPath);
+      if (!actualVersion || actualVersion === version) {
+        await ensureExecutable(targetPath);
+        return targetPath;
+      }
+      await rm(targetPath, { force: true });
+    }
+
+    await mkdir(targetDir, { recursive: true });
+    const packageDir = path.join(repoRoot, "apps", "opencode-router");
+    const entrypoint = path.join(packageDir, "src", "cli.ts");
+    const outfile = targetPath;
+    const bunCommand = [
+      process.execPath,
+      "build",
+      entrypoint,
+      "--compile",
+      "--outfile",
+      outfile,
+      "--target",
+      resolveBunTarget(runtimeTarget),
+      "--define",
+      `__OPENCODE_ROUTER_VERSION__=\"${version}\"`,
+    ];
+
+    try {
+      await captureProcess(bunCommand, { cwd: packageDir, timeoutMs: 300_000 });
+      await ensureExecutable(outfile);
+      return outfile;
+    } catch (error) {
+      throw new Error(
+        `Failed to build the local opencode-router ${version} binary for ${runtimeTarget}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  };
+
+  const ensureReleaseBinary = async (name: RuntimeAssetName, version: string) => {
+    const { manifest, rootDir } = await ensureReleaseRuntimeRoot();
+    const entry = manifest.files[name];
+    if (!entry) {
+      throw new Error(`Release runtime manifest is missing the ${name} entry.`);
+    }
+
+    const binaryPath = path.resolve(rootDir, entry.path);
+    if (!(await fileExists(binaryPath))) {
+      throw new Error(`Release runtime binary for ${name} was expected at ${binaryPath}, but it was not found.`);
+    }
+
+    await ensureExecutable(binaryPath);
+    const checksum = await sha256File(binaryPath);
+    if (checksum !== entry.sha256) {
+      throw new Error(`Release runtime binary checksum mismatch for ${name} at ${binaryPath}.`);
+    }
+
+    const actualVersion = await readBinaryVersion(binaryPath);
+    if (actualVersion && actualVersion !== version) {
+      throw new Error(`Release runtime ${name} version mismatch: expected ${version}, got ${actualVersion}.`);
+    }
+
+    return binaryPath;
+  };
+
+  const readReleaseManifestVersion = async (name: RuntimeAssetName) => {
+    const { manifest } = await ensureReleaseRuntimeRoot();
+    return name === "opencode" ? manifest.opencodeVersion : manifest.routerVersion;
+  };
+
+  const ensureBinary = async (name: RuntimeAssetName) => {
+    const source = resolveSource();
+    const version = source === "release"
+      ? await readReleaseManifestVersion(name)
+      : name === "opencode"
+        ? await readPinnedOpencodeVersion()
+        : await readRouterVersion();
+
+    const absolutePath = source === "development"
+      ? name === "opencode"
+        ? await ensureDevelopmentOpencodeBinary(version)
+        : await ensureDevelopmentRouterBinary(version)
+      : await ensureReleaseBinary(name, version);
+    return buildResolvedBinary(source, name, absolutePath, version);
+  };
+
+  return {
+    async ensureOpencodeBinary() {
+      return ensureBinary("opencode");
+    },
+
+    async ensureRouterBinary() {
+      return ensureBinary("opencode-router");
+    },
+
+    async getPinnedOpencodeVersion() {
+      return readPinnedOpencodeVersion();
+    },
+
+    async getRouterVersion() {
+      return readRouterVersion();
+    },
+
+    getSource() {
+      return resolveSource();
+    },
+
+    getTarget() {
+      return runtimeTarget;
+    },
+
+    getDevelopmentRoot() {
+      return developmentRoot;
+    },
+
+    getReleaseRoot() {
+      return releaseRoot;
+    },
+
+    async resolveRuntimeBundle(): Promise<ResolvedRuntimeBundle> {
+      const [opencode, router] = await Promise.all([this.ensureOpencodeBinary(), this.ensureRouterBinary()]);
+      const manifest = await materializeManifest(opencode.source, opencode, router);
+      return {
+        manifest,
+        opencode,
+        router,
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/runtime/embedded.ts b/apps/server-v2/src/runtime/embedded.ts
new file mode 100644
index 0000000000..b1ce2e68a8
--- /dev/null
+++ b/apps/server-v2/src/runtime/embedded.ts
@@ -0,0 +1,19 @@
+export type EmbeddedRuntimeBundle = {
+  manifestPath: string;
+  opencodePath: string;
+  routerPath: string;
+};
+
+declare global {
+  var __OPENWORK_SERVER_V2_EMBEDDED_RUNTIME__:
+    | EmbeddedRuntimeBundle
+    | undefined;
+}
+
+export function registerEmbeddedRuntimeBundle(bundle: EmbeddedRuntimeBundle | undefined) {
+  globalThis.__OPENWORK_SERVER_V2_EMBEDDED_RUNTIME__ = bundle;
+}
+
+export function getEmbeddedRuntimeBundle() {
+  return globalThis.__OPENWORK_SERVER_V2_EMBEDDED_RUNTIME__ ?? null;
+}
diff --git a/apps/server-v2/src/runtime/manifest.ts b/apps/server-v2/src/runtime/manifest.ts
new file mode 100644
index 0000000000..28e341bbf5
--- /dev/null
+++ b/apps/server-v2/src/runtime/manifest.ts
@@ -0,0 +1,88 @@
+export type RuntimeTarget =
+  | "darwin-arm64"
+  | "darwin-x64"
+  | "linux-arm64"
+  | "linux-x64"
+  | "windows-arm64"
+  | "windows-x64";
+
+export type RuntimeAssetName = "opencode" | "opencode-router";
+export type RuntimeAssetSource = "development" | "release";
+
+export type RuntimeManifestFile = {
+  path: string;
+  sha256: string;
+  size: number;
+};
+
+export type RuntimeManifest = {
+  files: Record<RuntimeAssetName, RuntimeManifestFile>;
+  generatedAt: string;
+  manifestVersion: 1;
+  opencodeVersion: string;
+  rootDir: string;
+  routerVersion: string;
+  serverVersion: string;
+  source: RuntimeAssetSource;
+  target: RuntimeTarget;
+};
+
+export type ResolvedRuntimeBinary = {
+  absolutePath: string;
+  name: RuntimeAssetName;
+  sha256: string;
+  size: number;
+  source: RuntimeAssetSource;
+  stagedRoot: string;
+  target: RuntimeTarget;
+  version: string;
+};
+
+export type ResolvedRuntimeBundle = {
+  manifest: RuntimeManifest;
+  opencode: ResolvedRuntimeBinary;
+  router: ResolvedRuntimeBinary;
+};
+
+export function resolveRuntimeTarget(): RuntimeTarget | null {
+  if (process.platform === "darwin") {
+    if (process.arch === "arm64") {
+      return "darwin-arm64";
+    }
+    if (process.arch === "x64") {
+      return "darwin-x64";
+    }
+    return null;
+  }
+
+  if (process.platform === "linux") {
+    if (process.arch === "arm64") {
+      return "linux-arm64";
+    }
+    if (process.arch === "x64") {
+      return "linux-x64";
+    }
+    return null;
+  }
+
+  if (process.platform === "win32") {
+    if (process.arch === "arm64") {
+      return "windows-arm64";
+    }
+    if (process.arch === "x64") {
+      return "windows-x64";
+    }
+    return null;
+  }
+
+  return null;
+}
+
+export function runtimeBinaryFilename(name: RuntimeAssetName, target: RuntimeTarget) {
+  const base = name === "opencode" ? "opencode" : "opencode-router";
+  return target.startsWith("windows") ? `${base}.exe` : base;
+}
+
+export function resolveBunTarget(target: RuntimeTarget) {
+  return `bun-${target}`;
+}
diff --git a/apps/server-v2/src/runtime/output-buffer.ts b/apps/server-v2/src/runtime/output-buffer.ts
new file mode 100644
index 0000000000..b8703461ee
--- /dev/null
+++ b/apps/server-v2/src/runtime/output-buffer.ts
@@ -0,0 +1,127 @@
+export type RuntimeOutputStream = "stdout" | "stderr";
+
+export type RuntimeOutputLine = {
+  at: string;
+  stream: RuntimeOutputStream;
+  text: string;
+};
+
+export type RuntimeOutputSnapshot = {
+  combined: RuntimeOutputLine[];
+  stderr: string[];
+  stdout: string[];
+  totalLines: number;
+  truncated: boolean;
+};
+
+type CreateBoundedOutputCollectorOptions = {
+  maxBytes?: number;
+  maxLines?: number;
+  onLine?: (line: RuntimeOutputLine) => void;
+};
+
+function byteLength(value: string) {
+  return Buffer.byteLength(value, "utf8");
+}
+
+export function createBoundedOutputCollector(options: CreateBoundedOutputCollectorOptions = {}) {
+  const maxLines = Math.max(1, options.maxLines ?? 200);
+  const maxBytes = Math.max(256, options.maxBytes ?? 16_384);
+  const combined: RuntimeOutputLine[] = [];
+  const partials: Record<RuntimeOutputStream, string> = {
+    stderr: "",
+    stdout: "",
+  };
+
+  let totalBytes = 0;
+  let truncated = false;
+
+  const appendLine = (stream: RuntimeOutputStream, text: string) => {
+    const line: RuntimeOutputLine = {
+      at: new Date().toISOString(),
+      stream,
+      text,
+    };
+
+    combined.push(line);
+    totalBytes += byteLength(text);
+    options.onLine?.(line);
+
+    while (combined.length > maxLines || totalBytes > maxBytes) {
+      const removed = combined.shift();
+      if (!removed) {
+        break;
+      }
+      totalBytes -= byteLength(removed.text);
+      truncated = true;
+    }
+  };
+
+  const flushPartial = (stream: RuntimeOutputStream) => {
+    const partial = partials[stream];
+    if (!partial) {
+      return;
+    }
+    partials[stream] = "";
+    appendLine(stream, partial);
+  };
+
+  return {
+    finish(stream: RuntimeOutputStream) {
+      flushPartial(stream);
+    },
+
+    pushChunk(stream: RuntimeOutputStream, chunk: string) {
+      if (!chunk) {
+        return;
+      }
+
+      let buffer = partials[stream] + chunk;
+      while (true) {
+        const newlineIndex = buffer.search(/\r?\n/);
+        if (newlineIndex < 0) {
+          break;
+        }
+
+        const newlineWidth = buffer[newlineIndex] === "\r" && buffer[newlineIndex + 1] === "\n" ? 2 : 1;
+        const line = buffer.slice(0, newlineIndex);
+        appendLine(stream, line);
+        buffer = buffer.slice(newlineIndex + newlineWidth);
+      }
+
+      partials[stream] = buffer;
+    },
+
+    snapshot(): RuntimeOutputSnapshot {
+      const stdout: string[] = [];
+      const stderr: string[] = [];
+      for (const line of combined) {
+        if (line.stream === "stdout") {
+          stdout.push(line.text);
+        } else {
+          stderr.push(line.text);
+        }
+      }
+
+      return {
+        combined: combined.map((line) => ({ ...line })),
+        stderr,
+        stdout,
+        totalLines: combined.length,
+        truncated,
+      };
+    },
+  };
+}
+
+export function formatRuntimeOutput(snapshot: RuntimeOutputSnapshot) {
+  if (snapshot.combined.length === 0) {
+    return "(no child output captured)";
+  }
+
+  const lines = snapshot.combined.map((line) => `${line.stream}: ${line.text}`);
+  if (snapshot.truncated) {
+    lines.unshift("(bounded output buffer truncated older lines)");
+  }
+  return lines.join("\n");
+}
diff --git a/apps/server-v2/src/schemas/common.ts b/apps/server-v2/src/schemas/common.ts
new file mode 100644
index 0000000000..77874629ee
--- /dev/null
+++ b/apps/server-v2/src/schemas/common.ts
@@ -0,0 +1,29 @@
+import { z } from "zod";
+
+export const requestIdSchema = z.string().min(1).meta({ ref: "OpenWorkServerV2RequestId" });
+
+export const identifierSchema = z.string().min(1).max(200).meta({ ref: "OpenWorkServerV2Identifier" });
+
+export const isoTimestampSchema = z.string().datetime({ offset: true }).meta({ ref: "OpenWorkServerV2IsoTimestamp" });
+
+export const responseMetaSchema = z.object({
+  requestId: requestIdSchema,
+  timestamp: isoTimestampSchema,
+}).meta({ ref: "OpenWorkServerV2ResponseMeta" });
+
+export const workspaceIdParamsSchema = z.object({
+  workspaceId: identifierSchema.describe("Stable OpenWork workspace identifier."),
+}).meta({ ref: "OpenWorkServerV2WorkspaceIdParams" });
+
+export const paginationQuerySchema = z.object({
+  cursor: z.string().min(1).optional(),
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+}).meta({ ref: "OpenWorkServerV2PaginationQuery" });
+
+export function successResponseSchema<TSchema extends z.ZodTypeAny>(ref: string, data: TSchema) {
+  return z.object({
+    ok: z.literal(true),
+    data,
+    meta: responseMetaSchema,
+  }).meta({ ref });
+}
diff --git a/apps/server-v2/src/schemas/config.ts b/apps/server-v2/src/schemas/config.ts
new file mode 100644
index 0000000000..9c8bba7170
--- /dev/null
+++ b/apps/server-v2/src/schemas/config.ts
@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { identifierSchema, successResponseSchema, workspaceIdParamsSchema } from "./common.js";
+
+const jsonRecordSchema = z.record(z.string(), z.unknown());
+
+export const workspaceConfigSnapshotSchema = z.object({
+  effective: z.object({
+    opencode: jsonRecordSchema,
+    openwork: jsonRecordSchema,
+  }),
+  materialized: z.object({
+    compatibilityOpencodePath: z.string().nullable(),
+    compatibilityOpenworkPath: z.string().nullable(),
+    configDir: z.string().nullable(),
+    configOpencodePath: z.string().nullable(),
+    configOpenworkPath: z.string().nullable(),
+  }),
+  stored: z.object({
+    opencode: jsonRecordSchema,
+    openwork: jsonRecordSchema,
+  }),
+  updatedAt: z.string(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceConfigSnapshot" });
+
+export const workspaceConfigPatchRequestSchema = z.object({
+  opencode: jsonRecordSchema.optional(),
+  openwork: jsonRecordSchema.optional(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceConfigPatchRequest" });
+
+export const rawOpencodeConfigQuerySchema = z.object({
+  scope: z.enum(["global", "project"]).optional(),
+}).meta({ ref: "OpenWorkServerV2RawOpencodeConfigQuery" });
+
+export const rawOpencodeConfigWriteRequestSchema = z.object({
+  content: z.string(),
+  scope: z.enum(["global", "project"]).optional(),
+}).meta({ ref: "OpenWorkServerV2RawOpencodeConfigWriteRequest" });
+
+export const rawOpencodeConfigDataSchema = z.object({
+  content: z.string(),
+  exists: z.boolean(),
+  path: z.string().nullable(),
+  updatedAt: z.string(),
+}).meta({ ref: "OpenWorkServerV2RawOpencodeConfigData" });
+
+export const workspaceConfigResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceConfigResponse",
+  workspaceConfigSnapshotSchema,
+);
+
+export const rawOpencodeConfigResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RawOpencodeConfigResponse",
+  rawOpencodeConfigDataSchema,
+);
+
+export const rawOpencodeConfigParamsSchema = workspaceIdParamsSchema.meta({ ref: "OpenWorkServerV2RawOpencodeConfigParams" });
diff --git a/apps/server-v2/src/schemas/errors.ts b/apps/server-v2/src/schemas/errors.ts
new file mode 100644
index 0000000000..2feb06b718
--- /dev/null
+++ b/apps/server-v2/src/schemas/errors.ts
@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { requestIdSchema } from "./common.js";
+
+export const errorDetailSchema = z.object({
+  message: z.string(),
+  path: z.array(z.union([z.string(), z.number()])).optional(),
+}).meta({ ref: "OpenWorkServerV2ErrorDetail" });
+
+const baseErrorSchema = z.object({
+  message: z.string(),
+  requestId: requestIdSchema,
+  details: z.array(errorDetailSchema).optional(),
+});
+
+export const invalidRequestErrorSchema = z.object({
+  ok: z.literal(false),
+  error: baseErrorSchema.extend({
+    code: z.literal("invalid_request"),
+  }),
+}).meta({ ref: "OpenWorkServerV2InvalidRequestError" });
+
+export const unauthorizedErrorSchema = z.object({
+  ok: z.literal(false),
+  error: baseErrorSchema.extend({
+    code: z.literal("unauthorized"),
+  }),
+}).meta({ ref: "OpenWorkServerV2UnauthorizedError" });
+
+export const forbiddenErrorSchema = z.object({
+  ok: z.literal(false),
+  error: baseErrorSchema.extend({
+    code: z.literal("forbidden"),
+  }),
+}).meta({ ref: "OpenWorkServerV2ForbiddenError" });
+
+export const notFoundErrorSchema = z.object({
+  ok: z.literal(false),
+  error: baseErrorSchema.extend({
+    code: z.literal("not_found"),
+  }),
+}).meta({ ref: "OpenWorkServerV2NotFoundError" });
+
+export const internalErrorSchema = z.object({
+  ok: z.literal(false),
+  error: baseErrorSchema.extend({
+    code: z.literal("internal_error"),
+  }),
+}).meta({ ref: "OpenWorkServerV2InternalError" });
diff --git a/apps/server-v2/src/schemas/files.ts b/apps/server-v2/src/schemas/files.ts
new file mode 100644
index 0000000000..51854953aa
--- /dev/null
+++ b/apps/server-v2/src/schemas/files.ts
@@ -0,0 +1,191 @@
+import { z } from "zod";
+import { identifierSchema, successResponseSchema, workspaceIdParamsSchema } from "./common.js";
+
+const fileSessionIdParamsSchema = workspaceIdParamsSchema.extend({
+  fileSessionId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2FileSessionIdParams" });
+
+const jsonRecordSchema = z.record(z.string(), z.unknown());
+
+export const workspaceActivationDataSchema = z.object({
+  activeWorkspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceActivationData" });
+
+export const engineReloadDataSchema = z.object({
+  reloadedAt: z.number().int().nonnegative(),
+}).meta({ ref: "OpenWorkServerV2EngineReloadData" });
+
+export const workspaceDeleteDataSchema = z.object({
+  deleted: z.boolean(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceDeleteData" });
+
+export const workspaceDisposeDataSchema = z.object({
+  disposed: z.boolean(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceDisposeData" });
+
+export const workspaceCreateLocalRequestSchema = z.object({
+  folderPath: z.string().min(1),
+  name: z.string().min(1),
+  preset: z.string().min(1).optional(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceCreateLocalRequest" });
+
+export const reloadEventSchema = z.object({
+  id: identifierSchema,
+  reason: z.enum(["agents", "commands", "config", "mcp", "plugins", "skills"]),
+  seq: z.number().int().nonnegative(),
+  timestamp: z.number().int().nonnegative(),
+  trigger: z.object({
+    action: z.enum(["added", "removed", "updated"]).optional(),
+    name: z.string().optional(),
+    path: z.string().optional(),
+    type: z.enum(["agent", "command", "config", "mcp", "plugin", "skill"]),
+  }).optional(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2ReloadEvent" });
+
+export const reloadEventsDataSchema = z.object({
+  cursor: z.number().int().nonnegative(),
+  items: z.array(reloadEventSchema),
+}).meta({ ref: "OpenWorkServerV2ReloadEventsData" });
+
+export const fileSessionCreateRequestSchema = z.object({
+  ttlSeconds: z.number().positive().optional(),
+  write: z.boolean().optional(),
+}).meta({ ref: "OpenWorkServerV2FileSessionCreateRequest" });
+
+export const fileSessionDataSchema = z.object({
+  canWrite: z.boolean(),
+  createdAt: z.number().int().nonnegative(),
+  expiresAt: z.number().int().nonnegative(),
+  id: identifierSchema,
+  ttlMs: z.number().int().nonnegative(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2FileSessionData" });
+
+export const fileCatalogSnapshotSchema = z.object({
+  cursor: z.number().int().nonnegative(),
+  generatedAt: z.number().int().nonnegative(),
+  items: z.array(z.object({
+    kind: z.enum(["dir", "file"]),
+    mtimeMs: z.number(),
+    path: z.string(),
+    revision: z.string(),
+    size: z.number().int().nonnegative(),
+  })),
+  nextAfter: z.string().optional(),
+  sessionId: identifierSchema,
+  total: z.number().int().nonnegative(),
+  truncated: z.boolean(),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2FileCatalogSnapshot" });
+
+export const fileBatchReadRequestSchema = z.object({
+  paths: z.array(z.string()).min(1),
+}).meta({ ref: "OpenWorkServerV2FileBatchReadRequest" });
+
+export const fileBatchReadResponseSchema = successResponseSchema(
+  "OpenWorkServerV2FileBatchReadResponse",
+  z.object({ items: z.array(jsonRecordSchema) }),
+);
+
+export const fileBatchWriteRequestSchema = z.object({
+  writes: z.array(jsonRecordSchema).min(1),
+}).meta({ ref: "OpenWorkServerV2FileBatchWriteRequest" });
+
+export const fileOperationsRequestSchema = z.object({
+  operations: z.array(jsonRecordSchema).min(1),
+}).meta({ ref: "OpenWorkServerV2FileOperationsRequest" });
+
+export const fileMutationResultSchema = successResponseSchema(
+  "OpenWorkServerV2FileMutationResult",
+  z.object({
+    cursor: z.number().int().nonnegative(),
+    items: z.array(jsonRecordSchema),
+  }),
+);
+
+export const simpleContentQuerySchema = z.object({
+  path: z.string().min(1),
+}).meta({ ref: "OpenWorkServerV2SimpleContentQuery" });
+
+export const simpleContentWriteRequestSchema = z.object({
+  baseUpdatedAt: z.number().nullable().optional(),
+  content: z.string(),
+  force: z.boolean().optional(),
+  path: z.string().min(1),
+}).meta({ ref: "OpenWorkServerV2SimpleContentWriteRequest" });
+
+export const simpleContentDataSchema = z.object({
+  bytes: z.number().int().nonnegative(),
+  content: z.string(),
+  path: z.string(),
+  revision: z.string().optional(),
+  updatedAt: z.number(),
+}).meta({ ref: "OpenWorkServerV2SimpleContentData" });
+
+export const binaryItemSchema = z.object({
+  id: z.string(),
+  name: z.string().optional(),
+  path: z.string(),
+  size: z.number().int().nonnegative(),
+  updatedAt: z.number(),
+}).meta({ ref: "OpenWorkServerV2BinaryItem" });
+
+export const binaryListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2BinaryListResponse",
+  z.object({ items: z.array(binaryItemSchema) }),
+);
+
+export const binaryUploadDataSchema = z.object({
+  bytes: z.number().int().nonnegative(),
+  path: z.string(),
+}).meta({ ref: "OpenWorkServerV2BinaryUploadData" });
+
+export const workspaceActivationResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceActivationResponse",
+  workspaceActivationDataSchema,
+);
+
+export const engineReloadResponseSchema = successResponseSchema(
+  "OpenWorkServerV2EngineReloadResponse",
+  engineReloadDataSchema,
+);
+
+export const workspaceDeleteResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceDeleteResponse",
+  workspaceDeleteDataSchema,
+);
+
+export const workspaceDisposeResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceDisposeResponse",
+  workspaceDisposeDataSchema,
+);
+
+export const reloadEventsResponseSchema = successResponseSchema(
+  "OpenWorkServerV2ReloadEventsResponse",
+  reloadEventsDataSchema,
+);
+
+export const fileSessionResponseSchema = successResponseSchema(
+  "OpenWorkServerV2FileSessionResponse",
+  fileSessionDataSchema,
+);
+
+export const fileCatalogSnapshotResponseSchema = successResponseSchema(
+  "OpenWorkServerV2FileCatalogSnapshotResponse",
+  fileCatalogSnapshotSchema,
+);
+
+export const simpleContentResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SimpleContentResponse",
+  simpleContentDataSchema,
+);
+
+export const binaryUploadResponseSchema = successResponseSchema(
+  "OpenWorkServerV2BinaryUploadResponse",
+  binaryUploadDataSchema,
+);
+
+export { fileSessionIdParamsSchema };
diff --git a/apps/server-v2/src/schemas/managed.ts b/apps/server-v2/src/schemas/managed.ts
new file mode 100644
index 0000000000..79edc31fea
--- /dev/null
+++ b/apps/server-v2/src/schemas/managed.ts
@@ -0,0 +1,251 @@
+import { z } from "zod";
+import { identifierSchema, isoTimestampSchema, successResponseSchema, workspaceIdParamsSchema } from "./common.js";
+
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+
+export const managedKindSchema = z.enum(["mcps", "plugins", "providerConfigs", "skills"]);
+
+export const managedItemSchema = z.object({
+  auth: jsonObjectSchema.nullable(),
+  cloudItemId: z.string().nullable(),
+  config: jsonObjectSchema,
+  createdAt: isoTimestampSchema,
+  displayName: z.string(),
+  id: identifierSchema,
+  key: z.string().nullable(),
+  metadata: jsonObjectSchema.nullable(),
+  source: z.enum(["cloud_synced", "discovered", "imported", "openwork_managed"]),
+  updatedAt: isoTimestampSchema,
+  workspaceIds: z.array(identifierSchema),
+}).meta({ ref: "OpenWorkServerV2ManagedItem" });
+
+export const managedItemWriteSchema = z.object({
+  auth: jsonObjectSchema.nullable().optional(),
+  cloudItemId: z.string().nullable().optional(),
+  config: jsonObjectSchema.optional(),
+  displayName: z.string(),
+  key: z.string().nullable().optional(),
+  metadata: jsonObjectSchema.nullable().optional(),
+  source: z.enum(["cloud_synced", "discovered", "imported", "openwork_managed"]).optional(),
+  workspaceIds: z.array(identifierSchema).optional(),
+}).meta({ ref: "OpenWorkServerV2ManagedItemWrite" });
+
+export const managedAssignmentWriteSchema = z.object({
+  workspaceIds: z.array(identifierSchema),
+}).meta({ ref: "OpenWorkServerV2ManagedAssignmentWrite" });
+
+export const managedItemListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2ManagedItemListResponse",
+  z.object({ items: z.array(managedItemSchema) }),
+);
+export const managedItemResponseSchema = successResponseSchema("OpenWorkServerV2ManagedItemResponse", managedItemSchema);
+export const managedDeleteResponseSchema = successResponseSchema(
+  "OpenWorkServerV2ManagedDeleteResponse",
+  z.object({ deleted: z.boolean(), id: identifierSchema }),
+);
+
+export const workspaceMcpItemSchema = z.object({
+  config: jsonObjectSchema,
+  disabledByTools: z.boolean().optional(),
+  name: z.string(),
+  source: z.enum(["config.global", "config.project", "config.remote"]),
+}).meta({ ref: "OpenWorkServerV2WorkspaceMcpItem" });
+export const workspaceMcpListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceMcpListResponse",
+  z.object({ items: z.array(workspaceMcpItemSchema) }),
+);
+export const workspaceMcpWriteSchema = z.object({
+  config: jsonObjectSchema,
+  name: z.string(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceMcpWrite" });
+
+export const workspacePluginItemSchema = z.object({
+  path: z.string().optional(),
+  scope: z.enum(["global", "project"]),
+  source: z.enum(["config", "dir.project", "dir.global"]),
+  spec: z.string(),
+}).meta({ ref: "OpenWorkServerV2WorkspacePluginItem" });
+export const workspacePluginListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspacePluginListResponse",
+  z.object({ items: z.array(workspacePluginItemSchema), loadOrder: z.array(z.string()) }),
+);
+export const workspacePluginWriteSchema = z.object({ spec: z.string() }).meta({ ref: "OpenWorkServerV2WorkspacePluginWrite" });
+
+export const workspaceSkillItemSchema = z.object({
+  description: z.string(),
+  name: z.string(),
+  path: z.string(),
+  scope: z.enum(["global", "project"]),
+  trigger: z.string().optional(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceSkillItem" });
+export const workspaceSkillContentSchema = z.object({
+  content: z.string(),
+  item: workspaceSkillItemSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceSkillContent" });
+export const workspaceSkillListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceSkillListResponse",
+  z.object({ items: z.array(workspaceSkillItemSchema) }),
+);
+export const workspaceSkillResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceSkillResponse", workspaceSkillContentSchema);
+export const workspaceSkillWriteSchema = z.object({
+  content: z.string(),
+  description: z.string().optional(),
+  name: z.string(),
+  trigger: z.string().optional(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceSkillWrite" });
+export const workspaceSkillDeleteResponseSchema = successResponseSchema(
+  "OpenWorkServerV2WorkspaceSkillDeleteResponse",
+  z.object({ path: z.string() }),
+);
+
+export const hubRepoSchema = z.object({
+  owner: z.string().optional(),
+  ref: z.string().optional(),
+  repo: z.string().optional(),
+}).meta({ ref: "OpenWorkServerV2HubRepo" });
+export const hubSkillItemSchema = z.object({
+  description: z.string(),
+  name: z.string(),
+  source: z.object({ owner: z.string(), path: z.string(), ref: z.string(), repo: z.string() }),
+  trigger: z.string().optional(),
+}).meta({ ref: "OpenWorkServerV2HubSkillItem" });
+export const hubSkillListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2HubSkillListResponse",
+  z.object({ items: z.array(hubSkillItemSchema) }),
+);
+export const hubSkillInstallWriteSchema = z.object({
+  overwrite: z.boolean().optional(),
+  repo: hubRepoSchema.optional(),
+}).meta({ ref: "OpenWorkServerV2HubSkillInstallWrite" });
+export const hubSkillInstallResponseSchema = successResponseSchema(
+  "OpenWorkServerV2HubSkillInstallResponse",
+  z.object({
+    action: z.enum(["added", "updated"]),
+    name: z.string(),
+    path: z.string(),
+    skipped: z.number().int().nonnegative(),
+    written: z.number().int().nonnegative(),
+  }),
+);
+
+export const cloudSigninSchema = z.object({
+  auth: jsonObjectSchema.nullable(),
+  cloudBaseUrl: z.string(),
+  createdAt: isoTimestampSchema,
+  id: identifierSchema,
+  lastValidatedAt: isoTimestampSchema.nullable(),
+  metadata: jsonObjectSchema.nullable(),
+  orgId: z.string().nullable(),
+  serverId: identifierSchema,
+  updatedAt: isoTimestampSchema,
+  userId: z.string().nullable(),
+}).meta({ ref: "OpenWorkServerV2CloudSignin" });
+export const cloudSigninWriteSchema = z.object({
+  auth: jsonObjectSchema.nullable().optional(),
+  cloudBaseUrl: z.string(),
+  metadata: jsonObjectSchema.nullable().optional(),
+  orgId: z.string().nullable().optional(),
+  userId: z.string().nullable().optional(),
+}).meta({ ref: "OpenWorkServerV2CloudSigninWrite" });
+export const cloudSigninResponseSchema = successResponseSchema("OpenWorkServerV2CloudSigninResponse", cloudSigninSchema.nullable());
+export const cloudSigninValidationResponseSchema = successResponseSchema(
+  "OpenWorkServerV2CloudSigninValidationResponse",
+  z.object({ lastValidatedAt: isoTimestampSchema.nullable(), ok: z.boolean(), record: cloudSigninSchema }),
+);
+
+export const workspaceShareSchema = z.object({
+  accessKey: z.string().nullable(),
+  audit: jsonObjectSchema.nullable(),
+  createdAt: isoTimestampSchema,
+  id: identifierSchema,
+  lastUsedAt: isoTimestampSchema.nullable(),
+  revokedAt: isoTimestampSchema.nullable(),
+  status: z.enum(["active", "disabled", "revoked"]),
+  updatedAt: isoTimestampSchema,
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceShare" });
+export const workspaceShareResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceShareResponse", workspaceShareSchema.nullable());
+
+export const workspaceExportWarningSchema = z.object({
+  detail: z.string(),
+  id: z.string(),
+  label: z.string(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceExportWarning" });
+export const workspaceExportDataSchema = z.object({
+  commands: z.array(z.object({ description: z.string().optional(), name: z.string(), template: z.string() })),
+  exportedAt: z.number().int().nonnegative(),
+  files: z.array(z.object({ content: z.string(), path: z.string() })).optional(),
+  openwork: jsonObjectSchema,
+  opencode: jsonObjectSchema,
+  skills: z.array(z.object({ content: z.string(), description: z.string().optional(), name: z.string(), trigger: z.string().optional() })),
+  workspaceId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceExportData" });
+export const workspaceExportResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceExportResponse", workspaceExportDataSchema);
+export const workspaceImportWriteSchema = z.record(z.string(), z.unknown()).meta({ ref: "OpenWorkServerV2WorkspaceImportWrite" });
+export const workspaceImportResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceImportResponse", z.object({ ok: z.boolean() }));
+
+export const sharedBundlePublishWriteSchema = z.object({
+  bundleType: z.string(),
+  name: z.string().optional(),
+  payload: z.unknown(),
+  timeoutMs: z.number().int().positive().optional(),
+}).meta({ ref: "OpenWorkServerV2SharedBundlePublishWrite" });
+export const sharedBundleFetchWriteSchema = z.object({
+  bundleUrl: z.string(),
+  timeoutMs: z.number().int().positive().optional(),
+}).meta({ ref: "OpenWorkServerV2SharedBundleFetchWrite" });
+export const sharedBundlePublishResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SharedBundlePublishResponse",
+  z.object({ url: z.string() }),
+);
+export const sharedBundleFetchResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SharedBundleFetchResponse",
+  z.record(z.string(), z.unknown()),
+);
+
+export const routerIdentityItemSchema = z.object({
+  access: z.enum(["private", "public"]).optional(),
+  enabled: z.boolean(),
+  id: z.string(),
+  pairingRequired: z.boolean().optional(),
+  running: z.boolean(),
+}).meta({ ref: "OpenWorkServerV2RouterIdentityItem" });
+export const routerHealthSnapshotSchema = z.object({
+  config: z.object({ groupsEnabled: z.boolean() }),
+  channels: z.object({ slack: z.boolean(), telegram: z.boolean(), whatsapp: z.boolean() }),
+  ok: z.boolean(),
+  opencode: z.object({ healthy: z.boolean(), url: z.string(), version: z.string().optional() }),
+}).meta({ ref: "OpenWorkServerV2RouterHealthSnapshot" });
+export const routerIdentityListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RouterIdentityListResponse",
+  z.object({ items: z.array(routerIdentityItemSchema), ok: z.boolean() }),
+);
+export const routerTelegramInfoResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RouterTelegramInfoResponse",
+  z.object({
+    bot: z.object({ id: z.number().int(), name: z.string().optional(), username: z.string().optional() }).nullable(),
+    configured: z.boolean(),
+    enabled: z.boolean(),
+    ok: z.boolean(),
+  }),
+);
+export const routerHealthResponseSchemaCompat = successResponseSchema("OpenWorkServerV2RouterHealthCompatResponse", routerHealthSnapshotSchema);
+export const routerTelegramWriteSchema = z.object({ access: z.enum(["private", "public"]).optional(), enabled: z.boolean().optional(), id: z.string().optional(), token: z.string() }).meta({ ref: "OpenWorkServerV2RouterTelegramWrite" });
+export const routerSlackWriteSchema = z.object({ appToken: z.string(), botToken: z.string(), enabled: z.boolean().optional(), id: z.string().optional() }).meta({ ref: "OpenWorkServerV2RouterSlackWrite" });
+export const routerBindingWriteSchema = z.object({ channel: z.enum(["slack", "telegram"]), directory: z.string().optional(), identityId: z.string().optional(), peerId: z.string() }).meta({ ref: "OpenWorkServerV2RouterBindingWrite" });
+export const routerBindingListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RouterBindingListResponse",
+  z.object({
+    items: z.array(z.object({ channel: z.string(), directory: z.string(), identityId: z.string(), peerId: z.string(), updatedAt: z.number().int().optional() })),
+    ok: z.boolean(),
+  }),
+);
+export const routerSendWriteSchema = z.object({ autoBind: z.boolean().optional(), channel: z.enum(["slack", "telegram"]), directory: z.string().optional(), identityId: z.string().optional(), peerId: z.string().optional(), text: z.string() }).meta({ ref: "OpenWorkServerV2RouterSendWrite" });
+export const routerMutationResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RouterMutationResponse",
+  z.record(z.string(), z.unknown()),
+);
+
+export const managedItemIdParamsSchema = z.object({ itemId: identifierSchema }).meta({ ref: "OpenWorkServerV2ManagedItemIdParams" });
+export const workspaceNamedItemParamsSchema = workspaceIdParamsSchema.extend({ name: z.string() }).meta({ ref: "OpenWorkServerV2WorkspaceNamedItemParams" });
+export const workspaceIdentityParamsSchema = workspaceIdParamsSchema.extend({ identityId: identifierSchema }).meta({ ref: "OpenWorkServerV2WorkspaceIdentityParams" });
diff --git a/apps/server-v2/src/schemas/registry.ts b/apps/server-v2/src/schemas/registry.ts
new file mode 100644
index 0000000000..22b769e366
--- /dev/null
+++ b/apps/server-v2/src/schemas/registry.ts
@@ -0,0 +1,261 @@
+import { z } from "zod";
+import { identifierSchema, isoTimestampSchema, successResponseSchema } from "./common.js";
+
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+
+export const authSummarySchema = z.object({
+  actorKind: z.enum(["anonymous", "client", "host"]),
+  configured: z.object({
+    clientToken: z.boolean(),
+    hostToken: z.boolean(),
+  }),
+  headers: z.object({
+    authorization: z.literal("Authorization"),
+    hostToken: z.literal("X-OpenWork-Host-Token"),
+  }),
+  required: z.boolean(),
+  scopes: z.object({
+    hiddenWorkspaceReads: z.literal("host"),
+    serverInventory: z.literal("host"),
+    visibleRead: z.literal("client_or_host"),
+  }),
+}).meta({ ref: "OpenWorkServerV2AuthSummary" });
+
+export const serverInventoryItemSchema = z.object({
+  auth: z.object({
+    configured: z.boolean(),
+    scheme: z.enum(["bearer", "none"]),
+  }),
+  baseUrl: z.string().nullable(),
+  capabilities: jsonObjectSchema,
+  hostingKind: z.enum(["desktop", "self_hosted", "cloud"]),
+  id: identifierSchema,
+  isEnabled: z.boolean(),
+  isLocal: z.boolean(),
+  kind: z.enum(["local", "remote"]),
+  label: z.string(),
+  lastSeenAt: isoTimestampSchema.nullable(),
+  source: z.string(),
+  updatedAt: isoTimestampSchema,
+}).meta({ ref: "OpenWorkServerV2ServerInventoryItem" });
+
+export const registrySummarySchema = z.object({
+  hiddenWorkspaceCount: z.number().int().nonnegative(),
+  localServerId: identifierSchema,
+  remoteServerCount: z.number().int().nonnegative(),
+  totalServers: z.number().int().nonnegative(),
+  visibleWorkspaceCount: z.number().int().nonnegative(),
+}).meta({ ref: "OpenWorkServerV2RegistrySummary" });
+
+export const capabilitiesDataSchema = z.object({
+  auth: authSummarySchema,
+  bundles: z.object({
+    fetch: z.literal(true),
+    publish: z.literal(true),
+    workspaceExport: z.literal(true),
+    workspaceImport: z.literal(true),
+  }),
+  cloud: z.object({
+    persistence: z.literal(true),
+    validation: z.literal(true),
+  }),
+  config: z.object({
+    projection: z.literal(true),
+    rawRead: z.literal(true),
+    rawWrite: z.literal(true),
+    read: z.literal(true),
+    write: z.literal(true),
+  }),
+  files: z.object({
+    artifacts: z.literal(true),
+    contentRoutes: z.literal(true),
+    fileSessions: z.literal(true),
+    inbox: z.literal(true),
+    mutations: z.literal(true),
+  }),
+  managed: z.object({
+    assignments: z.literal(true),
+    mcps: z.literal(true),
+    plugins: z.literal(true),
+    providerConfigs: z.literal(true),
+    skills: z.literal(true),
+  }),
+  reload: z.object({
+    manualEngineReload: z.literal(true),
+    reconciliation: z.literal(true),
+    watch: z.literal(true),
+    workspaceEvents: z.literal(true),
+  }),
+  registry: z.object({
+    backendResolution: z.literal(true),
+    remoteServerConnections: z.literal(true),
+    remoteWorkspaceSync: z.literal(true),
+    hiddenWorkspaceFiltering: z.literal(true),
+    serverInventory: z.literal(true),
+    workspaceDetail: z.literal(true),
+    workspaceList: z.literal(true),
+  }),
+  sessions: z.object({
+    events: z.literal(true),
+    list: z.literal(true),
+    messages: z.literal(true),
+    mutations: z.literal(true),
+    promptAsync: z.literal(true),
+    revertHistory: z.literal(true),
+  }),
+  runtime: z.object({
+    opencodeHealth: z.literal(true),
+    routerHealth: z.literal(true),
+    runtimeSummary: z.literal(true),
+    runtimeUpgrade: z.literal(true),
+    runtimeVersions: z.literal(true),
+  }),
+  router: z.object({
+    bindings: z.literal(true),
+    identities: z.literal(true),
+    outboundSend: z.literal(true),
+    productRoutes: z.literal(true),
+  }),
+  shares: z.object({
+    workspaceScoped: z.literal(true),
+  }),
+  workspaces: z.object({
+    activate: z.literal(true),
+    createLocal: z.literal(true),
+  }),
+  transport: z.object({
+    rootMounted: z.literal(true),
+    sdkPackage: z.literal("@openwork/server-sdk"),
+    v2: z.literal(true),
+  }),
+}).meta({ ref: "OpenWorkServerV2CapabilitiesData" });
+
+const workspaceBackendSchema = z.object({
+  kind: z.enum(["local_opencode", "remote_openwork"]),
+  local: z.object({
+    configDir: z.string().nullable(),
+    dataDir: z.string().nullable(),
+    opencodeProjectId: z.string().nullable(),
+  }).nullable(),
+  remote: z.object({
+    directory: z.string().nullable(),
+    hostUrl: z.string().nullable(),
+    remoteType: z.enum(["openwork", "opencode"]),
+    remoteWorkspaceId: z.string().nullable(),
+    workspaceName: z.string().nullable(),
+  }).nullable(),
+  serverId: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceBackend" });
+
+const workspaceRuntimeSummarySchema = z.object({
+  backendKind: z.enum(["local_opencode", "remote_openwork"]),
+  health: jsonObjectSchema.nullable(),
+  lastError: jsonObjectSchema.nullable(),
+  lastSessionRefreshAt: isoTimestampSchema.nullable(),
+  lastSyncAt: isoTimestampSchema.nullable(),
+  updatedAt: isoTimestampSchema.nullable(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceRuntimeSummary" });
+
+export const workspaceSummaryDataSchema = z.object({
+  backend: workspaceBackendSchema,
+  createdAt: isoTimestampSchema,
+  displayName: z.string(),
+  hidden: z.boolean(),
+  id: identifierSchema,
+  kind: z.enum(["local", "remote", "control", "help"]),
+  preset: z.enum(["minimal", "remote", "starter"]),
+  runtime: workspaceRuntimeSummarySchema,
+  server: serverInventoryItemSchema,
+  slug: z.string(),
+  status: z.enum(["ready", "imported", "attention"]),
+  updatedAt: isoTimestampSchema,
+}).meta({ ref: "OpenWorkServerV2WorkspaceSummaryData" });
+
+export const workspaceDetailDataSchema = workspaceSummaryDataSchema.extend({
+  notes: jsonObjectSchema.nullable(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceDetailData" });
+
+export const workspaceListDataSchema = z.object({
+  items: z.array(workspaceSummaryDataSchema),
+}).meta({ ref: "OpenWorkServerV2WorkspaceListData" });
+
+export const serverInventoryListDataSchema = z.object({
+  items: z.array(serverInventoryItemSchema),
+}).meta({ ref: "OpenWorkServerV2ServerInventoryListData" });
+
+export const remoteServerConnectRequestSchema = z.object({
+  baseUrl: z.string().min(1),
+  directory: z.string().nullable().optional(),
+  hostToken: z.string().nullable().optional(),
+  label: z.string().nullable().optional(),
+  token: z.string().nullable().optional(),
+  workspaceId: z.string().nullable().optional(),
+}).meta({ ref: "OpenWorkServerV2RemoteServerConnectRequest" });
+
+export const remoteServerSyncRequestSchema = z.object({
+  directory: z.string().nullable().optional(),
+  workspaceId: z.string().nullable().optional(),
+}).meta({ ref: "OpenWorkServerV2RemoteServerSyncRequest" });
+
+export const remoteServerConnectDataSchema = z.object({
+  selectedWorkspaceId: identifierSchema.nullable(),
+  server: serverInventoryItemSchema,
+  workspaces: z.array(workspaceSummaryDataSchema),
+}).meta({ ref: "OpenWorkServerV2RemoteServerConnectData" });
+
+export const systemStatusDataSchema = z.object({
+  auth: authSummarySchema,
+  capabilities: capabilitiesDataSchema,
+  database: z.object({
+    bootstrapMode: z.enum(["fresh", "existing"]),
+    configured: z.literal(true),
+    importWarnings: z.number().int().nonnegative(),
+    kind: z.literal("sqlite"),
+    migrations: z.object({
+      appliedThisRun: z.array(z.string()),
+      currentVersion: z.string(),
+      totalApplied: z.number().int().nonnegative(),
+    }),
+    path: z.string(),
+    phaseOwner: z.literal(2),
+    status: z.enum(["ready", "warning"]),
+    summary: z.string(),
+    workingDirectory: z.string(),
+  }),
+  environment: z.string(),
+  registry: registrySummarySchema,
+  runtime: z.object({
+    opencode: z.object({
+      baseUrl: z.string().nullable(),
+      running: z.boolean(),
+      status: z.enum(["crashed", "disabled", "error", "restart_scheduled", "running", "starting", "stopped"]),
+      version: z.string().nullable(),
+    }),
+    router: z.object({
+      baseUrl: z.string().nullable(),
+      running: z.boolean(),
+      status: z.enum(["crashed", "disabled", "error", "restart_scheduled", "running", "starting", "stopped"]),
+      version: z.string().nullable(),
+    }),
+    source: z.enum(["development", "release"]),
+    target: z.enum(["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "windows-arm64", "windows-x64"]),
+  }),
+  service: z.literal("openwork-server-v2"),
+  startedAt: isoTimestampSchema,
+  status: z.literal("ok"),
+  uptimeMs: z.number().int().nonnegative(),
+  version: z.string(),
+}).meta({ ref: "OpenWorkServerV2SystemStatusData" });
+
+export const capabilitiesResponseSchema = successResponseSchema("OpenWorkServerV2CapabilitiesResponse", capabilitiesDataSchema);
+export const serverInventoryListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2ServerInventoryListResponse",
+  serverInventoryListDataSchema,
+);
+export const remoteServerConnectResponseSchema = successResponseSchema(
+  "OpenWorkServerV2RemoteServerConnectResponse",
+  remoteServerConnectDataSchema,
+);
+export const systemStatusResponseSchema = successResponseSchema("OpenWorkServerV2SystemStatusResponse", systemStatusDataSchema);
+export const workspaceDetailResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceDetailResponse", workspaceDetailDataSchema);
+export const workspaceListResponseSchema = successResponseSchema("OpenWorkServerV2WorkspaceListResponse", workspaceListDataSchema);
diff --git a/apps/server-v2/src/schemas/runtime.ts b/apps/server-v2/src/schemas/runtime.ts
new file mode 100644
index 0000000000..147ab88cbc
--- /dev/null
+++ b/apps/server-v2/src/schemas/runtime.ts
@@ -0,0 +1,156 @@
+import { z } from "zod";
+import { isoTimestampSchema, successResponseSchema } from "./common.js";
+
+const runtimeOutputSnapshotSchema = z.object({
+  combined: z.array(z.object({
+    at: isoTimestampSchema,
+    stream: z.enum(["stdout", "stderr"]),
+    text: z.string(),
+  })),
+  stderr: z.array(z.string()),
+  stdout: z.array(z.string()),
+  totalLines: z.number().int().nonnegative(),
+  truncated: z.boolean(),
+}).meta({ ref: "OpenWorkServerV2RuntimeOutputSnapshot" });
+
+const runtimeTargetSchema = z.enum([
+  "darwin-arm64",
+  "darwin-x64",
+  "linux-arm64",
+  "linux-x64",
+  "windows-arm64",
+  "windows-x64",
+]).meta({ ref: "OpenWorkServerV2RuntimeTarget" });
+
+const runtimeManifestSchema = z.object({
+  files: z.object({
+    opencode: z.object({
+      path: z.string(),
+      sha256: z.string(),
+      size: z.number().int().nonnegative(),
+    }),
+    "opencode-router": z.object({
+      path: z.string(),
+      sha256: z.string(),
+      size: z.number().int().nonnegative(),
+    }),
+  }),
+  generatedAt: isoTimestampSchema,
+  manifestVersion: z.literal(1),
+  opencodeVersion: z.string(),
+  rootDir: z.string(),
+  routerVersion: z.string(),
+  serverVersion: z.string(),
+  source: z.enum(["development", "release"]),
+  target: runtimeTargetSchema,
+}).meta({ ref: "OpenWorkServerV2RuntimeManifest" });
+
+const lastExitSchema = z.object({
+  at: isoTimestampSchema,
+  code: z.number().int().nullable(),
+  output: runtimeOutputSnapshotSchema,
+  reason: z.string(),
+  signal: z.string().nullable(),
+}).meta({ ref: "OpenWorkServerV2RuntimeLastExit" });
+
+const routerEnablementSchema = z.object({
+  enabled: z.boolean(),
+  enabledBindingCount: z.number().int().nonnegative(),
+  enabledIdentityCount: z.number().int().nonnegative(),
+  forced: z.boolean(),
+  reason: z.string(),
+}).meta({ ref: "OpenWorkServerV2RouterEnablement" });
+
+const routerMaterializationSchema = z.object({
+  bindingCount: z.number().int().nonnegative(),
+  configPath: z.string(),
+  dataDir: z.string(),
+  dbPath: z.string(),
+  identityCount: z.number().int().nonnegative(),
+  logFile: z.string(),
+}).meta({ ref: "OpenWorkServerV2RouterMaterialization" });
+
+const runtimeChildStatusSchema = z.enum(["crashed", "disabled", "error", "restart_scheduled", "running", "starting", "stopped"]);
+
+const runtimeUpgradeStateSchema = z.object({
+  error: z.string().nullable(),
+  finishedAt: isoTimestampSchema.nullable(),
+  startedAt: isoTimestampSchema.nullable(),
+  status: z.enum(["completed", "failed", "idle", "running"]),
+}).meta({ ref: "OpenWorkServerV2RuntimeUpgradeState" });
+
+export const opencodeHealthDataSchema = z.object({
+  baseUrl: z.string().nullable(),
+  binaryPath: z.string().nullable(),
+  diagnostics: runtimeOutputSnapshotSchema,
+  lastError: z.string().nullable(),
+  lastExit: lastExitSchema.nullable(),
+  lastReadyAt: isoTimestampSchema.nullable(),
+  lastStartedAt: isoTimestampSchema.nullable(),
+  manifest: runtimeManifestSchema.nullable(),
+  pid: z.number().int().nullable(),
+  running: z.boolean(),
+  source: z.enum(["development", "release"]),
+  status: runtimeChildStatusSchema,
+  version: z.string().nullable(),
+}).meta({ ref: "OpenWorkServerV2OpencodeHealthData" });
+
+export const routerHealthDataSchema = z.object({
+  baseUrl: z.string().nullable(),
+  binaryPath: z.string().nullable(),
+  diagnostics: runtimeOutputSnapshotSchema,
+  enablement: routerEnablementSchema,
+  healthUrl: z.string().nullable(),
+  lastError: z.string().nullable(),
+  lastExit: lastExitSchema.nullable(),
+  lastReadyAt: isoTimestampSchema.nullable(),
+  lastStartedAt: isoTimestampSchema.nullable(),
+  manifest: runtimeManifestSchema.nullable(),
+  materialization: routerMaterializationSchema.nullable(),
+  pid: z.number().int().nullable(),
+  running: z.boolean(),
+  source: z.enum(["development", "release"]),
+  status: runtimeChildStatusSchema,
+  version: z.string().nullable(),
+}).meta({ ref: "OpenWorkServerV2RouterHealthData" });
+
+export const runtimeSummaryDataSchema = z.object({
+  bootstrapPolicy: z.enum(["disabled", "eager", "manual"]),
+  manifest: runtimeManifestSchema.nullable(),
+  opencode: opencodeHealthDataSchema,
+  restartPolicy: z.object({
+    backoffMs: z.number().int().nonnegative(),
+    maxAttempts: z.number().int().nonnegative(),
+    windowMs: z.number().int().nonnegative(),
+  }),
+  router: routerHealthDataSchema,
+  upgrade: runtimeUpgradeStateSchema,
+  source: z.enum(["development", "release"]),
+  target: runtimeTargetSchema,
+}).meta({ ref: "OpenWorkServerV2RuntimeSummaryData" });
+
+export const runtimeUpgradeDataSchema = z.object({
+  state: runtimeUpgradeStateSchema,
+  summary: runtimeSummaryDataSchema,
+}).meta({ ref: "OpenWorkServerV2RuntimeUpgradeData" });
+
+export const runtimeVersionsDataSchema = z.object({
+  active: z.object({
+    opencodeVersion: z.string().nullable(),
+    routerVersion: z.string().nullable(),
+    serverVersion: z.string(),
+  }),
+  manifest: runtimeManifestSchema.nullable(),
+  pinned: z.object({
+    opencodeVersion: z.string().nullable(),
+    routerVersion: z.string().nullable(),
+    serverVersion: z.string(),
+  }),
+  target: runtimeTargetSchema,
+}).meta({ ref: "OpenWorkServerV2RuntimeVersionsData" });
+
+export const opencodeHealthResponseSchema = successResponseSchema("OpenWorkServerV2OpencodeHealthResponse", opencodeHealthDataSchema);
+export const routerHealthResponseSchema = successResponseSchema("OpenWorkServerV2RouterHealthResponse", routerHealthDataSchema);
+export const runtimeSummaryResponseSchema = successResponseSchema("OpenWorkServerV2RuntimeSummaryResponse", runtimeSummaryDataSchema);
+export const runtimeVersionsResponseSchema = successResponseSchema("OpenWorkServerV2RuntimeVersionsResponse", runtimeVersionsDataSchema);
+export const runtimeUpgradeResponseSchema = successResponseSchema("OpenWorkServerV2RuntimeUpgradeResponse", runtimeUpgradeDataSchema);
diff --git a/apps/server-v2/src/schemas/sessions.ts b/apps/server-v2/src/schemas/sessions.ts
new file mode 100644
index 0000000000..9f8bfa29ae
--- /dev/null
+++ b/apps/server-v2/src/schemas/sessions.ts
@@ -0,0 +1,249 @@
+import { z } from "zod";
+import { identifierSchema, successResponseSchema, workspaceIdParamsSchema } from "./common.js";
+
+const jsonRecordSchema = z.record(z.string(), z.unknown());
+
+export const sessionStatusSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("idle") }),
+  z.object({ type: z.literal("busy") }),
+  z.object({
+    type: z.literal("retry"),
+    attempt: z.number(),
+    message: z.string(),
+    next: z.number(),
+  }),
+]).meta({ ref: "OpenWorkServerV2SessionStatus" });
+
+const sessionTimeSchema = z.object({
+  archived: z.number().optional(),
+  completed: z.number().optional(),
+  created: z.number().optional(),
+  updated: z.number().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionTime" });
+
+const sessionSummarySchema = z.object({
+  additions: z.number().optional(),
+  deletions: z.number().optional(),
+  files: z.number().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionSummary" });
+
+export const sessionSchema = z.object({
+  directory: z.string().nullish(),
+  id: identifierSchema,
+  parentID: z.string().nullish(),
+  revert: z.object({
+    messageID: identifierSchema,
+  }).partial().nullish(),
+  slug: z.string().nullish(),
+  summary: sessionSummarySchema.optional(),
+  time: sessionTimeSchema.optional(),
+  title: z.string().nullish(),
+}).passthrough().meta({ ref: "OpenWorkServerV2Session" });
+
+const sessionMessageInfoSchema = z.object({
+  id: identifierSchema,
+  parentID: z.string().nullish(),
+  role: z.string(),
+  sessionID: identifierSchema,
+  time: sessionTimeSchema.optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionMessageInfo" });
+
+export const sessionMessagePartSchema = z.object({
+  id: identifierSchema,
+  messageID: identifierSchema,
+  sessionID: identifierSchema,
+  type: z.string().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionMessagePart" });
+
+export const sessionMessageSchema = z.object({
+  info: sessionMessageInfoSchema,
+  parts: z.array(sessionMessagePartSchema),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionMessage" });
+
+export const sessionTodoSchema = z.object({
+  content: z.string(),
+  priority: z.string(),
+  status: z.string(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionTodo" });
+
+export const sessionSnapshotSchema = z.object({
+  messages: z.array(sessionMessageSchema),
+  session: sessionSchema,
+  status: sessionStatusSchema,
+  todos: z.array(sessionTodoSchema),
+}).meta({ ref: "OpenWorkServerV2SessionSnapshot" });
+
+export const workspaceEventSchema = z.object({
+  properties: z.unknown().optional(),
+  type: z.string(),
+}).meta({ ref: "OpenWorkServerV2WorkspaceEvent" });
+
+export const sessionListQuerySchema = z.object({
+  limit: z.coerce.number().int().positive().max(500).optional(),
+  roots: z.coerce.boolean().optional(),
+  search: z.string().trim().min(1).optional(),
+  start: z.coerce.number().int().nonnegative().optional(),
+}).meta({ ref: "OpenWorkServerV2SessionListQuery" });
+
+export const sessionMessagesQuerySchema = z.object({
+  limit: z.coerce.number().int().positive().max(500).optional(),
+}).meta({ ref: "OpenWorkServerV2SessionMessagesQuery" });
+
+export const sessionIdParamsSchema = workspaceIdParamsSchema.extend({
+  sessionId: identifierSchema.describe("Stable session identifier within the resolved workspace backend."),
+}).meta({ ref: "OpenWorkServerV2SessionIdParams" });
+
+export const messageIdParamsSchema = sessionIdParamsSchema.extend({
+  messageId: identifierSchema.describe("Stable message identifier within the resolved session."),
+}).meta({ ref: "OpenWorkServerV2MessageIdParams" });
+
+export const messagePartParamsSchema = messageIdParamsSchema.extend({
+  partId: identifierSchema.describe("Stable message part identifier within the resolved message."),
+}).meta({ ref: "OpenWorkServerV2MessagePartParams" });
+
+export const sessionCreateRequestSchema = z.object({
+  parentSessionId: identifierSchema.optional(),
+  title: z.string().trim().min(1).max(300).optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionCreateRequest" });
+
+export const sessionUpdateRequestSchema = z.object({
+  archived: z.boolean().optional(),
+  title: z.string().trim().min(1).max(300).optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionUpdateRequest" });
+
+export const sessionForkRequestSchema = z.object({
+  title: z.string().trim().min(1).max(300).optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionForkRequest" });
+
+export const sessionSummarizeRequestSchema = z.object({
+  modelID: z.string().trim().min(1).optional(),
+  providerID: z.string().trim().min(1).optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2SessionSummarizeRequest" });
+
+export const messageSendRequestSchema = z.object({
+  parts: z.array(z.unknown()).optional(),
+  role: z.string().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2MessageSendRequest" });
+
+export const promptAsyncRequestSchema = z.object({
+  agent: z.string().optional(),
+  messageID: identifierSchema.optional(),
+  model: z.object({
+    modelID: z.string(),
+    providerID: z.string(),
+  }).optional(),
+  noReply: z.boolean().optional(),
+  parts: z.array(z.unknown()).optional(),
+  reasoning_effort: z.string().optional(),
+  system: z.string().optional(),
+  tools: z.record(z.string(), z.boolean()).optional(),
+  variant: z.string().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2PromptAsyncRequest" });
+
+export const commandRequestSchema = z.object({
+  agent: z.string().optional(),
+  arguments: z.string().optional(),
+  command: z.string().min(1),
+  messageID: identifierSchema.optional(),
+  model: z.string().optional(),
+  parts: z.array(z.unknown()).optional(),
+  reasoning_effort: z.string().optional(),
+  variant: z.string().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2CommandRequest" });
+
+export const shellRequestSchema = z.object({
+  command: z.string().min(1),
+}).passthrough().meta({ ref: "OpenWorkServerV2ShellRequest" });
+
+export const revertRequestSchema = z.object({
+  messageID: identifierSchema,
+}).meta({ ref: "OpenWorkServerV2RevertRequest" });
+
+export const messagePartUpdateRequestSchema = z.object({
+  text: z.string().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2MessagePartUpdateRequest" });
+
+export const sessionListDataSchema = z.object({
+  items: z.array(sessionSchema),
+}).meta({ ref: "OpenWorkServerV2SessionListData" });
+
+export const sessionStatusesDataSchema = z.object({
+  items: z.record(z.string(), sessionStatusSchema),
+}).meta({ ref: "OpenWorkServerV2SessionStatusesData" });
+
+export const sessionTodoListDataSchema = z.object({
+  items: z.array(sessionTodoSchema),
+}).meta({ ref: "OpenWorkServerV2SessionTodoListData" });
+
+export const messageListDataSchema = z.object({
+  items: z.array(sessionMessageSchema),
+}).meta({ ref: "OpenWorkServerV2MessageListData" });
+
+export const acceptedActionDataSchema = z.object({
+  accepted: z.literal(true),
+}).meta({ ref: "OpenWorkServerV2AcceptedActionData" });
+
+export const deletedActionDataSchema = z.object({
+  deleted: z.literal(true),
+}).meta({ ref: "OpenWorkServerV2DeletedActionData" });
+
+export const sessionResponseSchema = successResponseSchema("OpenWorkServerV2SessionResponse", sessionSchema);
+export const sessionListResponseSchema = successResponseSchema("OpenWorkServerV2SessionListResponse", sessionListDataSchema);
+export const sessionStatusesResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SessionStatusesResponse",
+  sessionStatusesDataSchema,
+);
+export const sessionStatusResponseSchema = successResponseSchema("OpenWorkServerV2SessionStatusResponse", sessionStatusSchema);
+export const sessionTodoListResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SessionTodoListResponse",
+  sessionTodoListDataSchema,
+);
+export const sessionSnapshotResponseSchema = successResponseSchema(
+  "OpenWorkServerV2SessionSnapshotResponse",
+  sessionSnapshotSchema,
+);
+export const messageResponseSchema = successResponseSchema("OpenWorkServerV2MessageResponse", sessionMessageSchema);
+export const messageListResponseSchema = successResponseSchema("OpenWorkServerV2MessageListResponse", messageListDataSchema);
+export const acceptedActionResponseSchema = successResponseSchema(
+  "OpenWorkServerV2AcceptedActionResponse",
+  acceptedActionDataSchema,
+);
+export const deletedActionResponseSchema = successResponseSchema(
+  "OpenWorkServerV2DeletedActionResponse",
+  deletedActionDataSchema,
+);
+
+export type SessionRecord = z.infer<typeof sessionSchema>;
+export type SessionMessageRecord = z.infer<typeof sessionMessageSchema>;
+export type SessionSnapshotRecord = z.infer<typeof sessionSnapshotSchema>;
+export type SessionStatusRecord = z.infer<typeof sessionStatusSchema>;
+export type SessionTodoRecord = z.infer<typeof sessionTodoSchema>;
+export type WorkspaceEventRecord = z.infer<typeof workspaceEventSchema>;
+
+export function parseSessionData(value: unknown) {
+  return sessionSchema.parse(value);
+}
+
+export function parseSessionListData(value: unknown) {
+  return z.array(sessionSchema).parse(value);
+}
+
+export function parseSessionMessageData(value: unknown) {
+  return sessionMessageSchema.parse(value);
+}
+
+export function parseSessionMessagesData(value: unknown) {
+  return z.array(sessionMessageSchema).parse(value);
+}
+
+export function parseSessionStatusesData(value: unknown) {
+  return z.record(z.string(), sessionStatusSchema).parse(value);
+}
+
+export function parseSessionTodosData(value: unknown) {
+  return z.array(sessionTodoSchema).parse(value);
+}
+
+export function parseWorkspaceEventData(value: unknown) {
+  return workspaceEventSchema.parse(value);
+}
diff --git a/apps/server-v2/src/schemas/system.ts b/apps/server-v2/src/schemas/system.ts
new file mode 100644
index 0000000000..16620ee043
--- /dev/null
+++ b/apps/server-v2/src/schemas/system.ts
@@ -0,0 +1,133 @@
+import { z } from "zod";
+import { identifierSchema, isoTimestampSchema, successResponseSchema } from "./common.js";
+import { runtimeSummaryDataSchema } from "./runtime.js";
+
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+
+export const routeNamespacesSchema = z.object({
+  root: z.literal("/"),
+  openapi: z.literal("/openapi.json"),
+  system: z.literal("/system"),
+  workspaces: z.literal("/workspaces"),
+  workspaceResource: z.string().startsWith("/workspaces/"),
+}).meta({ ref: "OpenWorkServerV2RouteNamespaces" });
+
+export const contractMetadataSchema = z.object({
+  source: z.literal("hono-openapi"),
+  openapiPath: z.literal("/openapi.json"),
+  sdkPackage: z.literal("@openwork/server-sdk"),
+}).meta({ ref: "OpenWorkServerV2ContractMetadata" });
+
+export const databaseStatusSchema = z.object({
+  bootstrapMode: z.enum(["fresh", "existing"]),
+  configured: z.literal(true),
+  importWarnings: z.number().int().nonnegative(),
+  kind: z.literal("sqlite"),
+  migrations: z.object({
+    appliedThisRun: z.array(z.string()),
+    currentVersion: z.string(),
+    totalApplied: z.number().int().nonnegative(),
+  }).meta({ ref: "OpenWorkServerV2MigrationStatus" }),
+  path: z.string(),
+  phaseOwner: z.literal(2),
+  status: z.enum(["ready", "warning"]),
+  summary: z.string(),
+  workingDirectory: z.string(),
+}).meta({ ref: "OpenWorkServerV2DatabaseStatus" });
+
+export const importSourceReportSchema = z.object({
+  details: jsonObjectSchema,
+  sourcePath: z.string().nullable(),
+  status: z.enum(["error", "imported", "skipped", "unavailable"]),
+  warnings: z.array(z.string()),
+}).meta({ ref: "OpenWorkServerV2ImportSourceReport" });
+
+export const startupDiagnosticsSchema = z.object({
+  completedAt: isoTimestampSchema,
+  importReports: z.object({
+    cloudSignin: importSourceReportSchema,
+    desktopWorkspaceState: importSourceReportSchema,
+    orchestratorAuth: importSourceReportSchema,
+    orchestratorState: importSourceReportSchema,
+  }).meta({ ref: "OpenWorkServerV2ImportReports" }),
+  legacyWorkspaceImport: z.object({
+    completedAt: isoTimestampSchema.nullable(),
+    skipped: z.boolean(),
+  }).meta({ ref: "OpenWorkServerV2LegacyWorkspaceImportState" }),
+  mode: z.enum(["fresh", "existing"]),
+  migrations: z.object({
+    applied: z.array(z.string()),
+    currentVersion: z.string(),
+    totalApplied: z.number().int().nonnegative(),
+  }).meta({ ref: "OpenWorkServerV2StartupMigrationSummary" }),
+  registry: z.object({
+    hiddenWorkspaceIds: z.array(identifierSchema),
+    localServerCreated: z.boolean(),
+    localServerId: identifierSchema,
+    totalServers: z.number().int().nonnegative(),
+    totalVisibleWorkspaces: z.number().int().nonnegative(),
+  }).meta({ ref: "OpenWorkServerV2StartupRegistrySummary" }),
+  warnings: z.array(z.string()),
+  workingDirectory: z.object({
+    databasePath: z.string(),
+    rootDir: z.string(),
+    workspacesDir: z.string(),
+  }).meta({ ref: "OpenWorkServerV2WorkingDirectory" }),
+}).meta({ ref: "OpenWorkServerV2StartupDiagnostics" });
+
+export const rootInfoDataSchema = z.object({
+  service: z.literal("openwork-server-v2"),
+  packageName: z.literal("openwork-server-v2"),
+  version: z.string(),
+  environment: z.string(),
+  routes: routeNamespacesSchema,
+  contract: contractMetadataSchema,
+}).meta({ ref: "OpenWorkServerV2RootInfoData" });
+
+export const healthDataSchema = z.object({
+  service: z.literal("openwork-server-v2"),
+  status: z.literal("ok"),
+  startedAt: isoTimestampSchema,
+  uptimeMs: z.number().int().nonnegative(),
+  database: databaseStatusSchema,
+}).meta({ ref: "OpenWorkServerV2HealthData" });
+
+export const runtimeInfoSchema = z.object({
+  environment: z.string(),
+  hostname: z.string(),
+  pid: z.number().int().nonnegative(),
+  platform: z.string(),
+  runtime: z.literal("bun"),
+  runtimeVersion: z.string().nullable(),
+}).meta({ ref: "OpenWorkServerV2RuntimeInfo" });
+
+export const metadataDataSchema = z.object({
+  foundation: z.object({
+    phase: z.literal(8),
+    middlewareOrder: z.array(identifierSchema).min(1),
+    routeNamespaces: routeNamespacesSchema,
+    database: databaseStatusSchema,
+    startup: startupDiagnosticsSchema,
+  }).meta({ ref: "OpenWorkServerV2FoundationInfo" }),
+  requestContext: z.object({
+    actorKind: z.enum(["anonymous", "client", "host"]),
+    requestIdHeader: z.literal("X-Request-Id"),
+  }).meta({ ref: "OpenWorkServerV2RequestContextInfo" }),
+  runtime: runtimeInfoSchema,
+  runtimeSupervisor: runtimeSummaryDataSchema,
+  contract: contractMetadataSchema,
+}).meta({ ref: "OpenWorkServerV2MetadataData" });
+
+export const rootInfoResponseSchema = successResponseSchema("OpenWorkServerV2RootInfoResponse", rootInfoDataSchema);
+export const healthResponseSchema = successResponseSchema("OpenWorkServerV2HealthResponse", healthDataSchema);
+export const metadataResponseSchema = successResponseSchema("OpenWorkServerV2MetadataResponse", metadataDataSchema);
+
+export const openApiDocumentSchema = z.object({
+  openapi: z.string(),
+  info: z.object({
+    title: z.string(),
+    version: z.string(),
+  }).passthrough(),
+  paths: z.record(z.string(), z.unknown()),
+  components: z.object({}).passthrough().optional(),
+}).passthrough().meta({ ref: "OpenWorkServerV2OpenApiDocument" });
diff --git a/apps/server-v2/src/services/auth-service.ts b/apps/server-v2/src/services/auth-service.ts
new file mode 100644
index 0000000000..53cbd136d8
--- /dev/null
+++ b/apps/server-v2/src/services/auth-service.ts
@@ -0,0 +1,124 @@
+import { HTTPException } from "hono/http-exception";
+
+export type RequestActor = {
+  kind: "anonymous" | "client" | "host";
+};
+
+export type AuthSummary = {
+  actorKind: RequestActor["kind"];
+  configured: {
+    clientToken: boolean;
+    hostToken: boolean;
+  };
+  headers: {
+    authorization: "Authorization";
+    hostToken: "X-OpenWork-Host-Token";
+  };
+  required: boolean;
+  scopes: {
+    hiddenWorkspaceReads: "host";
+    serverInventory: "host";
+    visibleRead: "client_or_host";
+  };
+};
+
+function readBearer(headers: Headers) {
+  const raw = headers.get("authorization")?.trim() ?? "";
+  const match = raw.match(/^Bearer\s+(.+)$/i);
+  return match?.[1]?.trim() ?? "";
+}
+
+function trimToken(value: string | undefined) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed || null;
+}
+
+export type AuthService = ReturnType<typeof createAuthService>;
+
+export function createAuthService() {
+  const clientToken = trimToken(
+    process.env.OPENWORK_SERVER_V2_CLIENT_TOKEN
+      ?? process.env.OPENWORK_CLIENT_TOKEN
+      ?? process.env.OPENWORK_TOKEN,
+  );
+  const hostToken = trimToken(
+    process.env.OPENWORK_SERVER_V2_HOST_TOKEN
+      ?? process.env.OPENWORK_HOST_TOKEN,
+  );
+  const required = Boolean(clientToken || hostToken);
+
+  function resolveActor(headers: Headers): RequestActor {
+    const hostHeader = headers.get("x-openwork-host-token")?.trim() ?? "";
+    if (hostToken && hostHeader && hostHeader === hostToken) {
+      return { kind: "host" };
+    }
+
+    const bearer = readBearer(headers);
+    if (hostToken && bearer && bearer === hostToken) {
+      return { kind: "host" };
+    }
+
+    if (clientToken && bearer && bearer === clientToken) {
+      return { kind: "client" };
+    }
+
+    return { kind: "anonymous" };
+  }
+
+  function getSummary(actor: RequestActor): AuthSummary {
+    return {
+      actorKind: actor.kind,
+      configured: {
+        clientToken: Boolean(clientToken),
+        hostToken: Boolean(hostToken),
+      },
+      headers: {
+        authorization: "Authorization",
+        hostToken: "X-OpenWork-Host-Token",
+      },
+      required,
+      scopes: {
+        hiddenWorkspaceReads: "host",
+        serverInventory: "host",
+        visibleRead: "client_or_host",
+      },
+    };
+  }
+
+  function requireVisibleRead(actor: RequestActor) {
+    if (!required) {
+      return;
+    }
+
+    if (actor.kind === "anonymous") {
+      throw new HTTPException(401, {
+        message: "A client or host token is required for this route.",
+      });
+    }
+  }
+
+  function requireHost(actor: RequestActor) {
+    if (!required) {
+      return;
+    }
+
+    if (actor.kind === "anonymous") {
+      throw new HTTPException(401, {
+        message: "A host token is required for this route.",
+      });
+    }
+
+    if (actor.kind !== "host") {
+      throw new HTTPException(403, {
+        message: "Host scope is required for this route.",
+      });
+    }
+  }
+
+  return {
+    getSummary,
+    requireHost,
+    requireVisibleRead,
+    resolveActor,
+  };
+}
diff --git a/apps/server-v2/src/services/capabilities-service.ts b/apps/server-v2/src/services/capabilities-service.ts
new file mode 100644
index 0000000000..ae784b1a1c
--- /dev/null
+++ b/apps/server-v2/src/services/capabilities-service.ts
@@ -0,0 +1,182 @@
+import type { RequestActor } from "./auth-service.js";
+import type { RuntimeService } from "./runtime-service.js";
+import type { AuthService } from "./auth-service.js";
+
+export type CapabilitiesData = {
+  auth: ReturnType<AuthService["getSummary"]>;
+  bundles: {
+    fetch: true;
+    publish: true;
+    workspaceExport: true;
+    workspaceImport: true;
+  };
+  cloud: {
+    persistence: true;
+    validation: true;
+  };
+  config: {
+    projection: true;
+    rawRead: true;
+    rawWrite: true;
+    read: true;
+    write: true;
+  };
+  files: {
+    artifacts: true;
+    contentRoutes: true;
+    fileSessions: true;
+    inbox: true;
+    mutations: true;
+  };
+  managed: {
+    assignments: true;
+    mcps: true;
+    plugins: true;
+    providerConfigs: true;
+    skills: true;
+  };
+  reload: {
+    manualEngineReload: true;
+    reconciliation: true;
+    watch: true;
+    workspaceEvents: true;
+  };
+  registry: {
+    backendResolution: true;
+    hiddenWorkspaceFiltering: true;
+    remoteServerConnections: true;
+    remoteWorkspaceSync: true;
+    serverInventory: true;
+    workspaceDetail: true;
+    workspaceList: true;
+  };
+  sessions: {
+    events: true;
+    list: true;
+    messages: true;
+    mutations: true;
+    promptAsync: true;
+    revertHistory: true;
+  };
+  runtime: {
+    opencodeHealth: true;
+    routerHealth: true;
+    runtimeSummary: true;
+    runtimeUpgrade: true;
+    runtimeVersions: true;
+  };
+  router: {
+    bindings: true;
+    identities: true;
+    outboundSend: true;
+    productRoutes: true;
+  };
+  shares: {
+    workspaceScoped: true;
+  };
+  workspaces: {
+    activate: true;
+    createLocal: true;
+  };
+  transport: {
+    rootMounted: true;
+    sdkPackage: "@openwork/server-sdk";
+    v2: true;
+  };
+};
+
+export type CapabilitiesService = ReturnType<typeof createCapabilitiesService>;
+
+export function createCapabilitiesService(input: {
+  auth: AuthService;
+  runtime: RuntimeService;
+}) {
+  return {
+    getCapabilities(actor: RequestActor): CapabilitiesData {
+      const runtimeSummary = input.runtime.getRuntimeSummary();
+      void runtimeSummary;
+      return {
+        auth: input.auth.getSummary(actor),
+        bundles: {
+          fetch: true,
+          publish: true,
+          workspaceExport: true,
+          workspaceImport: true,
+        },
+        cloud: {
+          persistence: true,
+          validation: true,
+        },
+        config: {
+          projection: true,
+          rawRead: true,
+          rawWrite: true,
+          read: true,
+          write: true,
+        },
+        files: {
+          artifacts: true,
+          contentRoutes: true,
+          fileSessions: true,
+          inbox: true,
+          mutations: true,
+        },
+        managed: {
+          assignments: true,
+          mcps: true,
+          plugins: true,
+          providerConfigs: true,
+          skills: true,
+        },
+        reload: {
+          manualEngineReload: true,
+          reconciliation: true,
+          watch: true,
+          workspaceEvents: true,
+        },
+        registry: {
+          backendResolution: true,
+          hiddenWorkspaceFiltering: true,
+          remoteServerConnections: true,
+          remoteWorkspaceSync: true,
+          serverInventory: true,
+          workspaceDetail: true,
+          workspaceList: true,
+        },
+        sessions: {
+          events: true,
+          list: true,
+          messages: true,
+          mutations: true,
+          promptAsync: true,
+          revertHistory: true,
+        },
+        runtime: {
+          opencodeHealth: true,
+          routerHealth: true,
+          runtimeSummary: true,
+          runtimeUpgrade: true,
+          runtimeVersions: true,
+        },
+        router: {
+          bindings: true,
+          identities: true,
+          outboundSend: true,
+          productRoutes: true,
+        },
+        shares: {
+          workspaceScoped: true,
+        },
+        workspaces: {
+          activate: true,
+          createLocal: true,
+        },
+        transport: {
+          rootMounted: true,
+          sdkPackage: "@openwork/server-sdk",
+          v2: true,
+        },
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/config-materialization-service.ts b/apps/server-v2/src/services/config-materialization-service.ts
new file mode 100644
index 0000000000..124c0f4ed4
--- /dev/null
+++ b/apps/server-v2/src/services/config-materialization-service.ts
@@ -0,0 +1,832 @@
+import fs from "node:fs";
+import path from "node:path";
+import { HTTPException } from "hono/http-exception";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { JsonObject, ManagedConfigRecord, WorkspaceRecord } from "../database/types.js";
+import type { ServerWorkingDirectory } from "../database/working-directory.js";
+import { ensureWorkspaceConfigDir } from "../database/working-directory.js";
+import { RouteError } from "../http.js";
+import { requestRemoteOpenwork, resolveRemoteWorkspaceTarget } from "../adapters/remote-openwork.js";
+
+const MANAGED_SKILL_DOMAIN = "openwork-managed";
+const OPENWORK_CONFIG_VERSION = 1;
+
+type WorkspaceConfigSnapshot = {
+  effective: {
+    opencode: JsonObject;
+    openwork: JsonObject;
+  };
+  materialized: {
+    compatibilityOpencodePath: string | null;
+    compatibilityOpenworkPath: string | null;
+    configDir: string | null;
+    configOpencodePath: string | null;
+    configOpenworkPath: string | null;
+  };
+  stored: {
+    opencode: JsonObject;
+    openwork: JsonObject;
+  };
+  updatedAt: string;
+  workspaceId: string;
+};
+
+function asObject(value: unknown): JsonObject {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...(value as JsonObject) } : {};
+}
+
+function normalizeStringArray(value: unknown) {
+  if (!Array.isArray(value)) {
+    return [] as string[];
+  }
+  return Array.from(new Set(value.filter((item): item is string => typeof item === "string").map((item) => item.trim()).filter(Boolean)));
+}
+
+function normalizeAuthorizedFolderPath(input: string | null | undefined) {
+  const trimmed = (input ?? "").trim();
+  if (!trimmed) return "";
+  return trimmed.replace(/[\\/]\*+$/, "");
+}
+
+function authorizedFolderToExternalDirectoryKey(folder: string) {
+  const normalized = normalizeAuthorizedFolderPath(folder);
+  if (!normalized) return "";
+  return normalized === "/" ? "/*" : `${normalized}/*`;
+}
+
+function externalDirectoryKeyToAuthorizedFolder(key: string, value: unknown) {
+  if (value !== "allow") return null;
+  const trimmed = key.trim();
+  if (!trimmed) return null;
+  if (trimmed === "/*") return "/";
+  if (!trimmed.endsWith("/*")) return null;
+  return normalizeAuthorizedFolderPath(trimmed.slice(0, -2));
+}
+
+function normalizeExternalDirectory(value: unknown) {
+  const folders = new Set<string>();
+  const hiddenEntries: JsonObject = {};
+
+  for (const folder of normalizeStringArray(value)) {
+    const normalized = normalizeAuthorizedFolderPath(folder);
+    if (normalized) {
+      folders.add(normalized);
+    }
+  }
+
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    for (const [key, entryValue] of Object.entries(value as JsonObject)) {
+      const folder = externalDirectoryKeyToAuthorizedFolder(key, entryValue);
+      if (folder) {
+        folders.add(folder);
+      } else {
+        hiddenEntries[key] = entryValue;
+      }
+    }
+  }
+
+  return {
+    folders: Array.from(folders),
+    hiddenEntries,
+  };
+}
+
+function buildExternalDirectory(folders: string[], hiddenEntries: JsonObject) {
+  const next: JsonObject = { ...hiddenEntries };
+  for (const folder of folders) {
+    const key = authorizedFolderToExternalDirectoryKey(folder);
+    if (!key) continue;
+    next[key] = "allow";
+  }
+  return Object.keys(next).length ? next : undefined;
+}
+
+function withoutWorkspaceRoot(folders: string[], workspace: WorkspaceRecord) {
+  const workspaceRoot = normalizeAuthorizedFolderPath(workspace.dataDir);
+  if (!workspaceRoot) {
+    return folders;
+  }
+  return folders.filter((folder) => normalizeAuthorizedFolderPath(folder) !== workspaceRoot);
+}
+
+function canonicalizeWorkspaceConfigState(workspace: WorkspaceRecord, config: { openwork: JsonObject; opencode: JsonObject }) {
+  const nextOpenwork = asObject(config.openwork);
+  nextOpenwork.authorizedRoots = withoutWorkspaceRoot(normalizeStringArray(nextOpenwork.authorizedRoots), workspace);
+
+  const nextOpencode = asObject(config.opencode);
+  const permission = asObject(nextOpencode.permission);
+  const externalDirectory = normalizeExternalDirectory(permission.external_directory);
+  const nextExternalDirectory = buildExternalDirectory(withoutWorkspaceRoot(externalDirectory.folders, workspace), externalDirectory.hiddenEntries);
+  if (nextExternalDirectory) {
+    permission.external_directory = nextExternalDirectory;
+  } else {
+    delete permission.external_directory;
+  }
+  if (Object.keys(permission).length) {
+    nextOpencode.permission = permission;
+  } else {
+    delete nextOpencode.permission;
+  }
+
+  return {
+    openwork: nextOpenwork,
+    opencode: nextOpencode,
+  };
+}
+
+function mergeObjects(base: JsonObject, patch: JsonObject): JsonObject {
+  const next: JsonObject = { ...base };
+  for (const [key, value] of Object.entries(patch)) {
+    if (
+      value &&
+      typeof value === "object" &&
+      !Array.isArray(value) &&
+      base[key] &&
+      typeof base[key] === "object" &&
+      !Array.isArray(base[key])
+    ) {
+      next[key] = mergeObjects(asObject(base[key]), asObject(value));
+      continue;
+    }
+    next[key] = value;
+  }
+  return next;
+}
+
+function writeJsonFile(filePath: string, value: unknown) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function readJsonFile(filePath: string) {
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8")) as JsonObject;
+  } catch {
+    return null;
+  }
+}
+
+function readJsoncFile(filePath: string) {
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    return asObject(parseJsoncText(fs.readFileSync(filePath, "utf8")));
+  } catch {
+    return null;
+  }
+}
+
+function parseJsoncText(content: string) {
+  const withoutLineComments = content.replace(/^\s*\/\/.*$/gm, "");
+  const withoutBlockComments = withoutLineComments.replace(/\/\*[\s\S]*?\*\//g, "");
+  const withoutTrailingCommas = withoutBlockComments.replace(/,\s*([}\]])/g, "$1");
+  return JSON.parse(withoutTrailingCommas);
+}
+
+function normalizePluginKey(spec: string) {
+  const trimmed = spec.trim();
+  if (!trimmed) {
+    return "";
+  }
+  if (trimmed.startsWith("@")) {
+    const atIndex = trimmed.indexOf("@", 1);
+    return atIndex > 0 ? trimmed.slice(0, atIndex) : trimmed;
+  }
+  const atIndex = trimmed.indexOf("@");
+  return atIndex > 0 ? trimmed.slice(0, atIndex) : trimmed;
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function parseManagedSkillMetadata(content: string, fallbackName: string) {
+  const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  const nameMatch = frontmatter?.[1]?.match(/^name:\s*(.+)$/m);
+  const descriptionMatch = frontmatter?.[1]?.match(/^description:\s*(.+)$/m);
+  const displayName = nameMatch?.[1]?.trim() || fallbackName;
+  const key = displayName.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || fallbackName;
+  return {
+    description: descriptionMatch?.[1]?.trim() || displayName,
+    displayName,
+    key,
+  };
+}
+
+function readManagedSkillFiles(rootDir: string | null) {
+  if (!rootDir || !fs.existsSync(rootDir)) {
+    return [] as Array<{ content: string; key: string; path: string }>;
+  }
+
+  const items: Array<{ content: string; key: string; path: string }> = [];
+  const visit = (directory: string, depth: number) => {
+    if (depth > 2) {
+      return;
+    }
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      const direct = path.join(directory, entry.name, "SKILL.md");
+      if (fs.existsSync(direct) && fs.statSync(direct).isFile()) {
+        items.push({ content: fs.readFileSync(direct, "utf8"), key: entry.name, path: direct });
+        continue;
+      }
+      visit(path.join(directory, entry.name), depth + 1);
+    }
+  };
+
+  visit(rootDir, 0);
+  return items;
+}
+
+function extractRecognizedOpencodeSections(opencode: JsonObject) {
+  const base = { ...opencode };
+  const plugins = Array.isArray(base.plugin)
+    ? base.plugin.filter((value): value is string => typeof value === "string" && Boolean(value.trim())).map((value) => value.trim())
+    : typeof base.plugin === "string" && base.plugin.trim()
+      ? [base.plugin.trim()]
+      : [];
+  const mcps = asObject(base.mcp);
+  const providers = asObject((base as Record<string, unknown>).provider);
+  delete base.plugin;
+  delete base.mcp;
+  delete (base as Record<string, unknown>).provider;
+
+  return {
+    base,
+    mcps: Object.entries(mcps).map(([key, value]) => ({ config: asObject(value), displayName: key, key })),
+    plugins: plugins.map((spec) => ({
+      config: { spec },
+      displayName: normalizePluginKey(spec) || spec,
+      key: normalizePluginKey(spec) || spec,
+    })),
+    providers: Object.entries(providers).map(([key, value]) => ({ config: asObject(value), displayName: key, key })),
+  };
+}
+
+function dedupeAssignments(items: string[]) {
+  return Array.from(new Set(items.filter(Boolean)));
+}
+
+export type ConfigMaterializationService = ReturnType<typeof createConfigMaterializationService>;
+export type { WorkspaceConfigSnapshot };
+
+export function createConfigMaterializationService(input: {
+  repositories: ServerRepositories;
+  serverId: string;
+  workingDirectory: ServerWorkingDirectory;
+}) {
+  function getWorkspaceOrThrow(workspaceId: string) {
+    const workspace = input.repositories.workspaces.getById(workspaceId);
+    if (!workspace) {
+      throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+    }
+    return workspace;
+  }
+
+  function getRemoteServerOrThrow(workspace: WorkspaceRecord) {
+    const server = input.repositories.servers.getById(workspace.serverId);
+    if (!server) {
+      throw new RouteError(502, "bad_gateway", `Workspace ${workspace.id} points at missing remote server ${workspace.serverId}.`);
+    }
+    return server;
+  }
+
+  function ensureWorkspaceLocal(workspace: WorkspaceRecord) {
+    if (workspace.kind === "remote") {
+      throw new RouteError(
+        501,
+        "not_implemented",
+        "Phase 7 local file/config ownership currently supports local, control, and help workspaces only. Remote config and file mutation stay on the direct remote path during migration.",
+      );
+    }
+  }
+
+  function workspaceOpencodeConfigPath(workspace: WorkspaceRecord) {
+    const configDir = workspace.configDir?.trim();
+    if (!configDir) {
+      throw new RouteError(500, "internal_error", `Workspace ${workspace.id} is missing its config directory.`);
+    }
+    return path.join(configDir, "opencode.jsonc");
+  }
+
+  function workspaceOpenworkConfigPath(workspace: WorkspaceRecord) {
+    const configDir = workspace.configDir?.trim();
+    if (!configDir) {
+      throw new RouteError(500, "internal_error", `Workspace ${workspace.id} is missing its config directory.`);
+    }
+    return path.join(configDir, ".opencode", "openwork.json");
+  }
+
+  function compatibilityOpencodeConfigPath(workspace: WorkspaceRecord) {
+    const dataDir = workspace.dataDir?.trim();
+    return dataDir ? path.join(dataDir, "opencode.jsonc") : null;
+  }
+
+  function compatibilityOpenworkConfigPath(workspace: WorkspaceRecord) {
+    const dataDir = workspace.dataDir?.trim();
+    return dataDir ? path.join(dataDir, ".opencode", "openwork.json") : null;
+  }
+
+  function workspaceSkillRoots(workspace: WorkspaceRecord) {
+    const configDir = workspace.configDir?.trim();
+    const dataDir = workspace.dataDir?.trim();
+    return {
+      compatibility: dataDir ? path.join(dataDir, ".opencode", "skills", MANAGED_SKILL_DOMAIN) : null,
+      managedConfig: configDir ? path.join(configDir, ".opencode", "skills", MANAGED_SKILL_DOMAIN) : null,
+      sourceConfig: configDir ? path.join(configDir, ".opencode", "skills") : null,
+      sourceData: dataDir ? path.join(dataDir, ".opencode", "skills") : null,
+    };
+  }
+
+  function derivePreset(workspace: WorkspaceRecord) {
+    const notes = asObject(workspace.notes);
+    const legacyDesktop = asObject(notes.legacyDesktop);
+    const preset = typeof legacyDesktop.preset === "string" ? legacyDesktop.preset.trim() : "";
+    if (preset) {
+      return preset;
+    }
+    return workspace.kind === "local" ? "starter" : "remote";
+  }
+
+  function buildDefaultOpenwork(workspace: WorkspaceRecord) {
+    return {
+      authorizedRoots: [],
+      blueprint: null,
+      reload: null,
+      version: OPENWORK_CONFIG_VERSION,
+      workspace: {
+        configDir: workspace.configDir,
+        createdAt: Date.parse(workspace.createdAt) || Date.now(),
+        dataDir: workspace.dataDir,
+        name: workspace.displayName,
+        preset: derivePreset(workspace),
+      },
+    } satisfies JsonObject;
+  }
+
+  function buildDefaultOpencode() {
+    return {
+      $schema: "https://opencode.ai/config.json",
+    } satisfies JsonObject;
+  }
+
+  function ensureServerConfigState() {
+    const existing = input.repositories.serverConfigState.getByServerId(input.serverId);
+    if (existing) {
+      return existing;
+    }
+    return input.repositories.serverConfigState.upsert({
+      opencode: buildDefaultOpencode(),
+      serverId: input.serverId,
+    });
+  }
+
+  function readLegacyWorkspaceState(workspace: WorkspaceRecord) {
+    const openwork =
+      readJsonFile(workspaceOpenworkConfigPath(workspace))
+      ?? (compatibilityOpenworkConfigPath(workspace) ? readJsonFile(compatibilityOpenworkConfigPath(workspace)!) : null)
+      ?? buildDefaultOpenwork(workspace);
+    const opencode =
+      readJsoncFile(workspaceOpencodeConfigPath(workspace))
+      ?? (compatibilityOpencodeConfigPath(workspace) ? readJsoncFile(compatibilityOpencodeConfigPath(workspace)!) : null)
+      ?? buildDefaultOpencode();
+    return {
+      openwork: asObject(openwork),
+      opencode: asObject(opencode),
+    };
+  }
+
+  function ensureWorkspaceConfigState(workspace: WorkspaceRecord) {
+    ensureWorkspaceLocal(workspace);
+    ensureWorkspaceConfigDir(input.workingDirectory, workspace.id);
+    const existing = input.repositories.workspaceConfigState.getByWorkspaceId(workspace.id);
+    if (existing) {
+      return existing;
+    }
+    const legacy = readLegacyWorkspaceState(workspace);
+    const canonical = canonicalizeWorkspaceConfigState(workspace, legacy);
+    return input.repositories.workspaceConfigState.upsert({
+      openwork: canonical.openwork,
+      opencode: canonical.opencode,
+      workspaceId: workspace.id,
+    });
+  }
+
+  function upsertManagedRecords(
+    workspaceId: string,
+    kind: "mcps" | "plugins" | "providerConfigs",
+    items: Array<{ config: JsonObject; displayName: string; key: string }>,
+  ) {
+    if (kind === "mcps") {
+      const ids = items.map((item) => input.repositories.mcps.upsert({
+        auth: null,
+        cloudItemId: null,
+        config: item.config,
+        displayName: item.displayName,
+        id: `mcp_${workspaceId}_${item.key}`,
+        key: item.key,
+        metadata: { absorbed: true, workspaceId },
+        source: "imported",
+      }).id);
+      input.repositories.workspaceMcps.replaceAssignments(workspaceId, dedupeAssignments(ids));
+      return;
+    }
+
+    if (kind === "plugins") {
+      const ids = items.map((item) => input.repositories.plugins.upsert({
+        auth: null,
+        cloudItemId: null,
+        config: item.config,
+        displayName: item.displayName,
+        id: `plugin_${workspaceId}_${item.key}`,
+        key: item.key,
+        metadata: { absorbed: true, workspaceId },
+        source: "imported",
+      }).id);
+      input.repositories.workspacePlugins.replaceAssignments(workspaceId, dedupeAssignments(ids));
+      return;
+    }
+
+    const ids = items.map((item) => input.repositories.providerConfigs.upsert({
+      auth: null,
+      cloudItemId: null,
+      config: item.config,
+      displayName: item.displayName,
+      id: `provider_${workspaceId}_${item.key}`,
+      key: item.key,
+      metadata: { absorbed: true, workspaceId },
+      source: "imported",
+    }).id);
+    input.repositories.workspaceProviderConfigs.replaceAssignments(workspaceId, dedupeAssignments(ids));
+  }
+
+  function absorbManagedSkills(workspace: WorkspaceRecord) {
+    const items = [
+      ...readManagedSkillFiles(workspaceSkillRoots(workspace).sourceConfig),
+      ...readManagedSkillFiles(workspaceSkillRoots(workspace).sourceData),
+    ];
+    const seen = new Set<string>();
+    const ids: string[] = [];
+    for (const item of items) {
+      const meta = parseManagedSkillMetadata(item.content, item.key);
+      if (!meta.key || seen.has(meta.key)) {
+        continue;
+      }
+      seen.add(meta.key);
+      ids.push(input.repositories.skills.upsert({
+        auth: null,
+        cloudItemId: null,
+        config: { content: item.content },
+        displayName: meta.displayName,
+        id: `skill_${workspace.id}_${meta.key}`,
+        key: meta.key,
+        metadata: {
+          absorbed: true,
+          description: meta.description,
+          originPath: item.path,
+          workspaceId: workspace.id,
+        },
+        source: "imported",
+      }).id);
+    }
+    input.repositories.workspaceSkills.replaceAssignments(workspace.id, dedupeAssignments(ids));
+  }
+
+  function absorbWorkspaceConfigState(workspace: WorkspaceRecord) {
+    ensureWorkspaceConfigState(workspace);
+    const legacy = readLegacyWorkspaceState(workspace);
+    const recognized = extractRecognizedOpencodeSections(legacy.opencode);
+    upsertManagedRecords(workspace.id, "mcps", recognized.mcps);
+    upsertManagedRecords(workspace.id, "plugins", recognized.plugins);
+    upsertManagedRecords(workspace.id, "providerConfigs", recognized.providers);
+    absorbManagedSkills(workspace);
+    const canonical = canonicalizeWorkspaceConfigState(workspace, {
+      openwork: mergeObjects(buildDefaultOpenwork(workspace), legacy.openwork),
+      opencode: mergeObjects(buildDefaultOpencode(), recognized.base),
+    });
+    return input.repositories.workspaceConfigState.upsert({
+      openwork: canonical.openwork,
+      opencode: canonical.opencode,
+      workspaceId: workspace.id,
+    });
+  }
+
+  function listAssignedRecords(
+    workspaceId: string,
+    assignmentTable: "workspaceMcps" | "workspacePlugins" | "workspaceProviderConfigs",
+    repo: "mcps" | "plugins" | "providerConfigs",
+  ) {
+    return input.repositories[assignmentTable]
+      .listForWorkspace(workspaceId)
+      .map((assignment) => input.repositories[repo].getById(assignment.itemId))
+      .filter(Boolean) as ManagedConfigRecord[];
+  }
+
+  function listAssignedSkills(workspaceId: string) {
+    return input.repositories.workspaceSkills
+      .listForWorkspace(workspaceId)
+      .map((assignment) => input.repositories.skills.getById(assignment.itemId))
+      .filter(Boolean) as ManagedConfigRecord[];
+  }
+
+  function computeSnapshot(workspace: WorkspaceRecord): WorkspaceConfigSnapshot {
+    const workspaceState = ensureWorkspaceConfigState(workspace);
+    const serverState = ensureServerConfigState();
+    const canonicalState = canonicalizeWorkspaceConfigState(workspace, {
+      openwork: workspaceState.openwork,
+      opencode: workspaceState.opencode,
+    });
+    const storedOpenwork = mergeObjects(buildDefaultOpenwork(workspace), canonicalState.openwork);
+    const storedOpencode = mergeObjects(buildDefaultOpencode(), canonicalState.opencode);
+    const effectiveOpenwork = mergeObjects(buildDefaultOpenwork(workspace), storedOpenwork);
+    const effectiveOpencode = mergeObjects(asObject(serverState.opencode), storedOpencode);
+
+    const mcps = listAssignedRecords(workspace.id, "workspaceMcps", "mcps");
+    if (mcps.length) {
+      effectiveOpencode.mcp = Object.fromEntries(mcps.map((item) => [item.key ?? item.displayName, item.config]));
+    }
+
+    const plugins = listAssignedRecords(workspace.id, "workspacePlugins", "plugins");
+    if (plugins.length) {
+      effectiveOpencode.plugin = plugins.map((item) => {
+        const config = asObject(item.config);
+        return typeof config.spec === "string" && config.spec.trim() ? config.spec.trim() : item.key ?? item.displayName;
+      }).filter(Boolean);
+    }
+
+    const providers = listAssignedRecords(workspace.id, "workspaceProviderConfigs", "providerConfigs");
+    if (providers.length) {
+      (effectiveOpencode as Record<string, unknown>).provider = Object.fromEntries(
+        providers.map((item) => [item.key ?? item.displayName, item.config]),
+      );
+    }
+
+    const permission = asObject(effectiveOpencode.permission);
+    const externalDirectory = normalizeExternalDirectory(permission.external_directory);
+    const authorizedRoots = withoutWorkspaceRoot(normalizeStringArray([
+      ...normalizeStringArray(effectiveOpenwork.authorizedRoots),
+      ...externalDirectory.folders,
+    ]), workspace);
+    const nextExternalDirectory = buildExternalDirectory(authorizedRoots, externalDirectory.hiddenEntries);
+    if (nextExternalDirectory) {
+      permission.external_directory = nextExternalDirectory;
+    } else {
+      delete permission.external_directory;
+    }
+    effectiveOpencode.permission = permission;
+    effectiveOpenwork.authorizedRoots = authorizedRoots;
+
+    return {
+      effective: {
+        opencode: effectiveOpencode,
+        openwork: effectiveOpenwork,
+      },
+      materialized: {
+        compatibilityOpencodePath: compatibilityOpencodeConfigPath(workspace),
+        compatibilityOpenworkPath: compatibilityOpenworkConfigPath(workspace),
+        configDir: workspace.configDir,
+        configOpencodePath: workspaceOpencodeConfigPath(workspace),
+        configOpenworkPath: workspaceOpenworkConfigPath(workspace),
+      },
+      stored: {
+        opencode: storedOpencode,
+        openwork: storedOpenwork,
+      },
+      updatedAt: workspaceState.updatedAt,
+      workspaceId: workspace.id,
+    };
+  }
+
+  function materializeSkills(workspace: WorkspaceRecord) {
+    const skills = listAssignedSkills(workspace.id);
+    const roots = workspaceSkillRoots(workspace);
+    if (roots.managedConfig) {
+      fs.rmSync(roots.managedConfig, { force: true, recursive: true });
+      fs.mkdirSync(roots.managedConfig, { recursive: true });
+    }
+    if (roots.compatibility) {
+      fs.rmSync(roots.compatibility, { force: true, recursive: true });
+      fs.mkdirSync(roots.compatibility, { recursive: true });
+    }
+    for (const skill of skills) {
+      const content = typeof asObject(skill.config).content === "string" ? String(asObject(skill.config).content) : "";
+      if (!content) {
+        continue;
+      }
+      const skillKey = skill.key?.trim() || skill.id;
+      if (roots.managedConfig) {
+        const destination = path.join(roots.managedConfig, skillKey, "SKILL.md");
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.writeFileSync(destination, content.endsWith("\n") ? content : `${content}\n`, "utf8");
+      }
+      if (roots.compatibility) {
+        const meta = asObject(skill.metadata);
+        const originPath = typeof meta.originPath === "string" ? meta.originPath : "";
+        if (originPath && workspace.dataDir && originPath.startsWith(workspace.dataDir)) {
+          continue;
+        }
+        const destination = path.join(roots.compatibility, skillKey, "SKILL.md");
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.writeFileSync(destination, content.endsWith("\n") ? content : `${content}\n`, "utf8");
+      }
+    }
+  }
+
+  function materializeWorkspaceSnapshot(workspaceId: string) {
+    const workspace = getWorkspaceOrThrow(workspaceId);
+    ensureWorkspaceLocal(workspace);
+    const snapshot = computeSnapshot(workspace);
+    writeJsonFile(snapshot.materialized.configOpencodePath!, snapshot.effective.opencode);
+    writeJsonFile(snapshot.materialized.configOpenworkPath!, snapshot.effective.openwork);
+    if (snapshot.materialized.compatibilityOpencodePath) {
+      writeJsonFile(snapshot.materialized.compatibilityOpencodePath, snapshot.effective.opencode);
+    }
+    if (snapshot.materialized.compatibilityOpenworkPath) {
+      writeJsonFile(snapshot.materialized.compatibilityOpenworkPath, snapshot.effective.openwork);
+    }
+    materializeSkills(workspace);
+    return snapshot;
+  }
+
+  function readRawProjectOpencodeConfig(workspaceId: string) {
+    const snapshot = materializeWorkspaceSnapshot(workspaceId);
+    return {
+      content: `${JSON.stringify(snapshot.effective.opencode, null, 2)}\n`,
+      exists: true,
+      path: snapshot.materialized.configOpencodePath,
+      updatedAt: snapshot.updatedAt,
+    };
+  }
+
+  function readRawGlobalOpencodeConfig() {
+    const state = ensureServerConfigState();
+    const opencode = mergeObjects(buildDefaultOpencode(), state.opencode);
+    const filePath = path.join(input.workingDirectory.managedDir, "opencode.global.jsonc");
+    writeJsonFile(filePath, opencode);
+    return {
+      content: `${JSON.stringify(opencode, null, 2)}\n`,
+      exists: true,
+      path: filePath,
+      updatedAt: state.updatedAt,
+    };
+  }
+
+  return {
+    absorbWorkspaceConfig(workspaceId: string) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      ensureWorkspaceLocal(workspace);
+      absorbWorkspaceConfigState(workspace);
+      return materializeWorkspaceSnapshot(workspaceId);
+    },
+
+    ensureWorkspaceConfig(workspaceId: string) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      ensureWorkspaceLocal(workspace);
+      ensureWorkspaceConfigState(workspace);
+      return materializeWorkspaceSnapshot(workspaceId);
+    },
+
+    async getWorkspaceConfigSnapshot(workspaceId: string) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      if (workspace.kind === "remote") {
+        const server = getRemoteServerOrThrow(workspace);
+        const target = resolveRemoteWorkspaceTarget(server, workspace);
+        return requestRemoteOpenwork<WorkspaceConfigSnapshot>({
+          path: `/workspaces/${encodeURIComponent(target.remoteWorkspaceId)}/config`,
+          server,
+          timeoutMs: 10_000,
+        });
+      }
+      ensureWorkspaceLocal(workspace);
+      return computeSnapshot(workspace);
+    },
+
+    listWatchRoots(workspaceId: string) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      ensureWorkspaceLocal(workspace);
+      return [
+        workspace.configDir,
+        workspace.dataDir,
+        workspace.dataDir ? path.join(workspace.dataDir, ".opencode") : null,
+      ].filter((value): value is string => Boolean(value));
+    },
+
+    async patchWorkspaceConfig(workspaceId: string, patch: { openwork?: JsonObject; opencode?: JsonObject }) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      if (workspace.kind === "remote") {
+        const server = getRemoteServerOrThrow(workspace);
+        const target = resolveRemoteWorkspaceTarget(server, workspace);
+        return requestRemoteOpenwork<WorkspaceConfigSnapshot>({
+          body: patch,
+          method: "PATCH",
+          path: `/workspaces/${encodeURIComponent(target.remoteWorkspaceId)}/config`,
+          server,
+          timeoutMs: 15_000,
+        });
+      }
+      ensureWorkspaceLocal(workspace);
+      const current = ensureWorkspaceConfigState(workspace);
+      const nextOpenwork = patch.openwork ? mergeObjects(current.openwork, asObject(patch.openwork)) : current.openwork;
+      let nextOpencode = current.opencode;
+      if (patch.opencode) {
+        const merged = mergeObjects(current.opencode, asObject(patch.opencode));
+        const recognized = extractRecognizedOpencodeSections(merged);
+        upsertManagedRecords(workspace.id, "mcps", recognized.mcps);
+        upsertManagedRecords(workspace.id, "plugins", recognized.plugins);
+        upsertManagedRecords(workspace.id, "providerConfigs", recognized.providers);
+        nextOpencode = recognized.base;
+      }
+      const canonical = canonicalizeWorkspaceConfigState(workspace, {
+        openwork: nextOpenwork,
+        opencode: nextOpencode,
+      });
+      input.repositories.workspaceConfigState.upsert({
+        openwork: canonical.openwork,
+        opencode: canonical.opencode,
+        workspaceId: workspace.id,
+      });
+      return materializeWorkspaceSnapshot(workspaceId);
+    },
+
+    async readRawOpencodeConfig(workspaceId: string, scope: "global" | "project") {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      if (workspace.kind === "remote") {
+        const server = getRemoteServerOrThrow(workspace);
+        const target = resolveRemoteWorkspaceTarget(server, workspace);
+        const query = `?scope=${encodeURIComponent(scope)}`;
+        return requestRemoteOpenwork<{ content: string; exists: boolean; path: string | null; updatedAt: string }>({
+          path: `/workspaces/${encodeURIComponent(target.remoteWorkspaceId)}/config/opencode-raw${query}`,
+          server,
+          timeoutMs: 10_000,
+        });
+      }
+      return scope === "global" ? readRawGlobalOpencodeConfig() : readRawProjectOpencodeConfig(workspaceId);
+    },
+
+    reconcileAllWorkspaces() {
+      const workspaces = input.repositories.workspaces.list({ includeHidden: true }).filter((workspace) => workspace.kind !== "remote");
+      for (const workspace of workspaces) {
+        absorbWorkspaceConfigState(workspace);
+        materializeWorkspaceSnapshot(workspace.id);
+      }
+      return {
+        reconciledAt: nowIso(),
+        workspaceIds: workspaces.map((workspace) => workspace.id),
+      };
+    },
+
+    writeGlobalOpencodeConfig(content: string) {
+      const parsed = asObject(parseJsoncText(content));
+      const recognized = extractRecognizedOpencodeSections(parsed);
+      if (recognized.mcps.length || recognized.plugins.length || recognized.providers.length) {
+        throw new RouteError(
+          400,
+          "invalid_request",
+          "Global raw OpenCode config writes cannot include workspace-managed MCP, plugin, or provider sections during Phase 7.",
+        );
+      }
+      input.repositories.serverConfigState.upsert({
+        opencode: recognized.base,
+        serverId: input.serverId,
+      });
+      return readRawGlobalOpencodeConfig();
+    },
+
+    async writeWorkspaceRawOpencodeConfig(workspaceId: string, content: string) {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      if (workspace.kind === "remote") {
+        const server = getRemoteServerOrThrow(workspace);
+        const target = resolveRemoteWorkspaceTarget(server, workspace);
+        return requestRemoteOpenwork<{ content: string; exists: boolean; path: string | null; updatedAt: string }>({
+          body: { content, scope: "project" },
+          method: "POST",
+          path: `/workspaces/${encodeURIComponent(target.remoteWorkspaceId)}/config/opencode-raw`,
+          server,
+          timeoutMs: 15_000,
+        });
+      }
+      ensureWorkspaceLocal(workspace);
+      const parsed = asObject(parseJsoncText(content));
+      const recognized = extractRecognizedOpencodeSections(parsed);
+      upsertManagedRecords(workspace.id, "mcps", recognized.mcps);
+      upsertManagedRecords(workspace.id, "plugins", recognized.plugins);
+      upsertManagedRecords(workspace.id, "providerConfigs", recognized.providers);
+      const canonical = canonicalizeWorkspaceConfigState(workspace, {
+        openwork: ensureWorkspaceConfigState(workspace).openwork,
+        opencode: recognized.base,
+      });
+      input.repositories.workspaceConfigState.upsert({
+        openwork: canonical.openwork,
+        opencode: canonical.opencode,
+        workspaceId: workspace.id,
+      });
+      return readRawProjectOpencodeConfig(workspaceId);
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/managed-resource-service.ts b/apps/server-v2/src/services/managed-resource-service.ts
new file mode 100644
index 0000000000..177c5e6951
--- /dev/null
+++ b/apps/server-v2/src/services/managed-resource-service.ts
@@ -0,0 +1,1442 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { HTTPException } from "hono/http-exception";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { CloudSigninRecord, JsonObject, ManagedConfigRecord, WorkspaceRecord, WorkspaceShareRecord } from "../database/types.js";
+import type { ServerWorkingDirectory } from "../database/working-directory.js";
+import type { ConfigMaterializationService } from "./config-materialization-service.js";
+import type { WorkspaceFileService } from "./workspace-file-service.js";
+import { RouteError } from "../http.js";
+
+const DEFAULT_HUB_REPO = {
+  owner: "different-ai",
+  repo: "openwork-hub",
+  ref: "main",
+} as const;
+
+const ALLOWED_BUNDLE_TYPES = new Set(["skill", "skills-set"]);
+const ALLOWED_PORTABLE_PREFIXES = [".opencode/agents/", ".opencode/plugins/", ".opencode/tools/"];
+const RESERVED_PORTABLE_SEGMENTS = new Set([".DS_Store", "Thumbs.db", "node_modules"]);
+const SKILL_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const COMMAND_NAME_REGEX = /^[A-Za-z0-9_-]+$/;
+const MCP_NAME_REGEX = /^[A-Za-z0-9_-]+$/;
+
+type ManagedKind = "mcps" | "plugins" | "providerConfigs" | "skills";
+type ManagedSummary = ManagedConfigRecord & { workspaceIds: string[] };
+type WorkspaceExportSensitiveMode = "auto" | "include" | "exclude";
+type WorkspaceExportWarning = { detail: string; id: string; label: string };
+type HubRepo = { owner: string; repo: string; ref: string };
+type PortableFile = { content: string; path: string };
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function asObject(value: unknown): JsonObject {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...(value as JsonObject) } : {};
+}
+
+function cloneJson<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function normalizeString(value: unknown) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeUrl(value: unknown) {
+  const trimmed = normalizeString(value).replace(/\/+$/, "");
+  if (!trimmed) {
+    return "";
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return "";
+    }
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return "";
+  }
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...(value as Record<string, unknown>) } : null;
+}
+
+function parseFrontmatter(content: string) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) {
+    return { body: content, data: {} as Record<string, unknown> };
+  }
+  const raw = match[1] ?? "";
+  const data: Record<string, unknown> = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const separatorIndex = trimmed.indexOf(":");
+    if (separatorIndex <= 0) {
+      continue;
+    }
+    const key = trimmed.slice(0, separatorIndex).trim();
+    const value = trimmed.slice(separatorIndex + 1).trim();
+    if (!key) {
+      continue;
+    }
+    if (value === "true") {
+      data[key] = true;
+      continue;
+    }
+    if (value === "false") {
+      data[key] = false;
+      continue;
+    }
+    if (/^-?\d+(?:\.\d+)?$/.test(value)) {
+      data[key] = Number(value);
+      continue;
+    }
+    data[key] = value.replace(/^['"]|['"]$/g, "");
+  }
+  return {
+    body: content.slice(match[0].length),
+    data,
+  };
+}
+
+function buildFrontmatter(data: Record<string, unknown>) {
+  const yaml = Object.entries(data)
+    .filter(([, value]) => value !== undefined && value !== null && value !== "")
+    .map(([key, value]) => `${key}: ${typeof value === "string" ? String(value).replace(/\n/g, " ") : String(value)}`)
+    .join("\n");
+  return `---\n${yaml}\n---\n`;
+}
+
+function validateSkillName(name: string) {
+  if (!name || name.length < 1 || name.length > 64 || !SKILL_NAME_REGEX.test(name)) {
+    throw new RouteError(400, "invalid_request", "Skill name must be kebab-case (1-64 chars).");
+  }
+}
+
+function validateCommandName(name: string) {
+  if (!name || !COMMAND_NAME_REGEX.test(name)) {
+    throw new RouteError(400, "invalid_request", "Command name must be alphanumeric with _ or -.");
+  }
+}
+
+function validateMcpName(name: string) {
+  if (!name || name.startsWith("-") || !MCP_NAME_REGEX.test(name)) {
+    throw new RouteError(400, "invalid_request", "MCP name must be alphanumeric and not start with -.");
+  }
+}
+
+function validateMcpConfig(config: Record<string, unknown>) {
+  const type = config.type;
+  if (type !== "local" && type !== "remote") {
+    throw new RouteError(400, "invalid_request", "MCP config type must be local or remote.");
+  }
+  if (type === "local") {
+    const command = config.command;
+    if (!Array.isArray(command) || command.length === 0) {
+      throw new RouteError(400, "invalid_request", "Local MCP requires command array.");
+    }
+  }
+  if (type === "remote") {
+    const url = config.url;
+    if (!url || typeof url !== "string") {
+      throw new RouteError(400, "invalid_request", "Remote MCP requires url.");
+    }
+  }
+}
+
+function normalizeManagedKey(value: string, fallback: string) {
+  const trimmed = value.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  return trimmed || fallback;
+}
+
+function normalizePortablePath(input: unknown) {
+  const normalized = String(input ?? "")
+    .replaceAll("\\", "/")
+    .replace(/\/+/g, "/")
+    .replace(/^\.\//, "")
+    .replace(/^\/+/, "")
+    .trim();
+  if (!normalized) {
+    throw new RouteError(400, "invalid_request", "Portable file path is required.");
+  }
+  if (normalized.includes("\0")) {
+    throw new RouteError(400, "invalid_request", `Portable file path contains an invalid byte: ${normalized}`);
+  }
+  const segments = normalized.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new RouteError(400, "invalid_request", `Portable file path is invalid: ${normalized}`);
+  }
+  return normalized;
+}
+
+function isAllowedPortableFilePath(input: unknown) {
+  const filePath = normalizePortablePath(input);
+  if (!ALLOWED_PORTABLE_PREFIXES.some((prefix) => filePath.startsWith(prefix))) {
+    return false;
+  }
+  if (filePath.split("/").some((segment) => /^\.env(?:\..+)?$/i.test(segment) || RESERVED_PORTABLE_SEGMENTS.has(segment))) {
+    return false;
+  }
+  return true;
+}
+
+function resolveSafeChild(baseDir: string, child: string) {
+  const base = path.resolve(baseDir);
+  const target = path.resolve(baseDir, child);
+  if (target !== base && !target.startsWith(base + path.sep)) {
+    throw new RouteError(400, "invalid_request", "Invalid file path.");
+  }
+  return target;
+}
+
+function listPortableFiles(workspaceRoot: string): PortableFile[] {
+  const root = path.resolve(workspaceRoot);
+  const portableRoot = path.join(root, ".opencode");
+  if (!fs.existsSync(portableRoot)) {
+    return [];
+  }
+
+  const output: PortableFile[] = [];
+  const walk = (currentPath: string) => {
+    for (const entry of fs.readdirSync(currentPath, { withFileTypes: true })) {
+      const absolutePath = path.join(currentPath, entry.name);
+      if (entry.isDirectory()) {
+        walk(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      const relativePath = normalizePortablePath(absolutePath.slice(root.length + 1));
+      if (!isAllowedPortableFilePath(relativePath)) {
+        continue;
+      }
+      output.push({ content: fs.readFileSync(absolutePath, "utf8"), path: relativePath });
+    }
+  };
+
+  walk(portableRoot);
+  output.sort((left, right) => left.path.localeCompare(right.path));
+  return output;
+}
+
+function writePortableFiles(workspaceRoot: string, files: unknown, options?: { replace?: boolean }) {
+  if (!Array.isArray(files) || files.length === 0) {
+    return [] as PortableFile[];
+  }
+  const root = path.resolve(workspaceRoot);
+  const planned = files.map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new RouteError(400, "invalid_request", "Portable files must be objects with path and content.");
+    }
+    const record = entry as Record<string, unknown>;
+    const filePath = normalizePortablePath(record.path);
+    if (!isAllowedPortableFilePath(filePath)) {
+      throw new RouteError(400, "invalid_request", `Portable file path is not allowed: ${filePath}`);
+    }
+    return {
+      absolutePath: resolveSafeChild(root, filePath),
+      content: typeof record.content === "string" ? record.content : String(record.content ?? ""),
+      path: filePath,
+    };
+  });
+
+  if (options?.replace) {
+    for (const existing of listPortableFiles(workspaceRoot)) {
+      fs.rmSync(path.join(root, existing.path), { force: true });
+    }
+  }
+
+  for (const file of planned) {
+    fs.mkdirSync(path.dirname(file.absolutePath), { recursive: true });
+    fs.writeFileSync(file.absolutePath, file.content, "utf8");
+  }
+
+  return planned;
+}
+
+function sanitizePortableOpencodeConfig(opencode: Record<string, unknown> | null | undefined) {
+  const source = opencode && typeof opencode === "object" && !Array.isArray(opencode) ? opencode : {};
+  const next: Record<string, unknown> = {};
+  for (const key of ["agent", "command", "instructions", "mcp", "permission", "plugin", "share", "tools", "watcher"] as const) {
+    if (key in source) {
+      next[key] = cloneJson(source[key]);
+    }
+  }
+  return next;
+}
+
+function sanitizeOpenworkTemplateConfig(openwork: Record<string, unknown> | null | undefined) {
+  const next = cloneJson(openwork ?? {});
+  const blueprint = readRecord(next.blueprint);
+  if (!blueprint) {
+    return next;
+  }
+  const materialized = readRecord(blueprint.materialized);
+  if (materialized) {
+    delete materialized.sessions;
+    if (Object.keys(materialized).length === 0) {
+      delete blueprint.materialized;
+    } else {
+      blueprint.materialized = materialized;
+    }
+  }
+  next.blueprint = blueprint;
+  return next;
+}
+
+function hasWordPair(tokens: string[], left: string, right: string) {
+  return tokens.includes(left) && tokens.includes(right);
+}
+
+function splitNameIntoTokens(value: string) {
+  return value
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .split(/[^A-Za-z0-9]+/)
+    .map((token) => token.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function detectSensitiveStringSignals(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return [] as string[];
+  }
+  const matches = new Set<string>();
+  for (const pattern of [
+    { id: "Bearer", test: /\bBearer\s+[A-Za-z0-9._~+\/-]+=*/ },
+    { id: "token", test: /\b(?:ghp|gho|github_pat|xox[baprs]|sk|rk|AKIA|ASIA|AIza)[-_A-Za-z0-9]{8,}\b/ },
+    { id: "JWT", test: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+\b/ },
+    { id: "apiKey", test: /\bapi[_-]?key\b/i },
+    { id: "token", test: /\b(?:access[_-]?token|refresh[_-]?token|auth[_-]?token|token)\b/i },
+    { id: "secret", test: /\b(?:client[_-]?secret|secret)\b/i },
+    { id: "password", test: /\b(?:password|passwd)\b/i },
+    { id: "credentials", test: /\bcredentials?\b/i },
+    { id: "privateKey", test: /\bprivate[_-]?key\b/i },
+  ]) {
+    if (pattern.test.test(trimmed)) {
+      matches.add(pattern.id);
+    }
+  }
+  if (/https?:\/\//i.test(trimmed) && trimmed.length > 32) {
+    matches.add("long URL");
+  }
+  return Array.from(matches);
+}
+
+function collectSignals(value: unknown, keyHint?: string): string[] {
+  const matches = new Set<string>();
+  if (keyHint) {
+    const tokens = splitNameIntoTokens(keyHint);
+    const normalized = tokens.join("");
+    for (const pattern of [
+      { id: "apiKey", test: () => normalized.includes("apikey") || hasWordPair(tokens, "api", "key") },
+      { id: "token", test: () => tokens.includes("token") || normalized.includes("authtoken") },
+      { id: "secret", test: () => tokens.includes("secret") || hasWordPair(tokens, "client", "secret") },
+      { id: "password", test: () => tokens.includes("password") },
+      { id: "credentials", test: () => tokens.includes("credential") || tokens.includes("credentials") },
+      { id: "privateKey", test: () => hasWordPair(tokens, "private", "key") },
+    ]) {
+      if (pattern.test()) {
+        matches.add(pattern.id);
+      }
+    }
+  }
+
+  if (typeof value === "string") {
+    for (const match of detectSensitiveStringSignals(value)) {
+      matches.add(match);
+    }
+    return Array.from(matches);
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      for (const match of collectSignals(item)) {
+        matches.add(match);
+      }
+    }
+    return Array.from(matches);
+  }
+  if (value && typeof value === "object") {
+    for (const [childKey, childValue] of Object.entries(value as Record<string, unknown>)) {
+      for (const match of collectSignals(childValue, childKey)) {
+        matches.add(match);
+      }
+    }
+  }
+  return Array.from(matches);
+}
+
+function describeSignals(intro: string, signals: string[]) {
+  const unique = Array.from(new Set(signals));
+  if (!unique.length) {
+    return `${intro}.`;
+  }
+  return `${intro}: ${unique.slice(0, 4).join(", ")}${unique.length > 4 ? ", ..." : ""}.`;
+}
+
+function sanitizeValue(value: unknown): unknown {
+  if (typeof value === "string") {
+    return detectSensitiveStringSignals(value).length ? undefined : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeValue(item)).filter((item) => item !== undefined);
+  }
+  if (value && typeof value === "object") {
+    const next: Record<string, unknown> = {};
+    for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+      const directSignals = collectSignals(child, key);
+      if (directSignals.length) {
+        continue;
+      }
+      const sanitized = sanitizeValue(child);
+      if (sanitized === undefined) {
+        continue;
+      }
+      if (Array.isArray(sanitized) && sanitized.length === 0) {
+        continue;
+      }
+      if (sanitized && typeof sanitized === "object" && !Array.isArray(sanitized) && Object.keys(sanitized as Record<string, unknown>).length === 0) {
+        continue;
+      }
+      next[key] = sanitized;
+    }
+    return next;
+  }
+  return value;
+}
+
+function collectWorkspaceExportWarnings(input: { files: PortableFile[]; opencode: Record<string, unknown> | null | undefined }) {
+  const warnings = new Map<string, WorkspaceExportWarning>();
+  const opencode = input.opencode ?? {};
+  for (const [sectionKey, sectionValue] of Object.entries(opencode)) {
+    const signals = collectSignals(sectionValue);
+    if (!signals.length) {
+      continue;
+    }
+    const label = sectionKey.charAt(0).toUpperCase() + sectionKey.slice(1);
+    warnings.set(sectionKey, {
+      detail: describeSignals(`Contains secret-like ${sectionKey} config`, signals),
+      id: `${sectionKey}-config`,
+      label,
+    });
+  }
+  for (const file of input.files) {
+    if (!file.path.startsWith(".opencode/plugins/") && !file.path.startsWith(".opencode/tools/")) {
+      continue;
+    }
+    const signals = collectSignals(file.content);
+    if (!signals.length) {
+      continue;
+    }
+    warnings.set(`portable-file:${file.path}`, {
+      detail: describeSignals("Contains secret-like file content", signals),
+      id: `portable-file:${file.path}`,
+      label: file.path,
+    });
+  }
+  return Array.from(warnings.values());
+}
+
+function stripSensitiveWorkspaceExportData(input: { files: PortableFile[]; opencode: Record<string, unknown> | null | undefined }) {
+  const opencode = cloneJson(input.opencode ?? {});
+  for (const [sectionKey, sectionValue] of Object.entries(opencode)) {
+    const sanitized = sanitizeValue(sectionValue);
+    if (sanitized === undefined) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    if (Array.isArray(sanitized) && sanitized.length === 0) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    if (sanitized && typeof sanitized === "object" && !Array.isArray(sanitized) && Object.keys(sanitized as Record<string, unknown>).length === 0) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    opencode[sectionKey] = sanitized;
+  }
+  const files = input.files.filter((file) => collectSignals(file.content).length === 0).map((file) => ({ ...file }));
+  return { files, opencode };
+}
+
+function normalizeBundleFetchUrl(bundleUrl: unknown) {
+  let inputUrl: URL;
+  try {
+    inputUrl = new URL(String(bundleUrl ?? "").trim());
+  } catch {
+    throw new RouteError(400, "invalid_request", "Invalid shared bundle URL.");
+  }
+  if (inputUrl.protocol !== "https:" && inputUrl.protocol !== "http:") {
+    throw new RouteError(400, "invalid_request", "Shared bundle URL must use http(s).");
+  }
+  const trustedBaseUrl = new URL(resolvePublisherBaseUrl().replace(/\/+$/, ""));
+  if (inputUrl.origin !== trustedBaseUrl.origin) {
+    throw new RouteError(400, "invalid_request", `Shared bundle URLs must use the configured OpenWork publisher (${trustedBaseUrl.origin}).`);
+  }
+  const segments = inputUrl.pathname.split("/").filter(Boolean);
+  if (segments[0] !== "b" || !segments[1]) {
+    throw new RouteError(400, "invalid_request", "Shared bundle URL must point to a bundle id.");
+  }
+  trustedBaseUrl.pathname = `/b/${segments[1]}/data`;
+  trustedBaseUrl.search = "";
+  return trustedBaseUrl;
+}
+
+function readErrorMessage(text: string) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return "";
+  }
+  try {
+    const json = JSON.parse(trimmed) as Record<string, unknown>;
+    return typeof json.message === "string" ? json.message.trim() : trimmed;
+  } catch {
+    return trimmed;
+  }
+}
+
+function resolvePublisherBaseUrl() {
+  return String(process.env.OPENWORK_PUBLISHER_BASE_URL ?? "").trim() || "https://share.openworklabs.com";
+}
+
+function resolvePublisherOrigin() {
+  return String(process.env.OPENWORK_PUBLISHER_REQUEST_ORIGIN ?? "").trim() || "https://app.openwork.software";
+}
+
+function fetchTelegramBotInfo(token: string) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return Promise.resolve(null as { id: number; name?: string; username?: string } | null);
+  }
+  return fetch(`https://api.telegram.org/bot${trimmed}/getMe`, {
+    headers: { Accept: "application/json" },
+  }).then(async (response) => {
+    if (!response.ok) {
+      return null;
+    }
+    const json = await response.json().catch(() => null) as Record<string, unknown> | null;
+    const result = readRecord(json?.result);
+    if (!result) {
+      return null;
+    }
+    const id = Number(result.id);
+    return Number.isFinite(id)
+      ? {
+          id,
+          name: typeof result.first_name === "string" ? result.first_name : undefined,
+          username: typeof result.username === "string" ? result.username : undefined,
+        }
+      : null;
+  }).catch(() => null);
+}
+
+function createPairingCode() {
+  return randomBytes(4).toString("hex").toUpperCase();
+}
+
+function pairingCodeHash(value: string) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function extractTriggerFromBody(body: string) {
+  const lines = body.split(/\r?\n/);
+  let inWhenSection = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    if (/^#{1,6}\s+/.test(trimmed)) {
+      const heading = trimmed.replace(/^#{1,6}\s+/, "").trim();
+      inWhenSection = /^when to use$/i.test(heading);
+      continue;
+    }
+    if (!inWhenSection) {
+      continue;
+    }
+    const cleaned = trimmed.replace(/^[-*+]\s+/, "").replace(/^\d+[.)]\s+/, "").trim();
+    if (cleaned) {
+      return cleaned;
+    }
+  }
+  return "";
+}
+
+export type ManagedResourceService = ReturnType<typeof createManagedResourceService>;
+
+export function createManagedResourceService(input: {
+  config: ConfigMaterializationService;
+  files: WorkspaceFileService;
+  repositories: ServerRepositories;
+  serverId: string;
+  workingDirectory: ServerWorkingDirectory;
+}) {
+  const kindConfig = {
+    mcps: {
+      assignmentRepo: input.repositories.workspaceMcps,
+      itemRepo: input.repositories.mcps,
+      reloadReason: "mcp" as const,
+      triggerType: "mcp" as const,
+    },
+    plugins: {
+      assignmentRepo: input.repositories.workspacePlugins,
+      itemRepo: input.repositories.plugins,
+      reloadReason: "plugins" as const,
+      triggerType: "plugin" as const,
+    },
+    providerConfigs: {
+      assignmentRepo: input.repositories.workspaceProviderConfigs,
+      itemRepo: input.repositories.providerConfigs,
+      reloadReason: "config" as const,
+      triggerType: "config" as const,
+    },
+    skills: {
+      assignmentRepo: input.repositories.workspaceSkills,
+      itemRepo: input.repositories.skills,
+      reloadReason: "skills" as const,
+      triggerType: "skill" as const,
+    },
+  };
+
+  function getWorkspaceOrThrow(workspaceId: string) {
+    const workspace = input.repositories.workspaces.getById(workspaceId);
+    if (!workspace) {
+      throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+    }
+    return workspace;
+  }
+
+  function ensureWorkspaceMutable(workspace: WorkspaceRecord) {
+    if (workspace.kind === "remote") {
+      throw new RouteError(
+        501,
+        "not_implemented",
+        "Phase 8 managed-resource mutation currently supports local, control, and help workspaces only. Remote managed-resource mutation stays on the compatibility path until remote credentials and projection ownership fully migrate.",
+      );
+    }
+    if (!workspace.dataDir?.trim()) {
+      throw new RouteError(400, "invalid_request", `Workspace ${workspace.id} does not have a local data directory.`);
+    }
+    return workspace;
+  }
+
+  function workspaceSkillPath(workspace: WorkspaceRecord, key: string) {
+    const baseDir = workspace.configDir?.trim() || workspace.dataDir?.trim() || "";
+    return path.join(baseDir, ".opencode", "skills", "openwork-managed", key, "SKILL.md");
+  }
+
+  function workspaceCommandDir(workspace: WorkspaceRecord) {
+    return path.join(workspace.dataDir!.trim(), ".opencode", "commands");
+  }
+
+  function listWorkspaceCommands(workspace: WorkspaceRecord) {
+    ensureWorkspaceMutable(workspace);
+    const directory = workspaceCommandDir(workspace);
+    if (!fs.existsSync(directory)) {
+      return [] as Array<{ description?: string; name: string; template: string }>;
+    }
+    const items: Array<{ description?: string; name: string; template: string }> = [];
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith(".md")) {
+        continue;
+      }
+      const filePath = path.join(directory, entry.name);
+      const content = fs.readFileSync(filePath, "utf8");
+      const parsed = parseFrontmatter(content);
+      const name = typeof parsed.data.name === "string" ? parsed.data.name : entry.name.replace(/\.md$/, "");
+      if (!COMMAND_NAME_REGEX.test(name)) {
+        continue;
+      }
+      items.push({
+        description: typeof parsed.data.description === "string" ? parsed.data.description : undefined,
+        name,
+        template: parsed.body.trim(),
+      });
+    }
+    items.sort((left, right) => left.name.localeCompare(right.name));
+    return items;
+  }
+
+  function upsertWorkspaceCommand(workspace: WorkspaceRecord, payload: { description?: string; name: string; template: string }) {
+    ensureWorkspaceMutable(workspace);
+    validateCommandName(payload.name);
+    if (!payload.template.trim()) {
+      throw new RouteError(400, "invalid_request", "Command template is required.");
+    }
+    const directory = workspaceCommandDir(workspace);
+    fs.mkdirSync(directory, { recursive: true });
+    const filePath = path.join(directory, `${payload.name}.md`);
+    const content = `${buildFrontmatter({ description: payload.description, name: payload.name })}\n${payload.template.trim()}\n`;
+    fs.writeFileSync(filePath, content, "utf8");
+    return filePath;
+  }
+
+  function clearWorkspaceCommands(workspace: WorkspaceRecord) {
+    ensureWorkspaceMutable(workspace);
+    fs.rmSync(workspaceCommandDir(workspace), { force: true, recursive: true });
+  }
+
+  function summaryForKind(kind: ManagedKind, item: ManagedConfigRecord): ManagedSummary {
+    return {
+      ...item,
+      workspaceIds: kindConfig[kind].assignmentRepo.listForItem(item.id).map((assignment) => assignment.workspaceId),
+    };
+  }
+
+  async function materializeAssignments(kind: ManagedKind, workspaceIds: string[], action: "added" | "removed" | "updated", name: string) {
+    for (const workspaceId of Array.from(new Set(workspaceIds.filter(Boolean)))) {
+      const workspace = input.repositories.workspaces.getById(workspaceId);
+      if (!workspace || workspace.kind === "remote") {
+        continue;
+      }
+      input.config.ensureWorkspaceConfig(workspaceId);
+      input.files.emitReloadEvent(workspaceId, kindConfig[kind].reloadReason, {
+        action,
+        name,
+        path: kind === "skills" ? workspaceSkillPath(workspace, normalizeManagedKey(name, workspaceId)) : undefined,
+        type: kindConfig[kind].triggerType,
+      });
+      await input.files.recordWorkspaceAudit(
+        workspaceId,
+        `${kind}.${action}`,
+        workspace.dataDir ?? workspaceId,
+        `${action === "removed" ? "Removed" : action === "updated" ? "Updated" : "Added"} ${kind} item ${name} through Server V2.`,
+      );
+    }
+  }
+
+  function upsertManaged(kind: ManagedKind, payload: {
+    auth?: JsonObject | null;
+    cloudItemId?: string | null;
+    config?: JsonObject;
+    displayName: string;
+    id?: string;
+    key?: string | null;
+    metadata?: JsonObject | null;
+    source?: ManagedConfigRecord["source"];
+    workspaceIds?: string[];
+  }) {
+    const displayName = payload.displayName.trim();
+    if (!displayName) {
+      throw new RouteError(400, "invalid_request", "displayName is required.");
+    }
+    const key = normalizeManagedKey(payload.key?.trim() || displayName, kind.slice(0, -1));
+    const id = payload.id?.trim() || `${kind.slice(0, -1)}_${randomUUID()}`;
+    const workspaceIds = Array.from(new Set((payload.workspaceIds ?? []).map((value) => value.trim()).filter(Boolean)));
+    for (const workspaceId of workspaceIds) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+    }
+    const item = kindConfig[kind].itemRepo.upsert({
+      auth: payload.auth ?? null,
+      cloudItemId: payload.cloudItemId ?? null,
+      config: payload.config ?? {},
+      displayName,
+      id,
+      key,
+      metadata: payload.metadata ?? null,
+      source: payload.source ?? "openwork_managed",
+    });
+    if (payload.workspaceIds) {
+      const currentAssignments = kindConfig[kind].assignmentRepo.listForItem(item.id).map((assignment) => assignment.workspaceId);
+      for (const workspace of input.repositories.workspaces.list({ includeHidden: true })) {
+        if (workspace.kind === "remote") {
+          continue;
+        }
+        const nextAssigned = workspaceIds.includes(workspace.id);
+        const currentlyAssigned = currentAssignments.includes(workspace.id);
+        if (nextAssigned === currentlyAssigned) {
+          continue;
+        }
+        const currentForWorkspace = kindConfig[kind].assignmentRepo.listForWorkspace(workspace.id).map((assignment) => assignment.itemId);
+        const nextForWorkspace = nextAssigned
+          ? Array.from(new Set([...currentForWorkspace, item.id]))
+          : currentForWorkspace.filter((candidate) => candidate !== item.id);
+        kindConfig[kind].assignmentRepo.replaceAssignments(workspace.id, nextForWorkspace);
+      }
+    }
+    return summaryForKind(kind, item);
+  }
+
+  async function updateAssignments(kind: ManagedKind, itemId: string, workspaceIds: string[]) {
+    const item = kindConfig[kind].itemRepo.getById(itemId);
+    if (!item) {
+      throw new HTTPException(404, { message: `${kind} item not found: ${itemId}` });
+    }
+    const normalizedWorkspaceIds = Array.from(new Set(workspaceIds.map((value) => value.trim()).filter(Boolean)));
+    for (const workspaceId of normalizedWorkspaceIds) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+    }
+    const changedWorkspaceIds = new Set<string>();
+    for (const workspace of input.repositories.workspaces.list({ includeHidden: true })) {
+      if (workspace.kind === "remote") {
+        continue;
+      }
+      const currentForWorkspace = kindConfig[kind].assignmentRepo.listForWorkspace(workspace.id).map((assignment) => assignment.itemId);
+      const currentlyAssigned = currentForWorkspace.includes(itemId);
+      const nextAssigned = normalizedWorkspaceIds.includes(workspace.id);
+      if (currentlyAssigned === nextAssigned) {
+        continue;
+      }
+      const nextItemIds = nextAssigned
+        ? Array.from(new Set([...currentForWorkspace, itemId]))
+        : currentForWorkspace.filter((candidate) => candidate !== itemId);
+      kindConfig[kind].assignmentRepo.replaceAssignments(workspace.id, nextItemIds);
+      changedWorkspaceIds.add(workspace.id);
+    }
+    await materializeAssignments(kind, Array.from(changedWorkspaceIds), "updated", item.displayName);
+    return summaryForKind(kind, item);
+  }
+
+  return {
+    listManaged(kind: ManagedKind) {
+      return kindConfig[kind].itemRepo.list().map((item) => summaryForKind(kind, item));
+    },
+
+    createManaged(kind: ManagedKind, payload: Parameters<typeof upsertManaged>[1]) {
+      return upsertManaged(kind, payload);
+    },
+
+    async deleteManaged(kind: ManagedKind, itemId: string) {
+      const item = kindConfig[kind].itemRepo.getById(itemId);
+      if (!item) {
+        throw new HTTPException(404, { message: `${kind} item not found: ${itemId}` });
+      }
+      const workspaceIds = kindConfig[kind].assignmentRepo.listForItem(itemId).map((assignment) => assignment.workspaceId);
+      kindConfig[kind].assignmentRepo.deleteForItem(itemId);
+      kindConfig[kind].itemRepo.deleteById(itemId);
+      await materializeAssignments(kind, workspaceIds, "removed", item.displayName);
+      return { deleted: true, id: itemId };
+    },
+
+    updateManaged(kind: ManagedKind, itemId: string, payload: Omit<Parameters<typeof upsertManaged>[1], "id">) {
+      const existing = kindConfig[kind].itemRepo.getById(itemId);
+      if (!existing) {
+        throw new HTTPException(404, { message: `${kind} item not found: ${itemId}` });
+      }
+      return upsertManaged(kind, {
+        auth: payload.auth ?? existing.auth,
+        cloudItemId: payload.cloudItemId ?? existing.cloudItemId,
+        config: payload.config ?? existing.config,
+        displayName: payload.displayName || existing.displayName,
+        id: itemId,
+        key: payload.key ?? existing.key,
+        metadata: payload.metadata ?? existing.metadata,
+        source: payload.source ?? existing.source,
+        workspaceIds: payload.workspaceIds,
+      });
+    },
+
+    updateAssignments,
+
+    listWorkspaceMcp(workspaceId: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      return kindConfig.mcps.assignmentRepo.listForWorkspace(workspaceId)
+        .map((assignment) => input.repositories.mcps.getById(assignment.itemId))
+        .filter(Boolean)
+        .map((item) => ({
+          config: item!.config,
+          name: item!.key ?? item!.displayName,
+          source: "config.project" as const,
+        }));
+    },
+
+    async addWorkspaceMcp(workspaceId: string, payload: { config: Record<string, unknown>; name: string }) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      validateMcpName(payload.name);
+      validateMcpConfig(payload.config);
+      const key = normalizeManagedKey(payload.name, "mcp");
+      const existing = this.listManaged("mcps").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      const item = upsertManaged("mcps", {
+        config: payload.config,
+        displayName: payload.name,
+        id: existing?.id,
+        key,
+        metadata: { workspaceId },
+        workspaceIds: [workspace.id],
+      });
+      await materializeAssignments("mcps", [workspaceId], existing ? "updated" : "added", item.displayName);
+      return { items: this.listWorkspaceMcp(workspaceId) };
+    },
+
+    async removeWorkspaceMcp(workspaceId: string, name: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const key = normalizeManagedKey(name, "mcp");
+      const assignment = this.listManaged("mcps").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      if (!assignment) {
+        return { items: this.listWorkspaceMcp(workspaceId) };
+      }
+      const nextWorkspaceIds = assignment.workspaceIds.filter((candidate) => candidate !== workspaceId);
+      if (nextWorkspaceIds.length === 0) {
+        await this.deleteManaged("mcps", assignment.id);
+      } else {
+        await updateAssignments("mcps", assignment.id, nextWorkspaceIds);
+      }
+      return { items: this.listWorkspaceMcp(workspaceId) };
+    },
+
+    listWorkspacePlugins(workspaceId: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const items = kindConfig.plugins.assignmentRepo.listForWorkspace(workspaceId)
+        .map((assignment) => input.repositories.plugins.getById(assignment.itemId))
+        .filter(Boolean)
+        .map((item) => ({
+          scope: "project" as const,
+          source: "config" as const,
+          spec: typeof asObject(item!.config).spec === "string" ? String(asObject(item!.config).spec) : item!.displayName,
+        }));
+      return { items, loadOrder: ["config.global", "config.project", "dir.global", "dir.project"] };
+    },
+
+    async addWorkspacePlugin(workspaceId: string, spec: string) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const normalizedSpec = spec.trim();
+      if (!normalizedSpec) {
+        throw new RouteError(400, "invalid_request", "Plugin spec is required.");
+      }
+      const key = normalizeManagedKey(normalizedSpec.replace(/^file:/, ""), "plugin");
+      const existing = this.listManaged("plugins").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      const item = upsertManaged("plugins", {
+        config: { spec: normalizedSpec },
+        displayName: normalizedSpec,
+        id: existing?.id,
+        key,
+        metadata: { workspaceId },
+        workspaceIds: [workspace.id],
+      });
+      await materializeAssignments("plugins", [workspaceId], existing ? "updated" : "added", item.displayName);
+      return this.listWorkspacePlugins(workspaceId);
+    },
+
+    async removeWorkspacePlugin(workspaceId: string, spec: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const key = normalizeManagedKey(spec.replace(/^file:/, ""), "plugin");
+      const assignment = this.listManaged("plugins").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      if (!assignment) {
+        return this.listWorkspacePlugins(workspaceId);
+      }
+      const nextWorkspaceIds = assignment.workspaceIds.filter((candidate) => candidate !== workspaceId);
+      if (nextWorkspaceIds.length === 0) {
+        await this.deleteManaged("plugins", assignment.id);
+      } else {
+        await updateAssignments("plugins", assignment.id, nextWorkspaceIds);
+      }
+      return this.listWorkspacePlugins(workspaceId);
+    },
+
+    listWorkspaceSkills(workspaceId: string) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      return kindConfig.skills.assignmentRepo.listForWorkspace(workspaceId)
+        .map((assignment) => input.repositories.skills.getById(assignment.itemId))
+        .filter(Boolean)
+        .map((item) => ({
+          description: typeof asObject(item!.metadata).description === "string" ? String(asObject(item!.metadata).description) : item!.displayName,
+          name: item!.key ?? item!.displayName,
+          path: workspaceSkillPath(workspace, item!.key ?? item!.id),
+          scope: "project" as const,
+          trigger: typeof asObject(item!.metadata).trigger === "string" ? String(asObject(item!.metadata).trigger) : undefined,
+        }));
+    },
+
+    getWorkspaceSkill(workspaceId: string, name: string) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const key = normalizeManagedKey(name, "skill");
+      const skill = this.listManaged("skills").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      if (!skill) {
+        throw new HTTPException(404, { message: `Skill not found: ${name}` });
+      }
+      const content = typeof asObject(skill.config).content === "string" ? String(asObject(skill.config).content) : "";
+      return {
+        content,
+        item: {
+          description: typeof asObject(skill.metadata).description === "string" ? String(asObject(skill.metadata).description) : skill.displayName,
+          name: skill.key ?? skill.displayName,
+          path: workspaceSkillPath(workspace, skill.key ?? skill.id),
+          scope: "project" as const,
+          trigger: typeof asObject(skill.metadata).trigger === "string" ? String(asObject(skill.metadata).trigger) : undefined,
+        },
+      };
+    },
+
+    async upsertWorkspaceSkill(workspaceId: string, payload: {
+      cloudItemId?: string | null;
+      content: string;
+      description?: string;
+      metadata?: JsonObject | null;
+      name: string;
+      source?: ManagedConfigRecord["source"];
+      trigger?: string;
+    }) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      validateSkillName(payload.name);
+      if (!payload.content.trim()) {
+        throw new RouteError(400, "invalid_request", "Skill content is required.");
+      }
+      const parsed = parseFrontmatter(payload.content);
+      const frontmatterName = typeof parsed.data.name === "string" ? parsed.data.name.trim() : "";
+      if (frontmatterName && frontmatterName !== payload.name) {
+        throw new RouteError(400, "invalid_request", "Skill frontmatter name must match payload name.");
+      }
+      const nextDescription = normalizeString(parsed.data.description) || normalizeString(payload.description) || payload.name;
+      const trigger = normalizeString(parsed.data.trigger) || normalizeString(parsed.data.when) || normalizeString(payload.trigger) || extractTriggerFromBody(parsed.body);
+      const content = Object.keys(parsed.data).length > 0
+        ? `${buildFrontmatter({ ...parsed.data, description: nextDescription, name: payload.name })}${parsed.body.replace(/^\n/, "")}`
+        : `${buildFrontmatter({ description: nextDescription, name: payload.name, ...(trigger ? { trigger } : {}) })}${payload.content.replace(/^\n/, "")}`;
+      const existing = this.listManaged("skills").find((item) => item.key === payload.name && item.workspaceIds.includes(workspaceId)) ?? null;
+      const nextMetadata = {
+        ...(existing?.metadata ?? {}),
+        ...(payload.metadata ?? {}),
+        description: nextDescription,
+        trigger,
+        workspaceId,
+      } satisfies JsonObject;
+      const item = upsertManaged("skills", {
+        cloudItemId: payload.cloudItemId ?? existing?.cloudItemId ?? null,
+        config: { content: content.endsWith("\n") ? content : `${content}\n` },
+        displayName: payload.name,
+        id: existing?.id,
+        key: payload.name,
+        metadata: nextMetadata,
+        source: payload.source ?? existing?.source ?? "openwork_managed",
+        workspaceIds: [workspace.id],
+      });
+      await materializeAssignments("skills", [workspaceId], existing ? "updated" : "added", item.displayName);
+      return this.getWorkspaceSkill(workspaceId, payload.name).item;
+    },
+
+    async deleteWorkspaceSkill(workspaceId: string, name: string) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const key = normalizeManagedKey(name, "skill");
+      const assignment = this.listManaged("skills").find((item) => item.key === key && item.workspaceIds.includes(workspaceId)) ?? null;
+      if (!assignment) {
+        throw new HTTPException(404, { message: `Skill not found: ${name}` });
+      }
+      const nextWorkspaceIds = assignment.workspaceIds.filter((candidate) => candidate !== workspaceId);
+      if (nextWorkspaceIds.length === 0) {
+        await this.deleteManaged("skills", assignment.id);
+      } else {
+        await updateAssignments("skills", assignment.id, nextWorkspaceIds);
+      }
+      return { path: workspaceSkillPath(workspace, key).replace(/[/\\]SKILL\.md$/, "") };
+    },
+
+    async listHubSkills(repo?: Partial<HubRepo>) {
+      const resolvedRepo: HubRepo = {
+        owner: normalizeString(repo?.owner) || DEFAULT_HUB_REPO.owner,
+        repo: normalizeString(repo?.repo) || DEFAULT_HUB_REPO.repo,
+        ref: normalizeString(repo?.ref) || DEFAULT_HUB_REPO.ref,
+      };
+      const listing = await fetch(`https://api.github.com/repos/${encodeURIComponent(resolvedRepo.owner)}/${encodeURIComponent(resolvedRepo.repo)}/contents/skills?ref=${encodeURIComponent(resolvedRepo.ref)}`, {
+        headers: { Accept: "application/vnd.github+json", "User-Agent": "openwork-server-v2" },
+      });
+      if (!listing.ok) {
+        throw new RouteError(502, "bad_gateway", `Failed to fetch hub catalog (${listing.status}).`);
+      }
+      const items = await listing.json() as Array<Record<string, unknown>>;
+      const rawBase = `https://raw.githubusercontent.com/${encodeURIComponent(resolvedRepo.owner)}/${encodeURIComponent(resolvedRepo.repo)}/${encodeURIComponent(resolvedRepo.ref)}`;
+      const result: Array<{ description: string; name: string; source: { owner: string; path: string; ref: string; repo: string }; trigger?: string }> = [];
+      for (const entry of Array.isArray(items) ? items : []) {
+        const name = typeof entry?.name === "string" ? entry.name.trim() : "";
+        const type = typeof entry?.type === "string" ? entry.type : "";
+        if (!name || type !== "dir") {
+          continue;
+        }
+        try {
+          const content = await fetch(`${rawBase}/skills/${encodeURIComponent(name)}/SKILL.md`, {
+            headers: { Accept: "text/plain", "User-Agent": "openwork-server-v2" },
+          }).then((response) => response.ok ? response.text() : "");
+          if (!content) {
+            continue;
+          }
+          const parsed = parseFrontmatter(content);
+          const description = typeof parsed.data.description === "string" ? parsed.data.description : "";
+          const trigger = typeof parsed.data.trigger === "string" ? parsed.data.trigger : extractTriggerFromBody(parsed.body);
+          result.push({
+            description,
+            name,
+            source: { owner: resolvedRepo.owner, path: `skills/${name}`, ref: resolvedRepo.ref, repo: resolvedRepo.repo },
+            ...(trigger ? { trigger } : {}),
+          });
+        } catch {
+          // ignore individual skill failures
+        }
+      }
+      result.sort((left, right) => left.name.localeCompare(right.name));
+      return { items: result };
+    },
+
+    async installHubSkill(workspaceId: string, inputValue: { name: string; overwrite?: boolean; repo?: Partial<HubRepo> }) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      validateSkillName(inputValue.name);
+      const repo: HubRepo = {
+        owner: normalizeString(inputValue.repo?.owner) || DEFAULT_HUB_REPO.owner,
+        repo: normalizeString(inputValue.repo?.repo) || DEFAULT_HUB_REPO.repo,
+        ref: normalizeString(inputValue.repo?.ref) || DEFAULT_HUB_REPO.ref,
+      };
+      const rawUrl = `https://raw.githubusercontent.com/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/${encodeURIComponent(repo.ref)}/skills/${encodeURIComponent(inputValue.name)}/SKILL.md`;
+      const response = await fetch(rawUrl, {
+        headers: { Accept: "text/plain", "User-Agent": "openwork-server-v2" },
+      });
+      if (!response.ok) {
+        throw new RouteError(404, "not_found", `Hub skill not found: ${inputValue.name}`);
+      }
+      const content = await response.text();
+      const existing = this.listManaged("skills").find((item) => item.key === inputValue.name && item.workspaceIds.includes(workspaceId)) ?? null;
+      if (existing && inputValue.overwrite !== true) {
+        return { action: "updated" as const, name: inputValue.name, path: workspaceSkillPath(workspace, inputValue.name).replace(/[/\\]SKILL\.md$/, ""), skipped: 1, written: 0 };
+      }
+      const parsed = parseFrontmatter(content);
+      const description = typeof parsed.data.description === "string" ? parsed.data.description : inputValue.name;
+      const trigger = typeof parsed.data.trigger === "string" ? parsed.data.trigger : extractTriggerFromBody(parsed.body);
+      await this.upsertWorkspaceSkill(workspaceId, {
+        content,
+        description,
+        metadata: {
+          description,
+          install: {
+            kind: "hub",
+            owner: repo.owner,
+            path: `skills/${inputValue.name}`,
+            ref: repo.ref,
+            repo: repo.repo,
+            url: rawUrl,
+          },
+          trigger,
+          workspaceId,
+        },
+        name: inputValue.name,
+        source: "imported",
+        trigger,
+      });
+      return { action: existing ? "updated" as const : "added" as const, name: inputValue.name, path: workspaceSkillPath(workspace, inputValue.name).replace(/[/\\]SKILL\.md$/, ""), skipped: 0, written: 1 };
+    },
+
+    getCloudSignin() {
+      return input.repositories.cloudSignin.getPrimary();
+    },
+
+    clearCloudSignin() {
+      input.repositories.cloudSignin.deletePrimary();
+      return null;
+    },
+
+    upsertCloudSignin(payload: {
+      auth?: JsonObject | null;
+      cloudBaseUrl: string;
+      metadata?: JsonObject | null;
+      orgId?: string | null;
+      userId?: string | null;
+    }) {
+      const cloudBaseUrl = normalizeUrl(payload.cloudBaseUrl);
+      if (!cloudBaseUrl) {
+        throw new RouteError(400, "invalid_request", "cloudBaseUrl must be a valid http(s) URL.");
+      }
+      return input.repositories.cloudSignin.upsert({
+        auth: payload.auth ?? null,
+        cloudBaseUrl,
+        id: input.repositories.cloudSignin.getPrimary()?.id ?? `cloud_${input.serverId}`,
+        lastValidatedAt: null,
+        metadata: payload.metadata ?? null,
+        orgId: payload.orgId ?? null,
+        serverId: input.serverId,
+        userId: payload.userId ?? null,
+      });
+    },
+
+    async validateCloudSignin() {
+      const current = input.repositories.cloudSignin.getPrimary();
+      if (!current) {
+        throw new RouteError(404, "not_found", "Cloud signin is not configured.");
+      }
+      const auth = asObject(current.auth);
+      const token = typeof auth.authToken === "string" ? auth.authToken.trim() : typeof auth.token === "string" ? auth.token.trim() : "";
+      if (!token) {
+        throw new RouteError(400, "invalid_request", "Cloud signin does not include an auth token.");
+      }
+      const response = await fetch(`${current.cloudBaseUrl.replace(/\/+$/, "")}/v1/me`, {
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${token}`,
+        },
+      });
+      if (!response.ok) {
+        throw new RouteError(502, "bad_gateway", `Cloud validation failed (${response.status}).`);
+      }
+      const payload = await response.json().catch(() => ({})) as Record<string, unknown>;
+      const validatedUser = readRecord(payload.user) ?? readRecord(payload.me) ?? null;
+      const validated = input.repositories.cloudSignin.upsert({
+        ...current,
+        lastValidatedAt: nowIso(),
+        metadata: {
+          ...(current.metadata ?? {}),
+          validatedUser,
+        },
+        userId: typeof validatedUser?.id === "string" && validatedUser.id.trim() ? validatedUser.id.trim() : current.userId,
+      });
+      return {
+        lastValidatedAt: validated.lastValidatedAt,
+        ok: true,
+        record: validated,
+      };
+    },
+
+    getWorkspaceShare(workspaceId: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      return input.repositories.workspaceShares.getLatestByWorkspace(workspaceId);
+    },
+
+    exposeWorkspaceShare(workspaceId: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const existing = input.repositories.workspaceShares.getLatestByWorkspace(workspaceId);
+      const record = input.repositories.workspaceShares.upsert({
+        accessKey: randomBytes(24).toString("base64url"),
+        audit: {
+          exposedAt: nowIso(),
+          previousShareId: existing?.id ?? null,
+        },
+        id: existing?.id ?? `share_${workspaceId}`,
+        lastUsedAt: existing?.lastUsedAt ?? null,
+        revokedAt: null,
+        status: "active",
+        workspaceId,
+      });
+      return record;
+    },
+
+    revokeWorkspaceShare(workspaceId: string) {
+      ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const existing = input.repositories.workspaceShares.getLatestByWorkspace(workspaceId);
+      if (!existing) {
+        throw new HTTPException(404, { message: `Workspace share not found: ${workspaceId}` });
+      }
+      return input.repositories.workspaceShares.upsert({
+        ...existing,
+        accessKey: null,
+        audit: {
+          ...(existing.audit ?? {}),
+          revokedAt: nowIso(),
+        },
+        revokedAt: nowIso(),
+        status: "revoked",
+      });
+    },
+
+    async exportWorkspace(workspaceId: string, options?: { sensitiveMode?: WorkspaceExportSensitiveMode }) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const sensitiveMode = options?.sensitiveMode ?? "auto";
+      const snapshot = await input.config.getWorkspaceConfigSnapshot(workspaceId);
+      let opencode = sanitizePortableOpencodeConfig(snapshot.effective.opencode);
+      const openwork = sanitizeOpenworkTemplateConfig(snapshot.stored.openwork);
+      const skills = kindConfig.skills.assignmentRepo.listForWorkspace(workspaceId)
+        .map((assignment) => input.repositories.skills.getById(assignment.itemId))
+        .filter(Boolean)
+        .map((item) => ({
+          content: typeof asObject(item!.config).content === "string" ? String(asObject(item!.config).content) : "",
+          description: typeof asObject(item!.metadata).description === "string" ? String(asObject(item!.metadata).description) : undefined,
+          name: item!.key ?? item!.displayName,
+          trigger: typeof asObject(item!.metadata).trigger === "string" ? String(asObject(item!.metadata).trigger) : undefined,
+        }))
+        .filter((item) => item.content);
+      const commands = listWorkspaceCommands(workspace);
+      let files = listPortableFiles(workspace.dataDir!);
+      const warnings = collectWorkspaceExportWarnings({ files, opencode: snapshot.effective.opencode });
+      if (warnings.length && sensitiveMode === "auto") {
+        return { conflict: true as const, warnings };
+      }
+      if (sensitiveMode === "exclude") {
+        const sanitized = stripSensitiveWorkspaceExportData({ files, opencode });
+        files = sanitized.files;
+        opencode = sanitized.opencode;
+      }
+      return {
+        commands,
+        exportedAt: Date.now(),
+        ...(files.length ? { files } : {}),
+        openwork,
+        opencode,
+        skills,
+        workspaceId,
+      };
+    },
+
+    async importWorkspace(workspaceId: string, payload: Record<string, unknown>) {
+      const workspace = ensureWorkspaceMutable(getWorkspaceOrThrow(workspaceId));
+      const modes = asObject(payload.mode);
+      const opencode = readRecord(payload.opencode);
+      const openwork = readRecord(payload.openwork);
+      const skills = Array.isArray(payload.skills) ? payload.skills : [];
+      const commands = Array.isArray(payload.commands) ? payload.commands : [];
+      const files = Array.isArray(payload.files) ? payload.files : [];
+
+      if (opencode) {
+        const sanitizedOpencode = sanitizePortableOpencodeConfig(opencode);
+          await input.config.patchWorkspaceConfig(workspaceId, {
+            opencode: modes.opencode === "replace" ? sanitizedOpencode : sanitizedOpencode,
+          });
+      }
+
+      if (openwork) {
+          await input.config.patchWorkspaceConfig(workspaceId, {
+            openwork: sanitizeOpenworkTemplateConfig(openwork),
+          });
+      }
+
+      if (skills.length > 0 && modes.skills === "replace") {
+        for (const item of this.listManaged("skills").filter((skill) => skill.workspaceIds.includes(workspaceId))) {
+          const nextWorkspaceIds = item.workspaceIds.filter((candidate) => candidate !== workspaceId);
+          if (nextWorkspaceIds.length === 0) {
+            await this.deleteManaged("skills", item.id);
+          } else {
+            await updateAssignments("skills", item.id, nextWorkspaceIds);
+          }
+        }
+      }
+
+      for (const item of skills) {
+        const record = item && typeof item === "object" ? item as Record<string, unknown> : null;
+        if (!record) {
+          continue;
+        }
+        const name = normalizeString(record.name);
+        const content = typeof record.content === "string" ? record.content : "";
+        const description = normalizeString(record.description) || undefined;
+        const trigger = normalizeString(record.trigger) || undefined;
+        if (name && content) {
+          await this.upsertWorkspaceSkill(workspaceId, {
+            content,
+            description,
+            metadata: {
+              description,
+              importedVia: "portable_bundle",
+              sourceBundleWorkspaceId: normalizeString(payload.workspaceId) || null,
+              trigger,
+              workspaceId,
+            },
+            name,
+            source: "imported",
+            trigger,
+          });
+        }
+      }
+
+      if (commands.length > 0) {
+        if (modes.commands === "replace") {
+          clearWorkspaceCommands(workspace);
+        }
+        for (const item of commands) {
+          const record = item && typeof item === "object" ? item as Record<string, unknown> : null;
+          if (!record) {
+            continue;
+          }
+          const parsedContent = typeof record.content === "string" ? parseFrontmatter(record.content) : null;
+          const name = normalizeString(record.name) || normalizeString(parsedContent?.data.name);
+          const description = normalizeString(record.description) || normalizeString(parsedContent?.data.description) || undefined;
+          const template = typeof record.template === "string"
+            ? record.template
+            : parsedContent
+              ? parsedContent.body.trim()
+              : "";
+          if (name && template) {
+            upsertWorkspaceCommand(workspace, { description, name, template });
+          }
+        }
+      }
+
+      if (files.length > 0) {
+        writePortableFiles(workspace.dataDir!, files, { replace: modes.files === "replace" });
+      }
+
+      input.config.ensureWorkspaceConfig(workspaceId);
+      input.files.emitReloadEvent(workspaceId, "config", {
+        action: "updated",
+        name: "workspace-import",
+        type: "config",
+      });
+      await input.files.recordWorkspaceAudit(workspaceId, "workspace.import", workspace.dataDir ?? workspaceId, "Imported portable workspace data through Server V2.");
+      return { ok: true };
+    },
+
+    async publishSharedBundle(inputValue: { bundleType: string; name?: string; payload: unknown; timeoutMs?: number }) {
+      const bundleType = normalizeString(inputValue.bundleType);
+      if (!ALLOWED_BUNDLE_TYPES.has(bundleType)) {
+        throw new RouteError(400, "invalid_request", `Unsupported bundle type: ${bundleType || "unknown"}`);
+      }
+      const timeoutMs = typeof inputValue.timeoutMs === "number" && Number.isFinite(inputValue.timeoutMs) ? inputValue.timeoutMs : 15_000;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), Math.max(1_000, timeoutMs));
+      try {
+        const response = await fetch(`${resolvePublisherBaseUrl().replace(/\/+$/, "")}/v1/bundles`, {
+          body: JSON.stringify(inputValue.payload),
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            Origin: resolvePublisherOrigin(),
+            ...(normalizeString(inputValue.name) ? { "X-OpenWork-Name": normalizeString(inputValue.name) } : {}),
+            "X-OpenWork-Bundle-Type": bundleType,
+            "X-OpenWork-Schema-Version": "v1",
+          },
+          method: "POST",
+          redirect: "manual",
+          signal: controller.signal,
+        });
+        if (response.status >= 300 && response.status < 400) {
+          throw new RouteError(502, "bad_gateway", "Publisher redirects are not allowed.");
+        }
+        if (!response.ok) {
+          const details = readErrorMessage(await response.text());
+          throw new RouteError(502, "bad_gateway", `Publish failed (${response.status})${details ? `: ${details}` : ""}`);
+        }
+        const json = await response.json() as Record<string, unknown>;
+        const url = normalizeString(json.url);
+        if (!url) {
+          throw new RouteError(502, "bad_gateway", "Publisher response missing url.");
+        }
+        return { url };
+      } catch (error) {
+        if (error instanceof RouteError) {
+          throw error;
+        }
+        throw new RouteError(502, "bad_gateway", `Failed to publish bundle: ${error instanceof Error ? error.message : String(error)}`);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+
+    async fetchSharedBundle(bundleUrl: unknown, options?: { timeoutMs?: number }) {
+      const url = normalizeBundleFetchUrl(bundleUrl);
+      const timeoutMs = typeof options?.timeoutMs === "number" && Number.isFinite(options.timeoutMs) ? options.timeoutMs : 15_000;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), Math.max(1_000, timeoutMs));
+      try {
+        const response = await fetch(url.toString(), {
+          headers: { Accept: "application/json" },
+          method: "GET",
+          redirect: "manual",
+          signal: controller.signal,
+        });
+        if (response.status >= 300 && response.status < 400) {
+          throw new RouteError(502, "bad_gateway", "Shared bundle redirects are not allowed.");
+        }
+        if (!response.ok) {
+          const details = readErrorMessage(await response.text());
+          throw new RouteError(502, "bad_gateway", `Failed to fetch bundle (${response.status})${details ? `: ${details}` : ""}`);
+        }
+        return await response.json();
+      } catch (error) {
+        if (error instanceof RouteError) {
+          throw error;
+        }
+        throw new RouteError(502, "bad_gateway", `Failed to fetch bundle: ${error instanceof Error ? error.message : String(error)}`);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/registry-service.ts b/apps/server-v2/src/services/registry-service.ts
new file mode 100644
index 0000000000..6cb9f58b6d
--- /dev/null
+++ b/apps/server-v2/src/services/registry-service.ts
@@ -0,0 +1,283 @@
+import path from "node:path";
+import {
+  createInternalWorkspaceId,
+  createLocalWorkspaceId,
+  createRemoteWorkspaceId,
+  createServerId,
+  deriveWorkspaceSlugSource,
+} from "../database/identifiers.js";
+import type { ServerRepositories } from "../database/repositories.js";
+import { ensureWorkspaceConfigDir, type ServerWorkingDirectory } from "../database/working-directory.js";
+import type {
+  BackendKind,
+  HostingKind,
+  JsonObject,
+  ServerRecord,
+  WorkspaceKind,
+  WorkspaceRecord,
+} from "../database/types.js";
+
+export type LegacyRemoteWorkspaceInput = {
+  baseUrl: string;
+  displayName: string;
+  directory?: string | null;
+  legacyNotes: JsonObject;
+  remoteType: "openwork" | "opencode";
+  remoteWorkspaceId?: string | null;
+  serverAuth?: JsonObject | null;
+  serverBaseUrl: string;
+  serverHostingKind: HostingKind;
+  serverLabel: string;
+  workspaceStatus?: WorkspaceRecord["status"];
+};
+
+export type LegacyLocalWorkspaceInput = {
+  dataDir: string;
+  displayName: string;
+  kind?: Extract<WorkspaceKind, "control" | "help" | "local">;
+  legacyNotes?: JsonObject | null;
+  opencodeProjectId?: string | null;
+  status?: WorkspaceRecord["status"];
+};
+
+type EnsureLocalServerInput = {
+  baseUrl?: string | null;
+  capabilities?: JsonObject;
+  hostingKind: HostingKind;
+  label: string;
+  notes?: JsonObject | null;
+};
+
+function mergeJson(base: JsonObject | null | undefined, next: JsonObject | null | undefined) {
+  if (!base && !next) {
+    return null;
+  }
+
+  return {
+    ...(base ?? {}),
+    ...(next ?? {}),
+  };
+}
+
+function resolveSlug(repositories: ServerRepositories, workspaceId: string, baseSlug: string) {
+  let suffix = 1;
+  let candidate = baseSlug;
+  while (repositories.workspaces.findSlugConflict(candidate, workspaceId)) {
+    suffix += 1;
+    candidate = `${baseSlug}-${suffix}`;
+  }
+  return candidate;
+}
+
+export function createRegistryService(input: {
+  localServerCapabilities: JsonObject;
+  repositories: ServerRepositories;
+  workingDirectory: ServerWorkingDirectory;
+}) {
+  const localServerId = createServerId("local", "primary");
+  const { repositories } = input;
+
+  function upsertWorkspace(inputWorkspace: Omit<WorkspaceRecord, "createdAt" | "updatedAt" | "slug">) {
+    const slugBase = deriveWorkspaceSlugSource({
+      dataDir: inputWorkspace.dataDir,
+      displayName: inputWorkspace.displayName,
+      fallback: inputWorkspace.kind,
+    });
+    const slug = resolveSlug(repositories, inputWorkspace.id, slugBase);
+    return repositories.workspaces.upsert({
+      ...inputWorkspace,
+      slug,
+    });
+  }
+
+  return {
+    attachLocalServerBaseUrl(baseUrl: string) {
+      const existing = input.repositories.servers.getById(localServerId);
+      if (!existing) {
+        return this.ensureLocalServer({
+          baseUrl,
+          hostingKind: "self_hosted",
+          label: "Local OpenWork Server",
+        });
+      }
+
+      return input.repositories.servers.upsert({
+        ...existing,
+        baseUrl,
+        capabilities: existing.capabilities,
+      });
+    },
+
+    ensureLocalServer(server: EnsureLocalServerInput): { created: boolean; server: ServerRecord } {
+      const existing = input.repositories.servers.getById(localServerId);
+      const next = input.repositories.servers.upsert({
+        auth: existing?.auth ?? null,
+        baseUrl: server.baseUrl ?? existing?.baseUrl ?? null,
+        capabilities: {
+          ...input.localServerCapabilities,
+          ...(existing?.capabilities ?? {}),
+          ...(server.capabilities ?? {}),
+        },
+        hostingKind: server.hostingKind,
+        id: localServerId,
+        isEnabled: true,
+        isLocal: true,
+        kind: "local",
+        label: server.label,
+        lastSeenAt: new Date().toISOString(),
+        notes: mergeJson(existing?.notes, server.notes),
+        source: existing?.source ?? "seeded",
+      });
+
+      return {
+        created: !existing,
+        server: next,
+      };
+    },
+
+    ensureHiddenWorkspace(kind: "control" | "help") {
+      const workspaceId = createInternalWorkspaceId(kind);
+      const displayName = kind === "control" ? "Control Workspace" : "Help Workspace";
+      const workspace = upsertWorkspace({
+        configDir: ensureWorkspaceConfigDir(input.workingDirectory, workspaceId),
+        dataDir: null,
+        displayName,
+        id: workspaceId,
+        isHidden: true,
+        kind,
+        notes: {
+          internal: true,
+          seededBy: "server-v2-phase-2",
+        },
+        opencodeProjectId: null,
+        remoteWorkspaceId: null,
+        serverId: localServerId,
+        status: "ready",
+      });
+
+      const backendKind: BackendKind = "local_opencode";
+      input.repositories.workspaceRuntimeState.upsert({
+        backendKind,
+        health: {
+          hidden: true,
+          internalWorkspace: kind,
+        },
+        lastError: null,
+        lastSessionRefreshAt: null,
+        lastSyncAt: null,
+        workspaceId: workspace.id,
+      });
+
+      return workspace;
+    },
+
+    importLocalWorkspace(workspace: LegacyLocalWorkspaceInput) {
+      const workspaceKind = workspace.kind ?? "local";
+      const workspaceId = workspaceKind === "local" ? createLocalWorkspaceId(workspace.dataDir) : createInternalWorkspaceId(workspaceKind);
+      const configDir = ensureWorkspaceConfigDir(input.workingDirectory, workspaceId);
+      const record = upsertWorkspace({
+        configDir,
+        dataDir: workspace.dataDir,
+        displayName: workspace.displayName || path.basename(workspace.dataDir),
+        id: workspaceId,
+        isHidden: workspaceKind !== "local",
+        kind: workspaceKind,
+        notes: mergeJson(workspace.legacyNotes ?? null, {
+          importSource: "desktop_or_orchestrator",
+          workspaceKind,
+        }),
+        opencodeProjectId: workspace.opencodeProjectId ?? null,
+        remoteWorkspaceId: null,
+        serverId: localServerId,
+        status: workspace.status ?? "imported",
+      });
+
+      input.repositories.workspaceRuntimeState.upsert({
+        backendKind: "local_opencode",
+        health: {
+          configDir,
+          imported: true,
+        },
+        lastError: null,
+        lastSessionRefreshAt: null,
+        lastSyncAt: null,
+        workspaceId: record.id,
+      });
+
+      return record;
+    },
+
+    importRemoteWorkspace(workspace: LegacyRemoteWorkspaceInput) {
+      const serverId = createServerId("remote", workspace.serverBaseUrl);
+      const existingServer = input.repositories.servers.getById(serverId);
+      input.repositories.servers.upsert({
+        auth: workspace.serverAuth ?? existingServer?.auth ?? null,
+        baseUrl: workspace.serverBaseUrl,
+        capabilities: mergeJson(existingServer?.capabilities ?? {}, {
+          legacyRemoteType: workspace.remoteType,
+          phase: 2,
+          source: "desktop-import",
+        }) ?? {},
+        hostingKind: workspace.serverHostingKind,
+        id: serverId,
+        isEnabled: true,
+        isLocal: false,
+        kind: "remote",
+        label: workspace.serverLabel,
+        lastSeenAt: existingServer?.lastSeenAt ?? null,
+        notes: mergeJson(existingServer?.notes, workspace.legacyNotes),
+        source: existingServer?.source ?? "imported",
+      });
+
+      const workspaceId = createRemoteWorkspaceId({
+        baseUrl: workspace.serverBaseUrl,
+        directory: workspace.directory,
+        remoteType: workspace.remoteType,
+        remoteWorkspaceId: workspace.remoteWorkspaceId,
+      });
+      const record = upsertWorkspace({
+        configDir: null,
+        dataDir: null,
+        displayName: workspace.displayName,
+        id: workspaceId,
+        isHidden: false,
+        kind: "remote",
+        notes: mergeJson(workspace.legacyNotes, {
+          directory: workspace.directory ?? null,
+          remoteType: workspace.remoteType,
+        }),
+        opencodeProjectId: null,
+        remoteWorkspaceId: workspace.remoteWorkspaceId ?? null,
+        serverId,
+        status: workspace.workspaceStatus ?? "imported",
+      });
+
+      input.repositories.workspaceRuntimeState.upsert({
+        backendKind: "remote_openwork",
+        health: {
+          imported: true,
+          remoteServerId: serverId,
+        },
+        lastError: null,
+        lastSessionRefreshAt: null,
+        lastSyncAt: null,
+        workspaceId: record.id,
+      });
+
+      return record;
+    },
+
+    listServers() {
+      return input.repositories.servers.list();
+    },
+
+    listWorkspaces(includeHidden = false) {
+      return input.repositories.workspaces.list({ includeHidden });
+    },
+
+    localServerId,
+  };
+}
+
+type RegistryService = ReturnType<typeof createRegistryService>;
+export type { RegistryService };
diff --git a/apps/server-v2/src/services/remote-server-service.ts b/apps/server-v2/src/services/remote-server-service.ts
new file mode 100644
index 0000000000..a62d45fb0b
--- /dev/null
+++ b/apps/server-v2/src/services/remote-server-service.ts
@@ -0,0 +1,285 @@
+import { HTTPException } from "hono/http-exception";
+import { requestRemoteOpenwork } from "../adapters/remote-openwork.js";
+import { createRemoteWorkspaceId, createServerId } from "../database/identifiers.js";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { HostingKind, JsonObject, ServerRecord, WorkspaceRecord } from "../database/types.js";
+
+type RemoteWorkspaceSnapshot = {
+  directory: string | null;
+  displayName: string;
+  remoteWorkspaceId: string;
+};
+
+function normalizeUrl(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error("baseUrl is required.");
+  }
+  const withProtocol = /^https?:\/\//.test(trimmed) ? trimmed : `http://${trimmed}`;
+  const url = new URL(withProtocol);
+  return url.toString().replace(/\/+$/, "");
+}
+
+function stripWorkspaceMount(value: string) {
+  const url = new URL(normalizeUrl(value));
+  const segments = url.pathname.split("/").filter(Boolean);
+  const last = segments[segments.length - 1] ?? "";
+  const prev = segments[segments.length - 2] ?? "";
+  if (prev === "w" && last) {
+    url.pathname = `/${segments.slice(0, -2).join("/")}`;
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+function detectRemoteHostingKind(value: string): HostingKind {
+  const hostname = new URL(value).hostname.toLowerCase();
+  if (
+    hostname === "app.openworklabs.com"
+    || hostname === "app.openwork.software"
+    || hostname.endsWith(".openworklabs.com")
+    || hostname.endsWith(".openwork.software")
+  ) {
+    return "cloud";
+  }
+  return "self_hosted";
+}
+
+function asObject(value: unknown) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+function pickString(record: Record<string, unknown>, keys: string[]) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return null;
+}
+
+function normalizeRemoteWorkspaceItems(payload: unknown): RemoteWorkspaceSnapshot[] {
+  const record = asObject(payload);
+  const items = Array.isArray(record.items) ? record.items : [];
+  return items.flatMap((entry) => {
+    const item = asObject(entry);
+    const backend = asObject(item.backend);
+    const local = asObject(backend.local);
+    const remote = asObject(backend.remote);
+    const remoteWorkspaceId = pickString(item, ["id"]);
+    if (!remoteWorkspaceId) {
+      return [];
+    }
+    const displayName = pickString(item, ["displayName", "name"]) ?? remoteWorkspaceId;
+    const directory = pickString(local, ["dataDir", "directory"])
+      ?? pickString(remote, ["directory"])
+      ?? pickString(item, ["path", "directory"]);
+    return [{
+      directory,
+      displayName,
+      remoteWorkspaceId,
+    } satisfies RemoteWorkspaceSnapshot];
+  });
+}
+
+export type RemoteServerService = ReturnType<typeof createRemoteServerService>;
+
+export function createRemoteServerService(input: {
+  repositories: ServerRepositories;
+}) {
+  function buildServerRecord(payload: {
+    baseUrl: string;
+    hostToken?: string | null;
+    label?: string | null;
+    token?: string | null;
+  }) {
+    const baseUrl = stripWorkspaceMount(payload.baseUrl);
+    const serverId = createServerId("remote", baseUrl);
+    const existing = input.repositories.servers.getById(serverId);
+    const auth: JsonObject = {
+      ...(existing?.auth ?? {}),
+      ...(payload.token?.trim() ? { openworkToken: payload.token.trim(), openworkClientToken: payload.token.trim() } : {}),
+      ...(payload.hostToken?.trim() ? { openworkHostToken: payload.hostToken.trim() } : {}),
+    };
+    const label = payload.label?.trim() || existing?.label || new URL(baseUrl).host;
+    const server = input.repositories.servers.upsert({
+      auth: Object.keys(auth).length > 0 ? auth : existing?.auth ?? null,
+      baseUrl,
+      capabilities: {
+        ...(existing?.capabilities ?? {}),
+        phase: 9,
+        remoteWorkspaceDiscovery: true,
+        remoteWorkspaceRouting: true,
+      },
+      hostingKind: existing?.hostingKind ?? detectRemoteHostingKind(baseUrl),
+      id: serverId,
+      isEnabled: true,
+      isLocal: false,
+      kind: "remote",
+      label,
+      lastSeenAt: new Date().toISOString(),
+      notes: {
+        ...(existing?.notes ?? {}),
+        connectedVia: "server-v2-phase9",
+      },
+      source: existing?.source ?? "connected",
+    });
+    return server;
+  }
+
+  async function fetchRemoteWorkspaces(server: ServerRecord) {
+    const response = await requestRemoteOpenwork<unknown>({
+      path: "/workspaces",
+      server,
+      timeoutMs: 10_000,
+    });
+    return normalizeRemoteWorkspaceItems(response);
+  }
+
+  function updateWorkspaceRuntime(workspace: WorkspaceRecord, details: Record<string, unknown>) {
+    const current = input.repositories.workspaceRuntimeState.getByWorkspaceId(workspace.id);
+    input.repositories.workspaceRuntimeState.upsert({
+      backendKind: "remote_openwork",
+      health: {
+        ...(current?.health ?? {}),
+        ...details,
+      },
+      lastError: null,
+      lastSessionRefreshAt: current?.lastSessionRefreshAt ?? null,
+      lastSyncAt: new Date().toISOString(),
+      workspaceId: workspace.id,
+    });
+  }
+
+  function markMissingWorkspace(workspace: WorkspaceRecord) {
+    input.repositories.workspaces.upsert({
+      ...workspace,
+      notes: {
+        ...(workspace.notes ?? {}),
+        sync: {
+          missing: true,
+          recordedAt: new Date().toISOString(),
+        },
+      },
+      status: "attention",
+    });
+    const current = input.repositories.workspaceRuntimeState.getByWorkspaceId(workspace.id);
+    input.repositories.workspaceRuntimeState.upsert({
+      backendKind: "remote_openwork",
+      health: current?.health ?? null,
+      lastError: {
+        code: "not_found",
+        message: "Remote workspace was not returned during the latest sync.",
+        recordedAt: new Date().toISOString(),
+      },
+      lastSessionRefreshAt: current?.lastSessionRefreshAt ?? null,
+      lastSyncAt: new Date().toISOString(),
+      workspaceId: workspace.id,
+    });
+  }
+
+  function syncRemoteWorkspaceRecords(server: ServerRecord, discovered: RemoteWorkspaceSnapshot[], hints?: { directory?: string | null; workspaceId?: string | null }) {
+    const existing = input.repositories.workspaces.listByServerId(server.id, { includeHidden: true }).filter((workspace) => workspace.kind === "remote");
+    const seenWorkspaceIds = new Set<string>();
+    const synced: WorkspaceRecord[] = [];
+
+    for (const remoteWorkspace of discovered) {
+      const workspaceId = createRemoteWorkspaceId({
+        baseUrl: server.baseUrl ?? "",
+        remoteType: "openwork",
+        remoteWorkspaceId: remoteWorkspace.remoteWorkspaceId,
+      });
+      seenWorkspaceIds.add(workspaceId);
+      const previous = input.repositories.workspaces.getById(workspaceId);
+      const workspace = input.repositories.workspaces.upsert({
+        configDir: null,
+        dataDir: null,
+        displayName: remoteWorkspace.displayName,
+        id: workspaceId,
+        isHidden: false,
+        kind: "remote",
+        notes: {
+          ...(previous?.notes ?? {}),
+          directory: remoteWorkspace.directory,
+          remoteType: "openwork",
+          sync: {
+            directoryHint: hints?.directory?.trim() || null,
+            syncedAt: new Date().toISOString(),
+          },
+        },
+        opencodeProjectId: null,
+        remoteWorkspaceId: remoteWorkspace.remoteWorkspaceId,
+        serverId: server.id,
+        slug: previous?.slug ?? workspaceId,
+        status: "ready",
+      });
+      synced.push(workspace);
+      updateWorkspaceRuntime(workspace, {
+        remoteServerId: server.id,
+        remoteWorkspaceId: remoteWorkspace.remoteWorkspaceId,
+      });
+    }
+
+    for (const workspace of existing) {
+      if (!seenWorkspaceIds.has(workspace.id)) {
+        markMissingWorkspace(workspace);
+      }
+    }
+
+    const requestedWorkspaceId = hints?.workspaceId?.trim();
+    const requestedDirectory = hints?.directory?.trim();
+    const selected = synced.find((workspace) => workspace.remoteWorkspaceId === requestedWorkspaceId)
+      ?? synced.find((workspace) => typeof workspace.notes?.directory === "string" && requestedDirectory && workspace.notes.directory === requestedDirectory)
+      ?? synced[0]
+      ?? null;
+
+    return {
+      selectedWorkspaceId: selected?.id ?? null,
+      workspaces: synced,
+    };
+  }
+
+  return {
+    async connect(inputValue: {
+      baseUrl: string;
+      directory?: string | null;
+      hostToken?: string | null;
+      label?: string | null;
+      token?: string | null;
+      workspaceId?: string | null;
+    }) {
+      const server = buildServerRecord(inputValue);
+      const discovered = await fetchRemoteWorkspaces(server);
+      if (discovered.length === 0) {
+        throw new HTTPException(404, { message: "Remote OpenWork server did not return any visible workspaces." });
+      }
+      const result = syncRemoteWorkspaceRecords(server, discovered, {
+        directory: inputValue.directory,
+        workspaceId: inputValue.workspaceId,
+      });
+      return {
+        selectedWorkspaceId: result.selectedWorkspaceId,
+        server,
+        workspaces: result.workspaces,
+      };
+    },
+
+    async sync(serverId: string, hints?: { directory?: string | null; workspaceId?: string | null }) {
+      const server = input.repositories.servers.getById(serverId);
+      if (!server || server.kind !== "remote") {
+        throw new HTTPException(404, { message: `Remote server not found: ${serverId}` });
+      }
+      const discovered = await fetchRemoteWorkspaces(server);
+      const result = syncRemoteWorkspaceRecords(server, discovered, hints);
+      input.repositories.servers.upsert({
+        ...server,
+        lastSeenAt: new Date().toISOString(),
+      });
+      return {
+        selectedWorkspaceId: result.selectedWorkspaceId,
+        server: input.repositories.servers.getById(server.id)!,
+        workspaces: result.workspaces,
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/router-product-service.ts b/apps/server-v2/src/services/router-product-service.ts
new file mode 100644
index 0000000000..01328d69e1
--- /dev/null
+++ b/apps/server-v2/src/services/router-product-service.ts
@@ -0,0 +1,408 @@
+import { createHash, randomUUID } from "node:crypto";
+import { HTTPException } from "hono/http-exception";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { JsonObject, RouterBindingRecord, RouterIdentityRecord } from "../database/types.js";
+import type { RuntimeService } from "./runtime-service.js";
+import { RouteError } from "../http.js";
+
+function asObject(value: unknown): JsonObject {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...(value as JsonObject) } : {};
+}
+
+function normalizeString(value: unknown) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+async function fetchTelegramBotInfo(token: string) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return null as { id: number; name?: string; username?: string } | null;
+  }
+  try {
+    const response = await fetch(`https://api.telegram.org/bot${trimmed}/getMe`, {
+      headers: { Accept: "application/json" },
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const json = await response.json().catch(() => null) as Record<string, unknown> | null;
+    const result = asObject(json?.result);
+    const id = Number(result.id);
+    if (!Number.isFinite(id)) {
+      return null;
+    }
+    return {
+      id,
+      name: typeof result.first_name === "string" ? result.first_name : undefined,
+      username: typeof result.username === "string" ? result.username : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function createPairingCode() {
+  return Math.random().toString(36).slice(2, 8).toUpperCase();
+}
+
+function pairingCodeHash(value: string) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export type RouterProductService = ReturnType<typeof createRouterProductService>;
+
+export function createRouterProductService(input: {
+  repositories: ServerRepositories;
+  runtime: RuntimeService;
+  serverId: string;
+}) {
+  function getIdentityOrThrow(identityId: string) {
+    const identity = input.repositories.routerIdentities.getById(identityId);
+    if (!identity || identity.serverId !== input.serverId) {
+      throw new HTTPException(404, { message: `Router identity not found: ${identityId}` });
+    }
+    return identity;
+  }
+
+  function getBindingOrThrow(bindingId: string) {
+    const binding = input.repositories.routerBindings.getById(bindingId);
+    if (!binding || binding.serverId !== input.serverId) {
+      throw new HTTPException(404, { message: `Router binding not found: ${bindingId}` });
+    }
+    return binding;
+  }
+
+  function listIdentities(kind?: "slack" | "telegram") {
+    return input.repositories.routerIdentities.listByServer(input.serverId).filter((identity) => !kind || identity.kind === kind);
+  }
+
+  function listBindings(filters?: { channel?: string; identityId?: string }) {
+    const identitiesById = new Map(listIdentities().map((identity) => [identity.id, identity] as const));
+    return input.repositories.routerBindings.listByServer(input.serverId)
+      .filter((binding) => {
+        const identity = identitiesById.get(binding.routerIdentityId);
+        if (!identity) {
+          return false;
+        }
+        if (filters?.identityId?.trim() && binding.routerIdentityId !== filters.identityId.trim()) {
+          return false;
+        }
+        if (filters?.channel?.trim() && identity.kind !== filters.channel.trim()) {
+          return false;
+        }
+        return true;
+      })
+      .map((binding) => ({
+        channel: identitiesById.get(binding.routerIdentityId)?.kind ?? "unknown",
+        directory: normalizeString(asObject(binding.config).directory) || normalizeString(asObject(binding.config).workspacePath),
+        identityId: binding.routerIdentityId,
+        peerId: binding.bindingKey,
+        updatedAt: Date.parse(binding.updatedAt) || undefined,
+      }));
+  }
+
+  async function apply() {
+    const health = await input.runtime.applyRouterConfig();
+    return {
+      applied: health.status === "running" || health.status === "disabled",
+      applyError: health.status === "error" ? health.lastError ?? "Router apply failed." : undefined,
+      applyStatus: health.status === "error" ? 502 : undefined,
+      health,
+      ok: true,
+    };
+  }
+
+  function buildHealthSnapshot() {
+    const runtimeHealth = input.runtime.getRouterHealth();
+    const telegram = listIdentities("telegram").filter((identity) => identity.isEnabled);
+    const slack = listIdentities("slack").filter((identity) => identity.isEnabled);
+    return {
+      config: {
+        groupsEnabled: false,
+      },
+      channels: {
+        slack: slack.length > 0,
+        telegram: telegram.length > 0,
+        whatsapp: false,
+      },
+      ok: runtimeHealth.status === "running" || runtimeHealth.status === "disabled",
+      opencode: {
+        healthy: runtimeHealth.status === "running",
+        url: runtimeHealth.baseUrl ?? runtimeHealth.healthUrl ?? "",
+        version: runtimeHealth.version ?? undefined,
+      },
+    };
+  }
+
+  function buildIdentityItem(identity: RouterIdentityRecord) {
+    const config = asObject(identity.config);
+    return {
+      access: typeof config.access === "string" && (config.access === "private" || config.access === "public") ? config.access : undefined,
+      enabled: identity.isEnabled,
+      id: identity.id,
+      pairingRequired: config.access === "private" || undefined,
+      running: input.runtime.getRouterHealth().status === "running",
+    };
+  }
+
+  function resolveIdentityForChannel(channel: "slack" | "telegram", identityId?: string) {
+    if (identityId?.trim()) {
+      const identity = getIdentityOrThrow(identityId.trim());
+      if (identity.kind !== channel) {
+        throw new RouteError(400, "invalid_request", `Identity ${identityId} is not a ${channel} identity.`);
+      }
+      return identity;
+    }
+    const fallback = listIdentities(channel).find((identity) => identity.isEnabled) ?? listIdentities(channel)[0] ?? null;
+    if (!fallback) {
+      throw new RouteError(400, "invalid_request", `No ${channel} identity is configured.`);
+    }
+    return fallback;
+  }
+
+  async function proxyRouter<T>(pathname: string, init?: { body?: unknown; method?: string }) {
+    const health = input.runtime.getRouterHealth();
+    if (!health.baseUrl || health.status !== "running") {
+      throw new RouteError(503, "service_unavailable", "Router is not running.");
+    }
+    const response = await fetch(`${health.baseUrl.replace(/\/+$/, "")}${pathname}`, {
+      body: init?.body === undefined ? undefined : JSON.stringify(init.body),
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      method: init?.method ?? "GET",
+    });
+    const text = await response.text();
+    const json = text ? JSON.parse(text) : null;
+    if (!response.ok) {
+      throw new RouteError(response.status, "bad_gateway", typeof json?.error === "string" ? json.error : `Router request failed (${response.status}).`);
+    }
+    return json as T;
+  }
+
+  return {
+    async apply() {
+      return apply();
+    },
+
+    async deleteSlackIdentity(identityId: string) {
+      const identity = getIdentityOrThrow(identityId);
+      if (identity.kind !== "slack") {
+        throw new RouteError(400, "invalid_request", "Router identity is not a Slack identity.");
+      }
+      input.repositories.routerIdentities.deleteById(identityId);
+      const applied = await apply();
+      return {
+        ...applied,
+        slack: {
+          deleted: true,
+          id: identityId,
+        },
+      };
+    },
+
+    async deleteTelegramIdentity(identityId: string) {
+      const identity = getIdentityOrThrow(identityId);
+      if (identity.kind !== "telegram") {
+        throw new RouteError(400, "invalid_request", "Router identity is not a Telegram identity.");
+      }
+      input.repositories.routerIdentities.deleteById(identityId);
+      const applied = await apply();
+      return {
+        ...applied,
+        telegram: {
+          deleted: true,
+          id: identityId,
+        },
+      };
+    },
+
+    getHealth() {
+      return buildHealthSnapshot();
+    },
+
+    async getTelegramInfo() {
+      const identity = listIdentities("telegram")[0] ?? null;
+      if (!identity) {
+        return { bot: null, configured: false, enabled: false, ok: true };
+      }
+      const token = normalizeString(asObject(identity.auth).token) || normalizeString(asObject(identity.config).token);
+      return {
+        bot: await fetchTelegramBotInfo(token),
+        configured: Boolean(token),
+        enabled: identity.isEnabled,
+        ok: true,
+      };
+    },
+
+    listBindings(filters?: { channel?: string; identityId?: string }) {
+      return { items: listBindings(filters), ok: true };
+    },
+
+    listRouterBindings() {
+      return input.repositories.routerBindings.listByServer(input.serverId);
+    },
+
+    listRouterIdentities() {
+      return input.repositories.routerIdentities.listByServer(input.serverId);
+    },
+
+    listSlackIdentities() {
+      return { items: listIdentities("slack").map(buildIdentityItem), ok: true };
+    },
+
+    listTelegramIdentities() {
+      return { items: listIdentities("telegram").map(buildIdentityItem), ok: true };
+    },
+
+    async sendMessage(inputValue: {
+      autoBind?: boolean;
+      channel: "slack" | "telegram";
+      directory?: string;
+      identityId?: string;
+      peerId?: string;
+      text: string;
+    }) {
+      const payload = {
+        ...(inputValue.autoBind ? { autoBind: true } : {}),
+        channel: inputValue.channel,
+        ...(normalizeString(inputValue.directory) ? { directory: normalizeString(inputValue.directory) } : {}),
+        ...(normalizeString(inputValue.identityId) ? { identityId: normalizeString(inputValue.identityId) } : {}),
+        ...(normalizeString(inputValue.peerId) ? { peerId: normalizeString(inputValue.peerId) } : {}),
+        text: inputValue.text,
+      };
+      return await proxyRouter<Record<string, unknown>>("/send", { body: payload, method: "POST" });
+    },
+
+    async setBinding(inputValue: { channel: "slack" | "telegram"; directory: string; identityId?: string; peerId: string }) {
+      const identity = resolveIdentityForChannel(inputValue.channel, inputValue.identityId);
+      const existing = input.repositories.routerBindings.listByServer(input.serverId)
+        .find((binding) => binding.routerIdentityId === identity.id && binding.bindingKey === inputValue.peerId) ?? null;
+      input.repositories.routerBindings.upsert({
+        config: { directory: inputValue.directory },
+        bindingKey: inputValue.peerId,
+        id: existing?.id ?? `binding_${randomUUID()}`,
+        isEnabled: true,
+        routerIdentityId: identity.id,
+        serverId: input.serverId,
+      });
+      await apply();
+      return { ok: true };
+    },
+
+    async setSlackTokens(botToken: string, appToken: string) {
+      return this.upsertSlackIdentity({ appToken, botToken, enabled: true, id: "default" });
+    },
+
+    async setTelegramEnabled(enabled: boolean, options?: { clearToken?: boolean }) {
+      const identity = listIdentities("telegram")[0] ?? null;
+      if (!identity) {
+        throw new RouteError(404, "not_found", "Telegram identity is not configured.");
+      }
+      input.repositories.routerIdentities.upsert({
+        ...identity,
+        auth: options?.clearToken ? { ...identity.auth, token: null } : identity.auth,
+        isEnabled: enabled,
+      });
+      const applied = await apply();
+      return {
+        ...applied,
+        enabled,
+      };
+    },
+
+    async setTelegramToken(token: string) {
+      return this.upsertTelegramIdentity({ access: "public", enabled: true, id: "default", token });
+    },
+
+    async upsertRouterBinding(payload: Omit<RouterBindingRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+      const binding = input.repositories.routerBindings.upsert(payload);
+      await apply();
+      return binding;
+    },
+
+    async upsertRouterIdentity(payload: Omit<RouterIdentityRecord, "createdAt" | "updatedAt"> & { createdAt?: string; updatedAt?: string }) {
+      const identity = input.repositories.routerIdentities.upsert(payload);
+      await apply();
+      return identity;
+    },
+
+    async updateBinding(bindingId: string, payload: { config?: JsonObject; isEnabled?: boolean; routerIdentityId?: string }) {
+      const binding = getBindingOrThrow(bindingId);
+      return await this.upsertRouterBinding({
+        ...binding,
+        config: payload.config ?? binding.config,
+        isEnabled: payload.isEnabled ?? binding.isEnabled,
+        routerIdentityId: payload.routerIdentityId ?? binding.routerIdentityId,
+      });
+    },
+
+    async updateIdentity(identityId: string, payload: { auth?: JsonObject | null; config?: JsonObject; displayName?: string; isEnabled?: boolean }) {
+      const identity = getIdentityOrThrow(identityId);
+      return await this.upsertRouterIdentity({
+        ...identity,
+        auth: payload.auth ?? identity.auth,
+        config: payload.config ?? identity.config,
+        displayName: payload.displayName ?? identity.displayName,
+        isEnabled: payload.isEnabled ?? identity.isEnabled,
+      });
+    },
+
+    async upsertSlackIdentity(payload: { appToken: string; botToken: string; enabled?: boolean; id?: string }) {
+      const id = normalizeString(payload.id) || `router_slack_${randomUUID()}`;
+      input.repositories.routerIdentities.upsert({
+        auth: {
+          appToken: payload.appToken.trim(),
+          botToken: payload.botToken.trim(),
+        },
+        config: {},
+        displayName: id,
+        id,
+        isEnabled: payload.enabled !== false,
+        kind: "slack",
+        serverId: input.serverId,
+      });
+      const applied = await apply();
+      return {
+        ...applied,
+        slack: {
+          enabled: payload.enabled !== false,
+          id,
+        },
+      };
+    },
+
+    async upsertTelegramIdentity(payload: { access?: "private" | "public"; enabled?: boolean; id?: string; token: string }) {
+      const id = normalizeString(payload.id) || `router_telegram_${randomUUID()}`;
+      const pairingCode = payload.access === "private" ? createPairingCode() : null;
+      input.repositories.routerIdentities.upsert({
+        auth: {
+          token: payload.token.trim(),
+        },
+        config: {
+          ...(payload.access ? { access: payload.access } : {}),
+          ...(pairingCode ? { pairingCodeHash: pairingCodeHash(pairingCode) } : {}),
+        },
+        displayName: id,
+        id,
+        isEnabled: payload.enabled !== false,
+        kind: "telegram",
+        serverId: input.serverId,
+      });
+      const applied = await apply();
+      const bot = await fetchTelegramBotInfo(payload.token);
+      return {
+        ...applied,
+        telegram: {
+          access: payload.access,
+          ...(bot ? { bot } : {}),
+          enabled: payload.enabled !== false,
+          id,
+          ...(pairingCode ? { pairingCode, pairingRequired: true } : {}),
+        },
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/runtime-service.test.ts b/apps/server-v2/src/services/runtime-service.test.ts
new file mode 100644
index 0000000000..129ba84bde
--- /dev/null
+++ b/apps/server-v2/src/services/runtime-service.test.ts
@@ -0,0 +1,307 @@
+import { afterEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { createServerPersistence } from "../database/persistence.js";
+import { resolveRuntimeTarget, type RuntimeManifest } from "../runtime/manifest.js";
+import { createRuntimeService } from "./runtime-service.js";
+
+const cleanupPaths: string[] = [];
+
+afterEach(async () => {
+  while (cleanupPaths.length > 0) {
+    const target = cleanupPaths.pop();
+    if (!target) {
+      continue;
+    }
+    fs.rmSync(target, { force: true, recursive: true });
+  }
+});
+
+function makeTempDir(name: string) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), `${name}-`));
+  cleanupPaths.push(directory);
+  return directory;
+}
+
+async function sha256(filePath: string) {
+  const contents = await Bun.file(filePath).arrayBuffer();
+  return createHash("sha256").update(Buffer.from(contents)).digest("hex");
+}
+
+async function createFakeBinary(kind: "opencode" | "router", mode: string, exitAfterMs?: number) {
+  const wrapperDir = makeTempDir(`openwork-server-v2-${kind}`);
+  const binaryPath = path.join(wrapperDir, kind === "opencode" ? "opencode" : "opencode-router");
+  const fixturePath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "test-fixtures", "fake-runtime.ts");
+  const script = [
+    "#!/bin/sh",
+    `export FAKE_RUNTIME_KIND=${kind}`,
+    `export FAKE_RUNTIME_MODE=${mode}`,
+    ...(exitAfterMs ? [`export FAKE_RUNTIME_EXIT_AFTER_MS=${exitAfterMs}`] : []),
+    `exec ${JSON.stringify(process.execPath)} ${JSON.stringify(fixturePath)} \"$@\"`,
+    "",
+  ].join("\n");
+  fs.writeFileSync(binaryPath, script, "utf8");
+  fs.chmodSync(binaryPath, 0o755);
+  return binaryPath;
+}
+
+async function createFakeAssetService(opencodePath: string, routerPath: string) {
+  const target = resolveRuntimeTarget();
+  if (!target) {
+    throw new Error("Unsupported test target.");
+  }
+  const opencodeExists = fs.existsSync(opencodePath);
+  const opencodeStats = opencodeExists ? fs.statSync(opencodePath) : { size: 0 };
+  const routerStats = fs.statSync(routerPath);
+  const manifest: RuntimeManifest = {
+    files: {
+      opencode: {
+        path: path.basename(opencodePath),
+        sha256: opencodeExists ? await sha256(opencodePath) : "missing",
+        size: opencodeStats.size,
+      },
+      "opencode-router": {
+        path: path.basename(routerPath),
+        sha256: await sha256(routerPath),
+        size: routerStats.size,
+      },
+    },
+    generatedAt: new Date().toISOString(),
+    manifestVersion: 1,
+    opencodeVersion: "1.4.9",
+    rootDir: path.dirname(opencodePath),
+    routerVersion: "0.11.206",
+    serverVersion: "0.0.0-test",
+    source: "development",
+    target,
+  };
+
+  const opencodeBinary = {
+    absolutePath: opencodePath,
+    name: "opencode" as const,
+    sha256: manifest.files.opencode.sha256,
+    size: manifest.files.opencode.size,
+    source: "development" as const,
+    stagedRoot: path.dirname(opencodePath),
+    target,
+    version: "1.4.9",
+  };
+  const routerBinary = {
+    absolutePath: routerPath,
+    name: "opencode-router" as const,
+    sha256: manifest.files["opencode-router"].sha256,
+    size: manifest.files["opencode-router"].size,
+    source: "development" as const,
+    stagedRoot: path.dirname(routerPath),
+    target,
+    version: "0.11.206",
+  };
+
+  return {
+    ensureOpencodeBinary: async () => opencodeBinary,
+    ensureRouterBinary: async () => routerBinary,
+    getDevelopmentRoot: () => path.dirname(opencodePath),
+    getPinnedOpencodeVersion: async () => "1.4.9",
+    getReleaseRoot: () => path.dirname(opencodePath),
+    getRouterVersion: async () => "0.11.206",
+    getSource: () => "development" as const,
+    getTarget: () => target,
+    resolveRuntimeBundle: async () => ({
+      manifest,
+      opencode: opencodeBinary,
+      router: routerBinary,
+    }),
+  };
+}
+
+function createPersistence() {
+  const workingDirectory = makeTempDir("openwork-server-v2-runtime-service");
+  return createServerPersistence({
+    environment: "test",
+    localServer: {
+      baseUrl: null,
+      hostingKind: "self_hosted",
+      label: "Local OpenWork Server",
+    },
+    version: "0.0.0-test",
+    workingDirectory,
+  });
+}
+
+test("runtime bootstrap starts OpenCode successfully and persists health", async () => {
+  const persistence = createPersistence();
+  const opencodePath = await createFakeBinary("opencode", "success");
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(opencodePath, routerPath);
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await runtime.bootstrap();
+
+  const opencode = runtime.getOpencodeHealth();
+  expect(opencode.running).toBe(true);
+  expect(opencode.status).toBe("running");
+  expect(opencode.baseUrl).toContain("http://127.0.0.1:");
+  expect(persistence.repositories.serverRuntimeState.getByServerId(persistence.registry.localServerId)?.opencodeStatus).toBe("running");
+
+  await runtime.dispose();
+  persistence.close();
+});
+
+test("runtime bootstrap surfaces missing OpenCode binaries clearly", async () => {
+  const persistence = createPersistence();
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(path.join(os.tmpdir(), `does-not-exist-opencode-${Date.now()}`), routerPath);
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await expect(runtime.bootstrap()).rejects.toThrow("executable not found");
+  expect(runtime.getOpencodeHealth().status).toBe("error");
+
+  await runtime.dispose();
+  persistence.close();
+});
+
+test("runtime bootstrap surfaces OpenCode readiness timeouts", async () => {
+  const persistence = createPersistence();
+  const opencodePath = await createFakeBinary("opencode", "timeout");
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(opencodePath, routerPath);
+  process.env.OPENWORK_SERVER_V2_OPENCODE_START_TIMEOUT_MS = "300";
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await expect(runtime.bootstrap()).rejects.toThrow("did not become ready");
+  expect(runtime.getOpencodeHealth().status).toBe("error");
+  delete process.env.OPENWORK_SERVER_V2_OPENCODE_START_TIMEOUT_MS;
+
+  await runtime.dispose();
+  persistence.close();
+});
+
+test("runtime supervisor records post-ready OpenCode crashes", async () => {
+  const persistence = createPersistence();
+  const opencodePath = await createFakeBinary("opencode", "success", 150);
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(opencodePath, routerPath);
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await runtime.bootstrap();
+  await Bun.sleep(400);
+
+  expect(runtime.getOpencodeHealth().status).toBe("crashed");
+  expect(runtime.getOpencodeHealth().lastExit?.reason).toBe("unexpected_exit");
+
+  await runtime.dispose();
+  persistence.close();
+});
+
+test("runtime supervisor starts router when enabled and persists router state", async () => {
+  const persistence = createPersistence();
+  persistence.repositories.routerIdentities.upsert({
+    auth: { token: "telegram-token" },
+    config: {},
+    displayName: "Telegram Bot",
+    id: "router_identity_telegram",
+    isEnabled: true,
+    kind: "telegram",
+    serverId: persistence.registry.localServerId,
+  });
+  persistence.repositories.routerBindings.upsert({
+    bindingKey: "peer-1",
+    config: { directory: persistence.workingDirectory.rootDir },
+    id: "router_binding_one",
+    isEnabled: true,
+    routerIdentityId: "router_identity_telegram",
+    serverId: persistence.registry.localServerId,
+  });
+
+  const opencodePath = await createFakeBinary("opencode", "success");
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(opencodePath, routerPath);
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await runtime.bootstrap();
+
+  const router = runtime.getRouterHealth();
+  expect(router.enablement.enabled).toBe(true);
+  expect(router.running).toBe(true);
+  expect(router.status).toBe("running");
+  expect(router.materialization?.bindingCount).toBe(1);
+  expect(persistence.repositories.serverRuntimeState.getByServerId(persistence.registry.localServerId)?.routerStatus).toBe("running");
+
+  await runtime.dispose();
+  persistence.close();
+});
+
+test("runtime upgrade restarts managed children and records upgrade state", async () => {
+  const persistence = createPersistence();
+  const opencodePath = await createFakeBinary("opencode", "success");
+  const routerPath = await createFakeBinary("router", "success");
+  const assetService = await createFakeAssetService(opencodePath, routerPath);
+  const runtime = createRuntimeService({
+    assetService,
+    bootstrapPolicy: "manual",
+    environment: "test",
+    repositories: persistence.repositories,
+    restartPolicy: { backoffMs: 25, maxAttempts: 0, windowMs: 1000 },
+    serverId: persistence.registry.localServerId,
+    serverVersion: "0.0.0-test",
+    workingDirectory: persistence.workingDirectory,
+  });
+
+  await runtime.bootstrap();
+  const upgraded = await runtime.upgradeRuntime();
+
+  expect(upgraded.state.status).toBe("completed");
+  expect(upgraded.summary.opencode.running).toBe(true);
+  expect(upgraded.summary.upgrade.status).toBe("completed");
+
+  await runtime.dispose();
+  persistence.close();
+});
diff --git a/apps/server-v2/src/services/runtime-service.ts b/apps/server-v2/src/services/runtime-service.ts
new file mode 100644
index 0000000000..05e1807778
--- /dev/null
+++ b/apps/server-v2/src/services/runtime-service.ts
@@ -0,0 +1,1141 @@
+import fs from "node:fs";
+import net from "node:net";
+import path from "node:path";
+import { Database } from "bun:sqlite";
+import type { LocalOpencodeHandle, LocalProcessExit } from "../adapters/opencode/local.js";
+import { LocalOpencodeStartupError, createLocalOpencode } from "../adapters/opencode/local.js";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { ServerWorkingDirectory } from "../database/working-directory.js";
+import { createBoundedOutputCollector, formatRuntimeOutput, type RuntimeOutputSnapshot } from "../runtime/output-buffer.js";
+import type { ResolvedRuntimeBinary, RuntimeManifest } from "../runtime/manifest.js";
+import { createRuntimeAssetService, type RuntimeAssetService } from "../runtime/assets.js";
+
+type RuntimeBootstrapPolicy = "disabled" | "eager" | "manual";
+type RuntimeChildStatus = "crashed" | "disabled" | "error" | "restart_scheduled" | "running" | "starting" | "stopped";
+
+type RuntimeRestartPolicy = {
+  backoffMs: number;
+  maxAttempts: number;
+  windowMs: number;
+};
+
+type RuntimeLastExit = LocalProcessExit & {
+  output: RuntimeOutputSnapshot;
+  reason: string;
+};
+
+type RouterEnablementDecision = {
+  enabled: boolean;
+  enabledBindingCount: number;
+  enabledIdentityCount: number;
+  forced: boolean;
+  reason: string;
+};
+
+type RuntimeChildState = {
+  asset: ResolvedRuntimeBinary | null;
+  baseUrl: string | null;
+  healthUrl: string | null;
+  lastError: string | null;
+  lastExit: RuntimeLastExit | null;
+  lastReadyAt: string | null;
+  lastStartedAt: string | null;
+  pid: number | null;
+  recentOutput: RuntimeOutputSnapshot;
+  running: boolean;
+  status: RuntimeChildStatus;
+  version: string | null;
+};
+
+type RouterMaterialization = {
+  bindingCount: number;
+  configPath: string;
+  dataDir: string;
+  dbPath: string;
+  identityCount: number;
+  logFile: string;
+};
+
+type ManagedProcessHandle = {
+  close(): void;
+  getOutput(): RuntimeOutputSnapshot;
+  proc: Bun.Subprocess<"ignore", "pipe", "pipe">;
+  waitForExit(): Promise<LocalProcessExit>;
+};
+
+type RuntimeUpgradeState = {
+  error: string | null;
+  finishedAt: string | null;
+  startedAt: string | null;
+  status: "completed" | "failed" | "idle" | "running";
+};
+
+export type RuntimeService = {
+  applyRouterConfig(): Promise<ReturnType<RuntimeService["getRouterHealth"]>>;
+  bootstrap(): Promise<void>;
+  dispose(): Promise<void>;
+  getBootstrapPolicy(): RuntimeBootstrapPolicy;
+  getOpencodeHealth(): {
+    baseUrl: string | null;
+    binaryPath: string | null;
+    diagnostics: RuntimeOutputSnapshot;
+    lastError: string | null;
+    lastExit: RuntimeLastExit | null;
+    lastReadyAt: string | null;
+    lastStartedAt: string | null;
+    manifest: RuntimeManifest | null;
+    pid: number | null;
+    running: boolean;
+    source: "development" | "release";
+    status: RuntimeChildStatus;
+    version: string | null;
+  };
+  getRouterHealth(): {
+    baseUrl: string | null;
+    binaryPath: string | null;
+    diagnostics: RuntimeOutputSnapshot;
+    enablement: RouterEnablementDecision;
+    healthUrl: string | null;
+    lastError: string | null;
+    lastExit: RuntimeLastExit | null;
+    lastReadyAt: string | null;
+    lastStartedAt: string | null;
+    manifest: RuntimeManifest | null;
+    materialization: RouterMaterialization | null;
+    pid: number | null;
+    running: boolean;
+    source: "development" | "release";
+    status: RuntimeChildStatus;
+    version: string | null;
+  };
+  getRuntimeSummary(): {
+    bootstrapPolicy: RuntimeBootstrapPolicy;
+    manifest: RuntimeManifest | null;
+    opencode: ReturnType<RuntimeService["getOpencodeHealth"]>;
+    restartPolicy: RuntimeRestartPolicy;
+    router: ReturnType<RuntimeService["getRouterHealth"]>;
+    upgrade: RuntimeUpgradeState;
+    source: "development" | "release";
+    target: ReturnType<RuntimeAssetService["getTarget"]>;
+  };
+  getRuntimeVersions(): {
+    active: {
+      opencodeVersion: string | null;
+      routerVersion: string | null;
+      serverVersion: string;
+    };
+    manifest: RuntimeManifest | null;
+    pinned: {
+      opencodeVersion: string | null;
+      routerVersion: string | null;
+      serverVersion: string;
+    };
+    target: ReturnType<RuntimeAssetService["getTarget"]>;
+  };
+  getStateForPersistence(): ReturnType<RuntimeService["getRuntimeSummary"]>;
+  upgradeRuntime(): Promise<{ state: RuntimeUpgradeState; summary: ReturnType<RuntimeService["getRuntimeSummary"]> }>;
+};
+
+type CreateRuntimeServiceOptions = {
+  assetService?: RuntimeAssetService;
+  bootstrapPolicy?: RuntimeBootstrapPolicy;
+  environment: string;
+  repositories: ServerRepositories;
+  restartPolicy?: Partial<RuntimeRestartPolicy>;
+  serverId: string;
+  serverVersion: string;
+  workingDirectory: ServerWorkingDirectory;
+};
+
+function isTruthy(value: string | undefined) {
+  if (!value) {
+    return false;
+  }
+
+  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+
+function emptyOutput(): RuntimeOutputSnapshot {
+  return {
+    combined: [],
+    stderr: [],
+    stdout: [],
+    totalLines: 0,
+    truncated: false,
+  };
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function resolveBootstrapPolicy(environment: string, explicit?: RuntimeBootstrapPolicy): RuntimeBootstrapPolicy {
+  if (explicit) {
+    return explicit;
+  }
+
+  const fromEnv = process.env.OPENWORK_SERVER_V2_RUNTIME_BOOTSTRAP?.trim().toLowerCase();
+  if (fromEnv === "disabled" || fromEnv === "manual" || fromEnv === "eager") {
+    return fromEnv;
+  }
+
+  if (environment === "test") {
+    return "disabled";
+  }
+
+  return "eager";
+}
+
+function resolveRestartPolicy(overrides?: Partial<RuntimeRestartPolicy>): RuntimeRestartPolicy {
+  const maxAttempts = Number.parseInt(process.env.OPENWORK_SERVER_V2_RUNTIME_RESTART_MAX_ATTEMPTS ?? "2", 10);
+  const backoffMs = Number.parseInt(process.env.OPENWORK_SERVER_V2_RUNTIME_RESTART_BACKOFF_MS ?? "750", 10);
+  const windowMs = Number.parseInt(process.env.OPENWORK_SERVER_V2_RUNTIME_RESTART_WINDOW_MS ?? "30000", 10);
+
+  return {
+    backoffMs: overrides?.backoffMs ?? (Number.isFinite(backoffMs) ? backoffMs : 750),
+    maxAttempts: overrides?.maxAttempts ?? (Number.isFinite(maxAttempts) ? maxAttempts : 2),
+    windowMs: overrides?.windowMs ?? (Number.isFinite(windowMs) ? windowMs : 30_000),
+  };
+}
+
+function pickLatestExit(opencode: RuntimeChildState, router: RuntimeChildState) {
+  const exits = [
+    opencode.lastExit ? { component: "opencode" as const, ...opencode.lastExit } : null,
+    router.lastExit ? { component: "router" as const, ...router.lastExit } : null,
+  ].filter(Boolean) as Array<RuntimeLastExit & { component: "opencode" | "router" }>;
+  exits.sort((left, right) => right.at.localeCompare(left.at));
+  return exits[0] ?? null;
+}
+
+async function getFreePort() {
+  return new Promise<number>((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to allocate a free loopback port."));
+        return;
+      }
+
+      server.close((error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+
+        resolve(address.port);
+      });
+    });
+  });
+}
+
+async function waitForOpencodeHealthy(handle: LocalOpencodeHandle, timeoutMs = 5_000, pollMs = 200) {
+  const startedAt = Date.now();
+  let lastError = "OpenCode did not report healthy status yet.";
+
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const health = await handle.client.global.health();
+      const data = (health as { healthy?: boolean }).healthy;
+      if (data) {
+        return;
+      }
+      lastError = "OpenCode reported unhealthy state.";
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+
+    await Bun.sleep(pollMs);
+  }
+
+  throw new Error(lastError);
+}
+
+async function waitForHttpOk(url: string, timeoutMs = 10_000, pollMs = 250) {
+  const startedAt = Date.now();
+  let lastError = `Timed out waiting for ${url}`;
+
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(2_000) });
+      if (response.ok) {
+        return;
+      }
+      lastError = `HTTP ${response.status} from ${url}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+
+    await Bun.sleep(pollMs);
+  }
+
+  throw new Error(lastError);
+}
+
+async function spawnManagedBinary(
+  command: string[],
+  options: {
+    cwd: string;
+    env: Record<string, string | undefined>;
+    timeoutMs: number;
+    readinessUrl: string;
+  },
+) {
+  const output = createBoundedOutputCollector({ maxBytes: 16_384, maxLines: 200 });
+  const proc = Bun.spawn(command, {
+    cwd: options.cwd,
+    env: {
+      ...process.env,
+      ...options.env,
+    },
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe",
+  });
+
+  const waitForExit = async (): Promise<LocalProcessExit> => {
+    const code = await proc.exited;
+    return {
+      at: nowIso(),
+      code,
+      signal: "signalCode" in proc && typeof proc.signalCode === "string" ? proc.signalCode : null,
+    };
+  };
+
+  const pump = async (streamName: "stdout" | "stderr", stream: ReadableStream<Uint8Array> | null) => {
+    if (!stream) {
+      return;
+    }
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+          output.finish(streamName);
+          return;
+        }
+        output.pushChunk(streamName, decoder.decode(value, { stream: true }));
+      }
+    } finally {
+      output.finish(streamName);
+      reader.releaseLock();
+    }
+  };
+
+  void pump("stdout", proc.stdout);
+  void pump("stderr", proc.stderr);
+
+  try {
+    await waitForHttpOk(options.readinessUrl, options.timeoutMs, 200);
+  } catch (error) {
+    proc.kill();
+    const exit = await waitForExit().catch(() => ({ at: nowIso(), code: null, signal: null }));
+    const snapshot = output.snapshot();
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Router failed to become ready at ${options.readinessUrl}: ${detail}. Last exit: ${exit.code ?? "null"}.\nCollected output:\n${formatRuntimeOutput(snapshot)}`,
+    );
+  }
+
+  const handle: ManagedProcessHandle = {
+    close() {
+      proc.kill();
+    },
+    getOutput() {
+      return output.snapshot();
+    },
+    proc,
+    waitForExit,
+  };
+
+  return handle;
+}
+
+function ensureRouterStoreSchema(database: Database) {
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS sessions (
+      channel TEXT NOT NULL,
+      identity_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      directory TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (channel, identity_id, peer_id)
+    );
+    CREATE TABLE IF NOT EXISTS allowlist (
+      channel TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      PRIMARY KEY (channel, peer_id)
+    );
+    CREATE TABLE IF NOT EXISTS bindings (
+      channel TEXT NOT NULL,
+      identity_id TEXT NOT NULL,
+      peer_id TEXT NOT NULL,
+      directory TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (channel, identity_id, peer_id)
+    );
+    CREATE TABLE IF NOT EXISTS settings (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+  `);
+}
+
+function asRecord(value: unknown) {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : {};
+}
+
+function resolveDirectoryFromBindingConfig(config: unknown) {
+  const record = asRecord(config);
+  for (const key of ["directory", "dir", "path", "workspacePath"]) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return null;
+}
+
+function createInitialChildState(status: RuntimeChildStatus, version: string | null): RuntimeChildState {
+  return {
+    asset: null,
+    baseUrl: null,
+    healthUrl: null,
+    lastError: null,
+    lastExit: null,
+    lastReadyAt: null,
+    lastStartedAt: null,
+    pid: null,
+    recentOutput: emptyOutput(),
+    running: false,
+    status,
+    version,
+  };
+}
+
+export function createRuntimeService(options: CreateRuntimeServiceOptions): RuntimeService {
+  const bootstrapPolicy = resolveBootstrapPolicy(options.environment, options.bootstrapPolicy);
+  const restartPolicy = resolveRestartPolicy(options.restartPolicy);
+  const assetService = options.assetService ?? createRuntimeAssetService({
+    environment: options.environment,
+    serverVersion: options.serverVersion,
+    workingDirectory: options.workingDirectory,
+  });
+  const persisted = options.repositories.serverRuntimeState.getByServerId(options.serverId);
+  const startupDiagnostics = asRecord(asRecord(persisted?.health).startup);
+  const opencodeState = createInitialChildState(bootstrapPolicy === "disabled" ? "disabled" : "stopped", persisted?.opencodeVersion ?? null);
+  const routerState = createInitialChildState(persisted?.routerStatus === "running" ? "stopped" : "disabled", persisted?.routerVersion ?? null);
+
+  let runtimeManifest: RuntimeManifest | null = null;
+  let routerMaterialization: RouterMaterialization | null = null;
+  let bootstrapPromise: Promise<void> | null = null;
+  let shuttingDown = false;
+  let opencodeHandle: LocalOpencodeHandle | null = null;
+  let routerHandle: ManagedProcessHandle | null = null;
+  let opencodeStopping = false;
+  let routerStopping = false;
+  let routerEnablement: RouterEnablementDecision = {
+    enabled: false,
+    enabledBindingCount: 0,
+    enabledIdentityCount: 0,
+    forced: false,
+    reason: "router_not_evaluated",
+  };
+  let upgradeState: RuntimeUpgradeState = {
+    error: null,
+    finishedAt: null,
+    startedAt: null,
+    status: "idle",
+  };
+
+  const restartHistory = {
+    opencode: [] as number[],
+    router: [] as number[],
+  };
+  const restartTimers = {
+    opencode: null as ReturnType<typeof setTimeout> | null,
+    router: null as ReturnType<typeof setTimeout> | null,
+  };
+
+  const persistState = () => {
+    const health = {
+      startup: startupDiagnostics,
+      runtime: {
+        bootstrapPolicy,
+        manifest: runtimeManifest,
+        opencode: {
+          ...opencodeState,
+          binaryPath: opencodeState.asset?.absolutePath ?? null,
+        },
+        restartPolicy,
+        router: {
+          ...routerState,
+          binaryPath: routerState.asset?.absolutePath ?? null,
+          enablement: routerEnablement,
+          materialization: routerMaterialization,
+        },
+        target: assetService.getTarget(),
+        upgrade: upgradeState,
+      },
+    };
+    const latestExit = pickLatestExit(opencodeState, routerState);
+
+    options.repositories.serverRuntimeState.upsert({
+      health,
+      lastExit: latestExit,
+      lastStartedAt: [opencodeState.lastStartedAt, routerState.lastStartedAt].filter(Boolean).sort().reverse()[0] ?? null,
+      opencodeBaseUrl: opencodeState.baseUrl,
+      opencodeStatus: opencodeState.status,
+      opencodeVersion: opencodeState.version ?? runtimeManifest?.opencodeVersion ?? null,
+      restartPolicy: {
+        bootstrapPolicy,
+        ...restartPolicy,
+      },
+      routerStatus: routerState.status,
+      routerVersion: routerState.version ?? runtimeManifest?.routerVersion ?? null,
+      runtimeVersion: options.serverVersion,
+      serverId: options.serverId,
+    });
+  };
+
+  const withRestartRecord = (component: "opencode" | "router") => {
+    const now = Date.now();
+    const withinWindow = restartHistory[component].filter((value) => now - value <= restartPolicy.windowMs);
+    restartHistory[component] = withinWindow;
+    if (withinWindow.length >= restartPolicy.maxAttempts) {
+      return false;
+    }
+    restartHistory[component].push(now);
+    return true;
+  };
+
+  const clearRestartTimer = (component: "opencode" | "router") => {
+    const timer = restartTimers[component];
+    if (timer) {
+      clearTimeout(timer);
+      restartTimers[component] = null;
+    }
+  };
+
+  const resolveRouterEnablement = () => {
+    const identities = options.repositories.routerIdentities.listByServer(options.serverId);
+    const bindings = options.repositories.routerBindings.listByServer(options.serverId);
+    const enabledIdentityCount = identities.filter((identity) => identity.isEnabled).length;
+    const enabledBindingCount = bindings.filter((binding) => binding.isEnabled).length;
+    const forced = isTruthy(process.env.OPENWORK_SERVER_V2_ROUTER_FORCE) || isTruthy(process.env.OPENWORK_SERVER_V2_ROUTER_REQUIRED);
+
+    if (forced) {
+      return {
+        enabled: true,
+        enabledBindingCount,
+        enabledIdentityCount,
+        forced: true,
+        reason: "router_forced_by_environment",
+      } satisfies RouterEnablementDecision;
+    }
+
+    if (enabledIdentityCount > 0) {
+      return {
+        enabled: true,
+        enabledBindingCount,
+        enabledIdentityCount,
+        forced: false,
+        reason: "enabled_router_identities_present",
+      } satisfies RouterEnablementDecision;
+    }
+
+    if (enabledBindingCount > 0) {
+      return {
+        enabled: true,
+        enabledBindingCount,
+        enabledIdentityCount,
+        forced: false,
+        reason: "enabled_router_bindings_present",
+      } satisfies RouterEnablementDecision;
+    }
+
+    return {
+      enabled: false,
+      enabledBindingCount,
+      enabledIdentityCount,
+      forced: false,
+      reason: "no_enabled_router_identities_or_bindings",
+    } satisfies RouterEnablementDecision;
+  };
+
+  const materializeRouterConfig = () => {
+    const identities = options.repositories.routerIdentities.listByServer(options.serverId).filter((identity) => identity.isEnabled);
+    const bindings = options.repositories.routerBindings.listByServer(options.serverId).filter((binding) => binding.isEnabled);
+    const dataDir = path.join(options.workingDirectory.runtimeDir, "router");
+    const configPath = path.join(dataDir, "opencode-router.json");
+    const dbPath = path.join(dataDir, "opencode-router.db");
+    const logFile = path.join(dataDir, "logs", "opencode-router.log");
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.mkdirSync(path.dirname(logFile), { recursive: true });
+    const identityKindById = new Map(identities.map((identity) => [identity.id, identity.kind]));
+
+    const telegramBots = identities.filter((identity) => identity.kind === "telegram").flatMap((identity) => {
+      const auth = asRecord(identity.auth);
+      const config = asRecord(identity.config);
+      const token = typeof auth.token === "string" ? auth.token.trim() : typeof config.token === "string" ? config.token.trim() : "";
+      if (!token) {
+        return [];
+      }
+      return [{
+        access: typeof config.access === "string" ? config.access : "public",
+        directory: typeof config.directory === "string" ? config.directory.trim() : undefined,
+        enabled: true,
+        id: identity.id,
+        pairingCodeHash: typeof config.pairingCodeHash === "string" ? config.pairingCodeHash.trim() : undefined,
+        token,
+      }];
+    });
+    const slackApps = identities.filter((identity) => identity.kind === "slack").flatMap((identity) => {
+      const auth = asRecord(identity.auth);
+      const config = asRecord(identity.config);
+      const botToken = typeof auth.botToken === "string" ? auth.botToken.trim() : typeof config.botToken === "string" ? config.botToken.trim() : "";
+      const appToken = typeof auth.appToken === "string" ? auth.appToken.trim() : typeof config.appToken === "string" ? config.appToken.trim() : "";
+      if (!botToken || !appToken) {
+        return [];
+      }
+      return [{
+        appToken,
+        botToken,
+        directory: typeof config.directory === "string" ? config.directory.trim() : undefined,
+        enabled: true,
+        id: identity.id,
+      }];
+    });
+
+    const configPayload = {
+      channels: {
+        slack: {
+          apps: slackApps,
+          enabled: slackApps.length > 0,
+        },
+        telegram: {
+          bots: telegramBots,
+          enabled: telegramBots.length > 0,
+        },
+      },
+      groupsEnabled: false,
+      opencodeDirectory: options.workingDirectory.rootDir,
+      opencodeUrl: opencodeState.baseUrl ?? undefined,
+      version: 1,
+    };
+
+    fs.writeFileSync(configPath, `${JSON.stringify(configPayload, null, 2)}\n`, "utf8");
+
+    const database = new Database(dbPath, { create: true });
+    try {
+      ensureRouterStoreSchema(database);
+      database.query("DELETE FROM bindings").run();
+      const insert = database.query(
+        `INSERT OR REPLACE INTO bindings (channel, identity_id, peer_id, directory, created_at, updated_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6)`,
+      );
+      const now = Date.now();
+      let writtenBindings = 0;
+      for (const binding of bindings) {
+        const channel = identityKindById.get(binding.routerIdentityId);
+        const directory = resolveDirectoryFromBindingConfig(binding.config);
+        if ((channel !== "telegram" && channel !== "slack") || !directory) {
+          continue;
+        }
+        insert.run(channel, binding.routerIdentityId, binding.bindingKey, directory, now, now);
+        writtenBindings += 1;
+      }
+
+      routerMaterialization = {
+        bindingCount: writtenBindings,
+        configPath,
+        dataDir,
+        dbPath,
+        identityCount: telegramBots.length + slackApps.length,
+        logFile,
+      };
+    } finally {
+      database.close(false);
+    }
+  };
+
+  const updateRecentOutput = () => {
+    opencodeState.recentOutput = opencodeHandle?.server.getOutput() ?? opencodeState.recentOutput;
+    routerState.recentOutput = routerHandle?.getOutput() ?? routerState.recentOutput;
+  };
+
+  const stopRouter = async () => {
+    clearRestartTimer("router");
+    if (!routerHandle) {
+      routerState.running = false;
+      routerState.pid = null;
+      if (routerState.status !== "disabled") {
+        routerState.status = "stopped";
+      }
+      persistState();
+      return;
+    }
+
+    routerStopping = true;
+    const handle = routerHandle;
+    routerHandle = null;
+    handle.close();
+    await handle.waitForExit().catch(() => null);
+    routerState.running = false;
+    routerState.pid = null;
+    routerState.recentOutput = handle.getOutput();
+    routerState.status = routerEnablement.enabled ? "stopped" : "disabled";
+    persistState();
+    routerStopping = false;
+  };
+
+  const stopOpencode = async () => {
+    clearRestartTimer("opencode");
+    if (!opencodeHandle) {
+      opencodeState.running = false;
+      opencodeState.pid = null;
+      opencodeState.status = bootstrapPolicy === "disabled" ? "disabled" : "stopped";
+      persistState();
+      return;
+    }
+
+    opencodeStopping = true;
+    const handle = opencodeHandle;
+    opencodeHandle = null;
+    handle.server.close();
+    await handle.server.waitForExit().catch(() => null);
+    opencodeState.running = false;
+    opencodeState.pid = null;
+    opencodeState.recentOutput = handle.server.getOutput();
+    opencodeState.status = bootstrapPolicy === "disabled" ? "disabled" : "stopped";
+    persistState();
+    opencodeStopping = false;
+  };
+
+  const startRouter = async () => {
+    if (!routerEnablement.enabled) {
+      await stopRouter();
+      routerState.status = "disabled";
+      routerState.lastError = null;
+      persistState();
+      return;
+    }
+
+    if (routerHandle && routerState.running) {
+      return;
+    }
+
+    if (!runtimeManifest) {
+      return;
+    }
+
+    if (!opencodeState.running || !opencodeState.baseUrl) {
+      routerState.status = "error";
+      routerState.lastError = "Router cannot start until OpenCode is running.";
+      persistState();
+      return;
+    }
+
+    routerState.asset = await assetService.ensureRouterBinary();
+    routerState.version = routerState.asset.version;
+    routerState.status = "starting";
+    routerState.lastError = null;
+    routerState.lastStartedAt = nowIso();
+    materializeRouterConfig();
+    const healthPort = Number.parseInt(process.env.OPENWORK_SERVER_V2_ROUTER_HEALTH_PORT ?? "0", 10) || await getFreePort();
+    const healthUrl = `http://127.0.0.1:${healthPort}`;
+    routerState.healthUrl = healthUrl;
+    persistState();
+
+    try {
+      const handle = await spawnManagedBinary(
+        [
+          routerState.asset.absolutePath,
+          "serve",
+          options.workingDirectory.rootDir,
+          "--opencode-url",
+          opencodeState.baseUrl,
+        ],
+        {
+          cwd: options.workingDirectory.rootDir,
+          env: {
+            OPENCODE_DIRECTORY: options.workingDirectory.rootDir,
+            OPENCODE_ROUTER_CONFIG_PATH: routerMaterialization?.configPath,
+            OPENCODE_ROUTER_DATA_DIR: routerMaterialization?.dataDir,
+            OPENCODE_ROUTER_DB_PATH: routerMaterialization?.dbPath,
+            OPENCODE_ROUTER_HEALTH_PORT: String(healthPort),
+            OPENCODE_ROUTER_LOG_FILE: routerMaterialization?.logFile,
+            OPENCODE_URL: opencodeState.baseUrl,
+          },
+          readinessUrl: `${healthUrl}/health`,
+          timeoutMs: Number.parseInt(process.env.OPENWORK_SERVER_V2_ROUTER_START_TIMEOUT_MS ?? "10000", 10) || 10_000,
+        },
+      );
+      routerHandle = handle;
+      routerState.baseUrl = healthUrl;
+      routerState.lastReadyAt = nowIso();
+      routerState.pid = handle.proc.pid ?? null;
+      routerState.recentOutput = handle.getOutput();
+      routerState.running = true;
+      routerState.status = "running";
+      persistState();
+
+      void handle.waitForExit().then((exit) => {
+        if (routerHandle === handle) {
+          routerHandle = null;
+        }
+        routerState.running = false;
+        routerState.pid = null;
+        routerState.recentOutput = handle.getOutput();
+        routerState.lastExit = {
+          ...exit,
+          output: handle.getOutput(),
+          reason: routerStopping || shuttingDown ? "stopped" : "unexpected_exit",
+        };
+
+        if (routerStopping || shuttingDown) {
+          routerState.status = routerEnablement.enabled ? "stopped" : "disabled";
+          persistState();
+          return;
+        }
+
+        routerState.status = "crashed";
+        persistState();
+        if (!withRestartRecord("router")) {
+          routerState.lastError = "Router restart policy exhausted.";
+          persistState();
+          return;
+        }
+
+        routerState.status = "restart_scheduled";
+        persistState();
+        clearRestartTimer("router");
+        restartTimers.router = setTimeout(() => {
+          if (shuttingDown) {
+            return;
+          }
+          void startRouter().catch((error) => {
+            routerState.status = "error";
+            routerState.lastError = error instanceof Error ? error.message : String(error);
+            persistState();
+          });
+        }, restartPolicy.backoffMs);
+      });
+    } catch (error) {
+      routerState.running = false;
+      routerState.status = "error";
+      routerState.lastError = error instanceof Error ? error.message : String(error);
+      persistState();
+    }
+  };
+
+  const startOpencode = async () => {
+    const bundle = await assetService.resolveRuntimeBundle();
+    runtimeManifest = bundle.manifest;
+    opencodeState.asset = bundle.opencode;
+    opencodeState.version = bundle.opencode.version;
+    routerState.asset = bundle.router;
+    routerState.version = bundle.router.version;
+    opencodeState.status = bootstrapPolicy === "disabled" ? "disabled" : "starting";
+    opencodeState.lastError = null;
+    opencodeState.lastStartedAt = nowIso();
+    persistState();
+
+    const configuredPort = Number.parseInt(process.env.OPENWORK_SERVER_V2_OPENCODE_PORT ?? "0", 10);
+    const handle = await createLocalOpencode({
+      binary: bundle.opencode.absolutePath,
+      client: {
+        directory: options.workingDirectory.rootDir,
+        responseStyle: "data",
+        throwOnError: true,
+      },
+      config: {},
+      cwd: options.workingDirectory.rootDir,
+      hostname: process.env.OPENWORK_SERVER_V2_OPENCODE_HOST?.trim() || "127.0.0.1",
+      port: configuredPort > 0 ? configuredPort : await getFreePort(),
+      timeout: Number.parseInt(process.env.OPENWORK_SERVER_V2_OPENCODE_START_TIMEOUT_MS ?? "10000", 10) || 10_000,
+    });
+
+    try {
+      await waitForOpencodeHealthy(handle, 5_000, 200);
+    } catch (error) {
+      handle.server.close();
+      const snapshot = handle.server.getOutput();
+      throw new Error(
+        `OpenCode became reachable at ${handle.server.url}, but did not pass the SDK health probe: ${error instanceof Error ? error.message : String(error)}.\nCollected output:\n${formatRuntimeOutput(snapshot)}`,
+      );
+    }
+
+    opencodeHandle = handle;
+    opencodeState.baseUrl = handle.server.url;
+    opencodeState.lastReadyAt = nowIso();
+    opencodeState.pid = handle.server.proc.pid ?? null;
+    opencodeState.recentOutput = handle.server.getOutput();
+    opencodeState.running = true;
+    opencodeState.status = "running";
+    persistState();
+
+    void handle.server.waitForExit().then(async (exit) => {
+      if (opencodeHandle === handle) {
+        opencodeHandle = null;
+      }
+      opencodeState.running = false;
+      opencodeState.pid = null;
+      opencodeState.recentOutput = handle.server.getOutput();
+      opencodeState.lastExit = {
+        ...exit,
+        output: handle.server.getOutput(),
+        reason: opencodeStopping || shuttingDown ? "stopped" : "unexpected_exit",
+      };
+
+      await stopRouter();
+
+      if (opencodeStopping || shuttingDown) {
+        opencodeState.status = bootstrapPolicy === "disabled" ? "disabled" : "stopped";
+        persistState();
+        return;
+      }
+
+      opencodeState.status = "crashed";
+      persistState();
+
+      if (!withRestartRecord("opencode")) {
+        opencodeState.lastError = "OpenCode restart policy exhausted.";
+        persistState();
+        return;
+      }
+
+      opencodeState.status = "restart_scheduled";
+      persistState();
+      clearRestartTimer("opencode");
+      restartTimers.opencode = setTimeout(() => {
+        if (shuttingDown) {
+          return;
+        }
+
+        void bootstrap().catch((error) => {
+          opencodeState.status = "error";
+          opencodeState.lastError = error instanceof Error ? error.message : String(error);
+          persistState();
+        });
+      }, restartPolicy.backoffMs);
+    });
+  };
+
+  const bootstrap = async () => {
+    if (bootstrapPolicy === "disabled") {
+      opencodeState.status = "disabled";
+      routerState.status = "disabled";
+      persistState();
+      return;
+    }
+
+    if (bootstrapPromise) {
+      return bootstrapPromise;
+    }
+
+    bootstrapPromise = (async () => {
+      routerEnablement = resolveRouterEnablement();
+      persistState();
+      try {
+        updateRecentOutput();
+        if (!opencodeState.running) {
+          await startOpencode();
+        }
+      } catch (error) {
+        opencodeState.running = false;
+        opencodeState.status = "error";
+        opencodeState.lastError = error instanceof Error ? error.message : String(error);
+        if (error instanceof LocalOpencodeStartupError) {
+          opencodeState.recentOutput = error.output;
+          opencodeState.lastExit = {
+            at: nowIso(),
+            code: null,
+            output: error.output,
+            reason: error.code,
+            signal: null,
+          };
+        }
+        persistState();
+        throw error;
+      }
+
+      await startRouter();
+    })().finally(() => {
+      bootstrapPromise = null;
+    });
+
+    return bootstrapPromise;
+  };
+
+  const applyRouterConfig = async () => {
+    routerEnablement = resolveRouterEnablement();
+    persistState();
+
+    if (bootstrapPolicy !== "disabled" && !opencodeState.running) {
+      await startOpencode();
+    }
+
+    if (routerHandle || routerState.running) {
+      await stopRouter();
+    }
+
+    if (bootstrapPolicy === "disabled") {
+      routerState.status = "disabled";
+      persistState();
+      return;
+    }
+
+    await startRouter();
+  };
+
+  persistState();
+
+  const service: RuntimeService = {
+    async applyRouterConfig() {
+      await applyRouterConfig();
+      return this.getRouterHealth();
+    },
+
+    async bootstrap() {
+      await bootstrap();
+    },
+
+    async dispose() {
+      shuttingDown = true;
+      clearRestartTimer("opencode");
+      clearRestartTimer("router");
+      await stopRouter();
+      await stopOpencode();
+      persistState();
+    },
+
+    getBootstrapPolicy() {
+      return bootstrapPolicy;
+    },
+
+    getOpencodeHealth() {
+      updateRecentOutput();
+      return {
+        baseUrl: opencodeState.baseUrl,
+        binaryPath: opencodeState.asset?.absolutePath ?? null,
+        diagnostics: opencodeState.recentOutput,
+        lastError: opencodeState.lastError,
+        lastExit: opencodeState.lastExit,
+        lastReadyAt: opencodeState.lastReadyAt,
+        lastStartedAt: opencodeState.lastStartedAt,
+        manifest: runtimeManifest,
+        pid: opencodeState.pid,
+        running: opencodeState.running,
+        source: opencodeState.asset?.source ?? assetService.getSource(),
+        status: opencodeState.status,
+        version: opencodeState.version,
+      };
+    },
+
+    getRouterHealth() {
+      updateRecentOutput();
+      return {
+        baseUrl: routerState.baseUrl,
+        binaryPath: routerState.asset?.absolutePath ?? null,
+        diagnostics: routerState.recentOutput,
+        enablement: routerEnablement,
+        healthUrl: routerState.healthUrl,
+        lastError: routerState.lastError,
+        lastExit: routerState.lastExit,
+        lastReadyAt: routerState.lastReadyAt,
+        lastStartedAt: routerState.lastStartedAt,
+        manifest: runtimeManifest,
+        materialization: routerMaterialization,
+        pid: routerState.pid,
+        running: routerState.running,
+        source: routerState.asset?.source ?? assetService.getSource(),
+        status: routerState.status,
+        version: routerState.version,
+      };
+    },
+
+    getRuntimeSummary() {
+      return {
+        bootstrapPolicy,
+        manifest: runtimeManifest,
+        opencode: this.getOpencodeHealth(),
+        restartPolicy,
+        router: this.getRouterHealth(),
+        upgrade: upgradeState,
+        source: assetService.getSource(),
+        target: assetService.getTarget(),
+      };
+    },
+
+    getRuntimeVersions() {
+      const summary = this.getRuntimeSummary();
+      return {
+        active: {
+          opencodeVersion: summary.opencode.version,
+          routerVersion: summary.router.version,
+          serverVersion: options.serverVersion,
+        },
+        manifest: summary.manifest,
+        pinned: {
+          opencodeVersion: summary.manifest?.opencodeVersion ?? null,
+          routerVersion: summary.manifest?.routerVersion ?? null,
+          serverVersion: options.serverVersion,
+        },
+        target: summary.target,
+      };
+    },
+
+    getStateForPersistence(): ReturnType<RuntimeService["getRuntimeSummary"]> {
+      return this.getRuntimeSummary();
+    },
+
+    async upgradeRuntime() {
+      upgradeState = {
+        error: null,
+        finishedAt: null,
+        startedAt: nowIso(),
+        status: "running",
+      };
+      persistState();
+
+      try {
+        await stopRouter();
+        await stopOpencode();
+        runtimeManifest = null;
+        opencodeState.asset = null;
+        routerState.asset = null;
+        await bootstrap();
+        upgradeState = {
+          error: null,
+          finishedAt: nowIso(),
+          startedAt: upgradeState.startedAt,
+          status: "completed",
+        };
+        persistState();
+        return {
+          state: upgradeState,
+          summary: this.getRuntimeSummary(),
+        };
+      } catch (error) {
+        upgradeState = {
+          error: error instanceof Error ? error.message : String(error),
+          finishedAt: nowIso(),
+          startedAt: upgradeState.startedAt,
+          status: "failed",
+        };
+        persistState();
+        throw error;
+      }
+    },
+  };
+
+  return service;
+}
diff --git a/apps/server-v2/src/services/server-registry-service.ts b/apps/server-v2/src/services/server-registry-service.ts
new file mode 100644
index 0000000000..3adf419284
--- /dev/null
+++ b/apps/server-v2/src/services/server-registry-service.ts
@@ -0,0 +1,90 @@
+import type { ServerRepositories } from "../database/repositories.js";
+import type { JsonObject, ServerRecord } from "../database/types.js";
+
+export type ServerRegistrySummary = {
+  hiddenWorkspaceCount: number;
+  localServerId: string;
+  remoteServerCount: number;
+  totalServers: number;
+  visibleWorkspaceCount: number;
+};
+
+export type ServerInventoryItem = {
+  auth: {
+    configured: boolean;
+    scheme: "bearer" | "none";
+  };
+  baseUrl: string | null;
+  capabilities: JsonObject;
+  hostingKind: ServerRecord["hostingKind"];
+  id: string;
+  isEnabled: boolean;
+  isLocal: boolean;
+  kind: ServerRecord["kind"];
+  label: string;
+  lastSeenAt: string | null;
+  source: string;
+  updatedAt: string;
+};
+
+export type ServerRegistryService = ReturnType<typeof createServerRegistryService>;
+
+function hasServerAuth(record: ServerRecord) {
+  if (!record.auth) {
+    return false;
+  }
+
+  return Object.values(record.auth).some((value) => typeof value === "string" && value.trim().length > 0);
+}
+
+export function createServerRegistryService(input: {
+  localServerId: string;
+  repositories: ServerRepositories;
+}) {
+  const { repositories } = input;
+
+  function serialize(record: ServerRecord, options?: { includeBaseUrl?: boolean }) {
+    return {
+      auth: {
+        configured: hasServerAuth(record),
+        scheme: hasServerAuth(record) ? "bearer" : "none",
+      },
+      baseUrl: options?.includeBaseUrl === false ? null : record.baseUrl,
+      capabilities: record.capabilities,
+      hostingKind: record.hostingKind,
+      id: record.id,
+      isEnabled: record.isEnabled,
+      isLocal: record.isLocal,
+      kind: record.kind,
+      label: record.label,
+      lastSeenAt: record.lastSeenAt,
+      source: record.source,
+      updatedAt: record.updatedAt,
+    } satisfies ServerInventoryItem;
+  }
+
+  return {
+    getById(serverId: string) {
+      return repositories.servers.getById(serverId);
+    },
+
+    list(options?: { includeBaseUrl?: boolean }) {
+      return repositories.servers.list().map((record) => serialize(record, options));
+    },
+
+    serialize,
+
+    summarize(): ServerRegistrySummary {
+      const servers = repositories.servers.list();
+      const allWorkspaces = repositories.workspaces.list({ includeHidden: true });
+      const hiddenWorkspaceCount = allWorkspaces.filter((workspace) => workspace.isHidden).length;
+      return {
+        hiddenWorkspaceCount,
+        localServerId: input.localServerId,
+        remoteServerCount: servers.filter((server) => server.kind === "remote").length,
+        totalServers: servers.length,
+        visibleWorkspaceCount: allWorkspaces.length - hiddenWorkspaceCount,
+      };
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/system-service.ts b/apps/server-v2/src/services/system-service.ts
new file mode 100644
index 0000000000..934d6745ea
--- /dev/null
+++ b/apps/server-v2/src/services/system-service.ts
@@ -0,0 +1,148 @@
+import type { ProcessInfoAdapter } from "../adapters/process-info.js";
+import type { DatabaseStatusProvider } from "../database/status-provider.js";
+import { routeNamespaces, workspaceResourcePattern } from "../routes/route-paths.js";
+import type { AuthService, RequestActor } from "./auth-service.js";
+import type { CapabilitiesService } from "./capabilities-service.js";
+import type { RuntimeService } from "./runtime-service.js";
+import type { ServerRegistryService } from "./server-registry-service.js";
+import type { WorkspaceRegistryService } from "./workspace-registry-service.js";
+
+export type SystemService = ReturnType<typeof createSystemService>;
+
+export function createSystemService(input: {
+  auth: AuthService;
+  capabilities: CapabilitiesService;
+  environment: string;
+  processInfo: ProcessInfoAdapter;
+  database: DatabaseStatusProvider;
+  runtime: RuntimeService;
+  serverRegistry: ServerRegistryService;
+  startedAt: Date;
+  version: string;
+  workspaceRegistry: WorkspaceRegistryService;
+}) {
+  const service = "openwork-server-v2" as const;
+  const packageName = "openwork-server-v2" as const;
+
+  return {
+    getRootInfo() {
+      return {
+        service,
+        packageName,
+        version: input.version,
+        environment: input.environment,
+        routes: {
+          ...routeNamespaces,
+          workspaceResource: workspaceResourcePattern,
+        },
+        contract: {
+          source: "hono-openapi" as const,
+          openapiPath: routeNamespaces.openapi,
+          sdkPackage: "@openwork/server-sdk" as const,
+        },
+      };
+    },
+
+    getCapabilities(actor: RequestActor) {
+      return input.capabilities.getCapabilities(actor);
+    },
+
+    getHealth(now: Date = new Date()) {
+      return {
+        service,
+        status: "ok" as const,
+        startedAt: input.startedAt.toISOString(),
+        uptimeMs: Math.max(0, now.getTime() - input.startedAt.getTime()),
+        database: input.database.getStatus(),
+      };
+    },
+
+    getStatus(actor: RequestActor, now: Date = new Date()) {
+      const runtimeSummary = input.runtime.getRuntimeSummary();
+      const registry = input.serverRegistry.summarize();
+      return {
+        auth: input.auth.getSummary(actor),
+        capabilities: input.capabilities.getCapabilities(actor),
+        database: input.database.getStatus(),
+        environment: input.environment,
+        registry,
+        runtime: {
+          opencode: {
+            baseUrl: runtimeSummary.opencode.baseUrl,
+            running: runtimeSummary.opencode.running,
+            status: runtimeSummary.opencode.status,
+            version: runtimeSummary.opencode.version,
+          },
+          router: {
+            baseUrl: runtimeSummary.router.baseUrl,
+            running: runtimeSummary.router.running,
+            status: runtimeSummary.router.status,
+            version: runtimeSummary.router.version,
+          },
+          source: runtimeSummary.source,
+          target: runtimeSummary.target,
+        },
+        service,
+        startedAt: input.startedAt.toISOString(),
+        status: "ok" as const,
+        uptimeMs: Math.max(0, now.getTime() - input.startedAt.getTime()),
+        version: input.version,
+      };
+    },
+
+    getMetadata(actor: RequestActor) {
+      return {
+        foundation: {
+          phase: 10 as const,
+          middlewareOrder: [
+            "request-id",
+            "request-context",
+            "response-finalizer",
+            "request-logger",
+            "error-handler",
+          ],
+          routeNamespaces: {
+            ...routeNamespaces,
+            workspaceResource: workspaceResourcePattern,
+          },
+          database: input.database.getStatus(),
+          startup: input.database.getStartupDiagnostics(),
+        },
+        requestContext: {
+          actorKind: actor.kind,
+          requestIdHeader: "X-Request-Id" as const,
+        },
+        runtime: {
+          environment: input.processInfo.environment,
+          hostname: input.processInfo.hostname,
+          pid: input.processInfo.pid,
+          platform: input.processInfo.platform,
+          runtime: input.processInfo.runtime,
+          runtimeVersion: input.processInfo.runtimeVersion,
+        },
+        runtimeSupervisor: input.runtime.getRuntimeSummary(),
+        contract: {
+          source: "hono-openapi" as const,
+          openapiPath: routeNamespaces.openapi,
+          sdkPackage: "@openwork/server-sdk" as const,
+        },
+      };
+    },
+
+    listServers() {
+      return {
+        items: input.serverRegistry.list({ includeBaseUrl: true }),
+      };
+    },
+
+    listWorkspaces(options?: { includeHidden?: boolean }) {
+      return {
+        items: input.workspaceRegistry.list({ includeHidden: options?.includeHidden ?? false }),
+      };
+    },
+
+    getWorkspace(workspaceId: string, options?: { includeHidden?: boolean }) {
+      return input.workspaceRegistry.getById(workspaceId, { includeHidden: options?.includeHidden ?? false });
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/workspace-file-service.ts b/apps/server-v2/src/services/workspace-file-service.ts
new file mode 100644
index 0000000000..e2beb8c819
--- /dev/null
+++ b/apps/server-v2/src/services/workspace-file-service.ts
@@ -0,0 +1,1226 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { HTTPException } from "hono/http-exception";
+import type { RegistryService } from "./registry-service.js";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { WorkspaceRecord } from "../database/types.js";
+import type { RuntimeService } from "./runtime-service.js";
+import type { ConfigMaterializationService } from "./config-materialization-service.js";
+import { RouteError } from "../http.js";
+import { requestRemoteOpenwork, requestRemoteOpenworkRaw, resolveRemoteWorkspaceTarget } from "../adapters/remote-openwork.js";
+
+const FILE_SESSION_DEFAULT_TTL_MS = 15 * 60 * 1000;
+const FILE_SESSION_MIN_TTL_MS = 30 * 1000;
+const FILE_SESSION_MAX_TTL_MS = 24 * 60 * 60 * 1000;
+const FILE_SESSION_MAX_BATCH_ITEMS = 64;
+const FILE_SESSION_MAX_FILE_BYTES = 5_000_000;
+const FILE_SESSION_CATALOG_DEFAULT_LIMIT = 2000;
+const FILE_SESSION_CATALOG_MAX_LIMIT = 10000;
+
+type ReloadReason = "agents" | "commands" | "config" | "mcp" | "plugins" | "skills";
+
+type ReloadTrigger = {
+  action?: "added" | "removed" | "updated";
+  name?: string;
+  path?: string;
+  type: "agent" | "command" | "config" | "mcp" | "plugin" | "skill";
+};
+
+type ReloadEvent = {
+  id: string;
+  reason: ReloadReason;
+  seq: number;
+  timestamp: number;
+  trigger?: ReloadTrigger;
+  workspaceId: string;
+};
+
+type FileCatalogEntry = {
+  kind: "dir" | "file";
+  mtimeMs: number;
+  path: string;
+  revision: string;
+  size: number;
+};
+
+type FileSessionRecord = {
+  actorTokenHash: string;
+  canWrite: boolean;
+  createdAt: number;
+  expiresAt: number;
+  id: string;
+  workspaceId: string;
+  workspaceRoot: string;
+};
+
+type FileSessionEvent = {
+  id: string;
+  path: string;
+  revision?: string;
+  seq: number;
+  timestamp: number;
+  toPath?: string;
+  type: "delete" | "mkdir" | "rename" | "write";
+  workspaceId: string;
+};
+
+class LocalFileSessionStore {
+  private sessions = new Map<string, FileSessionRecord>();
+
+  private workspaceEvents = new Map<string, { events: FileSessionEvent[]; seq: number }>();
+
+  close(sessionId: string) {
+    return this.sessions.delete(sessionId);
+  }
+
+  create(input: Omit<FileSessionRecord, "createdAt" | "expiresAt" | "id"> & { ttlMs: number }) {
+    const now = nowMs();
+    const record: FileSessionRecord = {
+      ...input,
+      createdAt: now,
+      expiresAt: now + input.ttlMs,
+      id: randomUUID(),
+    };
+    this.sessions.set(record.id, record);
+    return record;
+  }
+
+  get(sessionId: string) {
+    const session = this.sessions.get(sessionId) ?? null;
+    if (session && session.expiresAt <= nowMs()) {
+      this.sessions.delete(sessionId);
+      return null;
+    }
+    return session;
+  }
+
+  listWorkspaceEvents(workspaceId: string, since = 0) {
+    const state = this.workspaceEvents.get(workspaceId);
+    if (!state) {
+      return { cursor: 0, items: [] as FileSessionEvent[] };
+    }
+    return {
+      cursor: state.seq,
+      items: state.events.filter((event) => event.seq > since),
+    };
+  }
+
+  recordWorkspaceEvent(input: Omit<FileSessionEvent, "id" | "seq" | "timestamp">) {
+    const state = this.workspaceEvents.get(input.workspaceId) ?? { events: [], seq: 0 };
+    const event: FileSessionEvent = {
+      ...input,
+      id: randomUUID(),
+      seq: state.seq + 1,
+      timestamp: nowMs(),
+    };
+    state.seq = event.seq;
+    state.events.push(event);
+    if (state.events.length > 500) {
+      state.events.splice(0, state.events.length - 500);
+    }
+    this.workspaceEvents.set(input.workspaceId, state);
+    return event;
+  }
+
+  renew(sessionId: string, ttlMs: number) {
+    const session = this.get(sessionId);
+    if (!session) {
+      return null;
+    }
+    session.expiresAt = nowMs() + ttlMs;
+    this.sessions.set(sessionId, session);
+    return session;
+  }
+}
+
+function nowMs() {
+  return Date.now();
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function recordAuditEntry(workspaceId: string, workspaceRoot: string, action: string, target: string, summary: string) {
+  const auditRoot = process.env.OPENWORK_DATA_DIR?.trim()
+    ? path.join(process.env.OPENWORK_DATA_DIR.trim(), "audit")
+    : path.join(workspaceRoot, ".opencode", "openwork");
+  fs.mkdirSync(auditRoot, { recursive: true });
+  const filePath = process.env.OPENWORK_DATA_DIR?.trim()
+    ? path.join(auditRoot, `${workspaceId}.jsonl`)
+    : path.join(auditRoot, "audit.jsonl");
+  const entry = {
+    action,
+    actor: { type: "remote" },
+    id: randomUUID(),
+    summary,
+    target,
+    timestamp: nowMs(),
+    workspaceId,
+  };
+  fs.appendFileSync(filePath, `${JSON.stringify(entry)}\n`, "utf8");
+}
+
+function initializeWorkspaceFiles(workspaceRoot: string) {
+  fs.mkdirSync(path.join(workspaceRoot, ".opencode"), { recursive: true });
+  fs.mkdirSync(path.join(workspaceRoot, ".opencode", "openwork"), { recursive: true });
+}
+
+function resolveWorkspaceOrThrow(repositories: ServerRepositories, workspaceId: string) {
+  const workspace = repositories.workspaces.getById(workspaceId);
+  if (!workspace) {
+    throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+  }
+  if (!workspace.dataDir?.trim()) {
+    throw new RouteError(400, "invalid_request", `Workspace ${workspace.id} does not have a local data directory.`);
+  }
+  return workspace;
+}
+
+function resolveWorkspaceRecordOrThrow(repositories: ServerRepositories, workspaceId: string) {
+  const workspace = repositories.workspaces.getById(workspaceId);
+  if (!workspace) {
+    throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+  }
+  return workspace;
+}
+
+function resolveWorkspaceRoot(workspace: WorkspaceRecord) {
+  const root = workspace.dataDir?.trim();
+  if (!root) {
+    throw new RouteError(400, "invalid_request", `Workspace ${workspace.id} does not have a local data directory.`);
+  }
+  return root;
+}
+
+function normalizeWorkspaceRelativePath(input: string, options: { allowSubdirs: boolean }) {
+  const raw = String(input ?? "").trim();
+  if (!raw) {
+    throw new RouteError(400, "invalid_request", "Path is required.");
+  }
+  if (raw.includes("\u0000")) {
+    throw new RouteError(400, "invalid_request", "Path contains a null byte.");
+  }
+  let normalized = raw.replace(/\\/g, "/").replace(/^\/+/, "").replace(/^\.\//, "").replace(/^workspace\//, "").replace(/^\/+/, "");
+  const parts = normalized.split("/").filter(Boolean);
+  if (!parts.length) {
+    throw new RouteError(400, "invalid_request", "Path is required.");
+  }
+  if (!options.allowSubdirs && parts.length > 1) {
+    throw new RouteError(400, "invalid_request", "Subdirectories are not allowed.");
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new RouteError(400, "invalid_request", "Path traversal is not allowed.");
+    }
+  }
+  normalized = parts.join("/");
+  return normalized;
+}
+
+function resolveSafeChildPath(root: string, child: string) {
+  const rootResolved = path.resolve(root);
+  const candidate = path.resolve(rootResolved, child);
+  if (candidate === rootResolved || !candidate.startsWith(rootResolved + path.sep)) {
+    throw new RouteError(400, "invalid_request", "Path traversal is not allowed.");
+  }
+  return candidate;
+}
+
+function fileRevision(info: { mtimeMs: number; size: number }) {
+  return `${Math.floor(info.mtimeMs)}:${info.size}`;
+}
+
+function parseFileSessionTtlMs(input: unknown) {
+  const raw = typeof input === "number" && Number.isFinite(input) ? input : Number.NaN;
+  if (Number.isNaN(raw)) return FILE_SESSION_DEFAULT_TTL_MS;
+  const ttlMs = Math.floor(raw * 1000);
+  if (ttlMs < FILE_SESSION_MIN_TTL_MS) return FILE_SESSION_MIN_TTL_MS;
+  if (ttlMs > FILE_SESSION_MAX_TTL_MS) return FILE_SESSION_MAX_TTL_MS;
+  return ttlMs;
+}
+
+function parseCatalogLimit(input: string | null) {
+  if (!input) return FILE_SESSION_CATALOG_DEFAULT_LIMIT;
+  const parsed = Number(input);
+  if (!Number.isFinite(parsed) || parsed <= 0) return FILE_SESSION_CATALOG_DEFAULT_LIMIT;
+  return Math.min(Math.floor(parsed), FILE_SESSION_CATALOG_MAX_LIMIT);
+}
+
+function parseCursor(input: string | null) {
+  if (!input) return 0;
+  const parsed = Number(input);
+  if (!Number.isFinite(parsed) || parsed < 0) return 0;
+  return Math.floor(parsed);
+}
+
+function parsePathFilter(input: string | null) {
+  if (!input?.trim()) return null;
+  return normalizeWorkspaceRelativePath(input, { allowSubdirs: true });
+}
+
+function matchesCatalogFilter(pathValue: string, filter: string | null) {
+  if (!filter) return true;
+  return pathValue === filter || pathValue.startsWith(`${filter}/`);
+}
+
+function parseBatchPathList(input: unknown) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new RouteError(400, "invalid_request", "paths must be a non-empty array.");
+  }
+  if (input.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+    throw new RouteError(400, "invalid_request", `paths must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items.`);
+  }
+  return input.map((item) => normalizeWorkspaceRelativePath(String(item ?? ""), { allowSubdirs: true }));
+}
+
+function parseBatchWriteList(input: unknown) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new RouteError(400, "invalid_request", "writes must be a non-empty array.");
+  }
+  if (input.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+    throw new RouteError(400, "invalid_request", `writes must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items.`);
+  }
+  return input.map((item) => {
+    if (!item || typeof item !== "object") {
+      throw new RouteError(400, "invalid_request", "Write entries must be objects.");
+    }
+    const record = item as Record<string, unknown>;
+    const contentBase64 = typeof record.contentBase64 === "string" ? record.contentBase64.trim() : "";
+    if (!contentBase64) {
+      throw new RouteError(400, "invalid_request", "contentBase64 is required.");
+    }
+    return {
+      contentBase64,
+      force: record.force === true,
+      ifMatchRevision: typeof record.ifMatchRevision === "string" && record.ifMatchRevision.trim() ? record.ifMatchRevision.trim() : undefined,
+      path: normalizeWorkspaceRelativePath(String(record.path ?? ""), { allowSubdirs: true }),
+    };
+  });
+}
+
+function parseOperations(input: unknown) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new RouteError(400, "invalid_request", "operations must be a non-empty array.");
+  }
+  if (input.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+    throw new RouteError(400, "invalid_request", `operations must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items.`);
+  }
+  return input as Array<Record<string, unknown>>;
+}
+
+function resolveInboxDir(workspaceRoot: string) {
+  return path.join(workspaceRoot, ".opencode", "openwork", "inbox");
+}
+
+function resolveOutboxDir(workspaceRoot: string) {
+  return path.join(workspaceRoot, ".opencode", "openwork", "outbox");
+}
+
+function encodeArtifactId(relativePath: string) {
+  return Buffer.from(relativePath, "utf8").toString("base64url");
+}
+
+function decodeArtifactId(id: string) {
+  const raw = id.trim();
+  if (!raw) {
+    throw new RouteError(400, "invalid_request", "Artifact id is required.");
+  }
+  try {
+    return normalizeWorkspaceRelativePath(Buffer.from(raw, "base64url").toString("utf8"), { allowSubdirs: true });
+  } catch {
+    throw new RouteError(400, "invalid_request", "Artifact id is invalid.");
+  }
+}
+
+class ReloadEventStore {
+  private events: ReloadEvent[] = [];
+
+  private lastRecorded = new Map<string, number>();
+
+  private seq = 0;
+
+  list(workspaceId: string, since = 0) {
+    return {
+      cursor: this.seq,
+      items: this.events.filter((event) => event.workspaceId === workspaceId && event.seq > since),
+    };
+  }
+
+  record(workspaceId: string, reason: ReloadReason, trigger?: ReloadTrigger, debounceMs = 750) {
+    const key = `${workspaceId}:${reason}:${trigger?.type ?? "unknown"}:${trigger?.path ?? ""}`;
+    const now = nowMs();
+    const last = this.lastRecorded.get(key) ?? 0;
+    if (now - last < debounceMs) {
+      return null;
+    }
+    this.lastRecorded.set(key, now);
+    const event: ReloadEvent = {
+      id: randomUUID(),
+      reason,
+      seq: ++this.seq,
+      timestamp: now,
+      ...(trigger ? { trigger } : {}),
+      workspaceId,
+    };
+    this.events.push(event);
+    if (this.events.length > 500) {
+      this.events.splice(0, this.events.length - 500);
+    }
+    return event;
+  }
+}
+
+export type WorkspaceFileService = ReturnType<typeof createWorkspaceFileService>;
+
+export function createWorkspaceFileService(input: {
+  config: ConfigMaterializationService;
+  registry: RegistryService;
+  repositories: ServerRepositories;
+  runtime: RuntimeService;
+  serverId: string;
+}) {
+  const fileSessions = new LocalFileSessionStore();
+  const reloadEvents = new ReloadEventStore();
+  const watcherClosers = new Map<string, () => void>();
+
+  function getRemoteServerOrThrow(workspace: WorkspaceRecord) {
+    const server = input.repositories.servers.getById(workspace.serverId);
+    if (!server) {
+      throw new RouteError(502, "bad_gateway", `Workspace ${workspace.id} points at missing remote server ${workspace.serverId}.`);
+    }
+    return server;
+  }
+
+  function getRemoteWorkspacePath(workspace: WorkspaceRecord, suffix: string) {
+    const server = getRemoteServerOrThrow(workspace);
+    const target = resolveRemoteWorkspaceTarget(server, workspace);
+    return {
+      path: `/workspaces/${encodeURIComponent(target.remoteWorkspaceId)}${suffix}`,
+      server,
+    };
+  }
+
+  function updateRuntimeHealth(details: Record<string, unknown>) {
+    const current = input.repositories.serverRuntimeState.getByServerId(input.serverId);
+    const health = current?.health && typeof current.health === "object" ? { ...current.health } : {};
+    const runtime = health.runtime && typeof health.runtime === "object" ? { ...(health.runtime as Record<string, unknown>) } : {};
+    runtime.phase7 = {
+      ...(runtime.phase7 && typeof runtime.phase7 === "object" ? runtime.phase7 as Record<string, unknown> : {}),
+      ...details,
+    };
+    health.runtime = runtime;
+    input.repositories.serverRuntimeState.upsert({
+      health,
+      lastExit: current?.lastExit ?? null,
+      lastStartedAt: current?.lastStartedAt ?? null,
+      opencodeBaseUrl: current?.opencodeBaseUrl ?? null,
+      opencodeStatus: current?.opencodeStatus ?? "unknown",
+      opencodeVersion: current?.opencodeVersion ?? null,
+      restartPolicy: current?.restartPolicy ?? null,
+      routerStatus: current?.routerStatus ?? "disabled",
+      routerVersion: current?.routerVersion ?? null,
+      runtimeVersion: current?.runtimeVersion ?? null,
+      serverId: input.serverId,
+    });
+  }
+
+  function classifyReloadTrigger(changedPath: string): { reason: ReloadReason; trigger: ReloadTrigger } {
+    const normalized = changedPath.replace(/\\/g, "/");
+    if (normalized.includes("/.opencode/skills/")) {
+      const parts = normalized.split("/");
+      const name = parts[parts.length - 2] ?? "skill";
+      return { reason: "skills", trigger: { action: "updated", name, path: changedPath, type: "skill" } };
+    }
+    if (normalized.includes("/.opencode/commands/")) {
+      const name = path.basename(changedPath).replace(/\.md$/i, "");
+      return { reason: "commands", trigger: { action: "updated", name, path: changedPath, type: "command" } };
+    }
+    return {
+      reason: "config",
+      trigger: { action: "updated", name: path.basename(changedPath), path: changedPath, type: "config" },
+    };
+  }
+
+  function startWorkspaceWatchers(workspaceId: string) {
+    const roots = input.config.listWatchRoots(workspaceId);
+    const watchers: fs.FSWatcher[] = [];
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    const schedule = (changedPath: string) => {
+      const { reason, trigger } = classifyReloadTrigger(changedPath);
+      reloadEvents.record(workspaceId, reason, trigger);
+      if (timer) {
+        clearTimeout(timer);
+      }
+      timer = setTimeout(() => {
+        timer = null;
+        try {
+          input.config.absorbWorkspaceConfig(workspaceId);
+        } catch {
+          // ignore best-effort watcher repair failures
+        }
+      }, 200);
+    };
+
+    for (const root of roots) {
+      if (!fs.existsSync(root)) {
+        continue;
+      }
+      try {
+        const watcher = fs.watch(root, { persistent: false }, (_eventType, filename) => {
+          schedule(filename ? path.join(root, filename.toString()) : root);
+        });
+        watchers.push(watcher);
+      } catch {
+        // ignore unsupported watcher roots
+      }
+    }
+
+    const close = () => {
+      if (timer) {
+        clearTimeout(timer);
+      }
+      for (const watcher of watchers) {
+        try {
+          watcher.close();
+        } catch {
+          // ignore
+        }
+      }
+    };
+    watcherClosers.set(workspaceId, close);
+  }
+
+  function startWatchers() {
+    for (const close of watcherClosers.values()) {
+      close();
+    }
+    watcherClosers.clear();
+    const workspaces = input.repositories.workspaces.list({ includeHidden: true }).filter((workspace) => workspace.kind !== "remote");
+    for (const workspace of workspaces) {
+      startWorkspaceWatchers(workspace.id);
+    }
+    updateRuntimeHealth({
+      watchedWorkspaceIds: workspaces.map((workspace) => workspace.id),
+      watchersStartedAt: nowMs(),
+    });
+  }
+
+  function reconcileAll() {
+    const result = input.config.reconcileAllWorkspaces();
+    updateRuntimeHealth({
+      lastReconciledAt: result.reconciledAt,
+      reconciledWorkspaceIds: result.workspaceIds,
+    });
+    return result;
+  }
+
+  reconcileAll();
+  startWatchers();
+  const periodicRepair = setInterval(() => {
+    reconcileAll();
+  }, 30_000);
+  (periodicRepair as any).unref?.();
+
+  function buildActorKey(actorKey: string | undefined, kind: "client" | "host") {
+    return `${kind}:${actorKey?.trim() || kind}`;
+  }
+
+  function resolveFileSession(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host") {
+    const session = fileSessions.get(sessionId);
+    if (!session || session.workspaceId !== workspaceId) {
+      throw new HTTPException(404, { message: "File session not found." });
+    }
+    if (session.actorTokenHash !== buildActorKey(actorKey, actorKind)) {
+      throw new HTTPException(403, { message: "File session does not belong to this actor." });
+    }
+    const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+    return { session, workspace, workspaceRoot: resolveWorkspaceRoot(workspace) };
+  }
+
+  async function listArtifacts(rootDir: string) {
+    if (!fs.existsSync(rootDir)) {
+      return [] as Array<{ id: string; path: string; size: number; updatedAt: number }>;
+    }
+    const items: Array<{ id: string; path: string; size: number; updatedAt: number }> = [];
+    const walk = (directory: string) => {
+      for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+        const absolute = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+          walk(absolute);
+          continue;
+        }
+        if (!entry.isFile()) {
+          continue;
+        }
+        const relativePath = normalizeWorkspaceRelativePath(path.relative(rootDir, absolute), { allowSubdirs: true });
+        const info = fs.statSync(absolute);
+        items.push({
+          id: encodeArtifactId(relativePath),
+          path: relativePath,
+          size: info.size,
+          updatedAt: info.mtimeMs,
+        });
+      }
+    };
+    walk(rootDir);
+    items.sort((left, right) => right.updatedAt - left.updatedAt);
+    return items;
+  }
+
+  function listWorkspaceCatalogEntries(workspaceRoot: string) {
+    const items: FileCatalogEntry[] = [];
+    const visit = (directory: string) => {
+      for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+        const absolute = path.join(directory, entry.name);
+        const relativePath = normalizeWorkspaceRelativePath(path.relative(workspaceRoot, absolute), { allowSubdirs: true });
+        const info = fs.statSync(absolute);
+        if (entry.isDirectory()) {
+          items.push({ kind: "dir", mtimeMs: info.mtimeMs, path: relativePath, revision: fileRevision({ mtimeMs: info.mtimeMs, size: 0 }), size: 0 });
+          visit(absolute);
+          continue;
+        }
+        if (!entry.isFile()) {
+          continue;
+        }
+        items.push({ kind: "file", mtimeMs: info.mtimeMs, path: relativePath, revision: fileRevision(info), size: info.size });
+      }
+    };
+    if (fs.existsSync(workspaceRoot)) {
+      visit(workspaceRoot);
+    }
+    items.sort((left, right) => left.path.localeCompare(right.path));
+    return items;
+  }
+
+  async function audit(workspace: WorkspaceRecord, action: string, target: string, summary: string) {
+    recordAuditEntry(workspace.id, resolveWorkspaceRoot(workspace), action, target, summary);
+  }
+
+  return {
+    activateWorkspace(workspaceId: string) {
+      const workspace = input.repositories.workspaces.getById(workspaceId);
+      if (!workspace) {
+        throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+      }
+      updateRuntimeHealth({ activeWorkspaceId: workspaceId, activeWorkspaceUpdatedAt: nowIso() });
+      return workspaceId;
+    },
+
+    deleteWorkspace(workspaceId: string) {
+      const workspace = input.repositories.workspaces.getById(workspaceId);
+      if (!workspace) {
+        throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+      }
+      const deleted = input.repositories.workspaces.deleteById(workspaceId);
+      updateRuntimeHealth({ activeWorkspaceId: null, activeWorkspaceUpdatedAt: nowIso() });
+      startWatchers();
+      return { deleted, workspaceId };
+    },
+
+    async disposeWorkspaceInstance(workspaceId: string) {
+      const workspace = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspace.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspace, "/engine/reload");
+        await requestRemoteOpenwork<{ reloadedAt: number }>({
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 20_000,
+        });
+        return { disposed: true, workspaceId };
+      }
+
+      await input.runtime.dispose();
+      await input.runtime.bootstrap();
+      updateRuntimeHealth({ activeWorkspaceId: null, activeWorkspaceUpdatedAt: nowIso() });
+      reloadEvents.record(workspace.id, "config", { action: "updated", name: "engine", type: "config" }, 0);
+      await audit(workspace, "engine.dispose", workspace.dataDir ?? workspace.id, "Disposed workspace runtime instance through Server V2.");
+      return { disposed: true, workspaceId };
+    },
+
+    async createLocalWorkspace(inputValue: { folderPath: string; name: string; preset: string }) {
+      const folderPath = inputValue.folderPath.trim();
+      if (!folderPath) {
+        throw new RouteError(400, "invalid_request", "folderPath is required.");
+      }
+      const workspaceRoot = path.resolve(folderPath);
+      fs.mkdirSync(workspaceRoot, { recursive: true });
+      initializeWorkspaceFiles(workspaceRoot);
+      const record = input.registry.importLocalWorkspace({
+        dataDir: workspaceRoot,
+        displayName: inputValue.name.trim() || path.basename(workspaceRoot),
+        status: "ready",
+      });
+      input.repositories.workspaces.upsert({
+        ...record,
+        displayName: inputValue.name.trim() || record.displayName,
+        status: "ready",
+      });
+      input.config.absorbWorkspaceConfig(record.id);
+      startWatchers();
+      updateRuntimeHealth({ activeWorkspaceId: record.id, activeWorkspaceUpdatedAt: nowIso() });
+      return resolveWorkspaceOrThrow(input.repositories, record.id);
+    },
+
+    createWorkspaceFileSession(workspaceId: string, inputValue: { actorKey?: string; actorKind: "client" | "host"; ttlSeconds?: number; write?: boolean }) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/file-sessions");
+        return requestRemoteOpenwork<{
+          canWrite: boolean;
+          createdAt: number;
+          expiresAt: number;
+          id: string;
+          ttlMs: number;
+          workspaceId: string;
+        }>({
+          body: { ttlSeconds: inputValue.ttlSeconds, write: inputValue.write },
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 15_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const workspaceRoot = resolveWorkspaceRoot(workspace);
+      const requestWrite = inputValue.write !== false;
+      const canWrite = requestWrite && (inputValue.actorKind === "host" || inputValue.actorKind === "client");
+      const session = fileSessions.create({
+        actorTokenHash: buildActorKey(inputValue.actorKey, inputValue.actorKind),
+        canWrite,
+        ttlMs: parseFileSessionTtlMs(inputValue.ttlSeconds),
+        workspaceId,
+        workspaceRoot,
+      });
+      return {
+        canWrite: session.canWrite,
+        createdAt: session.createdAt,
+        expiresAt: session.expiresAt,
+        id: session.id,
+        ttlMs: Math.max(0, session.expiresAt - nowMs()),
+        workspaceId,
+      };
+    },
+
+    async dispose() {
+      clearInterval(periodicRepair);
+      for (const close of watcherClosers.values()) {
+        close();
+      }
+      watcherClosers.clear();
+    },
+
+    emitReloadEvent(workspaceId: string, reason: ReloadReason, trigger?: ReloadTrigger) {
+      const workspace = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspace.kind === "remote") {
+        return null;
+      }
+      return reloadEvents.record(workspaceId, reason, trigger, 0);
+    },
+
+    async downloadArtifact(workspaceId: string, artifactId: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/artifacts/${encodeURIComponent(artifactId)}`);
+        const response = await requestRemoteOpenworkRaw({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 30_000,
+        });
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return {
+          buffer,
+          filename: response.headers.get("content-disposition")?.match(/filename="?([^";]+)"?/)?.[1] ?? artifactId,
+          size: buffer.byteLength,
+        };
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const rootDir = resolveOutboxDir(resolveWorkspaceRoot(workspace));
+      const relativePath = decodeArtifactId(artifactId);
+      const absolutePath = resolveSafeChildPath(rootDir, relativePath);
+      if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+        throw new HTTPException(404, { message: "Artifact not found." });
+      }
+      return { absolutePath, filename: path.basename(relativePath), size: fs.statSync(absolutePath).size };
+    },
+
+    async downloadInboxItem(workspaceId: string, inboxId: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/inbox/${encodeURIComponent(inboxId)}`);
+        const response = await requestRemoteOpenworkRaw({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 30_000,
+        });
+        const buffer = Buffer.from(await response.arrayBuffer());
+        return {
+          buffer,
+          filename: response.headers.get("content-disposition")?.match(/filename="?([^";]+)"?/)?.[1] ?? inboxId,
+          size: buffer.byteLength,
+        };
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const rootDir = resolveInboxDir(resolveWorkspaceRoot(workspace));
+      const relativePath = decodeArtifactId(inboxId);
+      const absolutePath = resolveSafeChildPath(rootDir, relativePath);
+      if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+        throw new HTTPException(404, { message: "Inbox item not found." });
+      }
+      return { absolutePath, filename: path.basename(relativePath), size: fs.statSync(absolutePath).size };
+    },
+
+    getReloadEvents(workspaceId: string, since?: number) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/reload-events${typeof since === "number" ? `?since=${since}` : ""}`);
+        return requestRemoteOpenwork<{ cursor: number; items: ReloadEvent[] }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 10_000,
+        });
+      }
+      resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      return reloadEvents.list(workspaceId, since ?? 0);
+    },
+
+    async recordWorkspaceAudit(workspaceId: string, action: string, target: string, summary: string) {
+      const workspace = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspace.kind === "remote") {
+        return null;
+      }
+      await audit(workspace, action, target, summary);
+    },
+
+    async listArtifacts(workspaceId: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/artifacts");
+        return requestRemoteOpenwork<{ items: Array<Record<string, unknown>> }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 15_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      return { items: await listArtifacts(resolveOutboxDir(resolveWorkspaceRoot(workspace))) };
+    },
+
+    async listFileSessionCatalogSnapshot(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", inputValue: { after?: string | null; includeDirs?: boolean; limit?: string | null; prefix?: string | null }) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const query = new URLSearchParams();
+        if (inputValue.after) query.set("after", inputValue.after);
+        if (inputValue.includeDirs === false) query.set("includeDirs", "false");
+        if (inputValue.limit) query.set("limit", inputValue.limit);
+        if (inputValue.prefix) query.set("prefix", inputValue.prefix);
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/catalog/snapshot${query.size ? `?${query.toString()}` : ""}`);
+        return requestRemoteOpenwork<{
+          cursor: number;
+          generatedAt: number;
+          items: FileCatalogEntry[];
+          nextAfter?: string;
+          sessionId: string;
+          total: number;
+          truncated: boolean;
+          workspaceId: string;
+        }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 20_000,
+        });
+      }
+      const { workspaceRoot } = resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      const prefix = parsePathFilter(inputValue.prefix ?? null);
+      const after = parsePathFilter(inputValue.after ?? null);
+      const includeDirs = inputValue.includeDirs !== false;
+      const limit = parseCatalogLimit(inputValue.limit ?? null);
+      const entries = listWorkspaceCatalogEntries(workspaceRoot).filter((entry) => {
+        if (!includeDirs && entry.kind === "dir") return false;
+        if (!matchesCatalogFilter(entry.path, prefix)) return false;
+        if (after && entry.path <= after) return false;
+        return true;
+      });
+      const items = entries.slice(0, limit);
+      const cursor = fileSessions.listWorkspaceEvents(workspaceId, Number.MAX_SAFE_INTEGER).cursor;
+      return {
+        cursor,
+        generatedAt: nowMs(),
+        items,
+        nextAfter: entries.length > items.length ? items[items.length - 1]?.path : undefined,
+        sessionId,
+        total: entries.length,
+        truncated: entries.length > items.length,
+        workspaceId,
+      };
+    },
+
+    listFileSessionEvents(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", since?: string | null) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/catalog/events${since?.trim() ? `?since=${encodeURIComponent(since.trim())}` : ""}`);
+        return requestRemoteOpenwork<{ cursor: number; items: FileSessionEvent[] }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 10_000,
+        });
+      }
+      resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      return fileSessions.listWorkspaceEvents(workspaceId, parseCursor(since ?? null));
+    },
+
+    async listInbox(workspaceId: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/inbox");
+        return requestRemoteOpenwork<{ items: Array<Record<string, unknown>> }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 15_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const items = await listArtifacts(resolveInboxDir(resolveWorkspaceRoot(workspace)));
+      return {
+        items: items.map((item) => ({ ...item, id: encodeArtifactId(item.path), name: path.basename(item.path) })),
+      };
+    },
+
+    async readSimpleContent(workspaceId: string, relativePathInput: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/files/content?path=${encodeURIComponent(relativePathInput)}`);
+        return requestRemoteOpenwork<{ bytes: number; content: string; path: string; updatedAt: number; revision?: string }>({
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 15_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const relativePath = normalizeWorkspaceRelativePath(relativePathInput, { allowSubdirs: true });
+      if (!/\.(md|mdx|markdown)$/i.test(relativePath)) {
+        throw new RouteError(400, "invalid_request", "Only markdown files are supported by the simple content routes.");
+      }
+      const absolutePath = resolveSafeChildPath(resolveWorkspaceRoot(workspace), relativePath);
+      if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+        throw new HTTPException(404, { message: "File not found." });
+      }
+      const info = fs.statSync(absolutePath);
+      if (info.size > FILE_SESSION_MAX_FILE_BYTES) {
+        throw new RouteError(413, "invalid_request", "File exceeds the maximum supported size.");
+      }
+      return {
+        bytes: info.size,
+        content: fs.readFileSync(absolutePath, "utf8"),
+        path: relativePath,
+        updatedAt: info.mtimeMs,
+      };
+    },
+
+    async readWorkspaceFiles(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", paths: unknown) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/read-batch`);
+        return requestRemoteOpenwork<{ items: Array<Record<string, unknown>> }>({
+          body: { paths },
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 20_000,
+        });
+      }
+      const { workspaceRoot } = resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      const items = parseBatchPathList(paths).map((relativePath) => {
+        try {
+          const absolutePath = resolveSafeChildPath(workspaceRoot, relativePath);
+          if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+            return { code: "file_not_found", message: "File not found", ok: false, path: relativePath };
+          }
+          const info = fs.statSync(absolutePath);
+          if (info.size > FILE_SESSION_MAX_FILE_BYTES) {
+            return { code: "file_too_large", maxBytes: FILE_SESSION_MAX_FILE_BYTES, message: "File exceeds size limit", ok: false, path: relativePath, size: info.size };
+          }
+          return {
+            bytes: info.size,
+            contentBase64: fs.readFileSync(absolutePath).toString("base64"),
+            kind: "file",
+            ok: true,
+            path: relativePath,
+            revision: fileRevision(info),
+            updatedAt: info.mtimeMs,
+          };
+        } catch (error) {
+          return { code: "read_failed", message: error instanceof Error ? error.message : "Unable to read file", ok: false, path: relativePath };
+        }
+      });
+      return { items };
+    },
+
+    async reloadWorkspaceEngine(workspaceId: string) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/engine/reload");
+        return requestRemoteOpenwork<{ reloadedAt: number }>({
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 20_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      await input.runtime.dispose();
+      await input.runtime.bootstrap();
+      reloadEvents.record(workspace.id, "config", { action: "updated", name: "engine", type: "config" }, 0);
+      await audit(workspace, "engine.reload", workspace.dataDir ?? workspace.id, "Reloaded workspace engine through Server V2.");
+      return { reloadedAt: nowMs() };
+    },
+
+    reconcileAll,
+
+    updateWorkspaceDisplayName(workspaceId: string, displayName: string | null) {
+      const workspace = input.repositories.workspaces.getById(workspaceId);
+      if (!workspace) {
+        throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+      }
+      return input.repositories.workspaces.upsert({
+        ...workspace,
+        displayName: displayName?.trim() || workspace.displayName,
+      });
+    },
+
+    renewWorkspaceFileSession(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", ttlSeconds?: number) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/renew`);
+        return requestRemoteOpenwork<{
+          canWrite: boolean;
+          createdAt: number;
+          expiresAt: number;
+          id: string;
+          ttlMs: number;
+          workspaceId: string;
+        }>({
+          body: ttlSeconds === undefined ? {} : { ttlSeconds },
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 10_000,
+        });
+      }
+      resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      const renewed = fileSessions.renew(sessionId, parseFileSessionTtlMs(ttlSeconds));
+      if (!renewed) {
+        throw new HTTPException(404, { message: "File session not found." });
+      }
+      return {
+        canWrite: renewed.canWrite,
+        createdAt: renewed.createdAt,
+        expiresAt: renewed.expiresAt,
+        id: renewed.id,
+        ttlMs: Math.max(0, renewed.expiresAt - nowMs()),
+        workspaceId,
+      };
+    },
+
+    closeWorkspaceFileSession(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host") {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}`);
+        return requestRemoteOpenwork<{ closed?: boolean }>({
+          method: "DELETE",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 10_000,
+        });
+      }
+      resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      fileSessions.close(sessionId);
+      return { closed: true };
+    },
+
+    async uploadInboxItem(workspaceId: string, requestedPath: string, file: File) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const form = new FormData();
+        form.append("file", file);
+        if (requestedPath.trim()) {
+          form.append("path", requestedPath.trim());
+        }
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/inbox");
+        const response = await requestRemoteOpenworkRaw({
+          body: form,
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 30_000,
+        });
+        const text = await response.text();
+        return text.trim() ? JSON.parse(text) as { bytes: number; path: string } : { bytes: file.size, path: requestedPath || file.name };
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const rootDir = resolveInboxDir(resolveWorkspaceRoot(workspace));
+      const relativePath = normalizeWorkspaceRelativePath(requestedPath || file.name, { allowSubdirs: true });
+      if (file.size > FILE_SESSION_MAX_FILE_BYTES) {
+        throw new RouteError(413, "invalid_request", "File exceeds the maximum supported size.");
+      }
+      const absolutePath = resolveSafeChildPath(rootDir, relativePath);
+      fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+      fs.writeFileSync(absolutePath, Buffer.from(await file.arrayBuffer()));
+      await audit(workspace, "workspace.inbox.upload", absolutePath, `Uploaded ${relativePath} to the workspace inbox.`);
+      return { bytes: file.size, path: relativePath };
+    },
+
+    async writeSimpleContent(workspaceId: string, inputValue: { baseUpdatedAt?: number | null; content: string; force?: boolean; path: string }) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, "/files/content");
+        return requestRemoteOpenwork<{ bytes: number; path: string; revision?: string; updatedAt: number }>({
+          body: inputValue,
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 20_000,
+        });
+      }
+      const workspace = resolveWorkspaceOrThrow(input.repositories, workspaceId);
+      const relativePath = normalizeWorkspaceRelativePath(inputValue.path, { allowSubdirs: true });
+      if (!/\.(md|mdx|markdown)$/i.test(relativePath)) {
+        throw new RouteError(400, "invalid_request", "Only markdown files are supported by the simple content routes.");
+      }
+      const absolutePath = resolveSafeChildPath(resolveWorkspaceRoot(workspace), relativePath);
+      const before = fs.existsSync(absolutePath) ? fs.statSync(absolutePath) : null;
+      if (before && !before.isFile()) {
+        throw new RouteError(400, "invalid_request", "Path must point to a file.");
+      }
+      if (!inputValue.force && before && inputValue.baseUpdatedAt !== undefined && inputValue.baseUpdatedAt !== null && before.mtimeMs !== inputValue.baseUpdatedAt) {
+        throw new RouteError(409, "conflict", "File changed since it was loaded.");
+      }
+      if (Buffer.byteLength(inputValue.content, "utf8") > FILE_SESSION_MAX_FILE_BYTES) {
+        throw new RouteError(413, "invalid_request", "File exceeds the maximum supported size.");
+      }
+      fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+      fs.writeFileSync(absolutePath, inputValue.content, "utf8");
+      const after = fs.statSync(absolutePath);
+      fileSessions.recordWorkspaceEvent({ path: relativePath, revision: fileRevision(after), type: "write", workspaceId });
+      reloadEvents.record(workspaceId, "config", { action: "updated", name: path.basename(relativePath), path: absolutePath, type: "config" });
+      await audit(workspace, "workspace.file.write", absolutePath, `Wrote ${relativePath} through the simple content route.`);
+      return { bytes: Buffer.byteLength(inputValue.content, "utf8"), path: relativePath, revision: fileRevision(after), updatedAt: after.mtimeMs };
+    },
+
+    async writeWorkspaceFiles(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", writes: unknown) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/write-batch`);
+        return requestRemoteOpenwork<{ cursor: number; items: Array<Record<string, unknown>> }>({
+          body: { writes },
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 30_000,
+        });
+      }
+      const { session, workspace, workspaceRoot } = resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      if (!session.canWrite) {
+        throw new HTTPException(403, { message: "File session is read-only." });
+      }
+      const items: Array<Record<string, unknown>> = [];
+      for (const write of parseBatchWriteList(writes)) {
+        try {
+          const absolutePath = resolveSafeChildPath(workspaceRoot, write.path);
+          const bytes = Buffer.from(write.contentBase64, "base64");
+          if (bytes.byteLength > FILE_SESSION_MAX_FILE_BYTES) {
+            items.push({ code: "file_too_large", maxBytes: FILE_SESSION_MAX_FILE_BYTES, message: "File exceeds size limit", ok: false, path: write.path, size: bytes.byteLength });
+            continue;
+          }
+          const before = fs.existsSync(absolutePath) ? fs.statSync(absolutePath) : null;
+          const currentRevision = before ? fileRevision(before) : null;
+          if (!write.force && write.ifMatchRevision && currentRevision !== write.ifMatchRevision) {
+            items.push({ code: "conflict", currentRevision, expectedRevision: write.ifMatchRevision, message: "File changed since it was loaded", ok: false, path: write.path });
+            continue;
+          }
+          fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+          fs.writeFileSync(absolutePath, bytes);
+          const after = fs.statSync(absolutePath);
+          const revision = fileRevision(after);
+          fileSessions.recordWorkspaceEvent({ path: write.path, revision, type: "write", workspaceId });
+          reloadEvents.record(workspaceId, "config", { action: "updated", name: path.basename(write.path), path: absolutePath, type: "config" });
+          await audit(workspace, "workspace.files.session.write", absolutePath, `Wrote ${write.path} through a file session.`);
+          items.push({ bytes: bytes.byteLength, ok: true, path: write.path, previousRevision: currentRevision, revision, updatedAt: after.mtimeMs });
+        } catch (error) {
+          items.push({ code: "write_failed", message: error instanceof Error ? error.message : "Failed to write file", ok: false, path: write.path });
+        }
+      }
+      return { cursor: fileSessions.listWorkspaceEvents(workspaceId, Number.MAX_SAFE_INTEGER).cursor, items };
+    },
+
+    async workspaceFileOperations(workspaceId: string, sessionId: string, actorKey: string, actorKind: "client" | "host", operations: unknown) {
+      const workspaceRecord = resolveWorkspaceRecordOrThrow(input.repositories, workspaceId);
+      if (workspaceRecord.kind === "remote") {
+        const remote = getRemoteWorkspacePath(workspaceRecord, `/file-sessions/${encodeURIComponent(sessionId)}/operations`);
+        return requestRemoteOpenwork<{ cursor: number; items: Array<Record<string, unknown>> }>({
+          body: { operations },
+          method: "POST",
+          path: remote.path,
+          server: remote.server,
+          timeoutMs: 30_000,
+        });
+      }
+      const { session, workspace, workspaceRoot } = resolveFileSession(workspaceId, sessionId, actorKey, actorKind);
+      if (!session.canWrite) {
+        throw new HTTPException(403, { message: "File session is read-only." });
+      }
+      const items: Array<Record<string, unknown>> = [];
+      for (const operation of parseOperations(operations)) {
+        const type = String(operation.type ?? "").trim();
+        try {
+          if (type === "mkdir") {
+            const relativePath = normalizeWorkspaceRelativePath(String(operation.path ?? ""), { allowSubdirs: true });
+            const absolutePath = resolveSafeChildPath(workspaceRoot, relativePath);
+            fs.mkdirSync(absolutePath, { recursive: true });
+            fileSessions.recordWorkspaceEvent({ path: relativePath, type: "mkdir", workspaceId });
+            reloadEvents.record(workspaceId, "config", { action: "updated", name: path.basename(relativePath), path: absolutePath, type: "config" });
+            items.push({ ok: true, path: relativePath, type });
+            continue;
+          }
+          if (type === "delete") {
+            const relativePath = normalizeWorkspaceRelativePath(String(operation.path ?? ""), { allowSubdirs: true });
+            const absolutePath = resolveSafeChildPath(workspaceRoot, relativePath);
+            if (!fs.existsSync(absolutePath)) {
+              items.push({ code: "file_not_found", message: "Path not found", ok: false, path: relativePath, type });
+              continue;
+            }
+            fs.rmSync(absolutePath, { force: false, recursive: operation.recursive === true });
+            fileSessions.recordWorkspaceEvent({ path: relativePath, type: "delete", workspaceId });
+            reloadEvents.record(workspaceId, "config", { action: "removed", name: path.basename(relativePath), path: absolutePath, type: "config" });
+            await audit(workspace, "workspace.files.session.delete", absolutePath, `Deleted ${relativePath} through a file session.`);
+            items.push({ ok: true, path: relativePath, type });
+            continue;
+          }
+          if (type === "rename") {
+            const from = normalizeWorkspaceRelativePath(String(operation.from ?? ""), { allowSubdirs: true });
+            const to = normalizeWorkspaceRelativePath(String(operation.to ?? ""), { allowSubdirs: true });
+            const fromAbsolute = resolveSafeChildPath(workspaceRoot, from);
+            const toAbsolute = resolveSafeChildPath(workspaceRoot, to);
+            if (!fs.existsSync(fromAbsolute)) {
+              items.push({ code: "file_not_found", from, message: "Source path not found", ok: false, to, type });
+              continue;
+            }
+            fs.mkdirSync(path.dirname(toAbsolute), { recursive: true });
+            fs.renameSync(fromAbsolute, toAbsolute);
+            fileSessions.recordWorkspaceEvent({ path: from, toPath: to, type: "rename", workspaceId });
+            reloadEvents.record(workspaceId, "config", { action: "updated", name: path.basename(to), path: toAbsolute, type: "config" });
+            await audit(workspace, "workspace.files.session.rename", `${fromAbsolute} -> ${toAbsolute}`, `Renamed ${from} to ${to} through a file session.`);
+            items.push({ from, ok: true, to, type });
+            continue;
+          }
+          items.push({ code: "invalid_operation", message: `Unsupported operation type: ${type}`, ok: false, type });
+        } catch (error) {
+          items.push({ code: "operation_failed", message: error instanceof Error ? error.message : "Operation failed", ok: false, type });
+        }
+      }
+      return { cursor: fileSessions.listWorkspaceEvents(workspaceId, Number.MAX_SAFE_INTEGER).cursor, items };
+    },
+  };
+}
diff --git a/apps/server-v2/src/services/workspace-registry-service.ts b/apps/server-v2/src/services/workspace-registry-service.ts
new file mode 100644
index 0000000000..a04eb30e90
--- /dev/null
+++ b/apps/server-v2/src/services/workspace-registry-service.ts
@@ -0,0 +1,191 @@
+import type { ServerRegistryService } from "./server-registry-service.js";
+import type { ServerRepositories } from "../database/repositories.js";
+import type {
+  BackendKind,
+  JsonObject,
+  WorkspaceKind,
+  WorkspaceRecord,
+  WorkspaceRuntimeStateRecord,
+} from "../database/types.js";
+
+type WorkspacePreset = "minimal" | "remote" | "starter";
+
+export type WorkspaceBackend = {
+  kind: BackendKind;
+  local: null | {
+    configDir: string | null;
+    dataDir: string | null;
+    opencodeProjectId: string | null;
+  };
+  remote: null | {
+    directory: string | null;
+    hostUrl: string | null;
+    remoteType: "openwork" | "opencode";
+    remoteWorkspaceId: string | null;
+    workspaceName: string | null;
+  };
+  serverId: string;
+};
+
+export type WorkspaceRuntimeSummary = {
+  backendKind: BackendKind;
+  health: JsonObject | null;
+  lastError: JsonObject | null;
+  lastSessionRefreshAt: string | null;
+  lastSyncAt: string | null;
+  updatedAt: string | null;
+};
+
+export type WorkspaceSummary = {
+  backend: WorkspaceBackend;
+  createdAt: string;
+  displayName: string;
+  hidden: boolean;
+  id: string;
+  kind: WorkspaceKind;
+  preset: WorkspacePreset;
+  runtime: WorkspaceRuntimeSummary;
+  server: ReturnType<ServerRegistryService["serialize"]>;
+  slug: string;
+  status: WorkspaceRecord["status"];
+  updatedAt: string;
+};
+
+export type WorkspaceDetail = WorkspaceSummary & {
+  notes: JsonObject | null;
+};
+
+export type WorkspaceRegistryService = ReturnType<typeof createWorkspaceRegistryService>;
+
+function asJsonObject(value: unknown): JsonObject | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+
+  return value as JsonObject;
+}
+
+function readPreset(workspace: WorkspaceRecord): WorkspacePreset {
+  const legacyDesktop = asJsonObject(workspace.notes?.legacyDesktop);
+  const preset = typeof legacyDesktop?.preset === "string" ? legacyDesktop.preset.trim().toLowerCase() : "";
+  if (preset === "minimal" || preset === "starter") {
+    return preset;
+  }
+
+  return workspace.kind === "remote" ? "remote" : "starter";
+}
+
+function readRemoteDirectory(workspace: WorkspaceRecord) {
+  const value = workspace.notes?.directory;
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function readRemoteType(workspace: WorkspaceRecord): "openwork" | "opencode" {
+  const explicit = workspace.notes?.remoteType;
+  return explicit === "opencode" ? "opencode" : "openwork";
+}
+
+function readRemoteWorkspaceName(workspace: WorkspaceRecord) {
+  const legacyDesktop = asJsonObject(workspace.notes?.legacyDesktop);
+  const value = legacyDesktop?.openworkWorkspaceName;
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function serializeRuntimeState(runtimeState: WorkspaceRuntimeStateRecord | null, backendKind: BackendKind): WorkspaceRuntimeSummary {
+  return {
+    backendKind,
+    health: runtimeState?.health ?? null,
+    lastError: runtimeState?.lastError ?? null,
+    lastSessionRefreshAt: runtimeState?.lastSessionRefreshAt ?? null,
+    lastSyncAt: runtimeState?.lastSyncAt ?? null,
+    updatedAt: runtimeState?.updatedAt ?? null,
+  };
+}
+
+export function createWorkspaceRegistryService(input: {
+  repositories: ServerRepositories;
+  servers: ServerRegistryService;
+}) {
+  const { repositories } = input;
+
+  function resolveBackend(workspace: WorkspaceRecord): WorkspaceBackend {
+    const runtimeState = repositories.workspaceRuntimeState.getByWorkspaceId(workspace.id);
+    const backendKind = runtimeState?.backendKind ?? (workspace.kind === "remote" ? "remote_openwork" : "local_opencode");
+
+    if (backendKind === "remote_openwork") {
+      const server = input.servers.getById(workspace.serverId);
+      return {
+        kind: backendKind,
+        local: null,
+        remote: {
+          directory: readRemoteDirectory(workspace),
+          hostUrl: server?.baseUrl ?? null,
+          remoteType: readRemoteType(workspace),
+          remoteWorkspaceId: workspace.remoteWorkspaceId,
+          workspaceName: readRemoteWorkspaceName(workspace),
+        },
+        serverId: workspace.serverId,
+      };
+    }
+
+    return {
+      kind: "local_opencode",
+      local: {
+        configDir: workspace.configDir,
+        dataDir: workspace.dataDir,
+        opencodeProjectId: workspace.opencodeProjectId,
+      },
+      remote: null,
+      serverId: workspace.serverId,
+    };
+  }
+
+  function serializeWorkspace(workspace: WorkspaceRecord) {
+    const server = input.servers.getById(workspace.serverId);
+    if (!server) {
+      throw new Error(`Workspace ${workspace.id} points at missing server ${workspace.serverId}.`);
+    }
+
+    const backend = resolveBackend(workspace);
+    const runtimeState = repositories.workspaceRuntimeState.getByWorkspaceId(workspace.id);
+    return {
+      backend,
+      createdAt: workspace.createdAt,
+      displayName: workspace.displayName,
+      hidden: workspace.isHidden,
+      id: workspace.id,
+      kind: workspace.kind,
+      notes: workspace.notes,
+      preset: readPreset(workspace),
+      runtime: serializeRuntimeState(runtimeState, backend.kind),
+      server: input.servers.serialize(server, { includeBaseUrl: false }),
+      slug: workspace.slug,
+      status: workspace.status,
+      updatedAt: workspace.updatedAt,
+    } satisfies WorkspaceDetail;
+  }
+
+  function canReadWorkspace(workspace: WorkspaceRecord, options?: { includeHidden?: boolean }) {
+    return options?.includeHidden === true || !workspace.isHidden;
+  }
+
+  return {
+    getById(workspaceId: string, options?: { includeHidden?: boolean }) {
+      const workspace = repositories.workspaces.getById(workspaceId);
+      if (!workspace || !canReadWorkspace(workspace, options)) {
+        return null;
+      }
+      return serializeWorkspace(workspace);
+    },
+
+    list(options?: { includeHidden?: boolean }) {
+      return repositories.workspaces
+        .list({ includeHidden: options?.includeHidden ?? false })
+        .filter((workspace) => canReadWorkspace(workspace, options))
+        .map((workspace) => serializeWorkspace(workspace));
+    },
+
+    resolveBackend,
+    serializeWorkspace,
+  };
+}
diff --git a/apps/server-v2/src/services/workspace-session-service.ts b/apps/server-v2/src/services/workspace-session-service.ts
new file mode 100644
index 0000000000..f9d9d2914f
--- /dev/null
+++ b/apps/server-v2/src/services/workspace-session-service.ts
@@ -0,0 +1,299 @@
+import { HTTPException } from "hono/http-exception";
+import type { ServerRepositories } from "../database/repositories.js";
+import type { WorkspaceRecord } from "../database/types.js";
+import { RouteError } from "../http.js";
+import type {
+  SessionMessageRecord,
+  SessionRecord,
+  SessionSnapshotRecord,
+  SessionStatusRecord,
+  SessionTodoRecord,
+  WorkspaceEventRecord,
+} from "../schemas/sessions.js";
+import type { RuntimeService } from "./runtime-service.js";
+import { createLocalOpencodeSessionAdapter } from "../adapters/sessions/local-opencode.js";
+import { OpenCodeBackendError } from "../adapters/sessions/opencode-backend.js";
+import { createRemoteOpenworkSessionAdapter } from "../adapters/sessions/remote-openwork.js";
+
+type SessionBackend = ReturnType<typeof createLocalOpencodeSessionAdapter>;
+
+function toBackendKind(workspace: WorkspaceRecord) {
+  return workspace.kind === "remote" ? "remote_openwork" : "local_opencode";
+}
+
+function readRuntimeState(repositories: ServerRepositories, workspace: WorkspaceRecord) {
+  return repositories.workspaceRuntimeState.getByWorkspaceId(workspace.id);
+}
+
+function recordSuccess(repositories: ServerRepositories, workspace: WorkspaceRecord, input: { refresh?: boolean; sync?: boolean }) {
+  const current = readRuntimeState(repositories, workspace);
+  const now = new Date().toISOString();
+  repositories.workspaceRuntimeState.upsert({
+    backendKind: current?.backendKind ?? toBackendKind(workspace),
+    health: current?.health ?? null,
+    lastError: null,
+    lastSessionRefreshAt: input.refresh ? now : current?.lastSessionRefreshAt ?? null,
+    lastSyncAt: input.sync ? now : current?.lastSyncAt ?? null,
+    workspaceId: workspace.id,
+  });
+}
+
+function recordError(repositories: ServerRepositories, workspace: WorkspaceRecord, error: RouteError | Error) {
+  const current = readRuntimeState(repositories, workspace);
+  repositories.workspaceRuntimeState.upsert({
+    backendKind: current?.backendKind ?? toBackendKind(workspace),
+    health: current?.health ?? null,
+    lastError: {
+      code: error instanceof RouteError ? error.code : "internal_error",
+      message: error.message,
+      recordedAt: new Date().toISOString(),
+    },
+    lastSessionRefreshAt: current?.lastSessionRefreshAt ?? null,
+    lastSyncAt: current?.lastSyncAt ?? null,
+    workspaceId: workspace.id,
+  });
+}
+
+function remapBackendError(error: unknown) {
+  if (error instanceof RouteError) {
+    throw error;
+  }
+
+  if (error instanceof OpenCodeBackendError) {
+    if (error.status === 400) {
+      throw new RouteError(400, "invalid_request", "Upstream session backend rejected the request.");
+    }
+    if (error.status === 404) {
+      throw new HTTPException(404, { message: "Requested session resource was not found." });
+    }
+    if (error.status === 501) {
+      throw new RouteError(501, "not_implemented", error.message || "Session operation is not supported by the resolved backend.");
+    }
+    throw new RouteError(502, "bad_gateway", error.message || "Resolved session backend request failed.");
+  }
+
+  if (error instanceof HTTPException) {
+    throw error;
+  }
+
+  throw new RouteError(500, "internal_error", error instanceof Error ? error.message : "Unexpected session service failure.");
+}
+
+export type WorkspaceSessionService = ReturnType<typeof createWorkspaceSessionService>;
+
+export function createWorkspaceSessionService(input: {
+  repositories: ServerRepositories;
+  runtime: RuntimeService;
+}) {
+  function getWorkspaceOrThrow(workspaceId: string) {
+    const workspace = input.repositories.workspaces.getById(workspaceId);
+    if (!workspace) {
+      throw new HTTPException(404, { message: `Workspace not found: ${workspaceId}` });
+    }
+    return workspace;
+  }
+
+  function resolveBackend(workspace: WorkspaceRecord): SessionBackend {
+    if (workspace.kind === "remote") {
+      const server = input.repositories.servers.getById(workspace.serverId);
+      if (!server) {
+        throw new RouteError(502, "bad_gateway", `Workspace ${workspace.id} points at missing server ${workspace.serverId}.`);
+      }
+      return createRemoteOpenworkSessionAdapter({ server, workspace });
+    }
+
+    return createLocalOpencodeSessionAdapter({ runtime: input.runtime, workspace });
+  }
+
+  async function runRead<T>(workspaceId: string, operation: (backend: SessionBackend) => Promise<T>) {
+    const workspace = getWorkspaceOrThrow(workspaceId);
+    try {
+      const result = await operation(resolveBackend(workspace));
+      recordSuccess(input.repositories, workspace, { refresh: true });
+      return result;
+    } catch (error) {
+      const remapped = (() => {
+        try {
+          remapBackendError(error);
+        } catch (next) {
+          return next;
+        }
+        return error;
+      })();
+      recordError(input.repositories, workspace, remapped as Error);
+      throw remapped;
+    }
+  }
+
+  async function runMutation<T>(workspaceId: string, operation: (backend: SessionBackend) => Promise<T>) {
+    const workspace = getWorkspaceOrThrow(workspaceId);
+    try {
+      const result = await operation(resolveBackend(workspace));
+      recordSuccess(input.repositories, workspace, { refresh: true, sync: true });
+      return result;
+    } catch (error) {
+      const remapped = (() => {
+        try {
+          remapBackendError(error);
+        } catch (next) {
+          return next;
+        }
+        return error;
+      })();
+      recordError(input.repositories, workspace, remapped as Error);
+      throw remapped;
+    }
+  }
+
+  async function runAsyncMutation(workspaceId: string, operation: (backend: SessionBackend) => Promise<unknown>) {
+    const workspace = getWorkspaceOrThrow(workspaceId);
+    let backend: SessionBackend;
+    try {
+      backend = resolveBackend(workspace);
+    } catch (error) {
+      remapBackendError(error);
+      throw error;
+    }
+
+    void operation(backend)
+      .then(() => recordSuccess(input.repositories, workspace, { refresh: true, sync: true }))
+      .catch((error) => {
+        const remapped = (() => {
+          try {
+            remapBackendError(error);
+          } catch (next) {
+            return next;
+          }
+          return error;
+        })();
+        recordError(input.repositories, workspace, remapped as Error);
+      });
+
+    return { accepted: true };
+  }
+
+  return {
+    abortSession(workspaceId: string, sessionId: string) {
+      return runMutation(workspaceId, (backend) => backend.abortSession(sessionId));
+    },
+
+    command(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runAsyncMutation(workspaceId, (backend) => backend.command(sessionId, body));
+    },
+
+    createSession(workspaceId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.createSession(body));
+    },
+
+    deleteMessage(workspaceId: string, sessionId: string, messageId: string) {
+      return runMutation(workspaceId, (backend) => backend.deleteMessage(sessionId, messageId));
+    },
+
+    deleteMessagePart(workspaceId: string, sessionId: string, messageId: string, partId: string) {
+      return runMutation(workspaceId, (backend) => backend.deleteMessagePart(sessionId, messageId, partId));
+    },
+
+    deleteSession(workspaceId: string, sessionId: string) {
+      return runMutation(workspaceId, (backend) => backend.deleteSession(sessionId));
+    },
+
+    forkSession(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.forkSession(sessionId, body));
+    },
+
+    getMessage(workspaceId: string, sessionId: string, messageId: string): Promise<SessionMessageRecord> {
+      return runRead(workspaceId, (backend) => backend.getMessage(sessionId, messageId));
+    },
+
+    getSession(workspaceId: string, sessionId: string): Promise<SessionRecord> {
+      return runRead(workspaceId, (backend) => backend.getSession(sessionId));
+    },
+
+    getSessionSnapshot(workspaceId: string, sessionId: string, input?: { limit?: number }): Promise<SessionSnapshotRecord> {
+      return runRead(workspaceId, (backend) => backend.getSessionSnapshot(sessionId, input));
+    },
+
+    async getSessionStatus(workspaceId: string, sessionId: string): Promise<SessionStatusRecord> {
+      const statuses = await runRead(workspaceId, (backend) => backend.listStatuses());
+      return statuses[sessionId] ?? { type: "idle" };
+    },
+
+    initSession(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.initSession(sessionId, body));
+    },
+
+    listMessages(workspaceId: string, sessionId: string, input?: { limit?: number }): Promise<SessionMessageRecord[]> {
+      return runRead(workspaceId, (backend) => backend.listMessages(sessionId, input));
+    },
+
+    listSessions(workspaceId: string, input?: { limit?: number; roots?: boolean; search?: string; start?: number }): Promise<SessionRecord[]> {
+      return runRead(workspaceId, (backend) => backend.listSessions(input));
+    },
+
+    listSessionStatuses(workspaceId: string): Promise<Record<string, SessionStatusRecord>> {
+      return runRead(workspaceId, (backend) => backend.listStatuses());
+    },
+
+    listTodos(workspaceId: string, sessionId: string): Promise<SessionTodoRecord[]> {
+      return runRead(workspaceId, (backend) => backend.listTodos(sessionId));
+    },
+
+    promptAsync(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.promptAsync(sessionId, body));
+    },
+
+    revert(workspaceId: string, sessionId: string, body: { messageID: string }) {
+      return runMutation(workspaceId, (backend) => backend.revert(sessionId, body));
+    },
+
+    sendMessage(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.sendMessage(sessionId, body));
+    },
+
+    shareSession(workspaceId: string, sessionId: string) {
+      return runMutation(workspaceId, (backend) => backend.shareSession(sessionId));
+    },
+
+    shell(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.shell(sessionId, body));
+    },
+
+    async streamWorkspaceEvents(workspaceId: string, signal?: AbortSignal): Promise<AsyncIterable<WorkspaceEventRecord>> {
+      const workspace = getWorkspaceOrThrow(workspaceId);
+      try {
+        return await resolveBackend(workspace).streamEvents(signal);
+      } catch (error) {
+        const remapped = (() => {
+          try {
+            remapBackendError(error);
+          } catch (next) {
+            return next;
+          }
+          return error;
+        })();
+        recordError(input.repositories, workspace, remapped as Error);
+        throw remapped;
+      }
+    },
+
+    summarizeSession(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.summarizeSession(sessionId, body));
+    },
+
+    unshareSession(workspaceId: string, sessionId: string) {
+      return runMutation(workspaceId, (backend) => backend.unshareSession(sessionId));
+    },
+
+    unrevert(workspaceId: string, sessionId: string) {
+      return runMutation(workspaceId, (backend) => backend.unrevert(sessionId));
+    },
+
+    updateMessagePart(workspaceId: string, sessionId: string, messageId: string, partId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.updateMessagePart(sessionId, messageId, partId, body));
+    },
+
+    updateSession(workspaceId: string, sessionId: string, body: Record<string, unknown>) {
+      return runMutation(workspaceId, (backend) => backend.updateSession(sessionId, body));
+    },
+  };
+}
diff --git a/apps/server-v2/src/sessions.test.ts b/apps/server-v2/src/sessions.test.ts
new file mode 100644
index 0000000000..762afdbe87
--- /dev/null
+++ b/apps/server-v2/src/sessions.test.ts
@@ -0,0 +1,324 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createApp } from "./app.js";
+import { createAppDependencies } from "./context/app-dependencies.js";
+
+type Served = {
+  port: number;
+  stop: (closeActiveConnections?: boolean) => void | Promise<void>;
+};
+
+const stops: Array<() => void | Promise<void>> = [];
+
+afterEach(async () => {
+  while (stops.length) {
+    await stops.pop()?.();
+  }
+});
+
+function createTestApp() {
+  const dependencies = createAppDependencies({
+    environment: "test",
+    inMemory: true,
+    legacy: {
+      desktopDataDir: `/tmp/openwork-server-v2-phase6-desktop-${Math.random().toString(16).slice(2)}`,
+      orchestratorDataDir: `/tmp/openwork-server-v2-phase6-orchestrator-${Math.random().toString(16).slice(2)}`,
+    },
+    runtime: {
+      bootstrapPolicy: "disabled",
+    },
+    startedAt: new Date("2026-04-14T00:00:00.000Z"),
+    version: "0.0.0-test",
+  });
+
+  return {
+    app: createApp({ dependencies }),
+    dependencies,
+  };
+}
+
+function withMockOpencodeBaseUrl(dependencies: ReturnType<typeof createAppDependencies>, baseUrl: string) {
+  dependencies.services.runtime.getOpencodeHealth = () => ({
+    baseUrl,
+    binaryPath: null,
+    diagnostics: { combined: [], stderr: [], stdout: [], totalLines: 0, truncated: false },
+    lastError: null,
+    lastExit: null,
+    lastReadyAt: null,
+    lastStartedAt: null,
+    manifest: null,
+    pid: 123,
+    running: true,
+    source: "development",
+    status: "running",
+    version: "1.2.3",
+  });
+}
+
+function startMockOpencode(options?: { expectBearer?: string; holdCommand?: Promise<void>; mountPrefix?: string }) {
+  const requests: Array<{ method: string; pathname: string; authorization: string | null; body: unknown }> = [];
+  const prefix = options?.mountPrefix?.replace(/\/+$/, "") ?? "";
+
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    async fetch(request) {
+      const url = new URL(request.url);
+      const pathname = prefix && url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) || "/" : url.pathname;
+      const authorization = request.headers.get("authorization");
+      requests.push({ method: request.method, pathname, authorization, body: null });
+
+      if (options?.expectBearer) {
+        expect(authorization).toBe(`Bearer ${options.expectBearer}`);
+      }
+
+      if (pathname === "/event") {
+        const stream = new ReadableStream({
+          start(controller) {
+            controller.enqueue(`data: ${JSON.stringify({ type: "session.status", properties: { sessionID: "ses_1", status: { type: "busy" } } })}\n\n`);
+            controller.enqueue(`data: ${JSON.stringify({ type: "session.idle", properties: { sessionID: "ses_1" } })}\n\n`);
+            controller.close();
+          },
+        });
+        return new Response(stream, {
+          headers: {
+            "Content-Type": "text/event-stream",
+          },
+        });
+      }
+
+      if (pathname === "/session" && request.method === "GET") {
+        return Response.json([
+          {
+            id: "ses_1",
+            title: "Session One",
+            directory: "/tmp/workspace",
+            time: { created: 100, updated: 200 },
+          },
+        ]);
+      }
+
+      if (pathname === "/session/status" && request.method === "GET") {
+        return Response.json({ ses_1: { type: "busy" } });
+      }
+
+      if (pathname === "/session" && request.method === "POST") {
+        return Response.json({
+          id: "ses_created",
+          title: "Created Session",
+          directory: "/tmp/workspace",
+          time: { created: 300, updated: 300 },
+        });
+      }
+
+      if (pathname === "/session/ses_1" && request.method === "GET") {
+        return Response.json({
+          id: "ses_1",
+          title: "Session One",
+          directory: "/tmp/workspace",
+          time: { created: 100, updated: 200 },
+        });
+      }
+
+      if (pathname === "/session/ses_1" && request.method === "PATCH") {
+        return Response.json({
+          id: "ses_1",
+          title: "Renamed Session",
+          directory: "/tmp/workspace",
+          time: { created: 100, updated: 250 },
+        });
+      }
+
+      if (pathname === "/session/ses_1" && request.method === "DELETE") {
+        return new Response(null, { status: 204 });
+      }
+
+      if (pathname === "/session/ses_1/message" && request.method === "GET") {
+        return Response.json([
+          {
+            info: {
+              id: "msg_1",
+              role: "assistant",
+              sessionID: "ses_1",
+            },
+            parts: [
+              {
+                id: "prt_1",
+                messageID: "msg_1",
+                sessionID: "ses_1",
+                type: "text",
+                text: "hello",
+              },
+            ],
+          },
+        ]);
+      }
+
+      if (pathname === "/session/ses_1/message/msg_1" && request.method === "GET") {
+        return Response.json({
+          info: {
+            id: "msg_1",
+            role: "assistant",
+            sessionID: "ses_1",
+          },
+          parts: [
+            {
+              id: "prt_1",
+              messageID: "msg_1",
+              sessionID: "ses_1",
+              type: "text",
+              text: "hello",
+            },
+          ],
+        });
+      }
+
+      if (pathname === "/session/ses_1/todo" && request.method === "GET") {
+        return Response.json([
+          { content: "Ship Phase 6", priority: "high", status: "completed" },
+        ]);
+      }
+
+      if (pathname === "/session/ses_1/prompt_async" && request.method === "POST") {
+        return Response.json({ ok: true });
+      }
+
+      if (pathname === "/session/ses_1/command" && request.method === "POST") {
+        await options?.holdCommand;
+        return Response.json({ ok: true });
+      }
+
+      if (pathname === "/session/ses_1/revert" && request.method === "POST") {
+        return Response.json({
+          id: "ses_1",
+          title: "Reverted Session",
+          directory: "/tmp/workspace",
+          time: { created: 100, updated: 260 },
+        });
+      }
+
+      if (pathname === "/session/ses_1/unrevert" && request.method === "POST") {
+        return Response.json({
+          id: "ses_1",
+          title: "Restored Session",
+          directory: "/tmp/workspace",
+          time: { created: 100, updated: 270 },
+        });
+      }
+
+      return Response.json({ code: "not_found", message: "Not found" }, { status: 404 });
+    },
+  }) as Served;
+
+  stops.push(() => server.stop(true));
+  return {
+    requests,
+    url: `http://127.0.0.1:${server.port}`,
+  };
+}
+
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>((next) => {
+    resolve = next;
+  });
+  return { promise, resolve };
+}
+
+describe("workspace session routes", () => {
+  test("serves local workspace session reads, writes, and streaming", async () => {
+    const mock = startMockOpencode();
+    const { app, dependencies } = createTestApp();
+    const workspace = dependencies.persistence.registry.importLocalWorkspace({
+      dataDir: "/tmp/workspace",
+      displayName: "Local Workspace",
+      status: "ready",
+    });
+    withMockOpencodeBaseUrl(dependencies, mock.url);
+
+    const listResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions?roots=true&limit=1`);
+    expect(listResponse.status).toBe(200);
+    expect((await listResponse.json()).data.items[0].id).toBe("ses_1");
+
+    const snapshotResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions/ses_1/snapshot?limit=5`);
+    expect(snapshotResponse.status).toBe(200);
+    const snapshot = await snapshotResponse.json();
+    expect(snapshot.data.session.id).toBe("ses_1");
+    expect(snapshot.data.status.type).toBe("busy");
+    expect(snapshot.data.todos[0].content).toBe("Ship Phase 6");
+
+    const createResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "Create" }),
+    });
+    expect(createResponse.status).toBe(200);
+    expect((await createResponse.json()).data.id).toBe("ses_created");
+
+    const updateResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions/ses_1`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "Rename" }),
+    });
+    expect(updateResponse.status).toBe(200);
+    expect((await updateResponse.json()).data.title).toBe("Renamed Session");
+
+    const promptResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions/ses_1/prompt_async`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ parts: [{ type: "text", text: "Hello" }] }),
+    });
+    expect(promptResponse.status).toBe(200);
+    expect((await promptResponse.json()).data.accepted).toBe(true);
+
+    const revertResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions/ses_1/revert`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ messageID: "msg_1" }),
+    });
+    expect(revertResponse.status).toBe(200);
+    expect((await revertResponse.json()).data.title).toBe("Reverted Session");
+
+    const eventsResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/events`);
+    expect(eventsResponse.status).toBe(200);
+    const eventsBody = await eventsResponse.text();
+    expect(eventsBody).toContain("session.status");
+    expect(eventsBody).toContain("session.idle");
+  });
+
+  test("routes remote workspace sessions through the mounted remote backend", async () => {
+    const command = deferred();
+    const remote = startMockOpencode({ expectBearer: "secret", holdCommand: command.promise, mountPrefix: "/w/alpha/opencode" });
+    const { app, dependencies } = createTestApp();
+    const workspace = dependencies.persistence.registry.importRemoteWorkspace({
+      baseUrl: `${remote.url}/w/alpha/opencode`,
+      directory: "/srv/remote-alpha",
+      displayName: "Remote Alpha",
+      legacyNotes: { source: "test" },
+      remoteType: "openwork",
+      remoteWorkspaceId: "alpha",
+      serverAuth: { openworkToken: "secret" },
+      serverBaseUrl: remote.url,
+      serverHostingKind: "self_hosted",
+      serverLabel: "remote.example.com",
+      workspaceStatus: "ready",
+    });
+
+    const listResponse = await app.request(`http://openwork.local/workspaces/${workspace.id}/sessions`);
+    expect(listResponse.status).toBe(200);
+    expect((await listResponse.json()).data.items[0].id).toBe("ses_1");
+
+    const commandResponse = await Promise.race([
+      app.request(`http://openwork.local/workspaces/${workspace.id}/sessions/ses_1/command`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ command: "review" }),
+      }),
+      new Promise<"timeout">((resolve) => setTimeout(() => resolve("timeout"), 100)),
+    ]);
+    expect(commandResponse).not.toBe("timeout");
+    command.resolve();
+    if (!(commandResponse instanceof Response)) throw new Error("Command response timed out");
+    expect(commandResponse.status).toBe(200);
+    expect((await commandResponse.json()).data.accepted).toBe(true);
+  });
+});
diff --git a/apps/server-v2/src/standalone.test.ts b/apps/server-v2/src/standalone.test.ts
new file mode 100644
index 0000000000..a55a072c73
--- /dev/null
+++ b/apps/server-v2/src/standalone.test.ts
@@ -0,0 +1,93 @@
+import { afterEach, expect, test } from "bun:test";
+import net from "node:net";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const spawnedChildren: Array<Bun.Subprocess> = [];
+
+afterEach(async () => {
+  while (spawnedChildren.length > 0) {
+    const child = spawnedChildren.pop();
+    if (!child) {
+      continue;
+    }
+
+    child.kill();
+    await child.exited;
+  }
+});
+
+function getFreePort() {
+  return new Promise<number>((resolve, reject) => {
+    const server = net.createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to resolve a test port."));
+        return;
+      }
+
+      const { port } = address;
+      server.close((error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+
+        resolve(port);
+      });
+    });
+    server.once("error", reject);
+  });
+}
+
+async function waitForHealth(url: string) {
+  const deadline = Date.now() + 10_000;
+
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) {
+        return response;
+      }
+    } catch {
+      // wait for server boot
+    }
+
+    await Bun.sleep(100);
+  }
+
+  throw new Error(`Timed out waiting for ${url}`);
+}
+
+test("cli boots as a standalone process and serves health plus runtime routes", async () => {
+  const port = await getFreePort();
+  const child = Bun.spawn(["bun", "src/cli.ts", "--port", String(port)], {
+    cwd: packageDir,
+    env: {
+      ...process.env,
+      OPENWORK_SERVER_V2_IN_MEMORY: "1",
+      OPENWORK_SERVER_V2_RUNTIME_BOOTSTRAP: "disabled",
+    },
+    stderr: "pipe",
+    stdout: "pipe",
+  });
+  spawnedChildren.push(child);
+
+  const response = await waitForHealth(`http://127.0.0.1:${port}/system/health`);
+  const body = await response.json();
+
+  const runtimeSummaryResponse = await waitForHealth(`http://127.0.0.1:${port}/system/runtime/summary`);
+  const runtimeSummary = await runtimeSummaryResponse.json();
+
+  const runtimeVersionsResponse = await waitForHealth(`http://127.0.0.1:${port}/system/runtime/versions`);
+  const runtimeVersions = await runtimeVersionsResponse.json();
+
+  expect(body.ok).toBe(true);
+  expect(body.data.service).toBe("openwork-server-v2");
+  expect(runtimeSummary.ok).toBe(true);
+  expect(runtimeSummary.data.target).toBeTruthy();
+  expect(runtimeVersions.ok).toBe(true);
+  expect(runtimeVersions.data.pinned.serverVersion).toBeTruthy();
+}, 15_000);
diff --git a/apps/server-v2/src/test-fixtures/fake-runtime.ts b/apps/server-v2/src/test-fixtures/fake-runtime.ts
new file mode 100644
index 0000000000..3fb8aceee8
--- /dev/null
+++ b/apps/server-v2/src/test-fixtures/fake-runtime.ts
@@ -0,0 +1,142 @@
+#!/usr/bin/env bun
+
+import http from "node:http";
+
+function readOption(name: string, fallback = "") {
+  return process.env[name]?.trim() || fallback;
+}
+
+function parsePort(argv: string[]) {
+  const hostArg = argv.find((value) => value.startsWith("--hostname=")) ?? "--hostname=127.0.0.1";
+  const portArg = argv.find((value) => value.startsWith("--port=")) ?? "--port=0";
+  return {
+    host: hostArg.slice("--hostname=".length),
+    port: Number.parseInt(portArg.slice("--port=".length), 10) || 0,
+  };
+}
+
+async function startFakeOpencode(argv: string[]) {
+  const mode = readOption("FAKE_RUNTIME_MODE", "success");
+  const version = readOption("FAKE_RUNTIME_VERSION", "1.2.27");
+
+  if (mode === "early-exit") {
+    console.error("fake opencode exiting before readiness");
+    process.exit(7);
+  }
+
+  if (mode === "timeout") {
+    console.log("fake opencode booting slowly");
+    setInterval(() => {}, 1_000);
+    await new Promise(() => undefined);
+  }
+
+  const { host, port } = parsePort(argv);
+  const server = http.createServer((req, res) => {
+    const pathname = req.url ? new URL(req.url, "http://localhost").pathname : "";
+    if (pathname === "/health" || pathname === "/global/health") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ healthy: true, version }));
+      return;
+    }
+
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "not_found" }));
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => resolve());
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("Failed to resolve fake opencode address.");
+  }
+
+  console.log(`opencode server listening on http://${host}:${address.port}`);
+
+  const exitAfterMs = Number.parseInt(readOption("FAKE_RUNTIME_EXIT_AFTER_MS", "0"), 10) || 0;
+  if (exitAfterMs > 0) {
+    setTimeout(() => {
+      server.close(() => {
+        process.exit(3);
+      });
+    }, exitAfterMs);
+  }
+
+  await new Promise<void>((resolve) => {
+    const shutdown = () => server.close(() => resolve());
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+}
+
+async function startFakeRouter() {
+  const mode = readOption("FAKE_RUNTIME_MODE", "success");
+  const healthPort = Number.parseInt(readOption("OPENCODE_ROUTER_HEALTH_PORT", "0"), 10);
+  if (!healthPort) {
+    throw new Error("OPENCODE_ROUTER_HEALTH_PORT is required for the fake router.");
+  }
+
+  if (mode === "early-exit") {
+    console.error("fake router exiting before readiness");
+    process.exit(9);
+  }
+
+  if (mode === "timeout") {
+    console.log("fake router waiting forever");
+    setInterval(() => {}, 1_000);
+    await new Promise(() => undefined);
+  }
+
+  const server = http.createServer((req, res) => {
+    const pathname = req.url ? new URL(req.url, "http://localhost").pathname : "";
+    if (pathname === "/health" || pathname === "/") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "not_found" }));
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(healthPort, "127.0.0.1", () => resolve());
+  });
+
+  const exitAfterMs = Number.parseInt(readOption("FAKE_RUNTIME_EXIT_AFTER_MS", "0"), 10) || 0;
+  if (exitAfterMs > 0) {
+    setTimeout(() => {
+      server.close(() => {
+        process.exit(4);
+      });
+    }, exitAfterMs);
+  }
+
+  await new Promise<void>((resolve) => {
+    const shutdown = () => server.close(() => resolve());
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+}
+
+async function main() {
+  const kind = readOption("FAKE_RUNTIME_KIND", "opencode");
+  const [, , ...argv] = process.argv;
+  if (argv[0] !== "serve") {
+    console.log(readOption("FAKE_RUNTIME_VERSION", "1.2.27"));
+    return;
+  }
+
+  if (kind === "router") {
+    await startFakeRouter();
+    return;
+  }
+
+  await startFakeOpencode(argv);
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.stack ?? error.message : String(error));
+  process.exit(1);
+});
diff --git a/apps/server-v2/src/version.ts b/apps/server-v2/src/version.ts
new file mode 100644
index 0000000000..2b70e027ca
--- /dev/null
+++ b/apps/server-v2/src/version.ts
@@ -0,0 +1,21 @@
+import packageJson from "../package.json" with { type: "json" };
+
+declare const __OPENWORK_SERVER_V2_VERSION__: string | undefined;
+
+function normalizeVersion(value: string | undefined | null) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed || null;
+}
+
+export function resolveServerV2Version() {
+  return (
+    normalizeVersion(process.env.OPENWORK_SERVER_V2_VERSION) ??
+    normalizeVersion(
+      typeof __OPENWORK_SERVER_V2_VERSION__ === "string"
+        ? __OPENWORK_SERVER_V2_VERSION__
+        : null,
+    ) ??
+    normalizeVersion(packageJson.version) ??
+    "0.0.0"
+  );
+}
diff --git a/apps/server-v2/tsconfig.json b/apps/server-v2/tsconfig.json
new file mode 100644
index 0000000000..9779c5ed67
--- /dev/null
+++ b/apps/server-v2/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "types": ["bun-types", "node"]
+  },
+  "include": ["src", "scripts"]
+}
diff --git a/apps/server/README.md b/apps/server/README.md
new file mode 100644
index 0000000000..e9954538ed
--- /dev/null
+++ b/apps/server/README.md
@@ -0,0 +1,159 @@
+# OpenWork Server
+
+Filesystem-backed API for OpenWork remote clients. This package provides the OpenWork server layer described in `apps/app/pr/openwork-server.md` and is intentionally independent from the desktop app.
+
+## Quick start
+
+```bash
+npm install -g openwork-server
+openwork-server --workspace /path/to/workspace --approval auto
+```
+
+`openwork-server` ships as a compiled binary, so Bun is not required at runtime.
+
+Or from source:
+
+```bash
+pnpm --filter openwork-server dev -- \
+  --workspace /path/to/workspace \
+  --approval auto
+```
+
+The server logs the client token and host token on boot when they are auto-generated.
+
+Add `--verbose` to print resolved config details on startup. Use `--version` to print the server version and exit.
+
+## Config file
+
+Defaults to `~/.config/openwork/server.json` (override with `OPENWORK_SERVER_CONFIG` or `--config`).
+
+```json
+{
+  "host": "127.0.0.1",
+  "port": 8787,
+  "approval": { "mode": "manual", "timeoutMs": 30000 },
+  "workspaces": [
+    {
+      "path": "/Users/susan/Finance",
+      "name": "Finance",
+      "workspaceType": "local",
+      "baseUrl": "http://127.0.0.1:4096",
+      "directory": "/Users/susan/Finance"
+    }
+  ],
+  "corsOrigins": ["http://localhost:5173"]
+}
+```
+
+## Environment variables
+
+- `OPENWORK_SERVER_CONFIG` path to config JSON
+- `OPENWORK_HOST` / `OPENWORK_PORT`
+- `OPENWORK_TOKEN` client bearer token
+- `OPENWORK_HOST_TOKEN` host approval token
+- `OPENWORK_APPROVAL_MODE` (`manual` | `auto`)
+- `OPENWORK_APPROVAL_TIMEOUT_MS`
+- `OPENWORK_WORKSPACES` (JSON array or comma-separated list of paths)
+- `OPENWORK_CORS_ORIGINS` (comma-separated list or `*`)
+- `OPENWORK_OPENCODE_BASE_URL`
+- `OPENWORK_OPENCODE_DIRECTORY`
+- `OPENWORK_OPENCODE_USERNAME`
+- `OPENWORK_OPENCODE_PASSWORD`
+
+Token management (scoped tokens):
+
+- `OPENWORK_TOKEN_STORE` path to token store JSON (default: alongside `server.json`)
+
+File injection / artifacts:
+
+- `OPENWORK_INBOX_ENABLED` (`1` | `0`)
+- `OPENWORK_INBOX_MAX_BYTES` (default: 50MB, capped)
+- `OPENWORK_OUTBOX_ENABLED` (`1` | `0`)
+
+Sandbox advertisement (for capability discovery):
+
+- `OPENWORK_SANDBOX_ENABLED` (`1` | `0`)
+- `OPENWORK_SANDBOX_BACKEND` (`docker` | `container` | `none`)
+
+## Endpoints
+
+- `GET /health`
+- `GET /status`
+- `GET /capabilities`
+- `GET /whoami`
+- `GET /workspaces`
+- `GET /workspace/:id/config`
+- `PATCH /workspace/:id/config`
+- `GET /workspace/:id/events`
+- `POST /workspace/:id/engine/reload`
+- `GET /workspace/:id/plugins`
+- `POST /workspace/:id/plugins`
+- `DELETE /workspace/:id/plugins/:name`
+- `GET /workspace/:id/skills`
+- `POST /workspace/:id/skills`
+- `GET /workspace/:id/mcp`
+- `POST /workspace/:id/mcp`
+- `DELETE /workspace/:id/mcp/:name`
+- `GET /workspace/:id/commands`
+- `POST /workspace/:id/commands`
+- `DELETE /workspace/:id/commands/:name`
+- `GET /workspace/:id/audit`
+- `GET /workspace/:id/export`
+- `POST /workspace/:id/import/preview`
+- `POST /workspace/:id/import`
+
+Token management (host/owner auth):
+
+- `GET /tokens`
+- `POST /tokens` (body: `{ "scope": "owner"|"collaborator"|"viewer", "label"?: string }`)
+- `DELETE /tokens/:id`
+
+Inbox/outbox:
+
+- `POST /workspace/:id/inbox` (multipart upload into `.opencode/openwork/inbox/`)
+- `GET /workspace/:id/artifacts`
+- `GET /workspace/:id/artifacts/:artifactId`
+- `POST /workspace/:id/files/sessions`
+- `POST /files/sessions/:sessionId/renew`
+- `DELETE /files/sessions/:sessionId`
+- `GET /files/sessions/:sessionId/catalog/snapshot`
+- `GET /files/sessions/:sessionId/catalog/events`
+- `POST /files/sessions/:sessionId/read-batch`
+- `POST /files/sessions/:sessionId/write-batch`
+- `POST /files/sessions/:sessionId/ops`
+
+Toy UI (static assets served by the server):
+
+- `GET /ui`
+- `GET /w/:id/ui`
+- `GET /ui/assets/*`
+
+OpenCode proxy:
+
+- `GET|POST|... /opencode/*`
+- `GET|POST|... /w/:id/opencode/*`
+
+OpenCode Router proxy:
+
+- `GET|POST|... /opencode-router/*`
+- `GET|POST|... /w/:id/opencode-router/*`
+
+Auth policy:
+- `GET /opencode-router/health` requires client auth.
+- All other `/opencode-router/*` endpoints require host/owner auth.
+
+## Approvals
+
+All writes are gated by host approval.
+
+Host APIs accept either:
+
+- `X-OpenWork-Host-Token: <token>` (legacy host token), or
+- `Authorization: Bearer <token>` where the token scope is `owner`.
+
+Approvals endpoints:
+
+- `GET /approvals`
+- `POST /approvals/:id` with `{ "reply": "allow" | "deny" }`
+
+Set `OPENWORK_APPROVAL_MODE=auto` to auto-approve during local development.
diff --git a/apps/server/bin/openwork-server.mjs b/apps/server/bin/openwork-server.mjs
new file mode 100755
index 0000000000..ab8c7a7e20
--- /dev/null
+++ b/apps/server/bin/openwork-server.mjs
@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = fileURLToPath(new URL("..", import.meta.url));
+const args = process.argv.slice(2);
+
+const binaryName = process.platform === "win32" ? "openwork-server.exe" : "openwork-server";
+const compiledBinary = fileURLToPath(new URL(`./dist/bin/${binaryName}`, `${new URL("../", import.meta.url)}`));
+const builtCli = fileURLToPath(new URL("./dist/cli.js", `${new URL("../", import.meta.url)}`));
+const sourceCli = fileURLToPath(new URL("./src/cli.ts", `${new URL("../", import.meta.url)}`));
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, { stdio: "inherit" });
+  if (result.error) {
+    if (result.error.code === "ENOENT") {
+      console.error(`Missing runtime dependency: ${command}`);
+      process.exit(1);
+    }
+    throw result.error;
+  }
+  process.exit(result.status ?? 1);
+}
+
+if (existsSync(compiledBinary)) {
+  run(compiledBinary, args);
+}
+
+if (existsSync(builtCli)) {
+  run("bun", [builtCli, ...args]);
+}
+
+if (existsSync(sourceCli)) {
+  run("bun", [sourceCli, ...args]);
+}
+
+console.error(
+  `Unable to find an OpenWork server entrypoint in ${basename(packageRoot)}. Build the package or run it from a source checkout with Bun available.`,
+);
+process.exit(1);
diff --git a/apps/server/package.json b/apps/server/package.json
new file mode 100644
index 0000000000..faa5f9e569
--- /dev/null
+++ b/apps/server/package.json
@@ -0,0 +1,57 @@
+{
+  "name": "openwork-server",
+  "version": "0.13.3",
+  "description": "Filesystem-backed API for OpenWork remote clients",
+  "type": "module",
+  "bin": {
+    "openwork-server": "bin/openwork-server.mjs"
+  },
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 bun src/cli.ts",
+    "test": "bun test",
+    "build": "tsc -p tsconfig.json",
+    "build:bin": "bun build --compile src/cli.ts --outfile dist/bin/openwork-server",
+    "build:bin:all": "bun ./script/build.ts --outdir dist/bin --target bun-darwin-arm64 --target bun-darwin-x64 --target bun-linux-x64 --target bun-linux-arm64 --target bun-windows-x64",
+    "start": "bun dist/cli.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "pnpm build:bin"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/different-ai/openwork.git",
+    "directory": "apps/server"
+  },
+  "homepage": "https://github.com/different-ai/openwork/tree/dev/apps/server",
+  "bugs": {
+    "url": "https://github.com/different-ai/openwork/issues"
+  },
+  "keywords": [
+    "openwork",
+    "server",
+    "opencode",
+    "headless",
+    "cli"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "jsonc-parser": "^3.2.1",
+    "minimatch": "^10.0.1",
+    "yaml": "^2.6.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "@types/minimatch": "^5.1.2",
+    "bun-types": "^1.3.6",
+    "typescript": "^5.6.3"
+  },
+  "packageManager": "pnpm@10.27.0"
+}
diff --git a/apps/server/script/build.ts b/apps/server/script/build.ts
new file mode 100644
index 0000000000..8582fe733e
--- /dev/null
+++ b/apps/server/script/build.ts
@@ -0,0 +1,112 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const bunRuntime = (globalThis as typeof globalThis & {
+  Bun?: {
+    build?: (...args: any[]) => Promise<any>;
+    argv?: string[];
+  };
+}).Bun;
+
+if (!bunRuntime?.build || !bunRuntime.argv) {
+  console.error("This script must be run with Bun.");
+  process.exit(1);
+}
+
+const bun = bunRuntime as { build: (...args: any[]) => Promise<any>; argv: string[] };
+
+type BuildOptions = {
+  targets: string[];
+  outdir: string;
+  filename: string;
+};
+
+function readArgs(argv: string[]): BuildOptions {
+  const options: BuildOptions = {
+    targets: [],
+    outdir: resolve("dist", "bin"),
+    filename: "openwork-server",
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value) continue;
+
+    if (value === "--target") {
+      const next = argv[index + 1];
+      if (next) {
+        options.targets.push(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--target=")) {
+      const next = value.slice("--target=".length).trim();
+      if (next) options.targets.push(next);
+      continue;
+    }
+
+    if (value === "--outdir") {
+      const next = argv[index + 1];
+      if (next) {
+        options.outdir = resolve(next);
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--outdir=")) {
+      const next = value.slice("--outdir=".length).trim();
+      if (next) options.outdir = resolve(next);
+      continue;
+    }
+
+    if (value === "--filename") {
+      const next = argv[index + 1];
+      if (next) {
+        options.filename = next;
+        index += 1;
+      }
+      continue;
+    }
+
+    if (value.startsWith("--filename=")) {
+      const next = value.slice("--filename=".length).trim();
+      if (next) options.filename = next;
+    }
+  }
+
+  return options;
+}
+
+function outputName(filename: string, target?: string) {
+  const needsExe = target ? target.includes("windows") : process.platform === "win32";
+  const suffix = target ? `-${target}` : "";
+  const ext = needsExe ? ".exe" : "";
+  return `${filename}${suffix}${ext}`;
+}
+
+async function buildOnce(entrypoint: string, outdir: string, filename: string, target?: string) {
+  mkdirSync(outdir, { recursive: true });
+  const outfile = join(outdir, outputName(filename, target));
+
+  const args = ["build", entrypoint, "--compile", "--outfile", outfile];
+  if (target) {
+    args.push("--target", target);
+  }
+
+  const result = spawnSync("bun", args, { stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+const options = readArgs(bun.argv.slice(2));
+const entrypoint = resolve("src", "cli.ts");
+const targets = options.targets.length ? options.targets : [undefined];
+
+for (const target of targets) {
+  await buildOnce(entrypoint, options.outdir, options.filename, target);
+}
diff --git a/apps/server/src/approvals.ts b/apps/server/src/approvals.ts
new file mode 100644
index 0000000000..6aa29ea86e
--- /dev/null
+++ b/apps/server/src/approvals.ts
@@ -0,0 +1,66 @@
+import type { ApprovalConfig, ApprovalRequest } from "./types.js";
+import { shortId } from "./utils.js";
+
+interface ApprovalResult {
+  id: string;
+  allowed: boolean;
+  reason?: string;
+}
+
+interface PendingApproval {
+  request: ApprovalRequest;
+  resolve: (result: ApprovalResult) => void;
+  timeout?: NodeJS.Timeout;
+}
+
+export class ApprovalService {
+  private config: ApprovalConfig;
+  private pending = new Map<string, PendingApproval>();
+
+  constructor(config: ApprovalConfig) {
+    this.config = config;
+  }
+
+  list(): ApprovalRequest[] {
+    return Array.from(this.pending.values()).map((entry) => entry.request);
+  }
+
+  async requestApproval(
+    input: Omit<ApprovalRequest, "id" | "createdAt">,
+  ): Promise<ApprovalResult> {
+    if (this.config.mode === "auto") {
+      return { id: "auto", allowed: true };
+    }
+    const id = shortId();
+    const request: ApprovalRequest = {
+      ...input,
+      id,
+      createdAt: Date.now(),
+    };
+
+    const result = await new Promise<ApprovalResult>((resolve) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(id);
+        resolve({ id, allowed: false, reason: "timeout" });
+      }, this.config.timeoutMs);
+
+      this.pending.set(id, { request, resolve, timeout });
+    });
+
+    return result;
+  }
+
+  respond(id: string, reply: "allow" | "deny"): ApprovalResult | null {
+    const pending = this.pending.get(id);
+    if (!pending) return null;
+    if (pending.timeout) clearTimeout(pending.timeout);
+    this.pending.delete(id);
+    const result: ApprovalResult = {
+      id,
+      allowed: reply === "allow",
+      reason: reply === "allow" ? undefined : "denied",
+    };
+    pending.resolve(result);
+    return result;
+  }
+}
diff --git a/apps/server/src/audit.ts b/apps/server/src/audit.ts
new file mode 100644
index 0000000000..3358838534
--- /dev/null
+++ b/apps/server/src/audit.ts
@@ -0,0 +1,84 @@
+import { dirname, join } from "node:path";
+import { appendFile, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import type { AuditEntry } from "./types.js";
+import { ensureDir, exists } from "./utils.js";
+
+function expandHome(value: string): string {
+  if (value.startsWith("~/")) {
+    return join(homedir(), value.slice(2));
+  }
+  return value;
+}
+
+function resolveOpenworkDataDir(): string {
+  const override = process.env.OPENWORK_DATA_DIR?.trim();
+  if (override) return expandHome(override);
+  return join(homedir(), ".openwork", "openwork-server");
+}
+
+export function auditLogPath(workspaceId: string): string {
+  return join(resolveOpenworkDataDir(), "audit", `${workspaceId}.jsonl`);
+}
+
+export function legacyAuditLogPath(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "openwork", "audit.jsonl");
+}
+
+async function resolveReadableAuditPath(workspaceRoot: string, workspaceId: string): Promise<string | null> {
+  const primary = auditLogPath(workspaceId);
+  if (await exists(primary)) return primary;
+  const legacy = legacyAuditLogPath(workspaceRoot);
+  if (await exists(legacy)) return legacy;
+  return null;
+}
+
+export async function recordAudit(workspaceRoot: string, entry: AuditEntry): Promise<void> {
+  const workspaceId = entry.workspaceId?.trim();
+  if (!workspaceId) {
+    const path = legacyAuditLogPath(workspaceRoot);
+    await ensureDir(dirname(path));
+    await appendFile(path, JSON.stringify(entry) + "\n", "utf8");
+    return;
+  }
+
+  const path = auditLogPath(workspaceId);
+  await ensureDir(dirname(path));
+  await appendFile(path, JSON.stringify(entry) + "\n", "utf8");
+}
+
+export async function readLastAudit(workspaceRoot: string, workspaceId: string): Promise<AuditEntry | null> {
+  const path = await resolveReadableAuditPath(workspaceRoot, workspaceId);
+  if (!path) return null;
+  const content = await readFile(path, "utf8");
+  const lines = content.trim().split("\n");
+  const last = lines[lines.length - 1];
+  if (!last) return null;
+  try {
+    return JSON.parse(last) as AuditEntry;
+  } catch {
+    return null;
+  }
+}
+
+export async function readAuditEntries(
+  workspaceRoot: string,
+  workspaceId: string,
+  limit = 50,
+): Promise<AuditEntry[]> {
+  const path = await resolveReadableAuditPath(workspaceRoot, workspaceId);
+  if (!path) return [];
+  const content = await readFile(path, "utf8");
+  const rawLines = content.trim().split("\n").filter(Boolean);
+  if (!rawLines.length) return [];
+  const slice = rawLines.slice(-Math.max(1, limit));
+  const entries: AuditEntry[] = [];
+  for (let i = slice.length - 1; i >= 0; i -= 1) {
+    try {
+      entries.push(JSON.parse(slice[i]) as AuditEntry);
+    } catch {
+      // ignore malformed entry
+    }
+  }
+  return entries;
+}
diff --git a/apps/server/src/blueprint-sessions.test.ts b/apps/server/src/blueprint-sessions.test.ts
new file mode 100644
index 0000000000..8bb633173d
--- /dev/null
+++ b/apps/server/src/blueprint-sessions.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  applyMaterializedBlueprintSessions,
+  normalizeBlueprintSessionTemplates,
+  readMaterializedBlueprintSessions,
+  sanitizeOpenworkTemplateConfig,
+} from "./blueprint-sessions.js";
+
+describe("blueprint sessions", () => {
+  test("normalizes configured session templates", () => {
+    const sessions = normalizeBlueprintSessionTemplates({
+      blueprint: {
+        sessions: [
+          {
+            id: "welcome",
+            title: "Welcome to OpenWork",
+            openOnFirstLoad: true,
+            messages: [
+              { role: "assistant", text: "Hi welcome to OpenWork!" },
+              { role: "user", text: "Help me get started." },
+            ],
+          },
+        ],
+      },
+    });
+
+    expect(sessions).toEqual([
+      {
+        id: "welcome",
+        title: "Welcome to OpenWork",
+        openOnFirstLoad: true,
+        messages: [
+          { role: "assistant", text: "Hi welcome to OpenWork!" },
+          { role: "user", text: "Help me get started." },
+        ],
+      },
+    ]);
+  });
+
+  test("sanitizes materialized session state from exported template config", () => {
+    const sanitized = sanitizeOpenworkTemplateConfig({
+      blueprint: {
+        sessions: [{ id: "welcome", title: "Welcome", messages: [{ role: "assistant", text: "Hello" }] }],
+        materialized: {
+          sessions: {
+            hydratedAt: 123,
+            items: [{ templateId: "welcome", sessionId: "ses_123" }],
+          },
+        },
+      },
+    });
+
+    expect(readMaterializedBlueprintSessions(sanitized)).toEqual([]);
+    expect((sanitized.blueprint as Record<string, unknown>).sessions).toBeDefined();
+  });
+
+  test("applies materialized session mappings without removing templates", () => {
+    const next = applyMaterializedBlueprintSessions(
+      {
+        blueprint: {
+          sessions: [{ id: "welcome", title: "Welcome", messages: [{ role: "assistant", text: "Hello" }] }],
+        },
+      },
+      [{ templateId: "welcome", sessionId: "ses_123" }],
+      456,
+    );
+
+    expect(readMaterializedBlueprintSessions(next)).toEqual([{ templateId: "welcome", sessionId: "ses_123" }]);
+    expect(((next.blueprint as Record<string, unknown>).materialized as Record<string, unknown>).sessions).toEqual({
+      hydratedAt: 456,
+      items: [{ templateId: "welcome", sessionId: "ses_123" }],
+    });
+  });
+});
diff --git a/apps/server/src/blueprint-sessions.ts b/apps/server/src/blueprint-sessions.ts
new file mode 100644
index 0000000000..662553950f
--- /dev/null
+++ b/apps/server/src/blueprint-sessions.ts
@@ -0,0 +1,111 @@
+type BlueprintSessionMessage = {
+  role: "assistant" | "user";
+  text: string;
+};
+
+export type BlueprintSessionTemplate = {
+  id: string;
+  title: string;
+  messages: BlueprintSessionMessage[];
+  openOnFirstLoad: boolean;
+};
+
+export type MaterializedBlueprintSession = {
+  templateId: string;
+  sessionId: string;
+};
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function cloneRecord<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function normalizeMessage(value: unknown): BlueprintSessionMessage | null {
+  const record = readRecord(value);
+  if (!record) return null;
+  const text = typeof record.text === "string" ? record.text.trim() : "";
+  if (!text) return null;
+  const role = String(record.role ?? "assistant").trim().toLowerCase() === "user" ? "user" : "assistant";
+  return { role, text };
+}
+
+export function normalizeBlueprintSessionTemplates(openwork: Record<string, unknown> | null | undefined): BlueprintSessionTemplate[] {
+  const blueprint = readRecord(openwork?.blueprint);
+  const sessions = Array.isArray(blueprint?.sessions) ? blueprint?.sessions : [];
+  return sessions
+    .map((value, index) => {
+      const record = readRecord(value);
+      if (!record) return null;
+      const title = typeof record.title === "string" ? record.title.trim() : "";
+      const messages = Array.isArray(record.messages)
+        ? record.messages.map(normalizeMessage).filter((item): item is BlueprintSessionMessage => Boolean(item))
+        : [];
+      if (!title && messages.length === 0) return null;
+      const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : `template-session-${index + 1}`;
+      return {
+        id,
+        title: title || `Template session ${index + 1}`,
+        messages,
+        openOnFirstLoad: record.openOnFirstLoad === true,
+      } satisfies BlueprintSessionTemplate;
+    })
+    .filter((item): item is BlueprintSessionTemplate => Boolean(item));
+}
+
+export function readMaterializedBlueprintSessions(openwork: Record<string, unknown> | null | undefined): MaterializedBlueprintSession[] {
+  const blueprint = readRecord(openwork?.blueprint);
+  const materialized = readRecord(blueprint?.materialized);
+  const sessions = readRecord(materialized?.sessions);
+  const items = Array.isArray(sessions?.items) ? sessions.items : [];
+  return items
+    .map((value) => {
+      const record = readRecord(value);
+      if (!record) return null;
+      const templateId = typeof record.templateId === "string" ? record.templateId.trim() : "";
+      const sessionId = typeof record.sessionId === "string" ? record.sessionId.trim() : "";
+      if (!templateId || !sessionId) return null;
+      return { templateId, sessionId } satisfies MaterializedBlueprintSession;
+    })
+    .filter((item): item is MaterializedBlueprintSession => Boolean(item));
+}
+
+export function sanitizeOpenworkTemplateConfig(openwork: Record<string, unknown> | null | undefined): Record<string, unknown> {
+  const next = cloneRecord(openwork ?? {});
+  const blueprint = readRecord(next.blueprint);
+  if (!blueprint) return next;
+
+  const materialized = readRecord(blueprint.materialized);
+  if (materialized) {
+    delete materialized.sessions;
+    if (Object.keys(materialized).length === 0) {
+      delete blueprint.materialized;
+    } else {
+      blueprint.materialized = materialized;
+    }
+  }
+
+  next.blueprint = blueprint;
+  return next;
+}
+
+export function applyMaterializedBlueprintSessions(
+  openwork: Record<string, unknown> | null | undefined,
+  items: MaterializedBlueprintSession[],
+  hydratedAt: number,
+): Record<string, unknown> {
+  const next = sanitizeOpenworkTemplateConfig(openwork);
+  const blueprint = readRecord(next.blueprint) ?? {};
+  const materialized = readRecord(blueprint.materialized) ?? {};
+  materialized.sessions = {
+    hydratedAt,
+    items: items.map((item) => ({ ...item })),
+  };
+  blueprint.materialized = materialized;
+  next.blueprint = blueprint;
+  return next;
+}
diff --git a/apps/server/src/bun.d.ts b/apps/server/src/bun.d.ts
new file mode 100644
index 0000000000..1916e9c11c
--- /dev/null
+++ b/apps/server/src/bun.d.ts
@@ -0,0 +1,9 @@
+declare const Bun: {
+  serve: (options: {
+    hostname: string;
+    port: number;
+    fetch: (request: Request) => Response | Promise<Response>;
+  }) => {
+    port: number;
+  };
+};
diff --git a/apps/server/src/cli.ts b/apps/server/src/cli.ts
new file mode 100644
index 0000000000..6b2ee15634
--- /dev/null
+++ b/apps/server/src/cli.ts
@@ -0,0 +1,92 @@
+#!/usr/bin/env bun
+
+import { mkdir } from "node:fs/promises";
+
+import { parseCliArgs, printHelp, resolveServerConfig } from "./config.js";
+import { createManagedOpencodeServer, type ManagedOpencodeServer } from "./managed-opencode.js";
+import { createServerLogger, startServer } from "./server.js";
+import pkg from "../package.json" with { type: "json" };
+
+const args = parseCliArgs(process.argv.slice(2));
+
+if (args.help) {
+  printHelp();
+  process.exit(0);
+}
+
+if (args.version) {
+  console.log(pkg.version);
+  process.exit(0);
+}
+
+const config = await resolveServerConfig(args);
+const logger = createServerLogger(config);
+let managedOpencode: ManagedOpencodeServer | null = null;
+
+if (!config.opencodeBaseUrl && process.env.OPENWORK_MANAGE_OPENCODE === "1") {
+  const workspace = config.workspaces[0];
+  if (workspace?.path) {
+    const managedOpencodeCwd = process.env.OPENWORK_MANAGED_OPENCODE_CWD?.trim() || workspace.path;
+    await mkdir(managedOpencodeCwd, { recursive: true });
+    managedOpencode = await createManagedOpencodeServer({
+      bin: process.env.OPENWORK_OPENCODE_BIN,
+      cwd: managedOpencodeCwd,
+      env: {
+        ...(process.env.OPENWORK_DEV_MODE ? { OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE } : {}),
+      },
+    });
+    config.opencodeBaseUrl = managedOpencode.url;
+    config.opencodeUsername = managedOpencode.username;
+    config.opencodePassword = managedOpencode.password;
+    for (const entry of config.workspaces) {
+      entry.baseUrl ??= managedOpencode.url;
+      entry.opencodeUsername ??= managedOpencode.username;
+      entry.opencodePassword ??= managedOpencode.password;
+      entry.directory ??= entry.path;
+    }
+    logger.log("info", `Managed OpenCode listening on ${managedOpencode.url}`);
+  }
+}
+
+const server = startServer(config);
+
+const url = `http://${config.host}:${server.port}`;
+logger.log("info", `OpenWork server listening on ${url}`);
+
+if (config.tokenSource === "generated") {
+  logger.log("info", `Client token: ${config.token}`);
+}
+
+if (config.hostTokenSource === "generated") {
+  logger.log("info", `Host token: ${config.hostToken}`);
+}
+
+if (config.workspaces.length === 0) {
+  logger.log("info", "No workspaces configured. Add --workspace or update server.json.");
+} else {
+  logger.log("info", `Workspaces: ${config.workspaces.length}`);
+}
+
+if (args.verbose) {
+  logger.log("info", `Config path: ${config.configPath ?? "unknown"}`);
+  logger.log("info", `Read-only: ${config.readOnly ? "true" : "false"}`);
+  logger.log("info", `Approval: ${config.approval.mode} (${config.approval.timeoutMs}ms)`);
+  logger.log("info", `CORS origins: ${config.corsOrigins.join(", ")}`);
+  logger.log("info", `Authorized roots: ${config.authorizedRoots.join(", ")}`);
+  logger.log("info", `Token source: ${config.tokenSource}`);
+  logger.log("info", `Host token source: ${config.hostTokenSource}`);
+}
+
+const shutdown = () => {
+  managedOpencode?.close();
+  (server as { stop?: (closeActiveConnections?: boolean) => void }).stop?.(true);
+};
+
+process.once("SIGINT", () => {
+  shutdown();
+  process.exit(0);
+});
+process.once("SIGTERM", () => {
+  shutdown();
+  process.exit(0);
+});
diff --git a/apps/server/src/commands.test.ts b/apps/server/src/commands.test.ts
new file mode 100644
index 0000000000..3e2139c694
--- /dev/null
+++ b/apps/server/src/commands.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { listCommands, upsertCommand } from "./commands.js";
+
+describe("commands", () => {
+  test("upsertCommand omits null model from frontmatter", async () => {
+    const workspace = await mkdtemp(join(tmpdir(), "openwork-commands-"));
+
+    const path = await upsertCommand(workspace, {
+      name: "learn-files",
+      description: "Learn files",
+      template: "Show me the files",
+      model: null,
+    });
+
+    const content = await readFile(path, "utf8");
+    expect(content).not.toContain("model: null");
+    expect(content).not.toContain("model:");
+  });
+
+  test("listCommands repairs legacy null model frontmatter", async () => {
+    const workspace = await mkdtemp(join(tmpdir(), "openwork-commands-"));
+    const commandsDir = join(workspace, ".opencode", "commands");
+    const commandPath = join(commandsDir, "learn-files.md");
+
+    await mkdir(commandsDir, { recursive: true });
+    await writeFile(commandPath, "---\nname: learn-files\ndescription: Learn files\nmodel: null\n---\nShow me the files\n", "utf8");
+
+    const commands = await listCommands(workspace, "workspace");
+    expect(commands).toHaveLength(1);
+    expect(commands[0]?.model).toBeNull();
+
+    const repaired = await readFile(commandPath, "utf8");
+    expect(repaired).not.toContain("model: null");
+    expect(repaired).not.toContain("model:");
+  });
+});
diff --git a/apps/server/src/commands.ts b/apps/server/src/commands.ts
new file mode 100644
index 0000000000..f903f73d16
--- /dev/null
+++ b/apps/server/src/commands.ts
@@ -0,0 +1,115 @@
+import { readdir, readFile, writeFile, rm, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import type { CommandItem } from "./types.js";
+import { parseFrontmatter, buildFrontmatter } from "./frontmatter.js";
+import { exists } from "./utils.js";
+import { projectCommandsDir } from "./workspace-files.js";
+import { validateCommandName, sanitizeCommandName } from "./validators.js";
+import { ApiError } from "./errors.js";
+
+function normalizeCommandFrontmatter(data: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(data).filter(([, value]) => value !== null && value !== undefined),
+  );
+}
+
+async function repairLegacyCommandFile(filePath: string, content: string): Promise<{ data: Record<string, unknown>; body: string }> {
+  const parsed = parseFrontmatter(content);
+  if (parsed.data.model !== null) {
+    return parsed;
+  }
+
+  const nextContent = buildFrontmatter(normalizeCommandFrontmatter(parsed.data)) + parsed.body.replace(/^\n?/, "\n");
+  await writeFile(filePath, nextContent, "utf8");
+  return {
+    data: normalizeCommandFrontmatter(parsed.data),
+    body: parsed.body,
+  };
+}
+
+async function listCommandsInDir(dir: string, scope: "workspace" | "global"): Promise<CommandItem[]> {
+  if (!(await exists(dir))) return [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  const items: CommandItem[] = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith(".md")) continue;
+    const filePath = join(dir, entry.name);
+    const content = await readFile(filePath, "utf8");
+    const { data, body } = await repairLegacyCommandFile(filePath, content);
+    const name = typeof data.name === "string" ? data.name : entry.name.replace(/\.md$/, "");
+    try {
+      validateCommandName(name);
+    } catch {
+      continue;
+    }
+    items.push({
+      name,
+      description: typeof data.description === "string" ? data.description : undefined,
+      template: body.trim(),
+      agent: typeof data.agent === "string" ? data.agent : undefined,
+      model: typeof data.model === "string" ? data.model : null,
+      subtask: typeof data.subtask === "boolean" ? data.subtask : undefined,
+      scope,
+    });
+  }
+  return items;
+}
+
+export async function listCommands(workspaceRoot: string, scope: "workspace" | "global"): Promise<CommandItem[]> {
+  if (scope === "global") {
+    const dir = join(homedir(), ".config", "opencode", "commands");
+    return listCommandsInDir(dir, "global");
+  }
+  return listCommandsInDir(projectCommandsDir(workspaceRoot), "workspace");
+}
+
+export type UpsertCommandPayload = {
+  name: string;
+  description?: string;
+  template: string;
+  agent?: string;
+  model?: string | null;
+  subtask?: boolean;
+};
+
+export function buildCommandContent(payload: UpsertCommandPayload): { name: string; content: string } {
+  if (!payload.template || payload.template.trim().length === 0) {
+    throw new ApiError(400, "invalid_command_template", "Command template is required");
+  }
+  const sanitized = sanitizeCommandName(payload.name);
+  validateCommandName(sanitized);
+  const frontmatter = buildFrontmatter(normalizeCommandFrontmatter({
+    name: sanitized,
+    description: payload.description,
+    agent: payload.agent,
+    model: payload.model,
+    subtask: payload.subtask ?? false,
+  }));
+  const content = frontmatter + "\n" + payload.template.trim() + "\n";
+  return { name: sanitized, content };
+}
+
+export async function upsertCommand(
+  workspaceRoot: string,
+  payload: UpsertCommandPayload,
+): Promise<string> {
+  const command = buildCommandContent(payload);
+  const dir = projectCommandsDir(workspaceRoot);
+  await mkdir(dir, { recursive: true });
+  const path = join(dir, `${command.name}.md`);
+  await writeFile(path, command.content, "utf8");
+  return path;
+}
+
+export async function repairCommands(workspaceRoot: string): Promise<void> {
+  await listCommandsInDir(projectCommandsDir(workspaceRoot), "workspace");
+}
+
+export async function deleteCommand(workspaceRoot: string, name: string): Promise<void> {
+  const sanitized = sanitizeCommandName(name);
+  validateCommandName(sanitized);
+  const path = join(projectCommandsDir(workspaceRoot), `${sanitized}.md`);
+  await rm(path, { force: true });
+}
diff --git a/apps/server/src/config.ts b/apps/server/src/config.ts
new file mode 100644
index 0000000000..e1db03287e
--- /dev/null
+++ b/apps/server/src/config.ts
@@ -0,0 +1,337 @@
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import type { ApprovalMode, ApprovalConfig, ServerConfig, WorkspaceConfig, LogFormat } from "./types.js";
+import { buildWorkspaceInfos } from "./workspaces.js";
+import { parseList, readJsonFile, shortId } from "./utils.js";
+
+interface CliArgs {
+  configPath?: string;
+  host?: string;
+  port?: number;
+  token?: string;
+  hostToken?: string;
+  approvalMode?: ApprovalMode;
+  approvalTimeoutMs?: number;
+  opencodeBaseUrl?: string;
+  opencodeDirectory?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  workspaces: string[];
+  corsOrigins?: string[];
+  readOnly?: boolean;
+  verbose?: boolean;
+  logFormat?: LogFormat;
+  logRequests?: boolean;
+  version?: boolean;
+  help?: boolean;
+}
+
+interface FileConfig {
+  host?: string;
+  port?: number;
+  token?: string;
+  hostToken?: string;
+  approval?: Partial<ApprovalConfig>;
+  workspaces?: WorkspaceConfig[];
+  corsOrigins?: string[];
+  authorizedRoots?: string[];
+  readOnly?: boolean;
+  opencodeBaseUrl?: string;
+  opencodeDirectory?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  logFormat?: LogFormat;
+  logRequests?: boolean;
+}
+
+const DEFAULT_PORT = 8787;
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_TIMEOUT_MS = 30000;
+const DEFAULT_LOG_FORMAT: LogFormat = "pretty";
+const DEFAULT_LOG_REQUESTS = true;
+
+function normalizeLogFormat(value: string | undefined): LogFormat | undefined {
+  if (!value) return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "json") return "json";
+  if (normalized === "pretty" || normalized === "text" || normalized === "human") return "pretty";
+  return undefined;
+}
+
+function parseBoolean(value: string | undefined): boolean | undefined {
+  if (!value) return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (["true", "1", "yes", "on"].includes(normalized)) return true;
+  if (["false", "0", "no", "off"].includes(normalized)) return false;
+  return undefined;
+}
+
+export function parseCliArgs(argv: string[]): CliArgs {
+  const args: CliArgs = { workspaces: [] };
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value) continue;
+    if (value === "--help" || value === "-h") {
+      args.help = true;
+      continue;
+    }
+    if (value === "--version") {
+      args.version = true;
+      continue;
+    }
+    if (value === "--verbose") {
+      args.verbose = true;
+      continue;
+    }
+    if (value === "--log-format") {
+      args.logFormat = argv[index + 1] as LogFormat | undefined;
+      index += 1;
+      continue;
+    }
+    if (value === "--log-requests") {
+      args.logRequests = true;
+      continue;
+    }
+    if (value === "--no-log-requests") {
+      args.logRequests = false;
+      continue;
+    }
+    if (value === "--config") {
+      args.configPath = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--host") {
+      args.host = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--port") {
+      const port = Number(argv[index + 1]);
+      if (!Number.isNaN(port)) args.port = port;
+      index += 1;
+      continue;
+    }
+    if (value === "--token") {
+      args.token = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--host-token") {
+      args.hostToken = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--approval") {
+      const mode = argv[index + 1] as ApprovalMode | undefined;
+      if (mode === "manual" || mode === "auto") args.approvalMode = mode;
+      index += 1;
+      continue;
+    }
+    if (value === "--approval-timeout") {
+      const timeout = Number(argv[index + 1]);
+      if (!Number.isNaN(timeout)) args.approvalTimeoutMs = timeout;
+      index += 1;
+      continue;
+    }
+    if (value === "--opencode-base-url") {
+      args.opencodeBaseUrl = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--opencode-directory") {
+      args.opencodeDirectory = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--opencode-username") {
+      args.opencodeUsername = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--opencode-password") {
+      args.opencodePassword = argv[index + 1];
+      index += 1;
+      continue;
+    }
+    if (value === "--workspace") {
+      const path = argv[index + 1];
+      if (path) args.workspaces.push(path);
+      index += 1;
+      continue;
+    }
+    if (value === "--cors") {
+      args.corsOrigins = parseList(argv[index + 1]);
+      index += 1;
+      continue;
+    }
+    if (value === "--read-only") {
+      args.readOnly = true;
+      continue;
+    }
+  }
+  return args;
+}
+
+export function printHelp(): void {
+  const message = [
+    "openwork-server",
+    "",
+    "Options:",
+    "  --config <path>          Path to server.json",
+    "  --host <host>            Hostname (default 127.0.0.1)",
+    "  --port <port>            Port (default 8787)",
+    "  --token <token>          Client bearer token",
+    "  --host-token <token>     Host approval token",
+    "  --approval <mode>        manual | auto",
+    "  --approval-timeout <ms>  Approval timeout",
+    "  --opencode-base-url <url> OpenCode base URL to share",
+    "  --opencode-directory <path> OpenCode workspace directory to share",
+    "  --opencode-username <user> OpenCode server username",
+    "  --opencode-password <pass> OpenCode server password",
+    "  --workspace <path>       Workspace root (repeatable)",
+    "  --cors <origins>          Comma-separated origins or *",
+    "  --read-only              Disable writes",
+    "  --log-format <format>     Log output format: pretty | json",
+    "  --log-requests           Log incoming requests (default: true)",
+    "  --no-log-requests        Disable request logging",
+    "  --verbose                Print resolved config",
+    "  --version                Show version",
+  ].join("\n");
+  console.log(message);
+}
+
+async function loadFileConfig(configPath: string): Promise<FileConfig> {
+  const parsed = await readJsonFile<FileConfig>(configPath);
+  return parsed ?? {};
+}
+
+export async function resolveServerConfig(cli: CliArgs): Promise<ServerConfig> {
+  const envConfigPath = process.env.OPENWORK_SERVER_CONFIG;
+  const configPath = cli.configPath ?? envConfigPath ?? resolve(homedir(), ".config", "openwork", "server.json");
+  const fileConfig = await loadFileConfig(configPath);
+  const configDir = dirname(configPath);
+
+  const envWorkspaces = parseList(process.env.OPENWORK_WORKSPACES);
+  let workspaceConfigs: WorkspaceConfig[] =
+    cli.workspaces.length > 0
+      ? cli.workspaces.map((path) => ({ path }))
+      : envWorkspaces.length > 0
+        ? envWorkspaces.map((path) => ({ path }))
+        : fileConfig.workspaces ?? [];
+
+  const envOpencodeBaseUrl = process.env.OPENWORK_OPENCODE_BASE_URL;
+  const envOpencodeDirectory = process.env.OPENWORK_OPENCODE_DIRECTORY;
+  const envOpencodeUsername = process.env.OPENWORK_OPENCODE_USERNAME;
+  const envOpencodePassword = process.env.OPENWORK_OPENCODE_PASSWORD;
+  const opencodeBaseUrl = cli.opencodeBaseUrl ?? envOpencodeBaseUrl ?? fileConfig.opencodeBaseUrl;
+  const opencodeDirectory = cli.opencodeDirectory ?? envOpencodeDirectory ?? fileConfig.opencodeDirectory;
+  const opencodeUsername = cli.opencodeUsername ?? envOpencodeUsername ?? fileConfig.opencodeUsername;
+  const opencodePassword = cli.opencodePassword ?? envOpencodePassword ?? fileConfig.opencodePassword;
+
+  if (workspaceConfigs.length > 0 && (opencodeBaseUrl || opencodeDirectory || opencodeUsername || opencodePassword)) {
+    const allowDirectoryOverride = workspaceConfigs.length === 1 && opencodeDirectory;
+    workspaceConfigs = workspaceConfigs.map((workspace, index) => {
+      const nextDirectory =
+        workspace.directory ?? (allowDirectoryOverride && index === 0 ? opencodeDirectory : undefined);
+      return {
+        ...workspace,
+        baseUrl: workspace.baseUrl ?? opencodeBaseUrl,
+        directory: nextDirectory,
+        opencodeUsername: workspace.opencodeUsername ?? opencodeUsername,
+        opencodePassword: workspace.opencodePassword ?? opencodePassword,
+      };
+    });
+  }
+
+  const workspaces = buildWorkspaceInfos(workspaceConfigs, configDir);
+
+  const tokenFromEnv = process.env.OPENWORK_TOKEN;
+  const hostTokenFromEnv = process.env.OPENWORK_HOST_TOKEN;
+
+  const token = cli.token ?? tokenFromEnv ?? fileConfig.token ?? shortId();
+  const hostToken = cli.hostToken ?? hostTokenFromEnv ?? fileConfig.hostToken ?? shortId();
+
+  const tokenSource: ServerConfig["tokenSource"] = cli.token
+    ? "cli"
+    : tokenFromEnv
+      ? "env"
+      : fileConfig.token
+        ? "file"
+        : "generated";
+
+  const hostTokenSource: ServerConfig["hostTokenSource"] = cli.hostToken
+    ? "cli"
+    : hostTokenFromEnv
+      ? "env"
+      : fileConfig.hostToken
+        ? "file"
+        : "generated";
+
+  const approvalMode =
+    cli.approvalMode ??
+    (process.env.OPENWORK_APPROVAL_MODE as ApprovalMode | undefined) ??
+    fileConfig.approval?.mode ??
+    "manual";
+
+  const approvalTimeoutMs =
+    cli.approvalTimeoutMs ??
+    (process.env.OPENWORK_APPROVAL_TIMEOUT_MS ? Number(process.env.OPENWORK_APPROVAL_TIMEOUT_MS) : undefined) ??
+    fileConfig.approval?.timeoutMs ??
+    DEFAULT_TIMEOUT_MS;
+
+  const approval: ApprovalConfig = {
+    mode: approvalMode === "auto" ? "auto" : "manual",
+    timeoutMs: Number.isNaN(approvalTimeoutMs) ? DEFAULT_TIMEOUT_MS : approvalTimeoutMs,
+  };
+
+  const envCorsOrigins = process.env.OPENWORK_CORS_ORIGINS;
+  const parsedEnvCors = envCorsOrigins ? parseList(envCorsOrigins) : null;
+  const corsOrigins = cli.corsOrigins ?? parsedEnvCors ?? fileConfig.corsOrigins ?? ["*"];
+
+  const envReadOnly = process.env.OPENWORK_READONLY;
+  const parsedReadOnly = envReadOnly
+    ? ["true", "1", "yes"].includes(envReadOnly.toLowerCase())
+    : undefined;
+  const readOnly = cli.readOnly ?? parsedReadOnly ?? fileConfig.readOnly ?? false;
+
+  const envLogFormat = process.env.OPENWORK_LOG_FORMAT;
+  const logFormat =
+    cli.logFormat ??
+    normalizeLogFormat(envLogFormat) ??
+    normalizeLogFormat(fileConfig.logFormat) ??
+    DEFAULT_LOG_FORMAT;
+
+  const envLogRequests = parseBoolean(process.env.OPENWORK_LOG_REQUESTS);
+  const logRequests = cli.logRequests ?? envLogRequests ?? fileConfig.logRequests ?? DEFAULT_LOG_REQUESTS;
+
+  const authorizedRoots =
+    fileConfig.authorizedRoots?.length
+      ? fileConfig.authorizedRoots.map((root) => resolve(configDir, root))
+      : workspaces.map((workspace) => workspace.path);
+
+  const host = cli.host ?? process.env.OPENWORK_HOST ?? fileConfig.host ?? DEFAULT_HOST;
+  const port = cli.port ?? (process.env.OPENWORK_PORT ? Number(process.env.OPENWORK_PORT) : undefined) ?? fileConfig.port ?? DEFAULT_PORT;
+
+  return {
+    host,
+    port: Number.isNaN(port) ? DEFAULT_PORT : port,
+    token,
+    hostToken,
+    configPath,
+    opencodeBaseUrl,
+    opencodeDirectory,
+    opencodeUsername,
+    opencodePassword,
+    approval,
+    corsOrigins,
+    workspaces,
+    authorizedRoots,
+    readOnly,
+    startedAt: Date.now(),
+    tokenSource,
+    hostTokenSource,
+    logFormat,
+    logRequests,
+  };
+}
diff --git a/apps/server/src/env-file.test.ts b/apps/server/src/env-file.test.ts
new file mode 100644
index 0000000000..2a9142ce59
--- /dev/null
+++ b/apps/server/src/env-file.test.ts
@@ -0,0 +1,172 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  EnvService,
+  EnvStoreReadError,
+  InvalidEnvKeyError,
+  isReservedEnvKey,
+  isValidEnvKey,
+} from "./env-file.js";
+
+describe("env-file", () => {
+  let dir: string;
+  let path: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "openwork-env-"));
+    path = join(dir, "env.json");
+  });
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("isValidEnvKey accepts POSIX names, rejects garbage", () => {
+    expect(isValidEnvKey("ANTHROPIC_API_KEY")).toBe(true);
+    expect(isValidEnvKey("_x")).toBe(true);
+    expect(isValidEnvKey("GCLOUD_PROJECT")).toBe(true);
+    expect(isValidEnvKey("1BAD")).toBe(false);
+    expect(isValidEnvKey("has space")).toBe(false);
+    expect(isValidEnvKey("has-dash")).toBe(false);
+    expect(isValidEnvKey("")).toBe(false);
+  });
+
+  test("isReservedEnvKey blocks OPENWORK_ / OPENCODE_ prefixes", () => {
+    expect(isReservedEnvKey("OPENWORK_TOKEN")).toBe(true);
+    expect(isReservedEnvKey("OPENCODE_SERVER_PASSWORD")).toBe(true);
+    expect(isReservedEnvKey("ANTHROPIC_API_KEY")).toBe(false);
+    expect(isReservedEnvKey("GCLOUD_PROJECT")).toBe(false);
+  });
+
+  test("upsertMany + list round-trips with sorted keys", async () => {
+    const svc = new EnvService({ path });
+    await svc.upsertMany([
+      { key: "ZED", value: "z" },
+      { key: "ANTHROPIC_API_KEY", value: "sk-ant-abc123" },
+    ]);
+    const items = await svc.list();
+    expect(items.map((e) => e.key)).toEqual(["ANTHROPIC_API_KEY", "ZED"]);
+    expect(items.find((e) => e.key === "ANTHROPIC_API_KEY")?.value).toBe("sk-ant-abc123");
+  });
+
+  test("upsertMany updates existing keys in place", async () => {
+    const svc = new EnvService({ path });
+    await svc.upsertMany([{ key: "FOO", value: "1" }]);
+    await svc.upsertMany([{ key: "FOO", value: "2" }]);
+    const items = await svc.list();
+    expect(items).toHaveLength(1);
+    expect(items[0].value).toBe("2");
+  });
+
+  test("concurrent upserts do not overwrite each other", async () => {
+    const svc = new EnvService({ path });
+    await Promise.all(
+      Array.from({ length: 12 }, (_, index) =>
+        svc.upsertMany([{ key: `KEY_${index}`, value: String(index) }])
+      ),
+    );
+
+    const items = await svc.list();
+    expect(items.map((item) => item.key)).toEqual(
+      Array.from({ length: 12 }, (_, index) => `KEY_${index}`).sort(),
+    );
+  });
+
+  test("write failures do not mutate loaded values", async () => {
+    const svc = new EnvService({ path });
+    await svc.upsertMany([{ key: "KEEP_ME", value: "old" }]);
+
+    rmSync(path, { force: true });
+    mkdirSync(path);
+
+    await expect(svc.upsertMany([{ key: "NEW_KEY", value: "new" }])).rejects.toThrow();
+    expect(await svc.list()).toEqual([
+      expect.objectContaining({ key: "KEEP_ME", value: "old" }),
+    ]);
+  });
+
+  test("upsertMany rejects invalid keys with InvalidEnvKeyError", async () => {
+    const svc = new EnvService({ path });
+    const promise = svc.upsertMany([{ key: "bad-key", value: "x" }]);
+    await expect(promise).rejects.toBeInstanceOf(InvalidEnvKeyError);
+    await expect(promise).rejects.toMatchObject({ code: "invalid_env_key" });
+  });
+
+  test("upsertMany rejects reserved keys", async () => {
+    const svc = new EnvService({ path });
+    const promise = svc.upsertMany([{ key: "OPENWORK_TOKEN", value: "x" }]);
+    await expect(promise).rejects.toBeInstanceOf(InvalidEnvKeyError);
+    await expect(promise).rejects.toMatchObject({ code: "reserved_env_key" });
+  });
+
+  test("delete returns false when the key is missing", async () => {
+    const svc = new EnvService({ path });
+    await svc.upsertMany([{ key: "FOO", value: "x" }]);
+    expect(await svc.delete("FOO")).toBe(true);
+    expect(await svc.delete("FOO")).toBe(false);
+  });
+
+  test("persisted file has 0600 perms on POSIX", async () => {
+    if (process.platform === "win32") return;
+    const svc = new EnvService({ path });
+    await svc.upsertMany([{ key: "FOO", value: "bar" }]);
+    const mode = statSync(path).mode & 0o777;
+    expect(mode).toBe(0o600);
+  });
+
+  test("readForInjection returns a plain key/value map", async () => {
+    const svc = new EnvService({ path });
+    await svc.upsertMany([
+      { key: "A", value: "1" },
+      { key: "B", value: "2" },
+    ]);
+    const injected = await EnvService.readForInjection(path);
+    expect(injected).toEqual({ A: "1", B: "2" });
+  });
+
+  test("readForInjection strips reserved keys even if present on disk", async () => {
+    // Simulate a hand-edited env.json that contains a reserved key. The
+    // service refuses to write these, but the injection path must still
+    // defend against a file someone tampered with.
+    writeFileSync(
+      path,
+      JSON.stringify({
+        schemaVersion: 1,
+        updatedAt: Date.now(),
+        variables: [
+          { key: "OPENWORK_TOKEN", value: "stolen" },
+          { key: "ANTHROPIC_API_KEY", value: "sk-ant" },
+        ],
+      }),
+    );
+    const injected = await EnvService.readForInjection(path);
+    expect(injected).toEqual({ ANTHROPIC_API_KEY: "sk-ant" });
+  });
+
+  test("readForInjection returns {} when the file is missing", async () => {
+    const injected = await EnvService.readForInjection(join(dir, "nope.json"));
+    expect(injected).toEqual({});
+  });
+
+  test("readForInjection returns {} on corrupted JSON", async () => {
+    writeFileSync(path, "{ this is not json");
+    const injected = await EnvService.readForInjection(path);
+    expect(injected).toEqual({});
+  });
+
+  test("list rejects corrupted JSON instead of treating it as empty", async () => {
+    writeFileSync(path, "{ this is not json");
+    const svc = new EnvService({ path });
+    await expect(svc.list()).rejects.toBeInstanceOf(EnvStoreReadError);
+  });
+
+  test("upsertMany does not overwrite an invalid store", async () => {
+    writeFileSync(path, "{ this is not json");
+    const svc = new EnvService({ path });
+    await expect(svc.upsertMany([{ key: "SAFE", value: "new" }])).rejects.toBeInstanceOf(EnvStoreReadError);
+    expect(readFileSync(path, "utf8")).toBe("{ this is not json");
+  });
+});
diff --git a/apps/server/src/env-file.ts b/apps/server/src/env-file.ts
new file mode 100644
index 0000000000..655d08e2fa
--- /dev/null
+++ b/apps/server/src/env-file.ts
@@ -0,0 +1,257 @@
+import { homedir, platform } from "node:os";
+import { chmod, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+
+import { ensureDir, exists } from "./utils.js";
+
+// User-level environment variables, persisted so the desktop shell can inject
+// them into every spawned child (OpenCode, OpenWork server, opencode-router).
+// Motivation: Linux GUI launches don't inherit shell env, so users set
+// ANTHROPIC_API_KEY / GCLOUD_* / GCP_* in .bashrc and hit silent auth failures.
+// Scope: user/machine, not workspace. Not synced to the cloud.
+
+const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+// Keys reserved for internal wiring by the shell/orchestrator/server. This UI
+// is for service credentials, not OpenWork/OpenCode runtime knobs; users who
+// need OPENCODE_* process settings should set them from the launching shell.
+// We refuse writes to these and strip them when reading for injection, so a
+// tampered file cannot shadow auth credentials, token paths, or process
+// identity.
+const RESERVED_PREFIXES = ["OPENWORK_", "OPENCODE_"] as const;
+
+export type EnvRecord = {
+  key: string;
+  value: string;
+  updatedAt: number;
+};
+
+type EnvStoreFile = {
+  schemaVersion: number;
+  updatedAt: number;
+  variables: EnvRecord[];
+};
+
+export function isValidEnvKey(key: string): boolean {
+  return ENV_KEY_PATTERN.test(key);
+}
+
+export function isReservedEnvKey(key: string): boolean {
+  return RESERVED_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+
+// Deterministic, matches what the Rust/Node shells compute independently.
+// Do NOT key this off ServerConfig.configPath — the shell resolves the path
+// before the server config exists, and must agree with us byte-for-byte.
+export function resolveDefaultEnvStorePath(): string {
+  const override = (process.env.OPENWORK_ENV_STORE ?? "").trim();
+  if (override) return resolve(override);
+
+  if (platform() === "win32") {
+    const appData = (process.env.APPDATA ?? "").trim();
+    const root = appData || join(homedir(), "AppData", "Roaming");
+    return join(root, "openwork", "env.json");
+  }
+  return join(homedir(), ".config", "openwork", "env.json");
+}
+
+function parseRecord(raw: unknown): EnvRecord | null {
+  if (!raw || typeof raw !== "object") return null;
+  const record = raw as Partial<EnvRecord>;
+  const key = typeof record.key === "string" ? record.key : "";
+  const value = typeof record.value === "string" ? record.value : "";
+  if (!isValidEnvKey(key)) return null;
+  return {
+    key,
+    value,
+    updatedAt: typeof record.updatedAt === "number" ? record.updatedAt : Date.now(),
+  };
+}
+
+function emptyStore(): EnvStoreFile {
+  return { schemaVersion: 1, updatedAt: Date.now(), variables: [] };
+}
+
+async function readStore(
+  path: string,
+  options: { tolerateInvalid?: boolean } = {},
+): Promise<EnvStoreFile> {
+  if (!(await exists(path))) {
+    return emptyStore();
+  }
+  let raw = "";
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    if ((error as { code?: string }).code === "ENOENT") return emptyStore();
+    if (options.tolerateInvalid) return emptyStore();
+    throw new EnvStoreReadError("Environment variable store could not be read");
+  }
+
+  let parsed: Partial<EnvStoreFile>;
+  try {
+    parsed = JSON.parse(raw) as Partial<EnvStoreFile>;
+  } catch {
+    if (options.tolerateInvalid) return emptyStore();
+    throw new EnvStoreReadError("Environment variable store is invalid JSON");
+  }
+
+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.variables)) {
+    if (options.tolerateInvalid) return emptyStore();
+    throw new EnvStoreReadError("Environment variable store has an invalid format");
+  }
+
+  const variables = parsed.variables
+    .map(parseRecord)
+    .filter((entry): entry is EnvRecord => Boolean(entry));
+  return {
+    schemaVersion: typeof parsed.schemaVersion === "number" ? parsed.schemaVersion : 1,
+    updatedAt: typeof parsed.updatedAt === "number" ? parsed.updatedAt : Date.now(),
+    variables,
+  };
+}
+
+async function writeStore(path: string, variables: EnvRecord[]): Promise<void> {
+  const dir = dirname(path);
+  await ensureDir(dir);
+  const payload: EnvStoreFile = {
+    schemaVersion: 1,
+    updatedAt: Date.now(),
+    variables,
+  };
+  const tempPath = join(
+    dir,
+    `.env.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,
+  );
+  await writeFile(tempPath, JSON.stringify(payload, null, 2) + "\n", {
+    encoding: "utf8",
+    flag: "wx",
+    mode: 0o600,
+  });
+  try {
+    await chmod(tempPath, 0o600);
+  } catch (error) {
+    // chmod is a no-op on Windows; values may still contain secrets.
+    if (platform() !== "win32") {
+      await rm(tempPath, { force: true }).catch(() => {});
+      throw error;
+    }
+  }
+  try {
+    await rename(tempPath, path);
+  } catch (error) {
+    await rm(tempPath, { force: true }).catch(() => {});
+    throw error;
+  }
+  try {
+    await chmod(path, 0o600);
+  } catch (error) {
+    // chmod is a no-op on Windows; values may still contain secrets.
+    if (platform() !== "win32") throw error;
+  }
+}
+
+export type EnvEntry = { key: string; value: string };
+
+export class EnvService {
+  private readonly path: string;
+  private loaded = false;
+  private loadPromise: Promise<void> | null = null;
+  private mutationQueue: Promise<void> = Promise.resolve();
+  private variables: EnvRecord[] = [];
+
+  constructor(options?: { path?: string }) {
+    this.path = options?.path ? resolve(options.path) : resolveDefaultEnvStorePath();
+  }
+
+  private async ensureLoaded(): Promise<void> {
+    if (this.loaded) return;
+    if (!this.loadPromise) {
+      this.loadPromise = readStore(this.path)
+        .then((store) => {
+          this.variables = store.variables;
+          this.loaded = true;
+        })
+        .finally(() => {
+          this.loadPromise = null;
+        });
+    }
+    await this.loadPromise;
+  }
+
+  private enqueueMutation<T>(operation: () => Promise<T>): Promise<T> {
+    const run = this.mutationQueue.catch(() => {}).then(operation);
+    this.mutationQueue = run.then(
+      () => {},
+      () => {},
+    );
+    return run;
+  }
+
+  async list(): Promise<EnvRecord[]> {
+    await this.ensureLoaded();
+    return this.variables.slice();
+  }
+
+  async upsertMany(entries: EnvEntry[]): Promise<void> {
+    return this.enqueueMutation(async () => {
+      await this.ensureLoaded();
+      const now = Date.now();
+      const next = new Map(this.variables.map((entry) => [entry.key, entry] as const));
+      for (const entry of entries) {
+        if (!isValidEnvKey(entry.key)) {
+          throw new InvalidEnvKeyError(entry.key, "invalid_env_key");
+        }
+        if (isReservedEnvKey(entry.key)) {
+          throw new InvalidEnvKeyError(entry.key, "reserved_env_key");
+        }
+        next.set(entry.key, { key: entry.key, value: entry.value, updatedAt: now });
+      }
+      const nextVariables = Array.from(next.values()).sort((a, b) => a.key.localeCompare(b.key));
+      await writeStore(this.path, nextVariables);
+      this.variables = nextVariables;
+    });
+  }
+
+  async delete(key: string): Promise<boolean> {
+    return this.enqueueMutation(async () => {
+      await this.ensureLoaded();
+      const before = this.variables.length;
+      const nextVariables = this.variables.filter((entry) => entry.key !== key);
+      if (nextVariables.length === before) return false;
+      await writeStore(this.path, nextVariables);
+      this.variables = nextVariables;
+      return true;
+    });
+  }
+
+  // Used by the Electron + orchestrator shells at spawn time. The Tauri Rust
+  // shell has its own equivalent in src-tauri/src/env_file.rs — keep the two
+  // readers byte-for-byte in sync on path resolution and reserved-keys policy.
+  static async readForInjection(overridePath?: string): Promise<Record<string, string>> {
+    const path = overridePath?.trim() ? resolve(overridePath.trim()) : resolveDefaultEnvStorePath();
+    const store = await readStore(path, { tolerateInvalid: true });
+    const out: Record<string, string> = {};
+    for (const entry of store.variables) {
+      if (isReservedEnvKey(entry.key)) continue;
+      out[entry.key] = entry.value;
+    }
+    return out;
+  }
+}
+
+export class EnvStoreReadError extends Error {
+  readonly code = "invalid_env_store";
+}
+
+export class InvalidEnvKeyError extends Error {
+  readonly code: "invalid_env_key" | "reserved_env_key";
+  constructor(key: string, code: "invalid_env_key" | "reserved_env_key") {
+    super(
+      code === "reserved_env_key"
+        ? `Environment variable name is reserved for OpenWork internals: ${key}`
+        : `Invalid environment variable name: ${key}`,
+    );
+    this.code = code;
+  }
+}
diff --git a/apps/server/src/env-routes.e2e.test.ts b/apps/server/src/env-routes.e2e.test.ts
new file mode 100644
index 0000000000..5e812d0091
--- /dev/null
+++ b/apps/server/src/env-routes.e2e.test.ts
@@ -0,0 +1,264 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { startServer } from "./server.js";
+import type { ServerConfig } from "./types.js";
+
+type Served = {
+  port: number;
+  stop: (closeActiveConnections?: boolean) => void | Promise<void>;
+};
+
+const HOST_TOKEN = "owt_env_host_token";
+const stops: Array<() => void | Promise<void>> = [];
+const dirs: string[] = [];
+const priorEnvStore = process.env.OPENWORK_ENV_STORE;
+const priorTokenStore = process.env.OPENWORK_TOKEN_STORE;
+
+function baseConfig(): ServerConfig {
+  return {
+    host: "127.0.0.1",
+    port: 0,
+    token: "owt_env_client_token",
+    hostToken: HOST_TOKEN,
+    approval: { mode: "auto", timeoutMs: 1000 },
+    corsOrigins: ["*"],
+    workspaces: [],
+    authorizedRoots: [],
+    readOnly: false,
+    startedAt: Date.now(),
+    tokenSource: "cli",
+    hostTokenSource: "cli",
+    logFormat: "pretty",
+    logRequests: false,
+  } as ServerConfig;
+}
+
+function boot() {
+  const server = startServer(baseConfig()) as Served;
+  stops.push(() => server.stop(true));
+  return {
+    server,
+    base: `http://127.0.0.1:${server.port}`,
+  };
+}
+
+function hostAuth() {
+  return { "x-openwork-host-token": HOST_TOKEN, "content-type": "application/json" };
+}
+
+beforeEach(() => {
+  const dir = mkdtempSync(join(tmpdir(), "openwork-env-routes-"));
+  dirs.push(dir);
+  // Redirect the shared env.json path into a throwaway dir so the test never
+  // touches the developer's real ~/.config/openwork/env.json.
+  process.env.OPENWORK_ENV_STORE = join(dir, "env.json");
+  process.env.OPENWORK_TOKEN_STORE = join(dir, "tokens.json");
+});
+
+afterEach(async () => {
+  while (stops.length) {
+    await stops.pop()?.();
+  }
+  while (dirs.length) {
+    rmSync(dirs.pop()!, { recursive: true, force: true });
+  }
+  if (priorEnvStore === undefined) {
+    delete process.env.OPENWORK_ENV_STORE;
+  } else {
+    process.env.OPENWORK_ENV_STORE = priorEnvStore;
+  }
+  if (priorTokenStore === undefined) {
+    delete process.env.OPENWORK_TOKEN_STORE;
+  } else {
+    process.env.OPENWORK_TOKEN_STORE = priorTokenStore;
+  }
+});
+
+describe("env routes", () => {
+  test("rejects unauthenticated requests", async () => {
+    const { base } = boot();
+    const response = await fetch(`${base}/env`);
+    expect(response.status).toBe(401);
+  });
+
+  test("rejects owner bearer tokens", async () => {
+    const { base } = boot();
+    const issued = await fetch(`${base}/tokens`, {
+      method: "POST",
+      headers: hostAuth(),
+      body: JSON.stringify({ scope: "owner", label: "test owner" }),
+    });
+    expect(issued.status).toBe(201);
+    const body = (await issued.json()) as { token: string };
+
+    const response = await fetch(`${base}/env`, {
+      headers: { authorization: `Bearer ${body.token}` },
+    });
+    expect(response.status).toBe(401);
+  });
+
+  test("CORS preflight allows PUT", async () => {
+    const { base } = boot();
+    const response = await fetch(`${base}/env`, {
+      method: "OPTIONS",
+      headers: {
+        origin: "http://localhost:5173",
+        "access-control-request-method": "PUT",
+      },
+    });
+    expect(response.status).toBe(204);
+    expect(response.headers.get("access-control-allow-methods")).toContain("PUT");
+  });
+
+  test("PUT + GET round-trips a single entry and returns raw values", async () => {
+    const { base } = boot();
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "ANTHROPIC_API_KEY", value: "sk-ant-abc" }),
+    });
+    expect(put.status).toBe(200);
+    expect(await put.json()).toEqual({ ok: true, count: 1 });
+
+    const list = await fetch(`${base}/env`, { headers: hostAuth() });
+    expect(list.status).toBe(200);
+    const body = (await list.json()) as { items: Array<{ key: string; value: string }> };
+    expect(body.items).toHaveLength(1);
+    expect(body.items[0]).toMatchObject({ key: "ANTHROPIC_API_KEY", value: "sk-ant-abc" });
+  });
+
+  test("GET /env/keys returns names without values", async () => {
+    const { base } = boot();
+    await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({
+        entries: [
+          { key: "ANTHROPIC_API_KEY", value: "sk-ant-abc" },
+          { key: "NBA_LIVE_KEY", value: "secret-value" },
+        ],
+      }),
+    });
+
+    const list = await fetch(`${base}/env/keys`, { headers: hostAuth() });
+    expect(list.status).toBe(200);
+    expect(await list.json()).toEqual({ keys: ["ANTHROPIC_API_KEY", "NBA_LIVE_KEY"] });
+  });
+
+  test("invalid env store returns 409 instead of overwriting on PUT", async () => {
+    writeFileSync(process.env.OPENWORK_ENV_STORE!, "{ this is not json");
+    const { base } = boot();
+
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "SAFE", value: "new" }),
+    });
+
+    expect(put.status).toBe(409);
+    const body = (await put.json()) as { code: string; message: string };
+    expect(body.code).toBe("invalid_env_store");
+  });
+
+  test("PUT accepts a batch via entries[]", async () => {
+    const { base } = boot();
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({
+        entries: [
+          { key: "A", value: "1" },
+          { key: "B", value: "2" },
+        ],
+      }),
+    });
+    expect(put.status).toBe(200);
+    expect(await put.json()).toEqual({ ok: true, count: 2 });
+
+    const body = (await (await fetch(`${base}/env`, { headers: hostAuth() })).json()) as {
+      items: Array<{ key: string }>;
+    };
+    expect(body.items.map((i) => i.key)).toEqual(["A", "B"]);
+  });
+
+  test("PUT rejects invalid keys with 400", async () => {
+    const { base } = boot();
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "bad-key", value: "x" }),
+    });
+    expect(put.status).toBe(400);
+    const body = (await put.json()) as { code: string; message: string };
+    expect(body.code).toBe("invalid_env_key");
+    expect(body.message).toBe("Invalid environment variable name");
+    expect(body.message).not.toContain("bad-key");
+  });
+
+  test("PUT rejects reserved keys with 400", async () => {
+    const { base } = boot();
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "OPENWORK_TOKEN", value: "x" }),
+    });
+    expect(put.status).toBe(400);
+    const body = (await put.json()) as { code: string; message: string };
+    expect(body.code).toBe("reserved_env_key");
+    expect(body.message).toBe("Environment variable name is reserved for OpenWork internals");
+    expect(body.message).not.toContain("OPENWORK_TOKEN");
+  });
+
+  test("PUT with no entries returns 400", async () => {
+    const { base } = boot();
+    const put = await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ entries: [] }),
+    });
+    expect(put.status).toBe(400);
+  });
+
+  test("DELETE removes an existing entry", async () => {
+    const { base } = boot();
+    await fetch(`${base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "FOO", value: "bar" }),
+    });
+
+    const del = await fetch(`${base}/env/FOO`, { method: "DELETE", headers: hostAuth() });
+    expect(del.status).toBe(200);
+
+    const list = (await (await fetch(`${base}/env`, { headers: hostAuth() })).json()) as {
+      items: unknown[];
+    };
+    expect(list.items).toHaveLength(0);
+  });
+
+  test("DELETE on missing key returns 404", async () => {
+    const { base } = boot();
+    const del = await fetch(`${base}/env/MISSING`, { method: "DELETE", headers: hostAuth() });
+    expect(del.status).toBe(404);
+  });
+
+  test("values persist across server restart", async () => {
+    const first = boot();
+    await fetch(`${first.base}/env`, {
+      method: "PUT",
+      headers: hostAuth(),
+      body: JSON.stringify({ key: "PERSISTED", value: "yes" }),
+    });
+    await first.server.stop(true);
+    stops.pop();
+
+    const second = boot();
+    const body = (await (await fetch(`${second.base}/env`, { headers: hostAuth() })).json()) as {
+      items: Array<{ key: string; value: string }>;
+    };
+    expect(body.items).toEqual([expect.objectContaining({ key: "PERSISTED", value: "yes" })]);
+  });
+});
diff --git a/apps/server/src/errors.ts b/apps/server/src/errors.ts
new file mode 100644
index 0000000000..0857aa1491
--- /dev/null
+++ b/apps/server/src/errors.ts
@@ -0,0 +1,22 @@
+import type { ApiErrorBody } from "./types.js";
+
+export class ApiError extends Error {
+  status: number;
+  code: string;
+  details?: unknown;
+
+  constructor(status: number, code: string, message: string, details?: unknown) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+}
+
+export function formatError(err: ApiError): ApiErrorBody {
+  return {
+    code: err.code,
+    message: err.message,
+    details: err.details,
+  };
+}
diff --git a/apps/server/src/events.ts b/apps/server/src/events.ts
new file mode 100644
index 0000000000..c547759c74
--- /dev/null
+++ b/apps/server/src/events.ts
@@ -0,0 +1,54 @@
+import type { ReloadEvent, ReloadReason, ReloadTrigger } from "./types.js";
+import { shortId } from "./utils.js";
+
+export class ReloadEventStore {
+  private events: ReloadEvent[] = [];
+  private seq = 0;
+  private maxSize: number;
+  private lastRecorded: Map<string, number> = new Map();
+
+  constructor(maxSize = 200) {
+    this.maxSize = maxSize;
+  }
+
+  record(workspaceId: string, reason: ReloadReason, trigger?: ReloadTrigger): ReloadEvent {
+    const event: ReloadEvent = {
+      id: shortId(),
+      seq: ++this.seq,
+      workspaceId,
+      reason,
+      trigger,
+      timestamp: Date.now(),
+    };
+
+    this.events.push(event);
+    if (this.events.length > this.maxSize) {
+      this.events.splice(0, this.events.length - this.maxSize);
+    }
+
+    return event;
+  }
+
+  recordDebounced(
+    workspaceId: string,
+    reason: ReloadReason,
+    trigger?: ReloadTrigger,
+    debounceMs = 750,
+  ): ReloadEvent | null {
+    const now = Date.now();
+    const key = `${workspaceId}:${reason}`;
+    const last = this.lastRecorded.get(key) ?? 0;
+    if (now - last < debounceMs) return null;
+    this.lastRecorded.set(key, now);
+    return this.record(workspaceId, reason, trigger);
+  }
+
+  list(workspaceId: string, since?: number): ReloadEvent[] {
+    const cursor = Number.isFinite(since) ? (since as number) : 0;
+    return this.events.filter((event) => event.workspaceId === workspaceId && event.seq > cursor);
+  }
+
+  cursor(): number {
+    return this.seq;
+  }
+}
diff --git a/apps/server/src/file-sessions.test.ts b/apps/server/src/file-sessions.test.ts
new file mode 100644
index 0000000000..7d8db105ed
--- /dev/null
+++ b/apps/server/src/file-sessions.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+import { FileSessionStore } from "./file-sessions.js";
+
+describe("FileSessionStore", () => {
+  test("creates, renews, and closes sessions", () => {
+    const store = new FileSessionStore({ maxSessions: 10 });
+    const created = store.create({
+      workspaceId: "ws_1",
+      workspaceRoot: "/tmp/ws",
+      actorTokenHash: "tok_1",
+      actorScope: "collaborator",
+      canWrite: true,
+      ttlMs: 60_000,
+    });
+
+    const fetched = store.get(created.id);
+    expect(fetched?.workspaceId).toBe("ws_1");
+    expect(fetched?.canWrite).toBe(true);
+
+    const createdExpiry = created.expiresAt;
+    const renewed = store.renew(created.id, 120_000);
+    expect(renewed).not.toBeNull();
+    expect((renewed?.expiresAt ?? 0) > createdExpiry).toBe(true);
+
+    const closed = store.close(created.id);
+    expect(closed).toBe(true);
+    expect(store.get(created.id)).toBeNull();
+  });
+
+  test("records and paginates workspace events", () => {
+    const store = new FileSessionStore({ maxEventsPerWorkspace: 5 });
+
+    store.recordWorkspaceEvent({ workspaceId: "ws_1", type: "write", path: "notes/a.md", revision: "1" });
+    store.recordWorkspaceEvent({ workspaceId: "ws_1", type: "mkdir", path: "notes" });
+    store.recordWorkspaceEvent({ workspaceId: "ws_1", type: "rename", path: "notes/a.md", toPath: "notes/b.md" });
+
+    const fromStart = store.listWorkspaceEvents("ws_1", 0);
+    expect(fromStart.items.length).toBe(3);
+    expect(fromStart.cursor).toBe(3);
+
+    const fromSecond = store.listWorkspaceEvents("ws_1", 2);
+    expect(fromSecond.items.length).toBe(1);
+    expect(fromSecond.items[0]?.type).toBe("rename");
+  });
+});
diff --git a/apps/server/src/file-sessions.ts b/apps/server/src/file-sessions.ts
new file mode 100644
index 0000000000..ad846feadd
--- /dev/null
+++ b/apps/server/src/file-sessions.ts
@@ -0,0 +1,152 @@
+import type { TokenScope } from "./types.js";
+import { shortId } from "./utils.js";
+
+export type FileSessionEventType = "write" | "delete" | "rename" | "mkdir";
+
+export type FileSessionEvent = {
+  id: string;
+  seq: number;
+  workspaceId: string;
+  type: FileSessionEventType;
+  path: string;
+  toPath?: string;
+  revision?: string;
+  timestamp: number;
+};
+
+export type FileSessionRecord = {
+  id: string;
+  workspaceId: string;
+  workspaceRoot: string;
+  actorTokenHash: string;
+  actorScope: TokenScope;
+  canWrite: boolean;
+  createdAt: number;
+  expiresAt: number;
+};
+
+type WorkspaceEventState = {
+  seq: number;
+  events: FileSessionEvent[];
+};
+
+export class FileSessionStore {
+  private sessions = new Map<string, FileSessionRecord>();
+
+  private workspaceEvents = new Map<string, WorkspaceEventState>();
+
+  private maxSessions: number;
+
+  private maxEventsPerWorkspace: number;
+
+  constructor(options?: { maxSessions?: number; maxEventsPerWorkspace?: number }) {
+    this.maxSessions = options?.maxSessions ?? 256;
+    this.maxEventsPerWorkspace = options?.maxEventsPerWorkspace ?? 500;
+  }
+
+  create(input: {
+    workspaceId: string;
+    workspaceRoot: string;
+    actorTokenHash: string;
+    actorScope: TokenScope;
+    canWrite: boolean;
+    ttlMs: number;
+  }): FileSessionRecord {
+    this.pruneExpired();
+    this.evictIfNeeded();
+
+    const now = Date.now();
+    const record: FileSessionRecord = {
+      id: shortId(),
+      workspaceId: input.workspaceId,
+      workspaceRoot: input.workspaceRoot,
+      actorTokenHash: input.actorTokenHash,
+      actorScope: input.actorScope,
+      canWrite: input.canWrite,
+      createdAt: now,
+      expiresAt: now + input.ttlMs,
+    };
+    this.sessions.set(record.id, record);
+    return record;
+  }
+
+  get(sessionId: string): FileSessionRecord | null {
+    this.pruneExpired();
+    const value = this.sessions.get(sessionId);
+    return value ?? null;
+  }
+
+  renew(sessionId: string, ttlMs: number): FileSessionRecord | null {
+    this.pruneExpired();
+    const value = this.sessions.get(sessionId);
+    if (!value) return null;
+    value.expiresAt = Date.now() + ttlMs;
+    this.sessions.set(sessionId, value);
+    return value;
+  }
+
+  close(sessionId: string): boolean {
+    return this.sessions.delete(sessionId);
+  }
+
+  recordWorkspaceEvent(input: {
+    workspaceId: string;
+    type: FileSessionEventType;
+    path: string;
+    toPath?: string;
+    revision?: string;
+  }): FileSessionEvent {
+    const state = this.workspaceEvents.get(input.workspaceId) ?? { seq: 0, events: [] };
+    const event: FileSessionEvent = {
+      id: shortId(),
+      seq: state.seq + 1,
+      workspaceId: input.workspaceId,
+      type: input.type,
+      path: input.path,
+      toPath: input.toPath,
+      revision: input.revision,
+      timestamp: Date.now(),
+    };
+    state.seq = event.seq;
+    state.events.push(event);
+    if (state.events.length > this.maxEventsPerWorkspace) {
+      state.events.splice(0, state.events.length - this.maxEventsPerWorkspace);
+    }
+    this.workspaceEvents.set(input.workspaceId, state);
+    return event;
+  }
+
+  listWorkspaceEvents(workspaceId: string, since = 0): { items: FileSessionEvent[]; cursor: number } {
+    const state = this.workspaceEvents.get(workspaceId);
+    if (!state) {
+      return { items: [], cursor: 0 };
+    }
+    const cursor = Number.isFinite(since) && since > 0 ? since : 0;
+    const items = state.events.filter((item) => item.seq > cursor);
+    return { items, cursor: state.seq };
+  }
+
+  private pruneExpired(): void {
+    const now = Date.now();
+    for (const [id, session] of this.sessions) {
+      if (session.expiresAt <= now) {
+        this.sessions.delete(id);
+      }
+    }
+  }
+
+  private evictIfNeeded(): void {
+    if (this.sessions.size < this.maxSessions) return;
+    let oldestId: string | null = null;
+    let oldestExpiry = Number.POSITIVE_INFINITY;
+    for (const [id, session] of this.sessions) {
+      if (session.expiresAt < oldestExpiry) {
+        oldestExpiry = session.expiresAt;
+        oldestId = id;
+      }
+    }
+    if (oldestId) {
+      this.sessions.delete(oldestId);
+    }
+  }
+}
diff --git a/apps/server/src/frontmatter.ts b/apps/server/src/frontmatter.ts
new file mode 100644
index 0000000000..bdfee25357
--- /dev/null
+++ b/apps/server/src/frontmatter.ts
@@ -0,0 +1,17 @@
+import { parse, stringify } from "yaml";
+
+export function parseFrontmatter(content: string): { data: Record<string, unknown>; body: string } {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) {
+    return { data: {}, body: content };
+  }
+  const raw = match[1] ?? "";
+  const data = (parse(raw) as Record<string, unknown>) ?? {};
+  const body = content.slice(match[0].length);
+  return { data, body };
+}
+
+export function buildFrontmatter(data: Record<string, unknown>): string {
+  const yaml = stringify(data).trimEnd();
+  return `---\n${yaml}\n---\n`;
+}
diff --git a/apps/server/src/jsonc.test.ts b/apps/server/src/jsonc.test.ts
new file mode 100644
index 0000000000..77ec0e0dbe
--- /dev/null
+++ b/apps/server/src/jsonc.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { updateJsoncPath } from "./jsonc.js";
+
+describe("updateJsoncPath", () => {
+  test("patches nested values without replacing sibling config", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "openwork-jsonc-"));
+    const file = join(dir, "opencode.jsonc");
+    await writeFile(
+      file,
+      `{
+  // keep this permission comment
+  "permission": {
+    "clipboard": "ask",
+    "external_directory": {
+      "/old/*": "allow"
+    }
+  },
+  "model": "openai/gpt-5"
+}
+`,
+      "utf8",
+    );
+
+    await updateJsoncPath(file, ["permission", "external_directory"], {
+      "/next/*": "allow",
+    });
+
+    const next = await readFile(file, "utf8");
+    expect(next).toContain('"clipboard": "ask"');
+    expect(next).toContain('"model": "openai/gpt-5"');
+    expect(next).toContain('"/next/*": "allow"');
+    expect(next).not.toContain('"/old/*": "allow"');
+  });
+
+  test("removes parent object when nested property was the only entry", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "openwork-jsonc-"));
+    const file = join(dir, "opencode.jsonc");
+    await writeFile(
+      file,
+      `{
+  "permission": {
+    "external_directory": {
+      "/old/*": "allow"
+    }
+  }
+}
+`,
+      "utf8",
+    );
+
+    await updateJsoncPath(file, ["permission"], undefined);
+
+    const next = await readFile(file, "utf8");
+    expect(next).not.toContain('"permission"');
+  });
+});
diff --git a/apps/server/src/jsonc.ts b/apps/server/src/jsonc.ts
new file mode 100644
index 0000000000..17dd302738
--- /dev/null
+++ b/apps/server/src/jsonc.ts
@@ -0,0 +1,70 @@
+import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
+import { dirname } from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+import { ApiError } from "./errors.js";
+import { ensureDir, exists } from "./utils.js";
+
+interface ParseResult<T> {
+  data: T;
+  raw: string;
+}
+
+export async function readJsoncFile<T>(path: string, fallback: T): Promise<ParseResult<T>> {
+  if (!(await exists(path))) {
+    return { data: fallback, raw: "" };
+  }
+  const raw = await readFile(path, "utf8");
+  const errors: { error: number; offset: number; length: number }[] = [];
+  const data = parse(raw, errors, { allowTrailingComma: true }) as T;
+  if (errors.length > 0) {
+    const details = errors.map((error) => ({
+      code: printParseErrorCode(error.error),
+      offset: error.offset,
+      length: error.length,
+    }));
+    throw new ApiError(422, "invalid_jsonc", "Failed to parse JSONC", details);
+  }
+  return { data, raw };
+}
+
+export async function updateJsoncTopLevel(path: string, updates: Record<string, unknown>): Promise<void> {
+  const hasFile = await exists(path);
+  if (!hasFile) {
+    await ensureDir(dirname(path));
+    const content = JSON.stringify(updates, null, 2) + "\n";
+    await writeFile(path, content, "utf8");
+    return;
+  }
+
+  let content = await readFile(path, "utf8");
+  const formattingOptions = { insertSpaces: true, tabSize: 2, eol: "\n" };
+  for (const [key, value] of Object.entries(updates)) {
+    const edits = modify(content, [key], value, { formattingOptions });
+    content = applyEdits(content, edits);
+  }
+  await writeFile(path, content.endsWith("\n") ? content : content + "\n", "utf8");
+}
+
+export async function updateJsoncPath(path: string, jsonPath: (string | number)[], value: unknown): Promise<void> {
+  const formattingOptions = { insertSpaces: true, tabSize: 2, eol: "\n" };
+  const hasFile = await exists(path);
+  if (!hasFile) {
+    await ensureDir(dirname(path));
+    let content = "{}\n";
+    const edits = modify(content, jsonPath, value, { formattingOptions });
+    content = applyEdits(content, edits);
+    await writeFile(path, content.endsWith("\n") ? content : content + "\n", "utf8");
+    return;
+  }
+
+  let content = await readFile(path, "utf8");
+  const edits = modify(content, jsonPath, value, { formattingOptions });
+  content = applyEdits(content, edits);
+  await writeFile(path, content.endsWith("\n") ? content : content + "\n", "utf8");
+}
+
+export async function writeJsoncFile(path: string, value: unknown): Promise<void> {
+  await ensureDir(dirname(path));
+  const content = JSON.stringify(value, null, 2) + "\n";
+  await writeFile(path, content, "utf8");
+}
diff --git a/apps/server/src/managed-opencode.ts b/apps/server/src/managed-opencode.ts
new file mode 100644
index 0000000000..a99c5d42e9
--- /dev/null
+++ b/apps/server/src/managed-opencode.ts
@@ -0,0 +1,91 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import net from "node:net";
+import { randomUUID } from "node:crypto";
+
+export type ManagedOpencodeServer = {
+  url: string;
+  username: string;
+  password: string;
+  pid: number | null;
+  close: () => void;
+};
+
+function randomSecret(): string {
+  return randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "");
+}
+
+async function findFreePort(hostname: string): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, hostname, () => {
+      const address = server.address();
+      server.close(() => {
+        if (address && typeof address === "object") resolve(address.port);
+        else reject(new Error("Failed to resolve free port"));
+      });
+    });
+  });
+}
+
+export async function createManagedOpencodeServer(options: {
+  bin?: string;
+  cwd: string;
+  hostname?: string;
+  port?: number;
+  timeoutMs?: number;
+  env?: Record<string, string | undefined>;
+}): Promise<ManagedOpencodeServer> {
+  const hostname = options.hostname ?? "127.0.0.1";
+  const port = options.port ?? await findFreePort(hostname);
+  const username = randomSecret();
+  const password = randomSecret();
+  const args = ["serve", "--hostname", hostname, "--port", String(port), "--cors", "*"];
+  const child: ChildProcess = spawn(options.bin?.trim() || "opencode", args, {
+    cwd: options.cwd,
+    env: {
+      ...process.env,
+      ...options.env,
+      OPENCODE_SERVER_USERNAME: username,
+      OPENCODE_SERVER_PASSWORD: password,
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  const url = await new Promise<string>((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error(`Timeout waiting for OpenCode server after ${options.timeoutMs ?? 15000}ms`)), options.timeoutMs ?? 15000);
+    let output = "";
+    const done = (value: string) => {
+      clearTimeout(timeout);
+      resolve(value);
+    };
+    const fail = (error: Error) => {
+      clearTimeout(timeout);
+      reject(error);
+    };
+    child.stdout?.on("data", (chunk) => {
+      output += chunk.toString();
+      for (const line of output.split("\n")) {
+        if (!line.startsWith("opencode server listening")) continue;
+        const match = line.match(/on\s+(https?:\/\/[^\s]+)/);
+        if (!match?.[1]) return fail(new Error(`Failed to parse OpenCode server URL from: ${line}`));
+        done(match[1]);
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+    child.once("error", fail);
+    child.once("exit", (code) => fail(new Error(`OpenCode server exited with code ${code}${output.trim() ? `\n${output}` : ""}`)));
+  });
+
+  return {
+    url,
+    username,
+    password,
+    pid: child.pid ?? null,
+    close() {
+      if (!child.killed) child.kill();
+    },
+  };
+}
diff --git a/apps/server/src/mcp.remote-connect.e2e.test.ts b/apps/server/src/mcp.remote-connect.e2e.test.ts
new file mode 100644
index 0000000000..8a5f28c502
--- /dev/null
+++ b/apps/server/src/mcp.remote-connect.e2e.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { addMcp, listMcp, removeMcp } from "./mcp.js";
+
+describe("mcp remote connect flow", () => {
+  test("adds, lists, and removes a remote MCP without OAuth", async () => {
+    const workspaceRoot = await mkdtemp(join(tmpdir(), "openwork-mcp-remote-e2e-"));
+
+    try {
+      const added = await addMcp(workspaceRoot, "simple-remote", {
+        type: "remote",
+        url: "https://example.com/mcp",
+        enabled: true,
+      });
+      expect(added.action).toBe("added");
+
+      const listedAfterAdd = await listMcp(workspaceRoot);
+      const item = listedAfterAdd.find((entry) => entry.name === "simple-remote");
+      expect(item).toBeDefined();
+      expect(item?.config).toEqual({
+        type: "remote",
+        url: "https://example.com/mcp",
+        enabled: true,
+      });
+      expect(item?.source).toBe("config.project");
+
+      const configText = await readFile(join(workspaceRoot, "opencode.jsonc"), "utf8");
+      expect(configText).toContain("\"simple-remote\"");
+      expect(configText).toContain("\"https://example.com/mcp\"");
+
+      const removed = await removeMcp(workspaceRoot, "simple-remote");
+      expect(removed).toBe(true);
+
+      const listedAfterRemove = await listMcp(workspaceRoot);
+      expect(listedAfterRemove.some((entry) => entry.name === "simple-remote")).toBe(false);
+    } finally {
+      await rm(workspaceRoot, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/apps/server/src/mcp.ts b/apps/server/src/mcp.ts
new file mode 100644
index 0000000000..ed4a8e92f4
--- /dev/null
+++ b/apps/server/src/mcp.ts
@@ -0,0 +1,123 @@
+import { minimatch } from "minimatch";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import type { McpItem } from "./types.js";
+import { readJsoncFile, updateJsoncPath, updateJsoncTopLevel } from "./jsonc.js";
+import { opencodeConfigPath } from "./workspace-files.js";
+import { validateMcpConfig, validateMcpName } from "./validators.js";
+
+function globalOpenCodeConfigPath(): string {
+  const base = join(homedir(), ".config", "opencode");
+  const jsonc = join(base, "opencode.jsonc");
+  const json = join(base, "opencode.json");
+  if (existsSync(jsonc)) return jsonc;
+  if (existsSync(json)) return json;
+  return jsonc; // fall back to jsonc (readJsoncFile handles missing files gracefully)
+}
+
+function getMcpConfig(config: Record<string, unknown>): Record<string, Record<string, unknown>> {
+  const mcp = config.mcp;
+  if (!mcp || typeof mcp !== "object") return {};
+  return mcp as Record<string, Record<string, unknown>>;
+}
+
+function getDeniedToolPatterns(config: Record<string, unknown>): string[] {
+  const tools = config.tools;
+  if (!tools || typeof tools !== "object") return [];
+  const deny = (tools as { deny?: unknown }).deny;
+  if (!Array.isArray(deny)) return [];
+  return deny.filter((item) => typeof item === "string") as string[];
+}
+
+function isMcpDisabledByTools(config: Record<string, unknown>, name: string): boolean {
+  const patterns = getDeniedToolPatterns(config);
+  if (patterns.length === 0) return false;
+  const candidates = [`mcp.${name}`, `mcp.${name}.*`, `mcp:${name}`, `mcp:${name}:*`, "mcp.*", "mcp:*"];
+  return patterns.some((pattern) => candidates.some((candidate) => minimatch(candidate, pattern)));
+}
+
+export async function listMcp(workspaceRoot: string): Promise<McpItem[]> {
+  const { data: config } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const { data: globalConfig } = await readJsoncFile(globalOpenCodeConfigPath(), {} as Record<string, unknown>);
+
+  const projectMcpMap = getMcpConfig(config);
+  const globalMcpMap = getMcpConfig(globalConfig);
+
+  const items: McpItem[] = [];
+
+  // Global MCPs first; project-level entries override global ones with the same name.
+  for (const [name, entry] of Object.entries(globalMcpMap)) {
+    if (Object.prototype.hasOwnProperty.call(projectMcpMap, name)) continue;
+    items.push({
+      name,
+      config: entry,
+      source: "config.global",
+      disabledByTools:
+        (isMcpDisabledByTools(globalConfig, name) || isMcpDisabledByTools(config, name)) || undefined,
+    });
+  }
+
+  // Project MCPs (highest priority).
+  for (const [name, entry] of Object.entries(projectMcpMap)) {
+    items.push({
+      name,
+      config: entry,
+      source: "config.project",
+      disabledByTools: isMcpDisabledByTools(config, name) || undefined,
+    });
+  }
+
+  return items;
+}
+
+export async function addMcp(
+  workspaceRoot: string,
+  name: string,
+  config: Record<string, unknown>,
+): Promise<{ action: "added" | "updated" }> {
+  validateMcpName(name);
+  validateMcpConfig(config);
+  const { data } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const mcpMap = getMcpConfig(data);
+  const existed = Object.prototype.hasOwnProperty.call(mcpMap, name);
+  mcpMap[name] = config;
+  await updateJsoncTopLevel(opencodeConfigPath(workspaceRoot), { mcp: mcpMap });
+  return { action: existed ? "updated" : "added" };
+}
+
+export async function removeMcp(workspaceRoot: string, name: string): Promise<boolean> {
+  const { data } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const mcpMap = getMcpConfig(data);
+  if (!Object.prototype.hasOwnProperty.call(mcpMap, name)) return false;
+  delete mcpMap[name];
+  await updateJsoncTopLevel(opencodeConfigPath(workspaceRoot), { mcp: mcpMap });
+  return true;
+}
+
+// Flips `enabled` on a workspace MCP entry. Returns false for "toggle does
+// not apply": missing, non-object, or malformed enough that OpenCode would
+// fail to load it. The HTTP layer maps false to 404. Globals are out of
+// scope by design — only workspace-level entries.
+//
+// `updateJsoncPath` (vs `updateJsoncTopLevel`) preserves inline comments
+// inside the MCP entry — see the regression that motivated #1444.
+export async function setMcpEnabled(
+  workspaceRoot: string,
+  name: string,
+  enabled: boolean,
+): Promise<boolean> {
+  validateMcpName(name);
+  const { data } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const mcpMap = getMcpConfig(data);
+  if (!Object.prototype.hasOwnProperty.call(mcpMap, name)) return false;
+  const current = mcpMap[name];
+  if (!current || typeof current !== "object" || Array.isArray(current)) return false;
+  try {
+    validateMcpConfig({ ...(current as Record<string, unknown>), enabled });
+  } catch {
+    return false;
+  }
+  await updateJsoncPath(opencodeConfigPath(workspaceRoot), ["mcp", name, "enabled"], enabled);
+  return true;
+}
diff --git a/apps/server/src/opencode-connection.test.ts b/apps/server/src/opencode-connection.test.ts
new file mode 100644
index 0000000000..54bbc066ca
--- /dev/null
+++ b/apps/server/src/opencode-connection.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, test } from "bun:test";
+
+import { inheritWorkspaceOpencodeConnection, resolveWorkspaceOpencodeConnection } from "./opencode-connection.js";
+
+describe("resolveWorkspaceOpencodeConnection", () => {
+  test("falls back to server-level OpenCode settings when a workspace entry is missing them", () => {
+    const connection = resolveWorkspaceOpencodeConnection(
+      {
+        opencodeBaseUrl: "http://127.0.0.1:54235",
+        opencodeUsername: "user",
+        opencodePassword: "pass",
+      },
+      {
+        id: "ws_test",
+        name: "Test",
+        path: "/tmp/test",
+        preset: "starter",
+        workspaceType: "local",
+      },
+    );
+
+    expect(connection.baseUrl).toBe("http://127.0.0.1:54235");
+    expect(connection.authHeader).toBe(`Basic ${Buffer.from("user:pass").toString("base64")}`);
+  });
+
+  test("prefers workspace-specific settings when present", () => {
+    const connection = resolveWorkspaceOpencodeConnection(
+      {
+        opencodeBaseUrl: "http://127.0.0.1:54235",
+        opencodeUsername: "user",
+        opencodePassword: "pass",
+      },
+      {
+        id: "ws_test",
+        name: "Test",
+        path: "/tmp/test",
+        preset: "starter",
+        workspaceType: "local",
+        baseUrl: "http://127.0.0.1:6000",
+        opencodeUsername: "local-user",
+        opencodePassword: "local-pass",
+      },
+    );
+
+    expect(connection.baseUrl).toBe("http://127.0.0.1:6000");
+    expect(connection.authHeader).toBe(`Basic ${Buffer.from("local-user:local-pass").toString("base64")}`);
+  });
+});
+
+describe("inheritWorkspaceOpencodeConnection", () => {
+  test("copies server-level OpenCode connection into new local workspaces", () => {
+    expect(
+      inheritWorkspaceOpencodeConnection({
+        opencodeBaseUrl: "http://127.0.0.1:54235",
+        opencodeUsername: "user",
+        opencodePassword: "pass",
+      }),
+    ).toEqual({
+      baseUrl: "http://127.0.0.1:54235",
+      opencodeUsername: "user",
+      opencodePassword: "pass",
+    });
+  });
+});
diff --git a/apps/server/src/opencode-connection.ts b/apps/server/src/opencode-connection.ts
new file mode 100644
index 0000000000..a455c6da48
--- /dev/null
+++ b/apps/server/src/opencode-connection.ts
@@ -0,0 +1,42 @@
+import type { ServerConfig, WorkspaceInfo } from "./types.js";
+
+type OpencodeConnection = {
+  baseUrl?: string;
+  authHeader?: string;
+};
+
+function trim(value: string | undefined): string {
+  return value?.trim() ?? "";
+}
+
+export function resolveWorkspaceOpencodeConnection(
+  config: Pick<ServerConfig, "opencodeBaseUrl" | "opencodeUsername" | "opencodePassword">,
+  workspace: WorkspaceInfo,
+): OpencodeConnection {
+  const baseUrl = trim(workspace.baseUrl) || trim(config.opencodeBaseUrl) || undefined;
+  const username = trim(workspace.opencodeUsername) || trim(config.opencodeUsername);
+  const password = trim(workspace.opencodePassword) || trim(config.opencodePassword);
+
+  return {
+    ...(baseUrl ? { baseUrl } : {}),
+    ...(username && password
+      ? {
+          authHeader: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`,
+        }
+      : {}),
+  };
+}
+
+export function inheritWorkspaceOpencodeConnection(
+  config: Pick<ServerConfig, "opencodeBaseUrl" | "opencodeUsername" | "opencodePassword">,
+): Pick<WorkspaceInfo, "baseUrl" | "opencodeUsername" | "opencodePassword"> {
+  const baseUrl = trim(config.opencodeBaseUrl);
+  const username = trim(config.opencodeUsername);
+  const password = trim(config.opencodePassword);
+
+  return {
+    ...(baseUrl ? { baseUrl } : {}),
+    ...(username ? { opencodeUsername: username } : {}),
+    ...(password ? { opencodePassword: password } : {}),
+  };
+}
diff --git a/apps/server/src/opencode-db.test.ts b/apps/server/src/opencode-db.test.ts
new file mode 100644
index 0000000000..aa32127bde
--- /dev/null
+++ b/apps/server/src/opencode-db.test.ts
@@ -0,0 +1,194 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import { resolveOpencodeDbPath, seedOpencodeSessionMessages } from "./opencode-db.js";
+
+async function createDb(): Promise<{ path: string; dispose: () => void }> {
+  const dir = await mkdtemp(join(tmpdir(), "openwork-opencode-db-"));
+  await mkdir(dir, { recursive: true });
+  const dbPath = join(dir, "opencode-test.db");
+  const db = new Database(dbPath);
+  db.exec(`
+    create table session (
+      id text primary key,
+      time_updated integer
+    );
+    create table message (
+      id text primary key,
+      session_id text not null,
+      time_created integer,
+      time_updated integer,
+      data text not null
+    );
+    create table part (
+      id text primary key,
+      message_id text not null,
+      session_id text not null,
+      time_created integer,
+      time_updated integer,
+      data text not null
+    );
+    insert into session (id, time_updated) values ('ses_test123', 1);
+  `);
+  db.close();
+  return {
+    path: dbPath,
+    dispose: () => new Database(dbPath).close(),
+  };
+}
+
+describe("seedOpencodeSessionMessages", () => {
+  test("writes seeded transcript messages into the OpenCode db", async () => {
+    const fixture = await createDb();
+    const result = seedOpencodeSessionMessages({
+      dbPath: fixture.path,
+      sessionId: "ses_test123",
+      workspaceRoot: "/tmp/workspace",
+      now: 1700000000000,
+      messages: [
+        { role: "assistant", text: "Welcome" },
+        { role: "user", text: "Help me start" },
+        { role: "assistant", text: "Sure" },
+      ],
+    });
+
+    expect(result).toEqual({ inserted: 3, skipped: false });
+
+    const db = new Database(fixture.path, { readonly: true });
+    const rows = db.query("select id, session_id, data from message order by time_created asc").all() as Array<{
+      id: string;
+      session_id: string;
+      data: string;
+    }>;
+    const parts = db.query("select data from part order by time_created asc").all() as Array<{ data: string }>;
+    const session = db.query("select time_updated from session where id = 'ses_test123'").get() as { time_updated: number };
+    db.close();
+
+    const decoded = rows.map((row) => JSON.parse(row.data) as Record<string, unknown>);
+    expect(decoded[0]?.role).toBe("assistant");
+    expect(decoded[0]?.parentID).toBe(rows[0]?.id);
+    expect(decoded[0]?.modelID).toBe("gpt-5.4");
+    expect(decoded[0]?.providerID).toBe("openai");
+    expect(decoded[1]?.role).toBe("user");
+    expect(decoded[1]?.summary).toEqual({ diffs: [] });
+    expect(decoded[2]?.role).toBe("assistant");
+    expect(decoded[2]?.parentID).toBe(rows[1]?.id);
+    expect(parts.map((row) => JSON.parse(row.data))).toEqual([
+      { type: "text", text: "Welcome" },
+      { type: "text", text: "Help me start" },
+      { type: "text", text: "Sure" },
+    ]);
+    expect(session.time_updated).toBe(1700000000003);
+  });
+
+  test("does not seed a session twice", async () => {
+    const fixture = await createDb();
+    const first = seedOpencodeSessionMessages({
+      dbPath: fixture.path,
+      sessionId: "ses_test123",
+      workspaceRoot: "/tmp/workspace",
+      messages: [{ role: "assistant", text: "Welcome" }],
+    });
+    const second = seedOpencodeSessionMessages({
+      dbPath: fixture.path,
+      sessionId: "ses_test123",
+      workspaceRoot: "/tmp/workspace",
+      messages: [{ role: "assistant", text: "Welcome again" }],
+    });
+
+    expect(first.skipped).toBe(false);
+    expect(second).toEqual({ inserted: 0, skipped: true });
+  });
+});
+
+describe("resolveOpencodeDbPath", () => {
+  test("prefers an existing XDG opencode.db when present", async () => {
+    const xdg = await mkdtemp(join(tmpdir(), "openwork-opencode-xdg-"));
+    const dir = join(xdg, "opencode");
+    const file = join(dir, "opencode.db");
+    await mkdir(dir, { recursive: true });
+    await writeFile(file, "", "utf8");
+
+    const previousXdg = process.env.XDG_DATA_HOME;
+    const previousChannel = process.env.OPENCODE_CHANNEL;
+    const previousDb = process.env.OPENCODE_DB;
+    try {
+      process.env.XDG_DATA_HOME = xdg;
+      process.env.OPENCODE_CHANNEL = "local";
+      delete process.env.OPENCODE_DB;
+
+      expect(resolveOpencodeDbPath()).toBe(file);
+    } finally {
+      if (previousXdg === undefined) delete process.env.XDG_DATA_HOME;
+      else process.env.XDG_DATA_HOME = previousXdg;
+      if (previousChannel === undefined) delete process.env.OPENCODE_CHANNEL;
+      else process.env.OPENCODE_CHANNEL = previousChannel;
+      if (previousDb === undefined) delete process.env.OPENCODE_DB;
+      else process.env.OPENCODE_DB = previousDb;
+    }
+  });
+
+  test("finds orchestrator-managed OpenCode dbs under OPENWORK_DATA_DIR", async () => {
+    const root = await mkdtemp(join(tmpdir(), "openwork-orchestrator-data-"));
+    const dir = join(root, "openwork-dev-data", "xdg", "data", "opencode");
+    const file = join(dir, "opencode.db");
+    await mkdir(dir, { recursive: true });
+    await writeFile(file, "", "utf8");
+
+    const previousDataDir = process.env.OPENWORK_DATA_DIR;
+    const previousXdg = process.env.XDG_DATA_HOME;
+    const previousChannel = process.env.OPENCODE_CHANNEL;
+    const previousDb = process.env.OPENCODE_DB;
+    try {
+      process.env.OPENWORK_DATA_DIR = root;
+      delete process.env.XDG_DATA_HOME;
+      process.env.OPENCODE_CHANNEL = "local";
+      delete process.env.OPENCODE_DB;
+
+      expect(resolveOpencodeDbPath()).toBe(file);
+    } finally {
+      if (previousDataDir === undefined) delete process.env.OPENWORK_DATA_DIR;
+      else process.env.OPENWORK_DATA_DIR = previousDataDir;
+      if (previousXdg === undefined) delete process.env.XDG_DATA_HOME;
+      else process.env.XDG_DATA_HOME = previousXdg;
+      if (previousChannel === undefined) delete process.env.OPENCODE_CHANNEL;
+      else process.env.OPENCODE_CHANNEL = previousChannel;
+      if (previousDb === undefined) delete process.env.OPENCODE_DB;
+      else process.env.OPENCODE_DB = previousDb;
+    }
+  });
+
+  test("finds legacy orchestrator-managed OpenCode dbs under OPENWORK_DATA_DIR", async () => {
+    const root = await mkdtemp(join(tmpdir(), "openwork-orchestrator-data-"));
+    const dir = join(root, "opencode-dev", "ws-test", "xdg", "data", "opencode");
+    const file = join(dir, "opencode.db");
+    await mkdir(dir, { recursive: true });
+    await writeFile(file, "", "utf8");
+
+    const previousDataDir = process.env.OPENWORK_DATA_DIR;
+    const previousXdg = process.env.XDG_DATA_HOME;
+    const previousChannel = process.env.OPENCODE_CHANNEL;
+    const previousDb = process.env.OPENCODE_DB;
+    try {
+      process.env.OPENWORK_DATA_DIR = root;
+      delete process.env.XDG_DATA_HOME;
+      process.env.OPENCODE_CHANNEL = "local";
+      delete process.env.OPENCODE_DB;
+
+      expect(resolveOpencodeDbPath()).toBe(file);
+    } finally {
+      if (previousDataDir === undefined) delete process.env.OPENWORK_DATA_DIR;
+      else process.env.OPENWORK_DATA_DIR = previousDataDir;
+      if (previousXdg === undefined) delete process.env.XDG_DATA_HOME;
+      else process.env.XDG_DATA_HOME = previousXdg;
+      if (previousChannel === undefined) delete process.env.OPENCODE_CHANNEL;
+      else process.env.OPENCODE_CHANNEL = previousChannel;
+      if (previousDb === undefined) delete process.env.OPENCODE_DB;
+      else process.env.OPENCODE_DB = previousDb;
+    }
+  });
+});
diff --git a/apps/server/src/opencode-db.ts b/apps/server/src/opencode-db.ts
new file mode 100644
index 0000000000..d442b22978
--- /dev/null
+++ b/apps/server/src/opencode-db.ts
@@ -0,0 +1,234 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+type SeedMessage = {
+  role: "assistant" | "user";
+  text: string;
+};
+
+const DEFAULT_AGENT = "openwork";
+const DEFAULT_PROVIDER = "openai";
+const DEFAULT_MODEL = "gpt-5.4";
+const OPENWORK_DEV_DATA_DIRS = ["openwork-dev-data", "opencode-dev"];
+
+function truthy(value: string | undefined): boolean {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
+}
+
+function opencodeOrchestratorDataDirs(): string[] {
+  const root = process.env.OPENWORK_DATA_DIR?.trim();
+  if (!root) return [];
+
+  const dirs: string[] = [];
+  const pushIfExists = (dir: string) => {
+    if (existsSync(dir)) dirs.push(dir);
+  };
+
+  for (const name of OPENWORK_DEV_DATA_DIRS) {
+    const base = join(root, name);
+    pushIfExists(join(base, "xdg", "data", "opencode"));
+    if (!existsSync(base)) continue;
+
+    for (const entry of readdirSync(base, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      pushIfExists(join(base, entry.name, "xdg", "data", "opencode"));
+    }
+  }
+
+  return dirs;
+}
+
+function opencodeDataDirs(): string[] {
+  const dirs: string[] = [];
+  dirs.push(...opencodeOrchestratorDataDirs());
+  const xdg = process.env.XDG_DATA_HOME?.trim();
+  if (xdg) dirs.push(join(xdg, "opencode"));
+  dirs.push(join(homedir(), ".local", "share", "opencode"));
+  if (process.platform === "darwin") dirs.push(join(homedir(), "Library", "Application Support", "opencode"));
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA?.trim();
+    if (appData) dirs.push(join(appData, "opencode"));
+  }
+  return Array.from(new Set(dirs));
+}
+
+function preferredDbNames(): string[] {
+  const channel = process.env.OPENCODE_CHANNEL?.trim() || "local";
+  return channel === "latest" || channel === "beta" || truthy(process.env.OPENCODE_DISABLE_CHANNEL_DB)
+    ? ["opencode.db"]
+    : [`opencode-${channel.replace(/[^a-zA-Z0-9._-]/g, "-")}.db`, "opencode.db"];
+}
+
+function candidateOpencodeDbPaths(): string[] {
+  const override = process.env.OPENCODE_DB?.trim();
+  if (override) {
+    if (isAbsolute(override)) return [override];
+    const candidates: string[] = [];
+    for (const dir of opencodeDataDirs()) {
+      candidates.push(join(dir, override));
+    }
+    candidates.push(join(opencodeDataDirs()[0] ?? join(homedir(), ".local", "share", "opencode"), override));
+    return Array.from(new Set(candidates));
+  }
+
+  const candidates: string[] = [];
+  for (const dir of opencodeDataDirs()) {
+    for (const name of preferredDbNames()) {
+      candidates.push(join(dir, name));
+    }
+  }
+
+  return Array.from(new Set(candidates));
+}
+
+export function resolveOpencodeDbPath(): string {
+  const candidates = candidateOpencodeDbPaths();
+  const existing = candidates.find((candidate) => existsSync(candidate));
+  if (existing) return existing;
+  return candidates[0] ?? join(homedir(), ".local", "share", "opencode", preferredDbNames()[0] ?? "opencode.db");
+}
+
+function findOpencodeSessionDbPath(sessionId: string, inputPath?: string): string | null {
+  const candidates = (inputPath ? [inputPath] : candidateOpencodeDbPaths()).filter((candidate) => existsSync(candidate));
+  for (const dbPath of candidates) {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+      const session = db.query("select id from session where id = ?1").get(sessionId);
+      if (session) return dbPath;
+    } catch {
+      // ignore non-matching dbs
+    } finally {
+      db.close();
+    }
+  }
+  return null;
+}
+
+function randomBase62(length: number): string {
+  const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+  const bytes = randomBytes(length);
+  let output = "";
+  for (let index = 0; index < length; index += 1) {
+    output += chars[bytes[index]! % 62];
+  }
+  return output;
+}
+
+function ascendingId(prefix: "msg" | "prt", timestamp: number, counter: number): string {
+  const now = BigInt(timestamp) * 0x1000n + BigInt(counter);
+  const bytes = Buffer.alloc(6);
+  for (let index = 0; index < 6; index += 1) {
+    bytes[index] = Number((now >> BigInt(40 - 8 * index)) & 0xffn);
+  }
+  return `${prefix}_${bytes.toString("hex")}${randomBase62(14)}`;
+}
+
+export function seedOpencodeSessionMessages(input: {
+  sessionId: string;
+  workspaceRoot: string;
+  messages: SeedMessage[];
+  dbPath?: string;
+  now?: number;
+}): { inserted: number; skipped: boolean } {
+  const sessionId = input.sessionId.trim();
+  if (!sessionId) {
+    throw new Error("sessionId is required");
+  }
+
+  const messages = input.messages.filter((item) => item.text.trim());
+  if (!messages.length) {
+    return { inserted: 0, skipped: true };
+  }
+
+  const explicitDbPath = input.dbPath?.trim() || undefined;
+  const dbPath = findOpencodeSessionDbPath(sessionId, explicitDbPath) || explicitDbPath || resolveOpencodeDbPath();
+  if (!existsSync(dbPath)) {
+    throw new Error(`OpenCode database not found at ${dbPath}`);
+  }
+
+  const db = new Database(dbPath);
+  db.exec("PRAGMA foreign_keys = ON");
+
+  try {
+    const run = db.transaction(() => {
+      const session = db.query("select id from session where id = ?1").get(sessionId);
+      if (!session) {
+        throw new Error(`OpenCode session not found: ${sessionId}`);
+      }
+
+      const existing = db.query("select count(1) as count from message where session_id = ?1").get(sessionId) as { count?: number } | null;
+      if ((existing?.count ?? 0) > 0) {
+        return { inserted: 0, skipped: true };
+      }
+
+      const insertMessage = db.prepare(
+        "insert into message (id, session_id, time_created, time_updated, data) values (?1, ?2, ?3, ?4, ?5)",
+      );
+      const insertPart = db.prepare(
+        "insert into part (id, message_id, session_id, time_created, time_updated, data) values (?1, ?2, ?3, ?4, ?5, ?6)",
+      );
+      const updateSession = db.prepare("update session set time_updated = ?2 where id = ?1");
+
+      const startedAt = input.now ?? Date.now();
+      let counter = 0;
+      let lastUserId: string | null = null;
+
+      messages.forEach((item, index) => {
+        const createdAt = startedAt + index;
+        counter += 1;
+        const messageId = ascendingId("msg", createdAt, counter);
+        counter += 1;
+        const partId = ascendingId("prt", createdAt, counter);
+
+        const messageData =
+          item.role === "user"
+            ? {
+                role: "user",
+                time: { created: createdAt },
+                summary: { diffs: [] },
+                agent: DEFAULT_AGENT,
+                model: { providerID: DEFAULT_PROVIDER, modelID: DEFAULT_MODEL },
+              }
+            : {
+                role: "assistant",
+                time: { created: createdAt, completed: createdAt },
+                parentID: lastUserId ?? messageId,
+                modelID: DEFAULT_MODEL,
+                providerID: DEFAULT_PROVIDER,
+                mode: DEFAULT_AGENT,
+                agent: DEFAULT_AGENT,
+                path: { cwd: input.workspaceRoot, root: input.workspaceRoot },
+                cost: 0,
+                tokens: { input: 0, output: 0, reasoning: 0, cache: { read: 0, write: 0 } },
+              };
+
+        insertMessage.run(messageId, sessionId, createdAt, createdAt, JSON.stringify(messageData));
+        insertPart.run(
+          partId,
+          messageId,
+          sessionId,
+          createdAt,
+          createdAt,
+          JSON.stringify({ type: "text", text: item.text.trim() }),
+        );
+
+        if (item.role === "user") {
+          lastUserId = messageId;
+        }
+      });
+
+      updateSession.run(sessionId, startedAt + messages.length);
+      return { inserted: messages.length, skipped: false };
+    });
+
+    return run();
+  } finally {
+    db.close();
+  }
+}
diff --git a/apps/server/src/paths.ts b/apps/server/src/paths.ts
new file mode 100644
index 0000000000..bdd0d65f93
--- /dev/null
+++ b/apps/server/src/paths.ts
@@ -0,0 +1,20 @@
+import { realpath } from "node:fs/promises";
+import { isAbsolute, resolve, sep } from "node:path";
+import { ApiError } from "./errors.js";
+
+export function assertAbsolute(path: string): void {
+  if (!isAbsolute(path)) {
+    throw new ApiError(400, "invalid_path", "Path must be absolute");
+  }
+}
+
+export async function resolveWithinRoot(root: string, ...segments: string[]): Promise<string> {
+  const resolvedRoot = await realpath(root);
+  const candidate = resolve(resolvedRoot, ...segments);
+  const resolvedCandidate = await realpath(candidate).catch(() => candidate);
+  if (resolvedCandidate === resolvedRoot) return candidate;
+  if (!resolvedCandidate.startsWith(resolvedRoot + sep)) {
+    throw new ApiError(400, "path_escape", "Path escapes workspace root");
+  }
+  return candidate;
+}
diff --git a/apps/server/src/plugins.ts b/apps/server/src/plugins.ts
new file mode 100644
index 0000000000..f7a0c5ff42
--- /dev/null
+++ b/apps/server/src/plugins.ts
@@ -0,0 +1,95 @@
+import { homedir } from "node:os";
+import { join, relative } from "node:path";
+import { readdir } from "node:fs/promises";
+import type { PluginItem } from "./types.js";
+import { readJsoncFile, updateJsoncTopLevel } from "./jsonc.js";
+import { opencodeConfigPath, projectPluginsDir } from "./workspace-files.js";
+import { exists } from "./utils.js";
+import { validatePluginSpec } from "./validators.js";
+
+export function normalizePluginSpec(spec: string): string {
+  const trimmed = spec.trim();
+  if (trimmed.startsWith("file:") || trimmed.startsWith("http:") || trimmed.startsWith("https:") || trimmed.startsWith("git:")) {
+    return trimmed;
+  }
+  if (trimmed.startsWith("/")) {
+    return trimmed;
+  }
+  if (trimmed.startsWith("@")) {
+    const atIndex = trimmed.indexOf("@", 1);
+    return atIndex > 0 ? trimmed.slice(0, atIndex) : trimmed;
+  }
+  const atIndex = trimmed.indexOf("@");
+  return atIndex > 0 ? trimmed.slice(0, atIndex) : trimmed;
+}
+
+function pluginListFromConfig(config: Record<string, unknown>): string[] {
+  const plugin = config.plugin;
+  if (typeof plugin === "string") return [plugin];
+  if (Array.isArray(plugin)) return plugin.filter((item) => typeof item === "string") as string[];
+  return [];
+}
+
+async function listPluginFiles(dir: string, scope: "project" | "global", workspaceRoot?: string): Promise<PluginItem[]> {
+  if (!(await exists(dir))) return [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  const items: PluginItem[] = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith(".js") && !entry.name.endsWith(".ts")) continue;
+    const absolutePath = join(dir, entry.name);
+    const relativePath = workspaceRoot ? relative(workspaceRoot, absolutePath) : absolutePath;
+    items.push({
+      spec: `file://${absolutePath}`,
+      source: scope === "project" ? "dir.project" : "dir.global",
+      scope,
+      path: relativePath,
+    });
+  }
+  return items;
+}
+
+export async function listPlugins(workspaceRoot: string, includeGlobal: boolean): Promise<{ items: PluginItem[]; loadOrder: string[] }> {
+  const { data: config } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const pluginSpecs = pluginListFromConfig(config);
+  const items: PluginItem[] = pluginSpecs.map((spec) => ({
+    spec,
+    source: "config",
+    scope: "project",
+  }));
+
+  const projectDir = projectPluginsDir(workspaceRoot);
+  items.push(...(await listPluginFiles(projectDir, "project", workspaceRoot)));
+
+  if (includeGlobal) {
+    const globalDir = join(homedir(), ".config", "opencode", "plugins");
+    items.push(...(await listPluginFiles(globalDir, "global")));
+  }
+
+  return {
+    items,
+    loadOrder: ["config.global", "config.project", "dir.global", "dir.project"],
+  };
+}
+
+export async function addPlugin(workspaceRoot: string, spec: string): Promise<boolean> {
+  validatePluginSpec(spec);
+  const { data: config } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const pluginSpecs = pluginListFromConfig(config);
+  const normalized = normalizePluginSpec(spec);
+  const existing = pluginSpecs.find((item) => normalizePluginSpec(item) === normalized);
+  if (existing) return false;
+  pluginSpecs.push(spec);
+  await updateJsoncTopLevel(opencodeConfigPath(workspaceRoot), { plugin: pluginSpecs });
+  return true;
+}
+
+export async function removePlugin(workspaceRoot: string, name: string): Promise<boolean> {
+  const { data: config } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  const pluginSpecs = pluginListFromConfig(config);
+  const normalized = normalizePluginSpec(name);
+  const filtered = pluginSpecs.filter((item) => normalizePluginSpec(item) !== normalized);
+  if (filtered.length === pluginSpecs.length) return false;
+  await updateJsoncTopLevel(opencodeConfigPath(workspaceRoot), { plugin: filtered });
+  return true;
+}
diff --git a/apps/server/src/portable-files.test.ts b/apps/server/src/portable-files.test.ts
new file mode 100644
index 0000000000..dcd01820cc
--- /dev/null
+++ b/apps/server/src/portable-files.test.ts
@@ -0,0 +1,98 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { listPortableFiles, planPortableFiles, writePortableFiles } from "./portable-files.js";
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (!dir) continue;
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+async function makeWorkspace(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "openwork-portable-files-"));
+  tempDirs.push(dir);
+  await mkdir(join(dir, ".opencode"), { recursive: true });
+  return dir;
+}
+
+describe("portable files", () => {
+  test("lists only extra shareable .opencode files", async () => {
+    const workspaceRoot = await makeWorkspace();
+    await mkdir(join(workspaceRoot, ".opencode", "agents"), { recursive: true });
+    await mkdir(join(workspaceRoot, ".opencode", "plugins"), { recursive: true });
+    await mkdir(join(workspaceRoot, ".opencode", "tools"), { recursive: true });
+    await mkdir(join(workspaceRoot, ".opencode", "node_modules", "demo"), { recursive: true });
+    await mkdir(join(workspaceRoot, ".opencode", "skills", "demo"), { recursive: true });
+    await mkdir(join(workspaceRoot, ".opencode", "commands"), { recursive: true });
+
+    await writeFile(join(workspaceRoot, ".opencode", "agents", "openwork.md"), "# agent\n", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "plugins", "router.json"), '{"enabled":true}\n', "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "tools", "database.ts"), "export default {};\n", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "node_modules", "demo", "index.js"), "export default 1;\n", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "skills", "demo", "SKILL.md"), "# skill\n", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "commands", "demo.md"), "# command\n", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "openwork.json"), '{"version":1}\n', "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", "opencode.db"), "sqlite-bytes", "utf8");
+    await writeFile(join(workspaceRoot, ".opencode", ".env"), "SECRET=value\n", "utf8");
+
+    const files = await listPortableFiles(workspaceRoot);
+
+    expect(files).toEqual([
+      { path: ".opencode/agents/openwork.md", content: "# agent\n" },
+      { path: ".opencode/plugins/router.json", content: '{"enabled":true}\n' },
+      { path: ".opencode/tools/database.ts", content: "export default {};\n" },
+    ]);
+  });
+
+  test("plans and writes validated portable files", async () => {
+    const workspaceRoot = await makeWorkspace();
+    const planned = planPortableFiles(workspaceRoot, [
+      { path: ".opencode/agents/demo.md", content: "hello\n" },
+      { path: ".opencode/tools/demo.ts", content: "export default {};\n" },
+    ]);
+
+    expect(planned[0]?.absolutePath.endsWith("/.opencode/agents/demo.md")).toBe(true);
+    expect(planned[1]?.absolutePath.endsWith("/.opencode/tools/demo.ts")).toBe(true);
+
+    await writePortableFiles(workspaceRoot, [
+      { path: ".opencode/agents/demo.md", content: "hello\n" },
+      { path: ".opencode/tools/demo.ts", content: "export default {};\n" },
+    ]);
+
+    const contents = await readFile(join(workspaceRoot, ".opencode", "agents", "demo.md"), "utf8");
+    const toolContents = await readFile(join(workspaceRoot, ".opencode", "tools", "demo.ts"), "utf8");
+    expect(contents).toBe("hello\n");
+    expect(toolContents).toBe("export default {};\n");
+  });
+
+  test("rejects non-allowlisted portable files and path traversal", async () => {
+    const workspaceRoot = await makeWorkspace();
+
+    expect(() =>
+      planPortableFiles(workspaceRoot, [{ path: ".opencode/.env", content: "SECRET=value" }]),
+    ).toThrow(/not allowed/i);
+
+    expect(() =>
+      planPortableFiles(workspaceRoot, [{ path: ".opencode/package.json", content: "{}" }]),
+    ).toThrow(/not allowed/i);
+
+    expect(() =>
+      planPortableFiles(workspaceRoot, [{ path: ".opencode/openwork.json", content: "{}" }]),
+    ).toThrow(/not allowed/i);
+
+    expect(() =>
+      planPortableFiles(workspaceRoot, [{ path: "../outside.md", content: "oops" }]),
+    ).toThrow(/invalid/i);
+
+    expect(() =>
+      planPortableFiles(workspaceRoot, [{ path: ".opencode/node_modules/demo/index.js", content: "oops" }]),
+    ).toThrow(/not allowed/i);
+  });
+});
diff --git a/apps/server/src/portable-files.ts b/apps/server/src/portable-files.ts
new file mode 100644
index 0000000000..617a63b728
--- /dev/null
+++ b/apps/server/src/portable-files.ts
@@ -0,0 +1,173 @@
+import { readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+
+import { ApiError } from "./errors.js";
+import { ensureDir, exists } from "./utils.js";
+
+export type PortableFile = {
+  path: string;
+  content: string;
+};
+
+export type PlannedPortableFile = PortableFile & {
+  absolutePath: string;
+};
+
+const ALLOWED_PORTABLE_PREFIXES = [".opencode/agents/", ".opencode/plugins/", ".opencode/tools/"];
+
+const RESERVED_PORTABLE_SEGMENTS = new Set([".DS_Store", "Thumbs.db", "node_modules"]);
+
+function normalizePortablePath(input: unknown): string {
+  const normalized = String(input ?? "")
+    .replaceAll("\\", "/")
+    .replace(/\/+/g, "/")
+    .replace(/^\.\//, "")
+    .replace(/^\/+/, "")
+    .trim();
+
+  if (!normalized) {
+    throw new ApiError(400, "invalid_portable_file_path", "Portable file path is required");
+  }
+
+  if (normalized.includes("\0")) {
+    throw new ApiError(400, "invalid_portable_file_path", `Portable file path contains an invalid byte: ${normalized}`);
+  }
+
+  const segments = normalized.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new ApiError(400, "invalid_portable_file_path", `Portable file path is invalid: ${normalized}`);
+  }
+
+  return normalized;
+}
+
+function isEnvFilePath(path: string): boolean {
+  return path
+    .split("/")
+    .some((segment) => /^\.env(?:\..+)?$/i.test(segment));
+}
+
+function hasReservedPortableSegment(path: string): boolean {
+  const segments = path.split("/");
+  return segments.some((segment) => RESERVED_PORTABLE_SEGMENTS.has(segment));
+}
+
+function isAllowedPortablePrefix(path: string): boolean {
+  return ALLOWED_PORTABLE_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+
+export function isAllowedPortableFilePath(input: unknown): boolean {
+  const path = normalizePortablePath(input);
+  if (!isAllowedPortablePrefix(path)) return false;
+  if (isEnvFilePath(path)) return false;
+  if (hasReservedPortableSegment(path)) return false;
+  return true;
+}
+
+function normalizePortableFile(value: unknown): PortableFile {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ApiError(400, "invalid_portable_file", "Portable files must be objects with path and content");
+  }
+
+  const record = value as Record<string, unknown>;
+  const path = normalizePortablePath(record.path);
+  if (!isAllowedPortableFilePath(path)) {
+    throw new ApiError(400, "invalid_portable_file_path", `Portable file path is not allowed: ${path}`);
+  }
+
+  return {
+    path,
+    content: typeof record.content === "string" ? record.content : String(record.content ?? ""),
+  };
+}
+
+export function planPortableFiles(workspaceRoot: string, value: unknown): PlannedPortableFile[] {
+  if (!Array.isArray(value) || !value.length) return [];
+
+  const root = resolve(workspaceRoot);
+  return value.map((entry) => {
+    const file = normalizePortableFile(entry);
+    return {
+      ...file,
+      absolutePath: join(root, file.path),
+    };
+  });
+}
+
+async function walkPortableFiles(root: string, currentPath: string, output: PortableFile[]): Promise<void> {
+  const entries = await readdir(currentPath, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const absolutePath = join(currentPath, entry.name);
+    if (entry.isDirectory()) {
+      await walkPortableFiles(root, absolutePath, output);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+
+    const relativePath = normalizePortablePath(absolutePath.slice(root.length + 1));
+    if (!isAllowedPortableFilePath(relativePath)) continue;
+    output.push({
+      path: relativePath,
+      content: await readFile(absolutePath, "utf8"),
+    });
+  }
+}
+
+async function walkPortableFilePaths(root: string, currentPath: string, output: string[]): Promise<void> {
+  const entries = await readdir(currentPath, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const absolutePath = join(currentPath, entry.name);
+    if (entry.isDirectory()) {
+      await walkPortableFilePaths(root, absolutePath, output);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+
+    const relativePath = normalizePortablePath(absolutePath.slice(root.length + 1));
+    if (!isAllowedPortableFilePath(relativePath)) continue;
+    output.push(relativePath);
+  }
+}
+
+export async function listPortableFiles(workspaceRoot: string): Promise<PortableFile[]> {
+  const root = resolve(workspaceRoot);
+  const portableRoot = join(root, ".opencode");
+  if (!(await exists(portableRoot))) return [];
+
+  const output: PortableFile[] = [];
+  await walkPortableFiles(root, portableRoot, output);
+  output.sort((a, b) => a.path.localeCompare(b.path));
+  return output;
+}
+
+export async function listPortableFilePaths(workspaceRoot: string): Promise<string[]> {
+  const root = resolve(workspaceRoot);
+  const portableRoot = join(root, ".opencode");
+  if (!(await exists(portableRoot))) return [];
+
+  const output: string[] = [];
+  await walkPortableFilePaths(root, portableRoot, output);
+  output.sort((a, b) => a.localeCompare(b));
+  return output;
+}
+
+export async function writePortableFiles(workspaceRoot: string, value: unknown, options?: { replace?: boolean }): Promise<PlannedPortableFile[]> {
+  const files = planPortableFiles(workspaceRoot, value);
+  if (!files.length) return [];
+
+  if (options?.replace) {
+    const existing = await listPortableFiles(workspaceRoot);
+    for (const file of existing) {
+      await rm(join(resolve(workspaceRoot), file.path), { force: true });
+    }
+  }
+
+  for (const file of files) {
+    await ensureDir(dirname(file.absolutePath));
+    await writeFile(file.absolutePath, file.content, "utf8");
+  }
+
+  return files;
+}
diff --git a/apps/server/src/portable-opencode.test.ts b/apps/server/src/portable-opencode.test.ts
new file mode 100644
index 0000000000..2bc5c51392
--- /dev/null
+++ b/apps/server/src/portable-opencode.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+
+import { sanitizePortableOpencodeConfig } from "./portable-opencode.js";
+
+describe("sanitizePortableOpencodeConfig", () => {
+  test("keeps only portable top-level config keys", () => {
+    const sanitized = sanitizePortableOpencodeConfig({
+      model: "anthropic/claude-sonnet-4-5",
+      provider: { openai: { options: { apiKey: "secret" } } },
+      tools: { bash: false },
+      permission: { edit: "ask" },
+      plugin: ["opencode-helicone-session"],
+      command: { review: { template: "Review changes" } },
+      mcp: { jira: { type: "remote", url: "https://jira.example.com/mcp" } },
+      agent: { reviewer: { description: "Reviews code" } },
+      instructions: ["CONTRIBUTING.md"],
+      share: "manual",
+      watcher: { ignore: ["dist/**"] },
+      autoupdate: false,
+    });
+
+    expect(sanitized).toEqual({
+      tools: { bash: false },
+      permission: { edit: "ask" },
+      plugin: ["opencode-helicone-session"],
+      command: { review: { template: "Review changes" } },
+      mcp: { jira: { type: "remote", url: "https://jira.example.com/mcp" } },
+      agent: { reviewer: { description: "Reviews code" } },
+      instructions: ["CONTRIBUTING.md"],
+      share: "manual",
+      watcher: { ignore: ["dist/**"] },
+    });
+  });
+
+  test("returns a defensive clone", () => {
+    const input = { plugin: ["a"], tools: { bash: false } };
+    const sanitized = sanitizePortableOpencodeConfig(input);
+    (sanitized.plugin as string[]).push("b");
+    (sanitized.tools as Record<string, unknown>).bash = true;
+
+    expect(input).toEqual({ plugin: ["a"], tools: { bash: false } });
+  });
+});
diff --git a/apps/server/src/portable-opencode.ts b/apps/server/src/portable-opencode.ts
new file mode 100644
index 0000000000..7acc051508
--- /dev/null
+++ b/apps/server/src/portable-opencode.ts
@@ -0,0 +1,27 @@
+const PORTABLE_OPENCODE_TOP_LEVEL_KEYS = [
+  "agent",
+  "command",
+  "instructions",
+  "mcp",
+  "permission",
+  "plugin",
+  "share",
+  "tools",
+  "watcher",
+] as const;
+
+function cloneJson<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value));
+}
+
+export function sanitizePortableOpencodeConfig(opencode: Record<string, unknown> | null | undefined): Record<string, unknown> {
+  const source = opencode && typeof opencode === "object" && !Array.isArray(opencode) ? opencode : {};
+  const next: Record<string, unknown> = {};
+
+  for (const key of PORTABLE_OPENCODE_TOP_LEVEL_KEYS) {
+    if (!(key in source)) continue;
+    next[key] = cloneJson(source[key]);
+  }
+
+  return next;
+}
diff --git a/apps/server/src/reload-watcher.ts b/apps/server/src/reload-watcher.ts
new file mode 100644
index 0000000000..e58eee41bf
--- /dev/null
+++ b/apps/server/src/reload-watcher.ts
@@ -0,0 +1,392 @@
+import { existsSync, watch, type FSWatcher } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+
+import type { ReloadEventStore } from "./events.js";
+import type { ReloadReason, ReloadTrigger, ServerConfig, WorkspaceInfo } from "./types.js";
+
+type LogLevel = "info" | "warn" | "error";
+
+type Logger = {
+  log: (level: LogLevel, message: string, attributes?: Record<string, unknown>) => void;
+};
+
+type DirectoryTreeWatcher = {
+  scheduleRescan: () => void;
+  close: () => void;
+};
+
+export function startReloadWatchers(input: {
+  config: ServerConfig;
+  reloadEvents: ReloadEventStore;
+  logger?: Logger | null;
+  debounceMs?: number;
+}): { close: () => void } {
+  const { config, reloadEvents } = input;
+  const logger = input.logger ?? null;
+  const debounceMs = typeof input.debounceMs === "number" ? input.debounceMs : 750;
+
+  const closers: Array<() => void> = [];
+
+  for (const workspace of config.workspaces) {
+    try {
+      closers.push(
+        startWorkspaceReloadWatcher({ workspace, reloadEvents, logger, debounceMs }),
+      );
+    } catch (error) {
+      logger?.log("warn", "Reload watcher failed to start", {
+        workspaceId: workspace.id,
+        workspacePath: workspace.path,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+
+  if (config.workspaces.length) {
+    logger?.log("info", `Reload watcher enabled (${config.workspaces.length})`, {
+      workspaceCount: config.workspaces.length,
+    });
+  }
+
+  return {
+    close: () => {
+      for (const close of closers) {
+        try {
+          close();
+        } catch {
+          // ignore
+        }
+      }
+    },
+  };
+}
+
+function startWorkspaceReloadWatcher(input: {
+  workspace: WorkspaceInfo;
+  reloadEvents: ReloadEventStore;
+  logger: Logger | null;
+  debounceMs: number;
+}): () => void {
+  const { workspace, reloadEvents, logger, debounceMs } = input;
+  const root = resolve(workspace.path);
+
+  const trees: DirectoryTreeWatcher[] = [];
+  const closeAll = () => {
+    for (const tree of trees) {
+      tree.close();
+    }
+    rootWatcher?.close();
+  };
+
+  const record = (reason: ReloadReason, trigger?: ReloadTrigger) => {
+    reloadEvents.recordDebounced(workspace.id, reason, trigger, debounceMs);
+  };
+
+  // Watch the workspace root for top-level config files.
+  let rootWatcher: FSWatcher | null = null;
+  if (existsSync(root)) {
+    try {
+      rootWatcher = watch(
+        root,
+        { persistent: false },
+        (_eventType, filename) => {
+          const raw = filename ? filename.toString() : "";
+          const name = raw.trim();
+          if (!name) {
+            for (const tree of trees) tree.scheduleRescan();
+            return;
+          }
+
+          if (name === "opencode.json" || name === "opencode.jsonc") {
+            record("config", {
+              type: "config",
+              name,
+              action: "updated",
+              path: join(root, name),
+            });
+            return;
+          }
+
+          if (name === "AGENTS.md") {
+            record("agents", {
+              type: "agent",
+              action: "updated",
+              path: join(root, name),
+            });
+            return;
+          }
+
+          // If .opencode is created/removed, rescan the relevant trees.
+          if (name === ".opencode") {
+            for (const tree of trees) tree.scheduleRescan();
+          }
+        },
+      );
+      rootWatcher.on("error", (error) => {
+        logger?.log("warn", "Reload watcher root error", {
+          workspaceId: workspace.id,
+          workspacePath: root,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      });
+    } catch (error) {
+      logger?.log("warn", "Reload watcher root failed", {
+        workspaceId: workspace.id,
+        workspacePath: root,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+
+  const opencodeRoot = join(root, ".opencode");
+
+  trees.push(
+    createDirectoryTreeWatcher({
+      rootDir: join(opencodeRoot, "skills"),
+      workspace,
+      reloadEvents,
+      reason: "skills",
+      triggerType: "skill",
+      debounceMs,
+      logger,
+    }),
+  );
+  trees.push(
+    createDirectoryTreeWatcher({
+      rootDir: join(opencodeRoot, "commands"),
+      workspace,
+      reloadEvents,
+      reason: "commands",
+      triggerType: "command",
+      debounceMs,
+      logger,
+    }),
+  );
+  trees.push(
+    createDirectoryTreeWatcher({
+      rootDir: join(opencodeRoot, "plugins"),
+      workspace,
+      reloadEvents,
+      reason: "plugins",
+      triggerType: "plugin",
+      debounceMs,
+      logger,
+    }),
+  );
+  trees.push(
+    createDirectoryTreeWatcher({
+      rootDir: join(opencodeRoot, "agents"),
+      workspace,
+      reloadEvents,
+      reason: "agents",
+      triggerType: "agent",
+      debounceMs,
+      logger,
+    }),
+  );
+  trees.push(
+    createDirectoryTreeWatcher({
+      rootDir: join(opencodeRoot, "agent"),
+      workspace,
+      reloadEvents,
+      reason: "agents",
+      triggerType: "agent",
+      debounceMs,
+      logger,
+    }),
+  );
+
+  // Kick off an initial scan so we start watching existing trees.
+  for (const tree of trees) {
+    tree.scheduleRescan();
+  }
+
+  return closeAll;
+}
+
+function createDirectoryTreeWatcher(input: {
+  rootDir: string;
+  workspace: WorkspaceInfo;
+  reloadEvents: ReloadEventStore;
+  reason: ReloadReason;
+  triggerType: ReloadTrigger["type"];
+  debounceMs: number;
+  logger: Logger | null;
+}): DirectoryTreeWatcher {
+  const { rootDir, workspace, reloadEvents, reason, triggerType, debounceMs, logger } = input;
+  const resolvedRoot = resolve(rootDir);
+
+  const watchers = new Map<string, FSWatcher>();
+  let closed = false;
+  let scanTimer: ReturnType<typeof setTimeout> | null = null;
+  let scanning = false;
+  let rescanRequested = false;
+  let lastRootExists = existsSync(resolvedRoot);
+
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    if (scanTimer) {
+      clearTimeout(scanTimer);
+      scanTimer = null;
+    }
+    for (const watcher of watchers.values()) {
+      try {
+        watcher.close();
+      } catch {
+        // ignore
+      }
+    }
+    watchers.clear();
+  };
+
+  const record = (path: string) => {
+    const trigger: ReloadTrigger = {
+      type: triggerType,
+      action: "updated",
+      path,
+    };
+
+    if (reason === "skills" || reason === "commands" || reason === "agents") {
+      const rel = path.slice(resolvedRoot.length).replace(/^[/\\]+/, "");
+      const name = rel.split(/[/\\]+/).filter(Boolean)[0] ?? "";
+      if (name) {
+        trigger.name = reason === "commands" ? name.replace(/\.md$/i, "") : name;
+      }
+    }
+
+    reloadEvents.recordDebounced(workspace.id, reason, trigger, debounceMs);
+  };
+
+  const shouldIgnoreEntry = (absPath: string) => {
+    const base = basename(absPath);
+    if (!base) return true;
+    if (base === ".DS_Store" || base === "Thumbs.db") return true;
+    return false;
+  };
+
+  const shouldSkipDir = (name: string) => {
+    const trimmed = name.trim();
+    if (!trimmed) return true;
+    if (trimmed === ".git" || trimmed === "node_modules") return true;
+    return false;
+  };
+
+  const ensureWatcher = (dir: string) => {
+    if (watchers.has(dir)) return;
+    try {
+      const watcher = watch(
+        dir,
+        { persistent: false },
+        (_eventType, filename) => {
+          if (closed) return;
+          const raw = filename ? filename.toString() : "";
+          const name = raw.trim();
+          const absPath = name ? join(dir, name) : dir;
+          if (!shouldIgnoreEntry(absPath)) {
+            record(absPath);
+          }
+          scheduleRescan();
+        },
+      );
+      watcher.on("error", (error) => {
+        logger?.log("warn", "Reload watcher dir error", {
+          workspaceId: workspace.id,
+          reason,
+          dir,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      });
+      watchers.set(dir, watcher);
+    } catch (error) {
+      logger?.log("warn", "Reload watcher dir failed", {
+        workspaceId: workspace.id,
+        reason,
+        dir,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  };
+
+  const scanDirs = async (): Promise<Set<string>> => {
+    const dirs = new Set<string>();
+    const stack = [resolvedRoot];
+    while (stack.length) {
+      const dir = stack.pop();
+      if (!dir) continue;
+      dirs.add(dir);
+      let entries;
+      try {
+        entries = await readdir(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        if (shouldSkipDir(entry.name)) continue;
+        stack.push(join(dir, entry.name));
+      }
+    }
+    return dirs;
+  };
+
+  const scan = async () => {
+    if (closed) return;
+    if (scanning) {
+      rescanRequested = true;
+      return;
+    }
+    scanning = true;
+    try {
+      const existsNow = existsSync(resolvedRoot);
+      if (existsNow !== lastRootExists) {
+        lastRootExists = existsNow;
+        reloadEvents.recordDebounced(workspace.id, reason, { type: triggerType, action: "updated", path: resolvedRoot }, debounceMs);
+      }
+      if (!existsNow) {
+        for (const watcher of watchers.values()) {
+          try {
+            watcher.close();
+          } catch {
+            // ignore
+          }
+        }
+        watchers.clear();
+        return;
+      }
+
+      const dirs = await scanDirs();
+      for (const dir of dirs) {
+        ensureWatcher(dir);
+      }
+      for (const dir of Array.from(watchers.keys())) {
+        if (!dirs.has(dir)) {
+          const watcher = watchers.get(dir);
+          try {
+            watcher?.close();
+          } catch {
+            // ignore
+          }
+          watchers.delete(dir);
+        }
+      }
+    } finally {
+      scanning = false;
+      if (rescanRequested) {
+        rescanRequested = false;
+        scheduleRescan();
+      }
+    }
+  };
+
+  const scheduleRescan = () => {
+    if (closed) return;
+    if (scanTimer) return;
+    scanTimer = setTimeout(() => {
+      scanTimer = null;
+      void scan();
+    }, 200);
+  };
+
+  return { scheduleRescan, close };
+}
diff --git a/apps/server/src/server.normalizeWorkspaceRelativePath.test.ts b/apps/server/src/server.normalizeWorkspaceRelativePath.test.ts
new file mode 100644
index 0000000000..9f1a0e99eb
--- /dev/null
+++ b/apps/server/src/server.normalizeWorkspaceRelativePath.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import { isSupportedWorkspaceTextFilePath, normalizeWorkspaceRelativePath } from "./server.js";
+
+describe("normalizeWorkspaceRelativePath", () => {
+  test("accepts a plain workspace-relative path", () => {
+    expect(normalizeWorkspaceRelativePath("notes.md", { allowSubdirs: true })).toBe("notes.md");
+  });
+
+  test("strips workspace/ prefix", () => {
+    expect(normalizeWorkspaceRelativePath("workspace/notes.md", { allowSubdirs: true })).toBe("notes.md");
+    expect(normalizeWorkspaceRelativePath("workspace/dir/notes.md", { allowSubdirs: true })).toBe("dir/notes.md");
+  });
+
+  test("strips /workspace/ prefix", () => {
+    expect(normalizeWorkspaceRelativePath("/workspace/notes.md", { allowSubdirs: true })).toBe("notes.md");
+    expect(normalizeWorkspaceRelativePath("//workspace/dir/notes.md", { allowSubdirs: true })).toBe("dir/notes.md");
+  });
+
+  test("strips ./workspace/ prefix", () => {
+    expect(normalizeWorkspaceRelativePath("./workspace/notes.md", { allowSubdirs: true })).toBe("notes.md");
+  });
+
+  test("still rejects traversal after stripping prefixes", () => {
+    expect(() => normalizeWorkspaceRelativePath("workspace/../secrets.md", { allowSubdirs: true })).toThrow();
+    expect(() => normalizeWorkspaceRelativePath("/workspace/../secrets.md", { allowSubdirs: true })).toThrow();
+  });
+
+  test("still enforces allowSubdirs", () => {
+    expect(() => normalizeWorkspaceRelativePath("workspace/dir/notes.md", { allowSubdirs: false })).toThrow();
+  });
+
+  test("treats workspace/ with no file as invalid", () => {
+    expect(() => normalizeWorkspaceRelativePath("workspace/", { allowSubdirs: true })).toThrow();
+    expect(() => normalizeWorkspaceRelativePath("/workspace/", { allowSubdirs: true })).toThrow();
+  });
+});
+
+describe("isSupportedWorkspaceTextFilePath", () => {
+  test("accepts plugin import text file extensions", () => {
+    expect(isSupportedWorkspaceTextFilePath(".opencode/tools/cloud.ts")).toBe(true);
+    expect(isSupportedWorkspaceTextFilePath(".opencode/mcps/cloud.json")).toBe(true);
+    expect(isSupportedWorkspaceTextFilePath(".opencode/plugins/cloud.txt")).toBe(true);
+  });
+
+  test("rejects unsupported binary-like extensions", () => {
+    expect(isSupportedWorkspaceTextFilePath(".opencode/plugins/cloud.bin")).toBe(false);
+  });
+});
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
new file mode 100644
index 0000000000..e7c65d3633
--- /dev/null
+++ b/apps/server/src/server.ts
@@ -0,0 +1,3583 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile, rm, readdir, rename, stat, appendFile, mkdir } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import type { ApprovalRequest, Capabilities, ServerConfig, WorkspaceInfo, Actor, ReloadReason, ReloadTrigger, TokenScope } from "./types.js";
+import { ApprovalService } from "./approvals.js";
+import { addPlugin, listPlugins, normalizePluginSpec, removePlugin } from "./plugins.js";
+import { sanitizePortableOpencodeConfig } from "./portable-opencode.js";
+import { addMcp, listMcp, removeMcp, setMcpEnabled } from "./mcp.js";
+import { deleteSkill, listSkills, upsertSkill } from "./skills.js";
+import { installHubSkill, listHubSkills } from "./skill-hub.js";
+import { deleteCommand, listCommands, repairCommands, upsertCommand } from "./commands.js";
+import { ApiError, formatError } from "./errors.js";
+import { readJsoncFile, updateJsoncPath, updateJsoncTopLevel, writeJsoncFile } from "./jsonc.js";
+import { recordAudit, readAuditEntries, readLastAudit } from "./audit.js";
+import { ReloadEventStore } from "./events.js";
+import { startReloadWatchers } from "./reload-watcher.js";
+import { opencodeConfigPath, openworkConfigPath, projectCommandsDir, projectSkillsDir } from "./workspace-files.js";
+import { ensureDir, exists, hashToken, shortId } from "./utils.js";
+import { workspaceIdForPath } from "./workspaces.js";
+import { ensureWorkspaceFiles, readRawOpencodeConfig } from "./workspace-init.js";
+import { sanitizeCommandName, validateMcpName } from "./validators.js";
+import { TokenService } from "./tokens.js";
+import { EnvService, EnvStoreReadError, InvalidEnvKeyError, isValidEnvKey } from "./env-file.js";
+import { TOY_UI_CSS, TOY_UI_FAVICON_SVG, TOY_UI_HTML, TOY_UI_JS, cssResponse, htmlResponse, jsResponse, svgResponse } from "./toy-ui.js";
+import { FileSessionStore } from "./file-sessions.js";
+import {
+  applyMaterializedBlueprintSessions,
+  normalizeBlueprintSessionTemplates,
+  readMaterializedBlueprintSessions,
+  sanitizeOpenworkTemplateConfig,
+} from "./blueprint-sessions.js";
+import { inheritWorkspaceOpencodeConnection, resolveWorkspaceOpencodeConnection } from "./opencode-connection.js";
+import { fetchSharedBundle, publishSharedBundle } from "./share-bundles.js";
+import { seedOpencodeSessionMessages } from "./opencode-db.js";
+import { listPortableFiles } from "./portable-files.js";
+import {
+  buildWorkspaceImportPreview,
+  normalizeWorkspaceImportPayload,
+  publicWorkspaceImportPreview,
+  summarizeWorkspaceImportApplied,
+  summarizeWorkspaceImportPreview,
+  type WorkspaceImportPlan,
+  workspaceImportPreviewApprovalPaths,
+} from "./workspace-import-preview.js";
+import { buildSession, buildSessionList, buildSessionMessages, buildSessionSnapshot, buildSessionStatuses, buildSessionTodos } from "./session-read-model.js";
+import {
+  collectWorkspaceExportWarnings,
+  stripSensitiveWorkspaceExportData,
+  type WorkspaceExportSensitiveMode,
+} from "./workspace-export-safety.js";
+import pkg from "../package.json" with { type: "json" };
+
+const SERVER_VERSION = pkg.version;
+
+const FILE_SESSION_DEFAULT_TTL_MS = 15 * 60 * 1000;
+const FILE_SESSION_MIN_TTL_MS = 30 * 1000;
+const FILE_SESSION_MAX_TTL_MS = 24 * 60 * 60 * 1000;
+const FILE_SESSION_MAX_BATCH_ITEMS = 64;
+const FILE_SESSION_MAX_FILE_BYTES = 5_000_000;
+const FILE_SESSION_CATALOG_DEFAULT_LIMIT = 2000;
+const FILE_SESSION_CATALOG_MAX_LIMIT = 10000;
+
+type LogLevel = "info" | "warn" | "error";
+
+type LogAttributes = Record<string, unknown>;
+
+type ServerLogger = {
+  log: (level: LogLevel, message: string, attributes?: LogAttributes) => void;
+};
+
+const LOG_LEVEL_NUMBERS: Record<LogLevel, number> = {
+  info: 9,
+  warn: 13,
+  error: 17,
+};
+
+function toUnixNano(): string {
+  return (BigInt(Date.now()) * 1_000_000n).toString();
+}
+
+export function createServerLogger(config: ServerConfig): ServerLogger {
+  const runId = process.env.OPENWORK_RUN_ID ?? shortId();
+  const host = hostname().trim();
+  const resource: Record<string, string> = {
+    "service.name": "openwork-server",
+    "service.version": SERVER_VERSION,
+    "service.instance.id": runId,
+  };
+  if (host) {
+    resource["host.name"] = host;
+  }
+  const baseAttributes: LogAttributes = {
+    "run.id": runId,
+    "process.pid": process.pid,
+  };
+
+  const emit = (level: LogLevel, message: string, attributes?: LogAttributes) => {
+    const merged = { ...baseAttributes, ...(attributes ?? {}) };
+    if (config.logFormat === "json") {
+      const record = {
+        timeUnixNano: toUnixNano(),
+        severityText: level.toUpperCase(),
+        severityNumber: LOG_LEVEL_NUMBERS[level],
+        body: message,
+        attributes: merged,
+        resource,
+      };
+      process.stdout.write(`${JSON.stringify(record)}\n`);
+      return;
+    }
+    process.stdout.write(`${message}\n`);
+  };
+
+  return { log: emit };
+}
+
+function logRequest(input: {
+  logger: ServerLogger;
+  request: Request;
+  response: Response;
+  durationMs: number;
+  authMode: AuthMode;
+  proxyService?: "opencode";
+  proxyBaseUrl?: string;
+  error?: string;
+}) {
+  const { logger, request, response, durationMs, authMode, proxyService, proxyBaseUrl, error } = input;
+  const status = response.status;
+  const level: LogLevel = status >= 500 ? "error" : status >= 400 ? "warn" : "info";
+  const url = new URL(request.url);
+  const method = request.method.toUpperCase();
+  const proxyLabel = proxyBaseUrl ? ` (${proxyService ?? "proxy"})` : "";
+  const message = `${method} ${url.pathname} ${status} ${durationMs}ms${proxyLabel}`;
+  const attributes: LogAttributes = {
+    method,
+    path: url.pathname,
+    status,
+    durationMs,
+    auth: authMode,
+  };
+  if (proxyBaseUrl) {
+    attributes["proxy.base_url"] = proxyBaseUrl;
+    if (proxyService) attributes["proxy.service"] = proxyService;
+  }
+  if (error) {
+    attributes.error = error;
+  }
+  logger.log(level, message, attributes);
+}
+
+type AuthMode = "none" | "client" | "host" | "host-token";
+
+function parseWorkspaceMount(pathname: string): { workspaceId: string; restPath: string } | null {
+  if (!pathname.startsWith("/w/")) return null;
+  const remainder = pathname.slice(3);
+  if (!remainder) return null;
+  const slash = remainder.indexOf("/");
+  if (slash === -1) {
+    return { workspaceId: decodeURIComponent(remainder), restPath: "/" };
+  }
+  const workspaceId = remainder.slice(0, slash);
+  const restPath = remainder.slice(slash) || "/";
+  if (!workspaceId.trim()) return null;
+  return { workspaceId: decodeURIComponent(workspaceId), restPath };
+}
+
+function normalizeOpencodeProxyPath(proxyPath: string): string {
+  const raw = (proxyPath ?? "").trim() || "/";
+  const withoutPrefix = raw.startsWith("/opencode") ? raw.slice("/opencode".length) : raw;
+  const normalized = (withoutPrefix || "/").replace(/\/+$/, "");
+  return normalized || "/";
+}
+
+function assertOpencodeProxyAllowed(actor: Actor, method: string, proxyPath: string) {
+  const m = method.toUpperCase();
+  const scope = actor.scope ?? "viewer";
+
+  if (scope === "viewer" && m !== "GET" && m !== "HEAD") {
+    throw new ApiError(403, "forbidden", "Viewer tokens are read-only");
+  }
+
+  // Prevent collaborators/viewers from self-approving OpenCode permission requests via the proxy.
+  // OpenCode uses /permission/:requestId/reply (and historically also a session-scoped variant).
+  if (scope !== "owner" && m !== "GET" && m !== "HEAD") {
+    const normalized = normalizeOpencodeProxyPath(proxyPath);
+    if (/\/permission\/[^/]+\/reply$/.test(normalized)) {
+      throw new ApiError(403, "forbidden", "Only owner tokens can reply to permission requests");
+    }
+  }
+}
+
+function isSessionCommandProxyRequest(method: string, proxyPath: string) {
+  return method === "POST" && /^\/session\/[^/]+\/command$/.test(normalizeOpencodeProxyPath(proxyPath));
+}
+
+interface Route {
+  method: string;
+  regex: RegExp;
+  keys: string[];
+  auth: AuthMode;
+  handler: (ctx: RequestContext) => Promise<Response>;
+}
+
+interface RequestContext {
+  request: Request;
+  url: URL;
+  params: Record<string, string>;
+  config: ServerConfig;
+  approvals: ApprovalService;
+  reloadEvents: ReloadEventStore;
+  tokens: TokenService;
+  actor?: Actor;
+}
+
+export function startServer(config: ServerConfig) {
+  const approvals = new ApprovalService(config.approval);
+  const reloadEvents = new ReloadEventStore();
+  const tokens = new TokenService(config);
+  const env = new EnvService();
+  const logger = createServerLogger(config);
+  let watcherHandle = startReloadWatchers({ config, reloadEvents, logger });
+  const restartReloadWatchers = () => {
+    watcherHandle.close();
+    watcherHandle = startReloadWatchers({ config, reloadEvents, logger });
+  };
+  const routes = createRoutes(config, approvals, tokens, env, restartReloadWatchers);
+
+  const serverOptions: {
+    hostname: string;
+    port: number;
+    fetch: (request: Request) => Response | Promise<Response>;
+  } = {
+    hostname: config.host,
+    port: config.port,
+    fetch: async (request: Request) => {
+      const url = new URL(request.url);
+      const startedAt = Date.now();
+      let authMode: AuthMode = "none";
+      let proxyService: "opencode" | undefined;
+      let proxyBaseUrl: string | undefined;
+      let errorMessage: string | undefined;
+
+      const finalize = (response: Response) => {
+        const wrapped = withCors(response, request, config);
+        if (config.logRequests) {
+            logRequest({
+              logger,
+              request,
+              response: wrapped,
+              durationMs: Date.now() - startedAt,
+              authMode,
+              proxyService,
+              proxyBaseUrl,
+              error: errorMessage,
+            });
+        }
+        return wrapped;
+      };
+
+      if (request.method === "OPTIONS") {
+        return finalize(new Response(null, { status: 204 }));
+      }
+
+      const mount = parseWorkspaceMount(url.pathname);
+      if (mount && (mount.restPath === "/opencode" || mount.restPath.startsWith("/opencode/"))) {
+        authMode = "client";
+        try {
+          const actor = await requireClient(request, config, tokens);
+          assertOpencodeProxyAllowed(actor, request.method, mount.restPath);
+          const workspace = await resolveWorkspace(config, mount.workspaceId);
+          proxyService = "opencode";
+          proxyBaseUrl = workspace.baseUrl?.trim() || undefined;
+          const response = await proxyOpencodeRequest({ config, request, url, workspace, proxyPath: mount.restPath });
+          return finalize(response);
+        } catch (error) {
+          const apiError = error instanceof ApiError
+            ? error
+            : new ApiError(500, "internal_error", "Unexpected server error");
+          errorMessage = apiError.message;
+          return finalize(jsonResponse(formatError(apiError), apiError.status));
+        }
+      }
+
+      // Allow clients to use a mounted base URL (e.g. http://host:8787/w/<id>) while
+      // still calling the existing /workspace/:id/* API surface.
+      // Example: baseUrl + "/workspace/<id>/plugins" => "/w/<id>/workspace/<id>/plugins".
+      // We strip the mount prefix and route-match on the rest path.
+      //
+      // Important: when using a mounted base URL, enforce that the nested /workspace/:id
+      // matches the mount workspace id to preserve the "single-workspace" mental model.
+      if (mount && mount.restPath.startsWith("/workspace/")) {
+        const match = mount.restPath.match(/^\/workspace\/([^/]+)/);
+        const nestedId = match?.[1] ? decodeURIComponent(match[1]) : null;
+        if (nestedId && nestedId !== mount.workspaceId) {
+          errorMessage = "not_found";
+          return finalize(jsonResponse({ code: "not_found", message: "Not found" }, 404));
+        }
+        url.pathname = mount.restPath;
+      }
+
+      if (url.pathname === "/opencode" || url.pathname.startsWith("/opencode/")) {
+        authMode = "client";
+        proxyBaseUrl = config.workspaces[0]?.baseUrl?.trim() || undefined;
+        try {
+          const actor = await requireClient(request, config, tokens);
+          assertOpencodeProxyAllowed(actor, request.method, url.pathname);
+          proxyService = "opencode";
+          const response = await proxyOpencodeRequest({ config, request, url, workspace: config.workspaces[0] });
+          return finalize(response);
+        } catch (error) {
+          const apiError = error instanceof ApiError
+            ? error
+            : new ApiError(500, "internal_error", "Unexpected server error");
+          errorMessage = apiError.message;
+          return finalize(jsonResponse(formatError(apiError), apiError.status));
+        }
+      }
+
+      const route = matchRoute(routes, request.method, url.pathname);
+      if (!route) {
+        errorMessage = "not_found";
+        return finalize(jsonResponse({ code: "not_found", message: "Not found" }, 404));
+      }
+
+      authMode = route.auth;
+      try {
+        const actor =
+          route.auth === "host-token"
+            ? requireHostToken(request, config)
+            : route.auth === "host"
+              ? await requireHost(request, config, tokens)
+              : route.auth === "client"
+                ? await requireClient(request, config, tokens)
+                : undefined;
+        const response = await route.handler({
+          request,
+          url,
+          params: route.params,
+          config,
+          approvals,
+          reloadEvents,
+          tokens,
+          actor,
+        });
+        return finalize(response);
+      } catch (error) {
+        if (!(error instanceof ApiError)) {
+          console.error("[openwork-server] Unhandled error:", error);
+        }
+        const apiError = error instanceof ApiError
+          ? error
+          : new ApiError(500, "internal_error", "Unexpected server error");
+        errorMessage = apiError.message;
+        return finalize(jsonResponse(formatError(apiError), apiError.status));
+      }
+    },
+  };
+
+  (serverOptions as { idleTimeout?: number }).idleTimeout = 120;
+
+  const server = Bun.serve(serverOptions);
+
+  return server;
+}
+
+function matchRoute(routes: Route[], method: string, path: string) {
+  for (const route of routes) {
+    if (route.method !== method) continue;
+    const match = path.match(route.regex);
+    if (!match) continue;
+    const params: Record<string, string> = {};
+    route.keys.forEach((key, index) => {
+      params[key] = decodeURIComponent(match[index + 1]);
+    });
+    return { ...route, params };
+  }
+  return null;
+}
+
+function addRoute(routes: Route[], method: string, path: string, auth: AuthMode, handler: Route["handler"]) {
+  const keys: string[] = [];
+  const regex = pathToRegex(path, keys);
+  routes.push({ method, regex, keys, auth, handler });
+}
+
+function pathToRegex(path: string, keys: string[]): RegExp {
+  const pattern = path.replace(/:([A-Za-z0-9_]+)/g, (_, key) => {
+    keys.push(key);
+    return "([^/]+)";
+  });
+  return new RegExp(`^${pattern}$`);
+}
+
+function buildOpencodeProxyUrl(baseUrl: string, path: string, search: string) {
+  const target = new URL(baseUrl);
+  const trimmedPath = path.replace(/^\/opencode/, "");
+  target.pathname = trimmedPath.startsWith("/") ? trimmedPath : `/${trimmedPath}`;
+  target.search = search;
+  return target.toString();
+}
+
+type OpencodeQueryValue = string | number | boolean | null | undefined;
+
+async function fetchOpencodeJson(
+  config: ServerConfig,
+  workspace: WorkspaceInfo,
+  path: string,
+  init: { method: string; body?: unknown; query?: URLSearchParams | Record<string, OpencodeQueryValue> },
+) {
+  const connection = resolveWorkspaceOpencodeConnection(config, workspace);
+  const baseUrl = connection.baseUrl?.trim() ?? "";
+  if (!baseUrl) {
+    throw new ApiError(400, "opencode_unconfigured", "OpenCode base URL is missing for this workspace");
+  }
+
+  const url = new URL(baseUrl);
+  url.pathname = path.startsWith("/") ? path : `/${path}`;
+  const directory = resolveOpencodeDirectory(workspace);
+  if (init.query instanceof URLSearchParams) {
+    const params = new URLSearchParams(init.query);
+    if (directory && !params.has("directory")) {
+      params.set("directory", directory);
+    }
+    url.search = params.toString();
+  } else if (init.query) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(init.query)) {
+      if (value === undefined || value === null) continue;
+      params.set(key, String(value));
+    }
+    if (directory && !params.has("directory")) {
+      params.set("directory", directory);
+    }
+    url.search = params.toString();
+  } else {
+    url.search = directory ? new URLSearchParams({ directory }).toString() : "";
+  }
+
+  const headers = new Headers();
+  headers.set("Content-Type", "application/json");
+
+  if (directory) {
+    headers.set("x-opencode-directory", directory);
+  }
+
+  const auth = connection.authHeader ?? null;
+  if (auth) {
+    headers.set("Authorization", auth);
+  }
+
+  const response = await fetch(url.toString(), {
+    method: init.method,
+    headers,
+    body: init.body === undefined ? undefined : JSON.stringify(init.body),
+  });
+
+  const text = await response.text();
+  const json = parseJsonResponse(text);
+  if (!response.ok) {
+    throw new ApiError(502, "opencode_request_failed", "OpenCode request failed", {
+      status: response.status,
+      body: json ?? text,
+      path,
+    });
+  }
+  return json;
+}
+
+async function proxyOpencodeRequest(input: {
+  config: ServerConfig;
+  request: Request;
+  url: URL;
+  workspace?: WorkspaceInfo;
+  proxyPath?: string;
+}) {
+  const workspace = input.workspace;
+  const baseUrl = workspace ? resolveWorkspaceOpencodeConnection(input.config, workspace).baseUrl?.trim() ?? "" : "";
+  if (!baseUrl) {
+    throw new ApiError(400, "opencode_unconfigured", "OpenCode base URL is missing for this workspace");
+  }
+
+  const proxyPath = input.proxyPath ?? input.url.pathname;
+  const targetUrl = buildOpencodeProxyUrl(baseUrl, proxyPath, input.url.search);
+  const headers = new Headers(input.request.headers);
+  headers.delete("authorization");
+  headers.delete("x-openwork-host-token");
+  headers.delete("x-openwork-client-id");
+  headers.delete("host");
+  headers.delete("origin");
+
+  const directory = workspace ? resolveOpencodeDirectory(workspace) : null;
+  if (directory && !headers.has("x-opencode-directory")) {
+    headers.set("x-opencode-directory", directory);
+  }
+
+  const auth = workspace ? resolveWorkspaceOpencodeConnection(input.config, workspace).authHeader ?? null : null;
+  if (auth) {
+    headers.set("Authorization", auth);
+  }
+
+  const method = input.request.method.toUpperCase();
+  const body = method === "GET" || method === "HEAD" ? undefined : input.request.body;
+  if (isSessionCommandProxyRequest(method, proxyPath)) {
+    const bufferedBody = body ? await input.request.arrayBuffer() : undefined;
+    void fetch(targetUrl, {
+      method,
+      headers,
+      body: bufferedBody,
+    }).catch(() => {
+      // Command failures are surfaced through the OpenCode event stream.
+    });
+    return jsonResponse({ ok: true, accepted: true });
+  }
+  const response = await fetch(targetUrl, {
+    method,
+    headers,
+    body,
+  });
+
+  return sanitizeProxyResponse(response);
+}
+
+/**
+ * Strip hop-by-hop and transport-level headers that Bun's native fetch keeps
+ * in the upstream response even after it has already decoded the body for us.
+ * Without this the browser sees `content-encoding: gzip` on a plain-text
+ * payload and bails out with ERR_CONTENT_DECODING_FAILED, breaking any UI
+ * code that reaches through /opencode/* (including session.create).
+ */
+function sanitizeProxyResponse(response: Response): Response {
+  const headers = new Headers(response.headers);
+  headers.delete("content-encoding");
+  headers.delete("transfer-encoding");
+  headers.delete("content-length");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+function jsonResponse(data: unknown, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function withCors(response: Response, request: Request, config: ServerConfig) {
+  const origin = request.headers.get("origin");
+  const allowedOrigins = config.corsOrigins;
+  let allowOrigin: string | null = null;
+  if (allowedOrigins.includes("*")) {
+    allowOrigin = "*";
+  } else if (origin && allowedOrigins.includes(origin)) {
+    allowOrigin = origin;
+  }
+
+  if (!allowOrigin) return response;
+  const headers = new Headers(response.headers);
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set(
+    "Access-Control-Allow-Headers",
+    "Authorization, Content-Type, X-OpenWork-Host-Token, X-OpenWork-Client-Id, X-OpenCode-Directory, X-Opencode-Directory, x-opencode-directory",
+  );
+  headers.set("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+  headers.set("Vary", "Origin");
+  return new Response(response.body, { status: response.status, headers });
+}
+
+async function requireClient(request: Request, config: ServerConfig, tokens: TokenService): Promise<Actor> {
+  const header = request.headers.get("authorization") ?? "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  const token = match?.[1];
+  if (!token) {
+    throw new ApiError(401, "unauthorized", "Invalid bearer token");
+  }
+  const scope = await tokens.scopeForToken(token);
+  if (!scope) {
+    throw new ApiError(401, "unauthorized", "Invalid bearer token");
+  }
+  const clientId = request.headers.get("x-openwork-client-id") ?? undefined;
+  return { type: "remote", clientId, tokenHash: hashToken(token), scope };
+}
+
+function requireHostToken(request: Request, config: ServerConfig): Actor {
+  const hostToken = request.headers.get("x-openwork-host-token");
+  if (hostToken && hostToken === config.hostToken) {
+    return { type: "host", tokenHash: hashToken(hostToken), scope: "owner" };
+  }
+  throw new ApiError(401, "unauthorized", "Invalid host token");
+}
+
+async function requireHost(request: Request, config: ServerConfig, tokens: TokenService): Promise<Actor> {
+  const hostToken = request.headers.get("x-openwork-host-token");
+  if (hostToken && hostToken === config.hostToken) {
+    return { type: "host", tokenHash: hashToken(hostToken), scope: "owner" };
+  }
+
+  const header = request.headers.get("authorization") ?? "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  const bearer = match?.[1];
+  if (!bearer) {
+    throw new ApiError(401, "unauthorized", "Invalid host token");
+  }
+  const scope = await tokens.scopeForToken(bearer);
+  if (scope !== "owner") {
+    throw new ApiError(401, "unauthorized", "Invalid host token");
+  }
+  const clientId = request.headers.get("x-openwork-client-id") ?? undefined;
+  return { type: "remote", clientId, tokenHash: hashToken(bearer), scope };
+}
+
+function buildCapabilities(config: ServerConfig): Capabilities {
+  const writeEnabled = !config.readOnly;
+  const schemaVersion = 1;
+  const sandboxBackend = resolveSandboxBackend();
+  const sandboxEnabled = resolveSandboxEnabled(sandboxBackend);
+  const inboxEnabled = resolveInboxEnabled();
+  const outboxEnabled = resolveOutboxEnabled();
+  const maxBytes = resolveInboxMaxBytes();
+  const toyUiEnabled = resolveToyUiEnabled();
+  const browserProvider = resolveBrowserProvider();
+  const opencodeConfigured = config.workspaces.some((workspace) => Boolean(workspace.baseUrl?.trim()));
+  return {
+    schemaVersion,
+    serverVersion: SERVER_VERSION,
+    skills: { read: true, write: writeEnabled, source: "openwork" },
+    hub: {
+      skills: {
+        read: true,
+        install: writeEnabled,
+        repo: { owner: "different-ai", name: "openwork-hub", ref: "main" },
+      },
+    },
+    plugins: { read: true, write: writeEnabled },
+    mcp: { read: true, write: writeEnabled },
+    commands: { read: true, write: writeEnabled },
+    config: { read: true, write: writeEnabled },
+
+    approvals: { mode: config.approval.mode, timeoutMs: config.approval.timeoutMs },
+    sandbox: { enabled: sandboxEnabled, backend: sandboxBackend },
+    ui: { toy: toyUiEnabled },
+    tokens: { scoped: true, scopes: ["owner", "collaborator", "viewer"] },
+    proxy: {
+      opencode: opencodeConfigured,
+    },
+    toolProviders: {
+      browser: browserProvider,
+      files: {
+        injection: writeEnabled && inboxEnabled,
+        outbox: outboxEnabled,
+        inboxPath: ".opencode/openwork/inbox/",
+        outboxPath: ".opencode/openwork/outbox/",
+        maxBytes,
+      },
+    },
+  };
+}
+
+function resolveSandboxBackend(): Capabilities["sandbox"]["backend"] {
+  const raw = (process.env.OPENWORK_SANDBOX_BACKEND ?? "").trim().toLowerCase();
+  if (raw === "docker") return "docker";
+  if (raw === "container") return "container";
+  return "none";
+}
+
+function resolveSandboxEnabled(backend: Capabilities["sandbox"]["backend"]): boolean {
+  const raw = (process.env.OPENWORK_SANDBOX_ENABLED ?? "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(raw)) return true;
+  if (["0", "false", "no", "off"].includes(raw)) return false;
+  return backend !== "none";
+}
+
+function resolveInboxEnabled(): boolean {
+  const raw = (process.env.OPENWORK_INBOX_ENABLED ?? "").trim().toLowerCase();
+  if (!raw) return true;
+  return ["1", "true", "yes", "on"].includes(raw);
+}
+
+function resolveOutboxEnabled(): boolean {
+  const raw = (process.env.OPENWORK_OUTBOX_ENABLED ?? "").trim().toLowerCase();
+  if (!raw) return true;
+  return ["1", "true", "yes", "on"].includes(raw);
+}
+
+function resolveInboxMaxBytes(): number {
+  const raw = (process.env.OPENWORK_INBOX_MAX_BYTES ?? "").trim();
+  const parsed = raw ? Number(raw) : NaN;
+  if (Number.isFinite(parsed) && parsed > 0) {
+    return Math.min(Math.trunc(parsed), 250_000_000);
+  }
+  return 50_000_000;
+}
+
+function resolveToyUiEnabled(): boolean {
+  const raw = (process.env.OPENWORK_TOY_UI ?? "").trim().toLowerCase();
+  if (!raw) return true;
+  return ["1", "true", "yes", "on"].includes(raw);
+}
+
+// Dev-only log sink target. When OPENWORK_DEV_LOG_FILE is set to a path, the
+// /dev/log endpoint accepts JSON payloads and appends them to that file so an
+// operator can `tail -f` the file to see live browser activity. Returning null
+// disables the endpoint entirely.
+function resolveDevLogPath(): string | null {
+  const raw = (process.env.OPENWORK_DEV_LOG_FILE ?? "").trim();
+  return raw.length > 0 ? raw : null;
+}
+
+function resolveBrowserProvider(): Capabilities["toolProviders"]["browser"] {
+  const raw = (process.env.OPENWORK_BROWSER_PROVIDER ?? "").trim().toLowerCase();
+  if (raw === "sandbox-headless") {
+    return { enabled: true, placement: "in-sandbox", mode: "headless" };
+  }
+  if (raw === "host-interactive") {
+    return { enabled: true, placement: "host-machine", mode: "interactive" };
+  }
+  if (raw === "client-interactive") {
+    return { enabled: true, placement: "client-machine", mode: "interactive" };
+  }
+  return { enabled: false, placement: "external", mode: "none" };
+}
+
+function resolveInboxDir(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "openwork", "inbox");
+}
+
+function resolveOutboxDir(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "openwork", "outbox");
+}
+
+export function normalizeWorkspaceRelativePath(input: string, options: { allowSubdirs: boolean }): string {
+  const raw = String(input ?? "").trim();
+  if (!raw) {
+    throw new ApiError(400, "invalid_path", "Path is required");
+  }
+  if (raw.includes("\u0000")) {
+    throw new ApiError(400, "invalid_path", "Path contains null byte");
+  }
+
+  // A lot of user-facing surfaces (artifacts, tool logs) reference files as
+  // `workspace/<path>` or `/workspace/<path>`. The server API expects
+  // workspace-relative paths, so normalize those common prefixes here.
+  let normalized = raw.replace(/\\/g, "/");
+  normalized = normalized.replace(/^\/+/, "");
+  normalized = normalized.replace(/^\.\//, "");
+  normalized = normalized.replace(/^workspace\//, "");
+  normalized = normalized.replace(/^\/+/, "");
+
+  const parts = normalized.split("/").filter(Boolean);
+  if (!parts.length) {
+    throw new ApiError(400, "invalid_path", "Path is required");
+  }
+  if (!options.allowSubdirs && parts.length > 1) {
+    throw new ApiError(400, "invalid_path", "Subdirectories are not allowed");
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new ApiError(400, "invalid_path", "Path traversal is not allowed");
+    }
+  }
+  return parts.join("/");
+}
+
+export function isSupportedWorkspaceTextFilePath(relativePath: string): boolean {
+  const lowered = relativePath.toLowerCase();
+  return [".md", ".mdx", ".markdown", ".json", ".jsonc", ".ts", ".js", ".mjs", ".cjs", ".txt"].some((ext) =>
+    lowered.endsWith(ext),
+  );
+}
+
+function resolveSafeChildPath(root: string, child: string): string {
+  const rootResolved = resolve(root);
+  const candidate = resolve(rootResolved, child);
+  if (candidate === rootResolved) {
+    throw new ApiError(400, "invalid_path", "Path must point to a file");
+  }
+  if (!candidate.startsWith(rootResolved + sep)) {
+    throw new ApiError(400, "invalid_path", "Path traversal is not allowed");
+  }
+  return candidate;
+}
+
+function encodeArtifactId(path: string): string {
+  return Buffer.from(path, "utf8").toString("base64url");
+}
+
+function decodeArtifactId(id: string): string {
+  const raw = (id ?? "").trim();
+  if (!raw) {
+    throw new ApiError(400, "invalid_artifact", "Artifact id is required");
+  }
+  try {
+    const decoded = Buffer.from(raw, "base64url").toString("utf8");
+    return normalizeWorkspaceRelativePath(decoded, { allowSubdirs: true });
+  } catch {
+    throw new ApiError(400, "invalid_artifact", "Artifact id is invalid");
+  }
+}
+
+function encodeInboxId(path: string): string {
+  return encodeArtifactId(path);
+}
+
+function decodeInboxId(id: string): string {
+  try {
+    return decodeArtifactId(id);
+  } catch {
+    throw new ApiError(400, "invalid_inbox_item", "Inbox item id is invalid");
+  }
+}
+
+async function listArtifacts(outboxRoot: string): Promise<Array<{ id: string; path: string; size: number; updatedAt: number }>> {
+  const rootResolved = resolve(outboxRoot);
+  if (!(await exists(rootResolved))) return [];
+
+  const items: Array<{ id: string; path: string; size: number; updatedAt: number }> = [];
+  const walk = async (dir: string) => {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const rel = normalizeWorkspaceRelativePath(relative(rootResolved, abs), { allowSubdirs: true });
+      const info = await stat(abs);
+      items.push({
+        id: encodeArtifactId(rel),
+        path: rel,
+        size: info.size,
+        updatedAt: info.mtimeMs,
+      });
+    }
+  };
+
+  try {
+    await walk(rootResolved);
+  } catch {
+    return [];
+  }
+
+  items.sort((a, b) => b.updatedAt - a.updatedAt);
+  return items;
+}
+
+async function listInbox(inboxRoot: string): Promise<Array<{ id: string; path: string; size: number; updatedAt: number; name: string }>> {
+  const items = await listArtifacts(inboxRoot);
+  return items.map((item) => ({
+    ...item,
+    id: encodeInboxId(item.path),
+    name: basename(item.path),
+  }));
+}
+
+type FileSessionCatalogEntry = {
+  path: string;
+  kind: "file" | "dir";
+  size: number;
+  mtimeMs: number;
+  revision: string;
+};
+
+function fileRevision(info: { mtimeMs: number; size: number }): string {
+  return `${Math.floor(info.mtimeMs)}:${info.size}`;
+}
+
+function parseFileSessionTtlMs(input: unknown): number {
+  const raw = typeof input === "number" && Number.isFinite(input) ? input : Number.NaN;
+  if (Number.isNaN(raw)) return FILE_SESSION_DEFAULT_TTL_MS;
+  const ttlMs = Math.floor(raw * 1000);
+  if (ttlMs < FILE_SESSION_MIN_TTL_MS) return FILE_SESSION_MIN_TTL_MS;
+  if (ttlMs > FILE_SESSION_MAX_TTL_MS) return FILE_SESSION_MAX_TTL_MS;
+  return ttlMs;
+}
+
+function parseCatalogLimit(input: string | null): number {
+  if (!input) return FILE_SESSION_CATALOG_DEFAULT_LIMIT;
+  const parsed = Number(input);
+  if (!Number.isFinite(parsed) || parsed <= 0) return FILE_SESSION_CATALOG_DEFAULT_LIMIT;
+  return Math.min(Math.floor(parsed), FILE_SESSION_CATALOG_MAX_LIMIT);
+}
+
+function parseSessionCursor(input: string | null): number {
+  if (!input) return 0;
+  const parsed = Number(input);
+  if (!Number.isFinite(parsed) || parsed < 0) return 0;
+  return Math.floor(parsed);
+}
+
+function parseCatalogPathFilter(input: string | null): string | null {
+  if (!input) return null;
+  const trimmed = input.trim();
+  if (!trimmed) return null;
+  return normalizeWorkspaceRelativePath(trimmed, { allowSubdirs: true });
+}
+
+function matchesCatalogFilter(path: string, filter: string | null): boolean {
+  if (!filter) return true;
+  return path === filter || path.startsWith(`${filter}/`);
+}
+
+function normalizeResolvedRelativePath(input: string): string {
+  const normalized = input.replace(/\\/g, "/");
+  const parts = normalized.split("/").filter(Boolean);
+  if (!parts.length) {
+    throw new ApiError(400, "invalid_path", "Path is required");
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new ApiError(400, "invalid_path", "Path traversal is not allowed");
+    }
+  }
+  return parts.join("/");
+}
+
+async function listWorkspaceCatalogEntries(workspaceRoot: string): Promise<FileSessionCatalogEntry[]> {
+  const rootResolved = resolve(workspaceRoot);
+  const items: FileSessionCatalogEntry[] = [];
+
+  const walk = async (dirPath: string) => {
+    const entries = await readdir(dirPath, { withFileTypes: true });
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+
+    for (const entry of entries) {
+      const absPath = join(dirPath, entry.name);
+      const relRaw = relative(rootResolved, absPath).replace(/\\/g, "/");
+      const rel = normalizeResolvedRelativePath(relRaw);
+
+      if (entry.isDirectory()) {
+        const info = await stat(absPath);
+        items.push({
+          path: rel,
+          kind: "dir",
+          size: 0,
+          mtimeMs: info.mtimeMs,
+          revision: fileRevision({ mtimeMs: info.mtimeMs, size: 0 }),
+        });
+        await walk(absPath);
+        continue;
+      }
+
+      if (!entry.isFile()) continue;
+      const info = await stat(absPath);
+      items.push({
+        path: rel,
+        kind: "file",
+        size: info.size,
+        mtimeMs: info.mtimeMs,
+        revision: fileRevision(info),
+      });
+    }
+  };
+
+  if (await exists(rootResolved)) {
+    await walk(rootResolved);
+  }
+
+  items.sort((a, b) => a.path.localeCompare(b.path));
+  return items;
+}
+
+function parseBatchPathList(input: unknown): string[] {
+  if (!Array.isArray(input)) {
+    throw new ApiError(400, "invalid_payload", "paths must be an array");
+  }
+  if (!input.length) {
+    throw new ApiError(400, "invalid_payload", "paths must not be empty");
+  }
+  if (input.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+    throw new ApiError(400, "invalid_payload", `paths must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items`);
+  }
+  return input.map((raw) => normalizeWorkspaceRelativePath(String(raw ?? ""), { allowSubdirs: true }));
+}
+
+function parseBatchWriteList(input: unknown): Array<{ path: string; contentBase64: string; ifMatchRevision?: string; force?: boolean }> {
+  if (!Array.isArray(input)) {
+    throw new ApiError(400, "invalid_payload", "writes must be an array");
+  }
+  if (!input.length) {
+    throw new ApiError(400, "invalid_payload", "writes must not be empty");
+  }
+  if (input.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+    throw new ApiError(400, "invalid_payload", `writes must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items`);
+  }
+
+  return input.map((raw) => {
+    if (!raw || typeof raw !== "object") {
+      throw new ApiError(400, "invalid_payload", "write entries must be objects");
+    }
+    const record = raw as Record<string, unknown>;
+    const contentBase64 = typeof record.contentBase64 === "string" ? record.contentBase64.trim() : "";
+    if (!contentBase64) {
+      throw new ApiError(400, "invalid_payload", "contentBase64 is required");
+    }
+    const ifMatchRevision =
+      typeof record.ifMatchRevision === "string" && record.ifMatchRevision.trim().length
+        ? record.ifMatchRevision.trim()
+        : undefined;
+    return {
+      path: normalizeWorkspaceRelativePath(String(record.path ?? ""), { allowSubdirs: true }),
+      contentBase64,
+      ...(ifMatchRevision ? { ifMatchRevision } : {}),
+      ...(record.force === true ? { force: true } : {}),
+    };
+  });
+}
+
+function emitReloadEvent(
+  reloadEvents: ReloadEventStore,
+  workspace: WorkspaceInfo,
+  reason: ReloadReason,
+  trigger?: ReloadTrigger,
+) {
+  reloadEvents.recordDebounced(workspace.id, reason, trigger);
+}
+
+function buildConfigTrigger(path: string): ReloadTrigger {
+  const name = path.split(/[\\/]/).filter(Boolean).pop();
+  return {
+    type: "config",
+    name: name || "opencode.json",
+    action: "updated",
+    path,
+  };
+}
+
+function serializeWorkspace(workspace: ServerConfig["workspaces"][number]) {
+  const { opencodeUsername, opencodePassword, ...rest } = workspace;
+  const opencodeDirectory = resolveOpencodeDirectory(workspace);
+  const opencode =
+    workspace.baseUrl || opencodeDirectory || opencodeUsername || opencodePassword
+      ? {
+          baseUrl: workspace.baseUrl,
+          directory: opencodeDirectory ?? undefined,
+          username: opencodeUsername,
+          password: opencodePassword,
+        }
+      : undefined;
+  return {
+    ...rest,
+    opencode,
+  };
+}
+
+function createRoutes(
+  config: ServerConfig,
+  approvals: ApprovalService,
+  tokens: TokenService,
+  env: EnvService,
+  onWorkspacesChanged: () => void,
+): Route[] {
+  const routes: Route[] = [];
+  const fileSessions = new FileSessionStore();
+
+  const serializeFileSession = (session: {
+    id: string;
+    workspaceId: string;
+    createdAt: number;
+    expiresAt: number;
+    canWrite: boolean;
+  }) => ({
+    id: session.id,
+    workspaceId: session.workspaceId,
+    createdAt: session.createdAt,
+    expiresAt: session.expiresAt,
+    ttlMs: Math.max(0, session.expiresAt - Date.now()),
+    canWrite: session.canWrite,
+  });
+
+  const resolveFileSession = (ctx: RequestContext, sessionId: string) => {
+    const session = fileSessions.get(sessionId);
+    if (!session) {
+      throw new ApiError(404, "file_session_not_found", "File session not found");
+    }
+
+    if (!ctx.actor?.tokenHash || session.actorTokenHash !== ctx.actor.tokenHash) {
+      throw new ApiError(403, "forbidden", "File session does not belong to this token");
+    }
+
+    const workspace = config.workspaces.find((item) => item.id === session.workspaceId);
+    if (!workspace) {
+      throw new ApiError(404, "workspace_not_found", "Workspace not found for this file session");
+    }
+
+    return { session, workspace };
+  };
+
+  const recordWorkspaceFileEvent = (workspaceId: string, input: { type: "write" | "delete" | "rename" | "mkdir"; path: string; toPath?: string; revision?: string }) => {
+    return fileSessions.recordWorkspaceEvent({ workspaceId, ...input });
+  };
+
+  addRoute(routes, "GET", "/health", "none", async () => {
+    return jsonResponse({ ok: true, version: SERVER_VERSION, uptimeMs: Date.now() - config.startedAt });
+  });
+
+  addRoute(routes, "GET", "/w/:id/health", "none", async () => {
+    return jsonResponse({ ok: true, version: SERVER_VERSION, uptimeMs: Date.now() - config.startedAt });
+  });
+
+  // Dev log sink: append browser console + error events to a file that an
+  // operator (or an AI driver) can tail. Unauth on purpose because this is
+  // scoped to the dev host and needs to work before clients finish wiring
+  // tokens; it is also a no-op when OPENWORK_DEV_LOG_FILE is unset.
+  addRoute(routes, "POST", "/dev/log", "none", async (ctx) => {
+    const target = resolveDevLogPath();
+    if (!target) {
+      return jsonResponse({ ok: false, reason: "dev_log_disabled" }, 404);
+    }
+    let payload: unknown = null;
+    try {
+      payload = await ctx.request.json();
+    } catch {
+      return jsonResponse({ ok: false, reason: "invalid_json" }, 400);
+    }
+    const entries = Array.isArray(payload) ? payload : [payload];
+    try {
+      await mkdir(dirname(target), { recursive: true });
+      const lines = entries
+        .map((entry) => {
+          try {
+            const stamped = { at: new Date().toISOString(), ...(entry as Record<string, unknown>) };
+            return JSON.stringify(stamped);
+          } catch {
+            return JSON.stringify({ at: new Date().toISOString(), raw: String(entry) });
+          }
+        })
+        .join("\n");
+      await appendFile(target, `${lines}\n`, "utf8");
+    } catch (error) {
+      return jsonResponse({ ok: false, reason: error instanceof Error ? error.message : String(error) }, 500);
+    }
+    return jsonResponse({ ok: true, count: entries.length });
+  });
+
+  addRoute(routes, "GET", "/dev/log", "none", async () => {
+    // Probe response: always 200 so the client's capability probe doesn't
+    // log a noisy "Failed to load resource: 404" in the browser console
+    // when the sink is simply disabled. Clients should key on `ok` + `reason`
+    // in the body, not on HTTP status.
+    const target = resolveDevLogPath();
+    if (!target) {
+      return jsonResponse({ ok: false, reason: "dev_log_disabled" });
+    }
+    return jsonResponse({ ok: true, path: target });
+  });
+
+  addRoute(routes, "GET", "/ui", "none", async () => {
+    if (!resolveToyUiEnabled()) {
+      throw new ApiError(404, "ui_disabled", "Toy UI is disabled");
+    }
+    return htmlResponse(TOY_UI_HTML);
+  });
+
+  addRoute(routes, "GET", "/w/:id/ui", "none", async () => {
+    if (!resolveToyUiEnabled()) {
+      throw new ApiError(404, "ui_disabled", "Toy UI is disabled");
+    }
+    return htmlResponse(TOY_UI_HTML);
+  });
+
+  addRoute(routes, "GET", "/ui/assets/toy.css", "none", async () => {
+    if (!resolveToyUiEnabled()) {
+      throw new ApiError(404, "ui_disabled", "Toy UI is disabled");
+    }
+    return cssResponse(TOY_UI_CSS);
+  });
+
+  addRoute(routes, "GET", "/ui/assets/toy.js", "none", async () => {
+    if (!resolveToyUiEnabled()) {
+      throw new ApiError(404, "ui_disabled", "Toy UI is disabled");
+    }
+    return jsResponse(TOY_UI_JS);
+  });
+
+  addRoute(routes, "GET", "/ui/assets/openwork-mark.svg", "none", async () => {
+    if (!resolveToyUiEnabled()) {
+      throw new ApiError(404, "ui_disabled", "Toy UI is disabled");
+    }
+    return svgResponse(TOY_UI_FAVICON_SVG);
+  });
+
+  addRoute(routes, "GET", "/w/:id/status", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    return jsonResponse({
+      ok: true,
+      version: SERVER_VERSION,
+      uptimeMs: Date.now() - config.startedAt,
+      readOnly: config.readOnly,
+      approval: config.approval,
+      corsOrigins: config.corsOrigins,
+      workspaceCount: 1,
+      activeWorkspaceId: workspace.id,
+      workspace: serializeWorkspace(workspace),
+      authorizedRoots: config.authorizedRoots,
+      server: {
+        host: config.host,
+        port: config.port,
+        configPath: config.configPath ?? null,
+      },
+      tokenSource: {
+        client: config.tokenSource,
+        host: config.hostTokenSource,
+      },
+    });
+  });
+
+  addRoute(routes, "GET", "/w/:id/capabilities", "client", async () => {
+    return jsonResponse(buildCapabilities(config));
+  });
+
+  addRoute(routes, "GET", "/w/:id/workspaces", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    return jsonResponse({ items: [serializeWorkspace(workspace)], activeId: workspace.id });
+  });
+
+  addRoute(routes, "GET", "/status", "client", async () => {
+    const active = config.workspaces[0];
+    return jsonResponse({
+      ok: true,
+      version: SERVER_VERSION,
+      uptimeMs: Date.now() - config.startedAt,
+      readOnly: config.readOnly,
+      approval: config.approval,
+      corsOrigins: config.corsOrigins,
+      workspaceCount: config.workspaces.length,
+      activeWorkspaceId: active?.id ?? null,
+      workspace: active ? serializeWorkspace(active) : null,
+      authorizedRoots: config.authorizedRoots,
+      server: {
+        host: config.host,
+        port: config.port,
+        configPath: config.configPath ?? null,
+      },
+      tokenSource: {
+        client: config.tokenSource,
+        host: config.hostTokenSource,
+      },
+    });
+  });
+
+  addRoute(routes, "GET", "/runtime/versions", "client", async () => {
+    const snapshot = await fetchRuntimeControl("/runtime/versions");
+    return jsonResponse(snapshot);
+  });
+
+  addRoute(routes, "POST", "/runtime/upgrade", "host", async (ctx) => {
+    const body = await readJsonBody(ctx.request);
+    const result = await fetchRuntimeControl("/runtime/upgrade", { method: "POST", body });
+    return jsonResponse(result, 202);
+  });
+
+  addRoute(routes, "GET", "/w/:id/runtime/versions", "client", async () => {
+    const snapshot = await fetchRuntimeControl("/runtime/versions");
+    return jsonResponse(snapshot);
+  });
+
+  addRoute(routes, "POST", "/w/:id/runtime/upgrade", "host", async (ctx) => {
+    const body = await readJsonBody(ctx.request);
+    const result = await fetchRuntimeControl("/runtime/upgrade", { method: "POST", body });
+    return jsonResponse(result, 202);
+  });
+
+  addRoute(routes, "GET", "/whoami", "client", async (ctx) => {
+    return jsonResponse({ ok: true, actor: ctx.actor ?? null });
+  });
+
+  addRoute(routes, "GET", "/capabilities", "client", async () => {
+    return jsonResponse(buildCapabilities(config));
+  });
+
+  addRoute(routes, "GET", "/workspaces", "client", async () => {
+    const active = config.workspaces[0] ?? null;
+    const items = config.workspaces.map(serializeWorkspace);
+    return jsonResponse({ items, workspaces: items, activeId: active?.id ?? null });
+  });
+
+  addRoute(routes, "GET", "/tokens", "host", async () => {
+    const items = await tokens.list();
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "POST", "/tokens", "host", async (ctx) => {
+    ensureWritable(config);
+    const body = await readJsonBody(ctx.request);
+    const scopeRaw = typeof body.scope === "string" ? body.scope.trim() : "";
+    const scope = scopeRaw === "owner" || scopeRaw === "collaborator" || scopeRaw === "viewer" ? scopeRaw : null;
+    if (!scope) {
+      throw new ApiError(400, "invalid_scope", "Token scope must be owner, collaborator, or viewer");
+    }
+    const label = typeof body.label === "string" ? body.label.trim() : undefined;
+    const issued = await tokens.create(scope, { label });
+    return jsonResponse(issued, 201);
+  });
+
+  addRoute(routes, "DELETE", "/tokens/:id", "host", async (ctx) => {
+    ensureWritable(config);
+    const ok = await tokens.revoke(ctx.params.id);
+    if (!ok) {
+      throw new ApiError(404, "token_not_found", "Token not found");
+    }
+    return jsonResponse({ ok: true });
+  });
+
+  function rethrowEnvStoreReadError(error: unknown): never {
+    if (error instanceof EnvStoreReadError) {
+      throw new ApiError(
+        409,
+        error.code,
+        "Environment variable store is invalid. Fix or remove the local env file before editing.",
+      );
+    }
+    throw error;
+  }
+
+  // User-level env vars (see apps/app/pr/environment-variables.md). All routes
+  // require the desktop host token (not owner bearer tokens) because values are
+  // returned raw; the React pane masks them only for display. Reload semantics
+  // are driven from the UI after a write; this surface is user-scoped, not
+  // workspace-scoped, so no audit.
+  addRoute(routes, "GET", "/env", "host-token", async () => {
+    const items = await env.list().catch(rethrowEnvStoreReadError);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/env/keys", "host-token", async () => {
+    const items = await env.list().catch(rethrowEnvStoreReadError);
+    return jsonResponse({ keys: items.map((item) => item.key) });
+  });
+
+  addRoute(routes, "PUT", "/env", "host-token", async (ctx) => {
+    ensureWritable(config);
+    const body = await readJsonBody(ctx.request);
+    const rawEntries = Array.isArray(body.entries)
+      ? body.entries
+      : [{ key: body.key, value: body.value }];
+    const entries: Array<{ key: string; value: string }> = [];
+    for (const raw of rawEntries) {
+      if (!raw || typeof raw !== "object") {
+        throw new ApiError(400, "invalid_entry", "Each entry must be an object");
+      }
+      const candidate = raw as { key?: unknown; value?: unknown };
+      const key = typeof candidate.key === "string" ? candidate.key.trim() : "";
+      const value = typeof candidate.value === "string" ? candidate.value : "";
+      if (!isValidEnvKey(key)) {
+        throw new ApiError(400, "invalid_env_key", "Invalid environment variable name");
+      }
+      entries.push({ key, value });
+    }
+    if (entries.length === 0) {
+      throw new ApiError(400, "no_entries", "No entries provided");
+    }
+    try {
+      await env.upsertMany(entries);
+    } catch (error) {
+      if (error instanceof EnvStoreReadError) {
+        rethrowEnvStoreReadError(error);
+      }
+      if (error instanceof InvalidEnvKeyError) {
+        throw new ApiError(
+          400,
+          error.code,
+          error.code === "reserved_env_key"
+            ? "Environment variable name is reserved for OpenWork internals"
+            : "Invalid environment variable name",
+        );
+      }
+      throw error;
+    }
+    return jsonResponse({ ok: true, count: entries.length });
+  });
+
+  addRoute(routes, "DELETE", "/env/:key", "host-token", async (ctx) => {
+    ensureWritable(config);
+    const key = ctx.params.key;
+    if (!isValidEnvKey(key)) {
+      throw new ApiError(400, "invalid_env_key", "Invalid environment variable name");
+    }
+    const removed = await env.delete(key).catch(rethrowEnvStoreReadError);
+    if (!removed) {
+      throw new ApiError(404, "env_not_found", "Environment variable not found");
+    }
+    return jsonResponse({ ok: true });
+  });
+
+  addRoute(routes, "POST", "/workspaces/local", "host", async (ctx) => {
+    ensureWritable(config);
+    const body = await readJsonBody(ctx.request);
+    const folderPath = typeof body.folderPath === "string" ? body.folderPath.trim() : "";
+    const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : basename(folderPath || "Workspace");
+    const preset = typeof body.preset === "string" && body.preset.trim() ? body.preset.trim() : "starter";
+
+    if (!folderPath) {
+      throw new ApiError(400, "invalid_payload", "folderPath is required");
+    }
+
+    const workspacePath = resolve(folderPath);
+    await ensureDir(workspacePath);
+    await ensureWorkspaceFiles(workspacePath, preset);
+
+    const workspace: WorkspaceInfo = {
+      id: workspaceIdForPath(workspacePath),
+      name,
+      path: workspacePath,
+      preset,
+      workspaceType: "local",
+      ...inheritWorkspaceOpencodeConnection(config),
+    };
+
+    config.workspaces = [workspace, ...config.workspaces.filter((entry) => entry.id !== workspace.id)];
+    if (!config.authorizedRoots.some((root) => resolve(root) === workspacePath)) {
+      config.authorizedRoots = [...config.authorizedRoots, workspacePath];
+    }
+    const persisted = await persistServerWorkspaceState(config);
+    onWorkspacesChanged();
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "host" },
+      action: "workspace.create",
+      target: workspace.path,
+      summary: `Created workspace ${name}`,
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({
+      activeId: workspace.id,
+      workspaces: config.workspaces.map(serializeWorkspace),
+      persisted,
+    }, 201);
+  });
+
+  addRoute(routes, "PATCH", "/workspaces/:id/display-name", "host", async (ctx) => {
+    ensureWritable(config);
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const nextDisplayName = typeof body.displayName === "string" && body.displayName.trim()
+      ? body.displayName.trim()
+      : undefined;
+
+    config.workspaces = config.workspaces.map((entry) =>
+      entry.id === workspace.id
+        ? {
+            ...entry,
+            displayName: nextDisplayName,
+            name: nextDisplayName ?? entry.name,
+          }
+        : entry,
+    );
+
+    const persisted = await persistServerWorkspaceState(config);
+    onWorkspacesChanged();
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "host" },
+      action: "workspace.rename",
+      target: workspace.path,
+      summary: `Updated workspace display name${nextDisplayName ? ` to ${nextDisplayName}` : ""}`,
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({
+      activeId: config.workspaces[0]?.id ?? null,
+      workspaces: config.workspaces.map(serializeWorkspace),
+      persisted,
+    });
+  });
+
+  addRoute(routes, "POST", "/workspaces/:id/activate", "host", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    config.workspaces = [
+      workspace,
+      ...config.workspaces.filter((entry) => entry.id !== workspace.id),
+    ];
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "host" },
+      action: "workspace.activate",
+      target: "workspace",
+      summary: "Switched active workspace",
+      timestamp: Date.now(),
+    });
+    const connection = resolveWorkspaceOpencodeConnection(config, workspace);
+    if (connection.baseUrl?.trim()) {
+      await reloadOpencodeEngine(config, workspace);
+    }
+    return jsonResponse({ activeId: workspace.id, workspace: serializeWorkspace(workspace), persisted: false });
+  });
+
+  addRoute(routes, "DELETE", "/workspaces/:id", "host", async (ctx) => {
+    ensureWritable(config);
+
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+
+    const before = config.workspaces.length;
+    config.workspaces = config.workspaces.filter((entry) => entry.id !== workspace.id);
+    const deleted = before !== config.workspaces.length;
+
+    if (deleted) {
+      // Only remove exact matches; authorizedRoots can contain broader entries.
+      config.authorizedRoots = config.authorizedRoots.filter((root) => resolve(root) !== resolve(workspace.path));
+    }
+    const persisted = await persistServerWorkspaceState(config);
+    onWorkspacesChanged();
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "host" },
+      action: "workspace.delete",
+      target: "workspace",
+      summary: "Deleted workspace from OpenWork server",
+      timestamp: Date.now(),
+    });
+
+    const active = config.workspaces[0] ?? null;
+    return jsonResponse({
+      ok: true,
+      deleted,
+      persisted,
+      activeId: active?.id ?? null,
+      items: config.workspaces.map(serializeWorkspace),
+      workspaces: config.workspaces.map(serializeWorkspace),
+    });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/config", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const opencode = await readOpencodeConfig(workspace.path);
+    const openwork = await readOpenworkConfig(workspace.path);
+    const lastAudit = await readLastAudit(workspace.path, workspace.id);
+    return jsonResponse({ opencode, openwork, updatedAt: lastAudit?.timestamp ?? null });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/opencode-config", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const scope = normalizeOpencodeScope(ctx.url.searchParams.get("scope"));
+    const configPath = resolveOpencodeConfigFilePath(scope, workspace.path);
+    const result = await readRawOpencodeConfig(configPath);
+    return jsonResponse({ path: configPath, exists: result.exists, content: result.content });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/opencode-config", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const scope = normalizeOpencodeScope(typeof body.scope === "string" ? body.scope : null);
+    const content = typeof body.content === "string" ? body.content : null;
+    if (content === null) {
+      throw new ApiError(400, "invalid_payload", "content must be a string");
+    }
+
+    const configPath = resolveOpencodeConfigFilePath(scope, workspace.path);
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: scope === "global" ? "config.global.write" : "config.write",
+      summary: `Write ${scope} OpenCode config`,
+      paths: [configPath],
+    });
+
+    await ensureDir(dirname(configPath));
+    await writeFile(configPath, content.endsWith("\n") ? content : `${content}\n`, "utf8");
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: scope === "global" ? "config.global.write" : "config.write",
+      target: configPath,
+      summary: `Updated ${scope} OpenCode config`,
+      timestamp: Date.now(),
+    });
+
+    if (scope === "project") {
+      emitReloadEvent(ctx.reloadEvents, workspace, "config", buildConfigTrigger(configPath));
+    }
+
+    return jsonResponse({
+      ok: true,
+      status: 0,
+      stdout: `Wrote ${configPath}`,
+      stderr: "",
+    });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/audit", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const limitParam = ctx.url.searchParams.get("limit");
+    const parsed = limitParam ? Number(limitParam) : NaN;
+    const limit = Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, 200) : 50;
+    const items = await readAuditEntries(workspace.path, workspace.id, limit);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/sessions", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const items = await listWorkspaceSessions(config, workspace, {
+      roots: parseOptionalBoolean(ctx.url.searchParams.get("roots"), "roots"),
+      start: parseOptionalNonNegativeInteger(ctx.url.searchParams.get("start"), "start"),
+      search: ctx.url.searchParams.get("search")?.trim() || undefined,
+      limit: parseOptionalPositiveInteger(ctx.url.searchParams.get("limit"), "limit"),
+    });
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/sessions/:sessionId", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sessionId = (ctx.params.sessionId ?? "").trim();
+    if (!sessionId) {
+      throw new ApiError(400, "invalid_payload", "sessionId is required");
+    }
+    const item = await readWorkspaceSession(config, workspace, sessionId);
+    return jsonResponse({ item });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/sessions/:sessionId/messages", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sessionId = (ctx.params.sessionId ?? "").trim();
+    if (!sessionId) {
+      throw new ApiError(400, "invalid_payload", "sessionId is required");
+    }
+    const items = await readWorkspaceSessionMessages(config, workspace, sessionId, {
+      limit: parseOptionalPositiveInteger(ctx.url.searchParams.get("limit"), "limit"),
+    });
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/sessions/:sessionId/snapshot", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sessionId = (ctx.params.sessionId ?? "").trim();
+    if (!sessionId) {
+      throw new ApiError(400, "invalid_payload", "sessionId is required");
+    }
+    const item = await readWorkspaceSessionSnapshot(config, workspace, sessionId, {
+      limit: parseOptionalPositiveInteger(ctx.url.searchParams.get("limit"), "limit"),
+    });
+    return jsonResponse({ item });
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/sessions/:sessionId", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sessionId = (ctx.params.sessionId ?? "").trim();
+    if (!sessionId) {
+      throw new ApiError(400, "invalid_payload", "sessionId is required");
+    }
+
+    // OpenCode session deletion via the upstream API.
+        await fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}`, {
+      method: "DELETE",
+    });
+
+    return jsonResponse({ ok: true });
+  });
+
+  addRoute(routes, "PATCH", "/workspace/:id/config", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const opencode = body.opencode as Record<string, unknown> | undefined;
+    const openwork = body.openwork as Record<string, unknown> | undefined;
+
+    if (!opencode && !openwork) {
+      throw new ApiError(400, "invalid_payload", "opencode or openwork updates required");
+    }
+
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "config.patch",
+      summary: "Patch workspace config",
+      paths: [opencode ? opencodeConfigPath(workspace.path) : null, openwork ? openworkConfigPath(workspace.path) : null].filter(Boolean) as string[],
+    });
+
+    if (opencode) {
+      const configPath = opencodeConfigPath(workspace.path);
+      const nextOpencode = ensurePlainObject(opencode);
+      const { permission, ...topLevelUpdates } = nextOpencode;
+
+      if (Object.keys(topLevelUpdates).length) {
+        await updateJsoncTopLevel(configPath, topLevelUpdates);
+      }
+
+      const permissionUpdate = ensurePlainObject(permission);
+      if (Object.prototype.hasOwnProperty.call(permissionUpdate, "external_directory")) {
+        const existingOpencode = await readOpencodeConfig(workspace.path);
+        const existingPermission = ensurePlainObject(existingOpencode.permission);
+        const nextExternalDirectory = permissionUpdate.external_directory;
+        const existingPermissionKeys = Object.keys(existingPermission);
+        const removePermissionParent =
+          typeof nextExternalDirectory === "undefined" &&
+          (existingPermissionKeys.length === 0 ||
+            (existingPermissionKeys.length === 1 && Object.prototype.hasOwnProperty.call(existingPermission, "external_directory")));
+
+        if (removePermissionParent) {
+          await updateJsoncPath(configPath, ["permission"], undefined);
+        } else {
+          await updateJsoncPath(configPath, ["permission", "external_directory"], nextExternalDirectory);
+        }
+      }
+    }
+    if (openwork) {
+      await writeOpenworkConfig(workspace.path, openwork, true);
+    }
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "config.patch",
+      target: "opencode.json",
+      summary: "Patched workspace config",
+      timestamp: Date.now(),
+    });
+
+    if (opencode) {
+      emitReloadEvent(ctx.reloadEvents, workspace, "config", buildConfigTrigger(opencodeConfigPath(workspace.path)));
+    }
+
+    return jsonResponse({ updatedAt: Date.now() });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/events", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sinceRaw = ctx.url.searchParams.get("since");
+    const since = sinceRaw ? Number(sinceRaw) : undefined;
+    const items = ctx.reloadEvents.list(workspace.id, since);
+    return jsonResponse({ items, cursor: ctx.reloadEvents.cursor(), workspaceId: workspace.id, disabled: false });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/engine/reload", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    requireClientScope(ctx, "collaborator");
+
+      await reloadOpencodeEngine(config, workspace);
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "engine.reload",
+      target: workspace.baseUrl ?? "opencode",
+      summary: "Reloaded workspace engine",
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({ ok: true, reloadedAt: Date.now() });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/inbox", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    if (!resolveInboxEnabled()) {
+      return jsonResponse({ items: [] });
+    }
+    const inboxRoot = resolveInboxDir(workspace.path);
+    const items = await listInbox(inboxRoot);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/inbox/:inboxId", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    if (!resolveInboxEnabled()) {
+      throw new ApiError(404, "inbox_disabled", "Workspace inbox is disabled");
+    }
+    const inboxRoot = resolveInboxDir(workspace.path);
+    const relativePath = decodeInboxId(ctx.params.inboxId);
+    const absPath = resolveSafeChildPath(inboxRoot, relativePath);
+    if (!(await exists(absPath))) {
+      throw new ApiError(404, "inbox_item_not_found", "Inbox item not found");
+    }
+    const info = await stat(absPath);
+    if (!info.isFile()) {
+      throw new ApiError(404, "inbox_item_not_found", "Inbox item not found");
+    }
+
+    const headers = new Headers();
+    headers.set("Content-Type", "application/octet-stream");
+    headers.set("Content-Length", String(info.size));
+    headers.set("Content-Disposition", `attachment; filename=\"${basename(relativePath)}\"`);
+    return new Response((Bun as any).file(absPath), { status: 200, headers });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/inbox", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    if (!resolveInboxEnabled()) {
+      throw new ApiError(404, "inbox_disabled", "Workspace inbox is disabled");
+    }
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+
+    const contentType = ctx.request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("multipart/form-data")) {
+      throw new ApiError(400, "invalid_payload", "Expected multipart/form-data");
+    }
+    const form = await ctx.request.formData();
+    const file = form.get("file");
+    if (!(file instanceof File)) {
+      throw new ApiError(400, "file_required", "Form field 'file' is required");
+    }
+
+    const queryPath = (ctx.url.searchParams.get("path") ?? "").trim();
+    const formPath = typeof form.get("path") === "string" ? String(form.get("path") || "").trim() : "";
+    const requestedPath = queryPath || formPath || file.name;
+
+    const relativePath = normalizeWorkspaceRelativePath(requestedPath, { allowSubdirs: true });
+    const inboxRoot = resolveInboxDir(workspace.path);
+    const dest = resolveSafeChildPath(inboxRoot, relativePath);
+    const maxBytes = resolveInboxMaxBytes();
+    if (file.size > maxBytes) {
+      throw new ApiError(413, "file_too_large", "File exceeds upload limit", { maxBytes, size: file.size });
+    }
+
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "workspace.inbox.upload",
+      summary: `Upload ${relativePath} to inbox`,
+      paths: [dest],
+    });
+
+    await ensureDir(dirname(dest));
+    const bytes = Buffer.from(await file.arrayBuffer());
+    const tmp = `${dest}.tmp-${shortId()}`;
+    await writeFile(tmp, bytes);
+    await rename(tmp, dest);
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "workspace.inbox.upload",
+      target: dest,
+      summary: `Uploaded ${relativePath} to inbox`,
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({ ok: true, path: relativePath, bytes: file.size });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/artifacts", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    if (!resolveOutboxEnabled()) {
+      return jsonResponse({ items: [] });
+    }
+    const outboxRoot = resolveOutboxDir(workspace.path);
+    const items = await listArtifacts(outboxRoot);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/artifacts/:artifactId", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    if (!resolveOutboxEnabled()) {
+      throw new ApiError(404, "outbox_disabled", "Workspace outbox is disabled");
+    }
+    const outboxRoot = resolveOutboxDir(workspace.path);
+    const relativePath = decodeArtifactId(ctx.params.artifactId);
+    const absPath = resolveSafeChildPath(outboxRoot, relativePath);
+    if (!(await exists(absPath))) {
+      throw new ApiError(404, "artifact_not_found", "Artifact not found");
+    }
+    const info = await stat(absPath);
+    if (!info.isFile()) {
+      throw new ApiError(404, "artifact_not_found", "Artifact not found");
+    }
+
+    const headers = new Headers();
+    headers.set("Content-Type", "application/octet-stream");
+    headers.set("Content-Length", String(info.size));
+    headers.set("Content-Disposition", `attachment; filename="${basename(relativePath)}"`);
+    return new Response((Bun as any).file(absPath), { status: 200, headers });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/files/sessions", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const ttlMs = parseFileSessionTtlMs((body as Record<string, unknown>).ttlSeconds);
+    const requestWrite = (body as Record<string, unknown>).write !== false;
+    const canWrite =
+      requestWrite &&
+      !config.readOnly &&
+      scopeRank(ctx.actor?.scope ?? "viewer") >= scopeRank("collaborator");
+
+    const session = fileSessions.create({
+      workspaceId: workspace.id,
+      workspaceRoot: workspace.path,
+      actorTokenHash: ctx.actor?.tokenHash ?? "",
+      actorScope: ctx.actor?.scope ?? "viewer",
+      canWrite,
+      ttlMs,
+    });
+
+    return jsonResponse({ session: serializeFileSession(session) });
+  });
+
+  addRoute(routes, "POST", "/files/sessions/:sessionId/renew", "client", async (ctx) => {
+    const body = await readJsonBody(ctx.request);
+    const ttlMs = parseFileSessionTtlMs((body as Record<string, unknown>).ttlSeconds);
+    const { session } = resolveFileSession(ctx, ctx.params.sessionId);
+    const renewed = fileSessions.renew(session.id, ttlMs);
+    if (!renewed) {
+      throw new ApiError(404, "file_session_not_found", "File session not found");
+    }
+    return jsonResponse({ session: serializeFileSession(renewed) });
+  });
+
+  addRoute(routes, "DELETE", "/files/sessions/:sessionId", "client", async (ctx) => {
+    const { session } = resolveFileSession(ctx, ctx.params.sessionId);
+    fileSessions.close(session.id);
+    return jsonResponse({ ok: true });
+  });
+
+  addRoute(routes, "GET", "/files/sessions/:sessionId/catalog/snapshot", "client", async (ctx) => {
+    const { workspace } = resolveFileSession(ctx, ctx.params.sessionId);
+    const prefix = parseCatalogPathFilter(ctx.url.searchParams.get("prefix"));
+    const after = parseCatalogPathFilter(ctx.url.searchParams.get("after"));
+    const includeDirs = ctx.url.searchParams.get("includeDirs") !== "false";
+    const limit = parseCatalogLimit(ctx.url.searchParams.get("limit"));
+
+    const entries = await listWorkspaceCatalogEntries(workspace.path);
+    const filtered = entries.filter((entry) => {
+      if (!includeDirs && entry.kind === "dir") return false;
+      if (!matchesCatalogFilter(entry.path, prefix)) return false;
+      if (after && entry.path <= after) return false;
+      return true;
+    });
+
+    const items = filtered.slice(0, limit);
+    const truncated = filtered.length > items.length;
+    const nextAfter = truncated ? items[items.length - 1]?.path : undefined;
+    const events = fileSessions.listWorkspaceEvents(workspace.id, Number.MAX_SAFE_INTEGER);
+
+    return jsonResponse({
+      sessionId: ctx.params.sessionId,
+      workspaceId: workspace.id,
+      generatedAt: Date.now(),
+      cursor: events.cursor,
+      total: filtered.length,
+      truncated,
+      nextAfter,
+      items,
+    });
+  });
+
+  addRoute(routes, "GET", "/files/sessions/:sessionId/catalog/events", "client", async (ctx) => {
+    const { workspace } = resolveFileSession(ctx, ctx.params.sessionId);
+    const since = parseSessionCursor(ctx.url.searchParams.get("since"));
+    const events = fileSessions.listWorkspaceEvents(workspace.id, since);
+    return jsonResponse(events);
+  });
+
+  addRoute(routes, "POST", "/files/sessions/:sessionId/read-batch", "client", async (ctx) => {
+    const { workspace } = resolveFileSession(ctx, ctx.params.sessionId);
+    const body = await readJsonBody(ctx.request);
+    const paths = parseBatchPathList((body as Record<string, unknown>).paths);
+    const items: Array<Record<string, unknown>> = [];
+
+    for (const relativePath of paths) {
+      try {
+        const absPath = resolveSafeChildPath(workspace.path, relativePath);
+        if (!(await exists(absPath))) {
+          items.push({ ok: false, path: relativePath, code: "file_not_found", message: "File not found" });
+          continue;
+        }
+        const info = await stat(absPath);
+        if (!info.isFile()) {
+          items.push({ ok: false, path: relativePath, code: "file_not_found", message: "File not found" });
+          continue;
+        }
+        if (info.size > FILE_SESSION_MAX_FILE_BYTES) {
+          items.push({
+            ok: false,
+            path: relativePath,
+            code: "file_too_large",
+            message: "File exceeds size limit",
+            maxBytes: FILE_SESSION_MAX_FILE_BYTES,
+            size: info.size,
+          });
+          continue;
+        }
+
+        const content = await readFile(absPath);
+        items.push({
+          ok: true,
+          path: relativePath,
+          kind: "file",
+          bytes: info.size,
+          updatedAt: info.mtimeMs,
+          revision: fileRevision(info),
+          contentBase64: content.toString("base64"),
+        });
+      } catch (error) {
+        const message = error instanceof ApiError ? error.message : "Unable to read file";
+        const code = error instanceof ApiError ? error.code : "read_failed";
+        items.push({ ok: false, path: relativePath, code, message });
+      }
+    }
+
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "POST", "/files/sessions/:sessionId/write-batch", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const { session, workspace } = resolveFileSession(ctx, ctx.params.sessionId);
+    if (!session.canWrite) {
+      throw new ApiError(403, "forbidden", "File session is read-only");
+    }
+
+    const body = await readJsonBody(ctx.request);
+    const writes = parseBatchWriteList((body as Record<string, unknown>).writes);
+    const items: Array<Record<string, unknown>> = [];
+
+    const plan: Array<{
+      path: string;
+      absPath: string;
+      bytes: Buffer;
+      ifMatchRevision?: string;
+      force?: boolean;
+      beforeRevision: string | null;
+    }> = [];
+
+    for (const write of writes) {
+      try {
+        const absPath = resolveSafeChildPath(workspace.path, write.path);
+        const bytes = Buffer.from(write.contentBase64, "base64");
+        if (bytes.byteLength > FILE_SESSION_MAX_FILE_BYTES) {
+          items.push({
+            ok: false,
+            path: write.path,
+            code: "file_too_large",
+            message: "File exceeds size limit",
+            maxBytes: FILE_SESSION_MAX_FILE_BYTES,
+            size: bytes.byteLength,
+          });
+          continue;
+        }
+
+        const before = (await exists(absPath)) ? await stat(absPath) : null;
+        if (before && !before.isFile()) {
+          items.push({ ok: false, path: write.path, code: "invalid_path", message: "Path must point to a file" });
+          continue;
+        }
+        const beforeRevision = before ? fileRevision(before) : null;
+        if (!write.force && write.ifMatchRevision && write.ifMatchRevision !== beforeRevision) {
+          items.push({
+            ok: false,
+            path: write.path,
+            code: "conflict",
+            message: "File changed since it was loaded",
+            expectedRevision: write.ifMatchRevision,
+            currentRevision: beforeRevision,
+          });
+          continue;
+        }
+
+        plan.push({
+          path: write.path,
+          absPath,
+          bytes,
+          beforeRevision,
+          ...(write.ifMatchRevision ? { ifMatchRevision: write.ifMatchRevision } : {}),
+          ...(write.force ? { force: true } : {}),
+        });
+      } catch (error) {
+        const message = error instanceof ApiError ? error.message : "Invalid write request";
+        const code = error instanceof ApiError ? error.code : "invalid_payload";
+        items.push({ ok: false, path: write.path, code, message });
+      }
+    }
+
+    if (plan.length) {
+      await requireApproval(ctx, {
+        workspaceId: workspace.id,
+        action: "workspace.files.session.write",
+        summary: `Write ${plan.length} file(s) via file session`,
+        paths: plan.map((item) => item.absPath),
+      });
+    }
+
+    for (const entry of plan) {
+      try {
+        const before = (await exists(entry.absPath)) ? await stat(entry.absPath) : null;
+        const currentRevision = before ? fileRevision(before) : null;
+        if (!entry.force && entry.ifMatchRevision && currentRevision !== entry.ifMatchRevision) {
+          items.push({
+            ok: false,
+            path: entry.path,
+            code: "conflict",
+            message: "File changed before write could be applied",
+            expectedRevision: entry.ifMatchRevision,
+            currentRevision,
+          });
+          continue;
+        }
+
+        await ensureDir(dirname(entry.absPath));
+        const tmp = `${entry.absPath}.tmp-${shortId()}`;
+        await writeFile(tmp, entry.bytes);
+        await rename(tmp, entry.absPath);
+        const after = await stat(entry.absPath);
+        const revision = fileRevision(after);
+
+        recordWorkspaceFileEvent(workspace.id, { type: "write", path: entry.path, revision });
+
+        await recordAudit(workspace.path, {
+          id: shortId(),
+          workspaceId: workspace.id,
+          actor: ctx.actor ?? { type: "remote" },
+          action: "workspace.files.session.write",
+          target: entry.absPath,
+          summary: `Wrote ${entry.path} via file session`,
+          timestamp: Date.now(),
+        });
+
+        items.push({
+          ok: true,
+          path: entry.path,
+          bytes: entry.bytes.byteLength,
+          updatedAt: after.mtimeMs,
+          revision,
+          previousRevision: entry.beforeRevision,
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to write file";
+        items.push({ ok: false, path: entry.path, code: "write_failed", message });
+      }
+    }
+
+    const events = fileSessions.listWorkspaceEvents(workspace.id, Number.MAX_SAFE_INTEGER);
+    return jsonResponse({ items, cursor: events.cursor });
+  });
+
+  addRoute(routes, "POST", "/files/sessions/:sessionId/ops", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const { session, workspace } = resolveFileSession(ctx, ctx.params.sessionId);
+    if (!session.canWrite) {
+      throw new ApiError(403, "forbidden", "File session is read-only");
+    }
+
+    const body = await readJsonBody(ctx.request);
+    const operations = Array.isArray((body as Record<string, unknown>).operations)
+      ? ((body as Record<string, unknown>).operations as Array<Record<string, unknown>>)
+      : null;
+    if (!operations || !operations.length) {
+      throw new ApiError(400, "invalid_payload", "operations must be a non-empty array");
+    }
+    if (operations.length > FILE_SESSION_MAX_BATCH_ITEMS) {
+      throw new ApiError(400, "invalid_payload", `operations must include <= ${FILE_SESSION_MAX_BATCH_ITEMS} items`);
+    }
+
+    const items: Array<Record<string, unknown>> = [];
+    const approvalPaths: string[] = [];
+    for (const op of operations) {
+      if (typeof op?.path === "string" && op.path.trim()) {
+        approvalPaths.push(resolveSafeChildPath(workspace.path, normalizeWorkspaceRelativePath(op.path, { allowSubdirs: true })));
+      }
+      if (typeof op?.from === "string" && op.from.trim()) {
+        approvalPaths.push(resolveSafeChildPath(workspace.path, normalizeWorkspaceRelativePath(op.from, { allowSubdirs: true })));
+      }
+      if (typeof op?.to === "string" && op.to.trim()) {
+        approvalPaths.push(resolveSafeChildPath(workspace.path, normalizeWorkspaceRelativePath(op.to, { allowSubdirs: true })));
+      }
+    }
+
+    if (approvalPaths.length) {
+      await requireApproval(ctx, {
+        workspaceId: workspace.id,
+        action: "workspace.files.session.ops",
+        summary: `Apply ${operations.length} file operation(s) via file session`,
+        paths: approvalPaths,
+      });
+    }
+
+    for (const op of operations) {
+      const type = String(op.type ?? "").trim();
+      try {
+        if (type === "mkdir") {
+          const path = normalizeWorkspaceRelativePath(String(op.path ?? ""), { allowSubdirs: true });
+          const absPath = resolveSafeChildPath(workspace.path, path);
+          await ensureDir(absPath);
+          recordWorkspaceFileEvent(workspace.id, { type: "mkdir", path });
+          items.push({ ok: true, type, path });
+          continue;
+        }
+
+        if (type === "delete") {
+          const path = normalizeWorkspaceRelativePath(String(op.path ?? ""), { allowSubdirs: true });
+          const absPath = resolveSafeChildPath(workspace.path, path);
+          if (!(await exists(absPath))) {
+            items.push({ ok: false, type, path, code: "file_not_found", message: "Path not found" });
+            continue;
+          }
+          await rm(absPath, { recursive: op.recursive === true, force: false });
+          recordWorkspaceFileEvent(workspace.id, { type: "delete", path });
+          items.push({ ok: true, type, path });
+          continue;
+        }
+
+        if (type === "rename") {
+          const from = normalizeWorkspaceRelativePath(String(op.from ?? ""), { allowSubdirs: true });
+          const to = normalizeWorkspaceRelativePath(String(op.to ?? ""), { allowSubdirs: true });
+          const fromAbs = resolveSafeChildPath(workspace.path, from);
+          const toAbs = resolveSafeChildPath(workspace.path, to);
+          if (!(await exists(fromAbs))) {
+            items.push({ ok: false, type, from, to, code: "file_not_found", message: "Source path not found" });
+            continue;
+          }
+          await ensureDir(dirname(toAbs));
+          await rename(fromAbs, toAbs);
+          recordWorkspaceFileEvent(workspace.id, { type: "rename", path: from, toPath: to });
+          items.push({ ok: true, type, from, to });
+          continue;
+        }
+
+        items.push({ ok: false, type, code: "invalid_operation", message: `Unsupported operation type: ${type}` });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Operation failed";
+        items.push({ ok: false, type, code: "operation_failed", message });
+      }
+    }
+
+    const events = fileSessions.listWorkspaceEvents(workspace.id, Number.MAX_SAFE_INTEGER);
+    return jsonResponse({ items, cursor: events.cursor });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/files/content", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const requested = (ctx.url.searchParams.get("path") ?? "").trim();
+    const relativePath = normalizeWorkspaceRelativePath(requested, { allowSubdirs: true });
+    if (!isSupportedWorkspaceTextFilePath(relativePath)) {
+      throw new ApiError(400, "invalid_path", "Only Markdown and OpenCode plugin text files are supported");
+    }
+
+    const absPath = resolveSafeChildPath(workspace.path, relativePath);
+    if (!(await exists(absPath))) {
+      throw new ApiError(404, "file_not_found", "File not found");
+    }
+    const info = await stat(absPath);
+    if (!info.isFile()) {
+      throw new ApiError(404, "file_not_found", "File not found");
+    }
+
+    const maxBytes = FILE_SESSION_MAX_FILE_BYTES;
+    if (info.size > maxBytes) {
+      throw new ApiError(413, "file_too_large", "File exceeds size limit", { maxBytes, size: info.size });
+    }
+
+    const content = await readFile(absPath, "utf8");
+    return jsonResponse({ path: relativePath, content, bytes: info.size, updatedAt: info.mtimeMs });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/files/content", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+
+    const requestedPath = String(body.path ?? "");
+    const relativePath = normalizeWorkspaceRelativePath(requestedPath, { allowSubdirs: true });
+    if (!isSupportedWorkspaceTextFilePath(relativePath)) {
+      throw new ApiError(400, "invalid_path", "Only Markdown and OpenCode plugin text files are supported");
+    }
+
+    if (typeof body.content !== "string") {
+      throw new ApiError(400, "invalid_payload", "content must be a string");
+    }
+    const content = body.content;
+    const bytes = Buffer.byteLength(content, "utf8");
+    const maxBytes = FILE_SESSION_MAX_FILE_BYTES;
+    if (bytes > maxBytes) {
+      throw new ApiError(413, "file_too_large", "File exceeds size limit", { maxBytes, size: bytes });
+    }
+
+    const baseUpdatedAtRaw = body.baseUpdatedAt;
+    const baseUpdatedAt =
+      typeof baseUpdatedAtRaw === "number" && Number.isFinite(baseUpdatedAtRaw) ? baseUpdatedAtRaw : null;
+    const force = body.force === true;
+
+    const absPath = resolveSafeChildPath(workspace.path, relativePath);
+
+    const before = (await exists(absPath)) ? await stat(absPath) : null;
+    if (before && !before.isFile()) {
+      throw new ApiError(400, "invalid_path", "Path must point to a file");
+    }
+    const beforeUpdatedAt = before ? before.mtimeMs : null;
+    if (!force && beforeUpdatedAt !== null && baseUpdatedAt !== null && beforeUpdatedAt !== baseUpdatedAt) {
+      throw new ApiError(409, "conflict", "File changed since it was loaded", {
+        baseUpdatedAt,
+        currentUpdatedAt: beforeUpdatedAt,
+      });
+    }
+
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "workspace.file.write",
+      summary: `Write ${relativePath}`,
+      paths: [absPath],
+    });
+
+    await ensureDir(dirname(absPath));
+    const tmp = `${absPath}.tmp-${shortId()}`;
+    await writeFile(tmp, content, "utf8");
+    await rename(tmp, absPath);
+    const after = await stat(absPath);
+    const revision = fileRevision(after);
+
+    recordWorkspaceFileEvent(workspace.id, {
+      type: "write",
+      path: relativePath,
+      revision,
+    });
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "workspace.file.write",
+      target: absPath,
+      summary: `Wrote ${relativePath}`,
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({ ok: true, path: relativePath, bytes, updatedAt: after.mtimeMs, revision });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/plugins", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const includeGlobal = ctx.url.searchParams.get("includeGlobal") === "true";
+    const result = await listPlugins(workspace.path, includeGlobal);
+    return jsonResponse(result);
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/plugins", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const spec = String(body.spec ?? "");
+    const normalized = normalizePluginSpec(spec);
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "plugins.add",
+      summary: `Add plugin ${spec}`,
+      paths: [opencodeConfigPath(workspace.path)],
+    });
+    const changed = await addPlugin(workspace.path, spec);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "plugins.add",
+      target: "opencode.json",
+      summary: `Added ${spec}`,
+      timestamp: Date.now(),
+    });
+    if (changed) {
+      emitReloadEvent(ctx.reloadEvents, workspace, "plugins", {
+        type: "plugin",
+        name: normalized,
+        action: "added",
+      });
+    }
+    const result = await listPlugins(workspace.path, false);
+    return jsonResponse(result);
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/plugins/:name", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = ctx.params.name ?? "";
+    const normalized = normalizePluginSpec(name);
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "plugins.remove",
+      summary: `Remove plugin ${name}`,
+      paths: [opencodeConfigPath(workspace.path)],
+    });
+    const removed = await removePlugin(workspace.path, name);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "plugins.remove",
+      target: "opencode.json",
+      summary: `Removed ${name}`,
+      timestamp: Date.now(),
+    });
+    if (removed) {
+      emitReloadEvent(ctx.reloadEvents, workspace, "plugins", {
+        type: "plugin",
+        name: normalized,
+        action: "removed",
+      });
+    }
+    const result = await listPlugins(workspace.path, false);
+    return jsonResponse(result);
+  });
+
+  addRoute(routes, "GET", "/hub/skills", "client", async (ctx) => {
+    const owner = ctx.url.searchParams.get("owner")?.trim();
+    const repo = ctx.url.searchParams.get("repo")?.trim();
+    const ref = ctx.url.searchParams.get("ref")?.trim();
+    const items = await listHubSkills({
+      owner: owner || "different-ai",
+      repo: repo || "openwork-hub",
+      ref: ref || "main",
+    });
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/skills", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const includeGlobal = ctx.url.searchParams.get("includeGlobal") === "true";
+    const items = await listSkills(workspace.path, includeGlobal);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/skills/hub/:name", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = String(ctx.params.name ?? "").trim();
+    if (!name) {
+      throw new ApiError(400, "invalid_skill_name", "Skill name is required");
+    }
+    const body = await readJsonBody(ctx.request);
+    const overwrite = body?.overwrite === true;
+    const repoPayload = body?.repo && typeof body.repo === "object" ? (body.repo as Record<string, unknown>) : undefined;
+    const repo = repoPayload
+      ? {
+          owner: typeof repoPayload.owner === "string" ? repoPayload.owner : undefined,
+          repo: typeof repoPayload.repo === "string" ? repoPayload.repo : undefined,
+          ref: typeof repoPayload.ref === "string" ? repoPayload.ref : undefined,
+        }
+      : undefined;
+
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "skills.install_hub",
+      summary: `Install hub skill ${name}`,
+      paths: [join(workspace.path, ".opencode", "skills", name)],
+    });
+
+    const result = await installHubSkill(workspace.path, { name, overwrite, repo });
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "skills.install_hub",
+      target: result.path,
+      summary: `Installed hub skill ${name}`,
+      timestamp: Date.now(),
+    });
+    emitReloadEvent(ctx.reloadEvents, workspace, "skills", {
+      type: "skill",
+      name,
+      action: result.action,
+      path: result.path,
+    });
+
+    return jsonResponse({ ok: true, ...result });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/skills/:name", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const includeGlobal = ctx.url.searchParams.get("includeGlobal") === "true";
+    const name = String(ctx.params.name ?? "").trim();
+    if (!name) {
+      throw new ApiError(400, "invalid_skill_name", "Skill name is required");
+    }
+    const items = await listSkills(workspace.path, includeGlobal);
+    const item = items.find((skill) => skill.name === name);
+    if (!item) {
+      throw new ApiError(404, "skill_not_found", `Skill not found: ${name}`);
+    }
+    const content = await readFile(item.path, "utf8");
+    return jsonResponse({ item, content });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/skills", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const name = String(body.name ?? "");
+    const content = String(body.content ?? "");
+    const description = body.description ? String(body.description) : undefined;
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "skills.upsert",
+      summary: `Upsert skill ${name}`,
+      paths: [join(workspace.path, ".opencode", "skills", name, "SKILL.md")],
+    });
+    const result = await upsertSkill(workspace.path, { name, content, description });
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "skills.upsert",
+      target: result.path,
+      summary: `Upserted skill ${name}`,
+      timestamp: Date.now(),
+    });
+    emitReloadEvent(ctx.reloadEvents, workspace, "skills", {
+      type: "skill",
+      name,
+      action: result.action,
+      path: result.path,
+    });
+    return jsonResponse({ name, path: result.path, description: description ?? "", scope: "project" });
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/skills/:name", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = String(ctx.params.name ?? "").trim();
+    if (!name) {
+      throw new ApiError(400, "invalid_skill_name", "Skill name is required");
+    }
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "skills.delete",
+      summary: `Delete skill ${name}`,
+      paths: [join(workspace.path, ".opencode", "skills", name)],
+    });
+    const result = await deleteSkill(workspace.path, name);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "skills.delete",
+      target: result.path,
+      summary: `Deleted skill ${name}`,
+      timestamp: Date.now(),
+    });
+    emitReloadEvent(ctx.reloadEvents, workspace, "skills", {
+      type: "skill",
+      name,
+      action: "removed",
+      path: result.path,
+    });
+    return jsonResponse({ ok: true, name, path: result.path });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/mcp", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const items = await listMcp(workspace.path);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/mcp", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const name = String(body.name ?? "");
+    const configPayload = body.config as Record<string, unknown> | undefined;
+    if (!configPayload) {
+      throw new ApiError(400, "invalid_payload", "MCP config is required");
+    }
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "mcp.add",
+      summary: `Add MCP ${name}`,
+      paths: [opencodeConfigPath(workspace.path)],
+    });
+    const result = await addMcp(workspace.path, name, configPayload);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "mcp.add",
+      target: "opencode.json",
+      summary: `Added MCP ${name}`,
+      timestamp: Date.now(),
+    });
+    emitReloadEvent(ctx.reloadEvents, workspace, "mcp", {
+      type: "mcp",
+      name,
+      action: result.action,
+    });
+    const items = await listMcp(workspace.path);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/mcp/:name", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = ctx.params.name ?? "";
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "mcp.remove",
+      summary: `Remove MCP ${name}`,
+      paths: [opencodeConfigPath(workspace.path)],
+    });
+    const removed = await removeMcp(workspace.path, name);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "mcp.remove",
+      target: "opencode.json",
+      summary: `Removed MCP ${name}`,
+      timestamp: Date.now(),
+    });
+    if (removed) {
+      emitReloadEvent(ctx.reloadEvents, workspace, "mcp", {
+        type: "mcp",
+        name,
+        action: "removed",
+      });
+    }
+    const items = await listMcp(workspace.path);
+    return jsonResponse({ items });
+  });
+
+  // Toggle `enabled` on a workspace MCP. Strict body validation — `Boolean(body.enabled)`
+  // would silently disable on `{}` or coerce `"false"` to true.
+  addRoute(routes, "POST", "/workspace/:id/mcp/:name/enabled", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = ctx.params.name ?? "";
+    const body = await readJsonBody(ctx.request);
+    if (!body || typeof body !== "object" || Array.isArray(body) || typeof body.enabled !== "boolean") {
+      throw new ApiError(400, "invalid_payload", "enabled must be a boolean");
+    }
+    const enabled = body.enabled;
+    const action = enabled ? "mcp.enable" : "mcp.disable";
+    const summary = `${enabled ? "Enable" : "Disable"} MCP ${name}`;
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action,
+      summary,
+      paths: [opencodeConfigPath(workspace.path)],
+    });
+    const updated = await setMcpEnabled(workspace.path, name, enabled);
+    if (!updated) {
+      throw new ApiError(404, "mcp_not_found", `MCP ${name} not found in workspace config`);
+    }
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action,
+      target: "opencode.json",
+      summary: `${enabled ? "Enabled" : "Disabled"} MCP ${name}`,
+      timestamp: Date.now(),
+    });
+    // ReloadTrigger.action only allows added/removed/updated, so toggle => "updated".
+    emitReloadEvent(ctx.reloadEvents, workspace, "mcp", {
+      type: "mcp",
+      name,
+      action: "updated",
+    });
+    const items = await listMcp(workspace.path);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/mcp/:name/auth", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = String(ctx.params.name ?? "").trim();
+    validateMcpName(name);
+
+    const authStorePath = join(homedir(), ".config", "opencode", "mcp-auth.json");
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "mcp.auth.remove",
+      summary: `Logout MCP ${name}`,
+      paths: [authStorePath],
+    });
+
+    // Best-effort disconnect so any active connection is torn down.
+    try {
+      await fetchOpencodeJson(config, workspace, `/mcp/${encodeURIComponent(name)}/disconnect`, { method: "POST" });
+    } catch {
+      // ignore
+    }
+
+    try {
+      await fetchOpencodeJson(config, workspace, `/mcp/${encodeURIComponent(name)}/auth`, { method: "DELETE" });
+    } catch (error) {
+      // Treat missing credentials as a successful logout (idempotent).
+      if (
+        error instanceof ApiError &&
+        error.code === "opencode_request_failed" &&
+        error.details &&
+        typeof error.details === "object" &&
+        "status" in (error.details as Record<string, unknown>) &&
+        (error.details as { status?: unknown }).status === 404
+      ) {
+        // ok
+      } else {
+        throw error;
+      }
+    }
+
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "mcp.auth.remove",
+      target: authStorePath,
+      summary: `Logged out MCP ${name}`,
+      timestamp: Date.now(),
+    });
+
+    return jsonResponse({ ok: true });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/commands", "client", async (ctx) => {
+    const scope = ctx.url.searchParams.get("scope") === "global" ? "global" : "workspace";
+    if (scope === "global") {
+      await requireHost(ctx.request, config, tokens);
+    }
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const items = await listCommands(workspace.path, scope);
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/commands", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const name = String(body.name ?? "");
+    const template = String(body.template ?? "");
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "commands.upsert",
+      summary: `Upsert command ${name}`,
+      paths: [join(workspace.path, ".opencode", "commands", `${sanitizeCommandName(name)}.md`)],
+    });
+    const path = await upsertCommand(workspace.path, {
+      name,
+      description: body.description ? String(body.description) : undefined,
+      template,
+      agent: body.agent ? String(body.agent) : undefined,
+      model: body.model ? String(body.model) : undefined,
+      subtask: typeof body.subtask === "boolean" ? body.subtask : undefined,
+    });
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "commands.upsert",
+      target: path,
+      summary: `Upserted command ${name}`,
+      timestamp: Date.now(),
+    });
+
+    emitReloadEvent(ctx.reloadEvents, workspace, "commands", {
+      type: "command",
+      name: sanitizeCommandName(name),
+      action: "updated",
+      path,
+    });
+    const items = await listCommands(workspace.path, "workspace");
+    return jsonResponse({ items });
+  });
+
+  addRoute(routes, "DELETE", "/workspace/:id/commands/:name", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const name = ctx.params.name ?? "";
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "commands.delete",
+      summary: `Delete command ${name}`,
+      paths: [join(workspace.path, ".opencode", "commands", `${sanitizeCommandName(name)}.md`)],
+    });
+    await deleteCommand(workspace.path, name);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "commands.delete",
+      target: join(workspace.path, ".opencode", "commands"),
+      summary: `Deleted command ${name}`,
+      timestamp: Date.now(),
+    });
+
+    emitReloadEvent(ctx.reloadEvents, workspace, "commands", {
+      type: "command",
+      name: sanitizeCommandName(name),
+      action: "removed",
+      path: join(workspace.path, ".opencode", "commands", `${sanitizeCommandName(name)}.md`),
+    });
+    return jsonResponse({ ok: true });
+  });
+
+  addRoute(routes, "GET", "/workspace/:id/export", "client", async (ctx) => {
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const sensitiveMode = parseWorkspaceExportSensitiveMode(ctx.url.searchParams.get("sensitive"));
+    const exportPayload = await exportWorkspace(workspace, { sensitiveMode });
+    return jsonResponse(exportPayload);
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/import/preview", "client", async (ctx) => {
+    requireClientScope(ctx, "viewer");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const preview = await buildWorkspaceImportPreview(workspace.path, body);
+    return jsonResponse(publicWorkspaceImportPreview(preview));
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/import", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const body = await readJsonBody(ctx.request);
+    const expectedFingerprint = parseWorkspaceImportPreviewFingerprint(body);
+    const preview = await buildWorkspaceImportPreview(workspace.path, body);
+    if (expectedFingerprint && expectedFingerprint !== preview.fingerprint) {
+      return jsonResponse(
+        {
+          ok: false,
+          code: "workspace_import_preview_stale",
+          message: "Workspace changed after this import was previewed. Review the latest preview before importing.",
+          preview: publicWorkspaceImportPreview(preview),
+        },
+        409,
+      );
+    }
+    const approvalPaths = workspaceImportPreviewApprovalPaths(preview);
+    if (approvalPaths.length === 0) {
+      return jsonResponse({ ok: true, preview: publicWorkspaceImportPreview(preview) });
+    }
+    if (!expectedFingerprint) {
+      return jsonResponse(
+        {
+          ok: false,
+          code: "workspace_import_preview_required",
+          message: "Review this import preview before applying workspace changes.",
+          preview: publicWorkspaceImportPreview(preview),
+        },
+        409,
+      );
+    }
+    await requireApproval(ctx, {
+      workspaceId: workspace.id,
+      action: "config.import",
+      summary: summarizeWorkspaceImportPreview(preview),
+      paths: approvalPaths,
+    });
+    const latestPreview = await buildWorkspaceImportPreview(workspace.path, body);
+    if (latestPreview.fingerprint !== expectedFingerprint) {
+      return jsonResponse(
+        {
+          ok: false,
+          code: "workspace_import_preview_stale",
+          message: "Workspace changed after this import was previewed. Review the latest preview before importing.",
+          preview: publicWorkspaceImportPreview(latestPreview),
+        },
+        409,
+      );
+    }
+    await importWorkspace(workspace, body, latestPreview);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "config.import",
+      target: "workspace",
+      summary: summarizeWorkspaceImportApplied(latestPreview),
+      timestamp: Date.now(),
+    });
+    emitReloadEvent(ctx.reloadEvents, workspace, "config", buildConfigTrigger(opencodeConfigPath(workspace.path)));
+    return jsonResponse({ ok: true, preview: publicWorkspaceImportPreview(latestPreview) });
+  });
+
+  addRoute(routes, "POST", "/workspace/:id/blueprint/sessions/materialize", "client", async (ctx) => {
+    ensureWritable(config);
+    requireClientScope(ctx, "collaborator");
+    const workspace = await resolveWorkspace(config, ctx.params.id);
+    const result = await materializeBlueprintSessions(config, workspace);
+    await recordAudit(workspace.path, {
+      id: shortId(),
+      workspaceId: workspace.id,
+      actor: ctx.actor ?? { type: "remote" },
+      action: "blueprint.sessions.materialize",
+      target: "workspace",
+      summary: result.created.length
+        ? `Materialized ${result.created.length} template starter session${result.created.length === 1 ? "" : "s"}`
+        : "Checked template starter sessions",
+      timestamp: Date.now(),
+    });
+    return jsonResponse(result);
+  });
+
+  addRoute(routes, "POST", "/share/bundles/publish", "client", async (ctx) => {
+    requireClientScope(ctx, "viewer");
+    const body = await readJsonBody(ctx.request);
+    if (typeof body.baseUrl === "string" && body.baseUrl.trim()) {
+      throw new ApiError(
+        400,
+        "publisher_base_url_forbidden",
+        "Bundle publishing always uses the configured OpenWork publisher. Remove baseUrl from the request.",
+      );
+    }
+    const result = await publishSharedBundle({
+      payload: body.payload,
+      bundleType: String(body.bundleType ?? "").trim(),
+      name: typeof body.name === "string" ? body.name : undefined,
+      timeoutMs: typeof body.timeoutMs === "number" ? body.timeoutMs : undefined,
+    });
+    return jsonResponse(result);
+  });
+
+  addRoute(routes, "POST", "/share/bundles/fetch", "client", async (ctx) => {
+    requireClientScope(ctx, "viewer");
+    const body = await readJsonBody(ctx.request);
+    const bundle = await fetchSharedBundle(body.bundleUrl, {
+      timeoutMs: typeof body.timeoutMs === "number" ? body.timeoutMs : undefined,
+    });
+  return jsonResponse(bundle);
+  });
+
+  addRoute(routes, "GET", "/approvals", "host", async (ctx) => {
+    return jsonResponse({ items: ctx.approvals.list() });
+  });
+
+  addRoute(routes, "POST", "/approvals/:id", "host", async (ctx) => {
+    const body = await readJsonBody(ctx.request);
+    const reply = body.reply === "allow" ? "allow" : "deny";
+    const result = ctx.approvals.respond(ctx.params.id, reply);
+    if (!result) {
+      throw new ApiError(404, "approval_not_found", "Approval request not found");
+    }
+    return jsonResponse({ ok: true, allowed: result.allowed });
+  });
+
+  return routes;
+}
+
+function remapSessionReadError(error: unknown): never {
+  if (error instanceof ApiError && error.code === "opencode_request_failed") {
+    const details = error.details;
+    const upstreamStatus =
+      details && typeof details === "object" && "status" in details ? Number((details as { status?: unknown }).status) : NaN;
+    if (upstreamStatus === 400) {
+      throw new ApiError(400, "invalid_query", "OpenCode rejected the session read request", details);
+    }
+    if (upstreamStatus === 404) {
+      throw new ApiError(404, "session_not_found", "Session not found", details);
+    }
+  }
+  throw error;
+}
+
+async function listWorkspaceSessions(
+  config: ServerConfig,
+  workspace: WorkspaceInfo,
+  input: { roots?: boolean; start?: number; search?: string; limit?: number },
+) {
+  try {
+    return buildSessionList(
+      await fetchOpencodeJson(config, workspace, "/session", {
+        method: "GET",
+        query: {
+          roots: input.roots,
+          start: input.start,
+          search: input.search,
+          limit: input.limit,
+        },
+      }),
+    );
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function readWorkspaceSession(config: ServerConfig, workspace: WorkspaceInfo, sessionId: string) {
+  try {
+    return buildSession(
+      await fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}`, {
+        method: "GET",
+      }),
+    );
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function readWorkspaceSessionMessages(
+  config: ServerConfig,
+  workspace: WorkspaceInfo,
+  sessionId: string,
+  input: { limit?: number },
+) {
+  try {
+    return buildSessionMessages(
+      await fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}/message`, {
+        method: "GET",
+        query: { limit: input.limit },
+      }),
+    );
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function readWorkspaceSessionTodos(config: ServerConfig, workspace: WorkspaceInfo, sessionId: string) {
+  try {
+    return buildSessionTodos(
+      await fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}/todo`, {
+        method: "GET",
+      }),
+    );
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function readWorkspaceSessionStatuses(config: ServerConfig, workspace: WorkspaceInfo) {
+  try {
+    return buildSessionStatuses(
+      await fetchOpencodeJson(config, workspace, "/session/status", {
+        method: "GET",
+      }),
+    );
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function readWorkspaceSessionSnapshot(
+  config: ServerConfig,
+  workspace: WorkspaceInfo,
+  sessionId: string,
+  input: { limit?: number },
+) {
+  try {
+    const [session, messages, todos, statuses] = await Promise.all([
+      fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}`, {
+        method: "GET",
+      }),
+      fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}/message`, {
+        method: "GET",
+        query: { limit: input.limit },
+      }),
+      fetchOpencodeJson(config, workspace, `/session/${encodeURIComponent(sessionId)}/todo`, {
+        method: "GET",
+      }),
+      fetchOpencodeJson(config, workspace, "/session/status", {
+        method: "GET",
+      }),
+    ]);
+    return buildSessionSnapshot({ session, messages, todos, statuses });
+  } catch (error) {
+    remapSessionReadError(error);
+  }
+}
+
+async function resolveWorkspace(config: ServerConfig, id: string): Promise<WorkspaceInfo> {
+  const workspace = config.workspaces.find((entry) => entry.id === id);
+  if (!workspace) {
+    throw new ApiError(404, "workspace_not_found", "Workspace not found");
+  }
+  const resolvedWorkspace = resolve(workspace.path);
+  const authorized = await isAuthorizedRoot(resolvedWorkspace, config.authorizedRoots);
+  if (!authorized) {
+    throw new ApiError(403, "workspace_unauthorized", "Workspace is not authorized");
+  }
+  if (!config.readOnly) {
+    await repairCommands(resolvedWorkspace);
+  }
+  return { ...workspace, path: resolvedWorkspace };
+}
+
+async function isAuthorizedRoot(workspacePath: string, roots: string[]): Promise<boolean> {
+  const resolvedWorkspace = resolve(workspacePath);
+  for (const root of roots) {
+    const resolvedRoot = resolve(root);
+    if (resolvedWorkspace === resolvedRoot) return true;
+    if (resolvedWorkspace.startsWith(resolvedRoot + sep)) return true;
+  }
+  return false;
+}
+
+function ensureWritable(config: ServerConfig): void {
+  if (config.readOnly) {
+    throw new ApiError(403, "read_only", "Server is read-only");
+  }
+}
+
+function scopeRank(scope: TokenScope): number {
+  if (scope === "viewer") return 1;
+  if (scope === "collaborator") return 2;
+  return 3;
+}
+
+function requireClientScope(ctx: RequestContext, required: TokenScope): void {
+  const scope = ctx.actor?.scope;
+  if (!scope) {
+    throw new ApiError(401, "unauthorized", "Missing token scope");
+  }
+  if (scopeRank(scope) < scopeRank(required)) {
+    throw new ApiError(403, "forbidden", "Insufficient token scope", { required, scope });
+  }
+}
+
+async function readJsonBody(request: Request): Promise<Record<string, unknown>> {
+  try {
+    const json = await request.json();
+    return json as Record<string, unknown>;
+  } catch {
+    throw new ApiError(400, "invalid_json", "Invalid JSON body");
+  }
+}
+
+function parseOptionalPositiveInteger(value: string | null, name: string): number | undefined {
+  if (value === null) return undefined;
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new ApiError(400, "invalid_query", `${name} must be a positive integer`);
+  }
+  return parsed;
+}
+
+function parseOptionalNonNegativeInteger(value: string | null, name: string): number | undefined {
+  if (value === null) return undefined;
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    throw new ApiError(400, "invalid_query", `${name} must be a non-negative integer`);
+  }
+  return parsed;
+}
+
+function parseOptionalBoolean(value: string | null, name: string): boolean | undefined {
+  if (value === null) return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) return true;
+  if (["0", "false", "no", "off"].includes(normalized)) return false;
+  throw new ApiError(400, "invalid_query", `${name} must be a boolean`);
+}
+
+function parseJsonResponse(text: string): unknown {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  try {
+    return JSON.parse(trimmed) as unknown;
+  } catch {
+    return trimmed;
+  }
+}
+
+function ensurePlainObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value as Record<string, unknown>;
+}
+
+type OpenworkServerConfigFile = Record<string, unknown> & {
+  workspaces?: Array<Record<string, unknown>>;
+  authorizedRoots?: string[];
+};
+
+async function readServerConfigFile(configPath: string): Promise<OpenworkServerConfigFile> {
+  if (!(await exists(configPath))) {
+    return {};
+  }
+
+  try {
+    const raw = await readFile(configPath, "utf8");
+    return ensurePlainObject(JSON.parse(raw)) as OpenworkServerConfigFile;
+  } catch (error) {
+    throw new ApiError(422, "invalid_json", "Failed to parse server config", {
+      path: configPath,
+      error: String(error),
+    });
+  }
+}
+
+function serializeWorkspaceConfigEntry(workspace: WorkspaceInfo): Record<string, unknown> {
+  return {
+    id: workspace.id,
+    path: workspace.path,
+    name: workspace.name,
+    preset: workspace.preset,
+    workspaceType: workspace.workspaceType,
+    ...(workspace.remoteType ? { remoteType: workspace.remoteType } : {}),
+    ...(workspace.baseUrl ? { baseUrl: workspace.baseUrl } : {}),
+    ...(workspace.directory ? { directory: workspace.directory } : {}),
+    ...(workspace.displayName ? { displayName: workspace.displayName } : {}),
+    ...(workspace.openworkHostUrl ? { openworkHostUrl: workspace.openworkHostUrl } : {}),
+    ...(workspace.openworkToken ? { openworkToken: workspace.openworkToken } : {}),
+    ...(workspace.openworkWorkspaceId ? { openworkWorkspaceId: workspace.openworkWorkspaceId } : {}),
+    ...(workspace.openworkWorkspaceName ? { openworkWorkspaceName: workspace.openworkWorkspaceName } : {}),
+    ...(workspace.sandboxBackend ? { sandboxBackend: workspace.sandboxBackend } : {}),
+    ...(workspace.sandboxRunId ? { sandboxRunId: workspace.sandboxRunId } : {}),
+    ...(workspace.sandboxContainerName ? { sandboxContainerName: workspace.sandboxContainerName } : {}),
+    ...(workspace.opencodeUsername ? { opencodeUsername: workspace.opencodeUsername } : {}),
+    ...(workspace.opencodePassword ? { opencodePassword: workspace.opencodePassword } : {}),
+  };
+}
+
+async function persistServerWorkspaceState(config: ServerConfig): Promise<boolean> {
+  const configPath = config.configPath?.trim() ?? "";
+  if (!configPath) return false;
+  if (!(await exists(configPath))) return false;
+
+  const parsed = await readServerConfigFile(configPath);
+  const next: OpenworkServerConfigFile = {
+    ...parsed,
+    workspaces: config.workspaces.map(serializeWorkspaceConfigEntry),
+    authorizedRoots: Array.from(new Set(config.authorizedRoots.map((root) => resolve(root)))),
+  };
+
+  await ensureDir(dirname(configPath));
+  const tmpPath = `${configPath}.tmp.${shortId()}`;
+  try {
+    await writeFile(tmpPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+    await rename(tmpPath, configPath);
+    return true;
+  } finally {
+    try {
+      await rm(tmpPath);
+    } catch {
+      // ignore
+    }
+  }
+}
+
+function normalizeOpencodeScope(value: string | null | undefined): "project" | "global" {
+  return value?.trim().toLowerCase() === "global" ? "global" : "project";
+}
+
+function resolveOpencodeConfigFilePath(scope: "project" | "global", workspaceRoot: string): string {
+  if (scope === "global") {
+    const base = join(homedir(), ".config", "opencode");
+    const jsoncPath = join(base, "opencode.jsonc");
+    const jsonPath = join(base, "opencode.json");
+    if (existsSync(jsoncPath)) return jsoncPath;
+    if (existsSync(jsonPath)) return jsonPath;
+    return jsoncPath;
+  }
+  return opencodeConfigPath(workspaceRoot);
+}
+
+function getRuntimeControlConfig(): { baseUrl: string; token: string } | null {
+  const baseUrl = process.env.OPENWORK_CONTROL_BASE_URL?.trim() ?? "";
+  const token = process.env.OPENWORK_CONTROL_TOKEN?.trim() ?? "";
+  if (!baseUrl || !token) return null;
+  return { baseUrl: baseUrl.replace(/\/+$/, ""), token };
+}
+
+async function fetchRuntimeControl(path: string, init?: { method?: string; body?: unknown }) {
+  const control = getRuntimeControlConfig();
+  if (!control) {
+    throw new ApiError(501, "runtime_upgrade_unavailable", "Worker runtime control is not configured on this host");
+  }
+  const response = await fetch(`${control.baseUrl}${path}`, {
+    method: init?.method ?? "GET",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${control.token}`,
+    },
+    body: init?.body === undefined ? undefined : JSON.stringify(init.body),
+  });
+  const text = await response.text();
+  const json = text ? JSON.parse(text) : null;
+  if (!response.ok) {
+    throw new ApiError(response.status, "runtime_upgrade_failed", "Worker runtime control request failed", json);
+  }
+  return json;
+}
+
+async function readOpencodeConfig(workspaceRoot: string): Promise<Record<string, unknown>> {
+  const { data } = await readJsoncFile(opencodeConfigPath(workspaceRoot), {} as Record<string, unknown>);
+  return data;
+}
+
+async function readOpenworkConfig(workspaceRoot: string): Promise<Record<string, unknown>> {
+  const path = openworkConfigPath(workspaceRoot);
+  if (!(await exists(path))) return {};
+  try {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw) as Record<string, unknown>;
+  } catch {
+    throw new ApiError(422, "invalid_json", "Failed to parse openwork.json");
+  }
+}
+
+function resolveOpencodeDirectory(workspace: WorkspaceInfo): string | null {
+  const explicit = workspace.directory?.trim() ?? "";
+  if (explicit) return explicit;
+  if (workspace.workspaceType === "local") return workspace.path;
+  return null;
+}
+
+function buildOpencodeReloadUrl(baseUrl: string, directory?: string | null): string {
+  try {
+    const url = new URL(baseUrl);
+    url.pathname = "/instance/dispose";
+    url.search = "";
+    if (directory) {
+      url.searchParams.set("directory", directory);
+    }
+    return url.toString();
+  } catch {
+    throw new ApiError(400, "opencode_url_invalid", "OpenCode base URL is invalid");
+  }
+}
+
+function parseOpencodeErrorBody(input: string): unknown {
+  const trimmed = input.trim();
+  if (!trimmed) return null;
+  try {
+    return JSON.parse(trimmed) as unknown;
+  } catch {
+    return trimmed;
+  }
+}
+
+async function reloadOpencodeEngine(config: ServerConfig, workspace: WorkspaceInfo): Promise<void> {
+  const connection = resolveWorkspaceOpencodeConnection(config, workspace);
+  const baseUrl = connection.baseUrl?.trim() ?? "";
+  if (!baseUrl) {
+    throw new ApiError(400, "opencode_unconfigured", "OpenCode base URL is missing for this workspace");
+  }
+
+  const directory = resolveOpencodeDirectory(workspace);
+  const targetUrl = buildOpencodeReloadUrl(baseUrl, directory);
+  const headers: Record<string, string> = {};
+  const auth = connection.authHeader ?? null;
+  if (auth) headers.Authorization = auth;
+
+  const response = await fetch(targetUrl, { method: "POST", headers });
+  if (response.ok) return;
+  const body = parseOpencodeErrorBody(await response.text());
+  throw new ApiError(502, "opencode_reload_failed", "OpenCode reload failed", {
+    status: response.status,
+    body,
+  });
+}
+
+async function writeOpenworkConfig(workspaceRoot: string, payload: Record<string, unknown>, merge: boolean): Promise<void> {
+  const path = openworkConfigPath(workspaceRoot);
+  const next = merge ? { ...(await readOpenworkConfig(workspaceRoot)), ...payload } : payload;
+  await ensureDir(join(workspaceRoot, ".opencode"));
+  await writeFile(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+}
+
+async function requireApproval(
+  ctx: RequestContext,
+  input: Omit<ApprovalRequest, "id" | "createdAt" | "actor">,
+): Promise<void> {
+  const actor = ctx.actor ?? { type: "remote" };
+  const result = await ctx.approvals.requestApproval({ ...input, actor });
+  if (!result.allowed) {
+    throw new ApiError(403, "write_denied", "Write request denied", {
+      requestId: result.id,
+      reason: result.reason,
+    });
+  }
+}
+
+async function exportWorkspace(
+  workspace: WorkspaceInfo,
+  options?: { sensitiveMode?: WorkspaceExportSensitiveMode },
+) {
+  const sensitiveMode = options?.sensitiveMode ?? "auto";
+  const rawOpencode = await readOpencodeConfig(workspace.path);
+  let opencode = sanitizePortableOpencodeConfig(rawOpencode);
+  const openwork = sanitizeOpenworkTemplateConfig(await readOpenworkConfig(workspace.path));
+  const skills = await listSkills(workspace.path, false);
+  const commands = await listCommands(workspace.path, "workspace");
+  let files = await listPortableFiles(workspace.path);
+  const warnings = collectWorkspaceExportWarnings({ opencode: rawOpencode, files });
+  if (warnings.length && sensitiveMode === "auto") {
+    throw new ApiError(
+      409,
+      "workspace_export_requires_decision",
+      "This workspace includes sensitive config. Choose whether to exclude it or include it before exporting.",
+      { warnings },
+    );
+  }
+  if (sensitiveMode === "exclude") {
+    const sanitized = stripSensitiveWorkspaceExportData({ opencode, files });
+    opencode = sanitized.opencode;
+    files = sanitized.files;
+  }
+  const skillContents = await Promise.all(
+    skills.map(async (skill) => ({
+      name: skill.name,
+      description: skill.description,
+      content: await readFile(skill.path, "utf8"),
+    })),
+  );
+  const commandContents = await Promise.all(
+    commands.map(async (command) => ({
+      name: command.name,
+      description: command.description,
+      template: command.template,
+    })),
+  );
+
+  return {
+    workspaceId: workspace.id,
+    exportedAt: Date.now(),
+    opencode,
+    openwork,
+    skills: skillContents,
+    commands: commandContents,
+    ...(files.length ? { files } : {}),
+  };
+}
+
+function parseWorkspaceExportSensitiveMode(input: string | null): WorkspaceExportSensitiveMode {
+  const trimmed = (input ?? "").trim();
+  if (!trimmed) return "auto";
+  if (trimmed === "auto" || trimmed === "include" || trimmed === "exclude") {
+    return trimmed;
+  }
+  throw new ApiError(400, "invalid_workspace_export_sensitive_mode", `Invalid workspace export sensitive mode: ${trimmed}`);
+}
+
+function parseWorkspaceImportPreviewFingerprint(payload: Record<string, unknown>): string | null {
+  const value = payload.previewFingerprint;
+  if (value === undefined || value === null || value === "") return null;
+  if (typeof value !== "string") {
+    throw new ApiError(
+      400,
+      "invalid_workspace_import_preview_fingerprint",
+      "Workspace import preview fingerprint must be a string",
+    );
+  }
+  return value;
+}
+
+function workspaceImportRelativePath(workspace: WorkspaceInfo, path: string): string {
+  return relative(workspace.path, path).replaceAll("\\", "/");
+}
+
+async function importWorkspace(workspace: WorkspaceInfo, payload: Record<string, unknown>, preview: WorkspaceImportPlan): Promise<void> {
+  const input = normalizeWorkspaceImportPayload(workspace.path, payload);
+  const changed = new Set(
+    preview.changes
+      .filter((change) => change.action !== "unchanged")
+      .map((change) => `${change.kind}:${change.path}`),
+  );
+  const changedPath = (kind: string, path: string) => changed.has(`${kind}:${path}`);
+
+  if (
+    input.opencode !== undefined &&
+    changedPath("opencode", workspaceImportRelativePath(workspace, opencodeConfigPath(workspace.path)))
+  ) {
+    if (input.modes.opencode === "replace") {
+      await writeJsoncFile(opencodeConfigPath(workspace.path), input.opencode);
+    } else {
+      await updateJsoncTopLevel(opencodeConfigPath(workspace.path), input.opencode);
+    }
+  }
+
+  if (
+    input.openwork !== undefined &&
+    changedPath("openwork", workspaceImportRelativePath(workspace, openworkConfigPath(workspace.path)))
+  ) {
+    if (input.modes.openwork === "replace") {
+      await writeOpenworkConfig(workspace.path, input.openwork, false);
+    } else {
+      await writeOpenworkConfig(workspace.path, input.openwork, true);
+    }
+  }
+
+  if (input.sections.skills) {
+    for (const skill of input.skills) {
+      const path = workspaceImportRelativePath(workspace, join(projectSkillsDir(workspace.path), skill.name, "SKILL.md"));
+      if (!changedPath("skill", path)) continue;
+      await upsertSkill(workspace.path, skill);
+    }
+    if (input.modes.skills === "replace") {
+      for (const change of preview.changes) {
+        if (change.kind === "skill" && change.action === "delete") {
+          await rm(change.absolutePath, { recursive: true, force: true });
+        }
+      }
+    }
+  }
+
+  if (input.sections.commands) {
+    for (const command of input.commands) {
+      const path = workspaceImportRelativePath(workspace, join(projectCommandsDir(workspace.path), `${command.name}.md`));
+      if (!changedPath("command", path)) continue;
+      await upsertCommand(workspace.path, command);
+    }
+    if (input.modes.commands === "replace") {
+      for (const change of preview.changes) {
+        if (change.kind === "command" && change.action === "delete") {
+          await rm(change.absolutePath, { force: true });
+        }
+      }
+    }
+  }
+
+  if (input.sections.files) {
+    for (const file of input.files) {
+      if (!changedPath("file", file.path)) continue;
+      const path = join(workspace.path, file.path);
+      await ensureDir(dirname(path));
+      await writeFile(path, file.content, "utf8");
+    }
+    if (input.modes.files === "replace") {
+      for (const change of preview.changes) {
+        if (change.kind === "file" && change.action === "delete") {
+          await rm(change.absolutePath, { force: true });
+        }
+      }
+    }
+  }
+}
+
+async function materializeBlueprintSessions(config: ServerConfig, workspace: WorkspaceInfo): Promise<{
+  ok: boolean;
+  created: Array<{ templateId: string; sessionId: string; title: string }>;
+  existing: Array<{ templateId: string; sessionId: string }>;
+  openSessionId: string | null;
+}> {
+  const openwork = await readOpenworkConfig(workspace.path);
+  const templates = normalizeBlueprintSessionTemplates(openwork);
+  if (!templates.length) {
+    return { ok: true, created: [], existing: [], openSessionId: null };
+  }
+
+  const existing = readMaterializedBlueprintSessions(openwork);
+  if (existing.length > 0) {
+    const preferredTemplate = templates.find((template) => template.openOnFirstLoad) ?? templates[0] ?? null;
+    const openSessionId = preferredTemplate
+      ? existing.find((item) => item.templateId === preferredTemplate.id)?.sessionId ?? existing[0]?.sessionId ?? null
+      : existing[0]?.sessionId ?? null;
+    return { ok: true, created: [], existing, openSessionId };
+  }
+
+  const created: Array<{ templateId: string; sessionId: string; title: string }> = [];
+  for (const template of templates) {
+    const result = await fetchOpencodeJson(config, workspace, "/session", {
+      method: "POST",
+      body: template.title ? { title: template.title } : undefined,
+    });
+    const sessionId =
+      result && typeof result === "object" && "id" in result && typeof result.id === "string" ? result.id.trim() : "";
+    if (!sessionId) {
+      throw new ApiError(502, "opencode_failed", "OpenCode session did not return an id");
+    }
+    seedOpencodeSessionMessages({
+      sessionId,
+      workspaceRoot: resolveOpencodeDirectory(workspace) ?? workspace.path,
+      messages: template.messages,
+    });
+    created.push({ templateId: template.id, sessionId, title: template.title });
+  }
+
+  const now = Date.now();
+  const nextOpenwork = applyMaterializedBlueprintSessions(
+    openwork,
+    created.map(({ templateId, sessionId }) => ({ templateId, sessionId })),
+    now,
+  );
+  await writeOpenworkConfig(workspace.path, nextOpenwork, false);
+
+  const preferredTemplate = templates.find((template) => template.openOnFirstLoad) ?? templates[0] ?? null;
+  const openSessionId = preferredTemplate
+    ? created.find((item) => item.templateId === preferredTemplate.id)?.sessionId ?? created[0]?.sessionId ?? null
+    : created[0]?.sessionId ?? null;
+
+  return { ok: true, created, existing: [], openSessionId };
+}
diff --git a/apps/server/src/session-read-model.e2e.test.ts b/apps/server/src/session-read-model.e2e.test.ts
new file mode 100644
index 0000000000..d6e79ccf24
--- /dev/null
+++ b/apps/server/src/session-read-model.e2e.test.ts
@@ -0,0 +1,303 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { startServer } from "./server.js";
+import type { ServerConfig } from "./types.js";
+
+type Served = {
+  port: number;
+  stop: (closeActiveConnections?: boolean) => void | Promise<void>;
+};
+
+const stops: Array<() => void | Promise<void>> = [];
+const roots: string[] = [];
+
+afterEach(async () => {
+  while (stops.length) {
+    await stops.pop()?.();
+  }
+  while (roots.length) {
+    await rm(roots.pop()!, { recursive: true, force: true });
+  }
+});
+
+async function createWorkspaceRoot() {
+  const root = await mkdtemp(join(tmpdir(), "openwork-session-read-"));
+  await mkdir(join(root, ".opencode"), { recursive: true });
+  roots.push(root);
+  return root;
+}
+
+function auth(token: string) {
+  return { Authorization: `Bearer ${token}` };
+}
+
+function startMockOpencode(input?: { invalidList?: boolean; holdCommand?: Promise<void> }) {
+  const requests: Array<{ pathname: string; search: string; directory: string | null }> = [];
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    async fetch(request) {
+      const url = new URL(request.url);
+      requests.push({
+        pathname: url.pathname,
+        search: url.search,
+        directory: request.headers.get("x-opencode-directory"),
+      });
+
+      if (url.pathname === "/session") {
+        if (input?.invalidList) {
+          return Response.json({ nope: true });
+        }
+        return Response.json([
+          {
+            id: "ses_1",
+            title: "Hostname Check",
+            slug: "hostname-check",
+            directory: request.headers.get("x-opencode-directory"),
+            time: { created: 100, updated: 200 },
+          },
+        ]);
+      }
+
+      if (url.pathname === "/session/status") {
+        return Response.json({ ses_1: { type: "busy" } });
+      }
+
+      if (url.pathname === "/session/ses_1") {
+        return Response.json({
+          id: "ses_1",
+          title: "Hostname Check",
+          slug: "hostname-check",
+          directory: request.headers.get("x-opencode-directory"),
+          time: { created: 100, updated: 200 },
+        });
+      }
+
+      if (url.pathname === "/session/ses_1/message") {
+        return Response.json([
+          {
+            info: {
+              id: "msg_1",
+              sessionID: "ses_1",
+              role: "assistant",
+              time: { created: 200 },
+            },
+            parts: [
+              {
+                id: "prt_1",
+                messageID: "msg_1",
+                sessionID: "ses_1",
+                type: "text",
+                text: "hostname: mock-host",
+              },
+            ],
+          },
+        ]);
+      }
+
+      if (url.pathname === "/session/ses_1/todo") {
+        return Response.json([
+          {
+            content: "Validate session reads",
+            status: "completed",
+            priority: "high",
+          },
+        ]);
+      }
+
+      if (url.pathname === "/session/ses_1/command" && request.method === "POST") {
+        await input?.holdCommand;
+        return Response.json({ ok: true });
+      }
+
+      return Response.json({ code: "not_found", message: "Not found" }, { status: 404 });
+    },
+  }) as Served;
+  stops.push(() => server.stop(true));
+  return { server, requests };
+}
+
+function startOpenworkServer(input: { workspaceRoot: string; opencodeBaseUrl: string }) {
+  const config: ServerConfig = {
+    host: "127.0.0.1",
+    port: 0,
+    token: "owt_test_token",
+    hostToken: "owt_host_token",
+    approval: { mode: "auto", timeoutMs: 1000 },
+    corsOrigins: ["*"],
+    workspaces: [
+      {
+        id: "ws_1",
+        name: "Workspace",
+        path: input.workspaceRoot,
+        preset: "starter",
+        workspaceType: "local",
+        baseUrl: input.opencodeBaseUrl,
+      },
+    ],
+    authorizedRoots: [input.workspaceRoot],
+    readOnly: true,
+    startedAt: Date.now(),
+    tokenSource: "cli",
+    hostTokenSource: "cli",
+    logFormat: "pretty",
+    logRequests: false,
+  };
+  const server = startServer(config) as Served;
+  stops.push(() => server.stop(true));
+  return { server, token: config.token };
+}
+
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>((next) => {
+    resolve = next;
+  });
+  return { promise, resolve };
+}
+
+async function waitUntil(predicate: () => boolean) {
+  for (let index = 0; index < 20; index++) {
+    if (predicate()) return true;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  return predicate();
+}
+
+describe("workspace session read APIs", () => {
+  test("lists sessions and returns session details, messages, and snapshot", async () => {
+    const workspaceRoot = await createWorkspaceRoot();
+    const mock = startMockOpencode();
+    const openwork = startOpenworkServer({
+      workspaceRoot,
+      opencodeBaseUrl: `http://127.0.0.1:${mock.server.port}`,
+    });
+
+    const base = `http://127.0.0.1:${openwork.server.port}`;
+
+    const listResponse = await fetch(`${base}/workspace/ws_1/sessions?roots=true&limit=1&search=host&start=10`, {
+      headers: auth(openwork.token),
+    });
+    expect(listResponse.status).toBe(200);
+    const listBody = await listResponse.json();
+    expect(listBody).toEqual({
+      items: [
+        {
+          id: "ses_1",
+          title: "Hostname Check",
+          slug: "hostname-check",
+          directory: workspaceRoot,
+          time: { created: 100, updated: 200 },
+        },
+      ],
+    });
+
+    const detailResponse = await fetch(`${base}/workspace/ws_1/sessions/ses_1`, {
+      headers: auth(openwork.token),
+    });
+    expect(detailResponse.status).toBe(200);
+    const detailBody = await detailResponse.json();
+    expect(detailBody.item.id).toBe("ses_1");
+    expect(detailBody.item.directory).toBe(workspaceRoot);
+
+    const messagesResponse = await fetch(`${base}/workspace/ws_1/sessions/ses_1/messages?limit=5`, {
+      headers: auth(openwork.token),
+    });
+    expect(messagesResponse.status).toBe(200);
+    const messagesBody = await messagesResponse.json();
+    expect(messagesBody.items).toHaveLength(1);
+    expect(messagesBody.items[0]?.info.id).toBe("msg_1");
+    expect(messagesBody.items[0]?.parts[0]?.text).toBe("hostname: mock-host");
+
+    const snapshotResponse = await fetch(`${base}/workspace/ws_1/sessions/ses_1/snapshot?limit=5`, {
+      headers: auth(openwork.token),
+    });
+    expect(snapshotResponse.status).toBe(200);
+    const snapshotBody = await snapshotResponse.json();
+    expect(snapshotBody.item.session.id).toBe("ses_1");
+    expect(snapshotBody.item.messages).toHaveLength(1);
+    expect(snapshotBody.item.todos).toEqual([
+      {
+        content: "Validate session reads",
+        status: "completed",
+        priority: "high",
+      },
+    ]);
+    expect(snapshotBody.item.status).toEqual({ type: "busy" });
+
+    const listRequest = mock.requests.find((request) => request.pathname === "/session");
+    expect(listRequest?.directory).toBe(workspaceRoot);
+    expect(listRequest?.search).toContain("roots=true");
+    expect(listRequest?.search).toContain("limit=1");
+    expect(listRequest?.search).toContain("search=host");
+    expect(listRequest?.search).toContain("start=10");
+
+  });
+
+  test("returns 404 when the upstream session is missing", async () => {
+    const workspaceRoot = await createWorkspaceRoot();
+    const mock = startMockOpencode();
+    const openwork = startOpenworkServer({
+      workspaceRoot,
+      opencodeBaseUrl: `http://127.0.0.1:${mock.server.port}`,
+    });
+
+    const response = await fetch(`http://127.0.0.1:${openwork.server.port}/workspace/ws_1/sessions/ses_missing/snapshot`, {
+      headers: auth(openwork.token),
+    });
+    expect(response.status).toBe(404);
+    await expect(response.json()).resolves.toMatchObject({
+      code: "session_not_found",
+      message: "Session not found",
+    });
+
+  });
+
+  test("acknowledges proxied session commands before upstream completion", async () => {
+    const workspaceRoot = await createWorkspaceRoot();
+    const command = deferred();
+    const mock = startMockOpencode({ holdCommand: command.promise });
+    const openwork = startOpenworkServer({
+      workspaceRoot,
+      opencodeBaseUrl: `http://127.0.0.1:${mock.server.port}`,
+    });
+
+    const response = await Promise.race([
+      fetch(`http://127.0.0.1:${openwork.server.port}/w/ws_1/opencode/session/ses_1/command`, {
+        method: "POST",
+        headers: { ...auth(openwork.token), "Content-Type": "application/json" },
+        body: JSON.stringify({ command: "review", arguments: "" }),
+      }),
+      new Promise<"timeout">((resolve) => setTimeout(() => resolve("timeout"), 100)),
+    ]);
+
+    expect(response).not.toBe("timeout");
+    expect(response instanceof Response ? response.status : 0).toBe(200);
+    await expect(response instanceof Response ? response.json() : null).resolves.toMatchObject({ accepted: true });
+    const sawCommand = await waitUntil(() => mock.requests.some((request) => request.pathname === "/session/ses_1/command"));
+    command.resolve();
+    expect(sawCommand).toBe(true);
+  });
+
+  test("returns 502 when OpenCode returns an invalid session list payload", async () => {
+    const workspaceRoot = await createWorkspaceRoot();
+    const mock = startMockOpencode({ invalidList: true });
+    const openwork = startOpenworkServer({
+      workspaceRoot,
+      opencodeBaseUrl: `http://127.0.0.1:${mock.server.port}`,
+    });
+
+    const response = await fetch(`http://127.0.0.1:${openwork.server.port}/workspace/ws_1/sessions`, {
+      headers: auth(openwork.token),
+    });
+    expect(response.status).toBe(502);
+    await expect(response.json()).resolves.toMatchObject({
+      code: "opencode_invalid_response",
+      message: "OpenCode returned invalid session list",
+    });
+
+  });
+});
diff --git a/apps/server/src/session-read-model.ts b/apps/server/src/session-read-model.ts
new file mode 100644
index 0000000000..8fbe3d85cf
--- /dev/null
+++ b/apps/server/src/session-read-model.ts
@@ -0,0 +1,141 @@
+import { z } from "zod";
+
+import { ApiError } from "./errors.js";
+
+const sessionTimeSchema = z
+  .object({
+    created: z.number().optional(),
+    updated: z.number().optional(),
+    completed: z.number().optional(),
+    archived: z.number().optional(),
+  })
+  .passthrough();
+
+const sessionSummarySchema = z
+  .object({
+    additions: z.number().optional(),
+    deletions: z.number().optional(),
+    files: z.number().optional(),
+  })
+  .passthrough();
+
+export const sessionStatusSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("idle") }),
+  z.object({ type: z.literal("busy") }),
+  z.object({ type: z.literal("retry"), attempt: z.number(), message: z.string(), next: z.number() }),
+]);
+
+export const sessionTodoSchema = z
+  .object({
+    content: z.string(),
+    status: z.string(),
+    priority: z.string(),
+  })
+  .passthrough();
+
+export const sessionInfoSchema = z
+  .object({
+    id: z.string(),
+    title: z.string().nullish(),
+    slug: z.string().nullish(),
+    parentID: z.string().nullish(),
+    directory: z.string().nullish(),
+    time: sessionTimeSchema.optional(),
+    summary: sessionSummarySchema.optional(),
+  })
+  .passthrough();
+
+const sessionMessageInfoSchema = z
+  .object({
+    id: z.string(),
+    sessionID: z.string(),
+    role: z.string(),
+    parentID: z.string().nullish(),
+    time: sessionTimeSchema.optional(),
+  })
+  .passthrough();
+
+const sessionPartSchema = z
+  .object({
+    id: z.string(),
+    messageID: z.string(),
+    sessionID: z.string(),
+  })
+  .passthrough();
+
+export const sessionMessageSchema = z
+  .object({
+    info: sessionMessageInfoSchema,
+    parts: z.array(sessionPartSchema),
+  })
+  .passthrough();
+
+const sessionListSchema = z.array(sessionInfoSchema);
+const sessionMessagesSchema = z.array(sessionMessageSchema);
+const sessionTodosSchema = z.array(sessionTodoSchema);
+const sessionStatusesSchema = z.record(z.string(), sessionStatusSchema);
+
+const sessionSnapshotSchema = z.object({
+  session: sessionInfoSchema,
+  messages: sessionMessagesSchema,
+  todos: sessionTodosSchema,
+  status: sessionStatusSchema,
+});
+
+export type SessionInfoReadModel = z.infer<typeof sessionInfoSchema>;
+export type SessionMessageReadModel = z.infer<typeof sessionMessageSchema>;
+export type SessionTodoReadModel = z.infer<typeof sessionTodoSchema>;
+export type SessionStatusReadModel = z.infer<typeof sessionStatusSchema>;
+export type SessionSnapshotReadModel = z.infer<typeof sessionSnapshotSchema>;
+
+const IDLE_STATUS: SessionStatusReadModel = { type: "idle" };
+
+function parseOrThrow<T>(schema: z.ZodType<T>, value: unknown, label: string): T {
+  const result = schema.safeParse(value);
+  if (result.success) return result.data;
+  throw new ApiError(502, "opencode_invalid_response", `OpenCode returned invalid ${label}`, {
+    issues: result.error.issues,
+  });
+}
+
+export function buildSessionList(value: unknown): SessionInfoReadModel[] {
+  return parseOrThrow(sessionListSchema, value, "session list");
+}
+
+export function buildSession(value: unknown): SessionInfoReadModel {
+  return parseOrThrow(sessionInfoSchema, value, "session");
+}
+
+export function buildSessionMessages(value: unknown): SessionMessageReadModel[] {
+  return parseOrThrow(sessionMessagesSchema, value, "session messages");
+}
+
+export function buildSessionTodos(value: unknown): SessionTodoReadModel[] {
+  return parseOrThrow(sessionTodosSchema, value, "session todos");
+}
+
+export function buildSessionStatuses(value: unknown): Record<string, SessionStatusReadModel> {
+  return parseOrThrow(sessionStatusesSchema, value, "session statuses");
+}
+
+export function buildSessionSnapshot(input: {
+  session: unknown;
+  messages: unknown;
+  todos: unknown;
+  statuses: unknown;
+}): SessionSnapshotReadModel {
+  const session = buildSession(input.session);
+  const messages = buildSessionMessages(input.messages);
+  const todos = buildSessionTodos(input.todos);
+  const statuses = buildSessionStatuses(input.statuses);
+  return parseOrThrow(
+    sessionSnapshotSchema,
+    {
+      session,
+      messages,
+      todos,
+      status: statuses[session.id] ?? IDLE_STATUS,
+    },
+    "session snapshot",
+  );
+}
diff --git a/apps/server/src/share-bundles.test.ts b/apps/server/src/share-bundles.test.ts
new file mode 100644
index 0000000000..85475d7ea7
--- /dev/null
+++ b/apps/server/src/share-bundles.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+
+import { ApiError } from "./errors.js";
+import { normalizeSharedBundleFetchUrl, resolveTrustedSharedBundleFetchUrl } from "./share-bundles.js";
+
+const VALID_SKILL_BUNDLE_ID = "01KNBQDQAK41VZSZDF5G9MW4MW";
+const VALID_SKILL_SHARE_URL = `https://share.openworklabs.com/b/${VALID_SKILL_BUNDLE_ID}`;
+const VALID_SKILL_DATA_URL = `${VALID_SKILL_SHARE_URL}/data`;
+
+describe("normalizeSharedBundleFetchUrl", () => {
+  test("rewrites human share pages to the canonical data endpoint", () => {
+    const normalized = normalizeSharedBundleFetchUrl(new URL(`${VALID_SKILL_SHARE_URL}?format=json`));
+
+    expect(normalized.toString()).toBe(VALID_SKILL_DATA_URL);
+  });
+
+  test("keeps existing data endpoints and strips redundant format", () => {
+    const normalized = normalizeSharedBundleFetchUrl(new URL(`${VALID_SKILL_DATA_URL}?format=json&download=1`));
+
+    expect(normalized.toString()).toBe(`${VALID_SKILL_DATA_URL}?download=1`);
+  });
+});
+
+describe("resolveTrustedSharedBundleFetchUrl", () => {
+  test("rebuilds fetch URLs from the configured publisher origin", () => {
+    const resolved = resolveTrustedSharedBundleFetchUrl(`${VALID_SKILL_SHARE_URL}?download=1`);
+
+    expect(resolved.toString()).toBe(VALID_SKILL_DATA_URL);
+  });
+
+  test("rejects bundle URLs that use another origin", () => {
+    expect(() => resolveTrustedSharedBundleFetchUrl(`https://evil.example/b/${VALID_SKILL_BUNDLE_ID}`)).toThrow(
+      new ApiError(
+        400,
+        "untrusted_bundle_url",
+        "Shared bundle URLs must use the configured OpenWork publisher (https://share.openworklabs.com). Import only bundles from trusted sources.",
+      ),
+    );
+  });
+
+  test("rejects bundle URLs without a bundle id path", () => {
+    expect(() => resolveTrustedSharedBundleFetchUrl("https://share.openworklabs.com/not-a-bundle")).toThrow(
+      new ApiError(400, "invalid_bundle_url", "Shared bundle URL must point to a bundle id"),
+    );
+  });
+});
diff --git a/apps/server/src/share-bundles.ts b/apps/server/src/share-bundles.ts
new file mode 100644
index 0000000000..43131cc8e6
--- /dev/null
+++ b/apps/server/src/share-bundles.ts
@@ -0,0 +1,176 @@
+import { ApiError } from "./errors.js";
+
+type PublishBundleInput = {
+  payload: unknown;
+  bundleType: string;
+  name?: string;
+  timeoutMs?: number;
+};
+
+const DEFAULT_PUBLISHER_BASE_URL = String(process.env.OPENWORK_PUBLISHER_BASE_URL ?? "").trim() || "https://share.openworklabs.com";
+const DEFAULT_PUBLISHER_ORIGIN = String(process.env.OPENWORK_PUBLISHER_REQUEST_ORIGIN ?? "").trim() || "https://app.openwork.software";
+const ALLOWED_BUNDLE_TYPES = new Set(["skill", "skills-set"]);
+
+export function normalizeSharedBundleFetchUrl(input: URL): URL {
+  const url = new URL(input.toString());
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments[0] === "b" && segments[1] && segments.length === 2) {
+    url.pathname = `/b/${segments[1]}/data`;
+    url.searchParams.delete("format");
+  } else if (segments[0] === "b" && segments[1] && segments[2] === "data") {
+    url.searchParams.delete("format");
+  }
+  return url;
+}
+
+function normalizeBaseUrl(input: unknown): string {
+  const trimmed = String(input ?? "").trim();
+  if (!trimmed) {
+    throw new ApiError(500, "publisher_base_url_missing", "Publisher base URL is required");
+  }
+  return trimmed.replace(/\/+$/, "");
+}
+
+function resolvePublisherBaseUrl(): string {
+  return normalizeBaseUrl(DEFAULT_PUBLISHER_BASE_URL);
+}
+
+function extractBundleId(url: URL): string {
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments[0] === "b" && segments[1] && (segments.length === 2 || (segments.length === 3 && segments[2] === "data"))) {
+    return segments[1];
+  }
+  throw new ApiError(400, "invalid_bundle_url", "Shared bundle URL must point to a bundle id");
+}
+
+export function resolveTrustedSharedBundleFetchUrl(bundleUrl: unknown): URL {
+  let inputUrl: URL;
+  try {
+    inputUrl = new URL(String(bundleUrl ?? "").trim());
+  } catch {
+    throw new ApiError(400, "invalid_bundle_url", "Invalid shared bundle URL");
+  }
+
+  if (inputUrl.protocol !== "https:" && inputUrl.protocol !== "http:") {
+    throw new ApiError(400, "invalid_bundle_url", "Shared bundle URL must use http(s)");
+  }
+
+  const trustedBaseUrl = new URL(resolvePublisherBaseUrl());
+  if (inputUrl.origin !== trustedBaseUrl.origin) {
+    throw new ApiError(
+      400,
+      "untrusted_bundle_url",
+      `Shared bundle URLs must use the configured OpenWork publisher (${trustedBaseUrl.origin}). Import only bundles from trusted sources.`,
+    );
+  }
+
+  const bundleId = extractBundleId(inputUrl);
+  trustedBaseUrl.pathname = `/b/${bundleId}/data`;
+  trustedBaseUrl.search = "";
+  return trustedBaseUrl;
+}
+
+async function readErrorMessage(response: Response): Promise<string> {
+  try {
+    const text = await response.text();
+    if (!text.trim()) return "";
+    try {
+      const json = JSON.parse(text) as Record<string, unknown>;
+      if (typeof json.message === "string" && json.message.trim()) {
+        return json.message.trim();
+      }
+    } catch {
+      // ignore
+    }
+    return text.trim();
+  } catch {
+    return "";
+  }
+}
+
+export async function publishSharedBundle(input: PublishBundleInput): Promise<{ url: string }> {
+  const bundleType = String(input.bundleType ?? "").trim();
+  if (!ALLOWED_BUNDLE_TYPES.has(bundleType)) {
+    throw new ApiError(400, "invalid_bundle_type", `Unsupported bundle type: ${bundleType || "unknown"}`);
+  }
+
+  const baseUrl = resolvePublisherBaseUrl();
+  const timeoutMs = typeof input.timeoutMs === "number" && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 15_000;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), Math.max(1_000, timeoutMs));
+
+  try {
+    const response = await fetch(`${baseUrl}/v1/bundles`, {
+      method: "POST",
+      redirect: "manual",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Origin: DEFAULT_PUBLISHER_ORIGIN,
+        "X-OpenWork-Bundle-Type": bundleType,
+        "X-OpenWork-Schema-Version": "v1",
+        ...(input.name?.trim() ? { "X-OpenWork-Name": input.name.trim() } : {}),
+      },
+      body: JSON.stringify(input.payload),
+      signal: controller.signal,
+    });
+
+    if (response.status >= 300 && response.status < 400) {
+      throw new ApiError(502, "bundle_publish_failed", "Publisher redirects are not allowed");
+    }
+
+    if (!response.ok) {
+      const details = await readErrorMessage(response);
+      const suffix = details ? `: ${details}` : "";
+      throw new ApiError(502, "bundle_publish_failed", `Publish failed (${response.status})${suffix}`);
+    }
+
+    const json = (await response.json()) as Record<string, unknown>;
+    const url = typeof json.url === "string" ? json.url.trim() : "";
+    if (!url) {
+      throw new ApiError(502, "bundle_publish_failed", "Publisher response missing url");
+    }
+    return { url };
+  } catch (error) {
+    if (error instanceof ApiError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ApiError(502, "bundle_publish_failed", `Failed to publish bundle: ${message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function fetchSharedBundle(bundleUrl: unknown, options?: { timeoutMs?: number }): Promise<unknown> {
+  const url = resolveTrustedSharedBundleFetchUrl(bundleUrl);
+
+  const timeoutMs = typeof options?.timeoutMs === "number" && Number.isFinite(options.timeoutMs) ? options.timeoutMs : 15_000;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), Math.max(1_000, timeoutMs));
+
+  try {
+    const response = await fetch(url.toString(), {
+      method: "GET",
+      redirect: "manual",
+      headers: { Accept: "application/json" },
+      signal: controller.signal,
+    });
+
+    if (response.status >= 300 && response.status < 400) {
+      throw new ApiError(502, "bundle_fetch_failed", "Shared bundle redirects are not allowed");
+    }
+
+    if (!response.ok) {
+      const details = await readErrorMessage(response);
+      const suffix = details ? `: ${details}` : "";
+      throw new ApiError(502, "bundle_fetch_failed", `Failed to fetch bundle (${response.status})${suffix}`);
+    }
+
+    return await response.json();
+  } catch (error) {
+    if (error instanceof ApiError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ApiError(502, "bundle_fetch_failed", `Failed to fetch bundle: ${message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
diff --git a/apps/server/src/skill-hub.ts b/apps/server/src/skill-hub.ts
new file mode 100644
index 0000000000..9f3c3be104
--- /dev/null
+++ b/apps/server/src/skill-hub.ts
@@ -0,0 +1,263 @@
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+
+import type { HubSkillItem } from "./types.js";
+import { ApiError } from "./errors.js";
+import { parseFrontmatter } from "./frontmatter.js";
+import { exists } from "./utils.js";
+import { validateSkillName } from "./validators.js";
+import { projectSkillsDir } from "./workspace-files.js";
+
+type HubRepo = { owner: string; repo: string; ref: string };
+
+const DEFAULT_HUB_REPO: HubRepo = {
+  owner: "different-ai",
+  repo: "openwork-hub",
+  ref: "main",
+};
+
+const CATALOG_TTL_MS = 5 * 60 * 1000;
+const cachedCatalogByRepo = new Map<string, { at: number; items: HubSkillItem[] }>();
+
+function hubRepoKey(repo: HubRepo) {
+  return `${repo.owner}/${repo.repo}@${repo.ref}`;
+}
+
+function hubApiBase(repo: HubRepo) {
+  return `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}`;
+}
+
+function hubRawBase(repo: HubRepo) {
+  return `https://raw.githubusercontent.com/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.repo)}/${encodeURIComponent(repo.ref)}`;
+}
+
+async function fetchJson(url: string): Promise<any> {
+  const res = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "openwork-server",
+    },
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ApiError(502, "hub_fetch_failed", `Failed to fetch hub data (${res.status}): ${text || url}`);
+  }
+  return res.json();
+}
+
+async function fetchText(url: string): Promise<string> {
+  const res = await fetch(url, {
+    headers: {
+      Accept: "text/plain",
+      "User-Agent": "openwork-server",
+    },
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ApiError(502, "hub_fetch_failed", `Failed to fetch hub data (${res.status}): ${text || url}`);
+  }
+  return res.text();
+}
+
+function extractTriggerFromBody(body: string) {
+  const lines = body.split(/\r?\n/);
+  let inWhenSection = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    if (/^#{1,6}\s+/.test(trimmed)) {
+      const heading = trimmed.replace(/^#{1,6}\s+/, "").trim();
+      inWhenSection = /^when to use$/i.test(heading);
+      continue;
+    }
+
+    if (!inWhenSection) continue;
+
+    const cleaned = trimmed
+      .replace(/^[-*+]\s+/, "")
+      .replace(/^\d+[.)]\s+/, "")
+      .trim();
+    if (cleaned) return cleaned;
+  }
+  return "";
+}
+
+async function mapWithConcurrency<T, R>(
+  items: T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results: R[] = new Array(items.length);
+  let idx = 0;
+  const workers = new Array(Math.min(limit, items.length)).fill(0).map(async () => {
+    while (idx < items.length) {
+      const current = idx++;
+      results[current] = await fn(items[current]!, current);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
+export async function listHubSkills(repo: HubRepo = DEFAULT_HUB_REPO): Promise<HubSkillItem[]> {
+  const now = Date.now();
+  const repoKey = hubRepoKey(repo);
+  const cachedCatalog = cachedCatalogByRepo.get(repoKey);
+  if (cachedCatalog && now - cachedCatalog.at < CATALOG_TTL_MS) {
+    return cachedCatalog.items;
+  }
+
+  const listing = await fetchJson(`${hubApiBase(repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`);
+  const dirs = Array.isArray(listing)
+    ? listing
+        .filter((entry) => entry && typeof entry === "object" && entry.type === "dir" && typeof entry.name === "string")
+        .map((entry) => String(entry.name))
+    : [];
+
+  const rawBase = hubRawBase(repo);
+  const items = await mapWithConcurrency<string, HubSkillItem | null>(dirs, 6, async (dirName) => {
+    try {
+      const skillName = dirName.trim();
+      validateSkillName(skillName);
+      const skillMd = await fetchText(`${rawBase}/skills/${encodeURIComponent(skillName)}/SKILL.md`);
+      const { data, body } = parseFrontmatter(skillMd);
+      const name = typeof data.name === "string" ? data.name : skillName;
+      const descriptionRaw = typeof data.description === "string" ? data.description : "";
+      const triggerRaw =
+        typeof data.trigger === "string"
+          ? data.trigger
+          : typeof data.when === "string"
+            ? data.when
+            : extractTriggerFromBody(body);
+
+      if (name !== skillName) {
+        return null;
+      }
+
+      const description = descriptionRaw.replace(/\s+/g, " ").trim().slice(0, 1024);
+      const trigger = triggerRaw?.trim() || "";
+      const item: HubSkillItem = {
+        name,
+        description,
+        ...(trigger ? { trigger } : {}),
+        source: {
+          owner: repo.owner,
+          repo: repo.repo,
+          ref: repo.ref,
+          path: `skills/${skillName}`,
+        },
+      };
+      return item;
+    } catch {
+      return null;
+    }
+  });
+
+  const sorted = items
+    .filter((item): item is HubSkillItem => item != null)
+    .slice()
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  cachedCatalogByRepo.set(repoKey, { at: now, items: sorted });
+  return sorted;
+}
+
+type HubTreeEntry = {
+  path?: string;
+  mode?: string;
+  type?: string;
+};
+
+function resolveSafeChild(baseDir: string, child: string): string {
+  const base = resolve(baseDir);
+  const target = resolve(baseDir, child);
+  if (target === base) return target;
+  if (!target.startsWith(base + "/") && !target.startsWith(base + "\\")) {
+    throw new ApiError(400, "invalid_path", "Invalid file path");
+  }
+  return target;
+}
+
+export async function installHubSkill(
+  workspaceRoot: string,
+  input: { name: string; overwrite?: boolean; repo?: Partial<HubRepo> },
+): Promise<{ name: string; path: string; action: "added" | "updated"; written: number; skipped: number }> {
+  const name = input.name.trim();
+  validateSkillName(name);
+  const overwrite = Boolean(input.overwrite);
+
+  const repo: HubRepo = {
+    owner: input.repo?.owner?.trim() || DEFAULT_HUB_REPO.owner,
+    repo: input.repo?.repo?.trim() || DEFAULT_HUB_REPO.repo,
+    ref: input.repo?.ref?.trim() || DEFAULT_HUB_REPO.ref,
+  };
+
+  const prefix = `skills/${name}/`;
+  const baseDir = join(projectSkillsDir(workspaceRoot), name);
+  const skillMdPath = join(baseDir, "SKILL.md");
+  const existedBefore = await exists(skillMdPath);
+
+  await mkdir(baseDir, { recursive: true });
+
+  const tree = await fetchJson(`${hubApiBase(repo)}/git/trees/${encodeURIComponent(repo.ref)}?recursive=1`);
+  const entries: HubTreeEntry[] = Array.isArray(tree?.tree) ? tree.tree : [];
+  const files = entries
+    .filter((entry) => entry && entry.type === "blob" && typeof entry.path === "string" && entry.path.startsWith(prefix))
+    .map((entry) => ({
+      path: String(entry.path),
+      mode: typeof entry.mode === "string" ? entry.mode : "100644",
+    }));
+
+  if (!files.length) {
+    throw new ApiError(404, "hub_skill_not_found", `Hub skill not found: ${name}`);
+  }
+
+  let written = 0;
+  let skipped = 0;
+  const rawBase = hubRawBase(repo);
+
+  for (const file of files) {
+    const rel = file.path.slice(prefix.length);
+    if (!rel || rel.startsWith("/") || rel.includes("..")) {
+      continue;
+    }
+
+    const destPath = resolveSafeChild(baseDir, rel);
+    if (!overwrite && (await exists(destPath))) {
+      skipped += 1;
+      continue;
+    }
+
+    await mkdir(dirname(destPath), { recursive: true });
+    const res = await fetch(`${rawBase}/${file.path}`, {
+      headers: { "User-Agent": "openwork-server" },
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new ApiError(502, "hub_fetch_failed", `Failed to fetch hub file (${res.status}): ${text || file.path}`);
+    }
+    const buf = new Uint8Array(await res.arrayBuffer());
+    await writeFile(destPath, buf);
+
+    // Best-effort executable bit.
+    if (file.mode === "100755") {
+      await chmod(destPath, 0o755).catch(() => undefined);
+    }
+
+    written += 1;
+  }
+
+  // Ensure the canonical entrypoint exists.
+  if (!(await exists(skillMdPath))) {
+    throw new ApiError(502, "hub_install_failed", `Hub skill install failed (missing SKILL.md): ${name}`);
+  }
+
+  return {
+    name,
+    path: baseDir,
+    action: existedBefore ? "updated" : "added",
+    written,
+    skipped,
+  };
+}
diff --git a/apps/server/src/skills.ts b/apps/server/src/skills.ts
new file mode 100644
index 0000000000..44972e5bec
--- /dev/null
+++ b/apps/server/src/skills.ts
@@ -0,0 +1,215 @@
+import { readdir, readFile, writeFile, mkdir, rm } from "node:fs/promises";
+import type { Dirent } from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+import type { SkillItem } from "./types.js";
+import { parseFrontmatter, buildFrontmatter } from "./frontmatter.js";
+import { exists } from "./utils.js";
+import { validateDescription, validateSkillName } from "./validators.js";
+import { ApiError } from "./errors.js";
+import { projectSkillsDir } from "./workspace-files.js";
+
+async function findWorkspaceRoots(workspaceRoot: string): Promise<string[]> {
+  const roots: string[] = [];
+  let current = resolve(workspaceRoot);
+  while (true) {
+    roots.push(current);
+    const gitPath = join(current, ".git");
+    if (await exists(gitPath)) break;
+    const parent = resolve(current, "..");
+    if (parent === current) break;
+    current = parent;
+  }
+  return roots;
+}
+
+const extractTriggerFromBody = (body: string) => {
+  const lines = body.split(/\r?\n/);
+  let inWhenSection = false;
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+
+    if (/^#{1,6}\s+/.test(trimmed)) {
+      const heading = trimmed.replace(/^#{1,6}\s+/, "").trim();
+      inWhenSection = /^when to use$/i.test(heading);
+      continue;
+    }
+
+    if (!inWhenSection) continue;
+
+    const cleaned = trimmed
+      .replace(/^[-*+]\s+/, "")
+      .replace(/^\d+[.)]\s+/, "")
+      .trim();
+
+    if (cleaned) return cleaned;
+  }
+
+  return "";
+};
+
+async function parseSkillEntry(
+  skillPath: string,
+  entryName: string,
+  scope: "project" | "global",
+): Promise<SkillItem | null> {
+  const content = await readFile(skillPath, "utf8");
+  const { data, body } = parseFrontmatter(content);
+  const name = typeof data.name === "string" ? data.name : entryName;
+  const description = typeof data.description === "string" ? data.description : "";
+  const trigger =
+    typeof data.trigger === "string"
+      ? data.trigger
+      : typeof data.when === "string"
+        ? data.when
+        : extractTriggerFromBody(body);
+  try {
+    validateSkillName(name);
+    validateDescription(description);
+  } catch {
+    return null;
+  }
+  if (name !== entryName) return null;
+  return {
+    name,
+    description,
+    path: skillPath,
+    scope,
+    trigger: trigger.trim() || undefined,
+  };
+}
+
+async function listSkillsInDir(dir: string, scope: "project" | "global"): Promise<SkillItem[]> {
+  if (!(await exists(dir))) return [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  const items: SkillItem[] = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const skillPath = join(dir, entry.name, "SKILL.md");
+    if (await exists(skillPath)) {
+      // Direct skill: <dir>/<name>/SKILL.md
+      const item = await parseSkillEntry(skillPath, entry.name, scope);
+      if (item) items.push(item);
+    } else {
+      // Domain/category folder: <dir>/<domain>/<name>/SKILL.md – scan one level deeper.
+      // This supports the convention where global skills are organised as
+      //   skills/<domain>/<skill-name>/SKILL.md
+      // in addition to the flat   skills/<skill-name>/SKILL.md  layout.
+      const domainDir = join(dir, entry.name);
+      let subEntries: Dirent[];
+      try {
+        subEntries = await readdir(domainDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const subEntry of subEntries) {
+        if (!subEntry.isDirectory()) continue;
+        const subSkillPath = join(domainDir, subEntry.name, "SKILL.md");
+        if (!(await exists(subSkillPath))) continue;
+        const item = await parseSkillEntry(subSkillPath, subEntry.name, scope);
+        if (item) items.push(item);
+      }
+    }
+  }
+  return items;
+}
+
+export async function listSkills(workspaceRoot: string, includeGlobal: boolean): Promise<SkillItem[]> {
+  const roots = await findWorkspaceRoots(workspaceRoot);
+  const items: SkillItem[] = [];
+  for (const root of roots) {
+    const opencodeDir = join(root, ".opencode", "skills");
+    const claudeDir = join(root, ".claude", "skills");
+    items.push(...(await listSkillsInDir(opencodeDir, "project")));
+    items.push(...(await listSkillsInDir(claudeDir, "project")));
+  }
+
+  if (includeGlobal) {
+    const globalOpenWork = join(homedir(), ".config", "opencode", "skills");
+    const globalClaude = join(homedir(), ".claude", "skills");
+    const globalAgents = join(homedir(), ".agents", "skills");
+    const globalAgentLegacy = join(homedir(), ".agent", "skills");
+    items.push(...(await listSkillsInDir(globalOpenWork, "global")));
+    items.push(...(await listSkillsInDir(globalClaude, "global")));
+    items.push(...(await listSkillsInDir(globalAgents, "global")));
+    items.push(...(await listSkillsInDir(globalAgentLegacy, "global")));
+  }
+
+  const seen = new Set<string>();
+  return items.filter((item) => {
+    if (seen.has(item.name)) return false;
+    seen.add(item.name);
+    return true;
+  });
+}
+
+export type UpsertSkillPayload = {
+  name: string;
+  content: string;
+  description?: string;
+};
+
+export function buildSkillContent(payload: UpsertSkillPayload): { name: string; content: string } {
+  const name = payload.name.trim();
+  validateSkillName(name);
+  if (!payload.content) {
+    throw new ApiError(400, "invalid_skill_content", "Skill content is required");
+  }
+
+  let content = payload.content;
+  const { data, body } = parseFrontmatter(payload.content);
+  if (Object.keys(data).length > 0) {
+    const frontmatterName = typeof data.name === "string" ? data.name : "";
+    const frontmatterDescription = typeof data.description === "string" ? data.description : "";
+    if (frontmatterName && frontmatterName !== name) {
+      throw new ApiError(400, "invalid_skill_name", "Skill frontmatter name must match payload name");
+    }
+    validateDescription(frontmatterDescription || payload.description);
+    const nextDescription = frontmatterDescription || payload.description || "";
+    const frontmatter = buildFrontmatter({
+      ...data,
+      name,
+      description: nextDescription,
+    });
+    content = frontmatter + body.replace(/^\n/, "");
+  } else {
+    validateDescription(payload.description);
+    const frontmatter = buildFrontmatter({ name, description: payload.description });
+    content = frontmatter + payload.content.replace(/^\n/, "");
+  }
+
+  return {
+    name,
+    content: content.endsWith("\n") ? content : content + "\n",
+  };
+}
+
+export async function upsertSkill(
+  workspaceRoot: string,
+  payload: UpsertSkillPayload,
+): Promise<{ path: string; action: "added" | "updated" }> {
+  const skill = buildSkillContent(payload);
+
+  const baseDir = projectSkillsDir(workspaceRoot);
+  const skillDir = join(baseDir, skill.name);
+  await mkdir(skillDir, { recursive: true });
+  const skillPath = join(skillDir, "SKILL.md");
+  const existed = await exists(skillPath);
+  await writeFile(skillPath, skill.content, "utf8");
+  return { path: skillPath, action: existed ? "updated" : "added" };
+}
+
+export async function deleteSkill(workspaceRoot: string, name: string): Promise<{ path: string }> {
+  const trimmed = name.trim();
+  validateSkillName(trimmed);
+  const baseDir = projectSkillsDir(workspaceRoot);
+  const skillDir = join(baseDir, trimmed);
+  const skillPath = join(skillDir, "SKILL.md");
+  if (!(await exists(skillPath))) {
+    throw new ApiError(404, "skill_not_found", `Skill not found: ${trimmed}`);
+  }
+  await rm(skillDir, { recursive: true, force: true });
+  return { path: skillDir };
+}
diff --git a/apps/server/src/tokens.test.ts b/apps/server/src/tokens.test.ts
new file mode 100644
index 0000000000..a3cba5d001
--- /dev/null
+++ b/apps/server/src/tokens.test.ts
@@ -0,0 +1,103 @@
+import { describe, expect, test, beforeEach } from "bun:test";
+import { TokenService } from "./tokens.js";
+import type { ServerConfig } from "./types.js";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+function createTestConfig(): ServerConfig {
+  const tempDir = join(
+    tmpdir(),
+    `openwork-token-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  );
+  return {
+    host: "127.0.0.1",
+    port: 8787,
+    token: "test-client-token",
+    hostToken: "test-host-token",
+    configPath: join(tempDir, "server.json"),
+    approval: { mode: "auto", timeoutMs: 30000 },
+    corsOrigins: ["*"],
+    workspaces: [],
+    authorizedRoots: [],
+    readOnly: false,
+    startedAt: Date.now(),
+    tokenSource: "generated",
+    hostTokenSource: "generated",
+    logFormat: "pretty",
+    logRequests: false,
+  };
+}
+
+describe("TokenService", () => {
+  let service: TokenService;
+
+  beforeEach(() => {
+    service = new TokenService(createTestConfig());
+  });
+
+  test("starts with empty token list", async () => {
+    const list = await service.list();
+    expect(list).toEqual([]);
+  });
+
+  test("creates a token with correct scope", async () => {
+    const result = await service.create("collaborator");
+    expect(result.scope).toBe("collaborator");
+    expect(result.token).toMatch(/^owt_/);
+    expect(result.id).toBeTruthy();
+    expect(result.createdAt).toBeGreaterThan(0);
+  });
+
+  test("created token appears in list", async () => {
+    await service.create("owner", { label: "My token" });
+    const list = await service.list();
+    expect(list.length).toBe(1);
+    expect(list[0].scope).toBe("owner");
+    expect(list[0].label).toBe("My token");
+    // Hash should not be in the list output
+    expect((list[0] as Record<string, unknown>).hash).toBeUndefined();
+  });
+
+  test("resolves scope for created token", async () => {
+    const { token } = await service.create("viewer");
+    const scope = await service.scopeForToken(token);
+    expect(scope).toBe("viewer");
+  });
+
+  test("resolves scope for built-in client token", async () => {
+    const scope = await service.scopeForToken("test-client-token");
+    expect(scope).toBe("collaborator");
+  });
+
+  test("returns null for unknown token", async () => {
+    const scope = await service.scopeForToken("unknown-token");
+    expect(scope).toBeNull();
+  });
+
+  test("revokes a token", async () => {
+    const { id, token } = await service.create("collaborator");
+    const revoked = await service.revoke(id);
+    expect(revoked).toBe(true);
+
+    const scope = await service.scopeForToken(token);
+    expect(scope).toBeNull();
+  });
+
+  test("revoke returns false for non-existent token", async () => {
+    const revoked = await service.revoke("non-existent-id");
+    expect(revoked).toBe(false);
+  });
+
+  test("multiple tokens with different scopes", async () => {
+    const owner = await service.create("owner");
+    const collab = await service.create("collaborator");
+    const viewer = await service.create("viewer");
+
+    expect(await service.scopeForToken(owner.token)).toBe("owner");
+    expect(await service.scopeForToken(collab.token)).toBe("collaborator");
+    expect(await service.scopeForToken(viewer.token)).toBe("viewer");
+
+    const list = await service.list();
+    expect(list.length).toBe(3);
+  });
+});
diff --git a/apps/server/src/tokens.ts b/apps/server/src/tokens.ts
new file mode 100644
index 0000000000..1c8c82b924
--- /dev/null
+++ b/apps/server/src/tokens.ts
@@ -0,0 +1,149 @@
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+
+import type { ServerConfig, TokenScope } from "./types.js";
+import { ensureDir, exists, hashToken, shortId } from "./utils.js";
+
+export type TokenRecord = {
+  id: string;
+  hash: string;
+  scope: TokenScope;
+  createdAt: number;
+  label?: string;
+};
+
+type TokenStoreFile = {
+  schemaVersion: number;
+  updatedAt: number;
+  tokens: TokenRecord[];
+};
+
+function normalizeScope(value: unknown): TokenScope | null {
+  if (value === "owner" || value === "collaborator" || value === "viewer") return value;
+  return null;
+}
+
+function resolveTokenStorePath(config: ServerConfig): string {
+  const override = (process.env.OPENWORK_TOKEN_STORE ?? "").trim();
+  if (override) return resolve(override);
+
+  const configPath = config.configPath?.trim();
+  const configDir = configPath ? dirname(configPath) : join(homedir(), ".config", "openwork");
+  return join(configDir, "tokens.json");
+}
+
+async function readTokenStore(path: string): Promise<TokenStoreFile> {
+  if (!(await exists(path))) {
+    return { schemaVersion: 1, updatedAt: Date.now(), tokens: [] };
+  }
+  try {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw) as Partial<TokenStoreFile>;
+    const tokens = Array.isArray(parsed.tokens)
+      ? parsed.tokens
+        .map((token) => {
+          const record = token as Partial<TokenRecord>;
+          const id = typeof record.id === "string" ? record.id : "";
+          const hash = typeof record.hash === "string" ? record.hash : "";
+          const scope = normalizeScope(record.scope);
+          const createdAt = typeof record.createdAt === "number" ? record.createdAt : Date.now();
+          const label = typeof record.label === "string" ? record.label : undefined;
+          if (!id || !hash || !scope) return null;
+          const parsedRecord: TokenRecord = {
+            id,
+            hash,
+            scope,
+            createdAt,
+            ...(label ? { label } : {}),
+          };
+          return parsedRecord;
+        })
+        .filter((token): token is TokenRecord => Boolean(token))
+      : [];
+    return {
+      schemaVersion: typeof parsed.schemaVersion === "number" ? parsed.schemaVersion : 1,
+      updatedAt: typeof parsed.updatedAt === "number" ? parsed.updatedAt : Date.now(),
+      tokens,
+    };
+  } catch {
+    return { schemaVersion: 1, updatedAt: Date.now(), tokens: [] };
+  }
+}
+
+async function writeTokenStore(path: string, tokens: TokenRecord[]): Promise<void> {
+  await ensureDir(dirname(path));
+  const payload: TokenStoreFile = {
+    schemaVersion: 1,
+    updatedAt: Date.now(),
+    tokens,
+  };
+  await writeFile(path, JSON.stringify(payload, null, 2) + "\n", "utf8");
+}
+
+export class TokenService {
+  private config: ServerConfig;
+  private path: string;
+  private loaded = false;
+  private tokens: TokenRecord[] = [];
+  private byHash = new Map<string, TokenRecord>();
+
+  constructor(config: ServerConfig) {
+    this.config = config;
+    this.path = resolveTokenStorePath(config);
+  }
+
+  private async ensureLoaded(): Promise<void> {
+    if (this.loaded) return;
+    const store = await readTokenStore(this.path);
+    this.tokens = store.tokens;
+    this.byHash = new Map(store.tokens.map((token) => [token.hash, token]));
+    this.loaded = true;
+  }
+
+  async list(): Promise<Array<Omit<TokenRecord, "hash">>> {
+    await this.ensureLoaded();
+    return this.tokens.map(({ hash: _hash, ...rest }) => rest);
+  }
+
+  async create(scope: TokenScope, options?: { label?: string }): Promise<{ id: string; token: string; scope: TokenScope; createdAt: number; label?: string }> {
+    await this.ensureLoaded();
+
+    const id = shortId();
+    const token = `owt_${shortId().replace(/-/g, "")}`;
+    const createdAt = Date.now();
+    const record: TokenRecord = {
+      id,
+      hash: hashToken(token),
+      scope,
+      createdAt,
+      label: options?.label?.trim() || undefined,
+    };
+
+    this.tokens = [record, ...this.tokens];
+    this.byHash.set(record.hash, record);
+    await writeTokenStore(this.path, this.tokens);
+    return { id, token, scope, createdAt, label: record.label };
+  }
+
+  async revoke(id: string): Promise<boolean> {
+    await this.ensureLoaded();
+    const index = this.tokens.findIndex((token) => token.id === id);
+    if (index === -1) return false;
+    const [removed] = this.tokens.splice(index, 1);
+    if (removed) {
+      this.byHash.delete(removed.hash);
+    }
+    await writeTokenStore(this.path, this.tokens);
+    return true;
+  }
+
+  async scopeForToken(token: string): Promise<TokenScope | null> {
+    const trimmed = token.trim();
+    if (!trimmed) return null;
+    if (trimmed === this.config.token) return "collaborator";
+    await this.ensureLoaded();
+    const found = this.byHash.get(hashToken(trimmed));
+    return found?.scope ?? null;
+  }
+}
diff --git a/apps/server/src/toy-ui.ts b/apps/server/src/toy-ui.ts
new file mode 100644
index 0000000000..1e4c1ede02
--- /dev/null
+++ b/apps/server/src/toy-ui.ts
@@ -0,0 +1,1582 @@
+export const TOY_UI_CSS = `:root {
+  --bg: #0b1020;
+  --panel: rgba(255, 255, 255, 0.06);
+  --panel-2: rgba(255, 255, 255, 0.04);
+  --text: rgba(255, 255, 255, 0.92);
+  --muted: rgba(255, 255, 255, 0.68);
+  --muted-2: rgba(255, 255, 255, 0.5);
+  --border: rgba(255, 255, 255, 0.12);
+  --accent: #53b8ff;
+  --danger: #ff5b5b;
+  --ok: #51d69c;
+  --mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+  --sans: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, "Apple Color Emoji", "Segoe UI Emoji";
+}
+
+* { box-sizing: border-box; }
+
+html, body {
+  height: 100%;
+  margin: 0;
+  padding: 0;
+  font-family: var(--sans);
+  background: radial-gradient(1200px 900px at 20% 10%, rgba(83, 184, 255, 0.14), transparent 60%),
+    radial-gradient(900px 700px at 80% 0%, rgba(81, 214, 156, 0.1), transparent 55%),
+    linear-gradient(180deg, #080b16, var(--bg));
+  color: var(--text);
+}
+
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+.wrap {
+  max-width: 1100px;
+  margin: 0 auto;
+  padding: 24px 16px 48px;
+}
+
+.top {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 16px;
+}
+
+.title {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.title h1 {
+  margin: 0;
+  font-size: 18px;
+  letter-spacing: 0.2px;
+}
+
+.title .sub {
+  color: var(--muted);
+  font-size: 12px;
+}
+
+.grid {
+  display: grid;
+  grid-template-columns: 1.2fr 0.8fr;
+  gap: 14px;
+}
+
+@media (max-width: 940px) {
+  .grid { grid-template-columns: 1fr; }
+}
+
+.card {
+  background: linear-gradient(180deg, var(--panel), var(--panel-2));
+  border: 1px solid var(--border);
+  border-radius: 14px;
+  overflow: hidden;
+}
+
+.card h2 {
+  margin: 0;
+  padding: 12px 14px;
+  font-size: 13px;
+  letter-spacing: 0.2px;
+  color: rgba(255, 255, 255, 0.88);
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+}
+
+.card .body {
+  padding: 12px 14px;
+}
+
+.row {
+  display: flex;
+  gap: 10px;
+  flex-wrap: wrap;
+  align-items: center;
+}
+
+.pill {
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 3px 8px;
+  font-size: 11px;
+  color: var(--muted);
+}
+
+.pill.ok { border-color: rgba(81, 214, 156, 0.45); color: rgba(81, 214, 156, 0.95); }
+.pill.bad { border-color: rgba(255, 91, 91, 0.45); color: rgba(255, 91, 91, 0.92); }
+
+.muted { color: var(--muted); }
+.mono { font-family: var(--mono); }
+
+.chat {
+  height: 56vh;
+  min-height: 420px;
+  display: flex;
+  flex-direction: column;
+}
+
+.chatlog {
+  flex: 1;
+  overflow: auto;
+  padding: 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+
+.timeline {
+  border-bottom: 1px solid var(--border);
+  padding: 10px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+
+.timeline .list {
+  max-height: 160px;
+  overflow: auto;
+}
+
+.msg {
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 10px 10px;
+  background: rgba(0, 0, 0, 0.14);
+}
+
+.msg .meta {
+  font-size: 11px;
+  color: var(--muted-2);
+  display: flex;
+  justify-content: space-between;
+  gap: 10px;
+  margin-bottom: 6px;
+}
+
+.msg .content {
+  white-space: pre-wrap;
+  line-height: 1.35;
+  font-size: 13px;
+}
+
+.composer {
+  border-top: 1px solid var(--border);
+  padding: 12px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+
+.composer textarea {
+  width: 100%;
+  resize: vertical;
+  min-height: 80px;
+  max-height: 220px;
+  padding: 10px 10px;
+  border-radius: 12px;
+  border: 1px solid var(--border);
+  background: rgba(0, 0, 0, 0.18);
+  color: var(--text);
+  outline: none;
+  font-family: var(--sans);
+  font-size: 13px;
+}
+
+.composer textarea:focus { border-color: rgba(83, 184, 255, 0.45); }
+
+.input {
+  appearance: none;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 9px 10px;
+  background: rgba(0, 0, 0, 0.18);
+  color: var(--text);
+  font-size: 13px;
+  outline: none;
+}
+
+.input:focus { border-color: rgba(83, 184, 255, 0.45); }
+
+.btn {
+  appearance: none;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 9px 10px;
+  background: rgba(0, 0, 0, 0.18);
+  color: var(--text);
+  font-size: 13px;
+  cursor: pointer;
+}
+
+.btn:hover { border-color: rgba(83, 184, 255, 0.4); }
+.btn.primary { border-color: rgba(83, 184, 255, 0.6); background: rgba(83, 184, 255, 0.12); }
+.btn.danger { border-color: rgba(255, 91, 91, 0.6); background: rgba(255, 91, 91, 0.08); }
+
+.kv {
+  display: grid;
+  grid-template-columns: 140px 1fr;
+  gap: 8px 10px;
+  font-size: 12px;
+}
+
+.kv .k { color: var(--muted-2); }
+
+.codebox {
+  margin-top: 10px;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 10px;
+  background: rgba(0, 0, 0, 0.18);
+  font-family: var(--mono);
+  font-size: 11px;
+  white-space: pre-wrap;
+  line-height: 1.3;
+}
+
+.list {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.item {
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 10px;
+  background: rgba(0, 0, 0, 0.14);
+}
+
+.item .row { justify-content: space-between; }
+
+.small { font-size: 11px; color: var(--muted-2); }
+
+.hr { height: 1px; background: var(--border); margin: 10px 0; }
+
+.tabs {
+  display: flex;
+  gap: 6px;
+  flex-wrap: wrap;
+}
+
+.tab {
+  appearance: none;
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 6px 10px;
+  background: rgba(0, 0, 0, 0.12);
+  color: var(--muted);
+  font-size: 12px;
+  cursor: pointer;
+}
+
+.tab.active {
+  border-color: rgba(83, 184, 255, 0.6);
+  background: rgba(83, 184, 255, 0.12);
+  color: rgba(255, 255, 255, 0.92);
+}
+
+.panel { display: block; margin-top: 10px; }
+.panel.hidden { display: none; }
+.hidden { display: none !important; }
+
+.inputarea {
+  width: 100%;
+  resize: vertical;
+  min-height: 90px;
+  max-height: 260px;
+  padding: 10px 10px;
+  border-radius: 12px;
+  border: 1px solid var(--border);
+  background: rgba(0, 0, 0, 0.18);
+  color: var(--text);
+  outline: none;
+  font-family: var(--mono);
+  font-size: 11px;
+  line-height: 1.35;
+}
+
+.inputarea:focus { border-color: rgba(83, 184, 255, 0.45); }
+`;
+
+export const TOY_UI_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>OpenWork Toy UI</title>
+    <link rel="icon" type="image/svg+xml" href="/ui/assets/openwork-mark.svg" />
+    <link rel="stylesheet" href="/ui/assets/toy.css" />
+  </head>
+  <body>
+    <div class="wrap">
+      <div class="top">
+        <div class="title">
+          <h1>OpenWork Toy UI</h1>
+          <div class="sub">Local-first host contract harness (served by openwork-server)</div>
+        </div>
+        <div class="row">
+          <span class="pill" id="pill-conn">disconnected</span>
+          <span class="pill" id="pill-scope">scope: unknown</span>
+        </div>
+      </div>
+
+      <div class="grid">
+        <div class="card chat">
+          <h2>
+            <span>Session</span>
+            <span class="small mono" id="session-id">session: -</span>
+          </h2>
+          <div class="timeline">
+            <div class="row">
+              <span class="pill" id="pill-run">idle</span>
+              <span class="small" id="timeline-hint">Checkpoints stream from SSE events.</span>
+            </div>
+            <div class="list" id="timeline"></div>
+          </div>
+          <div class="chatlog" id="chatlog"></div>
+          <div class="composer">
+            <div class="row">
+              <button class="btn" id="btn-new">New session</button>
+              <button class="btn" id="btn-refresh">Refresh messages</button>
+              <button class="btn" id="btn-delete-session">Delete session</button>
+              <span class="small" id="hint">Tip: open this page as /w/&lt;id&gt;/ui#token=&lt;token&gt;</span>
+            </div>
+            <textarea id="prompt" placeholder="Write a prompt..." spellcheck="false"></textarea>
+            <div class="row">
+              <button class="btn primary" id="btn-send">Send prompt</button>
+              <button class="btn" id="btn-skill">Turn into skill</button>
+              <button class="btn" id="btn-events">Connect SSE</button>
+              <button class="btn" id="btn-events-stop">Stop SSE</button>
+              <span class="small" id="status"></span>
+            </div>
+          </div>
+        </div>
+
+        <div class="card">
+          <h2><span>Host</span><span class="small mono" id="host-id">-</span></h2>
+          <div class="body">
+            <div class="kv">
+              <div class="k">workspace</div>
+              <div class="mono" id="workspace-id">-</div>
+              <div class="k">workspace url</div>
+              <div><a class="mono" id="workspace-url" href="#" target="_blank" rel="noreferrer">-</a></div>
+              <div class="k">server</div>
+              <div class="mono" id="server-version">-</div>
+              <div class="k">sandbox</div>
+              <div class="mono" id="sandbox">-</div>
+              <div class="k">file injection</div>
+              <div class="mono" id="file-injection">-</div>
+            </div>
+
+            <div class="hr"></div>
+
+            <div class="tabs" id="tabs">
+              <button class="tab active" data-tab="share">Share</button>
+              <button class="tab" data-tab="skills">Skills</button>
+              <button class="tab" data-tab="plugins">Plugins</button>
+              <button class="tab" data-tab="apps">Apps</button>
+              <button class="tab" data-tab="config">Config</button>
+            </div>
+
+            <div class="panel" data-panel="share">
+              <div class="row">
+                <select class="input" id="share-scope">
+                  <option value="collaborator">collaborator</option>
+                  <option value="viewer">viewer</option>
+                </select>
+                <input class="input" id="share-label" type="text" placeholder="label (optional)" />
+                <button class="btn" id="btn-mint">Mint token</button>
+                <button class="btn" id="btn-deploy">Deploy (Beta)</button>
+              </div>
+              <div class="small">Minting tokens requires an owner token (or host access).</div>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn" id="btn-share">Connect artifact (current token)</button>
+                <button class="btn" id="btn-copy">Copy JSON</button>
+                <button class="btn" id="btn-tokens">List tokens</button>
+              </div>
+              <div class="codebox" id="connect"></div>
+              <div class="list" id="tokens"></div>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn" id="btn-export">Export workspace</button>
+              </div>
+              <div class="codebox" id="export"></div>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn" id="btn-import">Import workspace</button>
+                <span class="small">(pastes JSON below)</span>
+              </div>
+              <textarea class="inputarea" id="import" placeholder="Paste export JSON..." spellcheck="false"></textarea>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn danger" id="btn-delete-workspace">Delete workspace</button>
+                <span class="small">Removes from host config. Requires owner/host token.</span>
+              </div>
+            </div>
+
+            <div class="panel hidden" data-panel="skills">
+              <div class="row">
+                <button class="btn" id="btn-skills-refresh">Refresh</button>
+                <span class="small">Managed in <span class="mono">.opencode/skills/</span></span>
+              </div>
+              <div class="list" id="skills"></div>
+            </div>
+
+            <div class="panel hidden" data-panel="plugins">
+              <div class="row">
+                <input class="input" id="plugin-spec" type="text" placeholder="plugin spec" />
+                <button class="btn" id="btn-plugin-add">Add</button>
+                <button class="btn" id="btn-plugins-refresh">Refresh</button>
+              </div>
+              <div class="list" id="plugins"></div>
+            </div>
+
+            <div class="panel hidden" data-panel="apps">
+              <div class="row">
+                <button class="btn" id="btn-mcp-refresh">Refresh</button>
+                <span class="small">MCP servers from <span class="mono">opencode.json</span></span>
+              </div>
+              <div class="list" id="mcp"></div>
+            </div>
+
+            <div class="panel hidden" data-panel="config">
+              <div class="row">
+                <input id="file" type="file" />
+                <button class="btn" id="btn-upload">Upload to inbox</button>
+              </div>
+              <div class="small">Uploads go to <span class="mono">.opencode/openwork/inbox/</span> inside the workspace.</div>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn" id="btn-artifacts">List artifacts</button>
+                <span class="small">Downloads read from <span class="mono">.opencode/openwork/outbox/</span>.</span>
+              </div>
+              <div class="list" id="artifacts"></div>
+
+              <div class="hr"></div>
+
+              <div class="row">
+                <button class="btn" id="btn-approvals">Refresh approvals</button>
+                <span class="small">(Owner or host token required)</span>
+              </div>
+              <div class="list" id="approvals"></div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <script type="module" src="/ui/assets/toy.js"></script>
+  </body>
+</html>
+`;
+
+export const TOY_UI_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 834 649" fill="none"><path fill="#011627" d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z" /><path fill="#FFFFFF" d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z" /><path fill="#011627" d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z" /><path fill="#FFFFFF" d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z" /><path fill="#FFFFFF" d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z" /><path fill="#FFFFFF" d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z" /></svg>`;
+
+export const TOY_UI_JS = String.raw`const qs = (sel) => document.querySelector(sel);
+
+const pillConn = qs("#pill-conn");
+const pillScope = qs("#pill-scope");
+const chatlog = qs("#chatlog");
+const promptEl = qs("#prompt");
+const statusEl = qs("#status");
+const sessionIdEl = qs("#session-id");
+const workspaceIdEl = qs("#workspace-id");
+const serverVersionEl = qs("#server-version");
+const sandboxEl = qs("#sandbox");
+const fileInjectionEl = qs("#file-injection");
+const artifactsEl = qs("#artifacts");
+const approvalsEl = qs("#approvals");
+const connectEl = qs("#connect");
+const tokensEl = qs("#tokens");
+const exportEl = qs("#export");
+const importEl = qs("#import");
+const skillsEl = qs("#skills");
+const pluginsEl = qs("#plugins");
+const pluginSpecEl = qs("#plugin-spec");
+const mcpEl = qs("#mcp");
+const hostIdEl = qs("#host-id");
+const pillRun = qs("#pill-run");
+const timelineEl = qs("#timeline");
+const workspaceUrlEl = qs("#workspace-url");
+const shareScopeEl = qs("#share-scope");
+const shareLabelEl = qs("#share-label");
+const tabsEl = qs("#tabs");
+
+const STORAGE_TOKEN = "openwork.toy.token";
+const STORAGE_SESSION_PREFIX = "openwork.toy.session.";
+
+function setPill(el, label, kind) {
+  el.textContent = label;
+  el.classList.remove("ok", "bad");
+  if (kind) el.classList.add(kind);
+}
+
+function setRun(label, kind) {
+  if (!pillRun) return;
+  setPill(pillRun, label, kind);
+}
+
+function clearTimeline() {
+  if (!timelineEl) return;
+  timelineEl.innerHTML = "";
+}
+
+function summarizeEvent(payload) {
+  if (!payload || typeof payload !== "object") return "";
+  const keys = ["name", "tool", "action", "summary", "status", "message"];
+  for (const key of keys) {
+    const value = payload[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+
+function addCheckpoint(label, detail) {
+  if (!timelineEl) return;
+
+  const row = document.createElement("div");
+  row.className = "item";
+
+  const top = document.createElement("div");
+  top.className = "row";
+
+  const left = document.createElement("div");
+  const name = document.createElement("div");
+  name.className = "mono";
+  name.textContent = label;
+
+  const meta = document.createElement("div");
+  meta.className = "small";
+  meta.textContent = new Date().toLocaleTimeString();
+
+  left.appendChild(name);
+  left.appendChild(meta);
+  top.appendChild(left);
+  row.appendChild(top);
+
+  if (detail) {
+    const d = document.createElement("div");
+    d.className = "small";
+    d.textContent = detail;
+    row.appendChild(d);
+  }
+
+  timelineEl.appendChild(row);
+  timelineEl.scrollTop = timelineEl.scrollHeight;
+
+  while (timelineEl.children.length > 80) {
+    timelineEl.removeChild(timelineEl.firstChild);
+  }
+}
+
+let activeTab = "share";
+
+function setTab(tab) {
+  activeTab = tab;
+  if (tabsEl) {
+    const buttons = tabsEl.querySelectorAll(".tab");
+    buttons.forEach((btn) => {
+      const t = btn.getAttribute("data-tab") || "";
+      btn.classList.toggle("active", t === tab);
+    });
+  }
+
+  const panels = document.querySelectorAll(".panel");
+  panels.forEach((panel) => {
+    const t = panel.getAttribute("data-panel") || "";
+    panel.classList.toggle("hidden", t !== tab);
+  });
+}
+
+function getTokenFromHash() {
+  const raw = (location.hash || "").startsWith("#") ? (location.hash || "").slice(1) : (location.hash || "");
+  if (!raw) return "";
+  const params = new URLSearchParams(raw);
+  return (params.get("token") || "").trim();
+}
+
+function stripHashToken() {
+  const raw = (location.hash || "").startsWith("#") ? (location.hash || "").slice(1) : (location.hash || "");
+  if (!raw) return;
+  const params = new URLSearchParams(raw);
+  if (!params.has("token")) return;
+  params.delete("token");
+  const next = params.toString();
+  const url = location.pathname + location.search + (next ? "#" + next : "");
+  history.replaceState(null, "", url);
+}
+
+function readToken() {
+  const fromHash = getTokenFromHash();
+  if (fromHash) {
+    try { localStorage.setItem(STORAGE_TOKEN, fromHash); } catch {}
+    stripHashToken();
+    return fromHash;
+  }
+  try {
+    return (localStorage.getItem(STORAGE_TOKEN) || "").trim();
+  } catch {
+    return "";
+  }
+}
+
+function parseWorkspaceIdFromPath() {
+  const parts = location.pathname.split("/").filter(Boolean);
+  const wIndex = parts.indexOf("w");
+  if (wIndex !== -1 && parts[wIndex + 1]) return decodeURIComponent(parts[wIndex + 1]);
+  return "";
+}
+
+async function apiFetch(path, options) {
+  const token = readToken();
+  const opts = options || {};
+  const headers = new Headers(opts.headers || {});
+  if (!headers.has("Content-Type") && opts.body && !(opts.body instanceof FormData)) {
+    headers.set("Content-Type", "application/json");
+  }
+  if (token) headers.set("Authorization", "Bearer " + token);
+  const res = await fetch(path, { ...opts, headers });
+  const text = await res.text();
+  let json = null;
+  try { json = text ? JSON.parse(text) : null; } catch { json = null; }
+  if (!res.ok) {
+    const msg = json && json.message ? json.message : (text || res.statusText);
+    const code = json && json.code ? json.code : "request_failed";
+    const err = new Error(code + ": " + msg);
+    err.status = res.status;
+    err.code = code;
+    err.details = json && json.details ? json.details : undefined;
+    throw err;
+  }
+  return json;
+}
+
+function setStatus(msg, kind) {
+  statusEl.textContent = msg || "";
+  statusEl.style.color = kind === "bad" ? "var(--danger)" : kind === "ok" ? "var(--ok)" : "var(--muted)";
+}
+
+function appendMsg(role, text) {
+  const el = document.createElement("div");
+  el.className = "msg";
+  const meta = document.createElement("div");
+  meta.className = "meta";
+  meta.textContent = role;
+  const content = document.createElement("div");
+  content.className = "content";
+  content.textContent = text;
+  el.appendChild(meta);
+  el.appendChild(content);
+  chatlog.appendChild(el);
+  chatlog.scrollTop = chatlog.scrollHeight;
+}
+
+function renderMessages(items) {
+  chatlog.innerHTML = "";
+  if (!Array.isArray(items) || !items.length) {
+    appendMsg("system", "No messages yet.");
+    return;
+  }
+  for (const msg of items) {
+    const info = msg && msg.info ? msg.info : null;
+    const parts = Array.isArray(msg && msg.parts) ? msg.parts : [];
+    const role = info && info.role ? info.role : "message";
+    const textParts = parts
+      .filter((p) => p && p.type === "text" && typeof p.text === "string")
+      .map((p) => p.text);
+    const body = textParts.length ? textParts.join("\n") : JSON.stringify(parts, null, 2);
+    appendMsg(role, body);
+  }
+}
+
+function sessionKey(workspaceId) {
+  return STORAGE_SESSION_PREFIX + workspaceId;
+}
+
+function readSessionId(workspaceId) {
+  try { return (localStorage.getItem(sessionKey(workspaceId)) || "").trim(); } catch { return ""; }
+}
+
+function writeSessionId(workspaceId, sessionId) {
+  try { localStorage.setItem(sessionKey(workspaceId), sessionId); } catch {}
+}
+
+async function resolveDefaultModel(workspaceId) {
+  try {
+    const providers = await apiFetch("/w/" + encodeURIComponent(workspaceId) + "/opencode/config/providers");
+    const def = providers && providers.default ? providers.default : null;
+    if (def && typeof def === "object") {
+      const entries = Object.entries(def);
+      if (entries.length) {
+        const providerID = entries[0][0];
+        const modelID = entries[0][1];
+        if (providerID && modelID) return { providerID, modelID };
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
+async function ensureSession(workspaceId) {
+  const existing = readSessionId(workspaceId);
+  if (existing) return existing;
+  const created = await apiFetch("/w/" + encodeURIComponent(workspaceId) + "/opencode/session", {
+    method: "POST",
+    body: JSON.stringify({ title: "OpenWork Toy UI" }),
+  });
+  const id = created && created.id ? String(created.id) : "";
+  if (!id) throw new Error("session_create_failed");
+  writeSessionId(workspaceId, id);
+  return id;
+}
+
+async function refreshHost(workspaceId) {
+  const token = readToken();
+  if (!token) {
+    setPill(pillConn, "token missing", "bad");
+    setStatus("Add #token=... to the URL fragment", "bad");
+    return;
+  }
+  try {
+    const status = await apiFetch("/status");
+    const caps = await apiFetch("/capabilities");
+    hostIdEl.textContent = location.origin;
+    serverVersionEl.textContent = caps && caps.serverVersion ? caps.serverVersion : (status && status.version ? status.version : "-");
+    const sandbox = caps && caps.sandbox ? caps.sandbox : null;
+    sandboxEl.textContent = sandbox ? (sandbox.backend + " (" + (sandbox.enabled ? "on" : "off") + ")") : "-";
+    const files = caps && caps.toolProviders && caps.toolProviders.files ? caps.toolProviders.files : null;
+    fileInjectionEl.textContent = files ? ((files.injection ? "upload" : "no upload") + " / " + (files.outbox ? "download" : "no download")) : "-";
+    workspaceIdEl.textContent = workspaceId || "-";
+    setPill(pillConn, "connected", "ok");
+    setStatus("Connected", "ok");
+
+    try {
+      const me = await apiFetch("/whoami");
+      const scope = me && me.actor && me.actor.scope ? me.actor.scope : "unknown";
+      pillScope.textContent = "scope: " + scope;
+    } catch {
+      pillScope.textContent = "scope: unknown";
+    }
+  } catch (e) {
+    setPill(pillConn, "disconnected", "bad");
+    setStatus(e && e.message ? e.message : "Disconnected", "bad");
+  }
+}
+
+async function refreshMessages(workspaceId) {
+  const sessionId = readSessionId(workspaceId);
+  sessionIdEl.textContent = sessionId ? ("session: " + sessionId) : "session: -";
+  if (!sessionId) {
+    renderMessages([]);
+    return;
+  }
+  const url = "/w/" + encodeURIComponent(workspaceId) + "/opencode/session/" + encodeURIComponent(sessionId) + "/message?limit=50";
+  const msgs = await apiFetch(url);
+  renderMessages(msgs);
+}
+
+async function listArtifacts(workspaceId) {
+  const data = await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/artifacts");
+  const items = Array.isArray(data && data.items) ? data.items : [];
+  artifactsEl.innerHTML = "";
+
+  if (!items.length) {
+    const empty = document.createElement("div");
+    empty.className = "item";
+    empty.textContent = "No artifacts found.";
+    artifactsEl.appendChild(empty);
+    return;
+  }
+
+  for (const item of items) {
+    const row = document.createElement("div");
+    row.className = "item";
+
+    const top = document.createElement("div");
+    top.className = "row";
+
+    const left = document.createElement("div");
+    const name = document.createElement("div");
+    name.className = "mono";
+    name.textContent = item.path;
+    const meta = document.createElement("div");
+    meta.className = "small";
+    meta.textContent = String(item.size) + " bytes";
+    left.appendChild(name);
+    left.appendChild(meta);
+
+    const btn = document.createElement("button");
+    btn.className = "btn";
+    btn.textContent = "Download";
+    btn.onclick = async () => {
+      try {
+        const res = await fetch(
+          "/workspace/" + encodeURIComponent(workspaceId) + "/artifacts/" + encodeURIComponent(item.id),
+          { headers: { Authorization: "Bearer " + readToken() } },
+        );
+        if (!res.ok) throw new Error("download_failed: " + res.status);
+        const blob = await res.blob();
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement("a");
+        a.href = url;
+        const parts = String(item.path || "artifact").split("/");
+        a.download = parts.length ? parts[parts.length - 1] : "artifact";
+        a.click();
+        setTimeout(() => URL.revokeObjectURL(url), 1000);
+      } catch (e) {
+        setStatus(e && e.message ? e.message : "Download failed", "bad");
+      }
+    };
+
+    top.appendChild(left);
+    top.appendChild(btn);
+    row.appendChild(top);
+    artifactsEl.appendChild(row);
+  }
+}
+
+async function refreshApprovals() {
+  approvalsEl.innerHTML = "";
+  try {
+    const data = await apiFetch("/approvals");
+    const items = Array.isArray(data && data.items) ? data.items : [];
+    if (!items.length) {
+      const empty = document.createElement("div");
+      empty.className = "item";
+      empty.textContent = "No pending approvals.";
+      approvalsEl.appendChild(empty);
+      return;
+    }
+
+    for (const item of items) {
+      const row = document.createElement("div");
+      row.className = "item";
+
+      const top = document.createElement("div");
+      top.className = "row";
+
+      const left = document.createElement("div");
+      const action = document.createElement("div");
+      action.className = "mono";
+      action.textContent = item.action;
+      const summary = document.createElement("div");
+      summary.className = "small";
+      summary.textContent = item.summary;
+      left.appendChild(action);
+      left.appendChild(summary);
+
+      const buttons = document.createElement("div");
+      buttons.className = "row";
+
+      const allow = document.createElement("button");
+      allow.className = "btn primary";
+      allow.textContent = "Allow";
+
+      const deny = document.createElement("button");
+      deny.className = "btn danger";
+      deny.textContent = "Deny";
+
+      allow.onclick = async () => {
+        await apiFetch("/approvals/" + encodeURIComponent(item.id), {
+          method: "POST",
+          body: JSON.stringify({ reply: "allow" }),
+        });
+        await refreshApprovals();
+      };
+
+      deny.onclick = async () => {
+        await apiFetch("/approvals/" + encodeURIComponent(item.id), {
+          method: "POST",
+          body: JSON.stringify({ reply: "deny" }),
+        });
+        await refreshApprovals();
+      };
+
+      buttons.appendChild(allow);
+      buttons.appendChild(deny);
+
+      top.appendChild(left);
+      top.appendChild(buttons);
+      row.appendChild(top);
+      approvalsEl.appendChild(row);
+    }
+  } catch (e) {
+    const warn = document.createElement("div");
+    warn.className = "item";
+    warn.textContent = e && e.message ? e.message : "Approvals unavailable";
+    approvalsEl.appendChild(warn);
+  }
+}
+
+let eventsAbort = null;
+
+async function connectSse(workspaceId) {
+  if (eventsAbort) return;
+  const controller = new AbortController();
+  eventsAbort = controller;
+  setStatus("Connecting SSE...", "");
+  addCheckpoint("sse.connecting");
+
+  const url = "/w/" + encodeURIComponent(workspaceId) + "/opencode/event";
+  const res = await fetch(url, {
+    headers: { Authorization: "Bearer " + readToken() },
+    signal: controller.signal,
+  });
+
+  if (!res.ok || !res.body) {
+    eventsAbort = null;
+    throw new Error("sse_failed: " + res.status);
+  }
+
+  setStatus("SSE connected", "ok");
+  addCheckpoint("sse.connected");
+  const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();
+  let buffer = "";
+
+  const pump = async () => {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      buffer += next.value;
+      buffer = buffer.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+      const chunks = buffer.split("\n\n");
+      buffer = chunks.pop() || "";
+      for (const chunk of chunks) {
+        const lines = chunk.split("\n");
+        const dataLines = [];
+        for (const line of lines) {
+          if (line.startsWith("data:")) {
+            const rest = line.slice(5);
+            dataLines.push(rest.startsWith(" ") ? rest.slice(1) : rest);
+          }
+        }
+        if (!dataLines.length) continue;
+        const raw = dataLines.join("\n");
+        try {
+          const event = JSON.parse(raw);
+          const payload = event && event.payload ? event.payload : event;
+          const type = payload && payload.type ? String(payload.type) : (event && event.type ? String(event.type) : "event");
+          addCheckpoint(type, summarizeEvent(payload));
+          if (type.endsWith(".completed") || type.endsWith(".finished") || type.endsWith(".stopped")) {
+            setRun("idle");
+          }
+          if (payload && payload.type === "message.part.updated") {
+            void refreshMessages(workspaceId);
+          }
+        } catch {
+          // ignore
+        }
+      }
+    }
+  };
+
+  pump()
+    .catch(() => undefined)
+    .finally(() => {
+      eventsAbort = null;
+      try { reader.releaseLock(); } catch {}
+      setStatus("SSE disconnected", "");
+      addCheckpoint("sse.disconnected");
+      setRun("idle");
+    });
+}
+
+function stopSse() {
+  if (!eventsAbort) return;
+  eventsAbort.abort();
+  eventsAbort = null;
+}
+
+function renderConnectArtifact(workspaceId, token, scope) {
+  const hostUrl = location.origin;
+  const workspaceUrl = hostUrl + "/w/" + encodeURIComponent(workspaceId);
+  const payload = {
+    kind: "openwork.connect.v1",
+    hostUrl: hostUrl,
+    workspaceId: workspaceId,
+    workspaceUrl: workspaceUrl,
+    token: token,
+    tokenScope: scope,
+    createdAt: Date.now(),
+  };
+  connectEl.textContent = JSON.stringify(payload, null, 2);
+}
+
+async function showConnectArtifact(workspaceId) {
+  const token = readToken();
+  let scope = "collaborator";
+  try {
+    const me = await apiFetch("/whoami");
+    const s = me && me.actor && me.actor.scope ? me.actor.scope : "";
+    if (s) scope = s;
+  } catch {
+    // ignore
+  }
+  renderConnectArtifact(workspaceId, token, scope);
+}
+
+async function mintShareToken(workspaceId) {
+  const scope = shareScopeEl && shareScopeEl.value ? String(shareScopeEl.value) : "collaborator";
+  const label = shareLabelEl && shareLabelEl.value ? String(shareLabelEl.value).trim() : "";
+  const issued = await apiFetch("/tokens", {
+    method: "POST",
+    body: JSON.stringify({ scope, label: label || undefined }),
+  });
+  const token = issued && issued.token ? String(issued.token) : "";
+  const tokenScope = issued && issued.scope ? String(issued.scope) : scope;
+  if (!token) throw new Error("token_missing");
+  renderConnectArtifact(workspaceId, token, tokenScope);
+  setStatus("Token minted: " + tokenScope, "ok");
+}
+
+async function refreshTokens() {
+  if (!tokensEl) return;
+  tokensEl.innerHTML = "";
+  try {
+    const data = await apiFetch("/tokens");
+    const items = Array.isArray(data && data.items) ? data.items : [];
+    if (!items.length) {
+      const empty = document.createElement("div");
+      empty.className = "item";
+      empty.textContent = "No tokens.";
+      tokensEl.appendChild(empty);
+      return;
+    }
+    for (const item of items) {
+      const row = document.createElement("div");
+      row.className = "item";
+      const top = document.createElement("div");
+      top.className = "row";
+
+      const left = document.createElement("div");
+      const title = document.createElement("div");
+      title.className = "mono";
+      title.textContent = (item.scope ? String(item.scope) : "token") + "  " + (item.id ? String(item.id) : "");
+      const meta = document.createElement("div");
+      meta.className = "small";
+      meta.textContent = item.label ? String(item.label) : "";
+      left.appendChild(title);
+      if (meta.textContent) left.appendChild(meta);
+
+      const revoke = document.createElement("button");
+      revoke.className = "btn danger";
+      revoke.textContent = "Revoke";
+      revoke.onclick = async () => {
+        try {
+          await apiFetch("/tokens/" + encodeURIComponent(String(item.id || "")), { method: "DELETE" });
+          await refreshTokens();
+        } catch (e) {
+          setStatus(e && e.message ? e.message : "Revoke failed", "bad");
+        }
+      };
+
+      top.appendChild(left);
+      top.appendChild(revoke);
+      row.appendChild(top);
+      tokensEl.appendChild(row);
+    }
+  } catch (e) {
+    const warn = document.createElement("div");
+    warn.className = "item";
+    warn.textContent = e && e.message ? e.message : "Tokens unavailable";
+    tokensEl.appendChild(warn);
+  }
+}
+
+async function exportWorkspace(workspaceId) {
+  if (!exportEl) return;
+  exportEl.textContent = "";
+  const data = await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/export");
+  exportEl.textContent = JSON.stringify(data, null, 2);
+}
+
+async function importWorkspace(workspaceId) {
+  if (!importEl) return;
+  const raw = (importEl.value || "").trim();
+  if (!raw) throw new Error("import_json_missing");
+  let payload = null;
+  try { payload = JSON.parse(raw); } catch { payload = null; }
+  if (!payload) throw new Error("import_json_invalid");
+  await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/import", {
+    method: "POST",
+    body: JSON.stringify(payload),
+  });
+}
+
+async function refreshSkills(workspaceId) {
+  if (!skillsEl) return;
+  skillsEl.innerHTML = "";
+  try {
+    const data = await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/skills");
+    const items = Array.isArray(data && data.items) ? data.items : [];
+    if (!items.length) {
+      const empty = document.createElement("div");
+      empty.className = "item";
+      empty.textContent = "No skills found.";
+      skillsEl.appendChild(empty);
+      return;
+    }
+    for (const item of items) {
+      const row = document.createElement("div");
+      row.className = "item";
+      const top = document.createElement("div");
+      top.className = "row";
+      const left = document.createElement("div");
+      const name = document.createElement("div");
+      name.className = "mono";
+      name.textContent = item.name;
+      const meta = document.createElement("div");
+      meta.className = "small";
+      meta.textContent = item.description || (item.scope ? String(item.scope) : "");
+      left.appendChild(name);
+      if (meta.textContent) left.appendChild(meta);
+
+      const delBtn = document.createElement("button");
+      delBtn.className = "btn danger";
+      delBtn.textContent = "Delete";
+      delBtn.disabled = item.scope !== "project";
+      delBtn.onclick = async () => {
+        try {
+          await apiFetch(
+            "/workspace/" + encodeURIComponent(workspaceId) + "/skills/" + encodeURIComponent(item.name),
+            { method: "DELETE" },
+          );
+          await refreshSkills(workspaceId);
+        } catch (e) {
+          setStatus(e && e.message ? e.message : "Delete failed", "bad");
+        }
+      };
+
+      top.appendChild(left);
+      top.appendChild(delBtn);
+      row.appendChild(top);
+      skillsEl.appendChild(row);
+    }
+  } catch (e) {
+    const warn = document.createElement("div");
+    warn.className = "item";
+    warn.textContent = e && e.message ? e.message : "Skills unavailable";
+    skillsEl.appendChild(warn);
+  }
+}
+
+async function refreshPlugins(workspaceId) {
+  if (!pluginsEl) return;
+  pluginsEl.innerHTML = "";
+  try {
+    const data = await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/plugins");
+    const items = Array.isArray(data && data.items) ? data.items : [];
+    if (!items.length) {
+      const empty = document.createElement("div");
+      empty.className = "item";
+      empty.textContent = "No plugins.";
+      pluginsEl.appendChild(empty);
+      return;
+    }
+    for (const item of items) {
+      const row = document.createElement("div");
+      row.className = "item";
+      const top = document.createElement("div");
+      top.className = "row";
+      const left = document.createElement("div");
+      const spec = document.createElement("div");
+      spec.className = "mono";
+      spec.textContent = item.spec;
+      const meta = document.createElement("div");
+      meta.className = "small";
+      meta.textContent = (item.source ? String(item.source) : "") + (item.scope ? " / " + String(item.scope) : "");
+      left.appendChild(spec);
+      if (meta.textContent) left.appendChild(meta);
+
+      const delBtn = document.createElement("button");
+      delBtn.className = "btn danger";
+      delBtn.textContent = "Remove";
+      delBtn.disabled = item.source !== "config";
+      delBtn.onclick = async () => {
+        try {
+          await apiFetch(
+            "/workspace/" + encodeURIComponent(workspaceId) + "/plugins/" + encodeURIComponent(item.spec),
+            { method: "DELETE" },
+          );
+          await refreshPlugins(workspaceId);
+        } catch (e) {
+          setStatus(e && e.message ? e.message : "Remove failed", "bad");
+        }
+      };
+
+      top.appendChild(left);
+      top.appendChild(delBtn);
+      row.appendChild(top);
+      pluginsEl.appendChild(row);
+    }
+  } catch (e) {
+    const warn = document.createElement("div");
+    warn.className = "item";
+    warn.textContent = e && e.message ? e.message : "Plugins unavailable";
+    pluginsEl.appendChild(warn);
+  }
+}
+
+async function refreshMcp(workspaceId) {
+  if (!mcpEl) return;
+  mcpEl.innerHTML = "";
+  try {
+    const data = await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/mcp");
+    const items = Array.isArray(data && data.items) ? data.items : [];
+    if (!items.length) {
+      const empty = document.createElement("div");
+      empty.className = "item";
+      empty.textContent = "No MCP servers.";
+      mcpEl.appendChild(empty);
+      return;
+    }
+    for (const item of items) {
+      const row = document.createElement("div");
+      row.className = "item";
+      const name = document.createElement("div");
+      name.className = "mono";
+      name.textContent = item.name;
+      const meta = document.createElement("div");
+      meta.className = "small";
+      meta.textContent = item.disabledByTools ? "disabled" : "enabled";
+      row.appendChild(name);
+      row.appendChild(meta);
+      mcpEl.appendChild(row);
+    }
+  } catch (e) {
+    const warn = document.createElement("div");
+    warn.className = "item";
+    warn.textContent = e && e.message ? e.message : "MCP unavailable";
+    mcpEl.appendChild(warn);
+  }
+}
+
+async function copyConnectArtifact() {
+  const text = connectEl.textContent || "";
+  if (!text.trim()) return;
+  try {
+    await navigator.clipboard.writeText(text);
+    setStatus("Copied", "ok");
+  } catch {
+    setStatus("Clipboard unavailable", "bad");
+  }
+}
+
+async function main() {
+  const workspaceId = parseWorkspaceIdFromPath();
+  if (!workspaceId) {
+    const token = readToken();
+    if (!token) {
+      appendMsg("system", "Open this as /ui#token=<token> or /w/<workspaceId>/ui#token=<token>");
+      return;
+    }
+    try {
+      const workspaces = await apiFetch("/workspaces");
+      const active = (workspaces && workspaces.activeId) || (workspaces && workspaces.items && workspaces.items[0] && workspaces.items[0].id) || "";
+      if (active) {
+        location.href = "/w/" + encodeURIComponent(active) + "/ui";
+        return;
+      }
+    } catch {
+      // ignore
+    }
+    appendMsg("system", "No workspace configured.");
+    return;
+  }
+
+  setRun("idle");
+  clearTimeline();
+  if (workspaceUrlEl) {
+    const wsUrl = location.origin + "/w/" + encodeURIComponent(workspaceId);
+    workspaceUrlEl.textContent = wsUrl;
+    workspaceUrlEl.href = wsUrl;
+  }
+
+  await refreshHost(workspaceId);
+  sessionIdEl.textContent = readSessionId(workspaceId) ? ("session: " + readSessionId(workspaceId)) : "session: -";
+  await refreshMessages(workspaceId).catch(() => undefined);
+
+  setTab(activeTab);
+  if (tabsEl) {
+    const buttons = tabsEl.querySelectorAll(".tab");
+    buttons.forEach((btn) => {
+      btn.onclick = async () => {
+        const tab = btn.getAttribute("data-tab") || "share";
+        setTab(tab);
+        try {
+          if (tab === "skills") await refreshSkills(workspaceId);
+          if (tab === "plugins") await refreshPlugins(workspaceId);
+          if (tab === "apps") await refreshMcp(workspaceId);
+          if (tab === "share") await refreshTokens().catch(() => undefined);
+        } catch {
+          // ignore
+        }
+      };
+    });
+  }
+  qs("#btn-new").onclick = async () => {
+    try {
+      writeSessionId(workspaceId, "");
+      const id = await ensureSession(workspaceId);
+      sessionIdEl.textContent = "session: " + id;
+      await refreshMessages(workspaceId);
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "Failed to create session", "bad");
+    }
+  };
+
+  qs("#btn-refresh").onclick = async () => {
+    await refreshMessages(workspaceId).catch((e) => setStatus(e && e.message ? e.message : "refresh failed", "bad"));
+  };
+
+  qs("#btn-delete-session").onclick = async () => {
+    const sessionId = readSessionId(workspaceId);
+    if (!sessionId) {
+      setStatus("No session selected", "bad");
+      return;
+    }
+    if (!confirm("Delete this session? This cannot be undone.")) return;
+    try {
+      await apiFetch(
+        "/workspace/" + encodeURIComponent(workspaceId) + "/sessions/" + encodeURIComponent(sessionId),
+        { method: "DELETE" },
+      );
+      writeSessionId(workspaceId, "");
+      sessionIdEl.textContent = "session: -";
+      chatlog.innerHTML = "";
+      clearTimeline();
+      setRun("idle");
+      setStatus("Session deleted", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "delete failed", "bad");
+    }
+  };
+
+  qs("#btn-send").onclick = async () => {
+    const text = (promptEl.value || "").trim();
+    if (!text) return;
+    clearTimeline();
+    addCheckpoint("prompt.submitted", text.length > 120 ? (text.slice(0, 120) + "...") : text);
+    setRun("running");
+    void connectSse(workspaceId).catch(() => undefined);
+    appendMsg("user", text);
+    promptEl.value = "";
+    try {
+      const sessionId = await ensureSession(workspaceId);
+      sessionIdEl.textContent = "session: " + sessionId;
+      const model = await resolveDefaultModel(workspaceId);
+      const body = { parts: [{ type: "text", text: text }] };
+      if (model) body.model = model;
+      await apiFetch(
+        "/w/" + encodeURIComponent(workspaceId) + "/opencode/session/" + encodeURIComponent(sessionId) + "/prompt_async",
+        { method: "POST", body: JSON.stringify(body) },
+      );
+      setStatus("Prompt accepted", "ok");
+      addCheckpoint("prompt.accepted");
+      await refreshMessages(workspaceId).catch(() => undefined);
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "Prompt failed", "bad");
+      addCheckpoint("prompt.failed", e && e.message ? e.message : "Prompt failed");
+      setRun("idle");
+    }
+  };
+
+  qs("#btn-skill").onclick = () => {
+    const template = [
+      "Turn this into a skill.",
+      "",
+      "Requirements:",
+      "- Skill name: my-skill",
+      "- Write to .opencode/skills/my-skill/SKILL.md",
+      "- Include usage, inputs, steps, and examples",
+      "",
+      "Use the most recent conversation as source material.",
+    ].join("\n");
+    const existing = (promptEl.value || "").trim();
+    promptEl.value = existing ? (existing + "\n\n" + template) : template;
+    promptEl.focus();
+  };
+
+  qs("#btn-mint").onclick = async () => {
+    try {
+      await mintShareToken(workspaceId);
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "Token mint failed", "bad");
+    }
+  };
+
+  qs("#btn-deploy").onclick = () => {
+    setStatus("Deploy (Beta) is not implemented in the Toy UI yet", "");
+  };
+
+  qs("#btn-events").onclick = async () => {
+    try {
+      await connectSse(workspaceId);
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "SSE failed", "bad");
+    }
+  };
+
+  qs("#btn-events-stop").onclick = () => stopSse();
+
+  qs("#btn-upload").onclick = async () => {
+    const input = qs("#file");
+    const file = input && input.files && input.files[0] ? input.files[0] : null;
+    if (!file) {
+      setStatus("Pick a file first", "bad");
+      return;
+    }
+    try {
+      const form = new FormData();
+      form.set("file", file);
+      await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/inbox", { method: "POST", body: form });
+      setStatus("Uploaded", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "Upload failed", "bad");
+    }
+  };
+
+  qs("#btn-artifacts").onclick = async () => {
+    await listArtifacts(workspaceId).catch((e) => setStatus(e && e.message ? e.message : "artifacts failed", "bad"));
+  };
+
+  qs("#btn-approvals").onclick = async () => {
+    await refreshApprovals().catch(() => undefined);
+  };
+
+  qs("#btn-share").onclick = async () => {
+    await showConnectArtifact(workspaceId).catch(() => undefined);
+  };
+
+  qs("#btn-copy").onclick = async () => {
+    await copyConnectArtifact();
+  };
+
+  qs("#btn-tokens").onclick = async () => {
+    await refreshTokens().catch((e) => setStatus(e && e.message ? e.message : "tokens failed", "bad"));
+  };
+
+  qs("#btn-export").onclick = async () => {
+    try {
+      await exportWorkspace(workspaceId);
+      setStatus("Exported", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "export failed", "bad");
+    }
+  };
+
+  qs("#btn-import").onclick = async () => {
+    try {
+      await importWorkspace(workspaceId);
+      setStatus("Import requested (check approvals)", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "import failed", "bad");
+    }
+  };
+
+  qs("#btn-delete-workspace").onclick = async () => {
+    if (!confirm("Delete this workspace from the host's OpenWork server config?")) return;
+    try {
+      await apiFetch("/workspaces/" + encodeURIComponent(workspaceId), { method: "DELETE" });
+      setStatus("Workspace deleted (refresh workspaces)", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "workspace delete failed", "bad");
+    }
+  };
+
+  qs("#btn-skills-refresh").onclick = async () => {
+    await refreshSkills(workspaceId).catch((e) => setStatus(e && e.message ? e.message : "skills failed", "bad"));
+  };
+
+  qs("#btn-plugins-refresh").onclick = async () => {
+    await refreshPlugins(workspaceId).catch((e) => setStatus(e && e.message ? e.message : "plugins failed", "bad"));
+  };
+
+  qs("#btn-plugin-add").onclick = async () => {
+    const spec = pluginSpecEl && pluginSpecEl.value ? String(pluginSpecEl.value).trim() : "";
+    if (!spec) {
+      setStatus("plugin spec required", "bad");
+      return;
+    }
+    try {
+      await apiFetch("/workspace/" + encodeURIComponent(workspaceId) + "/plugins", {
+        method: "POST",
+        body: JSON.stringify({ spec }),
+      });
+      if (pluginSpecEl) pluginSpecEl.value = "";
+      await refreshPlugins(workspaceId);
+      setStatus("Plugin added", "ok");
+    } catch (e) {
+      setStatus(e && e.message ? e.message : "plugin add failed", "bad");
+    }
+  };
+
+  qs("#btn-mcp-refresh").onclick = async () => {
+    await refreshMcp(workspaceId).catch((e) => setStatus(e && e.message ? e.message : "mcp failed", "bad"));
+  };
+}
+
+main().catch((e) => {
+  setStatus(e && e.message ? e.message : "Startup failed", "bad");
+});
+`;
+
+export function htmlResponse(body: string, status = 200): Response {
+  return new Response(body, {
+    status,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+    },
+  });
+}
+
+export function cssResponse(body: string): Response {
+  return new Response(body, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/css; charset=utf-8",
+      "Cache-Control": "no-store",
+    },
+  });
+}
+
+export function jsResponse(body: string): Response {
+  return new Response(body, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/javascript; charset=utf-8",
+      "Cache-Control": "no-store",
+    },
+  });
+}
+
+export function svgResponse(body: string): Response {
+  return new Response(body, {
+    status: 200,
+    headers: {
+      "Content-Type": "image/svg+xml; charset=utf-8",
+      "Cache-Control": "no-store",
+    },
+  });
+}
diff --git a/apps/server/src/types.ts b/apps/server/src/types.ts
new file mode 100644
index 0000000000..f737b30c8f
--- /dev/null
+++ b/apps/server/src/types.ts
@@ -0,0 +1,228 @@
+export type WorkspaceType = "local" | "remote";
+
+export type RemoteType = "opencode" | "openwork";
+
+export type ApprovalMode = "manual" | "auto";
+
+export type TokenScope = "owner" | "collaborator" | "viewer";
+
+export type SandboxBackend = "none" | "docker" | "container";
+
+export type ProviderPlacement = "in-sandbox" | "host-machine" | "client-machine" | "external";
+
+export type LogFormat = "pretty" | "json";
+
+export interface WorkspaceConfig {
+  id?: string;
+  path: string;
+  name?: string;
+  preset?: string;
+  workspaceType?: WorkspaceType;
+  remoteType?: RemoteType;
+  baseUrl?: string;
+  directory?: string;
+  displayName?: string;
+  openworkHostUrl?: string;
+  openworkToken?: string;
+  openworkWorkspaceId?: string;
+  openworkWorkspaceName?: string;
+  sandboxBackend?: string;
+  sandboxRunId?: string;
+  sandboxContainerName?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+}
+
+export interface WorkspaceInfo {
+  id: string;
+  name: string;
+  path: string;
+  preset: string;
+  workspaceType: WorkspaceType;
+  remoteType?: RemoteType;
+  baseUrl?: string;
+  directory?: string;
+  displayName?: string;
+  openworkHostUrl?: string;
+  openworkToken?: string;
+  openworkWorkspaceId?: string;
+  openworkWorkspaceName?: string;
+  sandboxBackend?: string;
+  sandboxRunId?: string;
+  sandboxContainerName?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  opencode?: {
+    baseUrl?: string;
+    directory?: string;
+    username?: string;
+    password?: string;
+  };
+}
+
+export interface OpencodeConfigFile {
+  path: string;
+  exists: boolean;
+  content: string | null;
+}
+
+export interface ApprovalConfig {
+  mode: ApprovalMode;
+  timeoutMs: number;
+}
+
+export interface ServerConfig {
+  host: string;
+  port: number;
+  token: string;
+  hostToken: string;
+  configPath?: string;
+  opencodeBaseUrl?: string;
+  opencodeDirectory?: string;
+  opencodeUsername?: string;
+  opencodePassword?: string;
+  approval: ApprovalConfig;
+  corsOrigins: string[];
+  workspaces: WorkspaceInfo[];
+  authorizedRoots: string[];
+  readOnly: boolean;
+  startedAt: number;
+  tokenSource: "cli" | "env" | "file" | "generated";
+  hostTokenSource: "cli" | "env" | "file" | "generated";
+  logFormat: LogFormat;
+  logRequests: boolean;
+}
+
+export interface Capabilities {
+  schemaVersion: number;
+  serverVersion: string;
+  skills: { read: boolean; write: boolean; source: "openwork" | "opencode" };
+  hub: {
+    skills: {
+      read: boolean;
+      install: boolean;
+      repo: { owner: string; name: string; ref: string };
+    };
+  };
+  plugins: { read: boolean; write: boolean };
+  mcp: { read: boolean; write: boolean };
+  commands: { read: boolean; write: boolean };
+  config: { read: boolean; write: boolean };
+
+  approvals: { mode: ApprovalMode; timeoutMs: number };
+  sandbox: { enabled: boolean; backend: SandboxBackend };
+  ui: { toy: boolean };
+  tokens: { scoped: boolean; scopes: TokenScope[] };
+  proxy: {
+    opencode: boolean;
+  };
+  toolProviders: {
+    browser: {
+      enabled: boolean;
+      placement: ProviderPlacement;
+      mode: "none" | "headless" | "interactive";
+    };
+    files: {
+      injection: boolean;
+      outbox: boolean;
+      inboxPath: string;
+      outboxPath: string;
+      maxBytes: number;
+    };
+  };
+}
+
+export type ReloadReason = "plugins" | "skills" | "mcp" | "config" | "agents" | "commands";
+
+export type ReloadTrigger = {
+  type: "skill" | "plugin" | "config" | "mcp" | "agent" | "command";
+  name?: string;
+  action?: "added" | "removed" | "updated";
+  path?: string;
+};
+
+export interface ReloadEvent {
+  id: string;
+  seq: number;
+  workspaceId: string;
+  reason: ReloadReason;
+  trigger?: ReloadTrigger;
+  timestamp: number;
+}
+
+export interface ApiErrorBody {
+  code: string;
+  message: string;
+  details?: unknown;
+}
+
+export interface PluginItem {
+  spec: string;
+  source: "config" | "dir.project" | "dir.global";
+  scope: "project" | "global";
+  path?: string;
+}
+
+export interface McpItem {
+  name: string;
+  config: Record<string, unknown>;
+  source: "config.project" | "config.global" | "config.remote";
+  disabledByTools?: boolean;
+}
+
+export interface SkillItem {
+  name: string;
+  path: string;
+  description: string;
+  scope: "project" | "global";
+  trigger?: string;
+}
+
+export interface HubSkillItem {
+  name: string;
+  description: string;
+  trigger?: string;
+  source: {
+    owner: string;
+    repo: string;
+    ref: string;
+    path: string;
+  };
+}
+
+export interface CommandItem {
+  name: string;
+  description?: string;
+  template: string;
+  agent?: string;
+  model?: string | null;
+  subtask?: boolean;
+  scope: "workspace" | "global";
+}
+
+export interface Actor {
+  type: "remote" | "host";
+  clientId?: string;
+  tokenHash?: string;
+  scope?: TokenScope;
+}
+
+export interface ApprovalRequest {
+  id: string;
+  workspaceId: string;
+  action: string;
+  summary: string;
+  paths: string[];
+  createdAt: number;
+  actor: Actor;
+}
+
+export interface AuditEntry {
+  id: string;
+  workspaceId: string;
+  actor: Actor;
+  action: string;
+  target: string;
+  summary: string;
+  timestamp: number;
+}
diff --git a/apps/server/src/utils.test.ts b/apps/server/src/utils.test.ts
new file mode 100644
index 0000000000..65167a6e52
--- /dev/null
+++ b/apps/server/src/utils.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { hashToken, shortId, parseList, ensureDir, exists } from "./utils.js";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+describe("hashToken", () => {
+  test("returns consistent hash for same input", () => {
+    const a = hashToken("my-secret-token");
+    const b = hashToken("my-secret-token");
+    expect(a).toBe(b);
+  });
+
+  test("returns different hashes for different inputs", () => {
+    const a = hashToken("token-a");
+    const b = hashToken("token-b");
+    expect(a).not.toBe(b);
+  });
+
+  test("returns a hex string", () => {
+    const hash = hashToken("test");
+    expect(hash).toMatch(/^[0-9a-f]+$/);
+  });
+});
+
+describe("shortId", () => {
+  test("returns a non-empty string", () => {
+    const id = shortId();
+    expect(id.length).toBeGreaterThan(0);
+  });
+
+  test("returns unique values", () => {
+    const ids = new Set(Array.from({ length: 100 }, () => shortId()));
+    expect(ids.size).toBe(100);
+  });
+});
+
+describe("parseList", () => {
+  test("splits comma-separated values", () => {
+    expect(parseList("a,b,c")).toEqual(["a", "b", "c"]);
+  });
+
+  test("trims whitespace", () => {
+    expect(parseList(" a , b , c ")).toEqual(["a", "b", "c"]);
+  });
+
+  test("filters empty entries", () => {
+    expect(parseList("a,,b,")).toEqual(["a", "b"]);
+  });
+
+  test("returns empty array for falsy input", () => {
+    expect(parseList(undefined)).toEqual([]);
+    expect(parseList("")).toEqual([]);
+  });
+});
+
+describe("ensureDir + exists", () => {
+  test("creates nested directory and reports it exists", async () => {
+    const dir = join(tmpdir(), `openwork-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    const nested = join(dir, "a", "b", "c");
+
+    expect(await exists(nested)).toBe(false);
+    await ensureDir(nested);
+    expect(await exists(nested)).toBe(true);
+  });
+});
diff --git a/apps/server/src/utils.ts b/apps/server/src/utils.ts
new file mode 100644
index 0000000000..cadd95fa89
--- /dev/null
+++ b/apps/server/src/utils.ts
@@ -0,0 +1,52 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, stat } from "node:fs/promises";
+
+export async function exists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function ensureDir(path: string): Promise<void> {
+  await mkdir(path, { recursive: true });
+}
+
+export async function readJsonFile<T>(path: string): Promise<T | null> {
+  try {
+    const raw = await readFile(path, "utf8");
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+export function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function shortId(): string {
+  return randomUUID();
+}
+
+export function parseList(input: string | undefined): string[] {
+  if (!input) return [];
+  const trimmed = input.trim();
+  if (!trimmed) return [];
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) {
+        return parsed.map((item) => String(item)).filter(Boolean);
+      }
+    } catch {
+      return [];
+    }
+  }
+  return trimmed
+    .split(/[,;]/)
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
diff --git a/apps/server/src/validators.test.ts b/apps/server/src/validators.test.ts
new file mode 100644
index 0000000000..2da35b644b
--- /dev/null
+++ b/apps/server/src/validators.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, test } from "bun:test";
+import {
+  sanitizeCommandName,
+  validateCommandName,
+  validateMcpName,
+  validateSkillName,
+  validateMcpConfig,
+} from "./validators.js";
+
+describe("sanitizeCommandName", () => {
+  test("passes through valid names", () => {
+    expect(sanitizeCommandName("my-command")).toBe("my-command");
+    expect(sanitizeCommandName("deploy")).toBe("deploy");
+  });
+
+  test("trims whitespace", () => {
+    expect(sanitizeCommandName("  hello  ")).toBe("hello");
+  });
+
+  test("strips leading slashes", () => {
+    expect(sanitizeCommandName("/deploy")).toBe("deploy");
+    expect(sanitizeCommandName("///deploy")).toBe("deploy");
+  });
+});
+
+describe("validateCommandName", () => {
+  test("accepts valid alphanumeric names", () => {
+    expect(() => validateCommandName("deploy")).not.toThrow();
+    expect(() => validateCommandName("my-cmd")).not.toThrow();
+    expect(() => validateCommandName("a_b_c")).not.toThrow();
+    expect(() => validateCommandName("Cmd123")).not.toThrow();
+  });
+
+  test("rejects empty string", () => {
+    expect(() => validateCommandName("")).toThrow();
+  });
+
+  test("rejects names with slashes", () => {
+    expect(() => validateCommandName("foo/bar")).toThrow();
+    expect(() => validateCommandName("foo\\bar")).toThrow();
+  });
+
+  test("rejects names with dots", () => {
+    expect(() => validateCommandName("foo.bar")).toThrow();
+  });
+
+  test("rejects names with spaces", () => {
+    expect(() => validateCommandName("foo bar")).toThrow();
+  });
+});
+
+describe("validateMcpName", () => {
+  test("accepts valid names", () => {
+    expect(() => validateMcpName("my-server")).not.toThrow();
+    expect(() => validateMcpName("notion")).not.toThrow();
+    expect(() => validateMcpName("a_b")).not.toThrow();
+  });
+
+  test("rejects empty strings", () => {
+    expect(() => validateMcpName("")).toThrow();
+  });
+
+  test("rejects names starting with dash", () => {
+    expect(() => validateMcpName("-bad")).toThrow();
+  });
+
+  test("rejects names with special characters", () => {
+    expect(() => validateMcpName("foo.bar")).toThrow();
+    expect(() => validateMcpName("foo bar")).toThrow();
+    expect(() => validateMcpName("foo/bar")).toThrow();
+  });
+});
+
+describe("validateSkillName", () => {
+  test("accepts kebab-case names", () => {
+    expect(() => validateSkillName("my-skill")).not.toThrow();
+    expect(() => validateSkillName("skill123")).not.toThrow();
+    expect(() => validateSkillName("a")).not.toThrow();
+  });
+
+  test("rejects empty strings", () => {
+    expect(() => validateSkillName("")).toThrow();
+  });
+
+  test("rejects uppercase", () => {
+    expect(() => validateSkillName("MySkill")).toThrow();
+  });
+
+  test("rejects underscores", () => {
+    expect(() => validateSkillName("my_skill")).toThrow();
+  });
+
+  test("rejects names over 64 chars", () => {
+    expect(() => validateSkillName("a".repeat(65))).toThrow();
+  });
+});
+
+describe("validateMcpConfig", () => {
+  test("accepts valid remote config", () => {
+    expect(() =>
+      validateMcpConfig({ type: "remote", url: "https://example.com" }),
+    ).not.toThrow();
+    expect(() =>
+      validateMcpConfig({ type: "remote", url: "http://localhost:8080/mcp" }),
+    ).not.toThrow();
+  });
+
+  test("accepts valid local config", () => {
+    expect(() =>
+      validateMcpConfig({ type: "local", command: ["npx", "my-server"] }),
+    ).not.toThrow();
+  });
+
+  test("rejects unknown type", () => {
+    expect(() => validateMcpConfig({ type: "unknown" })).toThrow();
+  });
+
+  test("rejects remote without url", () => {
+    expect(() => validateMcpConfig({ type: "remote" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "   " })).toThrow();
+  });
+
+  test("rejects remote with invalid or non-http url", () => {
+    expect(() => validateMcpConfig({ type: "remote", url: "notaurl" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "https:example.com" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: " https://example.com" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "https://example.com " })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "file:///tmp/mcp" })).toThrow();
+    expect(() => validateMcpConfig({ type: "remote", url: "javascript:alert(1)" })).toThrow();
+  });
+
+  test("rejects local without command", () => {
+    expect(() => validateMcpConfig({ type: "local" })).toThrow();
+    expect(() => validateMcpConfig({ type: "local", command: [] })).toThrow();
+    expect(() => validateMcpConfig({ type: "local", command: ["", "foo"] })).toThrow();
+    expect(() => validateMcpConfig({ type: "local", command: ["npx", 12] })).toThrow();
+  });
+});
diff --git a/apps/server/src/validators.ts b/apps/server/src/validators.ts
new file mode 100644
index 0000000000..bb6d8459f8
--- /dev/null
+++ b/apps/server/src/validators.ts
@@ -0,0 +1,79 @@
+import { ApiError } from "./errors.js";
+
+const SKILL_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const COMMAND_NAME_REGEX = /^[A-Za-z0-9_-]+$/;
+const MCP_NAME_REGEX = /^[A-Za-z0-9_-]+$/;
+
+export function validateSkillName(name: string): void {
+  if (!name || name.length < 1 || name.length > 64 || !SKILL_NAME_REGEX.test(name)) {
+    throw new ApiError(400, "invalid_skill_name", "Skill name must be kebab-case (1-64 chars)");
+  }
+}
+
+export function validateDescription(description: string | undefined): void {
+  if (!description || description.length < 1 || description.length > 1024) {
+    throw new ApiError(422, "invalid_description", "Description must be 1-1024 characters");
+  }
+}
+
+export function validatePluginSpec(spec: string): void {
+  if (!spec || spec.trim().length === 0) {
+    throw new ApiError(400, "invalid_plugin_spec", "Plugin spec is required");
+  }
+}
+
+export function sanitizeCommandName(name: string): string {
+  const trimmed = name.trim().replace(/^\/+/, "");
+  return trimmed;
+}
+
+export function validateCommandName(name: string): void {
+  if (!name || !COMMAND_NAME_REGEX.test(name)) {
+    throw new ApiError(400, "invalid_command_name", "Command name must be alphanumeric with _ or -");
+  }
+}
+
+export function validateMcpName(name: string): void {
+  if (!name || name.startsWith("-") || !MCP_NAME_REGEX.test(name)) {
+    throw new ApiError(400, "invalid_mcp_name", "MCP name must be alphanumeric and not start with -");
+  }
+}
+
+export function validateMcpConfig(config: Record<string, unknown>): void {
+  const type = config.type;
+  if (type !== "local" && type !== "remote") {
+    throw new ApiError(400, "invalid_mcp_config", "MCP config type must be local or remote");
+  }
+  if (type === "local") {
+    const command = config.command;
+    if (
+      !Array.isArray(command) ||
+      command.length === 0 ||
+      command.some((part) => typeof part !== "string" || part.trim().length === 0)
+    ) {
+      throw new ApiError(400, "invalid_mcp_config", "Local MCP requires command array");
+    }
+  }
+  if (type === "remote") {
+    const url = config.url;
+    if (!url || typeof url !== "string" || url.trim().length === 0) {
+      throw new ApiError(400, "invalid_mcp_config", "Remote MCP requires url");
+    }
+    const normalizedUrl = url.trim();
+    if (url !== normalizedUrl) {
+      throw new ApiError(400, "invalid_mcp_config", "Remote MCP url must not include surrounding whitespace");
+    }
+    if (!/^https?:\/\//i.test(normalizedUrl)) {
+      throw new ApiError(400, "invalid_mcp_config", "Remote MCP url must start with http(s)://");
+    }
+    try {
+      const parsed = new URL(normalizedUrl);
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new ApiError(400, "invalid_mcp_config", "Remote MCP url must use http(s)");
+      }
+    } catch (error) {
+      if (error instanceof ApiError) throw error;
+      throw new ApiError(400, "invalid_mcp_config", "Remote MCP requires a valid url");
+    }
+  }
+}
diff --git a/apps/server/src/workspace-activate.e2e.test.ts b/apps/server/src/workspace-activate.e2e.test.ts
new file mode 100644
index 0000000000..b9376e8002
--- /dev/null
+++ b/apps/server/src/workspace-activate.e2e.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { startServer } from "./server.js";
+import type { ServerConfig } from "./types.js";
+
+type Served = {
+  port: number;
+  stop: (closeActiveConnections?: boolean) => void | Promise<void>;
+};
+
+const stops: Array<() => void | Promise<void>> = [];
+const roots: string[] = [];
+
+afterEach(async () => {
+  while (stops.length) {
+    await stops.pop()?.();
+  }
+  while (roots.length) {
+    await rm(roots.pop()!, { recursive: true, force: true });
+  }
+});
+
+async function createWorkspaceRoot() {
+  const root = await mkdtemp(join(tmpdir(), "openwork-activate-"));
+  await mkdir(join(root, ".opencode"), { recursive: true });
+  roots.push(root);
+  return root;
+}
+
+function hostAuth(token: string) {
+  return { "X-OpenWork-Host-Token": token };
+}
+
+function startMockOpencode() {
+  const requests: Array<{ pathname: string; search: string }> = [];
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(request) {
+      const url = new URL(request.url);
+      requests.push({ pathname: url.pathname, search: url.search });
+
+      if (url.pathname === "/instance/dispose") {
+        return Response.json({ disposed: true });
+      }
+
+      return Response.json({ code: "not_found", message: "Not found" }, { status: 404 });
+    },
+  }) as Served;
+  stops.push(() => server.stop(true));
+  return { server, requests };
+}
+
+function startOpenworkServer(input: { workspaceRoot: string; opencodeBaseUrl: string }) {
+  const config: ServerConfig = {
+    host: "127.0.0.1",
+    port: 0,
+    token: "owt_test_token",
+    hostToken: "owt_host_token",
+    approval: { mode: "auto", timeoutMs: 1000 },
+    corsOrigins: ["*"],
+    workspaces: [
+      {
+        id: "ws_1",
+        name: "Workspace",
+        path: input.workspaceRoot,
+        preset: "starter",
+        workspaceType: "local",
+        baseUrl: input.opencodeBaseUrl,
+      },
+    ],
+    authorizedRoots: [input.workspaceRoot],
+    readOnly: false,
+    startedAt: Date.now(),
+    tokenSource: "cli",
+    hostTokenSource: "cli",
+    logFormat: "pretty",
+    logRequests: false,
+  };
+  const server = startServer(config) as Served;
+  stops.push(() => server.stop(true));
+  return { server, hostToken: config.hostToken };
+}
+
+describe("workspace activation", () => {
+  test("reloads the bound OpenCode engine on activate", async () => {
+    const workspaceRoot = await createWorkspaceRoot();
+    const mock = startMockOpencode();
+    const openwork = startOpenworkServer({
+      workspaceRoot,
+      opencodeBaseUrl: `http://127.0.0.1:${mock.server.port}`,
+    });
+
+    const base = `http://127.0.0.1:${openwork.server.port}`;
+    const response = await fetch(`${base}/workspaces/ws_1/activate`, {
+      method: "POST",
+      headers: hostAuth(openwork.hostToken),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.activeId).toBe("ws_1");
+
+    const reloadRequest = mock.requests.find(
+      (request) => request.pathname === "/instance/dispose",
+    );
+    expect(reloadRequest).toBeDefined();
+    expect(reloadRequest?.search).toContain(
+      `directory=${encodeURIComponent(workspaceRoot)}`,
+    );
+  });
+});
diff --git a/apps/server/src/workspace-export-safety.test.ts b/apps/server/src/workspace-export-safety.test.ts
new file mode 100644
index 0000000000..0ebf64b487
--- /dev/null
+++ b/apps/server/src/workspace-export-safety.test.ts
@@ -0,0 +1,116 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  collectWorkspaceExportWarnings,
+  stripSensitiveWorkspaceExportData,
+} from "./workspace-export-safety.js";
+
+describe("workspace export safety", () => {
+  test("does not warn for benign mcp, plugin, and portable files", () => {
+    const warnings = collectWorkspaceExportWarnings({
+      opencode: {
+        mcp: { jira: { type: "remote", url: "https://jira.example.com/mcp", key: "primary" } },
+        plugin: { demo: { key: "theme-dark" } },
+      },
+      files: [
+        { path: ".opencode/plugins/demo/index.ts", content: "const key = 'primary'; export default { enabled: true }" },
+        { path: ".opencode/tools/run.ts", content: "console.log('hello')" },
+      ],
+    });
+
+    expect(warnings).toEqual([]);
+  });
+
+  test("warns only when secret-like keys or values are present", () => {
+    const warnings = collectWorkspaceExportWarnings({
+      opencode: {
+        mcp: {
+          jira: {
+            headers: { Authorization: "Bearer abcdefghijklmnop" },
+            apiKey: "super-secret-key",
+          },
+        },
+        plugin: {
+          demo: { token: "ghp_1234567890abcdef", enabled: true, key: "AbCDef1234567890+/token" },
+        },
+      },
+      files: [
+        { path: ".opencode/plugins/demo/index.ts", content: "const apiKey = 'abc123456789';" },
+        {
+          path: ".opencode/tools/run.ts",
+          content: 'const key = "AbCdEf1234567890+/token"; fetch("https://example.com/path/with/a/really/long/url/that/looks/suspicious/123456789")',
+        },
+      ],
+    });
+
+    expect(warnings.map((warning) => warning.id)).toEqual([
+      "mcp-config",
+      "plugin-config",
+      "portable-file:.opencode/plugins/demo/index.ts",
+      "portable-file:.opencode/tools/run.ts",
+    ]);
+    expect(warnings[0]?.detail).toContain("apiKey");
+    expect(warnings[0]?.detail).toContain("Bearer");
+    expect(warnings[1]?.detail).toContain("token");
+    expect(warnings[1]?.detail).toContain("key");
+    expect(warnings[2]?.detail).toContain("apiKey");
+    expect(warnings[3]?.detail).toContain("key");
+    expect(warnings[3]?.detail).toContain("long URL");
+  });
+
+  test("warns when a non-portable provider section still contains secrets", () => {
+    const warnings = collectWorkspaceExportWarnings({
+      opencode: {
+        provider: {
+          openai: {
+            options: {
+              apiKey: "sk_live_1234567890abcdef",
+            },
+          },
+        },
+        mcp: { jira: { type: "remote", url: "https://jira.example.com/mcp" } },
+      },
+      files: [],
+    });
+
+    expect(warnings.map((warning) => warning.id)).toEqual(["provider-config"]);
+    expect(warnings[0]?.label).toBe("Provider settings");
+    expect(warnings[0]?.detail).toContain("apiKey");
+  });
+
+  test("exclude mode removes only flagged values and files", () => {
+    const sanitized = stripSensitiveWorkspaceExportData({
+      opencode: {
+        plugin: {
+          demo: {
+            enabled: true,
+            token: "ghp_1234567890abcdef",
+          },
+        },
+        mcp: {
+          jira: {
+            enabled: true,
+            apiKey: "super-secret-key",
+            url: "https://jira.example.com/mcp",
+          },
+        },
+        command: { review: { template: "Review it" } },
+      },
+      files: [
+        { path: ".opencode/plugins/demo/index.ts", content: "const token = 'secret';" },
+        { path: ".opencode/tools/run.ts", content: "console.log('safe tool');" },
+        { path: ".opencode/agents/reviewer.md", content: "agent" },
+      ],
+    });
+
+    expect(sanitized.opencode).toEqual({
+      plugin: { demo: { enabled: true } },
+      mcp: { jira: { enabled: true, url: "https://jira.example.com/mcp" } },
+      command: { review: { template: "Review it" } },
+    });
+    expect(sanitized.files).toEqual([
+      { path: ".opencode/tools/run.ts", content: "console.log('safe tool');" },
+      { path: ".opencode/agents/reviewer.md", content: "agent" },
+    ]);
+  });
+});
diff --git a/apps/server/src/workspace-export-safety.ts b/apps/server/src/workspace-export-safety.ts
new file mode 100644
index 0000000000..844616749b
--- /dev/null
+++ b/apps/server/src/workspace-export-safety.ts
@@ -0,0 +1,323 @@
+import type { PortableFile } from "./portable-files.js";
+
+export type WorkspaceExportSensitiveMode = "auto" | "include" | "exclude";
+
+export type WorkspaceExportWarning = {
+  id: string;
+  label: string;
+  detail: string;
+};
+
+const CONFIG_SECTION_METADATA: Record<string, { warningId: string; label: string; intro: string }> = {
+  mcp: {
+    warningId: "mcp-config",
+    label: "MCP servers",
+    intro: "Contains secret-like MCP config",
+  },
+  plugin: {
+    warningId: "plugin-config",
+    label: "Plugin settings",
+    intro: "Contains secret-like plugin config",
+  },
+  provider: {
+    warningId: "provider-config",
+    label: "Provider settings",
+    intro: "Contains secret-like provider config",
+  },
+};
+
+const PORTABLE_FILE_PREFIXES = [".opencode/plugins/", ".opencode/tools/"] as const;
+
+const COMMON_SECRET_KEY_PATTERNS = [
+  { id: "apiKey", test: (tokens: string[], normalized: string) => normalized.includes("apikey") || hasWordPair(tokens, "api", "key") },
+  { id: "key", test: (tokens: string[], normalized: string) => tokens.length === 1 && normalized === "key" },
+  { id: "token", test: (tokens: string[], normalized: string) => tokens.includes("token") || normalized.includes("authtoken") || normalized.includes("accesstoken") || normalized.includes("refreshtoken") },
+  { id: "Bearer", test: (tokens: string[], normalized: string) => tokens.includes("bearer") || normalized.includes("authorization") },
+  { id: "secret", test: (tokens: string[], normalized: string) => tokens.includes("secret") || hasWordPair(tokens, "client", "secret") },
+  { id: "password", test: (tokens: string[], normalized: string) => tokens.includes("password") || normalized.includes("passwd") },
+  { id: "credentials", test: (tokens: string[], normalized: string) => tokens.includes("credential") || tokens.includes("credentials") || normalized.includes("credential") },
+  { id: "privateKey", test: (tokens: string[]) => hasWordPair(tokens, "private", "key") },
+] as const;
+
+const KNOWN_SECRET_VALUE_PATTERNS = [
+  { id: "Bearer", test: (value: string) => /\bBearer\s+[A-Za-z0-9._~+\/-]+=*/.test(value) },
+  { id: "token", test: (value: string) => /\b(?:ghp|gho|github_pat|xox[baprs]|sk|rk|AKIA|ASIA|AIza)[-_A-Za-z0-9]{8,}\b/.test(value) },
+  { id: "JWT", test: (value: string) => /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+\b/.test(value) },
+] as const;
+
+const RAW_SECRET_TEXT_PATTERNS = [
+  { id: "apiKey", test: (value: string) => /\bapi[_-]?key\b/i.test(value) },
+  { id: "token", test: (value: string) => /\b(?:access[_-]?token|refresh[_-]?token|auth[_-]?token|token)\b/i.test(value) },
+  { id: "Bearer", test: (value: string) => /\bBearer\b/.test(value) },
+  { id: "secret", test: (value: string) => /\b(?:client[_-]?secret|secret)\b/i.test(value) },
+  { id: "password", test: (value: string) => /\b(?:password|passwd)\b/i.test(value) },
+  { id: "credentials", test: (value: string) => /\bcredentials?\b/i.test(value) },
+  { id: "privateKey", test: (value: string) => /\bprivate[_-]?key\b/i.test(value) },
+] as const;
+
+const GENERIC_KEY_ASSIGNMENT_PATTERNS = [
+  /\bkey\b\s*[:=]\s*["'`]([^"'`\n]{12,})["'`]/gi,
+  /["'`]key["'`]\s*:\s*["'`]([^"'`\n]{12,})["'`]/gi,
+] as const;
+
+function cloneJson<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function hasWordPair(tokens: string[], left: string, right: string): boolean {
+  return tokens.includes(left) && tokens.includes(right);
+}
+
+function splitNameIntoTokens(value: string): string[] {
+  return value
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .split(/[^A-Za-z0-9]+/)
+    .map((token) => token.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function detectSensitiveKeySignals(key: string, value: unknown): string[] {
+  const tokens = splitNameIntoTokens(key);
+  if (!tokens.length) return [];
+  const normalized = tokens.join("");
+  const matches = COMMON_SECRET_KEY_PATTERNS.filter((pattern) => pattern.test(tokens, normalized)).map((pattern) => pattern.id);
+
+  if (tokens.includes("public") && tokens.includes("key")) {
+    return matches.filter((match) => match !== "privateKey");
+  }
+
+  const primitive = typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+  const genericKeyOnly = tokens.length === 1 && tokens[0] === "key";
+  if (genericKeyOnly && !primitive) return [];
+  if (genericKeyOnly) {
+    if (typeof value !== "string") return [];
+    if (!looksLikeGenericSecretValue(value)) return [];
+  }
+
+  return matches;
+}
+
+function looksLikeGenericSecretValue(value: string): boolean {
+  const trimmed = value.trim();
+  if (trimmed.length < 16) return false;
+  if (/\s/.test(trimmed)) return false;
+  if (detectSensitiveStringSignals(trimmed).some((match) => match !== "key")) return true;
+  if (/^[a-f0-9]{32,}$/i.test(trimmed)) return true;
+
+  const classes = [/[a-z]/.test(trimmed), /[A-Z]/.test(trimmed), /\d/.test(trimmed), /[-_=+/.]/.test(trimmed)].filter(Boolean).length;
+  return classes >= 3 && /^[A-Za-z0-9._~+\/-=]+$/.test(trimmed);
+}
+
+function detectGenericKeyAssignments(value: string): string[] {
+  const matches = new Set<string>();
+  for (const pattern of GENERIC_KEY_ASSIGNMENT_PATTERNS) {
+    pattern.lastIndex = 0;
+    for (const match of value.matchAll(pattern)) {
+      const candidate = typeof match[1] === "string" ? match[1] : "";
+      if (looksLikeGenericSecretValue(candidate)) {
+        matches.add("key");
+      }
+    }
+  }
+  return Array.from(matches);
+}
+
+function detectSensitiveStringSignals(value: string): string[] {
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+
+  const matches = new Set<string>();
+  for (const pattern of KNOWN_SECRET_VALUE_PATTERNS) {
+    if (pattern.test(trimmed)) {
+      matches.add(pattern.id);
+    }
+  }
+
+  if (/https?:\/\//i.test(trimmed) && trimmed.length > 32) {
+    matches.add("long URL");
+  }
+
+  for (const pattern of RAW_SECRET_TEXT_PATTERNS) {
+    if (pattern.test(trimmed)) {
+      matches.add(pattern.id);
+    }
+  }
+
+  for (const match of detectGenericKeyAssignments(trimmed)) {
+    matches.add(match);
+  }
+
+  return Array.from(matches);
+}
+
+function collectSignals(value: unknown, keyHint?: string): string[] {
+  const matches = new Set<string>();
+
+  if (keyHint) {
+    for (const match of detectSensitiveKeySignals(keyHint, value)) {
+      matches.add(match);
+    }
+  }
+
+  if (typeof value === "string") {
+    for (const match of detectSensitiveStringSignals(value)) {
+      matches.add(match);
+    }
+    return Array.from(matches);
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      for (const match of collectSignals(item)) {
+        matches.add(match);
+      }
+    }
+    return Array.from(matches);
+  }
+
+  if (value && typeof value === "object") {
+    for (const [childKey, childValue] of Object.entries(value as Record<string, unknown>)) {
+      for (const match of collectSignals(childValue, childKey)) {
+        matches.add(match);
+      }
+    }
+  }
+
+  return Array.from(matches);
+}
+
+function describeSignals(intro: string, signals: string[]): string {
+  const unique = Array.from(new Set(signals));
+  if (!unique.length) return intro + ".";
+  return `${intro}: ${unique.slice(0, 4).join(", ")}${unique.length > 4 ? ", ..." : ""}.`;
+}
+
+function sanitizeValue(value: unknown, keyHint?: string): unknown {
+  const directSignals = new Set<string>();
+  if (keyHint) {
+    for (const match of detectSensitiveKeySignals(keyHint, value)) {
+      directSignals.add(match);
+    }
+  }
+  if (typeof value === "string") {
+    for (const match of detectSensitiveStringSignals(value)) {
+      directSignals.add(match);
+    }
+    return directSignals.size ? undefined : value;
+  }
+
+  if (directSignals.size) return undefined;
+
+  if (Array.isArray(value)) {
+    const items = value
+      .map((item) => sanitizeValue(item))
+      .filter((item) => item !== undefined);
+    return items;
+  }
+
+  if (value && typeof value === "object") {
+    const next: Record<string, unknown> = {};
+    for (const [childKey, childValue] of Object.entries(value as Record<string, unknown>)) {
+      const sanitized = sanitizeValue(childValue, childKey);
+      if (sanitized === undefined) continue;
+      if (Array.isArray(sanitized) && sanitized.length === 0) continue;
+      if (sanitized && typeof sanitized === "object" && !Array.isArray(sanitized) && Object.keys(sanitized as Record<string, unknown>).length === 0) {
+        continue;
+      }
+      next[childKey] = sanitized;
+    }
+    return next;
+  }
+
+  return value;
+}
+
+function isPortableFileCandidate(path: string): boolean {
+  return PORTABLE_FILE_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+
+export function collectWorkspaceExportWarnings(input: {
+  opencode: Record<string, unknown> | null | undefined;
+  files: PortableFile[];
+}): WorkspaceExportWarning[] {
+  const warnings = new Map<string, WorkspaceExportWarning>();
+  const opencode = input.opencode ?? {};
+
+  for (const [sectionKey, sectionValue] of Object.entries(opencode)) {
+    const signals = collectSignals(sectionValue);
+    if (!signals.length) continue;
+    const metadata =
+      CONFIG_SECTION_METADATA[sectionKey] ?? {
+        warningId: `config-${sectionKey}`,
+        label: formatSectionLabel(sectionKey),
+        intro: `Contains secret-like ${sectionKey} config`,
+      };
+    warnings.set(metadata.warningId, {
+      id: metadata.warningId,
+      label: metadata.label,
+      detail: describeSignals(metadata.intro, signals),
+    });
+  }
+
+  for (const file of input.files) {
+    const path = String(file.path ?? "").trim();
+    if (!path || !isPortableFileCandidate(path)) continue;
+    const signals = collectSignals(file.content);
+    if (!signals.length) continue;
+    warnings.set(`portable-file:${path}`, {
+      id: `portable-file:${path}`,
+      label: path,
+      detail: describeSignals("Contains secret-like file content", signals),
+    });
+  }
+
+  return Array.from(warnings.values());
+}
+
+export function stripSensitiveWorkspaceExportData(input: {
+  opencode: Record<string, unknown> | null | undefined;
+  files: PortableFile[];
+}): {
+  opencode: Record<string, unknown>;
+  files: PortableFile[];
+} {
+  const opencode = cloneJson(
+    input.opencode && typeof input.opencode === "object" && !Array.isArray(input.opencode)
+      ? input.opencode
+      : {},
+  ) as Record<string, unknown>;
+
+  for (const [sectionKey, sectionValue] of Object.entries(opencode)) {
+    const sanitized = sanitizeValue(sectionValue);
+    if (sanitized === undefined) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    if (sanitized && typeof sanitized === "object" && !Array.isArray(sanitized) && Object.keys(sanitized as Record<string, unknown>).length === 0) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    if (Array.isArray(sanitized) && sanitized.length === 0) {
+      delete opencode[sectionKey];
+      continue;
+    }
+    opencode[sectionKey] = sanitized;
+  }
+
+  const files = input.files
+    .filter((file) => {
+      const path = String(file.path ?? "").trim();
+      if (!isPortableFileCandidate(path)) return true;
+      return collectSignals(file.content).length === 0;
+    })
+    .map((file) => ({ ...file }));
+
+  return { opencode, files };
+}
+
+function formatSectionLabel(sectionKey: string): string {
+  return sectionKey
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .replace(/[-_]+/g, " ")
+    .replace(/^./, (char) => char.toUpperCase());
+}
diff --git a/apps/server/src/workspace-files.ts b/apps/server/src/workspace-files.ts
new file mode 100644
index 0000000000..dd8d4a7a6b
--- /dev/null
+++ b/apps/server/src/workspace-files.ts
@@ -0,0 +1,30 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+export function opencodeConfigPath(workspaceRoot: string): string {
+  const jsoncPath = join(workspaceRoot, "opencode.jsonc");
+  const jsonPath = join(workspaceRoot, "opencode.json");
+  const hiddenJsoncPath = join(workspaceRoot, ".opencode", "opencode.jsonc");
+  const hiddenJsonPath = join(workspaceRoot, ".opencode", "opencode.json");
+  if (existsSync(jsoncPath)) return jsoncPath;
+  if (existsSync(jsonPath)) return jsonPath;
+  if (existsSync(hiddenJsoncPath)) return hiddenJsoncPath;
+  if (existsSync(hiddenJsonPath)) return hiddenJsonPath;
+  return jsoncPath;
+}
+
+export function openworkConfigPath(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "openwork.json");
+}
+
+export function projectSkillsDir(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "skills");
+}
+
+export function projectCommandsDir(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "commands");
+}
+
+export function projectPluginsDir(workspaceRoot: string): string {
+  return join(workspaceRoot, ".opencode", "plugins");
+}
diff --git a/apps/server/src/workspace-import-preview.test.ts b/apps/server/src/workspace-import-preview.test.ts
new file mode 100644
index 0000000000..c2a4ce6646
--- /dev/null
+++ b/apps/server/src/workspace-import-preview.test.ts
@@ -0,0 +1,805 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { auditLogPath } from "./audit.js";
+import { buildCommandContent } from "./commands.js";
+import { startServer } from "./server.js";
+import { buildSkillContent } from "./skills.js";
+import type { ServerConfig } from "./types.js";
+import {
+  buildWorkspaceImportPreview,
+  publicWorkspaceImportPreview,
+  summarizeWorkspaceImportApplied,
+  summarizeWorkspaceImportPreview,
+  workspaceImportPreviewApprovalPaths,
+} from "./workspace-import-preview.js";
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (!dir) continue;
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+async function makeWorkspace(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "openwork-import-preview-"));
+  tempDirs.push(dir);
+  await mkdir(join(dir, ".opencode"), { recursive: true });
+  return dir;
+}
+
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function makeServerConfig(workspace: string, dataDir: string): ServerConfig {
+  return {
+    host: "127.0.0.1",
+    port: 0,
+    token: "test-token",
+    hostToken: "host-token",
+    configPath: join(dataDir, "config.json"),
+    approval: { mode: "auto", timeoutMs: 1000 },
+    corsOrigins: [],
+    workspaces: [
+      {
+        id: "workspace",
+        name: "workspace",
+        path: workspace,
+        preset: "default",
+        workspaceType: "local",
+      },
+    ],
+    authorizedRoots: [workspace],
+    readOnly: false,
+    startedAt: Date.now(),
+    tokenSource: "generated",
+    hostTokenSource: "generated",
+    logFormat: "pretty",
+    logRequests: false,
+  };
+}
+
+type TestHeaders = {
+  Authorization: string;
+  "Content-Type": string;
+};
+
+async function requestWorkspaceImportPreview(
+  baseUrl: string,
+  headers: TestHeaders,
+  payload: Record<string, unknown>,
+): Promise<{ fingerprint: string; summary: { create: number; update: number; delete: number; unchanged: number } }> {
+  const response = await fetch(`${baseUrl}/workspace/workspace/import/preview`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(payload),
+  });
+  expect(response.status).toBe(200);
+  return await response.json() as {
+    fingerprint: string;
+    summary: { create: number; update: number; delete: number; unchanged: number };
+  };
+}
+
+async function requestWorkspaceImportWithPreview(
+  baseUrl: string,
+  headers: TestHeaders,
+  payload: Record<string, unknown>,
+): Promise<Response> {
+  const preview = await requestWorkspaceImportPreview(baseUrl, headers, payload);
+  return await fetch(`${baseUrl}/workspace/workspace/import`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ ...payload, previewFingerprint: preview.fingerprint }),
+  });
+}
+
+async function silenceExpectedServerError<T>(run: () => Promise<T>): Promise<T> {
+  const originalError = console.error;
+  console.error = (...args: unknown[]) => {
+    if (args[0] === "[openwork-server] Unhandled error:") return;
+    originalError(...args);
+  };
+  try {
+    return await run();
+  } finally {
+    console.error = originalError;
+  }
+}
+
+async function waitForPendingApproval(baseUrl: string): Promise<string> {
+  for (let attempt = 0; attempt < 50; attempt += 1) {
+    const response = await fetch(`${baseUrl}/approvals`, {
+      headers: { "X-OpenWork-Host-Token": "host-token" },
+    });
+    expect(response.status).toBe(200);
+    const body = await response.json() as { items: Array<{ id: string }> };
+    const approval = body.items[0];
+    if (approval) return approval.id;
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  throw new Error("Timed out waiting for approval request");
+}
+
+describe("workspace import preview", () => {
+  test("summarizes workspace import changes without writing files", async () => {
+    const workspace = await makeWorkspace();
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["old-plugin"] }\n', "utf8");
+    await mkdir(join(workspace, ".opencode", "skills", "demo"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "demo", "SKILL.md"), "old skill\n", "utf8");
+    await mkdir(join(workspace, ".opencode", "commands"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "commands", "old.md"), "old command\n", "utf8");
+    await mkdir(join(workspace, ".opencode", "tools"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "plugins"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "tools", "existing.ts"), "old tool\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "plugins", "removed.ts"), "removed plugin\n", "utf8");
+
+    const preview = await buildWorkspaceImportPreview(workspace, {
+      mode: { skills: "replace", commands: "replace", files: "replace" },
+      opencode: {
+        plugin: ["old-plugin", "new-plugin"],
+      },
+      openwork: {
+        blueprint: {
+          materialized: {
+            sessions: { items: [{ templateId: "old", sessionId: "ses_123" }] },
+          },
+        },
+      },
+      skills: [
+        { name: "demo", description: "Demo skill", content: "---\nname: demo\ndescription: Demo skill\n---\nupdated\n" },
+        { name: "new-skill", description: "New skill", content: "---\nname: new-skill\ndescription: New skill\n---\nbody\n" },
+      ],
+      commands: [
+        { content: "---\nname: old\ndescription: Old command\n---\nupdated command\n" },
+        { name: "new-command", template: "run new command" },
+      ],
+      files: [
+        { path: ".opencode/tools/existing.ts", content: "new tool\n" },
+        { path: ".opencode/agents/new.md", content: "new agent\n" },
+      ],
+    });
+
+    expect(preview.summary).toEqual({
+      total: 9,
+      create: 4,
+      update: 4,
+      replace: 0,
+      delete: 1,
+      unchanged: 0,
+    });
+    expect(preview.changes.map((change) => [change.kind, change.action, change.path])).toEqual([
+      ["opencode", "update", "opencode.jsonc"],
+      ["openwork", "create", ".opencode/openwork.json"],
+      ["skill", "update", ".opencode/skills/demo/SKILL.md"],
+      ["skill", "create", ".opencode/skills/new-skill/SKILL.md"],
+      ["command", "update", ".opencode/commands/old.md"],
+      ["command", "create", ".opencode/commands/new-command.md"],
+      ["file", "update", ".opencode/tools/existing.ts"],
+      ["file", "create", ".opencode/agents/new.md"],
+      ["file", "delete", ".opencode/plugins/removed.ts"],
+    ]);
+
+    expect(await readFile(join(workspace, ".opencode", "tools", "existing.ts"), "utf8")).toBe("old tool\n");
+  });
+
+  test("marks identical config as unchanged and excludes it from approval paths", async () => {
+    const workspace = await makeWorkspace();
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["demo"] }\n', "utf8");
+
+    const preview = await buildWorkspaceImportPreview(workspace, {
+      opencode: { plugin: ["demo"] },
+    });
+
+    expect(preview.summary).toEqual({
+      total: 1,
+      create: 0,
+      update: 0,
+      replace: 0,
+      delete: 0,
+      unchanged: 1,
+    });
+    expect(preview.changes[0]?.action).toBe("unchanged");
+    expect(workspaceImportPreviewApprovalPaths(preview)).toEqual([]);
+    expect(summarizeWorkspaceImportPreview(preview)).toBe("Import workspace config (no changes)");
+  });
+
+  test("marks identical skills and commands unchanged", async () => {
+    const workspace = await makeWorkspace();
+    const skill = {
+      name: "demo",
+      description: "Demo skill",
+      content: "---\nname: demo\ndescription: Demo skill\n---\nbody\n",
+    };
+    const command = {
+      name: "demo-command",
+      description: "Demo command",
+      template: "do the thing",
+    };
+    const skillContent = buildSkillContent(skill);
+    const commandContent = buildCommandContent(command);
+    await mkdir(join(workspace, ".opencode", "skills", "demo"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "commands"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "demo", "SKILL.md"), skillContent.content, "utf8");
+    await writeFile(join(workspace, ".opencode", "commands", "demo-command.md"), commandContent.content, "utf8");
+
+    const preview = await buildWorkspaceImportPreview(workspace, {
+      skills: [skill],
+      commands: [command],
+    });
+
+    expect(preview.changes.map((change) => [change.kind, change.action, change.path])).toEqual([
+      ["skill", "unchanged", ".opencode/skills/demo/SKILL.md"],
+      ["command", "unchanged", ".opencode/commands/demo-command.md"],
+    ]);
+    expect(workspaceImportPreviewApprovalPaths(preview)).toEqual([]);
+    expect(publicWorkspaceImportPreview(preview).changes[0]).not.toHaveProperty("absolutePath");
+    expect(publicWorkspaceImportPreview(preview).changes[0]).not.toHaveProperty("beforeDigest");
+  });
+
+  test("uses replace action for config replacement", async () => {
+    const workspace = await makeWorkspace();
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["old"] }\n', "utf8");
+
+    const preview = await buildWorkspaceImportPreview(workspace, {
+      mode: { opencode: "replace" },
+      opencode: { plugin: ["new"] },
+    });
+
+    expect(preview.changes[0]).toMatchObject({
+      kind: "opencode",
+      action: "replace",
+      path: "opencode.jsonc",
+    });
+    expect(summarizeWorkspaceImportPreview(preview)).toBe("Import workspace config (update 1)");
+    expect(summarizeWorkspaceImportApplied(preview)).toBe("Imported workspace config (update 1)");
+  });
+
+  test("rejects unsafe portable file paths before import", async () => {
+    const workspace = await makeWorkspace();
+
+    await expect(
+      buildWorkspaceImportPreview(workspace, {
+        files: [{ path: ".opencode/.env", content: "SECRET=value\n" }],
+      }),
+    ).rejects.toThrow(/Portable file path is not allowed/i);
+  });
+
+  test("replace preview treats empty sections as delete all", async () => {
+    const workspace = await makeWorkspace();
+    await mkdir(join(workspace, ".opencode", "skills", "old-skill"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "commands"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "agents"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "old-skill", "SKILL.md"), "old skill\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "commands", "old-command.md"), "old command\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "agents", "old.md"), "old agent\n", "utf8");
+
+    const preview = await buildWorkspaceImportPreview(workspace, {
+      mode: { skills: "replace", commands: "replace", files: "replace" },
+      skills: [],
+      commands: [],
+      files: [],
+    });
+
+    expect(preview.summary).toMatchObject({
+      total: 3,
+      delete: 3,
+    });
+    expect(preview.changes.map((change) => [change.kind, change.action, change.path])).toEqual([
+      ["skill", "delete", ".opencode/skills/old-skill"],
+      ["command", "delete", ".opencode/commands/old-command.md"],
+      ["file", "delete", ".opencode/agents/old.md"],
+    ]);
+  });
+
+  test("preview route returns public changes and no-op import does not audit", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["demo"] }\n', "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const body = JSON.stringify({ opencode: { plugin: ["demo"] } });
+
+      const previewResponse = await fetch(`${baseUrl}/workspace/workspace/import/preview`, {
+        method: "POST",
+        headers,
+        body,
+      });
+      expect(previewResponse.status).toBe(200);
+      const preview = await previewResponse.json() as Record<string, unknown>;
+      expect(typeof preview.fingerprint).toBe("string");
+      expect((preview.changes as Array<Record<string, unknown>>)[0]).not.toHaveProperty("absolutePath");
+      expect((preview.changes as Array<Record<string, unknown>>)[0]).not.toHaveProperty("beforeDigest");
+
+      const importResponse = await fetch(`${baseUrl}/workspace/workspace/import`, {
+        method: "POST",
+        headers,
+        body,
+      });
+      expect(importResponse.status).toBe(200);
+      const imported = await importResponse.json() as Record<string, unknown>;
+      expect(imported.preview).toEqual(preview);
+      expect(await pathExists(auditLogPath("workspace"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("no-op import validates preview fingerprint shape", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["demo"] }\n', "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const response = await fetch(`http://127.0.0.1:${server.port}/workspace/workspace/import`, {
+        method: "POST",
+        headers: {
+          Authorization: "Bearer test-token",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          opencode: { plugin: ["demo"] },
+          previewFingerprint: 123,
+        }),
+      });
+
+      expect(response.status).toBe(400);
+      const body = await response.json() as { code: string };
+      expect(body.code).toBe("invalid_workspace_import_preview_fingerprint");
+      expect(await pathExists(auditLogPath("workspace"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("changed import requires a reviewed preview fingerprint", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const response = await fetch(`http://127.0.0.1:${server.port}/workspace/workspace/import`, {
+        method: "POST",
+        headers: {
+          Authorization: "Bearer test-token",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          opencode: { plugin: ["demo"] },
+        }),
+      });
+
+      expect(response.status).toBe(409);
+      const body = await response.json() as {
+        code: string;
+        preview: { fingerprint: string; summary: { create: number } };
+      };
+      expect(body.code).toBe("workspace_import_preview_required");
+      expect(typeof body.preview.fingerprint).toBe("string");
+      expect(body.preview.summary.create).toBe(1);
+      expect(await pathExists(join(workspace, "opencode.jsonc"))).toBe(false);
+      expect(await pathExists(auditLogPath("workspace"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("import route writes changed items and records audit", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const response = await requestWorkspaceImportWithPreview(baseUrl, headers, {
+        opencode: { plugin: ["demo"] },
+        skills: [
+          {
+            name: "demo",
+            description: "Demo skill",
+            content: "Use this skill for demo work.",
+          },
+        ],
+        files: [{ path: ".opencode/agents/demo.md", content: "Demo agent\n" }],
+      });
+
+      expect(response.status).toBe(200);
+      const body = await response.json() as { preview: { summary: { create: number } } };
+      expect(body.preview.summary.create).toBe(3);
+      expect(await readFile(join(workspace, "opencode.jsonc"), "utf8")).toContain('"plugin"');
+      expect(await readFile(join(workspace, ".opencode", "skills", "demo", "SKILL.md"), "utf8")).toContain("Demo skill");
+      expect(await readFile(join(workspace, ".opencode", "agents", "demo.md"), "utf8")).toBe("Demo agent\n");
+      expect(await readFile(auditLogPath("workspace"), "utf8")).toContain("Imported workspace config");
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("replace import route removes extra skills, commands, and portable files", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    const keepSkill = {
+      name: "keep",
+      description: "Keep skill",
+      content: "Use this skill for stable setup.",
+    };
+    const keepCommand = {
+      name: "keep-command",
+      description: "Keep command",
+      template: "run stable setup",
+    };
+    const keepSkillContent = buildSkillContent(keepSkill).content;
+    const keepCommandContent = buildCommandContent(keepCommand).content;
+
+    await mkdir(join(workspace, ".opencode", "skills", "keep"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "skills", "remove-me"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "commands"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "tools"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "keep", "SKILL.md"), keepSkillContent, "utf8");
+    await writeFile(join(workspace, ".opencode", "skills", "remove-me", "SKILL.md"), "legacy skill\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "commands", "keep-command.md"), keepCommandContent, "utf8");
+    await writeFile(join(workspace, ".opencode", "commands", "remove-me.md"), "legacy command\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "tools", "shared.ts"), "shared tool\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "tools", "remove-me.ts"), "legacy tool\n", "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const response = await requestWorkspaceImportWithPreview(baseUrl, headers, {
+        mode: { skills: "replace", commands: "replace", files: "replace" },
+        skills: [keepSkill],
+        commands: [keepCommand],
+        files: [{ path: ".opencode/tools/shared.ts", content: "shared tool\n" }],
+      });
+
+      expect(response.status).toBe(200);
+      const body = await response.json() as {
+        preview: { summary: { delete: number; unchanged: number } };
+      };
+      expect(body.preview.summary.delete).toBe(3);
+      expect(body.preview.summary.unchanged).toBe(3);
+      expect(await pathExists(join(workspace, ".opencode", "skills", "remove-me"))).toBe(false);
+      expect(await pathExists(join(workspace, ".opencode", "commands", "remove-me.md"))).toBe(false);
+      expect(await pathExists(join(workspace, ".opencode", "tools", "remove-me.ts"))).toBe(false);
+      expect(await readFile(join(workspace, ".opencode", "skills", "keep", "SKILL.md"), "utf8")).toBe(keepSkillContent);
+      expect(await readFile(join(workspace, ".opencode", "commands", "keep-command.md"), "utf8")).toBe(keepCommandContent);
+      expect(await readFile(join(workspace, ".opencode", "tools", "shared.ts"), "utf8")).toBe("shared tool\n");
+      expect(await readFile(auditLogPath("workspace"), "utf8")).toContain("Imported workspace config (remove 3)");
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("replace import route honors empty sections", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    await mkdir(join(workspace, ".opencode", "skills", "old-skill"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "commands"), { recursive: true });
+    await mkdir(join(workspace, ".opencode", "agents"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "old-skill", "SKILL.md"), "old skill\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "commands", "old-command.md"), "old command\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "agents", "old.md"), "old agent\n", "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const response = await requestWorkspaceImportWithPreview(baseUrl, headers, {
+        mode: { skills: "replace", commands: "replace", files: "replace" },
+        skills: [],
+        commands: [],
+        files: [],
+      });
+
+      expect(response.status).toBe(200);
+      const body = await response.json() as {
+        preview: { summary: { delete: number } };
+      };
+      expect(body.preview.summary.delete).toBe(3);
+      expect(await pathExists(join(workspace, ".opencode", "skills", "old-skill"))).toBe(false);
+      expect(await pathExists(join(workspace, ".opencode", "commands", "old-command.md"))).toBe(false);
+      expect(await pathExists(join(workspace, ".opencode", "agents", "old.md"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("import route rejects a stale reviewed preview", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["old"] }\n', "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const payload = { opencode: { plugin: ["new"] } };
+
+      const previewResponse = await fetch(`${baseUrl}/workspace/workspace/import/preview`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload),
+      });
+      expect(previewResponse.status).toBe(200);
+      const preview = await previewResponse.json() as { fingerprint: string };
+
+      await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["changed-after-preview"] }\n', "utf8");
+
+      const importResponse = await fetch(`${baseUrl}/workspace/workspace/import`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ ...payload, previewFingerprint: preview.fingerprint }),
+      });
+      expect(importResponse.status).toBe(409);
+      const rejected = await importResponse.json() as {
+        code: string;
+        preview: { fingerprint: string };
+      };
+      expect(rejected.code).toBe("workspace_import_preview_stale");
+      expect(rejected.preview.fingerprint).not.toBe(preview.fingerprint);
+      expect(await readFile(join(workspace, "opencode.jsonc"), "utf8")).toContain("changed-after-preview");
+      expect(await pathExists(auditLogPath("workspace"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("import route revalidates the preview after approval", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+    await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["old"] }\n', "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const serverConfig = makeServerConfig(workspace, dataDir);
+    serverConfig.approval = { mode: "manual", timeoutMs: 5000 };
+    const server = startServer(serverConfig) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const payload = { opencode: { plugin: ["new"] } };
+      const preview = await requestWorkspaceImportPreview(baseUrl, headers, payload);
+
+      const importPromise = fetch(`${baseUrl}/workspace/workspace/import`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ ...payload, previewFingerprint: preview.fingerprint }),
+      });
+
+      const approvalId = await waitForPendingApproval(baseUrl);
+      await writeFile(join(workspace, "opencode.jsonc"), '{ "plugin": ["changed-during-approval"] }\n', "utf8");
+      const approvalResponse = await fetch(`${baseUrl}/approvals/${approvalId}`, {
+        method: "POST",
+        headers: {
+          "X-OpenWork-Host-Token": "host-token",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ reply: "allow" }),
+      });
+      expect(approvalResponse.status).toBe(200);
+
+      const importResponse = await importPromise;
+      expect(importResponse.status).toBe(409);
+      const rejected = await importResponse.json() as {
+        code: string;
+        preview: { fingerprint: string };
+      };
+      expect(rejected.code).toBe("workspace_import_preview_stale");
+      expect(rejected.preview.fingerprint).not.toBe(preview.fingerprint);
+      expect(await readFile(join(workspace, "opencode.jsonc"), "utf8")).toContain("changed-during-approval");
+      expect(await pathExists(auditLogPath("workspace"))).toBe(false);
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("import route validates preview fingerprint shape", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const response = await fetch(`http://127.0.0.1:${server.port}/workspace/workspace/import`, {
+        method: "POST",
+        headers: {
+          Authorization: "Bearer test-token",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          opencode: { plugin: ["demo"] },
+          previewFingerprint: 123,
+        }),
+      });
+
+      expect(response.status).toBe(400);
+      const body = await response.json() as { code: string };
+      expect(body.code).toBe("invalid_workspace_import_preview_fingerprint");
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+
+  test("replace import keeps existing items when an incoming write fails", async () => {
+    const workspace = await makeWorkspace();
+    const dataDir = await mkdtemp(join(tmpdir(), "openwork-import-preview-data-"));
+    tempDirs.push(dataDir);
+
+    await mkdir(join(workspace, ".opencode", "skills", "old"), { recursive: true });
+    await writeFile(join(workspace, ".opencode", "skills", "old", "SKILL.md"), "old skill\n", "utf8");
+    await writeFile(join(workspace, ".opencode", "skills", "new"), "blocks new skill directory\n", "utf8");
+
+    const originalDataDir = process.env.OPENWORK_DATA_DIR;
+    process.env.OPENWORK_DATA_DIR = dataDir;
+    const server = startServer(makeServerConfig(workspace, dataDir)) as {
+      port: number;
+      stop: (force?: boolean) => void;
+    };
+    try {
+      const baseUrl = `http://127.0.0.1:${server.port}`;
+      const headers = {
+        Authorization: "Bearer test-token",
+        "Content-Type": "application/json",
+      };
+      const response = await silenceExpectedServerError(() =>
+        requestWorkspaceImportWithPreview(baseUrl, headers, {
+          mode: { skills: "replace" },
+          skills: [
+            {
+              name: "new",
+              description: "New skill",
+              content: "new skill\n",
+            },
+          ],
+        }),
+      );
+
+      expect(response.ok).toBe(false);
+      expect(response.status).toBe(500);
+      expect(await readFile(join(workspace, ".opencode", "skills", "old", "SKILL.md"), "utf8")).toBe("old skill\n");
+      expect(await readFile(join(workspace, ".opencode", "skills", "new"), "utf8")).toBe(
+        "blocks new skill directory\n",
+      );
+    } finally {
+      server.stop(true);
+      if (originalDataDir === undefined) {
+        delete process.env.OPENWORK_DATA_DIR;
+      } else {
+        process.env.OPENWORK_DATA_DIR = originalDataDir;
+      }
+    }
+  });
+});
diff --git a/apps/server/src/workspace-import-preview.ts b/apps/server/src/workspace-import-preview.ts
new file mode 100644
index 0000000000..7c5a8af93a
--- /dev/null
+++ b/apps/server/src/workspace-import-preview.ts
@@ -0,0 +1,511 @@
+import { createHash } from "node:crypto";
+import { readdir, readFile } from "node:fs/promises";
+import { join, relative } from "node:path";
+
+import { sanitizeOpenworkTemplateConfig } from "./blueprint-sessions.js";
+import { buildCommandContent } from "./commands.js";
+import { ApiError } from "./errors.js";
+import { parseFrontmatter } from "./frontmatter.js";
+import { readJsoncFile } from "./jsonc.js";
+import { planPortableFiles, listPortableFilePaths, type PortableFile } from "./portable-files.js";
+import { sanitizePortableOpencodeConfig } from "./portable-opencode.js";
+import { buildSkillContent } from "./skills.js";
+import { exists } from "./utils.js";
+import { sanitizeCommandName, validateCommandName, validateSkillName } from "./validators.js";
+import {
+  opencodeConfigPath,
+  openworkConfigPath,
+  projectCommandsDir,
+  projectSkillsDir,
+} from "./workspace-files.js";
+
+export type WorkspaceImportMode = "merge" | "replace";
+export type WorkspaceImportChangeKind = "opencode" | "openwork" | "skill" | "command" | "file";
+export type WorkspaceImportChangeAction = "create" | "update" | "replace" | "delete" | "unchanged";
+
+export type WorkspaceImportChange = {
+  kind: WorkspaceImportChangeKind;
+  action: WorkspaceImportChangeAction;
+  label: string;
+  path: string;
+};
+
+type WorkspaceImportPlannedChange = WorkspaceImportChange & {
+  absolutePath: string;
+  beforeDigest: string;
+  afterDigest: string;
+};
+
+export type WorkspaceImportPreview = {
+  fingerprint: string;
+  summary: {
+    total: number;
+    create: number;
+    update: number;
+    replace: number;
+    delete: number;
+    unchanged: number;
+  };
+  changes: WorkspaceImportChange[];
+};
+
+export type WorkspaceImportPlan = Omit<WorkspaceImportPreview, "changes"> & {
+  changes: WorkspaceImportPlannedChange[];
+};
+
+type WorkspaceImportSection = "opencode" | "openwork" | "skills" | "commands" | "files";
+
+export type NormalizedWorkspaceImport = {
+  modes: Record<string, WorkspaceImportMode>;
+  sections: Record<WorkspaceImportSection, boolean>;
+  opencode?: Record<string, unknown>;
+  openwork?: Record<string, unknown>;
+  skills: Array<{ name: string; content: string; description?: string }>;
+  commands: Array<{
+    name: string;
+    template: string;
+    description?: string;
+    agent?: string;
+    model?: string | null;
+    subtask?: boolean;
+  }>;
+  files: PortableFile[];
+};
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function readMode(value: unknown): WorkspaceImportMode {
+  return value === "replace" ? "replace" : "merge";
+}
+
+function normalizeModes(value: unknown): Record<string, WorkspaceImportMode> {
+  const record = readRecord(value) ?? {};
+  return {
+    opencode: readMode(record.opencode),
+    openwork: readMode(record.openwork),
+    skills: readMode(record.skills),
+    commands: readMode(record.commands),
+    files: readMode(record.files),
+  };
+}
+
+function readArray(value: unknown, label: string): Record<string, unknown>[] {
+  if (value === undefined || value === null) return [];
+  if (!Array.isArray(value)) {
+    throw new ApiError(400, "invalid_workspace_import_payload", `${label} must be an array`);
+  }
+  return value.map((item, index) => {
+    const record = readRecord(item);
+    if (!record) {
+      throw new ApiError(400, "invalid_workspace_import_payload", `${label}[${index}] must be an object`);
+    }
+    return record;
+  });
+}
+
+function normalizeSkills(value: unknown): NormalizedWorkspaceImport["skills"] {
+  return readArray(value, "skills").map((skill) => {
+    const name = String(skill.name ?? "").trim();
+    const content = typeof skill.content === "string" ? skill.content : "";
+    validateSkillName(name);
+    if (!content) {
+      throw new ApiError(400, "invalid_skill_content", "Skill content is required");
+    }
+    return {
+      name,
+      content,
+      description: typeof skill.description === "string" ? skill.description : undefined,
+    };
+  });
+}
+
+function normalizeCommands(value: unknown): NormalizedWorkspaceImport["commands"] {
+  return readArray(value, "commands").map((command) => {
+    if (typeof command.content === "string" && command.content.trim()) {
+      const parsed = parseFrontmatter(command.content);
+      const name = sanitizeCommandName(
+        String(command.name || (typeof parsed.data.name === "string" ? parsed.data.name : "")),
+      );
+      validateCommandName(name);
+      const template = parsed.body.trim();
+      if (!template) {
+        throw new ApiError(400, "invalid_command_template", "Command template is required");
+      }
+      return {
+        name,
+        template,
+        description:
+          typeof command.description === "string"
+            ? command.description
+            : typeof parsed.data.description === "string"
+              ? parsed.data.description
+              : undefined,
+        agent: typeof parsed.data.agent === "string" ? parsed.data.agent : undefined,
+        model: typeof parsed.data.model === "string" ? parsed.data.model : undefined,
+        subtask: typeof parsed.data.subtask === "boolean" ? parsed.data.subtask : undefined,
+      };
+    }
+
+    const name = sanitizeCommandName(String(command.name ?? ""));
+    validateCommandName(name);
+    const template = typeof command.template === "string" ? command.template : "";
+    if (!template.trim()) {
+      throw new ApiError(400, "invalid_command_template", "Command template is required");
+    }
+    return {
+      name,
+      template,
+      description: typeof command.description === "string" ? command.description : undefined,
+      agent: typeof command.agent === "string" ? command.agent : undefined,
+      model: typeof command.model === "string" ? command.model : null,
+      subtask: typeof command.subtask === "boolean" ? command.subtask : undefined,
+    };
+  });
+}
+
+export function normalizeWorkspaceImportPayload(
+  workspaceRoot: string,
+  payload: Record<string, unknown>,
+): NormalizedWorkspaceImport {
+  return {
+    modes: normalizeModes(payload.mode),
+    sections: {
+      opencode: payload.opencode !== undefined,
+      openwork: payload.openwork !== undefined,
+      skills: payload.skills !== undefined,
+      commands: payload.commands !== undefined,
+      files: payload.files !== undefined,
+    },
+    ...(payload.opencode !== undefined
+      ? { opencode: sanitizePortableOpencodeConfig(readRecord(payload.opencode)) }
+      : {}),
+    ...(payload.openwork !== undefined
+      ? { openwork: sanitizeOpenworkTemplateConfig(readRecord(payload.openwork)) }
+      : {}),
+    skills: normalizeSkills(payload.skills),
+    commands: normalizeCommands(payload.commands),
+    files: planPortableFiles(workspaceRoot, payload.files).map((file) => ({
+      path: file.path,
+      content: file.content,
+    })),
+  };
+}
+
+function stableStringify(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([key, child]) => `${JSON.stringify(key)}:${stableStringify(child)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+
+function digest(value: unknown): string {
+  return createHash("sha256").update(stableStringify(value)).digest("hex");
+}
+
+function textDigest(content: string | null): string {
+  return digest(content === null ? { type: "missing" } : { type: "text", content });
+}
+
+function jsonDigest(value: unknown): string {
+  return digest({ type: "json", value });
+}
+
+function sameJson(left: unknown, right: unknown): boolean {
+  return stableStringify(left) === stableStringify(right);
+}
+
+function actionForTarget(
+  existsBefore: boolean,
+  changed: boolean,
+  mode: WorkspaceImportMode,
+): WorkspaceImportChangeAction {
+  if (!existsBefore) return "create";
+  if (!changed) return "unchanged";
+  return mode === "replace" ? "replace" : "update";
+}
+
+function rel(workspaceRoot: string, absolutePath: string): string {
+  return relative(workspaceRoot, absolutePath).replaceAll("\\", "/");
+}
+
+function isMissingFileError(error: unknown): boolean {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+
+async function readTextIfPresent(path: string): Promise<string | null> {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (isMissingFileError(error)) return null;
+    throw error;
+  }
+}
+
+function countSummary(changes: WorkspaceImportChange[]): WorkspaceImportPreview["summary"] {
+  return changes.reduce(
+    (summary, change) => {
+      summary.total += 1;
+      summary[change.action] += 1;
+      return summary;
+    },
+    { total: 0, create: 0, update: 0, replace: 0, delete: 0, unchanged: 0 },
+  );
+}
+
+function fingerprintWorkspaceImportChanges(changes: WorkspaceImportPlannedChange[]): string {
+  return digest(
+    changes.map((change) => ({
+      kind: change.kind,
+      action: change.action,
+      path: change.path,
+      beforeDigest: change.beforeDigest,
+      afterDigest: change.afterDigest,
+    })),
+  );
+}
+
+async function readOpenworkConfig(path: string): Promise<Record<string, unknown>> {
+  const raw = await readTextIfPresent(path);
+  if (raw === null) return {};
+  try {
+    return JSON.parse(raw) as Record<string, unknown>;
+  } catch {
+    throw new ApiError(422, "invalid_json", "Failed to parse openwork.json");
+  }
+}
+
+async function listProjectSkillNames(workspaceRoot: string): Promise<string[]> {
+  const dir = projectSkillsDir(workspaceRoot);
+  if (!(await exists(dir))) return [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  const names: string[] = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (await exists(join(dir, entry.name, "SKILL.md"))) {
+      names.push(entry.name);
+    }
+  }
+  return names.sort();
+}
+
+async function listProjectCommandNames(workspaceRoot: string): Promise<string[]> {
+  const dir = projectCommandsDir(workspaceRoot);
+  if (!(await exists(dir))) return [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  return entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
+    .map((entry) => entry.name.replace(/\.md$/, ""))
+    .sort();
+}
+
+export async function buildWorkspaceImportPreview(
+  workspaceRoot: string,
+  payload: Record<string, unknown>,
+): Promise<WorkspaceImportPlan> {
+  const input = normalizeWorkspaceImportPayload(workspaceRoot, payload);
+  const changes: WorkspaceImportPlannedChange[] = [];
+
+  if (input.opencode !== undefined) {
+    const path = opencodeConfigPath(workspaceRoot);
+    const before = await readJsoncFile(path, {} as Record<string, unknown>);
+    const after = input.modes.opencode === "replace" ? input.opencode : { ...before.data, ...input.opencode };
+    changes.push({
+      kind: "opencode",
+      action: actionForTarget(Boolean(before.raw), !sameJson(before.data, after), input.modes.opencode),
+      label: "OpenCode config",
+      path: rel(workspaceRoot, path),
+      absolutePath: path,
+      beforeDigest: jsonDigest(before.data),
+      afterDigest: jsonDigest(after),
+    });
+  }
+
+  if (input.openwork !== undefined) {
+    const path = openworkConfigPath(workspaceRoot);
+    const existsBefore = await exists(path);
+    const before = await readOpenworkConfig(path);
+    const after = input.modes.openwork === "replace" ? input.openwork : { ...before, ...input.openwork };
+    changes.push({
+      kind: "openwork",
+      action: actionForTarget(existsBefore, !sameJson(before, after), input.modes.openwork),
+      label: "OpenWork config",
+      path: rel(workspaceRoot, path),
+      absolutePath: path,
+      beforeDigest: existsBefore ? jsonDigest(before) : textDigest(null),
+      afterDigest: jsonDigest(after),
+    });
+  }
+
+  if (input.sections.skills) {
+    const existing = new Set(await listProjectSkillNames(workspaceRoot));
+    const incoming = new Set<string>();
+    for (const skill of input.skills) {
+      incoming.add(skill.name);
+      const path = join(projectSkillsDir(workspaceRoot), skill.name, "SKILL.md");
+      const existsBefore = existing.has(skill.name);
+      const before = existsBefore ? await readTextIfPresent(path) : null;
+      const next = buildSkillContent(skill);
+      changes.push({
+        kind: "skill",
+        action: actionForTarget(before !== null, before !== next.content, "merge"),
+        label: skill.name,
+        path: rel(workspaceRoot, path),
+        absolutePath: path,
+        beforeDigest: before !== null ? textDigest(before) : textDigest(null),
+        afterDigest: textDigest(next.content),
+      });
+    }
+    if (input.modes.skills === "replace") {
+      for (const name of existing) {
+        if (incoming.has(name)) continue;
+        const path = join(projectSkillsDir(workspaceRoot), name);
+        const skillFile = join(path, "SKILL.md");
+        const before = await readTextIfPresent(skillFile);
+        if (before === null) continue;
+        changes.push({
+          kind: "skill",
+          action: "delete",
+          label: name,
+          path: rel(workspaceRoot, path),
+          absolutePath: path,
+          beforeDigest: textDigest(before),
+          afterDigest: textDigest(null),
+        });
+      }
+    }
+  }
+
+  if (input.sections.commands) {
+    const existing = new Set(await listProjectCommandNames(workspaceRoot));
+    const incoming = new Set<string>();
+    for (const command of input.commands) {
+      incoming.add(command.name);
+      const path = join(projectCommandsDir(workspaceRoot), `${command.name}.md`);
+      const existsBefore = existing.has(command.name);
+      const before = existsBefore ? await readTextIfPresent(path) : null;
+      const next = buildCommandContent(command);
+      changes.push({
+        kind: "command",
+        action: actionForTarget(before !== null, before !== next.content, "merge"),
+        label: command.name,
+        path: rel(workspaceRoot, path),
+        absolutePath: path,
+        beforeDigest: before !== null ? textDigest(before) : textDigest(null),
+        afterDigest: textDigest(next.content),
+      });
+    }
+    if (input.modes.commands === "replace") {
+      for (const name of existing) {
+        if (incoming.has(name)) continue;
+        const path = join(projectCommandsDir(workspaceRoot), `${name}.md`);
+        const before = await readTextIfPresent(path);
+        if (before === null) continue;
+        changes.push({
+          kind: "command",
+          action: "delete",
+          label: name,
+          path: rel(workspaceRoot, path),
+          absolutePath: path,
+          beforeDigest: textDigest(before),
+          afterDigest: textDigest(null),
+        });
+      }
+    }
+  }
+
+  if (input.sections.files) {
+    const incoming = new Set<string>();
+    for (const file of input.files) {
+      incoming.add(file.path);
+      const path = join(workspaceRoot, file.path);
+      const existsBefore = await exists(path);
+      const before = existsBefore ? await readTextIfPresent(path) : null;
+      changes.push({
+        kind: "file",
+        action: actionForTarget(before !== null, before !== file.content, "merge"),
+        label: file.path,
+        path: file.path,
+        absolutePath: path,
+        beforeDigest: before !== null ? textDigest(before) : textDigest(null),
+        afterDigest: textDigest(file.content),
+      });
+    }
+    if (input.modes.files === "replace") {
+      for (const filePath of await listPortableFilePaths(workspaceRoot)) {
+        if (incoming.has(filePath)) continue;
+        const path = join(workspaceRoot, filePath);
+        const before = await readTextIfPresent(path);
+        if (before === null) continue;
+        changes.push({
+          kind: "file",
+          action: "delete",
+          label: filePath,
+          path: filePath,
+          absolutePath: path,
+          beforeDigest: textDigest(before),
+          afterDigest: textDigest(null),
+        });
+      }
+    }
+  }
+
+  const summary = countSummary(changes);
+  return {
+    fingerprint: fingerprintWorkspaceImportChanges(changes),
+    summary,
+    changes,
+  };
+}
+
+export function publicWorkspaceImportPreview(preview: WorkspaceImportPlan): WorkspaceImportPreview {
+  return {
+    fingerprint: preview.fingerprint,
+    summary: preview.summary,
+    changes: preview.changes.map(
+      ({ absolutePath: _absolutePath, beforeDigest: _beforeDigest, afterDigest: _afterDigest, ...change }) => change,
+    ),
+  };
+}
+
+export function workspaceImportPreviewApprovalPaths(preview: WorkspaceImportPlan): string[] {
+  return Array.from(
+    new Set(
+      preview.changes
+        .filter((change) => change.action !== "unchanged")
+        .map((change) => change.absolutePath),
+    ),
+  );
+}
+
+function countLabel(verb: string, count: number): string | null {
+  if (count <= 0) return null;
+  return `${verb} ${count}`;
+}
+
+function summarizeWorkspaceImport(prefix: "Import" | "Imported", preview: WorkspaceImportPreview): string {
+  const parts = [
+    countLabel("add", preview.summary.create),
+    countLabel("update", preview.summary.update + preview.summary.replace),
+    countLabel("remove", preview.summary.delete),
+  ].filter((part): part is string => Boolean(part));
+
+  return parts.length ? `${prefix} workspace config (${parts.join(", ")})` : `${prefix} workspace config (no changes)`;
+}
+
+export function summarizeWorkspaceImportPreview(preview: WorkspaceImportPreview): string {
+  return summarizeWorkspaceImport("Import", preview);
+}
+
+export function summarizeWorkspaceImportApplied(preview: WorkspaceImportPreview): string {
+  return summarizeWorkspaceImport("Imported", preview);
+}
diff --git a/apps/server/src/workspace-init.ts b/apps/server/src/workspace-init.ts
new file mode 100644
index 0000000000..349790fb94
--- /dev/null
+++ b/apps/server/src/workspace-init.ts
@@ -0,0 +1,100 @@
+import { basename, join } from "node:path";
+import { readFile, writeFile } from "node:fs/promises";
+
+import { ensureDir, exists } from "./utils.js";
+import { ApiError } from "./errors.js";
+import { openworkConfigPath, opencodeConfigPath } from "./workspace-files.js";
+import { readJsoncFile, writeJsoncFile } from "./jsonc.js";
+
+const OPENWORK_AGENT = `---
+description: OpenWork default agent
+mode: primary
+temperature: 0.2
+---
+
+You are OpenWork.
+
+Help the user work on files safely from this workspace. Prefer clear, practical steps. If required setup or credentials are missing, ask one targeted question and continue once provided.
+`;
+
+type WorkspaceOpenworkConfig = {
+  version: number;
+  workspace?: {
+    name?: string | null;
+    createdAt?: number | null;
+    preset?: string | null;
+  } | null;
+  authorizedRoots: string[];
+  reload?: {
+    auto?: boolean;
+    resume?: boolean;
+  } | null;
+};
+
+function normalizePreset(preset: string | null | undefined): string {
+  const trimmed = preset?.trim() ?? "";
+  if (!trimmed) return "starter";
+  return trimmed;
+}
+
+async function ensureWorkspaceOpenworkConfig(workspaceRoot: string, preset: string): Promise<void> {
+  const path = openworkConfigPath(workspaceRoot);
+  if (await exists(path)) return;
+  const now = Date.now();
+  const config: WorkspaceOpenworkConfig = {
+    version: 1,
+    workspace: {
+      name: basename(workspaceRoot) || "Workspace",
+      createdAt: now,
+      preset,
+    },
+    authorizedRoots: [workspaceRoot],
+    reload: null,
+  };
+  await ensureDir(join(workspaceRoot, ".opencode"));
+  await writeFile(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+
+async function ensureOpencodeConfig(workspaceRoot: string): Promise<void> {
+  const path = opencodeConfigPath(workspaceRoot);
+  const { data } = await readJsoncFile<Record<string, unknown>>(path, {
+    $schema: "https://opencode.ai/config.json",
+  });
+  const next: Record<string, unknown> = data && typeof data === "object" && !Array.isArray(data)
+    ? { ...data }
+    : { $schema: "https://opencode.ai/config.json" };
+
+  if (typeof next.default_agent !== "string" || !next.default_agent.trim()) {
+    next.default_agent = "openwork";
+  }
+
+  await writeJsoncFile(path, next);
+}
+
+async function ensureOpenworkAgent(workspaceRoot: string): Promise<void> {
+  const agentsDir = join(workspaceRoot, ".opencode", "agents");
+  const agentPath = join(agentsDir, "openwork.md");
+  if (await exists(agentPath)) return;
+  await ensureDir(agentsDir);
+  await writeFile(agentPath, OPENWORK_AGENT.endsWith("\n") ? OPENWORK_AGENT : `${OPENWORK_AGENT}\n`, "utf8");
+}
+
+export async function ensureWorkspaceFiles(workspaceRoot: string, presetInput: string): Promise<void> {
+  const preset = normalizePreset(presetInput);
+  if (!workspaceRoot.trim()) {
+    throw new ApiError(400, "invalid_workspace_path", "workspace path is required");
+  }
+  await ensureDir(workspaceRoot);
+  await ensureOpencodeConfig(workspaceRoot);
+  await ensureOpenworkAgent(workspaceRoot);
+  await ensureWorkspaceOpenworkConfig(workspaceRoot, preset);
+}
+
+export async function readRawOpencodeConfig(path: string): Promise<{ exists: boolean; content: string | null }> {
+  const hasFile = await exists(path);
+  if (!hasFile) {
+    return { exists: false, content: null };
+  }
+  const content = await readFile(path, "utf8");
+  return { exists: true, content };
+}
diff --git a/apps/server/src/workspaces.ts b/apps/server/src/workspaces.ts
new file mode 100644
index 0000000000..c65a8ed81c
--- /dev/null
+++ b/apps/server/src/workspaces.ts
@@ -0,0 +1,72 @@
+import { createHash } from "node:crypto";
+import { basename, resolve } from "node:path";
+import type { WorkspaceConfig, WorkspaceInfo } from "./types.js";
+
+function workspaceIdForKey(key: string): string {
+  const hash = createHash("sha256").update(key).digest("hex");
+  return `ws_${hash.slice(0, 12)}`;
+}
+
+export function workspaceIdForPath(path: string): string {
+  return workspaceIdForKey(path);
+}
+
+export function workspaceIdForRemote(baseUrl: string, directory?: string | null): string {
+  const normalizedBaseUrl = baseUrl.trim();
+  const normalizedDirectory = directory?.trim() ?? "";
+  const key = normalizedDirectory
+    ? `remote::${normalizedBaseUrl}::${normalizedDirectory}`
+    : `remote::${normalizedBaseUrl}`;
+  return workspaceIdForKey(key);
+}
+
+export function workspaceIdForOpenwork(hostUrl: string, workspaceId?: string | null): string {
+  const normalizedHostUrl = hostUrl.trim();
+  const normalizedWorkspaceId = workspaceId?.trim() ?? "";
+  const key = normalizedWorkspaceId
+    ? `openwork::${normalizedHostUrl}::${normalizedWorkspaceId}`
+    : `openwork::${normalizedHostUrl}`;
+  return workspaceIdForKey(key);
+}
+
+export function buildWorkspaceInfos(
+  workspaces: WorkspaceConfig[],
+  cwd: string,
+): WorkspaceInfo[] {
+  return workspaces.map((workspace) => {
+    const rawPath = workspace.path?.trim() ?? "";
+    const workspaceType = workspace.workspaceType ?? "local";
+    const resolvedPath = rawPath ? resolve(cwd, rawPath) : "";
+    const remoteType = workspace.remoteType;
+    const id = workspace.id?.trim()
+      || (workspaceType === "remote"
+        ? remoteType === "openwork"
+          ? workspaceIdForOpenwork(workspace.openworkHostUrl ?? workspace.baseUrl ?? "", workspace.openworkWorkspaceId)
+          : workspaceIdForRemote(workspace.baseUrl ?? "", workspace.directory)
+        : workspaceIdForPath(resolvedPath));
+    const name = workspace.name?.trim()
+      || workspace.displayName?.trim()
+      || workspace.openworkWorkspaceName?.trim()
+      || basename(resolvedPath || workspace.directory?.trim() || workspace.baseUrl?.trim() || "Workspace");
+    return {
+      id,
+      name,
+      path: resolvedPath,
+      preset: workspace.preset?.trim() || (workspaceType === "remote" ? "remote" : "starter"),
+      workspaceType,
+      remoteType,
+      baseUrl: workspace.baseUrl,
+      directory: workspace.directory,
+      displayName: workspace.displayName,
+      openworkHostUrl: workspace.openworkHostUrl,
+      openworkToken: workspace.openworkToken,
+      openworkWorkspaceId: workspace.openworkWorkspaceId,
+      openworkWorkspaceName: workspace.openworkWorkspaceName,
+      sandboxBackend: workspace.sandboxBackend,
+      sandboxRunId: workspace.sandboxRunId,
+      sandboxContainerName: workspace.sandboxContainerName,
+      opencodeUsername: workspace.opencodeUsername,
+      opencodePassword: workspace.opencodePassword,
+    };
+  });
+}
diff --git a/apps/server/tsconfig.json b/apps/server/tsconfig.json
new file mode 100644
index 0000000000..d5509c4d5f
--- /dev/null
+++ b/apps/server/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "types": ["bun-types", "node"]
+  },
+  "include": ["src"]
+}
diff --git a/apps/share/.gitignore b/apps/share/.gitignore
new file mode 100644
index 0000000000..41d3ae8e49
--- /dev/null
+++ b/apps/share/.gitignore
@@ -0,0 +1,7 @@
+node_modules/
+.next/
+.vercel/
+.vercel
+.env*.local
+__tests__/
+*.tsbuildinfo
diff --git a/apps/share/README.md b/apps/share/README.md
new file mode 100644
index 0000000000..69da2b1aa2
--- /dev/null
+++ b/apps/share/README.md
@@ -0,0 +1,124 @@
+# OpenWork Share Service (Publisher)
+
+This is a Next.js publisher app for OpenWork "share link" bundles.
+
+It keeps the existing bundle APIs, but the public share surface now runs as a simple Next.js site backed by Vercel Blob.
+
+## Endpoints
+
+- `GET /`
+  - Human-friendly packaging page for OpenWork worker files.
+  - Supports drag/drop of skills, agents, commands, `opencode.json[c]`, and `openwork.json`.
+  - Previews the inferred bundle and publishes a share link.
+
+- `POST /v1/bundles`
+  - Accepts JSON bundle payloads.
+  - Stores bytes in Vercel Blob.
+  - Returns `{ "url": "https://share.openworklabs.com/b/<id>" }`.
+
+- `POST /v1/package`
+  - Accepts `{ files: [{ path, name?, content }], preview?: boolean }`.
+  - Parses supported OpenWork files into the smallest useful bundle shape.
+  - Returns preview metadata when `preview` is `true`.
+  - Publishes the generated bundle and returns the share URL otherwise.
+
+- `GET /b/:id`
+  - Returns an HTML share page by default for browser requests.
+  - Includes an **Open in app** action that opens `openwork://import-bundle` with:
+    - `ow_bundle=<share-url>`
+    - `ow_intent=new_worker` (desktop OpenWork converts single-skill bundles into a destination picker before import)
+    - `ow_source=share_service`
+  - Returns raw JSON for API/programmatic requests:
+    - send `Accept: application/json`, or
+    - append `?format=json`.
+  - The canonical raw endpoint is `/b/:id/data`.
+  - Supports `/b/:id/data?download=1` and the legacy `?format=json&download=1` compatibility path.
+
+## Bundle Types
+
+- `skill`
+  - A single skill install payload.
+- `skills-set`
+  - A full skills pack (multiple skills) exported from a worker.
+
+## Packager input support
+
+- Skill markdown from `.opencode/skills/<name>/SKILL.md`
+- Agent markdown from `.opencode/agents/*.md`
+- Tool definitions from `.opencode/tools/*`
+- Command markdown from `.opencode/commands/*.md`
+- `opencode.json` / `opencode.jsonc` (portable project keys only: `agent`, `command`, `instructions`, `mcp`, `permission`, `plugin`, `share`, `tools`, `watcher`)
+- `openwork.json`
+
+The packager rejects files that appear to contain secrets in shareable config.
+
+## Required Environment Variables
+
+- `BLOB_READ_WRITE_TOKEN`
+  - Vercel Blob token with read/write permissions.
+
+## Optional Environment Variables
+
+- `PUBLIC_BASE_URL`
+  - Default: `https://share.openworklabs.com`
+  - Used to construct the returned share URL.
+
+- `MAX_BYTES`
+  - Default: `262144` (256KB)
+  - Hard upload limit.
+
+- `OPENWORK_PUBLISHER_ALLOWED_ORIGINS`
+  - Optional comma-separated browser origins allowed to publish bundles.
+  - Defaults include the share origin, the hosted OpenWork app origin, and common local dev origins.
+
+- `LOCAL_BLOB_DIR`
+  - Optional local filesystem storage root for bundle JSON.
+  - When `BLOB_READ_WRITE_TOKEN` is unset in local/dev mode, the service falls back to local file storage automatically.
+
+## Local development
+
+For local testing you can use:
+
+```bash
+pnpm install
+pnpm --dir apps/share dev
+```
+
+Open `http://localhost:3000`.
+
+Without a `BLOB_READ_WRITE_TOKEN`, local development now stores bundles on disk in a local dev blob directory so publishing works out of the box.
+
+## Deploy
+
+Recommended project settings:
+
+- Root directory: `apps/share`
+- Framework preset: Next.js
+- Build command: `next build`
+- Output directory: `.next`
+- Install command: `pnpm install --frozen-lockfile`
+- Enable Vercel BotID for the project and keep the bundle routes protected in `app/layout.tsx`.
+
+## Tests
+
+```bash
+pnpm --dir apps/share test
+```
+
+## Quick checks
+
+```bash
+# Human-friendly page
+curl -i "http://localhost:3000/b/<id>" -H "Accept: text/html"
+
+# Machine-readable payload (OpenWork parser path)
+curl -i "http://localhost:3000/b/<id>/data"
+
+# Legacy compatibility path
+curl -i "http://localhost:3000/b/<id>?format=json"
+```
+
+## Notes
+
+- Links are public and unguessable (no auth, no encryption).
+- Do not publish secrets in bundles.
diff --git a/apps/share/app/api/health/route.ts b/apps/share/app/api/health/route.ts
new file mode 100644
index 0000000000..5d885a53f2
--- /dev/null
+++ b/apps/share/app/api/health/route.ts
@@ -0,0 +1,5 @@
+export const runtime = "nodejs";
+
+export function GET() {
+  return Response.json({ ok: true });
+}
diff --git a/apps/share/app/api/v1/bundles/route.ts b/apps/share/app/api/v1/bundles/route.ts
new file mode 100644
index 0000000000..5f63bf315f
--- /dev/null
+++ b/apps/share/app/api/v1/bundles/route.ts
@@ -0,0 +1,89 @@
+import { storeBundleJson } from "../../../../server/_lib/blob-store.ts";
+import { buildCorsHeaders, rateLimitPublishRequest, validateTrustedOrigin, verifyShareBotProtection } from "../../../../server/_lib/publish-security.ts";
+import { buildBundleUrls, getEnv, validateBundlePayload } from "../../../../server/_lib/share-utils.ts";
+import { buildRequestLike } from "../../../../server/_lib/request-like.ts";
+
+export const runtime = "nodejs";
+
+function formatPublishError(error: unknown): string {
+  const message = error instanceof Error ? error.message : "Blob put failed";
+  if (message.includes("BLOB_READ_WRITE_TOKEN") || message.includes("No token found")) {
+    return "Publishing requires BLOB_READ_WRITE_TOKEN in the server environment.";
+  }
+  return message;
+}
+
+function jsonResponse(body: unknown, request: Request, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      ...buildCorsHeaders(request),
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+export function OPTIONS(request: Request) {
+  return new Response(null, {
+    status: 204,
+    headers: buildCorsHeaders(request)
+  });
+}
+
+export async function POST(request: Request) {
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    return jsonResponse({ message: originCheck.message }, request, originCheck.status);
+  }
+
+  const rateLimit = rateLimitPublishRequest(request);
+  if (!rateLimit.ok) {
+    return new Response(JSON.stringify({ message: "Publishing is temporarily rate limited." }), {
+      status: 429,
+      headers: {
+        ...buildCorsHeaders(request),
+        "Content-Type": "application/json",
+        "X-Retry-After": String(rateLimit.retryAfterSeconds),
+      },
+    });
+  }
+
+  const botProtection = await verifyShareBotProtection(request);
+  if (!botProtection.ok) {
+    return jsonResponse({ message: botProtection.message }, request, botProtection.status);
+  }
+
+  const maxBytes = Number.parseInt(getEnv("MAX_BYTES", "262144"), 10);
+  const contentType = String(request.headers.get("content-type") ?? "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    return jsonResponse({ message: "Expected application/json" }, request, 415);
+  }
+
+  const rawJson = await request.text();
+  if (!rawJson) {
+    return jsonResponse({ message: "Body is required" }, request, 400);
+  }
+
+  if (Buffer.byteLength(rawJson, "utf8") > maxBytes) {
+    return jsonResponse({ message: "Bundle exceeds upload limit", maxBytes }, request, 413);
+  }
+
+  const validation = validateBundlePayload(rawJson);
+  if (!validation.ok) {
+    return jsonResponse({ message: validation.message }, request, 422);
+  }
+
+  try {
+    const { id } = await storeBundleJson(rawJson);
+    const urls = buildBundleUrls(
+      buildRequestLike({
+        headers: request.headers
+      }),
+      id
+    );
+
+    return jsonResponse({ url: urls.shareUrl }, request);
+  } catch (error) {
+    return jsonResponse({ message: formatPublishError(error) }, request, 500);
+  }
+}
diff --git a/apps/share/app/api/v1/package/route.ts b/apps/share/app/api/v1/package/route.ts
new file mode 100644
index 0000000000..13500f3af1
--- /dev/null
+++ b/apps/share/app/api/v1/package/route.ts
@@ -0,0 +1,101 @@
+import { storeBundleJson } from "../../../../server/_lib/blob-store.ts";
+import { packageOpenworkFiles } from "../../../../server/_lib/package-openwork-files.ts";
+import { buildCorsHeaders, rateLimitPublishRequest, validateTrustedOrigin, verifyShareBotProtection } from "../../../../server/_lib/publish-security.ts";
+import { buildBundleUrls, getEnv } from "../../../../server/_lib/share-utils.ts";
+import { buildRequestLike } from "../../../../server/_lib/request-like.ts";
+
+export const runtime = "nodejs";
+
+function formatPublishError(error: unknown): string {
+  const message = error instanceof Error ? error.message : "Failed to package files";
+  if (message.includes("BLOB_READ_WRITE_TOKEN") || message.includes("No token found")) {
+    return "Publishing requires BLOB_READ_WRITE_TOKEN in the server environment.";
+  }
+  return message;
+}
+
+function jsonResponse(body: unknown, request: Request, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      ...buildCorsHeaders(request),
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+export function OPTIONS(request: Request) {
+  return new Response(null, {
+    status: 204,
+    headers: buildCorsHeaders(request)
+  });
+}
+
+export async function POST(request: Request) {
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    return jsonResponse({ message: originCheck.message }, request, originCheck.status);
+  }
+
+  const rateLimit = rateLimitPublishRequest(request);
+  if (!rateLimit.ok) {
+    return new Response(JSON.stringify({ message: "Publishing is temporarily rate limited." }), {
+      status: 429,
+      headers: {
+        ...buildCorsHeaders(request),
+        "Content-Type": "application/json",
+        "X-Retry-After": String(rateLimit.retryAfterSeconds),
+      },
+    });
+  }
+
+  const botProtection = await verifyShareBotProtection(request);
+  if (!botProtection.ok) {
+    return jsonResponse({ message: botProtection.message }, request, botProtection.status);
+  }
+
+  const maxBytes = Number.parseInt(getEnv("MAX_BYTES", "262144"), 10);
+  const contentType = String(request.headers.get("content-type") ?? "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    return jsonResponse({ message: "Expected application/json" }, request, 415);
+  }
+
+  const raw = await request.text();
+  if (!raw) {
+    return jsonResponse({ message: "Body is required" }, request, 400);
+  }
+
+  if (Buffer.byteLength(raw, "utf8") > maxBytes) {
+    return jsonResponse({ message: "Package request exceeds upload limit", maxBytes }, request, 413);
+  }
+
+  let body: { preview?: boolean; [key: string]: unknown };
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return jsonResponse({ message: "Invalid JSON" }, request, 422);
+  }
+
+  try {
+    const packaged = packageOpenworkFiles(body);
+    if (body?.preview) {
+      return jsonResponse(packaged, request);
+    }
+
+    const { id } = await storeBundleJson(JSON.stringify(packaged.bundle));
+    const urls = buildBundleUrls(
+      buildRequestLike({
+        headers: request.headers
+      }),
+      id
+    );
+
+    return jsonResponse({
+      ...packaged,
+      url: urls.shareUrl,
+      id
+    }, request);
+  } catch (error) {
+    return jsonResponse({ message: formatPublishError(error) }, request, 422);
+  }
+}
diff --git a/apps/share/app/b/[id]/data/route.ts b/apps/share/app/b/[id]/data/route.ts
new file mode 100644
index 0000000000..e8114097c1
--- /dev/null
+++ b/apps/share/app/b/[id]/data/route.ts
@@ -0,0 +1,38 @@
+import { fetchBundleJsonById } from "../../../../server/_lib/blob-store.ts";
+import { wantsDownload } from "../../../../server/_lib/share-utils.ts";
+import { buildRequestLike } from "../../../../server/_lib/request-like.ts";
+import type { NextRequest } from "next/server";
+
+export const runtime = "nodejs";
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const routeParams = await params;
+  const id = String(routeParams?.id ?? "").trim();
+  if (!id) {
+    return Response.json({ message: "id is required" }, { status: 400 });
+  }
+
+  try {
+    const { blob, rawBuffer } = await fetchBundleJsonById(id);
+    const requestLike = buildRequestLike({
+      headers: request.headers,
+      searchParams: request.nextUrl.searchParams
+    });
+    const responseHeaders = new Headers({
+      Vary: "Accept",
+      "Cache-Control": "public, max-age=3600",
+      "Content-Type": blob.contentType || "application/json"
+    });
+
+    if (wantsDownload(requestLike)) {
+      responseHeaders.set("Content-Disposition", `attachment; filename="openwork-bundle-${id}.json"`);
+    }
+
+    return new Response(rawBuffer as unknown as BodyInit, {
+      status: 200,
+      headers: responseHeaders
+    });
+  } catch {
+    return Response.json({ message: "Not found" }, { status: 404 });
+  }
+}
diff --git a/apps/share/app/b/[id]/page.tsx b/apps/share/app/b/[id]/page.tsx
new file mode 100644
index 0000000000..362b1451ef
--- /dev/null
+++ b/apps/share/app/b/[id]/page.tsx
@@ -0,0 +1,124 @@
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+
+import ShareBundlePage from "../../../components/share-bundle-page";
+import { getBundlePageProps } from "../../../server/b/get-bundle-page-props.ts";
+import { getGithubStars } from "../../../server/_lib/github-stars.ts";
+import { buildRequestLike } from "../../../server/_lib/request-like.ts";
+
+async function loadBundlePageProps(id: string) {
+  const requestHeaders = await headers();
+  return getBundlePageProps({
+    id,
+    requestLike: buildRequestLike({ headers: requestHeaders })
+  });
+}
+
+type BundlePageSearchParams = Record<string, string | string[] | undefined>;
+
+function firstQueryValue(value: string | string[] | undefined): string {
+  return Array.isArray(value) ? String(value[0] ?? "") : String(value ?? "");
+}
+
+function wantsJsonBundleResponse(requestHeaders: Headers, searchParams: BundlePageSearchParams): boolean {
+  const format = firstQueryValue(searchParams.format).trim().toLowerCase();
+  if (format === "json") return true;
+
+  const accept = String(requestHeaders.get("accept") ?? "").toLowerCase();
+  return accept.includes("application/json") && !accept.includes("text/html");
+}
+
+function buildBundleDataUrl(id: string, searchParams: BundlePageSearchParams): string {
+  const query = new URLSearchParams();
+  const download = firstQueryValue(searchParams.download).trim();
+  if (download) {
+    query.set("download", download);
+  }
+
+  const suffix = query.toString();
+  return `/b/${encodeURIComponent(id)}/data${suffix ? `?${suffix}` : ""}`;
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ id: string }> }): Promise<Metadata> {
+  const routeParams = await params;
+  const props = await loadBundlePageProps(routeParams?.id);
+  const pageTitle = props.missing ? "SKILL.md not found" : props.title;
+  const pageDescription = props.missing
+    ? "This share link does not exist anymore, or the bundle id is invalid."
+    : props.description;
+
+  return {
+    title: pageTitle,
+    description: pageDescription,
+    alternates: {
+      canonical: props.canonicalUrl
+    },
+    robots: props.missing
+      ? {
+          index: false,
+          follow: false,
+          googleBot: {
+            index: false,
+            follow: false
+          }
+        }
+      : undefined,
+    openGraph: {
+      type: "website",
+      siteName: "OpenWork Share",
+      title: pageTitle,
+      description: pageDescription,
+      url: props.canonicalUrl,
+      images: [
+        {
+          url: props.ogImageUrls?.byVariant.facebook || props.ogImageUrl,
+          width: 1200,
+          height: 630,
+          alt: `${pageTitle} bundle preview`
+        }
+      ]
+    },
+    twitter: {
+      card: "summary_large_image",
+      title: pageTitle,
+      description: pageDescription,
+      images: [
+        {
+          url: props.twitterImageUrl || props.ogImageUrl,
+          alt: `${pageTitle} bundle preview`
+        }
+      ]
+    },
+    other: props.missing
+      ? undefined
+      : {
+          "openwork:bundle-id": props.id!,
+          "openwork:bundle-type": props.bundleType!,
+          "openwork:schema-version": props.schemaVersion!,
+          "openwork:open-in-app-url": props.openInAppDeepLink!
+        }
+  };
+}
+
+export default async function BundlePage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ id: string }>;
+  searchParams: Promise<BundlePageSearchParams>;
+}) {
+  const [routeParams, resolvedSearchParams, requestHeaders] = await Promise.all([params, searchParams, headers()]);
+  const id = String(routeParams?.id ?? "").trim();
+
+  if (id && wantsJsonBundleResponse(requestHeaders, resolvedSearchParams ?? {})) {
+    redirect(buildBundleDataUrl(id, resolvedSearchParams ?? {}));
+  }
+
+  const props = await getBundlePageProps({
+    id,
+    requestLike: buildRequestLike({ headers: requestHeaders })
+  });
+  const stars = await getGithubStars();
+  return <ShareBundlePage {...props} stars={stars} />;
+}
diff --git a/apps/share/app/layout.tsx b/apps/share/app/layout.tsx
new file mode 100644
index 0000000000..68f6f99bf8
--- /dev/null
+++ b/apps/share/app/layout.tsx
@@ -0,0 +1,80 @@
+import "../styles/globals.css";
+
+import type { Metadata } from "next";
+import { Inter, JetBrains_Mono } from "next/font/google";
+import Script from "next/script";
+import type { ReactNode } from "react";
+import { BotIdClient } from "botid/client";
+
+import { DEFAULT_PUBLIC_BASE_URL } from "../server/_lib/share-utils.ts";
+
+const inter = Inter({
+  subsets: ["latin"],
+  display: "swap",
+  variable: "--font-inter"
+});
+
+const jetbrainsMono = JetBrains_Mono({
+  subsets: ["latin"],
+  display: "swap",
+  variable: "--font-mono"
+});
+
+export const metadata: Metadata = {
+  metadataBase: new URL(DEFAULT_PUBLIC_BASE_URL),
+  title: {
+    default: "OpenWork Share",
+    template: "%s - OpenWork Share"
+  },
+  description: "Publish OpenWork worker packages and shareable import links.",
+  icons: { icon: "/openwork-mark.svg" },
+  openGraph: {
+    type: "website",
+    siteName: "OpenWork Share",
+  },
+  twitter: {
+    card: "summary_large_image",
+    site: "@getopenwork",
+  },
+};
+
+const defaultPosthogKey = "phc_4YnPTlDVYPjgwKvLuNxhbHjV5kadgvd7XLzVHWnCXAI";
+const defaultPosthogHost = "https://us.i.posthog.com";
+const posthogKey =
+  process.env.NEXT_PUBLIC_POSTHOG_KEY?.trim() ||
+  process.env.NEXT_PUBLIC_POSTHOG_API_KEY?.trim() ||
+  defaultPosthogKey;
+const posthogHost = (process.env.NEXT_PUBLIC_POSTHOG_HOST ?? defaultPosthogHost).trim();
+
+const posthogBootstrap = posthogKey
+  ? `!function(t,e){var o,n,p,r;e.__SV||(window.posthog&&window.posthog.__loaded)||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture identify alias reset register unregister setPersonProperties".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])})}(document,window.posthog||[]);
+posthog.init(${JSON.stringify(posthogKey)}, {
+  api_host: ${JSON.stringify(posthogHost)},
+  defaults: '2026-01-30',
+  person_profiles: 'identified_only',
+  autocapture: true,
+  capture_pageview: 'history_change',
+  capture_pageleave: true
+});`
+  : "";
+
+const protectedRoutes = [
+  { path: "/v1/package", method: "POST" as const },
+  { path: "/v1/bundles", method: "POST" as const },
+];
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en" className={`${inter.variable} ${jetbrainsMono.variable}`}>
+      <head>
+        <BotIdClient protect={protectedRoutes} />
+        {posthogBootstrap ? (
+          <Script id="posthog" strategy="beforeInteractive" dangerouslySetInnerHTML={{ __html: posthogBootstrap }} />
+        ) : null}
+      </head>
+      <body>
+        {children}
+      </body>
+    </html>
+  );
+}
diff --git a/apps/share/app/og/[id]/route.ts b/apps/share/app/og/[id]/route.ts
new file mode 100644
index 0000000000..ba0d732f79
--- /dev/null
+++ b/apps/share/app/og/[id]/route.ts
@@ -0,0 +1,101 @@
+import { fetchBundleJsonById } from "../../../server/_lib/blob-store.ts";
+import { parseOgImageVariant } from "../../../server/_lib/og-image-variants.ts";
+import { buildBundleOgImageModel, buildRootOgImageModel, renderBundleOgImage, renderRootOgImage } from "../../../server/_lib/render-og-image.ts";
+import { renderOgPngResponse } from "../../../server/_lib/render-og-image-response.tsx";
+
+export const runtime = "nodejs";
+
+function getCorsHeaders(): Record<string, string> {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET,OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type,Accept"
+  };
+}
+
+export function OPTIONS() {
+  return new Response(null, {
+    status: 204,
+    headers: getCorsHeaders()
+  });
+}
+
+export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const routeParams = await params;
+  const id = String(routeParams?.id ?? "root").trim() || "root";
+  const url = new URL(request.url);
+  const format = url.searchParams.get("format") === "svg" ? "svg" : "png";
+  const variant = parseOgImageVariant(url.searchParams.get("variant"));
+  const cacheControl =
+    id === "root"
+      ? "public, max-age=3600"
+      : "public, max-age=3600, stale-while-revalidate=86400";
+
+  if (id === "root") {
+    if (format === "svg") {
+      return new Response(renderRootOgImage(variant), {
+        status: 200,
+        headers: {
+          ...getCorsHeaders(),
+          "Content-Type": "image/svg+xml; charset=utf-8",
+          "Cache-Control": cacheControl
+        }
+      });
+    }
+
+    return renderOgPngResponse(
+      buildRootOgImageModel(),
+      {
+        ...getCorsHeaders(),
+        "Cache-Control": cacheControl
+      },
+      variant,
+    );
+  }
+
+  try {
+    const { rawJson } = await fetchBundleJsonById(id);
+    if (format === "svg") {
+      return new Response(renderBundleOgImage({ id, rawJson, variant }), {
+        status: 200,
+        headers: {
+          ...getCorsHeaders(),
+          "Content-Type": "image/svg+xml; charset=utf-8",
+          "Cache-Control": cacheControl
+        }
+      });
+    }
+
+    return renderOgPngResponse(
+      buildBundleOgImageModel({ id, rawJson }),
+      {
+        ...getCorsHeaders(),
+        "Cache-Control": cacheControl
+      },
+      variant,
+    );
+  } catch {
+    console.error(`[share-og] failed to render bundle ${id}`);
+    const fallbackCacheControl = "public, max-age=300, stale-while-revalidate=3600";
+
+    if (format === "svg") {
+      return new Response(renderRootOgImage(variant), {
+        status: 200,
+        headers: {
+          ...getCorsHeaders(),
+          "Content-Type": "image/svg+xml; charset=utf-8",
+          "Cache-Control": fallbackCacheControl
+        }
+      });
+    }
+
+    return renderOgPngResponse(
+      buildRootOgImageModel(),
+      {
+        ...getCorsHeaders(),
+        "Cache-Control": fallbackCacheControl
+      },
+      variant,
+    );
+  }
+}
diff --git a/apps/share/app/page.tsx b/apps/share/app/page.tsx
new file mode 100644
index 0000000000..9151f2da16
--- /dev/null
+++ b/apps/share/app/page.tsx
@@ -0,0 +1,61 @@
+import type { Metadata } from "next";
+
+import ShareHomeClient from "../components/share-home-client";
+import ShareNav from "../components/share-nav";
+import { getGithubStars } from "../server/_lib/github-stars.ts";
+import {
+  DEFAULT_OG_IMAGE_VARIANT,
+  DEFAULT_TWITTER_IMAGE_VARIANT,
+  OG_IMAGE_VARIANTS,
+} from "../server/_lib/og-image-variants.ts";
+import { DEFAULT_PUBLIC_BASE_URL, buildOgImageUrlFromOrigin } from "../server/_lib/share-utils.ts";
+
+export const revalidate = 3600;
+
+const rootOgImageUrl = buildOgImageUrlFromOrigin(DEFAULT_PUBLIC_BASE_URL, "root", DEFAULT_OG_IMAGE_VARIANT);
+const rootTwitterImageUrl = buildOgImageUrlFromOrigin(DEFAULT_PUBLIC_BASE_URL, "root", DEFAULT_TWITTER_IMAGE_VARIANT);
+const rootOpenGraphVariants = ["facebook", "linkedin", "slack", "whatsapp"] as const;
+const rootOpenGraphImages = rootOpenGraphVariants.map((variant) => ({
+  url: buildOgImageUrlFromOrigin(DEFAULT_PUBLIC_BASE_URL, "root", variant),
+  width: OG_IMAGE_VARIANTS[variant].width,
+  height: OG_IMAGE_VARIANTS[variant].height,
+  alt: "OpenWork Share landing page preview",
+}));
+
+export const metadata: Metadata = {
+  title: "Share Your Skill",
+  description: "Upload, edit, and publish a single OpenWork skill for sharing.",
+  alternates: {
+    canonical: DEFAULT_PUBLIC_BASE_URL
+  },
+  openGraph: {
+    type: "website",
+    siteName: "OpenWork Share",
+    title: "Share Your Skill",
+    description: "Upload, edit, and publish a single OpenWork skill for sharing.",
+    url: DEFAULT_PUBLIC_BASE_URL,
+    images: rootOpenGraphImages,
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "Share Your Skill",
+    description: "Upload, edit, and publish a single OpenWork skill for sharing.",
+    images: [
+      {
+        url: rootTwitterImageUrl,
+        alt: "OpenWork Share landing page preview"
+      }
+    ]
+  }
+};
+
+export default async function ShareHomePage() {
+  const stars = await getGithubStars();
+
+  return (
+    <main className="shell">
+      <ShareNav stars={stars} />
+      <ShareHomeClient />
+    </main>
+  );
+}
diff --git a/apps/share/components/share-bundle-page.tsx b/apps/share/components/share-bundle-page.tsx
new file mode 100644
index 0000000000..4c6feeaa27
--- /dev/null
+++ b/apps/share/components/share-bundle-page.tsx
@@ -0,0 +1,314 @@
+"use client";
+
+import { useMemo, useRef, useState, type KeyboardEvent, type MouseEvent, type PointerEvent } from "react";
+
+import type { BundlePageProps } from "../server/_lib/types.ts";
+import ShareNav from "./share-nav";
+import SkillEditorSurface from "./skill-editor-surface";
+import { parseSkillMarkdown } from "./skill-markdown";
+
+type BundleSelection = NonNullable<BundlePageProps["previewSelections"]>[number];
+
+const SPECIAL_TOKENS: Record<string, string> = {
+  api: "API",
+  json: "JSON",
+  jsonc: "JSONC",
+  mcp: "MCP",
+  md: "MD",
+  mdx: "MDX",
+  opencode: "OpenCode",
+  openwork: "OpenWork",
+  yaml: "YAML",
+  yml: "YAML",
+};
+
+function humanizeLabel(value: string | null | undefined): string {
+  const normalized = String(value ?? "")
+    .trim()
+    .replace(/\.[a-z0-9]+$/i, "")
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .replace(/[_-]+/g, " ")
+    .replace(/\s+/g, " ");
+
+  if (!normalized) return "OpenWork Bundle";
+
+  return normalized
+    .split(" ")
+    .filter(Boolean)
+    .map((part) => {
+      const lower = part.toLowerCase();
+      if (SPECIAL_TOKENS[lower]) return SPECIAL_TOKENS[lower];
+      return `${part.slice(0, 1).toUpperCase()}${part.slice(1).toLowerCase()}`;
+    })
+    .join(" ");
+}
+
+function formatSurfaceEyebrow(selection: BundleSelection | undefined, parsedName: string, fallbackTitle: string | undefined): string {
+  if (selection?.tone === "skill") {
+    return humanizeLabel(parsedName || selection.name || fallbackTitle || "Skill");
+  }
+
+  if (selection?.tone === "command") {
+    return humanizeLabel(selection.name || "Command");
+  }
+
+  if (selection?.tone === "agent") {
+    const label = humanizeLabel(selection.name || "Agent");
+    return /agent$/i.test(label) ? label : `${label} Agent`;
+  }
+
+  if (selection?.tone === "mcp") {
+    const label = humanizeLabel(selection.name || "MCP");
+    return /mcp$/i.test(label) ? label : `${label} MCP`;
+  }
+
+  const filename = selection?.filename || selection?.name || fallbackTitle || "config";
+  if (/^openwork\.json$/i.test(filename)) return "OpenWork Config";
+  if (/^opencode\.jsonc?$/i.test(filename)) return "OpenCode Config";
+
+  const label = humanizeLabel(filename);
+  return /config$/i.test(label) ? label : `${label} Config`;
+}
+
+function toneClass(item: { tone?: string } | null | undefined): string {
+  if (item?.tone === "agent") return "dot-agent";
+  if (item?.tone === "mcp") return "dot-mcp";
+  if (item?.tone === "command") return "dot-command";
+  if (item?.tone === "config") return "dot-config";
+  return "dot-skill";
+}
+
+export default function ShareBundlePage(props: BundlePageProps & { stars?: string }) {
+  const [previewCopied, setPreviewCopied] = useState(false);
+  const [activeSelectionId, setActiveSelectionId] = useState(props.previewSelections?.[0]?.id ?? "preview-0");
+  const previewCopyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  const openInAppUrl = props.openInAppDeepLink || "#";
+  const previewSelections = props.previewSelections?.length
+    ? props.previewSelections
+    : [
+        {
+          id: "preview-0",
+          name: props.title || "Untitled skill",
+          filename: props.previewFilename || "skill.md",
+          text: props.previewText || "",
+          tone: props.previewTone || "skill",
+          label: props.previewLabel || "Skill preview",
+        },
+      ];
+  const activeSelection = previewSelections.find((selection) => selection.id === activeSelectionId) ?? previewSelections[0];
+  const parsedPreview = useMemo(() => parseSkillMarkdown(activeSelection?.text || ""), [activeSelection?.text]);
+  const surfaceEyebrow = formatSurfaceEyebrow(activeSelection, parsedPreview.name, props.title);
+  const previewFilename = activeSelection?.filename || props.previewFilename || "bundle.json";
+  const showBundleSidebar = previewSelections.length > 1 || Boolean(props.metadataRows?.length);
+  const isSingleSkill = props.bundleType === "skill" && previewSelections.length === 1;
+
+  const copyPreview = async () => {
+    if (!activeSelection?.text) return;
+
+    try {
+      await navigator.clipboard.writeText(activeSelection.text);
+      setPreviewCopied(true);
+    } catch {
+      setPreviewCopied(false);
+    }
+
+    if (previewCopyTimerRef.current) clearTimeout(previewCopyTimerRef.current);
+    previewCopyTimerRef.current = setTimeout(() => {
+      setPreviewCopied(false);
+      previewCopyTimerRef.current = null;
+    }, 800);
+  };
+
+  const buildOpenInAppLaunchUrl = () => {
+    if (!openInAppUrl || openInAppUrl === "#") return openInAppUrl;
+
+    try {
+      const url = new URL(openInAppUrl);
+      const nonce = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function"
+        ? crypto.randomUUID()
+        : `${Date.now()}-${Math.round(Math.random() * 1_000_000_000)}`;
+      url.searchParams.set("ow_nonce", nonce);
+      return url.toString();
+    } catch {
+      return openInAppUrl;
+    }
+  };
+
+  const refreshOpenInAppHref = (anchor: HTMLAnchorElement) => {
+    const launchUrl = buildOpenInAppLaunchUrl();
+    if (launchUrl) {
+      anchor.href = launchUrl;
+    }
+    return launchUrl;
+  };
+
+  const openInOpenWork = (event: MouseEvent<HTMLAnchorElement>) => {
+    if (!openInAppUrl || openInAppUrl === "#") return;
+    event.preventDefault();
+
+    window.location.assign(refreshOpenInAppHref(event.currentTarget));
+  };
+
+  const prepareOpenInOpenWork = (event: PointerEvent<HTMLAnchorElement> | MouseEvent<HTMLAnchorElement>) => {
+    refreshOpenInAppHref(event.currentTarget);
+  };
+
+  const prepareOpenInOpenWorkFromKeyboard = (event: KeyboardEvent<HTMLAnchorElement>) => {
+    if (event.key !== "Enter" && event.key !== " ") return;
+    refreshOpenInAppHref(event.currentTarget);
+  };
+
+  const actionButtons = (
+    <>
+      <button className="button-primary" type="button" onClick={() => void copyPreview()}>
+        {previewCopied ? "Copied to clipboard" : "Copy to clipboard"}
+      </button>
+      <a
+        className="button-secondary"
+        href={openInAppUrl}
+        onPointerDown={prepareOpenInOpenWork}
+        onMouseDown={prepareOpenInOpenWork}
+        onKeyDown={prepareOpenInOpenWorkFromKeyboard}
+        onClick={openInOpenWork}
+      >
+        Open in OpenWork
+      </a>
+    </>
+  );
+
+  return (
+    <main className="shell">
+      <ShareNav stars={props.stars} />
+
+      {props.missing ? (
+        <section className="status-card">
+          <span className="eyebrow">OpenWork Share</span>
+          <h1>SKILL.md not found</h1>
+          <p>
+            This share link does not exist anymore, or the bundle id is invalid.
+          </p>
+          <div className="hero-actions">
+            <a className="button-primary" href="/">
+              Share another SKILL
+            </a>
+          </div>
+        </section>
+      ) : (
+        <>
+          {isSingleSkill ? (
+            <>
+              <section className="share-bundle-toolbar surface-shell">
+                <div className="button-row share-bundle-actions">{actionButtons}</div>
+              </section>
+
+              <section className="share-bundle-simple-stack">
+                <SkillEditorSurface
+                  className="share-bundle-editor share-bundle-editor-simple"
+                  toneClassName={toneClass(activeSelection)}
+                  eyebrow={surfaceEyebrow}
+                  filename={previewFilename}
+                  documentValue={activeSelection?.text || ""}
+                  readOnly={true}
+                  copied={previewCopied}
+                  onCopy={() => void copyPreview()}
+                />
+              </section>
+            </>
+          ) : (
+            <>
+              <section className="share-bundle-hero-card surface-shell">
+                <div className="share-bundle-hero-copy">
+                  <span className="eyebrow">{props.typeLabel}</span>
+                  <h1>{props.title}</h1>
+                  {props.description ? <p className="hero-body">{props.description}</p> : null}
+                  {props.installHint ? <p className="preview-note">{props.installHint}</p> : null}
+                  <div className="button-row share-bundle-actions">{actionButtons}</div>
+                </div>
+
+                <aside className="share-bundle-summary surface-soft">
+                  <div className="bundle-strip-header">Bundle summary</div>
+                  <div className="summary-grid">
+                    <div className="summary-stat">
+                      <span className="summary-stat-value">{previewSelections.length}</span>
+                      <span className="summary-stat-label">Previewable items</span>
+                    </div>
+                    <div className="summary-stat">
+                      <span className="summary-stat-value">{props.typeLabel || "Bundle"}</span>
+                      <span className="summary-stat-label">Share type</span>
+                    </div>
+                    <div className="summary-stat">
+                      <span className="summary-stat-value">{props.schemaVersion || "unknown"}</span>
+                      <span className="summary-stat-label">Schema version</span>
+                    </div>
+                    <div className="summary-stat">
+                      <span className="summary-stat-value">{surfaceEyebrow}</span>
+                      <span className="summary-stat-label">Open now</span>
+                    </div>
+                  </div>
+                </aside>
+              </section>
+
+              <section className={`share-bundle-stack${showBundleSidebar ? " has-sidebar" : ""}`}>
+                {showBundleSidebar ? (
+                  <div className="share-bundle-sidebar">
+                    <article className="bundle-compact-strip surface-soft">
+                      <div className="bundle-strip-header">Included</div>
+                      <div className="bundle-strip-list" aria-label="Included bundle items">
+                        {previewSelections.map((selection) => {
+                          const isActive = selection.id === activeSelection?.id;
+                          return (
+                            <button
+                              key={selection.id}
+                              type="button"
+                              className={`included-item${isActive ? " is-active" : ""}`}
+                              onClick={() => setActiveSelectionId(selection.id)}
+                              disabled={isActive}
+                            >
+                              <span className="item-left">
+                                <span className={`item-dot ${toneClass(selection)}`} />
+                                <span className="item-text">
+                                  <span className="item-title">{formatSurfaceEyebrow(selection, selection.name, selection.name)}</span>
+                                  <span className="item-meta">{selection.label || selection.filename}</span>
+                                </span>
+                              </span>
+                            </button>
+                          );
+                        })}
+                      </div>
+                    </article>
+
+                    {props.metadataRows?.length ? (
+                      <article className="share-bundle-meta-card surface-soft">
+                        <div className="bundle-strip-header">Bundle info</div>
+                        <dl className="metadata-list share-bundle-metadata-list">
+                          {props.metadataRows.map((row) => (
+                            <div className="metadata-row" key={row.label}>
+                              <dt>{row.label}</dt>
+                              <dd>{row.value}</dd>
+                            </div>
+                          ))}
+                        </dl>
+                      </article>
+                    ) : null}
+                  </div>
+                ) : null}
+
+                <SkillEditorSurface
+                  className="share-bundle-editor"
+                  toneClassName={toneClass(activeSelection)}
+                  eyebrow={surfaceEyebrow}
+                  filename={previewFilename}
+                  documentValue={activeSelection?.text || ""}
+                  readOnly={true}
+                  copied={previewCopied}
+                  onCopy={() => void copyPreview()}
+                />
+              </section>
+            </>
+          )}
+        </>
+      )}
+    </main>
+  );
+}
diff --git a/apps/share/components/share-home-client.tsx b/apps/share/components/share-home-client.tsx
new file mode 100644
index 0000000000..1774416fe3
--- /dev/null
+++ b/apps/share/components/share-home-client.tsx
@@ -0,0 +1,437 @@
+"use client";
+
+import { useEffect, useMemo, useRef, useState } from "react";
+
+import SkillEditorSurface from "./skill-editor-surface";
+import { composeSkillMarkdown, DEFAULT_SKILL_NAME, normalizeSkillMarkdown, parseSkillMarkdown } from "./skill-markdown";
+import type { BusyMode, EntryLike, FilePayload, PackageResponse, PreviewItem } from "./share-home-types";
+import { getPackageStatus, getPreviewFilename } from "./share-home-state";
+
+const DEFAULT_STATUS = "Upload a single file or paste skill content below.";
+const MULTI_FILE_ERROR = "Upload or paste a single skill to continue.";
+const PREVIEW_DEBOUNCE_MS = 1000;
+
+const BASELINE_BODY = `# Agent Creator
+
+Any markdown body is acceptable here.
+`;
+
+const BASELINE_DOCUMENT = composeSkillMarkdown(DEFAULT_SKILL_NAME, "This is a skill I'm currently using.", BASELINE_BODY);
+
+function toneClass(item: PreviewItem | null): string {
+  if (item?.tone === "agent") return "dot-agent";
+  if (item?.tone === "mcp") return "dot-mcp";
+  if (item?.tone === "command") return "dot-command";
+  if (item?.tone === "config") return "dot-config";
+  return "dot-skill";
+}
+
+function buildVirtualEntry(name: string, content: string): EntryLike {
+  const normalized = String(content || "");
+  return {
+    name: name.trim() || DEFAULT_SKILL_NAME,
+    async text() {
+      return normalized;
+    },
+  };
+}
+
+async function fileToPayload(file: EntryLike): Promise<FilePayload> {
+  const f = file as EntryLike & { relativePath?: string; webkitRelativePath?: string; path?: string };
+  return {
+    name: file.name,
+    path: f.relativePath || f.webkitRelativePath || f.path || file.name,
+    content: await file.text(),
+  };
+}
+
+function buildPredictedPreviewItem(skillName: string, hasContent: boolean): PreviewItem | null {
+  if (!hasContent) return null;
+  return {
+    name: skillName.trim() || DEFAULT_SKILL_NAME,
+    kind: "Skill",
+    meta: "Checking skill...",
+    tone: "skill",
+  };
+}
+
+function flattenEntries(entry: FileSystemEntry, prefix = ""): Promise<File[]> {
+  return new Promise((resolve, reject) => {
+    if (entry?.isFile) {
+      (entry as FileSystemFileEntry).file(
+        (file) => {
+          (file as File & { relativePath: string }).relativePath = `${prefix}${file.name}`;
+          resolve([file]);
+        },
+        reject,
+      );
+      return;
+    }
+
+    if (!entry?.isDirectory) {
+      resolve([]);
+      return;
+    }
+
+    const reader = (entry as FileSystemDirectoryEntry).createReader();
+    const files: File[] = [];
+
+    const readBatch = () => {
+      reader.readEntries(
+        async (entries) => {
+          if (!entries.length) {
+            resolve(files);
+            return;
+          }
+          for (const child of entries) {
+            files.push(...(await flattenEntries(child, `${prefix}${entry.name}/`)));
+          }
+          readBatch();
+        },
+        reject,
+      );
+    };
+
+    readBatch();
+  });
+}
+
+async function collectDroppedFiles(dataTransfer: DataTransfer | null): Promise<File[]> {
+  const items = Array.from(dataTransfer?.items || []);
+  if (!items.length) return Array.from(dataTransfer?.files || []);
+  const collected: File[] = [];
+
+  for (const item of items) {
+    const entry = item.webkitGetAsEntry ? item.webkitGetAsEntry() : null;
+    if (!entry) {
+      const file = item.getAsFile ? item.getAsFile() : null;
+      if (file) collected.push(file);
+      continue;
+    }
+    collected.push(...(await flattenEntries(entry)));
+  }
+
+  return collected;
+}
+
+export default function ShareHomeClient() {
+  const [uploadedFileCount, setUploadedFileCount] = useState(0);
+  const [editorValue, setEditorValue] = useState("");
+  const [preview, setPreview] = useState<PackageResponse | null>(null);
+  const [warnings, setWarnings] = useState<string[]>([]);
+  const [busyMode, setBusyMode] = useState<BusyMode>(null);
+  const [dropActive, setDropActive] = useState(false);
+  const [previewCopied, setPreviewCopied] = useState(false);
+  const [statusMessage, setStatusMessage] = useState(DEFAULT_STATUS);
+  const [errorMessage, setErrorMessage] = useState("");
+  const [predictedPreviewItem, setPredictedPreviewItem] = useState<PreviewItem | null>(null);
+  const requestIdRef = useRef<number>(0);
+  const previewRequestTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  const trimmedDocument = useMemo(() => editorValue.trim(), [editorValue]);
+  const hasContent = trimmedDocument.length > 0;
+  const parsedEditor = useMemo(() => parseSkillMarkdown(editorValue), [editorValue]);
+  const inferredSkillName = parsedEditor.name.trim() || DEFAULT_SKILL_NAME;
+  const effectiveEntries: EntryLike[] = useMemo(
+    () => (uploadedFileCount > 1 || !hasContent ? [] : [buildVirtualEntry(inferredSkillName, editorValue)]),
+    [editorValue, hasContent, inferredSkillName, uploadedFileCount],
+  );
+  const busy = busyMode !== null;
+  const packageStatus = useMemo(
+    () => getPackageStatus({ errorMessage, warnings, effectiveEntryCount: effectiveEntries.length }),
+    [effectiveEntries.length, errorMessage, warnings],
+  );
+  const activePreviewItem = preview?.items?.[0] ?? predictedPreviewItem;
+  const previewFilename = getPreviewFilename({
+    selectedEntryCount: uploadedFileCount,
+    selectedEntryName: inferredSkillName,
+    hasPastedContent: hasContent,
+    manualName: parsedEditor.name,
+  });
+  const publishDisabled = busy || !hasContent || Boolean(errorMessage) || uploadedFileCount > 1;
+  const previewCopyValue = hasContent ? editorValue : BASELINE_DOCUMENT;
+  const showSupportingFeedback =
+    packageStatus.severity === "warn" ||
+    packageStatus.severity === "info" ||
+    packageStatus.items.length > 0 ||
+    statusMessage !== DEFAULT_STATUS;
+
+  const requestPackage = async (previewOnly: boolean): Promise<PackageResponse> => {
+    const files = await Promise.all(effectiveEntries.map(fileToPayload));
+    const response = await fetch("/v1/package", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({ files, preview: previewOnly }),
+    });
+
+    let json: PackageResponse | { message?: string } | null = null;
+    try {
+      json = await response.json();
+    } catch {
+      json = null;
+    }
+
+    if (!response.ok) {
+      throw new Error(json && "message" in json && typeof json.message === "string" ? json.message : "Packaging failed.");
+    }
+
+    return json as PackageResponse;
+  };
+
+  useEffect(() => {
+    setPredictedPreviewItem(buildPredictedPreviewItem(inferredSkillName, hasContent));
+  }, [hasContent, inferredSkillName]);
+
+  useEffect(() => {
+    if (previewRequestTimerRef.current) {
+      clearTimeout(previewRequestTimerRef.current);
+      previewRequestTimerRef.current = null;
+    }
+
+    if (uploadedFileCount > 1) {
+      requestIdRef.current += 1;
+      setBusyMode(null);
+      setPreview(null);
+      setWarnings([]);
+      setErrorMessage(MULTI_FILE_ERROR);
+      return;
+    }
+
+    if (!hasContent) {
+      requestIdRef.current += 1;
+      setBusyMode(null);
+      setPreview(null);
+      setWarnings([]);
+      setErrorMessage("");
+      return;
+    }
+
+    const currentRequestId = requestIdRef.current + 1;
+    requestIdRef.current = currentRequestId;
+    let cancelled = false;
+
+    previewRequestTimerRef.current = setTimeout(() => {
+      previewRequestTimerRef.current = null;
+      if (cancelled || requestIdRef.current !== currentRequestId) return;
+
+      setBusyMode("preview");
+
+      void (async () => {
+        try {
+          const nextPreview = await requestPackage(true);
+          if (cancelled || requestIdRef.current !== currentRequestId) return;
+          setPreview(nextPreview);
+          setWarnings(Array.isArray(nextPreview.warnings) ? nextPreview.warnings : []);
+          setErrorMessage("");
+          if (nextPreview.items?.[0]) {
+            setPredictedPreviewItem(nextPreview.items[0]);
+          }
+        } catch (error) {
+          if (cancelled || requestIdRef.current !== currentRequestId) return;
+          setPreview(null);
+          setWarnings([]);
+          setErrorMessage(error instanceof Error ? error.message : "Packaging failed.");
+        } finally {
+          if (!cancelled && requestIdRef.current === currentRequestId) {
+            setBusyMode(null);
+          }
+        }
+      })();
+    }, PREVIEW_DEBOUNCE_MS);
+
+    return () => {
+      cancelled = true;
+      if (previewRequestTimerRef.current) {
+        clearTimeout(previewRequestTimerRef.current);
+        previewRequestTimerRef.current = null;
+      }
+    };
+  }, [effectiveEntries, hasContent, uploadedFileCount]);
+
+  const assignEntries = async (files: FileList | File[] | null) => {
+    const entries = Array.from(files || []).filter(Boolean);
+    setUploadedFileCount(entries.length);
+    setPreview(null);
+    setWarnings([]);
+
+    if (entries.length > 1) {
+      setEditorValue("");
+      setErrorMessage(MULTI_FILE_ERROR);
+      setStatusMessage("Only one file can be uploaded at a time.");
+      return;
+    }
+
+    if (!entries.length) {
+      setEditorValue("");
+      setErrorMessage("");
+      setStatusMessage(DEFAULT_STATUS);
+      return;
+    }
+
+    try {
+      const rawContent = await entries[0].text();
+      setEditorValue(normalizeSkillMarkdown(rawContent, entries[0].name || DEFAULT_SKILL_NAME));
+      setErrorMessage("");
+      setStatusMessage(DEFAULT_STATUS);
+    } catch {
+      setEditorValue("");
+      setErrorMessage("Could not read the uploaded file.");
+      setStatusMessage(DEFAULT_STATUS);
+    } finally {
+      setUploadedFileCount(0);
+    }
+  };
+
+  const previewCopyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  const publishBundle = async () => {
+    if (publishDisabled) return;
+
+    requestIdRef.current += 1;
+    if (previewRequestTimerRef.current) {
+      clearTimeout(previewRequestTimerRef.current);
+      previewRequestTimerRef.current = null;
+    }
+    setBusyMode("publish");
+
+    try {
+      const result = await requestPackage(false);
+      const nextUrl = typeof result?.url === "string" ? result.url : "";
+      if (nextUrl) {
+        window.location.assign(nextUrl);
+        return;
+      }
+      setErrorMessage("Share link generation completed without a destination URL.");
+    } catch (error) {
+      setErrorMessage(error instanceof Error ? error.message : "Packaging failed.");
+    } finally {
+      setBusyMode(null);
+    }
+  };
+
+  const copyPreviewText = async () => {
+    try {
+      await navigator.clipboard.writeText(previewCopyValue);
+      setPreviewCopied(true);
+      setStatusMessage("Copied preview to clipboard.");
+    } catch {
+      setStatusMessage("Clipboard access was blocked.");
+    }
+
+    if (previewCopyTimerRef.current) clearTimeout(previewCopyTimerRef.current);
+    previewCopyTimerRef.current = setTimeout(() => {
+      setPreviewCopied(false);
+      previewCopyTimerRef.current = null;
+    }, 300);
+  };
+
+  return (
+    <section className="hero-layout hero-layout-share">
+      <div className="hero-copy">
+        <h1>
+          Share your <em>skill</em>
+        </h1>
+        <p className="hero-body">Edit and share skills in seconds.</p>
+      </div>
+
+      <div className="share-home-stack">
+        <div className="package-card share-card surface-soft">
+          <div className="share-upload-row share-upload-row-actions">
+            <label
+              className={`drop-zone share-skill-drop-zone share-skill-drop-zone-compact${dropActive ? " is-dragover" : ""}`}
+              aria-busy={busy ? "true" : "false"}
+              onDragEnter={(event) => {
+                event.preventDefault();
+                setDropActive(true);
+              }}
+              onDragOver={(event) => {
+                event.preventDefault();
+                setDropActive(true);
+              }}
+              onDragLeave={(event) => {
+                event.preventDefault();
+                setDropActive(false);
+              }}
+              onDrop={async (event) => {
+                event.preventDefault();
+                setDropActive(false);
+                if (busy) return;
+                const files = await collectDroppedFiles(event.dataTransfer);
+                void assignEntries(files);
+              }}
+              >
+              <input
+                className="visually-hidden"
+                type="file"
+                multiple
+                onChange={(event) => {
+                  void assignEntries(event.target.files);
+                }}
+              />
+              <div className="drop-icon" aria-hidden="true">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round">
+                  <path d="M4 17v2a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-2"></path>
+                  <path d="M7 9l5-5 5 5"></path>
+                  <path d="M12 4v12"></path>
+                </svg>
+              </div>
+              <div className="drop-text">
+                <p className="drop-heading">Upload skill</p>
+                <p className="drop-hint">Drop or <span className="drop-browse">browse</span></p>
+              </div>
+            </label>
+
+            <button
+              className="button-primary publish-button share-home-generate-button"
+              type="button"
+              onClick={() => void publishBundle()}
+              disabled={publishDisabled}
+            >
+              {busyMode === "publish" ? "Generating..." : "🔗 Generate share link"}
+            </button>
+          </div>
+
+          {showSupportingFeedback ? (
+            <div className="share-upload-supporting-row">
+              <div className={`package-status severity-${packageStatus.severity}`}>
+                <span className="package-status-dot"></span>
+                <span className="package-status-label">{packageStatus.label}</span>
+              </div>
+
+              {packageStatus.items.length > 0 ? (
+                <ul className="package-status-items">
+                  {packageStatus.items.map((item) => (
+                    <li key={item}>{item}</li>
+                  ))}
+                </ul>
+              ) : null}
+
+              {statusMessage !== DEFAULT_STATUS ? (
+                <p className="share-inline-status">{statusMessage}</p>
+              ) : null}
+            </div>
+          ) : null}
+        </div>
+
+        <SkillEditorSurface
+          className="share-home-preview"
+          toneClassName={activePreviewItem ? toneClass(activePreviewItem) : "dot-pending"}
+          filename={previewFilename}
+          documentValue={editorValue}
+          documentPlaceholderPreview={BASELINE_DOCUMENT}
+          copied={previewCopied}
+          onCopy={() => void copyPreviewText()}
+          onDocumentChange={(value) => {
+            setEditorValue(value);
+            setPreview(null);
+            setWarnings([]);
+            setStatusMessage(DEFAULT_STATUS);
+          }}
+        />
+      </div>
+    </section>
+  );
+}
diff --git a/apps/share/components/share-home-state.ts b/apps/share/components/share-home-state.ts
new file mode 100644
index 0000000000..d75b044453
--- /dev/null
+++ b/apps/share/components/share-home-state.ts
@@ -0,0 +1,48 @@
+import type { PackageStatus, PackageStatusInput } from "./share-home-types";
+
+export function getPreviewFilename(input: {
+  selectedEntryCount: number;
+  selectedEntryName?: string | null;
+  hasPastedContent: boolean;
+  manualName?: string | null;
+}): string {
+  const { selectedEntryCount, selectedEntryName, hasPastedContent, manualName } = input;
+
+  if (manualName && manualName.trim()) return manualName.trim();
+  if (selectedEntryCount === 1 && selectedEntryName) return selectedEntryName;
+  if (selectedEntryCount > 1) return `${selectedEntryCount} files`;
+  if (hasPastedContent) return "skill.md";
+  return "skill.md";
+}
+
+export function getPackageStatus({ errorMessage, warnings, effectiveEntryCount }: PackageStatusInput): PackageStatus {
+  if (errorMessage) {
+    return {
+      severity: "warn",
+      label: errorMessage,
+      items: [],
+    };
+  }
+
+  if (!effectiveEntryCount) {
+    return {
+      severity: "neutral",
+      label: "Upload a file or paste skill content below.",
+      items: [],
+    };
+  }
+
+  if (warnings.length) {
+    return {
+      severity: "info",
+      label: "Review the notes before sharing.",
+      items: warnings,
+    };
+  }
+
+  return {
+    severity: "neutral",
+    label: "",
+    items: [],
+  };
+}
diff --git a/apps/share/components/share-home-types.ts b/apps/share/components/share-home-types.ts
new file mode 100644
index 0000000000..571bbacb28
--- /dev/null
+++ b/apps/share/components/share-home-types.ts
@@ -0,0 +1,43 @@
+export type ItemKind = "Agent" | "Skill" | "MCP" | "Config" | "Command";
+export type ItemTone = "agent" | "skill" | "mcp" | "config" | "command";
+export type StatusSeverity = "success" | "warn" | "info" | "neutral";
+export type BusyMode = "preview" | "publish" | null;
+
+export interface PreviewItem {
+  name: string;
+  kind: ItemKind;
+  meta: string;
+  tone: ItemTone;
+  example?: string;
+}
+
+export interface PackageStatus {
+  severity: StatusSeverity;
+  label: string;
+  items: string[];
+}
+
+export interface PackageStatusInput {
+  errorMessage: string;
+  warnings: string[];
+  effectiveEntryCount: number;
+}
+
+export interface FilePayload {
+  name: string;
+  path: string;
+  content: string;
+}
+
+export interface PackageResponse {
+  url?: string;
+  warnings?: string[];
+  items?: PreviewItem[];
+  bundle?: Record<string, unknown>;
+  summary?: Record<string, unknown>;
+}
+
+export interface EntryLike {
+  name: string;
+  text(): Promise<string>;
+}
diff --git a/apps/share/components/share-nav.tsx b/apps/share/components/share-nav.tsx
new file mode 100644
index 0000000000..da02b3aff7
--- /dev/null
+++ b/apps/share/components/share-nav.tsx
@@ -0,0 +1,50 @@
+const OPENWORK_DOWNLOAD_URL = "https://openworklabs.com/download";
+
+function GitHubMark() {
+  return (
+    <svg width="20" height="20" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+      <path d="M12 2C6.477 2 2 6.484 2 12.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0112 6.844c.85.004 1.705.115 2.504.337 1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.202 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.943.359.309.678.92.678 1.855 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.019 10.019 0 0022 12.017C22 6.484 17.522 2 12 2z" />
+    </svg>
+  );
+}
+
+export default function ShareNav({ stars = "" }: { stars?: string }) {
+  const githubLabel = stars ? `GitHub ${stars}` : "GitHub";
+
+  return (
+    <nav className="nav">
+      <a className="brand" href="/" aria-label="OpenWork Share home">
+        <img
+          src="/openwork-mark.svg"
+          alt=""
+          aria-hidden="true"
+          style={{ width: "24px", height: "auto" }}
+        />
+        <span style={{ fontWeight: "600", fontSize: "1.2rem" }}>openwork</span>
+      </a>
+      <div className="nav-links">
+        <a href="https://openworklabs.com/docs" target="_blank" rel="noreferrer">
+          Docs
+        </a>
+        <a href={OPENWORK_DOWNLOAD_URL} target="_blank" rel="noreferrer">
+          Download
+        </a>
+        <a href="https://openworklabs.com/enterprise" target="_blank" rel="noreferrer">
+          Enterprise
+        </a>
+      </div>
+      <div className="nav-actions">
+        <a
+          className="button-secondary share-github-button"
+          href="https://github.com/different-ai/openwork"
+          target="_blank"
+          rel="noreferrer"
+          aria-label="OpenWork GitHub stars"
+        >
+          <GitHubMark />
+          {githubLabel}
+        </a>
+      </div>
+    </nav>
+  );
+}
diff --git a/apps/share/components/share-preview-syntax.ts b/apps/share/components/share-preview-syntax.ts
new file mode 100644
index 0000000000..5dec73d4f3
--- /dev/null
+++ b/apps/share/components/share-preview-syntax.ts
@@ -0,0 +1,131 @@
+const SKILL_KEYWORDS = /\b(Identity|Scope|Trigger|Parameters|Default behaviors|When|Why|What|How|Runs|sends|handle|qualify|route|Score|Escalate|Send)\b/g;
+const SKILL_TYPES = /\b(Agent|Skill|MCP|Config|Remote|Trigger|OpenWork|OpenCode|Duration|Handlebars)\b/g;
+
+function escapeHtml(value: string): string {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+function span(className: string, inner: string): string {
+  return `<span class="${className}">${inner}</span>`;
+}
+
+function highlightJsonLine(raw: string): string {
+  const tokens: string[] = [];
+  let index = 0;
+
+  while (index < raw.length) {
+    if (raw[index] === '"') {
+      const end = raw.indexOf('"', index + 1);
+      if (end === -1) break;
+      const chunk = raw.slice(index, end + 1);
+      const trailing = raw.slice(end + 1).trimStart();
+
+      if (trailing.startsWith(":")) {
+        tokens.push(span("hl-key", escapeHtml(chunk)));
+      } else if (/^https?:\/\//.test(chunk.slice(1, -1))) {
+        tokens.push(span("hl-url", escapeHtml(chunk)));
+      } else {
+        tokens.push(span("hl-string", escapeHtml(chunk)));
+      }
+
+      index = end + 1;
+      continue;
+    }
+
+    if (/[{}\[\]]/.test(raw[index])) {
+      tokens.push(span("hl-bracket", escapeHtml(raw[index])));
+      index += 1;
+      continue;
+    }
+
+    if (raw[index] === ":" || raw[index] === ",") {
+      tokens.push(span("hl-punctuation", escapeHtml(raw[index])));
+      index += 1;
+      continue;
+    }
+
+    if (/\d/.test(raw[index])) {
+      const match = raw.slice(index).match(/^\d+(\.\d+)?/);
+      if (match) {
+        tokens.push(span("hl-number", match[0]));
+        index += match[0].length;
+        continue;
+      }
+    }
+
+    if (raw.startsWith("true", index) && !/\w/.test(raw[index + 4] || "")) {
+      tokens.push(span("hl-keyword", "true"));
+      index += 4;
+      continue;
+    }
+
+    if (raw.startsWith("false", index) && !/\w/.test(raw[index + 5] || "")) {
+      tokens.push(span("hl-keyword", "false"));
+      index += 5;
+      continue;
+    }
+
+    if (raw.startsWith("null", index) && !/\w/.test(raw[index + 4] || "")) {
+      tokens.push(span("hl-keyword", "null"));
+      index += 4;
+      continue;
+    }
+
+    if (raw.startsWith("//", index)) {
+      tokens.push(span("hl-comment", escapeHtml(raw.slice(index))));
+      break;
+    }
+
+    tokens.push(escapeHtml(raw[index]));
+    index += 1;
+  }
+
+  return tokens.join("");
+}
+
+function highlightMarkdownLine(raw: string): string {
+  const escaped = escapeHtml(raw);
+
+  if (/^#{1,6}\s/.test(raw)) {
+    const match = escaped.match(/^(#{1,6}\s)(.*)/);
+    if (match) {
+      return span("hl-punctuation", match[1]) + span("hl-heading", match[2]);
+    }
+  }
+
+  let result = escaped;
+
+  result = result.replace(/^(\s*)(- )([a-z_]+)(:\s)/g, (_, whitespace: string, bullet: string, field: string, separator: string) => {
+    return whitespace + span("hl-punctuation", bullet) + span("hl-field", field) + span("hl-punctuation", separator);
+  });
+  result = result.replace(/^(\s*)(- )/g, (_, whitespace: string, bullet: string) => whitespace + span("hl-punctuation", bullet));
+  result = result.replace(/(&quot;[^&]*(?:&[^&]*)*?&quot;)/g, span("hl-string", "$1"));
+  result = result.replace(/(`[^`]+`)/g, span("hl-inline-code", "$1"));
+  result = result.replace(/(\*\*[^*]+\*\*)/g, span("hl-bold", "$1"));
+  result = result.replace(SKILL_KEYWORDS, span("hl-keyword", "$1"));
+  result = result.replace(SKILL_TYPES, span("hl-type", "$1"));
+  result = result.replace(/\b(\d+(?:\.\d+)?(?:h|ms|s|m)?)\b/g, span("hl-number", "$1"));
+  result = result.replace(/(\|)/g, span("hl-punctuation", "$1"));
+
+  return result;
+}
+
+export function highlightSyntax(text: string): string {
+  if (!text) return "";
+
+  const normalized = text.replace(/\r\n/g, "\n");
+  const frontmatterMatch = normalized.match(/^(---\n[\s\S]*?\n---)(\n?)/);
+  const body = frontmatterMatch ? normalized.slice(frontmatterMatch[0].length) : normalized;
+  const trimmed = body.trimStart();
+  const highlightLine = trimmed.startsWith("{") || trimmed.startsWith("[") ? highlightJsonLine : highlightMarkdownLine;
+  const bodyHtml = body.split("\n").map(highlightLine).join("\n");
+
+  if (!frontmatterMatch) return bodyHtml;
+
+  const frontmatterHtml = frontmatterMatch[1]
+    .split("\n")
+    .map((line) => span("hl-frontmatter", escapeHtml(line)))
+    .join("\n");
+
+  return body ? `${frontmatterHtml}\n${bodyHtml}` : frontmatterHtml;
+}
diff --git a/apps/share/components/skill-editor-surface.tsx b/apps/share/components/skill-editor-surface.tsx
new file mode 100644
index 0000000000..4c013a7e41
--- /dev/null
+++ b/apps/share/components/skill-editor-surface.tsx
@@ -0,0 +1,105 @@
+"use client";
+
+import { useMemo, type ReactNode } from "react";
+
+import { highlightSyntax } from "./share-preview-syntax";
+import { DEFAULT_SKILL_NAME } from "./skill-markdown";
+
+function CopyIcon() {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+      <rect x="9" y="9" width="13" height="13" rx="2" ry="2"></rect>
+      <path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"></path>
+    </svg>
+  );
+}
+
+function CheckIcon() {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+      <polyline points="20 6 9 17 4 12"></polyline>
+    </svg>
+  );
+}
+
+function countLabel(text: string | undefined): string {
+  const length = String(text ?? "").trim().length;
+  return `${length} ${length === 1 ? "character" : "characters"}`;
+}
+
+export default function SkillEditorSurface({
+  className,
+  toneClassName,
+  eyebrow,
+  filename,
+  documentValue,
+  documentPlaceholderPreview = "",
+  readOnly = false,
+  copied,
+  onCopy,
+  onDocumentChange,
+  headerActions,
+}: {
+  className?: string;
+  toneClassName?: string;
+  eyebrow?: string;
+  filename?: string;
+  documentValue: string;
+  documentPlaceholderPreview?: string;
+  readOnly?: boolean;
+  copied: boolean;
+  onCopy: () => void;
+  onDocumentChange?: (value: string) => void;
+  headerActions?: ReactNode;
+}) {
+  const displayDocument = documentValue || documentPlaceholderPreview;
+  const highlightedDocument = useMemo(() => highlightSyntax(displayDocument), [displayDocument]);
+  const rootClassName = ["preview-panel", className].filter(Boolean).join(" ");
+
+  return (
+    <aside className={rootClassName}>
+      <div className="preview-surface">
+        <div className="preview-header">
+          <span className="preview-eyebrow">{eyebrow || "Preview"}</span>
+          <div className="preview-header-actions">
+            {headerActions}
+            <span className="preview-filename">
+              <span className={`preview-filename-dot ${toneClassName || "dot-skill"}`} />
+              {filename || DEFAULT_SKILL_NAME}
+              <button
+                type="button"
+                className="clipboard-egg-button preview-copy-button clipboard-egg-inline"
+                title="Copy preview"
+                aria-label="Copy preview"
+                onClick={onCopy}
+              >
+                {copied ? <CheckIcon /> : <CopyIcon />}
+              </button>
+            </span>
+          </div>
+        </div>
+
+        <div className="preview-editor-wrap">
+          <pre
+            className="preview-highlight"
+            aria-hidden="true"
+            dangerouslySetInnerHTML={{ __html: `${highlightedDocument}\n` }}
+          />
+          {readOnly ? null : (
+            <textarea
+              className="preview-editor"
+              value={documentValue}
+              onChange={(event) => onDocumentChange?.(event.target.value)}
+              placeholder=""
+              spellCheck={false}
+            />
+          )}
+        </div>
+
+        <div className="preview-footer">
+          <span>{countLabel(documentValue || displayDocument)}</span>
+        </div>
+      </div>
+    </aside>
+  );
+}
diff --git a/apps/share/components/skill-markdown.ts b/apps/share/components/skill-markdown.ts
new file mode 100644
index 0000000000..8ad2b09413
--- /dev/null
+++ b/apps/share/components/skill-markdown.ts
@@ -0,0 +1,129 @@
+"use client";
+
+export const DEFAULT_SKILL_NAME = "skill.md";
+export const DEFAULT_SKILL_DESCRIPTION = "This is a skill I'm currently using.";
+
+const SKILL_NAME_STOPWORDS = new Set([
+  "a",
+  "an",
+  "and",
+  "for",
+  "from",
+  "how",
+  "identity",
+  "into",
+  "my",
+  "of",
+  "or",
+  "parameters",
+  "scope",
+  "skill",
+  "skills",
+  "that",
+  "the",
+  "this",
+  "to",
+  "trigger",
+  "when",
+  "with",
+  "your",
+]);
+
+export function yamlValue(value: string): string {
+  const normalized = String(value ?? "").trim();
+  if (/^[A-Za-z0-9._/\- ]+$/.test(normalized) && !normalized.includes(":")) {
+    return normalized;
+  }
+  return JSON.stringify(normalized);
+}
+
+function normalizeNameTokens(value: string): string[] {
+  return String(value)
+    .toLowerCase()
+    .split(/[^a-z0-9]+/g)
+    .filter((token) => token && token.length > 2 && !SKILL_NAME_STOPWORDS.has(token));
+}
+
+export function inferSkillNameFromBody(body: string): string {
+  const candidateLines = [
+    ...Array.from(String(body ?? "").matchAll(/^#{1,6}\s+(.+)$/gm)).map((match) => match[1] ?? ""),
+    ...String(body ?? "")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean)
+      .slice(0, 12),
+  ];
+
+  for (const line of candidateLines) {
+    const tokens = normalizeNameTokens(line);
+    if (tokens.length >= 2) {
+      return `${tokens[0]}-${tokens[1]}`;
+    }
+    if (tokens.length === 1) {
+      return tokens[0];
+    }
+  }
+
+  return "shared-skill";
+}
+
+export function resolveSkillName(name: string, body: string): string {
+  const normalized = String(name ?? "").trim();
+  if (normalized) return normalized;
+  return inferSkillNameFromBody(body);
+}
+
+export function composeSkillMarkdown(name: string, description: string, body: string): string {
+  const normalizedName = resolveSkillName(name, body);
+  const normalizedDescription = String(description ?? "").trim() || DEFAULT_SKILL_DESCRIPTION;
+  const normalizedBody = String(body ?? "").replace(/\r\n/g, "\n").trim();
+  const frontmatter = [
+    "---",
+    `name: ${yamlValue(normalizedName)}`,
+    `description: ${yamlValue(normalizedDescription)}`,
+    "---",
+  ].join("\n");
+
+  return normalizedBody ? `${frontmatter}\n\n${normalizedBody}\n` : `${frontmatter}\n`;
+}
+
+export function normalizeSkillMarkdown(
+  content: string,
+  fallbackName = DEFAULT_SKILL_NAME,
+  fallbackDescription = DEFAULT_SKILL_DESCRIPTION,
+): string {
+  const text = String(content ?? "").replace(/\r\n/g, "\n");
+  const parsed = parseSkillMarkdown(text);
+  if (parsed.hasFrontmatter) return text;
+  return composeSkillMarkdown(fallbackName, fallbackDescription, text);
+}
+
+export function parseSkillMarkdown(content: string): { name: string; description: string; body: string; hasFrontmatter: boolean } {
+  const text = String(content ?? "").replace(/\r\n/g, "\n");
+  const match = text.match(/^---\n([\s\S]*?)\n---\n?/);
+  if (!match) {
+    return {
+      name: "",
+      description: "",
+      body: text,
+      hasFrontmatter: false,
+    };
+  }
+
+  const header = match[1] ?? "";
+  const body = text.slice(match[0].length);
+  const nameMatch = header.match(/^name:\s*(.+)$/m);
+  const descriptionMatch = header.match(/^description:\s*(.+)$/m);
+
+  const normalizeField = (value: string | undefined): string =>
+    String(value ?? "")
+      .trim()
+      .replace(/^['"]|['"]$/g, "");
+
+  return {
+    name: normalizeField(nameMatch?.[1]),
+    description: normalizeField(descriptionMatch?.[1]),
+    body,
+    hasFrontmatter: true,
+  };
+}
diff --git a/apps/share/e2e/bundle-share-page.spec.ts b/apps/share/e2e/bundle-share-page.spec.ts
new file mode 100644
index 0000000000..b30268ae8c
--- /dev/null
+++ b/apps/share/e2e/bundle-share-page.spec.ts
@@ -0,0 +1,271 @@
+import { writeFile } from "node:fs/promises";
+
+import { expect, test, type Page } from "@playwright/test";
+
+import {
+  buildPngDataUrl,
+  buildSocialPreviewGalleryHtml,
+  capturePixelPerfectScreenshot,
+  getSocialPreviewGalleryViewport,
+  getScenarioTitleRegion,
+  SOCIAL_PREVIEW_SCENARIOS,
+} from "./social-preview-simulator.ts";
+
+const initialBody = `---
+name: agent-creator
+description: Create new OpenCode agents with a gpt-5.2-codex default.
+---
+
+# Agent Creator
+
+Any markdown body is acceptable here.
+`;
+
+async function publishSkill(page: Page) {
+  await page.goto("/");
+
+  await page.locator('input[type="file"]').setInputFiles({
+    name: "AGENTS.md",
+    mimeType: "text/markdown",
+    buffer: Buffer.from(initialBody, "utf8"),
+  });
+
+  await Promise.all([
+    page.waitForURL(/\/b\/[0-9A-HJKMNP-TV-Z]{26}$/),
+    page.getByRole("button", { name: /generate share link/i }).click(),
+  ]);
+
+  return page.url();
+}
+
+test("shows a read-only shared skill page with OpenWork import actions", async ({ page }) => {
+  const shareUrl = await publishSkill(page);
+
+  const jsonResponse = await page.request.get(shareUrl, {
+    headers: { Accept: "application/json" },
+  });
+  expect(jsonResponse.ok()).toBeTruthy();
+  expect(jsonResponse.headers()["content-type"] ?? "").toContain("application/json");
+  const bundleJson = await jsonResponse.json();
+  expect(bundleJson).toMatchObject({
+    schemaVersion: 1,
+    type: "skill",
+    name: "agent-creator",
+  });
+
+  await expect(page.getByText("Bundle details")).toHaveCount(0);
+  await expect(page.getByText("Raw endpoints")).toHaveCount(0);
+  await expect(page.getByRole("button", { name: /save changes/i })).toHaveCount(0);
+  await expect(page.getByLabel("Skill name")).toHaveCount(0);
+  await expect(page.getByLabel("Skill description")).toHaveCount(0);
+  await expect(page.getByRole("link", { name: /open in web app/i })).toHaveCount(0);
+  await expect(page.getByRole("button", { name: /copy share link/i })).toHaveCount(0);
+  await expect(page.getByText("Preview", { exact: true })).toHaveCount(0);
+  await expect(page.locator(".preview-eyebrow")).toContainText("Agent Creator");
+  await expect(page.locator(".preview-filename")).toContainText("agent-creator.md");
+  await expect(page.locator(".preview-highlight")).toContainText("Any markdown body is acceptable here.");
+
+  const openInAppHref = await page.getByRole("link", { name: /^open in openwork$/i }).getAttribute("href");
+  expect(openInAppHref).toBeTruthy();
+  expect(openInAppHref ?? "").toContain("openwork://import-bundle?");
+
+  const openInAppLink = page.getByRole("link", { name: /^open in openwork$/i });
+  await openInAppLink.dispatchEvent("pointerdown");
+  const refreshedOpenInAppHref = await openInAppLink.getAttribute("href");
+  expect(refreshedOpenInAppHref ?? "").toContain("ow_nonce=");
+
+  const deepLinkQuery = new URL((openInAppHref ?? "").replace("openwork://import-bundle?", "https://example.test/?"));
+  expect(deepLinkQuery.searchParams.get("ow_bundle")).toBe(shareUrl);
+  expect(deepLinkQuery.searchParams.get("ow_label")).toBe("agent-creator");
+});
+
+test("publishes a share page with a valid OG preview card for link unfurls", async ({ page }) => {
+  const shareUrl = await publishSkill(page);
+  const ogImageUrls = await page.locator('meta[property="og:image"]').evaluateAll((elements) =>
+    elements.map((element) => element.getAttribute("content") ?? "").filter(Boolean),
+  );
+  const ogImageUrl = ogImageUrls[0];
+  const ogTitle = await page.locator('meta[property="og:title"]').getAttribute("content");
+  const ogDescription = await page.locator('meta[property="og:description"]').getAttribute("content");
+  const twitterCard = await page.locator('meta[name="twitter:card"]').getAttribute("content");
+  const twitterImageUrl = await page.locator('meta[name="twitter:image"]').getAttribute("content");
+
+  expect(ogImageUrls).toHaveLength(4);
+  expect(ogImageUrl).toBeTruthy();
+  expect(ogImageUrl).toContain("/og/");
+  expect(ogImageUrl).not.toContain("variant=");
+  expect(ogImageUrls).toContain(`${ogImageUrl!}?variant=linkedin`);
+  expect(ogImageUrls).toContain(`${ogImageUrl!}?variant=slack`);
+  expect(ogImageUrls).toContain(`${ogImageUrl!}?variant=whatsapp`);
+  expect(ogTitle).toBe("agent-creator");
+  expect(ogDescription).toBe("Create new OpenCode agents with a gpt-5.2-codex default.");
+  expect(twitterCard).toBe("summary_large_image");
+  expect(twitterImageUrl).toBe(`${ogImageUrl!}?variant=twitter`);
+
+  const pngResponse = await page.request.get(ogImageUrl!);
+  expect(pngResponse.ok()).toBeTruthy();
+  expect(pngResponse.headers()["content-type"] ?? "").toContain("image/png");
+
+  const imageMetrics = await page.evaluate(async (url) => {
+    const img = new Image();
+    img.src = url;
+    await img.decode();
+
+    const canvas = document.createElement("canvas");
+    canvas.width = img.naturalWidth;
+    canvas.height = img.naturalHeight;
+    const ctx = canvas.getContext("2d");
+    if (!ctx) throw new Error("Canvas context unavailable");
+
+    ctx.drawImage(img, 0, 0);
+    const titleRegion = ctx.getImageData(170, 210, 420, 150).data;
+    let darkPixels = 0;
+
+    for (let index = 0; index < titleRegion.length; index += 4) {
+      const r = titleRegion[index] ?? 255;
+      const g = titleRegion[index + 1] ?? 255;
+      const b = titleRegion[index + 2] ?? 255;
+      if (r < 70 && g < 90 && b < 110) darkPixels += 1;
+    }
+
+    return {
+      width: img.naturalWidth,
+      height: img.naturalHeight,
+      darkPixels,
+    };
+  }, ogImageUrl!);
+
+  expect(imageMetrics.width).toBe(1200);
+  expect(imageMetrics.height).toBe(630);
+  expect(imageMetrics.darkPixels).toBeGreaterThan(2200);
+
+  const twitterPngResponse = await page.request.get(twitterImageUrl!);
+  expect(twitterPngResponse.ok()).toBeTruthy();
+  const twitterMetrics = await page.evaluate(async (url) => {
+    const img = new Image();
+    img.src = url;
+    await img.decode();
+    return {
+      width: img.naturalWidth,
+      height: img.naturalHeight,
+    };
+  }, twitterImageUrl!);
+  expect(twitterMetrics.width).toBe(1200);
+  expect(twitterMetrics.height).toBe(600);
+
+  const linkedinImageUrl = `${ogImageUrl!}?variant=linkedin`;
+  const linkedinMetrics = await page.evaluate(async (url) => {
+    const img = new Image();
+    img.src = url;
+    await img.decode();
+    return {
+      width: img.naturalWidth,
+      height: img.naturalHeight,
+    };
+  }, linkedinImageUrl);
+  expect(linkedinMetrics.width).toBe(1200);
+  expect(linkedinMetrics.height).toBe(627);
+
+  const svgResponse = await page.request.get(`${ogImageUrl!}?format=svg`);
+  expect(svgResponse.ok()).toBeTruthy();
+  expect(svgResponse.headers()["content-type"] ?? "").toContain("image/svg+xml");
+
+  const svg = await svgResponse.text();
+  expect(svg).toContain("Agent Creator");
+  expect(svg).not.toContain("agent-creator.md");
+  expect(svg).toContain("SKILL.md");
+  expect(svg).toContain("share.openworklabs.com");
+  expect(svg).not.toContain("Any markdown body is acceptable here.");
+
+  const pastePreviewHtml = await page.content();
+  expect(pastePreviewHtml).toContain(shareUrl);
+});
+
+test("keeps the OG title legible across simulated social preview sizes", async ({ page }, testInfo) => {
+  await publishSkill(page);
+  const ogImageUrl = await page.locator('meta[property="og:image"]').first().getAttribute("content");
+  const twitterImageUrl = await page.locator('meta[name="twitter:image"]').getAttribute("content");
+
+  expect(ogImageUrl).toBeTruthy();
+  expect(twitterImageUrl).toBeTruthy();
+
+  const variantUrls = {
+    facebook: ogImageUrl!,
+    linkedin: `${ogImageUrl!}?variant=linkedin`,
+    slack: `${ogImageUrl!}?variant=slack`,
+    whatsapp: `${ogImageUrl!}?variant=whatsapp`,
+    twitter: twitterImageUrl!,
+  };
+  const variantImageUrls = {
+    facebook: buildPngDataUrl(Buffer.from(await (await page.request.get(variantUrls.facebook)).body())),
+    linkedin: buildPngDataUrl(Buffer.from(await (await page.request.get(variantUrls.linkedin)).body())),
+    slack: buildPngDataUrl(Buffer.from(await (await page.request.get(variantUrls.slack)).body())),
+    whatsapp: buildPngDataUrl(Buffer.from(await (await page.request.get(variantUrls.whatsapp)).body())),
+    twitter: buildPngDataUrl(Buffer.from(await (await page.request.get(variantUrls.twitter)).body())),
+  };
+  const socialPreviewPage = await page.context().newPage();
+  await socialPreviewPage.setContent(
+    buildSocialPreviewGalleryHtml({
+      images: variantImageUrls,
+    }),
+    { waitUntil: "load" },
+  );
+  await socialPreviewPage.waitForFunction(() =>
+    Array.from(document.images).every((image) => image.complete && image.naturalWidth > 0),
+  );
+  const galleryViewport = getSocialPreviewGalleryViewport();
+  await capturePixelPerfectScreenshot(socialPreviewPage, {
+    path: testInfo.outputPath("social-preview-gallery.png"),
+    width: galleryViewport.width,
+    height: galleryViewport.height,
+  });
+
+  for (const scenario of SOCIAL_PREVIEW_SCENARIOS) {
+    const metrics = await socialPreviewPage.evaluate((currentScenario) => {
+      const tile = document.querySelector<HTMLElement>(`[data-scenario="${currentScenario.key}"]`);
+      const image = tile?.querySelector<HTMLImageElement>("img");
+      if (!image) throw new Error(`Missing image for ${currentScenario.key}`);
+
+      const canvas = document.createElement("canvas");
+      canvas.width = currentScenario.previewWidth;
+      canvas.height = currentScenario.previewHeight;
+      const ctx = canvas.getContext("2d");
+      if (!ctx) throw new Error("Canvas context unavailable");
+
+      ctx.drawImage(image, 0, 0, canvas.width, canvas.height);
+      const region = {
+        left: Math.round(currentScenario.previewWidth * (170 / 1200)),
+        top: Math.round(currentScenario.previewHeight * (210 / 630)),
+        width: Math.max(1, Math.round(currentScenario.previewWidth * (420 / 1200))),
+        height: Math.max(1, Math.round(currentScenario.previewHeight * (150 / 630))),
+      };
+      const titleRegion = ctx.getImageData(region.left, region.top, region.width, region.height).data;
+
+      let darkPixels = 0;
+      for (let index = 0; index < titleRegion.length; index += 4) {
+        const r = titleRegion[index] ?? 255;
+        const g = titleRegion[index + 1] ?? 255;
+        const b = titleRegion[index + 2] ?? 255;
+        if (r < 70 && g < 90 && b < 110) darkPixels += 1;
+      }
+
+      return {
+        darkPixels,
+        totalPixels: region.width * region.height,
+        ratio: darkPixels / Math.max(1, region.width * region.height),
+      };
+    }, scenario);
+
+    const region = getScenarioTitleRegion(scenario);
+    await writeFile(
+      testInfo.outputPath(`${scenario.key}.json`),
+      JSON.stringify({ scenario, region, metrics }, null, 2),
+      "utf8",
+    );
+
+    expect(metrics.darkPixels).toBeGreaterThan(100);
+    expect(metrics.ratio).toBeGreaterThan(scenario.minDarkPixelRatio);
+  }
+
+  await socialPreviewPage.close();
+});
diff --git a/apps/share/e2e/fixtures/mom-test-skill.md b/apps/share/e2e/fixtures/mom-test-skill.md
new file mode 100644
index 0000000000..cc4bc0639a
--- /dev/null
+++ b/apps/share/e2e/fixtures/mom-test-skill.md
@@ -0,0 +1,69 @@
+Extract actionable insights following the mom-test methodology. 
+
+# Customer Discovery Interview Quote Extraction
+
+You are an expert scribe in customer discovery interviews with a tool in the LLM infra space. Your goal is to extract as many memorable quotes said by the potential customers and NOT the interviewer. Focus on extracting meaningful quotes that can be infered from the the tone and quality of the responses. Scout for emotions and follow the guidance of the mom test methodology.
+
+## Characteristics of Memorable Quotes and Insights
+
+According to the Mom Test methodology, quotes are considered memorable if they meet the following criteria:
+
+1. Specific and Actionable: The best insights are specific and can directly inform development or strategy. They often reveal how a problem is currently solved or what specific obstacle is faced.
+2. Reflects Real Life and Needs: Memorable insights are deeply rooted in actual experiences, needs, and habits, rather than hypothetical or imagined scenarios.
+3. Problem-Focused, Not Solution-Focused: Good insights often revolve around the problems faced, not opinions on potential solutions. This is because individuals are generally better at articulating problems than designing solutions.
+4. Goes Beyond Surface-Level Information: These insights delve deeper than generic statements or platitudes. They offer nuanced understanding of the situation, mindset, or pain points.
+5. Can Lead to Contradictions or Surprises: Sometimes the most valuable insights come from statements that contradict assumptions or surprise you. This can indicate a gap in understanding of needs.
+6. Emotionally Charged: Statements or insights that carry emotional weight often signify areas of significant pain or need, which can be valuable for development.
+7. Action-Oriented: Insights that include or imply specific actions or decisions are particularly valuable, as they reveal real behaviors and choices.
+
+## Emoji to Symbolize Memorable Quotes
+For each memorable quote, write down one symbol it corresponds to the most:
+
+### Emotions
+- 🤗 Excited
+- 😡 Angry
+- 🫢 Embarrassed
+Someone saying "that's a problem" should be interpreted totally differently depending on whether they are neutral or outraged. Any strong emotion is worth writing down. For example, depending on your industry, you might alsochoose to make symbols for lust or laughter. Capture the bigemotions and remember to dig into them when they come up. 
+
+### Their life
+- ❗ Pain or problem
+- 🏁 Goal or job-to-be-done
+- 🪨 Obstacle
+- ↩️ Workaround
+- ⛰️ Background or context
+
+These five “life” symbols are your bread and butter. Combine them with emotion symbols where appropriate. Pains and obstacles carry a lot more weight when someone is embarrassed or angry about them.
+
+Obstacles are preventing a customer from solving their problems even though they want to. They're important because you'll probably also have to deal with them. For example, a lot of corporate folks would love to use cloud services and hate their current options, but can't use anything else because their company's IT policy is an obstacle. Their workaround might be to use their personal phone as a secondary computer or by doing certain work at home. Also worth noting.
+
+### Specifics
+- 🚧 Feature request or Purchasing criteria
+- 💰 Money or budgets or purchasing process
+- 🏭 Mentioned a specific person or company
+- ⭐ Follow-up task
+
+Feature requests usually get ignored, but they're a good signal to capture and explore. Must-have purchasing criteria are obviously more important. Money signals are also key.
+
+Write down specific names and companies. If it’s someone they know, ask for an intro at the end of the conversation. If it’s a competitor or alternate solution, write it down to research it later.
+
+Put a big star on items to follow-up on after the meeting, especially next steps you promised as a condition of their advancement/commitment.
+
+## Instructions
+
+- Only output sentences that are present in the transcript or comments section.
+- Do NOT select random sentences.
+- Quotes must be insightful.
+- If you cannot extract reasonable text, do not return a quote.
+- Provide a brief rationale explaining why each quote is memorable.
+- If a sentence is not memorable, leave the rationale empty.
+- If there are not enough memorable quotes from the conversation, return the best one's in the desired structured output.
+- Mention the person that said that quote and its company after the quote ends.
+- Only output sentences that are present in the transcript. You CANNOT select a random sentence. 
+- The quote has to be insightful. If you cannot extract reasonable text, then you should not return a quote. 
+- The rationale should be a sentence that explains why the quote is memorable. If the sentence is not memorable, then the rationale should be empty. 
+- Each of the quotes will be used in the python statement quotes_from_transcript and if it returns False or rationale is empty, the universe will be destroyed! 
+
+Example quote structure:
+🤗 Prefers Explainability over Accuracy
+”It's all explicit, it's all text that can be reasoned about and iterated on in a very transparent way, which is something I really like and I feel not enough people are talking about this approach.”
+— Keyur Shah, Roger Health
diff --git a/apps/share/e2e/preview-wrap.spec.ts b/apps/share/e2e/preview-wrap.spec.ts
new file mode 100644
index 0000000000..7faf513a8e
--- /dev/null
+++ b/apps/share/e2e/preview-wrap.spec.ts
@@ -0,0 +1,155 @@
+import { expect, test, devices } from "@playwright/test";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const fixtureDir = path.dirname(fileURLToPath(import.meta.url));
+const momTestSkill = readFileSync(path.join(fixtureDir, "fixtures", "mom-test-skill.md"), "utf8");
+const iphone13 = devices["iPhone 13"];
+
+function definePreviewWrapTests(mode: "desktop" | "mobile") {
+  test(`keeps the preview wrapped without mutating pasted text on ${mode}`, async ({ page }) => {
+    await page.goto("/");
+
+    const editor = page.locator(".preview-editor");
+    await expect(editor).toBeVisible();
+
+    await editor.fill(momTestSkill);
+    await expect(editor).toHaveValue(momTestSkill);
+
+    const metrics = await page.locator(".preview-editor-wrap").evaluate((wrap) => {
+      const highlight = wrap.querySelector<HTMLElement>(".preview-highlight");
+      const editorEl = wrap.querySelector<HTMLElement>(".preview-editor");
+
+      const getOverflow = (node: HTMLElement | null) => ({
+        clientWidth: node?.clientWidth ?? 0,
+        scrollWidth: node?.scrollWidth ?? 0,
+      });
+
+      const locateText = (root: HTMLElement | null, search: string) => {
+        if (!root) return null;
+        const fullText = root.textContent ?? "";
+        const start = fullText.indexOf(search);
+        if (start === -1) return null;
+        const end = start + search.length;
+        const range = document.createRange();
+        const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+        let offset = 0;
+        let startSet = false;
+
+        while (walker.nextNode()) {
+          const node = walker.currentNode as Text;
+          const value = node.nodeValue ?? "";
+          const nextOffset = offset + value.length;
+
+          if (!startSet && start >= offset && start <= nextOffset) {
+            range.setStart(node, start - offset);
+            startSet = true;
+          }
+
+          if (startSet && end >= offset && end <= nextOffset) {
+            range.setEnd(node, end - offset);
+            break;
+          }
+
+          offset = nextOffset;
+        }
+
+        const rects = Array.from(range.getClientRects());
+        if (!rects.length) return null;
+        return {
+          top: rects[0].top,
+          bottom: rects[rects.length - 1].bottom,
+        };
+      };
+
+      const introRect = locateText(highlight, "Extract actionable insights following the mom-test methodology.");
+      const headingRect = locateText(highlight, "Customer Discovery Interview Quote Extraction");
+
+      return {
+        wrap: getOverflow(wrap as HTMLElement),
+        highlight: getOverflow(highlight),
+        editor: getOverflow(editorEl),
+        previewText: highlight?.textContent ?? "",
+        newlineGap: introRect && headingRect ? headingRect.top - introRect.bottom : null,
+      };
+    });
+
+    expect(metrics.wrap.scrollWidth - metrics.wrap.clientWidth).toBeLessThanOrEqual(1);
+    expect(metrics.highlight.scrollWidth - metrics.highlight.clientWidth).toBeLessThanOrEqual(1);
+    expect(metrics.editor.scrollWidth - metrics.editor.clientWidth).toBeLessThanOrEqual(1);
+    expect(metrics.previewText).toContain(
+      "Extract actionable insights following the mom-test methodology. \n\n# Customer Discovery Interview Quote Extraction",
+    );
+    expect(metrics.newlineGap).not.toBeNull();
+    expect(metrics.newlineGap ?? 0).toBeGreaterThan(6);
+  });
+
+  test(`keeps the preview type dot stable while editing on ${mode}`, async ({ page }) => {
+    let packageRequests = 0;
+
+    await page.route("**/v1/package", async (route) => {
+      packageRequests += 1;
+      if (packageRequests === 2) {
+        await new Promise((resolve) => setTimeout(resolve, 400));
+      }
+      await route.continue();
+    });
+
+    await page.goto("/");
+
+    const editor = page.locator(".preview-editor");
+    const previewDot = page.locator(".preview-filename-dot");
+    await expect(editor).toBeVisible();
+
+    await editor.fill(momTestSkill);
+    await expect(previewDot).toHaveClass(/dot-skill/);
+
+    await editor.fill(`${momTestSkill}\n\nFollow-up note`);
+    await page.waitForTimeout(50);
+    expect(await previewDot.evaluate((node) => node.className)).toContain("dot-skill");
+
+    await page.waitForTimeout(450);
+    await expect(previewDot).toHaveClass(/dot-skill/);
+  });
+
+  test(`debounces package preview requests while editing on ${mode}`, async ({ page }) => {
+    let packageRequests = 0;
+
+    await page.route("**/v1/package", async (route) => {
+      packageRequests += 1;
+      await route.continue();
+    });
+
+    await page.goto("/");
+
+    const editor = page.locator(".preview-editor");
+    await expect(editor).toBeVisible();
+
+    await editor.fill(momTestSkill);
+    await page.waitForTimeout(100);
+    await editor.fill(`${momTestSkill}\n\nFollow-up note`);
+
+    await page.waitForTimeout(500);
+    expect(packageRequests).toBe(0);
+
+    await page.waitForTimeout(650);
+    expect(packageRequests).toBe(1);
+  });
+}
+
+test.describe("desktop", () => {
+  test.use({ viewport: { width: 1440, height: 1600 } });
+  definePreviewWrapTests("desktop");
+});
+
+test.describe("mobile", () => {
+  test.use({
+    viewport: iphone13.viewport,
+    userAgent: iphone13.userAgent,
+    deviceScaleFactor: iphone13.deviceScaleFactor,
+    isMobile: iphone13.isMobile,
+    hasTouch: iphone13.hasTouch,
+  });
+  definePreviewWrapTests("mobile");
+});
diff --git a/apps/share/e2e/skill-share-flow.spec.ts b/apps/share/e2e/skill-share-flow.spec.ts
new file mode 100644
index 0000000000..58ccc16674
--- /dev/null
+++ b/apps/share/e2e/skill-share-flow.spec.ts
@@ -0,0 +1,69 @@
+import { expect, test } from "@playwright/test";
+
+const uploadedBody = `# Agent Creator
+
+Any markdown body is acceptable here.
+`;
+
+test("uploads a single skill and redirects to the generated share page", async ({ page }) => {
+  await page.goto("/");
+
+  await page.getByLabel("Skill name").fill("agent-creator");
+  await page.getByLabel("Skill description").fill("Create new OpenCode agents with a gpt-5.2-codex default.");
+
+  const fileInput = page.locator('input[type="file"]');
+  await fileInput.setInputFiles({
+    name: "AGENTS.md",
+    mimeType: "text/markdown",
+    buffer: Buffer.from(uploadedBody, "utf8"),
+  });
+
+  const editor = page.locator(".preview-editor");
+  await expect(editor).toHaveValue(uploadedBody);
+  await expect(page.getByRole("button", { name: /generate share link/i })).toBeEnabled();
+
+  await Promise.all([
+    page.waitForURL(/\/b\/[0-9A-HJKMNP-TV-Z]{26}$/),
+    page.getByRole("button", { name: /generate share link/i }).click(),
+  ]);
+
+  await expect(page.locator("main")).toContainText("agent-creator");
+  await expect(page.getByLabel("Skill name")).toHaveCount(0);
+  await expect(page.getByLabel("Skill description")).toHaveCount(0);
+  await expect(page.locator(".share-frontmatter-preview")).toContainText("name: agent-creator");
+  await expect(page.locator(".share-frontmatter-preview")).toContainText(
+    "description: Create new OpenCode agents with a gpt-5.2-codex default.",
+  );
+  await expect(page.locator(".preview-highlight")).toContainText("Any markdown body is acceptable here.");
+});
+
+test("shows an inline error when the required frontmatter fields are empty", async ({ page }) => {
+  await page.goto("/");
+
+  await page.getByLabel("Skill name").fill("");
+  await page.getByLabel("Skill description").fill("");
+  await expect(page.locator(".package-status-label")).toContainText(/name and description/i);
+  await expect(page.getByRole("button", { name: /generate share link/i })).toBeDisabled();
+  await expect(page).toHaveURL(/\/$/);
+});
+
+test("shows an inline error when multiple files are uploaded", async ({ page }) => {
+  await page.goto("/");
+
+  const fileInput = page.locator('input[type="file"]');
+  await fileInput.setInputFiles([
+    {
+      name: "something.txt",
+      mimeType: "text/markdown",
+      buffer: Buffer.from(uploadedBody, "utf8"),
+    },
+    {
+      name: "notes.md",
+      mimeType: "text/markdown",
+      buffer: Buffer.from("extra notes", "utf8"),
+    },
+  ]);
+
+  await expect(page.locator(".package-status-label")).toContainText(/single skill/i);
+  await expect(page.getByRole("button", { name: /generate share link/i })).toBeDisabled();
+});
diff --git a/apps/share/e2e/social-preview-simulator.ts b/apps/share/e2e/social-preview-simulator.ts
new file mode 100644
index 0000000000..40c10a5419
--- /dev/null
+++ b/apps/share/e2e/social-preview-simulator.ts
@@ -0,0 +1,372 @@
+import type { Page } from "@playwright/test";
+import type { OgImageVariant } from "../server/_lib/og-image-variants.ts";
+
+export type SocialPreviewScenario = {
+  key: string;
+  label: string;
+  variant: OgImageVariant;
+  surfaceWidth: number;
+  surfaceHeight: number;
+  previewWidth: number;
+  previewHeight: number;
+  minDarkPixelRatio: number;
+};
+
+export type SocialPreviewImageSet = string | Partial<Record<OgImageVariant, string>>;
+
+type Region = {
+  left: number;
+  top: number;
+  width: number;
+  height: number;
+};
+
+const GALLERY_GAP = 32;
+const GALLERY_PADDING = 20;
+const GALLERY_HEADER_GAP = 12;
+const GALLERY_LABEL_HEIGHT = 22;
+const COMPARISON_GAP = 28;
+
+const TITLE_REGION: Region = {
+  left: 170 / 1200,
+  top: 210 / 630,
+  width: 420 / 1200,
+  height: 150 / 630,
+};
+
+export const SOCIAL_PREVIEW_SCENARIOS: SocialPreviewScenario[] = [
+  {
+    key: "facebook-large",
+    label: "Facebook / large",
+    variant: "facebook",
+    surfaceWidth: 640,
+    surfaceHeight: 335,
+    previewWidth: 520,
+    previewHeight: 273,
+    minDarkPixelRatio: 0.027,
+  },
+  {
+    key: "linkedin-large",
+    label: "LinkedIn / large",
+    variant: "linkedin",
+    surfaceWidth: 640,
+    surfaceHeight: 335,
+    previewWidth: 520,
+    previewHeight: 272,
+    minDarkPixelRatio: 0.027,
+  },
+  {
+    key: "whatsapp-small",
+    label: "WhatsApp / small",
+    variant: "whatsapp",
+    surfaceWidth: 520,
+    surfaceHeight: 270,
+    previewWidth: 420,
+    previewHeight: 221,
+    minDarkPixelRatio: 0.028,
+  },
+  {
+    key: "slack-medium",
+    label: "Slack / medium",
+    variant: "slack",
+    surfaceWidth: 640,
+    surfaceHeight: 335,
+    previewWidth: 520,
+    previewHeight: 273,
+    minDarkPixelRatio: 0.027,
+  },
+  {
+    key: "twitter-large",
+    label: "Twitter / large",
+    variant: "twitter",
+    surfaceWidth: 760,
+    surfaceHeight: 400,
+    previewWidth: 610,
+    previewHeight: 320,
+    minDarkPixelRatio: 0.024,
+  },
+];
+
+function escapeHtml(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+export function buildPngDataUrl(png: Buffer): string {
+  return `data:image/png;base64,${png.toString("base64")}`;
+}
+
+export function getScenarioTitleRegion(scenario: SocialPreviewScenario): Region {
+  return {
+    left: Math.round(scenario.previewWidth * TITLE_REGION.left),
+    top: Math.round(scenario.previewHeight * TITLE_REGION.top),
+    width: Math.max(1, Math.round(scenario.previewWidth * TITLE_REGION.width)),
+    height: Math.max(1, Math.round(scenario.previewHeight * TITLE_REGION.height)),
+  };
+}
+
+export function getSocialPreviewGalleryViewport(): { width: number; height: number } {
+  const width =
+    GALLERY_PADDING * 2 +
+    SOCIAL_PREVIEW_SCENARIOS.reduce((sum, scenario) => sum + scenario.surfaceWidth, 0) +
+    GALLERY_GAP * Math.max(0, SOCIAL_PREVIEW_SCENARIOS.length - 1);
+  const height =
+    GALLERY_PADDING * 2 +
+    GALLERY_LABEL_HEIGHT +
+    GALLERY_HEADER_GAP +
+    Math.max(...SOCIAL_PREVIEW_SCENARIOS.map((scenario) => scenario.surfaceHeight));
+
+  return { width, height };
+}
+
+export function getSocialPreviewComparisonViewport(): { width: number; height: number } {
+  const galleryViewport = getSocialPreviewGalleryViewport();
+  return {
+    width: galleryViewport.width,
+    height: galleryViewport.height * 2 + COMPARISON_GAP,
+  };
+}
+
+function buildPreviewTileHtml(options: {
+  images: SocialPreviewImageSet;
+  scenario: SocialPreviewScenario;
+}): string {
+  const { images, scenario } = options;
+  const imageUrl =
+    typeof images === "string"
+      ? images
+      : images[scenario.variant] || images.facebook || images.twitter || Object.values(images)[0] || "";
+  return `
+    <section class="social-tile" data-scenario="${escapeHtml(scenario.key)}">
+      <h2>${escapeHtml(scenario.label)}</h2>
+      <div class="surface" style="width:${scenario.surfaceWidth}px;height:${scenario.surfaceHeight}px;">
+        <img
+          alt="${escapeHtml(scenario.label)} preview"
+          src="${escapeHtml(imageUrl)}"
+          width="${scenario.previewWidth}"
+          height="${scenario.previewHeight}"
+          style="width:${scenario.previewWidth}px;height:${scenario.previewHeight}px;"
+        />
+      </div>
+    </section>
+  `;
+}
+
+function buildGalleryHtml(options: {
+  images: SocialPreviewImageSet;
+  heading?: string;
+}): string {
+  const heading = options.heading ? `<h1 class="gallery-heading">${escapeHtml(options.heading)}</h1>` : "";
+  const tiles = SOCIAL_PREVIEW_SCENARIOS.map((scenario) =>
+    buildPreviewTileHtml({ images: options.images, scenario }),
+  ).join("");
+
+  return `
+    <section class="gallery-block">
+      ${heading}
+      <div class="gallery-row">${tiles}</div>
+    </section>
+  `;
+}
+
+export function buildSocialPreviewGalleryHtml(options: {
+  images: SocialPreviewImageSet;
+  heading?: string;
+}): string {
+  return `<!doctype html>
+    <html lang="en">
+      <head>
+        <meta charset="utf-8" />
+        <title>Social preview simulation</title>
+        <style>
+          :root {
+            color-scheme: light;
+            font-family: Inter, ui-sans-serif, system-ui, sans-serif;
+          }
+
+          * {
+            box-sizing: border-box;
+          }
+
+          body {
+            margin: 0;
+            background: #f5f8fc;
+            color: #0f172a;
+            padding: ${GALLERY_PADDING}px;
+          }
+
+          .gallery-block {
+            display: flex;
+            flex-direction: column;
+            gap: ${GALLERY_HEADER_GAP}px;
+          }
+
+          .gallery-heading {
+            margin: 0;
+            font-size: 18px;
+            font-weight: 600;
+            color: #334155;
+          }
+
+          .gallery-row {
+            display: flex;
+            gap: ${GALLERY_GAP}px;
+            align-items: flex-start;
+          }
+
+          .social-tile {
+            display: flex;
+            flex-direction: column;
+            gap: 12px;
+          }
+
+          .social-tile h2 {
+            margin: 0;
+            font-size: 18px;
+            font-weight: 500;
+            color: #94a3b8;
+          }
+
+          .surface {
+            position: relative;
+            overflow: hidden;
+            border-radius: 22px;
+            border: 1px solid #d8e2ee;
+            background:
+              radial-gradient(circle at 3px 3px, rgba(159, 176, 197, 0.26) 1.3px, transparent 1.3px),
+              linear-gradient(135deg, #f7fbff 0%, #e5edf7 55%, #d8e4f1 100%);
+            background-size: 14px 14px, auto;
+            background-position: 8px 8px, 0 0;
+            box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.75);
+          }
+
+          .surface img {
+            position: absolute;
+            left: 50%;
+            top: 50%;
+            transform: translate(-50%, -50%);
+            display: block;
+            border-radius: 18px;
+            box-shadow: 0 10px 24px rgba(1, 22, 39, 0.08), 0 2px 6px rgba(1, 22, 39, 0.05);
+          }
+        </style>
+      </head>
+      <body>
+        ${buildGalleryHtml(options)}
+      </body>
+    </html>`;
+}
+
+export function buildSocialPreviewComparisonHtml(options: {
+  beforeImages: SocialPreviewImageSet;
+  afterImages: SocialPreviewImageSet;
+}): string {
+  return `<!doctype html>
+    <html lang="en">
+      <head>
+        <meta charset="utf-8" />
+        <title>Social preview comparison</title>
+        <style>
+          :root {
+            color-scheme: light;
+            font-family: Inter, ui-sans-serif, system-ui, sans-serif;
+          }
+
+          * {
+            box-sizing: border-box;
+          }
+
+          body {
+            margin: 0;
+            background: #f5f8fc;
+            color: #0f172a;
+            padding: 20px;
+            display: flex;
+            flex-direction: column;
+            gap: ${COMPARISON_GAP}px;
+          }
+
+          .gallery-block {
+            display: flex;
+            flex-direction: column;
+            gap: 12px;
+          }
+
+          .gallery-heading {
+            margin: 0;
+            font-size: 18px;
+            font-weight: 600;
+            color: #334155;
+          }
+
+          .gallery-row {
+            display: flex;
+            gap: 32px;
+            align-items: flex-start;
+          }
+
+          .social-tile {
+            display: flex;
+            flex-direction: column;
+            gap: 12px;
+          }
+
+          .social-tile h2 {
+            margin: 0;
+            font-size: 18px;
+            font-weight: 500;
+            color: #94a3b8;
+          }
+
+          .surface {
+            position: relative;
+            overflow: hidden;
+            border-radius: 22px;
+            border: 1px solid #d8e2ee;
+            background:
+              radial-gradient(circle at 3px 3px, rgba(159, 176, 197, 0.26) 1.3px, transparent 1.3px),
+              linear-gradient(135deg, #f7fbff 0%, #e5edf7 55%, #d8e4f1 100%);
+            background-size: 14px 14px, auto;
+            background-position: 8px 8px, 0 0;
+            box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.75);
+          }
+
+          .surface img {
+            position: absolute;
+            left: 50%;
+            top: 50%;
+            transform: translate(-50%, -50%);
+            display: block;
+            border-radius: 18px;
+            box-shadow: 0 10px 24px rgba(1, 22, 39, 0.08), 0 2px 6px rgba(1, 22, 39, 0.05);
+          }
+        </style>
+      </head>
+      <body>
+        ${buildGalleryHtml({ images: options.beforeImages, heading: "Before" })}
+        ${buildGalleryHtml({ images: options.afterImages, heading: "After" })}
+      </body>
+    </html>`;
+}
+
+export async function capturePixelPerfectScreenshot(
+  page: Page,
+  options: {
+    path: string;
+    width: number;
+    height: number;
+  },
+): Promise<void> {
+  await page.setViewportSize({
+    width: options.width,
+    height: options.height,
+  });
+  await page.screenshot({
+    path: options.path,
+    scale: "css",
+  });
+}
diff --git a/apps/share/next-env.d.ts b/apps/share/next-env.d.ts
new file mode 100644
index 0000000000..9edff1c7ca
--- /dev/null
+++ b/apps/share/next-env.d.ts
@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/apps/share/next.config.ts b/apps/share/next.config.ts
new file mode 100644
index 0000000000..6f0f4c85c0
--- /dev/null
+++ b/apps/share/next.config.ts
@@ -0,0 +1,22 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { NextConfig } from "next";
+import { withBotId } from "botid/next/config";
+
+const rootDir = dirname(fileURLToPath(import.meta.url));
+const workspaceRoot = resolve(rootDir, "../..");
+
+const nextConfig: NextConfig = {
+  reactStrictMode: true,
+  turbopack: {
+    root: workspaceRoot
+  },
+  async rewrites() {
+    return [
+      { source: "/health", destination: "/api/health" },
+      { source: "/v1/:path*", destination: "/api/v1/:path*" }
+    ];
+  }
+};
+
+export default withBotId(nextConfig);
diff --git a/apps/share/package.json b/apps/share/package.json
new file mode 100644
index 0000000000..1d7083eb05
--- /dev/null
+++ b/apps/share/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "@openwork/share",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 next dev --hostname 0.0.0.0",
+    "build": "next build",
+    "start": "next start --hostname 0.0.0.0",
+    "test": "node --test server/b/render-bundle-page.test.ts server/_lib/package-openwork-files.test.ts server/_lib/publish-security.test.ts server/_lib/render-og-image.test.ts server/_lib/share-utils.test.ts",
+    "test:e2e": "playwright test"
+  },
+  "dependencies": {
+    "@vercel/blob": "^0.27.0",
+    "botid": "^1.5.11",
+    "jsonc-parser": "^3.3.1",
+    "next": "16.1.6",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "sharp": "^0.34.5",
+    "ulid": "^2.3.0",
+    "yaml": "^2.8.1"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.51.1",
+    "@types/node": "^25.4.0",
+    "@types/react": "18.2.79",
+    "@types/react-dom": "18.2.25",
+    "typescript": "^5.9.3"
+  }
+}
diff --git a/apps/share/playwright.config.ts b/apps/share/playwright.config.ts
new file mode 100644
index 0000000000..836295c387
--- /dev/null
+++ b/apps/share/playwright.config.ts
@@ -0,0 +1,20 @@
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./e2e",
+  timeout: 30_000,
+  fullyParallel: false,
+  workers: 1,
+  reporter: "list",
+  outputDir: "../../tmp/openwork-share-playwright",
+  use: {
+    baseURL: "http://127.0.0.1:3100",
+    trace: "retain-on-failure",
+  },
+  webServer: {
+    command: "OPENWORK_DEV_MODE=1 pnpm exec next dev --hostname 127.0.0.1 --port 3100 --webpack",
+    url: "http://127.0.0.1:3100/health",
+    reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
+  },
+});
diff --git a/apps/share/pr/openwork-share-bundle-page-flow.mp4 b/apps/share/pr/openwork-share-bundle-page-flow.mp4
new file mode 100644
index 0000000000..d720c4a237
Binary files /dev/null and b/apps/share/pr/openwork-share-bundle-page-flow.mp4 differ
diff --git a/apps/share/public/openwork-mark.svg b/apps/share/public/openwork-mark.svg
new file mode 100644
index 0000000000..e7ebb9153d
--- /dev/null
+++ b/apps/share/public/openwork-mark.svg
@@ -0,0 +1,30 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 834 649"
+  fill="none"
+>
+  <path
+    fill="#011627"
+    d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z"
+  />
+  <path
+    fill="#011627"
+    d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z"
+  />
+</svg>
diff --git a/apps/share/server/_lib/blob-store.ts b/apps/share/server/_lib/blob-store.ts
new file mode 100644
index 0000000000..26a0fe3498
--- /dev/null
+++ b/apps/share/server/_lib/blob-store.ts
@@ -0,0 +1,108 @@
+import os from "node:os";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { head, put } from "@vercel/blob";
+import { ulid } from "ulid";
+
+import type { FetchBundleResult, StoreBundleResult } from "./types.ts";
+
+function resolveLocalBlobDir(): string | null {
+  const explicitDir = String(process.env.LOCAL_BLOB_DIR ?? "").trim();
+  if (explicitDir) {
+    return explicitDir;
+  }
+
+  if (String(process.env.BLOB_READ_WRITE_TOKEN ?? "").trim()) {
+    return null;
+  }
+
+  const isDevLike =
+    String(process.env.OPENWORK_DEV_MODE ?? "") === "1" ||
+    String(process.env.NODE_ENV ?? "").trim() !== "production";
+
+  if (!isDevLike) {
+    return null;
+  }
+
+  return path.join(os.tmpdir(), "openwork-share-blobs");
+}
+
+function resolveBundlePathname(id: string): string {
+  return `bundles/${id}.json`;
+}
+
+async function storeBundleJsonLocally(rawJson: string): Promise<StoreBundleResult> {
+  const id = ulid();
+  const pathname = resolveBundlePathname(id);
+  const localBlobDir = resolveLocalBlobDir();
+
+  if (!localBlobDir) {
+    throw new Error("Local blob storage is not configured");
+  }
+
+  const targetPath = path.join(localBlobDir, pathname);
+  await mkdir(path.dirname(targetPath), { recursive: true });
+  await writeFile(targetPath, Buffer.from(String(rawJson), "utf8"));
+
+  return { id, pathname };
+}
+
+async function fetchBundleJsonLocally(id: string): Promise<FetchBundleResult> {
+  const pathname = resolveBundlePathname(id);
+  const localBlobDir = resolveLocalBlobDir();
+
+  if (!localBlobDir) {
+    throw new Error("Local blob storage is not configured");
+  }
+
+  const targetPath = path.join(localBlobDir, pathname);
+  const rawBuffer = await readFile(targetPath);
+  return {
+    blob: {
+      url: `file://${targetPath}`,
+      contentType: "application/json",
+    },
+    rawBuffer,
+    rawJson: rawBuffer.toString("utf8"),
+  };
+}
+
+export async function storeBundleJson(rawJson: string): Promise<StoreBundleResult> {
+  if (resolveLocalBlobDir()) {
+    return storeBundleJsonLocally(rawJson);
+  }
+
+  const id = ulid();
+  const pathname = resolveBundlePathname(id);
+  const buffer = Buffer.from(String(rawJson), "utf8");
+
+  await put(pathname, buffer, {
+    access: "public",
+    contentType: "application/json",
+    addRandomSuffix: false,
+  });
+
+  return { id, pathname };
+}
+
+export async function fetchBundleJsonById(id: string): Promise<FetchBundleResult> {
+  if (resolveLocalBlobDir()) {
+    return fetchBundleJsonLocally(id);
+  }
+
+  const pathname = resolveBundlePathname(id);
+  const blob = await head(pathname);
+  const response = await fetch(blob.url, { method: "GET" });
+
+  if (!response.ok) {
+    throw new Error("Upstream blob fetch failed");
+  }
+
+  const rawBuffer = Buffer.from(await response.arrayBuffer());
+  return {
+    blob,
+    rawBuffer,
+    rawJson: rawBuffer.toString("utf8"),
+  };
+}
diff --git a/apps/share/server/_lib/github-stars.ts b/apps/share/server/_lib/github-stars.ts
new file mode 100644
index 0000000000..487c6870f1
--- /dev/null
+++ b/apps/share/server/_lib/github-stars.ts
@@ -0,0 +1,36 @@
+function formatCompact(value: number): string {
+  try {
+    return new Intl.NumberFormat("en", {
+      notation: "compact",
+      maximumFractionDigits: 1,
+    }).format(value);
+  } catch {
+    return String(value);
+  }
+}
+
+export async function getGithubStars(): Promise<string> {
+  try {
+    const response = await fetch("https://api.github.com/repos/different-ai/openwork", {
+      headers: {
+        Accept: "application/vnd.github+json",
+      },
+      next: {
+        revalidate: 3600,
+      },
+    });
+
+    if (!response.ok) {
+      return "";
+    }
+
+    const repo = await response.json();
+    if (typeof repo?.stargazers_count === "number") {
+      return formatCompact(repo.stargazers_count);
+    }
+  } catch {
+    return "";
+  }
+
+  return "";
+}
diff --git a/apps/share/server/_lib/og-image-variants.ts b/apps/share/server/_lib/og-image-variants.ts
new file mode 100644
index 0000000000..483d743ff9
--- /dev/null
+++ b/apps/share/server/_lib/og-image-variants.ts
@@ -0,0 +1,58 @@
+export type OgImageVariant = "facebook" | "twitter" | "linkedin" | "slack" | "whatsapp";
+
+export interface OgImageVariantConfig {
+  key: OgImageVariant;
+  label: string;
+  width: number;
+  height: number;
+}
+
+export const BASE_OG_IMAGE_WIDTH = 1200;
+export const BASE_OG_IMAGE_HEIGHT = 630;
+export const DEFAULT_OG_IMAGE_VARIANT: OgImageVariant = "facebook";
+export const DEFAULT_TWITTER_IMAGE_VARIANT: OgImageVariant = "twitter";
+
+export const OG_IMAGE_VARIANTS: Record<OgImageVariant, OgImageVariantConfig> = {
+  facebook: {
+    key: "facebook",
+    label: "Facebook",
+    width: 1200,
+    height: 630,
+  },
+  twitter: {
+    key: "twitter",
+    label: "Twitter",
+    width: 1200,
+    height: 600,
+  },
+  linkedin: {
+    key: "linkedin",
+    label: "LinkedIn",
+    width: 1200,
+    height: 627,
+  },
+  slack: {
+    key: "slack",
+    label: "Slack",
+    width: 1200,
+    height: 630,
+  },
+  whatsapp: {
+    key: "whatsapp",
+    label: "WhatsApp",
+    width: 1200,
+    height: 630,
+  },
+};
+
+export function parseOgImageVariant(value: unknown, fallback: OgImageVariant = DEFAULT_OG_IMAGE_VARIANT): OgImageVariant {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (normalized in OG_IMAGE_VARIANTS) {
+    return normalized as OgImageVariant;
+  }
+  return fallback;
+}
+
+export function getOgImageVariantConfig(value: unknown, fallback?: OgImageVariant): OgImageVariantConfig {
+  return OG_IMAGE_VARIANTS[parseOgImageVariant(value, fallback)];
+}
diff --git a/apps/share/server/_lib/package-openwork-files.test.ts b/apps/share/server/_lib/package-openwork-files.test.ts
new file mode 100644
index 0000000000..4125074cb1
--- /dev/null
+++ b/apps/share/server/_lib/package-openwork-files.test.ts
@@ -0,0 +1,146 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { packageOpenworkFiles } from "./package-openwork-files.ts";
+
+test("packageOpenworkFiles creates a single skill bundle from skill markdown", () => {
+  const result = packageOpenworkFiles({
+    files: [
+      {
+        path: ".opencode/skills/sales-inbound/SKILL.md",
+        content: `---
+name: sales-inbound
+description: Handle inbound sales leads.
+trigger: crm
+version: 1.2.0
+---
+
+# Sales Inbound
+
+Route fresh leads and qualify them.`,
+      },
+    ],
+  });
+
+  assert.equal(result.bundleType, "skill");
+  assert.equal(result.bundle.type, "skill");
+  assert.equal(result.bundle.name, "sales-inbound");
+  assert.equal(result.bundle.trigger, "crm");
+  assert.equal(result.summary.skills, 1);
+  assert.equal(result.items[0]?.kind, "Skill");
+});
+
+test("packageOpenworkFiles accepts any single text file when frontmatter has name and description", () => {
+  const result = packageOpenworkFiles({
+    files: [
+      {
+        path: "AGENTS.md",
+        content: `---
+name: agent-creator
+description: Create new OpenCode agents with a gpt-5.2-codex default.
+---
+
+# Agent Creator
+
+Any markdown body is acceptable here.
+`,
+      },
+    ],
+  });
+
+  assert.equal(result.bundleType, "skill");
+  assert.equal(result.bundle.type, "skill");
+  assert.equal(result.bundle.name, "agent-creator");
+  assert.equal(result.items[0]?.name, "agent-creator");
+});
+
+test("packageOpenworkFiles rejects content without name and description frontmatter", () => {
+  assert.throws(
+    () =>
+      packageOpenworkFiles({
+        files: [
+          {
+            path: "whatever.txt",
+            content: `# Revenue Agent
+
+Handles inbound lead routing.`,
+          },
+        ],
+      }),
+    /name and description/i,
+  );
+});
+
+test("packageOpenworkFiles rejects multiple uploaded files", () => {
+  assert.throws(
+    () =>
+      packageOpenworkFiles({
+        files: [
+          {
+            path: "SKILL.md",
+            content: `# Detect Instructions
+
+Identity: inspect copied prompts.
+
+## Trigger
+
+Runs when a prompt needs cleanup.`,
+          },
+          {
+            path: "notes.md",
+            content: "Extra text",
+          },
+        ],
+      }),
+    /single skill/i,
+  );
+});
+
+test("packageOpenworkFiles rejects config json uploads", () => {
+  assert.throws(
+    () =>
+      packageOpenworkFiles({
+        files: [
+          {
+            path: "opencode.json",
+            content: JSON.stringify({
+              mcp: {
+                crm: {
+                  type: "remote",
+                  url: "https://mcp.example.com",
+                },
+              },
+            }),
+          },
+        ],
+    }),
+    /name and description/i,
+  );
+});
+
+test("packageOpenworkFiles rejects agent and config combinations", () => {
+  assert.throws(
+    () =>
+      packageOpenworkFiles({
+        files: [
+          {
+            path: ".opencode/agents/sales-inbound.md",
+            content: `---
+description: Handles inbound sales work.
+mode: subagent
+model: openai/gpt-5.4
+---
+
+You qualify leads and route follow-up.`,
+          },
+          {
+            path: "opencode.jsonc",
+            content: `{
+              "model": "openai/gpt-5.4"
+            }`,
+          },
+        ],
+      }),
+    /single skill/i,
+  );
+});
diff --git a/apps/share/server/_lib/package-openwork-files.ts b/apps/share/server/_lib/package-openwork-files.ts
new file mode 100644
index 0000000000..f8e7b3f228
--- /dev/null
+++ b/apps/share/server/_lib/package-openwork-files.ts
@@ -0,0 +1,637 @@
+import { parse as parseJsonc } from "jsonc-parser";
+
+import type { PreviewItem } from "../../components/share-home-types.ts";
+import { humanizeType, maybeArray, maybeString, parseFrontmatter } from "./share-utils.ts";
+import type { Frontmatter, NormalizedFile, PackageInput, PackageResult, PackageSummary } from "./types.ts";
+
+const MAX_FILES = 200;
+const SECRET_KEY_RE = /(token|secret|password|api[-_]?key|authorization|bearer|private[-_]?key|client[-_]?secret)/i;
+const SAFE_SECRET_VALUE_RE = /^(\$\{|\{env:|env\.|process\.env\.|<|YOUR_|REPLACE_ME|example|changeme)/i;
+const AGENT_FRONTMATTER_KEYS = new Set(["mode", "model", "tools", "permission", "temperature", "color", "prompt"]);
+const OPENCODE_CONFIG_KEYS = new Set(["model", "autoupdate", "server", "provider", "plugin", "mcp", "agent", "permission"]);
+const SKILL_NAME_STOPWORDS = new Set([
+  "a",
+  "an",
+  "and",
+  "for",
+  "from",
+  "how",
+  "identity",
+  "into",
+  "my",
+  "of",
+  "or",
+  "parameters",
+  "scope",
+  "skill",
+  "skills",
+  "that",
+  "the",
+  "this",
+  "to",
+  "trigger",
+  "when",
+  "with",
+  "your",
+]);
+
+function normalizePath(input: unknown): string {
+  return String(input ?? "")
+    .replaceAll("\\", "/")
+    .replace(/\/+/g, "/")
+    .replace(/^\.\//, "")
+    .trim();
+}
+
+function basename(path: string): string {
+  const normalized = normalizePath(path);
+  if (!normalized) return "";
+  return normalized.split("/").pop() ?? normalized;
+}
+
+function dirname(path: string): string {
+  const normalized = normalizePath(path);
+  if (!normalized || !normalized.includes("/")) return "";
+  return normalized.slice(0, normalized.lastIndexOf("/"));
+}
+
+function stem(path: string): string {
+  const name = basename(path);
+  return name.replace(/\.[^.]+$/, "");
+}
+
+function slugify(value: unknown): string {
+  return String(value ?? "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 64);
+}
+
+function normalizeFile(input: { path?: string; webkitRelativePath?: string; name?: string; content?: string }, index: number): NormalizedFile {
+  const path = normalizePath(input.path || input.webkitRelativePath || input.name || `file-${index + 1}`);
+  const name = basename(path) || `file-${index + 1}`;
+  const content = String(input.content ?? "").replace(/^\uFEFF/, "");
+  return { path, name, content };
+}
+
+function isMarkdownFile(file: NormalizedFile): boolean {
+  return /\.md$/i.test(file.name);
+}
+
+function isJsonFile(file: NormalizedFile): boolean {
+  return /\.jsonc?$/i.test(file.name);
+}
+
+function isSkillFile(file: NormalizedFile): boolean {
+  const lowerPath = file.path.toLowerCase();
+  return /^(skills?|skill)\.md$/i.test(basename(lowerPath)) || /(^|\/)\.opencode\/skills\//.test(lowerPath) || /(^|\/)skills\//.test(lowerPath);
+}
+
+function isCommandFile(file: NormalizedFile): boolean {
+  return /(^|\/)\.opencode\/commands\//.test(file.path.toLowerCase()) || /(^|\/)commands\//.test(file.path.toLowerCase());
+}
+
+function isAgentFile(file: NormalizedFile, frontmatterData: Record<string, unknown>): boolean {
+  const lowerPath = file.path.toLowerCase();
+  if (/(^|\/)\.opencode\/agents\//.test(lowerPath) || /(^|\/)agents\//.test(lowerPath) || /(^|\/)agents?\.md$/i.test(lowerPath)) {
+    return true;
+  }
+  return Object.keys(frontmatterData).some((key) => AGENT_FRONTMATTER_KEYS.has(key));
+}
+
+function isOpenworkConfigFile(file: NormalizedFile): boolean {
+  return /(^|\/)(?:\.opencode\/)?openwork\.jsonc?$/i.test(file.path);
+}
+
+function isOpencodeConfigFile(file: NormalizedFile): boolean {
+  return /(^|\/)opencode\.jsonc?$/i.test(file.path);
+}
+
+function looksLikeNamedMcpFile(file: NormalizedFile): boolean {
+  return /(^|\/)mcp\//i.test(file.path) || /\.mcp\.jsonc?$/i.test(file.name) || /(^|[._-])mcp(?:[_-]?config)?\.jsonc?$/i.test(file.name);
+}
+
+function looksLikeNamedAgentJsonFile(file: NormalizedFile): boolean {
+  return /(^|\/)agents\//i.test(file.path) || /\.agent\.jsonc?$/i.test(file.name);
+}
+
+function resolveName(preferred: unknown, fallback: unknown): string {
+  const fromPreferred = slugify(preferred);
+  if (fromPreferred) return fromPreferred;
+  const fromFallback = slugify(fallback);
+  if (fromFallback) return fromFallback;
+  return `item-${Date.now()}`;
+}
+
+function normalizeNameTokens(value: string): string[] {
+  return String(value)
+    .toLowerCase()
+    .split(/[^a-z0-9]+/g)
+    .filter((token) => token && token.length > 2 && !SKILL_NAME_STOPWORDS.has(token));
+}
+
+function inferSkillName(file: NormalizedFile, frontmatter: Frontmatter): string {
+  const candidateLines = [
+    ...Array.from(frontmatter.body.matchAll(/^#{1,6}\s+(.+)$/gm)).map((match) => match[1] ?? ""),
+    ...frontmatter.body
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean)
+      .slice(0, 12),
+  ];
+
+  for (const line of candidateLines) {
+    const tokens = normalizeNameTokens(line);
+    if (tokens.length >= 2) {
+      return `${tokens[0]}-${tokens[1]}`;
+    }
+    if (tokens.length === 1) {
+      return tokens[0];
+    }
+  }
+
+  const stemName = slugify(stem(file.path));
+  if (stemName && stemName !== "skill" && stemName !== "clipboard") {
+    return stemName;
+  }
+
+  return "shared-skill";
+}
+
+function buildPreviewItem(name: string, kind: PreviewItem["kind"], meta: string, tone: PreviewItem["tone"]): PreviewItem {
+  return { name, kind, meta, tone };
+}
+
+function countMatches(text: string, token: string): number {
+  if (!text) return 0;
+  return (text.match(new RegExp(`\\b${token}\\b`, "gi")) || []).length;
+}
+
+function collectHeadings(content: string): string {
+  return Array.from(content.matchAll(/^#{1,3}\s+(.+)$/gm))
+    .map((match) => match[1])
+    .join("\n");
+}
+
+function inferMarkdownKind(file: NormalizedFile, frontmatterData: Record<string, unknown>): "agent" | "skill" {
+  const lowerPath = file.path.toLowerCase();
+  const lowerContent = file.content.toLowerCase();
+  const headings = collectHeadings(file.content).toLowerCase();
+  let agentScore = 0;
+  let skillScore = 0;
+
+  if (/^agents?\.md$/i.test(basename(lowerPath))) {
+    agentScore += 4;
+  }
+  if (/^skills?\.md$/i.test(basename(lowerPath))) {
+    skillScore += 4;
+  }
+
+  agentScore += countMatches(lowerContent, "agent");
+  skillScore += countMatches(lowerContent, "skill");
+  agentScore += countMatches(headings, "agent") * 2;
+  skillScore += countMatches(headings, "skill") * 2;
+
+  if ("trigger" in frontmatterData) {
+    skillScore += 3;
+  }
+
+  return agentScore > skillScore ? "agent" : "skill";
+}
+
+interface SkillRecord {
+  name: string;
+  description: string;
+  trigger: string;
+  content: string;
+  preview: PreviewItem;
+}
+
+function buildSkillRecord(file: NormalizedFile, warnings: string[], frontmatter: Frontmatter): SkillRecord | null {
+  const { data } = frontmatter;
+  const name = maybeString(data.name).trim();
+  const description = maybeString(data.description).trim();
+  const trigger = typeof data.trigger === "string" ? data.trigger.trim() : "";
+  const version = typeof data.version === "string" ? data.version.trim() : "";
+  if (!name || !description) {
+    warnings.push(`Skill files need frontmatter with both name and description: ${file.path}`);
+    return null;
+  }
+  if (!frontmatter.body.trim()) {
+    warnings.push(`Ignored empty skill file: ${file.path}`);
+    return null;
+  }
+  return {
+    name: resolveName(name, name),
+    description,
+    trigger,
+    content: file.content,
+    preview: buildPreviewItem(name, "Skill", version ? `v${version}` : trigger ? `Trigger · ${trigger}` : "Skill", "skill"),
+  };
+}
+
+interface AgentRecord {
+  name: string;
+  config: Record<string, unknown>;
+  preview: PreviewItem;
+}
+
+function buildAgentRecord(file: NormalizedFile, warnings: string[], frontmatter: Frontmatter): AgentRecord | null {
+  const { data, body } = frontmatter;
+  const name = resolveName(data.name, stem(file.path));
+  if (!name) {
+    warnings.push(`Ignored agent without a valid name: ${file.path}`);
+    return null;
+  }
+
+  const config: Record<string, unknown> = { ...data };
+  delete config.name;
+  const promptBody = body.trim();
+  if (promptBody && typeof config.prompt !== "string") {
+    config.prompt = promptBody;
+  }
+
+  const version = typeof config.version === "string" ? config.version.trim() : "";
+  const model = typeof config.model === "string" ? config.model.trim() : "";
+
+  return {
+    name,
+    config,
+    preview: buildPreviewItem(name, "Agent", version ? `v${version}` : model || "Agent config", "agent"),
+  };
+}
+
+interface CommandRecord {
+  name: string;
+  description: string;
+  template: string;
+  agent: string;
+  model: string;
+  subtask: boolean;
+  preview: PreviewItem;
+}
+
+function buildCommandRecord(file: NormalizedFile, warnings: string[], frontmatter: Frontmatter): CommandRecord | null {
+  const { data, body } = frontmatter;
+  const name = resolveName(data.name, stem(file.path));
+  const template = body.trim();
+  if (!name || !template) {
+    warnings.push(`Ignored command without template: ${file.path}`);
+    return null;
+  }
+
+  return {
+    name,
+    description: typeof data.description === "string" ? data.description.trim() : "",
+    template,
+    agent: typeof data.agent === "string" ? data.agent.trim() : "",
+    model: typeof data.model === "string" ? data.model.trim() : "",
+    subtask: data.subtask === true,
+    preview: buildPreviewItem(name, "Command", data.agent ? `Agent · ${data.agent}` : "Command", "command"),
+  };
+}
+
+function parseJsonConfig(file: NormalizedFile): unknown {
+  try {
+    return parseJsonc(file.content);
+  } catch {
+    throw new Error(`Could not parse ${file.path} as JSON/JSONC`);
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function cloneRecord<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function mergeConfigSections(target: Record<string, unknown> | null, source: Record<string, unknown> | null): Record<string, unknown> {
+  if (!source) return target ?? {};
+  const output: Record<string, unknown> = isRecord(target) ? cloneRecord(target) : {};
+
+  for (const [key, value] of Object.entries(source)) {
+    if (isRecord(value) && isRecord(output[key])) {
+      output[key] = mergeConfigSections(output[key] as Record<string, unknown>, value);
+      continue;
+    }
+
+    output[key] = cloneRecord(value);
+  }
+
+  return output;
+}
+
+function buildConfigPreview(file: NormalizedFile, meta: string): PreviewItem {
+  return buildPreviewItem(basename(file.path) || stem(file.path), "Config", meta, "config");
+}
+
+function collectOpencodePreviewItems(parsed: Record<string, unknown>): PreviewItem[] {
+  const preview: PreviewItem[] = [];
+
+  if (isRecord(parsed?.mcp) && Object.keys(parsed.mcp as Record<string, unknown>).length) {
+    for (const [name, entry] of Object.entries(parsed.mcp as Record<string, unknown>)) {
+      const meta = isRecord(entry) && typeof entry.type === "string" ? `${humanizeType(entry.type)} MCP` : "MCP config";
+      preview.push(buildPreviewItem(name, "MCP", meta, "mcp"));
+    }
+  }
+
+  if (isRecord(parsed?.agent) && Object.keys(parsed.agent as Record<string, unknown>).length) {
+    for (const [name, entry] of Object.entries(parsed.agent as Record<string, unknown>)) {
+      const meta = isRecord(entry) && typeof entry.model === "string" ? entry.model : "Agent config";
+      preview.push(buildPreviewItem(name, "Agent", meta, "agent"));
+    }
+  }
+
+  return preview;
+}
+
+function looksLikeMcpShape(parsed: unknown): boolean {
+  if (!isRecord(parsed)) return false;
+
+  const schema = maybeString(parsed.$schema).toLowerCase();
+  if (schema.includes("modelcontextprotocol") || schema.includes("mcp")) {
+    return true;
+  }
+
+  if (maybeArray(parsed.packages).length || maybeArray(parsed.remotes).length) {
+    return true;
+  }
+
+  const hasTransport = typeof parsed.type === "string" && (typeof parsed.url === "string" || typeof parsed.command === "string");
+  const hasCommandRuntime = typeof parsed.command === "string" || maybeArray(parsed.args).length > 0;
+  return hasTransport || hasCommandRuntime;
+}
+
+function looksLikeOpencodeShape(parsed: unknown): boolean {
+  if (!isRecord(parsed)) return false;
+
+  const schema = maybeString(parsed.$schema).toLowerCase();
+  if (schema.includes("opencode") && schema.includes("config")) {
+    return true;
+  }
+
+  let matchedKeys = 0;
+  for (const key of Object.keys(parsed)) {
+    if (OPENCODE_CONFIG_KEYS.has(key)) matchedKeys += 1;
+  }
+  return matchedKeys >= 2;
+}
+
+function looksLikeOpenworkShape(parsed: unknown): boolean {
+  if (!isRecord(parsed)) return false;
+
+  const schema = maybeString(parsed.$schema).toLowerCase();
+  return schema.includes("openwork") && schema.includes("config");
+}
+
+function redactSecrets(value: unknown, prefix: string[] = [], hits: string[] = []): string[] {
+  if (!value || typeof value !== "object") return hits;
+
+  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+    const nextPrefix = [...prefix, key];
+    if (SECRET_KEY_RE.test(key) && typeof child === "string" && child.trim() && !SAFE_SECRET_VALUE_RE.test(child.trim())) {
+      hits.push(nextPrefix.join("."));
+      (value as Record<string, unknown>)[key] = "********";
+    }
+    if (typeof child === "object") {
+      redactSecrets(child, nextPrefix, hits);
+    }
+  }
+
+  return hits;
+}
+
+interface ConfigSection {
+  opencode: Record<string, unknown> | null;
+  openwork: Record<string, unknown> | null;
+  config: Record<string, unknown>;
+  preview: PreviewItem[];
+  configCount: number;
+}
+
+function readConfigSection(file: NormalizedFile, warnings: string[]): ConfigSection | null {
+  const parsed = parseJsonConfig(file);
+  if (!isRecord(parsed)) {
+    throw new Error(`Expected ${file.path} to contain an object`);
+  }
+
+  let opencode: Record<string, unknown> | null = null;
+  let openwork: Record<string, unknown> | null = null;
+  const config: Record<string, unknown> = {};
+  const preview: PreviewItem[] = [];
+  let configCount = 0;
+
+  if (isOpenworkConfigFile(file)) {
+    openwork = cloneRecord(parsed);
+    preview.push(buildConfigPreview(file, "OpenWork config"));
+    configCount += 1;
+  }
+
+  if (isOpencodeConfigFile(file)) {
+    opencode = cloneRecord(parsed);
+    preview.push(buildConfigPreview(file, "OpenCode config"));
+    preview.push(...collectOpencodePreviewItems(parsed));
+    configCount += 1;
+  }
+
+  if (!opencode && !openwork) {
+    if (looksLikeNamedMcpFile(file)) {
+      const name = resolveName("", stem(file.path));
+      opencode = { mcp: { [name]: cloneRecord(parsed) } };
+      const meta = typeof parsed.type === "string" ? `${humanizeType(parsed.type)} MCP` : "MCP config";
+      preview.push(buildPreviewItem(name, "MCP", meta, "mcp"));
+    } else if (looksLikeOpencodeShape(parsed)) {
+      opencode = cloneRecord(parsed);
+      preview.push(buildConfigPreview(file, "OpenCode config"));
+      preview.push(...collectOpencodePreviewItems(parsed));
+      configCount += 1;
+    } else if (looksLikeOpenworkShape(parsed)) {
+      openwork = cloneRecord(parsed);
+      preview.push(buildConfigPreview(file, "OpenWork config"));
+      configCount += 1;
+    } else if (looksLikeMcpShape(parsed)) {
+      const name = resolveName(parsed.name, stem(file.path));
+      opencode = { mcp: { [name]: cloneRecord(parsed) } };
+      preview.push(buildPreviewItem(maybeString(parsed.title).trim() || name, "MCP", "MCP config", "mcp"));
+    } else if (looksLikeNamedAgentJsonFile(file)) {
+      const name = resolveName(parsed.name, stem(file.path));
+      opencode = { agent: { [name]: cloneRecord(parsed) } };
+      const meta = typeof parsed.model === "string" ? parsed.model : "Agent config";
+      preview.push(buildPreviewItem(name, "Agent", meta, "agent"));
+    } else {
+      const name = resolveName("", stem(file.path));
+      config[name] = cloneRecord(parsed);
+      preview.push(buildPreviewItem(basename(file.path) || name, "Config", "Config file", "config"));
+      configCount += 1;
+    }
+  }
+
+  const secretHits = [
+    ...redactSecrets(opencode ?? {}, ["opencode"]),
+    ...redactSecrets(openwork ?? {}, ["openwork"]),
+    ...redactSecrets(config, ["config"]),
+  ];
+
+  if (secretHits.length) {
+    warnings.push(`Redacted ${secretHits.length} potential secret${secretHits.length === 1 ? "" : "s"} in ${file.path}: ${secretHits.slice(0, 3).join(", ")}`);
+  }
+
+  if (!opencode && !openwork && !Object.keys(config).length) {
+    warnings.push(`Ignored unsupported config file: ${file.path}`);
+    return null;
+  }
+
+  return { opencode, openwork, config, preview, configCount };
+}
+
+function mergeNamedObjects(target: Record<string, unknown>, source: Record<string, unknown> | undefined): void {
+  for (const [name, value] of Object.entries(source ?? {})) {
+    target[name] = value;
+  }
+}
+
+function buildSummary(
+  skills: Record<string, unknown>[],
+  agents: Record<string, unknown>,
+  mcp: Record<string, unknown>,
+  commands: Record<string, unknown>[],
+  warnings: string[],
+  configCount: number,
+): PackageSummary {
+  return {
+    skills: skills.length,
+    agents: Object.keys(agents).length,
+    mcpServers: Object.keys(mcp).length,
+    commands: commands.length,
+    configs: configCount,
+    warnings: warnings.length,
+  };
+}
+
+function buildBundleName(
+  inputName: unknown,
+  skills: { name: string }[],
+  agentCount: number,
+  mcpCount: number,
+  commandCount: number,
+  configCount: number,
+): string {
+  const explicit = String(inputName ?? "").trim();
+  if (explicit) return explicit;
+  if (skills.length === 1 && !agentCount && !mcpCount && !commandCount && !configCount) return skills[0].name;
+  if (skills.length > 1 && !agentCount && !mcpCount && !commandCount && !configCount) return "Shared skills set";
+  if (skills.length === 1) return `${skills[0].name} worker package`;
+  return "Packaged worker";
+}
+
+function buildBundleDescription(bundleType: string, summary: PackageSummary): string {
+  if (bundleType === "skill") return "Single skill bundle generated from dropped markdown.";
+  if (bundleType === "skills-set") return `${summary.skills} skills packaged together.`;
+  const parts: string[] = [];
+  if (summary.skills) parts.push(`${summary.skills} skill${summary.skills === 1 ? "" : "s"}`);
+  if (summary.agents) parts.push(`${summary.agents} agent${summary.agents === 1 ? "" : "s"}`);
+  if (summary.mcpServers) parts.push(`${summary.mcpServers} MCP${summary.mcpServers === 1 ? "" : "s"}`);
+  if (summary.commands) parts.push(`${summary.commands} command${summary.commands === 1 ? "" : "s"}`);
+  if (summary.configs) parts.push(`${summary.configs} config${summary.configs === 1 ? "" : "s"}`);
+  return parts.length ? `${parts.join(", ")} bundled into a worker package.` : "Worker package generated from shareable files.";
+}
+
+export function packageOpenworkFiles(input: PackageInput): PackageResult {
+  const rawFiles = Array.isArray(input?.files) ? input.files : [];
+  if (!rawFiles.length) {
+    throw new Error("Upload or paste a single skill to continue.");
+  }
+  if (rawFiles.length > MAX_FILES) {
+    throw new Error(`Too many files. Package up to ${MAX_FILES} files at once.`);
+  }
+  if (rawFiles.length !== 1) {
+    throw new Error("Upload or paste a single skill to continue.");
+  }
+
+  const warnings: string[] = [];
+  const skills: SkillRecord[] = [];
+  const commands: CommandRecord[] = [];
+  const previewItems: PreviewItem[] = [];
+  const opencodeAgent: Record<string, unknown> = {};
+  const opencodeMcp: Record<string, unknown> = {};
+  let opencodeConfig: Record<string, unknown> | null = null;
+  const genericConfig: Record<string, unknown> = {};
+  let openwork: Record<string, unknown> | null = null;
+  let configCount = 0;
+
+  for (let index = 0; index < rawFiles.length; index += 1) {
+    const file = normalizeFile(rawFiles[index], index);
+    if (!file.content.trim()) {
+      throw new Error("Skills need frontmatter with name and description.");
+    }
+
+    const frontmatter = parseFrontmatter(file.content);
+    const record = buildSkillRecord(file, warnings, frontmatter);
+    if (!record) {
+      throw new Error("Skills need frontmatter with name and description.");
+    }
+    skills.push(record);
+    previewItems.push(record.preview);
+  }
+
+  const cleanSkills = skills.map(({ preview: _preview, ...skill }) => skill);
+  const cleanCommands = commands.map(({ preview: _preview, ...command }) => command);
+
+  const summary = buildSummary(cleanSkills, opencodeAgent, opencodeMcp, cleanCommands, warnings, configCount);
+  if (!summary.skills && !summary.agents && !summary.mcpServers && !summary.commands && !summary.configs && !openwork) {
+    throw new Error("No shareable files found. Drop markdown or JSON/JSONC config files to package them.");
+  }
+
+  const hasWorkspaceConfig =
+    Boolean(openwork) ||
+    Boolean(opencodeConfig) ||
+    Object.keys(opencodeAgent).length ||
+    Object.keys(opencodeMcp).length ||
+    Object.keys(genericConfig).length ||
+    cleanCommands.length;
+  const name = buildBundleName(input?.bundleName, cleanSkills, summary.agents, summary.mcpServers, summary.commands, summary.configs);
+
+  if (hasWorkspaceConfig) {
+    throw new Error("Packaging full workspace config is no longer supported. Share skills without workspace config instead.");
+  }
+
+  if (!cleanSkills.length) {
+    throw new Error("No shareable skills found. Drop a skill markdown file to package it.");
+  }
+
+  const bundleType = cleanSkills.length === 1 ? "skill" : "skills-set";
+  const bundle: Record<string, unknown> = (() => {
+    if (bundleType === "skill") {
+      const skill = cleanSkills[0]!;
+      return {
+        schemaVersion: 1,
+        type: "skill",
+        name: skill.name,
+        description: skill.description || undefined,
+        trigger: skill.trigger || undefined,
+        content: skill.content,
+      };
+    }
+
+    return {
+      schemaVersion: 1,
+      type: "skills-set",
+      name,
+      description: buildBundleDescription("skills-set", summary),
+      skills: cleanSkills,
+    };
+  })();
+
+  return {
+    bundle,
+    bundleType,
+    name: bundle.name as string,
+    summary,
+    warnings,
+    items: previewItems.slice(0, 12),
+  };
+}
diff --git a/apps/share/server/_lib/publish-security.test.ts b/apps/share/server/_lib/publish-security.test.ts
new file mode 100644
index 0000000000..b656af64c1
--- /dev/null
+++ b/apps/share/server/_lib/publish-security.test.ts
@@ -0,0 +1,41 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildCanonicalRequest } from "./request-like.ts";
+import { buildCorsHeaders, validateTrustedOrigin } from "./publish-security.ts";
+
+test("buildCanonicalRequest pins legacy publish routes to the fixed share origin", () => {
+  const request = buildCanonicalRequest({
+    pathname: "/v1/bundles",
+    method: "POST",
+    headers: {
+      host: "evil.example",
+      "x-forwarded-host": "evil.example",
+      origin: "https://openworklabs.com",
+    },
+  });
+
+  assert.equal(new URL(request.url).origin, "https://share.openworklabs.com");
+});
+
+test("buildCorsHeaders reflects only trusted publisher origins", () => {
+  const trustedRequest = buildCanonicalRequest({
+    pathname: "/v1/bundles",
+    method: "POST",
+    headers: { origin: "https://openworklabs.com" },
+  });
+  const trustedHeaders = buildCorsHeaders(trustedRequest);
+
+  assert.equal(trustedHeaders["Access-Control-Allow-Origin"], "https://openworklabs.com");
+  assert.equal(trustedHeaders.Vary, "Origin");
+
+  const untrustedRequest = buildCanonicalRequest({
+    pathname: "/v1/bundles",
+    method: "POST",
+    headers: { origin: "https://evil.example" },
+  });
+  const untrustedHeaders = buildCorsHeaders(untrustedRequest);
+
+  assert.equal(untrustedHeaders["Access-Control-Allow-Origin"], undefined);
+  assert.equal(validateTrustedOrigin(untrustedRequest).ok, false);
+});
diff --git a/apps/share/server/_lib/publish-security.ts b/apps/share/server/_lib/publish-security.ts
new file mode 100644
index 0000000000..d201132258
--- /dev/null
+++ b/apps/share/server/_lib/publish-security.ts
@@ -0,0 +1,125 @@
+import { checkBotId } from "botid/server";
+
+type FixedWindowEntry = {
+  count: number;
+  resetAt: number;
+};
+
+const defaultAllowedOrigins = [
+  "https://app.openworklabs.com",
+  "https://openworklabs.com",
+  "https://app.openwork.software",
+  "https://openwork.software",
+  "http://localhost:5173",
+  "http://127.0.0.1:5173",
+  "tauri://localhost",
+  "http://tauri.localhost",
+  "http://localhost:3000",
+  "http://127.0.0.1:3000",
+  "http://localhost:3006",
+  "http://127.0.0.1:3006",
+];
+
+const store = globalThis as typeof globalThis & {
+  __openworkShareRateLimitStore?: Map<string, FixedWindowEntry>;
+};
+
+const rateLimitStore = store.__openworkShareRateLimitStore ?? new Map<string, FixedWindowEntry>();
+store.__openworkShareRateLimitStore = rateLimitStore;
+
+function now() {
+  return Date.now();
+}
+
+function readClientIp(request: Request) {
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  const realIp = request.headers.get("x-real-ip")?.trim();
+  return forwarded || realIp || "unknown";
+}
+
+function getRequestOrigin(request: Request) {
+  try {
+    return new URL(request.url).origin;
+  } catch {
+    return "";
+  }
+}
+
+export function getAllowedOrigins(request: Request) {
+  const configured = String(process.env.OPENWORK_PUBLISHER_ALLOWED_ORIGINS ?? "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  return new Set([getRequestOrigin(request), ...defaultAllowedOrigins, ...configured].filter(Boolean));
+}
+
+export function buildCorsHeaders(request: Request) {
+  const origin = request.headers.get("origin")?.trim() ?? "";
+  const headers: Record<string, string> = {
+    "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type,Accept,X-OpenWork-Bundle-Type,X-OpenWork-Schema-Version,X-OpenWork-Name",
+  };
+  if (origin && getAllowedOrigins(request).has(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Vary"] = "Origin";
+  }
+  return headers;
+}
+
+export function validateTrustedOrigin(request: Request) {
+  const origin = request.headers.get("origin")?.trim() ?? "";
+  if (!origin) {
+    return { ok: false as const, status: 403, message: "A trusted browser origin is required." };
+  }
+  if (!getAllowedOrigins(request).has(origin)) {
+    return { ok: false as const, status: 403, message: "Origin is not allowed to publish bundles." };
+  }
+  return { ok: true as const, origin };
+}
+
+export function applyFixedWindowRateLimit(input: {
+  key: string;
+  windowMs: number;
+  max: number;
+}) {
+  const currentTime = now();
+  const current = rateLimitStore.get(input.key);
+  if (!current || current.resetAt <= currentTime) {
+    rateLimitStore.set(input.key, { count: 1, resetAt: currentTime + input.windowMs });
+    return { ok: true as const, retryAfterSeconds: 0 };
+  }
+
+  if (current.count >= input.max) {
+    return {
+      ok: false as const,
+      retryAfterSeconds: Math.max(1, Math.ceil((current.resetAt - currentTime) / 1000)),
+    };
+  }
+
+  current.count += 1;
+  rateLimitStore.set(input.key, current);
+  return { ok: true as const, retryAfterSeconds: 0 };
+}
+
+export function rateLimitPublishRequest(request: Request) {
+  return applyFixedWindowRateLimit({
+    key: `publish:${readClientIp(request)}`,
+    windowMs: 60_000,
+    max: 20,
+  });
+}
+
+export async function verifyShareBotProtection(request: Request) {
+  const requestOrigin = getRequestOrigin(request);
+  const origin = request.headers.get("origin")?.trim() ?? "";
+  if (!origin || origin !== requestOrigin) {
+    return { ok: true as const };
+  }
+
+  const result = await checkBotId();
+  if (result.isBot) {
+    return { ok: false as const, status: 403, message: "Bot traffic is not allowed for bundle publishing." };
+  }
+
+  return { ok: true as const };
+}
diff --git a/apps/share/server/_lib/render-og-image-response.tsx b/apps/share/server/_lib/render-og-image-response.tsx
new file mode 100644
index 0000000000..7dbfb22999
--- /dev/null
+++ b/apps/share/server/_lib/render-og-image-response.tsx
@@ -0,0 +1,237 @@
+import { ImageResponse } from "next/og";
+import type { CSSProperties, ReactElement } from "react";
+
+import { computeOgImageLayout, type OgImageModel } from "./render-og-image.ts";
+import {
+  BASE_OG_IMAGE_HEIGHT,
+  BASE_OG_IMAGE_WIDTH,
+  getOgImageVariantConfig,
+  type OgImageVariant,
+} from "./og-image-variants.ts";
+
+const baseCanvasStyle: CSSProperties = {
+  width: `${BASE_OG_IMAGE_WIDTH}px`,
+  height: `${BASE_OG_IMAGE_HEIGHT}px`,
+  position: "relative",
+  display: "flex",
+  overflow: "hidden",
+  background: "linear-gradient(135deg, #f6f9fc 0%, #edf1f7 32%, #e2e8f0 66%, #f6f9fc 100%)",
+};
+
+const monoStyle: CSSProperties = {
+  fontFamily: "monospace",
+  color: "#64748b",
+};
+
+function OpenWorkLogo(): ReactElement {
+  return (
+    <svg width="40" height="34" viewBox="0 0 1024 866" fill="none">
+      <path
+        fill="#257CE9"
+        transform="scale(1.22782 1.22782)"
+        d="M490.962 13.2109C516.808 12.568 530.193 21.0761 551.688 33.1032L589.195 54.1798L626.787 75.2506C636.066 80.4389 649.292 87.5857 657.478 94.0584C671.769 105.914 683.112 124.362 684.683 143.175C685.907 157.831 685.389 173.375 685.377 188.173L685.339 263.964L685.37 354.897C685.391 380.32 686.655 411.29 681.484 435.723C675.249 464.929 662.265 492.269 643.573 515.558C632.659 528.974 618.797 542.079 604.617 552.026C599.568 555.568 592.431 559.221 586.895 562.254L566.235 573.714L489.048 616.153L413.234 657.883C399.18 665.674 384.868 674.248 370.402 681.208C362.127 685.189 352.078 686.881 342.951 687.813C318.706 688.516 306.452 681.909 286.169 670.383L257.958 654.418C241.853 645.558 225.804 636.597 209.812 627.535C198.9 621.412 183.811 613.689 174.536 605.554C158.954 591.701 149.499 572.233 148.244 551.42C147.215 534.843 147.823 512.715 147.821 495.659L147.81 397.552L147.812 317.362C147.82 296.243 146.723 270.836 151.06 250.573C156.911 223.486 169.602 198.349 187.923 177.56C197.018 167.22 207.51 158.199 219.097 150.756C233.391 141.426 253.227 131.448 268.617 123.103L348.755 79.3365L419.409 40.3549C445.897 25.8026 460.025 15.0173 490.962 13.2109ZM350.689 661.215C366.184 656.024 377.335 648.632 391.543 640.597C405.935 632.447 420.396 624.418 434.923 616.51L532.617 563.032C583.215 535.392 616.074 521.904 643.094 467.522C651 451.528 656.046 434.273 658.004 416.539C659.64 401.456 659.102 383.999 659.058 368.652L658.984 301.55L659.114 202.097C659.123 186.04 660.925 148.727 656.309 135.299C653.001 125.621 645.936 117.683 636.707 113.278C630.245 110.188 620.134 107.745 613.008 108.899C604.318 109.655 596.399 112.041 588.722 116.165C577.357 122.269 566.083 128.625 554.759 134.809L476.344 177.842L408.03 215.338C394.874 222.493 377.925 230.923 365.739 238.915C354.985 245.946 345.302 254.493 336.99 264.291C322.261 281.681 312.136 302.494 307.544 324.817C303.925 343.149 305.08 374.437 305.113 394.107L305.183 493.471L305.2 580.911C305.2 596.329 304.599 612.603 305.674 627.933C307.254 650.453 322.586 664.188 344.986 661.954C346.892 661.748 348.793 661.502 350.689 661.215ZM275.046 634.925C276.703 635.884 278.443 636.934 280.128 637.819C278.716 626.741 279.321 604.711 279.333 592.851L279.349 514.659L279.319 397.689L279.307 363.99C279.296 348.799 279.081 336.276 281.868 321.173C286.627 296.026 297.312 272.376 313.038 252.185C322.448 240.062 333.642 229.435 346.238 220.668C358.126 212.437 374.555 203.96 387.566 196.921C405.827 187.071 424.038 177.128 442.198 167.095L540.847 112.798C556.874 103.996 575.722 93.0395 591.788 84.9667L544.597 58.1945C529.914 49.8677 510.295 37.0292 492.825 38.8716C483.01 39.5777 473.292 41.0835 464.415 45.4977C453.156 51.0956 442.077 57.5037 431.036 63.5307L359.332 102.878L282.282 145.173C266.343 153.844 246.398 163.945 231.532 173.678C222.383 179.646 214.109 186.86 206.949 195.111C188.139 216.808 175.15 246.46 173.93 275.291C173.304 290.098 173.676 305.111 173.702 319.948L173.733 400.555L173.754 498.411C173.757 515.471 173.162 532.646 174.011 549.669C174.707 563.612 181.36 577.006 191.74 586.251C200.634 593.773 215.172 601.204 225.649 607.054C242.161 616.261 258.627 625.552 275.046 634.925Z"
+      />
+      <path
+        fill="#257CE9"
+        transform="scale(1.22782 1.22782)"
+        d="M552.454 209.477C572.012 207.959 581.847 219.441 582.39 238.522C582.687 248.987 582.481 259.462 582.458 269.93L582.381 329.269L582.483 374.869C582.513 386.815 582.826 398.849 581.432 410.717C580.03 422.226 576.641 433.405 571.416 443.754C564.818 456.975 555.554 468.686 544.209 478.151C533.954 486.627 522.347 492.2 510.69 498.541L475.758 517.796L441.984 536.419C433.817 540.91 422.997 547.228 414.361 550.139C395.476 554.553 385.023 538.561 385.317 521.594C385.494 511.326 385.526 500.852 385.528 490.583L385.489 419.929L385.431 378.325C385.353 365.955 384.961 352.061 386.603 339.869C388.349 327.707 392.543 316.027 398.933 305.533C412.05 283.666 427.715 275.485 449.348 263.601L480.283 246.56L514.335 227.666C526.451 220.869 538.901 212.844 552.454 209.477ZM411.433 419.84C412.154 444.816 411.109 470.99 411.596 496.052C411.681 500.45 411.062 520.138 411.862 523.514C436.021 509.816 460.32 496.368 484.756 483.172C499.771 474.909 517.93 466.631 530.803 455.318C544.786 443.029 554.756 422.232 555.367 403.682C556.041 383.225 555.895 362.475 555.571 342.046C555.568 341.804 555.455 341.8 555.196 341.71C513.173 364.086 471.908 388.028 429.782 410.228C423.629 413.47 417.693 416.752 411.433 419.84ZM411.24 391.445L414.53 389.48C449.106 371.177 482.45 351.994 516.706 333.189L543.205 318.622C547.228 316.407 553.138 312.877 557.106 311.086C556.18 289.545 557.012 267.818 556.741 246.25C556.699 242.902 557.552 235.271 552.517 234.957C545.074 238.359 537.476 242.917 530.329 246.979C521.218 252.161 512.063 257.266 502.866 262.294L460.839 285.501C451.005 290.952 438.682 297.024 430.234 304.172C423.327 309.962 418.07 317.472 414.993 325.943C409.122 341.857 411.331 373.369 411.24 391.445Z"
+      />
+    </svg>
+  );
+}
+
+function OgImage({
+  model,
+  variant,
+}: {
+  model: OgImageModel;
+  variant: OgImageVariant;
+}): ReactElement {
+  const layout = computeOgImageLayout(model);
+  const variantConfig = getOgImageVariantConfig(variant);
+  const scaleX = variantConfig.width / BASE_OG_IMAGE_WIDTH;
+  const scaleY = variantConfig.height / BASE_OG_IMAGE_HEIGHT;
+
+  return (
+    <div
+      style={{
+        width: `${variantConfig.width}px`,
+        height: `${variantConfig.height}px`,
+        position: "relative",
+        display: "flex",
+        overflow: "hidden",
+        background: "#f6f9fc",
+      }}
+    >
+      <div
+        style={{
+          ...baseCanvasStyle,
+          transform: `scale(${scaleX}, ${scaleY})`,
+          transformOrigin: "top left",
+        }}
+      >
+        <div
+          style={{
+            position: "absolute",
+            inset: "-18%",
+            transform: "rotate(-18deg)",
+            background:
+              "linear-gradient(90deg, rgba(255,255,255,0) 26%, rgba(148,163,184,0.08) 45%, rgba(203,213,225,0.14) 50%, rgba(148,163,184,0.08) 55%, rgba(255,255,255,0) 74%)",
+          }}
+        />
+
+        <div
+          style={{
+            position: "absolute",
+            inset: "0",
+            opacity: 0.6,
+            backgroundImage:
+              "radial-gradient(circle at 3px 3px, rgba(148,163,184,0.16) 1.2px, transparent 1.2px)",
+            backgroundSize: "32px 32px",
+          }}
+        />
+
+        <div
+          style={{
+            position: "absolute",
+            right: "58px",
+            bottom: "32px",
+            ...monoStyle,
+            fontSize: "14px",
+          }}
+        >
+          {model.domain}
+        </div>
+
+        <div
+          style={{
+            position: "absolute",
+            left: "108px",
+            top: "82px",
+            width: "984px",
+            height: "466px",
+            borderRadius: "28px",
+            background: "rgba(255,255,255,0.72)",
+            border: "1px solid rgba(226,232,240,0.85)",
+            boxShadow: "0 18px 40px rgba(1,22,39,0.08), 0 4px 12px rgba(1,22,39,0.04)",
+            display: "flex",
+            flexDirection: "column",
+            padding: "44px 72px 42px 72px",
+          }}
+        >
+          <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between" }}>
+            <OpenWorkLogo />
+            <div
+              style={{
+                display: "flex",
+                alignItems: "center",
+                gap: "10px",
+                height: "34px",
+                padding: "0 16px",
+                borderRadius: "999px",
+                background: "rgba(255,255,255,0.82)",
+                border: "1px solid rgba(226,232,240,0.72)",
+              }}
+            >
+              <div
+                style={{
+                  width: "10px",
+                  height: "10px",
+                  borderRadius: "999px",
+                  background: "#011627",
+                }}
+              />
+              <span style={{ ...monoStyle, fontSize: "15px", color: "#334155" }}>{model.fileType}</span>
+            </div>
+          </div>
+
+          <div
+            style={{
+              flex: 1,
+              display: "flex",
+              flexDirection: "column",
+              justifyContent: "center",
+              maxWidth: "720px",
+            }}
+          >
+            {layout.titleLines.map((line, index) => (
+              <div
+                key={`${line}-${index}`}
+                style={{
+                  fontFamily: "sans-serif",
+                  fontSize: `${layout.titleFontSize}px`,
+                  lineHeight: `${layout.titleLineHeight}px`,
+                  fontWeight: 700,
+                  letterSpacing: "-0.04em",
+                  color: "#011627",
+                }}
+              >
+                {line}
+              </div>
+            ))}
+
+            {layout.showDescription ? (
+              <div
+                style={{
+                  display: "flex",
+                  flexDirection: "column",
+                  gap: "4px",
+                  marginTop: "18px",
+                  maxWidth: "620px",
+                }}
+              >
+                {layout.descriptionLines.map((line, index) => (
+                  <div
+                    key={`${line}-${index}`}
+                    style={{
+                      fontFamily: "sans-serif",
+                      fontSize: "19px",
+                      lineHeight: "24px",
+                      fontWeight: 500,
+                      color: "#475569",
+                    }}
+                  >
+                    {line}
+                  </div>
+                ))}
+              </div>
+            ) : null}
+          </div>
+
+          <div style={{ display: "flex", alignItems: "center", gap: "18px" }}>
+            <span
+              style={{
+                ...monoStyle,
+                fontSize: "15px",
+                letterSpacing: "0.16em",
+                color: "#64748b",
+              }}
+            >
+              {model.category.toUpperCase()}
+            </span>
+            <span style={{ ...monoStyle, fontSize: "15px", color: "#cbd5e1" }}>/</span>
+            <span style={{ ...monoStyle, fontSize: "15px" }}>{model.tag}</span>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function renderOgPngResponse(
+  model: OgImageModel,
+  headers: Record<string, string> = {},
+  variant: OgImageVariant = "facebook",
+): ImageResponse {
+  const variantConfig = getOgImageVariantConfig(variant);
+  const response = new ImageResponse(<OgImage model={model} variant={variant} />, {
+    width: variantConfig.width,
+    height: variantConfig.height,
+  });
+
+  for (const [name, value] of Object.entries(headers)) {
+    response.headers.set(name, value);
+  }
+
+  return response;
+}
diff --git a/apps/share/server/_lib/render-og-image.test.ts b/apps/share/server/_lib/render-og-image.test.ts
new file mode 100644
index 0000000000..d9df6b80ec
--- /dev/null
+++ b/apps/share/server/_lib/render-og-image.test.ts
@@ -0,0 +1,53 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildBundleOgImageModel, renderBundleOgImage, renderRootOgImage } from "./render-og-image.ts";
+
+test("renderRootOgImage uses the simplified metadata-first card", () => {
+  const svg = renderRootOgImage();
+
+  assert.match(svg, /Share OpenWork skills/);
+  assert.match(svg, />beautifully</);
+  assert.match(svg, /#257CE9/);
+  assert.doesNotMatch(svg, /agent-creator\.md/);
+  assert.match(svg, /openwork preview/);
+  assert.doesNotMatch(svg, /Before we start, use the question tool/);
+});
+
+test("renderBundleOgImage focuses on bundle metadata instead of bundle body text", () => {
+  const rawJson = JSON.stringify({
+    schemaVersion: 1,
+    type: "skill",
+    name: "follow-up-reminder",
+    description: "Shareable reminder skill",
+    trigger: "idle",
+    content: "# follow-up-reminder\n\n## Trigger\n\nRuns after the conversation is idle for 24h."
+  });
+
+  const svg = renderBundleOgImage({ id: "01TESTPREVIEW", rawJson });
+  const model = buildBundleOgImageModel({ id: "01TESTPREVIEW", rawJson });
+
+  assert.equal(model.title, "Follow Up Reminder");
+  assert.equal(model.fileName, "follow-up-reminder.md");
+  assert.equal(model.tag, "trigger: idle");
+  assert.match(svg, /Follow Up Reminder/);
+  assert.doesNotMatch(svg, /follow-up-reminder\.md/);
+  assert.match(svg, /trigger: idle/);
+  assert.doesNotMatch(svg, /Runs after the conversation is idle for 24h/);
+});
+
+test("renderBundleOgImage supports platform-specific canvas dimensions", () => {
+  const rawJson = JSON.stringify({
+    schemaVersion: 1,
+    type: "skill",
+    name: "follow-up-reminder",
+    description: "Shareable reminder skill",
+    content: "# follow-up-reminder",
+  });
+
+  const twitterSvg = renderBundleOgImage({ id: "01TESTPREVIEW", rawJson, variant: "twitter" });
+  const linkedinSvg = renderBundleOgImage({ id: "01TESTPREVIEW", rawJson, variant: "linkedin" });
+
+  assert.match(twitterSvg, /<svg width="1200" height="600"/);
+  assert.match(linkedinSvg, /<svg width="1200" height="627"/);
+});
diff --git a/apps/share/server/_lib/render-og-image.ts b/apps/share/server/_lib/render-og-image.ts
new file mode 100644
index 0000000000..fb7fa97681
--- /dev/null
+++ b/apps/share/server/_lib/render-og-image.ts
@@ -0,0 +1,386 @@
+import {
+  DEFAULT_PUBLIC_BASE_URL,
+  buildBundlePreview,
+  humanizeType,
+  maybeString,
+  parseBundle,
+  parseFrontmatter,
+} from "./share-utils.ts";
+import {
+  BASE_OG_IMAGE_HEIGHT,
+  BASE_OG_IMAGE_WIDTH,
+  getOgImageVariantConfig,
+  type OgImageVariant,
+} from "./og-image-variants.ts";
+
+export type OgImageModel = {
+  title: string;
+  fileName: string;
+  fileType: string;
+  description: string;
+  category: string;
+  tag: string;
+  domain: string;
+};
+
+export type OgTitleTier = "xl" | "lg" | "md" | "sm" | "xs";
+
+export type OgImageLayout = {
+  displayTitle: string;
+  titleTier: OgTitleTier;
+  titleFontSize: number;
+  titleLineHeight: number;
+  titleLines: string[];
+  showDescription: boolean;
+  descriptionLines: string[];
+};
+
+type OgTextTierConfig = {
+  fontSize: number;
+  lineHeight: number;
+  maxLines: number;
+  charsPerLine: number;
+};
+
+const MAX_DISPLAY_CHARS = 55;
+const MAX_DESCRIPTION_CHARS = 120;
+const DEFAULT_DOMAIN = DEFAULT_PUBLIC_BASE_URL.replace(/^https?:\/\//, "");
+
+const TITLE_TIER_CONFIG: Record<OgTitleTier, OgTextTierConfig> = {
+  xl: { fontSize: 64, lineHeight: 68, maxLines: 1, charsPerLine: 18 },
+  lg: { fontSize: 50, lineHeight: 56, maxLines: 2, charsPerLine: 18 },
+  md: { fontSize: 40, lineHeight: 46, maxLines: 2, charsPerLine: 24 },
+  sm: { fontSize: 32, lineHeight: 38, maxLines: 2, charsPerLine: 30 },
+  xs: { fontSize: 26, lineHeight: 33, maxLines: 2, charsPerLine: 34 },
+};
+
+function escapeSvgText(value: unknown): string {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+function normalizeText(value: unknown): string {
+  return String(value ?? "").replace(/\s+/g, " ").trim();
+}
+
+function titleFromFileName(fileName: string): string {
+  return fileName
+    .replace(/\.[a-z0-9]+$/i, "")
+    .split(/[-_\s]+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function humanizeTitle(value: string): string {
+  const normalized = normalizeText(value);
+  if (!normalized) return "";
+  if (/[A-Z]/.test(normalized)) return normalized;
+  return normalized
+    .split(/[-_\s]+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function truncateAtWordBoundary(value: string, maxChars: number): string {
+  if (value.length <= maxChars) return value;
+  const truncated = value.slice(0, maxChars);
+  const lastSpace = truncated.lastIndexOf(" ");
+  if (lastSpace > maxChars * 0.6) {
+    return `${truncated.slice(0, lastSpace)}...`;
+  }
+  return `${truncated}...`;
+}
+
+function splitTextIntoLines(text: string, maxCharsPerLine: number, maxLines: number): string[] {
+  const normalized = normalizeText(text);
+  if (!normalized) return [];
+
+  const words = normalized.split(" ");
+  const lines: string[] = [];
+  let current = "";
+
+  for (const word of words) {
+    const candidate = current ? `${current} ${word}` : word;
+    if (candidate.length <= maxCharsPerLine) {
+      current = candidate;
+      continue;
+    }
+
+    if (current) {
+      lines.push(current);
+      if (lines.length === maxLines) {
+        lines[lines.length - 1] = truncateAtWordBoundary(lines[lines.length - 1]!, maxCharsPerLine);
+        return lines;
+      }
+      current = word;
+      continue;
+    }
+
+    lines.push(truncateAtWordBoundary(word, maxCharsPerLine));
+    if (lines.length === maxLines) {
+      return lines;
+    }
+  }
+
+  if (current && lines.length < maxLines) {
+    lines.push(current);
+  }
+
+  if (lines.length > maxLines) {
+    return lines.slice(0, maxLines);
+  }
+
+  if (lines.length === maxLines && words.join(" ").length > lines.join(" ").length) {
+    lines[lines.length - 1] = truncateAtWordBoundary(lines[lines.length - 1]!, maxCharsPerLine);
+  }
+
+  return lines;
+}
+
+function getTitleTier(length: number): OgTitleTier {
+  if (length <= 10) return "xl";
+  if (length <= 20) return "lg";
+  if (length <= 35) return "md";
+  if (length <= 50) return "sm";
+  return "xs";
+}
+
+function inferFileType(fileName: string, category: string): string {
+  const extension = (fileName.split(".").pop() || "").toLowerCase();
+  if (extension === "md" && category === "command") return "COMMAND.md";
+  if (extension === "md") return "SKILL.md";
+  if (extension === "json") return "JSON";
+  if (extension === "toml") return "TOML";
+  if (extension === "yaml" || extension === "yml") return "YAML";
+  return extension ? extension.toUpperCase() : "FILE";
+}
+
+function buildTagFromTrigger(trigger: string): string {
+  const normalized = normalizeText(trigger);
+  return normalized ? `trigger: ${normalized.toLowerCase()}` : "";
+}
+
+function buildCategory(bundleType: string, previewTone: string): string {
+  const typeLabel = humanizeType(bundleType).trim();
+  if (typeLabel) return typeLabel.toLowerCase();
+  return normalizeText(previewTone).toLowerCase() || "bundle";
+}
+
+function buildDescription(options: {
+  bundleDescription: string;
+  frontmatterDescription: string;
+  previewLabel: string;
+}): string {
+  return truncateAtWordBoundary(
+    normalizeText(options.bundleDescription) ||
+      normalizeText(options.frontmatterDescription) ||
+      normalizeText(options.previewLabel),
+    MAX_DESCRIPTION_CHARS,
+  );
+}
+
+function buildRootOgInput(): OgImageModel {
+  return {
+    title: "Share OpenWork skills beautifully",
+    fileName: "agent-creator.md",
+    fileType: "SKILL.md",
+    description: "Clean metadata-first social cards for shared OpenWork skills and bundles.",
+    category: "share",
+    tag: "openwork preview",
+    domain: DEFAULT_DOMAIN,
+  };
+}
+
+function buildBundleOgInput({ rawJson }: { id: string; rawJson: string }): OgImageModel {
+  const bundle = parseBundle(rawJson);
+  const preview = buildBundlePreview(bundle);
+  const { data } = parseFrontmatter(bundle.content);
+  const bundleName = maybeString(data.name).trim() || bundle.name || titleFromFileName(preview.filename) || "OpenWork bundle";
+  const bundleDescription = maybeString(bundle.description).trim();
+  const frontmatterDescription = maybeString(data.description).trim();
+  const triggerTag = buildTagFromTrigger(
+    maybeString(data.trigger).trim() || maybeString(bundle.trigger).trim(),
+  );
+  const title =
+    bundle.type === "skills-set" && bundle.skills.length > 1
+      ? `${bundle.skills.length} Shared Skills`
+      : humanizeTitle(bundleName) || "OpenWork bundle";
+  const category = buildCategory(bundle.type, preview.tone);
+  const tag =
+    triggerTag ||
+    normalizeText(preview.label).toLowerCase() ||
+    `${category} bundle`;
+
+  return {
+    title,
+    fileName: preview.filename,
+    fileType: inferFileType(preview.filename, preview.tone),
+    description: buildDescription({
+      bundleDescription,
+      frontmatterDescription,
+      previewLabel: preview.label,
+    }),
+    category,
+    tag,
+    domain: DEFAULT_DOMAIN,
+  };
+}
+
+export function computeOgImageLayout(model: OgImageModel): OgImageLayout {
+  const displayTitle = truncateAtWordBoundary(humanizeTitle(model.title) || "OpenWork bundle", MAX_DISPLAY_CHARS);
+  const titleTier = getTitleTier(displayTitle.length);
+  const config = TITLE_TIER_CONFIG[titleTier];
+  const titleLines = splitTextIntoLines(displayTitle, config.charsPerLine, config.maxLines);
+  const showDescription = Boolean(model.description) && (titleTier === "xl" || titleTier === "lg");
+  const descriptionLines = showDescription
+    ? splitTextIntoLines(model.description, 42, 2)
+    : [];
+
+  return {
+    displayTitle,
+    titleTier,
+    titleFontSize: config.fontSize,
+    titleLineHeight: config.lineHeight,
+    titleLines,
+    showDescription,
+    descriptionLines,
+  };
+}
+
+function renderOpenWorkLogo({ x, y, width, height }: { x: number; y: number; width: number; height: number }): string {
+  return `
+    <svg x="${x}" y="${y}" width="${width}" height="${height}" viewBox="0 0 1024 866" fill="none">
+      <path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M490.962 13.2109C516.808 12.568 530.193 21.0761 551.688 33.1032L589.195 54.1798L626.787 75.2506C636.066 80.4389 649.292 87.5857 657.478 94.0584C671.769 105.914 683.112 124.362 684.683 143.175C685.907 157.831 685.389 173.375 685.377 188.173L685.339 263.964L685.37 354.897C685.391 380.32 686.655 411.29 681.484 435.723C675.249 464.929 662.265 492.269 643.573 515.558C632.659 528.974 618.797 542.079 604.617 552.026C599.568 555.568 592.431 559.221 586.895 562.254L566.235 573.714L489.048 616.153L413.234 657.883C399.18 665.674 384.868 674.248 370.402 681.208C362.127 685.189 352.078 686.881 342.951 687.813C318.706 688.516 306.452 681.909 286.169 670.383L257.958 654.418C241.853 645.558 225.804 636.597 209.812 627.535C198.9 621.412 183.811 613.689 174.536 605.554C158.954 591.701 149.499 572.233 148.244 551.42C147.215 534.843 147.823 512.715 147.821 495.659L147.81 397.552L147.812 317.362C147.82 296.243 146.723 270.836 151.06 250.573C156.911 223.486 169.602 198.349 187.923 177.56C197.018 167.22 207.51 158.199 219.097 150.756C233.391 141.426 253.227 131.448 268.617 123.103L348.755 79.3365L419.409 40.3549C445.897 25.8026 460.025 15.0173 490.962 13.2109ZM350.689 661.215C366.184 656.024 377.335 648.632 391.543 640.597C405.935 632.447 420.396 624.418 434.923 616.51L532.617 563.032C583.215 535.392 616.074 521.904 643.094 467.522C651 451.528 656.046 434.273 658.004 416.539C659.64 401.456 659.102 383.999 659.058 368.652L658.984 301.55L659.114 202.097C659.123 186.04 660.925 148.727 656.309 135.299C653.001 125.621 645.936 117.683 636.707 113.278C630.245 110.188 620.134 107.745 613.008 108.899C604.318 109.655 596.399 112.041 588.722 116.165C577.357 122.269 566.083 128.625 554.759 134.809L476.344 177.842L408.03 215.338C394.874 222.493 377.925 230.923 365.739 238.915C354.985 245.946 345.302 254.493 336.99 264.291C322.261 281.681 312.136 302.494 307.544 324.817C303.925 343.149 305.08 374.437 305.113 394.107L305.183 493.471L305.2 580.911C305.2 596.329 304.599 612.603 305.674 627.933C307.254 650.453 322.586 664.188 344.986 661.954C346.892 661.748 348.793 661.502 350.689 661.215ZM275.046 634.925C276.703 635.884 278.443 636.934 280.128 637.819C278.716 626.741 279.321 604.711 279.333 592.851L279.349 514.659L279.319 397.689L279.307 363.99C279.296 348.799 279.081 336.276 281.868 321.173C286.627 296.026 297.312 272.376 313.038 252.185C322.448 240.062 333.642 229.435 346.238 220.668C358.126 212.437 374.555 203.96 387.566 196.921C405.827 187.071 424.038 177.128 442.198 167.095L540.847 112.798C556.874 103.996 575.722 93.0395 591.788 84.9667L544.597 58.1945C529.914 49.8677 510.295 37.0292 492.825 38.8716C483.01 39.5777 473.292 41.0835 464.415 45.4977C453.156 51.0956 442.077 57.5037 431.036 63.5307L359.332 102.878L282.282 145.173C266.343 153.844 246.398 163.945 231.532 173.678C222.383 179.646 214.109 186.86 206.949 195.111C188.139 216.808 175.15 246.46 173.93 275.291C173.304 290.098 173.676 305.111 173.702 319.948L173.733 400.555L173.754 498.411C173.757 515.471 173.162 532.646 174.011 549.669C174.707 563.612 181.36 577.006 191.74 586.251C200.634 593.773 215.172 601.204 225.649 607.054C242.161 616.261 258.627 625.552 275.046 634.925Z"/>
+      <path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M552.454 209.477C572.012 207.959 581.847 219.441 582.39 238.522C582.687 248.987 582.481 259.462 582.458 269.93L582.381 329.269L582.483 374.869C582.513 386.815 582.826 398.849 581.432 410.717C580.03 422.226 576.641 433.405 571.416 443.754C564.818 456.975 555.554 468.686 544.209 478.151C533.954 486.627 522.347 492.2 510.69 498.541L475.758 517.796L441.984 536.419C433.817 540.91 422.997 547.228 414.361 550.139C395.476 554.553 385.023 538.561 385.317 521.594C385.494 511.326 385.526 500.852 385.528 490.583L385.489 419.929L385.431 378.325C385.353 365.955 384.961 352.061 386.603 339.869C388.349 327.707 392.543 316.027 398.933 305.533C412.05 283.666 427.715 275.485 449.348 263.601L480.283 246.56L514.335 227.666C526.451 220.869 538.901 212.844 552.454 209.477ZM411.433 419.84C412.154 444.816 411.109 470.99 411.596 496.052C411.681 500.45 411.062 520.138 411.862 523.514C436.021 509.816 460.32 496.368 484.756 483.172C499.771 474.909 517.93 466.631 530.803 455.318C544.786 443.029 554.756 422.232 555.367 403.682C556.041 383.225 555.895 362.475 555.571 342.046C555.568 341.804 555.455 341.8 555.196 341.71C513.173 364.086 471.908 388.028 429.782 410.228C423.629 413.47 417.693 416.752 411.433 419.84ZM411.24 391.445L414.53 389.48C449.106 371.177 482.45 351.994 516.706 333.189L543.205 318.622C547.228 316.407 553.138 312.877 557.106 311.086C556.18 289.545 557.012 267.818 556.741 246.25C556.699 242.902 557.552 235.271 552.517 234.957C545.074 238.359 537.476 242.917 530.329 246.979C521.218 252.161 512.063 257.266 502.866 262.294L460.839 285.501C451.005 290.952 438.682 297.024 430.234 304.172C423.327 309.962 418.07 317.472 414.993 325.943C409.122 341.857 411.331 373.369 411.24 391.445Z"/>
+    </svg>
+  `;
+}
+
+function renderTitleBlock(model: OgImageModel): string {
+  const layout = computeOgImageLayout(model);
+  const cardX = 108;
+  const cardY = 82;
+  const titleWidth = 720;
+  const titleX = cardX + 72;
+  const descriptionLineHeight = 24;
+  const blockHeight =
+    layout.titleLines.length * layout.titleLineHeight +
+    (layout.showDescription ? layout.descriptionLines.length * descriptionLineHeight + 22 : 0);
+  let currentY = cardY + 242 - blockHeight / 2 + layout.titleFontSize;
+
+  const titleMarkup = layout.titleLines
+    .map((line, index) => {
+      const node = `<text x="${titleX}" y="${currentY + index * layout.titleLineHeight}" fill="#011627" font-family="Inter, Arial, sans-serif" font-size="${layout.titleFontSize}" font-weight="700" letter-spacing="-2">${escapeSvgText(line)}</text>`;
+      return node;
+    })
+    .join("");
+
+  currentY += layout.titleLines.length * layout.titleLineHeight;
+
+  const descriptionMarkup = layout.showDescription
+    ? layout.descriptionLines
+        .map((line, index) => {
+          const y = currentY + 22 + index * descriptionLineHeight;
+          return `<text x="${titleX}" y="${y}" fill="#475569" font-family="Inter, Arial, sans-serif" font-size="19" font-weight="500">${escapeSvgText(line)}</text>`;
+        })
+        .join("")
+    : "";
+
+  return `
+    <clipPath id="title-clip">
+      <rect x="${titleX}" y="${cardY + 134}" width="${titleWidth}" height="200" rx="18" />
+    </clipPath>
+    <g clip-path="url(#title-clip)">
+      ${titleMarkup}
+      ${descriptionMarkup}
+    </g>
+  `;
+}
+
+function renderSkillCard(model: OgImageModel, variant: OgImageVariant): string {
+  const variantConfig = getOgImageVariantConfig(variant);
+  const cardX = 108;
+  const cardY = 82;
+  const cardWidth = 984;
+  const cardHeight = 466;
+  const badgeWidth = 132;
+  const badgeX = cardX + cardWidth - 72 - badgeWidth;
+  const badgeY = cardY + 44;
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<svg width="${variantConfig.width}" height="${variantConfig.height}" viewBox="0 0 ${BASE_OG_IMAGE_WIDTH} ${BASE_OG_IMAGE_HEIGHT}" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="canvasGradient" x1="72" y1="0" x2="1128" y2="630" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#f6f9fc" />
+      <stop offset="0.34" stop-color="#edf1f7" />
+      <stop offset="0.67" stop-color="#e2e8f0" />
+      <stop offset="1" stop-color="#f6f9fc" />
+    </linearGradient>
+    <linearGradient id="diagonalBand" x1="112" y1="40" x2="1088" y2="590" gradientUnits="userSpaceOnUse">
+      <stop offset="0.22" stop-color="#ffffff" stop-opacity="0" />
+      <stop offset="0.44" stop-color="#94a3b8" stop-opacity="0.08" />
+      <stop offset="0.5" stop-color="#cbd5e1" stop-opacity="0.15" />
+      <stop offset="0.56" stop-color="#94a3b8" stop-opacity="0.08" />
+      <stop offset="0.78" stop-color="#ffffff" stop-opacity="0" />
+    </linearGradient>
+    <pattern id="dotGrid" width="32" height="32" patternUnits="userSpaceOnUse">
+      <circle cx="3" cy="3" r="1.2" fill="#94a3b8" fill-opacity="0.18" />
+    </pattern>
+    <filter id="cardShadow" x="44" y="40" width="1112" height="514" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feDropShadow dx="0" dy="18" stdDeviation="20" flood-color="#011627" flood-opacity="0.08" />
+      <feDropShadow dx="0" dy="4" stdDeviation="8" flood-color="#011627" flood-opacity="0.04" />
+    </filter>
+  </defs>
+  <rect width="${BASE_OG_IMAGE_WIDTH}" height="${BASE_OG_IMAGE_HEIGHT}" fill="url(#canvasGradient)" />
+  <rect x="-180" y="160" width="1560" height="164" transform="rotate(-18 600 315)" fill="url(#diagonalBand)" />
+  <rect width="${BASE_OG_IMAGE_WIDTH}" height="${BASE_OG_IMAGE_HEIGHT}" fill="url(#dotGrid)" />
+
+  <text x="1012" y="598" fill="#64748b" font-family="JetBrains Mono, Menlo, monospace" font-size="14">${escapeSvgText(model.domain)}</text>
+
+  <rect x="${cardX}" y="${cardY}" width="${cardWidth}" height="${cardHeight}" rx="28" fill="rgba(255,255,255,0.76)" stroke="rgba(226,232,240,0.85)" filter="url(#cardShadow)" />
+  <rect x="${cardX}" y="${cardY}" width="${cardWidth}" height="${cardHeight}" rx="28" fill="rgba(255,255,255,0.56)" />
+  ${renderOpenWorkLogo({ x: cardX + 66, y: cardY + 34, width: 40, height: 34 })}
+
+  <g transform="translate(${badgeX} ${badgeY})">
+    <rect width="${badgeWidth}" height="34" rx="17" fill="rgba(255,255,255,0.82)" stroke="rgba(226,232,240,0.72)" />
+    <circle cx="18" cy="17" r="5" fill="#011627" />
+    <text x="31" y="22" fill="#334155" font-family="JetBrains Mono, Menlo, monospace" font-size="15">${escapeSvgText(model.fileType)}</text>
+  </g>
+
+  ${renderTitleBlock(model)}
+
+  <text x="${cardX + 72}" y="${cardY + cardHeight - 42}" fill="#64748b" font-family="JetBrains Mono, Menlo, monospace" font-size="15" letter-spacing="2">${escapeSvgText(model.category.toUpperCase())}</text>
+  <text x="${cardX + 186}" y="${cardY + cardHeight - 42}" fill="#cbd5e1" font-family="JetBrains Mono, Menlo, monospace" font-size="15">/</text>
+  <text x="${cardX + 210}" y="${cardY + cardHeight - 42}" fill="#64748b" font-family="JetBrains Mono, Menlo, monospace" font-size="15">${escapeSvgText(model.tag)}</text>
+</svg>`;
+}
+
+export function buildRootOgImageModel(): OgImageModel {
+  return buildRootOgInput();
+}
+
+export function buildBundleOgImageModel({ id, rawJson }: { id: string; rawJson: string }): OgImageModel {
+  return buildBundleOgInput({ id, rawJson });
+}
+
+export function renderRootOgImage(variant: OgImageVariant = "facebook"): string {
+  return renderSkillCard(buildRootOgInput(), variant);
+}
+
+export function renderBundleOgImage({
+  id,
+  rawJson,
+  variant = "facebook",
+}: {
+  id: string;
+  rawJson: string;
+  variant?: OgImageVariant;
+}): string {
+  return renderSkillCard(buildBundleOgInput({ id, rawJson }), variant);
+}
diff --git a/apps/share/server/_lib/request-like.ts b/apps/share/server/_lib/request-like.ts
new file mode 100644
index 0000000000..af69f2e3a8
--- /dev/null
+++ b/apps/share/server/_lib/request-like.ts
@@ -0,0 +1,68 @@
+import type { RequestLike } from "./types.ts";
+import { getPublicBaseUrl } from "./share-utils.ts";
+
+export function headersToObject(
+  headersInput: Headers | Record<string, string | string[] | undefined> | null,
+): Record<string, string> {
+  const result: Record<string, string> = {};
+
+  if (!headersInput) return result;
+
+  if (typeof (headersInput as Headers).forEach === "function") {
+    (headersInput as Headers).forEach((value, key) => {
+      result[String(key).toLowerCase()] = String(value);
+    });
+    return result;
+  }
+
+  for (const [key, value] of Object.entries(headersInput)) {
+    if (value == null) continue;
+    result[String(key).toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+
+  return result;
+}
+
+export function searchParamsToQuery(searchParams: URLSearchParams | null): Record<string, string> {
+  if (!searchParams || typeof searchParams.entries !== "function") {
+    return {};
+  }
+
+  return Object.fromEntries(searchParams.entries());
+}
+
+export function buildRequestLike({
+  headers,
+  searchParams,
+}: {
+  headers?: Headers | Record<string, string | string[] | undefined> | null;
+  searchParams?: URLSearchParams | null;
+} = {}): RequestLike {
+  return {
+    headers: headersToObject(headers ?? null),
+    query: searchParamsToQuery(searchParams ?? null),
+  };
+}
+
+export function buildCanonicalRequest({
+  pathname,
+  method,
+  headers,
+  searchParams,
+}: {
+  pathname: string;
+  method?: string;
+  headers?: Headers | Record<string, string | string[] | undefined> | null;
+  searchParams?: URLSearchParams | null;
+}): Request {
+  const url = new URL(pathname, `${getPublicBaseUrl()}/`);
+  const query = searchParamsToQuery(searchParams ?? null);
+  for (const [key, value] of Object.entries(query)) {
+    url.searchParams.set(key, value);
+  }
+
+  return new Request(url.toString(), {
+    method: method ?? "GET",
+    headers: new Headers(headersToObject(headers ?? null)),
+  });
+}
diff --git a/apps/share/server/_lib/share-utils.test.ts b/apps/share/server/_lib/share-utils.test.ts
new file mode 100644
index 0000000000..34e5383fd2
--- /dev/null
+++ b/apps/share/server/_lib/share-utils.test.ts
@@ -0,0 +1,97 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildBundlePreviewSelections, buildBundleUrls, buildOgImageUrls } from "./share-utils.ts";
+
+function withEnv(name: string, value: string | undefined, run: () => void) {
+  const previous = process.env[name];
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+
+  try {
+    run();
+  } finally {
+    if (previous === undefined) {
+      delete process.env[name];
+    } else {
+      process.env[name] = previous;
+    }
+  }
+}
+
+test("buildBundlePreviewSelections slugifies shared skill filenames", () => {
+  const selections = buildBundlePreviewSelections({
+    schemaVersion: 1,
+    type: "skill",
+    name: "agent-creator",
+    description: "",
+    trigger: "",
+    content: "# Agent Creator",
+    workspace: null,
+    skills: [],
+    commands: [],
+  });
+
+  assert.equal(selections[0]?.filename, "agent-creator.md");
+  assert.equal(selections[0]?.label, "Skill");
+});
+
+test("buildOgImageUrls returns typed platform variants", () => {
+  const urls = buildOgImageUrls(
+    {
+      headers: {
+        host: "share.openworklabs.com",
+        "x-forwarded-proto": "https",
+      },
+      query: {},
+    },
+    "01TESTPREVIEW",
+  );
+
+  assert.equal(urls.default, "https://share.openworklabs.com/og/01TESTPREVIEW");
+  assert.equal(urls.twitter, "https://share.openworklabs.com/og/01TESTPREVIEW?variant=twitter");
+  assert.equal(urls.byVariant.facebook, "https://share.openworklabs.com/og/01TESTPREVIEW");
+  assert.equal(urls.byVariant.linkedin, "https://share.openworklabs.com/og/01TESTPREVIEW?variant=linkedin");
+  assert.equal(urls.byVariant.slack, "https://share.openworklabs.com/og/01TESTPREVIEW?variant=slack");
+  assert.equal(urls.byVariant.whatsapp, "https://share.openworklabs.com/og/01TESTPREVIEW?variant=whatsapp");
+});
+
+test("buildBundleUrls ignores forwarded hosts and uses the fixed default share origin", () => {
+  withEnv("PUBLIC_BASE_URL", undefined, () => {
+    const urls = buildBundleUrls(
+      {
+        headers: {
+          host: "evil.example",
+          "x-forwarded-host": "evil.example",
+          "x-forwarded-proto": "http",
+        },
+        query: {},
+      },
+      "01ABC",
+    );
+
+    assert.equal(urls.shareUrl, "https://share.openworklabs.com/b/01ABC");
+    assert.equal(urls.jsonUrl, "https://share.openworklabs.com/b/01ABC/data");
+    assert.equal(urls.downloadUrl, "https://share.openworklabs.com/b/01ABC/data?download=1");
+  });
+});
+
+test("buildBundleUrls respects PUBLIC_BASE_URL when explicitly configured", () => {
+  withEnv("PUBLIC_BASE_URL", "https://share.staging.openworklabs.com/", () => {
+    const urls = buildBundleUrls(
+      {
+        headers: {
+          host: "ignored.example",
+          "x-forwarded-host": "ignored.example",
+        },
+        query: {},
+      },
+      "01CFG",
+    );
+
+    assert.equal(urls.shareUrl, "https://share.staging.openworklabs.com/b/01CFG");
+  });
+});
diff --git a/apps/share/server/_lib/share-utils.ts b/apps/share/server/_lib/share-utils.ts
new file mode 100644
index 0000000000..f210118e32
--- /dev/null
+++ b/apps/share/server/_lib/share-utils.ts
@@ -0,0 +1,566 @@
+import { parse as parseYaml } from "yaml";
+
+import type { PreviewItem } from "../../components/share-home-types.ts";
+import type {
+  BundleCounts,
+  BundleUrls,
+  Frontmatter,
+  NormalizedBundle,
+  NormalizedSkillItem,
+  OgImageUrlSet,
+  OpenInAppUrls,
+  RequestLike,
+  ValidationResult,
+} from "./types.ts";
+import {
+  DEFAULT_OG_IMAGE_VARIANT,
+  DEFAULT_TWITTER_IMAGE_VARIANT,
+  OG_IMAGE_VARIANTS,
+  type OgImageVariant,
+} from "./og-image-variants.ts";
+
+export const OPENWORK_SITE_URL = "https://openworklabs.com";
+export const OPENWORK_DOWNLOAD_URL = "https://openworklabs.com/download";
+export const DEFAULT_PUBLIC_BASE_URL = "https://share.openworklabs.com";
+export const SHARE_EASE = "cubic-bezier(0.31, 0.325, 0, 0.92)";
+
+export function maybeString(value: unknown): string {
+  return typeof value === "string" ? value : "";
+}
+
+export function maybeObject(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
+}
+
+export function maybeArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : [];
+}
+
+export function getEnv(name: string, fallback = ""): string {
+  const value = process.env[name];
+  return typeof value === "string" && value.trim() ? value.trim() : fallback;
+}
+
+export function normalizeBaseUrl(input: unknown): string {
+  return String(input ?? "").trim().replace(/\/+$/, "");
+}
+
+export function getPublicBaseUrl(): string {
+  return normalizeBaseUrl(getEnv("PUBLIC_BASE_URL")) || DEFAULT_PUBLIC_BASE_URL;
+}
+
+export function setCors(
+  res: { setHeader(name: string, value: string): void },
+  options: { methods?: string; headers?: string } = {},
+): void {
+  res.setHeader("Access-Control-Allow-Origin", "*");
+  res.setHeader("Access-Control-Allow-Methods", options.methods ?? "GET,POST,OPTIONS");
+  res.setHeader(
+    "Access-Control-Allow-Headers",
+    options.headers ??
+      "Content-Type,Accept,X-OpenWork-Bundle-Type,X-OpenWork-Schema-Version,X-OpenWork-Name",
+  );
+}
+
+export function readBody(req: NodeJS.ReadableStream): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (chunk: Buffer) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}
+
+export function escapeHtml(value: unknown): string {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+export function escapeJsonForScript(rawJson: string): string {
+  return String(rawJson)
+    .replaceAll("<", "\\u003c")
+    .replaceAll(">", "\\u003e")
+    .replaceAll("\u2028", "\\u2028")
+    .replaceAll("\u2029", "\\u2029");
+}
+
+export function humanizeType(type: unknown): string {
+  if (!type) return "Bundle";
+  return String(type)
+    .split("-")
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+export function truncate(value: unknown, maxChars = 3200): string {
+  const text = String(value ?? "");
+  if (text.length <= maxChars) return text;
+  return `${text.slice(0, maxChars)}\n\n... (truncated for display)`;
+}
+
+export function buildRootUrl(_req: RequestLike): string {
+  return getPublicBaseUrl();
+}
+
+export function buildOgImageUrlFromOrigin(
+  origin: string,
+  targetId = "root",
+  variant: OgImageVariant = DEFAULT_OG_IMAGE_VARIANT,
+): string {
+  const url = new URL(`${normalizeBaseUrl(origin) || DEFAULT_PUBLIC_BASE_URL}/og/${encodeURIComponent(targetId)}`);
+  if (variant !== DEFAULT_OG_IMAGE_VARIANT) {
+    url.searchParams.set("variant", variant);
+  }
+  return url.toString();
+}
+
+export function buildOgImageUrl(req: RequestLike, targetId = "root", variant: OgImageVariant = DEFAULT_OG_IMAGE_VARIANT): string {
+  const origin = buildRootUrl(req);
+  return buildOgImageUrlFromOrigin(origin, targetId, variant);
+}
+
+export function buildOgImageUrls(req: RequestLike, targetId = "root"): OgImageUrlSet {
+  const origin = buildRootUrl(req);
+  return {
+    default: buildOgImageUrlFromOrigin(origin, targetId, DEFAULT_OG_IMAGE_VARIANT),
+    twitter: buildOgImageUrlFromOrigin(origin, targetId, DEFAULT_TWITTER_IMAGE_VARIANT),
+    byVariant: Object.fromEntries(
+      Object.keys(OG_IMAGE_VARIANTS).map((variant) => [
+        variant,
+        buildOgImageUrlFromOrigin(origin, targetId, variant as OgImageVariant),
+      ]),
+    ) as Record<OgImageVariant, string>,
+  };
+}
+
+export function buildBundleUrls(req: RequestLike, id: string): BundleUrls {
+  const encodedId = encodeURIComponent(id);
+  const origin = buildRootUrl(req);
+  const path = `/b/${encodedId}`;
+  const dataPath = `${path}/data`;
+
+  return {
+    shareUrl: `${origin}${path}`,
+    jsonUrl: `${origin}${dataPath}`,
+    downloadUrl: `${origin}${dataPath}?download=1`,
+  };
+}
+
+export function buildOpenInAppUrls(shareUrl: string, options: { label?: string } = {}): OpenInAppUrls {
+  const query = new URLSearchParams();
+  query.set("ow_bundle", shareUrl);
+  query.set("ow_intent", "new_worker");
+  query.set("ow_source", "share_service");
+
+  const label = String(options.label ?? "").trim();
+  if (label) query.set("ow_label", label.slice(0, 120));
+
+  const appScheme = (getEnv("PUBLIC_OPENWORK_APP_SCHEME", "openwork") || "openwork").trim().toLowerCase();
+  return {
+    openInAppDeepLink: `${appScheme}://import-bundle?${query.toString()}`,
+  };
+}
+
+export function wantsDownload(req: RequestLike): boolean {
+  return String(req.query?.download ?? "").trim() === "1";
+}
+
+export function parseFrontmatter(content: unknown): Frontmatter {
+  const text = String(content ?? "");
+  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+  if (!match) return { data: {}, body: text };
+  const raw = match[1] ?? "";
+  let data: Record<string, unknown> = {};
+  try {
+    data = maybeObject(parseYaml(raw)) ?? {};
+  } catch {
+    data = {};
+  }
+  return { data, body: text.slice(match[0].length) };
+}
+
+function normalizeSkillItem(value: unknown): NormalizedSkillItem | null {
+  const record = maybeObject(value);
+  if (!record) return null;
+  const name = maybeString(record.name).trim();
+  const content = maybeString(record.content);
+  if (!name || !content.trim()) return null;
+  return {
+    name,
+    description: maybeString(record.description).trim(),
+    trigger: maybeString(record.trigger).trim(),
+    content,
+  };
+}
+
+export function parseBundle(rawJson: string): NormalizedBundle {
+  try {
+    return normalizeBundleRecord(JSON.parse(rawJson));
+  } catch {
+    return normalizeBundleRecord(null);
+  }
+}
+
+function normalizeBundleRecord(parsed: unknown): NormalizedBundle {
+  const record = maybeObject(parsed);
+
+  return {
+    schemaVersion: typeof record?.schemaVersion === "number" ? record.schemaVersion : null,
+    type: maybeString(record?.type).trim(),
+    name: maybeString(record?.name).trim(),
+    description: maybeString(record?.description).trim(),
+    trigger: maybeString(record?.trigger).trim(),
+    content: maybeString(record?.content),
+    skills: maybeArray(record?.skills).map(normalizeSkillItem).filter((s): s is NormalizedSkillItem => s !== null),
+  };
+}
+
+export function validateBundlePayload(rawJson: string): ValidationResult {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch {
+    return { ok: false, message: "Invalid JSON" };
+  }
+
+  const bundle = normalizeBundleRecord(parsed);
+  if (bundle.schemaVersion !== 1) {
+    return { ok: false, message: "Unsupported bundle schema version" };
+  }
+
+  if (!["skill", "skills-set"].includes(bundle.type)) {
+    return { ok: false, message: "Unsupported bundle type" };
+  }
+
+  if (bundle.type === "skill") {
+    if (!bundle.name || !bundle.content.trim()) {
+      return { ok: false, message: "Skill bundles require name and content" };
+    }
+  }
+
+  if (bundle.type === "skills-set") {
+    if (!bundle.skills.length) {
+      return { ok: false, message: "Skills set bundle has no importable skills" };
+    }
+  }
+
+  return { ok: true, bundle };
+}
+
+export function getBundleCounts(bundle: NormalizedBundle): BundleCounts {
+  return {
+    skillCount:
+      bundle.type === "skill"
+        ? bundle.name
+          ? 1
+          : 0
+        : bundle.type === "skills-set"
+          ? bundle.skills.length
+          : 0,
+    commandCount: 0,
+    agentCount: 0,
+    mcpCount: 0,
+    configCount: 0,
+    fileCount: 0,
+    hasConfig: false,
+  };
+}
+
+function readVersionFromContent(content: string): string {
+  const { data } = parseFrontmatter(content);
+  const version = maybeString(data.version).trim();
+  return version || "";
+}
+
+export function collectBundleItems(bundle: NormalizedBundle, limit = 8): PreviewItem[] {
+  const items: PreviewItem[] = [];
+
+  if (bundle.type === "skill") {
+    items.push({
+      name: bundle.name || "Untitled skill",
+      kind: "Skill",
+      meta: bundle.trigger ? `Trigger · ${bundle.trigger}` : readVersionFromContent(bundle.content) || "Skill bundle",
+      tone: "skill",
+    });
+  }
+
+  if (bundle.type === "skills-set") {
+    for (const skill of bundle.skills) {
+      items.push({
+        name: skill.name,
+        kind: "Skill",
+        meta: skill.trigger ? `Trigger · ${skill.trigger}` : readVersionFromContent(skill.content) || "Skill",
+        tone: "skill",
+      });
+    }
+  }
+
+  return items.slice(0, limit);
+}
+
+function slugifyPreviewFilename(value: string, fallback: string, extension: string): string {
+  const stem = String(value ?? "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  return `${stem || fallback}.${extension}`;
+}
+
+function buildTextPreview(content: string, fallback: string): string {
+  const normalized = String(content ?? "").trim();
+  return normalized || fallback;
+}
+
+function buildJsonPreview(value: unknown, fallback: string): string {
+  try {
+    const serialized = JSON.stringify(value, null, 2);
+    return serialized || fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+function buildBundlePreviewSelection(input: {
+  filename: string;
+  text: string;
+  tone: PreviewItem["tone"];
+  label: string;
+}): {
+  filename: string;
+  text: string;
+  tone: PreviewItem["tone"];
+  label: string;
+} {
+  return input;
+}
+
+export function buildBundlePreview(bundle: NormalizedBundle): {
+  filename: string;
+  text: string;
+  tone: PreviewItem["tone"];
+  label: string;
+} {
+  if (bundle.type === "skill") {
+    return buildBundlePreviewSelection({
+      filename: slugifyPreviewFilename(bundle.name || "skill", "skill", "md"),
+      text: buildTextPreview(bundle.content, `# ${bundle.name || "OpenWork skill"}`),
+      tone: "skill",
+      label: bundle.trigger ? `Trigger: ${bundle.trigger}` : "Skill preview",
+    });
+  }
+
+  if (bundle.type === "skills-set" && bundle.skills.length) {
+    const firstSkill = bundle.skills[0]!;
+    return buildBundlePreviewSelection({
+      filename: slugifyPreviewFilename(firstSkill.name || "skill", "skill", "md"),
+      text: buildTextPreview(firstSkill.content, `# ${firstSkill.name || "Shared skill"}`),
+      tone: "skill",
+      label: bundle.skills.length > 1 ? `First of ${bundle.skills.length} skills` : "Skill preview",
+    });
+  }
+
+  return buildBundlePreviewSelection({
+    filename: "bundle.json",
+    text: buildJsonPreview(bundle, '{\n  "bundle": true\n}'),
+    tone: "config",
+    label: "Bundle JSON",
+  });
+}
+
+export function buildBundlePreviewSelections(bundle: NormalizedBundle): {
+  id: string;
+  name: string;
+  filename: string;
+  text: string;
+  tone: PreviewItem["tone"];
+  label: string;
+}[] {
+  if (bundle.type === "skill") {
+    return [
+      {
+        id: "skill-0",
+        name: bundle.name || "Untitled skill",
+        filename: slugifyPreviewFilename(bundle.name || "skill", "skill", "md"),
+        text: buildTextPreview(bundle.content, `# ${bundle.name || "OpenWork skill"}`),
+        tone: "skill",
+        label: bundle.trigger ? `Trigger · ${bundle.trigger}` : "Skill",
+      },
+    ];
+  }
+
+  if (bundle.type === "skills-set" && bundle.skills.length) {
+    return bundle.skills.map((skill, index) => ({
+      id: `skill-${index}`,
+      name: skill.name || `Skill ${index + 1}`,
+      filename: slugifyPreviewFilename(skill.name || `skill-${index + 1}`, "skill", "md"),
+      text: buildTextPreview(skill.content, `# ${skill.name || `Skill ${index + 1}`}`),
+      tone: "skill",
+      label: skill.trigger ? `Trigger · ${skill.trigger}` : "Skill",
+    }));
+  }
+
+  const preview = buildBundlePreview(bundle);
+  return [
+    {
+      id: "preview-0",
+      name: bundle.name || "OpenWork bundle",
+      filename: preview.filename,
+      text: preview.text,
+      tone: preview.tone,
+      label: preview.label,
+    },
+  ];
+}
+
+export function prettyJson(rawJson: string): string {
+  try {
+    return JSON.stringify(JSON.parse(rawJson), null, 2);
+  } catch {
+    return rawJson;
+  }
+}
+
+export function buildBundleNarrative(bundle: NormalizedBundle): string {
+  const counts = getBundleCounts(bundle);
+  if (bundle.type === "skill") {
+    return "One reusable skill, wrapped in a share link that can be added to an existing worker or imported into a new one.";
+  }
+  if (bundle.type === "skills-set") {
+    return `${counts.skillCount} skills packaged together so they can land in an existing worker or start a new worker with the full set in one import.`;
+  }
+
+  const parts: string[] = [];
+  if (counts.skillCount) parts.push(`${counts.skillCount} skill${counts.skillCount === 1 ? "" : "s"}`);
+  if (counts.agentCount) parts.push(`${counts.agentCount} agent${counts.agentCount === 1 ? "" : "s"}`);
+  if (counts.mcpCount) parts.push(`${counts.mcpCount} MCP${counts.mcpCount === 1 ? "" : "s"}`);
+  if (counts.commandCount) parts.push(`${counts.commandCount} command${counts.commandCount === 1 ? "" : "s"}`);
+  if (counts.configCount) parts.push(`${counts.configCount} config${counts.configCount === 1 ? "" : "s"}`);
+  if (counts.fileCount) parts.push(`${counts.fileCount} portable file${counts.fileCount === 1 ? "" : "s"}`);
+  return parts.length
+    ? `${parts.join(", ")} bundled into a worker package that imports through OpenWork with one step.`
+    : "Worker configuration bundle prepared for OpenWork import.";
+}
+
+export function buildStatusMarkup({
+  title,
+  description,
+  actionHref,
+  actionLabel,
+}: {
+  title: string;
+  description: string;
+  actionHref?: string;
+  actionLabel?: string;
+}): string {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(title)} - OpenWork Share</title>
+  <style>
+    @font-face {
+      font-family: "FK Raster Roman Compact Smooth";
+      src: url("https://openworklabs.com/fonts/FKRasterRomanCompact-Smooth.woff2") format("woff2");
+      font-weight: 400;
+      font-style: normal;
+      font-display: swap;
+    }
+    :root {
+      color-scheme: light;
+      --ow-bg: #f6f9fc;
+      --ow-ink: #011627;
+      --ow-card: rgba(255, 255, 255, 0.8);
+      --ow-border: rgba(255, 255, 255, 0.8);
+      --ow-shadow: 0 20px 60px -15px rgba(0, 0, 0, 0.1);
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      font-family: Inter, "Segoe UI", sans-serif;
+      color: var(--ow-ink);
+      background:
+        radial-gradient(circle at top left, rgba(251, 191, 36, 0.34), transparent 36%),
+        radial-gradient(circle at right, rgba(96, 165, 250, 0.28), transparent 30%),
+        radial-gradient(circle at bottom right, rgba(244, 114, 182, 0.14), transparent 28%),
+        linear-gradient(180deg, #fbfdff 0%, var(--ow-bg) 100%);
+    }
+    body::before {
+      content: "";
+      position: fixed;
+      inset: 0;
+      pointer-events: none;
+      background-image:
+        radial-gradient(rgba(1, 22, 39, 0.055) 0.75px, transparent 0.75px),
+        radial-gradient(rgba(1, 22, 39, 0.03) 0.6px, transparent 0.6px);
+      background-position: 0 0, 18px 18px;
+      background-size: 36px 36px;
+      opacity: 0.34;
+      mix-blend-mode: multiply;
+    }
+    .card {
+      position: relative;
+      z-index: 1;
+      width: min(100%, 540px);
+      border-radius: 2rem;
+      padding: 32px;
+      border: 1px solid var(--ow-border);
+      background: var(--ow-card);
+      box-shadow: var(--ow-shadow);
+      backdrop-filter: blur(16px);
+    }
+    h1 {
+      margin: 0 0 12px;
+      font-size: clamp(2rem, 5vw, 2.8rem);
+      line-height: 0.96;
+      letter-spacing: -0.06em;
+    }
+    p {
+      margin: 0;
+      color: #5f6b7a;
+      line-height: 1.6;
+    }
+    a {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      margin-top: 24px;
+      min-height: 48px;
+      padding: 0 20px;
+      border-radius: 999px;
+      text-decoration: none;
+      color: white;
+      background: #011627;
+      transition: transform 300ms ${SHARE_EASE}, background-color 300ms ${SHARE_EASE}, box-shadow 300ms ${SHARE_EASE};
+      box-shadow: 0 14px 32px -16px rgba(1, 22, 39, 0.55);
+      font-weight: 500;
+    }
+    a:hover {
+      background: rgb(110, 110, 110);
+      transform: translateY(-1px);
+      box-shadow:
+        rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+        rgba(0, 0, 0, 0.04) 0px 1px 2px 0px,
+        rgba(0, 0, 0, 0.04) 0px 2px 4px 0px;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <h1>${escapeHtml(title)}</h1>
+    <p>${escapeHtml(description)}</p>
+    ${actionHref && actionLabel ? `<a href="${escapeHtml(actionHref)}">${escapeHtml(actionLabel)}</a>` : ""}
+  </main>
+</body>
+</html>`;
+}
diff --git a/apps/share/server/_lib/types.ts b/apps/share/server/_lib/types.ts
new file mode 100644
index 0000000000..b8188090f7
--- /dev/null
+++ b/apps/share/server/_lib/types.ts
@@ -0,0 +1,140 @@
+import type { ItemTone, PreviewItem } from "../../components/share-home-types.ts";
+import type { OgImageVariant } from "./og-image-variants.ts";
+
+export interface RequestLike {
+  headers: Record<string, string>;
+  query: Record<string, string>;
+}
+
+export interface BundleUrls {
+  shareUrl: string;
+  jsonUrl: string;
+  downloadUrl: string;
+}
+
+export interface OgImageUrlSet {
+  default: string;
+  twitter: string;
+  byVariant: Record<OgImageVariant, string>;
+}
+
+export interface OpenInAppUrls {
+  openInAppDeepLink: string;
+}
+
+export interface NormalizedSkillItem {
+  name: string;
+  description: string;
+  trigger: string;
+  content: string;
+}
+
+export interface NormalizedBundle {
+  schemaVersion: number | null;
+  type: string;
+  name: string;
+  description: string;
+  trigger: string;
+  content: string;
+  skills: NormalizedSkillItem[];
+}
+
+export interface BundleCounts {
+  skillCount: number;
+  commandCount: number;
+  agentCount: number;
+  mcpCount: number;
+  configCount: number;
+  fileCount: number;
+  hasConfig: boolean;
+}
+
+export type ValidationResult =
+  | { ok: true; bundle: NormalizedBundle }
+  | { ok: false; message: string };
+
+export interface Frontmatter {
+  data: Record<string, unknown>;
+  body: string;
+}
+
+export interface RawFileInput {
+  path?: string;
+  webkitRelativePath?: string;
+  name?: string;
+  content?: string;
+}
+
+export interface NormalizedFile {
+  path: string;
+  name: string;
+  content: string;
+}
+
+export interface PackageInput {
+  files?: RawFileInput[];
+  bundleName?: string;
+  preview?: boolean;
+}
+
+export interface PackageSummary {
+  skills: number;
+  agents: number;
+  mcpServers: number;
+  commands: number;
+  configs: number;
+  warnings: number;
+}
+
+export interface PackageResult {
+  bundle: Record<string, unknown>;
+  bundleType: string;
+  name: string;
+  summary: PackageSummary;
+  warnings: string[];
+  items: PreviewItem[];
+}
+
+export interface StoreBundleResult {
+  id: string;
+  pathname: string;
+}
+
+export interface FetchBundleResult {
+  blob: { url: string; contentType: string };
+  rawBuffer: Buffer;
+  rawJson: string;
+}
+
+export interface BundlePageProps {
+  missing: boolean;
+  id?: string;
+  title?: string;
+  description?: string;
+  canonicalUrl: string;
+  shareUrl?: string;
+  jsonUrl?: string;
+  downloadUrl?: string;
+  ogImageUrl: string;
+  twitterImageUrl?: string;
+  ogImageUrls?: OgImageUrlSet;
+  openInAppDeepLink?: string;
+  installHint?: string;
+  bundleType?: string;
+  typeLabel?: string;
+  schemaVersion?: string;
+  items?: PreviewItem[];
+  previewFilename?: string;
+  previewText?: string;
+  previewLabel?: string;
+  previewTone?: ItemTone;
+  previewSelections?: {
+    id: string;
+    name: string;
+    filename: string;
+    text: string;
+    label: string;
+    tone: ItemTone;
+  }[];
+  metadataRows?: { label: string; value: string }[];
+}
diff --git a/apps/share/server/b/get-bundle-page-props.ts b/apps/share/server/b/get-bundle-page-props.ts
new file mode 100644
index 0000000000..1fdced2e67
--- /dev/null
+++ b/apps/share/server/b/get-bundle-page-props.ts
@@ -0,0 +1,102 @@
+import {
+  buildBundleNarrative,
+  buildBundlePreview,
+  buildBundlePreviewSelections,
+  buildBundleUrls,
+  buildOgImageUrl,
+  buildOgImageUrls,
+  buildOpenInAppUrls,
+  collectBundleItems,
+  getBundleCounts,
+  humanizeType,
+  parseBundle
+} from "../_lib/share-utils.ts";
+import { fetchBundleJsonById } from "../_lib/blob-store.ts";
+import type { BundlePageProps, RequestLike } from "../_lib/types.ts";
+
+function buildMetadataRows(
+  id: string,
+  bundle: ReturnType<typeof parseBundle>,
+  counts: ReturnType<typeof getBundleCounts>,
+  schemaVersion: string,
+): { label: string; value: string }[] {
+  return [
+    { label: "ID", value: id },
+    { label: "Type", value: bundle.type || "unknown" },
+    { label: "Schema", value: schemaVersion },
+    ...(counts.skillCount ? [{ label: "Skills", value: String(counts.skillCount) }] : []),
+    ...(counts.agentCount ? [{ label: "Agents", value: String(counts.agentCount) }] : []),
+    ...(counts.mcpCount ? [{ label: "MCPs", value: String(counts.mcpCount) }] : []),
+    ...(counts.commandCount ? [{ label: "Commands", value: String(counts.commandCount) }] : []),
+    ...(counts.configCount ? [{ label: "Configs", value: String(counts.configCount) }] : []),
+    ...(counts.fileCount ? [{ label: "Files", value: String(counts.fileCount) }] : [])
+  ];
+}
+
+export function buildMissingBundlePageProps(requestLike: RequestLike, id = "missing"): BundlePageProps {
+  return {
+    missing: true,
+    canonicalUrl: buildBundleUrls(requestLike, id).shareUrl,
+    ogImageUrl: buildOgImageUrl(requestLike, id),
+    twitterImageUrl: buildOgImageUrl(requestLike, id, "twitter"),
+    ogImageUrls: buildOgImageUrls(requestLike, id),
+  };
+}
+
+export async function getBundlePageProps({ id, requestLike }: { id: string; requestLike: RequestLike }): Promise<BundlePageProps> {
+  const normalizedId = String(id ?? "").trim();
+  if (!normalizedId) {
+    return buildMissingBundlePageProps(requestLike);
+  }
+
+  try {
+    const { rawJson } = await fetchBundleJsonById(normalizedId);
+    const bundle = parseBundle(rawJson);
+    const urls = buildBundleUrls(requestLike, normalizedId);
+    const ogImageUrls = buildOgImageUrls(requestLike, normalizedId);
+    const ogImageUrl = ogImageUrls.default;
+    const { openInAppDeepLink } = buildOpenInAppUrls(urls.shareUrl, {
+      label: bundle.name || "Shared worker package"
+    });
+    const counts = getBundleCounts(bundle);
+    const schemaVersion = bundle.schemaVersion == null ? "unknown" : String(bundle.schemaVersion);
+    const typeLabel = humanizeType(bundle.type);
+    const preview = buildBundlePreview(bundle);
+    const title = bundle.name || `OpenWork ${typeLabel}`;
+    const description = bundle.description || buildBundleNarrative(bundle);
+    const installHint =
+      bundle.type === "skill"
+        ? "Open in app to choose where to add this skill."
+        : bundle.type === "skills-set"
+          ? "Open in app to add this full skills set to an existing worker or create a new worker with it attached."
+          : "Open in app to create a new worker with these skills, commands, config, and portable .opencode files already bundled.";
+
+    return {
+      missing: false,
+      id: normalizedId,
+      title,
+      description,
+      canonicalUrl: urls.shareUrl,
+      shareUrl: urls.shareUrl,
+      jsonUrl: urls.jsonUrl,
+      downloadUrl: urls.downloadUrl,
+      ogImageUrl,
+      twitterImageUrl: ogImageUrls.twitter,
+      ogImageUrls,
+      openInAppDeepLink,
+      installHint,
+      bundleType: bundle.type || "unknown",
+      typeLabel,
+      schemaVersion,
+      items: collectBundleItems(bundle, 8),
+      previewFilename: preview.filename,
+      previewText: preview.text,
+      previewLabel: preview.label,
+      previewTone: preview.tone,
+      previewSelections: buildBundlePreviewSelections(bundle),
+      metadataRows: buildMetadataRows(normalizedId, bundle, counts, schemaVersion)
+    };
+  } catch {
+    return buildMissingBundlePageProps(requestLike, normalizedId);
+  }
+}
diff --git a/apps/share/server/b/render-bundle-page.test.ts b/apps/share/server/b/render-bundle-page.test.ts
new file mode 100644
index 0000000000..77f9388540
--- /dev/null
+++ b/apps/share/server/b/render-bundle-page.test.ts
@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildBundleUrls, renderBundlePage, wantsDownload } from "./render-bundle-page.ts";
+import type { RequestLike } from "../_lib/types.ts";
+
+function makeReq({ accept = "", query = {}, host = "share.openworklabs.com" }: { accept?: string; query?: Record<string, string>; host?: string } = {}): RequestLike {
+  return {
+    query,
+    headers: {
+      accept,
+      host,
+      "x-forwarded-proto": "https",
+      "x-forwarded-host": host,
+    },
+  };
+}
+
+test("wantsDownload only enables on download=1", () => {
+  assert.equal(wantsDownload(makeReq({ query: { download: "1" } })), true);
+  assert.equal(wantsDownload(makeReq({ query: { download: "0" } })), false);
+  assert.equal(wantsDownload(makeReq()), false);
+});
+
+test("buildBundleUrls uses the fixed share origin", () => {
+  const urls = buildBundleUrls(makeReq({ host: "example.test" }), "01ABC");
+  assert.equal(urls.shareUrl, "https://share.openworklabs.com/b/01ABC");
+  assert.equal(urls.jsonUrl, "https://share.openworklabs.com/b/01ABC/data");
+  assert.equal(urls.downloadUrl, "https://share.openworklabs.com/b/01ABC/data?download=1");
+});
+
+test("renderBundlePage includes machine-readable metadata and escaped json script", () => {
+  const rawJson = JSON.stringify({
+    schemaVersion: 1,
+    type: "skill",
+    name: "demo </script> skill",
+    description: "Install me",
+    trigger: "daily",
+    content: "# Skill\nHello",
+  });
+
+  const html = renderBundlePage({
+    id: "01TEST",
+    rawJson,
+    req: makeReq({ accept: "text/html", host: "share.openworklabs.com" }),
+  });
+
+  assert.match(html, /data-openwork-share="true"/);
+  assert.match(html, /data-openwork-bundle-type="skill"/);
+  assert.match(html, /meta name="openwork:bundle-id" content="01TEST"/);
+  assert.match(html, /\/b\/01TEST\/data/);
+  assert.match(html, /openwork:\/\/import-bundle\?/);
+  assert.match(html, /ow_bundle=https%3A%2F%2Fshare\.openworklabs\.com%2Fb%2F01TEST/);
+  assert.match(html, /ow_intent=new_worker/);
+  assert.match(html, /ow_source=share_service/);
+  assert.match(html, /id="openwork-bundle-json" type="application\/json"/);
+  assert.match(html, /demo \\u003c\/script\\u003e skill/);
+  assert.doesNotMatch(html, /Open in app to choose where to add this skill\./);
+  assert.doesNotMatch(html, /Bundle details/);
+  assert.doesNotMatch(html, /Raw endpoints/);
+  assert.match(html, /skill\.md/);
+  assert.match(html, /Open in OpenWork app/);
+  assert.match(html, /Open in an OpenWork den/);
+  assert.doesNotMatch(html, /Open in web app/);
+  assert.doesNotMatch(html, /Copy share link/);
+});
diff --git a/apps/share/server/b/render-bundle-page.ts b/apps/share/server/b/render-bundle-page.ts
new file mode 100644
index 0000000000..1522d1f148
--- /dev/null
+++ b/apps/share/server/b/render-bundle-page.ts
@@ -0,0 +1,473 @@
+import {
+  OPENWORK_DOWNLOAD_URL,
+  SHARE_EASE,
+  buildBundleNarrative,
+  buildBundleUrls,
+  buildOgImageUrls,
+  buildOpenInAppUrls,
+  collectBundleItems,
+  escapeHtml,
+  escapeJsonForScript,
+  humanizeType,
+  parseBundle,
+  wantsDownload,
+} from "../_lib/share-utils.ts";
+import type { RequestLike } from "../_lib/types.ts";
+
+export { buildBundleUrls, wantsDownload } from "../_lib/share-utils.ts";
+
+export function renderBundlePage({ id, rawJson, req }: { id: string; rawJson: string; req: RequestLike }): string {
+  const bundle = parseBundle(rawJson);
+  const urls = buildBundleUrls(req, id);
+  const ogImageUrls = buildOgImageUrls(req, id);
+  const ogImageUrl = ogImageUrls.default;
+  const { openInAppDeepLink } = buildOpenInAppUrls(urls.shareUrl, {
+    label: bundle.name || "Shared worker package",
+  });
+
+  const schemaVersion = bundle.schemaVersion == null ? "unknown" : String(bundle.schemaVersion);
+  const typeLabel = humanizeType(bundle.type);
+  const title = bundle.name || `OpenWork ${typeLabel}`;
+  const description = bundle.description || buildBundleNarrative(bundle);
+  const items = collectBundleItems(bundle, 8);
+  const compactItem = bundle.type === "skill" ? "skill.md" : items[0]?.name || "OpenWork bundle";
+
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(title)} - OpenWork Share</title>
+  <meta name="description" content="${escapeHtml(description)}" />
+  <meta name="openwork:bundle-id" content="${escapeHtml(id)}" />
+  <meta name="openwork:bundle-type" content="${escapeHtml(bundle.type || "unknown")}" />
+  <meta name="openwork:schema-version" content="${escapeHtml(schemaVersion)}" />
+  <meta name="openwork:open-in-app-url" content="${escapeHtml(openInAppDeepLink)}" />
+  <link rel="canonical" href="${escapeHtml(urls.shareUrl)}" />
+  <link rel="alternate" type="application/json" href="${escapeHtml(urls.jsonUrl)}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="${escapeHtml(title)}" />
+  <meta property="og:description" content="${escapeHtml(description)}" />
+  <meta property="og:url" content="${escapeHtml(urls.shareUrl)}" />
+  <meta property="og:image" content="${escapeHtml(ogImageUrl)}" />
+  <meta property="og:image" content="${escapeHtml(ogImageUrls.byVariant.linkedin)}" />
+  <meta property="og:image" content="${escapeHtml(ogImageUrls.byVariant.slack)}" />
+  <meta property="og:image" content="${escapeHtml(ogImageUrls.byVariant.whatsapp)}" />
+  <meta name="twitter:card" content="summary_large_image" />
+  <meta name="twitter:title" content="${escapeHtml(title)}" />
+  <meta name="twitter:description" content="${escapeHtml(description)}" />
+  <meta name="twitter:image" content="${escapeHtml(ogImageUrls.twitter)}" />
+  <style>
+    @font-face {
+      font-family: "FK Raster Roman Compact Smooth";
+      src: url("https://openworklabs.com/fonts/FKRasterRomanCompact-Smooth.woff2") format("woff2");
+      font-weight: 400;
+      font-style: normal;
+      font-display: swap;
+    }
+    :root {
+      color-scheme: light;
+      --ow-bg: #f6f9fc;
+      --ow-ink: #011627;
+      --ow-muted: #5f6b7a;
+      --ow-card: #ffffff;
+      --ow-border: rgba(148, 163, 184, 0.16);
+      --ow-shadow: 0 20px 60px -24px rgba(15, 23, 42, 0.18);
+      --ow-primary: #011627;
+      --ow-ease: ${SHARE_EASE};
+      --ow-sans: Inter, "Segoe UI", "Helvetica Neue", sans-serif;
+      --ow-accent: "FK Raster Roman Compact Smooth", "Iowan Old Style", "Palatino Linotype", "Book Antiqua", Georgia, serif;
+    }
+
+    * { box-sizing: border-box; }
+    [hidden] { display: none !important; }
+    html, body { min-height: 100%; }
+    body {
+      margin: 0;
+      font-family: var(--ow-sans);
+      color: var(--ow-ink);
+      background-color: var(--ow-bg);
+      overflow-x: hidden;
+      -webkit-font-smoothing: antialiased;
+      -moz-osx-font-smoothing: grayscale;
+    }
+
+    body::after {
+      content: "";
+      position: absolute;
+      top: 0;
+      right: 0;
+      width: 60vw;
+      height: 80vh;
+      background: radial-gradient(circle at 70% 30%, rgba(100, 116, 139, 0.25) 0%, transparent 60%);
+      filter: blur(60px);
+      z-index: 0;
+      pointer-events: none;
+    }
+
+    a { color: inherit; }
+
+    .shell {
+      position: relative;
+      z-index: 10;
+      width: min(100%, 1024px);
+      margin: 0 auto;
+      padding: 8px 32px 64px;
+    }
+
+    .nav {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      height: 80px;
+      margin-bottom: 40px;
+    }
+
+    .brand {
+      display: inline-flex;
+      align-items: center;
+      gap: 12px;
+      text-decoration: none;
+      font-weight: 600;
+      font-size: 20px;
+      letter-spacing: -0.02em;
+      color: var(--ow-ink);
+    }
+
+    .brand-mark {
+      width: 24px;
+      height: 24px;
+      background: url('data:image/svg+xml;utf8,<svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 2L2 7l10 5 10-5-10-5zM2 17l10 5 10-5M2 12l10 5 10-5" stroke="%23011627" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>') no-repeat center center;
+    }
+
+    .nav-links { display: none; }
+    @media (min-width: 768px) {
+      .nav-links {
+        display: flex;
+        gap: 32px;
+        font-size: 15px;
+        color: var(--ow-muted);
+        font-weight: 500;
+      }
+      .nav-links a { text-decoration: none; transition: color 0.2s; }
+      .nav-links a:hover { color: var(--ow-ink); }
+    }
+
+    .nav-actions { display: flex; align-items: center; gap: 12px; }
+
+    .button-primary {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 48px;
+      padding: 0 24px;
+      border-radius: 999px;
+      border: none;
+      cursor: pointer;
+      text-decoration: none;
+      color: #fff;
+      background: var(--ow-primary);
+      box-shadow: 0 14px 32px -16px rgba(1, 22, 39, 0.55);
+      font-family: inherit;
+      font-weight: 500;
+      font-size: 16px;
+      transition: all 300ms var(--ow-ease);
+      will-change: transform, background-color, box-shadow;
+    }
+
+    .button-primary:hover {
+      background: rgb(110, 110, 110);
+      transform: translateY(-1px);
+      box-shadow:
+        rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+        rgba(0, 0, 0, 0.04) 0px 1px 2px 0px,
+        rgba(0, 0, 0, 0.04) 0px 2px 4px 0px;
+    }
+
+    .button-secondary {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 48px;
+      padding: 0 24px;
+      border-radius: 999px;
+      text-decoration: none;
+      background: rgb(255, 255, 255);
+      color: rgb(0, 0, 0);
+      border: none;
+      box-shadow:
+        rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+        rgba(0, 0, 0, 0.04) 0px 1px 2px 0px;
+      font-family: inherit;
+      font-weight: 500;
+      font-size: 16px;
+      transition: all 300ms var(--ow-ease);
+      cursor: pointer;
+      will-change: transform, background-color, box-shadow;
+    }
+
+    .button-secondary:hover {
+      background: rgb(242, 242, 242);
+      box-shadow:
+        rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+        rgba(0, 0, 0, 0.04) 0px 1px 2px 0px,
+        rgba(0, 0, 0, 0.04) 0px 2px 4px 0px;
+    }
+
+    .hero-layout {
+      display: flex;
+      flex-direction: column;
+      gap: 64px;
+    }
+    @media (min-width: 1024px) {
+      .hero-layout { flex-direction: row; align-items: flex-start; }
+    }
+
+    .hero-copy {
+      flex: 1.1;
+      max-width: 600px;
+    }
+
+    h1 {
+      margin: 0 0 24px 0;
+      font-size: clamp(3rem, 5.5vw, 4.5rem);
+      line-height: 1.1;
+      letter-spacing: -0.04em;
+      font-weight: 500;
+      color: var(--ow-ink);
+    }
+
+    h1 em {
+      font-style: normal;
+      font-family: var(--ow-accent);
+      font-weight: 400;
+      font-size: 1.05em;
+      display: inline-block;
+      vertical-align: baseline;
+    }
+
+    .hero-body {
+      margin: 0 0 32px 0;
+      font-size: 20px;
+      line-height: 1.6;
+      color: #374151;
+      max-width: 500px;
+    }
+
+    .hero-actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 16px;
+      align-items: center;
+    }
+
+    .hero-artifact {
+      flex: 0.9;
+      width: 100%;
+    }
+
+    .app-window {
+      background: rgba(255, 255, 255, 0.95);
+      border: 1px solid rgba(255, 255, 255, 0.6);
+      border-radius: 1.5rem;
+      box-shadow: 0 20px 50px -24px rgba(15, 23, 42, 0.12);
+      overflow: hidden;
+      display: flex;
+      flex-direction: column;
+      width: 100%;
+    }
+
+    .app-window-header {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 12px 16px;
+      background: linear-gradient(to bottom, rgba(255,255,255,0.9), rgba(255,255,255,0.6));
+      border-bottom: 1px solid rgba(255,255,255,0.5);
+      position: relative;
+    }
+
+    .mac-dots {
+      position: absolute;
+      left: 16px;
+      display: flex;
+      gap: 6px;
+    }
+    .mac-dot { width: 12px; height: 12px; border-radius: 50%; }
+    .mac-dot.red { background: #ff5f56; border: 1px solid rgba(224, 68, 62, 0.2); }
+    .mac-dot.yellow { background: #ffbd2e; border: 1px solid rgba(222, 161, 35, 0.2); }
+    .mac-dot.green { background: #27c93f; border: 1px solid rgba(26, 171, 41, 0.2); }
+
+    .app-window-title {
+      font-size: 12px;
+      font-weight: 500;
+      color: var(--ow-muted);
+      letter-spacing: 0.02em;
+    }
+
+    .app-window-body {
+      padding: 24px;
+      background: #ffffff;
+    }
+
+    .included-section {
+      width: 100%;
+    }
+    .included-section h4 {
+      margin: 0 0 12px 0;
+      font-size: 12px;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.05em;
+      color: var(--ow-muted);
+    }
+    .included-list {
+      display: flex;
+      flex-direction: column;
+      gap: 8px;
+    }
+    .included-item {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding: 12px 16px;
+      background: #f8fafc;
+      border: 1px solid rgba(148, 163, 184, 0.15);
+      border-radius: 12px;
+    }
+    .item-left { display: flex; align-items: center; gap: 12px; }
+    .item-dot { width: 24px; height: 24px; border-radius: 50%; }
+    .dot-agent { background: #f97316; }
+    .dot-skill { background: #2463eb; }
+    .dot-mcp { background: #0f9f7f; }
+    .dot-command { background: #8b5cf6; }
+    .dot-config { background: #475569; }
+
+    .item-title { font-size: 14px; font-weight: 500; color: var(--ow-ink); }
+    .item-meta { font-size: 12px; color: var(--ow-muted); }
+
+    .results-grid {
+      display: grid;
+      grid-template-columns: 1fr;
+      gap: 24px;
+      margin-top: 64px;
+    }
+    @media (min-width: 768px) {
+      .results-grid { grid-template-columns: 1fr 1fr; }
+    }
+
+    .result-card {
+      background: #ffffff;
+      border: 1px solid var(--ow-border);
+      border-radius: 1.5rem;
+      padding: 32px;
+      box-shadow: var(--ow-shadow);
+    }
+    .result-card h3 { margin: 0 0 8px 0; font-size: 20px; font-weight: 500; }
+    .result-card p { margin: 0 0 24px 0; font-size: 15px; color: var(--ow-muted); line-height: 1.6; }
+
+    .url-box {
+      background: #f8fafc;
+      border: 1px solid rgba(148, 163, 184, 0.2);
+      border-radius: 12px;
+      padding: 16px;
+      font-family: ui-monospace, monospace;
+      font-size: 13px;
+      color: var(--ow-ink);
+      word-break: break-all;
+      margin-bottom: 16px;
+    }
+
+    .metadata-list {
+      padding: 0;
+      margin: 0;
+      display: flex;
+      flex-direction: column;
+      gap: 12px;
+    }
+    .metadata-row {
+      display: flex;
+      justify-content: space-between;
+      align-items: baseline;
+      gap: 12px;
+      font-size: 13px;
+    }
+    .metadata-list dt { color: var(--ow-muted); }
+    .metadata-list dd { margin: 0; color: var(--ow-ink); font-weight: 500; }
+  </style>
+</head>
+<body
+  data-openwork-share="true"
+  data-openwork-bundle-id="${escapeHtml(id)}"
+  data-openwork-bundle-type="${escapeHtml(bundle.type || "unknown")}"
+  data-openwork-schema-version="${escapeHtml(schemaVersion)}"
+>
+  <main class="shell">
+    <nav class="nav">
+      <a class="brand" href="/" aria-label="OpenWork Share home">
+        <span class="brand-mark" aria-hidden="true"></span>
+        <span>openwork</span>
+      </a>
+      <div class="nav-links">
+        <a href="https://openworklabs.com/docs" target="_blank" rel="noreferrer">Docs</a>
+        <a href="${escapeHtml(OPENWORK_DOWNLOAD_URL)}" target="_blank" rel="noreferrer">Download</a>
+        <a href="https://openworklabs.com/enterprise" target="_blank" rel="noreferrer">Enterprise</a>
+      </div>
+      <div class="nav-actions">
+        <a class="button-secondary" href="https://github.com/different-ai/openwork" target="_blank" rel="noreferrer">
+          <svg width="20" height="20" viewBox="0 0 24 24" fill="currentColor"><path d="M12 2C6.477 2 2 6.484 2 12.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0112 6.844c.85.004 1.705.115 2.504.337 1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.202 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.943.359.309.678.92.678 1.855 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.019 10.019 0 0022 12.017C22 6.484 17.522 2 12 2z"/></svg>
+          GitHub
+        </a>
+      </div>
+    </nav>
+
+    <section class="hero-layout">
+      <div class="hero-copy">
+        <h1>${escapeHtml(title)} <em>ready</em></h1>
+        <p class="hero-body">${escapeHtml(description)}</p>
+        <div class="hero-actions">
+          <a class="button-primary" href="${escapeHtml(openInAppDeepLink)}">Open in OpenWork app</a>
+          <a class="button-secondary" href="https://openworklabs.com/den" target="_blank" rel="noreferrer">Open in an OpenWork den</a>
+        </div>
+      </div>
+
+      <div class="hero-artifact">
+        <div class="app-window">
+          <div class="app-window-header">
+            <div class="mac-dots">
+              <div class="mac-dot red"></div>
+              <div class="mac-dot yellow"></div>
+              <div class="mac-dot green"></div>
+            </div>
+            <div class="app-window-title">OpenWork</div>
+          </div>
+          <div class="app-window-body">
+            <div class="included-section">
+              <h4>Skills:</h4>
+              <div class="included-list">
+                <div class="included-item"><div class="item-left"><div class="item-dot dot-skill"></div><span class="item-title">${escapeHtml(compactItem)}</span></div></div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </section>
+
+    <section class="results-grid">
+      <div class="result-card">
+        <div class="step-list">
+          <div class="step-row"><span class="step-bullet">01</span><span>Open the bundle in OpenWork</span></div>
+          <div class="step-row"><span class="step-bullet">02</span><span>Choose the destination worker</span></div>
+          <div class="step-row"><span class="step-bullet">03</span><span>Happy OpenWorking!</span></div>
+        </div>
+      </div>
+    </section>
+
+  </main>
+
+  <script id="openwork-bundle-json" type="application/json">${escapeJsonForScript(rawJson)}</script>
+  <script>
+  </script>
+</body>
+</html>`;
+}
diff --git a/apps/share/server/health.ts b/apps/share/server/health.ts
new file mode 100644
index 0000000000..332c408581
--- /dev/null
+++ b/apps/share/server/health.ts
@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+export default function handler(_req: IncomingMessage, res: ServerResponse): void {
+  res.setHeader("Content-Type", "application/json");
+  res.statusCode = 200;
+  res.end(JSON.stringify({ ok: true }));
+}
diff --git a/apps/share/server/og/[id].ts b/apps/share/server/og/[id].ts
new file mode 100644
index 0000000000..f6c3b2a647
--- /dev/null
+++ b/apps/share/server/og/[id].ts
@@ -0,0 +1,46 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import { fetchBundleJsonById } from "../_lib/blob-store.ts";
+import { parseOgImageVariant } from "../_lib/og-image-variants.ts";
+import { renderBundleOgImage, renderRootOgImage } from "../_lib/render-og-image.ts";
+import { setCors } from "../_lib/share-utils.ts";
+
+interface LegacyApiRequest extends IncomingMessage {
+  method?: string;
+  query?: Record<string, string | string[] | undefined>;
+}
+
+interface LegacyApiResponse extends ServerResponse {
+  status(code: number): LegacyApiResponse;
+  json(body: unknown): void;
+  send(body: string): void;
+}
+
+export default async function handler(req: LegacyApiRequest, res: LegacyApiResponse): Promise<void> {
+  setCors(res, { methods: "GET,OPTIONS", headers: "Content-Type,Accept" });
+  if (req.method === "OPTIONS") {
+    res.status(204).end();
+    return;
+  }
+  if (req.method !== "GET") {
+    res.status(405).json({ message: "Method not allowed" });
+    return;
+  }
+
+  const id = String(req.query?.id ?? "root").trim() || "root";
+  const variant = parseOgImageVariant(req.query?.variant);
+  res.setHeader("Content-Type", "image/svg+xml; charset=utf-8");
+  res.setHeader("Cache-Control", id === "root" ? "public, max-age=3600" : "public, max-age=3600, stale-while-revalidate=86400");
+
+  if (id === "root") {
+    res.status(200).send(renderRootOgImage(variant));
+    return;
+  }
+
+  try {
+    const { rawJson } = await fetchBundleJsonById(id);
+    res.status(200).send(renderBundleOgImage({ id, rawJson, variant }));
+  } catch {
+    res.status(404).send(renderRootOgImage(variant));
+  }
+}
diff --git a/apps/share/server/v1/bundles.ts b/apps/share/server/v1/bundles.ts
new file mode 100644
index 0000000000..7dd9c0d9ff
--- /dev/null
+++ b/apps/share/server/v1/bundles.ts
@@ -0,0 +1,113 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import { storeBundleJson } from "../_lib/blob-store.ts";
+import { buildCanonicalRequest, buildRequestLike } from "../_lib/request-like.ts";
+import { buildCorsHeaders, rateLimitPublishRequest, validateTrustedOrigin, verifyShareBotProtection } from "../_lib/publish-security.ts";
+import { buildBundleUrls, getEnv, readBody, validateBundlePayload } from "../_lib/share-utils.ts";
+
+interface LegacyApiRequest extends IncomingMessage {
+  method?: string;
+  headers: Record<string, string | string[] | undefined>;
+}
+
+interface LegacyApiResponse extends ServerResponse {
+  status(code: number): LegacyApiResponse;
+  json(body: unknown): void;
+}
+
+function formatPublishError(error: unknown): string {
+  const message = error instanceof Error ? error.message : "Blob put failed";
+  if (message.includes("BLOB_READ_WRITE_TOKEN") || message.includes("No token found")) {
+    return "Publishing requires BLOB_READ_WRITE_TOKEN in the server environment.";
+  }
+  return message;
+}
+
+function applyHeaders(res: LegacyApiResponse, headers: Record<string, string>): void {
+  for (const [name, value] of Object.entries(headers)) {
+    res.setHeader(name, value);
+  }
+}
+
+function json(res: LegacyApiResponse, body: unknown, status = 200, headers: Record<string, string> = {}): void {
+  applyHeaders(res, {
+    ...headers,
+    "Content-Type": "application/json",
+  });
+  res.status(status).end(JSON.stringify(body));
+}
+
+export default async function handler(req: LegacyApiRequest, res: LegacyApiResponse): Promise<void> {
+  const request = buildCanonicalRequest({
+    pathname: "/v1/bundles",
+    method: req.method,
+    headers: req.headers,
+  });
+
+  applyHeaders(res, buildCorsHeaders(request));
+  if (req.method === "OPTIONS") {
+    res.status(204).end();
+    return;
+  }
+
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    json(res, { message: originCheck.message }, originCheck.status);
+    return;
+  }
+
+  const rateLimit = rateLimitPublishRequest(request);
+  if (!rateLimit.ok) {
+    json(
+      res,
+      { message: "Publishing is temporarily rate limited." },
+      429,
+      { "X-Retry-After": String(rateLimit.retryAfterSeconds) },
+    );
+    return;
+  }
+
+  const botProtection = await verifyShareBotProtection(request);
+  if (!botProtection.ok) {
+    json(res, { message: botProtection.message }, botProtection.status);
+    return;
+  }
+
+  if (req.method !== "POST") {
+    json(res, { message: "Method not allowed" }, 405);
+    return;
+  }
+
+  const maxBytes = Number.parseInt(getEnv("MAX_BYTES", "5242880"), 10);
+
+  const contentType = String(req.headers["content-type"] ?? "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    json(res, { message: "Expected application/json" }, 415);
+    return;
+  }
+
+  const raw = await readBody(req);
+  if (!raw || raw.length === 0) {
+    json(res, { message: "Body is required" }, 400);
+    return;
+  }
+  if (raw.length > maxBytes) {
+    json(res, { message: "Bundle exceeds upload limit", maxBytes }, 413);
+    return;
+  }
+
+  const rawJson = raw.toString("utf8");
+  const validation = validateBundlePayload(rawJson);
+  if (!validation.ok) {
+    json(res, { message: validation.message }, 422);
+    return;
+  }
+
+  try {
+    const { id } = await storeBundleJson(rawJson);
+    const urls = buildBundleUrls(buildRequestLike({ headers: request.headers }), id);
+    json(res, { url: urls.shareUrl });
+  } catch (e) {
+    json(res, { message: formatPublishError(e) }, 500);
+  }
+}
diff --git a/apps/share/server/v1/package.ts b/apps/share/server/v1/package.ts
new file mode 100644
index 0000000000..c9bb88debd
--- /dev/null
+++ b/apps/share/server/v1/package.ts
@@ -0,0 +1,124 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import { storeBundleJson } from "../_lib/blob-store.ts";
+import { packageOpenworkFiles } from "../_lib/package-openwork-files.ts";
+import { buildCanonicalRequest, buildRequestLike } from "../_lib/request-like.ts";
+import { buildCorsHeaders, rateLimitPublishRequest, validateTrustedOrigin, verifyShareBotProtection } from "../_lib/publish-security.ts";
+import { buildBundleUrls, getEnv, readBody } from "../_lib/share-utils.ts";
+
+interface LegacyApiRequest extends IncomingMessage {
+  method?: string;
+  headers: Record<string, string | string[] | undefined>;
+}
+
+interface LegacyApiResponse extends ServerResponse {
+  status(code: number): LegacyApiResponse;
+  json(body: unknown): void;
+}
+
+function formatPublishError(error: unknown): string {
+  const message = error instanceof Error ? error.message : "Failed to package files";
+  if (message.includes("BLOB_READ_WRITE_TOKEN") || message.includes("No token found")) {
+    return "Publishing requires BLOB_READ_WRITE_TOKEN in the server environment.";
+  }
+  return message;
+}
+
+function applyHeaders(res: LegacyApiResponse, headers: Record<string, string>): void {
+  for (const [name, value] of Object.entries(headers)) {
+    res.setHeader(name, value);
+  }
+}
+
+function json(res: LegacyApiResponse, body: unknown, status = 200, headers: Record<string, string> = {}): void {
+  applyHeaders(res, {
+    ...headers,
+    "Content-Type": "application/json",
+  });
+  res.status(status).end(JSON.stringify(body));
+}
+
+export default async function handler(req: LegacyApiRequest, res: LegacyApiResponse): Promise<void> {
+  const request = buildCanonicalRequest({
+    pathname: "/v1/package",
+    method: req.method,
+    headers: req.headers,
+  });
+
+  applyHeaders(res, buildCorsHeaders(request));
+  if (req.method === "OPTIONS") {
+    res.status(204).end();
+    return;
+  }
+
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    json(res, { message: originCheck.message }, originCheck.status);
+    return;
+  }
+
+  const rateLimit = rateLimitPublishRequest(request);
+  if (!rateLimit.ok) {
+    json(
+      res,
+      { message: "Publishing is temporarily rate limited." },
+      429,
+      { "X-Retry-After": String(rateLimit.retryAfterSeconds) },
+    );
+    return;
+  }
+
+  const botProtection = await verifyShareBotProtection(request);
+  if (!botProtection.ok) {
+    json(res, { message: botProtection.message }, botProtection.status);
+    return;
+  }
+
+  if (req.method !== "POST") {
+    json(res, { message: "Method not allowed" }, 405);
+    return;
+  }
+
+  const maxBytes = Number.parseInt(getEnv("MAX_BYTES", "5242880"), 10);
+  const contentType = String(req.headers["content-type"] ?? "").toLowerCase();
+  if (!contentType.includes("application/json")) {
+    json(res, { message: "Expected application/json" }, 415);
+    return;
+  }
+
+  const raw = await readBody(req);
+  if (!raw || raw.length === 0) {
+    json(res, { message: "Body is required" }, 400);
+    return;
+  }
+  if (raw.length > maxBytes) {
+    json(res, { message: "Package request exceeds upload limit", maxBytes }, 413);
+    return;
+  }
+
+  let body: { preview?: boolean; [key: string]: unknown };
+  try {
+    body = JSON.parse(raw.toString("utf8"));
+  } catch {
+    json(res, { message: "Invalid JSON" }, 422);
+    return;
+  }
+
+  try {
+    const packaged = packageOpenworkFiles(body);
+    if (body?.preview) {
+      json(res, packaged);
+      return;
+    }
+
+    const { id } = await storeBundleJson(JSON.stringify(packaged.bundle));
+    const urls = buildBundleUrls(buildRequestLike({ headers: request.headers }), id);
+    json(res, {
+      ...packaged,
+      url: urls.shareUrl,
+      id,
+    });
+  } catch (error) {
+    json(res, { message: formatPublishError(error) }, 422);
+  }
+}
diff --git a/apps/share/styles/globals.css b/apps/share/styles/globals.css
new file mode 100644
index 0000000000..4bbe593ec4
--- /dev/null
+++ b/apps/share/styles/globals.css
@@ -0,0 +1,1976 @@
+@font-face {
+  font-family: "FK Raster Roman Compact Smooth";
+  src: url("https://openworklabs.com/fonts/FKRasterRomanCompact-Smooth.woff2") format("woff2");
+  font-weight: 400;
+  font-style: normal;
+  font-display: swap;
+}
+
+:root {
+  color-scheme: light;
+  --ow-bg: #f6f9fc;
+  --ow-ink: #011627;
+  --ow-muted: #5f6b7a;
+  --ow-card: rgba(255, 255, 255, 0.78);
+  --ow-card-strong: rgba(255, 255, 255, 0.94);
+  --ow-border: rgba(255, 255, 255, 0.76);
+  --ow-border-soft: rgba(148, 163, 184, 0.18);
+  --ow-shadow: 0 24px 70px -28px rgba(15, 23, 42, 0.18);
+  --ow-shadow-soft: 0 20px 50px -24px rgba(15, 23, 42, 0.12);
+  --ow-shadow-strong: 0 28px 80px -28px rgba(15, 23, 42, 0.26);
+  --ow-primary: #011627;
+  --ow-primary-hover: rgb(110, 110, 110);
+  --ow-ease: cubic-bezier(0.31, 0.325, 0, 0.92);
+  --ow-skill: linear-gradient(135deg, #f97316, #facc15);
+  --ow-agent: linear-gradient(135deg, #1d4ed8, #60a5fa);
+  --ow-mcp: linear-gradient(135deg, #0f766e, #2dd4bf);
+  --ow-command: linear-gradient(135deg, #7c3aed, #c084fc);
+  --ow-mono: var(--font-mono, ui-monospace), SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body,
+#__next {
+  min-height: 100%;
+}
+
+body {
+  margin: 0;
+  font-family: var(--font-inter, Inter), "Segoe UI", "Helvetica Neue", sans-serif;
+  color: var(--ow-ink);
+  background-color: #f6f9fc;
+  overflow-x: hidden;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+body::before {
+  display: none;
+}
+
+.grain-container {
+  position: absolute;
+  inset: 0;
+  overflow: hidden;
+}
+
+a,
+button,
+input,
+textarea {
+  font: inherit;
+}
+
+a {
+  color: inherit;
+}
+
+.mono {
+  font-family: var(--ow-mono);
+}
+
+.shell {
+  position: relative;
+  z-index: 1;
+  width: min(100%, 1180px);
+  margin: 0 auto;
+  padding: 28px 18px 54px;
+}
+
+.nav {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 28px;
+}
+
+.brand,
+.nav-links a,
+.button-primary,
+.button-secondary,
+  .hero-artifact,
+  .surface-shell,
+  .surface-soft,
+  .app-window,
+  .artifact-window,
+  .simple-app,
+  .drop-zone,
+  .selection-item,
+  .story-card,
+  .result-card,
+  .status-card,
+  .share-card,
+  .share-actions-bar,
+  .share-link-bar {
+  transition:
+    background-color 300ms var(--ow-ease),
+    border-color 300ms var(--ow-ease),
+    color 300ms var(--ow-ease),
+    box-shadow 300ms var(--ow-ease),
+    transform 300ms var(--ow-ease);
+}
+
+.brand {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  margin: 0;
+  padding: 0;
+  text-decoration: none;
+  color: var(--ow-ink);
+  font-size: 1.2rem;
+  font-weight: 600;
+  letter-spacing: -0.02em;
+  transition: opacity 300ms var(--ow-ease);
+}
+
+.brand:hover {
+  opacity: 0.8;
+}
+
+.brand-mark {
+  display: none;
+}
+
+.nav-links,
+.nav-actions,
+.button-row,
+.hero-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+  align-items: center;
+}
+
+.button-secondary {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  min-height: 44px;
+  padding: 0 18px;
+  border-radius: 999px;
+  text-decoration: none;
+  background: rgba(255, 255, 255, 0.66);
+  border: 1px solid rgba(255, 255, 255, 0.82);
+  box-shadow: 0 18px 44px -34px rgba(15, 23, 42, 0.28);
+  backdrop-filter: blur(12px);
+  color: var(--ow-ink);
+}
+
+.share-github-button {
+  background: #ffffff;
+}
+
+.nav-links a {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  min-height: 44px;
+  padding: 0 18px;
+  text-decoration: none;
+  color: var(--ow-ink);
+  font-weight: 500;
+  transition: color 300ms var(--ow-ease);
+}
+
+.nav-links a:hover {
+  color: var(--ow-primary-hover);
+}
+
+.button-secondary:hover {
+  background: rgb(242, 242, 242);
+  box-shadow:
+    rgba(0, 0, 0, 0.06) 0 0 0 1px,
+    rgba(0, 0, 0, 0.04) 0 1px 2px 0,
+    rgba(0, 0, 0, 0.04) 0 2px 4px 0;
+}
+
+.button-primary {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  min-height: 48px;
+  padding: 0 22px;
+  border-radius: 999px;
+  border: none;
+  cursor: pointer;
+  text-decoration: none;
+  color: #fff;
+  background: var(--ow-primary);
+  box-shadow: 0 22px 46px -28px rgba(1, 22, 39, 0.7);
+  font-weight: 600;
+}
+
+.button-primary:hover {
+  background: var(--ow-primary-hover);
+  transform: translateY(-1px);
+}
+
+.button-primary:disabled,
+.button-secondary:disabled {
+  cursor: not-allowed;
+  opacity: 0.58;
+  transform: none;
+}
+
+.hero-layout {
+  display: grid;
+  gap: 24px;
+  grid-template-columns: minmax(0, 1.05fr) minmax(320px, 0.95fr);
+  align-items: stretch;
+}
+
+.hero-layout-share {
+  grid-template-columns: minmax(0, 1fr);
+  align-items: start;
+}
+
+.hero-copy,
+.simple-app,
+.paste-panel,
+.result-card,
+.status-card {
+  display: grid;
+  gap: 18px;
+}
+
+.hero-copy h1,
+.status-card h1 {
+  margin: 0;
+  font-size: clamp(3rem, 8vw, 5rem);
+  line-height: 0.94;
+  letter-spacing: -0.06em;
+}
+
+.hero-copy h1 em,
+.status-card h1 em {
+  font-family: "FK Raster Roman Compact Smooth", Georgia, serif;
+  font-style: normal;
+  font-weight: 400;
+}
+
+.hero-body,
+.hero-note,
+.simple-app-copy,
+.story-card p,
+.result-card p,
+.status-card p {
+  margin: 0;
+  color: var(--ow-muted);
+  line-height: 1.6;
+}
+
+.hero-body {
+  max-width: 40rem;
+  font-size: 1.05rem;
+}
+
+.hero-note {
+  font-size: 13px;
+}
+
+.hero-proof-strip {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.surface-chip {
+  display: inline-flex;
+  width: fit-content;
+  min-height: 34px;
+  align-items: center;
+  padding: 0 14px;
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.84);
+  border: 1px solid rgba(255, 255, 255, 0.88);
+  box-shadow: 0 14px 34px -28px rgba(15, 23, 42, 0.18);
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  color: var(--ow-ink);
+}
+
+.eyebrow {
+  display: inline-flex;
+  width: fit-content;
+  min-height: 34px;
+  align-items: center;
+  padding: 0 14px;
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.9);
+  border: 1px solid rgba(255, 255, 255, 0.95);
+  box-shadow: 0 14px 34px -28px rgba(15, 23, 42, 0.28);
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+  color: var(--ow-muted);
+}
+
+.hero-artifact,
+.status-card {
+  position: relative;
+  overflow: hidden;
+  border-radius: 40px;
+  border: 1px solid var(--ow-border);
+  background: linear-gradient(180deg, rgba(255, 255, 255, 0.9), rgba(255, 255, 255, 0.72));
+  box-shadow: var(--ow-shadow-strong);
+  backdrop-filter: blur(22px);
+  padding: clamp(24px, 4vw, 40px);
+}
+
+.hero-artifact-share {
+  background: #ffffff;
+  padding: 18px;
+}
+
+.hero-artifact-published {
+  padding: 0;
+  border: 0;
+  background: transparent;
+  box-shadow: none;
+  backdrop-filter: none;
+  overflow: visible;
+}
+
+.simple-app,
+.app-window,
+.artifact-window,
+.surface-shell,
+.surface-soft {
+  position: relative;
+  z-index: 1;
+  border-radius: 32px;
+  background: var(--ow-card-strong);
+  border: 1px solid rgba(255, 255, 255, 0.72);
+  box-shadow: var(--ow-shadow-soft);
+}
+
+.surface-soft {
+  background: rgba(255, 255, 255, 0.92);
+}
+
+.surface-shell {
+  background: linear-gradient(180deg, rgba(255, 255, 255, 0.96), rgba(255, 255, 255, 0.86));
+}
+
+.simple-app {
+  padding: 24px;
+}
+
+.artifact-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.12fr) minmax(280px, 0.88fr);
+  gap: 18px;
+  align-items: start;
+}
+
+.share-cards-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(320px, 1.1fr);
+  gap: 18px;
+  align-items: stretch;
+}
+
+.share-home-stack {
+  display: grid;
+  gap: 18px;
+}
+
+.share-bundle-stack {
+  display: grid;
+  gap: 18px;
+  margin-top: 26px;
+}
+
+.share-bundle-simple-stack {
+  margin-top: 22px;
+}
+
+.share-bundle-stack.has-sidebar {
+  grid-template-columns: minmax(260px, 320px) minmax(0, 1fr);
+  align-items: start;
+}
+
+.share-bundle-toolbar {
+  margin-top: 4px;
+  padding: 18px 20px;
+}
+
+.share-bundle-hero-card {
+  display: grid;
+  gap: 20px;
+  grid-template-columns: minmax(0, 1.2fr) minmax(260px, 0.8fr);
+  align-items: start;
+  padding: 22px;
+}
+
+.share-bundle-hero-copy {
+  display: grid;
+  gap: 16px;
+  align-content: start;
+}
+
+.share-bundle-summary,
+.share-bundle-meta-card {
+  padding: 18px;
+}
+
+.share-bundle-sidebar {
+  display: grid;
+  gap: 14px;
+  align-content: start;
+}
+
+.share-bundle-metadata-list {
+  gap: 12px;
+}
+
+.share-bundle-actions .button-primary,
+.share-bundle-actions .button-secondary {
+  min-height: 64px;
+  padding: 0 30px;
+  font-size: 1.05rem;
+}
+
+.share-bundle-editor-simple {
+  min-height: 660px;
+}
+
+.share-bundle-grid {
+  align-items: stretch;
+}
+
+.share-card {
+  backdrop-filter: blur(22px);
+  box-shadow: var(--ow-shadow);
+}
+
+.share-actions-bar {
+  display: grid;
+  gap: 12px;
+  align-content: start;
+  padding: 20px 22px;
+  border-radius: 28px;
+  background: rgba(255, 255, 255, 0.92);
+  border: 1px solid rgba(255, 255, 255, 0.72);
+  box-shadow: var(--ow-shadow-soft);
+  backdrop-filter: blur(22px);
+}
+
+.publish-action,
+.publish-result {
+  display: grid;
+  gap: 10px;
+  min-height: 118px;
+  align-content: start;
+}
+
+.publish-hint {
+  margin: 0;
+  display: flex;
+  align-items: center;
+  min-height: 52px;
+  font-size: 13px;
+  color: var(--ow-muted);
+  line-height: 1.5;
+  padding: 0 16px;
+}
+
+.publish-button {
+  width: 100%;
+}
+
+.package-card {
+  display: grid;
+  gap: 18px;
+  padding: 22px;
+  align-content: start;
+}
+
+.share-home-card-header {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: space-between;
+  gap: 16px;
+  align-items: flex-start;
+}
+
+.preview-panel {
+  grid-column: 2;
+  grid-row: 1;
+  display: flex;
+  flex-direction: column;
+  min-height: 550px;
+  overflow: hidden;
+  contain: size;
+}
+
+.share-preview-panel {
+  min-height: 560px;
+}
+
+.share-home-preview {
+  grid-column: auto;
+  grid-row: auto;
+  min-height: 620px;
+  contain: initial;
+}
+
+.share-bundle-editor {
+  grid-column: auto;
+  grid-row: auto;
+  min-height: 620px;
+  contain: initial;
+}
+
+.preview-surface {
+  border-radius: 24px;
+  background: rgba(255, 255, 255, 0.94);
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  box-shadow: var(--ow-shadow-soft);
+  backdrop-filter: blur(22px);
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+  flex: 1;
+}
+
+.preview-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 18px 22px;
+  border-bottom: 1px solid rgba(148, 163, 184, 0.12);
+}
+
+.preview-eyebrow {
+  font-size: 14px;
+  font-weight: 700;
+  letter-spacing: 0.16em;
+  text-transform: uppercase;
+  color: var(--ow-muted);
+}
+
+.preview-filename {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  font-weight: 500;
+  color: #94a3b8;
+  font-family: var(--ow-mono);
+  letter-spacing: 0.02em;
+}
+
+.preview-header-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.share-frontmatter-preview {
+  display: grid;
+  gap: 4px;
+  padding: 16px 22px;
+  border-bottom: 1px solid rgba(148, 163, 184, 0.12);
+  background: rgba(248, 250, 252, 0.78);
+  font-size: 12px;
+  color: #64748b;
+}
+
+.share-frontmatter-editor {
+  padding: 16px 22px;
+  border-bottom: 1px solid rgba(148, 163, 184, 0.12);
+  background: rgba(248, 250, 252, 0.78);
+}
+
+.preview-editor-wrap {
+  display: grid;
+  grid-template-rows: 1fr;
+  flex: 1;
+  overflow-x: hidden;
+  overflow-y: auto;
+}
+
+.preview-highlight,
+.preview-editor {
+  grid-area: 1 / 1;
+  width: 100%;
+  min-width: 0;
+  padding: 20px 22px;
+  margin: 0;
+  border: none;
+  font-family: var(--ow-mono);
+  font-size: 13px;
+  line-height: 1.6;
+  tab-size: 2;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+}
+
+.share-preview-readonly {
+  min-height: 100%;
+}
+
+.preview-highlight {
+  color: #334155;
+  background: transparent;
+  pointer-events: none;
+}
+
+.preview-editor {
+  resize: none;
+  outline: none;
+  background: transparent;
+  color: transparent;
+  -webkit-text-fill-color: transparent;
+  caret-color: var(--ow-ink);
+  overflow: hidden;
+}
+
+.preview-editor::placeholder {
+  color: rgba(148, 163, 184, 0.6);
+  -webkit-text-fill-color: rgba(148, 163, 184, 0.6);
+}
+
+.preview-editor:focus {
+  outline: none;
+}
+
+.preview-footer {
+  padding: 10px 22px;
+  font-size: 12px;
+  color: #94a3b8;
+  border-top: 1px solid rgba(148, 163, 184, 0.12);
+  font-family: var(--ow-mono);
+  text-align: right;
+}
+
+/* Syntax highlighting — light-surface palette */
+
+.hl-heading {
+  color: #0f172a;
+  font-weight: 700;
+}
+
+.hl-punctuation {
+  color: #94a3b8;
+}
+
+.hl-frontmatter {
+  color: #94a3b8;
+}
+
+.hl-field {
+  color: #be123c;
+}
+
+.hl-keyword {
+  color: #7c3aed;
+  font-weight: 600;
+}
+
+.hl-type {
+  color: #0891b2;
+  font-style: italic;
+}
+
+.hl-string {
+  color: #059669;
+}
+
+.hl-number {
+  color: #d97706;
+}
+
+.hl-bold {
+  color: #0f172a;
+  font-weight: 700;
+}
+
+.hl-inline-code {
+  color: #0891b2;
+  background: rgba(8, 145, 178, 0.08);
+  border-radius: 3px;
+  padding: 0 3px;
+}
+
+.hl-key {
+  color: #be123c;
+}
+
+.hl-bracket {
+  color: #0f172a;
+  font-weight: 700;
+}
+
+.hl-url {
+  color: #2563eb;
+  text-decoration: underline;
+  text-decoration-color: rgba(37, 99, 235, 0.35);
+}
+
+.hl-comment {
+  color: #94a3b8;
+  font-style: italic;
+}
+
+
+.package-card-header,
+.preview-panel-header {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: space-between;
+  gap: 12px;
+  align-items: flex-start;
+}
+
+.selection-badge,
+.preview-state {
+  display: inline-flex;
+  align-items: center;
+  min-height: 34px;
+  padding: 0 14px;
+  border-radius: 999px;
+  background: rgba(248, 250, 252, 0.9);
+  border: 1px solid rgba(148, 163, 184, 0.16);
+  color: var(--ow-muted);
+  font-size: 12px;
+  font-weight: 600;
+}
+
+.preview-state.is-ready {
+  background: rgba(236, 253, 245, 0.95);
+  border-color: rgba(134, 239, 172, 0.4);
+  color: #166534;
+}
+
+.selection-list {
+  display: grid;
+  gap: 8px;
+}
+
+.inline-token {
+  display: inline;
+  padding: 0;
+  font-size: 0.88em;
+  font-weight: 600;
+  white-space: nowrap;
+  color: var(--ow-ink);
+  text-decoration: underline;
+  text-decoration-thickness: 2px;
+  text-underline-offset: 3px;
+}
+
+.inline-token::before {
+  content: "";
+  display: inline-block;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  margin-right: 4px;
+  vertical-align: baseline;
+  position: relative;
+  top: -1px;
+}
+
+.token-agent {
+  text-decoration-color: rgba(29, 78, 216, 0.4);
+}
+.token-agent::before {
+  background: var(--ow-agent);
+}
+
+.token-skill {
+  text-decoration-color: rgba(249, 115, 22, 0.4);
+}
+.token-skill::before {
+  background: var(--ow-skill);
+}
+
+.token-mcp {
+  text-decoration-color: rgba(15, 118, 110, 0.4);
+}
+.token-mcp::before {
+  background: var(--ow-mcp);
+}
+
+.token-command {
+  text-decoration-color: rgba(124, 58, 237, 0.4);
+}
+.token-command::before {
+  background: var(--ow-command);
+}
+
+.token-config {
+  text-decoration-color: rgba(71, 85, 105, 0.35);
+}
+.token-config::before {
+  background: #475569;
+}
+
+.selection-item {
+  padding: 12px 14px;
+  border-radius: 18px;
+  background: rgba(248, 250, 252, 0.78);
+  border: 1px solid rgba(148, 163, 184, 0.14);
+}
+
+.selection-item-name,
+.summary-stat-value {
+  display: block;
+  font-weight: 600;
+  color: var(--ow-ink);
+}
+
+.selection-item-path,
+.summary-stat-label {
+  display: block;
+  margin-top: 4px;
+  font-size: 12px;
+  color: var(--ow-muted);
+}
+
+.package-actions,
+.link-stack {
+  display: grid;
+  gap: 12px;
+}
+
+.preview-result-stack {
+  display: grid;
+  gap: 14px;
+}
+
+.published-shell,
+.published-layout {
+  display: grid;
+  gap: 20px;
+}
+
+.published-shell {
+  width: 100%;
+}
+
+.published-top-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+  gap: 16px;
+}
+
+.published-card {
+  display: grid;
+  gap: 10px;
+  padding: 20px 22px;
+  border-radius: 24px;
+  background: rgba(255, 255, 255, 0.92);
+  border: 1px solid rgba(255, 255, 255, 0.72);
+  box-shadow: var(--ow-shadow-soft);
+  backdrop-filter: blur(22px);
+}
+
+.published-card h3 {
+  margin: 0;
+  font-size: 20px;
+  font-weight: 600;
+  letter-spacing: -0.03em;
+  color: var(--ow-ink);
+}
+
+.published-card-copy {
+  margin: 0;
+  color: var(--ow-muted);
+  line-height: 1.55;
+}
+
+.share-link-bar {
+  padding: 16px 18px;
+  border-radius: 24px;
+  background: rgba(255, 255, 255, 0.92);
+  border: 1px solid rgba(255, 255, 255, 0.72);
+  box-shadow: var(--ow-shadow);
+  backdrop-filter: blur(22px);
+}
+
+.share-link-bar-main {
+  display: grid;
+  gap: 14px;
+}
+
+.share-link-row {
+  display: flex;
+  align-items: center;
+  min-height: 52px;
+  border-radius: 18px;
+  border: 1px solid rgba(148, 163, 184, 0.22);
+  background: rgba(255, 255, 255, 0.96);
+  transition: border-color 300ms var(--ow-ease), background-color 300ms var(--ow-ease);
+}
+
+.share-link-row.is-copied {
+  border-color: rgba(34, 197, 94, 0.4);
+  background: rgba(236, 253, 245, 0.6);
+}
+
+.share-link-inline {
+  flex: 1;
+  padding: 14px 16px;
+  border: none;
+  border-radius: 0;
+  background: transparent;
+  font-size: 13px;
+  word-break: break-word;
+}
+
+.copy-icon-button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 40px;
+  height: 40px;
+  flex-shrink: 0;
+  margin-right: 8px;
+  border: none;
+  border-radius: 10px;
+  background: transparent;
+  color: var(--ow-muted);
+  cursor: pointer;
+  transition: color 300ms var(--ow-ease), background-color 300ms var(--ow-ease);
+}
+
+.copy-icon-button:hover {
+  background: rgba(148, 163, 184, 0.1);
+  color: #3b82f6;
+}
+
+.copy-icon-button.is-copied {
+  color: #22c55e;
+}
+
+.copy-icon-button svg {
+  width: 16px;
+  height: 16px;
+}
+
+.share-link-bar-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 12px;
+}
+
+.share-feedback-inline {
+  display: inline-flex;
+  align-items: center;
+  min-height: 36px;
+  padding: 0 12px;
+  border-radius: 999px;
+  background: rgba(248, 250, 252, 0.96);
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  color: var(--ow-muted);
+  font-size: 12px;
+  font-weight: 600;
+}
+
+.share-feedback-inline.is-success {
+  background: rgba(236, 253, 245, 0.95);
+  border-color: rgba(134, 239, 172, 0.4);
+  color: #166534;
+}
+
+.input-method-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 14px;
+  align-items: stretch;
+}
+
+.share-upload-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.1fr) minmax(280px, 0.9fr);
+  gap: 16px;
+  align-items: stretch;
+}
+
+.share-upload-grid-compact {
+  grid-template-columns: minmax(180px, 220px) minmax(220px, 1fr) minmax(260px, 1.2fr) auto;
+  gap: 12px;
+  align-items: center;
+}
+
+.share-upload-row {
+  display: grid;
+  gap: 12px;
+  align-items: center;
+}
+
+.share-upload-row-metadata {
+  grid-template-columns: minmax(220px, 320px) minmax(320px, 1fr);
+}
+
+.share-upload-row-actions {
+  grid-template-columns: 1fr 1fr;
+}
+
+.share-upload-actions {
+  display: grid;
+  gap: 12px;
+  align-content: start;
+}
+
+.share-metadata-grid {
+  display: grid;
+  gap: 10px;
+}
+
+.share-metadata-field {
+  display: grid;
+  gap: 6px;
+}
+
+.share-metadata-field-inline {
+  grid-template-columns: auto minmax(0, 1fr);
+  align-items: center;
+  gap: 10px;
+}
+
+.share-metadata-field-description {
+  min-width: 0;
+}
+
+.share-metadata-key {
+  font-family: var(--ow-mono);
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--ow-muted);
+}
+
+.share-metadata-input {
+  min-height: 44px;
+  padding: 0 14px;
+  border-radius: 14px;
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  background: rgba(255, 255, 255, 0.96);
+  color: var(--ow-ink);
+  outline: none;
+}
+
+.share-metadata-input:focus {
+  border-color: rgba(37, 99, 235, 0.45);
+  box-shadow: 0 0 0 4px rgba(37, 99, 235, 0.08);
+}
+
+.share-home-generate-button {
+  width: 100%;
+  min-width: 0;
+}
+
+.share-home-generate-button:disabled {
+  cursor: not-allowed;
+  pointer-events: none;
+  transform: none;
+  background: #ffffff;
+  border: 1px solid rgba(148, 163, 184, 0.4);
+  color: var(--ow-muted);
+  opacity: 1;
+  box-shadow: none;
+}
+
+.share-home-generate-button:disabled:hover {
+  background: #ffffff;
+  transform: none;
+  box-shadow: none;
+}
+
+.share-upload-supporting-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 10px 14px;
+}
+
+.skill-editor-inline-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 10px;
+}
+
+.skill-save-button {
+  min-height: 38px;
+  padding: 0 18px;
+}
+
+.save-status {
+  font-size: 12px;
+  color: var(--ow-muted);
+}
+
+.save-status.is-error {
+  color: #b91c1c;
+}
+
+.share-feedback,
+.warning-card {
+  display: grid;
+  gap: 8px;
+  padding: 16px 18px;
+  border-radius: 24px;
+  background: rgba(255, 255, 255, 0.9);
+  border: 1px solid rgba(255, 255, 255, 0.72);
+  box-shadow: var(--ow-shadow-soft);
+  backdrop-filter: blur(22px);
+}
+
+.share-feedback strong,
+.warning-card h4 {
+  color: var(--ow-ink);
+}
+
+.share-feedback strong,
+.warning-card h4,
+.simple-app-title,
+.result-card h3 {
+  margin: 0;
+  font-size: 20px;
+  font-weight: 600;
+  letter-spacing: -0.03em;
+}
+
+.simple-app-title {
+  margin-bottom: 0;
+}
+
+.share-feedback span,
+.warning-card p {
+  margin: 0;
+  color: var(--ow-muted);
+  line-height: 1.6;
+}
+
+.share-feedback.is-success {
+  background: rgba(236, 253, 245, 0.95);
+  border-color: rgba(134, 239, 172, 0.4);
+}
+
+.share-feedback-compact {
+  gap: 4px;
+  padding: 14px 16px;
+}
+
+.package-status {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 14px;
+  border-radius: 12px;
+  font-size: 13px;
+  font-weight: 500;
+}
+
+.package-status-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+
+.severity-neutral,
+.severity-success,
+.severity-info,
+.severity-warn {
+  background: rgba(148, 163, 184, 0.06);
+  color: var(--ow-muted);
+}
+
+.severity-neutral .package-status-dot {
+  background: rgba(148, 163, 184, 0.35);
+}
+
+.severity-success .package-status-dot {
+  background: var(--ow-mcp);
+}
+
+.severity-info .package-status-dot {
+  background: var(--ow-skill);
+}
+
+.severity-warn .package-status-dot {
+  background: #ef4444;
+}
+
+.package-status-items {
+  margin: 0;
+  padding: 0 0 0 16px;
+  font-size: 12px;
+  color: var(--ow-muted);
+  display: grid;
+  gap: 2px;
+}
+
+.summary-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 10px;
+}
+
+.summary-stat {
+  padding: 14px 16px;
+  border-radius: 18px;
+  background: rgba(248, 250, 252, 0.9);
+  border: 1px solid rgba(148, 163, 184, 0.14);
+}
+
+.preview-note {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--ow-muted);
+}
+
+.drop-zone {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 14px;
+  min-height: 294px;
+  border: 2px dashed rgba(148, 163, 184, 0.3);
+  border-radius: 20px;
+  padding: 32px 24px;
+  text-align: center;
+  background: linear-gradient(180deg, rgba(248, 250, 252, 0.6), rgba(241, 245, 249, 0.4));
+  cursor: pointer;
+}
+
+.share-skill-drop-zone {
+  min-height: 240px;
+}
+
+.share-skill-drop-zone-compact {
+  flex-direction: row;
+  justify-content: flex-start;
+  min-height: 56px;
+  padding: 10px 14px;
+  gap: 12px;
+  border-radius: 16px;
+  text-align: left;
+}
+
+.drop-zone:hover,
+.drop-zone.is-dragover {
+  border-color: rgba(37, 99, 235, 0.45);
+  background: linear-gradient(180deg, rgba(239, 246, 255, 0.9), rgba(219, 234, 254, 0.5));
+}
+
+.drop-zone.is-dragover {
+  transform: scale(1.01);
+}
+
+.drop-zone[aria-busy="true"] {
+  cursor: progress;
+  opacity: 0.6;
+  pointer-events: none;
+}
+
+.clipboard-egg-button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  flex-shrink: 0;
+  border: none;
+  border-radius: 10px;
+  background: transparent;
+  color: #64748b;
+  cursor: pointer;
+  transition: background-color 300ms var(--ow-ease), color 300ms var(--ow-ease);
+}
+
+.clipboard-egg-button:hover {
+  background: rgba(100, 116, 139, 0.08);
+}
+
+.clipboard-egg-inline {
+  width: 20px;
+  height: 20px;
+  padding: 0;
+  border-radius: 6px;
+  background: transparent;
+  color: currentColor;
+}
+
+.clipboard-egg-inline:hover {
+  background: rgba(100, 116, 139, 0.08);
+}
+
+.preview-copy-button {
+  color: currentColor;
+}
+
+.preview-copy-button:hover {
+  color: currentColor;
+}
+
+.clipboard-egg-button svg {
+  width: 16px;
+  height: 16px;
+}
+
+.clipboard-egg-inline svg {
+  width: 12px;
+  height: 12px;
+}
+
+.drop-icon {
+  display: flex;
+  width: 48px;
+  height: 48px;
+  align-items: center;
+  justify-content: center;
+  border-radius: 14px;
+  background: rgba(255, 255, 255, 0.9);
+  color: rgba(100, 116, 139, 0.7);
+  box-shadow: 0 1px 3px rgba(15, 23, 42, 0.06);
+}
+
+.drop-zone:hover .drop-icon,
+.drop-zone.is-dragover .drop-icon {
+  color: #3b82f6;
+  background: #ffffff;
+  box-shadow: 0 4px 12px -4px rgba(59, 130, 246, 0.25);
+}
+
+.drop-icon svg {
+  width: 22px;
+  height: 22px;
+}
+
+.drop-text {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.drop-heading {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--ow-ink);
+}
+
+.drop-hint {
+  margin: 0;
+  font-size: 13px;
+  color: var(--ow-muted);
+}
+
+.share-upload-note,
+.share-inline-status {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--ow-muted);
+}
+
+.drop-browse {
+  color: #3b82f6;
+  font-weight: 500;
+  text-decoration: underline;
+  text-decoration-color: rgba(59, 130, 246, 0.3);
+  text-underline-offset: 2px;
+}
+
+.drop-zone:hover .drop-browse {
+  text-decoration-color: rgba(59, 130, 246, 0.6);
+}
+
+.share-skill-drop-zone-compact .drop-icon {
+  width: 36px;
+  height: 36px;
+  border-radius: 10px;
+}
+
+.share-skill-drop-zone-compact .drop-icon svg {
+  width: 18px;
+  height: 18px;
+}
+
+.share-skill-drop-zone-compact .drop-text {
+  gap: 2px;
+}
+
+.share-skill-drop-zone-compact .drop-heading {
+  font-size: 13px;
+}
+
+.share-skill-drop-zone-compact .drop-hint {
+  font-size: 12px;
+}
+
+.included-section h4 {
+  margin: 0;
+}
+
+.paste-meta,
+.status-area {
+  margin: 0;
+  font-size: 13px;
+  color: var(--ow-muted);
+}
+
+.included-section {
+  text-align: left;
+  min-width: 0;
+}
+
+.included-section-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 12px;
+}
+
+.included-section h4 {
+  margin: 0;
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--ow-muted);
+}
+
+.included-list {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 10px;
+}
+
+.metadata-list,
+.warnings-list,
+.url-stack {
+  display: grid;
+  gap: 10px;
+}
+
+.share-story-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 18px;
+  margin-top: 18px;
+}
+
+.bundle-compact-strip {
+  align-self: start;
+  padding: 16px;
+  border-radius: 24px;
+}
+
+.bundle-strip-header {
+  margin-bottom: 10px;
+  font-family: var(--ow-mono);
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--ow-muted);
+}
+
+.bundle-strip-list {
+  display: grid;
+  gap: 8px;
+  align-items: stretch;
+}
+
+.bundle-strip-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 40px;
+  padding: 0 14px;
+  border-radius: 999px;
+  background: rgba(248, 250, 252, 0.96);
+  border: 1px solid rgba(148, 163, 184, 0.16);
+  font-family: var(--ow-mono);
+  font-size: 12px;
+  color: var(--ow-ink);
+  cursor: pointer;
+  width: 100%;
+  justify-content: flex-start;
+  transition: border-color 300ms var(--ow-ease), background-color 300ms var(--ow-ease), transform 300ms var(--ow-ease);
+}
+
+button.bundle-strip-chip {
+  appearance: none;
+}
+
+.bundle-strip-chip:hover:not(:disabled) {
+  border-color: rgba(37, 99, 235, 0.32);
+  background: rgba(239, 246, 255, 0.96);
+  transform: translateY(-1px);
+}
+
+.bundle-strip-chip.is-active,
+.bundle-strip-chip:disabled {
+  background: rgba(225, 239, 255, 0.96);
+  border-color: rgba(37, 99, 235, 0.42);
+  cursor: default;
+}
+
+.step-list {
+  display: grid;
+  gap: 12px;
+}
+
+.step-row {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 12px;
+  align-items: start;
+  color: var(--ow-ink);
+  line-height: 1.6;
+}
+
+.step-bullet {
+  display: inline-flex;
+  min-width: 42px;
+  min-height: 42px;
+  align-items: center;
+  justify-content: center;
+  padding: 0 10px;
+  border-radius: 999px;
+  background: rgba(248, 250, 252, 0.92);
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  color: var(--ow-muted);
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+}
+
+button.included-item {
+  font: inherit;
+  color: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+
+.included-item {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 12px;
+  border-radius: 16px;
+  background: rgba(248, 250, 252, 0.92);
+  border: 1px solid rgba(148, 163, 184, 0.14);
+}
+
+.included-item:hover:not(:disabled) {
+  border-color: rgba(37, 99, 235, 0.35);
+  background: rgba(240, 247, 255, 0.95);
+  transform: translateY(-1px);
+}
+
+.included-item.is-active {
+  border-color: rgba(37, 99, 235, 0.5);
+  background: rgba(240, 247, 255, 0.98);
+  box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.15);
+}
+
+.included-item.is-dimmed {
+  opacity: 0.4;
+}
+
+.included-item.is-dimmed:hover {
+  opacity: 0.75;
+}
+
+.included-item:disabled {
+  cursor: default;
+}
+
+.preview-filename-dot {
+  display: inline-block;
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  margin-right: 6px;
+  vertical-align: middle;
+  background: rgba(148, 163, 184, 0.38);
+  box-shadow: inset 0 0 0 1px rgba(148, 163, 184, 0.32);
+}
+
+.item-left {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+}
+
+.item-dot {
+  position: relative;
+  width: 28px;
+  height: 28px;
+  border-radius: 999px;
+  flex-shrink: 0;
+  overflow: hidden;
+}
+
+.item-dot::after {
+  content: "";
+  position: absolute;
+  inset: 0;
+  border-radius: inherit;
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='200' height='200'%3E%3Cfilter id='g'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.75' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23g)' opacity='0.45'/%3E%3C/svg%3E");
+  background-size: cover;
+  mix-blend-mode: overlay;
+}
+
+.item-text {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+
+.dot-agent {
+  background: var(--ow-agent);
+}
+
+.dot-skill {
+  background: var(--ow-skill);
+}
+
+.dot-mcp {
+  background: var(--ow-mcp);
+}
+
+.dot-command {
+  background: var(--ow-command);
+}
+
+.dot-config {
+  background: #475569;
+}
+
+.dot-pending {
+  background: rgba(148, 163, 184, 0.38);
+  box-shadow: inset 0 0 0 1px rgba(148, 163, 184, 0.32);
+}
+
+.item-title {
+  font-size: 13px;
+  font-weight: 600;
+  line-height: 1.3;
+}
+
+.item-meta {
+  font-size: 11px;
+  color: var(--ow-muted);
+}
+
+.url-box {
+  width: 100%;
+  border-radius: 18px;
+  border: 1px solid rgba(148, 163, 184, 0.28);
+  background: rgba(255, 255, 255, 0.96);
+  color: var(--ow-ink);
+}
+
+.paste-meta {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  gap: 12px;
+}
+
+.status-area {
+  text-align: center;
+}
+
+.app-window,
+.artifact-window {
+  overflow: hidden;
+}
+
+.app-window-header,
+.artifact-window-header {
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 12px 16px;
+  background: linear-gradient(to bottom, rgba(255, 255, 255, 0.9), rgba(255, 255, 255, 0.62));
+  border-bottom: 1px solid rgba(255, 255, 255, 0.5);
+}
+
+.mac-dots {
+  position: absolute;
+  left: 16px;
+  display: flex;
+  gap: 6px;
+}
+
+.mac-dot {
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+}
+
+.mac-dot.red {
+  background: #ff5f56;
+  border: 1px solid rgba(224, 68, 62, 0.2);
+}
+
+.mac-dot.yellow {
+  background: #ffbd2e;
+  border: 1px solid rgba(222, 161, 35, 0.2);
+}
+
+.mac-dot.green {
+  background: #27c93f;
+  border: 1px solid rgba(26, 171, 41, 0.2);
+}
+
+.app-window-title,
+.artifact-window-title {
+  font-size: 12px;
+  font-weight: 500;
+  color: var(--ow-muted);
+}
+
+.app-window-body,
+.artifact-window-body {
+  padding: 24px;
+  background: #ffffff;
+}
+
+.url-box {
+  padding: 16px;
+  font-size: 13px;
+  word-break: break-word;
+}
+
+.metadata-row {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: 12px;
+  font-size: 13px;
+}
+
+.metadata-row dt,
+.warnings-empty {
+  color: var(--ow-muted);
+}
+
+.metadata-row dd {
+  margin: 0;
+  font-weight: 600;
+}
+
+.warnings-list {
+  margin: 0;
+  padding-left: 20px;
+  color: #b91c1c;
+  line-height: 1.6;
+}
+
+
+.status-card {
+  max-width: 720px;
+  margin: 48px auto 0;
+}
+
+.visually-hidden {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+.button-primary:focus-visible,
+.button-secondary:focus-visible,
+.drop-zone:focus-visible,
+.included-item:focus-visible,
+.preview-editor:focus-visible {
+  border-color: rgba(27, 41, 255, 0.55);
+  box-shadow: 0 0 0 0.22rem rgba(27, 41, 255, 0.16);
+  outline: none;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+    scroll-behavior: auto !important;
+  }
+}
+
+@media (max-width: 960px) {
+  .nav,
+  .hero-layout,
+  .artifact-grid,
+  .share-cards-grid,
+  .share-story-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .share-card-full,
+  .preview-panel {
+    grid-column: 1;
+    grid-row: auto;
+  }
+
+  .preview-panel {
+    min-height: 300px;
+    max-height: 50vh;
+  }
+
+  .input-method-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .share-upload-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .share-upload-grid-compact {
+    grid-template-columns: 1fr 1fr;
+    align-items: stretch;
+  }
+
+  .share-upload-row-metadata {
+    grid-template-columns: 1fr;
+  }
+
+  .share-upload-row-actions {
+    grid-template-columns: 1fr 1fr;
+  }
+
+  .share-home-generate-button {
+    width: 100%;
+  }
+
+  .included-list {
+    grid-template-columns: 1fr;
+  }
+
+  .published-top-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .nav {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .nav-links,
+  .nav-actions {
+    justify-content: center;
+  }
+
+  .hero-layout,
+  .artifact-grid,
+  .share-cards-grid {
+    display: grid;
+  }
+}
+
+@media (max-width: 720px) {
+  .share-upload-grid-compact {
+    grid-template-columns: 1fr;
+  }
+
+  .share-bundle-hero-card {
+    grid-template-columns: 1fr;
+  }
+
+  .share-bundle-stack.has-sidebar {
+    grid-template-columns: 1fr;
+  }
+
+  .share-metadata-field-inline {
+    grid-template-columns: 1fr;
+    gap: 6px;
+  }
+
+  .share-upload-row-actions {
+    grid-template-columns: 1fr;
+  }
+
+  .share-skill-drop-zone-compact {
+    justify-content: center;
+    text-align: center;
+  }
+
+  .summary-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (max-width: 720px) {
+  .shell {
+    padding: 20px 14px 40px;
+  }
+
+  .hero-copy h1,
+  .status-card h1 {
+    font-size: clamp(2.4rem, 14vw, 3.5rem);
+  }
+
+  .simple-app,
+  .result-card,
+  .status-card,
+  .hero-artifact,
+  .share-card,
+  .share-actions-bar {
+    padding: 20px;
+    border-radius: 24px;
+  }
+
+  .button-row,
+  .hero-actions,
+  .nav-links,
+  .nav-actions {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .button-primary,
+  .button-secondary,
+  .nav-links a {
+    width: 100%;
+  }
+
+  .share-link-bar-actions {
+    flex-direction: column;
+    align-items: stretch;
+  }
+
+  .share-feedback-compact {
+    gap: 8px;
+  }
+
+  .drop-zone {
+    min-height: 100px;
+  }
+}
diff --git a/apps/share/test-results/.last-run.json b/apps/share/test-results/.last-run.json
new file mode 100644
index 0000000000..cbcc1fbac1
--- /dev/null
+++ b/apps/share/test-results/.last-run.json
@@ -0,0 +1,4 @@
+{
+  "status": "passed",
+  "failedTests": []
+}
\ No newline at end of file
diff --git a/apps/share/tsconfig.json b/apps/share/tsconfig.json
new file mode 100644
index 0000000000..bcfbb589eb
--- /dev/null
+++ b/apps/share/tsconfig.json
@@ -0,0 +1,38 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": [
+      "ES2022",
+      "DOM",
+      "DOM.Iterable"
+    ],
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "allowImportingTsExtensions": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "allowJs": true
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    ".next",
+    "__tests__"
+  ]
+}
diff --git a/apps/share/vercel.json b/apps/share/vercel.json
new file mode 100644
index 0000000000..a667db8cda
--- /dev/null
+++ b/apps/share/vercel.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": "nextjs"
+}
diff --git a/apps/story-book/dev.log b/apps/story-book/dev.log
new file mode 100644
index 0000000000..adaf41d974
--- /dev/null
+++ b/apps/story-book/dev.log
@@ -0,0 +1,9 @@
+
+> @openwork/story-book@0.0.0 dev /Users/benjaminshafii/openwork-enterprise/_repos/openwork/apps/story-book
+> vite
+
+
+  VITE v6.4.1  ready in 389 ms
+
+  ➜  Local:   http://localhost:5176/
+  ➜  Network: use --host to expose
diff --git a/apps/story-book/index.html b/apps/story-book/index.html
new file mode 100644
index 0000000000..edcf036cf9
--- /dev/null
+++ b/apps/story-book/index.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>OpenWork Story Book</title>
+
+    <link rel="icon" type="image/svg+xml" href="/openwork-mark.svg" />
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+    <script>
+      (function () {
+        try {
+          var mode = localStorage.getItem("openwork.themePref") || "system";
+          var prefersDark = window.matchMedia("(prefers-color-scheme: dark)").matches;
+          var resolved = mode === "dark" || (mode === "system" && prefersDark) ? "dark" : "light";
+          document.documentElement.dataset.theme = resolved;
+          document.documentElement.style.colorScheme = resolved;
+        } catch (e) {
+          document.documentElement.dataset.theme = "light";
+          document.documentElement.style.colorScheme = "light";
+        }
+      })();
+    </script>
+  </head>
+  <body class="bg-dls-surface text-dls-text">
+    <div id="root"></div>
+    <script type="module" src="/src/index.tsx"></script>
+  </body>
+</html>
diff --git a/apps/story-book/package.json b/apps/story-book/package.json
new file mode 100644
index 0000000000..6691e608b6
--- /dev/null
+++ b/apps/story-book/package.json
@@ -0,0 +1,38 @@
+{
+  "name": "@openwork/story-book",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.1.18",
+    "tailwindcss": "^4.1.18",
+    "typescript": "^5.6.3",
+    "vite": "^6.0.1",
+    "vite-plugin-solid": "^2.11.0"
+  },
+  "packageManager": "pnpm@10.27.0",
+  "dependencies": {
+    "@codemirror/commands": "^6.8.0",
+    "@codemirror/lang-markdown": "^6.3.3",
+    "@codemirror/language": "^6.11.0",
+    "@codemirror/state": "^6.5.2",
+    "@codemirror/view": "^6.38.0",
+    "@opencode-ai/sdk": "^1.4.9",
+    "@radix-ui/colors": "^3.0.0",
+    "@solid-primitives/event-bus": "^1.1.2",
+    "@solid-primitives/storage": "^4.3.3",
+    "@solidjs/router": "^0.15.4",
+    "@tanstack/solid-virtual": "^3.13.19",
+    "fuzzysort": "^3.1.0",
+    "jsonc-parser": "^3.2.1",
+    "lucide-solid": "^0.562.0",
+    "marked": "^17.0.1",
+    "solid-js": "^1.9.0"
+  }
+}
diff --git a/apps/story-book/src/index.tsx b/apps/story-book/src/index.tsx
new file mode 100644
index 0000000000..7548a455b6
--- /dev/null
+++ b/apps/story-book/src/index.tsx
@@ -0,0 +1,65 @@
+/* @refresh reload */
+import { render } from "solid-js/web";
+
+import "../../app/src/app/index.css";
+import { openDesktopUrl, relaunchDesktopApp } from "../../app/src/app/lib/desktop";
+import { ConnectionsProvider } from "../../app/src/app/connections/provider";
+import { PlatformProvider, type Platform } from "../../app/src/app/context/platform";
+import { bootstrapTheme } from "../../app/src/app/theme";
+import { isDesktopRuntime } from "../../app/src/app/utils";
+import { initLocale } from "../../app/src/i18n";
+import NewLayoutApp from "./new-layout";
+
+bootstrapTheme();
+initLocale();
+
+const root = document.getElementById("root");
+
+if (!root) {
+  throw new Error("Root element not found");
+}
+
+const platform: Platform = {
+  platform: isDesktopRuntime() ? "desktop" : "web",
+  openLink(url: string) {
+    if (isDesktopRuntime()) {
+      void openDesktopUrl(url).catch(() => undefined);
+      return;
+    }
+    window.open(url, "_blank");
+  },
+  restart: async () => {
+    if (isDesktopRuntime()) {
+      await relaunchDesktopApp();
+      return;
+    }
+    window.location.reload();
+  },
+  notify: async () => undefined,
+  storage: (name) => {
+    const prefix = name ? `${name}:` : "";
+    return {
+      getItem: (key) => window.localStorage.getItem(prefix + key),
+      setItem: (key, value) => window.localStorage.setItem(prefix + key, value),
+      removeItem: (key) => window.localStorage.removeItem(prefix + key),
+    };
+  },
+  fetch,
+};
+
+const storyConnectionsStore = {
+  mcpServers: () => [],
+  mcpStatuses: () => ({}),
+  mcpStatus: () => null,
+} as any;
+
+render(
+  () => (
+    <PlatformProvider value={platform}>
+      <ConnectionsProvider store={storyConnectionsStore}>
+        <NewLayoutApp />
+      </ConnectionsProvider>
+    </PlatformProvider>
+  ),
+  root,
+);
diff --git a/apps/story-book/src/mock-data.ts b/apps/story-book/src/mock-data.ts
new file mode 100644
index 0000000000..654689bf55
--- /dev/null
+++ b/apps/story-book/src/mock-data.ts
@@ -0,0 +1,285 @@
+import type { Part } from "@opencode-ai/sdk/v2/client";
+
+import type { MessageWithParts } from "../../app/src/app/types";
+import type { WorkspaceInfo } from "../../app/src/app/lib/desktop";
+
+export type StoryScreen = "session" | "settings" | "components" | "onboarding";
+
+export type StoryStep = {
+  label: string;
+  detail: string;
+  state: "done" | "active" | "queued";
+};
+
+export const storyWorkspaces: WorkspaceInfo[] = [
+  {
+    id: "local-foundation",
+    name: "Local Foundation",
+    displayName: "OpenWork App",
+    path: "~/OpenWork/app",
+    preset: "starter",
+    workspaceType: "local",
+  },
+  {
+    id: "remote-worker",
+    name: "Remote Worker",
+    displayName: "Ops Worker",
+    path: "remote://ops-worker",
+    preset: "automation",
+    workspaceType: "remote",
+    remoteType: "openwork",
+    baseUrl: "https://worker.openworklabs.com/opencode",
+    openworkHostUrl: "https://worker.openworklabs.com",
+    openworkWorkspaceName: "Ops Worker",
+    sandboxBackend: "docker",
+    sandboxContainerName: "openwork-ops-worker",
+  },
+];
+
+export const sessionList = [
+  { title: "Refresh den cloud worker states", meta: "6m ago", active: true },
+  { title: "Polish mobile workspace connect flow", meta: "31m ago", active: false },
+  { title: "Audit release screenshots", meta: "Yesterday", active: false },
+  { title: "Tighten status copy in settings", meta: "Yesterday", active: false },
+];
+
+export const progressItems = [
+  { label: "Connect provider", done: true },
+  { label: "Review shell layout", done: true },
+  { label: "Mock key session states", done: false },
+  { label: "Capture PR screenshots", done: false },
+];
+
+const baseTime = Date.now() - 12 * 60 * 1000;
+
+function messageInfo(
+  id: string,
+  role: "user" | "assistant",
+  createdOffsetMs: number,
+): MessageWithParts["info"] {
+  return {
+    id,
+    sessionID: "story-shell-session",
+    role,
+    time: {
+      created: baseTime + createdOffsetMs,
+      ...(role === "assistant"
+        ? { completed: baseTime + createdOffsetMs + 20_000 }
+        : {}),
+    },
+  } as MessageWithParts["info"];
+}
+
+function toolPart(
+  tool: string,
+  status: "completed" | "running" | "pending" | "error",
+  input: Record<string, unknown>,
+  extras: Record<string, unknown> = {},
+): Part {
+  return {
+    type: "tool",
+    tool,
+    state: {
+      status,
+      input,
+      ...extras,
+    },
+  } as Part;
+}
+
+export const sessionMessages: MessageWithParts[] = [
+  {
+    info: messageInfo("sb-msg-1", "user", 0),
+    parts: [
+      {
+        type: "text",
+        text:
+          "Build a faithful story-book for the OpenWork app so we can iterate on the shell, session timeline, settings cards, and onboarding without touching the live runtime. Also make the mocked transcript feel closer to a real OpenWork session, including tool activity.",
+      } as Part,
+    ],
+  },
+  {
+    info: messageInfo("sb-msg-2", "assistant", 25_000),
+    parts: [
+      {
+        type: "text",
+        text:
+          "I audited the live session surface first so the mock keeps the same shell proportions, transcript rhythm, and action rail behavior.",
+      } as Part,
+      toolPart(
+        "read",
+        "completed",
+        {
+          filePath: "apps/app/src/app/pages/session.tsx",
+          offset: 4246,
+          limit: 220,
+        },
+        {
+          output: "Reviewed the live session header, command strip, and transcript layout bindings.",
+        },
+      ),
+      toolPart(
+        "grep",
+        "completed",
+        {
+          pattern: "tool|Command\\+K|compactSessionHistory|MessageList",
+          path: "apps/app/src/app",
+        },
+        {
+          output: "Found the real message timeline and tool summary helpers in message-list.tsx and utils/index.ts.",
+        },
+      ),
+      {
+        type: "reasoning",
+        text:
+          "Thinking: the mock should not invent a separate timeline widget. The fastest way to reach parity is to feed richer fake parts into the exact same MessageList surface the app already uses.",
+      } as Part,
+      {
+        type: "text",
+        text:
+          "That keeps the story-book useful for UI decisions while avoiding a parallel rendering path that could drift from the real app.",
+      } as Part,
+    ],
+  },
+  {
+    info: messageInfo("sb-msg-3", "assistant", 70_000),
+    parts: [
+      {
+        type: "text",
+        text:
+          "I then mocked a more realistic execution pass so the story transcript shows the same kinds of steps users see in production.",
+      } as Part,
+      toolPart(
+        "apply_patch",
+        "completed",
+        {
+          filePath: "apps/story-book/src/story-book.tsx",
+        },
+        {
+          output: "Success. Updated the following files: M apps/story-book/src/story-book.tsx",
+        },
+      ),
+      toolPart(
+        "bash",
+        "completed",
+        {
+          command: "pnpm --filter story-book build",
+          description: "Build story-book app to verify compile",
+        },
+        {
+          output:
+            "vite v6.4.1 building for production...\n✓ 1966 modules transformed.\n✓ built in 2.95s",
+        },
+      ),
+      toolPart(
+        "task",
+        "completed",
+        {
+          description: "Review session tool-call fidelity",
+          subagent_type: "explore",
+        },
+        {
+          metadata: {
+            sessionId: "story-subagent-session",
+          },
+          output:
+            "Subagent reviewed the session transcript surface and recommended using the live MessageList grouping semantics.",
+        },
+      ),
+      {
+        type: "text",
+        text:
+          "The result is still mocked data, but the transcript now exercises the real tool-call affordances: exploration summaries, individual action rows, and post-action assistant copy.",
+      } as Part,
+    ],
+  },
+  {
+    info: messageInfo("sb-msg-4", "assistant", 105_000),
+    parts: [
+      {
+        type: "text",
+        text:
+          "Next pass, we can add a few alternate transcript scenarios here too: running tools, failed commands, and a nested subagent thread with its own mini timeline.",
+      } as Part,
+    ],
+  },
+];
+
+export const settingsTabs = ["General", "Cloud", "Model", "Advanced", "Debug"] as const;
+
+export const settingsCards = [
+  {
+    title: "Runtime",
+    eyebrow: "Core services",
+    body: "Status for your local engine and OpenWork server with versioning, connection health, and repair actions.",
+    points: [
+      "OpenCode engine ready on localhost:4096",
+      "OpenWork server proxied for remote workers",
+      "Developer mode enabled for design QA",
+    ],
+    action: "Reconnect runtime",
+  },
+  {
+    title: "Providers",
+    eyebrow: "Models + auth",
+    body: "Compact surface for provider connection state, default model choice, and reasoning depth defaults.",
+    points: [
+      "Anthropic connected",
+      "OpenAI connected",
+      "Default model: Claude Sonnet 4",
+    ],
+    action: "Manage providers",
+  },
+  {
+    title: "Remote worker",
+    eyebrow: "Cloud worker",
+    body: "Connection card for hosted workspaces with URL, token state, and reconnect controls.",
+    points: [
+      "Worker URL copied into the shell",
+      "Last heartbeat 18s ago",
+      "Sandbox container detected",
+    ],
+    action: "Refresh worker",
+  },
+  {
+    title: "Updates",
+    eyebrow: "Desktop",
+    body: "Patch notes and delivery state for the desktop app, orchestrator, and router sidecars.",
+    points: [
+      "Auto-check weekly",
+      "Download on Wi-Fi only",
+      "Restart banner prepared",
+    ],
+    action: "Check for updates",
+  },
+];
+
+export const onboardingChoices = [
+  {
+    title: "Create local workspace",
+    detail: "Spin up a local OpenWork folder with reusable skills and project memory.",
+  },
+  {
+    title: "Connect remote worker",
+    detail: "Attach to a hosted worker using OpenWork URL + token for shared remote execution.",
+  },
+];
+
+export const screenCopy: Record<StoryScreen, { title: string; detail: string }> = {
+  session: {
+    title: "Session shell",
+    detail: "The full operational canvas: left rail, timeline, composer, utility rail, and status bar.",
+  },
+  settings: {
+    title: "Settings stack",
+    detail: "Dense control cards for runtime health, providers, remote workers, and update handling.",
+  },
+  components: {
+    title: "Core components",
+    detail: "Buttons, inputs, chips, cards, status rail, and other primitives pulled from the live app language.",
+  },
+  onboarding: {
+    title: "Onboarding",
+    detail: "First-run surfaces for theme choice, workspace creation, and remote worker connection.",
+  },
+};
diff --git a/apps/story-book/src/new-layout.tsx b/apps/story-book/src/new-layout.tsx
new file mode 100644
index 0000000000..c3d6785bbf
--- /dev/null
+++ b/apps/story-book/src/new-layout.tsx
@@ -0,0 +1,1758 @@
+import { For, Show, createEffect, createMemo, createSignal, onCleanup } from "solid-js";
+import { Redo2, Search, Undo2, X } from "lucide-solid";
+
+import Button from "../../app/src/app/components/button";
+import DenSettingsPanel from "../../app/src/app/components/den-settings-panel";
+import ModelPickerModal from "../../app/src/app/components/model-picker-modal";
+import StatusBar from "../../app/src/app/components/status-bar";
+import Composer from "../../app/src/app/components/session/composer";
+import MessageList from "../../app/src/app/components/session/message-list";
+import WorkspaceSessionList from "../../app/src/app/components/session/workspace-session-list";
+import {
+  CreateWorkspaceModal,
+  ShareWorkspaceModal,
+} from "../../app/src/app/workspace";
+import { MCP_QUICK_CONNECT, SUGGESTED_PLUGINS } from "../../app/src/app/constants";
+import { createWorkspaceShellLayout } from "../../app/src/app/lib/workspace-shell-layout";
+import { getModelBehaviorSummary, sanitizeModelBehaviorValue } from "../../app/src/app/lib/model-behavior";
+import type { OpenworkServerClient } from "../../app/src/app/lib/openwork-server";
+import ExtensionsView from "../../app/src/app/pages/extensions";
+import IdentitiesView from "../../app/src/app/pages/identities";
+import {
+  applyThemeMode,
+  getInitialThemeMode,
+  persistThemeMode,
+  subscribeToSystemTheme,
+  type ThemeMode,
+} from "../../app/src/app/theme";
+import type {
+  ComposerDraft,
+  HubSkillCard,
+  HubSkillRepo,
+  McpServerEntry,
+  McpStatusMap,
+  MessageWithParts,
+  ModelOption,
+  ModelRef,
+  PluginScope,
+  ProviderListItem,
+  SlashCommandOption,
+  SkillCard,
+  WorkspaceConnectionState,
+  WorkspacePreset,
+  WorkspaceSessionGroup,
+} from "../../app/src/app/types";
+import { sessionMessages, storyWorkspaces } from "./mock-data";
+
+type CommandPaletteMode = "root" | "sessions";
+type SettingsTab = "general" | "den" | "model" | "skills" | "extensions" | "messaging" | "advanced" | "appearance" | "updates" | "recovery" | "debug";
+
+type CommandPaletteItem = {
+  id: string;
+  title: string;
+  detail?: string;
+  meta?: string;
+  action: () => void;
+};
+
+const localWorkspace = storyWorkspaces[0] ?? {
+  id: "local-foundation",
+  name: "Local Foundation",
+  displayName: "OpenWork App",
+  path: "~/OpenWork/app",
+  preset: "starter",
+  workspaceType: "local" as const,
+};
+
+const remoteWorkspace = storyWorkspaces[1] ?? {
+  id: "remote-worker",
+  name: "Remote Worker",
+  displayName: "Ops Worker",
+  path: "remote://ops-worker",
+  preset: "automation",
+  workspaceType: "remote" as const,
+  remoteType: "openwork" as const,
+  baseUrl: "https://worker.openworklabs.com/opencode",
+  openworkHostUrl: "https://worker.openworklabs.com",
+  openworkWorkspaceName: "Ops Worker",
+  sandboxBackend: "docker" as const,
+  sandboxContainerName: "openwork-ops-worker",
+};
+
+const now = Date.now();
+
+const workspaceSessionGroups: WorkspaceSessionGroup[] = [
+  {
+    workspace: localWorkspace,
+    status: "ready",
+    sessions: [
+      {
+        id: "sb-session-shell",
+        title: "Story shell parity with session.tsx",
+        slug: "story-shell-parity",
+        time: { updated: now - 2 * 60 * 1000, created: now - 22 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-provider",
+        title: "Provider states and status rail",
+        slug: "provider-states",
+        time: { updated: now - 18 * 60 * 1000, created: now - 56 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-mobile",
+        title: "Mobile shell spacing pass",
+        slug: "mobile-shell-pass",
+        time: { updated: now - 56 * 60 * 1000, created: now - 3 * 60 * 60 * 1000 },
+      },
+    ],
+  },
+  {
+    workspace: remoteWorkspace,
+    status: "ready",
+    sessions: [
+      {
+        id: "sb-session-remote",
+        title: "Remote worker onboarding",
+        slug: "remote-worker-onboarding",
+        time: { updated: now - 7 * 60 * 1000, created: now - 2 * 60 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-inbox",
+        title: "Inbox upload behavior",
+        slug: "inbox-upload",
+        time: { updated: now - 35 * 60 * 1000, created: now - 6 * 60 * 60 * 1000 },
+      },
+    ],
+  },
+];
+
+const workspaceConnectionStateById: Record<string, WorkspaceConnectionState> = {
+  [localWorkspace.id]: { status: "connected", message: "Local engine ready" },
+  [remoteWorkspace.id]: { status: "connected", message: "Connected via token" },
+};
+
+const sessionStatusById: Record<string, string> = {
+  "sb-session-shell": "running",
+  "sb-session-provider": "idle",
+  "sb-session-mobile": "idle",
+  "sb-session-remote": "idle",
+  "sb-session-inbox": "idle",
+};
+
+const mcpStatuses: McpStatusMap = {
+  "chrome-devtools": { status: "connected" },
+  notion: { status: "connected" },
+  linear: { status: "needs_auth" },
+};
+
+const workingFiles = [
+  "apps/story-book/src/story-book.tsx",
+  "apps/app/src/app/pages/session.tsx",
+  "apps/app/src/app/components/session/workspace-session-list.tsx",
+  "apps/app/src/app/components/session/inbox-panel.tsx",
+];
+
+const commandOptions: SlashCommandOption[] = [
+  { id: "design-review", name: "design-review", description: "Open a design review pass", source: "command" },
+  { id: "test-flow", name: "test-flow", description: "Run shell flow checks", source: "skill" },
+];
+
+const storyModels: Array<{
+  ref: ModelRef;
+  title: string;
+  description: string;
+  isConnected: boolean;
+  model: ProviderListItem["models"][string];
+}> = [
+  {
+    ref: { providerID: "anthropic", modelID: "claude-sonnet-4-5-20250929" },
+    title: "Claude Sonnet 4.5",
+    description: "Anthropic",
+    isConnected: true,
+    model: {
+      id: "claude-sonnet-4-5-20250929",
+      name: "Claude Sonnet 4.5",
+      reasoning: true,
+      variants: { high: {}, max: {} },
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "openai", modelID: "gpt-5" },
+    title: "GPT-5",
+    description: "OpenAI",
+    isConnected: true,
+    model: {
+      id: "gpt-5",
+      name: "GPT-5",
+      reasoning: true,
+      variants: { none: {}, minimal: {}, low: {}, medium: {}, high: {}, xhigh: {} },
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "deepseek", modelID: "deepseek-r1" },
+    title: "DeepSeek R1",
+    description: "DeepSeek",
+    isConnected: true,
+    model: {
+      id: "deepseek-r1",
+      name: "DeepSeek R1",
+      reasoning: true,
+      variants: {},
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "openrouter", modelID: "grok-4" },
+    title: "Grok 4",
+    description: "OpenRouter",
+    isConnected: false,
+    model: {
+      id: "grok-4",
+      name: "Grok 4",
+      reasoning: false,
+      variants: {},
+    } as unknown as ProviderListItem["models"][string],
+  },
+];
+
+const mockShareFields = [
+  {
+    label: "Worker URL",
+    value: "https://worker.openworklabs.com/opencode",
+    hint: "Paste this into Add worker -> Connect remote.",
+  },
+  {
+    label: "Password",
+    value: "ow_story_worker_owner_password_7f9a1b3c",
+    secret: true,
+    hint: "Use when the remote client must answer permission prompts.",
+  },
+  {
+    label: "Collaborator token",
+    value: "ow_story_worker_collab_token_1c4d2e8a",
+    secret: true,
+    hint: "Routine access when you do not need owner-only actions.",
+  },
+] as const;
+
+const initialSkills: SkillCard[] = [
+  {
+    name: "workspace-guide",
+    path: ".opencode/skills/workspace-guide/SKILL.md",
+    description: "Guide users through workspace onboarding.",
+    trigger: "workspace guide",
+  },
+  {
+    name: "design-review",
+    path: ".opencode/skills/design-review/SKILL.md",
+    description: "Run a design review pass over the current shell.",
+    trigger: "review this design",
+  },
+  {
+    name: "test-flow",
+    path: ".opencode/skills/test-flow/SKILL.md",
+    description: "Exercise the Storybook flow before shipping.",
+    trigger: "test the flow",
+  },
+];
+
+const initialSkillContents: Record<string, string> = {
+  "workspace-guide": "# Workspace Guide\n\nHelp users connect a worker, open settings, and understand the shell layout.",
+  "design-review": "# Design Review\n\nReview the current screen for hierarchy, spacing, and state clarity.",
+  "test-flow": "# Test Flow\n\nRun the visible Storybook flow and note any interaction regressions.",
+};
+
+const initialHubRepo: HubSkillRepo = {
+  owner: "different-ai",
+  repo: "openwork-hub",
+  ref: "main",
+};
+
+const initialHubSkills: HubSkillCard[] = [
+  {
+    name: "worker-smoke",
+    description: "Smoke-test remote worker setup and report any blockers.",
+    trigger: "worker smoke",
+    source: { owner: "different-ai", repo: "openwork-hub", ref: "main", path: "skills/worker-smoke/SKILL.md" },
+  },
+  {
+    name: "share-review",
+    description: "Review share links, field labeling, and copy clarity.",
+    trigger: "share review",
+    source: { owner: "different-ai", repo: "openwork-hub", ref: "main", path: "skills/share-review/SKILL.md" },
+  },
+];
+
+const initialMcpServers: McpServerEntry[] = [
+  {
+    name: "notion",
+    config: { type: "remote", url: "https://mcp.notion.com/mcp", enabled: true },
+  },
+  {
+    name: "linear",
+    config: { type: "remote", url: "https://mcp.linear.app/mcp", enabled: true },
+  },
+  {
+    name: "chrome-devtools",
+    config: { type: "local", command: ["npx", "-y", "chrome-devtools-mcp@latest"], enabled: true },
+  },
+];
+
+function toMessageParts(id: string, role: "user" | "assistant", text: string): MessageWithParts {
+  return {
+    info: {
+      id,
+      sessionID: "story-shell-session",
+      role,
+      time: { created: Date.now() },
+    } as MessageWithParts["info"],
+    parts: [{ type: "text", text } as MessageWithParts["parts"][number]],
+  };
+}
+
+export default function NewLayoutApp() {
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = createSignal(localWorkspace.id);
+  const [selectedSessionId, setSelectedSessionId] = createSignal<string | null>("sb-session-shell");
+
+  const [themeMode] = createSignal<ThemeMode>(getInitialThemeMode());
+  const [composerPrompt, setComposerPrompt] = createSignal(
+    "Use this mock shell to design layout changes before touching the live session runtime.",
+  );
+  const [composerToast, setComposerToast] = createSignal<string | null>(null);
+  const [selectedAgent, setSelectedAgent] = createSignal<string | null>(null);
+  const [selectedModel, setSelectedModel] = createSignal<ModelRef>(storyModels[0].ref);
+  const [modelVariant, setModelVariant] = createSignal<string | null>("medium");
+  const [modelPickerOpen, setModelPickerOpen] = createSignal(false);
+  const [modelPickerTarget, setModelPickerTarget] = createSignal<"default" | "session">("session");
+  const [modelPickerQuery, setModelPickerQuery] = createSignal("");
+  const [createWorkspaceOpen, setCreateWorkspaceOpen] = createSignal(false);
+  const [createWorkspaceSubmitting, setCreateWorkspaceSubmitting] = createSignal(false);
+  const [mockFolderPickCount, setMockFolderPickCount] = createSignal(0);
+  const [agentPickerOpen, setAgentPickerOpen] = createSignal(false);
+  const [shareWorkspaceId, setShareWorkspaceId] = createSignal<string | null>(null);
+  const [messageRows, setMessageRows] = createSignal<MessageWithParts[]>(sessionMessages);
+  const [expandedStepIds, setExpandedStepIds] = createSignal(new Set<string>());
+  const [headerActionBusy, setHeaderActionBusy] = createSignal<"undo" | "redo" | "compact" | null>(null);
+  const [commandPaletteOpen, setCommandPaletteOpen] = createSignal(false);
+  const [commandPaletteMode, setCommandPaletteMode] = createSignal<CommandPaletteMode>("root");
+  const [commandPaletteQuery, setCommandPaletteQuery] = createSignal("");
+  const [commandPaletteActiveIndex, setCommandPaletteActiveIndex] = createSignal(0);
+  let commandPaletteInputEl: HTMLInputElement | undefined;
+  const commandPaletteOptionRefs: HTMLButtonElement[] = [];
+  const [skills, setSkills] = createSignal<SkillCard[]>(initialSkills);
+  const [skillContents, setSkillContents] = createSignal<Record<string, string>>(initialSkillContents);
+  const [hubRepo, setHubRepo] = createSignal<HubSkillRepo | null>(initialHubRepo);
+  const [hubRepos, setHubRepos] = createSignal<HubSkillRepo[]>([initialHubRepo]);
+  const [hubSkills] = createSignal<HubSkillCard[]>(initialHubSkills);
+  const [pluginScope, setPluginScope] = createSignal<PluginScope>("project");
+  const [pluginInput, setPluginInput] = createSignal("");
+  const [pluginList, setPluginList] = createSignal<string[]>(["@openwork/browser-mcp"]);
+  const [pluginStatus, setPluginStatus] = createSignal<string | null>("Sandbox plugin config loaded.");
+  const [activePluginGuide, setActivePluginGuide] = createSignal<string | null>(null);
+  const [selectedMcp, setSelectedMcp] = createSignal<string | null>("notion");
+  const [storyMcpServers, setStoryMcpServers] = createSignal<McpServerEntry[]>(initialMcpServers);
+  const [storyMcpStatuses, setStoryMcpStatuses] = createSignal<McpStatusMap>(mcpStatuses);
+  const [messagingModuleEnabled, setMessagingModuleEnabled] = createSignal(true);
+  const [telegramIdentityRows, setTelegramIdentityRows] = createSignal([
+    { id: "telegram-story", enabled: true, running: true, access: "private", pairingRequired: false },
+  ]);
+  const [slackIdentityRows, setSlackIdentityRows] = createSignal([
+    { id: "slack-story", enabled: true, running: true },
+  ]);
+  const [routerAgentContent, setRouterAgentContent] = createSignal(
+    "# OpenCodeRouter Messaging Agent\n\nKeep responses concise and route follow-ups to the right worker.",
+  );
+  const [routerAgentUpdatedAt, setRouterAgentUpdatedAt] = createSignal(now);
+
+  const {
+    leftSidebarWidth,
+    startLeftSidebarResize,
+  } = createWorkspaceShellLayout({ expandedRightWidth: 320 });
+
+  createEffect(() => {
+    const mode = themeMode();
+    persistThemeMode(mode);
+    applyThemeMode(mode);
+  });
+
+  createEffect(() => {
+    const unsubscribeSystemTheme = subscribeToSystemTheme(() => {
+      if (themeMode() === "system") {
+        applyThemeMode("system");
+      }
+    });
+    onCleanup(() => unsubscribeSystemTheme());
+  });
+
+  const selectedSessionTitle = createMemo(() => {
+    const target = selectedSessionId();
+    if (!target) return "New session";
+    for (const group of workspaceSessionGroups) {
+      const found = group.sessions.find((session) => session.id === target);
+      if (found) return found.title;
+    }
+    return "New session";
+  });
+  const [showingSettings, setShowingSettings] = createSignal(false);
+  const [settingsTab, setSettingsTab] = createSignal<SettingsTab>("general");
+
+  const workspaceTabs = createMemo<SettingsTab[]>(() => [
+    "general",
+    "model",
+    "skills",
+    "extensions",
+    "messaging",
+    "advanced",
+  ]);
+  const globalTabs = createMemo<SettingsTab[]>(() => ["den", "appearance", "updates", "recovery", "debug"]);
+
+  const tabLabel = (tab: SettingsTab) => {
+    switch (tab) {
+      case "den":
+        return "Cloud";
+      case "model":
+        return "Model";
+      case "skills":
+        return "Skills";
+      case "extensions":
+        return "Extensions";
+      case "messaging":
+        return "Messaging";
+      case "advanced":
+        return "Advanced";
+      case "appearance":
+        return "Appearance";
+      case "updates":
+        return "Updates";
+      case "recovery":
+        return "Recovery";
+      case "debug":
+        return "Debug";
+      default:
+        return "General";
+    }
+  };
+
+  const tabDescription = (tab: SettingsTab) => {
+    switch (tab) {
+      case "den":
+        return "Manage your OpenWork Cloud connection, hosted workers, and workspace access.";
+      case "model":
+        return "Tune the default model, runtime behavior, and assistant output settings.";
+      case "skills":
+        return "Browse skill surfaces and pinned shortcuts for this workspace.";
+      case "extensions":
+        return "Inspect extension-style integrations for this workspace shell.";
+      case "messaging":
+        return "Keep messaging and inbox tools inside workspace settings instead of the right rail.";
+      case "advanced":
+        return "Inspect runtime health, connection state, and developer-facing controls.";
+      case "appearance":
+        return "Adjust how OpenWork looks across desktop, system theme, and app chrome.";
+      case "updates":
+        return "Keep the app current with quiet background checks and install controls.";
+      case "recovery":
+        return "Repair migration state, reset workspace defaults, and recover local settings.";
+      case "debug":
+        return "Review runtime diagnostics, logs, and low-level debugging utilities.";
+      default:
+        return "Connect providers, authorize folders, and control the active OpenWork workspace.";
+    }
+  };
+
+  const settingsRailClass = "rounded-[24px] border border-dls-border bg-dls-sidebar p-3";
+  const settingsPanelClass = "rounded-[28px] border border-dls-border bg-dls-surface p-5 md:p-6";
+  const settingsPanelSoftClass = "rounded-2xl border border-gray-6/60 bg-gray-1/40 p-4";
+
+  const activeWorkspace = createMemo(
+    () => workspaceSessionGroups.find((group) => group.workspace.id === selectedWorkspaceId())?.workspace ?? localWorkspace,
+  );
+  const shareWorkspace = createMemo(
+    () => storyWorkspaces.find((workspace) => workspace.id === shareWorkspaceId()) ?? null,
+  );
+  const shareWorkspaceName = createMemo(
+    () => shareWorkspace()?.displayName?.trim() || shareWorkspace()?.name?.trim() || "Workspace",
+  );
+  const shareWorkspaceDetail = createMemo(() => {
+    const workspace = shareWorkspace();
+    if (!workspace) return null;
+    if (workspace.workspaceType === "remote") return workspace.baseUrl ?? workspace.path ?? null;
+    return workspace.path ?? null;
+  });
+  const selectedWorkspaceRoot = createMemo(() => activeWorkspace().path?.trim() || "");
+
+  const refreshSkills = () => setComposerToast("Story-book: refreshed skills.");
+  const refreshHubSkills = () => setComposerToast("Story-book: refreshed hub skills.");
+
+  const installSkillCreator = async () => {
+    if (!skills().some((skill) => skill.name === "skill-creator")) {
+      setSkills((current) => [
+        ...current,
+        {
+          name: "skill-creator",
+          path: ".opencode/skills/skill-creator/SKILL.md",
+          description: "Create new skills from chat.",
+          trigger: "create a skill",
+        },
+      ]);
+      setSkillContents((current) => ({
+        ...current,
+        "skill-creator": "# Skill Creator\n\nCreate a new OpenCode skill from a prompt.",
+      }));
+    }
+    return { ok: true, message: "Installed skill-creator in the Storybook sandbox." };
+  };
+
+  const installHubSkill = async (name: string) => {
+    const hubSkill = initialHubSkills.find((item) => item.name === name);
+    if (!hubSkill) return { ok: false, message: `Skill ${name} not found.` };
+    if (!skills().some((skill) => skill.name === name)) {
+      setSkills((current) => [
+        ...current,
+        {
+          name: hubSkill.name,
+          path: `.opencode/skills/${hubSkill.name}/SKILL.md`,
+          description: hubSkill.description,
+          trigger: hubSkill.trigger,
+        },
+      ]);
+      setSkillContents((current) => ({
+        ...current,
+        [hubSkill.name]: `# ${hubSkill.name}\n\n${hubSkill.description ?? "Imported from the hub."}`,
+      }));
+    }
+    return { ok: true, message: `Installed ${name} from the Storybook hub.` };
+  };
+
+  const addHubRepo = (repo: Partial<HubSkillRepo>) => {
+    const next: HubSkillRepo = {
+      owner: repo.owner?.trim() || initialHubRepo.owner,
+      repo: repo.repo?.trim() || initialHubRepo.repo,
+      ref: repo.ref?.trim() || initialHubRepo.ref,
+    };
+    setHubRepos((current) => {
+      if (current.some((item) => item.owner === next.owner && item.repo === next.repo && item.ref === next.ref)) {
+        return current;
+      }
+      return [...current, next];
+    });
+    setHubRepo(next);
+  };
+
+  const removeHubRepo = (repo: Partial<HubSkillRepo>) => {
+    setHubRepos((current) =>
+      current.filter((item) => !(item.owner === repo.owner && item.repo === repo.repo && item.ref === repo.ref)),
+    );
+    if (hubRepo()?.owner === repo.owner && hubRepo()?.repo === repo.repo && hubRepo()?.ref === repo.ref) {
+      setHubRepo(initialHubRepo);
+    }
+  };
+
+  const revealSkillsFolder = () => setComposerToast("Story-book: reveal skills folder is mocked.");
+
+  const uninstallSkill = (name: string) => {
+    setSkills((current) => current.filter((skill) => skill.name !== name));
+    setSkillContents((current) => {
+      const next = { ...current };
+      delete next[name];
+      return next;
+    });
+  };
+
+  const readSkill = async (name: string) => {
+    const skill = skills().find((item) => item.name === name);
+    if (!skill) return null;
+    return {
+      name,
+      path: skill.path,
+      content: skillContents()[name] ?? `# ${name}\n\nStory-book skill content.`,
+    };
+  };
+
+  const saveSkill = (input: { name: string; content: string; description?: string }) => {
+    const path = `.opencode/skills/${input.name}/SKILL.md`;
+    setSkills((current) => {
+      const existing = current.find((skill) => skill.name === input.name);
+      if (existing) {
+        return current.map((skill) =>
+          skill.name === input.name
+            ? { ...skill, description: input.description ?? skill.description, path }
+            : skill,
+        );
+      }
+      return [...current, { name: input.name, path, description: input.description }];
+    });
+    setSkillContents((current) => ({ ...current, [input.name]: input.content }));
+  };
+
+  const importLocalSkill = () => {
+    saveSkill({
+      name: "imported-local-skill",
+      content: "# Imported Local Skill\n\nThis came from the Storybook sandbox import action.",
+      description: "Imported into the sandbox.",
+    });
+    setComposerToast("Story-book: imported a local skill.");
+  };
+
+  const refreshPlugins = (scopeOverride?: PluginScope) => {
+    setPluginStatus(`Refreshed ${scopeOverride ?? pluginScope()} plugins in Storybook.`);
+  };
+
+  const isPluginInstalled = (name: string, aliases?: string[]) => {
+    const installed = new Set(pluginList());
+    if (installed.has(name)) return true;
+    return (aliases ?? []).some((alias) => installed.has(alias));
+  };
+
+  const addPlugin = (pluginNameOverride?: string) => {
+    const nextName = (pluginNameOverride ?? pluginInput()).trim();
+    if (!nextName) return;
+    if (!isPluginInstalled(nextName)) {
+      setPluginList((current) => [...current, nextName]);
+    }
+    setPluginInput("");
+    setPluginStatus(`${nextName} added in Storybook.`);
+  };
+
+  const removePlugin = (pluginName: string) => {
+    setPluginList((current) => current.filter((item) => item !== pluginName));
+    setPluginStatus(`${pluginName} removed in Storybook.`);
+  };
+
+  const refreshMcpServers = () => setComposerToast("Story-book: refreshed MCP servers.");
+
+  const connectMcp = (entry: (typeof MCP_QUICK_CONNECT)[number]) => {
+    const key = entry.id ?? entry.name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    if (!storyMcpServers().some((server) => server.name === key)) {
+      setStoryMcpServers((current) => [
+        ...current,
+        {
+          name: key,
+          config: {
+            type: entry.type ?? "remote",
+            ...(entry.url ? { url: entry.url } : {}),
+            ...(entry.command ? { command: entry.command } : {}),
+            enabled: true,
+          },
+        },
+      ]);
+    }
+    setStoryMcpStatuses((current) => ({ ...current, [key]: { status: entry.oauth ? "needs_auth" : "connected" } }));
+    setSelectedMcp(key);
+  };
+
+  const authorizeMcp = (entry: McpServerEntry) => {
+    setStoryMcpStatuses((current) => ({ ...current, [entry.name]: { status: "connected" } }));
+  };
+
+  const logoutMcpAuth = async (name: string) => {
+    setStoryMcpStatuses((current) => ({ ...current, [name]: { status: "needs_auth" } }));
+  };
+
+  const removeMcp = (name: string) => {
+    setStoryMcpServers((current) => current.filter((entry) => entry.name !== name));
+    setStoryMcpStatuses((current) => {
+      const next = { ...current };
+      delete next[name];
+      return next;
+    });
+    if (selectedMcp() === name) setSelectedMcp(null);
+  };
+
+  const buildRouterHealth = () => ({
+    ok: true,
+    opencode: {
+      url: "https://worker.openworklabs.com/opencode",
+      healthy: true,
+      version: "0.1.0-story",
+    },
+    channels: {
+      telegram: telegramIdentityRows().some((item) => item.enabled),
+      whatsapp: false,
+      slack: slackIdentityRows().some((item) => item.enabled),
+    },
+    config: {
+      groupsEnabled: true,
+    },
+    activity: {
+      dayStart: now - 12 * 60 * 60 * 1000,
+      inboundToday: 4,
+      outboundToday: 9,
+      lastMessageAt: now - 12 * 60 * 1000,
+    },
+    agent: {
+      scope: "workspace" as const,
+      path: ".opencode/agents/opencode-router.md",
+      loaded: true,
+      selected: "openwork-router",
+    },
+  });
+
+  const mockOpenworkServerClient = {
+    getConfig: async () => ({ openwork: { messaging: { enabled: messagingModuleEnabled() } } }),
+    getOpenCodeRouterHealth: async () => ({ ok: true, status: 200, json: buildRouterHealth() }),
+    getOpenCodeRouterTelegramIdentities: async () => ({ ok: true, items: telegramIdentityRows() }),
+    getOpenCodeRouterSlackIdentities: async () => ({ ok: true, items: slackIdentityRows() }),
+    getOpenCodeRouterTelegram: async () => ({
+      ok: true,
+      configured: true,
+      enabled: messagingModuleEnabled(),
+      bot: { id: 1, username: "openwork_storybot", name: "OpenWork Story Bot" },
+    }),
+    readWorkspaceFile: async (_workspaceId: string, path: string) => ({
+      path,
+      content: routerAgentContent(),
+      bytes: routerAgentContent().length,
+      updatedAt: routerAgentUpdatedAt(),
+    }),
+    writeWorkspaceFile: async (_workspaceId: string, input: { path: string; content: string }) => {
+      const updatedAt = Date.now();
+      setRouterAgentContent(input.content);
+      setRouterAgentUpdatedAt(updatedAt);
+      return { ok: true, path: input.path, bytes: input.content.length, updatedAt };
+    },
+    sendOpenCodeRouterMessage: async (
+      _workspaceId: string,
+      input: { channel: string; text: string; directory?: string; peerId?: string },
+    ) => ({
+      ok: true,
+      channel: input.channel,
+      directory: input.directory ?? selectedWorkspaceRoot(),
+      peerId: input.peerId,
+      attempted: 1,
+      sent: 1,
+      reason: "Delivered by the Storybook sandbox client.",
+    }),
+    patchConfig: async (
+      _workspaceId: string,
+      payload: { openwork?: { messaging?: { enabled?: boolean } } },
+    ) => {
+      const enabled = payload.openwork?.messaging?.enabled;
+      if (typeof enabled === "boolean") setMessagingModuleEnabled(enabled);
+      return { ok: true };
+    },
+    upsertOpenCodeRouterTelegramIdentity: async (
+      _workspaceId: string,
+      input: { enabled: boolean; access?: "public" | "private"; pairingRequired?: boolean },
+    ) => {
+      const next = {
+        id: "telegram-story",
+        enabled: input.enabled,
+        running: true,
+        access: input.access ?? "private",
+        pairingRequired: input.pairingRequired ?? false,
+      };
+      setTelegramIdentityRows([next]);
+      return {
+        ok: true,
+        telegram: {
+          id: next.id,
+          enabled: next.enabled,
+          access: next.access,
+          pairingRequired: next.pairingRequired,
+          pairingCode: next.pairingRequired ? "STORY42" : undefined,
+          bot: { id: 1, username: "openwork_storybot", name: "OpenWork Story Bot" },
+        },
+      };
+    },
+    deleteOpenCodeRouterTelegramIdentity: async (_workspaceId: string, identityId: string) => {
+      setTelegramIdentityRows((current) => current.filter((item) => item.id !== identityId));
+      return { ok: true, telegram: { id: identityId, deleted: true } };
+    },
+    upsertOpenCodeRouterSlackIdentity: async (_workspaceId: string, input: { enabled: boolean }) => {
+      const next = { id: "slack-story", enabled: input.enabled, running: true };
+      setSlackIdentityRows([next]);
+      return { ok: true, slack: { id: next.id, enabled: next.enabled } };
+    },
+    deleteOpenCodeRouterSlackIdentity: async (_workspaceId: string, identityId: string) => {
+      setSlackIdentityRows((current) => current.filter((item) => item.id !== identityId));
+      return { ok: true, slack: { id: identityId, deleted: true } };
+    },
+  } as unknown as OpenworkServerClient;
+
+  const agentLabel = createMemo(() => {
+    const name = selectedAgent() ?? "Default agent";
+    return name.charAt(0).toUpperCase() + name.slice(1);
+  });
+
+  const selectedStoryModel = createMemo(
+    () => storyModels.find((entry) => entry.ref.providerID === selectedModel().providerID && entry.ref.modelID === selectedModel().modelID)
+      ?? storyModels[0],
+  );
+
+  const selectedBehavior = createMemo(() =>
+    getModelBehaviorSummary(
+      selectedStoryModel().ref.providerID,
+      selectedStoryModel().model,
+      modelVariant(),
+    ),
+  );
+
+  const selectedModelLabel = createMemo(() => selectedStoryModel().title);
+
+  const storyModelOptions = createMemo<ModelOption[]>(() =>
+    storyModels.map((entry) => {
+      const behavior = getModelBehaviorSummary(entry.ref.providerID, entry.model, modelVariant());
+      return {
+        providerID: entry.ref.providerID,
+        modelID: entry.ref.modelID,
+        title: entry.title,
+        description: entry.description,
+        footer: entry.ref.providerID === selectedModel().providerID && entry.ref.modelID === selectedModel().modelID
+          ? "Current model"
+          : undefined,
+        behaviorTitle: behavior.title,
+        behaviorLabel: behavior.label,
+        behaviorDescription: behavior.description,
+        behaviorValue: sanitizeModelBehaviorValue(entry.ref.providerID, entry.model, modelVariant()),
+        behaviorOptions: behavior.options,
+        isFree: false,
+        isConnected: entry.isConnected,
+        isRecommended: entry.title.includes("GPT-5") || entry.title.includes("Claude") || entry.title.includes("DeepSeek"),
+      };
+    }),
+  );
+
+  const filteredStoryModelOptions = createMemo(() => {
+    const query = modelPickerQuery().trim().toLowerCase();
+    if (!query) return storyModelOptions();
+    return storyModelOptions().filter((option) =>
+      [
+        option.title,
+        option.description ?? "",
+        option.footer ?? "",
+        option.behaviorTitle,
+        option.behaviorLabel,
+        option.behaviorDescription,
+        `${option.providerID}/${option.modelID}`,
+      ]
+        .join(" ")
+        .toLowerCase()
+        .includes(query),
+    );
+  });
+
+  const openModelPicker = (target: "default" | "session" = "session") => {
+    setModelPickerTarget(target);
+    setModelPickerQuery("");
+    setModelPickerOpen(true);
+  };
+
+  const openMockCreateWorkspaceModal = () => {
+    setCreateWorkspaceSubmitting(false);
+    setCreateWorkspaceOpen(true);
+  };
+
+  const pickMockWorkspaceFolder = async () => {
+    const folders = [
+      "/Users/demo/OpenWork/client-foundation",
+      "/Users/demo/OpenWork/automation-lab",
+      "/Users/demo/OpenWork/starter-sandbox",
+    ];
+    const next = folders[mockFolderPickCount() % folders.length] ?? folders[0];
+    setMockFolderPickCount((count) => count + 1);
+    await new Promise((resolve) => window.setTimeout(resolve, 180));
+    return next;
+  };
+
+  const confirmMockWorkspaceCreate = (preset: WorkspacePreset, folder: string | null) => {
+    if (!folder || createWorkspaceSubmitting()) return;
+    setCreateWorkspaceSubmitting(true);
+    window.setTimeout(() => {
+      setCreateWorkspaceSubmitting(false);
+      setCreateWorkspaceOpen(false);
+      setComposerToast(`Story-book: create workspace is mocked with preset \"${preset}\" at ${folder}.`);
+    }, 320);
+  };
+
+  const applyStoryModelSelection = (next: ModelRef) => {
+    const entry = storyModels.find((item) => item.ref.providerID === next.providerID && item.ref.modelID === next.modelID);
+    setSelectedModel(next);
+    if (entry) {
+      setModelVariant(sanitizeModelBehaviorValue(next.providerID, entry.model, modelVariant()) ?? null);
+    }
+    setModelPickerOpen(false);
+  };
+
+  const handleDraftChange = (draft: ComposerDraft) => {
+    setComposerPrompt(draft.text);
+  };
+
+  const handleSend = (draft: ComposerDraft) => {
+    const text = (draft.resolvedText ?? draft.text ?? "").trim();
+    if (!text) return;
+    const nowStamp = Date.now();
+    setMessageRows((current) => [
+      ...current,
+      toMessageParts(`sb-user-${nowStamp}`, "user", text),
+      toMessageParts(
+        `sb-assistant-${nowStamp}`,
+        "assistant",
+        "Story-book mock response: message accepted. This uses app MessageList + Composer with local mock state.",
+      ),
+    ]);
+    setComposerPrompt("");
+  };
+
+  const runMockHeaderAction = (action: "undo" | "redo" | "compact", label: string) => {
+    if (headerActionBusy()) return;
+    setHeaderActionBusy(action);
+    setComposerToast(`Story-book: ${label} is mocked in this shell.`);
+    window.setTimeout(() => setHeaderActionBusy(null), 240);
+  };
+
+  const openMockShareModal = (workspaceId?: string | null) => {
+    const nextId = workspaceId?.trim() || selectedWorkspaceId();
+    setShareWorkspaceId(nextId);
+  };
+
+  const totalSessionCount = createMemo(() =>
+    workspaceSessionGroups.reduce((count, group) => count + group.sessions.length, 0),
+  );
+
+  const commandPaletteSessionOptions = createMemo(() => {
+    const out: Array<{
+      workspaceId: string;
+      sessionId: string;
+      title: string;
+      workspaceTitle: string;
+      updatedAt: number;
+      searchText: string;
+    }> = [];
+
+    for (const group of workspaceSessionGroups) {
+      const workspaceId = group.workspace.id?.trim() ?? "";
+      if (!workspaceId) continue;
+      const workspaceTitle = group.workspace.displayName?.trim() || group.workspace.name;
+      for (const session of group.sessions) {
+        const sessionId = session.id?.trim() ?? "";
+        if (!sessionId) continue;
+        const title = session.title;
+        const updatedAt = session.time?.updated ?? session.time?.created ?? 0;
+        out.push({
+          workspaceId,
+          sessionId,
+          title,
+          workspaceTitle,
+          updatedAt,
+          searchText: `${title} ${workspaceTitle}`.toLowerCase(),
+        });
+      }
+    }
+
+    out.sort((a, b) => b.updatedAt - a.updatedAt);
+    return out;
+  });
+
+  const focusCommandPaletteInput = () => {
+    queueMicrotask(() => {
+      commandPaletteInputEl?.focus();
+      commandPaletteInputEl?.select();
+    });
+  };
+
+  const openCommandPalette = (mode: CommandPaletteMode = "root") => {
+    setCommandPaletteMode(mode);
+    setCommandPaletteOpen(true);
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+    focusCommandPaletteInput();
+  };
+
+  const closeCommandPalette = () => {
+    setCommandPaletteOpen(false);
+    setCommandPaletteMode("root");
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+  };
+
+  const returnToCommandRoot = () => {
+    if (commandPaletteMode() === "root") return;
+    setCommandPaletteMode("root");
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+    focusCommandPaletteInput();
+  };
+
+  const commandPaletteRootItems = createMemo<CommandPaletteItem[]>(() => {
+    const selectedTitle = selectedSessionTitle().trim() || "Give your selected session a clearer name";
+    const items: CommandPaletteItem[] = [
+      {
+        id: "new-session",
+        title: "Create new session",
+        detail: "Start a fresh task in the current workspace",
+        meta: "Create",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: create new session is mocked in this shell.");
+        },
+      },
+      {
+        id: "workspace",
+        title: "Create workspace",
+        detail: "Open the real workspace-creation modal in the shell",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          openMockCreateWorkspaceModal();
+        },
+      },
+      {
+        id: "rename-session",
+        title: "Rename current session",
+        detail: selectedTitle,
+        meta: "Rename",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: rename session flow is mocked in this shell.");
+        },
+      },
+      {
+        id: "sessions",
+        title: "Search sessions",
+        detail: `${totalSessionCount().toLocaleString()} available across workspaces`,
+        meta: "Jump",
+        action: () => {
+          setCommandPaletteMode("sessions");
+          setCommandPaletteQuery("");
+          setCommandPaletteActiveIndex(0);
+          focusCommandPaletteInput();
+        },
+      },
+      {
+        id: "model",
+        title: "Change model",
+        detail: `${selectedModelLabel()} · ${selectedBehavior().label}`,
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          openModelPicker("session");
+        },
+      },
+      {
+        id: "provider",
+        title: "Connect provider",
+        detail: "Open provider connection flow",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: provider connection flow is mocked in this shell.");
+        },
+      },
+      {
+        id: "settings",
+        title: "Open settings",
+        detail: "Show the real settings panel in the shell",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          setShowingSettings(true);
+        },
+      },
+      {
+        id: "share",
+        title: "Share current workspace",
+        detail: activeWorkspace().displayName ?? activeWorkspace().name,
+        meta: "Share",
+        action: () => {
+          closeCommandPalette();
+          openMockShareModal(selectedWorkspaceId());
+        },
+      },
+    ];
+
+    const query = commandPaletteQuery().trim().toLowerCase();
+    if (!query) return items;
+    return items.filter((item) => `${item.title} ${item.detail ?? ""}`.toLowerCase().includes(query));
+  });
+
+  const commandPaletteSessionItems = createMemo<CommandPaletteItem[]>(() => {
+    const query = commandPaletteQuery().trim().toLowerCase();
+    const candidates = query
+      ? commandPaletteSessionOptions().filter((item) => item.searchText.includes(query))
+      : commandPaletteSessionOptions();
+
+    return candidates.slice(0, 80).map((item) => ({
+      id: `session:${item.workspaceId}:${item.sessionId}`,
+      title: item.title,
+      detail: item.workspaceTitle,
+      meta: item.workspaceId === selectedWorkspaceId() ? "Current workspace" : "Switch",
+      action: () => {
+        closeCommandPalette();
+        setSelectedWorkspaceId(item.workspaceId);
+        setSelectedSessionId(item.sessionId);
+      },
+    }));
+  });
+
+  const commandPaletteItems = createMemo<CommandPaletteItem[]>(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return commandPaletteSessionItems();
+    return commandPaletteRootItems();
+  });
+
+  const commandPaletteTitle = createMemo(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return "Search sessions";
+    return "Quick actions";
+  });
+
+  const commandPalettePlaceholder = createMemo(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return "Find by session title or workspace";
+    return "Search actions";
+  });
+
+  const runCommandPaletteItem = (item: CommandPaletteItem) => {
+    closeCommandPalette();
+    item.action();
+  };
+
+  createEffect(() => {
+    const onKeyDown = (event: KeyboardEvent) => {
+      if ((event.metaKey || event.ctrlKey) && event.key.toLowerCase() === "k") {
+        event.preventDefault();
+        if (commandPaletteOpen()) {
+          closeCommandPalette();
+        } else {
+          openCommandPalette();
+        }
+        return;
+      }
+
+      if (!commandPaletteOpen()) return;
+
+      if (event.key === "Escape") {
+        event.preventDefault();
+        closeCommandPalette();
+        return;
+      }
+
+      if (event.key === "Backspace" && !commandPaletteQuery().trim() && commandPaletteMode() !== "root") {
+        event.preventDefault();
+        returnToCommandRoot();
+        return;
+      }
+
+      const items = commandPaletteItems();
+      if (event.key === "ArrowDown") {
+        event.preventDefault();
+        if (!items.length) return;
+        setCommandPaletteActiveIndex((index) => (index + 1) % items.length);
+        return;
+      }
+
+      if (event.key === "ArrowUp") {
+        event.preventDefault();
+        if (!items.length) return;
+        setCommandPaletteActiveIndex((index) => (index - 1 + items.length) % items.length);
+        return;
+      }
+
+      if (event.key === "Enter") {
+        event.preventDefault();
+        const item = items[commandPaletteActiveIndex()];
+        if (!item) return;
+        runCommandPaletteItem(item);
+      }
+    };
+    window.addEventListener("keydown", onKeyDown);
+    onCleanup(() => window.removeEventListener("keydown", onKeyDown));
+  });
+
+  createEffect(() => {
+    const items = commandPaletteItems();
+    const index = commandPaletteActiveIndex();
+    if (items.length === 0) {
+      setCommandPaletteActiveIndex(0);
+      return;
+    }
+    if (index >= items.length) {
+      setCommandPaletteActiveIndex(items.length - 1);
+    }
+  });
+
+  createEffect(() => {
+    if (!commandPaletteOpen()) return;
+    const index = commandPaletteActiveIndex();
+    queueMicrotask(() => {
+      commandPaletteOptionRefs[index]?.scrollIntoView({ block: "nearest" });
+    });
+  });
+
+  createEffect(() => {
+    if (!commandPaletteOpen()) return;
+    commandPaletteMode();
+    commandPaletteQuery();
+    commandPaletteOptionRefs.length = 0;
+    setCommandPaletteActiveIndex(0);
+  });
+
+
+
+  return (
+    <div class="h-[100dvh] min-h-screen w-full overflow-hidden bg-[var(--dls-app-bg)] p-3 md:p-4 text-gray-12 font-sans">
+      <div class="flex h-full w-full gap-3 md:gap-4">
+        <aside
+          class="relative hidden lg:flex shrink-0 flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-sidebar p-2.5"
+          style={{
+            width: `${leftSidebarWidth()}px`,
+            "min-width": `${leftSidebarWidth()}px`,
+          }}
+        >
+          <div class="min-h-0 flex-1">
+            <WorkspaceSessionList
+              developerMode
+              workspaceSessionGroups={workspaceSessionGroups}
+              selectedWorkspaceId={selectedWorkspaceId()}
+              selectedSessionId={selectedSessionId()}
+              showSessionActions
+              sessionStatusById={sessionStatusById}
+              connectingWorkspaceId={null}
+              workspaceConnectionStateById={workspaceConnectionStateById}
+              newTaskDisabled={false}
+              importingWorkspaceConfig={false}
+              onSelectWorkspace={(workspaceId) => {
+                setSelectedWorkspaceId(workspaceId);
+                return true;
+              }}
+              onOpenSession={(workspaceId, sessionId) => {
+                setSelectedWorkspaceId(workspaceId);
+                setSelectedSessionId(sessionId);
+              }}
+              onCreateTaskInWorkspace={(workspaceId) => {
+                setSelectedWorkspaceId(workspaceId);
+              }}
+              onOpenRenameSession={() => undefined}
+              onOpenDeleteSession={() => undefined}
+              onOpenRenameWorkspace={() => undefined}
+              onShareWorkspace={(workspaceId) => openMockShareModal(workspaceId)}
+              onRevealWorkspace={() => undefined}
+              onRecoverWorkspace={() => true}
+              onTestWorkspaceConnection={() => true}
+              onEditWorkspaceConnection={() => undefined}
+              onForgetWorkspace={() => undefined}
+              onOpenCreateWorkspace={() => openMockCreateWorkspaceModal()}
+              onOpenCreateRemoteWorkspace={() => undefined}
+              onImportWorkspaceConfig={() => undefined}
+            />
+          </div>
+          <div
+            class="absolute right-0 top-3 hidden h-[calc(100%-24px)] w-2 translate-x-1/2 cursor-col-resize rounded-full bg-transparent transition-colors hover:bg-gray-6/40 lg:block"
+            onPointerDown={startLeftSidebarResize}
+            title="Resize workspace column"
+            aria-label="Resize workspace column"
+          />
+        </aside>
+
+        <main class="min-w-0 flex-1 flex flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+          <header class="z-10 flex h-12 shrink-0 items-center justify-between border-b border-dls-border bg-dls-surface px-4 md:px-6">
+            <div class="flex min-w-0 items-center gap-3">
+              <h1 class="truncate text-[15px] font-semibold text-dls-text">
+                {showingSettings() ? "Settings" : selectedSessionTitle()}
+              </h1>
+              <Show when={showingSettings()}>
+                <span class="hidden truncate text-[13px] text-dls-secondary lg:inline">
+                  {activeWorkspace().displayName ?? activeWorkspace().name}
+                </span>
+              </Show>
+            </div>
+
+            <div class="flex items-center gap-1.5 text-gray-10">
+              <button
+                type="button"
+                class="hidden items-center gap-2 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text sm:flex"
+                onClick={() => openCommandPalette()}
+                title="Open command palette"
+                aria-label="Open command palette"
+              >
+                <span>Palette</span>
+                <span class="ml-1 rounded border border-dls-border px-1 text-[10px] text-gray-9">⌘K</span>
+              </button>
+              <button
+                type="button"
+                class="flex h-9 w-9 items-center justify-center rounded-md text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text"
+                onClick={() => setComposerToast("Story-book: search is mocked in this shell.")}
+                title="Search conversation (Ctrl/Cmd+F)"
+                aria-label="Search conversation"
+              >
+                <Search size={16} />
+              </button>
+              <div class="hidden h-4 w-px bg-dls-border sm:block" />
+              <button
+                type="button"
+                class="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={() => runMockHeaderAction("undo", "undo")}
+                disabled={headerActionBusy() !== null}
+                title="Undo last message"
+                aria-label="Undo last message"
+              >
+                <Show when={headerActionBusy() === "undo"} fallback={<Undo2 size={16} />}>
+                  <span class="h-4 w-4 animate-spin rounded-full border-2 border-gray-8 border-t-transparent" />
+                </Show>
+                <span class="hidden lg:inline">Revert</span>
+              </button>
+              <button
+                type="button"
+                class="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={() => runMockHeaderAction("redo", "redo")}
+                disabled={headerActionBusy() !== null}
+                title="Redo last reverted message"
+                aria-label="Redo last reverted message"
+              >
+                <Show when={headerActionBusy() === "redo"} fallback={<Redo2 size={16} />}>
+                  <span class="h-4 w-4 animate-spin rounded-full border-2 border-gray-8 border-t-transparent" />
+                </Show>
+                <span class="hidden lg:inline">Redo</span>
+              </button>
+              <Show when={showingSettings()}>
+                <div class="hidden h-4 w-px bg-dls-border sm:block" />
+                <button
+                  type="button"
+                  class="flex h-9 w-9 items-center justify-center rounded-md text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text"
+                  onClick={() => setShowingSettings(false)}
+                  title="Close settings"
+                  aria-label="Close settings"
+                >
+                  <X size={18} />
+                </button>
+              </Show>
+            </div>
+          </header>
+
+          <div class="flex-1 min-h-0 overflow-hidden">
+            <div class="h-full overflow-y-auto bg-dls-surface px-4 pt-6 pb-4 sm:px-6 lg:px-10">
+              <div class={showingSettings() ? "w-full" : "mx-auto w-full max-w-[800px]"}>
+                <Show
+                  when={showingSettings()}
+                  fallback={
+                    <MessageList
+                      messages={messageRows()}
+                      developerMode
+                      showThinking={false}
+                      isStreaming={false}
+                      expandedStepIds={expandedStepIds()}
+                      setExpandedStepIds={(updater) => setExpandedStepIds((current) => updater(current))}
+                      workspaceRoot="/Users/benjaminshafii/openwork-enterprise/_repos/openwork"
+                    />
+                  }
+                >
+                  <section class="space-y-6 md:grid md:grid-cols-[220px_minmax(0,1fr)] md:gap-8 md:space-y-0">
+                    <aside class="space-y-6 md:sticky md:top-4 md:self-start">
+                      <div class={settingsRailClass}>
+                        <div class="mb-2 px-2 text-[11px] font-medium uppercase tracking-[0.18em] text-gray-8">
+                          Workspace
+                        </div>
+                        <div class="space-y-1">
+                          <For each={workspaceTabs()}>
+                            {(tab) => (
+                              <button
+                                type="button"
+                                class={`flex w-full items-center justify-between rounded-xl px-3 py-2.5 text-left text-[13px] font-medium transition-colors ${
+                                  settingsTab() === tab
+                                    ? "bg-dls-surface text-dls-text shadow-sm"
+                                    : "text-gray-10 hover:bg-dls-surface/50 hover:text-dls-text"
+                                }`}
+                                onClick={() => setSettingsTab(tab)}
+                              >
+                                <span>{tabLabel(tab)}</span>
+                              </button>
+                            )}
+                          </For>
+                        </div>
+                      </div>
+
+                      <div class={settingsRailClass}>
+                        <div class="mb-2 px-2 text-[11px] font-medium uppercase tracking-[0.18em] text-gray-8">
+                          Global
+                        </div>
+                        <div class="space-y-1">
+                          <For each={globalTabs()}>
+                            {(tab) => (
+                              <button
+                                type="button"
+                                class={`flex w-full items-center justify-between rounded-xl px-3 py-2.5 text-left text-[13px] font-medium transition-colors ${
+                                  settingsTab() === tab
+                                    ? "bg-dls-surface text-dls-text shadow-sm"
+                                    : "text-gray-10 hover:bg-dls-surface/50 hover:text-dls-text"
+                                }`}
+                                onClick={() => setSettingsTab(tab)}
+                              >
+                                <span>{tabLabel(tab)}</span>
+                              </button>
+                            )}
+                          </For>
+                        </div>
+                      </div>
+                    </aside>
+
+                    <div class="min-w-0 space-y-6">
+                      <div class={`${settingsPanelClass} flex flex-col gap-3 md:flex-row md:items-center md:justify-between`}>
+                        <div class="space-y-1">
+                          <h2 class="text-lg font-semibold tracking-tight text-gray-12">
+                            {tabLabel(settingsTab())}
+                          </h2>
+                          <p class="text-sm text-gray-9">
+                            {tabDescription(settingsTab())}
+                          </p>
+                        </div>
+                      </div>
+
+                      <Show when={settingsTab() === "general"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          General settings view mocked here.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "skills"}>
+                        <div class="rounded-[20px] border border-dls-border bg-dls-surface p-6 text-[14px] text-dls-secondary">
+                          Skills (installed, team catalog, GitHub hub) runs in the full app with{" "}
+                          <code class="rounded bg-dls-hover px-1 py-0.5 font-mono text-[12px]">ExtensionsProvider</code>.
+                          Use the OpenWork app shell to exercise this surface.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "extensions"}>
+                        <ExtensionsView
+                          initialSection="all"
+                          setDashboardTab={() => undefined}
+                          busy={false}
+                          selectedWorkspaceRoot={selectedWorkspaceRoot()}
+                          isRemoteWorkspace={activeWorkspace().workspaceType === "remote"}
+                          refreshMcpServers={refreshMcpServers}
+                          mcpServers={storyMcpServers()}
+                          mcpStatus="Story-book MCP sandbox ready."
+                          mcpLastUpdatedAt={now}
+                          mcpConnectingName={null}
+                          selectedMcp={selectedMcp()}
+                          setSelectedMcp={setSelectedMcp}
+                          quickConnect={MCP_QUICK_CONNECT}
+                          connectMcp={connectMcp}
+                          authorizeMcp={authorizeMcp}
+                          logoutMcpAuth={logoutMcpAuth}
+                          removeMcp={removeMcp}
+                          showMcpReloadBanner={false}
+                          reloadBlocked={false}
+                          reloadMcpEngine={() => setComposerToast("Story-book: reloaded MCP engine.")}
+                          canEditPlugins={true}
+                          canUseGlobalScope={true}
+                          accessHint={null}
+                          pluginScope={pluginScope()}
+                          setPluginScope={setPluginScope}
+                          pluginConfigPath={`${selectedWorkspaceRoot() || "."}/opencode.json`}
+                          pluginList={pluginList()}
+                          pluginInput={pluginInput()}
+                          setPluginInput={setPluginInput}
+                          pluginStatus={pluginStatus()}
+                          activePluginGuide={activePluginGuide()}
+                          setActivePluginGuide={setActivePluginGuide}
+                          isPluginInstalled={isPluginInstalled}
+                          suggestedPlugins={SUGGESTED_PLUGINS}
+                          refreshPlugins={refreshPlugins}
+                          addPlugin={addPlugin}
+                          removePlugin={removePlugin}
+                        />
+                      </Show>
+
+                      <Show when={settingsTab() === "messaging"}>
+                        <div class="space-y-4">
+                          <IdentitiesView
+                            busy={false}
+                            openworkServerStatus="connected"
+                            openworkServerUrl="https://worker.openworklabs.com/opencode"
+                            openworkServerClient={mockOpenworkServerClient}
+                            openworkReconnectBusy={false}
+                            reconnectOpenworkServer={async () => true}
+                            restartLocalServer={async () => true}
+                            runtimeWorkspaceId={selectedWorkspaceId()}
+                            selectedWorkspaceRoot={selectedWorkspaceRoot()}
+                            developerMode
+                          />
+                          <Show when={selectedWorkspaceId() === remoteWorkspace.id}>
+                            <div class="rounded-[20px] border border-dls-border bg-dls-surface p-3 shadow-[var(--dls-card-shadow)] text-sm text-dls-secondary">
+                              Remote inbox preview has been removed from the app shell.
+                            </div>
+                          </Show>
+                          <Show when={selectedWorkspaceId() !== remoteWorkspace.id}>
+                            <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                              Switch to the remote workspace to preview the inbox panel inside Messaging.
+                            </div>
+                          </Show>
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "den"}>
+                        <DenSettingsPanel
+                          developerMode
+                          connectRemoteWorkspace={async () => true}
+                        />
+                      </Show>
+
+                      <Show when={settingsTab() === "model"}>
+                        <div class="space-y-4">
+                          <div class="rounded-[20px] border border-dls-border bg-dls-surface p-4 shadow-[var(--dls-card-shadow)] space-y-3">
+                            <div>
+                              <div class="text-sm font-medium text-dls-text">Model preferences</div>
+                              <div class="text-xs text-dls-secondary mt-1">
+                                This preview mirrors the default model and reasoning controls from the app picker.
+                              </div>
+                            </div>
+                            <div class="rounded-2xl border border-dls-border bg-dls-sidebar px-4 py-3 flex items-center justify-between gap-3">
+                              <div class="min-w-0">
+                                <div class="text-sm text-dls-text truncate">{selectedModelLabel()}</div>
+                                <div class="text-xs text-dls-secondary truncate">
+                                  {selectedModel().providerID}/{selectedModel().modelID}
+                                </div>
+                              </div>
+                              <Button variant="outline" onClick={() => openModelPicker("default")}>
+                                Open picker
+                              </Button>
+                            </div>
+                            <div class="rounded-2xl border border-dls-border bg-dls-sidebar px-4 py-3">
+                              <div class="text-sm text-dls-text">{selectedBehavior().title}</div>
+                              <div class="mt-1 text-xs font-medium text-dls-text">{selectedBehavior().label}</div>
+                              <div class="mt-1 text-xs text-dls-secondary">{selectedBehavior().description}</div>
+                            </div>
+                          </div>
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "advanced"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          Advanced settings view mocked here.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "appearance"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          Appearance settings view mocked here.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "updates"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          Updates settings view mocked here.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "recovery"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          Recovery settings view mocked here.
+                        </div>
+                      </Show>
+
+                      <Show when={settingsTab() === "debug"}>
+                        <div class={`${settingsPanelSoftClass} text-sm text-dls-secondary`}>
+                          Debug settings view mocked here.
+                        </div>
+                      </Show>
+                    </div>
+                  </section>
+                </Show>
+              </div>
+            </div>
+          </div>
+
+          <Show when={!showingSettings()}>
+            <Composer
+              prompt={composerPrompt()}
+              draftMode="prompt"
+              draftScopeKey="story-book-new-layout-composer"
+              developerMode
+              busy={false}
+              isStreaming={false}
+              onSend={handleSend}
+              onStop={() => undefined}
+              onDraftChange={handleDraftChange}
+              selectedModelLabel={selectedModelLabel()}
+              onModelClick={() => openModelPicker("session")}
+              modelVariantLabel={`${selectedBehavior().title} · ${selectedBehavior().label}`}
+              modelVariant={modelVariant()}
+              modelBehaviorOptions={selectedBehavior().options}
+              onModelVariantChange={(value) => setModelVariant(value)}
+              agentLabel={agentLabel()}
+              selectedAgent={selectedAgent()}
+              agentPickerOpen={agentPickerOpen()}
+              agentPickerBusy={false}
+              agentPickerError={null}
+              agentOptions={[]}
+              onToggleAgentPicker={() => setAgentPickerOpen((current) => !current)}
+              onSelectAgent={(agent) => {
+                setSelectedAgent(agent);
+                setAgentPickerOpen(false);
+              }}
+              setAgentPickerRef={() => undefined}
+              notice={composerToast() ? { title: composerToast() } : null}
+              onNotice={(notice) => setComposerToast(notice.title)}
+              listAgents={async () => []}
+              recentFiles={workingFiles}
+              searchFiles={async (query) => {
+                const normalized = query.trim().toLowerCase();
+                if (!normalized) return workingFiles.slice(0, 8);
+                return workingFiles.filter((path) => path.toLowerCase().includes(normalized)).slice(0, 8);
+              }}
+              isRemoteWorkspace={selectedWorkspaceId() === remoteWorkspace.id}
+              isSandboxWorkspace={selectedWorkspaceId() === remoteWorkspace.id}
+              attachmentsEnabled
+              attachmentsDisabledReason={null}
+              skills={[]}
+              listCommands={async () => commandOptions}
+              onOpenSettings={() => undefined}
+            />
+          </Show>
+
+          <StatusBar
+            clientConnected
+            openworkServerStatus="connected"
+            developerMode
+            settingsOpen={showingSettings()}
+            showSettingsButton={true}
+            onSendFeedback={() => undefined}
+            onOpenSettings={() => {
+              setSettingsTab("general");
+              setShowingSettings((prev) => !prev);
+            }}
+            providerConnectedIds={["anthropic", "openai"]}
+            statusLabel="Session Ready"
+          />
+        </main>
+      </div>
+
+      <Show when={commandPaletteOpen()}>
+        <div
+          class="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-start justify-center p-4 overflow-y-auto"
+          onClick={closeCommandPalette}
+        >
+          <div
+            class="w-full max-w-2xl mt-12 rounded-2xl border border-dls-border bg-dls-surface shadow-2xl overflow-hidden"
+            onClick={(event) => event.stopPropagation()}
+          >
+            <div class="border-b border-dls-border px-4 py-3 space-y-2">
+              <div class="flex items-center gap-2">
+                <Show when={commandPaletteMode() !== "root"}>
+                  <button
+                    type="button"
+                    class="h-8 px-2 rounded-md text-xs text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors"
+                    onClick={returnToCommandRoot}
+                  >
+                    Back
+                  </button>
+                </Show>
+                <Search size={14} class="text-dls-secondary shrink-0" />
+                <input
+                  ref={(el) => (commandPaletteInputEl = el)}
+                  type="text"
+                  value={commandPaletteQuery()}
+                  onInput={(event) => {
+                    setCommandPaletteQuery(event.currentTarget.value);
+                    setCommandPaletteActiveIndex(0);
+                  }}
+                  placeholder={commandPalettePlaceholder()}
+                  class="min-w-0 flex-1 bg-transparent text-sm text-dls-text placeholder:text-dls-secondary focus:outline-none"
+                  aria-label={commandPaletteTitle()}
+                />
+                <button
+                  type="button"
+                  class="h-8 w-8 flex items-center justify-center rounded-md text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors"
+                  onClick={closeCommandPalette}
+                  aria-label="Close quick actions"
+                >
+                  <X size={14} />
+                </button>
+              </div>
+              <div class="text-[11px] text-dls-secondary">{commandPaletteTitle()}</div>
+            </div>
+
+            <div class="max-h-[56vh] overflow-y-auto p-2">
+              <Show
+                when={commandPaletteItems().length > 0}
+                fallback={<div class="px-3 py-6 text-sm text-dls-secondary text-center">No matches.</div>}
+              >
+                <For each={commandPaletteItems()}>
+                  {(item, idx) => (
+                    <button
+                      ref={(el) => {
+                        commandPaletteOptionRefs[idx()] = el;
+                      }}
+                      type="button"
+                      class={`w-full text-left rounded-xl px-3 py-2.5 transition-colors ${
+                        idx() === commandPaletteActiveIndex()
+                          ? "bg-dls-active text-dls-text"
+                          : "text-dls-text hover:bg-dls-hover"
+                      }`}
+                      onMouseEnter={() => setCommandPaletteActiveIndex(idx())}
+                      onClick={() => runCommandPaletteItem(item)}
+                    >
+                      <div class="flex items-start justify-between gap-3">
+                        <div class="min-w-0">
+                          <div class="text-sm font-medium truncate">{item.title}</div>
+                          <Show when={item.detail}>
+                            <div class="text-xs text-dls-secondary mt-1 truncate">{item.detail}</div>
+                          </Show>
+                        </div>
+                        <Show when={item.meta}>
+                          <span class="text-[10px] uppercase tracking-wide text-dls-secondary shrink-0">
+                            {item.meta}
+                          </span>
+                        </Show>
+                      </div>
+                    </button>
+                  )}
+                </For>
+              </Show>
+            </div>
+
+            <div class="border-t border-dls-border px-3 py-2 text-[11px] text-dls-secondary flex items-center justify-between gap-2">
+              <span>Arrow keys to navigate</span>
+              <span>Enter to run · Esc to close</span>
+            </div>
+          </div>
+        </div>
+      </Show>
+
+      <ShareWorkspaceModal
+        open={Boolean(shareWorkspaceId())}
+        onClose={() => setShareWorkspaceId(null)}
+        workspaceName={shareWorkspaceName()}
+        workspaceDetail={shareWorkspaceDetail()}
+        fields={[...mockShareFields]}
+        note="This is the real share modal from the app, mounted with safe mock values for shell review."
+        onExportConfig={() => setComposerToast("Story-book: export config is mocked in this shell.")}
+        exportDisabledReason={null}
+        onOpenBots={() => setComposerToast("Story-book: bots sharing flow is mocked in this shell.")}
+      />
+
+      <CreateWorkspaceModal
+        open={createWorkspaceOpen()}
+        onClose={() => {
+          if (createWorkspaceSubmitting()) return;
+          setCreateWorkspaceOpen(false);
+        }}
+        onConfirm={confirmMockWorkspaceCreate}
+        onPickFolder={pickMockWorkspaceFolder}
+        submitting={createWorkspaceSubmitting()}
+      />
+
+      <ModelPickerModal
+        open={modelPickerOpen()}
+        options={storyModelOptions()}
+        filteredOptions={filteredStoryModelOptions()}
+        query={modelPickerQuery()}
+        setQuery={setModelPickerQuery}
+        target={modelPickerTarget()}
+        current={selectedModel()}
+        onSelect={applyStoryModelSelection}
+        onBehaviorChange={(model, value) => {
+          if (model.providerID !== selectedModel().providerID || model.modelID !== selectedModel().modelID) return;
+          const entry = storyModels.find((item) => item.ref.providerID === model.providerID && item.ref.modelID === model.modelID);
+          if (!entry) return;
+          setModelVariant(sanitizeModelBehaviorValue(model.providerID, entry.model, value) ?? null);
+        }}
+        onOpenSettings={() => {
+          setModelPickerOpen(false);
+          setShowingSettings(true);
+        }}
+        onClose={() => setModelPickerOpen(false)}
+      />
+    </div>
+  );
+}
diff --git a/apps/story-book/src/story-book.tsx b/apps/story-book/src/story-book.tsx
new file mode 100644
index 0000000000..4c7e9302c0
--- /dev/null
+++ b/apps/story-book/src/story-book.tsx
@@ -0,0 +1,1224 @@
+import { For, Show, createEffect, createMemo, createSignal, onCleanup } from "solid-js";
+import type { Component, JSX } from "solid-js";
+import {
+  Box,
+  ChevronLeft,
+  ChevronRight,
+  MessageCircle,
+  Redo2,
+  Search,
+  SlidersHorizontal,
+  Undo2,
+  X,
+  Zap,
+} from "lucide-solid";
+
+import Button from "../../app/src/app/components/button";
+import DenSettingsPanel from "../../app/src/app/components/den-settings-panel";
+import ModelPickerModal from "../../app/src/app/components/model-picker-modal";
+import StatusBar from "../../app/src/app/components/status-bar";
+import Composer from "../../app/src/app/components/session/composer";
+import MessageList from "../../app/src/app/components/session/message-list";
+import WorkspaceSessionList from "../../app/src/app/components/session/workspace-session-list";
+import {
+  CreateWorkspaceModal,
+  ShareWorkspaceModal,
+} from "../../app/src/app/workspace";
+import { createWorkspaceShellLayout } from "../../app/src/app/lib/workspace-shell-layout";
+import { getModelBehaviorSummary, sanitizeModelBehaviorValue } from "../../app/src/app/lib/model-behavior";
+import {
+  applyThemeMode,
+  getInitialThemeMode,
+  persistThemeMode,
+  subscribeToSystemTheme,
+  type ThemeMode,
+} from "../../app/src/app/theme";
+import type {
+  ComposerDraft,
+  McpStatusMap,
+  MessageWithParts,
+  ModelOption,
+  ModelRef,
+  ProviderListItem,
+  SlashCommandOption,
+  WorkspaceConnectionState,
+  WorkspacePreset,
+  WorkspaceSessionGroup,
+} from "../../app/src/app/types";
+import { sessionMessages, storyWorkspaces } from "./mock-data";
+
+type RightRailNav = "skills" | "extensions" | "messaging" | "advanced";
+type CommandPaletteMode = "root" | "sessions";
+
+type CommandPaletteItem = {
+  id: string;
+  title: string;
+  detail?: string;
+  meta?: string;
+  action: () => void;
+};
+
+const localWorkspace = storyWorkspaces[0] ?? {
+  id: "local-foundation",
+  name: "Local Foundation",
+  displayName: "OpenWork App",
+  path: "~/OpenWork/app",
+  preset: "starter",
+  workspaceType: "local" as const,
+};
+
+const remoteWorkspace = storyWorkspaces[1] ?? {
+  id: "remote-worker",
+  name: "Remote Worker",
+  displayName: "Ops Worker",
+  path: "remote://ops-worker",
+  preset: "automation",
+  workspaceType: "remote" as const,
+  remoteType: "openwork" as const,
+  baseUrl: "https://worker.openworklabs.com/opencode",
+  openworkHostUrl: "https://worker.openworklabs.com",
+  openworkWorkspaceName: "Ops Worker",
+  sandboxBackend: "docker" as const,
+  sandboxContainerName: "openwork-ops-worker",
+};
+
+const now = Date.now();
+
+const workspaceSessionGroups: WorkspaceSessionGroup[] = [
+  {
+    workspace: localWorkspace,
+    status: "ready",
+    sessions: [
+      {
+        id: "sb-session-shell",
+        title: "Story shell parity with session.tsx",
+        slug: "story-shell-parity",
+        time: { updated: now - 2 * 60 * 1000, created: now - 22 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-provider",
+        title: "Provider states and status rail",
+        slug: "provider-states",
+        time: { updated: now - 18 * 60 * 1000, created: now - 56 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-mobile",
+        title: "Mobile shell spacing pass",
+        slug: "mobile-shell-pass",
+        time: { updated: now - 56 * 60 * 1000, created: now - 3 * 60 * 60 * 1000 },
+      },
+    ],
+  },
+  {
+    workspace: remoteWorkspace,
+    status: "ready",
+    sessions: [
+      {
+        id: "sb-session-remote",
+        title: "Remote worker onboarding",
+        slug: "remote-worker-onboarding",
+        time: { updated: now - 7 * 60 * 1000, created: now - 2 * 60 * 60 * 1000 },
+      },
+      {
+        id: "sb-session-inbox",
+        title: "Inbox upload behavior",
+        slug: "inbox-upload",
+        time: { updated: now - 35 * 60 * 1000, created: now - 6 * 60 * 60 * 1000 },
+      },
+    ],
+  },
+];
+
+const workspaceConnectionStateById: Record<string, WorkspaceConnectionState> = {
+  [localWorkspace.id]: { status: "connected", message: "Local engine ready" },
+  [remoteWorkspace.id]: { status: "connected", message: "Connected via token" },
+};
+
+const sessionStatusById: Record<string, string> = {
+  "sb-session-shell": "running",
+  "sb-session-provider": "idle",
+  "sb-session-mobile": "idle",
+  "sb-session-remote": "idle",
+  "sb-session-inbox": "idle",
+};
+
+const mcpStatuses: McpStatusMap = {
+  browser: { status: "connected" },
+  notion: { status: "connected" },
+  linear: { status: "needs_auth" },
+};
+
+const workingFiles = [
+  "apps/story-book/src/story-book.tsx",
+  "apps/app/src/app/pages/session.tsx",
+  "apps/app/src/app/components/session/workspace-session-list.tsx",
+  "apps/app/src/app/components/session/inbox-panel.tsx",
+];
+
+const commandOptions: SlashCommandOption[] = [
+  { id: "design-review", name: "design-review", description: "Open a design review pass", source: "command" },
+  { id: "test-flow", name: "test-flow", description: "Run shell flow checks", source: "skill" },
+];
+
+const storyModels: Array<{
+  ref: ModelRef;
+  title: string;
+  description: string;
+  isConnected: boolean;
+  model: ProviderListItem["models"][string];
+}> = [
+  {
+    ref: { providerID: "anthropic", modelID: "claude-sonnet-4-5-20250929" },
+    title: "Claude Sonnet 4.5",
+    description: "Anthropic",
+    isConnected: true,
+    model: {
+      id: "claude-sonnet-4-5-20250929",
+      name: "Claude Sonnet 4.5",
+      reasoning: true,
+      variants: { high: {}, max: {} },
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "openai", modelID: "gpt-5" },
+    title: "GPT-5",
+    description: "OpenAI",
+    isConnected: true,
+    model: {
+      id: "gpt-5",
+      name: "GPT-5",
+      reasoning: true,
+      variants: { none: {}, minimal: {}, low: {}, medium: {}, high: {}, xhigh: {} },
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "deepseek", modelID: "deepseek-r1" },
+    title: "DeepSeek R1",
+    description: "DeepSeek",
+    isConnected: true,
+    model: {
+      id: "deepseek-r1",
+      name: "DeepSeek R1",
+      reasoning: true,
+      variants: {},
+    } as unknown as ProviderListItem["models"][string],
+  },
+  {
+    ref: { providerID: "openrouter", modelID: "grok-4" },
+    title: "Grok 4",
+    description: "OpenRouter",
+    isConnected: false,
+    model: {
+      id: "grok-4",
+      name: "Grok 4",
+      reasoning: false,
+      variants: {},
+    } as unknown as ProviderListItem["models"][string],
+  },
+];
+
+const mockShareFields = [
+  {
+    label: "Worker URL",
+    value: "https://worker.openworklabs.com/opencode",
+    hint: "Paste this into Add worker -> Connect remote.",
+  },
+  {
+    label: "Password",
+    value: "ow_story_worker_owner_password_7f9a1b3c",
+    secret: true,
+    hint: "Use when the remote client must answer permission prompts.",
+  },
+  {
+    label: "Collaborator token",
+    value: "ow_story_worker_collab_token_1c4d2e8a",
+    secret: true,
+    hint: "Routine access when you do not need owner-only actions.",
+  },
+] as const;
+
+function toMessageParts(id: string, role: "user" | "assistant", text: string): MessageWithParts {
+  return {
+    info: {
+      id,
+      sessionID: "story-shell-session",
+      role,
+      time: { created: Date.now() },
+    } as MessageWithParts["info"],
+    parts: [{ type: "text", text } as MessageWithParts["parts"][number]],
+  };
+}
+
+const RightRailButton: Component<{
+  label: string;
+  icon: JSX.Element;
+  active: boolean;
+  expanded: boolean;
+  onClick: () => void;
+}> = (props) => (
+  <button
+    type="button"
+    class={`flex h-10 w-full items-center rounded-xl px-2.5 text-sm transition-colors ${
+      props.active
+        ? "bg-dls-surface text-dls-text shadow-[var(--dls-card-shadow)]"
+        : "text-gray-10 hover:bg-gray-2/70 hover:text-dls-text"
+    }`}
+    onClick={props.onClick}
+    title={props.label}
+    aria-label={props.label}
+  >
+    <span class={`inline-flex h-8 w-8 shrink-0 items-center justify-center ${props.active ? "text-dls-text" : "text-gray-9"}`}>
+      {props.icon}
+    </span>
+    <Show when={props.expanded}>
+      <span class="truncate">{props.label}</span>
+    </Show>
+  </button>
+);
+
+export default function StoryBookApp() {
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = createSignal(localWorkspace.id);
+  const [selectedSessionId, setSelectedSessionId] = createSignal<string | null>("sb-session-shell");
+  const [rightRailNav, setRightRailNav] = createSignal<RightRailNav>("skills");
+  const [themeMode] = createSignal<ThemeMode>(getInitialThemeMode());
+  const [composerPrompt, setComposerPrompt] = createSignal(
+    "Use this mock shell to design layout changes before touching the live session runtime.",
+  );
+  const [composerToast, setComposerToast] = createSignal<string | null>(null);
+  const [selectedAgent, setSelectedAgent] = createSignal<string | null>(null);
+  const [selectedModel, setSelectedModel] = createSignal<ModelRef>(storyModels[0].ref);
+  const [modelVariant, setModelVariant] = createSignal<string | null>("medium");
+  const [modelPickerOpen, setModelPickerOpen] = createSignal(false);
+  const [modelPickerTarget, setModelPickerTarget] = createSignal<"default" | "session">("session");
+  const [modelPickerQuery, setModelPickerQuery] = createSignal("");
+  const [createWorkspaceOpen, setCreateWorkspaceOpen] = createSignal(false);
+  const [createWorkspaceSubmitting, setCreateWorkspaceSubmitting] = createSignal(false);
+  const [mockFolderPickCount, setMockFolderPickCount] = createSignal(0);
+  const [agentPickerOpen, setAgentPickerOpen] = createSignal(false);
+  const [shareWorkspaceId, setShareWorkspaceId] = createSignal<string | null>(null);
+  const [messageRows, setMessageRows] = createSignal<MessageWithParts[]>(sessionMessages);
+  const [expandedStepIds, setExpandedStepIds] = createSignal(new Set<string>());
+  const [headerActionBusy, setHeaderActionBusy] = createSignal<"undo" | "redo" | "compact" | null>(null);
+  const [commandPaletteOpen, setCommandPaletteOpen] = createSignal(false);
+  const [commandPaletteMode, setCommandPaletteMode] = createSignal<CommandPaletteMode>("root");
+  const [commandPaletteQuery, setCommandPaletteQuery] = createSignal("");
+  const [commandPaletteActiveIndex, setCommandPaletteActiveIndex] = createSignal(0);
+  let commandPaletteInputEl: HTMLInputElement | undefined;
+  const commandPaletteOptionRefs: HTMLButtonElement[] = [];
+
+  const {
+    leftSidebarWidth,
+    rightSidebarExpanded,
+    rightSidebarWidth,
+    startLeftSidebarResize,
+    toggleRightSidebar,
+  } = createWorkspaceShellLayout({ expandedRightWidth: 320 });
+
+  createEffect(() => {
+    const mode = themeMode();
+    persistThemeMode(mode);
+    applyThemeMode(mode);
+  });
+
+  createEffect(() => {
+    const unsubscribeSystemTheme = subscribeToSystemTheme(() => {
+      if (themeMode() === "system") {
+        applyThemeMode("system");
+      }
+    });
+    onCleanup(() => unsubscribeSystemTheme());
+  });
+
+  const selectedSessionTitle = createMemo(() => {
+    const target = selectedSessionId();
+    if (!target) return "New session";
+    for (const group of workspaceSessionGroups) {
+      const found = group.sessions.find((session) => session.id === target);
+      if (found) return found.title;
+    }
+    return "New session";
+  });
+  const showingSettings = createMemo(() => rightRailNav() === "advanced");
+  const activeWorkspace = createMemo(
+    () => workspaceSessionGroups.find((group) => group.workspace.id === selectedWorkspaceId())?.workspace ?? localWorkspace,
+  );
+  const shareWorkspace = createMemo(
+    () => storyWorkspaces.find((workspace) => workspace.id === shareWorkspaceId()) ?? null,
+  );
+  const shareWorkspaceName = createMemo(
+    () => shareWorkspace()?.displayName?.trim() || shareWorkspace()?.name?.trim() || "Workspace",
+  );
+  const shareWorkspaceDetail = createMemo(() => {
+    const workspace = shareWorkspace();
+    if (!workspace) return null;
+    if (workspace.workspaceType === "remote") return workspace.baseUrl ?? workspace.path ?? null;
+    return workspace.path ?? null;
+  });
+
+  const agentLabel = createMemo(() => {
+    const name = selectedAgent() ?? "Default agent";
+    return name.charAt(0).toUpperCase() + name.slice(1);
+  });
+
+  const selectedStoryModel = createMemo(
+    () => storyModels.find((entry) => entry.ref.providerID === selectedModel().providerID && entry.ref.modelID === selectedModel().modelID)
+      ?? storyModels[0],
+  );
+
+  const selectedBehavior = createMemo(() =>
+    getModelBehaviorSummary(
+      selectedStoryModel().ref.providerID,
+      selectedStoryModel().model,
+      modelVariant(),
+    ),
+  );
+
+  const selectedModelLabel = createMemo(() => selectedStoryModel().title);
+
+  const storyModelOptions = createMemo<ModelOption[]>(() =>
+    storyModels.map((entry) => {
+      const behavior = getModelBehaviorSummary(entry.ref.providerID, entry.model, modelVariant());
+      return {
+        providerID: entry.ref.providerID,
+        modelID: entry.ref.modelID,
+        title: entry.title,
+        description: entry.description,
+        footer: entry.ref.providerID === selectedModel().providerID && entry.ref.modelID === selectedModel().modelID
+          ? "Current model"
+          : undefined,
+        behaviorTitle: behavior.title,
+        behaviorLabel: behavior.label,
+        behaviorDescription: behavior.description,
+        behaviorValue: sanitizeModelBehaviorValue(entry.ref.providerID, entry.model, modelVariant()),
+        behaviorOptions: behavior.options,
+        isFree: false,
+        isConnected: entry.isConnected,
+        isRecommended: entry.title.includes("GPT-5") || entry.title.includes("Claude") || entry.title.includes("DeepSeek"),
+      };
+    }),
+  );
+
+  const filteredStoryModelOptions = createMemo(() => {
+    const query = modelPickerQuery().trim().toLowerCase();
+    if (!query) return storyModelOptions();
+    return storyModelOptions().filter((option) =>
+      [
+        option.title,
+        option.description ?? "",
+        option.footer ?? "",
+        option.behaviorTitle,
+        option.behaviorLabel,
+        option.behaviorDescription,
+        `${option.providerID}/${option.modelID}`,
+      ]
+        .join(" ")
+        .toLowerCase()
+        .includes(query),
+    );
+  });
+
+  const openModelPicker = (target: "default" | "session" = "session") => {
+    setModelPickerTarget(target);
+    setModelPickerQuery("");
+    setModelPickerOpen(true);
+  };
+
+  const openMockCreateWorkspaceModal = () => {
+    setCreateWorkspaceSubmitting(false);
+    setCreateWorkspaceOpen(true);
+  };
+
+  const pickMockWorkspaceFolder = async () => {
+    const folders = [
+      "/Users/demo/OpenWork/client-foundation",
+      "/Users/demo/OpenWork/automation-lab",
+      "/Users/demo/OpenWork/starter-sandbox",
+    ];
+    const next = folders[mockFolderPickCount() % folders.length] ?? folders[0];
+    setMockFolderPickCount((count) => count + 1);
+    await new Promise((resolve) => window.setTimeout(resolve, 180));
+    return next;
+  };
+
+  const confirmMockWorkspaceCreate = (preset: WorkspacePreset, folder: string | null) => {
+    if (!folder || createWorkspaceSubmitting()) return;
+    setCreateWorkspaceSubmitting(true);
+    window.setTimeout(() => {
+      setCreateWorkspaceSubmitting(false);
+      setCreateWorkspaceOpen(false);
+      setComposerToast(`Story-book: create workspace is mocked with preset \"${preset}\" at ${folder}.`);
+    }, 320);
+  };
+
+  const applyStoryModelSelection = (next: ModelRef) => {
+    const entry = storyModels.find((item) => item.ref.providerID === next.providerID && item.ref.modelID === next.modelID);
+    setSelectedModel(next);
+    if (entry) {
+      setModelVariant(sanitizeModelBehaviorValue(next.providerID, entry.model, modelVariant()) ?? null);
+    }
+    setModelPickerOpen(false);
+  };
+
+  const handleDraftChange = (draft: ComposerDraft) => {
+    setComposerPrompt(draft.text);
+  };
+
+  const handleSend = (draft: ComposerDraft) => {
+    const text = (draft.resolvedText ?? draft.text ?? "").trim();
+    if (!text) return;
+    const nowStamp = Date.now();
+    setMessageRows((current) => [
+      ...current,
+      toMessageParts(`sb-user-${nowStamp}`, "user", text),
+      toMessageParts(
+        `sb-assistant-${nowStamp}`,
+        "assistant",
+        "Story-book mock response: message accepted. This uses app MessageList + Composer with local mock state.",
+      ),
+    ]);
+    setComposerPrompt("");
+  };
+
+  const runMockHeaderAction = (action: "undo" | "redo" | "compact", label: string) => {
+    if (headerActionBusy()) return;
+    setHeaderActionBusy(action);
+    setComposerToast(`Story-book: ${label} is mocked in this shell.`);
+    window.setTimeout(() => setHeaderActionBusy(null), 240);
+  };
+
+  const openMockShareModal = (workspaceId?: string | null) => {
+    const nextId = workspaceId?.trim() || selectedWorkspaceId();
+    setShareWorkspaceId(nextId);
+  };
+
+  const totalSessionCount = createMemo(() =>
+    workspaceSessionGroups.reduce((count, group) => count + group.sessions.length, 0),
+  );
+
+  const commandPaletteSessionOptions = createMemo(() => {
+    const out: Array<{
+      workspaceId: string;
+      sessionId: string;
+      title: string;
+      workspaceTitle: string;
+      updatedAt: number;
+      searchText: string;
+    }> = [];
+
+    for (const group of workspaceSessionGroups) {
+      const workspaceId = group.workspace.id?.trim() ?? "";
+      if (!workspaceId) continue;
+      const workspaceTitle = group.workspace.displayName?.trim() || group.workspace.name;
+      for (const session of group.sessions) {
+        const sessionId = session.id?.trim() ?? "";
+        if (!sessionId) continue;
+        const title = session.title;
+        const updatedAt = session.time?.updated ?? session.time?.created ?? 0;
+        out.push({
+          workspaceId,
+          sessionId,
+          title,
+          workspaceTitle,
+          updatedAt,
+          searchText: `${title} ${workspaceTitle}`.toLowerCase(),
+        });
+      }
+    }
+
+    out.sort((a, b) => b.updatedAt - a.updatedAt);
+    return out;
+  });
+
+  const focusCommandPaletteInput = () => {
+    queueMicrotask(() => {
+      commandPaletteInputEl?.focus();
+      commandPaletteInputEl?.select();
+    });
+  };
+
+  const openCommandPalette = (mode: CommandPaletteMode = "root") => {
+    setCommandPaletteMode(mode);
+    setCommandPaletteOpen(true);
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+    focusCommandPaletteInput();
+  };
+
+  const closeCommandPalette = () => {
+    setCommandPaletteOpen(false);
+    setCommandPaletteMode("root");
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+  };
+
+  const returnToCommandRoot = () => {
+    if (commandPaletteMode() === "root") return;
+    setCommandPaletteMode("root");
+    setCommandPaletteQuery("");
+    setCommandPaletteActiveIndex(0);
+    focusCommandPaletteInput();
+  };
+
+  const commandPaletteRootItems = createMemo<CommandPaletteItem[]>(() => {
+    const selectedTitle = selectedSessionTitle().trim() || "Give your selected session a clearer name";
+    const items: CommandPaletteItem[] = [
+      {
+        id: "new-session",
+        title: "Create new session",
+        detail: "Start a fresh task in the current workspace",
+        meta: "Create",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: create new session is mocked in this shell.");
+        },
+      },
+      {
+        id: "workspace",
+        title: "Create workspace",
+        detail: "Open the real workspace-creation modal in the shell",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          openMockCreateWorkspaceModal();
+        },
+      },
+      {
+        id: "rename-session",
+        title: "Rename current session",
+        detail: selectedTitle,
+        meta: "Rename",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: rename session flow is mocked in this shell.");
+        },
+      },
+      {
+        id: "sessions",
+        title: "Search sessions",
+        detail: `${totalSessionCount().toLocaleString()} available across workspaces`,
+        meta: "Jump",
+        action: () => {
+          setCommandPaletteMode("sessions");
+          setCommandPaletteQuery("");
+          setCommandPaletteActiveIndex(0);
+          focusCommandPaletteInput();
+        },
+      },
+      {
+        id: "model",
+        title: "Change model",
+        detail: `${selectedModelLabel()} · ${selectedBehavior().label}`,
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          openModelPicker("session");
+        },
+      },
+      {
+        id: "provider",
+        title: "Connect provider",
+        detail: "Open provider connection flow",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          setComposerToast("Story-book: provider connection flow is mocked in this shell.");
+        },
+      },
+      {
+        id: "settings",
+        title: "Open settings",
+        detail: "Show the real settings panel in the shell",
+        meta: "Open",
+        action: () => {
+          closeCommandPalette();
+          if (!rightSidebarExpanded()) toggleRightSidebar();
+          setRightRailNav("advanced");
+        },
+      },
+      {
+        id: "share",
+        title: "Share current workspace",
+        detail: activeWorkspace().displayName ?? activeWorkspace().name,
+        meta: "Share",
+        action: () => {
+          closeCommandPalette();
+          openMockShareModal(selectedWorkspaceId());
+        },
+      },
+    ];
+
+    const query = commandPaletteQuery().trim().toLowerCase();
+    if (!query) return items;
+    return items.filter((item) => `${item.title} ${item.detail ?? ""}`.toLowerCase().includes(query));
+  });
+
+  const commandPaletteSessionItems = createMemo<CommandPaletteItem[]>(() => {
+    const query = commandPaletteQuery().trim().toLowerCase();
+    const candidates = query
+      ? commandPaletteSessionOptions().filter((item) => item.searchText.includes(query))
+      : commandPaletteSessionOptions();
+
+    return candidates.slice(0, 80).map((item) => ({
+      id: `session:${item.workspaceId}:${item.sessionId}`,
+      title: item.title,
+      detail: item.workspaceTitle,
+      meta: item.workspaceId === selectedWorkspaceId() ? "Current workspace" : "Switch",
+      action: () => {
+        closeCommandPalette();
+        setSelectedWorkspaceId(item.workspaceId);
+        setSelectedSessionId(item.sessionId);
+      },
+    }));
+  });
+
+  const commandPaletteItems = createMemo<CommandPaletteItem[]>(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return commandPaletteSessionItems();
+    return commandPaletteRootItems();
+  });
+
+  const commandPaletteTitle = createMemo(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return "Search sessions";
+    return "Quick actions";
+  });
+
+  const commandPalettePlaceholder = createMemo(() => {
+    const mode = commandPaletteMode();
+    if (mode === "sessions") return "Find by session title or workspace";
+    return "Search actions";
+  });
+
+  const runCommandPaletteItem = (item: CommandPaletteItem) => {
+    closeCommandPalette();
+    item.action();
+  };
+
+  createEffect(() => {
+    const onKeyDown = (event: KeyboardEvent) => {
+      if ((event.metaKey || event.ctrlKey) && event.key.toLowerCase() === "k") {
+        event.preventDefault();
+        if (commandPaletteOpen()) {
+          closeCommandPalette();
+        } else {
+          openCommandPalette();
+        }
+        return;
+      }
+
+      if (!commandPaletteOpen()) return;
+
+      if (event.key === "Escape") {
+        event.preventDefault();
+        closeCommandPalette();
+        return;
+      }
+
+      if (event.key === "Backspace" && !commandPaletteQuery().trim() && commandPaletteMode() !== "root") {
+        event.preventDefault();
+        returnToCommandRoot();
+        return;
+      }
+
+      const items = commandPaletteItems();
+      if (event.key === "ArrowDown") {
+        event.preventDefault();
+        if (!items.length) return;
+        setCommandPaletteActiveIndex((index) => (index + 1) % items.length);
+        return;
+      }
+
+      if (event.key === "ArrowUp") {
+        event.preventDefault();
+        if (!items.length) return;
+        setCommandPaletteActiveIndex((index) => (index - 1 + items.length) % items.length);
+        return;
+      }
+
+      if (event.key === "Enter") {
+        event.preventDefault();
+        const item = items[commandPaletteActiveIndex()];
+        if (!item) return;
+        runCommandPaletteItem(item);
+      }
+    };
+    window.addEventListener("keydown", onKeyDown);
+    onCleanup(() => window.removeEventListener("keydown", onKeyDown));
+  });
+
+  createEffect(() => {
+    const items = commandPaletteItems();
+    const index = commandPaletteActiveIndex();
+    if (items.length === 0) {
+      setCommandPaletteActiveIndex(0);
+      return;
+    }
+    if (index >= items.length) {
+      setCommandPaletteActiveIndex(items.length - 1);
+    }
+  });
+
+  createEffect(() => {
+    if (!commandPaletteOpen()) return;
+    const index = commandPaletteActiveIndex();
+    queueMicrotask(() => {
+      commandPaletteOptionRefs[index]?.scrollIntoView({ block: "nearest" });
+    });
+  });
+
+  createEffect(() => {
+    if (!commandPaletteOpen()) return;
+    commandPaletteMode();
+    commandPaletteQuery();
+    commandPaletteOptionRefs.length = 0;
+    setCommandPaletteActiveIndex(0);
+  });
+
+  const renderRightRail = (expanded: boolean) => (
+    <div class="flex h-full w-full flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-sidebar p-3 transition-[width] duration-200">
+      <div class={`flex items-center pb-3 ${expanded ? "justify-end" : "justify-center"}`}>
+        <button
+          type="button"
+          class="flex h-10 w-10 items-center justify-center rounded-[16px] text-gray-10 transition-colors hover:bg-dls-surface hover:text-dls-text"
+          onClick={toggleRightSidebar}
+          title={expanded ? "Collapse sidebar" : "Expand sidebar"}
+          aria-label={expanded ? "Collapse sidebar" : "Expand sidebar"}
+        >
+          <Show when={expanded} fallback={<ChevronLeft size={18} />}>
+            <ChevronRight size={18} />
+          </Show>
+        </button>
+      </div>
+
+      <div class={`flex-1 overflow-y-auto ${expanded ? "space-y-5 pt-1" : "space-y-3 pt-1"}`}>
+        <div class="space-y-1 mb-2">
+          <RightRailButton
+            label="Skills"
+            icon={<Zap size={18} />}
+            active={rightRailNav() === "skills"}
+            expanded={expanded}
+            onClick={() => setRightRailNav("skills")}
+          />
+          <RightRailButton
+            label="Extensions"
+            icon={<Box size={18} />}
+            active={rightRailNav() === "extensions"}
+            expanded={expanded}
+            onClick={() => setRightRailNav("extensions")}
+          />
+          <RightRailButton
+            label="Messaging"
+            icon={<MessageCircle size={18} />}
+            active={rightRailNav() === "messaging"}
+            expanded={expanded}
+            onClick={() => setRightRailNav("messaging")}
+          />
+          <RightRailButton
+            label="Advanced"
+            icon={<SlidersHorizontal size={18} />}
+            active={rightRailNav() === "advanced"}
+            expanded={expanded}
+            onClick={() => setRightRailNav("advanced")}
+          />
+        </div>
+
+        <Show when={expanded && selectedWorkspaceId() === remoteWorkspace.id}>
+          <div class="rounded-[20px] border border-dls-border bg-dls-surface p-3 shadow-[var(--dls-card-shadow)] text-sm text-dls-secondary">
+            Remote inbox preview has been removed from the app shell.
+          </div>
+        </Show>
+      </div>
+    </div>
+  );
+
+  return (
+    <div class="h-[100dvh] min-h-screen w-full overflow-hidden bg-[var(--dls-app-bg)] p-3 md:p-4 text-gray-12 font-sans">
+      <div class="flex h-full w-full gap-3 md:gap-4">
+        <aside
+          class="relative hidden lg:flex shrink-0 flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-sidebar p-2.5"
+          style={{
+            width: `${leftSidebarWidth()}px`,
+            "min-width": `${leftSidebarWidth()}px`,
+          }}
+        >
+          <div class="min-h-0 flex-1">
+            <WorkspaceSessionList
+              developerMode
+              workspaceSessionGroups={workspaceSessionGroups}
+              selectedWorkspaceId={selectedWorkspaceId()}
+              selectedSessionId={selectedSessionId()}
+              showSessionActions
+              sessionStatusById={sessionStatusById}
+              connectingWorkspaceId={null}
+              workspaceConnectionStateById={workspaceConnectionStateById}
+              newTaskDisabled={false}
+              importingWorkspaceConfig={false}
+              onSelectWorkspace={(workspaceId) => {
+                setSelectedWorkspaceId(workspaceId);
+                return true;
+              }}
+              onOpenSession={(workspaceId, sessionId) => {
+                setSelectedWorkspaceId(workspaceId);
+                setSelectedSessionId(sessionId);
+              }}
+              onCreateTaskInWorkspace={(workspaceId) => {
+                setSelectedWorkspaceId(workspaceId);
+              }}
+              onOpenRenameSession={() => undefined}
+              onOpenDeleteSession={() => undefined}
+              onOpenRenameWorkspace={() => undefined}
+              onShareWorkspace={(workspaceId) => openMockShareModal(workspaceId)}
+              onRevealWorkspace={() => undefined}
+              onRecoverWorkspace={() => true}
+              onTestWorkspaceConnection={() => true}
+              onEditWorkspaceConnection={() => undefined}
+              onForgetWorkspace={() => undefined}
+              onOpenCreateWorkspace={() => openMockCreateWorkspaceModal()}
+              onOpenCreateRemoteWorkspace={() => undefined}
+              onImportWorkspaceConfig={() => undefined}
+            />
+          </div>
+          <div
+            class="absolute right-0 top-3 hidden h-[calc(100%-24px)] w-2 translate-x-1/2 cursor-col-resize rounded-full bg-transparent transition-colors hover:bg-gray-6/40 lg:block"
+            onPointerDown={startLeftSidebarResize}
+            title="Resize workspace column"
+            aria-label="Resize workspace column"
+          />
+        </aside>
+
+        <main class="min-w-0 flex-1 flex flex-col overflow-hidden rounded-[24px] border border-dls-border bg-dls-surface shadow-[var(--dls-shell-shadow)]">
+          <header class="z-10 flex h-12 shrink-0 items-center justify-between border-b border-dls-border bg-dls-surface px-4 md:px-6">
+            <div class="flex min-w-0 items-center gap-3">
+              <h1 class="truncate text-[15px] font-semibold text-dls-text">
+                {showingSettings() ? "Settings" : selectedSessionTitle()}
+              </h1>
+              <span class="hidden truncate text-[13px] text-dls-secondary lg:inline">
+                {activeWorkspace().displayName ?? activeWorkspace().name}
+              </span>
+            </div>
+
+            <div class="flex items-center gap-1.5 text-gray-10">
+              <button
+                type="button"
+                class="hidden items-center gap-2 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text sm:flex"
+                onClick={() => openCommandPalette()}
+                title="Open command palette"
+                aria-label="Open command palette"
+              >
+                <span>Palette</span>
+                <span class="ml-1 rounded border border-dls-border px-1 text-[10px] text-gray-9">⌘K</span>
+              </button>
+              <button
+                type="button"
+                class="flex h-9 w-9 items-center justify-center rounded-md text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text"
+                onClick={() => setComposerToast("Story-book: search is mocked in this shell.")}
+                title="Search conversation (Ctrl/Cmd+F)"
+                aria-label="Search conversation"
+              >
+                <Search size={16} />
+              </button>
+              <div class="hidden h-4 w-px bg-dls-border sm:block" />
+              <button
+                type="button"
+                class="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={() => runMockHeaderAction("undo", "undo")}
+                disabled={headerActionBusy() !== null}
+                title="Undo last message"
+                aria-label="Undo last message"
+              >
+                <Show when={headerActionBusy() === "undo"} fallback={<Undo2 size={16} />}>
+                  <span class="h-4 w-4 animate-spin rounded-full border-2 border-gray-8 border-t-transparent" />
+                </Show>
+                <span class="hidden lg:inline">Revert</span>
+              </button>
+              <button
+                type="button"
+                class="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-[13px] font-medium text-gray-10 transition-colors hover:bg-gray-2/70 hover:text-dls-text disabled:cursor-not-allowed disabled:opacity-60"
+                onClick={() => runMockHeaderAction("redo", "redo")}
+                disabled={headerActionBusy() !== null}
+                title="Redo last reverted message"
+                aria-label="Redo last reverted message"
+              >
+                <Show when={headerActionBusy() === "redo"} fallback={<Redo2 size={16} />}>
+                  <span class="h-4 w-4 animate-spin rounded-full border-2 border-gray-8 border-t-transparent" />
+                </Show>
+                <span class="hidden lg:inline">Redo</span>
+              </button>
+              <div class="hidden h-4 w-px bg-dls-border sm:block" />
+            </div>
+          </header>
+
+          <div class="flex-1 min-h-0 overflow-hidden">
+            <div class="h-full overflow-y-auto bg-dls-surface px-4 pt-6 pb-4 sm:px-6 lg:px-10">
+              <div class="mx-auto w-full max-w-[800px]">
+                <Show
+                  when={showingSettings()}
+                  fallback={
+                    <MessageList
+                      messages={messageRows()}
+                      developerMode
+                      showThinking={false}
+                      isStreaming={false}
+                      expandedStepIds={expandedStepIds()}
+                      setExpandedStepIds={(updater) => setExpandedStepIds((current) => updater(current))}
+                      workspaceRoot="/Users/benjaminshafii/openwork-enterprise/_repos/openwork"
+                    />
+                  }
+                >
+                  <div class="space-y-4">
+                    <div class="rounded-[20px] border border-dls-border bg-dls-surface p-4 shadow-[var(--dls-card-shadow)] space-y-3">
+                      <div>
+                        <div class="text-sm font-medium text-dls-text">Model preferences</div>
+                        <div class="text-xs text-dls-secondary mt-1">
+                          This preview mirrors the default model and reasoning controls from the app picker.
+                        </div>
+                      </div>
+                      <div class="rounded-2xl border border-dls-border bg-dls-sidebar px-4 py-3 flex items-center justify-between gap-3">
+                        <div class="min-w-0">
+                          <div class="text-sm text-dls-text truncate">{selectedModelLabel()}</div>
+                          <div class="text-xs text-dls-secondary truncate">
+                            {selectedModel().providerID}/{selectedModel().modelID}
+                          </div>
+                        </div>
+                        <Button variant="outline" onClick={() => openModelPicker("default")}>
+                          Open picker
+                        </Button>
+                      </div>
+                      <div class="rounded-2xl border border-dls-border bg-dls-sidebar px-4 py-3">
+                        <div class="text-sm text-dls-text">{selectedBehavior().title}</div>
+                        <div class="mt-1 text-xs font-medium text-dls-text">{selectedBehavior().label}</div>
+                        <div class="mt-1 text-xs text-dls-secondary">{selectedBehavior().description}</div>
+                      </div>
+                    </div>
+                    <div class="rounded-[20px] border border-dls-border bg-dls-sidebar p-4 text-sm text-dls-secondary">
+                      This is the real `DenSettingsPanel` from the app mounted inside story-book.
+                    </div>
+                    <DenSettingsPanel
+                      developerMode
+                      connectRemoteWorkspace={async () => true}
+                    />
+                  </div>
+                </Show>
+              </div>
+            </div>
+          </div>
+
+          <Show when={!showingSettings()}>
+            <Composer
+              prompt={composerPrompt()}
+              draftMode="prompt"
+              draftScopeKey="story-book-composer"
+              developerMode
+              busy={false}
+              isStreaming={false}
+              onSend={handleSend}
+              onStop={() => undefined}
+              onDraftChange={handleDraftChange}
+              selectedModelLabel={selectedModelLabel()}
+              onModelClick={() => openModelPicker("session")}
+              modelVariantLabel={`${selectedBehavior().title} · ${selectedBehavior().label}`}
+              modelVariant={modelVariant()}
+              modelBehaviorOptions={selectedBehavior().options}
+              onModelVariantChange={(value) => setModelVariant(value)}
+              agentLabel={agentLabel()}
+              selectedAgent={selectedAgent()}
+              agentPickerOpen={agentPickerOpen()}
+              agentPickerBusy={false}
+              agentPickerError={null}
+              agentOptions={[]}
+              onToggleAgentPicker={() => setAgentPickerOpen((current) => !current)}
+              onSelectAgent={(agent) => {
+                setSelectedAgent(agent);
+                setAgentPickerOpen(false);
+              }}
+              setAgentPickerRef={() => undefined}
+              notice={composerToast() ? { title: composerToast() } : null}
+              onNotice={(notice) => setComposerToast(notice.title)}
+              listAgents={async () => []}
+              recentFiles={workingFiles}
+              searchFiles={async (query) => {
+                const normalized = query.trim().toLowerCase();
+                if (!normalized) return workingFiles.slice(0, 8);
+                return workingFiles.filter((path) => path.toLowerCase().includes(normalized)).slice(0, 8);
+              }}
+              isRemoteWorkspace={selectedWorkspaceId() === remoteWorkspace.id}
+              isSandboxWorkspace={selectedWorkspaceId() === remoteWorkspace.id}
+              attachmentsEnabled
+              attachmentsDisabledReason={null}
+              skills={[]}
+              listCommands={async () => commandOptions}
+              onOpenSettings={() => undefined}
+            />
+          </Show>
+
+          <StatusBar
+            clientConnected
+            openworkServerStatus="connected"
+            developerMode
+            settingsOpen={showingSettings()}
+            showSettingsButton={false}
+            onSendFeedback={() => undefined}
+            onOpenSettings={() => {
+              if (showingSettings()) {
+                setRightRailNav("skills");
+                return;
+              }
+              if (!rightSidebarExpanded()) toggleRightSidebar();
+              setRightRailNav("advanced");
+            }}
+            providerConnectedIds={["anthropic", "openai"]}
+            statusLabel="Session Ready"
+          />
+        </main>
+
+        <aside
+          class="hidden shrink-0 md:flex"
+          style={{
+            width: `${rightSidebarWidth()}px`,
+            "min-width": `${rightSidebarWidth()}px`,
+          }}
+        >
+          {renderRightRail(rightSidebarExpanded())}
+        </aside>
+      </div>
+
+      <Show when={commandPaletteOpen()}>
+        <div
+          class="fixed inset-0 z-50 bg-gray-1/60 backdrop-blur-sm flex items-start justify-center p-4 overflow-y-auto"
+          onClick={closeCommandPalette}
+        >
+          <div
+            class="w-full max-w-2xl mt-12 rounded-2xl border border-dls-border bg-dls-surface shadow-2xl overflow-hidden"
+            onClick={(event) => event.stopPropagation()}
+          >
+            <div class="border-b border-dls-border px-4 py-3 space-y-2">
+              <div class="flex items-center gap-2">
+                <Show when={commandPaletteMode() !== "root"}>
+                  <button
+                    type="button"
+                    class="h-8 px-2 rounded-md text-xs text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors"
+                    onClick={returnToCommandRoot}
+                  >
+                    Back
+                  </button>
+                </Show>
+                <Search size={14} class="text-dls-secondary shrink-0" />
+                <input
+                  ref={(el) => (commandPaletteInputEl = el)}
+                  type="text"
+                  value={commandPaletteQuery()}
+                  onInput={(event) => {
+                    setCommandPaletteQuery(event.currentTarget.value);
+                    setCommandPaletteActiveIndex(0);
+                  }}
+                  placeholder={commandPalettePlaceholder()}
+                  class="min-w-0 flex-1 bg-transparent text-sm text-dls-text placeholder:text-dls-secondary focus:outline-none"
+                  aria-label={commandPaletteTitle()}
+                />
+                <button
+                  type="button"
+                  class="h-8 w-8 flex items-center justify-center rounded-md text-dls-secondary hover:text-dls-text hover:bg-dls-hover transition-colors"
+                  onClick={closeCommandPalette}
+                  aria-label="Close quick actions"
+                >
+                  <X size={14} />
+                </button>
+              </div>
+              <div class="text-[11px] text-dls-secondary">{commandPaletteTitle()}</div>
+            </div>
+
+            <div class="max-h-[56vh] overflow-y-auto p-2">
+              <Show
+                when={commandPaletteItems().length > 0}
+                fallback={<div class="px-3 py-6 text-sm text-dls-secondary text-center">No matches.</div>}
+              >
+                <For each={commandPaletteItems()}>
+                  {(item, idx) => (
+                    <button
+                      ref={(el) => {
+                        commandPaletteOptionRefs[idx()] = el;
+                      }}
+                      type="button"
+                      class={`w-full text-left rounded-xl px-3 py-2.5 transition-colors ${
+                        idx() === commandPaletteActiveIndex()
+                          ? "bg-dls-active text-dls-text"
+                          : "text-dls-text hover:bg-dls-hover"
+                      }`}
+                      onMouseEnter={() => setCommandPaletteActiveIndex(idx())}
+                      onClick={() => runCommandPaletteItem(item)}
+                    >
+                      <div class="flex items-start justify-between gap-3">
+                        <div class="min-w-0">
+                          <div class="text-sm font-medium truncate">{item.title}</div>
+                          <Show when={item.detail}>
+                            <div class="text-xs text-dls-secondary mt-1 truncate">{item.detail}</div>
+                          </Show>
+                        </div>
+                        <Show when={item.meta}>
+                          <span class="text-[10px] uppercase tracking-wide text-dls-secondary shrink-0">
+                            {item.meta}
+                          </span>
+                        </Show>
+                      </div>
+                    </button>
+                  )}
+                </For>
+              </Show>
+            </div>
+
+            <div class="border-t border-dls-border px-3 py-2 text-[11px] text-dls-secondary flex items-center justify-between gap-2">
+              <span>Arrow keys to navigate</span>
+              <span>Enter to run · Esc to close</span>
+            </div>
+          </div>
+        </div>
+      </Show>
+
+      <ShareWorkspaceModal
+        open={Boolean(shareWorkspaceId())}
+        onClose={() => setShareWorkspaceId(null)}
+        workspaceName={shareWorkspaceName()}
+        workspaceDetail={shareWorkspaceDetail()}
+        fields={[...mockShareFields]}
+        note="This is the real share modal from the app, mounted with safe mock values for shell review."
+        onExportConfig={() => setComposerToast("Story-book: export config is mocked in this shell.")}
+        exportDisabledReason={null}
+        onOpenBots={() => setComposerToast("Story-book: bots sharing flow is mocked in this shell.")}
+      />
+
+      <CreateWorkspaceModal
+        open={createWorkspaceOpen()}
+        onClose={() => {
+          if (createWorkspaceSubmitting()) return;
+          setCreateWorkspaceOpen(false);
+        }}
+        onConfirm={confirmMockWorkspaceCreate}
+        onPickFolder={pickMockWorkspaceFolder}
+        submitting={createWorkspaceSubmitting()}
+      />
+
+      <ModelPickerModal
+        open={modelPickerOpen()}
+        options={storyModelOptions()}
+        filteredOptions={filteredStoryModelOptions()}
+        query={modelPickerQuery()}
+        setQuery={setModelPickerQuery}
+        target={modelPickerTarget()}
+        current={selectedModel()}
+        onSelect={applyStoryModelSelection}
+        onBehaviorChange={(model, value) => {
+          if (model.providerID !== selectedModel().providerID || model.modelID !== selectedModel().modelID) return;
+          const entry = storyModels.find((item) => item.ref.providerID === model.providerID && item.ref.modelID === model.modelID);
+          if (!entry) return;
+          setModelVariant(sanitizeModelBehaviorValue(model.providerID, entry.model, value) ?? null);
+        }}
+        onOpenSettings={() => {
+          setModelPickerOpen(false);
+          if (!rightSidebarExpanded()) toggleRightSidebar();
+          setRightRailNav("advanced");
+        }}
+        onClose={() => setModelPickerOpen(false)}
+      />
+    </div>
+  );
+}
diff --git a/apps/story-book/tsconfig.json b/apps/story-book/tsconfig.json
new file mode 100644
index 0000000000..d33d2a1b33
--- /dev/null
+++ b/apps/story-book/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "extends": "../app/tsconfig.json",
+  "include": ["src", "../app/src", "vite.config.ts"]
+}
diff --git a/apps/story-book/vite.config.ts b/apps/story-book/vite.config.ts
new file mode 100644
index 0000000000..30e3028887
--- /dev/null
+++ b/apps/story-book/vite.config.ts
@@ -0,0 +1,37 @@
+import os from "node:os";
+import { defineConfig } from "vite";
+import tailwindcss from "@tailwindcss/vite";
+import solid from "vite-plugin-solid";
+
+const portValue = Number.parseInt(process.env.PORT ?? "", 10);
+const devPort = Number.isFinite(portValue) && portValue > 0 ? portValue : 5176;
+const allowedHosts = new Set<string>();
+const envAllowedHosts = process.env.VITE_ALLOWED_HOSTS ?? "";
+
+const addHost = (value?: string | null) => {
+  const trimmed = value?.trim();
+  if (!trimmed) return;
+  allowedHosts.add(trimmed);
+};
+
+envAllowedHosts.split(",").forEach(addHost);
+addHost(process.env.OPENWORK_PUBLIC_HOST ?? null);
+const hostname = os.hostname();
+addHost(hostname);
+const shortHostname = hostname.split(".")[0];
+if (shortHostname && shortHostname !== hostname) {
+  addHost(shortHostname);
+}
+
+export default defineConfig({
+  publicDir: "../app/public",
+  plugins: [tailwindcss(), solid()],
+  server: {
+    port: devPort,
+    strictPort: true,
+    ...(allowedHosts.size > 0 ? { allowedHosts: Array.from(allowedHosts) } : {}),
+  },
+  build: {
+    target: "esnext",
+  },
+});
diff --git a/apps/ui-demo/index.html b/apps/ui-demo/index.html
new file mode 100644
index 0000000000..66f28a9a46
--- /dev/null
+++ b/apps/ui-demo/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>OpenWork UI Demo</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+  </html>
diff --git a/apps/ui-demo/package.json b/apps/ui-demo/package.json
new file mode 100644
index 0000000000..2cb9bde604
--- /dev/null
+++ b/apps/ui-demo/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "@openwork/ui-demo",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "pnpm --dir ../../packages/ui build && vite --host 0.0.0.0 --port 3333 --strictPort",
+    "build": "pnpm --dir ../../packages/ui build && vite build",
+    "preview": "vite preview --host 0.0.0.0 --port 3333 --strictPort",
+    "typecheck": "pnpm --dir ../../packages/ui build && tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@openwork/ui": "workspace:*",
+    "react": "19.2.4",
+    "react-dom": "19.2.4"
+  },
+  "devDependencies": {
+    "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3",
+    "@vitejs/plugin-react": "^5.0.4",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.12"
+  }
+}
diff --git a/apps/ui-demo/src/app.tsx b/apps/ui-demo/src/app.tsx
new file mode 100644
index 0000000000..76a3ff7273
--- /dev/null
+++ b/apps/ui-demo/src/app.tsx
@@ -0,0 +1,216 @@
+import {
+  PaperGrainGradient,
+  PaperMeshGradient,
+  getSeededPaperGrainGradientConfig,
+  getSeededPaperMeshGradientConfig,
+} from "@openwork/ui/react"
+import { useMemo, useState } from "react"
+
+const sampleIds = [
+  "om_01kmhbscaze02vp04ykqa4tcsb",
+  "om_01kmhbscazf4cjf1bssx6v9q9",
+  "ow_01kmj2wc68r1zk4n8v7j6v1n2k",
+]
+
+export function App() {
+  const [seed, setSeed] = useState(sampleIds[0])
+  const normalizedSeed = seed.trim() || sampleIds[0]
+  const parsedSeed = parseTypeId(normalizedSeed)
+  const meshConfig = useMemo(() => getSeededPaperMeshGradientConfig(normalizedSeed), [normalizedSeed])
+  const grainConfig = useMemo(() => getSeededPaperGrainGradientConfig(normalizedSeed), [normalizedSeed])
+
+  return (
+    <main className="app-shell">
+      <div className="ambient ambient-a" />
+      <div className="ambient ambient-b" />
+
+      <section className="hero-card panel">
+        <div className="hero-copy">
+          <span className="eyebrow">OpenWork UI demo</span>
+          <h1>Seeded Paper gradients on their own dev surface</h1>
+          <p>
+            Type a TypeID-like string, inspect the deterministic values derived from it, and preview
+            the gradients that `@openwork/ui/react` will render anywhere else in the repo.
+          </p>
+        </div>
+
+        <div className="rule-card">
+          <span className="eyebrow muted">Deterministic</span>
+          <strong>Same seed, same result.</strong>
+          <p>Useful for stable identity-driven art direction across apps.</p>
+        </div>
+      </section>
+
+      <section className="controls-grid">
+        <div className="panel input-panel">
+          <label className="eyebrow muted" htmlFor="seed-id">
+            Seed id
+          </label>
+          <input
+            id="seed-id"
+            className="seed-input"
+            type="text"
+            value={seed}
+            onChange={(event) => setSeed(event.target.value)}
+            spellCheck={false}
+          />
+
+          <div className="sample-list">
+            {sampleIds.map((sampleId) => (
+              <button
+                key={sampleId}
+                type="button"
+                className={sampleId === normalizedSeed ? "sample-chip active" : "sample-chip"}
+                onClick={() => setSeed(sampleId)}
+              >
+                {sampleId}
+              </button>
+            ))}
+          </div>
+        </div>
+
+        <div className="panel seed-meta-grid">
+          <SeedMeta label="prefix" value={parsedSeed.prefix ?? "-"} />
+          <SeedMeta label="suffix" value={parsedSeed.suffix ?? "-"} />
+          <SeedMeta label="suffix first 5" value={parsedSeed.suffixAnchor ?? "-"} />
+          <SeedMeta label="suffix tail" value={parsedSeed.suffixTail ?? "-"} />
+        </div>
+      </section>
+
+      <section className="preview-grid">
+        <GradientCard
+          title="Mesh gradient"
+          subtitle="Shared mesh defaults plus seeded color and motion variation"
+          colors={meshConfig.colors}
+          config={meshConfig}
+          surface={<PaperMeshGradient seed={normalizedSeed} className="gradient-fill" />}
+        />
+
+        <GradientCard
+          title="Grain gradient"
+          subtitle="Shared grain defaults plus seeded background, shape, and values"
+          colors={[grainConfig.colorBack, ...grainConfig.colors]}
+          config={grainConfig}
+          surface={<PaperGrainGradient seed={normalizedSeed} className="gradient-fill" />}
+        />
+      </section>
+
+      <section className="footer-grid">
+        <div className="panel">
+          <span className="eyebrow muted">Determinism check</span>
+          <div className="mini-grid">
+            <MiniPreview title="Mesh A">
+              <PaperMeshGradient seed={normalizedSeed} className="gradient-fill" />
+            </MiniPreview>
+            <MiniPreview title="Mesh B">
+              <PaperMeshGradient seed={normalizedSeed} className="gradient-fill" />
+            </MiniPreview>
+          </div>
+          <p className="support-copy">
+            These two cards use the same seed and should always match.
+          </p>
+        </div>
+
+        <div className="panel code-panel">
+          <span className="eyebrow muted">Import paths</span>
+          <div className="pill-stack">
+            <code className="import-pill">@openwork/ui/react</code>
+            <code className="import-pill">@openwork/ui/solid</code>
+          </div>
+          <pre>{`import { PaperMeshGradient, PaperGrainGradient } from "@openwork/ui/react"
+
+<PaperMeshGradient seed="${normalizedSeed}" />
+<PaperGrainGradient seed="${normalizedSeed}" />`}</pre>
+        </div>
+      </section>
+    </main>
+  )
+}
+
+function GradientCard({
+  title,
+  subtitle,
+  colors,
+  config,
+  surface,
+}: {
+  title: string
+  subtitle: string
+  colors: string[]
+  config: Record<string, unknown>
+  surface: React.ReactNode
+}) {
+  return (
+    <article className="panel preview-card">
+      <div className="gradient-surface">
+        {surface}
+        <div className="surface-overlay" />
+        <div className="surface-copy">
+          <span className="eyebrow on-dark">@openwork/ui/react</span>
+          <h2>{title}</h2>
+          <p>{subtitle}</p>
+        </div>
+      </div>
+
+      <div className="details-stack">
+        <div>
+          <span className="eyebrow muted">Colors</span>
+          <div className="swatch-list">
+            {colors.map((color) => (
+              <div key={color} className="swatch-pill">
+                <span className="swatch-dot" style={{ backgroundColor: color }} />
+                <code>{color}</code>
+              </div>
+            ))}
+          </div>
+        </div>
+
+        <div>
+          <span className="eyebrow muted">Calculated values</span>
+          <pre>{JSON.stringify(config, null, 2)}</pre>
+        </div>
+      </div>
+    </article>
+  )
+}
+
+function MiniPreview({ title, children }: { title: string; children: React.ReactNode }) {
+  return (
+    <div>
+      <span className="eyebrow muted">{title}</span>
+      <div className="mini-surface">{children}</div>
+    </div>
+  )
+}
+
+function SeedMeta({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="seed-meta-card">
+      <span className="eyebrow muted">{label}</span>
+      <code>{value}</code>
+    </div>
+  )
+}
+
+function parseTypeId(value: string) {
+  const separatorIndex = value.indexOf("_")
+
+  if (separatorIndex === -1) {
+    return {
+      prefix: null,
+      suffix: value,
+      suffixAnchor: value.slice(0, 5) || null,
+      suffixTail: value.slice(5) || null,
+    }
+  }
+
+  const prefix = value.slice(0, separatorIndex) || null
+  const suffix = value.slice(separatorIndex + 1) || null
+
+  return {
+    prefix,
+    suffix,
+    suffixAnchor: suffix?.slice(0, 5) || null,
+    suffixTail: suffix?.slice(5) || null,
+  }
+}
diff --git a/apps/ui-demo/src/main.tsx b/apps/ui-demo/src/main.tsx
new file mode 100644
index 0000000000..8624da889e
--- /dev/null
+++ b/apps/ui-demo/src/main.tsx
@@ -0,0 +1,10 @@
+import React from "react"
+import ReactDOM from "react-dom/client"
+import { App } from "./app"
+import "./styles.css"
+
+ReactDOM.createRoot(document.getElementById("root")!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+)
diff --git a/apps/ui-demo/src/styles.css b/apps/ui-demo/src/styles.css
new file mode 100644
index 0000000000..69007a8995
--- /dev/null
+++ b/apps/ui-demo/src/styles.css
@@ -0,0 +1,343 @@
+:root {
+  color-scheme: light;
+  font-family: "IBM Plex Sans", "Inter", system-ui, sans-serif;
+  background:
+    radial-gradient(circle at top left, rgba(57, 181, 74, 0.16), transparent 28%),
+    radial-gradient(circle at top right, rgba(39, 98, 255, 0.14), transparent 30%),
+    linear-gradient(180deg, #f6f1e8 0%, #efe7d7 100%);
+  color: #1f2c2b;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  min-width: 320px;
+}
+
+button,
+input,
+textarea,
+select {
+  font: inherit;
+}
+
+code,
+pre,
+.sample-chip,
+.seed-input {
+  font-family: "IBM Plex Mono", "SFMono-Regular", ui-monospace, monospace;
+}
+
+.app-shell {
+  position: relative;
+  min-height: 100vh;
+  padding: 32px;
+  overflow: hidden;
+}
+
+.ambient {
+  position: fixed;
+  pointer-events: none;
+  border-radius: 999px;
+  filter: blur(70px);
+  opacity: 0.45;
+}
+
+.ambient-a {
+  top: -120px;
+  left: -80px;
+  width: 320px;
+  height: 320px;
+  background: rgba(76, 175, 80, 0.22);
+}
+
+.ambient-b {
+  right: -80px;
+  bottom: 80px;
+  width: 280px;
+  height: 280px;
+  background: rgba(59, 130, 246, 0.2);
+}
+
+.panel {
+  position: relative;
+  border: 1px solid rgba(24, 30, 28, 0.08);
+  background: rgba(255, 251, 245, 0.82);
+  backdrop-filter: blur(18px);
+  border-radius: 28px;
+  box-shadow: 0 24px 80px -48px rgba(29, 24, 17, 0.45);
+}
+
+.hero-card {
+  display: grid;
+  gap: 24px;
+  grid-template-columns: minmax(0, 1.5fr) minmax(260px, 0.8fr);
+  padding: 32px;
+}
+
+.hero-copy h1 {
+  margin: 10px 0 0;
+  font-size: clamp(2.4rem, 6vw, 4.5rem);
+  line-height: 0.92;
+  letter-spacing: -0.08em;
+}
+
+.hero-copy p,
+.rule-card p,
+.support-copy,
+.surface-copy p {
+  margin: 0;
+  color: #516160;
+  line-height: 1.7;
+}
+
+.hero-copy p {
+  margin-top: 18px;
+  max-width: 62ch;
+}
+
+.rule-card {
+  align-self: end;
+  padding: 20px;
+  border-radius: 24px;
+  background: #16201f;
+  color: #f0f7f3;
+}
+
+.rule-card p {
+  margin-top: 8px;
+  color: rgba(240, 247, 243, 0.74);
+}
+
+.eyebrow {
+  display: inline-block;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+}
+
+.muted {
+  color: #6d7a79;
+}
+
+.on-dark {
+  color: rgba(255, 255, 255, 0.68);
+}
+
+.controls-grid,
+.footer-grid {
+  display: grid;
+  gap: 24px;
+  grid-template-columns: minmax(0, 1.25fr) minmax(0, 0.95fr);
+  margin-top: 24px;
+}
+
+.input-panel,
+.seed-meta-grid,
+.code-panel {
+  padding: 24px;
+}
+
+.seed-input {
+  width: 100%;
+  margin-top: 10px;
+  padding: 15px 16px;
+  border-radius: 20px;
+  border: 1px solid rgba(22, 32, 31, 0.12);
+  background: rgba(255, 255, 255, 0.92);
+  color: #182321;
+  font-size: 0.92rem;
+  outline: none;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+
+.seed-input:focus {
+  border-color: #287d75;
+  box-shadow: 0 0 0 5px rgba(40, 125, 117, 0.12);
+}
+
+.sample-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+  margin-top: 16px;
+}
+
+.sample-chip {
+  border: 1px solid rgba(22, 32, 31, 0.1);
+  background: rgba(255, 255, 255, 0.75);
+  color: #425251;
+  border-radius: 999px;
+  padding: 9px 14px;
+  cursor: pointer;
+}
+
+.sample-chip.active {
+  background: #1f6978;
+  color: white;
+  border-color: #1f6978;
+}
+
+.seed-meta-grid {
+  display: grid;
+  gap: 12px;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  background: #16201f;
+}
+
+.seed-meta-card {
+  padding: 18px;
+  border-radius: 20px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.seed-meta-card code {
+  display: block;
+  margin-top: 8px;
+  color: #f4fbf7;
+  word-break: break-all;
+  line-height: 1.6;
+}
+
+.preview-grid {
+  display: grid;
+  gap: 24px;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  margin-top: 24px;
+}
+
+.preview-card {
+  overflow: hidden;
+}
+
+.gradient-surface {
+  position: relative;
+  min-height: 340px;
+  background: #101818;
+}
+
+.gradient-fill {
+  position: absolute;
+  inset: 0;
+}
+
+.surface-overlay {
+  position: absolute;
+  inset: 0;
+  background: linear-gradient(180deg, rgba(10, 18, 18, 0.08), rgba(10, 18, 18, 0.34));
+}
+
+.surface-copy {
+  position: absolute;
+  inset-inline: 0;
+  bottom: 0;
+  padding: 24px;
+  color: white;
+}
+
+.surface-copy h2 {
+  margin: 10px 0 0;
+  font-size: 2rem;
+  letter-spacing: -0.05em;
+}
+
+.surface-copy p {
+  margin-top: 10px;
+  color: rgba(255, 255, 255, 0.78);
+}
+
+.details-stack {
+  display: grid;
+  gap: 20px;
+  padding: 24px;
+}
+
+.swatch-list,
+.pill-stack {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+  margin-top: 14px;
+}
+
+.swatch-pill,
+.import-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  border-radius: 999px;
+  border: 1px solid rgba(22, 32, 31, 0.08);
+  background: rgba(248, 243, 235, 0.9);
+  padding: 10px 14px;
+}
+
+.swatch-dot {
+  width: 14px;
+  height: 14px;
+  border-radius: 999px;
+  border: 1px solid rgba(0, 0, 0, 0.12);
+}
+
+pre {
+  overflow-x: auto;
+  margin: 14px 0 0;
+  border-radius: 22px;
+  background: #16201f;
+  color: #dcebe4;
+  padding: 18px;
+  font-size: 0.8rem;
+  line-height: 1.7;
+}
+
+.mini-grid {
+  display: grid;
+  gap: 16px;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  margin-top: 16px;
+}
+
+.mini-surface {
+  position: relative;
+  min-height: 180px;
+  margin-top: 8px;
+  overflow: hidden;
+  border-radius: 22px;
+  background: #111918;
+}
+
+.support-copy {
+  margin-top: 16px;
+}
+
+@media (max-width: 980px) {
+  .hero-card,
+  .controls-grid,
+  .preview-grid,
+  .footer-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (max-width: 640px) {
+  .app-shell {
+    padding: 18px;
+  }
+
+  .hero-card,
+  .input-panel,
+  .seed-meta-grid,
+  .code-panel,
+  .details-stack {
+    padding: 18px;
+  }
+
+  .seed-meta-grid,
+  .mini-grid {
+    grid-template-columns: 1fr;
+  }
+}
diff --git a/tsconfig.json b/apps/ui-demo/tsconfig.json
similarity index 87%
rename from tsconfig.json
rename to apps/ui-demo/tsconfig.json
index 425ff26988..2957d0dfdf 100644
--- a/tsconfig.json
+++ b/apps/ui-demo/tsconfig.json
@@ -4,8 +4,7 @@
     "useDefineForClassFields": true,
     "module": "ESNext",
     "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "jsx": "preserve",
-    "jsxImportSource": "solid-js",
+    "jsx": "react-jsx",
     "moduleResolution": "Bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
diff --git a/apps/ui-demo/vite.config.ts b/apps/ui-demo/vite.config.ts
new file mode 100644
index 0000000000..4f3f02a3ee
--- /dev/null
+++ b/apps/ui-demo/vite.config.ts
@@ -0,0 +1,19 @@
+import { defineConfig } from "vite"
+import react from "@vitejs/plugin-react"
+
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    host: "0.0.0.0",
+    port: 3333,
+    strictPort: true,
+  },
+  preview: {
+    host: "0.0.0.0",
+    port: 3333,
+    strictPort: true,
+  },
+  build: {
+    target: "es2022",
+  },
+})
diff --git a/changelog/release-tracker-2026-02-19.md b/changelog/release-tracker-2026-02-19.md
new file mode 100644
index 0000000000..05c4e50d22
--- /dev/null
+++ b/changelog/release-tracker-2026-02-19.md
@@ -0,0 +1,1322 @@
+# Release Changelog Tracker
+
+Internal preparation file for release summaries. This is not yet published to the changelog page or docs.
+
+## v0.11.100
+
+#### Commit
+`a4601059`
+
+#### Released at
+`2026-02-19T17:49:05Z`
+
+#### Title
+Composer drafts stop disappearing mid-prompt
+
+#### One-line summary
+Fixes a session composer race so long prompts stay intact instead of getting replaced by stale draft echoes.
+
+#### Main changes
+- Fixed stale draft echoes overriding what you were actively typing in the session composer.
+- Tightened draft state tracking so long prompts stay stable during extended writing.
+
+#### Lines of code changed since previous release
+98 lines changed since `v0.11.99` (58 insertions, 40 deletions).
+
+#### Release importance
+Minor release: restores composer draft stability so long prompts no longer disappear while typing.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed a session composer bug where long prompts could appear to clear or get replaced while you were typing.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.101
+
+#### Commit
+`87fda845`
+
+#### Released at
+`2026-02-19T21:26:55Z`
+
+#### Title
+Local migration repair and clearer Soul controls
+
+#### One-line summary
+Adds a desktop recovery path for broken local OpenCode migrations and makes Soul setup plus compact action buttons easier to steer.
+
+#### Main changes
+Added migration repair from onboarding and Settings so broken local startup can recover without leaving OpenWork.
+
+Also released:
+
+- Clearer Soul starter steering and observability.
+- Cleaner compact action buttons across settings and sidebars.
+
+#### Lines of code changed since previous release
+1248 lines changed since `v0.11.100` (933 insertions, 315 deletions).
+
+#### Release importance
+Minor release: improves local recovery, Soul steering, and interface clarity without changing the product's overall shape.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added clearer Soul starter observability and steering controls in the app.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Added a migration recovery flow so broken local OpenCode database state can be repaired from the app experience.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.102
+
+#### Commit
+`f728cc3b`
+
+#### Released at
+`2026-02-20T00:00:11Z`
+
+#### Title
+Migration recovery explains when it can help
+
+#### One-line summary
+Clarifies when repair is actually available in the app and resets the landing page back to broader OpenWork messaging.
+
+#### Main changes
+- Added disabled-state feedback and clearer reasons when migration recovery is unavailable in onboarding and Settings.
+- Reverted the homepage copy from a workers-heavy framing back to the broader OpenWork message.
+
+#### Lines of code changed since previous release
+168 lines changed since `v0.11.101` (100 insertions, 68 deletions).
+
+#### Release importance
+Minor release: improves recovery-flow clarity with a focused troubleshooting UX patch.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Users can now see more clearly when migration recovery is available instead of guessing whether the repair flow should work.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.103
+
+#### Commit
+`a1b7a5e1`
+
+#### Released at
+`2026-02-20T00:41:17Z`
+
+#### Title
+Soul setup now runs safely, and sidebar sessions stay scoped
+
+#### One-line summary
+Prevents Soul quickstart content from being injected as raw prompt text and keeps sidebar session state tied to the active workspace root.
+
+#### Main changes
+- Switched Soul enable flows to run through the slash-command path instead of sending template text directly.
+- Scoped sidebar session sync by workspace root so session state does not bleed across workspaces.
+
+#### Lines of code changed since previous release
+83 lines changed since `v0.11.102` (47 insertions, 36 deletions).
+
+#### Release importance
+Major release: patches a meaningful Soul template security issue while also improving core multi-workspace behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Blocked Soul template prompt-injection behavior in app surfaces that expose Soul flows.
+- Fixed sidebar sync so state no longer bleeds across different workspace roots as easily.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.104
+
+#### Commit
+`091f13d2`
+
+#### Released at
+`2026-02-20T04:45:27Z`
+
+#### Title
+Session follow mode is now in your hands
+
+#### One-line summary
+Adds explicit follow-latest and jump-to-latest controls so streaming output stops interrupting people who scroll back to read.
+
+#### Main changes
+- Added a follow-latest toggle and a jump-to-latest button in the session timeline.
+- Turned off auto-follow as soon as you scroll away from the live tail.
+
+#### Lines of code changed since previous release
+211 lines changed since `v0.11.103` (123 insertions, 88 deletions).
+
+#### Release importance
+Minor release: fixes an annoying session reading behavior without materially changing the surrounding workflow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed session follow-scroll so it respects user scrolling instead of repeatedly pulling the view back to the live tail.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.105
+
+#### Commit
+`45f5f07d`
+
+#### Released at
+`2026-02-20T05:12:11Z`
+
+#### Title
+Session timelines stop auto-following altogether
+
+#### One-line summary
+Removes the remaining automatic follow behavior so live output no longer drags the view while you read older messages.
+
+#### Main changes
+- Removed automatic session follow scrolling during new output and sends.
+- Left only a manual jump-to-latest affordance when you are away from the bottom.
+
+#### Lines of code changed since previous release
+129 lines changed since `v0.11.104` (25 insertions, 104 deletions).
+
+#### Release importance
+Minor release: removes a disruptive session auto-scroll behavior with a tightly scoped UI fix.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Removed the automatic session scroll-follow behavior that was still causing unwanted movement while users reviewed prior output.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.106
+
+#### Commit
+`4e9260b9`
+
+#### Released at
+`2026-02-20T05:19:07Z`
+
+#### Title
+Packaging-only release lockfile maintenance
+
+#### One-line summary
+Refreshes package lock metadata for the release line, with no clear app, desktop, web, or workflow change.
+
+#### Main changes
+Updated release package metadata only, with no notable user-facing or developer-facing workflow change.
+
+#### Lines of code changed since previous release
+26 lines changed since `v0.11.105` (13 insertions, 13 deletions).
+
+#### Release importance
+Minor release: refreshes release metadata only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.107
+
+#### Commit
+`76a307fc`
+
+#### Released at
+`2026-02-20T05:40:27Z`
+
+#### Title
+Reopening sessions no longer snaps you back to the top
+
+#### One-line summary
+Fixes a revisit-specific session bug so returning to an existing conversation preserves a steadier reading position.
+
+#### Main changes
+- Stopped reopened sessions from reinitializing scroll position back to the top.
+- Limited top-of-thread initialization to the first visit for each session.
+
+#### Lines of code changed since previous release
+43 lines changed since `v0.11.106` (29 insertions, 14 deletions).
+
+#### Release importance
+Minor release: fixes another focused session scrolling regression without changing the overall product experience.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed repeated session resets to the top of the timeline.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.108
+
+#### Commit
+`3ae49df6`
+
+#### Released at
+`2026-02-20T18:14:52Z`
+
+#### Title
+Readable share pages, sturdier Soul flows, safer drafts
+
+#### One-line summary
+Makes shared bundles inspectable in the browser, preserves unsent draft text across tab switches, and strengthens Soul activation and audit flows.
+
+#### Main changes
+- Added human-readable bundle pages with raw JSON and download fallback for share links.
+- Preserved composer drafts across tab switches.
+- Hardened Soul setup and added clearer activation audit and steering flows.
+
+#### Lines of code changed since previous release
+1160 lines changed since `v0.11.107` (966 insertions, 194 deletions).
+
+#### Release importance
+Minor release: adds a meaningful sharing improvement and reliability fixes without materially reshaping how OpenWork works overall.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added browser-friendly share bundle pages with automatic JSON fallback.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Hardened Soul enable and steering audit flows so they fail less often in user-visible app paths.
+- Preserved composer drafts when switching tabs.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.109
+
+#### Commit
+`a896defd`
+
+#### Released at
+`2026-02-20T20:51:01Z`
+
+#### Title
+Safer automation setup, grouped skills, and global MCP config
+
+#### One-line summary
+Keeps automations hidden until the scheduler is installed and lets OpenWork pick up domain-organized skills plus machine-level MCP servers.
+
+#### Main changes
+- Hid Automations until the scheduler is installed.
+- Added support for skills stored in domain folders.
+- Included global MCP servers alongside workspace config.
+
+#### Lines of code changed since previous release
+410 lines changed since `v0.11.108` (321 insertions, 89 deletions).
+
+#### Release importance
+Minor release: improves setup predictability and expands advanced configuration support without changing the core product model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added support for domain-grouped skill folders.
+- Added support for global MCP configuration alongside project-local config.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Prevented automations from appearing as available before the scheduler dependency is installed.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.110
+
+#### Commit
+`8f869772`
+
+#### Released at
+`2026-02-20T22:35:16Z`
+
+#### Title
+Release packaging and deploy hardening only
+
+#### One-line summary
+Hardens updater metadata generation and share-service deploy behavior, with no visible OpenWork app or workflow changes.
+
+#### Main changes
+Mostly packaging only: the release now publishes deterministic updater metadata and skips unnecessary desktop builds during share-service deploys.
+
+#### Lines of code changed since previous release
+294 lines changed since `v0.11.109` (269 insertions, 25 deletions).
+
+#### Release importance
+Minor release: hardens release and deploy infrastructure without introducing intended user-facing product changes.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.111
+
+#### Commit
+`12847be3`
+
+#### Released at
+`2026-02-20T23:04:52Z`
+
+#### Title
+Version metadata sync only
+
+#### One-line summary
+Republishes synchronized package and desktop version metadata, with no intended OpenWork app, server, or workflow changes.
+
+#### Main changes
+Packaging only: this release just keeps version numbers and shipped metadata aligned across app, desktop, server, router, and orchestrator packages.
+
+#### Lines of code changed since previous release
+26 lines changed since `v0.11.110` (13 insertions, 13 deletions).
+
+#### Release importance
+Minor release: keeps release metadata aligned only, with no intended user-facing change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.112
+
+#### Commit
+`a0ceeae0`
+
+#### Released at
+`2026-02-21T01:19:34Z`
+
+#### Title
+Cleaner session tool timelines
+
+#### One-line summary
+Hides step lifecycle noise and separates reasoning from tool runs so active sessions are easier to scan.
+
+#### Main changes
+- Removed step start and finish rows from the session timeline.
+- Split grouped step blocks at reasoning boundaries so tool runs read in a more natural sequence.
+
+#### Lines of code changed since previous release
+233 lines changed since `v0.11.111` (178 insertions, 55 deletions).
+
+#### Release importance
+Minor release: improves session readability with a focused UI cleanup while the rest of the patch stays behind the scenes.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Removed noisy lifecycle rows from the session tool timeline so users can scan meaningful progress more easily.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.113
+
+#### Commit
+`83af293a`
+
+#### Released at
+`2026-02-21T01:58:50Z`
+
+#### Title
+Cmd+K quick actions for session work
+
+#### One-line summary
+Adds a keyboard-first palette for jumping between sessions and changing model or thinking settings without leaving chat.
+
+#### Main changes
+- Open quick actions with Cmd+K from the session view.
+- Search and jump across sessions from the same palette.
+- Change the active model or thinking level in place during a live session.
+
+#### Lines of code changed since previous release
+558 lines changed since `v0.11.112` (534 insertions, 24 deletions).
+
+#### Release importance
+Minor release: adds a focused productivity feature that makes everyday session navigation and configuration faster.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added a keyboard-first quick-actions palette for session navigation plus model and thinking controls.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.114
+
+#### Commit
+`28596bf7`
+
+#### Released at
+`2026-02-22T06:00:46Z`
+
+#### Title
+OpenWork Cloud worker setup and reconnect flows
+
+#### One-line summary
+Adds a guided web flow for launching cloud workers, then makes reconnects work with saved workers, usable tokens, and workspace-scoped connect links.
+
+#### Main changes
+Adds the first full OpenWork Cloud worker setup flow in the web app.
+
+Also released:
+
+- A 3-step sign-in, checkout, and launch flow.
+- Saved workers plus reusable tokens and workspace-scoped connect URLs.
+- Background provisioning with polling and completed provider OAuth in the app.
+
+#### Lines of code changed since previous release
+6726 lines changed since `v0.11.113` (6593 insertions, 133 deletions).
+
+#### Release importance
+Major release: introduces OpenWork Cloud worker provisioning and connect flows that materially change how users can start and use remote workers.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+4
+
+#### Major improvement details
+- Added the Den control plane with real Render-backed cloud workers inside OpenWork.
+- Shipped a new 3-step cloud worker setup experience in the web app.
+- Persisted user workers and removed manual worker ID recovery from the hosted flow.
+- Gated cloud workers behind Polar entitlements with a default hosted worker plan.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+5
+
+#### Major bug fix details
+- Completed the provider OAuth connect flow inside the app modal.
+- Returned compatible worker tokens for remote connect.
+- Returned workspace-scoped connect URLs so cloud workers open with the right workspace context.
+- Switched worker launch to asynchronous provisioning with auto-polling for better setup reliability.
+- Fixed editor-mode file opening and removed reasoning text noise from the session timeline.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.115
+
+#### Commit
+`74048ebb`
+
+#### Released at
+`2026-02-22T07:45:08Z`
+
+#### Title
+Private Telegram bot pairing and sturdier hosted sign-in
+
+#### One-line summary
+Requires explicit pairing before a private Telegram chat can control a worker and lets hosted auth recover from broken upstream HTML responses.
+
+#### Main changes
+Private Telegram bots now stay closed until a chat is explicitly paired, and hosted sign-in fails over more cleanly when the auth proxy gets bad 5xx HTML.
+    /pair ABCD-1234
+
+#### Lines of code changed since previous release
+790 lines changed since `v0.11.114` (700 insertions, 90 deletions).
+
+#### Release importance
+Minor release: tightens messaging security and fixes a focused hosted auth reliability issue without changing the broader product shape.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added a private Telegram bot pairing workflow that requires explicit approval before a chat can link to a workspace.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Added auth-proxy failover for 5xx HTML responses so hosted sign-in flows recover more gracefully.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.116
+
+#### Commit
+`a7b88238`
+
+#### Released at
+`2026-02-22T18:26:36Z`
+
+#### Title
+Cleaner cloud-worker connect with desktop deep links
+
+#### One-line summary
+Turns the hosted worker page into a simpler list-detail picker and adds one-click desktop handoff into OpenWork's remote connect flow.
+
+#### Main changes
+- Reworked hosted workers into a clearer list-detail connect view with status and action panels.
+- Added `openwork://connect-remote` deep links so the desktop app can open remote-connect details directly.
+- Kept manual URL and token copy available when one-click open is unavailable.
+
+#### Lines of code changed since previous release
+870 lines changed since `v0.11.115` (664 insertions, 206 deletions).
+
+#### Release importance
+Minor release: improves a focused cloud-worker flow by making remote connection clearer across web and desktop.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a list-detail cloud worker connect experience in the web app.
+- Wired desktop deep links so hosted remote-connect actions can open directly in the app.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.117
+
+#### Commit
+`adeafe5a`
+
+#### Released at
+`2026-02-23T01:09:20Z`
+
+#### Title
+Hosted worker connect and cleanup flows get clearer
+
+#### One-line summary
+Reworks the web worker shell with clearer status, delete, and custom-domain handling, then makes session runs easier to scan by separating request, work, and result.
+
+#### Main changes
+- Hosted workers now use a full-page list-detail flow with progressive disclosure instead of exposing every manual control up front.
+- You can delete a worker from the web flow, and custom domains resolve more cleanly when available.
+- Session timelines split each turn into request, execution, and result blocks for tool-heavy chats.
+
+#### Lines of code changed since previous release
+2207 lines changed since `v0.11.116` (1719 insertions, 488 deletions).
+
+#### Release importance
+Minor release: meaningfully improves hosted worker usability and session readability while staying within the existing product model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Added worker delete support in the hosted cloud flow.
+- Added custom worker domain support for hosted workers.
+- Introduced explicit session turn segmentation into intent, execution, and result.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Hardened Den against transient MySQL disconnect and reset conditions.
+- Recovered messaging from empty router prompt replies.
+- Stopped inbox refresh churn caused by auth memo changes.
+- Softened hosted 502 failures and restored the worker detail pane layout.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.118
+
+#### Commit
+`108d4efe`
+
+#### Released at
+`2026-02-23T02:49:35Z`
+
+#### Title
+Large sessions type faster, and cloud worker setup stays simpler
+
+#### One-line summary
+Cuts composer lag in big chats, renames timeline labels in plainer language, and keeps manual worker controls tucked behind advanced options.
+
+#### Main changes
+- Typing stays responsive deeper into large conversations by cutting composer layout churn.
+- Session timelines swap technical segment names for clearer user-facing wording.
+- Cloud worker pages hide manual URLs and tokens by default and recover safely when delete or custom-domain responses are incomplete.
+
+#### Lines of code changed since previous release
+758 lines changed since `v0.11.117` (555 insertions, 203 deletions).
+
+#### Release importance
+Minor release: improves responsiveness and clarity in existing session and hosted-worker flows without changing core behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Reduced typing lag in long sessions by cutting composer layout churn.
+- Updated session labels to use clearer, user-facing wording.
+- Fixed hosted worker delete responses and added a safer fallback path for vanity domains.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.119
+
+#### Commit
+`67844b38`
+
+#### Released at
+`2026-02-23T05:13:07Z`
+
+#### Title
+Long chats stay snappier, and web onboarding looks cleaner
+
+#### One-line summary
+Further trims typing lag while tightening the landing hero, Get started path, and hosted worker layout across the web experience.
+
+#### Main changes
+Further reduces composer reflow in heavy sessions, points Den visitors to a clearer Get started path, and makes both the landing hero and hosted worker panels use space more cleanly.
+
+#### Lines of code changed since previous release
+308 lines changed since `v0.11.118` (197 insertions, 111 deletions).
+
+#### Release importance
+Minor release: focuses on performance polish and presentation improvements across existing session and onboarding surfaces.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Reduced long-session composer reflow work to improve typing responsiveness in heavy chats.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.120
+
+#### Commit
+`6cf077b3`
+
+#### Released at
+`2026-02-23T06:19:35Z`
+
+#### Title
+Worker switching keeps session lists stable
+
+#### One-line summary
+Preserves sidebar sessions while moving between workers and refreshes the landing hero with higher contrast, calmer motion, and lighter nav chrome.
+
+#### Main changes
+- Switching workers no longer makes sidebar sessions disappear while connection state catches up.
+- The landing hero gets a stronger shader, higher text contrast, slower animation, and simpler sticky navigation.
+
+#### Lines of code changed since previous release
+150 lines changed since `v0.11.119` (94 insertions, 56 deletions).
+
+#### Release importance
+Minor release: fixes a core navigation annoyance and adds focused landing-page polish.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed sidebar behavior so sessions remain visible while users switch across workers.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.121
+
+#### Commit
+`b5f7814f`
+
+#### Released at
+`2026-02-23T06:46:26Z`
+
+#### Title
+Session timelines read naturally, and search hits stand out
+
+#### One-line summary
+Removes meta-heavy timeline labels, highlights search hits inside messages, and makes quick actions and composing feel faster in active chats.
+
+#### Main changes
+- Session runs now read like a conversation instead of showing Plan, Activity, and Answer labels.
+- Search highlights matching text inside messages, not just matching rows.
+- Worker quick actions and composer updates feel more responsive during active chats.
+
+#### Lines of code changed since previous release
+485 lines changed since `v0.11.120` (311 insertions, 174 deletions).
+
+#### Release importance
+Minor release: improves the feel and readability of the core session experience without changing the broader workflow model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added in-message search match highlighting while improving worker quick actions and composer responsiveness.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.122
+
+#### Commit
+`dfa41808`
+
+#### Released at
+`2026-02-26T01:34:07Z`
+
+#### Title
+Hosted onboarding and share links become app handoffs
+
+#### One-line summary
+Adds GitHub sign-in, Open in App worker handoff, and share links for workspace profiles and skill sets while smoothing long-session and desktop reliability.
+
+#### Main changes
+Hosted OpenWork now hands people straight from the web into the app for connect and import flows.
+
+Also released:
+
+- GitHub sign-in plus a dedicated download page for faster first-time setup.
+- Share links for workspace profiles and skill sets, with deep links that default to a new worker.
+- Long sessions render more smoothly, local file links resolve correctly, and desktop shutdown is cleaner.
+
+#### Lines of code changed since previous release
+5651 lines changed since `v0.11.121` (4835 insertions, 816 deletions).
+
+#### Release importance
+Major release: substantially expands how users sign up, connect, share, and navigate OpenWork across hosted and desktop flows.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+5
+
+#### Major improvement details
+- Added Open in App handoff for hosted remote-connect flows.
+- Simplified get-started signup and added GitHub sign-in.
+- Added a dedicated download page with platform anchors and a stronger docs entrypoint.
+- Added workspace profile and skills-set sharing flows.
+- Added bundle-share deep links that open directly into new-worker imports.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+5
+
+#### Major bug fix details
+- Grouped exploration steps and cached markdown rendering to keep long sessions responsive.
+- Fixed workspace-relative markdown file references so local file links open correctly.
+- Stabilized workspace actions, improved share modal mobile readability, wrapped long connection URLs, and clamped long skill triggers.
+- Hardened hosted auth with cookie preservation, trusted-origin defaults, callback fixes, and Polar access backfill.
+- Retried transient Den signup database reads and stopped the desktop orchestrator daemon cleanly on app close.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.123
+
+#### Commit
+`dfd331da`
+
+#### Released at
+`2026-02-26T05:45:34Z`
+
+#### Title
+Clearer share links and local server recovery in Settings
+
+#### One-line summary
+Refreshes both the in-app share modal and public bundle pages, and adds a one-click local server restart when a local worker gets stuck.
+
+#### Main changes
+- Share Workspace becomes a cleaner split between live access details and public link publishing.
+- Public bundle pages now look and read like OpenWork, with clearer import flows outside the app.
+- Settings adds `Restart local server` so local recovery no longer means leaving OpenWork.
+
+#### Lines of code changed since previous release
+1480 lines changed since `v0.11.122` (1027 insertions, 453 deletions).
+
+#### Release importance
+Minor release: introduces two focused user-facing improvements that make sharing and local recovery noticeably better.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a local server restart action in Settings.
+- Redesigned the share modal and generated bundle page styling to match OpenWork’s product identity.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.124
+
+#### Commit
+`3237bfab`
+
+#### Released at
+`2026-02-26T19:33:56Z`
+
+#### Title
+Orbita gives sessions a clearer three-pane workspace
+
+#### One-line summary
+Reworks the main session screen with a stronger left rail, cleaner timeline canvas, and floating composer while preserving readability across themes.
+
+#### Main changes
+Applies the Orbita direction across the session view, with a reorganized left rail for workers and sessions, lighter inbox and artifact side panels, and a clearer floating composer and message canvas.
+
+#### Lines of code changed since previous release
+734 lines changed since `v0.11.123` (451 insertions, 283 deletions).
+
+#### Release importance
+Minor release: refreshes the core session experience with a substantial layout polish pass while keeping the same underlying workflow.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Applied the Orbita session layout direction across the main session interface.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed theme and contrast regressions during the layout refresh so session surfaces remain readable.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
diff --git a/changelog/release-tracker-2026-02-26.md b/changelog/release-tracker-2026-02-26.md
new file mode 100644
index 0000000000..9e99712e2b
--- /dev/null
+++ b/changelog/release-tracker-2026-02-26.md
@@ -0,0 +1,1356 @@
+# Release Changelog Tracker
+
+Internal preparation file for release summaries. This is not yet published to the changelog page or docs.
+
+## v0.11.125
+
+#### Commit
+`7225736f`
+
+#### Released at
+`2026-02-26T22:26:17Z`
+
+#### Title
+Unified workspace navigation and smoother downloads
+
+#### One-line summary
+Unifies workspace navigation across dashboard and session views while preventing download-heavy operations from freezing the app.
+
+#### Main changes
+- Reused the same workspace and session sidebar in dashboard and session views.
+- Deduplicated equivalent remote workers and kept rows actionable during stale connects.
+- Throttled download updates so large transfers stop freezing the desktop UI.
+
+#### Lines of code changed since previous release
+710 lines changed since `v0.11.124` (160 insertions, 550 deletions).
+
+#### Release importance
+Minor release: fixes two painful interaction problems in core navigation and system responsiveness without introducing a new workflow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Unified sidebar and workspace switching behavior so navigation stays consistent and actionable.
+- Added download throttling to prevent UI freezes during large transfers.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.126
+
+#### Commit
+`42f68d9b`
+
+#### Released at
+`2026-02-27T15:47:46Z`
+
+#### Title
+Simpler artifacts and direct workspace actions
+
+#### One-line summary
+Simplifies artifact handling and adds direct worker and plugin actions so common cleanup and file workflows take fewer steps.
+
+#### Main changes
+- Replaced the inline artifact markdown editor with simpler reveal and open actions.
+- Added Open in Obsidian for markdown and Reveal in Finder or Explorer for local workers.
+- Added direct plugin removal and worker reveal actions from the main UI.
+
+#### Lines of code changed since previous release
+885 lines changed since `v0.11.125` (360 insertions, 525 deletions).
+
+#### Release importance
+Minor release: simplifies artifact management and adds faster workspace controls without changing OpenWork's overall workflow model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added direct worker and plugin quick actions so common workspace management tasks can be done from the main app surfaces.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Replaced the in-app artifact markdown editor with a simpler read-only artifact action flow.
+
+## v0.11.127
+
+#### Commit
+`7f3f70b0`
+
+#### Released at
+`2026-02-28T02:48:07Z`
+
+#### Title
+Get back online recovery and smarter Docker dev-up
+
+#### One-line summary
+Makes worker recovery clearer and preserves existing access, while smoothing Docker dev stacks for developers using local OpenCode config.
+
+#### Main changes
+- Added a plain-language Get back online action for remote worker recovery.
+- Reused existing OpenWork tokens during sandbox restarts so reconnects keep working.
+- Updated the legacy Docker dev stack to mount host OpenCode config and auth.
+
+#### Lines of code changed since previous release
+370 lines changed since `v0.11.126` (325 insertions, 45 deletions).
+
+#### Release importance
+Minor release: improves worker recovery clarity and token stability with a focused reliability update.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added a clearer in-app `Get back online` recovery action for workers.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed worker recovery so sandbox restarts can reconnect without rotating existing OpenWork tokens.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.128
+
+#### Commit
+`da183cf7`
+
+#### Released at
+`2026-03-01T18:40:52Z`
+
+#### Title
+Remote file sessions, Obsidian sync, and long-chat readability
+
+#### One-line summary
+Adds live remote file sessions with Obsidian-backed editing, then makes long desktop conversations easier to read and follow.
+
+#### Main changes
+- Added short-lived file sessions with catalog, event, read, write, rename, and delete batch APIs.
+- Mirrored remote markdown into Obsidian and synced edits back to the worker.
+- Added desktop-wide zoom shortcuts while cleaning transcript noise and live-thinking scroll behavior.
+
+#### Lines of code changed since previous release
+2719 lines changed since `v0.11.127` (2612 insertions, 107 deletions).
+
+#### Release importance
+Minor release: materially expands remote file workflows and readability, but does so as focused product improvements rather than a fundamental platform shift.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Added just-in-time file sessions for remote file workflows.
+- Added batch sync support for mirrored remote files.
+- Added desktop-wide font zoom shortcuts and whole-webview zoom for readability.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed transcript rendering so synthetic control-only parts no longer appear in the user-facing conversation.
+- Fixed live thinking updates so the transcript auto-scrolls more reliably during active runs.
+- Fixed recovery and desktop startup edge cases, including stale base URL restoration and blocking recover actions.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.129
+
+#### Commit
+`76a8217e`
+
+#### Released at
+`2026-03-02T02:35:51Z`
+
+#### Title
+Self-serve billing and media-rich messaging
+
+#### One-line summary
+Expands cloud billing into a self-serve management flow and lets Slack and Telegram carry richer OpenWork Router messages.
+
+#### Main changes
+- Added billing plan details, invoices, and subscription actions in the cloud worker dashboard.
+- Extended Slack and Telegram delivery to send richer media, not just plain text.
+- Hardened billing lookups and post-checkout navigation so account state refreshes more reliably.
+
+#### Lines of code changed since previous release
+3238 lines changed since `v0.11.128` (3061 insertions, 177 deletions).
+
+#### Release importance
+Minor release: adds two meaningful user-facing capabilities in billing and messaging without materially changing how the core product is operated.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added billing subscription controls and invoice history in the web cloud dashboard.
+- Added first-class media transport for Slack and Telegram in OpenWork Router.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Improved billing flow reliability and navigation so subscription management behaves more consistently in the web experience.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.130
+
+#### Commit
+`d1dee3ce`
+
+#### Released at
+`2026-03-02T16:58:05Z`
+
+#### Title
+Service restarts and steadier local connectivity
+
+#### One-line summary
+Adds in-app restart controls, makes router startup recover from local port conflicts, and smooths billing returns from checkout.
+
+#### Main changes
+- Added Settings actions to restart orchestrator, OpenCode, OpenWork server, and OpenCodeRouter.
+- Moved OpenCodeRouter onto conflict-free localhost health ports and retried startup failures automatically.
+- Restored billing state after checkout returns and dropped Telegram self-echo loops.
+
+#### Lines of code changed since previous release
+637 lines changed since `v0.11.129` (540 insertions, 97 deletions).
+
+#### Release importance
+Minor release: focuses on service recovery and billing-flow reliability with targeted fixes and controls.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added in-app restart controls for local services in desktop settings.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed router startup so local connectivity is less likely to fail during desktop launch.
+- Fixed billing session recovery after checkout redirects in the web cloud flow.
+- Fixed Telegram router handling so bot-authored echoes no longer create noisy loops.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.131
+
+#### Commit
+`de9b5cc6`
+
+#### Released at
+`2026-03-04T17:15:52Z`
+
+#### Title
+Virtualized chats and clearer runtime status
+
+#### One-line summary
+Keeps long sessions responsive with virtualized rendering, clearer runtime status, and optional auto-compaction after runs finish.
+
+#### Main changes
+- Virtualized long transcripts so large chats stay responsive instead of rendering every message at once.
+- Replaced split engine and server badges with one Ready indicator that opens a detailed status popover.
+- Added automatic context compaction after runs, plus persistent language selection and sturdier file opening.
+
+#### Lines of code changed since previous release
+1494 lines changed since `v0.11.130` (1134 insertions, 360 deletions).
+
+#### Release importance
+Major release: substantially improves how users run and monitor long OpenWork sessions through rendering, status, and compaction changes across core app surfaces.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+4
+
+#### Major improvement details
+- Added virtualized session rendering for long chats.
+- Added a unified status indicator with a detail popover.
+- Added an automatic context compaction toggle.
+- Added persistent language selection in settings.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed a regression where virtualized sessions could show blank transcripts.
+- Fixed editor and artifact file opening so local file targets resolve more reliably.
+- Fixed cross-session visibility for pending subagent prompts so important follow-up work is easier to notice.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.132
+
+#### Commit
+`1f641dbf`
+
+#### Released at
+`2026-03-05T00:06:28Z`
+
+#### Title
+Chat-first startup and faster long-session loading
+
+#### One-line summary
+Preserves the new-session launch state, fixes first-run setup, and makes long chats load from the latest messages with less lag.
+
+#### Main changes
+- Kept `/session` as an empty draft view instead of bouncing users into an older chat.
+- Added a first-run worker empty state, created the first chat automatically, and routed non-media uploads into inbox links.
+- Opened sessions at the latest messages, paged older history on demand, and collapsed oversized markdown by default.
+
+#### Lines of code changed since previous release
+611 lines changed since `v0.11.131` (447 insertions, 164 deletions).
+
+#### Release importance
+Minor release: tightens startup, first-run, and transcript responsiveness issues in the core session experience.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Fixed startup so `/session` can remain an empty draft state instead of redirecting away unexpectedly.
+- Fixed first-run chat creation so new users land in a usable conversation flow.
+- Fixed non-media upload handling so those files go to the inbox flow correctly.
+- Fixed conversation opening behavior so sessions land at the latest messages instead of an older position.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.133
+
+#### Commit
+`f11cad48`
+
+#### Released at
+`2026-03-05T15:54:31Z`
+
+#### Title
+Chat transcripts stop flickering during typing
+
+#### One-line summary
+Keeps active and long-running sessions visually stable by fixing typing flicker, remount churn, and collapsed long-message resets.
+
+#### Main changes
+- Fixed transcript flicker while typing in active chats.
+- Kept long sessions steadier by reducing remount churn in tail-loaded message lists.
+- Preserved expanded long-markdown state instead of collapsing it again mid-session.
+
+#### Lines of code changed since previous release
+292 lines changed since `v0.11.132` (163 insertions, 129 deletions).
+
+#### Release importance
+Minor release: delivers a focused session-rendering stability pass for active and long-running chats.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed transcript flicker that could appear while typing in active chats.
+- Fixed remount churn in tail-loaded virtualized sessions.
+- Fixed long-markdown collapse state so it no longer resets unexpectedly.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.134
+
+#### Commit
+`d1658182`
+
+#### Released at
+`2026-03-06T07:28:11Z`
+
+#### Title
+Remote MCP setup gets lighter, with exportable desktop diagnostics
+
+#### One-line summary
+Makes remote-workspace MCP connection setup clearer and adds in-app debug exports, sandbox probes, and config actions for faster troubleshooting.
+
+#### Main changes
+- Remote workspaces now steer MCP setup toward URL-based connections, with optional OAuth and safer reload prompts.
+- Settings can copy or export a runtime debug report and run a sandbox probe.
+- Settings can also reveal or reset workspace config without leaving the app.
+
+#### Lines of code changed since previous release
+852 lines changed since `v0.11.133` (789 insertions, 63 deletions).
+
+#### Release importance
+Minor release: improves remote setup and troubleshooting with targeted workflow and diagnostics additions.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Simplified remote MCP setup for remote workspaces.
+- Added exportable debug reports and config actions in Settings.
+- Added sandbox probe diagnostics export for desktop troubleshooting.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.135
+
+#### Commit
+`5d7185b4`
+
+#### Released at
+`2026-03-06T19:43:28Z`
+
+#### Title
+Bundled OpenCode version stays aligned across release paths
+
+#### One-line summary
+Pins the packaged OpenCode fallback consistently across CI, prerelease, and release builds, with no notable new app workflow changes.
+
+#### Main changes
+Keeps the bundled OpenCode fallback pinned to the same version across CI, prerelease, and release artifacts so packaged builds drift less, without introducing new user-facing OpenWork workflows.
+
+#### Lines of code changed since previous release
+61 lines changed since `v0.11.134` (31 insertions, 30 deletions).
+
+#### Release importance
+Minor release: tightens release-path consistency for bundled OpenCode behavior without adding new user-facing product workflows.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.136
+
+#### Commit
+`83593bdf`
+
+#### Released at
+`2026-03-10T04:00:32Z`
+
+#### Title
+OpenWork Share turns dropped files into worker packages
+
+#### One-line summary
+Adds a real worker-packaging flow in OpenWork Share, rebuilds the share site on the Next.js App Router, and makes provider connections easier to manage.
+
+#### Main changes
+- OpenWork Share now packages dropped skills, agents, commands, and MCP or OpenWork config into worker bundles.
+- The share site moves to the Next.js App Router with refreshed home and bundle pages.
+- Settings now lets users disconnect providers, while OAuth completion and sandbox startup recover more reliably.
+
+#### Lines of code changed since previous release
+12837 lines changed since `v0.11.135` (9531 insertions, 3306 deletions).
+
+#### Release importance
+Major release: substantially changes the share workflow and related web surfaces while also landing broad reliability and account-management improvements across core product areas.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Turned OpenWork Share into a worker packager.
+- Replatformed OpenWork Share onto the Next.js App Router.
+- Added provider disconnect controls in Settings.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed provider OAuth polling so connection flows complete more reliably.
+- Fixed sandbox Docker preflight hangs that could block local startup.
+- Fixed theme and workspace-state issues that made desktop and session behavior less predictable.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.137
+
+#### Commit
+`cc5700a1`
+
+#### Released at
+`2026-03-11T06:01:10Z`
+
+#### Title
+MCP sign-in retries and model setup get clearer
+
+#### One-line summary
+Makes MCP OAuth flows recover more reliably and reorganizes the model picker so disconnected providers route users straight to setup.
+
+#### Main changes
+- MCP auth now waits through reloads, reopens the browser flow clearly, and keeps retry states visible.
+- The model picker separates enabled providers from setup-needed ones and links the latter to Settings.
+- Remote MCP cards now expose login actions before a server is connected.
+
+#### Lines of code changed since previous release
+734 lines changed since `v0.11.136` (562 insertions, 172 deletions).
+
+#### Release importance
+Minor release: focuses on auth and model-selection reliability with a small follow-up packaging alignment fix.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed MCP auth connection flows so browser handoff, retry, and reconnect behavior are more reliable.
+- Fixed model picker provider grouping and routing so provider setup actions are clearer and less error-prone.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.138
+
+#### Commit
+`5307ce16`
+
+#### Released at
+`2026-03-11T15:19:39Z`
+
+#### Title
+Shared bundle links now open the blueprints worker flow
+
+#### One-line summary
+Routes shared bundle imports into the blueprints-style worker creation path so new-worker links land in the setup flow users expect.
+
+#### Main changes
+Shared bundle deep links now open the worker-creation flow with the right blueprints preset, then continue import through the intended setup path instead of dropping users into the wrong workspace flow.
+
+#### Lines of code changed since previous release
+143 lines changed since `v0.11.137` (101 insertions, 42 deletions).
+
+#### Release importance
+Minor release: delivers a focused fix for shared bundle import routing without broader product-surface changes.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed shared bundle imports so they route through the blueprints flow instead of landing in the wrong setup path.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.140
+
+#### Commit
+`77d2f1cc`
+
+#### Released at
+`2026-03-11T19:14:14Z`
+
+#### Title
+Shared bundle imports land on the intended worker
+
+#### One-line summary
+Makes shared bundle imports resolve to the exact active or newly created worker and adds more actionable sandbox startup diagnostics.
+
+#### Main changes
+- Imports now match the active or newly created worker by workspace ID, local root, or directory hint.
+- Sandbox startup logs now capture resolved Docker paths and launch arguments in the debug report.
+- Failed detached-worker launches surface clearer stage and spawn diagnostics.
+
+#### Lines of code changed since previous release
+460 lines changed since `v0.11.138` (364 insertions, 96 deletions).
+
+#### Release importance
+Minor release: fixes import targeting and worker startup clarity without materially changing OpenWork's overall product shape.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed shared skill imports so they open on the worker that was just created instead of misrouting users afterward.
+- Improved sandbox startup diagnostics so failed worker launches provide clearer recovery information.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.141
+
+#### Commit
+`9af84bd0`
+
+#### Released at
+`2026-03-12T01:33:57Z`
+
+#### Title
+App and worker opens stay on the new session screen
+
+#### One-line summary
+Keeps launch actions anchored on the new session flow while making oversized-context errors, share feedback, and support booking clearer.
+
+#### Main changes
+- Opening the app or a new worker now stays on the new-session screen instead of jumping away unexpectedly.
+- The todo strip docks to the composer, and HTTP 413 errors now suggest compaction or a fresh session.
+- OpenWork Share adds inline link-success feedback, and the Book a Call form gets clearer topic cards.
+
+#### Lines of code changed since previous release
+5453 lines changed since `v0.11.140` (3894 insertions, 1559 deletions).
+
+#### Release importance
+Minor release: improves session flow, share feedback, and support-entry polish without introducing a major product-level shift.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Refreshed the Book a Call form with conversation topics and a more usable layout.
+- Added inline success feedback and richer content handling on OpenWork Share surfaces.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Kept app and worker open actions anchored on the new session screen.
+- Docked the todo strip to the composer so long session flows feel more coherent.
+- Added a clearer user-facing message for HTTP 413 context-too-large failures.
+- Included stage diagnostics in sandbox probe timeout errors so desktop startup failures are easier to diagnose.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.142
+
+#### Commit
+`f9b586ae`
+
+#### Released at
+`2026-03-12T01:48:01Z`
+
+#### Title
+Version alignment patch
+
+#### One-line summary
+Republishes synchronized app, server, orchestrator, and router versions so shipped artifacts stay in lockstep, with no visible workflow changes.
+
+#### Main changes
+Republishes synchronized desktop, server, orchestrator, and router packages so installs resolve the same version everywhere. No clear user-facing or developer-facing workflow changes land in this patch.
+
+#### Lines of code changed since previous release
+26 lines changed since `v0.11.141` (13 insertions, 13 deletions).
+
+#### Release importance
+Minor release: keeps release artifacts aligned for distribution without changing how users use OpenWork.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.143
+
+#### Commit
+`41aeb178`
+
+#### Released at
+`2026-03-12T20:51:40Z`
+
+#### Title
+Free first Den worker and Google signup
+
+#### One-line summary
+Lets new users create one free Den worker without billing, sign up with Google, and enter a much clearer cloud onboarding path.
+
+#### Main changes
+Den now lets new users create one free cloud worker without billing and sign up with Google.
+
+Also released:
+
+- Retired remaining Soul-mode surfaces across the app and server.
+- Showed session errors inline, removed raw markdown flashes, and refreshed share bundle pages and previews.
+
+#### Lines of code changed since previous release
+9937 lines changed since `v0.11.142` (6244 insertions, 3693 deletions).
+
+#### Release importance
+Major release: meaningfully changes the Den onboarding and cloud-worker experience while also retiring older Soul-mode surfaces.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+5
+
+#### Major improvement details
+- Refreshed the Den landing page with a much fuller hero, comparison, support, and CTA flow.
+- Allowed one free cloud worker without billing.
+- Added Google authentication to Den signup.
+- Added Den worker runtime upgrade messaging and controls.
+- Restyled shared bundle pages and Open Graph previews for public sharing.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Showed session errors inline in chat instead of leaving failures harder to interpret.
+- Prevented raw markdown from flashing while streaming responses render.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Removed remaining Soul mode surfaces from the app.
+
+## v0.11.144
+
+#### Commit
+`5ddc4647`
+
+#### Released at
+`2026-03-12T22:53:50Z`
+
+#### Title
+Workspace shell recovery and clearer docs entrypoints
+
+#### One-line summary
+Restores reliable workspace-shell navigation and reset recovery, seeds Chrome DevTools setup correctly, and splits docs paths for technical and non-technical readers.
+
+#### Main changes
+- Kept dashboard, session, and Settings navigation inside the workspace shell so sidebars stay reachable.
+- Fully cleared desktop reset state on relaunch and seeded Control Chrome as `chrome-devtools` for smoother MCP setup.
+- Split docs entrypoints into technical and non-technical paths so onboarding starts in the right place.
+
+#### Lines of code changed since previous release
+1185 lines changed since `v0.11.143` (868 insertions, 317 deletions).
+
+#### Release importance
+Minor release: focuses on reliability and navigation fixes plus targeted polish to Den and MCP setup.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Kept workspace shell navigation reachable across dashboard and session flows.
+- Fully cleared desktop reset state on relaunch so recovery actually resets cleanly.
+- Seeded Control Chrome as `chrome-devtools` so browser-tooling setup works more predictably.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.145
+
+#### Commit
+`8ceed304`
+
+#### Released at
+`2026-03-13T05:47:09Z`
+
+#### Title
+Den admin backoffice and support routing
+
+#### One-line summary
+Adds a protected Den admin panel for support operations, routes enterprise contact submissions into Loops, and tightens desktop skill reload and settings diagnostics.
+
+#### Main changes
+- Added a protected Den admin backoffice with signup, worker, and billing visibility for internal support.
+- Routed enterprise contact requests into Loops and restored a mobile logout path in Den.
+- Surfaced skill reload and sharing feedback more clearly and moved runtime status into Settings > Advanced.
+
+#### Lines of code changed since previous release
+2493 lines changed since `v0.11.144` (2031 insertions, 462 deletions).
+
+#### Release importance
+Minor release: adds a focused operator capability and several UX improvements without broadly reshaping the OpenWork product.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a Den admin backoffice dashboard for internal support and worker operations.
+- Wired enterprise contact submissions into Loops for follow-up handling.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Improved skill sharing and hot-reload flows in the desktop app.
+- Restored a mobile logout path in Den.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.146
+
+#### Commit
+`8809a801`
+
+#### Released at
+`2026-03-13T19:14:51Z`
+
+#### Title
+Failed worker redeploy and safer skill imports
+
+#### One-line summary
+Adds direct Den worker redeploys, makes shared skills pick a destination worker before import, and improves both local Den setup and Chrome-first guidance.
+
+#### Main changes
+- Added a redeploy action for failed Den workers so users can recover instead of getting stuck.
+- Made shared skill imports choose a destination worker before import, including new-worker and remote-worker paths.
+- Added a dockerized local Den test stack and pushed browser setup toward the Chrome MCP path.
+
+#### Lines of code changed since previous release
+3499 lines changed since `v0.11.145` (2158 insertions, 1341 deletions).
+
+#### Release importance
+Minor release: improves recovery, import routing, and shell usability in focused ways without a major product-level change.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a failed-worker redeploy action in Den.
+- Added destination-worker selection before importing shared skills.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Kept the status footer more stable when moving between settings and sessions.
+- Made the browser quickstart target Chrome MCP first so setup guidance matches the expected path better.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.147
+
+#### Commit
+`a829371b`
+
+#### Released at
+`2026-03-14T01:31:52Z`
+
+#### Title
+Existing-worker imports and local Share publishing
+
+#### One-line summary
+Lets shared skills install into existing workers, adds a local Docker-backed Share publisher for self-hosted testing, and keeps Den worker provisioning current.
+
+#### Main changes
+Shared skills can now be imported straight into an existing worker from the app.
+
+Also released:
+
+- Added a local Docker-backed Share publisher for self-hosted dev flows.
+- Bundled fresh OpenCode builds for Den workers and improved missing Chrome extension guidance.
+
+#### Lines of code changed since previous release
+1727 lines changed since `v0.11.146` (1551 insertions, 176 deletions).
+
+#### Release importance
+Minor release: extends sharing workflows and fixes setup friction without materially changing OpenWork's overall architecture.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Added an existing-worker import flow for shared skills.
+- Added a local Docker publisher flow for OpenWork Share.
+- Bundled OpenCode for Den Render workers so worker provisioning is more self-contained.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Added in-app guidance when the Chrome control extension is missing.
+- Fixed long pasted skill previews so wrapping remains readable.
+- Stopped pinning stale OpenCode builds in Den worker provisioning.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.148
+
+#### Commit
+`9a3aef42`
+
+#### Released at
+`2026-03-14T22:28:03Z`
+
+#### Title
+Guided Den onboarding and single-skill Share
+
+#### One-line summary
+Turns Den signup into a calmer guided flow with clearer provisioning states while refocusing OpenWork Share on publishing one skill well.
+
+#### Main changes
+- Rebuilt Den onboarding as a guided flow with clearer naming, intent, loading, and browser-access states.
+- Simplified OpenWork Share to publish a single skill, with cleaner frontmatter and fuller shared previews.
+- Added a polished feedback card and clearer import and status feedback across app surfaces.
+
+#### Lines of code changed since previous release
+4390 lines changed since `v0.11.147` (2764 insertions, 1626 deletions).
+
+#### Release importance
+Major release: substantially changes both Den onboarding and the OpenWork Share publishing flow in ways users will immediately notice.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Redesigned Den onboarding into a guided stepper flow.
+- Simplified OpenWork Share to publish a single skill.
+- Added a polished feedback entrypoint card in Settings.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Polished the shared skill import flow so import progress and outcomes are clearer.
+- Slimmed session sidebar density so active chat navigation is easier to scan.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.149
+
+#### Commit
+`6acc6f79`
+
+#### Released at
+`2026-03-14T23:56:20Z`
+
+#### Title
+Richer skill previews and steadier jump-to-latest
+
+#### One-line summary
+Makes shared skill pages easier to evaluate before import, steadies the worker-selection flow, and keeps long chats pinned to the newest reply while thinking.
+
+#### Main changes
+- Simplified shared skill pages and added richer workspace previews before import.
+- Steadied shared-skill deep-link handling and worker selection so imports fire once and land more predictably.
+- Kept Jump to latest pinned during assistant thinking and reduced blank tail space in long chats.
+
+#### Lines of code changed since previous release
+3906 lines changed since `v0.11.148` (2531 insertions, 1375 deletions).
+
+#### Release importance
+Minor release: focuses on stabilizing sharing and long-chat behavior rather than introducing a new top-level workflow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Simplified shared skill pages so previews are easier to understand before import.
+- Steadied the shared skill import flow so destination handling behaves more predictably.
+- Kept Jump to latest pinning stable while long responses are still streaming.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.150
+
+#### Commit
+`4f89e04d`
+
+#### Released at
+`2026-03-15T01:05:19Z`
+
+#### Title
+Faster provider setup and steadier chat rendering
+
+#### One-line summary
+Prioritizes common providers in new-session setup, reduces inline image churn while chatting, and routes feedback straight to the team inbox.
+
+#### Main changes
+- Moved common providers like OpenAI and Anthropic to the front and hid the redundant ChatGPT prompt in new-session setup.
+- Reduced inline image rerender churn so active chats feel steadier.
+- Kept Settings width stable and sent feedback from Settings directly to the team inbox.
+
+#### Lines of code changed since previous release
+342 lines changed since `v0.11.149` (241 insertions, 101 deletions).
+
+#### Release importance
+Minor release: delivers focused session and settings polish without materially changing OpenWork's broader workflows.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Prioritized common providers in the auth flow so setup starts from the most likely choices.
+- Hid a redundant ChatGPT prompt in the session flow.
+- Reduced inline image churn during chat rendering.
+- Kept the settings shell width stable and routed feedback to the team inbox.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
diff --git a/changelog/release-tracker-2026-03-15.md b/changelog/release-tracker-2026-03-15.md
new file mode 100644
index 0000000000..a98ad5a5ab
--- /dev/null
+++ b/changelog/release-tracker-2026-03-15.md
@@ -0,0 +1,1324 @@
+# Release Changelog Tracker
+
+Internal preparation file for release summaries. This is not yet published to the changelog page or docs.
+
+## v0.11.151
+
+#### Commit
+`5e606273`
+
+#### Released at
+`2026-03-15T03:20:31Z`
+
+#### Title
+Feedback emails reach the team inbox again
+
+#### One-line summary
+Fixes the in-app feedback email target so reports reach the shared OpenWork inbox again.
+
+#### Main changes
+Updates the feedback mail link to send reports to `team@openworklabs.com`, restoring the intended shared inbox for in-app feedback.
+
+#### Lines of code changed since previous release
+81 lines changed since `v0.11.150` (55 insertions, 26 deletions).
+
+#### Release importance
+Minor release: fixes a focused feedback delivery problem without changing the surrounding product flow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed the feedback flow so submitted messages are sent to the OpenWork team inbox.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.152
+
+#### Commit
+`2386e59d`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-14T20:53:19-07:00`.
+
+#### Title
+CI workflows move to Blacksmith runners
+
+#### One-line summary
+Moves CI and release workflows onto Blacksmith-backed runners, with no visible OpenWork app, web, or server workflow change.
+
+#### Main changes
+Repoints CI and release workflows to Blacksmith runners and larger Linux release builders, tightening the release pipeline without changing user-facing product behavior.
+
+#### Lines of code changed since previous release
+70 lines changed since `v0.11.151` (35 insertions, 35 deletions).
+
+#### Release importance
+Minor release: updates release infrastructure only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.153
+
+#### Commit
+`f35422b7`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-14T22:35:30-07:00`.
+
+#### Title
+Live session updates and scroll pinning recover
+
+#### One-line summary
+Restores real-time assistant streaming in sessions while keeping long replies pinned correctly and web event streaming more reliable.
+
+#### Main changes
+- Restored incremental session text updates so assistant replies stream live again.
+- Reworked chat pinning and jump controls so long responses stay easier to follow.
+- Let the web proxy pass event streams through more safely during fallback handling.
+
+#### Lines of code changed since previous release
+449 lines changed since `v0.11.152` (315 insertions, 134 deletions).
+
+#### Release importance
+Minor release: repairs a core live-session behavior without materially changing OpenWork's overall workflow model.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Restored live session updates so streaming conversations refresh in place again.
+- Fixed scroll pinning so active sessions can stay attached to the newest output.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.154
+
+#### Commit
+`90c167f9`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-15T07:58:03-07:00`.
+
+#### Title
+Desktop release packaging is reworked
+
+#### One-line summary
+Reorganizes the desktop release pipeline around workflow artifacts and staged asset upload, with no direct product workflow change.
+
+#### Main changes
+Rebuilds the desktop release pipeline to package workflow artifacts first, verify bundled sidecar metadata, and upload release assets in a later step, including a dedicated Linux ARM64 path.
+
+#### Lines of code changed since previous release
+976 lines changed since `v0.11.153` (488 insertions, 488 deletions).
+
+#### Release importance
+Minor release: updates release packaging only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.155
+
+#### Commit
+`725b2117`
+
+#### Released at
+`2026-03-15T16:08:25Z`
+
+#### Title
+Windows release diagnostics stop masking failures
+
+#### One-line summary
+Improves release-pipeline diagnostics and normalizes workflow action inputs so broken Windows packaging runs are easier to debug.
+
+#### Main changes
+Fixes the Windows GitHub connectivity diagnostic step and aligns release-action input names so maintainers get clearer failure signals during desktop release packaging.
+
+#### Lines of code changed since previous release
+51 lines changed since `v0.11.154` (27 insertions, 24 deletions).
+
+#### Release importance
+Minor release: improves release reliability only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.156
+
+#### Commit
+`598fed9d`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-15T10:06:37-07:00`.
+
+#### Title
+Desktop release packaging splits build from upload
+
+#### One-line summary
+Restructures desktop release automation to build artifacts first, bundle Linux ARM separately, and upload assets in a final pass.
+
+#### Main changes
+Splits desktop releases into build, bundle, and upload stages, adds separate Linux ARM packaging, and introduces automated asset upload from workflow artifacts.
+
+#### Lines of code changed since previous release
+602 lines changed since `v0.11.155` (486 insertions, 116 deletions).
+
+#### Release importance
+Minor release: updates release packaging flow only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.157
+
+#### Commit
+`fca457be`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-15T12:27:44-07:00`.
+
+#### Title
+Den access controls tighten and nested task sessions return
+
+#### One-line summary
+Hardens Den sign-in and worker access while restoring inline subagent transcripts, selected-row session actions, and cleaner feedback links.
+
+#### Main changes
+- Requires verified Den accounts, removes exposed host tokens, and limits worker access more tightly by user role.
+- Renders subagent sessions inline under task steps and moves rename/delete actions into the selected session row.
+- Opens feedback mail links in place on the web instead of leaving a blank tab behind.
+
+#### Lines of code changed since previous release
+706 lines changed since `v0.11.156` (485 insertions, 221 deletions).
+
+#### Release importance
+Minor release: improves session clarity and fixes a few focused interaction issues without changing the broader OpenWork model.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed subagent sessions so child work stays attached to the task step that spawned it.
+- Fixed session list actions so controls live on the selected row instead of feeling misplaced.
+- Fixed web feedback email links so they no longer open a stray blank tab.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.158
+
+#### Commit
+`09837baf`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-15T12:43:37-07:00`.
+
+#### Title
+Orchestrator npm publish runs from package cwd
+
+#### One-line summary
+Fixes the release workflow so `openwork-orchestrator` publishes from `packages/orchestrator`, with no visible app or web workflow change.
+
+#### Main changes
+Corrects the orchestrator publish job to run from the package directory so sidecar build and npm publish steps use the right paths.
+
+#### Lines of code changed since previous release
+33 lines changed since `v0.11.157` (17 insertions, 16 deletions).
+
+#### Release importance
+Minor release: updates release publishing plumbing only, with no intended user-facing product change.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.159
+
+#### Commit
+`0559b341`
+
+#### Released at
+`2026-03-15T20:36:46Z`
+
+#### Title
+Den cloud billing and worker launch align
+
+#### One-line summary
+Aligns the app-hosted Den flow with landing-page messaging, restores checkout handling for extra workers, and fixes visible billing and marketing regressions.
+
+#### Main changes
+- Reworked the app cloud-worker flow to match the Den landing experience and messaging.
+- Restored Polar checkout and return handling for additional cloud workers.
+- Fixed the Den marketing rail and removed a dead billing navigation path.
+
+#### Lines of code changed since previous release
+2472 lines changed since `v0.11.158` (1192 insertions, 1280 deletions).
+
+#### Release importance
+Minor release: meaningfully improves the hosted cloud flow and corrects a couple of visible web regressions without redefining OpenWork's overall product shape.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Aligned the app cloud-worker flow with the Den landing experience for a more consistent hosted setup path.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed the Den marketing rail so the hosted web surface renders correctly again.
+- Removed an impossible billing navigation branch from the cloud control experience.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.160
+
+#### Commit
+`a9e56ec0`
+
+#### Released at
+`2026-03-15T23:51:50Z`
+
+#### Title
+Den auth, downloads, and nested sessions polish
+
+#### One-line summary
+Simplifies the Den auth entry flow, sends landing-page downloads to the right installer, and restores parent-child session browsing in the sidebar.
+
+#### Main changes
+- Simplified the Den auth screen so account entry is lighter and easier to scan.
+- Download buttons now choose the right installer for the visitor's OS and architecture.
+- Sidebar previews now keep subagent sessions nested under their parent tasks.
+
+#### Lines of code changed since previous release
+475 lines changed since `v0.11.159` (303 insertions, 172 deletions).
+
+#### Release importance
+Minor release: delivers a collection of focused UX and reliability fixes across key web and session surfaces without changing the core OpenWork workflow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Simplified the Den auth screen so the hosted sign-in path is less confusing.
+- Fixed landing download CTAs so they point users to the right installer for their OS and architecture.
+- Fixed nested session rendering so subagent sessions appear under their parent tasks with clearer list structure.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.161
+
+#### Commit
+`4fb90428`
+
+#### Released at
+Unreleased tag only. No published GitHub release. Tagged at `2026-03-15T16:48:43-07:00`.
+
+#### Title
+Den first-run goes straight to connect
+
+#### One-line summary
+Cuts onboarding friction by removing the intent step, waiting for session hydration cleanly, and ending first-run on a direct connect screen.
+
+#### Main changes
+Removes the extra intent step, drops the transient marketing-heavy auth shell, and adds a dedicated final connect screen so new Den users can launch a worker and open it in OpenWork with fewer detours.
+
+#### Lines of code changed since previous release
+448 lines changed since `v0.11.160` (198 insertions, 250 deletions).
+
+#### Release importance
+Minor release: improves a focused hosted onboarding path without materially changing OpenWork's broader product model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Improved the Den first-run experience so the hosted setup path feels more focused and intentional.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.162
+
+#### Commit
+`770c9473`
+
+#### Released at
+`2026-03-16T00:51:15Z`
+
+#### Title
+Docker dev prints LAN-ready OpenWork URLs
+
+#### One-line summary
+Makes local Docker testing easier from phones and other devices by printing public URLs and deriving Den auth and CORS defaults from the detected host.
+
+#### Main changes
+- The legacy Docker dev stack now prints localhost, hostname, and LAN IP URLs for the app, server, and share service.
+- `den-dev-up.sh` derives auth URLs and trusted origins for cross-device testing.
+- Added `OPENWORK_PUBLIC_HOST` and `DEN_PUBLIC_HOST` overrides when auto-detection is wrong.
+
+#### Lines of code changed since previous release
+149 lines changed since `v0.11.161` (130 insertions, 19 deletions).
+
+#### Release importance
+Minor release: improves local stack accessibility for testing and self-hosted development without changing the main OpenWork product flow.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Improved Docker dev-stack defaults so OpenWork is easier to access from other devices on local networks.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.163
+
+#### Commit
+`69249a20`
+
+#### Released at
+`2026-03-16T02:47:00Z`
+
+#### Title
+Custom skill hub repos and steadier session actions
+
+#### One-line summary
+Lets teams browse and install skills from any GitHub hub repo while making session switching, composer focus, and reload prompts behave more predictably.
+
+#### Main changes
+- Added custom GitHub skill hub repos, including saved repo selection and install-from-that-repo flows.
+- Cmd+K session actions now return focus to the composer after opening or creating sessions.
+- Restored the inline skill reload banner and cleaned up workspace status alignment.
+
+#### Lines of code changed since previous release
+1169 lines changed since `v0.11.162` (1034 insertions, 135 deletions).
+
+#### Release importance
+Minor release: adds a focused new skills-source capability and cleans up session interaction issues without changing the product's overall shape.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added custom GitHub skill hub repository support so organizations can use their own hosted skill sources inside OpenWork.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Preserved composer focus after Cmd+K session actions.
+- Restored the inline skill reload banner in sessions.
+- Aligned worker status labels with worker names for clearer scanning.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.164
+
+#### Commit
+`b88e2b53`
+
+#### Released at
+`2026-03-16T15:14:38Z`
+
+#### Title
+Owner tokens and child sessions stay visible
+
+#### One-line summary
+Clarifies remote approval access with owner tokens, keeps nested child sessions from disappearing in sidebar syncs, and broadens polish across sharing and localization.
+
+#### Main changes
+- Remote and cloud connect flows now expose owner tokens separately from collaborator tokens for permission prompts.
+- Sidebar resyncs stop dropping child task sessions when root items refresh.
+- Added Japanese localization and sharper HTML-first share previews.
+
+#### Lines of code changed since previous release
+2418 lines changed since `v0.11.163` (1907 insertions, 511 deletions).
+
+#### Release importance
+Minor release: improves visibility, recovery, and localization across key flows without materially changing OpenWork's core architecture.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added full Japanese localization coverage for the app.
+- Improved share previews with HTML-first crawler links and more polished Open Graph cards.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Preserved child task sessions during root sidebar syncs.
+- Exposed owner tokens in remote permission prompts so recovery flows are easier to finish.
+- Allowed removing the default skills hub repository for fully custom skills setups.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.165
+
+#### Commit
+`d556ed53`
+
+#### Released at
+`2026-03-17T02:56:06Z`
+
+#### Title
+Settings can sign into Cloud and open workers
+
+#### One-line summary
+Adds an in-app OpenWork Cloud settings flow for sign-in, org selection, and worker opening, while smoothing desktop auth handoff and share reliability.
+
+#### Main changes
+- Added a Cloud tab in Settings for sign-in, org selection, worker lists, and opening ready Den workers into OpenWork.
+- Routed desktop auth through the web handoff flow, including installed-app scheme support and bearer-session handling.
+- Restored shared bundle installs and fully cleared disconnected provider credentials.
+
+#### Lines of code changed since previous release
+3120 lines changed since `v0.11.164` (2391 insertions, 729 deletions).
+
+#### Release importance
+Major release: introduces a substantial new OpenWork Cloud workflow and expands how users authenticate and open cloud workers from the product.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added OpenWork Cloud authentication and worker-open controls directly in Settings.
+- Added web-based desktop auth handoff for Den so cloud and desktop sign-in flows connect more smoothly.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Restored shared bundle installs and repeat app opens in OpenWork Share.
+- Fully cleared disconnected provider credentials.
+- Fixed Den auth handoff to use the installed desktop scheme reliably.
+- Improved share preview readability so unfurls are easier to scan.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.166
+
+#### Commit
+`81882826`
+
+#### Released at
+`2026-03-17T05:45:14Z`
+
+#### Title
+Daytona-backed Den Docker flow ships
+
+#### One-line summary
+Introduces a Daytona-first local Den stack with a worker proxy and snapshot tooling, while tightening org setup and local developer startup paths.
+
+#### Main changes
+- Added a Daytona-backed Den Docker flow with a dedicated worker proxy and snapshot builder for preloaded runtimes.
+- Introduced the `den-v2` control plane and shared Den DB packages for the new hosted-worker path.
+- Fixed unique org slug generation and the `webdev:local` startup script.
+
+#### Lines of code changed since previous release
+13718 lines changed since `v0.11.165` (12760 insertions, 958 deletions).
+
+#### Release importance
+Major release: lands a major Den runtime and development-stack expansion that materially changes how cloud-worker flows are developed and tested.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added a full Daytona-backed Den Docker development flow with new controller, proxy, schema, and provisioning pieces for cloud-worker workflows.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Enforced stable org and environment syncing with unique org slugs for Den dev setups.
+- Fixed the `webdev:local` helper script so local web startup works reliably.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.167
+
+#### Commit
+`5ac86e5a`
+
+#### Released at
+Unreleased draft release. Tagged at `2026-03-16T22:50:30-07:00`.
+
+#### Title
+Cloud settings stay gated by developer mode
+
+#### One-line summary
+Keeps the Cloud settings tab and default settings route aligned with developer mode so regular users do not land in unfinished controls.
+
+#### Main changes
+Fixes the Settings tab list and default settings route so Cloud controls only appear in developer mode, matching the intended rollout of the new OpenWork Cloud panel.
+
+#### Lines of code changed since previous release
+45 lines changed since `v0.11.166` (23 insertions, 22 deletions).
+
+#### Release importance
+Minor release: fixes a narrow but important settings visibility regression for advanced cloud workflows.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Restored access to Cloud settings controls in Developer Mode so advanced cloud setup remains reachable.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.168
+
+#### Commit
+`603ddfee`
+
+#### Released at
+`2026-03-17T06:27:40Z`
+
+#### Title
+Release recovery with repaired installers
+
+#### One-line summary
+Republishes the release with repaired assets; the tagged diff itself is metadata-only, while the intended Cloud tab gating fix landed in `v0.11.167`.
+
+#### Main changes
+This tag mainly recovers the release process: `v0.11.167..v0.11.168` only bumps package versions, while the user-visible Cloud settings gating change was already in the prior tag.
+
+#### Lines of code changed since previous release
+26 lines changed since `v0.11.167` (13 insertions, 13 deletions).
+
+#### Release importance
+Minor release: recovers a small settings-flow fix and restores release/install reliability without changing the product's broader behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Prevented hidden Cloud settings state from stranding Den desktop handoff flows.
+- Restored frozen-lockfile release installs and the expected desktop asset publication set.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.169
+
+#### Commit
+`9ea1957b`
+
+#### Released at
+`2026-03-18T00:11:42Z`
+
+#### Title
+Den handoff and session chrome get steadier
+
+#### One-line summary
+Keeps Den browser handoff and worker naming in sync while cleaning up session focus, reload banners, run status, and broken sidebar affordances.
+
+#### Main changes
+Hardened Den sign-in and worker-open handoff by separating browser and API base URLs and returning proxy-safe desktop auth URLs.
+
+Also released:
+
+- Restored composer focus, flattened reload banners, and removed the broken artifacts rail.
+- Simplified OpenWork Share OG previews and cleaned up Den landing CTAs.
+
+#### Lines of code changed since previous release
+3699 lines changed since `v0.11.168` (2421 insertions, 1278 deletions).
+
+#### Release importance
+Minor release: focuses on connection reliability and session polish across existing workflows rather than reshaping the product.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+5
+
+#### Major bug fix details
+- Persisted Den browser and API base URLs separately to avoid broken desktop handoff state.
+- Restored proxy-safe desktop handoff and browser-facing CORS behavior for Den workers.
+- Kept open-in-web links auto-connecting reliably into sessions.
+- Restored composer focus after command actions and simplified session run-state feedback.
+- Removed the broken artifacts rail and flattened the reload-required banner in sessions.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.170
+
+#### Commit
+`3869313b`
+
+#### Released at
+`2026-03-19T17:27:40Z`
+
+#### Title
+OpenWork Cloud web flows and remote reconnects improve
+
+#### One-line summary
+Reworks the hosted Cloud web flow while making remote worker links, persisted share tokens, provider auth, and desktop close behavior more dependable.
+
+#### Main changes
+- Rebuilt Den web auth, checkout, and dashboard routes so hosted onboarding and billing feel like the app instead of a one-off page.
+- Persisted worker share tokens and repeated deeplinks across restarts, with stronger open-in-web auto-connect and connect overlays.
+- Added self-serve Cloud settings, OpenAI headless auth, and tray-on-close desktop behavior.
+
+#### Lines of code changed since previous release
+20054 lines changed since `v0.11.169` (7642 insertions, 12412 deletions).
+
+#### Release importance
+Major release: substantially changes the hosted OpenWork Cloud experience and remote-connect workflow across web, desktop, and cloud surfaces.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Tailored the hosted web app UI and Den onboarding flow for OpenWork Cloud deployments.
+- Made Cloud settings self-serve and exposed OpenAI headless auth so more provider and cloud setup can happen directly in-product.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+5
+
+#### Major bug fix details
+- Restored Polar billing flow during Den checkout.
+- Persisted worker share tokens across restarts.
+- Restored repeated shared-skill deeplinks in the desktop app.
+- Kept open-in-web auto-connect and the worker overlay working reliably during connect.
+- Improved desktop behavior by hiding to tray on close and restoring the window correctly.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.171
+
+#### Commit
+`10ec28d6`
+
+#### Released at
+Unreleased draft release. Tagged at `2026-03-19T14:01:13-07:00`.
+
+#### Title
+Session trace rows only open when they have details
+
+#### One-line summary
+Stops empty trace rows from expanding, removes stray desktop token-store test code from releases, and moves the repo into the new apps and ee layout.
+
+#### Main changes
+- Only trace rows with real details expand, with tighter mobile wrapping and clearer tool icons.
+- Removed stray token-store test code from desktop release code.
+- Reorganized the repo into `apps/` and `ee/` paths without changing app behavior.
+
+#### Lines of code changed since previous release
+1577 lines changed since `v0.11.170` (986 insertions, 591 deletions).
+
+#### Release importance
+Minor release: fixes startup and session-trace issues while carrying a mostly structural repo reorganization underneath.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Removed stray desktop token-store test code that could affect startup and release reliability.
+- Made session trace rows expand only when real details exist, improving readability and reducing visual noise.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.172
+
+#### Commit
+`d47a194d`
+
+#### Released at
+`2026-03-19T22:28:14Z`
+
+#### Title
+Server package naming and session traces line up
+
+#### One-line summary
+Renames the published server package to `openwork-server` and polishes trace-row icon and chevron alignment so session runs scan more cleanly.
+
+#### Main changes
+- Renamed the published server package to `openwork-server`, updating orchestrator, release, and dev tooling to resolve the same package consistently.
+- Tightened trace-row icon and chevron alignment so session summaries read cleanly.
+
+#### Lines of code changed since previous release
+3006 lines changed since `v0.11.171` (2296 insertions, 710 deletions).
+
+#### Release importance
+Minor release: improves packaging consistency and session trace polish without materially changing user workflows.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Resolved inconsistent server package naming across install, publish, and verification paths.
+- Fixed session trace row alignment so icons and chevrons stay visually aligned with summaries.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Replaced prior published server package references with the standardized `openwork-server` naming.
+
+## v0.11.173
+
+#### Commit
+`5f0e11ce`
+
+#### Released at
+`2026-03-20T00:55:12Z`
+
+#### Title
+Daytona workers report activity and local Node tools spawn reliably
+
+#### One-line summary
+Adds worker heartbeats for Daytona-backed Cloud workers while making local MCP and tool launches work in nvm-managed Node environments.
+
+#### Main changes
+- Added Daytona worker activity heartbeats so Cloud worker state stays fresher.
+- Added release snapshot automation for Daytona images.
+- Exposed `nvm`-managed Node paths to local spawns so MCP tools and local commands find Node more reliably.
+
+#### Lines of code changed since previous release
+805 lines changed since `v0.11.172` (762 insertions, 43 deletions).
+
+#### Release importance
+Minor release: improves worker runtime observability and local spawn compatibility without materially changing how most users operate OpenWork.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added Daytona worker activity heartbeats to improve worker liveness tracking for cloud-worker flows.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Exposed nvm-managed Node tools to local spawns so local tool execution works in more environments.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.174
+
+#### Commit
+`9f3890f6`
+
+#### Released at
+Unreleased draft release. Tagged at `2026-03-19T18:59:35-07:00`.
+
+#### Title
+Session traces go back to the familiar behavior
+
+#### One-line summary
+Restores the original trace interaction model, brings back summary copy actions, and keeps worker names readable in narrow sidebars.
+
+#### Main changes
+- Reverted the newer expandable trace treatment and restored the original session trace behavior.
+- Brought back trace summary copy actions.
+- Kept worker names visible in narrow sidebars instead of collapsing them away.
+
+#### Lines of code changed since previous release
+508 lines changed since `v0.11.173` (107 insertions, 401 deletions).
+
+#### Release importance
+Minor release: rolls back confusing trace behavior and repairs sidebar readability without changing the product's broader workflow model.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Restored the original session trace interaction model.
+- Restored trace summary copy actions.
+- Preserved worker names in narrow sidebars.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.175
+
+#### Commit
+`da0cd71c`
+
+#### Released at
+`2026-03-20T05:53:41Z`
+
+#### Title
+Authorized folders and first-run session guidance move into Settings
+
+#### One-line summary
+Adds Settings-based folder authorization and server-backed empty states, then tightens sidebar and composer labeling so navigation stays readable.
+
+#### Main changes
+Adds a server-backed way to manage authorized folders and to seed first-run session empty states from workspace blueprints.
+
+Also released:
+
+- Cleaner sidebar titles, status labels, footer pinning, and hidden generated timestamps.
+- Restored composer action labels and removed the dead artifacts rail.
+
+#### Lines of code changed since previous release
+1685 lines changed since `v0.11.174` (1313 insertions, 372 deletions).
+
+#### Release importance
+Minor release: adds focused settings and onboarding improvements while mainly polishing existing app-shell and sidebar behavior.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added authorized-folder management directly in Settings.
+- Added server-backed session empty states to guide first-run and worker setup more clearly.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Restored composer action labels.
+- Removed the session sidebar artifacts rail.
+- Kept workspace actions visible and quieter status labels easier to scan in the sidebar.
+- Fixed sidebar footer pinning, title truncation, timestamp readability, and flex overflow issues.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Removed the session sidebar artifacts rail in favor of a cleaner sidebar flow.
diff --git a/changelog/release-tracker-2026-03-20.md b/changelog/release-tracker-2026-03-20.md
new file mode 100644
index 0000000000..8b28d0300d
--- /dev/null
+++ b/changelog/release-tracker-2026-03-20.md
@@ -0,0 +1,1316 @@
+# Release Changelog Tracker
+
+Internal preparation file for release summaries. This is not yet published to the changelog page or docs.
+
+## v0.11.176
+
+#### Commit
+`47b6f7e3`
+
+#### Released at
+Unreleased draft release. Tagged at `2026-03-20T12:51:31-07:00`.
+
+#### Title
+OpenAI setup points new chats the right way
+
+#### One-line summary
+Makes first-run provider setup clearer by sending new chats into the ChatGPT flow and fixing remote messaging health reporting.
+
+#### Main changes
+- Swapped the starter CTA to Connect ChatGPT and hid it once OpenAI is already connected.
+- Made OpenAI auth worker-aware so remote workers use the device flow with copyable codes and manual browser launch.
+- Fixed worker-scoped router health so remote messaging no longer appears unconfigured in Settings and identities.
+
+#### Lines of code changed since previous release
+1079 lines changed since `v0.11.175` (618 insertions, 461 deletions).
+
+#### Release importance
+Minor release: fixes provider onboarding and remote messaging reliability without materially changing the product's overall shape.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed provider onboarding so the new-session CTA sends users through the correct OpenAI connection flow, including remote-worker cases.
+- Fixed remote messaging router health reporting so configured remote workers no longer look broken in settings and identities flows.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.177
+
+#### Commit
+`9603be37`
+
+#### Released at
+`2026-03-20T20:54:48Z`
+
+#### Title
+Downloads CTA and npm install fallback land
+
+#### One-line summary
+Gets desktop users to the right download path faster and lets `openwork-orchestrator` recover when npm skips its platform binary.
+
+#### Main changes
+Routes the desktop landing CTA to the Download page so the install path is clearer.
+
+Also released:
+
+- `openwork-orchestrator` postinstall now downloads the matching release binary when optional platform packages are missing.
+- Daytona snapshot builds now use the source orchestrator binary.
+
+#### Lines of code changed since previous release
+175 lines changed since `v0.11.176` (139 insertions, 36 deletions).
+
+#### Release importance
+Minor release: improves install-path clarity and local install resilience with a focused release-engineering patch.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed the landing CTA so new users reach the downloads page directly instead of taking a less useful route.
+- Fixed orchestrator npm installs so they can fall back to published binaries when the local install path fails.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.178
+
+#### Commit
+`1cc5360f`
+
+#### Released at
+`2026-03-22T03:08:43Z`
+
+#### Title
+Workspace sharing and model controls get a major refresh
+
+#### One-line summary
+Redesigns workspace sharing and sidebar structure, makes reasoning controls model-aware, and adds a hosted feedback flow.
+
+#### Main changes
+- Redesigned workspace sharing and the right sidebar, including cleaner remote credentials and nested child sessions.
+- Made model pickers model-aware with provider icons and per-model reasoning or behavior controls.
+- Moved app feedback to a hosted form, added an Exa toggle, and stopped forcing starter workspaces on desktop boot.
+
+#### Lines of code changed since previous release
+8432 lines changed since `v0.11.177` (5335 insertions, 3097 deletions).
+
+#### Release importance
+Major release: substantially reshapes navigation, sharing, and model-control flows across the app.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Redesigned workspace sharing and introduced a unified right sidebar with nested child sessions.
+- Added model-aware behavior controls so provider-specific options are clearer in the composer and settings.
+- Moved app feedback into a hosted feedback form that is reachable directly from app surfaces.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Restored the in-composer Run action and stabilized the composer footer after recent UI regressions.
+- Fixed session and settings follow-up regressions that made remote connect, picker behavior, and transcript affordances feel inconsistent.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.179
+
+#### Commit
+`5f043456`
+
+#### Released at
+`2026-03-22T05:34:34Z`
+
+#### Title
+Den checkout and workspace setup get leaner
+
+#### One-line summary
+Simplifies Den billing and dashboard surfaces, streamlines workspace creation flows, and removes the desktop tray path.
+
+#### Main changes
+- Simplified the create-workspace and connect-remote modals so setup fields read more clearly.
+- Refreshed Den checkout and dashboard screens into a flatter, cleaner shell.
+- Removed desktop tray support and now requires contact details on hosted feedback submissions.
+
+#### Lines of code changed since previous release
+1025 lines changed since `v0.11.178` (539 insertions, 486 deletions).
+
+#### Release importance
+Minor release: focuses on checkout, workspace setup, and a few visible desktop/share fixes without changing the overall product model.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Removed tray support so desktop close behavior no longer depends on a redundant background tray icon.
+- Removed duplicate thinking labels in sessions so streamed reasoning state is easier to read.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Removed desktop tray support from the app.
+
+## v0.11.180
+
+#### Commit
+`093ee573`
+
+#### Released at
+Unreleased draft release. Tagged at `2026-03-22T09:29:16-07:00`.
+
+#### Title
+Den landing and provisioning visuals get pared back
+
+#### One-line summary
+Mostly a docs-and-artifact cleanup release, with a small Den landing and provisioning UI simplification.
+
+#### Main changes
+Mostly removes internal PR docs and screenshots, while trimming the Den landing hero and simplifying the worker provisioning animation. No clear core app, server, or developer workflow changes land in this tag.
+
+#### Lines of code changed since previous release
+3020 lines changed since `v0.11.179` (23 insertions, 2997 deletions).
+
+#### Release importance
+Minor release: pares back visual complexity in Den onboarding surfaces without materially changing product behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.181
+
+#### Commit
+`abcfdfc7`
+
+#### Released at
+`2026-03-22T17:02:23Z`
+
+#### Title
+Version metadata is republished in sync
+
+#### One-line summary
+Republishes synchronized package versions only, with no distinct user-facing or developer-facing workflow change.
+
+#### Main changes
+Packaging-only release that syncs version metadata across app, desktop, server, router, and orchestrator packages. No material workflow, UI, API, or docs behavior changes are visible from the code.
+
+#### Lines of code changed since previous release
+58 lines changed since `v0.11.180` (40 insertions, 18 deletions).
+
+#### Release importance
+Minor release: primarily refreshes release artifacts and synchronized version metadata.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.182
+
+#### Commit
+`7a0e31d0`
+
+#### Released at
+`2026-03-23T01:48:48Z`
+
+#### Title
+Local workspaces move under OpenWork server control
+
+#### One-line summary
+Shifts local workspace ownership into OpenWork server so creation, reconnects, config writes, and starter bootstrap stay aligned across the app.
+
+#### Main changes
+- Local workspace create, rename, delete, config writes, and reload events now go through OpenWork server first.
+- First-run starter bootstrap and reconnect logic are more reliable across onboarding and sidebar flows.
+- Simplified the remote connect modal, moved tool-trace chevrons right, and added Windows ARM64 dev startup support.
+
+#### Lines of code changed since previous release
+1792 lines changed since `v0.11.181` (1510 insertions, 282 deletions).
+
+#### Release importance
+Major release: lands a substantial server-ownership and runtime-architecture change that materially affects core local workspace behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed local workspace reconnect and onboarding inconsistencies by moving workspace ownership into OpenWork server.
+- Fixed remote connect friction by simplifying the modal users see when attaching to a remote workspace.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.183
+
+#### Commit
+`160198ab`
+
+#### Released at
+`2026-03-23T05:01:53Z`
+
+#### Title
+Exa moves into OpenCode settings
+
+#### One-line summary
+Surfaces the Exa search toggle in a clearer OpenCode settings section and rolls back an unready macOS path-normalization change.
+
+#### Main changes
+- Added an OpenCode settings panel that exposes the Exa web-search toggle in a clearer place.
+- Reverted the macOS path case-folding change to avoid destabilizing session and workspace matching.
+- Also removed leftover docs-plan and screenshot artifacts.
+
+#### Lines of code changed since previous release
+614 lines changed since `v0.11.182` (53 insertions, 561 deletions).
+
+#### Release importance
+Minor release: adds a focused advanced-settings capability while avoiding a risky macOS path change.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added Exa as a configurable option in Advanced settings.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Reverted an unready macOS path normalization change so users do not pick up unstable workspace-path behavior.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.184
+
+#### Commit
+`09204a02`
+
+#### Released at
+`2026-03-23T15:04:42Z`
+
+#### Title
+CLI quickstart becomes the primary docs path
+
+#### One-line summary
+Rebuilds the docs around a single CLI-first quickstart and removes older split onboarding paths that were harder to follow.
+
+#### Main changes
+Collapses the docs nav to a single quickstart, rewrites onboarding around the remote CLI plus desktop connect flow, and removes older introduction, technical, non-technical, and tutorial pages so first-run guidance is much narrower and easier to scan.
+
+#### Lines of code changed since previous release
+898 lines changed since `v0.11.183` (121 insertions, 777 deletions).
+
+#### Release importance
+Minor release: narrows the documentation surface around Quickstart without changing shipped product behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.185
+
+#### Commit
+`5584dfd6`
+
+#### Released at
+`2026-03-24T05:34:00Z`
+
+#### Title
+Safer local sharing and messaging setup
+
+#### One-line summary
+Defaults local workers to loopback-only, makes public messaging exposure more deliberate, and adds guided setup for Chrome control.
+
+#### Main changes
+Local workers now stay localhost-only unless users explicitly opt into remote exposure, messaging is disabled until enabled on purpose, public Telegram bot creation shows a risk warning, and Chrome DevTools MCP gets a guided setup flow.
+
+#### Lines of code changed since previous release
+5434 lines changed since `v0.11.184` (4780 insertions, 654 deletions).
+
+#### Release importance
+Major release: materially changes sharing and messaging defaults while adding meaningful setup and localization improvements.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a guided Control Chrome setup flow inside the app.
+- Added Brazilian Portuguese (`pt-BR`) localization.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Local workers now stay localhost-only by default unless users intentionally expose them for sharing.
+- Hardened Den and public publishing/auth surfaces so shared flows are less likely to leak into unsafe configurations.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.186
+
+#### Commit
+`30737e99`
+
+#### Released at
+`2026-03-24T06:16:26Z`
+
+#### Title
+Local reconnects stay scoped to the right workspace
+
+#### One-line summary
+Fixes restart and reconnect flows so local sessions and starter workspaces stay attached to the intended directory.
+
+#### Main changes
+Keeps local session history scoped to the active workspace during reconnects and normalizes persisted starter paths on desktop bootstrap, so restarts stop reopening or creating sessions against the wrong local directory.
+
+#### Lines of code changed since previous release
+397 lines changed since `v0.11.185` (343 insertions, 54 deletions).
+
+#### Release importance
+Minor release: fixes local reconnect and bootstrap scoping issues without introducing broader workflow changes.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed local reconnect behavior so workspace history stays scoped to the active workspace instead of a stale directory.
+- Fixed starter-path handling so older persisted local paths reconnect correctly during desktop bootstrap.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.187
+
+#### Commit
+`5d1c6a28`
+
+#### Released at
+`2026-03-24T15:09:03Z`
+
+#### Title
+Windows workspace scoping handles verbatim paths
+
+#### One-line summary
+Normalizes Windows path transport, verbatim prefixes, and UNC comparisons so local session scope stays consistent across directory formats.
+
+#### Main changes
+Normalizes Windows directory strings end to end, strips verbatim path prefixes, and fixes UNC comparison logic so session lists, deletes, and workspace switching all target the same local workspace scope.
+
+#### Lines of code changed since previous release
+210 lines changed since `v0.11.186` (173 insertions, 37 deletions).
+
+#### Release importance
+Minor release: fixes a focused but important Windows path-scoping problem without changing the broader product experience.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed Windows directory transport mismatches that caused session and sidebar scope checks to disagree.
+- Fixed verbatim path-prefix handling so equivalent Windows paths no longer compare as different workspaces.
+- Fixed UNC path comparisons so Windows reconnect and worker-switch flows stay scoped correctly.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.188
+
+#### Commit
+`c9e00db6`
+
+#### Released at
+`2026-03-24T16:29:47Z`
+
+#### Title
+Landing feedback returns to the previous flow
+
+#### One-line summary
+Backs out the Loops feedback template so the landing feedback endpoint goes back to the simpler email-based path.
+
+#### Main changes
+Reverts the Loops-based landing feedback template and config, restoring the earlier app-feedback route behavior without introducing any broader app, worker, or docs workflow changes.
+
+#### Lines of code changed since previous release
+328 lines changed since `v0.11.187` (30 insertions, 298 deletions).
+
+#### Release importance
+Minor release: reverts a focused feedback-flow change to restore the previously working behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Reverted the Loops feedback template rollout so the landing feedback route goes back to the prior, more reliable submission path.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.189
+
+#### Commit
+`a7fa0312`
+
+#### Released at
+`2026-03-24T17:16:24Z`
+
+#### Title
+Package metadata rolls forward only
+
+#### One-line summary
+Updates the release line with a lockfile and version sync only, without any visible product or workflow changes.
+
+#### Main changes
+Packaging-only release: version metadata and the pnpm lockfile are synchronized, with no meaningful user-facing or developer-facing workflow changes in the shipped code.
+
+#### Lines of code changed since previous release
+26 lines changed since `v0.11.188` (13 insertions, 13 deletions).
+
+#### Release importance
+Minor release: advances the release line without introducing meaningful user-facing behavior changes.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.190
+
+#### Commit
+`6c22f800`
+
+#### Released at
+`2026-03-24T23:32:21Z`
+
+#### Title
+Connection guides expand while sharing and auth settle
+
+#### One-line summary
+Mostly docs-focused release that reorganizes onboarding around concrete connection guides, while fixing desktop publish routing and headless OpenAI auth timing.
+
+#### Main changes
+Mostly docs-only: the site shifts to task guides for remote setup, ChatGPT, custom providers, MCPs, sharing, and skill import, while the app fixes public share routing and waits to poll headless OpenAI auth until users actually open the browser.
+
+#### Lines of code changed since previous release
+3837 lines changed since `v0.11.189` (2654 insertions, 1183 deletions).
+
+#### Release importance
+Minor release: improves sharing reliability, provider onboarding stability, and shell polish without materially changing the product's overall shape.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed share publishing so packaged desktop builds can publish from the correct desktop origin.
+- Fixed share public routing so hardened public routes keep resolving instead of breaking after config changes.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.191
+
+#### Commit
+`6c9700ce`
+
+#### Released at
+`2026-03-25T01:04:43Z`
+
+#### Title
+Shared detached workers survive restarts
+
+#### One-line summary
+Preserves share credentials for detached workers, hides disconnected config-backed providers, and adds clearer Slack and skill-import docs.
+
+#### Main changes
+Detached Docker-backed workers now keep the right share credentials after restart so share links and reconnect flows keep working, disconnected config-backed providers disappear cleanly from Settings, and docs add clearer Slack and skill-import walkthroughs.
+
+#### Lines of code changed since previous release
+495 lines changed since `v0.11.190` (413 insertions, 82 deletions).
+
+#### Release importance
+Minor release: focuses on reliability fixes for shared workers and provider settings without adding broad new workflows.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed detached worker sharing so saved credentials survive app restarts instead of forcing users to reconnect.
+- Fixed disconnected provider handling so config-backed providers stay disabled after users disconnect them.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.192
+
+#### Commit
+`5f30ad2a`
+
+#### Released at
+`2026-03-25T22:30:34Z`
+
+#### Title
+Workspace switching stops hijacking runtime state
+
+#### One-line summary
+Separates workspace selection from runtime activation, keeps local worker ports stable, and makes shared templates carry starter content correctly.
+
+#### Main changes
+- Split selected workspace from runtime-connected workspace so browsing no longer flips the active worker.
+- Kept preferred local server ports sticky and avoided collisions across workspaces.
+- Let templates carry extra `.opencode` files and starter sessions, and materialized seeded sessions correctly.
+
+#### Lines of code changed since previous release
+4896 lines changed since `v0.11.191` (3899 insertions, 997 deletions).
+
+#### Release importance
+Major release: materially changes how workspace switching and template-based workspace setup work across the app and server.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added richer workspace template sharing so imports can include extra `.opencode` files.
+- Added starter sessions to workspace templates so new workspaces can open with seeded conversations.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed workspace switching semantics so selecting a workspace no longer needlessly reconnects runtimes.
+- Fixed blueprint-seeded session materialization so starter sessions load with their intended content.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.193
+
+#### Commit
+`da74ba9a`
+
+#### Released at
+`2026-03-26T05:23:19Z`
+
+#### Title
+Team template sharing reaches OpenWork Cloud
+
+#### One-line summary
+Adds Save-to-team template flows in the app, while Den gains organizations, member roles, invitations, and a manual Cloud sign-in fallback.
+
+#### Main changes
+- Added Save-to-team flows for workspace templates, with org selection and Cloud sign-in prompts.
+- Introduced Den organizations, member roles, invitations, custom roles, and org-scoped template APIs and screens.
+- Added a manual Cloud sign-in fallback when automatic team-sharing auth stalls.
+
+#### Lines of code changed since previous release
+7841 lines changed since `v0.11.192` (6406 insertions, 1435 deletions).
+
+#### Release importance
+Major release: adds substantial new Cloud collaboration and organization-management workflows that materially change how teams use OpenWork.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added Cloud team template sharing flows in the OpenWork app.
+- Added Den organization management, permissions, and org-scoped template sharing surfaces.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Added a manual Cloud sign-in fallback and clearer sign-in CTA so team-sharing flows are less likely to block on auth issues.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.194
+
+#### Commit
+`41d93e2e`
+
+#### Released at
+`2026-03-26T20:46:09Z`
+
+#### Title
+Auto compaction and live automations become real workflows
+
+#### One-line summary
+Wires auto compaction to actual workspace config, keeps scheduled jobs live in-app, and adds a faster Den local-dev path.
+
+#### Main changes
+- Wired Auto context compaction to workspace config so the setting actually changes `compaction.auto`.
+- Kept scheduled jobs live by polling while the Automations view is open.
+- Added a faster Den local-dev path and expanded the Cloud dashboard with shared setups and background-agent links.
+
+#### Lines of code changed since previous release
+5198 lines changed since `v0.11.193` (3852 insertions, 1346 deletions).
+
+#### Release importance
+Minor release: improves several active workflows and developer surfaces, but it does not substantially reshape the product's core user model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Enabled real automatic context compaction behavior through the app's OpenCode integration.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed the auto compaction toggle so it actually wires through to OpenCode behavior.
+- Fixed the custom app MCP add flow so users can stay in settings instead of getting bounced out of setup.
+- Fixed automations polling so scheduled jobs keep refreshing while the page is open.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.195
+
+#### Commit
+`9d5b14b4`
+
+#### Released at
+`2026-03-27T22:02:59Z`
+
+#### Title
+Local workspace creation and Den worker setup get steadier
+
+#### One-line summary
+Routes new local workspaces through the local host, persists model defaults properly, and smooths Den worker-connect and billing flows.
+
+#### Main changes
+- Created local workspaces through the local host so setup and binding finish correctly.
+- Preserved workspace default model changes and added a quick compact-session action in chat.
+- Simplified Den organization, worker-connect, and billing flows with less polling jank.
+
+#### Lines of code changed since previous release
+5137 lines changed since `v0.11.194` (3875 insertions, 1262 deletions).
+
+#### Release importance
+Minor release: improves existing Den and desktop workflows with focused reliability and UX fixes rather than introducing a new product surface.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Restored full worker connect actions in Den with inline connection controls for ready workers.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed default model changes so workspace refreshes no longer wipe out newly chosen defaults.
+- Fixed local workspace creation so the app creates them through the local host path reliably.
+- Fixed remote workspace binding so connect flows finish attaching the workspace correctly.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.196
+
+#### Commit
+`663e357b`
+
+#### Released at
+`2026-03-30T21:27:27Z`
+
+#### Title
+OpenWork resumes where you left off
+
+#### One-line summary
+Boots back into the last session, routes straight into session view, and moves automations onto a live scheduler-backed page.
+
+#### Main changes
+- Reopened the last session on workspace boot and routed straight into the session view.
+- Moved automations onto a dedicated page backed by live local or remote scheduler jobs.
+- Fixed bootstrap and workspace switching so Welcome setup and loading states stop interrupting startup.
+
+#### Lines of code changed since previous release
+34577 lines changed since `v0.11.195` (15875 insertions, 18702 deletions).
+
+#### Release importance
+Major release: substantially changes the app's navigation model and retires the old dashboard concept in favor of a session-first experience.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+2
+
+#### Major improvement details
+- Added a dedicated Automations page centered on live scheduler jobs.
+- Restored last-session boot so workspaces reopen directly into the active conversation flow.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+2
+
+#### Major bug fix details
+- Fixed welcome workspace bootstrap so first-run workspace setup behaves more predictably.
+- Fixed shell and session loading churn so startup and workspace switching feel less like full reloads.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Removed the old dashboard-first app concept in favor of session-first navigation and settings-owned tool surfaces.
+
+## v0.11.197
+
+#### Commit
+`020d7636`
+
+#### Released at
+`2026-03-31T05:21:16Z`
+
+#### Title
+Sharing gets safer and startup gets less noisy
+
+#### One-line summary
+Hardens workspace sharing, keeps orchestrator secrets out of CLI args and logs, and removes noisy sidebar and Welcome-workspace boot behavior.
+
+#### Main changes
+- Blocked sensitive workspace exports and showed warnings before sharing risky config or secrets.
+- Trusted bundle imports only from the configured publisher unless users explicitly choose a warning-backed manual path.
+- Moved OpenWork tokens off CLI args and logs, stopped auto-creating Welcome, and fixed collapsed sidebar session lists.
+
+#### Lines of code changed since previous release
+6399 lines changed since `v0.11.196` (5657 insertions, 742 deletions).
+
+#### Release importance
+Major release: ships important security hardening around secret handling and workspace sharing while also correcting core workspace-list behavior.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+4
+
+#### Major bug fix details
+- Fixed sensitive workspace exports so secrets can be detected and blocked before sharing.
+- Fixed bundle fetch routing so publish and fetch traffic stays pinned to the configured OpenWork publisher.
+- Fixed orchestrator secret handling so credentials no longer ride in argv and logs.
+- Fixed workspace boot/sidebar behavior by stopping unwanted Welcome workspace creation and restoring missing root sessions.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.198
+
+#### Commit
+`761796fd`
+
+#### Released at
+`2026-03-31T06:00:47Z`
+
+#### Title
+Local workspace switches restart the right engine
+
+#### One-line summary
+Fixes a local-only switch bug so changing between local workspaces restarts the engine instead of reusing the old connection.
+
+#### Main changes
+Captures the previous local workspace path before selection changes so switching between local workspaces restarts the engine instead of reusing the old connection.
+
+#### Lines of code changed since previous release
+100 lines changed since `v0.11.197` (59 insertions, 41 deletions).
+
+#### Release importance
+Minor release: fixes a focused local-workspace activation bug without changing the surrounding product flow.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+1
+
+#### Major bug fix details
+- Fixed a local workspace switching race that could skip the required engine restart when moving between local workspaces.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.199
+
+#### Commit
+`4a3e43e5`
+
+#### Released at
+`2026-04-02T02:18:50Z`
+
+#### Title
+Pricing, skill hubs, and session recovery sharpen up
+
+#### One-line summary
+Adds pricing and paid Windows messaging, expands Den with skill hubs and `den-api`, and improves everyday session recovery and debugging.
+
+#### Main changes
+- Added a pricing page and paid Windows messaging, and sent Cloud navigation directly into the app.
+- Expanded Den with skill hubs, a new `den-api`, and a smoother org-invite signup flow.
+- Added developer log export, per-conversation draft persistence, and recovery after immediate send failures.
+
+#### Lines of code changed since previous release
+19623 lines changed since `v0.11.198` (12501 insertions, 7122 deletions).
+
+#### Release importance
+Major release: introduces major new commercial and Den team workflows while materially improving debugging and session resilience.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Added landing pricing and paid Windows conversion flows.
+- Added Den skill hubs and migrated Den onto the new Hono-based `den-api`.
+- Added exportable developer logs in the app's debug surface.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed session send failures so conversations can recover after an immediate error.
+- Fixed draft persistence so conversation drafts stay scoped to the correct conversation.
+- Fixed startup and sharing edge cases such as delayed host-info checks and unreliable shared access token reveal.
+
+#### Deprecated features
+True
+
+#### Number of deprecated features
+1
+
+#### Deprecated details
+- Removed the legacy `opkg` CLI integration as part of the release cleanup.
+
+## v0.11.200
+
+#### Commit
+`5cc7bbdd`
+
+#### Released at
+`2026-04-03T15:22:13Z`
+
+#### Title
+Cloud skills and team limits move into the core flow
+
+#### One-line summary
+Brings Cloud team skills into the app, adds Den teams and deeper skill-hub management, and enforces org limits during creation.
+
+#### Main changes
+- Added an OpenWork Cloud skills catalog to the Skills page, with install and share-to-team flows.
+- Added Den teams plus full skill hub and skill editing and visibility management.
+- Moved billing into org creation and enforced organization member limits before setup finishes.
+
+#### Lines of code changed since previous release
+9000 lines changed since `v0.11.199` (7881 insertions, 1119 deletions).
+
+#### Release importance
+Major release: adds substantial new Cloud and Den organization capabilities that materially expand how teams discover, share, and manage skills.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+3
+
+#### Major improvement details
+- Added the OpenWork Cloud team skills catalog on the app Skills page.
+- Added Den teams and full skill hub management across the org dashboard.
+- Added billing-aware org creation with org limit enforcement.
+
+#### Major bugs resolved
+False
+
+#### Number of major bugs resolved
+0
+
+#### Major bug fix details
+None.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
diff --git a/changelog/release-tracker-2026-04-04.md b/changelog/release-tracker-2026-04-04.md
new file mode 100644
index 0000000000..72cb7cb0c8
--- /dev/null
+++ b/changelog/release-tracker-2026-04-04.md
@@ -0,0 +1,115 @@
+# Release Changelog Tracker
+
+Internal preparation file for release summaries. This is not yet published to the changelog page or docs.
+
+## v0.11.201
+
+#### Commit
+`15725dfb`
+
+#### Released at
+`2026-04-04T01:59:47Z`
+
+#### Title
+Workspace lists collapse cleanly and Den organization setup recovers more reliably.
+
+#### One-line summary
+Hides collapsed workspace task rows, steadies session loading, and fixes Den skill saving plus organization draft and invite recovery.
+
+#### Main changes
+- Collapsed workspaces now hide task rows, empty states, and loading shells until reopened.
+- Session loading stops refetch churn and early stream flicker.
+- Den now saves skill metadata from frontmatter and restores pending org drafts and invite counts.
+
+#### Lines of code changed since previous release
+3956 lines changed since `v0.11.200` (2440 insertions, 1516 deletions).
+
+#### Release importance
+Minor release: focuses on interface polish and workflow fixes across the app and Den without adding a substantially new product capability.
+
+#### Major improvements
+False
+
+#### Number of major improvements
+0
+
+#### Major improvement details
+None.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Fixed collapsed workspace lists so hidden workspaces no longer leak session previews or loading states.
+- Fixed session loading and streaming churn that could cause repeated fetches or visible flicker.
+- Fixed Den skill saving and org management by parsing skill frontmatter correctly and restoring pending invite and draft state.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
+
+## v0.11.202
+
+#### Commit
+`ff981742`
+
+#### Released at
+`2026-04-04T20:45:30Z`
+
+#### Title
+Translations fill out across the app and shared skill imports work again.
+
+#### One-line summary
+Adds Thai, restores missing page translations, fixes migrated shared-skill links, and tightens docs and local desktop dev setup.
+
+#### Main changes
+Completed localization coverage across the app and added Thai as a selectable language.
+
+Also released:
+
+- Restored shared-skill import links and canonical bundle fetch URLs.
+- Added clearer automations and skill-import docs.
+- Stopped desktop dev from reusing another checkout's Vite server.
+
+#### Lines of code changed since previous release
+8103 lines changed since `v0.11.201` (7198 insertions, 905 deletions).
+
+#### Release importance
+Minor release: expands localization coverage and fixes important import and desktop-dev paths without changing the core product model.
+
+#### Major improvements
+True
+
+#### Number of major improvements
+1
+
+#### Major improvement details
+- Added Thai and completed translation coverage across the app's shipped locales.
+
+#### Major bugs resolved
+True
+
+#### Number of major bugs resolved
+3
+
+#### Major bug fix details
+- Restored missing page translations and corrected locale labels so translated screens stop falling back unexpectedly.
+- Restored migrated shared-skill links and canonical bundle fetch URLs so docs imports work again.
+- Stopped desktop dev from reusing another checkout's Vite server.
+
+#### Deprecated features
+False
+
+#### Number of deprecated features
+0
+
+#### Deprecated details
+None.
diff --git a/constants.json b/constants.json
new file mode 100644
index 0000000000..aca25f3adf
--- /dev/null
+++ b/constants.json
@@ -0,0 +1,3 @@
+{
+  "opencodeVersion": "v1.4.9"
+}
diff --git a/design-prd.md b/design-prd.md
deleted file mode 100644
index c614fc90a2..0000000000
--- a/design-prd.md
+++ /dev/null
@@ -1,486 +0,0 @@
-# OpenWork Product Requirements Document (PRD)
-
-## Summary
-
-OpenWork is an open-source **native GUI** (Tauri) that makes OpenCode feel like a polished consumer app for non-technical people.
-
-- OpenCode is the **engine**.
-- OpenWork is the **experience**: onboarding, safety, permissions, progress, artifacts, and a premium-feeling UI.
-
-OpenWork competes directly with Anthropic’s Cowork conceptually, but stays open, local-first, and standards-based.
-
-## Goals
-
-- Deliver a **premium, extremely slick** user experience (desktop + mobile).
-- Make OpenCode usable without a terminal.
-- Launch/attach to an OpenCode instance automatically when OpenWork starts.
-- Expose OpenCode primitives (sessions, messages, tools, permissions, files) in a non-technical UI.
-- Provide long-running tasks with resumability.
-- Provide explicit, understandable permissions and auditing.
-- Work with **only the folders the user authorizes**.
-
-## Non-Goals
-
-- Replacing OpenCode’s CLI/TUI.
-- Shipping a hosted SaaS in v1.
-- Creating bespoke “magic” capabilities that don’t map to OpenCode APIs.
-
-## Target Users
-
-1. **Non-technical knowledge worker**: “Do this for me” workflows with guardrails.
-2. **Mobile-first user**: start/monitor tasks from phone.
-3. **Power user**: wants UI parity + speed + inspection.
-4. **Admin/host**: manages a shared machine + profiles.
-
-## Success Metrics
-
-- < 5 minutes to first successful task on fresh install.
-- > 80% task success without terminal fallback.
-- Permission prompts understood/accepted (low confusion + low deny-by-accident).
-- UI performance: 60fps; <100ms interaction latency; no jank.
-
-## Principles
-
-- **Parity**: UI actions map to OpenCode server APIs.
-- **Transparency**: plans, steps, tool calls, permissions are visible.
-- **Least privilege**: only user-authorized folders + explicit approvals.
-- **Prompt is the workflow**: product logic lives in prompts, rules, and skills.
-- **Graceful degradation**: if access is missing, guide the user.
-
----
-
-## Core Architecture
-
-OpenWork is a Tauri application with two runtime modes:
-
-### Mode A — Host (Desktop)
-
-- OpenWork runs on a desktop/laptop and **starts** OpenCode locally.
-- The OpenCode server runs on loopback (default `127.0.0.1:4096`).
-- OpenWork UI connects via the official SDK and listens to events.
-
-### Mode B — Client (Mobile)
-
-- OpenWork runs on iOS/Android as a **remote controller**.
-- It connects to an already-running OpenCode server hosted by a trusted device.
-- Pairing uses a QR code / one-time token and a secure transport (LAN or tunneled).
-
-This split makes mobile “first-class” without requiring the full engine to run on-device.
-
----
-
-## OpenCode Integration (Exact SDK + APIs)
-
-OpenWork uses the official JavaScript/TypeScript SDK:
-
-- Package: `@opencode-ai/sdk/v2` (UI should import `@opencode-ai/sdk/v2/client` to avoid Node-only server code)
-- Purpose: type-safe client generated from OpenAPI spec
-
-### Engine Lifecycle
-
-#### Start server + client (Host mode)
-
-Use `createOpencode()` to launch the OpenCode server and create a client.
-
-```ts
-import { createOpencode } from "@opencode-ai/sdk/v2";
-
-const opencode = await createOpencode({
-  hostname: "127.0.0.1",
-  port: 4096,
-  timeout: 5000,
-  config: {
-    model: "anthropic/claude-3-5-sonnet-20241022",
-  },
-});
-
-const { client } = opencode;
-// opencode.server.url is available
-```
-
-#### Connect to an existing server (Client mode)
-
-```ts
-import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
-
-const client = createOpencodeClient({
-  baseUrl: "http://localhost:4096",
-  directory: "/path/to/project",
-});
-```
-
-### Health + Version
-
-- `client.global.health()`
-  - Used for startup checks, compatibility warnings, and diagnostics.
-
-### Event Streaming (Real-time UI)
-
-OpenWork must be real-time. It subscribes to SSE events:
-
-- `client.event.subscribe()`
-
-The UI uses these events to drive:
-
-- streaming assistant responses
-- step-level tool execution timeline
-- permission prompts
-- session lifecycle changes
-
-### Sessions (Primary Primitive)
-
-OpenWork maps a “Task Run” to an OpenCode **Session**.
-
-Core methods:
-
-- `client.session.create()`
-- `client.session.list()`
-- `client.session.get()`
-- `client.session.messages()`
-- `client.session.prompt()`
-- `client.session.abort()`
-- `client.session.summarize()`
-
-### Files + Search
-
-OpenWork’s file browser and “what changed” UI are powered by:
-
-- `client.find.text()`
-- `client.find.files()`
-- `client.find.symbols()`
-- `client.file.read()`
-- `client.file.status()`
-
-### Permissions
-
-OpenWork must surface permission requests clearly and respond explicitly.
-
-- Permission response API:
-  - `client.permission.reply({ requestID, reply })` (where `reply` is `once` | `always` | `reject`)
-
-OpenWork UI should:
-
-1. Show what is being requested (scope + reason).
-2. Provide choices (allow once / allow for session / deny).
-3. Post the response to the server.
-4. Record the decision in the run’s audit log.
-
-### Config + Providers
-
-OpenWork’s settings pages use:
-
-- `client.config.get()`
-- `client.config.providers()`
-- `client.auth.set()` (optional flow to store keys)
-
-
-## When it comes to design
-
-use the design from ./design.ts that is your core reference for building the entire ui
-
-### Projects + Path
-
-- `client.project.list()` / `client.project.current()`
-- `client.path.get()`
-
-OpenWork conceptually treats “workspace” as the current project/path.
-
-### Optional TUI Control (Advanced)
-
-The SDK exposes `client.tui.*` methods. OpenWork can optionally provide a “Developer Mode” screen to:
-
-- append/submit prompt
-- open help/sessions/themes/models
-- show toast
-
-This is optional and not required for non-technical MVP.
-
----
-
-## Folder Authorization Model
-
-OpenWork enforces folder access through **two layers**:
-
-1. **OpenWork UI authorization**
-   - user explicitly selects allowed folders via native picker
-   - OpenWork remembers allowed roots per profile
-
-2. **OpenCode server permissions**
-   - OpenCode requests permissions as needed
-   - OpenWork intercepts requests via events and displays them
-
-Rules:
-
-- Default deny for anything outside allowed roots.
-- “Allow once” never expands persistent scope.
-- “Allow for session” applies only to the session ID.
-- “Always allow” (if offered) must be explicit and reversible.
-
----
-
-## Product Primitives (What OpenWork Exposes)
-
-OpenWork must feel like “OpenCode, but for everyone.”
-
-### 1) Tasks
-
-- A Task = a user-described outcome.
-- A Run = an OpenCode session + event stream.
-
-### 2) Plans / Todo Lists
-
-OpenWork provides a first-class plan UI:
-
-- Plan is generated before execution (editable).
-- Plan is updated during execution (step status + timestamps).
-- Plan is stored as a structured artifact attached to the session (JSON) so it’s reconstructable.
-
-Implementation detail:
-
-- The plan is represented in OpenCode as structured `parts` (or a dedicated “plan message”) and mirrored in OpenWork.
-
-### 3) Steps
-
-- Each tool call becomes a step row with:
-  - tool name
-  - arguments summary
-  - permission state
-  - start/end time
-  - output preview
-
-### 4) Artifacts
-
-Artifacts are user-visible outputs:
-
-- files created/modified
-- generated documents/spreadsheets/presentations
-- exported logs and summaries
-
-OpenWork lists artifacts per run and supports open/share/download.
-
-### 5) Audit Log
-
-Every run provides an exportable audit log:
-
-- prompts
-- plan
-- tool calls
-- permission decisions
-- outputs
-
----
-
-## UI/UX Requirements (Slick as a Core Goal)
-
-### Design Targets
-
-- premium, calm, high-contrast
-- subtle motion, springy transitions
-- zero “developer vibes” in default mode
-
-### Performance Targets
-
-- 60fps animations
-- <100ms input-to-feedback
-- no blocking spinners (always show progress state)
-
-### Mobile-first Interaction
-
-- bottom navigation
-- swipe gestures (dismiss, approve, cancel)
-- haptics for major events
-- adaptive layouts (phone/tablet)
-
-### Accessibility
-
-- WCAG 2.1 AA
-- reduced motion mode
-- screen-reader labels for steps + permissions
-
----
-
-## Functional Requirements
-
-### Onboarding
-
-- Host vs Client selection
-- workspace selection (Host)
-- connect to host (Client)
-- provider/model setup
-- first-run “hello world” task
-
-### Task Execution
-
-- create task
-- plan preview and edit
-- run with streaming updates
-- pause/resume/cancel
-- show artifacts and summaries
-
-### Permissions
-
-- clear prompts with “why”
-- allow once/session
-- audit of decisions
-
-### Templates
-
-- save a task as template
-- variables + quick run
-
-### Scheduling (Future)
-
-- schedule template runs
-- notify on completion
-
----
-
-## User Flow Map (Exhaustive)
-
-### 0. Install & Launch
-
-1. User installs OpenWork.
-2. App launches.
-3. App shows “Choose mode: Host / Client”.
-4. Host: start local OpenCode via SDK.
-5. Client: connect flow to an existing host.
-
-### 1. First-Run Onboarding (Host)
-
-1. Welcome + safety overview.
-2. Workspace folder selection.
-3. Allowed folders selection (can be multiple).
-4. Provider/model configuration.
-5. `global.health()` check.
-6. Run a test session using `session.create()` + `session.prompt()`.
-7. Success + sample templates.
-
-### 2. Pairing Onboarding (Client / Mobile)
-
-1. User selects “Client”.
-2. UI explains it connects to a trusted host.
-3. User scans QR code shown on host device.
-4. Client verifies connection with `global.health()`.
-5. Client can now list sessions and monitor runs.
-
-### 3. Runtime Health & Recovery
-
-1. UI pings `global.health()`.
-2. If unhealthy:
-   - Host: attempt restart via `createOpencode()`.
-   - Client: show reconnect + diagnostics.
-
-### 4. Quick Task Flow
-
-1. User types goal.
-2. OpenWork generates plan (structured).
-3. User approves.
-4. Create session: `session.create()`.
-5. Send prompt: `session.prompt()`.
-6. Subscribe to events: `event.subscribe()`.
-7. Render streaming output + steps.
-8. Show artifacts.
-
-### 5. Guided Task Flow
-
-1. Wizard collects goal, constraints, outputs.
-2. Plan preview with “risky step” highlights.
-3. Run execution with progress UI.
-
-### 6. File-Driven Task Flow
-
-1. User attaches files.
-2. OpenWork injects context into session.
-3. Execute prompt.
-
-### 7. Permissions Flow (Any)
-
-1. Event indicates permission request.
-2. UI modal shows request.
-3. User chooses allow/deny.
-4. UI calls `client.permission.reply({ requestID, reply })`.
-5. Run continues or fails gracefully.
-
-### 8. Cancel / Abort
-
-1. User clicks “Stop”.
-2. UI calls `client.session.abort({ sessionID })`.
-3. UI marks run stopped.
-
-### 9. Summarize
-
-1. User taps “Summarize”.
-2. UI calls `client.session.summarize({ sessionID })`.
-3. Summary displayed as an artifact.
-
-### 10. Run History
-
-1. UI calls `session.list()`.
-2. Tap a session to load `session.messages()`.
-3. UI reconstructs plan and steps.
-
-### 11. File Explorer + Search
-
-1. User searches: `find.text()`.
-2. Open file: `file.read()`.
-3. Show changed files: `file.status()`.
-
-### 12. Templates
-
-1. Save a plan + prompt as a template.
-2. Re-run template creates a new session.
-
-### 13. Multi-user (Future)
-
-- separate profiles
-- separate allowed folders
-- separate providers/keys
-
----
-
-## Security & Privacy
-
-- Local-first by default.
-- No secrets in git.
-- Use OS keychain for credentials.
-- Clear, explicit permissions.
-- Exportable audit logs.
-
----
-
-## Open Questions
-
-- Best packaging strategy for Host mode engine (bundled vs user-installed Node/runtime).
-- Best remote transport for mobile client (LAN only vs optional tunnel).
-- Scheduling API surface (native in OpenCode server vs OpenWork-managed scheduler).
-
----
-
-## Milestones
-
-### v0.1 — Engine + Client
-
-- Host mode: start OpenCode via `createOpencode()`.
-- Client mode: connect via `createOpencodeClient()`.
-- Health screen + basic sessions list.
-
-### v0.2 — Full Run Loop
-
-- create session
-- send prompt
-- stream events
-- display step timeline
-- permission prompts
-
-### v0.3 — Premium UX
-
-- micro-interactions and animations
-- mobile layouts + gestures
-- templates
-
-### v1.0 — Public Open Source Release
-
-- strong onboarding
-- multi-device pairing
-- audit/export
-- docs + examples
diff --git a/design.ts b/design.ts
deleted file mode 100644
index d73efc7d8d..0000000000
--- a/design.ts
+++ /dev/null
@@ -1,720 +0,0 @@
-import React, { useState, useEffect, useRef } from 'react';
-import { 
-  Command, 
-  Shield, 
-  Zap, 
-  Layout, 
-  Settings, 
-  ChevronRight, 
-  Play, 
-  CheckCircle2, 
-  Circle, 
-  AlertCircle, 
-  FileText, 
-  X, 
-  Terminal, 
-  Smartphone, 
-  HardDrive,
-  Cpu,
-  MoreHorizontal,
-  ArrowRight,
-  Clock,
-  Menu,
-  Download,
-  Folder,
-  Plus,
-  Trash2
-} from 'lucide-react';
-
-// --- Mock Data & Types ---
-
-const MOCK_TEMPLATES = [
-  { id: 1, title: "Analyze Q3 Revenue", description: "Read CSVs and generate a PDF report", icon: "bar-chart" },
-  { id: 2, title: "Clean Desktop", description: "Organize screenshots into folders", icon: "folder" },
-  { id: 3, title: "Summarize Meeting", description: "Process audio transcript", icon: "mic" },
-];
-
-const MOCK_RECENT_SESSIONS = [
-  { id: 101, title: "Update Dependencies", status: "completed", date: "2 mins ago" },
-  { id: 102, title: "Fix CSS Bug", status: "failed", date: "1 hour ago" },
-  { id: 103, title: "Deploy to Prod", status: "waiting", date: "Yesterday" },
-];
-
-// --- Components ---
-
-const Button = ({ children, variant = "primary", className = "", onClick, disabled }) => {
-  const baseStyle = "px-4 py-2.5 rounded-xl font-medium transition-all duration-200 flex items-center justify-center gap-2 active:scale-95 text-sm";
-  const variants = {
-    primary: "bg-white text-black hover:bg-gray-100 shadow-lg shadow-white/5",
-    secondary: "bg-zinc-800 text-zinc-100 hover:bg-zinc-700 border border-zinc-700/50",
-    ghost: "bg-transparent text-zinc-400 hover:text-white hover:bg-zinc-800/50",
-    danger: "bg-red-500/10 text-red-400 hover:bg-red-500/20 border border-red-500/20",
-    outline: "border border-zinc-700 text-zinc-300 hover:border-zinc-500 bg-transparent",
-  };
-
-  return (
-    <button 
-      onClick={onClick} 
-      disabled={disabled}
-      className={`${baseStyle} ${variants[variant]} ${disabled ? 'opacity-50 cursor-not-allowed' : ''} ${className}`}
-    >
-      {children}
-    </button>
-  );
-};
-
-const StatusBadge = ({ status }) => {
-  const styles = {
-    completed: "bg-emerald-500/10 text-emerald-400 border-emerald-500/20",
-    running: "bg-blue-500/10 text-blue-400 border-blue-500/20 animate-pulse",
-    waiting: "bg-amber-500/10 text-amber-400 border-amber-500/20",
-    failed: "bg-red-500/10 text-red-400 border-red-500/20",
-    stopped: "bg-zinc-500/10 text-zinc-400 border-zinc-500/20",
-  };
-
-  return (
-    <span className={`text-xs px-2 py-0.5 rounded-full border ${styles[status] || styles.stopped} flex items-center gap-1.5`}>
-      <span className="w-1.5 h-1.5 rounded-full bg-current"></span>
-      {status.charAt(0).toUpperCase() + status.slice(1)}
-    </span>
-  );
-};
-
-const Card = ({ children, className = "" }) => (
-  <div className={`bg-zinc-900/50 border border-zinc-800/60 backdrop-blur-xl rounded-2xl p-5 ${className}`}>
-    {children}
-  </div>
-);
-
-// --- Views ---
-
-const OnboardingView = ({ onComplete }) => {
-  const [step, setStep] = useState('mode-select'); // mode-select | working-dirs | connecting
-  const [mode, setMode] = useState(null);
-  const [folders, setFolders] = useState(['~/Documents/OpenWork']);
-
-  const handleModeSelect = (selectedMode) => {
-    setMode(selectedMode);
-    if (selectedMode === 'host') {
-      setStep('working-dirs');
-    } else {
-      startConnection(selectedMode);
-    }
-  };
-
-  const startConnection = (selectedMode) => {
-    setStep('connecting');
-    // Simulate connection delay
-    setTimeout(() => {
-      onComplete(selectedMode);
-    }, 2000);
-  };
-
-  const addFolder = () => {
-    // Mock folder selection
-    setFolders([...folders, '~/Downloads/Project_' + Math.floor(Math.random() * 100)]);
-  };
-
-  const removeFolder = (index) => {
-    setFolders(folders.filter((_, i) => i !== index));
-  };
-
-  if (step === 'connecting') {
-    return (
-      <div className="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative overflow-hidden">
-        <div className="absolute inset-0 bg-[radial-gradient(circle_at_center,_var(--tw-gradient-stops))] from-zinc-900 via-black to-black opacity-50" />
-        <div className="z-10 flex flex-col items-center gap-6">
-          <div className="relative">
-            <div className="w-16 h-16 rounded-full border-2 border-zinc-800 flex items-center justify-center animate-spin-slow">
-              <div className="w-12 h-12 rounded-full border-2 border-t-white border-zinc-800 animate-spin" />
-            </div>
-            <div className="absolute inset-0 flex items-center justify-center">
-              <Zap size={20} className="text-white fill-white" />
-            </div>
-          </div>
-          <div className="text-center">
-            <h2 className="text-xl font-medium mb-2">
-              {mode === 'host' ? 'Starting OpenCode Engine...' : 'Searching for Host...'}
-            </h2>
-            <p className="text-zinc-500 text-sm">
-              {mode === 'host' ? 'Initializing localhost:4096' : 'Verifying secure handshake'}
-            </p>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
-  if (step === 'working-dirs') {
-    return (
-      <div className="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative">
-        <div className="absolute top-0 left-0 w-full h-96 bg-gradient-to-b from-zinc-900 to-transparent opacity-20 pointer-events-none" />
-        
-        <div className="max-w-md w-full z-10 space-y-8 animate-in fade-in slide-in-from-bottom-4 duration-500">
-          <div className="text-center space-y-2">
-            <div className="w-12 h-12 bg-zinc-900 rounded-2xl mx-auto flex items-center justify-center border border-zinc-800 mb-6">
-              <Shield className="text-zinc-400" />
-            </div>
-            <h2 className="text-2xl font-bold tracking-tight">Authorized Workspaces</h2>
-            <p className="text-zinc-400 text-sm leading-relaxed">
-              OpenWork runs locally. For your safety, please explicitly select which folders it is allowed to access.
-            </p>
-          </div>
-
-          <div className="space-y-3">
-            {folders.map((folder, idx) => (
-              <div key={idx} className="group flex items-center justify-between p-4 bg-zinc-900/50 rounded-xl border border-zinc-800/80 hover:border-zinc-700 transition-colors">
-                <div className="flex items-center gap-3 overflow-hidden">
-                  <Folder size={18} className="text-indigo-400 shrink-0" />
-                  <span className="font-mono text-sm text-zinc-300 truncate">{folder}</span>
-                </div>
-                <button 
-                  onClick={() => removeFolder(idx)}
-                  className="text-zinc-600 hover:text-red-400 p-1 opacity-0 group-hover:opacity-100 transition-all"
-                >
-                  <Trash2 size={16} />
-                </button>
-              </div>
-            ))}
-            
-            <button 
-              onClick={addFolder}
-              className="w-full py-4 border border-dashed border-zinc-800 rounded-xl text-zinc-500 hover:text-white hover:border-zinc-600 hover:bg-zinc-900/30 transition-all flex items-center justify-center gap-2 text-sm font-medium group"
-            >
-              <Plus size={16} className="text-zinc-600 group-hover:text-white transition-colors" /> 
-              Add Authorized Folder
-            </button>
-          </div>
-
-          <div className="pt-4">
-             <Button onClick={() => startConnection('host')} className="w-full py-3 text-base">
-               Confirm & Start Engine
-             </Button>
-             <p className="text-center text-xs text-zinc-600 mt-4">
-               You can always change these permissions later in Settings.
-             </p>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative">
-      <div className="absolute top-0 left-0 w-full h-96 bg-gradient-to-b from-zinc-900 to-transparent opacity-20 pointer-events-none" />
-      
-      <div className="max-w-2xl w-full z-10 space-y-12">
-        <div className="text-center space-y-4">
-          <div className="flex items-center justify-center gap-3 mb-6">
-            <div className="w-10 h-10 bg-white rounded-xl flex items-center justify-center">
-              <Command className="text-black" />
-            </div>
-            <h1 className="text-3xl font-bold tracking-tight">OpenWork</h1>
-          </div>
-          <h2 className="text-xl text-zinc-400 font-light">
-            How would you like to run OpenWork today?
-          </h2>
-        </div>
-
-        <div className="grid md:grid-cols-2 gap-4">
-          <button 
-            onClick={() => handleModeSelect('host')}
-            className="group relative bg-zinc-900 hover:bg-zinc-800 border border-zinc-800 hover:border-zinc-700 p-8 rounded-3xl text-left transition-all duration-300 hover:-translate-y-1"
-          >
-            <div className="mb-6 w-12 h-12 rounded-2xl bg-gradient-to-br from-indigo-500/20 to-purple-500/20 flex items-center justify-center border border-indigo-500/20 group-hover:border-indigo-500/40 transition-colors">
-              <HardDrive className="text-indigo-400" />
-            </div>
-            <h3 className="text-lg font-medium text-white mb-2">Host Mode</h3>
-            <p className="text-zinc-500 text-sm leading-relaxed">
-              Run the OpenCode engine locally on this machine. Best for desktops and laptops.
-            </p>
-            <div className="mt-6 flex items-center gap-2 text-xs font-mono text-zinc-600">
-              <div className="w-2 h-2 rounded-full bg-green-500" />
-              127.0.0.1:4096
-            </div>
-          </button>
-
-          <button 
-            onClick={() => handleModeSelect('client')}
-            className="group relative bg-zinc-900 hover:bg-zinc-800 border border-zinc-800 hover:border-zinc-700 p-8 rounded-3xl text-left transition-all duration-300 hover:-translate-y-1"
-          >
-            <div className="mb-6 w-12 h-12 rounded-2xl bg-gradient-to-br from-emerald-500/20 to-teal-500/20 flex items-center justify-center border border-emerald-500/20 group-hover:border-emerald-500/40 transition-colors">
-              <Smartphone className="text-emerald-400" />
-            </div>
-            <h3 className="text-lg font-medium text-white mb-2">Client Mode</h3>
-            <p className="text-zinc-500 text-sm leading-relaxed">
-              Connect to an existing OpenCode instance. Perfect for controlling tasks from your phone.
-            </p>
-            <div className="mt-6 flex items-center gap-2 text-xs font-mono text-zinc-600">
-              <div className="w-2 h-2 rounded-full bg-zinc-600" />
-              Remote Pairing
-            </div>
-          </button>
-        </div>
-      </div>
-    </div>
-  );
-};
-
-const SessionView = ({ session, onBack }) => {
-  const [messages, setMessages] = useState([]);
-  const [steps, setSteps] = useState([]);
-  const [status, setStatus] = useState('idle'); // idle, planning, running, paused, completed
-  const [input, setInput] = useState('');
-  const [permissionRequest, setPermissionRequest] = useState(null);
-  const [artifacts, setArtifacts] = useState([]);
-  
-  const messagesEndRef = useRef(null);
-
-  // Auto-scroll
-  useEffect(() => {
-    messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
-  }, [messages, steps]);
-
-  // Simulate a run flow
-  const handleStart = () => {
-    if (!input.trim()) return;
-    
-    // 1. User Message
-    const userMsg = { id: 1, role: 'user', content: input };
-    setMessages([userMsg]);
-    setStatus('planning');
-    setInput('');
-
-    // 2. Simulate Planning (Delay)
-    setTimeout(() => {
-      const planMsg = { 
-        id: 2, 
-        role: 'assistant', 
-        type: 'plan',
-        content: "I'll help you analyze that. Here is the plan:" 
-      };
-      setMessages(prev => [...prev, planMsg]);
-      
-      const initialSteps = [
-        { id: 1, title: 'Read data files', status: 'pending' },
-        { id: 2, title: 'Process revenue metrics', status: 'pending' },
-        { id: 3, title: 'Generate PDF Report', status: 'pending' },
-      ];
-      setSteps(initialSteps);
-      setStatus('running');
-
-      // 3. Start Execution simulation
-      runStep(1, initialSteps);
-    }, 1500);
-  };
-
-  const runStep = (stepId, currentSteps) => {
-    // Update step to running
-    const updatedSteps = currentSteps.map(s => 
-      s.id === stepId ? { ...s, status: 'running' } : s
-    );
-    setSteps(updatedSteps);
-
-    // Simulate work time
-    setTimeout(() => {
-      if (stepId === 1) {
-        // PERMISSION TRAP
-        setPermissionRequest({
-          id: 'perm_123',
-          type: 'filesystem_read',
-          scope: '~/Documents/Finance/Q3',
-          reason: 'I need to read the CSV files to analyze revenue.',
-          stepId: 1
-        });
-        setStatus('paused');
-      } else if (stepId === 2) {
-        completeStep(stepId, updatedSteps);
-        runStep(3, updatedSteps);
-      } else if (stepId === 3) {
-        completeStep(stepId, updatedSteps);
-        finishSession();
-      }
-    }, 2000);
-  };
-
-  const handlePermission = (decision) => {
-    const currentStepId = permissionRequest.stepId;
-    setPermissionRequest(null);
-
-    if (decision === 'deny') {
-      setStatus('failed');
-      setMessages(prev => [...prev, { id: 99, role: 'system', content: 'Permission denied. Task aborted.', type: 'error' }]);
-      const newSteps = steps.map(s => s.id === currentStepId ? { ...s, status: 'failed' } : s);
-      setSteps(newSteps);
-    } else {
-      // Allowed
-      setStatus('running');
-      // Add system log
-      setMessages(prev => [...prev, { id: 98, role: 'system', content: `Permission granted: ${decision}`, type: 'audit' }]);
-      completeStep(currentStepId, steps);
-      // Move to next step
-      runStep(2, steps);
-    }
-  };
-
-  const completeStep = (id, currentSteps) => {
-    const newSteps = currentSteps.map(s => 
-      s.id === id ? { ...s, status: 'completed' } : s
-    );
-    setSteps(newSteps);
-  };
-
-  const finishSession = () => {
-    setStatus('completed');
-    setArtifacts([{ id: 1, name: 'Q3_Revenue_Report.pdf', size: '1.2MB' }]);
-    setMessages(prev => [...prev, { id: 100, role: 'assistant', content: 'Task complete! I have generated the report below.' }]);
-  };
-
-  return (
-    <div className="h-screen flex flex-col bg-zinc-950 text-white relative">
-      {/* Header */}
-      <header className="h-16 border-b border-zinc-800 flex items-center justify-between px-4 bg-zinc-950/80 backdrop-blur-md z-10 sticky top-0">
-        <div className="flex items-center gap-4">
-          <Button variant="ghost" className="!p-2 rounded-full" onClick={onBack}>
-            <ArrowRight className="rotate-180 w-5 h-5" />
-          </Button>
-          <div>
-            <h2 className="font-semibold text-sm">Session #104</h2>
-            <div className="flex items-center gap-2 text-xs text-zinc-400">
-              <span className={`w-2 h-2 rounded-full ${status === 'running' ? 'bg-blue-500 animate-pulse' : status === 'paused' ? 'bg-amber-500' : status === 'completed' ? 'bg-emerald-500' : 'bg-zinc-600'}`}></span>
-              {status.charAt(0).toUpperCase() + status.slice(1)}
-            </div>
-          </div>
-        </div>
-        <div className="flex gap-2">
-          <Button variant="ghost" className="text-xs">
-            <Settings size={14} />
-          </Button>
-        </div>
-      </header>
-
-      {/* Main Content Area */}
-      <div className="flex-1 flex overflow-hidden">
-        
-        {/* Left: Chat & Stream */}
-        <div className="flex-1 overflow-y-auto p-4 md:p-8 scroll-smooth">
-          <div className="max-w-2xl mx-auto space-y-6 pb-32">
-            
-            {/* Empty State */}
-            {messages.length === 0 && (
-              <div className="text-center py-20 space-y-4">
-                <div className="w-16 h-16 bg-zinc-900 rounded-3xl mx-auto flex items-center justify-center border border-zinc-800">
-                  <Zap className="text-zinc-600" />
-                </div>
-                <h3 className="text-xl font-medium">Ready to work</h3>
-                <p className="text-zinc-500 text-sm max-w-xs mx-auto">
-                  Describe a task. I'll create a plan, ask for permissions when needed, and execute it.
-                </p>
-              </div>
-            )}
-
-            {/* Message Stream */}
-            {messages.map((msg) => (
-              <div key={msg.id} className={`flex ${msg.role === 'user' ? 'justify-end' : 'justify-start'}`}>
-                {msg.type === 'audit' ? (
-                   <div className="flex items-center gap-2 text-xs text-zinc-500 font-mono py-2 w-full justify-center">
-                     <Shield size={12} /> {msg.content}
-                   </div>
-                ) : msg.type === 'error' ? (
-                   <div className="text-red-400 text-sm bg-red-500/10 border border-red-500/20 px-4 py-2 rounded-lg">
-                     {msg.content}
-                   </div>
-                ) : (
-                  <div className={`max-w-[85%] p-4 rounded-2xl text-sm leading-relaxed ${
-                    msg.role === 'user' 
-                      ? 'bg-white text-black rounded-tr-sm shadow-xl shadow-white/5' 
-                      : 'bg-zinc-900 border border-zinc-800 text-zinc-200 rounded-tl-sm'
-                  }`}>
-                    {msg.content}
-                  </div>
-                )}
-              </div>
-            ))}
-
-            {/* Artifacts */}
-            {artifacts.length > 0 && (
-              <div className="bg-emerald-900/10 border border-emerald-500/20 rounded-xl p-4 flex items-center justify-between">
-                <div className="flex items-center gap-3">
-                  <div className="p-2 bg-emerald-500/20 rounded-lg text-emerald-400">
-                    <FileText size={20} />
-                  </div>
-                  <div>
-                    <div className="text-sm font-medium text-emerald-100">{artifacts[0].name}</div>
-                    <div className="text-xs text-emerald-500/60">{artifacts[0].size}</div>
-                  </div>
-                </div>
-                <Button variant="ghost" className="text-emerald-400 hover:text-emerald-300">
-                  <Download size={16} />
-                </Button>
-              </div>
-            )}
-            
-            <div ref={messagesEndRef} />
-          </div>
-        </div>
-
-        {/* Right: Plan & Context (Desktop) */}
-        <div className="hidden lg:flex w-80 border-l border-zinc-800 bg-zinc-925 flex-col">
-          <div className="p-4 border-b border-zinc-800 font-medium text-sm text-zinc-400 flex items-center justify-between">
-            <span>Execution Plan</span>
-            <span className="text-xs bg-zinc-800 px-2 py-0.5 rounded text-zinc-500">{steps.filter(s => s.status === 'completed').length}/{steps.length}</span>
-          </div>
-          <div className="p-4 space-y-4 overflow-y-auto flex-1">
-            {steps.length === 0 ? (
-              <div className="text-zinc-600 text-sm text-center py-10 italic">Plan will appear here...</div>
-            ) : (
-              steps.map((step, idx) => (
-                <div key={step.id} className="relative pl-6 pb-6 last:pb-0">
-                  {idx !== steps.length - 1 && (
-                    <div className={`absolute left-[9px] top-6 bottom-0 w-px ${step.status === 'completed' ? 'bg-emerald-500/20' : 'bg-zinc-800'}`} />
-                  )}
-                  <div className={`absolute left-0 top-1 w-5 h-5 rounded-full border flex items-center justify-center bg-zinc-950 z-10 
-                    ${step.status === 'completed' ? 'border-emerald-500 text-emerald-500' : 
-                      step.status === 'running' ? 'border-blue-500 text-blue-500' : 
-                      step.status === 'failed' ? 'border-red-500 text-red-500' : 'border-zinc-700 text-zinc-700'}`}>
-                    {step.status === 'completed' ? <CheckCircle2 size={12} /> : 
-                     step.status === 'running' ? <div className="w-2 h-2 rounded-full bg-current animate-pulse" /> :
-                     step.status === 'failed' ? <X size={12} /> :
-                     <Circle size={8} />}
-                  </div>
-                  <div className={`text-sm ${step.status === 'completed' ? 'text-zinc-400' : step.status === 'running' ? 'text-blue-100' : 'text-zinc-500'}`}>
-                    {step.title}
-                  </div>
-                </div>
-              ))
-            )}
-          </div>
-        </div>
-      </div>
-
-      {/* Input Area */}
-      <div className="p-4 border-t border-zinc-800 bg-zinc-950 sticky bottom-0 z-20">
-        <div className="max-w-2xl mx-auto relative">
-          <input
-            type="text"
-            disabled={status !== 'idle' && status !== 'completed'}
-            value={input}
-            onChange={(e) => setInput(e.target.value)}
-            onKeyDown={(e) => e.key === 'Enter' && handleStart()}
-            placeholder={status === 'running' ? "Task is running..." : "Ask OpenWork to do something..."}
-            className="w-full bg-zinc-900 border border-zinc-800 rounded-2xl py-4 pl-5 pr-14 text-white placeholder-zinc-500 focus:outline-none focus:ring-1 focus:ring-zinc-600 focus:border-zinc-600 transition-all disabled:opacity-50"
-          />
-          <button 
-            disabled={!input.trim() || (status !== 'idle' && status !== 'completed')}
-            onClick={handleStart}
-            className="absolute right-2 top-2 p-2 bg-white text-black rounded-xl hover:scale-105 active:scale-95 transition-all disabled:opacity-0 disabled:scale-75"
-          >
-            <ArrowRight size={20} />
-          </button>
-        </div>
-      </div>
-
-      {/* Permission Modal Overlay */}
-      {permissionRequest && (
-        <div className="absolute inset-0 z-50 bg-black/60 backdrop-blur-sm flex items-center justify-center p-4">
-          <div className="bg-zinc-900 border border-amber-500/30 w-full max-w-md rounded-2xl shadow-2xl overflow-hidden animate-in fade-in zoom-in duration-200">
-            <div className="p-6">
-              <div className="flex items-start gap-4 mb-4">
-                <div className="p-3 bg-amber-500/10 rounded-full text-amber-500">
-                  <Shield size={24} />
-                </div>
-                <div>
-                  <h3 className="text-lg font-semibold text-white">Permission Required</h3>
-                  <p className="text-sm text-zinc-400 mt-1">OpenCode needs access to your file system to continue.</p>
-                </div>
-              </div>
-              
-              <div className="bg-zinc-950/50 rounded-xl p-4 border border-zinc-800 mb-6">
-                <div className="text-xs text-zinc-500 uppercase tracking-wider mb-2 font-semibold">Reason</div>
-                <p className="text-sm text-zinc-300 mb-4 italic">"{permissionRequest.reason}"</p>
-                
-                <div className="text-xs text-zinc-500 uppercase tracking-wider mb-2 font-semibold">Scope</div>
-                <div className="flex items-center gap-2 text-sm font-mono text-amber-200 bg-amber-950/30 px-2 py-1 rounded border border-amber-500/20">
-                  <HardDrive size={12} />
-                  {permissionRequest.scope}
-                </div>
-              </div>
-
-              <div className="grid grid-cols-2 gap-3">
-                <Button variant="outline" className="w-full border-red-500/20 text-red-400 hover:bg-red-950/30" onClick={() => handlePermission('deny')}>
-                  Deny
-                </Button>
-                <div className="grid grid-cols-2 gap-2">
-                  <Button variant="secondary" className="text-xs" onClick={() => handlePermission('session')}>
-                    Once
-                  </Button>
-                  <Button variant="primary" className="text-xs font-bold bg-amber-500 hover:bg-amber-400 text-black border-none shadow-amber-500/20" onClick={() => handlePermission('always')}>
-                    Allow
-                  </Button>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-};
-
-const DashboardView = ({ onStartTask, isHost }) => {
-  return (
-    <div className="flex h-screen bg-zinc-950 text-white overflow-hidden">
-      {/* Sidebar */}
-      <aside className="w-64 border-r border-zinc-800 p-6 hidden md:flex flex-col justify-between bg-zinc-950">
-        <div>
-          <div className="flex items-center gap-3 mb-10 px-2">
-            <div className="w-8 h-8 bg-white rounded-lg flex items-center justify-center">
-              <Command size={18} className="text-black" />
-            </div>
-            <span className="font-bold text-lg tracking-tight">OpenWork</span>
-          </div>
-
-          <nav className="space-y-1">
-            {[
-              { icon: Layout, label: 'Dashboard', active: true },
-              { icon: Play, label: 'Sessions' },
-              { icon: FileText, label: 'Artifacts' },
-              { icon: Shield, label: 'Permissions' },
-            ].map((item) => (
-              <button 
-                key={item.label}
-                className={`w-full flex items-center gap-3 px-3 py-2.5 rounded-xl text-sm font-medium transition-colors ${item.active ? 'bg-zinc-900 text-white' : 'text-zinc-500 hover:text-white hover:bg-zinc-900/50'}`}
-              >
-                <item.icon size={18} />
-                {item.label}
-              </button>
-            ))}
-          </nav>
-        </div>
-
-        <div className="space-y-4">
-           {/* Host Status */}
-           <div className="px-3 py-3 rounded-xl bg-zinc-900/50 border border-zinc-800">
-             <div className="flex items-center gap-2 text-xs font-medium text-zinc-400 mb-2">
-               {isHost ? <Cpu size={12} /> : <Smartphone size={12} />}
-               {isHost ? 'Local Engine' : 'Client Mode'}
-             </div>
-             <div className="flex items-center gap-2">
-               <div className="w-2 h-2 rounded-full bg-emerald-500 animate-pulse"></div>
-               <span className="text-sm text-emerald-500 font-mono">Healthy</span>
-             </div>
-           </div>
-
-           <button className="flex items-center gap-3 px-3 py-2 text-sm text-zinc-500 hover:text-zinc-300">
-             <Settings size={18} />
-             Settings
-           </button>
-        </div>
-      </aside>
-
-      {/* Main Content */}
-      <main className="flex-1 overflow-y-auto relative">
-        <header className="h-16 flex items-center justify-between px-6 md:px-10 border-b border-zinc-800 sticky top-0 bg-zinc-950/80 backdrop-blur-md z-10">
-          <h1 className="text-lg font-medium">Good Morning</h1>
-          <div className="md:hidden">
-            <Menu className="text-zinc-400" />
-          </div>
-        </header>
-
-        <div className="p-6 md:p-10 max-w-5xl mx-auto space-y-10">
-          
-          {/* Quick Action */}
-          <section>
-            <div className="bg-gradient-to-r from-zinc-900 to-zinc-800 rounded-3xl p-1 border border-zinc-800 shadow-2xl">
-              <div className="bg-zinc-950 rounded-[22px] p-6 md:p-8 flex flex-col md:flex-row items-center justify-between gap-6">
-                <div className="space-y-2 text-center md:text-left">
-                  <h2 className="text-2xl font-semibold text-white">What should we do today?</h2>
-                  <p className="text-zinc-400">OpenWork can read files, run scripts, and generate reports.</p>
-                </div>
-                <Button onClick={onStartTask} className="w-full md:w-auto py-3 px-6 text-base shadow-white/10 shadow-lg">
-                  <Play size={18} className="fill-current" />
-                  New Task
-                </Button>
-              </div>
-            </div>
-          </section>
-
-          {/* Templates */}
-          <section>
-            <div className="flex items-center justify-between mb-4">
-              <h3 className="text-sm font-medium text-zinc-400 uppercase tracking-wider">Quick Start Templates</h3>
-              <button className="text-sm text-zinc-500 hover:text-white">View all</button>
-            </div>
-            <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
-              {MOCK_TEMPLATES.map((t) => (
-                <button 
-                  key={t.id} 
-                  onClick={onStartTask}
-                  className="group p-5 rounded-2xl bg-zinc-900/30 border border-zinc-800/50 hover:bg-zinc-900 hover:border-zinc-700 transition-all text-left"
-                >
-                  <div className="w-10 h-10 rounded-full bg-zinc-800 flex items-center justify-center mb-4 group-hover:scale-110 transition-transform">
-                     {t.icon === 'bar-chart' && <Layout size={20} className="text-indigo-400" />}
-                     {t.icon === 'folder' && <HardDrive size={20} className="text-amber-400" />}
-                     {t.icon === 'mic' && <Settings size={20} className="text-pink-400" />}
-                  </div>
-                  <h4 className="font-medium text-white mb-1">{t.title}</h4>
-                  <p className="text-sm text-zinc-500">{t.description}</p>
-                </button>
-              ))}
-            </div>
-          </section>
-
-          {/* Recent Activity */}
-          <section>
-             <h3 className="text-sm font-medium text-zinc-400 uppercase tracking-wider mb-4">Recent Sessions</h3>
-             <div className="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl overflow-hidden">
-               {MOCK_RECENT_SESSIONS.map((s, i) => (
-                 <div key={s.id} className={`p-4 flex items-center justify-between hover:bg-zinc-800/50 transition-colors ${i !== MOCK_RECENT_SESSIONS.length - 1 ? 'border-b border-zinc-800/50' : ''}`}>
-                   <div className="flex items-center gap-4">
-                     <div className="w-8 h-8 rounded-full bg-zinc-800 flex items-center justify-center text-xs text-zinc-500 font-mono">
-                       #{s.id}
-                     </div>
-                     <div>
-                       <div className="font-medium text-sm text-zinc-200">{s.title}</div>
-                       <div className="text-xs text-zinc-500 flex items-center gap-2">
-                         <Clock size={10} /> {s.date}
-                       </div>
-                     </div>
-                   </div>
-                   <div className="flex items-center gap-4">
-                     <StatusBadge status={s.status} />
-                     <ChevronRight size={16} className="text-zinc-600" />
-                   </div>
-                 </div>
-               ))}
-             </div>
-          </section>
-        </div>
-      </main>
-    </div>
-  );
-};
-
-// --- Main App Controller ---
-
-export default function App() {
-  const [view, setView] = useState('onboarding'); // onboarding, dashboard, session
-  const [mode, setMode] = useState(null); // host, client
-
-  const handleOnboardingComplete = (selectedMode) => {
-    setMode(selectedMode);
-    setView('dashboard');
-  };
-
-  const handleStartTask = () => {
-    setView('session');
-  };
-
-  const handleBackToDashboard = () => {
-    setView('dashboard');
-  };
-
-  return (
-    <div className="antialiased font-sans bg-zinc-950 min-h-screen text-zinc-100 selection:bg-white/20">
-      {view === 'onboarding' && <OnboardingView onComplete={handleOnboardingComplete} />}
-      {view === 'dashboard' && <DashboardView onStartTask={handleStartTask} isHost={mode === 'host'} />}
-      {view === 'session' && <SessionView onBack={handleBackToDashboard} />}
-    </div>
-  );
-}
\ No newline at end of file
diff --git a/docs/mcp-ui-control-profile.md b/docs/mcp-ui-control-profile.md
new file mode 100644
index 0000000000..77069631ec
--- /dev/null
+++ b/docs/mcp-ui-control-profile.md
@@ -0,0 +1,239 @@
+# Control OpenWork from any MCP client
+
+OpenWork exposes its UI as an MCP server so any MCP-capable app can read what's on screen and run actions — no DOM scraping, no coordinates, no accessibility hacks.
+
+## Why this exists
+
+Apps like HandsFree let people control their computers hands-free using AI. But generic computer-use flows (screenshot → click coordinate) are slow, fragile, and need a vision model for every step.
+
+OpenWork takes a different approach: the app itself tells you what actions are available, what the current state is, and lets you execute actions by name. The MCP server wraps that surface so any MCP client gets a first-class, semantic control experience out of the box.
+
+This means:
+
+- **HandsFree** can drive OpenWork sessions, composer, navigation, and transcript without guessing pixels.
+- **OpenCode** can automate OpenWork as part of a larger coding workflow.
+- **Claude Desktop, Codex, Cursor**, or any MCP-compatible tool can add OpenWork control with a single config line.
+- Your own app can do the same.
+
+> Want to control OpenWork Cloud workers and server APIs instead of the desktop UI? Check out the **OpenWork Cloud MCP** (separate package, coming soon).
+
+## Quick start with HandsFree
+
+HandsFree auto-discovers the OpenWork MCP server when both apps are running on the same machine. No config needed.
+
+1. Launch **OpenWork** (desktop app).
+2. Launch **HandsFree**.
+3. Open the HandsFree connector panel — you should see **OpenWork** with a green "Connected" status and an action count.
+
+That's it. HandsFree can now list your sessions, read transcripts, type into the composer, send prompts, and navigate the app — all through MCP.
+
+### What HandsFree can do once connected
+
+- `ui_snapshot` — see the current route, status, and available actions.
+- `ui_list_actions` — get every action the app currently exposes (session controls, composer, navigation, etc.).
+- `ui_execute_action` — run an action by ID, e.g. `session.create_task`, `composer.set_text`, `composer.send`.
+- `ui_status` — check if OpenWork is running and the bridge is reachable.
+
+## Install
+
+```bash
+npm install -g openwork-ui-mcp
+```
+
+Or run without installing:
+
+```bash
+npx openwork-ui-mcp
+```
+
+> The package is [`openwork-ui-mcp` on npm](https://www.npmjs.com/package/openwork-ui-mcp).
+
+## Add to OpenCode
+
+Add the MCP server to your workspace or global `opencode.json`:
+
+```json
+{
+  "mcp": {
+    "openwork-ui": {
+      "type": "local",
+      "command": ["npx", "-y", "openwork-ui-mcp"],
+      "enabled": true
+    }
+  }
+}
+```
+
+Then use the tools in any session:
+
+```
+> Use ui_snapshot to see what's on screen in OpenWork, then list the available sessions.
+```
+
+## Add to Claude Desktop or Codex
+
+Both use the same MCP config shape. Add to your `claude_desktop_config.json` or Codex MCP settings:
+
+```json
+{
+  "mcpServers": {
+    "openwork-ui": {
+      "command": "npx",
+      "args": ["-y", "openwork-ui-mcp"]
+    }
+  }
+}
+```
+
+Restart the app. The four tools (`ui_status`, `ui_snapshot`, `ui_list_actions`, `ui_execute_action`) will appear in the tool list.
+
+## Add to your own MCP client
+
+If you're building an app that speaks MCP, you can connect to the OpenWork UI server the same way:
+
+```js
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+
+const transport = new StdioClientTransport({
+  command: "npx",
+  args: ["-y", "openwork-ui-mcp"],
+});
+const client = new Client({ name: "my-app", version: "1.0.0" });
+await client.connect(transport);
+
+// Check if OpenWork is running
+const status = await client.callTool({ name: "ui_status", arguments: {} });
+console.log(status);
+
+// See what actions are available
+const actions = await client.callTool({ name: "ui_list_actions", arguments: {} });
+console.log(actions);
+
+// Type something into the composer
+await client.callTool({
+  name: "ui_execute_action",
+  arguments: { actionId: "composer.set_text", args: { text: "Hello from my app" } },
+});
+```
+
+## Tool reference
+
+### `ui_status`
+
+Check if OpenWork is running and reachable. Returns connection status and app info.
+
+**No arguments.**
+
+Example response:
+
+```
+Connected to OpenWork
+Bridge: http://127.0.0.1:52431
+Version: 1
+```
+
+### `ui_snapshot`
+
+Get the current OpenWork UI state: active route, narration, visible actions, and status. Call this before acting to understand what the user sees.
+
+**No arguments.**
+
+Example response:
+
+```
+Route: /session/ses_abc123
+Status: ready
+Narration: Ready. A controller can inspect and run visible actions.
+
+Actions (26):
+  session.create_task — Create a new task
+  session.list_sessions — List available sessions
+  composer.set_text — Type into the composer [text]
+  composer.send — Send the composer prompt
+  ...
+```
+
+### `ui_list_actions`
+
+List all UI control actions currently available. Each action has an `id` you can pass to `ui_execute_action`.
+
+**No arguments.**
+
+Returns the full list with labels, descriptions, and argument info.
+
+### `ui_execute_action`
+
+Execute an OpenWork UI action by its id.
+
+| Argument | Type | Description |
+|----------|------|-------------|
+| `actionId` | string | The action id from `ui_list_actions`, e.g. `session.create_task` or `composer.set_text` |
+| `args` | object (optional) | JSON arguments for the action, if required |
+
+Example — list sessions:
+
+```json
+{ "actionId": "session.list_sessions" }
+```
+
+Example — type into the composer:
+
+```json
+{ "actionId": "composer.set_text", "args": { "text": "Summarize this project" } }
+```
+
+Example — send the composer prompt:
+
+```json
+{ "actionId": "composer.send" }
+```
+
+## Available actions
+
+The exact list depends on the current OpenWork route and state. Common actions include:
+
+| Action | Description |
+|--------|-------------|
+| `session.create_task` | Create a new session in the selected workspace |
+| `session.list_sessions` | List sessions across workspaces |
+| `session.open` | Navigate to a session by ID |
+| `session.rename` | Rename a session |
+| `session.delete` | Delete a session (requires confirmation) |
+| `session.latest_message` | Read the latest message in the current session |
+| `session.read_transcript` | Read the last N messages as text |
+| `composer.set_text` | Type text into the composer (visible typing animation) |
+| `composer.send` | Send the current draft |
+| `composer.stop` | Stop a running session |
+| `session.scroll_top` | Scroll to the top of the transcript |
+| `session.scroll_bottom` | Scroll to the bottom |
+| `route.session` | Navigate to the session view |
+| `route.settings.*` | Navigate to various settings pages |
+| `command_palette.open` | Open the command palette |
+| `session.model_picker.open` | Open the model picker |
+| `status.docs.open` | Open documentation |
+| `status.settings.open` | Open settings from the status bar |
+
+## Requirements
+
+- **OpenWork desktop** must be running. The MCP server connects to OpenWork's local bridge which starts automatically when the desktop app launches.
+- **macOS** is the primary supported platform. The bridge uses Electron IPC and writes a discovery file to `~/Library/Application Support/com.differentai.openwork/`.
+- The MCP server runs as a **stdio** process — your MCP client spawns it and communicates over stdin/stdout.
+
+## How it works under the hood
+
+```
+┌─────────────┐     MCP stdio      ┌──────────────────┐     HTTP localhost     ┌──────────────┐
+│  MCP client  │ ←────────────────→ │  openwork-ui-mcp │ ←───────────────────→ │  OpenWork app │
+│  (HandsFree, │                    │  (Node.js)       │                       │  (Electron)   │
+│   OpenCode,  │                    │                  │                       │               │
+│   Codex)     │                    └──────────────────┘                       └──────────────┘
+└─────────────┘
+```
+
+1. OpenWork desktop starts a private localhost HTTP bridge on a random port, protected by a bearer token.
+2. It writes a discovery file with the port and token so `openwork-ui-mcp` can find it.
+3. `openwork-ui-mcp` reads the discovery file, proxies MCP tool calls to the bridge, and returns structured results.
+4. The bridge calls `window.__openworkControl` inside the Electron renderer to snapshot state and execute actions.
+
+The bridge and discovery file are implementation details — you never need to touch them directly. Just point your MCP client at `openwork-ui-mcp`.
diff --git a/ee/LICENSE b/ee/LICENSE
new file mode 100644
index 0000000000..b0f07cba77
--- /dev/null
+++ b/ee/LICENSE
@@ -0,0 +1,110 @@
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Different AI Inc
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/ee/apps/den-api/.env.example b/ee/apps/den-api/.env.example
new file mode 100644
index 0000000000..16a15d4e86
--- /dev/null
+++ b/ee/apps/den-api/.env.example
@@ -0,0 +1,29 @@
+PORT=8790
+CORS_ORIGINS=http://localhost:3000,http://localhost:3001
+DATABASE_URL=mysql://root:password@127.0.0.1:3306/den
+BETTER_AUTH_SECRET=replace-with-32-plus-character-secret
+# Required dedicated DB encryption key for encrypted columns. Minimum 32 chars.
+# Generate one with: openssl rand -base64 128
+DEN_DB_ENCRYPTION_KEY=
+BETTER_AUTH_URL=http://localhost:8790
+DEN_BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000,http://localhost:3001
+LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL=replace-with-loops-template-id
+LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL=replace-with-loops-template-id
+PROVISIONER_MODE=daytona
+WORKER_URL_TEMPLATE=https://workers.local/{workerId}
+WORKER_ACTIVITY_BASE_URL=http://localhost:8790
+RENDER_API_KEY=
+RENDER_OWNER_ID=
+RENDER_WORKER_PUBLIC_DOMAIN_SUFFIX=
+VERCEL_TOKEN=
+VERCEL_DNS_DOMAIN=
+POLAR_FEATURE_GATE_ENABLED=false
+POLAR_API_BASE=
+POLAR_ACCESS_TOKEN=
+POLAR_PRODUCT_ID=
+POLAR_BENEFIT_ID=
+POLAR_SUCCESS_URL=
+POLAR_RETURN_URL=
+DAYTONA_API_KEY=
+DAYTONA_API_URL=https://app.daytona.io/api
+OPENWORK_DEV_MODE=1
diff --git a/ee/apps/den-api/README.md b/ee/apps/den-api/README.md
new file mode 100644
index 0000000000..2f4433542f
--- /dev/null
+++ b/ee/apps/den-api/README.md
@@ -0,0 +1,61 @@
+# Den API
+
+Hono-based Den control plane implementation (`den-api`, formerly `den-controller`).
+
+This package is the active Den control plane implementation.
+
+It carries the full migrated Den API route surface in a foldered Hono structure so agents can navigate one area at a time without scanning the whole service.
+
+## Quick start
+
+```bash
+pnpm --filter @openwork-ee/den-api dev:local
+```
+
+## Local demo org seed
+
+With a local Den MySQL database running, seed a demo organization:
+
+```bash
+pnpm --filter @openwork-ee/den-api seed:demo-org
+```
+
+This creates `Acme Robotics` with demo users, teams, pending invites, and an imported Anthropic Knowledge Work Plugins marketplace. It is guarded by `OPENWORK_DEV_MODE=1`, defaults to the local Den DB URL, and does not create workers or active external integrations.
+
+Default owner login: `alex@acme.test` / `OpenWorkDemo123!`.
+
+## Current routes
+
+- `GET /` -> `302 https://openworklabs.com`
+- `GET /health`
+- Better Auth mount at `/api/auth/*`
+- desktop handoff routes under `/v1/auth/*`
+- current user routes under `/v1/me*`
+- organization routes under `/v1/orgs*`
+- admin routes under `/v1/admin*`
+- worker lifecycle and billing routes under `/v1/workers*`
+
+## Folder map
+
+- `src/routes/auth/`: Better Auth mount + desktop handoff endpoints
+- `src/routes/me/`: current user and current user's org resolution routes
+- `src/routes/org/`: organization CRUD-ish surfaces, split by area
+- `src/routes/admin/`: admin-only reporting endpoints
+- `src/routes/workers/`: worker lifecycle, billing, runtime, and heartbeat endpoints
+- `src/middleware/`: reusable Hono middleware for auth context, org context, teams, and validation
+
+Each major folder also has its own `README.md` so future agents can inspect one area in isolation.
+
+## TypeID validation
+
+- Shared Den TypeID validation lives in `ee/packages/utils/src/typeid.ts`.
+- Use `typeId.schema("...")` or the compatibility helpers like `normalizeDenTypeId("...", value)` when an endpoint accepts or returns a Den TypeID.
+- `ee/apps/den-api/src/openapi.ts` exposes `denTypeIdSchema(...)` so path params, request bodies, and response fields all share the same validation rules and Swagger examples.
+- Swagger now documents Den IDs with their required prefix and fixed 26-character TypeID suffix, so invalid IDs fail request validation before route logic runs.
+
+## Migration approach
+
+1. Keep `den-api` (formerly `den-controller`) as the source of truth for Den control-plane behavior.
+2. Add endpoints in focused Hono route groups one surface at a time.
+3. Reuse shared middleware and Zod validators instead of duplicating request/session/org plumbing.
+4. Leave a short README in each route area when the structure changes so later agents can recover context fast.
diff --git a/ee/apps/den-api/package.json b/ee/apps/den-api/package.json
new file mode 100644
index 0000000000..55beb8332b
--- /dev/null
+++ b/ee/apps/den-api/package.json
@@ -0,0 +1,42 @@
+{
+  "name": "@openwork-ee/den-api",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 tsx watch src/server.ts",
+    "dev:local": "sh -lc 'OPENWORK_DEV_MODE=1 PORT=${DEN_API_PORT:-8790} tsx watch src/server.ts'",
+    "build": "node ./scripts/build.mjs",
+    "build:den-db": "pnpm --filter @openwork-ee/den-db build",
+    "seed:demo-org": "pnpm run build:den-db && sh -lc 'DEN_WEB_PORT=${DEN_WEB_PORT:-3005}; OPENWORK_DEV_MODE=${OPENWORK_DEV_MODE:-1} DATABASE_URL=${DATABASE_URL:-mysql://root:password@127.0.0.1:3306/openwork_den} DEN_DB_ENCRYPTION_KEY=${DEN_DB_ENCRYPTION_KEY:-local-dev-db-encryption-key-please-change-1234567890} BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-local-dev-secret-not-for-production-use!!} BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:$DEN_WEB_PORT} tsx scripts/seed-demo-org.ts'",
+    "start": "node dist/server.js"
+  },
+  "dependencies": {
+    "@better-auth/api-key": "^1.5.6",
+    "@better-auth/oauth-provider": "^1.5.6",
+    "@daytonaio/sdk": "^0.150.0",
+    "@hono/mcp": "^0.2.5",
+    "@hono/node-server": "^1.13.8",
+    "@hono/standard-validator": "^0.2.2",
+    "@hono/swagger-ui": "^0.6.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@openwork-ee/den-db": "workspace:*",
+    "@openwork-ee/utils": "workspace:*",
+    "@openwork/types": "workspace:*",
+    "@standard-community/standard-json": "^0.3.5",
+    "@standard-community/standard-openapi": "^0.2.9",
+    "@standard-schema/spec": "^1.1.0",
+    "better-auth": "^1.5.6",
+    "better-call": "^1.3.2",
+    "dotenv": "^16.4.5",
+    "hono": "^4.7.2",
+    "hono-openapi": "^1.3.0",
+    "openapi-types": "^12.1.3",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/json-schema": "^7.0.15",
+    "@types/node": "^20.11.30",
+    "tsx": "^4.15.7",
+    "typescript": "^5.5.4"
+  }
+}
diff --git a/ee/apps/den-api/scripts/build.mjs b/ee/apps/den-api/scripts/build.mjs
new file mode 100644
index 0000000000..2e9bb5b775
--- /dev/null
+++ b/ee/apps/den-api/scripts/build.mjs
@@ -0,0 +1,59 @@
+import { spawnSync } from "node:child_process"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const serviceDir = path.resolve(scriptDir, "..")
+const repoRoot = path.resolve(serviceDir, "..", "..", "..")
+const desktopPackagePath = path.join(repoRoot, "apps", "desktop", "package.json")
+const generatedVersionPath = path.join(serviceDir, "src", "generated", "app-version.ts")
+const pnpmCommand = process.platform === "win32" ? "pnpm.cmd" : "pnpm"
+const fallbackAppVersion = "0.0.0"
+
+function readDesktopVersion() {
+  if (!existsSync(desktopPackagePath)) {
+    // The Den API is built inside contexts (e.g. the Docker image used by
+    // `packaging/docker/den-dev-up.sh`) that intentionally do not ship the
+    // Tauri desktop sources. Falling back lets the container image build
+    // without copying unrelated packages; consumers that need the real
+    // version can override via DEN_API_LATEST_APP_VERSION.
+    console.warn(`Desktop package.json not found at ${desktopPackagePath}; using fallback version ${fallbackAppVersion}`)
+    return fallbackAppVersion
+  }
+
+  const packageJson = JSON.parse(readFileSync(desktopPackagePath, "utf8"))
+  const version = packageJson.version?.trim()
+
+  if (!version) {
+    throw new Error(`Desktop version missing in ${desktopPackagePath}`)
+  }
+
+  return version
+}
+
+function writeGeneratedVersionFile(latestAppVersion) {
+  mkdirSync(path.dirname(generatedVersionPath), { recursive: true })
+  writeFileSync(
+    generatedVersionPath,
+    `export const BUILD_LATEST_APP_VERSION = ${JSON.stringify(latestAppVersion)} as const\n`,
+  )
+}
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    cwd: serviceDir,
+    env: process.env,
+    stdio: "inherit",
+  })
+
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1)
+  }
+}
+
+process.env.DEN_API_LATEST_APP_VERSION = process.env.DEN_API_LATEST_APP_VERSION || readDesktopVersion()
+writeGeneratedVersionFile(process.env.DEN_API_LATEST_APP_VERSION)
+
+run(pnpmCommand, ["run", "build:den-db"])
+run(pnpmCommand, ["exec", "tsc", "-p", "tsconfig.json"])
diff --git a/ee/apps/den-api/scripts/seed-demo-org.ts b/ee/apps/den-api/scripts/seed-demo-org.ts
new file mode 100644
index 0000000000..574e367c93
--- /dev/null
+++ b/ee/apps/den-api/scripts/seed-demo-org.ts
@@ -0,0 +1,1041 @@
+import { and, eq, inArray } from "@openwork-ee/den-db/drizzle"
+import {
+  AuthUserTable,
+  ConfigObjectAccessGrantTable,
+  ConfigObjectTable,
+  ConfigObjectVersionTable,
+  InvitationTable,
+  MarketplaceAccessGrantTable,
+  MarketplacePluginTable,
+  MarketplaceTable,
+  MemberTable,
+  OrganizationTable,
+  PluginAccessGrantTable,
+  PluginConfigObjectTable,
+  PluginTable,
+  TeamMemberTable,
+  TeamTable,
+} from "@openwork-ee/den-db/schema"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import { auth } from "../src/auth.js"
+import { db } from "../src/db.js"
+import { env } from "../src/env.js"
+import { seedDefaultOrganizationRoles } from "../src/orgs.js"
+
+const RESET_MODE = process.argv.includes("--reset")
+
+type UserId = typeof AuthUserTable.$inferSelect.id
+type OrganizationId = typeof OrganizationTable.$inferSelect.id
+type MemberId = typeof MemberTable.$inferSelect.id
+type TeamId = typeof TeamTable.$inferSelect.id
+type MarketplaceId = typeof MarketplaceTable.$inferSelect.id
+type PluginId = typeof PluginTable.$inferSelect.id
+type ConfigObjectId = typeof ConfigObjectTable.$inferSelect.id
+type ConfigObjectType = typeof ConfigObjectTable.$inferSelect.objectType
+
+type DemoPerson = {
+  email: string
+  name: string
+  role: "admin" | "member" | "owner"
+  teams: string[]
+}
+
+type DemoPlugin = {
+  description: string
+  orgWide?: boolean
+  slug: string
+  teamAccess: string[]
+}
+
+type GithubContentEntry = {
+  download_url: string | null
+  name: string
+  path: string
+  type: "dir" | "file" | string
+}
+
+type PluginContentObject = {
+  description: string | null
+  normalizedPayloadJson?: Record<string, unknown>
+  objectType: ConfigObjectType
+  path: string
+  rawSourceText: string
+  title: string
+}
+
+const DEMO_ORG_NAME = process.env.DEN_DEMO_ORG_NAME?.trim() || "Acme Robotics"
+const DEMO_ORG_SLUG = process.env.DEN_DEMO_ORG_SLUG?.trim() || "acme-robotics-demo"
+const DEMO_EMAIL_DOMAIN = process.env.DEN_DEMO_EMAIL_DOMAIN?.trim() || "acme.test"
+const DEMO_OWNER_EMAIL = process.env.DEN_DEMO_OWNER_EMAIL?.trim() || `alex@${DEMO_EMAIL_DOMAIN}`
+const DEMO_OWNER_PASSWORD = process.env.DEN_DEMO_OWNER_PASSWORD?.trim() || "OpenWorkDemo123!"
+const SHOULD_FETCH_GITHUB = (process.env.DEN_DEMO_SEED_FETCH_GITHUB ?? "1").trim() !== "0"
+const GITHUB_TOKEN = process.env.GITHUB_TOKEN?.trim()
+const GITHUB_REPO = "anthropics/knowledge-work-plugins"
+const GITHUB_REF = process.env.DEN_DEMO_PLUGIN_REF?.trim() || "main"
+const GITHUB_RAW_BASE = `https://raw.githubusercontent.com/${GITHUB_REPO}/${GITHUB_REF}`
+const GITHUB_API_BASE = `https://api.github.com/repos/${GITHUB_REPO}/contents`
+const SOURCE_REVISION_REF = `${GITHUB_REPO}@${GITHUB_REF}`
+const MAX_RAW_SOURCE_CHARS = 18_000
+
+const demoPeople: DemoPerson[] = [
+  { email: DEMO_OWNER_EMAIL, name: "Alex Chen", role: "owner", teams: ["Leadership", "Product"] },
+  { email: `priya@${DEMO_EMAIL_DOMAIN}`, name: "Priya Shah", role: "admin", teams: ["Leadership", "Engineering"] },
+  { email: `mateo@${DEMO_EMAIL_DOMAIN}`, name: "Mateo Rivera", role: "admin", teams: ["Leadership", "Sales"] },
+  { email: `morgan@${DEMO_EMAIL_DOMAIN}`, name: "Morgan Lee", role: "member", teams: ["Product", "Design"] },
+  { email: `nora@${DEMO_EMAIL_DOMAIN}`, name: "Nora Patel", role: "member", teams: ["Product", "Data"] },
+  { email: `jamal@${DEMO_EMAIL_DOMAIN}`, name: "Jamal Brooks", role: "member", teams: ["Engineering"] },
+  { email: `sofia@${DEMO_EMAIL_DOMAIN}`, name: "Sofia Garcia", role: "member", teams: ["Engineering", "Operations"] },
+  { email: `ivy@${DEMO_EMAIL_DOMAIN}`, name: "Ivy Nguyen", role: "member", teams: ["Design"] },
+  { email: `liam@${DEMO_EMAIL_DOMAIN}`, name: "Liam O'Connor", role: "member", teams: ["Sales"] },
+  { email: `olivia@${DEMO_EMAIL_DOMAIN}`, name: "Olivia Martin", role: "member", teams: ["Sales", "Marketing"] },
+  { email: `harper@${DEMO_EMAIL_DOMAIN}`, name: "Harper Wilson", role: "member", teams: ["Support"] },
+  { email: `kenji@${DEMO_EMAIL_DOMAIN}`, name: "Kenji Tanaka", role: "member", teams: ["Support", "Operations"] },
+  { email: `zoe@${DEMO_EMAIL_DOMAIN}`, name: "Zoe Kim", role: "member", teams: ["Marketing"] },
+  { email: `sam@${DEMO_EMAIL_DOMAIN}`, name: "Sam Okafor", role: "member", teams: ["Finance"] },
+  { email: `maya@${DEMO_EMAIL_DOMAIN}`, name: "Maya Singh", role: "member", teams: ["Legal"] },
+  { email: `ezra@${DEMO_EMAIL_DOMAIN}`, name: "Ezra Cohen", role: "member", teams: ["Data", "Engineering"] },
+  { email: `camila@${DEMO_EMAIL_DOMAIN}`, name: "Camila Torres", role: "member", teams: ["Human Resources", "Operations"] },
+]
+
+const pendingInvites = [
+  { email: `riley@${DEMO_EMAIL_DOMAIN}`, role: "member", team: "Engineering" },
+  { email: `taylor@${DEMO_EMAIL_DOMAIN}`, role: "member", team: "Sales" },
+  { email: `jordan@${DEMO_EMAIL_DOMAIN}`, role: "admin", team: "Leadership" },
+]
+
+const demoPlugins: DemoPlugin[] = [
+  {
+    description: "Manage tasks, plan your day, and build up memory of important context about your work. Syncs with your calendar, email, and chat to keep everything organized and on track.",
+    orgWide: true,
+    slug: "productivity",
+    teamAccess: ["Leadership", "Operations"],
+  },
+  {
+    description: "Search across all of your company's tools in one place. Find anything across email, chat, documents, and wikis without switching between apps.",
+    orgWide: true,
+    slug: "enterprise-search",
+    teamAccess: ["Leadership", "Product", "Support"],
+  },
+  {
+    description: "Prospect, craft outreach, and build deal strategy faster. Prep for calls, manage your pipeline, and write personalized messaging that moves deals forward.",
+    slug: "sales",
+    teamAccess: ["Sales", "Marketing"],
+  },
+  {
+    description: "Triage tickets, draft responses, package escalations, research customer context, and turn resolved issues into knowledge base articles.",
+    slug: "customer-support",
+    teamAccess: ["Support", "Product"],
+  },
+  {
+    description: "Write feature specs, plan roadmaps, and synthesize user research faster. Keep stakeholders updated and stay ahead of the competitive landscape.",
+    slug: "product-management",
+    teamAccess: ["Product", "Design", "Engineering"],
+  },
+  {
+    description: "Create content, plan campaigns, and analyze performance across marketing channels. Maintain brand voice consistency, track competitors, and report on what's working.",
+    slug: "marketing",
+    teamAccess: ["Marketing", "Sales"],
+  },
+  {
+    description: "Speed up contract review, NDA triage, and compliance workflows for in-house legal teams. Draft legal briefs, organize precedent research, and manage institutional knowledge.",
+    slug: "legal",
+    teamAccess: ["Legal", "Leadership"],
+  },
+  {
+    description: "Streamline finance and accounting workflows, from journal entries and reconciliation to financial statements and variance analysis.",
+    slug: "finance",
+    teamAccess: ["Finance", "Leadership"],
+  },
+  {
+    description: "Write SQL, explore datasets, and generate insights faster. Build visualizations and dashboards, and turn raw data into clear stories for stakeholders.",
+    slug: "data",
+    teamAccess: ["Data", "Product", "Engineering"],
+  },
+  {
+    description: "Streamline engineering workflows — standups, code review, architecture decisions, incident response, and technical documentation.",
+    slug: "engineering",
+    teamAccess: ["Engineering", "Product"],
+  },
+  {
+    description: "Accelerate design workflows — critique, design system management, UX writing, accessibility audits, research synthesis, and dev handoff.",
+    slug: "design",
+    teamAccess: ["Design", "Product"],
+  },
+  {
+    description: "Optimize business operations — vendor management, process documentation, change management, capacity planning, and compliance tracking.",
+    slug: "operations",
+    teamAccess: ["Operations", "Finance", "Human Resources"],
+  },
+  {
+    description: "Streamline people operations — recruiting, onboarding, performance reviews, compensation analysis, and policy guidance.",
+    slug: "human-resources",
+    teamAccess: ["Human Resources", "Leadership"],
+  },
+  {
+    description: "View, annotate, and sign PDFs in a live interactive viewer for contracts, forms, and approvals.",
+    slug: "pdf-viewer",
+    teamAccess: ["Legal", "Finance", "Operations"],
+  },
+]
+
+function assertSafeDevTarget() {
+  if (!env.devMode) {
+    throw new Error("Refusing to seed demo data unless OPENWORK_DEV_MODE=1.")
+  }
+  if (env.dbMode !== "mysql") {
+    throw new Error(`Refusing to seed demo data into DB_MODE=${env.dbMode}; use local MySQL dev mode.`)
+  }
+
+  const parsed = env.databaseUrl ? new URL(env.databaseUrl) : null
+  const host = parsed?.hostname ?? ""
+  const allowNonLocal = process.env.DEN_DEMO_SEED_ALLOW_NONLOCAL === "1"
+  const localHosts = new Set(["127.0.0.1", "localhost", "mysql"])
+  if (!allowNonLocal && !localHosts.has(host)) {
+    throw new Error(`Refusing to seed non-local database host '${host}'. Set DEN_DEMO_SEED_ALLOW_NONLOCAL=1 to override.`)
+  }
+}
+
+function githubHeaders() {
+  return {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "openwork-den-demo-seed",
+    ...(GITHUB_TOKEN ? { Authorization: `Bearer ${GITHUB_TOKEN}` } : {}),
+  }
+}
+
+async function fetchJson<T>(url: string): Promise<T | null> {
+  if (!SHOULD_FETCH_GITHUB) return null
+  try {
+    const response = await fetch(url, { headers: githubHeaders() })
+    if (!response.ok) return null
+    return await response.json() as T
+  } catch {
+    return null
+  }
+}
+
+async function fetchText(url: string): Promise<string | null> {
+  if (!SHOULD_FETCH_GITHUB) return null
+  try {
+    const response = await fetch(url, { headers: githubHeaders() })
+    if (!response.ok) return null
+    return await response.text()
+  } catch {
+    return null
+  }
+}
+
+function trimForEncryptedText(value: string) {
+  if (value.length <= MAX_RAW_SOURCE_CHARS) return value
+  return `${value.slice(0, MAX_RAW_SOURCE_CHARS)}\n\n<!-- Demo seed truncated this source file for local DB text column size. -->`
+}
+
+function fileNameFromPath(path: string) {
+  return path.split("/").pop() ?? path
+}
+
+function extensionFromPath(path: string) {
+  const fileName = fileNameFromPath(path)
+  const dotIndex = fileName.lastIndexOf(".")
+  return dotIndex >= 0 ? fileName.slice(dotIndex + 1) : null
+}
+
+function titleFromPath(path: string) {
+  const fileName = fileNameFromPath(path).replace(/\.[^.]+$/, "")
+  return fileName
+    .split(/[-_\s]+/g)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join(" ") || path
+}
+
+function deriveSearchText(input: { description?: string | null; rawSourceText?: string | null; title: string }) {
+  return [input.title, input.description, input.rawSourceText].filter(Boolean).join("\n") || null
+}
+
+async function ensureSignedInOwnerUser() {
+  const existing = await db
+    .select()
+    .from(AuthUserTable)
+    .where(eq(AuthUserTable.email, DEMO_OWNER_EMAIL.toLowerCase()))
+    .limit(1)
+
+  if (!existing[0]) {
+    await (auth.api as unknown as {
+      signUpEmail(input: { body: { email: string; name: string; password: string } }): Promise<unknown>
+    }).signUpEmail({
+      body: {
+        email: DEMO_OWNER_EMAIL.toLowerCase(),
+        name: demoPeople[0]?.name ?? "Demo Owner",
+        password: DEMO_OWNER_PASSWORD,
+      },
+    })
+  }
+
+  const rows = await db
+    .select()
+    .from(AuthUserTable)
+    .where(eq(AuthUserTable.email, DEMO_OWNER_EMAIL.toLowerCase()))
+    .limit(1)
+  const user = rows[0]
+  if (!user) throw new Error(`Failed to create demo owner ${DEMO_OWNER_EMAIL}.`)
+
+  await db
+    .update(AuthUserTable)
+    .set({ emailVerified: true, name: demoPeople[0]?.name ?? user.name, updatedAt: new Date() })
+    .where(eq(AuthUserTable.id, user.id))
+
+  return user.id
+}
+
+async function ensureDisplayUser(person: DemoPerson): Promise<UserId> {
+  if (person.email.toLowerCase() === DEMO_OWNER_EMAIL.toLowerCase()) {
+    return ensureSignedInOwnerUser()
+  }
+
+  const email = person.email.toLowerCase()
+  const existing = await db.select().from(AuthUserTable).where(eq(AuthUserTable.email, email)).limit(1)
+  if (existing[0]) {
+    await db
+      .update(AuthUserTable)
+      .set({ emailVerified: true, name: person.name, updatedAt: new Date() })
+      .where(eq(AuthUserTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("user")
+  const now = new Date()
+  await db.insert(AuthUserTable).values({
+    createdAt: now,
+    email,
+    emailVerified: true,
+    id,
+    image: null,
+    name: person.name,
+    updatedAt: now,
+  })
+  return id
+}
+
+async function ensureOrganization(ownerUserId: UserId): Promise<OrganizationId> {
+  const existing = await db.select().from(OrganizationTable).where(eq(OrganizationTable.slug, DEMO_ORG_SLUG)).limit(1)
+  const metadata = {
+    demoSeed: {
+      source: "den-api seed:demo-org",
+      updatedAt: new Date().toISOString(),
+    },
+    limits: {
+      members: 100,
+      workers: 0,
+    },
+  }
+
+  if (existing[0]) {
+    await db
+      .update(OrganizationTable)
+      .set({
+        allowedEmailDomains: [DEMO_EMAIL_DOMAIN],
+        metadata,
+        name: DEMO_ORG_NAME,
+        updatedAt: new Date(),
+      })
+      .where(eq(OrganizationTable.id, existing[0].id))
+    await seedDefaultOrganizationRoles(existing[0].id)
+    await ensureMember(existing[0].id, ownerUserId, "owner")
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("organization")
+  await db.insert(OrganizationTable).values({
+    allowedEmailDomains: [DEMO_EMAIL_DOMAIN],
+    id,
+    logo: null,
+    metadata,
+    name: DEMO_ORG_NAME,
+    slug: DEMO_ORG_SLUG,
+  })
+  await seedDefaultOrganizationRoles(id)
+  await ensureMember(id, ownerUserId, "owner")
+  return id
+}
+
+async function ensureMember(organizationId: OrganizationId, userId: UserId, role: DemoPerson["role"]): Promise<MemberId> {
+  const existing = await db
+    .select()
+    .from(MemberTable)
+    .where(and(eq(MemberTable.organizationId, organizationId), eq(MemberTable.userId, userId)))
+    .limit(1)
+
+  if (existing[0]) {
+    await db.update(MemberTable).set({ role }).where(eq(MemberTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("member")
+  await db.insert(MemberTable).values({ id, organizationId, role, userId })
+  return id
+}
+
+async function ensureTeam(organizationId: OrganizationId, name: string): Promise<TeamId> {
+  const existing = await db
+    .select()
+    .from(TeamTable)
+    .where(and(eq(TeamTable.organizationId, organizationId), eq(TeamTable.name, name)))
+    .limit(1)
+  if (existing[0]) return existing[0].id
+
+  const id = createDenTypeId("team")
+  await db.insert(TeamTable).values({ id, name, organizationId })
+  return id
+}
+
+async function ensureTeamMember(teamId: TeamId, orgMembershipId: MemberId) {
+  const existing = await db
+    .select()
+    .from(TeamMemberTable)
+    .where(and(eq(TeamMemberTable.teamId, teamId), eq(TeamMemberTable.orgMembershipId, orgMembershipId)))
+    .limit(1)
+  if (existing[0]) return existing[0].id
+
+  const id = createDenTypeId("teamMember")
+  await db.insert(TeamMemberTable).values({ id, orgMembershipId, teamId })
+  return id
+}
+
+async function ensureInvitation(input: {
+  email: string
+  inviterId: UserId
+  organizationId: OrganizationId
+  role: string
+  teamId: TeamId | null
+}) {
+  const email = input.email.toLowerCase()
+  const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24 * 14)
+  const existing = await db
+    .select()
+    .from(InvitationTable)
+    .where(and(eq(InvitationTable.organizationId, input.organizationId), eq(InvitationTable.email, email)))
+    .limit(1)
+
+  if (existing[0]) {
+    await db
+      .update(InvitationTable)
+      .set({ expiresAt, inviterId: input.inviterId, role: input.role, status: "pending", teamId: input.teamId })
+      .where(eq(InvitationTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("invitation")
+  await db.insert(InvitationTable).values({
+    email,
+    expiresAt,
+    id,
+    inviterId: input.inviterId,
+    organizationId: input.organizationId,
+    role: input.role,
+    status: "pending",
+    teamId: input.teamId,
+  })
+  return id
+}
+
+async function ensureMarketplace(input: { createdByOrgMembershipId: MemberId; organizationId: OrganizationId }): Promise<MarketplaceId> {
+  const name = "Anthropic Knowledge Work Plugins"
+  const description = `Demo marketplace seeded from ${GITHUB_REPO}. Plugins are imported into Den DB for local demos; no external integrations are connected.`
+  const existing = await db
+    .select()
+    .from(MarketplaceTable)
+    .where(and(eq(MarketplaceTable.organizationId, input.organizationId), eq(MarketplaceTable.name, name)))
+    .limit(1)
+
+  if (existing[0]) {
+    await db
+      .update(MarketplaceTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, deletedAt: null, description, status: "active", updatedAt: new Date() })
+      .where(eq(MarketplaceTable.id, existing[0].id))
+    await ensureMarketplaceAccessGrant({ ...input, marketplaceId: existing[0].id, role: "viewer" })
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("marketplace")
+  await db.insert(MarketplaceTable).values({
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    deletedAt: null,
+    description,
+    id,
+    name,
+    organizationId: input.organizationId,
+    status: "active",
+  })
+  await ensureMarketplaceAccessGrant({ ...input, marketplaceId: id, role: "viewer" })
+  return id
+}
+
+async function ensureMarketplaceAccessGrant(input: {
+  createdByOrgMembershipId: MemberId
+  marketplaceId: MarketplaceId
+  organizationId: OrganizationId
+  role: "manager" | "viewer"
+}) {
+  const existing = await db
+    .select()
+    .from(MarketplaceAccessGrantTable)
+    .where(and(eq(MarketplaceAccessGrantTable.marketplaceId, input.marketplaceId), eq(MarketplaceAccessGrantTable.orgWide, true)))
+    .limit(1)
+  if (existing[0]) {
+    await db
+      .update(MarketplaceAccessGrantTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, orgWide: true, removedAt: null, role: input.role })
+      .where(eq(MarketplaceAccessGrantTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("marketplaceAccessGrant")
+  await db.insert(MarketplaceAccessGrantTable).values({
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    id,
+    marketplaceId: input.marketplaceId,
+    organizationId: input.organizationId,
+    orgMembershipId: null,
+    orgWide: true,
+    role: input.role,
+    teamId: null,
+  })
+  return id
+}
+
+async function ensurePlugin(input: {
+  createdByOrgMembershipId: MemberId
+  marketplaceId: MarketplaceId
+  organizationId: OrganizationId
+  plugin: DemoPlugin
+}): Promise<PluginId> {
+  const existing = await db
+    .select()
+    .from(PluginTable)
+    .where(and(eq(PluginTable.organizationId, input.organizationId), eq(PluginTable.name, input.plugin.slug)))
+    .limit(1)
+
+  const description = `${input.plugin.description}\n\nSource: https://github.com/${GITHUB_REPO}/tree/${GITHUB_REF}/${input.plugin.slug}`
+  let pluginId: PluginId
+  if (existing[0]) {
+    pluginId = existing[0].id
+    await db
+      .update(PluginTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, deletedAt: null, description, name: input.plugin.slug, status: "active", updatedAt: new Date() })
+      .where(eq(PluginTable.id, pluginId))
+  } else {
+    pluginId = createDenTypeId("plugin")
+    await db.insert(PluginTable).values({
+      createdByOrgMembershipId: input.createdByOrgMembershipId,
+      deletedAt: null,
+      description,
+      id: pluginId,
+      name: input.plugin.slug,
+      organizationId: input.organizationId,
+      status: "active",
+    })
+  }
+
+  await ensureMarketplacePlugin({ ...input, pluginId })
+  return pluginId
+}
+
+async function ensureMarketplacePlugin(input: {
+  createdByOrgMembershipId: MemberId
+  marketplaceId: MarketplaceId
+  organizationId: OrganizationId
+  pluginId: PluginId
+}) {
+  const existing = await db
+    .select()
+    .from(MarketplacePluginTable)
+    .where(and(eq(MarketplacePluginTable.marketplaceId, input.marketplaceId), eq(MarketplacePluginTable.pluginId, input.pluginId)))
+    .limit(1)
+
+  if (existing[0]) {
+    await db
+      .update(MarketplacePluginTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, membershipSource: "system", removedAt: null })
+      .where(eq(MarketplacePluginTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("marketplacePlugin")
+  await db.insert(MarketplacePluginTable).values({
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    id,
+    marketplaceId: input.marketplaceId,
+    membershipSource: "system",
+    organizationId: input.organizationId,
+    pluginId: input.pluginId,
+    removedAt: null,
+  })
+  return id
+}
+
+async function ensurePluginAccessGrant(input: {
+  createdByOrgMembershipId: MemberId
+  organizationId: OrganizationId
+  pluginId: PluginId
+  role: "editor" | "manager" | "viewer"
+  teamId?: TeamId | null
+  orgWide?: boolean
+}) {
+  const existing = await db
+    .select()
+    .from(PluginAccessGrantTable)
+    .where(and(
+      eq(PluginAccessGrantTable.pluginId, input.pluginId),
+      input.teamId ? eq(PluginAccessGrantTable.teamId, input.teamId) : eq(PluginAccessGrantTable.orgWide, true),
+    ))
+    .limit(1)
+
+  if (existing[0]) {
+    await db
+      .update(PluginAccessGrantTable)
+      .set({
+        createdByOrgMembershipId: input.createdByOrgMembershipId,
+        orgMembershipId: null,
+        orgWide: input.orgWide ?? !input.teamId,
+        removedAt: null,
+        role: input.role,
+        teamId: input.teamId ?? null,
+      })
+      .where(eq(PluginAccessGrantTable.id, existing[0].id))
+    return existing[0].id
+  }
+
+  const id = createDenTypeId("pluginAccessGrant")
+  await db.insert(PluginAccessGrantTable).values({
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    id,
+    organizationId: input.organizationId,
+    orgMembershipId: null,
+    orgWide: input.orgWide ?? !input.teamId,
+    pluginId: input.pluginId,
+    role: input.role,
+    teamId: input.teamId ?? null,
+  })
+  return id
+}
+
+async function ensureConfigObject(input: {
+  createdByOrgMembershipId: MemberId
+  object: PluginContentObject
+  organizationId: OrganizationId
+  pluginId: PluginId
+}) {
+  const currentFileName = fileNameFromPath(input.object.path)
+  const currentFileExtension = extensionFromPath(input.object.path)
+  const rawSourceText = trimForEncryptedText(input.object.rawSourceText)
+  const searchText = deriveSearchText({ description: input.object.description, rawSourceText, title: input.object.title })
+
+  const existing = await db
+    .select()
+    .from(ConfigObjectTable)
+    .where(and(eq(ConfigObjectTable.organizationId, input.organizationId), eq(ConfigObjectTable.currentRelativePath, input.object.path)))
+    .limit(1)
+
+  let configObjectId: ConfigObjectId
+  if (existing[0]) {
+    configObjectId = existing[0].id
+    await db
+      .update(ConfigObjectTable)
+      .set({
+        createdByOrgMembershipId: input.createdByOrgMembershipId,
+        currentFileExtension,
+        currentFileName,
+        currentRelativePath: input.object.path,
+        deletedAt: null,
+        description: input.object.description,
+        objectType: input.object.objectType,
+        searchText,
+        sourceMode: "import",
+        status: "active",
+        title: input.object.title,
+        updatedAt: new Date(),
+      })
+      .where(eq(ConfigObjectTable.id, configObjectId))
+  } else {
+    configObjectId = createDenTypeId("configObject")
+    await db.insert(ConfigObjectTable).values({
+      connectorInstanceId: null,
+      createdByOrgMembershipId: input.createdByOrgMembershipId,
+      currentFileExtension,
+      currentFileName,
+      currentRelativePath: input.object.path,
+      deletedAt: null,
+      description: input.object.description,
+      id: configObjectId,
+      objectType: input.object.objectType,
+      organizationId: input.organizationId,
+      searchText,
+      sourceMode: "import",
+      status: "active",
+      title: input.object.title,
+    })
+  }
+
+  await db.insert(ConfigObjectVersionTable).values({
+    configObjectId,
+    connectorSyncEventId: null,
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    createdVia: "import",
+    id: createDenTypeId("configObjectVersion"),
+    isDeletedVersion: false,
+    normalizedPayloadJson: input.object.normalizedPayloadJson ?? null,
+    organizationId: input.organizationId,
+    rawSourceText,
+    schemaVersion: "claude-plugin/demo-seed-v1",
+    sourceRevisionRef: SOURCE_REVISION_REF,
+  })
+
+  await ensureConfigObjectAccessGrant({
+    configObjectId,
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    organizationId: input.organizationId,
+  })
+  await ensurePluginConfigObject({
+    configObjectId,
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    organizationId: input.organizationId,
+    pluginId: input.pluginId,
+  })
+}
+
+async function ensureConfigObjectAccessGrant(input: {
+  configObjectId: ConfigObjectId
+  createdByOrgMembershipId: MemberId
+  organizationId: OrganizationId
+}) {
+  const existing = await db
+    .select()
+    .from(ConfigObjectAccessGrantTable)
+    .where(and(eq(ConfigObjectAccessGrantTable.configObjectId, input.configObjectId), eq(ConfigObjectAccessGrantTable.orgWide, true)))
+    .limit(1)
+  if (existing[0]) {
+    await db
+      .update(ConfigObjectAccessGrantTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, orgWide: true, removedAt: null, role: "viewer" })
+      .where(eq(ConfigObjectAccessGrantTable.id, existing[0].id))
+    return existing[0].id
+  }
+  const id = createDenTypeId("configObjectAccessGrant")
+  await db.insert(ConfigObjectAccessGrantTable).values({
+    configObjectId: input.configObjectId,
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    id,
+    organizationId: input.organizationId,
+    orgMembershipId: null,
+    orgWide: true,
+    role: "viewer",
+    teamId: null,
+  })
+  return id
+}
+
+async function ensurePluginConfigObject(input: {
+  configObjectId: ConfigObjectId
+  createdByOrgMembershipId: MemberId
+  organizationId: OrganizationId
+  pluginId: PluginId
+}) {
+  const existing = await db
+    .select()
+    .from(PluginConfigObjectTable)
+    .where(and(eq(PluginConfigObjectTable.pluginId, input.pluginId), eq(PluginConfigObjectTable.configObjectId, input.configObjectId)))
+    .limit(1)
+  if (existing[0]) {
+    await db
+      .update(PluginConfigObjectTable)
+      .set({ createdByOrgMembershipId: input.createdByOrgMembershipId, membershipSource: "system", removedAt: null })
+      .where(eq(PluginConfigObjectTable.id, existing[0].id))
+    return existing[0].id
+  }
+  const id = createDenTypeId("pluginConfigObject")
+  await db.insert(PluginConfigObjectTable).values({
+    configObjectId: input.configObjectId,
+    connectorMappingId: null,
+    createdByOrgMembershipId: input.createdByOrgMembershipId,
+    id,
+    membershipSource: "system",
+    organizationId: input.organizationId,
+    pluginId: input.pluginId,
+    removedAt: null,
+  })
+  return id
+}
+
+function parseJsonObject(value: string): Record<string, unknown> | undefined {
+  try {
+    const parsed = JSON.parse(value) as unknown
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed as Record<string, unknown> : undefined
+  } catch {
+    return undefined
+  }
+}
+
+async function fetchContents(path: string) {
+  const encoded = path.split("/").map((part) => encodeURIComponent(part)).join("/")
+  const response = await fetchJson<GithubContentEntry[] | GithubContentEntry>(`${GITHUB_API_BASE}/${encoded}?ref=${encodeURIComponent(GITHUB_REF)}`)
+  return Array.isArray(response) ? response : []
+}
+
+async function fetchPluginContent(plugin: DemoPlugin): Promise<PluginContentObject[]> {
+  const objects: PluginContentObject[] = []
+  const manifestPath = `${plugin.slug}/.claude-plugin/plugin.json`
+  const manifestRaw = await fetchText(`${GITHUB_RAW_BASE}/${manifestPath}`)
+  objects.push({
+    description: "Claude-compatible plugin manifest imported for the local Den demo.",
+    normalizedPayloadJson: manifestRaw ? parseJsonObject(manifestRaw) : { name: plugin.slug, description: plugin.description },
+    objectType: "context",
+    path: manifestPath,
+    rawSourceText: manifestRaw ?? JSON.stringify({ name: plugin.slug, description: plugin.description, source: `${GITHUB_REPO}/${plugin.slug}` }, null, 2),
+    title: `${plugin.slug} manifest`,
+  })
+
+  const mcpPath = `${plugin.slug}/.mcp.json`
+  const mcpRaw = await fetchText(`${GITHUB_RAW_BASE}/${mcpPath}`)
+  if (mcpRaw) {
+    objects.push({
+      description: "MCP connector manifest stored as plugin configuration only; demo seed does not create active connector accounts.",
+      normalizedPayloadJson: parseJsonObject(mcpRaw),
+      objectType: "mcp",
+      path: mcpPath,
+      rawSourceText: mcpRaw,
+      title: `${plugin.slug} MCP manifest`,
+    })
+  } else {
+    objects.push({
+      description: "Demo MCP placeholder showing where connector configuration would live without connecting any integration.",
+      normalizedPayloadJson: { mcpServers: {}, demoOnly: true, source: `${GITHUB_REPO}/${plugin.slug}` },
+      objectType: "mcp",
+      path: `${plugin.slug}/.mcp.demo.json`,
+      rawSourceText: JSON.stringify({ mcpServers: {}, demoOnly: true, source: `${GITHUB_REPO}/${plugin.slug}` }, null, 2),
+      title: `${plugin.slug} MCP manifest`,
+    })
+  }
+
+  const skillEntries = (await fetchContents(`${plugin.slug}/skills`))
+    .filter((entry) => entry.type === "dir" || entry.name.toLowerCase() === "skill.md")
+    .slice(0, 3)
+
+  for (const entry of skillEntries) {
+    const skillPath = entry.type === "dir" ? `${entry.path}/SKILL.md` : entry.path
+    const raw = await fetchText(`${GITHUB_RAW_BASE}/${skillPath}`)
+    if (!raw) continue
+    objects.push({
+      description: `Real skill source from ${GITHUB_REPO}/${skillPath}.`,
+      objectType: "skill",
+      path: skillPath,
+      rawSourceText: raw,
+      title: titleFromPath(entry.type === "dir" ? entry.path : skillPath),
+    })
+  }
+
+  const commandEntries = (await fetchContents(`${plugin.slug}/commands`))
+    .filter((entry) => entry.type === "file" && /\.(md|mdx)$/i.test(entry.name))
+    .slice(0, 2)
+
+  for (const entry of commandEntries) {
+    const raw = await fetchText(`${GITHUB_RAW_BASE}/${entry.path}`)
+    if (!raw) continue
+    objects.push({
+      description: `Real command source from ${GITHUB_REPO}/${entry.path}.`,
+      objectType: "command",
+      path: entry.path,
+      rawSourceText: raw,
+      title: titleFromPath(entry.path),
+    })
+  }
+
+  if (!objects.some((object) => object.objectType === "skill")) {
+    objects.push({
+      description: "Demo fallback skill generated from the real marketplace description.",
+      objectType: "skill",
+      path: `${plugin.slug}/skills/demo-overview/SKILL.md`,
+      rawSourceText: `# ${plugin.slug} overview\n\n${plugin.description}\n\nSource: https://github.com/${GITHUB_REPO}/tree/${GITHUB_REF}/${plugin.slug}\n\nThis fallback is used when GitHub source fetching is unavailable during local seeding.`,
+      title: `${plugin.slug} overview`,
+    })
+  }
+
+  return objects
+}
+
+function log(icon: string, message: string) {
+  console.log(`  ${icon} ${message}`)
+}
+
+async function resetDemoOrg() {
+  const existing = await db.select().from(OrganizationTable).where(eq(OrganizationTable.slug, DEMO_ORG_SLUG)).limit(1)
+  if (!existing[0]) {
+    log("⊘", "no existing demo org to reset")
+    return
+  }
+  const orgId = existing[0].id
+  log("↻", `resetting demo org ${orgId}…`)
+
+  const pluginIds = (await db.select({ id: PluginTable.id }).from(PluginTable).where(eq(PluginTable.organizationId, orgId))).map((r) => r.id)
+  const marketplaceIds = (await db.select({ id: MarketplaceTable.id }).from(MarketplaceTable).where(eq(MarketplaceTable.organizationId, orgId))).map((r) => r.id)
+  const configObjectIds = (await db.select({ id: ConfigObjectTable.id }).from(ConfigObjectTable).where(eq(ConfigObjectTable.organizationId, orgId))).map((r) => r.id)
+
+  if (configObjectIds.length > 0) {
+    await db.delete(ConfigObjectVersionTable).where(inArray(ConfigObjectVersionTable.configObjectId, configObjectIds))
+    await db.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.configObjectId, configObjectIds))
+    await db.delete(ConfigObjectAccessGrantTable).where(inArray(ConfigObjectAccessGrantTable.configObjectId, configObjectIds))
+    await db.delete(ConfigObjectTable).where(inArray(ConfigObjectTable.id, configObjectIds))
+  }
+  if (pluginIds.length > 0) {
+    await db.delete(MarketplacePluginTable).where(inArray(MarketplacePluginTable.pluginId, pluginIds))
+    await db.delete(PluginAccessGrantTable).where(inArray(PluginAccessGrantTable.pluginId, pluginIds))
+    await db.delete(PluginTable).where(inArray(PluginTable.id, pluginIds))
+  }
+  if (marketplaceIds.length > 0) {
+    await db.delete(MarketplaceAccessGrantTable).where(inArray(MarketplaceAccessGrantTable.marketplaceId, marketplaceIds))
+    await db.delete(MarketplaceTable).where(inArray(MarketplaceTable.id, marketplaceIds))
+  }
+  await db.delete(InvitationTable).where(eq(InvitationTable.organizationId, orgId))
+  await db.delete(TeamMemberTable).where(inArray(TeamMemberTable.teamId, (await db.select({ id: TeamTable.id }).from(TeamTable).where(eq(TeamTable.organizationId, orgId))).map((r) => r.id)))
+  await db.delete(TeamTable).where(eq(TeamTable.organizationId, orgId))
+  await db.delete(MemberTable).where(eq(MemberTable.organizationId, orgId))
+  await db.delete(OrganizationTable).where(eq(OrganizationTable.id, orgId))
+  log("✓", "demo org data deleted")
+}
+
+async function seedPeopleAndTeams(organizationId: OrganizationId) {
+  const userIdsByEmail = new Map<string, UserId>()
+  const memberIdsByEmail = new Map<string, MemberId>()
+  const teamIdsByName = new Map<string, TeamId>()
+
+  for (const person of demoPeople) {
+    const userId = await ensureDisplayUser(person)
+    userIdsByEmail.set(person.email.toLowerCase(), userId)
+    const memberId = await ensureMember(organizationId, userId, person.role)
+    memberIdsByEmail.set(person.email.toLowerCase(), memberId)
+  }
+
+  for (const teamName of [...new Set(demoPeople.flatMap((person) => person.teams).concat(pendingInvites.map((invite) => invite.team)))]) {
+    teamIdsByName.set(teamName, await ensureTeam(organizationId, teamName))
+  }
+
+  for (const person of demoPeople) {
+    const memberId = memberIdsByEmail.get(person.email.toLowerCase())
+    if (!memberId) continue
+    for (const teamName of person.teams) {
+      const teamId = teamIdsByName.get(teamName)
+      if (teamId) await ensureTeamMember(teamId, memberId)
+    }
+  }
+
+  const ownerUserId = userIdsByEmail.get(DEMO_OWNER_EMAIL.toLowerCase())
+  if (!ownerUserId) throw new Error("Demo owner user missing after seed.")
+  for (const invite of pendingInvites) {
+    await ensureInvitation({
+      email: invite.email,
+      inviterId: ownerUserId,
+      organizationId,
+      role: invite.role,
+      teamId: teamIdsByName.get(invite.team) ?? null,
+    })
+  }
+
+  return { memberIdsByEmail, teamIdsByName, userIdsByEmail }
+}
+
+async function seedPlugins(input: {
+  createdByOrgMembershipId: MemberId
+  marketplaceId: MarketplaceId
+  organizationId: OrganizationId
+  teamIdsByName: Map<string, TeamId>
+}) {
+  let seededPlugins = 0
+  let seededObjects = 0
+  for (const plugin of demoPlugins) {
+    const pluginId = await ensurePlugin({ ...input, plugin })
+    if (plugin.orgWide) {
+      await ensurePluginAccessGrant({ ...input, orgWide: true, pluginId, role: "viewer" })
+    }
+    for (const teamName of plugin.teamAccess) {
+      const teamId = input.teamIdsByName.get(teamName)
+      if (teamId) {
+        await ensurePluginAccessGrant({ ...input, pluginId, role: "editor", teamId })
+      }
+    }
+
+    const contentObjects = await fetchPluginContent(plugin)
+    for (const object of contentObjects) {
+      await ensureConfigObject({
+        createdByOrgMembershipId: input.createdByOrgMembershipId,
+        object,
+        organizationId: input.organizationId,
+        pluginId,
+      })
+      seededObjects++
+    }
+    seededPlugins++
+    log("✓", `plugin ${seededPlugins}/${demoPlugins.length}: ${plugin.slug} (${contentObjects.length} objects)`)
+  }
+  return { seededObjects, seededPlugins }
+}
+
+async function main() {
+  assertSafeDevTarget()
+  const startMs = Date.now()
+
+  console.log()
+  console.log(`  den demo seed · ${DEMO_ORG_NAME}`)
+  console.log(`  ${"─".repeat(40)}`)
+  log("◈", `org slug: ${DEMO_ORG_SLUG}`)
+  log("◈", `database: ${env.databaseUrl?.replace(/:[^@]*@/, ":***@") ?? "unknown"}`)
+  log("◈", `github fetch: ${SHOULD_FETCH_GITHUB ? "enabled" : "disabled"}`)
+  if (RESET_MODE) log("◈", "reset mode: will delete existing demo org first")
+  console.log()
+
+  if (RESET_MODE) {
+    await resetDemoOrg()
+    console.log()
+  }
+
+  log("…", "creating owner account")
+  const ownerUserId = await ensureSignedInOwnerUser()
+  log("✓", `owner: ${DEMO_OWNER_EMAIL}`)
+
+  log("…", "creating organization")
+  const organizationId = await ensureOrganization(ownerUserId)
+  log("✓", `org: ${organizationId}`)
+  console.log()
+
+  log("…", `seeding ${demoPeople.length} users and teams`)
+  const { memberIdsByEmail, teamIdsByName } = await seedPeopleAndTeams(organizationId)
+  log("✓", `${memberIdsByEmail.size} members · ${teamIdsByName.size} teams · ${pendingInvites.length} pending invites`)
+  console.log()
+
+  const ownerMembershipId = memberIdsByEmail.get(DEMO_OWNER_EMAIL.toLowerCase())
+  if (!ownerMembershipId) throw new Error("Demo owner membership missing after seed.")
+
+  log("…", "creating marketplace")
+  const marketplaceId = await ensureMarketplace({ createdByOrgMembershipId: ownerMembershipId, organizationId })
+  log("✓", `marketplace: ${marketplaceId}`)
+  console.log()
+
+  log("…", `seeding ${demoPlugins.length} plugins`)
+  const { seededObjects, seededPlugins } = await seedPlugins({ createdByOrgMembershipId: ownerMembershipId, marketplaceId, organizationId, teamIdsByName })
+  console.log()
+
+  const elapsedSeconds = ((Date.now() - startMs) / 1000).toFixed(1)
+  console.log(`  ${"─".repeat(40)}`)
+  log("✓", `done in ${elapsedSeconds}s`)
+  log(" ", `${memberIdsByEmail.size} members · ${teamIdsByName.size} teams · ${seededPlugins} plugins · ${seededObjects} config objects`)
+  console.log()
+  log("→", `login: ${DEMO_OWNER_EMAIL} / ${DEMO_OWNER_PASSWORD}`)
+  log("→", `open: /organization or /o/${DEMO_ORG_SLUG}/dashboard`)
+  console.log()
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exit(1)
+  })
diff --git a/ee/apps/den-api/scripts/smoke-email-failures.mjs b/ee/apps/den-api/scripts/smoke-email-failures.mjs
new file mode 100644
index 0000000000..7d845606c4
--- /dev/null
+++ b/ee/apps/den-api/scripts/smoke-email-failures.mjs
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+/**
+ * Standalone smoke test for the invitation-email failure paths.
+ *
+ * Run inside the den-api container (or any environment where the package has
+ * been built to `dist/`):
+ *
+ *   docker exec -e OPENWORK_DEV_MODE=0 \
+ *     openwork-den-dev-<id>-den-1 \
+ *     node ee/apps/den-api/scripts/smoke-email-failures.mjs
+ *
+ * Expected output:
+ *   [smoke] ok loops_not_configured { reason: 'loops_not_configured', ... }
+ *
+ * Add `-e LOOPS_API_KEY=bogus -e LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL=bogus`
+ * to also reach the `loops_rejected` path (Loops returns 401).
+ *
+ * Intentionally side-effect free: no DB writes, no auth.
+ */
+
+const { sendDenOrganizationInvitationEmail, DenEmailSendError } = await import(
+  "../dist/email.js"
+)
+
+const recipient = process.argv[2] ?? "smoke-test@example.com"
+
+try {
+  await sendDenOrganizationInvitationEmail({
+    email: recipient,
+    inviteLink: "https://example.com/join?invite=smoke",
+    invitedByName: "Smoke Test",
+    invitedByEmail: "smoke@example.com",
+    organizationName: "Smoke Org",
+    role: "member",
+  })
+
+  if (process.env.OPENWORK_DEV_MODE === "1" || !process.env.OPENWORK_DEV_MODE) {
+    console.log("[smoke] ok dev_mode_noop (no email sent, no throw — expected)")
+    process.exit(0)
+  }
+
+  console.error("[smoke] FAIL: expected throw when Loops is not configured or rejects")
+  process.exit(1)
+} catch (error) {
+  if (!(error instanceof DenEmailSendError)) {
+    console.error("[smoke] FAIL: wrong error class:", error)
+    process.exit(1)
+  }
+
+  console.log(`[smoke] ok ${error.reason}`, {
+    reason: error.reason,
+    template: error.template,
+    recipient: error.recipient,
+    detail: error.detail,
+  })
+}
diff --git a/ee/apps/den-api/src/CONSTS.ts b/ee/apps/den-api/src/CONSTS.ts
new file mode 100644
index 0000000000..63beb864ae
--- /dev/null
+++ b/ee/apps/den-api/src/CONSTS.ts
@@ -0,0 +1 @@
+export const DEN_WORKER_POLL_INTERVAL_MS = 1000
diff --git a/ee/apps/den-api/src/active-organization.ts b/ee/apps/den-api/src/active-organization.ts
new file mode 100644
index 0000000000..9221df4574
--- /dev/null
+++ b/ee/apps/den-api/src/active-organization.ts
@@ -0,0 +1,19 @@
+import { asc, eq } from "@openwork-ee/den-db/drizzle"
+import { MemberTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import { db } from "./db.js"
+
+export async function getInitialActiveOrganizationIdForUser(userId: string) {
+  const normalizedUserId = normalizeDenTypeId("user", userId)
+
+  const rows = await db
+    .select({
+      organizationId: MemberTable.organizationId,
+    })
+    .from(MemberTable)
+    .where(eq(MemberTable.userId, normalizedUserId))
+    .orderBy(asc(MemberTable.createdAt))
+    .limit(1)
+
+  return rows[0]?.organizationId ?? null
+}
diff --git a/ee/apps/den-api/src/admin-allowlist.ts b/ee/apps/den-api/src/admin-allowlist.ts
new file mode 100644
index 0000000000..a5e593891a
--- /dev/null
+++ b/ee/apps/den-api/src/admin-allowlist.ts
@@ -0,0 +1,53 @@
+import { sql } from "@openwork-ee/den-db/drizzle"
+import { AdminAllowlistTable } from "@openwork-ee/den-db/schema"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import { db } from "./db.js"
+
+const ADMIN_ALLOWLIST_SEEDS = [
+  {
+    email: "ben@openworklabs.com",
+    note: "Seeded internal admin",
+  },
+  {
+    email: "jan@openworklabs.com",
+    note: "Seeded internal admin",
+  },
+  {
+    email: "omar@openworklabs.com",
+    note: "Seeded internal admin",
+  },
+  {
+    email: "berk@openworklabs.com",
+    note: "Seeded internal admin",
+  },
+] as const
+
+let ensureAdminAllowlistSeededPromise: Promise<void> | null = null
+
+async function seedAdminAllowlist() {
+  for (const entry of ADMIN_ALLOWLIST_SEEDS) {
+    await db
+      .insert(AdminAllowlistTable)
+      .values({
+        id: createDenTypeId("adminAllowlist"),
+        ...entry,
+      })
+      .onDuplicateKeyUpdate({
+        set: {
+          note: entry.note,
+          updated_at: sql`CURRENT_TIMESTAMP(3)`,
+        },
+      })
+  }
+}
+
+export async function ensureAdminAllowlistSeeded() {
+  if (!ensureAdminAllowlistSeededPromise) {
+    ensureAdminAllowlistSeededPromise = seedAdminAllowlist().catch((error) => {
+      ensureAdminAllowlistSeededPromise = null
+      throw error
+    })
+  }
+
+  await ensureAdminAllowlistSeededPromise
+}
diff --git a/ee/apps/den-api/src/api-keys.ts b/ee/apps/den-api/src/api-keys.ts
new file mode 100644
index 0000000000..037c9cf0cb
--- /dev/null
+++ b/ee/apps/den-api/src/api-keys.ts
@@ -0,0 +1,222 @@
+import { and, asc, desc, eq, inArray } from "@openwork-ee/den-db/drizzle"
+import { AuthApiKeyTable, AuthUserTable, MemberTable } from "@openwork-ee/den-db/schema"
+import type { DenTypeId } from "@openwork-ee/utils/typeid"
+import { db } from "./db.js"
+
+export const DEN_API_KEY_HEADER = "x-api-key"
+export const DEN_API_KEY_DEFAULT_PREFIX = "den_"
+export const DEN_API_KEY_RATE_LIMIT_MAX = 600
+export const DEN_API_KEY_RATE_LIMIT_TIME_WINDOW_MS = 60_000
+
+type UserId = typeof AuthUserTable.$inferSelect.id
+type OrganizationId = typeof MemberTable.$inferSelect.organizationId
+type OrganizationMemberId = typeof MemberTable.$inferSelect.id
+type ApiKeyId = typeof AuthApiKeyTable.$inferSelect.id
+
+export type DenApiKeyMetadata = {
+  organizationId: OrganizationId
+  orgMembershipId: OrganizationMemberId
+  issuedByUserId: UserId
+  issuedByOrgMembershipId: OrganizationMemberId
+}
+
+export type DenApiKeySession = {
+  id: ApiKeyId
+  configId: string
+  referenceId: string
+  metadata: DenApiKeyMetadata | null
+}
+
+export type OrganizationApiKeySummary = {
+  id: ApiKeyId
+  configId: string
+  name: string | null
+  start: string | null
+  prefix: string | null
+  enabled: boolean
+  rateLimitEnabled: boolean
+  rateLimitMax: number | null
+  rateLimitTimeWindow: number | null
+  lastRequest: Date | null
+  expiresAt: Date | null
+  createdAt: Date
+  updatedAt: Date
+  owner: {
+    userId: UserId
+    memberId: OrganizationMemberId
+    name: string
+    email: string
+    image: string | null
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function parseApiKeyMetadata(value: unknown): DenApiKeyMetadata | null {
+  const parsed = typeof value === "string"
+    ? (() => {
+        try {
+          return JSON.parse(value) as unknown
+        } catch {
+          return null
+        }
+      })()
+    : value
+
+  if (!isRecord(parsed)) {
+    return null
+  }
+
+  const organizationId = typeof parsed.organizationId === "string" ? parsed.organizationId : null
+  const orgMembershipId = typeof parsed.orgMembershipId === "string" ? parsed.orgMembershipId : null
+  const issuedByUserId = typeof parsed.issuedByUserId === "string" ? parsed.issuedByUserId : null
+  const issuedByOrgMembershipId = typeof parsed.issuedByOrgMembershipId === "string" ? parsed.issuedByOrgMembershipId : null
+
+  if (!organizationId || !orgMembershipId || !issuedByUserId || !issuedByOrgMembershipId) {
+    return null
+  }
+
+  return {
+    organizationId: organizationId as OrganizationId,
+    orgMembershipId: orgMembershipId as OrganizationMemberId,
+    issuedByUserId: issuedByUserId as UserId,
+    issuedByOrgMembershipId: issuedByOrgMembershipId as OrganizationMemberId,
+  }
+}
+
+export function buildOrganizationApiKeyMetadata(input: {
+  organizationId: OrganizationId
+  orgMembershipId: OrganizationMemberId
+  issuedByUserId: UserId
+  issuedByOrgMembershipId: OrganizationMemberId
+}): DenApiKeyMetadata {
+  return {
+    organizationId: input.organizationId,
+    orgMembershipId: input.orgMembershipId,
+    issuedByUserId: input.issuedByUserId,
+    issuedByOrgMembershipId: input.issuedByOrgMembershipId,
+  }
+}
+
+export async function getApiKeySessionById(apiKeyId: string): Promise<DenApiKeySession | null> {
+  const rows = await db
+    .select({
+      id: AuthApiKeyTable.id,
+      configId: AuthApiKeyTable.configId,
+      referenceId: AuthApiKeyTable.referenceId,
+      metadata: AuthApiKeyTable.metadata,
+    })
+    .from(AuthApiKeyTable)
+    .where(eq(AuthApiKeyTable.id, apiKeyId))
+    .limit(1)
+
+  const row = rows[0]
+  if (!row) {
+    return null
+  }
+
+  return {
+    id: row.id,
+    configId: row.configId,
+    referenceId: row.referenceId,
+    metadata: parseApiKeyMetadata(row.metadata),
+  }
+}
+
+export async function listOrganizationApiKeys(organizationId: OrganizationId): Promise<OrganizationApiKeySummary[]> {
+  const members = await db
+    .select({
+      memberId: MemberTable.id,
+      userId: MemberTable.userId,
+      userName: AuthUserTable.name,
+      userEmail: AuthUserTable.email,
+      userImage: AuthUserTable.image,
+    })
+    .from(MemberTable)
+    .innerJoin(AuthUserTable, eq(MemberTable.userId, AuthUserTable.id))
+    .where(eq(MemberTable.organizationId, organizationId))
+    .orderBy(asc(MemberTable.createdAt))
+
+  if (members.length === 0) {
+    return []
+  }
+
+  const memberByUserId = new Map(members.map((member) => [member.userId, member]))
+
+  const apiKeys = await db
+    .select()
+    .from(AuthApiKeyTable)
+    .where(inArray(AuthApiKeyTable.referenceId, members.map((member) => member.userId)))
+    .orderBy(desc(AuthApiKeyTable.createdAt))
+
+  return apiKeys
+    .map((apiKey) => {
+      const owner = memberByUserId.get(apiKey.referenceId as UserId)
+      const metadata = parseApiKeyMetadata(apiKey.metadata)
+
+      if (!owner || !metadata || metadata.organizationId !== organizationId || metadata.orgMembershipId !== owner.memberId) {
+        return null
+      }
+
+      return {
+        id: apiKey.id,
+        configId: apiKey.configId,
+        name: apiKey.name,
+        start: apiKey.start,
+        prefix: apiKey.prefix,
+        enabled: apiKey.enabled,
+        rateLimitEnabled: apiKey.rateLimitEnabled,
+        rateLimitMax: apiKey.rateLimitMax,
+        rateLimitTimeWindow: apiKey.rateLimitTimeWindow,
+        lastRequest: apiKey.lastRequest,
+        expiresAt: apiKey.expiresAt,
+        createdAt: apiKey.createdAt,
+        updatedAt: apiKey.updatedAt,
+        owner: {
+          userId: owner.userId,
+          memberId: owner.memberId,
+          name: owner.userName,
+          email: owner.userEmail,
+          image: owner.userImage,
+        },
+      } satisfies OrganizationApiKeySummary
+    })
+    .filter((apiKey): apiKey is OrganizationApiKeySummary => apiKey !== null)
+}
+
+export async function getOrganizationApiKeyById(input: {
+  organizationId: OrganizationId
+  apiKeyId: ApiKeyId
+}) {
+  const keys = await listOrganizationApiKeys(input.organizationId)
+  return keys.find((apiKey) => apiKey.id === input.apiKeyId) ?? null
+}
+
+export async function deleteOrganizationApiKey(input: {
+  organizationId: OrganizationId
+  apiKeyId: ApiKeyId
+}) {
+  const apiKey = await getOrganizationApiKeyById(input)
+  if (!apiKey) {
+    return null
+  }
+
+  await db
+    .delete(AuthApiKeyTable)
+    .where(and(eq(AuthApiKeyTable.id, input.apiKeyId), eq(AuthApiKeyTable.referenceId, apiKey.owner.userId)))
+
+  return apiKey
+}
+
+export function isScopedApiKeyForOrganization(input: {
+  apiKey: DenApiKeySession | null
+  organizationId: string
+}) {
+  return input.apiKey?.metadata?.organizationId === input.organizationId
+}
+
+export function getApiKeyScopedOrganizationId(apiKey: DenApiKeySession | null): DenTypeId<"organization"> | null {
+  return apiKey?.metadata?.organizationId ?? null
+}
diff --git a/ee/apps/den-api/src/app.ts b/ee/apps/den-api/src/app.ts
new file mode 100644
index 0000000000..cb13ac0ff2
--- /dev/null
+++ b/ee/apps/den-api/src/app.ts
@@ -0,0 +1,215 @@
+import "./load-env.js"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import { swaggerUI } from "@hono/swagger-ui"
+import { cors } from "hono/cors"
+import { Hono } from "hono"
+import { logger } from "hono/logger"
+import type { RequestIdVariables } from "hono/request-id"
+import { requestId } from "hono/request-id"
+import { describeRoute, openAPIRouteHandler, resolver } from "hono-openapi"
+import { z } from "zod"
+import { env } from "./env.js"
+import type { MemberTeamsContext, OrganizationContextVariables, UserOrganizationsContext } from "./middleware/index.js"
+import { buildOperationId, emptyResponse, htmlResponse, jsonResponse } from "./openapi.js"
+import { registerAdminRoutes } from "./routes/admin/index.js"
+import { registerAuthRoutes } from "./routes/auth/index.js"
+import { registerMeRoutes } from "./routes/me/index.js"
+import { registerOrgRoutes } from "./routes/org/index.js"
+import { registerVersionRoutes } from "./routes/version/index.js"
+import { registerWebhookRoutes } from "./routes/webhooks/index.js"
+import { registerWorkerRoutes } from "./routes/workers/index.js"
+import { registerMcpRoutes } from "./mcp/index.js"
+import type { AuthContextVariables } from "./session.js"
+import { sessionMiddleware } from "./session.js"
+
+type AppVariables = RequestIdVariables & AuthContextVariables & Partial<UserOrganizationsContext> & Partial<OrganizationContextVariables> & Partial<MemberTeamsContext>
+
+const healthResponseSchema = z.object({
+  ok: z.literal(true),
+  service: z.literal("den-api"),
+}).meta({ ref: "DenApiHealthResponse" })
+
+const openApiDocumentSchema = z.object({
+  openapi: z.string(),
+  info: z.object({
+    title: z.string(),
+    version: z.string(),
+  }).passthrough(),
+  paths: z.record(z.string(), z.unknown()),
+  components: z.object({}).passthrough().optional(),
+}).passthrough().meta({ ref: "OpenApiDocument" })
+
+const app = new Hono<{ Variables: AppVariables }>()
+
+app.use("*", logger())
+app.use("*", requestId({
+  headerName: "",
+  generator: () => createDenTypeId("request"),
+}))
+app.use("*", async (c, next) => {
+  await next()
+  c.header("X-Request-Id", c.get("requestId"))
+})
+
+if (env.corsOrigins.length > 0) {
+  app.use(
+    "*",
+      cors({
+        origin: env.corsOrigins,
+        credentials: true,
+        allowHeaders: ["Content-Type", "Authorization", "X-Api-Key", "X-Request-Id"],
+        allowMethods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+        exposeHeaders: ["Content-Length", "X-Request-Id"],
+        maxAge: 600,
+    }),
+  )
+}
+
+app.use("*", sessionMiddleware)
+
+app.get(
+  "/",
+  describeRoute({
+    tags: ["System"],
+    hide: true,
+    summary: "Redirect API root",
+    description: "Redirects the API root to the OpenWork marketing site instead of serving API content.",
+    responses: {
+      302: emptyResponse("Redirect to the OpenWork marketing site."),
+    },
+  }),
+  (c) => {
+    return c.redirect("https://openworklabs.com", 302)
+  },
+)
+
+app.get(
+  "/health",
+  describeRoute({
+    tags: ["System"],
+    summary: "Check den-api health",
+    description: "Returns a lightweight health payload for den-api.",
+    responses: {
+      200: {
+        description: "den-api is reachable",
+        content: {
+          "application/json": {
+            schema: resolver(healthResponseSchema),
+          },
+        },
+      },
+    },
+  }),
+  (c) => {
+    return c.json({ ok: true, service: "den-api" })
+  },
+)
+
+registerAdminRoutes(app)
+registerAuthRoutes(app)
+registerMeRoutes(app)
+registerOrgRoutes(app)
+registerVersionRoutes(app)
+registerWebhookRoutes(app)
+registerWorkerRoutes(app)
+registerMcpRoutes(app)
+
+app.get(
+  "/openapi.json",
+  describeRoute({
+    tags: ["System"],
+    summary: "Get OpenAPI document",
+    description: "Returns the machine-readable OpenAPI 3.1 document for the Den API so humans and tools can inspect the API surface.",
+    responses: {
+      200: jsonResponse("OpenAPI document returned successfully.", openApiDocumentSchema),
+    },
+  }),
+  openAPIRouteHandler(app, {
+    documentation: {
+      openapi: "3.1.0",
+      info: {
+        title: "Den API",
+        version: "dev",
+        description: [
+          "OpenAPI spec for the Den control plane API.",
+          "",
+          "Authentication:",
+          "- Use `Authorization: Bearer <session-token>` for user-authenticated routes that require a Den session.",
+          "- Use `x-api-key: <den-api-key>` for API-key-authenticated routes that accept organization API keys.",
+          "- Public routes like health and documentation do not require authentication.",
+          "",
+          "Swagger tip: use the security schemes in the Authorize dialog to set either `bearerAuth` or `denApiKey` before trying protected endpoints.",
+        ].join("\n"),
+      },
+      servers: [
+        { url: "https://api.openworklabs.com" },
+      ],
+      tags: [
+        { name: "System", description: "Service health and operational routes." },
+        { name: "Organizations", description: "Top-level organization creation and context routes." },
+        { name: "Invitations", description: "Invitation preview, acceptance, creation, and cancellation routes." },
+        { name: "API Keys", description: "Organization API key management routes." },
+        { name: "Members", description: "Organization member management routes." },
+        { name: "Roles", description: "Organization custom role management routes." },
+        { name: "Teams", description: "Organization team management routes." },
+        { name: "Templates", description: "Organization shared template routes." },
+        { name: "LLM Providers", description: "Organization LLM provider catalog, configuration, and access routes." },
+        { name: "Skills", description: "Organization skill authoring and sharing routes." },
+        { name: "Skill Hubs", description: "Organization skill hub management and access routes." },
+        { name: "Workers", description: "Worker lifecycle, billing, and runtime routes." },
+        { name: "Worker Runtime", description: "Worker runtime inspection and upgrade routes." },
+        { name: "Worker Activity", description: "Worker heartbeat and activity reporting routes." },
+        { name: "Admin", description: "Administrative reporting routes." },
+        { name: "Users", description: "Current user and membership routes." },
+      ],
+      components: {
+        securitySchemes: {
+          bearerAuth: {
+            type: "http",
+            scheme: "bearer",
+            bearerFormat: "session-token",
+            description: "Session token passed as `Authorization: Bearer <session-token>` for user-authenticated Den routes.",
+          },
+          denApiKey: {
+            type: "apiKey",
+            in: "header",
+            name: "x-api-key",
+            description: "Organization API key passed as the `x-api-key` header for API-key-authenticated Den routes.",
+          },
+        },
+      },
+    },
+    includeEmptyPaths: true,
+    exclude: ["/docs", "/openapi.json"],
+    excludeMethods: ["OPTIONS"],
+    defaultOptions: {
+      ALL: {
+        operationId: (route) => buildOperationId(route.method, route.path),
+      },
+    },
+  }),
+)
+
+app.get(
+  "/docs",
+  describeRoute({
+    tags: ["System"],
+    summary: "Serve Swagger UI",
+    description: "Serves Swagger UI so developers can browse and try the Den API from a browser.",
+    responses: {
+      200: htmlResponse("Swagger UI page returned successfully."),
+    },
+  }),
+  swaggerUI({
+    url: "/openapi.json",
+    persistAuthorization: true,
+    displayOperationId: true,
+    defaultModelsExpandDepth: 1,
+  }),
+)
+
+app.notFound((c) => {
+  return c.json({ error: "not_found" }, 404)
+})
+
+export default app
diff --git a/ee/apps/den-api/src/auth.ts b/ee/apps/den-api/src/auth.ts
new file mode 100644
index 0000000000..923818950f
--- /dev/null
+++ b/ee/apps/den-api/src/auth.ts
@@ -0,0 +1,365 @@
+import { getInitialActiveOrganizationIdForUser } from "./active-organization.js";
+import { db } from "./db.js";
+import { env } from "./env.js";
+import {
+  sendDenOrganizationInvitationEmail,
+  sendDenVerificationEmail,
+} from "./email.js";
+import { syncDenSignupContact } from "./loops.js";
+import {
+  DEN_API_KEY_DEFAULT_PREFIX,
+  DEN_API_KEY_RATE_LIMIT_MAX,
+  DEN_API_KEY_RATE_LIMIT_TIME_WINDOW_MS,
+} from "./api-keys.js";
+import {
+  denOrganizationAccess,
+  denOrganizationStaticRoles,
+} from "./organization-access.js";
+import { seedDefaultOrganizationRoles } from "./orgs.js";
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid";
+import * as schema from "@openwork-ee/den-db/schema";
+import { apiKey } from "@better-auth/api-key";
+import { oauthProvider } from "@better-auth/oauth-provider";
+import { APIError } from "better-call";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { emailOTP, jwt, organization } from "better-auth/plugins";
+
+function localMcpResourceAliases(resource: string) {
+  if (!env.devMode) {
+    return [];
+  }
+
+  try {
+    const url = new URL(resource);
+    if (url.hostname === "127.0.0.1") {
+      url.hostname = "localhost";
+      return [url.toString().replace(/\/+$/, "")];
+    }
+    if (url.hostname === "localhost") {
+      url.hostname = "127.0.0.1";
+      return [url.toString().replace(/\/+$/, "")];
+    }
+  } catch {}
+
+  return [];
+}
+
+export const DEN_MCP_RESOURCE = env.mcpResourceUrl ?? `${env.betterAuthUrl}/mcp`;
+export const DEN_MCP_RESOURCES = Array.from(new Set([
+  DEN_MCP_RESOURCE,
+  ...localMcpResourceAliases(DEN_MCP_RESOURCE),
+]));
+export const DEN_MCP_SCOPES = ["openid", "profile", "email", "offline_access", "mcp:read", "mcp:write"];
+export const DEN_MCP_TOKEN_USE_CLAIM = "https://openworklabs.com/token_use";
+export const DEN_MCP_ORG_ID_CLAIM = "https://openworklabs.com/org_id";
+export const DEN_MCP_RESOURCE_CLAIM = "https://openworklabs.com/resource";
+export const DEN_MCP_OPAQUE_ACCESS_TOKEN_PREFIX = "ow_mcp_at_";
+
+const socialProviders = {
+  ...(env.github.clientId && env.github.clientSecret
+    ? {
+        github: {
+          clientId: env.github.clientId,
+          clientSecret: env.github.clientSecret,
+        },
+      }
+    : {}),
+  ...(env.google.clientId && env.google.clientSecret
+    ? {
+        google: {
+          clientId: env.google.clientId,
+          clientSecret: env.google.clientSecret,
+        },
+      }
+    : {}),
+};
+
+function hasRole(roleValue: string, roleName: string) {
+  return roleValue
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .includes(roleName);
+}
+
+function getInvitationOrigin() {
+  return (
+    env.betterAuthTrustedOrigins.find((origin) => origin !== "*") ??
+    env.betterAuthUrl
+  );
+}
+
+function buildInvitationLink(invitationId: string) {
+  return new URL(
+    `/join-org?invite=${encodeURIComponent(invitationId)}`,
+    getInvitationOrigin(),
+  ).toString();
+}
+
+function hasMcpScope(scopes: readonly string[]) {
+  return scopes.some((scope) => scope.startsWith("mcp:"));
+}
+
+export const auth = betterAuth({
+  baseURL: env.betterAuthUrl,
+  secret: env.betterAuthSecret,
+  trustedOrigins:
+    env.betterAuthTrustedOrigins.length > 0
+      ? env.betterAuthTrustedOrigins
+      : undefined,
+  socialProviders:
+    Object.keys(socialProviders).length > 0 ? socialProviders : undefined,
+  database: drizzleAdapter(db, {
+    provider: "mysql",
+    schema,
+  }),
+  databaseHooks: {
+    session: {
+      create: {
+        before: async (session) => {
+          const activeOrganizationId = await getInitialActiveOrganizationIdForUser(session.userId);
+
+          return {
+            data: {
+              ...session,
+              activeOrganizationId,
+            },
+          };
+        },
+      },
+    },
+  },
+  advanced: {
+    ipAddress: {
+      ipAddressHeaders: ["x-forwarded-for", "x-real-ip", "cf-connecting-ip"],
+      ipv6Subnet: 64,
+    },
+    database: {
+      generateId: (options) => {
+        switch (options.model) {
+          case "user":
+            return createDenTypeId("user");
+          case "session":
+            return createDenTypeId("session");
+          case "account":
+            return createDenTypeId("account");
+          case "verification":
+            return createDenTypeId("verification");
+          case "apikey":
+          case "apiKey":
+            return createDenTypeId("apiKey");
+          case "oauthClient":
+            return createDenTypeId("oauthClient");
+          case "oauthAccessToken":
+            return createDenTypeId("oauthAccessToken");
+          case "oauthRefreshToken":
+            return createDenTypeId("oauthRefreshToken");
+          case "oauthConsent":
+            return createDenTypeId("oauthConsent");
+          case "rateLimit":
+            return createDenTypeId("rateLimit");
+          case "organization":
+            return createDenTypeId("organization");
+          case "member":
+            return createDenTypeId("member");
+          case "invitation":
+            return createDenTypeId("invitation");
+          case "team":
+            return createDenTypeId("team");
+          case "teamMember":
+            return createDenTypeId("teamMember");
+          case "organizationRole":
+            return createDenTypeId("organizationRole");
+          default:
+            return false;
+        }
+      },
+    },
+  },
+  rateLimit: {
+    enabled: true,
+    storage: "database",
+    window: 60,
+    max: 20,
+    customRules: {
+      "/sign-in/email": {
+        window: 300,
+        max: 5,
+      },
+      "/sign-up/email": {
+        window: 3600,
+        max: 3,
+      },
+      "/email-otp/send-verification-otp": {
+        window: 3600,
+        max: 5,
+      },
+      "/email-otp/verify-email": {
+        window: 300,
+        max: 10,
+      },
+      "/request-password-reset": {
+        window: 3600,
+        max: 5,
+      },
+    },
+  },
+  emailVerification: {
+    sendOnSignUp: true,
+    sendOnSignIn: true,
+    afterEmailVerification: async (user) => {
+      await syncDenSignupContact({
+        email: user.email,
+        name: user.name,
+      });
+    },
+  },
+  emailAndPassword: {
+    enabled: true,
+    autoSignIn: false,
+    requireEmailVerification: true,
+  },
+  plugins: [
+    jwt(),
+    emailOTP({
+      overrideDefaultEmailVerification: true,
+      otpLength: 6,
+      expiresIn: 600,
+      allowedAttempts: 5,
+      async sendVerificationOTP({ email, otp, type }) {
+        await sendDenVerificationEmail({
+          email,
+          verificationCode: otp,
+        });
+      },
+    }),
+    organization({
+      ac: denOrganizationAccess,
+      roles: denOrganizationStaticRoles,
+      creatorRole: "owner",
+      requireEmailVerificationOnInvitation: true,
+      dynamicAccessControl: {
+        enabled: true,
+      },
+      teams: {
+        enabled: true,
+        defaultTeam: {
+          enabled: false,
+        },
+      },
+      async sendInvitationEmail(data) {
+        await sendDenOrganizationInvitationEmail({
+          email: data.email,
+          inviteLink: buildInvitationLink(data.id),
+          invitedByName: data.inviter.user.name ?? data.inviter.user.email,
+          invitedByEmail: data.inviter.user.email,
+          organizationName: data.organization.name,
+          role: data.role,
+        });
+      },
+      organizationHooks: {
+        afterCreateOrganization: async ({ organization }) => {
+          await seedDefaultOrganizationRoles(
+            normalizeDenTypeId("organization", organization.id),
+          );
+        },
+        beforeRemoveMember: async ({ member }) => {
+          if (hasRole(member.role, "owner")) {
+            throw new APIError("BAD_REQUEST", {
+              message: "The organization owner cannot be removed.",
+            });
+          }
+        },
+        beforeUpdateMemberRole: async ({ member, newRole }) => {
+          if (hasRole(member.role, "owner")) {
+            throw new APIError("BAD_REQUEST", {
+              message: "The organization owner role cannot be changed.",
+            });
+          }
+
+          if (hasRole(newRole, "owner")) {
+            throw new APIError("BAD_REQUEST", {
+              message:
+                "Owner can only be assigned during organization creation.",
+            });
+          }
+        },
+      },
+    }),
+    oauthProvider({
+      loginPage: env.betterAuthUrl,
+      consentPage: `${env.betterAuthUrl}/mcp/select-organization`,
+      scopes: [...DEN_MCP_SCOPES],
+      validAudiences: DEN_MCP_RESOURCES,
+      allowPublicClientPrelogin: true,
+      allowDynamicClientRegistration: true,
+      allowUnauthenticatedClientRegistration: true,
+      clientRegistrationDefaultScopes: ["openid", "profile", "email", "mcp:read", "mcp:write"],
+      clientRegistrationAllowedScopes: [...DEN_MCP_SCOPES],
+      advertisedMetadata: {
+        scopes_supported: [...DEN_MCP_SCOPES],
+        claims_supported: [
+          DEN_MCP_TOKEN_USE_CLAIM,
+          DEN_MCP_ORG_ID_CLAIM,
+          DEN_MCP_RESOURCE_CLAIM,
+        ],
+      },
+      postLogin: {
+        page: `${env.betterAuthUrl}/mcp/select-organization`,
+        shouldRedirect: async ({ session, scopes }) => {
+          if (!hasMcpScope(scopes)) {
+            return false;
+          }
+
+          return !session.activeOrganizationId;
+        },
+        consentReferenceId: async ({ session, scopes }) => {
+          if (!hasMcpScope(scopes)) {
+            return undefined;
+          }
+
+          const activeOrganizationId = typeof session.activeOrganizationId === "string"
+            ? session.activeOrganizationId
+            : undefined;
+          if (!activeOrganizationId) {
+            throw new APIError("BAD_REQUEST", {
+              message: "Select an organization before authorizing MCP access.",
+            });
+          }
+
+          return normalizeDenTypeId("organization", activeOrganizationId);
+        },
+      },
+      customAccessTokenClaims: ({ referenceId, resource, scopes }) => {
+        const claims: Record<string, string> = {};
+        if (hasMcpScope(scopes) || resource === DEN_MCP_RESOURCE) {
+          claims[DEN_MCP_TOKEN_USE_CLAIM] = "mcp";
+          claims[DEN_MCP_RESOURCE_CLAIM] = resource ?? DEN_MCP_RESOURCE;
+        }
+        if (referenceId) {
+          claims[DEN_MCP_ORG_ID_CLAIM] = referenceId;
+        }
+        return claims;
+      },
+      prefix: {
+        opaqueAccessToken: DEN_MCP_OPAQUE_ACCESS_TOKEN_PREFIX,
+        refreshToken: "ow_mcp_rt_",
+        clientSecret: "ow_mcp_cs_",
+      },
+    }),
+    apiKey({
+      defaultPrefix: DEN_API_KEY_DEFAULT_PREFIX,
+      enableMetadata: true,
+      enableSessionForAPIKeys: true,
+      maximumNameLength: 64,
+      requireName: true,
+      storage: "database",
+      rateLimit: {
+        enabled: true,
+        maxRequests: DEN_API_KEY_RATE_LIMIT_MAX,
+        timeWindow: DEN_API_KEY_RATE_LIMIT_TIME_WINDOW_MS,
+      },
+    }),
+  ],
+});
diff --git a/ee/apps/den-api/src/billing/polar.ts b/ee/apps/den-api/src/billing/polar.ts
new file mode 100644
index 0000000000..d202a6f3cd
--- /dev/null
+++ b/ee/apps/den-api/src/billing/polar.ts
@@ -0,0 +1,819 @@
+import { env } from "../env.js"
+import { sendSubscribedToDenEvent } from "../loops.js"
+
+type PolarCustomerState = {
+  granted_benefits?: Array<{
+    benefit_id?: string
+  }>
+}
+
+type PolarCheckoutSession = {
+  url?: string
+}
+
+type PolarCustomerSession = {
+  customer_portal_url?: string
+}
+
+type PolarCustomer = {
+  id?: string
+  email?: string
+  external_id?: string | null
+}
+
+type PolarListResource<T> = {
+  items?: T[]
+}
+
+type PolarSubscription = {
+  id?: string
+  status?: string
+  amount?: number
+  currency?: string
+  recurring_interval?: string | null
+  recurring_interval_count?: number | null
+  current_period_start?: string | null
+  current_period_end?: string | null
+  cancel_at_period_end?: boolean
+  canceled_at?: string | null
+  ended_at?: string | null
+}
+
+type PolarOrder = {
+  id?: string
+  created_at?: string
+  status?: string
+  total_amount?: number
+  net_amount?: number
+  currency?: string
+  invoice_number?: string
+  is_invoice_generated?: boolean
+}
+
+type PolarOrderInvoice = {
+  url?: string
+}
+
+type PolarProductPrice = {
+  amount_type?: string
+  price_currency?: string
+  price_amount?: number
+  minimum_amount?: number
+  preset_amount?: number | null
+  is_archived?: boolean
+  seat_tiers?: {
+    tiers?: Array<{
+      price_per_seat?: number
+    }>
+  }
+}
+
+type PolarProduct = {
+  recurring_interval?: string | null
+  recurring_interval_count?: number | null
+  prices?: PolarProductPrice[]
+}
+
+export type CloudWorkerAccess =
+  | {
+      allowed: true
+    }
+  | {
+      allowed: false
+      checkoutUrl: string
+    }
+
+export type CloudWorkerBillingPrice = {
+  amount: number | null
+  currency: string | null
+  recurringInterval: string | null
+  recurringIntervalCount: number | null
+}
+
+export type CloudWorkerBillingSubscription = {
+  id: string
+  status: string
+  amount: number | null
+  currency: string | null
+  recurringInterval: string | null
+  recurringIntervalCount: number | null
+  currentPeriodStart: string | null
+  currentPeriodEnd: string | null
+  cancelAtPeriodEnd: boolean
+  canceledAt: string | null
+  endedAt: string | null
+}
+
+export type CloudWorkerBillingInvoice = {
+  id: string
+  createdAt: string | null
+  status: string
+  totalAmount: number | null
+  currency: string | null
+  invoiceNumber: string | null
+  invoiceUrl: string | null
+}
+
+export type CloudWorkerBillingStatus = {
+  featureGateEnabled: boolean
+  hasActivePlan: boolean
+  checkoutRequired: boolean
+  checkoutUrl: string | null
+  portalUrl: string | null
+  price: CloudWorkerBillingPrice | null
+  subscription: CloudWorkerBillingSubscription | null
+  invoices: CloudWorkerBillingInvoice[]
+}
+
+export type CloudWorkerAdminBillingStatus = {
+  status: "paid" | "unpaid" | "unavailable"
+  featureGateEnabled: boolean
+  subscriptionId: string | null
+  subscriptionStatus: string | null
+  currentPeriodEnd: string | null
+  source: "benefit" | "subscription" | "unavailable"
+  note: string | null
+}
+
+type CloudAccessInput = {
+  userId: string
+  email: string
+  name: string
+}
+
+type BillingStatusOptions = {
+  includeCheckoutUrl?: boolean
+  includePortalUrl?: boolean
+  includeInvoices?: boolean
+}
+
+function sanitizeApiBase(value: string) {
+  return value.replace(/\/+$/, "")
+}
+
+function parseJson<T>(text: string): T | null {
+  if (!text) {
+    return null
+  }
+
+  return JSON.parse(text) as T
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+async function polarFetch(path: string, init: RequestInit = {}) {
+  const headers = new Headers(init.headers)
+  headers.set("Authorization", `Bearer ${env.polar.accessToken}`)
+  headers.set("Accept", "application/json")
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json")
+  }
+
+  return fetch(`${sanitizeApiBase(env.polar.apiBase)}${path}`, {
+    ...init,
+    headers,
+  })
+}
+
+async function polarFetchJson<T>(path: string, init: RequestInit = {}) {
+  const response = await polarFetch(path, init)
+  const text = await response.text()
+  const payload = parseJson<T>(text)
+  return { response, text, payload }
+}
+
+function assertPaywallConfig() {
+  if (!env.polar.accessToken) {
+    throw new Error("POLAR_ACCESS_TOKEN is required when POLAR_FEATURE_GATE_ENABLED=true")
+  }
+  if (!env.polar.productId) {
+    throw new Error("POLAR_PRODUCT_ID is required when POLAR_FEATURE_GATE_ENABLED=true")
+  }
+  if (!env.polar.successUrl) {
+    throw new Error("POLAR_SUCCESS_URL is required when POLAR_FEATURE_GATE_ENABLED=true")
+  }
+  if (!env.polar.returnUrl) {
+    throw new Error("POLAR_RETURN_URL is required when POLAR_FEATURE_GATE_ENABLED=true")
+  }
+}
+
+async function getCustomerStateByExternalId(externalCustomerId: string): Promise<PolarCustomerState | null> {
+  const encodedExternalId = encodeURIComponent(externalCustomerId)
+  const { response, payload, text } = await polarFetchJson<PolarCustomerState>(`/v1/customers/external/${encodedExternalId}/state`, {
+    method: "GET",
+  })
+
+  if (response.status === 404) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar customer state lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return payload
+}
+
+async function getCustomerStateById(customerId: string): Promise<PolarCustomerState | null> {
+  const encodedCustomerId = encodeURIComponent(customerId)
+  const { response, payload, text } = await polarFetchJson<PolarCustomerState>(`/v1/customers/${encodedCustomerId}/state`, {
+    method: "GET",
+  })
+
+  if (response.status === 404) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar customer state lookup by ID failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return payload
+}
+
+async function getCustomerByEmail(email: string): Promise<PolarCustomer | null> {
+  const normalizedEmail = email.trim().toLowerCase()
+  if (!normalizedEmail) {
+    return null
+  }
+
+  const encodedEmail = encodeURIComponent(normalizedEmail)
+  const { response, payload, text } = await polarFetchJson<PolarListResource<PolarCustomer>>(`/v1/customers/?email=${encodedEmail}`, {
+    method: "GET",
+  })
+
+  if (!response.ok) {
+    throw new Error(`Polar customer lookup by email failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  const customers = payload?.items ?? []
+  const exact = customers.find((customer) => customer.email?.trim().toLowerCase() === normalizedEmail)
+  return exact ?? customers[0] ?? null
+}
+
+async function linkCustomerExternalId(customer: PolarCustomer, externalCustomerId: string): Promise<void> {
+  if (!customer.id) {
+    return
+  }
+
+  if (typeof customer.external_id === "string" && customer.external_id.length > 0) {
+    return
+  }
+
+  const encodedCustomerId = encodeURIComponent(customer.id)
+  await polarFetch(`/v1/customers/${encodedCustomerId}`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      external_id: externalCustomerId,
+    }),
+  })
+}
+
+function hasRequiredBenefit(state: PolarCustomerState | null) {
+  if (!state?.granted_benefits || !env.polar.benefitId) {
+    return false
+  }
+
+  return state.granted_benefits.some((grant) => grant.benefit_id === env.polar.benefitId)
+}
+
+async function createCheckoutSession(input: CloudAccessInput): Promise<string> {
+  const payload = {
+    products: [env.polar.productId],
+    success_url: env.polar.successUrl,
+    return_url: env.polar.returnUrl,
+    external_customer_id: input.userId,
+    customer_email: input.email,
+    customer_name: input.name,
+  }
+
+  const { response, payload: checkout, text } = await polarFetchJson<PolarCheckoutSession>("/v1/checkouts/", {
+    method: "POST",
+    body: JSON.stringify(payload),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Polar checkout creation failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  if (!checkout?.url) {
+    throw new Error("Polar checkout response missing URL")
+  }
+
+  return checkout.url
+}
+
+type CloudWorkerAccessEvaluation = {
+  featureGateEnabled: boolean
+  hasActivePlan: boolean
+  checkoutUrl: string | null
+}
+
+async function evaluateCloudWorkerAccess(
+  input: CloudAccessInput,
+  options: { includeCheckoutUrl?: boolean } = {},
+): Promise<CloudWorkerAccessEvaluation> {
+  if (!env.polar.featureGateEnabled) {
+    return {
+      featureGateEnabled: false,
+      hasActivePlan: true,
+      checkoutUrl: null,
+    }
+  }
+
+  assertPaywallConfig()
+
+  const externalState = await getCustomerStateByExternalId(input.userId)
+  if (hasRequiredBenefit(externalState)) {
+    return {
+      featureGateEnabled: true,
+      hasActivePlan: true,
+      checkoutUrl: null,
+    }
+  }
+
+  const customer = await getCustomerByEmail(input.email)
+  if (customer?.id) {
+    const emailState = await getCustomerStateById(customer.id)
+    if (hasRequiredBenefit(emailState)) {
+      await linkCustomerExternalId(customer, input.userId).catch(() => undefined)
+      return {
+        featureGateEnabled: true,
+        hasActivePlan: true,
+        checkoutUrl: null,
+      }
+    }
+  }
+
+  return {
+    featureGateEnabled: true,
+    hasActivePlan: false,
+    checkoutUrl: options.includeCheckoutUrl ? await createCheckoutSession(input) : null,
+  }
+}
+
+function normalizeRecurringInterval(value: string | null | undefined): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value : null
+}
+
+function normalizeRecurringIntervalCount(value: number | null | undefined): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null
+}
+
+function isActiveSubscriptionStatus(status: string | null | undefined) {
+  const normalized = typeof status === "string" ? status.trim().toLowerCase() : ""
+  return normalized === "active" || normalized === "trialing"
+}
+
+function toBillingSubscription(subscription: PolarSubscription | null): CloudWorkerBillingSubscription | null {
+  if (!subscription?.id) {
+    return null
+  }
+
+  return {
+    id: subscription.id,
+    status: typeof subscription.status === "string" ? subscription.status : "unknown",
+    amount: typeof subscription.amount === "number" ? subscription.amount : null,
+    currency: typeof subscription.currency === "string" ? subscription.currency : null,
+    recurringInterval: normalizeRecurringInterval(subscription.recurring_interval),
+    recurringIntervalCount: normalizeRecurringIntervalCount(subscription.recurring_interval_count),
+    currentPeriodStart: typeof subscription.current_period_start === "string" ? subscription.current_period_start : null,
+    currentPeriodEnd: typeof subscription.current_period_end === "string" ? subscription.current_period_end : null,
+    cancelAtPeriodEnd: subscription.cancel_at_period_end === true,
+    canceledAt: typeof subscription.canceled_at === "string" ? subscription.canceled_at : null,
+    endedAt: typeof subscription.ended_at === "string" ? subscription.ended_at : null,
+  }
+}
+
+function toBillingPriceFromSubscription(subscription: CloudWorkerBillingSubscription | null): CloudWorkerBillingPrice | null {
+  if (!subscription) {
+    return null
+  }
+
+  return {
+    amount: subscription.amount,
+    currency: subscription.currency,
+    recurringInterval: subscription.recurringInterval,
+    recurringIntervalCount: subscription.recurringIntervalCount,
+  }
+}
+
+async function getSubscriptionById(subscriptionId: string): Promise<PolarSubscription | null> {
+  const encodedId = encodeURIComponent(subscriptionId)
+  const { response, payload, text } = await polarFetchJson<PolarSubscription>(`/v1/subscriptions/${encodedId}`, {
+    method: "GET",
+  })
+
+  if (response.status === 404) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar subscription lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return payload
+}
+
+async function listSubscriptionsByExternalCustomer(
+  externalCustomerId: string,
+  options: { activeOnly?: boolean; limit?: number } = {},
+): Promise<PolarSubscription[]> {
+  const params = new URLSearchParams()
+  params.set("external_customer_id", externalCustomerId)
+  if (env.polar.productId) {
+    params.set("product_id", env.polar.productId)
+  }
+  params.set("limit", String(options.limit ?? 1))
+  params.set("sorting", "-started_at")
+
+  if (options.activeOnly === true) {
+    params.set("active", "true")
+  }
+
+  const lookup = await polarFetchJson<PolarListResource<PolarSubscription>>(`/v1/subscriptions/?${params.toString()}`, {
+    method: "GET",
+  })
+  let response = lookup.response
+  let payload = lookup.payload
+  let text = lookup.text
+
+  if (response.status === 422 && params.has("sorting")) {
+    params.delete("sorting")
+    const fallbackLookup = await polarFetchJson<PolarListResource<PolarSubscription>>(`/v1/subscriptions/?${params.toString()}`, {
+      method: "GET",
+    })
+    response = fallbackLookup.response
+    payload = fallbackLookup.payload
+    text = fallbackLookup.text
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar subscriptions lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return payload?.items ?? []
+}
+
+async function getPrimarySubscriptionForCustomer(externalCustomerId: string): Promise<PolarSubscription | null> {
+  const active = await listSubscriptionsByExternalCustomer(externalCustomerId, { activeOnly: true, limit: 1 })
+  if (active[0]) {
+    return active[0]
+  }
+
+  const recent = await listSubscriptionsByExternalCustomer(externalCustomerId, { activeOnly: false, limit: 1 })
+  return recent[0] ?? null
+}
+
+async function listRecentOrdersByExternalCustomer(externalCustomerId: string, limit = 6): Promise<PolarOrder[]> {
+  const params = new URLSearchParams()
+  params.set("external_customer_id", externalCustomerId)
+  if (env.polar.productId) {
+    params.set("product_id", env.polar.productId)
+  }
+  params.set("limit", String(limit))
+  params.set("sorting", "-created_at")
+
+  const { response, payload, text } = await polarFetchJson<PolarListResource<PolarOrder>>(`/v1/orders/?${params.toString()}`, {
+    method: "GET",
+  })
+
+  if (!response.ok) {
+    throw new Error(`Polar orders lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return payload?.items ?? []
+}
+
+async function getOrderInvoiceUrl(orderId: string): Promise<string | null> {
+  const encodedId = encodeURIComponent(orderId)
+  const { response, payload, text } = await polarFetchJson<PolarOrderInvoice>(`/v1/orders/${encodedId}/invoice`, {
+    method: "GET",
+  })
+
+  if (response.status === 404) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar invoice lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return typeof payload?.url === "string" ? payload.url : null
+}
+
+function toBillingInvoice(order: PolarOrder, invoiceUrl: string | null): CloudWorkerBillingInvoice | null {
+  if (!order.id) {
+    return null
+  }
+
+  const totalAmount =
+    typeof order.total_amount === "number"
+      ? order.total_amount
+      : typeof order.net_amount === "number"
+        ? order.net_amount
+        : null
+
+  return {
+    id: order.id,
+    createdAt: typeof order.created_at === "string" ? order.created_at : null,
+    status: typeof order.status === "string" ? order.status : "unknown",
+    totalAmount,
+    currency: typeof order.currency === "string" ? order.currency : null,
+    invoiceNumber: typeof order.invoice_number === "string" ? order.invoice_number : null,
+    invoiceUrl,
+  }
+}
+
+async function listBillingInvoices(externalCustomerId: string, limit = 6): Promise<CloudWorkerBillingInvoice[]> {
+  const orders = await listRecentOrdersByExternalCustomer(externalCustomerId, limit)
+  const invoices = await Promise.all(
+    orders.map(async (order) => {
+      const invoiceUrl = order.id && order.is_invoice_generated === true ? await getOrderInvoiceUrl(order.id).catch(() => null) : null
+      return toBillingInvoice(order, invoiceUrl)
+    }),
+  )
+
+  return invoices.filter((invoice): invoice is CloudWorkerBillingInvoice => invoice !== null)
+}
+
+async function createCustomerPortalUrl(externalCustomerId: string): Promise<string | null> {
+  const body = {
+    external_customer_id: externalCustomerId,
+    return_url: env.polar.returnUrl ?? env.polar.successUrl ?? null,
+  }
+
+  const { response, payload, text } = await polarFetchJson<PolarCustomerSession>("/v1/customer-sessions/", {
+    method: "POST",
+    body: JSON.stringify(body),
+  })
+
+  if (response.status === 404 || response.status === 422) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar customer portal session failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return typeof payload?.customer_portal_url === "string" ? payload.customer_portal_url : null
+}
+
+function extractAmountFromProductPrice(price: PolarProductPrice): number | null {
+  if (price.amount_type === "fixed" && typeof price.price_amount === "number") {
+    return price.price_amount
+  }
+
+  if (price.amount_type === "seat_based") {
+    const firstTier = Array.isArray(price.seat_tiers?.tiers) ? price.seat_tiers?.tiers[0] : null
+    if (firstTier && typeof firstTier.price_per_seat === "number") {
+      return firstTier.price_per_seat
+    }
+  }
+
+  if (price.amount_type === "custom") {
+    if (typeof price.preset_amount === "number") {
+      return price.preset_amount
+    }
+    if (typeof price.minimum_amount === "number") {
+      return price.minimum_amount
+    }
+  }
+
+  if (price.amount_type === "free") {
+    return 0
+  }
+
+  return null
+}
+
+function extractBillingPriceFromProduct(product: PolarProduct | null): CloudWorkerBillingPrice | null {
+  if (!product || !Array.isArray(product.prices)) {
+    return null
+  }
+
+  for (const price of product.prices) {
+    if (!isRecord(price) || price.is_archived === true) {
+      continue
+    }
+
+    const amount = extractAmountFromProductPrice(price as PolarProductPrice)
+    if (amount === null) {
+      continue
+    }
+
+    const currency = typeof price.price_currency === "string" ? price.price_currency : null
+    return {
+      amount,
+      currency,
+      recurringInterval: normalizeRecurringInterval(product.recurring_interval),
+      recurringIntervalCount: normalizeRecurringIntervalCount(product.recurring_interval_count),
+    }
+  }
+
+  return null
+}
+
+async function getProductBillingPrice(productId: string): Promise<CloudWorkerBillingPrice | null> {
+  const encodedId = encodeURIComponent(productId)
+  const { response, payload, text } = await polarFetchJson<PolarProduct>(`/v1/products/${encodedId}`, {
+    method: "GET",
+  })
+
+  if (response.status === 404) {
+    return null
+  }
+
+  if (!response.ok) {
+    throw new Error(`Polar product lookup failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  return extractBillingPriceFromProduct(payload)
+}
+
+export async function requireCloudWorkerAccess(input: CloudAccessInput): Promise<CloudWorkerAccess> {
+  const evaluation = await evaluateCloudWorkerAccess(input, { includeCheckoutUrl: true })
+  if (evaluation.hasActivePlan) {
+    return { allowed: true }
+  }
+
+  if (!evaluation.checkoutUrl) {
+    throw new Error("Polar checkout URL unavailable")
+  }
+
+  return {
+    allowed: false,
+    checkoutUrl: evaluation.checkoutUrl,
+  }
+}
+
+export async function getCloudWorkerBillingStatus(
+  input: CloudAccessInput,
+  options: BillingStatusOptions = {},
+): Promise<CloudWorkerBillingStatus> {
+  const includePortalUrl = options.includePortalUrl !== false
+  const includeInvoices = options.includeInvoices !== false
+  const evaluation = await evaluateCloudWorkerAccess(input, {
+    includeCheckoutUrl: options.includeCheckoutUrl,
+  })
+
+  if (!evaluation.featureGateEnabled) {
+    return {
+      featureGateEnabled: false,
+      hasActivePlan: true,
+      checkoutRequired: false,
+      checkoutUrl: null,
+      portalUrl: null,
+      price: null,
+      subscription: null,
+      invoices: [],
+    }
+  }
+
+  if (evaluation.hasActivePlan) {
+    await sendSubscribedToDenEvent(input)
+  }
+
+  const [subscriptionResult, priceResult, portalResult, invoicesResult] = await Promise.all([
+    getPrimarySubscriptionForCustomer(input.userId).catch(() => null),
+    env.polar.productId ? getProductBillingPrice(env.polar.productId).catch(() => null) : Promise.resolve<CloudWorkerBillingPrice | null>(null),
+    includePortalUrl ? createCustomerPortalUrl(input.userId).catch(() => null) : Promise.resolve<string | null>(null),
+    includeInvoices ? listBillingInvoices(input.userId).catch(() => []) : Promise.resolve<CloudWorkerBillingInvoice[]>([]),
+  ])
+
+  const subscription = toBillingSubscription(subscriptionResult)
+  const productPrice = priceResult
+  const portalUrl = portalResult
+  const invoices = invoicesResult
+
+  return {
+    featureGateEnabled: evaluation.featureGateEnabled,
+    hasActivePlan: evaluation.hasActivePlan,
+    checkoutRequired: evaluation.featureGateEnabled && !evaluation.hasActivePlan,
+    checkoutUrl: evaluation.checkoutUrl,
+    portalUrl,
+    price: productPrice ?? toBillingPriceFromSubscription(subscription),
+    subscription,
+    invoices,
+  }
+}
+
+export async function getCloudWorkerAdminBillingStatus(
+  input: CloudAccessInput,
+): Promise<CloudWorkerAdminBillingStatus> {
+  if (!env.polar.accessToken) {
+    return {
+      status: "unavailable",
+      featureGateEnabled: env.polar.featureGateEnabled,
+      subscriptionId: null,
+      subscriptionStatus: null,
+      currentPeriodEnd: null,
+      source: "unavailable",
+      note: "Polar access token is not configured.",
+    }
+  }
+
+  if (!env.polar.benefitId && !env.polar.productId) {
+    return {
+      status: "unavailable",
+      featureGateEnabled: env.polar.featureGateEnabled,
+      subscriptionId: null,
+      subscriptionStatus: null,
+      currentPeriodEnd: null,
+      source: "unavailable",
+      note: "Polar product or benefit configuration is missing.",
+    }
+  }
+
+  try {
+    let note: string | null = null
+    let paidByBenefit = false
+
+    if (env.polar.benefitId) {
+      const externalState = await getCustomerStateByExternalId(input.userId)
+      if (hasRequiredBenefit(externalState)) {
+        paidByBenefit = true
+        note = "Benefit granted via external customer id."
+      } else {
+        const customer = await getCustomerByEmail(input.email)
+        if (customer?.id) {
+          const emailState = await getCustomerStateById(customer.id)
+          if (hasRequiredBenefit(emailState)) {
+            paidByBenefit = true
+            note = "Benefit granted via matching customer email."
+            await linkCustomerExternalId(customer, input.userId).catch(() => undefined)
+          }
+        }
+      }
+    }
+
+    const subscription = env.polar.productId ? await getPrimarySubscriptionForCustomer(input.userId) : null
+    const normalizedSubscription = toBillingSubscription(subscription)
+    const paidBySubscription = isActiveSubscriptionStatus(normalizedSubscription?.status)
+
+    return {
+      status: paidByBenefit || paidBySubscription ? "paid" : "unpaid",
+      featureGateEnabled: env.polar.featureGateEnabled,
+      subscriptionId: normalizedSubscription?.id ?? null,
+      subscriptionStatus: normalizedSubscription?.status ?? null,
+      currentPeriodEnd: normalizedSubscription?.currentPeriodEnd ?? null,
+      source: paidByBenefit ? "benefit" : "subscription",
+      note:
+        note ??
+        (normalizedSubscription
+          ? "Subscription status resolved from Polar."
+          : "No active billing record was found for this user."),
+    }
+  } catch (error) {
+    return {
+      status: "unavailable",
+      featureGateEnabled: env.polar.featureGateEnabled,
+      subscriptionId: null,
+      subscriptionStatus: null,
+      currentPeriodEnd: null,
+      source: "unavailable",
+      note: error instanceof Error ? error.message : "Billing lookup failed.",
+    }
+  }
+}
+
+export async function setCloudWorkerSubscriptionCancellation(
+  input: CloudAccessInput,
+  cancelAtPeriodEnd: boolean,
+): Promise<CloudWorkerBillingSubscription | null> {
+  if (!env.polar.featureGateEnabled) {
+    return null
+  }
+
+  assertPaywallConfig()
+
+  const activeSubscriptions = await listSubscriptionsByExternalCustomer(input.userId, {
+    activeOnly: true,
+    limit: 1,
+  })
+  const active = activeSubscriptions[0]
+  if (!active?.id) {
+    return null
+  }
+
+  const encodedId = encodeURIComponent(active.id)
+  const { response, payload, text } = await polarFetchJson<PolarSubscription>(`/v1/subscriptions/${encodedId}`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      cancel_at_period_end: cancelAtPeriodEnd,
+    }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Polar subscription update failed (${response.status}): ${text.slice(0, 400)}`)
+  }
+
+  if (payload?.id) {
+    return toBillingSubscription(payload)
+  }
+
+  const refreshed = await getSubscriptionById(active.id)
+  return toBillingSubscription(refreshed)
+}
diff --git a/ee/apps/den-api/src/db.ts b/ee/apps/den-api/src/db.ts
new file mode 100644
index 0000000000..bf48dfb132
--- /dev/null
+++ b/ee/apps/den-api/src/db.ts
@@ -0,0 +1,8 @@
+import { createDenDb } from "@openwork-ee/den-db"
+import { env } from "./env.js"
+
+export const { db } = createDenDb({
+  databaseUrl: env.databaseUrl,
+  mode: env.dbMode,
+  planetscale: env.planetscale,
+})
diff --git a/ee/apps/den-api/src/email.ts b/ee/apps/den-api/src/email.ts
new file mode 100644
index 0000000000..5ce42ddfe1
--- /dev/null
+++ b/ee/apps/den-api/src/email.ts
@@ -0,0 +1,169 @@
+import { env } from "./env.js"
+
+const LOOPS_TRANSACTIONAL_API_URL = "https://app.loops.so/api/v1/transactional"
+
+/**
+ * Error thrown when a transactional email send fails or is skipped because
+ * of misconfiguration. Handlers can inspect `.reason` to decide how to
+ * surface the failure to the caller (e.g. map to an HTTP status).
+ */
+export class DenEmailSendError extends Error {
+  readonly reason:
+    | "loops_not_configured"
+    | "loops_rejected"
+    | "loops_network"
+  readonly template: "verification" | "organization_invite"
+  readonly recipient: string
+  readonly detail?: string
+
+  constructor(input: {
+    template: DenEmailSendError["template"]
+    reason: DenEmailSendError["reason"]
+    recipient: string
+    detail?: string
+  }) {
+    super(
+      `[${input.template}] email for ${input.recipient} failed: ${input.reason}${
+        input.detail ? ` (${input.detail})` : ""
+      }`,
+    )
+    this.name = "DenEmailSendError"
+    this.reason = input.reason
+    this.template = input.template
+    this.recipient = input.recipient
+    this.detail = input.detail
+  }
+}
+
+async function postLoopsTransactional(input: {
+  transactionalId: string
+  email: string
+  dataVariables: Record<string, string>
+  template: DenEmailSendError["template"]
+}): Promise<void> {
+  let response: Response
+  try {
+    response = await fetch(LOOPS_TRANSACTIONAL_API_URL, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${env.loops.apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        transactionalId: input.transactionalId,
+        email: input.email,
+        dataVariables: input.dataVariables,
+      }),
+    })
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error"
+    throw new DenEmailSendError({
+      template: input.template,
+      reason: "loops_network",
+      recipient: input.email,
+      detail: message,
+    })
+  }
+
+  if (response.ok) {
+    return
+  }
+
+  let detail = `status ${response.status}`
+  try {
+    const payload = (await response.json()) as { message?: string }
+    if (payload.message?.trim()) {
+      detail = payload.message
+    }
+  } catch {
+    // Ignore invalid upstream payloads.
+  }
+
+  throw new DenEmailSendError({
+    template: input.template,
+    reason: "loops_rejected",
+    recipient: input.email,
+    detail,
+  })
+}
+
+export async function sendDenVerificationEmail(input: {
+  email: string
+  verificationCode: string
+}) {
+  const email = input.email.trim()
+  const verificationCode = input.verificationCode.trim()
+
+  if (!email || !verificationCode) {
+    return
+  }
+
+  if (env.devMode) {
+    console.info(`[auth] dev verification email payload for ${email}: ${JSON.stringify({ verificationCode })}`)
+    return
+  }
+
+  if (!env.loops.apiKey || !env.loops.transactionalIdDenVerifyEmail) {
+    throw new DenEmailSendError({
+      template: "verification",
+      reason: "loops_not_configured",
+      recipient: email,
+    })
+  }
+
+  await postLoopsTransactional({
+    transactionalId: env.loops.transactionalIdDenVerifyEmail,
+    email,
+    dataVariables: { verificationCode },
+    template: "verification",
+  })
+}
+
+export async function sendDenOrganizationInvitationEmail(input: {
+  email: string
+  inviteLink: string
+  invitedByName: string
+  invitedByEmail: string
+  organizationName: string
+  role: string
+}) {
+  const email = input.email.trim()
+
+  if (!email) {
+    return
+  }
+
+  if (env.devMode) {
+    console.info(
+      `[auth] dev organization invite email payload for ${email}: ${JSON.stringify({
+        inviteLink: input.inviteLink,
+        invitedByName: input.invitedByName,
+        invitedByEmail: input.invitedByEmail,
+        organizationName: input.organizationName,
+        role: input.role,
+      })}`,
+    )
+    return
+  }
+
+  if (!env.loops.apiKey || !env.loops.transactionalIdDenOrgInviteEmail) {
+    throw new DenEmailSendError({
+      template: "organization_invite",
+      reason: "loops_not_configured",
+      recipient: email,
+    })
+  }
+
+  await postLoopsTransactional({
+    transactionalId: env.loops.transactionalIdDenOrgInviteEmail,
+    email,
+    dataVariables: {
+      inviteLink: input.inviteLink,
+      invitedByName: input.invitedByName,
+      invitedByEmail: input.invitedByEmail,
+      organizationName: input.organizationName,
+      role: input.role,
+    },
+    template: "organization_invite",
+  })
+}
diff --git a/ee/apps/den-api/src/env.ts b/ee/apps/den-api/src/env.ts
new file mode 100644
index 0000000000..681ad9c94a
--- /dev/null
+++ b/ee/apps/den-api/src/env.ts
@@ -0,0 +1,289 @@
+import { DEN_WORKER_POLL_INTERVAL_MS } from "./CONSTS.js"
+import { z } from "zod"
+
+const EnvSchema = z.object({
+  DATABASE_URL: z.string().min(1).optional(),
+  DATABASE_HOST: z.string().min(1).optional(),
+  DATABASE_USERNAME: z.string().min(1).optional(),
+  DATABASE_PASSWORD: z.string().optional(),
+  DEN_DB_ENCRYPTION_KEY: z.string().trim().min(32),
+  DB_MODE: z.enum(["mysql", "planetscale"]).optional(),
+  BETTER_AUTH_SECRET: z.string().min(32),
+  BETTER_AUTH_URL: z.string().min(1),
+  DEN_MCP_RESOURCE_URL: z.string().optional(),
+  DEN_BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  GITHUB_CONNECTOR_APP_ID: z.string().optional(),
+  GITHUB_CONNECTOR_APP_CLIENT_ID: z.string().optional(),
+  GITHUB_CONNECTOR_APP_CLIENT_SECRET: z.string().optional(),
+  GITHUB_CONNECTOR_APP_PRIVATE_KEY: z.string().optional(),
+  GITHUB_CONNECTOR_APP_WEBHOOK_SECRET: z.string().optional(),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  LOOPS_API_KEY: z.string().optional(),
+  LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL: z.string().optional(),
+  LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL: z.string().optional(),
+  OPENWORK_DEV_MODE: z.string().optional(),
+  PORT: z.string().optional(),
+  CORS_ORIGINS: z.string().optional(),
+  WORKER_PROXY_PORT: z.string().optional(),
+  PROVISIONER_MODE: z.enum(["stub", "render", "daytona"]).optional(),
+  WORKER_URL_TEMPLATE: z.string().optional(),
+  WORKER_ACTIVITY_BASE_URL: z.string().optional(),
+  OPENWORK_DAYTONA_ENV_PATH: z.string().optional(),
+  RENDER_API_BASE: z.string().optional(),
+  RENDER_API_KEY: z.string().optional(),
+  RENDER_OWNER_ID: z.string().optional(),
+  RENDER_WORKER_REPO: z.string().optional(),
+  RENDER_WORKER_BRANCH: z.string().optional(),
+  RENDER_WORKER_ROOT_DIR: z.string().optional(),
+  RENDER_WORKER_PLAN: z.string().optional(),
+  RENDER_WORKER_REGION: z.string().optional(),
+  RENDER_WORKER_OPENWORK_VERSION: z.string().optional(),
+  RENDER_WORKER_NAME_PREFIX: z.string().optional(),
+  RENDER_WORKER_PUBLIC_DOMAIN_SUFFIX: z.string().optional(),
+  RENDER_CUSTOM_DOMAIN_READY_TIMEOUT_MS: z.string().optional(),
+  RENDER_PROVISION_TIMEOUT_MS: z.string().optional(),
+  RENDER_HEALTHCHECK_TIMEOUT_MS: z.string().optional(),
+  RENDER_POLL_INTERVAL_MS: z.string().optional(),
+  VERCEL_API_BASE: z.string().optional(),
+  VERCEL_TOKEN: z.string().optional(),
+  VERCEL_TEAM_ID: z.string().optional(),
+  VERCEL_TEAM_SLUG: z.string().optional(),
+  VERCEL_DNS_DOMAIN: z.string().optional(),
+  POLAR_FEATURE_GATE_ENABLED: z.string().optional(),
+  POLAR_API_BASE: z.string().optional(),
+  POLAR_ACCESS_TOKEN: z.string().optional(),
+  POLAR_PRODUCT_ID: z.string().optional(),
+  POLAR_BENEFIT_ID: z.string().optional(),
+  POLAR_SUCCESS_URL: z.string().optional(),
+  POLAR_RETURN_URL: z.string().optional(),
+  DAYTONA_API_URL: z.string().optional(),
+  DAYTONA_API_KEY: z.string().optional(),
+  DAYTONA_TARGET: z.string().optional(),
+  DAYTONA_SNAPSHOT: z.string().optional(),
+  DAYTONA_SANDBOX_IMAGE: z.string().optional(),
+  DAYTONA_SANDBOX_CPU: z.string().optional(),
+  DAYTONA_SANDBOX_MEMORY: z.string().optional(),
+  DAYTONA_SANDBOX_DISK: z.string().optional(),
+  DAYTONA_SANDBOX_PUBLIC: z.string().optional(),
+  DAYTONA_SANDBOX_AUTO_STOP_INTERVAL: z.string().optional(),
+  DAYTONA_SANDBOX_AUTO_ARCHIVE_INTERVAL: z.string().optional(),
+  DAYTONA_SANDBOX_AUTO_DELETE_INTERVAL: z.string().optional(),
+  DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS: z.string().optional(),
+  DAYTONA_WORKER_PROXY_BASE_URL: z.string().optional(),
+  DAYTONA_SANDBOX_NAME_PREFIX: z.string().optional(),
+  DAYTONA_SHARED_VOLUME_NAME: z.string().optional(),
+  DAYTONA_VOLUME_NAME_PREFIX: z.string().optional(),
+  DAYTONA_WORKSPACE_MOUNT_PATH: z.string().optional(),
+  DAYTONA_DATA_MOUNT_PATH: z.string().optional(),
+  DAYTONA_RUNTIME_WORKSPACE_PATH: z.string().optional(),
+  DAYTONA_RUNTIME_DATA_PATH: z.string().optional(),
+  DAYTONA_SIDECAR_DIR: z.string().optional(),
+  DAYTONA_OPENWORK_PORT: z.string().optional(),
+  DAYTONA_OPENCODE_PORT: z.string().optional(),
+  DAYTONA_CREATE_TIMEOUT_SECONDS: z.string().optional(),
+  DAYTONA_DELETE_TIMEOUT_SECONDS: z.string().optional(),
+  DAYTONA_HEALTHCHECK_TIMEOUT_MS: z.string().optional(),
+}).superRefine((value, ctx) => {
+  const inferredMode = value.DB_MODE ?? (value.DATABASE_URL ? "mysql" : "planetscale")
+
+  if (inferredMode === "mysql" && !value.DATABASE_URL) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "DATABASE_URL is required when using mysql mode",
+      path: ["DATABASE_URL"],
+    })
+  }
+
+  if (inferredMode === "planetscale") {
+    for (const key of ["DATABASE_HOST", "DATABASE_USERNAME", "DATABASE_PASSWORD"] as const) {
+      if (!value[key]) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `${key} is required when using planetscale mode`,
+          path: [key],
+        })
+      }
+    }
+  }
+})
+
+const parsed = EnvSchema.parse(process.env)
+
+function splitCsv(value: string | undefined) {
+  return (value ?? "")
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+}
+
+function optionalString(value: string | undefined) {
+  const trimmed = value?.trim()
+  return trimmed ? trimmed : undefined
+}
+
+function normalizeOrigin(origin: string) {
+  const value = origin.trim()
+  if (value === "*") {
+    return value
+  }
+  return value.replace(/\/+$/, "")
+}
+
+const corsOrigins = splitCsv(parsed.CORS_ORIGINS).map((origin) => normalizeOrigin(origin))
+const betterAuthTrustedOrigins = splitCsv(parsed.DEN_BETTER_AUTH_TRUSTED_ORIGINS)
+  .map((origin) => normalizeOrigin(origin))
+
+const polarFeatureGateEnabled =
+  (parsed.POLAR_FEATURE_GATE_ENABLED ?? "false").toLowerCase() === "true"
+
+const devMode = (parsed.OPENWORK_DEV_MODE ?? "0").trim() === "1"
+const port = Number(parsed.PORT ?? "8790")
+
+const daytonaSandboxPublic =
+  (parsed.DAYTONA_SANDBOX_PUBLIC ?? "false").toLowerCase() === "true"
+
+const planetscaleCredentials =
+  parsed.DATABASE_HOST && parsed.DATABASE_USERNAME && parsed.DATABASE_PASSWORD !== undefined
+    ? {
+        host: parsed.DATABASE_HOST,
+        username: parsed.DATABASE_USERNAME,
+        password: parsed.DATABASE_PASSWORD,
+      }
+    : null
+
+export const env = {
+  databaseUrl: parsed.DATABASE_URL,
+  dbEncryptionKey: optionalString(parsed.DEN_DB_ENCRYPTION_KEY),
+  dbMode: parsed.DB_MODE ?? (parsed.DATABASE_URL ? "mysql" : "planetscale"),
+  planetscale: planetscaleCredentials,
+  betterAuthSecret: parsed.BETTER_AUTH_SECRET,
+  betterAuthUrl: normalizeOrigin(parsed.BETTER_AUTH_URL),
+  mcpResourceUrl: optionalString(parsed.DEN_MCP_RESOURCE_URL)
+    ? normalizeOrigin(parsed.DEN_MCP_RESOURCE_URL!)
+    : devMode
+      ? `http://127.0.0.1:${port}/mcp`
+      : undefined,
+  betterAuthTrustedOrigins: betterAuthTrustedOrigins.length > 0 ? betterAuthTrustedOrigins : corsOrigins,
+  devMode,
+  github: {
+    clientId: optionalString(parsed.GITHUB_CLIENT_ID),
+    clientSecret: optionalString(parsed.GITHUB_CLIENT_SECRET),
+  },
+  githubConnectorApp: {
+    appId: optionalString(parsed.GITHUB_CONNECTOR_APP_ID),
+    clientId: optionalString(parsed.GITHUB_CONNECTOR_APP_CLIENT_ID),
+    clientSecret: optionalString(parsed.GITHUB_CONNECTOR_APP_CLIENT_SECRET),
+    privateKey: optionalString(parsed.GITHUB_CONNECTOR_APP_PRIVATE_KEY),
+    webhookSecret: optionalString(parsed.GITHUB_CONNECTOR_APP_WEBHOOK_SECRET),
+  },
+  google: {
+    clientId: optionalString(parsed.GOOGLE_CLIENT_ID),
+    clientSecret: optionalString(parsed.GOOGLE_CLIENT_SECRET),
+  },
+  loops: {
+    apiKey: optionalString(parsed.LOOPS_API_KEY),
+    transactionalIdDenVerifyEmail: optionalString(parsed.LOOPS_TRANSACTIONAL_ID_DEN_VERIFY_EMAIL),
+    transactionalIdDenOrgInviteEmail: optionalString(parsed.LOOPS_TRANSACTIONAL_ID_DEN_ORG_INVITE_EMAIL),
+  },
+  port,
+  workerProxyPort: Number(parsed.WORKER_PROXY_PORT ?? "8789"),
+  corsOrigins,
+  provisionerMode: parsed.PROVISIONER_MODE ?? "daytona",
+  workerUrlTemplate: parsed.WORKER_URL_TEMPLATE,
+  workerActivityBaseUrl:
+    optionalString(parsed.WORKER_ACTIVITY_BASE_URL) ??
+    parsed.BETTER_AUTH_URL.trim().replace(/\/+$/, ""),
+  render: {
+    apiBase: parsed.RENDER_API_BASE ?? "https://api.render.com/v1",
+    apiKey: parsed.RENDER_API_KEY,
+    ownerId: parsed.RENDER_OWNER_ID,
+    workerRepo:
+      parsed.RENDER_WORKER_REPO ?? "https://github.com/different-ai/openwork",
+    workerBranch: parsed.RENDER_WORKER_BRANCH ?? "dev",
+    workerRootDir:
+      parsed.RENDER_WORKER_ROOT_DIR ?? "ee/apps/den-worker-runtime",
+    workerPlan: parsed.RENDER_WORKER_PLAN ?? "standard",
+    workerRegion: parsed.RENDER_WORKER_REGION ?? "oregon",
+    workerOpenworkVersion: parsed.RENDER_WORKER_OPENWORK_VERSION,
+    workerNamePrefix: parsed.RENDER_WORKER_NAME_PREFIX ?? "den-worker",
+    workerPublicDomainSuffix: parsed.RENDER_WORKER_PUBLIC_DOMAIN_SUFFIX,
+    customDomainReadyTimeoutMs: Number(
+      parsed.RENDER_CUSTOM_DOMAIN_READY_TIMEOUT_MS ?? "240000",
+    ),
+    provisionTimeoutMs: Number(parsed.RENDER_PROVISION_TIMEOUT_MS ?? "900000"),
+    healthcheckTimeoutMs: Number(
+      parsed.RENDER_HEALTHCHECK_TIMEOUT_MS ?? "180000",
+    ),
+    pollIntervalMs: Number(parsed.RENDER_POLL_INTERVAL_MS ?? "5000"),
+  },
+  vercel: {
+    apiBase: parsed.VERCEL_API_BASE ?? "https://api.vercel.com",
+    token: parsed.VERCEL_TOKEN,
+    teamId: parsed.VERCEL_TEAM_ID,
+    teamSlug: parsed.VERCEL_TEAM_SLUG,
+    dnsDomain: parsed.VERCEL_DNS_DOMAIN,
+  },
+  polar: {
+    featureGateEnabled: polarFeatureGateEnabled,
+    apiBase: parsed.POLAR_API_BASE ?? "https://api.polar.sh",
+    accessToken: parsed.POLAR_ACCESS_TOKEN,
+    productId: parsed.POLAR_PRODUCT_ID,
+    benefitId: parsed.POLAR_BENEFIT_ID,
+    successUrl: parsed.POLAR_SUCCESS_URL,
+    returnUrl: parsed.POLAR_RETURN_URL,
+  },
+  daytona: {
+    envPath: optionalString(parsed.OPENWORK_DAYTONA_ENV_PATH),
+    apiUrl: optionalString(parsed.DAYTONA_API_URL) ?? "https://app.daytona.io/api",
+    apiKey: optionalString(parsed.DAYTONA_API_KEY),
+    target: optionalString(parsed.DAYTONA_TARGET),
+    snapshot: optionalString(parsed.DAYTONA_SNAPSHOT),
+    image: optionalString(parsed.DAYTONA_SANDBOX_IMAGE) ?? "node:20-bookworm",
+    resources: {
+      cpu: Number(parsed.DAYTONA_SANDBOX_CPU ?? "2"),
+      memory: Number(parsed.DAYTONA_SANDBOX_MEMORY ?? "4"),
+      disk: Number(parsed.DAYTONA_SANDBOX_DISK ?? "8"),
+    },
+    public: daytonaSandboxPublic,
+    autoStopInterval: Number(parsed.DAYTONA_SANDBOX_AUTO_STOP_INTERVAL ?? "0"),
+    autoArchiveInterval: Number(
+      parsed.DAYTONA_SANDBOX_AUTO_ARCHIVE_INTERVAL ?? "10080",
+    ),
+    autoDeleteInterval: Number(
+      parsed.DAYTONA_SANDBOX_AUTO_DELETE_INTERVAL ?? "-1",
+    ),
+    signedPreviewExpiresSeconds: Number(
+      parsed.DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS ?? "86400",
+    ),
+    workerProxyBaseUrl:
+      optionalString(parsed.DAYTONA_WORKER_PROXY_BASE_URL) ?? "https://workers.den.openworklabs",
+    sandboxNamePrefix:
+      optionalString(parsed.DAYTONA_SANDBOX_NAME_PREFIX) ?? "den-daytona-worker",
+    sharedVolumeName:
+      optionalString(parsed.DAYTONA_SHARED_VOLUME_NAME) ??
+      optionalString(parsed.DAYTONA_VOLUME_NAME_PREFIX) ??
+      "den-daytona-workers",
+    workspaceMountPath:
+      optionalString(parsed.DAYTONA_WORKSPACE_MOUNT_PATH) ?? "/workspace",
+    dataMountPath:
+      optionalString(parsed.DAYTONA_DATA_MOUNT_PATH) ?? "/persist/openwork",
+    runtimeWorkspacePath:
+      optionalString(parsed.DAYTONA_RUNTIME_WORKSPACE_PATH) ??
+      "/tmp/openwork-workspace",
+    runtimeDataPath:
+      optionalString(parsed.DAYTONA_RUNTIME_DATA_PATH) ?? "/tmp/openwork-data",
+    sidecarDir:
+      optionalString(parsed.DAYTONA_SIDECAR_DIR) ?? "/tmp/openwork-sidecars",
+    openworkPort: Number(parsed.DAYTONA_OPENWORK_PORT ?? "8787"),
+    opencodePort: Number(parsed.DAYTONA_OPENCODE_PORT ?? "4096"),
+    createTimeoutSeconds: Number(parsed.DAYTONA_CREATE_TIMEOUT_SECONDS ?? "300"),
+    deleteTimeoutSeconds: Number(parsed.DAYTONA_DELETE_TIMEOUT_SECONDS ?? "120"),
+    healthcheckTimeoutMs: Number(
+      parsed.DAYTONA_HEALTHCHECK_TIMEOUT_MS ?? "300000",
+    ),
+    pollIntervalMs: DEN_WORKER_POLL_INTERVAL_MS,
+  },
+}
diff --git a/ee/apps/den-api/src/generated/app-version.ts b/ee/apps/den-api/src/generated/app-version.ts
new file mode 100644
index 0000000000..04fd0ca543
--- /dev/null
+++ b/ee/apps/den-api/src/generated/app-version.ts
@@ -0,0 +1 @@
+export const BUILD_LATEST_APP_VERSION = "0.11.212" as const
diff --git a/ee/apps/den-api/src/index.ts b/ee/apps/den-api/src/index.ts
new file mode 100644
index 0000000000..1bd62f6388
--- /dev/null
+++ b/ee/apps/den-api/src/index.ts
@@ -0,0 +1,3 @@
+import app from "./app.js"
+
+export default app
diff --git a/ee/apps/den-api/src/llm/models-dev.ts b/ee/apps/den-api/src/llm/models-dev.ts
new file mode 100644
index 0000000000..f2eb93d864
--- /dev/null
+++ b/ee/apps/den-api/src/llm/models-dev.ts
@@ -0,0 +1,143 @@
+const MODELS_DEV_API_URL = "https://models.dev/api.json"
+const MODELS_DEV_CACHE_TTL_MS = 1000 * 60 * 10
+
+type JsonRecord = Record<string, unknown>
+
+export type ModelsDevProviderSummary = {
+  id: string
+  name: string
+  npm: string | null
+  env: string[]
+  doc: string | null
+  api: string | null
+  modelCount: number
+}
+
+export type ModelsDevModel = {
+  id: string
+  name: string
+  config: JsonRecord
+}
+
+export type ModelsDevProvider = {
+  id: string
+  name: string
+  npm: string | null
+  env: string[]
+  doc: string | null
+  api: string | null
+  config: JsonRecord
+  models: ModelsDevModel[]
+}
+
+let modelsDevCache:
+  | {
+      expiresAt: number
+      providers: ModelsDevProvider[]
+      providersById: Map<string, ModelsDevProvider>
+    }
+  | null = null
+
+function isRecord(value: unknown): value is JsonRecord {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value : null
+}
+
+function asStringList(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    : []
+}
+
+async function loadModelsDevCatalog() {
+  if (modelsDevCache && modelsDevCache.expiresAt > Date.now()) {
+    return modelsDevCache
+  }
+
+  const response = await fetch(MODELS_DEV_API_URL, {
+    headers: {
+      Accept: "application/json",
+      "User-Agent": "OpenWork Den API",
+    },
+  })
+
+  if (!response.ok) {
+    throw new Error(`models.dev returned ${response.status}`)
+  }
+
+  const payload = await response.json()
+  if (!isRecord(payload)) {
+    throw new Error("models.dev returned an invalid payload")
+  }
+
+  const providers = Object.entries(payload)
+    .map(([providerKey, rawProvider]) => {
+      if (!isRecord(rawProvider)) {
+        return null
+      }
+
+      const providerId = asString(rawProvider.id) ?? providerKey
+      const name = asString(rawProvider.name) ?? providerId
+      const modelsRecord = isRecord(rawProvider.models) ? rawProvider.models : {}
+      const { models: _models, ...providerConfig } = rawProvider
+      const models = Object.entries(modelsRecord)
+        .map(([modelKey, rawModel]) => {
+          if (!isRecord(rawModel)) {
+            return null
+          }
+
+          const modelId = asString(rawModel.id) ?? modelKey
+          const modelName = asString(rawModel.name) ?? modelId
+          return {
+            id: modelId,
+            name: modelName,
+            config: rawModel,
+          } satisfies ModelsDevModel
+        })
+        .filter((entry): entry is ModelsDevModel => entry !== null)
+        .sort((left, right) => left.name.localeCompare(right.name))
+
+      return {
+        id: providerId,
+        name,
+        npm: asString(rawProvider.npm),
+        env: asStringList(rawProvider.env),
+        doc: asString(rawProvider.doc),
+        api: asString(rawProvider.api),
+        config: providerConfig,
+        models,
+      } satisfies ModelsDevProvider
+    })
+    .filter((entry): entry is ModelsDevProvider => entry !== null)
+    .sort((left, right) => left.name.localeCompare(right.name))
+
+  const nextCache = {
+    expiresAt: Date.now() + MODELS_DEV_CACHE_TTL_MS,
+    providers,
+    providersById: new Map(providers.map((provider) => [provider.id, provider])),
+  }
+
+  modelsDevCache = nextCache
+  return nextCache
+}
+
+export async function listModelsDevProviders(): Promise<ModelsDevProviderSummary[]> {
+  const catalog = await loadModelsDevCatalog()
+  return catalog.providers.map((provider) => ({
+    id: provider.id,
+    name: provider.name,
+    npm: provider.npm,
+    env: provider.env,
+    doc: provider.doc,
+    api: provider.api,
+    modelCount: provider.models.length,
+  }))
+}
+
+export async function getModelsDevProvider(providerId: string): Promise<ModelsDevProvider | null> {
+  const catalog = await loadModelsDevCatalog()
+  return catalog.providersById.get(providerId) ?? null
+}
diff --git a/ee/apps/den-api/src/load-env.ts b/ee/apps/den-api/src/load-env.ts
new file mode 100644
index 0000000000..3e3830565f
--- /dev/null
+++ b/ee/apps/den-api/src/load-env.ts
@@ -0,0 +1,15 @@
+import { existsSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import dotenv from "dotenv"
+
+const srcDir = path.dirname(fileURLToPath(import.meta.url))
+const serviceDir = path.resolve(srcDir, "..")
+
+for (const filePath of [path.join(serviceDir, ".env.local"), path.join(serviceDir, ".env")]) {
+  if (existsSync(filePath)) {
+    dotenv.config({ path: filePath, override: false })
+  }
+}
+
+dotenv.config({ override: false })
diff --git a/ee/apps/den-api/src/loops.ts b/ee/apps/den-api/src/loops.ts
new file mode 100644
index 0000000000..626facb21b
--- /dev/null
+++ b/ee/apps/den-api/src/loops.ts
@@ -0,0 +1,121 @@
+import { env } from "./env.js"
+
+const LOOPS_CONTACTS_UPDATE_URL = "https://app.loops.so/api/v1/contacts/update"
+const LOOPS_EVENTS_SEND_URL = "https://app.loops.so/api/v1/events/send"
+const DEN_SIGNUP_SOURCE = "signup"
+const SUBSCRIBED_TO_DEN_EVENT = "subscribedToDen"
+
+function splitName(name: string) {
+  const parts = name.trim().split(/\s+/).filter(Boolean)
+  return {
+    firstName: parts[0] ?? "",
+    lastName: parts.slice(1).join(" ") || undefined,
+  }
+}
+
+export async function syncDenSignupContact(input: {
+  email: string
+  name?: string | null
+}) {
+  const apiKey = env.loops.apiKey
+  if (!apiKey) {
+    return
+  }
+
+  const email = input.email.trim()
+  if (!email) {
+    return
+  }
+
+  const name = input.name?.trim()
+  const { firstName, lastName } = name ? splitName(name) : { firstName: "", lastName: undefined }
+
+  try {
+    const response = await fetch(LOOPS_CONTACTS_UPDATE_URL, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        email,
+        firstName: firstName || undefined,
+        lastName,
+        source: DEN_SIGNUP_SOURCE,
+      }),
+    })
+
+    if (response.ok) {
+      return
+    }
+
+    let detail = `status ${response.status}`
+    try {
+      const payload = (await response.json()) as { message?: string }
+      if (payload.message?.trim()) {
+        detail = payload.message
+      }
+    } catch {
+      // Ignore non-JSON error bodies from Loops.
+    }
+
+    console.warn(`[auth] failed to sync Loops contact for ${email}: ${detail}`)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error"
+    console.warn(`[auth] failed to sync Loops contact for ${email}: ${message}`)
+  }
+}
+
+export async function sendSubscribedToDenEvent(input: {
+  email: string
+  name?: string | null
+}) {
+  const apiKey = env.loops.apiKey
+  if (!apiKey) {
+    return
+  }
+
+  const email = input.email.trim()
+  if (!email) {
+    return
+  }
+
+  const name = input.name?.trim()
+  const { firstName, lastName } = name ? splitName(name) : { firstName: "", lastName: undefined }
+
+  try {
+    const response = await fetch(LOOPS_EVENTS_SEND_URL, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        email,
+        eventName: SUBSCRIBED_TO_DEN_EVENT,
+        firstName: firstName || undefined,
+        lastName,
+        eventProperties: {
+          subscribedAt: new Date().toISOString(),
+        },
+      }),
+    })
+
+    if (!response.ok) {
+      let detail = `status ${response.status}`
+      try {
+        const payload = (await response.json()) as { message?: string }
+        if (payload.message?.trim()) {
+          detail = payload.message
+        }
+      } catch {
+        // Ignore non-JSON error bodies from Loops.
+      }
+
+      console.warn(`[billing] failed to send Loops event ${SUBSCRIBED_TO_DEN_EVENT} for ${email}: ${detail}`)
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error"
+    console.warn(`[billing] failed to send Loops event ${SUBSCRIBED_TO_DEN_EVENT} for ${email}: ${message}`)
+  }
+}
diff --git a/ee/apps/den-api/src/mcp/README.md b/ee/apps/den-api/src/mcp/README.md
new file mode 100644
index 0000000000..0999c3fdd1
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/README.md
@@ -0,0 +1,72 @@
+# Den API MCP Exposure Policy
+
+The MCP catalog is generated from `openapi.json`, then filtered by `policy.ts` before tools are registered.
+
+## Allowed Tags
+
+Every tagged Den API product surface is allowed unless it is listed under blocked tags or blocked operation IDs:
+
+- `API Keys`
+- `Config Objects`
+- `Connectors`
+- `GitHub`
+- `Invitations`
+- `LLM Providers`
+- `Marketplaces`
+- `Members`
+- `Organizations`
+- `Plugins`
+- `Roles`
+- `Skill Hubs`
+- `Skills`
+- `Teams`
+- `Users`
+- `Worker Activity`
+- `Worker Runtime`
+- `Workers`
+
+## Blocked Tags
+
+These tags are intentionally excluded from MCP:
+
+- `Admin`: internal administrative controls should not be broadly exposed as agent tools.
+- `Authentication`: OAuth/session plumbing is used to authorize MCP, not exposed through MCP.
+- `System`: health, docs, and other service metadata are not product actions.
+- `Webhooks`: external webhook ingress routes require provider signatures and should not be invoked by agents.
+
+## Blocked Paths
+
+Routes are blocked if their path:
+
+- starts with `/api/auth`
+- contains `/admin`
+- contains `/webhooks`
+
+This catches auth/admin/webhook routes even if they are untagged or incorrectly tagged.
+
+## Blocked Operation IDs
+
+These individual operations are blocked even though their tags may otherwise be allowed:
+
+- `postApiKeys`: creating API keys returns credentials and should stay behind explicit UI/API flows.
+- `postV1ApiKeys`: generated OpenAPI ID for creating API keys.
+- `deleteApiKeysByApiKeyId`: destructive credential revocation should stay behind explicit UI/API flows.
+- `deleteV1ApiKeysByApiKeyId`: generated OpenAPI ID for deleting API keys, if present.
+- `deleteOrg`: defensive block for organization deletion if a route is added.
+- `deleteV1Org`: defensive block for organization deletion if a route is added.
+- `deleteV1OrgsByOrgId`: defensive block for organization deletion if a route is added.
+- `postWorkersByWorkerIdTokens`: worker token minting returns credentials and should stay behind explicit UI/API flows.
+- `postV1WorkersByWorkerIdTokens`: generated OpenAPI ID for worker token minting.
+
+## Untagged Operations
+
+Untagged operations are excluded by default. Today these are OAuth/MCP discovery and registration routes, for example:
+
+- `/.well-known/oauth-authorization-server`
+- `/.well-known/openid-configuration`
+- `/.well-known/oauth-protected-resource`
+- `/api/auth/oauth2/authorize`
+- `/api/auth/oauth2/register`
+- `/register`
+
+They are required for OAuth/MCP setup, but should not appear as callable MCP tools.
diff --git a/ee/apps/den-api/src/mcp/auth.ts b/ee/apps/den-api/src/mcp/auth.ts
new file mode 100644
index 0000000000..fffd596f15
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/auth.ts
@@ -0,0 +1,167 @@
+import * as crypto from "node:crypto"
+import { eq } from "@openwork-ee/den-db/drizzle"
+import { OAuthAccessTokenTable } from "@openwork-ee/den-db/schema"
+import { verifyJwsAccessToken } from "better-auth/oauth2"
+import {
+  auth,
+  DEN_MCP_OPAQUE_ACCESS_TOKEN_PREFIX,
+  DEN_MCP_ORG_ID_CLAIM,
+  DEN_MCP_RESOURCE,
+  DEN_MCP_RESOURCE_CLAIM,
+  DEN_MCP_RESOURCES,
+  DEN_MCP_TOKEN_USE_CLAIM,
+} from "../auth.js"
+import { db } from "../db.js"
+import { env } from "../env.js"
+
+export type McpPrincipal = {
+  userId: string
+  organizationId: string
+  scopes: Set<string>
+  payload: Record<string, unknown>
+}
+
+export function getMcpResourceUrl(request: Request) {
+  const url = new URL(request.url)
+  const requestResource = `${url.origin}/mcp`
+  return DEN_MCP_RESOURCES.includes(requestResource) ? requestResource : DEN_MCP_RESOURCE
+}
+
+function readBearerToken(headers: Headers) {
+  const authorization = headers.get("authorization")?.trim() ?? ""
+  const match = authorization.match(/^Bearer\s+(.+)$/i)
+  return match?.[1]?.trim() || null
+}
+
+function hashStoredToken(token: string) {
+  return crypto.createHash("sha256").update(token).digest("base64url")
+}
+
+function readStoredScopes(scopes: string) {
+  try {
+    const parsed = JSON.parse(scopes) as unknown
+    if (Array.isArray(parsed)) return parsed.filter((entry): entry is string => typeof entry === "string")
+  } catch {
+    // Older rows or custom stores may keep scopes as a space-delimited string.
+  }
+  return scopes.split(/\s+/).filter(Boolean)
+}
+
+function readScopes(payload: Record<string, unknown>) {
+  const scope = typeof payload.scope === "string" ? payload.scope : ""
+  const scopes = Array.isArray(payload.scopes) ? payload.scopes : []
+  return new Set([
+    ...scope.split(/\s+/).filter(Boolean),
+    ...scopes.filter((entry: unknown): entry is string => typeof entry === "string"),
+  ])
+}
+
+function readStringClaim(payload: Record<string, unknown>, claim: string) {
+  const value = payload[claim]
+  return typeof value === "string" && value.trim() ? value.trim() : null
+}
+
+async function getJwks() {
+  const response = await auth.handler(new Request(`${env.betterAuthUrl}/api/auth/jwks`))
+  if (!response.ok) {
+    throw new Error("Unable to load auth JWKS")
+  }
+  return response.json()
+}
+
+async function verifyJwtMcpToken(token: string) {
+  const payload = await verifyJwsAccessToken(token, {
+    jwksFetch: getJwks,
+    verifyOptions: {
+      issuer: `${env.betterAuthUrl}/api/auth`,
+      audience: DEN_MCP_RESOURCES,
+    },
+  })
+  return payload as Record<string, unknown>
+}
+
+async function verifyOpaqueMcpToken(token: string) {
+  if (!token.startsWith(DEN_MCP_OPAQUE_ACCESS_TOKEN_PREFIX)) {
+    return null
+  }
+
+  const storedToken = hashStoredToken(token.slice(DEN_MCP_OPAQUE_ACCESS_TOKEN_PREFIX.length))
+  const [accessToken] = await db
+    .select()
+    .from(OAuthAccessTokenTable)
+    .where(eq(OAuthAccessTokenTable.token, storedToken))
+    .limit(1)
+
+  if (!accessToken || accessToken.expiresAt <= new Date()) {
+    return null
+  }
+
+  const storedScopes = readStoredScopes(accessToken.scopes)
+  return {
+    sub: accessToken.userId,
+    scope: storedScopes.join(" "),
+    client_id: accessToken.clientId,
+    exp: Math.floor(accessToken.expiresAt.getTime() / 1000),
+    iat: Math.floor(accessToken.createdAt.getTime() / 1000),
+    [DEN_MCP_TOKEN_USE_CLAIM]: "mcp",
+    [DEN_MCP_RESOURCE_CLAIM]: DEN_MCP_RESOURCE,
+    ...(accessToken.referenceId ? { [DEN_MCP_ORG_ID_CLAIM]: accessToken.referenceId } : {}),
+  }
+}
+
+export async function verifyMcpRequest(headers: Headers, resourceUrl = DEN_MCP_RESOURCE): Promise<McpPrincipal | Response> {
+  const token = readBearerToken(headers)
+  if (!token) {
+    return new Response(JSON.stringify({ error: "missing_mcp_token" }), {
+      status: 401,
+      headers: {
+        "content-type": "application/json",
+        "www-authenticate": `Bearer resource_metadata="${resourceUrl}/.well-known/oauth-protected-resource"`,
+      },
+    })
+  }
+
+  const payload = token.includes(".")
+    ? await verifyJwtMcpToken(token).catch(() => null)
+    : await verifyOpaqueMcpToken(token)
+  if (!payload) {
+    return new Response(JSON.stringify({ error: "invalid_mcp_token" }), {
+      status: 401,
+      headers: { "content-type": "application/json" },
+    })
+  }
+
+  const scopes = readScopes(payload)
+  if (!scopes.has("mcp:read") && !scopes.has("mcp:write")) {
+    return new Response(JSON.stringify({ error: "insufficient_mcp_scope" }), {
+      status: 403,
+      headers: { "content-type": "application/json" },
+    })
+  }
+
+  if (readStringClaim(payload, DEN_MCP_TOKEN_USE_CLAIM) !== "mcp") {
+    return new Response(JSON.stringify({ error: "wrong_token_use" }), {
+      status: 403,
+      headers: { "content-type": "application/json" },
+    })
+  }
+
+  const resource = readStringClaim(payload, DEN_MCP_RESOURCE_CLAIM)
+  if (resource && !DEN_MCP_RESOURCES.includes(resource)) {
+    return new Response(JSON.stringify({ error: "wrong_mcp_resource" }), {
+      status: 403,
+      headers: { "content-type": "application/json" },
+    })
+  }
+
+  const userId = typeof payload.sub === "string" ? payload.sub : null
+  const organizationId = readStringClaim(payload, DEN_MCP_ORG_ID_CLAIM)
+  if (!userId || !organizationId) {
+    return new Response(JSON.stringify({ error: "missing_mcp_principal" }), {
+      status: 403,
+      headers: { "content-type": "application/json" },
+    })
+  }
+
+  return { userId, organizationId, scopes, payload }
+}
diff --git a/ee/apps/den-api/src/mcp/catalog.ts b/ee/apps/den-api/src/mcp/catalog.ts
new file mode 100644
index 0000000000..c6a439ad94
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/catalog.ts
@@ -0,0 +1,220 @@
+import type { Hono } from "hono"
+import { z } from "zod"
+import { isMcpOperationAllowed, type OpenApiOperation } from "./policy.js"
+
+const METHODS = new Set(["get", "post", "put", "patch", "delete"])
+
+type OpenApiDocument = {
+  paths?: Record<string, Record<string, OpenApiOperation>>
+}
+
+type OpenApiParameter = {
+  name?: unknown
+  in?: unknown
+  required?: unknown
+  description?: unknown
+  schema?: {
+    type?: unknown
+    format?: unknown
+    enum?: unknown[]
+    default?: unknown
+  }
+}
+
+type OpenApiRequestBody = {
+  required?: unknown
+  content?: unknown
+}
+
+type McpInputSchema = z.ZodObject<Record<string, z.ZodTypeAny>>
+
+export type McpToolOperation = {
+  name: string
+  method: string
+  path: string
+  operation: OpenApiOperation
+  inputSchema: McpInputSchema
+}
+
+function isOpenApiParameter(value: unknown): value is OpenApiParameter {
+  return typeof value === "object" && value !== null
+}
+
+function getParameters(operation: OpenApiOperation, location: "path" | "query") {
+  return (operation.parameters ?? [])
+    .filter(isOpenApiParameter)
+    .filter((parameter) => parameter.in === location && typeof parameter.name === "string" && parameter.name.length > 0)
+}
+
+function schemaForParameter(parameter: OpenApiParameter) {
+  const schema = parameter.schema
+  const type = schema?.type
+  const enumValues = schema?.enum
+
+  let valueSchema: z.ZodTypeAny
+  if (Array.isArray(enumValues) && enumValues.length > 0 && enumValues.every((value): value is string => typeof value === "string")) {
+    valueSchema = z.enum(enumValues as [string, ...string[]])
+  } else if (type === "number" || type === "integer") {
+    valueSchema = z.number()
+  } else if (type === "boolean") {
+    valueSchema = z.boolean()
+  } else {
+    valueSchema = z.string()
+  }
+
+  if (typeof parameter.description === "string" && parameter.description.trim().length > 0) {
+    valueSchema = valueSchema.describe(parameter.description)
+  }
+
+  return valueSchema
+}
+
+function objectForParameters(parameters: OpenApiParameter[], requiredByDefault: boolean) {
+  const shape: Record<string, z.ZodTypeAny> = {}
+
+  for (const parameter of parameters) {
+    const name = parameter.name as string
+    const required = requiredByDefault || parameter.required === true
+    const schema = schemaForParameter(parameter)
+    shape[name] = required ? schema : schema.optional()
+  }
+
+  return z.object(shape).strict()
+}
+
+function pathParameterNamesFromTemplate(path: string) {
+  return [...path.matchAll(/\{([^}]+)\}/g)].map((match) => match[1]).filter(Boolean)
+}
+
+function buildPathSchema(path: string, operation: OpenApiOperation) {
+  const documentedParameters = getParameters(operation, "path")
+  const byName = new Map(documentedParameters.map((parameter) => [parameter.name as string, parameter]))
+  const parameters = pathParameterNamesFromTemplate(path).map((name) => byName.get(name) ?? { name, in: "path", required: true })
+
+  return parameters.length > 0 ? objectForParameters(parameters, true) : undefined
+}
+
+function buildQuerySchema(operation: OpenApiOperation) {
+  const parameters = getParameters(operation, "query")
+  return parameters.length > 0 ? objectForParameters(parameters, false) : undefined
+}
+
+function hasJsonRequestBody(operation: OpenApiOperation) {
+  const requestBody = getRequestBody(operation)
+  const content = requestBody?.content
+  return typeof content === "object" && content !== null && "application/json" in content
+}
+
+function getRequestBody(operation: OpenApiOperation): OpenApiRequestBody | null {
+  const requestBody = operation.requestBody
+  return typeof requestBody === "object" && requestBody !== null ? requestBody : null
+}
+
+function buildInputSchema(path: string, operation: OpenApiOperation) {
+  const shape: Record<string, z.ZodTypeAny> = {}
+  const pathSchema = buildPathSchema(path, operation)
+  const querySchema = buildQuerySchema(operation)
+
+  if (pathSchema) {
+    shape.path = pathSchema.describe("URL path parameters. Put values for route placeholders here, not in body.")
+  }
+
+  if (querySchema) {
+    shape.query = querySchema.describe("URL query string parameters.").optional()
+  }
+
+  if (hasJsonRequestBody(operation)) {
+    const bodySchema = z.unknown().describe("JSON request body fields for this operation.")
+    shape.body = getRequestBody(operation)?.required === true ? bodySchema : bodySchema.optional()
+  }
+
+  return z.object(shape).strict()
+}
+
+function buildInputGuidance(input: McpToolOperation) {
+  const sections: string[] = []
+  const pathNames = pathParameterNamesFromTemplate(input.path)
+  const queryNames = getParameters(input.operation, "query").map((parameter) => parameter.name as string)
+
+  if (pathNames.length > 0) {
+    sections.push(`Path parameters: put ${pathNames.map((name) => `\`${name}\``).join(", ")} under \`path\`.`)
+  }
+
+  if (queryNames.length > 0) {
+    sections.push(`Query parameters: put ${queryNames.map((name) => `\`${name}\``).join(", ")} under \`query\`.`)
+  }
+
+  if (hasJsonRequestBody(input.operation)) {
+    sections.push("Request body: put JSON body fields under `body`. Do not wrap them in `requestBody`.")
+  }
+
+  if (sections.length === 0) {
+    return null
+  }
+
+  return [
+    "MCP input shape:",
+    ...sections,
+    "Do not send OpenAPI wrapper keys like `parameters` or `requestBody`.",
+  ].join("\n")
+}
+
+export async function loadOpenApiDocument(app: Hono, env: unknown): Promise<OpenApiDocument> {
+  const response = await app.fetch(new Request("http://den-api.local/openapi.json"), env)
+  if (!response.ok) {
+    throw new Error(`Unable to load Den OpenAPI document: ${response.status}`)
+  }
+  return response.json() as Promise<OpenApiDocument>
+}
+
+function buildDescription(input: McpToolOperation) {
+  const parts = [
+    input.operation.summary,
+    input.operation.description,
+    `${input.method.toUpperCase()} ${input.path}`,
+    buildInputGuidance(input),
+  ].filter((part): part is string => typeof part === "string" && part.trim().length > 0)
+
+  return parts.join("\n\n")
+}
+
+export function getToolDescription(operation: McpToolOperation) {
+  return buildDescription(operation)
+}
+
+export function buildMcpCatalog(document: OpenApiDocument): McpToolOperation[] {
+  const operations: McpToolOperation[] = []
+  const names = new Set<string>()
+
+  for (const [path, pathItem] of Object.entries(document.paths ?? {})) {
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (!METHODS.has(method.toLowerCase())) {
+        continue
+      }
+
+      if (!isMcpOperationAllowed({ method, path, operation })) {
+        continue
+      }
+
+      const name = operation.operationId
+      if (!name) {
+        continue
+      }
+
+      if (names.has(name)) {
+        throw new Error(`Duplicate MCP tool operationId: ${name}`)
+      }
+      names.add(name)
+
+      operations.push({
+        name,
+        method: method.toUpperCase(),
+        path,
+        operation,
+        inputSchema: buildInputSchema(path, operation),
+      })
+    }
+  }
+
+  return operations.sort((a, b) => a.name.localeCompare(b.name))
+}
diff --git a/ee/apps/den-api/src/mcp/index.ts b/ee/apps/den-api/src/mcp/index.ts
new file mode 100644
index 0000000000..834b85c655
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/index.ts
@@ -0,0 +1,59 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"
+import { StreamableHTTPTransport } from "@hono/mcp"
+import type { Hono } from "hono"
+import { getMcpResourceUrl, verifyMcpRequest } from "./auth.js"
+import { buildMcpCatalog, getToolDescription, loadOpenApiDocument } from "./catalog.js"
+import { invokeMcpOperation } from "./invoke.js"
+
+function protectedResourceMetadata(request: Request) {
+  const resource = getMcpResourceUrl(request)
+  return {
+    resource,
+    authorization_servers: [resource.replace(/\/mcp$/, "/api/auth")],
+    scopes_supported: ["mcp:read", "mcp:write"],
+    bearer_methods_supported: ["header"],
+  }
+}
+
+export function registerMcpRoutes<T extends { Variables: Record<string, unknown> }>(app: Hono<T>) {
+  app.get("/.well-known/oauth-protected-resource", (c) => c.json(protectedResourceMetadata(c.req.raw)))
+  app.get("/.well-known/oauth-protected-resource/mcp", (c) => c.json(protectedResourceMetadata(c.req.raw)))
+  app.get("/mcp/.well-known/oauth-protected-resource", (c) => c.json(protectedResourceMetadata(c.req.raw)))
+
+  app.all("/mcp", async (c) => {
+    const principal = await verifyMcpRequest(c.req.raw.headers, getMcpResourceUrl(c.req.raw))
+    if (principal instanceof Response) {
+      return principal
+    }
+
+    const document = await loadOpenApiDocument(app as unknown as Hono, c.env)
+    const catalog = buildMcpCatalog(document)
+    const server = new McpServer({
+      name: "openwork-den-api",
+      version: "1.0.0",
+    })
+
+    for (const operation of catalog) {
+      server.registerTool(
+        operation.name,
+        {
+          title: operation.operation.summary ?? operation.name,
+          description: getToolDescription(operation),
+          inputSchema: operation.inputSchema,
+        },
+        async (toolInput) => invokeMcpOperation({
+          app: app as unknown as Hono,
+          env: c.env,
+          operation,
+          principal,
+          toolInput,
+        }),
+      )
+    }
+
+    const transport = new StreamableHTTPTransport()
+    await server.connect(transport)
+    const response = await transport.handleRequest(c)
+    return response ?? new Response(null, { status: 204 })
+  })
+}
diff --git a/ee/apps/den-api/src/mcp/invoke.ts b/ee/apps/den-api/src/mcp/invoke.ts
new file mode 100644
index 0000000000..276f8a93c2
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/invoke.ts
@@ -0,0 +1,103 @@
+import type { Hono } from "hono"
+import { createInternalMcpPrincipalHeader } from "../session.js"
+import type { McpPrincipal } from "./auth.js"
+import type { McpToolOperation } from "./catalog.js"
+import { requiredScopeForMethod } from "./policy.js"
+
+type ToolInput = {
+  path?: Record<string, unknown>
+  query?: Record<string, unknown>
+  body?: unknown
+}
+
+function encodeQueryValue(value: unknown) {
+  if (value === null || value === undefined) {
+    return null
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return String(value)
+  }
+  return JSON.stringify(value)
+}
+
+function buildPath(template: string, values: Record<string, unknown>) {
+  return template.replace(/\{([^}]+)\}/g, (_match, key: string) => {
+    const value = values[key]
+    if (value === null || value === undefined) {
+      throw new Error(`Missing path parameter: ${key}`)
+    }
+    return encodeURIComponent(String(value))
+  })
+}
+
+function buildInternalRequest(input: {
+  operation: McpToolOperation
+  toolInput: ToolInput
+  principal: McpPrincipal
+}) {
+  const path = buildPath(input.operation.path, input.toolInput.path ?? {})
+  const url = new URL(path, "http://den-api.local")
+
+  for (const [key, value] of Object.entries(input.toolInput.query ?? {})) {
+    const encoded = encodeQueryValue(value)
+    if (encoded !== null) {
+      url.searchParams.set(key, encoded)
+    }
+  }
+
+  const headers = new Headers({
+    accept: "application/json",
+    "x-den-internal-mcp-principal": createInternalMcpPrincipalHeader({
+      userId: input.principal.userId,
+      organizationId: input.principal.organizationId,
+    }),
+  })
+
+  let body: BodyInit | undefined
+  if (input.operation.method !== "GET" && input.operation.method !== "HEAD" && input.toolInput.body !== undefined) {
+    headers.set("content-type", "application/json")
+    body = JSON.stringify(input.toolInput.body)
+  }
+
+  return new Request(url, {
+    method: input.operation.method,
+    headers,
+    body,
+  })
+}
+
+export async function invokeMcpOperation(input: {
+  app: Hono
+  env: unknown
+  operation: McpToolOperation
+  principal: McpPrincipal
+  toolInput: ToolInput
+}) {
+  const requiredScope = requiredScopeForMethod(input.operation.method)
+  if (!input.principal.scopes.has(requiredScope)) {
+    return {
+      isError: true,
+      content: [{ type: "text" as const, text: JSON.stringify({ error: "insufficient_mcp_scope", requiredScope }) }],
+    }
+  }
+
+  let request: Request
+  try {
+    request = buildInternalRequest(input)
+  } catch (error) {
+    return {
+      isError: true,
+      content: [{ type: "text" as const, text: JSON.stringify({ error: "invalid_tool_input", message: error instanceof Error ? error.message : String(error) }) }],
+    }
+  }
+
+  const response = await input.app.fetch(request, input.env)
+  const contentType = response.headers.get("content-type") ?? ""
+  const payload = contentType.includes("application/json") ? await response.json() : await response.text()
+  const text = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2)
+
+  return {
+    isError: response.status >= 400,
+    content: [{ type: "text" as const, text }],
+  }
+}
diff --git a/ee/apps/den-api/src/mcp/policy.ts b/ee/apps/den-api/src/mcp/policy.ts
new file mode 100644
index 0000000000..605de9631d
--- /dev/null
+++ b/ee/apps/den-api/src/mcp/policy.ts
@@ -0,0 +1,80 @@
+const BLOCKED_TAGS = new Set(["Admin", "Authentication", "System", "Webhooks"])
+const SAFE_INCLUDED_TAGS = new Set([
+  "Users",
+  "Organizations",
+  "Invitations",
+  "API Keys",
+  "Members",
+  "Roles",
+  "Teams",
+  "Templates",
+  "LLM Providers",
+  "Skills",
+  "Skill Hubs",
+  "Workers",
+  "Worker Runtime",
+  "Worker Activity",
+  "Config Objects",
+  "Plugins",
+  "Marketplaces",
+  "Connectors",
+  "GitHub",
+])
+
+const BLOCKED_OPERATION_IDS = new Set([
+  "postApiKeys",
+  "postV1ApiKeys",
+  "deleteApiKeysByApiKeyId",
+  "deleteV1ApiKeysByApiKeyId",
+  "deleteOrg",
+  "deleteV1Org",
+  "deleteV1OrgsByOrgId",
+  "postWorkersByWorkerIdTokens",
+  "postV1WorkersByWorkerIdTokens",
+])
+
+export type OpenApiOperation = {
+  operationId?: string
+  summary?: string
+  description?: string
+  tags?: string[]
+  parameters?: unknown[]
+  requestBody?: unknown
+  security?: unknown
+  [key: string]: unknown
+}
+
+export function isMcpOperationAllowed(input: {
+  method: string
+  path: string
+  operation: OpenApiOperation
+}) {
+  const explicit = input.operation["x-mcp"]
+  if (explicit === false || explicit === "false") {
+    return false
+  }
+
+  const operationId = input.operation.operationId
+  if (!operationId || BLOCKED_OPERATION_IDS.has(operationId)) {
+    return false
+  }
+
+  if (input.path.startsWith("/api/auth") || input.path.includes("/webhooks") || input.path.includes("/admin")) {
+    return false
+  }
+
+  const tags = input.operation.tags ?? []
+  if (tags.some((tag) => BLOCKED_TAGS.has(tag))) {
+    return false
+  }
+
+  if (explicit === true || explicit === "true") {
+    return true
+  }
+
+  return tags.some((tag) => SAFE_INCLUDED_TAGS.has(tag))
+}
+
+export function requiredScopeForMethod(method: string) {
+  return method.toUpperCase() === "GET" ? "mcp:read" : "mcp:write"
+}
diff --git a/ee/apps/den-api/src/middleware/README.md b/ee/apps/den-api/src/middleware/README.md
new file mode 100644
index 0000000000..e6583199fd
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/README.md
@@ -0,0 +1,43 @@
+# Middleware
+
+This folder contains reusable Hono middleware that route areas can compose as needed.
+
+## Files
+
+- `index.ts`: public export surface for all shared middleware
+- `admin.ts`: requires an authenticated allowlisted admin
+- `current-user.ts`: requires an authenticated user
+- `user-organizations.ts`: loads the orgs the current user belongs to
+- `organization-context.ts`: loads org + current member context for `:orgSlug` routes
+- `member-teams.ts`: loads the teams the current org member belongs to
+- `validation.ts`: shared Hono Zod validator wrappers for JSON, query, and params
+
+## Available context
+
+- `c.get("user")`: current authenticated user
+- `c.get("session")`: current Better Auth session
+- `c.get("userOrganizations")`: orgs for the current user
+- `c.get("activeOrganizationId")`
+- `c.get("activeOrganizationSlug")`
+- `c.get("organizationContext")`: org record, current member, members, invites, roles
+- `c.get("memberTeams")`: teams for the current org member
+
+## Usage pattern
+
+Import from `src/middleware/index.ts`:
+
+```ts
+import {
+  jsonValidator,
+  paramValidator,
+  requireUserMiddleware,
+  resolveOrganizationContextMiddleware,
+} from "../../middleware/index.js"
+```
+
+Then compose only what a route needs.
+
+## Rule of thumb
+
+- If a value is broadly useful across multiple route areas, put it here
+- If a helper only exists for one route area, keep it in that route folder instead
diff --git a/ee/apps/den-api/src/middleware/admin.ts b/ee/apps/den-api/src/middleware/admin.ts
new file mode 100644
index 0000000000..2cdf2d17cd
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/admin.ts
@@ -0,0 +1,36 @@
+import { eq } from "@openwork-ee/den-db/drizzle"
+import { AdminAllowlistTable } from "@openwork-ee/den-db/schema"
+import type { MiddlewareHandler } from "hono"
+import { ensureAdminAllowlistSeeded } from "../admin-allowlist.js"
+import { db } from "../db.js"
+import type { AuthContextVariables } from "../session.js"
+
+function normalizeEmail(value: string | null | undefined) {
+  return value?.trim().toLowerCase() ?? ""
+}
+
+export const requireAdminMiddleware: MiddlewareHandler<{ Variables: AuthContextVariables }> = async (c, next) => {
+  const user = c.get("user")
+  if (!user?.id) {
+    return c.json({ error: "unauthorized" }, 401) as never
+  }
+
+  const email = normalizeEmail(user.email)
+  if (!email) {
+    return c.json({ error: "admin_email_required" }, 403) as never
+  }
+
+  await ensureAdminAllowlistSeeded()
+
+  const allowed = await db
+    .select({ id: AdminAllowlistTable.id })
+    .from(AdminAllowlistTable)
+    .where(eq(AdminAllowlistTable.email, email))
+    .limit(1)
+
+  if (allowed.length === 0) {
+    return c.json({ error: "forbidden" }, 403) as never
+  }
+
+  await next()
+}
diff --git a/ee/apps/den-api/src/middleware/current-user.ts b/ee/apps/den-api/src/middleware/current-user.ts
new file mode 100644
index 0000000000..51423635fe
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/current-user.ts
@@ -0,0 +1,10 @@
+import type { MiddlewareHandler } from "hono"
+import type { AuthContextVariables } from "../session.js"
+
+export const requireUserMiddleware: MiddlewareHandler<{ Variables: AuthContextVariables }> = async (c, next) => {
+  if (!c.get("user")?.id) {
+    return c.json({ error: "unauthorized" }, 401) as never
+  }
+
+  await next()
+}
diff --git a/ee/apps/den-api/src/middleware/index.ts b/ee/apps/den-api/src/middleware/index.ts
new file mode 100644
index 0000000000..d59f176073
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/index.ts
@@ -0,0 +1,6 @@
+export * from "./admin.js"
+export * from "./current-user.js"
+export * from "./user-organizations.js"
+export * from "./organization-context.js"
+export * from "./member-teams.js"
+export * from "./validation.js"
diff --git a/ee/apps/den-api/src/middleware/member-teams.ts b/ee/apps/den-api/src/middleware/member-teams.ts
new file mode 100644
index 0000000000..d14b716ca9
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/member-teams.ts
@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono"
+import { listTeamsForMember, type MemberTeamSummary } from "../orgs.js"
+import type { AuthContextVariables } from "../session.js"
+import type { OrganizationContextVariables } from "./organization-context.js"
+
+export type MemberTeamsContext = {
+  memberTeams: MemberTeamSummary[]
+}
+
+export const resolveMemberTeamsMiddleware: MiddlewareHandler<{
+  Variables: AuthContextVariables & Partial<OrganizationContextVariables> & Partial<MemberTeamsContext>
+}> = async (c, next) => {
+  const context = c.get("organizationContext")
+  if (!context) {
+    return c.json({ error: "organization_context_required" }, 500) as never
+  }
+
+  const memberTeams = await listTeamsForMember({
+    organizationId: context.organization.id,
+    memberId: context.currentMember.id,
+  })
+
+  c.set("memberTeams", memberTeams)
+  await next()
+}
diff --git a/ee/apps/den-api/src/middleware/organization-context.ts b/ee/apps/den-api/src/middleware/organization-context.ts
new file mode 100644
index 0000000000..5415893050
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/organization-context.ts
@@ -0,0 +1,91 @@
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { MiddlewareHandler } from "hono"
+import { getApiKeyScopedOrganizationId, isScopedApiKeyForOrganization } from "../api-keys.js"
+import { getOrganizationContextForUser, resolveUserOrganizations, type OrganizationContext } from "../orgs.js"
+import type { AuthContextVariables } from "../session.js"
+import { getLegacyProxyOrganizationId, hydrateSessionActiveOrganization, shouldHydrateSessionActiveOrganization, type UserOrganizationsContext } from "./user-organizations.js"
+
+export type OrganizationContextVariables = {
+  organizationContext: OrganizationContext
+}
+
+export const resolveOrganizationContextMiddleware: MiddlewareHandler<{
+  Variables: AuthContextVariables & Partial<OrganizationContextVariables> & Partial<UserOrganizationsContext>
+}> = async (c, next) => {
+  const user = c.get("user")
+  if (!user?.id) {
+    return c.json({ error: "unauthorized" }, 401) as never
+  }
+
+  const apiKey = c.get("apiKey")
+  const apiKeyScopedOrganizationId = getApiKeyScopedOrganizationId(apiKey)
+  const legacyProxyOrganizationId = getLegacyProxyOrganizationId(c.req.raw.headers)
+  const scopedOrganizationId = apiKeyScopedOrganizationId ?? legacyProxyOrganizationId
+
+  let organizationId = c.get("activeOrganizationId") ?? null
+  let organizationSlug = c.get("activeOrganizationSlug") ?? null
+
+  if (!organizationId) {
+    const session = c.get("session")
+    const resolved = await resolveUserOrganizations({
+      activeOrganizationId: scopedOrganizationId ?? session?.activeOrganizationId ?? null,
+      userId: normalizeDenTypeId("user", user.id),
+    })
+
+    const scopedOrgs = scopedOrganizationId
+      ? resolved.orgs.filter((org) => org.id === scopedOrganizationId)
+      : resolved.orgs
+
+    organizationId = scopedOrganizationId ? scopedOrgs[0]?.id ?? null : resolved.activeOrgId
+    organizationSlug = scopedOrganizationId ? scopedOrgs[0]?.slug ?? null : resolved.activeOrgSlug
+
+    if (shouldHydrateSessionActiveOrganization({
+      scopedOrganizationId: apiKeyScopedOrganizationId,
+      sessionActiveOrganizationId: session?.activeOrganizationId,
+      resolvedActiveOrganizationId: organizationId,
+    })) {
+      await hydrateSessionActiveOrganization(session, organizationId)
+      if (session) {
+        c.set("session", { ...session, activeOrganizationId: organizationId })
+      }
+    }
+
+    c.set("userOrganizations", scopedOrgs)
+    c.set("activeOrganizationId", organizationId)
+    c.set("activeOrganizationSlug", organizationSlug)
+  }
+
+  if (!organizationId) {
+    return c.json({ error: "organization_not_found" }, 404) as never
+  }
+
+  const normalizedOrganizationId = normalizeDenTypeId("organization", organizationId)
+
+  const context = await getOrganizationContextForUser({
+    userId: normalizeDenTypeId("user", user.id),
+    organizationId: normalizedOrganizationId,
+  })
+
+  if (!context) {
+    return c.json({ error: "organization_not_found" }, 404) as never
+  }
+
+  if (apiKey && !isScopedApiKeyForOrganization({ apiKey, organizationId: normalizedOrganizationId })) {
+    return c.json({
+      error: "forbidden",
+      message: "This API key is scoped to a different organization.",
+    }, 403) as never
+  }
+
+  if (apiKey?.metadata?.orgMembershipId && apiKey.metadata.orgMembershipId !== context.currentMember.id) {
+    return c.json({
+      error: "forbidden",
+      message: "This API key is no longer valid for the current organization member.",
+    }, 403) as never
+  }
+
+  c.set("organizationContext", context)
+  c.set("activeOrganizationId", context.organization.id)
+  c.set("activeOrganizationSlug", context.organization.slug)
+  await next()
+}
diff --git a/ee/apps/den-api/src/middleware/user-organizations.ts b/ee/apps/den-api/src/middleware/user-organizations.ts
new file mode 100644
index 0000000000..a539d15039
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/user-organizations.ts
@@ -0,0 +1,94 @@
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { MiddlewareHandler } from "hono"
+import { getApiKeyScopedOrganizationId } from "../api-keys.js"
+import { resolveUserOrganizations, setSessionActiveOrganization, type UserOrgSummary } from "../orgs.js"
+import type { AuthContextVariables } from "../session.js"
+
+export const LEGACY_ORG_PROXY_HEADER = "x-openwork-legacy-org-id"
+
+export type UserOrganizationsContext = {
+  userOrganizations: UserOrgSummary[]
+  activeOrganizationId: string | null
+  activeOrganizationSlug: string | null
+}
+
+type SessionLike = AuthContextVariables["session"]
+
+export function getLegacyProxyOrganizationId(headers: Headers) {
+  const rawOrganizationId = headers.get(LEGACY_ORG_PROXY_HEADER)?.trim()
+  if (!rawOrganizationId) {
+    return null
+  }
+
+  try {
+    return normalizeDenTypeId("organization", rawOrganizationId)
+  } catch {
+    return null
+  }
+}
+
+export function shouldHydrateSessionActiveOrganization(input: {
+  resolvedActiveOrganizationId: string | null
+  scopedOrganizationId: string | null
+  sessionActiveOrganizationId?: string | null
+}) {
+  return !input.scopedOrganizationId && !input.sessionActiveOrganizationId && !!input.resolvedActiveOrganizationId
+}
+
+export async function hydrateSessionActiveOrganization(session: SessionLike, organizationId: string | null) {
+  if (!session?.id || !organizationId || session.activeOrganizationId === organizationId) {
+    return
+  }
+
+  try {
+    const sessionId = normalizeDenTypeId("session", session.id)
+    const normalizedOrganizationId = normalizeDenTypeId("organization", organizationId)
+    await setSessionActiveOrganization(sessionId, normalizedOrganizationId)
+  } catch {
+    return
+  }
+}
+
+export const resolveUserOrganizationsMiddleware: MiddlewareHandler<{
+  Variables: AuthContextVariables & Partial<UserOrganizationsContext>
+}> = async (c, next) => {
+  const user = c.get("user")
+  if (!user?.id) {
+    return c.json({ error: "unauthorized" }, 401) as never
+  }
+
+  const session = c.get("session")
+  const apiKey = c.get("apiKey")
+  const apiKeyScopedOrganizationId = getApiKeyScopedOrganizationId(apiKey)
+  const legacyProxyOrganizationId = getLegacyProxyOrganizationId(c.req.raw.headers)
+  const scopedOrganizationId = apiKeyScopedOrganizationId ?? legacyProxyOrganizationId
+  const resolved = await resolveUserOrganizations({
+    activeOrganizationId: scopedOrganizationId ?? session?.activeOrganizationId ?? null,
+    userId: normalizeDenTypeId("user", user.id),
+  })
+
+  const scopedOrgs = scopedOrganizationId
+    ? resolved.orgs.filter((org) => org.id === scopedOrganizationId)
+    : resolved.orgs
+
+  const activeOrganizationId = scopedOrganizationId ? scopedOrgs[0]?.id ?? null : resolved.activeOrgId
+  const activeOrganizationSlug = scopedOrganizationId
+    ? scopedOrgs[0]?.slug ?? null
+    : resolved.activeOrgSlug
+
+  if (shouldHydrateSessionActiveOrganization({
+    scopedOrganizationId: apiKeyScopedOrganizationId,
+    sessionActiveOrganizationId: session?.activeOrganizationId,
+    resolvedActiveOrganizationId: activeOrganizationId,
+  })) {
+    await hydrateSessionActiveOrganization(session, activeOrganizationId)
+    if (session) {
+      c.set("session", { ...session, activeOrganizationId })
+    }
+  }
+
+  c.set("userOrganizations", scopedOrgs)
+  c.set("activeOrganizationId", activeOrganizationId)
+  c.set("activeOrganizationSlug", activeOrganizationSlug)
+  await next()
+}
diff --git a/ee/apps/den-api/src/middleware/validation.ts b/ee/apps/den-api/src/middleware/validation.ts
new file mode 100644
index 0000000000..4c3e531196
--- /dev/null
+++ b/ee/apps/den-api/src/middleware/validation.ts
@@ -0,0 +1,36 @@
+import { validator as zValidator } from "hono-openapi"
+import type { ZodSchema } from "zod"
+
+function invalidRequestResponse(result: { success: false; error: unknown }, c: { json: (body: unknown, status?: number) => Response }) {
+  return c.json(
+    {
+      error: "invalid_request",
+      details: result.error,
+    },
+    400,
+  )
+}
+
+export function jsonValidator<T extends ZodSchema>(schema: T) {
+  return zValidator("json", schema, (result, c) => {
+    if (!result.success) {
+      return invalidRequestResponse(result, c)
+    }
+  })
+}
+
+export function queryValidator<T extends ZodSchema>(schema: T) {
+  return zValidator("query", schema, (result, c) => {
+    if (!result.success) {
+      return invalidRequestResponse(result, c)
+    }
+  })
+}
+
+export function paramValidator<T extends ZodSchema>(schema: T) {
+  return zValidator("param", schema, (result, c) => {
+    if (!result.success) {
+      return invalidRequestResponse(result, c)
+    }
+  })
+}
diff --git a/ee/apps/den-api/src/openapi.ts b/ee/apps/den-api/src/openapi.ts
new file mode 100644
index 0000000000..6274378838
--- /dev/null
+++ b/ee/apps/den-api/src/openapi.ts
@@ -0,0 +1,114 @@
+import { type DenTypeIdName, typeId } from "@openwork-ee/utils/typeid"
+import { resolver } from "hono-openapi"
+import { z } from "zod"
+
+const TYPE_ID_EXAMPLE_SUFFIX = "01h2xcejqtf2nbrexx3vqjhp41"
+
+function toPascalCase(value: string) {
+  return value
+    .replace(/[^a-zA-Z0-9]+/g, " ")
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("")
+}
+
+export function buildOperationId(method: string, path: string) {
+  const parts = path
+    .split("/")
+    .filter(Boolean)
+    .filter((part) => part !== "v1")
+    .map((part) => {
+      if (part.startsWith(":")) {
+        return `by-${part.slice(1)}`
+      }
+
+      if (part === "*") {
+        return "wildcard"
+      }
+
+      return part
+    })
+
+  return [method.toLowerCase(), ...parts]
+    .map(toPascalCase)
+    .join("")
+    .replace(/^[A-Z]/, (char) => char.toLowerCase())
+}
+
+export function denTypeIdSchema<TName extends DenTypeIdName>(typeName: TName) {
+  const prefix = typeId.prefix[typeName]
+  return typeId.schema(typeName).describe(`Den TypeID with '${prefix}_' prefix.`).meta({
+    description: `Den TypeID with '${prefix}_' prefix and a ${typeId.suffixLength}-character base32 suffix.`,
+    examples: [`${prefix}_${TYPE_ID_EXAMPLE_SUFFIX}`],
+    format: "typeid",
+  })
+}
+
+const validationIssueSchema = z.object({
+  message: z.string(),
+  path: z.array(z.union([z.string(), z.number()])).optional(),
+}).passthrough()
+
+export const invalidRequestSchema = z.object({
+  error: z.literal("invalid_request"),
+  details: z.array(validationIssueSchema),
+}).meta({ ref: "InvalidRequestError" })
+
+export const unauthorizedSchema = z.object({
+  error: z.literal("unauthorized"),
+}).meta({ ref: "UnauthorizedError" })
+
+export const forbiddenSchema = z.object({
+  error: z.literal("forbidden"),
+  message: z.string().optional(),
+}).meta({ ref: "ForbiddenError" })
+
+export const notFoundSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+}).meta({ ref: "NotFoundError" })
+
+export const successSchema = z.object({
+  success: z.literal(true),
+}).meta({ ref: "SuccessResponse" })
+
+export const emptyObjectSchema = z.object({}).passthrough().meta({ ref: "OpaqueObject" })
+
+export function jsonResponse(description: string, schema: z.ZodTypeAny) {
+  return {
+    description,
+    content: {
+      "application/json": {
+        schema: resolver(schema),
+      },
+    },
+  }
+}
+
+export function htmlResponse(description: string) {
+  return {
+    description,
+    content: {
+      "text/html": {
+        schema: resolver(z.string()),
+      },
+    },
+  }
+}
+
+export function textResponse(description: string) {
+  return {
+    description,
+    content: {
+      "text/plain": {
+        schema: resolver(z.string()),
+      },
+    },
+  }
+}
+
+export function emptyResponse(description: string) {
+  return { description }
+}
diff --git a/ee/apps/den-api/src/organization-access.ts b/ee/apps/den-api/src/organization-access.ts
new file mode 100644
index 0000000000..6f2d7a1b2e
--- /dev/null
+++ b/ee/apps/den-api/src/organization-access.ts
@@ -0,0 +1,15 @@
+import { createAccessControl } from "better-auth/plugins/access"
+import { defaultRoles, defaultStatements } from "better-auth/plugins/organization/access"
+
+export const denOrganizationAccess = createAccessControl(defaultStatements)
+
+export const denOrganizationStaticRoles = {
+  owner: defaultRoles.owner,
+  admin: defaultRoles.admin,
+  member: defaultRoles.member,
+} as const
+
+export const denDefaultDynamicOrganizationRoles = {
+  admin: defaultRoles.admin.statements,
+  member: defaultRoles.member.statements,
+} as const
diff --git a/ee/apps/den-api/src/organization-limits.ts b/ee/apps/den-api/src/organization-limits.ts
new file mode 100644
index 0000000000..71728c5416
--- /dev/null
+++ b/ee/apps/den-api/src/organization-limits.ts
@@ -0,0 +1,196 @@
+import { and, eq, gt, sql } from "@openwork-ee/den-db/drizzle"
+import { InvitationTable, MemberTable, OrganizationTable, WorkerTable } from "@openwork-ee/den-db/schema"
+import { db } from "./db.js"
+
+export const DEFAULT_ORGANIZATION_LIMITS = {
+  members: 5,
+  workers: 1,
+} as const
+
+export type OrganizationLimitType = keyof typeof DEFAULT_ORGANIZATION_LIMITS
+
+export type OrganizationLimits = {
+  members: number
+  workers: number
+}
+
+type OrganizationId = typeof OrganizationTable.$inferSelect.id
+
+export type OrganizationMetadata = {
+  limits: OrganizationLimits
+  allowedDesktopVersions?: string[]
+} & Record<string, unknown>
+
+type OrganizationMetadataInput = Record<string, unknown> | string | null | undefined
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function normalizePositiveInteger(value: unknown, fallback: number) {
+  if (typeof value === "number" && Number.isInteger(value) && value > 0) {
+    return value
+  }
+
+  if (typeof value === "string") {
+    const parsed = Number(value)
+    if (Number.isInteger(parsed) && parsed > 0) {
+      return parsed
+    }
+  }
+
+  return fallback
+}
+
+function normalizeDesktopVersionString(value: unknown) {
+  if (typeof value !== "string") {
+    return null
+  }
+
+  const normalized = value.trim().replace(/^v/i, "")
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(normalized)
+    ? normalized
+    : null
+}
+
+function normalizeAllowedDesktopVersions(value: unknown): string[] | null {
+  if (!Array.isArray(value)) {
+    return null
+  }
+
+  const versions = [...new Set(value.map((entry) => normalizeDesktopVersionString(entry)).filter((entry): entry is string => Boolean(entry)))]
+  return versions
+}
+
+function sameStringArray(left: string[] | null, right: string[] | null) {
+  if (left === right) {
+    return true
+  }
+
+  if (!left || !right || left.length !== right.length) {
+    return false
+  }
+
+  return left.every((entry, index) => right[index] === entry)
+}
+
+function parseMetadata(input: OrganizationMetadataInput): Record<string, unknown> {
+  if (!input) {
+    return {}
+  }
+
+  if (typeof input === "string") {
+    try {
+      const parsed = JSON.parse(input) as unknown
+      return isRecord(parsed) ? parsed : {}
+    } catch {
+      return {}
+    }
+  }
+
+  return isRecord(input) ? input : {}
+}
+
+export function normalizeOrganizationMetadata(input: OrganizationMetadataInput): {
+  metadata: OrganizationMetadata
+  changed: boolean
+} {
+  const parsed = parseMetadata(input)
+  const rawLimits = isRecord(parsed.limits) ? parsed.limits : null
+  const allowedDesktopVersions = normalizeAllowedDesktopVersions(parsed.allowedDesktopVersions)
+  const members = normalizePositiveInteger(rawLimits?.members, DEFAULT_ORGANIZATION_LIMITS.members)
+  const workers = normalizePositiveInteger(rawLimits?.workers ?? rawLimits?.Workers, DEFAULT_ORGANIZATION_LIMITS.workers)
+
+  const metadata: OrganizationMetadata = {
+    ...parsed,
+    limits: {
+      members,
+      workers,
+    },
+    ...(allowedDesktopVersions !== null ? { allowedDesktopVersions } : {}),
+  } as OrganizationMetadata
+
+  if (allowedDesktopVersions === null) {
+    delete metadata.allowedDesktopVersions
+  }
+
+  const rawAllowedDesktopVersions = Array.isArray(parsed.allowedDesktopVersions)
+    ? parsed.allowedDesktopVersions.filter((entry): entry is string => typeof entry === "string")
+    : null
+
+  const changed =
+    !isRecord(parsed.limits) ||
+    Object.keys(parsed).length === 0 ||
+    rawLimits?.members !== members ||
+    (rawLimits?.workers ?? rawLimits?.Workers) !== workers ||
+    !sameStringArray(rawAllowedDesktopVersions, allowedDesktopVersions)
+
+  return { metadata, changed }
+}
+
+export function serializeOrganizationMetadata(metadata: OrganizationMetadataInput) {
+  const parsed = parseMetadata(metadata)
+  return Object.keys(parsed).length > 0 ? JSON.stringify(parsed) : null
+}
+
+export async function getOrInitializeOrganizationMetadata(organizationId: OrganizationId) {
+  const rows = await db
+    .select({ metadata: OrganizationTable.metadata })
+    .from(OrganizationTable)
+    .where(eq(OrganizationTable.id, organizationId))
+    .limit(1)
+
+  const { metadata, changed } = normalizeOrganizationMetadata(rows[0]?.metadata)
+  if (changed) {
+    await db
+      .update(OrganizationTable)
+      .set({ metadata })
+      .where(eq(OrganizationTable.id, organizationId))
+  }
+
+  return metadata
+}
+
+async function countOrganizationMembers(organizationId: OrganizationId) {
+  const rows = await db
+    .select({ count: sql<number>`count(*)` })
+    .from(MemberTable)
+    .where(eq(MemberTable.organizationId, organizationId))
+
+  return Number(rows[0]?.count ?? 0)
+}
+
+async function countPendingOrganizationInvitations(organizationId: OrganizationId) {
+  const rows = await db
+    .select({ count: sql<number>`count(*)` })
+    .from(InvitationTable)
+    .where(and(eq(InvitationTable.organizationId, organizationId), eq(InvitationTable.status, "pending"), gt(InvitationTable.expiresAt, new Date())))
+
+  return Number(rows[0]?.count ?? 0)
+}
+
+async function countOrganizationWorkers(organizationId: OrganizationId) {
+  const rows = await db
+    .select({ count: sql<number>`count(*)` })
+    .from(WorkerTable)
+    .where(eq(WorkerTable.org_id, organizationId))
+
+  return Number(rows[0]?.count ?? 0)
+}
+
+export async function getOrganizationLimitStatus(organizationId: OrganizationId, limitType: OrganizationLimitType) {
+  const metadata = await getOrInitializeOrganizationMetadata(organizationId)
+  const currentCount =
+    limitType === "members"
+      ? (await countOrganizationMembers(organizationId)) + (await countPendingOrganizationInvitations(organizationId))
+      : await countOrganizationWorkers(organizationId)
+
+  const limit = metadata.limits[limitType]
+
+  return {
+    metadata,
+    currentCount,
+    limit,
+    exceeded: currentCount >= limit,
+  }
+}
diff --git a/ee/apps/den-api/src/orgs.ts b/ee/apps/den-api/src/orgs.ts
new file mode 100644
index 0000000000..179622021a
--- /dev/null
+++ b/ee/apps/den-api/src/orgs.ts
@@ -0,0 +1,959 @@
+import { and, asc, eq, inArray } from "@openwork-ee/den-db/drizzle"
+import {
+  AuthSessionTable,
+  AuthUserTable,
+  InvitationTable,
+  MemberTable,
+  OrganizationRoleTable,
+  OrganizationTable,
+  TeamMemberTable,
+  TeamTable,
+} from "@openwork-ee/den-db/schema"
+import { normalizeDesktopAppRestrictions, type DesktopAppRestrictions } from "@openwork/types/den/desktop-app-restrictions"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import { db } from "./db.js"
+import { DEFAULT_ORGANIZATION_LIMITS, normalizeOrganizationMetadata, serializeOrganizationMetadata } from "./organization-limits.js"
+import { denDefaultDynamicOrganizationRoles, denOrganizationStaticRoles } from "./organization-access.js"
+
+type UserId = typeof AuthUserTable.$inferSelect.id
+type SessionId = typeof AuthSessionTable.$inferSelect.id
+type OrgId = typeof OrganizationTable.$inferSelect.id
+type MemberRow = typeof MemberTable.$inferSelect
+type MemberId = MemberRow["id"]
+type InvitationRow = typeof InvitationTable.$inferSelect
+export type AllowedEmailDomains = string[] | null
+
+export type InvitationStatus = "pending" | "accepted" | "canceled" | "expired"
+
+export type InvitationPreview = {
+  invitation: {
+    id: string
+    email: string
+    role: string
+    status: InvitationStatus
+    expiresAt: Date
+    createdAt: Date
+  }
+  organization: {
+    id: OrgId
+    name: string
+    slug: string
+    allowedEmailDomains: AllowedEmailDomains
+  }
+}
+
+export type UserOrgSummary = {
+  id: OrgId
+  name: string
+  slug: string
+  logo: string | null
+  metadata: string | null
+  role: string
+  orgMemberId: string
+  membershipId: string
+  createdAt: Date
+  updatedAt: Date
+}
+
+export type OrganizationContext = {
+  organization: {
+    id: OrgId
+    name: string
+    slug: string
+    logo: string | null
+    allowedEmailDomains: AllowedEmailDomains
+    desktopAppRestrictions: DesktopAppRestrictions
+    metadata: string | null
+    createdAt: Date
+    updatedAt: Date
+  }
+  currentMember: {
+    id: MemberId
+    userId: UserId
+    role: string
+    createdAt: Date
+    isOwner: boolean
+  }
+  members: Array<{
+    id: MemberId
+    userId: UserId
+    role: string
+    createdAt: Date
+    isOwner: boolean
+    user: {
+      id: UserId
+      email: string
+      name: string
+      image: string | null
+    }
+  }>
+  invitations: Array<{
+    id: string
+    email: string
+    role: string
+    status: string
+    expiresAt: Date
+    createdAt: Date
+  }>
+  roles: Array<{
+    id: string
+    role: string
+    permission: Record<string, string[]>
+    builtIn: boolean
+    protected: boolean
+    createdAt: Date | null
+    updatedAt: Date | null
+  }>
+  teams: Array<{
+    id: typeof TeamTable.$inferSelect.id
+    name: string
+    createdAt: Date
+    updatedAt: Date
+    memberIds: MemberId[]
+  }>
+}
+
+export type MemberTeamSummary = {
+  id: typeof TeamTable.$inferSelect.id
+  name: string
+  organizationId: typeof TeamTable.$inferSelect.organizationId
+  createdAt: Date
+  updatedAt: Date
+}
+
+function splitRoles(value: string) {
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+}
+
+function hasRole(roleValue: string, roleName: string) {
+  return splitRoles(roleValue).includes(roleName)
+}
+
+export function roleIncludesOwner(roleValue: string) {
+  return hasRole(roleValue, "owner")
+}
+
+function titleCase(value: string) {
+  return value
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ")
+}
+
+function buildPersonalOrgName(input: {
+  name?: string | null
+  email?: string | null
+}) {
+  const normalizedName = input.name?.trim()
+  if (normalizedName) {
+    return `${normalizedName}'s Org`
+  }
+
+  const localPart = input.email?.split("@")[0] ?? "Personal"
+  const normalized = titleCase(localPart.replace(/[._-]+/g, " ").trim()) || "Personal"
+  const suffix = normalized.endsWith("s") ? "' Org" : "'s Org"
+  return `${normalized}${suffix}`
+}
+
+function normalizeEmailDomainValue(value: string) {
+  const normalized = value.trim().toLowerCase().replace(/^@+/, "")
+  if (!normalized) {
+    return null
+  }
+
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(normalized)) {
+    return null
+  }
+
+  return normalized
+}
+
+export function normalizeAllowedEmailDomains(input: readonly string[] | null | undefined): {
+  domains: AllowedEmailDomains
+  invalidDomains: string[]
+} {
+  if (!input || input.length === 0) {
+    return {
+      domains: null,
+      invalidDomains: [],
+    }
+  }
+
+  const normalized = new Set<string>()
+  const invalidDomains: string[] = []
+
+  for (const value of input) {
+    const nextDomain = normalizeEmailDomainValue(value)
+    if (!nextDomain) {
+      invalidDomains.push(value)
+      continue
+    }
+    normalized.add(nextDomain)
+  }
+
+  return {
+    domains: normalized.size > 0 ? [...normalized].sort() : null,
+    invalidDomains,
+  }
+}
+
+function getEmailDomain(email: string) {
+  const normalized = email.trim().toLowerCase()
+  const atIndex = normalized.lastIndexOf("@")
+  if (atIndex === -1 || atIndex + 1 >= normalized.length) {
+    return null
+  }
+  return normalized.slice(atIndex + 1)
+}
+
+export function isEmailAllowedForOrganization(allowedEmailDomains: readonly string[] | null | undefined, email: string) {
+  if (!allowedEmailDomains || allowedEmailDomains.length === 0) {
+    return true
+  }
+
+  const emailDomain = getEmailDomain(email)
+  if (!emailDomain) {
+    return false
+  }
+
+  return allowedEmailDomains.includes(emailDomain)
+}
+
+function normalizeStoredAllowedEmailDomains(value: unknown): AllowedEmailDomains {
+  const values = Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === "string") : null
+  return normalizeAllowedEmailDomains(values).domains
+}
+
+export function parsePermissionRecord(value: string | null) {
+  if (!value) {
+    return {}
+  }
+
+  try {
+    const parsed = JSON.parse(value) as Record<string, unknown>
+    return Object.fromEntries(
+      Object.entries(parsed)
+        .filter((entry): entry is [string, unknown[]] => Array.isArray(entry[1]))
+        .map(([resource, actions]) => [
+          resource,
+          actions.filter((entry: unknown): entry is string => typeof entry === "string"),
+        ]),
+    )
+  } catch {
+    return {}
+  }
+}
+
+export function serializePermissionRecord(value: Record<string, string[]>) {
+  return JSON.stringify(value)
+}
+
+export class OrganizationEmailDomainRestrictionError extends Error {
+  readonly emailDomain: string | null
+  readonly allowedEmailDomains: string[]
+
+  constructor(email: string, allowedEmailDomains: string[]) {
+    const emailDomain = getEmailDomain(email)
+    super(
+      allowedEmailDomains.length === 1
+        ? `This workspace only allows ${allowedEmailDomains[0]} email addresses.`
+        : `This workspace only allows email addresses from these domains: ${allowedEmailDomains.join(", ")}.`,
+    )
+    this.name = "OrganizationEmailDomainRestrictionError"
+    this.emailDomain = emailDomain
+    this.allowedEmailDomains = allowedEmailDomains
+  }
+}
+
+function clonePermissionRecord(value: Record<string, readonly string[]>) {
+  return Object.fromEntries(
+    Object.entries(value).map(([resource, actions]) => [resource, [...actions]]),
+  ) as Record<string, string[]>
+}
+
+async function listMembershipRows(userId: UserId) {
+  return db
+    .select()
+    .from(MemberTable)
+    .where(eq(MemberTable.userId, userId))
+    .orderBy(asc(MemberTable.createdAt))
+}
+
+function getInvitationStatus(invitation: Pick<InvitationRow, "status" | "expiresAt">): InvitationStatus {
+  if (invitation.status !== "pending") {
+    return invitation.status as Exclude<InvitationStatus, "expired">
+  }
+
+  return invitation.expiresAt > new Date() ? "pending" : "expired"
+}
+
+async function getInvitationById(invitationIdRaw: string) {
+  let invitationId
+  try {
+    invitationId = normalizeDenTypeId("invitation", invitationIdRaw)
+  } catch {
+    return null
+  }
+
+  const rows = await db
+    .select()
+    .from(InvitationTable)
+    .where(eq(InvitationTable.id, invitationId))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function ensureDefaultDynamicRoles(orgId: OrgId) {
+  for (const [role, permission] of Object.entries(denDefaultDynamicOrganizationRoles)) {
+    const serializedPermission = serializePermissionRecord(clonePermissionRecord(permission))
+    await db
+      .insert(OrganizationRoleTable)
+      .values({
+        id: createDenTypeId("organizationRole"),
+        organizationId: orgId,
+        role,
+        permission: serializedPermission,
+      })
+      .onDuplicateKeyUpdate({
+        set: {
+          permission: serializedPermission,
+        },
+      })
+  }
+}
+
+function normalizeAssignableRole(input: string, availableRoles: Set<string>) {
+  const roles = splitRoles(input).filter((role) => availableRoles.has(role))
+  if (roles.length === 0) {
+    return "member"
+  }
+  return roles.join(",")
+}
+
+export async function listAssignableRoles(orgId: OrgId) {
+  await ensureDefaultDynamicRoles(orgId)
+
+  const rows = await db
+    .select({ role: OrganizationRoleTable.role })
+    .from(OrganizationRoleTable)
+    .where(eq(OrganizationRoleTable.organizationId, orgId))
+
+  return new Set(rows.map((row) => row.role))
+}
+
+async function insertMemberIfMissing(input: {
+  organizationId: OrgId
+  userId: UserId
+  role: string
+}) {
+  const existing = await db
+    .select()
+    .from(MemberTable)
+    .where(and(eq(MemberTable.organizationId, input.organizationId), eq(MemberTable.userId, input.userId)))
+    .limit(1)
+
+  if (existing.length > 0) {
+    return existing[0]
+  }
+
+  await db.insert(MemberTable).values({
+    id: createDenTypeId("member"),
+    organizationId: input.organizationId,
+    userId: input.userId,
+    role: input.role,
+  })
+
+  const created = await db
+    .select()
+    .from(MemberTable)
+    .where(and(eq(MemberTable.organizationId, input.organizationId), eq(MemberTable.userId, input.userId)))
+    .limit(1)
+
+  if (!created[0]) {
+    throw new Error("failed_to_create_member")
+  }
+
+  return created[0]
+}
+
+async function acceptInvitation(invitation: InvitationRow, userId: UserId) {
+  const availableRoles = await listAssignableRoles(invitation.organizationId)
+  const role = normalizeAssignableRole(invitation.role, availableRoles)
+
+  const member = await insertMemberIfMissing({
+    organizationId: invitation.organizationId,
+    userId,
+    role,
+  })
+
+  if (invitation.teamId) {
+    const teams = await db
+      .select({ id: TeamTable.id })
+      .from(TeamTable)
+      .where(eq(TeamTable.id, invitation.teamId))
+      .limit(1)
+
+    if (teams[0]) {
+      const existingTeamMember = await db
+        .select({ id: TeamMemberTable.id })
+        .from(TeamMemberTable)
+        .where(and(eq(TeamMemberTable.teamId, invitation.teamId), eq(TeamMemberTable.orgMembershipId, member.id)))
+        .limit(1)
+
+      if (!existingTeamMember[0]) {
+        await db.insert(TeamMemberTable).values({
+          id: createDenTypeId("teamMember"),
+          teamId: invitation.teamId,
+          orgMembershipId: member.id,
+        })
+      }
+    }
+  }
+
+  await db
+    .update(InvitationTable)
+    .set({ status: "accepted" })
+    .where(eq(InvitationTable.id, invitation.id))
+
+  return member
+}
+
+export async function acceptInvitationForUser(input: {
+  userId: UserId
+  email: string
+  invitationId: string | null
+}) {
+  if (!input.invitationId) {
+    return null
+  }
+
+  const invitation = await getInvitationById(input.invitationId)
+
+  if (!invitation) {
+    return null
+  }
+
+  if (invitation.email.trim().toLowerCase() !== input.email.trim().toLowerCase()) {
+    return null
+  }
+
+  if (getInvitationStatus(invitation) !== "pending") {
+    return null
+  }
+
+  const organizationRows = await db
+    .select({ allowedEmailDomains: OrganizationTable.allowedEmailDomains })
+    .from(OrganizationTable)
+    .where(eq(OrganizationTable.id, invitation.organizationId))
+    .limit(1)
+
+  const allowedEmailDomains = normalizeStoredAllowedEmailDomains(organizationRows[0]?.allowedEmailDomains)
+  if (!isEmailAllowedForOrganization(allowedEmailDomains, input.email)) {
+    throw new OrganizationEmailDomainRestrictionError(input.email, allowedEmailDomains ?? [])
+  }
+
+  const member = await acceptInvitation(invitation, input.userId)
+  return {
+    invitation,
+    member,
+  }
+}
+
+export async function getInvitationPreview(invitationIdRaw: string): Promise<InvitationPreview | null> {
+  let invitationId
+  try {
+    invitationId = normalizeDenTypeId("invitation", invitationIdRaw)
+  } catch {
+    return null
+  }
+
+  const rows = await db
+    .select({
+      invitation: {
+        id: InvitationTable.id,
+        email: InvitationTable.email,
+        role: InvitationTable.role,
+        status: InvitationTable.status,
+        expiresAt: InvitationTable.expiresAt,
+        createdAt: InvitationTable.createdAt,
+      },
+      organization: {
+        id: OrganizationTable.id,
+        name: OrganizationTable.name,
+        slug: OrganizationTable.slug,
+        allowedEmailDomains: OrganizationTable.allowedEmailDomains,
+      },
+    })
+    .from(InvitationTable)
+    .innerJoin(OrganizationTable, eq(InvitationTable.organizationId, OrganizationTable.id))
+    .where(eq(InvitationTable.id, invitationId))
+    .limit(1)
+
+  const row = rows[0]
+  if (!row) {
+    return null
+  }
+
+  return {
+    invitation: {
+      ...row.invitation,
+      status: getInvitationStatus(row.invitation),
+    },
+    organization: {
+      ...row.organization,
+      allowedEmailDomains: normalizeStoredAllowedEmailDomains(row.organization.allowedEmailDomains),
+    },
+  }
+}
+
+async function createOrganizationRecord(input: {
+  userId: UserId
+  name: string
+  logo?: string | null
+  metadata?: Record<string, unknown> | null
+}) {
+  const organizationId = createDenTypeId("organization")
+  const metadata =
+    input.metadata ?? {
+      limits: {
+        members: DEFAULT_ORGANIZATION_LIMITS.members,
+        workers: DEFAULT_ORGANIZATION_LIMITS.workers,
+      },
+    }
+
+  await db.insert(OrganizationTable).values({
+    id: organizationId,
+    name: input.name,
+    slug: organizationId,
+    logo: input.logo ?? null,
+    metadata,
+  })
+
+  await db.insert(MemberTable).values({
+    id: createDenTypeId("member"),
+    organizationId,
+    userId: input.userId,
+    role: "owner",
+  })
+
+  await ensureDefaultDynamicRoles(organizationId)
+
+  return organizationId
+}
+
+export async function ensureUserOrgAccess(input: {
+  userId: UserId
+}) {
+  const memberships = await listMembershipRows(input.userId)
+  if (memberships.length > 0) {
+    const organizationIds = [...new Set(memberships.map((membership) => membership.organizationId))]
+    await Promise.all(organizationIds.map((organizationId) => ensureDefaultDynamicRoles(organizationId)))
+    return memberships[0].organizationId
+  }
+
+  return null
+}
+
+export async function ensurePersonalOrganizationForUser(userId: UserId) {
+  const existingOrgId = await ensureUserOrgAccess({ userId })
+  if (existingOrgId) {
+    return existingOrgId
+  }
+
+  const userRows = await db
+    .select({
+      name: AuthUserTable.name,
+      email: AuthUserTable.email,
+    })
+    .from(AuthUserTable)
+    .where(eq(AuthUserTable.id, userId))
+    .limit(1)
+
+  const user = userRows[0]
+  const organizationId = await createOrganizationRecord({
+    userId,
+    name: buildPersonalOrgName({
+      name: user?.name,
+      email: user?.email,
+    }),
+  })
+
+  return organizationId
+}
+
+export async function createOrganizationForUser(input: {
+  userId: UserId
+  name: string
+}) {
+  return createOrganizationRecord({
+    userId: input.userId,
+    name: input.name.trim(),
+  })
+}
+
+export async function updateOrganizationName(input: {
+  organizationId: OrgId
+  name: string
+}) {
+  return updateOrganizationSettings({
+    organizationId: input.organizationId,
+    name: input.name,
+  })
+}
+
+export async function updateOrganizationSettings(input: {
+  organizationId: OrgId
+  name?: string
+  allowedEmailDomains?: readonly string[] | null
+  desktopAppRestrictions?: DesktopAppRestrictions
+  allowedDesktopVersions?: readonly string[] | null
+}) {
+  const nextName = typeof input.name === "string" ? input.name.trim() : null
+  if (typeof input.name === "string" && !nextName) {
+    return null
+  }
+
+  const updates: Partial<typeof OrganizationTable.$inferInsert> = {}
+  if (nextName) {
+    updates.name = nextName
+  }
+  if (input.allowedEmailDomains !== undefined) {
+    updates.allowedEmailDomains = normalizeAllowedEmailDomains(input.allowedEmailDomains).domains
+  }
+  if (input.desktopAppRestrictions !== undefined) {
+    updates.desktopAppRestrictions = normalizeDesktopAppRestrictions(input.desktopAppRestrictions)
+  }
+  if (input.allowedDesktopVersions !== undefined) {
+    const rows = await db
+      .select({ metadata: OrganizationTable.metadata })
+      .from(OrganizationTable)
+      .where(eq(OrganizationTable.id, input.organizationId))
+      .limit(1)
+
+    const existingOrganization = rows[0]
+    if (!existingOrganization) {
+      return null
+    }
+
+    const nextMetadata = {
+      ...normalizeOrganizationMetadata(existingOrganization.metadata).metadata,
+    } as Record<string, unknown>
+
+    if (input.allowedDesktopVersions === null) {
+      delete nextMetadata.allowedDesktopVersions
+    } else {
+      nextMetadata.allowedDesktopVersions = input.allowedDesktopVersions
+    }
+
+    updates.metadata = normalizeOrganizationMetadata(nextMetadata).metadata
+  }
+
+  if (Object.keys(updates).length === 0) {
+    return null
+  }
+
+  await db
+    .update(OrganizationTable)
+    .set(updates)
+    .where(eq(OrganizationTable.id, input.organizationId))
+
+  const rows = await db
+    .select()
+    .from(OrganizationTable)
+    .where(eq(OrganizationTable.id, input.organizationId))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+export async function seedDefaultOrganizationRoles(orgId: OrgId) {
+  await ensureDefaultDynamicRoles(orgId)
+}
+
+export async function setSessionActiveOrganization(sessionId: SessionId, organizationId: OrgId | null) {
+  await db
+    .update(AuthSessionTable)
+    .set({ activeOrganizationId: organizationId })
+    .where(eq(AuthSessionTable.id, sessionId))
+}
+
+export async function listUserOrgs(userId: UserId) {
+  const memberships = await db
+    .select({
+      membershipId: MemberTable.id,
+      role: MemberTable.role,
+      organization: {
+        id: OrganizationTable.id,
+        name: OrganizationTable.name,
+        slug: OrganizationTable.slug,
+        logo: OrganizationTable.logo,
+        allowedEmailDomains: OrganizationTable.allowedEmailDomains,
+        desktopAppRestrictions: OrganizationTable.desktopAppRestrictions,
+        metadata: OrganizationTable.metadata,
+        createdAt: OrganizationTable.createdAt,
+        updatedAt: OrganizationTable.updatedAt,
+      },
+    })
+    .from(MemberTable)
+    .innerJoin(OrganizationTable, eq(MemberTable.organizationId, OrganizationTable.id))
+    .where(eq(MemberTable.userId, userId))
+    .orderBy(asc(MemberTable.createdAt))
+
+  return memberships.map((row) => ({
+    id: row.organization.id,
+      name: row.organization.name,
+      slug: row.organization.slug,
+      logo: row.organization.logo,
+      allowedEmailDomains: normalizeStoredAllowedEmailDomains(row.organization.allowedEmailDomains),
+      desktopAppRestrictions: normalizeDesktopAppRestrictions(row.organization.desktopAppRestrictions),
+      metadata: serializeOrganizationMetadata(row.organization.metadata),
+    role: row.role,
+    orgMemberId: row.membershipId,
+    membershipId: row.membershipId,
+    createdAt: row.organization.createdAt,
+    updatedAt: row.organization.updatedAt,
+  })) satisfies UserOrgSummary[]
+}
+
+export async function resolveUserOrganizations(input: {
+  activeOrganizationId?: string | null
+  userId: UserId
+}) {
+  await ensureUserOrgAccess({ userId: input.userId })
+
+  const orgs = await listUserOrgs(input.userId)
+
+  const availableOrgIds = new Set(orgs.map((org) => org.id))
+
+  let activeOrgId: OrgId | null = null
+  if (input.activeOrganizationId) {
+    try {
+      const normalized = normalizeDenTypeId("organization", input.activeOrganizationId)
+      if (availableOrgIds.has(normalized)) {
+        activeOrgId = normalized
+      }
+    } catch {
+      activeOrgId = null
+    }
+  }
+
+  activeOrgId ??= orgs[0]?.id ?? null
+
+  const activeOrg = orgs.find((org) => org.id === activeOrgId) ?? null
+
+  return {
+    orgs,
+    activeOrgId,
+    activeOrgSlug: activeOrg?.slug ?? null,
+  }
+}
+
+export async function getOrganizationContextForUser(input: {
+  userId: UserId
+  organizationId: OrgId
+}) {
+  const organizationRows = await db
+    .select()
+    .from(OrganizationTable)
+    .where(eq(OrganizationTable.id, input.organizationId))
+    .limit(1)
+
+  const organization = organizationRows[0]
+  if (!organization) {
+    return null
+  }
+
+  const currentMemberRows = await db
+    .select()
+    .from(MemberTable)
+    .where(and(eq(MemberTable.organizationId, organization.id), eq(MemberTable.userId, input.userId)))
+    .limit(1)
+
+  const currentMember = currentMemberRows[0]
+  if (!currentMember) {
+    return null
+  }
+
+  await ensureDefaultDynamicRoles(organization.id)
+
+  const members = await db
+    .select({
+      id: MemberTable.id,
+      userId: MemberTable.userId,
+      role: MemberTable.role,
+      createdAt: MemberTable.createdAt,
+      user: {
+        id: AuthUserTable.id,
+        email: AuthUserTable.email,
+        name: AuthUserTable.name,
+        image: AuthUserTable.image,
+      },
+    })
+    .from(MemberTable)
+    .innerJoin(AuthUserTable, eq(MemberTable.userId, AuthUserTable.id))
+    .where(eq(MemberTable.organizationId, organization.id))
+    .orderBy(asc(MemberTable.createdAt))
+
+  const invitations = await db
+    .select({
+      id: InvitationTable.id,
+      email: InvitationTable.email,
+      role: InvitationTable.role,
+      status: InvitationTable.status,
+      expiresAt: InvitationTable.expiresAt,
+      createdAt: InvitationTable.createdAt,
+    })
+    .from(InvitationTable)
+    .where(eq(InvitationTable.organizationId, organization.id))
+    .orderBy(asc(InvitationTable.createdAt))
+
+  const dynamicRoles = await db
+    .select()
+    .from(OrganizationRoleTable)
+    .where(eq(OrganizationRoleTable.organizationId, organization.id))
+    .orderBy(asc(OrganizationRoleTable.createdAt))
+
+  const teams = await listOrganizationTeams(organization.id)
+
+  const builtInDynamicRoleNames = new Set(Object.keys(denDefaultDynamicOrganizationRoles))
+
+  return {
+      organization: {
+        id: organization.id,
+        name: organization.name,
+        slug: organization.slug,
+        logo: organization.logo,
+        allowedEmailDomains: normalizeStoredAllowedEmailDomains(organization.allowedEmailDomains),
+        desktopAppRestrictions: normalizeDesktopAppRestrictions(organization.desktopAppRestrictions),
+        metadata: serializeOrganizationMetadata(organization.metadata),
+        createdAt: organization.createdAt,
+        updatedAt: organization.updatedAt,
+    },
+    currentMember: {
+      id: currentMember.id,
+      userId: currentMember.userId,
+      role: currentMember.role,
+      createdAt: currentMember.createdAt,
+      isOwner: roleIncludesOwner(currentMember.role),
+    },
+    members: members.map((member) => ({
+      ...member,
+      isOwner: roleIncludesOwner(member.role),
+    })),
+    invitations,
+    roles: [
+      {
+        id: "builtin-owner",
+        role: "owner",
+        permission: clonePermissionRecord(denOrganizationStaticRoles.owner.statements),
+        builtIn: true,
+        protected: true,
+        createdAt: null,
+        updatedAt: null,
+      },
+      ...dynamicRoles.map((role) => ({
+        id: role.id,
+        role: role.role,
+        permission: parsePermissionRecord(role.permission),
+        builtIn: builtInDynamicRoleNames.has(role.role),
+        protected: false,
+        createdAt: role.createdAt,
+        updatedAt: role.updatedAt,
+      })),
+    ],
+    teams,
+  } satisfies OrganizationContext
+}
+
+async function listOrganizationTeams(organizationId: OrgId) {
+  const teams = await db
+    .select({
+      id: TeamTable.id,
+      name: TeamTable.name,
+      createdAt: TeamTable.createdAt,
+      updatedAt: TeamTable.updatedAt,
+    })
+    .from(TeamTable)
+    .where(eq(TeamTable.organizationId, organizationId))
+    .orderBy(asc(TeamTable.createdAt))
+
+  if (teams.length === 0) {
+    return []
+  }
+
+  const memberships = await db
+    .select({
+      teamId: TeamMemberTable.teamId,
+      orgMembershipId: TeamMemberTable.orgMembershipId,
+    })
+    .from(TeamMemberTable)
+    .where(inArray(TeamMemberTable.teamId, teams.map((team) => team.id)))
+
+  const memberIdsByTeamId = new Map<typeof TeamTable.$inferSelect.id, MemberId[]>()
+  for (const membership of memberships) {
+    const existing = memberIdsByTeamId.get(membership.teamId) ?? []
+    existing.push(membership.orgMembershipId)
+    memberIdsByTeamId.set(membership.teamId, existing)
+  }
+
+  return teams.map((team) => ({
+    ...team,
+    memberIds: memberIdsByTeamId.get(team.id) ?? [],
+  }))
+}
+
+export async function listTeamsForMember(input: {
+  organizationId: OrgId
+  memberId: MemberRow["id"]
+}) {
+  return db
+    .select({
+      id: TeamTable.id,
+      name: TeamTable.name,
+      organizationId: TeamTable.organizationId,
+      createdAt: TeamTable.createdAt,
+      updatedAt: TeamTable.updatedAt,
+    })
+    .from(TeamMemberTable)
+    .innerJoin(TeamTable, eq(TeamMemberTable.teamId, TeamTable.id))
+    .where(and(eq(TeamTable.organizationId, input.organizationId), eq(TeamMemberTable.orgMembershipId, input.memberId)))
+    .orderBy(asc(TeamTable.createdAt))
+}
+
+export async function removeOrganizationMember(input: {
+  organizationId: OrgId
+  memberId: MemberRow["id"]
+}) {
+  const memberRows = await db
+    .select()
+    .from(MemberTable)
+    .where(and(eq(MemberTable.id, input.memberId), eq(MemberTable.organizationId, input.organizationId)))
+    .limit(1)
+
+  const member = memberRows[0] ?? null
+  if (!member) {
+    return null
+  }
+
+  const teams = await db
+    .select({ id: TeamTable.id })
+    .from(TeamTable)
+    .where(eq(TeamTable.organizationId, input.organizationId))
+
+  await db.transaction(async (tx) => {
+    for (const team of teams) {
+      await tx
+        .delete(TeamMemberTable)
+        .where(and(eq(TeamMemberTable.teamId, team.id), eq(TeamMemberTable.orgMembershipId, member.id)))
+    }
+
+    await tx.delete(MemberTable).where(eq(MemberTable.id, member.id))
+  })
+
+  return member
+}
diff --git a/ee/apps/den-api/src/routes/README.md b/ee/apps/den-api/src/routes/README.md
new file mode 100644
index 0000000000..9976abedd9
--- /dev/null
+++ b/ee/apps/den-api/src/routes/README.md
@@ -0,0 +1,23 @@
+# Routes
+
+This folder groups Den API endpoints by product surface instead of keeping one large router file.
+
+## Layout
+
+- `auth/`: Better Auth mount and desktop handoff routes
+- `me/`: current-user routes that describe the signed-in user and their org access
+- `org/`: organization routes split into focused files by concern
+- `admin/`: admin-only operational endpoints
+- `version/`: public app version metadata for desktop update checks
+- `workers/`: worker lifecycle, runtime, billing, and heartbeat routes
+
+## Conventions
+
+- Each route area exports a single `register...Routes()` function from its `index.ts`
+- Request validation should use Hono Zod validators from `src/middleware/index.ts`
+- Shared auth/org/team context should come from `src/middleware/index.ts`, not from ad hoc request parsing
+- New route areas should get their own folder plus a local `README.md`
+
+## Why this exists
+
+Agents often need to change one endpoint family quickly. Keeping route areas isolated makes it easier to understand ownership and avoid accidental cross-surface regressions.
diff --git a/ee/apps/den-api/src/routes/admin/README.md b/ee/apps/den-api/src/routes/admin/README.md
new file mode 100644
index 0000000000..517fc5e538
--- /dev/null
+++ b/ee/apps/den-api/src/routes/admin/README.md
@@ -0,0 +1,21 @@
+# Admin Routes
+
+This folder owns admin-only Den API surfaces.
+
+## Files
+
+- `index.ts`: currently registers the admin overview endpoint
+
+## Current routes
+
+- `GET /v1/admin/overview`
+
+## Expectations
+
+- Gate all routes with `requireAdminMiddleware`
+- Keep admin reporting logic here instead of mixing it into auth or org routes
+- Prefer query validators for report flags such as `includeBilling`
+
+## Notes
+
+This area is intentionally small for now, but it is its own folder so future admin/reporting endpoints have a clear home.
diff --git a/ee/apps/den-api/src/routes/admin/index.ts b/ee/apps/den-api/src/routes/admin/index.ts
new file mode 100644
index 0000000000..186686a28c
--- /dev/null
+++ b/ee/apps/den-api/src/routes/admin/index.ts
@@ -0,0 +1,322 @@
+import { asc, desc, eq, isNotNull, sql } from "@openwork-ee/den-db/drizzle"
+import { AuthAccountTable, AuthSessionTable, AuthUserTable, WorkerTable, AdminAllowlistTable } from "@openwork-ee/den-db/schema"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { getCloudWorkerAdminBillingStatus } from "../../billing/polar.js"
+import { db } from "../../db.js"
+import { queryValidator, requireAdminMiddleware } from "../../middleware/index.js"
+import { denTypeIdSchema, invalidRequestSchema, jsonResponse, unauthorizedSchema } from "../../openapi.js"
+import type { AuthContextVariables } from "../../session.js"
+
+type UserId = typeof AuthUserTable.$inferSelect.id
+
+const overviewQuerySchema = z.object({
+  includeBilling: z.string().optional(),
+})
+
+const adminOverviewResponseSchema = z.object({
+  viewer: z.object({
+    id: denTypeIdSchema("user"),
+    email: z.string(),
+    name: z.string().nullable(),
+  }),
+  admins: z.array(z.object({}).passthrough()),
+  summary: z.object({}).passthrough(),
+  users: z.array(z.object({}).passthrough()),
+  generatedAt: z.string().datetime(),
+}).meta({ ref: "AdminOverviewResponse" })
+
+function normalizeEmail(value: string | null | undefined) {
+  return value?.trim().toLowerCase() ?? ""
+}
+
+function toNumber(value: unknown) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value
+  }
+
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : 0
+}
+
+function isWithinDays(value: Date | string | null, days: number) {
+  if (!value) {
+    return false
+  }
+
+  const date = value instanceof Date ? value : new Date(value)
+  if (Number.isNaN(date.getTime())) {
+    return false
+  }
+
+  const windowMs = days * 24 * 60 * 60 * 1000
+  return Date.now() - date.getTime() <= windowMs
+}
+
+function normalizeProvider(providerId: string) {
+  const normalized = providerId.trim().toLowerCase()
+  if (!normalized) {
+    return "unknown"
+  }
+
+  if (normalized === "credential" || normalized === "email-password") {
+    return "email"
+  }
+
+  return normalized
+}
+
+function parseBooleanQuery(value: string | undefined): boolean {
+  if (!value) {
+    return false
+  }
+
+  const normalized = value.trim().toLowerCase()
+  return normalized === "1" || normalized === "true" || normalized === "yes"
+}
+
+async function mapWithConcurrency<T, R>(items: T[], limit: number, mapper: (item: T) => Promise<R>) {
+  if (items.length === 0) {
+    return [] as R[]
+  }
+
+  const results = new Array<R>(items.length)
+  let nextIndex = 0
+
+  async function runWorker() {
+    while (nextIndex < items.length) {
+      const currentIndex = nextIndex
+      nextIndex += 1
+      results[currentIndex] = await mapper(items[currentIndex])
+    }
+  }
+
+  const workerCount = Math.max(1, Math.min(limit, items.length))
+  await Promise.all(Array.from({ length: workerCount }, () => runWorker()))
+  return results
+}
+
+export function registerAdminRoutes<T extends { Variables: AuthContextVariables }>(app: Hono<T>) {
+  app.get(
+    "/v1/admin/overview",
+    describeRoute({
+      tags: ["Admin"],
+      summary: "Get admin overview",
+      description: "Returns a high-level administrative overview of users, sessions, workers, admins, and optional billing data for Den operations.",
+      responses: {
+        200: jsonResponse("Administrative overview returned successfully.", adminOverviewResponseSchema),
+        400: jsonResponse("The admin overview query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be an authenticated admin.", unauthorizedSchema),
+      },
+    }),
+    requireAdminMiddleware,
+    queryValidator(overviewQuerySchema),
+    async (c) => {
+    const user = c.get("user")
+    const query = c.req.valid("query")
+    const includeBilling = parseBooleanQuery(query.includeBilling)
+
+    const [admins, users, workerStatsRows, sessionStatsRows, accountRows] = await Promise.all([
+      db
+        .select({
+          email: AdminAllowlistTable.email,
+          note: AdminAllowlistTable.note,
+          createdAt: AdminAllowlistTable.created_at,
+        })
+        .from(AdminAllowlistTable)
+        .orderBy(asc(AdminAllowlistTable.email)),
+      db.select().from(AuthUserTable).orderBy(desc(AuthUserTable.createdAt)),
+      db
+        .select({
+          userId: WorkerTable.created_by_user_id,
+          workerCount: sql<number>`count(*)`,
+          cloudWorkerCount: sql<number>`sum(case when ${WorkerTable.destination} = 'cloud' then 1 else 0 end)`,
+          localWorkerCount: sql<number>`sum(case when ${WorkerTable.destination} = 'local' then 1 else 0 end)`,
+          latestWorkerCreatedAt: sql<Date | null>`max(${WorkerTable.created_at})`,
+        })
+        .from(WorkerTable)
+        .where(isNotNull(WorkerTable.created_by_user_id))
+        .groupBy(WorkerTable.created_by_user_id),
+      db
+        .select({
+          userId: AuthSessionTable.userId,
+          sessionCount: sql<number>`count(*)`,
+          lastSeenAt: sql<Date | null>`max(${AuthSessionTable.updatedAt})`,
+        })
+        .from(AuthSessionTable)
+        .groupBy(AuthSessionTable.userId),
+      db
+        .select({
+          userId: AuthAccountTable.userId,
+          providerId: AuthAccountTable.providerId,
+        })
+        .from(AuthAccountTable),
+    ])
+
+    const workerStatsByUser = new Map<UserId, {
+      workerCount: number
+      cloudWorkerCount: number
+      localWorkerCount: number
+      latestWorkerCreatedAt: Date | string | null
+    }>()
+
+    for (const row of workerStatsRows) {
+      if (!row.userId) {
+        continue
+      }
+
+      workerStatsByUser.set(row.userId, {
+        workerCount: toNumber(row.workerCount),
+        cloudWorkerCount: toNumber(row.cloudWorkerCount),
+        localWorkerCount: toNumber(row.localWorkerCount),
+        latestWorkerCreatedAt: row.latestWorkerCreatedAt,
+      })
+    }
+
+    const sessionStatsByUser = new Map<UserId, {
+      sessionCount: number
+      lastSeenAt: Date | string | null
+    }>()
+
+    for (const row of sessionStatsRows) {
+      sessionStatsByUser.set(row.userId, {
+        sessionCount: toNumber(row.sessionCount),
+        lastSeenAt: row.lastSeenAt,
+      })
+    }
+
+    const providersByUser = new Map<UserId, Set<string>>()
+    for (const row of accountRows) {
+      const providerId = normalizeProvider(row.providerId)
+      const existing = providersByUser.get(row.userId) ?? new Set<string>()
+      existing.add(providerId)
+      providersByUser.set(row.userId, existing)
+    }
+
+    const defaultBilling = {
+      status: "unavailable" as const,
+      featureGateEnabled: false,
+      subscriptionId: null,
+      subscriptionStatus: null,
+      currentPeriodEnd: null,
+      source: "unavailable" as const,
+      note: "Billing lookup unavailable.",
+    }
+
+    const billingRows = includeBilling
+      ? await mapWithConcurrency(users, 4, async (entry) => ({
+          userId: entry.id,
+          billing: await getCloudWorkerAdminBillingStatus({
+            userId: entry.id,
+            email: entry.email,
+            name: entry.name ?? entry.email,
+          }),
+        }))
+      : []
+
+    const billingByUser = new Map(billingRows.map((row) => [row.userId, row.billing]))
+
+    const userRows = users.map((entry) => {
+      const workerStats = workerStatsByUser.get(entry.id) ?? {
+        workerCount: 0,
+        cloudWorkerCount: 0,
+        localWorkerCount: 0,
+        latestWorkerCreatedAt: null,
+      }
+      const sessionStats = sessionStatsByUser.get(entry.id) ?? {
+        sessionCount: 0,
+        lastSeenAt: null,
+      }
+      const authProviders = Array.from(providersByUser.get(entry.id) ?? []).sort()
+
+      return {
+        id: entry.id,
+        name: entry.name,
+        email: entry.email,
+        emailVerified: entry.emailVerified,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+        lastSeenAt: sessionStats.lastSeenAt,
+        sessionCount: sessionStats.sessionCount,
+        authProviders,
+        workerCount: workerStats.workerCount,
+        cloudWorkerCount: workerStats.cloudWorkerCount,
+        localWorkerCount: workerStats.localWorkerCount,
+        latestWorkerCreatedAt: workerStats.latestWorkerCreatedAt,
+        billing: includeBilling ? billingByUser.get(entry.id) ?? defaultBilling : null,
+      }
+    })
+
+    const summary = userRows.reduce(
+      (accumulator, entry) => {
+        accumulator.totalUsers += 1
+        accumulator.totalWorkers += entry.workerCount
+        accumulator.cloudWorkers += entry.cloudWorkerCount
+        accumulator.localWorkers += entry.localWorkerCount
+
+        if (entry.emailVerified) {
+          accumulator.verifiedUsers += 1
+        }
+
+        if (entry.workerCount > 0) {
+          accumulator.usersWithWorkers += 1
+        }
+
+        if (includeBilling && entry.billing) {
+          if (entry.billing.status === "paid") {
+            accumulator.paidUsers += 1
+          } else if (entry.billing.status === "unpaid") {
+            accumulator.unpaidUsers += 1
+          } else {
+            accumulator.billingUnavailableUsers += 1
+          }
+        }
+
+        if (isWithinDays(entry.createdAt, 7)) {
+          accumulator.recentUsers7d += 1
+        }
+
+        if (isWithinDays(entry.createdAt, 30)) {
+          accumulator.recentUsers30d += 1
+        }
+
+        return accumulator
+      },
+      {
+        totalUsers: 0,
+        verifiedUsers: 0,
+        recentUsers7d: 0,
+        recentUsers30d: 0,
+        totalWorkers: 0,
+        cloudWorkers: 0,
+        localWorkers: 0,
+        usersWithWorkers: 0,
+        paidUsers: 0,
+        unpaidUsers: 0,
+        billingUnavailableUsers: 0,
+      },
+    )
+
+    return c.json({
+      viewer: {
+        id: user.id,
+        email: normalizeEmail(user.email),
+        name: user.name,
+      },
+      admins,
+      summary: {
+        ...summary,
+        adminCount: admins.length,
+        billingLoaded: includeBilling,
+        paidUsers: includeBilling ? summary.paidUsers : null,
+        unpaidUsers: includeBilling ? summary.unpaidUsers : null,
+        billingUnavailableUsers: includeBilling ? summary.billingUnavailableUsers : null,
+        usersWithoutWorkers: summary.totalUsers - summary.usersWithWorkers,
+      },
+      users: userRows,
+      generatedAt: new Date().toISOString(),
+    })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/auth/README.md b/ee/apps/den-api/src/routes/auth/README.md
new file mode 100644
index 0000000000..01716c0fd1
--- /dev/null
+++ b/ee/apps/den-api/src/routes/auth/README.md
@@ -0,0 +1,25 @@
+# Auth Routes
+
+This folder owns authentication-related HTTP surfaces.
+
+## Files
+
+- `index.ts`: mounts Better Auth at `/api/auth/*` and registers auth-specific route groups
+- `desktop-handoff.ts`: desktop sign-in handoff flow under `/v1/auth/desktop-handoff*`
+
+## Current responsibilities
+
+- forward Better Auth requests to `auth.handler(c.req.raw)`
+- create short-lived desktop handoff grants
+- exchange a valid handoff grant for a session token
+
+## Expected dependencies
+
+- Better Auth configuration from `src/auth.ts`
+- shared auth/session middleware from `src/session.ts`
+- request validation from `src/middleware/index.ts`
+
+## Notes for future work
+
+- Keep browser auth routes mounted through Better Auth unless there is a strong reason to wrap them
+- Put new auth-adjacent custom endpoints in this folder, not in `me/` or `org/`
diff --git a/ee/apps/den-api/src/routes/auth/desktop-handoff.ts b/ee/apps/den-api/src/routes/auth/desktop-handoff.ts
new file mode 100644
index 0000000000..a2c6347a74
--- /dev/null
+++ b/ee/apps/den-api/src/routes/auth/desktop-handoff.ts
@@ -0,0 +1,281 @@
+import { randomBytes } from "node:crypto"
+import { and, eq, gt, isNull } from "@openwork-ee/den-db/drizzle"
+import { AuthSessionTable, AuthUserTable, DesktopHandoffGrantTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { jsonValidator, requireUserMiddleware } from "../../middleware/index.js"
+import { db } from "../../db.js"
+import { denTypeIdSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import type { AuthContextVariables } from "../../session.js"
+
+const createGrantSchema = z.object({
+  next: z.string().trim().max(128).optional(),
+  desktopScheme: z.string().trim().max(32).optional(),
+})
+
+const exchangeGrantSchema = z.object({
+  grant: z.string().trim().min(12).max(128),
+})
+
+const desktopHandoffGrantResponseSchema = z.object({
+  grant: z.string(),
+  expiresAt: z.string().datetime(),
+  openworkUrl: z.string().url(),
+}).meta({ ref: "DesktopHandoffGrantResponse" })
+
+const desktopHandoffExchangeResponseSchema = z.object({
+  token: z.string(),
+  user: z.object({
+    id: denTypeIdSchema("user"),
+    email: z.string().email(),
+    name: z.string().nullable(),
+  }),
+}).meta({ ref: "DesktopHandoffExchangeResponse" })
+
+const grantNotFoundSchema = z.object({
+  error: z.literal("grant_not_found"),
+  message: z.string(),
+}).meta({ ref: "DesktopHandoffGrantNotFoundError" })
+
+function readSingleHeader(value: string | null) {
+  const first = value?.split(",")[0]?.trim() ?? ""
+  return first || null
+}
+
+function isWebAppHost(hostname: string) {
+  const normalized = hostname.trim().toLowerCase()
+
+  if (
+    normalized === "localhost"
+    || normalized === "0.0.0.0"
+    || normalized === "::1"
+    || normalized === "[::1]"
+    || /^127(?:\.\d{1,3}){3}$/.test(normalized)
+  ) {
+    return true
+  }
+
+  const ipv4Match = normalized.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
+  if (ipv4Match) {
+    const [first, second, third, fourth] = ipv4Match.slice(1).map(Number)
+    const octets = [first, second, third, fourth]
+    if (octets.every((octet) => Number.isInteger(octet) && octet >= 0 && octet <= 255)) {
+      if (
+        first === 10
+        || first === 127
+        || (first === 172 && second >= 16 && second <= 31)
+        || (first === 192 && second === 168)
+        || (first === 169 && second === 254)
+        || (first === 100 && second >= 64 && second <= 127)
+      ) {
+        return true
+      }
+    }
+  }
+
+  return normalized === "app.openworklabs.com"
+    || normalized === "app.openwork.software"
+    || normalized.startsWith("app.")
+}
+
+function withDenProxyPath(origin: string) {
+  const url = new URL(origin)
+  const pathname = url.pathname.replace(/\/+$/, "")
+  if (pathname.toLowerCase().endsWith("/api/den")) {
+    return url.toString().replace(/\/+$/, "")
+  }
+  url.pathname = `${pathname}/api/den`.replace(/\/+/g, "/")
+  return url.toString().replace(/\/+$/, "")
+}
+
+function resolveDesktopDenBaseUrl(request: Request) {
+  const originHeader = readSingleHeader(request.headers.get("origin"))
+  if (originHeader) {
+    try {
+      const originUrl = new URL(originHeader)
+      if ((originUrl.protocol === "https:" || originUrl.protocol === "http:") && isWebAppHost(originUrl.hostname)) {
+        return withDenProxyPath(originUrl.origin)
+      }
+    } catch {
+      // Ignore invalid origins.
+    }
+  }
+
+  const forwardedProto = readSingleHeader(request.headers.get("x-forwarded-proto"))
+  const forwardedHost = readSingleHeader(request.headers.get("x-forwarded-host"))
+  const host = readSingleHeader(request.headers.get("host"))
+  const protocol = forwardedProto ?? new URL(request.url).protocol.replace(/:$/, "")
+  const targetHost = forwardedHost ?? host
+  if (!targetHost) {
+    return "https://app.openworklabs.com/api/den"
+  }
+
+  const origin = `${protocol}://${targetHost}`
+  try {
+    const url = new URL(origin)
+    if (isWebAppHost(url.hostname)) {
+      return withDenProxyPath(url.origin)
+    }
+  } catch {
+    // Ignore invalid forwarded origins.
+  }
+
+  return origin
+}
+
+function buildOpenworkDeepLink(input: {
+  scheme?: string | null
+  grant: string
+  denBaseUrl: string
+}) {
+  const requestedScheme = input.scheme?.trim() || "openwork"
+  const scheme = /^[a-z][a-z0-9+.-]*$/i.test(requestedScheme)
+    ? requestedScheme
+    : "openwork"
+  const url = new URL(`${scheme}://den-auth`)
+  url.searchParams.set("grant", input.grant)
+  url.searchParams.set("denBaseUrl", input.denBaseUrl)
+  return url.toString()
+}
+
+export function registerDesktopAuthRoutes<T extends { Variables: AuthContextVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/auth/desktop-handoff",
+    describeRoute({
+      hide: true,
+      tags: ["Authentication"],
+      summary: "Create desktop handoff grant",
+      description: "Creates a short-lived desktop handoff grant and deep link so a signed-in web user can continue the same account in the OpenWork desktop app.",
+      responses: {
+        200: jsonResponse("Desktop handoff grant created successfully.", desktopHandoffGrantResponseSchema),
+        400: jsonResponse("The handoff request body was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create a desktop handoff grant.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    jsonValidator(createGrantSchema),
+    async (c) => {
+    const user = c.get("user")
+    const session = c.get("session")
+    if (!user?.id || !session?.token) {
+      return c.json({ error: "unauthorized" }, 401)
+    }
+
+    const input = c.req.valid("json")
+
+    const grant = randomBytes(24).toString("base64url")
+    const expiresAt = new Date(Date.now() + 5 * 60 * 1000)
+    await db.insert(DesktopHandoffGrantTable).values({
+      id: grant,
+      user_id: normalizeDenTypeId("user", user.id),
+      session_token: session.token,
+      expires_at: expiresAt,
+      consumed_at: null,
+    })
+
+    const denBaseUrl = resolveDesktopDenBaseUrl(c.req.raw)
+
+    return c.json({
+      grant,
+      expiresAt: expiresAt.toISOString(),
+      openworkUrl: buildOpenworkDeepLink({
+        scheme: input.desktopScheme || "openwork",
+        grant,
+        denBaseUrl,
+      }),
+    })
+    },
+  )
+
+  app.post(
+    "/v1/auth/desktop-handoff/exchange",
+    describeRoute({
+      hide: true,
+      tags: ["Authentication"],
+      summary: "Exchange desktop handoff grant",
+      description: "Exchanges a one-time desktop handoff grant for the user's session token and basic profile so the desktop app can sign the user in.",
+      responses: {
+        200: jsonResponse("Desktop handoff grant exchanged successfully.", desktopHandoffExchangeResponseSchema),
+        400: jsonResponse("The handoff exchange request body was invalid.", invalidRequestSchema),
+        404: jsonResponse("The handoff grant was missing, expired, or already used.", grantNotFoundSchema),
+      },
+    }),
+    jsonValidator(exchangeGrantSchema),
+    async (c) => {
+    const input = c.req.valid("json")
+
+    const now = new Date()
+    const exchange = await db.transaction(async (tx) => {
+      const rows = await tx
+        .select({
+          session: AuthSessionTable,
+          user: AuthUserTable,
+        })
+        .from(DesktopHandoffGrantTable)
+        .innerJoin(AuthSessionTable, eq(DesktopHandoffGrantTable.session_token, AuthSessionTable.token))
+        .innerJoin(AuthUserTable, eq(DesktopHandoffGrantTable.user_id, AuthUserTable.id))
+        .where(
+          and(
+            eq(DesktopHandoffGrantTable.id, input.grant),
+            isNull(DesktopHandoffGrantTable.consumed_at),
+            gt(DesktopHandoffGrantTable.expires_at, now),
+            gt(AuthSessionTable.expiresAt, now),
+          ),
+        )
+        .limit(1)
+
+      const row = rows[0]
+      if (!row) {
+        return null
+      }
+
+      const consumedAt = new Date()
+      await tx
+        .update(DesktopHandoffGrantTable)
+        .set({ consumed_at: consumedAt })
+        .where(
+          and(
+            eq(DesktopHandoffGrantTable.id, input.grant),
+            isNull(DesktopHandoffGrantTable.consumed_at),
+            gt(DesktopHandoffGrantTable.expires_at, now),
+          ),
+        )
+
+      const claimed = await tx
+        .select({ id: DesktopHandoffGrantTable.id })
+        .from(DesktopHandoffGrantTable)
+        .where(
+          and(
+            eq(DesktopHandoffGrantTable.id, input.grant),
+            eq(DesktopHandoffGrantTable.consumed_at, consumedAt),
+          ),
+        )
+        .limit(1)
+
+      if (!claimed[0]) {
+        return null
+      }
+
+      return {
+        token: row.session.token,
+        user: {
+          id: row.user.id,
+          email: row.user.email,
+          name: row.user.name,
+        },
+      }
+    })
+
+    if (!exchange) {
+      return c.json({
+        error: "grant_not_found",
+        message: "This desktop sign-in link is missing, expired, or already used.",
+      }, 404)
+    }
+
+    return c.json(exchange)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/auth/index.ts b/ee/apps/den-api/src/routes/auth/index.ts
new file mode 100644
index 0000000000..5d51b76f68
--- /dev/null
+++ b/ee/apps/den-api/src/routes/auth/index.ts
@@ -0,0 +1,149 @@
+import { eq } from "@openwork-ee/den-db/drizzle"
+import { OAuthClientTable } from "@openwork-ee/den-db/schema"
+import type { Hono } from "hono"
+import { oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata } from "@better-auth/oauth-provider"
+import { describeRoute } from "hono-openapi"
+import { auth } from "../../auth.js"
+import { db } from "../../db.js"
+import { env } from "../../env.js"
+import { emptyResponse } from "../../openapi.js"
+import type { AuthContextVariables } from "../../session.js"
+import { registerDesktopAuthRoutes } from "./desktop-handoff.js"
+
+function rewriteAuthRequest(request: Request, path: string) {
+  const url = new URL(request.url)
+  url.pathname = path
+  return new Request(url, request)
+}
+
+async function rewriteMcpClientRegistrationRequest(request: Request, path: string) {
+  const url = new URL(request.url)
+  url.pathname = path
+
+  const headers = new Headers(request.headers)
+  const contentType = headers.get("content-type")?.toLowerCase() ?? ""
+  if (!contentType.includes("application/json")) {
+    return new Request(url, request)
+  }
+
+  const body = await request.json() as Record<string, unknown>
+  const scope = typeof body.scope === "string" ? body.scope : ""
+  const scopes = new Set(scope.split(/\s+/).filter(Boolean))
+  if (scopes.has("mcp:read") || scopes.has("mcp:write")) {
+    scopes.add("mcp:read")
+    scopes.add("mcp:write")
+    body.scope = Array.from(scopes).join(" ")
+  }
+
+  headers.set("content-type", "application/json")
+  headers.delete("content-length")
+
+  return new Request(url, {
+    method: request.method,
+    headers,
+    body: JSON.stringify(body),
+  })
+}
+
+async function rewriteMetadataOrigin(response: Response, origin: string) {
+  const metadata = await response.json() as Record<string, unknown>
+  const headers = new Headers(response.headers)
+  headers.delete("content-length")
+  headers.set("content-type", "application/json")
+
+  for (const [key, value] of Object.entries(metadata)) {
+    if (typeof value === "string") {
+      metadata[key] = value.replace(env.betterAuthUrl, origin)
+    }
+  }
+
+  return new Response(JSON.stringify(metadata), {
+    status: response.status,
+    headers,
+  })
+}
+
+function requestOrigin(request: Request) {
+  return new URL(request.url).origin
+}
+
+function readStoredClientScopes(scopes: string | null) {
+  if (!scopes) {
+    return []
+  }
+
+  try {
+    const parsed = JSON.parse(scopes) as unknown
+    if (Array.isArray(parsed)) return parsed.filter((entry): entry is string => typeof entry === "string")
+  } catch {}
+
+  return scopes.split(/\s+/).filter(Boolean)
+}
+
+async function ensureMcpClientScopes(request: Request) {
+  const url = new URL(request.url)
+  const requestedScopes = new Set((url.searchParams.get("scope") ?? "").split(/\s+/).filter(Boolean))
+  if (!requestedScopes.has("mcp:read") && !requestedScopes.has("mcp:write")) {
+    return
+  }
+
+  const clientId = url.searchParams.get("client_id")
+  if (!clientId) {
+    return
+  }
+
+  const [client] = await db
+    .select({ scopes: OAuthClientTable.scopes })
+    .from(OAuthClientTable)
+    .where(eq(OAuthClientTable.clientId, clientId))
+    .limit(1)
+  if (!client) {
+    return
+  }
+
+  const scopes = new Set(readStoredClientScopes(client.scopes))
+  if (!scopes.has("mcp:read") && !scopes.has("mcp:write")) {
+    return
+  }
+
+  scopes.add("mcp:read")
+  scopes.add("mcp:write")
+  await db
+    .update(OAuthClientTable)
+    .set({ scopes: JSON.stringify(Array.from(scopes)) })
+    .where(eq(OAuthClientTable.clientId, clientId))
+}
+
+export function registerAuthRoutes<T extends { Variables: AuthContextVariables }>(app: Hono<T>) {
+  app.get("/api/auth/.well-known/oauth-authorization-server", async (c) => rewriteMetadataOrigin(await oauthProviderAuthServerMetadata(auth)(c.req.raw), requestOrigin(c.req.raw)))
+  app.get("/api/auth/.well-known/openid-configuration", async (c) => rewriteMetadataOrigin(await oauthProviderOpenIdConfigMetadata(auth)(c.req.raw), requestOrigin(c.req.raw)))
+  app.get("/.well-known/oauth-authorization-server/api/auth", async (c) => rewriteMetadataOrigin(await oauthProviderAuthServerMetadata(auth)(c.req.raw), requestOrigin(c.req.raw)))
+  app.get("/.well-known/openid-configuration/api/auth", async (c) => rewriteMetadataOrigin(await oauthProviderOpenIdConfigMetadata(auth)(c.req.raw), requestOrigin(c.req.raw)))
+  app.get("/.well-known/oauth-authorization-server", async (c) => rewriteMetadataOrigin(await oauthProviderAuthServerMetadata(auth)(rewriteAuthRequest(c.req.raw, "/api/auth/.well-known/oauth-authorization-server")), requestOrigin(c.req.raw)))
+  app.get("/.well-known/openid-configuration", async (c) => rewriteMetadataOrigin(await oauthProviderOpenIdConfigMetadata(auth)(rewriteAuthRequest(c.req.raw, "/api/auth/.well-known/openid-configuration")), requestOrigin(c.req.raw)))
+  app.post("/register", async (c) => auth.handler(await rewriteMcpClientRegistrationRequest(c.req.raw, "/api/auth/oauth2/register")))
+  app.post("/api/auth/oauth2/register", async (c) => auth.handler(await rewriteMcpClientRegistrationRequest(c.req.raw, "/api/auth/oauth2/register")))
+  app.get("/api/auth/oauth2/authorize", async (c) => {
+    await ensureMcpClientScopes(c.req.raw)
+    return auth.handler(c.req.raw)
+  })
+
+  app.on(
+    ["GET", "POST"],
+    "/api/auth/*",
+    describeRoute({
+      hide: true,
+      tags: ["Authentication"],
+      summary: "Handle Better Auth flow",
+      description: "Proxies Better Auth sign-in, sign-out, session, and verification flows under the Den API auth namespace.",
+      responses: {
+        200: emptyResponse("Better Auth handled the request successfully."),
+        302: emptyResponse("Better Auth redirected the user to continue the auth flow."),
+        400: emptyResponse("Better Auth rejected the request as invalid."),
+        401: emptyResponse("Better Auth rejected the request because authentication failed."),
+      },
+    }),
+    (c) => auth.handler(c.req.raw),
+  )
+  registerDesktopAuthRoutes(app)
+}
diff --git a/ee/apps/den-api/src/routes/me/README.md b/ee/apps/den-api/src/routes/me/README.md
new file mode 100644
index 0000000000..125806bb4b
--- /dev/null
+++ b/ee/apps/den-api/src/routes/me/README.md
@@ -0,0 +1,23 @@
+# Me Routes
+
+This folder owns routes about the currently authenticated user.
+
+## Files
+
+- `index.ts`: registers `/v1/me` and `/v1/me/orgs`
+
+## Current responsibilities
+
+- return the current authenticated user/session payload
+- resolve the orgs the current user belongs to
+- expose active org selection data for the current session
+
+## Middleware expectations
+
+- use `requireUserMiddleware` when a route needs an authenticated user
+- use `resolveUserOrganizationsMiddleware` when a route needs org membership context
+
+## Notes for future work
+
+- Keep this folder focused on the current actor, not arbitrary user admin operations
+- If more current-user subareas appear later, split them into additional files inside this folder
diff --git a/ee/apps/den-api/src/routes/me/index.ts b/ee/apps/den-api/src/routes/me/index.ts
new file mode 100644
index 0000000000..47ec968f4e
--- /dev/null
+++ b/ee/apps/den-api/src/routes/me/index.ts
@@ -0,0 +1,99 @@
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { desktopConfigSchema } from "@openwork/types/den/desktop-app-restrictions"
+import { z } from "zod"
+import { requireUserMiddleware, resolveOrganizationContextMiddleware, resolveUserOrganizationsMiddleware, type OrganizationContextVariables, type UserOrganizationsContext } from "../../middleware/index.js"
+import { denTypeIdSchema, jsonResponse, unauthorizedSchema } from "../../openapi.js"
+import { normalizeOrganizationMetadata } from "../../organization-limits.js"
+import type { AuthContextVariables } from "../../session.js"
+
+const meResponseSchema = z.object({
+  user: z.object({}).passthrough(),
+  session: z.object({}).passthrough(),
+}).meta({ ref: "CurrentUserResponse" })
+
+const meOrganizationsResponseSchema = z.object({
+  orgs: z.array(z.object({
+    id: denTypeIdSchema("organization"),
+    isActive: z.boolean(),
+  }).passthrough()),
+  activeOrgId: denTypeIdSchema("organization").nullable(),
+  activeOrgSlug: z.string().nullable(),
+}).meta({ ref: "CurrentUserOrganizationsResponse" })
+
+const meDesktopConfigResponseSchema = desktopConfigSchema.meta({
+  ref: "CurrentUserDesktopConfigResponse",
+})
+
+export function registerMeRoutes<T extends { Variables: AuthContextVariables & Partial<UserOrganizationsContext> & Partial<OrganizationContextVariables> }>(app: Hono<T>) {
+  app.get(
+    "/v1/me",
+    describeRoute({
+      tags: ["Users"],
+      summary: "Get current user",
+      description: "Returns the currently authenticated user and active session details for the caller.",
+      responses: {
+        200: jsonResponse("Current user and session returned successfully.", meResponseSchema),
+        401: jsonResponse("The caller must be signed in to read profile data.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    (c) => {
+    return c.json({
+      user: c.get("user"),
+      session: c.get("session"),
+    })
+    },
+  )
+
+  app.get(
+    "/v1/me/orgs",
+    describeRoute({
+      tags: ["Users"],
+      summary: "List current user's organizations",
+      description: "Lists the organizations visible to the current user and marks which organization is currently active.",
+      responses: {
+        200: jsonResponse("Current user organizations returned successfully.", meOrganizationsResponseSchema),
+      },
+    }),
+    resolveUserOrganizationsMiddleware,
+    (c) => {
+    const orgs = (c.get("userOrganizations") ?? []) as NonNullable<UserOrganizationsContext["userOrganizations"]>
+
+    return c.json({
+      orgs: orgs.map((org) => ({
+        ...org,
+        isActive: org.id === c.get("activeOrganizationId"),
+      })),
+      activeOrgId: c.get("activeOrganizationId") ?? null,
+      activeOrgSlug: c.get("activeOrganizationSlug") ?? null,
+    })
+    },
+  )
+
+  app.get(
+    "/v1/me/desktop-config",
+    describeRoute({
+      tags: ["Users"],
+      summary: "Get current user's desktop config",
+      description: "Returns the authenticated desktop app restrictions for the caller's active organization.",
+      responses: {
+        200: jsonResponse("Current user desktop config returned successfully.", meDesktopConfigResponseSchema),
+        401: jsonResponse("The caller must be signed in to read desktop config.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    (c) => {
+      const organization = c.get("organizationContext").organization
+      const metadata = normalizeOrganizationMetadata(organization.metadata).metadata
+
+      return c.json({
+        ...organization.desktopAppRestrictions,
+        ...(Array.isArray(metadata.allowedDesktopVersions)
+          ? { allowedDesktopVersions: metadata.allowedDesktopVersions }
+          : {}),
+      })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/README.md b/ee/apps/den-api/src/routes/org/README.md
new file mode 100644
index 0000000000..139936c943
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/README.md
@@ -0,0 +1,41 @@
+# Org Routes
+
+This folder owns organization-facing Den API routes.
+
+## Files
+
+- `index.ts`: registers all org route groups
+- `core.ts`: org creation, invitation preview/accept, and org context
+- `invitations.ts`: invitation creation and cancellation
+- `members.ts`: member role updates and member removal
+- `roles.ts`: dynamic role CRUD
+- `templates.ts`: shared template CRUD
+- `shared.ts`: shared route-local helpers, param schemas, and guard helpers
+
+## Active organization model
+
+- `POST /api/auth/organization/set-active` is the only Better Auth endpoint that should switch the user's active org explicitly.
+- New sessions should get an initial `activeOrganizationId` from Better Auth session creation hooks in `src/auth.ts`.
+- `GET /v1/org` returns the active organization from the current session, including a nested `organization.owner` object plus the current member and team context.
+- `POST /v1/org` creates a new organization and switches the session to it. `PATCH /v1/org` updates the active organization.
+- Active-org scoped resources should prefer top-level routes like `/v1/skills`, `/v1/teams`, `/v1/roles`, `/v1/api-keys`, `/v1/llm-providers`, and plugin-system `/v1/...` routes. They should not require `:orgId` or `:orgSlug` in the path.
+- Routes under `/v1/orgs/**` are reserved for cross-org flows that are not tied to the active workspace yet, such as invitation preview/accept.
+- If a client needs to change workspaces, it should call Better Auth set-active first, then use the active-org scoped `/v1/...` resource routes.
+
+## Middleware expectations
+
+- `requireUserMiddleware`: the route requires a signed-in user
+- `resolveOrganizationContextMiddleware`: the route needs the current org and member context
+- `resolveMemberTeamsMiddleware`: the route needs the teams for the current org member
+
+Import these from `src/middleware/index.ts` so route files stay consistent.
+
+## Validation expectations
+
+- Query, JSON body, and params should use Hono Zod validators
+- Route files should read validated input with `c.req.valid(...)`
+- Avoid direct `c.req.param()`, `c.req.query()`, or manual `safeParse()` in route handlers
+
+## Why this is split up
+
+The org surface is the largest migrated area so far. Splitting by concern keeps edits small and lets agents change invitations, members, roles, or templates without scanning one giant router file.
diff --git a/ee/apps/den-api/src/routes/org/api-keys.ts b/ee/apps/den-api/src/routes/org/api-keys.ts
new file mode 100644
index 0000000000..87b1dc023a
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/api-keys.ts
@@ -0,0 +1,328 @@
+import type { Hono } from "hono"
+import { describeRoute, resolver } from "hono-openapi"
+import { z } from "zod"
+import {
+  buildOrganizationApiKeyMetadata,
+  deleteOrganizationApiKey,
+  DEN_API_KEY_RATE_LIMIT_MAX,
+  DEN_API_KEY_RATE_LIMIT_TIME_WINDOW_MS,
+  listOrganizationApiKeys,
+} from "../../api-keys.js"
+import { jsonValidator, paramValidator, requireUserMiddleware, resolveOrganizationContextMiddleware } from "../../middleware/index.js"
+import { denTypeIdSchema } from "../../openapi.js"
+import { auth } from "../../auth.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { ensureApiKeyManager, idParamSchema } from "./shared.js"
+
+const createOrganizationApiKeySchema = z.object({
+  name: z.string().trim().min(2).max(64),
+}).meta({ ref: "CreateOrganizationApiKeyRequest" })
+
+const validationIssueSchema = z.object({
+  message: z.string(),
+  path: z.array(z.union([z.string(), z.number()])).optional(),
+}).passthrough()
+
+const invalidRequestSchema = z.object({
+  error: z.literal("invalid_request"),
+  details: z.array(validationIssueSchema),
+}).meta({ ref: "InvalidRequestError" })
+
+const unauthorizedSchema = z.object({
+  error: z.literal("unauthorized"),
+}).meta({ ref: "UnauthorizedError" })
+
+const organizationNotFoundSchema = z.object({
+  error: z.literal("organization_not_found"),
+}).meta({ ref: "OrganizationNotFoundError" })
+
+const forbiddenApiKeyManagerSchema = z.object({
+  error: z.literal("forbidden"),
+  message: z.string(),
+}).meta({ ref: "OrganizationApiKeyForbiddenError" })
+
+const apiKeyNotFoundSchema = z.object({
+  error: z.literal("api_key_not_found"),
+}).meta({ ref: "OrganizationApiKeyNotFoundError" })
+
+const apiKeyOwnerSchema = z.object({
+  userId: denTypeIdSchema("user"),
+  memberId: denTypeIdSchema("member"),
+  name: z.string(),
+  email: z.string().email(),
+  image: z.string().nullable(),
+}).meta({ ref: "OrganizationApiKeyOwner" })
+
+const organizationApiKeySchema = z.object({
+  id: z.string(),
+  configId: z.string(),
+  name: z.string().nullable(),
+  start: z.string().nullable(),
+  prefix: z.string().nullable(),
+  enabled: z.boolean(),
+  rateLimitEnabled: z.boolean(),
+  rateLimitMax: z.number().int().nullable(),
+  rateLimitTimeWindow: z.number().int().nullable(),
+  lastRequest: z.string().datetime().nullable(),
+  expiresAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  owner: apiKeyOwnerSchema,
+}).meta({ ref: "OrganizationApiKey" })
+
+const organizationApiKeyListResponseSchema = z.object({
+  apiKeys: z.array(organizationApiKeySchema),
+}).meta({ ref: "OrganizationApiKeyListResponse" })
+
+const createdOrganizationApiKeySchema = z.object({
+  id: z.string(),
+  name: z.string().nullable(),
+  start: z.string().nullable(),
+  prefix: z.string().nullable(),
+  enabled: z.boolean(),
+  rateLimitEnabled: z.boolean(),
+  rateLimitMax: z.number().int().nullable(),
+  rateLimitTimeWindow: z.number().int().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+}).meta({ ref: "CreatedOrganizationApiKey" })
+
+const createOrganizationApiKeyResponseSchema = z.object({
+  apiKey: createdOrganizationApiKeySchema,
+  key: z.string().min(1),
+}).meta({ ref: "CreateOrganizationApiKeyResponse" })
+
+const apiKeyIdParamSchema = idParamSchema("apiKeyId")
+const hideApiKeyGenerationRoute = () => process.env.NODE_ENV === "production"
+
+export function registerOrgApiKeyRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.get(
+    "/v1/api-keys",
+    describeRoute({
+      tags: ["API Keys"],
+      summary: "List organization API keys",
+      description: "Returns the API keys that belong to the selected organization.",
+      security: [{ bearerAuth: [] }],
+      responses: {
+        200: {
+          description: "Organization API keys",
+          content: {
+            "application/json": {
+              schema: resolver(organizationApiKeyListResponseSchema),
+            },
+          },
+        },
+        400: {
+          description: "Invalid request",
+          content: {
+            "application/json": {
+              schema: resolver(invalidRequestSchema),
+            },
+          },
+        },
+        401: {
+          description: "Unauthorized",
+          content: {
+            "application/json": {
+              schema: resolver(unauthorizedSchema),
+            },
+          },
+        },
+        403: {
+          description: "Only workspace owners and admins can list API keys.",
+          content: {
+            "application/json": {
+              schema: resolver(forbiddenApiKeyManagerSchema),
+            },
+          },
+        },
+        404: {
+          description: "Organization not found",
+          content: {
+            "application/json": {
+              schema: resolver(organizationNotFoundSchema),
+            },
+          },
+        },
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const access = ensureApiKeyManager(c)
+      if (!access.ok) {
+        return c.json(access.response, access.response.error === "forbidden" ? 403 : 404)
+      }
+
+      const payload = c.get("organizationContext")
+      const apiKeys = await listOrganizationApiKeys(payload.organization.id)
+      return c.json({ apiKeys })
+    },
+  )
+
+  app.post(
+    "/v1/api-keys",
+    describeRoute({
+      tags: ["API Keys"],
+      summary: "Create an organization API key",
+      description: "Creates a new API key for the selected organization.",
+      hide: hideApiKeyGenerationRoute,
+      security: [{ bearerAuth: [] }],
+      responses: {
+        201: {
+          description: "Organization API key created",
+          content: {
+            "application/json": {
+              schema: resolver(createOrganizationApiKeyResponseSchema),
+            },
+          },
+        },
+        400: {
+          description: "Invalid request",
+          content: {
+            "application/json": {
+              schema: resolver(invalidRequestSchema),
+            },
+          },
+        },
+        401: {
+          description: "Unauthorized",
+          content: {
+            "application/json": {
+              schema: resolver(unauthorizedSchema),
+            },
+          },
+        },
+        403: {
+          description: "Only workspace owners and admins can create API keys.",
+          content: {
+            "application/json": {
+              schema: resolver(forbiddenApiKeyManagerSchema),
+            },
+          },
+        },
+        404: {
+          description: "Organization not found",
+          content: {
+            "application/json": {
+              schema: resolver(organizationNotFoundSchema),
+            },
+          },
+        },
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(createOrganizationApiKeySchema),
+    async (c) => {
+      const access = ensureApiKeyManager(c)
+      if (!access.ok) {
+        return c.json(access.response, access.response.error === "forbidden" ? 403 : 404)
+      }
+
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+      const created = await auth.api.createApiKey({
+        body: {
+          userId: payload.currentMember.userId,
+          name: input.name,
+          metadata: buildOrganizationApiKeyMetadata({
+            organizationId: payload.organization.id,
+            orgMembershipId: payload.currentMember.id,
+            issuedByUserId: payload.currentMember.userId,
+            issuedByOrgMembershipId: payload.currentMember.id,
+          }),
+          rateLimitEnabled: true,
+          rateLimitMax: DEN_API_KEY_RATE_LIMIT_MAX,
+          rateLimitTimeWindow: DEN_API_KEY_RATE_LIMIT_TIME_WINDOW_MS,
+        },
+      })
+
+      return c.json({
+        apiKey: {
+          id: created.id,
+          name: created.name,
+          start: created.start,
+          prefix: created.prefix,
+          enabled: created.enabled,
+          rateLimitEnabled: created.rateLimitEnabled,
+          rateLimitMax: created.rateLimitMax,
+          rateLimitTimeWindow: created.rateLimitTimeWindow,
+          createdAt: created.createdAt,
+          updatedAt: created.updatedAt,
+        },
+        key: created.key,
+      }, 201)
+    },
+  )
+
+  app.delete(
+    "/v1/api-keys/:apiKeyId",
+    describeRoute({
+      tags: ["API Keys"],
+      hide: true,
+      summary: "Delete an organization API key",
+      description: "Deletes an API key from the selected organization.",
+      security: [{ bearerAuth: [] }],
+      responses: {
+        204: {
+          description: "Organization API key deleted",
+        },
+        400: {
+          description: "Invalid request",
+          content: {
+            "application/json": {
+              schema: resolver(invalidRequestSchema),
+            },
+          },
+        },
+        401: {
+          description: "Unauthorized",
+          content: {
+            "application/json": {
+              schema: resolver(unauthorizedSchema),
+            },
+          },
+        },
+        403: {
+          description: "Only workspace owners and admins can delete API keys.",
+          content: {
+            "application/json": {
+              schema: resolver(forbiddenApiKeyManagerSchema),
+            },
+          },
+        },
+        404: {
+          description: "API key or organization not found",
+          content: {
+            "application/json": {
+              schema: resolver(z.union([organizationNotFoundSchema, apiKeyNotFoundSchema])),
+            },
+          },
+        },
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(apiKeyIdParamSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const access = ensureApiKeyManager(c)
+      if (!access.ok) {
+        return c.json(access.response, access.response.error === "forbidden" ? 403 : 404)
+      }
+
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const deleted = await deleteOrganizationApiKey({
+        organizationId: payload.organization.id,
+        apiKeyId: params.apiKeyId,
+      })
+
+      if (!deleted) {
+        return c.json({ error: "api_key_not_found" }, 404)
+      }
+
+      return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/core.ts b/ee/apps/den-api/src/routes/org/core.ts
new file mode 100644
index 0000000000..3d9d5724a0
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/core.ts
@@ -0,0 +1,395 @@
+import { eq } from "@openwork-ee/den-db/drizzle"
+import { OrganizationTable } from "@openwork-ee/den-db/schema"
+import { desktopAppRestrictionsSchema } from "@openwork/types/den/desktop-app-restrictions"
+import { normalizeDenTypeId, type DenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { auth } from "../../auth.js"
+import { requireCloudWorkerAccess } from "../../billing/polar.js"
+import { db } from "../../db.js"
+import { env } from "../../env.js"
+import { jsonValidator, queryValidator, requireUserMiddleware, resolveMemberTeamsMiddleware, resolveOrganizationContextMiddleware } from "../../middleware/index.js"
+import { denTypeIdSchema, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import {
+  acceptInvitationForUser,
+  createOrganizationForUser,
+  getInvitationPreview,
+  normalizeAllowedEmailDomains,
+  OrganizationEmailDomainRestrictionError,
+  setSessionActiveOrganization,
+  updateOrganizationSettings,
+} from "../../orgs.js"
+import { getRequiredUserEmail } from "../../user.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { ensureOwner } from "./shared.js"
+
+const createOrganizationSchema = z.object({
+  name: z.string().trim().min(2).max(120),
+})
+
+const updateOrganizationSchema = z.object({
+  name: z.string().trim().min(2).max(120).optional(),
+  allowedEmailDomains: z.array(z.string().trim().min(1).max(255)).max(100).nullable().optional(),
+  desktopAppRestrictions: desktopAppRestrictionsSchema.optional(),
+  allowedDesktopVersions: z.array(z.string().trim().min(1).max(32)).max(200).nullable().optional(),
+}).refine((value) => value.name !== undefined || value.allowedEmailDomains !== undefined || value.desktopAppRestrictions !== undefined || value.allowedDesktopVersions !== undefined, {
+  message: "Provide at least one organization field to update.",
+})
+
+const invitationPreviewQuerySchema = z.object({
+  id: denTypeIdSchema("invitation"),
+})
+
+const acceptInvitationSchema = z.object({
+  id: denTypeIdSchema("invitation"),
+})
+
+const organizationResponseSchema = z.object({
+  organization: z.object({}).passthrough().nullable(),
+}).meta({ ref: "OrganizationResponse" })
+
+const organizationOwnerSchema = z.object({
+  memberId: denTypeIdSchema("member"),
+  userId: denTypeIdSchema("user"),
+  name: z.string().nullable(),
+  email: z.string().email().nullable(),
+  image: z.string().nullable().optional(),
+}).meta({ ref: "OrganizationOwner" })
+
+const paymentRequiredSchema = z.object({
+  error: z.literal("payment_required"),
+  message: z.string(),
+  polar: z.object({
+    checkoutUrl: z.string().nullable(),
+    productId: z.string().nullable().optional(),
+    benefitId: z.string().nullable().optional(),
+  }).passthrough(),
+}).meta({ ref: "PaymentRequiredError" })
+
+const invitationPreviewResponseSchema = z.object({}).passthrough().meta({ ref: "InvitationPreviewResponse" })
+
+const invitationAcceptedResponseSchema = z.object({
+  accepted: z.literal(true),
+  organizationId: denTypeIdSchema("organization"),
+  organizationSlug: z.string().nullable(),
+  invitationId: denTypeIdSchema("invitation"),
+}).meta({ ref: "InvitationAcceptedResponse" })
+
+const organizationContextResponseSchema = z.object({
+  organization: z.object({
+    owner: organizationOwnerSchema.nullable().optional(),
+  }).passthrough(),
+  currentMember: z.object({}).passthrough(),
+  currentMemberTeams: z.array(z.object({}).passthrough()),
+}).passthrough().meta({ ref: "OrganizationContextResponse" })
+
+const userEmailRequiredSchema = z.object({
+  error: z.literal("user_email_required"),
+}).meta({ ref: "UserEmailRequiredError" })
+
+const invalidEmailDomainSchema = z.object({
+  error: z.literal("invalid_email_domain"),
+  message: z.string(),
+  invalidDomains: z.array(z.string()),
+}).meta({ ref: "InvalidEmailDomainError" })
+
+const accountEmailDomainNotAllowedSchema = z.object({
+  error: z.literal("account_email_domain_not_allowed"),
+  message: z.string(),
+  emailDomain: z.string().nullable(),
+  allowedEmailDomains: z.array(z.string()),
+}).meta({ ref: "AccountEmailDomainNotAllowedError" })
+
+function getStoredSessionId(session: { id?: string | null } | null) {
+  if (!session?.id) {
+    return null
+  }
+
+  try {
+    return normalizeDenTypeId("session", session.id)
+  } catch {
+    return null
+  }
+}
+
+async function setRequestActiveOrganization(
+  c: {
+    get: (key: "session") => { id?: string | null } | null
+    req: { raw: Request }
+  },
+  organizationId: DenTypeId<"organization"> | null,
+) {
+  try {
+    await auth.api.setActiveOrganization({
+      body: { organizationId },
+      headers: c.req.raw.headers,
+    })
+    return
+  } catch {}
+
+  const sessionId = getStoredSessionId(c.get("session"))
+  if (sessionId) {
+    await setSessionActiveOrganization(sessionId, organizationId)
+  }
+}
+
+export function registerOrgCoreRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/org",
+    describeRoute({
+      tags: ["Organizations"],
+      hide: true,
+      summary: "Create organization",
+      description: "Creates a new organization for the signed-in user after verifying that their account can provision OpenWork Cloud workspaces.",
+      responses: {
+        201: jsonResponse("Organization created successfully.", organizationResponseSchema),
+        400: jsonResponse("The organization creation request body was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create an organization.", unauthorizedSchema),
+        402: jsonResponse("The caller needs an active cloud plan before creating an organization.", paymentRequiredSchema),
+        403: jsonResponse("API keys cannot create organizations.", forbiddenSchema),
+      },
+    }),
+    requireUserMiddleware,
+    jsonValidator(createOrganizationSchema),
+    async (c) => {
+    if (c.get("apiKey")) {
+      return c.json({
+        error: "forbidden",
+        message: "API keys cannot create organizations.",
+      }, 403)
+    }
+
+    const user = c.get("user")
+    const input = c.req.valid("json")
+    const email = getRequiredUserEmail(user)
+
+    if (!email) {
+      return c.json({ error: "user_email_required" }, 400)
+    }
+
+    const access = await requireCloudWorkerAccess({
+      userId: normalizeDenTypeId("user", user.id),
+      email,
+      name: user.name ?? user.email ?? "OpenWork User",
+    })
+
+    if (!access.allowed) {
+      return c.json({
+        error: "payment_required",
+        message: "Creating a workspace requires an active OpenWork Cloud plan.",
+        polar: {
+          checkoutUrl: access.checkoutUrl,
+          productId: env.polar.productId,
+          benefitId: env.polar.benefitId,
+        },
+      }, 402)
+    }
+
+    const organizationId = await createOrganizationForUser({
+      userId: normalizeDenTypeId("user", user.id),
+      name: input.name,
+    })
+
+    await setRequestActiveOrganization(c, organizationId)
+
+    const organization = await db
+      .select()
+      .from(OrganizationTable)
+      .where(eq(OrganizationTable.id, organizationId))
+      .limit(1)
+
+    return c.json({ organization: organization[0] ?? null }, 201)
+    },
+  )
+
+  app.get(
+    "/v1/orgs/invitations/preview",
+    describeRoute({
+      tags: ["Invitations"],
+      summary: "Preview organization invitation",
+      description: "Returns invitation preview details so a user can inspect an organization invite before accepting it.",
+      responses: {
+        200: jsonResponse("Invitation preview returned successfully.", invitationPreviewResponseSchema),
+        400: jsonResponse("The invitation preview query parameters were invalid.", invalidRequestSchema),
+        404: jsonResponse("The invitation could not be found.", notFoundSchema),
+      },
+    }),
+    queryValidator(invitationPreviewQuerySchema),
+    async (c) => {
+    const query = c.req.valid("query")
+    const invitation = await getInvitationPreview(query.id)
+
+    if (!invitation) {
+      return c.json({ error: "invitation_not_found" }, 404)
+    }
+
+    return c.json(invitation)
+    },
+  )
+
+  app.post(
+    "/v1/orgs/invitations/accept",
+    describeRoute({
+      tags: ["Invitations"],
+      summary: "Accept organization invitation",
+      description: "Accepts an organization invitation for the current signed-in user and switches their active organization to the accepted workspace.",
+      responses: {
+        200: jsonResponse("Invitation accepted successfully.", invitationAcceptedResponseSchema),
+        400: jsonResponse("The invitation acceptance request body was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to accept an invitation.", unauthorizedSchema),
+        403: jsonResponse("API keys cannot accept organization invitations.", forbiddenSchema),
+        409: jsonResponse("The current account email is not allowed to join this organization.", accountEmailDomainNotAllowedSchema),
+        404: jsonResponse("The invitation could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    jsonValidator(acceptInvitationSchema),
+    async (c) => {
+    if (c.get("apiKey")) {
+      return c.json({
+        error: "forbidden",
+        message: "API keys cannot accept organization invitations.",
+      }, 403)
+    }
+
+    const user = c.get("user")
+    const input = c.req.valid("json")
+    const email = getRequiredUserEmail(user)
+
+    if (!email) {
+      return c.json({ error: "user_email_required" }, 400)
+    }
+
+    let accepted
+    try {
+      accepted = await acceptInvitationForUser({
+        userId: normalizeDenTypeId("user", user.id),
+        email,
+        invitationId: input.id,
+      })
+    } catch (error) {
+      if (error instanceof OrganizationEmailDomainRestrictionError) {
+        return c.json({
+          error: "account_email_domain_not_allowed",
+          message: error.message,
+          emailDomain: error.emailDomain,
+          allowedEmailDomains: error.allowedEmailDomains,
+        }, 409)
+      }
+      throw error
+    }
+
+    if (!accepted) {
+      return c.json({ error: "invitation_not_found" }, 404)
+    }
+
+    await setRequestActiveOrganization(c, accepted.member.organizationId)
+
+    const orgRows = await db
+      .select({ slug: OrganizationTable.slug })
+      .from(OrganizationTable)
+      .where(eq(OrganizationTable.id, accepted.member.organizationId))
+      .limit(1)
+
+    return c.json({
+      accepted: true,
+      organizationId: accepted.member.organizationId,
+      organizationSlug: orgRows[0]?.slug ?? null,
+      invitationId: accepted.invitation.id,
+    })
+    },
+  )
+
+  app.patch(
+    "/v1/org",
+    describeRoute({
+      tags: ["Organizations"],
+      summary: "Update organization",
+      description: "Updates organization fields that workspace owners are allowed to change, including the display name, allowed invitation email domains, and desktop app restrictions. The slug is immutable to avoid breaking dashboard URLs.",
+      responses: {
+        200: jsonResponse("Organization updated successfully.", organizationResponseSchema),
+        400: jsonResponse("The organization update request body was invalid or contained malformed email domains.", invalidEmailDomainSchema),
+        401: jsonResponse("The caller must be signed in to update an organization.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can update the organization.", forbiddenSchema),
+        404: jsonResponse("The organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateOrganizationSchema),
+    async (c) => {
+      const permission = ensureOwner(c)
+      if (!permission.ok) {
+        return c.json(permission.response, 403)
+      }
+
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+
+      const normalizedDomains = input.allowedEmailDomains === undefined
+        ? { domains: undefined, invalidDomains: [] as string[] }
+        : normalizeAllowedEmailDomains(input.allowedEmailDomains)
+
+      if (normalizedDomains.invalidDomains.length > 0) {
+        return c.json({
+          error: "invalid_email_domain",
+          message: "Enter valid email domains like company.com.",
+          invalidDomains: normalizedDomains.invalidDomains,
+        }, 400)
+      }
+
+      const updated = await updateOrganizationSettings({
+        organizationId: payload.organization.id,
+        name: input.name,
+        allowedEmailDomains: normalizedDomains.domains,
+        desktopAppRestrictions: input.desktopAppRestrictions,
+        allowedDesktopVersions: input.allowedDesktopVersions,
+      })
+
+      if (!updated) {
+        return c.json({ error: "organization_not_found" }, 404)
+      }
+
+      return c.json({ organization: updated })
+    },
+  )
+
+  app.get(
+    "/v1/org",
+    describeRoute({
+      tags: ["Organizations"],
+      summary: "Get active organization",
+      description: "Returns the active organization from the current session, including its owner, the current member record, and their team memberships.",
+      responses: {
+        200: jsonResponse("Organization context returned successfully.", organizationContextResponseSchema),
+        401: jsonResponse("The caller must be signed in to load organization context.", unauthorizedSchema),
+        404: jsonResponse("The organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    resolveMemberTeamsMiddleware,
+    (c) => {
+      const payload = c.get("organizationContext")
+      const owner = payload.members.find((member: typeof payload.members[number]) => member.isOwner) ?? null
+
+      return c.json({
+        ...payload,
+        organization: {
+          ...payload.organization,
+          owner: owner
+            ? {
+              memberId: owner.id,
+              userId: owner.user.id,
+              name: owner.user.name,
+              email: owner.user.email,
+              image: owner.user.image,
+            }
+            : null,
+        },
+        currentMemberTeams: c.get("memberTeams") ?? [],
+      })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/index.ts b/ee/apps/den-api/src/routes/org/index.ts
new file mode 100644
index 0000000000..40bd0d3d68
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/index.ts
@@ -0,0 +1,68 @@
+import type { Hono } from "hono"
+import { registerOrgApiKeyRoutes } from "./api-keys.js"
+import { LEGACY_ORG_PROXY_HEADER } from "../../middleware/user-organizations.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { registerOrgCoreRoutes } from "./core.js"
+import { registerOrgInvitationRoutes } from "./invitations.js"
+import { registerOrgLlmProviderRoutes } from "./llm-providers.js"
+import { registerOrgMemberRoutes } from "./members.js"
+import { registerPluginArchRoutes } from "./plugin-system/routes.js"
+import { registerOrgRoleRoutes } from "./roles.js"
+import { registerOrgSkillRoutes } from "./skills.js"
+import { registerOrgTeamRoutes } from "./teams.js"
+
+const LEGACY_ORG_PATH_PREFIX = "/v1/orgs/"
+
+function extractLegacyOrgProxyTarget(pathname: string) {
+  if (!pathname.startsWith(LEGACY_ORG_PATH_PREFIX)) {
+    return null
+  }
+
+  const remainder = pathname.slice(LEGACY_ORG_PATH_PREFIX.length)
+  const slashIndex = remainder.indexOf("/")
+  if (slashIndex <= 0) {
+    return null
+  }
+
+  const organizationId = remainder.slice(0, slashIndex)
+  if (!organizationId.startsWith("org_")) {
+    return null
+  }
+
+  const targetPath = `/v1${remainder.slice(slashIndex)}`
+  if (targetPath === pathname) {
+    return null
+  }
+
+  return { organizationId, targetPath }
+}
+
+export function registerOrgRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  registerOrgCoreRoutes(app)
+  registerOrgApiKeyRoutes(app)
+  registerOrgInvitationRoutes(app)
+  registerOrgLlmProviderRoutes(app)
+  registerOrgMemberRoutes(app)
+  registerPluginArchRoutes(app)
+  registerOrgRoleRoutes(app)
+  registerOrgSkillRoutes(app)
+  registerOrgTeamRoutes(app)
+
+  app.all("/v1/orgs/:orgId/*", async (c) => {
+    const url = new URL(c.req.raw.url)
+    const target = extractLegacyOrgProxyTarget(url.pathname)
+    if (!target) {
+      return c.json({ error: "not_found" }, 404)
+    }
+
+    const proxiedUrl = new URL(url)
+    proxiedUrl.pathname = target.targetPath
+
+    const headers = new Headers(c.req.raw.headers)
+    headers.set(LEGACY_ORG_PROXY_HEADER, target.organizationId)
+
+    const proxiedRequest = new Request(new Request(proxiedUrl, c.req.raw), { headers })
+
+    return app.fetch(proxiedRequest, c.env)
+  })
+}
diff --git a/ee/apps/den-api/src/routes/org/invitations.ts b/ee/apps/den-api/src/routes/org/invitations.ts
new file mode 100644
index 0000000000..ae20fa0641
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/invitations.ts
@@ -0,0 +1,242 @@
+import { and, eq, gt } from "@openwork-ee/den-db/drizzle"
+import { AuthUserTable, InvitationTable, MemberTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import { DenEmailSendError, sendDenOrganizationInvitationEmail } from "../../email.js"
+import { jsonValidator, paramValidator, requireUserMiddleware, resolveOrganizationContextMiddleware } from "../../middleware/index.js"
+import { denTypeIdSchema, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, successSchema, unauthorizedSchema } from "../../openapi.js"
+import { getOrganizationLimitStatus } from "../../organization-limits.js"
+import { isEmailAllowedForOrganization, listAssignableRoles } from "../../orgs.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { buildInvitationLink, createInvitationId, ensureInviteManager, idParamSchema, normalizeRoleName } from "./shared.js"
+
+const inviteMemberSchema = z.object({
+  email: z.string().email(),
+  role: z.string().trim().min(1).max(64),
+})
+
+const invitationResponseSchema = z.object({
+  invitationId: denTypeIdSchema("invitation"),
+  email: z.string().email(),
+  role: z.string(),
+  expiresAt: z.string().datetime(),
+}).meta({ ref: "InvitationResponse" })
+
+const invitationEmailFailedSchema = z.object({
+  error: z.literal("invitation_email_failed"),
+  reason: z.enum(["loops_not_configured", "loops_rejected", "loops_network"]),
+  message: z.string(),
+  invitationId: denTypeIdSchema("invitation"),
+}).meta({ ref: "InvitationEmailFailedError" })
+
+const inviteEmailDomainNotAllowedSchema = z.object({
+  error: z.literal("invite_email_domain_not_allowed"),
+  message: z.string(),
+  emailDomain: z.string().nullable(),
+  allowedEmailDomains: z.array(z.string()),
+}).meta({ ref: "InviteEmailDomainNotAllowedError" })
+
+type InvitationId = typeof InvitationTable.$inferSelect.id
+
+const orgInvitationParamsSchema = idParamSchema("invitationId", "invitation")
+
+export function registerOrgInvitationRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/invitations",
+    describeRoute({
+      tags: ["Invitations"],
+      summary: "Create organization invitation",
+      description: "Creates or refreshes a pending organization invitation for an email address and sends the invite email. Returns 502 when the invitation row is persisted but the email provider (Loops) failed to send; the client should surface the error and give the user a retry affordance.",
+      responses: {
+        200: jsonResponse("Existing invitation refreshed successfully.", invitationResponseSchema),
+        201: jsonResponse("Invitation created successfully.", invitationResponseSchema),
+        400: jsonResponse("The invitation request body or path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to invite organization members.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners and admins can create or resend invitations.", forbiddenSchema),
+        404: jsonResponse("The organization could not be found.", notFoundSchema),
+        409: jsonResponse("The email address is outside this workspace's allowed domains.", inviteEmailDomainNotAllowedSchema),
+        502: jsonResponse("The invitation was saved but the email provider (Loops) rejected or failed to deliver it. Retry by submitting the same email again.", invitationEmailFailedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(inviteMemberSchema),
+    async (c) => {
+    const permission = ensureInviteManager(c)
+    if (!permission.ok) {
+      return c.json(permission.response, permission.response.error === "forbidden" ? 403 : 404)
+    }
+
+    const payload = c.get("organizationContext")
+    const user = c.get("user")
+    const input = c.req.valid("json")
+
+    const email = input.email.trim().toLowerCase()
+    if (!isEmailAllowedForOrganization(payload.organization.allowedEmailDomains, email)) {
+      const emailDomain = email.includes("@") ? email.slice(email.lastIndexOf("@") + 1) : null
+      return c.json({
+        error: "invite_email_domain_not_allowed",
+        message:
+          payload.organization.allowedEmailDomains && payload.organization.allowedEmailDomains.length === 1
+            ? `This workspace only allows ${payload.organization.allowedEmailDomains[0]} email addresses.`
+            : `This workspace only allows email addresses from these domains: ${(payload.organization.allowedEmailDomains ?? []).join(", ")}.`,
+        emailDomain,
+        allowedEmailDomains: payload.organization.allowedEmailDomains ?? [],
+      }, 409)
+    }
+
+    const availableRoles = await listAssignableRoles(payload.organization.id)
+    const role = normalizeRoleName(input.role)
+    if (!availableRoles.has(role)) {
+      return c.json({ error: "invalid_role", message: "Choose one of the existing organization roles." }, 400)
+    }
+
+    const existingMembers = await db
+      .select({ id: MemberTable.id })
+      .from(MemberTable)
+      .innerJoin(AuthUserTable, eq(MemberTable.userId, AuthUserTable.id))
+      .where(and(eq(MemberTable.organizationId, payload.organization.id), eq(AuthUserTable.email, email)))
+      .limit(1)
+
+    if (existingMembers[0]) {
+      return c.json({
+        error: "member_exists",
+        message: "That email address is already a member of this organization.",
+      }, 409)
+    }
+
+    const existingInvitation = await db
+      .select()
+      .from(InvitationTable)
+      .where(
+        and(
+          eq(InvitationTable.organizationId, payload.organization.id),
+          eq(InvitationTable.email, email),
+          eq(InvitationTable.status, "pending"),
+          gt(InvitationTable.expiresAt, new Date()),
+        ),
+      )
+      .limit(1)
+
+    if (!existingInvitation[0]) {
+      const memberLimit = await getOrganizationLimitStatus(payload.organization.id, "members")
+      if (memberLimit.exceeded) {
+        return c.json({
+          error: "org_limit_reached",
+          limitType: "members",
+          limit: memberLimit.limit,
+          currentCount: memberLimit.currentCount,
+          message: `This workspace currently supports up to ${memberLimit.limit} members. Contact support to increase the limit.`,
+        }, 409)
+      }
+    }
+
+    const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24 * 7)
+    const invitationId = existingInvitation[0]?.id ?? createInvitationId()
+
+    if (existingInvitation[0]) {
+      await db
+        .update(InvitationTable)
+        .set({ role, inviterId: normalizeDenTypeId("user", user.id), expiresAt })
+        .where(eq(InvitationTable.id, existingInvitation[0].id))
+    } else {
+      await db.insert(InvitationTable).values({
+        id: invitationId,
+        organizationId: payload.organization.id,
+        email,
+        role,
+        status: "pending",
+        inviterId: normalizeDenTypeId("user", user.id),
+        expiresAt,
+      })
+    }
+
+    try {
+      await sendDenOrganizationInvitationEmail({
+        email,
+        inviteLink: buildInvitationLink(invitationId),
+        invitedByName: user.name ?? user.email ?? "OpenWork",
+        invitedByEmail: user.email ?? "",
+        organizationName: payload.organization.name,
+        role,
+      })
+    } catch (error) {
+      if (error instanceof DenEmailSendError) {
+        // The invitation row is already persisted (step above). Log at error
+        // level so operators can grep, and return a 502 so the caller can
+        // render a real failure instead of a silent success. The invitation
+        // id is included so the UI can correlate and offer a direct retry.
+        console.error(
+          `[auth][invite_email_failed] organization=${payload.organization.id} invitation=${invitationId} email=${email} reason=${error.reason}${error.detail ? ` detail=${error.detail}` : ""}`,
+        )
+
+        return c.json({
+          error: "invitation_email_failed" as const,
+          reason: error.reason,
+          message:
+            error.reason === "loops_not_configured"
+              ? "The invitation email provider (Loops) is not configured on this deployment."
+              : error.reason === "loops_network"
+                ? "Could not reach the invitation email provider. The invitation is saved; retry to send again."
+                : `The invitation email provider rejected the send${error.detail ? `: ${error.detail}` : "."}`,
+          invitationId,
+        }, 502)
+      }
+
+      throw error
+    }
+
+    return c.json({ invitationId, email, role, expiresAt }, existingInvitation[0] ? 200 : 201)
+    },
+  )
+
+  app.post(
+    "/v1/invitations/:invitationId/cancel",
+    describeRoute({
+      tags: ["Invitations"],
+      summary: "Cancel organization invitation",
+      description: "Cancels a pending organization invitation so the invite link can no longer be used.",
+      responses: {
+        200: jsonResponse("Invitation cancelled successfully.", successSchema),
+        400: jsonResponse("The invitation cancellation path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to cancel invitations.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners and admins can cancel invitations.", forbiddenSchema),
+        404: jsonResponse("The invitation or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgInvitationParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+    const permission = ensureInviteManager(c)
+    if (!permission.ok) {
+      return c.json(permission.response, permission.response.error === "forbidden" ? 403 : 404)
+    }
+
+    const payload = c.get("organizationContext")
+    const params = c.req.valid("param")
+    let invitationId: InvitationId
+    try {
+      invitationId = normalizeDenTypeId("invitation", params.invitationId)
+    } catch {
+      return c.json({ error: "invitation_not_found" }, 404)
+    }
+
+    const invitationRows = await db
+      .select({ id: InvitationTable.id })
+      .from(InvitationTable)
+      .where(and(eq(InvitationTable.id, invitationId), eq(InvitationTable.organizationId, payload.organization.id)))
+      .limit(1)
+
+    if (!invitationRows[0]) {
+      return c.json({ error: "invitation_not_found" }, 404)
+    }
+
+    await db.update(InvitationTable).set({ status: "canceled" }).where(eq(InvitationTable.id, invitationId))
+    return c.json({ success: true })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/llm-providers.ts b/ee/apps/den-api/src/routes/org/llm-providers.ts
new file mode 100644
index 0000000000..7b8f7efd92
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/llm-providers.ts
@@ -0,0 +1,1041 @@
+import { and, desc, eq, inArray, isNotNull, or } from "@openwork-ee/den-db/drizzle"
+import {
+  AuthUserTable,
+  LlmProviderAccessTable,
+  LlmProviderModelTable,
+  LlmProviderTable,
+  MemberTable,
+  TeamTable,
+} from "@openwork-ee/den-db/schema"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import {
+  jsonValidator,
+  paramValidator,
+  requireUserMiddleware,
+  resolveMemberTeamsMiddleware,
+  resolveOrganizationContextMiddleware,
+} from "../../middleware/index.js"
+import { getModelsDevProvider, listModelsDevProviders } from "../../llm/models-dev.js"
+import type { MemberTeamsContext } from "../../middleware/member-teams.js"
+import { denTypeIdSchema, emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { idParamSchema, memberHasRole } from "./shared.js"
+
+type JsonRecord = Record<string, unknown>
+type LlmProviderId = typeof LlmProviderTable.$inferSelect.id
+type LlmProviderAccessId = typeof LlmProviderAccessTable.$inferSelect.id
+type MemberId = typeof MemberTable.$inferSelect.id
+type TeamId = typeof TeamTable.$inferSelect.id
+type LlmProviderRow = typeof LlmProviderTable.$inferSelect
+
+type RouteFailure = {
+  status: number
+  error: string
+  message?: string
+}
+
+const providerCatalogParamsSchema = z.object({
+  providerId: z.string().trim().min(1).max(255),
+})
+
+const orgLlmProviderParamsSchema = idParamSchema("llmProviderId", "llmProvider")
+
+const customModelSchema = z.object({
+  id: z.string().trim().min(1).max(255),
+  name: z.string().trim().min(1).max(255),
+}).passthrough()
+
+const customProviderSchema = z.object({
+  id: z.string().trim().min(1).max(255),
+  name: z.string().trim().min(1).max(255),
+  npm: z.string().trim().min(1).max(255),
+  env: z.array(z.string().trim().min(1).max(255)).min(1),
+  doc: z.string().trim().min(1).max(2048),
+  api: z.string().trim().min(1).max(2048).optional(),
+  models: z.array(customModelSchema).min(1),
+}).passthrough()
+
+const llmProviderWriteSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  source: z.enum(["models_dev", "custom"]),
+  providerId: z.string().trim().min(1).max(255).optional(),
+  modelIds: z.array(z.string().trim().min(1).max(255)).min(1).optional(),
+  customConfigText: z.string().trim().min(1).optional(),
+  apiKey: z.string().trim().max(65535).optional(),
+  memberIds: z.array(denTypeIdSchema("member")).max(500).optional().default([]),
+  teamIds: z.array(denTypeIdSchema("team")).max(500).optional().default([]),
+}).superRefine((value, ctx) => {
+  if (value.source === "models_dev") {
+    if (!value.providerId) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["providerId"],
+        message: "Select a provider.",
+      })
+    }
+
+    if (!value.modelIds?.length) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["modelIds"],
+        message: "Select at least one model.",
+      })
+    }
+  }
+
+  if (value.source === "custom" && !value.customConfigText) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["customConfigText"],
+      message: "Paste a custom provider config.",
+    })
+  }
+})
+
+const providerCatalogListResponseSchema = z.object({
+  providers: z.array(z.object({}).passthrough()),
+}).meta({ ref: "LlmProviderCatalogListResponse" })
+
+const providerCatalogResponseSchema = z.object({
+  provider: z.object({}).passthrough(),
+}).meta({ ref: "LlmProviderCatalogResponse" })
+
+const llmProviderListResponseSchema = z.object({
+  llmProviders: z.array(z.object({}).passthrough()),
+}).meta({ ref: "LlmProviderListResponse" })
+
+const llmProviderResponseSchema = z.object({
+  llmProvider: z.object({}).passthrough(),
+}).meta({ ref: "LlmProviderResponse" })
+
+const providerCatalogUnavailableSchema = z.object({
+  error: z.literal("provider_catalog_unavailable"),
+  message: z.string(),
+}).meta({ ref: "ProviderCatalogUnavailableError" })
+
+const conflictSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+}).meta({ ref: "ConflictError" })
+
+function createFailure(status: number, error: string, message?: string): RouteFailure {
+  return { status, error, message }
+}
+
+function isRouteFailure(value: unknown): value is RouteFailure {
+  return typeof value === "object" && value !== null && "status" in value && "error" in value
+}
+
+function isOrganizationAdmin(payload: { currentMember: { isOwner: boolean; role: string } }) {
+  return payload.currentMember.isOwner || memberHasRole(payload.currentMember.role, "admin")
+}
+
+function canManageLlmProvider(
+  payload: { currentMember: { id: MemberId; isOwner: boolean; role: string } },
+  provider: LlmProviderRow,
+) {
+  return isOrganizationAdmin(payload) || provider.createdByOrgMembershipId === payload.currentMember.id
+}
+
+async function canAccessLlmProvider(input: {
+  organizationId: typeof LlmProviderTable.$inferSelect.organizationId
+  llmProviderId: LlmProviderId
+  currentMemberId: MemberId
+  memberTeams: Array<{ id: TeamId }>
+  isAdmin: boolean
+}) {
+  if (input.isAdmin) {
+    return true
+  }
+
+  const access = await listAccessibleProviderAccess({
+    organizationId: input.organizationId,
+    currentMemberId: input.currentMemberId,
+    memberTeams: input.memberTeams,
+  })
+
+  return access.some((entry) => entry.llmProviderId === input.llmProviderId)
+}
+
+function parseLlmProviderId(value: string) {
+  return normalizeDenTypeId("llmProvider", value)
+}
+
+function parseLlmProviderAccessId(value: string) {
+  return normalizeDenTypeId("llmProviderAccess", value)
+}
+
+function parseMemberId(value: string) {
+  return normalizeDenTypeId("member", value)
+}
+
+function parseTeamId(value: string) {
+  return normalizeDenTypeId("team", value)
+}
+
+async function listAccessibleProviderAccess(input: {
+  organizationId: typeof LlmProviderTable.$inferSelect.organizationId
+  currentMemberId: MemberId
+  memberTeams: Array<{ id: TeamId }>
+}) {
+  const teamIds = input.memberTeams.map((team) => team.id)
+  const accessWhere = teamIds.length > 0
+    ? and(
+        eq(LlmProviderTable.organizationId, input.organizationId),
+        or(
+          eq(LlmProviderAccessTable.orgMembershipId, input.currentMemberId),
+          inArray(LlmProviderAccessTable.teamId, teamIds),
+        ),
+      )
+    : and(
+        eq(LlmProviderTable.organizationId, input.organizationId),
+        eq(LlmProviderAccessTable.orgMembershipId, input.currentMemberId),
+      )
+
+  return db
+    .select({
+      id: LlmProviderAccessTable.id,
+      llmProviderId: LlmProviderAccessTable.llmProviderId,
+      orgMembershipId: LlmProviderAccessTable.orgMembershipId,
+      teamId: LlmProviderAccessTable.teamId,
+      createdAt: LlmProviderAccessTable.createdAt,
+    })
+    .from(LlmProviderAccessTable)
+    .innerJoin(LlmProviderTable, eq(LlmProviderAccessTable.llmProviderId, LlmProviderTable.id))
+    .where(accessWhere)
+}
+
+async function resolveMemberIds(input: {
+  organizationId: typeof LlmProviderTable.$inferSelect.organizationId
+  values: string[]
+}) {
+  const uniqueValues = [...new Set(input.values)]
+  if (uniqueValues.length === 0) {
+    return [] as MemberId[]
+  }
+
+  const memberIds = uniqueValues.map((value) => {
+    try {
+      return parseMemberId(value)
+    } catch {
+      throw createFailure(404, "member_not_found")
+    }
+  })
+
+  const rows = await db
+    .select({ id: MemberTable.id })
+    .from(MemberTable)
+    .where(and(eq(MemberTable.organizationId, input.organizationId), inArray(MemberTable.id, memberIds)))
+
+  if (rows.length !== memberIds.length) {
+    throw createFailure(404, "member_not_found")
+  }
+
+  return memberIds
+}
+
+async function resolveTeamIds(input: {
+  organizationId: typeof LlmProviderTable.$inferSelect.organizationId
+  values: string[]
+}) {
+  const uniqueValues = [...new Set(input.values)]
+  if (uniqueValues.length === 0) {
+    return [] as TeamId[]
+  }
+
+  const teamIds = uniqueValues.map((value) => {
+    try {
+      return parseTeamId(value)
+    } catch {
+      throw createFailure(404, "team_not_found")
+    }
+  })
+
+  const rows = await db
+    .select({ id: TeamTable.id })
+    .from(TeamTable)
+    .where(and(eq(TeamTable.organizationId, input.organizationId), inArray(TeamTable.id, teamIds)))
+
+  if (rows.length !== teamIds.length) {
+    throw createFailure(404, "team_not_found")
+  }
+
+  return teamIds
+}
+
+async function normalizeLlmProviderInput(input: z.infer<typeof llmProviderWriteSchema>) {
+  if (input.source === "models_dev") {
+    const provider = await getModelsDevProvider(input.providerId ?? "")
+    if (!provider) {
+      throw createFailure(404, "provider_not_found", "The selected provider was not found in models.dev.")
+    }
+
+    const requestedModelIds = [...new Set(input.modelIds ?? [])]
+    const modelsById = new Map(provider.models.map((model) => [model.id, model]))
+    const models = requestedModelIds.map((modelId) => {
+      const model = modelsById.get(modelId)
+      if (!model) {
+        throw createFailure(404, "model_not_found", `Model ${modelId} is not available for ${provider.name}.`)
+      }
+      return model
+    })
+
+    const apiKey = input.apiKey?.trim() || null
+
+    return {
+      source: input.source,
+      providerId: provider.id,
+      name: input.name,
+      providerConfig: provider.config,
+      models: models.map((model) => ({
+        id: model.id,
+        name: model.name,
+        config: model.config,
+      })),
+      apiKey,
+    }
+  }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(input.customConfigText ?? "")
+  } catch {
+    throw createFailure(400, "invalid_custom_provider_config", "Custom provider config must be valid JSON.")
+  }
+
+  const customProvider = customProviderSchema.safeParse(parsed)
+  if (!customProvider.success) {
+    throw createFailure(
+      400,
+      "invalid_custom_provider_config",
+      customProvider.error.issues[0]?.message ?? "Custom provider config is invalid.",
+    )
+  }
+
+  const { models, ...providerConfig } = customProvider.data
+
+  return {
+    source: input.source,
+    providerId: customProvider.data.id,
+    name: input.name,
+    providerConfig: providerConfig as JsonRecord,
+    models: models.map((model) => ({
+      id: model.id,
+      name: model.name,
+      config: model as JsonRecord,
+    })),
+    apiKey: input.apiKey?.trim() || null,
+  }
+}
+
+async function loadLlmProviders(input: {
+  organizationId: typeof LlmProviderTable.$inferSelect.organizationId
+  currentMemberId: MemberId
+  memberTeams: Array<{ id: TeamId }>
+  isAdmin: boolean
+}) {
+  const accessibleAccess = input.isAdmin
+    ? []
+    : await listAccessibleProviderAccess({
+        organizationId: input.organizationId,
+        currentMemberId: input.currentMemberId,
+        memberTeams: input.memberTeams,
+      })
+
+  const accessibleProviderIds = [...new Set(accessibleAccess.map((entry) => entry.llmProviderId))]
+  if (!input.isAdmin && accessibleProviderIds.length === 0) {
+    return []
+  }
+
+  const providers = await db
+    .select()
+    .from(LlmProviderTable)
+    .where(
+      input.isAdmin
+        ? eq(LlmProviderTable.organizationId, input.organizationId)
+        : and(
+            eq(LlmProviderTable.organizationId, input.organizationId),
+            inArray(LlmProviderTable.id, accessibleProviderIds),
+          ),
+    )
+    .orderBy(desc(LlmProviderTable.updatedAt))
+
+  if (providers.length === 0) {
+    return []
+  }
+
+  const providerIds = providers.map((provider) => provider.id)
+  const models = await db
+    .select()
+    .from(LlmProviderModelTable)
+    .where(inArray(LlmProviderModelTable.llmProviderId, providerIds))
+
+  const memberAccessRows = await db
+    .select({
+      access: {
+        id: LlmProviderAccessTable.id,
+        llmProviderId: LlmProviderAccessTable.llmProviderId,
+        createdAt: LlmProviderAccessTable.createdAt,
+      },
+      member: {
+        id: MemberTable.id,
+        role: MemberTable.role,
+      },
+      user: {
+        id: AuthUserTable.id,
+        name: AuthUserTable.name,
+        email: AuthUserTable.email,
+        image: AuthUserTable.image,
+      },
+    })
+    .from(LlmProviderAccessTable)
+    .innerJoin(MemberTable, eq(LlmProviderAccessTable.orgMembershipId, MemberTable.id))
+    .innerJoin(AuthUserTable, eq(MemberTable.userId, AuthUserTable.id))
+    .where(and(inArray(LlmProviderAccessTable.llmProviderId, providerIds), isNotNull(LlmProviderAccessTable.orgMembershipId)))
+
+  const teamAccessRows = await db
+    .select({
+      access: {
+        id: LlmProviderAccessTable.id,
+        llmProviderId: LlmProviderAccessTable.llmProviderId,
+        createdAt: LlmProviderAccessTable.createdAt,
+      },
+      team: {
+        id: TeamTable.id,
+        name: TeamTable.name,
+        createdAt: TeamTable.createdAt,
+        updatedAt: TeamTable.updatedAt,
+      },
+    })
+    .from(LlmProviderAccessTable)
+    .innerJoin(TeamTable, eq(LlmProviderAccessTable.teamId, TeamTable.id))
+    .where(and(inArray(LlmProviderAccessTable.llmProviderId, providerIds), isNotNull(LlmProviderAccessTable.teamId)))
+
+  const modelsByProviderId = new Map<LlmProviderId, typeof models>()
+  for (const model of models) {
+    const existing = modelsByProviderId.get(model.llmProviderId) ?? []
+    existing.push(model)
+    modelsByProviderId.set(model.llmProviderId, existing)
+  }
+
+  const memberAccessByProviderId = new Map<LlmProviderId, typeof memberAccessRows>()
+  for (const row of memberAccessRows) {
+    const existing = memberAccessByProviderId.get(row.access.llmProviderId) ?? []
+    existing.push(row)
+    memberAccessByProviderId.set(row.access.llmProviderId, existing)
+  }
+
+  const teamAccessByProviderId = new Map<LlmProviderId, typeof teamAccessRows>()
+  for (const row of teamAccessRows) {
+    const existing = teamAccessByProviderId.get(row.access.llmProviderId) ?? []
+    existing.push(row)
+    teamAccessByProviderId.set(row.access.llmProviderId, existing)
+  }
+
+  const accessibleViaByProviderId = new Map<LlmProviderId, { orgMembershipIds: MemberId[]; teamIds: TeamId[] }>()
+  for (const row of accessibleAccess) {
+    const existing = accessibleViaByProviderId.get(row.llmProviderId) ?? { orgMembershipIds: [], teamIds: [] }
+    if (row.orgMembershipId && !existing.orgMembershipIds.includes(row.orgMembershipId)) {
+      existing.orgMembershipIds.push(row.orgMembershipId)
+    }
+    if (row.teamId && !existing.teamIds.includes(row.teamId)) {
+      existing.teamIds.push(row.teamId)
+    }
+    accessibleViaByProviderId.set(row.llmProviderId, existing)
+  }
+
+  return providers.map((provider) => ({
+    ...provider,
+    hasApiKey: Boolean(provider.apiKey && provider.apiKey.trim().length > 0),
+    models: (modelsByProviderId.get(provider.id) ?? [])
+      .map((model) => ({
+        id: model.modelId,
+        name: model.name,
+        config: model.modelConfig,
+        createdAt: model.createdAt,
+      }))
+      .sort((left, right) => left.name.localeCompare(right.name)),
+    access: {
+      members: (memberAccessByProviderId.get(provider.id) ?? []).map((row) => ({
+        id: row.access.id,
+        orgMembershipId: row.member.id,
+        role: row.member.role,
+        user: row.user,
+        createdAt: row.access.createdAt,
+      })),
+      teams: (teamAccessByProviderId.get(provider.id) ?? []).map((row) => ({
+        id: row.access.id,
+        teamId: row.team.id,
+        name: row.team.name,
+        createdAt: row.team.createdAt,
+        updatedAt: row.team.updatedAt,
+      })),
+    },
+    accessibleVia: accessibleViaByProviderId.get(provider.id) ?? { orgMembershipIds: [], teamIds: [] },
+  }))
+}
+
+export function registerOrgLlmProviderRoutes<T extends { Variables: OrgRouteVariables & Partial<MemberTeamsContext> }>(app: Hono<T>) {
+  app.get(
+    "/v1/llm-provider-catalog",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "List LLM provider catalog",
+      description: "Lists the provider catalog from models.dev so an organization can choose which LLM providers to configure.",
+      responses: {
+        200: jsonResponse("Provider catalog returned successfully.", providerCatalogListResponseSchema),
+        400: jsonResponse("The provider catalog path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to browse the provider catalog.", unauthorizedSchema),
+        502: jsonResponse("The external provider catalog was unavailable.", providerCatalogUnavailableSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      try {
+        const providers = await listModelsDevProviders()
+        return c.json({ providers })
+      } catch (error) {
+        return c.json({
+          error: "provider_catalog_unavailable",
+          message: error instanceof Error ? error.message : "Could not load the models.dev catalog.",
+        }, 502)
+      }
+    },
+  )
+
+  app.get(
+    "/v1/llm-provider-catalog/:providerId",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Get LLM provider catalog entry",
+      description: "Returns the full models.dev catalog record for one provider, including its config template and model list.",
+      responses: {
+        200: jsonResponse("Provider catalog entry returned successfully.", providerCatalogResponseSchema),
+        400: jsonResponse("The provider catalog path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to inspect provider catalog entries.", unauthorizedSchema),
+        404: jsonResponse("The requested provider catalog entry could not be found.", notFoundSchema),
+        502: jsonResponse("The external provider catalog was unavailable.", providerCatalogUnavailableSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(providerCatalogParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const params = c.req.valid("param")
+
+      try {
+        const provider = await getModelsDevProvider(params.providerId)
+        if (!provider) {
+          return c.json({ error: "provider_not_found" }, 404)
+        }
+
+        return c.json({
+          provider: {
+            id: provider.id,
+            name: provider.name,
+            npm: provider.npm,
+            env: provider.env,
+            doc: provider.doc,
+            api: provider.api,
+            config: provider.config,
+            models: provider.models,
+          },
+        })
+      } catch (error) {
+        return c.json({
+          error: "provider_catalog_unavailable",
+          message: error instanceof Error ? error.message : "Could not load the provider details.",
+        }, 502)
+      }
+    },
+  )
+
+  app.get(
+    "/v1/llm-providers",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "List organization LLM providers",
+      description: "Lists the LLM providers that the current organization member is allowed to see and potentially manage.",
+      responses: {
+        200: jsonResponse("Accessible organization LLM providers returned successfully.", llmProviderListResponseSchema),
+        400: jsonResponse("The provider list path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list organization LLM providers.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    resolveMemberTeamsMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const memberTeams = c.get("memberTeams") ?? []
+      const providers = await loadLlmProviders({
+        organizationId: payload.organization.id,
+        currentMemberId: payload.currentMember.id,
+        memberTeams,
+        isAdmin: isOrganizationAdmin(payload),
+      })
+
+      return c.json({
+        llmProviders: providers.map((provider) => ({
+          ...provider,
+          apiKey: undefined,
+          canManage: canManageLlmProvider(payload, provider),
+        })),
+      })
+    },
+  )
+
+  app.get(
+    "/v1/llm-providers/:llmProviderId/connect",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Get LLM provider connect payload",
+      description: "Returns one accessible organization LLM provider with the concrete model configuration needed to connect to it.",
+      responses: {
+        200: jsonResponse("Provider connection payload returned successfully.", llmProviderResponseSchema),
+        400: jsonResponse("The provider connect path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to connect to an organization LLM provider.", unauthorizedSchema),
+        403: jsonResponse("Only members with access grants, the provider creator, or workspace admins can connect to this provider.", forbiddenSchema),
+        404: jsonResponse("The provider could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgLlmProviderParamsSchema),
+    resolveOrganizationContextMiddleware,
+    resolveMemberTeamsMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const memberTeams = c.get("memberTeams") ?? []
+      const params = c.req.valid("param")
+
+      let llmProviderId: LlmProviderId
+      try {
+        llmProviderId = parseLlmProviderId(params.llmProviderId)
+      } catch {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      const providerRows = await db
+        .select()
+        .from(LlmProviderTable)
+        .where(and(eq(LlmProviderTable.id, llmProviderId), eq(LlmProviderTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const provider = providerRows[0]
+      if (!provider) {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      const accessible = await canAccessLlmProvider({
+        organizationId: payload.organization.id,
+        llmProviderId,
+        currentMemberId: payload.currentMember.id,
+        memberTeams,
+        isAdmin: isOrganizationAdmin(payload),
+      })
+
+      if (!accessible) {
+        return c.json({
+          error: "forbidden",
+          message: "You do not have access to this provider.",
+        }, 403)
+      }
+
+      const models = await db
+        .select()
+        .from(LlmProviderModelTable)
+        .where(eq(LlmProviderModelTable.llmProviderId, llmProviderId))
+
+      return c.json({
+        llmProvider: {
+          ...provider,
+          models: models
+            .map((model) => ({
+              id: model.modelId,
+              name: model.name,
+              config: model.modelConfig,
+              createdAt: model.createdAt,
+            }))
+            .sort((left, right) => left.name.localeCompare(right.name)),
+        },
+      })
+    },
+  )
+
+  app.post(
+    "/v1/llm-providers",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Create organization LLM provider",
+      description: "Creates a new organization-scoped LLM provider from either a models.dev provider template or a pasted custom configuration.",
+      responses: {
+        201: jsonResponse("Organization LLM provider created successfully.", llmProviderResponseSchema),
+        400: jsonResponse("The provider creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create organization LLM providers.", unauthorizedSchema),
+        404: jsonResponse("A referenced provider, model, member, or team could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(llmProviderWriteSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+
+      try {
+        const normalized = await normalizeLlmProviderInput(input)
+        const memberIds = await resolveMemberIds({
+          organizationId: payload.organization.id,
+          values: input.memberIds,
+        })
+        const teamIds = await resolveTeamIds({
+          organizationId: payload.organization.id,
+          values: input.teamIds,
+        })
+
+        const llmProviderId = createDenTypeId("llmProvider")
+        const protectedMemberIds = [...new Set([payload.currentMember.id, ...memberIds])]
+        const now = new Date()
+
+        await db.transaction(async (tx) => {
+          await tx.insert(LlmProviderTable).values({
+            id: llmProviderId,
+            organizationId: payload.organization.id,
+            createdByOrgMembershipId: payload.currentMember.id,
+            source: normalized.source,
+            providerId: normalized.providerId,
+            name: normalized.name,
+            providerConfig: normalized.providerConfig,
+            apiKey: normalized.apiKey,
+            createdAt: now,
+            updatedAt: now,
+          })
+
+          if (normalized.models.length > 0) {
+            await tx.insert(LlmProviderModelTable).values(
+              normalized.models.map((model) => ({
+                id: createDenTypeId("llmProviderModel"),
+                llmProviderId,
+                modelId: model.id,
+                name: model.name,
+                modelConfig: model.config,
+                createdAt: now,
+              })),
+            )
+          }
+
+          const accessRows = [
+            ...protectedMemberIds.map((orgMembershipId) => ({
+              id: createDenTypeId("llmProviderAccess"),
+              llmProviderId,
+              orgMembershipId,
+              teamId: null,
+              createdAt: now,
+            })),
+            ...teamIds.map((teamId) => ({
+              id: createDenTypeId("llmProviderAccess"),
+              llmProviderId,
+              orgMembershipId: null,
+              teamId,
+              createdAt: now,
+            })),
+          ]
+
+          if (accessRows.length > 0) {
+            await tx.insert(LlmProviderAccessTable).values(accessRows)
+          }
+        })
+
+        return c.json({
+          llmProvider: {
+            id: llmProviderId,
+            organizationId: payload.organization.id,
+            createdByOrgMembershipId: payload.currentMember.id,
+            source: normalized.source,
+            providerId: normalized.providerId,
+            name: normalized.name,
+            providerConfig: normalized.providerConfig,
+            hasApiKey: Boolean(normalized.apiKey),
+            createdAt: now,
+            updatedAt: now,
+          },
+        }, 201)
+      } catch (error) {
+        if (isRouteFailure(error)) {
+          return c.json(
+            { error: error.error, message: error.message },
+            { status: error.status as 400 | 404 },
+          )
+        }
+
+        throw error
+      }
+    },
+  )
+
+  app.patch(
+    "/v1/llm-providers/:llmProviderId",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Update organization LLM provider",
+      description: "Updates an existing organization LLM provider, including its provider config, selected models, secret, and access grants.",
+      responses: {
+        200: jsonResponse("Organization LLM provider updated successfully.", llmProviderResponseSchema),
+        400: jsonResponse("The provider update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update organization LLM providers.", unauthorizedSchema),
+        403: jsonResponse("Only the provider creator or a workspace admin can update providers.", forbiddenSchema),
+        404: jsonResponse("The provider or a referenced resource could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgLlmProviderParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(llmProviderWriteSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let llmProviderId: LlmProviderId
+      try {
+        llmProviderId = parseLlmProviderId(params.llmProviderId)
+      } catch {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      const providerRows = await db
+        .select()
+        .from(LlmProviderTable)
+        .where(and(eq(LlmProviderTable.id, llmProviderId), eq(LlmProviderTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const provider = providerRows[0]
+      if (!provider) {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      if (!canManageLlmProvider(payload, provider)) {
+        return c.json({
+          error: "forbidden",
+          message: "Only the provider creator or a workspace admin can update providers.",
+        }, 403)
+      }
+
+      try {
+        const normalized = await normalizeLlmProviderInput(input)
+        const memberIds = await resolveMemberIds({
+          organizationId: payload.organization.id,
+          values: input.memberIds,
+        })
+        const teamIds = await resolveTeamIds({
+          organizationId: payload.organization.id,
+          values: input.teamIds,
+        })
+        const protectedMemberIds = [...new Set([provider.createdByOrgMembershipId, ...memberIds])]
+        const updatedAt = new Date()
+
+        await db.transaction(async (tx) => {
+          await tx
+            .update(LlmProviderTable)
+            .set({
+              source: normalized.source,
+              providerId: normalized.providerId,
+              name: normalized.name,
+              providerConfig: normalized.providerConfig,
+              apiKey: input.apiKey === undefined ? provider.apiKey : normalized.apiKey,
+              updatedAt,
+            })
+            .where(eq(LlmProviderTable.id, provider.id))
+
+          await tx.delete(LlmProviderModelTable).where(eq(LlmProviderModelTable.llmProviderId, provider.id))
+          await tx.delete(LlmProviderAccessTable).where(eq(LlmProviderAccessTable.llmProviderId, provider.id))
+
+          if (normalized.models.length > 0) {
+            await tx.insert(LlmProviderModelTable).values(
+              normalized.models.map((model) => ({
+                id: createDenTypeId("llmProviderModel"),
+                llmProviderId: provider.id,
+                modelId: model.id,
+                name: model.name,
+                modelConfig: model.config,
+                createdAt: updatedAt,
+              })),
+            )
+          }
+
+          const accessRows = [
+            ...protectedMemberIds.map((orgMembershipId) => ({
+              id: createDenTypeId("llmProviderAccess"),
+              llmProviderId: provider.id,
+              orgMembershipId,
+              teamId: null,
+              createdAt: updatedAt,
+            })),
+            ...teamIds.map((teamId) => ({
+              id: createDenTypeId("llmProviderAccess"),
+              llmProviderId: provider.id,
+              orgMembershipId: null,
+              teamId,
+              createdAt: updatedAt,
+            })),
+          ]
+
+          if (accessRows.length > 0) {
+            await tx.insert(LlmProviderAccessTable).values(accessRows)
+          }
+        })
+
+        return c.json({
+          llmProvider: {
+            ...provider,
+            source: normalized.source,
+            providerId: normalized.providerId,
+            name: normalized.name,
+            providerConfig: normalized.providerConfig,
+            hasApiKey: input.apiKey === undefined ? Boolean(provider.apiKey) : Boolean(normalized.apiKey),
+            updatedAt,
+          },
+        })
+      } catch (error) {
+        if (isRouteFailure(error)) {
+          return c.json(
+            { error: error.error, message: error.message },
+            { status: error.status as 400 | 404 },
+          )
+        }
+
+        throw error
+      }
+    },
+  )
+
+  app.delete(
+    "/v1/llm-providers/:llmProviderId",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Delete organization LLM provider",
+      description: "Deletes an organization LLM provider and removes its models and access rules.",
+      responses: {
+        204: emptyResponse("Organization LLM provider deleted successfully."),
+        400: jsonResponse("The provider deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete organization LLM providers.", unauthorizedSchema),
+        403: jsonResponse("Only the provider creator or a workspace admin can delete providers.", forbiddenSchema),
+        404: jsonResponse("The provider could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgLlmProviderParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let llmProviderId: LlmProviderId
+      try {
+        llmProviderId = parseLlmProviderId(params.llmProviderId)
+      } catch {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      const providerRows = await db
+        .select()
+        .from(LlmProviderTable)
+        .where(and(eq(LlmProviderTable.id, llmProviderId), eq(LlmProviderTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const provider = providerRows[0]
+      if (!provider) {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      if (!canManageLlmProvider(payload, provider)) {
+        return c.json({
+          error: "forbidden",
+          message: "Only the provider creator or a workspace admin can delete providers.",
+        }, 403)
+      }
+
+      await db.transaction(async (tx) => {
+        await tx.delete(LlmProviderAccessTable).where(eq(LlmProviderAccessTable.llmProviderId, provider.id))
+        await tx.delete(LlmProviderModelTable).where(eq(LlmProviderModelTable.llmProviderId, provider.id))
+        await tx.delete(LlmProviderTable).where(eq(LlmProviderTable.id, provider.id))
+      })
+
+      return c.body(null, 204)
+    },
+  )
+
+  app.delete(
+    "/v1/llm-providers/:llmProviderId/access/:accessId",
+    describeRoute({
+      tags: ["LLM Providers"],
+      summary: "Remove LLM provider access grant",
+      description: "Removes one explicit member or team access grant from an organization LLM provider.",
+      responses: {
+        204: emptyResponse("Organization LLM provider access removed successfully."),
+        400: jsonResponse("The provider access deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage provider access.", unauthorizedSchema),
+        403: jsonResponse("Only the provider creator or a workspace admin can manage provider access.", forbiddenSchema),
+        404: jsonResponse("The provider or access grant could not be found.", notFoundSchema),
+        409: jsonResponse("The request tried to remove a protected provider access entry.", conflictSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgLlmProviderParamsSchema.extend(idParamSchema("accessId", "llmProviderAccess").shape)),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let llmProviderId: LlmProviderId
+      let accessId: LlmProviderAccessId
+      try {
+        llmProviderId = parseLlmProviderId(params.llmProviderId)
+        accessId = parseLlmProviderAccessId(params.accessId)
+      } catch {
+        return c.json({ error: "not_found" }, 404)
+      }
+
+      const providerRows = await db
+        .select()
+        .from(LlmProviderTable)
+        .where(and(eq(LlmProviderTable.id, llmProviderId), eq(LlmProviderTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const provider = providerRows[0]
+      if (!provider) {
+        return c.json({ error: "llm_provider_not_found" }, 404)
+      }
+
+      if (!canManageLlmProvider(payload, provider)) {
+        return c.json({ error: "forbidden", message: "Only the provider creator or a workspace admin can manage access." }, 403)
+      }
+
+      const accessRows = await db
+        .select()
+        .from(LlmProviderAccessTable)
+        .where(and(eq(LlmProviderAccessTable.id, accessId), eq(LlmProviderAccessTable.llmProviderId, provider.id)))
+        .limit(1)
+
+      const access = accessRows[0]
+      if (!access) {
+        return c.json({ error: "llm_provider_access_not_found" }, 404)
+      }
+
+      if (access.orgMembershipId === provider.createdByOrgMembershipId) {
+        return c.json({
+          error: "protected_access",
+          message: "The provider creator always keeps direct access.",
+        }, 409)
+      }
+
+      await db.delete(LlmProviderAccessTable).where(eq(LlmProviderAccessTable.id, access.id))
+      return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/members.ts b/ee/apps/den-api/src/routes/org/members.ts
new file mode 100644
index 0000000000..17c9df490e
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/members.ts
@@ -0,0 +1,137 @@
+import { and, eq } from "@openwork-ee/den-db/drizzle"
+import { MemberTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import { jsonValidator, paramValidator, requireUserMiddleware, resolveOrganizationContextMiddleware } from "../../middleware/index.js"
+import { emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, successSchema, unauthorizedSchema } from "../../openapi.js"
+import { listAssignableRoles, removeOrganizationMember, roleIncludesOwner } from "../../orgs.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { ensureOwner, idParamSchema, normalizeRoleName } from "./shared.js"
+
+const updateMemberRoleSchema = z.object({
+  role: z.string().trim().min(1).max(64),
+})
+
+type MemberId = typeof MemberTable.$inferSelect.id
+const orgMemberParamsSchema = idParamSchema("memberId", "member")
+
+export function registerOrgMemberRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/members/:memberId/role",
+    describeRoute({
+      tags: ["Members"],
+      summary: "Update member role",
+      description: "Changes the role assigned to a specific organization member.",
+      responses: {
+        200: jsonResponse("Member role updated successfully.", successSchema),
+        400: jsonResponse("The member role update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update member roles.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can update member roles.", forbiddenSchema),
+        404: jsonResponse("The member or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgMemberParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateMemberRoleSchema),
+    async (c) => {
+    const permission = ensureOwner(c)
+    if (!permission.ok) {
+      return c.json(permission.response, 403)
+    }
+
+    const payload = c.get("organizationContext")
+    const input = c.req.valid("json")
+
+    const params = c.req.valid("param")
+    let memberId: MemberId
+    try {
+      memberId = normalizeDenTypeId("member", params.memberId)
+    } catch {
+      return c.json({ error: "member_not_found" }, 404)
+    }
+
+    const memberRows = await db
+      .select()
+      .from(MemberTable)
+      .where(and(eq(MemberTable.id, memberId), eq(MemberTable.organizationId, payload.organization.id)))
+      .limit(1)
+
+    const member = memberRows[0]
+    if (!member) {
+      return c.json({ error: "member_not_found" }, 404)
+    }
+
+    if (roleIncludesOwner(member.role)) {
+      return c.json({ error: "owner_role_locked", message: "The organization owner role cannot be changed." }, 400)
+    }
+
+    const role = normalizeRoleName(input.role)
+    const availableRoles = await listAssignableRoles(payload.organization.id)
+    if (!availableRoles.has(role)) {
+      return c.json({ error: "invalid_role", message: "Choose one of the existing organization roles." }, 400)
+    }
+
+    await db.update(MemberTable).set({ role }).where(eq(MemberTable.id, member.id))
+    return c.json({ success: true })
+    },
+  )
+
+  app.delete(
+    "/v1/members/:memberId",
+    describeRoute({
+      tags: ["Members"],
+      summary: "Remove organization member",
+      description: "Removes a member from an organization while protecting the owner role from deletion.",
+      responses: {
+        204: emptyResponse("Member removed successfully."),
+        400: jsonResponse("The member removal request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to remove organization members.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can remove members.", forbiddenSchema),
+        404: jsonResponse("The member or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgMemberParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+    const permission = ensureOwner(c)
+    if (!permission.ok) {
+      return c.json(permission.response, 403)
+    }
+
+    const payload = c.get("organizationContext")
+    const params = c.req.valid("param")
+    let memberId: MemberId
+    try {
+      memberId = normalizeDenTypeId("member", params.memberId)
+    } catch {
+      return c.json({ error: "member_not_found" }, 404)
+    }
+
+    const memberRows = await db
+      .select()
+      .from(MemberTable)
+      .where(and(eq(MemberTable.id, memberId), eq(MemberTable.organizationId, payload.organization.id)))
+      .limit(1)
+
+    const member = memberRows[0]
+    if (!member) {
+      return c.json({ error: "member_not_found" }, 404)
+    }
+
+    if (roleIncludesOwner(member.role)) {
+      return c.json({ error: "owner_role_locked", message: "The organization owner cannot be removed." }, 400)
+    }
+
+    await removeOrganizationMember({
+      organizationId: payload.organization.id,
+      memberId: member.id,
+    })
+    return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/access.ts b/ee/apps/den-api/src/routes/org/plugin-system/access.ts
new file mode 100644
index 0000000000..7dd6efd759
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/access.ts
@@ -0,0 +1,290 @@
+import { and, eq, inArray, isNull } from "@openwork-ee/den-db/drizzle"
+import {
+  ConfigObjectAccessGrantTable,
+  ConfigObjectTable,
+  ConnectorInstanceAccessGrantTable,
+  ConnectorInstanceTable,
+  MarketplaceAccessGrantTable,
+  MarketplacePluginTable,
+  MarketplaceTable,
+  PluginAccessGrantTable,
+  PluginConfigObjectTable,
+  PluginTable,
+} from "@openwork-ee/den-db/schema"
+import type { MemberTeamSummary, OrganizationContext } from "../../../orgs.js"
+import { db } from "../../../db.js"
+import { memberHasRole } from "../shared.js"
+
+export type PluginArchResourceKind = "config_object" | "connector_instance" | "marketplace" | "plugin"
+export type PluginArchRole = "viewer" | "editor" | "manager"
+export type PluginArchCapability = "config_object.create" | "connector_account.create" | "connector_instance.create" | "marketplace.create" | "plugin.create"
+
+export type PluginArchActorContext = {
+  memberTeams: MemberTeamSummary[]
+  organizationContext: OrganizationContext
+}
+
+type MemberId = OrganizationContext["currentMember"]["id"]
+type TeamId = MemberTeamSummary["id"]
+type ConfigObjectId = typeof ConfigObjectTable.$inferSelect.id
+type MarketplaceId = typeof MarketplaceTable.$inferSelect.id
+type PluginId = typeof PluginTable.$inferSelect.id
+type ConnectorInstanceId = typeof ConnectorInstanceTable.$inferSelect.id
+type ConfigObjectGrantRow = Pick<typeof ConfigObjectAccessGrantTable.$inferSelect, "orgMembershipId" | "orgWide" | "removedAt" | "role" | "teamId">
+type MarketplaceGrantRow = Pick<typeof MarketplaceAccessGrantTable.$inferSelect, "orgMembershipId" | "orgWide" | "removedAt" | "role" | "teamId">
+type PluginGrantRow = Pick<typeof PluginAccessGrantTable.$inferSelect, "orgMembershipId" | "orgWide" | "removedAt" | "role" | "teamId">
+type ConnectorInstanceGrantRow = Pick<typeof ConnectorInstanceAccessGrantTable.$inferSelect, "orgMembershipId" | "orgWide" | "removedAt" | "role" | "teamId">
+type GrantRow = ConfigObjectGrantRow | MarketplaceGrantRow | PluginGrantRow | ConnectorInstanceGrantRow
+
+type MarketplaceResourceLookupInput = {
+  context: PluginArchActorContext
+  resourceId: MarketplaceId
+  resourceKind: "marketplace"
+}
+
+type PluginResourceLookupInput = {
+  context: PluginArchActorContext
+  resourceId: PluginId
+  resourceKind: "plugin"
+}
+
+type ConnectorInstanceResourceLookupInput = {
+  context: PluginArchActorContext
+  resourceId: ConnectorInstanceId
+  resourceKind: "connector_instance"
+}
+
+type ConfigObjectResourceLookupInput = {
+  context: PluginArchActorContext
+  resourceId: ConfigObjectId
+  resourceKind: "config_object"
+}
+
+type ResourceLookupInput =
+  | PluginResourceLookupInput
+  | ConnectorInstanceResourceLookupInput
+  | MarketplaceResourceLookupInput
+  | ConfigObjectResourceLookupInput
+
+type RequireResourceRoleInput = ResourceLookupInput & { role: PluginArchRole }
+
+export class PluginArchAuthorizationError extends Error {
+  constructor(
+    readonly status: 403,
+    readonly error: "forbidden",
+    message: string,
+  ) {
+    super(message)
+    this.name = "PluginArchAuthorizationError"
+  }
+}
+
+const rolePriority: Record<PluginArchRole, number> = {
+  viewer: 1,
+  editor: 2,
+  manager: 3,
+}
+
+function maxRole(current: PluginArchRole | null, candidate: PluginArchRole | null) {
+  if (!candidate) return current
+  if (!current) return candidate
+  return rolePriority[candidate] > rolePriority[current] ? candidate : current
+}
+
+export function isPluginArchOrgAdmin(context: PluginArchActorContext) {
+  return context.organizationContext.currentMember.isOwner || memberHasRole(context.organizationContext.currentMember.role, "admin")
+}
+
+export function hasPluginArchCapability(context: PluginArchActorContext, _capability: PluginArchCapability) {
+  return isPluginArchOrgAdmin(context)
+}
+
+function roleSatisfies(role: PluginArchRole | null, required: PluginArchRole) {
+  if (!role) return false
+  return rolePriority[role] >= rolePriority[required]
+}
+
+export function resolvePluginArchGrantRole(input: {
+  grants: GrantRow[]
+  memberId: MemberId
+  teamIds: TeamId[]
+}) {
+  const teamIds = new Set(input.teamIds)
+  let resolved: PluginArchRole | null = null
+
+  for (const grant of input.grants) {
+    if (grant.removedAt) continue
+    const applies = grant.orgWide || grant.orgMembershipId === input.memberId || (grant.teamId ? teamIds.has(grant.teamId) : false)
+    if (!applies) continue
+    resolved = maxRole(resolved, grant.role)
+  }
+
+  return resolved
+}
+
+async function resolveGrantRole(input: {
+  grants: GrantRow[]
+  context: PluginArchActorContext
+}) {
+  return resolvePluginArchGrantRole({
+    grants: input.grants,
+    memberId: input.context.organizationContext.currentMember.id,
+    teamIds: input.context.memberTeams.map((team) => team.id),
+  })
+}
+
+async function resolvePluginRoleForIds(context: PluginArchActorContext, pluginIds: PluginId[]) {
+  if (pluginIds.length === 0) {
+    return null
+  }
+
+  if (isPluginArchOrgAdmin(context)) {
+    return "manager" satisfies PluginArchRole
+  }
+
+  const grants = await db
+    .select({
+      orgMembershipId: PluginAccessGrantTable.orgMembershipId,
+      orgWide: PluginAccessGrantTable.orgWide,
+      removedAt: PluginAccessGrantTable.removedAt,
+      role: PluginAccessGrantTable.role,
+      teamId: PluginAccessGrantTable.teamId,
+    })
+    .from(PluginAccessGrantTable)
+    .where(inArray(PluginAccessGrantTable.pluginId, pluginIds))
+
+  return resolveGrantRole({ context, grants })
+}
+
+async function resolveMarketplaceRoleForIds(context: PluginArchActorContext, marketplaceIds: MarketplaceId[]) {
+  if (marketplaceIds.length === 0) {
+    return null
+  }
+
+  if (isPluginArchOrgAdmin(context)) {
+    return "manager" satisfies PluginArchRole
+  }
+
+  const grants = await db
+    .select({
+      orgMembershipId: MarketplaceAccessGrantTable.orgMembershipId,
+      orgWide: MarketplaceAccessGrantTable.orgWide,
+      removedAt: MarketplaceAccessGrantTable.removedAt,
+      role: MarketplaceAccessGrantTable.role,
+      teamId: MarketplaceAccessGrantTable.teamId,
+    })
+    .from(MarketplaceAccessGrantTable)
+    .where(inArray(MarketplaceAccessGrantTable.marketplaceId, marketplaceIds))
+
+  return resolveGrantRole({ context, grants })
+}
+
+export async function resolvePluginArchResourceRole(input: ResourceLookupInput) {
+  if (isPluginArchOrgAdmin(input.context)) {
+    return "manager" satisfies PluginArchRole
+  }
+
+  if (input.resourceKind === "marketplace") {
+    const grants = await db
+      .select({
+        orgMembershipId: MarketplaceAccessGrantTable.orgMembershipId,
+        orgWide: MarketplaceAccessGrantTable.orgWide,
+        removedAt: MarketplaceAccessGrantTable.removedAt,
+        role: MarketplaceAccessGrantTable.role,
+        teamId: MarketplaceAccessGrantTable.teamId,
+      })
+      .from(MarketplaceAccessGrantTable)
+      .where(eq(MarketplaceAccessGrantTable.marketplaceId, input.resourceId))
+    return resolveGrantRole({ context: input.context, grants })
+  }
+
+  if (input.resourceKind === "plugin") {
+    const grants = await db
+      .select({
+        orgMembershipId: PluginAccessGrantTable.orgMembershipId,
+        orgWide: PluginAccessGrantTable.orgWide,
+        removedAt: PluginAccessGrantTable.removedAt,
+        role: PluginAccessGrantTable.role,
+        teamId: PluginAccessGrantTable.teamId,
+      })
+      .from(PluginAccessGrantTable)
+      .where(eq(PluginAccessGrantTable.pluginId, input.resourceId))
+    const resolved = await resolveGrantRole({ context: input.context, grants })
+    if (resolved) {
+      return resolved
+    }
+
+    const memberships = await db
+      .select({ marketplaceId: MarketplacePluginTable.marketplaceId })
+      .from(MarketplacePluginTable)
+      .where(and(eq(MarketplacePluginTable.pluginId, input.resourceId), isNull(MarketplacePluginTable.removedAt)))
+
+    const marketplaceRole = await resolveMarketplaceRoleForIds(input.context, memberships.map((membership) => membership.marketplaceId))
+    return maxRole(resolved, marketplaceRole ? "viewer" : null)
+  }
+
+  if (input.resourceKind === "connector_instance") {
+    const grants = await db
+      .select({
+        orgMembershipId: ConnectorInstanceAccessGrantTable.orgMembershipId,
+        orgWide: ConnectorInstanceAccessGrantTable.orgWide,
+        removedAt: ConnectorInstanceAccessGrantTable.removedAt,
+        role: ConnectorInstanceAccessGrantTable.role,
+        teamId: ConnectorInstanceAccessGrantTable.teamId,
+      })
+      .from(ConnectorInstanceAccessGrantTable)
+      .where(eq(ConnectorInstanceAccessGrantTable.connectorInstanceId, input.resourceId))
+    return resolveGrantRole({ context: input.context, grants })
+  }
+
+  const directGrants = await db
+    .select({
+      orgMembershipId: ConfigObjectAccessGrantTable.orgMembershipId,
+      orgWide: ConfigObjectAccessGrantTable.orgWide,
+      removedAt: ConfigObjectAccessGrantTable.removedAt,
+      role: ConfigObjectAccessGrantTable.role,
+      teamId: ConfigObjectAccessGrantTable.teamId,
+    })
+    .from(ConfigObjectAccessGrantTable)
+    .where(eq(ConfigObjectAccessGrantTable.configObjectId, input.resourceId))
+
+  let resolved = await resolveGrantRole({ context: input.context, grants: directGrants })
+  if (resolved) {
+    return resolved
+  }
+
+  const memberships = await db
+    .select({ pluginId: PluginConfigObjectTable.pluginId })
+    .from(PluginConfigObjectTable)
+    .where(and(eq(PluginConfigObjectTable.configObjectId, input.resourceId), isNull(PluginConfigObjectTable.removedAt)))
+
+  const pluginRole = await resolvePluginRoleForIds(input.context, memberships.map((membership) => membership.pluginId))
+  resolved = maxRole(resolved, pluginRole ? "viewer" : null)
+  return resolved
+}
+
+export async function requirePluginArchCapability(context: PluginArchActorContext, capability: PluginArchCapability) {
+  if (hasPluginArchCapability(context, capability)) {
+    return
+  }
+
+  throw new PluginArchAuthorizationError(403, "forbidden", `Missing organization capability: ${capability}`)
+}
+
+export async function requirePluginArchResourceRole(input: {
+  context: PluginArchActorContext
+  resourceId: ConfigObjectId | ConnectorInstanceId | MarketplaceId | PluginId
+  resourceKind: PluginArchResourceKind
+  role: PluginArchRole
+}) {
+  const resolved = await resolvePluginArchResourceRole(input as RequireResourceRoleInput)
+  if (roleSatisfies(resolved, input.role)) {
+    return resolved
+  }
+
+  throw new PluginArchAuthorizationError(
+    403,
+    "forbidden",
+    `Missing ${input.role} access for ${input.resourceKind.replace(/_/g, " ")}.`,
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/connector-cleanup.ts b/ee/apps/den-api/src/routes/org/plugin-system/connector-cleanup.ts
new file mode 100644
index 0000000000..3be0e77946
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/connector-cleanup.ts
@@ -0,0 +1,58 @@
+export type ConnectorCleanupMarketplaceMembership<TPluginId extends string = string, TMarketplaceId extends string = string> = {
+  marketplaceId: TMarketplaceId
+  membershipSource: "api" | "connector" | "manual" | "system"
+  pluginId: TPluginId
+}
+
+export function uniqueIds<TId extends string>(values: TId[]) {
+  return [...new Set(values)]
+}
+
+export function planConnectorImportedResourceCleanup<TPluginId extends string, TMarketplaceId extends string>(input: {
+  activeMarketplaceMemberships: Array<ConnectorCleanupMarketplaceMembership<TPluginId, TMarketplaceId>>
+  activeMappingPluginIds: TPluginId[]
+  activePluginMembershipPluginIds: TPluginId[]
+  candidateMarketplaceIds: TMarketplaceId[]
+  candidatePluginIds: TPluginId[]
+}) {
+  const candidateMarketplaceIds = uniqueIds(input.candidateMarketplaceIds)
+  const candidatePluginIds = uniqueIds(input.candidatePluginIds)
+  const candidateMarketplaceIdSet = new Set(candidateMarketplaceIds)
+  const activeMappingPluginIdSet = new Set(input.activeMappingPluginIds)
+  const activePluginMembershipPluginIdSet = new Set(input.activePluginMembershipPluginIds)
+
+  const marketplaceMembershipsByPlugin = new Map<TPluginId, Array<ConnectorCleanupMarketplaceMembership<TPluginId, TMarketplaceId>>>()
+  const marketplaceMembershipsByMarketplace = new Map<TMarketplaceId, Array<ConnectorCleanupMarketplaceMembership<TPluginId, TMarketplaceId>>>()
+  for (const membership of input.activeMarketplaceMemberships) {
+    const membershipsForPlugin = marketplaceMembershipsByPlugin.get(membership.pluginId) ?? []
+    membershipsForPlugin.push(membership)
+    marketplaceMembershipsByPlugin.set(membership.pluginId, membershipsForPlugin)
+
+    const membershipsForMarketplace = marketplaceMembershipsByMarketplace.get(membership.marketplaceId) ?? []
+    membershipsForMarketplace.push(membership)
+    marketplaceMembershipsByMarketplace.set(membership.marketplaceId, membershipsForMarketplace)
+  }
+
+  const pluginIdsToDelete = candidatePluginIds.filter((pluginId) => {
+    if (activeMappingPluginIdSet.has(pluginId) || activePluginMembershipPluginIdSet.has(pluginId)) {
+      return false
+    }
+
+    const activeMarketplaceMemberships = marketplaceMembershipsByPlugin.get(pluginId) ?? []
+    const hasNonConnectorDependency = activeMarketplaceMemberships.some((membership) => (
+      !candidateMarketplaceIdSet.has(membership.marketplaceId) || membership.membershipSource !== "connector"
+    ))
+    return !hasNonConnectorDependency
+  })
+  const pluginIdsToDeleteSet = new Set(pluginIdsToDelete)
+
+  const marketplaceIdsToDelete = candidateMarketplaceIds.filter((marketplaceId) => {
+    const memberships = marketplaceMembershipsByMarketplace.get(marketplaceId) ?? []
+    return memberships.every((membership) => pluginIdsToDeleteSet.has(membership.pluginId))
+  })
+
+  return {
+    marketplaceIdsToDelete,
+    pluginIdsToDelete,
+  }
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/contracts.ts b/ee/apps/den-api/src/routes/org/plugin-system/contracts.ts
new file mode 100644
index 0000000000..a3db498b7e
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/contracts.ts
@@ -0,0 +1,1012 @@
+import type { z } from "zod"
+import {
+  accessGrantListResponseSchema,
+  accessGrantMutationResponseSchema,
+  configObjectAccessGrantParamsSchema,
+  configObjectCreateSchema,
+  configObjectCreateVersionSchema,
+  configObjectDetailResponseSchema,
+  configObjectListQuerySchema,
+  configObjectListResponseSchema,
+  configObjectMutationResponseSchema,
+  configObjectParamsSchema,
+  configObjectPluginAttachSchema,
+  configObjectVersionDetailResponseSchema,
+  configObjectVersionListQuerySchema,
+  configObjectVersionListResponseSchema,
+  configObjectVersionParamsSchema,
+  connectorAccountCreateSchema,
+  connectorAccountDetailResponseSchema,
+  connectorAccountDisconnectSchema,
+  connectorAccountListQuerySchema,
+  connectorAccountListResponseSchema,
+  connectorAccountDisconnectResponseSchema,
+  connectorAccountMutationResponseSchema,
+  connectorInstanceAutoImportSchema,
+  connectorInstanceConfigurationResponseSchema,
+  connectorInstanceRemoveResponseSchema,
+  connectorAccountParamsSchema,
+  connectorAccountRepositoryParamsSchema,
+  connectorInstanceAccessGrantParamsSchema,
+  connectorInstanceCreateSchema,
+  connectorInstanceDetailResponseSchema,
+  connectorInstanceListQuerySchema,
+  connectorInstanceListResponseSchema,
+  connectorInstanceMutationResponseSchema,
+  connectorInstanceParamsSchema,
+  connectorInstanceUpdateSchema,
+  connectorMappingCreateSchema,
+  connectorMappingListQuerySchema,
+  connectorMappingListResponseSchema,
+  connectorMappingMutationResponseSchema,
+  connectorMappingParamsSchema,
+  connectorMappingUpdateSchema,
+  connectorSyncAsyncResponseSchema,
+  connectorSyncEventDetailResponseSchema,
+  connectorSyncEventListQuerySchema,
+  connectorSyncEventListResponseSchema,
+  connectorSyncEventParamsSchema,
+  connectorTargetCreateSchema,
+  connectorTargetDetailResponseSchema,
+  connectorTargetListQuerySchema,
+  connectorTargetListResponseSchema,
+  connectorTargetMutationResponseSchema,
+  connectorTargetParamsSchema,
+  connectorTargetUpdateSchema,
+  githubConnectorAccountCreateSchema,
+  githubConnectorDiscoveryResponseSchema,
+  githubDiscoveryApplyResponseSchema,
+  githubDiscoveryApplySchema,
+  githubDiscoveryTreeQuerySchema,
+  githubDiscoveryTreeResponseSchema,
+  githubInstallCompleteResponseSchema,
+  githubInstallCompleteSchema,
+  githubInstallStartResponseSchema,
+  githubInstallStartSchema,
+  githubConnectorSetupSchema,
+  githubRepositoryListQuerySchema,
+  githubRepositoryListResponseSchema,
+  githubSetupResponseSchema,
+  githubValidateTargetResponseSchema,
+  githubValidateTargetSchema,
+  githubWebhookAcceptedResponseSchema,
+  githubWebhookHeadersSchema,
+  githubWebhookIgnoredResponseSchema,
+  githubWebhookRawBodySchema,
+  githubWebhookUnauthorizedResponseSchema,
+  marketplaceAccessGrantParamsSchema,
+  marketplaceCreateSchema,
+  marketplaceDetailResponseSchema,
+  marketplaceListQuerySchema,
+  marketplaceListResponseSchema,
+  marketplaceMutationResponseSchema,
+  marketplaceParamsSchema,
+  marketplacePluginListResponseSchema,
+  marketplaceResolvedResponseSchema,
+  marketplacePluginMutationResponseSchema,
+  marketplacePluginParamsSchema,
+  marketplacePluginWriteSchema,
+  marketplaceUpdateSchema,
+  pluginAccessGrantParamsSchema,
+  pluginConfigObjectParamsSchema,
+  pluginCreateSchema,
+  pluginDetailResponseSchema,
+  pluginListQuerySchema,
+  pluginListResponseSchema,
+  pluginMembershipMutationResponseSchema,
+  pluginMembershipListResponseSchema,
+  pluginMembershipWriteSchema,
+  pluginMutationResponseSchema,
+  pluginParamsSchema,
+  pluginUpdateSchema,
+  resourceAccessGrantWriteSchema,
+} from "./schemas.js"
+
+type EndpointMethod = "DELETE" | "GET" | "PATCH" | "POST"
+type EndpointAudience = "admin" | "public_webhook"
+type EndpointTag = "Config Objects" | "Plugins" | "Marketplaces" | "Connectors" | "GitHub" | "Webhooks"
+
+type EndpointContract = {
+  audience: EndpointAudience
+  description: string
+  method: EndpointMethod
+  path: string
+  request?: {
+    body?: z.ZodTypeAny
+    headers?: z.ZodTypeAny
+    params?: z.ZodTypeAny
+    query?: z.ZodTypeAny
+  }
+  response: {
+    description: string
+    schema?: z.ZodTypeAny
+    status: 200 | 201 | 202 | 204 | 401
+  }
+  tag: EndpointTag
+}
+
+type DeferredEndpointContract = {
+  description: string
+  method: EndpointMethod
+  path: string
+  reason: string
+  tag: EndpointTag
+}
+
+const orgBasePath = "/v1"
+
+export const pluginArchRoutePaths = {
+  configObjects: `${orgBasePath}/config-objects`,
+  configObject: `${orgBasePath}/config-objects/:configObjectId`,
+  configObjectArchive: `${orgBasePath}/config-objects/:configObjectId/archive`,
+  configObjectDelete: `${orgBasePath}/config-objects/:configObjectId/delete`,
+  configObjectRestore: `${orgBasePath}/config-objects/:configObjectId/restore`,
+  configObjectPlugins: `${orgBasePath}/config-objects/:configObjectId/plugins`,
+  configObjectPlugin: `${orgBasePath}/config-objects/:configObjectId/plugins/:pluginId`,
+  configObjectAccess: `${orgBasePath}/config-objects/:configObjectId/access`,
+  configObjectAccessGrant: `${orgBasePath}/config-objects/:configObjectId/access/:grantId`,
+  configObjectVersions: `${orgBasePath}/config-objects/:configObjectId/versions`,
+  configObjectVersion: `${orgBasePath}/config-objects/:configObjectId/versions/:versionId`,
+  configObjectLatestVersion: `${orgBasePath}/config-objects/:configObjectId/versions/latest`,
+  configObjectCompareVersions: `${orgBasePath}/config-objects/:configObjectId/versions/compare`,
+  skills: `${orgBasePath}/skills`,
+  agents: `${orgBasePath}/agents`,
+  commands: `${orgBasePath}/commands`,
+  tools: `${orgBasePath}/tools`,
+  mcps: `${orgBasePath}/mcps`,
+  plugins: `${orgBasePath}/plugins`,
+  plugin: `${orgBasePath}/plugins/:pluginId`,
+  pluginArchive: `${orgBasePath}/plugins/:pluginId/archive`,
+  pluginRestore: `${orgBasePath}/plugins/:pluginId/restore`,
+  pluginConfigObjects: `${orgBasePath}/plugins/:pluginId/config-objects`,
+  pluginConfigObject: `${orgBasePath}/plugins/:pluginId/config-objects/:configObjectId`,
+  pluginResolved: `${orgBasePath}/plugins/:pluginId/resolved`,
+  pluginReleases: `${orgBasePath}/plugins/:pluginId/releases`,
+  pluginAccess: `${orgBasePath}/plugins/:pluginId/access`,
+  pluginAccessGrant: `${orgBasePath}/plugins/:pluginId/access/:grantId`,
+  marketplaces: `${orgBasePath}/marketplaces`,
+  marketplace: `${orgBasePath}/marketplaces/:marketplaceId`,
+  marketplaceResolved: `${orgBasePath}/marketplaces/:marketplaceId/resolved`,
+  marketplaceArchive: `${orgBasePath}/marketplaces/:marketplaceId/archive`,
+  marketplaceRestore: `${orgBasePath}/marketplaces/:marketplaceId/restore`,
+  marketplacePlugins: `${orgBasePath}/marketplaces/:marketplaceId/plugins`,
+  marketplacePlugin: `${orgBasePath}/marketplaces/:marketplaceId/plugins/:pluginId`,
+  marketplaceAccess: `${orgBasePath}/marketplaces/:marketplaceId/access`,
+  marketplaceAccessGrant: `${orgBasePath}/marketplaces/:marketplaceId/access/:grantId`,
+  connectorAccounts: `${orgBasePath}/connector-accounts`,
+  connectorAccount: `${orgBasePath}/connector-accounts/:connectorAccountId`,
+  connectorAccountDisconnect: `${orgBasePath}/connector-accounts/:connectorAccountId/disconnect`,
+  connectorInstances: `${orgBasePath}/connector-instances`,
+  connectorInstance: `${orgBasePath}/connector-instances/:connectorInstanceId`,
+  connectorInstanceConfiguration: `${orgBasePath}/connector-instances/:connectorInstanceId/configuration`,
+  connectorInstanceAutoImport: `${orgBasePath}/connector-instances/:connectorInstanceId/auto-import`,
+  connectorInstanceRemove: `${orgBasePath}/connector-instances/:connectorInstanceId/remove`,
+  connectorInstanceArchive: `${orgBasePath}/connector-instances/:connectorInstanceId/archive`,
+  connectorInstanceDisable: `${orgBasePath}/connector-instances/:connectorInstanceId/disable`,
+  connectorInstanceEnable: `${orgBasePath}/connector-instances/:connectorInstanceId/enable`,
+  connectorInstanceAccess: `${orgBasePath}/connector-instances/:connectorInstanceId/access`,
+  connectorInstanceAccessGrant: `${orgBasePath}/connector-instances/:connectorInstanceId/access/:grantId`,
+  connectorTargets: `${orgBasePath}/connector-instances/:connectorInstanceId/targets`,
+  connectorTarget: `${orgBasePath}/connector-targets/:connectorTargetId`,
+  connectorTargetResync: `${orgBasePath}/connector-targets/:connectorTargetId/resync`,
+  connectorTargetMappings: `${orgBasePath}/connector-targets/:connectorTargetId/mappings`,
+  connectorMapping: `${orgBasePath}/connector-mappings/:connectorMappingId`,
+  connectorMappingPreview: `${orgBasePath}/connector-mappings/:connectorMappingId/preview`,
+  connectorSyncEvents: `${orgBasePath}/connector-sync-events`,
+  connectorSyncEvent: `${orgBasePath}/connector-sync-events/:connectorSyncEventId`,
+  connectorSyncEventRetry: `${orgBasePath}/connector-sync-events/:connectorSyncEventId/retry`,
+  connectorInstanceDiscovery: `${orgBasePath}/connector-instances/:connectorInstanceId/discovery`,
+  connectorInstanceDiscoveryApply: `${orgBasePath}/connector-instances/:connectorInstanceId/discovery/apply`,
+  connectorInstanceDiscoveryTree: `${orgBasePath}/connector-instances/:connectorInstanceId/discovery/tree`,
+  githubInstallStart: `${orgBasePath}/connectors/github/install/start`,
+  githubInstallComplete: `${orgBasePath}/connectors/github/install/complete`,
+  githubSetup: `${orgBasePath}/connectors/github/setup`,
+  githubAccounts: `${orgBasePath}/connectors/github/accounts`,
+  githubAccountRepositories: `${orgBasePath}/connectors/github/accounts/:connectorAccountId/repositories`,
+  githubValidateTarget: `${orgBasePath}/connectors/github/validate-target`,
+  githubWebhookIngress: "/v1/webhooks/connectors/github",
+} as const
+
+export const pluginArchEndpointContracts: Record<string, EndpointContract> = {
+  listConfigObjects: {
+    audience: "admin",
+    description: "List current config object projections with search and connector filters.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjects,
+    request: { query: configObjectListQuerySchema },
+    response: { description: "Current config object rows.", schema: configObjectListResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  getConfigObject: {
+    audience: "admin",
+    description: "Get one config object with its latest version projection.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObject,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Current config object detail.", schema: configObjectDetailResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  createConfigObject: {
+    audience: "admin",
+    description: "Create a cloud or imported config object and optionally attach it to plugins.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjects,
+    request: { body: configObjectCreateSchema },
+    response: { description: "Config object created successfully.", schema: configObjectMutationResponseSchema, status: 201 },
+    tag: "Config Objects",
+  },
+  createConfigObjectVersion: {
+    audience: "admin",
+    description: "Create a new immutable version for an existing config object.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectVersions,
+    request: { body: configObjectCreateVersionSchema, params: configObjectParamsSchema },
+    response: { description: "Latest config object detail after version creation.", schema: configObjectMutationResponseSchema, status: 201 },
+    tag: "Config Objects",
+  },
+  archiveConfigObject: {
+    audience: "admin",
+    description: "Archive a config object without removing history.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectArchive,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Archived config object detail.", schema: configObjectMutationResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  deleteConfigObject: {
+    audience: "admin",
+    description: "Soft-delete a config object while preserving history.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectDelete,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Deleted config object detail.", schema: configObjectMutationResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  restoreConfigObject: {
+    audience: "admin",
+    description: "Restore a deleted or archived config object.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectRestore,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Restored config object detail.", schema: configObjectMutationResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  listConfigObjectPlugins: {
+    audience: "admin",
+    description: "List the plugins that currently include a config object.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectPlugins,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Plugin memberships for the config object.", schema: pluginMembershipListResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  attachConfigObjectToPlugin: {
+    audience: "admin",
+    description: "Attach a config object to a plugin using plugin-scoped write access.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectPlugins,
+    request: { body: configObjectPluginAttachSchema, params: configObjectParamsSchema },
+    response: { description: "Plugin membership created successfully.", schema: pluginMembershipMutationResponseSchema, status: 201 },
+    tag: "Config Objects",
+  },
+  removeConfigObjectFromPlugin: {
+    audience: "admin",
+    description: "Remove one active plugin membership from a config object.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.configObjectPlugin,
+    request: { params: configObjectParamsSchema.extend({ pluginId: pluginParamsSchema.shape.pluginId }) },
+    response: { description: "Plugin membership removed successfully.", status: 204 },
+    tag: "Config Objects",
+  },
+  listConfigObjectAccess: {
+    audience: "admin",
+    description: "List direct, team, and org-wide grants for a config object.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectAccess,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Config object access grants.", schema: accessGrantListResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  grantConfigObjectAccess: {
+    audience: "admin",
+    description: "Create one direct, team, or org-wide access grant for a config object.",
+    method: "POST",
+    path: pluginArchRoutePaths.configObjectAccess,
+    request: { body: resourceAccessGrantWriteSchema, params: configObjectParamsSchema },
+    response: { description: "Config object access grant created successfully.", schema: accessGrantMutationResponseSchema, status: 201 },
+    tag: "Config Objects",
+  },
+  revokeConfigObjectAccess: {
+    audience: "admin",
+    description: "Soft-revoke one config object access grant.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.configObjectAccessGrant,
+    request: { params: configObjectAccessGrantParamsSchema },
+    response: { description: "Config object access grant revoked successfully.", status: 204 },
+    tag: "Config Objects",
+  },
+  listConfigObjectVersions: {
+    audience: "admin",
+    description: "List immutable versions for a config object.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectVersions,
+    request: { params: configObjectParamsSchema, query: configObjectVersionListQuerySchema },
+    response: { description: "Config object versions.", schema: configObjectVersionListResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  getConfigObjectVersion: {
+    audience: "admin",
+    description: "Get one immutable config object version.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectVersion,
+    request: { params: configObjectVersionParamsSchema },
+    response: { description: "Config object version detail.", schema: configObjectVersionDetailResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  getLatestConfigObjectVersion: {
+    audience: "admin",
+    description: "Resolve the latest config object version using created_at and id ordering.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectLatestVersion,
+    request: { params: configObjectParamsSchema },
+    response: { description: "Latest config object version detail.", schema: configObjectVersionDetailResponseSchema, status: 200 },
+    tag: "Config Objects",
+  },
+  listPlugins: {
+    audience: "admin",
+    description: "List accessible plugins for the organization.",
+    method: "GET",
+    path: pluginArchRoutePaths.plugins,
+    request: { query: pluginListQuerySchema },
+    response: { description: "Plugin list.", schema: pluginListResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  getPlugin: {
+    audience: "admin",
+    description: "Get one plugin and its current metadata.",
+    method: "GET",
+    path: pluginArchRoutePaths.plugin,
+    request: { params: pluginParamsSchema },
+    response: { description: "Plugin detail.", schema: pluginDetailResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  createPlugin: {
+    audience: "admin",
+    description: "Create a private-by-default plugin.",
+    method: "POST",
+    path: pluginArchRoutePaths.plugins,
+    request: { body: pluginCreateSchema },
+    response: { description: "Plugin created successfully.", schema: pluginMutationResponseSchema, status: 201 },
+    tag: "Plugins",
+  },
+  updatePlugin: {
+    audience: "admin",
+    description: "Patch plugin metadata.",
+    method: "PATCH",
+    path: pluginArchRoutePaths.plugin,
+    request: { body: pluginUpdateSchema, params: pluginParamsSchema },
+    response: { description: "Plugin updated successfully.", schema: pluginMutationResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  archivePlugin: {
+    audience: "admin",
+    description: "Archive a plugin without deleting membership history.",
+    method: "POST",
+    path: pluginArchRoutePaths.pluginArchive,
+    request: { params: pluginParamsSchema },
+    response: { description: "Archived plugin detail.", schema: pluginMutationResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  restorePlugin: {
+    audience: "admin",
+    description: "Restore an archived or deleted plugin.",
+    method: "POST",
+    path: pluginArchRoutePaths.pluginRestore,
+    request: { params: pluginParamsSchema },
+    response: { description: "Restored plugin detail.", schema: pluginMutationResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  listPluginConfigObjects: {
+    audience: "admin",
+    description: "List plugin memberships and the current config object projections they reference.",
+    method: "GET",
+    path: pluginArchRoutePaths.pluginConfigObjects,
+    request: { params: pluginParamsSchema },
+    response: { description: "Plugin memberships.", schema: pluginMembershipListResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  addPluginConfigObject: {
+    audience: "admin",
+    description: "Add a config object to a plugin using plugin-scoped write access.",
+    method: "POST",
+    path: pluginArchRoutePaths.pluginConfigObjects,
+    request: { body: pluginMembershipWriteSchema, params: pluginParamsSchema },
+    response: { description: "Plugin membership created successfully.", schema: pluginMembershipMutationResponseSchema, status: 201 },
+    tag: "Plugins",
+  },
+  removePluginConfigObject: {
+    audience: "admin",
+    description: "Remove one config object membership from a plugin.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.pluginConfigObject,
+    request: { params: pluginConfigObjectParamsSchema },
+    response: { description: "Plugin membership removed successfully.", status: 204 },
+    tag: "Plugins",
+  },
+  getResolvedPlugin: {
+    audience: "admin",
+    description: "Preview the resolved latest-version members of a plugin without invoking delivery.",
+    method: "GET",
+    path: pluginArchRoutePaths.pluginResolved,
+    request: { params: pluginParamsSchema },
+    response: { description: "Resolved plugin membership view.", schema: pluginMembershipListResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  listPluginAccess: {
+    audience: "admin",
+    description: "List direct, team, and org-wide grants for a plugin.",
+    method: "GET",
+    path: pluginArchRoutePaths.pluginAccess,
+    request: { params: pluginParamsSchema },
+    response: { description: "Plugin access grants.", schema: accessGrantListResponseSchema, status: 200 },
+    tag: "Plugins",
+  },
+  grantPluginAccess: {
+    audience: "admin",
+    description: "Create one direct, team, or org-wide access grant for a plugin.",
+    method: "POST",
+    path: pluginArchRoutePaths.pluginAccess,
+    request: { body: resourceAccessGrantWriteSchema, params: pluginParamsSchema },
+    response: { description: "Plugin access grant created successfully.", schema: accessGrantMutationResponseSchema, status: 201 },
+    tag: "Plugins",
+  },
+  revokePluginAccess: {
+    audience: "admin",
+    description: "Soft-revoke one plugin access grant.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.pluginAccessGrant,
+    request: { params: pluginAccessGrantParamsSchema },
+    response: { description: "Plugin access grant revoked successfully.", status: 204 },
+    tag: "Plugins",
+  },
+  listMarketplaces: {
+    audience: "admin",
+    description: "List accessible marketplaces for the organization.",
+    method: "GET",
+    path: pluginArchRoutePaths.marketplaces,
+    request: { query: marketplaceListQuerySchema },
+    response: { description: "Marketplace list.", schema: marketplaceListResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  getMarketplace: {
+    audience: "admin",
+    description: "Get one marketplace and its current metadata.",
+    method: "GET",
+    path: pluginArchRoutePaths.marketplace,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Marketplace detail.", schema: marketplaceDetailResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  createMarketplace: {
+    audience: "admin",
+    description: "Create a private-by-default marketplace.",
+    method: "POST",
+    path: pluginArchRoutePaths.marketplaces,
+    request: { body: marketplaceCreateSchema },
+    response: { description: "Marketplace created successfully.", schema: marketplaceMutationResponseSchema, status: 201 },
+    tag: "Marketplaces",
+  },
+  updateMarketplace: {
+    audience: "admin",
+    description: "Patch marketplace metadata.",
+    method: "PATCH",
+    path: pluginArchRoutePaths.marketplace,
+    request: { body: marketplaceUpdateSchema, params: marketplaceParamsSchema },
+    response: { description: "Marketplace updated successfully.", schema: marketplaceMutationResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  archiveMarketplace: {
+    audience: "admin",
+    description: "Archive a marketplace without deleting membership history.",
+    method: "POST",
+    path: pluginArchRoutePaths.marketplaceArchive,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Archived marketplace detail.", schema: marketplaceMutationResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  restoreMarketplace: {
+    audience: "admin",
+    description: "Restore an archived or deleted marketplace.",
+    method: "POST",
+    path: pluginArchRoutePaths.marketplaceRestore,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Restored marketplace detail.", schema: marketplaceMutationResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  listMarketplacePlugins: {
+    audience: "admin",
+    description: "List marketplace memberships and the plugins they reference.",
+    method: "GET",
+    path: pluginArchRoutePaths.marketplacePlugins,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Marketplace plugin memberships.", schema: marketplacePluginListResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  getMarketplaceResolved: {
+    audience: "admin",
+    description: "Return marketplace detail with plugins and derived source info.",
+    method: "GET",
+    path: pluginArchRoutePaths.marketplaceResolved,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Marketplace resolved detail.", schema: marketplaceResolvedResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  addMarketplacePlugin: {
+    audience: "admin",
+    description: "Add a plugin to a marketplace using marketplace-scoped write access.",
+    method: "POST",
+    path: pluginArchRoutePaths.marketplacePlugins,
+    request: { body: marketplacePluginWriteSchema, params: marketplaceParamsSchema },
+    response: { description: "Marketplace plugin membership created successfully.", schema: marketplacePluginMutationResponseSchema, status: 201 },
+    tag: "Marketplaces",
+  },
+  removeMarketplacePlugin: {
+    audience: "admin",
+    description: "Remove one plugin membership from a marketplace.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.marketplacePlugin,
+    request: { params: marketplacePluginParamsSchema },
+    response: { description: "Marketplace plugin membership removed successfully.", status: 204 },
+    tag: "Marketplaces",
+  },
+  listMarketplaceAccess: {
+    audience: "admin",
+    description: "List direct, team, and org-wide grants for a marketplace.",
+    method: "GET",
+    path: pluginArchRoutePaths.marketplaceAccess,
+    request: { params: marketplaceParamsSchema },
+    response: { description: "Marketplace access grants.", schema: accessGrantListResponseSchema, status: 200 },
+    tag: "Marketplaces",
+  },
+  grantMarketplaceAccess: {
+    audience: "admin",
+    description: "Create one direct, team, or org-wide access grant for a marketplace.",
+    method: "POST",
+    path: pluginArchRoutePaths.marketplaceAccess,
+    request: { body: resourceAccessGrantWriteSchema, params: marketplaceParamsSchema },
+    response: { description: "Marketplace access grant created successfully.", schema: accessGrantMutationResponseSchema, status: 201 },
+    tag: "Marketplaces",
+  },
+  revokeMarketplaceAccess: {
+    audience: "admin",
+    description: "Soft-revoke one marketplace access grant.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.marketplaceAccessGrant,
+    request: { params: marketplaceAccessGrantParamsSchema },
+    response: { description: "Marketplace access grant revoked successfully.", status: 204 },
+    tag: "Marketplaces",
+  },
+  listConnectorAccounts: {
+    audience: "admin",
+    description: "List connector accounts such as GitHub App installations available to the org.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorAccounts,
+    request: { query: connectorAccountListQuerySchema },
+    response: { description: "Connector account list.", schema: connectorAccountListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  createConnectorAccount: {
+    audience: "admin",
+    description: "Create a reusable connector account record.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorAccounts,
+    request: { body: connectorAccountCreateSchema },
+    response: { description: "Connector account created successfully.", schema: connectorAccountMutationResponseSchema, status: 201 },
+    tag: "Connectors",
+  },
+  getConnectorAccount: {
+    audience: "admin",
+    description: "Get one connector account record.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorAccount,
+    request: { params: connectorAccountParamsSchema },
+    response: { description: "Connector account detail.", schema: connectorAccountDetailResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  disconnectConnectorAccount: {
+    audience: "admin",
+    description: "Disconnect one connector account and delete its connector-managed imports (mappings, config objects, plugins created via discovery, and empty marketplaces).",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorAccountDisconnect,
+    request: { body: connectorAccountDisconnectSchema, params: connectorAccountParamsSchema },
+    response: { description: "Connector account disconnected and cleaned up successfully.", schema: connectorAccountDisconnectResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  listConnectorInstances: {
+    audience: "admin",
+    description: "List configured connector instances for the org.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstances,
+    request: { query: connectorInstanceListQuerySchema },
+    response: { description: "Connector instance list.", schema: connectorInstanceListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  createConnectorInstance: {
+    audience: "admin",
+    description: "Create a connector instance backed by one connector account.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstances,
+    request: { body: connectorInstanceCreateSchema },
+    response: { description: "Connector instance created successfully.", schema: connectorInstanceMutationResponseSchema, status: 201 },
+    tag: "Connectors",
+  },
+  getConnectorInstance: {
+    audience: "admin",
+    description: "Get one connector instance.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstance,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance detail.", schema: connectorInstanceDetailResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  updateConnectorInstance: {
+    audience: "admin",
+    description: "Patch connector instance metadata or config.",
+    method: "PATCH",
+    path: pluginArchRoutePaths.connectorInstance,
+    request: { body: connectorInstanceUpdateSchema, params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance updated successfully.", schema: connectorInstanceMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  archiveConnectorInstance: {
+    audience: "admin",
+    description: "Archive a connector instance.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceArchive,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance archived successfully.", schema: connectorInstanceMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  getConnectorInstanceConfiguration: {
+    audience: "admin",
+    description: "Return the configured plugins, mappings, and import state for a connector instance.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstanceConfiguration,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance configuration returned successfully.", schema: connectorInstanceConfigurationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  setConnectorInstanceAutoImport: {
+    audience: "admin",
+    description: "Enable or disable auto-import of new plugins for a connector instance.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceAutoImport,
+    request: { body: connectorInstanceAutoImportSchema, params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance auto-import updated successfully.", schema: connectorInstanceConfigurationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  removeConnectorInstance: {
+    audience: "admin",
+    description: "Remove a connector instance and delete its associated plugins, mappings, config objects, and bindings.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceRemove,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance removed and cleaned up successfully.", schema: connectorInstanceRemoveResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  disableConnectorInstance: {
+    audience: "admin",
+    description: "Disable sync execution for a connector instance.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceDisable,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance disabled successfully.", schema: connectorInstanceMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  enableConnectorInstance: {
+    audience: "admin",
+    description: "Re-enable sync execution for a connector instance.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceEnable,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance enabled successfully.", schema: connectorInstanceMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  listConnectorInstanceAccess: {
+    audience: "admin",
+    description: "List direct, team, and org-wide grants for a connector instance.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstanceAccess,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance access grants.", schema: accessGrantListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  grantConnectorInstanceAccess: {
+    audience: "admin",
+    description: "Create one direct, team, or org-wide access grant for a connector instance.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceAccess,
+    request: { body: resourceAccessGrantWriteSchema, params: connectorInstanceParamsSchema },
+    response: { description: "Connector instance access grant created successfully.", schema: accessGrantMutationResponseSchema, status: 201 },
+    tag: "Connectors",
+  },
+  revokeConnectorInstanceAccess: {
+    audience: "admin",
+    description: "Soft-revoke one connector instance access grant.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.connectorInstanceAccessGrant,
+    request: { params: connectorInstanceAccessGrantParamsSchema },
+    response: { description: "Connector instance access grant revoked successfully.", status: 204 },
+    tag: "Connectors",
+  },
+  listConnectorTargets: {
+    audience: "admin",
+    description: "List external targets configured under a connector instance.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorTargets,
+    request: { params: connectorInstanceParamsSchema, query: connectorTargetListQuerySchema },
+    response: { description: "Connector target list.", schema: connectorTargetListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  createConnectorTarget: {
+    audience: "admin",
+    description: "Create one connector target such as a GitHub repository branch.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorTargets,
+    request: { body: connectorTargetCreateSchema, params: connectorInstanceParamsSchema },
+    response: { description: "Connector target created successfully.", schema: connectorTargetMutationResponseSchema, status: 201 },
+    tag: "Connectors",
+  },
+  getConnectorTarget: {
+    audience: "admin",
+    description: "Get one connector target.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorTarget,
+    request: { params: connectorTargetParamsSchema },
+    response: { description: "Connector target detail.", schema: connectorTargetDetailResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  updateConnectorTarget: {
+    audience: "admin",
+    description: "Patch one connector target.",
+    method: "PATCH",
+    path: pluginArchRoutePaths.connectorTarget,
+    request: { body: connectorTargetUpdateSchema, params: connectorTargetParamsSchema },
+    response: { description: "Connector target updated successfully.", schema: connectorTargetMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  resyncConnectorTarget: {
+    audience: "admin",
+    description: "Queue a manual reconciliation run for one connector target.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorTargetResync,
+    request: { params: connectorTargetParamsSchema },
+    response: { description: "Connector target resync queued successfully.", schema: connectorSyncAsyncResponseSchema, status: 202 },
+    tag: "Connectors",
+  },
+  listConnectorMappings: {
+    audience: "admin",
+    description: "List mappings configured under a connector target.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorTargetMappings,
+    request: { params: connectorTargetParamsSchema, query: connectorMappingListQuerySchema },
+    response: { description: "Connector mapping list.", schema: connectorMappingListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  createConnectorMapping: {
+    audience: "admin",
+    description: "Create a path or API mapping for a connector target.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorTargetMappings,
+    request: { body: connectorMappingCreateSchema, params: connectorTargetParamsSchema },
+    response: { description: "Connector mapping created successfully.", schema: connectorMappingMutationResponseSchema, status: 201 },
+    tag: "Connectors",
+  },
+  updateConnectorMapping: {
+    audience: "admin",
+    description: "Patch one connector mapping.",
+    method: "PATCH",
+    path: pluginArchRoutePaths.connectorMapping,
+    request: { body: connectorMappingUpdateSchema, params: connectorMappingParamsSchema },
+    response: { description: "Connector mapping updated successfully.", schema: connectorMappingMutationResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  deleteConnectorMapping: {
+    audience: "admin",
+    description: "Delete one connector mapping.",
+    method: "DELETE",
+    path: pluginArchRoutePaths.connectorMapping,
+    request: { params: connectorMappingParamsSchema },
+    response: { description: "Connector mapping deleted successfully.", status: 204 },
+    tag: "Connectors",
+  },
+  listConnectorSyncEvents: {
+    audience: "admin",
+    description: "List connector sync events for inspection and debugging.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorSyncEvents,
+    request: { query: connectorSyncEventListQuerySchema },
+    response: { description: "Connector sync event list.", schema: connectorSyncEventListResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  getConnectorSyncEvent: {
+    audience: "admin",
+    description: "Get one connector sync event.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorSyncEvent,
+    request: { params: connectorSyncEventParamsSchema },
+    response: { description: "Connector sync event detail.", schema: connectorSyncEventDetailResponseSchema, status: 200 },
+    tag: "Connectors",
+  },
+  retryConnectorSyncEvent: {
+    audience: "admin",
+    description: "Queue a retry for a failed or partial connector sync event.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorSyncEventRetry,
+    request: { params: connectorSyncEventParamsSchema },
+    response: { description: "Connector sync retry queued successfully.", schema: connectorSyncAsyncResponseSchema, status: 202 },
+    tag: "Connectors",
+  },
+  getGithubConnectorDiscovery: {
+    audience: "admin",
+    description: "Analyze a GitHub connector instance and return the discovered repository shape and plugin candidates.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstanceDiscovery,
+    request: { params: connectorInstanceParamsSchema },
+    response: { description: "GitHub connector discovery returned successfully.", schema: githubConnectorDiscoveryResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  listGithubConnectorDiscoveryTree: {
+    audience: "admin",
+    description: "Page through the normalized GitHub repository tree for one connector instance.",
+    method: "GET",
+    path: pluginArchRoutePaths.connectorInstanceDiscoveryTree,
+    request: { params: connectorInstanceParamsSchema, query: githubDiscoveryTreeQuerySchema },
+    response: { description: "GitHub discovery tree page returned successfully.", schema: githubDiscoveryTreeResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  applyGithubConnectorDiscovery: {
+    audience: "admin",
+    description: "Create OpenWork plugins and connector mappings from selected GitHub discovery candidates.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorInstanceDiscoveryApply,
+    request: { body: githubDiscoveryApplySchema, params: connectorInstanceParamsSchema },
+    response: { description: "GitHub discovery selection applied successfully.", schema: githubDiscoveryApplyResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  githubInstallStart: {
+    audience: "admin",
+    description: "Start the GitHub App install flow and return a redirect URL.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubInstallStart,
+    request: { body: githubInstallStartSchema },
+    response: { description: "GitHub install redirect created successfully.", schema: githubInstallStartResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  githubInstallComplete: {
+    audience: "admin",
+    description: "Complete one GitHub App installation and return repositories visible to it.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubInstallComplete,
+    request: { body: githubInstallCompleteSchema },
+    response: { description: "GitHub installation completed successfully.", schema: githubInstallCompleteResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  githubSetup: {
+    audience: "admin",
+    description: "Create the GitHub connector account, instance, target, and initial mappings in one setup flow.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubSetup,
+    request: { body: githubConnectorSetupSchema },
+    response: { description: "GitHub connector setup created successfully.", schema: githubSetupResponseSchema, status: 201 },
+    tag: "GitHub",
+  },
+  githubCreateAccount: {
+    audience: "admin",
+    description: "Persist a GitHub App installation as a reusable connector account.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubAccounts,
+    request: { body: githubConnectorAccountCreateSchema },
+    response: { description: "GitHub connector account created successfully.", schema: connectorAccountMutationResponseSchema, status: 201 },
+    tag: "GitHub",
+  },
+  githubListRepositories: {
+    audience: "admin",
+    description: "List repositories visible to one GitHub connector account.",
+    method: "GET",
+    path: pluginArchRoutePaths.githubAccountRepositories,
+    request: { params: connectorAccountRepositoryParamsSchema, query: githubRepositoryListQuerySchema },
+    response: { description: "GitHub repositories visible to the installation.", schema: githubRepositoryListResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  githubValidateTarget: {
+    audience: "admin",
+    description: "Validate one GitHub repository-branch target before persisting it.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubValidateTarget,
+    request: { body: githubValidateTargetSchema },
+    response: { description: "GitHub target validation result.", schema: githubValidateTargetResponseSchema, status: 200 },
+    tag: "GitHub",
+  },
+  githubWebhookIngress: {
+    audience: "public_webhook",
+    description: "Accept a GitHub App webhook delivery, verify the raw-body signature, and enqueue any relevant sync work.",
+    method: "POST",
+    path: pluginArchRoutePaths.githubWebhookIngress,
+    request: { body: githubWebhookRawBodySchema, headers: githubWebhookHeadersSchema },
+    response: { description: "Valid webhook accepted or ignored.", schema: githubWebhookAcceptedResponseSchema.or(githubWebhookIgnoredResponseSchema), status: 202 },
+    tag: "Webhooks",
+  },
+}
+
+export const deferredPluginArchEndpointContracts: DeferredEndpointContract[] = [
+  {
+    description: "Compare two config object versions.",
+    method: "GET",
+    path: pluginArchRoutePaths.configObjectCompareVersions,
+    reason: "Diff semantics can wait until immutable version storage exists.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Type-specific convenience endpoints for skills.",
+    method: "GET",
+    path: pluginArchRoutePaths.skills,
+    reason: "Shared config-object routes land first; per-type wrappers follow once the core surface is working.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Type-specific convenience endpoints for agents.",
+    method: "GET",
+    path: pluginArchRoutePaths.agents,
+    reason: "Shared config-object routes land first; per-type wrappers follow once the core surface is working.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Type-specific convenience endpoints for commands.",
+    method: "GET",
+    path: pluginArchRoutePaths.commands,
+    reason: "Shared config-object routes land first; per-type wrappers follow once the core surface is working.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Type-specific convenience endpoints for tools.",
+    method: "GET",
+    path: pluginArchRoutePaths.tools,
+    reason: "Shared config-object routes land first; per-type wrappers follow once the core surface is working.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Type-specific convenience endpoints for MCPs.",
+    method: "GET",
+    path: pluginArchRoutePaths.mcps,
+    reason: "Shared config-object routes land first; per-type wrappers follow once the core surface is working.",
+    tag: "Config Objects",
+  },
+  {
+    description: "Create and list plugin releases.",
+    method: "POST",
+    path: pluginArchRoutePaths.pluginReleases,
+    reason: "Delivery and release snapshots stay deferred until the admin and webhook slice is live.",
+    tag: "Plugins",
+  },
+  {
+    description: "Preview one connector mapping against remote source data.",
+    method: "POST",
+    path: pluginArchRoutePaths.connectorMappingPreview,
+    reason: "Mapping preview depends on the later reconciliation engine and should not block the first admin slice.",
+    tag: "Connectors",
+  },
+]
+
+export const pluginArchContractSummary = {
+  implementationHome: {
+    adminApi: "ee/apps/den-api/src/routes/org",
+    persistence: "ee/packages/den-db/src/schema",
+    webhookIngress: "ee/apps/den-api/src/routes",
+  },
+  outOfScope: [
+    "plugin delivery/install endpoints",
+    "plugin release snapshot implementation",
+    "type-specific convenience wrappers",
+  ],
+} as const
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/github-app.ts b/ee/apps/den-api/src/routes/org/plugin-system/github-app.ts
new file mode 100644
index 0000000000..4fbbe8734c
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/github-app.ts
@@ -0,0 +1,642 @@
+import { createHmac, createSign, randomUUID, timingSafeEqual } from "node:crypto"
+
+export class GithubConnectorConfigError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = "GithubConnectorConfigError"
+  }
+}
+
+export class GithubConnectorRequestError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly body?: unknown,
+  ) {
+    super(message)
+    this.name = "GithubConnectorRequestError"
+  }
+}
+
+export type GithubConnectorAppConfig = {
+  appId: string
+  clientId?: string
+  clientSecret?: string
+  privateKey: string
+}
+
+type GithubFetch = typeof fetch
+
+export type GithubManifestKind = "marketplace" | "plugin" | null
+
+type GithubRepositorySummary = {
+  defaultBranch: string | null
+  fullName: string
+  hasPluginManifest?: boolean
+  id: number
+  manifestKind?: GithubManifestKind
+  marketplacePluginCount?: number | null
+  private: boolean
+}
+
+export type GithubRepositoryTreeEntry = {
+  id: string
+  kind: "blob" | "tree"
+  path: string
+  sha: string | null
+  size: number | null
+}
+
+export type GithubRepositoryTreeSnapshot = {
+  headSha: string
+  truncated: boolean
+  treeEntries: GithubRepositoryTreeEntry[]
+  treeSha: string
+}
+
+export type GithubAppSummary = {
+  htmlUrl: string
+  name: string
+  slug: string
+}
+
+export type GithubInstallationSummary = {
+  accountLogin: string
+  accountType: "Organization" | "User"
+  displayName: string
+  installationId: number
+  repositorySelection: "all" | "selected"
+  settingsUrl: string | null
+}
+
+export type GithubInstallStatePayload = {
+  exp: number
+  nonce: string
+  orgId: string
+  returnPath: string
+  userId: string
+}
+
+const GITHUB_API_BASE = "https://api.github.com"
+const GITHUB_API_VERSION = "2022-11-28"
+
+function base64UrlEncode(value: unknown) {
+  const buffer = typeof value === "string"
+    ? Buffer.from(value)
+    : Buffer.isBuffer(value)
+      ? value
+      : value instanceof Uint8Array
+        ? Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+        : (() => {
+            throw new GithubConnectorConfigError("Unsupported value passed to base64UrlEncode.")
+          })()
+
+  return buffer
+    .toString("base64")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/g, "")
+}
+
+export function normalizeGithubPrivateKey(privateKey: string) {
+  return privateKey.includes("\\n") ? privateKey.replace(/\\n/g, "\n") : privateKey
+}
+
+export function getGithubConnectorAppConfig(input: { appId?: string; privateKey?: string }) {
+  const appId = input.appId?.trim()
+  const privateKey = input.privateKey?.trim()
+
+  if (!appId) {
+    throw new GithubConnectorConfigError("GITHUB_CONNECTOR_APP_ID is required for live GitHub connector testing.")
+  }
+
+  if (!privateKey) {
+    throw new GithubConnectorConfigError("GITHUB_CONNECTOR_APP_PRIVATE_KEY is required for live GitHub connector testing.")
+  }
+
+  return {
+    appId,
+    privateKey: normalizeGithubPrivateKey(privateKey),
+  } satisfies GithubConnectorAppConfig
+}
+
+function base64UrlDecode(value: string) {
+  return Buffer.from(value, "base64url")
+}
+
+function isSafeRelativeReturnPath(value: string) {
+  return value.startsWith("/") && !value.startsWith("//")
+}
+
+export function createGithubInstallStateToken(input: {
+  now?: Date | number
+  orgId: string
+  returnPath: string
+  secret: string
+  ttlSeconds?: number
+  userId: string
+}) {
+  const nowMs = input.now instanceof Date ? input.now.getTime() : (typeof input.now === "number" ? input.now : Date.now())
+  const returnPath = input.returnPath.trim()
+  if (!isSafeRelativeReturnPath(returnPath)) {
+    throw new GithubConnectorConfigError("GitHub install return path must be a safe relative path.")
+  }
+
+  const payload: GithubInstallStatePayload = {
+    exp: Math.floor(nowMs / 1000) + (input.ttlSeconds ?? 10 * 60),
+    nonce: randomUUID(),
+    orgId: input.orgId,
+    returnPath,
+    userId: input.userId,
+  }
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload))
+  const signature = base64UrlEncode(createHmac("sha256", input.secret).update(encodedPayload).digest())
+  return `${encodedPayload}.${signature}`
+}
+
+export function verifyGithubInstallStateToken(input: { now?: Date | number; secret: string; token: string }) {
+  const [encodedPayload, encodedSignature] = input.token.split(".")
+  if (!encodedPayload || !encodedSignature) {
+    return null
+  }
+
+  try {
+    const expectedSignature = createHmac("sha256", input.secret).update(encodedPayload).digest()
+    const providedSignature = base64UrlDecode(encodedSignature)
+    const expectedBytes = new Uint8Array(expectedSignature)
+    const providedBytes = new Uint8Array(providedSignature)
+    if (expectedBytes.length !== providedBytes.length || !timingSafeEqual(expectedBytes, providedBytes)) {
+      return null
+    }
+
+    const payload = JSON.parse(base64UrlDecode(encodedPayload).toString("utf8")) as Partial<GithubInstallStatePayload>
+    const nowSeconds = Math.floor((input.now instanceof Date ? input.now.getTime() : (typeof input.now === "number" ? input.now : Date.now())) / 1000)
+    if (
+      typeof payload.exp !== "number"
+      || typeof payload.nonce !== "string"
+      || typeof payload.orgId !== "string"
+      || typeof payload.returnPath !== "string"
+      || typeof payload.userId !== "string"
+      || payload.exp < nowSeconds
+      || !isSafeRelativeReturnPath(payload.returnPath)
+    ) {
+      return null
+    }
+    return payload as GithubInstallStatePayload
+  } catch {
+    return null
+  }
+}
+
+export function createGithubAppJwt(input: GithubConnectorAppConfig & { now?: Date | number }) {
+  const nowMs = input.now instanceof Date ? input.now.getTime() : (typeof input.now === "number" ? input.now : Date.now())
+  const issuedAt = Math.floor(nowMs / 1000) - 60
+  const expiresAt = issuedAt + (9 * 60)
+  const signingInput = [
+    base64UrlEncode(JSON.stringify({ alg: "RS256", typ: "JWT" })),
+    base64UrlEncode(JSON.stringify({ exp: expiresAt, iat: issuedAt, iss: input.appId })),
+  ].join(".")
+
+  const signer = createSign("RSA-SHA256")
+  signer.update(signingInput)
+  signer.end()
+
+  return `${signingInput}.${base64UrlEncode(signer.sign(input.privateKey))}`
+}
+
+async function requestGithubJson<TResponse>(input: {
+  fetchFn?: GithubFetch
+  headers?: Record<string, string>
+  method?: "GET" | "POST"
+  path: string
+  allowStatuses?: number[]
+}) {
+  const fetchFn = input.fetchFn ?? fetch
+  const response = await fetchFn(`${GITHUB_API_BASE}${input.path}`, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "openwork-den-api",
+      "X-GitHub-Api-Version": GITHUB_API_VERSION,
+      ...input.headers,
+    },
+    method: input.method ?? "GET",
+  })
+
+  const text = await response.text()
+  const body = text ? JSON.parse(text) as unknown : null
+  if (!response.ok && !(input.allowStatuses ?? []).includes(response.status)) {
+    const message = body && typeof body === "object" && typeof (body as Record<string, unknown>).message === "string"
+      ? (body as Record<string, unknown>).message as string
+      : `GitHub request failed with status ${response.status}.`
+    throw new GithubConnectorRequestError(message, response.status, body)
+  }
+
+  return {
+    body: body as TResponse,
+    ok: response.ok,
+    status: response.status,
+  }
+}
+
+export async function getGithubAppSummary(input: { config: GithubConnectorAppConfig; fetchFn?: GithubFetch }) {
+  const jwt = createGithubAppJwt(input.config)
+  const response = await requestGithubJson<{ html_url?: string; name?: string; slug?: string }>({
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+    },
+    path: "/app",
+  })
+
+  const htmlUrl = typeof response.body.html_url === "string" ? response.body.html_url.trim() : ""
+  const slug = typeof response.body.slug === "string" ? response.body.slug.trim() : ""
+  const name = typeof response.body.name === "string" ? response.body.name.trim() : ""
+  if (!htmlUrl || !slug || !name) {
+    throw new GithubConnectorRequestError("GitHub app metadata response was incomplete.", 502, response.body)
+  }
+
+  return {
+    htmlUrl,
+    name,
+    slug,
+  } satisfies GithubAppSummary
+}
+
+export function buildGithubAppInstallUrl(input: { app: GithubAppSummary; state: string }) {
+  const url = new URL(`${input.app.htmlUrl.replace(/\/+$/, "")}/installations/new`)
+  url.searchParams.set("state", input.state)
+  return url.toString()
+}
+
+export async function getGithubInstallationSummary(input: { config: GithubConnectorAppConfig; fetchFn?: GithubFetch; installationId: number }) {
+  const jwt = createGithubAppJwt(input.config)
+  const response = await requestGithubJson<{
+    account?: {
+      login?: string
+      type?: string
+    }
+    html_url?: string
+    id?: number
+    repository_selection?: string
+  }>({
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+    },
+    path: `/app/installations/${input.installationId}`,
+  })
+
+  const installationId = typeof response.body.id === "number" ? response.body.id : input.installationId
+  const accountLogin = typeof response.body.account?.login === "string" ? response.body.account.login.trim() : ""
+  const accountType = response.body.account?.type === "Organization" ? "Organization" : "User"
+  const repositorySelection = response.body.repository_selection === "selected" ? "selected" : "all"
+  if (!accountLogin) {
+    throw new GithubConnectorRequestError("GitHub installation response was missing the account login.", 502, response.body)
+  }
+
+  return {
+    accountLogin,
+    accountType,
+    displayName: accountLogin,
+    installationId,
+    repositorySelection,
+    settingsUrl: typeof response.body.html_url === "string" ? response.body.html_url.trim() || null : null,
+  } satisfies GithubInstallationSummary
+}
+
+async function createGithubInstallationAccessToken(input: { config: GithubConnectorAppConfig; fetchFn?: GithubFetch; installationId: number }) {
+  const jwt = createGithubAppJwt(input.config)
+  const response = await requestGithubJson<{ token?: string }>({
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+    },
+    method: "POST",
+    path: `/app/installations/${input.installationId}/access_tokens`,
+  })
+
+  const token = typeof response.body?.token === "string" ? response.body.token : null
+  if (!token) {
+    throw new GithubConnectorRequestError("GitHub did not return an installation access token.", 502, response.body)
+  }
+
+  return token
+}
+
+export async function getGithubInstallationAccessToken(input: { config: GithubConnectorAppConfig; fetchFn?: GithubFetch; installationId: number }) {
+  return createGithubInstallationAccessToken(input)
+}
+
+function normalizeGithubRepository(entry: unknown): GithubRepositorySummary | null {
+  if (!entry || typeof entry !== "object") {
+    return null
+  }
+
+  const candidate = entry as Record<string, unknown>
+  const id = typeof candidate.id === "number" ? candidate.id : Number(candidate.id)
+  const fullName = typeof candidate.full_name === "string"
+    ? candidate.full_name
+    : typeof candidate.fullName === "string"
+      ? candidate.fullName
+      : null
+
+  if (!Number.isFinite(id) || !fullName) {
+    return null
+  }
+
+  return {
+    defaultBranch: typeof candidate.default_branch === "string"
+      ? candidate.default_branch
+      : typeof candidate.defaultBranch === "string"
+        ? candidate.defaultBranch
+        : null,
+    fullName,
+    id,
+    private: Boolean(candidate.private),
+  }
+}
+
+export async function listGithubInstallationRepositories(input: { config: GithubConnectorAppConfig; fetchFn?: GithubFetch; installationId: number }) {
+  const token = await createGithubInstallationAccessToken(input)
+  const response = await requestGithubJson<{ repositories?: unknown[] }>({
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+    path: "/installation/repositories",
+  })
+
+  if (!Array.isArray(response.body.repositories)) {
+    return []
+  }
+
+  const repositories: GithubRepositorySummary[] = []
+  for (const entry of response.body.repositories) {
+    const normalized = normalizeGithubRepository(entry)
+    if (!normalized) {
+      continue
+    }
+
+    const manifest = await detectRepositoryManifest({
+      fetchFn: input.fetchFn,
+      ownerAndRepo: normalized.fullName,
+      token,
+    })
+
+    repositories.push({
+      ...normalized,
+      hasPluginManifest: manifest.manifestKind !== null,
+      manifestKind: manifest.manifestKind,
+      marketplacePluginCount: manifest.marketplacePluginCount,
+    })
+  }
+
+  return repositories
+}
+
+async function detectRepositoryManifest(input: { fetchFn?: GithubFetch; ownerAndRepo: string; token: string }): Promise<{
+  manifestKind: GithubManifestKind
+  marketplacePluginCount: number | null
+}> {
+  const parts = splitRepositoryFullName(input.ownerAndRepo)
+  if (!parts) {
+    return { manifestKind: null, marketplacePluginCount: null }
+  }
+
+  const marketplaceResponse = await requestGithubJson<{ content?: string; encoding?: string }>({
+    allowStatuses: [404],
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${input.token}`,
+    },
+    path: `/repos/${encodeURIComponent(parts.owner)}/${encodeURIComponent(parts.repo)}/contents/.claude-plugin/marketplace.json`,
+  })
+
+  if (marketplaceResponse.ok && typeof marketplaceResponse.body?.content === "string" && marketplaceResponse.body.encoding === "base64") {
+    let marketplacePluginCount: number | null = null
+    try {
+      const decoded = Buffer.from(marketplaceResponse.body.content.replace(/\n/g, ""), "base64").toString("utf8")
+      const parsed = JSON.parse(decoded) as unknown
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && Array.isArray((parsed as Record<string, unknown>).plugins)) {
+        marketplacePluginCount = ((parsed as Record<string, unknown>).plugins as unknown[]).length
+      }
+    } catch {
+      marketplacePluginCount = null
+    }
+    return { manifestKind: "marketplace", marketplacePluginCount }
+  }
+
+  const pluginResponse = await requestGithubJson<unknown>({
+    allowStatuses: [404],
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${input.token}`,
+    },
+    path: `/repos/${encodeURIComponent(parts.owner)}/${encodeURIComponent(parts.repo)}/contents/.claude-plugin/plugin.json`,
+  })
+
+  if (pluginResponse.ok) {
+    return { manifestKind: "plugin", marketplacePluginCount: null }
+  }
+
+  return { manifestKind: null, marketplacePluginCount: null }
+}
+
+function splitRepositoryFullName(repositoryFullName: string) {
+  const [owner, repo, ...rest] = repositoryFullName.trim().split("/")
+  if (!owner || !repo || rest.length > 0) {
+    return null
+  }
+
+  return { owner, repo }
+}
+
+export async function getGithubRepositoryTextFile(input: {
+  config: GithubConnectorAppConfig
+  fetchFn?: GithubFetch
+  installationId: number
+  path: string
+  ref: string
+  repositoryFullName: string
+  token?: string
+}) {
+  const repositoryParts = splitRepositoryFullName(input.repositoryFullName)
+  if (!repositoryParts) {
+    throw new GithubConnectorRequestError("GitHub repository full name is invalid.", 400)
+  }
+
+  const token = input.token ?? await createGithubInstallationAccessToken(input)
+  const response = await requestGithubJson<{ content?: string; encoding?: string }>({
+    allowStatuses: [404],
+    fetchFn: input.fetchFn,
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+    path: `/repos/${encodeURIComponent(repositoryParts.owner)}/${encodeURIComponent(repositoryParts.repo)}/contents/${input.path.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(input.ref)}`,
+  })
+
+  if (!response.ok) {
+    return null
+  }
+
+  if (response.body.encoding !== "base64" || typeof response.body.content !== "string") {
+    throw new GithubConnectorRequestError("GitHub file response was incomplete.", 502, response.body)
+  }
+
+  return Buffer.from(response.body.content.replace(/\n/g, ""), "base64").toString("utf8")
+}
+
+export async function getGithubRepositoryTree(input: {
+  branch: string
+  config: GithubConnectorAppConfig
+  fetchFn?: GithubFetch
+  installationId: number
+  repositoryFullName: string
+  token?: string
+}) {
+  const repositoryParts = splitRepositoryFullName(input.repositoryFullName)
+  if (!repositoryParts) {
+    throw new GithubConnectorRequestError("GitHub repository full name is invalid.", 400)
+  }
+
+  const token = input.token ?? await createGithubInstallationAccessToken(input)
+  const authHeaders = {
+    Authorization: `Bearer ${token}`,
+  }
+  const commitResponse = await requestGithubJson<{
+    commit?: {
+      tree?: {
+        sha?: string
+      }
+    }
+    sha?: string
+  }>({
+    fetchFn: input.fetchFn,
+    headers: authHeaders,
+    path: `/repos/${encodeURIComponent(repositoryParts.owner)}/${encodeURIComponent(repositoryParts.repo)}/commits/${encodeURIComponent(input.branch.trim())}`,
+  })
+
+  const headSha = typeof commitResponse.body.sha === "string" ? commitResponse.body.sha : ""
+  const treeSha = typeof commitResponse.body.commit?.tree?.sha === "string" ? commitResponse.body.commit.tree.sha : ""
+  if (!headSha || !treeSha) {
+    throw new GithubConnectorRequestError("GitHub commit response was missing the head or tree sha.", 502, commitResponse.body)
+  }
+
+  const treeResponse = await requestGithubJson<{
+    truncated?: boolean
+    tree?: Array<{
+      path?: string
+      sha?: string
+      size?: number
+      type?: string
+    }>
+  }>({
+    fetchFn: input.fetchFn,
+    headers: authHeaders,
+    path: `/repos/${encodeURIComponent(repositoryParts.owner)}/${encodeURIComponent(repositoryParts.repo)}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`,
+  })
+
+  const treeEntries = Array.isArray(treeResponse.body.tree)
+    ? treeResponse.body.tree.flatMap((entry) => {
+        const path = typeof entry.path === "string" ? entry.path.trim() : ""
+        const kind = entry.type === "blob" || entry.type === "tree" ? entry.type : null
+        if (!path || !kind) {
+          return []
+        }
+
+        return [{
+          id: path,
+          kind,
+          path,
+          sha: typeof entry.sha === "string" ? entry.sha : null,
+          size: typeof entry.size === "number" ? entry.size : null,
+        } satisfies GithubRepositoryTreeEntry]
+      })
+    : []
+
+  return {
+    headSha,
+    truncated: Boolean(treeResponse.body.truncated),
+    treeEntries,
+    treeSha,
+  } satisfies GithubRepositoryTreeSnapshot
+}
+
+export async function validateGithubInstallationTarget(input: {
+  branch: string
+  config: GithubConnectorAppConfig
+  fetchFn?: GithubFetch
+  installationId: number
+  ref: string
+  repositoryFullName: string
+  repositoryId: number
+  token?: string
+}) {
+  const repositoryParts = splitRepositoryFullName(input.repositoryFullName)
+  if (!repositoryParts) {
+    return {
+      branchExists: false,
+      defaultBranch: null,
+      repositoryAccessible: false,
+    }
+  }
+
+  const token = input.token ?? await createGithubInstallationAccessToken(input)
+  const authHeaders = {
+    Authorization: `Bearer ${token}`,
+  }
+  const repositoryResponse = await requestGithubJson<{
+    default_branch?: string
+    full_name?: string
+    id?: number
+  }>({
+    allowStatuses: [404],
+    fetchFn: input.fetchFn,
+    headers: authHeaders,
+    path: `/repos/${encodeURIComponent(repositoryParts.owner)}/${encodeURIComponent(repositoryParts.repo)}`,
+  })
+
+  if (!repositoryResponse.ok) {
+    return {
+      branchExists: false,
+      defaultBranch: null,
+      repositoryAccessible: false,
+    }
+  }
+
+  const defaultBranch = typeof repositoryResponse.body.default_branch === "string"
+    ? repositoryResponse.body.default_branch
+    : null
+  const repositoryAccessible = repositoryResponse.body.id === input.repositoryId
+    && repositoryResponse.body.full_name === input.repositoryFullName
+
+  if (!repositoryAccessible) {
+    return {
+      branchExists: false,
+      defaultBranch,
+      repositoryAccessible: false,
+    }
+  }
+
+  const expectedRef = `refs/heads/${input.branch.trim()}`
+  if (input.ref.trim() !== expectedRef) {
+    return {
+      branchExists: false,
+      defaultBranch,
+      repositoryAccessible: true,
+    }
+  }
+
+  const branchResponse = await requestGithubJson<{ name?: string }>({
+    allowStatuses: [404],
+    fetchFn: input.fetchFn,
+    headers: authHeaders,
+    path: `/repos/${encodeURIComponent(repositoryParts.owner)}/${encodeURIComponent(repositoryParts.repo)}/branches/${encodeURIComponent(input.branch.trim())}`,
+  })
+
+  return {
+    branchExists: branchResponse.ok && branchResponse.body.name === input.branch.trim(),
+    defaultBranch,
+    repositoryAccessible: true,
+  }
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/github-discovery.ts b/ee/apps/den-api/src/routes/org/plugin-system/github-discovery.ts
new file mode 100644
index 0000000000..e7ce1f7c24
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/github-discovery.ts
@@ -0,0 +1,519 @@
+type GithubDiscoveryTreeEntryKind = "blob" | "tree"
+
+export type GithubDiscoveryTreeEntry = {
+  id: string
+  kind: GithubDiscoveryTreeEntryKind
+  path: string
+  sha: string | null
+  size: number | null
+}
+
+export type GithubDiscoveryClassification =
+  | "claude_marketplace_repo"
+  | "claude_multi_plugin_repo"
+  | "claude_single_plugin_repo"
+  | "folder_inferred_repo"
+  | "unsupported"
+
+export type GithubDiscoveredPluginSourceKind =
+  | "marketplace_entry"
+  | "plugin_manifest"
+  | "standalone_claude"
+  | "folder_inference"
+
+export type GithubDiscoveredPluginComponentKind =
+  | "skill"
+  | "command"
+  | "agent"
+  | "hook"
+  | "mcp_server"
+  | "lsp_server"
+  | "monitor"
+  | "settings"
+
+export type GithubDiscoveredPlugin = {
+  componentKinds: GithubDiscoveredPluginComponentKind[]
+  componentPaths: {
+    agents: string[]
+    commands: string[]
+    hooks: string[]
+    lspServers: string[]
+    mcpServers: string[]
+    monitors: string[]
+    settings: string[]
+    skills: string[]
+  }
+  description: string | null
+  displayName: string
+  key: string
+  manifestPath: string | null
+  metadata: Record<string, unknown>
+  rootPath: string
+  selectedByDefault: boolean
+  sourceKind: GithubDiscoveredPluginSourceKind
+  supported: boolean
+  warnings: string[]
+}
+
+export type GithubMarketplaceInfo = {
+  description: string | null
+  name: string | null
+  owner: string | null
+  version: string | null
+}
+
+export type GithubRepoDiscoveryResult = {
+  classification: GithubDiscoveryClassification
+  discoveredPlugins: GithubDiscoveredPlugin[]
+  marketplace: GithubMarketplaceInfo | null
+  warnings: string[]
+}
+
+type MarketplaceEntry = {
+  agents?: unknown
+  commands?: unknown
+  description?: unknown
+  hooks?: unknown
+  mcpServers?: unknown
+  name?: unknown
+  settings?: unknown
+  skills?: unknown
+  source?: unknown
+}
+
+type PluginMetadata = {
+  description: string | null
+  metadata: Record<string, unknown>
+  name: string | null
+}
+
+const KNOWN_COMPONENT_SEGMENTS = ["skills", "commands", "agents"] as const
+
+function normalizePath(value: string) {
+  return value.trim().replace(/^\.\//, "").replace(/^\/+/, "").replace(/\/+$/, "")
+}
+
+function joinPath(rootPath: string, childPath: string) {
+  const root = normalizePath(rootPath)
+  const child = normalizePath(childPath)
+  if (!root) return child
+  if (!child) return root
+  return `${root}/${child}`
+}
+
+function basename(path: string) {
+  const normalized = normalizePath(path)
+  if (!normalized) return null
+  const parts = normalized.split("/")
+  return parts[parts.length - 1] ?? null
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function asString(value: unknown) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null
+}
+
+function pathDirectoryPrefixes(path: string) {
+  const segments = normalizePath(path).split("/").filter(Boolean)
+  const prefixes: string[] = []
+  for (let index = 1; index <= segments.length; index += 1) {
+    prefixes.push(segments.slice(0, index).join("/"))
+  }
+  return prefixes
+}
+
+function buildPathSet(entries: GithubDiscoveryTreeEntry[]) {
+  const knownPaths = new Set<string>()
+  for (const entry of entries) {
+    const normalizedPath = normalizePath(entry.path)
+    if (!normalizedPath) continue
+    knownPaths.add(normalizedPath)
+    for (const prefix of pathDirectoryPrefixes(normalizedPath)) {
+      knownPaths.add(prefix)
+    }
+  }
+  return knownPaths
+}
+
+function hasPath(knownPaths: Set<string>, path: string) {
+  const normalized = normalizePath(path)
+  return normalized.length > 0 && knownPaths.has(normalized)
+}
+
+function hasDescendant(knownPaths: Set<string>, path: string) {
+  const normalized = normalizePath(path)
+  if (!normalized) return false
+  for (const candidate of knownPaths) {
+    if (candidate === normalized || candidate.startsWith(`${normalized}/`)) {
+      return true
+    }
+  }
+  return false
+}
+
+function readJsonMap(fileTextByPath: Record<string, string | null | undefined>, path: string) {
+  const text = fileTextByPath[normalizePath(path)]
+  if (!text) return null
+  try {
+    return JSON.parse(text) as unknown
+  } catch {
+    return null
+  }
+}
+
+function readPluginMetadata(fileTextByPath: Record<string, string | null | undefined>, rootPath: string, manifestPath?: string | null): PluginMetadata {
+  const manifestCandidate = manifestPath ? normalizePath(manifestPath) : normalizePath(joinPath(rootPath, ".claude-plugin/plugin.json"))
+  const explicitManifest = manifestCandidate ? readJsonMap(fileTextByPath, manifestCandidate) : null
+  if (isRecord(explicitManifest)) {
+    return {
+      description: asString(explicitManifest.description),
+      metadata: explicitManifest,
+      name: asString(explicitManifest.name),
+    }
+  }
+
+  const fallbackPluginJson = readJsonMap(fileTextByPath, joinPath(rootPath, "plugin.json"))
+  if (isRecord(fallbackPluginJson)) {
+    return {
+      description: asString(fallbackPluginJson.description),
+      metadata: fallbackPluginJson,
+      name: asString(fallbackPluginJson.name),
+    }
+  }
+
+  return {
+    description: null,
+    metadata: {},
+    name: null,
+  }
+}
+
+function collectComponentPaths(knownPaths: Set<string>, rootPath: string) {
+  const componentPaths = {
+    agents: [] as string[],
+    commands: [] as string[],
+    hooks: [] as string[],
+    lspServers: [] as string[],
+    mcpServers: [] as string[],
+    monitors: [] as string[],
+    settings: [] as string[],
+    skills: [] as string[],
+  }
+
+  const candidates: Array<[keyof typeof componentPaths, string]> = [
+    ["skills", joinPath(rootPath, "skills")],
+    ["skills", joinPath(rootPath, ".claude/skills")],
+    ["commands", joinPath(rootPath, "commands")],
+    ["commands", joinPath(rootPath, ".claude/commands")],
+    ["agents", joinPath(rootPath, "agents")],
+    ["agents", joinPath(rootPath, ".claude/agents")],
+    ["hooks", joinPath(rootPath, "hooks/hooks.json")],
+    ["mcpServers", joinPath(rootPath, ".mcp.json")],
+    ["lspServers", joinPath(rootPath, ".lsp.json")],
+    ["monitors", joinPath(rootPath, "monitors/monitors.json")],
+    ["settings", joinPath(rootPath, "settings.json")],
+  ]
+
+  for (const [bucket, candidate] of candidates) {
+    if (!candidate) continue
+    if (bucket === "hooks" || bucket === "mcpServers" || bucket === "lspServers" || bucket === "monitors" || bucket === "settings") {
+      if (hasPath(knownPaths, candidate)) {
+        componentPaths[bucket].push(candidate)
+      }
+      continue
+    }
+
+    if (hasDescendant(knownPaths, candidate)) {
+      componentPaths[bucket].push(candidate)
+    }
+  }
+
+  return componentPaths
+}
+
+function readStringArray(value: unknown) {
+  return Array.isArray(value)
+    ? value.flatMap((entry) => {
+        const normalized = asString(entry)
+        return normalized ? [normalized] : []
+      })
+    : []
+}
+
+function declaredComponentPaths(input: {
+  declared: Partial<Record<keyof GithubDiscoveredPlugin["componentPaths"], unknown>>
+  knownPaths: Set<string>
+  rootPath: string
+}) {
+  const collect = (values: unknown, { file, directory }: { file?: boolean; directory?: boolean }) => {
+    const paths: string[] = []
+    for (const value of readStringArray(values)) {
+      const candidate = joinPath(input.rootPath, value)
+      if (!candidate && !input.rootPath) {
+        continue
+      }
+      if ((directory && hasDescendant(input.knownPaths, candidate)) || (file && hasPath(input.knownPaths, candidate))) {
+        paths.push(candidate)
+      }
+    }
+    return paths
+  }
+
+  return {
+    agents: collect(input.declared.agents, { directory: true }),
+    commands: collect(input.declared.commands, { directory: true }),
+    hooks: collect(input.declared.hooks, { file: true, directory: true }),
+    lspServers: [],
+    mcpServers: collect(input.declared.mcpServers, { file: true }),
+    monitors: [],
+    settings: collect(input.declared.settings, { file: true }),
+    skills: collect(input.declared.skills, { directory: true }),
+  } satisfies GithubDiscoveredPlugin["componentPaths"]
+}
+
+function marketplaceComponentPaths(entry: MarketplaceEntry, knownPaths: Set<string>, rootPath: string) {
+  return declaredComponentPaths({
+    declared: {
+      agents: entry.agents,
+      commands: entry.commands,
+      hooks: entry.hooks,
+      mcpServers: entry.mcpServers,
+      settings: entry.settings,
+      skills: entry.skills,
+    },
+    knownPaths,
+    rootPath,
+  })
+}
+
+function hasAnyComponentPaths(componentPaths: GithubDiscoveredPlugin["componentPaths"]) {
+  return Object.values(componentPaths).some((paths) => paths.length > 0)
+}
+
+function componentKindsFromPaths(componentPaths: GithubDiscoveredPlugin["componentPaths"]): GithubDiscoveredPluginComponentKind[] {
+  const kinds: GithubDiscoveredPluginComponentKind[] = []
+  if (componentPaths.skills.length > 0) kinds.push("skill")
+  if (componentPaths.commands.length > 0) kinds.push("command")
+  if (componentPaths.agents.length > 0) kinds.push("agent")
+  if (componentPaths.hooks.length > 0) kinds.push("hook")
+  if (componentPaths.mcpServers.length > 0) kinds.push("mcp_server")
+  if (componentPaths.lspServers.length > 0) kinds.push("lsp_server")
+  if (componentPaths.monitors.length > 0) kinds.push("monitor")
+  if (componentPaths.settings.length > 0) kinds.push("settings")
+  return kinds
+}
+
+function buildDiscoveredPlugin(input: {
+  componentPathsOverride?: GithubDiscoveredPlugin["componentPaths"] | null
+  description?: string | null
+  displayName?: string | null
+  fileTextByPath: Record<string, string | null | undefined>
+  key: string
+  knownPaths: Set<string>
+  manifestPath?: string | null
+  rootPath: string
+  sourceKind: GithubDiscoveredPluginSourceKind
+  supported?: boolean
+  warnings?: string[]
+}) {
+  const metadata = readPluginMetadata(input.fileTextByPath, input.rootPath, input.manifestPath)
+  const manifestDeclaredPaths = declaredComponentPaths({
+    declared: metadata.metadata,
+    knownPaths: input.knownPaths,
+    rootPath: input.rootPath,
+  })
+  const componentPaths = input.componentPathsOverride
+    ?? (hasAnyComponentPaths(manifestDeclaredPaths) ? manifestDeclaredPaths : collectComponentPaths(input.knownPaths, input.rootPath))
+  const displayName = input.displayName?.trim()
+    || metadata.name
+    || basename(input.rootPath)
+    || "Repository plugin"
+
+  return {
+    componentKinds: componentKindsFromPaths(componentPaths),
+    componentPaths,
+    description: input.description ?? metadata.description,
+    displayName,
+    key: input.key,
+    manifestPath: input.manifestPath ? normalizePath(input.manifestPath) : (hasPath(input.knownPaths, joinPath(input.rootPath, ".claude-plugin/plugin.json")) ? joinPath(input.rootPath, ".claude-plugin/plugin.json") : null),
+    metadata: metadata.metadata,
+    rootPath: normalizePath(input.rootPath),
+    selectedByDefault: input.supported !== false,
+    sourceKind: input.sourceKind,
+    supported: input.supported !== false,
+    warnings: input.warnings ?? [],
+  } satisfies GithubDiscoveredPlugin
+}
+
+function localMarketplaceRoot(entry: MarketplaceEntry) {
+  if (typeof entry.source === "string") {
+    return normalizePath(entry.source)
+  }
+
+  if (!isRecord(entry.source)) {
+    return null
+  }
+
+  if (typeof entry.source.url === "string") {
+    return null
+  }
+
+  const localPath = asString(entry.source.path)
+  return localPath ? normalizePath(localPath) : null
+}
+
+function pluginRootsFromManifests(entries: GithubDiscoveryTreeEntry[]) {
+  return entries
+    .map((entry) => normalizePath(entry.path))
+    .filter((path) => path.endsWith(".claude-plugin/plugin.json"))
+    .map((path) => path.slice(0, -"/.claude-plugin/plugin.json".length))
+}
+
+function inferredRootsFromKnownFolders(entries: GithubDiscoveryTreeEntry[]) {
+  const inferred = new Set<string>()
+  for (const entry of entries) {
+    const normalized = normalizePath(entry.path)
+    if (!normalized) continue
+    const segments = normalized.split("/")
+    for (let index = 0; index < segments.length; index += 1) {
+      const segment = segments[index]
+      if (!KNOWN_COMPONENT_SEGMENTS.includes(segment as (typeof KNOWN_COMPONENT_SEGMENTS)[number])) {
+        continue
+      }
+      const rootSegments = segments.slice(0, index)
+      if (rootSegments.length === 1 && rootSegments[0] === ".claude") {
+        inferred.add("")
+        continue
+      }
+      inferred.add(rootSegments.join("/"))
+      break
+    }
+  }
+  return [...inferred]
+}
+
+export function buildGithubRepoDiscovery(input: {
+  entries: GithubDiscoveryTreeEntry[]
+  fileTextByPath: Record<string, string | null | undefined>
+}) {
+  const knownPaths = buildPathSet(input.entries)
+  const warnings: string[] = []
+
+  if (hasPath(knownPaths, ".claude-plugin/marketplace.json")) {
+    const marketplaceJson = readJsonMap(input.fileTextByPath, ".claude-plugin/marketplace.json")
+    const marketplaceEntries = isRecord(marketplaceJson) && Array.isArray(marketplaceJson.plugins)
+      ? marketplaceJson.plugins.filter(isRecord) as MarketplaceEntry[]
+      : []
+
+    const marketplaceInfo: GithubMarketplaceInfo = isRecord(marketplaceJson)
+      ? {
+          description: asString(marketplaceJson.description),
+          name: asString(marketplaceJson.name),
+          owner: isRecord(marketplaceJson.owner)
+            ? asString(marketplaceJson.owner.name) ?? asString(marketplaceJson.owner.login) ?? asString(marketplaceJson.owner)
+            : asString(marketplaceJson.owner),
+          version: asString(marketplaceJson.version),
+        }
+      : { description: null, name: null, owner: null, version: null }
+
+    const discoveredPlugins = marketplaceEntries.map((entry, index) => {
+      const rootPath = localMarketplaceRoot(entry)
+      if (rootPath === null) {
+        const warning = "Marketplace entry points at an external source and cannot be auto-mapped from this connected repo yet."
+        warnings.push(warning)
+        return buildDiscoveredPlugin({
+          description: asString(entry.description),
+          displayName: asString(entry.name) ?? `Marketplace plugin ${index + 1}`,
+          fileTextByPath: input.fileTextByPath,
+          key: `marketplace:${asString(entry.name) ?? index}`,
+          knownPaths,
+          manifestPath: null,
+          rootPath: "",
+          sourceKind: "marketplace_entry",
+          supported: false,
+          warnings: [warning],
+        })
+      }
+
+      return buildDiscoveredPlugin({
+        componentPathsOverride: (() => {
+          const override = marketplaceComponentPaths(entry, knownPaths, rootPath)
+          return hasAnyComponentPaths(override) ? override : null
+        })(),
+        description: asString(entry.description),
+        displayName: asString(entry.name),
+        fileTextByPath: input.fileTextByPath,
+        key: `marketplace:${rootPath}`,
+        knownPaths,
+        manifestPath: joinPath(rootPath, ".claude-plugin/plugin.json"),
+        rootPath,
+        sourceKind: "marketplace_entry",
+      })
+    })
+
+    return {
+      classification: "claude_marketplace_repo",
+      discoveredPlugins,
+      marketplace: marketplaceInfo,
+      warnings,
+    } satisfies GithubRepoDiscoveryResult
+  }
+
+  const manifestRoots = [...new Set(pluginRootsFromManifests(input.entries))]
+  if (manifestRoots.length > 0) {
+    const discoveredPlugins = manifestRoots.map((rootPath) => buildDiscoveredPlugin({
+      fileTextByPath: input.fileTextByPath,
+      key: `manifest:${rootPath || "root"}`,
+      knownPaths,
+      manifestPath: joinPath(rootPath, ".claude-plugin/plugin.json"),
+      rootPath,
+      sourceKind: "plugin_manifest",
+    }))
+
+    return {
+      classification: manifestRoots.length === 1 && manifestRoots[0] === "" ? "claude_single_plugin_repo" : "claude_multi_plugin_repo",
+      discoveredPlugins,
+      marketplace: null,
+      warnings,
+    } satisfies GithubRepoDiscoveryResult
+  }
+
+  // Intentionally disabled for now: directory-based inference can over-classify
+  // arbitrary repos as plugins. Until we support a broader compatibility model,
+  // discovery should only accept explicit Claude plugin markers.
+  // const inferredRoots = inferredRootsFromKnownFolders(input.entries)
+  // const standaloneRoot = inferredRoots.includes("") && (
+  //   hasDescendant(knownPaths, ".claude/skills")
+  //   || hasDescendant(knownPaths, ".claude/commands")
+  //   || hasDescendant(knownPaths, ".claude/agents")
+  // )
+  // const folderRoots = standaloneRoot ? inferredRoots : inferredRoots.filter((root) => root !== "")
+  //
+  // if (folderRoots.length > 0) {
+  //   const discoveredPlugins = folderRoots.map((rootPath) => buildDiscoveredPlugin({
+  //     fileTextByPath: input.fileTextByPath,
+  //     key: `${standaloneRoot && rootPath === "" ? "standalone" : "folder"}:${rootPath || "root"}`,
+  //     knownPaths,
+  //     rootPath,
+  //     sourceKind: standaloneRoot && rootPath === "" ? "standalone_claude" : "folder_inference",
+  //   }))
+  //
+  //   return {
+  //     classification: "folder_inferred_repo",
+  //     discoveredPlugins,
+  //     warnings,
+  //   } satisfies GithubRepoDiscoveryResult
+  // }
+
+  warnings.push("OpenWork currently only supports Claude-compatible plugins and marketplaces. Add `.claude-plugin/marketplace.json` or `.claude-plugin/plugin.json` to this repository.")
+
+  return {
+    classification: "unsupported",
+    discoveredPlugins: [],
+    marketplace: null,
+    warnings,
+  } satisfies GithubRepoDiscoveryResult
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/index.ts b/ee/apps/den-api/src/routes/org/plugin-system/index.ts
new file mode 100644
index 0000000000..326d85278b
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/index.ts
@@ -0,0 +1,7 @@
+export * from "./contracts.js"
+export * from "./access.js"
+export * from "./github-app.js"
+export * from "./github-discovery.js"
+export * from "./routes.js"
+export * from "./schemas.js"
+export * from "./store.js"
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/routes.ts b/ee/apps/den-api/src/routes/org/plugin-system/routes.ts
new file mode 100644
index 0000000000..7660ffb32a
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/routes.ts
@@ -0,0 +1,1963 @@
+import type { Context, Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { queryValidator, jsonValidator, paramValidator, requireUserMiddleware, resolveMemberTeamsMiddleware, resolveOrganizationContextMiddleware } from "../../../middleware/index.js"
+import { emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../../openapi.js"
+import type { OrgRouteVariables } from "../shared.js"
+import {
+  accessGrantListResponseSchema,
+  accessGrantMutationResponseSchema,
+  configObjectAccessGrantParamsSchema,
+  configObjectCreateSchema,
+  configObjectCreateVersionSchema,
+  configObjectDetailResponseSchema,
+  configObjectListQuerySchema,
+  configObjectListResponseSchema,
+  configObjectMutationResponseSchema,
+  configObjectParamsSchema,
+  configObjectPluginAttachSchema,
+  configObjectVersionDetailResponseSchema,
+  configObjectVersionListQuerySchema,
+  configObjectVersionListResponseSchema,
+  configObjectVersionParamsSchema,
+  connectorAccountCreateSchema,
+  connectorAccountDetailResponseSchema,
+  connectorAccountDisconnectSchema,
+  connectorAccountListQuerySchema,
+  connectorAccountListResponseSchema,
+  connectorAccountDisconnectResponseSchema,
+  connectorAccountMutationResponseSchema,
+  connectorInstanceAutoImportSchema,
+  connectorInstanceConfigurationResponseSchema,
+  connectorInstanceRemoveResponseSchema,
+  connectorAccountParamsSchema,
+  connectorAccountRepositoryParamsSchema,
+  connectorInstanceAccessGrantParamsSchema,
+  connectorInstanceCreateSchema,
+  githubConnectorDiscoveryResponseSchema,
+  githubDiscoveryApplyResponseSchema,
+  githubDiscoveryApplySchema,
+  githubDiscoveryTreeQuerySchema,
+  githubDiscoveryTreeResponseSchema,
+  connectorInstanceDetailResponseSchema,
+  connectorInstanceListQuerySchema,
+  connectorInstanceListResponseSchema,
+  connectorInstanceMutationResponseSchema,
+  connectorInstanceParamsSchema,
+  connectorInstanceUpdateSchema,
+  connectorMappingCreateSchema,
+  connectorMappingListQuerySchema,
+  connectorMappingListResponseSchema,
+  connectorMappingMutationResponseSchema,
+  connectorMappingParamsSchema,
+  connectorMappingUpdateSchema,
+  connectorSyncAsyncResponseSchema,
+  connectorSyncEventDetailResponseSchema,
+  connectorSyncEventListQuerySchema,
+  connectorSyncEventListResponseSchema,
+  connectorSyncEventParamsSchema,
+  connectorTargetCreateSchema,
+  connectorTargetDetailResponseSchema,
+  connectorTargetListQuerySchema,
+  connectorTargetListResponseSchema,
+  connectorTargetMutationResponseSchema,
+  connectorTargetParamsSchema,
+  connectorTargetUpdateSchema,
+  githubConnectorAccountCreateSchema,
+  githubInstallCompleteResponseSchema,
+  githubInstallCompleteSchema,
+  githubInstallStartResponseSchema,
+  githubInstallStartSchema,
+  githubRepositoryListQuerySchema,
+  githubRepositoryListResponseSchema,
+  githubSetupResponseSchema,
+  githubConnectorSetupSchema,
+  githubValidateTargetResponseSchema,
+  githubValidateTargetSchema,
+  marketplaceAccessGrantParamsSchema,
+  marketplaceCreateSchema,
+  marketplaceDetailResponseSchema,
+  marketplaceListQuerySchema,
+  marketplaceListResponseSchema,
+  marketplaceMutationResponseSchema,
+  marketplaceParamsSchema,
+  marketplacePluginListResponseSchema,
+  marketplaceResolvedResponseSchema,
+  marketplacePluginMutationResponseSchema,
+  marketplacePluginParamsSchema,
+  marketplacePluginWriteSchema,
+  marketplaceUpdateSchema,
+  pluginAccessGrantParamsSchema,
+  pluginCreateSchema,
+  pluginDetailResponseSchema,
+  pluginListQuerySchema,
+  pluginListResponseSchema,
+  pluginMembershipListResponseSchema,
+  pluginMembershipMutationResponseSchema,
+  pluginMembershipWriteSchema,
+  pluginMutationResponseSchema,
+  pluginParamsSchema,
+  pluginUpdateSchema,
+  resourceAccessGrantWriteSchema,
+} from "./schemas.js"
+import { requirePluginArchCapability, type PluginArchActorContext, PluginArchAuthorizationError } from "./access.js"
+import { pluginArchRoutePaths } from "./contracts.js"
+import {
+  PluginArchRouteFailure,
+  addPluginMembership,
+  attachConfigObjectToPlugin,
+  createConfigObject,
+  createConfigObjectVersion,
+  createConnectorAccount,
+  createConnectorInstance,
+  createConnectorMapping,
+  createGithubConnectorAccount,
+  createMarketplace,
+  createPlugin,
+  createResourceAccessGrant,
+  createConnectorTarget,
+  deleteConnectorMapping,
+  deleteResourceAccessGrant,
+  disconnectConnectorAccount,
+  getConfigObjectDetail,
+  getConfigObjectVersion,
+  getConnectorAccountDetail,
+  getConnectorInstanceDetail,
+  getConnectorSyncEventDetail,
+  getConnectorTargetDetail,
+  getLatestConfigObjectVersion,
+  getMarketplaceDetail,
+  getMarketplaceResolved,
+  getPluginDetail,
+  githubSetup,
+  listConfigObjectPlugins,
+  listConfigObjectVersions,
+  listConfigObjects,
+  listConnectorAccounts,
+  listConnectorInstances,
+  listConnectorMappings,
+  listConnectorSyncEvents,
+  listConnectorTargets,
+  listGithubRepositories,
+  listMarketplaceMemberships,
+  listMarketplaces,
+  listPluginMemberships,
+  listPlugins,
+  listResourceAccess,
+  attachPluginToMarketplace,
+  completeGithubConnectorInstall,
+  applyGithubConnectorDiscovery,
+  getConnectorInstanceConfiguration,
+  getGithubConnectorDiscovery,
+  getGithubConnectorDiscoveryTree,
+  removeConnectorInstance,
+  setConnectorInstanceAutoImport,
+  queueConnectorTargetResync,
+  removeConfigObjectFromPlugin,
+  removePluginFromMarketplace,
+  removePluginMembership,
+  retryConnectorSyncEvent,
+  setConfigObjectLifecycle,
+  setConnectorInstanceLifecycle,
+  setMarketplaceLifecycle,
+  setPluginLifecycle,
+  startGithubConnectorInstall,
+  updateConnectorInstance,
+  updateConnectorMapping,
+  updateConnectorTarget,
+  updateMarketplace,
+  updatePlugin,
+  validateGithubTarget,
+} from "./store.js"
+
+type OrgContext = Context<{ Variables: OrgRouteVariables }>
+
+function validRequestPart<T>(c: OrgContext, target: "json" | "param" | "query") {
+  return (c.req as unknown as { valid: (part: typeof target) => unknown }).valid(target) as T
+}
+
+function validJson<T>(c: OrgContext) {
+  return validRequestPart<T>(c, "json")
+}
+
+function validParam<T>(c: OrgContext) {
+  return validRequestPart<T>(c, "param")
+}
+
+function validQuery<T>(c: OrgContext) {
+  return validRequestPart<T>(c, "query")
+}
+
+function actorContext(c: OrgContext): PluginArchActorContext {
+  const organizationContext = c.get("organizationContext")
+  if (!organizationContext) {
+    throw new PluginArchRouteFailure(404, "organization_not_found", "Organization context not found.")
+  }
+
+  return {
+    memberTeams: c.get("memberTeams") ?? [],
+    organizationContext,
+  }
+}
+
+function routeErrorResponse(c: OrgContext, error: unknown) {
+  if (error instanceof PluginArchAuthorizationError) {
+    const authorizationError = error as PluginArchAuthorizationError
+    return c.json({ error: authorizationError.error, message: authorizationError.message }, 403)
+  }
+  if (error instanceof PluginArchRouteFailure) {
+    const failure = error as PluginArchRouteFailure
+    return c.json({ error: failure.error, message: failure.message }, failure.status)
+  }
+  throw error
+}
+
+function withPluginArchOrgContext(app: Hono<any>, method: "delete" | "get" | "patch" | "post", path: string, ...handlers: unknown[]) {
+  const routeHandler = handlers.pop() as unknown
+  const routeMiddlewares = handlers as unknown[]
+  const routeApp = app as unknown as Record<string, (...args: unknown[]) => unknown>
+  routeApp[method](path, requireUserMiddleware, ...routeMiddlewares, resolveOrganizationContextMiddleware, resolveMemberTeamsMiddleware, routeHandler)
+}
+
+export function registerPluginArchRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  withPluginArchOrgContext(
+    app,
+    "post",
+    pluginArchRoutePaths.githubInstallStart,
+    jsonValidator(githubInstallStartSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Start GitHub install",
+      description: "Builds a GitHub App install redirect URL for the current organization.",
+      responses: {
+        200: jsonResponse("GitHub install redirect returned successfully.", githubInstallStartResponseSchema),
+        400: jsonResponse("The GitHub install request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to connect GitHub.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to connect GitHub.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_account.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await startGithubConnectorInstall({ context, returnPath: body.returnPath }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    },
+  )
+
+  withPluginArchOrgContext(
+    app,
+    "post",
+    pluginArchRoutePaths.githubInstallComplete,
+    jsonValidator(githubInstallCompleteSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Complete GitHub install",
+      description: "Completes a GitHub App installation for the current organization and returns visible repositories.",
+      responses: {
+        200: jsonResponse("GitHub installation completed successfully.", githubInstallCompleteResponseSchema),
+        400: jsonResponse("The GitHub install completion request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to complete GitHub connection.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to complete GitHub connection.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_account.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await completeGithubConnectorInstall({ context, installationId: body.installationId, state: body.state }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    },
+  )
+
+  withPluginArchOrgContext(
+    app,
+    "get",
+    pluginArchRoutePaths.configObjects,
+    queryValidator(configObjectListQuerySchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "List config objects",
+      description: "Lists current config object projections visible to the current organization member.",
+      responses: {
+        200: jsonResponse("Config objects returned successfully.", configObjectListResponseSchema),
+        400: jsonResponse("The config object query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list config objects.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listConfigObjects({
+        connectorInstanceId: query.connectorInstanceId,
+        context: actorContext(c),
+        cursor: query.cursor,
+        includeDeleted: query.includeDeleted,
+        limit: query.limit,
+        pluginId: query.pluginId,
+        q: query.q,
+        sourceMode: query.sourceMode,
+        status: query.status,
+        type: query.type,
+      }))
+    },
+  )
+
+  withPluginArchOrgContext(
+    app,
+    "post",
+    pluginArchRoutePaths.configObjects,
+    jsonValidator(configObjectCreateSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Create config object",
+      description: "Creates a new private config object and initial immutable version.",
+      responses: {
+        201: jsonResponse("Config object created successfully.", configObjectMutationResponseSchema),
+        400: jsonResponse("The config object creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create config objects.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create config objects.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "config_object.create")
+        const body = validJson<any>(c)
+        const item = await createConfigObject({
+          context,
+          objectType: body.type,
+          pluginIds: body.pluginIds,
+          sourceMode: body.sourceMode,
+          value: body.input,
+        })
+        return c.json({ ok: true, item }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    },
+  )
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObject,
+    paramValidator(configObjectParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Get config object",
+      description: "Returns one config object detail when the caller can view it.",
+      responses: {
+        200: jsonResponse("Config object returned successfully.", configObjectDetailResponseSchema),
+        400: jsonResponse("The config object path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view config objects.", unauthorizedSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ item: await getConfigObjectDetail(actorContext(c), params.configObjectId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.configObjectVersions,
+    paramValidator(configObjectParamsSchema),
+    jsonValidator(configObjectCreateVersionSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Create config object version",
+      description: "Creates a new immutable config object version.",
+      responses: {
+        201: jsonResponse("Config object version created successfully.", configObjectMutationResponseSchema),
+        400: jsonResponse("The config object version request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create config object versions.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this config object.", forbiddenSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c) as any
+        return c.json({ ok: true, item: await createConfigObjectVersion({ configObjectId: params.configObjectId, context: actorContext(c), reason: body.reason, value: body.input }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObjectVersions,
+    paramValidator(configObjectParamsSchema),
+    queryValidator(configObjectVersionListQuerySchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "List config object versions",
+      description: "Returns immutable versions for one config object.",
+      responses: {
+        200: jsonResponse("Config object versions returned successfully.", configObjectVersionListResponseSchema),
+        400: jsonResponse("The version list request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view config object versions.", unauthorizedSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const query = validQuery<any>(c)
+        return c.json(await listConfigObjectVersions({ configObjectId: params.configObjectId, context: actorContext(c), cursor: query.cursor, includeDeleted: query.includeDeleted, limit: query.limit }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObjectVersion,
+    paramValidator(configObjectVersionParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Get config object version",
+      description: "Returns one immutable config object version.",
+      responses: {
+        200: jsonResponse("Config object version returned successfully.", configObjectVersionDetailResponseSchema),
+        400: jsonResponse("The version path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view config object versions.", unauthorizedSchema),
+        404: jsonResponse("The config object version could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ item: await getConfigObjectVersion({ configObjectId: params.configObjectId, context: actorContext(c), versionId: params.versionId }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObjectLatestVersion,
+    paramValidator(configObjectParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Get latest config object version",
+      description: "Returns the latest config object version by created_at and id ordering.",
+      responses: {
+        200: jsonResponse("Latest config object version returned successfully.", configObjectVersionDetailResponseSchema),
+        400: jsonResponse("The latest-version path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view config object versions.", unauthorizedSchema),
+        404: jsonResponse("The config object version could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ item: await getLatestConfigObjectVersion({ configObjectId: params.configObjectId, context: actorContext(c) }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  for (const [path, action] of [[pluginArchRoutePaths.configObjectArchive, "archive"], [pluginArchRoutePaths.configObjectDelete, "delete"], [pluginArchRoutePaths.configObjectRestore, "restore"]] as const) {
+    withPluginArchOrgContext(app, "post", path,
+      paramValidator(configObjectParamsSchema),
+      describeRoute({
+        tags: ["Config Objects"],
+        summary: `${action} config object`,
+        description: `${action} a config object without removing its history.`,
+        responses: {
+          200: jsonResponse("Config object lifecycle updated successfully.", configObjectMutationResponseSchema),
+          400: jsonResponse("The lifecycle path parameters were invalid.", invalidRequestSchema),
+          401: jsonResponse("The caller must be signed in to manage config objects.", unauthorizedSchema),
+          403: jsonResponse("The caller lacks permission to manage this config object.", forbiddenSchema),
+          404: jsonResponse("The config object could not be found.", notFoundSchema),
+        },
+      }),
+      async (c: OrgContext) => {
+        try {
+          const params = validParam<any>(c)
+          return c.json({ ok: true, item: await setConfigObjectLifecycle({ action, configObjectId: params.configObjectId, context: actorContext(c) }) })
+        } catch (error) {
+          return routeErrorResponse(c, error)
+        }
+      })
+  }
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObjectPlugins,
+    paramValidator(configObjectParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "List config object plugins",
+      description: "Lists plugins that currently include the config object.",
+      responses: {
+        200: jsonResponse("Config object plugins returned successfully.", pluginMembershipListResponseSchema),
+        400: jsonResponse("The config object plugin path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view config object plugins.", unauthorizedSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listConfigObjectPlugins({ configObjectId: params.configObjectId, context: actorContext(c) }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.configObjectPlugins,
+    paramValidator(configObjectParamsSchema),
+    jsonValidator(configObjectPluginAttachSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Attach config object to plugin",
+      description: "Adds a config object to a plugin when the caller can edit the target plugin.",
+      responses: {
+        201: jsonResponse("Plugin membership created successfully.", pluginMembershipMutationResponseSchema),
+        400: jsonResponse("The plugin membership request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin membership.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit the target plugin.", forbiddenSchema),
+        404: jsonResponse("The config object or plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await attachConfigObjectToPlugin({ configObjectId: params.configObjectId, context: actorContext(c), membershipSource: body.membershipSource, pluginId: body.pluginId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.configObjectPlugin,
+    paramValidator(configObjectParamsSchema.extend(pluginParamsSchema.pick({ pluginId: true }).shape)),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Remove config object from plugin",
+      description: "Removes one active plugin membership from a config object.",
+      responses: {
+        204: emptyResponse("Plugin membership removed successfully."),
+        400: jsonResponse("The plugin membership path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin membership.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit the target plugin.", forbiddenSchema),
+        404: jsonResponse("The plugin membership could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await removeConfigObjectFromPlugin({ configObjectId: params.configObjectId, context: actorContext(c), pluginId: params.pluginId })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.configObjectAccess,
+    paramValidator(configObjectParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "List config object access grants",
+      description: "Lists direct, team, and org-wide grants for one config object.",
+      responses: {
+        200: jsonResponse("Config object access grants returned successfully.", accessGrantListResponseSchema),
+        400: jsonResponse("The access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage config object access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage config object access.", forbiddenSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listResourceAccess({ context: actorContext(c), resourceId: params.configObjectId, resourceKind: "config_object" }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.configObjectAccess,
+    paramValidator(configObjectParamsSchema),
+    jsonValidator(resourceAccessGrantWriteSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Grant config object access",
+      description: "Creates or reactivates one access grant for a config object.",
+      responses: {
+        201: jsonResponse("Config object access grant created successfully.", accessGrantMutationResponseSchema),
+        400: jsonResponse("The access grant request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage config object access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage config object access.", forbiddenSchema),
+        404: jsonResponse("The config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createResourceAccessGrant({ context: actorContext(c), resourceId: params.configObjectId, resourceKind: "config_object", value: body }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.configObjectAccessGrant,
+    paramValidator(configObjectAccessGrantParamsSchema),
+    describeRoute({
+      tags: ["Config Objects"],
+      summary: "Revoke config object access",
+      description: "Soft-revokes one config object access grant.",
+      responses: {
+        204: emptyResponse("Config object access revoked successfully."),
+        400: jsonResponse("The access grant path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage config object access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage config object access.", forbiddenSchema),
+        404: jsonResponse("The access grant could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await deleteResourceAccessGrant({ context: actorContext(c), grantId: params.grantId, resourceId: params.configObjectId, resourceKind: "config_object" })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.plugins,
+    queryValidator(pluginListQuerySchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "List plugins",
+      description: "Lists plugins visible to the current organization member.",
+      responses: {
+        200: jsonResponse("Plugins returned successfully.", pluginListResponseSchema),
+        400: jsonResponse("The plugin query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list plugins.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listPlugins({ context: actorContext(c), cursor: query.cursor, limit: query.limit, q: query.q, status: query.status }))
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.plugins,
+    jsonValidator(pluginCreateSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Create plugin",
+      description: "Creates a new private plugin and grants the creator manager access.",
+      responses: {
+        201: jsonResponse("Plugin created successfully.", pluginMutationResponseSchema),
+        400: jsonResponse("The plugin creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create plugins.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create plugins.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "plugin.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createPlugin({ context, description: body.description, name: body.name }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.plugin,
+    paramValidator(pluginParamsSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Get plugin",
+      description: "Returns one plugin detail when the caller can view it.",
+      responses: {
+        200: jsonResponse("Plugin returned successfully.", pluginDetailResponseSchema),
+        400: jsonResponse("The plugin path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view plugins.", unauthorizedSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ item: await getPluginDetail(actorContext(c), params.pluginId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "patch", pluginArchRoutePaths.plugin,
+    paramValidator(pluginParamsSchema),
+    jsonValidator(pluginUpdateSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Update plugin",
+      description: "Updates plugin metadata.",
+      responses: {
+        200: jsonResponse("Plugin updated successfully.", pluginMutationResponseSchema),
+        400: jsonResponse("The plugin update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update plugins.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this plugin.", forbiddenSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await updatePlugin({ context: actorContext(c), description: body.description, name: body.name, pluginId: params.pluginId }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  for (const [path, action] of [[pluginArchRoutePaths.pluginArchive, "archive"], [pluginArchRoutePaths.pluginRestore, "restore"]] as const) {
+    withPluginArchOrgContext(app, "post", path,
+      paramValidator(pluginParamsSchema),
+      describeRoute({
+        tags: ["Plugins"],
+        summary: `${action} plugin`,
+        description: `${action} a plugin without touching its historical memberships.`,
+        responses: {
+          200: jsonResponse("Plugin lifecycle updated successfully.", pluginMutationResponseSchema),
+          400: jsonResponse("The plugin lifecycle path parameters were invalid.", invalidRequestSchema),
+          401: jsonResponse("The caller must be signed in to manage plugins.", unauthorizedSchema),
+          403: jsonResponse("The caller lacks permission to manage this plugin.", forbiddenSchema),
+          404: jsonResponse("The plugin could not be found.", notFoundSchema),
+        },
+      }),
+      async (c: OrgContext) => {
+        try {
+          const params = validParam<any>(c)
+          return c.json({ ok: true, item: await setPluginLifecycle({ action, context: actorContext(c), pluginId: params.pluginId }) })
+        } catch (error) {
+          return routeErrorResponse(c, error)
+        }
+      })
+  }
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.pluginConfigObjects,
+    paramValidator(pluginParamsSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "List plugin config objects",
+      description: "Lists plugin memberships and resolved config object projections.",
+      responses: {
+        200: jsonResponse("Plugin memberships returned successfully.", pluginMembershipListResponseSchema),
+        400: jsonResponse("The plugin membership path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view plugin memberships.", unauthorizedSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listPluginMemberships({ context: actorContext(c), includeConfigObjects: true, onlyActive: false, pluginId: params.pluginId }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.pluginConfigObjects,
+    paramValidator(pluginParamsSchema),
+    jsonValidator(pluginMembershipWriteSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Add plugin config object",
+      description: "Adds a config object to a plugin.",
+      responses: {
+        201: jsonResponse("Plugin membership created successfully.", pluginMembershipMutationResponseSchema),
+        400: jsonResponse("The plugin membership request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin memberships.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this plugin.", forbiddenSchema),
+        404: jsonResponse("The plugin or config object could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await addPluginMembership({ configObjectId: body.configObjectId, context: actorContext(c), membershipSource: body.membershipSource, pluginId: params.pluginId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.pluginConfigObject,
+    paramValidator(pluginParamsSchema.extend(configObjectParamsSchema.pick({ configObjectId: true }).shape)),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Remove plugin config object",
+      description: "Removes one config object from a plugin.",
+      responses: {
+        204: emptyResponse("Plugin membership removed successfully."),
+        400: jsonResponse("The plugin membership path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin memberships.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this plugin.", forbiddenSchema),
+        404: jsonResponse("The plugin membership could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await removePluginMembership({ configObjectId: params.configObjectId, context: actorContext(c), pluginId: params.pluginId })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.pluginResolved,
+    paramValidator(pluginParamsSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Get resolved plugin",
+      description: "Lists active plugin memberships with the current config object projection for each item.",
+      responses: {
+        200: jsonResponse("Resolved plugin returned successfully.", pluginMembershipListResponseSchema),
+        400: jsonResponse("The plugin path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view resolved plugins.", unauthorizedSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listPluginMemberships({ context: actorContext(c), includeConfigObjects: true, onlyActive: true, pluginId: params.pluginId }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.pluginAccess,
+    paramValidator(pluginParamsSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "List plugin access grants",
+      description: "Lists direct, team, and org-wide grants for a plugin.",
+      responses: {
+        200: jsonResponse("Plugin access grants returned successfully.", accessGrantListResponseSchema),
+        400: jsonResponse("The plugin access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage plugin access.", forbiddenSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listResourceAccess({ context: actorContext(c), resourceId: params.pluginId, resourceKind: "plugin" }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.pluginAccess,
+    paramValidator(pluginParamsSchema),
+    jsonValidator(resourceAccessGrantWriteSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Grant plugin access",
+      description: "Creates or reactivates one access grant for a plugin.",
+      responses: {
+        201: jsonResponse("Plugin access grant created successfully.", accessGrantMutationResponseSchema),
+        400: jsonResponse("The plugin access request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage plugin access.", forbiddenSchema),
+        404: jsonResponse("The plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ ok: true, item: await createResourceAccessGrant({ context: actorContext(c), resourceId: params.pluginId, resourceKind: "plugin", value: validJson<any>(c) }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.pluginAccessGrant,
+    paramValidator(pluginAccessGrantParamsSchema),
+    describeRoute({
+      tags: ["Plugins"],
+      summary: "Revoke plugin access",
+      description: "Soft-revokes one plugin access grant.",
+      responses: {
+        204: emptyResponse("Plugin access revoked successfully."),
+        400: jsonResponse("The plugin access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage plugin access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage plugin access.", forbiddenSchema),
+        404: jsonResponse("The access grant could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await deleteResourceAccessGrant({ context: actorContext(c), grantId: params.grantId, resourceId: params.pluginId, resourceKind: "plugin" })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.marketplaces,
+    queryValidator(marketplaceListQuerySchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "List marketplaces",
+      description: "Lists marketplaces visible to the current organization member.",
+      responses: {
+        200: jsonResponse("Marketplaces returned successfully.", marketplaceListResponseSchema),
+        400: jsonResponse("The marketplace query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list marketplaces.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listMarketplaces({ context: actorContext(c), cursor: query.cursor, limit: query.limit, q: query.q, status: query.status }))
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.marketplaces,
+    jsonValidator(marketplaceCreateSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Create marketplace",
+      description: "Creates a new private marketplace and grants the creator manager access.",
+      responses: {
+        201: jsonResponse("Marketplace created successfully.", marketplaceMutationResponseSchema),
+        400: jsonResponse("The marketplace creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create marketplaces.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create marketplaces.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "marketplace.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createMarketplace({ context, description: body.description, name: body.name }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.marketplace,
+    paramValidator(marketplaceParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Get marketplace",
+      description: "Returns one marketplace detail when the caller can view it.",
+      responses: {
+        200: jsonResponse("Marketplace returned successfully.", marketplaceDetailResponseSchema),
+        400: jsonResponse("The marketplace path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view marketplaces.", unauthorizedSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ item: await getMarketplaceDetail(actorContext(c), params.marketplaceId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "patch", pluginArchRoutePaths.marketplace,
+    paramValidator(marketplaceParamsSchema),
+    jsonValidator(marketplaceUpdateSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Update marketplace",
+      description: "Updates marketplace metadata.",
+      responses: {
+        200: jsonResponse("Marketplace updated successfully.", marketplaceMutationResponseSchema),
+        400: jsonResponse("The marketplace update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update marketplaces.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this marketplace.", forbiddenSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await updateMarketplace({ context: actorContext(c), description: body.description, marketplaceId: params.marketplaceId, name: body.name }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  for (const [path, action] of [[pluginArchRoutePaths.marketplaceArchive, "archive"], [pluginArchRoutePaths.marketplaceRestore, "restore"]] as const) {
+    withPluginArchOrgContext(app, "post", path,
+      paramValidator(marketplaceParamsSchema),
+      describeRoute({
+        tags: ["Marketplaces"],
+        summary: `${action} marketplace`,
+        description: `${action} a marketplace without touching membership history.`,
+        responses: {
+          200: jsonResponse("Marketplace lifecycle updated successfully.", marketplaceMutationResponseSchema),
+          400: jsonResponse("The marketplace lifecycle path parameters were invalid.", invalidRequestSchema),
+          401: jsonResponse("The caller must be signed in to manage marketplaces.", unauthorizedSchema),
+          403: jsonResponse("The caller lacks permission to manage this marketplace.", forbiddenSchema),
+          404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+        },
+      }),
+      async (c: OrgContext) => {
+        try {
+          const params = validParam<any>(c)
+          return c.json({ ok: true, item: await setMarketplaceLifecycle({ action, context: actorContext(c), marketplaceId: params.marketplaceId }) })
+        } catch (error) {
+          return routeErrorResponse(c, error)
+        }
+      })
+  }
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.marketplacePlugins,
+    paramValidator(marketplaceParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "List marketplace plugins",
+      description: "Lists marketplace memberships and resolved plugin projections.",
+      responses: {
+        200: jsonResponse("Marketplace memberships returned successfully.", marketplacePluginListResponseSchema),
+        400: jsonResponse("The marketplace membership path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view marketplace memberships.", unauthorizedSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listMarketplaceMemberships({ context: actorContext(c), includePlugins: true, marketplaceId: params.marketplaceId, onlyActive: false }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.marketplaceResolved,
+    paramValidator(marketplaceParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Get marketplace resolved",
+      description: "Returns marketplace detail with plugins and derived source info.",
+      responses: {
+        200: jsonResponse("Marketplace resolved detail returned successfully.", marketplaceResolvedResponseSchema),
+        400: jsonResponse("The marketplace path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view marketplaces.", unauthorizedSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ ok: true, item: await getMarketplaceResolved({ context: actorContext(c), marketplaceId: params.marketplaceId }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.marketplacePlugins,
+    paramValidator(marketplaceParamsSchema),
+    jsonValidator(marketplacePluginWriteSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Add marketplace plugin",
+      description: "Adds a plugin to a marketplace.",
+      responses: {
+        201: jsonResponse("Marketplace membership created successfully.", marketplacePluginMutationResponseSchema),
+        400: jsonResponse("The marketplace membership request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage marketplace memberships.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this marketplace.", forbiddenSchema),
+        404: jsonResponse("The marketplace or plugin could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await attachPluginToMarketplace({ context: actorContext(c), marketplaceId: params.marketplaceId, membershipSource: body.membershipSource, pluginId: body.pluginId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.marketplacePlugin,
+    paramValidator(marketplacePluginParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Remove marketplace plugin",
+      description: "Removes one plugin from a marketplace.",
+      responses: {
+        204: emptyResponse("Marketplace membership removed successfully."),
+        400: jsonResponse("The marketplace membership path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage marketplace memberships.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this marketplace.", forbiddenSchema),
+        404: jsonResponse("The marketplace membership could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await removePluginFromMarketplace({ context: actorContext(c), marketplaceId: params.marketplaceId, pluginId: params.pluginId })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.marketplaceAccess,
+    paramValidator(marketplaceParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "List marketplace access grants",
+      description: "Lists direct, team, and org-wide grants for a marketplace.",
+      responses: {
+        200: jsonResponse("Marketplace access grants returned successfully.", accessGrantListResponseSchema),
+        400: jsonResponse("The marketplace access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage marketplace access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage marketplace access.", forbiddenSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listResourceAccess({ context: actorContext(c), resourceId: params.marketplaceId, resourceKind: "marketplace" }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.marketplaceAccess,
+    paramValidator(marketplaceParamsSchema),
+    jsonValidator(resourceAccessGrantWriteSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Grant marketplace access",
+      description: "Creates or reactivates one access grant for a marketplace.",
+      responses: {
+        201: jsonResponse("Marketplace access grant created successfully.", accessGrantMutationResponseSchema),
+        400: jsonResponse("The marketplace access request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage marketplace access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage marketplace access.", forbiddenSchema),
+        404: jsonResponse("The marketplace could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ ok: true, item: await createResourceAccessGrant({ context: actorContext(c), resourceId: params.marketplaceId, resourceKind: "marketplace", value: validJson<any>(c) }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.marketplaceAccessGrant,
+    paramValidator(marketplaceAccessGrantParamsSchema),
+    describeRoute({
+      tags: ["Marketplaces"],
+      summary: "Revoke marketplace access",
+      description: "Soft-revokes one marketplace access grant.",
+      responses: {
+        204: emptyResponse("Marketplace access revoked successfully."),
+        400: jsonResponse("The marketplace access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage marketplace access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage marketplace access.", forbiddenSchema),
+        404: jsonResponse("The access grant could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await deleteResourceAccessGrant({ context: actorContext(c), grantId: params.grantId, resourceId: params.marketplaceId, resourceKind: "marketplace" })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorAccounts,
+    queryValidator(connectorAccountListQuerySchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector accounts",
+      description: "Lists connector accounts for the organization.",
+      responses: {
+        200: jsonResponse("Connector accounts returned successfully.", connectorAccountListResponseSchema),
+        400: jsonResponse("The connector account query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list connector accounts.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listConnectorAccounts({ connectorType: query.connectorType, context: actorContext(c), cursor: query.cursor, limit: query.limit, q: query.q, status: query.status }))
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorAccounts,
+    jsonValidator(connectorAccountCreateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Create connector account",
+      description: "Creates a connector account such as a GitHub App installation binding.",
+      responses: {
+        201: jsonResponse("Connector account created successfully.", connectorAccountMutationResponseSchema),
+        400: jsonResponse("The connector account creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create connector accounts.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create connector accounts.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_account.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createConnectorAccount({ connectorType: body.connectorType, context, displayName: body.displayName, externalAccountRef: body.externalAccountRef, metadata: body.metadata, remoteId: body.remoteId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorAccount,
+    paramValidator(connectorAccountParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Get connector account",
+      description: "Returns one connector account detail.",
+      responses: {
+        200: jsonResponse("Connector account returned successfully.", connectorAccountDetailResponseSchema),
+        400: jsonResponse("The connector account path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view connector accounts.", unauthorizedSchema),
+        404: jsonResponse("The connector account could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ item: await getConnectorAccountDetail(actorContext(c), validParam<any>(c).connectorAccountId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorAccountDisconnect,
+    paramValidator(connectorAccountParamsSchema),
+    jsonValidator(connectorAccountDisconnectSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Disconnect connector account",
+      description: "Disconnects a connector account and cleans up all associated connector-managed records.",
+      responses: {
+        200: jsonResponse("Connector account disconnected and cleaned up successfully.", connectorAccountDisconnectResponseSchema),
+        400: jsonResponse("The connector account disconnect request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage connector accounts.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage connector accounts.", forbiddenSchema),
+        404: jsonResponse("The connector account could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_account.create")
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await disconnectConnectorAccount({ connectorAccountId: params.connectorAccountId, context, reason: body?.reason }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstances,
+    queryValidator(connectorInstanceListQuerySchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector instances",
+      description: "Lists connector instances visible to the current member.",
+      responses: {
+        200: jsonResponse("Connector instances returned successfully.", connectorInstanceListResponseSchema),
+        400: jsonResponse("The connector instance query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list connector instances.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listConnectorInstances({ connectorAccountId: query.connectorAccountId, context: actorContext(c), cursor: query.cursor, limit: query.limit, pluginId: query.pluginId, q: query.q, status: query.status }))
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorInstances,
+    jsonValidator(connectorInstanceCreateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Create connector instance",
+      description: "Creates a new connector instance.",
+      responses: {
+        201: jsonResponse("Connector instance created successfully.", connectorInstanceMutationResponseSchema),
+        400: jsonResponse("The connector instance creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create connector instances.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create connector instances.", forbiddenSchema),
+        404: jsonResponse("The connector account could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_instance.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createConnectorInstance({ connectorAccountId: body.connectorAccountId, connectorType: body.connectorType, config: body.config, context, name: body.name, remoteId: body.remoteId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstance,
+    paramValidator(connectorInstanceParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Get connector instance",
+      description: "Returns one connector instance detail.",
+      responses: {
+        200: jsonResponse("Connector instance returned successfully.", connectorInstanceDetailResponseSchema),
+        400: jsonResponse("The connector instance path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view connector instances.", unauthorizedSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ item: await getConnectorInstanceDetail(actorContext(c), validParam<any>(c).connectorInstanceId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "patch", pluginArchRoutePaths.connectorInstance,
+    paramValidator(connectorInstanceParamsSchema),
+    jsonValidator(connectorInstanceUpdateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Update connector instance",
+      description: "Updates one connector instance.",
+      responses: {
+        200: jsonResponse("Connector instance updated successfully.", connectorInstanceMutationResponseSchema),
+        400: jsonResponse("The connector instance update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update connector instances.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await updateConnectorInstance({ connectorInstanceId: params.connectorInstanceId, config: body.config, context: actorContext(c), name: body.name, remoteId: body.remoteId, status: body.status }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  for (const [path, action] of [[pluginArchRoutePaths.connectorInstanceArchive, "archive"], [pluginArchRoutePaths.connectorInstanceDisable, "disable"], [pluginArchRoutePaths.connectorInstanceEnable, "enable"]] as const) {
+    withPluginArchOrgContext(app, "post", path,
+      paramValidator(connectorInstanceParamsSchema),
+      describeRoute({
+        tags: ["Connectors"],
+        summary: `${action} connector instance`,
+        description: `${action} a connector instance.`,
+        responses: {
+          200: jsonResponse("Connector instance updated successfully.", connectorInstanceMutationResponseSchema),
+          400: jsonResponse("The connector instance path parameters were invalid.", invalidRequestSchema),
+          401: jsonResponse("The caller must be signed in to manage connector instances.", unauthorizedSchema),
+          403: jsonResponse("The caller lacks permission to manage this connector instance.", forbiddenSchema),
+          404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+        },
+      }),
+      async (c: OrgContext) => {
+        try {
+          const params = validParam<any>(c)
+          return c.json({ ok: true, item: await setConnectorInstanceLifecycle({ action, connectorInstanceId: params.connectorInstanceId, context: actorContext(c) }) })
+        } catch (error) {
+          return routeErrorResponse(c, error)
+        }
+      })
+  }
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstanceConfiguration,
+    paramValidator(connectorInstanceParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Get connector instance configuration",
+      description: "Returns the currently configured plugins and import stats for a connector instance.",
+      responses: {
+        200: jsonResponse("Connector instance configuration returned successfully.", connectorInstanceConfigurationResponseSchema),
+        400: jsonResponse("The connector instance path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to inspect connector instances.", unauthorizedSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ ok: true, item: await getConnectorInstanceConfiguration({ connectorInstanceId: validParam<any>(c).connectorInstanceId, context: actorContext(c) }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorInstanceRemove,
+    paramValidator(connectorInstanceParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Remove connector instance",
+      description: "Removes a connector instance and deletes the plugins, mappings, config objects, and bindings associated with it.",
+      responses: {
+        200: jsonResponse("Connector instance removed and cleaned up successfully.", connectorInstanceRemoveResponseSchema),
+        400: jsonResponse("The connector instance path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to remove connector instances.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to remove this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        return c.json({ ok: true, item: await removeConnectorInstance({ connectorInstanceId: validParam<any>(c).connectorInstanceId, context }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorInstanceAutoImport,
+    paramValidator(connectorInstanceParamsSchema),
+    jsonValidator(connectorInstanceAutoImportSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Set connector instance auto-import",
+      description: "Enables or disables auto-import of new plugins on future push webhooks for a connector instance.",
+      responses: {
+        200: jsonResponse("Connector instance auto-import updated successfully.", connectorInstanceConfigurationResponseSchema),
+        400: jsonResponse("The auto-import request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to configure connector instances.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to configure this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await setConnectorInstanceAutoImport({ autoImportNewPlugins: Boolean(body.autoImportNewPlugins), connectorInstanceId: params.connectorInstanceId, context }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstanceDiscovery,
+    paramValidator(connectorInstanceParamsSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Get GitHub connector discovery",
+      description: "Analyzes a GitHub connector target and returns discovered plugin candidates.",
+      responses: {
+        200: jsonResponse("GitHub connector discovery returned successfully.", githubConnectorDiscoveryResponseSchema),
+        400: jsonResponse("The connector instance path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to inspect GitHub discovery.", unauthorizedSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ ok: true, item: await getGithubConnectorDiscovery({ connectorInstanceId: validParam<any>(c).connectorInstanceId, context: actorContext(c) }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstanceDiscoveryTree,
+    paramValidator(connectorInstanceParamsSchema),
+    queryValidator(githubDiscoveryTreeQuerySchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "List GitHub discovery tree entries",
+      description: "Pages through the normalized GitHub repository tree used during discovery.",
+      responses: {
+        200: jsonResponse("GitHub discovery tree returned successfully.", githubDiscoveryTreeResponseSchema),
+        400: jsonResponse("The discovery tree request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to inspect GitHub discovery tree entries.", unauthorizedSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const query = validQuery<any>(c)
+        return c.json(await getGithubConnectorDiscoveryTree({ connectorInstanceId: params.connectorInstanceId, context: actorContext(c), cursor: query.cursor, limit: query.limit, prefix: query.prefix }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorInstanceDiscoveryApply,
+    paramValidator(connectorInstanceParamsSchema),
+    jsonValidator(githubDiscoveryApplySchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Apply GitHub discovery selection",
+      description: "Creates OpenWork plugins and connector mappings from selected discovery candidates.",
+      responses: {
+        200: jsonResponse("GitHub discovery selection applied successfully.", githubDiscoveryApplyResponseSchema),
+        400: jsonResponse("The discovery apply request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to apply discovery selections.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        const context = actorContext(c)
+        if (Array.isArray(body.selectedKeys) && body.selectedKeys.length > 0) {
+          await requirePluginArchCapability(context, "plugin.create")
+        }
+        return c.json({ ok: true, item: await applyGithubConnectorDiscovery({ autoImportNewPlugins: Boolean(body.autoImportNewPlugins), connectorInstanceId: params.connectorInstanceId, context, selectedKeys: body.selectedKeys }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorInstanceAccess,
+    paramValidator(connectorInstanceParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector instance access grants",
+      description: "Lists direct, team, and org-wide grants for a connector instance.",
+      responses: {
+        200: jsonResponse("Connector instance access grants returned successfully.", accessGrantListResponseSchema),
+        400: jsonResponse("The connector instance access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage connector instance access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage connector instance access.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json(await listResourceAccess({ context: actorContext(c), resourceId: params.connectorInstanceId, resourceKind: "connector_instance" }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorInstanceAccess,
+    paramValidator(connectorInstanceParamsSchema),
+    jsonValidator(resourceAccessGrantWriteSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Grant connector instance access",
+      description: "Creates or reactivates one access grant for a connector instance.",
+      responses: {
+        201: jsonResponse("Connector instance access grant created successfully.", accessGrantMutationResponseSchema),
+        400: jsonResponse("The connector instance access request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage connector instance access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage connector instance access.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        return c.json({ ok: true, item: await createResourceAccessGrant({ context: actorContext(c), resourceId: params.connectorInstanceId, resourceKind: "connector_instance", value: validJson<any>(c) }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.connectorInstanceAccessGrant,
+    paramValidator(connectorInstanceAccessGrantParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Revoke connector instance access",
+      description: "Soft-revokes one connector instance access grant.",
+      responses: {
+        204: emptyResponse("Connector instance access revoked successfully."),
+        400: jsonResponse("The connector instance access path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage connector instance access.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to manage connector instance access.", forbiddenSchema),
+        404: jsonResponse("The access grant could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        await deleteResourceAccessGrant({ context: actorContext(c), grantId: params.grantId, resourceId: params.connectorInstanceId, resourceKind: "connector_instance" })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorTargets,
+    paramValidator(connectorInstanceParamsSchema),
+    queryValidator(connectorTargetListQuerySchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector targets",
+      description: "Lists connector targets for one connector instance.",
+      responses: {
+        200: jsonResponse("Connector targets returned successfully.", connectorTargetListResponseSchema),
+        400: jsonResponse("The connector target query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list connector targets.", unauthorizedSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const query = validQuery<any>(c)
+        return c.json(await listConnectorTargets({ connectorInstanceId: params.connectorInstanceId, context: actorContext(c), cursor: query.cursor, limit: query.limit, q: query.q, targetKind: query.targetKind }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorTargets,
+    paramValidator(connectorInstanceParamsSchema),
+    jsonValidator(connectorTargetCreateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Create connector target",
+      description: "Creates a connector target under a connector instance.",
+      responses: {
+        201: jsonResponse("Connector target created successfully.", connectorTargetMutationResponseSchema),
+        400: jsonResponse("The connector target creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create connector targets.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector instance could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createConnectorTarget({ config: body.config, connectorInstanceId: params.connectorInstanceId, connectorType: body.connectorType, context: actorContext(c), externalTargetRef: body.externalTargetRef, remoteId: body.remoteId, targetKind: body.targetKind }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorTarget,
+    paramValidator(connectorTargetParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Get connector target",
+      description: "Returns one connector target detail.",
+      responses: {
+        200: jsonResponse("Connector target returned successfully.", connectorTargetDetailResponseSchema),
+        400: jsonResponse("The connector target path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view connector targets.", unauthorizedSchema),
+        404: jsonResponse("The connector target could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ item: await getConnectorTargetDetail(actorContext(c), validParam<any>(c).connectorTargetId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "patch", pluginArchRoutePaths.connectorTarget,
+    paramValidator(connectorTargetParamsSchema),
+    jsonValidator(connectorTargetUpdateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Update connector target",
+      description: "Updates one connector target.",
+      responses: {
+        200: jsonResponse("Connector target updated successfully.", connectorTargetMutationResponseSchema),
+        400: jsonResponse("The connector target update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update connector targets.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector target could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await updateConnectorTarget({ config: body.config, connectorTargetId: params.connectorTargetId, context: actorContext(c), externalTargetRef: body.externalTargetRef, remoteId: body.remoteId }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorTargetResync,
+    paramValidator(connectorTargetParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Resync connector target",
+      description: "Queues a manual resync for a connector target.",
+      responses: {
+        202: jsonResponse("Connector target resync queued successfully.", connectorSyncAsyncResponseSchema),
+        400: jsonResponse("The connector target path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to resync connector targets.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector target could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const job = await queueConnectorTargetResync({ connectorTargetId: validParam<any>(c).connectorTargetId, context: actorContext(c) })
+        return c.json({ ok: true, queued: true, job }, 202)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorTargetMappings,
+    paramValidator(connectorTargetParamsSchema),
+    queryValidator(connectorMappingListQuerySchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector mappings",
+      description: "Lists mappings under a connector target.",
+      responses: {
+        200: jsonResponse("Connector mappings returned successfully.", connectorMappingListResponseSchema),
+        400: jsonResponse("The connector mapping query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list connector mappings.", unauthorizedSchema),
+        404: jsonResponse("The connector target could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const query = validQuery<any>(c)
+        return c.json(await listConnectorMappings({ connectorTargetId: params.connectorTargetId, context: actorContext(c), cursor: query.cursor, limit: query.limit, mappingKind: query.mappingKind, objectType: query.objectType, pluginId: query.pluginId, q: query.q }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorTargetMappings,
+    paramValidator(connectorTargetParamsSchema),
+    jsonValidator(connectorMappingCreateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Create connector mapping",
+      description: "Creates a connector mapping.",
+      responses: {
+        201: jsonResponse("Connector mapping created successfully.", connectorMappingMutationResponseSchema),
+        400: jsonResponse("The connector mapping creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create connector mappings.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance or target plugin.", forbiddenSchema),
+        404: jsonResponse("The connector target could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createConnectorMapping({ autoAddToPlugin: body.autoAddToPlugin, config: body.config, connectorTargetId: params.connectorTargetId, context: actorContext(c), mappingKind: body.mappingKind, objectType: body.objectType, pluginId: body.pluginId, selector: body.selector }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "patch", pluginArchRoutePaths.connectorMapping,
+    paramValidator(connectorMappingParamsSchema),
+    jsonValidator(connectorMappingUpdateSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Update connector mapping",
+      description: "Updates one connector mapping.",
+      responses: {
+        200: jsonResponse("Connector mapping updated successfully.", connectorMappingMutationResponseSchema),
+        400: jsonResponse("The connector mapping update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update connector mappings.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance or target plugin.", forbiddenSchema),
+        404: jsonResponse("The connector mapping could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await updateConnectorMapping({ autoAddToPlugin: body.autoAddToPlugin, config: body.config, connectorMappingId: params.connectorMappingId, context: actorContext(c), objectType: body.objectType, pluginId: body.pluginId, selector: body.selector }) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "delete", pluginArchRoutePaths.connectorMapping,
+    paramValidator(connectorMappingParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Delete connector mapping",
+      description: "Deletes one connector mapping.",
+      responses: {
+        204: emptyResponse("Connector mapping deleted successfully."),
+        400: jsonResponse("The connector mapping path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete connector mappings.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector mapping could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        await deleteConnectorMapping({ connectorMappingId: validParam<any>(c).connectorMappingId, context: actorContext(c) })
+        return c.body(null, 204)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorSyncEvents,
+    queryValidator(connectorSyncEventListQuerySchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "List connector sync events",
+      description: "Lists connector sync events visible to the current member.",
+      responses: {
+        200: jsonResponse("Connector sync events returned successfully.", connectorSyncEventListResponseSchema),
+        400: jsonResponse("The connector sync event query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list connector sync events.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const query = validQuery<any>(c)
+      return c.json(await listConnectorSyncEvents({ connectorInstanceId: query.connectorInstanceId, connectorTargetId: query.connectorTargetId, context: actorContext(c), cursor: query.cursor, eventType: query.eventType, limit: query.limit, q: query.q, status: query.status }))
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.connectorSyncEvent,
+    paramValidator(connectorSyncEventParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Get connector sync event",
+      description: "Returns one connector sync event detail.",
+      responses: {
+        200: jsonResponse("Connector sync event returned successfully.", connectorSyncEventDetailResponseSchema),
+        400: jsonResponse("The connector sync event path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to view connector sync events.", unauthorizedSchema),
+        404: jsonResponse("The connector sync event could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        return c.json({ item: await getConnectorSyncEventDetail(actorContext(c), validParam<any>(c).connectorSyncEventId) })
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.connectorSyncEventRetry,
+    paramValidator(connectorSyncEventParamsSchema),
+    describeRoute({
+      tags: ["Connectors"],
+      summary: "Retry connector sync event",
+      description: "Re-queues one connector sync event.",
+      responses: {
+        202: jsonResponse("Connector sync event retried successfully.", connectorSyncAsyncResponseSchema),
+        400: jsonResponse("The connector sync event path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to retry connector sync events.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to edit this connector instance.", forbiddenSchema),
+        404: jsonResponse("The connector sync event could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const job = await retryConnectorSyncEvent({ connectorSyncEventId: validParam<any>(c).connectorSyncEventId, context: actorContext(c) })
+        return c.json({ ok: true, queued: true, job }, 202)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.githubAccounts,
+    jsonValidator(githubConnectorAccountCreateSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Create GitHub connector account",
+      description: "Persists one GitHub App installation as a connector account.",
+      responses: {
+        201: jsonResponse("GitHub connector account created successfully.", connectorAccountMutationResponseSchema),
+        400: jsonResponse("The GitHub account creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create GitHub connector accounts.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to create GitHub connector accounts.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_account.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await createGithubConnectorAccount({ accountLogin: body.accountLogin, accountType: body.accountType, context, displayName: body.displayName, installationId: body.installationId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.githubSetup,
+    jsonValidator(githubConnectorSetupSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Setup GitHub connector",
+      description: "Creates a GitHub connector account, instance, target, and initial mappings in one flow.",
+      responses: {
+        201: jsonResponse("GitHub connector setup created successfully.", githubSetupResponseSchema),
+        400: jsonResponse("The GitHub setup request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to setup GitHub connectors.", unauthorizedSchema),
+        403: jsonResponse("The caller lacks permission to setup GitHub connectors.", forbiddenSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const context = actorContext(c)
+        await requirePluginArchCapability(context, "connector_instance.create")
+        const body = validJson<any>(c)
+        return c.json({ ok: true, item: await githubSetup({ branch: body.branch, connectorAccountId: body.connectorAccountId, connectorInstanceName: body.connectorInstanceName, context, installationId: body.installationId, mappings: body.mappings, ref: body.ref, repositoryFullName: body.repositoryFullName, repositoryId: body.repositoryId }) }, 201)
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "get", pluginArchRoutePaths.githubAccountRepositories,
+    paramValidator(connectorAccountRepositoryParamsSchema),
+    queryValidator(githubRepositoryListQuerySchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "List GitHub repositories",
+      description: "Lists repositories visible to one GitHub connector account.",
+      responses: {
+        200: jsonResponse("GitHub repositories returned successfully.", githubRepositoryListResponseSchema),
+        400: jsonResponse("The GitHub repository query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list GitHub repositories.", unauthorizedSchema),
+        404: jsonResponse("The connector account could not be found.", notFoundSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      try {
+        const params = validParam<any>(c)
+        const query = validQuery<any>(c)
+        return c.json(await listGithubRepositories({ connectorAccountId: params.connectorAccountId, context: actorContext(c), cursor: query.cursor, limit: query.limit, q: query.q }))
+      } catch (error) {
+        return routeErrorResponse(c, error)
+      }
+    })
+
+  withPluginArchOrgContext(app, "post", pluginArchRoutePaths.githubValidateTarget,
+    jsonValidator(githubValidateTargetSchema),
+    describeRoute({
+      tags: ["GitHub"],
+      summary: "Validate GitHub target",
+      description: "Validates one repository-branch target before persisting it.",
+      responses: {
+        200: jsonResponse("GitHub target validated successfully.", githubValidateTargetResponseSchema),
+        400: jsonResponse("The GitHub target validation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to validate GitHub targets.", unauthorizedSchema),
+      },
+    }),
+    async (c: OrgContext) => {
+      const body = validJson<any>(c)
+      return c.json({ ok: true, item: await validateGithubTarget({ branch: body.branch, installationId: body.installationId, ref: body.ref, repositoryFullName: body.repositoryFullName, repositoryId: body.repositoryId }) })
+    })
+}
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/schemas.ts b/ee/apps/den-api/src/routes/org/plugin-system/schemas.ts
new file mode 100644
index 0000000000..d87e7e5bda
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/schemas.ts
@@ -0,0 +1,882 @@
+import {
+  accessRoleValues,
+  configObjectCreatedViaValues,
+  configObjectSourceModeValues,
+  configObjectStatusValues,
+  configObjectTypeValues,
+  connectorAccountStatusValues,
+  connectorInstanceStatusValues,
+  connectorMappingKindValues,
+  connectorSyncEventTypeValues,
+  connectorSyncStatusValues,
+  connectorTargetKindValues,
+  connectorTypeValues,
+  marketplaceStatusValues,
+  membershipSourceValues,
+  pluginStatusValues,
+} from "@openwork-ee/den-db/schema"
+import { z } from "zod"
+import { denTypeIdSchema } from "../../../openapi.js"
+import { idParamSchema } from "../shared.js"
+
+const cursorSchema = z.string().trim().min(1).max(255)
+const jsonObjectSchema = z.object({}).passthrough()
+const rawSourceTextSchema = z.string().trim().min(1)
+const nullableStringSchema = z.string().trim().min(1).nullable()
+const nullableTimestampSchema = z.string().datetime({ offset: true }).nullable()
+const queryBooleanSchema = z.enum(["true", "false"]).transform((value) => value === "true")
+
+export const githubWebhookEventValues = ["push", "installation", "installation_repositories", "repository"] as const
+
+export const configObjectIdSchema = denTypeIdSchema("configObject")
+export const configObjectVersionIdSchema = denTypeIdSchema("configObjectVersion")
+export const configObjectAccessGrantIdSchema = denTypeIdSchema("configObjectAccessGrant")
+export const pluginIdSchema = denTypeIdSchema("plugin")
+export const pluginConfigObjectIdSchema = denTypeIdSchema("pluginConfigObject")
+export const pluginAccessGrantIdSchema = denTypeIdSchema("pluginAccessGrant")
+export const marketplaceIdSchema = denTypeIdSchema("marketplace")
+export const marketplacePluginIdSchema = denTypeIdSchema("marketplacePlugin")
+export const marketplaceAccessGrantIdSchema = denTypeIdSchema("marketplaceAccessGrant")
+export const connectorAccountIdSchema = denTypeIdSchema("connectorAccount")
+export const connectorInstanceIdSchema = denTypeIdSchema("connectorInstance")
+export const connectorInstanceAccessGrantIdSchema = denTypeIdSchema("connectorInstanceAccessGrant")
+export const connectorTargetIdSchema = denTypeIdSchema("connectorTarget")
+export const connectorMappingIdSchema = denTypeIdSchema("connectorMapping")
+export const connectorSyncEventIdSchema = denTypeIdSchema("connectorSyncEvent")
+export const connectorSourceBindingIdSchema = denTypeIdSchema("connectorSourceBinding")
+export const connectorSourceTombstoneIdSchema = denTypeIdSchema("connectorSourceTombstone")
+export const memberIdSchema = denTypeIdSchema("member")
+export const teamIdSchema = denTypeIdSchema("team")
+
+export const configObjectTypeSchema = z.enum(configObjectTypeValues)
+export const configObjectSourceModeSchema = z.enum(configObjectSourceModeValues)
+export const configObjectCreatedViaSchema = z.enum(configObjectCreatedViaValues)
+export const configObjectStatusSchema = z.enum(configObjectStatusValues)
+export const pluginStatusSchema = z.enum(pluginStatusValues)
+export const marketplaceStatusSchema = z.enum(marketplaceStatusValues)
+export const membershipSourceSchema = z.enum(membershipSourceValues)
+export const accessRoleSchema = z.enum(accessRoleValues)
+export const connectorTypeSchema = z.enum(connectorTypeValues)
+export const connectorAccountStatusSchema = z.enum(connectorAccountStatusValues)
+export const connectorInstanceStatusSchema = z.enum(connectorInstanceStatusValues)
+export const connectorTargetKindSchema = z.enum(connectorTargetKindValues)
+export const connectorMappingKindSchema = z.enum(connectorMappingKindValues)
+export const connectorSyncStatusSchema = z.enum(connectorSyncStatusValues)
+export const connectorSyncEventTypeSchema = z.enum(connectorSyncEventTypeValues)
+export const githubWebhookEventSchema = z.enum(githubWebhookEventValues)
+
+export const pluginArchPaginationQuerySchema = z.object({
+  cursor: cursorSchema.optional(),
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+})
+
+export const configObjectListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  type: configObjectTypeSchema.optional(),
+  status: configObjectStatusSchema.optional(),
+  sourceMode: configObjectSourceModeSchema.optional(),
+  pluginId: pluginIdSchema.optional(),
+  connectorInstanceId: connectorInstanceIdSchema.optional(),
+  includeDeleted: queryBooleanSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const configObjectVersionListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  includeDeleted: queryBooleanSchema.optional(),
+})
+
+export const pluginListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  status: pluginStatusSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const marketplaceListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  status: marketplaceStatusSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const connectorAccountListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  connectorType: connectorTypeSchema.optional(),
+  status: connectorAccountStatusSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const connectorInstanceListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  connectorAccountId: connectorAccountIdSchema.optional(),
+  connectorType: connectorTypeSchema.optional(),
+  pluginId: pluginIdSchema.optional(),
+  status: connectorInstanceStatusSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const connectorTargetListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  targetKind: connectorTargetKindSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const connectorMappingListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  mappingKind: connectorMappingKindSchema.optional(),
+  objectType: configObjectTypeSchema.optional(),
+  pluginId: pluginIdSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const connectorSyncEventListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  connectorInstanceId: connectorInstanceIdSchema.optional(),
+  connectorTargetId: connectorTargetIdSchema.optional(),
+  eventType: connectorSyncEventTypeSchema.optional(),
+  status: connectorSyncStatusSchema.optional(),
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const githubRepositoryListQuerySchema = pluginArchPaginationQuerySchema.extend({
+  q: z.string().trim().min(1).max(255).optional(),
+})
+
+export const configObjectParamsSchema = idParamSchema("configObjectId", "configObject")
+export const configObjectVersionParamsSchema = configObjectParamsSchema.extend(idParamSchema("versionId", "configObjectVersion").shape)
+export const configObjectAccessGrantParamsSchema = configObjectParamsSchema.extend(idParamSchema("grantId", "configObjectAccessGrant").shape)
+export const pluginParamsSchema = idParamSchema("pluginId", "plugin")
+export const pluginConfigObjectParamsSchema = pluginParamsSchema.extend(idParamSchema("configObjectId", "configObject").shape)
+export const pluginAccessGrantParamsSchema = pluginParamsSchema.extend(idParamSchema("grantId", "pluginAccessGrant").shape)
+export const marketplaceParamsSchema = idParamSchema("marketplaceId", "marketplace")
+export const marketplacePluginParamsSchema = marketplaceParamsSchema.extend(idParamSchema("pluginId", "plugin").shape)
+export const marketplaceAccessGrantParamsSchema = marketplaceParamsSchema.extend(idParamSchema("grantId", "marketplaceAccessGrant").shape)
+export const connectorAccountParamsSchema = idParamSchema("connectorAccountId", "connectorAccount")
+export const connectorInstanceParamsSchema = idParamSchema("connectorInstanceId", "connectorInstance")
+export const connectorInstanceAccessGrantParamsSchema = connectorInstanceParamsSchema.extend(idParamSchema("grantId", "connectorInstanceAccessGrant").shape)
+export const connectorTargetParamsSchema = idParamSchema("connectorTargetId", "connectorTarget")
+export const connectorMappingParamsSchema = idParamSchema("connectorMappingId", "connectorMapping")
+export const connectorSyncEventParamsSchema = idParamSchema("connectorSyncEventId", "connectorSyncEvent")
+
+export const connectorAccountRepositoryParamsSchema = connectorAccountParamsSchema
+
+export const configObjectInputSchema = z.object({
+  rawSourceText: rawSourceTextSchema.optional(),
+  normalizedPayloadJson: jsonObjectSchema.optional(),
+  parserMode: z.string().trim().min(1).max(100).optional(),
+  schemaVersion: z.string().trim().min(1).max(100).optional(),
+  metadata: jsonObjectSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (!value.rawSourceText && !value.normalizedPayloadJson) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide either rawSourceText or normalizedPayloadJson.",
+      path: ["rawSourceText"],
+    })
+  }
+})
+
+export const configObjectCreateSchema = z.object({
+  type: configObjectTypeSchema,
+  sourceMode: configObjectSourceModeSchema,
+  pluginIds: z.array(pluginIdSchema).max(100).optional(),
+  input: configObjectInputSchema,
+})
+
+export const configObjectCreateVersionSchema = z.object({
+  input: configObjectInputSchema,
+  reason: z.string().trim().min(1).max(255).optional(),
+})
+
+export const configObjectPluginAttachSchema = z.object({
+  pluginId: pluginIdSchema,
+  membershipSource: membershipSourceSchema.optional(),
+})
+
+export const resourceAccessGrantWriteSchema = z.object({
+  orgMembershipId: memberIdSchema.optional(),
+  teamId: teamIdSchema.optional(),
+  orgWide: z.boolean().optional().default(false),
+  role: accessRoleSchema,
+}).superRefine((value, ctx) => {
+  const count = Number(Boolean(value.orgMembershipId)) + Number(Boolean(value.teamId)) + Number(Boolean(value.orgWide))
+  if (count !== 1) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide exactly one of orgMembershipId, teamId, or orgWide=true.",
+      path: ["orgMembershipId"],
+    })
+  }
+})
+
+export const pluginCreateSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  description: nullableStringSchema.optional(),
+})
+
+export const pluginUpdateSchema = z.object({
+  name: z.string().trim().min(1).max(255).optional(),
+  description: nullableStringSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (value.name === undefined && value.description === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide at least one field to update.",
+      path: ["name"],
+    })
+  }
+})
+
+export const marketplaceCreateSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  description: nullableStringSchema.optional(),
+})
+
+export const marketplaceUpdateSchema = z.object({
+  name: z.string().trim().min(1).max(255).optional(),
+  description: nullableStringSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (value.name === undefined && value.description === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide at least one field to update.",
+      path: ["name"],
+    })
+  }
+})
+
+export const pluginMembershipWriteSchema = z.object({
+  configObjectId: configObjectIdSchema,
+  membershipSource: membershipSourceSchema.optional(),
+})
+
+export const marketplacePluginWriteSchema = z.object({
+  pluginId: pluginIdSchema,
+  membershipSource: membershipSourceSchema.optional(),
+})
+
+export const connectorAccountCreateSchema = z.object({
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255),
+  externalAccountRef: z.string().trim().min(1).max(255).nullable().optional(),
+  displayName: z.string().trim().min(1).max(255),
+  metadata: jsonObjectSchema.optional(),
+})
+
+export const connectorAccountDisconnectSchema = z.object({
+  reason: z.string().trim().min(1).max(255).optional(),
+}).optional()
+
+export const connectorInstanceCreateSchema = z.object({
+  connectorAccountId: connectorAccountIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable().optional(),
+  name: z.string().trim().min(1).max(255),
+  config: jsonObjectSchema.optional(),
+})
+
+export const connectorInstanceUpdateSchema = z.object({
+  remoteId: z.string().trim().min(1).max(255).nullable().optional(),
+  name: z.string().trim().min(1).max(255).optional(),
+  status: connectorInstanceStatusSchema.optional(),
+  config: jsonObjectSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (value.remoteId === undefined && value.name === undefined && value.status === undefined && value.config === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide at least one field to update.",
+      path: ["name"],
+    })
+  }
+})
+
+export const connectorTargetCreateSchema = z.object({
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255),
+  targetKind: connectorTargetKindSchema,
+  externalTargetRef: z.string().trim().min(1).max(255).nullable().optional(),
+  config: jsonObjectSchema,
+})
+
+export const connectorTargetUpdateSchema = z.object({
+  remoteId: z.string().trim().min(1).max(255).optional(),
+  externalTargetRef: z.string().trim().min(1).max(255).nullable().optional(),
+  config: jsonObjectSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (value.remoteId === undefined && value.externalTargetRef === undefined && value.config === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide at least one field to update.",
+      path: ["remoteId"],
+    })
+  }
+})
+
+export const connectorMappingCreateSchema = z.object({
+  mappingKind: connectorMappingKindSchema,
+  selector: z.string().trim().min(1).max(255),
+  objectType: configObjectTypeSchema,
+  pluginId: pluginIdSchema.nullable().optional(),
+  autoAddToPlugin: z.boolean().default(false),
+  config: jsonObjectSchema.optional(),
+})
+
+export const connectorMappingUpdateSchema = z.object({
+  selector: z.string().trim().min(1).max(255).optional(),
+  objectType: configObjectTypeSchema.optional(),
+  pluginId: pluginIdSchema.nullable().optional(),
+  autoAddToPlugin: z.boolean().optional(),
+  config: jsonObjectSchema.optional(),
+}).superRefine((value, ctx) => {
+  if (
+    value.selector === undefined
+    && value.objectType === undefined
+    && value.pluginId === undefined
+    && value.autoAddToPlugin === undefined
+    && value.config === undefined
+  ) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide at least one field to update.",
+      path: ["selector"],
+    })
+  }
+})
+
+export const githubConnectorSetupSchema = z.object({
+  installationId: z.number().int().positive(),
+  connectorAccountId: connectorAccountIdSchema.optional(),
+  connectorInstanceName: z.string().trim().min(1).max(255),
+  repositoryId: z.number().int().positive(),
+  repositoryFullName: z.string().trim().min(1).max(255),
+  branch: z.string().trim().min(1).max(255),
+  ref: z.string().trim().min(1).max(255),
+  mappings: z.array(connectorMappingCreateSchema).max(100).default([]),
+})
+
+export const githubInstallStartSchema = z.object({
+  returnPath: z.string().trim().min(1).max(1024),
+})
+
+export const githubInstallCompleteSchema = z.object({
+  installationId: z.number().int().positive(),
+  state: z.string().trim().min(1).max(4096),
+})
+
+export const githubDiscoveryApplySchema = z.object({
+  autoImportNewPlugins: z.boolean().default(false),
+  selectedKeys: z.array(z.string().trim().min(1).max(255)).max(200),
+})
+
+export const githubDiscoveryTreeQuerySchema = z.object({
+  cursor: z.string().trim().min(1).max(255).optional(),
+  limit: z.coerce.number().int().positive().max(500).optional(),
+  prefix: z.string().trim().min(1).max(1024).optional(),
+})
+
+export const githubConnectorAccountCreateSchema = z.object({
+  installationId: z.number().int().positive(),
+  accountLogin: z.string().trim().min(1).max(255),
+  accountType: z.enum(["Organization", "User"]),
+  displayName: z.string().trim().min(1).max(255),
+})
+
+export const githubValidateTargetSchema = z.object({
+  installationId: z.number().int().positive(),
+  repositoryId: z.number().int().positive(),
+  repositoryFullName: z.string().trim().min(1).max(255),
+  branch: z.string().trim().min(1).max(255),
+  ref: z.string().trim().min(1).max(255),
+})
+
+export const accessGrantSchema = z.object({
+  id: z.union([configObjectAccessGrantIdSchema, pluginAccessGrantIdSchema, marketplaceAccessGrantIdSchema, connectorInstanceAccessGrantIdSchema]),
+  orgMembershipId: memberIdSchema.nullable(),
+  teamId: teamIdSchema.nullable(),
+  orgWide: z.boolean(),
+  role: accessRoleSchema,
+  createdByOrgMembershipId: memberIdSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  removedAt: nullableTimestampSchema,
+}).meta({ ref: "PluginArchAccessGrant" })
+
+export const configObjectVersionSchema = z.object({
+  id: configObjectVersionIdSchema,
+  configObjectId: configObjectIdSchema,
+  schemaVersion: z.string().trim().min(1).max(100).nullable(),
+  normalizedPayloadJson: jsonObjectSchema.nullable(),
+  rawSourceText: z.string().nullable(),
+  createdVia: configObjectCreatedViaSchema,
+  createdByOrgMembershipId: memberIdSchema.nullable(),
+  connectorSyncEventId: connectorSyncEventIdSchema.nullable(),
+  sourceRevisionRef: z.string().trim().min(1).max(255).nullable(),
+  isDeletedVersion: z.boolean(),
+  createdAt: z.string().datetime({ offset: true }),
+}).meta({ ref: "PluginArchConfigObjectVersion" })
+
+export const configObjectSchema = z.object({
+  id: configObjectIdSchema,
+  organizationId: denTypeIdSchema("organization"),
+  objectType: configObjectTypeSchema,
+  sourceMode: configObjectSourceModeSchema,
+  title: z.string().trim().min(1).max(255),
+  description: nullableStringSchema,
+  searchText: z.string().trim().min(1).max(65535).nullable(),
+  currentFileName: z.string().trim().min(1).max(255).nullable(),
+  currentFileExtension: z.string().trim().min(1).max(32).nullable(),
+  currentRelativePath: z.string().trim().min(1).max(255).nullable(),
+  status: configObjectStatusSchema,
+  createdByOrgMembershipId: memberIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema.nullable(),
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+  deletedAt: nullableTimestampSchema,
+  latestVersion: configObjectVersionSchema.nullable(),
+}).meta({ ref: "PluginArchConfigObject" })
+
+export const pluginMembershipSchema = z.object({
+  id: pluginConfigObjectIdSchema,
+  pluginId: pluginIdSchema,
+  configObjectId: configObjectIdSchema,
+  membershipSource: membershipSourceSchema,
+  connectorMappingId: connectorMappingIdSchema.nullable(),
+  createdByOrgMembershipId: memberIdSchema.nullable(),
+  createdAt: z.string().datetime({ offset: true }),
+  removedAt: nullableTimestampSchema,
+  configObject: configObjectSchema.optional(),
+}).meta({ ref: "PluginArchPluginMembership" })
+
+export const pluginSchema = z.object({
+  id: pluginIdSchema,
+  organizationId: denTypeIdSchema("organization"),
+  name: z.string().trim().min(1).max(255),
+  description: nullableStringSchema,
+  status: pluginStatusSchema,
+  createdByOrgMembershipId: memberIdSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+  deletedAt: nullableTimestampSchema,
+  memberCount: z.number().int().nonnegative().optional(),
+  marketplaces: z.array(z.object({
+    id: marketplaceIdSchema,
+    name: z.string().trim().min(1).max(255),
+  })).optional(),
+}).meta({ ref: "PluginArchPlugin" })
+
+export const marketplacePluginSchema = z.object({
+  id: marketplacePluginIdSchema,
+  marketplaceId: marketplaceIdSchema,
+  pluginId: pluginIdSchema,
+  membershipSource: membershipSourceSchema,
+  createdByOrgMembershipId: memberIdSchema.nullable(),
+  createdAt: z.string().datetime({ offset: true }),
+  removedAt: nullableTimestampSchema,
+  plugin: pluginSchema.optional(),
+}).meta({ ref: "PluginArchMarketplacePluginMembership" })
+
+export const marketplaceSchema = z.object({
+  id: marketplaceIdSchema,
+  organizationId: denTypeIdSchema("organization"),
+  name: z.string().trim().min(1).max(255),
+  description: nullableStringSchema,
+  status: marketplaceStatusSchema,
+  createdByOrgMembershipId: memberIdSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+  deletedAt: nullableTimestampSchema,
+  pluginCount: z.number().int().nonnegative().optional(),
+}).meta({ ref: "PluginArchMarketplace" })
+
+export const connectorAccountSchema = z.object({
+  id: connectorAccountIdSchema,
+  organizationId: denTypeIdSchema("organization"),
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255),
+  externalAccountRef: z.string().trim().min(1).max(255).nullable(),
+  displayName: z.string().trim().min(1).max(255),
+  status: connectorAccountStatusSchema,
+  createdByName: z.string().trim().min(1).max(255).nullable().optional(),
+  createdByOrgMembershipId: memberIdSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+  metadata: jsonObjectSchema.optional(),
+}).meta({ ref: "PluginArchConnectorAccount" })
+
+export const connectorInstanceSchema = z.object({
+  id: connectorInstanceIdSchema,
+  organizationId: denTypeIdSchema("organization"),
+  connectorAccountId: connectorAccountIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable(),
+  name: z.string().trim().min(1).max(255),
+  status: connectorInstanceStatusSchema,
+  instanceConfigJson: jsonObjectSchema.nullable(),
+  lastSyncedAt: nullableTimestampSchema,
+  lastSyncStatus: connectorSyncStatusSchema.nullable(),
+  lastSyncCursor: z.string().trim().min(1).max(255).nullable(),
+  createdByOrgMembershipId: memberIdSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+}).meta({ ref: "PluginArchConnectorInstance" })
+
+export const connectorTargetSchema = z.object({
+  id: connectorTargetIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255),
+  targetKind: connectorTargetKindSchema,
+  externalTargetRef: z.string().trim().min(1).max(255).nullable(),
+  targetConfigJson: jsonObjectSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+}).meta({ ref: "PluginArchConnectorTarget" })
+
+export const connectorMappingSchema = z.object({
+  id: connectorMappingIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorTargetId: connectorTargetIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable(),
+  mappingKind: connectorMappingKindSchema,
+  selector: z.string().trim().min(1).max(255),
+  objectType: configObjectTypeSchema,
+  pluginId: pluginIdSchema.nullable(),
+  autoAddToPlugin: z.boolean(),
+  mappingConfigJson: jsonObjectSchema.nullable(),
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+}).meta({ ref: "PluginArchConnectorMapping" })
+
+export const connectorSyncSummarySchema = z.object({
+  createdCount: z.number().int().nonnegative().optional(),
+  updatedCount: z.number().int().nonnegative().optional(),
+  deletedCount: z.number().int().nonnegative().optional(),
+  skippedCount: z.number().int().nonnegative().optional(),
+  failedCount: z.number().int().nonnegative().optional(),
+  failures: z.array(jsonObjectSchema).optional(),
+}).passthrough().meta({ ref: "PluginArchConnectorSyncSummary" })
+
+export const connectorSyncEventSchema = z.object({
+  id: connectorSyncEventIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorTargetId: connectorTargetIdSchema.nullable(),
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable(),
+  eventType: connectorSyncEventTypeSchema,
+  externalEventRef: z.string().trim().min(1).max(255).nullable(),
+  sourceRevisionRef: z.string().trim().min(1).max(255).nullable(),
+  status: connectorSyncStatusSchema,
+  summaryJson: connectorSyncSummarySchema.nullable(),
+  startedAt: z.string().datetime({ offset: true }),
+  completedAt: nullableTimestampSchema,
+}).meta({ ref: "PluginArchConnectorSyncEvent" })
+
+export const connectorSourceBindingSchema = z.object({
+  id: connectorSourceBindingIdSchema,
+  configObjectId: configObjectIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorTargetId: connectorTargetIdSchema,
+  connectorMappingId: connectorMappingIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable(),
+  externalLocator: z.string().trim().min(1).max(255),
+  externalStableRef: z.string().trim().min(1).max(255).nullable(),
+  lastSeenSourceRevisionRef: z.string().trim().min(1).max(255).nullable(),
+  status: configObjectStatusSchema,
+  createdAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+  deletedAt: nullableTimestampSchema,
+}).meta({ ref: "PluginArchConnectorSourceBinding" })
+
+export const connectorSourceTombstoneSchema = z.object({
+  id: connectorSourceTombstoneIdSchema,
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorTargetId: connectorTargetIdSchema,
+  connectorMappingId: connectorMappingIdSchema,
+  connectorType: connectorTypeSchema,
+  remoteId: z.string().trim().min(1).max(255).nullable(),
+  externalLocator: z.string().trim().min(1).max(255),
+  formerConfigObjectId: configObjectIdSchema,
+  deletedInSyncEventId: connectorSyncEventIdSchema,
+  deletedSourceRevisionRef: z.string().trim().min(1).max(255).nullable(),
+  createdAt: z.string().datetime({ offset: true }),
+}).meta({ ref: "PluginArchConnectorSourceTombstone" })
+
+export const githubWebhookHeadersSchema = z.object({
+  xHubSignature256: z.string().trim().min(1),
+  xGithubEvent: githubWebhookEventSchema,
+  xGithubDelivery: z.string().trim().min(1),
+}).meta({ ref: "PluginArchGithubWebhookHeaders" })
+
+export const githubWebhookPayloadSchema = z.object({
+  after: z.string().trim().min(1).optional(),
+  installation: z.object({
+    id: z.number().int().positive(),
+  }).passthrough().optional(),
+  ref: z.string().trim().min(1).optional(),
+  repository: z.object({
+    full_name: z.string().trim().min(1),
+    id: z.number().int().positive(),
+  }).passthrough().optional(),
+}).passthrough().meta({ ref: "PluginArchGithubWebhookPayload" })
+
+export const githubWebhookEnvelopeSchema = z.object({
+  deliveryId: z.string().trim().min(1),
+  event: githubWebhookEventSchema,
+  installationId: z.number().int().positive().optional(),
+  repositoryId: z.number().int().positive().optional(),
+  repositoryFullName: z.string().trim().min(1).optional(),
+  ref: z.string().trim().min(1).optional(),
+  headSha: z.string().trim().min(1).optional(),
+  payload: githubWebhookPayloadSchema,
+}).meta({ ref: "PluginArchGithubWebhookEnvelope" })
+
+export const githubConnectorSyncJobSchema = z.object({
+  connectorType: z.literal("github"),
+  connectorInstanceId: connectorInstanceIdSchema,
+  connectorTargetId: connectorTargetIdSchema,
+  connectorSyncEventId: connectorSyncEventIdSchema,
+  deliveryId: z.string().trim().min(1),
+  installationId: z.number().int().positive(),
+  repositoryId: z.number().int().positive(),
+  repositoryFullName: z.string().trim().min(1),
+  ref: z.string().trim().min(1),
+  headSha: z.string().trim().min(1),
+}).meta({ ref: "PluginArchGithubConnectorSyncJob" })
+
+export const githubWebhookRawBodySchema = z.string().min(1).meta({ ref: "PluginArchGithubWebhookRawBody" })
+
+export const githubWebhookAcceptedResponseSchema = z.object({
+  ok: z.literal(true),
+  accepted: z.literal(true),
+  event: githubWebhookEventSchema,
+  deliveryId: z.string().trim().min(1),
+  queued: z.boolean(),
+}).meta({ ref: "PluginArchGithubWebhookAcceptedResponse" })
+
+export const githubWebhookIgnoredResponseSchema = z.object({
+  ok: z.literal(true),
+  accepted: z.literal(false),
+  reason: z.string().trim().min(1),
+}).meta({ ref: "PluginArchGithubWebhookIgnoredResponse" })
+
+export const githubWebhookUnauthorizedResponseSchema = z.object({
+  ok: z.literal(false),
+  error: z.literal("invalid signature"),
+}).meta({ ref: "PluginArchGithubWebhookUnauthorizedResponse" })
+
+export function pluginArchListResponseSchema<TSchema extends z.ZodTypeAny>(ref: string, itemSchema: TSchema) {
+  return z.object({
+    items: z.array(itemSchema),
+    nextCursor: cursorSchema.nullable(),
+  }).meta({ ref })
+}
+
+export function pluginArchDetailResponseSchema<TSchema extends z.ZodTypeAny>(ref: string, itemSchema: TSchema) {
+  return z.object({
+    item: itemSchema,
+  }).meta({ ref })
+}
+
+export function pluginArchMutationResponseSchema<TSchema extends z.ZodTypeAny>(ref: string, itemSchema: TSchema) {
+  return z.object({
+    ok: z.literal(true),
+    item: itemSchema,
+  }).meta({ ref })
+}
+
+export function pluginArchAsyncResponseSchema<TSchema extends z.ZodTypeAny>(ref: string, jobSchema: TSchema) {
+  return z.object({
+    ok: z.literal(true),
+    queued: z.literal(true),
+    job: jobSchema,
+  }).meta({ ref })
+}
+
+export const configObjectListResponseSchema = pluginArchListResponseSchema("PluginArchConfigObjectListResponse", configObjectSchema)
+export const configObjectDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConfigObjectDetailResponse", configObjectSchema)
+export const configObjectMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchConfigObjectMutationResponse", configObjectSchema)
+export const configObjectVersionListResponseSchema = pluginArchListResponseSchema("PluginArchConfigObjectVersionListResponse", configObjectVersionSchema)
+export const configObjectVersionDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConfigObjectVersionDetailResponse", configObjectVersionSchema)
+export const pluginListResponseSchema = pluginArchListResponseSchema("PluginArchPluginListResponse", pluginSchema)
+export const pluginDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchPluginDetailResponse", pluginSchema)
+export const pluginMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchPluginMutationResponse", pluginSchema)
+export const pluginMembershipListResponseSchema = pluginArchListResponseSchema("PluginArchPluginMembershipListResponse", pluginMembershipSchema)
+export const pluginMembershipDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchPluginMembershipDetailResponse", pluginMembershipSchema)
+export const pluginMembershipMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchPluginMembershipMutationResponse", pluginMembershipSchema)
+export const marketplaceListResponseSchema = pluginArchListResponseSchema("PluginArchMarketplaceListResponse", marketplaceSchema)
+export const marketplaceDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchMarketplaceDetailResponse", marketplaceSchema)
+export const marketplaceMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchMarketplaceMutationResponse", marketplaceSchema)
+
+export const marketplaceResolvedResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchMarketplaceResolvedResponse",
+  z.object({
+    marketplace: marketplaceSchema,
+    plugins: z.array(pluginSchema.extend({
+      componentCounts: z.record(z.string(), z.number().int().nonnegative()).default({}),
+    })),
+    source: z.object({
+      connectorAccountId: connectorAccountIdSchema,
+      connectorInstanceId: connectorInstanceIdSchema,
+      accountLogin: z.string().trim().min(1).nullable(),
+      repositoryFullName: z.string().trim().min(1),
+      branch: z.string().trim().min(1).nullable(),
+    }).nullable(),
+  }),
+)
+export const marketplacePluginListResponseSchema = pluginArchListResponseSchema("PluginArchMarketplacePluginListResponse", marketplacePluginSchema)
+export const marketplacePluginMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchMarketplacePluginMutationResponse", marketplacePluginSchema)
+export const accessGrantListResponseSchema = pluginArchListResponseSchema("PluginArchAccessGrantListResponse", accessGrantSchema)
+export const accessGrantMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchAccessGrantMutationResponse", accessGrantSchema)
+export const connectorAccountListResponseSchema = pluginArchListResponseSchema("PluginArchConnectorAccountListResponse", connectorAccountSchema)
+export const connectorAccountDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConnectorAccountDetailResponse", connectorAccountSchema)
+export const connectorAccountMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchConnectorAccountMutationResponse", connectorAccountSchema)
+export const connectorAccountDisconnectResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchConnectorAccountDisconnectResponse",
+  z.object({
+    deletedConfigObjectCount: z.number().int().nonnegative(),
+    deletedConnectorInstanceCount: z.number().int().nonnegative(),
+    deletedConnectorMappingCount: z.number().int().nonnegative(),
+    disconnectedAccountId: connectorAccountIdSchema,
+    reason: z.string().trim().nullable(),
+  }),
+)
+export const connectorInstanceConfiguredPluginSchema = pluginSchema.extend({
+  componentCounts: z.record(z.string(), z.number().int().nonnegative()).default({}),
+  rootPath: z.string().nullable(),
+}).meta({ ref: "PluginArchConnectorInstanceConfiguredPlugin" })
+
+export const connectorInstanceConfigurationResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchConnectorInstanceConfigurationResponse",
+  z.object({
+    autoImportNewPlugins: z.boolean(),
+    configuredPlugins: z.array(connectorInstanceConfiguredPluginSchema),
+    connectorInstance: connectorInstanceSchema,
+    importedConfigObjectCount: z.number().int().nonnegative(),
+    mappingCount: z.number().int().nonnegative(),
+  }),
+)
+export const connectorInstanceAutoImportSchema = z.object({
+  autoImportNewPlugins: z.boolean(),
+})
+export const connectorInstanceRemoveResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchConnectorInstanceRemoveResponse",
+  z.object({
+    deletedConfigObjectCount: z.number().int().nonnegative(),
+    deletedConnectorMappingCount: z.number().int().nonnegative(),
+    removedConnectorInstanceId: connectorInstanceIdSchema,
+  }),
+)
+export const connectorInstanceListResponseSchema = pluginArchListResponseSchema("PluginArchConnectorInstanceListResponse", connectorInstanceSchema)
+export const connectorInstanceDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConnectorInstanceDetailResponse", connectorInstanceSchema)
+export const connectorInstanceMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchConnectorInstanceMutationResponse", connectorInstanceSchema)
+export const connectorTargetListResponseSchema = pluginArchListResponseSchema("PluginArchConnectorTargetListResponse", connectorTargetSchema)
+export const connectorTargetDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConnectorTargetDetailResponse", connectorTargetSchema)
+export const connectorTargetMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchConnectorTargetMutationResponse", connectorTargetSchema)
+export const connectorMappingListResponseSchema = pluginArchListResponseSchema("PluginArchConnectorMappingListResponse", connectorMappingSchema)
+export const connectorMappingMutationResponseSchema = pluginArchMutationResponseSchema("PluginArchConnectorMappingMutationResponse", connectorMappingSchema)
+export const connectorSyncEventListResponseSchema = pluginArchListResponseSchema("PluginArchConnectorSyncEventListResponse", connectorSyncEventSchema)
+export const connectorSyncEventDetailResponseSchema = pluginArchDetailResponseSchema("PluginArchConnectorSyncEventDetailResponse", connectorSyncEventSchema)
+export const connectorSyncAsyncResponseSchema = pluginArchAsyncResponseSchema(
+  "PluginArchConnectorSyncAsyncResponse",
+  z.object({ id: connectorSyncEventIdSchema }),
+)
+export const githubRepositorySchema = z.object({
+  id: z.number().int().positive(),
+  fullName: z.string().trim().min(1),
+  defaultBranch: z.string().trim().min(1).nullable(),
+  hasPluginManifest: z.boolean().optional(),
+  manifestKind: z.enum(["marketplace", "plugin"]).nullable().optional(),
+  marketplacePluginCount: z.number().int().nonnegative().nullable().optional(),
+  private: z.boolean(),
+}).meta({ ref: "PluginArchGithubRepository" })
+export const githubRepositoryListResponseSchema = pluginArchListResponseSchema("PluginArchGithubRepositoryListResponse", githubRepositorySchema)
+export const githubDiscoveryStepSchema = z.object({
+  id: z.enum(["read_repository_structure", "check_marketplace_manifest", "check_plugin_manifests", "prepare_discovered_plugins"]),
+  label: z.string().trim().min(1),
+  status: z.enum(["completed", "running", "warning"]),
+}).meta({ ref: "PluginArchGithubDiscoveryStep" })
+export const githubDiscoveryTreeSummarySchema = z.object({
+  scannedEntryCount: z.number().int().nonnegative(),
+  strategy: z.enum(["git-tree-recursive"]),
+  truncated: z.boolean(),
+}).meta({ ref: "PluginArchGithubDiscoveryTreeSummary" })
+export const githubDiscoveredPluginSchema = z.object({
+  key: z.string().trim().min(1),
+  sourceKind: z.enum(["marketplace_entry", "plugin_manifest", "standalone_claude", "folder_inference"]),
+  rootPath: z.string(),
+  displayName: z.string().trim().min(1),
+  description: nullableStringSchema,
+  selectedByDefault: z.boolean(),
+  supported: z.boolean(),
+  manifestPath: nullableStringSchema,
+  warnings: z.array(z.string().trim().min(1)),
+  componentKinds: z.array(z.enum(["skill", "command", "agent", "hook", "mcp_server", "lsp_server", "monitor", "settings"])),
+  componentPaths: z.object({
+    agents: z.array(z.string().trim().min(1)),
+    commands: z.array(z.string().trim().min(1)),
+    hooks: z.array(z.string().trim().min(1)),
+    lspServers: z.array(z.string().trim().min(1)),
+    mcpServers: z.array(z.string().trim().min(1)),
+    monitors: z.array(z.string().trim().min(1)),
+    settings: z.array(z.string().trim().min(1)),
+    skills: z.array(z.string().trim().min(1)),
+  }),
+  metadata: jsonObjectSchema,
+}).meta({ ref: "PluginArchGithubDiscoveredPlugin" })
+export const githubConnectorDiscoveryResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubConnectorDiscoveryResponse",
+  z.object({
+    autoImportNewPlugins: z.boolean(),
+    classification: z.enum(["claude_marketplace_repo", "claude_multi_plugin_repo", "claude_single_plugin_repo", "folder_inferred_repo", "unsupported"]),
+    connectorInstance: connectorInstanceSchema,
+    connectorTarget: connectorTargetSchema,
+    discoveredPlugins: z.array(githubDiscoveredPluginSchema),
+    repositoryFullName: z.string().trim().min(1),
+    sourceRevisionRef: z.string().trim().min(1),
+    steps: z.array(githubDiscoveryStepSchema),
+    treeSummary: githubDiscoveryTreeSummarySchema,
+    warnings: z.array(z.string().trim().min(1)),
+  }),
+)
+export const githubDiscoveryTreeEntrySchema = z.object({
+  id: z.string().trim().min(1),
+  kind: z.enum(["blob", "tree"]),
+  path: z.string().trim().min(1),
+  sha: nullableStringSchema,
+  size: z.number().int().nonnegative().nullable(),
+}).meta({ ref: "PluginArchGithubDiscoveryTreeEntry" })
+export const githubDiscoveryTreeResponseSchema = pluginArchListResponseSchema("PluginArchGithubDiscoveryTreeResponse", githubDiscoveryTreeEntrySchema)
+export const githubDiscoveryApplyResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubDiscoveryApplyResponse",
+  z.object({
+    autoImportNewPlugins: z.boolean(),
+    createdMarketplace: marketplaceSchema.nullable().optional(),
+    connectorInstance: connectorInstanceSchema,
+    connectorTarget: connectorTargetSchema,
+    createdPlugins: z.array(pluginSchema),
+    createdMappings: z.array(connectorMappingSchema),
+    materializedConfigObjects: z.array(configObjectSchema),
+    sourceRevisionRef: z.string().trim().min(1),
+  }),
+)
+export const githubInstallStartResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubInstallStartResponse",
+  z.object({
+    redirectUrl: z.string().url(),
+    state: z.string().trim().min(1),
+  }),
+)
+export const githubInstallCompleteResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubInstallCompleteResponse",
+  z.object({
+    connectorAccount: connectorAccountSchema,
+    repositories: z.array(githubRepositorySchema),
+  }),
+)
+export const githubSetupResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubSetupResponse",
+  z.object({
+    connectorAccount: connectorAccountSchema,
+    connectorInstance: connectorInstanceSchema,
+    connectorTarget: connectorTargetSchema,
+  }),
+)
+export const githubValidateTargetResponseSchema = pluginArchMutationResponseSchema(
+  "PluginArchGithubValidateTargetResponse",
+  z.object({
+    branchExists: z.boolean(),
+    defaultBranch: z.string().trim().min(1).nullable(),
+    repositoryAccessible: z.boolean(),
+  }),
+)
diff --git a/ee/apps/den-api/src/routes/org/plugin-system/store.ts b/ee/apps/den-api/src/routes/org/plugin-system/store.ts
new file mode 100644
index 0000000000..bd9f1ec841
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/plugin-system/store.ts
@@ -0,0 +1,3780 @@
+import { and, asc, desc, eq, inArray, isNull } from "@openwork-ee/den-db/drizzle"
+import {
+  ConfigObjectAccessGrantTable,
+  ConfigObjectTable,
+  ConfigObjectVersionTable,
+  ConnectorAccountTable,
+  ConnectorInstanceAccessGrantTable,
+  ConnectorInstanceTable,
+  ConnectorMappingTable,
+  ConnectorSourceBindingTable,
+  ConnectorSourceTombstoneTable,
+  ConnectorSyncEventTable,
+  ConnectorTargetTable,
+  MarketplaceAccessGrantTable,
+  MarketplacePluginTable,
+  MarketplaceTable,
+  MemberTable,
+  OrganizationTable,
+  PluginAccessGrantTable,
+  PluginConfigObjectTable,
+  PluginTable,
+} from "@openwork-ee/den-db/schema"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import type { PluginArchActorContext, PluginArchResourceKind, PluginArchRole } from "./access.js"
+import { requirePluginArchResourceRole, resolvePluginArchResourceRole } from "./access.js"
+import {
+  buildGithubAppInstallUrl,
+  createGithubInstallStateToken,
+  GithubConnectorConfigError,
+  GithubConnectorRequestError,
+  getGithubAppSummary,
+  getGithubConnectorAppConfig,
+  getGithubInstallationAccessToken,
+  getGithubRepositoryTextFile,
+  getGithubRepositoryTree,
+  getGithubInstallationSummary,
+  listGithubInstallationRepositories,
+  validateGithubInstallationTarget,
+  verifyGithubInstallStateToken,
+} from "./github-app.js"
+import {
+  buildGithubRepoDiscovery,
+  type GithubDiscoveredPlugin,
+  type GithubDiscoveryClassification,
+  type GithubMarketplaceInfo,
+  type GithubDiscoveryTreeEntry,
+} from "./github-discovery.js"
+import { planConnectorImportedResourceCleanup, uniqueIds } from "./connector-cleanup.js"
+import { db } from "../../../db.js"
+import { env } from "../../../env.js"
+import { roleIncludesOwner } from "../../../orgs.js"
+
+type OrganizationId = PluginArchActorContext["organizationContext"]["organization"]["id"]
+type MemberId = PluginArchActorContext["organizationContext"]["currentMember"]["id"]
+type TeamId = PluginArchActorContext["memberTeams"][number]["id"]
+type ConfigObjectRow = typeof ConfigObjectTable.$inferSelect
+type ConfigObjectVersionRow = typeof ConfigObjectVersionTable.$inferSelect
+type MarketplaceRow = typeof MarketplaceTable.$inferSelect
+type MarketplaceMembershipRow = typeof MarketplacePluginTable.$inferSelect
+type PluginRow = typeof PluginTable.$inferSelect
+type PluginMembershipRow = typeof PluginConfigObjectTable.$inferSelect
+type ConfigObjectId = ConfigObjectRow["id"]
+type ConfigObjectVersionId = ConfigObjectVersionRow["id"]
+type MarketplaceId = MarketplaceRow["id"]
+type MarketplaceMembershipId = MarketplaceMembershipRow["id"]
+type PluginId = PluginRow["id"]
+type PluginMembershipId = PluginMembershipRow["id"]
+type AccessGrantRow =
+  | typeof ConfigObjectAccessGrantTable.$inferSelect
+  | typeof MarketplaceAccessGrantTable.$inferSelect
+  | typeof PluginAccessGrantTable.$inferSelect
+  | typeof ConnectorInstanceAccessGrantTable.$inferSelect
+type ConfigObjectAccessGrantId = typeof ConfigObjectAccessGrantTable.$inferSelect.id
+type MarketplaceAccessGrantId = typeof MarketplaceAccessGrantTable.$inferSelect.id
+type PluginAccessGrantId = typeof PluginAccessGrantTable.$inferSelect.id
+type ConnectorInstanceAccessGrantId = typeof ConnectorInstanceAccessGrantTable.$inferSelect.id
+type ConnectorAccountRow = typeof ConnectorAccountTable.$inferSelect
+type ConnectorInstanceRow = typeof ConnectorInstanceTable.$inferSelect
+type ConnectorTargetRow = typeof ConnectorTargetTable.$inferSelect
+type ConnectorMappingRow = typeof ConnectorMappingTable.$inferSelect
+type ConnectorSyncEventRow = typeof ConnectorSyncEventTable.$inferSelect
+type ConnectorAccountId = ConnectorAccountRow["id"]
+type ConnectorInstanceId = ConnectorInstanceRow["id"]
+type ConnectorTargetId = ConnectorTargetRow["id"]
+type ConnectorMappingId = ConnectorMappingRow["id"]
+type ConnectorSyncEventId = ConnectorSyncEventRow["id"]
+type MemberRow = typeof MemberTable.$inferSelect
+type OrganizationRow = typeof OrganizationTable.$inferSelect
+type DbTransaction = Parameters<Parameters<typeof db.transaction>[0]>[0]
+
+type CursorPage<TItem extends { id: string }> = {
+  items: TItem[]
+  nextCursor: string | null
+}
+
+type GithubConnectorDiscoveryStep = {
+  id: "read_repository_structure" | "check_marketplace_manifest" | "check_plugin_manifests" | "prepare_discovered_plugins"
+  label: string
+  status: "completed" | "running" | "warning"
+}
+
+type GithubConnectorDiscoveryTreeSummary = {
+  scannedEntryCount: number
+  strategy: "git-tree-recursive"
+  truncated: boolean
+}
+
+type GithubDiscoveryImportPlan = {
+  objectType: ConnectorMappingRow["objectType"]
+  paths: string[]
+  selector: string
+}
+
+type GithubDiscoveryCacheEntry = {
+  branch: string
+  classification: GithubDiscoveryClassification
+  discoveredPlugins: GithubDiscoveredPlugin[]
+  importPlansByPluginKey: Record<string, GithubDiscoveryImportPlan[]>
+  marketplace: GithubMarketplaceInfo | null
+  ref: string
+  repositoryFullName: string
+  sourceRevisionRef: string
+  treeSummary: GithubConnectorDiscoveryTreeSummary
+  warnings: string[]
+}
+
+type GithubConnectorDiscoveryComputation = GithubDiscoveryCacheEntry & {
+  connectorInstance: ReturnType<typeof serializeConnectorInstance>
+  connectorTarget: ReturnType<typeof serializeConnectorTarget>
+  treeEntries: GithubDiscoveryTreeEntry[]
+}
+
+type GithubDiscoverySnapshot = GithubDiscoveryCacheEntry & {
+  treeEntries: GithubDiscoveryTreeEntry[]
+}
+
+type ConfigObjectInput = {
+  metadata?: Record<string, unknown>
+  normalizedPayloadJson?: Record<string, unknown>
+  parserMode?: string
+  rawSourceText?: string
+  schemaVersion?: string
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+type AccessGrantWrite = {
+  orgMembershipId?: MemberId
+  orgWide?: boolean
+  role: PluginArchRole
+  teamId?: TeamId
+}
+
+type RepositorySummary = {
+  defaultBranch: string | null
+  fullName: string
+  hasPluginManifest?: boolean
+  id: number
+  manifestKind?: "marketplace" | "plugin" | null
+  marketplacePluginCount?: number | null
+  private: boolean
+}
+
+type ConfigObjectResourceTarget = {
+  resourceId: ConfigObjectId
+  resourceKind: "config_object"
+}
+
+type PluginResourceTarget = {
+  resourceId: PluginId
+  resourceKind: "plugin"
+}
+
+type MarketplaceResourceTarget = {
+  resourceId: MarketplaceId
+  resourceKind: "marketplace"
+}
+
+type ConnectorInstanceResourceTarget = {
+  resourceId: ConnectorInstanceId
+  resourceKind: "connector_instance"
+}
+
+type ResourceTarget =
+  | ConfigObjectResourceTarget
+  | MarketplaceResourceTarget
+  | PluginResourceTarget
+  | ConnectorInstanceResourceTarget
+
+type ConfigObjectGrantTarget = ConfigObjectResourceTarget & { grantId: ConfigObjectAccessGrantId }
+type MarketplaceGrantTarget = MarketplaceResourceTarget & { grantId: MarketplaceAccessGrantId }
+type PluginGrantTarget = PluginResourceTarget & { grantId: PluginAccessGrantId }
+type ConnectorInstanceGrantTarget = ConnectorInstanceResourceTarget & { grantId: ConnectorInstanceAccessGrantId }
+type GrantTarget = ConfigObjectGrantTarget | MarketplaceGrantTarget | PluginGrantTarget | ConnectorInstanceGrantTarget
+
+export class PluginArchRouteFailure extends Error {
+  constructor(
+    readonly status: 400 | 404 | 409,
+    readonly error: string,
+    message: string,
+  ) {
+    super(message)
+    this.name = "PluginArchRouteFailure"
+  }
+}
+
+function normalizeOptionalString(value: string | null | undefined) {
+  const trimmed = value?.trim()
+  return trimmed ? trimmed : null
+}
+
+function firstTextLine(value: string) {
+  return value
+    .split(/\r?\n/g)
+    .map((line) => line.trim())
+    .filter(Boolean)[0] ?? ""
+}
+
+function stripLineDecorators(value: string) {
+  return value
+    .replace(/^#{1,6}\s+/, "")
+    .replace(/^[-*+]\s+/, "")
+    .replace(/^title\s*:\s*/i, "")
+    .replace(/^description\s*:\s*/i, "")
+    .trim()
+}
+
+function deriveProjection(input: { objectType: ConfigObjectRow["objectType"]; value: ConfigObjectInput }) {
+  const metadata = input.value.metadata ?? {}
+  const payload = input.value.normalizedPayloadJson ?? {}
+  const rawSourceText = normalizeOptionalString(input.value.rawSourceText)
+  const titleCandidate = [
+    typeof metadata.title === "string" ? metadata.title : null,
+    typeof metadata.name === "string" ? metadata.name : null,
+    typeof payload.title === "string" ? payload.title : null,
+    typeof payload.name === "string" ? payload.name : null,
+    rawSourceText ? stripLineDecorators(firstTextLine(rawSourceText)) : null,
+  ].find((value) => Boolean(normalizeOptionalString(value ?? undefined)))
+
+  const descriptionCandidate = [
+    typeof metadata.description === "string" ? metadata.description : null,
+    typeof payload.description === "string" ? payload.description : null,
+    rawSourceText
+      ? rawSourceText
+        .split(/\r?\n/g)
+        .map((line) => stripLineDecorators(line.trim()))
+        .filter(Boolean)
+        .slice(1)
+        .find(Boolean) ?? null
+      : null,
+  ].find((value) => Boolean(normalizeOptionalString(value ?? undefined)))
+
+  const title = normalizeOptionalString(titleCandidate ?? undefined)
+    ?? `${input.objectType.charAt(0).toUpperCase()}${input.objectType.slice(1)} ${new Date().toISOString()}`
+
+  const description = normalizeOptionalString(descriptionCandidate ?? undefined)
+  const searchText = [title, description, rawSourceText].filter(Boolean).join("\n") || null
+
+  return {
+    description,
+    searchText,
+    title,
+  }
+}
+
+function pageItems<TItem extends { id: string }>(items: TItem[], cursor: string | undefined, limit: number | undefined): CursorPage<TItem> {
+  const ordered = [...items]
+  const pageSize = limit ?? 50
+  const startIndex = cursor ? Math.max(ordered.findIndex((item) => item.id === cursor) + 1, 0) : 0
+  const sliced = ordered.slice(startIndex, startIndex + pageSize)
+  const nextCursor = ordered.length > startIndex + pageSize ? sliced[sliced.length - 1]?.id ?? null : null
+  return { items: sliced, nextCursor }
+}
+
+async function getLatestVersions(configObjectIds: ConfigObjectId[]) {
+  if (configObjectIds.length === 0) {
+    return new Map<string, ConfigObjectVersionRow>()
+  }
+
+  const rows = await db
+    .select()
+    .from(ConfigObjectVersionTable)
+    .where(inArray(ConfigObjectVersionTable.configObjectId, configObjectIds))
+    .orderBy(desc(ConfigObjectVersionTable.createdAt), desc(ConfigObjectVersionTable.id))
+
+  const latestByObjectId = new Map<string, ConfigObjectVersionRow>()
+  for (const row of rows) {
+    if (!latestByObjectId.has(row.configObjectId)) {
+      latestByObjectId.set(row.configObjectId, row)
+    }
+  }
+
+  return latestByObjectId
+}
+
+function serializeVersion(row: ConfigObjectVersionRow) {
+  return {
+    configObjectId: row.configObjectId,
+    connectorSyncEventId: row.connectorSyncEventId,
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    createdVia: row.createdVia,
+    id: row.id,
+    isDeletedVersion: row.isDeletedVersion,
+    normalizedPayloadJson: row.normalizedPayloadJson,
+    rawSourceText: row.rawSourceText,
+    schemaVersion: row.schemaVersion,
+    sourceRevisionRef: row.sourceRevisionRef,
+  }
+}
+
+function serializeConfigObject(row: ConfigObjectRow, latestVersion: ConfigObjectVersionRow | null) {
+  return {
+    connectorInstanceId: row.connectorInstanceId,
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    currentFileExtension: row.currentFileExtension,
+    currentFileName: row.currentFileName,
+    currentRelativePath: row.currentRelativePath,
+    deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
+    description: row.description,
+    id: row.id,
+    latestVersion: latestVersion ? serializeVersion(latestVersion) : null,
+    objectType: row.objectType,
+    organizationId: row.organizationId,
+    searchText: row.searchText,
+    sourceMode: row.sourceMode,
+    status: row.status,
+    title: row.title,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+type PluginMarketplaceSummary = {
+  id: string
+  name: string
+}
+
+function serializePlugin(row: PluginRow, memberCount?: number, marketplaces: PluginMarketplaceSummary[] = []) {
+  return {
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
+    description: row.description,
+    id: row.id,
+    marketplaces,
+    memberCount,
+    name: row.name,
+    organizationId: row.organizationId,
+    status: row.status,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function serializeMarketplace(row: MarketplaceRow, pluginCount?: number) {
+  return {
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
+    description: row.description,
+    id: row.id,
+    name: row.name,
+    organizationId: row.organizationId,
+    pluginCount,
+    status: row.status,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function serializeMembership(row: PluginMembershipRow, configObject?: ReturnType<typeof serializeConfigObject>) {
+  return {
+    configObject,
+    configObjectId: row.configObjectId,
+    connectorMappingId: row.connectorMappingId,
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    id: row.id,
+    membershipSource: row.membershipSource,
+    pluginId: row.pluginId,
+    removedAt: row.removedAt ? row.removedAt.toISOString() : null,
+  }
+}
+
+function serializeMarketplaceMembership(row: MarketplaceMembershipRow, plugin?: ReturnType<typeof serializePlugin>) {
+  return {
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    id: row.id,
+    marketplaceId: row.marketplaceId,
+    membershipSource: row.membershipSource,
+    plugin,
+    pluginId: row.pluginId,
+    removedAt: row.removedAt ? row.removedAt.toISOString() : null,
+  }
+}
+
+function serializeAccessGrant(row: AccessGrantRow) {
+  return {
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    id: row.id,
+    orgMembershipId: row.orgMembershipId,
+    orgWide: row.orgWide,
+    removedAt: row.removedAt ? row.removedAt.toISOString() : null,
+    role: row.role,
+    teamId: row.teamId,
+  }
+}
+
+function serializeConnectorAccount(row: ConnectorAccountRow, creatorName: string | null = null) {
+  return {
+    connectorType: row.connectorType,
+    createdAt: row.createdAt.toISOString(),
+    createdByName: creatorName,
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    displayName: row.displayName,
+    externalAccountRef: row.externalAccountRef,
+    id: row.id,
+    metadata: row.metadataJson ?? undefined,
+    organizationId: row.organizationId,
+    remoteId: row.remoteId,
+    status: row.status,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function resolveCreatorName(context: PluginArchActorContext, memberId: string) {
+  const member = context.organizationContext.members.find((entry) => entry.id === memberId)
+  if (!member) return null
+  return member.user.name?.trim() || member.user.email || null
+}
+
+function serializeConnectorInstance(row: ConnectorInstanceRow) {
+  return {
+    connectorAccountId: row.connectorAccountId,
+    connectorType: row.connectorType,
+    createdAt: row.createdAt.toISOString(),
+    createdByOrgMembershipId: row.createdByOrgMembershipId,
+    id: row.id,
+    instanceConfigJson: row.instanceConfigJson,
+    lastSyncCursor: row.lastSyncCursor,
+    lastSyncStatus: row.lastSyncStatus,
+    lastSyncedAt: row.lastSyncedAt ? row.lastSyncedAt.toISOString() : null,
+    name: row.name,
+    organizationId: row.organizationId,
+    remoteId: row.remoteId,
+    status: row.status,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function serializeConnectorTarget(row: ConnectorTargetRow) {
+  return {
+    connectorInstanceId: row.connectorInstanceId,
+    connectorType: row.connectorType,
+    createdAt: row.createdAt.toISOString(),
+    externalTargetRef: row.externalTargetRef,
+    id: row.id,
+    remoteId: row.remoteId,
+    targetConfigJson: row.targetConfigJson,
+    targetKind: row.targetKind,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function serializeConnectorMapping(row: ConnectorMappingRow) {
+  return {
+    autoAddToPlugin: row.autoAddToPlugin,
+    connectorInstanceId: row.connectorInstanceId,
+    connectorTargetId: row.connectorTargetId,
+    connectorType: row.connectorType,
+    createdAt: row.createdAt.toISOString(),
+    id: row.id,
+    mappingConfigJson: row.mappingConfigJson,
+    mappingKind: row.mappingKind,
+    objectType: row.objectType,
+    pluginId: row.pluginId,
+    remoteId: row.remoteId,
+    selector: row.selector,
+    updatedAt: row.updatedAt.toISOString(),
+  }
+}
+
+function serializeConnectorSyncEvent(row: ConnectorSyncEventRow) {
+  return {
+    completedAt: row.completedAt ? row.completedAt.toISOString() : null,
+    connectorInstanceId: row.connectorInstanceId,
+    connectorTargetId: row.connectorTargetId,
+    connectorType: row.connectorType,
+    eventType: row.eventType,
+    externalEventRef: row.externalEventRef,
+    id: row.id,
+    remoteId: row.remoteId,
+    sourceRevisionRef: row.sourceRevisionRef,
+    startedAt: row.startedAt.toISOString(),
+    status: row.status,
+    summaryJson: row.summaryJson,
+  }
+}
+
+async function getConfigObjectRow(organizationId: OrganizationId, configObjectId: ConfigObjectId) {
+  const rows = await db
+    .select()
+    .from(ConfigObjectTable)
+    .where(and(eq(ConfigObjectTable.organizationId, organizationId), eq(ConfigObjectTable.id, configObjectId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function getPluginRow(organizationId: OrganizationId, pluginId: PluginId) {
+  const rows = await db
+    .select()
+    .from(PluginTable)
+    .where(and(eq(PluginTable.organizationId, organizationId), eq(PluginTable.id, pluginId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function getMarketplaceRow(organizationId: OrganizationId, marketplaceId: MarketplaceId) {
+  const rows = await db
+    .select()
+    .from(MarketplaceTable)
+    .where(and(eq(MarketplaceTable.organizationId, organizationId), eq(MarketplaceTable.id, marketplaceId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function getConnectorAccountRow(organizationId: OrganizationId, connectorAccountId: ConnectorAccountId) {
+  const rows = await db
+    .select()
+    .from(ConnectorAccountTable)
+    .where(and(eq(ConnectorAccountTable.organizationId, organizationId), eq(ConnectorAccountTable.id, connectorAccountId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function getConnectorInstanceRow(organizationId: OrganizationId, connectorInstanceId: ConnectorInstanceId) {
+  const rows = await db
+    .select()
+    .from(ConnectorInstanceTable)
+    .where(and(eq(ConnectorInstanceTable.organizationId, organizationId), eq(ConnectorInstanceTable.id, connectorInstanceId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+async function getConnectorTargetRow(organizationId: OrganizationId, connectorTargetId: ConnectorTargetId) {
+  const rows = await db
+    .select({ target: ConnectorTargetTable, instance: ConnectorInstanceTable })
+    .from(ConnectorTargetTable)
+    .innerJoin(ConnectorInstanceTable, eq(ConnectorTargetTable.connectorInstanceId, ConnectorInstanceTable.id))
+    .where(and(eq(ConnectorTargetTable.id, connectorTargetId), eq(ConnectorInstanceTable.organizationId, organizationId)))
+    .limit(1)
+
+  return rows[0]?.target ?? null
+}
+
+async function getConnectorMappingRow(organizationId: OrganizationId, connectorMappingId: ConnectorMappingId) {
+  const rows = await db
+    .select({ mapping: ConnectorMappingTable, instance: ConnectorInstanceTable })
+    .from(ConnectorMappingTable)
+    .innerJoin(ConnectorInstanceTable, eq(ConnectorMappingTable.connectorInstanceId, ConnectorInstanceTable.id))
+    .where(and(eq(ConnectorMappingTable.id, connectorMappingId), eq(ConnectorInstanceTable.organizationId, organizationId)))
+    .limit(1)
+
+  return rows[0]?.mapping ?? null
+}
+
+async function getConnectorSyncEventRow(organizationId: OrganizationId, connectorSyncEventId: ConnectorSyncEventId) {
+  const rows = await db
+    .select({ event: ConnectorSyncEventTable, instance: ConnectorInstanceTable })
+    .from(ConnectorSyncEventTable)
+    .innerJoin(ConnectorInstanceTable, eq(ConnectorSyncEventTable.connectorInstanceId, ConnectorInstanceTable.id))
+    .where(and(eq(ConnectorSyncEventTable.id, connectorSyncEventId), eq(ConnectorInstanceTable.organizationId, organizationId)))
+    .limit(1)
+
+  return rows[0]?.event ?? null
+}
+
+async function ensureVisibleConfigObject(context: PluginArchActorContext, configObjectId: ConfigObjectId) {
+  const row = await getConfigObjectRow(context.organizationContext.organization.id, configObjectId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "config_object_not_found", "Config object not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "config_object", role: "viewer" })
+  return row
+}
+
+async function ensureEditablePlugin(context: PluginArchActorContext, pluginId: PluginId) {
+  const row = await getPluginRow(context.organizationContext.organization.id, pluginId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "plugin_not_found", "Plugin not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "plugin", role: "editor" })
+  return row
+}
+
+async function ensureEditableMarketplace(context: PluginArchActorContext, marketplaceId: MarketplaceId) {
+  const row = await getMarketplaceRow(context.organizationContext.organization.id, marketplaceId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "marketplace_not_found", "Marketplace not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "marketplace", role: "editor" })
+  return row
+}
+
+async function ensureVisibleMarketplace(context: PluginArchActorContext, marketplaceId: MarketplaceId) {
+  const row = await getMarketplaceRow(context.organizationContext.organization.id, marketplaceId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "marketplace_not_found", "Marketplace not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "marketplace", role: "viewer" })
+  return row
+}
+
+async function ensureVisiblePlugin(context: PluginArchActorContext, pluginId: PluginId) {
+  const row = await getPluginRow(context.organizationContext.organization.id, pluginId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "plugin_not_found", "Plugin not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "plugin", role: "viewer" })
+  return row
+}
+
+async function ensureVisibleConnectorInstance(context: PluginArchActorContext, connectorInstanceId: ConnectorInstanceId) {
+  const row = await getConnectorInstanceRow(context.organizationContext.organization.id, connectorInstanceId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "connector_instance_not_found", "Connector instance not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "connector_instance", role: "viewer" })
+  return row
+}
+
+async function ensureEditableConnectorInstance(context: PluginArchActorContext, connectorInstanceId: ConnectorInstanceId) {
+  const row = await getConnectorInstanceRow(context.organizationContext.organization.id, connectorInstanceId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "connector_instance_not_found", "Connector instance not found.")
+  }
+  await requirePluginArchResourceRole({ context, resourceId: row.id, resourceKind: "connector_instance", role: "editor" })
+  return row
+}
+
+async function upsertGrant(input: ResourceTarget & {
+  context: PluginArchActorContext
+  value: AccessGrantWrite
+}) {
+  const createdAt = new Date()
+  const createdByOrgMembershipId = input.context.organizationContext.currentMember.id
+  const organizationId = input.context.organizationContext.organization.id
+
+  if (input.resourceKind === "config_object") {
+    const existing = await db
+      .select()
+      .from(ConfigObjectAccessGrantTable)
+      .where(and(
+        eq(ConfigObjectAccessGrantTable.configObjectId, input.resourceId),
+        input.value.orgMembershipId
+          ? eq(ConfigObjectAccessGrantTable.orgMembershipId, input.value.orgMembershipId)
+          : input.value.teamId
+            ? eq(ConfigObjectAccessGrantTable.teamId, input.value.teamId)
+            : eq(ConfigObjectAccessGrantTable.orgWide, true),
+      ))
+      .limit(1)
+
+    if (existing[0]) {
+      await db
+        .update(ConfigObjectAccessGrantTable)
+        .set({
+          createdByOrgMembershipId,
+          orgMembershipId: input.value.orgMembershipId ?? null,
+          orgWide: input.value.orgWide ?? false,
+          removedAt: null,
+          role: input.value.role,
+          teamId: input.value.teamId ?? null,
+        })
+        .where(eq(ConfigObjectAccessGrantTable.id, existing[0].id))
+      return serializeAccessGrant({ ...existing[0], createdByOrgMembershipId, orgMembershipId: input.value.orgMembershipId ?? null, orgWide: input.value.orgWide ?? false, removedAt: null, role: input.value.role, teamId: input.value.teamId ?? null })
+    }
+
+    const row = {
+      configObjectId: input.resourceId,
+      createdAt,
+      createdByOrgMembershipId,
+      id: createDenTypeId("configObjectAccessGrant"),
+      organizationId,
+      orgMembershipId: input.value.orgMembershipId ?? null,
+      orgWide: input.value.orgWide ?? false,
+      role: input.value.role,
+      teamId: input.value.teamId ?? null,
+    }
+    await db.insert(ConfigObjectAccessGrantTable).values(row)
+    return serializeAccessGrant({ ...row, removedAt: null })
+  }
+
+  if (input.resourceKind === "marketplace") {
+    const existing = await db
+      .select()
+      .from(MarketplaceAccessGrantTable)
+      .where(and(
+        eq(MarketplaceAccessGrantTable.marketplaceId, input.resourceId),
+        input.value.orgMembershipId
+          ? eq(MarketplaceAccessGrantTable.orgMembershipId, input.value.orgMembershipId)
+          : input.value.teamId
+            ? eq(MarketplaceAccessGrantTable.teamId, input.value.teamId)
+            : eq(MarketplaceAccessGrantTable.orgWide, true),
+      ))
+      .limit(1)
+
+    if (existing[0]) {
+      await db
+        .update(MarketplaceAccessGrantTable)
+        .set({
+          createdByOrgMembershipId,
+          orgMembershipId: input.value.orgMembershipId ?? null,
+          orgWide: input.value.orgWide ?? false,
+          removedAt: null,
+          role: input.value.role,
+          teamId: input.value.teamId ?? null,
+        })
+        .where(eq(MarketplaceAccessGrantTable.id, existing[0].id))
+      return serializeAccessGrant({ ...existing[0], createdByOrgMembershipId, orgMembershipId: input.value.orgMembershipId ?? null, orgWide: input.value.orgWide ?? false, removedAt: null, role: input.value.role, teamId: input.value.teamId ?? null })
+    }
+
+    const row = {
+      createdAt,
+      createdByOrgMembershipId,
+      id: createDenTypeId("marketplaceAccessGrant"),
+      marketplaceId: input.resourceId,
+      organizationId,
+      orgMembershipId: input.value.orgMembershipId ?? null,
+      orgWide: input.value.orgWide ?? false,
+      role: input.value.role,
+      teamId: input.value.teamId ?? null,
+    }
+    await db.insert(MarketplaceAccessGrantTable).values(row)
+    return serializeAccessGrant({ ...row, removedAt: null })
+  }
+
+  if (input.resourceKind === "plugin") {
+    const existing = await db
+      .select()
+      .from(PluginAccessGrantTable)
+      .where(and(
+        eq(PluginAccessGrantTable.pluginId, input.resourceId),
+        input.value.orgMembershipId
+          ? eq(PluginAccessGrantTable.orgMembershipId, input.value.orgMembershipId)
+          : input.value.teamId
+            ? eq(PluginAccessGrantTable.teamId, input.value.teamId)
+            : eq(PluginAccessGrantTable.orgWide, true),
+      ))
+      .limit(1)
+
+    if (existing[0]) {
+      await db
+        .update(PluginAccessGrantTable)
+        .set({
+          createdByOrgMembershipId,
+          orgMembershipId: input.value.orgMembershipId ?? null,
+          orgWide: input.value.orgWide ?? false,
+          removedAt: null,
+          role: input.value.role,
+          teamId: input.value.teamId ?? null,
+        })
+        .where(eq(PluginAccessGrantTable.id, existing[0].id))
+      return serializeAccessGrant({ ...existing[0], createdByOrgMembershipId, orgMembershipId: input.value.orgMembershipId ?? null, orgWide: input.value.orgWide ?? false, removedAt: null, role: input.value.role, teamId: input.value.teamId ?? null })
+    }
+
+    const row = {
+      createdAt,
+      createdByOrgMembershipId,
+      id: createDenTypeId("pluginAccessGrant"),
+      organizationId,
+      orgMembershipId: input.value.orgMembershipId ?? null,
+      orgWide: input.value.orgWide ?? false,
+      pluginId: input.resourceId,
+      role: input.value.role,
+      teamId: input.value.teamId ?? null,
+    }
+    await db.insert(PluginAccessGrantTable).values(row)
+    return serializeAccessGrant({ ...row, removedAt: null })
+  }
+
+  const existing = await db
+    .select()
+    .from(ConnectorInstanceAccessGrantTable)
+    .where(and(
+      eq(ConnectorInstanceAccessGrantTable.connectorInstanceId, input.resourceId),
+      input.value.orgMembershipId
+        ? eq(ConnectorInstanceAccessGrantTable.orgMembershipId, input.value.orgMembershipId)
+        : input.value.teamId
+          ? eq(ConnectorInstanceAccessGrantTable.teamId, input.value.teamId)
+          : eq(ConnectorInstanceAccessGrantTable.orgWide, true),
+    ))
+    .limit(1)
+
+  if (existing[0]) {
+    await db
+      .update(ConnectorInstanceAccessGrantTable)
+      .set({
+        createdByOrgMembershipId,
+        orgMembershipId: input.value.orgMembershipId ?? null,
+        orgWide: input.value.orgWide ?? false,
+        removedAt: null,
+        role: input.value.role,
+        teamId: input.value.teamId ?? null,
+      })
+      .where(eq(ConnectorInstanceAccessGrantTable.id, existing[0].id))
+    return serializeAccessGrant({ ...existing[0], createdByOrgMembershipId, orgMembershipId: input.value.orgMembershipId ?? null, orgWide: input.value.orgWide ?? false, removedAt: null, role: input.value.role, teamId: input.value.teamId ?? null })
+  }
+
+  const row = {
+    connectorInstanceId: input.resourceId,
+    createdAt,
+    createdByOrgMembershipId,
+    id: createDenTypeId("connectorInstanceAccessGrant"),
+    organizationId,
+    orgMembershipId: input.value.orgMembershipId ?? null,
+    orgWide: input.value.orgWide ?? false,
+    role: input.value.role,
+    teamId: input.value.teamId ?? null,
+  }
+  await db.insert(ConnectorInstanceAccessGrantTable).values(row)
+  return serializeAccessGrant({ ...row, removedAt: null })
+}
+
+async function removeGrant(input: GrantTarget & { context: PluginArchActorContext }) {
+  const removedAt = new Date()
+  if (input.resourceKind === "config_object") {
+    const rows = await db
+      .select()
+      .from(ConfigObjectAccessGrantTable)
+      .where(and(eq(ConfigObjectAccessGrantTable.id, input.grantId), eq(ConfigObjectAccessGrantTable.configObjectId, input.resourceId)))
+      .limit(1)
+    if (!rows[0]) throw new PluginArchRouteFailure(404, "access_grant_not_found", "Access grant not found.")
+    await db.update(ConfigObjectAccessGrantTable).set({ removedAt }).where(eq(ConfigObjectAccessGrantTable.id, input.grantId))
+    return
+  }
+  if (input.resourceKind === "marketplace") {
+    const rows = await db
+      .select()
+      .from(MarketplaceAccessGrantTable)
+      .where(and(eq(MarketplaceAccessGrantTable.id, input.grantId), eq(MarketplaceAccessGrantTable.marketplaceId, input.resourceId)))
+      .limit(1)
+    if (!rows[0]) throw new PluginArchRouteFailure(404, "access_grant_not_found", "Access grant not found.")
+    await db.update(MarketplaceAccessGrantTable).set({ removedAt }).where(eq(MarketplaceAccessGrantTable.id, input.grantId))
+    return
+  }
+  if (input.resourceKind === "plugin") {
+    const rows = await db
+      .select()
+      .from(PluginAccessGrantTable)
+      .where(and(eq(PluginAccessGrantTable.id, input.grantId), eq(PluginAccessGrantTable.pluginId, input.resourceId)))
+      .limit(1)
+    if (!rows[0]) throw new PluginArchRouteFailure(404, "access_grant_not_found", "Access grant not found.")
+    await db.update(PluginAccessGrantTable).set({ removedAt }).where(eq(PluginAccessGrantTable.id, input.grantId))
+    return
+  }
+  const rows = await db
+    .select()
+    .from(ConnectorInstanceAccessGrantTable)
+    .where(and(eq(ConnectorInstanceAccessGrantTable.id, input.grantId), eq(ConnectorInstanceAccessGrantTable.connectorInstanceId, input.resourceId)))
+    .limit(1)
+  if (!rows[0]) throw new PluginArchRouteFailure(404, "access_grant_not_found", "Access grant not found.")
+  await db.update(ConnectorInstanceAccessGrantTable).set({ removedAt }).where(eq(ConnectorInstanceAccessGrantTable.id, input.grantId))
+}
+
+export async function listConfigObjects(input: {
+  connectorInstanceId?: ConnectorInstanceId
+  context: PluginArchActorContext
+  cursor?: string
+  includeDeleted?: boolean
+  limit?: number
+  pluginId?: PluginId
+  q?: string
+  sourceMode?: ConfigObjectRow["sourceMode"]
+  status?: ConfigObjectRow["status"]
+  type?: ConfigObjectRow["objectType"]
+}) {
+  const organizationId = input.context.organizationContext.organization.id
+  const rows = await db
+    .select()
+    .from(ConfigObjectTable)
+    .where(eq(ConfigObjectTable.organizationId, organizationId))
+    .orderBy(desc(ConfigObjectTable.updatedAt), desc(ConfigObjectTable.id))
+
+  const latestVersions = await getLatestVersions(rows.map((row) => row.id))
+  const filtered: ReturnType<typeof serializeConfigObject>[] = []
+
+  for (const row of rows) {
+    const role = await resolvePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "config_object" })
+    if (!role) continue
+    if (input.type && row.objectType !== input.type) continue
+    if (input.status && row.status !== input.status) continue
+    if (input.sourceMode && row.sourceMode !== input.sourceMode) continue
+    if (!input.includeDeleted && row.status === "deleted") continue
+    if (input.connectorInstanceId && row.connectorInstanceId !== input.connectorInstanceId) continue
+    if (input.q) {
+      const haystack = `${row.title}\n${row.description ?? ""}\n${row.searchText ?? ""}`.toLowerCase()
+      if (!haystack.includes(input.q.toLowerCase())) continue
+    }
+    if (input.pluginId) {
+      const memberships = await db
+        .select({ id: PluginConfigObjectTable.id })
+        .from(PluginConfigObjectTable)
+        .where(and(eq(PluginConfigObjectTable.pluginId, input.pluginId), eq(PluginConfigObjectTable.configObjectId, row.id), isNull(PluginConfigObjectTable.removedAt)))
+        .limit(1)
+      if (!memberships[0]) continue
+    }
+    filtered.push(serializeConfigObject(row, latestVersions.get(row.id) ?? null))
+  }
+
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function getConfigObjectDetail(context: PluginArchActorContext, configObjectId: ConfigObjectId) {
+  const row = await ensureVisibleConfigObject(context, configObjectId)
+  const latest = await getLatestVersions([row.id])
+  return serializeConfigObject(row, latest.get(row.id) ?? null)
+}
+
+export async function createConfigObject(input: {
+  context: PluginArchActorContext
+  objectType: ConfigObjectRow["objectType"]
+  pluginIds?: PluginId[]
+  sourceMode: ConfigObjectRow["sourceMode"]
+  value: ConfigObjectInput
+}) {
+  if (input.sourceMode === "connector") {
+    throw new PluginArchRouteFailure(400, "invalid_request", "Connector-managed config objects must be created through connector sync.")
+  }
+
+  for (const pluginId of input.pluginIds ?? []) {
+    await requirePluginArchResourceRole({ context: input.context, resourceId: pluginId, resourceKind: "plugin", role: "editor" })
+  }
+
+  const now = new Date()
+  const projection = deriveProjection({ objectType: input.objectType, value: input.value })
+  const organizationId = input.context.organizationContext.organization.id
+  const createdByOrgMembershipId = input.context.organizationContext.currentMember.id
+  const configObjectId = createDenTypeId("configObject")
+  const versionId = createDenTypeId("configObjectVersion")
+
+  await db.transaction(async (tx) => {
+    await tx.insert(ConfigObjectTable).values({
+      createdAt: now,
+      createdByOrgMembershipId,
+      currentFileExtension: null,
+      currentFileName: null,
+      currentRelativePath: null,
+      deletedAt: null,
+      description: projection.description,
+      id: configObjectId,
+      objectType: input.objectType,
+      organizationId,
+      searchText: projection.searchText,
+      sourceMode: input.sourceMode,
+      status: "active",
+      title: projection.title,
+      updatedAt: now,
+      connectorInstanceId: null,
+    })
+
+      await tx.insert(ConfigObjectVersionTable).values({
+        configObjectId,
+        connectorSyncEventId: null,
+        createdAt: now,
+        createdByOrgMembershipId,
+        createdVia: input.sourceMode,
+        id: versionId,
+        isDeletedVersion: false,
+        normalizedPayloadJson: input.value.normalizedPayloadJson ?? null,
+        organizationId,
+        rawSourceText: normalizeOptionalString(input.value.rawSourceText),
+      schemaVersion: normalizeOptionalString(input.value.schemaVersion),
+      sourceRevisionRef: null,
+    })
+
+      await tx.insert(ConfigObjectAccessGrantTable).values({
+        configObjectId,
+        createdAt: now,
+        createdByOrgMembershipId,
+        id: createDenTypeId("configObjectAccessGrant"),
+        organizationId,
+        orgMembershipId: createdByOrgMembershipId,
+      orgWide: false,
+      role: "manager",
+      teamId: null,
+    })
+
+    for (const pluginId of input.pluginIds ?? []) {
+      const existing = await tx
+        .select({ id: PluginConfigObjectTable.id })
+        .from(PluginConfigObjectTable)
+        .where(and(eq(PluginConfigObjectTable.pluginId, pluginId), eq(PluginConfigObjectTable.configObjectId, configObjectId)))
+        .limit(1)
+
+      if (existing[0]) {
+        await tx.update(PluginConfigObjectTable).set({ removedAt: null }).where(eq(PluginConfigObjectTable.id, existing[0].id))
+      } else {
+        await tx.insert(PluginConfigObjectTable).values({
+          configObjectId,
+          connectorMappingId: null,
+          createdAt: now,
+          createdByOrgMembershipId,
+          id: createDenTypeId("pluginConfigObject"),
+          membershipSource: "manual",
+          organizationId,
+          pluginId,
+        })
+      }
+    }
+  })
+
+  return getConfigObjectDetail(input.context, configObjectId)
+}
+
+export async function listConfigObjectVersions(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; cursor?: string; includeDeleted?: boolean; limit?: number }) {
+  const configObject = await ensureVisibleConfigObject(input.context, input.configObjectId)
+  const rows = await db
+    .select()
+    .from(ConfigObjectVersionTable)
+    .where(eq(ConfigObjectVersionTable.configObjectId, configObject.id))
+    .orderBy(desc(ConfigObjectVersionTable.createdAt), desc(ConfigObjectVersionTable.id))
+
+  const items = rows
+    .filter((row) => input.includeDeleted || !row.isDeletedVersion)
+    .map((row) => ({ ...serializeVersion(row), id: row.id }))
+
+  return pageItems(items, input.cursor, input.limit)
+}
+
+export async function getConfigObjectVersion(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; versionId: ConfigObjectVersionId }) {
+  await ensureVisibleConfigObject(input.context, input.configObjectId)
+  const rows = await db
+    .select()
+    .from(ConfigObjectVersionTable)
+    .where(and(eq(ConfigObjectVersionTable.id, input.versionId), eq(ConfigObjectVersionTable.configObjectId, input.configObjectId)))
+    .limit(1)
+  if (!rows[0]) {
+    throw new PluginArchRouteFailure(404, "config_object_version_not_found", "Config object version not found.")
+  }
+  return serializeVersion(rows[0])
+}
+
+export async function getLatestConfigObjectVersion(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId }) {
+  await ensureVisibleConfigObject(input.context, input.configObjectId)
+  const rows = await db
+    .select()
+    .from(ConfigObjectVersionTable)
+    .where(eq(ConfigObjectVersionTable.configObjectId, input.configObjectId))
+    .orderBy(desc(ConfigObjectVersionTable.createdAt), desc(ConfigObjectVersionTable.id))
+    .limit(1)
+  if (!rows[0]) {
+    throw new PluginArchRouteFailure(404, "config_object_version_not_found", "Config object version not found.")
+  }
+  return serializeVersion(rows[0])
+}
+
+export async function createConfigObjectVersion(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; reason?: string; value: ConfigObjectInput }) {
+  const row = await getConfigObjectRow(input.context.organizationContext.organization.id, input.configObjectId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "config_object_not_found", "Config object not found.")
+  }
+  await requirePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "config_object", role: "editor" })
+
+  const now = new Date()
+  const projection = deriveProjection({ objectType: row.objectType, value: input.value })
+  await db.transaction(async (tx) => {
+    await tx.insert(ConfigObjectVersionTable).values({
+      configObjectId: row.id,
+      connectorSyncEventId: null,
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      createdVia: row.sourceMode === "connector" ? "connector" : row.sourceMode,
+      id: createDenTypeId("configObjectVersion"),
+      isDeletedVersion: false,
+      normalizedPayloadJson: input.value.normalizedPayloadJson ?? null,
+      organizationId: row.organizationId,
+      rawSourceText: normalizeOptionalString(input.value.rawSourceText),
+      schemaVersion: normalizeOptionalString(input.value.schemaVersion),
+      sourceRevisionRef: normalizeOptionalString(input.reason),
+    })
+
+    await tx.update(ConfigObjectTable).set({
+      description: projection.description,
+      searchText: projection.searchText,
+      title: projection.title,
+      updatedAt: now,
+    }).where(eq(ConfigObjectTable.id, row.id))
+  })
+
+  return getConfigObjectDetail(input.context, row.id)
+}
+
+export async function setConfigObjectLifecycle(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; action: "archive" | "delete" | "restore" }) {
+  const row = await getConfigObjectRow(input.context.organizationContext.organization.id, input.configObjectId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "config_object_not_found", "Config object not found.")
+  }
+  await requirePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "config_object", role: "manager" })
+  const now = new Date()
+  const patch = input.action === "archive"
+    ? { deletedAt: null, status: "archived" as const, updatedAt: now }
+    : input.action === "delete"
+      ? { deletedAt: now, status: "deleted" as const, updatedAt: now }
+      : { deletedAt: null, status: "active" as const, updatedAt: now }
+
+  await db.update(ConfigObjectTable).set(patch).where(eq(ConfigObjectTable.id, row.id))
+  return getConfigObjectDetail(input.context, row.id)
+}
+
+export async function listConfigObjectPlugins(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId }) {
+  const configObject = await ensureVisibleConfigObject(input.context, input.configObjectId)
+  const latest = await getLatestVersions([configObject.id])
+  const memberships = await db
+    .select()
+    .from(PluginConfigObjectTable)
+    .where(eq(PluginConfigObjectTable.configObjectId, configObject.id))
+    .orderBy(desc(PluginConfigObjectTable.createdAt))
+
+  const serializedConfigObject = serializeConfigObject(configObject, latest.get(configObject.id) ?? null)
+  const visible: ReturnType<typeof serializeMembership>[] = []
+  for (const membership of memberships) {
+    const pluginRole = await resolvePluginArchResourceRole({ context: input.context, resourceId: membership.pluginId, resourceKind: "plugin" })
+    if (!pluginRole) continue
+    visible.push(serializeMembership(membership, serializedConfigObject))
+  }
+  return { items: visible, nextCursor: null }
+}
+
+export async function attachConfigObjectToPlugin(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; membershipSource?: PluginMembershipRow["membershipSource"]; pluginId: PluginId }) {
+  await ensureVisibleConfigObject(input.context, input.configObjectId)
+  await ensureEditablePlugin(input.context, input.pluginId)
+
+  const existing = await db
+    .select()
+    .from(PluginConfigObjectTable)
+    .where(and(eq(PluginConfigObjectTable.pluginId, input.pluginId), eq(PluginConfigObjectTable.configObjectId, input.configObjectId)))
+    .limit(1)
+
+  const now = new Date()
+  let membershipId = existing[0]?.id ?? null
+  if (existing[0]) {
+    await db.update(PluginConfigObjectTable).set({ membershipSource: input.membershipSource ?? existing[0].membershipSource, removedAt: null }).where(eq(PluginConfigObjectTable.id, existing[0].id))
+  } else {
+    membershipId = createDenTypeId("pluginConfigObject")
+    await db.insert(PluginConfigObjectTable).values({
+      configObjectId: input.configObjectId,
+      connectorMappingId: null,
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      id: membershipId,
+      membershipSource: input.membershipSource ?? "manual",
+      organizationId: input.context.organizationContext.organization.id,
+      pluginId: input.pluginId,
+    })
+  }
+
+  const rows = await db.select().from(PluginConfigObjectTable).where(eq(PluginConfigObjectTable.id, membershipId!)).limit(1)
+  return serializeMembership(rows[0])
+}
+
+export async function removeConfigObjectFromPlugin(input: { context: PluginArchActorContext; configObjectId: ConfigObjectId; pluginId: PluginId }) {
+  await ensureVisibleConfigObject(input.context, input.configObjectId)
+  await ensureEditablePlugin(input.context, input.pluginId)
+  const rows = await db
+    .select()
+    .from(PluginConfigObjectTable)
+    .where(and(eq(PluginConfigObjectTable.pluginId, input.pluginId), eq(PluginConfigObjectTable.configObjectId, input.configObjectId), isNull(PluginConfigObjectTable.removedAt)))
+    .limit(1)
+  if (!rows[0]) {
+    throw new PluginArchRouteFailure(404, "plugin_membership_not_found", "Plugin membership not found.")
+  }
+  await db.update(PluginConfigObjectTable).set({ removedAt: new Date() }).where(eq(PluginConfigObjectTable.id, rows[0].id))
+}
+
+export async function listResourceAccess(input: { context: PluginArchActorContext } & ResourceTarget) {
+  await requirePluginArchResourceRole({ context: input.context, resourceId: input.resourceId, resourceKind: input.resourceKind, role: "manager" })
+
+  if (input.resourceKind === "config_object") {
+    const rows = await db.select().from(ConfigObjectAccessGrantTable).where(eq(ConfigObjectAccessGrantTable.configObjectId, input.resourceId)).orderBy(desc(ConfigObjectAccessGrantTable.createdAt))
+    return { items: rows.map((row) => serializeAccessGrant(row)), nextCursor: null }
+  }
+  if (input.resourceKind === "marketplace") {
+    const rows = await db.select().from(MarketplaceAccessGrantTable).where(eq(MarketplaceAccessGrantTable.marketplaceId, input.resourceId)).orderBy(desc(MarketplaceAccessGrantTable.createdAt))
+    return { items: rows.map((row) => serializeAccessGrant(row)), nextCursor: null }
+  }
+  if (input.resourceKind === "plugin") {
+    const rows = await db.select().from(PluginAccessGrantTable).where(eq(PluginAccessGrantTable.pluginId, input.resourceId)).orderBy(desc(PluginAccessGrantTable.createdAt))
+    return { items: rows.map((row) => serializeAccessGrant(row)), nextCursor: null }
+  }
+  const rows = await db.select().from(ConnectorInstanceAccessGrantTable).where(eq(ConnectorInstanceAccessGrantTable.connectorInstanceId, input.resourceId)).orderBy(desc(ConnectorInstanceAccessGrantTable.createdAt))
+  return { items: rows.map((row) => serializeAccessGrant(row)), nextCursor: null }
+}
+
+export async function createResourceAccessGrant(input: { context: PluginArchActorContext; value: AccessGrantWrite } & ResourceTarget) {
+  await requirePluginArchResourceRole({ context: input.context, resourceId: input.resourceId, resourceKind: input.resourceKind, role: "manager" })
+  return upsertGrant(input)
+}
+
+export async function deleteResourceAccessGrant(input: { context: PluginArchActorContext } & GrantTarget) {
+  await requirePluginArchResourceRole({ context: input.context, resourceId: input.resourceId, resourceKind: input.resourceKind, role: "manager" })
+  return removeGrant(input)
+}
+
+async function collectPluginMarketplaces(organizationId: PluginRow["organizationId"], pluginIds: PluginId[]): Promise<Map<string, PluginMarketplaceSummary[]>> {
+  const byPlugin = new Map<string, PluginMarketplaceSummary[]>()
+  if (pluginIds.length === 0) {
+    return byPlugin
+  }
+
+  const rows = await db
+    .select({
+      marketplaceId: MarketplaceTable.id,
+      marketplaceName: MarketplaceTable.name,
+      pluginId: MarketplacePluginTable.pluginId,
+    })
+    .from(MarketplacePluginTable)
+    .innerJoin(MarketplaceTable, eq(MarketplacePluginTable.marketplaceId, MarketplaceTable.id))
+    .where(and(
+      eq(MarketplaceTable.organizationId, organizationId),
+      isNull(MarketplacePluginTable.removedAt),
+      isNull(MarketplaceTable.deletedAt),
+      inArray(MarketplacePluginTable.pluginId, pluginIds),
+    ))
+
+  for (const row of rows) {
+    const existing = byPlugin.get(row.pluginId) ?? []
+    existing.push({ id: row.marketplaceId, name: row.marketplaceName })
+    byPlugin.set(row.pluginId, existing)
+  }
+  return byPlugin
+}
+
+export async function listPlugins(input: { context: PluginArchActorContext; cursor?: string; limit?: number; q?: string; status?: PluginRow["status"] }) {
+  const rows = await db
+    .select()
+    .from(PluginTable)
+    .where(eq(PluginTable.organizationId, input.context.organizationContext.organization.id))
+    .orderBy(desc(PluginTable.updatedAt), desc(PluginTable.id))
+
+  const memberships = await db
+    .select({ pluginId: PluginConfigObjectTable.pluginId, count: PluginConfigObjectTable.id })
+    .from(PluginConfigObjectTable)
+    .where(isNull(PluginConfigObjectTable.removedAt))
+
+  const counts = memberships.reduce((accumulator, row) => {
+    accumulator.set(row.pluginId, (accumulator.get(row.pluginId) ?? 0) + 1)
+    return accumulator
+  }, new Map<string, number>())
+
+  const marketplaceMembers = await collectPluginMarketplaces(
+    input.context.organizationContext.organization.id,
+    rows.map((row) => row.id),
+  )
+
+  const visible: ReturnType<typeof serializePlugin>[] = []
+  for (const row of rows) {
+    const role = await resolvePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "plugin" })
+    if (!role) continue
+    if (input.status && row.status !== input.status) continue
+    if (input.q) {
+      const haystack = `${row.name}\n${row.description ?? ""}`.toLowerCase()
+      if (!haystack.includes(input.q.toLowerCase())) continue
+    }
+    visible.push(serializePlugin(row, counts.get(row.id) ?? 0, marketplaceMembers.get(row.id) ?? []))
+  }
+
+  return pageItems(visible, input.cursor, input.limit)
+}
+
+export async function getPluginDetail(context: PluginArchActorContext, pluginId: PluginId) {
+  const row = await ensureVisiblePlugin(context, pluginId)
+  const memberships = await db.select({ id: PluginConfigObjectTable.id }).from(PluginConfigObjectTable).where(and(eq(PluginConfigObjectTable.pluginId, row.id), isNull(PluginConfigObjectTable.removedAt)))
+  const marketplaceMembers = await collectPluginMarketplaces(context.organizationContext.organization.id, [row.id])
+  return serializePlugin(row, memberships.length, marketplaceMembers.get(row.id) ?? [])
+}
+
+export async function createPlugin(input: { context: PluginArchActorContext; description?: string | null; name: string }) {
+  const now = new Date()
+  const row = {
+    createdAt: now,
+    createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+    deletedAt: null,
+    description: normalizeOptionalString(input.description ?? undefined),
+    id: createDenTypeId("plugin"),
+    name: input.name.trim(),
+    organizationId: input.context.organizationContext.organization.id,
+    status: "active" as const,
+    updatedAt: now,
+  }
+
+  await db.transaction(async (tx) => {
+    await tx.insert(PluginTable).values(row)
+    await tx.insert(PluginAccessGrantTable).values({
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      id: createDenTypeId("pluginAccessGrant"),
+      organizationId: input.context.organizationContext.organization.id,
+      orgMembershipId: input.context.organizationContext.currentMember.id,
+      orgWide: false,
+      pluginId: row.id,
+      role: "manager",
+      teamId: null,
+    })
+  })
+
+  return serializePlugin(row, 0)
+}
+
+export async function updatePlugin(input: { context: PluginArchActorContext; description?: string | null; name?: string; pluginId: PluginId }) {
+  const row = await ensureEditablePlugin(input.context, input.pluginId)
+  const updatedAt = new Date()
+  await db.update(PluginTable).set({
+    description: input.description === undefined ? row.description : normalizeOptionalString(input.description ?? undefined),
+    name: input.name?.trim() || row.name,
+    updatedAt,
+  }).where(eq(PluginTable.id, row.id))
+  return getPluginDetail(input.context, row.id)
+}
+
+export async function setPluginLifecycle(input: { action: "archive" | "restore"; context: PluginArchActorContext; pluginId: PluginId }) {
+  const row = await ensureVisiblePlugin(input.context, input.pluginId)
+  await requirePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "plugin", role: "manager" })
+  const updatedAt = new Date()
+  await db.update(PluginTable).set({
+    deletedAt: input.action === "archive" ? row.deletedAt : null,
+    status: input.action === "archive" ? "archived" : "active",
+    updatedAt,
+  }).where(eq(PluginTable.id, row.id))
+  return getPluginDetail(input.context, row.id)
+}
+
+export async function listPluginMemberships(input: { context: PluginArchActorContext; pluginId: PluginId; includeConfigObjects?: boolean; onlyActive?: boolean }) {
+  await ensureVisiblePlugin(input.context, input.pluginId)
+  const memberships = await db
+    .select()
+    .from(PluginConfigObjectTable)
+    .where(input.onlyActive ? and(eq(PluginConfigObjectTable.pluginId, input.pluginId), isNull(PluginConfigObjectTable.removedAt)) : eq(PluginConfigObjectTable.pluginId, input.pluginId))
+    .orderBy(desc(PluginConfigObjectTable.createdAt))
+
+  if (!input.includeConfigObjects) {
+    return { items: memberships.map((membership) => serializeMembership(membership)), nextCursor: null }
+  }
+
+  const configObjects = await db.select().from(ConfigObjectTable).where(inArray(ConfigObjectTable.id, memberships.map((membership) => membership.configObjectId)))
+  const latestVersions = await getLatestVersions(configObjects.map((row) => row.id))
+  const byId = new Map<string, ReturnType<typeof serializeConfigObject>>(configObjects.map((row) => [row.id, serializeConfigObject(row, latestVersions.get(row.id) ?? null)]))
+  return { items: memberships.map((membership) => serializeMembership(membership, byId.get(membership.configObjectId))), nextCursor: null }
+}
+
+export async function addPluginMembership(input: { configObjectId: ConfigObjectId; context: PluginArchActorContext; membershipSource?: PluginMembershipRow["membershipSource"]; pluginId: PluginId }) {
+  return attachConfigObjectToPlugin({ ...input })
+}
+
+export async function removePluginMembership(input: { configObjectId: ConfigObjectId; context: PluginArchActorContext; pluginId: PluginId }) {
+  return removeConfigObjectFromPlugin(input)
+}
+
+export async function listMarketplaces(input: { context: PluginArchActorContext; cursor?: string; limit?: number; q?: string; status?: MarketplaceRow["status"] }) {
+  const rows = await db
+    .select()
+    .from(MarketplaceTable)
+    .where(eq(MarketplaceTable.organizationId, input.context.organizationContext.organization.id))
+    .orderBy(desc(MarketplaceTable.updatedAt), desc(MarketplaceTable.id))
+
+  const memberships = await db
+    .select({ marketplaceId: MarketplacePluginTable.marketplaceId, count: MarketplacePluginTable.id })
+    .from(MarketplacePluginTable)
+    .where(isNull(MarketplacePluginTable.removedAt))
+
+  const counts = memberships.reduce((accumulator, row) => {
+    accumulator.set(row.marketplaceId, (accumulator.get(row.marketplaceId) ?? 0) + 1)
+    return accumulator
+  }, new Map<string, number>())
+
+  const visible: ReturnType<typeof serializeMarketplace>[] = []
+  for (const row of rows) {
+    const role = await resolvePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "marketplace" })
+    if (!role) continue
+    if (input.status && row.status !== input.status) continue
+    if (input.q) {
+      const haystack = `${row.name}\n${row.description ?? ""}`.toLowerCase()
+      if (!haystack.includes(input.q.toLowerCase())) continue
+    }
+    visible.push(serializeMarketplace(row, counts.get(row.id) ?? 0))
+  }
+
+  return pageItems(visible, input.cursor, input.limit)
+}
+
+export async function getMarketplaceDetail(context: PluginArchActorContext, marketplaceId: MarketplaceId) {
+  const row = await ensureVisibleMarketplace(context, marketplaceId)
+  const memberships = await db
+    .select({ id: MarketplacePluginTable.id })
+    .from(MarketplacePluginTable)
+    .where(and(eq(MarketplacePluginTable.marketplaceId, row.id), isNull(MarketplacePluginTable.removedAt)))
+  return serializeMarketplace(row, memberships.length)
+}
+
+export async function createMarketplace(input: { context: PluginArchActorContext; description?: string | null; name: string }) {
+  const now = new Date()
+  const row = {
+    createdAt: now,
+    createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+    deletedAt: null,
+    description: normalizeOptionalString(input.description ?? undefined),
+    id: createDenTypeId("marketplace"),
+    name: input.name.trim(),
+    organizationId: input.context.organizationContext.organization.id,
+    status: "active" as const,
+    updatedAt: now,
+  }
+
+  await db.transaction(async (tx) => {
+    await tx.insert(MarketplaceTable).values(row)
+    await tx.insert(MarketplaceAccessGrantTable).values({
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      id: createDenTypeId("marketplaceAccessGrant"),
+      marketplaceId: row.id,
+      organizationId: input.context.organizationContext.organization.id,
+      orgMembershipId: input.context.organizationContext.currentMember.id,
+      orgWide: false,
+      role: "manager",
+      teamId: null,
+    })
+  })
+
+  return serializeMarketplace(row, 0)
+}
+
+export async function updateMarketplace(input: { context: PluginArchActorContext; description?: string | null; marketplaceId: MarketplaceId; name?: string }) {
+  const row = await ensureEditableMarketplace(input.context, input.marketplaceId)
+  const updatedAt = new Date()
+  await db.update(MarketplaceTable).set({
+    description: input.description === undefined ? row.description : normalizeOptionalString(input.description ?? undefined),
+    name: input.name?.trim() || row.name,
+    updatedAt,
+  }).where(eq(MarketplaceTable.id, row.id))
+  return getMarketplaceDetail(input.context, row.id)
+}
+
+export async function setMarketplaceLifecycle(input: { action: "archive" | "restore"; context: PluginArchActorContext; marketplaceId: MarketplaceId }) {
+  const row = await ensureVisibleMarketplace(input.context, input.marketplaceId)
+  await requirePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "marketplace", role: "manager" })
+  const updatedAt = new Date()
+  await db.update(MarketplaceTable).set({
+    deletedAt: input.action === "archive" ? row.deletedAt : null,
+    status: input.action === "archive" ? "archived" : "active",
+    updatedAt,
+  }).where(eq(MarketplaceTable.id, row.id))
+  return getMarketplaceDetail(input.context, row.id)
+}
+
+export async function listMarketplaceMemberships(input: { context: PluginArchActorContext; includePlugins?: boolean; marketplaceId: MarketplaceId; onlyActive?: boolean }) {
+  await ensureVisibleMarketplace(input.context, input.marketplaceId)
+  const memberships = await db
+    .select()
+    .from(MarketplacePluginTable)
+    .where(input.onlyActive ? and(eq(MarketplacePluginTable.marketplaceId, input.marketplaceId), isNull(MarketplacePluginTable.removedAt)) : eq(MarketplacePluginTable.marketplaceId, input.marketplaceId))
+    .orderBy(desc(MarketplacePluginTable.createdAt))
+
+  if (!input.includePlugins) {
+    return { items: memberships.map((membership) => serializeMarketplaceMembership(membership)), nextCursor: null }
+  }
+
+  const plugins = memberships.length === 0
+    ? []
+    : await db.select().from(PluginTable).where(inArray(PluginTable.id, memberships.map((membership) => membership.pluginId)))
+  const byId = new Map<string, ReturnType<typeof serializePlugin>>(plugins.map((row) => [row.id, serializePlugin(row)]))
+  return { items: memberships.map((membership) => serializeMarketplaceMembership(membership, byId.get(membership.pluginId))), nextCursor: null }
+}
+
+export type MarketplaceResolvedSource = {
+  connectorAccountId: string
+  connectorInstanceId: string
+  accountLogin: string | null
+  repositoryFullName: string
+  branch: string | null
+} | null
+
+export async function getMarketplaceResolved(input: { context: PluginArchActorContext; marketplaceId: MarketplaceId }) {
+  const marketplaceRow = await ensureVisibleMarketplace(input.context, input.marketplaceId)
+  const organizationId = input.context.organizationContext.organization.id
+
+  const memberships = await db
+    .select()
+    .from(MarketplacePluginTable)
+    .where(and(eq(MarketplacePluginTable.marketplaceId, marketplaceRow.id), isNull(MarketplacePluginTable.removedAt)))
+    .orderBy(desc(MarketplacePluginTable.createdAt))
+
+  const pluginIds = memberships.map((membership) => membership.pluginId)
+  const pluginRows = pluginIds.length === 0
+    ? []
+    : await db.select().from(PluginTable).where(inArray(PluginTable.id, pluginIds))
+
+  const activePluginMemberships = pluginIds.length === 0
+    ? []
+    : await db
+      .select({ pluginId: PluginConfigObjectTable.pluginId, configObjectId: PluginConfigObjectTable.configObjectId })
+      .from(PluginConfigObjectTable)
+      .where(and(inArray(PluginConfigObjectTable.pluginId, pluginIds), isNull(PluginConfigObjectTable.removedAt)))
+  const memberCounts = new Map<string, number>()
+  for (const entry of activePluginMemberships) {
+    memberCounts.set(entry.pluginId, (memberCounts.get(entry.pluginId) ?? 0) + 1)
+  }
+
+  const configObjectIds = [...new Set(activePluginMemberships.map((entry) => entry.configObjectId))]
+  const configObjectTypeById = new Map<string, string>()
+  if (configObjectIds.length > 0) {
+    const rows = await db
+      .select({ id: ConfigObjectTable.id, objectType: ConfigObjectTable.objectType })
+      .from(ConfigObjectTable)
+      .where(inArray(ConfigObjectTable.id, configObjectIds))
+    for (const row of rows) {
+      configObjectTypeById.set(row.id, row.objectType)
+    }
+  }
+
+  const componentCountsByPlugin = new Map<string, Map<string, number>>()
+  for (const entry of activePluginMemberships) {
+    const objectType = configObjectTypeById.get(entry.configObjectId)
+    if (!objectType) continue
+    let counts = componentCountsByPlugin.get(entry.pluginId)
+    if (!counts) {
+      counts = new Map<string, number>()
+      componentCountsByPlugin.set(entry.pluginId, counts)
+    }
+    counts.set(objectType, (counts.get(objectType) ?? 0) + 1)
+  }
+
+  const plugins = pluginRows.map((row) => ({
+    ...serializePlugin(row, memberCounts.get(row.id) ?? 0),
+    componentCounts: Object.fromEntries(componentCountsByPlugin.get(row.id) ?? new Map()),
+  }))
+
+  let source: MarketplaceResolvedSource = null
+  if (pluginIds.length > 0) {
+    const mappingRows = await db
+      .selectDistinct({ connectorInstanceId: ConnectorMappingTable.connectorInstanceId })
+      .from(ConnectorMappingTable)
+      .where(and(
+        eq(ConnectorMappingTable.organizationId, organizationId),
+        inArray(ConnectorMappingTable.pluginId, pluginIds),
+      ))
+    const connectorInstanceIds = mappingRows.map((entry) => entry.connectorInstanceId)
+    if (connectorInstanceIds.length === 1) {
+      const [instance] = await db
+        .select()
+        .from(ConnectorInstanceTable)
+        .where(eq(ConnectorInstanceTable.id, connectorInstanceIds[0]))
+        .limit(1)
+      if (instance) {
+        const [account] = await db
+          .select()
+          .from(ConnectorAccountTable)
+          .where(eq(ConnectorAccountTable.id, instance.connectorAccountId))
+          .limit(1)
+        const [target] = await db
+          .select()
+          .from(ConnectorTargetTable)
+          .where(eq(ConnectorTargetTable.connectorInstanceId, instance.id))
+          .orderBy(asc(ConnectorTargetTable.createdAt), asc(ConnectorTargetTable.id))
+          .limit(1)
+        const targetConfig = target?.targetConfigJson && typeof target.targetConfigJson === "object"
+          ? target.targetConfigJson as Record<string, unknown>
+          : {}
+        const repositoryFullName = typeof targetConfig.repositoryFullName === "string"
+          ? targetConfig.repositoryFullName
+          : instance.remoteId ?? ""
+        source = {
+          connectorAccountId: instance.connectorAccountId,
+          connectorInstanceId: instance.id,
+          accountLogin: account?.externalAccountRef ?? (account?.metadataJson && typeof account.metadataJson === "object" ? (account.metadataJson as Record<string, unknown>).accountLogin as string ?? null : null),
+          repositoryFullName,
+          branch: typeof targetConfig.branch === "string" ? targetConfig.branch : target?.externalTargetRef ?? null,
+        }
+      }
+    }
+  }
+
+  return {
+    marketplace: serializeMarketplace(marketplaceRow, plugins.length),
+    plugins,
+    source,
+  }
+}
+
+export async function attachPluginToMarketplace(input: { context: PluginArchActorContext; marketplaceId: MarketplaceId; membershipSource?: MarketplaceMembershipRow["membershipSource"]; pluginId: PluginId }) {
+  await ensureVisiblePlugin(input.context, input.pluginId)
+  await ensureEditableMarketplace(input.context, input.marketplaceId)
+
+  const existing = await db
+    .select()
+    .from(MarketplacePluginTable)
+    .where(and(eq(MarketplacePluginTable.marketplaceId, input.marketplaceId), eq(MarketplacePluginTable.pluginId, input.pluginId)))
+    .limit(1)
+
+  const now = new Date()
+  let membershipId: MarketplaceMembershipId | null = existing[0]?.id ?? null
+  if (existing[0]) {
+    await db.update(MarketplacePluginTable).set({ membershipSource: input.membershipSource ?? existing[0].membershipSource, removedAt: null }).where(eq(MarketplacePluginTable.id, existing[0].id))
+  } else {
+    membershipId = createDenTypeId("marketplacePlugin")
+    await db.insert(MarketplacePluginTable).values({
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      id: membershipId,
+      marketplaceId: input.marketplaceId,
+      membershipSource: input.membershipSource ?? "manual",
+      organizationId: input.context.organizationContext.organization.id,
+      pluginId: input.pluginId,
+    })
+  }
+
+  const rows = await db.select().from(MarketplacePluginTable).where(eq(MarketplacePluginTable.id, membershipId!)).limit(1)
+  return serializeMarketplaceMembership(rows[0])
+}
+
+export async function removePluginFromMarketplace(input: { context: PluginArchActorContext; marketplaceId: MarketplaceId; pluginId: PluginId }) {
+  await ensureVisiblePlugin(input.context, input.pluginId)
+  await ensureEditableMarketplace(input.context, input.marketplaceId)
+  const rows = await db
+    .select()
+    .from(MarketplacePluginTable)
+    .where(and(eq(MarketplacePluginTable.marketplaceId, input.marketplaceId), eq(MarketplacePluginTable.pluginId, input.pluginId), isNull(MarketplacePluginTable.removedAt)))
+    .limit(1)
+  if (!rows[0]) {
+    throw new PluginArchRouteFailure(404, "marketplace_membership_not_found", "Marketplace membership not found.")
+  }
+  await db.update(MarketplacePluginTable).set({ removedAt: new Date() }).where(eq(MarketplacePluginTable.id, rows[0].id))
+}
+
+export async function listConnectorAccounts(input: { context: PluginArchActorContext; connectorType?: ConnectorAccountRow["connectorType"]; cursor?: string; limit?: number; q?: string; status?: ConnectorAccountRow["status"] }) {
+  const rows = await db
+    .select()
+    .from(ConnectorAccountTable)
+    .where(eq(ConnectorAccountTable.organizationId, input.context.organizationContext.organization.id))
+    .orderBy(desc(ConnectorAccountTable.updatedAt), desc(ConnectorAccountTable.id))
+
+  const filtered = rows
+    .filter((row) => !input.connectorType || row.connectorType === input.connectorType)
+    .filter((row) => !input.status || row.status === input.status)
+    .filter((row) => !input.q || `${row.displayName}\n${row.remoteId}\n${row.externalAccountRef ?? ""}`.toLowerCase().includes(input.q.toLowerCase()))
+    .map((row) => serializeConnectorAccount(row, resolveCreatorName(input.context, row.createdByOrgMembershipId)))
+
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function createConnectorAccount(input: { context: PluginArchActorContext; connectorType: ConnectorAccountRow["connectorType"]; displayName: string; externalAccountRef?: string | null; metadata?: Record<string, unknown>; remoteId: string }) {
+  const now = new Date()
+  const row = {
+    connectorType: input.connectorType,
+    createdAt: now,
+    createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+    displayName: input.displayName.trim(),
+    externalAccountRef: normalizeOptionalString(input.externalAccountRef ?? undefined),
+    id: createDenTypeId("connectorAccount"),
+    metadataJson: input.metadata ?? null,
+    organizationId: input.context.organizationContext.organization.id,
+    remoteId: input.remoteId.trim(),
+    status: "active" as const,
+    updatedAt: now,
+  }
+  await db.insert(ConnectorAccountTable).values(row)
+  return serializeConnectorAccount(row)
+}
+
+export async function getConnectorAccountDetail(context: PluginArchActorContext, connectorAccountId: ConnectorAccountId) {
+  const row = await getConnectorAccountRow(context.organizationContext.organization.id, connectorAccountId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "connector_account_not_found", "Connector account not found.")
+  }
+  return serializeConnectorAccount(row, resolveCreatorName(context, row.createdByOrgMembershipId))
+}
+
+export async function disconnectConnectorAccount(input: { connectorAccountId: ConnectorAccountId; context: PluginArchActorContext; reason?: string }) {
+  const organizationId = input.context.organizationContext.organization.id
+  const row = await getConnectorAccountRow(organizationId, input.connectorAccountId)
+  if (!row) {
+    throw new PluginArchRouteFailure(404, "connector_account_not_found", "Connector account not found.")
+  }
+
+  const instances = await db
+    .select({ id: ConnectorInstanceTable.id })
+    .from(ConnectorInstanceTable)
+    .where(and(
+      eq(ConnectorInstanceTable.organizationId, organizationId),
+      eq(ConnectorInstanceTable.connectorAccountId, row.id),
+    ))
+  const instanceIds = instances.map((entry) => entry.id)
+
+  const mappingRows = instanceIds.length === 0
+    ? []
+    : await db
+      .select({ id: ConnectorMappingTable.id, pluginId: ConnectorMappingTable.pluginId })
+      .from(ConnectorMappingTable)
+      .where(inArray(ConnectorMappingTable.connectorInstanceId, instanceIds))
+  const mappingIds = mappingRows.map((entry) => entry.id)
+  const connectorPluginIds = [...new Set(mappingRows.map((entry) => entry.pluginId).filter((value): value is PluginId => Boolean(value)))]
+
+  const configObjectRows = instanceIds.length === 0
+    ? []
+    : await db
+      .select({ id: ConfigObjectTable.id })
+      .from(ConfigObjectTable)
+      .where(inArray(ConfigObjectTable.connectorInstanceId, instanceIds))
+  const configObjectIds = configObjectRows.map((entry) => entry.id)
+
+  await db.transaction(async (tx) => {
+    if (instanceIds.length > 0) {
+      await tx.delete(ConnectorSourceTombstoneTable).where(inArray(ConnectorSourceTombstoneTable.connectorInstanceId, instanceIds))
+      await tx.delete(ConnectorSourceBindingTable).where(inArray(ConnectorSourceBindingTable.connectorInstanceId, instanceIds))
+      await tx.delete(ConnectorSyncEventTable).where(inArray(ConnectorSyncEventTable.connectorInstanceId, instanceIds))
+    }
+
+    if (configObjectIds.length > 0) {
+      await tx.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectAccessGrantTable).where(inArray(ConfigObjectAccessGrantTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectVersionTable).where(inArray(ConfigObjectVersionTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectTable).where(inArray(ConfigObjectTable.id, configObjectIds))
+    }
+
+    if (mappingIds.length > 0) {
+      await tx.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.connectorMappingId, mappingIds))
+      await tx.delete(ConnectorMappingTable).where(inArray(ConnectorMappingTable.id, mappingIds))
+    }
+
+    if (instanceIds.length > 0) {
+      await tx.delete(ConnectorTargetTable).where(inArray(ConnectorTargetTable.connectorInstanceId, instanceIds))
+      await tx.delete(ConnectorInstanceAccessGrantTable).where(inArray(ConnectorInstanceAccessGrantTable.connectorInstanceId, instanceIds))
+      await tx.delete(ConnectorInstanceTable).where(inArray(ConnectorInstanceTable.id, instanceIds))
+    }
+
+    await cleanupConnectorImportedResources({ seedPluginIds: connectorPluginIds, tx })
+
+    await tx.delete(ConnectorAccountTable).where(eq(ConnectorAccountTable.id, row.id))
+  })
+
+  return {
+    deletedConfigObjectCount: configObjectIds.length,
+    deletedConnectorInstanceCount: instanceIds.length,
+    deletedConnectorMappingCount: mappingIds.length,
+    disconnectedAccountId: row.id,
+    reason: input.reason ?? null,
+  }
+}
+
+export async function listConnectorInstances(input: { connectorAccountId?: ConnectorAccountId; context: PluginArchActorContext; cursor?: string; limit?: number; pluginId?: PluginId; q?: string; status?: ConnectorInstanceRow["status"] }) {
+  const rows = await db
+    .select()
+    .from(ConnectorInstanceTable)
+    .where(eq(ConnectorInstanceTable.organizationId, input.context.organizationContext.organization.id))
+    .orderBy(desc(ConnectorInstanceTable.updatedAt), desc(ConnectorInstanceTable.id))
+
+  const filtered: ReturnType<typeof serializeConnectorInstance>[] = []
+  for (const row of rows) {
+    const role = await resolvePluginArchResourceRole({ context: input.context, resourceId: row.id, resourceKind: "connector_instance" })
+    if (!role) continue
+    if (input.connectorAccountId && row.connectorAccountId !== input.connectorAccountId) continue
+    if (input.status && row.status !== input.status) continue
+    if (input.q && !`${row.name}\n${row.remoteId ?? ""}`.toLowerCase().includes(input.q.toLowerCase())) continue
+    if (input.pluginId) {
+      const mappings = await db
+        .select({ id: ConnectorMappingTable.id })
+        .from(ConnectorMappingTable)
+        .where(and(eq(ConnectorMappingTable.connectorInstanceId, row.id), eq(ConnectorMappingTable.pluginId, input.pluginId)))
+        .limit(1)
+      if (!mappings[0]) continue
+    }
+    filtered.push(serializeConnectorInstance(row))
+  }
+
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function createConnectorInstance(input: { connectorAccountId: ConnectorAccountId; connectorType: ConnectorInstanceRow["connectorType"]; config?: Record<string, unknown>; context: PluginArchActorContext; name: string; remoteId?: string | null }) {
+  const account = await getConnectorAccountRow(input.context.organizationContext.organization.id, input.connectorAccountId)
+  if (!account) {
+    throw new PluginArchRouteFailure(404, "connector_account_not_found", "Connector account not found.")
+  }
+  const now = new Date()
+  const row = {
+    connectorAccountId: account.id,
+    connectorType: input.connectorType,
+    createdAt: now,
+    createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+    id: createDenTypeId("connectorInstance"),
+    instanceConfigJson: input.config ?? null,
+    lastSyncCursor: null,
+    lastSyncStatus: null,
+    lastSyncedAt: null,
+    name: input.name.trim(),
+    organizationId: input.context.organizationContext.organization.id,
+    remoteId: normalizeOptionalString(input.remoteId ?? undefined),
+    status: "active" as const,
+    updatedAt: now,
+  }
+  await db.transaction(async (tx) => {
+    await tx.insert(ConnectorInstanceTable).values(row)
+    await tx.insert(ConnectorInstanceAccessGrantTable).values({
+      connectorInstanceId: row.id,
+      createdAt: now,
+      createdByOrgMembershipId: input.context.organizationContext.currentMember.id,
+      id: createDenTypeId("connectorInstanceAccessGrant"),
+      organizationId: input.context.organizationContext.organization.id,
+      orgMembershipId: input.context.organizationContext.currentMember.id,
+      orgWide: false,
+      role: "manager",
+      teamId: null,
+    })
+  })
+  return serializeConnectorInstance(row)
+}
+
+export async function getConnectorInstanceDetail(context: PluginArchActorContext, connectorInstanceId: ConnectorInstanceId) {
+  const row = await ensureVisibleConnectorInstance(context, connectorInstanceId)
+  return serializeConnectorInstance(row)
+}
+
+export async function updateConnectorInstance(input: { connectorInstanceId: ConnectorInstanceId; config?: Record<string, unknown>; context: PluginArchActorContext; name?: string; remoteId?: string | null; status?: ConnectorInstanceRow["status"] }) {
+  const row = await ensureEditableConnectorInstance(input.context, input.connectorInstanceId)
+  await db.update(ConnectorInstanceTable).set({
+    instanceConfigJson: input.config === undefined ? row.instanceConfigJson : input.config,
+    name: input.name?.trim() || row.name,
+    remoteId: input.remoteId === undefined ? row.remoteId : normalizeOptionalString(input.remoteId ?? undefined),
+    status: input.status ?? row.status,
+    updatedAt: new Date(),
+  }).where(eq(ConnectorInstanceTable.id, row.id))
+  return getConnectorInstanceDetail(input.context, row.id)
+}
+
+export async function setConnectorInstanceLifecycle(input: { action: "archive" | "disable" | "enable"; connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const row = await ensureEditableConnectorInstance(input.context, input.connectorInstanceId)
+  const status = input.action === "archive" ? "archived" : input.action === "disable" ? "disabled" : "active"
+  await db.update(ConnectorInstanceTable).set({ status, updatedAt: new Date() }).where(eq(ConnectorInstanceTable.id, row.id))
+  return getConnectorInstanceDetail(input.context, row.id)
+}
+
+function commonSelectorRootPath(selectors: string[]): string | null {
+  const normalized = selectors
+    .map((selector) => {
+      let path = selector.trim().replace(/^\/+/, "").replace(/\/+$/, "")
+      if (path.endsWith("/**")) {
+        path = path.slice(0, -3)
+      }
+      const knownLeafSegments = ["skills", "commands", "agents", "hooks", "monitors", "mcp", ".mcp.json", ".lsp.json", "settings.json", "hooks.json"]
+      for (const leaf of knownLeafSegments) {
+        if (path === leaf) return ""
+        if (path.endsWith(`/${leaf}`)) return path.slice(0, -(leaf.length + 1))
+      }
+      return path
+    })
+    .filter((path): path is string => path !== null)
+
+  if (normalized.length === 0) return null
+  if (normalized.every((path) => path === normalized[0])) {
+    return normalized[0]
+  }
+
+  const parts = normalized[0].split("/")
+  for (let index = parts.length; index > 0; index -= 1) {
+    const candidate = parts.slice(0, index).join("/")
+    if (normalized.every((path) => path === candidate || path.startsWith(`${candidate}/`))) {
+      return candidate
+    }
+  }
+  return ""
+}
+
+async function assertConnectorImportedResourceCleanup(input: {
+  marketplaceIdsToDelete: MarketplaceId[]
+  pluginIdsToDelete: PluginId[]
+  tx: DbTransaction
+}) {
+  if (input.pluginIdsToDelete.length > 0) {
+    const [remainingPlugins, remainingPluginMappings, remainingPluginMemberships, remainingPluginGrants] = await Promise.all([
+      input.tx.select({ id: PluginTable.id }).from(PluginTable).where(inArray(PluginTable.id, input.pluginIdsToDelete)),
+      input.tx.select({ id: ConnectorMappingTable.id }).from(ConnectorMappingTable).where(inArray(ConnectorMappingTable.pluginId, input.pluginIdsToDelete)),
+      input.tx.select({ id: PluginConfigObjectTable.id }).from(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.pluginId, input.pluginIdsToDelete)),
+      input.tx.select({ id: PluginAccessGrantTable.id }).from(PluginAccessGrantTable).where(inArray(PluginAccessGrantTable.pluginId, input.pluginIdsToDelete)),
+    ])
+
+    if (remainingPlugins.length > 0 || remainingPluginMappings.length > 0 || remainingPluginMemberships.length > 0 || remainingPluginGrants.length > 0) {
+      throw new Error("Connector cleanup left plugin records behind.")
+    }
+  }
+
+  if (input.marketplaceIdsToDelete.length > 0) {
+    const [remainingMarketplaces, remainingMarketplaceMemberships, remainingMarketplaceGrants] = await Promise.all([
+      input.tx.select({ id: MarketplaceTable.id }).from(MarketplaceTable).where(inArray(MarketplaceTable.id, input.marketplaceIdsToDelete)),
+      input.tx.select({ id: MarketplacePluginTable.id }).from(MarketplacePluginTable).where(inArray(MarketplacePluginTable.marketplaceId, input.marketplaceIdsToDelete)),
+      input.tx.select({ id: MarketplaceAccessGrantTable.id }).from(MarketplaceAccessGrantTable).where(inArray(MarketplaceAccessGrantTable.marketplaceId, input.marketplaceIdsToDelete)),
+    ])
+
+    if (remainingMarketplaces.length > 0 || remainingMarketplaceMemberships.length > 0 || remainingMarketplaceGrants.length > 0) {
+      throw new Error("Connector cleanup left marketplace records behind.")
+    }
+  }
+}
+
+async function cleanupConnectorImportedResources(input: {
+  seedPluginIds: PluginId[]
+  tx: DbTransaction
+}) {
+  const seedPluginIds = uniqueIds(input.seedPluginIds)
+  if (seedPluginIds.length === 0) {
+    return { deletedMarketplaceCount: 0, deletedPluginCount: 0 }
+  }
+
+  const connectorMarketplaceRows = await input.tx
+    .select({ marketplaceId: MarketplacePluginTable.marketplaceId })
+    .from(MarketplacePluginTable)
+    .where(and(
+      inArray(MarketplacePluginTable.pluginId, seedPluginIds),
+      eq(MarketplacePluginTable.membershipSource, "connector"),
+      isNull(MarketplacePluginTable.removedAt),
+    ))
+  const candidateMarketplaceIds = uniqueIds(connectorMarketplaceRows.map((row) => row.marketplaceId))
+
+  const activeMarketplaceMemberships = candidateMarketplaceIds.length === 0
+    ? []
+    : await input.tx
+      .select({
+        marketplaceId: MarketplacePluginTable.marketplaceId,
+        membershipSource: MarketplacePluginTable.membershipSource,
+        pluginId: MarketplacePluginTable.pluginId,
+      })
+      .from(MarketplacePluginTable)
+      .where(and(
+        inArray(MarketplacePluginTable.marketplaceId, candidateMarketplaceIds),
+        isNull(MarketplacePluginTable.removedAt),
+      ))
+
+  const candidatePluginIds = uniqueIds([
+    ...seedPluginIds,
+    ...activeMarketplaceMemberships
+      .filter((membership) => membership.membershipSource === "connector")
+      .map((membership) => membership.pluginId),
+  ])
+
+  const activePluginMembershipRows = candidatePluginIds.length === 0
+    ? []
+    : await input.tx
+      .select({ pluginId: PluginConfigObjectTable.pluginId })
+      .from(PluginConfigObjectTable)
+      .where(and(
+        inArray(PluginConfigObjectTable.pluginId, candidatePluginIds),
+        isNull(PluginConfigObjectTable.removedAt),
+      ))
+
+  const activeMappingRows = candidatePluginIds.length === 0
+    ? []
+    : await input.tx
+      .select({ pluginId: ConnectorMappingTable.pluginId })
+      .from(ConnectorMappingTable)
+      .where(inArray(ConnectorMappingTable.pluginId, candidatePluginIds))
+
+  const { marketplaceIdsToDelete, pluginIdsToDelete } = planConnectorImportedResourceCleanup({
+    activeMarketplaceMemberships,
+    activeMappingPluginIds: activeMappingRows
+      .map((row) => row.pluginId)
+      .filter((pluginId): pluginId is PluginId => Boolean(pluginId)),
+    activePluginMembershipPluginIds: activePluginMembershipRows.map((row) => row.pluginId),
+    candidateMarketplaceIds,
+    candidatePluginIds,
+  })
+
+  if (pluginIdsToDelete.length > 0) {
+    await input.tx.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.pluginId, pluginIdsToDelete))
+    await input.tx.delete(MarketplacePluginTable).where(inArray(MarketplacePluginTable.pluginId, pluginIdsToDelete))
+    await input.tx.delete(PluginAccessGrantTable).where(inArray(PluginAccessGrantTable.pluginId, pluginIdsToDelete))
+    await input.tx.delete(PluginTable).where(inArray(PluginTable.id, pluginIdsToDelete))
+  }
+
+  if (marketplaceIdsToDelete.length > 0) {
+    await input.tx.delete(MarketplacePluginTable).where(inArray(MarketplacePluginTable.marketplaceId, marketplaceIdsToDelete))
+    await input.tx.delete(MarketplaceAccessGrantTable).where(inArray(MarketplaceAccessGrantTable.marketplaceId, marketplaceIdsToDelete))
+    await input.tx.delete(MarketplaceTable).where(inArray(MarketplaceTable.id, marketplaceIdsToDelete))
+  }
+
+  await assertConnectorImportedResourceCleanup({
+    marketplaceIdsToDelete,
+    pluginIdsToDelete,
+    tx: input.tx,
+  })
+
+  return {
+    deletedMarketplaceCount: marketplaceIdsToDelete.length,
+    deletedPluginCount: pluginIdsToDelete.length,
+  }
+}
+
+export async function getConnectorInstanceConfiguration(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const instance = await ensureVisibleConnectorInstance(input.context, input.connectorInstanceId)
+  const mappings = await db
+    .select()
+    .from(ConnectorMappingTable)
+    .where(eq(ConnectorMappingTable.connectorInstanceId, instance.id))
+    .orderBy(desc(ConnectorMappingTable.createdAt), desc(ConnectorMappingTable.id))
+
+  const pluginIds = [...new Set(mappings.map((row) => row.pluginId).filter((value): value is PluginId => Boolean(value)))]
+  const pluginRows = pluginIds.length === 0
+    ? []
+    : await db.select().from(PluginTable).where(inArray(PluginTable.id, pluginIds))
+  const memberships = pluginIds.length === 0
+    ? []
+    : await db
+      .select({ pluginId: PluginConfigObjectTable.pluginId, configObjectId: PluginConfigObjectTable.configObjectId })
+      .from(PluginConfigObjectTable)
+      .where(and(inArray(PluginConfigObjectTable.pluginId, pluginIds), isNull(PluginConfigObjectTable.removedAt)))
+  const configObjectIds = [...new Set(memberships.map((entry) => entry.configObjectId))]
+  const configObjectTypeById = new Map<string, string>()
+  if (configObjectIds.length > 0) {
+    const rows = await db
+      .select({ id: ConfigObjectTable.id, objectType: ConfigObjectTable.objectType })
+      .from(ConfigObjectTable)
+      .where(inArray(ConfigObjectTable.id, configObjectIds))
+    for (const row of rows) {
+      configObjectTypeById.set(row.id, row.objectType)
+    }
+  }
+
+  const pluginComponentCounts = new Map<string, Map<string, number>>()
+  const membershipCounts = new Map<string, number>()
+  for (const membership of memberships) {
+    membershipCounts.set(membership.pluginId, (membershipCounts.get(membership.pluginId) ?? 0) + 1)
+    const objectType = configObjectTypeById.get(membership.configObjectId)
+    if (!objectType) continue
+    let counts = pluginComponentCounts.get(membership.pluginId)
+    if (!counts) {
+      counts = new Map<string, number>()
+      pluginComponentCounts.set(membership.pluginId, counts)
+    }
+    counts.set(objectType, (counts.get(objectType) ?? 0) + 1)
+  }
+
+  const pluginRootPaths = new Map<string, string | null>()
+  for (const pluginId of pluginIds) {
+    const selectors = mappings
+      .filter((mapping) => mapping.pluginId === pluginId)
+      .map((mapping) => mapping.selector)
+    pluginRootPaths.set(pluginId, commonSelectorRootPath(selectors))
+  }
+
+  const configObjectRows = await db
+    .select({ id: ConfigObjectTable.id })
+    .from(ConfigObjectTable)
+    .where(eq(ConfigObjectTable.connectorInstanceId, instance.id))
+
+  const instanceConfig = instance.instanceConfigJson && typeof instance.instanceConfigJson === "object"
+    ? instance.instanceConfigJson as Record<string, unknown>
+    : {}
+  const savedAutoImport = instanceConfig.autoImportNewPlugins
+
+  return {
+    autoImportNewPlugins: typeof savedAutoImport === "boolean" ? savedAutoImport : true,
+    configuredPlugins: pluginRows.map((row) => ({
+      ...serializePlugin(row, membershipCounts.get(row.id) ?? 0),
+      componentCounts: Object.fromEntries(pluginComponentCounts.get(row.id) ?? new Map()),
+      rootPath: pluginRootPaths.get(row.id) ?? null,
+    })),
+    connectorInstance: serializeConnectorInstance(instance),
+    importedConfigObjectCount: configObjectRows.length,
+    mappingCount: mappings.length,
+  }
+}
+
+export async function setConnectorInstanceAutoImport(input: { autoImportNewPlugins: boolean; connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const instance = await ensureEditableConnectorInstance(input.context, input.connectorInstanceId)
+  const currentConfig = instance.instanceConfigJson && typeof instance.instanceConfigJson === "object"
+    ? instance.instanceConfigJson as Record<string, unknown>
+    : {}
+  await db.update(ConnectorInstanceTable).set({
+    instanceConfigJson: {
+      ...currentConfig,
+      autoImportNewPlugins: input.autoImportNewPlugins,
+    },
+    updatedAt: new Date(),
+  }).where(eq(ConnectorInstanceTable.id, instance.id))
+
+  return getConnectorInstanceConfiguration({ connectorInstanceId: instance.id, context: input.context })
+}
+
+export async function removeConnectorInstance(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const instance = await ensureEditableConnectorInstance(input.context, input.connectorInstanceId)
+
+  const mappingRows = await db
+    .select({ id: ConnectorMappingTable.id, pluginId: ConnectorMappingTable.pluginId })
+    .from(ConnectorMappingTable)
+    .where(eq(ConnectorMappingTable.connectorInstanceId, instance.id))
+  const mappingIds = mappingRows.map((entry) => entry.id)
+  const pluginIds = [...new Set(mappingRows.map((entry) => entry.pluginId).filter((value): value is PluginId => Boolean(value)))]
+
+  const configObjectRows = await db
+    .select({ id: ConfigObjectTable.id })
+    .from(ConfigObjectTable)
+    .where(eq(ConfigObjectTable.connectorInstanceId, instance.id))
+  const configObjectIds = configObjectRows.map((entry) => entry.id)
+
+  await db.transaction(async (tx) => {
+    await tx.delete(ConnectorSourceTombstoneTable).where(eq(ConnectorSourceTombstoneTable.connectorInstanceId, instance.id))
+    await tx.delete(ConnectorSourceBindingTable).where(eq(ConnectorSourceBindingTable.connectorInstanceId, instance.id))
+    await tx.delete(ConnectorSyncEventTable).where(eq(ConnectorSyncEventTable.connectorInstanceId, instance.id))
+
+    if (configObjectIds.length > 0) {
+      await tx.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectAccessGrantTable).where(inArray(ConfigObjectAccessGrantTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectVersionTable).where(inArray(ConfigObjectVersionTable.configObjectId, configObjectIds))
+      await tx.delete(ConfigObjectTable).where(inArray(ConfigObjectTable.id, configObjectIds))
+    }
+
+    if (mappingIds.length > 0) {
+      await tx.delete(PluginConfigObjectTable).where(inArray(PluginConfigObjectTable.connectorMappingId, mappingIds))
+      await tx.delete(ConnectorMappingTable).where(inArray(ConnectorMappingTable.id, mappingIds))
+    }
+
+    await tx.delete(ConnectorTargetTable).where(eq(ConnectorTargetTable.connectorInstanceId, instance.id))
+    await tx.delete(ConnectorInstanceAccessGrantTable).where(eq(ConnectorInstanceAccessGrantTable.connectorInstanceId, instance.id))
+    await tx.delete(ConnectorInstanceTable).where(eq(ConnectorInstanceTable.id, instance.id))
+
+    await cleanupConnectorImportedResources({ seedPluginIds: pluginIds, tx })
+  })
+
+  return {
+    deletedConfigObjectCount: configObjectIds.length,
+    deletedConnectorMappingCount: mappingIds.length,
+    removedConnectorInstanceId: instance.id,
+  }
+}
+
+export async function listConnectorTargets(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext; cursor?: string; limit?: number; q?: string; targetKind?: ConnectorTargetRow["targetKind"] }) {
+  await ensureVisibleConnectorInstance(input.context, input.connectorInstanceId)
+  const rows = await db
+    .select()
+    .from(ConnectorTargetTable)
+    .where(eq(ConnectorTargetTable.connectorInstanceId, input.connectorInstanceId))
+    .orderBy(desc(ConnectorTargetTable.updatedAt), desc(ConnectorTargetTable.id))
+
+  const filtered = rows
+    .filter((row) => !input.targetKind || row.targetKind === input.targetKind)
+    .filter((row) => !input.q || `${row.remoteId}\n${row.externalTargetRef ?? ""}`.toLowerCase().includes(input.q.toLowerCase()))
+    .map((row) => serializeConnectorTarget(row))
+
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function createConnectorTarget(input: { config: Record<string, unknown>; connectorInstanceId: ConnectorInstanceId; connectorType: ConnectorTargetRow["connectorType"]; context: PluginArchActorContext; externalTargetRef?: string | null; remoteId: string; targetKind: ConnectorTargetRow["targetKind"] }) {
+  await ensureEditableConnectorInstance(input.context, input.connectorInstanceId)
+  const row = {
+    connectorInstanceId: input.connectorInstanceId,
+    connectorType: input.connectorType,
+    createdAt: new Date(),
+    externalTargetRef: normalizeOptionalString(input.externalTargetRef ?? undefined),
+    id: createDenTypeId("connectorTarget"),
+    organizationId: input.context.organizationContext.organization.id,
+    remoteId: input.remoteId.trim(),
+    targetConfigJson: input.config,
+    targetKind: input.targetKind,
+    updatedAt: new Date(),
+  }
+  await db.insert(ConnectorTargetTable).values(row)
+  return serializeConnectorTarget(row)
+}
+
+export async function getConnectorTargetDetail(context: PluginArchActorContext, connectorTargetId: ConnectorTargetId) {
+  const target = await getConnectorTargetRow(context.organizationContext.organization.id, connectorTargetId)
+  if (!target) throw new PluginArchRouteFailure(404, "connector_target_not_found", "Connector target not found.")
+  await ensureVisibleConnectorInstance(context, target.connectorInstanceId)
+  return serializeConnectorTarget(target)
+}
+
+export async function updateConnectorTarget(input: { config?: Record<string, unknown>; connectorTargetId: ConnectorTargetId; context: PluginArchActorContext; externalTargetRef?: string | null; remoteId?: string }) {
+  const target = await getConnectorTargetRow(input.context.organizationContext.organization.id, input.connectorTargetId)
+  if (!target) throw new PluginArchRouteFailure(404, "connector_target_not_found", "Connector target not found.")
+  await ensureEditableConnectorInstance(input.context, target.connectorInstanceId)
+  await db.update(ConnectorTargetTable).set({
+    externalTargetRef: input.externalTargetRef === undefined ? target.externalTargetRef : normalizeOptionalString(input.externalTargetRef ?? undefined),
+    remoteId: input.remoteId?.trim() || target.remoteId,
+    targetConfigJson: input.config === undefined ? target.targetConfigJson : input.config,
+    updatedAt: new Date(),
+  }).where(eq(ConnectorTargetTable.id, target.id))
+  return getConnectorTargetDetail(input.context, target.id)
+}
+
+export async function queueConnectorTargetResync(input: { connectorTargetId: ConnectorTargetId; context: PluginArchActorContext }) {
+  const target = await getConnectorTargetRow(input.context.organizationContext.organization.id, input.connectorTargetId)
+  if (!target) throw new PluginArchRouteFailure(404, "connector_target_not_found", "Connector target not found.")
+  const instance = await ensureEditableConnectorInstance(input.context, target.connectorInstanceId)
+  const eventId = createDenTypeId("connectorSyncEvent")
+  await db.insert(ConnectorSyncEventTable).values({
+    completedAt: null,
+    connectorInstanceId: instance.id,
+    connectorTargetId: target.id,
+    connectorType: target.connectorType,
+    eventType: "manual_resync",
+    externalEventRef: null,
+    id: eventId,
+    organizationId: instance.organizationId,
+    remoteId: target.remoteId,
+    sourceRevisionRef: null,
+    startedAt: new Date(),
+    status: "queued",
+    summaryJson: { queuedBy: input.context.organizationContext.currentMember.id },
+  })
+  return { id: eventId }
+}
+
+export async function listConnectorMappings(input: { connectorTargetId: ConnectorTargetId; context: PluginArchActorContext; cursor?: string; limit?: number; mappingKind?: ConnectorMappingRow["mappingKind"]; objectType?: ConnectorMappingRow["objectType"]; pluginId?: PluginId; q?: string }) {
+  const target = await getConnectorTargetRow(input.context.organizationContext.organization.id, input.connectorTargetId)
+  if (!target) throw new PluginArchRouteFailure(404, "connector_target_not_found", "Connector target not found.")
+  await ensureVisibleConnectorInstance(input.context, target.connectorInstanceId)
+  const rows = await db.select().from(ConnectorMappingTable).where(eq(ConnectorMappingTable.connectorTargetId, target.id)).orderBy(desc(ConnectorMappingTable.updatedAt), desc(ConnectorMappingTable.id))
+  const filtered = rows
+    .filter((row) => !input.mappingKind || row.mappingKind === input.mappingKind)
+    .filter((row) => !input.objectType || row.objectType === input.objectType)
+    .filter((row) => !input.pluginId || row.pluginId === input.pluginId)
+    .filter((row) => !input.q || `${row.selector}\n${row.remoteId ?? ""}`.toLowerCase().includes(input.q.toLowerCase()))
+    .map((row) => serializeConnectorMapping(row))
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function createConnectorMapping(input: { autoAddToPlugin: boolean; config?: Record<string, unknown>; connectorTargetId: ConnectorTargetId; context: PluginArchActorContext; mappingKind: ConnectorMappingRow["mappingKind"]; objectType: ConnectorMappingRow["objectType"]; pluginId?: PluginId | null; selector: string }) {
+  const target = await getConnectorTargetRow(input.context.organizationContext.organization.id, input.connectorTargetId)
+  if (!target) throw new PluginArchRouteFailure(404, "connector_target_not_found", "Connector target not found.")
+  await ensureEditableConnectorInstance(input.context, target.connectorInstanceId)
+  if (input.pluginId) {
+    await ensureEditablePlugin(input.context, input.pluginId)
+  }
+  const row = {
+    autoAddToPlugin: input.autoAddToPlugin,
+    connectorInstanceId: target.connectorInstanceId,
+    connectorTargetId: target.id,
+    connectorType: target.connectorType,
+    createdAt: new Date(),
+    id: createDenTypeId("connectorMapping"),
+    mappingConfigJson: input.config ?? null,
+    mappingKind: input.mappingKind,
+    objectType: input.objectType,
+    organizationId: input.context.organizationContext.organization.id,
+    pluginId: input.pluginId ?? null,
+    remoteId: null,
+    selector: input.selector.trim(),
+    updatedAt: new Date(),
+  }
+  await db.insert(ConnectorMappingTable).values(row)
+  return serializeConnectorMapping(row)
+}
+
+export async function updateConnectorMapping(input: { autoAddToPlugin?: boolean; config?: Record<string, unknown>; connectorMappingId: ConnectorMappingId; context: PluginArchActorContext; objectType?: ConnectorMappingRow["objectType"]; pluginId?: PluginId | null; selector?: string }) {
+  const mapping = await getConnectorMappingRow(input.context.organizationContext.organization.id, input.connectorMappingId)
+  if (!mapping) throw new PluginArchRouteFailure(404, "connector_mapping_not_found", "Connector mapping not found.")
+  await ensureEditableConnectorInstance(input.context, mapping.connectorInstanceId)
+  if (input.pluginId) {
+    await ensureEditablePlugin(input.context, input.pluginId)
+  }
+  await db.update(ConnectorMappingTable).set({
+    autoAddToPlugin: input.autoAddToPlugin ?? mapping.autoAddToPlugin,
+    mappingConfigJson: input.config === undefined ? mapping.mappingConfigJson : input.config,
+    objectType: input.objectType ?? mapping.objectType,
+    pluginId: input.pluginId === undefined ? mapping.pluginId : input.pluginId,
+    selector: input.selector?.trim() || mapping.selector,
+    updatedAt: new Date(),
+  }).where(eq(ConnectorMappingTable.id, mapping.id))
+  return serializeConnectorMapping({ ...mapping, autoAddToPlugin: input.autoAddToPlugin ?? mapping.autoAddToPlugin, mappingConfigJson: input.config === undefined ? mapping.mappingConfigJson : input.config, objectType: input.objectType ?? mapping.objectType, pluginId: input.pluginId === undefined ? mapping.pluginId : input.pluginId, selector: input.selector?.trim() || mapping.selector, updatedAt: new Date() })
+}
+
+export async function deleteConnectorMapping(input: { connectorMappingId: ConnectorMappingId; context: PluginArchActorContext }) {
+  const mapping = await getConnectorMappingRow(input.context.organizationContext.organization.id, input.connectorMappingId)
+  if (!mapping) throw new PluginArchRouteFailure(404, "connector_mapping_not_found", "Connector mapping not found.")
+  await ensureEditableConnectorInstance(input.context, mapping.connectorInstanceId)
+  await db.delete(ConnectorMappingTable).where(eq(ConnectorMappingTable.id, mapping.id))
+}
+
+export async function listConnectorSyncEvents(input: { connectorInstanceId?: ConnectorInstanceId; connectorTargetId?: ConnectorTargetId; context: PluginArchActorContext; cursor?: string; eventType?: ConnectorSyncEventRow["eventType"]; limit?: number; q?: string; status?: ConnectorSyncEventRow["status"] }) {
+  const rows = await db
+    .select({ event: ConnectorSyncEventTable, instance: ConnectorInstanceTable })
+    .from(ConnectorSyncEventTable)
+    .innerJoin(ConnectorInstanceTable, eq(ConnectorSyncEventTable.connectorInstanceId, ConnectorInstanceTable.id))
+    .where(eq(ConnectorInstanceTable.organizationId, input.context.organizationContext.organization.id))
+    .orderBy(desc(ConnectorSyncEventTable.startedAt), desc(ConnectorSyncEventTable.id))
+
+  const filtered: ReturnType<typeof serializeConnectorSyncEvent>[] = []
+  for (const row of rows) {
+    const role = await resolvePluginArchResourceRole({ context: input.context, resourceId: row.instance.id, resourceKind: "connector_instance" })
+    if (!role) continue
+    if (input.connectorInstanceId && row.event.connectorInstanceId !== input.connectorInstanceId) continue
+    if (input.connectorTargetId && row.event.connectorTargetId !== input.connectorTargetId) continue
+    if (input.eventType && row.event.eventType !== input.eventType) continue
+    if (input.status && row.event.status !== input.status) continue
+    if (input.q && !`${row.event.externalEventRef ?? ""}\n${row.event.sourceRevisionRef ?? ""}`.toLowerCase().includes(input.q.toLowerCase())) continue
+    filtered.push(serializeConnectorSyncEvent(row.event))
+  }
+  return pageItems(filtered, input.cursor, input.limit)
+}
+
+export async function getConnectorSyncEventDetail(context: PluginArchActorContext, connectorSyncEventId: ConnectorSyncEventId) {
+  const row = await getConnectorSyncEventRow(context.organizationContext.organization.id, connectorSyncEventId)
+  if (!row) throw new PluginArchRouteFailure(404, "connector_sync_event_not_found", "Connector sync event not found.")
+  await ensureVisibleConnectorInstance(context, row.connectorInstanceId)
+  return serializeConnectorSyncEvent(row)
+}
+
+export async function retryConnectorSyncEvent(input: { connectorSyncEventId: ConnectorSyncEventId; context: PluginArchActorContext }) {
+  const row = await getConnectorSyncEventRow(input.context.organizationContext.organization.id, input.connectorSyncEventId)
+  if (!row) throw new PluginArchRouteFailure(404, "connector_sync_event_not_found", "Connector sync event not found.")
+  await ensureEditableConnectorInstance(input.context, row.connectorInstanceId)
+  await db.update(ConnectorSyncEventTable).set({ completedAt: null, startedAt: new Date(), status: "queued" }).where(eq(ConnectorSyncEventTable.id, row.id))
+  return { id: row.id }
+}
+
+function githubConnectorAppConfig() {
+  try {
+    return getGithubConnectorAppConfig(env.githubConnectorApp)
+  } catch (error) {
+    if (error instanceof GithubConnectorConfigError) {
+      throw new PluginArchRouteFailure(409, "github_connector_app_not_configured", error.message)
+    }
+    throw error
+  }
+}
+
+export function consumeGithubInstallState(state: string) {
+  const parsed = verifyGithubInstallStateToken({ secret: env.betterAuthSecret, token: state })
+  if (!parsed) {
+    throw new PluginArchRouteFailure(400, "invalid_github_install_state", "GitHub install state is invalid or expired.")
+  }
+  return parsed
+}
+
+function wrapGithubConnectorError(error: unknown): never {
+  if (error instanceof PluginArchRouteFailure) {
+    throw error
+  }
+
+  if (error instanceof GithubConnectorConfigError) {
+    throw new PluginArchRouteFailure(409, "github_connector_app_not_configured", error.message)
+  }
+
+  if (error instanceof GithubConnectorRequestError) {
+    throw new PluginArchRouteFailure(409, "github_connector_request_failed", error.message)
+  }
+
+  throw error
+}
+
+function normalizeDiscoveryCursor(value: string | undefined) {
+  return value?.trim() || undefined
+}
+
+function discoveryStep(status: GithubConnectorDiscoveryStep["status"], id: GithubConnectorDiscoveryStep["id"], label: string): GithubConnectorDiscoveryStep {
+  return { id, label, status }
+}
+
+function buildGithubConnectorDiscoverySteps(input: {
+  classification: GithubDiscoveryClassification
+  discoveredPlugins: GithubDiscoveredPlugin[]
+}) {
+  return [
+    discoveryStep("completed", "read_repository_structure", "Read repository structure"),
+    discoveryStep(input.classification === "claude_marketplace_repo" ? "completed" : "warning", "check_marketplace_manifest", "Check for Claude marketplace manifest"),
+    discoveryStep(
+      input.classification === "claude_single_plugin_repo" || input.classification === "claude_multi_plugin_repo"
+        ? "completed"
+        : "warning",
+      "check_plugin_manifests",
+      "Check for plugin manifests",
+    ),
+    discoveryStep(input.discoveredPlugins.length > 0 ? "completed" : "warning", "prepare_discovered_plugins", "Prepare discovered plugins"),
+  ] satisfies GithubConnectorDiscoveryStep[]
+}
+
+function buildGithubDiscoveryImportPlans(input: { discoveredPlugins: GithubDiscoveredPlugin[]; treeEntries: GithubDiscoveryTreeEntry[] }) {
+  return Object.fromEntries(input.discoveredPlugins.map((plugin) => [
+    plugin.key,
+    discoveryMappingsForPlugin(plugin).map((mapping) => ({
+      objectType: mapping.objectType,
+      paths: importableGithubPathsForMapping({ mapping, treeEntries: input.treeEntries }).map((entry) => entry.path),
+      selector: mapping.selector,
+    } satisfies GithubDiscoveryImportPlan)),
+  ])) satisfies Record<string, GithubDiscoveryImportPlan[]>
+}
+
+function readGithubDiscoveryCache(config: Record<string, unknown> | null) {
+  const cache = config && isRecord(config.githubDiscoveryCache) ? config.githubDiscoveryCache : null
+  if (!cache) {
+    return null
+  }
+
+  const repositoryFullName = typeof cache.repositoryFullName === "string" ? cache.repositoryFullName : null
+  const branch = typeof cache.branch === "string" ? cache.branch : null
+  const ref = typeof cache.ref === "string" ? cache.ref : null
+  const sourceRevisionRef = typeof cache.sourceRevisionRef === "string" ? cache.sourceRevisionRef : null
+  const discoveredPlugins = Array.isArray(cache.discoveredPlugins) ? cache.discoveredPlugins as GithubDiscoveredPlugin[] : null
+  const warnings = Array.isArray(cache.warnings) ? cache.warnings.filter((entry): entry is string => typeof entry === "string") : null
+  const treeSummary = isRecord(cache.treeSummary) ? cache.treeSummary as GithubConnectorDiscoveryTreeSummary : null
+  const importPlansByPluginKey = isRecord(cache.importPlansByPluginKey)
+    ? cache.importPlansByPluginKey as Record<string, GithubDiscoveryImportPlan[]>
+    : null
+  const classification = typeof cache.classification === "string" ? cache.classification as GithubDiscoveryClassification : null
+
+  if (!repositoryFullName || !branch || !ref || !sourceRevisionRef || !discoveredPlugins || !warnings || !treeSummary || !importPlansByPluginKey || !classification) {
+    return null
+  }
+
+  return {
+    branch,
+    classification,
+    discoveredPlugins,
+    importPlansByPluginKey,
+    marketplace: isRecord(cache.marketplace) || cache.marketplace === null ? cache.marketplace as GithubMarketplaceInfo | null : null,
+    ref,
+    repositoryFullName,
+    sourceRevisionRef,
+    treeSummary,
+    warnings,
+  } satisfies GithubDiscoveryCacheEntry
+}
+
+function withGithubDiscoveryCache(config: Record<string, unknown>, cache: GithubDiscoveryCacheEntry) {
+  return {
+    ...config,
+    githubDiscoveryCache: cache,
+  }
+}
+
+async function getGithubDiscoveryContext(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const connectorInstance = await ensureVisibleConnectorInstance(input.context, input.connectorInstanceId)
+  if (connectorInstance.connectorType !== "github") {
+    throw new PluginArchRouteFailure(409, "github_connector_instance_required", "Connector instance is not a GitHub connector.")
+  }
+
+  const connectorAccount = await getConnectorAccountRow(input.context.organizationContext.organization.id, connectorInstance.connectorAccountId)
+  if (!connectorAccount || connectorAccount.connectorType !== "github") {
+    throw new PluginArchRouteFailure(404, "connector_account_not_found", "GitHub connector account not found.")
+  }
+
+  const targetRows = await db
+    .select()
+    .from(ConnectorTargetTable)
+    .where(eq(ConnectorTargetTable.connectorInstanceId, connectorInstance.id))
+    .orderBy(asc(ConnectorTargetTable.createdAt), asc(ConnectorTargetTable.id))
+    .limit(1)
+  const connectorTarget = targetRows[0] ?? null
+  if (!connectorTarget) {
+    throw new PluginArchRouteFailure(404, "connector_target_not_found", "GitHub connector target not found.")
+  }
+
+  const targetConfig = connectorTarget.targetConfigJson && typeof connectorTarget.targetConfigJson === "object"
+    ? connectorTarget.targetConfigJson as Record<string, unknown>
+    : {}
+  const repositoryFullName = typeof targetConfig.repositoryFullName === "string" ? targetConfig.repositoryFullName.trim() : connectorTarget.remoteId.trim()
+  const branch = typeof targetConfig.branch === "string" ? targetConfig.branch.trim() : connectorTarget.externalTargetRef?.trim() ?? ""
+  const ref = typeof targetConfig.ref === "string" ? targetConfig.ref.trim() : branch ? `refs/heads/${branch}` : ""
+  const installationId = typeof connectorInstance.instanceConfigJson === "object" && connectorInstance.instanceConfigJson && typeof (connectorInstance.instanceConfigJson as Record<string, unknown>).installationId === "number"
+    ? (connectorInstance.instanceConfigJson as Record<string, unknown>).installationId as number
+    : Number(connectorAccount.remoteId)
+
+  if (!repositoryFullName || !branch || !ref || !Number.isFinite(installationId) || installationId <= 0) {
+    throw new PluginArchRouteFailure(409, "invalid_github_connector_target", "GitHub connector target is missing repository, branch, or installation metadata.")
+  }
+
+  const instanceConfigRecord = typeof connectorInstance.instanceConfigJson === "object" && connectorInstance.instanceConfigJson
+    ? connectorInstance.instanceConfigJson as Record<string, unknown>
+    : null
+  const autoImportSaved = instanceConfigRecord ? instanceConfigRecord.autoImportNewPlugins : undefined
+  return {
+    autoImportNewPlugins: typeof autoImportSaved === "boolean" ? autoImportSaved : true,
+    branch,
+    connectorAccount,
+    connectorInstance,
+    connectorTarget,
+    installationId,
+    ref,
+    repositoryFullName,
+  }
+}
+
+async function buildConnectorAutomationContext(input: { connectorInstance: ConnectorInstanceRow }) {
+  const organizationRows = await db
+    .select()
+    .from(OrganizationTable)
+    .where(eq(OrganizationTable.id, input.connectorInstance.organizationId))
+    .limit(1)
+  const organization = organizationRows[0] as OrganizationRow | undefined
+  if (!organization) {
+    throw new PluginArchRouteFailure(404, "organization_not_found", "Organization not found for connector instance.")
+  }
+
+  const memberRows = await db
+    .select()
+    .from(MemberTable)
+    .where(and(
+      eq(MemberTable.organizationId, input.connectorInstance.organizationId),
+      eq(MemberTable.id, input.connectorInstance.createdByOrgMembershipId),
+    ))
+    .limit(1)
+  const member = memberRows[0] as MemberRow | undefined
+  if (!member) {
+    throw new PluginArchRouteFailure(404, "member_not_found", "Connector creator member not found.")
+  }
+
+  return {
+    memberTeams: [],
+    organizationContext: {
+      currentMember: {
+        createdAt: member.createdAt,
+        id: member.id,
+        isOwner: roleIncludesOwner(member.role),
+        role: member.role,
+        userId: member.userId,
+      },
+      invitations: [],
+      members: [],
+      organization: {
+        allowedEmailDomains: organization.allowedEmailDomains ?? null,
+        createdAt: organization.createdAt,
+        desktopAppRestrictions: organization.desktopAppRestrictions,
+        id: organization.id,
+        logo: organization.logo ?? null,
+        metadata: organization.metadata ? JSON.stringify(organization.metadata) : null,
+        name: organization.name,
+        slug: organization.slug,
+        updatedAt: organization.updatedAt,
+      },
+      roles: [],
+      teams: [],
+    },
+  } satisfies PluginArchActorContext
+}
+
+async function maybeAutoImportGithubConnectorInstance(input: {
+  connectorInstance: ConnectorInstanceRow
+  connectorTarget: ConnectorTargetRow
+}) {
+  const instanceConfig = input.connectorInstance.instanceConfigJson && typeof input.connectorInstance.instanceConfigJson === "object"
+    ? input.connectorInstance.instanceConfigJson as Record<string, unknown>
+    : {}
+  if (instanceConfig.autoImportNewPlugins !== true) {
+    return { autoImported: false as const, createdPluginCount: 0, materializedConfigObjectCount: 0 }
+  }
+
+  const context = await buildConnectorAutomationContext({ connectorInstance: input.connectorInstance })
+  const discovery = await resolveGithubConnectorDiscovery({
+    connectorInstanceId: input.connectorInstance.id,
+    context,
+  })
+  const selectedKeys = discovery.cache.discoveredPlugins
+    .filter((plugin) => plugin.supported)
+    .map((plugin) => plugin.key)
+
+  const applied = await applyGithubConnectorDiscovery({
+    autoImportNewPlugins: true,
+    connectorInstanceId: input.connectorInstance.id,
+    context,
+    selectedKeys,
+  })
+
+  return {
+    autoImported: true as const,
+    createdPluginCount: applied.createdPlugins.length,
+    materializedConfigObjectCount: applied.materializedConfigObjects.length,
+  }
+}
+
+async function getGithubDiscoveryFileTexts(input: {
+  branch: string
+  config: ReturnType<typeof githubConnectorAppConfig>
+  installationId: number
+  repositoryFullName: string
+  token?: string
+  treeEntries: GithubDiscoveryTreeEntry[]
+}) {
+  const interestingPaths = new Set<string>()
+  const knownPaths = new Set(input.treeEntries.map((entry) => entry.path))
+
+  if (knownPaths.has(".claude-plugin/marketplace.json")) {
+    interestingPaths.add(".claude-plugin/marketplace.json")
+  }
+
+  for (const entry of input.treeEntries) {
+    if (entry.path.endsWith(".claude-plugin/plugin.json") || entry.path.endsWith("/plugin.json") || entry.path === "plugin.json") {
+      interestingPaths.add(entry.path)
+    }
+  }
+
+  const fileTextByPath: Record<string, string | null> = {}
+  for (const path of interestingPaths) {
+    try {
+      fileTextByPath[path] = await getGithubRepositoryTextFile({
+        config: input.config,
+        installationId: input.installationId,
+        path,
+        ref: input.branch,
+        repositoryFullName: input.repositoryFullName,
+        token: input.token,
+      })
+    } catch (error) {
+      wrapGithubConnectorError(error)
+    }
+  }
+
+  return fileTextByPath
+}
+
+function pagedGithubDiscoveryTree(input: { cursor?: string; entries: GithubDiscoveryTreeEntry[]; limit?: number; prefix?: string }) {
+  const normalizedPrefix = input.prefix?.trim().replace(/^\/+/, "").replace(/\/+$/, "")
+  const filtered = input.entries
+    .filter((entry) => !normalizedPrefix || entry.path === normalizedPrefix || entry.path.startsWith(`${normalizedPrefix}/`))
+    .sort((left, right) => left.path.localeCompare(right.path))
+  return pageItems(filtered, normalizeDiscoveryCursor(input.cursor), input.limit)
+}
+
+async function computeGithubDiscoverySnapshot(input: {
+  branch: string
+  installationId: number
+  ref: string
+  repositoryFullName: string
+  token?: string
+}) {
+  const token = input.token ?? await getGithubInstallationAccessToken({
+    config: githubConnectorAppConfig(),
+    installationId: input.installationId,
+  })
+  let treeSnapshot: Awaited<ReturnType<typeof getGithubRepositoryTree>>
+  try {
+    treeSnapshot = await getGithubRepositoryTree({
+      branch: input.branch,
+      config: githubConnectorAppConfig(),
+      installationId: input.installationId,
+      repositoryFullName: input.repositoryFullName,
+      token,
+    })
+  } catch (error) {
+    wrapGithubConnectorError(error)
+  }
+
+  const fileTextByPath = await getGithubDiscoveryFileTexts({
+    branch: input.branch,
+    config: githubConnectorAppConfig(),
+    installationId: input.installationId,
+    repositoryFullName: input.repositoryFullName,
+    token,
+    treeEntries: treeSnapshot.treeEntries,
+  })
+  const discovery = buildGithubRepoDiscovery({
+    entries: treeSnapshot.treeEntries,
+    fileTextByPath,
+  })
+
+  return {
+    branch: input.branch,
+    classification: discovery.classification,
+    discoveredPlugins: discovery.discoveredPlugins,
+    importPlansByPluginKey: buildGithubDiscoveryImportPlans({
+      discoveredPlugins: discovery.discoveredPlugins,
+      treeEntries: treeSnapshot.treeEntries,
+    }),
+    marketplace: discovery.marketplace,
+    ref: input.ref,
+    repositoryFullName: input.repositoryFullName,
+    sourceRevisionRef: treeSnapshot.headSha,
+    treeEntries: treeSnapshot.treeEntries,
+    treeSummary: {
+      scannedEntryCount: treeSnapshot.treeEntries.length,
+      strategy: "git-tree-recursive",
+      truncated: treeSnapshot.truncated,
+    } satisfies GithubConnectorDiscoveryTreeSummary,
+    warnings: discovery.warnings,
+  } satisfies GithubDiscoverySnapshot
+}
+
+async function computeGithubConnectorDiscovery(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext; token?: string }) {
+  const discoveryContext = await getGithubDiscoveryContext(input)
+  const snapshot = await computeGithubDiscoverySnapshot({
+    branch: discoveryContext.branch,
+    installationId: discoveryContext.installationId,
+    ref: discoveryContext.ref,
+    repositoryFullName: discoveryContext.repositoryFullName,
+    token: input.token,
+  })
+
+  return {
+    ...snapshot,
+    connectorInstance: serializeConnectorInstance(discoveryContext.connectorInstance),
+    connectorTarget: serializeConnectorTarget(discoveryContext.connectorTarget),
+  } satisfies GithubConnectorDiscoveryComputation
+}
+
+async function persistGithubConnectorDiscoveryCache(input: {
+  cache: GithubDiscoveryCacheEntry
+  connectorTargetId: ConnectorTargetId
+  context: PluginArchActorContext
+}) {
+  const target = await getConnectorTargetRow(input.context.organizationContext.organization.id, input.connectorTargetId)
+  if (!target) {
+    return
+  }
+
+  const targetConfig = target.targetConfigJson && typeof target.targetConfigJson === "object"
+    ? target.targetConfigJson as Record<string, unknown>
+    : {}
+  await updateConnectorTarget({
+    config: withGithubDiscoveryCache(targetConfig, input.cache),
+    connectorTargetId: target.id,
+    context: input.context,
+    externalTargetRef: target.externalTargetRef,
+    remoteId: target.remoteId,
+  })
+}
+
+async function resolveGithubConnectorDiscovery(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const discoveryContext = await getGithubDiscoveryContext(input)
+  const targetConfig = discoveryContext.connectorTarget.targetConfigJson && typeof discoveryContext.connectorTarget.targetConfigJson === "object"
+    ? discoveryContext.connectorTarget.targetConfigJson as Record<string, unknown>
+    : null
+  const cached = readGithubDiscoveryCache(targetConfig)
+  if (cached
+    && cached.branch === discoveryContext.branch
+    && cached.ref === discoveryContext.ref
+    && cached.repositoryFullName === discoveryContext.repositoryFullName) {
+    return {
+      autoImportNewPlugins: discoveryContext.autoImportNewPlugins,
+      cache: cached,
+      connectorInstance: serializeConnectorInstance(discoveryContext.connectorInstance),
+      connectorTarget: serializeConnectorTarget(discoveryContext.connectorTarget),
+    }
+  }
+
+  const computed = await computeGithubConnectorDiscovery(input)
+  const cache = {
+    branch: computed.branch,
+    classification: computed.classification,
+    discoveredPlugins: computed.discoveredPlugins,
+    importPlansByPluginKey: computed.importPlansByPluginKey,
+    marketplace: computed.marketplace,
+    ref: computed.ref,
+    repositoryFullName: computed.repositoryFullName,
+    sourceRevisionRef: computed.sourceRevisionRef,
+    treeSummary: computed.treeSummary,
+    warnings: computed.warnings,
+  } satisfies GithubDiscoveryCacheEntry
+  await persistGithubConnectorDiscoveryCache({
+    cache,
+    connectorTargetId: computed.connectorTarget.id,
+    context: input.context,
+  })
+  return {
+    autoImportNewPlugins: discoveryContext.autoImportNewPlugins,
+    cache,
+    connectorInstance: computed.connectorInstance,
+    connectorTarget: computed.connectorTarget,
+  }
+}
+
+function discoveryMappingsForPlugin(plugin: GithubDiscoveredPlugin) {
+  return [
+    ...plugin.componentPaths.skills.map((selector) => ({ objectType: "skill" as const, selector: `${selector}/**` })),
+    ...plugin.componentPaths.commands.map((selector) => ({ objectType: "command" as const, selector: `${selector}/**` })),
+    ...plugin.componentPaths.agents.map((selector) => ({ objectType: "agent" as const, selector: `${selector}/**` })),
+    ...plugin.componentPaths.hooks.map((selector) => ({ objectType: "hook" as const, selector })),
+    ...plugin.componentPaths.mcpServers.map((selector) => ({ objectType: "mcp" as const, selector })),
+  ]
+}
+
+function mappingSelectorMatchesPath(selector: string, path: string) {
+  const normalizedSelector = selector.trim().replace(/^\/+/, "")
+  const normalizedPath = path.trim().replace(/^\/+/, "")
+  if (normalizedSelector.endsWith("/**")) {
+    const prefix = normalizedSelector.slice(0, -3)
+    return normalizedPath.startsWith(`${prefix}/`)
+  }
+  return normalizedPath === normalizedSelector
+}
+
+function importableGithubPathsForMapping(input: {
+  mapping: Pick<ReturnType<typeof serializeConnectorMapping>, "objectType" | "selector">
+  treeEntries: GithubDiscoveryTreeEntry[]
+}) {
+  const matchingBlobs = input.treeEntries
+    .filter((entry) => entry.kind === "blob")
+    .filter((entry) => mappingSelectorMatchesPath(input.mapping.selector, entry.path))
+
+  if (input.mapping.objectType === "skill") {
+    const preferred = matchingBlobs.filter((entry) => entry.path.endsWith("/SKILL.md"))
+    return preferred.length > 0 ? preferred : matchingBlobs.filter((entry) => entry.path.endsWith(".md"))
+  }
+  if (input.mapping.objectType === "agent") {
+    const preferred = matchingBlobs.filter((entry) => entry.path.endsWith("/AGENT.md"))
+    return preferred.length > 0 ? preferred : matchingBlobs.filter((entry) => entry.path.endsWith(".md"))
+  }
+  if (input.mapping.objectType === "command") {
+    return matchingBlobs.filter((entry) => entry.path.endsWith(".md"))
+  }
+  return matchingBlobs
+}
+
+function parseMarkdownFrontmatter(rawSourceText: string): { body: string; data: Record<string, string> } {
+  const match = rawSourceText.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
+  if (!match) {
+    return { body: rawSourceText, data: {} }
+  }
+
+  const [, yaml, body] = match
+  const data: Record<string, string> = {}
+  for (const line of yaml.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith("#")) continue
+    const colonIndex = trimmed.indexOf(":")
+    if (colonIndex === -1) continue
+    const key = trimmed.slice(0, colonIndex).trim()
+    let value = trimmed.slice(colonIndex + 1).trim()
+    if (value.length > 1) {
+      const first = value[0]
+      const last = value[value.length - 1]
+      if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        value = value.slice(1, -1)
+      }
+    }
+    if (!key || !value) continue
+    data[key] = value
+  }
+  return { body: body ?? "", data }
+}
+
+function importedObjectMetadata(input: { objectType: ConnectorMappingRow["objectType"]; path: string; rawSourceText: string }) {
+  const pathSegments = input.path.split("/")
+  const fileName = pathSegments[pathSegments.length - 1] ?? input.path
+  const parentName = pathSegments[pathSegments.length - 2] ?? pathSegments[pathSegments.length - 1] ?? "Imported"
+  const nameFromFile = fileName.replace(/\.[^.]+$/, "")
+  const preferredName = input.objectType === "skill" || input.objectType === "agent"
+    ? (fileName.toUpperCase() === "SKILL.MD" || fileName.toUpperCase() === "AGENT.MD" ? parentName : nameFromFile)
+    : nameFromFile
+
+  const isMarkdown = fileName.toLowerCase().endsWith(".md") || fileName.toLowerCase().endsWith(".mdx")
+  const frontmatter = isMarkdown ? parseMarkdownFrontmatter(input.rawSourceText) : null
+  const frontmatterName = frontmatter?.data.name ?? frontmatter?.data.title
+  const frontmatterDescription = frontmatter?.data.description ?? frontmatter?.data.summary
+
+  const metadata: Record<string, unknown> = {
+    name: frontmatterName?.trim() || preferredName,
+    relativePath: input.path,
+  }
+  if (frontmatterDescription?.trim()) {
+    metadata.description = frontmatterDescription.trim()
+  }
+  if (frontmatter && Object.keys(frontmatter.data).length > 0) {
+    metadata.frontmatter = frontmatter.data
+  }
+
+  return {
+    metadata,
+    normalizedPayloadJson: (() => {
+      if (!fileName.endsWith(".json")) {
+        return undefined
+      }
+      try {
+        const parsed = JSON.parse(input.rawSourceText) as unknown
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed as Record<string, unknown> : undefined
+      } catch {
+        return undefined
+      }
+    })(),
+  }
+}
+
+async function materializeGithubImportedObject(input: {
+  connectorInstance: ReturnType<typeof serializeConnectorInstance>
+  connectorMapping: ReturnType<typeof serializeConnectorMapping>
+  connectorTarget: ReturnType<typeof serializeConnectorTarget>
+  context: PluginArchActorContext
+  externalLocator: string
+  rawSourceText: string
+  sourceRevisionRef: string
+}) {
+  const organizationId = input.context.organizationContext.organization.id
+  const createdByOrgMembershipId = input.context.organizationContext.currentMember.id
+  const now = new Date()
+  const metadata = importedObjectMetadata({
+    objectType: input.connectorMapping.objectType,
+    path: input.externalLocator,
+    rawSourceText: input.rawSourceText,
+  })
+  const frontmatterRecord = metadata.metadata && typeof metadata.metadata.frontmatter === "object"
+    ? metadata.metadata.frontmatter as Record<string, unknown>
+    : null
+  const hasFrontmatter = frontmatterRecord && Object.keys(frontmatterRecord).length > 0
+  const projectionRawSource = hasFrontmatter
+    ? parseMarkdownFrontmatter(input.rawSourceText).body
+    : input.rawSourceText
+  const projection = deriveProjection({
+    objectType: input.connectorMapping.objectType,
+    value: {
+      metadata: metadata.metadata,
+      normalizedPayloadJson: metadata.normalizedPayloadJson,
+      rawSourceText: projectionRawSource,
+    },
+  })
+  const fileName = input.externalLocator.split("/").filter(Boolean).at(-1) ?? input.externalLocator
+  const fileExtension = fileName.includes(".") ? fileName.split(".").at(-1) ?? null : null
+
+  const existingBinding = await db
+    .select()
+    .from(ConnectorSourceBindingTable)
+    .where(and(
+      eq(ConnectorSourceBindingTable.organizationId, organizationId),
+      eq(ConnectorSourceBindingTable.connectorMappingId, input.connectorMapping.id),
+      eq(ConnectorSourceBindingTable.externalLocator, input.externalLocator),
+      isNull(ConnectorSourceBindingTable.deletedAt),
+    ))
+    .limit(1)
+
+  if (!existingBinding[0]) {
+    const configObjectId = createDenTypeId("configObject")
+    const versionId = createDenTypeId("configObjectVersion")
+    await db.transaction(async (tx) => {
+      await tx.insert(ConfigObjectTable).values({
+        connectorInstanceId: input.connectorInstance.id,
+        createdAt: now,
+        createdByOrgMembershipId,
+        currentFileExtension: normalizeOptionalString(fileExtension ?? undefined),
+        currentFileName: fileName,
+        currentRelativePath: input.externalLocator,
+        deletedAt: null,
+        description: projection.description,
+        id: configObjectId,
+        objectType: input.connectorMapping.objectType,
+        organizationId,
+        searchText: projection.searchText,
+        sourceMode: "connector",
+        status: "active",
+        title: projection.title,
+        updatedAt: now,
+      })
+
+      await tx.insert(ConfigObjectVersionTable).values({
+        configObjectId,
+        connectorSyncEventId: null,
+        createdAt: now,
+        createdByOrgMembershipId,
+        createdVia: "connector",
+        id: versionId,
+        isDeletedVersion: false,
+        normalizedPayloadJson: metadata.normalizedPayloadJson ?? null,
+        organizationId,
+        rawSourceText: normalizeOptionalString(input.rawSourceText),
+        schemaVersion: null,
+        sourceRevisionRef: input.sourceRevisionRef,
+      })
+
+      await tx.insert(ConfigObjectAccessGrantTable).values({
+        configObjectId,
+        createdAt: now,
+        createdByOrgMembershipId,
+        id: createDenTypeId("configObjectAccessGrant"),
+        organizationId,
+        orgMembershipId: createdByOrgMembershipId,
+        orgWide: false,
+        role: "manager",
+        teamId: null,
+      })
+
+      if (input.connectorMapping.pluginId) {
+        await tx.insert(PluginConfigObjectTable).values({
+          configObjectId,
+          connectorMappingId: input.connectorMapping.id,
+          createdAt: now,
+          createdByOrgMembershipId,
+          id: createDenTypeId("pluginConfigObject"),
+          membershipSource: "connector",
+          organizationId,
+          pluginId: input.connectorMapping.pluginId,
+          removedAt: null,
+        })
+      }
+
+      await tx.insert(ConnectorSourceBindingTable).values({
+        configObjectId,
+        connectorInstanceId: input.connectorInstance.id,
+        connectorMappingId: input.connectorMapping.id,
+        connectorTargetId: input.connectorTarget.id,
+        connectorType: input.connectorTarget.connectorType,
+        createdAt: now,
+        deletedAt: null,
+        externalLocator: input.externalLocator,
+        externalStableRef: input.externalLocator,
+        id: createDenTypeId("connectorSourceBinding"),
+        lastSeenSourceRevisionRef: input.sourceRevisionRef,
+        organizationId,
+        remoteId: input.connectorTarget.remoteId,
+        status: "active",
+        updatedAt: now,
+      })
+    })
+
+    return getConfigObjectDetail(input.context, configObjectId)
+  }
+
+  const binding = existingBinding[0]
+  if (binding.lastSeenSourceRevisionRef !== input.sourceRevisionRef) {
+    const versionId = createDenTypeId("configObjectVersion")
+    await db.transaction(async (tx) => {
+      await tx.update(ConfigObjectTable).set({
+        currentFileExtension: normalizeOptionalString(fileExtension ?? undefined),
+        currentFileName: fileName,
+        currentRelativePath: input.externalLocator,
+        description: projection.description,
+        searchText: projection.searchText,
+        status: "active",
+        title: projection.title,
+        updatedAt: now,
+      }).where(eq(ConfigObjectTable.id, binding.configObjectId))
+
+      await tx.insert(ConfigObjectVersionTable).values({
+        configObjectId: binding.configObjectId,
+        connectorSyncEventId: null,
+        createdAt: now,
+        createdByOrgMembershipId,
+        createdVia: "connector",
+        id: versionId,
+        isDeletedVersion: false,
+        normalizedPayloadJson: metadata.normalizedPayloadJson ?? null,
+        organizationId,
+        rawSourceText: normalizeOptionalString(input.rawSourceText),
+        schemaVersion: null,
+        sourceRevisionRef: input.sourceRevisionRef,
+      })
+
+      if (input.connectorMapping.pluginId) {
+        const membership = await tx
+          .select({ id: PluginConfigObjectTable.id })
+          .from(PluginConfigObjectTable)
+          .where(and(
+            eq(PluginConfigObjectTable.pluginId, input.connectorMapping.pluginId),
+            eq(PluginConfigObjectTable.configObjectId, binding.configObjectId),
+          ))
+          .limit(1)
+        if (membership[0]) {
+          await tx.update(PluginConfigObjectTable).set({
+            connectorMappingId: input.connectorMapping.id,
+            membershipSource: "connector",
+            removedAt: null,
+          }).where(eq(PluginConfigObjectTable.id, membership[0].id))
+        } else {
+          await tx.insert(PluginConfigObjectTable).values({
+            configObjectId: binding.configObjectId,
+            connectorMappingId: input.connectorMapping.id,
+            createdAt: now,
+            createdByOrgMembershipId,
+            id: createDenTypeId("pluginConfigObject"),
+            membershipSource: "connector",
+            organizationId,
+            pluginId: input.connectorMapping.pluginId,
+            removedAt: null,
+          })
+        }
+      }
+
+      await tx.update(ConnectorSourceBindingTable).set({
+        deletedAt: null,
+        lastSeenSourceRevisionRef: input.sourceRevisionRef,
+        status: "active",
+        updatedAt: now,
+      }).where(eq(ConnectorSourceBindingTable.id, binding.id))
+    })
+  }
+
+  return getConfigObjectDetail(input.context, binding.configObjectId)
+}
+
+async function materializeGithubImportPlans(input: {
+  connectorInstance: ReturnType<typeof serializeConnectorInstance>
+  connectorTarget: ReturnType<typeof serializeConnectorTarget>
+  context: PluginArchActorContext
+  importPlans: Array<{ mapping: ReturnType<typeof serializeConnectorMapping>; paths: string[] }>
+  sourceRevisionRef: string
+}) {
+  const config = githubConnectorAppConfig()
+  const targetConfig = input.connectorTarget.targetConfigJson && typeof input.connectorTarget.targetConfigJson === "object"
+    ? input.connectorTarget.targetConfigJson as Record<string, unknown>
+    : {}
+  const branch = typeof targetConfig.branch === "string" ? targetConfig.branch : input.connectorTarget.externalTargetRef ?? ""
+  const installationId = typeof input.connectorInstance.instanceConfigJson === "object" && input.connectorInstance.instanceConfigJson && typeof (input.connectorInstance.instanceConfigJson as Record<string, unknown>).installationId === "number"
+    ? (input.connectorInstance.instanceConfigJson as Record<string, unknown>).installationId as number
+    : null
+  const repositoryFullName = typeof targetConfig.repositoryFullName === "string" ? targetConfig.repositoryFullName : input.connectorTarget.remoteId
+  if (!installationId || !branch || !repositoryFullName) {
+    throw new PluginArchRouteFailure(409, "invalid_github_materialization_context", "GitHub connector target is missing required materialization context.")
+  }
+
+  const token = await getGithubInstallationAccessToken({
+    config,
+    installationId,
+  })
+  const materializedConfigObjects: ReturnType<typeof serializeConfigObject>[] = []
+  for (const plan of input.importPlans) {
+    for (const path of plan.paths) {
+      let rawSourceText: string | null
+      try {
+        rawSourceText = await getGithubRepositoryTextFile({
+          config,
+          installationId,
+          path,
+          ref: branch,
+          repositoryFullName,
+          token,
+        })
+      } catch (error) {
+        wrapGithubConnectorError(error)
+      }
+      if (!rawSourceText) {
+        continue
+      }
+      materializedConfigObjects.push(await materializeGithubImportedObject({
+        connectorInstance: input.connectorInstance,
+        connectorMapping: plan.mapping,
+        connectorTarget: input.connectorTarget,
+        context: input.context,
+        externalLocator: path,
+        rawSourceText,
+        sourceRevisionRef: input.sourceRevisionRef,
+      }))
+    }
+  }
+
+  return materializedConfigObjects
+}
+
+async function ensureDiscoveryPlugin(input: { context: PluginArchActorContext; description: string | null; name: string }) {
+  const existing = await db
+    .select()
+    .from(PluginTable)
+    .where(and(
+      eq(PluginTable.organizationId, input.context.organizationContext.organization.id),
+      eq(PluginTable.name, input.name.trim()),
+      isNull(PluginTable.deletedAt),
+    ))
+    .orderBy(asc(PluginTable.createdAt), asc(PluginTable.id))
+    .limit(1)
+
+  if (existing[0]) {
+    return serializePlugin(existing[0], 0)
+  }
+
+  return createPlugin({
+    context: input.context,
+    description: input.description,
+    name: input.name,
+  })
+}
+
+async function ensureDiscoveryMarketplace(input: { context: PluginArchActorContext; description: string | null; name: string }) {
+  const existing = await db
+    .select()
+    .from(MarketplaceTable)
+    .where(and(
+      eq(MarketplaceTable.organizationId, input.context.organizationContext.organization.id),
+      eq(MarketplaceTable.name, input.name.trim()),
+      isNull(MarketplaceTable.deletedAt),
+    ))
+    .orderBy(asc(MarketplaceTable.createdAt), asc(MarketplaceTable.id))
+    .limit(1)
+
+  if (existing[0]) {
+    return serializeMarketplace(existing[0], 0)
+  }
+
+  return createMarketplace({
+    context: input.context,
+    description: input.description,
+    name: input.name,
+  })
+}
+
+async function ensureDiscoveryMapping(input: {
+  connectorTargetId: ConnectorTargetId
+  context: PluginArchActorContext
+  objectType: ConnectorMappingRow["objectType"]
+  pluginId: PluginId
+  selector: string
+}) {
+  const existing = await db
+    .select()
+    .from(ConnectorMappingTable)
+    .where(and(
+      eq(ConnectorMappingTable.connectorTargetId, input.connectorTargetId),
+      eq(ConnectorMappingTable.mappingKind, "path"),
+      eq(ConnectorMappingTable.objectType, input.objectType),
+      eq(ConnectorMappingTable.pluginId, input.pluginId),
+      eq(ConnectorMappingTable.selector, input.selector),
+    ))
+    .limit(1)
+
+  if (existing[0]) {
+    return serializeConnectorMapping(existing[0])
+  }
+
+  return createConnectorMapping({
+    autoAddToPlugin: true,
+    config: {
+      discoverySourceKind: input.objectType,
+    },
+    connectorTargetId: input.connectorTargetId,
+    context: input.context,
+    mappingKind: "path",
+    objectType: input.objectType,
+    pluginId: input.pluginId,
+    selector: input.selector,
+  })
+}
+
+export async function createGithubConnectorAccount(input: { accountLogin: string; accountType: "Organization" | "User"; context: PluginArchActorContext; displayName: string; installationId: number }) {
+  return createConnectorAccount({
+    connectorType: "github",
+    context: input.context,
+    displayName: input.displayName,
+    metadata: {
+      accountLogin: input.accountLogin,
+      accountType: input.accountType,
+      repositories: [],
+      repositorySelection: "all",
+      settingsUrl: null,
+    },
+    remoteId: String(input.installationId),
+  })
+}
+
+async function upsertGithubConnectorAccountFromInstallation(input: { context: PluginArchActorContext; installationId: number }) {
+  let installation: Awaited<ReturnType<typeof getGithubInstallationSummary>>
+  try {
+    installation = await getGithubInstallationSummary({
+      config: githubConnectorAppConfig(),
+      installationId: input.installationId,
+    })
+  } catch (error) {
+    wrapGithubConnectorError(error)
+  }
+  const organizationId = input.context.organizationContext.organization.id
+  const existingRows = await db
+    .select()
+    .from(ConnectorAccountTable)
+    .where(and(
+      eq(ConnectorAccountTable.organizationId, organizationId),
+      eq(ConnectorAccountTable.connectorType, "github"),
+      eq(ConnectorAccountTable.remoteId, String(input.installationId)),
+    ))
+    .limit(1)
+
+  const metadata = {
+    accountLogin: installation.accountLogin,
+    accountType: installation.accountType,
+    repositories: [],
+    repositorySelection: installation.repositorySelection,
+    settingsUrl: installation.settingsUrl,
+  }
+
+  if (!existingRows[0]) {
+    return createConnectorAccount({
+      connectorType: "github",
+      context: input.context,
+      displayName: installation.displayName,
+      externalAccountRef: installation.accountLogin,
+      metadata,
+      remoteId: String(input.installationId),
+    })
+  }
+
+  await db.update(ConnectorAccountTable).set({
+    displayName: installation.displayName,
+    externalAccountRef: installation.accountLogin,
+    metadataJson: {
+      ...(existingRows[0].metadataJson ?? {}),
+      ...metadata,
+    },
+    status: "active",
+    updatedAt: new Date(),
+  }).where(eq(ConnectorAccountTable.id, existingRows[0].id))
+
+  return getConnectorAccountDetail(input.context, existingRows[0].id)
+}
+
+export async function startGithubConnectorInstall(input: { context: PluginArchActorContext; returnPath: string }) {
+  const returnPath = input.returnPath.trim()
+  if (!returnPath.startsWith("/") || returnPath.startsWith("//")) {
+    throw new PluginArchRouteFailure(400, "invalid_return_path", "GitHub install return path must be a safe relative path.")
+  }
+
+  let app: Awaited<ReturnType<typeof getGithubAppSummary>>
+  try {
+    app = await getGithubAppSummary({ config: githubConnectorAppConfig() })
+  } catch (error) {
+    wrapGithubConnectorError(error)
+  }
+  const state = createGithubInstallStateToken({
+    orgId: input.context.organizationContext.organization.id,
+    returnPath,
+    secret: env.betterAuthSecret,
+    userId: input.context.organizationContext.currentMember.userId,
+  })
+
+  return {
+    redirectUrl: buildGithubAppInstallUrl({ app, state }),
+    state,
+  }
+}
+
+export async function completeGithubConnectorInstall(input: { context: PluginArchActorContext; installationId: number; state: string }) {
+  const parsedState = consumeGithubInstallState(input.state)
+  if (parsedState.orgId !== input.context.organizationContext.organization.id) {
+    throw new PluginArchRouteFailure(409, "github_install_org_mismatch", "GitHub install state does not match the current organization.")
+  }
+  if (parsedState.userId !== input.context.organizationContext.currentMember.userId) {
+    throw new PluginArchRouteFailure(409, "github_install_user_mismatch", "GitHub install state does not match the current user.")
+  }
+
+  const connectorAccount = await upsertGithubConnectorAccountFromInstallation({
+    context: input.context,
+    installationId: input.installationId,
+  })
+
+  return {
+    connectorAccount,
+    // Keep install completion fast. The connected-account screen loads repositories next.
+    repositories: [],
+  }
+}
+
+export async function getGithubConnectorDiscovery(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext }) {
+  const discovery = await resolveGithubConnectorDiscovery(input)
+  return {
+    autoImportNewPlugins: discovery.autoImportNewPlugins,
+    classification: discovery.cache.classification,
+    connectorInstance: discovery.connectorInstance,
+    connectorTarget: discovery.connectorTarget,
+    discoveredPlugins: discovery.cache.discoveredPlugins,
+    repositoryFullName: discovery.cache.repositoryFullName,
+    sourceRevisionRef: discovery.cache.sourceRevisionRef,
+    steps: buildGithubConnectorDiscoverySteps({
+      classification: discovery.cache.classification,
+      discoveredPlugins: discovery.cache.discoveredPlugins,
+    }),
+    treeSummary: discovery.cache.treeSummary,
+    warnings: discovery.cache.warnings,
+  }
+}
+
+export async function getGithubConnectorDiscoveryTree(input: { connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext; cursor?: string; limit?: number; prefix?: string }) {
+  const discovery = await computeGithubConnectorDiscovery({ connectorInstanceId: input.connectorInstanceId, context: input.context })
+  return pagedGithubDiscoveryTree({
+    cursor: input.cursor,
+    entries: discovery.treeEntries,
+    limit: input.limit,
+    prefix: input.prefix,
+  })
+}
+
+export async function applyGithubConnectorDiscovery(input: { autoImportNewPlugins: boolean; connectorInstanceId: ConnectorInstanceId; context: PluginArchActorContext; selectedKeys: string[] }) {
+  const discovery = await resolveGithubConnectorDiscovery({ connectorInstanceId: input.connectorInstanceId, context: input.context })
+  const selectedKeySet = new Set(input.selectedKeys.map((key) => key.trim()).filter(Boolean))
+  const selectedPlugins = discovery.cache.discoveredPlugins.filter((plugin) => plugin.supported && selectedKeySet.has(plugin.key))
+  await db.update(ConnectorInstanceTable).set({
+    instanceConfigJson: {
+      ...((discovery.connectorInstance.instanceConfigJson && typeof discovery.connectorInstance.instanceConfigJson === "object")
+        ? discovery.connectorInstance.instanceConfigJson as Record<string, unknown>
+        : {}),
+      autoImportNewPlugins: input.autoImportNewPlugins,
+    },
+    updatedAt: new Date(),
+  }).where(eq(ConnectorInstanceTable.id, discovery.connectorInstance.id))
+
+  const marketplaceInfo = discovery.cache.marketplace
+  const marketplaceName = marketplaceInfo?.name?.trim() || discovery.cache.repositoryFullName
+  const marketplaceDescription = marketplaceInfo?.description?.trim()
+    ?? `Imported from GitHub marketplace repository ${discovery.cache.repositoryFullName}.`
+  const createdMarketplace = discovery.cache.classification === "claude_marketplace_repo"
+    ? await ensureDiscoveryMarketplace({
+        context: input.context,
+        description: marketplaceDescription,
+        name: marketplaceName,
+      })
+    : null
+
+  const plugins = [] as Array<ReturnType<typeof serializePlugin>>
+  const mappings = [] as Array<ReturnType<typeof serializeConnectorMapping>>
+  const importPlans = [] as Array<{ mapping: ReturnType<typeof serializeConnectorMapping>; paths: string[] }>
+  for (const discoveredPlugin of selectedPlugins) {
+    const plugin = await ensureDiscoveryPlugin({
+      context: input.context,
+      description: discoveredPlugin.description,
+      name: discoveredPlugin.displayName,
+    })
+    plugins.push(plugin)
+
+    if (createdMarketplace) {
+      await attachPluginToMarketplace({
+        context: input.context,
+        marketplaceId: createdMarketplace.id,
+        membershipSource: "connector",
+        pluginId: plugin.id,
+      })
+    }
+
+    for (const plan of discovery.cache.importPlansByPluginKey[discoveredPlugin.key] ?? []) {
+      const mapping = await ensureDiscoveryMapping({
+        connectorTargetId: discovery.connectorTarget.id,
+        context: input.context,
+        objectType: plan.objectType,
+        pluginId: plugin.id,
+        selector: plan.selector,
+      })
+      mappings.push(mapping)
+      importPlans.push({ mapping, paths: plan.paths })
+    }
+  }
+
+  const materializedConfigObjects = await materializeGithubImportPlans({
+    connectorInstance: discovery.connectorInstance,
+    connectorTarget: discovery.connectorTarget,
+    context: input.context,
+    importPlans,
+    sourceRevisionRef: discovery.cache.sourceRevisionRef,
+  })
+
+  return {
+    autoImportNewPlugins: input.autoImportNewPlugins,
+    createdMarketplace,
+    connectorInstance: discovery.connectorInstance,
+    connectorTarget: discovery.connectorTarget,
+    createdPlugins: plugins,
+    createdMappings: mappings,
+    materializedConfigObjects,
+    sourceRevisionRef: discovery.cache.sourceRevisionRef,
+  }
+}
+
+export async function listGithubRepositories(input: { connectorAccountId: ConnectorAccountId; context: PluginArchActorContext; cursor?: string; limit?: number; q?: string }) {
+  const account = await getConnectorAccountRow(input.context.organizationContext.organization.id, input.connectorAccountId)
+  if (!account) {
+    throw new PluginArchRouteFailure(404, "connector_account_not_found", "Connector account not found.")
+  }
+  if (account.connectorType !== "github") {
+    throw new PluginArchRouteFailure(409, "github_connector_account_required", "Connector account is not a GitHub account.")
+  }
+
+  const installationId = Number(account.remoteId)
+  if (!Number.isFinite(installationId) || installationId <= 0) {
+    throw new PluginArchRouteFailure(409, "invalid_github_installation_id", "Connector account does not have a valid GitHub installation id.")
+  }
+
+  let repositories: RepositorySummary[]
+  let installationSummary: Awaited<ReturnType<typeof getGithubInstallationSummary>>
+  try {
+    repositories = await listGithubInstallationRepositories({
+      config: githubConnectorAppConfig(),
+      installationId,
+    })
+    installationSummary = await getGithubInstallationSummary({
+      config: githubConnectorAppConfig(),
+      installationId,
+    })
+  } catch (error) {
+    wrapGithubConnectorError(error)
+  }
+
+  const existingMetadata = account.metadataJson && typeof account.metadataJson === "object"
+    ? account.metadataJson as Record<string, unknown>
+    : {}
+  await db.update(ConnectorAccountTable).set({
+    metadataJson: {
+      ...existingMetadata,
+      repositories: repositories.map((repository) => ({
+        defaultBranch: repository.defaultBranch,
+        fullName: repository.fullName,
+        hasPluginManifest: repository.hasPluginManifest ?? false,
+        id: repository.id,
+        manifestKind: repository.manifestKind ?? null,
+        marketplacePluginCount: repository.marketplacePluginCount ?? null,
+        private: repository.private,
+      })),
+      repositorySelection: installationSummary.repositorySelection,
+      settingsUrl: installationSummary.settingsUrl,
+    },
+    updatedAt: new Date(),
+  }).where(eq(ConnectorAccountTable.id, account.id))
+
+  const filtered = repositories
+    .filter((repository) => !input.q || `${repository.fullName}\n${repository.defaultBranch ?? ""}`.toLowerCase().includes(input.q.toLowerCase()))
+    .map((repository) => ({ ...repository, id: String(repository.id) }))
+  const page = pageItems(filtered, input.cursor, input.limit)
+  return {
+    items: page.items.map((repository) => ({
+      defaultBranch: repository.defaultBranch,
+      fullName: repository.fullName,
+      hasPluginManifest: Boolean(repository.hasPluginManifest),
+      id: Number(repository.id),
+      manifestKind: repository.manifestKind ?? null,
+      marketplacePluginCount: repository.marketplacePluginCount ?? null,
+      private: repository.private,
+    })),
+    nextCursor: page.nextCursor,
+  }
+}
+
+export async function validateGithubTarget(input: {
+  branch: string
+  config?: ReturnType<typeof githubConnectorAppConfig>
+  installationId: number
+  ref: string
+  repositoryFullName: string
+  repositoryId: number
+  token?: string
+}) {
+  try {
+    return await validateGithubInstallationTarget({
+      branch: input.branch,
+      config: input.config ?? githubConnectorAppConfig(),
+      installationId: input.installationId,
+      ref: input.ref,
+      repositoryFullName: input.repositoryFullName,
+      repositoryId: input.repositoryId,
+      token: input.token,
+    })
+  } catch (error) {
+    wrapGithubConnectorError(error)
+  }
+}
+
+export async function githubSetup(input: {
+  branch: string
+  connectorAccountId?: ConnectorAccountId
+  connectorInstanceName: string
+  context: PluginArchActorContext
+  installationId: number
+  mappings: Array<{ autoAddToPlugin: boolean; config?: Record<string, unknown>; mappingKind: ConnectorMappingRow["mappingKind"]; objectType: ConnectorMappingRow["objectType"]; pluginId?: PluginId | null; selector: string }>
+  ref: string
+  repositoryFullName: string
+  repositoryId: number
+}) {
+  const githubConfig = githubConnectorAppConfig()
+  const installationToken = await getGithubInstallationAccessToken({
+    config: githubConfig,
+    installationId: input.installationId,
+  })
+  const validation = await validateGithubTarget({
+    branch: input.branch,
+    config: githubConfig,
+    installationId: input.installationId,
+    ref: input.ref,
+    repositoryFullName: input.repositoryFullName,
+    repositoryId: input.repositoryId,
+    token: installationToken,
+  })
+  if (!validation.repositoryAccessible) {
+    throw new PluginArchRouteFailure(409, "github_repository_not_accessible", "GitHub repository is not accessible for this installation.")
+  }
+  if (!validation.branchExists) {
+    throw new PluginArchRouteFailure(409, "github_branch_not_found", "GitHub branch/ref could not be validated for this repository.")
+  }
+
+  const discovery = await computeGithubDiscoverySnapshot({
+    branch: input.branch,
+    installationId: input.installationId,
+    ref: input.ref,
+    repositoryFullName: input.repositoryFullName,
+    token: installationToken,
+  })
+
+  let connectorAccountId = input.connectorAccountId as ConnectorAccountId | undefined
+  let connectorAccountDetail = connectorAccountId ? await getConnectorAccountDetail(input.context, connectorAccountId) : null
+  if (!connectorAccountId || !connectorAccountDetail) {
+    connectorAccountDetail = await createGithubConnectorAccount({
+      accountLogin: input.repositoryFullName.split("/")[0] ?? input.repositoryFullName,
+      accountType: "Organization",
+      context: input.context,
+      displayName: input.repositoryFullName,
+      installationId: input.installationId,
+    })
+    connectorAccountId = connectorAccountDetail.id
+  }
+
+  const connectorInstance = await createConnectorInstance({
+    connectorAccountId,
+    connectorType: "github",
+    config: {
+      autoImportNewPlugins: true,
+      installationId: input.installationId,
+    },
+    context: input.context,
+    name: input.connectorInstanceName,
+    remoteId: input.repositoryFullName,
+  })
+
+  const connectorTarget = await createConnectorTarget({
+    config: withGithubDiscoveryCache({
+      branch: input.branch,
+      defaultBranch: validation.defaultBranch,
+      ref: input.ref,
+      repositoryFullName: input.repositoryFullName,
+      repositoryId: input.repositoryId,
+    }, {
+      branch: discovery.branch,
+      classification: discovery.classification,
+      discoveredPlugins: discovery.discoveredPlugins,
+      importPlansByPluginKey: discovery.importPlansByPluginKey,
+      marketplace: discovery.marketplace,
+      ref: discovery.ref,
+      repositoryFullName: discovery.repositoryFullName,
+      sourceRevisionRef: discovery.sourceRevisionRef,
+      treeSummary: discovery.treeSummary,
+      warnings: discovery.warnings,
+    }),
+    connectorInstanceId: connectorInstance.id,
+    connectorType: "github",
+    context: input.context,
+    externalTargetRef: input.branch,
+    remoteId: input.repositoryFullName,
+    targetKind: "repository_branch",
+  })
+
+  for (const mapping of input.mappings) {
+    await createConnectorMapping({
+      autoAddToPlugin: mapping.autoAddToPlugin,
+      config: mapping.config,
+      connectorTargetId: connectorTarget.id,
+      context: input.context,
+      mappingKind: mapping.mappingKind,
+      objectType: mapping.objectType,
+      pluginId: mapping.pluginId,
+      selector: mapping.selector,
+    })
+  }
+
+  return {
+    connectorAccount: connectorAccountDetail,
+    connectorInstance,
+    connectorTarget,
+  }
+}
+
+export async function enqueueGithubWebhookSync(input: {
+  deliveryId: string
+  event: "installation" | "installation_repositories" | "push" | "repository"
+  headSha?: string
+  installationId?: number
+  payload: Record<string, unknown>
+  ref?: string
+  repositoryFullName?: string
+  repositoryId?: number
+}) {
+  if (!input.installationId) {
+    return { accepted: false as const, reason: "missing installation id" }
+  }
+
+  const accounts = await db
+    .select()
+    .from(ConnectorAccountTable)
+    .where(and(eq(ConnectorAccountTable.connectorType, "github"), eq(ConnectorAccountTable.remoteId, String(input.installationId))))
+
+  if (input.event !== "push") {
+    if (input.event === "installation") {
+      const action = typeof input.payload.action === "string" ? input.payload.action : null
+      if (action === "deleted") {
+        for (const account of accounts) {
+          await db.update(ConnectorAccountTable).set({ status: "disconnected", updatedAt: new Date() }).where(eq(ConnectorAccountTable.id, account.id))
+        }
+        return { accepted: true as const, queued: false as const }
+      }
+    }
+    return { accepted: false as const, reason: "event ignored" }
+  }
+
+  if (!input.repositoryFullName || !input.ref || !input.headSha || !input.repositoryId) {
+    return { accepted: false as const, reason: "missing push metadata" }
+  }
+
+  const instances = await db
+    .select({ instance: ConnectorInstanceTable, target: ConnectorTargetTable })
+    .from(ConnectorTargetTable)
+    .innerJoin(ConnectorInstanceTable, eq(ConnectorTargetTable.connectorInstanceId, ConnectorInstanceTable.id))
+    .where(and(eq(ConnectorTargetTable.connectorType, "github"), eq(ConnectorTargetTable.remoteId, input.repositoryFullName)))
+
+  const queuedIds: string[] = []
+  for (const row of instances) {
+    const targetConfig = row.target.targetConfigJson ?? {}
+    const targetRef = typeof targetConfig.ref === "string" ? targetConfig.ref : null
+    if (targetRef && targetRef !== input.ref) {
+      continue
+    }
+
+    const existing = await db
+      .select({ id: ConnectorSyncEventTable.id })
+      .from(ConnectorSyncEventTable)
+      .where(and(
+        eq(ConnectorSyncEventTable.connectorTargetId, row.target.id),
+        eq(ConnectorSyncEventTable.eventType, "push"),
+        eq(ConnectorSyncEventTable.sourceRevisionRef, input.headSha),
+      ))
+      .limit(1)
+
+    let autoImportSummary: {
+      autoImported: boolean
+      createdPluginCount: number
+      materializedConfigObjectCount: number
+    }
+    try {
+      autoImportSummary = await maybeAutoImportGithubConnectorInstance({
+        connectorInstance: row.instance,
+        connectorTarget: row.target,
+      })
+    } catch (error) {
+      autoImportSummary = {
+        autoImported: false,
+        createdPluginCount: 0,
+        materializedConfigObjectCount: 0,
+      }
+    }
+
+    const eventStatus = autoImportSummary.autoImported ? "completed" as const : "queued" as const
+    const completedAt = autoImportSummary.autoImported ? new Date() : null
+
+    const id = existing[0]?.id ?? createDenTypeId("connectorSyncEvent")
+    if (existing[0]) {
+      await db.update(ConnectorSyncEventTable).set({
+        completedAt,
+        externalEventRef: input.deliveryId,
+        startedAt: new Date(),
+        status: eventStatus,
+        summaryJson: {
+          autoImportApplied: autoImportSummary.autoImported,
+          autoImportCreatedPluginCount: autoImportSummary.createdPluginCount,
+          autoImportMaterializedConfigObjectCount: autoImportSummary.materializedConfigObjectCount,
+          deliveryId: input.deliveryId,
+          headSha: input.headSha,
+          repositoryFullName: input.repositoryFullName,
+          repositoryId: input.repositoryId,
+          queuedAt: new Date().toISOString(),
+          ref: input.ref,
+        },
+      }).where(eq(ConnectorSyncEventTable.id, id))
+    } else {
+      await db.insert(ConnectorSyncEventTable).values({
+        completedAt,
+        connectorInstanceId: row.instance.id,
+        connectorTargetId: row.target.id,
+        connectorType: "github",
+        eventType: "push",
+        externalEventRef: input.deliveryId,
+        id,
+        organizationId: row.instance.organizationId,
+        remoteId: input.repositoryFullName,
+        sourceRevisionRef: input.headSha,
+        startedAt: new Date(),
+        status: eventStatus,
+        summaryJson: {
+          autoImportApplied: autoImportSummary.autoImported,
+          autoImportCreatedPluginCount: autoImportSummary.createdPluginCount,
+          autoImportMaterializedConfigObjectCount: autoImportSummary.materializedConfigObjectCount,
+          deliveryId: input.deliveryId,
+          headSha: input.headSha,
+          installationId: input.installationId,
+          repositoryFullName: input.repositoryFullName,
+          repositoryId: input.repositoryId,
+          ref: input.ref,
+        },
+      })
+    }
+    queuedIds.push(id)
+  }
+
+  return queuedIds.length > 0
+    ? { accepted: true as const, queued: true as const, syncEventIds: queuedIds }
+    : { accepted: false as const, reason: "event ignored" }
+}
diff --git a/ee/apps/den-api/src/routes/org/roles.ts b/ee/apps/den-api/src/routes/org/roles.ts
new file mode 100644
index 0000000000..3d3a692f88
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/roles.ts
@@ -0,0 +1,257 @@
+import { and, eq } from "@openwork-ee/den-db/drizzle"
+import { InvitationTable, MemberTable, OrganizationRoleTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import { jsonValidator, paramValidator, requireUserMiddleware, resolveOrganizationContextMiddleware } from "../../middleware/index.js"
+import { emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, successSchema, unauthorizedSchema } from "../../openapi.js"
+import { serializePermissionRecord } from "../../orgs.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { createRoleId, ensureOwner, idParamSchema, normalizeRoleName, replaceRoleValue, splitRoles } from "./shared.js"
+
+const permissionSchema = z.record(z.string(), z.array(z.string()))
+
+const createRoleSchema = z.object({
+  roleName: z.string().trim().min(2).max(64),
+  permission: permissionSchema,
+})
+
+const updateRoleSchema = z.object({
+  roleName: z.string().trim().min(2).max(64).optional(),
+  permission: permissionSchema.optional(),
+})
+
+type OrganizationRoleId = typeof OrganizationRoleTable.$inferSelect.id
+const orgRoleParamsSchema = idParamSchema("roleId", "organizationRole")
+
+export function registerOrgRoleRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/roles",
+    describeRoute({
+      tags: ["Roles"],
+      summary: "Create organization role",
+      description: "Creates a custom organization role with a named permission map.",
+      responses: {
+        201: jsonResponse("Organization role created successfully.", successSchema),
+        400: jsonResponse("The role creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create organization roles.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can create custom roles.", forbiddenSchema),
+        404: jsonResponse("The organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(createRoleSchema),
+    async (c) => {
+    const permission = ensureOwner(c)
+    if (!permission.ok) {
+      return c.json(permission.response, 403)
+    }
+
+    const payload = c.get("organizationContext")
+    const input = c.req.valid("json")
+
+    const roleName = normalizeRoleName(input.roleName)
+    if (roleName === "owner") {
+      return c.json({ error: "invalid_role", message: "Owner is managed by the system." }, 400)
+    }
+
+    const existingByName = await db
+      .select({ id: OrganizationRoleTable.id })
+      .from(OrganizationRoleTable)
+      .where(and(eq(OrganizationRoleTable.organizationId, payload.organization.id), eq(OrganizationRoleTable.role, roleName)))
+      .limit(1)
+
+    if (existingByName[0]) {
+      return c.json({ error: "role_exists", message: "That role already exists in this organization." }, 409)
+    }
+
+    await db.insert(OrganizationRoleTable).values({
+      id: createRoleId(),
+      organizationId: payload.organization.id,
+      role: roleName,
+      permission: serializePermissionRecord(input.permission),
+    })
+
+    return c.json({ success: true }, 201)
+    },
+  )
+
+  app.patch(
+    "/v1/roles/:roleId",
+    describeRoute({
+      tags: ["Roles"],
+      summary: "Update organization role",
+      description: "Updates a custom organization role and propagates role name changes to members and pending invitations.",
+      responses: {
+        200: jsonResponse("Organization role updated successfully.", successSchema),
+        400: jsonResponse("The role update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update organization roles.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can update custom roles.", forbiddenSchema),
+        404: jsonResponse("The role or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgRoleParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateRoleSchema),
+    async (c) => {
+    const permission = ensureOwner(c)
+    if (!permission.ok) {
+      return c.json(permission.response, 403)
+    }
+
+    const payload = c.get("organizationContext")
+    const input = c.req.valid("json")
+
+    const params = c.req.valid("param")
+    let roleId: OrganizationRoleId
+    try {
+      roleId = normalizeDenTypeId("organizationRole", params.roleId)
+    } catch {
+      return c.json({ error: "role_not_found" }, 404)
+    }
+
+    const roleRows = await db
+      .select()
+      .from(OrganizationRoleTable)
+      .where(and(eq(OrganizationRoleTable.id, roleId), eq(OrganizationRoleTable.organizationId, payload.organization.id)))
+      .limit(1)
+
+    const roleRow = roleRows[0]
+    if (!roleRow) {
+      return c.json({ error: "role_not_found" }, 404)
+    }
+
+    const nextRoleName = input.roleName ? normalizeRoleName(input.roleName) : roleRow.role
+    if (nextRoleName === "owner") {
+      return c.json({ error: "invalid_role", message: "Owner is managed by the system." }, 400)
+    }
+
+    if (nextRoleName !== roleRow.role) {
+      const duplicate = await db
+        .select({ id: OrganizationRoleTable.id })
+        .from(OrganizationRoleTable)
+        .where(and(eq(OrganizationRoleTable.organizationId, payload.organization.id), eq(OrganizationRoleTable.role, nextRoleName)))
+        .limit(1)
+      if (duplicate[0]) {
+        return c.json({ error: "role_exists", message: "That role name is already in use." }, 409)
+      }
+    }
+
+    const nextPermission = input.permission ? serializePermissionRecord(input.permission) : roleRow.permission
+
+    await db
+      .update(OrganizationRoleTable)
+      .set({ role: nextRoleName, permission: nextPermission })
+      .where(eq(OrganizationRoleTable.id, roleRow.id))
+
+    if (nextRoleName !== roleRow.role) {
+      const members = await db
+        .select()
+        .from(MemberTable)
+        .where(eq(MemberTable.organizationId, payload.organization.id))
+
+      for (const member of members) {
+        if (!splitRoles(member.role).includes(roleRow.role)) {
+          continue
+        }
+
+        await db
+          .update(MemberTable)
+          .set({ role: replaceRoleValue(member.role, roleRow.role, nextRoleName) })
+          .where(eq(MemberTable.id, member.id))
+      }
+
+      const invitations = await db
+        .select()
+        .from(InvitationTable)
+        .where(eq(InvitationTable.organizationId, payload.organization.id))
+
+      for (const invitation of invitations) {
+        if (!splitRoles(invitation.role).includes(roleRow.role)) {
+          continue
+        }
+
+        await db
+          .update(InvitationTable)
+          .set({ role: replaceRoleValue(invitation.role, roleRow.role, nextRoleName) })
+          .where(eq(InvitationTable.id, invitation.id))
+      }
+    }
+
+    return c.json({ success: true })
+    },
+  )
+
+  app.delete(
+    "/v1/roles/:roleId",
+    describeRoute({
+      tags: ["Roles"],
+      summary: "Delete organization role",
+      description: "Deletes a custom organization role after confirming that no members or pending invitations still depend on it.",
+      responses: {
+        204: emptyResponse("Organization role deleted successfully."),
+        400: jsonResponse("The role deletion request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete organization roles.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners can delete custom roles.", forbiddenSchema),
+        404: jsonResponse("The role or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgRoleParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+    const permission = ensureOwner(c)
+    if (!permission.ok) {
+      return c.json(permission.response, 403)
+    }
+
+    const payload = c.get("organizationContext")
+    const params = c.req.valid("param")
+    let roleId: OrganizationRoleId
+    try {
+      roleId = normalizeDenTypeId("organizationRole", params.roleId)
+    } catch {
+      return c.json({ error: "role_not_found" }, 404)
+    }
+
+    const roleRows = await db
+      .select()
+      .from(OrganizationRoleTable)
+      .where(and(eq(OrganizationRoleTable.id, roleId), eq(OrganizationRoleTable.organizationId, payload.organization.id)))
+      .limit(1)
+
+    const roleRow = roleRows[0]
+    if (!roleRow) {
+      return c.json({ error: "role_not_found" }, 404)
+    }
+
+    const membersUsingRole = await db
+      .select({ role: MemberTable.role })
+      .from(MemberTable)
+      .where(eq(MemberTable.organizationId, payload.organization.id))
+
+    if (membersUsingRole.some((member) => splitRoles(member.role).includes(roleRow.role))) {
+      return c.json({ error: "role_in_use", message: "Update members using this role before deleting it." }, 400)
+    }
+
+    const invitationsUsingRole = await db
+      .select({ role: InvitationTable.role })
+      .from(InvitationTable)
+      .where(eq(InvitationTable.organizationId, payload.organization.id))
+
+    if (invitationsUsingRole.some((invitation) => splitRoles(invitation.role).includes(roleRow.role))) {
+      return c.json({
+        error: "role_in_use",
+        message: "Cancel or update pending invitations using this role before deleting it.",
+      }, 400)
+    }
+
+    await db.delete(OrganizationRoleTable).where(eq(OrganizationRoleTable.id, roleRow.id))
+    return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/shared.ts b/ee/apps/den-api/src/routes/org/shared.ts
new file mode 100644
index 0000000000..ef376705fb
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/shared.ts
@@ -0,0 +1,156 @@
+import { createDenTypeId, type DenTypeIdName } from "@openwork-ee/utils/typeid"
+import { z } from "zod"
+import type { MemberTeamsContext, OrganizationContextVariables, UserOrganizationsContext } from "../../middleware/index.js"
+import { env } from "../../env.js"
+import { denTypeIdSchema } from "../../openapi.js"
+import type { AuthContextVariables } from "../../session.js"
+
+export type OrgRouteVariables =
+  & AuthContextVariables
+  & Partial<UserOrganizationsContext>
+  & Partial<OrganizationContextVariables>
+  & Partial<MemberTeamsContext>
+
+export function idParamSchema<K extends string>(key: K, typeName?: DenTypeIdName) {
+  if (!typeName) {
+    return z.object({
+      [key]: z.string().trim().min(1).max(255),
+    } as unknown as Record<K, z.ZodString>)
+  }
+
+  return z.object({
+    [key]: denTypeIdSchema(typeName),
+  } as unknown as Record<K, z.ZodType<string, string>>)
+}
+
+export function splitRoles(value: string) {
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+}
+
+export function memberHasRole(value: string, role: string) {
+  return splitRoles(value).includes(role)
+}
+
+export function normalizeRoleName(value: string) {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, "-")
+}
+
+export function replaceRoleValue(value: string, previousRole: string, nextRole: string | null) {
+  const existing = splitRoles(value)
+  const remaining = existing.filter((role) => role !== previousRole)
+
+  if (nextRole && !remaining.includes(nextRole)) {
+    remaining.push(nextRole)
+  }
+
+  return remaining[0] ? remaining.join(",") : "member"
+}
+
+export function getInvitationOrigin() {
+  return env.betterAuthTrustedOrigins.find((origin) => origin !== "*") ?? env.betterAuthUrl
+}
+
+export function buildInvitationLink(invitationId: string) {
+  return new URL(`/join-org?invite=${encodeURIComponent(invitationId)}`, getInvitationOrigin()).toString()
+}
+
+export function ensureOwner(c: { get: (key: "organizationContext") => OrgRouteVariables["organizationContext"] }) {
+  const payload = c.get("organizationContext")
+  if (!payload?.currentMember.isOwner) {
+    return {
+      ok: false as const,
+      response: {
+        error: "forbidden",
+        message: "Only workspace owners can manage members and roles.",
+      },
+    }
+  }
+
+  return { ok: true as const }
+}
+
+export function ensureInviteManager(c: { get: (key: "organizationContext") => OrgRouteVariables["organizationContext"] }) {
+  const payload = c.get("organizationContext")
+  if (!payload) {
+    return {
+      ok: false as const,
+      response: {
+        error: "organization_not_found",
+      },
+    }
+  }
+
+  if (payload.currentMember.isOwner || memberHasRole(payload.currentMember.role, "admin")) {
+    return { ok: true as const }
+  }
+
+  return {
+    ok: false as const,
+    response: {
+      error: "forbidden",
+      message: "Only workspace owners and admins can invite members.",
+    },
+  }
+}
+
+export function ensureTeamManager(c: { get: (key: "organizationContext") => OrgRouteVariables["organizationContext"] }) {
+  const payload = c.get("organizationContext")
+  if (!payload) {
+    return {
+      ok: false as const,
+      response: {
+        error: "organization_not_found",
+      },
+    }
+  }
+
+  if (payload.currentMember.isOwner || memberHasRole(payload.currentMember.role, "admin")) {
+    return { ok: true as const }
+  }
+
+  return {
+    ok: false as const,
+    response: {
+      error: "forbidden",
+      message: "Only workspace owners and admins can manage teams.",
+    },
+  }
+}
+
+export function ensureApiKeyManager(c: { get: (key: "organizationContext") => OrgRouteVariables["organizationContext"] }) {
+  const payload = c.get("organizationContext")
+  if (!payload) {
+    return {
+      ok: false as const,
+      response: {
+        error: "organization_not_found",
+      },
+    }
+  }
+
+  if (payload.currentMember.isOwner || memberHasRole(payload.currentMember.role, "admin")) {
+    return { ok: true as const }
+  }
+
+  return {
+    ok: false as const,
+    response: {
+      error: "forbidden",
+      message: "Only workspace owners and admins can manage API keys.",
+    },
+  }
+}
+
+export function createInvitationId() {
+  return createDenTypeId("invitation")
+}
+
+export function createRoleId() {
+  return createDenTypeId("organizationRole")
+}
diff --git a/ee/apps/den-api/src/routes/org/skills.ts b/ee/apps/den-api/src/routes/org/skills.ts
new file mode 100644
index 0000000000..646f0e45b0
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/skills.ts
@@ -0,0 +1,1140 @@
+import { and, desc, eq, inArray, isNotNull, or } from "@openwork-ee/den-db/drizzle"
+import {
+  AuthUserTable,
+  MemberTable,
+  SkillHubMemberTable,
+  SkillHubSkillTable,
+  SkillHubTable,
+  SkillTable,
+  TeamTable,
+} from "@openwork-ee/den-db/schema"
+import { hasSkillFrontmatterName, parseSkillMarkdown } from "@openwork-ee/utils"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import {
+  jsonValidator,
+  paramValidator,
+  requireUserMiddleware,
+  resolveMemberTeamsMiddleware,
+  resolveOrganizationContextMiddleware,
+} from "../../middleware/index.js"
+import type { MemberTeamsContext } from "../../middleware/member-teams.js"
+import { denTypeIdSchema, emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, successSchema, unauthorizedSchema } from "../../openapi.js"
+import type { OrgRouteVariables } from "./shared.js"
+import { idParamSchema, memberHasRole } from "./shared.js"
+
+const skillTextSchema = z.string().superRefine((value, ctx) => {
+  if (!value.trim()) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Skill content cannot be empty.",
+    })
+    return
+  }
+
+  if (!hasSkillFrontmatterName(value)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Skill content must start with frontmatter that includes a name.",
+    })
+  }
+})
+
+const createSkillSchema = z.object({
+  skillText: skillTextSchema,
+  shared: z.enum(["org", "public"]).nullable().optional(),
+})
+
+const updateSkillSchema = z.object({
+  skillText: skillTextSchema.optional(),
+  shared: z.enum(["org", "public"]).nullable().optional(),
+}).superRefine((value, ctx) => {
+  if (value.skillText === undefined && value.shared === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["skillText"],
+      message: "Provide at least one field to update.",
+    })
+  }
+})
+
+const createSkillHubSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  description: z.string().trim().max(65535).nullish().transform((value) => value || null),
+})
+
+const updateSkillHubSchema = z.object({
+  name: z.string().trim().min(1).max(255).optional(),
+  description: z.string().trim().max(65535).nullable().optional(),
+}).superRefine((value, ctx) => {
+  if (value.name === undefined && value.description === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["name"],
+      message: "Provide at least one field to update.",
+    })
+  }
+})
+
+const addSkillToHubSchema = z.object({
+  skillId: denTypeIdSchema("skill"),
+})
+
+const addSkillHubAccessSchema = z.object({
+  orgMembershipId: denTypeIdSchema("member").optional(),
+  teamId: denTypeIdSchema("team").optional(),
+}).superRefine((value, ctx) => {
+  const count = Number(Boolean(value.orgMembershipId)) + Number(Boolean(value.teamId))
+  if (count !== 1) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["orgMembershipId"],
+      message: "Provide exactly one of orgMembershipId or teamId.",
+    })
+  }
+})
+
+type SkillId = typeof SkillTable.$inferSelect.id
+type SkillHubId = typeof SkillHubTable.$inferSelect.id
+type SkillHubMemberId = typeof SkillHubMemberTable.$inferSelect.id
+type TeamId = typeof TeamTable.$inferSelect.id
+type MemberId = typeof MemberTable.$inferSelect.id
+type SkillRow = typeof SkillTable.$inferSelect
+type SkillHubRow = typeof SkillHubTable.$inferSelect
+
+const orgSkillHubParamsSchema = idParamSchema("skillHubId", "skillHub")
+const orgSkillParamsSchema = idParamSchema("skillId", "skill")
+const orgSkillHubSkillParamsSchema = orgSkillHubParamsSchema.extend(idParamSchema("skillId", "skill").shape)
+const orgSkillHubAccessParamsSchema = orgSkillHubParamsSchema.extend(idParamSchema("accessId", "skillHubMember").shape)
+
+const skillResponseSchema = z.object({
+  skill: z.object({}).passthrough(),
+}).meta({ ref: "SkillResponse" })
+
+const skillListResponseSchema = z.object({
+  skills: z.array(z.object({}).passthrough()),
+}).meta({ ref: "SkillListResponse" })
+
+const skillHubResponseSchema = z.object({
+  skillHub: z.object({}).passthrough(),
+}).meta({ ref: "SkillHubResponse" })
+
+const skillHubListResponseSchema = z.object({
+  skillHubs: z.array(z.object({}).passthrough()),
+}).meta({ ref: "SkillHubListResponse" })
+
+const skillHubAccessResponseSchema = z.object({
+  access: z.object({}).passthrough(),
+}).meta({ ref: "SkillHubAccessResponse" })
+
+const conflictSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+}).meta({ ref: "ConflictError" })
+
+function parseSkillId(value: string) {
+  return normalizeDenTypeId("skill", value)
+}
+
+function parseSkillHubId(value: string) {
+  return normalizeDenTypeId("skillHub", value)
+}
+
+function parseSkillHubMemberId(value: string) {
+  return normalizeDenTypeId("skillHubMember", value)
+}
+
+function parseMemberId(value: string) {
+  return normalizeDenTypeId("member", value)
+}
+
+function parseTeamId(value: string) {
+  return normalizeDenTypeId("team", value)
+}
+
+function parseSkillMetadata(skillText: string) {
+  const parsed = parseSkillMarkdown(skillText)
+  if (parsed.hasFrontmatter) {
+    const title = parsed.name.trim() || "Untitled skill"
+    const description = parsed.description.trim() || null
+
+    return {
+      title: title.slice(0, 255),
+      description: description ? description.slice(0, 65535) : null,
+    }
+  }
+
+  const lines = skillText
+    .split(/\r?\n/g)
+    .map((line) => line.trim())
+    .filter(Boolean)
+
+  const cleanup = (value: string) => value
+    .replace(/^#{1,6}\s+/, "")
+    .replace(/^[-*+]\s+/, "")
+    .replace(/^title\s*:\s*/i, "")
+    .replace(/^description\s*:\s*/i, "")
+    .trim()
+
+  const title = cleanup(lines[0] ?? "") || "Untitled skill"
+  const description = lines.slice(1).map(cleanup).find(Boolean) ?? null
+
+  return {
+    title: title.slice(0, 255),
+    description: description ? description.slice(0, 65535) : null,
+  }
+}
+
+function isOrganizationAdmin(payload: { currentMember: { isOwner: boolean; role: string } }) {
+  return payload.currentMember.isOwner || memberHasRole(payload.currentMember.role, "admin")
+}
+
+function canManageSkill(payload: { currentMember: { id: MemberId; isOwner: boolean; role: string } }, skill: SkillRow) {
+  return isOrganizationAdmin(payload) || skill.createdByOrgMembershipId === payload.currentMember.id
+}
+
+function canManageHub(payload: { currentMember: { id: MemberId; isOwner: boolean; role: string } }, skillHub: SkillHubRow) {
+  return isOrganizationAdmin(payload) || skillHub.createdByOrgMembershipId === payload.currentMember.id
+}
+
+async function listAccessibleHubMemberships(input: {
+  organizationId: typeof SkillHubTable.$inferSelect.organizationId
+  currentMemberId: MemberId
+  memberTeams: Array<{ id: TeamId }>
+}) {
+  const teamIds = input.memberTeams.map((team) => team.id)
+  const accessWhere = teamIds.length > 0
+    ? and(
+        eq(SkillHubTable.organizationId, input.organizationId),
+        or(
+          eq(SkillHubMemberTable.orgMembershipId, input.currentMemberId),
+          inArray(SkillHubMemberTable.teamId, teamIds),
+        ),
+      )
+    : and(
+        eq(SkillHubTable.organizationId, input.organizationId),
+        eq(SkillHubMemberTable.orgMembershipId, input.currentMemberId),
+      )
+
+  return db
+    .select({
+      id: SkillHubMemberTable.id,
+      skillHubId: SkillHubMemberTable.skillHubId,
+      orgMembershipId: SkillHubMemberTable.orgMembershipId,
+      teamId: SkillHubMemberTable.teamId,
+      createdAt: SkillHubMemberTable.createdAt,
+    })
+    .from(SkillHubMemberTable)
+    .innerJoin(SkillHubTable, eq(SkillHubMemberTable.skillHubId, SkillHubTable.id))
+    .where(accessWhere)
+}
+
+async function listAccessibleSkillIds(input: {
+  organizationId: typeof SkillHubTable.$inferSelect.organizationId
+  currentMemberId: MemberId
+  memberTeams: Array<{ id: TeamId }>
+}) {
+  const memberships = await listAccessibleHubMemberships(input)
+  const hubIds = [...new Set(memberships.map((membership) => membership.skillHubId))]
+  if (hubIds.length === 0) {
+    return new Set<SkillId>()
+  }
+
+  const rows = await db
+    .select({ skillId: SkillHubSkillTable.skillId })
+    .from(SkillHubSkillTable)
+    .where(inArray(SkillHubSkillTable.skillHubId, hubIds))
+
+  return new Set(rows.map((row) => row.skillId))
+}
+
+function canViewSkill(input: {
+  currentMemberId: MemberId
+  skill: SkillRow
+  accessibleSkillIds: Set<SkillId>
+}) {
+  return input.skill.createdByOrgMembershipId === input.currentMemberId
+    || input.skill.shared !== null
+    || input.accessibleSkillIds.has(input.skill.id)
+}
+
+export function registerOrgSkillRoutes<T extends { Variables: OrgRouteVariables & Partial<MemberTeamsContext> }>(app: Hono<T>) {
+  app.post(
+    "/v1/skills",
+    describeRoute({
+      tags: ["Skills"],
+      summary: "Create skill",
+      description: "Creates a new skill in the organization from markdown content and optional sharing visibility.",
+      responses: {
+        201: jsonResponse("Skill created successfully.", skillResponseSchema),
+        400: jsonResponse("The skill creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create skills.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(createSkillSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+      const now = new Date()
+      const skillId = createDenTypeId("skill")
+      const metadata = parseSkillMetadata(input.skillText)
+
+      await db.insert(SkillTable).values({
+        id: skillId,
+        organizationId: payload.organization.id,
+        createdByOrgMembershipId: payload.currentMember.id,
+        title: metadata.title,
+        description: metadata.description,
+        skillText: input.skillText,
+        shared: input.shared ?? null,
+        createdAt: now,
+        updatedAt: now,
+      })
+
+      return c.json({
+        skill: {
+          id: skillId,
+          organizationId: payload.organization.id,
+          createdByOrgMembershipId: payload.currentMember.id,
+          title: metadata.title,
+          description: metadata.description,
+          skillText: input.skillText,
+          shared: input.shared ?? null,
+          createdAt: now,
+          updatedAt: now,
+        },
+      }, 201)
+    },
+  )
+
+  app.get(
+    "/v1/skills",
+    describeRoute({
+      tags: ["Skills"],
+      summary: "List skills",
+      description: "Lists the skills the current member can view, including owned skills, shared skills, and skills available through hub access.",
+      responses: {
+        200: jsonResponse("Accessible skills returned successfully.", skillListResponseSchema),
+        400: jsonResponse("The skill list path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list skills.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    resolveMemberTeamsMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const memberTeams = c.get("memberTeams") ?? []
+      const accessibleSkillIds = await listAccessibleSkillIds({
+        organizationId: payload.organization.id,
+        currentMemberId: payload.currentMember.id,
+        memberTeams,
+      })
+
+      const skills = await db
+        .select()
+        .from(SkillTable)
+        .where(eq(SkillTable.organizationId, payload.organization.id))
+        .orderBy(desc(SkillTable.updatedAt))
+
+      return c.json({
+        skills: skills
+          .filter((skill) => canViewSkill({
+            currentMemberId: payload.currentMember.id,
+            skill,
+            accessibleSkillIds,
+          }))
+          .map((skill) => ({
+            ...skill,
+            canManage: canManageSkill(payload, skill),
+          })),
+      })
+    },
+  )
+
+  app.delete(
+    "/v1/skills/:skillId",
+    describeRoute({
+      tags: ["Skills"],
+      summary: "Delete skill",
+      description: "Deletes one organization skill when the caller is allowed to manage it.",
+      responses: {
+        204: emptyResponse("Skill deleted successfully."),
+        400: jsonResponse("The skill deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete skills.", unauthorizedSchema),
+        403: jsonResponse("Only the skill creator or a workspace admin can delete skills.", forbiddenSchema),
+        404: jsonResponse("The skill could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let skillId: SkillId
+      try {
+        skillId = parseSkillId(params.skillId)
+      } catch {
+        return c.json({ error: "skill_not_found" }, 404)
+      }
+
+      const skillRows = await db
+        .select()
+        .from(SkillTable)
+        .where(and(eq(SkillTable.id, skillId), eq(SkillTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skill = skillRows[0]
+      if (!skill) {
+        return c.json({ error: "skill_not_found" }, 404)
+      }
+
+      if (!canManageSkill(payload, skill)) {
+        return c.json({ error: "forbidden", message: "Only the skill creator or a workspace admin can delete skills." }, 403)
+      }
+
+      await db.transaction(async (tx) => {
+        await tx.delete(SkillHubSkillTable).where(eq(SkillHubSkillTable.skillId, skill.id))
+        await tx.delete(SkillTable).where(eq(SkillTable.id, skill.id))
+      })
+
+      return c.body(null, 204)
+    },
+  )
+
+  app.patch(
+    "/v1/skills/:skillId",
+    describeRoute({
+      tags: ["Skills"],
+      summary: "Update skill",
+      description: "Updates a skill's markdown content and-or sharing visibility while keeping derived metadata in sync.",
+      responses: {
+        200: jsonResponse("Skill updated successfully.", skillResponseSchema),
+        400: jsonResponse("The skill update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update skills.", unauthorizedSchema),
+        403: jsonResponse("Only the skill creator or a workspace admin can update skills.", forbiddenSchema),
+        404: jsonResponse("The skill could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateSkillSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let skillId: SkillId
+      try {
+        skillId = parseSkillId(params.skillId)
+      } catch {
+        return c.json({ error: "skill_not_found" }, 404)
+      }
+
+      const skillRows = await db
+        .select()
+        .from(SkillTable)
+        .where(and(eq(SkillTable.id, skillId), eq(SkillTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skill = skillRows[0]
+      if (!skill) {
+        return c.json({ error: "skill_not_found" }, 404)
+      }
+
+      if (!canManageSkill(payload, skill)) {
+        return c.json({ error: "forbidden", message: "Only the skill creator or a workspace admin can update skills." }, 403)
+      }
+
+      const nextSkillText = input.skillText ?? skill.skillText
+      const metadata = parseSkillMetadata(nextSkillText)
+      const updatedAt = new Date()
+      const nextShared = input.shared === undefined ? skill.shared : input.shared
+
+      await db
+        .update(SkillTable)
+        .set({
+          title: metadata.title,
+          description: metadata.description,
+          skillText: nextSkillText,
+          shared: nextShared,
+          updatedAt,
+        })
+        .where(eq(SkillTable.id, skill.id))
+
+      return c.json({
+        skill: {
+          ...skill,
+          title: metadata.title,
+          description: metadata.description,
+          skillText: nextSkillText,
+          shared: nextShared,
+          updatedAt,
+        },
+      })
+    },
+  )
+
+  app.post(
+    "/v1/skill-hubs",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Create skill hub",
+      description: "Creates a skill hub that can group skills and assign access to specific members or teams.",
+      responses: {
+        201: jsonResponse("Skill hub created successfully.", skillHubResponseSchema),
+        400: jsonResponse("The skill hub creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create skill hubs.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(createSkillHubSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+      const now = new Date()
+      const skillHubId = createDenTypeId("skillHub")
+
+      await db.transaction(async (tx) => {
+        await tx.insert(SkillHubTable).values({
+          id: skillHubId,
+          organizationId: payload.organization.id,
+          createdByOrgMembershipId: payload.currentMember.id,
+          name: input.name,
+          description: input.description,
+          createdAt: now,
+          updatedAt: now,
+        })
+
+        await tx.insert(SkillHubMemberTable).values({
+          id: createDenTypeId("skillHubMember"),
+          skillHubId,
+          orgMembershipId: payload.currentMember.id,
+          teamId: null,
+          createdAt: now,
+        })
+      })
+
+      return c.json({
+        skillHub: {
+          id: skillHubId,
+          organizationId: payload.organization.id,
+          createdByOrgMembershipId: payload.currentMember.id,
+          name: input.name,
+          description: input.description,
+          createdAt: now,
+          updatedAt: now,
+        },
+      }, 201)
+    },
+  )
+
+  app.get(
+    "/v1/skill-hubs",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "List skill hubs",
+      description: "Lists the skill hubs the current member can access, along with linked skills and access metadata.",
+      responses: {
+        200: jsonResponse("Accessible skill hubs returned successfully.", skillHubListResponseSchema),
+        400: jsonResponse("The skill hub list path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list skill hubs.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    resolveMemberTeamsMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const memberTeams = c.get("memberTeams") ?? []
+      const accessibleMemberships = await listAccessibleHubMemberships({
+        organizationId: payload.organization.id,
+        currentMemberId: payload.currentMember.id,
+        memberTeams,
+      })
+      const skillHubIds = [...new Set(accessibleMemberships.map((membership) => membership.skillHubId))]
+
+      if (skillHubIds.length === 0) {
+        return c.json({ skillHubs: [] })
+      }
+
+      const skillHubs = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.organizationId, payload.organization.id), inArray(SkillHubTable.id, skillHubIds)))
+        .orderBy(desc(SkillHubTable.updatedAt))
+
+      const skillLinks = await db
+        .select({ skillHubId: SkillHubSkillTable.skillHubId, skillId: SkillHubSkillTable.skillId })
+        .from(SkillHubSkillTable)
+        .where(inArray(SkillHubSkillTable.skillHubId, skillHubIds))
+
+      const skillIds = [...new Set(skillLinks.map((link) => link.skillId))]
+      const skills = skillIds.length === 0
+        ? []
+        : await db
+          .select()
+          .from(SkillTable)
+          .where(and(eq(SkillTable.organizationId, payload.organization.id), inArray(SkillTable.id, skillIds)))
+
+      const memberAccessRows = await db
+        .select({
+          access: {
+            id: SkillHubMemberTable.id,
+            skillHubId: SkillHubMemberTable.skillHubId,
+            createdAt: SkillHubMemberTable.createdAt,
+          },
+          member: {
+            id: MemberTable.id,
+            role: MemberTable.role,
+          },
+          user: {
+            id: AuthUserTable.id,
+            name: AuthUserTable.name,
+            email: AuthUserTable.email,
+            image: AuthUserTable.image,
+          },
+        })
+        .from(SkillHubMemberTable)
+        .innerJoin(MemberTable, eq(SkillHubMemberTable.orgMembershipId, MemberTable.id))
+        .innerJoin(AuthUserTable, eq(MemberTable.userId, AuthUserTable.id))
+        .where(and(inArray(SkillHubMemberTable.skillHubId, skillHubIds), isNotNull(SkillHubMemberTable.orgMembershipId)))
+
+      const teamAccessRows = await db
+        .select({
+          access: {
+            id: SkillHubMemberTable.id,
+            skillHubId: SkillHubMemberTable.skillHubId,
+            createdAt: SkillHubMemberTable.createdAt,
+          },
+          team: {
+            id: TeamTable.id,
+            name: TeamTable.name,
+            createdAt: TeamTable.createdAt,
+            updatedAt: TeamTable.updatedAt,
+          },
+        })
+        .from(SkillHubMemberTable)
+        .innerJoin(TeamTable, eq(SkillHubMemberTable.teamId, TeamTable.id))
+        .where(and(inArray(SkillHubMemberTable.skillHubId, skillHubIds), isNotNull(SkillHubMemberTable.teamId)))
+
+      const skillsById = new Map(skills.map((skill) => [skill.id, skill]))
+      const skillsByHubId = new Map<SkillHubId, SkillRow[]>()
+      for (const link of skillLinks) {
+        const skill = skillsById.get(link.skillId)
+        if (!skill) {
+          continue
+        }
+
+        const existing = skillsByHubId.get(link.skillHubId) ?? []
+        existing.push(skill)
+        skillsByHubId.set(link.skillHubId, existing)
+      }
+
+      const memberAccessByHubId = new Map<SkillHubId, typeof memberAccessRows>()
+      for (const row of memberAccessRows) {
+        const existing = memberAccessByHubId.get(row.access.skillHubId) ?? []
+        existing.push(row)
+        memberAccessByHubId.set(row.access.skillHubId, existing)
+      }
+
+      const teamAccessByHubId = new Map<SkillHubId, typeof teamAccessRows>()
+      for (const row of teamAccessRows) {
+        const existing = teamAccessByHubId.get(row.access.skillHubId) ?? []
+        existing.push(row)
+        teamAccessByHubId.set(row.access.skillHubId, existing)
+      }
+
+      const accessibleViaByHubId = new Map<SkillHubId, { orgMembershipIds: MemberId[]; teamIds: TeamId[] }>()
+      for (const row of accessibleMemberships) {
+        const existing = accessibleViaByHubId.get(row.skillHubId) ?? { orgMembershipIds: [], teamIds: [] }
+        if (row.orgMembershipId && !existing.orgMembershipIds.includes(row.orgMembershipId)) {
+          existing.orgMembershipIds.push(row.orgMembershipId)
+        }
+        if (row.teamId && !existing.teamIds.includes(row.teamId)) {
+          existing.teamIds.push(row.teamId)
+        }
+        accessibleViaByHubId.set(row.skillHubId, existing)
+      }
+
+      return c.json({
+        skillHubs: skillHubs.map((skillHub) => ({
+          ...skillHub,
+          canManage: canManageHub(payload, skillHub),
+          accessibleVia: accessibleViaByHubId.get(skillHub.id) ?? { orgMembershipIds: [], teamIds: [] },
+          skills: skillsByHubId.get(skillHub.id) ?? [],
+          access: {
+            members: (memberAccessByHubId.get(skillHub.id) ?? []).map((row) => ({
+              id: row.access.id,
+              orgMembershipId: row.member.id,
+              role: row.member.role,
+              user: row.user,
+              createdAt: row.access.createdAt,
+            })),
+            teams: (teamAccessByHubId.get(skillHub.id) ?? []).map((row) => ({
+              id: row.access.id,
+              teamId: row.team.id,
+              name: row.team.name,
+              createdAt: row.team.createdAt,
+              updatedAt: row.team.updatedAt,
+            })),
+          },
+        })),
+      })
+    },
+  )
+
+  app.patch(
+    "/v1/skill-hubs/:skillHubId",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Update skill hub",
+      description: "Updates a skill hub's display name or description.",
+      responses: {
+        200: jsonResponse("Skill hub updated successfully.", skillHubResponseSchema),
+        400: jsonResponse("The skill hub update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update skill hubs.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can update skill hubs.", forbiddenSchema),
+        404: jsonResponse("The skill hub could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateSkillHubSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let skillHubId: SkillHubId
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+      } catch {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can update hubs." }, 403)
+      }
+
+      const updatedAt = new Date()
+      const nextName = input.name ?? skillHub.name
+      const nextDescription = input.description === undefined ? skillHub.description : input.description
+
+      await db
+        .update(SkillHubTable)
+        .set({
+          name: nextName,
+          description: nextDescription,
+          updatedAt,
+        })
+        .where(eq(SkillHubTable.id, skillHub.id))
+
+      return c.json({
+        skillHub: {
+          ...skillHub,
+          name: nextName,
+          description: nextDescription,
+          updatedAt,
+        },
+      })
+    },
+  )
+
+  app.delete(
+    "/v1/skill-hubs/:skillHubId",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Delete skill hub",
+      description: "Deletes a skill hub and removes its access links and skill links.",
+      responses: {
+        204: emptyResponse("Skill hub deleted successfully."),
+        400: jsonResponse("The skill hub deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete skill hubs.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can delete skill hubs.", forbiddenSchema),
+        404: jsonResponse("The skill hub could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let skillHubId: SkillHubId
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+      } catch {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can delete hubs." }, 403)
+      }
+
+      await db.transaction(async (tx) => {
+        await tx.delete(SkillHubMemberTable).where(eq(SkillHubMemberTable.skillHubId, skillHub.id))
+        await tx.delete(SkillHubSkillTable).where(eq(SkillHubSkillTable.skillHubId, skillHub.id))
+        await tx.delete(SkillHubTable).where(eq(SkillHubTable.id, skillHub.id))
+      })
+
+      return c.body(null, 204)
+    },
+  )
+
+  app.post(
+    "/v1/skill-hubs/:skillHubId/skills",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Add skill to skill hub",
+      description: "Adds an existing organization skill to a skill hub so hub members can discover and use it.",
+      responses: {
+        201: jsonResponse("Skill added to skill hub successfully.", successSchema),
+        400: jsonResponse("The add-skill-to-hub request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage skill hub contents.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can manage hub skills, and private skills stay creator-controlled.", forbiddenSchema),
+        404: jsonResponse("The skill hub or skill could not be found.", notFoundSchema),
+        409: jsonResponse("The skill is already attached to the skill hub.", conflictSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(addSkillToHubSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let skillHubId: SkillHubId
+      let skillId: SkillId
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+        skillId = parseSkillId(input.skillId)
+      } catch {
+        return c.json({ error: "not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can manage hub skills." }, 403)
+      }
+
+      const skillRows = await db
+        .select()
+        .from(SkillTable)
+        .where(and(eq(SkillTable.id, skillId), eq(SkillTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skill = skillRows[0]
+      if (!skill) {
+        return c.json({ error: "skill_not_found" }, 404)
+      }
+
+      if (!canManageSkill(payload, skill) && skill.shared === null) {
+        return c.json({
+          error: "forbidden",
+          message: "Private skills can only be added to hubs by their creator or a workspace admin.",
+        }, 403)
+      }
+
+      const existing = await db
+        .select({ id: SkillHubSkillTable.id })
+        .from(SkillHubSkillTable)
+        .where(and(eq(SkillHubSkillTable.skillHubId, skillHubId), eq(SkillHubSkillTable.skillId, skill.id)))
+        .limit(1)
+
+      if (existing[0]) {
+        return c.json({ error: "skill_hub_skill_exists" }, 409)
+      }
+
+      await db.insert(SkillHubSkillTable).values({
+        id: createDenTypeId("skillHubSkill"),
+        skillHubId,
+        skillId: skill.id,
+        addedByOrgMembershipId: payload.currentMember.id,
+        createdAt: new Date(),
+      })
+
+      return c.json({ success: true }, 201)
+    },
+  )
+
+  app.delete(
+    "/v1/skill-hubs/:skillHubId/skills/:skillId",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Remove skill from skill hub",
+      description: "Removes a skill from a skill hub without deleting the underlying skill itself.",
+      responses: {
+        204: emptyResponse("Skill removed from skill hub successfully."),
+        400: jsonResponse("The remove-skill-from-hub path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage skill hub contents.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can remove skills from a hub.", forbiddenSchema),
+        404: jsonResponse("The skill hub or hub-skill link could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubSkillParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let skillHubId: SkillHubId
+      let skillId: SkillId
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+        skillId = parseSkillId(params.skillId)
+      } catch {
+        return c.json({ error: "not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can manage hub skills." }, 403)
+      }
+
+      const existing = await db
+        .select({ id: SkillHubSkillTable.id })
+        .from(SkillHubSkillTable)
+        .where(and(eq(SkillHubSkillTable.skillHubId, skillHubId), eq(SkillHubSkillTable.skillId, skillId)))
+        .limit(1)
+
+      if (!existing[0]) {
+        return c.json({ error: "skill_hub_skill_not_found" }, 404)
+      }
+
+      await db
+        .delete(SkillHubSkillTable)
+        .where(and(eq(SkillHubSkillTable.skillHubId, skillHubId), eq(SkillHubSkillTable.skillId, skillId)))
+
+      return c.body(null, 204)
+    },
+  )
+
+  app.post(
+    "/v1/skill-hubs/:skillHubId/access",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Grant skill hub access",
+      description: "Grants a specific member or team access to a skill hub.",
+      responses: {
+        201: jsonResponse("Skill hub access granted successfully.", skillHubAccessResponseSchema),
+        400: jsonResponse("The skill hub access request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage skill hub access.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can grant hub access.", forbiddenSchema),
+        404: jsonResponse("The skill hub or access target could not be found.", notFoundSchema),
+        409: jsonResponse("The requested access entry already exists.", conflictSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(addSkillHubAccessSchema),
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let skillHubId: SkillHubId
+      let orgMembershipId: MemberId | null = null
+      let teamId: TeamId | null = null
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+        orgMembershipId = input.orgMembershipId ? parseMemberId(input.orgMembershipId) : null
+        teamId = input.teamId ? parseTeamId(input.teamId) : null
+      } catch {
+        return c.json({ error: "access_target_not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can manage access." }, 403)
+      }
+
+      if (orgMembershipId) {
+        const memberRows = await db
+          .select({ id: MemberTable.id })
+          .from(MemberTable)
+          .where(and(eq(MemberTable.id, orgMembershipId), eq(MemberTable.organizationId, payload.organization.id)))
+          .limit(1)
+
+        if (!memberRows[0]) {
+          return c.json({ error: "member_not_found" }, 404)
+        }
+      }
+
+      if (teamId) {
+        const teamRows = await db
+          .select({ id: TeamTable.id })
+          .from(TeamTable)
+          .where(and(eq(TeamTable.id, teamId), eq(TeamTable.organizationId, payload.organization.id)))
+          .limit(1)
+
+        if (!teamRows[0]) {
+          return c.json({ error: "team_not_found" }, 404)
+        }
+      }
+
+      const existing = await db
+        .select({ id: SkillHubMemberTable.id })
+        .from(SkillHubMemberTable)
+        .where(
+          orgMembershipId
+            ? and(eq(SkillHubMemberTable.skillHubId, skillHubId), eq(SkillHubMemberTable.orgMembershipId, orgMembershipId))
+            : and(eq(SkillHubMemberTable.skillHubId, skillHubId), eq(SkillHubMemberTable.teamId, teamId as TeamId)),
+        )
+        .limit(1)
+
+      if (existing[0]) {
+        return c.json({ error: "skill_hub_access_exists" }, 409)
+      }
+
+      const accessId = createDenTypeId("skillHubMember")
+      const createdAt = new Date()
+
+      await db.insert(SkillHubMemberTable).values({
+        id: accessId,
+        skillHubId,
+        orgMembershipId,
+        teamId,
+        createdAt,
+      })
+
+      return c.json({
+        access: {
+          id: accessId,
+          skillHubId,
+          orgMembershipId,
+          teamId,
+          createdAt,
+        },
+      }, 201)
+    },
+  )
+
+  app.delete(
+    "/v1/skill-hubs/:skillHubId/access/:accessId",
+    describeRoute({
+      tags: ["Skill Hubs"],
+      summary: "Revoke skill hub access",
+      description: "Revokes one member or team access entry from a skill hub.",
+      responses: {
+        204: emptyResponse("Skill hub access removed successfully."),
+        400: jsonResponse("The skill hub access deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to manage skill hub access.", unauthorizedSchema),
+        403: jsonResponse("Only the hub creator or a workspace admin can revoke hub access.", forbiddenSchema),
+        404: jsonResponse("The skill hub or access entry could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgSkillHubAccessParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let skillHubId: SkillHubId
+      let accessId: SkillHubMemberId
+      try {
+        skillHubId = parseSkillHubId(params.skillHubId)
+        accessId = parseSkillHubMemberId(params.accessId)
+      } catch {
+        return c.json({ error: "not_found" }, 404)
+      }
+
+      const skillHubRows = await db
+        .select()
+        .from(SkillHubTable)
+        .where(and(eq(SkillHubTable.id, skillHubId), eq(SkillHubTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const skillHub = skillHubRows[0]
+      if (!skillHub) {
+        return c.json({ error: "skill_hub_not_found" }, 404)
+      }
+
+      if (!canManageHub(payload, skillHub)) {
+        return c.json({ error: "forbidden", message: "Only the hub creator or a workspace admin can manage access." }, 403)
+      }
+
+      const accessRows = await db
+        .select()
+        .from(SkillHubMemberTable)
+        .where(and(eq(SkillHubMemberTable.id, accessId), eq(SkillHubMemberTable.skillHubId, skillHubId)))
+        .limit(1)
+
+      const access = accessRows[0]
+      if (!access) {
+        return c.json({ error: "skill_hub_access_not_found" }, 404)
+      }
+
+      await db.delete(SkillHubMemberTable).where(eq(SkillHubMemberTable.id, access.id))
+      return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/org/teams.ts b/ee/apps/den-api/src/routes/org/teams.ts
new file mode 100644
index 0000000000..2dd34454fb
--- /dev/null
+++ b/ee/apps/den-api/src/routes/org/teams.ts
@@ -0,0 +1,331 @@
+import { and, eq } from "@openwork-ee/den-db/drizzle"
+import {
+  MemberTable,
+  SkillHubMemberTable,
+  TeamMemberTable,
+  TeamTable,
+} from "@openwork-ee/den-db/schema"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import {
+  jsonValidator,
+  paramValidator,
+  requireUserMiddleware,
+  resolveOrganizationContextMiddleware,
+} from "../../middleware/index.js"
+import { denTypeIdSchema, emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import type { OrgRouteVariables } from "./shared.js"
+import {
+  ensureTeamManager,
+  idParamSchema,
+} from "./shared.js"
+
+const createTeamSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  memberIds: z.array(denTypeIdSchema("member")).optional().default([]),
+})
+
+const updateTeamSchema = z.object({
+  name: z.string().trim().min(1).max(255).optional(),
+  memberIds: z.array(denTypeIdSchema("member")).optional(),
+}).superRefine((value, ctx) => {
+  if (value.name === undefined && value.memberIds === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["name"],
+      message: "Provide at least one field to update.",
+    })
+  }
+})
+
+type TeamId = typeof TeamTable.$inferSelect.id
+type MemberId = typeof MemberTable.$inferSelect.id
+
+const orgTeamParamsSchema = idParamSchema("teamId", "team")
+
+const teamResponseSchema = z.object({
+  team: z.object({
+    id: denTypeIdSchema("team"),
+    organizationId: denTypeIdSchema("organization"),
+    name: z.string(),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+    memberIds: z.array(denTypeIdSchema("member")),
+  }),
+}).meta({ ref: "TeamResponse" })
+
+function parseTeamId(value: string) {
+  return normalizeDenTypeId("team", value)
+}
+
+function parseMemberIds(memberIds: string[]) {
+  return [...new Set(memberIds.map((value) => normalizeDenTypeId("member", value)))]
+}
+
+async function ensureMembersBelongToOrganization(input: {
+  organizationId: typeof TeamTable.$inferSelect.organizationId
+  memberIds: MemberId[]
+}) {
+  if (input.memberIds.length === 0) {
+    return true
+  }
+
+  const rows = await db
+    .select({ id: MemberTable.id })
+    .from(MemberTable)
+    .where(eq(MemberTable.organizationId, input.organizationId))
+
+  const memberIds = new Set(rows.map((row) => row.id))
+  return input.memberIds.every((memberId) => memberIds.has(memberId))
+}
+
+export function registerOrgTeamRoutes<T extends { Variables: OrgRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/teams",
+    describeRoute({
+      tags: ["Teams"],
+      summary: "Create team",
+      description: "Creates a team inside an organization and can optionally attach existing organization members to it.",
+      responses: {
+        201: jsonResponse("Team created successfully.", teamResponseSchema),
+        400: jsonResponse("The team creation request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to create teams.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners and admins can create teams.", forbiddenSchema),
+        404: jsonResponse("The organization or a referenced member could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveOrganizationContextMiddleware,
+    jsonValidator(createTeamSchema),
+    async (c) => {
+      const permission = ensureTeamManager(c)
+      if (!permission.ok) {
+        return c.json(permission.response, 403)
+      }
+
+      const payload = c.get("organizationContext")
+      const input = c.req.valid("json")
+
+      let memberIds: MemberId[]
+      try {
+        memberIds = parseMemberIds(input.memberIds)
+      } catch {
+        return c.json({ error: "member_not_found" }, 404)
+      }
+
+      const membersBelongToOrg = await ensureMembersBelongToOrganization({
+        organizationId: payload.organization.id,
+        memberIds,
+      })
+      if (!membersBelongToOrg) {
+        return c.json({ error: "member_not_found" }, 404)
+      }
+
+      const existingTeam = await db
+        .select({ id: TeamTable.id })
+        .from(TeamTable)
+        .where(and(eq(TeamTable.organizationId, payload.organization.id), eq(TeamTable.name, input.name)))
+        .limit(1)
+
+      if (existingTeam[0]) {
+        return c.json({ error: "team_exists", message: "That team already exists in this organization." }, 409)
+      }
+
+      const teamId = createDenTypeId("team")
+      const now = new Date()
+
+      await db.transaction(async (tx) => {
+        await tx.insert(TeamTable).values({
+          id: teamId,
+          name: input.name,
+          organizationId: payload.organization.id,
+          createdAt: now,
+          updatedAt: now,
+        })
+
+        if (memberIds.length > 0) {
+          await tx.insert(TeamMemberTable).values(
+            memberIds.map((memberId) => ({
+              id: createDenTypeId("teamMember"),
+              teamId,
+              orgMembershipId: memberId,
+              createdAt: now,
+            })),
+          )
+        }
+      })
+
+      return c.json({
+        team: {
+          id: teamId,
+          organizationId: payload.organization.id,
+          name: input.name,
+          createdAt: now,
+          updatedAt: now,
+          memberIds,
+        },
+      }, 201)
+    },
+  )
+
+  app.patch(
+    "/v1/teams/:teamId",
+    describeRoute({
+      tags: ["Teams"],
+      summary: "Update team",
+      description: "Updates a team's name and-or membership list within an organization.",
+      responses: {
+        200: jsonResponse("Team updated successfully.", teamResponseSchema),
+        400: jsonResponse("The team update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update teams.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners and admins can update teams.", forbiddenSchema),
+        404: jsonResponse("The team, organization, or a referenced member could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgTeamParamsSchema),
+    resolveOrganizationContextMiddleware,
+    jsonValidator(updateTeamSchema),
+    async (c) => {
+      const permission = ensureTeamManager(c)
+      if (!permission.ok) {
+        return c.json(permission.response, 403)
+      }
+
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+      const input = c.req.valid("json")
+
+      let teamId: TeamId
+      try {
+        teamId = parseTeamId(params.teamId)
+      } catch {
+        return c.json({ error: "team_not_found" }, 404)
+      }
+
+      const teamRows = await db
+        .select()
+        .from(TeamTable)
+        .where(and(eq(TeamTable.id, teamId), eq(TeamTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const team = teamRows[0]
+      if (!team) {
+        return c.json({ error: "team_not_found" }, 404)
+      }
+
+      let memberIds: MemberId[] | undefined
+      if (input.memberIds) {
+        try {
+          memberIds = parseMemberIds(input.memberIds)
+        } catch {
+          return c.json({ error: "member_not_found" }, 404)
+        }
+
+        const membersBelongToOrg = await ensureMembersBelongToOrganization({
+          organizationId: payload.organization.id,
+          memberIds,
+        })
+        if (!membersBelongToOrg) {
+          return c.json({ error: "member_not_found" }, 404)
+        }
+      }
+
+      const nextName = input.name ?? team.name
+      const duplicate = await db
+        .select({ id: TeamTable.id })
+        .from(TeamTable)
+        .where(and(eq(TeamTable.organizationId, payload.organization.id), eq(TeamTable.name, nextName)))
+        .limit(1)
+
+      if (duplicate[0] && duplicate[0].id !== team.id) {
+        return c.json({ error: "team_exists", message: "That team already exists in this organization." }, 409)
+      }
+
+      const updatedAt = new Date()
+      await db.transaction(async (tx) => {
+        await tx.update(TeamTable).set({ name: nextName, updatedAt }).where(eq(TeamTable.id, team.id))
+
+        if (memberIds) {
+          await tx.delete(TeamMemberTable).where(eq(TeamMemberTable.teamId, team.id))
+          if (memberIds.length > 0) {
+            await tx.insert(TeamMemberTable).values(
+              memberIds.map((memberId) => ({
+                id: createDenTypeId("teamMember"),
+                teamId: team.id,
+                orgMembershipId: memberId,
+                createdAt: updatedAt,
+              })),
+            )
+          }
+        }
+      })
+
+      return c.json({
+        team: {
+          ...team,
+          name: nextName,
+          updatedAt,
+          memberIds: memberIds ?? [],
+        },
+      })
+    },
+  )
+
+  app.delete(
+    "/v1/teams/:teamId",
+    describeRoute({
+      tags: ["Teams"],
+      summary: "Delete team",
+      description: "Deletes a team and removes its related hub-access and team-membership records.",
+      responses: {
+        204: emptyResponse("Team deleted successfully."),
+        400: jsonResponse("The team deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete teams.", unauthorizedSchema),
+        403: jsonResponse("Only workspace owners and admins can delete teams.", forbiddenSchema),
+        404: jsonResponse("The team or organization could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    paramValidator(orgTeamParamsSchema),
+    resolveOrganizationContextMiddleware,
+    async (c) => {
+      const permission = ensureTeamManager(c)
+      if (!permission.ok) {
+        return c.json(permission.response, 403)
+      }
+
+      const payload = c.get("organizationContext")
+      const params = c.req.valid("param")
+
+      let teamId: TeamId
+      try {
+        teamId = parseTeamId(params.teamId)
+      } catch {
+        return c.json({ error: "team_not_found" }, 404)
+      }
+
+      const teamRows = await db
+        .select()
+        .from(TeamTable)
+        .where(and(eq(TeamTable.id, teamId), eq(TeamTable.organizationId, payload.organization.id)))
+        .limit(1)
+
+      const team = teamRows[0]
+      if (!team) {
+        return c.json({ error: "team_not_found" }, 404)
+      }
+
+      await db.transaction(async (tx) => {
+        await tx.delete(SkillHubMemberTable).where(eq(SkillHubMemberTable.teamId, team.id))
+        await tx.delete(TeamMemberTable).where(eq(TeamMemberTable.teamId, team.id))
+        await tx.delete(TeamTable).where(eq(TeamTable.id, team.id))
+      })
+
+      return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/version/README.md b/ee/apps/den-api/src/routes/version/README.md
new file mode 100644
index 0000000000..b2ddf7ca86
--- /dev/null
+++ b/ee/apps/den-api/src/routes/version/README.md
@@ -0,0 +1,3 @@
+# Version Routes
+
+This folder contains public Den API routes that expose app version metadata for desktop clients.
diff --git a/ee/apps/den-api/src/routes/version/index.ts b/ee/apps/den-api/src/routes/version/index.ts
new file mode 100644
index 0000000000..9709889fc3
--- /dev/null
+++ b/ee/apps/den-api/src/routes/version/index.ts
@@ -0,0 +1,27 @@
+import type { Env, Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { jsonResponse } from "../../openapi.js"
+import { denApiAppVersion } from "../../version.js"
+
+const appVersionResponseSchema = z.object({
+  minAppVersion: z.string(),
+  latestAppVersion: z.string().min(1),
+}).meta({ ref: "DenAppVersionResponse" })
+
+export function registerVersionRoutes<T extends Env>(app: Hono<T>) {
+  app.get(
+    "/v1/app-version",
+    describeRoute({
+      tags: ["System"],
+      summary: "Get desktop app version metadata",
+      description: "Returns the minimum supported desktop app version and the latest desktop app version published with this Den API build.",
+      responses: {
+        200: jsonResponse("Desktop app version metadata returned successfully.", appVersionResponseSchema),
+      },
+    }),
+    (c) => {
+      return c.json(denApiAppVersion)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/webhooks/github.ts b/ee/apps/den-api/src/routes/webhooks/github.ts
new file mode 100644
index 0000000000..13d5d22906
--- /dev/null
+++ b/ee/apps/den-api/src/routes/webhooks/github.ts
@@ -0,0 +1,100 @@
+import { createHmac, timingSafeEqual } from "node:crypto"
+import type { Env, Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { env } from "../../env.js"
+import { emptyResponse, jsonResponse } from "../../openapi.js"
+import { enqueueGithubWebhookSync } from "../org/plugin-system/store.js"
+import {
+  githubWebhookAcceptedResponseSchema,
+  githubWebhookIgnoredResponseSchema,
+  githubWebhookUnauthorizedResponseSchema,
+} from "../org/plugin-system/schemas.js"
+import { pluginArchRoutePaths } from "../org/plugin-system/contracts.js"
+
+export function signGithubBody(rawBody: string, secret: string) {
+  return `sha256=${createHmac("sha256", secret).update(rawBody).digest("hex")}`
+}
+
+export function safeCompareGithubSignature(received: string, expected: string) {
+  const encoder = new TextEncoder()
+  const receivedBuffer = encoder.encode(received)
+  const expectedBuffer = encoder.encode(expected)
+  if (receivedBuffer.length !== expectedBuffer.length) {
+    return false
+  }
+  return timingSafeEqual(receivedBuffer, expectedBuffer)
+}
+
+export function registerGithubWebhookRoutes<T extends Env>(app: Hono<T>) {
+  app.post(
+    pluginArchRoutePaths.githubWebhookIngress,
+    describeRoute({
+      tags: ["Webhooks"],
+      summary: "GitHub webhook ingress",
+      description: "Verifies a GitHub App webhook signature against the raw request body, then records any relevant sync work.",
+      responses: {
+        200: jsonResponse("Ignored but valid GitHub webhook delivery.", githubWebhookIgnoredResponseSchema),
+        202: jsonResponse("Accepted GitHub webhook delivery.", githubWebhookAcceptedResponseSchema),
+        401: jsonResponse("Invalid GitHub webhook signature.", githubWebhookUnauthorizedResponseSchema),
+        503: emptyResponse("GitHub webhook secret is not configured."),
+      },
+    }),
+    async (c) => {
+      const secret = env.githubConnectorApp.webhookSecret
+      if (!secret) {
+        return c.body(null, 503)
+      }
+
+      const rawBody = await c.req.raw.text()
+      const signature = c.req.raw.headers.get("x-hub-signature-256")?.trim() ?? ""
+      if (!signature) {
+        return c.json({ ok: false, error: "invalid signature" }, 401)
+      }
+
+      const expected = signGithubBody(rawBody, secret)
+      if (!safeCompareGithubSignature(signature, expected)) {
+        return c.json({ ok: false, error: "invalid signature" }, 401)
+      }
+
+      const event = c.req.raw.headers.get("x-github-event")?.trim() ?? ""
+      const deliveryId = c.req.raw.headers.get("x-github-delivery")?.trim() ?? ""
+      if (!event || !deliveryId) {
+        return c.json({ ok: true, accepted: false, reason: "event ignored" }, 200)
+      }
+
+      const normalizedEvent = event === "push" || event === "installation" || event === "installation_repositories" || event === "repository"
+        ? event
+        : null
+      if (!normalizedEvent) {
+        return c.json({ ok: true, accepted: false, reason: "event ignored" }, 200)
+      }
+
+      const payload = JSON.parse(rawBody) as Record<string, unknown>
+      const installationId = payload.installation && typeof payload.installation === "object" && typeof (payload.installation as Record<string, unknown>).id === "number"
+        ? (payload.installation as Record<string, unknown>).id as number
+        : undefined
+      const repository = payload.repository && typeof payload.repository === "object" ? payload.repository as Record<string, unknown> : null
+      const repositoryFullName = typeof repository?.full_name === "string" ? repository.full_name : undefined
+      const repositoryId = typeof repository?.id === "number" ? repository.id : undefined
+      const ref = typeof payload.ref === "string" ? payload.ref : undefined
+      const headSha = typeof payload.after === "string" ? payload.after : undefined
+
+      const accepted = await enqueueGithubWebhookSync({
+        deliveryId,
+        event: normalizedEvent,
+        headSha,
+        installationId,
+        payload,
+        ref,
+        repositoryFullName,
+        repositoryId,
+      })
+
+      if (!accepted.accepted) {
+        return c.json({ ok: true, accepted: false, reason: accepted.reason }, 200)
+      }
+
+      return c.json({ ok: true, accepted: true, deliveryId, event: normalizedEvent, queued: accepted.queued }, 202)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/webhooks/index.ts b/ee/apps/den-api/src/routes/webhooks/index.ts
new file mode 100644
index 0000000000..ac3643fb32
--- /dev/null
+++ b/ee/apps/den-api/src/routes/webhooks/index.ts
@@ -0,0 +1,6 @@
+import type { Env, Hono } from "hono"
+import { registerGithubWebhookRoutes } from "./github.js"
+
+export function registerWebhookRoutes<T extends Env>(app: Hono<T>) {
+  registerGithubWebhookRoutes(app)
+}
diff --git a/ee/apps/den-api/src/routes/workers/README.md b/ee/apps/den-api/src/routes/workers/README.md
new file mode 100644
index 0000000000..55c5043621
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/README.md
@@ -0,0 +1,24 @@
+# Worker Routes
+
+This folder owns worker lifecycle, runtime, billing, and heartbeat routes.
+
+## Files
+
+- `index.ts`: registers all worker route groups
+- `activity.ts`: unauthenticated worker heartbeat endpoint authenticated by worker activity token
+- `billing.ts`: user-facing cloud worker billing endpoints
+- `core.ts`: list/create/get/update/delete worker routes and token lookup
+- `runtime.ts`: worker runtime inspection and upgrade passthrough endpoints
+- `shared.ts`: worker schemas, helper functions, response mapping, and shared DB/runtime utilities
+
+## Middleware expectations
+
+- Most worker routes use `requireUserMiddleware`
+- Org-scoped worker routes should use `resolveUserOrganizationsMiddleware` to determine the current active org
+- Request payloads, params, and query flags should use Hono Zod validators from `src/middleware/index.ts`
+
+## Notes
+
+- Activity heartbeat is the exception: it uses worker tokens instead of user auth
+- Runtime endpoints proxy to the worker runtime using stored host tokens and instance URLs
+- Provisioning logic lives in `src/workers/`, not in the route handlers themselves
diff --git a/ee/apps/den-api/src/routes/workers/activity.ts b/ee/apps/den-api/src/routes/workers/activity.ts
new file mode 100644
index 0000000000..fe59220f62
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/activity.ts
@@ -0,0 +1,118 @@
+import { and, eq, isNull } from "@openwork-ee/den-db/drizzle"
+import { WorkerTable, WorkerTokenTable } from "@openwork-ee/den-db/schema"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import { jsonValidator, paramValidator } from "../../middleware/index.js"
+import { invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import {
+  activityHeartbeatSchema,
+  newerDate,
+  parseHeartbeatTimestamp,
+  parseWorkerIdParam,
+  readBearerToken,
+  workerIdParamSchema,
+  type WorkerRouteVariables,
+} from "./shared.js"
+
+const workerHeartbeatResponseSchema = z.object({
+  ok: z.literal(true),
+  workerId: z.string(),
+  isActiveRecently: z.boolean(),
+  openSessionCount: z.number().int().nullable(),
+  lastHeartbeatAt: z.string().datetime(),
+  lastActiveAt: z.string().datetime().nullable(),
+}).meta({ ref: "WorkerHeartbeatResponse" })
+
+export function registerWorkerActivityRoutes<T extends { Variables: WorkerRouteVariables }>(app: Hono<T>) {
+  app.post(
+    "/v1/workers/:id/activity-heartbeat",
+    describeRoute({
+      tags: ["Workers", "Worker Activity"],
+      summary: "Record worker heartbeat",
+      description: "Accepts signed heartbeat and recent-activity updates from a worker so Den can track worker health and recent usage.",
+      responses: {
+        200: jsonResponse("Worker heartbeat accepted successfully.", workerHeartbeatResponseSchema),
+        400: jsonResponse("The heartbeat payload or worker path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The worker heartbeat token was missing or invalid.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    paramValidator(workerIdParamSchema),
+    jsonValidator(activityHeartbeatSchema),
+    async (c) => {
+    const params = c.req.valid("param")
+    const body = c.req.valid("json")
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const authorization =
+      readBearerToken(c.req.header("authorization") ?? undefined) ??
+      (c.req.header("x-den-worker-heartbeat-token")?.trim() || null)
+
+    if (!authorization) {
+      return c.json({ error: "unauthorized" }, 401)
+    }
+
+    const tokenRows = await db
+      .select({ id: WorkerTokenTable.id })
+      .from(WorkerTokenTable)
+      .where(
+        and(
+          eq(WorkerTokenTable.worker_id, workerId),
+          eq(WorkerTokenTable.scope, "activity"),
+          eq(WorkerTokenTable.token, authorization),
+          isNull(WorkerTokenTable.revoked_at),
+        ),
+      )
+      .limit(1)
+
+    if (tokenRows.length === 0) {
+      return c.json({ error: "unauthorized" }, 401)
+    }
+
+    const workerRows = await db
+      .select()
+      .from(WorkerTable)
+      .where(eq(WorkerTable.id, workerId))
+      .limit(1)
+
+    const worker = workerRows[0]
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const heartbeatAt = parseHeartbeatTimestamp(body.sentAt) ?? new Date()
+    const requestedActivityAt = parseHeartbeatTimestamp(body.lastActivityAt ?? null)
+    const activityAt = body.isActiveRecently ? (requestedActivityAt ?? heartbeatAt) : null
+
+    const nextHeartbeatAt = newerDate(worker.last_heartbeat_at, heartbeatAt)
+    const nextActiveAt = body.isActiveRecently
+      ? newerDate(worker.last_active_at, activityAt)
+      : worker.last_active_at
+
+    await db
+      .update(WorkerTable)
+      .set({
+        last_heartbeat_at: nextHeartbeatAt,
+        last_active_at: nextActiveAt,
+      })
+      .where(eq(WorkerTable.id, workerId))
+
+    return c.json({
+      ok: true,
+      workerId,
+      isActiveRecently: body.isActiveRecently,
+      openSessionCount: body.openSessionCount ?? null,
+      lastHeartbeatAt: nextHeartbeatAt,
+      lastActiveAt: nextActiveAt,
+    })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/workers/billing.ts b/ee/apps/den-api/src/routes/workers/billing.ts
new file mode 100644
index 0000000000..a63e32e71b
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/billing.ts
@@ -0,0 +1,126 @@
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { env } from "../../env.js"
+import { jsonValidator, queryValidator, requireUserMiddleware } from "../../middleware/index.js"
+import { invalidRequestSchema, jsonResponse, unauthorizedSchema } from "../../openapi.js"
+import { getRequiredUserEmail } from "../../user.js"
+import type { WorkerRouteVariables } from "./shared.js"
+import { billingQuerySchema, billingSubscriptionSchema, getWorkerBilling, setWorkerBillingSubscription, queryIncludesFlag } from "./shared.js"
+
+const workerBillingPayloadSchema = z.object({
+  status: z.string(),
+  featureGateEnabled: z.boolean(),
+  productId: z.string().nullable().optional(),
+  benefitId: z.string().nullable().optional(),
+}).passthrough()
+
+const workerBillingResponseSchema = z.object({
+  billing: workerBillingPayloadSchema,
+}).meta({ ref: "WorkerBillingResponse" })
+
+const workerBillingSubscriptionResponseSchema = z.object({
+  subscription: z.object({}).passthrough(),
+  billing: workerBillingPayloadSchema,
+}).meta({ ref: "WorkerBillingSubscriptionResponse" })
+
+const userEmailRequiredSchema = z.object({
+  error: z.literal("user_email_required"),
+}).meta({ ref: "UserEmailRequiredError" })
+
+export function registerWorkerBillingRoutes<T extends { Variables: WorkerRouteVariables }>(app: Hono<T>) {
+  app.get(
+    "/v1/workers/billing",
+    describeRoute({
+      tags: ["Workers"],
+      hide: true,
+      summary: "Get worker billing status",
+      description: "Returns billing and subscription status for the signed-in user's cloud worker access.",
+      responses: {
+        200: jsonResponse("Worker billing status returned successfully.", workerBillingResponseSchema),
+        400: jsonResponse("The billing query parameters were invalid or the user is missing an email.", z.union([invalidRequestSchema, userEmailRequiredSchema])),
+        401: jsonResponse("The caller must be signed in to read billing status.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    queryValidator(billingQuerySchema),
+    async (c) => {
+    const user = c.get("user")
+    const query = c.req.valid("query")
+    const email = getRequiredUserEmail(user)
+
+    if (!email) {
+      return c.json({ error: "user_email_required" }, 400)
+    }
+
+    const billing = await getWorkerBilling({
+      userId: user.id,
+      email,
+      name: user.name ?? user.email ?? "OpenWork User",
+      includeCheckoutUrl: queryIncludesFlag(query.includeCheckout),
+      includePortalUrl: !queryIncludesFlag(query.excludePortal),
+      includeInvoices: !queryIncludesFlag(query.excludeInvoices),
+    })
+
+    return c.json({
+      billing: {
+        ...billing,
+        productId: env.polar.productId,
+        benefitId: env.polar.benefitId,
+      },
+    })
+    },
+  )
+
+  app.post(
+    "/v1/workers/billing/subscription",
+    describeRoute({
+      tags: ["Workers"],
+      hide: true,
+      summary: "Update worker subscription settings",
+      description: "Updates whether the user's cloud worker subscription should cancel at the end of the current billing period.",
+      responses: {
+        200: jsonResponse("Worker subscription settings updated successfully.", workerBillingSubscriptionResponseSchema),
+        400: jsonResponse("The subscription update payload was invalid or the user is missing an email.", z.union([invalidRequestSchema, userEmailRequiredSchema])),
+        401: jsonResponse("The caller must be signed in to update billing settings.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    jsonValidator(billingSubscriptionSchema),
+    async (c) => {
+    const user = c.get("user")
+    const input = c.req.valid("json")
+    const email = getRequiredUserEmail(user)
+
+    if (!email) {
+      return c.json({ error: "user_email_required" }, 400)
+    }
+
+    const billingInput = {
+      userId: user.id,
+      email,
+      name: user.name ?? user.email ?? "OpenWork User",
+    }
+
+    const subscription = await setWorkerBillingSubscription({
+      ...billingInput,
+      cancelAtPeriodEnd: input.cancelAtPeriodEnd,
+    })
+    const billing = await getWorkerBilling({
+      ...billingInput,
+      includeCheckoutUrl: false,
+      includePortalUrl: true,
+      includeInvoices: true,
+    })
+
+    return c.json({
+      subscription,
+      billing: {
+        ...billing,
+        productId: env.polar.productId,
+        benefitId: env.polar.benefitId,
+      },
+    })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/workers/core.ts b/ee/apps/den-api/src/routes/workers/core.ts
new file mode 100644
index 0000000000..fcd7c408c2
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/core.ts
@@ -0,0 +1,485 @@
+import { desc, eq } from "@openwork-ee/den-db/drizzle"
+import { WorkerTable, WorkerTokenTable } from "@openwork-ee/den-db/schema"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { db } from "../../db.js"
+import { jsonValidator, paramValidator, queryValidator, requireUserMiddleware, resolveUserOrganizationsMiddleware } from "../../middleware/index.js"
+import { denTypeIdSchema, emptyResponse, forbiddenSchema, invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import { getOrganizationLimitStatus } from "../../organization-limits.js"
+import type { WorkerRouteVariables } from "./shared.js"
+import {
+  continueCloudProvisioning,
+  createWorkerSchema,
+  deleteWorkerCascade,
+  getLatestWorkerInstance,
+  getWorkerByIdForOrg,
+  getWorkerTokensAndConnect,
+  listWorkersQuerySchema,
+  parseWorkerIdParam,
+  toInstanceResponse,
+  toWorkerResponse,
+  token,
+  updateWorkerSchema,
+  workerIdParamSchema,
+} from "./shared.js"
+
+const workerInstanceSchema = z.object({
+  provider: z.string(),
+  region: z.string().nullable(),
+  url: z.string().nullable(),
+  status: z.string(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+}).nullable().meta({ ref: "WorkerInstance" })
+
+const workerSchema = z.object({
+  id: denTypeIdSchema("worker"),
+  orgId: denTypeIdSchema("organization"),
+  createdByUserId: denTypeIdSchema("user").nullable(),
+  isMine: z.boolean(),
+  name: z.string(),
+  description: z.string().nullable(),
+  destination: z.string(),
+  status: z.string(),
+  imageVersion: z.string().nullable(),
+  workspacePath: z.string().nullable(),
+  sandboxBackend: z.string().nullable(),
+  lastHeartbeatAt: z.string().datetime().nullable(),
+  lastActiveAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+}).meta({ ref: "Worker" })
+
+const workerListResponseSchema = z.object({
+  workers: z.array(z.object({
+    instance: workerInstanceSchema,
+  }).merge(workerSchema)),
+}).meta({ ref: "WorkerListResponse" })
+
+const workerResponseSchema = z.object({
+  worker: workerSchema,
+  instance: workerInstanceSchema,
+}).meta({ ref: "WorkerResponse" })
+
+const workerCreateResponseSchema = z.object({
+  worker: workerSchema,
+  tokens: z.object({
+    owner: z.string(),
+    host: z.string(),
+    client: z.string(),
+  }),
+  instance: workerInstanceSchema,
+  launch: z.object({
+    mode: z.string(),
+    pollAfterMs: z.number().int(),
+  }),
+}).meta({ ref: "WorkerCreateResponse" })
+
+const workerTokensResponseSchema = z.object({
+  tokens: z.object({
+    owner: z.string(),
+    host: z.string(),
+    client: z.string(),
+  }),
+  connect: z.object({
+    openworkUrl: z.string().nullable(),
+    workspaceId: z.string().nullable(),
+  }).nullable(),
+}).meta({ ref: "WorkerTokensResponse" })
+
+const organizationUnavailableSchema = z.object({
+  error: z.literal("organization_unavailable"),
+}).meta({ ref: "OrganizationUnavailableError" })
+
+const workspacePathRequiredSchema = z.object({
+  error: z.literal("workspace_path_required"),
+}).meta({ ref: "WorkspacePathRequiredError" })
+
+const orgLimitReachedSchema = z.object({
+  error: z.literal("org_limit_reached"),
+  limitType: z.literal("workers"),
+  limit: z.number().int(),
+  currentCount: z.number().int(),
+  message: z.string(),
+}).meta({ ref: "WorkerOrgLimitReachedError" })
+
+const workerRuntimeUnavailableSchema = z.object({
+  error: z.literal("worker_tokens_unavailable"),
+  message: z.string(),
+}).or(z.object({
+  error: z.literal("worker_runtime_unavailable"),
+  message: z.string(),
+})).meta({ ref: "WorkerConnectionError" })
+
+export function registerWorkerCoreRoutes<T extends { Variables: WorkerRouteVariables }>(app: Hono<T>) {
+  app.get(
+    "/v1/workers",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "List workers",
+      description: "Lists the workers that belong to the caller's active organization, including each worker's latest known instance state.",
+      responses: {
+        200: jsonResponse("Workers returned successfully.", workerListResponseSchema),
+        400: jsonResponse("The worker list query parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to list workers.", unauthorizedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    queryValidator(listWorkersQuerySchema),
+    async (c) => {
+    const user = c.get("user")
+    const orgId = c.get("activeOrganizationId")
+    const query = c.req.valid("query")
+
+    if (!orgId) {
+      return c.json({ workers: [] })
+    }
+
+    const rows = await db
+      .select()
+      .from(WorkerTable)
+      .where(eq(WorkerTable.org_id, orgId))
+      .orderBy(desc(WorkerTable.created_at))
+      .limit(query.limit)
+
+    const workers = await Promise.all(
+      rows.map(async (row) => {
+        const instance = await getLatestWorkerInstance(row.id)
+        return {
+          ...toWorkerResponse(row, user.id),
+          instance: toInstanceResponse(instance),
+        }
+      }),
+    )
+
+    return c.json({ workers })
+    },
+  )
+
+  app.post(
+    "/v1/workers",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "Create worker",
+      description: "Creates a local or cloud worker for the active organization and returns the initial tokens needed to connect to it.",
+      responses: {
+        201: jsonResponse("Local worker created successfully.", workerCreateResponseSchema),
+        202: jsonResponse("Cloud worker creation started successfully.", workerCreateResponseSchema),
+        400: jsonResponse("The worker creation payload was invalid.", z.union([invalidRequestSchema, organizationUnavailableSchema, workspacePathRequiredSchema])),
+        401: jsonResponse("The caller must be signed in to create workers.", unauthorizedSchema),
+        409: jsonResponse("The organization has reached its worker limit.", orgLimitReachedSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    jsonValidator(createWorkerSchema),
+    async (c) => {
+    const user = c.get("user")
+    const orgId = c.get("activeOrganizationId")
+    const input = c.req.valid("json")
+
+    if (!orgId) {
+      return c.json({ error: "organization_unavailable" }, 400)
+    }
+
+    if (input.destination === "local" && !input.workspacePath) {
+      return c.json({ error: "workspace_path_required" }, 400)
+    }
+
+    if (input.destination === "cloud") {
+      const workerLimit = await getOrganizationLimitStatus(orgId, "workers")
+      if (workerLimit.exceeded) {
+        return c.json({
+          error: "org_limit_reached",
+          limitType: "workers",
+          limit: workerLimit.limit,
+          currentCount: workerLimit.currentCount,
+          message: `This workspace currently supports up to ${workerLimit.limit} workers. Contact support to increase the limit.`,
+        }, 409)
+      }
+    }
+
+    const workerId = createDenTypeId("worker")
+    const workerStatus = input.destination === "cloud" ? "provisioning" : "healthy"
+
+    await db.insert(WorkerTable).values({
+      id: workerId,
+      org_id: orgId,
+      created_by_user_id: user.id,
+      name: input.name,
+      description: input.description,
+      destination: input.destination,
+      status: workerStatus,
+      image_version: input.imageVersion,
+      workspace_path: input.workspacePath,
+      sandbox_backend: input.sandboxBackend,
+    })
+
+    const hostToken = token()
+    const clientToken = token()
+    const activityToken = token()
+    await db.insert(WorkerTokenTable).values([
+      {
+        id: createDenTypeId("workerToken"),
+        worker_id: workerId,
+        scope: "host",
+        token: hostToken,
+      },
+      {
+        id: createDenTypeId("workerToken"),
+        worker_id: workerId,
+        scope: "client",
+        token: clientToken,
+      },
+      {
+        id: createDenTypeId("workerToken"),
+        worker_id: workerId,
+        scope: "activity",
+        token: activityToken,
+      },
+    ])
+
+    if (input.destination === "cloud") {
+      void continueCloudProvisioning({
+        workerId,
+        name: input.name,
+        hostToken,
+        clientToken,
+        activityToken,
+      })
+    }
+
+    return c.json({
+      worker: toWorkerResponse(
+        {
+          id: workerId,
+          org_id: orgId,
+          created_by_user_id: user.id,
+          name: input.name,
+          description: input.description ?? null,
+          destination: input.destination,
+          status: workerStatus,
+          image_version: input.imageVersion ?? null,
+          workspace_path: input.workspacePath ?? null,
+          sandbox_backend: input.sandboxBackend ?? null,
+          last_heartbeat_at: null,
+          last_active_at: null,
+          created_at: new Date(),
+          updated_at: new Date(),
+        },
+        user.id,
+      ),
+      tokens: {
+        owner: hostToken,
+        host: hostToken,
+        client: clientToken,
+      },
+      instance: null,
+      launch: input.destination === "cloud" ? { mode: "async", pollAfterMs: 5000 } : { mode: "instant", pollAfterMs: 0 },
+    }, input.destination === "cloud" ? 202 : 201)
+    },
+  )
+
+  app.get(
+    "/v1/workers/:id",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "Get worker",
+      description: "Returns one worker from the active organization together with its latest provisioned instance details.",
+      responses: {
+        200: jsonResponse("Worker returned successfully.", workerResponseSchema),
+        400: jsonResponse("The worker path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to read worker details.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    async (c) => {
+    const user = c.get("user")
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const instance = await getLatestWorkerInstance(worker.id)
+
+    return c.json({
+      worker: toWorkerResponse(worker, user.id),
+      instance: toInstanceResponse(instance),
+    })
+    },
+  )
+
+  app.patch(
+    "/v1/workers/:id",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "Update worker",
+      description: "Renames a worker, but only when the caller is the user who originally created that worker.",
+      responses: {
+        200: jsonResponse("Worker updated successfully.", z.object({ worker: workerSchema }).meta({ ref: "WorkerUpdateResponse" })),
+        400: jsonResponse("The worker update request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to update workers.", unauthorizedSchema),
+        403: jsonResponse("Only the worker owner can rename this worker.", forbiddenSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    jsonValidator(updateWorkerSchema),
+    async (c) => {
+    const user = c.get("user")
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+    const input = c.req.valid("json")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    if (worker.created_by_user_id !== user.id) {
+      return c.json({
+        error: "forbidden",
+        message: "Only the worker owner can rename this worker.",
+      }, 403)
+    }
+
+    await db.update(WorkerTable).set({ name: input.name }).where(eq(WorkerTable.id, workerId))
+
+    return c.json({
+      worker: toWorkerResponse(
+        {
+          ...worker,
+          name: input.name,
+          updated_at: new Date(),
+        },
+        user.id,
+      ),
+    })
+    },
+  )
+
+  app.post(
+    "/v1/workers/:id/tokens",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "Get worker connection tokens",
+      description: "Returns connection tokens and the resolved OpenWork connect URL for an existing worker.",
+      responses: {
+        200: jsonResponse("Worker connection tokens returned successfully.", workerTokensResponseSchema),
+        400: jsonResponse("The worker token path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to request worker tokens.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+        409: jsonResponse("The worker is not ready to return connection tokens yet.", workerRuntimeUnavailableSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    async (c) => {
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const resolved = await getWorkerTokensAndConnect(worker)
+    if ("error" in resolved && resolved.error) {
+      return new Response(JSON.stringify(resolved.error.body), {
+        status: resolved.error.status,
+        headers: {
+          "Content-Type": "application/json",
+        },
+      })
+    }
+
+    return c.json(resolved)
+    },
+  )
+
+  app.delete(
+    "/v1/workers/:id",
+    describeRoute({
+      tags: ["Workers"],
+      summary: "Delete worker",
+      description: "Deletes a worker and cascades cleanup for its tokens, runtime records, and provider-specific resources.",
+      responses: {
+        204: emptyResponse("Worker deleted successfully."),
+        400: jsonResponse("The worker deletion path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to delete workers.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    async (c) => {
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    await deleteWorkerCascade(worker)
+    return c.body(null, 204)
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/workers/index.ts b/ee/apps/den-api/src/routes/workers/index.ts
new file mode 100644
index 0000000000..4c14419dfb
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/index.ts
@@ -0,0 +1,13 @@
+import type { Hono } from "hono"
+import type { WorkerRouteVariables } from "./shared.js"
+import { registerWorkerActivityRoutes } from "./activity.js"
+import { registerWorkerBillingRoutes } from "./billing.js"
+import { registerWorkerCoreRoutes } from "./core.js"
+import { registerWorkerRuntimeRoutes } from "./runtime.js"
+
+export function registerWorkerRoutes<T extends { Variables: WorkerRouteVariables }>(app: Hono<T>) {
+  registerWorkerActivityRoutes(app)
+  registerWorkerBillingRoutes(app)
+  registerWorkerCoreRoutes(app)
+  registerWorkerRuntimeRoutes(app)
+}
diff --git a/ee/apps/den-api/src/routes/workers/runtime.ts b/ee/apps/den-api/src/routes/workers/runtime.ts
new file mode 100644
index 0000000000..244e574936
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/runtime.ts
@@ -0,0 +1,115 @@
+import type { Hono } from "hono"
+import { describeRoute } from "hono-openapi"
+import { z } from "zod"
+import { jsonValidator, paramValidator, requireUserMiddleware, resolveUserOrganizationsMiddleware } from "../../middleware/index.js"
+import { invalidRequestSchema, jsonResponse, notFoundSchema, unauthorizedSchema } from "../../openapi.js"
+import type { WorkerRouteVariables } from "./shared.js"
+import { fetchWorkerRuntimeJson, getWorkerByIdForOrg, parseWorkerIdParam, workerIdParamSchema } from "./shared.js"
+
+const workerRuntimeResponseSchema = z.object({}).passthrough().meta({ ref: "WorkerRuntimeResponse" })
+
+export function registerWorkerRuntimeRoutes<T extends { Variables: WorkerRouteVariables }>(app: Hono<T>) {
+  app.get(
+    "/v1/workers/:id/runtime",
+    describeRoute({
+      tags: ["Workers", "Worker Runtime"],
+      summary: "Get worker runtime status",
+      description: "Fetches runtime version and status information from a specific worker's runtime endpoint.",
+      responses: {
+        200: jsonResponse("Worker runtime information returned successfully.", workerRuntimeResponseSchema),
+        400: jsonResponse("The worker runtime path parameters were invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to read worker runtime information.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    async (c) => {
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const runtime = await fetchWorkerRuntimeJson({
+      workerId: worker.id,
+      path: "/runtime/versions",
+    })
+
+    return new Response(JSON.stringify(runtime.payload), {
+      status: runtime.status,
+      headers: {
+        "Content-Type": "application/json",
+      },
+    })
+    },
+  )
+
+  app.post(
+    "/v1/workers/:id/runtime/upgrade",
+    describeRoute({
+      tags: ["Workers", "Worker Runtime"],
+      summary: "Upgrade worker runtime",
+      description: "Forwards a runtime upgrade request to a specific worker and returns the worker runtime's response.",
+      responses: {
+        200: jsonResponse("Worker runtime upgrade request completed successfully.", workerRuntimeResponseSchema),
+        400: jsonResponse("The runtime upgrade request was invalid.", invalidRequestSchema),
+        401: jsonResponse("The caller must be signed in to upgrade a worker runtime.", unauthorizedSchema),
+        404: jsonResponse("The worker could not be found.", notFoundSchema),
+      },
+    }),
+    requireUserMiddleware,
+    resolveUserOrganizationsMiddleware,
+    paramValidator(workerIdParamSchema),
+    jsonValidator(z.object({}).passthrough()),
+    async (c) => {
+    const orgId = c.get("activeOrganizationId")
+    const params = c.req.valid("param")
+    const body = c.req.valid("json")
+
+    if (!orgId) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    let workerId
+    try {
+      workerId = parseWorkerIdParam(params.id)
+    } catch {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const worker = await getWorkerByIdForOrg(workerId, orgId)
+    if (!worker) {
+      return c.json({ error: "worker_not_found" }, 404)
+    }
+
+    const runtime = await fetchWorkerRuntimeJson({
+      workerId: worker.id,
+      path: "/runtime/upgrade",
+      method: "POST",
+      body,
+    })
+
+    return new Response(JSON.stringify(runtime.payload), {
+      status: runtime.status,
+      headers: {
+        "Content-Type": "application/json",
+      },
+    })
+    },
+  )
+}
diff --git a/ee/apps/den-api/src/routes/workers/shared.ts b/ee/apps/den-api/src/routes/workers/shared.ts
new file mode 100644
index 0000000000..9bd16c8c48
--- /dev/null
+++ b/ee/apps/den-api/src/routes/workers/shared.ts
@@ -0,0 +1,495 @@
+import { randomBytes } from "node:crypto"
+import { and, asc, desc, eq, isNull } from "@openwork-ee/den-db/drizzle"
+import {
+  AuditEventTable,
+  AuthUserTable,
+  DaytonaSandboxTable,
+  MemberTable,
+  WorkerBundleTable,
+  WorkerInstanceTable,
+  WorkerTable,
+  WorkerTokenTable,
+} from "@openwork-ee/den-db/schema"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import { z } from "zod"
+import { getCloudWorkerBillingStatus, requireCloudWorkerAccess, setCloudWorkerSubscriptionCancellation } from "../../billing/polar.js"
+import { db } from "../../db.js"
+import { env } from "../../env.js"
+import type { UserOrganizationsContext } from "../../middleware/index.js"
+import { denTypeIdSchema } from "../../openapi.js"
+import type { AuthContextVariables } from "../../session.js"
+import { deprovisionWorker, provisionWorker } from "../../workers/provisioner.js"
+import { customDomainForWorker } from "../../workers/vanity-domain.js"
+
+export const createWorkerSchema = z.object({
+  name: z.string().min(1),
+  description: z.string().optional(),
+  destination: z.enum(["local", "cloud"]),
+  workspacePath: z.string().optional(),
+  sandboxBackend: z.string().optional(),
+  imageVersion: z.string().optional(),
+})
+
+export const updateWorkerSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+})
+
+export const listWorkersQuerySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(50).default(20),
+})
+
+export const billingQuerySchema = z.object({
+  includeCheckout: z.string().optional(),
+  excludePortal: z.string().optional(),
+  excludeInvoices: z.string().optional(),
+})
+
+export const billingSubscriptionSchema = z.object({
+  cancelAtPeriodEnd: z.boolean().default(true),
+})
+
+export const activityHeartbeatSchema = z.object({
+  sentAt: z.string().datetime().optional(),
+  isActiveRecently: z.boolean(),
+  lastActivityAt: z.string().datetime().optional().nullable(),
+  openSessionCount: z.number().int().min(0).optional(),
+})
+
+export const workerIdParamSchema = z.object({
+  id: denTypeIdSchema("worker"),
+})
+
+export type WorkerRouteVariables = AuthContextVariables & Partial<UserOrganizationsContext>
+
+type WorkerRow = typeof WorkerTable.$inferSelect
+type WorkerInstanceRow = typeof WorkerInstanceTable.$inferSelect
+export type WorkerId = WorkerRow["id"]
+type OrgId = typeof MemberTable.$inferSelect.organizationId
+type UserId = typeof AuthUserTable.$inferSelect.id
+
+export const token = () => randomBytes(32).toString("hex")
+
+export function parseWorkerIdParam(value: string): WorkerId {
+  return normalizeDenTypeId("worker", value)
+}
+
+export function parseUserId(value: string): UserId {
+  return normalizeDenTypeId("user", value)
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function normalizeUrl(value: string): string {
+  return value.trim().replace(/\/+$/, "")
+}
+
+function parseWorkspaceSelection(payload: unknown): { workspaceId: string; openworkUrl: string } | null {
+  if (!isRecord(payload) || !Array.isArray(payload.items)) {
+    return null
+  }
+
+  const activeId = typeof payload.activeId === "string" ? payload.activeId : null
+  let workspaceId = activeId
+
+  if (!workspaceId) {
+    for (const item of payload.items) {
+      if (isRecord(item) && typeof item.id === "string" && item.id.trim()) {
+        workspaceId = item.id
+        break
+      }
+    }
+  }
+
+  const baseUrl = typeof payload.baseUrl === "string" ? normalizeUrl(payload.baseUrl) : ""
+  if (!workspaceId || !baseUrl) {
+    return null
+  }
+
+  return {
+    workspaceId,
+    openworkUrl: `${baseUrl}/w/${encodeURIComponent(workspaceId)}`,
+  }
+}
+
+async function resolveConnectUrlFromWorker(instanceUrl: string, clientToken: string) {
+  const baseUrl = normalizeUrl(instanceUrl)
+  if (!baseUrl || !clientToken.trim()) {
+    return null
+  }
+
+  try {
+    const response = await fetch(`${baseUrl}/workspaces`, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${clientToken.trim()}`,
+      },
+    })
+
+    if (!response.ok) {
+      return null
+    }
+
+    const payload = (await response.json()) as unknown
+    const selected = parseWorkspaceSelection({
+      ...(isRecord(payload) ? payload : {}),
+      baseUrl,
+    })
+    return selected
+  } catch {
+    return null
+  }
+}
+
+function getConnectUrlCandidates(workerId: WorkerId, instanceUrl: string | null) {
+  const candidates: string[] = []
+  const vanityHostname = customDomainForWorker(workerId, env.render.workerPublicDomainSuffix)
+  if (vanityHostname) {
+    candidates.push(`https://${vanityHostname}`)
+  }
+
+  if (instanceUrl) {
+    const normalized = normalizeUrl(instanceUrl)
+    if (normalized && !candidates.includes(normalized)) {
+      candidates.push(normalized)
+    }
+  }
+
+  return candidates
+}
+
+export function queryIncludesFlag(value: string | undefined): boolean {
+  if (typeof value !== "string") {
+    return false
+  }
+
+  const normalized = value.trim().toLowerCase()
+  return normalized === "1" || normalized === "true" || normalized === "yes"
+}
+
+export function readBearerToken(value: string | undefined) {
+  const trimmed = value?.trim() ?? ""
+  if (!trimmed.toLowerCase().startsWith("bearer ")) {
+    return null
+  }
+  const tokenValue = trimmed.slice(7).trim()
+  return tokenValue ? tokenValue : null
+}
+
+export function parseHeartbeatTimestamp(value: string | null | undefined) {
+  if (!value) {
+    return null
+  }
+  const parsed = new Date(value)
+  if (Number.isNaN(parsed.getTime())) {
+    return null
+  }
+  return parsed
+}
+
+export function newerDate(current: Date | null | undefined, candidate: Date | null | undefined) {
+  if (!candidate) {
+    return current ?? null
+  }
+  if (!current) {
+    return candidate
+  }
+  return candidate.getTime() > current.getTime() ? candidate : current
+}
+
+async function resolveConnectUrlFromCandidates(workerId: WorkerId, instanceUrl: string | null, clientToken: string) {
+  const candidates = getConnectUrlCandidates(workerId, instanceUrl)
+  for (const candidate of candidates) {
+    const resolved = await resolveConnectUrlFromWorker(candidate, clientToken)
+    if (resolved) {
+      return resolved
+    }
+  }
+  return null
+}
+
+async function getWorkerRuntimeAccess(workerId: WorkerId) {
+  const instance = await getLatestWorkerInstance(workerId)
+  const tokenRows = await db
+    .select()
+    .from(WorkerTokenTable)
+    .where(and(eq(WorkerTokenTable.worker_id, workerId), isNull(WorkerTokenTable.revoked_at)))
+    .orderBy(asc(WorkerTokenTable.created_at))
+
+  const hostToken = tokenRows.find((entry) => entry.scope === "host")?.token ?? null
+  if (!instance?.url || !hostToken) {
+    return null
+  }
+
+  return {
+    instance,
+    hostToken,
+    candidates: getConnectUrlCandidates(workerId, instance.url),
+  }
+}
+
+export async function fetchWorkerRuntimeJson(input: {
+  workerId: WorkerId
+  path: string
+  method?: "GET" | "POST"
+  body?: unknown
+}) {
+  const access = await getWorkerRuntimeAccess(input.workerId)
+  if (!access) {
+    return {
+      ok: false as const,
+      status: 409,
+      payload: {
+        error: "worker_runtime_unavailable",
+        message: "Worker runtime access is not ready yet. Wait for provisioning to finish and try again.",
+      },
+    }
+  }
+
+  let lastPayload: unknown = null
+  let lastStatus = 502
+
+  for (const candidate of access.candidates) {
+    try {
+      const response = await fetch(`${normalizeUrl(candidate)}${input.path}`, {
+        method: input.method ?? "GET",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          "X-OpenWork-Host-Token": access.hostToken,
+        },
+        body: input.body === undefined ? undefined : JSON.stringify(input.body),
+      })
+
+      const text = await response.text()
+      lastStatus = response.status
+      try {
+        lastPayload = text ? JSON.parse(text) : null
+      } catch {
+        lastPayload = text ? { message: text } : null
+      }
+
+      if (response.ok) {
+        return { ok: true as const, status: response.status, payload: lastPayload }
+      }
+    } catch (error) {
+      lastPayload = { message: error instanceof Error ? error.message : "worker_request_failed" }
+    }
+  }
+
+  return { ok: false as const, status: lastStatus, payload: lastPayload }
+}
+
+export async function countUserCloudWorkers(userId: UserId) {
+  const rows = await db
+    .select({ id: WorkerTable.id })
+    .from(WorkerTable)
+    .where(and(eq(WorkerTable.created_by_user_id, userId), eq(WorkerTable.destination, "cloud")))
+    .limit(2)
+
+  return rows.length
+}
+
+export async function getLatestWorkerInstance(workerId: WorkerId) {
+  const rows = await db
+    .select()
+    .from(WorkerInstanceTable)
+    .where(eq(WorkerInstanceTable.worker_id, workerId))
+    .orderBy(desc(WorkerInstanceTable.created_at))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+export function toInstanceResponse(instance: WorkerInstanceRow | null) {
+  if (!instance) {
+    return null
+  }
+
+  return {
+    provider: instance.provider,
+    region: instance.region,
+    url: instance.url,
+    status: instance.status,
+    createdAt: instance.created_at,
+    updatedAt: instance.updated_at,
+  }
+}
+
+export function toWorkerResponse(row: WorkerRow, userId: string) {
+  return {
+    id: row.id,
+    orgId: row.org_id,
+    createdByUserId: row.created_by_user_id,
+    isMine: row.created_by_user_id === userId,
+    name: row.name,
+    description: row.description,
+    destination: row.destination,
+    status: row.status,
+    imageVersion: row.image_version,
+    workspacePath: row.workspace_path,
+    sandboxBackend: row.sandbox_backend,
+    lastHeartbeatAt: row.last_heartbeat_at,
+    lastActiveAt: row.last_active_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  }
+}
+
+export async function continueCloudProvisioning(input: {
+  workerId: WorkerId
+  name: string
+  hostToken: string
+  clientToken: string
+  activityToken: string
+}) {
+  try {
+    const provisioned = await provisionWorker({
+      workerId: input.workerId,
+      name: input.name,
+      hostToken: input.hostToken,
+      clientToken: input.clientToken,
+      activityToken: input.activityToken,
+    })
+
+    await db
+      .update(WorkerTable)
+      .set({ status: provisioned.status })
+      .where(eq(WorkerTable.id, input.workerId))
+
+    await db.insert(WorkerInstanceTable).values({
+      id: createDenTypeId("workerInstance"),
+      worker_id: input.workerId,
+      provider: provisioned.provider,
+      region: provisioned.region,
+      url: provisioned.url,
+      status: provisioned.status,
+    })
+  } catch (error) {
+    await db
+      .update(WorkerTable)
+      .set({ status: "failed" })
+      .where(eq(WorkerTable.id, input.workerId))
+
+    const message = error instanceof Error ? error.message : "provisioning_failed"
+    console.error(`[workers] provisioning failed for ${input.workerId}: ${message}`)
+  }
+}
+
+export async function requireCloudAccessOrPayment(input: {
+  userId: UserId
+  email: string
+  name: string
+}) {
+  return requireCloudWorkerAccess(input)
+}
+
+export async function getWorkerBilling(input: {
+  userId: UserId
+  email: string
+  name: string
+  includeCheckoutUrl: boolean
+  includePortalUrl: boolean
+  includeInvoices: boolean
+}) {
+  return getCloudWorkerBillingStatus(
+    {
+      userId: input.userId,
+      email: input.email,
+      name: input.name,
+    },
+    {
+      includeCheckoutUrl: input.includeCheckoutUrl,
+      includePortalUrl: input.includePortalUrl,
+      includeInvoices: input.includeInvoices,
+    },
+  )
+}
+
+export async function setWorkerBillingSubscription(input: {
+  userId: UserId
+  email: string
+  name: string
+  cancelAtPeriodEnd: boolean
+}) {
+  return setCloudWorkerSubscriptionCancellation(
+    {
+      userId: input.userId,
+      email: input.email,
+      name: input.name,
+    },
+    input.cancelAtPeriodEnd,
+  )
+}
+
+export async function getWorkerTokensAndConnect(worker: WorkerRow) {
+  const tokenRows = await db
+    .select()
+    .from(WorkerTokenTable)
+    .where(and(eq(WorkerTokenTable.worker_id, worker.id), isNull(WorkerTokenTable.revoked_at)))
+    .orderBy(asc(WorkerTokenTable.created_at))
+
+  const hostToken = tokenRows.find((entry) => entry.scope === "host")?.token ?? null
+  const clientToken = tokenRows.find((entry) => entry.scope === "client")?.token ?? null
+
+  if (!hostToken || !clientToken) {
+    return {
+      error: {
+        status: 409,
+        body: {
+          error: "worker_tokens_unavailable",
+          message: "Worker tokens are missing for this worker. Launch a new worker and try again.",
+        },
+      },
+    }
+  }
+
+  const instance = await getLatestWorkerInstance(worker.id)
+  const connect = await resolveConnectUrlFromCandidates(worker.id, instance?.url ?? null, clientToken)
+
+  return {
+    tokens: {
+      owner: hostToken,
+      host: hostToken,
+      client: clientToken,
+    },
+    connect: connect ?? (instance?.url ? { openworkUrl: instance.url, workspaceId: null } : null),
+  }
+}
+
+export async function deleteWorkerCascade(worker: WorkerRow) {
+  const instance = await getLatestWorkerInstance(worker.id)
+
+  if (worker.destination === "cloud") {
+    try {
+      await deprovisionWorker({
+        workerId: worker.id,
+        instanceUrl: instance?.url ?? null,
+      })
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "deprovision_failed"
+      console.warn(`[workers] deprovision warning for ${worker.id}: ${message}`)
+    }
+  }
+
+  await db.transaction(async (tx) => {
+    await tx.delete(WorkerTokenTable).where(eq(WorkerTokenTable.worker_id, worker.id))
+    await tx.delete(DaytonaSandboxTable).where(eq(DaytonaSandboxTable.worker_id, worker.id))
+    await tx.delete(WorkerInstanceTable).where(eq(WorkerInstanceTable.worker_id, worker.id))
+    await tx.delete(WorkerBundleTable).where(eq(WorkerBundleTable.worker_id, worker.id))
+    await tx.delete(AuditEventTable).where(eq(AuditEventTable.worker_id, worker.id))
+    await tx.delete(WorkerTable).where(eq(WorkerTable.id, worker.id))
+  })
+}
+
+export async function getWorkerByIdForOrg(workerId: WorkerId, orgId: OrgId) {
+  const rows = await db
+    .select()
+    .from(WorkerTable)
+    .where(and(eq(WorkerTable.id, workerId), eq(WorkerTable.org_id, orgId)))
+    .limit(1)
+
+  return rows[0] ?? null
+}
diff --git a/ee/apps/den-api/src/server.ts b/ee/apps/den-api/src/server.ts
new file mode 100644
index 0000000000..a60f9ac887
--- /dev/null
+++ b/ee/apps/den-api/src/server.ts
@@ -0,0 +1,7 @@
+import { serve } from "@hono/node-server"
+import app from "./app.js"
+import { env } from "./env.js"
+
+serve({ fetch: app.fetch, port: env.port }, (info) => {
+  console.log(`den-api listening on ${info.port}`)
+})
diff --git a/ee/apps/den-api/src/session.ts b/ee/apps/den-api/src/session.ts
new file mode 100644
index 0000000000..c455b0e00b
--- /dev/null
+++ b/ee/apps/den-api/src/session.ts
@@ -0,0 +1,220 @@
+import { and, eq, gt } from "@openwork-ee/den-db/drizzle"
+import { AuthSessionTable, AuthUserTable } from "@openwork-ee/den-db/schema"
+import { normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import { createHmac, timingSafeEqual } from "node:crypto"
+import type { MiddlewareHandler } from "hono"
+import { DEN_API_KEY_HEADER, getApiKeySessionById, type DenApiKeySession } from "./api-keys.js"
+import { auth } from "./auth.js"
+import { db } from "./db.js"
+import { env } from "./env.js"
+
+type AuthSessionLike = Awaited<ReturnType<typeof auth.api.getSession>>
+type AuthSessionValue = NonNullable<AuthSessionLike>
+
+export type AuthContextVariables = {
+  user: AuthSessionValue["user"] | null
+  session: AuthSessionValue["session"] | null
+  apiKey: DenApiKeySession | null
+}
+
+const INTERNAL_MCP_PRINCIPAL_HEADER = "x-den-internal-mcp-principal"
+const INTERNAL_MCP_PRINCIPAL_TTL_MS = 60_000
+
+type InternalMcpPrincipal = {
+  userId: string
+  organizationId: string
+  expiresAt: number
+}
+
+function signPrincipalPayload(payload: string) {
+  return createHmac("sha256", env.betterAuthSecret).update(payload).digest("base64url")
+}
+
+function verifySignature(payload: string, signature: string) {
+  const expected = signPrincipalPayload(payload)
+  const expectedBuffer = new Uint8Array(Buffer.from(expected))
+  const receivedBuffer = new Uint8Array(Buffer.from(signature))
+  return expectedBuffer.length === receivedBuffer.length && timingSafeEqual(expectedBuffer, receivedBuffer)
+}
+
+export function createInternalMcpPrincipalHeader(input: { userId: string; organizationId: string }) {
+  const principal: InternalMcpPrincipal = {
+    userId: normalizeDenTypeId("user", input.userId),
+    organizationId: normalizeDenTypeId("organization", input.organizationId),
+    expiresAt: Date.now() + INTERNAL_MCP_PRINCIPAL_TTL_MS,
+  }
+  const payload = Buffer.from(JSON.stringify(principal), "utf8").toString("base64url")
+  return `${payload}.${signPrincipalPayload(payload)}`
+}
+
+async function getSessionFromInternalMcpPrincipal(headers: Headers): Promise<(AuthSessionValue & { activeOrganizationId: string }) | null> {
+  const header = headers.get(INTERNAL_MCP_PRINCIPAL_HEADER)
+  if (!header) {
+    return null
+  }
+
+  const [payload, signature] = header.split(".")
+  if (!payload || !signature || !verifySignature(payload, signature)) {
+    return null
+  }
+
+  let parsed: InternalMcpPrincipal
+  try {
+    parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as InternalMcpPrincipal
+  } catch {
+    return null
+  }
+
+  if (typeof parsed.userId !== "string" || typeof parsed.organizationId !== "string" || typeof parsed.expiresAt !== "number" || parsed.expiresAt < Date.now()) {
+    return null
+  }
+
+  const rows = await db
+    .select({
+      id: AuthUserTable.id,
+      name: AuthUserTable.name,
+      email: AuthUserTable.email,
+      emailVerified: AuthUserTable.emailVerified,
+      image: AuthUserTable.image,
+      createdAt: AuthUserTable.createdAt,
+      updatedAt: AuthUserTable.updatedAt,
+    })
+    .from(AuthUserTable)
+    .where(eq(AuthUserTable.id, normalizeDenTypeId("user", parsed.userId)))
+    .limit(1)
+
+  const user = rows[0]
+  if (!user) {
+    return null
+  }
+
+  return {
+    user: {
+      ...user,
+      id: normalizeDenTypeId("user", user.id),
+    },
+    session: {
+      id: "mcp_internal",
+      token: "mcp_internal",
+      userId: user.id,
+      activeOrganizationId: normalizeDenTypeId("organization", parsed.organizationId),
+      activeTeamId: null,
+      expiresAt: new Date(parsed.expiresAt),
+      createdAt: new Date(),
+      updatedAt: new Date(),
+      ipAddress: null,
+      userAgent: null,
+    },
+    activeOrganizationId: normalizeDenTypeId("organization", parsed.organizationId),
+  }
+}
+
+function readBearerToken(headers: Headers): string | null {
+  const header = headers.get("authorization")?.trim() ?? ""
+  if (!header) {
+    return null
+  }
+
+  const match = header.match(/^Bearer\s+(.+)$/i)
+  if (!match) {
+    return null
+  }
+
+  const token = match[1]?.trim() ?? ""
+  return token || null
+}
+
+async function getSessionFromBearerToken(token: string): Promise<AuthSessionLike> {
+  const rows = await db
+    .select({
+      session: {
+        id: AuthSessionTable.id,
+        token: AuthSessionTable.token,
+        userId: AuthSessionTable.userId,
+        activeOrganizationId: AuthSessionTable.activeOrganizationId,
+        activeTeamId: AuthSessionTable.activeTeamId,
+        expiresAt: AuthSessionTable.expiresAt,
+        createdAt: AuthSessionTable.createdAt,
+        updatedAt: AuthSessionTable.updatedAt,
+        ipAddress: AuthSessionTable.ipAddress,
+        userAgent: AuthSessionTable.userAgent,
+      },
+      user: {
+        id: AuthUserTable.id,
+        name: AuthUserTable.name,
+        email: AuthUserTable.email,
+        emailVerified: AuthUserTable.emailVerified,
+        image: AuthUserTable.image,
+        createdAt: AuthUserTable.createdAt,
+        updatedAt: AuthUserTable.updatedAt,
+      },
+    })
+    .from(AuthSessionTable)
+    .innerJoin(AuthUserTable, eq(AuthSessionTable.userId, AuthUserTable.id))
+    .where(and(eq(AuthSessionTable.token, token), gt(AuthSessionTable.expiresAt, new Date())))
+    .limit(1)
+
+  const row = rows[0]
+  if (!row) {
+    return null
+  }
+
+  return {
+    session: row.session,
+    user: {
+      ...row.user,
+      id: normalizeDenTypeId("user", row.user.id),
+    },
+  }
+}
+
+export async function getRequestSession(headers: Headers): Promise<AuthSessionLike> {
+  const internalMcpSession = await getSessionFromInternalMcpPrincipal(headers)
+  if (internalMcpSession) {
+    return internalMcpSession
+  }
+
+  let cookieSession: AuthSessionLike
+  try {
+    cookieSession = await auth.api.getSession({ headers })
+  } catch {
+    return null
+  }
+
+  if (cookieSession?.user?.id) {
+    return {
+      ...cookieSession,
+      user: {
+        ...cookieSession.user,
+        id: normalizeDenTypeId("user", cookieSession.user.id),
+      },
+    }
+  }
+
+  const bearerToken = readBearerToken(headers)
+  if (!bearerToken) {
+    return null
+  }
+
+  return getSessionFromBearerToken(bearerToken)
+}
+
+async function getRequestApiKeySession(headers: Headers, session: AuthSessionLike): Promise<DenApiKeySession | null> {
+  if (!headers.has(DEN_API_KEY_HEADER) || !session?.session?.id) {
+    return null
+  }
+
+  return getApiKeySessionById(session.session.id)
+}
+
+export const sessionMiddleware: MiddlewareHandler<{ Variables: AuthContextVariables }> = async (c, next) => {
+  const resolved = await getRequestSession(c.req.raw.headers)
+  const apiKey = await getRequestApiKeySession(c.req.raw.headers, resolved)
+  c.set("user", resolved?.user ?? null)
+  c.set("session", resolved?.session ?? null)
+  if (resolved?.session?.activeOrganizationId) {
+    ;(c as unknown as { set: (key: string, value: unknown) => void }).set("activeOrganizationId", resolved.session.activeOrganizationId)
+  }
+  c.set("apiKey", apiKey)
+  await next()
+}
diff --git a/ee/apps/den-api/src/user.ts b/ee/apps/den-api/src/user.ts
new file mode 100644
index 0000000000..542622cf2e
--- /dev/null
+++ b/ee/apps/den-api/src/user.ts
@@ -0,0 +1,8 @@
+export function getRequiredUserEmail(user: { id: string; email?: string | null }) {
+  const email = user.email?.trim()
+  if (!email) {
+    return null
+  }
+
+  return email
+}
diff --git a/ee/apps/den-api/src/version.ts b/ee/apps/den-api/src/version.ts
new file mode 100644
index 0000000000..f19c2386d9
--- /dev/null
+++ b/ee/apps/den-api/src/version.ts
@@ -0,0 +1,13 @@
+import { BUILD_LATEST_APP_VERSION } from "./generated/app-version.js";
+
+const MIN_APP_VERSION = "0.11.207";
+
+function normalizeVersion(value: string | undefined | null) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed || null;
+}
+
+export const denApiAppVersion = {
+  minAppVersion: MIN_APP_VERSION,
+  latestAppVersion: normalizeVersion(BUILD_LATEST_APP_VERSION) ?? "0.0.0",
+} as const;
diff --git a/ee/apps/den-api/src/workers/daytona.ts b/ee/apps/den-api/src/workers/daytona.ts
new file mode 100644
index 0000000000..0ec0719057
--- /dev/null
+++ b/ee/apps/den-api/src/workers/daytona.ts
@@ -0,0 +1,559 @@
+import { Daytona, type Sandbox } from "@daytonaio/sdk"
+import { eq } from "@openwork-ee/den-db/drizzle"
+import { DaytonaSandboxTable } from "@openwork-ee/den-db/schema"
+import { createDenTypeId } from "@openwork-ee/utils/typeid"
+import { db } from "../db.js"
+import { env } from "../env.js"
+
+type WorkerId = typeof DaytonaSandboxTable.$inferSelect.worker_id
+
+type ProvisionInput = {
+  workerId: WorkerId
+  name: string
+  hostToken: string
+  clientToken: string
+  activityToken: string
+}
+
+type ProvisionedInstance = {
+  provider: string
+  url: string
+  status: "provisioning" | "healthy"
+  region?: string
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
+const maxSignedPreviewExpirySeconds = 60 * 60 * 24
+const signedPreviewRefreshLeadMs = 5 * 60 * 1000
+
+const slug = (value: string) =>
+  value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+
+function shellQuote(value: string) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`
+}
+
+function createDaytonaClient() {
+  return new Daytona({
+    apiKey: env.daytona.apiKey,
+    apiUrl: env.daytona.apiUrl,
+    ...(env.daytona.target ? { target: env.daytona.target } : {}),
+  })
+}
+
+function normalizedSignedPreviewExpirySeconds() {
+  return Math.max(
+    1,
+    Math.min(env.daytona.signedPreviewExpiresSeconds, maxSignedPreviewExpirySeconds),
+  )
+}
+
+function signedPreviewRefreshAt(expiresInSeconds: number) {
+  return new Date(
+    Date.now() + Math.max(0, expiresInSeconds * 1000 - signedPreviewRefreshLeadMs),
+  )
+}
+
+function workerProxyUrl(workerId: WorkerId) {
+  return `${env.daytona.workerProxyBaseUrl.replace(/\/+$/, "")}/${encodeURIComponent(workerId)}`
+}
+
+function workerActivityHeartbeatUrl(workerId: WorkerId) {
+  const base = env.workerActivityBaseUrl.replace(/\/+$/, "")
+  return `${base}/v1/workers/${encodeURIComponent(workerId)}/activity-heartbeat`
+}
+
+function assertDaytonaConfig() {
+  if (!env.daytona.apiKey) {
+    throw new Error("DAYTONA_API_KEY is required for daytona provisioner")
+  }
+}
+
+function workerHint(workerId: WorkerId) {
+  return workerId.replace(/-/g, "").slice(0, 12)
+}
+
+function sandboxLabels(workerId: WorkerId) {
+  return {
+    "openwork.den.provider": "daytona",
+    "openwork.den.worker-id": workerId,
+  }
+}
+
+function sandboxName(input: ProvisionInput) {
+  return slug(
+    `${env.daytona.sandboxNamePrefix}-${input.name}-${workerHint(input.workerId)}`,
+  ).slice(0, 63)
+}
+
+function sharedVolumeName() {
+  return slug(env.daytona.sharedVolumeName).slice(0, 63)
+}
+
+function workerVolumeRootSubpath(workerId: WorkerId) {
+  return `workers/${workerId}`
+}
+
+function workspaceVolumeSubpath(workerId: WorkerId) {
+  return `${workerVolumeRootSubpath(workerId)}/workspace`
+}
+
+function dataVolumeSubpath(workerId: WorkerId) {
+  return `${workerVolumeRootSubpath(workerId)}/data`
+}
+
+function sharedVolumeMounts(workerId: WorkerId, volumeId: string) {
+  return [
+    {
+      volumeId,
+      mountPath: env.daytona.workspaceMountPath,
+      subpath: workspaceVolumeSubpath(workerId),
+    },
+    {
+      volumeId,
+      mountPath: env.daytona.dataMountPath,
+      subpath: dataVolumeSubpath(workerId),
+    },
+  ]
+}
+
+function buildOpenWorkStartCommand(input: ProvisionInput) {
+  const verifyRuntimeStep = [
+    "if ! command -v openwork >/dev/null 2>&1; then echo 'openwork binary missing from Daytona runtime image; rebuild and republish the Daytona snapshot' >&2; exit 1; fi",
+    "if ! command -v opencode >/dev/null 2>&1; then echo 'opencode binary missing from Daytona runtime image; rebuild and republish the Daytona snapshot' >&2; exit 1; fi",
+  ].join("; ")
+  const openworkServe = [
+    "OPENWORK_DATA_DIR=",
+    shellQuote(env.daytona.runtimeDataPath),
+    " OPENWORK_SIDECAR_DIR=",
+    shellQuote(env.daytona.sidecarDir),
+    " OPENWORK_TOKEN=",
+    shellQuote(input.clientToken),
+    " OPENWORK_HOST_TOKEN=",
+    shellQuote(input.hostToken),
+    " DEN_RUNTIME_PROVIDER=",
+    shellQuote("daytona"),
+    " DEN_WORKER_ID=",
+    shellQuote(input.workerId),
+    " DEN_ACTIVITY_HEARTBEAT_ENABLED=",
+    shellQuote("1"),
+    " DEN_ACTIVITY_HEARTBEAT_URL=",
+    shellQuote(workerActivityHeartbeatUrl(input.workerId)),
+    " DEN_ACTIVITY_HEARTBEAT_TOKEN=",
+    shellQuote(input.activityToken),
+    " openwork serve",
+    ` --workspace ${shellQuote(env.daytona.runtimeWorkspacePath)}`,
+    ` --remote-access`,
+    ` --openwork-port ${env.daytona.openworkPort}`,
+    ` --opencode-host 127.0.0.1`,
+    ` --opencode-port ${env.daytona.opencodePort}`,
+    ` --connect-host 127.0.0.1`,
+    ` --cors '*'`,
+    ` --approval manual`,
+    ` --allow-external`,
+    ` --opencode-source external`,
+    ` --opencode-bin $(command -v opencode)`,
+    ` --no-opencode-router`,
+    ` --verbose`,
+  ].join("")
+
+  const script = `
+set -u
+mkdir -p ${shellQuote(env.daytona.workspaceMountPath)} ${shellQuote(env.daytona.dataMountPath)} ${shellQuote(env.daytona.runtimeWorkspacePath)} ${shellQuote(env.daytona.runtimeDataPath)} ${shellQuote(env.daytona.sidecarDir)} ${shellQuote(`${env.daytona.runtimeWorkspacePath}/volumes`)}
+ln -sfn ${shellQuote(env.daytona.workspaceMountPath)} ${shellQuote(`${env.daytona.runtimeWorkspacePath}/volumes/workspace`) }
+ln -sfn ${shellQuote(env.daytona.dataMountPath)} ${shellQuote(`${env.daytona.runtimeWorkspacePath}/volumes/data`) }
+${verifyRuntimeStep}
+attempt=0
+while [ "$attempt" -lt 3 ]; do
+  attempt=$((attempt + 1))
+  if ${openworkServe}; then
+    exit 0
+  fi
+  status=$?
+  echo "openwork serve failed (attempt $attempt, exit $status); retrying in 3s"
+  sleep 3
+done
+exit 1
+`.trim()
+
+  return `sh -lc ${shellQuote(script)}`
+}
+
+async function waitForVolumeReady(daytona: Daytona, name: string, timeoutMs: number) {
+  const startedAt = Date.now()
+
+  while (Date.now() - startedAt < timeoutMs) {
+    const volume = await daytona.volume.get(name)
+    if (volume.state === "ready") {
+      return volume
+    }
+    await sleep(env.daytona.pollIntervalMs)
+  }
+
+  throw new Error(`Timed out waiting for Daytona volume ${name} to become ready`)
+}
+
+function buildVolumeCleanupCommand(workerId: WorkerId) {
+  return [
+    "node -e",
+    shellQuote(
+      [
+        'const fs = require("node:fs")',
+        'const path = require("node:path")',
+        'for (const dir of process.argv.slice(1)) {',
+        '  fs.mkdirSync(dir, { recursive: true })',
+        '  for (const entry of fs.readdirSync(dir)) {',
+        '    fs.rmSync(path.join(dir, entry), { recursive: true, force: true })',
+        '  }',
+        '}',
+      ].join("; "),
+    ),
+    shellQuote(env.daytona.workspaceMountPath),
+    shellQuote(env.daytona.dataMountPath),
+  ].join(" ")
+}
+
+async function cleanupWorkerDataOnDaytona(daytona: Daytona, workerId: WorkerId) {
+  let sharedVolume
+
+  try {
+    sharedVolume = await waitForVolumeReady(
+      daytona,
+      sharedVolumeName(),
+      env.daytona.createTimeoutSeconds * 1000,
+    )
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown_error"
+    console.warn(`[provisioner] failed to resolve shared Daytona volume for ${workerId}: ${message}`)
+    return
+  }
+
+  let cleanupSandbox: Awaited<ReturnType<typeof daytona.create>> | null = null
+
+  try {
+    cleanupSandbox = await daytona.create(
+      {
+        name: slug(`den-daytona-cleanup-${workerHint(workerId)}`).slice(0, 63),
+        image: env.daytona.image,
+        public: false,
+        autoStopInterval: 0,
+        autoArchiveInterval: 0,
+        autoDeleteInterval: 0,
+        ephemeral: true,
+        envVars: {
+          DEN_RUNTIME_PROVIDER: "daytona-cleanup",
+          DEN_WORKER_ID: workerId,
+        },
+        resources: {
+          cpu: 1,
+          memory: 1,
+          disk: 4,
+        },
+        volumes: sharedVolumeMounts(workerId, sharedVolume.id),
+      },
+      { timeout: env.daytona.createTimeoutSeconds },
+    )
+
+    const result = await cleanupSandbox.process.executeCommand(
+      buildVolumeCleanupCommand(workerId),
+      undefined,
+      undefined,
+      env.daytona.deleteTimeoutSeconds,
+    )
+
+    if (result.exitCode !== 0) {
+      throw new Error(result.result?.trim() || `cleanup command exited with ${result.exitCode}`)
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown_error"
+    console.warn(`[provisioner] failed to cleanup Daytona worker data for ${workerId}: ${message}`)
+  } finally {
+    if (cleanupSandbox) {
+      await cleanupSandbox.delete(env.daytona.deleteTimeoutSeconds).catch((error) => {
+        const message = error instanceof Error ? error.message : "unknown_error"
+        console.warn(`[provisioner] failed to delete Daytona cleanup sandbox for ${workerId}: ${message}`)
+      })
+    }
+  }
+}
+
+async function waitForHealth(url: string, timeoutMs: number, sandbox: Sandbox, sessionId: string, commandId: string) {
+  const startedAt = Date.now()
+
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const response = await fetch(`${url.replace(/\/$/, "")}/health`, { method: "GET" })
+      if (response.ok) {
+        return
+      }
+    } catch {
+      // ignore transient startup failures
+    }
+
+    try {
+      const command = await sandbox.process.getSessionCommand(sessionId, commandId)
+      if (typeof command.exitCode === "number" && command.exitCode !== 0) {
+        const logs = await sandbox.process.getSessionCommandLogs(sessionId, commandId)
+        throw new Error(
+          [
+            `openwork session exited with ${command.exitCode}`,
+            logs.stdout?.trim() ? `stdout:\n${logs.stdout.trim().slice(-4000)}` : "",
+            logs.stderr?.trim() ? `stderr:\n${logs.stderr.trim().slice(-4000)}` : "",
+          ]
+            .filter(Boolean)
+            .join("\n\n"),
+        )
+      }
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("openwork session exited")) {
+        throw error
+      }
+    }
+
+    await sleep(env.daytona.pollIntervalMs)
+  }
+
+  const logs = await sandbox.process.getSessionCommandLogs(sessionId, commandId).catch(
+    () => null,
+  )
+  throw new Error(
+    [
+      `Timed out waiting for Daytona worker health at ${url.replace(/\/$/, "")}/health`,
+      logs?.stdout?.trim() ? `stdout:\n${logs.stdout.trim().slice(-4000)}` : "",
+      logs?.stderr?.trim() ? `stderr:\n${logs.stderr.trim().slice(-4000)}` : "",
+    ]
+      .filter(Boolean)
+      .join("\n\n"),
+  )
+}
+
+async function upsertDaytonaSandbox(input: {
+  workerId: WorkerId
+  sandboxId: string
+  workspaceVolumeId: string
+  dataVolumeId: string
+  signedPreviewUrl: string
+  signedPreviewUrlExpiresAt: Date
+  region: string | null
+}) {
+  const existing = await db
+    .select({ id: DaytonaSandboxTable.id })
+    .from(DaytonaSandboxTable)
+    .where(eq(DaytonaSandboxTable.worker_id, input.workerId))
+    .limit(1)
+
+  if (existing.length > 0) {
+    await db
+      .update(DaytonaSandboxTable)
+      .set({
+        sandbox_id: input.sandboxId,
+        workspace_volume_id: input.workspaceVolumeId,
+        data_volume_id: input.dataVolumeId,
+        signed_preview_url: input.signedPreviewUrl,
+        signed_preview_url_expires_at: input.signedPreviewUrlExpiresAt,
+        region: input.region,
+      })
+      .where(eq(DaytonaSandboxTable.worker_id, input.workerId))
+    return
+  }
+
+  await db.insert(DaytonaSandboxTable).values({
+    id: createDenTypeId("daytonaSandbox"),
+    worker_id: input.workerId,
+    sandbox_id: input.sandboxId,
+    workspace_volume_id: input.workspaceVolumeId,
+    data_volume_id: input.dataVolumeId,
+    signed_preview_url: input.signedPreviewUrl,
+    signed_preview_url_expires_at: input.signedPreviewUrlExpiresAt,
+    region: input.region,
+  })
+}
+
+export async function getDaytonaSandboxRecord(workerId: WorkerId) {
+  const rows = await db
+    .select()
+    .from(DaytonaSandboxTable)
+    .where(eq(DaytonaSandboxTable.worker_id, workerId))
+    .limit(1)
+
+  return rows[0] ?? null
+}
+
+export async function refreshDaytonaSignedPreview(workerId: WorkerId) {
+  assertDaytonaConfig()
+
+  const record = await getDaytonaSandboxRecord(workerId)
+  if (!record) {
+    return null
+  }
+
+  const daytona = createDaytonaClient()
+  const sandbox = await daytona.get(record.sandbox_id)
+  await sandbox.refreshData()
+
+  const expiresInSeconds = normalizedSignedPreviewExpirySeconds()
+  const preview = await sandbox.getSignedPreviewUrl(env.daytona.openworkPort, expiresInSeconds)
+  const expiresAt = signedPreviewRefreshAt(expiresInSeconds)
+
+  await db
+    .update(DaytonaSandboxTable)
+    .set({
+      signed_preview_url: preview.url,
+      signed_preview_url_expires_at: expiresAt,
+      region: sandbox.target,
+    })
+    .where(eq(DaytonaSandboxTable.worker_id, workerId))
+
+  return {
+    ...record,
+    signed_preview_url: preview.url,
+    signed_preview_url_expires_at: expiresAt,
+    region: sandbox.target,
+  }
+}
+
+export async function getDaytonaSignedPreviewForProxy(workerId: WorkerId) {
+  const record = await getDaytonaSandboxRecord(workerId)
+  if (!record) {
+    return null
+  }
+
+  if (record.signed_preview_url_expires_at.getTime() > Date.now()) {
+    return record.signed_preview_url
+  }
+
+  const refreshed = await refreshDaytonaSignedPreview(workerId)
+  return refreshed?.signed_preview_url ?? null
+}
+
+export async function provisionWorkerOnDaytona(
+  input: ProvisionInput,
+): Promise<ProvisionedInstance> {
+  assertDaytonaConfig()
+
+  const daytona = createDaytonaClient()
+  const labels = sandboxLabels(input.workerId)
+  const sharedVolumeNameValue = sharedVolumeName()
+  await daytona.volume.get(sharedVolumeNameValue, true)
+  const sharedVolume = await waitForVolumeReady(
+    daytona,
+    sharedVolumeNameValue,
+    env.daytona.createTimeoutSeconds * 1000,
+  )
+  let sandbox: Awaited<ReturnType<typeof daytona.create>> | null = null
+
+  try {
+    sandbox = env.daytona.snapshot
+      ? await daytona.create(
+          {
+            name: sandboxName(input),
+            snapshot: env.daytona.snapshot,
+            autoStopInterval: env.daytona.autoStopInterval,
+            autoArchiveInterval: env.daytona.autoArchiveInterval,
+            autoDeleteInterval: env.daytona.autoDeleteInterval,
+            public: env.daytona.public,
+            labels,
+            envVars: {
+              DEN_WORKER_ID: input.workerId,
+              DEN_RUNTIME_PROVIDER: "daytona",
+            },
+            volumes: sharedVolumeMounts(input.workerId, sharedVolume.id),
+          },
+          { timeout: env.daytona.createTimeoutSeconds },
+        )
+      : await daytona.create(
+          {
+            name: sandboxName(input),
+            image: env.daytona.image,
+            autoStopInterval: env.daytona.autoStopInterval,
+            autoArchiveInterval: env.daytona.autoArchiveInterval,
+            autoDeleteInterval: env.daytona.autoDeleteInterval,
+            public: env.daytona.public,
+            labels,
+            envVars: {
+              DEN_WORKER_ID: input.workerId,
+              DEN_RUNTIME_PROVIDER: "daytona",
+            },
+            resources: {
+              cpu: env.daytona.resources.cpu,
+              memory: env.daytona.resources.memory,
+              disk: env.daytona.resources.disk,
+            },
+            volumes: sharedVolumeMounts(input.workerId, sharedVolume.id),
+          },
+          { timeout: env.daytona.createTimeoutSeconds },
+        )
+
+    const sessionId = `openwork-${workerHint(input.workerId)}`
+    await sandbox.process.createSession(sessionId)
+    const command = await sandbox.process.executeSessionCommand(
+      sessionId,
+      {
+        command: buildOpenWorkStartCommand(input),
+        runAsync: true,
+      },
+      0,
+    )
+
+    const expiresInSeconds = normalizedSignedPreviewExpirySeconds()
+    const preview = await sandbox.getSignedPreviewUrl(env.daytona.openworkPort, expiresInSeconds)
+    await waitForHealth(preview.url, env.daytona.healthcheckTimeoutMs, sandbox, sessionId, command.cmdId)
+    await upsertDaytonaSandbox({
+      workerId: input.workerId,
+      sandboxId: sandbox.id,
+      workspaceVolumeId: sharedVolume.id,
+      dataVolumeId: sharedVolume.id,
+      signedPreviewUrl: preview.url,
+      signedPreviewUrlExpiresAt: signedPreviewRefreshAt(expiresInSeconds),
+      region: sandbox.target ?? null,
+    })
+
+    return {
+      provider: "daytona",
+      url: workerProxyUrl(input.workerId),
+      status: "healthy",
+      region: sandbox.target,
+    }
+  } catch (error) {
+    if (sandbox) {
+      await sandbox.delete(env.daytona.deleteTimeoutSeconds).catch(() => {})
+    }
+    throw error
+  }
+}
+
+export async function deprovisionWorkerOnDaytona(workerId: WorkerId) {
+  assertDaytonaConfig()
+
+  const daytona = createDaytonaClient()
+  const record = await getDaytonaSandboxRecord(workerId)
+
+  if (record) {
+    try {
+      const sandbox = await daytona.get(record.sandbox_id)
+      await sandbox.delete(env.daytona.deleteTimeoutSeconds)
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "unknown_error"
+      console.warn(`[provisioner] failed to delete Daytona sandbox ${record.sandbox_id}: ${message}`)
+    }
+
+    await cleanupWorkerDataOnDaytona(daytona, workerId)
+
+    return
+  }
+
+  const sandboxes = await daytona.list(sandboxLabels(workerId), 1, 20)
+
+  for (const sandbox of sandboxes.items) {
+    await sandbox.delete(env.daytona.deleteTimeoutSeconds).catch((error) => {
+      const message = error instanceof Error ? error.message : "unknown_error"
+      console.warn(`[provisioner] failed to delete Daytona sandbox ${sandbox.id}: ${message}`)
+    })
+  }
+
+  await cleanupWorkerDataOnDaytona(daytona, workerId)
+}
diff --git a/ee/apps/den-api/src/workers/provisioner.ts b/ee/apps/den-api/src/workers/provisioner.ts
new file mode 100644
index 0000000000..dcf952a34e
--- /dev/null
+++ b/ee/apps/den-api/src/workers/provisioner.ts
@@ -0,0 +1,406 @@
+import { WorkerTable } from "@openwork-ee/den-db/schema"
+import { env } from "../env.js"
+import {
+  deprovisionWorkerOnDaytona,
+  provisionWorkerOnDaytona,
+} from "./daytona.js"
+import {
+  customDomainForWorker,
+  ensureVercelDnsRecord,
+} from "./vanity-domain.js"
+
+type WorkerId = typeof WorkerTable.$inferSelect.id
+
+export type ProvisionInput = {
+  workerId: WorkerId
+  name: string
+  hostToken: string
+  clientToken: string
+  activityToken: string
+}
+
+export type ProvisionedInstance = {
+  provider: string
+  url: string
+  status: "provisioning" | "healthy"
+  region?: string
+}
+
+type RenderService = {
+  id: string
+  name?: string
+  slug?: string
+  serviceDetails?: {
+    url?: string
+    region?: string
+  }
+}
+
+type RenderServiceListRow = {
+  cursor?: string
+  service?: RenderService
+}
+
+type RenderDeploy = {
+  id: string
+  status: string
+}
+
+const terminalDeployStates = new Set([
+  "live",
+  "update_failed",
+  "build_failed",
+  "canceled",
+])
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
+
+const slug = (value: string) =>
+  value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+
+const hostFromUrl = (value: string | null | undefined) => {
+  if (!value) {
+    return ""
+  }
+
+  try {
+    return new URL(value).host.toLowerCase()
+  } catch {
+    return ""
+  }
+}
+
+async function renderRequest<T>(
+  path: string,
+  init: RequestInit = {},
+): Promise<T> {
+  const headers = new Headers(init.headers)
+  headers.set("Authorization", `Bearer ${env.render.apiKey}`)
+  headers.set("Accept", "application/json")
+
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json")
+  }
+
+  const response = await fetch(`${env.render.apiBase}${path}`, {
+    ...init,
+    headers,
+  })
+  const text = await response.text()
+
+  if (!response.ok) {
+    throw new Error(
+      `Render API ${path} failed (${response.status}): ${text.slice(0, 400)}`,
+    )
+  }
+
+  if (!text) {
+    return null as T
+  }
+
+  return JSON.parse(text) as T
+}
+
+async function waitForDeployLive(serviceId: string) {
+  const startedAt = Date.now()
+  let latest: RenderDeploy | null = null
+
+  while (Date.now() - startedAt < env.render.provisionTimeoutMs) {
+    const rows = await renderRequest<Array<{ deploy: RenderDeploy }>>(
+      `/services/${serviceId}/deploys?limit=1`,
+    )
+    latest = rows[0]?.deploy ?? null
+
+    if (latest && terminalDeployStates.has(latest.status)) {
+      if (latest.status !== "live") {
+        throw new Error(
+          `Render deploy ${latest.id} ended with ${latest.status}`,
+        )
+      }
+      return latest
+    }
+
+    await sleep(env.render.pollIntervalMs)
+  }
+
+  throw new Error(
+    `Timed out waiting for Render deploy for service ${serviceId}`,
+  )
+}
+
+async function waitForHealth(
+  url: string,
+  timeoutMs = env.render.healthcheckTimeoutMs,
+) {
+  const healthUrl = `${url.replace(/\/$/, "")}/health`
+  const startedAt = Date.now()
+
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const response = await fetch(healthUrl, { method: "GET" })
+      if (response.ok) {
+        return
+      }
+    } catch {
+      // ignore transient network failures while the instance boots
+    }
+    await sleep(env.render.pollIntervalMs)
+  }
+
+  throw new Error(`Timed out waiting for worker health endpoint ${healthUrl}`)
+}
+
+async function listRenderServices(limit = 200) {
+  const rows: RenderService[] = []
+  let cursor: string | undefined
+
+  while (rows.length < limit) {
+    const query = new URLSearchParams({ limit: "100" })
+    if (cursor) {
+      query.set("cursor", cursor)
+    }
+
+    const page = await renderRequest<RenderServiceListRow[]>(
+      `/services?${query.toString()}`,
+    )
+    if (page.length === 0) {
+      break
+    }
+
+    rows.push(
+      ...page
+        .map((entry) => entry.service)
+        .filter((entry): entry is RenderService => Boolean(entry?.id)),
+    )
+
+    const nextCursor = page[page.length - 1]?.cursor
+    if (!nextCursor || nextCursor === cursor) {
+      break
+    }
+
+    cursor = nextCursor
+  }
+
+  return rows.slice(0, limit)
+}
+
+async function attachRenderCustomDomain(
+  serviceId: string,
+  workerId: string,
+  renderUrl: string,
+) {
+  const hostname = customDomainForWorker(
+    workerId,
+    env.render.workerPublicDomainSuffix,
+  )
+  if (!hostname) {
+    return null
+  }
+
+  try {
+    await renderRequest(`/services/${serviceId}/custom-domains`, {
+      method: "POST",
+      body: JSON.stringify({
+        name: hostname,
+      }),
+    })
+
+    const dnsReady = await ensureVercelDnsRecord({
+      hostname,
+      targetUrl: renderUrl,
+      domain: env.vercel.dnsDomain ?? env.render.workerPublicDomainSuffix,
+      apiBase: env.vercel.apiBase,
+      token: env.vercel.token,
+      teamId: env.vercel.teamId,
+      teamSlug: env.vercel.teamSlug,
+    })
+
+    if (!dnsReady) {
+      console.warn(
+        `[provisioner] vanity dns upsert skipped or failed for ${hostname}; using Render URL fallback`,
+      )
+      return null
+    }
+
+    return `https://${hostname}`
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown_error"
+    console.warn(
+      `[provisioner] custom domain attach failed for ${serviceId}: ${message}`,
+    )
+    return null
+  }
+}
+
+function assertRenderConfig() {
+  if (!env.render.apiKey) {
+    throw new Error("RENDER_API_KEY is required for render provisioner")
+  }
+  if (!env.render.ownerId) {
+    throw new Error("RENDER_OWNER_ID is required for render provisioner")
+  }
+}
+
+async function provisionWorkerOnRender(
+  input: ProvisionInput,
+): Promise<ProvisionedInstance> {
+  assertRenderConfig()
+
+  const serviceName = slug(
+    `${env.render.workerNamePrefix}-${input.name}-${input.workerId.slice(0, 8)}`,
+  ).slice(0, 62)
+  const orchestratorPackage = env.render.workerOpenworkVersion?.trim()
+    ? `openwork-orchestrator@${env.render.workerOpenworkVersion.trim()}`
+    : "openwork-orchestrator"
+  const buildCommand = [
+    `npm install -g ${orchestratorPackage}`,
+    "node ./scripts/install-opencode.mjs",
+  ].join(" && ")
+  const startCommand = [
+    "mkdir -p /tmp/workspace",
+    "attempt=0; while [ $attempt -lt 3 ]; do attempt=$((attempt + 1)); openwork serve --workspace /tmp/workspace --remote-access --openwork-port ${PORT:-10000} --opencode-host 127.0.0.1 --opencode-port 4096 --connect-host 127.0.0.1 --cors '*' --approval manual --allow-external --opencode-source external --opencode-bin ./bin/opencode --no-opencode-router --verbose && exit 0; echo \"openwork serve failed (attempt $attempt); retrying in 3s\"; sleep 3; done; exit 1",
+  ].join(" && ")
+
+  const payload = {
+    type: "web_service",
+    name: serviceName,
+    ownerId: env.render.ownerId,
+    repo: env.render.workerRepo,
+    branch: env.render.workerBranch,
+    autoDeploy: "no",
+    rootDir: env.render.workerRootDir,
+    envVars: [
+      { key: "OPENWORK_TOKEN", value: input.clientToken },
+      { key: "OPENWORK_HOST_TOKEN", value: input.hostToken },
+      { key: "DEN_WORKER_ID", value: input.workerId },
+    ],
+    serviceDetails: {
+      runtime: "node",
+      plan: env.render.workerPlan,
+      region: env.render.workerRegion,
+      healthCheckPath: "/health",
+      envSpecificDetails: {
+        buildCommand,
+        startCommand,
+      },
+    },
+  }
+
+  const created = await renderRequest<{ service: RenderService }>("/services", {
+    method: "POST",
+    body: JSON.stringify(payload),
+  })
+
+  const serviceId = created.service.id
+  await waitForDeployLive(serviceId)
+  const service = await renderRequest<RenderService>(`/services/${serviceId}`)
+  const renderUrl = service.serviceDetails?.url
+
+  if (!renderUrl) {
+    throw new Error(`Render service ${serviceId} has no public URL`)
+  }
+
+  await waitForHealth(renderUrl)
+
+  const customUrl = await attachRenderCustomDomain(
+    serviceId,
+    input.workerId,
+    renderUrl,
+  )
+  let url = renderUrl
+
+  if (customUrl) {
+    try {
+      await waitForHealth(customUrl, env.render.customDomainReadyTimeoutMs)
+      url = customUrl
+    } catch {
+      console.warn(
+        `[provisioner] vanity domain not ready yet for ${input.workerId}; returning Render URL fallback`,
+      )
+    }
+  }
+
+  return {
+    provider: "render",
+    url,
+    status: "healthy",
+    region: service.serviceDetails?.region ?? env.render.workerRegion,
+  }
+}
+
+export async function provisionWorker(
+  input: ProvisionInput,
+): Promise<ProvisionedInstance> {
+  if (env.provisionerMode === "render") {
+    return provisionWorkerOnRender(input)
+  }
+
+  if (env.provisionerMode === "daytona") {
+    return provisionWorkerOnDaytona(input)
+  }
+
+  const template = env.workerUrlTemplate ?? "https://workers.local/{workerId}"
+  const url = template.replace("{workerId}", input.workerId)
+  return {
+    provider: "stub",
+    url,
+    status: "provisioning",
+  }
+}
+
+export async function deprovisionWorker(input: {
+  workerId: WorkerId
+  instanceUrl: string | null
+}) {
+  if (env.provisionerMode === "daytona") {
+    await deprovisionWorkerOnDaytona(input.workerId)
+    return
+  }
+
+  if (env.provisionerMode !== "render") {
+    return
+  }
+
+  assertRenderConfig()
+
+  const targetHost = hostFromUrl(input.instanceUrl)
+  const workerHint = input.workerId.slice(0, 8).toLowerCase()
+
+  const services = await listRenderServices()
+
+  const target =
+    services.find((service) => {
+      if (service.name?.toLowerCase().includes(workerHint)) {
+        return true
+      }
+
+      if (
+        targetHost &&
+        hostFromUrl(service.serviceDetails?.url) === targetHost
+      ) {
+        return true
+      }
+
+      return false
+    }) ?? null
+
+  if (!target) {
+    return
+  }
+
+  try {
+    await renderRequest(`/services/${target.id}/suspend`, {
+      method: "POST",
+      body: JSON.stringify({}),
+    })
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown_error"
+    console.warn(
+      `[provisioner] failed to suspend Render service ${target.id}: ${message}`,
+    )
+  }
+}
diff --git a/ee/apps/den-api/src/workers/vanity-domain.ts b/ee/apps/den-api/src/workers/vanity-domain.ts
new file mode 100644
index 0000000000..13e675f4f9
--- /dev/null
+++ b/ee/apps/den-api/src/workers/vanity-domain.ts
@@ -0,0 +1,183 @@
+function normalizeUrl(value: string): string {
+  return value.trim().replace(/\/+$/, "")
+}
+
+function slug(value: string) {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+}
+
+function splitHostname(hostname: string, domain: string): string | null {
+  const normalizedHost = hostname.trim().toLowerCase()
+  const normalizedDomain = domain.trim().toLowerCase()
+  if (!normalizedHost || !normalizedDomain) {
+    return null
+  }
+
+  if (normalizedHost === normalizedDomain) {
+    return ""
+  }
+
+  if (!normalizedHost.endsWith(`.${normalizedDomain}`)) {
+    return null
+  }
+
+  return normalizedHost.slice(0, -(normalizedDomain.length + 1))
+}
+
+function hostFromUrl(value: string): string | null {
+  try {
+    return new URL(normalizeUrl(value)).host.toLowerCase()
+  } catch {
+    return null
+  }
+}
+
+function withVercelScope(url: URL, teamId?: string, teamSlug?: string) {
+  if (teamId?.trim()) {
+    url.searchParams.set("teamId", teamId.trim())
+  } else if (teamSlug?.trim()) {
+    url.searchParams.set("slug", teamSlug.trim())
+  }
+  return url
+}
+
+type VercelDnsRecord = {
+  id: string
+  type?: string
+  name?: string
+  value?: string
+}
+
+async function vercelRequest<T>(input: {
+  apiBase: string
+  token: string
+  path: string
+  teamId?: string
+  teamSlug?: string
+  method?: "GET" | "POST" | "PATCH"
+  body?: unknown
+}): Promise<T> {
+  const base = normalizeUrl(input.apiBase || "https://api.vercel.com")
+  const url = withVercelScope(new URL(`${base}${input.path}`), input.teamId, input.teamSlug)
+  const headers = new Headers({
+    Authorization: `Bearer ${input.token}`,
+    Accept: "application/json",
+  })
+
+  const init: RequestInit = {
+    method: input.method ?? "GET",
+    headers,
+  }
+
+  if (typeof input.body !== "undefined") {
+    headers.set("Content-Type", "application/json")
+    init.body = JSON.stringify(input.body)
+  }
+
+  const response = await fetch(url, init)
+  const text = await response.text()
+
+  if (!response.ok) {
+    throw new Error(`Vercel API ${input.path} failed (${response.status}): ${text.slice(0, 300)}`)
+  }
+
+  if (!text) {
+    return null as T
+  }
+
+  return JSON.parse(text) as T
+}
+
+export function customDomainForWorker(workerId: string, suffix: string | null | undefined): string | null {
+  const normalizedSuffix = suffix?.trim().toLowerCase()
+  if (!normalizedSuffix) {
+    return null
+  }
+
+  const label = slug(workerId).slice(0, 32)
+  if (!label) {
+    return null
+  }
+
+  return `${label}.${normalizedSuffix}`
+}
+
+export async function ensureVercelDnsRecord(input: {
+  hostname: string
+  targetUrl: string
+  domain: string | null | undefined
+  apiBase?: string
+  token?: string
+  teamId?: string
+  teamSlug?: string
+}): Promise<boolean> {
+  const domain = input.domain?.trim().toLowerCase()
+  const token = input.token?.trim()
+  if (!domain || !token) {
+    return false
+  }
+
+  const name = splitHostname(input.hostname, domain)
+  const targetHost = hostFromUrl(input.targetUrl)
+  if (name === null || !targetHost) {
+    return false
+  }
+
+  const list = await vercelRequest<{ records?: VercelDnsRecord[] }>({
+    apiBase: input.apiBase ?? "https://api.vercel.com",
+    token,
+    teamId: input.teamId,
+    teamSlug: input.teamSlug,
+    path: `/v4/domains/${encodeURIComponent(domain)}/records`,
+  })
+
+  const records = Array.isArray(list.records) ? list.records : []
+  const current = records.find((record) => {
+    if (!record?.id) {
+      return false
+    }
+    if ((record.type ?? "").toUpperCase() !== "CNAME") {
+      return false
+    }
+    return (record.name ?? "") === name
+  })
+
+  if (current && (current.value ?? "").toLowerCase() === targetHost.toLowerCase()) {
+    return true
+  }
+
+  const payload = {
+    name,
+    type: "CNAME",
+    value: targetHost,
+  }
+
+  if (current?.id) {
+    await vercelRequest({
+      apiBase: input.apiBase ?? "https://api.vercel.com",
+      token,
+      teamId: input.teamId,
+      teamSlug: input.teamSlug,
+      method: "PATCH",
+      path: `/v4/domains/${encodeURIComponent(domain)}/records/${encodeURIComponent(current.id)}`,
+      body: payload,
+    })
+    return true
+  }
+
+  await vercelRequest({
+    apiBase: input.apiBase ?? "https://api.vercel.com",
+    token,
+    teamId: input.teamId,
+    teamSlug: input.teamSlug,
+    method: "POST",
+    path: `/v4/domains/${encodeURIComponent(domain)}/records`,
+    body: payload,
+  })
+
+  return true
+}
diff --git a/ee/apps/den-api/test/connector-cleanup.test.ts b/ee/apps/den-api/test/connector-cleanup.test.ts
new file mode 100644
index 0000000000..735575d3ec
--- /dev/null
+++ b/ee/apps/den-api/test/connector-cleanup.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, test } from "bun:test"
+import { planConnectorImportedResourceCleanup } from "../src/routes/org/plugin-system/connector-cleanup.js"
+
+describe("connector cleanup planning", () => {
+  test("deletes connector-owned plugins and marketplaces when only connector memberships remain", () => {
+    const result = planConnectorImportedResourceCleanup({
+      activeMarketplaceMemberships: [
+        { marketplaceId: "marketplace_1", membershipSource: "connector", pluginId: "plugin_1" },
+      ],
+      activeMappingPluginIds: [],
+      activePluginMembershipPluginIds: [],
+      candidateMarketplaceIds: ["marketplace_1"],
+      candidatePluginIds: ["plugin_1"],
+    })
+
+    expect(result).toEqual({
+      marketplaceIdsToDelete: ["marketplace_1"],
+      pluginIdsToDelete: ["plugin_1"],
+    })
+  })
+
+  test("keeps plugins alive when active imported objects remain", () => {
+    const result = planConnectorImportedResourceCleanup({
+      activeMarketplaceMemberships: [
+        { marketplaceId: "marketplace_1", membershipSource: "connector", pluginId: "plugin_1" },
+      ],
+      activeMappingPluginIds: [],
+      activePluginMembershipPluginIds: ["plugin_1"],
+      candidateMarketplaceIds: ["marketplace_1"],
+      candidatePluginIds: ["plugin_1"],
+    })
+
+    expect(result).toEqual({
+      marketplaceIdsToDelete: [],
+      pluginIdsToDelete: [],
+    })
+  })
+
+  test("deletes connector-owned sibling plugins through the marketplace tree", () => {
+    const result = planConnectorImportedResourceCleanup({
+      activeMarketplaceMemberships: [
+        { marketplaceId: "marketplace_1", membershipSource: "connector", pluginId: "plugin_1" },
+        { marketplaceId: "marketplace_1", membershipSource: "connector", pluginId: "plugin_2" },
+      ],
+      activeMappingPluginIds: [],
+      activePluginMembershipPluginIds: [],
+      candidateMarketplaceIds: ["marketplace_1"],
+      candidatePluginIds: ["plugin_1", "plugin_2"],
+    })
+
+    expect(result).toEqual({
+      marketplaceIdsToDelete: ["marketplace_1"],
+      pluginIdsToDelete: ["plugin_1", "plugin_2"],
+    })
+  })
+
+  test("keeps plugins alive when they still have non-connector marketplace dependencies", () => {
+    const result = planConnectorImportedResourceCleanup({
+      activeMarketplaceMemberships: [
+        { marketplaceId: "marketplace_1", membershipSource: "connector", pluginId: "plugin_1" },
+        { marketplaceId: "marketplace_2", membershipSource: "manual", pluginId: "plugin_1" },
+      ],
+      activeMappingPluginIds: [],
+      activePluginMembershipPluginIds: [],
+      candidateMarketplaceIds: ["marketplace_1"],
+      candidatePluginIds: ["plugin_1"],
+    })
+
+    expect(result).toEqual({
+      marketplaceIdsToDelete: [],
+      pluginIdsToDelete: [],
+    })
+  })
+})
diff --git a/ee/apps/den-api/test/github-connector-app.test.ts b/ee/apps/den-api/test/github-connector-app.test.ts
new file mode 100644
index 0000000000..b488485eab
--- /dev/null
+++ b/ee/apps/den-api/test/github-connector-app.test.ts
@@ -0,0 +1,180 @@
+import { describe, expect, test } from "bun:test"
+import { generateKeyPairSync } from "node:crypto"
+import {
+  buildGithubAppInstallUrl,
+  createGithubInstallStateToken,
+  createGithubAppJwt,
+  getGithubAppSummary,
+  getGithubConnectorAppConfig,
+  getGithubInstallationSummary,
+  listGithubInstallationRepositories,
+  normalizeGithubPrivateKey,
+  validateGithubInstallationTarget,
+  verifyGithubInstallStateToken,
+} from "../src/routes/org/plugin-system/github-app.js"
+
+const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 })
+const privateKeyPem = privateKey.export({ format: "pem", type: "pkcs8" }).toString()
+
+describe("github connector app helpers", () => {
+  test("normalizes escaped private keys and produces a signed app JWT", () => {
+    const escapedKey = privateKeyPem.replace(/\n/g, "\\n")
+    expect(normalizeGithubPrivateKey(escapedKey)).toBe(privateKeyPem)
+
+    const config = getGithubConnectorAppConfig({
+      appId: "123456",
+      privateKey: escapedKey,
+    })
+    const jwt = createGithubAppJwt({ ...config, now: new Date("2026-04-21T19:00:00.000Z") })
+    const [headerSegment, payloadSegment, signatureSegment] = jwt.split(".")
+
+    expect(signatureSegment.length).toBeGreaterThan(0)
+    expect(JSON.parse(Buffer.from(headerSegment, "base64url").toString("utf8"))).toEqual({ alg: "RS256", typ: "JWT" })
+    expect(JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"))).toMatchObject({
+      iss: "123456",
+    })
+  })
+
+  test("lists repositories through the GitHub installation token flow", async () => {
+    const requests: Array<{ method: string; url: string }> = []
+    const repositories = await listGithubInstallationRepositories({
+      config: { appId: "123456", privateKey: privateKeyPem },
+      fetchFn: async (url, init) => {
+        requests.push({
+          method: init?.method ?? "GET",
+          url: String(url),
+        })
+
+        if (String(url).endsWith("/access_tokens")) {
+          return new Response(JSON.stringify({ token: "installation-token" }), { status: 201 })
+        }
+
+        if (String(url).endsWith("/contents/.claude-plugin/marketplace.json")) {
+          if (String(url).includes("different-ai/openwork")) {
+            const content = Buffer.from(JSON.stringify({ plugins: [{ name: "a" }, { name: "b" }, { name: "c" }] })).toString("base64")
+            return new Response(JSON.stringify({ content, encoding: "base64" }), { status: 200 })
+          }
+          return new Response(JSON.stringify({ message: "not found" }), { status: 404 })
+        }
+
+        if (String(url).endsWith("/contents/.claude-plugin/plugin.json")) {
+          if (String(url).includes("different-ai/opencode")) {
+            return new Response(JSON.stringify({ name: "plugin.json" }), { status: 200 })
+          }
+          return new Response(JSON.stringify({ message: "not found" }), { status: 404 })
+        }
+
+        return new Response(JSON.stringify({
+          repositories: [
+            { default_branch: "main", full_name: "different-ai/openwork", id: 42, private: true },
+            { default_branch: "dev", full_name: "different-ai/opencode", id: 99, private: false },
+          ],
+        }), { status: 200 })
+      },
+      installationId: 777,
+    })
+
+    expect(requests.map((request) => request.url)).toEqual([
+      "https://api.github.com/app/installations/777/access_tokens",
+      "https://api.github.com/installation/repositories",
+      "https://api.github.com/repos/different-ai/openwork/contents/.claude-plugin/marketplace.json",
+      "https://api.github.com/repos/different-ai/opencode/contents/.claude-plugin/marketplace.json",
+      "https://api.github.com/repos/different-ai/opencode/contents/.claude-plugin/plugin.json",
+    ])
+    expect(repositories).toEqual([
+      { defaultBranch: "main", fullName: "different-ai/openwork", hasPluginManifest: true, id: 42, manifestKind: "marketplace", marketplacePluginCount: 3, private: true },
+      { defaultBranch: "dev", fullName: "different-ai/opencode", hasPluginManifest: true, id: 99, manifestKind: "plugin", marketplacePluginCount: null, private: false },
+    ])
+  })
+
+  test("builds install URLs and validates signed state tokens", async () => {
+    const app = await getGithubAppSummary({
+      config: { appId: "123456", privateKey: privateKeyPem },
+      fetchFn: async () => new Response(JSON.stringify({
+        html_url: "https://github.com/apps/openwork-test",
+        name: "OpenWork Test",
+        slug: "openwork-test",
+      }), { status: 200 }),
+    })
+
+    const token = createGithubInstallStateToken({
+      now: new Date("2026-04-21T19:00:00.000Z"),
+      orgId: "org_123",
+      returnPath: "/o/test-org/dashboard/integrations/github",
+      secret: "secret-123",
+      userId: "user_123",
+    })
+
+    expect(buildGithubAppInstallUrl({ app, state: token })).toBe(`https://github.com/apps/openwork-test/installations/new?state=${encodeURIComponent(token)}`)
+    expect(verifyGithubInstallStateToken({ now: new Date("2026-04-21T19:05:00.000Z"), secret: "secret-123", token })).toMatchObject({
+      orgId: "org_123",
+      returnPath: "/o/test-org/dashboard/integrations/github",
+      userId: "user_123",
+    })
+    expect(verifyGithubInstallStateToken({ now: new Date("2026-04-21T19:05:00.000Z"), secret: "wrong-secret", token })).toBeNull()
+  })
+
+  test("reads GitHub installation account details", async () => {
+    const installation = await getGithubInstallationSummary({
+      config: { appId: "123456", privateKey: privateKeyPem },
+      fetchFn: async (url) => {
+        if (String(url).endsWith("/app/installations/777")) {
+          return new Response(JSON.stringify({
+            account: {
+              login: "different-ai",
+              type: "Organization",
+            },
+            id: 777,
+          }), { status: 200 })
+        }
+        return new Response(JSON.stringify({ message: "not found" }), { status: 404 })
+      },
+      installationId: 777,
+    })
+
+    expect(installation).toEqual({
+      accountLogin: "different-ai",
+      accountType: "Organization",
+      displayName: "different-ai",
+      installationId: 777,
+      repositorySelection: "all",
+      settingsUrl: null,
+    })
+  })
+
+  test("validates repository identity and branch existence against GitHub", async () => {
+    const result = await validateGithubInstallationTarget({
+      branch: "main",
+      config: { appId: "123456", privateKey: privateKeyPem },
+      fetchFn: async (url) => {
+        if (String(url).endsWith("/access_tokens")) {
+          return new Response(JSON.stringify({ token: "installation-token" }), { status: 201 })
+        }
+
+        if (String(url).endsWith("/repos/different-ai/openwork")) {
+          return new Response(JSON.stringify({
+            default_branch: "main",
+            full_name: "different-ai/openwork",
+            id: 42,
+          }), { status: 200 })
+        }
+
+        if (String(url).endsWith("/repos/different-ai/openwork/branches/main")) {
+          return new Response(JSON.stringify({ name: "main" }), { status: 200 })
+        }
+
+        return new Response(JSON.stringify({ message: "not found" }), { status: 404 })
+      },
+      installationId: 777,
+      ref: "refs/heads/main",
+      repositoryFullName: "different-ai/openwork",
+      repositoryId: 42,
+    })
+
+    expect(result).toEqual({
+      branchExists: true,
+      defaultBranch: "main",
+      repositoryAccessible: true,
+    })
+  })
+})
diff --git a/ee/apps/den-api/test/github-discovery.test.ts b/ee/apps/den-api/test/github-discovery.test.ts
new file mode 100644
index 0000000000..45c175095f
--- /dev/null
+++ b/ee/apps/den-api/test/github-discovery.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, test } from "bun:test"
+import { buildGithubRepoDiscovery, type GithubDiscoveryTreeEntry } from "../src/routes/org/plugin-system/github-discovery.js"
+
+function blob(path: string): GithubDiscoveryTreeEntry {
+  return { id: path, kind: "blob", path, sha: null, size: null }
+}
+
+describe("github discovery", () => {
+  test("classifies marketplace repos and resolves local plugin roots", () => {
+    const result = buildGithubRepoDiscovery({
+      entries: [
+        blob(".claude-plugin/marketplace.json"),
+        blob("plugins/sales/.claude-plugin/plugin.json"),
+        blob("plugins/sales/skills/hello/SKILL.md"),
+        blob("plugins/sales/commands/deploy.md"),
+      ],
+      fileTextByPath: {
+        ".claude-plugin/marketplace.json": JSON.stringify({
+          plugins: [
+            { name: "sales", description: "Sales workflows", source: "./plugins/sales" },
+          ],
+        }),
+        "plugins/sales/.claude-plugin/plugin.json": JSON.stringify({
+          name: "sales",
+          description: "Sales plugin",
+        }),
+      },
+    })
+
+    expect(result.classification).toBe("claude_marketplace_repo")
+    expect(result.discoveredPlugins).toHaveLength(1)
+    expect(result.discoveredPlugins[0]).toMatchObject({
+      displayName: "sales",
+      rootPath: "plugins/sales",
+      sourceKind: "marketplace_entry",
+    })
+    expect(result.discoveredPlugins[0]?.componentPaths.skills).toEqual(["plugins/sales/skills"])
+    expect(result.discoveredPlugins[0]?.componentPaths.commands).toEqual(["plugins/sales/commands"])
+  })
+
+  test("treats marketplace source './' as the current repo root", () => {
+    const result = buildGithubRepoDiscovery({
+      entries: [
+        blob(".claude-plugin/marketplace.json"),
+        blob("skills/agent-browser/SKILL.md"),
+        blob("skills/other-skill/SKILL.md"),
+      ],
+      fileTextByPath: {
+        ".claude-plugin/marketplace.json": JSON.stringify({
+          plugins: [
+            {
+              name: "agent-browser",
+              description: "Automates browser interactions for web testing, form filling, screenshots, and data extraction",
+              source: "./",
+              strict: false,
+              skills: ["./skills/agent-browser"],
+              category: "development",
+            },
+          ],
+        }),
+      },
+    })
+
+    expect(result.classification).toBe("claude_marketplace_repo")
+    expect(result.warnings).toEqual([])
+    expect(result.discoveredPlugins).toHaveLength(1)
+    expect(result.discoveredPlugins[0]).toMatchObject({
+      displayName: "agent-browser",
+      rootPath: "",
+      sourceKind: "marketplace_entry",
+      supported: true,
+    })
+    expect(result.discoveredPlugins[0]?.componentPaths.skills).toEqual(["skills/agent-browser"])
+  })
+
+  test("treats non-Claude folder-only repos as unsupported", () => {
+    const result = buildGithubRepoDiscovery({
+      entries: [
+        blob("Sales/skills/pitch/SKILL.md"),
+        blob("Sales/commands/release.md"),
+        blob("finance/agents/reviewer.md"),
+        blob("finance/commands/audit.md"),
+      ],
+      fileTextByPath: {
+        "Sales/plugin.json": JSON.stringify({ name: "Sales", description: "Sales tools" }),
+      },
+    })
+
+    expect(result.classification).toBe("unsupported")
+    expect(result.discoveredPlugins).toEqual([])
+    expect(result.warnings[0]).toContain("only supports Claude-compatible plugins and marketplaces")
+  })
+
+  test("treats standalone .claude directories as unsupported without plugin manifests", () => {
+    const result = buildGithubRepoDiscovery({
+      entries: [
+        blob(".claude/skills/research/SKILL.md"),
+        blob(".claude/commands/publish.md"),
+      ],
+      fileTextByPath: {},
+    })
+
+    expect(result.classification).toBe("unsupported")
+    expect(result.discoveredPlugins).toEqual([])
+    expect(result.warnings[0]).toContain("only supports Claude-compatible plugins and marketplaces")
+  })
+})
diff --git a/ee/apps/den-api/test/github-webhook.test.ts b/ee/apps/den-api/test/github-webhook.test.ts
new file mode 100644
index 0000000000..d2cbce69ca
--- /dev/null
+++ b/ee/apps/den-api/test/github-webhook.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, beforeAll, expect, test } from "bun:test"
+import { Hono } from "hono"
+
+function seedRequiredEnv() {
+  process.env.DATABASE_URL = process.env.DATABASE_URL ?? "mysql://root:password@127.0.0.1:3306/openwork_test"
+  process.env.DEN_DB_ENCRYPTION_KEY = process.env.DEN_DB_ENCRYPTION_KEY ?? "x".repeat(32)
+  process.env.BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET ?? "y".repeat(32)
+  process.env.BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://127.0.0.1:8790"
+}
+
+let envModule: typeof import("../src/env.js")
+let githubModule: typeof import("../src/routes/webhooks/github.js")
+
+beforeAll(async () => {
+  seedRequiredEnv()
+  envModule = await import("../src/env.js")
+  githubModule = await import("../src/routes/webhooks/github.js")
+})
+
+afterEach(() => {
+  envModule.env.githubConnectorApp.webhookSecret = "super-secret"
+})
+
+function createWebhookApp() {
+  const app = new Hono()
+  githubModule.registerGithubWebhookRoutes(app)
+  return app
+}
+
+test("webhook route rejects invalid signatures before JSON parsing", async () => {
+  envModule.env.githubConnectorApp.webhookSecret = "super-secret"
+  const app = createWebhookApp()
+  const response = await app.request("http://den.local/v1/webhooks/connectors/github", {
+    body: "{",
+    headers: {
+      "x-github-delivery": "delivery-1",
+      "x-github-event": "push",
+      "x-hub-signature-256": "sha256=wrong",
+    },
+    method: "POST",
+  })
+
+  expect(response.status).toBe(401)
+  await expect(response.json()).resolves.toEqual({ ok: false, error: "invalid signature" })
+})
+
+test("webhook route returns 503 when the GitHub webhook secret is unset", async () => {
+  envModule.env.githubConnectorApp.webhookSecret = undefined
+  const app = createWebhookApp()
+  const response = await app.request("http://den.local/v1/webhooks/connectors/github", {
+    body: "{}",
+    headers: {
+      "x-github-delivery": "delivery-2",
+      "x-github-event": "push",
+      "x-hub-signature-256": "sha256=unused",
+    },
+    method: "POST",
+  })
+
+  expect(response.status).toBe(503)
+})
+
+test("webhook route accepts a valid signature and ignores unbound deliveries cleanly", async () => {
+  envModule.env.githubConnectorApp.webhookSecret = "super-secret"
+  const app = createWebhookApp()
+  const payload = JSON.stringify({
+    after: "abc123",
+    ref: "refs/heads/main",
+    repository: {
+      full_name: "different-ai/openwork",
+      id: 42,
+    },
+  })
+
+  const response = await app.request("http://den.local/v1/webhooks/connectors/github", {
+    body: payload,
+    headers: {
+      "x-github-delivery": "delivery-3",
+      "x-github-event": "push",
+      "x-hub-signature-256": githubModule.signGithubBody(payload, "super-secret"),
+    },
+    method: "POST",
+  })
+
+  expect(response.status).toBe(200)
+  await expect(response.json()).resolves.toEqual({
+    ok: true,
+    accepted: false,
+    reason: "missing installation id",
+  })
+})
diff --git a/ee/apps/den-api/test/org-invitations.test.ts b/ee/apps/den-api/test/org-invitations.test.ts
new file mode 100644
index 0000000000..29b4096f56
--- /dev/null
+++ b/ee/apps/den-api/test/org-invitations.test.ts
@@ -0,0 +1,95 @@
+import { beforeAll, expect, test } from "bun:test"
+import { Hono } from "hono"
+
+function seedRequiredEnv() {
+  process.env.DATABASE_URL = process.env.DATABASE_URL ?? "mysql://root:password@127.0.0.1:3306/openwork_test"
+  process.env.DEN_DB_ENCRYPTION_KEY = process.env.DEN_DB_ENCRYPTION_KEY ?? "x".repeat(32)
+  process.env.BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET ?? "y".repeat(32)
+  process.env.BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://127.0.0.1:8790"
+  process.env.CORS_ORIGINS = process.env.CORS_ORIGINS ?? "http://127.0.0.1:8790"
+}
+
+let invitationModule: typeof import("../src/routes/org/invitations.js")
+let orgRoutesModule: typeof import("../src/routes/org/index.js")
+let userOrganizationsModule: typeof import("../src/middleware/user-organizations.js")
+
+beforeAll(async () => {
+  seedRequiredEnv()
+  invitationModule = await import("../src/routes/org/invitations.js")
+  orgRoutesModule = await import("../src/routes/org/index.js")
+  userOrganizationsModule = await import("../src/middleware/user-organizations.js")
+})
+
+function createOrgApp() {
+  const app = new Hono()
+  orgRoutesModule.registerOrgRoutes(app)
+  return app
+}
+
+test("legacy org-scoped paths proxy into the unscoped handlers", async () => {
+  const app = createOrgApp()
+  const response = await app.request("http://den.local/v1/orgs/org_123/invitations", {
+    body: JSON.stringify({ email: "teammate@example.com", role: "admin" }),
+    headers: {
+      "content-type": "application/json",
+    },
+    method: "POST",
+  })
+
+  expect(response.status).toBe(401)
+  await expect(response.json()).resolves.toEqual({ error: "unauthorized" })
+})
+
+test("legacy org-scoped proxy also reaches non-invitation org resources", async () => {
+  const app = createOrgApp()
+  const response = await app.request("http://den.local/v1/orgs/org_123/teams", {
+    body: JSON.stringify({ memberIds: [], name: "Legacy Team" }),
+    headers: {
+      "content-type": "application/json",
+    },
+    method: "POST",
+  })
+
+  expect(response.status).toBe(401)
+  await expect(response.json()).resolves.toEqual({ error: "unauthorized" })
+})
+
+test("current org endpoints are not swallowed by the legacy proxy", async () => {
+  const app = createOrgApp()
+  const response = await app.request("http://den.local/v1/orgs/invitations/preview?id=bad", {
+    method: "GET",
+  })
+
+  expect(response.status).toBe(400)
+})
+
+test("invitation cancel still validates against the unscoped handler", async () => {
+  const app = new Hono()
+  invitationModule.registerOrgInvitationRoutes(app)
+  const response = await app.request("http://den.local/v1/invitations/invitation_123/cancel", {
+    method: "POST",
+  })
+
+  expect(response.status).toBe(401)
+  await expect(response.json()).resolves.toEqual({ error: "unauthorized" })
+})
+
+test("session hydration only runs when a user session is missing an active organization", () => {
+  expect(userOrganizationsModule.shouldHydrateSessionActiveOrganization({
+    scopedOrganizationId: null,
+    sessionActiveOrganizationId: null,
+    resolvedActiveOrganizationId: "organization_first",
+  })).toBe(true)
+
+  expect(userOrganizationsModule.shouldHydrateSessionActiveOrganization({
+    scopedOrganizationId: null,
+    sessionActiveOrganizationId: "organization_existing",
+    resolvedActiveOrganizationId: "organization_existing",
+  })).toBe(false)
+
+  expect(userOrganizationsModule.shouldHydrateSessionActiveOrganization({
+    scopedOrganizationId: "organization_scoped",
+    sessionActiveOrganizationId: null,
+    resolvedActiveOrganizationId: "organization_scoped",
+  })).toBe(false)
+})
diff --git a/ee/apps/den-api/test/plugin-system-access.test.ts b/ee/apps/den-api/test/plugin-system-access.test.ts
new file mode 100644
index 0000000000..ad68e2f545
--- /dev/null
+++ b/ee/apps/den-api/test/plugin-system-access.test.ts
@@ -0,0 +1,91 @@
+import { beforeAll, expect, test } from "bun:test"
+
+function seedRequiredEnv() {
+  process.env.DATABASE_URL = process.env.DATABASE_URL ?? "mysql://root:password@127.0.0.1:3306/openwork_test"
+  process.env.DEN_DB_ENCRYPTION_KEY = process.env.DEN_DB_ENCRYPTION_KEY ?? "x".repeat(32)
+  process.env.BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET ?? "y".repeat(32)
+  process.env.BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://127.0.0.1:8790"
+}
+
+let accessModule: typeof import("../src/routes/org/plugin-system/access.js")
+
+beforeAll(async () => {
+  seedRequiredEnv()
+  accessModule = await import("../src/routes/org/plugin-system/access.js")
+})
+
+function createActorContext(input?: { isOwner?: boolean; role?: string; teamIds?: string[] }) {
+  return {
+    memberTeams: (input?.teamIds ?? []).map((teamId) => ({
+      createdAt: new Date("2026-04-17T00:00:00.000Z"),
+      id: teamId,
+      name: teamId,
+      organizationId: "org_test",
+      updatedAt: new Date("2026-04-17T00:00:00.000Z"),
+    })),
+    organizationContext: {
+      currentMember: {
+        createdAt: new Date("2026-04-17T00:00:00.000Z"),
+        id: "member_current",
+        isOwner: input?.isOwner ?? false,
+        role: input?.role ?? "member",
+        userId: "user_current",
+      },
+    },
+  } as any
+}
+
+test("org owners and admins get plugin-system capability access", () => {
+  expect(accessModule.isPluginArchOrgAdmin(createActorContext({ isOwner: true }))).toBe(true)
+  expect(accessModule.isPluginArchOrgAdmin(createActorContext({ role: "member,admin" }))).toBe(true)
+  expect(accessModule.isPluginArchOrgAdmin(createActorContext({ role: "member" }))).toBe(false)
+
+  expect(accessModule.hasPluginArchCapability(createActorContext({ isOwner: true }), "plugin.create")).toBe(true)
+  expect(accessModule.hasPluginArchCapability(createActorContext({ role: "admin" }), "marketplace.create")).toBe(true)
+  expect(accessModule.hasPluginArchCapability(createActorContext({ role: "admin" }), "connector_instance.create")).toBe(true)
+  expect(accessModule.hasPluginArchCapability(createActorContext({ role: "member" }), "config_object.create")).toBe(false)
+})
+
+test("grant resolution supports direct, team, org-wide, and highest-role precedence", () => {
+  const grants = [
+    {
+      orgMembershipId: null,
+      orgWide: true,
+      removedAt: null,
+      role: "viewer",
+      teamId: null,
+    },
+    {
+      orgMembershipId: null,
+      orgWide: false,
+      removedAt: null,
+      role: "editor",
+      teamId: "team_alpha",
+    },
+    {
+      orgMembershipId: "member_current",
+      orgWide: false,
+      removedAt: null,
+      role: "manager",
+      teamId: null,
+    },
+  ] as const
+
+  expect(accessModule.resolvePluginArchGrantRole({ grants: [...grants], memberId: "member_current", teamIds: ["team_alpha"] })).toBe("manager")
+  expect(accessModule.resolvePluginArchGrantRole({ grants: [...grants], memberId: "other_member", teamIds: ["team_alpha"] })).toBe("editor")
+  expect(accessModule.resolvePluginArchGrantRole({ grants: [...grants], memberId: "other_member", teamIds: [] })).toBe("viewer")
+})
+
+test("removed grants are ignored during resolution", () => {
+  expect(accessModule.resolvePluginArchGrantRole({
+    grants: [{
+      orgMembershipId: "member_current",
+      orgWide: false,
+      removedAt: new Date("2026-04-17T00:00:00.000Z"),
+      role: "manager",
+      teamId: null,
+    }],
+    memberId: "member_current",
+    teamIds: [],
+  })).toBeNull()
+})
diff --git a/ee/apps/den-api/tsconfig.json b/ee/apps/den-api/tsconfig.json
new file mode 100644
index 0000000000..21f5aeef55
--- /dev/null
+++ b/ee/apps/den-api/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src"]
+}
diff --git a/ee/apps/den-controller/README.md b/ee/apps/den-controller/README.md
new file mode 100644
index 0000000000..ccf5839a1e
--- /dev/null
+++ b/ee/apps/den-controller/README.md
@@ -0,0 +1,13 @@
+# Deprecated: `den-controller`
+
+`ee/apps/den-controller` has been replaced by `ee/apps/den-api` (`den-api`, formerly `den-controller`).
+
+Use `ee/apps/den-api` for:
+
+- auth endpoints
+- org endpoints
+- admin endpoints
+- worker endpoints
+- local and production Den control-plane work
+
+This directory is intentionally kept as a stub so older links resolve to a clear migration note.
diff --git a/ee/apps/den-web/.gitignore b/ee/apps/den-web/.gitignore
new file mode 100644
index 0000000000..272e211607
--- /dev/null
+++ b/ee/apps/den-web/.gitignore
@@ -0,0 +1,4 @@
+.vercel
+.env
+.env.*
+.env*.local
diff --git a/ee/apps/den-web/README.md b/ee/apps/den-web/README.md
new file mode 100644
index 0000000000..f9f091d7e4
--- /dev/null
+++ b/ee/apps/den-web/README.md
@@ -0,0 +1,65 @@
+# OpenWork Cloud App (`ee/apps/den-web`)
+
+Frontend for `app.openworklabs.com`.
+
+## What it does
+
+- Signs up / signs in users against Den service auth.
+- Handles invited-org signup flows where the invited email stays locked and the user verifies access before joining.
+- Launches cloud workers via `POST /v1/workers`.
+- Handles paywall responses (`402 payment_required`), routes users through Polar checkout, and only enables worker launch after purchase.
+- Offers desktop handoff actions so users can open the generated worker directly in OpenWork or copy the connect credentials manually.
+- Uses a Next.js proxy route (`/api/den/*`) to reach `api.openworklabs.com` without browser CORS issues.
+- Uses a same-origin auth proxy (`/api/auth/*`) so GitHub OAuth callbacks can land on `app.openworklabs.com`.
+
+## Current hosted user flow
+
+1. Sign in with a standard provider or accept an org invite.
+2. If the org requires billing, complete checkout before launching a worker.
+3. Launch the worker from the cloud dashboard.
+4. Open the worker in the desktop app with the provided deep link, or copy the URL/token into `Connect remote` manually.
+
+## Local development
+
+1. Install workspace deps from repo root:
+   `pnpm install`
+2. Run the app:
+   `pnpm --filter @openwork-ee/den-web dev`
+3. Open:
+   `http://localhost:3005`
+
+### Optional env vars
+
+- `DEN_API_BASE` (server-only): upstream API base used by proxy route.
+  - default: `https://api.openworklabs.com`
+- `DEN_AUTH_ORIGIN` (server-only): Origin header sent to Better Auth endpoints when the browser request does not include one.
+  - default: `https://app.openworklabs.com`
+- `DEN_AUTH_FALLBACK_BASE` (server-only): fallback Den origin used if `DEN_API_BASE` serves an HTML/5xx error.
+  - default: `https://den-control-plane-openwork.onrender.com`
+- `NEXT_PUBLIC_OPENWORK_APP_CONNECT_URL` (client): Base URL for "Open in App" links.
+  - Example: `https://openworklabs.com/app`
+  - The web panel appends `/connect-remote` and injects worker URL/token params automatically.
+- `NEXT_PUBLIC_OPENWORK_AUTH_CALLBACK_URL` (client): Canonical URL used for GitHub auth callback redirects.
+  - default: `https://app.openworklabs.com`
+  - this host must serve `/api/auth/*`; the included proxy route does that
+- `NEXT_PUBLIC_POSTHOG_KEY` (client): PostHog project key used for Den analytics.
+  - optional override; defaults to the same project key used by `ee/apps/landing`
+- `NEXT_PUBLIC_POSTHOG_HOST` (client): PostHog ingest host or same-origin proxy path.
+  - default: `/ow`
+  - set it to `https://us.i.posthog.com` to bypass the local proxy
+
+## Deploy on Vercel
+
+Recommended project settings:
+
+- Root directory: `ee/apps/den-web`
+- Framework preset: Next.js
+- Build command: `cd ../../.. && pnpm --filter @openwork-ee/den-web build`
+- Output directory: `.next`
+- Install command: `cd ../../.. && pnpm install --frozen-lockfile`
+
+These commands should be configured in the Vercel dashboard rather than committed in `vercel.json`, so the app still builds from the monorepo root and can resolve shared workspace packages like `@openwork-ee/utils`.
+
+Then assign custom domain:
+
+- `app.openworklabs.com`
diff --git a/ee/apps/den-web/app/(den)/_components/auth-panel.tsx b/ee/apps/den-web/app/(den)/_components/auth-panel.tsx
new file mode 100644
index 0000000000..493702824c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/auth-panel.tsx
@@ -0,0 +1,393 @@
+"use client";
+
+import { ArrowRight, CheckCircle2 } from "lucide-react";
+import { usePathname, useRouter } from "next/navigation";
+import { useEffect, useRef, useState, type ReactNode } from "react";
+import { isSamePathname } from "../_lib/client-route";
+import type { AuthMode } from "../_lib/den-flow";
+import { getMcpOAuthSelectOrganizationRoute } from "../_lib/mcp-oauth-route";
+import { useDenFlow } from "../_providers/den-flow-provider";
+
+type PanelContent = {
+  title: string;
+  copy: string;
+  submitLabel: string;
+  togglePrompt?: string;
+  toggleActionLabel?: string;
+};
+
+function getDesktopGrant(url: string | null) {
+  if (!url) return null;
+  try {
+    const parsed = new URL(url);
+    const grant = parsed.searchParams.get("grant")?.trim() ?? "";
+    return grant || null;
+  } catch {
+    return null;
+  }
+}
+
+function GitHubLogo() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="h-4 w-4 shrink-0">
+      <path
+        fill="currentColor"
+        d="M8 0C3.58 0 0 3.58 0 8a8 8 0 0 0 5.47 7.59c.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.5-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82a7.5 7.5 0 0 1 4 0c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8 8 0 0 0 16 8c0-4.42-3.58-8-8-8Z"
+      />
+    </svg>
+  );
+}
+
+function GoogleLogo() {
+  return (
+    <svg viewBox="0 0 18 18" aria-hidden="true" className="h-4 w-4 shrink-0">
+      <path fill="#4285F4" d="M17.64 9.2c0-.64-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92c1.71-1.57 2.68-3.89 2.68-6.62Z" />
+      <path fill="#34A853" d="M9 18c2.43 0 4.47-.8 5.96-2.18l-2.92-2.26c-.81.54-1.84.86-3.04.86-2.34 0-4.31-1.58-5.01-3.7H.96v2.33A9 9 0 0 0 9 18Z" />
+      <path fill="#FBBC05" d="M3.99 10.72A5.41 5.41 0 0 1 3.71 9c0-.6.1-1.18.28-1.72V4.95H.96A9 9 0 0 0 0 9c0 1.45.35 2.82.96 4.05l3.03-2.33Z" />
+      <path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.43 1.33l2.57-2.57C13.46.9 11.43 0 9 0A9 9 0 0 0 .96 4.95l3.03 2.33c.7-2.12 2.67-3.7 5.01-3.7Z" />
+    </svg>
+  );
+}
+
+function SocialButton({
+  children,
+  onClick,
+  disabled,
+}: {
+  children: ReactNode;
+  onClick: () => void;
+  disabled: boolean;
+}) {
+  return (
+    <button
+      type="button"
+      className="den-button-secondary den-social-button"
+      onClick={onClick}
+      disabled={disabled}
+    >
+      {children}
+    </button>
+  );
+}
+
+export function AuthPanel({
+  prefilledEmail,
+  prefillKey,
+  initialMode = "sign-up",
+  lockEmail = false,
+  hideSocialAuth = false,
+  hideEmailField = false,
+  eyebrow = "Account",
+  signUpContent,
+  signInContent,
+  verificationContent,
+}: {
+  prefilledEmail?: string;
+  prefillKey?: string;
+  initialMode?: AuthMode;
+  lockEmail?: boolean;
+  hideSocialAuth?: boolean;
+  hideEmailField?: boolean;
+  eyebrow?: string;
+  signUpContent?: Partial<PanelContent>;
+  signInContent?: Partial<PanelContent>;
+  verificationContent?: Partial<PanelContent>;
+}) {
+  const router = useRouter();
+  const pathname = usePathname();
+  const prefillRef = useRef<string | null>(null);
+  const [copiedDesktopField, setCopiedDesktopField] = useState<"link" | "code" | null>(null);
+  const {
+    authMode,
+    setAuthMode,
+    email,
+    setEmail,
+    password,
+    setPassword,
+    verificationCode,
+    setVerificationCode,
+    verificationRequired,
+    authBusy,
+    authInfo,
+    authError,
+    desktopAuthRequested,
+    desktopRedirectUrl,
+    desktopRedirectBusy,
+    showAuthFeedback,
+    submitAuth,
+    submitVerificationCode,
+    resendVerificationCode,
+    cancelVerification,
+    beginSocialAuth,
+    resolveUserLandingRoute,
+  } = useDenFlow();
+
+  const resolvedSignUpContent: PanelContent = {
+    title: "Get started.",
+    copy: "Free to try. Team plans from $50/mo.",
+    submitLabel: "Create account",
+    togglePrompt: "Have an account?",
+    toggleActionLabel: "Sign in",
+    ...signUpContent,
+  };
+
+  const resolvedSignInContent: PanelContent = {
+    title: "Welcome back.",
+    copy: "Sign in to open your team workspace.",
+    submitLabel: "Sign in",
+    togglePrompt: "Need an account?",
+    toggleActionLabel: "Create one",
+    ...signInContent,
+  };
+
+  const resolvedVerificationContent: PanelContent = {
+    title: "Verify your email.",
+    copy: "Enter the six-digit code from your inbox.",
+    submitLabel: "Verify email",
+    ...verificationContent,
+  };
+
+  const desktopGrant = getDesktopGrant(desktopRedirectUrl);
+  const activeContent = verificationRequired
+    ? resolvedVerificationContent
+    : authMode === "sign-in"
+      ? resolvedSignInContent
+      : resolvedSignUpContent;
+  const showLockedEmailSummary = Boolean(prefilledEmail && lockEmail && hideEmailField);
+
+  useEffect(() => {
+    const key = prefillKey ?? prefilledEmail?.trim() ?? null;
+    if (!key || prefillRef.current === key) {
+      return;
+    }
+
+    prefillRef.current = key;
+    setAuthMode(initialMode);
+    setEmail(prefilledEmail?.trim() ?? "");
+    setPassword("");
+    setVerificationCode("");
+  }, [initialMode, prefillKey, prefilledEmail, setAuthMode, setEmail, setPassword, setVerificationCode]);
+
+  const copyDesktopValue = async (field: "link" | "code", value: string | null) => {
+    if (!value) return;
+    await navigator.clipboard.writeText(value);
+    setCopiedDesktopField(field);
+    window.setTimeout(() => {
+      setCopiedDesktopField((current) => (current === field ? null : current));
+    }, 1800);
+  };
+
+  return (
+    <div className="den-frame grid gap-5 p-6 md:p-7">
+      <div className="grid gap-3">
+        <p className="den-eyebrow">{eyebrow}</p>
+        <div className="grid gap-2">
+          <h2 className="den-title-lg">{activeContent.title}</h2>
+          <p className="den-copy">{activeContent.copy}</p>
+        </div>
+      </div>
+
+      {desktopAuthRequested ? (
+        <div className="den-notice is-info grid gap-3 text-[13px]">
+          <p className="m-0">Finish sign-in here, then jump back into the OpenWork desktop app.</p>
+          {desktopRedirectUrl ? (
+            <div className="grid gap-3">
+              <div className="flex flex-wrap gap-3">
+                <button
+                  type="button"
+                  className="den-button-secondary w-full sm:w-auto"
+                  onClick={() => window.location.assign(desktopRedirectUrl)}
+                >
+                  Open OpenWork
+                </button>
+                <button
+                  type="button"
+                  className="den-button-secondary w-full sm:w-auto"
+                  onClick={() => void copyDesktopValue("link", desktopRedirectUrl)}
+                >
+                  {copiedDesktopField === "link" ? "Copied link" : "Copy sign-in link"}
+                </button>
+                {desktopGrant ? (
+                  <button
+                    type="button"
+                    className="den-button-secondary w-full sm:w-auto"
+                    onClick={() => void copyDesktopValue("code", desktopGrant)}
+                  >
+                    {copiedDesktopField === "code" ? "Copied code" : "Copy one-time code"}
+                  </button>
+                ) : null}
+              </div>
+              <p className="m-0 text-xs leading-5 text-sky-800/80">
+                If OpenWork does not open automatically, copy the sign-in link or one-time code and paste it into the OpenWork desktop app.
+              </p>
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+
+      <form
+        className="grid gap-4"
+        onSubmit={async (event) => {
+          const next = verificationRequired
+            ? await submitVerificationCode(event)
+            : await submitAuth(event);
+          const oauthRoute = typeof window === "undefined" ? null : getMcpOAuthSelectOrganizationRoute(window.location.search);
+          if (next && oauthRoute) {
+            router.replace(oauthRoute);
+            return;
+          }
+          if (next === "dashboard" || next === "join-org") {
+            const target = await resolveUserLandingRoute();
+            if (target && !isSamePathname(pathname, target)) {
+              router.replace(target);
+            }
+          } else if (next === "checkout" && !isSamePathname(pathname, "/checkout")) {
+            router.replace("/checkout");
+          }
+        }}
+      >
+        {!verificationRequired && !hideSocialAuth ? (
+          <>
+            <SocialButton
+              onClick={() => void beginSocialAuth("github")}
+              disabled={authBusy || desktopRedirectBusy}
+            >
+              <GitHubLogo />
+              <span>Continue with GitHub</span>
+            </SocialButton>
+
+            <SocialButton
+              onClick={() => void beginSocialAuth("google")}
+              disabled={authBusy || desktopRedirectBusy}
+            >
+              <GoogleLogo />
+              <span>Continue with Google</span>
+            </SocialButton>
+
+            <div className="den-divider" aria-hidden="true">
+              <span>or</span>
+            </div>
+          </>
+        ) : null}
+
+        {showLockedEmailSummary ? (
+          <div className="den-frame-inset grid gap-1 rounded-[1.5rem] px-4 py-3">
+            <p className="den-label">Invited email</p>
+            <p className="m-0 text-sm font-medium text-[var(--dls-text-primary)]">{prefilledEmail}</p>
+          </div>
+        ) : null}
+
+        {!hideEmailField ? (
+          <label className="grid gap-2">
+            <span className="den-label">Email</span>
+            <input
+              className="den-input disabled:cursor-not-allowed disabled:bg-gray-50 disabled:text-gray-500"
+              type="email"
+              value={email}
+              onChange={(event) => setEmail(event.target.value)}
+              autoComplete="email"
+              readOnly={lockEmail}
+              disabled={lockEmail}
+              required
+            />
+          </label>
+        ) : null}
+
+        {!verificationRequired ? (
+          <label className="grid gap-2">
+            <span className="den-label">Password</span>
+            <input
+              className="den-input"
+              type="password"
+              value={password}
+              onChange={(event) => setPassword(event.target.value)}
+              autoComplete={authMode === "sign-up" ? "new-password" : "current-password"}
+              required
+            />
+          </label>
+        ) : (
+          <label className="grid gap-2">
+            <span className="den-label">Verification code</span>
+            <input
+              className="den-input text-center text-[18px] font-semibold tracking-[0.35em]"
+              type="text"
+              inputMode="numeric"
+              pattern="[0-9]*"
+              value={verificationCode}
+              onChange={(event) =>
+                setVerificationCode(event.target.value.replace(/\D+/g, "").slice(0, 6))
+              }
+              autoComplete="one-time-code"
+              required
+            />
+          </label>
+        )}
+
+        <button
+          type="submit"
+          className="den-button-primary w-full"
+          disabled={authBusy || desktopRedirectBusy}
+        >
+          {authBusy || desktopRedirectBusy ? "Working..." : activeContent.submitLabel}
+          {!authBusy && !desktopRedirectBusy ? <ArrowRight className="h-4 w-4" /> : null}
+        </button>
+
+        {verificationRequired ? (
+          <div className="flex flex-col gap-3 sm:flex-row">
+            <button
+              type="button"
+              className="den-button-secondary w-full"
+              onClick={() => void resendVerificationCode()}
+              disabled={authBusy || desktopRedirectBusy}
+            >
+              Resend code
+            </button>
+            <button
+              type="button"
+              className="den-button-secondary w-full"
+              onClick={() => cancelVerification()}
+              disabled={authBusy || desktopRedirectBusy}
+            >
+              Change email
+            </button>
+          </div>
+        ) : null}
+      </form>
+
+      {!verificationRequired ? (
+        <div className="flex items-center justify-between gap-3 border-t border-[var(--dls-border)] pt-4 text-sm text-[var(--dls-text-secondary)]">
+          <p className="m-0">
+            {authMode === "sign-in"
+              ? resolvedSignInContent.togglePrompt
+              : resolvedSignUpContent.togglePrompt}
+          </p>
+          <button
+            type="button"
+            className="font-medium text-[var(--dls-text-primary)] transition hover:opacity-70"
+            onClick={() => setAuthMode(authMode === "sign-in" ? "sign-up" : "sign-in")}
+          >
+            {authMode === "sign-in"
+              ? resolvedSignInContent.toggleActionLabel
+              : resolvedSignUpContent.toggleActionLabel}
+          </button>
+        </div>
+      ) : null}
+
+      {showAuthFeedback ? (
+        <div
+          className="den-frame-inset grid gap-1 rounded-[1.5rem] px-4 py-3 text-center text-[13px] text-[var(--dls-text-secondary)]"
+          aria-live="polite"
+        >
+          <p>{authInfo}</p>
+          {authError ? <p className="font-medium text-rose-600">{authError}</p> : null}
+          {!authError && verificationRequired ? (
+            <div className="mt-1 inline-flex items-center justify-center gap-1 text-emerald-600">
+              <CheckCircle2 className="h-3.5 w-3.5" />
+              <span>Waiting for your verification code</span>
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/auth-screen.tsx b/ee/apps/den-web/app/(den)/_components/auth-screen.tsx
new file mode 100644
index 0000000000..4bbb202ae5
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/auth-screen.tsx
@@ -0,0 +1,153 @@
+"use client";
+
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { Dithering } from "@paper-design/shaders-react";
+import { usePathname, useRouter } from "next/navigation";
+import { useEffect, useRef } from "react";
+import { isSamePathname } from "../_lib/client-route";
+import { getMcpOAuthSelectOrganizationRoute } from "../_lib/mcp-oauth-route";
+import { useDenFlow } from "../_providers/den-flow-provider";
+import { AuthPanel } from "./auth-panel";
+
+function FeatureCard({ title, body }: { title: string; body: string }) {
+  return (
+    <div className="den-stat-card grid gap-2">
+      <p className="m-0 text-[14px] font-medium text-[var(--dls-text-primary)]">{title}</p>
+      <p className="m-0 text-[13px] leading-[1.6] text-[var(--dls-text-secondary)]">{body}</p>
+    </div>
+  );
+}
+
+function LoadingPanel({ title, body }: { title: string; body: string }) {
+  return (
+    <div className="den-frame grid gap-3 p-6 md:p-7">
+      <div className="grid gap-3">
+        <p className="den-eyebrow">OpenWork Cloud</p>
+        <h2 className="den-title-lg">{title}</h2>
+        <p className="den-copy">{body}</p>
+      </div>
+      <div className="h-2 overflow-hidden rounded-full bg-[var(--dls-hover)]">
+        <div className="h-full w-1/3 animate-pulse rounded-full bg-[var(--dls-accent)]" />
+      </div>
+    </div>
+  );
+}
+
+export function AuthScreen() {
+  const router = useRouter();
+  const pathname = usePathname();
+  const routingRef = useRef(false);
+  const { user, sessionHydrated, desktopAuthRequested, resolveUserLandingRoute } = useDenFlow();
+  const hasResolvedSession = sessionHydrated && Boolean(user) && !desktopAuthRequested;
+
+  useEffect(() => {
+    if (!hasResolvedSession || routingRef.current) {
+      return;
+    }
+
+    const oauthRoute = typeof window === "undefined" ? null : getMcpOAuthSelectOrganizationRoute(window.location.search);
+    if (oauthRoute && !isSamePathname(pathname, oauthRoute)) {
+      router.replace(oauthRoute);
+      return;
+    }
+
+    routingRef.current = true;
+    void resolveUserLandingRoute()
+      .then((target) => {
+        if (target && !isSamePathname(pathname, target)) {
+          router.replace(target);
+        }
+      })
+      .finally(() => {
+        routingRef.current = false;
+      });
+  }, [hasResolvedSession, pathname, resolveUserLandingRoute, router]);
+
+  if (!sessionHydrated) {
+    return (
+      <section className="den-page flex w-full items-center py-4 lg:min-h-[calc(100vh-2.5rem)]">
+        <LoadingPanel title="Checking your session." body="Loading your Cloud account state..." />
+      </section>
+    );
+  }
+
+  return (
+    <section className="den-page flex w-full items-center py-4 lg:min-h-[calc(100vh-2.5rem)]">
+      <div className="grid w-full gap-6 lg:grid-cols-[minmax(0,1fr)_minmax(360px,440px)]">
+        <div className="order-2 flex flex-col gap-6 lg:order-1">
+          <div className="den-frame relative min-h-[300px] overflow-hidden px-7 py-8 md:px-10 md:py-10">
+            <div className="absolute inset-0 z-0">
+              <Dithering
+                speed={0}
+                shape="warp"
+                type="4x4"
+                size={2.5}
+                scale={1}
+                frame={30214.2}
+                colorBack="#00000000"
+                colorFront="#FEFEFE"
+                style={{ backgroundColor: "#142033", width: "100%", height: "100%" }}
+              >
+                <PaperMeshGradient
+                  speed={0.1}
+                  distortion={0.8}
+                  swirl={0.1}
+                  grainMixer={0}
+                  grainOverlay={0}
+                  frame={176868.9}
+                  colors={["#0F172A", "#1E40AF", "#4C1D95", "#0F766E"]}
+                  style={{ width: "100%", height: "100%" }}
+                />
+              </Dithering>
+            </div>
+
+            <div className="relative z-10 flex h-full flex-col justify-between gap-10">
+              <div className="flex items-center gap-3">
+                <img src="/openwork-logo-transparent.svg" alt="OpenWork" className="h-9 w-auto" />
+                <span className="text-[13px] font-medium text-white/80">OpenWork Cloud</span>
+              </div>
+
+              <div className="grid gap-4">
+                <span className="inline-flex w-fit rounded-full border border-white/20 bg-white/15 px-3 py-1 text-[10px] font-medium uppercase tracking-[0.18em] text-white backdrop-blur-md">
+                  OpenWork Cloud
+                </span>
+                <h1 className="max-w-[12ch] text-[2.25rem] font-semibold leading-[0.95] tracking-[-0.06em] text-white md:text-[3rem]">
+                  One setup, every seat.
+                </h1>
+                <p className="max-w-[34rem] text-[15px] leading-7 text-white/80">
+                  Configure once. Your whole team gets the same tools, agents, and providers.
+                </p>
+              </div>
+            </div>
+          </div>
+
+          <div className="grid gap-4 md:grid-cols-3">
+            <FeatureCard
+              title="Shared config"
+              body="Set it up once, then push it to the org."
+            />
+            <FeatureCard
+              title="Cloud agents"
+              body="Workflows that keep running while your team is away."
+            />
+            <FeatureCard
+              title="Your models"
+              body="Bring your own provider when the team is ready."
+            />
+          </div>
+        </div>
+
+        <div className="order-1 lg:order-2">
+          {hasResolvedSession ? (
+            <LoadingPanel
+              title="Redirecting to your workspace."
+              body="We found your account and are sending you to the right Cloud destination now."
+            />
+          ) : (
+            <AuthPanel />
+          )}
+        </div>
+      </div>
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/checkout-screen.tsx b/ee/apps/den-web/app/(den)/_components/checkout-screen.tsx
new file mode 100644
index 0000000000..f0f4eed042
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/checkout-screen.tsx
@@ -0,0 +1,361 @@
+"use client";
+
+import { usePathname, useRouter } from "next/navigation";
+import { useEffect, useRef, useState } from "react";
+import { isSamePathname } from "../_lib/client-route";
+import { formatMoneyMinor } from "../_lib/den-flow";
+import { useDenFlow } from "../_providers/den-flow-provider";
+
+// For local layout testing (no deploy needed)
+// Enable with: NEXT_PUBLIC_DEN_MOCK_BILLING=1
+const MOCK_BILLING = process.env.NEXT_PUBLIC_DEN_MOCK_BILLING === "1";
+const MOCK_CHECKOUT_URL = (process.env.NEXT_PUBLIC_DEN_MOCK_CHECKOUT_URL ?? "").trim() || null;
+
+function formatSubscriptionStatus(value: string | null | undefined) {
+  if (!value) return "Purchase required";
+  return value
+    .split(/[_\s]+/)
+    .filter(Boolean)
+    .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1).toLowerCase())
+    .join(" ");
+}
+
+function LoadingPanel({ title, body }: { title: string; body: string }) {
+  return (
+    <section className="den-page py-4">
+      <div className="den-frame-soft grid max-w-[44rem] gap-4 p-6">
+        <h1 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">{title}</h1>
+        <p className="text-sm text-[var(--dls-text-secondary)]">{body}</p>
+      </div>
+    </section>
+  );
+}
+
+export function CheckoutScreen({ customerSessionToken }: { customerSessionToken: string | null }) {
+  const router = useRouter();
+  const pathname = usePathname();
+  const handledReturnRef = useRef(false);
+  const redirectingRef = useRef(false);
+  const [resuming, setResuming] = useState(false);
+  const [redirectMessage, setRedirectMessage] = useState<string | null>(null);
+  const {
+    user,
+    sessionHydrated,
+    billingSummary: realBillingSummary,
+    billingBusy,
+    billingCheckoutBusy,
+    billingError,
+    effectiveCheckoutUrl,
+    onboardingPending,
+    refreshBilling,
+    refreshCheckoutReturn,
+    resolveUserLandingRoute,
+  } = useDenFlow();
+
+  const mockMode = MOCK_BILLING && process.env.NODE_ENV !== "production";
+
+  const billingSummary = MOCK_BILLING
+    ? {
+        featureGateEnabled: true,
+        hasActivePlan: false,
+        checkoutRequired: true,
+              checkoutUrl: MOCK_CHECKOUT_URL,
+              portalUrl: null,
+              price: { amount: 5000, currency: "usd", recurringInterval: "month", recurringIntervalCount: 1 },
+        subscription: null,
+        invoices: [],
+        productId: null,
+        benefitId: null,
+      }
+    : realBillingSummary;
+
+  useEffect(() => {
+    if (!sessionHydrated || resuming || user || mockMode) {
+      return;
+    }
+
+    setRedirectMessage("Redirecting to sign in...");
+    if (!isSamePathname(pathname, "/")) {
+      router.replace("/");
+    }
+  }, [mockMode, pathname, resuming, router, sessionHydrated, user]);
+
+  useEffect(() => {
+    if (!sessionHydrated || !user || handledReturnRef.current || !customerSessionToken) {
+      return;
+    }
+
+    handledReturnRef.current = true;
+    setResuming(true);
+    setRedirectMessage("Finishing your checkout...");
+
+    void refreshCheckoutReturn(true)
+      .then((target) => {
+        if (target && !isSamePathname(pathname, target)) {
+          router.replace(target);
+          return;
+        }
+
+        setRedirectMessage(null);
+        setResuming(false);
+      })
+      .catch(() => {
+        setRedirectMessage(null);
+        setResuming(false);
+      });
+  }, [customerSessionToken, pathname, refreshCheckoutReturn, router, sessionHydrated, user]);
+
+  useEffect(() => {
+    if (!sessionHydrated || !user || resuming) {
+      return;
+    }
+
+    if (!billingSummary?.hasActivePlan && !effectiveCheckoutUrl && !billingBusy && !billingCheckoutBusy) {
+      void refreshBilling({ includeCheckout: true, quiet: true });
+    }
+  }, [
+    billingBusy,
+    billingCheckoutBusy,
+    billingSummary?.hasActivePlan,
+    effectiveCheckoutUrl,
+    refreshBilling,
+    resuming,
+    sessionHydrated,
+    user,
+  ]);
+
+  useEffect(() => {
+    if (
+      !sessionHydrated ||
+      !user ||
+      resuming ||
+      onboardingPending ||
+      mockMode ||
+      redirectingRef.current ||
+      billingBusy ||
+      billingCheckoutBusy ||
+      !billingSummary ||
+      (billingSummary.featureGateEnabled && !billingSummary.hasActivePlan)
+    ) {
+      return;
+    }
+
+    redirectingRef.current = true;
+    void resolveUserLandingRoute()
+      .then((target) => {
+        if (target && !isSamePathname(pathname, target)) {
+          setRedirectMessage("Redirecting to your workspace...");
+          router.replace(target);
+          return;
+        }
+
+        setRedirectMessage(null);
+      })
+      .finally(() => {
+        redirectingRef.current = false;
+      });
+  }, [
+    billingBusy,
+    billingCheckoutBusy,
+    billingSummary,
+    mockMode,
+    onboardingPending,
+    pathname,
+    resolveUserLandingRoute,
+    resuming,
+    router,
+    sessionHydrated,
+    user,
+  ]);
+
+  if (!sessionHydrated || (!user && !mockMode)) {
+    return (
+      <LoadingPanel
+        title="Checking your billing session..."
+        body="Loading your account and billing state before continuing."
+      />
+    );
+  }
+
+  if (redirectMessage) {
+    return <LoadingPanel title="One moment." body={redirectMessage} />;
+  }
+
+  const billingPrice = billingSummary?.price ?? null;
+  const showLoading = resuming || (billingBusy && !billingSummary && !MOCK_BILLING);
+  const checkoutHref = effectiveCheckoutUrl ?? MOCK_CHECKOUT_URL ?? null;
+  const planAmountLabel =
+    billingPrice && billingPrice.amount !== null
+      ? `${formatMoneyMinor(billingPrice.amount, billingPrice.currency)}/${billingPrice.recurringInterval}`
+      : "$50.00/month";
+  const subscription = billingSummary?.subscription ?? null;
+  const subscriptionStatus = formatSubscriptionStatus(subscription?.status);
+
+  return (
+    <section className="den-page grid gap-6 py-4 lg:py-6">
+      <div className="den-frame grid gap-6 p-6 md:p-8 lg:p-10">
+        <div className="flex flex-col gap-4 lg:max-w-3xl">
+          <div className="grid gap-3">
+            <p className="den-eyebrow">OpenWork Cloud</p>
+            <h1 className="den-title-xl max-w-[14ch]">Purchase a plan before creating your workspace.</h1>
+            <p className="den-copy max-w-2xl">
+              Start with one workspace plan for $50/month. Each plan includes up to 5 members and 1 hosted worker.
+            </p>
+          </div>
+
+          <div className="flex flex-wrap gap-3">
+            {checkoutHref ? (
+              <a href={checkoutHref} rel="noreferrer" className="den-button-primary w-full sm:w-auto">
+                Purchase plan — $50/month
+              </a>
+            ) : (
+              <button
+                type="button"
+                className="den-button-primary w-full sm:w-auto"
+                onClick={() => void refreshBilling({ includeCheckout: true, quiet: false })}
+                disabled={billingBusy || billingCheckoutBusy}
+              >
+                Refresh purchase link
+              </button>
+            )}
+            <a href="https://openworklabs.com/download" className="den-button-secondary w-full sm:w-auto">
+              Use desktop only
+            </a>
+          </div>
+
+          <div className="flex flex-wrap items-center gap-3 text-sm text-[var(--dls-text-secondary)]">
+            <span>$50/month per workspace</span>
+            <span aria-hidden="true">•</span>
+            <span>{planAmountLabel} billed monthly</span>
+            <span aria-hidden="true">•</span>
+            <span>{user?.email ?? "Signed in"}</span>
+          </div>
+        </div>
+      </div>
+
+      {billingError ? <div className="den-notice is-error">{billingError}</div> : null}
+      {showLoading ? (
+        <div className="den-frame-soft px-5 py-4 text-sm text-[var(--dls-text-secondary)]">
+          Refreshing access state...
+        </div>
+      ) : null}
+
+      {billingSummary ? (
+        <div className="grid gap-6 xl:grid-cols-[minmax(0,1.15fr)_320px]">
+          <div className="grid gap-6">
+            <article className="den-frame grid gap-6 p-6 md:p-7">
+              <div className="grid gap-3">
+                <span className="den-kicker w-fit">OpenWork Cloud</span>
+                <h2 className="den-title-lg">Share your setup across your team.</h2>
+                <p className="den-copy">
+                  Manage your team&apos;s setup, invite teammates, and keep everything in sync.
+                </p>
+              </div>
+
+              <div className="grid gap-3 text-sm text-[var(--dls-text-secondary)]">
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Share setup across your team and org</div>
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Background agents in alpha for selected workflows</div>
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Custom LLM providers with team access controls</div>
+              </div>
+
+              <div className="grid gap-4 md:grid-cols-2">
+                <div className="den-frame-inset rounded-[1.5rem] p-4">
+                  <p className="den-stat-label">Background agents</p>
+                  <p className="mt-3 text-sm text-[var(--dls-text-secondary)]">
+                    Keep selected workflows running in the background. Alpha.
+                  </p>
+                </div>
+                <div className="den-frame-inset rounded-[1.5rem] p-4">
+                  <p className="den-stat-label">LLM providers</p>
+                  <p className="mt-3 text-sm text-[var(--dls-text-secondary)]">
+                    Standardize provider access, model selection, and team rollout.
+                  </p>
+                </div>
+              </div>
+            </article>
+
+            <article className="den-frame-soft grid gap-5 p-6 md:p-7">
+              <div className="grid gap-3">
+                <span className="den-kicker w-fit">Desktop app</span>
+                <h2 className="den-title-lg">Stay local when you need to.</h2>
+                <p className="den-copy">
+                  Run locally for free, keep your data on your machine, and add OpenWork Cloud when your team is ready.
+                </p>
+              </div>
+
+              <div className="grid gap-3 text-sm text-[var(--dls-text-secondary)]">
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Run locally for free</div>
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Keep data on your machine</div>
+                <div className="flex gap-3"><span className="mt-2 h-1.5 w-1.5 rounded-full bg-slate-300" />Move into OpenWork Cloud later</div>
+              </div>
+
+              <div className="mt-auto pt-2">
+                <a href="https://openworklabs.com/download" className="den-button-secondary w-full sm:w-auto">
+                  Use desktop only
+                </a>
+              </div>
+            </article>
+          </div>
+
+          <aside className="den-frame-soft grid h-fit gap-4 p-5 md:p-6">
+            <div className="grid gap-2">
+              <p className="den-eyebrow">Billing status</p>
+              <h2 className="text-2xl font-semibold tracking-tight text-[var(--dls-text-primary)]">{subscriptionStatus}</h2>
+              <p className="den-copy text-sm">
+                {billingSummary.hasActivePlan ? "Your workspace plan is active." : "Purchase a plan to create your first workspace."}
+              </p>
+            </div>
+
+            <div className="den-frame-inset grid gap-3 rounded-[1.5rem] px-4 py-4">
+              <div className="flex items-center justify-between gap-3">
+                <span className="text-sm font-medium text-[var(--dls-text-primary)]">Plan</span>
+                <span className={`den-status-pill ${billingSummary.hasActivePlan ? "is-positive" : "is-neutral"}`}>
+                  {subscriptionStatus}
+                </span>
+              </div>
+              <div className="flex items-center justify-between gap-3 text-sm text-[var(--dls-text-secondary)]">
+                <span>Price</span>
+                <span className="font-medium text-[var(--dls-text-primary)]">{planAmountLabel}</span>
+              </div>
+              <div className="flex items-center justify-between gap-3 text-sm text-[var(--dls-text-secondary)]">
+                <span>Invoices</span>
+                <span className="font-medium text-[var(--dls-text-primary)]">{billingSummary.invoices.length}</span>
+              </div>
+            </div>
+
+            <div className="grid gap-3">
+              {checkoutHref && !billingSummary.hasActivePlan ? (
+                <a href={checkoutHref} rel="noreferrer" className="den-button-primary w-full">
+                  Purchase plan
+                </a>
+              ) : null}
+              {billingSummary.portalUrl ? (
+                <a href={billingSummary.portalUrl} rel="noreferrer" target="_blank" className="den-button-secondary w-full">
+                  Open billing portal
+                </a>
+              ) : null}
+              <button
+                type="button"
+                className="den-button-secondary w-full"
+                onClick={() => void refreshBilling({ includeCheckout: true, quiet: false })}
+                disabled={billingBusy || billingCheckoutBusy}
+              >
+                Refresh billing
+              </button>
+            </div>
+
+            <div className="flex flex-wrap gap-x-4 gap-y-2 text-sm text-[var(--dls-text-secondary)]">
+              {billingSummary.portalUrl ? (
+                <a href={billingSummary.portalUrl} rel="noreferrer" target="_blank" className="font-medium text-[var(--dls-text-primary)] transition hover:opacity-70">
+                  Billing portal
+                </a>
+              ) : null}
+              <span>Invoices {billingSummary.invoices.length > 0 ? `(${billingSummary.invoices.length})` : ""}</span>
+              <span>Monthly billing</span>
+            </div>
+          </aside>
+        </div>
+      ) : null}
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/dashboard-redirect-screen.tsx b/ee/apps/den-web/app/(den)/_components/dashboard-redirect-screen.tsx
new file mode 100644
index 0000000000..3cbb88dfd3
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/dashboard-redirect-screen.tsx
@@ -0,0 +1,39 @@
+"use client";
+
+import { useEffect, useRef } from "react";
+import { usePathname, useRouter } from "next/navigation";
+import { isSamePathname } from "../_lib/client-route";
+import { useDenFlow } from "../_providers/den-flow-provider";
+
+export function DashboardRedirectScreen() {
+  const router = useRouter();
+  const pathname = usePathname();
+  const redirectingRef = useRef(false);
+  const { resolveUserLandingRoute, sessionHydrated } = useDenFlow();
+
+  useEffect(() => {
+    if (!sessionHydrated || redirectingRef.current) {
+      return;
+    }
+
+    redirectingRef.current = true;
+    void resolveUserLandingRoute()
+      .then((target) => {
+        const nextTarget = target ?? "/";
+        if (!isSamePathname(pathname, nextTarget)) {
+          router.replace(nextTarget);
+        }
+      })
+      .finally(() => {
+        redirectingRef.current = false;
+      });
+  }, [pathname, resolveUserLandingRoute, router, sessionHydrated]);
+
+  return (
+    <section className="mx-auto grid w-full max-w-[52rem] gap-4 rounded-[32px] border border-gray-100 bg-white p-6 shadow-[0_10px_30px_-24px_rgba(15,23,42,0.22)]">
+      <p className="text-[11px] font-semibold uppercase tracking-[0.18em] text-gray-400">OpenWork Cloud</p>
+      <p className="text-2xl font-semibold tracking-[-0.04em] text-gray-900">Loading your workspace.</p>
+      <p className="text-sm text-gray-500">Routing you to the right organization and billing destination now.</p>
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/dashboard-screen.tsx b/ee/apps/den-web/app/(den)/_components/dashboard-screen.tsx
new file mode 100644
index 0000000000..1ecf7e9e3d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/dashboard-screen.tsx
@@ -0,0 +1,679 @@
+"use client";
+
+import Link from "next/link";
+import { useEffect } from "react";
+import { useRouter } from "next/navigation";
+import { getWorkerStatusCopy, getWorkerStatusMeta } from "../_lib/den-flow";
+import { useDenFlow } from "../_providers/den-flow-provider";
+
+type IconProps = {
+  className?: string;
+};
+
+function CubeIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <path d="M12 3 4.5 7v10L12 21l7.5-4V7L12 3Z" />
+      <path d="M4.5 7 12 11l7.5-4" />
+      <path d="M12 11v10" />
+    </svg>
+  );
+}
+
+function MonitorIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <rect x="3" y="4" width="18" height="12" rx="2" />
+      <path d="M8 20h8" />
+      <path d="M12 16v4" />
+    </svg>
+  );
+}
+
+function GlobeIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <circle cx="12" cy="12" r="9" />
+      <path d="M3 12h18" />
+      <path d="M12 3c2.4 2.6 3.6 5.6 3.6 9S14.4 18.4 12 21" />
+      <path d="M12 3c-2.4 2.6-3.6 5.6-3.6 9S9.6 18.4 12 21" />
+    </svg>
+  );
+}
+
+function LockIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <rect x="5" y="11" width="14" height="10" rx="2" />
+      <path d="M8 11V8a4 4 0 1 1 8 0v3" />
+    </svg>
+  );
+}
+
+function TerminalIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <rect x="3" y="4" width="18" height="16" rx="2" />
+      <path d="m7 9 3 3-3 3" />
+      <path d="M13 15h4" />
+    </svg>
+  );
+}
+
+function ActivityIcon({ className = "h-5 w-5" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <path d="M3 12h4l2.5-5 5 10 2.5-5H21" />
+    </svg>
+  );
+}
+
+function RefreshIcon({ className = "h-4 w-4" }: IconProps) {
+  return (
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.8" className={className} aria-hidden="true">
+      <path d="M20 11a8 8 0 1 0 2 5.3" />
+      <path d="M20 4v7h-7" />
+    </svg>
+  );
+}
+
+function CredentialRow({
+  label,
+  value,
+  placeholder,
+  hint,
+  canCopy,
+  copied,
+  onCopy,
+  muted = false
+}: {
+  label: string;
+  value: string | null;
+  placeholder: string;
+  hint?: string;
+  canCopy: boolean;
+  copied: boolean;
+  onCopy: () => void;
+  muted?: boolean;
+}) {
+  return (
+    <label className="grid gap-2">
+      <span className="px-0.5 text-[0.67rem] font-bold uppercase tracking-[0.11em] text-[var(--dls-text-secondary)]">{label}</span>
+      <div className={`flex items-center gap-2 rounded-xl border border-[var(--dls-border)] bg-[var(--dls-surface)] p-1.5 ${muted ? "opacity-75" : ""}`}>
+        <input
+          readOnly
+          value={value ?? placeholder}
+          className="min-w-0 flex-1 border-none bg-transparent px-2 py-1.5 font-mono text-xs text-[var(--dls-text-primary)] outline-none"
+          onClick={(event) => event.currentTarget.select()}
+        />
+        <button
+          type="button"
+          className="rounded-lg border border-[var(--dls-border)] bg-[var(--dls-surface)] px-2.5 py-1 text-xs font-medium text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-50"
+          disabled={!canCopy}
+          onClick={onCopy}
+        >
+          {copied ? "Copied" : canCopy ? "Copy" : "N/A"}
+        </button>
+      </div>
+      {hint ? <span className="px-0.5 text-[0.7rem] text-[var(--dls-text-secondary)]">{hint}</span> : null}
+    </label>
+  );
+}
+
+function SkeletonBar({ widthClass }: { widthClass: string }) {
+  return <div className={`h-11 rounded-xl bg-[var(--dls-hover)] ${widthClass}`} aria-hidden="true" />;
+}
+
+function ProvisioningGraphic({ ready }: { ready: boolean }) {
+  return (
+    <div className="relative overflow-hidden rounded-[22px] border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-6">
+      <div className="flex items-center justify-center gap-2 text-sm font-medium text-[var(--dls-text-secondary)]">
+        <RefreshIcon className={ready ? "h-4 w-4 text-emerald-500" : "h-4 w-4 animate-spin text-amber-500"} />
+        <span>{ready ? "Connection details are ready to use." : "Allocating resources and configuring your worker..."}</span>
+      </div>
+    </div>
+  );
+}
+
+function SectionBadge({
+  icon,
+  title,
+  body,
+  dimmed = false
+}: {
+  icon: React.ReactNode;
+  title: string;
+  body: string;
+  dimmed?: boolean;
+}) {
+  return (
+    <div className={`rounded-[28px] border border-[var(--dls-border)] p-8 ${dimmed ? "bg-[var(--dls-sidebar)] grayscale-[0.25] opacity-70" : "bg-[var(--dls-surface)]"}`}>
+      <div className="mb-4 flex items-center gap-3">
+        <div className="rounded-xl border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-2.5 text-[var(--dls-text-secondary)]">{icon}</div>
+        <h3 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">{title}</h3>
+      </div>
+      <p className="text-[15px] leading-relaxed text-[var(--dls-text-secondary)]">{body}</p>
+    </div>
+  );
+}
+
+export function DashboardScreen({ showSidebar = true }: { showSidebar?: boolean }) {
+  const router = useRouter();
+  const {
+    user,
+    sessionHydrated,
+    onboardingPending,
+    onboardingDecisionBusy,
+    resolveUserLandingRoute,
+    signOut,
+    workers,
+    filteredWorkers,
+    workersBusy,
+    workersError,
+    selectedWorker,
+    activeWorker,
+    selectWorker,
+    launchBusy,
+    actionBusy,
+    deleteBusyWorkerId,
+    redeployBusyWorkerId,
+    runtimeSnapshot,
+    runtimeBusy,
+    runtimeError,
+    runtimeUpgradeBusy,
+    copiedField,
+    events,
+    openworkDeepLink,
+    openworkAppConnectUrl,
+    hasWorkspaceScopedUrl,
+    selectedStatusMeta,
+    isSelectedWorkerFailed,
+    ownedWorkerCount,
+    billingSummary,
+    refreshWorkers,
+    checkWorkerStatus,
+    generateWorkerToken,
+    deleteWorker,
+    redeployWorker,
+    refreshRuntime,
+    upgradeRuntime,
+    copyToClipboard,
+    getRuntimeServiceLabel
+  } = useDenFlow();
+
+  useEffect(() => {
+    if (!sessionHydrated) {
+      return;
+    }
+    if (!user) {
+      router.replace("/");
+      return;
+    }
+    if (!onboardingPending) {
+      return;
+    }
+
+    void resolveUserLandingRoute().then((target) => {
+      if (target === "/checkout") {
+        router.replace(target);
+      }
+    });
+  }, [onboardingPending, resolveUserLandingRoute, router, sessionHydrated, user]);
+
+  if (!sessionHydrated || !user || onboardingDecisionBusy) {
+    return (
+      <section className="mx-auto grid w-full max-w-[52rem] gap-4 rounded-[32px] border border-[var(--dls-border)] bg-[var(--dls-surface)] p-6">
+        <p className="text-sm text-[var(--dls-text-secondary)]">Preparing your dashboard...</p>
+      </section>
+    );
+  }
+
+  const currentWorker = activeWorker ?? (selectedWorker ? { workerName: selectedWorker.workerName, status: selectedWorker.status } : null);
+  const isReady = selectedStatusMeta.bucket === "ready";
+  const isStarting = selectedStatusMeta.bucket === "starting";
+  const webDisabled = !openworkAppConnectUrl || !isReady;
+  const desktopDisabled = !openworkDeepLink || !isReady;
+  const showConnectionHint = !openworkDeepLink || !hasWorkspaceScopedUrl;
+
+  const mainContent = (
+    <main className="min-h-0 flex-1 overflow-y-auto bg-[var(--dls-sidebar)]">
+      <div className="mx-auto flex max-w-5xl flex-col gap-5 p-4 md:gap-6 md:p-12">
+        {selectedWorker ? (
+          <>
+            <div className="flex items-center justify-between gap-4">
+              <div>
+                <div className="mb-2 text-[11px] font-bold uppercase tracking-[0.16em] text-[var(--dls-text-secondary)]">Overview</div>
+                <h1 className="text-2xl font-semibold tracking-tight text-[var(--dls-text-primary)] md:text-3xl">{currentWorker?.workerName ?? selectedWorker.workerName}</h1>
+              </div>
+            </div>
+
+            <div className="relative overflow-hidden rounded-[28px] border border-[var(--dls-border)] bg-[var(--dls-surface)] p-6 md:rounded-[32px] md:p-10">
+              <div className="relative z-10 flex flex-col gap-8 md:flex-row md:items-start md:justify-between">
+                <div className="flex max-w-xl flex-col gap-6">
+                  <div className="flex items-center gap-3">
+                    <div className="relative flex h-3 w-3">
+                      <span className={`absolute inline-flex h-full w-full rounded-full ${isReady ? "bg-emerald-400/60" : "animate-ping bg-amber-400/70"}`} />
+                      <span className={`relative inline-flex h-3 w-3 rounded-full ${isReady ? "bg-emerald-500" : "bg-amber-500"}`} />
+                    </div>
+                    <h2 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)] md:text-2xl">
+                      {isReady ? "Your worker is ready." : isStarting ? "Provisioning in the background" : currentWorker ? getWorkerStatusCopy(currentWorker.status) : "Preparing worker"}
+                    </h2>
+                  </div>
+
+                  <p className="text-[16px] leading-relaxed text-[var(--dls-text-secondary)] md:text-[17px]">
+                    {isReady
+                      ? "Open the worker in web or desktop, or copy the live credentials below."
+                      : "We are allocating resources and preparing the OpenWork connection before unlocking the rest of the controls."}
+                  </p>
+
+                  <ProvisioningGraphic ready={isReady} />
+                </div>
+
+                <div className="flex w-full flex-col gap-3 md:w-[200px] md:shrink-0 md:items-end">
+                  {openworkAppConnectUrl ? (
+                    <a
+                      href={openworkAppConnectUrl}
+                      target="_blank"
+                      rel="noreferrer"
+                      className={`flex w-full items-center justify-center gap-2 rounded-xl px-6 py-3.5 text-base font-medium transition-all md:min-h-[52px] md:text-sm ${
+                        webDisabled ? "pointer-events-none border border-[var(--dls-border)] bg-[var(--dls-surface)] text-[var(--dls-text-secondary)]" : "bg-[#011627] text-white hover:bg-black"
+                      }`}
+                      aria-disabled={webDisabled}
+                    >
+                      <GlobeIcon className="h-[18px] w-[18px]" />
+                      {webDisabled ? "Preparing web access" : "Open in Web"}
+                    </a>
+                  ) : (
+                    <button
+                      type="button"
+                      disabled
+                      className="flex w-full items-center justify-center gap-2 rounded-xl border border-[var(--dls-border)] bg-[var(--dls-surface)] px-6 py-3.5 font-medium text-[var(--dls-text-secondary)]"
+                    >
+                      <GlobeIcon className="h-[18px] w-[18px]" />
+                      Preparing web access
+                    </button>
+                  )}
+
+                  <div className="hidden w-full flex-col items-center md:flex">
+                    <button
+                      type="button"
+                      className={`flex w-full items-center justify-center gap-2 rounded-xl px-4 py-2.5 text-sm font-medium transition-all ${
+                        desktopDisabled ? "border border-[var(--dls-border)] bg-[var(--dls-surface)] text-[var(--dls-text-secondary)]" : "border border-[var(--dls-border)] bg-[var(--dls-surface)] text-[var(--dls-text-secondary)] hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)]"
+                      }`}
+                      onClick={() => {
+                        if (!desktopDisabled && openworkDeepLink) {
+                          window.location.href = openworkDeepLink;
+                        }
+                      }}
+                      disabled={desktopDisabled}
+                    >
+                      <MonitorIcon className="h-4 w-4" />
+                      {desktopDisabled ? "Preparing desktop launch" : "Open in Desktop"}
+                    </button>
+                    <span className="mt-2 text-[11px] font-medium text-[var(--dls-text-secondary)]">requires the OpenWork desktop app</span>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <div className="grid gap-6 lg:grid-cols-[minmax(0,1.05fr)_minmax(0,0.95fr)]">
+              <div className={`rounded-[28px] border border-[var(--dls-border)] transition-all ${isReady ? "bg-[var(--dls-surface)]" : "bg-[var(--dls-sidebar)] opacity-80"}`}>
+                <details className="group" open>
+                  <summary className="flex cursor-pointer list-none items-center justify-between p-8 outline-none [&::-webkit-details-marker]:hidden">
+                    <div>
+                      <div className="mb-4 flex items-center gap-3">
+                        <div className="rounded-xl border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-2.5 text-[var(--dls-text-secondary)]">
+                          <LockIcon className="h-[18px] w-[18px]" />
+                        </div>
+                        <h3 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">Connection details</h3>
+                      </div>
+                      <p className="text-[15px] leading-relaxed text-[var(--dls-text-secondary)]">
+                        Connect now or copy manual credentials for another client.
+                      </p>
+                    </div>
+                    <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--dls-hover)] text-[var(--dls-text-secondary)] transition-transform group-open:rotate-180">
+                      <svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round"><path d="m2 4 4 4 4-4"/></svg>
+                    </div>
+                  </summary>
+
+                  <div className="px-8 pb-8 pt-0">
+                    <div className="flex flex-wrap gap-2">
+                      <button
+                        type="button"
+                        className="rounded-[16px] bg-[#011627] px-5 py-3 text-sm font-semibold text-white transition hover:bg-black disabled:cursor-not-allowed disabled:opacity-50"
+                        onClick={() => {
+                          if (openworkDeepLink) {
+                            window.location.href = openworkDeepLink;
+                          }
+                        }}
+                        disabled={!openworkDeepLink || !isReady}
+                      >
+                        {openworkDeepLink ? "Open in Desktop" : "Preparing connection..."}
+                      </button>
+                      <button
+                        type="button"
+                        className="rounded-[16px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-4 py-3 text-sm font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-60"
+                        onClick={() => void generateWorkerToken()}
+                        disabled={actionBusy !== null}
+                      >
+                        {actionBusy === "token" ? "Refreshing token..." : "Refresh token"}
+                      </button>
+                    </div>
+
+                    <div className="mt-6 space-y-4">
+                      <CredentialRow
+                        label="Connection URL"
+                        value={activeWorker?.openworkUrl ?? activeWorker?.instanceUrl ?? null}
+                        placeholder="Connection URL is still preparing..."
+                        hint={showConnectionHint ? (!openworkDeepLink ? "Getting connection details ready..." : "Finishing your workspace URL...") : undefined}
+                        canCopy={Boolean(activeWorker?.openworkUrl ?? activeWorker?.instanceUrl)}
+                        copied={copiedField === "openwork-url"}
+                        onCopy={() => void copyToClipboard("openwork-url", activeWorker?.openworkUrl ?? activeWorker?.instanceUrl ?? null)}
+                        muted={!isReady}
+                      />
+
+                      <CredentialRow
+                        label="Owner token"
+                        value={activeWorker?.ownerToken ?? null}
+                        placeholder="Use refresh token"
+                        hint="Use this token when the remote client must answer permission prompts."
+                        canCopy={Boolean(activeWorker?.ownerToken)}
+                        copied={copiedField === "owner-token"}
+                        onCopy={() => void copyToClipboard("owner-token", activeWorker?.ownerToken ?? null)}
+                        muted={!isReady}
+                      />
+
+                      <CredentialRow
+                        label="Collaborator token"
+                        value={activeWorker?.clientToken ?? null}
+                        placeholder="Use refresh token"
+                        hint="Routine remote access without owner-only actions."
+                        canCopy={Boolean(activeWorker?.clientToken)}
+                        copied={copiedField === "client-token"}
+                        onCopy={() => void copyToClipboard("client-token", activeWorker?.clientToken ?? null)}
+                        muted={!isReady}
+                      />
+                    </div>
+                  </div>
+                </details>
+              </div>
+
+              <div className="flex flex-col gap-6">
+                <div className={`rounded-[28px] border border-[var(--dls-border)] transition-all ${isReady ? "bg-[var(--dls-surface)]" : "bg-[var(--dls-sidebar)] opacity-80"}`}>
+                  <details className="group">
+                    <summary className="flex cursor-pointer list-none items-center justify-between p-8 outline-none [&::-webkit-details-marker]:hidden">
+                      <div>
+                        <div className="mb-4 flex items-center gap-3">
+                          <div className="rounded-xl border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-2.5 text-[var(--dls-text-secondary)]">
+                            <ActivityIcon className="h-[18px] w-[18px]" />
+                          </div>
+                          <h3 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">Worker actions</h3>
+                        </div>
+                        <p className="text-[15px] leading-relaxed text-[var(--dls-text-secondary)]">
+                          Refresh state, recover tokens, or replace the worker. Controls unlock as the worker becomes reachable.
+                        </p>
+                      </div>
+                      <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--dls-hover)] text-[var(--dls-text-secondary)] transition-transform group-open:rotate-180">
+                        <svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round"><path d="m2 4 4 4 4-4"/></svg>
+                      </div>
+                    </summary>
+
+                    <div className="px-8 pb-8 pt-0">
+                      <div className="flex flex-wrap gap-2">
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void refreshWorkers({ keepSelection: true })}
+                          disabled={workersBusy || actionBusy !== null}
+                        >
+                          {workersBusy ? "Refreshing..." : "Refresh list"}
+                        </button>
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void checkWorkerStatus({ workerId: selectedWorker.workerId })}
+                          disabled={actionBusy !== null}
+                        >
+                          {actionBusy === "status" ? "Checking..." : "Check status"}
+                        </button>
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void generateWorkerToken()}
+                          disabled={actionBusy !== null}
+                        >
+                          {actionBusy === "token" ? "Fetching..." : "Refresh token"}
+                        </button>
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-hover)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-primary)] transition hover:bg-[var(--dls-active)] disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void redeployWorker(selectedWorker.workerId)}
+                          disabled={!isSelectedWorkerFailed || redeployBusyWorkerId !== null || deleteBusyWorkerId !== null || actionBusy !== null || launchBusy}
+                        >
+                          {redeployBusyWorkerId === selectedWorker.workerId ? "Redeploying..." : "Redeploy"}
+                        </button>
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-rose-200 bg-rose-50 px-3 py-2 text-xs font-semibold text-rose-700 transition hover:bg-rose-100 disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void deleteWorker(selectedWorker.workerId)}
+                          disabled={deleteBusyWorkerId !== null || redeployBusyWorkerId !== null || actionBusy !== null || launchBusy}
+                        >
+                          {deleteBusyWorkerId === selectedWorker.workerId ? "Deleting..." : "Delete worker"}
+                        </button>
+                      </div>
+                    </div>
+                  </details>
+                </div>
+
+                <div className={`rounded-[28px] border border-[var(--dls-border)] transition-all ${isReady ? "bg-[var(--dls-surface)]" : "bg-[var(--dls-sidebar)] opacity-80"}`}>
+                  <details className="group">
+                    <summary className="flex cursor-pointer list-none items-center justify-between p-8 outline-none [&::-webkit-details-marker]:hidden">
+                      <div>
+                        <div className="mb-4 flex items-center gap-3">
+                          <div className="rounded-xl border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-2.5 text-[var(--dls-text-secondary)]">
+                            <TerminalIcon className="h-[18px] w-[18px]" />
+                          </div>
+                          <h3 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">Worker runtime</h3>
+                        </div>
+                        <p className="text-[15px] leading-relaxed text-[var(--dls-text-secondary)]">
+                          Compare installed runtime versions with the versions this worker should be running.
+                        </p>
+                      </div>
+                      <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--dls-hover)] text-[var(--dls-text-secondary)] transition-transform group-open:rotate-180">
+                        <svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round"><path d="m2 4 4 4 4-4"/></svg>
+                      </div>
+                    </summary>
+
+                    <div className="px-8 pb-8 pt-0">
+                      <div className="mb-4 flex flex-wrap gap-2">
+                        <button
+                          type="button"
+                          className="rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)] disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void refreshRuntime(selectedWorker.workerId)}
+                          disabled={runtimeBusy || runtimeUpgradeBusy}
+                        >
+                          {runtimeBusy ? "Checking..." : "Refresh runtime"}
+                        </button>
+                        <button
+                          type="button"
+                          className="rounded-[12px] bg-[#011627] px-3 py-2 text-xs font-semibold text-white transition hover:bg-black disabled:cursor-not-allowed disabled:opacity-50"
+                          onClick={() => void upgradeRuntime()}
+                          disabled={runtimeUpgradeBusy || runtimeBusy || !isReady}
+                        >
+                          {runtimeUpgradeBusy || runtimeSnapshot?.upgrade.status === "running" ? "Upgrading..." : "Upgrade runtime"}
+                        </button>
+                      </div>
+
+                      {runtimeError ? <div className="mb-4 rounded-[14px] border border-rose-200 bg-rose-50 px-4 py-3 text-sm text-rose-700">{runtimeError}</div> : null}
+
+                      <div className="space-y-3">
+                        {(runtimeSnapshot?.services ?? []).map((service) => (
+                          <div key={service.name} className="rounded-[18px] border border-[var(--dls-border)] bg-[var(--dls-sidebar)] px-4 py-3">
+                            <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
+                              <div>
+                                <p className="text-sm font-semibold text-[var(--dls-text-primary)]">{getRuntimeServiceLabel(service.name)}</p>
+                                <p className="text-xs text-[var(--dls-text-secondary)]">
+                                  Installed {service.actualVersion ?? "unknown"} · Target {service.targetVersion ?? "unknown"}
+                                </p>
+                              </div>
+                              <div className="flex items-center gap-2 text-xs font-semibold uppercase tracking-wide">
+                                <span className={`rounded-full px-2.5 py-1 ${service.running ? "bg-emerald-100 text-emerald-700" : "bg-slate-200 text-slate-600"}`}>
+                                  {service.running ? "Running" : service.enabled ? "Stopped" : "Disabled"}
+                                </span>
+                                <span className={`rounded-full px-2.5 py-1 ${service.upgradeAvailable ? "bg-amber-100 text-amber-700" : "bg-slate-200 text-slate-600"}`}>
+                                  {service.upgradeAvailable ? "Upgrade available" : "Current"}
+                                </span>
+                              </div>
+                            </div>
+                          </div>
+                        ))}
+
+                        {!runtimeSnapshot && !runtimeBusy ? (
+                          <div className="space-y-3">
+                            <SkeletonBar widthClass="w-full" />
+                            <SkeletonBar widthClass="w-4/5" />
+                            <p className="text-sm text-[var(--dls-text-secondary)]">Runtime details appear after the worker is reachable.</p>
+                          </div>
+                        ) : null}
+                      </div>
+                    </div>
+                  </details>
+                </div>
+
+                <SectionBadge
+                  icon={<ActivityIcon className="h-[18px] w-[18px]" />}
+                  title="Recent activity"
+                  body={events.length > 0 ? `${events[0]?.label ?? "Activity"}: ${events[0]?.detail ?? "Waiting for updates."}` : "Actions and provisioning updates appear here as they happen."}
+                  dimmed={false}
+                />
+
+                <div className="rounded-[28px] border border-[var(--dls-border)] bg-[var(--dls-surface)] p-8">
+                  <div className="mb-4 flex items-center gap-3">
+                    <div className="rounded-xl border border-[var(--dls-border)] bg-[var(--dls-sidebar)] p-2.5 text-[var(--dls-text-secondary)]">
+                      <GlobeIcon className="h-[18px] w-[18px]" />
+                    </div>
+                    <h3 className="text-xl font-semibold tracking-tight text-[var(--dls-text-primary)]">Billing snapshot</h3>
+                  </div>
+                  <p className="text-[15px] leading-relaxed text-[var(--dls-text-secondary)]">
+                    {billingSummary?.featureGateEnabled
+                      ? billingSummary.hasActivePlan
+                        ? "Your account has active worker billing."
+                        : "Workers stay disabled until you purchase one for $50/month."
+                      : "Billing gates are disabled in this environment."}
+                  </p>
+                  <Link
+                    href="/checkout"
+                    className="mt-4 inline-flex rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)]"
+                  >
+                    Open billing
+                  </Link>
+                </div>
+              </div>
+            </div>
+          </>
+        ) : (
+          <div className="rounded-[24px] border border-[var(--dls-border)] bg-[var(--dls-surface)] p-8">
+            <div className="mx-auto max-w-[30rem] text-center">
+              <h2 className="text-2xl font-semibold tracking-tight text-[var(--dls-text-primary)]">No workers yet</h2>
+              <p className="mt-3 text-sm leading-6 text-[var(--dls-text-secondary)]">Purchase your first worker to unlock connection details and runtime controls.</p>
+              <Link
+                href="/checkout"
+                className="mt-5 inline-flex rounded-[12px] border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-2 text-xs font-semibold text-[var(--dls-text-secondary)] transition hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)]"
+              >
+                Purchase worker billing
+              </Link>
+            </div>
+          </div>
+        )}
+      </div>
+    </main>
+  );
+
+  if (!showSidebar) {
+    return mainContent;
+  }
+
+  return (
+    <section className="flex flex-1 w-full flex-col overflow-hidden bg-[var(--dls-surface)] md:flex-row">
+      <aside className="order-2 w-full shrink-0 border-t border-[var(--dls-border)] bg-[var(--dls-sidebar)] md:order-1 md:w-[296px] md:border-r md:border-t-0">
+        <div className="flex h-full flex-col justify-between gap-4 p-4 md:gap-6 md:p-6">
+          <div className="flex flex-col gap-4 md:gap-6">
+            <div className="flex items-center justify-between gap-3">
+              <div className="flex items-center gap-2">
+                <div className="flex h-8 w-8 items-center justify-center rounded-lg border border-[var(--dls-border)] bg-[var(--dls-surface)] text-[var(--dls-text-primary)]">
+                  <CubeIcon className="h-4 w-4" />
+                </div>
+                <span className="text-lg font-semibold tracking-tight text-[var(--dls-text-primary)]">OpenWork</span>
+              </div>
+              <button
+                type="button"
+                className="rounded-full border border-[var(--dls-border)] bg-[var(--dls-surface)] px-3 py-1.5 text-sm font-medium text-[var(--dls-text-secondary)] transition-colors hover:bg-[var(--dls-hover)] hover:text-[var(--dls-text-primary)]"
+                onClick={() => void signOut()}
+              >
+                Log out
+              </button>
+            </div>
+
+            <div className="flex flex-col gap-3 md:gap-4">
+              <div>
+                <div className="mb-2 text-[11px] font-bold uppercase tracking-[0.16em] text-[var(--dls-text-secondary)]">Dashboard</div>
+                <span className="text-lg font-medium text-[var(--dls-text-primary)] md:text-xl">Workers</span>
+              </div>
+
+              <nav className="flex flex-col gap-1.5 md:gap-2">
+                {filteredWorkers.map((item) => {
+                  const meta = getWorkerStatusMeta(item.status);
+                  const selected = selectedWorker?.workerId === item.workerId;
+                  return (
+                    <button
+                      key={item.workerId}
+                      type="button"
+                      onClick={() => selectWorker(item)}
+                      className={`flex items-center justify-between rounded-2xl border px-3.5 py-3 text-left transition-colors md:px-4 ${
+                        selected
+                            ? "border-[var(--dls-border)] bg-[var(--dls-active)]"
+                            : "border-transparent bg-transparent hover:border-[var(--dls-border)] hover:bg-[var(--dls-surface)]"
+                        }`}
+                    >
+                      <span className="flex min-w-0 flex-col">
+                        <span className="truncate text-sm font-semibold text-[var(--dls-text-primary)]">{item.workerName}</span>
+                        <span className="text-xs text-[var(--dls-text-secondary)]">{meta.label}</span>
+                      </span>
+                      {item.isMine ? (
+                          <span className={`shrink-0 rounded-md px-2 py-0.5 text-[10px] font-bold uppercase tracking-wider ${selected ? "bg-[var(--dls-surface)] text-[var(--dls-text-primary)]" : "bg-[var(--dls-hover)] text-[var(--dls-text-secondary)]"}`}>
+                            Yours
+                          </span>
+                      ) : null}
+                    </button>
+                  );
+                })}
+
+                <Link
+                  href="/checkout"
+                  className="rounded-2xl px-4 py-3 text-left text-sm font-medium text-[var(--dls-text-secondary)] transition-colors hover:bg-[var(--dls-surface)] hover:text-[var(--dls-text-primary)]"
+                >
+                  Billing
+                </Link>
+              </nav>
+            </div>
+
+            {workersBusy ? <p className="text-xs text-[var(--dls-text-secondary)]">Loading workers...</p> : null}
+            {workersError ? <p className="text-xs font-medium text-rose-600">{workersError}</p> : null}
+            {workers.length === 0 && !workersBusy ? <p className="text-xs text-[var(--dls-text-secondary)]">No workers yet. Purchase one to get started.</p> : null}
+          </div>
+
+            <div className="text-xs text-[var(--dls-text-secondary)] md:text-sm">
+              Signed in as <span className="font-medium text-[var(--dls-text-primary)]">{user.email}</span>
+              <div className="mt-2 text-xs text-[var(--dls-text-secondary)]">
+                {billingSummary?.featureGateEnabled && !billingSummary.hasActivePlan
+                  ? "Purchase required before the next launch."
+                  : `${ownedWorkerCount} worker${ownedWorkerCount === 1 ? "" : "s"} in your account.`}
+            </div>
+          </div>
+        </div>
+      </aside>
+
+      {mainContent}
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/den-shell.tsx b/ee/apps/den-web/app/(den)/_components/den-shell.tsx
new file mode 100644
index 0000000000..0bc19d381e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/den-shell.tsx
@@ -0,0 +1,14 @@
+export function DenShell({ children }: { children: React.ReactNode }) {
+  return (
+    <main className="relative min-h-screen w-full overflow-hidden bg-[var(--dls-app-bg)] text-[var(--dls-text-primary)]">
+      <div className="pointer-events-none absolute inset-0 overflow-hidden" aria-hidden>
+        <span className="absolute inset-x-0 top-0 h-[34rem] bg-[linear-gradient(180deg,rgba(255,255,255,0.85),rgba(246,249,252,0))]" />
+        <span className="absolute inset-x-0 top-0 h-[30rem] bg-[radial-gradient(circle_at_top_left,rgba(59,130,246,0.08),transparent_34%),radial-gradient(circle_at_top_right,rgba(99,102,241,0.08),transparent_30%)]" />
+      </div>
+
+      <div className="relative z-10  min-h-screen min-h-dvh w-full">
+        {children}
+      </div>
+    </main>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/join-org-screen.tsx b/ee/apps/den-web/app/(den)/_components/join-org-screen.tsx
new file mode 100644
index 0000000000..3de6ba99a3
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/join-org-screen.tsx
@@ -0,0 +1,386 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useState } from "react";
+import { getErrorMessage, requestJson } from "../_lib/den-flow";
+import {
+  PENDING_ORG_INVITATION_STORAGE_KEY,
+  formatRoleLabel,
+  getJoinOrgRoute,
+  getOrgDashboardRoute,
+  isEmailAllowedForOrganization,
+  parseInvitationPreviewPayload,
+  type DenInvitationPreview,
+} from "../_lib/den-org";
+import { useDenFlow } from "../_providers/den-flow-provider";
+import { AuthPanel } from "./auth-panel";
+
+function LoadingCard({ title, body }: { title: string; body: string }) {
+  return (
+    <section className="den-page py-4 lg:py-6">
+      <div className="den-frame grid max-w-[44rem] gap-4 p-6 md:p-7">
+        <p className="den-eyebrow">OpenWork Cloud</p>
+        <div className="grid gap-2">
+          <h1 className="den-title-lg">{title}</h1>
+          <p className="den-copy">{body}</p>
+        </div>
+        <div className="h-2 overflow-hidden rounded-full bg-[var(--dls-hover)]">
+          <div className="h-full w-1/3 animate-pulse rounded-full bg-[var(--dls-accent)]" />
+        </div>
+      </div>
+    </section>
+  );
+}
+
+function statusMessage(preview: DenInvitationPreview | null) {
+  switch (preview?.invitation.status) {
+    case "accepted":
+      return "This invite has already been used.";
+    case "canceled":
+      return "This invite was canceled.";
+    case "expired":
+      return "This invite expired.";
+    default:
+      return "This invite is no longer available.";
+  }
+}
+
+function formatAllowedDomains(allowedEmailDomains: readonly string[] | null | undefined) {
+  if (!allowedEmailDomains || allowedEmailDomains.length === 0) {
+    return "any invited email address";
+  }
+
+  return allowedEmailDomains.length === 1
+    ? allowedEmailDomains[0]
+    : allowedEmailDomains.join(", ");
+}
+
+export function JoinOrgScreen({ invitationId }: { invitationId: string }) {
+  const router = useRouter();
+  const { user, sessionHydrated, signOut } = useDenFlow();
+  const [preview, setPreview] = useState<DenInvitationPreview | null>(null);
+  const [previewBusy, setPreviewBusy] = useState(true);
+  const [previewError, setPreviewError] = useState<string | null>(null);
+  const [joinBusy, setJoinBusy] = useState(false);
+  const [joinError, setJoinError] = useState<string | null>(null);
+
+  const invitedEmailMatches = preview && user
+    ? preview.invitation.email.trim().toLowerCase() === user.email.trim().toLowerCase()
+    : false;
+  const invitedEmailAllowed = preview
+    ? isEmailAllowedForOrganization(preview.organization.allowedEmailDomains, preview.invitation.email)
+    : true;
+  const signedInEmailAllowed = preview && user
+    ? isEmailAllowedForOrganization(preview.organization.allowedEmailDomains, user.email)
+    : true;
+  const roleLabel = preview ? formatRoleLabel(preview.invitation.role) : "";
+  const allowedDomainsLabel = preview ? formatAllowedDomains(preview.organization.allowedEmailDomains) : "";
+
+  useEffect(() => {
+    let cancelled = false;
+
+    async function loadPreview() {
+      if (!invitationId) {
+        setPreview(null);
+        setPreviewError("Missing invitation link.");
+        setPreviewBusy(false);
+        return;
+      }
+
+      setPreviewBusy(true);
+      setPreviewError(null);
+
+      try {
+        const { response, payload } = await requestJson(
+          `/v1/orgs/invitations/preview?id=${encodeURIComponent(invitationId)}`,
+          { method: "GET" },
+          12000,
+        );
+
+        if (cancelled) {
+          return;
+        }
+
+        if (!response.ok) {
+          if (typeof window !== "undefined" && response.status === 404) {
+            window.sessionStorage.removeItem(PENDING_ORG_INVITATION_STORAGE_KEY);
+          }
+
+          setPreview(null);
+          setPreviewError(getErrorMessage(payload, response.status === 404 ? "This invite is no longer available." : `Could not load the invite (${response.status}).`));
+          return;
+        }
+
+        const nextPreview = parseInvitationPreviewPayload(payload);
+        if (!nextPreview) {
+          setPreview(null);
+          setPreviewError("The invitation details were incomplete.");
+          return;
+        }
+
+        setPreview(nextPreview);
+      } catch (error) {
+        if (!cancelled) {
+          setPreview(null);
+          setPreviewError(error instanceof Error ? error.message : "Could not load the invite.");
+        }
+      } finally {
+        if (!cancelled) {
+          setPreviewBusy(false);
+        }
+      }
+    }
+
+    void loadPreview();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [invitationId]);
+
+  async function handleAcceptInvitation() {
+    if (!invitationId) {
+      setJoinError("Missing invitation link.");
+      return;
+    }
+
+    setJoinBusy(true);
+    setJoinError(null);
+
+    try {
+      const { response, payload } = await requestJson(
+        "/v1/orgs/invitations/accept",
+        {
+          method: "POST",
+          body: JSON.stringify({ id: invitationId }),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        setJoinError(getErrorMessage(payload, response.status === 404 ? "This invite could not be accepted." : `Could not join the organization (${response.status}).`));
+        return;
+      }
+
+      if (typeof window !== "undefined") {
+        window.sessionStorage.removeItem(PENDING_ORG_INVITATION_STORAGE_KEY);
+      }
+
+      const acceptedPayload = typeof payload === "object" && payload ? payload as { organizationSlug?: unknown } : null;
+      const organizationSlug = typeof acceptedPayload?.organizationSlug === "string" ? acceptedPayload.organizationSlug.trim() : "";
+      router.replace(organizationSlug ? getOrgDashboardRoute(organizationSlug) : "/dashboard");
+    } catch (error) {
+      setJoinError(error instanceof Error ? error.message : "Could not join the organization.");
+    } finally {
+      setJoinBusy(false);
+    }
+  }
+
+  async function handleSwitchAccount() {
+    await signOut();
+    if (typeof window !== "undefined" && invitationId) {
+      window.sessionStorage.setItem(PENDING_ORG_INVITATION_STORAGE_KEY, invitationId);
+    }
+    router.replace(getJoinOrgRoute(invitationId));
+  }
+
+  if (!sessionHydrated || previewBusy) {
+    return <LoadingCard title="Loading invite." body="Checking the invite details and your account state..." />;
+  }
+
+  if (!preview) {
+    return (
+      <section className="den-page py-4 lg:py-6">
+        <div className="den-frame grid max-w-[44rem] gap-6 p-6 md:p-8">
+          <div className="grid gap-2">
+            <p className="den-eyebrow">OpenWork Cloud</p>
+            <h1 className="den-title-lg">This invite can't be opened.</h1>
+            <p className="den-copy">{previewError ?? "This invite could not be loaded."}</p>
+          </div>
+          <div className="flex flex-wrap gap-3">
+            <Link href="/" className="den-button-primary w-full sm:w-auto">
+              Back to OpenWork Cloud
+            </Link>
+          </div>
+        </div>
+      </section>
+    );
+  }
+
+  if (preview.invitation.status === "pending" && !invitedEmailAllowed) {
+    return (
+      <section className="den-page py-4 lg:py-6">
+        <div className="den-frame grid max-w-[44rem] gap-6 p-6 md:p-8">
+          <div className="grid gap-2">
+            <p className="den-eyebrow">OpenWork Cloud</p>
+            <h1 className="den-title-lg">This invite needs a different email domain.</h1>
+            <p className="den-copy">
+              {preview.organization.name} now only accepts accounts from {allowedDomainsLabel}. Ask a workspace owner to update the allowlist or send a new invite.
+            </p>
+          </div>
+          <div className="flex flex-wrap gap-3">
+            <Link href="/" className="den-button-primary w-full sm:w-auto">
+              Back to OpenWork Cloud
+            </Link>
+          </div>
+        </div>
+      </section>
+    );
+  }
+
+  if (preview.invitation.status === "pending" && !user) {
+    return (
+      <section className="den-page grid gap-6 py-4 lg:grid-cols-[minmax(0,1fr)_minmax(360px,440px)] lg:py-6">
+        <div className="den-frame grid gap-6 p-6 md:p-8">
+          <div className="grid gap-3">
+            <p className="den-eyebrow">OpenWork Cloud</p>
+            <div className="grid gap-2">
+              <p className="den-copy">You've been invited to</p>
+              <h1 className="den-title-xl max-w-[12ch]">{preview.organization.name}</h1>
+            </div>
+          </div>
+
+          <div className="den-meta-row">
+            <span className="den-kicker">Role · {roleLabel}</span>
+          </div>
+
+          <div className="den-frame-inset grid gap-3 rounded-[1.5rem] p-5">
+            <p className="m-0 text-base font-medium text-[var(--dls-text-primary)]">
+              Your team is already set up and waiting.
+            </p>
+            <p className="den-copy">
+              Member access is ready as soon as you join.
+              {preview.organization.allowedEmailDomains?.length
+                ? ` This workspace only accepts ${allowedDomainsLabel} accounts.`
+                : ""}
+            </p>
+          </div>
+        </div>
+
+        <AuthPanel
+          eyebrow="Invite"
+          prefilledEmail={preview.invitation.email}
+          prefillKey={preview.invitation.id}
+          initialMode="sign-up"
+          lockEmail
+          hideSocialAuth
+          hideEmailField
+          signUpContent={{
+            title: `Join ${preview.organization.name}.`,
+            copy: "Pick a password and you're in.",
+            submitLabel: `Join ${preview.organization.name}`,
+            togglePrompt: "Already on Cloud?",
+            toggleActionLabel: "Sign in",
+          }}
+          signInContent={{
+            title: `Join ${preview.organization.name}.`,
+            copy: `Sign in as ${preview.invitation.email} to accept this invite.`,
+            submitLabel: "Sign in to join",
+            togglePrompt: "Need a new account?",
+            toggleActionLabel: "Create one",
+          }}
+          verificationContent={{
+            title: "Check your inbox.",
+            copy: `Enter the six-digit code sent to ${preview.invitation.email}.`,
+            submitLabel: "Verify and join",
+          }}
+        />
+      </section>
+    );
+  }
+
+  const showAcceptAction = preview.invitation.status === "pending" && Boolean(user) && invitedEmailMatches;
+
+  return (
+    <section className="den-page py-4 lg:py-6">
+      <div className="den-frame grid max-w-[44rem] gap-6 p-6 md:p-8">
+        <div className="grid gap-3">
+          <p className="den-eyebrow">OpenWork Cloud</p>
+          <div className="grid gap-2">
+            <p className="den-copy">You've been invited to</p>
+            <h1 className="den-title-xl max-w-[12ch]">{preview.organization.name}</h1>
+          </div>
+        </div>
+
+        <div className="den-meta-row">
+          <span className="den-kicker">Role · {roleLabel}</span>
+          {user ? <span>{user.email}</span> : null}
+        </div>
+
+        {user ? (
+          <div className="den-frame-inset grid gap-1 rounded-[1.5rem] px-4 py-3">
+            <p className="den-label">Signed in as</p>
+            <p className="m-0 text-sm font-medium text-[var(--dls-text-primary)]">{user.email}</p>
+          </div>
+        ) : null}
+
+        {preview.invitation.status !== "pending" ? (
+          <div className="grid gap-4">
+            <p className="den-copy">{statusMessage(preview)}</p>
+            <div className="flex flex-wrap gap-3">
+              <Link
+                href={user && invitedEmailMatches ? getOrgDashboardRoute(preview.organization.slug) : "/"}
+                className="den-button-primary w-full sm:w-auto"
+              >
+                {user && invitedEmailMatches ? "Open team" : "Back to OpenWork Cloud"}
+              </Link>
+            </div>
+          </div>
+        ) : user && !signedInEmailAllowed ? (
+          <div className="grid gap-4">
+            <p className="den-copy">
+              {preview.organization.name} only accepts accounts from <span className="font-medium text-[var(--dls-text-primary)]">{allowedDomainsLabel}</span>. You are signed in as <span className="font-medium text-[var(--dls-text-primary)]">{user.email}</span>, so this account cannot join.
+            </p>
+            <p className="text-sm text-gray-500">
+              Log out, then create a new account or sign in with an allowed email address.
+            </p>
+            <div className="flex flex-wrap gap-3">
+              <button
+                type="button"
+                className="den-button-primary w-full sm:w-auto"
+                onClick={() => void handleSwitchAccount()}
+                disabled={joinBusy}
+              >
+                Log out
+              </button>
+            </div>
+          </div>
+        ) : !invitedEmailMatches ? (
+          <div className="grid gap-4">
+            <p className="den-copy">
+              This invite is for <span className="font-medium text-[var(--dls-text-primary)]">{preview.invitation.email}</span>. Switch accounts to continue.
+            </p>
+            <div className="flex flex-wrap gap-3">
+              <button
+                type="button"
+                className="den-button-primary w-full sm:w-auto"
+                onClick={() => void handleSwitchAccount()}
+                disabled={joinBusy}
+              >
+                Use a different account
+              </button>
+            </div>
+          </div>
+        ) : (
+          <div className="grid gap-4">
+            <p className="den-copy">You're one click away from the team workspace.</p>
+            <div className="flex flex-wrap gap-3">
+              <button
+                type="button"
+                className="den-button-primary w-full sm:w-auto"
+                onClick={() => void handleAcceptInvitation()}
+                disabled={!showAcceptAction || joinBusy}
+              >
+                {joinBusy ? "Joining..." : `Join ${preview.organization.name}`}
+              </button>
+            </div>
+          </div>
+        )}
+
+        {joinError ? <div className="den-notice is-error">{joinError}</div> : null}
+        {previewError ? <div className="den-notice is-error">{previewError}</div> : null}
+      </div>
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/org-limit-dialog.tsx b/ee/apps/den-web/app/(den)/_components/org-limit-dialog.tsx
new file mode 100644
index 0000000000..72fa31efa7
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/org-limit-dialog.tsx
@@ -0,0 +1,47 @@
+"use client";
+
+import { DenButton, buttonVariants } from "./ui/button";
+
+export function OrgLimitDialog({
+  open,
+  title,
+  message,
+  detail,
+  feedbackHref,
+  onClose,
+}: {
+  open: boolean;
+  title: string;
+  message: string;
+  detail?: string | null;
+  feedbackHref: string;
+  onClose: () => void;
+}) {
+  if (!open) {
+    return null;
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-950/45 px-4 py-6">
+      <div className="w-full max-w-md rounded-[28px] border border-gray-200 bg-white p-6 shadow-[0_24px_80px_-32px_rgba(15,23,42,0.45)]">
+        <div className="grid gap-3">
+          <p className="text-[12px] font-semibold uppercase tracking-[0.18em] text-gray-400">Workspace limit</p>
+          <div className="grid gap-2">
+            <h2 className="text-[24px] font-semibold tracking-[-0.03em] text-gray-950">{title}</h2>
+            <p className="text-[15px] leading-7 text-gray-600">{message}</p>
+            {detail ? <p className="text-[13px] leading-6 text-gray-500">{detail}</p> : null}
+          </div>
+        </div>
+
+        <div className="mt-6 flex flex-col gap-3 sm:flex-row sm:justify-end">
+          <DenButton variant="secondary" onClick={onClose}>
+            Close
+          </DenButton>
+          <a href={feedbackHref} target="_blank" rel="noreferrer" className={buttonVariants({ variant: "primary" })}>
+            Contact support
+          </a>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/organization-screen.tsx b/ee/apps/den-web/app/(den)/_components/organization-screen.tsx
new file mode 100644
index 0000000000..2a08ef25bf
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/organization-screen.tsx
@@ -0,0 +1,486 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useEffect, useMemo, useState } from "react";
+import { LogOut, Settings } from "lucide-react";
+import { getErrorMessage, requestJson } from "../_lib/den-flow";
+import { type DenOrgSummary, formatRoleLabel, getOrgDashboardRoute, parseOrgListPayload } from "../_lib/den-org";
+import { useDenFlow } from "../_providers/den-flow-provider";
+
+type SettingsTab = "profile" | "organizations";
+
+const PENDING_ORG_DRAFT_STORAGE_KEY = "openwork-den-pending-org-draft";
+
+function readPendingOrgDraft(userEmail: string | null | undefined) {
+  if (typeof window === "undefined" || !userEmail) {
+    return null;
+  }
+
+  const raw = window.localStorage.getItem(PENDING_ORG_DRAFT_STORAGE_KEY);
+  if (!raw) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(raw) as { name?: unknown; email?: unknown };
+    if (typeof parsed.name !== "string" || typeof parsed.email !== "string") {
+      return null;
+    }
+
+    return parsed.email === userEmail ? parsed.name.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+function writePendingOrgDraft(name: string, userEmail: string | null | undefined) {
+  if (typeof window === "undefined" || !userEmail) {
+    return;
+  }
+
+  window.localStorage.setItem(
+    PENDING_ORG_DRAFT_STORAGE_KEY,
+    JSON.stringify({
+      name,
+      email: userEmail,
+    }),
+  );
+}
+
+function clearPendingOrgDraft() {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.removeItem(PENDING_ORG_DRAFT_STORAGE_KEY);
+}
+
+export function OrganizationScreen() {
+  const router = useRouter();
+  const { user, sessionHydrated, signOut, billingSummary } = useDenFlow();
+  const [orgs, setOrgs] = useState<DenOrgSummary[]>([]);
+  const [busy, setBusy] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [activeTab, setActiveTab] = useState<SettingsTab>("organizations");
+  const [showCreate, setShowCreate] = useState(false);
+  const [createName, setCreateName] = useState("");
+  const [createBusy, setCreateBusy] = useState(false);
+  const [createError, setCreateError] = useState<string | null>(null);
+  const [hasPendingOrgDraft, setHasPendingOrgDraft] = useState(false);
+
+  const userDisplayName = useMemo(() => {
+    const trimmedName = user?.name?.trim();
+    if (trimmedName) return trimmedName;
+    const emailLocalPart = user?.email?.split("@")[0]?.trim() ?? "";
+    return emailLocalPart || "OpenWork User";
+  }, [user?.email, user?.name]);
+
+  const userInitials = useMemo(() => {
+    const parts = userDisplayName.split(/\s+/).filter(Boolean);
+    return ((parts[0]?.slice(0, 1) ?? "O") + (parts[1]?.slice(0, 1) ?? "")).toUpperCase();
+  }, [userDisplayName]);
+
+  const activeOrg = useMemo(() => orgs.find((org) => org.isActive) ?? null, [orgs]);
+  const showDirectCreateFlow = orgs.length === 0;
+  const returningToSavedDraft = showDirectCreateFlow && hasPendingOrgDraft;
+  const draftReadyAfterCheckout = returningToSavedDraft && Boolean(billingSummary?.hasActivePlan);
+
+  useEffect(() => {
+    if (!sessionHydrated) return;
+    if (!user) {
+      router.replace("/");
+      return;
+    }
+
+    let isMounted = true;
+
+    async function loadOrgs() {
+      try {
+        const { response, payload } = await requestJson("/v1/me/orgs", { method: "GET" });
+        if (!response.ok) {
+          throw new Error(getErrorMessage(payload, "Failed to load organizations."));
+        }
+
+        if (isMounted) {
+          const parsed = parseOrgListPayload(payload);
+          const nextOrgs = parsed.orgs.map((org) => ({ ...org, isActive: org.slug === parsed.activeOrgSlug }));
+          setOrgs(nextOrgs);
+          setShowCreate(nextOrgs.length === 0);
+          setBusy(false);
+        }
+      } catch (err) {
+        if (isMounted) {
+          setError(err instanceof Error ? err.message : "An error occurred.");
+          setBusy(false);
+        }
+      }
+    }
+
+    void loadOrgs();
+
+    return () => {
+      isMounted = false;
+    };
+  }, [sessionHydrated, user, router]);
+
+  useEffect(() => {
+    if (!user?.email) {
+      setHasPendingOrgDraft(false);
+      return;
+    }
+
+    if (!showDirectCreateFlow) {
+      clearPendingOrgDraft();
+      setHasPendingOrgDraft(false);
+      return;
+    }
+
+    const savedName = readPendingOrgDraft(user.email);
+    if (!savedName) {
+      setHasPendingOrgDraft(false);
+      return;
+    }
+
+    setCreateName((current) => current || savedName);
+    setHasPendingOrgDraft(true);
+  }, [showDirectCreateFlow, user?.email]);
+
+  async function handleCreate(e: React.FormEvent) {
+    e.preventDefault();
+    const trimmed = createName.trim();
+    if (!trimmed) return;
+
+    setCreateBusy(true);
+    setCreateError(null);
+    try {
+      const { response, payload } = await requestJson("/v1/org", {
+        method: "POST",
+        body: JSON.stringify({ name: trimmed }),
+      });
+
+      if (!response.ok) {
+        if (response.status === 402) {
+          writePendingOrgDraft(trimmed, user?.email);
+          setHasPendingOrgDraft(true);
+          setCreateBusy(false);
+          router.push("/checkout");
+          return;
+        }
+        throw new Error(getErrorMessage(payload, "Failed to create organization."));
+      }
+
+      const organization =
+        typeof payload === "object" && payload && "organization" in payload && payload.organization && typeof payload.organization === "object"
+          ? (payload.organization as { slug?: unknown })
+          : null;
+      const nextSlug = typeof organization?.slug === "string" ? organization.slug : null;
+
+      if (!nextSlug) {
+        throw new Error("Organization was created, but no slug was returned.");
+      }
+
+      clearPendingOrgDraft();
+      setHasPendingOrgDraft(false);
+      router.push(getOrgDashboardRoute(nextSlug));
+    } catch (err) {
+      setCreateError(err instanceof Error ? err.message : "Failed to create organization.");
+      setCreateBusy(false);
+    }
+  }
+
+  function handleSwitch(slug: string) {
+    router.push(getOrgDashboardRoute(slug));
+  }
+
+  if (!sessionHydrated || busy) {
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-[#fafafa]">
+        <p className="text-sm text-gray-500">Loading organizations...</p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex min-h-screen flex-col bg-[#fafafa]">
+      <header className="flex h-14 shrink-0 items-center justify-between border-b border-gray-200 bg-white px-6">
+        <div className="flex items-center gap-2">
+          <span className="text-[14px] font-medium text-gray-900">OpenWork Cloud</span>
+        </div>
+        <div className="flex items-center gap-4">
+          <span className="text-sm text-gray-500">{user?.email}</span>
+          <button
+            onClick={() => void signOut()}
+            className="text-gray-400 transition-colors hover:text-gray-900"
+            aria-label="Log out"
+          >
+            <LogOut className="h-4 w-4" />
+          </button>
+        </div>
+      </header>
+
+      <main className="flex-1 overflow-y-auto p-6 md:p-12">
+        {showDirectCreateFlow ? (
+          <div className="mx-auto max-w-2xl">
+            <section className="rounded-[2rem] border border-gray-200 bg-white p-8 shadow-sm md:p-10">
+              <div className="mb-8 flex items-start gap-4">
+                <div className="flex h-14 w-14 shrink-0 items-center justify-center rounded-full bg-[#011627] text-sm font-semibold uppercase tracking-[0.08em] text-white">
+                  {userInitials}
+                </div>
+                <div className="min-w-0">
+                  <p className="text-sm font-medium uppercase tracking-[0.18em] text-gray-400">OpenWork Cloud</p>
+                  <h1 className="mt-2 text-3xl font-semibold tracking-[-0.03em] text-gray-950">
+                    {returningToSavedDraft ? "Finish creating your organization." : "Create your first organization."}
+                  </h1>
+                  <p className="mt-3 max-w-xl text-sm leading-6 text-gray-500">
+                    {draftReadyAfterCheckout
+                      ? "Your plan is ready. Confirm the workspace name below and create the workspace to finish setup."
+                      : returningToSavedDraft
+                        ? "We saved your workspace name so you can pick up right where you left off."
+                        : "Name the workspace you want to set up for your team. If billing is enabled, the plan step comes right after this."}
+                  </p>
+                </div>
+              </div>
+
+              {error ? (
+                <div className="mb-6 rounded-xl border border-rose-200 bg-rose-50 p-4 text-sm text-rose-900">
+                  {error}
+                </div>
+              ) : null}
+
+              <form onSubmit={handleCreate} className="grid gap-5">
+                <label className="grid gap-2">
+                  <span className="text-sm font-medium text-gray-700">Organization name</span>
+                  <input
+                    type="text"
+                    value={createName}
+                    onChange={(e) => setCreateName(e.target.value)}
+                    placeholder="Acme Corp"
+                    className="w-full rounded-2xl border border-gray-200 px-4 py-3 text-sm text-gray-900 outline-none transition focus:border-gray-400 focus:ring-4 focus:ring-gray-900/5"
+                    autoFocus
+                    required
+                  />
+                </label>
+
+                {createError ? <p className="text-sm font-medium text-rose-600">{createError}</p> : null}
+
+                <div className="flex flex-wrap items-center gap-3">
+                  <button
+                    type="submit"
+                    disabled={createBusy || !createName.trim()}
+                    className="rounded-2xl bg-gray-900 px-5 py-3 text-sm font-medium text-white transition-colors hover:bg-gray-800 disabled:opacity-50"
+                  >
+                    {createBusy ? "Creating..." : returningToSavedDraft ? "Create organization" : "Continue"}
+                  </button>
+                  <p className="text-sm text-gray-500">Signed in as {user?.email ?? "your account"}</p>
+                </div>
+              </form>
+            </section>
+          </div>
+        ) : (
+          <div className="mx-auto max-w-5xl">
+            <div className="mb-8">
+              <h1 className="text-2xl font-semibold tracking-tight text-gray-900">Settings</h1>
+              <p className="mt-1 text-sm text-gray-500">Manage your profile and organization memberships.</p>
+            </div>
+
+            <div className="mb-8 flex gap-8 border-b border-gray-200">
+              <button
+                type="button"
+                onClick={() => setActiveTab("profile")}
+                className={`border-b-2 pb-3 text-sm font-medium transition-colors ${
+                  activeTab === "profile"
+                    ? "border-gray-900 text-gray-900"
+                    : "border-transparent text-gray-500 hover:text-gray-700"
+                }`}
+              >
+                Profile
+              </button>
+              <button
+                type="button"
+                onClick={() => setActiveTab("organizations")}
+                className={`border-b-2 pb-3 text-sm font-medium transition-colors ${
+                  activeTab === "organizations"
+                    ? "border-gray-900 text-gray-900"
+                    : "border-transparent text-gray-500 hover:text-gray-700"
+                }`}
+              >
+                Organizations
+              </button>
+            </div>
+
+            {error ? (
+              <div className="mb-6 rounded-xl border border-rose-200 bg-rose-50 p-4 text-sm text-rose-900">
+                {error}
+              </div>
+            ) : null}
+
+            {activeTab === "profile" ? (
+              <section className="rounded-2xl border border-gray-200 bg-white p-6 shadow-sm">
+                <div className="mb-6 flex items-start gap-4">
+                  <div className="flex h-14 w-14 shrink-0 items-center justify-center rounded-full bg-[#011627] text-sm font-semibold uppercase tracking-[0.08em] text-white">
+                    {userInitials}
+                  </div>
+                  <div className="min-w-0">
+                    <h2 className="text-lg font-medium text-gray-900">{userDisplayName}</h2>
+                    <p className="mt-1 text-sm text-gray-500">{user?.email ?? "Signed in"}</p>
+                  </div>
+                </div>
+
+                <div className="grid gap-5 md:grid-cols-2">
+                  <label className="grid gap-2">
+                    <span className="text-sm font-medium text-gray-700">Full name</span>
+                    <input
+                      type="text"
+                      value={user?.name ?? ""}
+                      readOnly
+                      className="w-full rounded-xl border border-gray-200 bg-gray-50 px-4 py-2.5 text-sm text-gray-900 outline-none"
+                    />
+                  </label>
+
+                  <label className="grid gap-2">
+                    <span className="text-sm font-medium text-gray-700">Email</span>
+                    <input
+                      type="email"
+                      value={user?.email ?? ""}
+                      readOnly
+                      className="w-full rounded-xl border border-gray-200 bg-gray-50 px-4 py-2.5 text-sm text-gray-900 outline-none"
+                    />
+                  </label>
+
+                  <label className="grid gap-2">
+                    <span className="text-sm font-medium text-gray-700">User ID</span>
+                    <input
+                      type="text"
+                      value={user?.id ?? ""}
+                      readOnly
+                      className="w-full rounded-xl border border-gray-200 bg-gray-50 px-4 py-2.5 text-sm text-gray-900 outline-none"
+                    />
+                  </label>
+
+                  <label className="grid gap-2">
+                    <span className="text-sm font-medium text-gray-700">Current organization</span>
+                    <input
+                      type="text"
+                      value={activeOrg?.name ?? "No active organization"}
+                      readOnly
+                      className="w-full rounded-xl border border-gray-200 bg-gray-50 px-4 py-2.5 text-sm text-gray-900 outline-none"
+                    />
+                  </label>
+                </div>
+              </section>
+            ) : (
+              <>
+                <div className="mb-6 flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">
+                  <p className="max-w-2xl text-sm text-gray-500">
+                    Organizations are independent environments. In each organization you can collaborate with other members and manage your own resources.
+                  </p>
+                  <button
+                    onClick={() => setShowCreate(true)}
+                    className="shrink-0 rounded-xl bg-gray-900 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-gray-800"
+                  >
+                    + Create New Organization
+                  </button>
+                </div>
+
+                {showCreate ? (
+                  <div className="mb-8 rounded-2xl border border-gray-200 bg-white p-6 shadow-sm">
+                    <h2 className="mb-4 text-lg font-medium text-gray-900">Create an Organization</h2>
+                    <form onSubmit={handleCreate} className="grid max-w-md gap-4">
+                      <label className="grid gap-2">
+                        <span className="text-sm font-medium text-gray-700">Organization Name</span>
+                        <input
+                          type="text"
+                          value={createName}
+                          onChange={(e) => setCreateName(e.target.value)}
+                          placeholder="Acme Corp"
+                          className="w-full rounded-xl border border-gray-200 px-4 py-2.5 text-sm text-gray-900 outline-none transition focus:border-gray-400 focus:ring-4 focus:ring-gray-900/5"
+                          autoFocus
+                          required
+                        />
+                      </label>
+
+                      <div className="flex gap-3 pt-2">
+                        <button
+                          type="button"
+                          onClick={() => {
+                            setShowCreate(false);
+                            setCreateName("");
+                            setCreateError(null);
+                          }}
+                          className="rounded-xl border border-gray-200 px-4 py-2 text-sm font-medium text-gray-700 transition-colors hover:bg-gray-50"
+                        >
+                          Cancel
+                        </button>
+                        <button
+                          type="submit"
+                          disabled={createBusy || !createName.trim()}
+                          className="rounded-xl bg-gray-900 px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-gray-800 disabled:opacity-50"
+                        >
+                          {createBusy ? "Creating..." : "Create"}
+                        </button>
+                      </div>
+
+                      {createError ? <p className="text-sm font-medium text-rose-600">{createError}</p> : null}
+                    </form>
+                  </div>
+                ) : null}
+
+                <div className="overflow-hidden rounded-2xl border border-gray-200 bg-white shadow-sm">
+                  <div className="overflow-x-auto">
+                    <table className="w-full text-left text-sm">
+                      <thead className="border-b border-gray-200 bg-gray-50/50">
+                        <tr>
+                          <th className="px-6 py-4 font-medium text-gray-500">Organization</th>
+                          <th className="px-6 py-4 font-medium text-gray-500">Seat Type</th>
+                          <th className="px-6 py-4 text-right font-medium text-gray-500">Action</th>
+                        </tr>
+                      </thead>
+                      <tbody className="divide-y divide-gray-100">
+                        {orgs.map((org) => (
+                          <tr key={org.id} className="transition-colors hover:bg-gray-50/50">
+                            <td className="px-6 py-4">
+                              <div className="font-medium text-gray-900">{org.name}</div>
+                              <div className="mt-1 text-xs text-gray-500">
+                                {org.role === "owner" ? "Creator plan" : "Free plan"} • 1 member
+                              </div>
+                            </td>
+                            <td className="px-6 py-4">
+                              <span className="text-gray-700">{formatRoleLabel(org.role)}</span>
+                            </td>
+                            <td className="px-6 py-4 text-right">
+                              {org.isActive ? (
+                                <span className="inline-flex cursor-default items-center rounded-lg bg-gray-100 px-3 py-1.5 text-xs font-medium text-gray-500">
+                                  Current Organization
+                                </span>
+                              ) : (
+                                <button
+                                  onClick={() => handleSwitch(org.slug)}
+                                  className="rounded-lg border border-gray-200 bg-white px-3 py-1.5 text-xs font-medium text-gray-700 shadow-sm transition hover:bg-gray-50"
+                                >
+                                  Switch
+                                </button>
+                              )}
+                              <button
+                                onClick={() => handleSwitch(org.slug)}
+                                className="ml-2 inline-flex items-center justify-center rounded-lg p-1.5 text-gray-400 transition hover:bg-gray-100 hover:text-gray-700"
+                                aria-label="Organization settings"
+                              >
+                                <Settings className="h-4 w-4" />
+                              </button>
+                            </td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </div>
+                </div>
+
+                <p className="mt-8 text-center text-sm text-gray-500">You have no pending organization invites.</p>
+              </>
+            )}
+          </div>
+        )}
+      </main>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/button.tsx b/ee/apps/den-web/app/(den)/_components/ui/button.tsx
new file mode 100644
index 0000000000..cc5d876311
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/button.tsx
@@ -0,0 +1,161 @@
+"use client";
+
+import type { ButtonHTMLAttributes, ElementType } from "react";
+
+// ─── Variant / size tokens ────────────────────────────────────────────────────
+
+export type ButtonVariant = "primary" | "secondary" | "destructive";
+export type ButtonSize = "md" | "sm";
+
+const variantClasses: Record<ButtonVariant, string> = {
+    primary: "bg-[#0f172a] text-white hover:bg-[#111c33]",
+    secondary:
+        "border border-gray-200 bg-white text-gray-700 hover:bg-gray-50 hover:border-gray-300 hover:text-gray-900",
+    destructive:
+        "border border-red-200 text-red-600 hover:bg-red-50 hover:border-red-300",
+};
+
+// md is sized to match the Shared Workspaces reference buttons (px-5 py-2.5 ≈ h-10)
+const sizeClasses: Record<ButtonSize, string> = {
+    md: "h-10 px-5 text-[13px] gap-2",
+    sm: "h-8 px-3.5 text-[12px] gap-1.5",
+};
+
+// ─── buttonVariants helper (for <Link> / <a> elements) ───────────────────────
+
+/**
+ * Returns the className string for button styles.
+ * Use this on <Link> and <a> elements that should look like buttons.
+ */
+export function buttonVariants({
+    variant = "primary",
+    size = "md",
+    className = "",
+}: {
+    variant?: ButtonVariant;
+    size?: ButtonSize;
+    className?: string;
+} = {}): string {
+    return [
+        "inline-flex items-center justify-center rounded-full font-medium transition-colors",
+        variantClasses[variant],
+        sizeClasses[size],
+        className,
+    ]
+        .filter(Boolean)
+        .join(" ");
+}
+
+// ─── Spinner ──────────────────────────────────────────────────────────────────
+
+function Spinner({ px }: { px: number }) {
+    return (
+        <svg
+            aria-hidden="true"
+            className="animate-spin"
+            xmlns="http://www.w3.org/2000/svg"
+            fill="none"
+            viewBox="0 0 24 24"
+            width={px}
+            height={px}
+        >
+            <circle
+                className="opacity-25"
+                cx="12"
+                cy="12"
+                r="10"
+                stroke="currentColor"
+                strokeWidth="4"
+            />
+            <path
+                className="opacity-75"
+                fill="currentColor"
+                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"
+            />
+        </svg>
+    );
+}
+
+// ─── DenButton ────────────────────────────────────────────────────────────────
+
+export type DenButtonProps = ButtonHTMLAttributes<HTMLButtonElement> & {
+    variant?: ButtonVariant;
+    size?: ButtonSize;
+    /**
+     * Lucide icon component rendered on the left.
+     * In loading state the icon is replaced by a spinner.
+     */
+    icon?: ElementType<{
+        size?: number;
+        className?: string;
+        strokeWidth?: number;
+    }>;
+    /**
+     * Shows a spinner and forces the button into a disabled state.
+     * - With icon: spinner replaces the icon; text stays visible.
+     * - Without icon: text becomes invisible (preserving button width) and a
+     *   spinner appears centered over it.
+     */
+    loading?: boolean;
+};
+
+export function DenButton({
+    variant = "primary",
+    size = "md",
+    icon: Icon,
+    loading = false,
+    disabled = false,
+    children,
+    className,
+    ...rest
+}: DenButtonProps) {
+    const isDisabled = disabled || loading;
+    const iconPx = size === "sm" ? 13 : 15;
+    const hasText = children !== null && children !== undefined;
+    // No-icon loading: hide text but keep its width, overlay centered spinner
+    const noIconLoading = loading && !Icon;
+
+    return (
+        <button
+            {...rest}
+            type={rest.type ?? "button"}
+            disabled={isDisabled}
+            className={[
+                "relative flex flex-row gap-2 items-center justify-center rounded-full font-medium transition-colors",
+                variantClasses[variant],
+                sizeClasses[size],
+                isDisabled ? "cursor-not-allowed opacity-70" : "",
+                className ?? "",
+            ]
+                .filter(Boolean)
+                .join(" ")}
+        >
+            {/* Leading icon slot ─ shows icon normally, or spinner when loading */}
+            {Icon && !loading && (
+                <Icon size={iconPx} strokeWidth={1.75} aria-hidden="true" />
+            )}
+            {Icon && loading && <Spinner px={iconPx} />}
+
+            {/* Text — invisible (not removed) when in no-icon loading state */}
+            {hasText && (
+                <div
+                    className={[
+                        noIconLoading ? "invisible" : undefined,
+                        "flex flex-row gap-2 items-center",
+                    ]
+                        .filter(Boolean)
+                        .join(" ")}
+                >
+                    {children}
+                </div>
+            )}
+
+            {/* Centered overlay spinner when there is no icon */}
+            {noIconLoading && (
+                <span className="absolute inset-0 flex items-center justify-center">
+                    <Spinner px={iconPx} />
+                </span>
+            )}
+        </button>
+    );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/card.tsx b/ee/apps/den-web/app/(den)/_components/ui/card.tsx
new file mode 100644
index 0000000000..560a2fc435
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/card.tsx
@@ -0,0 +1,59 @@
+"use client";
+
+import { forwardRef, type HTMLAttributes } from "react";
+
+/**
+ * Visual density presets for cards.
+ *
+ * Den surfaces never use drop shadows — flat borders only. If you need to
+ * emphasise a card, use a darker border, a coloured background, or the
+ * gradient hero (see `DashboardPageTemplate`). Do NOT reintroduce shadows.
+ */
+export type DenCardSize = "comfortable" | "spacious";
+
+const sizeClasses: Record<DenCardSize, string> = {
+  // Matches the original Members / API Keys inline card.
+  comfortable: "rounded-[30px] p-6",
+  // Matches the editor-screen section card (LLM providers, skill hubs).
+  spacious: "rounded-[36px] p-8",
+};
+
+export type DenCardProps = HTMLAttributes<HTMLDivElement> & {
+  size?: DenCardSize;
+};
+
+/**
+ * DenCard
+ *
+ * Reusable surface container for the Den dashboard.
+ *
+ * Intentional constraints:
+ * - No drop shadows. Ever.
+ * - No hover transforms. Cards are surfaces, not buttons.
+ * - Single, borderable background (`border-gray-200 bg-white`).
+ *
+ * Pick a size that matches the surrounding flow:
+ * - `comfortable` (default): forms, summary cards, inline editors.
+ * - `spacious`: detail/editor pages with multiple stacked sections.
+ *
+ * Anything more opinionated (headings, toolbars, descriptions) belongs in a
+ * higher-level composition, not in this primitive.
+ */
+export const DenCard = forwardRef<HTMLDivElement, DenCardProps>(function DenCard(
+  { size = "comfortable", className, ...rest },
+  ref,
+) {
+  return (
+    <div
+      ref={ref}
+      {...rest}
+      className={[
+        "border border-gray-200 bg-white",
+        sizeClasses[size],
+        className ?? "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    />
+  );
+});
diff --git a/ee/apps/den-web/app/(den)/_components/ui/combobox.tsx b/ee/apps/den-web/app/(den)/_components/ui/combobox.tsx
new file mode 100644
index 0000000000..1412a96ed5
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/combobox.tsx
@@ -0,0 +1,407 @@
+"use client";
+
+import { Check, ChevronDown } from "lucide-react";
+import { useEffect, useId, useMemo, useRef, useState, type ChangeEvent, type FocusEvent, type KeyboardEvent } from "react";
+import {
+  denDropdownChevronSlotClass,
+  denDropdownFieldBaseClass,
+  denDropdownFieldOpenClass,
+  denDropdownListClass,
+  denDropdownMenuBaseClass,
+  denDropdownRowActiveClass,
+  denDropdownRowBaseClass,
+  denDropdownRowIdleClass,
+  denDropdownRowSelectedClass,
+} from "./dropdown-styles";
+
+export type DenComboboxOption = {
+  value: string;
+  label: string;
+  description?: string;
+  meta?: string;
+  keywords?: string[];
+};
+
+export type DenComboboxProps = {
+  value: string;
+  options: DenComboboxOption[];
+  onChange: (value: string) => void;
+  placeholder?: string;
+  searchPlaceholder?: string;
+  emptyLabel?: string;
+  disabled?: boolean;
+  className?: string;
+  ariaLabel?: string;
+};
+
+function normalizeQuery(value: string) {
+  return value.trim().toLowerCase();
+}
+
+function getOptionSearchText(option: DenComboboxOption) {
+  return [option.label, option.value, option.description ?? "", ...(option.keywords ?? [])]
+    .join(" ")
+    .toLowerCase();
+}
+
+export function DenCombobox({
+  value,
+  options,
+  onChange,
+  placeholder = "Select an option...",
+  searchPlaceholder = "Search...",
+  emptyLabel = "No options match",
+  disabled = false,
+  className,
+  ariaLabel = "Select option",
+}: DenComboboxProps) {
+  const [open, setOpen] = useState(false);
+  const [query, setQuery] = useState("");
+  const [hasTypedSinceOpen, setHasTypedSinceOpen] = useState(false);
+  const [activeValue, setActiveValue] = useState<string | null>(null);
+  const rootRef = useRef<HTMLDivElement>(null);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const optionRefs = useRef<Record<string, HTMLButtonElement | null>>({});
+  const listboxId = useId();
+
+  const selectedOption = useMemo(() => options.find((option) => option.value === value) ?? null, [options, value]);
+  const selectedLabel = selectedOption?.label ?? "";
+  const normalizedQuery = hasTypedSinceOpen ? normalizeQuery(query) : "";
+  const filteredOptions = useMemo(() => {
+    if (!normalizedQuery) {
+      return options;
+    }
+
+    return options.filter((option) => getOptionSearchText(option).includes(normalizedQuery));
+  }, [normalizedQuery, options]);
+
+  const activeIndex = activeValue ? filteredOptions.findIndex((option) => option.value === activeValue) : -1;
+  const activeDescendant = activeIndex >= 0 ? `${listboxId}-option-${activeIndex}` : undefined;
+  const inputValue = open ? (hasTypedSinceOpen ? query : selectedLabel) : selectedLabel;
+
+  function focusInput(selectText = false) {
+    requestAnimationFrame(() => {
+      inputRef.current?.focus();
+      if (selectText) {
+        inputRef.current?.select();
+      }
+    });
+  }
+
+  function openCombobox({ selectText = false }: { selectText?: boolean } = {}) {
+    if (disabled) {
+      return;
+    }
+
+    setOpen(true);
+    setHasTypedSinceOpen(false);
+    setQuery(selectedLabel);
+    if (selectText) {
+      focusInput(true);
+    }
+  }
+
+  function closeCombobox({ focus = false }: { focus?: boolean } = {}) {
+    setOpen(false);
+    setActiveValue(null);
+    setHasTypedSinceOpen(false);
+    setQuery(selectedLabel);
+    if (focus) {
+      focusInput();
+    }
+  }
+
+  function selectOption(nextValue: string) {
+    const nextOption = options.find((option) => option.value === nextValue) ?? null;
+    onChange(nextValue);
+    setOpen(false);
+    setActiveValue(null);
+    setHasTypedSinceOpen(false);
+    setQuery(nextOption?.label ?? "");
+    focusInput();
+  }
+
+  function moveActive(step: 1 | -1) {
+    if (!filteredOptions.length) {
+      return;
+    }
+
+    if (!activeValue) {
+      setActiveValue(step === 1 ? filteredOptions[0]?.value ?? null : filteredOptions[filteredOptions.length - 1]?.value ?? null);
+      return;
+    }
+
+    const currentIndex = filteredOptions.findIndex((option) => option.value === activeValue);
+    const nextIndex = currentIndex < 0
+      ? 0
+      : (currentIndex + step + filteredOptions.length) % filteredOptions.length;
+    setActiveValue(filteredOptions[nextIndex]?.value ?? null);
+  }
+
+  function handleInputFocus(event: FocusEvent<HTMLInputElement>) {
+    if (disabled) {
+      return;
+    }
+
+    openCombobox();
+
+    if (!open && selectedLabel) {
+      const input = event.currentTarget;
+      requestAnimationFrame(() => input.select());
+    }
+  }
+
+  function handleInputChange(event: ChangeEvent<HTMLInputElement>) {
+    if (!open) {
+      setOpen(true);
+    }
+    setHasTypedSinceOpen(true);
+    setQuery(event.target.value);
+  }
+
+  function handleInputKeyDown(event: KeyboardEvent<HTMLInputElement>) {
+    if (disabled) {
+      return;
+    }
+
+    if (!open && event.key.length === 1 && !event.altKey && !event.ctrlKey && !event.metaKey) {
+      event.preventDefault();
+      openCombobox();
+      setHasTypedSinceOpen(true);
+      setQuery(event.key);
+      setActiveValue(null);
+      return;
+    }
+
+    if (!open && (event.key === "ArrowDown" || event.key === "ArrowUp")) {
+      event.preventDefault();
+      openCombobox();
+      setActiveValue(
+        event.key === "ArrowUp"
+          ? options[options.length - 1]?.value ?? null
+          : selectedOption?.value ?? options[0]?.value ?? null,
+      );
+      return;
+    }
+
+    if (event.key === "ArrowDown") {
+      event.preventDefault();
+      moveActive(1);
+      return;
+    }
+
+    if (event.key === "ArrowUp") {
+      event.preventDefault();
+      moveActive(-1);
+      return;
+    }
+
+    if (event.key === "Home") {
+      if (open) {
+        event.preventDefault();
+        setActiveValue(filteredOptions[0]?.value ?? null);
+      }
+      return;
+    }
+
+    if (event.key === "End") {
+      if (open) {
+        event.preventDefault();
+        setActiveValue(filteredOptions[filteredOptions.length - 1]?.value ?? null);
+      }
+      return;
+    }
+
+    if (event.key === "Enter") {
+      if (open && activeValue) {
+        event.preventDefault();
+        selectOption(activeValue);
+      }
+      return;
+    }
+
+    if (event.key === "Escape") {
+      if (open) {
+        event.preventDefault();
+        closeCombobox({ focus: true });
+      }
+    }
+  }
+
+  useEffect(() => {
+    if (open) {
+      return;
+    }
+
+    setQuery(selectedLabel);
+    setHasTypedSinceOpen(false);
+  }, [open, selectedLabel]);
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+
+    const handlePointerDown = (event: PointerEvent) => {
+      if (rootRef.current?.contains(event.target as Node)) {
+        return;
+      }
+      closeCombobox();
+    };
+
+    document.addEventListener("pointerdown", handlePointerDown);
+    return () => {
+      document.removeEventListener("pointerdown", handlePointerDown);
+    };
+  }, [open, selectedLabel]);
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+
+    setActiveValue((current) => {
+      if (current && filteredOptions.some((option) => option.value === current)) {
+        return current;
+      }
+      if (selectedOption && filteredOptions.some((option) => option.value === selectedOption.value)) {
+        return selectedOption.value;
+      }
+      return filteredOptions[0]?.value ?? null;
+    });
+  }, [filteredOptions, open, selectedOption]);
+
+  useEffect(() => {
+    if (!open || !activeValue) {
+      return;
+    }
+
+    const frame = requestAnimationFrame(() => {
+      optionRefs.current[activeValue]?.scrollIntoView({ block: "nearest" });
+    });
+
+    return () => {
+      cancelAnimationFrame(frame);
+    };
+  }, [activeValue, open]);
+
+  return (
+    <div
+      ref={rootRef}
+      className="relative"
+      onBlurCapture={() => {
+        if (!open) {
+          return;
+        }
+
+        requestAnimationFrame(() => {
+          const activeElement = document.activeElement;
+          if (rootRef.current && activeElement instanceof Node && !rootRef.current.contains(activeElement)) {
+            closeCombobox();
+          }
+        });
+      }}
+    >
+      <div className="relative">
+        <input
+          ref={inputRef}
+          type="search"
+          value={inputValue}
+          disabled={disabled}
+          readOnly={!open}
+          name={`${listboxId}-search`}
+          autoComplete="new-password"
+          autoCorrect="off"
+          autoCapitalize="none"
+          spellCheck={false}
+          data-form-type="other"
+          data-lpignore="true"
+          data-1p-ignore="true"
+          placeholder={open ? searchPlaceholder : placeholder}
+          aria-label={ariaLabel}
+          role="combobox"
+          aria-haspopup="listbox"
+          aria-expanded={open}
+          aria-controls={listboxId}
+          aria-autocomplete="list"
+          aria-activedescendant={activeDescendant}
+          onFocus={handleInputFocus}
+          onChange={handleInputChange}
+          onClick={() => {
+            if (!open) {
+              openCombobox({ selectText: true });
+            }
+          }}
+          onKeyDown={handleInputKeyDown}
+          className={[
+            denDropdownFieldBaseClass,
+            "rounded-lg placeholder:text-gray-400",
+            open ? denDropdownFieldOpenClass : "",
+            disabled ? "cursor-not-allowed opacity-60" : "cursor-text",
+            className ?? "",
+          ]
+            .filter(Boolean)
+            .join(" ")}
+        />
+        <span className={denDropdownChevronSlotClass}>
+          <ChevronDown size={16} className={disabled ? "text-gray-300" : "text-gray-400"} aria-hidden="true" />
+        </span>
+      </div>
+
+      {open ? (
+        <div className={denDropdownMenuBaseClass}>
+          <div id={listboxId} role="listbox" className={denDropdownListClass}>
+            {filteredOptions.length ? (
+              filteredOptions.map((option, index) => {
+                const selected = option.value === value;
+                const active = option.value === activeValue;
+
+                return (
+                  <button
+                    key={option.value}
+                    ref={(node) => {
+                      optionRefs.current[option.value] = node;
+                    }}
+                    id={`${listboxId}-option-${index}`}
+                    type="button"
+                    role="option"
+                    tabIndex={-1}
+                    aria-selected={selected}
+                    onMouseEnter={() => setActiveValue(option.value)}
+                    onMouseDown={(event) => {
+                      event.preventDefault();
+                      selectOption(option.value);
+                    }}
+                    className={[
+                      denDropdownRowBaseClass,
+                      "items-start",
+                      selected ? denDropdownRowSelectedClass : active ? denDropdownRowActiveClass : denDropdownRowIdleClass,
+                    ]
+                      .filter(Boolean)
+                      .join(" ")}
+                  >
+                    <div className="min-w-0 flex-1">
+                      <p className="truncate text-[14px] font-medium text-gray-900">{option.label}</p>
+                      {option.description ? (
+                        <p className="mt-1 truncate text-[12px] text-gray-500">{option.description}</p>
+                      ) : null}
+                    </div>
+
+                    <div className="flex shrink-0 items-center gap-3 pl-2">
+                      {option.meta ? <span className="text-[12px] text-gray-400">{option.meta}</span> : null}
+                      {selected ? <Check className="h-4 w-4 text-gray-900" aria-hidden="true" /> : null}
+                    </div>
+                  </button>
+                );
+              })
+            ) : (
+              <div className="px-3 py-4 text-[13px] text-gray-500">
+                {query ? `${emptyLabel} "${query}"` : emptyLabel}
+              </div>
+            )}
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/dashboard-page-template.tsx b/ee/apps/den-web/app/(den)/_components/ui/dashboard-page-template.tsx
new file mode 100644
index 0000000000..2fe09dc5c8
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/dashboard-page-template.tsx
@@ -0,0 +1,109 @@
+"use client";
+
+import type { ElementType } from "react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { Dithering } from "@paper-design/shaders-react";
+
+/**
+ * DashboardPageTemplate
+ *
+ * A consistent page shell for all org dashboard pages.
+ * Provides:
+ *  - A gradient hero card (icon + badge + title)
+ *  - A description line below the card
+ *  - A children slot for page-specific content
+ *
+ * Caller controls only the gradient `colors` tuple — everything else
+ * (distortion, swirl, grain, speed, frame, dithering overlay) is fixed
+ * so every page looks coherent.
+ */
+
+export type DashboardPageTemplateProps = {
+  /** Lucide (or any) icon component rendered inside the frosted glass icon box */
+  icon: ElementType<{
+    size?: number;
+    className?: string;
+    strokeWidth?: number;
+  }>;
+  /** Short label rendered as a frosted pill badge above the title. Omit to hide. */
+  badgeLabel?: string;
+  /** Page heading rendered large inside the card */
+  title: string;
+  /** One-liner rendered in gray below the card, above children */
+  description: string;
+  /**
+   * Exactly 4 CSS hex colors for the mesh gradient.
+   * Tip: vary hue across pages so each section feels distinct at a glance.
+   */
+  colors: [string, string, string, string];
+  children?: React.ReactNode;
+};
+
+export function DashboardPageTemplate({
+  icon: Icon,
+  badgeLabel,
+  title,
+  description,
+  colors,
+  children,
+}: DashboardPageTemplateProps) {
+  return (
+    <div className="mx-auto max-w-[860px] p-8">
+      {/* ── Gradient hero card ── */}
+      <div className="relative mb-8 flex h-[200px] items-center overflow-hidden rounded-3xl border border-gray-100 px-10">
+        {/* Background layers: mesh gradient wrapped in a dithering texture */}
+        <div className="absolute inset-0 z-0">
+          <Dithering
+            speed={0}
+            shape="warp"
+            type="4x4"
+            size={2.5}
+            scale={1}
+            frame={41112.4}
+            colorBack="#00000000"
+            colorFront="#FEFEFE"
+            style={{
+              backgroundColor: "#0f172a",
+              width: "100%",
+              height: "100%",
+            }}
+          >
+            <PaperMeshGradient
+              speed={0.1}
+              distortion={0.8}
+              swirl={0.1}
+              grainMixer={0}
+              grainOverlay={0}
+              frame={176868.9}
+              colors={colors}
+              style={{ width: "100%", height: "100%" }}
+            />
+          </Dithering>
+        </div>
+
+        {/* Icon — top right */}
+        <div className="absolute right-8 top-8 z-10 flex h-12 w-12 items-center justify-center rounded-xl border border-white/30 bg-white/20 backdrop-blur-md">
+          <Icon size={24} className="text-white" strokeWidth={1.5} />
+        </div>
+
+        {/* Badge (optional) + Title — bottom left */}
+        <div className="absolute bottom-8 left-10 z-10 flex flex-col items-start gap-2">
+          {badgeLabel ? (
+            <span className="rounded-full border border-white/20 bg-white/20 px-2.5 py-1 text-[10px] uppercase tracking-[1px] text-white backdrop-blur-md">
+              {badgeLabel}
+            </span>
+          ) : null}
+          <h1 className="text-[28px] font-medium tracking-[-0.5px] text-white">
+            {title}
+          </h1>
+        </div>
+      </div>
+
+      {/* ── Description ── */}
+      <p className="mb-6 text-[14px] text-gray-500">{description}</p>
+
+      {/* ── Page content ── */}
+      {children}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/dropdown-styles.ts b/ee/apps/den-web/app/(den)/_components/ui/dropdown-styles.ts
new file mode 100644
index 0000000000..e3340d1b1e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/dropdown-styles.ts
@@ -0,0 +1,24 @@
+export const denDropdownFieldBaseClass = [
+  "w-full border border-gray-200 bg-white",
+  "h-[42px] px-4 pr-10 text-[14px] leading-5 text-gray-900",
+  "outline-none transition-all focus:border-gray-300 focus:ring-2 focus:ring-gray-900/5",
+].join(" ");
+
+export const denDropdownFieldOpenClass = "border-gray-300 ring-2 ring-gray-900/5";
+
+export const denDropdownChevronSlotClass = "pointer-events-none absolute inset-y-0 right-3 flex items-center";
+
+export const denDropdownMenuBaseClass = [
+  "absolute left-0 top-[calc(100%+0.375rem)] z-30 w-full overflow-hidden rounded-lg",
+  "border border-gray-200 bg-white shadow-[0_20px_44px_-28px_rgba(15,23,42,0.22)]",
+].join(" ");
+
+export const denDropdownListClass = "max-h-72 overflow-y-auto p-1.5";
+
+export const denDropdownRowBaseClass = "flex w-full justify-between gap-3 rounded-lg px-3 py-2.5 text-left transition";
+
+export const denDropdownRowIdleClass = "bg-white hover:bg-gray-50";
+
+export const denDropdownRowActiveClass = "bg-gray-50";
+
+export const denDropdownRowSelectedClass = "bg-gray-50/80";
diff --git a/ee/apps/den-web/app/(den)/_components/ui/input.tsx b/ee/apps/den-web/app/(den)/_components/ui/input.tsx
new file mode 100644
index 0000000000..4fceed2525
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/input.tsx
@@ -0,0 +1,90 @@
+"use client";
+
+import type { ElementType, InputHTMLAttributes } from "react";
+
+export type DenInputProps = Omit<InputHTMLAttributes<HTMLInputElement>, "disabled"> & {
+  /**
+   * Optional Lucide icon component rendered on the left.
+   * When omitted, no icon is shown and no extra left padding is added.
+   */
+  icon?: ElementType<{ size?: number; className?: string }>;
+  /**
+   * Pixel size of the icon. Defaults to 16.
+   * Use 20 for larger search fields so the icon stays proportional.
+   * Left position and left-padding are derived automatically.
+   */
+  iconSize?: number;
+  /**
+   * Disables the input and dims it to 60 % opacity.
+   * Forwarded as the native `disabled` attribute.
+   */
+  disabled?: boolean;
+};
+
+/**
+ * DenInput
+ *
+ * Consistent text input for all dashboard pages, based on the
+ * Shared Workspaces compact search field.
+ *
+ * Defaults: rounded-lg · h-[42px] · px-4 · text-[14px]/leading-5
+ * Icon: auto-positions and adjusts left padding.
+ * No className needed at the call site — override only when necessary.
+ */
+export function DenInput({
+  icon: Icon,
+  iconSize = 16,
+  disabled = false,
+  className,
+  ...rest
+}: DenInputProps) {
+  const isLargeIcon = iconSize > 16;
+  const iconLeft = isLargeIcon ? "left-5" : "left-3";
+  // inject icon left-padding only if the caller hasn't specified one
+  const iconPl = Icon
+    ? className?.includes("pl-")
+      ? ""
+      : isLargeIcon
+        ? "pl-14"
+        : "pl-9"
+    : "";
+
+  const input = (
+    <input
+      {...rest}
+      disabled={disabled}
+      className={[
+        // base visual style
+        "w-full rounded-lg border border-gray-200 bg-white",
+        "h-[42px] px-4 text-[14px] leading-5 text-gray-900",
+        "outline-none transition-all placeholder:text-gray-400",
+        "focus:border-gray-300 focus:ring-2 focus:ring-gray-900/5",
+        // disabled state
+        disabled ? "cursor-not-allowed opacity-60" : "",
+        // icon left-padding (overrides px-4 left side)
+        iconPl,
+        // caller overrides
+        className ?? "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    />
+  );
+
+  if (!Icon) return input;
+
+  return (
+    <div className="relative">
+      <div
+        className={`pointer-events-none absolute inset-y-0 ${iconLeft} flex items-center`}
+      >
+        <Icon
+          size={iconSize}
+          className={disabled ? "text-gray-300" : "text-gray-400"}
+          aria-hidden="true"
+        />
+      </div>
+      {input}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/select.tsx b/ee/apps/den-web/app/(den)/_components/ui/select.tsx
new file mode 100644
index 0000000000..e017222977
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/select.tsx
@@ -0,0 +1,383 @@
+"use client";
+
+import { Check, ChevronDown } from "lucide-react";
+import {
+  Children,
+  isValidElement,
+  useEffect,
+  useId,
+  useMemo,
+  useRef,
+  useState,
+  type ChangeEvent,
+  type FocusEvent,
+  type KeyboardEvent,
+  type ReactElement,
+  type ReactNode,
+  type SelectHTMLAttributes,
+} from "react";
+import {
+  denDropdownChevronSlotClass,
+  denDropdownFieldBaseClass,
+  denDropdownFieldOpenClass,
+  denDropdownListClass,
+  denDropdownMenuBaseClass,
+  denDropdownRowActiveClass,
+  denDropdownRowBaseClass,
+  denDropdownRowIdleClass,
+  denDropdownRowSelectedClass,
+} from "./dropdown-styles";
+
+type DenSelectOption = {
+  value: string;
+  disabled: boolean;
+  content: ReactNode;
+};
+
+export type DenSelectProps = Omit<SelectHTMLAttributes<HTMLSelectElement>, "disabled"> & {
+  disabled?: boolean;
+};
+
+function getOptionText(node: ReactNode): string {
+  if (typeof node === "string" || typeof node === "number") {
+    return String(node);
+  }
+
+  if (Array.isArray(node)) {
+    return node.map(getOptionText).join("");
+  }
+
+  if (isValidElement<{ children?: ReactNode }>(node)) {
+    return getOptionText(node.props.children);
+  }
+
+  return "";
+}
+
+function createSelectEvent(value: string, name?: string) {
+  return {
+    target: { value, name: name ?? "" },
+    currentTarget: { value, name: name ?? "" },
+  } as ChangeEvent<HTMLSelectElement>;
+}
+
+function createBlurEvent(value: string, name?: string) {
+  return {
+    target: { value, name: name ?? "" },
+    currentTarget: { value, name: name ?? "" },
+  } as FocusEvent<HTMLSelectElement>;
+}
+
+function getFirstEnabledOption(options: DenSelectOption[]) {
+  return options.find((option) => !option.disabled) ?? null;
+}
+
+export function DenSelect({
+  value,
+  defaultValue,
+  name,
+  id,
+  disabled = false,
+  className,
+  children,
+  onChange,
+  onBlur,
+  "aria-label": ariaLabel,
+  "aria-labelledby": ariaLabelledBy,
+}: DenSelectProps) {
+  const [open, setOpen] = useState(false);
+  const [activeValue, setActiveValue] = useState<string | null>(null);
+  const [uncontrolledValue, setUncontrolledValue] = useState<string | null>(defaultValue !== undefined ? String(defaultValue) : null);
+  const rootRef = useRef<HTMLDivElement>(null);
+  const triggerRef = useRef<HTMLButtonElement>(null);
+  const optionRefs = useRef<Record<string, HTMLButtonElement | null>>({});
+  const listboxId = useId();
+
+  const options = useMemo(() => {
+    return Children.toArray(children).flatMap((child) => {
+      if (!isValidElement(child) || child.type !== "option") {
+        return [];
+      }
+
+      const option = child as ReactElement<{
+        value?: string | number;
+        disabled?: boolean;
+        children?: ReactNode;
+      }>;
+
+      return [
+        {
+          value: option.props.value !== undefined ? String(option.props.value) : getOptionText(option.props.children),
+          disabled: option.props.disabled === true,
+          content: option.props.children,
+        } satisfies DenSelectOption,
+      ];
+    });
+  }, [children]);
+
+  useEffect(() => {
+    if (value === undefined && uncontrolledValue === null && options.length) {
+      setUncontrolledValue(options[0]?.value ?? null);
+    }
+  }, [options, uncontrolledValue, value]);
+
+  const selectedValue = value !== undefined ? String(value) : uncontrolledValue ?? "";
+  const selectedOption = options.find((option) => option.value === selectedValue) ?? options[0] ?? null;
+
+  function focusTrigger() {
+    requestAnimationFrame(() => triggerRef.current?.focus());
+  }
+
+  function openSelect(preferredValue?: string | null) {
+    if (disabled) {
+      return;
+    }
+
+    setOpen(true);
+    const nextActive = options.find((option) => option.value === preferredValue && !option.disabled) ?? getFirstEnabledOption(options);
+    setActiveValue(nextActive?.value ?? null);
+  }
+
+  function closeSelect({ focus = false }: { focus?: boolean } = {}) {
+    setOpen(false);
+    setActiveValue(null);
+    if (focus) {
+      focusTrigger();
+    }
+  }
+
+  function commitValue(nextValue: string) {
+    const nextOption = options.find((option) => option.value === nextValue);
+    if (!nextOption || nextOption.disabled) {
+      return;
+    }
+
+    if (value === undefined) {
+      setUncontrolledValue(nextValue);
+    }
+
+    onChange?.(createSelectEvent(nextValue, name));
+    closeSelect({ focus: true });
+  }
+
+  function moveActive(step: 1 | -1) {
+    const enabledOptions = options.filter((option) => !option.disabled);
+    if (!enabledOptions.length) {
+      return;
+    }
+
+    if (!activeValue) {
+      setActiveValue(step === 1 ? enabledOptions[0]?.value ?? null : enabledOptions[enabledOptions.length - 1]?.value ?? null);
+      return;
+    }
+
+    const currentIndex = enabledOptions.findIndex((option) => option.value === activeValue);
+    const nextIndex = currentIndex < 0
+      ? 0
+      : (currentIndex + step + enabledOptions.length) % enabledOptions.length;
+    setActiveValue(enabledOptions[nextIndex]?.value ?? null);
+  }
+
+  function handleTriggerKeyDown(event: KeyboardEvent<HTMLButtonElement>) {
+    if (disabled) {
+      return;
+    }
+
+    if (event.key === "ArrowDown") {
+      event.preventDefault();
+      if (!open) {
+        openSelect(selectedOption?.value ?? null);
+        return;
+      }
+      moveActive(1);
+      return;
+    }
+
+    if (event.key === "ArrowUp") {
+      event.preventDefault();
+      if (!open) {
+        openSelect(selectedOption?.value ?? options[options.length - 1]?.value ?? null);
+        return;
+      }
+      moveActive(-1);
+      return;
+    }
+
+    if (event.key === "Home" && open) {
+      event.preventDefault();
+      setActiveValue(getFirstEnabledOption(options)?.value ?? null);
+      return;
+    }
+
+    if (event.key === "End" && open) {
+      event.preventDefault();
+      const enabledOptions = options.filter((option) => !option.disabled);
+      setActiveValue(enabledOptions[enabledOptions.length - 1]?.value ?? null);
+      return;
+    }
+
+    if (event.key === "Enter" || event.key === " ") {
+      event.preventDefault();
+      if (!open) {
+        openSelect(selectedOption?.value ?? null);
+        return;
+      }
+
+      if (activeValue) {
+        commitValue(activeValue);
+      }
+      return;
+    }
+
+    if (event.key === "Escape" && open) {
+      event.preventDefault();
+      closeSelect({ focus: true });
+    }
+  }
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+
+    const handlePointerDown = (event: PointerEvent) => {
+      if (rootRef.current?.contains(event.target as Node)) {
+        return;
+      }
+      closeSelect();
+    };
+
+    document.addEventListener("pointerdown", handlePointerDown);
+    return () => {
+      document.removeEventListener("pointerdown", handlePointerDown);
+    };
+  }, [open]);
+
+  useEffect(() => {
+    if (!open || !activeValue) {
+      return;
+    }
+
+    const frame = requestAnimationFrame(() => {
+      optionRefs.current[activeValue]?.scrollIntoView({ block: "nearest" });
+    });
+
+    return () => {
+      cancelAnimationFrame(frame);
+    };
+  }, [activeValue, open]);
+
+  const activeIndex = activeValue ? options.findIndex((option) => option.value === activeValue) : -1;
+  const activeDescendant = activeIndex >= 0 ? `${listboxId}-option-${activeIndex}` : undefined;
+
+  return (
+    <div
+      ref={rootRef}
+      className="relative"
+      onBlurCapture={() => {
+        requestAnimationFrame(() => {
+          const activeElement = document.activeElement;
+          if (rootRef.current && activeElement instanceof Node && !rootRef.current.contains(activeElement)) {
+            if (open) {
+              closeSelect();
+            }
+            onBlur?.(createBlurEvent(selectedValue, name));
+          }
+        });
+      }}
+    >
+      {name ? <input type="hidden" name={name} value={selectedValue} disabled={disabled} /> : null}
+
+      <button
+        ref={triggerRef}
+        id={id}
+        type="button"
+        disabled={disabled}
+        aria-label={ariaLabel}
+        aria-labelledby={ariaLabelledBy}
+        aria-haspopup="listbox"
+        aria-expanded={open}
+        aria-controls={listboxId}
+        aria-activedescendant={activeDescendant}
+        onClick={() => {
+          if (open) {
+            closeSelect();
+            return;
+          }
+          openSelect(selectedOption?.value ?? null);
+        }}
+        onKeyDown={handleTriggerKeyDown}
+        className={[
+          denDropdownFieldBaseClass,
+          "flex items-center justify-between gap-3 rounded-lg text-left",
+          "focus-visible:border-gray-300 focus-visible:ring-2 focus-visible:ring-gray-900/5",
+          open ? denDropdownFieldOpenClass : "",
+          disabled ? "cursor-not-allowed opacity-60" : "cursor-pointer",
+          className ?? "",
+        ]
+          .filter(Boolean)
+          .join(" ")}
+      >
+        <span className="truncate">{selectedOption?.content ?? null}</span>
+        <span className={denDropdownChevronSlotClass}>
+          <ChevronDown size={16} className={disabled ? "text-gray-300" : "text-gray-400"} aria-hidden="true" />
+        </span>
+      </button>
+
+      {open ? (
+        <div className={denDropdownMenuBaseClass}>
+          <div id={listboxId} role="listbox" className={denDropdownListClass}>
+            {options.map((option, index) => {
+              const selected = option.value === selectedValue;
+              const active = option.value === activeValue;
+
+              return (
+                <button
+                  key={`${option.value}-${index}`}
+                  ref={(node) => {
+                    optionRefs.current[option.value] = node;
+                  }}
+                  id={`${listboxId}-option-${index}`}
+                  type="button"
+                  role="option"
+                  tabIndex={-1}
+                  aria-selected={selected}
+                  disabled={option.disabled}
+                  onMouseEnter={() => {
+                    if (!option.disabled) {
+                      setActiveValue(option.value);
+                    }
+                  }}
+                  onMouseDown={(event) => {
+                    event.preventDefault();
+                    if (!option.disabled) {
+                      commitValue(option.value);
+                    }
+                  }}
+                  className={[
+                    denDropdownRowBaseClass,
+                    "items-center",
+                    option.disabled
+                      ? "cursor-not-allowed opacity-50"
+                      : selected
+                        ? denDropdownRowSelectedClass
+                        : active
+                          ? denDropdownRowActiveClass
+                          : denDropdownRowIdleClass,
+                  ]
+                    .filter(Boolean)
+                    .join(" ")}
+                >
+                  <span className="min-w-0 flex-1 truncate text-[14px] font-medium text-gray-900">
+                    {option.content}
+                  </span>
+                  {selected ? <Check className="h-4 w-4 shrink-0 text-gray-900" aria-hidden="true" /> : null}
+                </button>
+              );
+            })}
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/selectable-row.tsx b/ee/apps/den-web/app/(den)/_components/ui/selectable-row.tsx
new file mode 100644
index 0000000000..587d322742
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/selectable-row.tsx
@@ -0,0 +1,64 @@
+"use client";
+
+import { Check } from "lucide-react";
+import type { ButtonHTMLAttributes, ReactNode } from "react";
+
+export type DenSelectableRowProps = Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "type"> & {
+  title: ReactNode;
+  description?: ReactNode;
+  selected?: boolean;
+  aside?: ReactNode;
+  leading?: ReactNode;
+  descriptionBelow?: boolean;
+};
+
+export function DenSelectableRow({
+  title,
+  description,
+  selected = false,
+  disabled = false,
+  aside,
+  leading,
+  descriptionBelow = false,
+  className,
+  ...rest
+}: DenSelectableRowProps) {
+  return (
+    <button
+      {...rest}
+      type="button"
+      disabled={disabled}
+      aria-pressed={selected}
+      className={[
+        "group relative flex w-full items-center gap-3 px-4 py-3 text-left outline-none transition-colors duration-150",
+        "focus-visible:z-10 focus-visible:ring-2 focus-visible:ring-gray-900/5",
+        selected
+          ? "bg-gray-100"
+          : "bg-white hover:bg-gray-50/60",
+        disabled ? "cursor-not-allowed opacity-60" : "cursor-pointer",
+        className ?? "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    >
+      {leading ? <div className="shrink-0">{leading}</div> : null}
+
+      <div className="min-w-0 flex-1">
+        <div className={descriptionBelow ? "grid min-w-0 gap-0.5" : "flex min-w-0 items-baseline gap-2"}>
+          <p className="truncate text-[15px] font-medium leading-[1.15] tracking-[-0.02em] text-gray-950">{title}</p>
+          {description ? <p className="truncate text-[12px] leading-[1.15] text-gray-500">{description}</p> : null}
+        </div>
+      </div>
+
+      {aside ? <div className="shrink-0">{aside}</div> : null}
+
+      {selected ? (
+        <span className="flex h-5 w-5 shrink-0 items-center justify-center rounded-[5px] bg-emerald-700 text-white" aria-hidden="true">
+          <Check className="h-3 w-3" />
+        </span>
+      ) : (
+        <span className="h-5 w-5 shrink-0 rounded-[5px] border border-gray-300 bg-white transition-colors group-hover:border-gray-400" aria-hidden="true" />
+      )}
+    </button>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/tabs.tsx b/ee/apps/den-web/app/(den)/_components/ui/tabs.tsx
new file mode 100644
index 0000000000..28184e0809
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/tabs.tsx
@@ -0,0 +1,60 @@
+"use client";
+
+import type { ElementType } from "react";
+
+export type TabItem<T extends string> = {
+  value: T;
+  label: string;
+  icon?: ElementType<{ className?: string }>;
+  count?: number;
+};
+
+type UnderlineTabsProps<T extends string> = {
+  tabs: readonly TabItem<T>[];
+  activeTab: T;
+  onChange: (value: T) => void;
+  className?: string;
+};
+
+export function UnderlineTabs<T extends string>({
+  tabs,
+  activeTab,
+  onChange,
+  className = "",
+}: UnderlineTabsProps<T>) {
+  return (
+    <div className={`border-b border-gray-200 ${className}`}>
+      <nav className="-mb-px flex flex-wrap gap-6" role="tablist">
+        {tabs.map(({ value, label, icon: Icon, count }) => {
+          const selected = activeTab === value;
+          return (
+            <button
+              key={value}
+              type="button"
+              role="tab"
+              aria-selected={selected}
+              onClick={() => onChange(value)}
+              className={`inline-flex items-center gap-2 border-b-2 pb-3 text-[14px] font-medium transition-colors ${
+                selected
+                  ? "border-[#0f172a] text-[#0f172a]"
+                  : "border-transparent text-gray-400 hover:text-gray-600"
+              }`}
+            >
+              {Icon ? <Icon className="h-4 w-4" /> : null}
+              {label}
+              {count !== undefined && count > 0 ? (
+                <span
+                  className={`rounded-full px-2 py-0.5 text-[11px] font-semibold ${
+                    selected ? "bg-gray-100 text-gray-600" : "bg-gray-100 text-gray-400"
+                  }`}
+                >
+                  {count}
+                </span>
+              ) : null}
+            </button>
+          );
+        })}
+      </nav>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_components/ui/textarea.tsx b/ee/apps/den-web/app/(den)/_components/ui/textarea.tsx
new file mode 100644
index 0000000000..af4195ec87
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_components/ui/textarea.tsx
@@ -0,0 +1,51 @@
+"use client";
+
+import type { TextareaHTMLAttributes } from "react";
+
+export type DenTextareaProps = Omit<
+  TextareaHTMLAttributes<HTMLTextAreaElement>,
+  "disabled"
+> & {
+  /**
+   * Number of visible text lines — sets the initial height.
+   * Defaults to 4.
+   */
+  rows?: number;
+  /**
+   * Disables the textarea and dims it to 60 % opacity.
+   * Forwarded as the native `disabled` attribute.
+   */
+  disabled?: boolean;
+};
+
+/**
+ * DenTextarea
+ *
+ * Matches DenInput styling exactly: same border, bg, focus ring,
+ * placeholder, and disabled state. Height is controlled by `rows`.
+ */
+export function DenTextarea({
+  rows = 4,
+  disabled = false,
+  className,
+  ...rest
+}: DenTextareaProps) {
+  return (
+    <textarea
+      {...rest}
+      rows={rows}
+      disabled={disabled}
+      className={[
+        "w-full rounded-lg border border-gray-200 bg-white",
+        "px-4 py-2.5 text-[14px] text-gray-900",
+        "outline-none transition-all placeholder:text-gray-400",
+        "focus:border-gray-300 focus:ring-2 focus:ring-gray-900/5",
+        "resize-none",
+        disabled ? "cursor-not-allowed opacity-60" : "",
+        className ?? "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    />
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/_lib/CONSTS.ts b/ee/apps/den-web/app/(den)/_lib/CONSTS.ts
new file mode 100644
index 0000000000..4ed52d341f
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/CONSTS.ts
@@ -0,0 +1 @@
+export const DEN_WORKER_POLL_INTERVAL_MS = 1000;
diff --git a/ee/apps/den-web/app/(den)/_lib/client-route.ts b/ee/apps/den-web/app/(den)/_lib/client-route.ts
new file mode 100644
index 0000000000..7e418adc74
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/client-route.ts
@@ -0,0 +1,25 @@
+export function getComparablePathname(target: string | null | undefined): string | null {
+  const trimmed = target?.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (trimmed.startsWith("http://") || trimmed.startsWith("https://")) {
+    try {
+      return new URL(trimmed).pathname;
+    } catch {
+      return trimmed;
+    }
+  }
+
+  return trimmed.split(/[?#]/)[0] ?? trimmed;
+}
+
+export function isSamePathname(currentPathname: string, target: string | null | undefined) {
+  const comparable = getComparablePathname(target);
+  if (!comparable) {
+    return false;
+  }
+
+  return comparable === currentPathname;
+}
diff --git a/ee/apps/den-web/app/(den)/_lib/den-flow.ts b/ee/apps/den-web/app/(den)/_lib/den-flow.ts
new file mode 100644
index 0000000000..fb8ec72209
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/den-flow.ts
@@ -0,0 +1,1015 @@
+import { DEN_WORKER_POLL_INTERVAL_MS } from "./CONSTS";
+
+export type AuthMode = "sign-in" | "sign-up";
+export type SocialAuthProvider = "github" | "google";
+export type WorkerStatusBucket = "ready" | "starting" | "attention" | "other";
+export type RuntimeServiceName = "openwork-server" | "opencode" | "opencode-router";
+export type EventLevel = "info" | "success" | "warning" | "error";
+export type AuthMethod = "email" | SocialAuthProvider;
+
+export type BillingPrice = {
+  amount: number | null;
+  currency: string | null;
+  recurringInterval: string | null;
+  recurringIntervalCount: number | null;
+};
+
+export type BillingSubscription = {
+  id: string;
+  status: string;
+  amount: number | null;
+  currency: string | null;
+  recurringInterval: string | null;
+  recurringIntervalCount: number | null;
+  currentPeriodStart: string | null;
+  currentPeriodEnd: string | null;
+  cancelAtPeriodEnd: boolean;
+  canceledAt: string | null;
+  endedAt: string | null;
+};
+
+export type BillingInvoice = {
+  id: string;
+  createdAt: string | null;
+  status: string;
+  totalAmount: number | null;
+  currency: string | null;
+  invoiceNumber: string | null;
+  invoiceUrl: string | null;
+};
+
+export type BillingSummary = {
+  featureGateEnabled: boolean;
+  hasActivePlan: boolean;
+  checkoutRequired: boolean;
+  checkoutUrl: string | null;
+  portalUrl: string | null;
+  price: BillingPrice | null;
+  subscription: BillingSubscription | null;
+  invoices: BillingInvoice[];
+  productId: string | null;
+  benefitId: string | null;
+};
+
+export type OrgLimitError = {
+  error: "org_limit_reached";
+  message: string;
+  limitType: "members" | "workers";
+  currentCount: number;
+  limit: number;
+};
+
+export type AuthUser = {
+  id: string;
+  email: string;
+  name: string | null;
+};
+
+export type WorkerLaunch = {
+  workerId: string;
+  workerName: string;
+  status: string;
+  provider: string | null;
+  instanceUrl: string | null;
+  openworkUrl: string | null;
+  workspaceId: string | null;
+  clientToken: string | null;
+  ownerToken: string | null;
+  hostToken: string | null;
+};
+
+export type WorkerSummary = {
+  workerId: string;
+  workerName: string;
+  status: string;
+  instanceUrl: string | null;
+  provider: string | null;
+  isMine: boolean;
+};
+
+export type WorkerTokens = {
+  clientToken: string | null;
+  ownerToken: string | null;
+  hostToken: string | null;
+  openworkUrl: string | null;
+  workspaceId: string | null;
+};
+
+export type WorkerListItem = {
+  workerId: string;
+  workerName: string;
+  status: string;
+  instanceUrl: string | null;
+  provider: string | null;
+  isMine: boolean;
+  createdAt: string | null;
+};
+
+export type WorkerRuntimeService = {
+  name: RuntimeServiceName;
+  enabled: boolean;
+  running: boolean;
+  targetVersion: string | null;
+  actualVersion: string | null;
+  upgradeAvailable: boolean;
+};
+
+export type WorkerRuntimeSnapshot = {
+  services: WorkerRuntimeService[];
+  upgrade: {
+    status: "idle" | "running" | "failed";
+    startedAt: string | null;
+    finishedAt: string | null;
+    error: string | null;
+  };
+};
+
+export type LaunchEvent = {
+  id: string;
+  level: EventLevel;
+  label: string;
+  detail: string;
+  at: string;
+};
+
+export type OnboardingIntent = {
+  version: 1;
+  workerName: string;
+  shouldLaunch: boolean;
+  completed: boolean;
+  authMethod: AuthMethod;
+};
+
+type PosthogClient = {
+  capture?: (eventName: string, properties?: Record<string, unknown>) => void;
+  identify?: (distinctId?: string, properties?: Record<string, unknown>) => void;
+  reset?: () => void;
+};
+
+declare global {
+  interface Window {
+    posthog?: PosthogClient;
+  }
+}
+
+export const LAST_WORKER_STORAGE_KEY = "openwork:web:last-worker";
+export const PENDING_SOCIAL_SIGNUP_STORAGE_KEY = "openwork:web:pending-social-signup";
+export const AUTH_TOKEN_STORAGE_KEY = "openwork:web:auth-token";
+export const ONBOARDING_INTENT_STORAGE_KEY = "openwork:web:onboarding-intent";
+export const WORKER_STATUS_POLL_MS = DEN_WORKER_POLL_INTERVAL_MS;
+export const DEFAULT_AUTH_NAME = "OpenWork User";
+export const DEFAULT_WORKER_NAME = "My Worker";
+export const OPENWORK_APP_CONNECT_BASE_URL = (process.env.NEXT_PUBLIC_OPENWORK_APP_CONNECT_URL ?? "").trim();
+export const OPENWORK_AUTH_CALLBACK_BASE_URL = (process.env.NEXT_PUBLIC_OPENWORK_AUTH_CALLBACK_URL ?? "").trim();
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+export function getAuthInfoForMode(mode: AuthMode): string {
+  return mode === "sign-up"
+    ? "Create an account to launch and manage cloud workers."
+    : "Sign in to launch and manage cloud workers.";
+}
+
+export function getEmailDomain(email: string): string {
+  const atIndex = email.lastIndexOf("@");
+  if (atIndex === -1 || atIndex + 1 >= email.length) {
+    return "unknown";
+  }
+  return email.slice(atIndex + 1).toLowerCase();
+}
+
+export function trackPosthogEvent(eventName: string, properties: Record<string, unknown> = {}) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    window.posthog?.capture?.(eventName, properties);
+  } catch {
+    // Ignore analytics delivery failures.
+  }
+}
+
+export function identifyPosthogUser(user: AuthUser) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    window.posthog?.identify?.(user.id, {
+      email: user.email,
+      name: user.name ?? undefined
+    });
+  } catch {
+    // Ignore analytics delivery failures.
+  }
+}
+
+export function resetPosthogUser() {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    window.posthog?.reset?.();
+  } catch {
+    // Ignore analytics delivery failures.
+  }
+}
+
+export function normalizeAuthModeParam(value: string | null | undefined): AuthMode | null {
+  return value === "sign-in" || value === "sign-up" ? value : null;
+}
+
+export function getSocialProviderLabel(provider: SocialAuthProvider): string {
+  return provider === "github" ? "GitHub" : "Google";
+}
+
+export function normalizeWorkerName(input: string): string {
+  const normalized = input.trim().replace(/\s+/g, " ");
+  return normalized || DEFAULT_WORKER_NAME;
+}
+
+export function deriveOnboardingWorkerName(user: AuthUser): string {
+  const rawIdentity = (user.name?.trim() || user.email.split("@")[0] || DEFAULT_WORKER_NAME).replace(/[._-]+/g, " ").trim();
+  const base = rawIdentity
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+
+  const owner = base || DEFAULT_WORKER_NAME;
+  const suffix = owner.endsWith("s") ? "' Worker" : "'s Worker";
+  return normalizeWorkerName(`${owner}${suffix}`);
+}
+
+export function getSocialCallbackUrl(): string {
+  try {
+    const origin = typeof window !== "undefined" ? window.location.origin : OPENWORK_AUTH_CALLBACK_BASE_URL || "https://app.openworklabs.com";
+    const callbackUrl = new URL("/", origin);
+    if (typeof window !== "undefined") {
+      const params = new URLSearchParams(window.location.search);
+      for (const key of ["mode", "desktopAuth", "desktopScheme", "invite"]) {
+        const value = params.get(key)?.trim() ?? "";
+        if (value) {
+          callbackUrl.searchParams.set(key, value);
+        }
+      }
+    }
+    return callbackUrl.toString();
+  } catch {
+    return "https://app.openworklabs.com/";
+  }
+}
+
+export function isDesktopContext(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+
+  const ua = window.navigator.userAgent || "";
+  return !/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(ua);
+}
+
+export function shortValue(value: string): string {
+  if (value.length <= 18) {
+    return value;
+  }
+  return `${value.slice(0, 8)}...${value.slice(-6)}`;
+}
+
+export function formatMoneyMinor(amount: number | null, currency: string | null): string {
+  if (typeof amount !== "number" || !Number.isFinite(amount)) {
+    return "Not available";
+  }
+
+  const normalizedCurrency = (currency ?? "USD").toUpperCase();
+  const majorValue = amount / 100;
+
+  try {
+    return new Intl.NumberFormat(undefined, {
+      style: "currency",
+      currency: normalizedCurrency
+    }).format(majorValue);
+  } catch {
+    return `${majorValue.toFixed(2)} ${normalizedCurrency}`;
+  }
+}
+
+export function formatIsoDate(value: string | null): string {
+  if (!value) {
+    return "Not available";
+  }
+
+  try {
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) {
+      return "Not available";
+    }
+    return date.toLocaleDateString();
+  } catch {
+    return "Not available";
+  }
+}
+
+export function formatRecurringInterval(interval: string | null, count: number | null): string {
+  if (!interval) {
+    return "billing cycle";
+  }
+
+  const normalizedInterval = interval.replace(/_/g, " ");
+  const normalizedCount = typeof count === "number" && Number.isFinite(count) ? count : 1;
+
+  if (normalizedCount <= 1) {
+    return `per ${normalizedInterval}`;
+  }
+
+  const pluralSuffix = normalizedInterval.endsWith("s") ? "" : "s";
+  return `every ${normalizedCount} ${normalizedInterval}${pluralSuffix}`;
+}
+
+export function formatSubscriptionStatus(status: string): string {
+  const normalized = status.trim().toLowerCase();
+  if (!normalized) {
+    return "Unknown";
+  }
+
+  return normalized
+    .split("_")
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+export function getErrorMessage(payload: unknown, fallback: string): string {
+  if (typeof payload === "string" && payload.trim().length > 0) {
+    const trimmed = payload.trim();
+    const lower = trimmed.toLowerCase();
+    if (lower.startsWith("<!doctype") || lower.startsWith("<html") || lower.includes("<body")) {
+      return `${fallback} Upstream returned an HTML error page.`;
+    }
+    if (trimmed.length > 240) {
+      return `${fallback} Upstream returned a non-JSON error payload.`;
+    }
+    return trimmed;
+  }
+
+  if (!isRecord(payload)) {
+    return fallback;
+  }
+
+  const message = payload.message;
+  if (typeof message === "string" && message.trim().length > 0) {
+    return message;
+  }
+
+  const error = payload.error;
+  if (typeof error === "string" && error.trim().length > 0) {
+    return error;
+  }
+
+  return fallback;
+}
+
+export function getOrgLimitError(payload: unknown): OrgLimitError | null {
+  if (!isRecord(payload) || payload.error !== "org_limit_reached") {
+    return null;
+  }
+
+  if (
+    (payload.limitType !== "members" && payload.limitType !== "workers") ||
+    typeof payload.message !== "string" ||
+    typeof payload.currentCount !== "number" ||
+    typeof payload.limit !== "number"
+  ) {
+    return null;
+  }
+
+  return {
+    error: "org_limit_reached",
+    message: payload.message,
+    limitType: payload.limitType,
+    currentCount: payload.currentCount,
+    limit: payload.limit,
+  };
+}
+
+export function getUser(payload: unknown): AuthUser | null {
+  if (!isRecord(payload) || !isRecord(payload.user)) {
+    return null;
+  }
+
+  const user = payload.user;
+  if (typeof user.id !== "string" || typeof user.email !== "string") {
+    return null;
+  }
+
+  return {
+    id: user.id,
+    email: user.email,
+    name: typeof user.name === "string" ? user.name : null
+  };
+}
+
+export function getToken(payload: unknown): string | null {
+  if (!isRecord(payload)) {
+    return null;
+  }
+  return typeof payload.token === "string" ? payload.token : null;
+}
+
+export function getCheckoutUrl(payload: unknown): string | null {
+  if (!isRecord(payload) || !isRecord(payload.polar)) {
+    return null;
+  }
+  return typeof payload.polar.checkoutUrl === "string" ? payload.polar.checkoutUrl : null;
+}
+
+export function getWorker(payload: unknown): WorkerLaunch | null {
+  if (!isRecord(payload) || !isRecord(payload.worker)) {
+    return null;
+  }
+
+  const worker = payload.worker;
+  if (typeof worker.id !== "string" || typeof worker.name !== "string") {
+    return null;
+  }
+
+  const instance = isRecord(payload.instance) ? payload.instance : null;
+  const tokens = isRecord(payload.tokens) ? payload.tokens : null;
+
+  return {
+    workerId: worker.id,
+    workerName: worker.name,
+    status: getEffectiveWorkerStatus(worker.status, instance),
+    provider: instance && typeof instance.provider === "string" ? instance.provider : null,
+    instanceUrl: instance && typeof instance.url === "string" ? instance.url : null,
+    openworkUrl: instance && typeof instance.url === "string" ? instance.url : null,
+    workspaceId: null,
+    clientToken: tokens && typeof tokens.client === "string" ? tokens.client : null,
+    ownerToken: tokens && typeof tokens.owner === "string"
+      ? tokens.owner
+      : tokens && typeof tokens.host === "string"
+        ? tokens.host
+        : null,
+    hostToken: tokens && typeof tokens.host === "string" ? tokens.host : null
+  };
+}
+
+export function getWorkerSummary(payload: unknown): WorkerSummary | null {
+  if (!isRecord(payload) || !isRecord(payload.worker)) {
+    return null;
+  }
+
+  const worker = payload.worker;
+  if (typeof worker.id !== "string" || typeof worker.name !== "string") {
+    return null;
+  }
+
+  const instance = isRecord(payload.instance) ? payload.instance : null;
+
+  return {
+    workerId: worker.id,
+    workerName: worker.name,
+    status: getEffectiveWorkerStatus(worker.status, instance),
+    instanceUrl: instance && typeof instance.url === "string" ? instance.url : null,
+    provider: instance && typeof instance.provider === "string" ? instance.provider : null,
+    isMine: worker.isMine === true
+  };
+}
+
+export function getWorkerTokens(payload: unknown): WorkerTokens | null {
+  if (!isRecord(payload) || !isRecord(payload.tokens)) {
+    return null;
+  }
+
+  const tokens = payload.tokens;
+  const connect = isRecord(payload.connect) ? payload.connect : null;
+  const clientToken = typeof tokens.client === "string" ? tokens.client : null;
+  const ownerToken = typeof tokens.owner === "string"
+    ? tokens.owner
+    : typeof tokens.host === "string"
+      ? tokens.host
+      : null;
+  const hostToken = typeof tokens.host === "string" ? tokens.host : null;
+  const openworkUrl = connect && typeof connect.openworkUrl === "string" ? connect.openworkUrl : null;
+  const workspaceId = connect && typeof connect.workspaceId === "string" ? connect.workspaceId : null;
+
+  if (!clientToken && !ownerToken && !hostToken) {
+    return null;
+  }
+
+  return { clientToken, ownerToken, hostToken, openworkUrl, workspaceId };
+}
+
+export function getWorkerRuntimeSnapshot(payload: unknown): WorkerRuntimeSnapshot | null {
+  if (!isRecord(payload) || !Array.isArray(payload.services)) {
+    return null;
+  }
+
+  const services = payload.services
+    .map((value) => {
+      if (!isRecord(value) || typeof value.name !== "string") {
+        return null;
+      }
+
+      return {
+        name: value.name as RuntimeServiceName,
+        enabled: value.enabled === true,
+        running: value.running === true,
+        targetVersion: typeof value.targetVersion === "string" ? value.targetVersion : null,
+        actualVersion: typeof value.actualVersion === "string" ? value.actualVersion : null,
+        upgradeAvailable: value.upgradeAvailable === true
+      };
+    })
+    .filter((item): item is WorkerRuntimeService => item !== null);
+
+  const upgrade = isRecord(payload.upgrade) ? payload.upgrade : null;
+
+  return {
+    services,
+    upgrade: {
+      status:
+        upgrade?.status === "running" || upgrade?.status === "failed" || upgrade?.status === "idle"
+          ? upgrade.status
+          : "idle",
+      startedAt: typeof upgrade?.startedAt === "number" ? new Date(upgrade.startedAt).toISOString() : null,
+      finishedAt: typeof upgrade?.finishedAt === "number" ? new Date(upgrade.finishedAt).toISOString() : null,
+      error: typeof upgrade?.error === "string" ? upgrade.error : null
+    }
+  };
+}
+
+export function getRuntimeServiceLabel(name: RuntimeServiceName): string {
+  switch (name) {
+    case "openwork-server":
+      return "OpenWork server";
+    case "opencode":
+      return "OpenCode";
+    case "opencode-router":
+      return "OpenCode Router";
+  }
+}
+
+function getBillingPrice(value: unknown): BillingPrice | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  return {
+    amount: typeof value.amount === "number" ? value.amount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    recurringInterval: typeof value.recurringInterval === "string" ? value.recurringInterval : null,
+    recurringIntervalCount: typeof value.recurringIntervalCount === "number" ? value.recurringIntervalCount : null
+  };
+}
+
+function getBillingSubscription(value: unknown): BillingSubscription | null {
+  if (!isRecord(value) || typeof value.id !== "string") {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    status: typeof value.status === "string" ? value.status : "unknown",
+    amount: typeof value.amount === "number" ? value.amount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    recurringInterval: typeof value.recurringInterval === "string" ? value.recurringInterval : null,
+    recurringIntervalCount: typeof value.recurringIntervalCount === "number" ? value.recurringIntervalCount : null,
+    currentPeriodStart: typeof value.currentPeriodStart === "string" ? value.currentPeriodStart : null,
+    currentPeriodEnd: typeof value.currentPeriodEnd === "string" ? value.currentPeriodEnd : null,
+    cancelAtPeriodEnd: value.cancelAtPeriodEnd === true,
+    canceledAt: typeof value.canceledAt === "string" ? value.canceledAt : null,
+    endedAt: typeof value.endedAt === "string" ? value.endedAt : null
+  };
+}
+
+function getBillingInvoice(value: unknown): BillingInvoice | null {
+  if (!isRecord(value) || typeof value.id !== "string") {
+    return null;
+  }
+
+  return {
+    id: value.id,
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : null,
+    status: typeof value.status === "string" ? value.status : "unknown",
+    totalAmount: typeof value.totalAmount === "number" ? value.totalAmount : null,
+    currency: typeof value.currency === "string" ? value.currency : null,
+    invoiceNumber: typeof value.invoiceNumber === "string" ? value.invoiceNumber : null,
+    invoiceUrl: typeof value.invoiceUrl === "string" ? value.invoiceUrl : null
+  };
+}
+
+export function getBillingSummary(payload: unknown): BillingSummary | null {
+  if (!isRecord(payload) || !isRecord(payload.billing)) {
+    return null;
+  }
+
+  const billing = payload.billing;
+  const featureGateEnabled = billing.featureGateEnabled;
+  const hasActivePlan = billing.hasActivePlan;
+  const checkoutRequired = billing.checkoutRequired;
+
+  if (
+    typeof featureGateEnabled !== "boolean" ||
+    typeof hasActivePlan !== "boolean" ||
+    typeof checkoutRequired !== "boolean"
+  ) {
+    return null;
+  }
+
+  return {
+    featureGateEnabled,
+    hasActivePlan,
+    checkoutRequired,
+    checkoutUrl: typeof billing.checkoutUrl === "string" ? billing.checkoutUrl : null,
+    portalUrl: typeof billing.portalUrl === "string" ? billing.portalUrl : null,
+    price: getBillingPrice(billing.price),
+    subscription: getBillingSubscription(billing.subscription),
+    invoices: Array.isArray(billing.invoices)
+      ? billing.invoices
+          .map((item) => getBillingInvoice(item))
+          .filter((item): item is BillingInvoice => item !== null)
+      : [],
+    productId: typeof billing.productId === "string" ? billing.productId : null,
+    benefitId: typeof billing.benefitId === "string" ? billing.benefitId : null
+  };
+}
+
+function parseWorkerListItem(value: unknown): WorkerListItem | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const workerId = value.id;
+  const workerName = value.name;
+  if (typeof workerId !== "string" || typeof workerName !== "string") {
+    return null;
+  }
+
+  const instance = isRecord(value.instance) ? value.instance : null;
+  const createdAt = typeof value.createdAt === "string" ? value.createdAt : null;
+
+  return {
+    workerId,
+    workerName,
+    status: getEffectiveWorkerStatus(value.status, instance),
+    instanceUrl: instance && typeof instance.url === "string" ? instance.url : null,
+    provider: instance && typeof instance.provider === "string" ? instance.provider : null,
+    isMine: value.isMine === true,
+    createdAt
+  };
+}
+
+export function getWorkersList(payload: unknown): WorkerListItem[] {
+  if (!isRecord(payload) || !Array.isArray(payload.workers)) {
+    return [];
+  }
+
+  const rows: WorkerListItem[] = [];
+  for (const item of payload.workers) {
+    const parsed = parseWorkerListItem(item);
+    if (parsed) {
+      rows.push(parsed);
+    }
+  }
+
+  return rows;
+}
+
+export function getWorkerStatusMeta(status: string): { label: string; bucket: WorkerStatusBucket } {
+  const normalized = status.trim().toLowerCase();
+
+  if (normalized === "healthy" || normalized === "ready") {
+    return { label: "Ready", bucket: "ready" };
+  }
+
+  if (normalized === "provisioning" || normalized === "starting") {
+    return { label: "Starting", bucket: "starting" };
+  }
+
+  if (normalized === "failed" || normalized === "suspended" || normalized === "stopped") {
+    return { label: "Needs attention", bucket: "attention" };
+  }
+
+  return { label: "Unknown", bucket: "other" };
+}
+
+export function getWorkerStatusCopy(status: string): string {
+  const normalized = status.trim().toLowerCase();
+  switch (normalized) {
+    case "provisioning":
+    case "starting":
+      return "Starting...";
+    case "healthy":
+    case "ready":
+      return "Ready to connect.";
+    case "failed":
+      return "Worker failed to start.";
+    case "suspended":
+    case "stopped":
+      return "Worker is suspended.";
+    default:
+      return "Worker status unknown.";
+  }
+}
+
+function getEffectiveWorkerStatus(workerStatus: unknown, instance: Record<string, unknown> | null): string {
+  const normalizedWorkerStatus = typeof workerStatus === "string" ? workerStatus : "unknown";
+  const normalized = normalizedWorkerStatus.trim().toLowerCase();
+  const instanceStatus = instance && typeof instance.status === "string" ? instance.status.trim().toLowerCase() : null;
+
+  if (!instanceStatus) {
+    return normalizedWorkerStatus;
+  }
+
+  if (normalized === "provisioning" || normalized === "starting") {
+    return instanceStatus;
+  }
+
+  return normalizedWorkerStatus;
+}
+
+export function isWorkerLaunch(value: unknown): value is WorkerLaunch {
+  if (!isRecord(value)) {
+    return false;
+  }
+
+  return (
+    typeof value.workerId === "string" &&
+    typeof value.workerName === "string" &&
+    typeof value.status === "string" &&
+    (typeof value.provider === "string" || value.provider === null) &&
+    (typeof value.instanceUrl === "string" || value.instanceUrl === null) &&
+    (typeof value.openworkUrl === "string" || value.openworkUrl === null || typeof value.openworkUrl === "undefined") &&
+    (typeof value.workspaceId === "string" || value.workspaceId === null || typeof value.workspaceId === "undefined") &&
+    (typeof value.clientToken === "string" || value.clientToken === null) &&
+    (typeof value.ownerToken === "string" || value.ownerToken === null || typeof value.ownerToken === "undefined") &&
+    (typeof value.hostToken === "string" || value.hostToken === null)
+  );
+}
+
+export function listItemToWorker(item: WorkerListItem, current: WorkerLaunch | null = null): WorkerLaunch {
+  return {
+    workerId: item.workerId,
+    workerName: item.workerName,
+    status: item.status,
+    provider: item.provider,
+    instanceUrl: item.instanceUrl,
+    openworkUrl: current?.workerId === item.workerId ? current.openworkUrl ?? item.instanceUrl : item.instanceUrl,
+    workspaceId: current?.workerId === item.workerId ? current.workspaceId : null,
+    clientToken: current?.workerId === item.workerId ? current.clientToken : null,
+    ownerToken: current?.workerId === item.workerId ? current.ownerToken : null,
+    hostToken: current?.workerId === item.workerId ? current.hostToken : null
+  };
+}
+
+function normalizeUrl(value: string): string {
+  return value.trim().replace(/\/+$/, "");
+}
+
+export function parseWorkspaceIdFromUrl(value: string): string | null {
+  const normalized = normalizeUrl(value);
+  if (!normalized) {
+    return null;
+  }
+
+  try {
+    const url = new URL(normalized);
+    const segments = url.pathname.split("/").filter(Boolean);
+    const last = segments[segments.length - 1] ?? "";
+    const prev = segments[segments.length - 2] ?? "";
+    if (prev !== "w" || !last) {
+      return null;
+    }
+    return decodeURIComponent(last);
+  } catch {
+    const match = normalized.match(/\/w\/([^/?#]+)/);
+    if (!match?.[1]) {
+      return null;
+    }
+    try {
+      return decodeURIComponent(match[1]);
+    } catch {
+      return match[1];
+    }
+  }
+}
+
+function buildWorkspaceUrl(instanceUrl: string, workspaceId: string): string {
+  return `${normalizeUrl(instanceUrl)}/w/${encodeURIComponent(workspaceId)}`;
+}
+
+export function buildOpenworkDeepLink(
+  openworkUrl: string | null,
+  accessToken: string | null,
+  workerId: string | null,
+  workerName: string | null
+): string | null {
+  if (!openworkUrl || !accessToken) {
+    return null;
+  }
+
+  const params = new URLSearchParams({
+    openworkHostUrl: openworkUrl,
+    openworkToken: accessToken,
+    source: "openwork-web"
+  });
+
+  if (workerId) {
+    params.set("workerId", workerId);
+  }
+
+  if (workerName) {
+    params.set("workerName", workerName);
+  }
+
+  return `openwork://connect-remote?${params.toString()}`;
+}
+
+export function buildOpenworkAppConnectUrl(
+  appConnectBaseUrl: string,
+  openworkUrl: string | null,
+  accessToken: string | null,
+  workerId: string | null,
+  workerName: string | null,
+  options?: { autoConnect?: boolean }
+): string | null {
+  if (!appConnectBaseUrl || !openworkUrl || !accessToken) {
+    return null;
+  }
+
+  let connectUrl: URL;
+  try {
+    connectUrl = new URL(appConnectBaseUrl);
+  } catch {
+    return null;
+  }
+
+  const normalizedPath = connectUrl.pathname.replace(/\/+$/, "");
+  if (!normalizedPath || normalizedPath === "/") {
+    connectUrl.pathname = "/connect-remote";
+  } else {
+    const pathSegments = normalizedPath.split("/").filter(Boolean);
+    const lastSegment = (pathSegments[pathSegments.length - 1] ?? "").toLowerCase();
+    connectUrl.pathname = lastSegment === "connect-remote" ? normalizedPath : `${normalizedPath}/connect-remote`;
+  }
+
+  connectUrl.searchParams.set("openworkHostUrl", openworkUrl);
+  connectUrl.searchParams.set("openworkToken", accessToken);
+  if (options?.autoConnect) {
+    connectUrl.searchParams.set("autoConnect", "1");
+  }
+  connectUrl.searchParams.set("source", "openwork-web");
+
+  if (workerId) {
+    connectUrl.searchParams.set("workerId", workerId);
+  }
+
+  if (workerName) {
+    connectUrl.searchParams.set("workerName", workerName);
+  }
+
+  return connectUrl.toString();
+}
+
+function parseWorkspaceIdFromWorkspacesPayload(payload: unknown): string | null {
+  if (!isRecord(payload) || !Array.isArray(payload.items)) {
+    return null;
+  }
+
+  const activeId = typeof payload.activeId === "string" ? payload.activeId : null;
+  if (activeId && payload.items.some((item) => isRecord(item) && item.id === activeId)) {
+    return activeId;
+  }
+
+  for (const item of payload.items) {
+    if (isRecord(item) && typeof item.id === "string" && item.id.trim()) {
+      return item.id;
+    }
+  }
+
+  return null;
+}
+
+async function requestAbsoluteJson(url: string, init: RequestInit = {}, timeoutMs = 12000) {
+  const headers = new Headers(init.headers);
+  headers.set("Accept", "application/json");
+
+  const shouldAttachTimeout = !init.signal && timeoutMs > 0;
+  const timeoutController = shouldAttachTimeout ? new AbortController() : null;
+  const timeoutHandle = timeoutController
+    ? setTimeout(() => {
+        timeoutController.abort();
+      }, timeoutMs)
+    : null;
+
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      ...init,
+      headers,
+      credentials: "omit",
+      signal: init.signal ?? timeoutController?.signal
+    });
+  } finally {
+    if (timeoutHandle) {
+      clearTimeout(timeoutHandle);
+    }
+  }
+
+  const text = await response.text();
+  let payload: unknown = null;
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = text;
+    }
+  }
+
+  return { response, payload };
+}
+
+export async function resolveOpenworkWorkspaceUrl(instanceUrl: string, accessToken: string): Promise<{ workspaceId: string; openworkUrl: string } | null> {
+  const baseUrl = normalizeUrl(instanceUrl);
+  const token = accessToken.trim();
+  if (!baseUrl || !token) {
+    return null;
+  }
+
+  const mountedWorkspaceId = parseWorkspaceIdFromUrl(baseUrl);
+  if (mountedWorkspaceId) {
+    return {
+      workspaceId: mountedWorkspaceId,
+      openworkUrl: baseUrl
+    };
+  }
+
+  const { response, payload } = await requestAbsoluteJson(`${baseUrl}/workspaces`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`
+    }
+  });
+
+  if (!response.ok) {
+    return null;
+  }
+
+  const workspaceId = parseWorkspaceIdFromWorkspacesPayload(payload);
+  if (!workspaceId) {
+    return null;
+  }
+
+  return {
+    workspaceId,
+    openworkUrl: buildWorkspaceUrl(baseUrl, workspaceId)
+  };
+}
+
+export async function requestJson(path: string, init: RequestInit = {}, timeoutMs = 30000) {
+  const headers = new Headers(init.headers);
+  headers.set("Accept", "application/json");
+
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
+  }
+
+  const shouldAttachTimeout = !init.signal && timeoutMs > 0;
+  const timeoutController = shouldAttachTimeout ? new AbortController() : null;
+  const timeoutHandle = timeoutController
+    ? setTimeout(() => {
+        timeoutController.abort();
+      }, timeoutMs)
+    : null;
+
+  let response: Response;
+  try {
+    const endpoint = path.startsWith("/api/") ? path : `/api/den${path}`;
+    response = await fetch(endpoint, {
+      ...init,
+      headers,
+      credentials: "include",
+      signal: init.signal ?? timeoutController?.signal
+    });
+  } finally {
+    if (timeoutHandle) {
+      clearTimeout(timeoutHandle);
+    }
+  }
+
+  const text = await response.text();
+  let payload: unknown = null;
+
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = text;
+    }
+  }
+
+  return { response, payload, text };
+}
diff --git a/ee/apps/den-web/app/(den)/_lib/den-org.ts b/ee/apps/den-web/app/(den)/_lib/den-org.ts
new file mode 100644
index 0000000000..7962125c9b
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/den-org.ts
@@ -0,0 +1,710 @@
+import { normalizeDesktopAppRestrictions, type DesktopAppRestrictions } from "@openwork/types/den/desktop-app-restrictions";
+
+export type DenDesktopAppRestrictions = DesktopAppRestrictions;
+
+export type DenOrgSummary = {
+  id: string;
+  name: string;
+  slug: string;
+  logo: string | null;
+  metadata: string | null;
+  role: string;
+  orgMemberId: string;
+  membershipId: string;
+  createdAt: string | null;
+  updatedAt: string | null;
+  isActive: boolean;
+};
+
+export type DenOrgMember = {
+  id: string;
+  userId: string;
+  role: string;
+  createdAt: string | null;
+  isOwner: boolean;
+  user: {
+    id: string;
+    email: string;
+    name: string;
+    image: string | null;
+  };
+};
+
+export type DenOrgInvitation = {
+  id: string;
+  email: string;
+  role: string;
+  status: string;
+  expiresAt: string | null;
+  createdAt: string | null;
+};
+
+export type DenOrgTeam = {
+  id: string;
+  name: string;
+  createdAt: string | null;
+  updatedAt: string | null;
+  memberIds: string[];
+};
+
+export type DenCurrentMemberTeam = {
+  id: string;
+  name: string;
+  organizationId: string;
+  createdAt: string | null;
+  updatedAt: string | null;
+};
+
+export type DenInvitationPreview = {
+  invitation: {
+    id: string;
+    email: string;
+    role: string;
+    status: string;
+    expiresAt: string | null;
+    createdAt: string | null;
+  };
+  organization: {
+    id: string;
+    name: string;
+    slug: string;
+    allowedEmailDomains: string[] | null;
+  };
+};
+
+export type DenOrgRole = {
+  id: string;
+  role: string;
+  permission: Record<string, string[]>;
+  builtIn: boolean;
+  protected: boolean;
+  createdAt: string | null;
+  updatedAt: string | null;
+};
+
+export type DenOrgApiKey = {
+  id: string;
+  configId: string;
+  name: string | null;
+  start: string | null;
+  prefix: string | null;
+  enabled: boolean;
+  rateLimitEnabled: boolean;
+  rateLimitMax: number | null;
+  rateLimitTimeWindow: number | null;
+  lastRequest: string | null;
+  expiresAt: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+  owner: {
+    userId: string;
+    memberId: string;
+    name: string;
+    email: string;
+    image: string | null;
+  };
+};
+
+export type DenOrgContext = {
+  organization: {
+    id: string;
+    name: string;
+    slug: string;
+    logo: string | null;
+    allowedEmailDomains: string[] | null;
+    desktopAppRestrictions: DenDesktopAppRestrictions;
+    metadata: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    owner: {
+      memberId: string;
+      userId: string;
+      name: string | null;
+      email: string | null;
+      image: string | null;
+    } | null;
+  };
+  currentMember: {
+    id: string;
+    userId: string;
+    role: string;
+    createdAt: string | null;
+    isOwner: boolean;
+  };
+  members: DenOrgMember[];
+  invitations: DenOrgInvitation[];
+  roles: DenOrgRole[];
+  teams: DenOrgTeam[];
+  currentMemberTeams: DenCurrentMemberTeam[];
+};
+
+export type DenOrganizationMetadata = {
+  allowedDesktopVersions?: string[];
+} & Record<string, unknown>;
+
+export const DEN_ROLE_PERMISSION_OPTIONS = {
+  organization: ["update", "delete"],
+  member: ["create", "update", "delete"],
+  invitation: ["create", "cancel"],
+  team: ["create", "update", "delete"],
+  ac: ["create", "read", "update", "delete"],
+} as const;
+
+export const PENDING_ORG_INVITATION_STORAGE_KEY = "openwork:web:pending-org-invitation";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asIsoString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asBoolean(value: unknown): boolean {
+  return value === true;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asStringArray(value: unknown): string[] | null {
+  if (!Array.isArray(value)) {
+    return null;
+  }
+
+  return value.filter((entry): entry is string => typeof entry === "string");
+}
+
+function normalizeDesktopVersionString(value: string): string | null {
+  const normalized = value.trim().replace(/^v/i, "");
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(normalized)
+    ? normalized
+    : null;
+}
+
+export function parseOrganizationMetadata(metadata: string | null): DenOrganizationMetadata | null {
+  if (!metadata) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(metadata) as unknown;
+    return isRecord(parsed) ? (parsed as DenOrganizationMetadata) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function getAllowedDesktopVersionsFromMetadata(metadata: string | null): string[] | null {
+  const parsed = parseOrganizationMetadata(metadata);
+  const values = asStringArray(parsed?.allowedDesktopVersions);
+
+  if (!values) {
+    return null;
+  }
+
+  return [...new Set(values.map((entry) => normalizeDesktopVersionString(entry)).filter((entry): entry is string => Boolean(entry)))];
+}
+
+function asDesktopAppRestrictions(value: unknown): DenDesktopAppRestrictions {
+  return normalizeDesktopAppRestrictions(value);
+}
+
+function parsePermissionRecord(value: unknown): Record<string, string[]> {
+  if (!isRecord(value)) {
+    return {};
+  }
+
+  return Object.fromEntries(
+    Object.entries(value)
+      .filter((entry): entry is [string, unknown[]] => Array.isArray(entry[1]))
+      .map(([resource, actions]) => [
+        resource,
+        actions.filter((entry: unknown): entry is string => typeof entry === "string"),
+      ])
+  );
+}
+
+export function splitRoleString(value: string): string[] {
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+export function getOrgAccessFlags(roleValue: string, isOwner: boolean) {
+  const roles = new Set(splitRoleString(roleValue));
+  const isAdmin = isOwner || roles.has("admin");
+
+  return {
+    isOwner,
+    isAdmin,
+    canInviteMembers: isAdmin,
+    canCancelInvitations: isAdmin,
+    canManageMembers: isOwner,
+    canManageRoles: isOwner,
+    canManageTeams: isAdmin,
+    canManageApiKeys: isAdmin,
+  };
+}
+
+export function formatRoleLabel(role: string): string {
+  return role
+    .split(/[-_\s]+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+export function getOrgDashboardRoute(_orgSlug?: string | null): string {
+  return "/dashboard";
+}
+
+export function getJoinOrgRoute(invitationId: string): string {
+  return `/join-org?invite=${encodeURIComponent(invitationId)}`;
+}
+
+export function getManageMembersRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/manage-members`;
+}
+
+export function getMembersRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/members`;
+}
+
+export function getBackgroundAgentsRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/background-agents`;
+}
+
+export function getCustomLlmProvidersRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/custom-llm-providers`;
+}
+
+export function getLlmProvidersRoute(orgSlug?: string | null): string {
+  return getCustomLlmProvidersRoute(orgSlug);
+}
+
+export function getLlmProviderRoute(orgSlug: string | null | undefined, llmProviderId: string): string {
+  return `${getLlmProvidersRoute(orgSlug)}/${encodeURIComponent(llmProviderId)}`;
+}
+
+export function getEditLlmProviderRoute(orgSlug: string | null | undefined, llmProviderId: string): string {
+  return `${getLlmProviderRoute(orgSlug, llmProviderId)}/edit`;
+}
+
+export function getNewLlmProviderRoute(orgSlug?: string | null): string {
+  return `${getLlmProvidersRoute(orgSlug)}/new`;
+}
+
+export function getBillingRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/billing`;
+}
+
+export function getOrgSettingsRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/org-settings`;
+}
+
+export function getApiKeysRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/api-keys`;
+}
+
+export function getSkillHubsRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/skill-hubs`;
+}
+
+export function getSkillHubRoute(orgSlug: string | null | undefined, skillHubId: string): string {
+  return `${getSkillHubsRoute(orgSlug)}/${encodeURIComponent(skillHubId)}`;
+}
+
+export function getEditSkillHubRoute(orgSlug: string | null | undefined, skillHubId: string): string {
+  return `${getSkillHubRoute(orgSlug, skillHubId)}/edit`;
+}
+
+export function getNewSkillHubRoute(orgSlug?: string | null): string {
+  return `${getSkillHubsRoute(orgSlug)}/new`;
+}
+
+export function getSkillDetailRoute(orgSlug: string | null | undefined, skillId: string): string {
+  return `${getSkillHubsRoute(orgSlug)}/skills/${encodeURIComponent(skillId)}`;
+}
+
+export function getEditSkillRoute(orgSlug: string | null | undefined, skillId: string): string {
+  return `${getSkillDetailRoute(orgSlug, skillId)}/edit`;
+}
+
+export function getNewSkillRoute(orgSlug?: string | null): string {
+  return `${getSkillHubsRoute(orgSlug)}/skills/new`;
+}
+
+export function getPluginsRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/plugins`;
+}
+
+export function getPluginRoute(orgSlug: string | null | undefined, pluginId: string): string {
+  return `${getPluginsRoute(orgSlug)}/${encodeURIComponent(pluginId)}`;
+}
+
+export function getMarketplacesRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/marketplaces`;
+}
+
+export function getMarketplaceRoute(orgSlug: string | null | undefined, marketplaceId: string): string {
+  return `${getMarketplacesRoute(orgSlug)}/${encodeURIComponent(marketplaceId)}`;
+}
+
+export function getIntegrationsRoute(orgSlug?: string | null): string {
+  return `${getOrgDashboardRoute(orgSlug)}/integrations`;
+}
+
+export function getGithubIntegrationRoute(orgSlug?: string | null): string {
+  return `${getIntegrationsRoute(orgSlug)}/github`;
+}
+
+export function getGithubIntegrationSetupRoute(orgSlug: string | null | undefined, connectorInstanceId: string): string {
+  return `${getGithubIntegrationRoute(orgSlug)}?connectorInstanceId=${encodeURIComponent(connectorInstanceId)}`;
+}
+
+export function getGithubIntegrationAccountRoute(orgSlug: string | null | undefined, connectorAccountId: string): string {
+  return `${getGithubIntegrationRoute(orgSlug)}?connectorAccountId=${encodeURIComponent(connectorAccountId)}`;
+}
+
+export function parseOrgListPayload(payload: unknown): {
+  orgs: DenOrgSummary[];
+  activeOrgId: string | null;
+  activeOrgSlug: string | null;
+} {
+  if (!isRecord(payload) || !Array.isArray(payload.orgs)) {
+    return { orgs: [], activeOrgId: null, activeOrgSlug: null };
+  }
+
+  const orgs = payload.orgs
+    .map((entry) => {
+      if (!isRecord(entry)) {
+        return null;
+      }
+
+      const id = asString(entry.id);
+      const name = asString(entry.name);
+      const slug = asString(entry.slug);
+      const role = asString(entry.role);
+      const orgMemberId = asString(entry.orgMemberId);
+      const membershipId = asString(entry.membershipId);
+      if (!id || !name || !slug || !role || !orgMemberId || !membershipId) {
+        return null;
+      }
+
+      return {
+        id,
+        name,
+        slug,
+        logo: asString(entry.logo),
+        metadata: asString(entry.metadata),
+        role,
+        orgMemberId,
+        membershipId,
+        createdAt: asIsoString(entry.createdAt),
+        updatedAt: asIsoString(entry.updatedAt),
+        isActive: asBoolean(entry.isActive),
+      } satisfies DenOrgSummary;
+    })
+    .filter((entry): entry is DenOrgSummary => entry !== null);
+
+  return {
+    orgs,
+    activeOrgId: asString(payload.activeOrgId),
+    activeOrgSlug: asString(payload.activeOrgSlug),
+  };
+}
+
+export function parseOrgContextPayload(payload: unknown): DenOrgContext | null {
+  if (!isRecord(payload) || !isRecord(payload.organization) || !isRecord(payload.currentMember)) {
+    return null;
+  }
+
+  const organization = payload.organization;
+  const currentMember = payload.currentMember;
+  const organizationId = asString(organization.id);
+  const organizationName = asString(organization.name);
+  const organizationSlug = asString(organization.slug);
+  const organizationOwner = isRecord(organization.owner) ? organization.owner : null;
+  const organizationOwnerMemberId = organizationOwner ? asString(organizationOwner.memberId) : null;
+  const organizationOwnerUserId = organizationOwner ? asString(organizationOwner.userId) : null;
+  const currentMemberId = asString(currentMember.id);
+  const currentMemberUserId = asString(currentMember.userId);
+  const currentMemberRole = asString(currentMember.role);
+
+  if (!organizationId || !organizationName || !organizationSlug || !currentMemberId || !currentMemberUserId || !currentMemberRole) {
+    return null;
+  }
+
+  const members = Array.isArray(payload.members)
+    ? payload.members
+        .map((entry) => {
+          if (!isRecord(entry) || !isRecord(entry.user)) {
+            return null;
+          }
+
+          const id = asString(entry.id);
+          const userId = asString(entry.userId);
+          const role = asString(entry.role);
+          const user = entry.user;
+          const userEmail = asString(user.email);
+          const userName = asString(user.name);
+          const userIdentity = asString(user.id);
+          if (!id || !userId || !role || !userEmail || !userName || !userIdentity) {
+            return null;
+          }
+
+          return {
+            id,
+            userId,
+            role,
+            createdAt: asIsoString(entry.createdAt),
+            isOwner: asBoolean(entry.isOwner),
+            user: {
+              id: userIdentity,
+              email: userEmail,
+              name: userName,
+              image: asString(user.image),
+            },
+          } satisfies DenOrgMember;
+        })
+        .filter((entry): entry is DenOrgMember => entry !== null)
+    : [];
+
+  const invitations = Array.isArray(payload.invitations)
+    ? payload.invitations
+        .map((entry) => {
+          if (!isRecord(entry)) {
+            return null;
+          }
+
+          const id = asString(entry.id);
+          const email = asString(entry.email);
+          const role = asString(entry.role);
+          const status = asString(entry.status);
+          if (!id || !email || !role || !status) {
+            return null;
+          }
+
+          return {
+            id,
+            email,
+            role,
+            status,
+            expiresAt: asIsoString(entry.expiresAt),
+            createdAt: asIsoString(entry.createdAt),
+          } satisfies DenOrgInvitation;
+        })
+        .filter((entry): entry is DenOrgInvitation => entry !== null)
+    : [];
+
+  const roles = Array.isArray(payload.roles)
+    ? payload.roles
+        .map((entry) => {
+          if (!isRecord(entry)) {
+            return null;
+          }
+
+          const id = asString(entry.id);
+          const role = asString(entry.role);
+          if (!id || !role) {
+            return null;
+          }
+
+          return {
+            id,
+            role,
+            permission: parsePermissionRecord(entry.permission),
+            builtIn: asBoolean(entry.builtIn),
+            protected: asBoolean(entry.protected),
+            createdAt: asIsoString(entry.createdAt),
+            updatedAt: asIsoString(entry.updatedAt),
+          } satisfies DenOrgRole;
+        })
+        .filter((entry): entry is DenOrgRole => entry !== null)
+    : [];
+
+  const teams = Array.isArray(payload.teams)
+    ? payload.teams
+        .map((entry) => {
+          if (!isRecord(entry) || typeof entry.id !== "string" || typeof entry.name !== "string") {
+            return null;
+          }
+
+          const memberIds = Array.isArray(entry.memberIds)
+            ? entry.memberIds.filter((value): value is string => typeof value === "string")
+            : [];
+
+          return {
+            id: entry.id,
+            name: entry.name,
+            createdAt: asIsoString(entry.createdAt),
+            updatedAt: asIsoString(entry.updatedAt),
+            memberIds,
+          } satisfies DenOrgTeam;
+        })
+        .filter((entry): entry is DenOrgTeam => entry !== null)
+    : [];
+
+  const currentMemberTeams = Array.isArray(payload.currentMemberTeams)
+    ? payload.currentMemberTeams
+        .map((entry) => {
+          if (!isRecord(entry)) {
+            return null;
+          }
+
+          const id = asString(entry.id);
+          const name = asString(entry.name);
+          const organizationId = asString(entry.organizationId);
+          if (!id || !name || !organizationId) {
+            return null;
+          }
+
+          return {
+            id,
+            name,
+            organizationId,
+            createdAt: asIsoString(entry.createdAt),
+            updatedAt: asIsoString(entry.updatedAt),
+          } satisfies DenCurrentMemberTeam;
+        })
+        .filter((entry): entry is DenCurrentMemberTeam => entry !== null)
+    : [];
+
+  return {
+    organization: {
+      id: organizationId,
+      name: organizationName,
+      slug: organizationSlug,
+      logo: asString(organization.logo),
+      allowedEmailDomains: asStringArray(organization.allowedEmailDomains),
+      desktopAppRestrictions: asDesktopAppRestrictions(organization.desktopAppRestrictions),
+      metadata: asString(organization.metadata),
+      createdAt: asIsoString(organization.createdAt),
+      updatedAt: asIsoString(organization.updatedAt),
+      owner: organizationOwner && organizationOwnerMemberId && organizationOwnerUserId
+        ? {
+          memberId: organizationOwnerMemberId,
+          userId: organizationOwnerUserId,
+          name: asString(organizationOwner.name),
+          email: asString(organizationOwner.email),
+          image: asString(organizationOwner.image),
+        }
+        : null,
+    },
+    currentMember: {
+      id: currentMemberId,
+      userId: currentMemberUserId,
+      role: currentMemberRole,
+      createdAt: asIsoString(currentMember.createdAt),
+      isOwner: asBoolean(currentMember.isOwner),
+    },
+    members,
+    invitations,
+    roles,
+    teams,
+    currentMemberTeams,
+  };
+}
+
+export function parseInvitationPreviewPayload(payload: unknown): DenInvitationPreview | null {
+  if (!isRecord(payload) || !isRecord(payload.invitation) || !isRecord(payload.organization)) {
+    return null;
+  }
+
+  const invitation = payload.invitation;
+  const organization = payload.organization;
+  const invitationId = asString(invitation.id);
+  const invitationEmail = asString(invitation.email);
+  const invitationRole = asString(invitation.role);
+  const invitationStatus = asString(invitation.status);
+  const organizationId = asString(organization.id);
+  const organizationName = asString(organization.name);
+  const organizationSlug = asString(organization.slug);
+
+  if (!invitationId || !invitationEmail || !invitationRole || !invitationStatus || !organizationId || !organizationName || !organizationSlug) {
+    return null;
+  }
+
+  return {
+    invitation: {
+      id: invitationId,
+      email: invitationEmail,
+      role: invitationRole,
+      status: invitationStatus,
+      expiresAt: asIsoString(invitation.expiresAt),
+      createdAt: asIsoString(invitation.createdAt),
+    },
+    organization: {
+      id: organizationId,
+      name: organizationName,
+      slug: organizationSlug,
+      allowedEmailDomains: asStringArray(organization.allowedEmailDomains),
+    },
+  };
+}
+
+export function isEmailAllowedForOrganization(allowedEmailDomains: readonly string[] | null | undefined, email: string): boolean {
+  if (!allowedEmailDomains || allowedEmailDomains.length === 0) {
+    return true;
+  }
+
+  const normalized = email.trim().toLowerCase();
+  const atIndex = normalized.lastIndexOf("@");
+  if (atIndex === -1 || atIndex + 1 >= normalized.length) {
+    return false;
+  }
+
+  return allowedEmailDomains.includes(normalized.slice(atIndex + 1));
+}
+
+export function parseOrgApiKeysPayload(payload: unknown): DenOrgApiKey[] {
+  if (!isRecord(payload) || !Array.isArray(payload.apiKeys)) {
+    return [];
+  }
+
+  return payload.apiKeys
+    .map((entry) => {
+      if (!isRecord(entry) || !isRecord(entry.owner)) {
+        return null;
+      }
+
+      const id = asString(entry.id);
+      const configId = asString(entry.configId);
+      const owner = entry.owner;
+      const ownerUserId = asString(owner.userId);
+      const ownerMemberId = asString(owner.memberId);
+      const ownerName = asString(owner.name);
+      const ownerEmail = asString(owner.email);
+
+      if (!id || !configId || !ownerUserId || !ownerMemberId || !ownerName || !ownerEmail) {
+        return null;
+      }
+
+      return {
+        id,
+        configId,
+        name: asString(entry.name),
+        start: asString(entry.start),
+        prefix: asString(entry.prefix),
+        enabled: asBoolean(entry.enabled),
+        rateLimitEnabled: asBoolean(entry.rateLimitEnabled),
+        rateLimitMax: typeof entry.rateLimitMax === "number" ? entry.rateLimitMax : null,
+        rateLimitTimeWindow: typeof entry.rateLimitTimeWindow === "number" ? entry.rateLimitTimeWindow : null,
+        lastRequest: asIsoString(entry.lastRequest),
+        expiresAt: asIsoString(entry.expiresAt),
+        createdAt: asIsoString(entry.createdAt),
+        updatedAt: asIsoString(entry.updatedAt),
+        owner: {
+          userId: ownerUserId,
+          memberId: ownerMemberId,
+          name: ownerName,
+          email: ownerEmail,
+          image: asString(owner.image),
+        },
+      } satisfies DenOrgApiKey;
+    })
+    .filter((entry): entry is DenOrgApiKey => entry !== null);
+}
diff --git a/ee/apps/den-web/app/(den)/_lib/feedback.ts b/ee/apps/den-web/app/(den)/_lib/feedback.ts
new file mode 100644
index 0000000000..6b16cbc87c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/feedback.ts
@@ -0,0 +1,22 @@
+export const OPENWORK_FEEDBACK_URL = "https://openworklabs.com/feedback";
+
+export function buildDenFeedbackUrl(options?: {
+  pathname?: string;
+  orgSlug?: string | null;
+  topic?: string;
+}) {
+  const url = new URL(OPENWORK_FEEDBACK_URL);
+  url.searchParams.set("source", "openwork-web-app");
+  url.searchParams.set("deployment", "web");
+  url.searchParams.set("entrypoint", options?.pathname ?? "dashboard");
+
+  if (options?.orgSlug) {
+    url.searchParams.set("org", options.orgSlug);
+  }
+
+  if (options?.topic) {
+    url.searchParams.set("topic", options.topic);
+  }
+
+  return url.toString();
+}
diff --git a/ee/apps/den-web/app/(den)/_lib/mcp-oauth-route.ts b/ee/apps/den-web/app/(den)/_lib/mcp-oauth-route.ts
new file mode 100644
index 0000000000..65425babfb
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_lib/mcp-oauth-route.ts
@@ -0,0 +1,12 @@
+export function getMcpOAuthSelectOrganizationRoute(search: string) {
+  const normalizedSearch = search.startsWith("?") ? search.slice(1) : search;
+  if (!normalizedSearch) return null;
+
+  const params = new URLSearchParams(normalizedSearch);
+  const scopes = new Set((params.get("scope") ?? "").split(/\s+/).filter(Boolean));
+  if (params.get("response_type") !== "code" || !params.get("client_id") || (!scopes.has("mcp:read") && !scopes.has("mcp:write"))) {
+    return null;
+  }
+
+  return `/mcp/select-organization?${normalizedSearch}`;
+}
diff --git a/ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx b/ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx
new file mode 100644
index 0000000000..f19e202cd5
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/_providers/den-flow-provider.tsx
@@ -0,0 +1,2121 @@
+"use client";
+
+import { createContext, createElement, useContext, useEffect, useRef, useState, type FormEvent, type ReactNode } from "react";
+import {
+  AUTH_TOKEN_STORAGE_KEY,
+  DEFAULT_AUTH_NAME,
+  DEFAULT_WORKER_NAME,
+  LAST_WORKER_STORAGE_KEY,
+  ONBOARDING_INTENT_STORAGE_KEY,
+  OPENWORK_APP_CONNECT_BASE_URL,
+  PENDING_SOCIAL_SIGNUP_STORAGE_KEY,
+  WORKER_STATUS_POLL_MS,
+  type AuthMethod,
+  type AuthMode,
+  type AuthUser,
+  type BillingSummary,
+  type LaunchEvent,
+  type OnboardingIntent,
+  type OrgLimitError,
+  type RuntimeServiceName,
+  type SocialAuthProvider,
+  type WorkerLaunch,
+  type WorkerListItem,
+  type WorkerRuntimeSnapshot,
+  type WorkerSummary,
+  type WorkerStatusBucket,
+  buildOpenworkAppConnectUrl,
+  buildOpenworkDeepLink,
+  deriveOnboardingWorkerName,
+  getAuthInfoForMode,
+  getBillingSummary,
+  getCheckoutUrl,
+  getEmailDomain,
+  getErrorMessage,
+  getOrgLimitError,
+  getRuntimeServiceLabel,
+  getSocialCallbackUrl,
+  getSocialProviderLabel,
+  getToken,
+  getUser,
+  getWorker,
+  getWorkerRuntimeSnapshot,
+  getWorkerStatusCopy,
+  getWorkerStatusMeta,
+  getWorkerSummary,
+  getWorkerTokens,
+  getWorkersList,
+  identifyPosthogUser,
+  isWorkerLaunch,
+  listItemToWorker,
+  normalizeAuthModeParam,
+  parseWorkspaceIdFromUrl,
+  requestJson,
+  resetPosthogUser,
+  resolveOpenworkWorkspaceUrl,
+  trackPosthogEvent
+} from "../_lib/den-flow";
+import {
+  PENDING_ORG_INVITATION_STORAGE_KEY,
+  getJoinOrgRoute,
+  getOrgDashboardRoute,
+  parseOrgListPayload,
+} from "../_lib/den-org";
+
+type LaunchWorkerResult = "success" | "checkout" | "limit" | "error";
+type AuthNavigationResult = "dashboard" | "checkout" | "join-org" | null;
+
+type DenFlowContextValue = {
+  authMode: AuthMode;
+  setAuthMode: (mode: AuthMode) => void;
+  email: string;
+  setEmail: (value: string) => void;
+  password: string;
+  setPassword: (value: string) => void;
+  verificationCode: string;
+  setVerificationCode: (value: string) => void;
+  verificationRequired: boolean;
+  authBusy: boolean;
+  authInfo: string;
+  authError: string | null;
+  user: AuthUser | null;
+  sessionHydrated: boolean;
+  desktopAuthRequested: boolean;
+  desktopAuthScheme: string;
+  desktopRedirectUrl: string | null;
+  desktopRedirectBusy: boolean;
+  showAuthFeedback: boolean;
+  submitAuth: (event: FormEvent<HTMLFormElement>) => Promise<AuthNavigationResult>;
+  submitVerificationCode: (event: FormEvent<HTMLFormElement>) => Promise<AuthNavigationResult>;
+  resendVerificationCode: () => Promise<void>;
+  cancelVerification: () => void;
+  beginSocialAuth: (provider: SocialAuthProvider) => Promise<void>;
+  signOut: () => Promise<void>;
+  resolveUserLandingRoute: () => Promise<string | null>;
+  billingSummary: BillingSummary | null;
+  billingBusy: boolean;
+  billingCheckoutBusy: boolean;
+  billingSubscriptionBusy: boolean;
+  billingError: string | null;
+  effectiveCheckoutUrl: string | null;
+  orgLimitError: OrgLimitError | null;
+  clearOrgLimitError: () => void;
+  refreshBilling: (options?: { includeCheckout?: boolean; quiet?: boolean }) => Promise<BillingSummary | null>;
+  handleSubscriptionCancellation: (cancelAtPeriodEnd: boolean) => Promise<void>;
+  refreshCheckoutReturn: (sessionTokenPresent: boolean) => Promise<string>;
+  onboardingPending: boolean;
+  onboardingDecisionBusy: boolean;
+  workers: WorkerListItem[];
+  filteredWorkers: WorkerListItem[];
+  workersBusy: boolean;
+  workersLoadedOnce: boolean;
+  workersError: string | null;
+  workerQuery: string;
+  setWorkerQuery: (value: string) => void;
+  workerStatusFilter: WorkerStatusBucket | "all";
+  setWorkerStatusFilter: (value: WorkerStatusBucket | "all") => void;
+  selectedWorker: WorkerListItem | null;
+  activeWorker: WorkerLaunch | null;
+  selectWorker: (item: WorkerListItem) => void;
+  workerName: string;
+  setWorkerName: (value: string) => void;
+  launchBusy: boolean;
+  launchStatus: string;
+  launchError: string | null;
+  actionBusy: "status" | "token" | null;
+  deleteBusyWorkerId: string | null;
+  redeployBusyWorkerId: string | null;
+  renameBusyWorkerId: string | null;
+  runtimeSnapshot: WorkerRuntimeSnapshot | null;
+  runtimeBusy: boolean;
+  runtimeError: string | null;
+  runtimeUpgradeBusy: boolean;
+  copiedField: string | null;
+  events: LaunchEvent[];
+  openworkDeepLink: string | null;
+  openworkAppConnectUrl: string | null;
+  hasWorkspaceScopedUrl: boolean;
+  additionalWorkerNeedsPlan: boolean;
+  selectedStatusMeta: { label: string; bucket: WorkerStatusBucket };
+  isSelectedWorkerFailed: boolean;
+  ownedWorkerCount: number;
+  refreshWorkers: (options?: { keepSelection?: boolean; quiet?: boolean }) => Promise<void>;
+  launchWorker: (options?: { source?: "manual" | "signup_auto"; workerNameOverride?: string }) => Promise<LaunchWorkerResult>;
+  checkWorkerStatus: (options?: { workerId?: string; quiet?: boolean; background?: boolean }) => Promise<void>;
+  generateWorkerToken: () => Promise<void>;
+  renameWorker: (workerId: string, name: string) => Promise<boolean>;
+  deleteWorker: (workerId: string) => Promise<void>;
+  redeployWorker: (workerId: string) => Promise<void>;
+  refreshRuntime: (workerId?: string, options?: { quiet?: boolean }) => Promise<WorkerRuntimeSnapshot | null>;
+  upgradeRuntime: () => Promise<void>;
+  copyToClipboard: (field: string, value: string | null) => Promise<void>;
+  getRuntimeServiceLabel: (name: RuntimeServiceName) => string;
+};
+
+const DenFlowContext = createContext<DenFlowContextValue | null>(null);
+
+function getPendingOrgInvitationId() {
+  if (typeof window === "undefined") {
+    return null;
+  }
+
+  const invitationId = window.sessionStorage.getItem(PENDING_ORG_INVITATION_STORAGE_KEY)?.trim() ?? "";
+  return invitationId || null;
+}
+
+export function DenFlowProvider({ children }: { children: ReactNode }) {
+  const [authMode, setAuthModeState] = useState<AuthMode>("sign-up");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [verificationCode, setVerificationCode] = useState("");
+  const [verificationRequired, setVerificationRequired] = useState(false);
+  const [authBusy, setAuthBusy] = useState(false);
+  const [authInfo, setAuthInfo] = useState(getAuthInfoForMode("sign-up"));
+  const [authError, setAuthError] = useState<string | null>(null);
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [authToken, setAuthToken] = useState<string | null>(() => {
+    if (typeof window === "undefined") {
+      return null;
+    }
+
+    const token = window.localStorage.getItem(AUTH_TOKEN_STORAGE_KEY);
+    if (!token || token.trim().length === 0) {
+      return null;
+    }
+
+    return token;
+  });
+  const [sessionHydrated, setSessionHydrated] = useState(false);
+  const [desktopAuthRequested, setDesktopAuthRequested] = useState(false);
+  const [desktopAuthScheme, setDesktopAuthScheme] = useState("openwork");
+  const [desktopRedirectBusy, setDesktopRedirectBusy] = useState(false);
+  const [desktopRedirectUrl, setDesktopRedirectUrl] = useState<string | null>(null);
+  const [desktopRedirectAttempted, setDesktopRedirectAttempted] = useState(false);
+  const [billingSummary, setBillingSummary] = useState<BillingSummary | null>(null);
+  const [checkoutUrl, setCheckoutUrl] = useState<string | null>(null);
+  const [billingBusy, setBillingBusy] = useState(false);
+  const [billingCheckoutBusy, setBillingCheckoutBusy] = useState(false);
+  const [billingSubscriptionBusy, setBillingSubscriptionBusy] = useState(false);
+  const [billingError, setBillingError] = useState<string | null>(null);
+  const [billingLoadedOnce, setBillingLoadedOnce] = useState(false);
+  const [orgLimitError, setOrgLimitError] = useState<OrgLimitError | null>(null);
+
+  const [workerName, setWorkerName] = useState(DEFAULT_WORKER_NAME);
+  const [worker, setWorker] = useState<WorkerLaunch | null>(null);
+  const [workerLookupId, setWorkerLookupId] = useState("");
+  const [workers, setWorkers] = useState<WorkerListItem[]>([]);
+  const [workersBusy, setWorkersBusy] = useState(false);
+  const [workersLoadedOnce, setWorkersLoadedOnce] = useState(false);
+  const [workersError, setWorkersError] = useState<string | null>(null);
+  const [workerQuery, setWorkerQuery] = useState("");
+  const [workerStatusFilter, setWorkerStatusFilter] = useState<WorkerStatusBucket | "all">("all");
+  const [launchBusy, setLaunchBusy] = useState(false);
+  const [actionBusy, setActionBusy] = useState<"status" | "token" | null>(null);
+  const [launchStatus, setLaunchStatus] = useState("Choose a worker name and launch.");
+  const [launchError, setLaunchError] = useState<string | null>(null);
+  const [events, setEvents] = useState<LaunchEvent[]>([]);
+  const [copiedField, setCopiedField] = useState<string | null>(null);
+  const [tokenFetchedForWorkerId, setTokenFetchedForWorkerId] = useState<string | null>(null);
+  const [deleteBusyWorkerId, setDeleteBusyWorkerId] = useState<string | null>(null);
+  const [redeployBusyWorkerId, setRedeployBusyWorkerId] = useState<string | null>(null);
+  const [renameBusyWorkerId, setRenameBusyWorkerId] = useState<string | null>(null);
+  const [pendingRestoredWorkerId, setPendingRestoredWorkerId] = useState<string | null>(null);
+  const [runtimeSnapshot, setRuntimeSnapshot] = useState<WorkerRuntimeSnapshot | null>(null);
+  const [runtimeBusy, setRuntimeBusy] = useState(false);
+  const [runtimeError, setRuntimeError] = useState<string | null>(null);
+  const [runtimeUpgradeBusy, setRuntimeUpgradeBusy] = useState(false);
+
+  const [onboardingIntent, setOnboardingIntent] = useState<OnboardingIntent | null>(null);
+  const onboardingAutoLaunchKeyRef = useRef<string | null>(null);
+  const socialSignupHandledRef = useRef<string | null>(null);
+  const pendingWorkersRequestRef = useRef<Promise<{ response: Response; payload: unknown }> | null>(null);
+
+  const selectedWorker = workers.find((item) => item.workerId === workerLookupId) ?? null;
+  const activeWorker =
+    worker && workerLookupId === worker.workerId
+      ? worker
+      : selectedWorker
+        ? listItemToWorker(selectedWorker, worker)
+        : worker;
+  const openworkConnectUrl = activeWorker?.openworkUrl ?? activeWorker?.instanceUrl ?? null;
+  const preferredOpenworkToken = activeWorker?.clientToken ?? activeWorker?.ownerToken ?? null;
+  const hasWorkspaceScopedUrl = Boolean(openworkConnectUrl && /\/w\/[^/?#]+/.test(openworkConnectUrl));
+  const openworkDeepLink = buildOpenworkDeepLink(
+    openworkConnectUrl,
+    preferredOpenworkToken,
+    activeWorker?.workerId ?? null,
+    activeWorker?.workerName ?? null
+  );
+  const openworkAppConnectUrl = buildOpenworkAppConnectUrl(
+    OPENWORK_APP_CONNECT_BASE_URL,
+    openworkConnectUrl,
+    preferredOpenworkToken,
+    activeWorker?.workerId ?? null,
+    activeWorker?.workerName ?? null,
+    { autoConnect: true }
+  );
+  const ownedWorkerCount = workers.filter((item) => item.isMine).length;
+  const additionalWorkerNeedsPlan = Boolean(
+    user &&
+      ownedWorkerCount > 0 &&
+      billingSummary?.featureGateEnabled &&
+      !billingSummary.hasActivePlan
+  );
+  const selectedWorkerStatus = activeWorker?.status ?? selectedWorker?.status ?? "unknown";
+  const selectedStatusMeta = getWorkerStatusMeta(selectedWorkerStatus);
+  const isSelectedWorkerFailed = selectedWorkerStatus.trim().toLowerCase() === "failed";
+  const effectiveCheckoutUrl = checkoutUrl ?? billingSummary?.checkoutUrl ?? null;
+  const onboardingPending = Boolean(onboardingIntent?.shouldLaunch && !onboardingIntent.completed);
+  const onboardingDecisionBusy = onboardingPending && !billingLoadedOnce && (billingBusy || billingCheckoutBusy || !sessionHydrated);
+
+  const filteredWorkers = workers.filter((item) => {
+    const query = workerQuery.trim().toLowerCase();
+    const matchesQuery =
+      !query ||
+      item.workerName.toLowerCase().includes(query) ||
+      item.workerId.toLowerCase().includes(query);
+
+    if (!matchesQuery) {
+      return false;
+    }
+
+    if (workerStatusFilter === "all") {
+      return true;
+    }
+
+    return getWorkerStatusMeta(item.status).bucket === workerStatusFilter;
+  });
+
+  function persistOnboardingIntent(next: OnboardingIntent | null) {
+    setOnboardingIntent(next);
+
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    if (!next) {
+      window.localStorage.removeItem(ONBOARDING_INTENT_STORAGE_KEY);
+      return;
+    }
+
+    window.localStorage.setItem(ONBOARDING_INTENT_STORAGE_KEY, JSON.stringify(next));
+  }
+
+  function appendEvent(level: LaunchEvent["level"], label: string, detail: string) {
+    setEvents((current) => {
+      const next: LaunchEvent[] = [
+        {
+          id: `${Date.now()}-${Math.random().toString(16).slice(2)}`,
+          level,
+          label,
+          detail,
+          at: new Date().toISOString()
+        },
+        ...current
+      ];
+
+      return next.slice(0, 10);
+    });
+  }
+
+  function markOnboardingComplete() {
+    if (!onboardingIntent || onboardingIntent.completed) {
+      return;
+    }
+
+    persistOnboardingIntent({
+      ...onboardingIntent,
+      completed: true,
+      shouldLaunch: false
+    });
+  }
+
+  function setAuthMode(mode: AuthMode) {
+    setAuthModeState(mode);
+    setVerificationRequired(false);
+    setVerificationCode("");
+    setAuthInfo(getAuthInfoForMode(mode));
+    setAuthError(null);
+  }
+
+  function openVerificationStep(targetEmail: string, message?: string) {
+    setVerificationRequired(true);
+    setVerificationCode("");
+    setAuthInfo(message ?? `Enter the 6-digit code we sent to ${targetEmail}.`);
+    setAuthError(null);
+  }
+
+  function cancelVerification() {
+    setVerificationRequired(false);
+    setVerificationCode("");
+    setAuthInfo(getAuthInfoForMode(authMode));
+    setAuthError(null);
+  }
+
+  async function finalizeEmailPasswordSignIn(
+    nextMode: AuthMode,
+    trimmedEmail: string,
+    payloadOverride?: unknown,
+  ): Promise<AuthNavigationResult> {
+    let payload = payloadOverride;
+
+    if (payload === undefined || (!getToken(payload) && nextMode === "sign-up" && Boolean(password))) {
+      const signInBody = {
+        email: trimmedEmail,
+        password,
+      };
+
+      const signInResult = await requestJson("/api/auth/sign-in/email", {
+        method: "POST",
+        body: JSON.stringify(signInBody)
+      });
+
+      if (!signInResult.response.ok) {
+        setAuthError(getErrorMessage(signInResult.payload, `Authentication failed with ${signInResult.response.status}.`));
+        trackPosthogEvent("den_auth_failed", {
+          mode: nextMode,
+          method: "email",
+          status: signInResult.response.status
+        });
+        return null;
+      }
+
+      payload = signInResult.payload;
+    }
+
+    const token = getToken(payload);
+    if (token) {
+      setAuthToken(token);
+    }
+
+    let authenticatedUser: AuthUser | null = null;
+    const payloadUser = getUser(payload);
+    if (payloadUser) {
+      authenticatedUser = payloadUser;
+      setUser(payloadUser);
+      setAuthInfo(`Signed in as ${payloadUser.email}.`);
+      appendEvent("success", nextMode === "sign-up" ? "Account created" : "Signed in", payloadUser.email);
+    } else {
+      const refreshed = await refreshSession(true);
+      if (refreshed) {
+        authenticatedUser = refreshed;
+        appendEvent("success", nextMode === "sign-up" ? "Account created" : "Signed in", refreshed.email);
+      } else {
+        setAuthInfo("Authentication succeeded, but session details are still syncing.");
+      }
+    }
+
+    if (authenticatedUser) {
+      identifyPosthogUser(authenticatedUser);
+      const analyticsPayload = {
+        mode: nextMode,
+        method: "email",
+        email_domain: getEmailDomain(authenticatedUser.email)
+      };
+
+      if (nextMode === "sign-up") {
+        trackPosthogEvent("den_signup_completed", analyticsPayload);
+      } else {
+        trackPosthogEvent("den_signin_completed", analyticsPayload);
+      }
+    }
+
+    if (desktopAuthRequested) {
+      setAuthInfo("Signed in. Returning to OpenWork...");
+      return null;
+    }
+
+    if (authenticatedUser && getPendingOrgInvitationId()) {
+      return "join-org";
+    }
+
+    if (authenticatedUser && nextMode === "sign-up") {
+      return await beginSignupOnboarding(authenticatedUser, "email");
+    }
+
+    return "dashboard" as const;
+  }
+
+  async function resendVerificationCode() {
+    const trimmedEmail = email.trim();
+    if (!trimmedEmail) {
+      setAuthError("Enter your email before requesting a verification code.");
+      return;
+    }
+
+    setAuthBusy(true);
+    setAuthError(null);
+    try {
+      const { response, payload } = await requestJson("/api/auth/email-otp/send-verification-otp", {
+        method: "POST",
+        body: JSON.stringify({
+          email: trimmedEmail,
+          type: "email-verification"
+        })
+      });
+
+      if (!response.ok) {
+        setAuthError(getErrorMessage(payload, `Could not resend the code (${response.status}).`));
+        return;
+      }
+
+      setAuthInfo(`We sent a fresh verification code to ${trimmedEmail}.`);
+      appendEvent("info", "Verification code resent", trimmedEmail);
+      trackPosthogEvent("den_signup_verification_sent", {
+        method: "email",
+        email_domain: getEmailDomain(trimmedEmail),
+      });
+    } catch (error) {
+      setAuthError(error instanceof Error ? error.message : "Could not resend the verification code.");
+    } finally {
+      setAuthBusy(false);
+    }
+  }
+
+  async function submitVerificationCode(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const trimmedEmail = email.trim();
+    const otp = verificationCode.trim();
+    if (!trimmedEmail || !otp) {
+      setAuthError("Enter the verification code from your email.");
+      return null;
+    }
+
+    setAuthBusy(true);
+    setAuthError(null);
+    try {
+      const { response, payload } = await requestJson("/api/auth/email-otp/verify-email", {
+        method: "POST",
+        body: JSON.stringify({
+          email: trimmedEmail,
+          otp,
+        })
+      });
+
+      if (!response.ok) {
+        setAuthError(getErrorMessage(payload, `Verification failed with ${response.status}.`));
+        trackPosthogEvent("den_auth_failed", {
+          mode: authMode,
+          method: "email",
+          status: response.status,
+          reason: "verification_failed"
+        });
+        return null;
+      }
+
+      setVerificationRequired(false);
+      setVerificationCode("");
+      setAuthInfo(`Email verified for ${trimmedEmail}. Finishing sign-in...`);
+      appendEvent("success", "Email verified", trimmedEmail);
+      trackPosthogEvent("den_email_verified", {
+        method: "email",
+        email_domain: getEmailDomain(trimmedEmail),
+      });
+
+      return await finalizeEmailPasswordSignIn(authMode, trimmedEmail, payload);
+    } catch (error) {
+      setAuthError(error instanceof Error ? error.message : "Verification failed.");
+      return null;
+    } finally {
+      setAuthBusy(false);
+    }
+  }
+
+  async function withResolvedOpenworkCredentials(candidate: WorkerLaunch, options: { quiet?: boolean } = {}) {
+    const existingConnectUrl = candidate.openworkUrl?.trim() ?? "";
+    const existingWorkspaceId = candidate.workspaceId?.trim() ?? "";
+    if (existingConnectUrl && existingWorkspaceId) {
+      return {
+        ...candidate,
+        openworkUrl: existingConnectUrl,
+        workspaceId: existingWorkspaceId
+      };
+    }
+
+    const instanceUrl = candidate.instanceUrl?.trim() ?? "";
+    if (!instanceUrl) {
+      return {
+        ...candidate,
+        openworkUrl: null,
+        workspaceId: null
+      };
+    }
+
+    const accessToken = candidate.clientToken?.trim() ?? candidate.ownerToken?.trim() ?? "";
+    if (!accessToken) {
+      const mountedWorkspaceId = parseWorkspaceIdFromUrl(instanceUrl);
+      return {
+        ...candidate,
+        openworkUrl: instanceUrl.trim().replace(/\/+$/, ""),
+        workspaceId: mountedWorkspaceId
+      };
+    }
+
+    try {
+      const resolved = await resolveOpenworkWorkspaceUrl(instanceUrl, accessToken);
+      if (resolved) {
+        return {
+          ...candidate,
+          openworkUrl: resolved.openworkUrl,
+          workspaceId: resolved.workspaceId
+        };
+      }
+    } catch {
+      if (!options.quiet) {
+        appendEvent("warning", "Credential hint", "Could not resolve /w/ URL yet. Using host URL fallback.");
+      }
+    }
+
+    return {
+      ...candidate,
+      openworkUrl: instanceUrl.trim().replace(/\/+$/, ""),
+      workspaceId: parseWorkspaceIdFromUrl(instanceUrl)
+    };
+  }
+
+  async function refreshWorkers(options: { keepSelection?: boolean; quiet?: boolean } = {}) {
+    if (!user) {
+      setWorkers([]);
+      setWorkersLoadedOnce(false);
+      setWorkersError(null);
+      return;
+    }
+
+    if (!options.quiet) {
+      setWorkersBusy(true);
+      setWorkersError(null);
+    }
+
+    try {
+      if (!pendingWorkersRequestRef.current) {
+        pendingWorkersRequestRef.current = requestJson("/v1/workers?limit=20", {
+          method: "GET",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+        });
+      }
+
+      const { response, payload } = await pendingWorkersRequestRef.current;
+
+      if (!response.ok) {
+        if (!options.quiet) {
+          setWorkersError(getErrorMessage(payload, `Failed to load workers (${response.status}).`));
+        }
+        setWorkersLoadedOnce(true);
+        return;
+      }
+
+      const nextWorkers = getWorkersList(payload);
+      setWorkers(nextWorkers);
+      setWorkersLoadedOnce(true);
+
+      const restoredWorkerStillExists =
+        pendingRestoredWorkerId && nextWorkers.some((item) => item.workerId === pendingRestoredWorkerId);
+      const currentSelection = options.keepSelection ? workerLookupId : "";
+      const nextSelectedId =
+        currentSelection && nextWorkers.some((item) => item.workerId === currentSelection)
+          ? currentSelection
+          : nextWorkers[0]?.workerId ?? "";
+      const nextSelectedWorker = nextSelectedId
+        ? nextWorkers.find((item) => item.workerId === nextSelectedId) ?? null
+        : null;
+
+      setWorkerLookupId(nextSelectedId);
+
+      if (!nextSelectedId) {
+        setWorker(null);
+        setTokenFetchedForWorkerId(null);
+        setPendingRestoredWorkerId(null);
+        setLaunchStatus("Choose a worker name and launch.");
+        if (typeof window !== "undefined") {
+          window.localStorage.removeItem(LAST_WORKER_STORAGE_KEY);
+        }
+        return;
+      }
+
+      if (restoredWorkerStillExists) {
+        setPendingRestoredWorkerId(null);
+      }
+
+      if (nextSelectedWorker) {
+        setWorker((current) => listItemToWorker(nextSelectedWorker, current));
+        if (!launchBusy) {
+          setLaunchStatus(getWorkerStatusCopy(nextSelectedWorker.status));
+        }
+      }
+    } catch (error) {
+      if (!options.quiet) {
+        setWorkersError(error instanceof Error ? error.message : "Unknown network error");
+      }
+      setWorkersLoadedOnce(true);
+    } finally {
+      pendingWorkersRequestRef.current = null;
+      if (!options.quiet) {
+        setWorkersBusy(false);
+      }
+    }
+  }
+
+  function mergeWorkerSummaryIntoList(summary: WorkerSummary) {
+    setWorkers((current) => current.map((entry) =>
+      entry.workerId === summary.workerId
+        ? {
+            ...entry,
+            workerName: summary.workerName,
+            status: summary.status,
+            provider: summary.provider,
+            instanceUrl: summary.instanceUrl,
+            isMine: summary.isMine,
+          }
+        : entry,
+    ));
+  }
+
+  async function refreshRuntime(workerId?: string, options: { quiet?: boolean } = {}) {
+    const targetWorkerId = workerId ?? activeWorker?.workerId ?? selectedWorker?.workerId ?? null;
+    if (!user || !targetWorkerId) {
+      setRuntimeSnapshot(null);
+      if (!options.quiet) {
+        setRuntimeError("Select a worker to inspect runtime versions.");
+      }
+      return null;
+    }
+
+    setRuntimeBusy(true);
+    if (!options.quiet) {
+      setRuntimeError(null);
+    }
+
+    try {
+      const { response, payload } = await requestJson(
+        `/v1/workers/${encodeURIComponent(targetWorkerId)}/runtime`,
+        {
+          method: "GET",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+        },
+        12000
+      );
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Runtime check failed with ${response.status}.`);
+        if (!options.quiet) {
+          setRuntimeError(message);
+        }
+        return null;
+      }
+
+      const snapshot = getWorkerRuntimeSnapshot(payload);
+      if (!snapshot) {
+        if (!options.quiet) {
+          setRuntimeError("Runtime details were missing from the worker response.");
+        }
+        return null;
+      }
+
+      setRuntimeSnapshot(snapshot);
+      return snapshot;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      if (!options.quiet) {
+        setRuntimeError(message);
+      }
+      return null;
+    } finally {
+      setRuntimeBusy(false);
+    }
+  }
+
+  async function upgradeRuntime() {
+    const targetWorkerId = activeWorker?.workerId ?? selectedWorker?.workerId ?? null;
+    if (!user || !targetWorkerId || runtimeUpgradeBusy) {
+      return;
+    }
+
+    setRuntimeUpgradeBusy(true);
+    setRuntimeError(null);
+
+    try {
+      const { response, payload } = await requestJson(
+        `/v1/workers/${encodeURIComponent(targetWorkerId)}/runtime/upgrade`,
+        {
+          method: "POST",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+          body: JSON.stringify({ services: ["openwork-server", "opencode"] })
+        },
+        12000
+      );
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Runtime upgrade failed with ${response.status}.`);
+        setRuntimeError(message);
+        appendEvent("error", "Runtime upgrade failed", message);
+        return;
+      }
+
+      appendEvent("info", "Runtime upgrade started", activeWorker?.workerName ?? selectedWorker?.workerName ?? targetWorkerId);
+      setRuntimeSnapshot((current) =>
+        current
+          ? {
+              ...current,
+              upgrade: {
+                ...current.upgrade,
+                status: "running",
+                startedAt: new Date().toISOString(),
+                finishedAt: null,
+                error: null
+              }
+            }
+          : current
+      );
+
+      window.setTimeout(() => {
+        void refreshRuntime(targetWorkerId, { quiet: true });
+      }, 4000);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setRuntimeError(message);
+      appendEvent("error", "Runtime upgrade failed", message);
+    } finally {
+      setRuntimeUpgradeBusy(false);
+    }
+  }
+
+  async function refreshBilling(options: { includeCheckout?: boolean; quiet?: boolean } = {}) {
+    if (!user) {
+      setBillingSummary(null);
+      if (!options.quiet) {
+        setBillingError("Sign in to view billing details.");
+      }
+      return null;
+    }
+
+    const includeCheckout = options.includeCheckout === true;
+    const quiet = options.quiet === true;
+
+    if (includeCheckout) {
+      setBillingCheckoutBusy(true);
+    } else {
+      setBillingBusy(true);
+    }
+
+    if (!quiet) {
+      setBillingError(null);
+    }
+
+    try {
+      const query = includeCheckout ? "?includeCheckout=1" : "";
+      const { response, payload } = await requestJson(
+        `/v1/workers/billing${query}`,
+        {
+          method: "GET",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+        },
+        12000
+      );
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Billing lookup failed with ${response.status}.`);
+        if (!quiet) {
+          setBillingError(message);
+          appendEvent("error", "Billing check failed", message);
+        }
+        return null;
+      }
+
+      const summary = getBillingSummary(payload);
+      if (!summary) {
+        if (!quiet) {
+          setBillingError("Billing response was missing details.");
+          appendEvent("error", "Billing check failed", "Billing summary missing");
+        }
+        return null;
+      }
+
+      setBillingSummary(summary);
+      setBillingLoadedOnce(true);
+      if (summary.checkoutUrl) {
+        setCheckoutUrl(summary.checkoutUrl);
+      } else if (!summary.checkoutRequired) {
+        setCheckoutUrl(null);
+      }
+
+      return summary;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      if (!quiet) {
+        setBillingError(message);
+        appendEvent("error", "Billing check failed", message);
+      }
+      return null;
+    } finally {
+      if (includeCheckout) {
+        setBillingCheckoutBusy(false);
+      } else {
+        setBillingBusy(false);
+      }
+    }
+  }
+
+  async function handleSubscriptionCancellation(cancelAtPeriodEnd: boolean) {
+    if (!user || billingSubscriptionBusy) {
+      return;
+    }
+
+    if (cancelAtPeriodEnd && typeof window !== "undefined") {
+      const confirmed = window.confirm("Cancel subscription at period end? You can still use your current billing period.");
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    setBillingSubscriptionBusy(true);
+    setBillingError(null);
+
+    try {
+      const { response, payload } = await requestJson(
+        "/v1/workers/billing/subscription",
+        {
+          method: "POST",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+          body: JSON.stringify({ cancelAtPeriodEnd })
+        },
+        12000
+      );
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Subscription update failed (${response.status}).`);
+        setBillingError(message);
+        appendEvent("error", "Subscription update failed", message);
+        return;
+      }
+
+      const summary = getBillingSummary(payload);
+      if (!summary) {
+        setBillingError("Subscription updated, but billing details could not be refreshed.");
+        appendEvent("warning", "Subscription updated", "Billing summary missing");
+        return;
+      }
+
+      setBillingSummary(summary);
+      setBillingLoadedOnce(true);
+      if (summary.checkoutUrl) {
+        setCheckoutUrl(summary.checkoutUrl);
+      } else if (!summary.checkoutRequired) {
+        setCheckoutUrl(null);
+      }
+
+      appendEvent(
+        "success",
+        cancelAtPeriodEnd ? "Subscription will cancel at period end" : "Subscription auto-renew resumed",
+        user.email
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setBillingError(message);
+      appendEvent("error", "Subscription update failed", message);
+    } finally {
+      setBillingSubscriptionBusy(false);
+    }
+  }
+
+  async function copyToClipboard(field: string, value: string | null) {
+    if (!value) {
+      return;
+    }
+
+    await navigator.clipboard.writeText(value);
+    setCopiedField(field);
+    setTimeout(() => {
+      setCopiedField((current) => (current === field ? null : current));
+    }, 1800);
+  }
+
+  async function refreshSession(quiet = false) {
+    const headers = new Headers();
+    if (authToken) {
+      headers.set("Authorization", `Bearer ${authToken}`);
+    }
+
+    const { response, payload } = await requestJson("/v1/me", { method: "GET", headers }, 12000);
+
+    if (!response.ok) {
+      setUser(null);
+      if (response.status === 401 && authToken) {
+        setAuthToken(null);
+      }
+      if (!quiet) {
+        setAuthError("No active session found. Sign in first.");
+      }
+      return null;
+    }
+
+    const sessionUser = getUser(payload);
+    if (!sessionUser) {
+      if (!quiet) {
+        setAuthError("Session response did not include a user.");
+      }
+      return null;
+    }
+
+    setUser(sessionUser);
+    setAuthInfo(`Signed in as ${sessionUser.email}.`);
+    return sessionUser;
+  }
+
+  async function loadOrgDirectory() {
+    const headers = new Headers();
+    if (authToken) {
+      headers.set("Authorization", `Bearer ${authToken}`);
+    }
+
+    const { response, payload } = await requestJson("/v1/me/orgs", { method: "GET", headers }, 12000);
+    if (!response.ok) {
+      return {
+        orgs: [],
+        activeOrgId: null,
+        activeOrgSlug: null,
+      };
+    }
+
+    return parseOrgListPayload(payload);
+  }
+
+  async function resolveDashboardRoute() {
+    const orgDirectory = await loadOrgDirectory();
+    const activeOrgSlug = orgDirectory.activeOrgSlug ?? orgDirectory.orgs[0]?.slug ?? null;
+    return activeOrgSlug ? getOrgDashboardRoute(activeOrgSlug) : null;
+  }
+
+  async function completeDesktopAuthHandoff() {
+    if (!desktopAuthRequested || desktopRedirectBusy) {
+      return;
+    }
+
+    setDesktopRedirectBusy(true);
+    setDesktopRedirectAttempted(true);
+    setAuthError(null);
+
+    try {
+      const headers = new Headers();
+      if (authToken) {
+        headers.set("Authorization", `Bearer ${authToken}`);
+      }
+
+      const { response, payload } = await requestJson("/v1/auth/desktop-handoff", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ desktopScheme: desktopAuthScheme })
+      });
+
+      if (!response.ok) {
+        setAuthError(getErrorMessage(payload, `Desktop handoff failed with ${response.status}.`));
+        return;
+      }
+
+      const openworkPayload = payload as { openworkUrl?: unknown } | null;
+      const openworkUrl = typeof openworkPayload?.openworkUrl === "string" ? openworkPayload.openworkUrl.trim() : "";
+      if (!openworkUrl) {
+        setAuthError("Desktop handoff succeeded, but no OpenWork redirect URL was returned.");
+        return;
+      }
+
+      setDesktopRedirectUrl(openworkUrl);
+      window.location.assign(openworkUrl);
+    } catch (error) {
+      setAuthError(error instanceof Error ? error.message : "Failed to open OpenWork.");
+    } finally {
+      setDesktopRedirectBusy(false);
+    }
+  }
+
+  async function beginSignupOnboarding(authenticatedUser: AuthUser, _authMethod: AuthMethod) {
+    const autoName = deriveOnboardingWorkerName(authenticatedUser);
+    setWorkerName(autoName);
+    setLaunchError(null);
+    setLaunchStatus("Create a workspace to get started.");
+    persistOnboardingIntent(null);
+    return "dashboard" as const;
+  }
+
+  async function resolveUserLandingRoute() {
+    if (!user || desktopAuthRequested) {
+      return null;
+    }
+
+    const pendingInvitationId = getPendingOrgInvitationId();
+    if (pendingInvitationId) {
+      return getJoinOrgRoute(pendingInvitationId);
+    }
+
+    const dashboardRoute = await resolveDashboardRoute();
+
+    if (dashboardRoute) {
+      return dashboardRoute;
+    }
+
+    return "/organization";
+  }
+
+  async function submitAuth(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+
+    setAuthBusy(true);
+    setAuthError(null);
+    trackPosthogEvent("den_auth_submitted", {
+      mode: authMode,
+      method: "email"
+    });
+
+    try {
+      const endpoint = authMode === "sign-up" ? "/api/auth/sign-up/email" : "/api/auth/sign-in/email";
+      const trimmedEmail = email.trim();
+      const body =
+        authMode === "sign-up"
+          ? {
+              name: DEFAULT_AUTH_NAME,
+              email: trimmedEmail,
+              password
+            }
+          : {
+              email: trimmedEmail,
+              password
+            };
+
+      const { response, payload } = await requestJson(endpoint, {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+
+      if (!response.ok) {
+        if (response.status === 403) {
+          openVerificationStep(trimmedEmail, `Enter the 6-digit code we sent to ${trimmedEmail} to finish verifying your email.`);
+        }
+        setAuthError(getErrorMessage(payload, `Authentication failed with ${response.status}.`));
+        trackPosthogEvent("den_auth_failed", {
+          mode: authMode,
+          method: "email",
+          status: response.status
+        });
+        return null;
+      }
+
+      const token = getToken(payload);
+
+      if (authMode === "sign-up" && !token) {
+        setUser(null);
+        openVerificationStep(trimmedEmail, `We emailed a 6-digit verification code to ${trimmedEmail}. Enter it below to finish creating your account.`);
+        appendEvent("info", "Verification code sent", trimmedEmail);
+        trackPosthogEvent("den_signup_verification_sent", {
+          method: "email",
+          email_domain: getEmailDomain(trimmedEmail),
+        });
+        return null;
+      }
+      return await finalizeEmailPasswordSignIn(authMode, trimmedEmail);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setAuthError(message);
+      trackPosthogEvent("den_auth_failed", {
+        mode: authMode,
+        method: "email",
+        reason: "network_error"
+      });
+      return null;
+    } finally {
+      setAuthBusy(false);
+    }
+  }
+
+  async function beginSocialAuth(provider: SocialAuthProvider) {
+    if (authBusy || typeof window === "undefined") {
+      return;
+    }
+
+    const shouldTrackSocialSignup = authMode === "sign-up";
+    if (shouldTrackSocialSignup) {
+      window.sessionStorage.setItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY, provider);
+    }
+
+    setAuthBusy(true);
+    setAuthError(null);
+    setAuthInfo(`Redirecting to ${getSocialProviderLabel(provider)}...`);
+    trackPosthogEvent("den_auth_submitted", {
+      mode: authMode,
+      method: provider
+    });
+
+    try {
+      const callbackURL = getSocialCallbackUrl();
+      const { response, payload } = await requestJson("/api/auth/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({
+          provider,
+          callbackURL,
+          errorCallbackURL: callbackURL
+        })
+      });
+
+      if (!response.ok) {
+        if (shouldTrackSocialSignup) {
+          window.sessionStorage.removeItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+        }
+        setAuthInfo(getAuthInfoForMode(authMode));
+        setAuthError(getErrorMessage(payload, `${getSocialProviderLabel(provider)} sign-in failed with ${response.status}.`));
+        setAuthBusy(false);
+        return;
+      }
+
+      const socialPayload = payload as { url?: unknown } | null;
+      const payloadUrl = typeof socialPayload?.url === "string" ? socialPayload.url.trim() : "";
+      const headerUrl = response.headers.get("location")?.trim() ?? "";
+      const redirectUrl = payloadUrl || headerUrl;
+
+      if (!redirectUrl) {
+        if (shouldTrackSocialSignup) {
+          window.sessionStorage.removeItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+        }
+        setAuthInfo(getAuthInfoForMode(authMode));
+        setAuthError(`${getSocialProviderLabel(provider)} sign-in did not return a redirect URL.`);
+        setAuthBusy(false);
+        return;
+      }
+
+      window.location.assign(redirectUrl);
+    } catch (error) {
+      if (shouldTrackSocialSignup) {
+        window.sessionStorage.removeItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+      }
+      setAuthInfo(getAuthInfoForMode(authMode));
+      setAuthError(error instanceof Error ? error.message : "Unknown network error");
+      setAuthBusy(false);
+    }
+  }
+
+  async function signOut() {
+    if (authBusy) {
+      return;
+    }
+
+    setAuthBusy(true);
+    setAuthError(null);
+
+    try {
+      await requestJson("/api/auth/sign-out", {
+        method: "POST",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+        body: JSON.stringify({})
+      });
+    } catch {
+      // Ignore transport issues and clear local state anyway.
+    } finally {
+      setAuthBusy(false);
+    }
+
+    setUser(null);
+    setAuthToken(null);
+    setWorker(null);
+    setWorkers([]);
+    setWorkerLookupId("");
+    setWorkersError(null);
+    setLaunchError(null);
+    setCheckoutUrl(null);
+    setBillingSummary(null);
+    setBillingError(null);
+    setOrgLimitError(null);
+    setBillingBusy(false);
+    setBillingCheckoutBusy(false);
+    setBillingSubscriptionBusy(false);
+    setBillingLoadedOnce(false);
+    setTokenFetchedForWorkerId(null);
+    setDeleteBusyWorkerId(null);
+    setActionBusy(null);
+    setLaunchBusy(false);
+    setRuntimeSnapshot(null);
+    setRuntimeError(null);
+    setRuntimeUpgradeBusy(false);
+    setPendingRestoredWorkerId(null);
+    setDesktopRedirectUrl(null);
+    setDesktopRedirectAttempted(false);
+    setAuthMode("sign-up");
+    setEmail("");
+    setPassword("");
+    setAuthInfo(getAuthInfoForMode("sign-up"));
+    setLaunchStatus("Choose a worker name and launch.");
+    setEvents([]);
+    setWorkerQuery("");
+    setWorkerStatusFilter("all");
+    setWorkerName(DEFAULT_WORKER_NAME);
+    persistOnboardingIntent(null);
+    resetPosthogUser();
+    trackPosthogEvent("den_signout_completed", { method: "manual" });
+
+    if (typeof window !== "undefined") {
+      window.localStorage.removeItem(LAST_WORKER_STORAGE_KEY);
+      window.sessionStorage.removeItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+      window.sessionStorage.removeItem(PENDING_ORG_INVITATION_STORAGE_KEY);
+    }
+  }
+
+  async function launchWorker(options: { source?: "manual" | "signup_auto"; workerNameOverride?: string } = {}) {
+    if (!user) {
+      setAuthError("Sign in before launching a worker.");
+      return "error" as const;
+    }
+
+    const resolvedLaunchName = options.workerNameOverride?.trim() || workerName.trim() || DEFAULT_WORKER_NAME;
+
+    setLaunchBusy(true);
+    setLaunchError(null);
+    setOrgLimitError(null);
+    setCheckoutUrl(null);
+    setLaunchStatus(options.source === "signup_auto" ? "Creating your first worker..." : "Checking worker billing and launch eligibility...");
+    appendEvent("info", "Launch requested", resolvedLaunchName);
+
+    try {
+      const { response, payload } = await requestJson(
+        "/v1/workers",
+        {
+          method: "POST",
+          headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+          body: JSON.stringify({
+            name: resolvedLaunchName,
+            destination: "cloud"
+          })
+        },
+        12000
+      );
+
+      const limitError = getOrgLimitError(payload);
+      if (limitError) {
+        setOrgLimitError(limitError);
+        setLaunchStatus(limitError.message);
+        setLaunchError(limitError.message);
+        appendEvent("warning", "Workspace limit reached", limitError.message);
+        return "limit" as const;
+      }
+
+      if (response.status === 402) {
+        const url = getCheckoutUrl(payload);
+        setCheckoutUrl(url);
+        setBillingSummary((current) => {
+          if (!current) {
+            return current;
+          }
+
+          return {
+            ...current,
+            hasActivePlan: false,
+            checkoutRequired: true,
+            checkoutUrl: url ?? current.checkoutUrl
+          };
+        });
+        setLaunchStatus("Payment is required. Complete checkout and return to continue launch.");
+        setLaunchError(url ? null : "Checkout URL missing from paywall response.");
+        appendEvent("warning", "Paywall required", url ? "Checkout URL generated" : "Checkout URL missing");
+        if (!url) {
+          void refreshBilling({ includeCheckout: true, quiet: true });
+        }
+        return "checkout" as const;
+      }
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Launch failed with ${response.status}.`);
+        setLaunchError(message);
+        setLaunchStatus("Launch failed. Fix the error and retry.");
+        appendEvent("error", "Launch failed", message);
+        return "error" as const;
+      }
+
+      const parsedWorker = getWorker(payload);
+      if (!parsedWorker) {
+        setLaunchError("Launch response was missing worker details.");
+        setLaunchStatus("Launch response format was unexpected.");
+        appendEvent("error", "Launch failed", "Worker payload missing");
+        return "error" as const;
+      }
+
+      const resolvedWorker = await withResolvedOpenworkCredentials(parsedWorker);
+      setWorker(resolvedWorker);
+      setWorkerLookupId(parsedWorker.workerId);
+      setPendingRestoredWorkerId(null);
+      setCheckoutUrl(null);
+
+      if (resolvedWorker.status === "provisioning") {
+        setLaunchStatus("Provisioning started. We will keep checking automatically.");
+        appendEvent("info", "Provisioning started", `Worker ID ${parsedWorker.workerId}`);
+      } else {
+        setLaunchStatus(getWorkerStatusCopy(resolvedWorker.status));
+        appendEvent("success", "Worker launched", `Worker ID ${parsedWorker.workerId}`);
+      }
+
+      markOnboardingComplete();
+      return "success" as const;
+    } catch (error) {
+      const message =
+        error instanceof DOMException && error.name === "AbortError"
+          ? "Launch request took longer than expected. Provisioning can continue in the background. Refresh worker status below."
+          : error instanceof Error
+            ? error.message
+            : "Unknown network error";
+
+      setLaunchError(message);
+      setLaunchStatus("Launch request failed.");
+      appendEvent("error", "Launch failed", message);
+      return "error" as const;
+    } finally {
+      setLaunchBusy(false);
+      void refreshWorkers({ keepSelection: true });
+    }
+  }
+
+  async function checkWorkerStatus(options: { workerId?: string; quiet?: boolean; background?: boolean } = {}) {
+    const quiet = options.quiet === true;
+    const background = options.background === true;
+
+    if (!user) {
+      if (!quiet) {
+        setLaunchError("Sign in before checking worker status.");
+      }
+      return;
+    }
+
+    const fallbackId = workerLookupId.trim() || worker?.workerId || workers[0]?.workerId || "";
+    const id = options.workerId ?? fallbackId;
+    if (!id) {
+      if (!quiet) {
+        setLaunchError("No worker selected yet. Launch one first, then use this panel.");
+      }
+      return;
+    }
+
+    if (!background) {
+      setWorkerLookupId(id);
+    }
+
+    if (!background) {
+      setActionBusy("status");
+    }
+    if (!quiet) {
+      setLaunchError(null);
+    }
+
+    try {
+      const { response, payload } = await requestJson(`/v1/workers/${encodeURIComponent(id)}`, {
+        method: "GET",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+      });
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Status check failed with ${response.status}.`);
+        if (!quiet) {
+          setLaunchError(message);
+          appendEvent("error", "Status check failed", message);
+        }
+        return;
+      }
+
+      const summary = getWorkerSummary(payload);
+      if (!summary) {
+        if (!quiet) {
+          setLaunchError("Status response was missing worker details.");
+          appendEvent("error", "Status check failed", "Worker summary missing");
+        }
+        return;
+      }
+
+      mergeWorkerSummaryIntoList(summary);
+
+      const previousStatus = worker?.workerId === summary.workerId ? worker.status : null;
+      const nextWorker: WorkerLaunch =
+        worker && worker.workerId === summary.workerId
+          ? {
+              ...worker,
+              workerName: summary.workerName,
+              status: summary.status,
+              provider: summary.provider,
+              instanceUrl: summary.instanceUrl
+            }
+          : {
+              workerId: summary.workerId,
+              workerName: summary.workerName,
+              status: summary.status,
+              provider: summary.provider,
+              instanceUrl: summary.instanceUrl,
+              openworkUrl: summary.instanceUrl,
+              workspaceId: null,
+              clientToken: null,
+              ownerToken: null,
+              hostToken: null
+            };
+
+      const shouldUpdateActiveWorker = worker?.workerId === summary.workerId || (!background && workerLookupId === summary.workerId);
+      if (shouldUpdateActiveWorker) {
+        const resolvedWorker = await withResolvedOpenworkCredentials(nextWorker, { quiet: true });
+        setWorker(resolvedWorker);
+        setPendingRestoredWorkerId(null);
+        if (!background) {
+          setWorkerLookupId(summary.workerId);
+        }
+      }
+
+      if (!quiet) {
+        setLaunchStatus(`Worker ${summary.workerName} is currently ${summary.status}.`);
+        appendEvent("info", "Status refreshed", `${summary.workerName}: ${summary.status}`);
+      } else if (previousStatus && previousStatus !== summary.status) {
+        setLaunchStatus(getWorkerStatusCopy(summary.status));
+
+        if (summary.status === "healthy") {
+          appendEvent("success", "Provisioning complete", `${summary.workerName} is ready`);
+          markOnboardingComplete();
+        } else if (summary.status === "failed") {
+          appendEvent("error", "Provisioning failed", `${summary.workerName} failed to provision`);
+        } else {
+          appendEvent("info", "Provisioning update", `${summary.workerName}: ${summary.status}`);
+        }
+      }
+
+    } catch (error) {
+      if (!quiet) {
+        setLaunchError(error instanceof Error ? error.message : "Unknown network error");
+      }
+    } finally {
+      if (!background) {
+        setActionBusy(null);
+      }
+    }
+  }
+
+  async function generateWorkerToken() {
+    if (!user) {
+      setLaunchError("Sign in before fetching a worker access token.");
+      return;
+    }
+
+    const id = workerLookupId.trim() || worker?.workerId || workers[0]?.workerId || "";
+    if (!id) {
+      setLaunchError("No worker selected yet. Launch one first, then fetch a token.");
+      return;
+    }
+
+    setWorkerLookupId(id);
+    setActionBusy("token");
+    setLaunchError(null);
+
+    try {
+      const { response, payload } = await requestJson(`/v1/workers/${encodeURIComponent(id)}/tokens`, {
+        method: "POST",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+        body: JSON.stringify({})
+      });
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Token fetch failed with ${response.status}.`);
+        setLaunchError(message);
+        appendEvent("error", "Token fetch failed", message);
+        return;
+      }
+
+      const tokens = getWorkerTokens(payload);
+      if (!tokens) {
+        setLaunchError("Token response returned no token values.");
+        appendEvent("error", "Token fetch failed", "Missing token payload");
+        return;
+      }
+
+      const nextWorker: WorkerLaunch =
+        worker && worker.workerId === id
+          ? {
+              ...worker,
+              openworkUrl: tokens.openworkUrl ?? worker.openworkUrl,
+              workspaceId: tokens.workspaceId ?? worker.workspaceId,
+              clientToken: tokens.clientToken,
+              ownerToken: tokens.ownerToken,
+              hostToken: tokens.hostToken
+            }
+          : {
+              workerId: id,
+              workerName: "Existing worker",
+              status: "unknown",
+              provider: null,
+              instanceUrl: null,
+              openworkUrl: tokens.openworkUrl,
+              workspaceId: tokens.workspaceId,
+              clientToken: tokens.clientToken,
+              ownerToken: tokens.ownerToken,
+              hostToken: tokens.hostToken
+            };
+
+      const resolvedWorker = await withResolvedOpenworkCredentials(nextWorker, { quiet: true });
+      setWorker(resolvedWorker);
+      setPendingRestoredWorkerId(null);
+      setLaunchStatus("Worker is ready to connect.");
+      appendEvent("success", "Owner token ready", `Worker ID ${id}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setLaunchError(message);
+      appendEvent("error", "Token fetch failed", message);
+    } finally {
+      setActionBusy(null);
+    }
+  }
+
+  async function renameWorker(workerId: string, name: string) {
+    if (!user) {
+      setLaunchError("Sign in before renaming a worker.");
+      return false;
+    }
+
+    const nextName = name.trim();
+    if (!nextName) {
+      setLaunchError("Enter a worker name.");
+      return false;
+    }
+
+    setRenameBusyWorkerId(workerId);
+    setLaunchError(null);
+
+    try {
+      const { response, payload } = await requestJson(`/v1/workers/${encodeURIComponent(workerId)}`, {
+        method: "PATCH",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined,
+        body: JSON.stringify({ name: nextName })
+      });
+
+      if (!response.ok) {
+        const message = getErrorMessage(payload, `Rename failed with ${response.status}.`);
+        setLaunchError(message);
+        appendEvent("error", "Rename failed", message);
+        return false;
+      }
+
+      setWorkers((current) => current.map((entry) => entry.workerId === workerId ? { ...entry, workerName: nextName } : entry));
+      setWorker((current) => current && current.workerId === workerId ? { ...current, workerName: nextName } : current);
+      setLaunchStatus(`Renamed worker to ${nextName}.`);
+      appendEvent("success", "Worker renamed", nextName);
+      return true;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setLaunchError(message);
+      appendEvent("error", "Rename failed", message);
+      return false;
+    } finally {
+      setRenameBusyWorkerId(null);
+    }
+  }
+
+  async function deleteWorker(workerId: string) {
+    if (!user) {
+      setLaunchError("Sign in before deleting a worker.");
+      return;
+    }
+
+    if (deleteBusyWorkerId || redeployBusyWorkerId || actionBusy !== null || launchBusy) {
+      return;
+    }
+
+    const target = workers.find((entry) => entry.workerId === workerId) ?? null;
+    const workerLabel = target?.workerName ?? "this worker";
+
+    if (typeof window !== "undefined") {
+      const confirmed = window.confirm(`Delete \"${workerLabel}\"? This removes it from your worker list.`);
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    setDeleteBusyWorkerId(workerId);
+    setLaunchError(null);
+
+    try {
+      const { response, payload } = await requestJson(`/v1/workers/${encodeURIComponent(workerId)}`, {
+        method: "DELETE",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+      });
+
+      if (response.status !== 204 && !response.ok) {
+        const message = getErrorMessage(payload, `Delete failed with ${response.status}.`);
+        setLaunchError(message);
+        appendEvent("error", "Delete failed", message);
+        return;
+      }
+
+      setWorkers((current) => current.filter((entry) => entry.workerId !== workerId));
+      setWorker((current) => (current && current.workerId === workerId ? null : current));
+      setPendingRestoredWorkerId((current) => (current === workerId ? null : current));
+      setWorkerLookupId((current) => (current === workerId ? "" : current));
+
+      if (typeof window !== "undefined" && worker?.workerId === workerId) {
+        window.localStorage.removeItem(LAST_WORKER_STORAGE_KEY);
+      }
+
+      setLaunchStatus(`Deleted ${workerLabel}.`);
+      appendEvent("success", "Worker deleted", workerLabel);
+      await refreshWorkers({ keepSelection: false });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error";
+      setLaunchError(message);
+      appendEvent("error", "Delete failed", message);
+    } finally {
+      setDeleteBusyWorkerId(null);
+    }
+  }
+
+  async function redeployWorker(workerId: string) {
+    if (!user) {
+      setLaunchError("Sign in before redeploying a worker.");
+      return;
+    }
+
+    if (redeployBusyWorkerId || deleteBusyWorkerId || actionBusy !== null || launchBusy) {
+      return;
+    }
+
+    const target = workers.find((entry) => entry.workerId === workerId) ?? null;
+    const workerLabel = target?.workerName?.trim() || DEFAULT_WORKER_NAME;
+
+    if (typeof window !== "undefined") {
+      const confirmed = window.confirm(`Redeploy \"${workerLabel}\"? This removes the current worker and creates a new one with the same name.`);
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    setRedeployBusyWorkerId(workerId);
+    setLaunchError(null);
+    setCheckoutUrl(null);
+    setLaunchStatus(`Redeploying ${workerLabel}...`);
+    appendEvent("info", "Redeploy requested", workerLabel);
+
+    try {
+      const { response: deleteResponse, payload: deletePayload } = await requestJson(`/v1/workers/${encodeURIComponent(workerId)}`, {
+        method: "DELETE",
+        headers: authToken ? { Authorization: `Bearer ${authToken}` } : undefined
+      });
+
+      if (deleteResponse.status !== 204 && !deleteResponse.ok) {
+        const message = getErrorMessage(deletePayload, `Redeploy failed while deleting (${deleteResponse.status}).`);
+        setLaunchError(message);
+        appendEvent("error", "Redeploy failed", message);
+        return;
+      }
+
+      const outcome = await launchWorker({ source: "manual", workerNameOverride: workerLabel });
+      if (outcome === "success") {
+        appendEvent("success", "Worker redeployed", workerLabel);
+      }
+    } finally {
+      setRedeployBusyWorkerId(null);
+      void refreshWorkers({ keepSelection: true });
+    }
+  }
+
+  async function refreshCheckoutReturn(sessionTokenPresent: boolean) {
+    if (sessionTokenPresent) {
+      setCheckoutUrl(null);
+      setLaunchStatus("Checkout return detected. Billing is refreshing now.");
+      appendEvent("success", "Returned from checkout", sessionTokenPresent ? "Polar session token received" : "Return detected");
+      trackPosthogEvent("den_paywall_checkout_returned", {
+        source: "polar",
+        session_token_present: sessionTokenPresent
+      });
+    }
+
+    const summary = await refreshBilling({ includeCheckout: false, quiet: true });
+    if (!summary) {
+      return "/checkout" as const;
+    }
+
+    if (!summary.featureGateEnabled || summary.hasActivePlan) {
+      return (await resolveUserLandingRoute()) ?? "/organization";
+    }
+
+    return "/checkout" as const;
+  }
+
+  function selectWorker(item: WorkerListItem) {
+    setWorkerLookupId(item.workerId);
+    setWorker((current) => listItemToWorker(item, current));
+  }
+
+  useEffect(() => {
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    const params = new URLSearchParams(window.location.search);
+    const requestedMode = normalizeAuthModeParam(params.get("mode"));
+    if (requestedMode) {
+      setAuthMode(requestedMode);
+    }
+
+    setDesktopAuthRequested(params.get("desktopAuth") === "1");
+    const requestedScheme = params.get("desktopScheme")?.trim() ?? "";
+    if (/^[a-z][a-z0-9+.-]*$/i.test(requestedScheme)) {
+      setDesktopAuthScheme(requestedScheme);
+    }
+
+    const invitationId = params.get("invite")?.trim() ?? "";
+    if (invitationId) {
+      window.sessionStorage.setItem(PENDING_ORG_INVITATION_STORAGE_KEY, invitationId);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (authToken) {
+      window.localStorage.setItem(AUTH_TOKEN_STORAGE_KEY, authToken);
+    } else {
+      window.localStorage.removeItem(AUTH_TOKEN_STORAGE_KEY);
+    }
+  }, [authToken]);
+
+  useEffect(() => {
+    let cancelled = false;
+
+    const hydrateSession = async () => {
+      await refreshSession(true);
+      if (!cancelled) {
+        setSessionHydrated(true);
+      }
+    };
+
+    void hydrateSession();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [authToken]);
+
+  useEffect(() => {
+    if (!user) {
+      setWorkers([]);
+      setWorkersLoadedOnce(false);
+      setWorkersError(null);
+      return;
+    }
+
+    void refreshWorkers();
+  }, [user?.id, authToken]);
+
+  useEffect(() => {
+    if (!user) {
+      setBillingSummary(null);
+      setBillingError(null);
+      setBillingLoadedOnce(false);
+      return;
+    }
+
+    void refreshBilling({ quiet: true });
+  }, [user?.id, authToken]);
+
+  useEffect(() => {
+    if (!user) {
+      return;
+    }
+
+    identifyPosthogUser(user);
+  }, [user?.id]);
+
+  useEffect(() => {
+    if (!user || typeof window === "undefined") {
+      return;
+    }
+
+    const pendingSocialSignup = window.sessionStorage.getItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+    if (pendingSocialSignup !== "github" && pendingSocialSignup !== "google") {
+      return;
+    }
+    if (socialSignupHandledRef.current === user.id) {
+      return;
+    }
+
+    socialSignupHandledRef.current = user.id;
+    window.sessionStorage.removeItem(PENDING_SOCIAL_SIGNUP_STORAGE_KEY);
+    trackPosthogEvent("den_signup_completed", {
+      mode: "sign-up",
+      method: pendingSocialSignup,
+      email_domain: getEmailDomain(user.email)
+    });
+
+    if (getPendingOrgInvitationId()) {
+      return;
+    }
+
+    void beginSignupOnboarding(user, pendingSocialSignup);
+  }, [user?.id]);
+
+  useEffect(() => {
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    const raw = window.localStorage.getItem(LAST_WORKER_STORAGE_KEY);
+    if (!raw) {
+      return;
+    }
+
+    try {
+      const parsed = JSON.parse(raw) as unknown;
+      if (!isWorkerLaunch(parsed)) {
+        return;
+      }
+
+      const restored: WorkerLaunch = {
+        ...parsed,
+        openworkUrl: parsed.openworkUrl ?? parsed.instanceUrl,
+        workspaceId: parsed.workspaceId ?? parseWorkspaceIdFromUrl(parsed.instanceUrl ?? ""),
+        clientToken: null,
+        ownerToken: null,
+        hostToken: null
+      };
+
+      setWorker(restored);
+      setWorkerLookupId(restored.workerId);
+      setPendingRestoredWorkerId(restored.workerId);
+      setLaunchStatus(`Recovered worker ${restored.workerName}. ${getWorkerStatusCopy(restored.status)}`);
+      appendEvent("info", "Recovered worker context", `Worker ID ${restored.workerId}`);
+    } catch {
+      // Ignore invalid saved worker state.
+    }
+  }, []);
+
+  useEffect(() => {
+    if (typeof window === "undefined" || !worker) {
+      return;
+    }
+
+    const serializable: WorkerLaunch = {
+      ...worker,
+      clientToken: null,
+      ownerToken: null,
+      hostToken: null
+    };
+
+    window.localStorage.setItem(LAST_WORKER_STORAGE_KEY, JSON.stringify(serializable));
+  }, [worker]);
+
+  useEffect(() => {
+    if (!user || !worker) {
+      return;
+    }
+    if (pendingRestoredWorkerId === worker.workerId) {
+      return;
+    }
+    if (worker.ownerToken || worker.clientToken) {
+      return;
+    }
+    if (actionBusy !== null || launchBusy) {
+      return;
+    }
+    if (tokenFetchedForWorkerId === worker.workerId) {
+      return;
+    }
+
+    setTokenFetchedForWorkerId(worker.workerId);
+    void generateWorkerToken();
+  }, [actionBusy, launchBusy, pendingRestoredWorkerId, tokenFetchedForWorkerId, user, worker]);
+
+  const provisioningWorkerIds = workers
+    .filter((item) => item.status === "provisioning")
+    .map((item) => item.workerId);
+
+  useEffect(() => {
+    if (!user || provisioningWorkerIds.length === 0) {
+      return;
+    }
+
+    let cancelled = false;
+    const poll = async () => {
+      if (cancelled || actionBusy !== null || launchBusy) {
+        return;
+      }
+
+      await Promise.all(
+        provisioningWorkerIds.map((workerId) =>
+          checkWorkerStatus({ workerId, quiet: true, background: true }),
+        ),
+      );
+    };
+
+    void poll();
+    const interval = window.setInterval(() => {
+      void poll();
+    }, WORKER_STATUS_POLL_MS);
+
+    return () => {
+      cancelled = true;
+      window.clearInterval(interval);
+    };
+  }, [actionBusy, launchBusy, provisioningWorkerIds.join(","), user?.id]);
+
+  useEffect(() => {
+    const targetWorkerId = activeWorker?.workerId ?? selectedWorker?.workerId ?? null;
+    if (!user || !targetWorkerId || pendingRestoredWorkerId === targetWorkerId) {
+      setRuntimeSnapshot(null);
+      setRuntimeError(null);
+      return;
+    }
+
+    void refreshRuntime(targetWorkerId, { quiet: true });
+  }, [user?.id, authToken, activeWorker?.workerId, pendingRestoredWorkerId, selectedWorker?.workerId]);
+
+  useEffect(() => {
+    const targetWorkerId = activeWorker?.workerId ?? selectedWorker?.workerId ?? null;
+    if (!targetWorkerId || runtimeSnapshot?.upgrade.status !== "running") {
+      return;
+    }
+
+    const timer = window.setInterval(() => {
+      void refreshRuntime(targetWorkerId, { quiet: true });
+    }, WORKER_STATUS_POLL_MS);
+
+    return () => window.clearInterval(timer);
+  }, [activeWorker?.workerId, selectedWorker?.workerId, runtimeSnapshot?.upgrade.status]);
+
+  useEffect(() => {
+    if (!desktopAuthRequested || !user || desktopRedirectUrl || desktopRedirectBusy || desktopRedirectAttempted) {
+      return;
+    }
+
+    void completeDesktopAuthHandoff();
+  }, [desktopAuthRequested, user?.id, authToken, desktopRedirectUrl, desktopRedirectBusy, desktopRedirectAttempted, desktopAuthScheme]);
+
+  useEffect(() => {
+    if (!user || !onboardingPending) {
+      onboardingAutoLaunchKeyRef.current = null;
+      return;
+    }
+
+    if (!billingSummary) {
+      return;
+    }
+
+    if (billingSummary.featureGateEnabled && !billingSummary.hasActivePlan) {
+      return;
+    }
+
+    if (ownedWorkerCount > 0) {
+      markOnboardingComplete();
+      return;
+    }
+
+    if (launchBusy) {
+      return;
+    }
+
+    const autoLaunchKey = `${user.id}:${onboardingIntent?.workerName ?? DEFAULT_WORKER_NAME}`;
+    if (onboardingAutoLaunchKeyRef.current === autoLaunchKey) {
+      return;
+    }
+
+    onboardingAutoLaunchKeyRef.current = autoLaunchKey;
+    markOnboardingComplete();
+  }, [billingSummary?.featureGateEnabled, billingSummary?.hasActivePlan, launchBusy, onboardingIntent?.workerName, onboardingPending, ownedWorkerCount, user?.id]);
+
+  useEffect(() => {
+    if (!user) {
+      return;
+    }
+
+    if ((workerName === DEFAULT_WORKER_NAME || workerName.trim().length === 0) && !onboardingPending) {
+      setWorkerName(deriveOnboardingWorkerName(user));
+    }
+  }, [onboardingPending, user?.id, workerName]);
+
+  const showAuthFeedback = authInfo !== getAuthInfoForMode(authMode) || authError !== null;
+
+  const value: DenFlowContextValue = {
+    authMode,
+    setAuthMode,
+    email,
+    setEmail,
+    password,
+    setPassword,
+    verificationCode,
+    setVerificationCode,
+    verificationRequired,
+    authBusy,
+    authInfo,
+    authError,
+    user,
+    sessionHydrated,
+    desktopAuthRequested,
+    desktopAuthScheme,
+    desktopRedirectUrl,
+    desktopRedirectBusy,
+    showAuthFeedback,
+    submitAuth,
+    submitVerificationCode,
+    resendVerificationCode,
+    cancelVerification,
+    beginSocialAuth,
+    signOut,
+    resolveUserLandingRoute,
+    billingSummary,
+    billingBusy,
+    billingCheckoutBusy,
+    billingSubscriptionBusy,
+    billingError,
+    effectiveCheckoutUrl,
+    orgLimitError,
+    clearOrgLimitError: () => setOrgLimitError(null),
+    refreshBilling,
+    handleSubscriptionCancellation,
+    refreshCheckoutReturn,
+    onboardingPending,
+    onboardingDecisionBusy,
+    workers,
+    filteredWorkers,
+    workersBusy,
+    workersLoadedOnce,
+    workersError,
+    workerQuery,
+    setWorkerQuery,
+    workerStatusFilter,
+    setWorkerStatusFilter,
+    selectedWorker,
+    activeWorker,
+    selectWorker,
+    workerName,
+    setWorkerName,
+    launchBusy,
+    launchStatus,
+    launchError,
+    actionBusy,
+    deleteBusyWorkerId,
+    redeployBusyWorkerId,
+    renameBusyWorkerId,
+    runtimeSnapshot,
+    runtimeBusy,
+    runtimeError,
+    runtimeUpgradeBusy,
+    copiedField,
+    events,
+    openworkDeepLink,
+    openworkAppConnectUrl,
+    hasWorkspaceScopedUrl,
+    additionalWorkerNeedsPlan,
+    selectedStatusMeta,
+    isSelectedWorkerFailed,
+    ownedWorkerCount,
+    refreshWorkers,
+    launchWorker,
+    checkWorkerStatus,
+    generateWorkerToken,
+    renameWorker,
+    deleteWorker,
+    redeployWorker,
+    refreshRuntime,
+    upgradeRuntime,
+    copyToClipboard,
+    getRuntimeServiceLabel,
+  };
+
+  return createElement(DenFlowContext.Provider, { value }, children);
+}
+
+export function useDenFlow() {
+  const value = useContext(DenFlowContext);
+  if (!value) {
+    throw new Error("useDenFlow must be used within DenFlowProvider.");
+  }
+  return value;
+}
diff --git a/ee/apps/den-web/app/(den)/checkout/page.tsx b/ee/apps/den-web/app/(den)/checkout/page.tsx
new file mode 100644
index 0000000000..419ca0b5bf
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/checkout/page.tsx
@@ -0,0 +1,15 @@
+import { CheckoutScreen } from "../_components/checkout-screen";
+
+export default async function CheckoutPage({
+  searchParams,
+}: {
+  searchParams?: Promise<{ customer_session_token?: string }>;
+}) {
+  const resolvedSearchParams = await searchParams;
+
+  return (
+    <CheckoutScreen
+      customerSessionToken={resolvedSearchParams?.customer_session_token ?? null}
+    />
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/dashboard/api-keys/page.tsx b/ee/apps/den-web/app/(den)/dashboard/api-keys/page.tsx
new file mode 100644
index 0000000000..19fa5b48f0
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/api-keys/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/api-keys/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/background-agents/page.tsx b/ee/apps/den-web/app/(den)/dashboard/background-agents/page.tsx
new file mode 100644
index 0000000000..1457f1f671
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/background-agents/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/background-agents/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/billing/page.tsx b/ee/apps/den-web/app/(den)/dashboard/billing/page.tsx
new file mode 100644
index 0000000000..a1d7717869
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/billing/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/billing/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx
new file mode 100644
index 0000000000..1ac53126b6
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../../o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/edit/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/page.tsx b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/page.tsx
new file mode 100644
index 0000000000..067831fccc
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/[llmProviderId]/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/new/page.tsx b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/new/page.tsx
new file mode 100644
index 0000000000..6d86f703fb
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/new/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/custom-llm-providers/new/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/page.tsx b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/page.tsx
new file mode 100644
index 0000000000..be4bc0d7d4
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/custom-llm-providers/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/custom-llm-providers/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/integrations/github/page.tsx b/ee/apps/den-web/app/(den)/dashboard/integrations/github/page.tsx
new file mode 100644
index 0000000000..59ac9ec4b8
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/integrations/github/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/integrations/github/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/integrations/page.tsx b/ee/apps/den-web/app/(den)/dashboard/integrations/page.tsx
new file mode 100644
index 0000000000..d675194201
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/integrations/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/integrations/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/layout.tsx b/ee/apps/den-web/app/(den)/dashboard/layout.tsx
new file mode 100644
index 0000000000..cd1d053f33
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/layout.tsx
@@ -0,0 +1,17 @@
+import { OrgDashboardShell } from "../o/[orgSlug]/dashboard/_components/org-dashboard-shell";
+import { OrgDashboardProvider } from "../o/[orgSlug]/dashboard/_providers/org-dashboard-provider";
+import { DashboardQueryClientProvider } from "../o/[orgSlug]/dashboard/_providers/query-client-provider";
+
+export default function DashboardLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <DashboardQueryClientProvider>
+      <OrgDashboardProvider>
+        <OrgDashboardShell>{children}</OrgDashboardShell>
+      </OrgDashboardProvider>
+    </DashboardQueryClientProvider>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/dashboard/manage-members/page.tsx b/ee/apps/den-web/app/(den)/dashboard/manage-members/page.tsx
new file mode 100644
index 0000000000..0bca91b795
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/manage-members/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/manage-members/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/marketplaces/[marketplaceId]/page.tsx b/ee/apps/den-web/app/(den)/dashboard/marketplaces/[marketplaceId]/page.tsx
new file mode 100644
index 0000000000..38433394de
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/marketplaces/[marketplaceId]/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/marketplaces/[marketplaceId]/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/marketplaces/page.tsx b/ee/apps/den-web/app/(den)/dashboard/marketplaces/page.tsx
new file mode 100644
index 0000000000..cf78dc2b40
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/marketplaces/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/marketplaces/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/members/page.tsx b/ee/apps/den-web/app/(den)/dashboard/members/page.tsx
new file mode 100644
index 0000000000..e5ef35e3ea
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/members/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/members/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/org-settings/page.tsx b/ee/apps/den-web/app/(den)/dashboard/org-settings/page.tsx
new file mode 100644
index 0000000000..6a4420f86c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/org-settings/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/org-settings/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/page.tsx b/ee/apps/den-web/app/(den)/dashboard/page.tsx
new file mode 100644
index 0000000000..c5ed6749d3
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/page.tsx
@@ -0,0 +1 @@
+export { default } from "../o/[orgSlug]/dashboard/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/plugins/[pluginId]/page.tsx b/ee/apps/den-web/app/(den)/dashboard/plugins/[pluginId]/page.tsx
new file mode 100644
index 0000000000..ebe511720e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/plugins/[pluginId]/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/plugins/[pluginId]/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/plugins/page.tsx b/ee/apps/den-web/app/(den)/dashboard/plugins/page.tsx
new file mode 100644
index 0000000000..df703fc206
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/plugins/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/plugins/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/edit/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/edit/page.tsx
new file mode 100644
index 0000000000..bc6f4ebf9c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/edit/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../../o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/edit/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/page.tsx
new file mode 100644
index 0000000000..6d61f31c92
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/[skillHubId]/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/new/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/new/page.tsx
new file mode 100644
index 0000000000..5f9f239486
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/new/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../o/[orgSlug]/dashboard/skill-hubs/new/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/page.tsx
new file mode 100644
index 0000000000..9b41db596a
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../o/[orgSlug]/dashboard/skill-hubs/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx
new file mode 100644
index 0000000000..760275c152
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../../../o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/edit/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/page.tsx
new file mode 100644
index 0000000000..b512748224
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/[skillId]/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../../o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/page";
diff --git a/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/new/page.tsx b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/new/page.tsx
new file mode 100644
index 0000000000..09e4f8caaa
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/dashboard/skill-hubs/skills/new/page.tsx
@@ -0,0 +1 @@
+export { default } from "../../../../o/[orgSlug]/dashboard/skill-hubs/skills/new/page";
diff --git a/ee/apps/den-web/app/(den)/join-org/page.tsx b/ee/apps/den-web/app/(den)/join-org/page.tsx
new file mode 100644
index 0000000000..4b4ef7518e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/join-org/page.tsx
@@ -0,0 +1,17 @@
+import { JoinOrgScreen } from "../_components/join-org-screen";
+
+export default async function JoinOrgPage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | string[] | undefined>>;
+}) {
+  const params = await searchParams;
+  const inviteParam = params.invite;
+  const invitationId = typeof inviteParam === "string"
+    ? inviteParam.trim()
+    : Array.isArray(inviteParam)
+      ? (inviteParam[0]?.trim() ?? "")
+      : "";
+
+  return <JoinOrgScreen invitationId={invitationId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/layout.tsx b/ee/apps/den-web/app/(den)/layout.tsx
new file mode 100644
index 0000000000..7e6b177351
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/layout.tsx
@@ -0,0 +1,10 @@
+import { DenShell } from "./_components/den-shell";
+import { DenFlowProvider } from "./_providers/den-flow-provider";
+
+export default function DenLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <DenFlowProvider>
+      <DenShell>{children}</DenShell>
+    </DenFlowProvider>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/api-keys-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/api-keys-screen.tsx
new file mode 100644
index 0000000000..bab5b1b3b8
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/api-keys-screen.tsx
@@ -0,0 +1,445 @@
+"use client";
+
+import { type FormEvent, useEffect, useMemo, useState } from "react";
+import { Copy, KeyRound, Trash2 } from "lucide-react";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenCard } from "../../../../_components/ui/card";
+import { DenInput } from "../../../../_components/ui/input";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+    getOrgAccessFlags,
+    parseOrgApiKeysPayload,
+    type DenOrgApiKey,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+function formatDateTime(value: string | null) {
+    if (!value) {
+        return "Never";
+    }
+
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) {
+        return "Never";
+    }
+
+    return date.toLocaleString();
+}
+
+function formatKeyPreview(apiKey: DenOrgApiKey) {
+    if (apiKey.start) {
+        return `${apiKey.start}...`;
+    }
+
+    if (apiKey.prefix) {
+        return `${apiKey.prefix}${apiKey.id.slice(0, 6)}...`;
+    }
+
+    return `${apiKey.id.slice(0, 6)}...`;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null;
+}
+
+function getCreatedKey(payload: unknown) {
+    if (!isRecord(payload) || typeof payload.key !== "string") {
+        return null;
+    }
+
+    return payload.key;
+}
+
+export function ApiKeysScreen() {
+    const { orgId, orgContext } = useOrgDashboard();
+    const [apiKeys, setApiKeys] = useState<DenOrgApiKey[]>([]);
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+    const [name, setName] = useState("");
+    const [creating, setCreating] = useState(false);
+    const [deletingId, setDeletingId] = useState<string | null>(null);
+    const [showCreateForm, setShowCreateForm] = useState(false);
+    const [createdKey, setCreatedKey] = useState<string | null>(null);
+    const [createdKeyName, setCreatedKeyName] = useState<string | null>(null);
+    const [copied, setCopied] = useState(false);
+
+    const access = useMemo(
+        () =>
+            getOrgAccessFlags(
+                orgContext?.currentMember.role ?? "member",
+                orgContext?.currentMember.isOwner ?? false,
+            ),
+        [orgContext?.currentMember.isOwner, orgContext?.currentMember.role],
+    );
+
+    async function loadApiKeys() {
+        if (!orgId || !access.canManageApiKeys) {
+            setApiKeys([]);
+            return;
+        }
+
+        setBusy(true);
+        setError(null);
+        try {
+            const { response, payload } = await requestJson(
+                `/v1/api-keys`,
+                { method: "GET" },
+                12000,
+            );
+            if (!response.ok) {
+                throw new Error(
+                    getErrorMessage(
+                        payload,
+                        `Failed to load API keys (${response.status}).`,
+                    ),
+                );
+            }
+
+            setApiKeys(parseOrgApiKeysPayload(payload));
+        } catch (nextError) {
+            setError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Failed to load API keys.",
+            );
+        } finally {
+            setBusy(false);
+        }
+    }
+
+    useEffect(() => {
+        void loadApiKeys();
+    }, [orgId, access.canManageApiKeys]);
+
+    useEffect(() => {
+        if (!copied) {
+            return;
+        }
+
+        const timeout = window.setTimeout(() => setCopied(false), 1500);
+        return () => window.clearTimeout(timeout);
+    }, [copied]);
+
+    async function handleCreate(event: FormEvent<HTMLFormElement>) {
+        event.preventDefault();
+        if (!orgId) {
+            setError("Organization not found.");
+            return;
+        }
+
+        setCreating(true);
+        setError(null);
+        setCreatedKey(null);
+        setCreatedKeyName(null);
+        setCopied(false);
+        try {
+            const { response, payload } = await requestJson(
+                `/v1/api-keys`,
+                {
+                    method: "POST",
+                    body: JSON.stringify({ name }),
+                },
+                12000,
+            );
+
+            if (!response.ok) {
+                throw new Error(
+                    getErrorMessage(
+                        payload,
+                        `Failed to create API key (${response.status}).`,
+                    ),
+                );
+            }
+
+            const nextKey = getCreatedKey(payload);
+            if (!nextKey) {
+                throw new Error(
+                    "API key was created, but the secret was not returned.",
+                );
+            }
+
+            setCreatedKey(nextKey);
+            setCreatedKeyName(name);
+            setName("");
+            setShowCreateForm(false);
+            await loadApiKeys();
+        } catch (nextError) {
+            setError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Failed to create API key.",
+            );
+        } finally {
+            setCreating(false);
+        }
+    }
+
+    function openCreateForm() {
+        setError(null);
+        setCopied(false);
+        setCreatedKey(null);
+        setCreatedKeyName(null);
+        setName("");
+        setShowCreateForm(true);
+    }
+
+    function closeCreateForm() {
+        setName("");
+        setShowCreateForm(false);
+    }
+
+    async function handleDelete(apiKey: DenOrgApiKey) {
+        if (
+            !orgId ||
+            !window.confirm(
+                `Delete ${apiKey.name ?? apiKey.start ?? "this API key"}? This cannot be undone.`,
+            )
+        ) {
+            return;
+        }
+
+        setDeletingId(apiKey.id);
+        setError(null);
+        try {
+            const { response, payload } = await requestJson(
+                `/v1/api-keys/${encodeURIComponent(apiKey.id)}`,
+                { method: "DELETE" },
+                12000,
+            );
+
+            if (response.status !== 204 && !response.ok) {
+                throw new Error(
+                    getErrorMessage(
+                        payload,
+                        `Failed to delete API key (${response.status}).`,
+                    ),
+                );
+            }
+
+            await loadApiKeys();
+        } catch (nextError) {
+            setError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Failed to delete API key.",
+            );
+        } finally {
+            setDeletingId(null);
+        }
+    }
+
+    async function copyCreatedKey() {
+        if (!createdKey) {
+            return;
+        }
+
+        try {
+            await navigator.clipboard.writeText(createdKey);
+            setCopied(true);
+        } catch {
+            setError(
+                "Could not copy the API key. Copy it manually before leaving this page.",
+            );
+        }
+    }
+
+    if (!orgContext) {
+        return (
+            <DashboardPageTemplate
+                icon={KeyRound}
+                badgeLabel="Admin"
+                title="API Keys"
+                description="Create named, rate-limited API keys for your own org membership and revoke any key in the workspace when needed."
+                colors={["#E6FFFA", "#0F766E", "#14B8A6", "#99F6E4"]}
+            >
+                <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+                    Loading organization details...
+                </div>
+            </DashboardPageTemplate>
+        );
+    }
+
+    return (
+        <DashboardPageTemplate
+            icon={KeyRound}
+            badgeLabel="Admin"
+            title="API Keys"
+            description="Manage your OpenWork API keys."
+            colors={["#E6FFFA", "#0F766E", "#14B8A6", "#99F6E4"]}
+        >
+            {!access.canManageApiKeys ? (
+                <div className="rounded-[28px] border border-amber-200 bg-amber-50 px-6 py-5 text-[14px] text-amber-900">
+                    Only organization owners and admins can view or manage API
+                    keys.
+                </div>
+            ) : (
+                <>
+                    {error ? (
+                        <div className="mb-6 rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[14px] text-red-700">
+                            {error}
+                        </div>
+                    ) : null}
+
+                    <DenCard className="mb-6">
+                        {createdKey ? (
+                            <div className="rounded-[24px] bg-[#0f172a] p-6 text-white">
+                                <div className="flex flex-wrap items-start justify-between gap-4">
+                                    <div>
+                                        <p className="text-[16px] font-semibold tracking-[-0.03em]">
+                                            {createdKeyName
+                                                ? `${createdKeyName} is ready`
+                                                : "Your new API key is ready"}
+                                        </p>
+                                        <p className="mt-1 text-[14px] leading-6 text-slate-300">
+                                            The key will only be shown once.
+                                        </p>
+                                    </div>
+                                </div>
+
+                                <div className="mt-5 rounded-[20px] border border-white/10 bg-white/5 p-4">
+                                    <code className="block break-all text-[13px] leading-6 text-emerald-200">
+                                        {createdKey}
+                                    </code>
+                                </div>
+
+                                <div className="mt-5 flex flex-wrap justify-end gap-3">
+                                    <DenButton
+                                        variant="secondary"
+                                        icon={Copy}
+                                        onClick={() => void copyCreatedKey()}
+                                    >
+                                        {copied ? "Copied" : "Copy key"}
+                                    </DenButton>
+                                    <DenButton onClick={openCreateForm}>
+                                        Create another key
+                                    </DenButton>
+                                </div>
+                            </div>
+                        ) : showCreateForm ? (
+                            <form onSubmit={handleCreate}>
+                                <div className="mb-5 flex items-start justify-between gap-4">
+                                    <div>
+                                        <p className="text-[16px] font-semibold tracking-[-0.03em] text-gray-900">
+                                            Issue a new key
+                                        </p>
+                                        <p className="mt-1 text-[14px] leading-6 text-gray-500">
+                                            Keys are issued to you for this
+                                            organization only.
+                                        </p>
+                                    </div>
+                                </div>
+
+                                <label className="grid gap-3">
+                                    <span className="text-[14px] font-medium text-gray-700">
+                                        Key name
+                                    </span>
+                                    <DenInput
+                                        type="text"
+                                        value={name}
+                                        onChange={(event) =>
+                                            setName(event.target.value)
+                                        }
+                                        placeholder="CI worker"
+                                        required
+                                    />
+                                </label>
+
+                                <div className="mt-5 flex flex-wrap justify-end gap-3">
+                                    <DenButton
+                                        type="button"
+                                        variant="secondary"
+                                        onClick={closeCreateForm}
+                                    >
+                                        Cancel
+                                    </DenButton>
+                                    <DenButton type="submit" loading={creating}>
+                                        Create API key
+                                    </DenButton>
+                                </div>
+                            </form>
+                        ) : (
+                            <div className="flex flex-wrap items-center justify-between gap-4">
+                                <div>
+                                    <p className="text-[16px] font-semibold tracking-[-0.03em] text-gray-900">
+                                        Create a new API key
+                                    </p>
+                                </div>
+                                 <DenButton onClick={openCreateForm}>
+                                    New key
+                                </DenButton>
+                            </div>
+                        )}
+                    </DenCard>
+
+                    <div className="overflow-hidden rounded-[28px] border border-gray-100 bg-white">
+                        <div className="grid grid-cols-[minmax(0,1.6fr)_minmax(0,1fr)_180px_120px] gap-4 border-b border-gray-100 px-6 py-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                            <span>Key</span>
+                            <span>Owner</span>
+                            <span>Last used</span>
+                            <span />
+                        </div>
+
+                        {busy ? (
+                            <div className="px-6 py-8 text-center text-[13px] text-gray-400">
+                                Loading API keys...
+                            </div>
+                        ) : apiKeys.length === 0 ? (
+                            <div className="px-6 py-8 text-center text-[13px] text-gray-400">
+                                No API keys for this workspace yet.
+                            </div>
+                        ) : (
+                            apiKeys.map((apiKey) => (
+                                <div
+                                    key={apiKey.id}
+                                    className="grid grid-cols-[minmax(0,1.6fr)_minmax(0,1fr)_180px_120px] items-center gap-4 border-b border-gray-100 px-6 py-4 transition hover:bg-gray-50/70 last:border-b-0"
+                                >
+                                    <div className="min-w-0">
+                                        <p className="truncate text-[14px] font-medium text-gray-900">
+                                            {apiKey.name ??
+                                                apiKey.start ??
+                                                "Untitled key"}
+                                        </p>
+                                        <p className="mt-1 truncate text-[12px] text-gray-400">
+                                            {formatKeyPreview(apiKey)}{" "}
+                                            {formatDateTime(apiKey.createdAt)}
+                                        </p>
+                                    </div>
+
+                                    <div className="min-w-0">
+                                        <p className="truncate text-[13px] font-medium text-gray-900">
+                                            {apiKey.owner.name}
+                                        </p>
+                                        <p className="truncate text-[12px] text-gray-400">
+                                            {apiKey.owner.email}
+                                        </p>
+                                    </div>
+
+                                    <span className="text-[13px] text-gray-500">
+                                        {formatDateTime(apiKey.lastRequest)}
+                                    </span>
+
+                                    <div className="flex justify-end">
+                                        <DenButton
+                                            variant="destructive"
+                                            size="sm"
+                                            icon={Trash2}
+                                            onClick={() =>
+                                                void handleDelete(apiKey)
+                                            }
+                                            disabled={deletingId === apiKey.id}
+                                        >
+                                            {deletingId === apiKey.id
+                                                ? "Deleting..."
+                                                : "Delete"}
+                                        </DenButton>
+                                    </div>
+                                </div>
+                            ))
+                        )}
+                    </div>
+                </>
+            )}
+        </DashboardPageTemplate>
+    );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/background-agents-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/background-agents-screen.tsx
new file mode 100644
index 0000000000..3a4aa78b0d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/background-agents-screen.tsx
@@ -0,0 +1,504 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import {
+  Bot,
+  Box,
+  Check,
+  ChevronDown,
+  ChevronUp,
+  Copy,
+  ExternalLink,
+  KeyRound,
+  Monitor,
+  MoreHorizontal,
+  Plus,
+  RefreshCw,
+  Search,
+} from "lucide-react";
+import { DenInput } from "../../../../_components/ui/input";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenButton } from "../../../../_components/ui/button";
+import { OrgLimitDialog } from "../../../../_components/org-limit-dialog";
+import {
+  OPENWORK_APP_CONNECT_BASE_URL,
+  buildOpenworkAppConnectUrl,
+  buildOpenworkDeepLink,
+  getErrorMessage,
+  getWorkerStatusMeta,
+  getWorkerTokens,
+  requestJson,
+  type WorkerListItem,
+} from "../../../../_lib/den-flow";
+import { buildDenFeedbackUrl } from "../../../../_lib/feedback";
+import { useDenFlow } from "../../../../_providers/den-flow-provider";
+import { getBackgroundAgentsRoute } from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+type ConnectionDetails = {
+  openworkUrl: string | null;
+  ownerToken: string | null;
+  clientToken: string | null;
+  openworkAppConnectUrl: string | null;
+  openworkDeepLink: string | null;
+};
+
+function getStatusBadgeClass(bucket: ReturnType<typeof getWorkerStatusMeta>["bucket"]) {
+  switch (bucket) {
+    case "ready":
+      return "border-emerald-100 bg-emerald-50 text-emerald-600";
+    case "starting":
+      return "border-amber-100 bg-amber-50 text-amber-600";
+    case "attention":
+      return "border-rose-100 bg-rose-50 text-rose-600";
+    default:
+      return "border-gray-100 bg-gray-50 text-gray-500";
+  }
+}
+
+function CredentialField({
+  id,
+  label,
+  value,
+  onCopy,
+  copied,
+}: {
+  id: string;
+  label: string;
+  value: string;
+  onCopy: (field: string, text: string) => void;
+  copied: boolean;
+}) {
+  return (
+    <div>
+      <label className="mb-1.5 block text-[12px] text-gray-500">{label}</label>
+      <div className="flex items-center gap-2">
+        <input
+          readOnly
+          value={value}
+          className="flex-1 rounded-lg border border-gray-200 bg-white px-3 py-2 text-[12px] font-mono text-gray-600 outline-none shadow-sm transition-colors focus:border-gray-300"
+          onClick={(event) => event.currentTarget.select()}
+        />
+        <button
+          type="button"
+          onClick={() => onCopy(id, value)}
+          className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border border-gray-200 bg-white text-gray-400 shadow-sm transition-colors hover:border-gray-300 hover:text-gray-700"
+          aria-label={`Copy ${label}`}
+        >
+          {copied ? <Check size={14} className="text-emerald-500" /> : <Copy size={14} />}
+        </button>
+      </div>
+    </div>
+  );
+}
+
+function SandboxCard({
+  sandbox,
+  expanded,
+  details,
+  connectBusy,
+  renameBusy,
+  onToggle,
+  onRefresh,
+  onRename,
+}: {
+  sandbox: WorkerListItem;
+  expanded: boolean;
+  details: ConnectionDetails | null;
+  connectBusy: boolean;
+  renameBusy: boolean;
+  onToggle: () => void;
+  onRefresh: () => void;
+  onRename: () => void;
+}) {
+  const [showTokens, setShowTokens] = useState(false);
+  const [copiedField, setCopiedField] = useState<string | null>(null);
+  const meta = getWorkerStatusMeta(sandbox.status);
+  const canConnect = meta.bucket === "ready";
+  const connectionUrl = details?.openworkUrl ?? sandbox.instanceUrl ?? null;
+  const ownerToken = details?.ownerToken ?? null;
+  const clientToken = details?.clientToken ?? null;
+  const openWebUrl = details?.openworkAppConnectUrl ?? null;
+  const openDesktopUrl = details?.openworkDeepLink ?? null;
+
+  async function handleCopy(field: string, text: string) {
+    await navigator.clipboard.writeText(text);
+    setCopiedField(field);
+    window.setTimeout(() => {
+      setCopiedField((current) => (current === field ? null : current));
+    }, 2000);
+  }
+
+  const credentialFields = [
+    connectionUrl ? { id: "url", label: "Connection URL", value: connectionUrl } : null,
+    ownerToken ? { id: "owner", label: "Owner token", value: ownerToken } : null,
+    clientToken ? { id: "client", label: "Client token", value: clientToken } : null,
+  ].filter((field): field is { id: string; label: string; value: string } => Boolean(field));
+
+  return (
+    <div className="rounded-2xl border border-gray-100 bg-white p-5 transition-all hover:border-gray-200 hover:shadow-[0_2px_8px_-4px_rgba(0,0,0,0.04)]">
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex items-center gap-4">
+          <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-gray-100 bg-gray-50">
+            <Box size={18} className="text-gray-400" />
+          </div>
+          <div>
+            <h3 className="mb-0.5 flex items-center gap-2 text-[14px] font-medium text-gray-900">
+              {sandbox.workerName}
+              <span
+                className={`flex items-center gap-1.5 rounded-full border px-2 py-0.5 text-[10px] font-medium uppercase tracking-[0.5px] ${getStatusBadgeClass(meta.bucket)}`}
+              >
+                <span className="h-1.5 w-1.5 rounded-full bg-current" />
+                {meta.label}
+              </span>
+            </h3>
+            <p className="text-[12px] text-gray-400">
+              Source: {sandbox.provider ? `${sandbox.provider} sandbox` : "cloud sandbox"}
+            </p>
+          </div>
+        </div>
+        <div className="flex items-center gap-2">
+          <button
+            type="button"
+            onClick={() => {
+              if (expanded) {
+                setShowTokens(false);
+              }
+              onToggle();
+            }}
+            disabled={!canConnect}
+            className={`flex items-center gap-1.5 rounded-lg px-3 py-1.5 text-[13px] font-medium transition-colors ${
+              expanded
+                ? "bg-gray-100 text-gray-900 hover:bg-gray-200"
+                : "bg-gray-50 text-gray-700 hover:bg-gray-100 hover:text-gray-900"
+            } disabled:cursor-not-allowed disabled:opacity-60`}
+          >
+            {expanded ? "Hide details" : "Connect"}
+            {expanded ? <ChevronUp size={14} /> : <ChevronDown size={14} />}
+          </button>
+          <button
+            type="button"
+            onClick={onRename}
+            disabled={renameBusy}
+            className="flex h-8 w-8 items-center justify-center rounded-lg text-gray-400 transition-colors hover:bg-gray-50 hover:text-gray-900 disabled:cursor-not-allowed disabled:opacity-60"
+            aria-label={`Rename ${sandbox.workerName}`}
+          >
+            <MoreHorizontal size={16} />
+          </button>
+        </div>
+      </div>
+
+      {expanded ? (
+        <div className="mt-5 border-t border-gray-100 pt-5">
+          <div className="flex flex-col gap-3 sm:flex-row">
+            <button
+              type="button"
+              onClick={() => {
+                if (openDesktopUrl) {
+                  window.location.href = openDesktopUrl;
+                }
+              }}
+              disabled={!openDesktopUrl}
+              className="flex flex-1 items-center justify-center gap-2 rounded-xl bg-gray-900 py-2.5 text-[13px] font-medium text-white shadow-sm transition-colors hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-60"
+            >
+              <Monitor size={15} /> Open in desktop
+            </button>
+
+            {openWebUrl ? (
+              <a
+                href={openWebUrl}
+                target="_blank"
+                rel="noreferrer"
+                className="flex flex-1 items-center justify-center gap-2 rounded-xl border border-gray-200 bg-white py-2.5 text-[13px] font-medium text-gray-700 shadow-sm transition-colors hover:bg-gray-50"
+              >
+                <ExternalLink size={15} /> Open in web
+              </a>
+            ) : (
+              <button
+                type="button"
+                disabled
+                className="flex flex-1 items-center justify-center gap-2 rounded-xl border border-gray-200 bg-white py-2.5 text-[13px] font-medium text-gray-700 shadow-sm opacity-60"
+              >
+                <ExternalLink size={15} /> Open in web
+              </button>
+            )}
+          </div>
+
+          {canConnect ? (
+            <div className="mt-4">
+              <button
+                type="button"
+                onClick={() => setShowTokens((current) => !current)}
+                className="flex w-full items-center justify-between rounded-xl border border-gray-100 bg-gray-50/50 px-4 py-2.5 text-[12px] font-medium text-gray-600 transition-colors hover:bg-gray-50"
+              >
+                <span className="flex items-center gap-2">
+                  <KeyRound size={14} className="text-gray-400" />
+                  Connection credentials
+                </span>
+                {showTokens ? (
+                  <ChevronUp size={14} className="text-gray-400" />
+                ) : (
+                  <ChevronDown size={14} className="text-gray-400" />
+                )}
+              </button>
+
+              {showTokens ? (
+                <div className="mt-2 space-y-4 rounded-xl border border-gray-100 bg-gray-50/50 p-5">
+                  <div className="mb-2 flex items-center justify-between">
+                    <span className="text-[10px] font-semibold uppercase tracking-[1px] text-gray-500">
+                      Access Tokens
+                    </span>
+                    <button
+                      type="button"
+                      onClick={onRefresh}
+                      disabled={connectBusy}
+                      className="flex items-center gap-1.5 text-[12px] font-medium text-gray-500 transition-colors hover:text-gray-900 disabled:cursor-not-allowed disabled:opacity-60"
+                    >
+                      <RefreshCw size={13} className={connectBusy ? "animate-spin" : ""} />
+                      {connectBusy ? "Refreshing..." : "Refresh tokens"}
+                    </button>
+                  </div>
+
+                  {credentialFields.length > 0 ? (
+                    credentialFields.map((field) => (
+                      <CredentialField
+                        key={field.id}
+                        id={field.id}
+                        label={field.label}
+                        value={field.value}
+                        onCopy={handleCopy}
+                        copied={copiedField === field.id}
+                      />
+                    ))
+                  ) : (
+                    <p className="text-[12px] text-gray-500">
+                      {connectBusy
+                        ? "Loading connection credentials..."
+                        : "Connection credentials will appear here once the workspace is ready."}
+                    </p>
+                  )}
+                </div>
+              ) : null}
+            </div>
+          ) : (
+            <p className="mt-4 text-[12px] text-gray-500">
+              Connection details will appear once this workspace is ready.
+            </p>
+          )}
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+export function BackgroundAgentsScreen() {
+  const router = useRouter();
+  const { orgSlug } = useOrgDashboard();
+  const [expandedWorkerId, setExpandedWorkerId] = useState<string | null>(null);
+  const [connectBusyWorkerId, setConnectBusyWorkerId] = useState<string | null>(null);
+  const [connectError, setConnectError] = useState<string | null>(null);
+  const [connectionDetailsByWorkerId, setConnectionDetailsByWorkerId] = useState<
+    Record<string, ConnectionDetails>
+  >({});
+  const {
+    filteredWorkers,
+    workerQuery,
+    setWorkerQuery,
+    workersBusy,
+    workersLoadedOnce,
+    workersError,
+    launchBusy,
+    launchWorker,
+    orgLimitError,
+    clearOrgLimitError,
+    renameWorker,
+    renameBusyWorkerId,
+  } = useDenFlow();
+  const feedbackHref = buildDenFeedbackUrl({
+    pathname: getBackgroundAgentsRoute(orgSlug),
+    orgSlug,
+    topic: "workspace-limits",
+  });
+
+  async function handleAddWorkspace() {
+    const result = await launchWorker({ source: "manual" });
+    if (result === "checkout") {
+      router.push("/checkout");
+    }
+  }
+
+  async function loadConnectionDetails(workerId: string, workerName: string) {
+    setConnectBusyWorkerId(workerId);
+    setConnectError(null);
+
+    try {
+      const { response, payload } = await requestJson(
+        `/v1/workers/${encodeURIComponent(workerId)}/tokens`,
+        {
+          method: "POST",
+          body: JSON.stringify({}),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(
+          getErrorMessage(payload, `Failed to load connection details (${response.status}).`),
+        );
+      }
+
+      const tokens = getWorkerTokens(payload);
+      if (!tokens) {
+        throw new Error("Connection details were missing from the worker response.");
+      }
+
+      const nextDetails: ConnectionDetails = {
+        openworkUrl: tokens.openworkUrl,
+        ownerToken: tokens.ownerToken,
+        clientToken: tokens.clientToken,
+        openworkAppConnectUrl: buildOpenworkAppConnectUrl(
+          OPENWORK_APP_CONNECT_BASE_URL,
+          tokens.openworkUrl,
+          tokens.clientToken,
+          workerId,
+          workerName,
+          { autoConnect: true },
+        ),
+        openworkDeepLink: buildOpenworkDeepLink(
+          tokens.openworkUrl,
+          tokens.clientToken,
+          workerId,
+          workerName,
+        ),
+      };
+
+      setConnectionDetailsByWorkerId((current) => ({
+        ...current,
+        [workerId]: nextDetails,
+      }));
+    } catch (error) {
+      setConnectError(
+        error instanceof Error ? error.message : "Failed to load connection details.",
+      );
+    } finally {
+      setConnectBusyWorkerId(null);
+    }
+  }
+
+  async function toggleSandbox(worker: WorkerListItem) {
+    const meta = getWorkerStatusMeta(worker.status);
+    if (meta.bucket !== "ready") {
+      return;
+    }
+
+    if (expandedWorkerId === worker.workerId) {
+      setExpandedWorkerId(null);
+      return;
+    }
+
+    setExpandedWorkerId(worker.workerId);
+    if (!connectionDetailsByWorkerId[worker.workerId]) {
+      await loadConnectionDetails(worker.workerId, worker.workerName);
+    }
+  }
+
+  return (
+    <DashboardPageTemplate
+      icon={Bot}
+      badgeLabel="Alpha"
+      title="Shared Workspaces"
+      description="Keep selected workflows running in the background without asking each teammate to run them locally."
+      colors={["#E9FFE0", "#3E9A1D", "#B3F750", "#51F0A3"]}
+    >
+      <OrgLimitDialog
+        open={Boolean(orgLimitError)}
+        title={orgLimitError?.limitType === "workers" ? "Worker limit reached" : "Member limit reached"}
+        message={orgLimitError?.message ?? "This workspace reached its current plan limit."}
+        detail={
+          orgLimitError
+            ? `${orgLimitError.currentCount} of ${orgLimitError.limit} ${orgLimitError.limitType} are already in use.`
+            : null
+        }
+        feedbackHref={feedbackHref}
+        onClose={clearOrgLimitError}
+      />
+
+      <div className="mb-10 flex items-center gap-3">
+        <DenButton
+          icon={Plus}
+          loading={launchBusy}
+          onClick={() => void handleAddWorkspace()}
+        >
+          Add workspace
+        </DenButton>
+      </div>
+
+      {workersError ? (
+        <div className="mb-4 rounded-2xl border border-red-200 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+          {workersError}
+        </div>
+      ) : null}
+      {connectError ? (
+        <div className="mb-4 rounded-2xl border border-red-200 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+          {connectError}
+        </div>
+      ) : null}
+
+      <div>
+        <div className="mb-4 flex items-center justify-between gap-4">
+          <h2 className="text-[15px] font-medium tracking-[-0.2px] text-gray-900">
+            Current workspaces
+          </h2>
+          <div className="w-full max-w-[240px]">
+            <DenInput
+              type="text"
+              icon={Search}
+              value={workerQuery}
+              onChange={(event) => setWorkerQuery(event.target.value)}
+              placeholder="Search workspaces..."
+            />
+          </div>
+        </div>
+
+        <div className="space-y-3">
+          {!workersLoadedOnce ? (
+            <div className="rounded-2xl border border-gray-100 bg-white p-5 text-[13px] text-gray-500">
+              Loading workspaces...
+            </div>
+          ) : filteredWorkers.length === 0 ? (
+            <div className="rounded-2xl border border-gray-100 bg-white p-5 text-[13px] text-gray-500">
+              {workerQuery.trim()
+                ? "No workspaces match that search yet."
+                : "No workspaces launched yet. Add one to start connecting cloud workflows."}
+            </div>
+          ) : (
+            filteredWorkers.map((sandbox) => (
+              <SandboxCard
+                key={sandbox.workerId}
+                sandbox={sandbox}
+                expanded={expandedWorkerId === sandbox.workerId}
+                details={connectionDetailsByWorkerId[sandbox.workerId] ?? null}
+                connectBusy={connectBusyWorkerId === sandbox.workerId}
+                renameBusy={renameBusyWorkerId === sandbox.workerId}
+                onToggle={() => void toggleSandbox(sandbox)}
+                onRefresh={() => void loadConnectionDetails(sandbox.workerId, sandbox.workerName)}
+                onRename={() => {
+                  const nextName = window.prompt("Rename workspace", sandbox.workerName)?.trim();
+                  if (!nextName || nextName === sandbox.workerName) {
+                    return;
+                  }
+                  void renameWorker(sandbox.workerId, nextName);
+                }}
+              />
+            ))
+          )}
+        </div>
+      </div>
+
+      {workersLoadedOnce && workersBusy ? (
+        <p className="mt-4 text-[12px] text-gray-400">Refreshing workspaces…</p>
+      ) : null}
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/billing-dashboard-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/billing-dashboard-screen.tsx
new file mode 100644
index 0000000000..442a4a77fb
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/billing-dashboard-screen.tsx
@@ -0,0 +1,215 @@
+"use client";
+
+import { useEffect } from "react";
+import { CreditCard } from "lucide-react";
+import { DenButton, buttonVariants } from "../../../../_components/ui/button";
+import {
+  formatIsoDate,
+  formatMoneyMinor,
+  formatRecurringInterval,
+  formatSubscriptionStatus,
+} from "../../../../_lib/den-flow";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { useDenFlow } from "../../../../_providers/den-flow-provider";
+
+export function BillingDashboardScreen() {
+  const {
+    sessionHydrated,
+    user,
+    billingSummary,
+    billingBusy,
+    billingCheckoutBusy,
+    billingSubscriptionBusy,
+    billingError,
+    effectiveCheckoutUrl,
+    refreshBilling,
+    handleSubscriptionCancellation,
+  } = useDenFlow();
+
+  useEffect(() => {
+    if (!sessionHydrated || !user || billingSummary || billingBusy || billingCheckoutBusy) {
+      return;
+    }
+
+    void refreshBilling({ includeCheckout: true, quiet: true });
+  }, [
+    billingBusy,
+    billingCheckoutBusy,
+    billingSummary,
+    refreshBilling,
+    sessionHydrated,
+    user,
+  ]);
+
+  if (!sessionHydrated) {
+    return (
+      <DashboardPageTemplate
+        icon={CreditCard}
+        title="Billing"
+        description="Manage your plan, view usage, and update payment details."
+        colors={["#EFF6FF", "#1E3A5F", "#3B82F6", "#93C5FD"]}
+      >
+        <div className="rounded-[20px] border border-gray-100 bg-white px-5 py-8 text-[14px] text-gray-500">
+          Checking billing details…
+        </div>
+      </DashboardPageTemplate>
+    );
+  }
+
+  const billingPrice = billingSummary?.price ?? null;
+  const subscription = billingSummary?.subscription ?? null;
+  const planAmountLabel = billingPrice
+    ? `${formatMoneyMinor(billingPrice.amount, billingPrice.currency)} · ${formatRecurringInterval(
+        billingPrice.recurringInterval,
+        billingPrice.recurringIntervalCount,
+      )}`
+    : "Not available";
+  const statusLabel = subscription
+    ? formatSubscriptionStatus(subscription.status)
+    : billingSummary?.hasActivePlan
+      ? "Active"
+      : "Purchase required";
+  const nextBillingDate = subscription?.currentPeriodEnd
+    ? formatIsoDate(subscription.currentPeriodEnd)
+    : "Not available";
+  const nextPaymentAmount = subscription?.amount
+    ? formatMoneyMinor(subscription.amount, subscription.currency)
+    : billingPrice
+      ? formatMoneyMinor(billingPrice.amount, billingPrice.currency)
+      : "Not available";
+
+  return (
+    <DashboardPageTemplate
+      icon={CreditCard}
+      title="Billing"
+      description="Manage your plan, view usage, and update payment details."
+      colors={["#EFF6FF", "#1E3A5F", "#3B82F6", "#93C5FD"]}
+    >
+      {billingError ? (
+        <div className="mb-6 rounded-[20px] border border-red-200 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+          {billingError}
+        </div>
+      ) : null}
+
+      <div className="mb-6 rounded-[20px] border border-gray-100 bg-white p-8 shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)]">
+        <div className="mb-8 border-b border-gray-100 pb-6">
+            <p className="text-[15px] text-gray-700">
+              {billingSummary?.hasActivePlan
+                ? `This workspace's plan is currently ${statusLabel.toLowerCase()} and renews on ${nextBillingDate}.`
+                : "Workspace plans are $50/month and include up to 5 members plus 1 hosted worker."}
+            </p>
+        </div>
+
+        <div className="mb-10 grid grid-cols-1 gap-x-6 gap-y-8 md:grid-cols-2 lg:grid-cols-3">
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Current plan</h2>
+            <div className="text-[15px] font-medium text-gray-900">{statusLabel}</div>
+          </div>
+
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Plan cost</h2>
+            <div className="text-[15px] font-medium text-gray-900">{planAmountLabel}</div>
+          </div>
+
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Next billing date</h2>
+            <div className="text-[15px] font-medium text-gray-900">{nextBillingDate}</div>
+          </div>
+
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Next payment amount</h2>
+            <div className="text-[15px] font-medium text-gray-900">{nextPaymentAmount}</div>
+          </div>
+
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Billing period</h2>
+            <span className="text-[15px] font-medium text-gray-900">
+              {billingPrice
+                ? formatRecurringInterval(
+                    billingPrice.recurringInterval,
+                    billingPrice.recurringIntervalCount,
+                  )
+                : "Not available"}
+            </span>
+          </div>
+
+          <div>
+            <h2 className="mb-2 text-[13px] font-medium text-gray-500">Invoices</h2>
+            <span className="text-[15px] font-medium text-gray-900">
+              {billingSummary?.invoices.length ?? 0}
+            </span>
+          </div>
+        </div>
+
+        <div className="flex flex-wrap items-center gap-3">
+          {effectiveCheckoutUrl && !billingSummary?.hasActivePlan ? (
+            <a href={effectiveCheckoutUrl} rel="noreferrer" className={buttonVariants({ variant: "primary" })}>
+              Purchase plan
+            </a>
+          ) : null}
+
+          {billingSummary?.portalUrl ? (
+            <a href={billingSummary.portalUrl} target="_blank" rel="noreferrer" className={buttonVariants({ variant: "secondary" })}>
+              Open billing portal
+            </a>
+          ) : null}
+
+          {billingSummary?.hasActivePlan ? (
+            <DenButton
+              variant={subscription?.cancelAtPeriodEnd ? "secondary" : "destructive"}
+              loading={billingSubscriptionBusy}
+              onClick={() => void handleSubscriptionCancellation(!Boolean(subscription?.cancelAtPeriodEnd))}
+            >
+              {subscription?.cancelAtPeriodEnd ? "Resume plan" : "Cancel plan"}
+            </DenButton>
+          ) : null}
+        </div>
+      </div>
+
+      <div className="mb-6 rounded-[20px] border border-gray-100 bg-white p-8 shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)]">
+        <h2 className="mb-4 text-[15px] font-medium text-gray-900">Pricing</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-3">
+          <div className="rounded-[16px] border border-gray-100 bg-gray-50 p-4">
+            <p className="mb-1 text-[12px] font-semibold uppercase tracking-wide text-gray-500">Solo</p>
+            <p className="text-[20px] font-semibold text-gray-900">$0</p>
+            <p className="mt-1 text-[13px] text-gray-500">Free forever · open source</p>
+          </div>
+          <div className="rounded-[16px] border border-gray-100 bg-gray-50 p-4">
+            <p className="mb-1 text-[12px] font-semibold uppercase tracking-wide text-gray-500">Workspace plan</p>
+            <p className="text-[20px] font-semibold text-gray-900">$50<span className="text-[13px] font-medium text-gray-500">/month</span></p>
+            <p className="mt-1 text-[13px] text-gray-500">5 members included · 1 hosted worker</p>
+          </div>
+          <div className="rounded-[16px] border border-gray-100 bg-gray-50 p-4">
+            <p className="mb-1 text-[12px] font-semibold uppercase tracking-wide text-gray-500">Enterprise</p>
+            <p className="text-[20px] font-semibold text-gray-900">Custom</p>
+            <p className="mt-1 text-[13px] text-gray-500">Windows included · talk to us</p>
+          </div>
+        </div>
+      </div>
+
+      <div className="flex items-center justify-between rounded-[20px] border border-gray-100 bg-white p-6 shadow-[0_2px_12px_-4px_rgba(0,0,0,0.06)]">
+        <div>
+          <h2 className="mb-1 text-[15px] font-medium text-gray-900">Invoices</h2>
+          <p className="text-[14px] text-gray-500">
+            View and download your past billing invoices.
+          </p>
+        </div>
+
+        {billingSummary?.portalUrl ? (
+          <a href={billingSummary.portalUrl} target="_blank" rel="noreferrer" className={buttonVariants({ variant: "secondary", size: "sm" })}>
+            View invoices
+          </a>
+        ) : (
+          <DenButton
+            variant="secondary"
+            size="sm"
+            loading={billingBusy || billingCheckoutBusy}
+            onClick={() => void refreshBilling({ includeCheckout: true, quiet: false })}
+          >
+            Refresh billing
+          </DenButton>
+        )}
+      </div>
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/dashboard-overview-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/dashboard-overview-screen.tsx
new file mode 100644
index 0000000000..a96a9f4f5e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/dashboard-overview-screen.tsx
@@ -0,0 +1,179 @@
+"use client";
+
+import Link from "next/link";
+import {
+  Bot,
+  CreditCard,
+  Cpu,
+  KeyRound,
+  Monitor,
+  Users,
+} from "lucide-react";
+import {
+  getBackgroundAgentsRoute,
+  getApiKeysRoute,
+  getBillingRoute,
+  getCustomLlmProvidersRoute,
+  getOrgAccessFlags,
+  getMembersRoute,
+} from "../../../../_lib/den-org";
+import { useDenFlow } from "../../../../_providers/den-flow-provider";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+function getGreeting(name: string | null | undefined) {
+  const hour = new Date().getHours();
+  const greeting = hour < 12 ? "Good morning" : hour < 18 ? "Good afternoon" : "Good evening";
+  const firstName = name?.trim().split(/\s+/)[0] ?? "there";
+  return `${greeting}, ${firstName}`;
+}
+
+export function DashboardOverviewScreen() {
+  const { orgSlug, activeOrg, orgContext } = useOrgDashboard();
+  const { user } = useDenFlow();
+  const access = getOrgAccessFlags(
+    orgContext?.currentMember.role ?? "member",
+    orgContext?.currentMember.isOwner ?? false,
+  );
+
+  const quickActions = [
+    {
+      label: "Members",
+      icon: Users,
+      href: getMembersRoute(orgSlug),
+      tint: "bg-cyan-50 text-cyan-600 group-hover:bg-cyan-100",
+    },
+    ...(access.canManageApiKeys
+      ? [{
+          label: "API Keys",
+          icon: KeyRound,
+          href: getApiKeysRoute(orgSlug),
+          tint: "bg-emerald-50 text-emerald-600 group-hover:bg-emerald-100",
+        }]
+      : []),
+    {
+      label: "Shared Workspace",
+      icon: Bot,
+      href: getBackgroundAgentsRoute(orgSlug),
+      tint: "bg-orange-50 text-orange-500 group-hover:bg-orange-100",
+    },
+    {
+      label: "LLM Providers",
+      icon: Cpu,
+      href: getCustomLlmProvidersRoute(orgSlug),
+      tint: "bg-lime-50 text-lime-600 group-hover:bg-lime-100",
+    },
+    {
+      label: "Billing",
+      icon: CreditCard,
+      href: getBillingRoute(orgSlug),
+      tint: "bg-gray-100 text-gray-600 group-hover:bg-gray-200",
+    },
+    {
+      label: "Desktop app",
+      icon: Monitor,
+      href: "https://openworklabs.com/download",
+      external: true,
+      tint: "bg-fuchsia-50 text-fuchsia-600 group-hover:bg-fuchsia-100",
+    },
+  ];
+
+  return (
+    <div className="mx-auto max-w-[1200px] px-6 py-8 md:px-8">
+      <p className="mb-1 text-[12px] text-gray-400">
+        {activeOrg?.name ?? "OpenWork Cloud"}
+      </p>
+      <h1 className="mb-8 text-[26px] tracking-[-0.5px] text-gray-900">
+        {getGreeting(user?.name)}
+      </h1>
+
+      <div className="mb-10 grid grid-cols-2 gap-3 md:grid-cols-3 xl:grid-cols-6">
+        {quickActions.map((action) => {
+          const content = (
+            <>
+              <div
+                className={`flex h-10 w-10 items-center justify-center rounded-xl transition-colors ${action.tint}`}
+              >
+                <action.icon className="h-5 w-5" strokeWidth={1.8} />
+              </div>
+              <span className="text-center text-[12px] leading-tight text-gray-700">
+                {action.label}
+              </span>
+            </>
+          );
+
+          const className =
+            "group flex min-h-[116px] flex-col items-center gap-3 rounded-2xl border border-gray-100 bg-white p-5 transition-all hover:border-gray-200 hover:shadow-[0_2px_8px_-4px_rgba(0,0,0,0.08)]";
+
+          if (action.external) {
+            return (
+              <a
+                key={action.label}
+                href={action.href}
+                target="_blank"
+                rel="noreferrer"
+                className={className}
+              >
+                {content}
+              </a>
+            );
+          }
+
+          return (
+            <Link key={action.label} href={action.href} className={className}>
+              {content}
+            </Link>
+          );
+        })}
+      </div>
+
+      <div className="grid gap-8 xl:grid-cols-[minmax(0,1fr)_300px]">
+        <div className="rounded-2xl border border-gray-100 bg-white p-6">
+          <h2 className="mb-2 text-[15px] tracking-[-0.2px] text-gray-900">
+            Cloud workspace control
+          </h2>
+          <p className="max-w-[620px] text-[13px] leading-[1.7] text-gray-500">
+            Launch shared workspaces, manage access, and connect teammates to hosted OpenWork workers from this dashboard.
+          </p>
+          <Link
+            href={getBackgroundAgentsRoute(orgSlug)}
+            className="mt-5 inline-flex rounded-full bg-gray-900 px-4 py-2 text-[12px] font-medium text-white transition-colors hover:bg-gray-800"
+          >
+            Open shared workspaces
+          </Link>
+        </div>
+
+        <div className="space-y-4">
+          <div className="overflow-hidden rounded-2xl border border-gray-800 bg-gray-900 p-5">
+            <h3 className="mb-2 text-[14px] text-white">Desktop app</h3>
+            <p className="mb-4 text-[13px] leading-[1.6] text-gray-300">
+              Run locally for free, keep your data on your machine, and move to shared web workflows when your team is ready.
+            </p>
+            <a
+              href="https://openworklabs.com/download"
+              className="inline-flex items-center gap-2 rounded-full border border-white/20 px-4 py-2 text-[12px] text-white transition-colors hover:bg-white/10"
+            >
+              <Monitor className="h-3.5 w-3.5" />
+              Use desktop only
+            </a>
+          </div>
+
+          <div className="rounded-2xl border border-gray-100 bg-white p-5">
+            <h3 className="mb-1 text-[14px] text-gray-900">Workspace snapshot</h3>
+            <div className="mt-4 grid gap-3">
+              <div className="flex items-center justify-between text-[13px] text-gray-500">
+                <span>Members</span>
+                <span className="font-medium text-gray-900">{orgContext?.members.length ?? 0}</span>
+              </div>
+              <div className="flex items-center justify-between text-[13px] text-gray-500">
+                <span>Pending invites</span>
+                <span className="font-medium text-gray-900">
+                  {(orgContext?.invitations ?? []).filter((invitation) => invitation.status === "pending").length}
+                </span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/github-integration-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/github-integration-screen.tsx
new file mode 100644
index 0000000000..3005566f06
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/github-integration-screen.tsx
@@ -0,0 +1,1295 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import Link from "next/link";
+import { useRouter, useSearchParams } from "next/navigation";
+import { useQueryClient } from "@tanstack/react-query";
+import {
+  ArrowLeft,
+  CheckCircle2,
+  ExternalLink,
+  GitBranch,
+  Github,
+  LoaderCircle,
+  Puzzle,
+  RefreshCw,
+  Search,
+  Settings,
+  Sparkles,
+  Trash2,
+} from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import {
+  getGithubIntegrationAccountRoute,
+  getGithubIntegrationRoute,
+  getGithubIntegrationSetupRoute,
+  getIntegrationsRoute,
+} from "../../../../_lib/den-org";
+import { buttonVariants, DenButton } from "../../../../_components/ui/button";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenInput } from "../../../../_components/ui/input";
+import {
+  type IntegrationRepo,
+  useApplyGithubDiscovery,
+  useConnectorInstanceConfiguration,
+  useCreateGithubConnectorInstance,
+  useGithubAccountRepositories,
+  useGithubConnectorDiscovery,
+  useGithubInstallCompletion,
+  useIntegrations,
+  useRemoveConnectorInstance,
+  useSetConnectorInstanceAutoImport,
+} from "./integration-data";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+function parseInstallationId(value: string | null) {
+  if (!value) return null;
+  const numeric = Number(value);
+  return Number.isInteger(numeric) && numeric > 0 ? numeric : null;
+}
+
+export function GithubIntegrationScreen() {
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const { orgSlug } = useOrgDashboard();
+  const connectorInstanceId = searchParams.get("connectorInstanceId")?.trim() ?? null;
+  const connectorAccountId = searchParams.get("connectorAccountId")?.trim() ?? null;
+  const mode = searchParams.get("mode")?.trim() ?? null;
+  const installationId = parseInstallationId(searchParams.get("installation_id"));
+  const state = searchParams.get("state")?.trim() ?? null;
+
+  if (connectorInstanceId) {
+    return (
+      <GithubConnectorInstanceRouter
+        connectorInstanceId={connectorInstanceId}
+        mode={mode}
+        onBack={() => router.push(getIntegrationsRoute(orgSlug))}
+      />
+    );
+  }
+
+  if (connectorAccountId) {
+    return <GithubConnectedAccountSelectionPhase connectorAccountId={connectorAccountId} />;
+  }
+
+  if (installationId && state) {
+    return <GithubInstallCompletionRedirect installationId={installationId} state={state} />;
+  }
+
+  return (
+    <DashboardPageTemplate
+      icon={Github}
+      badgeLabel="GitHub"
+      title="Connect GitHub"
+      description="Choose a connected account from the Integrations page to continue."
+      colors={["#E2E8F0", "#0F172A", "#111827", "#94A3B8"]}
+    >
+      <StatePanel
+        title="Nothing to do here"
+        body="Return to Integrations to connect a new GitHub account or configure another repository."
+      />
+    </DashboardPageTemplate>
+  );
+}
+
+function GithubInstallCompletionRedirect({ installationId, state }: { installationId: number; state: string }) {
+  const { orgSlug } = useOrgDashboard();
+  const queryClient = useQueryClient();
+  const completionQuery = useGithubInstallCompletion({ installationId, state });
+
+  useEffect(() => {
+    if (!completionQuery.data) return;
+
+    queryClient.invalidateQueries({ queryKey: ["integrations"] });
+    if (completionQuery.data.repositories.length > 0) {
+      queryClient.setQueryData(
+        ["integrations", "repos", "github", completionQuery.data.connectorAccount.id, "connected-account"],
+        completionQuery.data.repositories,
+      );
+    }
+
+    const nextUrl = getGithubIntegrationAccountRoute(orgSlug, completionQuery.data.connectorAccount.id);
+    window.location.replace(nextUrl);
+  }, [completionQuery.data, orgSlug, queryClient]);
+
+  return (
+    <DashboardPageTemplate
+      icon={Github}
+      badgeLabel="GitHub"
+      title="Finishing GitHub connection"
+      description="OpenWork is finalizing the GitHub App installation for this organization."
+      colors={["#E2E8F0", "#0F172A", "#111827", "#94A3B8"]}
+    >
+      {completionQuery.error ? (
+        <StatePanel
+          title="GitHub connection could not be completed"
+          body={completionQuery.error instanceof Error ? completionQuery.error.message : "Unknown GitHub installation error."}
+        />
+      ) : (
+        <section className="flex flex-col items-center justify-center rounded-2xl border border-gray-100 bg-white px-6 py-16 text-center">
+          <div className="flex h-12 w-12 items-center justify-center rounded-2xl bg-slate-950 text-white">
+            <LoaderCircle className="h-6 w-6 animate-spin" aria-hidden />
+          </div>
+          <h2 className="mt-5 text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+            Finalizing your GitHub connection
+          </h2>
+          <p className="mt-2 max-w-[460px] text-[13px] leading-[1.6] text-gray-500">
+            OpenWork is resolving the installation and loading accessible repositories.
+          </p>
+        </section>
+      )}
+    </DashboardPageTemplate>
+  );
+}
+
+function GithubConnectorInstanceRouter({
+  connectorInstanceId,
+  mode,
+  onBack,
+}: {
+  connectorInstanceId: string;
+  mode: string | null;
+  onBack: () => void;
+}) {
+  const configurationQuery = useConnectorInstanceConfiguration(connectorInstanceId);
+
+  if (configurationQuery.isLoading) {
+    return <ConfigurationLoadingState />;
+  }
+
+  const configuration = configurationQuery.data;
+  const hasConfigured = Boolean(configuration && configuration.configuredPlugins.length > 0);
+  const shouldRunDiscovery = !hasConfigured || mode === "rediscover";
+
+  if (shouldRunDiscovery) {
+    return (
+      <GithubDiscoveryPhase
+        connectorInstanceId={connectorInstanceId}
+        onBack={onBack}
+      />
+    );
+  }
+
+  if (!configuration) {
+    return (
+      <GithubDiscoveryPhase
+        connectorInstanceId={connectorInstanceId}
+        onBack={onBack}
+      />
+    );
+  }
+
+  return (
+    <GithubConnectorInstanceManagePhase
+      configuration={configuration}
+      onBack={onBack}
+    />
+  );
+}
+
+function ConfigurationLoadingState() {
+  return (
+    <DashboardPageTemplate
+      icon={Puzzle}
+      badgeLabel="Repository"
+      title="Loading…"
+      description="OpenWork is loading this repository's connector configuration."
+      colors={["#DBEAFE", "#0F172A", "#1D4ED8", "#BFDBFE"]}
+    >
+      <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-center shadow-sm">
+        <LoaderCircle className="mx-auto h-6 w-6 animate-spin text-gray-400" />
+        <p className="mt-3 text-[14px] text-gray-500">Loading connector configuration…</p>
+      </div>
+    </DashboardPageTemplate>
+  );
+}
+
+function GithubConnectorInstanceManagePhase({
+  configuration,
+  onBack,
+}: {
+  configuration: {
+    autoImportNewPlugins: boolean;
+    configuredPlugins: Array<{
+      id: string;
+      name: string;
+      description: string | null;
+      memberCount: number;
+      componentCounts: Record<string, number>;
+      rootPath: string | null;
+    }>;
+    connectorInstanceId: string;
+    connectorInstanceName: string;
+    importedConfigObjectCount: number;
+    mappingCount: number;
+    repositoryFullName: string | null;
+  };
+  onBack: () => void;
+}) {
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const { orgSlug } = useOrgDashboard();
+  const removeMutation = useRemoveConnectorInstance();
+  const autoImportMutation = useSetConnectorInstanceAutoImport();
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [autoImportChecked, setAutoImportChecked] = useState(configuration.autoImportNewPlugins);
+
+  useEffect(() => {
+    setAutoImportChecked(configuration.autoImportNewPlugins);
+  }, [configuration.autoImportNewPlugins]);
+
+  const repoName = configuration.repositoryFullName ?? configuration.connectorInstanceName;
+
+  async function handleRemove() {
+    await removeMutation.mutateAsync(configuration.connectorInstanceId);
+    onBack();
+  }
+
+  function handleRediscover() {
+    const params = new URLSearchParams(searchParams?.toString() ?? "");
+    params.set("connectorInstanceId", configuration.connectorInstanceId);
+    params.set("mode", "rediscover");
+    router.push(`${getGithubIntegrationRoute(orgSlug)}?${params.toString()}`);
+  }
+
+  async function handleAutoImportToggle(nextValue: boolean) {
+    setAutoImportChecked(nextValue);
+    try {
+      await autoImportMutation.mutateAsync({
+        autoImportNewPlugins: nextValue,
+        connectorInstanceId: configuration.connectorInstanceId,
+      });
+    } catch {
+      setAutoImportChecked(configuration.autoImportNewPlugins);
+    }
+  }
+
+  return (
+    <DashboardPageTemplate
+      icon={Puzzle}
+      badgeLabel="Repository"
+      title={repoName}
+      description="Manage which plugins OpenWork imports from this repository."
+      colors={["#DBEAFE", "#0F172A", "#1D4ED8", "#BFDBFE"]}
+    >
+      <div className="mb-6 flex items-center justify-between gap-3">
+        <button
+          type="button"
+          onClick={onBack}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </button>
+        <DenButton variant="secondary" size="sm" icon={RefreshCw} onClick={handleRediscover}>
+          Re-run discovery
+        </DenButton>
+      </div>
+
+      <div className="space-y-8">
+        <section>
+          <div className="mb-3 flex items-baseline justify-between gap-3">
+            <h2 className="text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Imported plugins
+            </h2>
+            <p className="text-[11px] text-gray-400">
+              {configuration.configuredPlugins.length} plugin{configuration.configuredPlugins.length === 1 ? "" : "s"}
+            </p>
+          </div>
+
+          <div className="mb-4 flex items-start justify-between gap-5 rounded-2xl border border-gray-100 bg-white px-5 py-4">
+            <div className="min-w-0 flex-1">
+              <p className="text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                Auto-import new plugins
+              </p>
+              <p className="mt-1 text-[12.5px] leading-[1.6] text-gray-500">
+                When new plugin structures appear in this repository on future pushes, OpenWork will discover and import them automatically.
+              </p>
+              {autoImportMutation.error ? (
+                <p className="mt-2 text-[12px] text-red-700">
+                  {autoImportMutation.error instanceof Error ? autoImportMutation.error.message : "Failed to update auto-import."}
+                </p>
+              ) : null}
+            </div>
+            <Toggle
+              checked={autoImportChecked}
+              busy={autoImportMutation.isPending}
+              onChange={(next) => void handleAutoImportToggle(next)}
+            />
+          </div>
+
+          {configuration.configuredPlugins.length > 0 ? (
+            <div className="grid gap-3">
+              {configuration.configuredPlugins.map((plugin) => (
+                <PluginListItem key={plugin.id} plugin={plugin} />
+              ))}
+            </div>
+          ) : (
+            <div className="rounded-[20px] border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+              <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                No plugins imported yet
+              </p>
+              <p className="mx-auto mt-2 max-w-[400px] text-[13px] leading-6 text-gray-400">
+                Re-run discovery to pick plugins from this repository.
+              </p>
+            </div>
+          )}
+        </section>
+
+        <section>
+          <h2 className="mb-3 text-[11px] font-semibold uppercase tracking-[0.16em] text-red-400">
+            Danger zone
+          </h2>
+          <div className="overflow-hidden rounded-2xl border border-red-100 bg-white">
+            <div className="flex flex-wrap items-start justify-between gap-3 px-5 py-4">
+              <div className="min-w-0 flex-1">
+                <p className="text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                  Remove this repository
+                </p>
+                <p className="mt-1 text-[12.5px] leading-[1.6] text-gray-500">
+                  Deletes everything OpenWork imported from this repository. The GitHub connection itself stays active.
+                </p>
+              </div>
+              <DenButton
+                variant="destructive"
+                size="sm"
+                icon={Trash2}
+                onClick={() => setConfirmOpen(true)}
+                loading={removeMutation.isPending}
+              >
+                Remove
+              </DenButton>
+            </div>
+            {removeMutation.error ? (
+              <div className="border-t border-red-100 bg-red-50 px-5 py-2 text-[12px] text-red-700">
+                {removeMutation.error instanceof Error ? removeMutation.error.message : "Failed to remove this repository."}
+              </div>
+            ) : null}
+          </div>
+        </section>
+      </div>
+
+      <RemoveRepositoryConfirmDialog
+        open={confirmOpen}
+        repoName={repoName}
+        pluginCount={configuration.configuredPlugins.length}
+        configObjectCount={configuration.importedConfigObjectCount}
+        busy={removeMutation.isPending}
+        onClose={() => {
+          if (!removeMutation.isPending) setConfirmOpen(false);
+        }}
+        onConfirm={() => {
+          void handleRemove();
+          setConfirmOpen(false);
+        }}
+      />
+    </DashboardPageTemplate>
+  );
+}
+
+const COMPONENT_TYPE_LABELS: Record<string, { singular: string; plural: string }> = {
+  skill: { singular: "skill", plural: "skills" },
+  agent: { singular: "agent", plural: "agents" },
+  command: { singular: "command", plural: "commands" },
+  hook: { singular: "hook", plural: "hooks" },
+  mcp: { singular: "MCP server", plural: "MCP servers" },
+  mcp_server: { singular: "MCP server", plural: "MCP servers" },
+  lsp_server: { singular: "LSP server", plural: "LSP servers" },
+  monitor: { singular: "monitor", plural: "monitors" },
+  settings: { singular: "setting", plural: "settings" },
+};
+
+function formatComponentCount(type: string, count: number) {
+  const label = COMPONENT_TYPE_LABELS[type] ?? {
+    singular: type.replace(/_/g, " "),
+    plural: `${type.replace(/_/g, " ")}s`,
+  };
+  return `${count} ${count === 1 ? label.singular : label.plural}`;
+}
+
+function PluginListItem({ plugin }: {
+  plugin: {
+    id: string;
+    name: string;
+    description: string | null;
+    componentCounts: Record<string, number>;
+    rootPath: string | null;
+  };
+}) {
+  const orderedCountEntries = Object.entries(plugin.componentCounts)
+    .filter(([, count]) => count > 0)
+    .sort((a, b) => b[1] - a[1]);
+  const repoPath = plugin.rootPath === null
+    ? null
+    : plugin.rootPath === ""
+      ? "/"
+      : plugin.rootPath;
+
+  return (
+    <article className="group overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]">
+      <div className="flex items-stretch">
+        <div className="relative w-[72px] shrink-0 overflow-hidden">
+          <div className="absolute inset-0">
+            <PaperMeshGradient seed={plugin.id} speed={0} />
+          </div>
+          <div className="relative flex h-full items-center justify-center">
+            <div className="flex h-10 w-10 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+              <Puzzle className="h-4.5 w-4.5 text-gray-700" aria-hidden />
+            </div>
+          </div>
+        </div>
+
+        <div className="min-w-0 flex-1 px-5 py-4">
+          <div className="flex items-start justify-between gap-3">
+            <div className="min-w-0 flex-1">
+              <h3 className="truncate text-[15px] font-semibold tracking-[-0.02em] text-gray-900">
+                {plugin.name}
+              </h3>
+              {plugin.description ? (
+                <p className="mt-0.5 line-clamp-2 text-[13px] leading-[1.55] text-gray-500">
+                  {plugin.description}
+                </p>
+              ) : null}
+            </div>
+            {repoPath ? (
+              <code className="shrink-0 rounded-md bg-gray-50 px-2 py-0.5 font-mono text-[11px] text-gray-500">
+                {repoPath}
+              </code>
+            ) : null}
+          </div>
+
+          {orderedCountEntries.length > 0 ? (
+            <div className="mt-3 flex flex-wrap gap-1.5 border-t border-gray-50 pt-3">
+              {orderedCountEntries.map(([type, count]) => (
+                <span
+                  key={type}
+                  className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2.5 py-0.5 text-[11.5px] text-gray-600"
+                >
+                  <span className="font-semibold text-gray-900">{count}</span>
+                  <span className="text-gray-500">
+                    {formatComponentCount(type, count).replace(`${count} `, "")}
+                  </span>
+                </span>
+              ))}
+            </div>
+          ) : null}
+        </div>
+      </div>
+    </article>
+  );
+}
+
+function Toggle({
+  checked,
+  busy,
+  onChange,
+}: {
+  checked: boolean;
+  busy: boolean;
+  onChange: (next: boolean) => void;
+}) {
+  return (
+    <button
+      type="button"
+      role="switch"
+      aria-checked={checked}
+      disabled={busy}
+      onClick={() => onChange(!checked)}
+      className={`relative inline-flex h-6 w-[42px] shrink-0 items-center rounded-full transition-colors ${
+        checked ? "bg-[#0f172a]" : "bg-gray-200"
+      } ${busy ? "opacity-60" : ""} focus:outline-none focus:ring-2 focus:ring-[#0f172a]/20 focus:ring-offset-2`}
+    >
+      <span
+        className={`inline-block h-5 w-5 transform rounded-full bg-white shadow-[0_2px_6px_-1px_rgba(15,23,42,0.3)] transition-transform ${
+          checked ? "translate-x-[18px]" : "translate-x-0.5"
+        }`}
+      />
+    </button>
+  );
+}
+
+function RemoveRepositoryConfirmDialog({
+  open,
+  repoName,
+  pluginCount,
+  configObjectCount,
+  busy,
+  onClose,
+  onConfirm,
+}: {
+  open: boolean;
+  repoName: string;
+  pluginCount: number;
+  configObjectCount: number;
+  busy: boolean;
+  onClose: () => void;
+  onConfirm: () => void;
+}) {
+  if (!open) {
+    return null;
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-950/45 px-4 py-6" onClick={onClose}>
+      <div
+        className="w-full max-w-md rounded-[28px] border border-gray-200 bg-white p-6 shadow-[0_24px_80px_-32px_rgba(15,23,42,0.45)]"
+        onClick={(event) => event.stopPropagation()}
+      >
+        <div className="flex items-start gap-3">
+          <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-red-50 text-red-600">
+            <Trash2 className="h-5 w-5" aria-hidden />
+          </div>
+          <div className="min-w-0 flex-1">
+            <h2 className="text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+              Remove {repoName}?
+            </h2>
+            <p className="mt-1 text-[13px] leading-6 text-gray-600">
+              This will delete everything OpenWork imported from this repository, including:
+            </p>
+            <ul className="mt-3 space-y-1.5 text-[13px] leading-6 text-gray-600">
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>
+                  <strong>{pluginCount}</strong> imported plugin{pluginCount === 1 ? "" : "s"}
+                </span>
+              </li>
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>
+                  <strong>{configObjectCount}</strong> imported config object{configObjectCount === 1 ? "" : "s"} and all their versions
+                </span>
+              </li>
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>Connector mappings, source bindings, and sync history for this repository</span>
+              </li>
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>Any marketplace that was created solely from this repository and is now empty</span>
+              </li>
+            </ul>
+            <p className="mt-3 text-[12px] leading-5 text-gray-500">
+              The GitHub connection itself stays active. You can re-add this repository later from the Integrations page.
+            </p>
+          </div>
+        </div>
+
+        <div className="mt-6 flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+          <DenButton variant="secondary" onClick={onClose} disabled={busy}>
+            Cancel
+          </DenButton>
+          <DenButton variant="destructive" icon={Trash2} loading={busy} onClick={onConfirm}>
+            Remove repository
+          </DenButton>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function GithubConnectedAccountSelectionPhase({ connectorAccountId }: { connectorAccountId: string }) {
+  const { orgSlug } = useOrgDashboard();
+  const { data: connections = [], isFetching: connectionsFetching, isLoading: connectionsLoading } = useIntegrations();
+  const repositoriesQuery = useGithubAccountRepositories(connectorAccountId);
+  const connectMutation = useCreateGithubConnectorInstance();
+  const [query, setQuery] = useState("");
+  const [selectedRepoId, setSelectedRepoId] = useState<string | null>(null);
+
+  const connection = connections.find((entry) => entry.provider === "github" && entry.account.id === connectorAccountId) ?? null;
+  const configuredByFullName = new Map(
+    (connection?.repos ?? [])
+      .filter((entry) => entry.connectorInstanceId)
+      .map((entry) => [entry.fullName, entry.connectorInstanceId as string]),
+  );
+  const allRepos = repositoriesQuery.data ?? [];
+  const unconfiguredRepos = allRepos.filter((repo) => !configuredByFullName.has(repo.fullName));
+  const filteredRepos = useMemo(() => {
+    const normalized = query.trim().toLowerCase();
+    const base = !normalized
+      ? allRepos
+      : allRepos.filter((repository) =>
+          `${repository.fullName}\n${repository.description}`.toLowerCase().includes(normalized),
+        );
+
+    const priority = (repository: IntegrationRepo): number => {
+      if (configuredByFullName.has(repository.fullName)) return 0;
+      if (repository.manifestKind) return 1;
+      return 2;
+    };
+
+    return [...base].sort((left, right) => {
+      const diff = priority(left) - priority(right);
+      if (diff !== 0) return diff;
+      return left.fullName.localeCompare(right.fullName);
+    });
+  }, [allRepos, configuredByFullName, query]);
+  const selectedRepo = unconfiguredRepos.find((repo) => repo.id === selectedRepoId) ?? null;
+
+  async function handleConnectRepo() {
+    if (!connection?.account.installationId || !selectedRepo || !selectedRepo.defaultBranch) {
+      return;
+    }
+
+    const repositoryId = Number(selectedRepo.id);
+    if (!Number.isInteger(repositoryId) || repositoryId <= 0) {
+      return;
+    }
+
+    const result = await connectMutation.mutateAsync({
+      branch: selectedRepo.defaultBranch,
+      connectorAccountId,
+      connectorInstanceName: selectedRepo.fullName,
+      installationId: connection.account.installationId,
+      repositoryFullName: selectedRepo.fullName,
+      repositoryId,
+    });
+    window.location.assign(getGithubIntegrationSetupRoute(orgSlug, result.connectorInstanceId));
+  }
+
+  const accessLabel = connection?.account.repositorySelection === "selected"
+    ? "Only selected"
+    : "All repositories";
+  const ownerLogin = connection?.account.ownerName ?? connection?.account.name ?? null;
+  const totalReadable = allRepos.length;
+
+  return (
+    <DashboardPageTemplate
+      icon={Github}
+      badgeLabel="GitHub"
+      title="Add a repository"
+      description={ownerLogin
+        ? `Pick one of the repositories the @${ownerLogin} installation can already read.`
+        : "Pick one of the repositories this GitHub installation can already read."}
+      colors={["#E2E8F0", "#0F172A", "#111827", "#94A3B8"]}
+    >
+      <div className="mb-6 flex items-center justify-between gap-3">
+        <Link
+          href={getIntegrationsRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+        {ownerLogin ? (
+          <span className="inline-flex items-center gap-1.5 rounded-full border border-gray-100 bg-white px-3 py-1 text-[12px] font-medium text-gray-600">
+            <Github className="h-3.5 w-3.5 text-gray-500" aria-hidden />
+            @{ownerLogin}
+          </span>
+        ) : null}
+      </div>
+
+      {repositoriesQuery.isLoading || (!connection && (connectionsLoading || connectionsFetching)) ? (
+        <StatePanel
+          title="Loading repositories"
+          body="OpenWork is checking which repositories this GitHub installation can already read."
+        />
+      ) : repositoriesQuery.error ? (
+        <StatePanel
+          title="Could not load repositories"
+          body={repositoriesQuery.error instanceof Error ? repositoriesQuery.error.message : "GitHub repositories could not be loaded."}
+        />
+      ) : !connection ? (
+        <StatePanel
+          title="Connector account not found"
+          body="OpenWork could not find that connected GitHub account. Return to Integrations and reconnect if needed."
+        />
+      ) : (
+        <div className="space-y-5">
+          <div className="flex items-baseline justify-between gap-3">
+            <h2 className="text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Repositories
+            </h2>
+            <div className="flex items-center gap-2 text-[11px] text-gray-400">
+              <span>{unconfiguredRepos.length} unconfigured</span>
+              <span className="text-gray-300">·</span>
+              <span>{totalReadable} readable</span>
+              <span className="text-gray-300">·</span>
+              <span>{accessLabel}</span>
+            </div>
+          </div>
+
+          {allRepos.length > 0 ? (
+            <>
+              <DenInput
+                type="search"
+                icon={Search}
+                value={query}
+                onChange={(event) => setQuery(event.currentTarget.value)}
+                placeholder="Search repositories"
+              />
+
+              {filteredRepos.length > 0 ? (
+                <div className="grid gap-2">
+                  {filteredRepos.map((repository) => {
+                    const configuredInstanceId = configuredByFullName.get(repository.fullName) ?? null;
+                    return (
+                      <RepositoryCard
+                        key={repository.id}
+                        fullName={repository.fullName}
+                        defaultBranch={repository.defaultBranch ?? null}
+                        manifestKind={repository.manifestKind ?? null}
+                        marketplacePluginCount={repository.marketplacePluginCount ?? null}
+                        configuredInstanceId={configuredInstanceId}
+                        configuredHref={configuredInstanceId ? `${getGithubIntegrationRoute(orgSlug)}?connectorInstanceId=${encodeURIComponent(configuredInstanceId)}` : null}
+                        selected={!configuredInstanceId && selectedRepoId === repository.id}
+                        onSelect={() => {
+                          if (!configuredInstanceId) setSelectedRepoId(repository.id);
+                        }}
+                      />
+                    );
+                  })}
+                </div>
+              ) : (
+                <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+                  <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                    No repositories matched your search
+                  </p>
+                  <p className="mx-auto mt-2 max-w-[360px] text-[13px] leading-6 text-gray-400">
+                    Try a different search term, or pick from the list above.
+                  </p>
+                </div>
+              )}
+
+              {selectedRepo ? (
+                <div className="flex flex-col-reverse items-stretch justify-between gap-3 rounded-2xl border border-gray-100 bg-white px-4 py-3 sm:flex-row sm:items-center">
+                  <div className="min-w-0">
+                    <p className="truncate text-[13px] font-semibold tracking-[-0.01em] text-gray-900">
+                      {selectedRepo.fullName}
+                    </p>
+                    <p className="truncate text-[11.5px] text-gray-500">
+                      <GitBranch className="mr-1 inline h-3 w-3 text-gray-400" aria-hidden />
+                      {selectedRepo.defaultBranch ?? "Default branch unavailable"}
+                    </p>
+                  </div>
+                  <DenButton
+                    disabled={!selectedRepo.defaultBranch}
+                    loading={connectMutation.isPending}
+                    onClick={() => void handleConnectRepo()}
+                  >
+                    Start discovery
+                  </DenButton>
+                </div>
+              ) : unconfiguredRepos.length > 0 ? (
+                <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-4 py-3 text-[13px] text-gray-400">
+                  Select a repository above to start discovery.
+                </div>
+              ) : null}
+            </>
+          ) : null}
+
+          {unconfiguredRepos.length === 0 && allRepos.length > 0 ? (
+            <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+              <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                Nothing left to configure here
+              </p>
+              <p className="mx-auto mt-2 max-w-[420px] text-[13px] leading-6 text-gray-500">
+                {connection.account.repositorySelection === "selected"
+                  ? "This GitHub installation is limited to selected repositories, and OpenWork has already configured all of them."
+                  : "This GitHub installation already has access to all repositories under this owner, and there are none unconfigured right now."}
+              </p>
+              {connection.account.repositorySelection === "selected" && connection.account.manageUrl ? (
+                <a
+                  href={connection.account.manageUrl}
+                  target="_blank"
+                  rel="noreferrer"
+                  className={`${buttonVariants({ variant: "primary", size: "sm" })} mt-5 inline-flex gap-2`}
+                >
+                  <ExternalLink className="h-4 w-4" aria-hidden />
+                  Allow more repositories on GitHub
+                </a>
+              ) : null}
+            </div>
+          ) : null}
+
+          {allRepos.length === 0 ? (
+            <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+              <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                No repositories available
+              </p>
+              <p className="mx-auto mt-2 max-w-[420px] text-[13px] leading-6 text-gray-500">
+                This GitHub installation has no repositories OpenWork can read right now.
+              </p>
+            </div>
+          ) : null}
+
+          {connectMutation.error ? (
+            <div className="rounded-2xl border border-red-100 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+              {connectMutation.error instanceof Error ? connectMutation.error.message : "Failed to create the connector instance."}
+            </div>
+          ) : null}
+        </div>
+      )}
+    </DashboardPageTemplate>
+  );
+}
+
+function manifestLabel(kind: "marketplace" | "plugin" | null, marketplacePluginCount: number | null): string | null {
+  if (kind === "marketplace") {
+    if (marketplacePluginCount && marketplacePluginCount > 1) {
+      return `Claude Marketplace · ${marketplacePluginCount} plugins`;
+    }
+    return "Claude Marketplace Detected";
+  }
+  if (kind === "plugin") {
+    return "Claude Plugin Detected";
+  }
+  return null;
+}
+
+function RepositoryCard({
+  fullName,
+  defaultBranch,
+  manifestKind,
+  marketplacePluginCount,
+  configuredInstanceId,
+  configuredHref,
+  selected,
+  onSelect,
+}: {
+  fullName: string;
+  defaultBranch: string | null;
+  manifestKind: "marketplace" | "plugin" | null;
+  marketplacePluginCount: number | null;
+  configuredInstanceId: string | null;
+  configuredHref: string | null;
+  selected: boolean;
+  onSelect: () => void;
+}) {
+  const badge = manifestLabel(manifestKind, marketplacePluginCount);
+  const isConfigured = Boolean(configuredInstanceId);
+
+  const innerContent = (
+    <div className="flex items-stretch">
+      <div className="relative w-[72px] shrink-0 overflow-hidden">
+        <div className="absolute inset-0">
+          <PaperMeshGradient seed={fullName} speed={0} />
+        </div>
+        <div className="relative flex h-full items-center justify-center">
+          <div className="flex h-10 w-10 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+            <GitBranch className="h-4 w-4 text-gray-700" aria-hidden />
+          </div>
+        </div>
+      </div>
+
+      <div className="flex min-w-0 flex-1 items-center gap-4 px-5 py-3.5">
+        <div className="min-w-0 flex-1">
+          <div className="flex flex-wrap items-center gap-2">
+            <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+              {fullName}
+            </p>
+            {isConfigured ? (
+              <span className="inline-flex items-center rounded-full bg-gray-100 px-2 py-0.5 text-[10.5px] font-medium uppercase tracking-[0.08em] text-gray-600">
+                Configured
+              </span>
+            ) : null}
+            {badge ? (
+              <span className="inline-flex items-center rounded-full bg-emerald-50 px-2 py-0.5 text-[10.5px] font-medium uppercase tracking-[0.06em] text-emerald-700">
+                {badge}
+              </span>
+            ) : null}
+          </div>
+          <p className="mt-0.5 truncate text-[12px] text-gray-500">
+            {defaultBranch ? `${defaultBranch} branch` : "Default branch unavailable"}
+          </p>
+        </div>
+
+        {isConfigured ? (
+          <span
+            aria-hidden
+            className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full text-gray-400 transition group-hover:bg-gray-100 group-hover:text-gray-900"
+          >
+            <Settings className="h-4 w-4" />
+          </span>
+        ) : (
+          <span
+            role="radio"
+            aria-checked={selected}
+            className={`flex h-[18px] w-[18px] shrink-0 items-center justify-center rounded-full border transition ${
+              selected
+                ? "border-[#0f172a] bg-[#0f172a] text-white"
+                : "border-gray-300 bg-white text-transparent group-hover:border-gray-500"
+            }`}
+          >
+            <span className={`h-2 w-2 rounded-full ${selected ? "bg-white" : "bg-transparent"}`} />
+          </span>
+        )}
+      </div>
+    </div>
+  );
+
+  const baseClass = `group block w-full overflow-hidden rounded-2xl border text-left transition ${
+    selected
+      ? "border-[#0f172a] bg-white shadow-[0_8px_24px_-12px_rgba(15,23,42,0.2)]"
+      : "border-gray-100 bg-white hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]"
+  }`;
+
+  if (isConfigured && configuredHref) {
+    return (
+      <Link href={configuredHref} aria-label={`Configure ${fullName}`} className={baseClass}>
+        {innerContent}
+      </Link>
+    );
+  }
+
+  return (
+    <button type="button" onClick={onSelect} className={baseClass}>
+      {innerContent}
+    </button>
+  );
+}
+
+function GithubDiscoveryPhase({ connectorInstanceId, onBack }: { connectorInstanceId: string; onBack: () => void }) {
+  const discoveryQuery = useGithubConnectorDiscovery(connectorInstanceId);
+  const applyMutation = useApplyGithubDiscovery();
+  const [selectedKeys, setSelectedKeys] = useState<string[]>([]);
+  const [autoImportNewPlugins, setAutoImportNewPlugins] = useState(true);
+
+  useEffect(() => {
+    if (!discoveryQuery.data) {
+      return;
+    }
+
+    setSelectedKeys(
+      discoveryQuery.data.discoveredPlugins
+        .filter((plugin) => plugin.supported && plugin.selectedByDefault)
+        .map((plugin) => plugin.key),
+    );
+    // Discovery is a fresh-intent operation: default the toggle ON each time
+    // the user enters the flow, regardless of the previously saved value.
+    setAutoImportNewPlugins(true);
+  }, [discoveryQuery.data]);
+
+  const selectedPlugins = (discoveryQuery.data?.discoveredPlugins ?? []).filter((plugin) => selectedKeys.includes(plugin.key));
+
+  async function handleApply() {
+    const result = await applyMutation.mutateAsync({
+      autoImportNewPlugins,
+      connectorInstanceId,
+      selectedKeys,
+    });
+
+    if (result.createdPluginNames.length === 0 && result.createdMappingCount === 0) {
+      return;
+    }
+  }
+
+  function toggleCandidate(key: string) {
+    setSelectedKeys((current) => current.includes(key) ? current.filter((value) => value !== key) : [...current, key]);
+  }
+
+  const repoName = discoveryQuery.data?.repositoryFullName ?? null;
+
+  return (
+    <DashboardPageTemplate
+      icon={Sparkles}
+      badgeLabel="Discovery"
+      title={repoName ?? "Discover repository"}
+      description="Pick which plugins OpenWork should import from this repository."
+      colors={["#DBEAFE", "#0F172A", "#1D4ED8", "#BFDBFE"]}
+    >
+      <div className="mb-6 flex items-center justify-between gap-3">
+        <button
+          type="button"
+          onClick={onBack}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </button>
+        {discoveryQuery.data ? (
+          <span className="inline-flex items-center gap-1.5 rounded-full border border-gray-100 bg-white px-3 py-1 text-[11px] font-medium text-gray-600">
+            <GitBranch className="h-3 w-3 text-gray-400" aria-hidden />
+            <code className="font-mono">{discoveryQuery.data.sourceRevisionRef.slice(0, 7)}</code>
+          </span>
+        ) : null}
+      </div>
+
+      {discoveryQuery.isLoading ? (
+        <DiscoveryLoadingState />
+      ) : discoveryQuery.error ? (
+        <StatePanel
+          title="Discovery failed"
+          body={discoveryQuery.error instanceof Error ? discoveryQuery.error.message : "OpenWork could not inspect the connected repository."}
+        />
+      ) : applyMutation.isSuccess ? (
+        <DiscoveryAppliedState
+          createdPluginNames={applyMutation.data.createdPluginNames}
+          createdMappingCount={applyMutation.data.createdMappingCount}
+          materializedConfigObjectCount={applyMutation.data.materializedConfigObjectCount}
+          onDone={onBack}
+        />
+      ) : discoveryQuery.data ? (
+        <div className="space-y-5">
+          {discoveryQuery.data.warnings.length > 0 ? (
+            <div className="rounded-2xl border border-amber-100 bg-amber-50 px-4 py-3 text-[12.5px] text-amber-800">
+              {discoveryQuery.data.warnings[0]}
+            </div>
+          ) : null}
+          {discoveryQuery.data.treeSummary.truncated ? (
+            <div className="rounded-2xl border border-amber-100 bg-amber-50 px-4 py-3 text-[12.5px] text-amber-800">
+              GitHub truncated the tree response. Discovery is based on the paths GitHub returned so far.
+            </div>
+          ) : null}
+
+          <div>
+            <div className="mb-3 flex items-baseline justify-between gap-3">
+              <h2 className="text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                Discovered plugins
+              </h2>
+              <p className="text-[11px] text-gray-400">
+                {selectedPlugins.length} of {discoveryQuery.data.discoveredPlugins.length} selected
+              </p>
+            </div>
+
+            <div className="mb-4 flex items-start justify-between gap-5 rounded-2xl border border-gray-100 bg-white px-5 py-4">
+              <div className="min-w-0 flex-1">
+                <p className="text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                  Auto-import new plugins
+                </p>
+                <p className="mt-1 text-[12.5px] leading-[1.6] text-gray-500">
+                  When new plugin structures appear on future pushes, OpenWork will discover and import them automatically.
+                </p>
+              </div>
+              <Toggle
+                checked={autoImportNewPlugins}
+                busy={false}
+                onChange={(next) => setAutoImportNewPlugins(next)}
+              />
+            </div>
+
+            {discoveryQuery.data.discoveredPlugins.length > 0 ? (
+              <div className="grid gap-3">
+                {discoveryQuery.data.discoveredPlugins.map((plugin) => (
+                  <DiscoveredPluginCard
+                    key={plugin.key}
+                    plugin={plugin}
+                    selected={selectedKeys.includes(plugin.key)}
+                    onToggle={() => {
+                      if (plugin.supported) toggleCandidate(plugin.key);
+                    }}
+                  />
+                ))}
+              </div>
+            ) : (
+              <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+                <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                  No Claude-compatible plugins detected
+                </p>
+                <p className="mx-auto mt-2 max-w-[440px] text-[13px] leading-6 text-gray-500">
+                  OpenWork currently only supports Claude-compatible plugins and marketplaces. Add <code className="rounded bg-gray-100 px-1 py-0.5 text-[11px]">.claude-plugin/marketplace.json</code> or <code className="rounded bg-gray-100 px-1 py-0.5 text-[11px]">.claude-plugin/plugin.json</code> to this repository.
+                </p>
+              </div>
+            )}
+          </div>
+
+          {discoveryQuery.data.discoveredPlugins.length > 0 ? (
+            <div className="flex flex-col-reverse items-stretch justify-between gap-3 rounded-2xl border border-gray-100 bg-white px-4 py-3 sm:flex-row sm:items-center">
+              <div className="min-w-0 text-[12.5px] text-gray-500">
+                {selectedPlugins.length === 0
+                  ? "Select at least one plugin to import."
+                  : `This will create ${selectedPlugins.length} plugin${selectedPlugins.length === 1 ? "" : "s"} and their mappings in OpenWork.`}
+              </div>
+              <DenButton
+                disabled={selectedPlugins.length === 0}
+                loading={applyMutation.isPending}
+                onClick={() => void handleApply()}
+              >
+                Create plugins and mappings
+              </DenButton>
+            </div>
+          ) : null}
+
+          {applyMutation.error ? (
+            <div className="rounded-2xl border border-red-100 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+              {applyMutation.error instanceof Error ? applyMutation.error.message : "Failed to apply discovery results."}
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+    </DashboardPageTemplate>
+  );
+}
+
+function DiscoveredPluginCard({
+  plugin,
+  selected,
+  onToggle,
+}: {
+  plugin: {
+    key: string;
+    displayName: string;
+    description: string | null;
+    rootPath: string;
+    sourceKind: string;
+    supported: boolean;
+    componentKinds: string[];
+    warnings: string[];
+  };
+  selected: boolean;
+  onToggle: () => void;
+}) {
+  const repoPath = plugin.rootPath === "" ? "/" : plugin.rootPath;
+
+  const baseClass = `group block w-full overflow-hidden rounded-2xl border text-left transition ${
+    !plugin.supported
+      ? "cursor-not-allowed border-gray-100 bg-white opacity-70"
+      : "border-gray-100 bg-white hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]"
+  }`;
+
+  return (
+    <button type="button" onClick={onToggle} disabled={!plugin.supported} className={baseClass}>
+      <div className="flex items-stretch">
+        <div className="relative w-[72px] shrink-0 overflow-hidden">
+          <div className="absolute inset-0">
+            <PaperMeshGradient seed={plugin.key} speed={0} />
+          </div>
+          <div className="relative flex h-full items-center justify-center">
+            <div className="flex h-10 w-10 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+              <Puzzle className="h-4 w-4 text-gray-700" aria-hidden />
+            </div>
+          </div>
+        </div>
+
+        <div className="min-w-0 flex-1 px-5 py-4">
+          <div className="flex items-start justify-between gap-3">
+            <div className="min-w-0 flex-1">
+              <div className="flex flex-wrap items-center gap-2">
+                <h3 className="truncate text-[15px] font-semibold tracking-[-0.02em] text-gray-900">
+                  {plugin.displayName}
+                </h3>
+                {!plugin.supported ? (
+                  <span className="inline-flex items-center rounded-full bg-amber-100 px-2 py-0.5 text-[10.5px] font-medium uppercase tracking-[0.06em] text-amber-700">
+                    Unsupported
+                  </span>
+                ) : null}
+              </div>
+              {plugin.description ? (
+                <p className="mt-0.5 line-clamp-2 text-[13px] leading-[1.55] text-gray-500">
+                  {plugin.description}
+                </p>
+              ) : null}
+            </div>
+            <div className="flex shrink-0 items-center gap-2">
+              <code className="rounded-md bg-gray-50 px-2 py-0.5 font-mono text-[11px] text-gray-500">
+                {repoPath}
+              </code>
+              <span
+                role="checkbox"
+                aria-checked={selected}
+                aria-disabled={!plugin.supported}
+                className={`flex h-[18px] w-[18px] shrink-0 items-center justify-center rounded-[5px] border transition ${
+                  !plugin.supported
+                    ? "border-gray-200 bg-gray-50 text-transparent"
+                    : selected
+                      ? "border-[#0f172a] bg-[#0f172a] text-white"
+                      : "border-gray-300 bg-white text-transparent group-hover:border-gray-500"
+                }`}
+              >
+                <svg viewBox="0 0 12 12" aria-hidden className="h-3 w-3">
+                  <path
+                    d="M2.5 6.2 4.8 8.4 9.5 3.6"
+                    fill="none"
+                    stroke="currentColor"
+                    strokeWidth="1.75"
+                    strokeLinecap="round"
+                    strokeLinejoin="round"
+                  />
+                </svg>
+              </span>
+            </div>
+          </div>
+
+          {plugin.componentKinds.length > 0 ? (
+            <div className="mt-3 flex flex-wrap gap-1.5 border-t border-gray-50 pt-3">
+              {plugin.componentKinds.map((kind) => (
+                <span
+                  key={`${plugin.key}:${kind}`}
+                  className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2.5 py-0.5 text-[11.5px] text-gray-600"
+                >
+                  {kind.replaceAll("_", " ")}
+                </span>
+              ))}
+            </div>
+          ) : null}
+
+          {plugin.warnings.length > 0 ? (
+            <p className="mt-2 text-[11.5px] text-amber-700">{plugin.warnings[0]}</p>
+          ) : null}
+        </div>
+      </div>
+    </button>
+  );
+}
+
+function DiscoveryAppliedState({
+  createdPluginNames,
+  createdMappingCount,
+  materializedConfigObjectCount,
+  onDone,
+}: {
+  createdPluginNames: string[];
+  createdMappingCount: number;
+  materializedConfigObjectCount: number;
+  onDone: () => void;
+}) {
+  return (
+    <div className="overflow-hidden rounded-2xl border border-emerald-100 bg-white">
+      <div className="flex items-start gap-4 px-6 py-5">
+        <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-emerald-50 text-emerald-600">
+          <CheckCircle2 className="h-5 w-5" />
+        </div>
+        <div className="min-w-0 flex-1">
+          <h2 className="text-[15px] font-semibold tracking-[-0.01em] text-gray-950">
+            Discovery applied
+          </h2>
+          <p className="mt-1 text-[12.5px] leading-[1.6] text-gray-500">
+            OpenWork created <span className="font-semibold text-gray-900">{createdPluginNames.length}</span> plugin{createdPluginNames.length === 1 ? "" : "s"},{" "}
+            <span className="font-semibold text-gray-900">{createdMappingCount}</span> mapping{createdMappingCount === 1 ? "" : "s"}, and{" "}
+            <span className="font-semibold text-gray-900">{materializedConfigObjectCount}</span> imported config object{materializedConfigObjectCount === 1 ? "" : "s"}.
+          </p>
+
+          {createdPluginNames.length > 0 ? (
+            <div className="mt-3 flex flex-wrap gap-1.5">
+              {createdPluginNames.map((name) => (
+                <span
+                  key={name}
+                  className="inline-flex items-center rounded-full bg-gray-50 px-2.5 py-0.5 text-[11.5px] text-gray-700"
+                >
+                  {name}
+                </span>
+              ))}
+            </div>
+          ) : null}
+        </div>
+      </div>
+      <div className="flex justify-end border-t border-gray-100 bg-gray-50/60 px-6 py-3">
+        <DenButton onClick={onDone}>Return to integrations</DenButton>
+      </div>
+    </div>
+  );
+}
+
+function DiscoveryLoadingState() {
+  return (
+    <section className="flex flex-col items-center justify-center rounded-2xl border border-gray-100 bg-white px-6 py-16 text-center">
+      <div className="flex h-12 w-12 items-center justify-center rounded-2xl bg-slate-950 text-white">
+        <LoaderCircle className="h-6 w-6 animate-spin" aria-hidden />
+      </div>
+      <h2 className="mt-5 text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+        Discovering marketplaces and plugins in your repository
+      </h2>
+      <p className="mt-2 max-w-[460px] text-[13px] leading-[1.6] text-gray-500">
+        OpenWork is scanning the repo for Claude-compatible plugin and marketplace manifests.
+      </p>
+    </section>
+  );
+}
+
+function StatePanel({ title, body }: { title: string; body: string }) {
+  return (
+    <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+      <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-900">{title}</p>
+      <p className="mx-auto mt-2 max-w-xl text-[13px] leading-6 text-gray-500">{body}</p>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-connect-dialog.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-connect-dialog.tsx
new file mode 100644
index 0000000000..6b9315064d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-connect-dialog.tsx
@@ -0,0 +1,455 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import {
+  ArrowRight,
+  CheckCircle2,
+  GitBranch,
+  Lock,
+  ShieldCheck,
+  X,
+} from "lucide-react";
+import { DenButton, buttonVariants } from "../../../../_components/ui/button";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenSelectableRow } from "../../../../_components/ui/selectable-row";
+import {
+  type IntegrationAccount,
+  type IntegrationProvider,
+  type IntegrationRepo,
+  getProviderMeta,
+  useConnectIntegration,
+  useIntegrationAccounts,
+  useIntegrationRepos,
+} from "./integration-data";
+
+/**
+ * IntegrationConnectDialog
+ *
+ * Walks the user through a realistic OAuth-style connect flow entirely in-app:
+ *   1. authorize        — eyebrow scopes + "Authorize" button (mocks the IdP redirect)
+ *   2. select_account   — pick a personal account or an org/workspace
+ *   3. select_repos     — pick one or more repos to expose
+ *   4. connecting       — spinner while the mutation resolves
+ *   5. connected        — success card with a "Done" CTA
+ *
+ * No real redirect to GitHub/Bitbucket — the "Authorize" step just advances
+ * the wizard. All progress is stateful client-side so the walkthrough feels
+ * real and the final React Query cache ends up in a correct state.
+ */
+
+type Step = "authorize" | "select_account" | "select_repos" | "connecting" | "connected";
+
+const STEP_ORDER: Step[] = ["authorize", "select_account", "select_repos", "connecting", "connected"];
+const STEP_LABELS: Record<Step, string> = {
+  authorize: "Authorize",
+  select_account: "Select account",
+  select_repos: "Select repositories",
+  connecting: "Connecting",
+  connected: "Connected",
+};
+
+export function IntegrationConnectDialog({
+  open,
+  provider,
+  onClose,
+}: {
+  open: boolean;
+  provider: IntegrationProvider | null;
+  onClose: () => void;
+}) {
+  const [step, setStep] = useState<Step>("authorize");
+  const [selectedAccount, setSelectedAccount] = useState<IntegrationAccount | null>(null);
+  const [selectedRepoIds, setSelectedRepoIds] = useState<Set<string>>(new Set());
+  const [repoQuery, setRepoQuery] = useState("");
+  const [localError, setLocalError] = useState<string | null>(null);
+
+  const accountsQuery = useIntegrationAccounts(provider ?? "github", Boolean(provider) && step === "select_account");
+  const reposQuery = useIntegrationRepos(provider ?? "github", selectedAccount?.id ?? null);
+  const connectMutation = useConnectIntegration();
+
+  // Reset the wizard every time the dialog is re-opened.
+  useEffect(() => {
+    if (open) {
+      setStep("authorize");
+      setSelectedAccount(null);
+      setSelectedRepoIds(new Set());
+      setRepoQuery("");
+      setLocalError(null);
+    }
+  }, [open, provider]);
+
+  if (!open || !provider) {
+    return null;
+  }
+
+  const meta = getProviderMeta(provider);
+  const stepIndex = STEP_ORDER.indexOf(step);
+  const progressLabel =
+    step === "connected"
+      ? "Done"
+      : `Step ${Math.min(stepIndex + 1, 4)} of 4 · ${STEP_LABELS[step]}`;
+
+  // Filtered repos for the select step.
+  const filteredRepos = useMemo(() => {
+    const repos = reposQuery.data ?? [];
+    const normalized = repoQuery.trim().toLowerCase();
+    if (!normalized) return repos;
+    return repos.filter(
+      (repo) =>
+        repo.fullName.toLowerCase().includes(normalized) ||
+        repo.description.toLowerCase().includes(normalized),
+    );
+  }, [reposQuery.data, repoQuery]);
+
+  function handleToggleRepo(repo: IntegrationRepo) {
+    setSelectedRepoIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(repo.id)) {
+        next.delete(repo.id);
+      } else {
+        next.add(repo.id);
+      }
+      return next;
+    });
+  }
+
+  async function handleConnect() {
+    if (!selectedAccount || !provider) return;
+    const repos = (reposQuery.data ?? []).filter((repo) => selectedRepoIds.has(repo.id));
+    if (repos.length === 0) {
+      setLocalError("Select at least one repository to connect.");
+      return;
+    }
+
+    setLocalError(null);
+    setStep("connecting");
+    try {
+      await connectMutation.mutateAsync({
+        provider,
+        account: selectedAccount,
+        repos,
+      });
+      setStep("connected");
+    } catch (error) {
+      setLocalError(error instanceof Error ? error.message : "Failed to connect integration.");
+      setStep("select_repos");
+    }
+  }
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-slate-950/45 px-4 py-6"
+      role="dialog"
+      aria-modal="true"
+      aria-label={`Connect ${meta.name}`}
+    >
+      <div className="relative w-full max-w-lg rounded-[28px] border border-gray-200 bg-white p-6 shadow-[0_24px_80px_-32px_rgba(15,23,42,0.45)]">
+        {/* Close */}
+        <button
+          type="button"
+          onClick={onClose}
+          className="absolute right-5 top-5 inline-flex h-8 w-8 items-center justify-center rounded-full text-gray-400 transition hover:bg-gray-100 hover:text-gray-700"
+          aria-label="Close"
+        >
+          <X className="h-4 w-4" />
+        </button>
+
+        {/* Header */}
+        <div className="grid gap-2 pr-8">
+          <p className="text-[12px] font-semibold uppercase tracking-[0.18em] text-gray-400">
+            {progressLabel}
+          </p>
+          <div className="flex items-center gap-3">
+            <ProviderBadge provider={provider} />
+            <div>
+              <h2 className="text-[20px] font-semibold tracking-[-0.03em] text-gray-950">
+                Connect {meta.name}
+              </h2>
+              <p className="text-[13px] text-gray-500">{meta.description}</p>
+            </div>
+          </div>
+        </div>
+
+        {/* Body */}
+        <div className="mt-6">
+          {step === "authorize" ? (
+            <AuthorizeStep scopes={meta.scopes} providerName={meta.name} />
+          ) : step === "select_account" ? (
+            <SelectAccountStep
+              accounts={accountsQuery.data ?? []}
+              loading={accountsQuery.isLoading}
+              selectedId={selectedAccount?.id ?? null}
+              onSelect={(account) => {
+                setSelectedAccount(account);
+              }}
+            />
+          ) : step === "select_repos" ? (
+            <SelectReposStep
+              repos={filteredRepos}
+              totalCount={(reposQuery.data ?? []).length}
+              loading={reposQuery.isLoading}
+              selectedIds={selectedRepoIds}
+              onToggle={handleToggleRepo}
+              query={repoQuery}
+              onQueryChange={setRepoQuery}
+            />
+          ) : step === "connecting" ? (
+            <ConnectingStep providerName={meta.name} />
+          ) : (
+            <ConnectedStep
+              providerName={meta.name}
+              account={selectedAccount}
+              repoCount={selectedRepoIds.size}
+            />
+          )}
+        </div>
+
+        {/* Error */}
+        {localError ? (
+          <div className="mt-4 rounded-2xl border border-red-200 bg-red-50 px-4 py-3 text-[13px] text-red-700">
+            {localError}
+          </div>
+        ) : null}
+
+        {/* Footer actions */}
+        <div className="mt-6 flex flex-col gap-3 sm:flex-row sm:justify-end">
+          {step === "authorize" ? (
+            <>
+              <DenButton variant="secondary" onClick={onClose}>
+                Cancel
+              </DenButton>
+              <DenButton onClick={() => setStep("select_account")} icon={ArrowRight}>
+                Authorize with {meta.name}
+              </DenButton>
+            </>
+          ) : step === "select_account" ? (
+            <>
+              <DenButton variant="secondary" onClick={() => setStep("authorize")}>
+                Back
+              </DenButton>
+              <DenButton
+                onClick={() => setStep("select_repos")}
+                disabled={!selectedAccount}
+                icon={ArrowRight}
+              >
+                Continue
+              </DenButton>
+            </>
+          ) : step === "select_repos" ? (
+            <>
+              <DenButton variant="secondary" onClick={() => setStep("select_account")}>
+                Back
+              </DenButton>
+              <DenButton
+                onClick={() => void handleConnect()}
+                disabled={selectedRepoIds.size === 0}
+                loading={connectMutation.isPending}
+              >
+                {selectedRepoIds.size === 0
+                  ? "Select a repository"
+                  : `Connect ${selectedRepoIds.size} ${selectedRepoIds.size === 1 ? "repo" : "repos"}`}
+              </DenButton>
+            </>
+          ) : step === "connecting" ? (
+            <span className={buttonVariants({ variant: "secondary" })}>Working…</span>
+          ) : (
+            <DenButton onClick={onClose}>Done</DenButton>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// ── Step components ────────────────────────────────────────────────────────
+
+function ProviderBadge({ provider }: { provider: IntegrationProvider }) {
+  const bg = provider === "github" ? "bg-[#0f172a]" : "bg-[#2684FF]";
+  const label = provider === "github" ? "GH" : "BB";
+  return (
+    <div
+      className={`flex h-10 w-10 items-center justify-center rounded-[12px] text-[13px] font-semibold text-white ${bg}`}
+      aria-hidden="true"
+    >
+      {label}
+    </div>
+  );
+}
+
+function AuthorizeStep({ providerName, scopes }: { providerName: string; scopes: string[] }) {
+  return (
+    <div className="rounded-2xl border border-gray-100 bg-gray-50/60 p-5">
+      <p className="flex items-center gap-2 text-[13px] font-medium text-gray-900">
+        <ShieldCheck className="h-4 w-4 text-gray-500" />
+        {providerName} is requesting the following permissions
+      </p>
+      <ul className="mt-3 grid gap-2 text-[13px] text-gray-600">
+        {scopes.map((scope) => (
+          <li key={scope} className="flex items-center gap-2">
+            <Lock className="h-3.5 w-3.5 text-gray-400" />
+            <code className="rounded bg-white px-1.5 py-0.5 text-[12px] text-gray-700 ring-1 ring-gray-200">
+              {scope}
+            </code>
+          </li>
+        ))}
+      </ul>
+      <p className="mt-4 text-[12px] leading-5 text-gray-400">
+        You will be redirected to {providerName} to approve access. This preview simulates that
+        redirect — no data leaves your browser.
+      </p>
+    </div>
+  );
+}
+
+function SelectAccountStep({
+  accounts,
+  loading,
+  selectedId,
+  onSelect,
+}: {
+  accounts: IntegrationAccount[];
+  loading: boolean;
+  selectedId: string | null;
+  onSelect: (account: IntegrationAccount) => void;
+}) {
+  if (loading) {
+    return (
+      <div className="rounded-2xl border border-dashed border-gray-200 px-5 py-10 text-center text-[13px] text-gray-400">
+        Loading accounts…
+      </div>
+    );
+  }
+  if (accounts.length === 0) {
+    return (
+      <div className="rounded-2xl border border-dashed border-gray-200 px-5 py-10 text-center text-[13px] text-gray-400">
+        No accounts available.
+      </div>
+    );
+  }
+  return (
+    <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+      <div className="divide-y divide-gray-100">
+        {accounts.map((account) => (
+          <DenSelectableRow
+            key={account.id}
+            title={account.name}
+            description={account.kind === "user" ? "Personal account" : "Organization"}
+            descriptionBelow
+            selected={selectedId === account.id}
+            onClick={() => onSelect(account)}
+            leading={
+              <div className="flex h-8 w-8 items-center justify-center rounded-full bg-[#0f172a] text-[12px] font-semibold text-white">
+                {account.avatarInitial}
+              </div>
+            }
+          />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function SelectReposStep({
+  repos,
+  totalCount,
+  loading,
+  selectedIds,
+  onToggle,
+  query,
+  onQueryChange,
+}: {
+  repos: IntegrationRepo[];
+  totalCount: number;
+  loading: boolean;
+  selectedIds: Set<string>;
+  onToggle: (repo: IntegrationRepo) => void;
+  query: string;
+  onQueryChange: (value: string) => void;
+}) {
+  return (
+    <div className="grid gap-3">
+      <DenInput
+        type="search"
+        value={query}
+        onChange={(event) => onQueryChange(event.target.value)}
+        placeholder="Filter repositories..."
+      />
+
+      {loading ? (
+        <div className="rounded-2xl border border-dashed border-gray-200 px-5 py-10 text-center text-[13px] text-gray-400">
+          Loading repositories…
+        </div>
+      ) : repos.length === 0 ? (
+        <div className="rounded-2xl border border-dashed border-gray-200 px-5 py-10 text-center text-[13px] text-gray-400">
+          {totalCount === 0 ? "No repositories available on this account." : "No repositories match that filter."}
+        </div>
+      ) : (
+        <div className="max-h-[320px] overflow-y-auto rounded-2xl border border-gray-100 bg-white">
+          <div className="divide-y divide-gray-100">
+            {repos.map((repo) => (
+              <DenSelectableRow
+                key={repo.id}
+                title={repo.fullName}
+                description={repo.description}
+                descriptionBelow
+                selected={selectedIds.has(repo.id)}
+                onClick={() => onToggle(repo)}
+                leading={<GitBranch className="h-4 w-4 text-gray-400" />}
+                aside={
+                  repo.hasPlugins ? (
+                    <span className="rounded-full bg-emerald-50 px-2 py-0.5 text-[11px] font-medium text-emerald-700">
+                      has plugins
+                    </span>
+                  ) : null
+                }
+              />
+            ))}
+          </div>
+        </div>
+      )}
+
+      <p className="text-[12px] text-gray-400">
+        {selectedIds.size === 0
+          ? "Select one or more repos to expose their plugins and skills."
+          : `${selectedIds.size} of ${totalCount} selected.`}
+      </p>
+    </div>
+  );
+}
+
+function ConnectingStep({ providerName }: { providerName: string }) {
+  return (
+    <div className="rounded-2xl border border-gray-100 bg-gray-50/60 px-5 py-10 text-center">
+      <div className="mx-auto mb-3 flex h-10 w-10 items-center justify-center">
+        <svg aria-hidden="true" className="h-8 w-8 animate-spin text-gray-500" viewBox="0 0 24 24" fill="none">
+          <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+          <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z" />
+        </svg>
+      </div>
+      <p className="text-[14px] font-medium text-gray-900">Installing {providerName} integration…</p>
+      <p className="mt-1 text-[12px] text-gray-500">Registering webhooks and indexing repository manifests.</p>
+    </div>
+  );
+}
+
+function ConnectedStep({
+  providerName,
+  account,
+  repoCount,
+}: {
+  providerName: string;
+  account: IntegrationAccount | null;
+  repoCount: number;
+}) {
+  return (
+    <div className="rounded-2xl border border-emerald-200 bg-emerald-50/60 px-5 py-6 text-center">
+      <CheckCircle2 className="mx-auto mb-2 h-8 w-8 text-emerald-700" />
+      <p className="text-[14px] font-medium text-gray-900">
+        {providerName} connected{account ? ` · ${account.name}` : ""}
+      </p>
+      <p className="mt-1 text-[12px] text-gray-500">
+        {repoCount} {repoCount === 1 ? "repository" : "repositories"} will now contribute plugins and skills.
+      </p>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-data.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-data.tsx
new file mode 100644
index 0000000000..2ecf93166a
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integration-data.tsx
@@ -0,0 +1,977 @@
+"use client";
+
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+export type IntegrationProvider = "github" | "bitbucket";
+
+export type IntegrationAccount = {
+  id: string;
+  installationId?: number;
+  manageUrl?: string | null;
+  name: string;
+  kind: "user" | "org";
+  avatarInitial: string;
+  createdByName?: string | null;
+  ownerName?: string;
+  repositorySelection?: "all" | "selected";
+};
+
+export type IntegrationRepoManifestKind = "marketplace" | "plugin" | null;
+
+export type IntegrationRepo = {
+  connectorInstanceId?: string;
+  id: string;
+  name: string;
+  fullName: string;
+  description: string;
+  hasPluginManifest?: boolean;
+  manifestKind?: IntegrationRepoManifestKind;
+  marketplacePluginCount?: number | null;
+  hasPlugins: boolean;
+  defaultBranch?: string | null;
+  private?: boolean;
+};
+
+export type ConnectedIntegration = {
+  id: string;
+  provider: IntegrationProvider;
+  account: IntegrationAccount;
+  repos: IntegrationRepo[];
+  connectedAt: string;
+};
+
+export type GithubInstallStartResult = {
+  redirectUrl: string;
+  state: string;
+};
+
+export type GithubInstallCompleteResult = {
+  connectorAccount: {
+    id: string;
+    displayName: string;
+    metadata?: Record<string, unknown>;
+  };
+  repositories: IntegrationRepo[];
+};
+
+export type GithubConnectorCreationResult = {
+  connectorInstanceId: string;
+  connectorTargetId: string;
+  repositoryFullName: string;
+};
+
+export type GithubDiscoveryStep = {
+  id: string;
+  label: string;
+  status: "completed" | "running" | "warning";
+};
+
+export type GithubDiscoveredPlugin = {
+  componentKinds: string[];
+  componentPaths: {
+    agents: string[];
+    commands: string[];
+    hooks: string[];
+    lspServers: string[];
+    mcpServers: string[];
+    monitors: string[];
+    settings: string[];
+    skills: string[];
+  };
+  description: string | null;
+  displayName: string;
+  key: string;
+  manifestPath: string | null;
+  rootPath: string;
+  selectedByDefault: boolean;
+  sourceKind: string;
+  supported: boolean;
+  warnings: string[];
+};
+
+export type GithubConnectorDiscoveryResult = {
+  autoImportNewPlugins: boolean;
+  classification: string;
+  connectorInstanceId: string;
+  connectorTargetId: string;
+  discoveredPlugins: GithubDiscoveredPlugin[];
+  repositoryFullName: string;
+  sourceRevisionRef: string;
+  steps: GithubDiscoveryStep[];
+  treeSummary: {
+    scannedEntryCount: number;
+    strategy: string;
+    truncated: boolean;
+  };
+  warnings: string[];
+};
+
+export type GithubDiscoveryApplyResult = {
+  autoImportNewPlugins: boolean;
+  createdMappingCount: number;
+  materializedConfigObjectCount: number;
+  createdPluginNames: string[];
+};
+
+type IntegrationProviderMeta = {
+  provider: IntegrationProvider;
+  name: string;
+  description: string;
+  docsHref: string;
+  scopes: string[];
+};
+
+export const INTEGRATION_PROVIDERS: Record<IntegrationProvider, IntegrationProviderMeta> = {
+  github: {
+    provider: "github",
+    name: "GitHub",
+    description: "Install the OpenWork GitHub App, then pick a repository to turn into a connector instance.",
+    docsHref: "https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps",
+    scopes: ["metadata:read", "contents:read", "webhooks"],
+  },
+  bitbucket: {
+    provider: "bitbucket",
+    name: "Bitbucket",
+    description: "Connect Bitbucket workspaces to pull in plugins and skills from your team repos.",
+    docsHref: "https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/",
+    scopes: ["repository", "account"],
+  },
+};
+
+let mockConnections: ConnectedIntegration[] = [];
+
+export function getMockAccountsFor(provider: IntegrationProvider): IntegrationAccount[] {
+  if (provider === "github") {
+    return [
+      { id: "acc_gh_user", name: "bshafii", kind: "user", avatarInitial: "B" },
+      { id: "acc_gh_different_ai", name: "different-ai", kind: "org", avatarInitial: "D" },
+      { id: "acc_gh_openwork", name: "openwork-labs", kind: "org", avatarInitial: "O" },
+    ];
+  }
+  return [
+    { id: "acc_bb_user", name: "bshafii", kind: "user", avatarInitial: "B" },
+    { id: "acc_bb_openwork", name: "openwork", kind: "org", avatarInitial: "O" },
+  ];
+}
+
+export function getMockReposFor(provider: IntegrationProvider, accountId: string): IntegrationRepo[] {
+  const tag = `${provider}:${accountId}`;
+  const base: IntegrationRepo[] = [
+    {
+      id: `${tag}:openwork`,
+      name: "openwork",
+      fullName: `${accountToLabel(accountId)}/openwork`,
+      description: "Core OpenWork monorepo — desktop, server, and orchestrator.",
+      hasPlugins: true,
+    },
+    {
+      id: `${tag}:openwork-plugins`,
+      name: "openwork-plugins",
+      fullName: `${accountToLabel(accountId)}/openwork-plugins`,
+      description: "Internal plugin marketplace: release kit, commit commands, linear groomer.",
+      hasPlugins: true,
+    },
+    {
+      id: `${tag}:den-infra`,
+      name: "den-infra",
+      fullName: `${accountToLabel(accountId)}/den-infra`,
+      description: "Infra-as-code for Den Cloud. No plugins yet.",
+      hasPlugins: false,
+    },
+  ];
+  return base;
+}
+
+function accountToLabel(accountId: string): string {
+  if (accountId.includes("openwork-labs")) return "openwork-labs";
+  if (accountId.includes("openwork")) return "openwork";
+  if (accountId.includes("different-ai")) return "different-ai";
+  return "bshafii";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function asNullableString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function parseGithubConnectorAccounts(payload: unknown) {
+  if (!isRecord(payload) || !Array.isArray(payload.items)) {
+    return [];
+  }
+
+  return payload.items.flatMap((entry) => {
+    if (!isRecord(entry)) {
+      return [];
+    }
+
+    const id = asString(entry.id);
+    const displayName = asString(entry.displayName);
+    const createdAt = asString(entry.createdAt);
+    const externalAccountRef = asString(entry.externalAccountRef);
+    const createdByName = asNullableString(entry.createdByName);
+    const metadata = isRecord(entry.metadata) ? entry.metadata : undefined;
+    if (!id || !displayName || !createdAt) {
+      return [];
+    }
+
+    const remoteId = asString(entry.remoteId);
+    return [{ id, createdAt, createdByName, displayName, externalAccountRef, metadata, remoteId }];
+  });
+}
+
+function parseGithubConnectorInstances(payload: unknown) {
+  if (!isRecord(payload) || !Array.isArray(payload.items)) {
+    return [];
+  }
+
+  return payload.items.flatMap((entry) => {
+    if (!isRecord(entry)) {
+      return [];
+    }
+
+    const id = asString(entry.id);
+    const connectorAccountId = asString(entry.connectorAccountId);
+    const remoteId = asNullableString(entry.remoteId);
+    const name = asString(entry.name);
+    if (!id || !connectorAccountId || !name) {
+      return [];
+    }
+
+    return [{ connectorAccountId, id, name, remoteId }];
+  });
+}
+
+function toAccountKind(metadata: Record<string, unknown> | undefined): "org" | "user" {
+  return metadata?.accountType === "Organization" ? "org" : "user";
+}
+
+function toAvatarInitial(name: string) {
+  return name.trim().charAt(0).toUpperCase() || "?";
+}
+
+function toRepoName(fullName: string) {
+  const parts = fullName.split("/");
+  return parts[parts.length - 1] ?? fullName;
+}
+
+async function simulateLatency(ms = 450) {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function fetchGithubConnections() {
+  const [accountsResult, instancesResult] = await Promise.all([
+    requestJson("/v1/connector-accounts?connectorType=github&status=active&limit=100", { method: "GET" }, 15000),
+    requestJson("/v1/connector-instances?connectorType=github&status=active&limit=100", { method: "GET" }, 15000),
+  ]);
+
+  if (!accountsResult.response.ok) {
+    throw new Error(getErrorMessage(accountsResult.payload, `Failed to load GitHub integrations (${accountsResult.response.status}).`));
+  }
+  if (!instancesResult.response.ok) {
+    throw new Error(getErrorMessage(instancesResult.payload, `Failed to load GitHub connector instances (${instancesResult.response.status}).`));
+  }
+
+  const accounts = parseGithubConnectorAccounts(accountsResult.payload);
+  const instances = parseGithubConnectorInstances(instancesResult.payload);
+
+  return accounts.map<ConnectedIntegration>((account) => ({
+    id: account.id,
+    provider: "github",
+    account: {
+      avatarInitial: toAvatarInitial(account.displayName),
+      createdByName: account.createdByName,
+      id: account.id,
+      installationId: account.remoteId ? Number(account.remoteId) : undefined,
+      kind: toAccountKind(account.metadata),
+      manageUrl: typeof account.metadata?.settingsUrl === "string" ? account.metadata.settingsUrl : null,
+      name: account.displayName,
+      ownerName: account.externalAccountRef ?? (typeof account.metadata?.accountLogin === "string" ? account.metadata.accountLogin : undefined),
+      repositorySelection: account.metadata?.repositorySelection === "selected" ? "selected" : "all",
+    },
+    connectedAt: account.createdAt,
+    repos: instances
+      .filter((instance) => instance.connectorAccountId === account.id && instance.remoteId)
+      .map((instance) => ({
+        connectorInstanceId: instance.id,
+        defaultBranch: null,
+        description: "Repository selected for connector sync.",
+        fullName: instance.remoteId ?? instance.name,
+        hasPlugins: true,
+        id: instance.id,
+        name: toRepoName(instance.remoteId ?? instance.name),
+      })),
+  }));
+}
+
+async function fetchConnections(): Promise<ConnectedIntegration[]> {
+  const githubConnections = await fetchGithubConnections();
+  return [...githubConnections, ...mockConnections];
+}
+
+export function formatIntegrationTimestamp(value: string | null): string {
+  if (!value) return "Recently connected";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return "Recently connected";
+  return new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+  }).format(date);
+}
+
+export function getProviderMeta(provider: IntegrationProvider): IntegrationProviderMeta {
+  return INTEGRATION_PROVIDERS[provider];
+}
+
+export const integrationQueryKeys = {
+  all: ["integrations"] as const,
+  list: (orgId?: string | null) => [...integrationQueryKeys.all, "list", orgId ?? "none"] as const,
+  accounts: (provider: IntegrationProvider) => [...integrationQueryKeys.all, "accounts", provider] as const,
+  repos: (provider: IntegrationProvider, accountId: string | null) =>
+    [...integrationQueryKeys.all, "repos", provider, accountId ?? "none"] as const,
+  githubInstall: (installationId: number | null) => [...integrationQueryKeys.all, "github-install", installationId ?? 0] as const,
+  githubDiscovery: (connectorInstanceId: string | null) => [...integrationQueryKeys.all, "github-discovery", connectorInstanceId ?? "none"] as const,
+  connectorInstanceConfiguration: (connectorInstanceId: string | null) => [...integrationQueryKeys.all, "connector-instance-config", connectorInstanceId ?? "none"] as const,
+};
+
+export type ConnectorInstanceConfiguredPlugin = {
+  id: string;
+  name: string;
+  description: string | null;
+  memberCount: number;
+  componentCounts: Record<string, number>;
+  rootPath: string | null;
+};
+
+export type ConnectorInstanceConfiguration = {
+  autoImportNewPlugins: boolean;
+  configuredPlugins: ConnectorInstanceConfiguredPlugin[];
+  connectorInstanceId: string;
+  connectorInstanceName: string;
+  importedConfigObjectCount: number;
+  mappingCount: number;
+  repositoryFullName: string | null;
+};
+
+export function useIntegrations() {
+  const { orgId } = useOrgDashboard();
+
+  return useQuery({
+    enabled: Boolean(orgId),
+    queryKey: integrationQueryKeys.list(orgId),
+    queryFn: fetchConnections,
+  });
+}
+
+export function useHasAnyIntegration(): { hasAny: boolean; isLoading: boolean } {
+  const { data, isLoading } = useIntegrations();
+  return { hasAny: (data?.length ?? 0) > 0, isLoading };
+}
+
+export function useIntegrationAccounts(provider: IntegrationProvider, enabled: boolean) {
+  return useQuery({
+    queryKey: integrationQueryKeys.accounts(provider),
+    queryFn: async () => {
+      await simulateLatency();
+      return getMockAccountsFor(provider);
+    },
+    enabled,
+  });
+}
+
+export function useIntegrationRepos(provider: IntegrationProvider, accountId: string | null) {
+  return useQuery({
+    queryKey: integrationQueryKeys.repos(provider, accountId),
+    queryFn: async () => {
+      if (!accountId) return [];
+      await simulateLatency();
+      return getMockReposFor(provider, accountId);
+    },
+    enabled: Boolean(accountId),
+  });
+}
+
+export function useStartGithubInstall() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: { returnPath: string }): Promise<GithubInstallStartResult> => {
+      const { response, payload } = await requestJson(
+        "/v1/connectors/github/install/start",
+        {
+          method: "POST",
+          body: JSON.stringify({ returnPath: input.returnPath }),
+        },
+        15000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to start GitHub install (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const redirectUrl = item ? asString(item.redirectUrl) : null;
+      const state = item ? asString(item.state) : null;
+      if (!redirectUrl || !state) {
+        throw new Error("GitHub install start response was incomplete.");
+      }
+
+      return { redirectUrl, state };
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+    },
+  });
+}
+
+export function useGithubInstallCompletion(input: { installationId: number | null; state: string | null }) {
+  return useQuery({
+    enabled: Number.isFinite(input.installationId ?? NaN) && (input.installationId ?? 0) > 0 && Boolean(input.state?.trim()),
+    queryKey: [...integrationQueryKeys.githubInstall(input.installationId), input.state ?? "no-state"] as const,
+    retry: false,
+    queryFn: async (): Promise<GithubInstallCompleteResult> => {
+      const { response, payload } = await requestJson(
+        "/v1/connectors/github/install/complete",
+        {
+          method: "POST",
+          body: JSON.stringify({ installationId: input.installationId, state: input.state }),
+        },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to complete GitHub installation (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const connectorAccount = item && isRecord(item.connectorAccount) ? item.connectorAccount : null;
+      const repositories = item && Array.isArray(item.repositories)
+        ? item.repositories.flatMap((entry) => {
+            if (!isRecord(entry)) {
+              return [];
+            }
+
+            const id = typeof entry.id === "number" ? String(entry.id) : asString(entry.id);
+            const fullName = asString(entry.fullName);
+            if (!id || !fullName) {
+              return [];
+            }
+
+            const manifestKindValue = entry.manifestKind;
+            const manifestKind: IntegrationRepoManifestKind = manifestKindValue === "marketplace" || manifestKindValue === "plugin"
+              ? manifestKindValue
+              : null;
+            return [{
+              defaultBranch: asNullableString(entry.defaultBranch),
+              description: manifestKind === "marketplace"
+                ? "Claude marketplace manifest detected."
+                : manifestKind === "plugin"
+                  ? "Claude plugin manifest detected."
+                  : "Repository available to connect.",
+              fullName,
+              hasPluginManifest: Boolean(entry.hasPluginManifest),
+              hasPlugins: Boolean(entry.hasPluginManifest),
+              id,
+              manifestKind,
+              marketplacePluginCount: typeof entry.marketplacePluginCount === "number" ? entry.marketplacePluginCount : null,
+              name: toRepoName(fullName),
+              private: Boolean(entry.private),
+            } satisfies IntegrationRepo];
+          })
+        : [];
+
+      if (!connectorAccount || !asString(connectorAccount.id) || !asString(connectorAccount.displayName)) {
+        throw new Error("GitHub install completion response was incomplete.");
+      }
+
+      return {
+        connectorAccount: {
+          displayName: asString(connectorAccount.displayName) ?? "GitHub",
+          id: asString(connectorAccount.id) ?? "",
+          metadata: isRecord(connectorAccount.metadata) ? connectorAccount.metadata : undefined,
+        },
+        repositories,
+      };
+    },
+  });
+}
+
+export function useGithubAccountRepositories(connectorAccountId: string | null) {
+  return useQuery({
+    enabled: Boolean(connectorAccountId),
+    queryKey: [...integrationQueryKeys.repos("github", connectorAccountId), "connected-account"] as const,
+    queryFn: async (): Promise<IntegrationRepo[]> => {
+      const { response, payload } = await requestJson(
+        `/v1/connectors/github/accounts/${encodeURIComponent(connectorAccountId ?? "")}/repositories?limit=100`,
+        { method: "GET" },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load GitHub repositories (${response.status}).`));
+      }
+
+      return isRecord(payload) && Array.isArray(payload.items)
+        ? payload.items.flatMap((entry) => {
+            if (!isRecord(entry)) {
+              return [];
+            }
+
+            const id = typeof entry.id === "number" ? String(entry.id) : asString(entry.id);
+            const fullName = asString(entry.fullName);
+            if (!id || !fullName) {
+              return [];
+            }
+
+            const manifestKindValue = entry.manifestKind;
+            const manifestKind: IntegrationRepoManifestKind = manifestKindValue === "marketplace" || manifestKindValue === "plugin"
+              ? manifestKindValue
+              : null;
+            return [{
+              defaultBranch: asNullableString(entry.defaultBranch),
+              description: manifestKind === "marketplace"
+                ? "Claude marketplace manifest detected."
+                : manifestKind === "plugin"
+                  ? "Claude plugin manifest detected."
+                  : "Repository available to connect.",
+              fullName,
+              hasPluginManifest: Boolean(entry.hasPluginManifest),
+              hasPlugins: Boolean(entry.hasPluginManifest),
+              id,
+              manifestKind,
+              marketplacePluginCount: typeof entry.marketplacePluginCount === "number" ? entry.marketplacePluginCount : null,
+              name: toRepoName(fullName),
+              private: Boolean(entry.private),
+            } satisfies IntegrationRepo];
+          })
+        : [];
+    },
+  });
+}
+
+export function useCreateGithubConnectorInstance() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: {
+      branch: string;
+      connectorAccountId: string;
+      connectorInstanceName: string;
+      installationId: number;
+      repositoryFullName: string;
+      repositoryId: number;
+    }): Promise<GithubConnectorCreationResult> => {
+      const { response, payload } = await requestJson(
+        "/v1/connectors/github/setup",
+        {
+          method: "POST",
+          body: JSON.stringify({
+            branch: input.branch,
+            connectorAccountId: input.connectorAccountId,
+            connectorInstanceName: input.connectorInstanceName,
+            installationId: input.installationId,
+            mappings: [],
+            ref: `refs/heads/${input.branch}`,
+            repositoryFullName: input.repositoryFullName,
+            repositoryId: input.repositoryId,
+          }),
+        },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to connect GitHub repository (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const connectorInstance = item && isRecord(item.connectorInstance) ? item.connectorInstance : null;
+      const connectorTarget = item && isRecord(item.connectorTarget) ? item.connectorTarget : null;
+      const connectorInstanceId = connectorInstance ? asString(connectorInstance.id) : null;
+      const connectorTargetId = connectorTarget ? asString(connectorTarget.id) : null;
+      const repositoryFullName = connectorTarget && isRecord(connectorTarget.targetConfigJson)
+        ? asString(connectorTarget.targetConfigJson.repositoryFullName)
+        : null;
+
+      if (!connectorInstanceId || !connectorTargetId || !repositoryFullName) {
+        throw new Error("GitHub setup response was incomplete.");
+      }
+
+      return {
+        connectorInstanceId,
+        connectorTargetId,
+        repositoryFullName,
+      };
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+      queryClient.invalidateQueries({ queryKey: ["plugins"] });
+    },
+  });
+}
+
+export function useGithubConnectorDiscovery(connectorInstanceId: string | null) {
+  return useQuery({
+    enabled: Boolean(connectorInstanceId),
+    queryKey: integrationQueryKeys.githubDiscovery(connectorInstanceId),
+    queryFn: async (): Promise<GithubConnectorDiscoveryResult> => {
+      const { response, payload } = await requestJson(
+        `/v1/connector-instances/${encodeURIComponent(connectorInstanceId ?? "")}/discovery`,
+        { method: "GET" },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to inspect GitHub repository (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const connectorInstance = item && isRecord(item.connectorInstance) ? item.connectorInstance : null;
+      const connectorTarget = item && isRecord(item.connectorTarget) ? item.connectorTarget : null;
+      const connectorInstanceIdValue = connectorInstance ? asString(connectorInstance.id) : null;
+      const connectorTargetId = connectorTarget ? asString(connectorTarget.id) : null;
+      const repositoryFullName = item ? asString(item.repositoryFullName) : null;
+      const sourceRevisionRef = item ? asString(item.sourceRevisionRef) : null;
+      const classification = item ? asString(item.classification) : null;
+      const discoveredPlugins = item && Array.isArray(item.discoveredPlugins)
+        ? item.discoveredPlugins.flatMap((entry) => {
+            if (!isRecord(entry)) {
+              return [];
+            }
+
+            const key = asString(entry.key);
+            const displayName = asString(entry.displayName);
+            if (!key || !displayName) {
+              return [];
+            }
+
+            const componentPaths = isRecord(entry.componentPaths) ? entry.componentPaths : {};
+            const asStringArray = (value: unknown) => Array.isArray(value)
+              ? value.flatMap((candidate) => {
+                  const normalized = asString(candidate);
+                  return normalized ? [normalized] : [];
+                })
+              : [];
+
+            return [{
+              componentKinds: Array.isArray(entry.componentKinds)
+                ? entry.componentKinds.flatMap((candidate) => {
+                    const normalized = asString(candidate);
+                    return normalized ? [normalized] : [];
+                  })
+                : [],
+              componentPaths: {
+                agents: asStringArray(componentPaths.agents),
+                commands: asStringArray(componentPaths.commands),
+                hooks: asStringArray(componentPaths.hooks),
+                lspServers: asStringArray(componentPaths.lspServers),
+                mcpServers: asStringArray(componentPaths.mcpServers),
+                monitors: asStringArray(componentPaths.monitors),
+                settings: asStringArray(componentPaths.settings),
+                skills: asStringArray(componentPaths.skills),
+              },
+              description: asNullableString(entry.description),
+              displayName,
+              key,
+              manifestPath: asNullableString(entry.manifestPath),
+              rootPath: typeof entry.rootPath === "string" ? entry.rootPath : "",
+              selectedByDefault: Boolean(entry.selectedByDefault),
+              sourceKind: asString(entry.sourceKind) ?? "folder_inference",
+              supported: Boolean(entry.supported),
+              warnings: Array.isArray(entry.warnings)
+                ? entry.warnings.flatMap((candidate) => {
+                    const normalized = asString(candidate);
+                    return normalized ? [normalized] : [];
+                  })
+                : [],
+            } satisfies GithubDiscoveredPlugin];
+          })
+        : [];
+      const steps = item && Array.isArray(item.steps)
+        ? item.steps.flatMap((entry) => {
+            if (!isRecord(entry)) {
+              return [];
+            }
+
+            const id = asString(entry.id);
+            const label = asString(entry.label);
+            const status = asString(entry.status);
+            if (!id || !label || (status !== "completed" && status !== "running" && status !== "warning")) {
+              return [];
+            }
+
+            return [{ id, label, status } satisfies GithubDiscoveryStep];
+          })
+        : [];
+      const treeSummary = item && isRecord(item.treeSummary)
+        ? {
+            scannedEntryCount: typeof item.treeSummary.scannedEntryCount === "number" ? item.treeSummary.scannedEntryCount : 0,
+            strategy: asString(item.treeSummary.strategy) ?? "git-tree-recursive",
+            truncated: Boolean(item.treeSummary.truncated),
+          }
+        : { scannedEntryCount: 0, strategy: "git-tree-recursive", truncated: false };
+      const warnings = item && Array.isArray(item.warnings)
+        ? item.warnings.flatMap((entry) => {
+            const normalized = asString(entry);
+            return normalized ? [normalized] : [];
+          })
+        : [];
+
+      const autoImportNewPlugins = item ? Boolean(item.autoImportNewPlugins) : false;
+
+      if (!connectorInstanceIdValue || !connectorTargetId || !repositoryFullName || !sourceRevisionRef || !classification) {
+        throw new Error("GitHub discovery response was incomplete.");
+      }
+
+      return {
+        autoImportNewPlugins,
+        classification,
+        connectorInstanceId: connectorInstanceIdValue,
+        connectorTargetId,
+        discoveredPlugins,
+        repositoryFullName,
+        sourceRevisionRef,
+        steps,
+        treeSummary,
+        warnings,
+      };
+    },
+  });
+}
+
+export function useApplyGithubDiscovery() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: { autoImportNewPlugins: boolean; connectorInstanceId: string; selectedKeys: string[] }): Promise<GithubDiscoveryApplyResult> => {
+      const { response, payload } = await requestJson(
+        `/v1/connector-instances/${encodeURIComponent(input.connectorInstanceId)}/discovery/apply`,
+        {
+          method: "POST",
+          body: JSON.stringify({ autoImportNewPlugins: input.autoImportNewPlugins, selectedKeys: input.selectedKeys }),
+        },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to apply GitHub discovery (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const createdPlugins = item && Array.isArray(item.createdPlugins)
+        ? item.createdPlugins.flatMap((entry) => {
+            if (!isRecord(entry)) return [];
+            const name = asString(entry.name);
+            return name ? [name] : [];
+          })
+        : [];
+      const createdMappingCount = item && Array.isArray(item.createdMappings) ? item.createdMappings.length : 0;
+      const materializedConfigObjectCount = item && Array.isArray(item.materializedConfigObjects) ? item.materializedConfigObjects.length : 0;
+
+      return {
+        autoImportNewPlugins: item ? Boolean(item.autoImportNewPlugins) : input.autoImportNewPlugins,
+        createdMappingCount,
+        materializedConfigObjectCount,
+        createdPluginNames: createdPlugins,
+      };
+    },
+    onSuccess: (_, variables) => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+      queryClient.invalidateQueries({ queryKey: ["plugins"] });
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.githubDiscovery(variables.connectorInstanceId) });
+    },
+  });
+}
+
+export type ConnectInput = {
+  provider: IntegrationProvider;
+  account: IntegrationAccount;
+  repos: IntegrationRepo[];
+};
+
+export function useConnectIntegration() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: ConnectInput): Promise<ConnectedIntegration> => {
+      await simulateLatency(900);
+
+      const connection: ConnectedIntegration = {
+        id: `conn_${input.provider}_${input.account.id}_${Date.now()}`,
+        provider: input.provider,
+        account: input.account,
+        repos: input.repos,
+        connectedAt: new Date().toISOString(),
+      };
+
+      mockConnections = [
+        ...mockConnections.filter(
+          (entry) => !(entry.provider === input.provider && entry.account.id === input.account.id),
+        ),
+        connection,
+      ];
+
+      return connection;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+      queryClient.invalidateQueries({ queryKey: ["plugins"] });
+    },
+  });
+}
+
+export function useDisconnectIntegration() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (connectionId: string) => {
+      const isGithubConnection = connectionId.startsWith("cac_");
+      if (isGithubConnection) {
+        const { response, payload } = await requestJson(
+          `/v1/connector-accounts/${encodeURIComponent(connectionId)}/disconnect`,
+          {
+            method: "POST",
+            body: JSON.stringify({ reason: "Disconnected from Den Web integrations." }),
+          },
+          20000,
+        );
+        if (!response.ok) {
+          throw new Error(getErrorMessage(payload, `Failed to disconnect integration (${response.status}).`));
+        }
+        return connectionId;
+      }
+
+      await simulateLatency(300);
+      mockConnections = mockConnections.filter((entry) => entry.id !== connectionId);
+      return connectionId;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+      queryClient.invalidateQueries({ queryKey: ["plugins"] });
+    },
+  });
+}
+
+export function useConnectorInstanceConfiguration(connectorInstanceId: string | null) {
+  return useQuery({
+    enabled: Boolean(connectorInstanceId),
+    queryKey: integrationQueryKeys.connectorInstanceConfiguration(connectorInstanceId),
+    queryFn: async (): Promise<ConnectorInstanceConfiguration> => {
+      const { response, payload } = await requestJson(
+        `/v1/connector-instances/${encodeURIComponent(connectorInstanceId ?? "")}/configuration`,
+        { method: "GET" },
+        15000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load connector instance (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const connectorInstance = item && isRecord(item.connectorInstance) ? item.connectorInstance : null;
+      const connectorInstanceIdValue = connectorInstance ? asString(connectorInstance.id) : null;
+      const connectorInstanceName = connectorInstance ? asString(connectorInstance.name) : null;
+      const remoteId = connectorInstance ? asString(connectorInstance.remoteId) : null;
+      if (!item || !connectorInstanceIdValue || !connectorInstanceName) {
+        throw new Error("Connector instance configuration response was incomplete.");
+      }
+
+      const configuredPlugins = Array.isArray(item.configuredPlugins)
+        ? item.configuredPlugins.flatMap((entry) => {
+            if (!isRecord(entry)) return [];
+            const id = asString(entry.id);
+            const name = asString(entry.name);
+            if (!id || !name) return [];
+            const componentCounts: Record<string, number> = {};
+            if (isRecord(entry.componentCounts)) {
+              for (const [key, value] of Object.entries(entry.componentCounts)) {
+                if (typeof value === "number" && value > 0) {
+                  componentCounts[key] = value;
+                }
+              }
+            }
+            const rootPathValue = entry.rootPath;
+            const rootPath = typeof rootPathValue === "string" ? rootPathValue : null;
+            return [{
+              componentCounts,
+              description: asNullableString(entry.description),
+              id,
+              memberCount: typeof entry.memberCount === "number" ? entry.memberCount : 0,
+              name,
+              rootPath,
+            } satisfies ConnectorInstanceConfiguredPlugin];
+          })
+        : [];
+
+      return {
+        autoImportNewPlugins: Boolean(item.autoImportNewPlugins),
+        configuredPlugins,
+        connectorInstanceId: connectorInstanceIdValue,
+        connectorInstanceName,
+        importedConfigObjectCount: typeof item.importedConfigObjectCount === "number" ? item.importedConfigObjectCount : 0,
+        mappingCount: typeof item.mappingCount === "number" ? item.mappingCount : 0,
+        repositoryFullName: remoteId,
+      };
+    },
+  });
+}
+
+export function useSetConnectorInstanceAutoImport() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: { autoImportNewPlugins: boolean; connectorInstanceId: string }) => {
+      const { response, payload } = await requestJson(
+        `/v1/connector-instances/${encodeURIComponent(input.connectorInstanceId)}/auto-import`,
+        {
+          method: "POST",
+          body: JSON.stringify({ autoImportNewPlugins: input.autoImportNewPlugins }),
+        },
+        15000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to update auto-import (${response.status}).`));
+      }
+
+      return input.autoImportNewPlugins;
+    },
+    onSuccess: (_result, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: integrationQueryKeys.connectorInstanceConfiguration(variables.connectorInstanceId),
+      });
+    },
+  });
+}
+
+export function useRemoveConnectorInstance() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (connectorInstanceId: string) => {
+      const { response, payload } = await requestJson(
+        `/v1/connector-instances/${encodeURIComponent(connectorInstanceId)}/remove`,
+        { method: "POST" },
+        20000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to remove connector instance (${response.status}).`));
+      }
+
+      return connectorInstanceId;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: integrationQueryKeys.all });
+      queryClient.invalidateQueries({ queryKey: ["plugins"] });
+    },
+  });
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integrations-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integrations-screen.tsx
new file mode 100644
index 0000000000..a984bfd0ab
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/integrations-screen.tsx
@@ -0,0 +1,381 @@
+"use client";
+
+import Link from "next/link";
+import { useState } from "react";
+import { Cable, Check, GitBranch, Github, Loader2, Plus, Settings, Trash2 } from "lucide-react";
+import { getGithubIntegrationAccountRoute, getGithubIntegrationRoute, getGithubIntegrationSetupRoute } from "../../../../_lib/den-org";
+import { DenButton } from "../../../../_components/ui/button";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { IntegrationConnectDialog } from "./integration-connect-dialog";
+import {
+  type ConnectedIntegration,
+  type IntegrationProvider,
+  INTEGRATION_PROVIDERS,
+  formatIntegrationTimestamp,
+  useDisconnectIntegration,
+  useIntegrations,
+  useStartGithubInstall,
+} from "./integration-data";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+export function IntegrationsScreen() {
+  const { orgSlug } = useOrgDashboard();
+  const { data: connections = [], isLoading, error } = useIntegrations();
+  const disconnect = useDisconnectIntegration();
+  const startGithubInstall = useStartGithubInstall();
+  const [dialogProvider, setDialogProvider] = useState<IntegrationProvider | null>(null);
+
+  async function handleConnect(provider: IntegrationProvider) {
+    if (provider !== "github") {
+      setDialogProvider(provider);
+      return;
+    }
+
+    try {
+      const result = await startGithubInstall.mutateAsync({
+        returnPath: getGithubIntegrationRoute(orgSlug),
+      });
+      window.location.assign(result.redirectUrl);
+    } catch {
+      return;
+    }
+  }
+
+  const connectedByProvider = connections.reduce<
+    Partial<Record<IntegrationProvider, ConnectedIntegration[]>>
+  >((acc, connection) => {
+    const list = acc[connection.provider] ?? [];
+    list.push(connection);
+    acc[connection.provider] = list;
+    return acc;
+  }, {});
+
+  const providers = Object.values(INTEGRATION_PROVIDERS);
+
+  return (
+    <DashboardPageTemplate
+      icon={Cable}
+      badgeLabel="Preview"
+      title="Integrations"
+      description="Connect to GitHub or Bitbucket. Once an account is linked, plugins and skills from those repositories show up on the Plugins page."
+      colors={["#E0F2FE", "#0C4A6E", "#0284C7", "#7DD3FC"]}
+    >
+      {error || startGithubInstall.error ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {error instanceof Error
+            ? error.message
+            : startGithubInstall.error instanceof Error
+              ? startGithubInstall.error.message
+              : "Failed to load integrations."}
+        </div>
+      ) : null}
+
+      {isLoading ? (
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading integrations…
+        </div>
+      ) : (
+        <div className="grid gap-4 lg:grid-cols-2">
+          {providers.map((meta) => {
+            const providerConnections = connectedByProvider[meta.provider] ?? [];
+            const isConnected = providerConnections.length > 0;
+
+            return (
+              <div
+                key={meta.provider}
+                className="overflow-hidden rounded-2xl border border-gray-100 bg-white"
+              >
+                {/* Header */}
+                <div
+                  className={`flex items-start gap-4 px-6 py-5 ${isConnected ? "border-b border-gray-100" : ""}`}
+                >
+                  <ProviderLogo provider={meta.provider} />
+                  <div className="min-w-0 flex-1">
+                    <div className="flex flex-wrap items-center gap-2">
+                      <h2 className="text-[15px] font-semibold text-gray-900">{meta.name}</h2>
+                      {meta.provider === "bitbucket" ? (
+                        <span className="inline-flex rounded-full bg-gray-100 px-2 py-0.5 text-[11px] font-medium text-gray-500">
+                          Coming soon
+                        </span>
+                      ) : isConnected ? (
+                        <span className="inline-flex items-center gap-1 rounded-full bg-emerald-50 px-2 py-0.5 text-[11px] font-medium text-emerald-700">
+                          <Check className="h-3 w-3" />
+                          Connected
+                        </span>
+                      ) : (
+                        <span className="inline-flex rounded-full bg-gray-100 px-2 py-0.5 text-[11px] font-medium text-gray-500">
+                          Not connected
+                        </span>
+                      )}
+                    </div>
+                    {!isConnected ? (
+                      <p className="mt-1 text-[13px] leading-[1.55] text-gray-500">{meta.description}</p>
+                    ) : null}
+                  </div>
+
+                  <div className="shrink-0">
+                    <DenButton
+                      variant={isConnected ? "secondary" : "primary"}
+                      size="sm"
+                      loading={meta.provider === "github" && startGithubInstall.isPending}
+                      disabled={meta.provider === "bitbucket"}
+                      onClick={() => void handleConnect(meta.provider)}
+                    >
+                      {meta.provider === "bitbucket"
+                        ? "Coming soon"
+                        : isConnected
+                          ? "Connect another"
+                          : "Connect"}
+                    </DenButton>
+                  </div>
+                </div>
+
+                {/* Body: connected accounts + repos */}
+                {isConnected ? (
+                  <div className="divide-y divide-gray-100">
+                    {providerConnections.map((connection) => (
+                      <ConnectionRow
+                        key={connection.id}
+                        connection={connection}
+                        orgSlug={orgSlug}
+                        onConfigureNewRepo={meta.provider === "github" ? () => window.location.assign(getGithubIntegrationAccountRoute(orgSlug, connection.account.id)) : undefined}
+                        onDisconnect={() => disconnect.mutate(connection.id)}
+                        busy={disconnect.isPending && disconnect.variables === connection.id}
+                      />
+                    ))}
+                  </div>
+                ) : null}
+              </div>
+            );
+          })}
+        </div>
+      )}
+
+      <IntegrationConnectDialog
+        open={dialogProvider !== null}
+        provider={dialogProvider}
+        onClose={() => setDialogProvider(null)}
+      />
+    </DashboardPageTemplate>
+  );
+}
+
+function ConnectionRow({
+  connection,
+  orgSlug,
+  onConfigureNewRepo,
+  onDisconnect,
+  busy,
+}: {
+  connection: ConnectedIntegration;
+  orgSlug: string | null;
+  onConfigureNewRepo?: () => void;
+  onDisconnect: () => void;
+  busy: boolean;
+}) {
+  const accountLogin = connection.account.ownerName ?? connection.account.name;
+  const connectedBy = connection.account.createdByName ?? null;
+  const avatarUrl = connection.provider === "github" && accountLogin
+    ? `https://github.com/${encodeURIComponent(accountLogin)}.png?size=80`
+    : null;
+  const [confirmOpen, setConfirmOpen] = useState(false);
+
+  return (
+    <div className="group relative">
+      <button
+        type="button"
+        onClick={() => setConfirmOpen(true)}
+        aria-label={`Disconnect ${accountLogin}`}
+        disabled={busy}
+        className="absolute right-4 top-4 inline-flex h-8 w-8 items-center justify-center rounded-full text-gray-400 opacity-0 transition-all duration-150 hover:bg-red-50 hover:text-red-600 focus:opacity-100 focus:outline-none focus:ring-2 focus:ring-red-500/30 group-hover:opacity-100 disabled:cursor-not-allowed"
+      >
+        {busy ? (
+          <Loader2 className="h-4 w-4 animate-spin" aria-hidden />
+        ) : (
+          <Trash2 className="h-4 w-4" aria-hidden />
+        )}
+      </button>
+
+      <div className="flex items-start gap-3 px-6 py-5 pr-14">
+        <Avatar url={avatarUrl} fallback={connection.account.avatarInitial} />
+        <div className="min-w-0 flex-1">
+          <div className="flex flex-wrap items-center gap-2">
+            <p className="truncate text-[14px] font-semibold text-gray-900">@{accountLogin}</p>
+            <span className="inline-flex items-center rounded-full bg-gray-100 px-2 py-0.5 text-[11px] font-medium text-gray-500">
+              {connection.account.kind === "user" ? "Personal" : "Organization"}
+            </span>
+          </div>
+          <p className="mt-0.5 truncate text-[12px] text-gray-500">
+            {connectedBy ? `Added by ${connectedBy}` : "Added recently"}
+            <span className="text-gray-400"> · {formatIntegrationTimestamp(connection.connectedAt)}</span>
+          </p>
+        </div>
+      </div>
+
+      <div className="px-6 pb-5">
+        <p className="mb-2 text-[11px] font-semibold uppercase tracking-[0.14em] text-gray-400">
+          Configured repositories
+        </p>
+
+        {connection.repos.length > 0 ? (
+          <ul className="space-y-1.5">
+            {connection.repos.map((repo) => (
+              <li
+                key={repo.id}
+                className="flex items-center justify-between gap-3 rounded-lg px-2 py-1.5 transition hover:bg-gray-50"
+              >
+                <span className="inline-flex min-w-0 items-center gap-2 text-[13px] text-gray-700">
+                  <GitBranch className="h-3.5 w-3.5 shrink-0 text-gray-400" />
+                  <span className="truncate">{repo.fullName}</span>
+                </span>
+                {connection.provider === "github" && repo.connectorInstanceId ? (
+                  <Link
+                    href={getGithubIntegrationSetupRoute(orgSlug, repo.connectorInstanceId)}
+                    aria-label={`Open setup for ${repo.fullName}`}
+                    className="inline-flex h-7 w-7 shrink-0 items-center justify-center rounded-full text-gray-400 transition hover:bg-gray-200 hover:text-gray-900"
+                  >
+                    <Settings className="h-4 w-4" aria-hidden />
+                  </Link>
+                ) : null}
+              </li>
+            ))}
+          </ul>
+        ) : (
+          <p className="text-[13px] text-gray-400">No repositories configured yet.</p>
+        )}
+
+        {onConfigureNewRepo ? (
+          <button
+            type="button"
+            onClick={onConfigureNewRepo}
+            className="mt-2 inline-flex w-full items-center justify-center gap-1.5 rounded-lg border border-dashed border-gray-200 px-3 py-2 text-[13px] font-medium text-gray-500 transition hover:border-gray-400 hover:bg-gray-50 hover:text-gray-900"
+          >
+            <Plus className="h-4 w-4" aria-hidden />
+            Add new repo
+          </button>
+        ) : null}
+      </div>
+
+      <DisconnectConfirmDialog
+        open={confirmOpen}
+        accountLogin={accountLogin}
+        repoCount={connection.repos.length}
+        busy={busy}
+        onClose={() => {
+          if (!busy) setConfirmOpen(false);
+        }}
+        onConfirm={() => {
+          onDisconnect();
+          setConfirmOpen(false);
+        }}
+      />
+    </div>
+  );
+}
+
+function Avatar({ url, fallback }: { url: string | null; fallback: string }) {
+  const [errored, setErrored] = useState(false);
+
+  if (!url || errored) {
+    return (
+      <div className="flex h-11 w-11 shrink-0 items-center justify-center rounded-full bg-[#0f172a] text-[14px] font-semibold text-white">
+        {fallback}
+      </div>
+    );
+  }
+
+  return (
+    <img
+      src={url}
+      alt=""
+      onError={() => setErrored(true)}
+      className="h-11 w-11 shrink-0 rounded-full bg-gray-100 object-cover"
+    />
+  );
+}
+
+function DisconnectConfirmDialog({
+  open,
+  accountLogin,
+  repoCount,
+  busy,
+  onClose,
+  onConfirm,
+}: {
+  open: boolean;
+  accountLogin: string;
+  repoCount: number;
+  busy: boolean;
+  onClose: () => void;
+  onConfirm: () => void;
+}) {
+  if (!open) {
+    return null;
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-950/45 px-4 py-6" onClick={onClose}>
+      <div
+        className="w-full max-w-md rounded-[28px] border border-gray-200 bg-white p-6 shadow-[0_24px_80px_-32px_rgba(15,23,42,0.45)]"
+        onClick={(event) => event.stopPropagation()}
+      >
+        <div className="flex items-start gap-3">
+          <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-red-50 text-red-600">
+            <Trash2 className="h-5 w-5" aria-hidden />
+          </div>
+          <div className="min-w-0 flex-1">
+            <h2 className="text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+              Remove @{accountLogin}?
+            </h2>
+            <p className="mt-1 text-[13px] leading-6 text-gray-600">
+              This will permanently delete everything OpenWork imported from this GitHub account, including:
+            </p>
+            <ul className="mt-3 space-y-1.5 text-[13px] leading-6 text-gray-600">
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>
+                  <strong>{repoCount}</strong> connected {repoCount === 1 ? "repository" : "repositories"} and their connector setup
+                </span>
+              </li>
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>All plugins and marketplaces created from those repos</span>
+              </li>
+              <li className="flex gap-2">
+                <span className="text-gray-400">•</span>
+                <span>All imported config objects, versions and source bindings</span>
+              </li>
+            </ul>
+            <p className="mt-3 text-[12px] leading-5 text-gray-500">
+              The GitHub App installation itself stays on GitHub. You can remove it from your GitHub account settings if you also want to revoke access.
+            </p>
+          </div>
+        </div>
+
+        <div className="mt-6 flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+          <DenButton variant="secondary" onClick={onClose} disabled={busy}>
+            Cancel
+          </DenButton>
+          <DenButton variant="destructive" icon={Trash2} loading={busy} onClick={onConfirm}>
+            Remove integration
+          </DenButton>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function ProviderLogo({ provider }: { provider: IntegrationProvider }) {
+  if (provider === "github") {
+    return (
+      <div className="flex h-10 w-10 items-center justify-center rounded-[12px] bg-[#0f172a] text-white">
+        <Github className="h-5 w-5" aria-hidden />
+      </div>
+    );
+  }
+  return (
+    <div className="flex h-10 w-10 items-center justify-center rounded-[12px] bg-[#2684FF] text-[13px] font-semibold text-white">
+      BB
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-data.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-data.tsx
new file mode 100644
index 0000000000..145a78f204
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-data.tsx
@@ -0,0 +1,430 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+
+export type DenLlmProviderSource = "models_dev" | "custom";
+
+export type DenLlmProviderModel = {
+  id: string;
+  name: string;
+  config: Record<string, unknown>;
+  createdAt: string | null;
+};
+
+export type DenLlmProviderMemberAccess = {
+  id: string;
+  orgMembershipId: string;
+  role: string;
+  createdAt: string | null;
+  user: {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+  };
+};
+
+export type DenLlmProviderTeamAccess = {
+  id: string;
+  teamId: string;
+  name: string;
+  createdAt: string | null;
+  updatedAt: string | null;
+};
+
+export type DenLlmProvider = {
+  id: string;
+  organizationId: string;
+  createdByOrgMembershipId: string;
+  source: DenLlmProviderSource;
+  providerId: string;
+  name: string;
+  providerConfig: Record<string, unknown>;
+  hasApiKey: boolean;
+  createdAt: string | null;
+  updatedAt: string | null;
+  canManage: boolean;
+  accessibleVia: {
+    orgMembershipIds: string[];
+    teamIds: string[];
+  };
+  models: DenLlmProviderModel[];
+  access: {
+    members: DenLlmProviderMemberAccess[];
+    teams: DenLlmProviderTeamAccess[];
+  };
+};
+
+export type DenModelsDevProviderSummary = {
+  id: string;
+  name: string;
+  npm: string | null;
+  env: string[];
+  doc: string | null;
+  api: string | null;
+  modelCount: number;
+};
+
+export type DenModelsDevProviderDetail = DenModelsDevProviderSummary & {
+  config: Record<string, unknown>;
+  models: Array<{
+    id: string;
+    name: string;
+    config: Record<string, unknown>;
+  }>;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asIsoString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asStringList(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === "string") : [];
+}
+
+function asJsonRecord(value: unknown): Record<string, unknown> {
+  return isRecord(value) ? value : {};
+}
+
+function asLlmProviderModel(value: unknown): DenLlmProviderModel | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const name = asString(value.name);
+  if (!id || !name) {
+    return null;
+  }
+
+  return {
+    id,
+    name,
+    config: asJsonRecord(value.config),
+    createdAt: asIsoString(value.createdAt),
+  };
+}
+
+function asLlmProviderMemberAccess(value: unknown): DenLlmProviderMemberAccess | null {
+  if (!isRecord(value) || !isRecord(value.user)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const orgMembershipId = asString(value.orgMembershipId);
+  const role = asString(value.role);
+  const userId = asString(value.user.id);
+  const name = asString(value.user.name);
+  const email = asString(value.user.email);
+  if (!id || !orgMembershipId || !role || !userId || !name || !email) {
+    return null;
+  }
+
+  return {
+    id,
+    orgMembershipId,
+    role,
+    createdAt: asIsoString(value.createdAt),
+    user: {
+      id: userId,
+      name,
+      email,
+      image: asString(value.user.image),
+    },
+  };
+}
+
+function asLlmProviderTeamAccess(value: unknown): DenLlmProviderTeamAccess | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const teamId = asString(value.teamId);
+  const name = asString(value.name);
+  if (!id || !teamId || !name) {
+    return null;
+  }
+
+  return {
+    id,
+    teamId,
+    name,
+    createdAt: asIsoString(value.createdAt),
+    updatedAt: asIsoString(value.updatedAt),
+  };
+}
+
+function asLlmProvider(value: unknown): DenLlmProvider | null {
+  if (!isRecord(value) || !isRecord(value.access) || !isRecord(value.accessibleVia)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const organizationId = asString(value.organizationId);
+  const createdByOrgMembershipId = asString(value.createdByOrgMembershipId);
+  const providerId = asString(value.providerId);
+  const name = asString(value.name);
+  const source = value.source === "models_dev" || value.source === "custom" ? value.source : null;
+  if (!id || !organizationId || !createdByOrgMembershipId || !providerId || !name || !source) {
+    return null;
+  }
+
+  return {
+    id,
+    organizationId,
+    createdByOrgMembershipId,
+    source,
+    providerId,
+    name,
+    providerConfig: asJsonRecord(value.providerConfig),
+    hasApiKey: value.hasApiKey === true,
+    createdAt: asIsoString(value.createdAt),
+    updatedAt: asIsoString(value.updatedAt),
+    canManage: value.canManage === true,
+    accessibleVia: {
+      orgMembershipIds: asStringList(value.accessibleVia.orgMembershipIds),
+      teamIds: asStringList(value.accessibleVia.teamIds),
+    },
+    models: Array.isArray(value.models)
+      ? value.models.map(asLlmProviderModel).filter((entry): entry is DenLlmProviderModel => entry !== null)
+      : [],
+    access: {
+      members: Array.isArray(value.access.members)
+        ? value.access.members
+            .map(asLlmProviderMemberAccess)
+            .filter((entry): entry is DenLlmProviderMemberAccess => entry !== null)
+        : [],
+      teams: Array.isArray(value.access.teams)
+        ? value.access.teams
+            .map(asLlmProviderTeamAccess)
+            .filter((entry): entry is DenLlmProviderTeamAccess => entry !== null)
+        : [],
+    },
+  };
+}
+
+function asCatalogProviderSummary(value: unknown): DenModelsDevProviderSummary | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const name = asString(value.name);
+  if (!id || !name) {
+    return null;
+  }
+
+  return {
+    id,
+    name,
+    npm: asString(value.npm),
+    env: asStringList(value.env),
+    doc: asString(value.doc),
+    api: asString(value.api),
+    modelCount: typeof value.modelCount === "number" ? value.modelCount : 0,
+  };
+}
+
+function asCatalogProviderDetail(value: unknown): DenModelsDevProviderDetail | null {
+  const summary = asCatalogProviderSummary(value);
+  if (!summary || !isRecord(value)) {
+    return null;
+  }
+
+  const models = Array.isArray(value.models)
+    ? value.models
+        .map((model) => {
+          if (!isRecord(model)) {
+            return null;
+          }
+
+          const id = asString(model.id);
+          const name = asString(model.name);
+          if (!id || !name) {
+            return null;
+          }
+
+          return {
+            id,
+            name,
+            config: asJsonRecord(model.config),
+          };
+        })
+        .filter((entry): entry is DenModelsDevProviderDetail["models"][number] => entry !== null)
+    : [];
+
+  return {
+    ...summary,
+    config: asJsonRecord(value.config),
+    models,
+  };
+}
+
+export function getProviderEnvNames(config: Record<string, unknown>): string[] {
+  return asStringList(config.env);
+}
+
+export function getProviderDocUrl(config: Record<string, unknown>): string | null {
+  return asString(config.doc);
+}
+
+export function getProviderNpmPackage(config: Record<string, unknown>): string | null {
+  return asString(config.npm);
+}
+
+export function getProviderApiBase(config: Record<string, unknown>): string | null {
+  return asString(config.api);
+}
+
+export function formatProviderTimestamp(value: string | null) {
+  if (!value) {
+    return "Recently updated";
+  }
+
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "Recently updated";
+  }
+
+  return new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+  }).format(date);
+}
+
+export function buildCustomProviderTemplate() {
+  return JSON.stringify(
+    {
+      id: "custom-provider",
+      name: "Custom Provider",
+      npm: "@ai-sdk/openai-compatible",
+      env: ["CUSTOM_PROVIDER_API_KEY"],
+      doc: "https://example.com/docs/models",
+      api: "https://api.example.com/v1",
+      models: [
+        {
+          id: "custom-provider/example-model",
+          name: "Example Model",
+          attachment: false,
+          reasoning: false,
+          tool_call: true,
+          structured_output: true,
+          temperature: true,
+          release_date: "2026-01-01",
+          last_updated: "2026-01-01",
+          open_weights: false,
+          limit: {
+            context: 128000,
+            input: 128000,
+            output: 8192,
+          },
+          modalities: {
+            input: ["text"],
+            output: ["text"],
+          },
+        },
+      ],
+    },
+    null,
+    2,
+  );
+}
+
+export function buildEditableCustomProviderText(provider: DenLlmProvider) {
+  return JSON.stringify(
+    {
+      ...provider.providerConfig,
+      models: provider.models.map((model) => model.config),
+    },
+    null,
+    2,
+  );
+}
+
+export async function requestLlmProviderCatalog(orgId: string) {
+  const { response, payload } = await requestJson(`/v1/llm-provider-catalog`, { method: "GET" }, 20000);
+  if (!response.ok) {
+    throw new Error(getErrorMessage(payload, `Failed to load the provider catalog (${response.status}).`));
+  }
+
+  return isRecord(payload) && Array.isArray(payload.providers)
+    ? payload.providers.map(asCatalogProviderSummary).filter((entry): entry is DenModelsDevProviderSummary => entry !== null)
+    : [];
+}
+
+export async function requestLlmProviderCatalogDetail(orgId: string, providerId: string) {
+  const { response, payload } = await requestJson(
+    `/v1/llm-provider-catalog/${encodeURIComponent(providerId)}`,
+    { method: "GET" },
+    20000,
+  );
+
+  if (!response.ok) {
+    throw new Error(getErrorMessage(payload, `Failed to load provider details (${response.status}).`));
+  }
+
+  if (!isRecord(payload) || !payload.provider) {
+    throw new Error("Provider details were missing from the response.");
+  }
+
+  const detail = asCatalogProviderDetail(payload.provider);
+  if (!detail) {
+    throw new Error("Provider details could not be parsed.");
+  }
+
+  return detail;
+}
+
+export function useOrgLlmProviders(orgId: string | null) {
+  const [llmProviders, setLlmProviders] = useState<DenLlmProvider[]>([]);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function loadProviders() {
+    if (!orgId) {
+      setLlmProviders([]);
+      setError("Organization not found.");
+      return;
+    }
+
+    setBusy(true);
+    setError(null);
+    try {
+      const { response, payload } = await requestJson(`/v1/llm-providers`, { method: "GET" }, 15000);
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load providers (${response.status}).`));
+      }
+
+      const nextProviders = isRecord(payload) && Array.isArray(payload.llmProviders)
+        ? payload.llmProviders.map(asLlmProvider).filter((entry): entry is DenLlmProvider => entry !== null)
+        : [];
+      setLlmProviders(nextProviders);
+    } catch (loadError) {
+      setError(loadError instanceof Error ? loadError.message : "Failed to load the provider library.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  useEffect(() => {
+    void loadProviders();
+  }, [orgId]);
+
+  return {
+    llmProviders,
+    busy,
+    error,
+    reloadProviders: loadProviders,
+  };
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-detail-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-detail-screen.tsx
new file mode 100644
index 0000000000..245e738764
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-detail-screen.tsx
@@ -0,0 +1,390 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { ArrowLeft, ExternalLink, KeyRound, Trash2, Users } from "lucide-react";
+import { DenButton } from "../../../../_components/ui/button";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+    getEditLlmProviderRoute,
+    getLlmProvidersRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+    formatProviderTimestamp,
+    getProviderApiBase,
+    getProviderDocUrl,
+    getProviderEnvNames,
+    getProviderNpmPackage,
+    useOrgLlmProviders,
+} from "./llm-provider-data";
+
+function formatCountLabel(count: number, singular: string, plural: string) {
+    return `${count} ${count === 1 ? singular : plural}`;
+}
+
+function getLimitLabel(config: Record<string, unknown>) {
+    const limit =
+        typeof config.limit === "object" && config.limit !== null
+            ? (config.limit as Record<string, unknown>)
+            : null;
+    const context = typeof limit?.context === "number" ? limit.context : null;
+    return context ? `${context.toLocaleString()} ctx` : null;
+}
+
+export function LlmProviderDetailScreen({
+    llmProviderId,
+}: {
+    llmProviderId: string;
+}) {
+    const router = useRouter();
+    const { orgId, orgSlug } = useOrgDashboard();
+    const { llmProviders, busy, error, reloadProviders } =
+        useOrgLlmProviders(orgId);
+    const [deleteBusy, setDeleteBusy] = useState(false);
+    const [deleteError, setDeleteError] = useState<string | null>(null);
+
+    const provider = useMemo(
+        () => llmProviders.find((entry) => entry.id === llmProviderId) ?? null,
+        [llmProviderId, llmProviders],
+    );
+
+    async function deleteProvider() {
+        if (!orgId || !provider) {
+            return;
+        }
+
+        if (
+            !window.confirm(
+                `Delete ${provider.name}? This will remove its saved model list and access rules.`,
+            )
+        ) {
+            return;
+        }
+
+        setDeleteBusy(true);
+        setDeleteError(null);
+        try {
+            const { response, payload } = await requestJson(
+                `/v1/llm-providers/${encodeURIComponent(provider.id)}`,
+                { method: "DELETE" },
+                12000,
+            );
+
+            if (response.status !== 204 && !response.ok) {
+                throw new Error(
+                    getErrorMessage(
+                        payload,
+                        `Failed to delete provider (${response.status}).`,
+                    ),
+                );
+            }
+
+            await reloadProviders();
+            router.push(getLlmProvidersRoute(orgSlug));
+            router.refresh();
+        } catch (nextError) {
+            setDeleteError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Could not delete the provider.",
+            );
+        } finally {
+            setDeleteBusy(false);
+        }
+    }
+
+    if (busy && !provider) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+                    Loading provider details...
+                </div>
+            </div>
+        );
+    }
+
+    if (!provider) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[15px] text-red-700">
+                    {error ?? "That provider could not be found."}
+                </div>
+            </div>
+        );
+    }
+
+    const envNames = getProviderEnvNames(provider.providerConfig);
+    const npmPackage = getProviderNpmPackage(provider.providerConfig);
+    const apiBase = getProviderApiBase(provider.providerConfig);
+    const docUrl = getProviderDocUrl(provider.providerConfig);
+
+    return (
+        <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+            <div className="mb-8 flex flex-col gap-3">
+                <p className="text-[12px] font-semibold uppercase tracking-[0.18em] text-gray-400">
+                    LLM provider
+                </p>
+                <div className="flex flex-col gap-4 xl:flex-row xl:items-end xl:justify-between">
+                    <div>
+                        <h1 className="text-[34px] font-semibold tracking-[-0.07em] text-gray-950">
+                            {provider.name}
+                        </h1>
+                    </div>
+                </div>
+            </div>
+
+            <div className="mb-8 flex flex-wrap items-center justify-between gap-4">
+                <Link
+                    href={getLlmProvidersRoute(orgSlug)}
+                    className="inline-flex items-center gap-2 text-[15px] font-medium text-gray-500 transition hover:text-gray-900"
+                >
+                    <ArrowLeft className="h-5 w-5" />
+                    Back to providers
+                </Link>
+
+                <div className="flex flex-wrap gap-3">
+                    {provider.canManage ? (
+                        <>
+                            <Link
+                                href={getEditLlmProviderRoute(
+                                    orgSlug,
+                                    provider.id,
+                                )}
+                            >
+                                <DenButton variant="secondary">
+                                    Edit Provider
+                                </DenButton>
+                            </Link>
+                            <DenButton
+                                variant="destructive"
+                                loading={deleteBusy}
+                                onClick={() => void deleteProvider()}
+                            >
+                                <Trash2 className="h-4 w-4" />
+                                Delete
+                            </DenButton>
+                        </>
+                    ) : null}
+                </div>
+            </div>
+
+            {deleteError ? (
+                <div className="mb-6 rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[14px] text-red-700">
+                    {deleteError}
+                </div>
+            ) : null}
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div className="flex flex-col gap-4 lg:flex-row lg:items-start lg:justify-between">
+                    <div>
+                        <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                            Provider configuration
+                        </h2>
+                    </div>
+
+                    <div
+                        className={`inline-flex items-center gap-2 rounded-full px-4 py-2 text-[13px] font-medium ${provider.hasApiKey ? "bg-emerald-50 text-emerald-700" : "bg-amber-50 text-amber-700"}`}
+                    >
+                        <KeyRound className="h-4 w-4" />
+                        {provider.hasApiKey
+                            ? "Credential saved"
+                            : "Credential missing"}
+                    </div>
+                </div>
+
+                <div className="mt-8 grid gap-4 md:grid-cols-2 xl:grid-cols-4">
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            Provider id
+                        </p>
+                        <p className="mt-3 text-[16px] font-medium text-gray-900">
+                            {provider.providerId}
+                        </p>
+                    </div>
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            NPM package
+                        </p>
+                        <p className="mt-3 text-[16px] font-medium text-gray-900">
+                            {npmPackage ?? "Not set"}
+                        </p>
+                    </div>
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            API base
+                        </p>
+                        <p className="mt-3 break-all text-[16px] font-medium text-gray-900">
+                            {apiBase ?? "Not set"}
+                        </p>
+                    </div>
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            Updated
+                        </p>
+                        <p className="mt-3 text-[16px] font-medium text-gray-900">
+                            {formatProviderTimestamp(provider.updatedAt)}
+                        </p>
+                    </div>
+                </div>
+
+                <div className="mt-6 flex flex-wrap gap-2">
+                    {envNames.map((envName) => (
+                        <span
+                            key={envName}
+                            className="rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-600"
+                        >
+                            {envName}
+                        </span>
+                    ))}
+                    {docUrl ? (
+                        <a
+                            href={docUrl}
+                            target="_blank"
+                            rel="noreferrer"
+                            className="inline-flex items-center gap-1 rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-600 transition hover:bg-gray-200"
+                        >
+                            Docs
+                            <ExternalLink className="h-3.5 w-3.5" />
+                        </a>
+                    ) : null}
+                </div>
+            </section>
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div className="flex items-start justify-between gap-4">
+                    <div>
+                        <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                            Selected models
+                        </h2>
+                    </div>
+                    <div className="rounded-full bg-gray-100 px-4 py-2 text-[13px] font-medium text-gray-600">
+                        {formatCountLabel(
+                            provider.models.length,
+                            "model",
+                            "models",
+                        )}
+                    </div>
+                </div>
+
+                <div className="mt-8 grid gap-4 lg:grid-cols-2 2xl:grid-cols-3">
+                    {provider.models.map((model) => {
+                        const limitLabel = getLimitLabel(model.config);
+                        return (
+                            <div
+                                key={model.id}
+                                className="rounded-[24px] border border-gray-200 bg-gray-50 p-5"
+                            >
+                                <div className="flex items-start justify-between gap-3">
+                                    <div>
+                                        <p className="text-[17px] font-semibold tracking-[-0.03em] text-gray-950">
+                                            {model.name}
+                                        </p>
+                                        <p className="mt-1 text-[13px] text-gray-500">
+                                            {model.id}
+                                        </p>
+                                    </div>
+                                    {limitLabel ? (
+                                        <span className="rounded-full bg-white px-3 py-1 text-[12px] font-medium text-gray-600">
+                                            {limitLabel}
+                                        </span>
+                                    ) : null}
+                                </div>
+                            </div>
+                        );
+                    })}
+                </div>
+            </section>
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div className="flex items-start justify-between gap-4">
+                    <div>
+                        <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                            Access
+                        </h2>
+                    </div>
+                    <div className="inline-flex items-center gap-2 rounded-full bg-gray-100 px-4 py-2 text-[13px] font-medium text-gray-600">
+                        <Users className="h-4 w-4" />
+                        {provider.access.members.length +
+                            provider.access.teams.length}{" "}
+                        grants
+                    </div>
+                </div>
+
+                <div className="mt-8 grid gap-6 xl:grid-cols-2">
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            People
+                        </p>
+                        <div className="mt-4 grid gap-3">
+                            {provider.access.members.length === 0 ? (
+                                <p className="text-[14px] text-gray-500">
+                                    No direct people access yet.
+                                </p>
+                            ) : (
+                                provider.access.members.map((member) => (
+                                    <div
+                                        key={member.id}
+                                        className="rounded-[18px] border border-gray-200 bg-white px-4 py-3"
+                                    >
+                                        <p className="text-[15px] font-medium text-gray-900">
+                                            {member.user.name}
+                                        </p>
+                                        <p className="mt-1 text-[13px] text-gray-500">
+                                            {member.user.email}
+                                        </p>
+                                    </div>
+                                ))
+                            )}
+                        </div>
+                    </div>
+
+                    <div className="rounded-[24px] bg-gray-50 p-5">
+                        <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                            Teams
+                        </p>
+                        <div className="mt-4 grid gap-3">
+                            {provider.access.teams.length === 0 ? (
+                                <p className="text-[14px] text-gray-500">
+                                    No team access yet.
+                                </p>
+                            ) : (
+                                provider.access.teams.map((team) => (
+                                    <div
+                                        key={team.id}
+                                        className="rounded-[18px] border border-gray-200 bg-white px-4 py-3"
+                                    >
+                                        <p className="text-[15px] font-medium text-gray-900">
+                                            {team.name}
+                                        </p>
+                                        <p className="mt-1 text-[13px] text-gray-500">
+                                            Updated{" "}
+                                            {formatProviderTimestamp(
+                                                team.updatedAt,
+                                            )}
+                                        </p>
+                                    </div>
+                                ))
+                            )}
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            {provider.source === "custom" ? (
+                <section className="rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                    <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                        Custom provider payload
+                    </h2>
+                    <p className="mt-2 text-[15px] text-gray-500">
+                        The raw provider config saved for this custom source.
+                    </p>
+                    <pre className="mt-6 overflow-x-auto rounded-[24px] bg-[#0f172a] p-5 text-[13px] leading-6 text-slate-100">
+                        {JSON.stringify(provider.providerConfig, null, 2)}
+                    </pre>
+                </section>
+            ) : null}
+        </div>
+    );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-editor-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-editor-screen.tsx
new file mode 100644
index 0000000000..15070eaf70
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-provider-editor-screen.tsx
@@ -0,0 +1,872 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useMemo, useState } from "react";
+import {
+    ArrowLeft,
+    CodeXml,
+    Cpu,
+    Search,
+    User,
+    Users,
+} from "lucide-react";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenCombobox } from "../../../../_components/ui/combobox";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenSelectableRow } from "../../../../_components/ui/selectable-row";
+import { UnderlineTabs } from "../../../../_components/ui/tabs";
+import { DenTextarea } from "../../../../_components/ui/textarea";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+    getLlmProviderRoute,
+    getLlmProvidersRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+    buildCustomProviderTemplate,
+    buildEditableCustomProviderText,
+    getProviderApiBase,
+    getProviderDocUrl,
+    getProviderEnvNames,
+    getProviderNpmPackage,
+    requestLlmProviderCatalog,
+    requestLlmProviderCatalogDetail,
+    useOrgLlmProviders,
+    type DenLlmProvider,
+    type DenModelsDevProviderDetail,
+    type DenModelsDevProviderSummary,
+    type DenLlmProviderSource,
+} from "./llm-provider-data";
+
+const SOURCE_TABS = [
+    { value: "models_dev" as const, label: "Catalog provider", icon: Cpu },
+    { value: "custom" as const, label: "Custom provider", icon: CodeXml },
+];
+
+function getLockMemberId(
+    provider: DenLlmProvider | null,
+    currentMemberId: string | null,
+) {
+    return provider?.createdByOrgMembershipId ?? currentMemberId;
+}
+
+export function LlmProviderEditorScreen({
+    llmProviderId,
+}: {
+    llmProviderId?: string;
+}) {
+    const router = useRouter();
+    const { orgId, orgSlug, orgContext } = useOrgDashboard();
+    const { llmProviders, busy, error, reloadProviders } =
+        useOrgLlmProviders(orgId);
+    const provider = useMemo(
+        () =>
+            llmProviderId
+                ? (llmProviders.find((entry) => entry.id === llmProviderId) ??
+                  null)
+                : null,
+        [llmProviderId, llmProviders],
+    );
+    const [source, setSource] = useState<DenLlmProviderSource>("models_dev");
+    const [accessTab, setAccessTab] = useState<"teams" | "people">("teams");
+    const [accessQuery, setAccessQuery] = useState("");
+    const [catalogProviders, setCatalogProviders] = useState<
+        DenModelsDevProviderSummary[]
+    >([]);
+    const [catalogBusy, setCatalogBusy] = useState(false);
+    const [catalogError, setCatalogError] = useState<string | null>(null);
+    const [selectedProviderId, setSelectedProviderId] = useState("");
+    const [catalogDetail, setCatalogDetail] =
+        useState<DenModelsDevProviderDetail | null>(null);
+    const [detailBusy, setDetailBusy] = useState(false);
+    const [detailError, setDetailError] = useState<string | null>(null);
+    const [providerName, setProviderName] = useState("");
+    const [selectedModelIds, setSelectedModelIds] = useState<string[]>([]);
+    const [modelQuery, setModelQuery] = useState("");
+    const [customConfigText, setCustomConfigText] = useState(
+        buildCustomProviderTemplate(),
+    );
+    const [apiKey, setApiKey] = useState("");
+    const [selectedMemberIds, setSelectedMemberIds] = useState<string[]>([]);
+    const [selectedTeamIds, setSelectedTeamIds] = useState<string[]>([]);
+    const [saveBusy, setSaveBusy] = useState(false);
+    const [saveError, setSaveError] = useState<string | null>(null);
+
+    useEffect(() => {
+        if (!orgId) {
+            setCatalogProviders([]);
+            return;
+        }
+
+        let canceled = false;
+        setCatalogBusy(true);
+        setCatalogError(null);
+        void requestLlmProviderCatalog(orgId)
+            .then((providers) => {
+                if (!canceled) {
+                    setCatalogProviders(providers);
+                }
+            })
+            .catch((loadError) => {
+                if (!canceled) {
+                    setCatalogError(
+                        loadError instanceof Error
+                            ? loadError.message
+                            : "Failed to load the provider catalog.",
+                    );
+                }
+            })
+            .finally(() => {
+                if (!canceled) {
+                    setCatalogBusy(false);
+                }
+            });
+
+        return () => {
+            canceled = true;
+        };
+    }, [orgId]);
+
+    useEffect(() => {
+        if (provider) {
+            setSource(provider.source);
+            setSelectedProviderId(provider.providerId);
+            setProviderName(provider.name);
+            setSelectedModelIds(provider.models.map((entry) => entry.id));
+            setSelectedMemberIds(
+                provider.access.members.map((entry) => entry.orgMembershipId),
+            );
+            setSelectedTeamIds(
+                provider.access.teams.map((entry) => entry.teamId),
+            );
+            setCustomConfigText(
+                provider.source === "custom"
+                    ? buildEditableCustomProviderText(provider)
+                    : buildCustomProviderTemplate(),
+            );
+            setApiKey("");
+            return;
+        }
+
+        setSource("models_dev");
+        setSelectedProviderId("");
+        setProviderName("");
+        setSelectedModelIds([]);
+        setSelectedMemberIds(
+            orgContext?.currentMember.id ? [orgContext.currentMember.id] : [],
+        );
+        setSelectedTeamIds([]);
+        setCustomConfigText(buildCustomProviderTemplate());
+        setApiKey("");
+    }, [orgContext?.currentMember.id, provider]);
+
+    useEffect(() => {
+        if (source !== "models_dev" || !orgId || !selectedProviderId) {
+            setCatalogDetail(null);
+            setDetailError(null);
+            setDetailBusy(false);
+            return;
+        }
+
+        let canceled = false;
+        setDetailBusy(true);
+        setDetailError(null);
+        void requestLlmProviderCatalogDetail(orgId, selectedProviderId)
+            .then((detail) => {
+                if (!canceled) {
+                    setCatalogDetail(detail);
+                    setSelectedModelIds((current) =>
+                        current.filter((entry) =>
+                            detail.models.some((model) => model.id === entry),
+                        ),
+                    );
+                }
+            })
+            .catch((loadError) => {
+                if (!canceled) {
+                    setCatalogDetail(null);
+                    setDetailError(
+                        loadError instanceof Error
+                            ? loadError.message
+                            : "Failed to load provider details.",
+                    );
+                }
+            })
+            .finally(() => {
+                if (!canceled) {
+                    setDetailBusy(false);
+                }
+            });
+
+        return () => {
+            canceled = true;
+        };
+    }, [orgId, selectedProviderId, source]);
+
+    const currentMemberId = orgContext?.currentMember.id ?? null;
+    const lockedMemberId = getLockMemberId(provider, currentMemberId);
+
+    const filteredModels = useMemo(() => {
+        const models = catalogDetail?.models ?? [];
+        const normalizedQuery = modelQuery.trim().toLowerCase();
+        if (!normalizedQuery) {
+            return models;
+        }
+
+        return models.filter(
+            (model) =>
+                model.name.toLowerCase().includes(normalizedQuery) ||
+                model.id.toLowerCase().includes(normalizedQuery),
+        );
+    }, [catalogDetail?.models, modelQuery]);
+
+    const filteredTeams = useMemo(() => {
+        const teams = orgContext?.teams ?? [];
+        const normalizedQuery = accessQuery.trim().toLowerCase();
+        if (!normalizedQuery) {
+            return teams;
+        }
+
+        return teams.filter((team) =>
+            team.name.toLowerCase().includes(normalizedQuery),
+        );
+    }, [accessQuery, orgContext?.teams]);
+
+    const filteredMembers = useMemo(() => {
+        const members = orgContext?.members ?? [];
+        const normalizedQuery = accessQuery.trim().toLowerCase();
+        if (!normalizedQuery) {
+            return members;
+        }
+
+        return members.filter(
+            (member) =>
+                member.user.name.toLowerCase().includes(normalizedQuery) ||
+                member.user.email.toLowerCase().includes(normalizedQuery),
+        );
+    }, [accessQuery, orgContext?.members]);
+
+    const catalogProviderOptions = useMemo(
+        () =>
+            catalogProviders.map((catalogProvider) => ({
+                value: catalogProvider.id,
+                label: catalogProvider.name,
+                description: catalogProvider.id,
+                meta: `${catalogProvider.modelCount} ${catalogProvider.modelCount === 1 ? "model" : "models"}`,
+            })),
+        [catalogProviders],
+    );
+
+    async function saveProvider() {
+        if (!orgId) {
+            setSaveError("Organization not found.");
+            return;
+        }
+
+        if (!providerName.trim()) {
+            setSaveError("Give this provider a name.");
+            return;
+        }
+
+        if (source === "models_dev") {
+            if (!selectedProviderId) {
+                setSaveError("Select a provider.");
+                return;
+            }
+            if (!selectedModelIds.length) {
+                setSaveError("Select at least one model.");
+                return;
+            }
+        }
+
+        if (source === "custom" && !customConfigText.trim()) {
+            setSaveError("Paste a custom provider config.");
+            return;
+        }
+
+        setSaveBusy(true);
+        setSaveError(null);
+        try {
+            const body: Record<string, unknown> = {
+                name: providerName.trim(),
+                source,
+                memberIds: [...new Set(selectedMemberIds)],
+                teamIds: [...new Set(selectedTeamIds)],
+            };
+
+            if (source === "models_dev") {
+                body.providerId = selectedProviderId;
+                body.modelIds = selectedModelIds;
+            } else {
+                body.customConfigText = customConfigText;
+            }
+
+            if (apiKey.trim() || !provider) {
+                body.apiKey = apiKey.trim();
+            }
+
+            const path = provider
+                ? `/v1/llm-providers/${encodeURIComponent(provider.id)}`
+                : `/v1/llm-providers`;
+            const method = provider ? "PATCH" : "POST";
+
+            const { response, payload } = await requestJson(
+                path,
+                {
+                    method,
+                    body: JSON.stringify(body),
+                },
+                20000,
+            );
+
+            if (!response.ok) {
+                throw new Error(
+                    getErrorMessage(
+                        payload,
+                        `Failed to save provider (${response.status}).`,
+                    ),
+                );
+            }
+
+            const nextProvider =
+                payload &&
+                typeof payload === "object" &&
+                payload &&
+                "llmProvider" in payload &&
+                payload.llmProvider &&
+                typeof payload.llmProvider === "object"
+                    ? (payload.llmProvider as { id?: unknown })
+                    : null;
+            const nextProviderId =
+                typeof nextProvider?.id === "string"
+                    ? nextProvider.id
+                    : (provider?.id ?? null);
+            if (!nextProviderId) {
+                throw new Error(
+                    "The provider was saved, but no provider id was returned.",
+                );
+            }
+
+            await reloadProviders();
+            router.push(getLlmProviderRoute(orgSlug, nextProviderId));
+            router.refresh();
+        } catch (nextError) {
+            setSaveError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Could not save the provider.",
+            );
+        } finally {
+            setSaveBusy(false);
+        }
+    }
+
+    if (busy && llmProviderId && !provider) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+                    Loading provider details...
+                </div>
+            </div>
+        );
+    }
+
+    if (llmProviderId && !provider) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[15px] text-red-700">
+                    {error ?? "That provider could not be found."}
+                </div>
+            </div>
+        );
+    }
+
+    const providerDoc = catalogDetail
+        ? getProviderDocUrl(catalogDetail.config)
+        : null;
+    const providerNpm = catalogDetail
+        ? getProviderNpmPackage(catalogDetail.config)
+        : null;
+    const providerApiBase = catalogDetail
+        ? getProviderApiBase(catalogDetail.config)
+        : null;
+    const providerEnv = catalogDetail
+        ? getProviderEnvNames(catalogDetail.config)
+        : [];
+
+    return (
+        <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+            <div className="mb-8 flex flex-col gap-3">
+                <p className="text-[12px] font-semibold uppercase tracking-[0.18em] text-gray-400">
+                    {provider ? "Edit provider" : "Add provider"}
+                </p>
+                <div className="flex flex-col gap-4 xl:flex-row xl:items-end xl:justify-between">
+                    <div>
+                        <h1 className="text-[34px] font-semibold tracking-[-0.07em] text-gray-950">
+                            {provider
+                                ? (providerName.trim() || provider.name)
+                                : "Add a new LLM provider"}
+                        </h1>
+                        <p className="mt-3 max-w-[720px] text-[16px] leading-8 text-gray-500">
+                            Pick a provider or paste a custom config, then
+                            decide which models to allow and which teammates can
+                            use it.
+                        </p>
+                    </div>
+                </div>
+            </div>
+
+            <div className="mb-8 flex items-center justify-between gap-4">
+                <Link
+                    href={
+                        provider
+                            ? getLlmProviderRoute(orgSlug, provider.id)
+                            : getLlmProvidersRoute(orgSlug)
+                    }
+                    className="inline-flex items-center gap-2 text-[15px] font-medium text-gray-500 transition hover:text-gray-900"
+                >
+                    <ArrowLeft className="h-5 w-5" />
+                    Back
+                </Link>
+
+                <DenButton
+                    loading={saveBusy}
+                    onClick={() => void saveProvider()}
+                >
+                    {provider ? "Save Provider" : "Create Provider"}
+                </DenButton>
+            </div>
+
+            {saveError ? (
+                <div className="mb-6 rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[14px] text-red-700">
+                    {saveError}
+                </div>
+            ) : null}
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <label className="grid gap-3">
+                    <span className="text-[14px] font-medium text-gray-700">
+                        Name
+                    </span>
+                    <DenInput
+                        value={providerName}
+                        onChange={(event) => setProviderName(event.target.value)}
+                        placeholder="Give this key a name"
+                        autoComplete="off"
+                    />
+                </label>
+                <p className="mt-3 text-[13px] text-gray-500">
+                    Pick a clear label so teammates know which key or provider
+                    setup they are using.
+                </p>
+            </section>
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <h2 className="mb-6 text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                    Provider type
+                </h2>
+                <UnderlineTabs
+                    tabs={SOURCE_TABS}
+                    activeTab={source}
+                    onChange={setSource}
+                />
+
+                {source === "models_dev" ? (
+                    <div className="mt-8 grid gap-6">
+                        <div className="grid gap-3">
+                            <span className="text-[14px] font-medium text-gray-700">
+                                Provider
+                            </span>
+                            <DenCombobox
+                                value={selectedProviderId}
+                                options={catalogProviderOptions}
+                                onChange={setSelectedProviderId}
+                                ariaLabel="Provider"
+                                placeholder="Select a provider..."
+                                searchPlaceholder="Search providers..."
+                                emptyLabel="No providers match"
+                            />
+                        </div>
+
+                        {catalogBusy ? (
+                            <p className="text-[14px] text-gray-500">
+                                Loading provider catalog...
+                            </p>
+                        ) : null}
+                        {catalogError ? (
+                            <p className="text-[14px] text-red-600">
+                                {catalogError}
+                            </p>
+                        ) : null}
+
+                        {detailBusy ? (
+                            <p className="text-[14px] text-gray-500">
+                                Loading provider details...
+                            </p>
+                        ) : null}
+                        {detailError ? (
+                            <p className="text-[14px] text-red-600">
+                                {detailError}
+                            </p>
+                        ) : null}
+
+                        {catalogDetail ? (
+                            <div className="rounded-[28px] bg-gray-50 p-6">
+                                <div className="grid gap-4 md:grid-cols-2">
+                                    <div>
+                                        <p className="text-[12px] font-semibold uppercase text-gray-400">
+                                            NPM package
+                                        </p>
+                                        <p className="mt-2">
+                                            <span className="inline-flex max-w-full rounded-md bg-white px-3 py-1.5 font-mono text-[11px] leading-5 text-gray-700 ring-1 ring-inset ring-gray-200">
+                                                {providerNpm ?? "Not set"}
+                                            </span>
+                                        </p>
+                                    </div>
+                                    <div>
+                                        <p className="text-[12px] font-semibold uppercase text-gray-400">
+                                            API base
+                                        </p>
+                                        <p className="mt-2">
+                                            <span className="inline-flex max-w-full break-all rounded-md bg-white px-3 py-1.5 font-mono text-[11px] leading-5 text-gray-700 ring-1 ring-inset ring-gray-200">
+                                                {providerApiBase ?? "Not set"}
+                                            </span>
+                                        </p>
+                                    </div>
+                                    <div>
+                                        <p className="text-[12px] font-semibold uppercase text-gray-400">
+                                            Env keys
+                                        </p>
+                                        {providerEnv.length > 0 ? (
+                                            <div className="mt-2 flex flex-wrap gap-2">
+                                                {providerEnv.map((envName) => (
+                                                    <span
+                                                        key={envName}
+                                                        className="inline-flex max-w-full break-all rounded-md bg-white px-3 py-1.5 font-mono text-[11px] leading-5 text-gray-700 ring-1 ring-inset ring-gray-200"
+                                                    >
+                                                        {envName}
+                                                    </span>
+                                                ))}
+                                            </div>
+                                        ) : (
+                                            <p className="mt-2">
+                                                <span className="inline-flex max-w-full rounded-md bg-white px-3 py-1.5 font-mono text-[11px] leading-5 text-gray-700 ring-1 ring-inset ring-gray-200">
+                                                    None listed
+                                                </span>
+                                            </p>
+                                        )}
+                                    </div>
+                                    <div>
+                                        <p className="text-[12px] font-semibold uppercase text-gray-400">
+                                            Docs
+                                        </p>
+                                        <p className="mt-2">
+                                            <span className="inline-flex max-w-full break-all rounded-md bg-white px-3 py-1.5 font-mono text-[11px] leading-5 text-gray-700 ring-1 ring-inset ring-gray-200">
+                                                {providerDoc ?? "Not set"}
+                                            </span>
+                                        </p>
+                                    </div>
+                                </div>
+                            </div>
+                        ) : null}
+                    </div>
+                ) : (
+                    <div className="mt-8 grid gap-3">
+                        <span className="text-[14px] font-medium text-gray-700">
+                            Custom provider JSON
+                        </span>
+                        <DenTextarea
+                            value={customConfigText}
+                            onChange={(event) =>
+                                setCustomConfigText(event.target.value)
+                            }
+                            rows={18}
+                        />
+                        <p className="text-[13px] text-gray-500">
+                            Use the models.dev-style schema and include a{" "}
+                            <code className="rounded bg-gray-100 px-1 py-0.5">
+                                models
+                            </code>{" "}
+                            array.
+                        </p>
+                    </div>
+                )}
+            </section>
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div className="mb-6 flex flex-col gap-4 lg:flex-row lg:items-center lg:justify-between">
+                    <div>
+                        <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                            Credential
+                        </h2>
+                    </div>
+                    {provider?.hasApiKey ? (
+                        <span className="rounded-full bg-emerald-50 px-4 py-2 text-[13px] font-medium text-emerald-700">
+                            Existing credential saved
+                        </span>
+                    ) : null}
+                </div>
+
+                <label className="grid gap-3">
+                    <span className="text-[14px] font-medium text-gray-700">
+                        API key / credential
+                    </span>
+                    <DenInput
+                        type="password"
+                        value={apiKey}
+                        onChange={(event) => setApiKey(event.target.value)}
+                        placeholder={
+                            provider?.hasApiKey
+                                ? "Leave blank to keep current credential"
+                                : "Paste the provider credential"
+                        }
+                    />
+                </label>
+            </section>
+
+            {source === "models_dev" ? (
+                <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                    <div>
+                        <div>
+                            <div className="flex flex-wrap items-center gap-3">
+                                <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                                    Models
+                                </h2>
+                                {catalogDetail ? (
+                                    <span className="rounded-full bg-gray-200 px-3 py-1 text-[12px] font-medium text-gray-700">
+                                        {selectedModelIds.length}{" "}
+                                        {selectedModelIds.length === 1
+                                            ? "model selected"
+                                            : "models selected"}
+                                    </span>
+                                ) : null}
+                            </div>
+                            <p className="mt-2 text-[15px] text-gray-500">
+                                Pick the exact models this provider should
+                                allow.
+                            </p>
+                        </div>
+
+                        <div className="mt-6">
+                            <DenInput
+                                type="search"
+                                icon={Search}
+                                value={modelQuery}
+                                onChange={(event) =>
+                                    setModelQuery(event.target.value)
+                                }
+                                placeholder="Search models..."
+                            />
+                        </div>
+                    </div>
+
+                    {catalogDetail ? (
+                        filteredModels.length ? (
+                            <div className="mt-4">
+                                <div className="overflow-hidden rounded-[16px] border border-gray-200 bg-white divide-y divide-gray-200">
+                                    {filteredModels.map((model) => {
+                                        const selected =
+                                            selectedModelIds.includes(model.id);
+                                        return (
+                                            <DenSelectableRow
+                                                key={model.id}
+                                                selected={selected}
+                                                title={model.name}
+                                                description={model.id}
+                                                onClick={() =>
+                                                    setSelectedModelIds(
+                                                        (current) =>
+                                                            current.includes(
+                                                                model.id,
+                                                            )
+                                                                ? current.filter(
+                                                                      (entry) =>
+                                                                          entry !==
+                                                                          model.id,
+                                                                  )
+                                                                : [
+                                                                      ...current,
+                                                                      model.id,
+                                                                  ],
+                                                    )
+                                                }
+                                            />
+                                        );
+                                    })}
+                                </div>
+                            </div>
+                        ) : (
+                            <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                                No models match{" "}
+                                <span className="font-medium text-gray-700">
+                                    &quot;{modelQuery}&quot;
+                                </span>
+                                .
+                            </div>
+                        )
+                    ) : (
+                        <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                            Select a provider to browse its models.
+                        </div>
+                    )}
+                </section>
+            ) : null}
+
+            <section className="rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div>
+                    <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                        Configure access
+                    </h2>
+                    <p className="mt-2 text-[15px] text-gray-500">
+                        Select which teams and people can use this provider.
+                    </p>
+                </div>
+
+                <div className="mt-8 grid w-80 grid-cols-2 rounded-xl bg-gray-200 p-1 text-[13px] font-medium text-gray-500">
+                    <button
+                        type="button"
+                        onClick={() => {
+                            setAccessTab("teams");
+                            setAccessQuery("");
+                        }}
+                        className={`inline-flex items-center justify-center gap-2 rounded-lg px-4 py-2 transition ${accessTab === "teams" ? "bg-white text-gray-900 shadow-sm" : "hover:text-gray-700"}`}
+                    >
+                        <Users className="h-4 w-4" />
+                        {`Teams (${selectedTeamIds.length})`}
+                    </button>
+                    <button
+                        type="button"
+                        onClick={() => {
+                            setAccessTab("people");
+                            setAccessQuery("");
+                        }}
+                        className={`inline-flex items-center justify-center gap-2 rounded-lg px-4 py-2 transition ${accessTab === "people" ? "bg-white text-gray-900 shadow-sm" : "hover:text-gray-700"}`}
+                    >
+                        <User className="h-4 w-4" />
+                        {`People (${selectedMemberIds.length})`}
+                    </button>
+                </div>
+
+                <div className="mt-6">
+                    <DenInput
+                        type="search"
+                        icon={Search}
+                        value={accessQuery}
+                        onChange={(event) => setAccessQuery(event.target.value)}
+                        placeholder={
+                            accessTab === "teams"
+                                ? "Search teams..."
+                                : "Search people..."
+                        }
+                    />
+                </div>
+
+                {accessTab === "teams" ? (
+                    orgContext?.teams.length ? (
+                        filteredTeams.length ? (
+                            <div className="mt-4 overflow-hidden rounded-[16px] border border-gray-200 bg-white divide-y divide-gray-200">
+                                {filteredTeams.map((team) => {
+                                    const selected = selectedTeamIds.includes(team.id);
+                                    return (
+                                        <DenSelectableRow
+                                            key={team.id}
+                                            selected={selected}
+                                            leading={
+                                                <Users className="h-4 w-4 text-gray-400" />
+                                            }
+                                            title={team.name}
+                                            description={`${team.memberIds.length} ${team.memberIds.length === 1 ? "member" : "members"}`}
+                                            onClick={() =>
+                                                setSelectedTeamIds((current) =>
+                                                    current.includes(team.id)
+                                                        ? current.filter(
+                                                              (entry) =>
+                                                                  entry !== team.id,
+                                                          )
+                                                        : [...current, team.id],
+                                                )
+                                            }
+                                        />
+                                    );
+                                })}
+                            </div>
+                        ) : (
+                            <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                                No teams match{" "}
+                                <span className="font-medium text-gray-700">
+                                    &quot;{accessQuery}&quot;
+                                </span>
+                                .
+                            </div>
+                        )
+                    ) : (
+                        <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                            Create teams from the Members page before assigning team
+                            access.
+                        </div>
+                    )
+                ) : orgContext?.members.length ? (
+                    filteredMembers.length ? (
+                        <div className="mt-4 overflow-hidden rounded-[16px] border border-gray-200 bg-white divide-y divide-gray-200">
+                            {filteredMembers.map((member) => {
+                                const selected = selectedMemberIds.includes(
+                                    member.id,
+                                );
+                                const locked = lockedMemberId === member.id;
+                                return (
+                                    <DenSelectableRow
+                                        key={member.id}
+                                        disabled={locked}
+                                        selected={selected}
+                                        leading={
+                                            <div className="flex h-8 w-8 items-center justify-center rounded-full bg-[#0f172a] text-[11px] font-semibold uppercase text-white">
+                                                {member.user.name
+                                                    .split(" ")
+                                                    .map((part) => part[0])
+                                                    .join("")
+                                                    .slice(0, 2)}
+                                            </div>
+                                        }
+                                        descriptionBelow
+                                        title={member.user.name}
+                                        description={member.user.email}
+                                        aside={
+                                            locked ? (
+                                                <span className="rounded-full bg-gray-100 px-2.5 py-1 text-[11px] font-medium text-gray-500">
+                                                    Locked
+                                                </span>
+                                            ) : undefined
+                                        }
+                                        onClick={() =>
+                                            setSelectedMemberIds((current) =>
+                                                current.includes(member.id)
+                                                    ? current.filter(
+                                                          (entry) =>
+                                                              entry !== member.id,
+                                                      )
+                                                    : [...current, member.id],
+                                            )
+                                        }
+                                    />
+                                );
+                            })}
+                        </div>
+                    ) : (
+                        <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                            No people match{" "}
+                            <span className="font-medium text-gray-700">
+                                &quot;{accessQuery}&quot;
+                            </span>
+                            .
+                        </div>
+                    )
+                ) : (
+                    <div className="mt-4 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                        No people are available to assign yet.
+                    </div>
+                )}
+            </section>
+        </div>
+    );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-providers-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-providers-screen.tsx
new file mode 100644
index 0000000000..f56cdb9902
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/llm-providers-screen.tsx
@@ -0,0 +1,159 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+import { CodeXml, Cpu, KeyRound, Plus, Search } from "lucide-react";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { buttonVariants } from "../../../../_components/ui/button";
+import { DenInput } from "../../../../_components/ui/input";
+import {
+  getLlmProviderRoute,
+  getNewLlmProviderRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  formatProviderTimestamp,
+  getProviderDocUrl,
+  getProviderEnvNames,
+  useOrgLlmProviders,
+} from "./llm-provider-data";
+
+function getProviderSourceLabel(source: "models_dev" | "custom") {
+  return source === "custom" ? "Custom" : "Catalog";
+}
+
+function getProviderSourceIcon(source: "models_dev" | "custom") {
+  return source === "custom" ? CodeXml : Cpu;
+}
+
+export function LlmProvidersScreen() {
+  const { orgId, orgSlug } = useOrgDashboard();
+  const { llmProviders, busy, error } = useOrgLlmProviders(orgId);
+  const [query, setQuery] = useState("");
+
+  const filteredProviders = useMemo(() => {
+    const normalizedQuery = query.trim().toLowerCase();
+    if (!normalizedQuery) {
+      return llmProviders;
+    }
+
+    return llmProviders.filter((provider) => {
+      const env = getProviderEnvNames(provider.providerConfig).join(" ").toLowerCase();
+      const doc = (getProviderDocUrl(provider.providerConfig) ?? "").toLowerCase();
+      return (
+        provider.name.toLowerCase().includes(normalizedQuery) ||
+        provider.providerId.toLowerCase().includes(normalizedQuery) ||
+        provider.models.some((model) => model.name.toLowerCase().includes(normalizedQuery)) ||
+        env.includes(normalizedQuery) ||
+        doc.includes(normalizedQuery)
+      );
+    });
+  }, [llmProviders, query]);
+
+  return (
+    <DashboardPageTemplate
+      icon={Cpu}
+      badgeLabel="New"
+      title="LLM Providers"
+      description="Configure catalog-backed or custom providers, choose the exact models each one exposes, and grant access to the right people and teams."
+      colors={["#F3FFF9", "#0F766E", "#34D399", "#7DD3FC"]}
+    >
+      <div className="mb-8 flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
+        <DenInput
+          type="search"
+          icon={Search}
+          value={query}
+          onChange={(event) => setQuery(event.target.value)}
+          placeholder="Search providers, models, or env keys..."
+        />
+
+        <Link href={getNewLlmProviderRoute(orgSlug)} className={buttonVariants({ variant: "primary" })}>
+          <Plus className="h-4 w-4" aria-hidden="true" />
+          Add Provider
+        </Link>
+      </div>
+
+      {error ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {error}
+        </div>
+      ) : null}
+
+      {busy ? (
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading your provider library...
+        </div>
+      ) : filteredProviders.length === 0 ? (
+        <div className="rounded-[32px] border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+          <p className="text-[16px] font-medium tracking-[-0.03em] text-gray-900">
+            {llmProviders.length === 0 ? "No providers configured yet." : "No providers match that search yet."}
+          </p>
+          <p className="mx-auto mt-3 max-w-[560px] text-[15px] leading-8 text-gray-500">
+            {llmProviders.length === 0
+              ? "Start with a models.dev provider, select the models you want to expose, add the credential, and then grant access to the right people or teams."
+              : "Try a broader search term, or create a new provider if this org needs a different stack."}
+          </p>
+        </div>
+      ) : (
+        <div className="grid gap-4 lg:grid-cols-2 2xl:grid-cols-3">
+          {filteredProviders.map((provider) => {
+            const SourceIcon = getProviderSourceIcon(provider.source);
+            const envNames = getProviderEnvNames(provider.providerConfig);
+            const memberAccessCount = provider.access.members.length;
+            const teamAccessCount = provider.access.teams.length;
+            return (
+              <Link
+                key={provider.id}
+                href={getLlmProviderRoute(orgSlug, provider.id)}
+                className="block overflow-hidden rounded-[28px] border border-gray-200 bg-white p-6 transition hover:-translate-y-0.5 hover:border-gray-300 hover:shadow-[0_18px_40px_-24px_rgba(15,23,42,0.25)]"
+              >
+                <div className="flex items-start justify-between gap-4">
+                  <div>
+                    <div className="inline-flex items-center gap-2 rounded-full border border-emerald-100 bg-emerald-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.14em] text-emerald-700">
+                      <SourceIcon className="h-3.5 w-3.5" />
+                      {getProviderSourceLabel(provider.source)}
+                    </div>
+                    <h2 className="mt-4 text-[22px] font-semibold tracking-[-0.05em] text-gray-950">{provider.name}</h2>
+                    <p className="mt-2 text-[14px] text-gray-500">{provider.providerId}</p>
+                  </div>
+
+                  <div className="rounded-full border border-gray-200 bg-gray-50 px-3 py-1 text-[12px] font-medium text-gray-600">
+                    {provider.models.length} {provider.models.length === 1 ? "model" : "models"}
+                  </div>
+                </div>
+
+                <div className="mt-5 flex flex-wrap gap-2">
+                  <span className={`inline-flex items-center gap-1 rounded-full px-3 py-1 text-[12px] font-medium ${provider.hasApiKey ? "bg-emerald-50 text-emerald-700" : "bg-amber-50 text-amber-700"}`}>
+                    <KeyRound className="h-3.5 w-3.5" />
+                    {provider.hasApiKey ? "Credential saved" : "Credential missing"}
+                  </span>
+                  {envNames.slice(0, 2).map((envName) => (
+                    <span key={envName} className="rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-600">
+                      {envName}
+                    </span>
+                  ))}
+                  {envNames.length > 2 ? (
+                    <span className="rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-600">
+                      +{envNames.length - 2} more keys
+                    </span>
+                  ) : null}
+                </div>
+
+                <div className="mt-6 grid gap-3 rounded-[24px] bg-gray-50 p-4 text-[13px] text-gray-600 sm:grid-cols-2">
+                  <div>
+                    <p className="font-medium text-gray-900">Access</p>
+                    <p className="mt-1">{memberAccessCount} people · {teamAccessCount} teams</p>
+                  </div>
+                  <div>
+                    <p className="font-medium text-gray-900">Updated</p>
+                    <p className="mt-1">{formatProviderTimestamp(provider.updatedAt)}</p>
+                  </div>
+                </div>
+              </Link>
+            );
+          })}
+        </div>
+      )}
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/manage-members-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/manage-members-screen.tsx
new file mode 100644
index 0000000000..8188f0ca0a
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/manage-members-screen.tsx
@@ -0,0 +1,1019 @@
+"use client";
+
+import { type ElementType, useEffect, useMemo, useState } from "react";
+import {
+  CheckCircle2,
+  Circle,
+  Lock,
+  Mail,
+  Pencil,
+  Plus,
+  Settings,
+  Shield,
+  Trash2,
+  User,
+  Users,
+} from "lucide-react";
+import {
+  DEN_ROLE_PERMISSION_OPTIONS,
+  formatRoleLabel,
+  getOrgAccessFlags,
+  getMembersRoute,
+  splitRoleString,
+} from "../../../../_lib/den-org";
+import { type OrgLimitError, getOrgLimitError } from "../../../../_lib/den-flow";
+import { buildDenFeedbackUrl } from "../../../../_lib/feedback";
+import { OrgLimitDialog } from "../../../../_components/org-limit-dialog";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import { UnderlineTabs } from "../../../../_components/ui/tabs";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenCard } from "../../../../_components/ui/card";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenSelect } from "../../../../_components/ui/select";
+
+type MembersTab = "members" | "teams" | "roles" | "invitations";
+
+function clonePermissionRecord(value: Record<string, string[]>) {
+  return Object.fromEntries(
+    Object.entries(value).map(([resource, actions]) => [
+      resource,
+      [...actions],
+    ]),
+  );
+}
+
+function toggleAction(
+  value: Record<string, string[]>,
+  resource: string,
+  action: string,
+  enabled: boolean,
+) {
+  const next = clonePermissionRecord(value);
+  const current = new Set(next[resource] ?? []);
+
+  if (enabled) {
+    current.add(action);
+  } else {
+    current.delete(action);
+  }
+
+  next[resource] = [...current];
+  return next;
+}
+
+function ActionButton({
+  children,
+  tone = "default",
+  size = "sm",
+  icon,
+  onClick,
+  disabled,
+}: {
+  children: React.ReactNode;
+  tone?: "default" | "danger";
+  size?: "md" | "sm";
+  icon?: ElementType<{ size?: number; className?: string }>;
+  onClick?: () => void;
+  disabled?: boolean;
+}) {
+  return (
+    <DenButton
+      variant={tone === "danger" ? "destructive" : "secondary"}
+      size={size}
+      icon={icon}
+      onClick={onClick}
+      disabled={disabled}
+    >
+      {children}
+    </DenButton>
+  );
+}
+
+function SummaryCard({
+  label,
+  value,
+  tone = "default",
+}: {
+  label: string;
+  value: string;
+  tone?: "default" | "dark";
+}) {
+  return (
+    <div
+      className={`rounded-[24px] border px-5 py-4 ${tone === "dark" ? "border-[#0f172a] bg-[#0f172a] text-white" : "border-gray-200 bg-white text-gray-900"}`}
+    >
+      <p
+        className={`text-[12px] font-semibold uppercase tracking-[0.16em] ${tone === "dark" ? "text-white/60" : "text-gray-400"}`}
+      >
+        {label}
+      </p>
+      <p className="mt-3 text-[24px] font-semibold tracking-[-0.05em]">
+        {value}
+      </p>
+    </div>
+  );
+}
+
+export function ManageMembersScreen() {
+  const {
+    activeOrg,
+    orgContext,
+    orgBusy,
+    orgError,
+    mutationBusy,
+    inviteMember,
+    cancelInvitation,
+    updateMemberRole,
+    removeMember,
+    createTeam,
+    updateTeam,
+    deleteTeam,
+    createRole,
+    updateRole,
+    deleteRole,
+  } = useOrgDashboard();
+  const [activeTab, setActiveTab] = useState<MembersTab>("members");
+  const [pageError, setPageError] = useState<string | null>(null);
+  const [showInviteForm, setShowInviteForm] = useState(false);
+  const [inviteEmail, setInviteEmail] = useState("");
+  const [inviteRole, setInviteRole] = useState("member");
+  const [editingMemberId, setEditingMemberId] = useState<string | null>(null);
+  const [memberRoleDraft, setMemberRoleDraft] = useState("member");
+  const [showTeamForm, setShowTeamForm] = useState(false);
+  const [editingTeamId, setEditingTeamId] = useState<string | null>(null);
+  const [teamNameDraft, setTeamNameDraft] = useState("");
+  const [teamMemberDraft, setTeamMemberDraft] = useState<string[]>([]);
+  const [showRoleForm, setShowRoleForm] = useState(false);
+  const [editingRoleId, setEditingRoleId] = useState<string | null>(null);
+  const [roleNameDraft, setRoleNameDraft] = useState("");
+  const [rolePermissionDraft, setRolePermissionDraft] = useState<
+    Record<string, string[]>
+  >({});
+  const [limitDialogError, setLimitDialogError] = useState<OrgLimitError | null>(null);
+
+  const assignableRoles = useMemo(
+    () => (orgContext?.roles ?? []).filter((role) => !role.protected),
+    [orgContext?.roles],
+  );
+
+  const access = useMemo(
+    () =>
+      getOrgAccessFlags(
+        orgContext?.currentMember.role ?? "member",
+        orgContext?.currentMember.isOwner ?? false,
+      ),
+    [orgContext?.currentMember.isOwner, orgContext?.currentMember.role],
+  );
+
+  const pendingInvitations = useMemo(
+    () =>
+      (orgContext?.invitations ?? []).filter(
+        (invitation) => invitation.status === "pending",
+      ),
+    [orgContext?.invitations],
+  );
+
+  const tabCounts: Record<MembersTab, number> = {
+    members: orgContext?.members.length ?? 0,
+    teams: orgContext?.teams.length ?? 0,
+    roles: orgContext?.roles.length ?? 0,
+    invitations: pendingInvitations.length,
+  };
+
+  const teamMemberNames = useMemo(() => {
+    const membersById = new Map(
+      (orgContext?.members ?? []).map((member) => [
+        member.id,
+        member.user.name,
+      ]),
+    );
+    return new Map(
+      (orgContext?.teams ?? []).map((team) => [
+        team.id,
+        team.memberIds
+          .map((memberId) => membersById.get(memberId))
+          .filter((value): value is string => Boolean(value)),
+      ]),
+    );
+  }, [orgContext?.members, orgContext?.teams]);
+
+  const feedbackHref = useMemo(
+    () =>
+      buildDenFeedbackUrl({
+        pathname: activeOrg ? getMembersRoute(activeOrg.slug) : "/organization",
+        orgSlug: activeOrg?.slug ?? null,
+        topic: "workspace-limits",
+      }),
+    [activeOrg],
+  );
+
+  function resetInviteForm() {
+    setInviteEmail("");
+    setInviteRole(assignableRoles[0]?.role ?? "member");
+    setShowInviteForm(false);
+  }
+
+  function resetMemberEditor() {
+    setEditingMemberId(null);
+    setMemberRoleDraft(assignableRoles[0]?.role ?? "member");
+  }
+
+  function resetTeamEditor() {
+    setEditingTeamId(null);
+    setTeamNameDraft("");
+    setTeamMemberDraft([]);
+    setShowTeamForm(false);
+  }
+
+  function resetRoleEditor() {
+    setEditingRoleId(null);
+    setRoleNameDraft("");
+    setRolePermissionDraft({});
+    setShowRoleForm(false);
+  }
+
+  useEffect(() => {
+    if (!assignableRoles[0]) {
+      return;
+    }
+
+    setInviteRole((current) =>
+      assignableRoles.some((role) => role.role === current)
+        ? current
+        : assignableRoles[0].role,
+    );
+    setMemberRoleDraft((current) =>
+      assignableRoles.some((role) => role.role === current)
+        ? current
+        : assignableRoles[0].role,
+    );
+  }, [assignableRoles]);
+
+  if (orgBusy && !orgContext) {
+    return (
+      <div className="mx-auto max-w-[1200px] px-6 py-8 md:px-8">
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading organization details...
+        </div>
+      </div>
+    );
+  }
+
+  if (!orgContext || !activeOrg) {
+    return (
+      <div className="mx-auto max-w-[1200px] px-6 py-8 md:px-8">
+        <div className="rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[15px] text-red-700">
+          {orgError ?? "Organization details are unavailable."}
+        </div>
+      </div>
+    );
+  }
+
+  const inviteForm =
+    showInviteForm && access.canInviteMembers ? (
+      <DenCard className="mb-6">
+        <form
+          className="grid gap-4 lg:grid-cols-[minmax(0,1.4fr)_220px_auto] lg:items-end"
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setPageError(null);
+            try {
+              await inviteMember({ email: inviteEmail, role: inviteRole });
+              resetInviteForm();
+            } catch (error) {
+              const limitError = getOrgLimitError(error);
+              if (limitError) {
+                setLimitDialogError(limitError);
+                return;
+              }
+
+              setPageError(
+                error instanceof Error
+                  ? error.message
+                  : "Could not invite member.",
+              );
+            }
+          }}
+        >
+          <label className="grid gap-3">
+            <span className="text-[14px] font-medium text-gray-700">Email</span>
+            <DenInput
+              type="email"
+              value={inviteEmail}
+              onChange={(event) => setInviteEmail(event.target.value)}
+              placeholder="teammate@example.com"
+              required
+            />
+          </label>
+          <label className="grid gap-3">
+            <span className="text-[14px] font-medium text-gray-700">Role</span>
+            <DenSelect value={inviteRole} onChange={(event) => setInviteRole(event.target.value)}>
+              {assignableRoles.map((role) => (
+                <option key={role.id} value={role.role}>
+                  {formatRoleLabel(role.role)}
+                </option>
+              ))}
+            </DenSelect>
+          </label>
+          <div className="flex gap-2 lg:justify-end">
+            <ActionButton size="md" onClick={resetInviteForm}>Cancel</ActionButton>
+            <DenButton type="submit" loading={mutationBusy === "invite-member"}>
+              Send invite
+            </DenButton>
+          </div>
+        </form>
+      </DenCard>
+    ) : null;
+
+  const editMemberForm =
+    editingMemberId && access.canManageMembers ? (
+      <DenCard className="mb-6">
+        <form
+          className="grid gap-4 lg:grid-cols-[240px_auto] lg:items-end"
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setPageError(null);
+            try {
+              await updateMemberRole(editingMemberId, memberRoleDraft);
+              resetMemberEditor();
+            } catch (error) {
+              setPageError(
+                error instanceof Error
+                  ? error.message
+                  : "Could not update member role.",
+              );
+            }
+          }}
+        >
+          <label className="grid gap-3">
+            <span className="text-[14px] font-medium text-gray-700">Role</span>
+            <DenSelect value={memberRoleDraft} onChange={(event) => setMemberRoleDraft(event.target.value)}>
+              {assignableRoles.map((role) => (
+                <option key={role.id} value={role.role}>
+                  {formatRoleLabel(role.role)}
+                </option>
+              ))}
+            </DenSelect>
+          </label>
+          <div className="flex gap-2 lg:justify-end">
+            <ActionButton size="md" onClick={resetMemberEditor}>Cancel</ActionButton>
+            <DenButton type="submit" loading={mutationBusy === "update-member-role"}>
+              Save member
+            </DenButton>
+          </div>
+        </form>
+      </DenCard>
+    ) : null;
+
+  const teamForm =
+    (showTeamForm || editingTeamId) && access.canManageTeams ? (
+      <DenCard className="mb-6">
+        <form
+          className="grid gap-6"
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setPageError(null);
+            try {
+              if (editingTeamId) {
+                await updateTeam(editingTeamId, {
+                  name: teamNameDraft,
+                  memberIds: teamMemberDraft,
+                });
+              } else {
+                await createTeam({
+                  name: teamNameDraft,
+                  memberIds: teamMemberDraft,
+                });
+              }
+              resetTeamEditor();
+            } catch (error) {
+              setPageError(
+                error instanceof Error ? error.message : "Could not save team.",
+              );
+            }
+          }}
+        >
+          <label className="grid gap-3 lg:max-w-[420px]">
+            <span className="text-[14px] font-medium text-gray-700">
+              Team name
+            </span>
+            <DenInput
+              type="text"
+              value={teamNameDraft}
+              onChange={(event) => setTeamNameDraft(event.target.value)}
+              placeholder="Core Engineering"
+              required
+            />
+          </label>
+
+          <div>
+            <p className="mb-3 text-[14px] font-medium text-gray-700">
+              Team members
+            </p>
+            {orgContext.members.length === 0 ? (
+              <div className="rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[14px] text-gray-500">
+                Invite a member before assigning people to this team.
+              </div>
+            ) : (
+              <div className="grid gap-3 md:grid-cols-2">
+                {orgContext.members.map((member) => {
+                  const selected = teamMemberDraft.includes(member.id);
+                  return (
+                    <button
+                      key={member.id}
+                      type="button"
+                      onClick={() => {
+                        setTeamMemberDraft((current) =>
+                          current.includes(member.id)
+                            ? current.filter((entry) => entry !== member.id)
+                            : [...current, member.id],
+                        );
+                      }}
+                      className={`flex items-start gap-3 rounded-[22px] border px-4 py-4 text-left transition ${
+                        selected
+                          ? "border-[#0f172a] bg-[#0f172a] text-white"
+                          : "border-gray-200 bg-white text-gray-700 hover:border-gray-300"
+                      }`}
+                    >
+                      {selected ? (
+                        <CheckCircle2 className="mt-0.5 h-6 w-6 shrink-0" />
+                      ) : (
+                        <Circle className="mt-0.5 h-6 w-6 shrink-0 text-gray-300" />
+                      )}
+                      <div>
+                        <p className="text-[15px] font-medium tracking-[-0.03em]">
+                          {member.user.name}
+                        </p>
+                        <p
+                          className={`mt-1 text-[13px] ${selected ? "text-white/70" : "text-gray-400"}`}
+                        >
+                          {member.user.email}
+                        </p>
+                      </div>
+                    </button>
+                  );
+                })}
+              </div>
+            )}
+          </div>
+
+          <div className="flex flex-wrap gap-2">
+            <ActionButton size="md" onClick={resetTeamEditor}>Cancel</ActionButton>
+            <DenButton
+              type="submit"
+              loading={mutationBusy === "create-team" || mutationBusy === "update-team"}
+            >
+              {editingTeamId ? "Save team" : "Create team"}
+            </DenButton>
+          </div>
+        </form>
+      </DenCard>
+    ) : null;
+
+  const roleForm =
+    (showRoleForm || editingRoleId) && access.canManageRoles ? (
+      <DenCard className="mb-6">
+        <form
+          className="grid gap-6"
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setPageError(null);
+            try {
+              if (editingRoleId) {
+                await updateRole(editingRoleId, {
+                  roleName: roleNameDraft,
+                  permission: rolePermissionDraft,
+                });
+              } else {
+                await createRole({
+                  roleName: roleNameDraft,
+                  permission: rolePermissionDraft,
+                });
+              }
+              resetRoleEditor();
+            } catch (error) {
+              setPageError(
+                error instanceof Error ? error.message : "Could not save role.",
+              );
+            }
+          }}
+        >
+          <label className="grid gap-3 lg:max-w-[420px]">
+            <span className="text-[14px] font-medium text-gray-700">
+              Role name
+            </span>
+            <DenInput
+              type="text"
+              value={roleNameDraft}
+              onChange={(event) => setRoleNameDraft(event.target.value)}
+              placeholder="qa-reviewer"
+              required
+            />
+          </label>
+
+          <div className="grid gap-4 xl:grid-cols-3">
+            {Object.entries(DEN_ROLE_PERMISSION_OPTIONS).map(
+              ([resource, actions]) => (
+                <div
+                  key={resource}
+                  className="rounded-[24px] border border-gray-200 bg-[#f8fafc] p-4"
+                >
+                  <p className="mb-3 text-[15px] font-semibold text-gray-900">
+                    {formatRoleLabel(resource)}
+                  </p>
+                  <div className="grid gap-2">
+                    {actions.map((action) => {
+                      const checked = (
+                        rolePermissionDraft[resource] ?? []
+                      ).includes(action);
+                      return (
+                        <label
+                          key={`${resource}-${action}`}
+                          className="inline-flex items-center gap-2 text-[14px] text-gray-600"
+                        >
+                          <input
+                            type="checkbox"
+                            checked={checked}
+                            onChange={(event) =>
+                              setRolePermissionDraft((current) =>
+                                toggleAction(
+                                  current,
+                                  resource,
+                                  action,
+                                  event.target.checked,
+                                ),
+                              )
+                            }
+                          />
+                          <span>{formatRoleLabel(action)}</span>
+                        </label>
+                      );
+                    })}
+                  </div>
+                </div>
+              ),
+            )}
+          </div>
+
+          <div className="flex flex-wrap gap-2">
+            <ActionButton size="md" onClick={resetRoleEditor}>Cancel</ActionButton>
+            <DenButton
+              type="submit"
+              loading={mutationBusy === "create-role" || mutationBusy === "update-role"}
+            >
+              {editingRoleId ? "Save role" : "Create role"}
+            </DenButton>
+          </div>
+        </form>
+      </DenCard>
+    ) : null;
+
+  const toolbarAction = (() => {
+    if (activeTab === "members" && access.canInviteMembers) {
+      return {
+        label: "Add member",
+        onClick: () => {
+          resetMemberEditor();
+          setShowInviteForm((current) => !current);
+        },
+      };
+    }
+    if (activeTab === "teams" && access.canManageTeams) {
+      return {
+        label: "Create Team",
+        onClick: () => {
+          resetTeamEditor();
+          setShowTeamForm((current) => !current);
+        },
+      };
+    }
+    if (activeTab === "roles" && access.canManageRoles) {
+      return {
+        label: "Add role",
+        onClick: () => {
+          setShowRoleForm((current) => !current);
+          setEditingRoleId(null);
+          setRoleNameDraft("");
+          setRolePermissionDraft({});
+        },
+      };
+    }
+    if (activeTab === "invitations" && access.canInviteMembers) {
+      return {
+        label: "Invite member",
+        onClick: () => {
+          resetMemberEditor();
+          setShowInviteForm((current) => !current);
+        },
+      };
+    }
+    return null;
+  })();
+
+  return (
+    <DashboardPageTemplate
+      icon={Users}
+      title="Members"
+      description="Invite teammates, adjust roles, and keep access clean."
+      colors={["#F3EEFF", "#4A1D96", "#7C3AED", "#C4B5FD"]}
+    >
+      <OrgLimitDialog
+        open={Boolean(limitDialogError)}
+        title={limitDialogError?.limitType === "members" ? "Member limit reached" : "Worker limit reached"}
+        message={limitDialogError?.message ?? "This workspace reached its current plan limit."}
+        detail={
+          limitDialogError
+            ? `${limitDialogError.currentCount} of ${limitDialogError.limit} ${limitDialogError.limitType} are already in use.`
+            : null
+        }
+        feedbackHref={feedbackHref}
+        onClose={() => setLimitDialogError(null)}
+      />
+
+      {pageError ? (
+        <div className="mb-6 rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[14px] text-red-700">
+          {pageError}
+        </div>
+      ) : null}
+
+      <UnderlineTabs
+        className="mb-6"
+        activeTab={activeTab}
+        onChange={setActiveTab}
+        tabs={[
+          { value: "members", label: "Members", icon: User, count: tabCounts.members },
+          { value: "teams", label: "Teams", icon: Users, count: tabCounts.teams },
+          { value: "roles", label: "Roles", icon: Shield, count: tabCounts.roles },
+          { value: "invitations", label: "Invitations", icon: Mail, count: tabCounts.invitations },
+        ]}
+      />
+
+      {activeTab === "members" ? inviteForm : null}
+      {activeTab === "members" ? editMemberForm : null}
+      {activeTab === "teams" ? teamForm : null}
+      {activeTab === "roles" ? roleForm : null}
+      {activeTab === "invitations" ? inviteForm : null}
+
+      {activeTab === "members" ? (
+        <div>
+          <div className="mb-6 flex items-center justify-between gap-4">
+            <p className="text-[15px] text-gray-400">
+              {access.canInviteMembers
+                ? "Invite people, update their role, or remove them from the organization."
+                : "View who is in the organization and what role they currently hold."}
+            </p>
+            {toolbarAction ? (
+              <DenButton icon={Plus} onClick={toolbarAction.onClick}>
+                {toolbarAction.label}
+              </DenButton>
+            ) : null}
+          </div>
+
+          <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+            <div className="grid grid-cols-[minmax(0,1fr)_180px_140px_160px] gap-4 border-b border-gray-100 px-6 py-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+              <span>Member</span>
+              <span>Role</span>
+              <span>Joined</span>
+              <span />
+            </div>
+
+            {orgContext.members.map((member) => (
+              <div
+                key={member.id}
+                className="grid grid-cols-[minmax(0,1fr)_180px_140px_160px] items-center gap-4 border-b border-gray-100 px-6 py-3.5 transition hover:bg-gray-50/60 last:border-b-0"
+              >
+                <div className="flex min-w-0 items-center gap-3">
+                  <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[#0f172a] text-[11px] font-semibold uppercase text-white">
+                    {member.user.name
+                      .split(" ")
+                      .map((part) => part[0])
+                      .join("")
+                      .slice(0, 2)}
+                  </div>
+                  <div className="min-w-0">
+                    <p className="truncate text-[13px] font-medium text-gray-900">
+                      {member.user.name}
+                    </p>
+                    <p className="truncate text-[12px] text-gray-400">
+                      {member.user.email}
+                    </p>
+                  </div>
+                </div>
+                <span className="text-[13px] text-gray-500">
+                  {splitRoleString(member.role).map(formatRoleLabel).join(", ")}
+                </span>
+                <span className="text-[13px] text-gray-400">
+                  {member.createdAt
+                    ? new Date(member.createdAt).toLocaleDateString()
+                    : "-"}
+                </span>
+                <div className="flex items-center justify-end gap-2">
+                  {member.isOwner ? (
+                    <span className="inline-flex items-center gap-1.5 rounded-full bg-gray-100 px-3 py-1 text-[12px] text-gray-400">
+                      <Lock className="h-3 w-3" />
+                      Locked
+                    </span>
+                  ) : access.canManageMembers ? (
+                    <>
+                      <button
+                        type="button"
+                        onClick={() => {
+                          setEditingMemberId(member.id);
+                          setMemberRoleDraft(member.role);
+                          setShowInviteForm(false);
+                        }}
+                        className="rounded-full p-2 text-gray-400 transition hover:bg-gray-100 hover:text-gray-700"
+                        aria-label={`Edit ${member.user.name}`}
+                      >
+                        <Settings className="h-4 w-4" />
+                      </button>
+                      <button
+                        type="button"
+                        onClick={async () => {
+                          setPageError(null);
+                          try {
+                            await removeMember(member.id);
+                            if (editingMemberId === member.id) {
+                              resetMemberEditor();
+                            }
+                          } catch (error) {
+                            setPageError(
+                              error instanceof Error
+                                ? error.message
+                                : "Could not remove member.",
+                            );
+                          }
+                        }}
+                        disabled={mutationBusy === "remove-member"}
+                        className="rounded-full p-2 text-gray-400 transition hover:bg-red-50 hover:text-red-600 disabled:cursor-not-allowed disabled:opacity-60"
+                        aria-label={`Remove ${member.user.name}`}
+                      >
+                        <Trash2 className="h-4 w-4" />
+                      </button>
+                    </>
+                  ) : (
+                    <span className="text-[13px] text-gray-400">Read only</span>
+                  )}
+                </div>
+              </div>
+            ))}
+          </div>
+        </div>
+      ) : null}
+
+      {activeTab === "teams" ? (
+        <div>
+          <div className="mb-6 flex items-center justify-between gap-4">
+            <p className="text-[15px] text-gray-400">Manage teams and their members.</p>
+            {toolbarAction ? (
+              <DenButton icon={Plus} onClick={toolbarAction.onClick}>
+                {toolbarAction.label}
+              </DenButton>
+            ) : null}
+          </div>
+
+          <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+            <div className="grid grid-cols-[minmax(0,1fr)_160px_200px] gap-4 border-b border-gray-100 px-6 py-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+              <span>Team</span>
+              <span>Members</span>
+              <span />
+            </div>
+
+            {orgContext.teams.length === 0 ? (
+              <div className="px-6 py-8 text-center text-[13px] text-gray-400">
+                No teams yet.
+              </div>
+            ) : (
+              orgContext.teams.map((team) => (
+                <div
+                  key={team.id}
+                  className="grid grid-cols-[minmax(0,1fr)_160px_200px] items-center gap-4 border-b border-gray-100 px-6 py-3.5 transition hover:bg-gray-50/60 last:border-b-0"
+                >
+                  <div>
+                    <span className="text-[13px] font-medium text-gray-900">
+                      {team.name}
+                    </span>
+                    <p className="mt-0.5 text-[12px] text-gray-400">
+                      {teamMemberNames.get(team.id)?.slice(0, 3).join(", ") ||
+                        "No members assigned yet"}
+                      {(teamMemberNames.get(team.id)?.length ?? 0) > 3
+                        ? ` +${(teamMemberNames.get(team.id)?.length ?? 0) - 3}`
+                        : ""}
+                    </p>
+                  </div>
+                  <span className="text-[13px] text-gray-400">{`${team.memberIds.length} ${team.memberIds.length === 1 ? "member" : "members"}`}</span>
+                  <div className="flex items-center justify-end gap-3">
+                    {access.canManageTeams ? (
+                      <>
+                        <ActionButton
+                          icon={Pencil}
+                          onClick={() => {
+                            setShowTeamForm(false);
+                            setEditingTeamId(team.id);
+                            setTeamNameDraft(team.name);
+                            setTeamMemberDraft(team.memberIds);
+                          }}
+                        >
+                          Edit
+                        </ActionButton>
+                        <ActionButton
+                          tone="danger"
+                          icon={Trash2}
+                          disabled={mutationBusy === "delete-team"}
+                          onClick={async () => {
+                            setPageError(null);
+                            try {
+                              await deleteTeam(team.id);
+                              if (editingTeamId === team.id) {
+                                resetTeamEditor();
+                              }
+                            } catch (error) {
+                              setPageError(
+                                error instanceof Error
+                                  ? error.message
+                                  : "Could not delete team.",
+                              );
+                            }
+                          }}
+                        >
+                          {mutationBusy === "delete-team" ? "Deleting..." : "Delete"}
+                        </ActionButton>
+                      </>
+                    ) : (
+                      <span className="text-[13px] text-gray-400">
+                        Read only
+                      </span>
+                    )}
+                  </div>
+                </div>
+              ))
+            )}
+          </div>
+        </div>
+      ) : null}
+
+      {activeTab === "roles" ? (
+        <div>
+          <div className="mb-6 flex items-center justify-between gap-4">
+            <p className="text-[15px] text-gray-400">
+              {access.canManageRoles
+                ? "Default roles stay available, and owners can add, edit, or remove custom roles here."
+                : "Role definitions are visible here, but only owners can change them."}
+            </p>
+            {toolbarAction ? (
+              <DenButton icon={Plus} onClick={toolbarAction.onClick}>
+                {toolbarAction.label}
+              </DenButton>
+            ) : null}
+          </div>
+
+          <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+            <div className="grid grid-cols-[minmax(0,1fr)_120px_200px] gap-4 border-b border-gray-100 px-6 py-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+              <span>Role</span>
+              <span>Type</span>
+              <span />
+            </div>
+
+            {orgContext.roles.map((role) => (
+              <div
+                key={role.id}
+                className="grid grid-cols-[minmax(0,1fr)_120px_200px] items-center gap-4 border-b border-gray-100 px-6 py-3.5 transition hover:bg-gray-50/60 last:border-b-0"
+              >
+                <span className="text-[13px] font-medium text-gray-900">
+                  {formatRoleLabel(role.role)}
+                </span>
+                <span className="text-[13px] text-gray-400">
+                  {role.protected
+                    ? "System"
+                    : role.builtIn
+                      ? "Default"
+                      : "Custom"}
+                </span>
+                <div className="flex items-center justify-end gap-3">
+                  {access.canManageRoles && !role.protected ? (
+                    <>
+                      <ActionButton
+                        icon={Pencil}
+                        onClick={() => {
+                          setShowRoleForm(false);
+                          setEditingRoleId(role.id);
+                          setRoleNameDraft(role.role);
+                          setRolePermissionDraft(
+                            clonePermissionRecord(role.permission),
+                          );
+                        }}
+                      >
+                        Edit
+                      </ActionButton>
+                      <ActionButton
+                        tone="danger"
+                        icon={Trash2}
+                        disabled={mutationBusy === "delete-role"}
+                        onClick={async () => {
+                          setPageError(null);
+                          try {
+                            await deleteRole(role.id);
+                            if (editingRoleId === role.id) {
+                              resetRoleEditor();
+                            }
+                          } catch (error) {
+                            setPageError(
+                              error instanceof Error
+                                ? error.message
+                                : "Could not delete role.",
+                            );
+                          }
+                        }}
+                      >
+                        {mutationBusy === "delete-role" ? "Deleting..." : "Delete"}
+                      </ActionButton>
+                    </>
+                  ) : (
+                    <span className="text-[13px] text-gray-400">Read only</span>
+                  )}
+                </div>
+              </div>
+            ))}
+          </div>
+        </div>
+      ) : null}
+
+      {activeTab === "invitations" ? (
+        <div>
+          <div className="mb-6 flex items-center justify-between gap-4">
+            <p className="text-[15px] text-gray-400">
+              Admins and owners can revoke pending invites before they are accepted.
+            </p>
+            {toolbarAction ? (
+              <DenButton icon={Plus} onClick={toolbarAction.onClick}>
+                {toolbarAction.label}
+              </DenButton>
+            ) : null}
+          </div>
+
+          <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+            <div className="grid grid-cols-[minmax(0,1fr)_140px_140px_120px] gap-4 border-b border-gray-100 px-6 py-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+              <span>Email</span>
+              <span>Role</span>
+              <span>Expires</span>
+              <span />
+            </div>
+
+            {pendingInvitations.length === 0 ? (
+              <div className="px-6 py-8 text-center text-[13px] text-gray-400">
+                You have no pending workspace invites.
+              </div>
+            ) : (
+              pendingInvitations.map((invitation) => (
+                <div
+                  key={invitation.id}
+                  className="grid grid-cols-[minmax(0,1fr)_140px_140px_120px] items-center gap-4 border-b border-gray-100 px-6 py-3.5 transition hover:bg-gray-50/60 last:border-b-0"
+                >
+                  <span className="truncate text-[13px] text-gray-900">
+                    {invitation.email}
+                  </span>
+                  <span className="text-[13px] text-gray-500">
+                    {formatRoleLabel(invitation.role)}
+                  </span>
+                  <span className="text-[13px] text-gray-400">
+                    {invitation.expiresAt
+                      ? new Date(invitation.expiresAt).toLocaleDateString()
+                      : "-"}
+                  </span>
+                  <div className="flex justify-end">
+                    {access.canCancelInvitations ? (
+                      <ActionButton
+                        disabled={mutationBusy === "cancel-invitation"}
+                        onClick={async () => {
+                          setPageError(null);
+                          try {
+                            await cancelInvitation(invitation.id);
+                          } catch (error) {
+                            setPageError(
+                              error instanceof Error
+                                ? error.message
+                                : "Could not cancel invitation.",
+                            );
+                          }
+                        }}
+                      >
+                        {mutationBusy === "cancel-invitation"
+                          ? "Cancelling..."
+                          : "Cancel"}
+                      </ActionButton>
+                    ) : (
+                      <span className="text-[13px] text-gray-400">
+                        Read only
+                      </span>
+                    )}
+                  </div>
+                </div>
+              ))
+            )}
+          </div>
+        </div>
+      ) : null}
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-data.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-data.tsx
new file mode 100644
index 0000000000..a369b3dd75
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-data.tsx
@@ -0,0 +1,265 @@
+"use client";
+
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+
+export type DenMarketplace = {
+  id: string;
+  name: string;
+  description: string | null;
+  pluginCount: number;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export const marketplaceQueryKeys = {
+  all: ["marketplaces"] as const,
+  list: () => [...marketplaceQueryKeys.all, "list"] as const,
+  detail: (id: string) => [...marketplaceQueryKeys.all, "detail", id] as const,
+  resolved: (id: string) => [...marketplaceQueryKeys.all, "resolved", id] as const,
+  access: (id: string) => [...marketplaceQueryKeys.all, "access", id] as const,
+};
+
+export type MarketplaceAccessRole = "viewer" | "editor" | "manager";
+
+export type MarketplaceAccessGrant = {
+  id: string;
+  orgMembershipId: string | null;
+  teamId: string | null;
+  orgWide: boolean;
+  role: MarketplaceAccessRole;
+  createdAt: string;
+  removedAt: string | null;
+};
+
+export type MarketplaceResolvedSource = {
+  connectorAccountId: string;
+  connectorInstanceId: string;
+  accountLogin: string | null;
+  repositoryFullName: string;
+  branch: string | null;
+};
+
+export type MarketplacePluginSummary = {
+  id: string;
+  name: string;
+  description: string | null;
+  memberCount: number;
+  componentCounts: Record<string, number>;
+};
+
+export type MarketplaceResolved = {
+  marketplace: DenMarketplace;
+  plugins: MarketplacePluginSummary[];
+  source: MarketplaceResolvedSource | null;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function parseMarketplace(entry: unknown): DenMarketplace | null {
+  if (!isRecord(entry)) return null;
+  const id = asString(entry.id);
+  const name = asString(entry.name);
+  const createdAt = asString(entry.createdAt);
+  const updatedAt = asString(entry.updatedAt);
+  if (!id || !name || !createdAt || !updatedAt) return null;
+  return {
+    id,
+    name,
+    description: asString(entry.description),
+    pluginCount: typeof entry.pluginCount === "number" ? entry.pluginCount : 0,
+    createdAt,
+    updatedAt,
+  };
+}
+
+export function useMarketplace(marketplaceId: string | null) {
+  return useQuery({
+    enabled: Boolean(marketplaceId),
+    queryKey: marketplaceQueryKeys.resolved(marketplaceId ?? "none"),
+    queryFn: async (): Promise<MarketplaceResolved> => {
+      const { response, payload } = await requestJson(
+        `/v1/marketplaces/${encodeURIComponent(marketplaceId ?? "")}/resolved`,
+        { method: "GET" },
+        15000,
+      );
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load marketplace (${response.status}).`));
+      }
+
+      const item = isRecord(payload) && isRecord(payload.item) ? payload.item : null;
+      const marketplace = item && isRecord(item.marketplace) ? parseMarketplace(item.marketplace) : null;
+      if (!item || !marketplace) {
+        throw new Error("Marketplace resolved response was incomplete.");
+      }
+
+      const plugins = Array.isArray(item.plugins)
+        ? item.plugins.flatMap((entry) => {
+            if (!isRecord(entry)) return [];
+            const id = asString(entry.id);
+            const name = asString(entry.name);
+            if (!id || !name) return [];
+            const componentCounts: Record<string, number> = {};
+            if (isRecord(entry.componentCounts)) {
+              for (const [key, value] of Object.entries(entry.componentCounts)) {
+                if (typeof value === "number" && value > 0) {
+                  componentCounts[key] = value;
+                }
+              }
+            }
+            return [{
+              id,
+              name,
+              description: asString(entry.description),
+              memberCount: typeof entry.memberCount === "number" ? entry.memberCount : 0,
+              componentCounts,
+            } satisfies MarketplacePluginSummary];
+          })
+        : [];
+
+      const sourceRecord = isRecord(item.source) ? item.source : null;
+      const source: MarketplaceResolvedSource | null = sourceRecord
+        ? {
+            connectorAccountId: asString(sourceRecord.connectorAccountId) ?? "",
+            connectorInstanceId: asString(sourceRecord.connectorInstanceId) ?? "",
+            accountLogin: asString(sourceRecord.accountLogin),
+            repositoryFullName: asString(sourceRecord.repositoryFullName) ?? "",
+            branch: asString(sourceRecord.branch),
+          }
+        : null;
+
+      return { marketplace, plugins, source };
+    },
+  });
+}
+
+function parseAccessGrant(entry: unknown): MarketplaceAccessGrant | null {
+  if (!isRecord(entry)) return null;
+  const id = asString(entry.id);
+  const role = asString(entry.role);
+  if (!id || !role) return null;
+  if (role !== "viewer" && role !== "editor" && role !== "manager") return null;
+  return {
+    id,
+    orgMembershipId: asString(entry.orgMembershipId),
+    teamId: asString(entry.teamId),
+    orgWide: Boolean(entry.orgWide),
+    role,
+    createdAt: asString(entry.createdAt) ?? new Date().toISOString(),
+    removedAt: asString(entry.removedAt),
+  };
+}
+
+export function useMarketplaceAccess(marketplaceId: string | null) {
+  return useQuery({
+    enabled: Boolean(marketplaceId),
+    queryKey: marketplaceQueryKeys.access(marketplaceId ?? "none"),
+    queryFn: async (): Promise<MarketplaceAccessGrant[]> => {
+      const { response, payload } = await requestJson(
+        `/v1/marketplaces/${encodeURIComponent(marketplaceId ?? "")}/access`,
+        { method: "GET" },
+        15000,
+      );
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load marketplace access (${response.status}).`));
+      }
+
+      const items = isRecord(payload) && Array.isArray(payload.items) ? payload.items : [];
+      return items
+        .map(parseAccessGrant)
+        .filter((value): value is MarketplaceAccessGrant => Boolean(value) && value?.removedAt === null);
+    },
+  });
+}
+
+export function useGrantMarketplaceAccess() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: {
+      marketplaceId: string;
+      body:
+        | { orgWide: true; role?: MarketplaceAccessRole }
+        | { teamId: string; role?: MarketplaceAccessRole }
+        | { orgMembershipId: string; role?: MarketplaceAccessRole };
+    }) => {
+      const body = {
+        role: input.body.role ?? "viewer",
+        ...("orgWide" in input.body ? { orgWide: true } : {}),
+        ...("teamId" in input.body ? { teamId: input.body.teamId } : {}),
+        ...("orgMembershipId" in input.body ? { orgMembershipId: input.body.orgMembershipId } : {}),
+      };
+      const { response, payload } = await requestJson(
+        `/v1/marketplaces/${encodeURIComponent(input.marketplaceId)}/access`,
+        { method: "POST", body: JSON.stringify(body) },
+        15000,
+      );
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to grant access (${response.status}).`));
+      }
+      return input.marketplaceId;
+    },
+    onSuccess: (marketplaceId) => {
+      queryClient.invalidateQueries({ queryKey: marketplaceQueryKeys.access(marketplaceId) });
+    },
+  });
+}
+
+export function useRevokeMarketplaceAccess() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async (input: { marketplaceId: string; grantId: string }) => {
+      const { response, payload } = await requestJson(
+        `/v1/marketplaces/${encodeURIComponent(input.marketplaceId)}/access/${encodeURIComponent(input.grantId)}`,
+        { method: "DELETE" },
+        15000,
+      );
+      if (response.status !== 204 && !response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to revoke access (${response.status}).`));
+      }
+      return input.marketplaceId;
+    },
+    onSuccess: (marketplaceId) => {
+      queryClient.invalidateQueries({ queryKey: marketplaceQueryKeys.access(marketplaceId) });
+    },
+  });
+}
+
+export function useMarketplaces() {
+  return useQuery({
+    queryKey: marketplaceQueryKeys.list(),
+    queryFn: async () => {
+      const { response, payload } = await requestJson(
+        "/v1/marketplaces?status=active&limit=100",
+        { method: "GET" },
+        15000,
+      );
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load marketplaces (${response.status}).`));
+      }
+
+      const items = isRecord(payload) && Array.isArray(payload.items) ? payload.items : [];
+      return items
+        .map(parseMarketplace)
+        .filter((value): value is DenMarketplace => Boolean(value));
+    },
+  });
+}
+
+export function formatMarketplaceTimestamp(value: string | null): string {
+  if (!value) return "Recently added";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return "Recently added";
+  return new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+  }).format(date);
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-detail-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-detail-screen.tsx
new file mode 100644
index 0000000000..5c4f27aaf1
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplace-detail-screen.tsx
@@ -0,0 +1,568 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useRef, useState, useEffect } from "react";
+import { ArrowLeft, Check, GitBranch, Github, Globe, Loader2, Plus, Puzzle, Store, Users, X } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import {
+  getGithubIntegrationSetupRoute,
+  getMarketplacesRoute,
+  getPluginRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  formatMarketplaceTimestamp,
+  type MarketplacePluginSummary,
+  useGrantMarketplaceAccess,
+  useMarketplace,
+  useMarketplaceAccess,
+  useRevokeMarketplaceAccess,
+} from "./marketplace-data";
+
+const COMPONENT_TYPE_LABELS: Record<string, { singular: string; plural: string }> = {
+  skill: { singular: "skill", plural: "skills" },
+  agent: { singular: "agent", plural: "agents" },
+  command: { singular: "command", plural: "commands" },
+  hook: { singular: "hook", plural: "hooks" },
+  mcp: { singular: "MCP server", plural: "MCP servers" },
+  mcp_server: { singular: "MCP server", plural: "MCP servers" },
+  lsp_server: { singular: "LSP server", plural: "LSP servers" },
+  monitor: { singular: "monitor", plural: "monitors" },
+  settings: { singular: "setting", plural: "settings" },
+};
+
+function componentTypeLabel(type: string, count: number) {
+  const label = COMPONENT_TYPE_LABELS[type] ?? {
+    singular: type.replace(/_/g, " "),
+    plural: `${type.replace(/_/g, " ")}s`,
+  };
+  return count === 1 ? label.singular : label.plural;
+}
+
+export function MarketplaceDetailScreen({ marketplaceId }: { marketplaceId: string }) {
+  const { orgSlug } = useOrgDashboard();
+  const { data, isLoading, error } = useMarketplace(marketplaceId);
+
+  if (isLoading && !data) {
+    return (
+      <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+        <div className="rounded-2xl border border-gray-100 bg-white px-5 py-8 text-[13px] text-gray-400">
+          Loading marketplace…
+        </div>
+      </div>
+    );
+  }
+
+  if (!data) {
+    return (
+      <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+        <div className="rounded-2xl border border-red-100 bg-red-50 px-5 py-3.5 text-[13px] text-red-600">
+          {error instanceof Error ? error.message : "That marketplace could not be found."}
+        </div>
+      </div>
+    );
+  }
+
+  const { marketplace, plugins, source } = data;
+
+  return (
+    <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+      <div className="mb-6 flex items-center justify-between gap-4">
+        <Link
+          href={getMarketplacesRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+      </div>
+
+      <article className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+        <div className="flex items-stretch">
+          <div className="relative w-[96px] shrink-0 overflow-hidden">
+            <div className="absolute inset-0">
+              <PaperMeshGradient seed={marketplace.id} speed={0} />
+            </div>
+            <div className="relative flex h-full items-center justify-center">
+              <div className="flex h-14 w-14 items-center justify-center rounded-[16px] border border-white/60 bg-white shadow-[0_10px_24px_-10px_rgba(15,23,42,0.3)]">
+                <Store className="h-6 w-6 text-gray-700" aria-hidden />
+              </div>
+            </div>
+          </div>
+
+          <div className="min-w-0 flex-1 px-6 py-5">
+            <div className="flex flex-wrap items-center gap-2">
+              <h1 className="truncate text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+                {marketplace.name}
+              </h1>
+              <span className="rounded-full bg-gray-100 px-2 py-0.5 text-[11px] font-medium text-gray-500">
+                {plugins.length} plugin{plugins.length === 1 ? "" : "s"}
+              </span>
+            </div>
+            {marketplace.description ? (
+              <p className="mt-1 text-[13px] leading-[1.55] text-gray-500">{marketplace.description}</p>
+            ) : null}
+            <p className="mt-3 text-[11.5px] text-gray-400">
+              Added {formatMarketplaceTimestamp(marketplace.createdAt)}
+            </p>
+          </div>
+        </div>
+      </article>
+
+      <div className="mt-6 space-y-6">
+        {source ? (
+          <section>
+            <h2 className="mb-3 text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Source
+            </h2>
+            <Link
+              href={getGithubIntegrationSetupRoute(orgSlug, source.connectorInstanceId)}
+              className="group flex items-center gap-4 rounded-2xl border border-gray-100 bg-white px-4 py-3 transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.08)]"
+            >
+              <div className="flex h-9 w-9 shrink-0 items-center justify-center rounded-[10px] bg-gray-50 text-gray-600 group-hover:bg-gray-100 group-hover:text-gray-800">
+                <Github className="h-4 w-4" aria-hidden />
+              </div>
+              <div className="min-w-0 flex-1">
+                <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                  {source.repositoryFullName}
+                </p>
+                <p className="mt-0.5 truncate text-[12.5px] text-gray-500">
+                  {source.accountLogin ? `@${source.accountLogin}` : "GitHub connector"}
+                  {source.branch ? (
+                    <>
+                      <span className="mx-1.5 text-gray-300">·</span>
+                      <GitBranch className="mr-1 inline h-3 w-3 text-gray-400" aria-hidden />
+                      {source.branch}
+                    </>
+                  ) : null}
+                </p>
+              </div>
+            </Link>
+          </section>
+        ) : null}
+
+        <MarketplaceAccessSection marketplaceId={marketplace.id} />
+
+        <section>
+          <div className="mb-3 flex items-baseline justify-between gap-3">
+            <h2 className="text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Plugins
+            </h2>
+            <p className="text-[11px] text-gray-400">
+              {plugins.length} plugin{plugins.length === 1 ? "" : "s"}
+            </p>
+          </div>
+
+          {plugins.length === 0 ? (
+            <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-5 py-10 text-center">
+              <p className="text-[14px] font-medium tracking-[-0.02em] text-gray-800">
+                No plugins in this marketplace yet
+              </p>
+              <p className="mx-auto mt-2 max-w-[420px] text-[13px] leading-6 text-gray-500">
+                Plugins appear here as they're imported from the source repository.
+              </p>
+            </div>
+          ) : (
+            <div className="grid gap-3 md:grid-cols-2">
+              {plugins.map((plugin) => (
+                <MarketplacePluginCard key={plugin.id} orgSlug={orgSlug} plugin={plugin} />
+              ))}
+            </div>
+          )}
+        </section>
+      </div>
+    </div>
+  );
+}
+
+function MarketplaceAccessSection({ marketplaceId }: { marketplaceId: string }) {
+  const { orgContext } = useOrgDashboard();
+  const accessQuery = useMarketplaceAccess(marketplaceId);
+  const grantMutation = useGrantMarketplaceAccess();
+  const revokeMutation = useRevokeMarketplaceAccess();
+
+  const grants = accessQuery.data ?? [];
+  const orgWideGrant = grants.find((grant) => grant.orgWide) ?? null;
+  const teamGrants = grants.filter((grant) => Boolean(grant.teamId));
+  const memberGrants = grants.filter((grant) => Boolean(grant.orgMembershipId));
+
+  const teamsById = useMemo(
+    () => new Map((orgContext?.teams ?? []).map((team) => [team.id, team])),
+    [orgContext?.teams],
+  );
+  const membersById = useMemo(
+    () => new Map((orgContext?.members ?? []).map((member) => [member.id, member])),
+    [orgContext?.members],
+  );
+
+  const teamsAvailable = (orgContext?.teams ?? []).filter(
+    (team) => !teamGrants.some((grant) => grant.teamId === team.id),
+  );
+  const membersAvailable = (orgContext?.members ?? []).filter(
+    (member) => !memberGrants.some((grant) => grant.orgMembershipId === member.id),
+  );
+
+  async function handleToggleOrgWide() {
+    if (orgWideGrant) {
+      await revokeMutation.mutateAsync({ marketplaceId, grantId: orgWideGrant.id });
+    } else {
+      await grantMutation.mutateAsync({
+        marketplaceId,
+        body: { orgWide: true, role: "viewer" },
+      });
+    }
+  }
+
+  async function handleAddTeam(teamId: string) {
+    await grantMutation.mutateAsync({
+      marketplaceId,
+      body: { teamId, role: "viewer" },
+    });
+  }
+
+  async function handleAddMember(memberId: string) {
+    await grantMutation.mutateAsync({
+      marketplaceId,
+      body: { orgMembershipId: memberId, role: "viewer" },
+    });
+  }
+
+  async function handleRevoke(grantId: string) {
+    await revokeMutation.mutateAsync({ marketplaceId, grantId });
+  }
+
+  const busy = accessQuery.isLoading || grantMutation.isPending || revokeMutation.isPending;
+
+  return (
+    <section>
+      <div className="mb-3 flex items-baseline justify-between gap-3">
+        <h2 className="text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+          Who can access this
+        </h2>
+        {busy ? <Loader2 className="h-3.5 w-3.5 animate-spin text-gray-400" aria-hidden /> : null}
+      </div>
+
+      <div className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+        <button
+          type="button"
+          onClick={() => void handleToggleOrgWide()}
+          disabled={grantMutation.isPending || revokeMutation.isPending}
+          className="flex w-full items-center gap-4 px-5 py-4 text-left transition hover:bg-gray-50/60 disabled:opacity-60"
+        >
+          <div className={`flex h-9 w-9 shrink-0 items-center justify-center rounded-[10px] ${orgWideGrant ? "bg-emerald-50 text-emerald-600" : "bg-gray-50 text-gray-500"}`}>
+            <Globe className="h-4 w-4" aria-hidden />
+          </div>
+          <div className="min-w-0 flex-1">
+            <p className="text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+              Everyone in {orgContext?.organization.name ?? "this organization"}
+            </p>
+            <p className="mt-0.5 text-[12.5px] leading-[1.55] text-gray-500">
+              {orgWideGrant
+                ? "All org members can see this marketplace."
+                : "Only admins and people you add below can see this marketplace."}
+            </p>
+          </div>
+          <div
+            role="switch"
+            aria-checked={Boolean(orgWideGrant)}
+            className={`relative inline-flex h-6 w-[42px] shrink-0 items-center rounded-full transition-colors ${
+              orgWideGrant ? "bg-[#0f172a]" : "bg-gray-200"
+            }`}
+          >
+            <span
+              className={`inline-block h-5 w-5 transform rounded-full bg-white shadow-[0_2px_6px_-1px_rgba(15,23,42,0.3)] transition-transform ${
+                orgWideGrant ? "translate-x-[18px]" : "translate-x-0.5"
+              }`}
+            />
+          </div>
+        </button>
+
+        <AccessRowGroup
+          label="Teams"
+          icon={Users}
+          emptyLabel="No team access yet"
+          items={teamGrants.map((grant) => {
+            const team = grant.teamId ? teamsById.get(grant.teamId) : null;
+            return {
+              grantId: grant.id,
+              title: team?.name ?? "Removed team",
+              subtitle: team ? `${team.memberIds.length} member${team.memberIds.length === 1 ? "" : "s"}` : null,
+            };
+          })}
+          availableOptions={teamsAvailable.map((team) => ({
+            id: team.id,
+            label: team.name,
+            subtitle: `${team.memberIds.length} member${team.memberIds.length === 1 ? "" : "s"}`,
+          }))}
+          availableEmptyLabel="All teams already have access"
+          onAdd={(id) => void handleAddTeam(id)}
+          onRemove={(id) => void handleRevoke(id)}
+          disabled={grantMutation.isPending || revokeMutation.isPending}
+        />
+
+        <AccessRowGroup
+          label="People"
+          icon={Users}
+          emptyLabel="No individual access yet"
+          items={memberGrants.map((grant) => {
+            const member = grant.orgMembershipId ? membersById.get(grant.orgMembershipId) : null;
+            return {
+              grantId: grant.id,
+              title: member?.user.name ?? "Removed member",
+              subtitle: member?.user.email ?? null,
+            };
+          })}
+          availableOptions={membersAvailable.map((member) => ({
+            id: member.id,
+            label: member.user.name,
+            subtitle: member.user.email,
+          }))}
+          availableEmptyLabel="Everyone already has access"
+          onAdd={(id) => void handleAddMember(id)}
+          onRemove={(id) => void handleRevoke(id)}
+          disabled={grantMutation.isPending || revokeMutation.isPending}
+        />
+      </div>
+
+      {accessQuery.error ? (
+        <p className="mt-2 text-[12px] text-red-600">
+          {accessQuery.error instanceof Error ? accessQuery.error.message : "Failed to load access."}
+        </p>
+      ) : null}
+      {grantMutation.error ? (
+        <p className="mt-2 text-[12px] text-red-600">
+          {grantMutation.error instanceof Error ? grantMutation.error.message : "Failed to grant access."}
+        </p>
+      ) : null}
+      {revokeMutation.error ? (
+        <p className="mt-2 text-[12px] text-red-600">
+          {revokeMutation.error instanceof Error ? revokeMutation.error.message : "Failed to revoke access."}
+        </p>
+      ) : null}
+    </section>
+  );
+}
+
+function AccessRowGroup({
+  label,
+  icon: Icon,
+  emptyLabel,
+  items,
+  availableOptions,
+  availableEmptyLabel,
+  onAdd,
+  onRemove,
+  disabled,
+}: {
+  label: string;
+  icon: React.ComponentType<{ className?: string }>;
+  emptyLabel: string;
+  items: Array<{ grantId: string; title: string; subtitle: string | null }>;
+  availableOptions: Array<{ id: string; label: string; subtitle: string }>;
+  availableEmptyLabel: string;
+  onAdd: (id: string) => void;
+  onRemove: (grantId: string) => void;
+  disabled: boolean;
+}) {
+  return (
+    <div className="border-t border-gray-100 px-5 py-4">
+      <div className="mb-2 flex items-center gap-2">
+        <Icon className="h-3.5 w-3.5 text-gray-400" aria-hidden />
+        <p className="text-[11px] font-semibold uppercase tracking-[0.14em] text-gray-400">{label}</p>
+      </div>
+
+      {items.length === 0 ? (
+        <p className="text-[12.5px] text-gray-400">{emptyLabel}</p>
+      ) : (
+        <div className="flex flex-wrap gap-1.5">
+          {items.map((entry) => (
+            <span
+              key={entry.grantId}
+              className="group inline-flex items-center gap-1.5 rounded-full bg-gray-50 py-1 pl-3 pr-1 text-[12px] text-gray-700"
+            >
+              <span className="truncate max-w-[180px]">{entry.title}</span>
+              {entry.subtitle ? (
+                <span className="truncate max-w-[140px] text-gray-400">· {entry.subtitle}</span>
+              ) : null}
+              <button
+                type="button"
+                aria-label={`Remove ${entry.title}`}
+                disabled={disabled}
+                onClick={() => onRemove(entry.grantId)}
+                className="inline-flex h-5 w-5 items-center justify-center rounded-full text-gray-400 transition hover:bg-gray-200 hover:text-gray-900 disabled:cursor-not-allowed disabled:opacity-50"
+              >
+                <X className="h-3 w-3" aria-hidden />
+              </button>
+            </span>
+          ))}
+        </div>
+      )}
+
+      <AccessAddPicker
+        label={label}
+        options={availableOptions}
+        emptyLabel={availableEmptyLabel}
+        disabled={disabled}
+        onAdd={onAdd}
+      />
+    </div>
+  );
+}
+
+function AccessAddPicker({
+  label,
+  options,
+  emptyLabel,
+  disabled,
+  onAdd,
+}: {
+  label: string;
+  options: Array<{ id: string; label: string; subtitle: string }>;
+  emptyLabel: string;
+  disabled: boolean;
+  onAdd: (id: string) => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [query, setQuery] = useState("");
+  const ref = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    function handle(event: MouseEvent) {
+      if (ref.current && !ref.current.contains(event.target as Node)) {
+        setOpen(false);
+      }
+    }
+    document.addEventListener("mousedown", handle);
+    return () => document.removeEventListener("mousedown", handle);
+  }, [open]);
+
+  const filtered = useMemo(() => {
+    const normalized = query.trim().toLowerCase();
+    if (!normalized) return options;
+    return options.filter(
+      (option) =>
+        option.label.toLowerCase().includes(normalized) ||
+        option.subtitle.toLowerCase().includes(normalized),
+    );
+  }, [options, query]);
+
+  if (options.length === 0) {
+    return (
+      <p className="mt-2 text-[11.5px] text-gray-400">{emptyLabel}</p>
+    );
+  }
+
+  return (
+    <div ref={ref} className="relative mt-2 inline-block">
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() => setOpen((value) => !value)}
+        className="inline-flex items-center gap-1 rounded-full border border-dashed border-gray-200 px-2.5 py-1 text-[11.5px] text-gray-500 transition hover:border-gray-400 hover:text-gray-900 disabled:cursor-not-allowed disabled:opacity-50"
+      >
+        <Plus className="h-3 w-3" aria-hidden />
+        Add {label.toLowerCase().replace(/s$/, "")}
+      </button>
+
+      {open ? (
+        <div className="absolute left-0 top-[calc(100%+4px)] z-10 w-[260px] overflow-hidden rounded-2xl border border-gray-100 bg-white shadow-[0_20px_40px_-16px_rgba(15,23,42,0.18)]">
+          <div className="border-b border-gray-100 px-3 py-2">
+            <input
+              type="search"
+              value={query}
+              onChange={(event) => setQuery(event.target.value)}
+              placeholder={`Search ${label.toLowerCase()}...`}
+              className="w-full bg-transparent text-[12.5px] text-gray-900 placeholder:text-gray-400 focus:outline-none"
+              autoFocus
+            />
+          </div>
+          <div className="max-h-[240px] overflow-y-auto py-1">
+            {filtered.length === 0 ? (
+              <p className="px-3 py-3 text-[12px] text-gray-400">No matches</p>
+            ) : (
+              filtered.map((option) => (
+                <button
+                  key={option.id}
+                  type="button"
+                  onClick={() => {
+                    onAdd(option.id);
+                    setOpen(false);
+                    setQuery("");
+                  }}
+                  className="flex w-full items-center gap-2 px-3 py-2 text-left transition hover:bg-gray-50"
+                >
+                  <div className="min-w-0 flex-1">
+                    <p className="truncate text-[12.5px] font-medium text-gray-900">{option.label}</p>
+                    <p className="truncate text-[11px] text-gray-500">{option.subtitle}</p>
+                  </div>
+                  <Check className="h-3.5 w-3.5 shrink-0 text-transparent" aria-hidden />
+                </button>
+              ))
+            )}
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function MarketplacePluginCard({
+  orgSlug,
+  plugin,
+}: {
+  orgSlug: string | null;
+  plugin: MarketplacePluginSummary;
+}) {
+  const orderedCountEntries = Object.entries(plugin.componentCounts)
+    .filter(([, count]) => count > 0)
+    .sort((a, b) => b[1] - a[1]);
+
+  return (
+    <Link
+      href={getPluginRoute(orgSlug, plugin.id)}
+      className="group block overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]"
+    >
+      <div className="flex items-stretch">
+        <div className="relative w-[64px] shrink-0 overflow-hidden">
+          <div className="absolute inset-0">
+            <PaperMeshGradient seed={plugin.id} speed={0} />
+          </div>
+          <div className="relative flex h-full items-center justify-center">
+            <div className="flex h-9 w-9 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+              <Puzzle className="h-4 w-4 text-gray-700" aria-hidden />
+            </div>
+          </div>
+        </div>
+        <div className="min-w-0 flex-1 px-4 py-3">
+          <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+            {plugin.name}
+          </p>
+          {plugin.description ? (
+            <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">
+              {plugin.description}
+            </p>
+          ) : null}
+
+          {orderedCountEntries.length > 0 ? (
+            <div className="mt-2.5 flex flex-wrap gap-1.5 border-t border-gray-50 pt-2.5">
+              {orderedCountEntries.map(([type, count]) => (
+                <span
+                  key={type}
+                  className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2 py-0.5 text-[11.5px] text-gray-600"
+                >
+                  <span className="font-semibold text-gray-900">{count}</span>
+                  <span className="text-gray-500">{componentTypeLabel(type, count)}</span>
+                </span>
+              ))}
+            </div>
+          ) : (
+            <p className="mt-2 text-[11.5px] text-gray-400">
+              {plugin.memberCount} imported object{plugin.memberCount === 1 ? "" : "s"}
+            </p>
+          )}
+        </div>
+      </div>
+    </Link>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplaces-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplaces-screen.tsx
new file mode 100644
index 0000000000..508d0afa4f
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/marketplaces-screen.tsx
@@ -0,0 +1,154 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+import { Cable, Search, Store } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenInput } from "../../../../_components/ui/input";
+import { buttonVariants } from "../../../../_components/ui/button";
+import { getIntegrationsRoute, getMarketplaceRoute } from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import { useHasAnyIntegration } from "./integration-data";
+import { formatMarketplaceTimestamp, useMarketplaces } from "./marketplace-data";
+
+export function MarketplacesScreen() {
+  const { orgSlug } = useOrgDashboard();
+  const { data: marketplaces = [], isLoading, error } = useMarketplaces();
+  const { hasAny: hasAnyIntegration, isLoading: integrationsLoading } = useHasAnyIntegration();
+  const [query, setQuery] = useState("");
+
+  const normalizedQuery = query.trim().toLowerCase();
+  const filtered = useMemo(() => {
+    if (!normalizedQuery) return marketplaces;
+    return marketplaces.filter((marketplace) =>
+      `${marketplace.name}\n${marketplace.description ?? ""}`.toLowerCase().includes(normalizedQuery),
+    );
+  }, [marketplaces, normalizedQuery]);
+
+  return (
+    <DashboardPageTemplate
+      icon={Store}
+      badgeLabel="Preview"
+      title="Marketplaces"
+      description="Marketplaces group plugins imported from a Claude marketplace repository."
+      colors={["#FEF3C7", "#92400E", "#F59E0B", "#FDE68A"]}
+    >
+      <div className="mb-6">
+        <DenInput
+          type="search"
+          icon={Search}
+          value={query}
+          onChange={(event) => setQuery(event.target.value)}
+          placeholder="Search marketplaces..."
+        />
+      </div>
+
+      {error ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {error instanceof Error ? error.message : "Failed to load marketplaces."}
+        </div>
+      ) : null}
+
+      {isLoading || integrationsLoading ? (
+        <div className="rounded-2xl border border-gray-100 bg-white px-6 py-10 text-[14px] text-gray-500">
+          Loading marketplaces…
+        </div>
+      ) : !hasAnyIntegration && marketplaces.length === 0 ? (
+        <ConnectIntegrationEmptyState integrationsHref={getIntegrationsRoute(orgSlug)} />
+      ) : filtered.length === 0 ? (
+        <EmptyState
+          title={marketplaces.length === 0 ? "No marketplaces yet" : "No marketplaces match that search"}
+          description={
+            marketplaces.length === 0
+              ? "Imported marketplaces and connected integration marketplaces will show up here when they are available."
+              : "Try a different search term or open the plugins tab."
+          }
+          action={
+            marketplaces.length === 0
+              ? { href: getIntegrationsRoute(orgSlug), label: "Open Integrations", icon: Cable }
+              : undefined
+          }
+        />
+      ) : (
+        <div className="grid gap-3 md:grid-cols-2">
+          {filtered.map((marketplace) => (
+            <Link
+              key={marketplace.id}
+              href={getMarketplaceRoute(orgSlug, marketplace.id)}
+              className="group block overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]"
+            >
+              <div className="flex items-stretch">
+                <div className="relative w-[68px] shrink-0 overflow-hidden">
+                  <div className="absolute inset-0">
+                    <PaperMeshGradient seed={marketplace.id} speed={0} />
+                  </div>
+                  <div className="relative flex h-full items-center justify-center">
+                    <div className="flex h-10 w-10 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+                      <Store className="h-4 w-4 text-gray-700" aria-hidden />
+                    </div>
+                  </div>
+                </div>
+
+                <div className="min-w-0 flex-1 px-5 py-4">
+                  <div className="flex items-start justify-between gap-3">
+                    <h2 className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                      {marketplace.name}
+                    </h2>
+                    <span className="shrink-0 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-500">
+                      {marketplace.pluginCount} plugin{marketplace.pluginCount === 1 ? "" : "s"}
+                    </span>
+                  </div>
+                  {marketplace.description ? (
+                    <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">
+                      {marketplace.description}
+                    </p>
+                  ) : null}
+                  <p className="mt-3 text-[11.5px] text-gray-400">
+                    Added {formatMarketplaceTimestamp(marketplace.createdAt)}
+                  </p>
+                </div>
+              </div>
+            </Link>
+          ))}
+        </div>
+      )}
+    </DashboardPageTemplate>
+  );
+}
+
+function EmptyState({
+  title,
+  description,
+  action,
+}: {
+  title: string;
+  description: string;
+  action?: { href: string; label: string; icon: React.ComponentType<{ className?: string }> };
+}) {
+  const ActionIcon = action?.icon;
+  return (
+    <div className="rounded-2xl border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+      <p className="text-[15px] font-semibold tracking-[-0.02em] text-gray-900">{title}</p>
+      <p className="mx-auto mt-2 max-w-[520px] text-[13px] leading-6 text-gray-500">{description}</p>
+      {action ? (
+        <div className="mt-5 flex justify-center">
+          <Link href={action.href} className={buttonVariants({ variant: "primary", size: "sm" })}>
+            {ActionIcon ? <ActionIcon className="h-4 w-4" aria-hidden="true" /> : null}
+            {action.label}
+          </Link>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+function ConnectIntegrationEmptyState({ integrationsHref }: { integrationsHref: string }) {
+  return (
+    <EmptyState
+      title="Connect an integration to discover marketplaces"
+      description="Marketplaces are created when OpenWork finds a `.claude-plugin/marketplace.json` manifest in a connected repository."
+      action={{ href: integrationsHref, label: "Open Integrations", icon: Cable }}
+    />
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-dashboard-shell.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-dashboard-shell.tsx
new file mode 100644
index 0000000000..b33004e18f
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-dashboard-shell.tsx
@@ -0,0 +1,423 @@
+"use client";
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+import { useMemo, useState } from "react";
+import {
+  BookOpen,
+  Bot,
+  Cable,
+  CreditCard,
+  Cpu,
+  FileText,
+  Home,
+  KeyRound,
+  LogOut,
+  MessageSquare,
+  Puzzle,
+  SlidersHorizontal,
+  Store,
+  Users,
+} from "lucide-react";
+import { useDenFlow } from "../../../../_providers/den-flow-provider";
+import {
+  formatRoleLabel,
+  getBackgroundAgentsRoute,
+  getApiKeysRoute,
+  getBillingRoute,
+  getCustomLlmProvidersRoute,
+  getOrgAccessFlags,
+  getIntegrationsRoute,
+  getMembersRoute,
+  getOrgDashboardRoute,
+  getOrgSettingsRoute,
+  getMarketplacesRoute,
+  getPluginsRoute,
+  getSkillHubsRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import { buildDenFeedbackUrl } from "../../../../_lib/feedback";
+
+const OPENWORK_DOCS_URL = "https://openworklabs.com/docs";
+
+function OrgMark({ name }: { name: string }) {
+  const initials = useMemo(() => {
+    const parts = name.trim().split(/\s+/).filter(Boolean);
+    return (parts[0]?.slice(0, 1) ?? "O") + (parts[1]?.slice(0, 1) ?? "");
+  }, [name]);
+
+  return (
+    <div className="flex h-10 w-10 items-center justify-center rounded-full bg-[#011627] text-xs font-semibold uppercase tracking-[0.08em] text-white">
+      {initials}
+    </div>
+  );
+}
+
+function OpenWorkMark({ className = "h-9 w-auto" }: { className?: string }) {
+  return (
+    <svg
+      xmlns="http://www.w3.org/2000/svg"
+      viewBox="0 0 834 649"
+      fill="none"
+      className={className}
+      aria-label="OpenWork"
+    >
+      <path
+        fill="#011627"
+        d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z"
+      />
+      <path
+        fill="#FFFFFF"
+        d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z"
+      />
+      <path
+        fill="#011627"
+        d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z"
+      />
+      <path
+        fill="#FFFFFF"
+        d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z"
+      />
+      <path
+        fill="#FFFFFF"
+        d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z"
+      />
+      <path
+        fill="#FFFFFF"
+        d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z"
+      />
+    </svg>
+  );
+}
+
+function getDashboardPageTitle(pathname: string, orgSlug: string | null) {
+  if (!orgSlug) {
+    return "Home";
+  }
+
+  const dashboardRoot = getOrgDashboardRoute(orgSlug);
+
+  if (pathname === dashboardRoot) {
+    return "Home";
+  }
+  if (pathname.startsWith(getMembersRoute(orgSlug))) {
+    return "Members";
+  }
+  if (pathname.startsWith(getApiKeysRoute(orgSlug))) {
+    return "API Keys";
+  }
+  if (pathname.startsWith(getBackgroundAgentsRoute(orgSlug))) {
+    return "Shared Workspaces";
+  }
+  if (pathname.startsWith(getCustomLlmProvidersRoute(orgSlug))) {
+    return "LLM Providers";
+  }
+  if (pathname.startsWith(getSkillHubsRoute(orgSlug))) {
+    return "Skill Hubs";
+  }
+  if (pathname.startsWith(getPluginsRoute(orgSlug))) {
+    return "Plugins";
+  }
+  if (pathname.startsWith(getMarketplacesRoute(orgSlug))) {
+    return "Marketplaces";
+  }
+  if (pathname.startsWith(getIntegrationsRoute(orgSlug))) {
+    return "Integrations";
+  }
+  if (pathname.startsWith(getBillingRoute(orgSlug)) || pathname === "/checkout") {
+    return "Billing";
+  }
+  if (pathname.startsWith(getOrgSettingsRoute(orgSlug))) {
+    return "Org Settings";
+  }
+
+  return "Home";
+}
+
+export function OrgDashboardShell({ children }: { children: React.ReactNode }) {
+  const pathname = usePathname();
+  const { user, signOut } = useDenFlow();
+  const {
+    activeOrg,
+    orgDirectory,
+    orgContext,
+    orgBusy,
+    orgError,
+    switchOrganization,
+  } = useOrgDashboard();
+  const [switcherOpen, setSwitcherOpen] = useState(false);
+
+  const access = getOrgAccessFlags(
+    orgContext?.currentMember.role ?? "member",
+    orgContext?.currentMember.isOwner ?? false,
+  );
+
+  const pageTitle = getDashboardPageTitle(pathname, activeOrg?.slug ?? null);
+  const feedbackHref = buildDenFeedbackUrl({
+    pathname,
+    orgSlug: activeOrg?.slug,
+  });
+
+  const navItems = [
+    {
+      href: activeOrg ? getOrgDashboardRoute(activeOrg.slug) : "#",
+      label: "Dashboard",
+      icon: Home,
+    },
+    {
+      href: activeOrg ? getBackgroundAgentsRoute(activeOrg.slug) : "#",
+      label: "Shared Workspace",
+      icon: Bot,
+      badge: "Alpha",
+    },
+    {
+      href: activeOrg ? getCustomLlmProvidersRoute(activeOrg.slug) : "#",
+      label: "LLM Providers",
+      icon: Cpu,
+    },
+    {
+      href: activeOrg ? getSkillHubsRoute(activeOrg.slug) : "#",
+      label: "Skill Hubs",
+      icon: BookOpen,
+    },
+    {
+      href: activeOrg ? getIntegrationsRoute(activeOrg.slug) : "#",
+      label: "Integrations",
+      icon: Cable,
+      badge: "New",
+    },
+    {
+      href: activeOrg ? getMarketplacesRoute(activeOrg.slug) : "#",
+      label: "Marketplaces",
+      icon: Store,
+      badge: "New",
+    },
+    {
+      href: activeOrg ? getPluginsRoute(activeOrg.slug) : "#",
+      label: "Plugins",
+      icon: Puzzle,
+      badge: "New",
+    },
+    {
+      href: activeOrg ? getMembersRoute(activeOrg.slug) : "#",
+      label: "Members",
+      icon: Users,
+    },
+    ...(access.canManageApiKeys
+      ? [{
+          href: activeOrg ? getApiKeysRoute(activeOrg.slug) : "#",
+          label: "API Keys",
+          icon: KeyRound,
+        }]
+      : []),
+    {
+      href: activeOrg ? getBillingRoute(activeOrg.slug) : "/checkout",
+      label: "Billing",
+      icon: CreditCard,
+    },
+    {
+      href: activeOrg ? getOrgSettingsRoute(activeOrg.slug) : "#",
+      label: "Org Settings",
+      icon: SlidersHorizontal,
+    },
+  ];
+
+  const orgSwitcher = (
+    <div className="relative">
+      <button
+        type="button"
+        className="flex w-full items-center justify-between gap-3 rounded-xl px-2 py-2 text-left transition-colors hover:bg-gray-100"
+        onClick={() => setSwitcherOpen((current) => !current)}
+      >
+        <div className="flex min-w-0 items-center gap-3">
+          <OrgMark name={activeOrg?.name ?? "OpenWork"} />
+          <div className="min-w-0">
+            <p className="truncate text-[14px] font-medium text-gray-900">
+              {activeOrg?.name ?? "Loading..."}
+            </p>
+            <p className="truncate text-[12px] text-gray-500">
+              {activeOrg ? formatRoleLabel(activeOrg.role) : "Preparing workspace"}
+            </p>
+          </div>
+        </div>
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="text-gray-400 shrink-0">
+          <path d="M17 3l4 4-4 4"/>
+          <path d="M3 7h18"/>
+          <path d="M7 21l-4-4 4-4"/>
+          <path d="M21 17H3"/>
+        </svg>
+      </button>
+
+      {switcherOpen ? (
+        <div className="absolute bottom-[calc(100%+0.5rem)] left-0 w-[240px] z-30 grid gap-1 rounded-2xl border border-gray-200 bg-white py-2 shadow-[0_12px_24px_-12px_rgba(0,0,0,0.15)]">
+          <div className="px-3 py-1.5">
+            <p className="truncate text-[13px] font-medium text-gray-900">
+              {user?.email ?? "OpenWork user"}
+            </p>
+          </div>
+          
+          <div className="mx-2 h-px bg-gray-100 my-1" />
+
+          <div className="px-3 pb-1 pt-1">
+            <p className="text-[11px] font-medium text-gray-500">
+              Switch workspace
+            </p>
+          </div>
+          
+          <div className="grid gap-0.5 px-1.5">
+            {orgDirectory.map((org) => (
+              <button
+                key={org.id}
+                type="button"
+                onClick={() => {
+                  setSwitcherOpen(false);
+                  switchOrganization(org.slug);
+                }}
+                className={`flex items-center justify-between gap-3 rounded-lg px-2 py-1.5 text-left transition-colors ${
+                  org.isActive
+                    ? "bg-gray-50 text-gray-900"
+                    : "text-gray-600 hover:bg-gray-50 hover:text-gray-900"
+                }`}
+              >
+                <div className="flex min-w-0 items-center gap-2.5">
+                  <div className="min-w-0">
+                    <span className="block truncate text-[13px] font-medium tracking-[-0.1px]">{org.name}</span>
+                    <span className="block truncate text-[12px] text-gray-500">
+                      {org.role === "owner" ? "Creator plan" : "Free plan"} • 1 member
+                    </span>
+                  </div>
+                </div>
+                {org.isActive ? (
+                  <svg className="h-4 w-4 shrink-0 text-gray-900" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
+                    <polyline points="20 6 9 17 4 12" />
+                  </svg>
+                ) : null}
+              </button>
+            ))}
+          </div>
+
+          <div className="px-1.5 mt-0.5">
+            <Link
+              href="/organization"
+              className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-[13px] font-medium text-gray-600 transition-colors hover:bg-gray-50 hover:text-gray-900"
+              onClick={() => setSwitcherOpen(false)}
+            >
+              <span className="text-gray-400 text-[16px] leading-none">+</span> Create or join workspace
+            </Link>
+          </div>
+
+          <div className="mx-2 h-px bg-gray-100 my-1" />
+
+          <div className="px-1.5">
+            <button
+              type="button"
+              onClick={() => void signOut()}
+              className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-[13px] font-medium text-gray-600 transition-colors hover:bg-gray-50 hover:text-gray-900"
+            >
+              <LogOut className="h-4 w-4 text-gray-400" />
+              Sign out
+            </button>
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+
+  return (
+    <div className="flex min-h-screen flex-col bg-[#fafafa] md:flex-row">
+      <aside className="w-full shrink-0 border-b border-gray-100 bg-white md:flex md:min-h-screen md:w-[260px] md:flex-col md:border-b-0 md:border-r">
+        <div className="flex flex-1 flex-col">
+          <div className="border-b border-gray-100 px-4 pb-4 pt-5">
+            <div className="flex items-center justify-between gap-3">
+              <OpenWorkMark />
+              {orgBusy ? <span className="text-xs text-gray-400">Refreshing...</span> : null}
+            </div>
+          </div>
+
+          <nav className="flex-1 px-3 py-5">
+            <p className="px-3 pb-2 text-[10px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Navigation
+            </p>
+            <div className="space-y-1">
+              {navItems.map((item) => {
+                const isDashboardRoot =
+                  activeOrg && item.href === getOrgDashboardRoute(activeOrg.slug);
+                const selected =
+                  item.href !== "#" &&
+                  (isDashboardRoot
+                    ? pathname === item.href
+                    : pathname === item.href || pathname.startsWith(`${item.href}/`));
+
+                return (
+                  <Link
+                    key={item.label}
+                    href={item.href}
+                    className={`flex items-center justify-between gap-3 rounded-xl px-3 py-2.5 text-[13px] tracking-[-0.1px] transition-colors ${
+                      selected
+                        ? "bg-gray-100 text-gray-900"
+                        : "text-gray-500 hover:bg-gray-50 hover:text-gray-700"
+                    }`}
+                  >
+                    <span className="flex items-center gap-3">
+                      <item.icon className="h-4 w-4" strokeWidth={1.8} />
+                      {item.label}
+                    </span>
+                    {item.badge ? (
+                      <span className="rounded-full bg-white px-2 py-1 text-[9px] font-semibold uppercase tracking-[0.14em] text-gray-500">
+                        {item.badge}
+                      </span>
+                    ) : null}
+                  </Link>
+                );
+              })}
+            </div>
+          </nav>
+
+          <div className="mt-auto p-3">
+            {orgSwitcher}
+
+            {orgBusy ? (
+              <p className="mt-3 px-2 text-[11px] text-gray-400">Refreshing workspace…</p>
+            ) : null}
+            {orgError ? (
+              <p className="mt-3 px-2 text-[11px] font-medium text-rose-600">{orgError}</p>
+            ) : null}
+          </div>
+        </div>
+      </aside>
+
+      <div className="flex min-w-0 flex-1 flex-col">
+        <header className="flex h-14 shrink-0 items-center justify-between border-b border-gray-100 bg-white px-5 md:px-6">
+          <div className="flex items-center gap-2">
+            <span className="text-[14px] tracking-[-0.1px] text-gray-900">
+              {pageTitle}
+            </span>
+          </div>
+
+          <div className="flex items-center gap-1">
+            <a
+              href={feedbackHref}
+              target="_blank"
+              rel="noreferrer"
+              className="flex items-center gap-1.5 rounded-lg px-3 py-1.5 text-[13px] text-gray-500 transition-colors hover:bg-gray-50 hover:text-gray-700"
+            >
+              <MessageSquare className="h-4 w-4" />
+              Feedback
+            </a>
+            <a
+              href={OPENWORK_DOCS_URL}
+              target="_blank"
+              rel="noreferrer"
+              className="flex items-center gap-1.5 rounded-lg px-3 py-1.5 text-[13px] text-gray-500 transition-colors hover:bg-gray-50 hover:text-gray-700"
+            >
+              <FileText className="h-4 w-4" />
+              Docs
+            </a>
+          </div>
+        </header>
+
+        <main className="flex-1 overflow-y-auto bg-[#fafafa]">{children}</main>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-settings-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-settings-screen.tsx
new file mode 100644
index 0000000000..780dcf99aa
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/org-settings-screen.tsx
@@ -0,0 +1,739 @@
+"use client";
+
+import { Check, Copy, Pencil, SlidersHorizontal } from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import { getAllowedDesktopVersionsFromMetadata } from "../../../../_lib/den-org";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenCard } from "../../../../_components/ui/card";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenTextarea } from "../../../../_components/ui/textarea";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+
+function normalizeAllowedEmailDomainsInput(value: string): string[] | null {
+  const domains = [
+    ...new Set(
+      value
+        .split(/[\s,]+/)
+        .map((entry) => entry.trim().toLowerCase().replace(/^@+/, ""))
+        .filter(Boolean),
+    ),
+  ];
+
+  return domains.length > 0 ? domains : null;
+}
+
+function normalizeDesktopVersionString(value: string): string | null {
+  const normalized = value.trim().replace(/^v/i, "");
+  return /^\d+\.\d+\.\d+$/.test(normalized) ? normalized : null;
+}
+
+function getDesktopVersionMetadata(payload: unknown): {
+  minAppVersion: string;
+  latestAppVersion: string;
+} | null {
+  if (!payload || typeof payload !== "object") {
+    return null;
+  }
+
+  const record = payload as Record<string, unknown>;
+
+  const minAppVersion =
+    typeof record.minAppVersion === "string"
+      ? normalizeDesktopVersionString(record.minAppVersion)
+      : null;
+  const latestAppVersion =
+    typeof record.latestAppVersion === "string"
+      ? normalizeDesktopVersionString(record.latestAppVersion)
+      : null;
+
+  if (!minAppVersion || !latestAppVersion) {
+    return null;
+  }
+
+  return { minAppVersion, latestAppVersion };
+}
+
+function buildDesktopVersionOptions(
+  minVersion: string,
+  maxVersion: string,
+): string[] {
+  const minMatch = minVersion.match(/^(\d+)\.(\d+)\.(\d+)$/);
+  const maxMatch = maxVersion.match(/^(\d+)\.(\d+)\.(\d+)$/);
+  if (!minMatch || !maxMatch) {
+    return [...new Set([minVersion, maxVersion])];
+  }
+
+  const minMajor = Number(minMatch[1]);
+  const minMinor = Number(minMatch[2]);
+  const minPatch = Number(minMatch[3]);
+  const maxMajor = Number(maxMatch[1]);
+  const maxMinor = Number(maxMatch[2]);
+  const maxPatch = Number(maxMatch[3]);
+
+  if (minMajor !== maxMajor || minMinor !== maxMinor || minPatch > maxPatch) {
+    return [...new Set([minVersion, maxVersion])];
+  }
+
+  return Array.from(
+    { length: maxPatch - minPatch + 1 },
+    (_, index) => `${minMajor}.${minMinor}.${minPatch + index}`,
+  );
+}
+
+function toggleAllowedDesktopVersion(
+  current: string[],
+  version: string,
+  checked: boolean,
+) {
+  if (checked) {
+    return current.includes(version) ? current : [...current, version];
+  }
+
+  return current.filter((entry) => entry !== version);
+}
+
+function filterAllowedDesktopVersionsToVisibleOptions(
+  storedVersions: string[] | null,
+  visibleOptions: string[],
+) {
+  if (storedVersions === null) {
+    return null;
+  }
+
+  const visibleOptionSet = new Set(visibleOptions);
+  return storedVersions.filter((version) => visibleOptionSet.has(version));
+}
+
+function SettingsToggle({
+  label,
+  checked,
+  disabled,
+  onChange,
+}: {
+  label: string;
+  checked: boolean;
+  disabled?: boolean;
+  onChange: (nextValue: boolean) => void;
+}) {
+  return (
+    <button
+      type="button"
+      role="switch"
+      aria-checked={checked}
+      aria-label={label}
+      disabled={disabled}
+      onClick={() => onChange(!checked)}
+      className={[
+        "relative inline-flex h-7 w-12 items-center rounded-full border transition-colors",
+        checked
+          ? "border-[#0f172a] bg-[#0f172a]"
+          : "border-gray-200 bg-gray-200",
+        disabled ? "cursor-not-allowed opacity-60" : "cursor-pointer",
+      ].join(" ")}
+    >
+      <span
+        aria-hidden="true"
+        className={[
+          "inline-block h-5 w-5 rounded-full bg-white transition-transform",
+          checked ? "translate-x-6" : "translate-x-1",
+        ].join(" ")}
+      />
+    </button>
+  );
+}
+
+export function OrgSettingsScreen() {
+  const {
+    activeOrg,
+    orgContext,
+    orgBusy,
+    orgError,
+    mutationBusy,
+    updateOrganizationSettings,
+  } = useOrgDashboard();
+  const [orgNameDraft, setOrgNameDraft] = useState("");
+  const [allowedDomainsDraft, setAllowedDomainsDraft] = useState("");
+  const [domainRestrictionsEnabled, setDomainRestrictionsEnabled] =
+    useState(false);
+  const [allowNonCloudModelsEnabled, setAllowNonCloudModelsEnabled] =
+    useState(true);
+  const [allowZenModelEnabled, setAllowZenModelEnabled] = useState(true);
+  const [allowMultipleWorkspacesEnabled, setAllowMultipleWorkspacesEnabled] =
+    useState(true);
+  const [domainEditModeEnabled, setDomainEditModeEnabled] = useState(false);
+  const [desktopVersionOptions, setDesktopVersionOptions] = useState<string[]>(
+    [],
+  );
+  const [allowedDesktopVersionsDraft, setAllowedDesktopVersionsDraft] =
+    useState<string[]>([]);
+  const [desktopVersionOptionsBusy, setDesktopVersionOptionsBusy] =
+    useState(false);
+  const [desktopVersionOptionsError, setDesktopVersionOptionsError] = useState<
+    string | null
+  >(null);
+  const [pageError, setPageError] = useState<string | null>(null);
+  const [pageSuccess, setPageSuccess] = useState<string | null>(null);
+  const [copiedOrgId, setCopiedOrgId] = useState(false);
+
+  const currentAllowedDomains =
+    orgContext?.organization.allowedEmailDomains ?? null;
+  const currentDesktopAppRestrictions =
+    orgContext?.organization.desktopAppRestrictions ?? {};
+  const isOwner = orgContext?.currentMember.isOwner ?? false;
+  const draftAllowedDomains = useMemo(
+    () => normalizeAllowedEmailDomainsInput(allowedDomainsDraft),
+    [allowedDomainsDraft],
+  );
+  const hasDraftDomains = (draftAllowedDomains?.length ?? 0) > 0;
+  const visibleAllowedDesktopVersionsDraft = useMemo(
+    () =>
+      filterAllowedDesktopVersionsToVisibleOptions(
+        allowedDesktopVersionsDraft,
+        desktopVersionOptions,
+      ) ?? [],
+    [allowedDesktopVersionsDraft, desktopVersionOptions],
+  );
+  const selectedDesktopVersions = useMemo(
+    () => new Set(visibleAllowedDesktopVersionsDraft),
+    [visibleAllowedDesktopVersionsDraft],
+  );
+  const allDesktopVersionsAllowed =
+    desktopVersionOptions.length > 0 &&
+    desktopVersionOptions.every((version) =>
+      selectedDesktopVersions.has(version),
+    );
+
+  useEffect(() => {
+    if (!orgContext) {
+      return;
+    }
+
+    setOrgNameDraft(orgContext.organization.name);
+    setAllowedDomainsDraft(
+      (orgContext.organization.allowedEmailDomains ?? []).join("\n"),
+    );
+    setDomainRestrictionsEnabled(
+      (orgContext.organization.allowedEmailDomains?.length ?? 0) > 0,
+    );
+    setAllowNonCloudModelsEnabled(
+      orgContext.organization.desktopAppRestrictions.disallowNonCloudModels !==
+        true,
+    );
+    setAllowZenModelEnabled(
+      orgContext.organization.desktopAppRestrictions.blockZenModel !== true,
+    );
+    setAllowMultipleWorkspacesEnabled(
+      orgContext.organization.desktopAppRestrictions.blockMultipleWorkspaces !==
+        true,
+    );
+    setDomainEditModeEnabled(false);
+  }, [orgContext]);
+
+  useEffect(() => {
+    let cancelled = false;
+
+    async function loadDesktopVersionOptions() {
+      setDesktopVersionOptionsBusy(true);
+      setDesktopVersionOptionsError(null);
+
+      try {
+        const { response, payload } = await requestJson(
+          "/v1/app-version",
+          { method: "GET" },
+          12000,
+        );
+
+        if (!response.ok) {
+          throw new Error(
+            getErrorMessage(
+              payload,
+              `Failed to load desktop version metadata (${response.status}).`,
+            ),
+          );
+        }
+
+        const metadata = getDesktopVersionMetadata(payload);
+        if (!metadata) {
+          throw new Error("Desktop version metadata was incomplete.");
+        }
+
+        if (cancelled) {
+          return;
+        }
+
+        setDesktopVersionOptions(
+          buildDesktopVersionOptions(
+            metadata.minAppVersion,
+            metadata.latestAppVersion,
+          ),
+        );
+      } catch (error) {
+        if (!cancelled) {
+          setDesktopVersionOptions([]);
+          setDesktopVersionOptionsError(
+            error instanceof Error
+              ? error.message
+              : "Could not load desktop versions.",
+          );
+        }
+      } finally {
+        if (!cancelled) {
+          setDesktopVersionOptionsBusy(false);
+        }
+      }
+    }
+
+    void loadDesktopVersionOptions();
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  useEffect(() => {
+    if (!orgContext || desktopVersionOptions.length === 0) {
+      return;
+    }
+
+    const storedAllowedDesktopVersions =
+      filterAllowedDesktopVersionsToVisibleOptions(
+        getAllowedDesktopVersionsFromMetadata(orgContext.organization.metadata),
+        desktopVersionOptions,
+      );
+
+    if (storedAllowedDesktopVersions === null) {
+      setAllowedDesktopVersionsDraft(desktopVersionOptions);
+      return;
+    }
+
+    setAllowedDesktopVersionsDraft(storedAllowedDesktopVersions);
+  }, [desktopVersionOptions, orgContext]);
+
+  useEffect(() => {
+    if (
+      visibleAllowedDesktopVersionsDraft.length ===
+      allowedDesktopVersionsDraft.length
+    ) {
+      return;
+    }
+
+    setAllowedDesktopVersionsDraft(visibleAllowedDesktopVersionsDraft);
+  }, [allowedDesktopVersionsDraft.length, visibleAllowedDesktopVersionsDraft]);
+
+  useEffect(() => {
+    if (!copiedOrgId) {
+      return;
+    }
+
+    const timeout = window.setTimeout(() => setCopiedOrgId(false), 1600);
+    return () => window.clearTimeout(timeout);
+  }, [copiedOrgId]);
+
+  const createdAtLabel = useMemo(() => {
+    if (!orgContext?.organization.createdAt) {
+      return "Not available";
+    }
+
+    return new Date(orgContext.organization.createdAt).toLocaleDateString();
+  }, [orgContext?.organization.createdAt]);
+
+  if (orgBusy && !orgContext) {
+    return (
+      <div className="mx-auto max-w-[860px] p-8">
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading workspace settings...
+        </div>
+      </div>
+    );
+  }
+
+  if (!activeOrg || !orgContext) {
+    return (
+      <div className="mx-auto max-w-[860px] p-8">
+        <div className="rounded-[28px] border border-red-200 bg-red-50 px-6 py-10 text-[15px] text-red-700">
+          {orgError ?? "Workspace settings are not available right now."}
+        </div>
+      </div>
+    );
+  }
+
+  const organizationId = orgContext.organization.id;
+
+  async function handleCopyOrgId() {
+    await navigator.clipboard.writeText(organizationId);
+    setCopiedOrgId(true);
+  }
+
+  function handleDomainRestrictionToggle(nextValue: boolean) {
+    if (!isOwner) {
+      return;
+    }
+
+    if (!nextValue && hasDraftDomains) {
+      return;
+    }
+
+    setPageError(null);
+    setPageSuccess(null);
+    setDomainRestrictionsEnabled(nextValue);
+    setDomainEditModeEnabled(nextValue && !currentAllowedDomains?.length);
+  }
+
+  async function handleSaveSettings(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    setPageError(null);
+    setPageSuccess(null);
+
+    try {
+      await updateOrganizationSettings({
+        name: orgNameDraft,
+        allowedEmailDomains: domainRestrictionsEnabled
+          ? draftAllowedDomains
+          : null,
+        desktopAppRestrictions: {
+          ...(!allowNonCloudModelsEnabled
+            ? { disallowNonCloudModels: true }
+            : {}),
+          ...(!allowZenModelEnabled ? { blockZenModel: true } : {}),
+          ...(!allowMultipleWorkspacesEnabled
+            ? { blockMultipleWorkspaces: true }
+            : {}),
+        },
+        ...(desktopVersionOptions.length > 0
+          ? {
+              allowedDesktopVersions: allDesktopVersionsAllowed
+                ? null
+                : desktopVersionOptions.filter((version) =>
+                    selectedDesktopVersions.has(version),
+                  ),
+            }
+          : {}),
+      });
+      setDomainEditModeEnabled(false);
+      setPageSuccess("Workspace settings updated.");
+    } catch (error) {
+      setPageError(
+        error instanceof Error
+          ? error.message
+          : "Could not update workspace settings.",
+      );
+    }
+  }
+
+  return (
+    <DashboardPageTemplate
+      icon={SlidersHorizontal}
+      title="Org settings"
+      description="Control your organization's settings."
+      colors={["#D9F99D", "#0F172A", "#0F766E", "#FDE68A"]}
+    >
+      {pageError ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {pageError}
+        </div>
+      ) : null}
+      {pageSuccess ? (
+        <div className="mb-6 rounded-[24px] border border-emerald-200 bg-emerald-50 px-5 py-4 text-[14px] text-emerald-700">
+          {pageSuccess}
+        </div>
+      ) : null}
+
+      <form className="grid gap-6" onSubmit={handleSaveSettings}>
+        <DenCard size="spacious" className="grid gap-6">
+          <div className="grid gap-2">
+            <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Core
+            </p>
+            <h2 className="text-[24px] font-semibold tracking-[-0.04em] text-gray-900">
+              Organization Identity
+            </h2>
+          </div>
+
+          <div className="grid gap-5 lg:grid-cols-[minmax(0,1.25fr)_minmax(0,0.75fr)]">
+            <label className="grid gap-3">
+              <span className="text-[14px] font-medium text-gray-700">
+                Name
+              </span>
+              <DenInput
+                type="text"
+                value={orgNameDraft}
+                onChange={(event) => setOrgNameDraft(event.target.value)}
+                minLength={2}
+                maxLength={120}
+                disabled={!isOwner}
+                required
+              />
+            </label>
+
+            <div className="grid gap-3">
+              <span className="text-[14px] font-medium text-gray-700">ID</span>
+              <div className="flex gap-2">
+                <DenInput
+                  value={organizationId}
+                  readOnly
+                  aria-label="Organization ID"
+                  className="font-mono text-[13px]"
+                />
+                <DenButton
+                  variant="secondary"
+                  type="button"
+                  icon={copiedOrgId ? Check : Copy}
+                  onClick={() => void handleCopyOrgId()}
+                >
+                  {copiedOrgId ? "Copied" : "Copy"}
+                </DenButton>
+              </div>
+            </div>
+          </div>
+        </DenCard>
+
+        <DenCard size="spacious" className="grid gap-6">
+          <div className="flex items-start justify-between gap-4">
+            <div className="grid gap-2">
+              <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+                Access rules
+              </p>
+              <h2 className="text-[24px] font-semibold tracking-[-0.04em] text-gray-900">
+                Allowed email domains
+              </h2>
+              <p className="text-[14px] text-gray-500">
+                Only allow people with specific email domains to join this
+                Organization.
+              </p>
+            </div>
+            <div className="flex items-center gap-3 pt-1">
+              <span className="text-[13px] font-medium text-gray-500">
+                {domainRestrictionsEnabled ? "On" : "Off"}
+              </span>
+              <SettingsToggle
+                label="Restrict allowed email domains"
+                checked={domainRestrictionsEnabled}
+                disabled={
+                  !isOwner || (domainRestrictionsEnabled && hasDraftDomains)
+                }
+                onChange={handleDomainRestrictionToggle}
+              />
+            </div>
+          </div>
+
+          {domainRestrictionsEnabled && domainEditModeEnabled ? (
+            <label className="grid gap-3">
+              <span className="text-[14px] font-medium text-gray-700">
+                Domain allowlist
+              </span>
+              <span className="text-[10px] text-gray-500">
+                Enter domains one per line or with comma as separator
+              </span>
+              <DenTextarea
+                value={allowedDomainsDraft}
+                onChange={(event) => setAllowedDomainsDraft(event.target.value)}
+                rows={6}
+                disabled={!isOwner}
+                placeholder={"company.com\npartner.org"}
+              />
+            </label>
+          ) : null}
+
+          {domainRestrictionsEnabled && !domainEditModeEnabled ? (
+            <div className="grid gap-3 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-4">
+              <div className="flex items-start justify-between gap-3">
+                {currentAllowedDomains && currentAllowedDomains.length > 0 ? (
+                  <div className="flex flex-wrap w-full gap-2">
+                    {currentAllowedDomains.map((domain) => (
+                      <span
+                        key={domain}
+                        className="rounded-full border border-gray-200 bg-white px-3 py-1 text-[13px] text-gray-700"
+                      >
+                        {domain}
+                      </span>
+                    ))}
+                  </div>
+                ) : (
+                  <p className="text-[14px] text-gray-600">
+                    No email domains are configured yet.
+                  </p>
+                )}
+                {isOwner ? (
+                  <DenButton
+                    type="button"
+                    size="sm"
+                    variant="secondary"
+                    icon={Pencil}
+                    onClick={() => {
+                      setPageError(null);
+                      setPageSuccess(null);
+                      setDomainEditModeEnabled(true);
+                    }}
+                  >
+                    Edit
+                  </DenButton>
+                ) : null}
+              </div>
+            </div>
+          ) : null}
+        </DenCard>
+
+        <DenCard size="spacious" className="grid gap-6">
+          <div className="grid gap-2">
+            <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Desktop app
+            </p>
+            <h2 className="text-[24px] font-semibold tracking-[-0.04em] text-gray-900">
+              Desktop restrictions
+            </h2>
+            <p className="text-[14px] text-gray-500">
+              Control which desktop-only options remain available after people
+              sign in to this workspace.
+            </p>
+          </div>
+
+          <div className="grid gap-4">
+            <div className="flex items-start justify-between gap-4 rounded-[24px] border border-gray-200 bg-white px-5 py-4">
+              <div className="grid gap-1 pr-4">
+                <p className="text-[15px] font-medium text-gray-900">
+                  Allow non-cloud deployed models
+                </p>
+                <p className="text-[13px] text-gray-500">
+                  Let signed-in desktop users access models that are not
+                  deployed through OpenWork Cloud.
+                </p>
+              </div>
+              <SettingsToggle
+                label="Allow non-cloud deployed models"
+                checked={allowNonCloudModelsEnabled}
+                disabled={!isOwner}
+                onChange={setAllowNonCloudModelsEnabled}
+              />
+            </div>
+
+            <div className="flex items-start justify-between gap-4 rounded-[24px] border border-gray-200 bg-white px-5 py-4">
+              <div className="grid gap-1 pr-4">
+                <p className="text-[15px] font-medium text-gray-900">
+                  Allow usage of OpenCode Zen model
+                </p>
+                <p className="text-[13px] text-gray-500">
+                  Let signed-in desktop users access the OpenCode Zen model in
+                  the desktop app.
+                </p>
+              </div>
+              <SettingsToggle
+                label="Allow usage of OpenCode Zen model"
+                checked={allowZenModelEnabled}
+                disabled={!isOwner}
+                onChange={setAllowZenModelEnabled}
+              />
+            </div>
+
+            <div className="flex items-start justify-between gap-4 rounded-[24px] border border-gray-200 bg-white px-5 py-4">
+              <div className="grid gap-1 pr-4">
+                <p className="text-[15px] font-medium text-gray-900">
+                  Allow users to configure multiple workspaces
+                </p>
+                <p className="text-[13px] text-gray-500">
+                  Let signed-in desktop users create or manage more than one
+                  workspace on their machine.
+                </p>
+              </div>
+              <SettingsToggle
+                label="Allow users to configure multiple workspaces"
+                checked={allowMultipleWorkspacesEnabled}
+                disabled={!isOwner}
+                onChange={setAllowMultipleWorkspacesEnabled}
+              />
+            </div>
+          </div>
+        </DenCard>
+
+        <DenCard size="spacious" className="grid gap-6">
+          <div className="grid gap-2">
+            <p className="text-[12px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+              Desktop app
+            </p>
+            <h2 className="text-[24px] font-semibold tracking-[-0.04em] text-gray-900">
+              Allowed Desktop Versions
+            </h2>
+            <p className="text-[14px] text-gray-500">
+              Choose which supported desktop versions can sign in to this
+              workspace.
+            </p>
+            {desktopVersionOptions.length > 0 ? (
+              <p className="text-[10px] text-gray-400">
+                This server currently supports desktop
+                {` ${desktopVersionOptions[0]} `}
+                to {desktopVersionOptions[desktopVersionOptions.length - 1]}.
+              </p>
+            ) : null}
+          </div>
+
+          {desktopVersionOptionsBusy ? (
+            <div className="rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-4 text-[14px] text-gray-500">
+              Loading desktop versions...
+            </div>
+          ) : null}
+
+          {desktopVersionOptionsError ? (
+            <div className="rounded-[24px] border border-amber-200 bg-amber-50 px-5 py-4 text-[14px] text-amber-800">
+              {desktopVersionOptionsError}
+            </div>
+          ) : null}
+
+          {!desktopVersionOptionsBusy &&
+          !desktopVersionOptionsError &&
+          desktopVersionOptions.length > 0 ? (
+            <div className="grid gap-4">
+              <div className="grid gap-3">
+                {desktopVersionOptions.map((version) => {
+                  const checked = selectedDesktopVersions.has(version);
+
+                  return (
+                    <label
+                      key={version}
+                      className="flex items-center justify-between gap-4 rounded-[24px] border border-gray-200 bg-white px-5 py-4"
+                    >
+                      <div className="grid gap-1">
+                        <p className="text-[15px] font-medium text-gray-900">
+                          {version}
+                        </p>
+                      </div>
+                      <input
+                        type="checkbox"
+                        checked={checked}
+                        disabled={!isOwner}
+                        aria-label={`Allow desktop version ${version}`}
+                        onChange={(event) =>
+                          setAllowedDesktopVersionsDraft((current) =>
+                            toggleAllowedDesktopVersion(
+                              current,
+                              version,
+                              event.target.checked,
+                            ),
+                          )
+                        }
+                      />
+                    </label>
+                  );
+                })}
+              </div>
+            </div>
+          ) : null}
+        </DenCard>
+
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <p className="text-[13px] text-gray-500">
+            {!isOwner && "Only workspace owners can change these settings."}
+          </p>
+          {isOwner ? (
+            <DenButton
+              type="submit"
+              loading={mutationBusy === "update-organization-settings"}
+            >
+              Save settings
+            </DenButton>
+          ) : null}
+        </div>
+      </form>
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-data.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-data.tsx
new file mode 100644
index 0000000000..862f739866
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-data.tsx
@@ -0,0 +1,623 @@
+"use client";
+
+import { useQuery, type QueryClient } from "@tanstack/react-query";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+  type ConnectedIntegration,
+  integrationQueryKeys,
+} from "./integration-data";
+
+/**
+ * Plugin primitives — mirror OpenCode / Claude Code's plugin surface:
+ *
+ *  A plugin is a *bundle* of reusable pieces that extend an agent runtime:
+ *   - skills      natural-language playbooks/instructions agents can load on demand
+ *   - hooks       lifecycle callbacks (PreToolUse / PostToolUse / SessionStart, etc.)
+ *   - mcps        Model Context Protocol servers that expose external tools/resources
+ *   - agents      custom sub-agents with their own system prompt and tool set
+ *   - commands    slash-commands that shortcut common workflows
+ *
+ * This file models the frontend shape only. Mock data is served through
+ * React Query so we can swap the queryFn for a real API call later without
+ * touching any consumers.
+ *
+ * Gating: the catalog is empty until the user has connected at least one
+ * integration (GitHub or Bitbucket) on the Integrations page. The queryFn
+ * reads the integrations cache and derives which plugins are visible from
+ * the set of connected repositories. Integration mutations invalidate
+ * `["plugins"]`, so connections and disconnections propagate automatically.
+ */
+
+// ── Primitive types ────────────────────────────────────────────────────────
+
+export type PluginCategory =
+  | "integrations"
+  | "workflows"
+  | "code-intelligence"
+  | "output-styles"
+  | "infrastructure";
+
+export type PluginSkill = {
+  id: string;
+  name: string;
+  description: string;
+};
+
+export type PluginHookEvent =
+  | "PreToolUse"
+  | "PostToolUse"
+  | "SessionStart"
+  | "SessionEnd"
+  | "UserPromptSubmit"
+  | "Notification"
+  | "Stop";
+
+export type PluginHook = {
+  id: string;
+  event: PluginHookEvent;
+  description: string;
+  matcher?: string | null;
+};
+
+export type PluginMcpTransport = "stdio" | "http" | "sse";
+
+export type PluginMcp = {
+  id: string;
+  name: string;
+  description: string;
+  transport: PluginMcpTransport;
+  toolCount: number;
+};
+
+export type PluginAgent = {
+  id: string;
+  name: string;
+  description: string;
+};
+
+export type PluginCommand = {
+  id: string;
+  name: string;
+  description: string;
+};
+
+export type PluginSource =
+  | { type: "marketplace"; marketplace: string }
+  | { type: "github"; repo: string }
+  | { type: "local"; path: string };
+
+export type PluginMarketplaceRef = {
+  id: string;
+  name: string;
+};
+
+export type DenPlugin = {
+  id: string;
+  name: string;
+  slug: string;
+  description: string;
+  version: string | null;
+  author: string;
+  category: PluginCategory;
+  installed: boolean;
+  source: PluginSource;
+  marketplaces?: PluginMarketplaceRef[];
+  skills: PluginSkill[];
+  hooks: PluginHook[];
+  mcps: PluginMcp[];
+  agents: PluginAgent[];
+  commands: PluginCommand[];
+  updatedAt: string;
+  /**
+   * Opt-in gating: which connected integration provider exposes this plugin.
+   * - "any"      → visible once ANY integration is connected (e.g. marketplace output styles)
+   * - "github"   → only visible after a GitHub account is connected
+   * - "bitbucket"→ only visible after a Bitbucket account is connected
+   */
+  requiresProvider: "any" | "github" | "bitbucket";
+};
+
+// ── Display helpers ────────────────────────────────────────────────────────
+
+export function getPluginCategoryLabel(category: PluginCategory): string {
+  switch (category) {
+    case "integrations":
+      return "External Integrations";
+    case "workflows":
+      return "Workflows";
+    case "code-intelligence":
+      return "Code Intelligence";
+    case "output-styles":
+      return "Output Styles";
+    case "infrastructure":
+      return "Infrastructure";
+  }
+}
+
+export function formatPluginTimestamp(value: string | null): string {
+  if (!value) {
+    return "Recently updated";
+  }
+
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "Recently updated";
+  }
+
+  return new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+  }).format(date);
+}
+
+export function getPluginPartsSummary(plugin: DenPlugin): string {
+  const parts: string[] = [];
+  if (plugin.skills.length > 0) {
+    parts.push(`${plugin.skills.length} ${plugin.skills.length === 1 ? "Skill" : "Skills"}`);
+  }
+  if (plugin.hooks.length > 0) {
+    parts.push(`${plugin.hooks.length} ${plugin.hooks.length === 1 ? "Hook" : "Hooks"}`);
+  }
+  if (plugin.mcps.length > 0) {
+    parts.push(`${plugin.mcps.length} ${plugin.mcps.length === 1 ? "MCP" : "MCPs"}`);
+  }
+  if (plugin.agents.length > 0) {
+    parts.push(`${plugin.agents.length} ${plugin.agents.length === 1 ? "Agent" : "Agents"}`);
+  }
+  if (plugin.commands.length > 0) {
+    parts.push(`${plugin.commands.length} ${plugin.commands.length === 1 ? "Command" : "Commands"}`);
+  }
+  return parts.length > 0 ? parts.join(" · ") : "Empty bundle";
+}
+
+// ── Mock data ──────────────────────────────────────────────────────────────
+//
+// These are shaped to mirror real marketplaces (Anthropic's official catalog,
+// internal team bundles, etc.) so the UI exercises realistic content.
+
+const MOCK_PLUGINS: DenPlugin[] = [
+  {
+    id: "plg_github",
+    name: "GitHub",
+    slug: "github",
+    description:
+      "Work with GitHub repositories, pull requests, issues, and Actions directly from chat. Bundles an MCP server and review workflows.",
+    version: "1.4.2",
+    author: "Anthropic",
+    category: "integrations",
+    installed: true,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [
+      { id: "sk_gh_pr", name: "Open Pull Request", description: "Draft PR titles and bodies from a diff." },
+      { id: "sk_gh_review", name: "Review Pull Request", description: "Summarize diffs and suggest blocking comments." },
+    ],
+    hooks: [
+      {
+        id: "hk_gh_pre",
+        event: "PreToolUse",
+        description: "Redact GitHub tokens from logs before tool execution.",
+        matcher: "Bash",
+      },
+    ],
+    mcps: [
+      {
+        id: "mcp_gh",
+        name: "github-mcp",
+        description: "Official GitHub MCP server — issues, PRs, releases, Actions.",
+        transport: "http",
+        toolCount: 42,
+      },
+    ],
+    agents: [
+      {
+        id: "ag_gh_reviewer",
+        name: "pr-reviewer",
+        description: "Opinionated pull-request reviewer with context-aware suggestions.",
+      },
+    ],
+    commands: [
+      { id: "cmd_gh_pr", name: "/gh:pr", description: "Create a pull request from the current branch." },
+    ],
+    updatedAt: "2026-04-10T12:00:00Z",
+    requiresProvider: "github",
+  },
+  {
+    id: "plg_commit_commands",
+    name: "Commit Commands",
+    slug: "commit-commands",
+    description:
+      "Git commit, push, and PR-creation workflows. Uses conventional-commit heuristics and follows your repo's commit style.",
+    version: "0.9.0",
+    author: "Anthropic",
+    category: "workflows",
+    installed: true,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [
+      { id: "sk_cc_commit", name: "Smart Commit", description: "Stage, group, and commit with a generated message." },
+      { id: "sk_cc_push", name: "Push & Open PR", description: "Push current branch and open a PR with autogenerated body." },
+    ],
+    hooks: [],
+    mcps: [],
+    agents: [],
+    commands: [
+      { id: "cmd_cc_commit", name: "/commit", description: "Create a commit for staged changes." },
+      { id: "cmd_cc_push", name: "/push", description: "Push current branch and track upstream." },
+      { id: "cmd_cc_pr", name: "/pr", description: "Open a pull request." },
+    ],
+    updatedAt: "2026-04-07T09:00:00Z",
+    requiresProvider: "any",
+  },
+  {
+    id: "plg_typescript_lsp",
+    name: "TypeScript LSP",
+    slug: "typescript-lsp",
+    description:
+      "Connects Claude to the TypeScript language server so it can jump to definitions, find references, and surface type errors immediately after edits.",
+    version: "1.1.0",
+    author: "Anthropic",
+    category: "code-intelligence",
+    installed: false,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [],
+    hooks: [
+      {
+        id: "hk_ts_diag",
+        event: "PostToolUse",
+        description: "Run LSP diagnostics after every file edit and report type errors.",
+        matcher: "Edit|Write",
+      },
+    ],
+    mcps: [
+      {
+        id: "mcp_ts",
+        name: "typescript-language-server",
+        description: "LSP bridge for .ts/.tsx diagnostics and navigation.",
+        transport: "stdio",
+        toolCount: 9,
+      },
+    ],
+    agents: [],
+    commands: [],
+    updatedAt: "2026-03-28T16:45:00Z",
+    requiresProvider: "any",
+  },
+  {
+    id: "plg_linear",
+    name: "Linear",
+    slug: "linear",
+    description:
+      "Create, update, and triage Linear issues without leaving the session. Bundles a Linear MCP and an issue-grooming agent.",
+    version: "0.6.3",
+    author: "Anthropic",
+    category: "integrations",
+    installed: false,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [
+      { id: "sk_lin_triage", name: "Triage Inbox", description: "Sweep the inbox and file issues to the right project." },
+    ],
+    hooks: [],
+    mcps: [
+      {
+        id: "mcp_linear",
+        name: "linear-mcp",
+        description: "Linear MCP — issues, cycles, projects, comments.",
+        transport: "http",
+        toolCount: 24,
+      },
+    ],
+    agents: [
+      { id: "ag_lin_groomer", name: "linear-groomer", description: "Keeps the backlog tidy and flags stale issues." },
+    ],
+    commands: [
+      { id: "cmd_lin_new", name: "/linear:new", description: "File a new issue from the current context." },
+    ],
+    updatedAt: "2026-04-02T18:12:00Z",
+    requiresProvider: "any",
+  },
+  {
+    id: "plg_openwork_release",
+    name: "OpenWork Release Kit",
+    slug: "openwork-release-kit",
+    description:
+      "Internal plugin that automates OpenWork release prep, orchestrator sidecar builds, and changelog generation. Shipped by OpenWork infra.",
+    version: "2.3.1",
+    author: "OpenWork",
+    category: "workflows",
+    installed: true,
+    source: { type: "github", repo: "different-ai/openwork-plugins" },
+    skills: [
+      { id: "sk_ow_release_prep", name: "Release Prep", description: "Bump versions across app/desktop/orchestrator in lockstep." },
+      { id: "sk_ow_changelog", name: "Changelog Drafter", description: "Generate markdown release notes from merged PRs." },
+    ],
+    hooks: [
+      {
+        id: "hk_ow_sessionstart",
+        event: "SessionStart",
+        description: "Load the release runbook into context at session start.",
+        matcher: null,
+      },
+    ],
+    mcps: [],
+    agents: [
+      { id: "ag_ow_release", name: "release-captain", description: "Drives the full release flow end-to-end." },
+    ],
+    commands: [
+      { id: "cmd_ow_release", name: "/release", description: "Run the standardized release workflow." },
+    ],
+    updatedAt: "2026-04-14T08:30:00Z",
+    requiresProvider: "github",
+  },
+  {
+    id: "plg_sentry",
+    name: "Sentry",
+    slug: "sentry",
+    description:
+      "Connect to Sentry and ingest recent errors into a session. Includes an MCP server and a triage skill that clusters noisy issues.",
+    version: "0.4.0",
+    author: "Anthropic",
+    category: "infrastructure",
+    installed: false,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [
+      { id: "sk_sentry_triage", name: "Triage Errors", description: "Cluster Sentry issues and recommend owners." },
+    ],
+    hooks: [],
+    mcps: [
+      {
+        id: "mcp_sentry",
+        name: "sentry-mcp",
+        description: "Sentry MCP — projects, issues, releases, performance.",
+        transport: "http",
+        toolCount: 18,
+      },
+    ],
+    agents: [],
+    commands: [],
+    updatedAt: "2026-03-20T11:00:00Z",
+    requiresProvider: "any",
+  },
+  {
+    id: "plg_explanatory_style",
+    name: "Explanatory Output Style",
+    slug: "explanatory-output-style",
+    description:
+      "Response style that adds educational context around implementation choices, trade-offs, and alternatives.",
+    version: "1.0.0",
+    author: "Anthropic",
+    category: "output-styles",
+    installed: false,
+    source: { type: "marketplace", marketplace: "claude-plugins-official" },
+    skills: [],
+    hooks: [
+      {
+        id: "hk_explain_post",
+        event: "Stop",
+        description: "Append an 'Implementation notes' section before stopping.",
+        matcher: null,
+      },
+    ],
+    mcps: [],
+    agents: [],
+    commands: [],
+    updatedAt: "2026-03-12T14:22:00Z",
+    requiresProvider: "any",
+  },
+];
+
+function readConnectedProviders(client: QueryClient): Set<"github" | "bitbucket"> {
+  const connections = client.getQueryData<ConnectedIntegration[]>(integrationQueryKeys.list()) ?? [];
+  return new Set(connections.map((connection) => connection.provider));
+}
+
+function filterByConnectedProviders(
+  plugins: DenPlugin[],
+  connectedProviders: Set<"github" | "bitbucket">,
+): DenPlugin[] {
+  if (connectedProviders.size === 0) {
+    return [];
+  }
+  return plugins.filter((plugin) => {
+    if (plugin.requiresProvider === "any") return true;
+    return connectedProviders.has(plugin.requiresProvider);
+  });
+}
+
+// ── Query hooks ────────────────────────────────────────────────────────────
+//
+// Keep the surface identical to what a real API-backed version would return,
+// so swapping `queryFn` for `requestJson(...)` later is a one-line change.
+
+export const pluginQueryKeys = {
+  all: ["plugins"] as const,
+  list: () => [...pluginQueryKeys.all, "list"] as const,
+  detail: (id: string) => [...pluginQueryKeys.all, "detail", id] as const,
+};
+
+function slugifyPluginName(value: string) {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "") || "plugin";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function parseMembershipConfigObject(entry: unknown) {
+  if (!isRecord(entry) || !isRecord(entry.configObject)) {
+    return null;
+  }
+
+  const configObject = entry.configObject;
+  const id = asString(configObject.id);
+  const title = asString(configObject.title);
+  const description = asString(configObject.description) ?? "Imported from a connected repository.";
+  const objectType = asString(configObject.objectType);
+  const currentRelativePath = asString(configObject.currentRelativePath);
+  const latestVersion = isRecord(configObject.latestVersion) ? configObject.latestVersion : null;
+  const normalizedPayload = latestVersion && isRecord(latestVersion.normalizedPayloadJson)
+    ? latestVersion.normalizedPayloadJson
+    : null;
+
+  if (!id || !title || !objectType) {
+    return null;
+  }
+
+  return {
+    currentRelativePath,
+    description,
+    id,
+    normalizedPayload,
+    objectType,
+    title,
+  };
+}
+
+function derivePluginCategory(input: { agents: PluginAgent[]; commands: PluginCommand[]; hooks: PluginHook[]; mcps: PluginMcp[]; skills: PluginSkill[] }): PluginCategory {
+  if (input.mcps.length > 0 || input.hooks.length > 0) {
+    return "integrations";
+  }
+  if (input.agents.length > 0 || input.commands.length > 0 || input.skills.length > 0) {
+    return "workflows";
+  }
+  return "output-styles";
+}
+
+function parsePluginHookEvent(value: string | null): PluginHookEvent {
+  switch (value) {
+    case "PreToolUse":
+    case "PostToolUse":
+    case "SessionStart":
+    case "SessionEnd":
+    case "UserPromptSubmit":
+    case "Notification":
+    case "Stop":
+      return value;
+    default:
+      return "Notification";
+  }
+}
+
+async function fetchResolvedPlugin(id: string): Promise<DenPlugin | null> {
+  const [pluginResult, membershipsResult] = await Promise.all([
+    requestJson(`/v1/plugins/${encodeURIComponent(id)}`, { method: "GET" }, 15000),
+    requestJson(`/v1/plugins/${encodeURIComponent(id)}/resolved`, { method: "GET" }, 15000),
+  ]);
+
+  if (!pluginResult.response.ok) {
+    throw new Error(getErrorMessage(pluginResult.payload, `Failed to load plugin (${pluginResult.response.status}).`));
+  }
+  if (!membershipsResult.response.ok) {
+    throw new Error(getErrorMessage(membershipsResult.payload, `Failed to load plugin contents (${membershipsResult.response.status}).`));
+  }
+
+  const pluginItem = isRecord(pluginResult.payload) && isRecord(pluginResult.payload.item) ? pluginResult.payload.item : null;
+  if (!pluginItem) {
+    return null;
+  }
+
+  const pluginId = asString(pluginItem.id);
+  const name = asString(pluginItem.name);
+  if (!pluginId || !name) {
+    return null;
+  }
+
+  const membershipItems = isRecord(membershipsResult.payload) && Array.isArray(membershipsResult.payload.items)
+    ? membershipsResult.payload.items.map(parseMembershipConfigObject).filter((value): value is NonNullable<typeof value> => Boolean(value))
+    : [];
+
+  const skills = membershipItems
+    .filter((item) => item.objectType === "skill")
+    .map((item) => ({ id: item.id, name: item.title, description: item.description } satisfies PluginSkill));
+  const agents = membershipItems
+    .filter((item) => item.objectType === "agent")
+    .map((item) => ({ id: item.id, name: item.title, description: item.description } satisfies PluginAgent));
+  const commands = membershipItems
+    .filter((item) => item.objectType === "command")
+    .map((item) => ({ id: item.id, name: item.currentRelativePath?.split("/").pop()?.replace(/\.md$/i, "") ?? item.title, description: item.description } satisfies PluginCommand));
+  const hooks = membershipItems
+    .filter((item) => item.objectType === "hook")
+    .map((item) => ({
+      description: item.description,
+      event: parsePluginHookEvent(asString(item.normalizedPayload?.event) ?? item.title),
+      id: item.id,
+      matcher: asString(item.normalizedPayload?.matcher),
+    } satisfies PluginHook));
+  const mcps = membershipItems
+    .filter((item) => item.objectType === "mcp")
+    .map((item) => ({
+      description: item.description,
+      id: item.id,
+      name: item.title,
+      toolCount: typeof item.normalizedPayload?.toolCount === "number" ? item.normalizedPayload.toolCount : 0,
+      transport: (asString(item.normalizedPayload?.transport) as PluginMcpTransport | null) ?? "stdio",
+    } satisfies PluginMcp));
+
+  const marketplaces = Array.isArray(pluginItem.marketplaces)
+    ? pluginItem.marketplaces.flatMap((entry) => {
+        if (!isRecord(entry)) return [];
+        const id = asString(entry.id);
+        const marketplaceName = asString(entry.name);
+        if (!id || !marketplaceName) return [];
+        return [{ id, name: marketplaceName } satisfies PluginMarketplaceRef];
+      })
+    : [];
+
+  return {
+    agents,
+    author: "Connected repository",
+    category: derivePluginCategory({ agents, commands, hooks, mcps, skills }),
+    commands,
+    description: asString(pluginItem.description) ?? "Imported from a connected repository.",
+    hooks,
+    id: pluginId,
+    installed: true,
+    marketplaces,
+    mcps,
+    name,
+    requiresProvider: "github",
+    skills,
+    slug: slugifyPluginName(name),
+    source: marketplaces[0]
+      ? { type: "marketplace", marketplace: marketplaces[0].name }
+      : { type: "github", repo: "Connected repository" },
+    updatedAt: asString(pluginItem.updatedAt) ?? new Date().toISOString(),
+    version: null,
+  } satisfies DenPlugin;
+}
+
+export function usePlugins() {
+  return useQuery({
+    queryKey: pluginQueryKeys.list(),
+    queryFn: async () => {
+      const { response, payload } = await requestJson("/v1/plugins?status=active&limit=100", { method: "GET" }, 20000);
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to load plugins (${response.status}).`));
+      }
+
+      const items = isRecord(payload) && Array.isArray(payload.items) ? payload.items : [];
+      const pluginIds = items.flatMap((entry) => {
+        const id = isRecord(entry) ? asString(entry.id) : null;
+        return id ? [id] : [];
+      });
+
+      const plugins = await Promise.all(pluginIds.map((id) => fetchResolvedPlugin(id)));
+      return plugins.filter((plugin): plugin is DenPlugin => Boolean(plugin));
+    },
+  });
+}
+
+export function usePlugin(id: string) {
+  return useQuery({
+    queryKey: pluginQueryKeys.detail(id),
+    queryFn: async () => fetchResolvedPlugin(id),
+    enabled: Boolean(id),
+  });
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-detail-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-detail-screen.tsx
new file mode 100644
index 0000000000..4ddd88ab2b
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugin-detail-screen.tsx
@@ -0,0 +1,251 @@
+"use client";
+
+import Link from "next/link";
+import { ArrowLeft, FileText, Puzzle, Server, Store, Terminal, Users, Webhook } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+
+import { getPluginsRoute } from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  type DenPlugin,
+  type PluginHook,
+  type PluginMcp,
+  type PluginSkill,
+  type PluginAgent,
+  type PluginCommand,
+  formatPluginTimestamp,
+  usePlugin,
+} from "./plugin-data";
+
+export function PluginDetailScreen({ pluginId }: { pluginId: string }) {
+  const { orgSlug } = useOrgDashboard();
+  const { data: plugin, isLoading, error } = usePlugin(pluginId);
+
+  if (isLoading && !plugin) {
+    return (
+      <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+        <div className="rounded-2xl border border-gray-100 bg-white px-5 py-8 text-[13px] text-gray-400">
+          Loading plugin details…
+        </div>
+      </div>
+    );
+  }
+
+  if (!plugin) {
+    return (
+      <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+        <div className="rounded-2xl border border-red-100 bg-red-50 px-5 py-3.5 text-[13px] text-red-600">
+          {error instanceof Error ? error.message : "That plugin could not be found."}
+        </div>
+      </div>
+    );
+  }
+
+  const marketplaces = plugin.marketplaces ?? [];
+  const missingLabels: string[] = [];
+  if (plugin.skills.length === 0) missingLabels.push("skills");
+  if (plugin.agents.length === 0) missingLabels.push("agents");
+  if (plugin.commands.length === 0) missingLabels.push("commands");
+  if (plugin.hooks.length === 0) missingLabels.push("hooks");
+  if (plugin.mcps.length === 0) missingLabels.push("MCP servers");
+
+  return (
+    <div className="mx-auto max-w-[860px] px-6 py-8 md:px-8">
+      <div className="mb-6 flex items-center justify-between gap-4">
+        <Link
+          href={getPluginsRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+      </div>
+
+      <article className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+        <div className="flex items-stretch">
+          <div className="relative w-[96px] shrink-0 overflow-hidden">
+            <div className="absolute inset-0">
+              <PaperMeshGradient seed={plugin.id} speed={0} />
+            </div>
+            <div className="relative flex h-full items-center justify-center">
+              <div className="flex h-14 w-14 items-center justify-center rounded-[16px] border border-white/60 bg-white shadow-[0_10px_24px_-10px_rgba(15,23,42,0.3)]">
+                <Puzzle className="h-6 w-6 text-gray-700" aria-hidden />
+              </div>
+            </div>
+          </div>
+
+          <div className="min-w-0 flex-1 px-6 py-5">
+            <div className="flex flex-wrap items-center gap-2">
+              <h1 className="truncate text-[18px] font-semibold tracking-[-0.02em] text-gray-950">
+                {plugin.name}
+              </h1>
+              {plugin.version ? (
+                <span className="rounded-full bg-gray-100 px-2 py-0.5 text-[11px] font-medium text-gray-500">
+                  v{plugin.version}
+                </span>
+              ) : null}
+            </div>
+            {plugin.description ? (
+              <p className="mt-1 text-[13px] leading-[1.55] text-gray-500">{plugin.description}</p>
+            ) : null}
+
+            {marketplaces.length > 0 ? (
+              <div className="mt-3 flex flex-wrap gap-1.5">
+                {marketplaces.map((marketplace) => (
+                  <span
+                    key={marketplace.id}
+                    className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-600"
+                  >
+                    <Store className="h-3 w-3 text-gray-400" aria-hidden />
+                    <span className="truncate">{marketplace.name}</span>
+                  </span>
+                ))}
+              </div>
+            ) : null}
+
+            <p className="mt-3 text-[11.5px] text-gray-400">
+              Updated {formatPluginTimestamp(plugin.updatedAt)}
+            </p>
+          </div>
+        </div>
+      </article>
+
+      <div className="mt-6 space-y-6">
+        <PrimitiveSection icon={FileText} label="Skills" items={plugin.skills} render={renderSkillRow} />
+        <PrimitiveSection icon={Users} label="Agents" items={plugin.agents} render={renderAgentRow} />
+        <PrimitiveSection icon={Terminal} label="Commands" items={plugin.commands} render={renderCommandRow} />
+        <PrimitiveSection icon={Webhook} label="Hooks" items={plugin.hooks} render={renderHookRow} />
+        <PrimitiveSection icon={Server} label="MCP Servers" items={plugin.mcps} render={renderMcpRow} />
+      </div>
+
+      {missingLabels.length > 0 ? (
+        <p className="mt-6 text-center text-[12px] text-gray-400">
+          No {formatMissingList(missingLabels)} detected in this plugin.
+        </p>
+      ) : null}
+    </div>
+  );
+}
+
+function formatMissingList(labels: string[]) {
+  if (labels.length === 0) return "";
+  const lowered = labels.map((label) => label.toLowerCase());
+  if (lowered.length === 1) return lowered[0];
+  if (lowered.length === 2) return `${lowered[0]} or ${lowered[1]}`;
+  return `${lowered.slice(0, -1).join(", ")}, or ${lowered[lowered.length - 1]}`;
+}
+
+function PrimitiveSection<T>({
+  icon: Icon,
+  label,
+  items,
+  render,
+}: {
+  icon: React.ComponentType<{ className?: string }>;
+  label: string;
+  items: T[];
+  render: (item: T) => React.ReactNode;
+}) {
+  if (items.length === 0) {
+    return null;
+  }
+
+  return (
+    <section>
+      <div className="mb-3 flex items-baseline justify-between gap-3">
+        <h2 className="inline-flex items-center gap-1.5 text-[11px] font-semibold uppercase tracking-[0.16em] text-gray-400">
+          <Icon className="h-3.5 w-3.5" />
+          {label}
+        </h2>
+        <p className="text-[11px] text-gray-400">
+          {items.length} {items.length === 1 ? "item" : "items"}
+        </p>
+      </div>
+      <div className="grid gap-2">{items.map((item) => render(item))}</div>
+    </section>
+  );
+}
+
+function renderSkillRow(skill: PluginSkill) {
+  return (
+    <div
+      key={skill.id}
+      className="rounded-xl border border-gray-100 bg-white px-4 py-3 transition hover:border-gray-200"
+    >
+      <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">{skill.name}</p>
+      {skill.description ? (
+        <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">{skill.description}</p>
+      ) : null}
+    </div>
+  );
+}
+
+function renderHookRow(hook: PluginHook) {
+  return (
+    <div
+      key={hook.id}
+      className="flex items-start justify-between gap-3 rounded-xl border border-gray-100 bg-white px-4 py-3 transition hover:border-gray-200"
+    >
+      <div className="min-w-0 flex-1">
+        <p className="truncate font-mono text-[13px] font-semibold text-gray-900">{hook.event}</p>
+        {hook.description ? (
+          <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">{hook.description}</p>
+        ) : null}
+      </div>
+      {hook.matcher ? (
+        <span className="shrink-0 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-500">
+          matcher: {hook.matcher}
+        </span>
+      ) : null}
+    </div>
+  );
+}
+
+function renderMcpRow(mcp: PluginMcp) {
+  return (
+    <div
+      key={mcp.id}
+      className="flex items-start justify-between gap-3 rounded-xl border border-gray-100 bg-white px-4 py-3 transition hover:border-gray-200"
+    >
+      <div className="min-w-0 flex-1">
+        <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">{mcp.name}</p>
+        {mcp.description ? (
+          <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">{mcp.description}</p>
+        ) : null}
+      </div>
+      <span className="shrink-0 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-500">
+        {mcp.transport} · {mcp.toolCount} tool{mcp.toolCount === 1 ? "" : "s"}
+      </span>
+    </div>
+  );
+}
+
+function renderAgentRow(agent: PluginAgent) {
+  return (
+    <div
+      key={agent.id}
+      className="rounded-xl border border-gray-100 bg-white px-4 py-3 transition hover:border-gray-200"
+    >
+      <p className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">{agent.name}</p>
+      {agent.description ? (
+        <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">{agent.description}</p>
+      ) : null}
+    </div>
+  );
+}
+
+function renderCommandRow(command: PluginCommand) {
+  return (
+    <div
+      key={command.id}
+      className="rounded-xl border border-gray-100 bg-white px-4 py-3 transition hover:border-gray-200"
+    >
+      <p className="truncate font-mono text-[13px] font-semibold text-gray-900">{command.name}</p>
+      {command.description ? (
+        <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">{command.description}</p>
+      ) : null}
+    </div>
+  );
+}
+
+export type { DenPlugin };
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugins-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugins-screen.tsx
new file mode 100644
index 0000000000..1384bfc324
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/plugins-screen.tsx
@@ -0,0 +1,463 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+import {
+  Cable,
+  FileText,
+  Puzzle,
+  Search,
+  Server,
+  Store,
+  Terminal,
+  Users,
+  Webhook,
+} from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { UnderlineTabs } from "../../../../_components/ui/tabs";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenInput } from "../../../../_components/ui/input";
+import { buttonVariants } from "../../../../_components/ui/button";
+import { getIntegrationsRoute, getPluginRoute } from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import { useHasAnyIntegration } from "./integration-data";
+import {
+  getPluginCategoryLabel,
+  getPluginPartsSummary,
+  usePlugins,
+} from "./plugin-data";
+
+type PluginView = "plugins" | "skills" | "agents" | "commands" | "hooks" | "mcps";
+
+const PLUGIN_TABS = [
+  { value: "plugins" as const, label: "Plugins", icon: Puzzle },
+  { value: "skills" as const, label: "Skills", icon: FileText },
+  { value: "agents" as const, label: "Agents", icon: Users },
+  { value: "commands" as const, label: "Commands", icon: Terminal },
+  { value: "hooks" as const, label: "Hooks", icon: Webhook },
+  { value: "mcps" as const, label: "MCPs", icon: Server },
+];
+
+export function PluginsScreen() {
+  const { orgSlug } = useOrgDashboard();
+  const { data: plugins = [], isLoading, error } = usePlugins();
+  const { hasAny: hasAnyIntegration, isLoading: integrationsLoading } = useHasAnyIntegration();
+  const [activeView, setActiveView] = useState<PluginView>("plugins");
+  const [query, setQuery] = useState("");
+
+  const normalizedQuery = query.trim().toLowerCase();
+
+  const filteredPlugins = useMemo(() => {
+    if (!normalizedQuery) {
+      return plugins;
+    }
+
+    return plugins.filter((plugin) => {
+      return (
+        plugin.name.toLowerCase().includes(normalizedQuery) ||
+        plugin.description.toLowerCase().includes(normalizedQuery) ||
+        plugin.author.toLowerCase().includes(normalizedQuery) ||
+        getPluginCategoryLabel(plugin.category).toLowerCase().includes(normalizedQuery)
+      );
+    });
+  }, [normalizedQuery, plugins]);
+
+  const allSkills = useMemo(
+    () =>
+      plugins.flatMap((plugin) =>
+        plugin.skills.map((skill) => ({ ...skill, pluginId: plugin.id, pluginName: plugin.name })),
+      ),
+    [plugins],
+  );
+
+  const allHooks = useMemo(
+    () =>
+      plugins.flatMap((plugin) =>
+        plugin.hooks.map((hook) => ({ ...hook, pluginId: plugin.id, pluginName: plugin.name })),
+      ),
+    [plugins],
+  );
+
+  const allMcps = useMemo(
+    () =>
+      plugins.flatMap((plugin) =>
+        plugin.mcps.map((mcp) => ({ ...mcp, pluginId: plugin.id, pluginName: plugin.name })),
+      ),
+    [plugins],
+  );
+
+  const allAgents = useMemo(
+    () =>
+      plugins.flatMap((plugin) =>
+        plugin.agents.map((agent) => ({ ...agent, pluginId: plugin.id, pluginName: plugin.name })),
+      ),
+    [plugins],
+  );
+
+  const allCommands = useMemo(
+    () =>
+      plugins.flatMap((plugin) =>
+        plugin.commands.map((command) => ({ ...command, pluginId: plugin.id, pluginName: plugin.name })),
+      ),
+    [plugins],
+  );
+
+  const filteredSkills = useMemo(() => {
+    if (!normalizedQuery) return allSkills;
+    return allSkills.filter(
+      (skill) =>
+        skill.name.toLowerCase().includes(normalizedQuery) ||
+        skill.description.toLowerCase().includes(normalizedQuery) ||
+        skill.pluginName.toLowerCase().includes(normalizedQuery),
+    );
+  }, [normalizedQuery, allSkills]);
+
+  const filteredHooks = useMemo(() => {
+    if (!normalizedQuery) return allHooks;
+    return allHooks.filter(
+      (hook) =>
+        hook.event.toLowerCase().includes(normalizedQuery) ||
+        hook.description.toLowerCase().includes(normalizedQuery) ||
+        hook.pluginName.toLowerCase().includes(normalizedQuery),
+    );
+  }, [normalizedQuery, allHooks]);
+
+  const filteredMcps = useMemo(() => {
+    if (!normalizedQuery) return allMcps;
+    return allMcps.filter(
+      (mcp) =>
+        mcp.name.toLowerCase().includes(normalizedQuery) ||
+        mcp.description.toLowerCase().includes(normalizedQuery) ||
+        mcp.pluginName.toLowerCase().includes(normalizedQuery),
+    );
+  }, [normalizedQuery, allMcps]);
+
+  const filteredAgents = useMemo(() => {
+    if (!normalizedQuery) return allAgents;
+    return allAgents.filter(
+      (agent) =>
+        agent.name.toLowerCase().includes(normalizedQuery) ||
+        agent.description.toLowerCase().includes(normalizedQuery) ||
+        agent.pluginName.toLowerCase().includes(normalizedQuery),
+    );
+  }, [normalizedQuery, allAgents]);
+
+  const filteredCommands = useMemo(() => {
+    if (!normalizedQuery) return allCommands;
+    return allCommands.filter(
+      (command) =>
+        command.name.toLowerCase().includes(normalizedQuery) ||
+        command.description.toLowerCase().includes(normalizedQuery) ||
+        command.pluginName.toLowerCase().includes(normalizedQuery),
+    );
+  }, [normalizedQuery, allCommands]);
+
+  const searchPlaceholder =
+    activeView === "plugins"
+      ? "Search plugins..."
+      : activeView === "skills"
+        ? "Search skills..."
+        : activeView === "agents"
+          ? "Search agents..."
+          : activeView === "commands"
+            ? "Search commands..."
+            : activeView === "hooks"
+              ? "Search hooks..."
+              : "Search MCPs...";
+
+  return (
+    <DashboardPageTemplate
+      icon={Puzzle}
+      badgeLabel="Preview"
+      title="Plugins"
+      description="Discover and manage plugins — bundles of skills, hooks, MCP servers, agents, and commands that extend your workers."
+      colors={["#EDE9FE", "#4C1D95", "#7C3AED", "#C4B5FD"]}
+    >
+      <div className="mb-8 flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
+        <div className="flex flex-col gap-4">
+          <UnderlineTabs tabs={PLUGIN_TABS} activeTab={activeView} onChange={setActiveView} />
+          <div>
+            <DenInput
+              type="search"
+              icon={Search}
+              value={query}
+              onChange={(event) => setQuery(event.target.value)}
+              placeholder={searchPlaceholder}
+            />
+          </div>
+        </div>
+      </div>
+
+      {error ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {error instanceof Error ? error.message : "Failed to load plugins."}
+        </div>
+      ) : null}
+
+      {isLoading || integrationsLoading ? (
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading plugin catalog...
+        </div>
+      ) : !hasAnyIntegration && plugins.length === 0 ? (
+        <ConnectIntegrationEmptyState integrationsHref={getIntegrationsRoute(orgSlug)} />
+      ) : activeView === "plugins" ? (
+        filteredPlugins.length === 0 ? (
+          <EmptyState
+            title={plugins.length === 0 ? "No plugins available yet." : "No plugins match that search."}
+            description={
+              plugins.length === 0
+                ? "Imported plugins and connected integration plugins will show up here when they are available."
+                : "Try a different search term or browse the skills, hooks, or MCPs tabs."
+            }
+          />
+        ) : (
+          <div className="grid gap-3 md:grid-cols-2">
+            {filteredPlugins.map((plugin) => (
+              <Link
+                key={plugin.id}
+                href={getPluginRoute(orgSlug, plugin.id)}
+                className="group block overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.12)]"
+              >
+                <div className="flex items-stretch">
+                  <div className="relative w-[68px] shrink-0 overflow-hidden">
+                    <div className="absolute inset-0">
+                      <PaperMeshGradient seed={plugin.id} speed={0} />
+                    </div>
+                    <div className="relative flex h-full items-center justify-center">
+                      <div className="flex h-10 w-10 items-center justify-center rounded-[12px] border border-white/60 bg-white shadow-[0_8px_20px_-8px_rgba(15,23,42,0.3)]">
+                        <Puzzle className="h-4 w-4 text-gray-700" aria-hidden />
+                      </div>
+                    </div>
+                  </div>
+
+                  <div className="min-w-0 flex-1 px-5 py-4">
+                    <div className="flex items-start justify-between gap-2">
+                      <h2 className="truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900">
+                        {plugin.name}
+                      </h2>
+                    </div>
+                    {plugin.description ? (
+                      <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">
+                        {plugin.description}
+                      </p>
+                    ) : null}
+
+                    {(plugin.marketplaces ?? []).length > 0 ? (
+                      <div className="mt-2.5 flex flex-wrap gap-1.5">
+                        {(plugin.marketplaces ?? []).map((marketplace) => (
+                          <span
+                            key={marketplace.id}
+                            className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-600"
+                          >
+                            <Store className="h-3 w-3 text-gray-400" aria-hidden />
+                            <span className="truncate">{marketplace.name}</span>
+                          </span>
+                        ))}
+                      </div>
+                    ) : null}
+
+                    <p className="mt-3 text-[11.5px] text-gray-400">
+                      {getPluginPartsSummary(plugin)}
+                    </p>
+                  </div>
+                </div>
+              </Link>
+            ))}
+          </div>
+        )
+      ) : activeView === "skills" ? (
+        <PrimitiveList
+          icon={FileText}
+          emptyLabel="No skills in this catalog yet."
+          emptyDescriptionEmpty="Once plugins contribute skills, they will show up here."
+          emptyDescriptionFiltered="No skills match that search."
+          unfilteredCount={allSkills.length}
+          rows={filteredSkills.map((skill) => ({
+            id: skill.id,
+            title: skill.name,
+            description: skill.description,
+            pluginName: skill.pluginName,
+            href: getPluginRoute(orgSlug, skill.pluginId),
+          }))}
+        />
+      ) : activeView === "agents" ? (
+        <PrimitiveList
+          icon={Users}
+          emptyLabel="No agents in this catalog yet."
+          emptyDescriptionEmpty="Agents declared by plugins will show up here."
+          emptyDescriptionFiltered="No agents match that search."
+          unfilteredCount={allAgents.length}
+          rows={filteredAgents.map((agent) => ({
+            id: agent.id,
+            title: agent.name,
+            description: agent.description,
+            pluginName: agent.pluginName,
+            href: getPluginRoute(orgSlug, agent.pluginId),
+          }))}
+        />
+      ) : activeView === "commands" ? (
+        <PrimitiveList
+          icon={Terminal}
+          emptyLabel="No commands in this catalog yet."
+          emptyDescriptionEmpty="Slash-commands declared by plugins will show up here."
+          emptyDescriptionFiltered="No commands match that search."
+          unfilteredCount={allCommands.length}
+          rows={filteredCommands.map((command) => ({
+            id: command.id,
+            title: command.name,
+            description: command.description,
+            pluginName: command.pluginName,
+            monospacedTitle: true,
+            href: getPluginRoute(orgSlug, command.pluginId),
+          }))}
+        />
+      ) : activeView === "hooks" ? (
+        <PrimitiveList
+          icon={Webhook}
+          emptyLabel="No hooks in this catalog yet."
+          emptyDescriptionEmpty="Hooks declared by plugins will show up here."
+          emptyDescriptionFiltered="No hooks match that search."
+          unfilteredCount={allHooks.length}
+          rows={filteredHooks.map((hook) => ({
+            id: hook.id,
+            title: hook.event,
+            description: hook.description,
+            pluginName: hook.pluginName,
+            monospacedTitle: true,
+            meta: hook.matcher ? `matcher: ${hook.matcher}` : undefined,
+            href: getPluginRoute(orgSlug, hook.pluginId),
+          }))}
+        />
+      ) : (
+        <PrimitiveList
+          icon={Server}
+          emptyLabel="No MCP servers in this catalog yet."
+          emptyDescriptionEmpty="MCP servers exposed by plugins will show up here."
+          emptyDescriptionFiltered="No MCPs match that search."
+          unfilteredCount={allMcps.length}
+          rows={filteredMcps.map((mcp) => ({
+            id: mcp.id,
+            title: mcp.name,
+            description: mcp.description,
+            pluginName: mcp.pluginName,
+            meta: `${mcp.transport} · ${mcp.toolCount} tool${mcp.toolCount === 1 ? "" : "s"}`,
+            href: getPluginRoute(orgSlug, mcp.pluginId),
+          }))}
+        />
+      )}
+    </DashboardPageTemplate>
+  );
+}
+
+function EmptyState({ title, description }: { title: string; description: string }) {
+  return (
+    <div className="rounded-[32px] border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+      <p className="text-[16px] font-medium tracking-[-0.03em] text-gray-900">{title}</p>
+      <p className="mx-auto mt-3 max-w-[520px] text-[15px] leading-8 text-gray-500">{description}</p>
+    </div>
+  );
+}
+
+function ConnectIntegrationEmptyState({ integrationsHref }: { integrationsHref: string }) {
+  return (
+    <div className="rounded-[32px] border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+      <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-[14px] bg-gray-100 text-gray-500">
+        <Cable className="h-6 w-6" />
+      </div>
+      <p className="text-[16px] font-medium tracking-[-0.03em] text-gray-900">
+        Connect an integration to discover plugins
+      </p>
+      <p className="mx-auto mt-3 max-w-[520px] text-[15px] leading-8 text-gray-500">
+        Plugins, skills, hooks, and MCP servers are sourced from the repositories you connect on the
+        Integrations page. Connect GitHub or Bitbucket to see your catalog populate.
+      </p>
+      <div className="mt-6 flex justify-center">
+        <Link
+          href={integrationsHref}
+          className={buttonVariants({ variant: "primary" })}
+        >
+          <Cable className="h-4 w-4" aria-hidden="true" />
+          Open Integrations
+        </Link>
+      </div>
+    </div>
+  );
+}
+
+type PrimitiveRow = {
+  id: string;
+  title: string;
+  description: string;
+  pluginName: string;
+  meta?: string;
+  monospacedTitle?: boolean;
+  href: string;
+};
+
+function PrimitiveList({
+  icon: Icon,
+  rows,
+  unfilteredCount,
+  emptyLabel,
+  emptyDescriptionEmpty,
+  emptyDescriptionFiltered,
+}: {
+  icon: React.ComponentType<{ className?: string }>;
+  rows: PrimitiveRow[];
+  unfilteredCount: number;
+  emptyLabel: string;
+  emptyDescriptionEmpty: string;
+  emptyDescriptionFiltered: string;
+}) {
+  if (rows.length === 0) {
+    return (
+      <EmptyState
+        title={unfilteredCount === 0 ? emptyLabel : "Nothing matches that search."}
+        description={unfilteredCount === 0 ? emptyDescriptionEmpty : emptyDescriptionFiltered}
+      />
+    );
+  }
+
+  return (
+    <div className="grid gap-3 md:grid-cols-2">
+      {rows.map((row) => (
+        <Link
+          key={row.id}
+          href={row.href}
+          className="group flex min-w-0 flex-col gap-3 rounded-2xl border border-gray-100 bg-white px-4 py-4 transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-12px_rgba(15,23,42,0.08)]"
+        >
+          <div className="flex min-w-0 items-start gap-3">
+            <div className="flex h-9 w-9 shrink-0 items-center justify-center rounded-[10px] bg-gray-50 text-gray-500 group-hover:bg-gray-100 group-hover:text-gray-700">
+              <Icon className="h-4 w-4" />
+            </div>
+            <div className="min-w-0 flex-1">
+              <p
+                className={`truncate text-[14px] font-semibold tracking-[-0.01em] text-gray-900 ${
+                  row.monospacedTitle ? "font-mono" : ""
+                }`}
+              >
+                {row.title}
+              </p>
+              {row.description ? (
+                <p className="mt-0.5 line-clamp-2 text-[12.5px] leading-[1.55] text-gray-500">
+                  {row.description}
+                </p>
+              ) : null}
+            </div>
+          </div>
+          <div className="flex flex-wrap items-center gap-1.5 border-t border-gray-50 pt-2.5">
+            <span className="inline-flex items-center gap-1 rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-500">
+              <Puzzle className="h-3 w-3 text-gray-400" aria-hidden />
+              <span className="max-w-[160px] truncate">{row.pluginName}</span>
+            </span>
+            {row.meta ? (
+              <span className="rounded-full bg-gray-50 px-2 py-0.5 text-[11px] text-gray-500">
+                {row.meta}
+              </span>
+            ) : null}
+          </div>
+        </Link>
+      ))}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-detail-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-detail-screen.tsx
new file mode 100644
index 0000000000..a202857348
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-detail-screen.tsx
@@ -0,0 +1,132 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo } from "react";
+import { ArrowLeft, FileText, Pencil } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { buttonVariants } from "../../../../_components/ui/button";
+import {
+  getEditSkillRoute,
+  getSkillHubsRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  formatSkillTimestamp,
+  getSkillBodyText,
+  getSkillVisibilityLabel,
+  parseSkillDraft,
+  useOrgSkillLibrary,
+} from "./skill-hub-data";
+
+export function SkillDetailScreen({ skillId }: { skillId: string }) {
+  const { orgId, orgSlug } = useOrgDashboard();
+  const { skills, busy, error } = useOrgSkillLibrary(orgId);
+  const skill = useMemo(
+    () => skills.find((entry) => entry.id === skillId) ?? null,
+    [skillId, skills],
+  );
+
+  if (busy && !skill) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-gray-100 bg-white px-5 py-8 text-[13px] text-gray-400">
+          Loading skill details...
+        </div>
+      </div>
+    );
+  }
+
+  if (!skill) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-red-100 bg-red-50 px-5 py-3.5 text-[13px] text-red-600">
+          {error ?? "That skill could not be found."}
+        </div>
+      </div>
+    );
+  }
+
+  const draft = parseSkillDraft(skill.skillText, {
+    name: skill.title,
+    description: skill.description,
+  });
+  const skillBody = getSkillBodyText(skill.skillText, {
+    name: skill.title,
+    description: skill.description,
+  });
+
+  return (
+    <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+
+      {/* Nav */}
+      <div className="mb-6 flex items-center justify-between gap-4">
+        <Link
+          href={getSkillHubsRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+
+        {skill.canManage ? (
+          <Link
+            href={getEditSkillRoute(orgSlug, skill.id)}
+            className={buttonVariants({ variant: "secondary", size: "sm" })}
+          >
+            <Pencil className="h-3.5 w-3.5" aria-hidden="true" />
+            Edit Skill
+          </Link>
+        ) : null}
+      </div>
+
+      <div className="grid gap-5">
+
+        {/* ── Main card ── */}
+        <section className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+
+          {/* Gradient header — seeded by skill id */}
+          <div className="relative h-40 overflow-hidden border-b border-gray-100">
+            <div className="absolute inset-0">
+              <PaperMeshGradient seed={skill.id} speed={0} />
+            </div>
+            <div className="absolute bottom-[-20px] left-6 flex h-14 w-14 items-center justify-center rounded-[18px] border border-white/60 bg-white shadow-[0_12px_24px_-12px_rgba(15,23,42,0.3)]">
+              <FileText className="h-6 w-6 text-gray-700" />
+            </div>
+          </div>
+
+          <div className="px-6 pb-6 pt-10">
+            {/* Title row with inline visibility label */}
+            <div className="flex items-start justify-between gap-4">
+              <h1 className="text-[18px] font-semibold text-gray-900">{skill.title}</h1>
+              <span className="mt-0.5 shrink-0 rounded-full bg-gray-100 px-3 py-1 text-[12px] text-gray-500">
+                {getSkillVisibilityLabel(skill.shared)}
+              </span>
+            </div>
+            {skill.description ? (
+              <p className="mt-1.5 text-[13px] leading-relaxed text-gray-400">
+                {skill.description}
+              </p>
+            ) : null}
+            <p className="mt-2 text-[12px] text-gray-300">
+              Updated {formatSkillTimestamp(skill.updatedAt)}
+            </p>
+
+            {/* Skill definition */}
+            <div className="mt-6 border-t border-gray-100 pt-5">
+              <p className="mb-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                Instructions
+              </p>
+              <div className="overflow-x-auto rounded-xl border border-gray-100 bg-gray-50 px-4 py-4">
+                <pre className="whitespace-pre-wrap font-mono text-[13px] leading-7 text-gray-700">
+                  {skillBody}
+                </pre>
+              </div>
+            </div>
+          </div>
+        </section>
+
+
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-editor-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-editor-screen.tsx
new file mode 100644
index 0000000000..8859873248
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-editor-screen.tsx
@@ -0,0 +1,308 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useMemo, useRef, useState } from "react";
+import { ArrowLeft, Upload } from "lucide-react";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenSelect } from "../../../../_components/ui/select";
+import { DenTextarea } from "../../../../_components/ui/textarea";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+  getSkillDetailRoute,
+  getSkillHubsRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  buildSkillText,
+  getSkillBodyText,
+  parseSkillDraft,
+  useOrgSkillLibrary,
+} from "./skill-hub-data";
+
+type SkillEditorMode = "manual" | "upload";
+type SkillVisibility = "private" | "org" | "public";
+
+export function SkillEditorScreen({ skillId }: { skillId?: string }) {
+  const router = useRouter();
+  const fileInputRef = useRef<HTMLInputElement | null>(null);
+  const { orgId, orgSlug } = useOrgDashboard();
+  const { skills, busy, error } = useOrgSkillLibrary(orgId);
+  const skill = useMemo(
+    () => (skillId ? skills.find((entry) => entry.id === skillId) ?? null : null),
+    [skillId, skills],
+  );
+  const [mode, setMode] = useState<SkillEditorMode>("manual");
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  const [details, setDetails] = useState("");
+  const [visibility, setVisibility] = useState<SkillVisibility>("private");
+  const [uploadedSkillText, setUploadedSkillText] = useState<string | null>(null);
+  const [uploadedFileName, setUploadedFileName] = useState<string | null>(null);
+  const [saveError, setSaveError] = useState<string | null>(null);
+  const [saving, setSaving] = useState(false);
+
+  const assembledPreview =
+    mode === "upload" && uploadedSkillText?.trim()
+      ? uploadedSkillText
+      : buildSkillText({ name, category: "", description, details });
+
+  useEffect(() => {
+    if (!skillId) {
+      setName("");
+      setDescription("");
+      setDetails("");
+      setVisibility("private");
+      setUploadedSkillText(null);
+      setUploadedFileName(null);
+      setMode("manual");
+      return;
+    }
+
+    if (!skill) return;
+
+    const draft = parseSkillDraft(skill.skillText, {
+      name: skill.title,
+      description: skill.description,
+    });
+    setName(draft.name || skill.title);
+    setDescription(draft.description || skill.description || "");
+    setDetails(getSkillBodyText(skill.skillText, {
+      name: skill.title,
+      description: skill.description,
+    }));
+    setVisibility(
+      skill.shared === "org" ? "org" : skill.shared === "public" ? "public" : "private",
+    );
+    setUploadedSkillText(null);
+    setUploadedFileName(null);
+    setMode("manual");
+  }, [skill, skillId]);
+
+  async function saveSkill() {
+    if (!orgId) { setSaveError("Organization not found."); return; }
+    if (!name.trim()) { setSaveError("Enter a skill name."); return; }
+
+    const skillText =
+      mode === "upload" && uploadedSkillText?.trim()
+        ? uploadedSkillText
+        : buildSkillText({ name, category: "", description, details });
+
+    setSaving(true);
+    setSaveError(null);
+    try {
+      const shared = visibility === "private" ? null : visibility;
+      if (skillId) {
+        const { response, payload } = await requestJson(
+          `/v1/skills/${encodeURIComponent(skillId)}`,
+          { method: "PATCH", body: JSON.stringify({ skillText, shared }) },
+          12000,
+        );
+        if (!response.ok) throw new Error(getErrorMessage(payload, `Failed to update skill (${response.status}).`));
+        router.push(getSkillDetailRoute(orgSlug, skillId));
+      } else {
+        const { response, payload } = await requestJson(
+          `/v1/skills`,
+          { method: "POST", body: JSON.stringify({ skillText, shared }) },
+          12000,
+        );
+        if (!response.ok) throw new Error(getErrorMessage(payload, `Failed to create skill (${response.status}).`));
+        const nextSkill =
+          payload && typeof payload === "object" && "skill" in payload && payload.skill && typeof payload.skill === "object"
+            ? (payload.skill as { id?: unknown })
+            : null;
+        const nextSkillId = typeof nextSkill?.id === "string" ? nextSkill.id : null;
+        if (!nextSkillId) throw new Error("The skill was created, but no skill id was returned.");
+        router.push(getSkillDetailRoute(orgSlug, nextSkillId));
+      }
+      router.refresh();
+    } catch (nextError) {
+      setSaveError(nextError instanceof Error ? nextError.message : "Could not save the skill.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function handleFileSelection(event: React.ChangeEvent<HTMLInputElement>) {
+    const file = event.target.files?.[0];
+    if (!file) return;
+    const text = await file.text();
+    const draft = parseSkillDraft(text);
+    setUploadedSkillText(text);
+    setUploadedFileName(file.name);
+    setName(draft.name || file.name.replace(/\.md$/i, ""));
+    setDescription(draft.description);
+    setDetails(getSkillBodyText(text));
+    setMode("upload");
+  }
+
+  if (busy && skillId && !skill) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-gray-100 bg-white px-5 py-8 text-[13px] text-gray-400">
+          Loading skill editor...
+        </div>
+      </div>
+    );
+  }
+
+  if (skillId && !skill) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-red-100 bg-red-50 px-5 py-3.5 text-[13px] text-red-600">
+          {error ?? "That skill could not be found."}
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+
+      {/* Nav */}
+      <div className="mb-6 flex items-center justify-between gap-4">
+        <Link
+          href={skillId ? getSkillDetailRoute(orgSlug, skillId) : getSkillHubsRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+
+        <DenButton loading={saving} onClick={() => void saveSkill()}>
+          {skillId ? "Save Skill" : "Create Skill"}
+        </DenButton>
+      </div>
+
+      {/* Error */}
+      {saveError ? (
+        <div className="mb-5 rounded-xl border border-red-100 bg-red-50 px-4 py-3 text-[13px] text-red-600">
+          {saveError}
+        </div>
+      ) : null}
+
+      <section className="rounded-2xl border border-gray-100 bg-white p-5 md:p-6">
+        {/* Mode toggle */}
+        <div className="mb-6 grid grid-cols-2 rounded-xl bg-gray-100/60 p-1 text-[13px] font-medium text-gray-500">
+          <button
+            type="button"
+            onClick={() => setMode("manual")}
+            className={`rounded-lg px-4 py-2 transition ${mode === "manual" ? "bg-white text-gray-900 shadow-sm" : "hover:text-gray-700"}`}
+          >
+            Manual Entry
+          </button>
+          <button
+            type="button"
+            onClick={() => setMode("upload")}
+            className={`rounded-lg px-4 py-2 transition ${mode === "upload" ? "bg-white text-gray-900 shadow-sm" : "hover:text-gray-700"}`}
+          >
+            Upload SKILL.md
+          </button>
+        </div>
+
+        {/* Upload zone */}
+        {mode === "upload" ? (
+          <div className="mb-6 rounded-xl border border-dashed border-gray-200 bg-gray-50 px-6 py-7 text-center">
+            <p className="text-[14px] font-medium text-gray-900">Upload a SKILL.md file</p>
+            <p className="mt-1.5 text-[13px] text-gray-400">
+              We'll keep the markdown source and prefill the fields for review.
+            </p>
+            <DenButton
+              variant="secondary"
+              size="sm"
+              icon={Upload}
+              className="mt-4"
+              onClick={() => fileInputRef.current?.click()}
+            >
+              {uploadedFileName ? `Replace ${uploadedFileName}` : "Choose file"}
+            </DenButton>
+            <input
+              ref={fileInputRef}
+              type="file"
+              accept=".md,text/markdown"
+              className="hidden"
+              onChange={(event) => void handleFileSelection(event)}
+            />
+          </div>
+        ) : null}
+
+        {/* Two-column form layout */}
+        <div className="grid gap-6 xl:grid-cols-[minmax(0,1fr)_320px]">
+
+          {/* Fields */}
+          <div className="grid gap-5">
+            <label className="grid gap-2">
+              <span className="text-[13px] font-medium text-gray-600">Skill Name</span>
+              <DenInput
+                type="text"
+                value={name}
+                onChange={(event) => setName(event.target.value)}
+              />
+            </label>
+
+            <label className="grid gap-2">
+              <span className="text-[13px] font-medium text-gray-600">Visibility</span>
+              <DenSelect
+                value={visibility}
+                onChange={(event) => setVisibility(event.target.value as SkillVisibility)}
+              >
+                <option value="private">Private</option>
+                <option value="org">Org</option>
+                <option value="public">Public</option>
+              </DenSelect>
+            </label>
+
+            <label className="grid gap-2">
+              <span className="text-[13px] font-medium text-gray-600">Short Description</span>
+              <DenTextarea
+                value={description}
+                onChange={(event) => setDescription(event.target.value)}
+                rows={3}
+              />
+            </label>
+
+            <label className="grid gap-2">
+              <span className="text-[13px] font-medium text-gray-600">
+                Detailed Instructions{" "}
+                <span className="font-normal text-gray-400">(Markdown)</span>
+              </span>
+              <DenTextarea
+                value={details}
+                onChange={(event) => setDetails(event.target.value)}
+                rows={16}
+                className="font-mono text-[13px] leading-7"
+              />
+            </label>
+          </div>
+
+          {/* Preview aside */}
+          <aside className="grid gap-3 self-start xl:sticky xl:top-8">
+            <div className="rounded-xl border border-gray-100 bg-white p-4">
+              <p className="mb-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                Markdown Preview
+              </p>
+              <div className="max-h-[480px] overflow-auto rounded-lg border border-gray-100 bg-gray-50 px-4 py-4">
+                <pre className="whitespace-pre-wrap font-mono text-[12px] leading-6 text-gray-600">
+                  {assembledPreview}
+                </pre>
+              </div>
+            </div>
+
+            {uploadedFileName ? (
+              <div className="rounded-xl border border-gray-100 bg-white p-4">
+                <p className="mb-1.5 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                  Uploaded Source
+                </p>
+                <p className="text-[13px] font-medium text-gray-900">{uploadedFileName}</p>
+                <p className="mt-1 text-[12px] leading-relaxed text-gray-400">
+                  Original markdown is preserved in upload mode.
+                </p>
+              </div>
+            ) : null}
+          </aside>
+        </div>
+      </section>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-data.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-data.tsx
new file mode 100644
index 0000000000..cebd3cb1fe
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-data.tsx
@@ -0,0 +1,405 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { composeSkillMarkdown, parseSkillMarkdown } from "@openwork-ee/utils";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+
+export type DenSkillShared = "org" | "public" | null;
+
+export type DenSkill = {
+  id: string;
+  organizationId: string;
+  createdByOrgMembershipId: string;
+  title: string;
+  description: string | null;
+  skillText: string;
+  shared: DenSkillShared;
+  createdAt: string | null;
+  updatedAt: string | null;
+  canManage: boolean;
+};
+
+export type DenSkillHubMemberAccess = {
+  id: string;
+  orgMembershipId: string;
+  role: string;
+  createdAt: string | null;
+  user: {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+  };
+};
+
+export type DenSkillHubTeamAccess = {
+  id: string;
+  teamId: string;
+  name: string;
+  createdAt: string | null;
+  updatedAt: string | null;
+};
+
+export type DenSkillHub = {
+  id: string;
+  organizationId: string;
+  createdByOrgMembershipId: string;
+  name: string;
+  description: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+  canManage: boolean;
+  accessibleVia: {
+    orgMembershipIds: string[];
+    teamIds: string[];
+  };
+  skills: DenSkill[];
+  access: {
+    members: DenSkillHubMemberAccess[];
+    teams: DenSkillHubTeamAccess[];
+  };
+};
+
+export type SkillComposerDraft = {
+  name: string;
+  description: string;
+  category: string;
+  details: string;
+};
+
+export const skillCategoryOptions = [
+  "Engineering",
+  "Workflow",
+  "Marketing",
+  "Operations",
+  "Sales",
+  "Support",
+  "General",
+];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asIsoString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function asStringList(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === "string") : [];
+}
+
+function asSkill(value: unknown): DenSkill | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const organizationId = asString(value.organizationId);
+  const createdByOrgMembershipId = asString(value.createdByOrgMembershipId);
+  const title = asString(value.title);
+  if (!id || !organizationId || !createdByOrgMembershipId || !title) {
+    return null;
+  }
+
+  const sharedValue = value.shared;
+  const shared: DenSkillShared = sharedValue === "org" || sharedValue === "public" ? sharedValue : null;
+
+  return {
+    id,
+    organizationId,
+    createdByOrgMembershipId,
+    title,
+    description: asString(value.description),
+    skillText: asString(value.skillText) ?? "",
+    shared,
+    createdAt: asIsoString(value.createdAt),
+    updatedAt: asIsoString(value.updatedAt),
+    canManage: value.canManage === true,
+  };
+}
+
+function asSkillHubMemberAccess(value: unknown): DenSkillHubMemberAccess | null {
+  if (!isRecord(value) || !isRecord(value.user)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const orgMembershipId = asString(value.orgMembershipId);
+  const role = asString(value.role);
+  const user = value.user;
+  const userId = asString(user.id);
+  const name = asString(user.name);
+  const email = asString(user.email);
+  if (!id || !orgMembershipId || !role || !userId || !name || !email) {
+    return null;
+  }
+
+  return {
+    id,
+    orgMembershipId,
+    role,
+    createdAt: asIsoString(value.createdAt),
+    user: {
+      id: userId,
+      name,
+      email,
+      image: asString(user.image),
+    },
+  };
+}
+
+function asSkillHubTeamAccess(value: unknown): DenSkillHubTeamAccess | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const teamId = asString(value.teamId);
+  const name = asString(value.name);
+  if (!id || !teamId || !name) {
+    return null;
+  }
+
+  return {
+    id,
+    teamId,
+    name,
+    createdAt: asIsoString(value.createdAt),
+    updatedAt: asIsoString(value.updatedAt),
+  };
+}
+
+function asSkillHub(value: unknown): DenSkillHub | null {
+  if (!isRecord(value) || !isRecord(value.access) || !isRecord(value.accessibleVia)) {
+    return null;
+  }
+
+  const id = asString(value.id);
+  const organizationId = asString(value.organizationId);
+  const createdByOrgMembershipId = asString(value.createdByOrgMembershipId);
+  const name = asString(value.name);
+  if (!id || !organizationId || !createdByOrgMembershipId || !name) {
+    return null;
+  }
+
+  const access = value.access;
+  const accessibleVia = value.accessibleVia;
+
+  return {
+    id,
+    organizationId,
+    createdByOrgMembershipId,
+    name,
+    description: asString(value.description),
+    createdAt: asIsoString(value.createdAt),
+    updatedAt: asIsoString(value.updatedAt),
+    canManage: value.canManage === true,
+    accessibleVia: {
+      orgMembershipIds: asStringList(accessibleVia.orgMembershipIds),
+      teamIds: asStringList(accessibleVia.teamIds),
+    },
+    skills: Array.isArray(value.skills) ? value.skills.map(asSkill).filter((entry): entry is DenSkill => entry !== null) : [],
+    access: {
+      members: Array.isArray(access.members)
+        ? access.members.map(asSkillHubMemberAccess).filter((entry): entry is DenSkillHubMemberAccess => entry !== null)
+        : [],
+      teams: Array.isArray(access.teams)
+        ? access.teams.map(asSkillHubTeamAccess).filter((entry): entry is DenSkillHubTeamAccess => entry !== null)
+        : [],
+    },
+  };
+}
+
+export function parseSkillCategory(skillText: string): string | null {
+  const match = skillText.match(/^category\s*:\s*(.+)$/im);
+  return match && match[1] ? match[1].trim() : null;
+}
+
+export function parseSkillDraft(skillText: string, fallback?: { name?: string | null; description?: string | null }): SkillComposerDraft {
+  const parsed = parseSkillMarkdown(skillText);
+  if (parsed.hasFrontmatter) {
+    return {
+      name: parsed.name || fallback?.name || "",
+      description: parsed.description || fallback?.description || "",
+      category: parseSkillCategory(skillText) ?? "General",
+      details: parsed.body.trim(),
+    };
+  }
+
+  const lines = skillText.split(/\r?\n/g);
+  const nonEmptyIndexes = lines.reduce<number[]>((indexes, line, index) => {
+    if (line.trim()) {
+      indexes.push(index);
+    }
+    return indexes;
+  }, []);
+
+  const titleIndex = nonEmptyIndexes[0] ?? -1;
+  const descriptionIndex = nonEmptyIndexes[1] ?? -1;
+  const categoryIndex = nonEmptyIndexes.find((index) => /^category\s*:/i.test(lines[index]?.trim() ?? "")) ?? -1;
+
+  const bodyStartIndex = categoryIndex >= 0
+    ? categoryIndex + 1
+    : descriptionIndex >= 0
+      ? descriptionIndex + 1
+      : titleIndex >= 0
+        ? titleIndex + 1
+        : 0;
+
+  const titleLine = titleIndex >= 0 ? lines[titleIndex] : fallback?.name ?? "";
+  const descriptionLine = descriptionIndex >= 0 ? lines[descriptionIndex] : fallback?.description ?? "";
+
+  return {
+    name: cleanupSkillMetadataLine(titleLine) || fallback?.name || "",
+    description: cleanupSkillMetadataLine(descriptionLine) || fallback?.description || "",
+    category: categoryIndex >= 0 ? lines[categoryIndex].replace(/^category\s*:/i, "").trim() : parseSkillCategory(skillText) ?? "General",
+    details: lines.slice(bodyStartIndex).join("\n").trim(),
+  };
+}
+
+export function getSkillBodyText(skillText: string, fallback?: { name?: string | null; description?: string | null }) {
+  const parsed = parseSkillMarkdown(skillText);
+  if (parsed.hasFrontmatter) {
+    return parsed.body.trim();
+  }
+
+  const draft = parseSkillDraft(skillText, fallback);
+  return draft.details || skillText;
+}
+
+export function getSkillBodyPreview(skillText: string, fallback?: { name?: string | null; description?: string | null }) {
+  const body = getSkillBodyText(skillText, fallback)
+    .replace(/^#{1,6}\s+/gm, "")
+    .replace(/^[-*+]\s+/gm, "")
+    .trim();
+
+  if (!body) {
+    return null;
+  }
+
+  const firstParagraph = body
+    .split(/\n\s*\n/g)
+    .map((section) => section.trim())
+    .find(Boolean);
+
+  return firstParagraph ?? null;
+}
+
+function cleanupSkillMetadataLine(value: string): string {
+  return value
+    .replace(/^#{1,6}\s+/, "")
+    .replace(/^[-*+]\s+/, "")
+    .replace(/^title\s*:\s*/i, "")
+    .replace(/^description\s*:\s*/i, "")
+    .trim();
+}
+
+export function buildSkillText(input: SkillComposerDraft): string {
+  return composeSkillMarkdown(input.name, input.description, input.details);
+}
+
+export function getSkillVisibilityLabel(shared: DenSkillShared): string {
+  if (shared === "org") {
+    return "Org";
+  }
+  if (shared === "public") {
+    return "Public";
+  }
+  return "Private";
+}
+
+export function formatSkillTimestamp(value: string | null) {
+  if (!value) {
+    return "Recently updated";
+  }
+
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "Recently updated";
+  }
+
+  return new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+  }).format(date);
+}
+
+export function getHubAccent(seed: string) {
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = (hash * 33 + seed.charCodeAt(index)) % 360;
+  }
+
+  const hue = hash;
+  const gradient = `radial-gradient(circle at 18% 18%, hsla(${(hue + 18) % 360} 92% 92% / 0.95) 0%, transparent 38%), linear-gradient(135deg, hsl(${hue} 85% 78%) 0%, hsl(${(hue + 32) % 360} 92% 86%) 48%, hsl(${(hue + 86) % 360} 78% 86%) 100%)`;
+
+  return {
+    gradient,
+    grain: `radial-gradient(circle at 20% 20%, rgba(255,255,255,0.65) 0%, rgba(255,255,255,0) 45%), radial-gradient(circle at 80% 30%, rgba(255,255,255,0.48) 0%, rgba(255,255,255,0) 35%), radial-gradient(circle at 55% 78%, rgba(15,23,42,0.08) 0%, rgba(15,23,42,0) 42%)`,
+  };
+}
+
+export function useOrgSkillLibrary(orgId: string | null) {
+  const [skills, setSkills] = useState<DenSkill[]>([]);
+  const [skillHubs, setSkillHubs] = useState<DenSkillHub[]>([]);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function loadLibrary() {
+    if (!orgId) {
+      setSkills([]);
+      setSkillHubs([]);
+      setError("Organization not found.");
+      return;
+    }
+
+    setBusy(true);
+    setError(null);
+    try {
+      const [skillsResult, skillHubsResult] = await Promise.all([
+        requestJson(`/v1/skills`, { method: "GET" }, 12000),
+        requestJson(`/v1/skill-hubs`, { method: "GET" }, 12000),
+      ]);
+
+      if (!skillsResult.response.ok) {
+        throw new Error(getErrorMessage(skillsResult.payload, `Failed to load skills (${skillsResult.response.status}).`));
+      }
+
+      if (!skillHubsResult.response.ok) {
+        throw new Error(getErrorMessage(skillHubsResult.payload, `Failed to load skill hubs (${skillHubsResult.response.status}).`));
+      }
+
+      const nextSkills = isRecord(skillsResult.payload) && Array.isArray(skillsResult.payload.skills)
+        ? skillsResult.payload.skills.map(asSkill).filter((entry): entry is DenSkill => entry !== null)
+        : [];
+      const nextSkillHubs = isRecord(skillHubsResult.payload) && Array.isArray(skillHubsResult.payload.skillHubs)
+        ? skillHubsResult.payload.skillHubs.map(asSkillHub).filter((entry): entry is DenSkillHub => entry !== null)
+        : [];
+
+      setSkills(nextSkills);
+      setSkillHubs(nextSkillHubs);
+    } catch (loadError) {
+      setError(loadError instanceof Error ? loadError.message : "Failed to load the skill library.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  useEffect(() => {
+    void loadLibrary();
+  }, [orgId]);
+
+  return {
+    skills,
+    skillHubs,
+    busy,
+    error,
+    reloadLibrary: loadLibrary,
+  };
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-detail-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-detail-screen.tsx
new file mode 100644
index 0000000000..f5f3638de2
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-detail-screen.tsx
@@ -0,0 +1,188 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo } from "react";
+import { ArrowLeft, BookOpen, Pencil } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { buttonVariants } from "../../../../_components/ui/button";
+import {
+  getEditSkillHubRoute,
+  getSkillDetailRoute,
+  getSkillHubsRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  formatSkillTimestamp,
+  getSkillVisibilityLabel,
+  parseSkillCategory,
+  useOrgSkillLibrary,
+} from "./skill-hub-data";
+
+export function SkillHubDetailScreen({ skillHubId }: { skillHubId: string }) {
+  const { orgId, orgSlug } = useOrgDashboard();
+  const { skillHubs, busy, error } = useOrgSkillLibrary(orgId);
+  const skillHub = useMemo(
+    () => skillHubs.find((entry) => entry.id === skillHubId) ?? null,
+    [skillHubId, skillHubs],
+  );
+
+  if (busy && !skillHub) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-gray-100 bg-white px-5 py-8 text-[13px] text-gray-400">
+          Loading hub details...
+        </div>
+      </div>
+    );
+  }
+
+  if (!skillHub) {
+    return (
+      <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+        <div className="rounded-xl border border-red-100 bg-red-50 px-5 py-3.5 text-[13px] text-red-600">
+          {error ?? "That hub could not be found."}
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="mx-auto max-w-[900px] px-6 py-8 md:px-8">
+
+      {/* Nav */}
+      <div className="mb-6 flex items-center justify-between gap-4">
+        <Link
+          href={getSkillHubsRoute(orgSlug)}
+          className="inline-flex items-center gap-1.5 text-[13px] text-gray-400 transition hover:text-gray-700"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back
+        </Link>
+
+        {skillHub.canManage ? (
+          <Link
+            href={getEditSkillHubRoute(orgSlug, skillHub.id)}
+            className={buttonVariants({ variant: "secondary", size: "sm" })}
+          >
+            <Pencil className="h-3.5 w-3.5" aria-hidden="true" />
+            Edit Hub
+          </Link>
+        ) : null}
+      </div>
+
+      <div className="grid gap-5 xl:grid-cols-[minmax(0,1fr)_240px]">
+
+        {/* ── Main card ── */}
+        <section className="overflow-hidden rounded-2xl border border-gray-100 bg-white">
+
+          {/* Gradient header — seeded by hub id, matches list card */}
+          <div className="relative h-40 overflow-hidden border-b border-gray-100">
+            <div className="absolute inset-0">
+              <PaperMeshGradient seed={skillHub.id} speed={0} />
+            </div>
+            <div className="absolute bottom-[-20px] left-6 flex h-14 w-14 items-center justify-center rounded-[18px] border border-white/60 bg-white shadow-[0_12px_24px_-12px_rgba(15,23,42,0.3)]">
+              <BookOpen className="h-6 w-6 text-gray-700" />
+            </div>
+          </div>
+
+          <div className="px-6 pb-6 pt-10">
+            {/* Title + description + last updated */}
+            <h1 className="text-[18px] font-semibold text-gray-900">{skillHub.name}</h1>
+            {skillHub.description ? (
+              <p className="mt-1.5 text-[13px] leading-relaxed text-gray-400">
+                {skillHub.description}
+              </p>
+            ) : null}
+            <p className="mt-2 text-[12px] text-gray-300">
+              Updated {formatSkillTimestamp(skillHub.updatedAt)}
+            </p>
+
+            {/* Included skills */}
+            <div className="mt-6 border-t border-gray-100 pt-5">
+              <p className="mb-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                {skillHub.skills.length === 0
+                  ? "No skills yet"
+                  : `${skillHub.skills.length} ${skillHub.skills.length === 1 ? "Skill" : "Skills"}`}
+              </p>
+
+              {skillHub.skills.length === 0 ? (
+                <div className="rounded-xl border border-dashed border-gray-100 px-5 py-6 text-[13px] text-gray-400">
+                  This hub does not include any skills yet.
+                </div>
+              ) : (
+                <div className="grid gap-1.5">
+                  {skillHub.skills.map((skill) => (
+                    <Link
+                      key={skill.id}
+                      href={getSkillDetailRoute(orgSlug, skill.id)}
+                      className="flex items-center justify-between gap-4 rounded-xl border border-gray-100 px-4 py-3 transition hover:border-gray-200 hover:bg-gray-50/60"
+                    >
+                      <div className="min-w-0">
+                        <p className="truncate text-[13px] font-medium text-gray-900">
+                          {skill.title}
+                        </p>
+                        {skill.description ? (
+                          <p className="mt-0.5 truncate text-[12px] text-gray-400">
+                            {skill.description}
+                          </p>
+                        ) : null}
+                      </div>
+                      <span className="shrink-0 rounded-full bg-gray-100 px-2.5 py-0.5 text-[11px] text-gray-400">
+                        {parseSkillCategory(skill.skillText) ?? getSkillVisibilityLabel(skill.shared)}
+                      </span>
+                    </Link>
+                  ))}
+                </div>
+              )}
+            </div>
+          </div>
+        </section>
+
+        {/* ── Sidebar ── */}
+        <aside className="grid gap-3 self-start">
+
+          {/* Teams */}
+          <div className="rounded-xl border border-gray-100 bg-white p-4">
+            <p className="mb-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+              Teams
+            </p>
+            {skillHub.access.teams.length === 0 ? (
+              <span className="text-[13px] text-gray-400">No teams assigned.</span>
+            ) : (
+              <div className="flex flex-wrap gap-1.5">
+                {skillHub.access.teams.map((team) => (
+                  <span
+                    key={team.teamId}
+                    className="rounded-full bg-gray-100 px-3 py-1 text-[12px] text-gray-500"
+                  >
+                    {team.name}
+                  </span>
+                ))}
+              </div>
+            )}
+          </div>
+
+          {/* Direct access — only show when populated */}
+          {skillHub.access.members.length > 0 ? (
+            <div className="rounded-xl border border-gray-100 bg-white p-4">
+              <p className="mb-3 text-[11px] font-medium uppercase tracking-wide text-gray-400">
+                Direct Access
+              </p>
+              <div className="divide-y divide-gray-100">
+                {skillHub.access.members.map((member) => (
+                  <div key={member.id} className="py-2.5 first:pt-0 last:pb-0">
+                    <p className="text-[13px] font-medium text-gray-900">
+                      {member.user.name}
+                    </p>
+                    <p className="text-[12px] text-gray-400">{member.user.email}</p>
+                  </div>
+                ))}
+              </div>
+            </div>
+          ) : null}
+
+        </aside>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-editor-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-editor-screen.tsx
new file mode 100644
index 0000000000..1b99c59e06
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hub-editor-screen.tsx
@@ -0,0 +1,599 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useMemo, useState } from "react";
+import {
+    ArrowLeft,
+    BookOpen,
+    CheckCircle2,
+    Circle,
+    Search,
+} from "lucide-react";
+import { DenButton } from "../../../../_components/ui/button";
+import { DenInput } from "../../../../_components/ui/input";
+import { DenTextarea } from "../../../../_components/ui/textarea";
+import { getErrorMessage, requestJson } from "../../../../_lib/den-flow";
+import {
+    getOrgAccessFlags,
+    getSkillHubsRoute,
+    getSkillHubRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+    getSkillVisibilityLabel,
+    parseSkillCategory,
+    useOrgSkillLibrary,
+} from "./skill-hub-data";
+
+export function SkillHubEditorScreen({ skillHubId }: { skillHubId?: string }) {
+    const router = useRouter();
+    const { orgId, orgSlug, orgContext } = useOrgDashboard();
+    const { skills, skillHubs, busy, error, reloadLibrary } =
+        useOrgSkillLibrary(orgId);
+    const skillHub = useMemo(
+        () =>
+            skillHubId
+                ? (skillHubs.find((entry) => entry.id === skillHubId) ?? null)
+                : null,
+        [skillHubId, skillHubs],
+    );
+
+    const access = useMemo(
+        () =>
+            getOrgAccessFlags(
+                orgContext?.currentMember.role ?? "member",
+                orgContext?.currentMember.isOwner ?? false,
+            ),
+        [orgContext?.currentMember.isOwner, orgContext?.currentMember.role],
+    );
+
+    const canManage = skillHubId ? skillHub?.canManage === true : true;
+    const [name, setName] = useState("");
+    const [description, setDescription] = useState("");
+    const [selectedTeamIds, setSelectedTeamIds] = useState<string[]>([]);
+    const [selectedSkillIds, setSelectedSkillIds] = useState<string[]>([]);
+    const [skillQuery, setSkillQuery] = useState("");
+    const [saveError, setSaveError] = useState<string | null>(null);
+    const [saving, setSaving] = useState(false);
+
+    useEffect(() => {
+        if (skillHubId) {
+            if (!skillHub) {
+                return;
+            }
+
+            setName(skillHub.name);
+            setDescription(skillHub.description ?? "");
+            setSelectedTeamIds(
+                skillHub.access.teams.map((entry) => entry.teamId),
+            );
+            setSelectedSkillIds(skillHub.skills.map((entry) => entry.id));
+            return;
+        }
+
+        setName("");
+        setDescription("");
+        setSelectedTeamIds([]);
+        setSelectedSkillIds([]);
+    }, [skillHub, skillHubId]);
+
+    const filteredSkills = useMemo(() => {
+        const normalizedQuery = skillQuery.trim().toLowerCase();
+        if (!normalizedQuery) {
+            return skills;
+        }
+
+        return skills.filter((skill) => {
+            const category = parseSkillCategory(skill.skillText) ?? "";
+            return (
+                skill.title.toLowerCase().includes(normalizedQuery) ||
+                (skill.description ?? "")
+                    .toLowerCase()
+                    .includes(normalizedQuery) ||
+                category.toLowerCase().includes(normalizedQuery)
+            );
+        });
+    }, [skillQuery, skills]);
+
+    const currentTeamAccessById = useMemo(
+        () =>
+            new Map(
+                (skillHub?.access.teams ?? []).map((entry) => [
+                    entry.teamId,
+                    entry.id,
+                ]),
+            ),
+        [skillHub?.access.teams],
+    );
+
+    const currentSkillIds = useMemo(
+        () => new Set(skillHub?.skills.map((entry) => entry.id) ?? []),
+        [skillHub?.skills],
+    );
+
+    async function saveHub() {
+        if (!orgId) {
+            setSaveError("Organization not found.");
+            return;
+        }
+
+        if (!name.trim()) {
+            setSaveError("Enter a hub name.");
+            return;
+        }
+
+        setSaving(true);
+        setSaveError(null);
+        try {
+            let nextSkillHubId = skillHubId ?? null;
+
+            if (!nextSkillHubId) {
+                const { response, payload } = await requestJson(
+                    `/v1/skill-hubs`,
+                    {
+                        method: "POST",
+                        body: JSON.stringify({
+                            name: name.trim(),
+                            description: description.trim() || null,
+                        }),
+                    },
+                    12000,
+                );
+
+                if (!response.ok) {
+                    throw new Error(
+                        getErrorMessage(
+                            payload,
+                            `Failed to create hub (${response.status}).`,
+                        ),
+                    );
+                }
+
+                const nextHub =
+                    payload &&
+                    typeof payload === "object" &&
+                    payload &&
+                    "skillHub" in payload &&
+                    payload.skillHub &&
+                    typeof payload.skillHub === "object"
+                        ? (payload.skillHub as { id?: unknown })
+                        : null;
+                nextSkillHubId =
+                    typeof nextHub?.id === "string" ? nextHub.id : null;
+                if (!nextSkillHubId) {
+                    throw new Error(
+                        "The hub was created, but no hub id was returned.",
+                    );
+                }
+            } else if (
+                skillHub &&
+                (skillHub.name !== name.trim() ||
+                    (skillHub.description ?? "") !== description.trim())
+            ) {
+                const { response, payload } = await requestJson(
+                    `/v1/skill-hubs/${encodeURIComponent(nextSkillHubId)}`,
+                    {
+                        method: "PATCH",
+                        body: JSON.stringify({
+                            name: name.trim(),
+                            description: description.trim() || null,
+                        }),
+                    },
+                    12000,
+                );
+
+                if (!response.ok) {
+                    throw new Error(
+                        getErrorMessage(
+                            payload,
+                            `Failed to update hub (${response.status}).`,
+                        ),
+                    );
+                }
+            }
+
+            const teamIdsToAdd = selectedTeamIds.filter(
+                (teamId) => !currentTeamAccessById.has(teamId),
+            );
+            const teamAccessIdsToRemove = [...currentTeamAccessById.entries()]
+                .filter(([teamId]) => !selectedTeamIds.includes(teamId))
+                .map(([, accessId]) => accessId);
+            const skillIdsToAdd = selectedSkillIds.filter(
+                (entry) => !currentSkillIds.has(entry),
+            );
+            const skillIdsToRemove = [...currentSkillIds].filter(
+                (entry) => !selectedSkillIds.includes(entry),
+            );
+
+            await Promise.all(
+                teamIdsToAdd.map(async (teamId) => {
+                    const { response, payload } = await requestJson(
+                        `/v1/skill-hubs/${encodeURIComponent(nextSkillHubId)}/access`,
+                        {
+                            method: "POST",
+                            body: JSON.stringify({ teamId }),
+                        },
+                        12000,
+                    );
+
+                    if (!response.ok) {
+                        throw new Error(
+                            getErrorMessage(
+                                payload,
+                                `Failed to grant team access (${response.status}).`,
+                            ),
+                        );
+                    }
+                }),
+            );
+
+            await Promise.all(
+                teamAccessIdsToRemove.map(async (accessId) => {
+                    const { response, payload } = await requestJson(
+                        `/v1/skill-hubs/${encodeURIComponent(nextSkillHubId)}/access/${encodeURIComponent(accessId)}`,
+                        { method: "DELETE" },
+                        12000,
+                    );
+
+                    if (response.status !== 204 && !response.ok) {
+                        throw new Error(
+                            getErrorMessage(
+                                payload,
+                                `Failed to remove team access (${response.status}).`,
+                            ),
+                        );
+                    }
+                }),
+            );
+
+            await Promise.all(
+                skillIdsToAdd.map(async (entry) => {
+                    const { response, payload } = await requestJson(
+                        `/v1/skill-hubs/${encodeURIComponent(nextSkillHubId)}/skills`,
+                        {
+                            method: "POST",
+                            body: JSON.stringify({ skillId: entry }),
+                        },
+                        12000,
+                    );
+
+                    if (!response.ok) {
+                        throw new Error(
+                            getErrorMessage(
+                                payload,
+                                `Failed to add a skill (${response.status}).`,
+                            ),
+                        );
+                    }
+                }),
+            );
+
+            await Promise.all(
+                skillIdsToRemove.map(async (entry) => {
+                    const { response, payload } = await requestJson(
+                        `/v1/skill-hubs/${encodeURIComponent(nextSkillHubId)}/skills/${encodeURIComponent(entry)}`,
+                        { method: "DELETE" },
+                        12000,
+                    );
+
+                    if (response.status !== 204 && !response.ok) {
+                        throw new Error(
+                            getErrorMessage(
+                                payload,
+                                `Failed to remove a skill (${response.status}).`,
+                            ),
+                        );
+                    }
+                }),
+            );
+
+            await reloadLibrary();
+            router.push(
+                skillHubId
+                    ? getSkillHubRoute(orgSlug, nextSkillHubId)
+                    : getSkillHubsRoute(orgSlug),
+            );
+            router.refresh();
+        } catch (nextError) {
+            setSaveError(
+                nextError instanceof Error
+                    ? nextError.message
+                    : "Could not save the hub.",
+            );
+        } finally {
+            setSaving(false);
+        }
+    }
+
+    if (busy && skillHubId && !skillHub) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+                    Loading hub details...
+                </div>
+            </div>
+        );
+    }
+
+    if (skillHubId && !skillHub) {
+        return (
+            <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+                <div className="rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[15px] text-red-700">
+                    {error ?? "That hub could not be found."}
+                </div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="mx-auto max-w-[1180px] px-6 py-8 md:px-8">
+            <div className="mb-8 flex flex-col gap-3">
+                <p className="text-[12px] font-semibold uppercase tracking-[0.18em] text-gray-400">
+                    {skillHubId ? "Skill hub editor" : "Create a hub"}
+                </p>
+                <div className="flex flex-col gap-4 xl:flex-row xl:items-end xl:justify-between">
+                    <div>
+                        <h1 className="text-[34px] font-semibold tracking-[-0.07em] text-gray-950">
+                            {skillHubId
+                                ? (skillHub?.name ?? "Hub details")
+                                : "Create a new skill hub"}
+                        </h1>
+                        <p className="mt-3 max-w-[700px] text-[16px] leading-8 text-gray-500">
+                            Shape who can access this collection, then pick the
+                            exact skills each team should inherit.
+                        </p>
+                    </div>
+                </div>
+            </div>
+
+            <div className="mb-8 flex items-center justify-between gap-4">
+                <Link
+                    href={
+                        skillHubId
+                            ? getSkillHubRoute(orgSlug, skillHubId)
+                            : getSkillHubsRoute(orgSlug)
+                    }
+                    className="inline-flex items-center gap-2 text-[15px] font-medium text-gray-500 transition hover:text-gray-900"
+                >
+                    <ArrowLeft className="h-5 w-5" />
+                    Back
+                </Link>
+
+                {canManage ? (
+                    <DenButton loading={saving} onClick={() => void saveHub()}>
+                        {skillHubId ? "Save Hub" : "Create Hub"}
+                    </DenButton>
+                ) : (
+                    <span className="rounded-full border border-gray-200 bg-white px-4 py-2 text-[13px] font-medium text-gray-500">
+                        Read only
+                    </span>
+                )}
+            </div>
+
+            {saveError ? (
+                <div className="mb-6 rounded-[28px] border border-red-200 bg-red-50 px-6 py-4 text-[14px] text-red-700">
+                    {saveError}
+                </div>
+            ) : null}
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <h2 className="mb-8 text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                    Hub Details
+                </h2>
+                <div className="grid gap-6">
+                    <label className="grid gap-3">
+                        <span className="text-[14px] font-medium text-gray-700">
+                            Hub Name
+                        </span>
+                        <DenInput
+                            type="text"
+                            value={name}
+                            onChange={(event) => setName(event.target.value)}
+                            disabled={!canManage}
+                        />
+                    </label>
+                    <label className="grid gap-3">
+                        <span className="text-[14px] font-medium text-gray-700">
+                            Description
+                        </span>
+                        <DenTextarea
+                            value={description}
+                            onChange={(event) =>
+                                setDescription(event.target.value)
+                            }
+                            disabled={!canManage}
+                            rows={4}
+                        />
+                    </label>
+                </div>
+            </section>
+
+            <section className="mb-8 rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                    Assigned Teams
+                </h2>
+                <p className="mt-2 text-[15px] text-gray-500">
+                    Select which teams have access to this hub.
+                </p>
+                {skillHub?.access.members.length ? (
+                    <p className="mt-3 text-[13px] text-gray-400">
+                        {skillHub.access.members.length} direct member grant
+                        {skillHub.access.members.length === 1 ? "" : "s"}{" "}
+                        already exist and will stay in place.
+                    </p>
+                ) : null}
+
+                {orgContext?.teams.length ? (
+                    <div className="mt-8 grid gap-4 md:grid-cols-2">
+                        {orgContext.teams.map((team) => {
+                            const selected = selectedTeamIds.includes(team.id);
+                            return (
+                                <button
+                                    key={team.id}
+                                    type="button"
+                                    disabled={!canManage}
+                                    onClick={() => {
+                                        if (!canManage) {
+                                            return;
+                                        }
+                                        setSelectedTeamIds((current) =>
+                                            current.includes(team.id)
+                                                ? current.filter(
+                                                      (entry) =>
+                                                          entry !== team.id,
+                                                  )
+                                                : [...current, team.id],
+                                        );
+                                    }}
+                                    className={`flex min-h-[84px] items-center gap-4 rounded-[24px] border px-5 py-4 text-left transition ${
+                                        selected
+                                            ? "border-[#0f172a] bg-[#0f172a] text-white"
+                                            : "border-gray-200 bg-white text-gray-700 hover:border-gray-300"
+                                    } ${!canManage ? "cursor-default" : "cursor-pointer"}`}
+                                >
+                                    {selected ? (
+                                        <CheckCircle2 className="h-7 w-7 shrink-0" />
+                                    ) : (
+                                        <Circle className="h-7 w-7 shrink-0 text-gray-300" />
+                                    )}
+                                    <div>
+                                        <p className="text-[17px] font-medium tracking-[-0.03em]">
+                                            {team.name}
+                                        </p>
+                                        <p
+                                            className={`mt-1 text-[13px] ${selected ? "text-white/70" : "text-gray-400"}`}
+                                        >
+                                            {team.memberIds.length}{" "}
+                                            {team.memberIds.length === 1
+                                                ? "member"
+                                                : "members"}
+                                        </p>
+                                    </div>
+                                </button>
+                            );
+                        })}
+                    </div>
+                ) : (
+                    <div className="mt-8 rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                        Create teams from the Members page before assigning hub
+                        access.
+                    </div>
+                )}
+            </section>
+
+            <section className="rounded-[36px] border border-gray-200 bg-white p-8 shadow-[0_18px_48px_-34px_rgba(15,23,42,0.24)]">
+                <div className="mb-6 flex flex-col gap-4 lg:flex-row lg:items-center lg:justify-between">
+                    <div>
+                        <h2 className="text-[24px] font-semibold tracking-[-0.05em] text-gray-950">
+                            Hub Skills
+                        </h2>
+                        <p className="mt-2 text-[15px] text-gray-500">
+                            Select the skills to include in this hub.
+                        </p>
+                    </div>
+
+                    <div>
+                        <DenInput
+                            type="search"
+                            icon={Search}
+                            value={skillQuery}
+                            onChange={(event) =>
+                                setSkillQuery(event.target.value)
+                            }
+                            placeholder="Search skills..."
+                        />
+                    </div>
+                </div>
+
+                <div className="max-h-[560px] overflow-y-auto border-t border-gray-100 pt-6">
+                    {filteredSkills.length === 0 ? (
+                        <div className="rounded-[24px] border border-dashed border-gray-200 bg-gray-50 px-5 py-6 text-[15px] text-gray-500">
+                            No skills match that search.
+                        </div>
+                    ) : (
+                        <div className="grid gap-4">
+                            {filteredSkills.map((skill) => {
+                                const selected = selectedSkillIds.includes(
+                                    skill.id,
+                                );
+                                const isPrivateRestricted =
+                                    skill.shared === null &&
+                                    !skill.canManage &&
+                                    !access.isAdmin;
+                                return (
+                                    <button
+                                        key={skill.id}
+                                        type="button"
+                                        disabled={
+                                            !canManage || isPrivateRestricted
+                                        }
+                                        onClick={() => {
+                                            if (
+                                                !canManage ||
+                                                isPrivateRestricted
+                                            ) {
+                                                return;
+                                            }
+                                            setSelectedSkillIds((current) =>
+                                                current.includes(skill.id)
+                                                    ? current.filter(
+                                                          (entry) =>
+                                                              entry !==
+                                                              skill.id,
+                                                      )
+                                                    : [...current, skill.id],
+                                            );
+                                        }}
+                                        className={`flex items-start gap-4 rounded-[24px] border px-5 py-5 text-left transition ${
+                                            selected
+                                                ? "border-[#0f172a] bg-[#f8fafc]"
+                                                : "border-gray-200 bg-white hover:border-gray-300"
+                                        } ${isPrivateRestricted ? "cursor-not-allowed opacity-60" : !canManage ? "cursor-default" : "cursor-pointer"}`}
+                                    >
+                                        {selected ? (
+                                            <CheckCircle2 className="mt-0.5 h-7 w-7 shrink-0 text-[#0f172a]" />
+                                        ) : (
+                                            <Circle className="mt-0.5 h-7 w-7 shrink-0 text-gray-300" />
+                                        )}
+                                        <div className="min-w-0">
+                                            <div className="flex flex-wrap items-center gap-3">
+                                                <span className="text-[18px] font-semibold tracking-[-0.03em] text-gray-950">
+                                                    {skill.title}
+                                                </span>
+                                                <span className="rounded-full bg-gray-100 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.14em] text-gray-500">
+                                                    {parseSkillCategory(
+                                                        skill.skillText,
+                                                    ) ??
+                                                        getSkillVisibilityLabel(
+                                                            skill.shared,
+                                                        )}
+                                                </span>
+                                                <span className="rounded-full bg-gray-100 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.14em] text-gray-500">
+                                                    {getSkillVisibilityLabel(
+                                                        skill.shared,
+                                                    )}
+                                                </span>
+                                            </div>
+                                            <p className="mt-2 text-[15px] leading-7 text-gray-500">
+                                                {skill.description ||
+                                                    "No description yet."}
+                                            </p>
+                                            {isPrivateRestricted ? (
+                                                <p className="mt-3 text-[13px] text-amber-600">
+                                                    Private skills can only be
+                                                    added by their creator or an
+                                                    org admin.
+                                                </p>
+                                            ) : null}
+                                        </div>
+                                    </button>
+                                );
+                            })}
+                        </div>
+                    )}
+                </div>
+            </section>
+        </div>
+    );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hubs-screen.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hubs-screen.tsx
new file mode 100644
index 0000000000..7b42330ef2
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_components/skill-hubs-screen.tsx
@@ -0,0 +1,219 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+import { BookOpen, FileText, Plus, Search } from "lucide-react";
+import { PaperMeshGradient } from "@openwork/ui/react";
+import { UnderlineTabs } from "../../../../_components/ui/tabs";
+import { DashboardPageTemplate } from "../../../../_components/ui/dashboard-page-template";
+import { DenButton, buttonVariants } from "../../../../_components/ui/button";
+import { DenInput } from "../../../../_components/ui/input";
+import {
+  getNewSkillHubRoute,
+  getNewSkillRoute,
+  getSkillDetailRoute,
+  getSkillHubRoute,
+} from "../../../../_lib/den-org";
+import { useOrgDashboard } from "../_providers/org-dashboard-provider";
+import {
+  formatSkillTimestamp,
+  getSkillVisibilityLabel,
+  useOrgSkillLibrary,
+} from "./skill-hub-data";
+
+type SkillLibraryView = "hubs" | "skills";
+
+const SKILL_LIBRARY_TABS = [
+  { value: "hubs" as const, label: "Hubs", icon: BookOpen },
+  { value: "skills" as const, label: "All Skills", icon: FileText },
+];
+
+export function SkillHubsScreen() {
+  const { activeOrg, orgId, orgSlug, orgContext } = useOrgDashboard();
+  const { skills, skillHubs, busy, error } = useOrgSkillLibrary(orgId);
+  const [activeView, setActiveView] = useState<SkillLibraryView>("hubs");
+  const [query, setQuery] = useState("");
+
+  const filteredHubs = useMemo(() => {
+    const normalizedQuery = query.trim().toLowerCase();
+    if (!normalizedQuery) {
+      return skillHubs;
+    }
+
+    return skillHubs.filter((skillHub) => {
+      return (
+        skillHub.name.toLowerCase().includes(normalizedQuery) ||
+        (skillHub.description ?? "").toLowerCase().includes(normalizedQuery) ||
+        skillHub.access.teams.some((team) => team.name.toLowerCase().includes(normalizedQuery))
+      );
+    });
+  }, [query, skillHubs]);
+
+  const filteredSkills = useMemo(() => {
+    const normalizedQuery = query.trim().toLowerCase();
+    if (!normalizedQuery) {
+      return skills;
+    }
+
+    return skills.filter((skill) =>
+      skill.title.toLowerCase().includes(normalizedQuery) ||
+      (skill.description ?? "").toLowerCase().includes(normalizedQuery),
+    );
+  }, [query, skills]);
+
+  return (
+    <DashboardPageTemplate
+      icon={BookOpen}
+      badgeLabel="New"
+      title="Skill Hubs"
+      description="Curate shared skill libraries for each team, then publish reusable skills your whole organization can discover."
+      colors={["#FFF0F3", "#881337", "#F43F5E", "#FDA4AF"]}
+    >
+      <div className="mb-8 flex flex-col gap-4 xl:flex-row xl:items-center xl:justify-between">
+        <div className="flex flex-col gap-4">
+          <UnderlineTabs tabs={SKILL_LIBRARY_TABS} activeTab={activeView} onChange={setActiveView} />
+          <div>
+            <DenInput
+              type="search"
+              icon={Search}
+              value={query}
+              onChange={(event) => setQuery(event.target.value)}
+              placeholder={activeView === "hubs" ? "Search hubs..." : "Search skills..."}
+            />
+          </div>
+        </div>
+
+        <Link
+          href={activeView === "hubs" ? getNewSkillHubRoute(orgSlug) : getNewSkillRoute(orgSlug)}
+          className={buttonVariants({ variant: "primary" })}
+        >
+          <Plus className="h-4 w-4" aria-hidden="true" />
+          {activeView === "hubs" ? "Create Hub" : "Add Skill"}
+        </Link>
+      </div>
+
+      {error ? (
+        <div className="mb-6 rounded-[24px] border border-red-200 bg-red-50 px-5 py-4 text-[14px] text-red-700">
+          {error}
+        </div>
+      ) : null}
+
+      {busy ? (
+        <div className="rounded-[28px] border border-gray-200 bg-white px-6 py-10 text-[15px] text-gray-500">
+          Loading your skill library...
+        </div>
+      ) : activeView === "hubs" ? (
+        filteredHubs.length === 0 ? (
+          <div className="rounded-[32px] border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+            <p className="text-[16px] font-medium tracking-[-0.03em] text-gray-900">
+              {skillHubs.length === 0 ? "No skill hubs yet." : "No skill hubs match that search yet."}
+            </p>
+            <p className="mx-auto mt-3 max-w-[520px] text-[15px] leading-8 text-gray-500">
+              {skillHubs.length === 0
+                ? "Create your first hub to organize shared skills by team and control who can access each collection."
+                : "Try a different search term, or switch to All Skills to browse the individual skills already available in this org."}
+            </p>
+            {skillHubs.length === 0 && skills.length > 0 ? (
+              <DenButton
+                variant="secondary"
+                className="mt-6"
+                onClick={() => setActiveView("skills")}
+              >
+                Browse all skills
+              </DenButton>
+            ) : null}
+          </div>
+        ) : (
+          <div className="grid gap-4 lg:grid-cols-2 2xl:grid-cols-3">
+            {filteredHubs.map((skillHub) => (
+              <Link
+                key={skillHub.id}
+                href={getSkillHubRoute(orgSlug, skillHub.id)}
+                className="block overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-8px_rgba(15,23,42,0.1)]"
+              >
+                {/* Gradient header */}
+                <div className="relative h-36 overflow-hidden border-b border-gray-100">
+                  <div className="absolute inset-0">
+                    <PaperMeshGradient seed={skillHub.id} speed={0} />
+                  </div>
+                  <div className="absolute bottom-[-20px] left-6 flex h-14 w-14 items-center justify-center rounded-[18px] border border-white/60 bg-white shadow-[0_12px_24px_-12px_rgba(15,23,42,0.3)]">
+                    <BookOpen className="h-6 w-6 text-gray-700" />
+                  </div>
+                </div>
+
+                {/* Body */}
+                <div className="px-6 pb-5 pt-9">
+                  <h2 className="mb-1.5 text-[15px] font-semibold text-gray-900">
+                    {skillHub.name}
+                  </h2>
+                  <p className="line-clamp-2 text-[13px] leading-[1.6] text-gray-400">
+                    {skillHub.description || "A curated library of reusable skills for this organization."}
+                  </p>
+
+                  <div className="mt-5 flex items-center gap-2 border-t border-gray-100 pt-4">
+                    <span className="inline-flex rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-500">
+                      {skillHub.skills.length} {skillHub.skills.length === 1 ? "Skill" : "Skills"}
+                    </span>
+                    <span className="ml-auto text-[13px] font-medium text-gray-500">
+                      View Hub
+                    </span>
+                  </div>
+                </div>
+              </Link>
+            ))}
+          </div>
+        )
+      ) : filteredSkills.length === 0 ? (
+        <div className="rounded-[32px] border border-dashed border-gray-200 bg-white px-6 py-12 text-center">
+          <p className="text-[16px] font-medium tracking-[-0.03em] text-gray-900">
+            {skills.length === 0 ? "No skills have been added yet." : "No skills match that search yet."}
+          </p>
+          <p className="mx-auto mt-3 max-w-[520px] text-[15px] leading-8 text-gray-500">
+            {skills.length === 0
+              ? "Add your first skill to start building the hub library, then group it into team-specific hubs."
+              : "Try a broader search or switch back to Hubs to manage curated collections."}
+          </p>
+        </div>
+      ) : (
+        <div className="grid gap-4 lg:grid-cols-2 2xl:grid-cols-3">
+          {filteredSkills.map((skill) => (
+            <Link
+              key={skill.id}
+              href={getSkillDetailRoute(orgSlug, skill.id)}
+              className="block overflow-hidden rounded-2xl border border-gray-100 bg-white transition hover:-translate-y-0.5 hover:border-gray-200 hover:shadow-[0_8px_24px_-8px_rgba(15,23,42,0.1)]"
+            >
+              {/* Gradient header — seeded by skill id */}
+              <div className="relative h-36 overflow-hidden border-b border-gray-100">
+                <div className="absolute inset-0">
+                  <PaperMeshGradient seed={skill.id} speed={0} />
+                </div>
+                <div className="absolute bottom-[-20px] left-6 flex h-14 w-14 items-center justify-center rounded-[18px] border border-white/60 bg-white shadow-[0_12px_24px_-12px_rgba(15,23,42,0.3)]">
+                  <FileText className="h-6 w-6 text-gray-700" />
+                </div>
+              </div>
+
+              {/* Body */}
+              <div className="px-6 pb-5 pt-9">
+                <h2 className="mb-1.5 text-[15px] font-semibold text-gray-900">
+                  {skill.title}
+                </h2>
+                <p className="line-clamp-2 text-[13px] leading-[1.6] text-gray-400">
+                  {skill.description || "Open this skill to view its instructions."}
+                </p>
+
+                <div className="mt-5 flex items-center gap-2 border-t border-gray-100 pt-4">
+                  <span className="inline-flex rounded-full bg-gray-100 px-3 py-1 text-[12px] font-medium text-gray-500">
+                    {getSkillVisibilityLabel(skill.shared)}
+                  </span>
+                  <span className="ml-auto text-[12px] text-gray-400">
+                    {formatSkillTimestamp(skill.updatedAt)}
+                  </span>
+                </div>
+              </div>
+            </Link>
+          ))}
+        </div>
+      )}
+    </DashboardPageTemplate>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/org-dashboard-provider.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/org-dashboard-provider.tsx
new file mode 100644
index 0000000000..bfa24b8bea
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/org-dashboard-provider.tsx
@@ -0,0 +1,511 @@
+"use client";
+
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+} from "react";
+import { usePathname, useRouter } from "next/navigation";
+import { useDenFlow } from "../../../../_providers/den-flow-provider";
+import { getErrorMessage, getOrgLimitError, requestJson } from "../../../../_lib/den-flow";
+import {
+  type DenDesktopAppRestrictions,
+  type DenOrgContext,
+  type DenOrgSummary,
+  getOrgDashboardRoute,
+  parseOrgContextPayload,
+  parseOrgListPayload,
+} from "../../../../_lib/den-org";
+
+type OrgDashboardContextValue = {
+  orgSlug: string | null;
+  orgId: string | null;
+  orgDirectory: DenOrgSummary[];
+  activeOrg: DenOrgSummary | null;
+  orgContext: DenOrgContext | null;
+  orgBusy: boolean;
+  orgError: string | null;
+  mutationBusy: string | null;
+  refreshOrgData: () => Promise<void>;
+  createOrganization: (name: string) => Promise<void>;
+  updateOrganizationName: (name: string) => Promise<void>;
+  updateOrganizationSettings: (input: { name?: string; allowedEmailDomains?: string[] | null; desktopAppRestrictions?: DenDesktopAppRestrictions; allowedDesktopVersions?: string[] | null }) => Promise<void>;
+  switchOrganization: (slug: string) => void;
+  inviteMember: (input: { email: string; role: string }) => Promise<void>;
+  cancelInvitation: (invitationId: string) => Promise<void>;
+  updateMemberRole: (memberId: string, role: string) => Promise<void>;
+  removeMember: (memberId: string) => Promise<void>;
+  createTeam: (input: { name: string; memberIds: string[] }) => Promise<void>;
+  updateTeam: (teamId: string, input: { name?: string; memberIds?: string[] }) => Promise<void>;
+  deleteTeam: (teamId: string) => Promise<void>;
+  createRole: (input: { roleName: string; permission: Record<string, string[]> }) => Promise<void>;
+  updateRole: (roleId: string, input: { roleName?: string; permission?: Record<string, string[]> }) => Promise<void>;
+  deleteRole: (roleId: string) => Promise<void>;
+};
+
+const OrgDashboardContext = createContext<OrgDashboardContextValue | null>(null);
+
+export function OrgDashboardProvider({
+  orgSlug,
+  children,
+}: {
+  orgSlug?: string | null;
+  children: React.ReactNode;
+}) {
+  const router = useRouter();
+  const pathname = usePathname();
+  const { user, sessionHydrated, signOut, refreshWorkers, workersLoadedOnce } = useDenFlow();
+  const [orgDirectory, setOrgDirectory] = useState<DenOrgSummary[]>([]);
+  const [orgContext, setOrgContext] = useState<DenOrgContext | null>(null);
+  const [orgBusy, setOrgBusy] = useState(false);
+  const [orgError, setOrgError] = useState<string | null>(null);
+  const [mutationBusy, setMutationBusy] = useState<string | null>(null);
+
+  const activeOrg = useMemo(
+    () =>
+      (orgSlug ? orgDirectory.find((entry) => entry.slug === orgSlug) : null) ??
+      orgDirectory.find((entry) => entry.isActive) ??
+      orgDirectory[0] ??
+      null,
+    [orgDirectory, orgSlug],
+  );
+
+  const activeOrgId = activeOrg?.id ?? orgContext?.organization.id ?? null;
+
+  function ensureActiveOrganizationSelected() {
+    if (!activeOrgId) {
+      throw new Error("Organization not found.");
+    }
+  }
+
+  async function loadOrgDirectory() {
+    const { response, payload } = await requestJson("/v1/me/orgs", { method: "GET" }, 12000);
+    if (!response.ok) {
+      throw new Error(getErrorMessage(payload, `Failed to load organizations (${response.status}).`));
+    }
+
+    return parseOrgListPayload(payload);
+  }
+
+  async function setActiveOrganization(input: { organizationId?: string | null; organizationSlug?: string | null }) {
+    const { response, payload } = await requestJson(
+      "/api/auth/organization/set-active",
+      {
+        method: "POST",
+        body: JSON.stringify(input),
+      },
+      12000,
+    );
+
+    if (!response.ok) {
+      throw new Error(getErrorMessage(payload, `Failed to switch organization (${response.status}).`));
+    }
+  }
+
+  async function loadOrgContext() {
+    const { response, payload } = await requestJson("/v1/org", { method: "GET" }, 12000);
+    if (!response.ok) {
+      throw new Error(getErrorMessage(payload, `Failed to load organization (${response.status}).`));
+    }
+
+    const parsed = parseOrgContextPayload(payload);
+    if (!parsed) {
+      throw new Error("Organization context response was incomplete.");
+    }
+
+    return parsed;
+  }
+
+  async function refreshOrgData() {
+    if (!user) {
+      setOrgDirectory([]);
+      setOrgContext(null);
+      setOrgError(null);
+      return;
+    }
+
+    setOrgBusy(true);
+    setOrgError(null);
+
+    try {
+      let directoryPayload = await loadOrgDirectory();
+      const fallbackOrg = directoryPayload.orgs.find((entry) => entry.isActive) ?? directoryPayload.orgs[0] ?? null;
+      const targetOrg = (orgSlug ? directoryPayload.orgs.find((entry) => entry.slug === orgSlug) : null) ?? fallbackOrg;
+
+      if (!targetOrg) {
+        setOrgDirectory([]);
+        setOrgContext(null);
+        router.replace("/organization");
+        return;
+      }
+
+      if (!targetOrg.isActive) {
+        await setActiveOrganization({ organizationId: targetOrg.id });
+        directoryPayload = await loadOrgDirectory();
+      }
+
+      const context = await loadOrgContext();
+
+      setOrgDirectory(directoryPayload.orgs.map((entry) => ({ ...entry, isActive: entry.id === context.organization.id })));
+      setOrgContext(context);
+      await refreshWorkers({ keepSelection: false, quiet: workersLoadedOnce });
+    } catch (error) {
+      setOrgError(error instanceof Error ? error.message : "Failed to load organization details.");
+    } finally {
+      setOrgBusy(false);
+    }
+  }
+
+  async function runMutation(label: string, action: () => Promise<void>) {
+    setMutationBusy(label);
+    setOrgError(null);
+    try {
+      await action();
+      await refreshOrgData();
+    } finally {
+      setMutationBusy(null);
+    }
+  }
+
+  async function createOrganization(name: string) {
+    const trimmed = name.trim();
+    if (!trimmed) {
+      throw new Error("Enter an organization name.");
+    }
+
+    setMutationBusy("create-organization");
+    setOrgError(null);
+    try {
+      const { response, payload } = await requestJson(
+        "/v1/org",
+        {
+          method: "POST",
+          body: JSON.stringify({ name: trimmed }),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        if (response.status === 402) {
+          router.push("/checkout");
+          return;
+        }
+        throw new Error(getErrorMessage(payload, `Failed to create organization (${response.status}).`));
+      }
+
+      const organization =
+        typeof payload === "object" && payload && "organization" in payload && payload.organization && typeof payload.organization === "object"
+          ? payload.organization as { slug?: unknown }
+          : null;
+      const nextSlug = typeof organization?.slug === "string" ? organization.slug : null;
+
+      if (!nextSlug) {
+        throw new Error("Organization was created, but no slug was returned.");
+      }
+
+      router.push(getOrgDashboardRoute(nextSlug));
+    } finally {
+      setMutationBusy(null);
+    }
+  }
+
+  function switchOrganization(nextSlug: string) {
+    const targetOrg = orgDirectory.find((entry) => entry.slug === nextSlug) ?? null;
+    if (!targetOrg) {
+      return;
+    }
+
+    void (async () => {
+      setMutationBusy("switch-organization");
+      setOrgError(null);
+
+      try {
+        await setActiveOrganization({ organizationId: targetOrg.id });
+        const context = await loadOrgContext();
+        setOrgDirectory((current) => current.map((entry) => ({ ...entry, isActive: entry.id === context.organization.id })));
+        setOrgContext(context);
+        await refreshWorkers({ keepSelection: false, quiet: workersLoadedOnce });
+
+        if (orgSlug && pathname.startsWith("/o/")) {
+          router.replace(getOrgDashboardRoute(nextSlug));
+          return;
+        }
+
+        router.refresh();
+      } catch (error) {
+        setOrgError(error instanceof Error ? error.message : "Failed to switch organization.");
+      } finally {
+        setMutationBusy(null);
+      }
+    })();
+  }
+
+  async function updateOrganizationName(name: string) {
+    const trimmed = name.trim();
+    if (!trimmed) {
+      throw new Error("Enter an organization name.");
+    }
+
+    await updateOrganizationSettings({ name: trimmed });
+  }
+
+  async function updateOrganizationSettings(input: { name?: string; allowedEmailDomains?: string[] | null; desktopAppRestrictions?: DenDesktopAppRestrictions; allowedDesktopVersions?: string[] | null }) {
+    const body: { name?: string; allowedEmailDomains?: string[] | null; desktopAppRestrictions?: DenDesktopAppRestrictions; allowedDesktopVersions?: string[] | null } = {};
+    if (typeof input.name === "string") {
+      const trimmed = input.name.trim();
+      if (!trimmed) {
+        throw new Error("Enter an organization name.");
+      }
+      body.name = trimmed;
+    }
+    if (input.allowedEmailDomains !== undefined) {
+      body.allowedEmailDomains = input.allowedEmailDomains;
+    }
+    if (input.desktopAppRestrictions !== undefined) {
+      body.desktopAppRestrictions = input.desktopAppRestrictions;
+    }
+    if (input.allowedDesktopVersions !== undefined) {
+      body.allowedDesktopVersions = input.allowedDesktopVersions;
+    }
+
+    await runMutation("update-organization-settings", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        "/v1/org",
+        {
+          method: "PATCH",
+          body: JSON.stringify(body),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to update organization (${response.status}).`));
+      }
+    });
+  }
+
+  async function inviteMember(input: { email: string; role: string }) {
+    await runMutation("invite-member", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        "/v1/invitations",
+        {
+          method: "POST",
+          body: JSON.stringify(input),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        const limitError = getOrgLimitError(payload);
+        if (limitError) {
+          throw limitError;
+        }
+        throw new Error(getErrorMessage(payload, `Failed to invite member (${response.status}).`));
+      }
+    });
+  }
+
+  async function cancelInvitation(invitationId: string) {
+    await runMutation("cancel-invitation", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/invitations/${encodeURIComponent(invitationId)}/cancel`,
+        { method: "POST", body: JSON.stringify({}) },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to cancel invitation (${response.status}).`));
+      }
+    });
+  }
+
+  async function updateMemberRole(memberId: string, role: string) {
+    await runMutation("update-member-role", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/members/${encodeURIComponent(memberId)}/role`,
+        {
+          method: "POST",
+          body: JSON.stringify({ role }),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to update member (${response.status}).`));
+      }
+    });
+  }
+
+  async function removeMember(memberId: string) {
+    await runMutation("remove-member", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/members/${encodeURIComponent(memberId)}`,
+        { method: "DELETE" },
+        12000,
+      );
+
+      if (response.status !== 204 && !response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to remove member (${response.status}).`));
+      }
+    });
+  }
+
+  async function createRole(input: { roleName: string; permission: Record<string, string[]> }) {
+    await runMutation("create-role", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        "/v1/roles",
+        {
+          method: "POST",
+          body: JSON.stringify(input),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to create role (${response.status}).`));
+      }
+    });
+  }
+
+  async function createTeam(input: { name: string; memberIds: string[] }) {
+    await runMutation("create-team", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        "/v1/teams",
+        {
+          method: "POST",
+          body: JSON.stringify(input),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to create team (${response.status}).`));
+      }
+    });
+  }
+
+  async function updateTeam(teamId: string, input: { name?: string; memberIds?: string[] }) {
+    await runMutation("update-team", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/teams/${encodeURIComponent(teamId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(input),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to update team (${response.status}).`));
+      }
+    });
+  }
+
+  async function deleteTeam(teamId: string) {
+    await runMutation("delete-team", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/teams/${encodeURIComponent(teamId)}`,
+        { method: "DELETE" },
+        12000,
+      );
+
+      if (response.status !== 204 && !response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to delete team (${response.status}).`));
+      }
+    });
+  }
+
+  async function updateRole(roleId: string, input: { roleName?: string; permission?: Record<string, string[]> }) {
+    await runMutation("update-role", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/roles/${encodeURIComponent(roleId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(input),
+        },
+        12000,
+      );
+
+      if (!response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to update role (${response.status}).`));
+      }
+    });
+  }
+
+  async function deleteRole(roleId: string) {
+    await runMutation("delete-role", async () => {
+      ensureActiveOrganizationSelected();
+      const { response, payload } = await requestJson(
+        `/v1/roles/${encodeURIComponent(roleId)}`,
+        { method: "DELETE" },
+        12000,
+      );
+
+      if (response.status !== 204 && !response.ok) {
+        throw new Error(getErrorMessage(payload, `Failed to delete role (${response.status}).`));
+      }
+    });
+  }
+
+  useEffect(() => {
+    if (!sessionHydrated) {
+      return;
+    }
+
+    if (!user) {
+      void signOut();
+      router.replace("/");
+      return;
+    }
+
+    void refreshOrgData();
+  }, [orgSlug, router, sessionHydrated, user?.id]);
+
+  const value: OrgDashboardContextValue = {
+    orgSlug: activeOrg?.slug ?? orgSlug ?? null,
+    orgId: activeOrgId,
+    orgDirectory,
+    activeOrg,
+    orgContext,
+    orgBusy,
+    orgError,
+    mutationBusy,
+    refreshOrgData,
+      createOrganization,
+      updateOrganizationName,
+      updateOrganizationSettings,
+      switchOrganization,
+      inviteMember,
+    cancelInvitation,
+    updateMemberRole,
+    removeMember,
+    createTeam,
+    updateTeam,
+    deleteTeam,
+    createRole,
+    updateRole,
+    deleteRole,
+  };
+
+  return <OrgDashboardContext.Provider value={value}>{children}</OrgDashboardContext.Provider>;
+}
+
+export function useOrgDashboard() {
+  const value = useContext(OrgDashboardContext);
+  if (!value) {
+    throw new Error("useOrgDashboard must be used within OrgDashboardProvider.");
+  }
+  return value;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/query-client-provider.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/query-client-provider.tsx
new file mode 100644
index 0000000000..f5eebee464
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/_providers/query-client-provider.tsx
@@ -0,0 +1,29 @@
+"use client";
+
+import { useState } from "react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+/**
+ * DashboardQueryClientProvider
+ *
+ * Scopes a single QueryClient instance to the org dashboard subtree.
+ * Keeps den-web's React Query surface narrow — any new dashboard feature
+ * (plugins, etc.) can use useQuery/useMutation without leaking client state
+ * across other top-level routes.
+ */
+export function DashboardQueryClientProvider({ children }: { children: React.ReactNode }) {
+  const [client] = useState(
+    () =>
+      new QueryClient({
+        defaultOptions: {
+          queries: {
+            staleTime: 30_000,
+            refetchOnWindowFocus: false,
+            retry: 1,
+          },
+        },
+      }),
+  );
+
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/api-keys/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/api-keys/page.tsx
new file mode 100644
index 0000000000..433d152d45
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/api-keys/page.tsx
@@ -0,0 +1,5 @@
+import { ApiKeysScreen } from "../_components/api-keys-screen";
+
+export default function ApiKeysPage() {
+  return <ApiKeysScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/background-agents/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/background-agents/page.tsx
new file mode 100644
index 0000000000..63a92e5ea5
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/background-agents/page.tsx
@@ -0,0 +1,5 @@
+import { BackgroundAgentsScreen } from "../_components/background-agents-screen";
+
+export default function BackgroundAgentsPage() {
+  return <BackgroundAgentsScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/billing/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/billing/page.tsx
new file mode 100644
index 0000000000..10c98cb399
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/billing/page.tsx
@@ -0,0 +1,5 @@
+import { BillingDashboardScreen } from "../_components/billing-dashboard-screen";
+
+export default function BillingPage() {
+  return <BillingDashboardScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx
new file mode 100644
index 0000000000..7a3a25ec37
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/edit/page.tsx
@@ -0,0 +1,10 @@
+import { LlmProviderEditorScreen } from "../../../_components/llm-provider-editor-screen";
+
+export default async function EditLlmProviderPage({
+  params,
+}: {
+  params: Promise<{ llmProviderId: string }>;
+}) {
+  const { llmProviderId } = await params;
+  return <LlmProviderEditorScreen llmProviderId={llmProviderId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/page.tsx
new file mode 100644
index 0000000000..6f04e8a33c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/[llmProviderId]/page.tsx
@@ -0,0 +1,10 @@
+import { LlmProviderDetailScreen } from "../../_components/llm-provider-detail-screen";
+
+export default async function LlmProviderPage({
+  params,
+}: {
+  params: Promise<{ llmProviderId: string }>;
+}) {
+  const { llmProviderId } = await params;
+  return <LlmProviderDetailScreen llmProviderId={llmProviderId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/new/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/new/page.tsx
new file mode 100644
index 0000000000..aa52ad6074
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/new/page.tsx
@@ -0,0 +1,5 @@
+import { LlmProviderEditorScreen } from "../../_components/llm-provider-editor-screen";
+
+export default function NewLlmProviderPage() {
+  return <LlmProviderEditorScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/page.tsx
new file mode 100644
index 0000000000..081573a56e
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/custom-llm-providers/page.tsx
@@ -0,0 +1,5 @@
+import { LlmProvidersScreen } from "../_components/llm-providers-screen";
+
+export default function CustomLlmProvidersPage() {
+  return <LlmProvidersScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/github/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/github/page.tsx
new file mode 100644
index 0000000000..afc700214c
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/github/page.tsx
@@ -0,0 +1,12 @@
+import { Suspense } from "react";
+import { GithubIntegrationScreen } from "../../_components/github-integration-screen";
+
+export const dynamic = "force-dynamic";
+
+export default function GithubIntegrationPage() {
+  return (
+    <Suspense fallback={null}>
+      <GithubIntegrationScreen />
+    </Suspense>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/page.tsx
new file mode 100644
index 0000000000..cd4aad6579
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/integrations/page.tsx
@@ -0,0 +1,5 @@
+import { IntegrationsScreen } from "../_components/integrations-screen";
+
+export default function IntegrationsPage() {
+  return <IntegrationsScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/layout.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/layout.tsx
new file mode 100644
index 0000000000..87d576e21d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/layout.tsx
@@ -0,0 +1,21 @@
+import { OrgDashboardShell } from "./_components/org-dashboard-shell";
+import { OrgDashboardProvider } from "./_providers/org-dashboard-provider";
+import { DashboardQueryClientProvider } from "./_providers/query-client-provider";
+
+export default async function OrgDashboardLayout({
+  children,
+  params,
+}: {
+  children: React.ReactNode;
+  params: Promise<{ orgSlug: string }>;
+}) {
+  const { orgSlug } = await params;
+
+  return (
+    <DashboardQueryClientProvider>
+      <OrgDashboardProvider orgSlug={orgSlug}>
+        <OrgDashboardShell>{children}</OrgDashboardShell>
+      </OrgDashboardProvider>
+    </DashboardQueryClientProvider>
+  );
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/manage-members/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/manage-members/page.tsx
new file mode 100644
index 0000000000..ac6d72cdc9
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/manage-members/page.tsx
@@ -0,0 +1,5 @@
+import { redirect } from "next/navigation";
+
+export default function ManageMembersRedirectPage() {
+  redirect("/dashboard/members");
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/[marketplaceId]/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/[marketplaceId]/page.tsx
new file mode 100644
index 0000000000..3e6e6fbf78
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/[marketplaceId]/page.tsx
@@ -0,0 +1,10 @@
+import { MarketplaceDetailScreen } from "../../_components/marketplace-detail-screen";
+
+export default async function MarketplaceDetailPage({
+  params,
+}: {
+  params: Promise<{ marketplaceId: string }>;
+}) {
+  const { marketplaceId } = await params;
+  return <MarketplaceDetailScreen marketplaceId={marketplaceId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/page.tsx
new file mode 100644
index 0000000000..3154efe418
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/marketplaces/page.tsx
@@ -0,0 +1,5 @@
+import { MarketplacesScreen } from "../_components/marketplaces-screen";
+
+export default function MarketplacesPage() {
+  return <MarketplacesScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/members/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/members/page.tsx
new file mode 100644
index 0000000000..a343c8995d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/members/page.tsx
@@ -0,0 +1,5 @@
+import { ManageMembersScreen } from "../_components/manage-members-screen";
+
+export default function MembersPage() {
+  return <ManageMembersScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/org-settings/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/org-settings/page.tsx
new file mode 100644
index 0000000000..2eb5f5c156
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/org-settings/page.tsx
@@ -0,0 +1,5 @@
+import { OrgSettingsScreen } from "../_components/org-settings-screen";
+
+export default function OrgSettingsPage() {
+  return <OrgSettingsScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/page.tsx
new file mode 100644
index 0000000000..c923aea7ae
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/page.tsx
@@ -0,0 +1,5 @@
+import { DashboardOverviewScreen } from "./_components/dashboard-overview-screen";
+
+export default function OrgDashboardPage() {
+  return <DashboardOverviewScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/[pluginId]/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/[pluginId]/page.tsx
new file mode 100644
index 0000000000..8f345ef934
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/[pluginId]/page.tsx
@@ -0,0 +1,11 @@
+import { PluginDetailScreen } from "../../_components/plugin-detail-screen";
+
+export default async function PluginPage({
+  params,
+}: {
+  params: Promise<{ pluginId: string }>;
+}) {
+  const { pluginId } = await params;
+
+  return <PluginDetailScreen pluginId={pluginId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/page.tsx
new file mode 100644
index 0000000000..debfe1b1e6
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/plugins/page.tsx
@@ -0,0 +1,5 @@
+import { PluginsScreen } from "../_components/plugins-screen";
+
+export default function PluginsPage() {
+  return <PluginsScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/edit/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/edit/page.tsx
new file mode 100644
index 0000000000..bc61abe7b5
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/edit/page.tsx
@@ -0,0 +1,11 @@
+import { SkillHubEditorScreen } from "../../../_components/skill-hub-editor-screen";
+
+export default async function EditSkillHubPage({
+  params,
+}: {
+  params: Promise<{ skillHubId: string }>;
+}) {
+  const { skillHubId } = await params;
+
+  return <SkillHubEditorScreen skillHubId={skillHubId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/page.tsx
new file mode 100644
index 0000000000..6c3c33e455
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/[skillHubId]/page.tsx
@@ -0,0 +1,11 @@
+import { SkillHubDetailScreen } from "../../_components/skill-hub-detail-screen";
+
+export default async function SkillHubPage({
+  params,
+}: {
+  params: Promise<{ skillHubId: string }>;
+}) {
+  const { skillHubId } = await params;
+
+  return <SkillHubDetailScreen skillHubId={skillHubId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/new/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/new/page.tsx
new file mode 100644
index 0000000000..7d9018217d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/new/page.tsx
@@ -0,0 +1,5 @@
+import { SkillHubEditorScreen } from "../../_components/skill-hub-editor-screen";
+
+export default function NewSkillHubPage() {
+  return <SkillHubEditorScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/page.tsx
new file mode 100644
index 0000000000..7e6b571c8d
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/page.tsx
@@ -0,0 +1,5 @@
+import { SkillHubsScreen } from "../_components/skill-hubs-screen";
+
+export default function SkillHubsPage() {
+  return <SkillHubsScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx
new file mode 100644
index 0000000000..bced68cc2b
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/edit/page.tsx
@@ -0,0 +1,11 @@
+import { SkillEditorScreen } from "../../../../_components/skill-editor-screen";
+
+export default async function EditSkillPage({
+  params,
+}: {
+  params: Promise<{ skillId: string }>;
+}) {
+  const { skillId } = await params;
+
+  return <SkillEditorScreen skillId={skillId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/page.tsx
new file mode 100644
index 0000000000..2fcff99919
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/[skillId]/page.tsx
@@ -0,0 +1,11 @@
+import { SkillDetailScreen } from "../../../_components/skill-detail-screen";
+
+export default async function SkillPage({
+  params,
+}: {
+  params: Promise<{ skillId: string }>;
+}) {
+  const { skillId } = await params;
+
+  return <SkillDetailScreen skillId={skillId} />;
+}
diff --git a/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/new/page.tsx b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/new/page.tsx
new file mode 100644
index 0000000000..0e13597885
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/o/[orgSlug]/dashboard/skill-hubs/skills/new/page.tsx
@@ -0,0 +1,5 @@
+import { SkillEditorScreen } from "../../../_components/skill-editor-screen";
+
+export default function NewSkillPage() {
+  return <SkillEditorScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/organization/page.tsx b/ee/apps/den-web/app/(den)/organization/page.tsx
new file mode 100644
index 0000000000..6c78794c5b
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/organization/page.tsx
@@ -0,0 +1,5 @@
+import { OrganizationScreen } from "../_components/organization-screen";
+
+export default function OrganizationPage() {
+  return <OrganizationScreen />;
+}
diff --git a/ee/apps/den-web/app/(den)/page.tsx b/ee/apps/den-web/app/(den)/page.tsx
new file mode 100644
index 0000000000..ea35489281
--- /dev/null
+++ b/ee/apps/den-web/app/(den)/page.tsx
@@ -0,0 +1,5 @@
+import { AuthScreen } from "./_components/auth-screen";
+
+export default function HomePage() {
+  return <AuthScreen />;
+}
diff --git a/ee/apps/den-web/app/admin/page.tsx b/ee/apps/den-web/app/admin/page.tsx
new file mode 100644
index 0000000000..efb2bd46ae
--- /dev/null
+++ b/ee/apps/den-web/app/admin/page.tsx
@@ -0,0 +1,23 @@
+import Link from "next/link";
+import { DenAdminPanel } from "../../components/den-admin-panel";
+
+export default function AdminPage() {
+  return (
+    <main className="min-h-screen bg-slate-50 px-4 py-6 sm:px-6 lg:px-8">
+      <div className="mx-auto flex w-full max-w-6xl flex-wrap items-center justify-between gap-3 pb-5">
+        <div>
+          <p className="text-[0.7rem] font-semibold uppercase tracking-[0.18em] text-slate-500">OpenWork</p>
+          <p className="mt-1 text-sm text-slate-600">Internal Den backoffice</p>
+        </div>
+        <Link
+          href="/"
+          className="inline-flex items-center justify-center rounded-full border border-slate-200 bg-white px-4 py-2 text-sm font-semibold text-slate-700"
+        >
+          Back to cloud panel
+        </Link>
+      </div>
+
+      <DenAdminPanel />
+    </main>
+  );
+}
diff --git a/ee/apps/den-web/app/api/_lib/upstream-proxy.ts b/ee/apps/den-web/app/api/_lib/upstream-proxy.ts
new file mode 100644
index 0000000000..35db6ead88
--- /dev/null
+++ b/ee/apps/den-web/app/api/_lib/upstream-proxy.ts
@@ -0,0 +1,394 @@
+import { NextRequest } from "next/server";
+
+const DEFAULT_API_BASE = "https://api.openworklabs.com";
+const DEFAULT_AUTH_ORIGIN = "https://app.openworklabs.com";
+const DEFAULT_AUTH_FALLBACK_BASE = "https://den-control-plane-openwork.onrender.com";
+const NO_BODY_STATUS = new Set([204, 205, 304]);
+
+const apiBase = normalizeBaseUrl(process.env.DEN_API_BASE ?? DEFAULT_API_BASE);
+const authOrigin = normalizeBaseUrl(process.env.DEN_AUTH_ORIGIN ?? DEFAULT_AUTH_ORIGIN);
+const authFallbackBase = normalizeBaseUrl(process.env.DEN_AUTH_FALLBACK_BASE ?? DEFAULT_AUTH_FALLBACK_BASE);
+const appPort = process.env.OPENWORK_APP_PORT?.trim() || process.env.PORT?.trim() || "5173";
+const configuredCorsOrigins = splitCsv(process.env.DEN_CORS_ORIGINS ?? process.env.CORS_ORIGINS);
+const localDevCorsOrigins = process.env.OPENWORK_DEV_MODE === "1"
+  ? [`http://localhost:${appPort}`, `http://127.0.0.1:${appPort}`]
+  : [];
+const corsOrigins = Array.from(new Set([...configuredCorsOrigins, ...localDevCorsOrigins]));
+
+type ProxyOptions = {
+  routePrefix: string;
+  upstreamPathPrefix?: string;
+  rewriteAuthLocationsToRequestOrigin?: boolean;
+};
+
+function normalizeBaseUrl(value: string): string {
+  return value.trim().replace(/\/+$/, "");
+}
+
+function splitCsv(value: string | undefined): string[] {
+  return (value ?? "")
+    .split(",")
+    .map((entry) => entry.trim().replace(/\/+$/, ""))
+    .filter(Boolean);
+}
+
+function normalizePathPrefix(value: string): string {
+  return value.replace(/^\/+|\/+$/g, "");
+}
+
+function getTargetPath(request: NextRequest, segments: string[], routePrefix: string): string {
+  const incoming = new URL(request.url);
+  let targetPath = segments.join("/");
+
+  if (!targetPath) {
+    const normalizedPrefix = routePrefix.endsWith("/") ? routePrefix : `${routePrefix}/`;
+    if (incoming.pathname.startsWith(normalizedPrefix)) {
+      targetPath = incoming.pathname.slice(normalizedPrefix.length);
+    } else if (incoming.pathname === routePrefix) {
+      targetPath = "";
+    }
+  }
+
+  return targetPath;
+}
+
+function buildTargetUrl(
+  base: string,
+  request: NextRequest,
+  targetPath: string,
+  upstreamPathPrefix = "",
+): string {
+  const incoming = new URL(request.url);
+  const prefixedPath = [normalizePathPrefix(upstreamPathPrefix), targetPath].filter(Boolean).join("/");
+  const upstream = new URL(prefixedPath ? `${base}/${prefixedPath}` : base);
+  upstream.search = incoming.search;
+  return upstream.toString();
+}
+
+function isLikelyHtmlBody(body: ArrayBuffer): boolean {
+  if (body.byteLength === 0) {
+    return false;
+  }
+
+  const preview = new TextDecoder().decode(body.slice(0, 256)).trim().toLowerCase();
+  return preview.startsWith("<!doctype") || preview.startsWith("<html") || preview.includes("<body");
+}
+
+function isLikelyCannotGetBody(body: ArrayBuffer): boolean {
+  if (body.byteLength === 0) {
+    return false;
+  }
+
+  const preview = new TextDecoder().decode(body.slice(0, 256)).trim().toLowerCase();
+  return preview.includes("cannot get ");
+}
+
+function isAdminTargetPath(targetPath: string): boolean {
+  return targetPath === "v1/admin" || targetPath.startsWith("v1/admin/");
+}
+
+function shouldFallbackToAuthBase(response: Response, body: ArrayBuffer, targetPath: string): boolean {
+  if (response.status === 502 || response.status === 503 || response.status === 504) {
+    return true;
+  }
+
+  if (response.status === 404 && isAdminTargetPath(targetPath)) {
+    const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+    if (contentType.includes("text/html") || isLikelyHtmlBody(body) || isLikelyCannotGetBody(body)) {
+      return true;
+    }
+  }
+
+  if (response.status < 500) {
+    return false;
+  }
+
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("text/html")) {
+    return true;
+  }
+
+  return isLikelyHtmlBody(body);
+}
+
+function buildUpstreamErrorResponse(status: number, error: string): Response {
+  return new Response(JSON.stringify({ error }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+    },
+  });
+}
+
+function applyCorsHeaders(request: NextRequest, headers: Headers): void {
+  const origin = request.headers.get("origin")?.trim().replace(/\/+$/, "") ?? "";
+  if (!origin) {
+    return;
+  }
+
+  const allowOrigin = corsOrigins.includes("*") || corsOrigins.includes(origin) ? origin : "";
+  if (!allowOrigin) {
+    return;
+  }
+
+  headers.set("access-control-allow-origin", allowOrigin);
+  headers.set("access-control-allow-credentials", "true");
+  headers.set("access-control-allow-methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+  headers.set("access-control-allow-headers", "Content-Type,Authorization,X-Api-Key,X-Request-Id,X-Requested-With");
+  headers.append("vary", "Origin");
+}
+
+export function buildCorsPreflightResponse(request: NextRequest): Response {
+  const headers = new Headers();
+  applyCorsHeaders(request, headers);
+  return new Response(null, { status: 204, headers });
+}
+
+function getJsonRedirectUrl(body: ArrayBuffer): string | null {
+  try {
+    const payload = JSON.parse(new TextDecoder().decode(body)) as unknown;
+    if (
+      payload &&
+      typeof payload === "object" &&
+      "redirect" in payload &&
+      payload.redirect === true &&
+      "url" in payload &&
+      typeof payload.url === "string" &&
+      payload.url.trim()
+    ) {
+      return payload.url.trim();
+    }
+  } catch {}
+  return null;
+}
+
+function copySetCookieHeaders(upstreamHeaders: Headers, responseHeaders: Headers): void {
+  const getSetCookie = (upstreamHeaders as Headers & { getSetCookie?: () => string[] }).getSetCookie;
+  if (typeof getSetCookie === "function") {
+    const cookies = getSetCookie.call(upstreamHeaders);
+    for (const cookie of cookies) {
+      if (cookie) {
+        responseHeaders.append("set-cookie", cookie);
+      }
+    }
+    return;
+  }
+
+  const cookie = upstreamHeaders.get("set-cookie");
+  if (cookie) {
+    responseHeaders.append("set-cookie", cookie);
+  }
+}
+
+function buildHeaders(request: NextRequest, contentType: string | null): Headers {
+  const headers = new Headers();
+  const copyHeaders = [
+    "accept",
+    "authorization",
+    "cookie",
+    "user-agent",
+    "x-requested-with",
+    "x-api-key",
+    "origin",
+    "x-forwarded-for",
+  ];
+
+  for (const key of copyHeaders) {
+    const value = request.headers.get(key);
+    if (value) {
+      headers.set(key, value);
+    }
+  }
+
+  if (contentType) {
+    headers.set("content-type", contentType);
+  }
+
+  if (!headers.has("accept")) {
+    headers.set("accept", "application/json");
+  }
+
+  if (!headers.has("origin")) {
+    headers.set("origin", authOrigin);
+  }
+
+  const incoming = new URL(request.url);
+  headers.set("x-forwarded-host", request.headers.get("host") ?? incoming.host);
+  headers.set("x-forwarded-proto", incoming.protocol.replace(/:$/, ""));
+
+  return headers;
+}
+
+async function fetchUpstream(
+  request: NextRequest,
+  targetUrl: string,
+  contentType: string | null,
+  body: Uint8Array | null,
+): Promise<Response> {
+  const init: RequestInit = {
+    method: request.method,
+    headers: buildHeaders(request, contentType),
+    redirect: "manual",
+  };
+
+  if (body && request.method !== "GET" && request.method !== "HEAD") {
+    init.body = body;
+  }
+
+  return fetch(targetUrl, init);
+}
+
+async function readUpstreamBody(response: Response): Promise<ArrayBuffer> {
+  return response.arrayBuffer();
+}
+
+function isEventStreamRequest(request: NextRequest): boolean {
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  return accept.includes("text/event-stream");
+}
+
+function isEventStreamResponse(response: Response): boolean {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  return contentType.includes("text/event-stream");
+}
+
+function shouldFallbackToAuthBaseForStream(response: Response, targetPath: string): boolean {
+  if (response.status === 502 || response.status === 503 || response.status === 504) {
+    return true;
+  }
+
+  if (response.status === 404 && isAdminTargetPath(targetPath)) {
+    return true;
+  }
+
+  return false;
+}
+
+function rewriteLocationHeader(location: string, request: NextRequest): string {
+  let parsedLocation: URL;
+  try {
+    parsedLocation = new URL(location);
+  } catch {
+    return location;
+  }
+
+  const requestOrigin = new URL(request.url).origin;
+  const rewriteableOrigins = [apiBase, authFallbackBase]
+    .map((value) => {
+      try {
+        return new URL(value).origin;
+      } catch {
+        return null;
+      }
+    })
+    .filter((value): value is string => Boolean(value));
+
+  if (!rewriteableOrigins.includes(parsedLocation.origin) || !parsedLocation.pathname.startsWith("/api/auth/")) {
+    return location;
+  }
+
+  return `${requestOrigin}${parsedLocation.pathname}${parsedLocation.search}${parsedLocation.hash}`;
+}
+
+function buildProxyResponse(
+  request: NextRequest,
+  upstream: Response,
+  options: ProxyOptions,
+  body?: BodyInit | null,
+): Response {
+  const responseHeaders = new Headers();
+  const passThroughHeaders = ["content-type", "location", "cache-control"];
+
+  for (const key of passThroughHeaders) {
+    const value = upstream.headers.get(key);
+    if (!value) {
+      continue;
+    }
+
+    if (key === "location" && options.rewriteAuthLocationsToRequestOrigin) {
+      responseHeaders.set(key, rewriteLocationHeader(value, request));
+      continue;
+    }
+
+    responseHeaders.set(key, value);
+  }
+
+  copySetCookieHeaders(upstream.headers, responseHeaders);
+  applyCorsHeaders(request, responseHeaders);
+
+  const shouldDropBody = request.method === "HEAD" || NO_BODY_STATUS.has(upstream.status);
+
+  return new Response(shouldDropBody ? null : (body ?? upstream.body), {
+    status: upstream.status,
+    headers: responseHeaders,
+  });
+}
+
+export async function proxyUpstream(
+  request: NextRequest,
+  segments: string[] = [],
+  options: ProxyOptions,
+): Promise<Response> {
+  const targetPath = getTargetPath(request, segments, options.routePrefix);
+  const primaryTargetUrl = buildTargetUrl(apiBase, request, targetPath, options.upstreamPathPrefix);
+  const fallbackTargetUrl = buildTargetUrl(authFallbackBase, request, targetPath, options.upstreamPathPrefix);
+  const contentType = request.headers.get("content-type");
+  const requestBody = request.method !== "GET" && request.method !== "HEAD"
+    ? new Uint8Array(await request.arrayBuffer())
+    : null;
+
+  let upstream: Response | null = null;
+
+  try {
+    upstream = await fetchUpstream(request, primaryTargetUrl, contentType, requestBody);
+  } catch {
+    if (apiBase !== authFallbackBase) {
+      try {
+        upstream = await fetchUpstream(request, fallbackTargetUrl, contentType, requestBody);
+      } catch {}
+    }
+  }
+
+  if (!upstream) {
+    const response = buildUpstreamErrorResponse(502, "Upstream request failed.");
+    applyCorsHeaders(request, response.headers);
+    return response;
+  }
+
+  if (isEventStreamRequest(request) || isEventStreamResponse(upstream)) {
+    if (apiBase !== authFallbackBase && shouldFallbackToAuthBaseForStream(upstream, targetPath)) {
+      try {
+        upstream = await fetchUpstream(request, fallbackTargetUrl, contentType, requestBody);
+      } catch {}
+    }
+    return buildProxyResponse(request, upstream, options);
+  }
+
+  let body = await readUpstreamBody(upstream);
+
+  if (apiBase !== authFallbackBase && shouldFallbackToAuthBase(upstream, body, targetPath)) {
+    try {
+      upstream = await fetchUpstream(request, fallbackTargetUrl, contentType, requestBody);
+      body = await readUpstreamBody(upstream);
+    } catch {}
+  }
+
+  const responseContentType = upstream.headers.get("content-type")?.toLowerCase() ?? "";
+  if (upstream.status >= 500 && (responseContentType.includes("text/html") || isLikelyHtmlBody(body))) {
+    const response = buildUpstreamErrorResponse(upstream.status, "Upstream service unavailable.");
+    applyCorsHeaders(request, response.headers);
+    return response;
+  }
+
+  if (request.method === "GET" && targetPath === "oauth2/authorize") {
+    const redirectUrl = getJsonRedirectUrl(body);
+    if (redirectUrl) {
+      const incoming = new URL(request.url);
+      const host = request.headers.get("host") ?? incoming.host;
+      const origin = `${incoming.protocol}//${host}`;
+      return Response.redirect(new URL(redirectUrl, origin), 302);
+    }
+  }
+
+  return buildProxyResponse(request, upstream, options, body);
+}
diff --git a/ee/apps/den-web/app/api/auth/[...path]/route.ts b/ee/apps/den-web/app/api/auth/[...path]/route.ts
new file mode 100644
index 0000000000..e1c2fec348
--- /dev/null
+++ b/ee/apps/den-web/app/api/auth/[...path]/route.ts
@@ -0,0 +1,32 @@
+import { NextRequest } from "next/server";
+import { proxyUpstream } from "../../_lib/upstream-proxy";
+
+export const dynamic = "force-dynamic";
+
+async function proxy(request: NextRequest, segments: string[] = []) {
+  return proxyUpstream(request, segments, {
+    routePrefix: "/api/auth",
+    upstreamPathPrefix: "api/auth",
+    rewriteAuthLocationsToRequestOrigin: true,
+  });
+}
+
+export async function GET(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function POST(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function PUT(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function PATCH(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function DELETE(request: NextRequest) {
+  return proxy(request);
+}
diff --git a/ee/apps/den-web/app/api/den/[...path]/route.ts b/ee/apps/den-web/app/api/den/[...path]/route.ts
new file mode 100644
index 0000000000..ef413bd1e2
--- /dev/null
+++ b/ee/apps/den-web/app/api/den/[...path]/route.ts
@@ -0,0 +1,34 @@
+import { NextRequest } from "next/server";
+import { buildCorsPreflightResponse, proxyUpstream } from "../../_lib/upstream-proxy";
+
+export const dynamic = "force-dynamic";
+
+async function proxy(request: NextRequest, segments: string[] = []) {
+  return proxyUpstream(request, segments, {
+    routePrefix: "/api/den",
+  });
+}
+
+export async function GET(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function POST(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function PUT(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function PATCH(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function DELETE(request: NextRequest) {
+  return proxy(request);
+}
+
+export async function OPTIONS(request: NextRequest) {
+  return buildCorsPreflightResponse(request);
+}
diff --git a/ee/apps/den-web/app/globals.css b/ee/apps/den-web/app/globals.css
new file mode 100644
index 0000000000..052f11e57b
--- /dev/null
+++ b/ee/apps/den-web/app/globals.css
@@ -0,0 +1,1581 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+:root {
+    color-scheme: light;
+    --dls-surface: #ffffff;
+    --dls-sidebar: #f6f9fc;
+    --dls-app-bg: #f6f9fc;
+    --dls-border: #e5e7eb;
+    --dls-accent: #011627;
+    --dls-accent-hover: #000000;
+    --dls-accent-rgb: 1 22 39;
+    --dls-text-primary: #011627;
+    --dls-text-secondary: #667085;
+    --dls-hover: #f2f4f7;
+    --dls-active: #eef2f7;
+    --dls-shell-shadow: 0 18px 40px -30px rgba(15, 23, 42, 0.14);
+    --dls-card-shadow: 0 12px 24px -20px rgba(15, 23, 42, 0.1);
+    --ow-bg: var(--dls-app-bg);
+    --ow-ink: var(--dls-text-primary);
+    --ow-muted: var(--dls-text-secondary);
+    --ow-line: var(--dls-border);
+    --ow-card: rgba(255, 255, 255, 0.98);
+    --ow-accent: var(--dls-accent);
+    --ow-accent-strong: #0b1320;
+    --ow-success: #0f9f66;
+    --ow-warning: #b45309;
+    --ow-danger: #b42318;
+}
+
+* {
+    box-sizing: border-box;
+}
+
+html,
+body {
+    min-height: 100%;
+}
+
+body {
+    margin: 0;
+    font-family:
+        var(--font-inter), "IBM Plex Sans", "Avenir Next", "Segoe UI", sans-serif;
+    color: var(--ow-ink);
+    background: var(--ow-bg);
+}
+
+.den-page {
+    width: min(100%, 1180px);
+    margin: 0 auto;
+    padding: 1.25rem;
+}
+
+.den-frame,
+.den-frame-soft,
+.den-frame-inset {
+    border-radius: 2rem;
+    border: 1px solid var(--dls-border);
+}
+
+.den-frame {
+    background: rgba(255, 255, 255, 0.96);
+    box-shadow: var(--dls-shell-shadow);
+}
+
+.den-frame-soft {
+    background: rgba(255, 255, 255, 0.92);
+}
+
+.den-frame-inset {
+    background: rgba(248, 250, 252, 0.86);
+}
+
+.den-eyebrow {
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.18em;
+    text-transform: uppercase;
+    color: var(--dls-text-secondary);
+}
+
+.den-title-xl {
+    margin: 0;
+    font-size: clamp(2.1rem, 5vw, 4rem);
+    line-height: 0.97;
+    letter-spacing: -0.06em;
+    font-weight: 600;
+    color: var(--dls-text-primary);
+}
+
+.den-title-lg {
+    margin: 0;
+    font-size: clamp(1.6rem, 3vw, 2.4rem);
+    line-height: 1;
+    letter-spacing: -0.05em;
+    font-weight: 600;
+    color: var(--dls-text-primary);
+}
+
+.den-copy {
+    margin: 0;
+    color: var(--dls-text-secondary);
+    font-size: 0.96rem;
+    line-height: 1.75;
+}
+
+.den-copy-strong {
+    color: var(--dls-text-primary);
+}
+
+.den-button-primary,
+.den-button-secondary,
+.den-button-danger,
+.den-button-ghost {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    min-height: 48px;
+    padding: 0.75rem 1.25rem;
+    border-radius: 9999px;
+    font-size: 0.92rem;
+    font-weight: 600;
+    transition:
+        color 0.2s ease,
+        background-color 0.2s ease,
+        border-color 0.2s ease,
+        box-shadow 0.2s ease,
+        transform 0.2s ease;
+}
+
+.den-button-primary {
+    background: #011627;
+    color: #fff;
+    box-shadow: 0 14px 32px -20px rgba(1, 22, 39, 0.45);
+}
+
+.den-button-primary:hover:not(:disabled) {
+    background: #000;
+    transform: translateY(-1px);
+}
+
+.den-button-secondary {
+    background: #fff;
+    color: var(--dls-text-primary);
+    box-shadow:
+        rgba(0, 0, 0, 0.06) 0 0 0 1px,
+        rgba(0, 0, 0, 0.04) 0 1px 2px 0;
+}
+
+.den-button-secondary:hover:not(:disabled) {
+    background: #f8fafc;
+}
+
+.den-button-danger {
+    background: #fff5f5;
+    color: #b42318;
+    box-shadow: inset 0 0 0 1px rgba(180, 35, 24, 0.16);
+}
+
+.den-button-danger:hover:not(:disabled) {
+    background: #feecec;
+}
+
+.den-button-ghost {
+    background: transparent;
+    color: var(--dls-text-secondary);
+}
+
+.den-button-ghost:hover:not(:disabled) {
+    color: var(--dls-text-primary);
+}
+
+.den-button-primary:disabled,
+.den-button-secondary:disabled,
+.den-button-danger:disabled,
+.den-button-ghost:disabled {
+    opacity: 0.6;
+    cursor: not-allowed;
+    transform: none;
+}
+
+.den-input,
+.den-select,
+.den-textarea {
+    width: 100%;
+    border-radius: 1rem;
+    border: 1px solid var(--dls-border);
+    background: #fff;
+    color: var(--dls-text-primary);
+    padding: 0.9rem 1rem;
+    font-size: 0.95rem;
+    line-height: 1.4;
+    transition:
+        border-color 0.16s ease,
+        box-shadow 0.16s ease;
+}
+
+.den-input:focus,
+.den-select:focus,
+.den-textarea:focus {
+    outline: none;
+    border-color: #cbd5e1;
+    box-shadow: 0 0 0 4px rgba(15, 23, 42, 0.05);
+}
+
+.den-label {
+    padding-left: 0.25rem;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.16em;
+    text-transform: uppercase;
+    color: var(--dls-text-secondary);
+}
+
+.den-stat-grid {
+    display: grid;
+    gap: 1rem;
+}
+
+@media (min-width: 768px) {
+    .den-stat-grid {
+        grid-template-columns: repeat(3, minmax(0, 1fr));
+    }
+}
+
+.den-stat-card {
+    border-radius: 1.5rem;
+    border: 1px solid var(--dls-border);
+    background: rgba(255, 255, 255, 0.92);
+    padding: 1.25rem;
+}
+
+.den-stat-label {
+    margin: 0;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.16em;
+    text-transform: uppercase;
+    color: var(--dls-text-secondary);
+}
+
+.den-stat-value {
+    margin: 0.45rem 0 0;
+    font-size: 2rem;
+    line-height: 1;
+    letter-spacing: -0.05em;
+    font-weight: 600;
+    color: var(--dls-text-primary);
+}
+
+.den-stat-copy {
+    margin: 0.45rem 0 0;
+    font-size: 0.9rem;
+    line-height: 1.6;
+    color: var(--dls-text-secondary);
+}
+
+.den-list-shell {
+    overflow: hidden;
+    border-radius: 1.75rem;
+    border: 1px solid var(--dls-border);
+    background: rgba(255, 255, 255, 0.96);
+}
+
+.den-list-row {
+    display: flex;
+    align-items: flex-start;
+    justify-content: space-between;
+    gap: 1rem;
+    padding: 1.15rem 1.25rem;
+    border-top: 1px solid var(--dls-border);
+}
+
+.den-list-row:first-child {
+    border-top: 0;
+}
+
+.den-kicker {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.45rem;
+    border-radius: 9999px;
+    padding: 0.35rem 0.75rem;
+    background: rgba(255, 255, 255, 0.8);
+    box-shadow:
+        rgba(0, 0, 0, 0.06) 0 0 0 1px,
+        rgba(0, 0, 0, 0.04) 0 1px 2px 0;
+    font-size: 0.75rem;
+    font-weight: 600;
+    color: var(--dls-text-secondary);
+}
+
+.den-status-pill {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 9999px;
+    padding: 0.35rem 0.7rem;
+    font-size: 0.72rem;
+    font-weight: 700;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+}
+
+.den-status-pill.is-positive {
+    background: #ecfdf3;
+    color: #027a48;
+}
+
+.den-status-pill.is-neutral {
+    background: #f2f4f7;
+    color: #475467;
+}
+
+.den-notice {
+    border-radius: 1.25rem;
+    padding: 0.9rem 1rem;
+    font-size: 0.92rem;
+    line-height: 1.6;
+}
+
+.den-notice.is-error {
+    border: 1px solid #fecaca;
+    background: #fef2f2;
+    color: #b42318;
+}
+
+.den-notice.is-info {
+    border: 1px solid #dbeafe;
+    background: #eff6ff;
+    color: #1d4ed8;
+}
+
+.den-social-button {
+    width: 100%;
+}
+
+.den-divider {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    color: var(--dls-text-secondary);
+    font-size: 0.72rem;
+    font-weight: 700;
+    letter-spacing: 0.14em;
+    text-transform: uppercase;
+}
+
+.den-divider::before,
+.den-divider::after {
+    content: "";
+    flex: 1 1 auto;
+    height: 1px;
+    background: var(--dls-border);
+}
+
+.den-meta-row {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 0.75rem;
+    color: var(--dls-text-secondary);
+    font-size: 0.92rem;
+}
+
+.den-bullet-list {
+    display: grid;
+    gap: 0.8rem;
+}
+
+.den-bullet-item {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.75rem;
+    color: var(--dls-text-secondary);
+    font-size: 0.95rem;
+    line-height: 1.65;
+}
+
+.den-bullet-dot {
+    width: 0.4rem;
+    height: 0.4rem;
+    margin-top: 0.55rem;
+    border-radius: 9999px;
+    flex: 0 0 auto;
+    background: #cbd5e1;
+}
+
+.den-link-inline {
+    color: var(--dls-text-primary);
+    font-weight: 600;
+    text-decoration: none;
+    transition: opacity 0.2s ease;
+}
+
+.den-link-inline:hover {
+    opacity: 0.72;
+}
+
+.ow-shell {
+    position: relative;
+    min-height: 100vh;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: flex-start;
+    gap: 1rem;
+    padding: 1rem;
+    overflow-x: hidden;
+    overflow-y: auto;
+    background:
+        radial-gradient(circle at top left, rgba(1, 22, 39, 0.03), transparent 28%),
+        linear-gradient(180deg, #ffffff 0%, #fbfbfc 100%);
+}
+
+.ow-ambient {
+    position: absolute;
+    inset: 0;
+    pointer-events: none;
+}
+
+.ow-blob {
+    position: absolute;
+    border-radius: 999px;
+    filter: blur(130px);
+    mix-blend-mode: normal;
+    opacity: 0.18;
+}
+
+.ow-blob-one {
+    width: 36rem;
+    height: 36rem;
+    top: -12%;
+    left: -8%;
+    background: rgba(17, 24, 39, 0.1);
+}
+
+.ow-blob-two {
+    width: 28rem;
+    height: 28rem;
+    top: 10%;
+    right: -8%;
+    background: rgba(99, 102, 241, 0.08);
+}
+
+.ow-blob-three {
+    width: 32rem;
+    height: 32rem;
+    bottom: -28%;
+    left: 18%;
+    background: rgba(226, 232, 240, 0.8);
+}
+
+.ow-brand {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.55rem;
+}
+
+.ow-brand-icon {
+    width: 1.95rem;
+    height: 1.95rem;
+    border-radius: 0.65rem;
+    background: rgba(1, 22, 39, 0.05);
+    border: 1px solid var(--dls-border);
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.ow-brand-icon-core {
+    width: 0.9rem;
+    height: 0.9rem;
+    border-radius: 999px;
+    background: var(--ow-accent);
+    box-shadow: 0 0 0 0.3rem rgba(1, 22, 39, 0.1);
+}
+
+.ow-brand-text {
+    font-size: 0.98rem;
+    font-weight: 600;
+    letter-spacing: -0.02em;
+}
+
+.ow-card {
+    width: min(100%, 1180px);
+    background: var(--ow-card);
+    border: 1px solid var(--dls-border);
+    border-radius: 1.5rem;
+    box-shadow: var(--dls-shell-shadow);
+    backdrop-filter: blur(10px);
+    position: relative;
+    z-index: 4;
+    overflow: hidden;
+}
+
+.ow-card-auth {
+    width: min(100%, 28rem);
+}
+
+.ow-card-shell {
+    width: min(100%, 1180px);
+    max-width: none;
+    min-height: calc(100vh - 6rem);
+    height: calc(100vh - 6rem);
+    height: calc(100dvh - 6rem);
+    border-radius: 1.5rem;
+    background: rgba(255, 255, 255, 0.98);
+}
+
+.ow-card-shell .ow-card-body {
+    min-height: calc(100vh - 6rem);
+    height: calc(100vh - 6rem);
+    height: calc(100dvh - 6rem);
+    display: flex;
+    flex-direction: column;
+    padding: 0;
+}
+
+.ow-card-shell .ow-app-shell {
+    min-height: calc(100vh - 10rem);
+}
+
+.ow-progress-track {
+    width: 100%;
+    height: 0.28rem;
+    background: var(--dls-hover);
+}
+
+.ow-progress-fill {
+    display: block;
+    height: 100%;
+    background: linear-gradient(90deg, #1b29ff 0%, #3b82f6 100%);
+    transition: width 320ms ease;
+}
+
+.ow-card-body {
+    padding: 2rem 1.7rem;
+}
+
+.ow-stack {
+    display: grid;
+    gap: 0.95rem;
+}
+
+.ow-auth-panel {
+    width: min(100%, 21.875rem);
+    margin: 0 auto;
+}
+
+.ow-heading-block {
+    display: grid;
+    gap: 0.45rem;
+    text-align: center;
+    margin-bottom: 0.35rem;
+}
+
+.ow-icon-chip {
+    width: 2.7rem;
+    height: 2.7rem;
+    border-radius: 0.9rem;
+    background: rgba(27, 41, 255, 0.11);
+    border: 1px solid rgba(27, 41, 255, 0.2);
+    color: var(--ow-accent);
+    font-weight: 700;
+    letter-spacing: 0.06em;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    margin: 0 auto 0.2rem;
+}
+
+.ow-title {
+    margin: 0;
+    font-size: clamp(1.7rem, 5vw, 2.1rem);
+    font-weight: 700;
+    letter-spacing: -0.02em;
+}
+
+.ow-subtitle {
+    margin: 0;
+    color: var(--ow-muted);
+    font-size: 0.92rem;
+    line-height: 1.45;
+}
+
+.ow-subtitle-line {
+    display: block;
+}
+
+.ow-field-block {
+    display: grid;
+    gap: 0.38rem;
+}
+
+.ow-field-label {
+    font-size: 0.72rem;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: #5f6f91;
+    padding-left: 0.2rem;
+}
+
+.ow-input {
+    width: 100%;
+    border-radius: 0.78rem;
+    border: 1px solid #e5e7eb;
+    background: #fff;
+    color: var(--ow-ink);
+    padding: 0.82rem 0.9rem;
+    font-size: 0.93rem;
+    line-height: 1.35;
+    transition:
+        border-color 120ms ease,
+        box-shadow 120ms ease;
+}
+
+.ow-input:focus-visible {
+    outline: none;
+    border-color: rgba(1, 22, 39, 0.18);
+    box-shadow: 0 0 0 0.22rem rgba(1, 22, 39, 0.08);
+}
+
+.ow-mono {
+    font-family:
+        var(--font-ibm-plex-mono), "JetBrains Mono", "SF Mono", monospace;
+    font-size: 0.8rem;
+}
+
+.ow-btn-primary,
+.ow-btn-secondary,
+.ow-btn-icon,
+.ow-link {
+    appearance: none;
+    cursor: pointer;
+    border: 0;
+    font: inherit;
+}
+
+.ow-btn-primary {
+    width: 100%;
+    border-radius: 0.82rem;
+    border: 1px solid rgba(1, 22, 39, 0.22);
+    background: linear-gradient(135deg, #011627 0%, #0f1f33 100%);
+    color: #fff;
+    font-weight: 700;
+    font-size: 0.92rem;
+    padding: 0.84rem 0.96rem;
+    transition:
+        transform 120ms ease,
+        box-shadow 120ms ease,
+        opacity 120ms ease;
+    box-shadow: 0 10px 20px rgba(15, 23, 42, 0.12);
+}
+
+.ow-btn-primary:hover:not(:disabled) {
+    transform: translateY(-1px);
+}
+
+.ow-btn-primary:disabled {
+    opacity: 0.62;
+    cursor: not-allowed;
+    box-shadow: none;
+}
+
+.ow-btn-secondary {
+    border-radius: 0.82rem;
+    border: 1px solid #e5e7eb;
+    background: #fff;
+    color: #334155;
+    font-size: 0.84rem;
+    font-weight: 600;
+    padding: 0.66rem 0.84rem;
+    transition:
+        border-color 120ms ease,
+        background-color 120ms ease,
+        color 120ms ease;
+}
+
+.ow-btn-secondary:hover:not(:disabled),
+.ow-btn-icon:hover:not(:disabled) {
+    border-color: rgba(1, 22, 39, 0.16);
+    color: var(--ow-accent);
+    background: rgba(1, 22, 39, 0.04);
+}
+
+.ow-btn-secondary:disabled,
+.ow-btn-icon:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+}
+
+.ow-social-btn {
+    width: 100%;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.68rem;
+    padding: 0.78rem 0.92rem;
+    font-size: 0.92rem;
+}
+
+.ow-social-icon {
+    width: 1rem;
+    height: 1rem;
+    flex: 0 0 auto;
+}
+
+.ow-divider {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    color: #64748b;
+    font-size: 0.78rem;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+}
+
+.ow-divider::before,
+.ow-divider::after {
+    content: "";
+    flex: 1 1 auto;
+    height: 1px;
+    background: #d9e1f2;
+}
+
+.ow-social-btn {
+  width: 100%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.68rem;
+  padding: 0.78rem 0.92rem;
+  font-size: 0.92rem;
+}
+
+.ow-social-icon {
+  width: 1rem;
+  height: 1rem;
+  flex: 0 0 auto;
+}
+
+.ow-divider {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  color: #64748b;
+  font-size: 0.78rem;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.ow-divider::before,
+.ow-divider::after {
+  content: "";
+  flex: 1 1 auto;
+  height: 1px;
+  background: #d9e1f2;
+}
+
+.ow-inline-row {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.8rem;
+}
+
+.ow-auth-feedback {
+    display: grid;
+    gap: 0.42rem;
+    text-align: center;
+    color: #475569;
+    font-size: 0.82rem;
+}
+
+.ow-app-shell {
+    display: grid;
+    gap: 1rem;
+    align-content: start;
+}
+
+@media (min-width: 980px) {
+    .ow-app-shell {
+        grid-template-columns: 16rem 21rem minmax(0, 1fr);
+        align-items: start;
+    }
+
+    .ow-pane-span-2 {
+        grid-column: 2 / span 2;
+    }
+}
+
+.ow-app-nav {
+    border: 1px solid #e2e8f0;
+    border-radius: 2rem;
+    background: #fff;
+    padding: 1rem;
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+    box-shadow: 0 6px 24px rgba(15, 23, 42, 0.05);
+}
+
+.ow-nav-group {
+    display: grid;
+    gap: 0.45rem;
+}
+
+.ow-nav-label {
+    margin: 0;
+    font-size: 0.62rem;
+    font-weight: 700;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: #94a3b8;
+    padding-left: 0.35rem;
+}
+
+.ow-nav-item {
+    border: 1px solid transparent;
+    border-radius: 0.92rem;
+    background: transparent;
+    color: #475569;
+    font-size: 0.85rem;
+    font-weight: 600;
+    padding: 0.66rem 0.75rem;
+    text-align: left;
+    transition:
+        border-color 140ms ease,
+        background-color 140ms ease,
+        color 140ms ease;
+}
+
+.ow-nav-item:hover {
+    border-color: #e2e8f0;
+    background: #f8fafc;
+}
+
+.ow-nav-item.is-active {
+    border-color: rgba(27, 41, 255, 0.24);
+    color: #1b29ff;
+    background: rgba(27, 41, 255, 0.08);
+}
+
+.ow-app-nav-footer {
+    margin-top: auto;
+    border-top: 1px solid #e2e8f0;
+    padding-top: 0.9rem;
+    display: grid;
+    gap: 0.42rem;
+}
+
+.ow-nav-email {
+    overflow-wrap: anywhere;
+    font-size: 0.8rem;
+    color: #475569;
+}
+
+.ow-pane {
+    border: 1px solid #e2e8f0;
+    border-radius: 2rem;
+    background: #fff;
+    padding: 1.2rem;
+    display: grid;
+    gap: 0.9rem;
+    align-content: start;
+    box-shadow: 0 6px 24px rgba(15, 23, 42, 0.05);
+}
+
+.ow-pane-head {
+    display: grid;
+    gap: 0.3rem;
+}
+
+.ow-pane-head-row {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem;
+}
+
+.ow-pane-block {
+    border: 1px solid #e2e8f0;
+    border-radius: 1.1rem;
+    background: #f8fafc;
+    padding: 0.85rem;
+    display: grid;
+    gap: 0.65rem;
+}
+
+.ow-btn-compact {
+    font-size: 0.79rem;
+    padding: 0.58rem 0.88rem;
+}
+
+.ow-filter-row {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    gap: 0.55rem;
+}
+
+.ow-select {
+    border-radius: 0.9rem;
+    border: 1px solid #cbd5e1;
+    background: #fff;
+    color: #334155;
+    padding: 0.74rem 0.82rem;
+    font-size: 0.86rem;
+    font-weight: 500;
+}
+
+.ow-select:focus-visible {
+    outline: none;
+    border-color: rgba(27, 41, 255, 0.55);
+    box-shadow: 0 0 0 0.22rem rgba(27, 41, 255, 0.16);
+}
+
+.ow-overview-grid {
+    display: grid;
+    gap: 0.65rem;
+}
+
+@media (min-width: 700px) {
+    .ow-overview-grid {
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+}
+
+.ow-overview-card {
+    border: 1px solid #e2e8f0;
+    border-radius: 1.1rem;
+    background: #fff;
+    padding: 0.9rem;
+    display: grid;
+    gap: 0.32rem;
+}
+
+.ow-overview-label {
+    margin: 0;
+    font-size: 0.65rem;
+    font-weight: 700;
+    color: #94a3b8;
+    text-transform: uppercase;
+    letter-spacing: 0.1em;
+}
+
+.ow-overview-value {
+    margin: 0;
+    font-size: 1rem;
+    font-weight: 700;
+    color: #0f172a;
+}
+
+.ow-overview-value.is-ready {
+    color: #0f9f66;
+}
+
+.ow-overview-value.is-starting {
+    color: #1e3a8a;
+}
+
+.ow-overview-value.is-attention {
+    color: #b45309;
+}
+
+.ow-howto-copy {
+    margin: 0;
+    color: #64748b;
+    font-size: 0.75rem;
+    line-height: 1.4;
+}
+
+.ow-empty-detail {
+    border: 1px dashed #cbd5e1;
+    border-radius: 1.1rem;
+    background: #f8fafc;
+    padding: 1.2rem;
+    display: grid;
+    gap: 0.42rem;
+}
+
+@media (max-width: 979px) {
+    .ow-app-nav {
+        flex-direction: row;
+        align-items: flex-start;
+        flex-wrap: wrap;
+        border-radius: 1.35rem;
+        padding: 0.8rem;
+    }
+
+    .ow-app-nav-footer {
+        margin-top: 0;
+        margin-left: auto;
+        border-top: 0;
+        padding-top: 0.1rem;
+        align-items: end;
+    }
+
+    .ow-nav-email {
+        max-width: 11rem;
+        text-align: right;
+    }
+
+    .ow-filter-row {
+        grid-template-columns: 1fr;
+    }
+
+    .ow-select {
+        width: 100%;
+    }
+}
+
+.ow-caption {
+    margin: 0;
+    color: #64748b;
+    font-size: 0.78rem;
+}
+
+.ow-soft-pulse-dot {
+    animation: ow-soft-dot-pulse 1.8s ease-in-out infinite;
+}
+
+.ow-soft-pulse-ring {
+    animation: ow-soft-ring-pulse 2s ease-out infinite;
+}
+
+.ow-soft-pulse-orb {
+    animation: ow-soft-orb-pulse 1.8s ease-in-out infinite;
+}
+
+.ow-soft-disabled-cta {
+    animation: ow-soft-cta-breathe 2.4s ease-in-out infinite;
+}
+
+@keyframes ow-soft-dot-pulse {
+    0%,
+    100% {
+        transform: scale(1);
+        opacity: 0.85;
+    }
+
+    50% {
+        transform: scale(1.25);
+        opacity: 1;
+    }
+}
+
+@keyframes ow-soft-ring-pulse {
+    0% {
+        transform: scale(0.65);
+        opacity: 0.35;
+    }
+
+    70% {
+        transform: scale(1.15);
+        opacity: 0;
+    }
+
+    100% {
+        transform: scale(1.15);
+        opacity: 0;
+    }
+}
+
+@keyframes ow-soft-orb-pulse {
+    0%,
+    100% {
+        transform: scale(0.92);
+        opacity: 0.9;
+    }
+
+    50% {
+        transform: scale(1.08);
+        opacity: 1;
+    }
+}
+
+@keyframes ow-soft-cta-breathe {
+    0%,
+    100% {
+        opacity: 0.72;
+        transform: translateY(0);
+    }
+
+    50% {
+        opacity: 1;
+        transform: translateY(-0.5px);
+    }
+}
+
+.ow-link {
+    background: transparent;
+    color: #1b29ff;
+    font-size: 0.79rem;
+    font-weight: 700;
+    padding: 0;
+    text-decoration: underline;
+    text-decoration-color: transparent;
+    text-underline-offset: 0.2rem;
+}
+
+.ow-link:hover {
+    text-decoration-color: currentColor;
+}
+
+.ow-note-box,
+.ow-paywall-box,
+.ow-lookup-box,
+.ow-log-box {
+    border-radius: 1rem;
+    border: 1px solid #e2e8f0;
+    background: #f8fafc;
+    padding: 0.9rem;
+}
+
+.ow-note-box p,
+.ow-paywall-box p,
+.ow-log-item p,
+.ow-step-detail {
+    margin: 0;
+}
+
+.ow-note-box {
+    display: grid;
+    gap: 0.42rem;
+    color: #475569;
+    font-size: 0.82rem;
+}
+
+.ow-connect-steps {
+    margin: 0;
+    padding-left: 1.1rem;
+    display: grid;
+    gap: 0.2rem;
+    color: #334155;
+    font-size: 0.8rem;
+}
+
+.ow-connect-steps li {
+    line-height: 1.35;
+}
+
+.ow-connect-shot {
+    margin: 0;
+    border-radius: 0.75rem;
+    border: 1px solid #dbe3f4;
+    overflow: hidden;
+    background: #fff;
+}
+
+.ow-connect-shot img {
+    display: block;
+    width: 100%;
+    height: auto;
+}
+
+.ow-howto {
+    border: 1px solid #e2e8f0;
+    border-radius: 1rem;
+    background: #fff;
+    padding: 0.75rem;
+}
+
+.ow-howto summary {
+    cursor: pointer;
+    font-size: 0.82rem;
+    font-weight: 700;
+    color: #0f172a;
+}
+
+.ow-howto[open] {
+    display: grid;
+    gap: 0.45rem;
+}
+
+.ow-inline-actions .ow-link {
+    align-self: center;
+}
+
+.ow-error-text {
+    color: var(--ow-danger);
+    font-weight: 600;
+}
+
+.ow-step-list {
+    display: grid;
+    gap: 0.5rem;
+}
+
+.ow-step-item {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.55rem;
+    border-radius: 0.8rem;
+    border: 1px solid #dbe3f4;
+    background: #fff;
+    padding: 0.58rem 0.6rem;
+}
+
+.ow-step-item.is-done {
+    border-color: #bfd0f8;
+    background: #f7faff;
+}
+
+.ow-step-index {
+    width: 1.35rem;
+    height: 1.35rem;
+    border-radius: 999px;
+    border: 1px solid #b9caef;
+    background: #eef4ff;
+    color: #1f3a8a;
+    font-size: 0.66rem;
+    font-weight: 700;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    flex-shrink: 0;
+}
+
+.ow-step-title {
+    margin: 0;
+    font-size: 0.86rem;
+    color: #0f172a;
+    font-weight: 700;
+}
+
+.ow-step-detail {
+    color: #64748b;
+    font-size: 0.72rem;
+    line-height: 1.3;
+}
+
+.ow-paywall-title,
+.ow-section-title {
+    margin: 0 0 0.5rem;
+    font-size: 0.95rem;
+    font-weight: 700;
+    color: #0f172a;
+}
+
+.ow-full {
+    width: 100%;
+    justify-content: center;
+    display: inline-flex;
+}
+
+.ow-lookup-box {
+    display: grid;
+    gap: 0.58rem;
+}
+
+.ow-worker-section-head {
+    display: flex;
+    align-items: flex-start;
+    justify-content: space-between;
+    gap: 0.6rem;
+}
+
+.ow-worker-layout {
+    display: grid;
+    gap: 0.6rem;
+}
+
+@media (min-width: 860px) {
+    .ow-worker-layout {
+        grid-template-columns: minmax(0, 0.9fr) minmax(0, 1.1fr);
+    }
+}
+
+.ow-worker-list-panel {
+    max-height: 58vh;
+    overflow-y: auto;
+    padding-right: 0.2rem;
+}
+
+.ow-worker-select {
+    width: 100%;
+    text-align: left;
+    font: inherit;
+    color: inherit;
+    cursor: pointer;
+    border: 1px solid #e2e8f0;
+    border-radius: 1.2rem;
+    background: #fff;
+    padding: 0.82rem;
+    display: grid;
+    gap: 0.45rem;
+    transition:
+        border-color 140ms ease,
+        box-shadow 140ms ease,
+        background-color 140ms ease;
+}
+
+.ow-worker-select:hover {
+    border-color: #cbd5e1;
+    background: #f8fafc;
+}
+
+.ow-worker-select.is-active {
+    border-color: #1b29ff;
+    background: rgba(27, 41, 255, 0.04);
+    box-shadow:
+        inset 3px 0 0 #1b29ff,
+        0 8px 22px rgba(27, 41, 255, 0.12);
+}
+
+.ow-worker-detail {
+    border: 1px solid #dbe3f4;
+    border-radius: 0.82rem;
+    background: #fff;
+    padding: 0.66rem;
+    display: grid;
+    gap: 0.52rem;
+}
+
+.ow-worker-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 0.46rem;
+}
+
+.ow-worker-item {
+    border: 1px solid #dbe3f4;
+    border-radius: 0.76rem;
+    background: #fff;
+    padding: 0.56rem;
+    display: grid;
+    gap: 0.4rem;
+}
+
+.ow-worker-item.is-active {
+    border-color: #9fb2eb;
+    background: #f8fbff;
+}
+
+.ow-worker-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem;
+}
+
+.ow-worker-meta {
+    margin: 0;
+    font-size: 0.72rem;
+    color: #64748b;
+    word-break: break-all;
+    font-family:
+        var(--font-ibm-plex-mono), "JetBrains Mono", "SF Mono", monospace;
+}
+
+.ow-badge {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 0.45rem;
+    border: 1px solid #e2e8f0;
+    background: #f8fafc;
+    color: #64748b;
+    font-size: 0.62rem;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    padding: 0.2rem 0.45rem;
+}
+
+.ow-worker-badges {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35rem;
+}
+
+.ow-status-pill {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 999px;
+    padding: 0.22rem 0.5rem;
+    font-size: 0.62rem;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+}
+
+.ow-status-pill.is-ready {
+    background: #dcfce7;
+    color: #166534;
+}
+
+.ow-status-pill.is-starting {
+    background: #fef3c7;
+    color: #92400e;
+}
+
+.ow-status-pill.is-attention {
+    background: #ffe4e6;
+    color: #9f1239;
+}
+
+.ow-status-pill.is-other {
+    background: #e2e8f0;
+    color: #475569;
+}
+
+.ow-inline-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.58rem;
+}
+
+.ow-inline-actions > .ow-input {
+    flex: 1 1 14rem;
+}
+
+.ow-copy-row {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.55rem;
+    align-items: center;
+}
+
+.ow-btn-icon {
+    border-radius: 0.75rem;
+    border: 1px solid #cbd5e1;
+    background: #fff;
+    color: #334155;
+    font-size: 0.74rem;
+    font-weight: 600;
+    padding: 0.6rem 0.75rem;
+    min-width: 4.2rem;
+}
+
+.ow-btn-primary-inline {
+    width: auto;
+    min-width: 0;
+}
+
+.ow-open-btn {
+    min-width: 12.8rem;
+    box-shadow: 0 10px 24px rgba(27, 41, 255, 0.22);
+}
+
+.ow-connection-block {
+    display: grid;
+    gap: 0.38rem;
+}
+
+.ow-log-box {
+    display: grid;
+    gap: 0.5rem;
+}
+
+.ow-log-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 0.4rem;
+}
+
+.ow-log-item {
+    border-radius: 0.72rem;
+    border: 1px solid #e1e8f7;
+    background: #fff;
+    padding: 0.52rem 0.56rem;
+    display: grid;
+    gap: 0.2rem;
+    color: #334155;
+    font-size: 0.74rem;
+}
+
+.ow-log-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.35rem;
+    font-weight: 700;
+    color: #1e293b;
+}
+
+.ow-log-item.level-success .ow-log-head {
+    color: var(--ow-success);
+}
+
+.ow-log-item.level-warning .ow-log-head {
+    color: var(--ow-warning);
+}
+
+.ow-log-item.level-error .ow-log-head {
+    color: var(--ow-danger);
+}
+
+.ow-footer {
+    margin: 0;
+    position: relative;
+    z-index: 3;
+    max-width: 28rem;
+    text-align: center;
+    color: #64748b;
+    font-size: 0.72rem;
+}
+
+@media (max-width: 640px) {
+    .ow-shell {
+        padding-top: 0.85rem;
+        padding-bottom: 2.2rem;
+        padding-left: 0.75rem;
+        padding-right: 0.75rem;
+    }
+
+    .ow-card {
+        border-radius: 1.45rem;
+    }
+
+    .ow-card-auth {
+        width: 100%;
+    }
+
+    .ow-card-shell {
+        width: 100%;
+        min-height: calc(100vh - 6.4rem);
+        height: calc(100vh - 6.4rem);
+        height: calc(100dvh - 6.4rem);
+        border-radius: 0.95rem;
+    }
+
+    .ow-card-shell .ow-card-body {
+        min-height: calc(100vh - 6.4rem);
+        height: calc(100vh - 6.4rem);
+        height: calc(100dvh - 6.4rem);
+        padding: 0.72rem;
+    }
+
+    .ow-card-shell .ow-app-shell {
+        min-height: calc(100vh - 6.7rem);
+    }
+
+    .ow-card-body {
+        padding: 1.25rem 0.95rem;
+    }
+
+    .ow-auth-panel {
+        width: 100%;
+    }
+
+    .ow-inline-actions.ow-inline-row {
+        justify-content: space-between;
+    }
+
+    .ow-auth-panel .ow-inline-row {
+        flex-direction: row;
+        align-items: center;
+        gap: 0.5rem;
+    }
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .ow-progress-fill,
+    .ow-btn-primary,
+    .ow-btn-secondary,
+    .ow-btn-icon,
+    .ow-link,
+    .ow-input {
+        transition: none;
+    }
+
+    .ow-soft-pulse-dot,
+    .ow-soft-pulse-ring,
+    .ow-soft-pulse-orb,
+    .ow-soft-disabled-cta {
+        animation: none;
+    }
+
+}
diff --git a/ee/apps/den-web/app/layout.tsx b/ee/apps/den-web/app/layout.tsx
new file mode 100644
index 0000000000..9cae212a15
--- /dev/null
+++ b/ee/apps/den-web/app/layout.tsx
@@ -0,0 +1,72 @@
+import type { Metadata } from "next";
+import { IBM_Plex_Mono, Inter } from "next/font/google";
+import Script from "next/script";
+import "./globals.css";
+
+const inter = Inter({
+  subsets: ["latin"],
+  variable: "--font-inter",
+  display: "swap"
+});
+
+const ibmPlexMono = IBM_Plex_Mono({
+  subsets: ["latin"],
+  variable: "--font-ibm-plex-mono",
+  display: "swap",
+  weight: ["400", "500"]
+});
+
+export const metadata: Metadata = {
+  metadataBase: new URL("https://app.openworklabs.com"),
+  title: "OpenWork Cloud",
+  description:
+    "Share your OpenWork setup with your team, manage billing, and use OpenWork Cloud from app.openworklabs.com.",
+  openGraph: {
+    title: "OpenWork Cloud",
+    description:
+      "Share your OpenWork setup with your team and keep selected workflows available in OpenWork Cloud.",
+    images: ["/opengraph-image"]
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "OpenWork Cloud",
+    description:
+      "Share your OpenWork setup with your team and manage OpenWork Cloud from app.openworklabs.com.",
+    images: ["/opengraph-image"]
+  },
+  icons: {
+    icon: "/openwork-mark.svg"
+  }
+};
+
+const defaultPosthogKey = "phc_4YnPTlDVYPjgwKvLuNxhbHjV5kadgvd7XLzVHWnCXAI";
+const defaultPosthogProxyPath = "/ow";
+const posthogKey =
+  process.env.NEXT_PUBLIC_POSTHOG_KEY?.trim() ||
+  process.env.NEXT_PUBLIC_POSTHOG_API_KEY?.trim() ||
+  defaultPosthogKey;
+const posthogHost = (process.env.NEXT_PUBLIC_POSTHOG_HOST ?? defaultPosthogProxyPath).trim();
+
+const posthogBootstrap = posthogKey
+  ? `!function(t,e){var o,n,p,r;e.__SV||(window.posthog&&window.posthog.__loaded)||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture identify alias reset register unregister setPersonProperties".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])})}(document,window.posthog||[]);
+posthog.init(${JSON.stringify(posthogKey)}, {
+  api_host: ${JSON.stringify(posthogHost)},
+  defaults: '2025-11-30',
+  person_profiles: 'identified_only'
+});`
+  : "";
+
+export default function RootLayout({
+  children
+}: Readonly<{ children: React.ReactNode }>) {
+  return (
+    <html lang="en" className={`${inter.variable} ${ibmPlexMono.variable}`}>
+      <head>
+        {posthogBootstrap ? (
+          <Script id="posthog" strategy="beforeInteractive" dangerouslySetInnerHTML={{ __html: posthogBootstrap }} />
+        ) : null}
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}
diff --git a/ee/apps/den-web/app/mcp/consent/page.tsx b/ee/apps/den-web/app/mcp/consent/page.tsx
new file mode 100644
index 0000000000..727114eddd
--- /dev/null
+++ b/ee/apps/den-web/app/mcp/consent/page.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { useMemo, useState } from "react";
+
+function getErrorMessage(payload: unknown, fallback: string) {
+  if (payload && typeof payload === "object" && "message" in payload && typeof payload.message === "string") return payload.message;
+  if (payload && typeof payload === "object" && "error" in payload && typeof payload.error === "string") return payload.error;
+  return fallback;
+}
+
+async function submitConsent(accept: boolean, oauthQuery: string, scope: string) {
+  const response = await fetch("/api/auth/oauth2/consent", {
+    method: "POST",
+    credentials: "include",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ accept, scope, oauth_query: oauthQuery }),
+  });
+  const payload = await response.json().catch(() => null) as unknown;
+  return { response, payload };
+}
+
+export default function McpConsentPage() {
+  const [status, setStatus] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const params = useMemo(() => {
+    if (typeof window === "undefined") return new URLSearchParams();
+    return new URLSearchParams(window.location.search);
+  }, []);
+  const oauthQuery = useMemo(() => {
+    if (typeof window === "undefined") return "";
+    return window.location.search.replace(/^\?/, "");
+  }, []);
+  const clientId = params.get("client_id") ?? "MCP client";
+  const scope = params.get("scope") ?? "openid profile email mcp:read";
+
+  async function decide(accept: boolean) {
+    setBusy(true);
+    setStatus(accept ? "Authorizing MCP client..." : "Denying authorization...");
+    const result = await submitConsent(accept, oauthQuery, scope);
+    if (!result.response.ok) {
+      setBusy(false);
+      setStatus(getErrorMessage(result.payload, "Failed to submit consent."));
+      return;
+    }
+    if (result.payload && typeof result.payload === "object" && "url" in result.payload && typeof result.payload.url === "string") {
+      window.location.href = result.payload.url;
+      return;
+    }
+    window.location.reload();
+  }
+
+  return (
+    <main className="min-h-screen bg-slate-950 px-6 py-12 text-white">
+      <section className="mx-auto max-w-xl rounded-3xl border border-white/10 bg-white/10 p-8 shadow-2xl">
+        <p className="text-sm uppercase tracking-[0.3em] text-cyan-200">OpenWork MCP</p>
+        <h1 className="mt-3 text-3xl font-semibold">Authorize MCP access</h1>
+        <p className="mt-3 text-sm text-slate-300">`{clientId}` wants to access OpenWork through MCP.</p>
+        <div className="mt-6 rounded-2xl border border-white/10 bg-slate-900/70 p-4">
+          <p className="text-sm font-medium text-slate-200">Requested scopes</p>
+          <p className="mt-2 break-words font-mono text-xs text-cyan-100">{scope}</p>
+        </div>
+        {status ? <p className="mt-4 text-sm text-slate-300">{status}</p> : null}
+        <div className="mt-6 grid gap-3 sm:grid-cols-2">
+          <button className="rounded-2xl border border-white/15 px-4 py-3 font-semibold text-white disabled:opacity-50" disabled={busy} onClick={() => void decide(false)}>
+            Deny
+          </button>
+          <button className="rounded-2xl bg-cyan-300 px-4 py-3 font-semibold text-slate-950 disabled:opacity-50" disabled={busy} onClick={() => void decide(true)}>
+            Authorize
+          </button>
+        </div>
+      </section>
+    </main>
+  );
+}
diff --git a/ee/apps/den-web/app/mcp/select-organization/page.tsx b/ee/apps/den-web/app/mcp/select-organization/page.tsx
new file mode 100644
index 0000000000..d996393105
--- /dev/null
+++ b/ee/apps/den-web/app/mcp/select-organization/page.tsx
@@ -0,0 +1,391 @@
+"use client";
+
+import Link from "next/link";
+import { useEffect, useMemo, useState } from "react";
+
+type Organization = {
+  id: string;
+  slug?: string | null;
+  name?: string | null;
+  role?: string | null;
+  isActive?: boolean;
+};
+
+type FlowState =
+  | "loading"
+  | "ready"
+  | "empty"
+  | "submitting"
+  | "redirecting"
+  | "error";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function readPayloadString(payload: unknown, key: "message" | "error" | "url") {
+  if (isRecord(payload) && typeof payload[key] === "string") {
+    return payload[key] as string;
+  }
+  return null;
+}
+
+function getErrorMessage(payload: unknown, fallback: string) {
+  return (
+    readPayloadString(payload, "message") ??
+    readPayloadString(payload, "error") ??
+    fallback
+  );
+}
+
+async function requestJson(path: string, init?: RequestInit) {
+  const response = await fetch(path, {
+    credentials: "include",
+    headers: { "content-type": "application/json", ...(init?.headers ?? {}) },
+    ...init,
+  });
+  const payload = (await response.json().catch(() => null)) as unknown;
+  return { response, payload };
+}
+
+function getInitials(value: string) {
+  const cleaned = value.trim();
+  if (!cleaned) return "OW";
+  const parts = cleaned.split(/\s+/).filter(Boolean);
+  const initials =
+    (parts[0]?.slice(0, 1) ?? "") + (parts[1]?.slice(0, 1) ?? "");
+  return initials.toUpperCase() || cleaned.slice(0, 2).toUpperCase();
+}
+
+function formatRole(role: string | null | undefined) {
+  if (!role) return "Member";
+  return role
+    .split(/[-_,\s]+/)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function parseOrgs(payload: unknown): Organization[] {
+  if (!isRecord(payload) || !Array.isArray(payload.orgs)) {
+    return [];
+  }
+
+  const result: Organization[] = [];
+  for (const entry of payload.orgs) {
+    if (!isRecord(entry) || typeof entry.id !== "string") continue;
+    result.push({
+      id: entry.id,
+      slug: typeof entry.slug === "string" ? entry.slug : null,
+      name: typeof entry.name === "string" ? entry.name : null,
+      role: typeof entry.role === "string" ? entry.role : null,
+      isActive: entry.isActive === true,
+    });
+  }
+  return result;
+}
+
+export default function McpSelectOrganizationPage() {
+  const [orgs, setOrgs] = useState<Organization[]>([]);
+  const [selectedOrgId, setSelectedOrgId] = useState("");
+  const [flowState, setFlowState] = useState<FlowState>("loading");
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  const oauthQuery = useMemo(() => {
+    if (typeof window === "undefined") return "";
+    return window.location.search.replace(/^\?/, "");
+  }, []);
+  const params = useMemo(() => new URLSearchParams(oauthQuery), [oauthQuery]);
+  const requestedScope = useMemo(
+    () => params.get("scope") ?? "openid profile email mcp:read",
+    [params],
+  );
+  const selectedOrg = useMemo(
+    () => orgs.find((org) => org.id === selectedOrgId) ?? null,
+    [orgs, selectedOrgId],
+  );
+  const isBusy = flowState === "submitting" || flowState === "redirecting";
+
+  useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      const { response, payload } = await requestJson("/api/den/v1/me/orgs", {
+        method: "GET",
+      });
+      if (cancelled) return;
+
+      if (!response.ok) {
+        setErrorMessage(
+          getErrorMessage(payload, "Sign in before authorizing MCP access."),
+        );
+        setFlowState("error");
+        return;
+      }
+
+      const list = parseOrgs(payload);
+      setOrgs(list);
+      setSelectedOrgId(
+        list.find((org) => org.isActive)?.id ?? list[0]?.id ?? "",
+      );
+      setFlowState(list.length ? "ready" : "empty");
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  async function continueFlow() {
+    if (!selectedOrgId) return;
+    setFlowState("submitting");
+    setErrorMessage(null);
+
+    const active = await requestJson("/api/auth/organization/set-active", {
+      method: "POST",
+      body: JSON.stringify({
+        organizationId: selectedOrgId,
+        organizationSlug: selectedOrg?.slug ?? null,
+      }),
+    });
+    if (!active.response.ok) {
+      setFlowState("ready");
+      setErrorMessage(
+        getErrorMessage(active.payload, "Failed to select organization."),
+      );
+      return;
+    }
+
+    const continued = await requestJson("/api/auth/oauth2/consent", {
+      method: "POST",
+      body: JSON.stringify({
+        accept: true,
+        scope: requestedScope,
+        oauth_query: oauthQuery,
+      }),
+    });
+    if (!continued.response.ok) {
+      setFlowState("ready");
+      setErrorMessage(
+        getErrorMessage(
+          continued.payload,
+          "Failed to continue OAuth authorization.",
+        ),
+      );
+      return;
+    }
+
+    const redirectUrl = readPayloadString(continued.payload, "url");
+    setFlowState("redirecting");
+    if (redirectUrl) {
+      window.location.href = redirectUrl;
+      return;
+    }
+    window.location.reload();
+  }
+
+  async function cancelFlow() {
+    setFlowState("submitting");
+    setErrorMessage(null);
+
+    const denied = await requestJson("/api/auth/oauth2/consent", {
+      method: "POST",
+      body: JSON.stringify({
+        accept: false,
+        scope: requestedScope,
+        oauth_query: oauthQuery,
+      }),
+    });
+
+    const redirectUrl = readPayloadString(denied.payload, "url");
+    if (redirectUrl) {
+      setFlowState("redirecting");
+      window.location.href = redirectUrl;
+      return;
+    }
+
+    setFlowState(orgs.length ? "ready" : "empty");
+    setErrorMessage("Authorization cancelled. You can close this tab.");
+  }
+
+  const introCopy =
+    flowState === "loading"
+      ? "Loading the workspaces you can access..."
+      : flowState === "empty"
+        ? "You don't belong to any workspaces yet. Create one before authorizing the MCP client."
+        : flowState === "redirecting"
+          ? "Finishing authorization and sending you back to the MCP client now."
+          : flowState === "submitting"
+            ? "Authorizing the MCP client..."
+            : "The MCP client will only see data for the workspace you choose.";
+
+  const primaryLabel =
+    flowState === "submitting"
+      ? "Authorizing..."
+      : flowState === "redirecting"
+        ? "Redirecting..."
+        : "Authorize and continue";
+
+  return (
+    <main className="den-page flex min-h-screen w-full items-center py-6">
+      <section className="grid w-full items-stretch gap-6 lg:grid-cols-[minmax(0,1fr)_minmax(360px,440px)]">
+        <aside className="order-2 lg:order-1">
+          <div className="den-frame relative h-full min-h-[300px] overflow-hidden bg-[#011627] px-7 py-8 text-white md:px-10 md:py-10">
+            <div
+              aria-hidden
+              className="absolute inset-0 z-0 opacity-95"
+              style={{
+                backgroundImage:
+                  "radial-gradient(circle at 18% 28%, rgba(99, 102, 241, 0.55), transparent 55%), radial-gradient(circle at 82% 62%, rgba(34, 211, 238, 0.4), transparent 55%), linear-gradient(160deg, #0F172A 0%, #1E1B4B 55%, #0F766E 100%)",
+              }}
+            />
+            <div className="relative z-10 flex h-full flex-col justify-between gap-10">
+              <div className="flex items-center gap-3">
+                <img
+                  src="/openwork-logo-transparent.svg"
+                  alt="OpenWork"
+                  className="h-9 w-auto"
+                />
+                <span className="text-[13px] font-medium text-white/80">
+                  OpenWork Cloud
+                </span>
+              </div>
+              <div className="grid gap-4">
+                <span className="inline-flex w-fit rounded-full border border-white/20 bg-white/15 px-3 py-1 text-[10px] font-medium uppercase tracking-[0.18em] text-white backdrop-blur-md">
+                  MCP authorization
+                </span>
+                <h1 className="max-w-[14ch] text-[2rem] font-semibold leading-[0.97] tracking-[-0.05em] md:text-[2.6rem]">
+                  Pick the workspace this client can use.
+                </h1>
+                <p className="max-w-[34rem] text-[14px] leading-7 text-white/80">
+                  The MCP client only sees data and tools for the workspace you
+                  select here.
+                </p>
+              </div>
+            </div>
+          </div>
+        </aside>
+
+        <div className="order-1 lg:order-2">
+          <div className="den-frame grid h-full gap-6 p-6 md:p-7">
+            <div className="grid gap-3">
+              <p className="den-eyebrow">Choose workspace</p>
+              <h2 className="den-title-lg">
+                Where should this client work?
+              </h2>
+              <p className="den-copy">{introCopy}</p>
+            </div>
+
+            {flowState === "loading" ? (
+              <div className="h-2 overflow-hidden rounded-full bg-[var(--dls-hover)]">
+                <div className="h-full w-1/3 animate-pulse rounded-full bg-[var(--dls-accent)]" />
+              </div>
+            ) : null}
+
+            {flowState === "empty" ? (
+              <div className="grid gap-3">
+                <Link
+                  href="/organization"
+                  className="den-button-primary w-full sm:w-auto"
+                >
+                  Create your first workspace
+                </Link>
+                <p className="text-[13px] text-[var(--dls-text-secondary)]">
+                  Once it is set up, run the MCP authorization again from your
+                  client.
+                </p>
+              </div>
+            ) : null}
+
+            {orgs.length > 0 &&
+            (flowState === "ready" ||
+              flowState === "submitting" ||
+              flowState === "redirecting") ? (
+              <ul className="grid gap-2">
+                {orgs.map((org) => {
+                  const display = org.name || org.slug || org.id;
+                  const isSelected = selectedOrgId === org.id;
+                  return (
+                    <li key={org.id}>
+                      <label
+                        className={`flex cursor-pointer items-center gap-3 rounded-2xl border bg-white px-4 py-3 transition-colors ${
+                          isSelected
+                            ? "border-[var(--dls-accent)] shadow-[0_0_0_4px_rgba(15,23,42,0.06)]"
+                            : "border-[var(--dls-border)] hover:bg-[var(--dls-hover)]"
+                        } ${isBusy ? "pointer-events-none opacity-70" : ""}`}
+                      >
+                        <input
+                          type="radio"
+                          name="mcp-organization"
+                          checked={isSelected}
+                          onChange={() => setSelectedOrgId(org.id)}
+                          className="sr-only"
+                          disabled={isBusy}
+                        />
+                        <span
+                          aria-hidden
+                          className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-[#011627] text-[12px] font-semibold uppercase tracking-[0.08em] text-white"
+                        >
+                          {getInitials(display)}
+                        </span>
+                        <span className="grid flex-1 gap-0.5">
+                          <span className="text-[15px] font-medium text-[var(--dls-text-primary)]">
+                            {display}
+                          </span>
+                          <span className="text-[12px] text-[var(--dls-text-secondary)]">
+                            {formatRole(org.role)}
+                            {org.isActive ? " · Current workspace" : ""}
+                          </span>
+                        </span>
+                        <span
+                          aria-hidden
+                          className={`flex h-5 w-5 shrink-0 items-center justify-center rounded-full border ${
+                            isSelected
+                              ? "border-[var(--dls-accent)] bg-[var(--dls-accent)]"
+                              : "border-[var(--dls-border)] bg-white"
+                          }`}
+                        >
+                          {isSelected ? (
+                            <span className="h-2 w-2 rounded-full bg-white" />
+                          ) : null}
+                        </span>
+                      </label>
+                    </li>
+                  );
+                })}
+              </ul>
+            ) : null}
+
+            {errorMessage ? (
+              <div className="den-notice is-error">{errorMessage}</div>
+            ) : null}
+
+            <div className="grid gap-3 sm:flex sm:flex-wrap sm:items-center sm:justify-between">
+              <button
+                type="button"
+                className="den-button-ghost w-full sm:w-auto"
+                onClick={() => void cancelFlow()}
+                disabled={isBusy || flowState === "loading"}
+              >
+                Cancel
+              </button>
+              <button
+                type="button"
+                className="den-button-primary w-full sm:w-auto"
+                onClick={() => void continueFlow()}
+                disabled={
+                  isBusy ||
+                  flowState === "loading" ||
+                  flowState === "empty" ||
+                  flowState === "error" ||
+                  !selectedOrgId
+                }
+              >
+                {primaryLabel}
+              </button>
+            </div>
+          </div>
+        </div>
+      </section>
+    </main>
+  );
+}
diff --git a/ee/apps/den-web/app/opengraph-image.tsx b/ee/apps/den-web/app/opengraph-image.tsx
new file mode 100644
index 0000000000..cc1d708f03
--- /dev/null
+++ b/ee/apps/den-web/app/opengraph-image.tsx
@@ -0,0 +1,191 @@
+import { ImageResponse } from "next/og";
+
+export const alt = "OpenWork Cloud";
+export const size = {
+  width: 1200,
+  height: 630
+};
+
+export const contentType = "image/png";
+
+function StatusDot(props: { color: string }) {
+  return (
+    <div
+      style={{
+        width: 10,
+        height: 10,
+        borderRadius: 999,
+        background: props.color
+      }}
+    />
+  );
+}
+
+export default function OpenGraphImage() {
+  return new ImageResponse(
+    (
+      <div
+        style={{
+          width: "100%",
+          height: "100%",
+          display: "flex",
+          position: "relative",
+          overflow: "hidden",
+          background: "linear-gradient(180deg, #f8fafc 0%, #eef2f7 100%)",
+          color: "#011627",
+          fontFamily: "Inter, sans-serif"
+        }}
+      >
+        <div
+          style={{
+            position: "absolute",
+            inset: 0,
+            background: "radial-gradient(circle at top left, rgba(15, 23, 42, 0.08), transparent 30%), radial-gradient(circle at right center, rgba(79, 109, 255, 0.12), transparent 24%)"
+          }}
+        />
+
+        <div
+          style={{
+            display: "flex",
+            width: "100%",
+            justifyContent: "space-between",
+            padding: "56px 60px",
+            gap: 32,
+            position: "relative"
+          }}
+        >
+          <div style={{ display: "flex", flexDirection: "column", width: 580, gap: 24 }}>
+            <div style={{ display: "flex", alignItems: "center", gap: 14 }}>
+              <div
+                style={{
+                  width: 52,
+                  height: 52,
+                  borderRadius: 18,
+                  background: "#011627",
+                  color: "#ffffff",
+                  display: "flex",
+                  alignItems: "center",
+                  justifyContent: "center",
+                  fontSize: 20,
+                  fontWeight: 700
+                }}
+              >
+                OW
+              </div>
+              <div style={{ display: "flex", flexDirection: "column", gap: 4 }}>
+                <div style={{ fontSize: 16, fontWeight: 700, textTransform: "uppercase", letterSpacing: 3, color: "#64748b" }}>
+                  OpenWork Cloud
+                </div>
+                <div style={{ fontSize: 24, fontWeight: 600 }}>OpenWork Cloud</div>
+              </div>
+            </div>
+
+            <div style={{ display: "flex", flexDirection: "column", gap: 10, fontSize: 64, fontWeight: 600, letterSpacing: -2.8, lineHeight: 0.98 }}>
+              <div>Share your setup</div>
+              <div>with your team.</div>
+            </div>
+
+            <div style={{ fontSize: 24, lineHeight: 1.45, color: "#475569", display: "flex", maxWidth: 520 }}>
+              Share setups across your org, keep selected workflows available, and manage OpenWork Cloud from app.openworklabs.com.
+            </div>
+
+            <div style={{ display: "flex", gap: 12, flexWrap: "wrap" }}>
+              {[
+                "Open source",
+                "50+ integrations and LLMs",
+                "Free first worker",
+                "Polar billing for scale"
+              ].map((label) => (
+                <div
+                  key={label}
+                  style={{
+                    display: "flex",
+                    padding: "12px 18px",
+                    borderRadius: 999,
+                    border: "1px solid rgba(148, 163, 184, 0.35)",
+                    background: "rgba(255, 255, 255, 0.82)",
+                    fontSize: 16,
+                    fontWeight: 600,
+                    color: "#334155"
+                  }}
+                >
+                  {label}
+                </div>
+              ))}
+            </div>
+          </div>
+
+          <div
+            style={{
+              width: 430,
+              display: "flex",
+              flexDirection: "column",
+              borderRadius: 28,
+              overflow: "hidden",
+              background: "#151718",
+              boxShadow: "0 32px 90px -45px rgba(15, 23, 42, 0.75)",
+              border: "1px solid rgba(255,255,255,0.65)"
+            }}
+          >
+            <div
+              style={{
+                height: 54,
+                display: "flex",
+                alignItems: "center",
+                padding: "0 20px",
+                position: "relative",
+                background: "#1d1f21",
+                borderBottom: "1px solid rgba(255,255,255,0.08)"
+              }}
+            >
+              <div style={{ display: "flex", gap: 8 }}>
+                <StatusDot color="#ff5f56" />
+                <StatusDot color="#ffbd2e" />
+                <StatusDot color="#27c93f" />
+              </div>
+              <div style={{ position: "absolute", left: "50%", transform: "translateX(-50%)", color: "#94a3b8", fontSize: 14, letterSpacing: 2, textTransform: "uppercase" }}>
+                ops-worker-01
+              </div>
+            </div>
+
+            <div style={{ display: "flex", flexDirection: "column", gap: 18, padding: 22, color: "white" }}>
+              <div style={{ display: "flex", alignItems: "center", gap: 10, color: "#94a3b8", fontSize: 13, fontWeight: 700, textTransform: "uppercase", letterSpacing: 2.5 }}>
+                <div style={{ width: 10, height: 10, borderRadius: 999, background: "#3ddc97", boxShadow: "0 0 0 8px rgba(61, 220, 151, 0.14)" }} />
+                Running
+              </div>
+
+              {[
+                ["9:41 AM", "GitHub", "Reviewed PR #247, approved"],
+                ["10:12 AM", "Slack", "Flagged invoice #1092 as duplicate"],
+                ["1:30 PM", "Linear", "Triaged 8 issues, 2 critical"],
+                ["3:15 PM", "Polar", "Checkout return ready for launch"]
+              ].map(([time, source, detail]) => (
+                <div
+                  key={`${time}-${source}`}
+                  style={{
+                    display: "flex",
+                    flexDirection: "column",
+                    gap: 8,
+                    padding: "14px 16px",
+                    borderRadius: 18,
+                    background: "rgba(255,255,255,0.06)",
+                    border: "1px solid rgba(255,255,255,0.08)"
+                  }}
+                >
+                  <div style={{ display: "flex", alignItems: "center", gap: 10 }}>
+                    <div style={{ fontSize: 13, fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace", color: "#94a3b8" }}>{time}</div>
+                    <div style={{ padding: "4px 8px", borderRadius: 999, background: "rgba(255,255,255,0.07)", fontSize: 11, fontWeight: 700, textTransform: "uppercase", letterSpacing: 1.5, color: "#cbd5e1" }}>
+                      {source}
+                    </div>
+                  </div>
+                  <div style={{ fontSize: 18, lineHeight: 1.45, color: "#f8fafc" }}>{detail}</div>
+                </div>
+              ))}
+            </div>
+          </div>
+        </div>
+      </div>
+    ),
+    size
+  );
+}
diff --git a/ee/apps/den-web/components/den-admin-panel.tsx b/ee/apps/den-web/components/den-admin-panel.tsx
new file mode 100644
index 0000000000..3ac4b46984
--- /dev/null
+++ b/ee/apps/den-web/components/den-admin-panel.tsx
@@ -0,0 +1,745 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+
+type AccessState = "loading" | "ready" | "signed-out" | "forbidden" | "error";
+type WorkerFilter = "all" | "with-workers" | "without-workers";
+type BillingFilter = "all" | "paid" | "unpaid" | "unavailable";
+
+type AdminBillingStatus = {
+  status: "paid" | "unpaid" | "unavailable";
+  featureGateEnabled: boolean;
+  subscriptionId: string | null;
+  subscriptionStatus: string | null;
+  currentPeriodEnd: string | null;
+  source: "benefit" | "subscription" | "unavailable";
+  note: string | null;
+};
+
+type AdminEntry = {
+  email: string;
+  note: string | null;
+};
+
+type AdminSummary = {
+  totalUsers: number;
+  verifiedUsers: number;
+  recentUsers7d: number;
+  recentUsers30d: number;
+  totalWorkers: number;
+  cloudWorkers: number;
+  localWorkers: number;
+  usersWithWorkers: number;
+  usersWithoutWorkers: number;
+  paidUsers: number | null;
+  unpaidUsers: number | null;
+  billingUnavailableUsers: number | null;
+  adminCount: number;
+  billingLoaded: boolean;
+};
+
+type AdminUser = {
+  id: string;
+  name: string | null;
+  email: string;
+  emailVerified: boolean;
+  createdAt: string | null;
+  updatedAt: string | null;
+  lastSeenAt: string | null;
+  sessionCount: number;
+  authProviders: string[];
+  workerCount: number;
+  cloudWorkerCount: number;
+  localWorkerCount: number;
+  latestWorkerCreatedAt: string | null;
+  billing: AdminBillingStatus | null;
+};
+
+type AdminPayload = {
+  viewer: {
+    id: string;
+    email: string | null;
+    name: string | null;
+  };
+  admins: AdminEntry[];
+  summary: AdminSummary;
+  users: AdminUser[];
+  generatedAt: string | null;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function toStringValue(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function toNumberValue(value: unknown): number {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+function toNullableNumberValue(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+
+function parseBillingStatus(value: unknown): AdminBillingStatus | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+
+  const status = value.status === "paid" || value.status === "unpaid" || value.status === "unavailable"
+    ? value.status
+    : "unavailable";
+  const source = value.source === "benefit" || value.source === "subscription" || value.source === "unavailable"
+    ? value.source
+    : "unavailable";
+
+  return {
+    status,
+    featureGateEnabled: value.featureGateEnabled === true,
+    subscriptionId: toStringValue(value.subscriptionId),
+    subscriptionStatus: toStringValue(value.subscriptionStatus),
+    currentPeriodEnd: toStringValue(value.currentPeriodEnd),
+    source,
+    note: toStringValue(value.note)
+  };
+}
+
+function parseAdminPayload(payload: unknown): AdminPayload | null {
+  if (!isRecord(payload) || !isRecord(payload.summary) || !Array.isArray(payload.users) || !Array.isArray(payload.admins)) {
+    return null;
+  }
+
+  const viewer = isRecord(payload.viewer) ? payload.viewer : {};
+  const summary = payload.summary;
+
+  const users: AdminUser[] = payload.users
+    .map((value) => {
+      if (!isRecord(value) || typeof value.id !== "string" || typeof value.email !== "string") {
+        return null;
+      }
+
+      const authProviders = Array.isArray(value.authProviders)
+        ? value.authProviders.filter((provider): provider is string => typeof provider === "string")
+        : [];
+
+      return {
+        id: value.id,
+        name: toStringValue(value.name),
+        email: value.email,
+        emailVerified: value.emailVerified === true,
+        createdAt: toStringValue(value.createdAt),
+        updatedAt: toStringValue(value.updatedAt),
+        lastSeenAt: toStringValue(value.lastSeenAt),
+        sessionCount: toNumberValue(value.sessionCount),
+        authProviders,
+        workerCount: toNumberValue(value.workerCount),
+        cloudWorkerCount: toNumberValue(value.cloudWorkerCount),
+        localWorkerCount: toNumberValue(value.localWorkerCount),
+        latestWorkerCreatedAt: toStringValue(value.latestWorkerCreatedAt),
+        billing: parseBillingStatus(value.billing)
+      };
+    })
+    .filter((value): value is AdminUser => value !== null);
+
+  const admins: AdminEntry[] = payload.admins
+    .map((value) => {
+      if (!isRecord(value) || typeof value.email !== "string") {
+        return null;
+      }
+
+      return {
+        email: value.email,
+        note: toStringValue(value.note)
+      };
+    })
+    .filter((value): value is AdminEntry => value !== null);
+
+  return {
+    viewer: {
+      id: typeof viewer.id === "string" ? viewer.id : "unknown",
+      email: toStringValue(viewer.email),
+      name: toStringValue(viewer.name)
+    },
+    admins,
+    summary: {
+      totalUsers: toNumberValue(summary.totalUsers),
+      verifiedUsers: toNumberValue(summary.verifiedUsers),
+      recentUsers7d: toNumberValue(summary.recentUsers7d),
+      recentUsers30d: toNumberValue(summary.recentUsers30d),
+      totalWorkers: toNumberValue(summary.totalWorkers),
+      cloudWorkers: toNumberValue(summary.cloudWorkers),
+      localWorkers: toNumberValue(summary.localWorkers),
+      usersWithWorkers: toNumberValue(summary.usersWithWorkers),
+      usersWithoutWorkers: toNumberValue(summary.usersWithoutWorkers),
+      paidUsers: toNullableNumberValue(summary.paidUsers),
+      unpaidUsers: toNullableNumberValue(summary.unpaidUsers),
+      billingUnavailableUsers: toNullableNumberValue(summary.billingUnavailableUsers),
+      adminCount: toNumberValue(summary.adminCount),
+      billingLoaded: summary.billingLoaded === true
+    },
+    users,
+    generatedAt: toStringValue(payload.generatedAt)
+  };
+}
+
+function getFriendlyHtmlError(value: string): string | null {
+  const normalized = value.replace(/\s+/g, " ").trim();
+  const lower = normalized.toLowerCase();
+
+  if (!lower) {
+    return null;
+  }
+
+  if (lower.includes("cannot get /v1/admin/overview")) {
+    return "The Den admin API is not live on the upstream service yet. The backend deploy likely failed or is still rolling out.";
+  }
+
+  if (lower.startsWith("<!doctype") || lower.startsWith("<html")) {
+    return "The upstream Den service returned HTML instead of JSON. This usually means the admin backend route is stale or unavailable.";
+  }
+
+  return null;
+}
+
+function getErrorMessage(payload: unknown, fallback: string): string {
+  if (typeof payload === "string") {
+    const friendly = getFriendlyHtmlError(payload);
+    if (friendly) {
+      return friendly;
+    }
+
+    if (payload.trim()) {
+      return payload.trim();
+    }
+  }
+
+  if (!isRecord(payload)) {
+    return fallback;
+  }
+
+  if (typeof payload.message === "string" && payload.message.trim()) {
+    return payload.message.trim();
+  }
+
+  if (typeof payload.error === "string" && payload.error.trim()) {
+    const friendly = getFriendlyHtmlError(payload.error);
+    return friendly ?? payload.error.trim();
+  }
+
+  return fallback;
+}
+
+async function requestJson(path: string) {
+  const response = await fetch(`/api/den${path}`, {
+    method: "GET",
+    credentials: "include",
+    headers: {
+      Accept: "application/json"
+    }
+  });
+
+  const text = await response.text();
+  let payload: unknown = null;
+
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = text;
+    }
+  }
+
+  return { response, payload };
+}
+
+function formatDateTime(value: string | null): string {
+  if (!value) {
+    return "-";
+  }
+
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "-";
+  }
+
+  return new Intl.DateTimeFormat(undefined, {
+    dateStyle: "medium",
+    timeStyle: "short"
+  }).format(date);
+}
+
+function formatRelativeTime(value: string | null): string {
+  if (!value) {
+    return "No activity";
+  }
+
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "No activity";
+  }
+
+  const diffMs = Date.now() - date.getTime();
+  const diffMinutes = Math.floor(diffMs / (60 * 1000));
+  if (diffMinutes < 1) {
+    return "Just now";
+  }
+  if (diffMinutes < 60) {
+    return `${diffMinutes}m ago`;
+  }
+
+  const diffHours = Math.floor(diffMinutes / 60);
+  if (diffHours < 24) {
+    return `${diffHours}h ago`;
+  }
+
+  const diffDays = Math.floor(diffHours / 24);
+  if (diffDays < 30) {
+    return `${diffDays}d ago`;
+  }
+
+  const diffMonths = Math.floor(diffDays / 30);
+  if (diffMonths < 12) {
+    return `${diffMonths}mo ago`;
+  }
+
+  return `${Math.floor(diffMonths / 12)}y ago`;
+}
+
+function formatProvider(provider: string): string {
+  return provider
+    .split(/[-_]/g)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function formatBillingStatus(value: AdminBillingStatus | null): string {
+  if (!value) {
+    return "Not loaded";
+  }
+
+  if (value.status === "paid") {
+    return "Paid";
+  }
+
+  if (value.status === "unpaid") {
+    return "Unpaid";
+  }
+
+  return "Unavailable";
+}
+
+function formatSubscriptionStatus(value: string | null): string {
+  if (!value) {
+    return "No subscription record";
+  }
+
+  return value
+    .split(/[-_]/g)
+    .filter(Boolean)
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join(" ");
+}
+
+function StatCard({ label, value, detail }: { label: string; value: string; detail: string }) {
+  return (
+    <div className="rounded-2xl border border-slate-200 bg-slate-50/70 p-4">
+      <p className="text-[0.68rem] font-semibold uppercase tracking-[0.16em] text-slate-500">{label}</p>
+      <p className="mt-2 text-2xl font-semibold tracking-[-0.04em] text-slate-950">{value}</p>
+      <p className="mt-1 text-sm leading-6 text-slate-500">{detail}</p>
+    </div>
+  );
+}
+
+function MetaCell({ label, value }: { label: string; value: string }) {
+  return (
+    <div>
+      <p className="text-[0.68rem] font-semibold uppercase tracking-[0.14em] text-slate-500">{label}</p>
+      <p className="mt-1 text-sm text-slate-700">{value}</p>
+    </div>
+  );
+}
+
+function BillingPill({ billing }: { billing: AdminBillingStatus | null }) {
+  if (!billing) {
+    return (
+      <span className="inline-flex items-center rounded-full border border-slate-200 bg-slate-100 px-2.5 py-1 text-[0.68rem] font-semibold uppercase tracking-[0.16em] text-slate-500">
+        Not loaded
+      </span>
+    );
+  }
+
+  const palette =
+    billing.status === "paid"
+      ? "border-emerald-200 bg-emerald-50 text-emerald-700"
+      : billing.status === "unpaid"
+        ? "border-amber-200 bg-amber-50 text-amber-700"
+        : "border-slate-200 bg-slate-100 text-slate-600";
+
+  return (
+    <span className={`inline-flex items-center rounded-full border px-2.5 py-1 text-[0.68rem] font-semibold uppercase tracking-[0.16em] ${palette}`}>
+      {formatBillingStatus(billing)}
+    </span>
+  );
+}
+
+export function DenAdminPanel() {
+  const [accessState, setAccessState] = useState<AccessState>("loading");
+  const [payload, setPayload] = useState<AdminPayload | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [refreshing, setRefreshing] = useState(false);
+  const [query, setQuery] = useState("");
+  const [workerFilter, setWorkerFilter] = useState<WorkerFilter>("all");
+  const [billingFilter, setBillingFilter] = useState<BillingFilter>("all");
+  const [selectedUserId, setSelectedUserId] = useState<string | null>(null);
+  const [includeBilling, setIncludeBilling] = useState(false);
+
+  const loadOverview = useCallback(async (loadBilling: boolean) => {
+    setRefreshing(true);
+    setError(null);
+
+    try {
+      const suffix = loadBilling ? "?includeBilling=1" : "";
+      const { response, payload: nextPayload } = await requestJson(`/v1/admin/overview${suffix}`);
+
+      if (response.status === 401) {
+        setAccessState("signed-out");
+        setPayload(null);
+        return;
+      }
+
+      if (response.status === 403) {
+        setAccessState("forbidden");
+        setPayload(null);
+        return;
+      }
+
+      if (!response.ok) {
+        setAccessState("error");
+        setPayload(null);
+        setError(getErrorMessage(nextPayload, `Backoffice request failed with ${response.status}.`));
+        return;
+      }
+
+      const parsed = parseAdminPayload(nextPayload);
+      if (!parsed) {
+        setAccessState("error");
+        setPayload(null);
+        setError("Backoffice payload was missing required fields.");
+        return;
+      }
+
+      setIncludeBilling(parsed.summary.billingLoaded);
+      setAccessState("ready");
+      setPayload(parsed);
+    } catch (nextError) {
+      setAccessState("error");
+      setPayload(null);
+      setError(nextError instanceof Error ? nextError.message : "Unknown network error");
+    } finally {
+      setRefreshing(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void loadOverview(false);
+  }, [loadOverview]);
+
+  const filteredUsers = useMemo(() => {
+    if (!payload) {
+      return [] as AdminUser[];
+    }
+
+    const normalizedQuery = query.trim().toLowerCase();
+    return payload.users.filter((user) => {
+      if (workerFilter === "with-workers" && user.workerCount === 0) {
+        return false;
+      }
+
+      if (workerFilter === "without-workers" && user.workerCount > 0) {
+        return false;
+      }
+
+      if (payload.summary.billingLoaded && billingFilter !== "all") {
+        if (!user.billing || user.billing.status !== billingFilter) {
+          return false;
+        }
+      }
+
+      if (!normalizedQuery) {
+        return true;
+      }
+
+      const haystack = [user.name ?? "", user.email, user.id, ...user.authProviders].join(" ").toLowerCase();
+      return haystack.includes(normalizedQuery);
+    });
+  }, [billingFilter, payload, query, workerFilter]);
+
+  useEffect(() => {
+    if (!payload) {
+      setSelectedUserId(null);
+      return;
+    }
+
+    setSelectedUserId((current) => {
+      if (current && filteredUsers.some((user) => user.id === current)) {
+        return current;
+      }
+
+      return filteredUsers[0]?.id ?? null;
+    });
+  }, [filteredUsers, payload]);
+
+  const selectedUser = useMemo(() => {
+    return filteredUsers.find((user) => user.id === selectedUserId) ?? filteredUsers[0] ?? null;
+  }, [filteredUsers, selectedUserId]);
+
+  if (accessState === "loading") {
+    return (
+      <section className="mx-auto w-full max-w-6xl rounded-3xl border border-slate-200 bg-white p-8 shadow-sm">
+        <p className="text-sm text-slate-500">Loading Den admin...</p>
+      </section>
+    );
+  }
+
+  if (accessState === "signed-out" || accessState === "forbidden" || accessState === "error") {
+    const title = accessState === "signed-out"
+      ? "Sign in required"
+      : accessState === "forbidden"
+        ? "Admin access required"
+        : "Backoffice unavailable";
+    const message = accessState === "signed-out"
+      ? "Use the main Den page to sign in, then return with a whitelisted admin account."
+      : accessState === "forbidden"
+        ? "Your session is valid, but the email on it is not present in the Den admin allowlist."
+        : error ?? "The backoffice request failed before the dashboard could load.";
+
+    return (
+      <section className="mx-auto w-full max-w-4xl rounded-3xl border border-slate-200 bg-white p-8 shadow-sm">
+        <p className="text-[0.7rem] font-semibold uppercase tracking-[0.18em] text-slate-500">Den admin</p>
+        <h1 className="mt-3 text-3xl font-semibold tracking-[-0.04em] text-slate-950">{title}</h1>
+        <p className="mt-3 max-w-2xl text-sm leading-7 text-slate-600">{message}</p>
+        <div className="mt-6 flex flex-wrap gap-3">
+          <a
+            href="/"
+            className="inline-flex items-center justify-center rounded-full bg-slate-950 px-4 py-2 text-sm font-semibold text-white"
+          >
+            Open sign-in page
+          </a>
+          <button
+            type="button"
+            onClick={() => {
+              void loadOverview(includeBilling);
+            }}
+            className="inline-flex items-center justify-center rounded-full border border-slate-200 bg-white px-4 py-2 text-sm font-semibold text-slate-700"
+          >
+            Retry
+          </button>
+        </div>
+      </section>
+    );
+  }
+
+  if (!payload) {
+    return null;
+  }
+
+  const billingDetail = payload.summary.billingLoaded
+    ? `${payload.summary.paidUsers ?? 0} paid / ${payload.summary.unpaidUsers ?? 0} unpaid`
+    : "Load billing only when you need it";
+
+  return (
+    <section className="mx-auto w-full max-w-6xl rounded-3xl border border-slate-200 bg-white shadow-sm">
+      <div className="border-b border-slate-200 px-6 py-6 sm:px-8">
+        <div className="flex flex-col gap-4 lg:flex-row lg:items-end lg:justify-between">
+          <div>
+            <p className="text-[0.7rem] font-semibold uppercase tracking-[0.18em] text-slate-500">Den admin</p>
+            <h1 className="mt-2 text-3xl font-semibold tracking-[-0.04em] text-slate-950">User backoffice</h1>
+            <p className="mt-2 max-w-3xl text-sm leading-7 text-slate-600">
+              Lightweight internal view for signups, worker creation, and on-demand billing checks.
+            </p>
+          </div>
+
+          <div className="flex flex-wrap items-center gap-3">
+            <div className="rounded-full border border-slate-200 bg-slate-50 px-4 py-2 text-sm text-slate-600">
+              {payload.viewer.email ?? payload.viewer.id}
+            </div>
+            <button
+              type="button"
+              onClick={() => {
+                void loadOverview(includeBilling);
+              }}
+              disabled={refreshing}
+              className="inline-flex items-center justify-center rounded-full border border-slate-200 bg-white px-4 py-2 text-sm font-semibold text-slate-700 disabled:cursor-not-allowed disabled:opacity-60"
+            >
+              {refreshing ? "Refreshing..." : "Refresh"}
+            </button>
+          </div>
+        </div>
+
+        <div className="mt-6 grid gap-3 sm:grid-cols-2 xl:grid-cols-6">
+          <StatCard label="Users" value={String(payload.summary.totalUsers)} detail={`${payload.summary.recentUsers7d} new in 7d`} />
+          <StatCard label="Verified" value={String(payload.summary.verifiedUsers)} detail={`${payload.summary.totalUsers - payload.summary.verifiedUsers} still unverified`} />
+          <StatCard label="Worker creators" value={String(payload.summary.usersWithWorkers)} detail={`${payload.summary.usersWithoutWorkers} without workers`} />
+          <StatCard label="Workers" value={String(payload.summary.totalWorkers)} detail={`${payload.summary.cloudWorkers} cloud / ${payload.summary.localWorkers} local`} />
+          <StatCard label="Billing" value={payload.summary.billingLoaded ? String(payload.summary.paidUsers ?? 0) : "On demand"} detail={billingDetail} />
+          <StatCard label="Admins" value={String(payload.summary.adminCount)} detail="Whitelisted operator accounts" />
+        </div>
+
+        <div className="mt-5 flex flex-wrap gap-2">
+          {payload.admins.map((admin) => (
+            <span key={admin.email} className="inline-flex items-center rounded-full border border-slate-200 bg-slate-50 px-3 py-1.5 text-xs font-medium text-slate-700">
+              {admin.email}
+            </span>
+          ))}
+        </div>
+      </div>
+
+      <div className="px-6 py-6 sm:px-8">
+        <div className="flex flex-col gap-3 lg:flex-row lg:items-end lg:justify-between">
+          <div className="grid gap-3 sm:grid-cols-[minmax(0,1fr)_13rem_13rem]">
+            <label className="grid gap-2">
+              <span className="text-[0.68rem] font-semibold uppercase tracking-[0.14em] text-slate-500">Search users</span>
+              <input
+                value={query}
+                onChange={(event) => setQuery(event.target.value)}
+                placeholder="Email, name, user id, provider"
+                className="rounded-2xl border border-slate-200 bg-white px-4 py-3 text-sm text-slate-900 outline-none transition focus:border-slate-400"
+              />
+            </label>
+
+            <label className="grid gap-2">
+              <span className="text-[0.68rem] font-semibold uppercase tracking-[0.14em] text-slate-500">Workers</span>
+              <select
+                value={workerFilter}
+                onChange={(event) => setWorkerFilter(event.target.value as WorkerFilter)}
+                className="rounded-2xl border border-slate-200 bg-white px-4 py-3 text-sm text-slate-900 outline-none transition focus:border-slate-400"
+              >
+                <option value="all">All users</option>
+                <option value="with-workers">With workers</option>
+                <option value="without-workers">Without workers</option>
+              </select>
+            </label>
+
+            <label className="grid gap-2">
+              <span className="text-[0.68rem] font-semibold uppercase tracking-[0.14em] text-slate-500">Billing</span>
+              <select
+                value={billingFilter}
+                onChange={(event) => setBillingFilter(event.target.value as BillingFilter)}
+                disabled={!payload.summary.billingLoaded}
+                className="rounded-2xl border border-slate-200 bg-white px-4 py-3 text-sm text-slate-900 outline-none transition focus:border-slate-400 disabled:cursor-not-allowed disabled:bg-slate-100 disabled:text-slate-400"
+              >
+                <option value="all">All users</option>
+                <option value="paid">Paid</option>
+                <option value="unpaid">Unpaid</option>
+                <option value="unavailable">Unavailable</option>
+              </select>
+            </label>
+          </div>
+
+          {!payload.summary.billingLoaded ? (
+            <button
+              type="button"
+              onClick={() => {
+                void loadOverview(true);
+              }}
+              disabled={refreshing}
+              className="inline-flex items-center justify-center rounded-full bg-slate-950 px-4 py-2 text-sm font-semibold text-white disabled:cursor-not-allowed disabled:opacity-60"
+            >
+              Load billing statuses
+            </button>
+          ) : (
+            <p className="text-sm text-slate-500">Billing loaded for {payload.summary.totalUsers} users.</p>
+          )}
+        </div>
+
+        <div className="mt-6 grid gap-3">
+          {filteredUsers.length > 0 ? filteredUsers.map((user) => {
+            const isSelected = user.id === selectedUser?.id;
+
+            return (
+              <button
+                key={user.id}
+                type="button"
+                onClick={() => setSelectedUserId(user.id)}
+                className={`rounded-2xl border px-4 py-4 text-left transition ${isSelected ? "border-slate-900 bg-slate-50" : "border-slate-200 bg-white hover:border-slate-300 hover:bg-slate-50/70"}`}
+              >
+                <div className="flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between">
+                  <div className="min-w-0">
+                    <div className="flex flex-wrap items-center gap-2">
+                      <p className="truncate text-base font-semibold text-slate-950">{user.name?.trim() || user.email}</p>
+                      {user.emailVerified ? (
+                        <span className="inline-flex items-center rounded-full border border-emerald-200 bg-emerald-50 px-2 py-0.5 text-[0.66rem] font-semibold uppercase tracking-[0.14em] text-emerald-700">
+                          Verified
+                        </span>
+                      ) : null}
+                    </div>
+                    <p className="mt-1 truncate text-sm text-slate-500">{user.email}</p>
+                  </div>
+
+                  <div className="flex flex-wrap items-center gap-2">
+                    <BillingPill billing={user.billing} />
+                    <span className="inline-flex items-center rounded-full border border-slate-200 bg-slate-50 px-2.5 py-1 text-[0.68rem] font-semibold uppercase tracking-[0.14em] text-slate-600">
+                      {user.workerCount} workers
+                    </span>
+                  </div>
+                </div>
+
+                <div className="mt-4 grid gap-4 sm:grid-cols-2 xl:grid-cols-4">
+                  <MetaCell label="Signed up" value={formatDateTime(user.createdAt)} />
+                  <MetaCell label="Last seen" value={user.lastSeenAt ? `${formatRelativeTime(user.lastSeenAt)} · ${formatDateTime(user.lastSeenAt)}` : "No sessions yet"} />
+                  <MetaCell label="Sessions" value={String(user.sessionCount)} />
+                  <MetaCell label="Workers" value={`${user.cloudWorkerCount} cloud / ${user.localWorkerCount} local`} />
+                </div>
+
+                {isSelected ? (
+                  <div className="mt-4 grid gap-4 border-t border-slate-200 pt-4 lg:grid-cols-2">
+                    <div className="grid gap-4">
+                      <MetaCell label="Auth providers" value={user.authProviders.length > 0 ? user.authProviders.map(formatProvider).join(", ") : "No provider records"} />
+                      <MetaCell label="Latest worker" value={user.latestWorkerCreatedAt ? `${formatRelativeTime(user.latestWorkerCreatedAt)} · ${formatDateTime(user.latestWorkerCreatedAt)}` : "No workers created"} />
+                    </div>
+
+                    <div className="grid gap-4">
+                      {user.billing ? (
+                        <>
+                          <MetaCell label="Subscription" value={formatSubscriptionStatus(user.billing.subscriptionStatus)} />
+                          <MetaCell label="Billing note" value={user.billing.note ?? "No billing note returned."} />
+                        </>
+                      ) : (
+                        <div className="rounded-2xl border border-slate-200 bg-slate-50 px-4 py-4">
+                          <p className="text-sm leading-7 text-slate-600">
+                            Billing is intentionally loaded on demand to keep the admin page fast.
+                          </p>
+                          <button
+                            type="button"
+                            onClick={(event) => {
+                              event.stopPropagation();
+                              void loadOverview(true);
+                            }}
+                            disabled={refreshing}
+                            className="mt-3 inline-flex items-center justify-center rounded-full bg-slate-950 px-4 py-2 text-sm font-semibold text-white disabled:cursor-not-allowed disabled:opacity-60"
+                          >
+                            Load billing statuses
+                          </button>
+                        </div>
+                      )}
+                    </div>
+                  </div>
+                ) : null}
+              </button>
+            );
+          }) : (
+            <div className="rounded-2xl border border-dashed border-slate-300 bg-slate-50 px-5 py-10 text-center">
+              <p className="text-base font-semibold text-slate-950">No users match the current filters</p>
+              <p className="mt-2 text-sm leading-7 text-slate-500">Try broadening search or relaxing the worker and billing filters.</p>
+            </div>
+          )}
+        </div>
+
+        <p className="mt-6 text-xs leading-6 text-slate-500">Snapshot generated {formatDateTime(payload.generatedAt)}.</p>
+      </div>
+    </section>
+  );
+}
diff --git a/ee/apps/den-web/components/den-marketing-rail.tsx b/ee/apps/den-web/components/den-marketing-rail.tsx
new file mode 100644
index 0000000000..506ed1baa0
--- /dev/null
+++ b/ee/apps/den-web/components/den-marketing-rail.tsx
@@ -0,0 +1,161 @@
+type DenMarketingRailProps = {
+  compact?: boolean;
+};
+
+const useCaseCards = [
+  {
+    label: "OPS",
+    title: "Invoice tracking, doc generation",
+    body: "Watches incoming invoices, flags issues, and delivers a morning summary to Slack.",
+    detail: "~2 hrs/week back",
+    accent: "from-[#ffb570] via-[#ff9e43] to-[#f97316]"
+  },
+  {
+    label: "CODE",
+    title: "PR review, issue triage",
+    body: "Checks PRs against your style guide, sorts issues by severity, and drafts first responses.",
+    detail: "Runs on every push",
+    accent: "from-[#6e87ff] via-[#4f6dff] to-[#1b29ff]"
+  },
+  {
+    label: "CONTENT",
+    title: "Social drafts, follow-up emails",
+    body: "Writes drafts from your changelog or CRM data. You approve before anything goes out.",
+    detail: "You approve, it sends",
+    accent: "from-[#67d9d1] via-[#3fcfc3] to-[#0f9f9a]"
+  }
+];
+
+const activityEntries = [
+  { time: "9:41 AM", source: "GitHub", tone: "bg-[#22c55e]", lines: ["Reviewed PR #247, approved"] },
+  { time: "10:12 AM", source: "Slack", tone: "bg-[#f59e0b]", lines: ["Flagged invoice #1092", "Duplicate detected"] },
+  { time: "1:30 PM", source: "Linear", tone: "bg-[#ef4444]", lines: ["Triaged 8 issues", "2 critical"] },
+  { time: "3:15 PM", source: "Slack", tone: "bg-[#22c55e]", lines: ["Weekly digest sent", "to #ops"] }
+];
+
+function ActivityPanel() {
+  return (
+    <div className="overflow-hidden rounded-[2rem] border border-white/70 bg-[#151718] shadow-[0_26px_70px_-36px_rgba(15,23,42,0.55)]">
+      <div className="relative flex items-center border-b border-white/10 bg-[#1d1f21] px-4 py-3">
+        <div className="flex gap-2">
+          <span className="h-3 w-3 rounded-full bg-[#ff5f56]" />
+          <span className="h-3 w-3 rounded-full bg-[#ffbd2e]" />
+          <span className="h-3 w-3 rounded-full bg-[#27c93f]" />
+        </div>
+        <div className="absolute left-1/2 -translate-x-1/2 text-[11px] font-medium uppercase tracking-[0.2em] text-slate-400">
+          ops-worker-01
+        </div>
+      </div>
+
+      <div className="space-y-4 px-4 py-4 text-white">
+        <div className="inline-flex items-center gap-2 text-[11px] font-semibold uppercase tracking-[0.22em] text-[#9aa3af]">
+          <span className="h-2.5 w-2.5 rounded-full bg-[#3ddc97] shadow-[0_0_0_6px_rgba(61,220,151,0.12)]" />
+          Running
+        </div>
+
+        <div className="relative space-y-3 pl-8 before:absolute before:bottom-2 before:left-[9px] before:top-1 before:w-px before:bg-white/10 before:content-['']">
+          {activityEntries.map((entry) => (
+            <div key={`${entry.time}-${entry.source}`} className="relative rounded-[1.1rem] border border-white/8 bg-white/6 px-3 py-3 shadow-[0_18px_34px_-28px_rgba(15,23,42,0.75)]">
+              <span className={`absolute -left-8 top-[0.3rem] h-2.5 w-2.5 rounded-full ${entry.tone}`} />
+              <div className="mb-2 flex items-center gap-2">
+                <span className="font-mono text-[11px] text-slate-400">{entry.time}</span>
+                <span className="rounded-full border border-white/10 bg-white/6 px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.12em] text-slate-300">
+                  {entry.source}
+                </span>
+              </div>
+              <div className="space-y-0.5 text-[13px] leading-6 text-slate-100">
+                {entry.lines.map((line) => (
+                  <div key={line}>{line}</div>
+                ))}
+              </div>
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function PricingCards() {
+  return (
+    <div className="grid gap-4 lg:grid-cols-2">
+      <article className="flex h-full flex-col rounded-[1.6rem] border border-[#dbe1e8] bg-[linear-gradient(180deg,#ffffff,#f6f7f9)] px-4 py-4 shadow-[0_10px_26px_-22px_rgba(15,23,42,0.18)]">
+        <div className="text-[11px] font-semibold uppercase tracking-[0.18em] text-[#64748b]">Human repetitive work</div>
+        <div className="mt-3 text-[1.95rem] font-medium leading-[0.95] tracking-tight text-[#0f172a]">$2k-4k/mo</div>
+        <div className="mt-4 space-y-3 text-[13px] leading-6 text-[#64748b]">
+          <div>Best when the work needs constant human judgment.</div>
+          <div>Expensive for follow-through and reminders.</div>
+        </div>
+      </article>
+
+      <article className="flex h-full flex-col rounded-[1.6rem] border border-[#c4cbd5] bg-[radial-gradient(circle_at_top,rgba(15,23,42,0.08),transparent_45%),linear-gradient(180deg,#fbfbfc,#eef1f4)] px-4 py-4 shadow-[0_20px_44px_-28px_rgba(15,23,42,0.28)] ring-1 ring-[#0f172a]/5">
+        <div className="flex items-center justify-between gap-3">
+          <div className="text-[11px] font-semibold uppercase tracking-[0.18em] text-[#111827]">Den worker</div>
+          <div className="inline-flex items-center rounded-full bg-[#111827] px-2.5 py-1 text-[10px] font-semibold uppercase tracking-[0.14em] text-white">
+            Recommended
+          </div>
+        </div>
+        <div className="mt-3 text-[2rem] font-medium leading-[0.95] tracking-tight text-[#0f172a]">$50/mo</div>
+        <div className="mt-4 space-y-3 text-[13px] leading-6 text-[#42526a]">
+          <div>Handles repetitive work continuously instead of in bursts.</div>
+          <div>Keeps humans focused on approvals and exceptions.</div>
+        </div>
+      </article>
+    </div>
+  );
+}
+
+export function DenMarketingRail({ compact = false }: DenMarketingRailProps) {
+  return (
+    <div className="grid gap-6 text-[#011627]">
+      <div className="grid gap-5">
+        <div className="inline-flex items-center gap-2 text-[11px] font-semibold uppercase tracking-[0.24em] text-slate-500">
+          OpenWork hosted
+        </div>
+        <div className="grid gap-4">
+          <h1 className="max-w-[12ch] text-[2.7rem] font-medium leading-[0.95] tracking-[-0.055em] text-[#011627] md:text-[3.5rem]">
+            Always-on AI workers for you and your team.
+          </h1>
+          <p className="max-w-[38rem] text-[16px] leading-8 text-slate-600">
+            Define a task, deploy a worker, and check results from Slack or Telegram. Den handles the repetitive work so your team can stay focused on approvals and exceptions.
+          </p>
+        </div>
+        <div className="flex flex-wrap items-center gap-2.5 text-[13px] font-medium text-slate-700">
+          <span className="rounded-full border border-slate-200 bg-white/80 px-4 py-2 shadow-[0_10px_20px_-18px_rgba(15,23,42,0.32)]">Open source</span>
+          <span className="rounded-full border border-slate-200 bg-white/80 px-4 py-2 shadow-[0_10px_20px_-18px_rgba(15,23,42,0.32)]">50+ integrations and LLMs</span>
+        </div>
+      </div>
+
+      <div className="grid gap-5 xl:grid-cols-[minmax(0,1.08fr)_minmax(300px,0.92fr)] xl:items-start">
+        <div className="grid gap-4 sm:grid-cols-3 xl:grid-cols-1">
+          {useCaseCards.slice(0, compact ? 2 : useCaseCards.length).map((card) => (
+            <article key={card.label} className="rounded-[1.7rem] border border-slate-200/80 bg-white/88 p-5 shadow-[0_24px_60px_-42px_rgba(15,23,42,0.35)] backdrop-blur">
+              <div className={`mb-4 h-3.5 w-3.5 rounded-full bg-gradient-to-br ${card.accent}`} />
+              <div className="mb-2 text-[11px] font-semibold uppercase tracking-[0.22em] text-slate-500">{card.label}</div>
+              <h2 className="text-[1.35rem] font-medium leading-[1.08] tracking-[-0.035em] text-[#011627]">{card.title}</h2>
+              <p className="mt-3 text-[14px] leading-7 text-slate-600">{card.body}</p>
+              <div className="mt-5 font-mono text-[12px] text-slate-500">{card.detail}</div>
+            </article>
+          ))}
+        </div>
+
+        <ActivityPanel />
+      </div>
+
+      {!compact ? (
+        <section className="grid gap-4 rounded-[2rem] border border-slate-200/80 bg-[radial-gradient(circle_at_top_right,rgba(15,23,42,0.08),transparent_30%),linear-gradient(180deg,rgba(255,255,255,0.94),rgba(244,246,248,0.98))] p-5 shadow-[0_28px_70px_-48px_rgba(15,23,42,0.28)]">
+          <div>
+            <div className="text-[11px] font-semibold uppercase tracking-[0.22em] text-slate-500">Pricing</div>
+            <p className="mt-3 max-w-[28rem] text-[2rem] font-medium leading-[1.02] tracking-[-0.045em] text-[#011627]">
+              Replace repetitive work with a $50 worker.
+            </p>
+            <p className="mt-3 max-w-[38rem] text-[15px] leading-7 text-slate-600">
+              Start free, then use Den Cloud billing when you need more capacity. The app handles checkout return flows and billing management without sending people back to marketing pages.
+            </p>
+          </div>
+          <PricingCards />
+        </section>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-create.png b/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-create.png
new file mode 100644
index 0000000000..8173d7427e
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-create.png differ
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-rename.png b/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-rename.png
new file mode 100644
index 0000000000..62f6e7832c
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-detail-after-rename.png differ
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-edit-name-prefilled.png b/ee/apps/den-web/docs/screenshots/llm-provider-edit-name-prefilled.png
new file mode 100644
index 0000000000..35c247ad10
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-edit-name-prefilled.png differ
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-list-after-rename.png b/ee/apps/den-web/docs/screenshots/llm-provider-list-after-rename.png
new file mode 100644
index 0000000000..870075da65
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-list-after-rename.png differ
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-new-filled.png b/ee/apps/den-web/docs/screenshots/llm-provider-new-filled.png
new file mode 100644
index 0000000000..2630df6dc8
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-new-filled.png differ
diff --git a/ee/apps/den-web/docs/screenshots/llm-provider-new-name-field.png b/ee/apps/den-web/docs/screenshots/llm-provider-new-name-field.png
new file mode 100644
index 0000000000..8b82e46a51
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/llm-provider-new-name-field.png differ
diff --git a/ee/apps/den-web/docs/screenshots/members-rename-after.png b/ee/apps/den-web/docs/screenshots/members-rename-after.png
new file mode 100644
index 0000000000..e41e22b3da
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/members-rename-after.png differ
diff --git a/ee/apps/den-web/docs/screenshots/members-rename-before.png b/ee/apps/den-web/docs/screenshots/members-rename-before.png
new file mode 100644
index 0000000000..da28513f5b
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/members-rename-before.png differ
diff --git a/ee/apps/den-web/docs/screenshots/members-rename-editing.png b/ee/apps/den-web/docs/screenshots/members-rename-editing.png
new file mode 100644
index 0000000000..6db4632374
Binary files /dev/null and b/ee/apps/den-web/docs/screenshots/members-rename-editing.png differ
diff --git a/ee/apps/den-web/next-env.d.ts b/ee/apps/den-web/next-env.d.ts
new file mode 100644
index 0000000000..9edff1c7ca
--- /dev/null
+++ b/ee/apps/den-web/next-env.d.ts
@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/ee/apps/den-web/next.config.js b/ee/apps/den-web/next.config.js
new file mode 100644
index 0000000000..5ea6ece01a
--- /dev/null
+++ b/ee/apps/den-web/next.config.js
@@ -0,0 +1,11 @@
+const path = require("path");
+
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  reactStrictMode: true,
+  skipTrailingSlashRedirect: true,
+  transpilePackages: ["@openwork/ui", "@openwork-ee/utils"],
+  outputFileTracingRoot: path.join(__dirname, "../../.."),
+};
+
+module.exports = nextConfig;
diff --git a/ee/apps/den-web/package.json b/ee/apps/den-web/package.json
new file mode 100644
index 0000000000..3a06afb66b
--- /dev/null
+++ b/ee/apps/den-web/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "@openwork-ee/den-web",
+  "private": true,
+  "version": "0.0.0",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= next dev --hostname 0.0.0.0 --port 3005",
+    "dev:local": "sh -lc 'OPENWORK_DEV_MODE=1 NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= next dev --hostname 0.0.0.0 --port ${DEN_WEB_PORT:-3005}'",
+    "prebuild": "pnpm --dir ../../../packages/ui build && pnpm --dir ../../packages/utils build",
+    "build": "next build",
+    "start": "next start --hostname 0.0.0.0 --port 3005",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "@openwork/types": "workspace:*",
+    "@openwork-ee/utils": "workspace:*",
+    "@openwork/ui": "workspace:*",
+    "@paper-design/shaders-react": "0.0.72",
+    "@tanstack/react-query": "^5.96.2",
+    "lucide-react": "^0.577.0",
+    "next": "16.2.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4"
+  },
+  "devDependencies": {
+    "@types/node": "20.12.12",
+    "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3",
+    "autoprefixer": "10.4.19",
+    "postcss": "8.4.38",
+    "tailwindcss": "3.4.7",
+    "typescript": "5.4.5"
+  }
+}
diff --git a/postcss.config.cjs b/ee/apps/den-web/postcss.config.js
similarity index 67%
rename from postcss.config.cjs
rename to ee/apps/den-web/postcss.config.js
index 12a703d900..5cbc2c7d87 100644
--- a/postcss.config.cjs
+++ b/ee/apps/den-web/postcss.config.js
@@ -1,6 +1,6 @@
 module.exports = {
   plugins: {
     tailwindcss: {},
-    autoprefixer: {},
-  },
+    autoprefixer: {}
+  }
 };
diff --git a/ee/apps/den-web/proxy.ts b/ee/apps/den-web/proxy.ts
new file mode 100644
index 0000000000..9fd4c5cf27
--- /dev/null
+++ b/ee/apps/den-web/proxy.ts
@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+
+const POSTHOG_PROXY_PATH = "/ow";
+const POSTHOG_API_HOST = "us.i.posthog.com";
+const POSTHOG_ASSETS_HOST = "us-assets.i.posthog.com";
+
+export function proxy(request: NextRequest) {
+  const url = request.nextUrl.clone();
+  const { pathname } = url;
+
+  if (!pathname.startsWith(POSTHOG_PROXY_PATH)) {
+    return NextResponse.next();
+  }
+
+  const hostname = pathname.startsWith(`${POSTHOG_PROXY_PATH}/static/`)
+    ? POSTHOG_ASSETS_HOST
+    : POSTHOG_API_HOST;
+  const requestHeaders = new Headers(request.headers);
+
+  requestHeaders.set("host", hostname);
+  requestHeaders.delete("cookie");
+
+  url.protocol = "https";
+  url.hostname = hostname;
+  url.port = "443";
+  url.pathname = pathname.replace(/^\/ow/, "") || "/";
+
+  return NextResponse.rewrite(url, {
+    request: {
+      headers: requestHeaders
+    }
+  });
+}
+
+export const config = {
+  matcher: "/ow/:path*"
+};
diff --git a/ee/apps/den-web/public/openwork-logo-transparent.svg b/ee/apps/den-web/public/openwork-logo-transparent.svg
new file mode 100644
index 0000000000..f64cb6648c
--- /dev/null
+++ b/ee/apps/den-web/public/openwork-logo-transparent.svg
@@ -0,0 +1,12 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_182_19)">
+<path d="M612.283 48.1887C625.496 46.0953 647.01 49.7669 659.498 54.1301C674.701 59.4419 689.252 67.9192 703.298 75.7141C718.677 84.3343 734.102 92.872 749.572 101.326C768.927 111.916 788.228 122.606 807.473 133.396C840.683 151.785 870.254 166.532 883.97 205.384C893.264 231.712 891.051 259.314 891.044 286.774L891.035 375.676L891.027 510.719C891.027 548.514 892.711 592.842 885.28 629.363C877.45 668.196 860.873 704.734 836.807 736.199C819.076 759.099 797.811 779.03 773.812 795.243C753.081 809.457 728.663 821.54 706.376 833.38L617.657 880.867L519.187 933.624C490.696 948.991 465.95 966.39 433.129 970.741C420.834 972.69 402.72 969.583 391.229 965.263C381.115 961.46 370.688 955.51 361.175 950.28L324.758 930.253L256.121 892.792C236.955 882.325 217.038 872.18 199.807 858.867C174.606 839.396 159.573 811.138 156.147 779.58C153.961 759.436 154.618 735.47 154.621 714.854L154.558 621.205L154.822 470.301C155.178 436.128 153.699 403.213 160.327 369.35C166.568 336.451 180.643 305.541 201.361 279.235C215.839 261.25 232.92 245.526 252.038 232.581C269.567 220.687 292.408 208.988 311.365 198.724L398.702 151.378L502.977 95.0881L543.077 73.4368C567.921 60.1065 583.278 51.3671 612.283 48.1887ZM833.058 194.304C823.696 186.764 810.462 183.336 798.57 184.177C771.778 187.62 742.31 206.444 718.286 219.565L628.893 268.315C589.049 289.644 549.367 311.277 509.854 333.213C493.187 342.415 468.999 354.487 453.64 364.719C437.593 375.25 423.409 388.377 411.669 403.562C393.449 427.391 381.387 455.347 376.551 484.951C373.498 502.539 373.265 522.833 373.19 540.702L373.144 586.463L373.108 737.774L373.06 834.782C373.036 850.93 372.755 867.066 373.301 883.201C374.493 918.481 396.493 935.629 430.624 933.974C454.078 931.219 483.649 912.278 504.852 900.772L597.104 850.665L686.12 802.92C707.445 791.522 728.945 780.569 749.24 767.331C798.823 734.99 835.505 681.466 848.284 623.706C855.778 589.832 854.001 552.144 854.009 517.346L854.081 399.85C854.507 364.925 854.64 329.996 854.48 295.069C854.474 284.199 854.406 273.352 854.338 262.486C854.188 238.496 853.425 210.709 833.058 194.304ZM699.028 114.926C675.263 101.784 646.691 83.1971 618.776 85.2073C589.573 87.7692 569.517 101.526 544.458 115.132L465.686 158.248L345.258 223.919C316.332 239.825 284.352 255.692 258.192 275.931C226.008 300.832 206.21 336.477 198.533 376.138C192.736 406.084 194.036 436.541 193.35 466.938C192.258 519.066 193.754 571.457 193.968 623.546L194.003 719.207C194.002 757.248 188.736 801.436 221.267 828.343C231.847 837.093 242.715 842.79 254.608 849.344L288.732 868.112L319.865 885.469C324.589 888.118 331.038 892.047 335.685 894.323L335.066 888.161C333.868 859.228 334.498 827.775 334.504 798.64L334.711 648.9L334.819 558.867C334.801 526.582 333.303 498.295 340.325 466.563C348.141 430.493 365.381 397.139 390.288 369.904C418.661 339.049 446.341 325.558 482.31 306.174L539.163 275.25L694.589 190.489L740.329 165.625C748.779 161.046 757.55 156.593 765.789 151.719L699.028 114.926Z" fill="white"/>
+<path d="M612.283 48.1887C625.496 46.0953 647.01 49.7669 659.498 54.1301C674.701 59.4419 689.252 67.9192 703.298 75.7141C718.677 84.3343 734.102 92.872 749.572 101.326C768.927 111.916 788.228 122.606 807.473 133.396C840.683 151.785 870.254 166.532 883.97 205.384C893.264 231.712 891.051 259.314 891.044 286.774L891.035 375.676L891.027 510.719C891.027 548.514 892.711 592.842 885.28 629.363C877.45 668.196 860.873 704.734 836.807 736.199C819.076 759.099 797.811 779.03 773.812 795.243C753.081 809.457 728.663 821.54 706.376 833.38L617.657 880.867L519.187 933.624C490.696 948.991 465.95 966.39 433.129 970.741C420.834 972.69 402.72 969.583 391.229 965.263C381.115 961.46 370.688 955.51 361.175 950.28L324.758 930.253L256.121 892.792C236.955 882.325 217.038 872.18 199.807 858.867C174.606 839.396 159.573 811.138 156.147 779.58C153.961 759.436 154.618 735.47 154.621 714.854L154.558 621.205L154.822 470.301C155.178 436.128 153.699 403.213 160.327 369.35C166.568 336.451 180.643 305.541 201.361 279.235C215.839 261.25 232.92 245.526 252.038 232.581C269.567 220.687 292.408 208.988 311.365 198.724L398.702 151.378L502.977 95.0881L543.077 73.4368C567.921 60.1065 583.278 51.3671 612.283 48.1887ZM833.058 194.304C823.696 186.764 810.462 183.336 798.57 184.177C771.778 187.62 742.31 206.444 718.286 219.565L628.893 268.315C589.049 289.644 549.367 311.277 509.854 333.213C493.187 342.415 468.999 354.487 453.64 364.719C437.593 375.25 423.409 388.377 411.669 403.562C393.449 427.391 381.387 455.347 376.551 484.951C373.498 502.539 373.265 522.833 373.19 540.702L373.144 586.463L373.108 737.774L373.06 834.782C373.036 850.93 372.755 867.066 373.301 883.201C374.493 918.481 396.493 935.629 430.624 933.974C454.078 931.219 483.649 912.278 504.852 900.772L597.104 850.665L686.12 802.92C707.445 791.522 728.945 780.569 749.24 767.331C798.823 734.99 835.505 681.466 848.284 623.706C855.778 589.832 854.001 552.144 854.009 517.346L854.081 399.85C854.507 364.925 854.64 329.996 854.48 295.069C854.474 284.199 854.406 273.352 854.338 262.486C854.188 238.496 853.425 210.709 833.058 194.304ZM699.028 114.926C675.263 101.784 646.691 83.1971 618.776 85.2073C589.573 87.7692 569.517 101.526 544.458 115.132L465.686 158.248L345.258 223.919C316.332 239.825 284.352 255.692 258.192 275.931C226.008 300.832 206.21 336.477 198.533 376.138C192.736 406.084 194.036 436.541 193.35 466.938C192.258 519.066 193.754 571.457 193.968 623.546L194.003 719.207C194.002 757.248 188.736 801.436 221.267 828.343C231.847 837.093 242.715 842.79 254.608 849.344L288.732 868.112L319.865 885.469C324.589 888.118 331.038 892.047 335.685 894.323L335.066 888.161C333.868 859.228 334.498 827.775 334.504 798.64L334.711 648.9L334.819 558.867C334.801 526.582 333.303 498.295 340.325 466.563C348.141 430.493 365.381 397.139 390.288 369.904C418.661 339.049 446.341 325.558 482.31 306.174L539.163 275.25L694.589 190.489L740.329 165.625C748.779 161.046 757.55 156.593 765.789 151.719L699.028 114.926Z" stroke="black"/>
+<path d="M707.136 316.628C721.059 315.692 731.348 318.341 738.451 324.629C745.562 330.925 749.575 340.951 750.75 354.977C752.107 371.153 751.571 386.95 751.565 403.22L751.606 477.994L751.608 538.359V538.36C751.633 572.695 751.503 598.89 737.268 631.095C728.146 651.702 714.527 670.004 697.41 684.661L697.409 684.662C676.943 702.314 659.598 710.334 635.98 722.932L635.978 722.933L586.056 749.815L544.081 772.435C534.514 777.579 525.114 783.188 515.06 787.067C513.944 787.441 512.739 787.881 511.654 788.086C499.816 790.33 491.415 788.801 485.444 784.882C479.468 780.96 475.838 774.585 473.666 766.955C471.493 759.325 470.794 750.489 470.643 741.717C470.492 732.925 470.89 724.301 470.896 716.971L470.927 647.705L470.959 556.256L470.955 552.466C470.837 513.478 469.04 479.71 492.344 445.513C510.52 418.843 533.546 407.36 560.949 392.612L560.951 392.61L602.102 370.225H602.103L660.639 338.258C667.632 334.456 675.45 329.791 683.469 325.685C691.468 321.589 699.592 318.09 707.136 316.628ZM713.285 496.62C644.143 531.96 575.912 571.385 507.254 607.595L506.988 607.736V608.036C506.983 613.716 506.787 647.908 506.725 681.064C506.694 697.638 506.696 713.95 506.774 726.3C506.813 732.475 506.871 737.661 506.952 741.396C506.992 743.262 507.039 744.77 507.092 745.858C507.119 746.401 507.147 746.845 507.178 747.178C507.194 747.344 507.21 747.488 507.228 747.606C507.244 747.713 507.266 747.832 507.301 747.929L507.353 748.069L507.472 748.158L507.937 748.503L508.195 748.695L508.477 748.54L607.909 693.874L607.91 693.873C618.778 687.883 631.73 681.28 644.136 674.15C656.55 667.015 668.482 659.315 677.361 651.088C692.481 637.21 703.503 619.447 709.22 599.735C711.523 591.803 713.05 583.665 713.78 575.437C714.03 572.658 714.449 554.214 714.645 535.938C714.743 526.793 714.786 517.678 714.724 510.568C714.693 507.013 714.635 503.956 714.545 501.646C714.501 500.491 714.448 499.519 714.385 498.762C714.324 498.021 714.251 497.445 714.156 497.112L714.125 497.002L714.049 496.917L713.886 496.734L713.629 496.444L713.285 496.62ZM711.494 352.851C709.637 352.076 708.003 352.436 706.092 352.578L706.015 352.583L705.944 352.612C698.889 355.425 686.232 362.852 679.152 366.748H679.151L629.312 394.263L569.9 426.668C547.09 439.062 525.912 446.909 515.215 472.603C506.341 493.917 506.996 512.768 506.979 535.002L506.955 567.674V568.538L507.704 568.109L514.16 564.408L651.968 489.63H651.969L694.011 466.743C699.714 463.658 709.097 458.251 714.832 455.792L715.136 455.662L715.135 455.33C715.038 434.764 715.049 414.198 715.169 393.633V393.63C715.172 389.759 715.464 380.757 715.231 372.222C715.115 367.951 714.866 363.773 714.382 360.388C714.14 358.696 713.837 357.189 713.458 355.96C713.082 354.746 712.613 353.744 712.004 353.12L711.945 353.06L711.868 353.022L711.494 352.851Z" fill="white" stroke="white"/>
+</g>
+<defs>
+<clipPath id="clip0_182_19">
+<rect width="1024" height="1024" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/ee/apps/den-web/public/openwork-mark.svg b/ee/apps/den-web/public/openwork-mark.svg
new file mode 100644
index 0000000000..e7ebb9153d
--- /dev/null
+++ b/ee/apps/den-web/public/openwork-mark.svg
@@ -0,0 +1,30 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 834 649"
+  fill="none"
+>
+  <path
+    fill="#011627"
+    d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z"
+  />
+  <path
+    fill="#011627"
+    d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z"
+  />
+</svg>
diff --git a/ee/apps/den-web/tailwind.config.js b/ee/apps/den-web/tailwind.config.js
new file mode 100644
index 0000000000..a267645b6e
--- /dev/null
+++ b/ee/apps/den-web/tailwind.config.js
@@ -0,0 +1,14 @@
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ["./app/**/*.{ts,tsx}", "./components/**/*.{ts,tsx}"],
+  theme: {
+    extend: {
+      colors: {
+        brandInk: "#161019",
+        brandOrange: "#ef7b35",
+        brandBlue: "#00a6fb"
+      }
+    }
+  },
+  plugins: []
+};
diff --git a/ee/apps/den-web/tsconfig.json b/ee/apps/den-web/tsconfig.json
new file mode 100644
index 0000000000..86866ab8da
--- /dev/null
+++ b/ee/apps/den-web/tsconfig.json
@@ -0,0 +1,36 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "DOM",
+      "DOM.Iterable",
+      "ES2022"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}
diff --git a/ee/apps/den-web/tsconfig.tsbuildinfo b/ee/apps/den-web/tsconfig.tsbuildinfo
new file mode 100644
index 0000000000..489f3f73a0
--- /dev/null
+++ b/ee/apps/den-web/tsconfig.tsbuildinfo
@@ -0,0 +1 @@
+{"program":{"fileNames":["../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es5.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.dom.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.dom.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.core.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.collection.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.generator.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.date.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.array.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.date.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.number.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.array.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.error.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.esnext.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.decorators.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.decorators.legacy.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/global.d.ts","../../../node_modules/.pnpm/csstype@3.2.3/node_modules/csstype/index.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/styled-jsx/types/css.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/styled-jsx/types/macro.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/styled-jsx/types/style.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/styled-jsx/types/global.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/styled-jsx/types/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/get-page-files.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/assert.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/assert/strict.d.ts","../../../node_modules/.pnpm/buffer@5.6.0/node_modules/buffer/index.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/header.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/readable.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/file.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/fetch.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/formdata.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/connector.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/client.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/errors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/global-dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/global-origin.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/pool-stats.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/handlers.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/balanced-pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-interceptor.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-client.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-errors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/proxy-agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/api.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/cookies.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/patch.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/filereader.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/diagnostics-channel.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/websocket.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/content-type.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/cache.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/interceptors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/index.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/globals.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/async_hooks.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/buffer.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/child_process.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/cluster.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/console.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/constants.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/crypto.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dgram.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/diagnostics_channel.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dns.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dns/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/domain.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dom-events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/fs.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/fs/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/http.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/http2.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/https.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/inspector.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/module.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/net.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/os.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/path.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/perf_hooks.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/process.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/punycode.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/querystring.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/readline.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/readline/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/repl.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/sea.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/consumers.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/web.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/string_decoder.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/test.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/timers.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/timers/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/tls.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/trace_events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/tty.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/url.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/util.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/v8.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/vm.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/wasi.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/worker_threads.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/zlib.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/globals.global.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/index.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/canary.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/experimental.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/index.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/canary.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/experimental.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/fallback.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/webpack/webpack.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/modern-browserslist-target.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/entry-constants.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/constants.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/bundler.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/load-custom-routes.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/image-config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/subresource-integrity-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/body-streams.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/search-params.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/segment-cache/vary-params-decoding.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/vary-params.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/params.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-kind.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-matches/route-match.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/app-router-headers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/cache-control.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/app-router-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/cache-handlers/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/use-cache/use-cache-wrapper.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/resume-data-cache/cache-store.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/resume-data-cache/resume-data-cache.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/constants.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/render-result.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/response-cache/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/response-cache/index.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/jsx-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/userspace/pages/pages-dev-overlay-setup.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/static-paths/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/app-page-route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/adapter/setup-node-env.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/instrumentation/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/setup-exception-listeners.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/worker.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/experimental/ppr.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/page-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/segment-config/app/app-segment-config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/segment-config/pages/pages-segment-config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/analysis/get-page-static-info.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/loaders/get-module-build-info.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/middleware-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/require-hook.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-polyfill-crypto.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-baseline.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/error-inspect.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/console-file.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/console-exit.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/console-dim.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/unhandled-rejection.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/random.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/date.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/web-crypto.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/node-crypto.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment-extensions/fast-set-immediate.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/node-environment.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/page-extensions-type.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/module.compiled.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/app-route-route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/i18n-provider.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/next-url.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@edge-runtime/cookies/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/cookies.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/request.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/deep-readonly.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/incremental-cache/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/middleware-route-matcher.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/flight-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/next-font-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/locale-route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/pages-route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/mitt.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/with-router.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/router.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/route-loader.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/page-loader.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/bloom-filter.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/router.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/loadable-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/loadable.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/image-config-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/readonly-url-search-params.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/hooks-client-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/head-manager-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/flight-data-helpers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/cache-key.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/router-reducer/fetch-server-response.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/segment-cache/segment-value-encoding.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/scheduler.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/cache-map.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/vary-path.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/cache.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/router-reducer/ppr-navigations.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/segment-cache/navigation.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/router-reducer/router-reducer-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/app-router-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/server-inserted-html.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/pages/vendored/contexts/entrypoints.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/pages/module.compiled.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/templates/pages.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/pages/module.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/render.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/pages-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-definitions/pages-api-route-definition.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-matches/pages-api-route-match.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-matchers/route-matcher.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-matcher-providers/route-matcher-provider.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-matcher-managers/route-matcher-manager.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/normalizer.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/locale-route-normalizer.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/request/pathname-normalizer.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/request/suffix.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/request/rsc.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/request/next-data.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/after/builtin-request-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/normalizers/request/segment-prefix-rsc.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/pages/builtin/_error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/load-default-error-components.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/base-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/after/after.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/after/after-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/use-cache/cache-life.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/work-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/lazy-result.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/create-error-handler.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/action-revalidation-kind.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/work-async-storage.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/async-storage/work-store.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/http.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/hooks-server-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-route/shared-modules.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/redirect-status-code.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/redirect-error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/adapters/request-cookies.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/async-storage/draft-mode-provider.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/adapters/headers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/cache-signal.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/instant-validation/boundary-tracking.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/instant-validation/instant-validation-error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/parse-relative-url.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/instant-validation/instant-samples.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/dynamic-rendering.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/work-unit-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/implicit-tags.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/staged-rendering.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/work-unit-async-storage.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/templates/app-route.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/action-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/action-async-storage.external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-route/module.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-route/module.compiled.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/segment-config/app/app-segments.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/get-supported-browsers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/utils.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/rendering-mode.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-utils/build-prefetch-segment-data-route.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/cpu-profile.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/turborepo-access-trace/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/turborepo-access-trace/result.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/turborepo-access-trace/helpers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/turborepo-access-trace/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/export/routes/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/export/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/export/worker.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/worker.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/coalesced-function.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-utils/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/trace/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/trace/trace.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/trace/shared.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/trace/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/load-jsconfig.d.ts","../../../node_modules/.pnpm/@next+env@16.2.1/node_modules/@next/env/dist/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/telemetry-plugin/use-cache-tracker-utils.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/plugins/telemetry-plugin/telemetry-plugin.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/telemetry/storage.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/build-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack-config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/swc/generated-native.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/define-env.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/swc/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/swc/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/parse-version-info.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/shared/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/dev-indicator-server-state.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/dev-overlay/cache-indicator.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/parse-stack.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/server/shared.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/shared/stack-frame.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/dev-overlay/utils/get-error-by-type.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/dev-overlay/container/runtime-error/render-error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/dev-overlay/shared.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/debug-channel.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/hot-reloader-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/fetch-event.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/response.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/segment-config/middleware/middleware-config.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/parse-url.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/base-http/node.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/async-callback-set.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/route-regex.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/route-matcher.d.ts","../../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/image-optimizer.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/next-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/lru-cache.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/dev-bundler-service.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/static-paths-worker.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/dev/next-dev-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/next.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/render-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/router/utils/path-match.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-utils/filesystem.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-utils/setup-dev-bundler.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/router-utils/router-server-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/route-module.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/load-components.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/adapter.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/loaders/metadata/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/webpack/loaders/next-app-loader/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/lib/app-dir-module.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/app-render.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/vendored/contexts/entrypoints.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/error-boundary.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/layout-router.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/render-from-template-context.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/client-page.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/client-segment.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/http-access-fallback/error-boundary.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/alternative-urls-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/extra-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/metadata-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/manifest-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/opengraph-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/twitter-types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/metadata-interface.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/resolvers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/types/icons.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/resolve-metadata.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/metadata/metadata.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/lib/framework/boundary-components.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/rsc/preloads.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/rsc/postpone.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/rsc/taint.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/collect-segment-data.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/instant-validation/instant-validation.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/next-devtools/userspace/app/segment-explorer-node.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/app-render/entry-base.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/templates/app-page.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/helpers/prerender-manifest-matcher.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/jsx-dev-runtime.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/compiler-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/vendored/rsc/entrypoints.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/client.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/static.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/vendored/ssr/entrypoints.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/route-modules/app-page/module.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/fallback-params.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/image-response.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/user-agent.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/url-pattern.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/after/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/connection.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/exports/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request-meta.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/cli/next-test.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/size-limit.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/config-shared.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/base-http/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/api-utils/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/build/adapter/build-complete.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/html-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/utils.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/pages/_app.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/app.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/unstable-cache.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/revalidate.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/web/spec-extension/unstable-no-store.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/use-cache/cache-tag.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/cache.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/pages/_document.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/document.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/dynamic.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dynamic.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/pages/_error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/catch-error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/api/error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/head.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/head.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/cookies.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/headers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/request/draft-mode.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/headers.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/get-img-props.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/image-component.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/shared/lib/image-external.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/image.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/link.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/link.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/unrecognized-action-error.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/redirect.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/not-found.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/forbidden.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/unauthorized.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/unstable-rethrow.server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/unstable-rethrow.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/navigation.react-server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/components/navigation.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/navigation.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/router.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/client/script.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/script.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@edge-runtime/primitives/url.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@vercel/og/satori/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@vercel/og/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/server.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/types/global.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/types/compiled.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/image-types/global.d.ts","./.next/dev/types/routes.d.ts","./next-env.d.ts","./proxy.ts","./app/(den)/_components/ui/dropdown-styles.ts","./app/(den)/_lib/consts.ts","./app/(den)/_lib/client-route.ts","./app/(den)/_lib/den-flow.ts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/json-schema.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/standard-schema.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/registries.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/to-json-schema.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/util.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/versions.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/schemas.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/checks.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/errors.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/core.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/parse.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/regexes.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ar.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/az.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/be.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/bg.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ca.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/cs.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/da.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/de.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/en.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/eo.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/es.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/fa.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/fi.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/fr.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/fr-ca.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/he.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/hu.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/hy.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/id.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/is.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/it.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ja.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ka.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/kh.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/km.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ko.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/lt.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/mk.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ms.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/nl.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/no.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ota.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ps.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/pl.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/pt.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ru.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/sl.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/sv.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ta.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/th.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/tr.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ua.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/uk.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/ur.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/uz.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/vi.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/zh-cn.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/zh-tw.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/yo.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/locales/index.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/doc.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/api.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/json-schema-processors.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/json-schema-generator.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/index.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/errors.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/parse.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/schemas.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/checks.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/compat.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/iso.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/coerce.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.d.cts","../../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/index.d.cts","../../../packages/types/src/den/desktop-app-restrictions.ts","./app/(den)/_lib/den-org.ts","./app/(den)/_lib/feedback.ts","./app/(den)/o/[orgslug]/dashboard/_components/shared-setup-data.ts","./app/api/_lib/upstream-proxy.ts","./app/api/auth/[...path]/route.ts","./app/api/den/[...path]/route.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@next/font/dist/types.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@next/font/dist/google/index.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/font/google/index.d.ts","./app/layout.tsx","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/compiled/@vercel/og/index.node.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/dist/server/og/image-response.d.ts","../../../node_modules/.pnpm/next@16.2.1_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@19.2.4_react@19.2.4__react@19.2.4/node_modules/next/og.d.ts","./app/opengraph-image.tsx","./app/(den)/_components/den-shell.tsx","./app/(den)/_providers/den-flow-provider.tsx","./app/(den)/layout.tsx","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shader-mount.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shader-sizing.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/types.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/smoke-ring.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/neuro-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dot-orbit.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dot-grid.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/simplex-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/metaballs.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/perlin-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/voronoi.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/waves.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/warp.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/god-rays.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/spiral.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/swirl.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/grain-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/pulsing-border.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/color-panels.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/static-mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/static-radial-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/paper-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/water.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/fluted-glass.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/image-dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/heatmap.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/liquid-metal.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/halftone-dots.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/halftone-cmyk.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/get-shader-color-from-string.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/get-shader-noise-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/empty-pixel.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/index.d.ts","../../../packages/ui/src/common/paper.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shader-mount.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/smoke-ring.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/neuro-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dot-orbit.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dot-grid.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/simplex-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/metaballs.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/waves.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/perlin-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/voronoi.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/warp.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/god-rays.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/spiral.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/swirl.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/grain-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/pulsing-border.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/color-panels.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/static-mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/static-radial-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/paper-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/fluted-glass.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/water.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/image-dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/heatmap.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/liquid-metal.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/halftone-dots.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/halftone-cmyk.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/index.d.ts","../../../packages/ui/src/react/paper/grain-gradient.tsx","../../../packages/ui/src/react/paper/mesh-gradient.tsx","../../../packages/ui/src/react/index.ts","../../../node_modules/.pnpm/lucide-react@0.577.0_react@19.2.4/node_modules/lucide-react/dist/lucide-react.d.ts","./app/(den)/_components/auth-panel.tsx","./app/(den)/_components/auth-screen.tsx","./app/(den)/page.tsx","./app/(den)/_components/checkout-screen.tsx","./app/(den)/_components/dashboard-redirect-screen.tsx","./app/(den)/_components/dashboard-screen.tsx","./app/(den)/_components/join-org-screen.tsx","./app/(den)/_components/ui/button.tsx","./app/(den)/_components/org-limit-dialog.tsx","./app/(den)/_components/organization-screen.tsx","./app/(den)/_components/ui/card.tsx","./app/(den)/_components/ui/combobox.tsx","./app/(den)/_components/ui/dashboard-page-template.tsx","./app/(den)/_components/ui/input.tsx","./app/(den)/_components/ui/select.tsx","./app/(den)/_components/ui/selectable-row.tsx","./app/(den)/_components/ui/tabs.tsx","./app/(den)/_components/ui/textarea.tsx","./app/(den)/checkout/page.tsx","./app/(den)/o/[orgslug]/dashboard/_providers/org-dashboard-provider.tsx","./app/(den)/o/[orgslug]/dashboard/_components/org-dashboard-shell.tsx","../../../node_modules/.pnpm/@tanstack+query-core@5.96.2/node_modules/@tanstack/query-core/build/modern/_tsup-dts-rollup.d.ts","../../../node_modules/.pnpm/@tanstack+query-core@5.96.2/node_modules/@tanstack/query-core/build/modern/index.d.ts","../../../node_modules/.pnpm/@tanstack+react-query@5.96.2_react@19.2.4/node_modules/@tanstack/react-query/build/modern/_tsup-dts-rollup.d.ts","../../../node_modules/.pnpm/@tanstack+react-query@5.96.2_react@19.2.4/node_modules/@tanstack/react-query/build/modern/index.d.ts","./app/(den)/o/[orgslug]/dashboard/_providers/query-client-provider.tsx","./app/(den)/dashboard/layout.tsx","./app/(den)/o/[orgslug]/dashboard/_components/dashboard-overview-screen.tsx","./app/(den)/o/[orgslug]/dashboard/page.tsx","./app/(den)/dashboard/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/api-keys-screen.tsx","./app/(den)/o/[orgslug]/dashboard/api-keys/page.tsx","./app/(den)/dashboard/api-keys/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/background-agents-screen.tsx","./app/(den)/o/[orgslug]/dashboard/background-agents/page.tsx","./app/(den)/dashboard/background-agents/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/billing-dashboard-screen.tsx","./app/(den)/o/[orgslug]/dashboard/billing/page.tsx","./app/(den)/dashboard/billing/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/llm-provider-data.tsx","./app/(den)/o/[orgslug]/dashboard/_components/llm-providers-screen.tsx","./app/(den)/o/[orgslug]/dashboard/custom-llm-providers/page.tsx","./app/(den)/dashboard/custom-llm-providers/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/llm-provider-detail-screen.tsx","./app/(den)/o/[orgslug]/dashboard/custom-llm-providers/[llmproviderid]/page.tsx","./app/(den)/dashboard/custom-llm-providers/[llmproviderid]/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/llm-provider-editor-screen.tsx","./app/(den)/o/[orgslug]/dashboard/custom-llm-providers/[llmproviderid]/edit/page.tsx","./app/(den)/dashboard/custom-llm-providers/[llmproviderid]/edit/page.tsx","./app/(den)/o/[orgslug]/dashboard/custom-llm-providers/new/page.tsx","./app/(den)/dashboard/custom-llm-providers/new/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/integration-data.tsx","./app/(den)/o/[orgslug]/dashboard/_components/integration-connect-dialog.tsx","./app/(den)/o/[orgslug]/dashboard/_components/integrations-screen.tsx","./app/(den)/o/[orgslug]/dashboard/integrations/page.tsx","./app/(den)/dashboard/integrations/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/github-integration-screen.tsx","./app/(den)/o/[orgslug]/dashboard/integrations/github/page.tsx","./app/(den)/dashboard/integrations/github/page.tsx","./app/(den)/o/[orgslug]/dashboard/manage-members/page.tsx","./app/(den)/dashboard/manage-members/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/marketplace-data.tsx","./app/(den)/o/[orgslug]/dashboard/_components/marketplaces-screen.tsx","./app/(den)/o/[orgslug]/dashboard/marketplaces/page.tsx","./app/(den)/dashboard/marketplaces/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/marketplace-detail-screen.tsx","./app/(den)/o/[orgslug]/dashboard/marketplaces/[marketplaceid]/page.tsx","./app/(den)/dashboard/marketplaces/[marketplaceid]/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/manage-members-screen.tsx","./app/(den)/o/[orgslug]/dashboard/members/page.tsx","./app/(den)/dashboard/members/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/org-settings-screen.tsx","./app/(den)/o/[orgslug]/dashboard/org-settings/page.tsx","./app/(den)/dashboard/org-settings/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/plugin-data.tsx","./app/(den)/o/[orgslug]/dashboard/_components/plugins-screen.tsx","./app/(den)/o/[orgslug]/dashboard/plugins/page.tsx","./app/(den)/dashboard/plugins/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/plugin-detail-screen.tsx","./app/(den)/o/[orgslug]/dashboard/plugins/[pluginid]/page.tsx","./app/(den)/dashboard/plugins/[pluginid]/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/templates-dashboard-screen.tsx","./app/(den)/o/[orgslug]/dashboard/shared-setups/page.tsx","./app/(den)/dashboard/shared-setups/page.tsx","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/zone.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/settings.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/_util.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/misc.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/duration.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/interval.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/datetime.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/info.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/src/luxon.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/index.d.ts","../../../node_modules/.pnpm/@types+luxon@3.7.1/node_modules/@types/luxon/index.d.mts","../../../node_modules/.pnpm/typeid-js@1.2.0/node_modules/typeid-js/dist/index.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/types.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/max.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/nil.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/parse.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/stringify.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v1.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v1tov6.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v35.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v3.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v4.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v5.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v6.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v6tov1.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/v7.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/validate.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/version.d.ts","../../../node_modules/.pnpm/uuid@11.1.0/node_modules/uuid/dist/esm-browser/index.d.ts","../../packages/utils/src/typeid.ts","../../packages/utils/src/skill-markdown.ts","../../packages/utils/src/index.ts","./app/(den)/o/[orgslug]/dashboard/_components/skill-hub-data.tsx","./app/(den)/o/[orgslug]/dashboard/_components/skill-hubs-screen.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/page.tsx","./app/(den)/dashboard/skill-hubs/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/skill-hub-detail-screen.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/[skillhubid]/page.tsx","./app/(den)/dashboard/skill-hubs/[skillhubid]/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/skill-hub-editor-screen.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/[skillhubid]/edit/page.tsx","./app/(den)/dashboard/skill-hubs/[skillhubid]/edit/page.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/new/page.tsx","./app/(den)/dashboard/skill-hubs/new/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/skill-detail-screen.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/skills/[skillid]/page.tsx","./app/(den)/dashboard/skill-hubs/skills/[skillid]/page.tsx","./app/(den)/o/[orgslug]/dashboard/_components/skill-editor-screen.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/skills/[skillid]/edit/page.tsx","./app/(den)/dashboard/skill-hubs/skills/[skillid]/edit/page.tsx","./app/(den)/o/[orgslug]/dashboard/skill-hubs/skills/new/page.tsx","./app/(den)/dashboard/skill-hubs/skills/new/page.tsx","./app/(den)/join-org/page.tsx","./app/(den)/o/[orgslug]/dashboard/layout.tsx","./app/(den)/organization/page.tsx","./components/den-admin-panel.tsx","./app/admin/page.tsx","./components/den-marketing-rail.tsx","./.next/dev/types/cache-life.d.ts","./.next/dev/types/validator.ts"],"fileInfos":[{"version":"824cb491a40f7e8fdeb56f1df5edf91b23f3e3ee6b4cde84d4a99be32338faee","affectsGlobalScope":true},"45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4","3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75","9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d","5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8","68d73b4a11549f9c0b7d352d10e91e5dca8faa3322bfb77b661839c42b1ddec7","5efce4fc3c29ea84e8928f97adec086e3dc876365e0982cc8479a07954a3efd4","feecb1be483ed332fad555aff858affd90a48ab19ba7272ee084704eb7167569","5514e54f17d6d74ecefedc73c504eadffdeda79c7ea205cf9febead32d45c4bc",{"version":"87d693a4920d794a73384b3c779cadcb8548ac6945aa7a925832fe2418c9527a","affectsGlobalScope":true},{"version":"76f838d5d49b65de83bc345c04aa54c62a3cfdb72a477dc0c0fce89a30596c30","affectsGlobalScope":true},{"version":"138fb588d26538783b78d1e3b2c2cc12d55840b97bf5e08bca7f7a174fbe2f17","affectsGlobalScope":true},{"version":"dc2df20b1bcdc8c2d34af4926e2c3ab15ffe1160a63e58b7e09833f616efff44","affectsGlobalScope":true},{"version":"4443e68b35f3332f753eacc66a04ac1d2053b8b035a0e0ac1d455392b5e243b3","affectsGlobalScope":true},{"version":"bc47685641087c015972a3f072480889f0d6c65515f12bd85222f49a98952ed7","affectsGlobalScope":true},{"version":"0dc1e7ceda9b8b9b455c3a2d67b0412feab00bd2f66656cd8850e8831b08b537","affectsGlobalScope":true},{"version":"ce691fb9e5c64efb9547083e4a34091bcbe5bdb41027e310ebba8f7d96a98671","affectsGlobalScope":true},{"version":"8d697a2a929a5fcb38b7a65594020fcef05ec1630804a33748829c5ff53640d0","affectsGlobalScope":true},{"version":"4ff2a353abf8a80ee399af572debb8faab2d33ad38c4b4474cff7f26e7653b8d","affectsGlobalScope":true},{"version":"93495ff27b8746f55d19fcbcdbaccc99fd95f19d057aed1bd2c0cafe1335fbf0","affectsGlobalScope":true},{"version":"6fc23bb8c3965964be8c597310a2878b53a0306edb71d4b5a4dfe760186bcc01","affectsGlobalScope":true},{"version":"ea011c76963fb15ef1cdd7ce6a6808b46322c527de2077b6cfdf23ae6f5f9ec7","affectsGlobalScope":true},{"version":"38f0219c9e23c915ef9790ab1d680440d95419ad264816fa15009a8851e79119","affectsGlobalScope":true},{"version":"bb42a7797d996412ecdc5b2787720de477103a0b2e53058569069a0e2bae6c7e","affectsGlobalScope":true},{"version":"4738f2420687fd85629c9efb470793bb753709c2379e5f85bc1815d875ceadcd","affectsGlobalScope":true},{"version":"2f11ff796926e0832f9ae148008138ad583bd181899ab7dd768a2666700b1893","affectsGlobalScope":true},{"version":"4de680d5bb41c17f7f68e0419412ca23c98d5749dcaaea1896172f06435891fc","affectsGlobalScope":true},{"version":"9fc46429fbe091ac5ad2608c657201eb68b6f1b8341bd6d670047d32ed0a88fa","affectsGlobalScope":true},{"version":"61c37c1de663cf4171e1192466e52c7a382afa58da01b1dc75058f032ddf0839","affectsGlobalScope":true},{"version":"b541a838a13f9234aba650a825393ffc2292dc0fc87681a5d81ef0c96d281e7a","affectsGlobalScope":true},{"version":"b20fe0eca9a4e405f1a5ae24a2b3290b37cf7f21eba6cbe4fc3fab979237d4f3","affectsGlobalScope":true},{"version":"811ec78f7fefcabbda4bfa93b3eb67d9ae166ef95f9bff989d964061cbf81a0c","affectsGlobalScope":true},{"version":"717937616a17072082152a2ef351cb51f98802fb4b2fdabd32399843875974ca","affectsGlobalScope":true},{"version":"d7e7d9b7b50e5f22c915b525acc5a49a7a6584cf8f62d0569e557c5cfc4b2ac2","affectsGlobalScope":true},{"version":"71c37f4c9543f31dfced6c7840e068c5a5aacb7b89111a4364b1d5276b852557","affectsGlobalScope":true},{"version":"576711e016cf4f1804676043e6a0a5414252560eb57de9faceee34d79798c850","affectsGlobalScope":true},{"version":"89c1b1281ba7b8a96efc676b11b264de7a8374c5ea1e6617f11880a13fc56dc6","affectsGlobalScope":true},{"version":"49ed889be54031e1044af0ad2c603d627b8bda8b50c1a68435fe85583901d072","affectsGlobalScope":true},{"version":"e93d098658ce4f0c8a0779e6cab91d0259efb88a318137f686ad76f8410ca270","affectsGlobalScope":true},{"version":"063600664504610fe3e99b717a1223f8b1900087fab0b4cad1496a114744f8df","affectsGlobalScope":true},{"version":"934019d7e3c81950f9a8426d093458b65d5aff2c7c1511233c0fd5b941e608ab","affectsGlobalScope":true},{"version":"bf14a426dbbf1022d11bd08d6b8e709a2e9d246f0c6c1032f3b2edb9a902adbe","affectsGlobalScope":true},{"version":"5e07ed3809d48205d5b985642a59f2eba47c402374a7cf8006b686f79efadcbd","affectsGlobalScope":true},{"version":"2b72d528b2e2fe3c57889ca7baef5e13a56c957b946906d03767c642f386bbc3","affectsGlobalScope":true},{"version":"8073890e29d2f46fdbc19b8d6d2eb9ea58db9a2052f8640af20baff9afbc8640","affectsGlobalScope":true},{"version":"368af93f74c9c932edd84c58883e736c9e3d53cec1fe24c0b0ff451f529ceab1","affectsGlobalScope":true},{"version":"af3dd424cf267428f30ccfc376f47a2c0114546b55c44d8c0f1d57d841e28d74","affectsGlobalScope":true},{"version":"995c005ab91a498455ea8dfb63aa9f83fa2ea793c3d8aa344be4a1678d06d399","affectsGlobalScope":true},{"version":"51e547984877a62227042850456de71a5c45e7fe86b7c975c6e68896c86fa23b","affectsGlobalScope":true},{"version":"956d27abdea9652e8368ce029bb1e0b9174e9678a273529f426df4b3d90abd60","affectsGlobalScope":true},{"version":"4fa6ed14e98aa80b91f61b9805c653ee82af3502dc21c9da5268d3857772ca05","affectsGlobalScope":true},{"version":"e6633e05da3ff36e6da2ec170d0d03ccf33de50ca4dc6f5aeecb572cedd162fb","affectsGlobalScope":true},{"version":"d8670852241d4c6e03f2b89d67497a4bbefe29ecaa5a444e2c11a9b05e6fccc6","affectsGlobalScope":true},{"version":"8444af78980e3b20b49324f4a16ba35024fef3ee069a0eb67616ea6ca821c47a","affectsGlobalScope":true},{"version":"caccc56c72713969e1cfe5c3d44e5bab151544d9d2b373d7dbe5a1e4166652be","affectsGlobalScope":true},{"version":"3287d9d085fbd618c3971944b65b4be57859f5415f495b33a6adc994edd2f004","affectsGlobalScope":true},{"version":"50d53ccd31f6667aff66e3d62adf948879a3a16f05d89882d1188084ee415bbc","affectsGlobalScope":true},{"version":"13f6e6380c78e15e140243dc4be2fa546c287c6d61f4729bc2dd7cf449605471","affectsGlobalScope":true},{"version":"33358442698bb565130f52ba79bfd3d4d484ac85fe33f3cb1759c54d18201393","affectsGlobalScope":true},{"version":"782dec38049b92d4e85c1585fbea5474a219c6984a35b004963b00beb1aab538","affectsGlobalScope":true},{"version":"7e29f41b158de217f94cb9676bf9cbd0cd9b5a46e1985141ed36e075c52bf6ad","affectsGlobalScope":true},"ac51dd7d31333793807a6abaa5ae168512b6131bd41d9c5b98477fc3b7800f9f","dc0a7f107690ee5cd8afc8dbf05c4df78085471ce16bdd9881642ec738bc81fe","acd8fd5090ac73902278889c38336ff3f48af6ba03aa665eb34a75e7ba1dccc4","d6258883868fb2680d2ca96bc8b1352cab69874581493e6d52680c5ffecdb6cc","1b61d259de5350f8b1e5db06290d31eaebebc6baafd5f79d314b5af9256d7153","f258e3960f324a956fc76a3d3d9e964fff2244ff5859dcc6ce5951e5413ca826","643f7232d07bf75e15bd8f658f664d6183a0efaca5eb84b48201c7671a266979","21da358700a3893281ce0c517a7a30cbd46be020d9f0c3f2834d0a8ad1f5fc75","d78c698fa755ef94e3af591883bfee3a330ffec36392e00aaacdff3541cf5382","7394959e5a741b185456e1ef5d64599c36c60a323207450991e7a42e08911419","ef18cbf1d8374576e3db03ff33c2c7499845972eb0c4adf87392949709c5e160","5929864ce17fba74232584d90cb721a89b7ad277220627cc97054ba15a98ea8f","7180c03fd3cb6e22f911ce9ba0f8a7008b1a6ddbe88ccf16a9c8140ef9ac1686","25c8056edf4314820382a5fdb4bb7816999acdcb929c8f75e3f39473b87e85bc","54cb85a47d760da1c13c00add10d26b5118280d44d58e6908d8e89abbd9d7725","3e4825171442666d31c845aeb47fcd34b62e14041bb353ae2b874285d78482aa","c6fd2c5a395f2432786c9cb8deb870b9b0e8ff7e22c029954fabdd692bff6195","a967bfe3ad4e62243eb604bf956101e4c740f5921277c60debaf325c1320bf88","e9775e97ac4877aebf963a0289c81abe76d1ec9a2a7778dbe637e5151f25c5f3","471e1da5a78350bc55ef8cef24eb3aca6174143c281b8b214ca2beda51f5e04a","cadc8aced301244057c4e7e73fbcae534b0f5b12a37b150d80e5a45aa4bebcbd","385aab901643aa54e1c36f5ef3107913b10d1b5bb8cbcd933d4263b80a0d7f20","9670d44354bab9d9982eca21945686b5c24a3f893db73c0dae0fd74217a4c219","db3435f3525cd785bf21ec6769bf8da7e8a776be1a99e2e7efb5f244a2ef5fee","c3b170c45fc031db31f782e612adf7314b167e60439d304b49e704010e7bafe5","40383ebef22b943d503c6ce2cb2e060282936b952a01bea5f9f493d5fb487cc7","4893a895ea92c85345017a04ed427cbd6a1710453338df26881a6019432febdd","3a84b7cb891141824bd00ef8a50b6a44596aded4075da937f180c90e362fe5f6","13f6f39e12b1518c6650bbb220c8985999020fe0f21d818e28f512b7771d00f9","9b5369969f6e7175740bf51223112ff209f94ba43ecd3bb09eefff9fd675624a","4fe9e626e7164748e8769bbf74b538e09607f07ed17c2f20af8d680ee49fc1da","24515859bc0b836719105bb6cc3d68255042a9f02a6022b3187948b204946bd2","33203609eba548914dc83ddf6cadbc0bcb6e8ef89f6d648ca0908ae887f9fcc5","0db18c6e78ea846316c012478888f33c11ffadab9efd1cc8bcc12daded7a60b6","89167d696a849fce5ca508032aabfe901c0868f833a8625d5a9c6e861ef935d2","e53a3c2a9f624d90f24bf4588aacd223e7bec1b9d0d479b68d2f4a9e6011147f","339dc5265ee5ed92e536a93a04c4ebbc2128f45eeec6ed29f379e0085283542c","9f0a92164925aa37d4a5d9dd3e0134cff8177208dba55fd2310cd74beea40ee2","8bfdb79bf1a9d435ec48d9372dc93291161f152c0865b81fc0b2694aedb4578d","2e85db9e6fd73cfa3d7f28e0ab6b55417ea18931423bd47b409a96e4a169e8e6","c46e079fe54c76f95c67fb89081b3e399da2c7d109e7dca8e4b58d83e332e605","d32275be3546f252e3ad33976caf8c5e842c09cb87d468cb40d5f4cf092d1acc","4a0c3504813a3289f7fb1115db13967c8e004aa8e4f8a9021b95285502221bd1",{"version":"a14ed46fa3f5ffc7a8336b497cd07b45c2084213aaca933a22443fcb2eef0d07","affectsGlobalScope":true},"6968359c8dbc693224fd1ea0b1f96b135f14d8eee3d6e23296d68c3a9da3ea00",{"version":"79d75a353f29d9f7fc63e879ccebe213baaaea26676fb3e47cc96cf221b27b4f","affectsGlobalScope":true},"dfdc7699360a0d512d7e31c69f75cb6a419cf415c98673e24499793170db5d6b","dcf46daa1e04481b1c2f360c7a77bf019885bd70353a92aa698b9c22b7fe3d6b",{"version":"033350619c2cfcbeab2a483f4b221e0866e17cc4ac514240d285d35c35eecf7c","affectsGlobalScope":true},"a40826e8476694e90da94aa008283a7de50d1dafd37beada623863f1901cb7fb",{"version":"b197fb2d5fa71cebc66e5d10e15c7d02f15fcd3194fbdaafeb964262582f2a82","affectsGlobalScope":true},"1a7f593d587f49ca97710c021c453ab1b95db5e39e58567f4af644f97a5fb0e0","dd4705d1d78af32c407e93e5df009962bed324599d6a5b2a9d661ba44dd99e43","3a02975d4a7034567425e529a0770f7f895ed605d2b576f7831668b7beea9fea","7525257b4aa35efc7a1bbc00f205a9a96c4e4ab791da90db41b77938c4e0c18e","cf87b355c4f531e98a9bba2b0e62d413b49b58b26bf8a9865e60a22d3af1fcd3",{"version":"ee1ee365d88c4c6c0c0a5a5701d66ebc27ccd0bcfcfaa482c6e2e7fe7b98edf7","affectsGlobalScope":true},{"version":"1a08fe5930473dcae34b831b3440cd51ff2c682cf03bd70e28812751dd1644dd","affectsGlobalScope":true},"6f3e00b838cf23f7837ffca5da88ae25f0a81742af9ccadce5cb85ac72050929","304f66274aa8119e8d65a49b1cff84cbf803def6afe1b2cc987386e9a9890e22","cbcb993f1fa22b7769074eb09c1307756e6380659a2990d6f50cfd8943bd8333","55a93997681797056da069cfac92878bff4d2a35e61c1c16280ee0cba38702f2","ea25afcaf96904668f7eebc1b834f89b5b5e5acafd430c29990028a1aaa0bcbe","df981b2ce32930887db27eeae29e48b9b841e4ba0bbba1162ebed04c778cd7e1",{"version":"ea455cc68871b049bcecd9f56d4cf27b852d6dafd5e3b54468ca87cc11604e4d","affectsGlobalScope":true},"3be96458790a77cb357856dab45d1cc8383ac63ba4e085f620b202fb62a6e1db","02d85d03fd4a4f63cba0b133f0e0192368dfeb4338bd33f87788a4f6302de873","bb3a0ce56babb71d7c208ed848b4aafe545e7a7e06304fc0c8cfe3ad328cab7a",{"version":"43bb766c0dc5f1150021f161aa6831eb2cc75dab278172408515cb6e47f697a9","affectsGlobalScope":true},{"version":"8bcf09ba67bd0ec12a9f1efc1e58e1ba2cb1ff78920ce6cf67ebfe6003c54b82","affectsGlobalScope":true},"13ce7518e39051544dd1e3124c185665adda05a5021676f2606c2c74ad2c964f","4ac5899be65d5e2cabe3aaf3dfc2cf7641e54dde23db198d9f683dfabe228145","124dacf89c97915479ed6ad81b09ba42fd40962d069c0642fed42e2d9719f2ba","139ad1dc93a503da85b7a0d5f615bddbae61ad796bc68fedd049150db67a1e26","ad06959073c066bb9543ef9c1dee37fc3140d2ecaae42b97bf4e27f2f03d6511","9eece5e586312581ccd106d4853e861aaaa1a39f8e3ea672b8c3847eedd12f6e","782abaae13e868dee4ea9c16d44499af251d112fba535c558d10ff5279b34678","269929a24b2816343a178008ac9ae9248304d92a8ba8e233055e0ed6dbe6ef71","93452d394fdd1dc551ec62f5042366f011a00d342d36d50793b3529bfc9bd633","3c1f19c7abcda6b3a4cf9438a15c7307a080bd3b51dfd56b198d9f86baf19447","98e7b7220dad76c509d584c9b7b1ec4dcbd7df5e3a2d37d28c54f74461ec0975",{"version":"c61b5fad633f25bb0de0f95612191c1df9a6671cd66f451507b5223bff41b50d","affectsGlobalScope":true},{"version":"d21966ba3284ade60cb94eb2c533ab5b2af7fd0b4b28462043f6ebcb8400bd21","affectsGlobalScope":true},"98e00f3613402504bc2a2c9a621800ab48e0a463d1eed062208a4ae98ad8f84c","b8e9e44ce8eba70af569523ff31d669cc239a93f548899a259f3224392a75e6c","005d1caa2a5d9bc096f75b598d0fd184bc848dd2665b050a17a17d5dc1ef652d","619735e4e221e1bf137ae3efa5330beee4a06039dccb876c822f9d8913a392da",{"version":"3560d0809b0677d77e39d0459ae6129c0e045cb3d43d1f345df06cf7ab7d6029","affectsGlobalScope":true},{"version":"5ab086d9457abbc69cca270e5475073f2e8eb35b2fb810c516400de7b7c7d575","affectsGlobalScope":true},"2a2fd53f2d963624b596fb720b390cbfe8d744e92cb55b48a8090a8fd42a302d","1f01c8fde66abc4ff6aed1db050a928b3bcb6f29bc89630a0d748a0649e14074","60223439b7ee9b26a08d527cacc8b34ea6c6741589ef4949f4669c9aeb97978e",{"version":"48fffe7824c2e8cf8c812f528c33d4c4f502767582083df35920a7f56fe794b3","affectsGlobalScope":true},"561bf7d1d3163db272980f9167b4b98f6a9ee8698c5955e9d9584e84088aad51",{"version":"ab9b9a36e5284fd8d3bf2f7d5fcbc60052f25f27e4d20954782099282c60d23e","affectsGlobalScope":true},"a42be67ed1ddaec743582f41fc219db96a1b69719fccac6d1464321178d610fc","2beff543f6e9a9701df88daeee3cdd70a34b4a1c11cb4c734472195a5cb2af54","2e07abf27aa06353d46f4448c0bbac73431f6065eef7113128a5cd804d0c384d","be1cc4d94ea60cbe567bc29ed479d42587bf1e6cba490f123d329976b0fe4ee5","42bc0e1a903408137c3df2b06dfd7e402cdab5bbfa5fcfb871b22ebfdb30bd0b","9894dafe342b976d251aac58e616ac6df8db91fb9d98934ff9dd103e9e82578f","413df52d4ea14472c2fa5bee62f7a40abd1eb49be0b9722ee01ee4e52e63beb2","db6d2d9daad8a6d83f281af12ce4355a20b9a3e71b82b9f57cddcca0a8964a96","446a50749b24d14deac6f8843e057a6355dd6437d1fac4f9e5ce4a5071f34bff","182e9fcbe08ac7c012e0a6e2b5798b4352470be29a64fdc114d23c2bab7d5106","2f4e6b4d39426a1b85ecf4bdeb9dddbf4d9b3397d95d8555d46f925c9519ec7d","78a2869ad0cbf3f9045dda08c0d4562b7e1b2bfe07b19e0db072f5c3c56e9584","89d5d28d4f57e000b836ac273079be1b75710e28ce14750d081fb420d37e2ca5","fd4e24ccff3966390600d7f5d6aa1fed5a512e92ada735ea5fbc933d313ad3d3","b7cddfe1aa6b86b5fad3c9ccb30d05b3ccb165aebbf112f48d2d8a5f69dd98b1","a86f82d646a739041d6702101afa82dcb935c416dd93cbca7fd754fd0282ce1f","ad0d1d75d129b1c80f911be438d6b61bfa8703930a8ff2be2f0e1f8a91841c64","bd2c7ada3dee03653d3f601011d30072194bc3970cd93208f9588fbdc0c69347","e480da45d32313e7174b265674da504f075f59ef326852f0c5a5d863b438ae85","ad54850f61fcf5d014e11be80d2f46fea9265cfa7e77456da876f7833ef81769","6f7c9e8bd2b5b6a080b07080065f94900bd3c7e5ebbd3047bc33fcce2fab1dd8","3e7efde639c6a6c3edb9847b3f61e308bf7a69685b92f665048c45132f51c218","df45ca1176e6ac211eae7ddf51336dc075c5314bc5c253651bae639defd5eec5","8a0e762ceb20c7e72504feef83d709468a70af4abccb304f32d6b9bac1129b2c","da5950ee2a90721df6f3fba45f5d05308f7e4c35835392215dd2cd404505e2de","ce75b1aebb33d510ff28af960a9221410a3eaf7f18fc5f21f9404075fba77256","f42d5fed19610d485c646a0c430e768115567d078c7fc855c57b0c578b3d6cd3","ee8df1cb8d0faaca4013a1b442e99130769ce06f438d18d510fed95890067563","d5630f2ad9b4541e5ce891648121022f9412ecdca1820baa1f0104f70fd7eff7","4d15375ab13497104bc8fe56fdef2b5fd6853f29255737d23a33fa306ff7fd69","2cd3fc1d0d6a1e85baffd2d4f50f5efb192b5446eef567e97c94765402f0aad4","e4cbf2f1e89ecccaddd2c045e600ae41b732295953fb06247c7dcbc2d281ed30","27bbdb7509a5bb564020321fc5485764d0db3230a10d2336ae5ce2c1d401b0e7","8c1697d90c394a6fd955b98eae01238eff628e129b987a68aea10f898a48e7da","7580e62139cb2b44a0270c8d01abcbfcba2819a02514a527342447fa69b34ef1","42c169fb8c2d42f4f668c624a9a11e719d5d07dacbebb63cbcf7ef365b0a75b3","f374cb24e93e7798c4d9e83ff872fa52d2cdb36306392b840a6ddf46cb925cb6","d10d63718e1646c2279e3b33831f82c60e31f622b2b7020f1196409ca4c09242","106c6025f1d99fd468fd8bf6e5bda724e11e5905a4076c5d29790b6c3745e50c","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","148679c6d0f449210a96e7d2e562d589e56fcde87f843a92808b3ff103f1a774","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","02436d7e9ead85e09a2f8e27d5f47d9464bced31738dec138ca735390815c9f0","f8d5ff8eafd37499f2b6a98659dd9b45a321de186b8db6b6142faed0fea3de77","c86fe861cf1b4c46a0fb7d74dffe596cf679a2e5e8b1456881313170f092e3fa","a22dd55aa4d39906252000ab8e8a1b83b195eef7f4274eb51e457c1f11cf6580","540cc83ab772a2c6bc509fe1354f314825b5dba3669efdfbe4693ecd3048e34f","121b0696021ab885c570bbeb331be8ad82c6efe2f3b93a6e63874901bebc13e3","612d9da66bb046a9c1e2e8d026245ded881fc4b9f98cbfae714415d57ee0ae0b","32c2ad9494dad5d11b0564a619fee18f388db6c1e9e2cd3c360b3122549691eb","6c301d40aec56a74ec7bd7324e31a728dadf9bfba3e96def02938d3d973534ec","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881","8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881","aa14cee20aa0db79f8df101fc027d929aec10feb5b8a8da3b9af3895d05b7ba2","493c700ac3bd317177b2eb913805c87fe60d4e8af4fb39c41f04ba81fae7e170","aeb554d876c6b8c818da2e118d8b11e1e559adbe6bf606cc9a611c1b6c09f670","acf5a2ac47b59ca07afa9abbd2b31d001bf7448b041927befae2ea5b1951d9f9","8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881","d71291eff1e19d8762a908ba947e891af44749f3a2cbc5bd2ec4b72f72ea795f","c0480e03db4b816dff2682b347c95f2177699525c54e7e6f6aa8ded890b76be7","25a5f6fd3a2243c859eddc99ab5fba11d970af2fe7a5df9c32b7668f76f97b01","8d207e1f9d2c30d6f77dfa693f3827c3fbf0d89240297e10bdfe1041d433df68","b620391fe8060cf9bedc176a4d01366e6574d7a71e0ac0ab344a4e76576fcbb8","6ac6715916fa75a1f7ebdfeacac09513b4d904b667d827b7535e84ff59679aff","2652448ac55a2010a1f71dd141f828b682298d39728f9871e1cdf8696ef443fd","d682336018141807fb602709e2d95a192828fcb8d5ba06dda3833a8ea98f69e3","6124e973eab8c52cabf3c07575204efc1784aca6b0a30c79eb85fe240a857efa","0d891735a21edc75df51f3eb995e18149e119d1ce22fd40db2b260c5960b914e","3b414b99a73171e1c4b7b7714e26b87d6c5cb03d200352da5342ab4088a54c85","4fbd3116e00ed3a6410499924b6403cc9367fdca303e34838129b328058ede40","9c82171d836c47486074e4ca8e059735bf97b205e70b196535b5efd40cbe1bc5","8c70ddc0c22d85e56011d49fddfaae3405eb53d47b59327b9dd589e82df672e7","2f9c89cbb29d362290531b48880a4024f258c6033aaeb7e59fbc62db26819650","a365c4d3bed3be4e4e20793c999c51f5cd7e6792322f14650949d827fbcd170f","c5426dbfc1cf90532f66965a7aa8c1136a78d4d0f96d8180ecbfc11d7722f1a5","65a15fc47900787c0bd18b603afb98d33ede930bed1798fc984d5ebb78b26cf9","9d202701f6e0744adb6314d03d2eb8fc994798fc83d91b691b75b07626a69801","de9d2df7663e64e3a91bf495f315a7577e23ba088f2949d5ce9ec96f44fba37d","c7af78a2ea7cb1cd009cfb5bdb48cd0b03dad3b54f6da7aab615c2e9e9d570c5","1ee45496b5f8bdee6f7abc233355898e5bf9bd51255db65f5ff7ede617ca0027",{"version":"273782b8454e78f6a8b30d2cfbf6860499c930595095fcc1689637115f0eddda","affectsGlobalScope":true},{"version":"3fbdd025f9d4d820414417eeb4107ffa0078d454a033b506e22d3a23bc3d9c41","affectsGlobalScope":true},"dba114fb6a32b355a9cfc26ca2276834d72fe0e94cd2c3494005547025015369",{"version":"a8f8e6ab2fa07b45251f403548b78eaf2022f3c2254df3dc186cb2671fe4996d","affectsGlobalScope":true},"fa6c12a7c0f6b84d512f200690bfc74819e99efae69e4c95c4cd30f6884c526e","f1c32f9ce9c497da4dc215c3bc84b722ea02497d35f9134db3bb40a8d918b92b",{"version":"b73c319af2cc3ef8f6421308a250f328836531ea3761823b4cabbd133047aefa","affectsGlobalScope":true},"e433b0337b8106909e7953015e8fa3f2d30797cea27141d1c5b135365bb975a6","9f9bb6755a8ce32d656ffa4763a8144aa4f274d6b69b59d7c32811031467216e","5c32bdfbd2d65e8fffbb9fbda04d7165e9181b08dad61154961852366deb7540","ddff7fc6edbdc5163a09e22bf8df7bef75f75369ebd7ecea95ba55c4386e2441","0c05e9842ec4f8b7bfebfd3ca61604bb8c914ba8da9b5337c4f25da427a005f2","faed7a5153215dbd6ebe76dfdcc0af0cfe760f7362bed43284be544308b114cf","7029e566b8df176f703fb59fd437a38670c7a0e02c58b2d66dfb5b2e2b2defdb","7f2aa4d4989a82530aaac3f72b3dceca90e9c25bee0b1a327e8a08a1262435ad","d96b39301d0ded3f1a27b47759676a33a02f6f5049bfcbde81e533fd10f50dcb","e9f147ecca73d9346a4c073432843c159ccbe50bdcb678a78f6da10eae2cecf4","de061f7d72bd65c06fc1419f841dfdcb29a8e22fe6fa527d1e6eb20b897d4de0","663beafc2446079574570cba86e9b15f986f908ddb1b01274509970126fee945","a3102887d5058bf4cb5b37fa6964c09e9527c42053b3b5c642b89878620748de","0aaaa1727edd29673d85c9b26d7ca4d54e5407a48586903c51b48b7f7d196f61","d35bca0b261bff02635758c48e8ab99c61c420d0dfabbcf467e847171d876b7d","3bc12c40d90c342ff88a3d876996c555ed5cbee5fe8c3308a240b321f401ee46","ba130768aae855a5477e9e148e5c879548e6e7ccbcc56fd1934c8a18ea5b7569","2e4f37ffe8862b14d8e24ae8763daaa8340c0df0b859d9a9733def0eee7562d9","d38530db0601215d6d767f280e3a3c54b2a83b709e8d9001acb6f61c67e965fc","6ac6715916fa75a1f7ebdfeacac09513b4d904b667d827b7535e84ff59679aff","b499af2054a037a162b3b72cd886f48bbf32a3502c865c6e29fac7d2ab3ce0b5","b83cb14474fa60c5f3ec660146b97d122f0735627f80d82dd03e8caa39b4388c","d87f90d2df7b638204d81d6c57e1f2a8cc9317c45ca331c691c375649aa9255c","7274fbffbd7c9589d8d0ffba68157237afd5cecff1e99881ea3399127e60572f","b73cbf0a72c8800cf8f96a9acfe94f3ad32ca71342a8908b8ae484d61113f647","bae6dd176832f6423966647382c0d7ba9e63f8c167522f09a982f086cd4e8b23","20865ac316b8893c1a0cc383ccfc1801443fbcc2a7255be166cf90d03fac88c9","c9958eb32126a3843deedda8c22fb97024aa5d6dd588b90af2d7f2bfac540f23","461d0ad8ae5f2ff981778af912ba71b37a8426a33301daa00f21c6ccb27f8156","e927c2c13c4eaf0a7f17e6022eee8519eb29ef42c4c13a31e81a611ab8c95577","fcafff163ca5e66d3b87126e756e1b6dfa8c526aa9cd2a2b0a9da837d81bbd72","70246ad95ad8a22bdfe806cb5d383a26c0c6e58e7207ab9c431f1cb175aca657","f00f3aa5d64ff46e600648b55a79dcd1333458f7a10da2ed594d9f0a44b76d0b","772d8d5eb158b6c92412c03228bd9902ccb1457d7a705b8129814a5d1a6308fc","802e797bcab5663b2c9f63f51bdf67eff7c41bc64c0fd65e6da3e7941359e2f7","b01bd582a6e41457bc56e6f0f9de4cb17f33f5f3843a7cf8210ac9c18472fb0f","8b4327413e5af38cd8cb97c59f48c3c866015d5d642f28518e3a891c469f240e","4cceef18d7f088e797a463e90b7a9dad10c6bc667724b7686e3e740ae00122be","7ee86fbb3754388e004de0ef9e6505485ddfb3be7640783d6d015711c03d302d","cc1954b539604b1e562319119ac7e888172208b32ca873f9a357a92c826bd046","a67b87d0281c97dfc1197ef28dfe397fc2c865ccd41f7e32b53f647184cc7307","771ffb773f1ddd562492a6b9aaca648192ac3f056f0e1d997678ff97dbb6bf9b","43e96a3d5d1411ab40ba2f61d6a3192e58177bcf3b133a80ad2a16591611726d","232f70c0cf2b432f3a6e56a8dc3417103eb162292a9fd376d51a3a9ea5fbbf6f","bb8f2dbc03533abca2066ce4655c119bff353dd4514375beb93c08590c03e023",{"version":"706dd95827e7ebaabda91d5db2b755233e0952d98570e9c032b0f066a15c1177","affectsGlobalScope":true},"0b103e9abfe82d14c0ad06a55d9f91d6747154ef7cacc73cf27ecad2bfb3afcf","990b8fad2327b77e6920cc792af320e8867e68f02ce849b12c0a6ab9a1aebb09","5eb8cd1cb0c9143d74a8190b577c522720878c31aef67d866fcd29973f83e955","120599fd965257b1f4d0ff794bc696162832d9d8467224f4665f713a3119078b","43ba4f2fa8c698f5c304d21a3ef596741e8e85a810b7c1f9b692653791d8d97a","5433f33b0a20300cca35d2f229a7fc20b0e8477c44be2affeb21cb464af60c76","db036c56f79186da50af66511d37d9fe77fa6793381927292d17f81f787bb195","a6805fcafed712aea7759f8bc731014f9d22738c1d6ef9d43b8091d1d48346d5","c49469a5349b3cc1965710b5b0f98ed6c028686aa8450bcb3796728873eb923e","4a889f2c763edb4d55cb624257272ac10d04a1cad2ed2948b10ed4a7fda2a428","7bb79aa2fead87d9d56294ef71e056487e848d7b550c9a367523ee5416c44cfa","d88ea80a6447d7391f52352ec97e56b52ebec934a4a4af6e2464cfd8b39c3ba8","142617b3cdf902b69c6464c9fbd942b60ab3e733ca18c032b19e0f7e2adbefe8","0b603555f1881f87256ffd6344d3e3ed6d466c2e701eabf381f28be8c2125892","897e4f7662488e3ecc79e743bdd3b78f13bdb69a97851afa5b440c4211e32ea9","e2e1c6d3b2d93add5200bd7bc1a8cccb4e446836b2111ece45db8683a2c765de","251b03d5cd243854ce870d9a9a39f491faf69898c5d6b5eee28cc7649c57417b","27ff4196654e6373c9af16b6165120e2dd2169f9ad6abb5c935af5abd8c7938c","2c4de79f406d137390608e8c0a44fba2ff8e00bacfcae7c9d1781fef10e9440d","07ba23a10465791be5d22deaf5ef7de7658774ddff53721e5ea17fedea1bc721","dca8c645c5afeb03b1ecedbf16323f33e7d0afaa6256c8e047e6e38087a97f53","775f181bd4a533d6f8b5e55ec1d9f1624559720ae8a70e9432258da26b38d27c","796273b2edc72e78a04e86d7c58ae94d370ab93a0ddf40b1aa85a37a1c29ecd7","5df15a69187d737d6d8d066e189ae4f97e41f4d53712a46b2710ff9f8563ec9f","0659e6650e6c528420733abc2cdc36474ef14cc8d64ef3c6fee794d71c69cc2e","6ac6715916fa75a1f7ebdfeacac09513b4d904b667d827b7535e84ff59679aff","622694a8522b46f6310c2a9b5d2530dde1e2854cb5829354e6d1ff8f371cf469","cd8ce8d68567f62dd580b3c3c37777ac3f5b81944c7417f5ea83030eab533385","e374d1eaa05b7dc38580062942ac8351ce79cbe11f6dbce4946a582a5680582d","9e2739b32f741859263fdba0244c194ca8e96da49b430377930b8f721d77c000","a9e6c0ff3f8186fccd05752cf75fc94e147c02645087ac6de5cc16403323d870","49af4b52f0d4d2304c5f2c6fe5fab3e153e0acc38830d0202821b877c097dd02","49c346823ba6d4b12278c12c977fb3a31c06b9ca719015978cb145eb86da1c61","bfac6e50eaa7e73bb66b7e052c38fdc8ccfc8dbde2777648642af33cf349f7f1","92f7c1a4da7fbfd67a2228d1687d5c2e1faa0ba865a94d3550a3941d7527a45d","f53b120213a9289d9a26f5af90c4c686dd71d91487a0aa5451a38366c70dc64b","e68b8e5a1df7c1be2bc105141456ecba70215806e1c28bfbc5c12bfce4be6e68","511c8f02329808d47d00b859c532ae9115590048b17325a946c74dac48428650","57d67b72e06059adc5e9454de26bbfe567d412b962a501d263c75c2db430f40e","b5f9e66625783eefcbe3d2da074b2e7ba2066d61ce3fc6ef4f22805ad946cab4","e37115962d284b9f7a37c2bdd2add50f88365dde41f5e0ff591ffc48a8ec7575","6459054aabb306821a043e02b89d54da508e3a6966601a41e71c166e4ea1474f","bb37588926aba35c9283fe8d46ebf4e79ffe976343105f5c6d45f282793352b2","f89488602bec98a142072fae7ea5ba99431a569ff580c64b7be39896474799d8","bbbc47961f39a57df103cf4ca3bb8f8732b4b6678a18225a0aa76d59c466956c","2e6114a7dd6feeef85b2c80120fdbfb59a5529c0dcc5bfa8447b6996c97a69f5","2ffb043dc5163458e473b7010859f86e01dc4edffcae0a93d885d028b426a546","c8f004e6036aa1c764ad4ec543cf89a5c1893a9535c80ef3f2b653e370de45e6","dd80b1e600d00f5c6a6ba23f455b84a7db121219e68f89f10552c54ba46e4dc9","b064c36f35de7387d71c599bfcf28875849a1dbc733e82bd26cae3d1cd060521","05c7280d72f3ed26f346cbe7cbbbb002fb7f15739197cbbee6ab3fd1a6cb9347","8de9fe97fa9e00ec00666fa77ab6e91b35d25af8ca75dabcb01e14ad3299b150","04b7b2e0832dfd3c31e81df3975e8d8fda28e7ff999b0aa2932608a8f6661d5c","ca2d34c6ed5cbd3070b8b6f32f42ae54adcc6499c1e4b99f0a5798b3f27cc653","9ec68995e66dd6b9dac834bf5ae85fde802714ea2e82151a5d1d53ef01b463ef","5c4d626b4902f2ef8a1cc146d761d276cef988016dc674e3b98fbad70e64bc9f","fdfaa0aad899524962e2955287b5b991ffe3be50f64e02eb60c933ca44644a94","53c972a0f9bc3a4ec70fff7314123ea8cfcf75b3703046f767d2dc1eea87b2fb","f974e4a06953682a2c15d5bd5114c0284d5abf8bc0fe4da25cb9159427b70072","50256e9c31318487f3752b7ac12ff365c8949953e04568009c8705db802776fb","7d73b24e7bf31dfb8a931ca6c4245f6bb0814dfae17e4b60c9e194a631fe5f7b","d130c5f73768de51402351d5dc7d1b36eaec980ca697846e53156e4ea9911476","413586add0cfe7369b64979d4ec2ed56c3f771c0667fbde1bf1f10063ede0b08","06472528e998d152375ad3bd8ebcb69ff4694fd8d2effaf60a9d9f25a37a097a","7303b45138d2511035056a5901a1490ebdcbf055cbb1276f8629c5121cbe733e","27f874cd5327507eeff699a74567f60c1215b94509f4308633a7b01922471ed2","a401617604fa1f6ce437b81689563dfdc377069e4c58465dbd8d16069aede0a5","2c6cf04bc525caf6546e859e8ef10bfb9573837ec0bc5ec7b53a7b1b8ca72781","8695dec09ad439b0ceef3776ea68a232e381135b516878f0901ed2ea114fd0fe","304b44b1e97dd4c94697c3313df89a578dca4930a104454c99863f1784a54357","0a437ae178f999b46b6153d79095b60c42c996bc0458c04955f1c996dc68b971","74b2a5e5197bd0f2e0077a1ea7c07455bbea67b87b0869d9786d55104006784f","4a7baeb6325920044f66c0f8e5e6f1f52e06e6d87588d837bdf44feb6f35c664","87cc05fe13108f02e12da7e3efd8e360fef78d96a0c9e11408ea1b1b9fb3e03d","1abbf67c218d23c2ce76887caac2df6c7dab3d97ba2b65348432b876f510002a","1a82deef4c1d39f6882f28d275cad4c01f907b9b39be9cbc472fcf2cf051e05b","4b20fcf10a5413680e39f5666464859fc56b1003e7dfe2405ced82371ebd49b6","c06ef3b2569b1c1ad99fcd7fe5fba8d466e2619da5375dfa940a94e0feea899b","f7d628893c9fa52ba3ab01bcb5e79191636c4331ee5667ecc6373cbccff8ae12","1d879125d1ec570bf04bc1f362fdbe0cb538315c7ac4bcfcdf0c1e9670846aa6","8bd496cf710d4873d15e4891a5dbf945673e3321ca74cf75187e347fd5ed295e","a6dba407fc287f1e25454e75028c91bbc00675f2d1c4e8b3edcc36c08611a486","d663134457d8d669ae0df34eabd57028bddc04fc444c4bc04bc5215afc91e1f4","e91f7b1344577a02f051b9b471f33044fef8334a76dc9e1de003d17595a5219b","c0723195c85e19656d6b5b9fdb81d3f3403c1ae4679e722c6ea058c516b38d12","186eea74805194f04e41038fc5eca653788b9dedbab7c2d7d17e10139622dd92","71d9eb4c4e99456b78ae182fb20a5dfc20eb1667f091dbb9335b3c017dd1c783","cfa846a7b7847a1d973605fbb8c91f47f3a0f0643c18ac05c47077ebc72e71c7","1594da19968752a22b2ac48c2d0e60575700e745c577a8a4a676b841238ad5bb","e0cee12109e0a10a4c3d6769fcc7644b7c1ea7f52365bea51728f5af29f8a137","7d4254b4c6c67a29d5e7f65e67d72540480ac2cfb041ca484847f5ae70480b62","3536968defef8a75514f547ead5e2e9c1e984820290ec9b00c5fdfb6ef786535","d83773870080c30a230e322ce13a9c6f3398e8dacea4ea8a83e26370f3bac23e","dcfeaf98d66314fec29a9076c4290e45d0b196a65827becc19138e9c7b855f37","6849fe9210fe4946d5f085bfed36758f33dc6ae15a751338d178dd4daa017c46","888cda0fa66d7f74e985a3f7b1af1f64b8ff03eb3d5e80d051c3cbdeb7f32ab7","60681e13f3545be5e9477acb752b741eae6eaf4cc01658a25ec05bff8b82a2ef","ffae4e1e06aa848a1e4bcef162cd1c48e5909b26223515981310af9c036bdfc7","a57b1802794433adec9ff3fed12aa79d671faed86c49b09e02e1ac41b4f1d33a","34e16eb7c31768a11a08aebcfb3d70d7b8f0b016197e98d8419e566ceae6d6c8","f94ec1f7e4b709d26960306c9082a7a1b728a6e13089346aa48ba57c74cbf47e","9a11cb4033405e96c247cd5aa29790212aaffdd127869e8a5219103f0b389fd5","01479d9d5a5dda16d529b91811375187f61a06e74be294a35ecce77e0b9e8d6c","aff5213585cb72e94054dfe17250ff315f3569b3919d1ef1ad235f37c4ee894e","fb2ea35e1be6388d722d7725e2b49c697d34d9c890c3b96758faaeb86d35cef8","ce0df82a9ae6f914ba08409d4d883983cc08e6d59eb2df02d8e4d68309e7848b","1a4dc28334a926d90ba6a2d811ba0ff6c22775fcc13679521f034c124269fd40","f05315ff85714f0b87cc0b54bcd3dde2716e5a6b99aedcc19cad02bf2403e08c","5fad3b31fc17a5bc58095118a8b160f5260964787c52e7eb51e3d4fcf5d4a6f0","72105519d0390262cf0abe84cf41c926ade0ff475d35eb21307b2f94de985778","456006a6975b26c0a1785feddae165f6d307e2d601ffde27e21fc4a790e448a4","c857e0aae3f5f444abd791ec81206020fbcc1223e187316677e026d1c1d6fe08","ccf6dd45b708fb74ba9ed0f2478d4eb9195c9dfef0ff83a6092fa3cf2ff53b4f","1fe0d18b111e1145a7e7601855bccd4ca20f24e3b9a5aba6bb1fa9d1a7059170","5632c3c26d420c063eebe64c45b1248b9492a67bf44f1d0c57e9dc8f6cf449bb","0df5aa619ab12993a39ea6dae062ee46eadbb4d738916460e636ada52bced75b","8fca3039857709484e5893c05c1f9126ab7451fa6c29e19bb8c2411a2e937345","35069c2c417bd7443ae7c7cafd1de02f665bf015479fec998985ffbbf500628c","10ab7be91f87ebe8916b62cf28af2e45b5601fc7b0e311adf838f912c6b31dd8","bc636fbc08e0979ceb7eb0731a33000283d77a33b62e1f71ee65be50394e40ba","7e0b7f91c5ab6e33f511efc640d36e6f933510b11be24f98836a20a2dc914c2d","045b752f44bf9bbdcaffd882424ab0e15cb8d11fa94e1448942e338c8ef19fba","2894c56cad581928bb37607810af011764a2f511f575d28c9f4af0f2ef02d1ab","0a72186f94215d020cb386f7dca81d7495ab6c17066eb07d0f44a5bf33c1b21a","75bbd3be047d539988a0ff0b56384ef7a6a25f3b676ad96bee547d44c31622a7","42960001a776b089ade681ab5cfddc936e0afb0615133ec1841f3dee89d3e1bf","0aedb02516baf3e66b2c1db9fef50666d6ed257edac0f866ea32f1aa05aa474f",{"version":"da47712b394d944328245482603bc6f416d3949b67c9392279caab595076b510","affectsGlobalScope":true},"37d0071d8f0a06dc55c2c5e0ec3391affd4fd107c53410bf358196ec0bf3923f","b213dad76ca37fd552274c9499056e1c0d9c1bd38a55bb7f68b22ba6b84c3ad7","56ccb49443bfb72e5952f7012f0de1a8679f9f75fc93a5c1ac0bafb28725fc5f","20fa37b636fdcc1746ea0738f733d0aed17890d1cd7cb1b2f37010222c23f13e","d90b9f1520366d713a73bd30c5a9eb0040d0fb6076aff370796bc776fd705943","bc03c3c352f689e38c0ddd50c39b1e65d59273991bfc8858a9e3c0ebb79c023b",{"version":"19df3488557c2fc9b4d8f0bac0fd20fb59aa19dec67c81f93813951a81a867f8","affectsGlobalScope":true},{"version":"b25350193e103ae90423c5418ddb0ad1168dc9c393c9295ef34980b990030617","affectsGlobalScope":true},"bef86adb77316505c6b471da1d9b8c9e428867c2566270e8894d4d773a1c4dc2","5a49adaef698b7ad7e6127949fa1b0bbd3d46b7cbd11c54e392a4dcdd51f5190","96171c03c2e7f314d66d38acd581f9667439845865b7f85da8df598ff9617476","27be6622e2922a1b412eb057faa854831b95db9db5035c3f6d4b677b902ab3b7","5c634644d45a1b6bc7b05e71e05e52ec04f3d73d9ac85d5927f647a5f965181a","2489bf04d77dc025ba67f49f1a56eb24b9db477d5ff88123d887e163ed1776aa","63a7595a5015e65262557f883463f934904959da563b4f788306f699411e9bac","4ba137d6553965703b6b55fd2000b4e07ba365f8caeb0359162ad7247f9707a6","0b77b819b5417775fccb20c678293cf614c054a5b1a65421a5b933a9124ba998","e1f6076688a95bd82deaac740fccbe3cdea0d8a22057cccc9c5bce4398bdd33b","9252d498a77517aab5d8d4b5eb9d71e4b225bbc7123df9713e08181de63180f6","b1f1d57fde8247599731b24a733395c880a6561ec0c882efaaf20d7df968c5af","c8dadeff90ccc638d88a989c1139fd6a1329a5b39c2a7cbef1811c83ffe40903","35e6379c3f7cb27b111ad4c1aa69538fd8e788ab737b8ff7596a1b40e96f4f90","1fffe726740f9787f15b532e1dc870af3cd964dbe29e191e76121aa3dd8693f2","5a3ea721d03a361ccbdd7390ccd75f6e84cbca3a3f01f4b331ecc9af31890c49",{"version":"e7dfaee4af38d45b1cab8a1ee0b3bc1f85ddcf64545ed391d675d78ae6526274","affectsGlobalScope":true},"98e2b197bf7fe7800f89c87825e2556d66474869845e97ad9c2b36f347c43539","af48e58339188d5737b608d41411a9c054685413d8ae88b8c1d0d9bfabdf6e7e","616775f16134fa9d01fc677ad3f76e68c051a056c22ab552c64cc281a9686790","65c24a8baa2cca1de069a0ba9fba82a173690f52d7e2d0f1f7542d59d5eb4db0","f9fe6af238339a0e5f7563acee3178f51db37f32a2e7c09f85273098cee7ec49","1de8c302fd35220d8f29dea378a4ae45199dc8ff83ca9923aca1400f2b28848a","77e71242e71ebf8528c5802993697878f0533db8f2299b4d36aa015bae08a79c","98a787be42bd92f8c2a37d7df5f13e5992da0d967fab794adbb7ee18370f9849","332248ee37cca52903572e66c11bef755ccc6e235835e63d3c3e60ddda3e9b93","94e8cc88ae2ef3d920bb3bdc369f48436db123aa2dc07f683309ad8c9968a1e1","4545c1a1ceca170d5d83452dd7c4994644c35cf676a671412601689d9a62da35","320f4091e33548b554d2214ce5fc31c96631b513dffa806e2e3a60766c8c49d9","a2d648d333cf67b9aeac5d81a1a379d563a8ffa91ddd61c6179f68de724260ff","d90d5f524de38889d1e1dbc2aeef00060d779f8688c02766ddb9ca195e4a713d","07ed3ddab975995eea41b22f3010506fb9f5fb301d04820b07d7a1aee5477d7c","969d8b0965849f4bae7cab0ba90bd1e1220e95999c2c6f01117fa7500901c017","6ec840ee5e2bc103f557fe38b1d585ee250540468713d7634ee066de372bf332","b0309e1eda99a9e76f87c18992d9c3689b0938266242835dd4611f2b69efe456","47699512e6d8bebf7be488182427189f999affe3addc1c87c882d36b7f2d0b0e","6ceb10ca57943be87ff9debe978f4ab73593c0c85ee802c051a93fc96aaf7a20","1de3ffe0cc28a9fe2ac761ece075826836b5a02f340b412510a59ba1d41a505a","e46d6cc08d243d8d0d83986f609d830991f00450fb234f5b2f861648c42dc0d8","1c0a98de1323051010ce5b958ad47bc1c007f7921973123c999300e2b7b0ecc0","ff863d17c6c659440f7c5c536e4db7762d8c2565547b2608f36b798a743606ca","5412ad0043cd60d1f1406fc12cb4fb987e9a734decbdd4db6f6acf71791e36fe","ad036a85efcd9e5b4f7dd5c1a7362c8478f9a3b6c3554654ca24a29aa850a9c5","fedebeae32c5cdd1a85b4e0504a01996e4a8adf3dfa72876920d3dd6e42978e7","e297c0a524edee7677939122f90027bfbe5f2698939d9a85728e5044b39c7124","cdf21eee8007e339b1b9945abf4a7b44930b1d695cc528459e68a3adc39a622e","bc9ee0192f056b3d5527bcd78dc3f9e527a9ba2bdc0a2c296fbc9027147df4b2","b62381cae176db34f003cc6172ee8f3e0122014889d66391aa73698105cf4934","1d9c0a9a6df4e8f29dc84c25c5aa0bb1da5456ebede7a03e03df08bb8b27bae6","84380af21da938a567c65ef95aefb5354f676368ee1a1cbb4cae81604a4c7d17","1af3e1f2a5d1332e136f8b0b95c0e6c0a02aaabd5092b36b64f3042a03debf28","30d8da250766efa99490fc02801047c2c6d72dd0da1bba6581c7e80d1d8842a4","03566202f5553bd2d9de22dfab0c61aa163cabb64f0223c08431fb3fc8f70280","41eb514d9ce0a6e87957f08a4b7af70d93f87637f37dee706e2d92a6601c25a9","e7765aa8bcb74a38b3230d212b4547686eb9796621ffb4367a104451c3f9614f","1de80059b8078ea5749941c9f863aa970b4735bdbb003be4925c853a8b6b4450","1d079c37fa53e3c21ed3fa214a27507bda9991f2a41458705b19ed8c2b61173d","5bf5c7a44e779790d1eb54c234b668b15e34affa95e78eada73e5757f61ed76a","5835a6e0d7cd2738e56b671af0e561e7c1b4fb77751383672f4b009f4e161d70","4b7f74b772140395e7af67c4841be1ab867c11b3b82a51b1aeb692822b76c872","7bd01f0f28cd3aeb2046274d85208e245965f6f2948edf4f7b2057bcf9f22ccc","d2f2cf2b8cc92bea913cda4a076e0f790b23a21e84f989d12f0116a7fe3906e0",{"version":"6de125ea94866c736c6d58d68eb15272cf7d1020a5b459fea1c660027eca9a90","affectsGlobalScope":true},{"version":"f5b20bc288ee49989c95b20847fc93b96bf61cc0845598897a6a53a967dd7d07","affectsGlobalScope":true},"064ac1c2ac4b2867c2ceaa74bbdce0cb6a4c16e7c31a6497097159c18f74aa7c","3dc14e1ab45e497e5d5e4295271d54ff689aeae00b4277979fdd10fa563540ae","d3b315763d91265d6b0e7e7fa93cfdb8a80ce7cdd2d9f55ba0f37a22db00bdb8","b789bf89eb19c777ed1e956dbad0925ca795701552d22e68fd130a032008b9f9",{"version":"93ae4f0dfc37232949af02a71ef02651b9bba59c2ba5aadc1811158418a818f5","affectsGlobalScope":true},"7ad303e40d4fddf44f156129e397511953a71481c5cfd86b1862649aaaf240cc",{"version":"19057deb2bccf5a9c84dc204f16eca621755a2780c41a0b5609e45c04955a256","signature":"1d52dd10a60604480c2df73b6f2ed688c4fb54521f6e89a7053fade549bbd305"},{"version":"71ce4481a24791352a9d85c96464eb007398c5721cd4056f733272e18f997541","signature":"aa590225db421a6e653d25d07f3d5920ce1791ddf43ad9c1bff9d5b1656c3a57"},{"version":"8d508bdeb528b59f183d32ff2befa3e48d3fc19510ced2ab0c4e7b8983dd005c","signature":"96b83cb91c297d92b47dd178ab3b112dabe0131789c4eeadb9d9bfdfeccda54a"},{"version":"d40c2770ae085a4cd33f51fcda608eb21e65c4250eac66314bf34b4e0c483c2f","signature":"435d200a2397f25002f9eef130d0bf16aa85418ef89e59a0cb4460bd28853482"},{"version":"7ab265209ec68e2a156fe8226d32de96d3e2bdce280d662fc94a9d1721e1c76d","signature":"e32606cd5ffca79070c91e897105cd80afa446070a2bf5f3f69d5a9eabd29f0c","affectsGlobalScope":true},"c1a2e05eb6d7ca8d7e4a7f4c93ccf0c2857e842a64c98eaee4d85841ee9855e6","835fb2909ce458740fb4a49fc61709896c6864f5ce3db7f0a88f06c720d74d02","6e5857f38aa297a859cab4ec891408659218a5a2610cd317b6dcbef9979459cc","ead8e39c2e11891f286b06ae2aa71f208b1802661fcdb2425cffa4f494a68854","82919acbb38870fcf5786ec1292f0f5afe490f9b3060123e48675831bd947192","e222701788ec77bd57c28facbbd142eadf5c749a74d586bc2f317db7e33544b1","09154713fae0ed7befacdad783e5bd1970c06fc41a5f866f7f933b96312ce764","8d67b13da77316a8a2fabc21d340866ddf8a4b99e76a6c951cc45189142df652","a91c8d28d10fee7fe717ddf3743f287b68770c813c98f796b6e38d5d164bd459","68add36d9632bc096d7245d24d6b0b8ad5f125183016102a3dad4c9c2438ccb0","3a819c2928ee06bbcc84e2797fd3558ae2ebb7e0ed8d87f71732fb2e2acc87b4","f6f827cd43e92685f194002d6b52a9408309cda1cec46fb7ca8489a95cbd2fd4","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","e0bfe601a9fdf6defe94ed62dc60ac71597566001a1f86e705c95e431a9c816d","a270a1a893d1aee5a3c1c8c276cd2778aa970a2741ee2ccf29cc3210d7da80f5","add0ce7b77ba5b308492fa68f77f24d1ed1d9148534bdf05ac17c30763fc1a79","8926594ee895917e90701d8cbb5fdf77fc238b266ac540f929c7253f8ad6233d","2f67911e4bf4e0717dc2ded248ce2d5e4398d945ee13889a6852c1233ea41508","d8430c275b0f59417ea8e173cfb888a4477b430ec35b595bf734f3ec7a7d729f","69364df1c776372d7df1fb46a6cb3a6bf7f55e700f533a104e3f9d70a32bec18","6042774c61ece4ba77b3bf375f15942eb054675b7957882a00c22c0e4fe5865c","5a3bd57ed7a9d9afef74c75f77fce79ba3c786401af9810cdf45907c4e93f30e","ed8763205f02fb65e84eff7432155258df7f93b7d938f01785cb447d043d53f3","30db853bb2e60170ba11e39ab48bacecb32d06d4def89eedf17e58ebab762a65","e27451b24234dfed45f6cf22112a04955183a99c42a2691fb4936d63cfe42761","2316301dd223d31962d917999acf8e543e0119c5d24ec984c9f22cb23247160c","58d65a2803c3b6629b0e18c8bf1bc883a686fcf0333230dd0151ab6e85b74307","e818471014c77c103330aee11f00a7a00b37b35500b53ea6f337aefacd6174c9","d4a5b1d2ff02c37643e18db302488cd64c342b00e2786e65caac4e12bda9219b","29f823cbe0166e10e7176a94afe609a24b9e5af3858628c541ff8ce1727023cd","2c848d85167df71bf58136eacb3909a93d5aeb445712cf225b68e23a58c94f9a",{"version":"0d42aad8c0912a3acd1885467766d230b59a9aaecf06cbe61db3ba8eb16ddb30","signature":"bcf58f57eadc764d0de6c302867e8d28a7af89716953e3966398e543530ed56a"},{"version":"a71180189528733fab93b635ba481d5735934537620e761dbf5a06f8c2d329cb","signature":"468bc51ab87258211e4098104ddbacfcb957b2bfef4181caabf42ff19daa7f5a"},{"version":"0c1543b200cacda3fdb390562916aa9261ca9494bcf44d61a9327e23e0e0ac13","signature":"c78ceb7105a4bb458318b2419e4280cea6cf6728801a4b56938dd67971248453"},{"version":"f11eb01b35d79a4b683e2367e62ebb21bab66a71543defa930ed4d9f4981b315","signature":"a0f44e6da310e13692195d272290b5f92d117549a660373907321b4f61b5cf0d"},{"version":"6af2eca05a7efac5490d85f83a62ca12d64e0a02626b48c7fb2035475373e5eb","signature":"c307ca4230db68b58cc3f3c2a4fd560ea4e7e140ae1551894f48180a17b103d6"},{"version":"272575aa71443e9d7732b9c140d839884d890bf35fd8ce065a720b5525582262","signature":"c307ca4230db68b58cc3f3c2a4fd560ea4e7e140ae1551894f48180a17b103d6"},"fe93c474ab38ac02e30e3af073412b4f92b740152cf3a751fdaee8cbea982341","3255b97f3f24af29c79cc1aa88004efb13b6285ebdde0a567bf32e19bb65250d","1e00b8bf9e3766c958218cd6144ffe08418286f89ff44ba5a2cc830c03dd22c7",{"version":"b21a240acb3f8b6f685a0e008c2d771a73614933d58851adca6963ce4dd7b6f1","signature":"caa1b198a8464669dafd523a15a3e1242818a28cfdf1e34c9bd0868de244d286"},"1d5f3f3a6b781909db1f435b239f36f013b555e88cc63a534b7ed7a179410ae8","7348c35ce10f8323a515ea6a6c237c0dc7c3fd5e491c4dacec2a7b93f0dfcd26","258e67b2638408b67fbf5fe6c953b8f2dd2a69f9171d31c9a976cd2329716e4c",{"version":"4c8c17155232527fec337e87da680b5318714d10df203c785ab0c18e2c79f078","signature":"f88aab57fbb88cd12345f6107f25a2b91b36475471e7a5f69c55a738808e6152"},{"version":"08f9991f5185766214666421a45dcee4b4540dc6374324b079c15d12fb61dcfd","signature":"d64c203591b2636598069519d3a6a0349872a23c280bcf7da0cfa40c956fa078"},{"version":"3e9d76bcf80e35422ce7bde4d17c48fb706cc231d4c3080a491836e7d2408773","signature":"55fb805b9021c06eafe78f95310a31cbdfdf8c3b1b3d6bb65258d147f1bee674"},{"version":"0699d5a2174ec2bb1cfdc81270042c8aa966864202fdb4d25150d5055ed2e590","signature":"35858f9c1818fe110880afb899b3de723aeaabbed636db4b751aedd937f457e0"},"8f95b4b53d4522f8d1010a073c07aebdda64f44d56b0a22a89400242aa3f4723","7e0dd7745de5cfc3c45f808d9f8553f65ab5e46137c1ee44ab0c6952e2293d7c","7d726479d24cdccd0a77a47b7203a4dd231ae8c97035c12c568dc6966ddb6a64","c335ba6a64c20a5feaff899e6491ec4c4e5dd69e70066b3a4d7e2bc964cd3057","123e805b51c37983b549cbbcc52f644b9714b6595e40145f79472e8a84b9ed86","5d8b31143c299a58ee75de8d08640b76d02b14ed21dd0d2f4f4ab2474f5a7d90","50cca1953dae077b33f08a532c408045e877a7b8c078ee5513231b005664cfd0","5e3dbd3b43e6ec52958b141af2b4bef1b2de8f602d9bea636f37eec83d4440b2","e92837bb84d6e09cf2a41029ca445effec2eb26c22317118439e546fdd33835a","7ed9b4563cbc9f9baac3be14c05ec6236314b9352606ee36758e088a6ec2eeec","7d13c1f2e06b846642d1843412df218725c7b87976e83129f62e8f2d4c58fa52","94a8c1c289ef27f42280c1d730100a28540f709492fff746cff2286b0e406a26","8c26acc596067d21f15f5dc136b4d3daf5658854461c29f4dc6ec66a480718e3","3bec811f5aeba45b7ff3adc9abbfb8aff256984bf44b26a5d1ba276aa79d261d","3737225833b121f3fcb4402070c095d87c29bf453796707a26da829f4228c1fc","7cac781e1c51f3eabbbdd6a2e17f83ad04ed016267ae0ce45d57d4fd14f563c4","c9d927a8c00c15ae154d85cfdc3830e18d3d0972eb549311473468ffd682826d","3c2179e56922a2e287e466534c6fb20691f83853b870d99f609ceb9bc7526a55","c1247c0820d5d9645163386bdb52947ecb9fbc45c436213c0c2c91e1dc8449ca","ed5e4d71f85fa8c7b70eac885fa1da580c7d5632cbbacf6478b675c67d3ec9df","0e24b3fb18105ee4e4536de9d15f885d22a8119633550ff52c6d5aa27cfc4cf5","3ce2e95dba28838c21a981faff028630d7e874c8c429e6d515cdc448cb868e42","e03e31f8cd337c7fd31b106d463960d35344860bc7a02f8f1da9a872eeb686f4","c4b966e6c010c501a32ac2bc8dc9420a87e5c4a3e0685f700262f02c045b6fb4","8d98489d008026dd1a38cb9d70b31558c0164ec488b9815b8ae0ed466d215df9","32c5af30582fc4d9cd817aab004de53994027c64a2931dbd4229935fa677dc31","11b1d083ec7b7de157f7bdad5a11a4b53913d1caa56007773b9a32b203e86781","18d99cee5c26fd8e9fbf386f055ac2b269fa7d645c1e4fd3e7bb5b3476ad6aec","2dde80ffcef0c366a1ae22a6eea8dbc6821d518092b6a0bbdceb37da0d53cfbf","0eab6314ceccba630cc6cca396d80e8415efe03903df730d57517ef1bb30bc4f","bab2e3c1a519be231dafb3d9b0463fc7415e356f89c08b785c0eb8b86d7556c4","ffa44f47e95902b40d02b5a2a2395a2825937df7ca08542716b015dfc61862ca","2b6ec928ac39e9e63c9406c427c0fb7d1e84d80d7b3c8dd78be121c8e5b32ee9","eff6fa1bcb36c62e15a4ab37e4717aa804986cb095c6c0cf676a596d614126eb","9d39ae81494ec822f28812de06f4441ff839940aa06b7e3cb0f9e02623cc310c","c869fea6f6781ff27332ff370d422ceae6f1c8ebda4ca79275d89d147786c1d4","d438883ea02e1c9e045f47b8a18ae014e4011d4c7ab8798b7b9f1be8b55bab20","babae7f05d084027561e1b7812edb6a660687946bd2c7729d5e186b9e494f9ab","e9a9f2962a374bd2d2b53059357d6ce9f0416f49e2c53d38f5c514ce00692c30","24bd9f28cb058c7bef45cc6f9babaa3af9694c6d68f8037cb6fe88f2419b1c1c","cc4f3e808c9e0251a3e4ac160a5836832eff53194dcb39e3cb2f3e70eaeb511c","7450441efd97dc54f68fe785a6a7f1eae875c11338134889bc88eaf052b70df0","426a1be9f47a8db226a21250158562e1837ad36862671cd4764d4d360f0c9eea","5fc1a3db11db206c64d5038b44276e94dcd402b262776b9a27c19e9176f2e8e6","c73e8393670ba80643a3bc0078a7f3de8193acfe1fd7c84e76132312562a419a","28a7f3ca9fcca7caca89b6bf74c2aefe982f7ff57f36bcb5f29c91833d39b302","d036b54cb57366f779bb8b998d92778ad1453e3e1483013cad43df76dd7c4eb1","325c9eda18d6e766fa14c006d4c1c329f3ad8cbdc2ed7c117af113b71f7aaeed","1105bd9fa22a9508097685f15ea765554eb65d55b455d273150dac014246f787","7092715152a127a874c1453831de3bda4e6527200b5fb79af83c420d4a445b7f","83562fedbc941e235a3be1c99b337cc69d6f9aae4999ac836adef2f920b9e3dc","26fbcd7cd9416ce4438e56417ae7b8b91eafb1cc647bac002778d57583dfecf4","95eb8982a57d9933d65e2afdd5c866bc715e40c30a0dbaceb59892501ad659e8","21a53758e5f95a22f56995233bfe18bd3f39c23ad64a57936cf793f5fb01fdbb","8cbf0fbcb7706d0a2394eae1a564825d50a0d0c1ee9336f8bc8c7da41711ed44","a31738774f95b193a777d9531f9c3609e0294cefe7f0971acce955e8ef52e8d5","ea88363b3147f77e19ea1b55f0cb038626364d476863e8e2f91cf60cf286e7e7","913ad4fa2f9e0b444c264605fce1605cbeb47d5be25137f9bdd25f3ccd7be556","d2a7cc6e7044a81891d07d0be88dd12f7559fbbb35227a3ad42514c9fb96b83a","914260e95660c84a6e283ad91dd832d9f3119fe9a7cb7ffcd0764716dc4f705a","0eb6cee7bcf4262afd1a083f9fef4ec12de5022e29e9fa0c86d0acd635eb37ac","a6b39f1d2ceaf4f5bb3dab98483fff79e4ede4786928c93307a482d0e888d12d","3cd99ec82de92fff68a2768cab73739911766bb7c6e7d10e29706d656107a2b5","c21314a38f4337202999e6473579aeaaef6371b6d001973692715433f4e7fc89","899bc20734112d2094d89e4f55644c6f3115d2440c250822ffbd4fa212b158a5","d39fd2772f9bb4dacc97319c5ed760ea9e2d83458b522eb5894ab09b0674a704","3f635b32106636b9c54c7cce0c73372f99859f9ae90c0de7d83d01f48af3064f","d114c65d009de428f5c9ae22fab8ab7a602d22822fb8eb77ba3f09ca7aaef895","fdc9ee7bc24198eb4ef75bff9c3233bab7b7586bad8ea11bf18cd6faacbc5c65","db7da89b083e353471f3911adb59288c2d4bda401b25433943e8128d654e0afc",{"version":"e02dba5bdeffc897f15d54bba5349552f6ad3ff78701c1f3daf48c1c833a338b","signature":"fb6f4fa19c31ec6d573314ab5554c1e502d060f1dd1bc13a8e33e13da82dac68"},{"version":"1d15b5ccdd194c50d98059e908abf83b86b07fef4ae775aa1f58ff2d8168c183","signature":"8594bd59ac178f59f2d84bf8688d27ad0a3becc7ba33fd81f04f8d824ebf4401"},{"version":"acc106b92fba6ddbb441372feefa1d5590714b547f02b50dd745d7737a6efa0c","signature":"7b87720aae5dbfb749d597c437531239e4019502dc0e78633561735db617b6f3"},{"version":"4696a36809af910477f1055f544b9fcbad274c61bef927a783cdebb4d7318fe5","signature":"af43d990de0a7ca77c517828e04eef576a41eecffd40f4969b7204730d7ab4ff"},{"version":"58161f996133c22693eb7ec1de37906396614f5f4496994114134a90170154c2","signature":"ee9ab354680e54334978cd515a52ab5827b0aa354a219a0090d6a3c2a5200607"},{"version":"d89f3462199b790d57723554a63e1427fe6b45d96fd3402e3257aeb65c1565ef","signature":"b600573c0debf674ee5c2f87d41a32a0ad05fbe876b4424de64e682e79aed0ef"},{"version":"a2b40c42a6955bf2d6ebe22c7c965f886cfeaac9264db564bdd9f0ffa52c42fe","signature":"f0ea57024528a15b4b205f6b0730596c6b0fe6c05e5eec104a16feaaf3800a07"},{"version":"8b0d9e2f3dcb64edcad3e6556e96ace0d36e8bfaeeb95a483ffd6c6f8ee24823","signature":"ed2a76a9709b7048cda9306c4923395ed1ed27f256aea26f91d3766cc4c819fb"},{"version":"9f12612081ecafd25a69e319b6daa3f79653940a11c2c4c7f92d154a257cd83c","signature":"e712c539f287227f7325b64c54f20a90b8fc7fe88ad6d5207b45384697c90153"},{"version":"e13870a91afa9586f9741f431478f9159c089edd8a71c2b15b460a66723d0de4","signature":"11e21c32bb2568d07cbbe5fc074cb99b6904e76676f7cec14fea5b0b4f1b8079"},{"version":"24406c9b1293aca6f377aa326931fb01adfa4dcd4b409c17b64bcc331ef5bf2b","signature":"ec9a875269954c1ba03a55c91da48022034ff4affc11c5f29d446350fd79827d"},{"version":"8fa86846b00fe5b75512d4837325dfd3922441a7576b10797ea3b0a2b35c4e02","signature":"9f4584be4f95f11ec5c89191b6b44240ba7a8da0c95742cfccea2592c3b5a831"},{"version":"0d4c12fbf58f91044d49cd2c5a4c0ca5e3e3e60ff885bd71a037a2e4eafaa96d","signature":"2e3e6fb88ce4f31e2be2058eb3a7c598ca20090b3b627c5fb6115cc43b8f8c4a"},{"version":"8dca17ff12fdb20402189f94db6fff6ccefb7bdba685b9630cb49164054f71fa","signature":"c794febe22f147a05771ef8271eeef3704ad5138bd1888085d890382b3e59161"},{"version":"df8e7b1a9a7b78dc3b4f86509adefcb299937ca48ba6131b3d13bdf1363581d9","signature":"9e802ec2285c19519c699128dd1d791b6843dd589fd9f2401fcb46a9a02aa43f"},{"version":"0863e3e9addb3f648dece90a3fa5444e6c38c972ec80924c66854456119bfeab","signature":"c00d28620b7f1f5a5514e497ec62252c3d081edc5baa049edd3f6b3255d55552"},{"version":"217661fc5bbc27004adbc4f2bc2be52c69385b2d623c7a8307236156b7c90413","signature":"eb0a47da0b0e3ffd59cf4ad71a6bf0ebf9d93680d53bb3c5dfbd2c01405e60e1"},{"version":"5dd20c5d4abeda697efdfaec0660a7be908d2ca9721591007dc0c87165d5ba2c","signature":"282b58c1a7eaa775343f717ce14a836038ef998c9ef306aba618b46ac328bbe1"},{"version":"a7ae6acae0232bd62325d5e35bc1ac57eff67516737f68285a2d124c176fea15","signature":"c2ad7311e0fbd63784d9762b56a4b75f6d11ca83d953d8d8e4582b28bb68b508"},{"version":"db6e59fb9001a0d370a1acd0b057dc774bf2fb5393e52665031f7e6809c12fc3","signature":"c3f1af455d3487b01feb03e93a6cfdbf55d62c16572a92c3d282bb1e00ca0ba3"},{"version":"36f055572026eff7586c54e4dc2dd3a1faa24dec59121d286fda602dbe8c433f","signature":"b883fe48c574a069b1bc61f4748c60d31da0f352515c3abf9b4e644ec9ab4252"},"50b5e0089cc8135750a422a661660de0b0efc8879363507c703e52fcde653d46","b7901072b4348af0c9c02ef413add51f3adbbd608a6f3155c40fd26b6a1ccc53","f887c9c3d273371c7fbfbb28128ece44ff88240e94226e2411b3800915ef1ec1","4a80acea776bb9bc1315176b7cbc8bd6afd7524ddede00936fab97a9c19e050d",{"version":"c32d64c16537dfdf5254f639606c632e4cdc97e445fbcd3659dda493592eb0ec","signature":"2ebf2908f5fd13e598b5fc6151c83b250bf6cfa3710f020dd2cf503b79d27577"},{"version":"d3b963d3ad36b1b3a39b1727c2d1cb3cf8f82a2f53d643cea4d2e8b787d7f867","signature":"aaaa457daaf26d32b47682eb61251436083f510fab6ebe4d0dc818bd0092edfd"},{"version":"ceb52e8ada32787ad839dff259cc4a85bcbf6448417dbed5d180584c65237ff5","signature":"e9d4bb56f013adcd8a0b33211e0870040704ece52fc5d7f303482c1ea7b7775e"},{"version":"a5654321577784cf14f48954695365f6cd3c2922abe9c2d3084cbd88e7271d52","signature":"f17bd7ed36a4a9810bd5fd92dfd490b6835a6d537f8b4dc6c48fa3e3fcf28af5"},"65bedb4a67d96f29840d820ef493c09d1347f49078a62d49ffbd09087cd07176",{"version":"8e9d2eba8e8f051f22dfde0d656af94b4856e974626b7c1eb56a7075fea9cca2","signature":"7b8d9ebd4c8e99e6e7e44fbb9a6ec72b22c8e45972bf75d8173101fd7b60e479"},{"version":"017609e44d98fea641804be490d75582139379bb9e70100b9d1102e7478fa62b","signature":"faf77a35be7f5648e12ab952b900ee69526103333b3d7b86498adf346a207d89"},"c47b3065f186a303ba2b6c43134d06f22bb55858edae0ef5a673af58b7224528",{"version":"6b2918103774a86c46c5b9977dfe8c1fb77714dfca2695f0b0e3022ced40e9be","signature":"c357f418fbf9e83e1eda2f76b9c0a69adab3cc16131895c20a2c37665421398e"},{"version":"194575ba989d1b6d14d4f4f7818a3132e46c0c038014d95bca9ec487a232845c","signature":"f0f984000a05f87208bb940b7ee0466035af819503044412fe4003569def7403"},"d8b13b3bc61d5c23a46d1ea65f29d4027afbdaa4b1e2c8245cd3bc1c995fccf4",{"version":"2ff079ea24d8658285ff80e69ddff92d99d1bd9514906ae17982bde909b4ab23","signature":"b62f8aeb315a6874b400426f33a71eda94b7086c73e07ace88f3a2bf39779f20"},{"version":"d38ce747917eeb6ae6d6e25c5c1704465e20d586fb4b685e056a151107bcfb93","signature":"fecf2db136256608e67de3a4d60c3e965bab210fa3e95c1be2bfe0b917b4f0e4"},"70f619f78c5dd1d7740302cf2ceb4f50a8250a089d245cbe3bdfd2d2b539267b",{"version":"cfc449516bcd4ae29ee4aa26b1db8b180b6b67a5b2ddb79c7f3648bfc71ad109","signature":"26b7bf752be650968a7a96e0d19667500ccb6f54da84c0dbec6beff2b4d6da84"},{"version":"14353fd744e863644b4129ee809916b5db701b408c63f0474011a3d51153392b","signature":"eb571f42631fd53b4c9759137984c071ed641bc1da3f59a348f2b960bb8e5ba6"},{"version":"ac7f2c6c0b472df4d59c70804538bef8a05f642aac71d3872cff54d30affc5df","signature":"a0a3fbad280d33c2deaec14a798270327710a06c48ea9deea1fc6c7e47a02a09"},"70459dac73b861b42361833fdc3332967f8467cd3a65b22963a5c4daf9925e7d",{"version":"45b21caebc3e5f217173ff0744bda6be16bae8f6d506875a90b713ef02c5a7f8","signature":"aaae4534085bc40d1208a414429ad36d1cb2f05701ed90ee61dcc76550208979"},{"version":"c60b83fd6ca9ee3cf065f5c659dcbb5f183deaae5409eeeb392ee069edabafce","signature":"b40d44b32456fd07c96d5fa3837db5f55d06eca8a1f93a352c15a19b9b6672ca"},"b6699805cb4ec267945d0070d77f2ae9a7315512ccb73fde71d883973beae399",{"version":"8c5afa88d6548f90cc80482de81a3cf91beae0fe0101dc68dfa86a48acc82384","signature":"9580f62d04ee36b80f9300af73217bd9d9b030de5b5286086950b95063b5e3f0"},{"version":"a783ec280de961ffddfc89a0cec42ef284a4fcddbc007642aacd878b79c4c75f","signature":"ad9e27de69f0a3ce140368e9701af3cee0164f9062a83c6f07229d77c86734d2"},"0a15e6c9f7f828d4e2a7e454c19436d5b9798515158ebb3b4c6c0b5d352d9743",{"version":"86ce7ad404f035e56c50dd95f2e6be119585d61c57d75a13602408eb14441000","signature":"445611e8f39aa6050a3484dc86cd1f0715f8677554a52e9ed9e793ab9a12fda1"},"59c3171e265479cfa3e3f39413f00afec7607e18ba6df3c1c737b3be04e954a6",{"version":"3fe0b23a1f93b7bf51384098ba3acf11d663ae43f32eabe6368312a048807c84","signature":"542d354def87ff5b99b066f1bcbb2d9a5f8fa7d84eb8b6ca10e4ebfb73639bec"},{"version":"5a5c6e7ed3446581d58bc21be415dd86fb7404e19e346a8159bde072dfde53f7","signature":"58fb8479412dfda44269d07f4e7305f26ad1bd77752cb5508630d7bc1e93900d"},{"version":"65eaf13c8a7f0c30272af9d193f27e4bf141cc2d8f213157f8f1099e4a69e617","signature":"77dbec1678fe6f3d5346b38a2e6cd3a42be62ae44c4755563944343877251987"},{"version":"d8e96f47ca5467d4c710ed7f7dd7def2e17ae2690924881952a3c71aeaa2bfd6","signature":"436759811402e264efb204dda538ba920dfa1ff2be85883a93757e29732637ba"},"19f112c9bab045b027eba6db1df6981092ba36c903d4f60093ee4f7aef12dc91",{"version":"9b445b17cf56b332b2240aff1079d7307d328dce7ebaa9f0242ad66fc18c73d8","signature":"cd32e623f24176a767082458bc617e122995c1cab290f9992ba93c71505296e5"},{"version":"a66e46a350be103b7f78a78edafa1fa93c0d619b723a18274c83f0e6323f2c47","signature":"0c9c77ad0910e37c70952568d9efeda325c83f68a6d8ff0056fa107189fd1945"},"3bddbab89355f51bd8b42587f27190e7b50a1882113b3a19ce886cdd422322da",{"version":"2b5457426efe2f305c2b5f8311cdf2ec1d3b4fa6155448f38836684313d45b0b","signature":"1db4be3384a337943065b5fa9ce41b6f19cb019c8e6a800b7bf12a31872133b1"},"3419307e5758ff5f87a99f6e0b57dfc3004fa0d0d4da5daba9d3440053ee3316",{"version":"13acc56e4dee51d558625d3ff9f9dda8ffa2ce15fe8a349f7fdce1e49dfd96ec","signature":"ba0e17bfbd876fd9995623e23a0288ba21175fe443cfc5998b31ceed87511194"},"7fef987076649aaa4b18f24b2b71420f7d33b4d5b39344e316e2c95edc9163ab","5828a7a366ce95e8c9d565afdcbab592dff75956b9c841cb6152a51ef8bec8e1","c5701d1aa21f437bb0d0fdfd6adf8c8ba2c9b8b150b80d7a309c8236ab9ce6bf",{"version":"84accfa3830ddd2fe6e88f319e3e72b2cba051424330b7e9a7d10fe82b2482c8","signature":"5f19f6528874c04d4c7ab60e0ccf83358df80fdde252f99ea73677ba9e465448"},"8876ebc218a576bbf2f71156d1699ce8d30b38c68a10977bf137935b5ddec3ba","bd162fd1db9c8175b2a9f8f8a8257bcaa71e7320272602e9ea130acf556fd6b4",{"version":"14df21adbe9baf4c8f8d13c680e96e5e93f3c05f67b49e01d58e62048e6a1607","signature":"38a79980404c2230335f84dbf00b715475d5a0c1b79de6d5645a0f4334a57c62"},{"version":"c09d9f9e2665f2edfc7436577ab7de14333d92e6b3482df1b8d24126de1af5fa","signature":"3b3553f30fd03aa1e3f9ff3f3e3dcf5397ac3cc1f792f77e231ce7ef172f063d"},"4f870e4eb9cdb42fecd2e0db6d2585239bbc476f9419973e32b4610bef5c976d",{"version":"4f3580808da24e36ee218b783c286b5179d592849982157c698e6a543c9be9f3","signature":"145bbd6d54e747345048c472c3997d1613da800d9eeb4b9449d0ed7bda8f0800"},{"version":"7285ba3a1ffbea7c7e678a8528117785b602c8f898ec045effb3cd2ca022dc43","signature":"7062acca0a96cd5b3bbb75021f3b1628493675d096415fcbf433e5e6f3fef2d3"},"96197ea53e0992242f1b8c3a91cee947fba45ee218d11aa6aa041041358d4c28",{"version":"0b6c490e5022cebaa1fb9b9efc92106024b1252a797520c7e9f7cec28e7149a7","signature":"eb24f9f3a6819d27e67d0e0dc70d8d729cfff07f3c5ab0a55159f95938c8d5dc"},{"version":"94431bb5a46bd051ae0f46b52b31a094fc89cba3ed8a7e74814f8087f3feefbc","signature":"d19936ae3a7cef953303df8ee5519f6cf79710b1476524afdc3aef618bbda299"},{"version":"ff32946dd6b9bff0ef89d720928f5638e5ae480b89cb714348162c2663063874","signature":"651e438b6de12883e5b66a63584263ea899685dac62f0162aa6d9e53419aa821"},"e88bc78dd8f694c29d6d001b122b1c1eab1776b04b47c2af7eb4b546b0658c5f",{"version":"e87affc96a499e5783c95a15aeaa52a449dcd6960fe7db126e908800424ba769","signature":"e29e2d48ec11f0c9c1c711a679b350a699afdabfb4ca68bf4d5c3631e8d86750"},{"version":"562a0ce230aed8e40a64a0fcbb9bc4e87f6e44b5a517207bfbf570708ce82b77","signature":"291219ea9e5e3d25456801a877f2ebaf564c3445d2b5377613c222424cce90e3"},"8d2dc1900eb4e0f58e9fae8bec2aa24cbb272e333b75c185f7152ebff4258073",{"version":"21a1da0e8f3cb3da1a8093f9be02a1d31928c3526bb69032b936c8185c82ecfd","signature":"3fdb55f8db6b78df59effe7150172b72a31f2a4ac7168115eeb2b6a1c98fb16f"},{"version":"9014a7fb5ee6092e72f54abc4c2bcf67941b7793dd8f04d2cbb0b4398f3a259f","signature":"1925cf8c19f0ebc9231348b1bb61ef17662cdaa98be5cce83c7555f37d0d3454"},"b789d50343e536848d186f23715c223599f62f2e562180a32803bc7524629759","5339f84dfcb7b04aa1c2b4d7713d6128039381447f07abc2e48d36685e2eef44","fb35a61a39c933d31b5b2549d906b2c932a1486622958586f662dbd4b2fe72e6","24e2728268be1ad2407bab004549d2753a49b2acb0f117a04c4e28ffb3ecdd4f","aff159b14eba59afe98a88fe6f57881ba02895fb9763512dda9083497bdcd0e6","1f2bddea07543ccda708134cca0600b4d9ac9bd774ec1ede0a69935b04df1496","6e8997d08f6798d0a9416df24312cafd084e6184a205d9283eba95ef56f8ef8b","ac6968717607889d24d6e407effb48dd5af82005925b4725b1d9eb52a8a047e2","26080058b725ac0b480241751255b4391f722263778e84e66a62068705aafd3c","46afbf46c3d62eac2afead3a2011d506637bf4f2c05e1fd64bbf7e2bb2947b7c","84d02daa32c7a8bff4946bbc7d878ffb7114c19879f7bfceeeb39bef48e93c42","97e1818573679b5d3d697406abd3e5f1e9cd00da1f2783ab236912180462f5be","be79291850df988e29e6a72fcec3703dbf85caec078d9631311f0b97d451094a","cff399d99c68e4fafdd5835d443a980622267a39ac6f3f59b9e3d60d60c4f133","6ada175c0c585e89569e8feb8ff6fc9fc443d7f9ca6340b456e0f94cbef559bf","e56e4d95fad615c97eb0ae39c329a4cda9c0af178273a9173676cc9b14b58520","73e8dfd5e7d2abc18bdb5c5873e64dbdd1082408dd1921cad6ff7130d8339334","fc820b2f0c21501f51f79b58a21d3fa7ae5659fc1812784dbfbb72af147659ee","4f041ef66167b5f9c73101e5fd8468774b09429932067926f9b2960cc3e4f99d","31501b8fc4279e78f6a05ca35e365e73c0b0c57d06dbe8faecb10c7254ce7714","7bc76e7d4bbe3764abaf054aed3a622c5cdbac694e474050d71ce9d4ab93ea4b","ff4e9db3eb1e95d7ba4b5765e4dc7f512b90fb3b588adfd5ca9b0d9d7a56a1ae","f205fd03cd15ea054f7006b7ef8378ef29c315149da0726f4928d291e7dce7b9","d683908557d53abeb1b94747e764b3bd6b6226273514b96a942340e9ce4b7be7","7c6d5704e2f236fddaf8dbe9131d998a4f5132609ef795b78c3b63f46317f88a","d05bd4d28c12545827349b0ac3a79c50658d68147dad38d13e97e22353544496","b6436d90a5487d9b3c3916b939f68e43f7eaca4b0bb305d897d5124180a122b9","04ace6bedd6f59c30ea6df1f0f8d432c728c8bc5c5fd0c5c1c80242d3ab51977","57a8a7772769c35ba7b4b1ba125f0812deec5c7102a0d04d9e15b1d22880c9e8","badcc9d59770b91987e962f8e3ddfa1e06671b0e4c5e2738bbd002255cad3f38","9c05962e2db9c8258604edc9dcf538524fbb7c32adbeed7efa6cb2f85bc41953","820287fd1e5c94ef0ad9a0cbde5fb238287444962edb2343341ef653229435df","3d1408c4a396851667313cf4acf538714271abf06dac605023660659e6057d9a",{"version":"71d5e9c7a237d68bef5f253e41fa2b98001439971c2a0aeac2dcba020c798e18","signature":"ebde7c386b80a28c65a11973982ed4414e82bba204ec868149244c23afe6638b"},{"version":"609cdb013788cd63c927c074d933b00926a85dcefad189e1a4038a659703b779","signature":"44a30773fd48463f72a0ee166e80d71ea6a8ce2ea020dfd58ef85889ed56ce4e"},{"version":"c90bc2f4cc839efafb5afa09f7c43c5b9c8721e2c18c19de611df9cb8fdee0f7","signature":"a05403c14f0fcf7d9f368648ccd7fbe9635dea2d76b38616ce7978b2aa63889c"},"9f2b60a199443fcba445b103dc7a0d6d3c0901d0279571860fcc32a67982c0e7",{"version":"9d1f687f92714b82d0a55d822c181281f03b047a173a01c78a4124abaacbbf27","signature":"b3ff69f48488da5978db457570b0745f10ac01095b10460cc4323addd16b1e51"},{"version":"f2dfcfffec92fb67f40ea55a99bf8481b98618e019e5937269aaf17fd35bed8c","signature":"5eea39e2d0454c2439941d26c4cc4f809fb8bac7cda34a58e68c627fa7c2e300"},"ba89ea4d3d73ef69151d4d9676b3c0b795db98af78ec0899788a2a8184bf720d",{"version":"77a85e25cc82b657571aa93d2be263618aa034b97ee75e76e171e7f9bb598ca7","signature":"b57ffd2dee78f4d7e24877bab745458a15e7d4c2a9a715aa310e7d9776769ca1"},{"version":"25ca145f51bdd2277d91297fc7a976c9794a961808723a0481d940db73128870","signature":"6df3d6d17d7b9b451b5c315fef3e05e7facdf40002ac423ed7badb854f5bbe76"},"f82eda491532647a55ac1fa047d04c1698964934e06be0ea80e3b17995c5bc22",{"version":"127d649065fdb75c6659afdde9431b7cbb56250fa5048b013e2f3f81975bde1c","signature":"19384f53eba2a1209a3b7e9e2615f4b11a89e634e8c9bb7e52ee68a858d7d3f9"},"1ef9310a9c3e55ef4479a6ba39c2d5a84dcf89d86ba2f0f450d7efd80c2c4086",{"version":"3b12535bcc01640c88da8e8462bbf67515a65a49db3b426b2deb3f960946c9e5","signature":"1d0150fa7b967ca930bf4d81f97968e81fbb12df39f7ff2dea819fe239a08a7e"},{"version":"033eaedbfebd0c6e07a4cfffc59ec3c62872a4daed6ba391a2d02aff8dd2dd4f","signature":"306c065f877b8fd57edfe4b0ae9cbcfa9a0c200f9c165c7186ae97f260c8df17"},"fbfad858ba60f5a46916ded99252dcd4f3eee04deab5ada357ae404acb7ae92c",{"version":"2618cae715702bd817e1528337285ec704ee5e925ab638c48efd011918c2d7d9","signature":"9d48ba96f7a03f32aaaebc42d2093f08e05ff9845365325d607c574115981b3e"},{"version":"3733123c9552464e981e3c48a3f3be87e30a0b87c57f39dc445e4a1a9b74f958","signature":"684dd2c3e2352eee7e561d7fd4123d56d7e5903f39d76a5b674ffe738b9e4ea5"},"c0fcec422e7ebbbc148daa36f11b979f225c4bb8f8e56c294c94d7427b68c54c",{"version":"67a9057796ca7c7c04005297532358ad6e231223a8c405011f2f6752f79c5818","signature":"4d8f6b245380e62372145114bc782801bb6fe32e46268022eb8773c46c411dbd"},"10108c7cdc4ad660215d3ef4bb893244afd422c0b75ffaad9c2d14177278b769",{"version":"84b7b73cc56d8a8f66956740692053f280289ae6fa0fe880db00a0b0d4a7912e","signature":"fc0ae6558234c70ac37e299e68ab60c71602026067d156c59385a99b4175fb35"},{"version":"c7cd53e6fa8cb5a1d88268abec30d74e868822b4816b9d4d4ef9d2c10747da51","signature":"83377ebcff939d6614a818c9df2b568894943d1de6b47486ebd6bafe9070cf90"},{"version":"1228e16822f5edea8f5221e1dbd091efd52daa5a438e6a2a5e92c0f3cb816835","signature":"11897cccf9e074fe6001b66576a2ac97e23f29a54991239800a309cdf08ae592"},{"version":"b7eb2b3d8e59e11c623616c54a9b9f594fcb0b18ba36675a028c53c33bf8fdb1","signature":"462223fc5c3f164d8818f43ab372137795270cc7dbdf537fd8f8db5ccfc074e7"},{"version":"05741e2c3b958508424ff867afc2573912e413ddbd4177fa691045eba32af703","signature":"8ee403d597589bc5bc99839d5199596b16f459bc2f3a78ecf6cecdbec6843341"},{"version":"11c2408c325a68fe9143136fd1f27d19d97cfec7b8d8e6e7772144a49c4ff40c","signature":"6ebe765592b2e9f9cfcc835e1eb80320ae2a60feb59e51ee0d036e5d6e812ec0"},"d1986184a09a52db8228cb2bb2a61a8c05c9354e5b93cec8e2628d8579c892d7","3dd7a9ae023eebbfbce7faab47f25dbacc126234d43d88888700b176f97fd2c9"],"root":[[496,502],[581,586],590,[594,597],[668,688],[693,751],[784,811]],"options":{"allowJs":true,"esModuleInterop":true,"jsx":4,"module":99,"skipLibCheck":true,"strict":true,"target":9},"fileIdsList":[[449,450,451,452],[192,490,493,496,585,586,590,597,670,686,694,696,697,699,700,702,703,705,706,709,710,712,713,715,716,717,718,722,723,725,726,727,728,731,732,734,735,737,738,740,741,744,745,747,748,750,751,786,787,789,790,792,793,794,795,797,798,800,801,802,803,804,805,806,808],[63,192,483,501,502,596,667],[63,192,483,501,596,663,666,668],[63,192,483,501,502,596],[63,192,483,501,596],[63,192,473,483,502,596],[192],[63,192,473,483,502,581,596,668],[192,675],[63,192,483,502,581,596,667],[63,192],[63,192,499,667],[63,192,663,666],[63,192,667],[192,500],[192,580],[63,192,502,581],[192,671],[192,699],[192,702],[192,705],[192,715],[192,712],[192,717],[192,709],[192,725],[192,722],[192,687,688,693],[192,727],[192,734],[192,731],[192,737],[192,740],[192,696],[192,747],[192,744],[192,750],[192,792],[192,789],[192,794],[192,786],[192,800],[192,797],[192,802],[192,674],[192,595,596],[63,192,502,581,667,675,678,680,681,687],[63,192,473,483,502,581,582,596,667,675,676,680,681,687],[63,192,502,596,667,675,680],[192,473,581,583,596,667,687],[63,192,473,483,581,666,667,675,680,681,683,687,719],[63,192,667,675,681,683,719],[192,502,687,692],[63,192,473,581,667,675,680,687,719,720],[63,192,502],[63,192,473,483,502,581,667,675,687,707],[63,192,473,483,502,581,667,675,679,681,683,684,685,687,707],[63,192,473,581,667,675,680,681,687,707],[63,192,502,581,582,667,675,676,678,680,681,682,684,687],[192,502,692],[63,192,473,581,666,667,687,729],[63,192,473,581,666,667,675,680,681,687,719,729],[63,192,473,483,581,583,596,667,687],[63,192,502,581,667,675,678,680,681,685,687],[192,502,692,719],[192,473,581,666,667,687,742],[63,192,473,581,666,667,675,680,681,684,687,719,742],[63,192,502,582],[63,192,473,581,666,667,675,687,784],[63,192,473,483,502,581,667,675,681,682,685,687,784],[63,192,502,783],[63,192,473,483,502,581,667,675,681,685,687,784],[63,192,473,581,666,667,675,680,681,684,687,784],[63,192,473,502,581,583,596,667,675,680,681,687],[63,192,483,502,581,596],[63,192,692],[192,698],[192,701],[192,704],[192,714],[192,711],[192,708],[192,724],[192,721],[192,483],[192,733],[192,730],[192,736],[192,739],[192,695],[192,746],[192,743],[192,749],[192,791],[192,788],[192,785],[192,799],[192,796],[192,677],[192,669],[192,473,807],[192,490],[192,490,584],[192,486,491,494,589],[192,593],[494,495,496],[781,782],[579,762,763,780],[632,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662],[632],[632,634],[63,632,634],[598,599,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631],[598,599,600],[598,599],[599],[689],[63,192,690],[691],[761],[760],[753],[752,754,756,757,761],[754,755,758],[752,755,758],[754,756,758],[752,753,755,756,757,758,759],[752,758],[754],[70],[106],[107,112,141],[108,119,120,127,138,149],[108,109,119,127],[110,150],[111,112,120,128],[112,138,146],[113,115,119,127],[106,114],[115,116],[119],[117,119],[106,119],[119,120,121,138,149],[119,120,121,134,138,141],[104,107,154],[115,119,122,127,138,149],[119,120,122,123,127,138,146,149],[122,124,138,146,149],[70,71,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156],[119,125],[126,149,154],[115,119,127,138],[128],[129],[106,130],[127,128,131,148,154],[132],[133],[119,134,135],[134,136,150,152],[107,119,138,139,140,141],[107,138,140],[138,139],[141],[142],[106,138],[119,144,145],[144,145],[112,127,138,146],[147],[127,148],[107,122,133,149],[112,150],[138,151],[126,152],[153],[107,112,119,121,130,138,149,152,154],[138,155],[63,67,158,159,160,162,444,489],[63],[63,67,158,159,160,161,425,444,489],[63,67,158,159,161,162,444,489],[63,162,425,426],[63,162,425],[63,67,159,160,161,162,444,489],[63,67,158,160,161,162,444,489],[61,62],[447],[395,458,459],[167,168,170,182,206,321,332,440],[170,201,202,203,205,440],[170,338,340,342,343,345,440,442],[170,204,241,440],[168,170,181,182,188,194,199,320,321,322,331,440,442],[440],[177,183,202,222,317],[170],[163,177,183],[349],[346,347,349],[346,348,440],[122,222,419,437],[122,293,296,312,317,437],[122,265,437],[325],[324,325,326],[324],[69,122,163,170,182,188,194,200,202,206,207,220,221,288,318,319,332,440,444],[167,170,204,241,338,339,344,440,492],[204,492],[167,221,390,440,492],[492],[170,204,205,492],[341,492],[207,320,323,330],[63,395],[133,177,192],[177,192],[63,262],[63,183,192,395],[177,248,262,263,474,481],[247,475,476,477,478,480],[298],[298,299],[181,183,250,251],[183,257,258],[183,252,260],[257],[175,183,250,251,252,253,254,255,256,257,260],[183,250,257,258,259,261],[183,251,253,254],[251,253,256,258],[479],[183],[63,171,468],[63,149],[63,204,239],[63,204,332],[237,242],[63,238,446],[587],[63,122,138,488,489],[63,67,122,158,159,160,161,162,444,488],[122,183],[122,182,187,268,285,327,328,332,387,389,440,441],[220,329],[444],[169],[63,174,177,392,408,410],[133,177,392,407,408,409,491],[401,402,403,404,405,406],[403],[407],[192,356,357,359],[63,183,350,351,352,353,358],[356,358],[354],[355],[63,192,238,446],[63,192,445,446],[63,192,446],[285,286],[286],[122,441,446],[315],[106,314],[177,183,189,191,293,306,310,312,389,392,429,430,437,441],[183,232,254],[293,304,307,312],[63,174,177,293,296,312,315,349,396,397,398,399,400,411,412,413,414,415,416,417,418,492],[174,177,202,293,300,301,302,305,306],[138,183,202,304,311,392,393,437],[308],[122,133,171,183,187,197,229,230,233,285,288,353,387,388,429,440,441,442,444,492],[174,175,177],[293],[106,202,229,230,287,288,289,290,291,292,441],[312],[106,176,177,187,191,227,293,300,301,302,303,304,307,308,309,310,311,430],[122,227,228,300,441,442],[202,230,285,288,293,389,441],[122,440,442],[122,138,437,441,442],[122,133,163,177,182,189,191,194,197,204,224,229,230,231,232,233,268,269,271,274,276,279,280,281,282,284,332,387,389,437,440,441,442],[122,138],[170,171,172,200,437,438,439,444,446,492],[167,168,440],[361],[122,138,149,179,345,349,350,351,352,353,359,360,492],[133,149,163,177,179,191,194,230,269,274,284,285,338,365,366,367,373,376,377,387,389,437,440],[194,200,207,220,230,288,440],[122,149,171,182,191,230,371,437,440],[391],[122,361,374,375,384],[437,440],[290,430],[191,229,332,446],[122,133,169,274,334,338,367,373,376,379,437],[122,207,220,338,380],[170,231,332,382,440,442],[122,149,353,440],[122,204,231,332,333,334,343,361,381,383,440],[69,122,229,386,444,446],[283,387],[122,133,177,180,182,183,189,191,197,206,207,220,230,233,269,271,281,284,285,332,365,366,367,368,370,372,387,389,437,446],[122,138,207,373,378,384,437],[210,211,212,213,214,215,216,217,218,219],[224,275],[277],[275],[277,278],[591],[122,181,182,183,187,188,441],[122,133,169,171,189,193,229,232,233,267,387,437,442,444,446],[122,133,149,173,180,181,191,193,230,385,430,436,441],[300],[301],[183,194,429],[302],[176],[178,190],[122,178,182,189],[185,190],[186],[178,179],[178,234],[178],[180,224,273],[272],[177,179,180],[180,270],[177,179],[229,332],[429],[122,149,189,191,195,229,332,386,389,392,393,394,420,421,424,428,430,437,441],[243,246,248,249,262,263],[63,160,162,192,422,423],[63,160,162,192,422,423,427],[316],[202,223,228,229,293,294,295,296,297,299,312,313,315,318,386,389,440,442],[262],[122,267,437],[267],[122,189,235,264,266,268,386,437,444,446],[243,244,245,246,248,249,262,263,445],[69,122,133,149,178,179,191,197,229,230,233,332,384,385,387,437,440,441,444],[174,177,184],[228,230,362,365],[228,363,431,432,433,434,435],[122,224,440],[122],[227,312],[226],[228,281],[225,227,440],[122,173,228,362,363,364,437,440,441],[63,177,183,261],[63,175],[165,166],[63,171],[63,177,247],[63,69,229,233,444,446],[171,468,469],[63,242],[63,133,149,169,236,238,240,241,446],[177,204,441],[177,369],[63,120,122,133,167,169,242,340,444,445],[63,158,159,160,161,162,444,489],[63,64,65,66,67],[112],[335,336,337],[335],[63,67,122,124,133,157,158,159,160,161,162,163,169,197,202,379,407,442,443,446,489],[454],[456],[460],[588],[462],[464,465,466],[470],[68,448,453,455,457,461,463,467,471,473,483,484,486,490,491,492,493],[472],[482],[592],[238],[485],[106,228,362,363,365,431,432,434,435,487,489],[157],[138,157],[81,85,149],[81,138,149],[76],[78,81,146,149],[127,146],[76,157],[78,81,127,149],[73,74,77,80,107,119,138,149],[73,79],[77,81,107,141,149,157],[107,157],[97,107,157],[75,76,157],[81],[75,76,77,78,79,80,81,82,83,85,86,87,88,89,90,91,92,93,94,95,96,98,99,100,101,102,103],[81,88,89],[79,81,89,90],[80],[73,76,81],[81,85,89,90],[85],[79,81,84,149],[73,78,79,81,85,88],[107,138],[76,81,97,107,154,157],[764,765,766,767,768,769,770,772,773,774,775,776,777,778,779],[764],[764,771],[578],[569],[569,572],[564,567,569,570,571,572,573,574,575,576,577],[503,505,572],[569,570],[504,569,571],[505,507,509,510,511,512],[507,509,511,512],[507,509,511],[504,507,509,510,512],[503,505,506,507,508,509,510,511,512,513,514,564,565,566,567,568],[503,505,506,509],[505,506,509],[509,512],[503,504,506,507,508,510,511,512],[503,504,505,509,569],[509,510,511,512],[511],[515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563],[579],[192,632],[192,633,664,665],[192,632,633,663],[192,633,663],[192,502],[580],[63,502],[725],[734],[731],[192,719],[692],[192,742],[582],[192,581],[490],[192,491,494],[593],[494,495]],"referencedMap":[[810,1],[811,2],[668,3],[669,4],[671,5],[672,6],[673,7],[595,8],[674,9],[676,10],[677,11],[675,12],[678,12],[679,13],[680,14],[499,8],[681,12],[682,13],[683,15],[684,12],[685,12],[501,8],[500,8],[502,16],[581,17],[582,8],[596,18],[686,19],[700,20],[703,21],[706,22],[716,23],[713,24],[718,25],[710,26],[726,27],[723,28],[694,29],[728,30],[735,31],[732,32],[738,33],[741,34],[697,35],[748,36],[745,37],[751,38],[793,39],[790,40],[795,41],[787,42],[801,43],[798,44],[803,45],[804,46],[597,47],[698,48],[701,49],[704,50],[695,51],[724,52],[720,53],[719,54],[721,55],[707,56],[711,57],[714,58],[708,59],[736,60],[729,61],[733,62],[730,63],[688,64],[739,65],[742,66],[746,67],[743,68],[583,69],[796,70],[799,71],[784,72],[788,70],[791,73],[785,74],[749,75],[687,76],[693,77],[699,78],[702,79],[705,80],[715,81],[712,82],[717,81],[709,83],[725,84],[722,85],[805,29],[727,86],[734,87],[731,88],[737,89],[740,90],[696,91],[747,92],[744,93],[750,94],[792,95],[789,96],[794,95],[786,97],[800,98],[797,99],[802,98],[806,100],[670,101],[808,102],[584,103],[585,104],[586,104],[590,105],[594,106],[807,12],[809,8],[497,107],[498,103],[783,108],[781,109],[663,110],[634,111],[652,112],[649,112],[639,112],[638,112],[656,112],[646,112],[650,112],[662,112],[661,112],[659,113],[658,112],[660,112],[635,112],[641,112],[637,112],[655,112],[643,112],[651,112],[640,112],[636,112],[647,112],[653,112],[654,112],[648,112],[644,112],[645,112],[657,112],[642,112],[632,114],[618,115],[615,116],[605,117],[604,115],[623,116],[612,115],[616,115],[628,116],[627,116],[625,115],[624,116],[626,116],[601,115],[607,115],[603,116],[621,116],[608,116],[617,115],[606,115],[602,115],[613,116],[619,115],[620,115],[614,115],[609,115],[611,115],[622,116],[610,117],[690,118],[691,119],[692,120],[762,121],[761,122],[754,123],[758,124],[756,125],[759,126],[757,127],[760,128],[753,129],[752,130],[70,131],[71,131],[106,132],[107,133],[108,134],[109,135],[110,136],[111,137],[112,138],[113,139],[114,140],[115,141],[116,141],[118,142],[117,143],[119,144],[120,145],[121,146],[105,147],[122,148],[123,149],[124,150],[157,151],[125,152],[126,153],[127,154],[128,155],[129,156],[130,157],[131,158],[132,159],[133,160],[134,161],[135,161],[136,162],[138,163],[140,164],[139,165],[141,166],[142,167],[143,168],[144,169],[145,170],[146,171],[147,172],[148,173],[149,174],[150,175],[151,176],[152,177],[153,178],[154,179],[155,180],[161,181],[425,182],[162,183],[160,184],[427,185],[426,186],[158,187],[159,188],[63,189],[422,182],[192,182],[667,182],[448,190],[453,1],[460,191],[443,192],[204,193],[344,194],[347,195],[332,196],[339,197],[318,198],[364,199],[194,200],[346,201],[348,202],[349,203],[420,204],[313,205],[266,206],[326,207],[327,208],[325,209],[320,210],[345,211],[205,212],[391,213],[232,214],[206,215],[233,214],[269,214],[172,214],[342,216],[331,217],[459,218],[398,219],[399,220],[395,221],[400,12],[396,222],[482,223],[481,224],[299,225],[475,226],[397,182],[252,227],[259,228],[261,229],[256,230],[258,231],[260,232],[255,233],[257,234],[480,235],[250,236],[469,237],[472,238],[240,239],[239,240],[238,241],[485,182],[237,242],[588,243],[591,244],[488,182],[489,245],[328,246],[329,247],[330,248],[188,249],[412,182],[170,250],[411,251],[410,252],[407,253],[405,254],[408,255],[406,254],[199,214],[358,256],[359,257],[357,258],[355,259],[356,260],[418,12],[193,12],[447,261],[454,262],[458,263],[287,264],[434,265],[442,266],[314,267],[315,268],[393,269],[416,270],[291,182],[308,271],[419,272],[307,273],[417,274],[414,275],[389,276],[176,277],[289,278],[293,279],[309,280],[312,281],[301,282],[294,283],[441,284],[367,285],[285,286],[173,287],[440,288],[169,289],[360,290],[361,291],[378,292],[377,293],[372,294],[392,295],[376,296],[224,297],[310,298],[230,299],[380,300],[381,301],[383,302],[385,303],[384,304],[374,287],[387,305],[284,306],[373,307],[379,308],[220,309],[276,310],[280,311],[277,312],[279,313],[282,311],[278,312],[592,314],[189,315],[268,316],[437,317],[464,318],[466,319],[430,320],[465,321],[177,322],[174,322],[191,323],[190,324],[186,325],[187,326],[195,327],[223,327],[234,327],[270,328],[235,328],[179,329],[274,330],[273,331],[272,332],[271,333],[180,334],[421,335],[222,336],[429,337],[394,338],[424,339],[428,340],[317,341],[316,342],[297,343],[283,344],[265,345],[267,346],[264,347],[386,348],[185,349],[388,350],[436,351],[225,352],[302,353],[300,354],[227,355],[362,356],[228,357],[363,357],[365,358],[262,359],[183,360],[167,361],[456,182],[468,362],[249,182],[462,12],[248,363],[445,364],[246,362],[470,365],[244,182],[245,182],[243,366],[242,367],[231,368],[306,160],[366,160],[370,369],[254,236],[263,182],[439,249],[446,370],[64,182],[67,371],[68,372],[65,182],[343,373],[338,374],[336,375],[444,376],[455,377],[457,378],[461,379],[589,380],[463,381],[467,382],[495,383],[471,383],[494,384],[473,385],[483,386],[593,387],[484,388],[486,389],[490,390],[493,249],[491,391],[371,392],[88,393],[95,394],[87,393],[102,395],[79,396],[78,397],[101,391],[96,398],[99,399],[81,400],[80,401],[76,402],[75,403],[98,404],[77,405],[82,406],[86,406],[104,407],[103,406],[90,408],[91,409],[93,410],[89,411],[92,412],[97,391],[84,413],[85,414],[94,415],[74,416],[100,417],[780,418],[769,419],[772,420],[771,419],[773,419],[774,420],[775,419],[777,419],[579,421],[573,422],[577,423],[574,423],[570,422],[578,424],[575,425],[576,423],[571,426],[572,427],[566,428],[510,429],[512,430],[511,431],[569,432],[568,433],[567,434],[513,429],[505,435],[509,436],[506,437],[507,438],[515,439],[516,439],[517,439],[518,439],[519,439],[520,439],[521,439],[522,439],[523,439],[524,439],[525,439],[526,439],[527,439],[529,439],[528,439],[530,439],[531,439],[532,439],[533,439],[564,440],[534,439],[535,439],[536,439],[537,439],[538,439],[539,439],[540,439],[541,439],[542,439],[543,439],[544,439],[545,439],[546,439],[548,439],[547,439],[549,439],[550,439],[551,439],[552,439],[553,439],[554,439],[555,439],[556,439],[557,439],[558,439],[559,439],[560,439],[563,439],[561,439],[562,439],[580,441],[633,442],[666,443],[664,444],[665,445]],"exportedModulesMap":[[810,1],[811,2],[668,446],[669,8],[671,8],[672,8],[673,8],[595,8],[674,8],[676,8],[677,8],[675,12],[678,182],[679,8],[680,12],[681,12],[682,12],[683,12],[684,12],[685,12],[581,447],[596,448],[686,8],[700,20],[703,21],[706,22],[716,23],[713,24],[718,25],[710,26],[726,449],[723,28],[694,8],[728,30],[735,450],[732,451],[738,33],[741,34],[697,35],[748,36],[745,37],[751,38],[793,39],[790,40],[795,41],[787,42],[801,43],[798,44],[803,45],[804,8],[597,8],[698,8],[701,8],[704,8],[695,8],[724,8],[720,452],[719,453],[721,8],[711,8],[714,8],[708,8],[736,8],[729,453],[733,8],[730,63],[688,8],[739,8],[742,453],[746,454],[743,8],[583,455],[796,8],[799,8],[788,8],[791,8],[785,8],[749,8],[687,456],[693,8],[699,8],[702,8],[705,8],[715,8],[712,8],[717,8],[709,8],[725,8],[722,8],[805,8],[734,87],[731,88],[737,8],[740,8],[696,8],[747,8],[744,8],[750,8],[792,8],[789,8],[794,8],[786,8],[800,8],[797,8],[802,8],[806,8],[670,8],[808,8],[584,457],[585,457],[586,457],[590,458],[594,459],[807,8],[809,8],[497,460],[498,457],[783,108],[781,109],[663,110],[634,111],[652,112],[649,112],[639,112],[638,112],[656,112],[646,112],[650,112],[662,112],[661,112],[659,113],[658,112],[660,112],[635,112],[641,112],[637,112],[655,112],[643,112],[651,112],[640,112],[636,112],[647,112],[653,112],[654,112],[648,112],[644,112],[645,112],[657,112],[642,112],[632,114],[618,115],[615,116],[605,117],[604,115],[623,116],[612,115],[616,115],[628,116],[627,116],[625,115],[624,116],[626,116],[601,115],[607,115],[603,116],[621,116],[608,116],[617,115],[606,115],[602,115],[613,116],[619,115],[620,115],[614,115],[609,115],[611,115],[622,116],[610,117],[690,118],[691,119],[692,120],[762,121],[761,122],[754,123],[758,124],[756,125],[759,126],[757,127],[760,128],[753,129],[752,130],[70,131],[71,131],[106,132],[107,133],[108,134],[109,135],[110,136],[111,137],[112,138],[113,139],[114,140],[115,141],[116,141],[118,142],[117,143],[119,144],[120,145],[121,146],[105,147],[122,148],[123,149],[124,150],[157,151],[125,152],[126,153],[127,154],[128,155],[129,156],[130,157],[131,158],[132,159],[133,160],[134,161],[135,161],[136,162],[138,163],[140,164],[139,165],[141,166],[142,167],[143,168],[144,169],[145,170],[146,171],[147,172],[148,173],[149,174],[150,175],[151,176],[152,177],[153,178],[154,179],[155,180],[161,181],[425,182],[162,183],[160,184],[427,185],[426,186],[158,187],[159,188],[63,189],[422,182],[192,182],[667,182],[448,190],[453,1],[460,191],[443,192],[204,193],[344,194],[347,195],[332,196],[339,197],[318,198],[364,199],[194,200],[346,201],[348,202],[349,203],[420,204],[313,205],[266,206],[326,207],[327,208],[325,209],[320,210],[345,211],[205,212],[391,213],[232,214],[206,215],[233,214],[269,214],[172,214],[342,216],[331,217],[459,218],[398,219],[399,220],[395,221],[400,12],[396,222],[482,223],[481,224],[299,225],[475,226],[397,182],[252,227],[259,228],[261,229],[256,230],[258,231],[260,232],[255,233],[257,234],[480,235],[250,236],[469,237],[472,238],[240,239],[239,240],[238,241],[485,182],[237,242],[588,243],[591,244],[488,182],[489,245],[328,246],[329,247],[330,248],[188,249],[412,182],[170,250],[411,251],[410,252],[407,253],[405,254],[408,255],[406,254],[199,214],[358,256],[359,257],[357,258],[355,259],[356,260],[418,12],[193,12],[447,261],[454,262],[458,263],[287,264],[434,265],[442,266],[314,267],[315,268],[393,269],[416,270],[291,182],[308,271],[419,272],[307,273],[417,274],[414,275],[389,276],[176,277],[289,278],[293,279],[309,280],[312,281],[301,282],[294,283],[441,284],[367,285],[285,286],[173,287],[440,288],[169,289],[360,290],[361,291],[378,292],[377,293],[372,294],[392,295],[376,296],[224,297],[310,298],[230,299],[380,300],[381,301],[383,302],[385,303],[384,304],[374,287],[387,305],[284,306],[373,307],[379,308],[220,309],[276,310],[280,311],[277,312],[279,313],[282,311],[278,312],[592,314],[189,315],[268,316],[437,317],[464,318],[466,319],[430,320],[465,321],[177,322],[174,322],[191,323],[190,324],[186,325],[187,326],[195,327],[223,327],[234,327],[270,328],[235,328],[179,329],[274,330],[273,331],[272,332],[271,333],[180,334],[421,335],[222,336],[429,337],[394,338],[424,339],[428,340],[317,341],[316,342],[297,343],[283,344],[265,345],[267,346],[264,347],[386,348],[185,349],[388,350],[436,351],[225,352],[302,353],[300,354],[227,355],[362,356],[228,357],[363,357],[365,358],[262,359],[183,360],[167,361],[456,182],[468,362],[249,182],[462,12],[248,363],[445,364],[246,362],[470,365],[244,182],[245,182],[243,366],[242,367],[231,368],[306,160],[366,160],[370,369],[254,236],[263,182],[439,249],[446,370],[64,182],[67,371],[68,372],[65,182],[343,373],[338,374],[336,375],[444,376],[455,377],[457,378],[461,379],[589,380],[463,381],[467,382],[495,383],[471,383],[494,384],[473,385],[483,386],[593,387],[484,388],[486,389],[490,390],[493,249],[491,391],[371,392],[88,393],[95,394],[87,393],[102,395],[79,396],[78,397],[101,391],[96,398],[99,399],[81,400],[80,401],[76,402],[75,403],[98,404],[77,405],[82,406],[86,406],[104,407],[103,406],[90,408],[91,409],[93,410],[89,411],[92,412],[97,391],[84,413],[85,414],[94,415],[74,416],[100,417],[780,418],[769,419],[772,420],[771,419],[773,419],[774,420],[775,419],[777,419],[579,421],[573,422],[577,423],[574,423],[570,422],[578,424],[575,425],[576,423],[571,426],[572,427],[566,428],[510,429],[512,430],[511,431],[569,432],[568,433],[567,434],[513,429],[505,435],[509,436],[506,437],[507,438],[515,439],[516,439],[517,439],[518,439],[519,439],[520,439],[521,439],[522,439],[523,439],[524,439],[525,439],[526,439],[527,439],[529,439],[528,439],[530,439],[531,439],[532,439],[533,439],[564,440],[534,439],[535,439],[536,439],[537,439],[538,439],[539,439],[540,439],[541,439],[542,439],[543,439],[544,439],[545,439],[546,439],[548,439],[547,439],[549,439],[550,439],[551,439],[552,439],[553,439],[554,439],[555,439],[556,439],[557,439],[558,439],[559,439],[560,439],[563,439],[561,439],[562,439],[580,441],[633,442],[666,443],[664,444],[665,445]],"semanticDiagnosticsPerFile":[810,496,811,668,669,671,672,673,595,674,676,677,675,678,679,680,499,681,682,683,684,685,501,500,502,581,582,596,686,700,703,706,716,713,718,710,726,723,694,728,735,732,738,741,697,748,745,751,793,790,795,787,801,798,803,804,597,698,701,704,695,724,720,719,721,707,711,714,708,736,729,733,730,688,739,742,746,743,583,796,799,784,788,791,785,749,687,693,699,702,705,715,712,717,709,725,722,805,727,734,731,737,740,696,747,744,750,792,789,794,786,800,797,802,806,670,808,584,585,586,590,594,807,809,497,498,783,782,781,340,663,634,652,649,639,638,656,646,650,662,661,659,658,660,635,641,637,655,643,651,640,636,647,653,654,648,644,645,657,642,631,629,630,632,598,599,618,615,605,604,623,612,616,628,627,625,624,626,601,607,603,621,608,617,606,602,613,619,620,614,609,611,622,610,600,689,690,691,692,762,761,754,758,756,759,757,760,755,753,752,70,71,106,107,108,109,110,111,112,113,114,115,116,118,117,119,120,121,105,156,122,123,124,157,125,126,127,128,129,130,131,132,133,134,135,136,137,138,140,139,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,161,425,162,160,427,426,158,423,159,61,63,422,192,72,62,667,448,453,460,443,196,204,344,347,319,332,339,221,321,202,318,364,203,194,346,348,349,420,313,266,326,327,325,324,320,345,205,390,391,232,206,233,269,172,342,341,331,438,181,459,398,399,395,477,296,400,396,482,481,476,247,299,298,475,397,252,259,261,251,256,258,260,255,253,257,478,474,480,479,250,469,472,240,239,238,485,237,226,487,588,587,591,488,489,164,328,329,330,168,333,188,163,412,170,411,410,401,402,409,404,407,403,405,408,406,201,198,199,353,358,359,357,355,356,351,418,193,447,454,458,287,286,281,434,442,314,315,393,303,416,291,308,419,304,307,305,417,414,413,415,311,389,176,289,293,309,312,301,294,441,367,285,173,440,169,360,352,361,378,350,377,69,372,197,392,368,182,184,323,376,200,224,310,230,290,375,354,380,381,322,383,385,384,334,374,387,284,373,379,209,213,212,211,216,210,219,218,215,214,217,220,208,276,275,280,277,279,282,278,592,189,268,437,435,464,466,430,465,177,174,207,191,190,186,187,195,223,234,270,235,179,178,274,273,272,271,180,421,222,429,394,424,428,317,316,297,283,265,267,264,386,288,452,185,388,436,295,225,302,300,227,362,431,228,363,450,449,451,433,432,365,292,262,183,241,167,229,456,166,468,249,462,248,445,246,171,470,244,245,236,165,243,242,231,306,366,382,370,369,254,175,263,439,446,64,67,68,65,66,343,338,337,336,335,444,455,457,461,589,463,467,495,471,494,473,483,593,484,486,490,493,492,491,371,763,59,60,10,11,13,12,2,14,15,16,17,18,19,20,21,3,22,4,23,27,24,25,26,28,29,30,5,31,32,33,34,6,38,35,36,37,39,7,40,45,46,41,42,43,44,8,50,47,48,49,51,9,52,53,54,57,55,56,1,58,88,95,87,102,79,78,101,96,99,81,80,76,75,98,77,82,83,86,73,104,103,90,91,93,89,92,97,84,85,94,74,100,780,765,766,767,768,764,769,770,772,771,773,774,775,776,777,778,779,579,573,577,574,570,578,575,576,571,572,566,510,512,565,511,569,568,567,503,513,514,505,509,504,506,507,508,515,516,517,518,519,520,521,522,523,524,525,526,527,529,528,530,531,532,533,564,534,535,536,537,538,539,540,541,542,543,544,545,546,548,547,549,550,551,552,553,554,555,556,557,558,559,560,563,561,562,580,633,666,664,665],"affectedFilesPendingEmit":[811,668,669,671,672,673,595,674,676,677,675,678,679,680,499,681,682,683,684,685,501,500,502,581,582,596,686,700,703,706,716,713,718,710,726,723,694,728,735,732,738,741,697,748,745,751,793,790,795,787,801,798,803,804,597,698,701,704,695,724,720,719,721,707,711,714,708,736,729,733,730,688,739,742,746,743,583,796,799,784,788,791,785,749,687,693,699,702,705,715,712,717,709,725,722,805,727,734,731,737,740,696,747,744,750,792,789,794,786,800,797,802,806,670,808,584,585,586,590,594,807,809,498]},"version":"5.4.5"}
\ No newline at end of file
diff --git a/ee/apps/den-web/vercel.json b/ee/apps/den-web/vercel.json
new file mode 100644
index 0000000000..a667db8cda
--- /dev/null
+++ b/ee/apps/den-web/vercel.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": "nextjs"
+}
diff --git a/ee/apps/den-worker-proxy/.env.example b/ee/apps/den-worker-proxy/.env.example
new file mode 100644
index 0000000000..79113fabf6
--- /dev/null
+++ b/ee/apps/den-worker-proxy/.env.example
@@ -0,0 +1,12 @@
+DATABASE_URL=
+DATABASE_HOST=
+DATABASE_USERNAME=
+DATABASE_PASSWORD=
+DB_MODE=
+PORT=8789
+OPENWORK_DAYTONA_ENV_PATH=
+DAYTONA_API_URL=https://app.daytona.io/api
+DAYTONA_API_KEY=
+DAYTONA_TARGET=
+DAYTONA_OPENWORK_PORT=8787
+DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS=86400
diff --git a/ee/apps/den-worker-proxy/package.json b/ee/apps/den-worker-proxy/package.json
new file mode 100644
index 0000000000..eba45db869
--- /dev/null
+++ b/ee/apps/den-worker-proxy/package.json
@@ -0,0 +1,26 @@
+{
+  "name": "@openwork-ee/den-worker-proxy",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "NODE_OPTIONS=--conditions=development OPENWORK_DEV_MODE=1 tsx watch src/server.ts",
+    "dev:local": "sh -lc 'NODE_OPTIONS=--conditions=development OPENWORK_DEV_MODE=1 PORT=${DEN_WORKER_PROXY_PORT:-8789} tsx watch src/server.ts'",
+    "build": "npm run build:den-db && tsc -p tsconfig.json",
+    "build:den-db": "pnpm --filter @openwork-ee/den-db build",
+    "start": "node dist/server.js"
+  },
+  "dependencies": {
+    "@openwork-ee/den-db": "workspace:*",
+    "@openwork-ee/utils": "workspace:*",
+    "@daytonaio/sdk": "^0.150.0",
+    "@hono/node-server": "^1.13.8",
+    "dotenv": "^16.4.5",
+    "hono": "^4.7.2",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.30",
+    "tsx": "^4.15.7",
+    "typescript": "^5.5.4"
+  }
+}
diff --git a/ee/apps/den-worker-proxy/src/app.ts b/ee/apps/den-worker-proxy/src/app.ts
new file mode 100644
index 0000000000..fc958fbe1c
--- /dev/null
+++ b/ee/apps/den-worker-proxy/src/app.ts
@@ -0,0 +1,396 @@
+import "./load-env.js"
+import { Daytona } from "@daytonaio/sdk"
+import { Hono } from "hono"
+import { and, eq, isNull } from "@openwork-ee/den-db/drizzle"
+import { createDenDb, DaytonaSandboxTable, RateLimitTable, WorkerTokenTable } from "@openwork-ee/den-db"
+import { createDenTypeId, normalizeDenTypeId } from "@openwork-ee/utils/typeid"
+import { env } from "./env.js"
+
+const { db } = createDenDb({
+  databaseUrl: env.databaseUrl,
+  mode: env.dbMode,
+  planetscale: env.planetscale,
+})
+const app = new Hono()
+const maxSignedPreviewExpirySeconds = 60 * 60 * 24
+const signedPreviewRefreshLeadMs = 5 * 60 * 1000
+const anonymousReadRateLimit = { windowMs: 60_000, max: 60 }
+const authenticatedReadRateLimit = { windowMs: 60_000, max: 240 }
+const authenticatedWriteRateLimit = { windowMs: 60_000, max: 60 }
+const publicCorsAllowMethods = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+const publicCorsAllowHeaders = [
+  "Authorization",
+  "Content-Type",
+  "X-OpenWork-Host-Token",
+  "X-OpenWork-Client-Id",
+  "X-OpenCode-Directory",
+  "X-Opencode-Directory",
+  "x-opencode-directory",
+]
+type WorkerId = typeof DaytonaSandboxTable.$inferSelect.worker_id
+type WorkerTokenScope = typeof WorkerTokenTable.$inferSelect.scope
+
+const refreshPromises = new Map<WorkerId, Promise<string | null>>()
+
+function assertDaytonaConfig() {
+  if (!env.daytona.apiKey) {
+    throw new Error("DAYTONA_API_KEY is required for worker proxy")
+  }
+}
+
+function createDaytonaClient() {
+  assertDaytonaConfig()
+  return new Daytona({
+    apiKey: env.daytona.apiKey,
+    apiUrl: env.daytona.apiUrl,
+    ...(env.daytona.target ? { target: env.daytona.target } : {}),
+  })
+}
+
+function normalizedSignedPreviewExpirySeconds() {
+  return Math.max(1, Math.min(env.daytona.signedPreviewExpiresSeconds, maxSignedPreviewExpirySeconds))
+}
+
+function signedPreviewRefreshAt(expiresInSeconds: number) {
+  return new Date(Date.now() + Math.max(0, expiresInSeconds * 1000 - signedPreviewRefreshLeadMs))
+}
+
+function noCacheHeaders(headers: Headers) {
+  headers.set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate")
+  headers.set("Pragma", "no-cache")
+  headers.set("Expires", "0")
+  headers.set("Surrogate-Control", "no-store")
+}
+
+function applyPublicCorsHeaders(headers: Headers, request: Request) {
+  const requestedHeaders = (request.headers.get("access-control-request-headers") ?? "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean)
+
+  const allowHeaders = Array.from(new Set([...publicCorsAllowHeaders, ...requestedHeaders]))
+
+  headers.delete("Access-Control-Allow-Credentials")
+  headers.set("Access-Control-Allow-Origin", "*")
+  headers.set("Access-Control-Allow-Headers", allowHeaders.join(", "))
+  headers.set("Access-Control-Allow-Methods", publicCorsAllowMethods.join(","))
+  headers.set("Access-Control-Max-Age", "86400")
+}
+
+function stripProxyHeaders(input: Headers) {
+  const headers = new Headers(input)
+  headers.delete("host")
+  headers.delete("content-length")
+  headers.delete("connection")
+  return headers
+}
+
+function readClientIp(request: Request) {
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()
+  const realIp = request.headers.get("x-real-ip")?.trim()
+  return forwarded || realIp || "unknown"
+}
+
+function readBearerToken(request: Request) {
+  const header = request.headers.get("authorization")?.trim() ?? ""
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null
+  }
+  const token = header.slice(7).trim()
+  return token || null
+}
+
+async function consumeRateLimit(input: {
+  key: string
+  max: number
+  windowMs: number
+}) {
+  const now = Date.now()
+  const rows = await db
+    .select({ count: RateLimitTable.count, lastRequest: RateLimitTable.lastRequest })
+    .from(RateLimitTable)
+    .where(eq(RateLimitTable.key, input.key))
+    .limit(1)
+
+  const current = rows[0] ?? null
+  if (!current) {
+    await db.insert(RateLimitTable).values({
+      id: createDenTypeId("rateLimit"),
+      key: input.key,
+      count: 1,
+      lastRequest: now,
+    })
+    return { allowed: true as const, retryAfterSeconds: 0 }
+  }
+
+  const elapsedMs = Math.max(0, now - current.lastRequest)
+  if (elapsedMs >= input.windowMs) {
+    await db
+      .update(RateLimitTable)
+      .set({ count: 1, lastRequest: now })
+      .where(eq(RateLimitTable.key, input.key))
+    return { allowed: true as const, retryAfterSeconds: 0 }
+  }
+
+  if (current.count >= input.max) {
+    return {
+      allowed: false as const,
+      retryAfterSeconds: Math.max(1, Math.ceil((input.windowMs - elapsedMs) / 1000)),
+    }
+  }
+
+  await db
+    .update(RateLimitTable)
+    .set({ count: current.count + 1, lastRequest: now })
+    .where(eq(RateLimitTable.key, input.key))
+
+  return { allowed: true as const, retryAfterSeconds: 0 }
+}
+
+async function resolveWorkerTokenScope(workerId: WorkerId, request: Request): Promise<WorkerTokenScope | "invalid" | null> {
+  const hostToken = request.headers.get("x-openwork-host-token")?.trim() || null
+  const bearerToken = readBearerToken(request)
+  const candidateTokens: Array<{ token: string; requiredScope: WorkerTokenScope | null }> = []
+  if (hostToken) {
+    candidateTokens.push({ token: hostToken, requiredScope: "host" })
+  }
+  if (bearerToken) {
+    candidateTokens.push({ token: bearerToken, requiredScope: null })
+  }
+
+  if (candidateTokens.length === 0) {
+    return null
+  }
+
+  for (const candidate of candidateTokens) {
+    const filters = [
+      eq(WorkerTokenTable.worker_id, workerId),
+      eq(WorkerTokenTable.token, candidate.token),
+      isNull(WorkerTokenTable.revoked_at),
+    ]
+    if (candidate.requiredScope) {
+      filters.push(eq(WorkerTokenTable.scope, candidate.requiredScope))
+    }
+
+    const rows = await db
+      .select({ scope: WorkerTokenTable.scope })
+      .from(WorkerTokenTable)
+      .where(and(...filters))
+      .limit(1)
+
+    if (rows[0]?.scope) {
+      return rows[0].scope
+    }
+  }
+
+  return "invalid"
+}
+
+async function enforceProxyRateLimit(input: {
+  workerId: WorkerId
+  request: Request
+  tokenScope: WorkerTokenScope | null
+}) {
+  const method = input.request.method.toUpperCase()
+  const ip = readClientIp(input.request)
+  const authState = input.tokenScope ?? "anonymous"
+  const limit = method === "GET" || method === "HEAD"
+    ? input.tokenScope
+      ? authenticatedReadRateLimit
+      : anonymousReadRateLimit
+    : authenticatedWriteRateLimit
+
+  return consumeRateLimit({
+    key: `worker-proxy:${input.workerId}:${authState}:${method}:${ip}`,
+    max: limit.max,
+    windowMs: limit.windowMs,
+  })
+}
+
+function targetUrl(baseUrl: string, requestUrl: string, workerId: WorkerId) {
+  const current = new URL(requestUrl)
+  const suffix = current.pathname.slice(`/${encodeURIComponent(workerId)}`.length) || "/"
+  return `${baseUrl.replace(/\/+$/, "")}${suffix}${current.search}`
+}
+
+async function getSignedPreviewUrl(workerId: WorkerId) {
+  const rows = await db
+    .select()
+    .from(DaytonaSandboxTable)
+    .where(eq(DaytonaSandboxTable.worker_id, workerId))
+    .limit(1)
+
+  const record = rows[0] ?? null
+  if (!record) {
+    return null
+  }
+
+  if (record.signed_preview_url_expires_at.getTime() > Date.now()) {
+    return record.signed_preview_url
+  }
+
+  const existingRefresh = refreshPromises.get(workerId)
+  if (existingRefresh) {
+    return existingRefresh
+  }
+
+  const refreshPromise = (async () => {
+    const daytona = createDaytonaClient()
+    const sandbox = await daytona.get(record.sandbox_id)
+    await sandbox.refreshData()
+
+    const expiresInSeconds = normalizedSignedPreviewExpirySeconds()
+    const preview = await sandbox.getSignedPreviewUrl(env.daytona.openworkPort, expiresInSeconds)
+
+    await db
+      .update(DaytonaSandboxTable)
+      .set({
+        signed_preview_url: preview.url,
+        signed_preview_url_expires_at: signedPreviewRefreshAt(expiresInSeconds),
+        region: sandbox.target,
+      })
+      .where(eq(DaytonaSandboxTable.worker_id, workerId))
+
+    return preview.url
+  })()
+
+  refreshPromises.set(workerId, refreshPromise)
+
+  try {
+    return await refreshPromise
+  } finally {
+    refreshPromises.delete(workerId)
+  }
+}
+
+async function proxyRequest(workerId: WorkerId, request: Request) {
+  let baseUrl: string | null = null
+
+  try {
+    baseUrl = await getSignedPreviewUrl(workerId)
+  } catch (error) {
+    const headers = new Headers({ "Content-Type": "application/json" })
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, request)
+    return new Response(JSON.stringify({
+      error: "worker_proxy_refresh_failed",
+      message: error instanceof Error ? error.message : "unknown_error",
+    }), { status: 502, headers })
+  }
+
+  if (!baseUrl) {
+    const headers = new Headers({ "Content-Type": "application/json" })
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, request)
+    return new Response(JSON.stringify({ error: "worker_proxy_unavailable" }), {
+      status: 404,
+      headers,
+    })
+  }
+
+  let upstream: Response
+  try {
+    upstream = await fetch(targetUrl(baseUrl, request.url, workerId), {
+      method: request.method,
+      headers: stripProxyHeaders(request.headers),
+      body: request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer(),
+      redirect: "manual",
+    })
+  } catch (error) {
+    const headers = new Headers({ "Content-Type": "application/json" })
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, request)
+    return new Response(JSON.stringify({
+      error: "worker_proxy_upstream_failed",
+      message: error instanceof Error ? error.message : "unknown_error",
+    }), { status: 502, headers })
+  }
+
+  const headers = new Headers(upstream.headers)
+  headers.delete("access-control-allow-origin")
+  headers.delete("access-control-allow-credentials")
+  headers.delete("access-control-allow-headers")
+  headers.delete("access-control-allow-methods")
+  headers.delete("access-control-max-age")
+  headers.delete("content-length")
+  headers.delete("set-cookie")
+  headers.delete("vary")
+  noCacheHeaders(headers)
+  applyPublicCorsHeaders(headers, request)
+
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers,
+  })
+}
+
+app.all("*", async (c) => {
+  const requestUrl = new URL(c.req.url)
+  if (requestUrl.pathname === "/") {
+    return Response.redirect("https://openworklabs.com", 302)
+  }
+
+  if (c.req.method === "OPTIONS") {
+    const headers = new Headers()
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, c.req.raw)
+    return new Response(null, { status: 204, headers })
+  }
+
+  const segments = requestUrl.pathname.split("/").filter(Boolean)
+  const workerId = segments[0]?.trim()
+
+  if (!workerId) {
+    const headers = new Headers({ "Content-Type": "application/json" })
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, c.req.raw)
+    return new Response(JSON.stringify({ error: "worker_id_required" }), {
+      status: 400,
+      headers,
+    })
+  }
+
+  try {
+    const normalizedWorkerId = normalizeDenTypeId("worker", workerId)
+    const tokenScope = await resolveWorkerTokenScope(normalizedWorkerId, c.req.raw)
+    const isWriteMethod = !["GET", "HEAD", "OPTIONS"].includes(c.req.method.toUpperCase())
+
+    if (tokenScope === "invalid" || (isWriteMethod && !tokenScope)) {
+      const headers = new Headers({ "Content-Type": "application/json" })
+      noCacheHeaders(headers)
+      applyPublicCorsHeaders(headers, c.req.raw)
+      return new Response(JSON.stringify({ error: "worker_proxy_unauthorized" }), {
+        status: 401,
+        headers,
+      })
+    }
+
+    const rateLimit = await enforceProxyRateLimit({
+      workerId: normalizedWorkerId,
+      request: c.req.raw,
+      tokenScope,
+    })
+    if (!rateLimit.allowed) {
+      const headers = new Headers({ "Content-Type": "application/json" })
+      headers.set("X-Retry-After", String(rateLimit.retryAfterSeconds))
+      noCacheHeaders(headers)
+      applyPublicCorsHeaders(headers, c.req.raw)
+      return new Response(JSON.stringify({ error: "worker_proxy_rate_limited" }), {
+        status: 429,
+        headers,
+      })
+    }
+
+    return proxyRequest(normalizedWorkerId, c.req.raw)
+  } catch {
+    const headers = new Headers({ "Content-Type": "application/json" })
+    noCacheHeaders(headers)
+    applyPublicCorsHeaders(headers, c.req.raw)
+    return new Response(JSON.stringify({ error: "worker_not_found" }), {
+      status: 404,
+      headers,
+    })
+  }
+})
+
+export default app
diff --git a/ee/apps/den-worker-proxy/src/env.ts b/ee/apps/den-worker-proxy/src/env.ts
new file mode 100644
index 0000000000..e6ea967d8b
--- /dev/null
+++ b/ee/apps/den-worker-proxy/src/env.ts
@@ -0,0 +1,67 @@
+import { z } from "zod"
+
+const EnvSchema = z.object({
+  DATABASE_URL: z.string().min(1).optional(),
+  DATABASE_HOST: z.string().min(1).optional(),
+  DATABASE_USERNAME: z.string().min(1).optional(),
+  DATABASE_PASSWORD: z.string().optional(),
+  DB_MODE: z.enum(["mysql", "planetscale"]).optional(),
+  PORT: z.string().optional(),
+  DAYTONA_API_URL: z.string().optional(),
+  DAYTONA_API_KEY: z.string().optional(),
+  DAYTONA_TARGET: z.string().optional(),
+  DAYTONA_OPENWORK_PORT: z.string().optional(),
+  DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS: z.string().optional(),
+}).superRefine((value, ctx) => {
+  const inferredMode = value.DB_MODE ?? (value.DATABASE_URL ? "mysql" : "planetscale")
+
+  if (inferredMode === "mysql" && !value.DATABASE_URL) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "DATABASE_URL is required when using mysql mode",
+      path: ["DATABASE_URL"],
+    })
+  }
+
+  if (inferredMode === "planetscale") {
+    for (const key of ["DATABASE_HOST", "DATABASE_USERNAME", "DATABASE_PASSWORD"] as const) {
+      if (!value[key]) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `${key} is required when using planetscale mode`,
+          path: [key],
+        })
+      }
+    }
+  }
+})
+
+const parsed = EnvSchema.parse(process.env)
+
+const planetscaleCredentials =
+  parsed.DATABASE_HOST && parsed.DATABASE_USERNAME && parsed.DATABASE_PASSWORD !== undefined
+    ? {
+        host: parsed.DATABASE_HOST,
+        username: parsed.DATABASE_USERNAME,
+        password: parsed.DATABASE_PASSWORD,
+      }
+    : null
+
+function optionalString(value: string | undefined) {
+  const trimmed = value?.trim()
+  return trimmed ? trimmed : undefined
+}
+
+export const env = {
+  databaseUrl: parsed.DATABASE_URL,
+  dbMode: parsed.DB_MODE ?? (parsed.DATABASE_URL ? "mysql" : "planetscale"),
+  planetscale: planetscaleCredentials,
+  port: Number(parsed.PORT ?? "8789"),
+  daytona: {
+    apiUrl: optionalString(parsed.DAYTONA_API_URL) ?? "https://app.daytona.io/api",
+    apiKey: optionalString(parsed.DAYTONA_API_KEY),
+    target: optionalString(parsed.DAYTONA_TARGET),
+    openworkPort: Number(parsed.DAYTONA_OPENWORK_PORT ?? "8787"),
+    signedPreviewExpiresSeconds: Number(parsed.DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS ?? "86400"),
+  },
+}
diff --git a/ee/apps/den-worker-proxy/src/index.ts b/ee/apps/den-worker-proxy/src/index.ts
new file mode 100644
index 0000000000..1bd62f6388
--- /dev/null
+++ b/ee/apps/den-worker-proxy/src/index.ts
@@ -0,0 +1,3 @@
+import app from "./app.js"
+
+export default app
diff --git a/ee/apps/den-worker-proxy/src/load-env.ts b/ee/apps/den-worker-proxy/src/load-env.ts
new file mode 100644
index 0000000000..24fe2b6594
--- /dev/null
+++ b/ee/apps/den-worker-proxy/src/load-env.ts
@@ -0,0 +1,42 @@
+import { existsSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import dotenv from "dotenv"
+
+function findUpwards(startDir: string, fileName: string, maxDepth = 8) {
+  let current = startDir
+
+  for (let depth = 0; depth <= maxDepth; depth += 1) {
+    const candidate = path.join(current, fileName)
+    if (existsSync(candidate)) {
+      return candidate
+    }
+
+    const parent = path.dirname(current)
+    if (parent === current) {
+      break
+    }
+    current = parent
+  }
+
+  return null
+}
+
+const srcDir = path.dirname(fileURLToPath(import.meta.url))
+const serviceDir = path.resolve(srcDir, "..")
+
+for (const filePath of [path.join(serviceDir, ".env.local"), path.join(serviceDir, ".env")]) {
+  if (existsSync(filePath)) {
+    dotenv.config({ path: filePath, override: false })
+  }
+}
+
+const explicitDaytonaEnvPath = process.env.OPENWORK_DAYTONA_ENV_PATH?.trim()
+const detectedDaytonaEnvPath = findUpwards(path.resolve(serviceDir, "..", ".."), ".env.daytona")
+const daytonaEnvPath = explicitDaytonaEnvPath || detectedDaytonaEnvPath
+
+if (daytonaEnvPath && existsSync(daytonaEnvPath)) {
+  dotenv.config({ path: daytonaEnvPath, override: false })
+}
+
+dotenv.config({ override: false })
diff --git a/ee/apps/den-worker-proxy/src/server.ts b/ee/apps/den-worker-proxy/src/server.ts
new file mode 100644
index 0000000000..b1359b5e2f
--- /dev/null
+++ b/ee/apps/den-worker-proxy/src/server.ts
@@ -0,0 +1,7 @@
+import { serve } from "@hono/node-server"
+import app from "./app.js"
+import { env } from "./env.js"
+
+serve({ fetch: app.fetch, port: env.port }, (info) => {
+  console.log(`worker proxy listening on ${info.port}`)
+})
diff --git a/ee/apps/den-worker-proxy/tsconfig.json b/ee/apps/den-worker-proxy/tsconfig.json
new file mode 100644
index 0000000000..21f5aeef55
--- /dev/null
+++ b/ee/apps/den-worker-proxy/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src"]
+}
diff --git a/ee/apps/den-worker-runtime/.gitignore b/ee/apps/den-worker-runtime/.gitignore
new file mode 100644
index 0000000000..e660fd93d3
--- /dev/null
+++ b/ee/apps/den-worker-runtime/.gitignore
@@ -0,0 +1 @@
+bin/
diff --git a/ee/apps/den-worker-runtime/Dockerfile.daytona-snapshot b/ee/apps/den-worker-runtime/Dockerfile.daytona-snapshot
new file mode 100644
index 0000000000..99c9a10a38
--- /dev/null
+++ b/ee/apps/den-worker-runtime/Dockerfile.daytona-snapshot
@@ -0,0 +1,52 @@
+FROM node:22-bookworm-slim AS openwork-builder
+
+WORKDIR /src
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl git unzip \
+  && npm install -g bun \
+  && corepack enable \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY . .
+
+RUN pnpm install --frozen-lockfile --filter openwork-orchestrator... \
+  && pnpm --filter openwork-orchestrator build:bin
+
+FROM node:22-bookworm-slim
+
+ARG OPENWORK_ORCHESTRATOR_VERSION=0.11.151
+ARG OPENCODE_VERSION
+ARG OPENCODE_DOWNLOAD_URL=
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl tar unzip \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=openwork-builder /src/apps/orchestrator/dist/bin/openwork /usr/local/bin/openwork
+COPY --from=openwork-builder /src/constants.json /usr/local/constants.json
+
+RUN set -eux; \
+  test -n "$OPENCODE_VERSION"; \
+  arch="$(dpkg --print-architecture)"; \
+  case "$arch" in \
+    amd64) asset="opencode-linux-x64-baseline.tar.gz" ;; \
+    arm64) asset="opencode-linux-arm64.tar.gz" ;; \
+    *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
+  esac; \
+  url="$OPENCODE_DOWNLOAD_URL"; \
+  if [ -z "$url" ]; then \
+    url="https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/${asset}"; \
+  fi; \
+  tmpdir="$(mktemp -d)"; \
+  curl -fsSL "$url" -o "$tmpdir/$asset"; \
+  tar -xzf "$tmpdir/$asset" -C "$tmpdir"; \
+  binary="$(find "$tmpdir" -type f -name opencode | head -n 1)"; \
+  test -n "$binary"; \
+  install -m 0755 "$binary" /usr/local/bin/opencode; \
+  rm -rf "$tmpdir"
+
+RUN test "$(openwork --version)" = "$OPENWORK_ORCHESTRATOR_VERSION" \
+  && opencode --version
+
+CMD ["sleep", "infinity"]
diff --git a/ee/apps/den-worker-runtime/README.md b/ee/apps/den-worker-runtime/README.md
new file mode 100644
index 0000000000..b67cbcec89
--- /dev/null
+++ b/ee/apps/den-worker-runtime/README.md
@@ -0,0 +1,7 @@
+# Den Worker Runtime Root
+
+Render worker services use this directory as `rootDir`.
+
+The control plane installs `openwork-orchestrator`, reads the pinned OpenCode version from `constants.json` packaged with it, runs `scripts/install-opencode.mjs` during the Render build, and then launches workers with the `openwork` command.
+
+That extra build step vendors the matching `opencode` release asset into `./bin/opencode` so the runtime does not depend on a first-boot GitHub download.
diff --git a/ee/apps/den-worker-runtime/scripts/install-opencode.mjs b/ee/apps/den-worker-runtime/scripts/install-opencode.mjs
new file mode 100644
index 0000000000..832214a58b
--- /dev/null
+++ b/ee/apps/den-worker-runtime/scripts/install-opencode.mjs
@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const runtimeRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const repoRoot = resolve(runtimeRoot, "..", "..");
+const outputDir = resolve(runtimeRoot, "bin");
+const outputName = process.platform === "win32" ? "opencode.exe" : "opencode";
+const outputPath = join(outputDir, outputName);
+const versionStampPath = join(outputDir, "opencode.version");
+
+function readJson(filePath) {
+  return JSON.parse(readFileSync(filePath, "utf8"));
+}
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    stdio: "inherit",
+    encoding: "utf8",
+  });
+  if (result.status !== 0) {
+    throw new Error(`Command failed: ${command} ${args.join(" ")}`);
+  }
+  return result;
+}
+
+function resolveOrchestratorPackageJson() {
+  const globalRoot = spawnSync("npm", ["root", "-g"], {
+    cwd: runtimeRoot,
+    encoding: "utf8",
+  });
+
+  if (globalRoot.status === 0) {
+    const candidate = resolve(globalRoot.stdout.trim(), "openwork-orchestrator", "package.json");
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  const repoCandidate = resolve(repoRoot, "packages", "orchestrator", "package.json");
+  if (existsSync(repoCandidate)) {
+    return repoCandidate;
+  }
+
+  throw new Error("Unable to locate openwork-orchestrator package.json");
+}
+
+function resolveOpencodeVersion() {
+  const orchestratorPackageJson = resolveOrchestratorPackageJson();
+  const orchestratorRoot = resolve(orchestratorPackageJson, "..");
+  const versionPath = resolve(orchestratorRoot, "constants.json");
+  if (!existsSync(versionPath)) {
+    throw new Error(`Missing pinned constants file at ${versionPath}`);
+  }
+  const parsed = JSON.parse(readFileSync(versionPath, "utf8"));
+  const version = String(parsed.opencodeVersion ?? "").trim().replace(/^v/, "");
+  if (!version) {
+    throw new Error(`Pinned OpenCode version is missing from ${versionPath}`);
+  }
+  return version;
+}
+
+function resolveAssetName() {
+  const target = `${process.platform}-${process.arch}`;
+  const assets = {
+    "darwin-arm64": "opencode-darwin-arm64.zip",
+    "darwin-x64": "opencode-darwin-x64-baseline.zip",
+    "linux-arm64": "opencode-linux-arm64.tar.gz",
+    "linux-x64": "opencode-linux-x64-baseline.tar.gz",
+    "win32-arm64": "opencode-windows-arm64.zip",
+    "win32-x64": "opencode-windows-x64-baseline.zip",
+  };
+
+  const asset = assets[target];
+  if (!asset) {
+    throw new Error(`Unsupported platform for opencode bundle: ${target}`);
+  }
+  return asset;
+}
+
+async function downloadWithRetries(url, destination) {
+  let lastError = null;
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    try {
+      const response = await fetch(url);
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}`);
+      }
+      const buffer = Buffer.from(await response.arrayBuffer());
+      writeFileSync(destination, buffer);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (attempt < 3) {
+        await new Promise((resolvePromise) => setTimeout(resolvePromise, attempt * 1000));
+      }
+    }
+  }
+
+  throw new Error(`Failed to download ${url}: ${String(lastError)}`);
+}
+
+function extractArchive(archivePath, outputDirectory) {
+  if (archivePath.endsWith(".tar.gz")) {
+    run("tar", ["-xzf", archivePath, "-C", outputDirectory], runtimeRoot);
+    return;
+  }
+
+  if (archivePath.endsWith(".zip")) {
+    if (process.platform === "win32") {
+      run(
+        "powershell",
+        [
+          "-NoProfile",
+          "-Command",
+          `Expand-Archive -Path '${archivePath.replace(/'/g, "''")}' -DestinationPath '${outputDirectory.replace(/'/g, "''")}' -Force`,
+        ],
+        runtimeRoot,
+      );
+      return;
+    }
+
+    run("unzip", ["-q", archivePath, "-d", outputDirectory], runtimeRoot);
+    return;
+  }
+
+  throw new Error(`Unsupported archive format: ${basename(archivePath)}`);
+}
+
+function findBinary(searchRoot) {
+  const stack = [searchRoot];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (!current) continue;
+
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const entryPath = join(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(entryPath);
+        continue;
+      }
+      if (entry.isFile() && entry.name === outputName) {
+        return entryPath;
+      }
+    }
+  }
+
+  throw new Error(`Unable to find ${outputName} inside extracted archive`);
+}
+
+const version = resolveOpencodeVersion();
+const versionLabel = version;
+
+if (
+  existsSync(outputPath) &&
+  existsSync(versionStampPath) &&
+  readFileSync(versionStampPath, "utf8").trim() === versionLabel
+) {
+  console.log(`[den-worker-runtime] opencode ${versionLabel} already bundled at ${outputPath}`);
+  process.exit(0);
+}
+
+const assetName = resolveAssetName();
+const downloadUrl = process.env.OPENWORK_OPENCODE_DOWNLOAD_URL?.trim()
+  || (version
+    ? `https://github.com/anomalyco/opencode/releases/download/v${version}/${assetName}`
+    : null);
+if (!downloadUrl) {
+  throw new Error("Pinned OpenCode version is required to bundle the worker runtime");
+}
+const tempDir = mkdtempSync(join(tmpdir(), "den-worker-opencode-"));
+const archivePath = join(tempDir, assetName);
+const extractDir = join(tempDir, "extract");
+
+mkdirSync(extractDir, { recursive: true });
+mkdirSync(outputDir, { recursive: true });
+
+try {
+  console.log(`[den-worker-runtime] downloading opencode ${versionLabel} from ${downloadUrl}`);
+  await downloadWithRetries(downloadUrl, archivePath);
+  extractArchive(archivePath, extractDir);
+  const extractedBinary = findBinary(extractDir);
+  copyFileSync(extractedBinary, outputPath);
+  if (process.platform !== "win32") {
+    chmodSync(outputPath, 0o755);
+  }
+  writeFileSync(versionStampPath, `${versionLabel}\n`, "utf8");
+  console.log(`[den-worker-runtime] bundled opencode ${versionLabel} at ${outputPath}`);
+} finally {
+  rmSync(tempDir, { recursive: true, force: true });
+}
diff --git a/ee/apps/landing/.gitignore b/ee/apps/landing/.gitignore
new file mode 100644
index 0000000000..272e211607
--- /dev/null
+++ b/ee/apps/landing/.gitignore
@@ -0,0 +1,4 @@
+.vercel
+.env
+.env.*
+.env*.local
diff --git a/ee/apps/landing/README.md b/ee/apps/landing/README.md
new file mode 100644
index 0000000000..323a3cc05e
--- /dev/null
+++ b/ee/apps/landing/README.md
@@ -0,0 +1,34 @@
+# OpenWork Landing (Next.js)
+
+## Local dev
+
+1. Install deps from repo root:
+   `pnpm install`
+2. Run the app:
+   `pnpm --filter @openwork-ee/landing dev`
+
+### Optional env vars
+
+- `NEXT_PUBLIC_CAL_URL` - enterprise booking link
+- `NEXT_PUBLIC_DEN_CHECKOUT_URL` - Polar checkout URL for the Den preorder CTA
+- `LOOPS_API_KEY` - Loops API key for feedback/contact submissions
+- `LOOPS_TRANSACTIONAL_ID_APP_FEEDBACK` - Loops transactional template ID for app feedback emails
+- `LOOPS_INTERNAL_FEEDBACK_EMAIL` - optional override for the internal feedback recipient (defaults to `team@openworklabs.com`)
+- `LANDING_FORM_ALLOWED_ORIGINS` - optional comma-separated origin allowlist for feedback/contact form posts
+
+## Deploy (recommended)
+
+This app is ready for Vercel or any Node-compatible Next.js host.
+
+### Vercel
+
+1. Create a new Vercel project rooted at `ee/apps/landing`.
+2. Build command: `pnpm --filter @openwork-ee/landing build`
+3. Output: `.next`
+4. Start command: `pnpm --filter @openwork-ee/landing start`
+5. Enable Vercel BotID for the project so protected form routes can reject automated submissions.
+
+### Self-hosted
+
+1. Build: `pnpm --filter @openwork-ee/landing build`
+2. Start: `pnpm --filter @openwork-ee/landing start`
diff --git a/ee/apps/landing/app/.well-known/api-catalog/route.ts b/ee/apps/landing/app/.well-known/api-catalog/route.ts
new file mode 100644
index 0000000000..2c7a16712a
--- /dev/null
+++ b/ee/apps/landing/app/.well-known/api-catalog/route.ts
@@ -0,0 +1,48 @@
+export const dynamic = "force-static"
+
+const linkset = {
+  linkset: [
+    {
+      anchor: "https://api.openworklabs.com",
+      "service-desc": [
+        {
+          href: "https://api.openworklabs.com/openapi.json",
+          type: "application/vnd.oai.openapi+json;version=3.1",
+          title: "OpenWork Den API — OpenAPI 3.1 document",
+        },
+      ],
+      "service-doc": [
+        {
+          href: "https://openworklabs.com/docs/api-reference",
+          type: "text/html",
+          title: "OpenWork Den API — human documentation",
+        },
+      ],
+      status: [
+        {
+          href: "https://api.openworklabs.com/health",
+          type: "application/json",
+          title: "OpenWork Den API — health endpoint",
+        },
+      ],
+      "service-meta": [
+        {
+          href: "https://openworklabs.com/llms.txt",
+          type: "text/plain",
+          title: "OpenWork llms.txt — agent-facing site guide",
+        },
+      ],
+    },
+  ],
+}
+
+export function GET() {
+  return new Response(JSON.stringify(linkset, null, 2), {
+    status: 200,
+    headers: {
+      "Content-Type": "application/linkset+json",
+      "Cache-Control": "public, max-age=3600",
+      "Access-Control-Allow-Origin": "*",
+    },
+  })
+}
diff --git a/ee/apps/landing/app/api/_lib/security.ts b/ee/apps/landing/app/api/_lib/security.ts
new file mode 100644
index 0000000000..da3c0079c1
--- /dev/null
+++ b/ee/apps/landing/app/api/_lib/security.ts
@@ -0,0 +1,145 @@
+import { checkBotId } from "botid/server";
+
+type FixedWindowEntry = {
+  count: number;
+  resetAt: number;
+};
+
+const minimumSubmissionAgeMs = 1500;
+const maximumSubmissionAgeMs = 1000 * 60 * 60;
+const defaultAllowedOrigins = [
+  "https://openworklabs.com",
+  "https://www.openworklabs.com",
+  "https://openwork.software",
+  "https://www.openwork.software",
+  "http://localhost:3000",
+  "http://127.0.0.1:3000",
+  "http://localhost:3005",
+  "http://127.0.0.1:3005",
+];
+
+const store = globalThis as typeof globalThis & {
+  __openworkLandingRateLimitStore?: Map<string, FixedWindowEntry>;
+};
+
+const rateLimitStore = store.__openworkLandingRateLimitStore ?? new Map<string, FixedWindowEntry>();
+store.__openworkLandingRateLimitStore = rateLimitStore;
+
+function currentTime() {
+  return Date.now();
+}
+
+function readClientIp(request: Request) {
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  const realIp = request.headers.get("x-real-ip")?.trim();
+  return forwarded || realIp || "unknown";
+}
+
+function getRequestOrigin(request: Request) {
+  try {
+    return new URL(request.url).origin;
+  } catch {
+    return "";
+  }
+}
+
+export function getAllowedOrigins(request: Request) {
+  const configured = String(process.env.LANDING_FORM_ALLOWED_ORIGINS ?? "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  return new Set([getRequestOrigin(request), ...defaultAllowedOrigins, ...configured].filter(Boolean));
+}
+
+export function validateTrustedOrigin(request: Request) {
+  const origin = request.headers.get("origin")?.trim() ?? "";
+  if (!origin) {
+    return { ok: false as const, status: 403, error: "A trusted browser origin is required." };
+  }
+  if (!getAllowedOrigins(request).has(origin)) {
+    return { ok: false as const, status: 403, error: "Origin is not allowed." };
+  }
+  return { ok: true as const, origin };
+}
+
+export function buildResponseHeaders(request: Request) {
+  const origin = request.headers.get("origin")?.trim() ?? "";
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (origin && getAllowedOrigins(request).has(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Vary"] = "Origin";
+  }
+  return headers;
+}
+
+export function jsonResponse(request: Request, body: unknown, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: buildResponseHeaders(request),
+  });
+}
+
+export function applyFixedWindowRateLimit(input: {
+  key: string;
+  windowMs: number;
+  max: number;
+}) {
+  const now = currentTime();
+  const current = rateLimitStore.get(input.key);
+  if (!current || current.resetAt <= now) {
+    rateLimitStore.set(input.key, { count: 1, resetAt: now + input.windowMs });
+    return { ok: true as const, retryAfterSeconds: 0 };
+  }
+
+  if (current.count >= input.max) {
+    return {
+      ok: false as const,
+      retryAfterSeconds: Math.max(1, Math.ceil((current.resetAt - now) / 1000)),
+    };
+  }
+
+  current.count += 1;
+  rateLimitStore.set(input.key, current);
+  return { ok: true as const, retryAfterSeconds: 0 };
+}
+
+export function rateLimitFormRequest(request: Request, route: string) {
+  return applyFixedWindowRateLimit({
+    key: `${route}:${readClientIp(request)}`,
+    windowMs: 60_000,
+    max: 5,
+  });
+}
+
+export async function verifyFormBotProtection() {
+  const result = await checkBotId();
+  if (result.isBot) {
+    return { ok: false as const, status: 403, error: "Bot traffic is not allowed for this form." };
+  }
+  return { ok: true as const };
+}
+
+export function validateAntiSpamFields(input: { website?: string; startedAt?: number | string }) {
+  if (typeof input.website === "string" && input.website.trim()) {
+    return { ok: false as const, status: 400, error: "Invalid form submission." };
+  }
+
+  const startedAt = typeof input.startedAt === "number"
+    ? input.startedAt
+    : typeof input.startedAt === "string" && input.startedAt.trim()
+      ? Number(input.startedAt)
+      : Number.NaN;
+
+  if (!Number.isFinite(startedAt)) {
+    return { ok: false as const, status: 400, error: "Missing submission timing metadata." };
+  }
+
+  const ageMs = currentTime() - startedAt;
+  if (ageMs < minimumSubmissionAgeMs || ageMs > maximumSubmissionAgeMs) {
+    return { ok: false as const, status: 400, error: "Invalid form submission timing." };
+  }
+
+  return { ok: true as const };
+}
diff --git a/ee/apps/landing/app/api/app-feedback/route.ts b/ee/apps/landing/app/api/app-feedback/route.ts
new file mode 100644
index 0000000000..bbfb939bc8
--- /dev/null
+++ b/ee/apps/landing/app/api/app-feedback/route.ts
@@ -0,0 +1,211 @@
+import { buildResponseHeaders, jsonResponse, rateLimitFormRequest, validateAntiSpamFields, validateTrustedOrigin, verifyFormBotProtection } from "../_lib/security";
+
+type FeedbackContext = {
+  source?: string;
+  entrypoint?: string;
+  deployment?: string;
+  appVersion?: string;
+  openworkServerVersion?: string;
+  opencodeVersion?: string;
+  orchestratorVersion?: string;
+  opencodeRouterVersion?: string;
+  osName?: string;
+  osVersion?: string;
+  platform?: string;
+};
+
+type FeedbackPayload = {
+  name?: string;
+  email?: string;
+  message?: string;
+  website?: string;
+  startedAt?: number | string;
+  context?: FeedbackContext;
+};
+
+const LOOPS_TRANSACTIONAL_API_URL = "https://app.loops.so/api/v1/transactional";
+const DEFAULT_INTERNAL_FEEDBACK_EMAIL = "team@openworklabs.com";
+
+function sanitizeValue(value: unknown, maxLength = 240) {
+  return typeof value === "string" ? value.trim().slice(0, maxLength) : "";
+}
+
+function sanitizeContext(input: FeedbackContext | undefined) {
+  return {
+    source: sanitizeValue(input?.source),
+    entrypoint: sanitizeValue(input?.entrypoint),
+    deployment: sanitizeValue(input?.deployment),
+    appVersion: sanitizeValue(input?.appVersion),
+    openworkServerVersion: sanitizeValue(input?.openworkServerVersion),
+    opencodeVersion: sanitizeValue(input?.opencodeVersion),
+    orchestratorVersion: sanitizeValue(input?.orchestratorVersion),
+    opencodeRouterVersion: sanitizeValue(input?.opencodeRouterVersion),
+    osName: sanitizeValue(input?.osName),
+    osVersion: sanitizeValue(input?.osVersion),
+    platform: sanitizeValue(input?.platform),
+  };
+}
+
+function formatDiagnosticsSummary(context: ReturnType<typeof sanitizeContext>) {
+  const osLabel = [context.osName, context.osVersion].filter(Boolean).join(" ");
+  const lines = [
+    ["Source", context.source],
+    ["Entrypoint", context.entrypoint],
+    ["Deployment", context.deployment],
+    ["App version", context.appVersion],
+    ["OpenWork server", context.openworkServerVersion],
+    ["OpenCode", context.opencodeVersion],
+    ["Orchestrator", context.orchestratorVersion],
+    ["Router", context.opencodeRouterVersion],
+    ["OS", osLabel],
+    ["Platform", context.platform],
+  ].filter(([, value]) => value);
+
+  return lines.map(([label, value]) => `${label}: ${value}`).join("\n");
+}
+
+export async function POST(request: Request) {
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    return jsonResponse(request, { error: originCheck.error }, originCheck.status);
+  }
+
+  const rateLimit = rateLimitFormRequest(request, "app-feedback");
+  if (!rateLimit.ok) {
+    return new Response(JSON.stringify({ error: "Feedback form is temporarily rate limited." }), {
+      status: 429,
+      headers: {
+        ...buildResponseHeaders(request),
+        "X-Retry-After": String(rateLimit.retryAfterSeconds),
+      },
+    });
+  }
+
+  const botProtection = await verifyFormBotProtection();
+  if (!botProtection.ok) {
+    return jsonResponse(request, { error: botProtection.error }, botProtection.status);
+  }
+
+  const apiKey = process.env.LOOPS_API_KEY?.trim();
+  const transactionalId =
+    process.env.LOOPS_TRANSACTIONAL_ID_APP_FEEDBACK?.trim();
+  const internalEmail =
+    process.env.LOOPS_INTERNAL_FEEDBACK_EMAIL?.trim() ||
+    DEFAULT_INTERNAL_FEEDBACK_EMAIL;
+
+  if (!apiKey || !transactionalId) {
+    return jsonResponse(
+      request,
+      { error: "App feedback is not configured on this deployment." },
+      500,
+    );
+  }
+
+  let payload: FeedbackPayload;
+  try {
+    const raw = await request.text();
+    if (raw.length > 8000) {
+      return jsonResponse(request, { error: "Request payload is too large." }, 413);
+    }
+    payload = JSON.parse(raw) as FeedbackPayload;
+  } catch {
+    return jsonResponse(request,
+      { error: "Invalid request payload." },
+      400,
+    );
+  }
+
+  const antiSpam = validateAntiSpamFields(payload);
+  if (!antiSpam.ok) {
+    return jsonResponse(request, { error: antiSpam.error }, antiSpam.status);
+  }
+
+  const message = sanitizeValue(payload.message, 5000);
+  const name = sanitizeValue(payload.name, 120);
+  const email = sanitizeValue(payload.email, 240);
+
+  if (!name) {
+    return jsonResponse(request,
+      { error: "Please include your name so we know who sent this." },
+      400,
+    );
+  }
+
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return jsonResponse(request,
+      { error: "Please include a valid email so we can follow up." },
+      400,
+    );
+  }
+
+  if (!message) {
+    return jsonResponse(request,
+      { error: "Please include a short message before sending feedback." },
+      400,
+    );
+  }
+
+  const context = sanitizeContext(payload.context);
+  const diagnosticsSummary = formatDiagnosticsSummary(context);
+  const submittedAt = new Date().toISOString();
+
+  if (process.env.NODE_ENV === "development") {
+    console.log("[DEV] Skipping Loops app feedback email", {
+      internalEmail,
+      transactionalId,
+      message,
+      name,
+      email,
+      context,
+    });
+    return jsonResponse(request, { ok: true });
+  }
+
+  const response = await fetch(LOOPS_TRANSACTIONAL_API_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      transactionalId,
+      email: internalEmail,
+      dataVariables: {
+        name,
+        email,
+        message,
+        source: context.source || "openwork-app",
+        entrypoint: context.entrypoint || "unknown",
+        deployment: context.deployment || "desktop",
+        appVersion: context.appVersion || "unknown",
+        openworkServerVersion: context.openworkServerVersion || "unknown",
+        opencodeVersion: context.opencodeVersion || "unknown",
+        orchestratorVersion: context.orchestratorVersion || "unknown",
+        opencodeRouterVersion: context.opencodeRouterVersion || "unknown",
+        osName: context.osName || "unknown",
+        osVersion: context.osVersion || "",
+        platform: context.platform || "unknown",
+        diagnosticsSummary,
+        submittedAt,
+      },
+    }),
+    cache: "no-store",
+  });
+
+  if (!response.ok) {
+    let detail = "Failed to send feedback email.";
+
+    try {
+      const errorBody = await response.text();
+      if (errorBody.trim()) {
+        detail = errorBody.slice(0, 600);
+      }
+    } catch {
+      // Ignore invalid upstream error bodies.
+    }
+
+    return jsonResponse(request, { error: detail }, 502);
+  }
+
+  return jsonResponse(request, { ok: true });
+}
diff --git a/ee/apps/landing/app/api/enterprise-contact/route.ts b/ee/apps/landing/app/api/enterprise-contact/route.ts
new file mode 100644
index 0000000000..d09e531015
--- /dev/null
+++ b/ee/apps/landing/app/api/enterprise-contact/route.ts
@@ -0,0 +1,218 @@
+import { buildResponseHeaders, jsonResponse, rateLimitFormRequest, validateAntiSpamFields, validateTrustedOrigin, verifyFormBotProtection } from "../_lib/security";
+
+type ContactPayload = {
+  fullName?: string;
+  companyEmail?: string;
+  message?: string;
+  website?: string;
+  startedAt?: number | string;
+};
+
+const LOOPS_CONTACTS_API_URL = "https://app.loops.so/api/v1/contacts/update";
+const LOOPS_EVENTS_API_URL = "https://app.loops.so/api/v1/events/send";
+const ENTERPRISE_EVENT_NAME = "enterpriseContactSubmitted";
+const ENTERPRISE_SOURCE = "OpenWork Enterprise Contact Form";
+const ENTERPRISE_GROUP = "Enterprise Leads";
+
+function splitName(fullName: string) {
+  const parts = fullName.trim().split(/\s+/).filter(Boolean);
+
+  if (parts.length === 0) {
+    return { firstName: "", lastName: "" };
+  }
+
+  return {
+    firstName: parts[0] ?? "",
+    lastName: parts.slice(1).join(" ")
+  };
+}
+
+function validatePayload(payload: ContactPayload) {
+  const fullName = payload.fullName?.trim() ?? "";
+  const companyEmail = payload.companyEmail?.trim() ?? "";
+  const message = payload.message?.trim() ?? "";
+
+  if (!fullName || !companyEmail || !message) {
+    return { error: "Please fill out all fields." };
+  }
+
+  const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!emailPattern.test(companyEmail)) {
+    return { error: "Please enter a valid work email." };
+  }
+
+  return {
+    fullName,
+    companyEmail,
+    message
+  };
+}
+
+function deriveCompanyFromEmail(email: string) {
+  const domain = email.split("@")[1]?.toLowerCase() ?? "";
+  if (!domain) {
+    return "";
+  }
+
+  const parts = domain.split(".").filter(Boolean);
+  if (parts.length === 0) {
+    return "";
+  }
+
+  const compoundSuffixes = new Set([
+    "co.uk",
+    "com.au",
+    "co.jp",
+    "com.br",
+    "co.in",
+    "com.sg",
+    "com.mx",
+    "com.tr"
+  ]);
+
+  const suffix = parts.slice(-2).join(".");
+  const baseIndex =
+    parts.length >= 3 && compoundSuffixes.has(suffix)
+      ? parts.length - 3
+      : parts.length - 2;
+  const companySlug = parts[Math.max(baseIndex, 0)] ?? "";
+
+  return companySlug
+    .split(/[-_]+/)
+    .filter(Boolean)
+    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+    .join(" ");
+}
+
+export async function POST(request: Request) {
+  const originCheck = validateTrustedOrigin(request);
+  if (!originCheck.ok) {
+    return jsonResponse(request, { error: originCheck.error }, originCheck.status);
+  }
+
+  const rateLimit = rateLimitFormRequest(request, "enterprise-contact");
+  if (!rateLimit.ok) {
+    return new Response(JSON.stringify({ error: "Contact form is temporarily rate limited." }), {
+      status: 429,
+      headers: {
+        ...buildResponseHeaders(request),
+        "X-Retry-After": String(rateLimit.retryAfterSeconds),
+      },
+    });
+  }
+
+  const botProtection = await verifyFormBotProtection();
+  if (!botProtection.ok) {
+    return jsonResponse(request, { error: botProtection.error }, botProtection.status);
+  }
+
+  const apiKey = process.env.LOOPS_API_KEY?.trim();
+  if (!apiKey) {
+    return jsonResponse(request,
+      { error: "Loops is not configured on this deployment." },
+      500
+    );
+  }
+
+  let payload: ContactPayload;
+  try {
+    const raw = await request.text();
+    if (raw.length > 6000) {
+      return jsonResponse(request, { error: "Request payload is too large." }, 413);
+    }
+    payload = JSON.parse(raw) as ContactPayload;
+  } catch {
+    return jsonResponse(request,
+      { error: "Invalid request payload." },
+      400
+    );
+  }
+
+  const antiSpam = validateAntiSpamFields(payload);
+  if (!antiSpam.ok) {
+    return jsonResponse(request, { error: antiSpam.error }, antiSpam.status);
+  }
+
+  const validated = validatePayload(payload);
+  if ("error" in validated) {
+    return jsonResponse(request, { error: validated.error }, 400);
+  }
+
+  const { firstName, lastName } = splitName(validated.fullName);
+  const company = deriveCompanyFromEmail(validated.companyEmail);
+  const submittedAt = new Date().toISOString();
+
+  const contactResponse = await fetch(LOOPS_CONTACTS_API_URL, {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      email: validated.companyEmail,
+      firstName,
+      lastName: lastName || undefined,
+      company: company || undefined,
+      notes: validated.message,
+      source: ENTERPRISE_SOURCE,
+      userGroup: ENTERPRISE_GROUP
+    }),
+    cache: "no-store"
+  });
+
+  if (!contactResponse.ok) {
+    let detail = "Failed to submit contact request.";
+
+    try {
+      const errorData = (await contactResponse.json()) as { message?: string };
+      if (errorData.message?.trim()) {
+        detail = errorData.message;
+      }
+    } catch {
+      // Ignore invalid error payloads from upstream and return a generic message.
+    }
+
+    return jsonResponse(request, { error: detail }, 502);
+  }
+
+  const eventResponse = await fetch(LOOPS_EVENTS_API_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      email: validated.companyEmail,
+      eventName: ENTERPRISE_EVENT_NAME,
+      firstName,
+      lastName: lastName || undefined,
+      source: ENTERPRISE_SOURCE,
+      userGroup: ENTERPRISE_GROUP,
+      eventProperties: {
+        message: validated.message,
+        fullName: validated.fullName,
+        submittedAt,
+        page: "enterprise",
+        note: validated.message
+      }
+    }),
+    cache: "no-store"
+  });
+
+  if (!eventResponse.ok) {
+    let detail = "Failed to record contact event.";
+
+    try {
+      const errorData = (await eventResponse.json()) as { message?: string };
+      if (errorData.message?.trim()) {
+        detail = errorData.message;
+      }
+    } catch {
+      // Ignore invalid error payloads from upstream and return a generic message.
+    }
+
+    return jsonResponse(request, { error: detail }, 502);
+  }
+
+  return jsonResponse(request, { ok: true });
+}
diff --git a/ee/apps/landing/app/apple-icon.png b/ee/apps/landing/app/apple-icon.png
new file mode 100644
index 0000000000..b1d86b6888
Binary files /dev/null and b/ee/apps/landing/app/apple-icon.png differ
diff --git a/ee/apps/landing/app/download/page.tsx b/ee/apps/landing/app/download/page.tsx
new file mode 100644
index 0000000000..7399e50dbc
--- /dev/null
+++ b/ee/apps/landing/app/download/page.tsx
@@ -0,0 +1,237 @@
+import { SiteFooter } from "../../components/site-footer";
+import { SiteNav } from "../../components/site-nav";
+import { StructuredData } from "../../components/structured-data";
+import { getGithubData } from "../../lib/github";
+import { baseOpenGraph } from "../../lib/seo";
+
+const downloadSchema = {
+  "@context": "https://schema.org",
+  "@type": "SoftwareApplication",
+  name: "OpenWork",
+  description:
+    "Open source Claude Cowork alternative. Desktop app for macOS, Windows, and Linux that lets teams use 50+ LLMs with their own provider keys.",
+  url: "https://openworklabs.com/download",
+  downloadUrl: "https://github.com/different-ai/openwork/releases/latest",
+  applicationCategory: "BusinessApplication",
+  operatingSystem: "macOS, Windows, Linux",
+  offers: {
+    "@type": "Offer",
+    price: "0",
+    priceCurrency: "USD"
+  },
+  publisher: {
+    "@type": "Organization",
+    name: "OpenWork",
+    url: "https://openworklabs.com"
+  }
+};
+
+export const metadata = {
+  title: "Download OpenWork — macOS, Windows, Linux",
+  description:
+    "Download OpenWork desktop for macOS, Windows, and Linux. Direct Electron build downloads are resolved from the latest GitHub release.",
+  alternates: {
+    canonical: "/download"
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com/download"
+  }
+};
+
+export default async function Download() {
+  const github = await getGithubData();
+  const releaseLabel = github.releaseTag || "latest";
+  const releaseUrl = github.releaseUrl;
+
+  return (
+    <div className="min-h-screen">
+      <StructuredData data={downloadSchema} />
+      <SiteNav
+        stars={github.stars}
+        downloadHref={github.downloads.macos}
+        active="download"
+      />
+
+      <main className="pb-24 pt-20">
+        <div className="content-max-width px-6">
+          <div className="animate-fade-up">
+            <div className="mb-3 text-[12px] font-bold uppercase tracking-wider text-gray-500">
+              OpenWork desktop
+            </div>
+            <h1 className="mb-4 text-4xl font-bold tracking-tight md:text-5xl">
+              Download OpenWork
+            </h1>
+            <p className="mb-4 max-w-3xl text-[17px] leading-relaxed text-gray-700">
+              Install OpenWork on macOS, Windows, or Linux. Pick the package that
+              matches your distro and architecture.
+            </p>
+            <p className="mb-10 text-[14px] text-gray-600">
+              Latest stable release: 
+              <a
+                href={releaseUrl}
+                target="_blank"
+                rel="noreferrer"
+                className="font-semibold text-gray-900 underline decoration-gray-300 underline-offset-4 transition hover:decoration-gray-700"
+              >
+                {releaseLabel}
+              </a>
+            </p>
+          </div>
+
+          <div className="mb-10 grid grid-cols-1 gap-4 sm:grid-cols-3">
+            <a
+              href="#macos"
+              className="feature-card border-sky-100 bg-sky-50/60 transition hover:border-sky-200"
+            >
+              <span className="mb-2 block text-[16px] font-semibold text-gray-900">macOS</span>
+              <p className="text-[14px] text-gray-700">Apple Silicon and Intel builds</p>
+            </a>
+            <a
+              href="#windows"
+              className="feature-card border-violet-100 bg-violet-50/50 transition hover:border-violet-200"
+            >
+              <span className="mb-2 block text-[16px] font-semibold text-gray-900">Windows</span>
+              <p className="text-[14px] text-gray-700">x64 NSIS installer</p>
+            </a>
+            <a
+              href="#linux"
+              className="feature-card border-emerald-100 bg-emerald-50/60 transition hover:border-emerald-200"
+            >
+              <span className="mb-2 block text-[16px] font-semibold text-gray-900">Linux</span>
+              <p className="text-[14px] text-gray-700">AppImage and tarball builds</p>
+            </a>
+          </div>
+
+          <section id="macos" className="py-6">
+            <h2 className="mb-2 text-2xl font-bold md:text-3xl">macOS</h2>
+            <p className="mb-8 text-[15px] text-gray-700">
+              Download the DMG that matches your Mac.
+            </p>
+
+            <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+              <div className="feature-card bg-white/90">
+                <h3 className="mb-2 text-[16px] font-semibold text-gray-900">Apple Silicon (M-series)</h3>
+                <p className="mb-4 text-[14px] text-gray-600">Recommended for M1, M2, M3, and M4 chips.</p>
+                <a
+                  href={github.installers.macos.appleSilicon}
+                  className="doc-button"
+                  rel="noreferrer"
+                  target="_blank"
+                >
+                  Download .dmg
+                </a>
+              </div>
+
+              <div className="feature-card bg-white/90">
+                <h3 className="mb-2 text-[16px] font-semibold text-gray-900">Intel (x64)</h3>
+                <p className="mb-4 text-[14px] text-gray-600">For Intel-based Macs.</p>
+                <a
+                  href={github.installers.macos.intel}
+                  className="doc-button"
+                  rel="noreferrer"
+                  target="_blank"
+                >
+                  Download .dmg
+                </a>
+              </div>
+            </div>
+          </section>
+
+          <hr />
+
+          <section id="windows" className="py-6">
+            <h2 className="mb-2 text-2xl font-bold md:text-3xl">Windows</h2>
+            <p className="mb-6 text-[15px] text-gray-700">
+              OpenWork for Windows is available as an x64 Electron installer.
+            </p>
+            <a
+              href={github.installers.windows.x64}
+              className="doc-button"
+              rel="noreferrer"
+              target="_blank"
+            >
+              Download Windows x64 (.exe)
+            </a>
+          </section>
+
+          <hr />
+
+          <section id="linux" className="py-6">
+            <h2 className="mb-2 text-2xl font-bold md:text-3xl">Linux</h2>
+            <p className="mb-8 text-[15px] text-gray-700">
+              Download Electron builds directly for x64 and arm64 Linux systems.
+            </p>
+
+            <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+              <div className="feature-card border-amber-100 bg-white/90 ring-1 ring-amber-100/60">
+                <h3 className="mb-2 text-[16px] font-semibold text-gray-900">AppImage</h3>
+                <p className="mb-4 text-[14px] text-gray-600">
+                  Portable desktop builds for most Linux distributions.
+                </p>
+                <div className="flex flex-wrap gap-3">
+                  <a
+                    href={github.installers.linux.appImageX64}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="doc-button"
+                  >
+                    x64 AppImage
+                  </a>
+                  <a
+                    href={github.installers.linux.appImageArm64}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="doc-button"
+                  >
+                    arm64 AppImage
+                  </a>
+                </div>
+              </div>
+
+              <div className="feature-card border-sky-100 bg-white/90 ring-1 ring-sky-100/60">
+                <h3 className="mb-2 text-[16px] font-semibold text-gray-900">Tarball</h3>
+                <p className="mb-4 text-[14px] text-gray-600">
+                  Compressed Electron builds for manual installation.
+                </p>
+                <div className="flex flex-wrap gap-3">
+                  <a
+                    href={github.installers.linux.tarX64}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="doc-button"
+                  >
+                    x64 .tar.gz
+                  </a>
+                  <a
+                    href={github.installers.linux.tarArm64}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="doc-button"
+                  >
+                    arm64 .tar.gz
+                  </a>
+                </div>
+              </div>
+            </div>
+
+            <p className="mt-8 text-[14px] text-gray-600">
+              Need another format? 
+              <a
+                href={releaseUrl}
+                target="_blank"
+                rel="noreferrer"
+                className="font-semibold text-gray-900 underline decoration-gray-300 underline-offset-4 transition hover:decoration-gray-700"
+              >
+                Browse all release assets
+              </a>
+              .
+            </p>
+          </section>
+
+          <SiteFooter />
+        </div>
+      </main>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/app/enterprise/page.tsx b/ee/apps/landing/app/enterprise/page.tsx
new file mode 100644
index 0000000000..8b5133ba05
--- /dev/null
+++ b/ee/apps/landing/app/enterprise/page.tsx
@@ -0,0 +1,29 @@
+import { LandingEnterprise } from "../../components/landing-enterprise";
+import { getGithubData } from "../../lib/github";
+import { baseOpenGraph } from "../../lib/seo";
+
+export const metadata = {
+  title: "OpenWork Enterprise — Self-hosted AI agents for teams",
+  description:
+    "Deploy shared skills, MCPs, and agent workflows across your org. Self-hosted or managed, 50+ LLM providers, HIPAA / SOC 2 / ISO 27001 / GDPR ready.",
+  alternates: {
+    canonical: "/enterprise"
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com/enterprise"
+  }
+};
+
+export default async function Enterprise() {
+  const github = await getGithubData();
+  const cal = process.env.NEXT_PUBLIC_CAL_URL ?? "";
+
+  return (
+    <LandingEnterprise
+      stars={github.stars}
+      downloadHref={github.downloads.macos}
+      calUrl={cal}
+    />
+  );
+}
diff --git a/ee/apps/landing/app/favicon.ico b/ee/apps/landing/app/favicon.ico
new file mode 100644
index 0000000000..c59a048ff6
Binary files /dev/null and b/ee/apps/landing/app/favicon.ico differ
diff --git a/ee/apps/landing/app/feedback/page.tsx b/ee/apps/landing/app/feedback/page.tsx
new file mode 100644
index 0000000000..76b006c7fc
--- /dev/null
+++ b/ee/apps/landing/app/feedback/page.tsx
@@ -0,0 +1,74 @@
+import Link from "next/link";
+import { AppFeedbackForm, type AppFeedbackPrefill } from "../../components/app-feedback-form";
+import { OpenWorkMark } from "../../components/openwork-mark";
+import { SiteFooter } from "../../components/site-footer";
+import { baseOpenGraph } from "../../lib/seo";
+
+export const metadata = {
+  title: "OpenWork — Feedback",
+  description: "Send app feedback to the OpenWork team with prefilled runtime context.",
+  alternates: {
+    canonical: "/feedback"
+  },
+  robots: {
+    index: false,
+    follow: true
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com/feedback"
+  }
+};
+
+type PageProps = {
+  searchParams?: Record<string, string | string[] | undefined>;
+};
+
+function readSearchParam(
+  searchParams: PageProps["searchParams"],
+  key: string,
+): string {
+  const raw = searchParams?.[key];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  return typeof value === "string" ? value.trim().slice(0, 240) : "";
+}
+
+export default function FeedbackPage({ searchParams }: PageProps) {
+  const prefill: AppFeedbackPrefill = {
+    source: readSearchParam(searchParams, "source") || "openwork-app",
+    entrypoint: readSearchParam(searchParams, "entrypoint") || "unknown",
+    deployment: readSearchParam(searchParams, "deployment") || "desktop",
+    appVersion: readSearchParam(searchParams, "appVersion"),
+    openworkServerVersion: readSearchParam(searchParams, "openworkServerVersion"),
+    opencodeVersion: readSearchParam(searchParams, "opencodeVersion"),
+    orchestratorVersion: readSearchParam(searchParams, "orchestratorVersion"),
+    opencodeRouterVersion: readSearchParam(searchParams, "opencodeRouterVersion"),
+    osName: readSearchParam(searchParams, "osName"),
+    osVersion: readSearchParam(searchParams, "osVersion"),
+    platform: readSearchParam(searchParams, "platform"),
+  };
+
+  return (
+    <div className="min-h-screen bg-[radial-gradient(circle_at_top,_rgba(72,187,255,0.14),_transparent_34%),linear-gradient(180deg,_#f7fbff_0%,_#edf4fb_100%)]">
+      <div className="mx-auto max-w-5xl px-6 pb-20 pt-6 md:px-8 md:pt-8">
+        <header className="mb-10 flex items-center justify-between gap-4">
+          <Link href="/" className="inline-flex items-center gap-3 text-[#011627]">
+            <OpenWorkMark className="h-[30px] w-[38px]" />
+            <span className="text-[1.2rem] font-semibold tracking-tight lowercase">
+              OpenWork
+            </span>
+          </Link>
+          <Link
+            href="/download"
+            className="rounded-full border border-white/80 bg-white/80 px-4 py-2 text-[13px] font-medium text-slate-700 shadow-sm transition hover:bg-white"
+          >
+            Download latest app
+          </Link>
+        </header>
+
+        <AppFeedbackForm prefill={prefill} />
+        <SiteFooter />
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/app/globals.css b/ee/apps/landing/app/globals.css
new file mode 100644
index 0000000000..9d63ae61c2
--- /dev/null
+++ b/ee/apps/landing/app/globals.css
@@ -0,0 +1,400 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@font-face {
+  font-family: "FK Raster Roman Compact Smooth";
+  src: local("FK Raster Roman Compact Smooth"),
+    local("FKRasterRomanCompact-Smooth"),
+    url("/fonts/FKRasterRomanCompact-Smooth.woff2") format("woff2");
+  font-weight: 400;
+  font-style: normal;
+  font-display: swap;
+}
+
+:root {
+  color-scheme: light;
+}
+
+html {
+  scroll-behavior: smooth;
+}
+
+body {
+  min-height: 100vh;
+  font-family: var(--font-sans), ui-sans-serif, system-ui, -apple-system,
+    BlinkMacSystemFont, "Segoe UI", sans-serif;
+  background-color: #f6f9fc;
+  color: #011627;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+.mono {
+  font-family: var(--font-mono), ui-monospace, SFMono-Regular, SFMono-Regular,
+    Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+.font-pixel,
+.pixel-text {
+  font-family: "FK Raster Roman Compact Smooth", sans-serif !important;
+  font-weight: 400;
+  -webkit-font-smoothing: auto;
+  text-rendering: optimizeSpeed;
+}
+
+/* Legal page prose — styles MDX-rendered markdown for privacy/terms pages */
+.legal-prose h1 {
+  font-size: 2.25rem;
+  font-weight: 500;
+  line-height: 1.05;
+  letter-spacing: -0.025em;
+  margin-bottom: 1rem;
+}
+@media (min-width: 768px) {
+  .legal-prose h1 { font-size: 3rem; }
+}
+@media (min-width: 1024px) {
+  .legal-prose h1 { font-size: 3.75rem; }
+}
+.legal-prose h1 + p:first-of-type {
+  color: #6b7280;
+  margin-bottom: 3rem;
+}
+.legal-prose h2 {
+  font-size: 1.25rem;
+  font-weight: 600;
+  letter-spacing: -0.025em;
+  color: #011627;
+  margin-top: 2.5rem;
+  margin-bottom: 0.75rem;
+}
+.legal-prose h3 {
+  font-size: 1rem;
+  font-weight: 600;
+  color: #011627;
+  margin-top: 1.5rem;
+  margin-bottom: 0.5rem;
+}
+.legal-prose p {
+  font-size: 15px;
+  line-height: 1.7;
+  color: #374151;
+  margin-bottom: 1rem;
+}
+.legal-prose ul,
+.legal-prose ol {
+  font-size: 15px;
+  line-height: 1.7;
+  color: #374151;
+  padding-left: 1.25rem;
+  margin-bottom: 1rem;
+  list-style-type: disc;
+}
+.legal-prose ol { list-style-type: decimal; }
+.legal-prose li { margin-bottom: 0.375rem; }
+.legal-prose li strong { color: #011627; }
+.legal-prose a {
+  color: #011627;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.legal-prose a:hover { opacity: 0.7; }
+.legal-prose blockquote {
+  border-left: 3px solid #cbd5e1;
+  padding-left: 1rem;
+  margin: 1rem 0;
+  color: #4b5563;
+  font-size: 15px;
+  line-height: 1.7;
+}
+.legal-prose strong { font-weight: 600; }
+.legal-prose hr {
+  border: 0;
+  border-top: 1px solid rgba(148, 163, 184, 0.2);
+  margin: 2.5rem 0;
+}
+
+.content-max-width {
+  max-width: 64rem; /* matches Tailwind max-w-5xl used by the nav */
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.landing-shell {
+  background: rgba(255, 255, 255, 0.8);
+  border: 1px solid rgba(255, 255, 255, 0.8);
+  box-shadow: 0 20px 60px -15px rgba(0, 0, 0, 0.1);
+}
+
+.landing-shell-soft {
+  background: rgba(255, 255, 255, 0.95);
+  border: 1px solid rgba(255, 255, 255, 0.6);
+}
+
+.landing-chip {
+  background: rgba(255, 255, 255, 0.8);
+  border: 1px solid rgba(229, 231, 235, 1);
+  box-shadow: 0 10px 24px -20px rgba(15, 23, 42, 0.18);
+}
+
+.landing-canvas {
+  background: #ece8de;
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.55);
+}
+
+.doc-button {
+  background-color: #011627;
+  color: #ffffff;
+  min-height: 48px;
+  padding: 0.75rem 1.5rem;
+  border-radius: 9999px;
+  font-size: 16px;
+  font-weight: 400;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  box-shadow: 0 14px 32px -16px rgba(1, 22, 39, 0.55);
+  transition:
+    color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    background-color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    border-color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    box-shadow 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    transform 0.3s cubic-bezier(0.31, 0.325, 0, 0.92);
+  will-change: transform, background-color, box-shadow;
+}
+
+.doc-button:hover {
+  background-color: rgb(110, 110, 110);
+  transform: translateY(-1px);
+  box-shadow:
+    rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+    rgba(0, 0, 0, 0.04) 0px 1px 2px 0px,
+    rgba(0, 0, 0, 0.04) 0px 2px 4px 0px;
+}
+
+.secondary-button {
+  min-height: 48px;
+  padding-left: 20px;
+  padding-right: 20px;
+  border-radius: 9999px;
+  background-color: rgb(255, 255, 255);
+  color: rgb(0, 0, 0);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  white-space: nowrap;
+  border: 0;
+  box-shadow:
+    rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+    rgba(0, 0, 0, 0.04) 0px 1px 2px 0px;
+  transition:
+    color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    background-color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    border-color 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    box-shadow 0.3s cubic-bezier(0.31, 0.325, 0, 0.92),
+    transform 0.3s cubic-bezier(0.31, 0.325, 0, 0.92);
+}
+
+.secondary-button:hover {
+  background-color: rgb(242, 242, 242);
+  color: rgb(0, 0, 0);
+  box-shadow:
+    rgba(0, 0, 0, 0.06) 0px 0px 0px 1px,
+    rgba(0, 0, 0, 0.04) 0px 1px 2px 0px,
+    rgba(0, 0, 0, 0.04) 0px 2px 4px 0px;
+}
+
+.step-circle {
+  width: 24px;
+  height: 24px;
+  background: rgba(255, 255, 255, 0.8);
+  border: 1px solid rgba(148, 163, 184, 0.2);
+  border-radius: 999px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 12px;
+  font-weight: 600;
+  color: #64748b;
+}
+
+hr {
+  border: 0;
+  border-top: 1px solid rgba(148, 163, 184, 0.2);
+  margin: 40px 0;
+}
+
+.feature-card {
+  border: 1px solid rgba(148, 163, 184, 0.16);
+  padding: 24px;
+  border-radius: 2rem;
+  transition: border-color 0.2s ease, transform 0.2s ease, box-shadow 0.2s ease;
+  background: rgba(255, 255, 255, 0.8);
+  box-shadow: 0 20px 60px -24px rgba(15, 23, 42, 0.18);
+}
+
+.feature-card:hover {
+  border-color: rgba(203, 213, 225, 0.9);
+  transform: translateY(-2px);
+  box-shadow: 0 24px 60px -24px rgba(15, 23, 42, 0.2);
+}
+
+.alpha-tag {
+  background: #fffbeb;
+  color: #92400e;
+  border: 1px solid #fef3c7;
+  padding: 2px 6px;
+  border-radius: 4px;
+  font-size: 10px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.word-cycle {
+  display: inline-block;
+  position: relative;
+  vertical-align: top;
+  overflow: hidden;
+  height: 1.5em;
+}
+
+.word-cycle span {
+  display: block;
+  animation: cycle 4s infinite ease-in-out;
+  color: #111111;
+  font-weight: 600;
+}
+
+@keyframes cycle {
+  0%,
+  45% {
+    transform: translateY(0);
+  }
+  50%,
+  95% {
+    transform: translateY(-1.5em);
+  }
+  100% {
+    transform: translateY(0);
+  }
+}
+
+.animate-fade-up {
+  animation: fade-up 600ms ease both;
+}
+
+.den-carbon-window {
+  background:
+    radial-gradient(circle at top left, rgba(255, 255, 255, 0.95), transparent 34%),
+    radial-gradient(circle at bottom right, rgba(226, 232, 240, 0.8), transparent 38%),
+    linear-gradient(180deg, rgba(255, 255, 255, 0.98) 0%, rgba(248, 250, 252, 0.96) 100%);
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  box-shadow:
+    0 24px 60px -32px rgba(15, 23, 42, 0.22),
+    inset 0 1px 0 rgba(255, 255, 255, 0.72);
+  backdrop-filter: blur(22px);
+}
+
+.den-carbon-titlebar {
+  background: rgba(255, 255, 255, 0.94);
+  border-bottom: 1px solid rgba(148, 163, 184, 0.12);
+}
+
+.den-source-pill {
+  display: inline-flex;
+  align-items: center;
+  border-radius: 9999px;
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  background: rgba(248, 250, 252, 0.92);
+  color: #64748b;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  padding: 0.2rem 0.55rem;
+  text-transform: uppercase;
+}
+
+.den-running-dot {
+  animation: den-pulse 1.8s ease-out infinite;
+  box-shadow: 0 0 0 rgba(34, 197, 94, 0.38);
+}
+
+@keyframes den-pulse {
+  0% {
+    opacity: 0.7;
+    transform: scale(0.92);
+    box-shadow: 0 0 0 0 rgba(34, 197, 94, 0.34);
+  }
+  55% {
+    opacity: 1;
+    transform: scale(1.08);
+    box-shadow: 0 0 0 10px rgba(34, 197, 94, 0);
+  }
+  100% {
+    opacity: 0.75;
+    transform: scale(0.94);
+    box-shadow: 0 0 0 0 rgba(34, 197, 94, 0);
+  }
+}
+
+@keyframes ow-blob-pulse {
+  0%, 100% { transform: scale(1); opacity: 0.5; }
+  50% { transform: scale(1.4); opacity: 0.8; }
+}
+
+.ow-status-pill {
+  border-radius: 999px;
+  padding: 4px 10px;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  transition: all 0.3s cubic-bezier(0.31, 0.325, 0, 0.92);
+}
+
+.ow-task-chip {
+  position: absolute;
+  top: 50%;
+  transform: translate(-50%, -50%);
+  background: rgba(255, 255, 255, 0.94);
+  border: 1px solid #cbd5e1;
+  border-radius: 999px;
+  padding: 6px 10px;
+  font-size: 10px;
+  font-family: var(--font-mono);
+  font-weight: 600;
+  color: #334155;
+  box-shadow: 0 12px 28px -24px rgba(15, 23, 42, 0.22);
+  z-index: 10;
+  white-space: nowrap;
+}
+
+@keyframes fade-up {
+  from {
+    opacity: 0;
+    transform: translateY(8px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .word-cycle span,
+  .animate-fade-up,
+  .den-running-dot,
+  .doc-button,
+  .secondary-button,
+  .feature-card {
+    animation: none;
+    transition: none;
+  }
+  html {
+    scroll-behavior: auto;
+  }
+}
diff --git a/ee/apps/landing/app/icon.png b/ee/apps/landing/app/icon.png
new file mode 100644
index 0000000000..2780d9009a
Binary files /dev/null and b/ee/apps/landing/app/icon.png differ
diff --git a/ee/apps/landing/app/layout.tsx b/ee/apps/landing/app/layout.tsx
new file mode 100644
index 0000000000..42cfbc3045
--- /dev/null
+++ b/ee/apps/landing/app/layout.tsx
@@ -0,0 +1,88 @@
+import "./globals.css";
+import { Inter, JetBrains_Mono } from "next/font/google";
+import Script from "next/script";
+import { BotIdClient } from "botid/client";
+import { WebMcpProvider } from "../components/webmcp-provider";
+import { StructuredData } from "../components/structured-data";
+
+const organizationSchema = {
+  "@context": "https://schema.org",
+  "@type": "Organization",
+  name: "OpenWork",
+  legalName: "Different AI",
+  url: "https://openworklabs.com",
+  logo: "https://openworklabs.com/openwork-mark.svg",
+  sameAs: ["https://github.com/different-ai/openwork"]
+};
+
+const inter = Inter({
+  subsets: ["latin"],
+  variable: "--font-sans",
+  display: "swap"
+});
+
+const jetbrains = JetBrains_Mono({
+  subsets: ["latin"],
+  variable: "--font-mono",
+  display: "swap"
+});
+
+export const metadata = {
+  metadataBase: new URL("https://openworklabs.com"),
+  title: "OpenWork — Open source Claude Cowork alternative for teams",
+  description:
+    "Bring your own model and provider, wire in your tools and context, and ship reusable agent setups across your org — with guardrails built in.",
+  alternates: {
+    canonical: "/"
+  },
+  robots: {
+    index: true,
+    follow: true
+  },
+  openGraph: {
+    type: "website",
+    siteName: "OpenWork",
+    locale: "en_US",
+    images: ["/og-image-clean.png"]
+  },
+  twitter: {
+    card: "summary_large_image",
+    images: ["/og-image-clean.png"]
+  }
+};
+
+const protectedRoutes = [
+  { path: "/api/enterprise-contact", method: "POST" as const },
+  { path: "/api/app-feedback", method: "POST" as const },
+];
+
+export default function RootLayout({
+  children
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en" className={`${inter.variable} ${jetbrains.variable}`}>
+      <head>
+        <StructuredData data={organizationSchema} />
+        <BotIdClient protect={protectedRoutes} />
+        <Script
+          id="posthog"
+          strategy="beforeInteractive"
+          dangerouslySetInnerHTML={{
+            __html: `!function(t,e){var o,n,p,r;e.__SV||(window.posthog && window.posthog.__loaded)||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init rs ls wi ns us ts ss capture calculateEventProperties vs register register_once register_for_session unregister unregister_for_session gs getFeatureFlag getFeatureFlagPayload getFeatureFlagResult isFeatureEnabled reloadFeatureFlags updateFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSurveysLoaded onSessionId getSurveys getActiveMatchingSurveys renderSurvey displaySurvey cancelPendingSurvey canRenderSurvey canRenderSurveyAsync identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException startExceptionAutocapture stopExceptionAutocapture loadToolbar get_property getSessionProperty fs ds createPersonProfile setInternalOrTestUser ps Qr opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing get_explicit_consent_status is_capturing clear_opt_in_out_capturing hs debug M cs getPageViewId captureTraceFeedback captureTraceMetric Kr".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);
+    posthog.init('phc_4YnPTlDVYPjgwKvLuNxhbHjV5kadgvd7XLzVHWnCXAI', {
+        api_host: 'https://us.i.posthog.com',
+        defaults: '2025-11-30',
+        person_profiles: 'identified_only',
+    })`
+          }}
+        />
+      </head>
+      <body className="overflow-x-hidden antialiased">
+        <WebMcpProvider />
+        {children}
+      </body>
+    </html>
+  );
+}
diff --git a/ee/apps/landing/app/manifest.ts b/ee/apps/landing/app/manifest.ts
new file mode 100644
index 0000000000..d46ab709b6
--- /dev/null
+++ b/ee/apps/landing/app/manifest.ts
@@ -0,0 +1,33 @@
+import type { MetadataRoute } from "next";
+
+export default function manifest(): MetadataRoute.Manifest {
+  return {
+    name: "OpenWork",
+    short_name: "OpenWork",
+    description:
+      "Open source Claude Cowork alternative. Bring your own model, wire in your tools, and ship reusable agent setups across your org.",
+    start_url: "/",
+    display: "standalone",
+    background_color: "#ffffff",
+    theme_color: "#011627",
+    icons: [
+      {
+        src: "/icon.png",
+        type: "image/png",
+        sizes: "192x192",
+        purpose: "any"
+      },
+      {
+        src: "/apple-icon.png",
+        type: "image/png",
+        sizes: "180x180",
+        purpose: "any"
+      },
+      {
+        src: "/openwork-mark.svg",
+        type: "image/svg+xml",
+        sizes: "any"
+      }
+    ]
+  };
+}
diff --git a/ee/apps/landing/app/og/page.tsx b/ee/apps/landing/app/og/page.tsx
new file mode 100644
index 0000000000..d5fa61a275
--- /dev/null
+++ b/ee/apps/landing/app/og/page.tsx
@@ -0,0 +1,9 @@
+import OGImage from "../../components/og-image";
+
+export default function OGPage() {
+  return (
+    <main className="flex min-h-screen items-center justify-center bg-[#f6f9fc] p-6">
+      <OGImage />
+    </main>
+  );
+}
diff --git a/ee/apps/landing/app/page.tsx b/ee/apps/landing/app/page.tsx
new file mode 100644
index 0000000000..755fca2beb
--- /dev/null
+++ b/ee/apps/landing/app/page.tsx
@@ -0,0 +1,56 @@
+import { LandingHome } from "../components/landing-home";
+import { getGithubData } from "../lib/github";
+import { headers } from "next/headers";
+import { StructuredData } from "../components/structured-data";
+import { baseOpenGraph } from "../lib/seo";
+
+export const metadata = {
+  alternates: {
+    canonical: "/"
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com"
+  }
+};
+
+const softwareApplicationSchema = {
+  "@context": "https://schema.org",
+  "@type": "SoftwareApplication",
+  name: "OpenWork",
+  description:
+    "Open source Claude Cowork alternative. Desktop app that lets teams use 50+ LLMs, bring their own provider keys, and ship reusable agent setups with guardrails.",
+  url: "https://openworklabs.com",
+  applicationCategory: "BusinessApplication",
+  operatingSystem: "macOS, Windows, Linux",
+  offers: {
+    "@type": "Offer",
+    price: "0",
+    priceCurrency: "USD",
+    url: "https://openworklabs.com/pricing"
+  },
+  publisher: {
+    "@type": "Organization",
+    name: "OpenWork",
+    url: "https://openworklabs.com"
+  }
+};
+
+export default async function Home() {
+  const github = await getGithubData();
+  const cal = process.env.NEXT_PUBLIC_CAL_URL || "/enterprise#book";
+  const userAgent = headers().get("user-agent")?.toLowerCase() || "";
+  const isMobileVisitor = /android|iphone|ipad|ipod|mobile/.test(userAgent);
+
+  return (
+    <>
+      <StructuredData data={softwareApplicationSchema} />
+      <LandingHome
+        stars={github.stars}
+        downloadHref={github.downloads.macos}
+        callHref={cal}
+        isMobileVisitor={isMobileVisitor}
+      />
+    </>
+  );
+}
diff --git a/ee/apps/landing/app/pricing/page.tsx b/ee/apps/landing/app/pricing/page.tsx
new file mode 100644
index 0000000000..512658d9d6
--- /dev/null
+++ b/ee/apps/landing/app/pricing/page.tsx
@@ -0,0 +1,100 @@
+import { LandingBackground } from "../../components/landing-background";
+import { PricingGrid } from "../../components/pricing-grid";
+import { SiteFooter } from "../../components/site-footer";
+import { SiteNav } from "../../components/site-nav";
+import { StructuredData } from "../../components/structured-data";
+import { getGithubData } from "../../lib/github";
+import { baseOpenGraph } from "../../lib/seo";
+
+const pricingSchema = {
+  "@context": "https://schema.org",
+  "@type": "Product",
+  name: "OpenWork",
+  description:
+    "OpenWork is an open source Claude Cowork alternative — a desktop app for teams to use 50+ LLMs, bring their own keys, and share reusable agent setups with guardrails.",
+  brand: { "@type": "Brand", name: "OpenWork" },
+  offers: [
+    {
+      "@type": "Offer",
+      name: "Solo",
+      price: "0",
+      priceCurrency: "USD",
+      url: "https://openworklabs.com/download",
+      availability: "https://schema.org/InStock",
+      description: "Free forever. Open source desktop app with bring-your-own-keys."
+    },
+    {
+      "@type": "Offer",
+      name: "Team Starter",
+      price: "50",
+      priceCurrency: "USD",
+      url: "https://app.openworklabs.com/checkout",
+      availability: "https://schema.org/InStock",
+      priceSpecification: {
+        "@type": "UnitPriceSpecification",
+        price: "50",
+        priceCurrency: "USD",
+        unitText: "MONTH"
+      },
+      description: "5 seats, API access, Skill Hub Manager, distributed keys."
+    },
+    {
+      "@type": "Offer",
+      name: "Enterprise",
+      url: "https://openworklabs.com/enterprise",
+      description:
+        "Custom pricing. Enterprise rollout support, deployment guidance, and custom commercial terms."
+    }
+  ]
+};
+
+export const metadata = {
+  title: "OpenWork Pricing — Free desktop, $50/mo cloud, enterprise",
+  description:
+    "OpenWork is free forever for solo use with bring-your-own-keys. Cloud workers from $50/month per seat, plus custom enterprise licensing with self-hosted deployment.",
+  alternates: {
+    canonical: "/pricing"
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com/pricing"
+  }
+};
+
+export default async function PricingPage() {
+  const github = await getGithubData();
+  const callUrl = process.env.NEXT_PUBLIC_CAL_URL || "/enterprise#book";
+
+  return (
+    <div className="relative min-h-screen overflow-hidden text-[#011627]">
+      <StructuredData data={pricingSchema} />
+      <LandingBackground />
+
+      <div className="relative z-10 flex min-h-screen flex-col items-center pb-3 pt-1 md:pb-4 md:pt-2">
+        <div className="w-full">
+          <SiteNav
+            stars={github.stars}
+            callUrl={callUrl}
+            downloadHref={github.downloads.macos}
+            active="pricing"
+          />
+        </div>
+
+        <main className="mx-auto flex w-full max-w-6xl flex-col gap-16 px-6 pb-24 md:gap-20 md:px-8 md:pb-28">
+          <section className="max-w-4xl pt-6 md:pt-10">
+            <h1 className="mb-6 text-4xl font-medium leading-[1.05] tracking-tight md:text-5xl lg:text-6xl">
+              OpenWork pricing — free, team, and enterprise
+            </h1>
+          </section>
+
+          <PricingGrid
+            callUrl={callUrl}
+            showHeader={false}
+          />
+
+          <SiteFooter />
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/app/privacy/page.tsx b/ee/apps/landing/app/privacy/page.tsx
new file mode 100644
index 0000000000..53644c3ca1
--- /dev/null
+++ b/ee/apps/landing/app/privacy/page.tsx
@@ -0,0 +1,13 @@
+import { LegalPage } from "../../components/legal-page";
+
+export const metadata = {
+  title: "OpenWork — Privacy Policy",
+  description: "Privacy policy for Different AI, doing business as OpenWork.",
+  alternates: {
+    canonical: "/privacy"
+  }
+};
+
+export default function PrivacyPage() {
+  return <LegalPage file="privacy/privacy-policy.md" />;
+}
diff --git a/ee/apps/landing/app/privacy/privacy-policy.md b/ee/apps/landing/app/privacy/privacy-policy.md
new file mode 100644
index 0000000000..eed1bbb0a9
--- /dev/null
+++ b/ee/apps/landing/app/privacy/privacy-policy.md
@@ -0,0 +1,323 @@
+# Privacy Policy
+
+Effective date: April 4, 2026
+
+DIFFERENT AI, INC., doing business as OpenWork ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by OpenWork.
+
+This Privacy Policy applies to our website ([openworklabs.com](https://openworklabs.com) and its associated subdomains), our Desktop App, and our Cloud Service (collectively, our "Service"). By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy and our [Terms of Use](/terms).
+
+## Definitions and key terms
+
+To help explain things as clearly as possible in this Privacy Policy, every time any of these terms are referenced, are strictly defined as:
+
+- **Cookie:** small amount of data generated by a website and saved by your web browser. It is used to identify your browser, provide analytics, remember information about you such as your language preference or login information.
+- **Company:** when this policy mentions "Company," "we," "us," or "our," it refers to Different AI, (28 Geary St STE 650 Suite #188, San Francisco, California 94108, United States) that is responsible for your information under this Privacy Policy.
+- **Country:** where OpenWork or the owners/founders of OpenWork are based, in this case is United States.
+- **Customer:** refers to the company, organization or person that signs up to use the OpenWork Service to manage the relationships with your consumers or service users.
+- **Device:** any internet connected device such as a phone, tablet, computer or any other device that can be used to visit OpenWork and use the services.
+- **IP address:** Every device connected to the Internet is assigned a number known as an Internet protocol (IP) address. These numbers are usually assigned in geographic blocks. An IP address can often be used to identify the location from which a device is connecting to the Internet.
+- **Personnel:** refers to those individuals who are employed by OpenWork or are under contract to perform a service on behalf of one of the parties.
+- **Personal Data:** any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.
+- **Service:** refers to the service provided by OpenWork as described in the relative terms (if available) and on this platform.
+- **Third-party service:** refers to service providers, partners, and others who provide content, functionality, or services in connection with our Service, including analytics providers, payment processors, and authentication providers.
+- **Website:** OpenWork's marketing website, which can be accessed via this URL: [openworklabs.com](https://openworklabs.com).
+- **Desktop App:** the OpenWork desktop application, distributed for macOS, Windows, and Linux.
+- **Cloud Service:** the OpenWork cloud-hosted web application, accessible via a web browser and providing functionality similar to the Desktop App.
+- **You:** a person or entity that accesses or uses the Service.
+
+## What Information Do We Collect?
+
+The information we collect depends on which part of our Service you use. We distinguish between our Website, our Desktop App, and our Cloud Service.
+
+### Website
+
+When you visit our Website, we collect anonymous usage data (such as pages visited, interactions, and general navigation patterns) through PostHog, a third-party analytics platform. When you subscribe to our newsletter, we collect your email address. When you create an account or subscribe to a paid plan, we may collect:
+
+- Name / Username
+- Email address
+- Payment information (credit or debit card numbers), processed and stored by our third-party payment processor
+- Account authentication data received from third-party providers (Google or GitHub) if you choose to sign in using social login
+
+### Desktop App
+
+The Desktop App does not collect, track, or transmit any data during normal use. The only instance in which information is gathered is when you explicitly choose to report a bug. When you initiate a bug report, the following diagnostic information is attached to your submission solely to help us reproduce and resolve the issue:
+
+- Application version
+- OpenCode version
+- Operating system name and version
+- Platform identifier (e.g., MacIntel)
+- Deployment type (e.g., desktop)
+- Source and entry point within the App
+
+This diagnostic data is submitted only with your affirmative action and does not include personal information, file contents, conversation data, or usage history. It is stored temporarily and deleted once the related issue is resolved.
+
+### Cloud Service
+
+The Cloud Service does not track or profile user behavior. Like the Desktop App, the Cloud Service supports voluntary bug reporting with the same diagnostic data described above. In addition, the Cloud Service collects limited operational telemetry (such as service availability, error rates, and performance metrics) that is necessary for us to monitor and maintain the reliability and security of the service. This operational telemetry does not contain personal information or user content.
+
+## Categories of Sources of Personal Data
+
+We collect Personal Data about you from the following categories of sources:
+
+- **Directly from you:** when you create an account, subscribe to a paid plan, subscribe to our newsletter, submit a bug report, or otherwise contact us.
+- **Automatically:** when you visit our Website, through cookies and similar technologies (PostHog analytics), and through operational telemetry in the Cloud Service.
+- **Third-party authentication providers:** when you sign in using Google or GitHub, we receive profile information (name, email, profile identifier) in accordance with the permissions you grant.
+- **Third-party payment processors:** when you subscribe to a paid plan, we receive transaction confirmation data from Polar.
+
+## How Do We Use The Information We Collect?
+
+Any of the information we collect from you may be used in one of the following ways:
+
+- To provide, operate, and maintain the Service
+- To process transactions and manage your subscription
+- To improve our Website based on anonymous analytics data
+- To diagnose and resolve software defects using bug report diagnostic data
+- To monitor and ensure the reliability, security, and performance of our Cloud Service
+- To send newsletter communications to subscribers who have opted in
+- To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs)
+- To comply with legal obligations
+
+## Legal Bases for Processing Your Data
+
+We process personal data only where a valid legal ground applies under each applicable privacy regime:
+
+- **Performance of a Contract:** We process your data to provide, maintain, and support the Service you have requested under our Terms of Use, including account creation, subscription management, and customer support.
+- **Legitimate Interests:** We use personal data to secure the platform, detect fraud, monitor Cloud Service reliability through operational telemetry, and improve our Website based on anonymous analytics, where these interests are not outweighed by your privacy rights.
+- **Consent:** We rely on your consent for newsletter subscriptions, non-essential analytics cookies (PostHog), and customer audience targeting on advertising platforms. You may withdraw consent at any time without affecting the lawfulness of prior processing.
+- **Legal Obligations:** We retain and disclose information as necessary to comply with applicable laws, regulations, court orders, or other legal duties.
+
+## When does OpenWork use information from third parties?
+
+If you choose to authenticate using a third-party provider (Google or GitHub), we receive certain profile information from that provider, such as your name, email address, and profile identifier, in accordance with the permissions you grant during the authentication process. We use this information solely to create and manage your account. You can control what information third-party authentication providers share by reviewing your account settings with those providers.
+
+We may also receive information from third-party payment processors in connection with subscription transactions, limited to what is necessary to confirm and manage your subscription.
+
+## Do we share the information we collect with third parties?
+
+We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
+
+We engage trusted third-party service providers ("sub-processors") to perform functions and provide services to us. Our current sub-processors are:
+
+- **PostHog** (analytics): collects anonymous website usage data on our behalf.
+- **Polar Software, Inc.** (payments): processes subscription billing and credit card transactions.
+- **Google** (authentication): provides OAuth sign-in services.
+- **GitHub** (authentication): provides OAuth sign-in services.
+- **Daytona** (infrastructure): provides virtual sandbox environments for the Cloud Service.
+
+We share only the minimum information necessary to enable these providers to perform their services on our behalf and for you. Each sub-processor is contractually obligated to use your information solely for the purposes of providing services to us.
+
+> **Note:** The Desktop App and Cloud Service allow you to connect your own API keys to third-party AI model providers (such as OpenAI, Anthropic, Google, and others). These providers are not our sub-processors — you interact with them directly using your own credentials and under their own terms of service and privacy policies. We do not transmit your data to these providers on your behalf.
+
+If we are involved in a merger, acquisition, asset sale, or other business reorganization, we may share or transfer your personal and non-personal information to our successors-in-interest, provided that the receiving party agrees to honor the terms of this Privacy Policy.
+
+We may also disclose personal and non-personal information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate in order to respond to claims, legal process (including subpoenas), to protect our rights and interests or those of a third party, the safety of the public or any person, to prevent or stop any illegal, unethical, or legally actionable activity, or to otherwise comply with applicable court orders, laws, rules and regulations.
+
+## Where and when is information collected from customers and end users?
+
+OpenWork will collect personal information that you submit to us. We may also receive personal information about you from third parties as described above.
+
+## How Do We Use Your Email Address?
+
+By submitting your email address on this website or by creating an account on our platform, you agree to receive emails from us, including onboarding communications, product updates, and newsletters. By signing up for our platform, we interpret your registration as an expression of interest in receiving additional communications related to the Service. We may send emails directly or through a third-party email service provider acting on our behalf.
+
+We may, in the future, use your email address for customer audience targeting on third-party advertising platforms, where we would display custom advertising to specific people who have opted in to receive communications from us. If we do so, we will update this Privacy Policy accordingly and, where required by applicable law, obtain your consent prior to such use.
+
+You can cancel your participation in any of these email lists at any time by clicking on the opt-out link or other unsubscribe option that is included in the respective email. We only send emails to people who have authorized us to contact them, either directly, or through a third party. We do not send unsolicited commercial emails. If, however, you have provided the same email to us through another method, we may use it for any of the purposes stated in this Policy.
+
+If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email.
+
+## How Long Do We Keep Your Information?
+
+We retain personal information only as long as necessary to fulfill the purposes outlined in this policy or as required by applicable law. Specific retention periods are as follows:
+
+- **Customer account data** (name, email, authentication data): retained for the duration of your account. Upon account deletion, personal data is deleted within thirty (30) days, except where retention is required for fraud prevention, legal compliance, or legal defense.
+- **Payment information:** retained by our third-party payment processor (Polar) for the duration of your subscription and as required by applicable financial regulations.
+- **Bug report diagnostic data:** retained temporarily and deleted once the related issue is resolved.
+- **Website analytics data:** retained by PostHog in accordance with PostHog's data retention policies.
+- **Cloud Service operational telemetry:** retained only as long as necessary for monitoring and reliability purposes.
+- **Backups:** deleted data may persist in backups for up to ninety (90) days before being permanently removed.
+
+When we no longer need to use your information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or depersonalize it so that we can no longer identify you.
+
+## How Do We Protect Your Information?
+
+We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our payment gateway provider's database only to be accessible by those authorized with special access rights to such systems, and are required to keep the information confidential. If you subscribe to a paid plan, your payment information is stored by our third-party payment processor for the duration of your subscription in order to process recurring charges. We do not directly store your full credit card number on our own servers. We cannot, however, ensure or warrant the absolute security of any information you transmit to OpenWork or guarantee that your information on the Service may not be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or managerial safeguards.
+
+### Incident Response
+
+In the event of a confirmed security breach involving your personal data, we will notify affected customers within seventy-two (72) hours of confirming the breach, in accordance with applicable law. Notification will be provided via email to the address associated with your account, and will include a description of the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.
+
+## Could my information be transferred to other countries?
+
+OpenWork is incorporated in United States. Information collected via our website, through direct interactions with you, or from use of our help services may be transferred from time to time to our offices or personnel, or to third parties, located throughout the world, and may be viewed and hosted anywhere in the world, including countries that may not have laws of general applicability regulating the use and transfer of such data. To the fullest extent allowed by applicable law, by using any of the above, you voluntarily consent to the trans-border transfer and hosting of such information.
+
+## Is the information collected through the Service secure?
+
+We take precautions to protect the security of your information. We have physical, electronic, and managerial procedures to help safeguard, prevent unauthorized access, maintain data security, and correctly use your information. However, neither people nor security systems are foolproof, including encryption systems. In addition, people can commit intentional crimes, make mistakes or fail to follow policies. Therefore, while we use reasonable efforts to protect your personal information, we cannot guarantee its absolute security. If applicable law imposes any non-disclaimable duty to protect your personal information, you agree that intentional misconduct will be the standards used to measure our compliance with that duty.
+
+## Can I update or correct my information?
+
+The rights you have to request updates or corrections to the information OpenWork collects depend on your relationship with OpenWork. Personnel may update or correct their information as detailed in our internal company employment policies.
+
+Customers have the right to request the restriction of certain uses and disclosures of personally identifiable information as follows. You can contact us in order to (1) update or correct your personally identifiable information, (2) change your preferences with respect to communications and other information you receive from us, or (3) delete the personally identifiable information maintained about you on our systems (subject to the following paragraph), by cancelling your account. Such updates, corrections, changes and deletions will have no effect on other information that we maintain, or information that we have provided to third parties in accordance with this Privacy Policy prior to such update, correction, change or deletion. To protect your privacy and security, we may take reasonable steps (such as requesting a unique password) to verify your identity before granting you profile access or making corrections. You are responsible for maintaining the secrecy of your unique password and account information at all times.
+
+You should be aware that it is not technologically possible to remove each and every record of the information you have provided to us from our system. The need to back up our systems to protect information from inadvertent loss means that a copy of your information may exist in a non-erasable form that will be difficult or impossible for us to locate. Promptly after receiving your request, all personal information stored in databases we actively use, and other readily searchable media will be updated, corrected, changed or deleted, as appropriate, as soon as and to the extent reasonably and technically practicable.
+
+If you are an end user and wish to update, delete, or receive any information we have about you, you may do so by contacting the organization of which you are a customer.
+
+## Personnel
+
+If you are an OpenWork worker or applicant, we collect information you voluntarily provide to us. We use the information collected for Human Resources purposes in order to administer benefits to workers and screen applicants.
+
+You may contact us in order to (1) update or correct your information, (2) change your preferences with respect to communications and other information you receive from us, or (3) receive a record of the information we have relating to you. Such updates, corrections, changes and deletions will have no effect on other information that we maintain, or information that we have provided to third parties in accordance with this Privacy Policy prior to such update, correction, change or deletion.
+
+## Sale of Business
+
+We reserve the right to transfer information to a third party in the event of a sale, merger or other transfer of all or substantially all of the assets of OpenWork or any of its Corporate Affiliates (as defined herein), or that portion of OpenWork or any of its Corporate Affiliates to which the Service relates, or in the event that we discontinue our business or file a petition or have filed against us a petition in bankruptcy, reorganization or similar proceeding, provided that the third party agrees to adhere to the terms of this Privacy Policy.
+
+## Affiliates
+
+We may disclose information (including personal information) about you to our Corporate Affiliates. For purposes of this Privacy Policy, "Corporate Affiliate" means any person or entity which directly or indirectly controls, is controlled by or is under common control with OpenWork, whether by ownership or otherwise. Any information relating to you that we provide to our Corporate Affiliates will be treated by those Corporate Affiliates in accordance with the terms of this Privacy Policy.
+
+## Governing Law
+
+This Privacy Policy is governed by the laws of United States without regard to its conflict of laws provision. You consent to the exclusive jurisdiction of the courts in connection with any action or dispute arising between the parties under or in connection with this Privacy Policy except for those individuals who may have rights to make claims under Privacy Shield, or the Swiss-US framework.
+
+The laws of United States, excluding its conflicts of law rules, shall govern this Agreement and your use of the website/app. Your use of the website/app may also be subject to other local, state, national, or international laws.
+
+By using the Service or contacting us directly, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, you should not engage with our website, or use our services. Continued use of the website, direct engagement with us, or following the posting of changes to this Privacy Policy that do not significantly affect the use or disclosure of your personal information will mean that you accept those changes.
+
+## Your Consent
+
+We've updated our Privacy Policy to provide you with complete transparency into what is being set when you visit our site and how it's being used. By using our website/app, registering an account, or making a purchase, you hereby consent to our Privacy Policy and agree to its terms.
+
+## Links to Other Websites
+
+This Privacy Policy applies only to the Services. The Services may contain links to other websites not operated or controlled by OpenWork. We are not responsible for the content, accuracy or opinions expressed in such websites, and such websites are not investigated, monitored or checked for accuracy or completeness by us. Please remember that when you use a link to go from the Services to another website, our Privacy Policy is no longer in effect. Your browsing and interaction on any other website, including those that have a link on our platform, is subject to that website's own rules and policies. Such third parties may use their own cookies or other methods to collect information about you.
+
+## Cookies
+
+We use "Cookies" to identify the areas of our Website that you have visited. A Cookie is a small piece of data stored on your computer or mobile device by your web browser. We deploy the following categories of cookies on our Website:
+
+- **Strictly Necessary Cookies:** These cookies support core functions such as sign-in, session management, and security. They are essential for the Website to function and do not require consent.
+- **Analytics and Performance Cookies:** We use PostHog to collect anonymous usage data (pages visited, interactions, navigation patterns) to measure feature adoption, diagnose errors, and improve the Website. These cookies are non-essential.
+- **Functional Cookies:** These cookies remember your preferences (such as language or theme settings) to provide a more personalized experience.
+
+The Desktop App and Cloud Service do not use cookies for tracking or analytics purposes. We never place Personally Identifiable Information in Cookies.
+
+### Blocking and disabling cookies and similar technologies
+
+You may set your browser to block cookies and similar technologies, but this action may block essential cookies and prevent our Website from functioning properly. You should also be aware that you may lose some saved information (e.g., saved login details, site preferences) if you block cookies on your browser. Different browsers make different controls available to you. Disabling a cookie or category of cookie does not delete the cookie from your browser; you will need to do this yourself from within your browser. Please visit your browser's help menu for more information.
+
+### Do Not Track
+
+Your browser may offer a "Do Not Track" option, which allows you to signal to websites that you do not wish to be tracked. Our Services do not currently support "Do Not Track" requests sent from a browser at this time.
+
+## Payment Details
+
+In respect to any credit card or other payment processing details you have provided us, we commit that this confidential information will be stored in the most secure manner possible.
+
+## Kids' Privacy
+
+The Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect or solicit personally identifiable information from anyone under the age of eighteen (18). If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of eighteen (18) without verification of parental consent, we will promptly delete that information from our servers.
+
+## Changes To Our Privacy Policy
+
+We may change our Service and policies, and we may need to make changes to this Privacy Policy so that they accurately reflect our Service and policies. Unless otherwise required by law, we will notify you (for example, through our Service) before we make changes to this Privacy Policy and give you an opportunity to review them before they go into effect. Then, if you continue to use the Service, you will be bound by the updated Privacy Policy. If you do not want to agree to this or any updated Privacy Policy, you can delete your account.
+
+## Third-Party Services
+
+We may display, include or make available third-party content (including data, information, applications and other products services) or provide links to third-party websites or services ("Third-Party Services"). You acknowledge and agree that OpenWork shall not be responsible for any Third-Party Services, including their accuracy, completeness, timeliness, validity, copyright compliance, legality, decency, quality or any other aspect thereof. OpenWork does not assume and shall not have any liability or responsibility to you or any other person or entity for any Third-Party Services. Third-Party Services and links thereto are provided solely as a convenience to you and you access and use them entirely at your own risk and subject to such third parties' terms and conditions.
+
+## Tracking Technologies
+
+### Cookies
+
+Our Website uses cookies in connection with PostHog analytics to collect anonymous usage data and to enhance the performance and functionality of the Website. These cookies are non-essential to the use of the Website. However, without these cookies, certain functionality may become unavailable or you would be required to enter your login details every time you visit the Website as we would not be able to remember that you had logged in previously. The Desktop App and Cloud Service do not use cookies for tracking or analytics purposes.
+
+### Local Storage
+
+Local Storage sometimes known as DOM storage, provides web apps with methods and protocols for storing client-side data. Web storage supports persistent data storage, similar to cookies but with a greatly enhanced capacity and no information stored in the HTTP request header.
+
+### Sessions
+
+We use "Sessions" to identify the areas of our Website that you have visited. A Session is a small piece of data stored on your computer or mobile device by your web browser.
+
+### Operational Telemetry
+
+The Cloud Service collects limited operational telemetry (such as service availability, error rates, and performance metrics) necessary to monitor and maintain the reliability and security of the service. This telemetry does not contain personal information or user content and is not used for behavioral tracking or profiling.
+
+## Information about General Data Protection Regulation (GDPR)
+
+We may be collecting and using information from you if you are from the European Economic Area (EEA), and in this section of our Privacy Policy we are going to explain exactly how and why is this data collected, and how we maintain this data under protection from being replicated or used in the wrong way.
+
+### What is GDPR?
+
+GDPR is an EU-wide privacy and data protection law that regulates how EU residents' data is protected by companies and enhances the control the EU residents have, over their personal data.
+
+The GDPR is relevant to any globally operating company and not just the EU-based businesses and EU residents. Our customers' data is important irrespective of where they are located, which is why we have implemented GDPR controls as our baseline standard for all our operations worldwide.
+
+### What is personal data?
+
+Any data that relates to an identifiable or identified individual. GDPR covers a broad spectrum of information that could be used on its own, or in combination with other pieces of information, to identify a person. Personal data extends beyond a person's name or email address. Some examples include financial information, political opinions, genetic data, biometric data, IP addresses, physical address, sexual orientation, and ethnicity.
+
+### The Data Protection Principles include requirements such as:
+
+- Personal data collected must be processed in a fair, legal, and transparent way and should only be used in a way that a person would reasonably expect.
+- Personal data should only be collected to fulfil a specific purpose and it should only be used for that purpose. Organizations must specify why they need the personal data when they collect it.
+- Personal data should be held no longer than necessary to fulfil its purpose.
+- People covered by the GDPR have the right to access their own personal data. They can also request a copy of their data, and that their data be updated, deleted, restricted, or moved to another organization.
+
+### Why is GDPR important?
+
+GDPR adds some new requirements regarding how companies should protect individuals' personal data that they collect and process. It also raises the stakes for compliance by increasing enforcement and imposing greater fines for breach. Beyond these facts it's simply the right thing to do. At OpenWork we strongly believe that your data privacy is very important and we already have solid security and privacy practices in place that go beyond the requirements of this new regulation.
+
+### Individual Data Subject's Rights — Data Access, Portability and Deletion
+
+We are committed to helping our customers meet the data subject rights requirements of GDPR. OpenWork processes or stores all personal data in fully vetted, DPA compliant vendors. Upon account deletion, we dispose of all personal data in accordance with our Terms of Use and this Privacy Policy within thirty (30) days. Backups may retain data for up to ninety (90) days before permanent removal.
+
+You have the right to access, update, retrieve, and remove your personal data at any time. To exercise these rights, please contact us at [team@openworklabs.com](mailto:team@openworklabs.com).
+
+## United States Resident Rights
+
+This section applies to residents of states with applicable consumer privacy laws, including but not limited to California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Delaware (DPDPA), Iowa (ICDPA), Montana (MCDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJPA), Oregon (OCPA), Texas (TDPSA), Utah (UCPA), and Virginia (VCDPA). Where the specific rights afforded by these laws vary, we will apply the provision that is most protective of your Personal Data, to the extent reasonably practicable and not in conflict with applicable law in your jurisdiction.
+
+Depending on where you live, you may have some or all of the following rights, subject to applicable legal exceptions and limitations:
+
+- **Right to Know and Access.** You may submit a verifiable request for information regarding: (1) the categories of Personal Data we collect, use, or disclose; (2) the purposes for which we collect or use your Personal Data; (3) the categories of sources from which we collect Personal Data; and (4) the specific pieces of Personal Data we have collected about you. Where required by law, we will provide a copy of your Personal Data in a portable, machine-readable format.
+- **Right to Delete.** You may submit a verifiable request to delete Personal Data that we have collected about you, subject to certain exceptions permitted by law (for example, data required for legal compliance or to complete a transaction you requested).
+- **Right to Correct.** You may request that we correct inaccurate Personal Data we have collected about you.
+- **Right to Opt Out.** You may opt out of the sale or sharing of your Personal Data, the processing of your Personal Data for targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell or share your Personal Data as defined under applicable state privacy laws, and we do not process your Personal Data for targeted advertising or profiling purposes.
+- **Right to Equal Service.** We will not discriminate against you for exercising your privacy rights. We will not deny you our services, charge you different prices, or provide you a lower quality of service if you exercise your rights.
+
+We do not sell the Personal Information of our users. We do not collect or process Sensitive Personal Information as defined under applicable state privacy laws.
+
+### Exercising Your Rights
+
+To exercise any of the rights described above, you or your authorized agent must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we collected Personal Data, and (2) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. We will respond to your request within the time period required by applicable law (generally thirty (30) days, with extensions as permitted by law). We will not charge you a fee for making a request unless it is excessive, repetitive, or manifestly unfounded.
+
+### Authorized Agent
+
+If you are a resident of a state that permits it, you may authorize an agent to exercise your privacy rights on your behalf. To do so, you must provide your authorized agent with written permission, and we may request a copy of this written permission when verifying the agent's authority.
+
+### Appeal Process
+
+If we deny your privacy rights request, you may appeal our decision by emailing us at [team@openworklabs.com](mailto:team@openworklabs.com) within sixty (60) days of receiving the denial. Your appeal must include sufficient information to identify the original request and a description of the basis for your appeal. We will respond to your appeal within the time period required by applicable law. If we deny your appeal, you have the right to contact the Attorney General of your state.
+
+## No Coding Advice
+
+Our Services provide AI-assisted tools that can generate or suggest code, but they are not a substitute for professional software engineering judgment. You remain solely responsible for reviewing, testing, and validating any code or configuration produced by the Service. Reliance on AI-generated output is at your own risk. Intellectual property ownership, license terms, and usage restrictions are detailed in our [Terms of Use](/terms).
+
+## Severability
+
+If any provision of this Privacy Policy is found by a court of competent jurisdiction to be unlawful, void, or unenforceable for any reason, that provision shall be interpreted to achieve its intent as closely as possible under applicable law, or if that is not possible, shall be deemed severed from this Privacy Policy. The invalidity or unenforceability of any provision shall not affect the validity or enforceability of any other provision, and the remaining provisions shall continue in full force and effect.
+
+## Entire Agreement
+
+This Privacy Policy, together with our Terms of Use and any applicable supplemental terms, constitutes the entire agreement between you and OpenWork regarding privacy and data protection in connection with the Service. In the event of a conflict between this Privacy Policy and the Terms of Use on matters of data privacy or data protection, this Privacy Policy shall control.
+
+## Contact Us
+
+Don't hesitate to contact us if you have any questions.
+
+- Via Email: [team@openworklabs.com](mailto:team@openworklabs.com)
diff --git a/ee/apps/landing/app/sitemap.ts b/ee/apps/landing/app/sitemap.ts
new file mode 100644
index 0000000000..9256d24021
--- /dev/null
+++ b/ee/apps/landing/app/sitemap.ts
@@ -0,0 +1,24 @@
+import type { MetadataRoute } from "next";
+
+const BASE_URL = "https://openworklabs.com";
+
+const paths: { path: string; priority: number }[] = [
+  { path: "/", priority: 1 },
+  { path: "/download", priority: 0.7 },
+  { path: "/enterprise", priority: 0.7 },
+  { path: "/pricing", priority: 0.7 },
+  { path: "/trust", priority: 0.7 },
+  { path: "/docs", priority: 0.7 },
+  { path: "/privacy", priority: 0.3 },
+  { path: "/terms", priority: 0.3 },
+];
+
+export default function sitemap(): MetadataRoute.Sitemap {
+  const lastModified = new Date();
+  return paths.map(({ path, priority }) => ({
+    url: `${BASE_URL}${path}`,
+    lastModified,
+    changeFrequency: "weekly",
+    priority,
+  }));
+}
diff --git a/ee/apps/landing/app/starter-success/page.tsx b/ee/apps/landing/app/starter-success/page.tsx
new file mode 100644
index 0000000000..d52ffd8d77
--- /dev/null
+++ b/ee/apps/landing/app/starter-success/page.tsx
@@ -0,0 +1,85 @@
+import { SiteFooter } from "../../components/site-footer";
+import { SiteNav } from "../../components/site-nav";
+import { getGithubData } from "../../lib/github";
+
+export const metadata = {
+  title: "OpenWork — Starter Success",
+  description: "Thanks for pre-ordering OpenWork Team Starter.",
+  alternates: {
+    canonical: "/starter-success"
+  },
+  robots: {
+    index: false,
+    follow: true
+  }
+};
+
+export default async function StarterSuccessPage() {
+  const github = await getGithubData();
+  const calBase = process.env.NEXT_PUBLIC_CAL_URL ?? "";
+  const calHref = (() => {
+    if (!calBase) return "/enterprise#book";
+    try {
+      const url = new URL(calBase);
+      url.searchParams.set("source", "starter-success");
+      url.searchParams.set("notes", "Paid customer: OpenWork Team Starter (12 months). Priority onboarding requested.");
+      url.searchParams.set("description", "Paid customer - Team Starter (12 months). Please prioritize onboarding.");
+      return url.toString();
+    } catch {
+      return calBase;
+    }
+  })();
+
+  return (
+    <div className="min-h-screen">
+      <SiteNav stars={github.stars} downloadHref={github.downloads.macos} />
+
+      <main className="pb-24 pt-20">
+        <div className="content-max-width px-6">
+          <section className="animate-fade-up">
+            <div className="mb-4 inline-flex items-center rounded-full border border-emerald-200 bg-emerald-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-wider text-emerald-700">
+              starter confirmed
+            </div>
+
+            <h1 className="mb-4 text-4xl font-bold tracking-tight">
+              Thank you. You&apos;re in.
+            </h1>
+
+            <p className="max-w-2xl text-[16px] leading-relaxed text-gray-700">
+              You&apos;re on track for getting access to OpenWork Hosted in 7 days.
+            </p>
+          </section>
+
+          <section className="mt-10 grid grid-cols-1 gap-6 md:grid-cols-2">
+            <div className="feature-card">
+              <h2 className="mb-2 text-[15px] font-bold">What happens next</h2>
+              <ul className="space-y-2 text-[14px] leading-relaxed text-gray-600">
+                <li>- We review your team setup and use case.</li>
+                <li>- We send rollout details for teams up to 10 people.</li>
+                <li>- You get early access as hosted workers go live.</li>
+              </ul>
+            </div>
+
+            <div className="feature-card bg-gradient-to-br from-blue-50 to-orange-50">
+              <h2 className="mb-2 text-[15px] font-bold">Want to accelerate?</h2>
+              <p className="mb-4 text-[14px] leading-relaxed text-gray-600">
+                Schedule a call with the founder to accelerate and share your
+                use case.
+              </p>
+              <a href={calHref} className="doc-button">
+                Schedule founder call
+              </a>
+            </div>
+          </section>
+
+          <div className="mt-10 rounded-xl border border-gray-100 bg-white p-5 text-[13px] text-gray-500">
+            OpenWork stays open source, runs in any environment, and works with
+            any model.
+          </div>
+
+          <SiteFooter />
+        </div>
+      </main>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/app/terms/page.tsx b/ee/apps/landing/app/terms/page.tsx
new file mode 100644
index 0000000000..798c63a3a2
--- /dev/null
+++ b/ee/apps/landing/app/terms/page.tsx
@@ -0,0 +1,13 @@
+import { LegalPage } from "../../components/legal-page";
+
+export const metadata = {
+  title: "OpenWork — Terms of Use",
+  description: "Terms of use for Different AI, doing business as OpenWork.",
+  alternates: {
+    canonical: "/terms"
+  }
+};
+
+export default function TermsPage() {
+  return <LegalPage file="terms/terms-of-use.md" />;
+}
diff --git a/ee/apps/landing/app/terms/terms-of-use.md b/ee/apps/landing/app/terms/terms-of-use.md
new file mode 100644
index 0000000000..b395199e25
--- /dev/null
+++ b/ee/apps/landing/app/terms/terms-of-use.md
@@ -0,0 +1,235 @@
+# Terms of Use
+
+Effective date: April 4, 2026
+
+Welcome to OpenWork. Please read on to learn the rules and restrictions that govern your use of OpenWork's website, desktop application, cloud service, and hosted software offering (the "Services"). If you have any questions, comments, or concerns regarding these terms or the Services, please contact us at:
+
+Email: [team@openworklabs.com](mailto:team@openworklabs.com)
+
+These Terms of Use (the "Terms") are a binding contract between you and DIFFERENT AI, INC. (DBA as "OpenWork," "we" and "us"). Your use of the Services in any way means that you agree to all of these Terms, and these Terms will remain in effect while you use the Services. These Terms include the provisions in this document as well as those in the [Privacy Policy](/privacy). Your use of or participation in certain Services may also be subject to additional policies, rules and/or conditions ("Additional Terms"), which are incorporated herein by reference, and you understand and agree that by using or participating in any such Services, you agree to also comply with these Additional Terms. For clarity, our open source software that is not provided to you on a hosted basis is subject to the open source license and terms set forth on the applicable repository where you access such open source software, and such license and terms will exclusively govern your use of such open source software.
+
+Please read these Terms carefully. They cover important information about Services provided to you and any charges, taxes, and fees we bill you. These Terms include information about future changes to these Terms, automatic renewals, limitations of liability, a class action waiver and resolution of disputes by arbitration instead of in court. **PLEASE NOTE THAT YOUR USE OF AND ACCESS TO OUR SERVICES ARE SUBJECT TO THE FOLLOWING TERMS; IF YOU DO NOT AGREE TO ALL OF THE FOLLOWING, YOU MAY NOT USE OR ACCESS THE SERVICES IN ANY MANNER.**
+
+**ARBITRATION NOTICE AND CLASS ACTION WAIVER: EXCEPT FOR CERTAIN TYPES OF DISPUTES DESCRIBED IN THE ARBITRATION AGREEMENT SECTION BELOW, YOU AGREE THAT DISPUTES BETWEEN YOU AND US WILL BE RESOLVED BY BINDING, INDIVIDUAL ARBITRATION IN THE STATE OF DELAWARE AND YOU WAIVE YOUR RIGHT TO PARTICIPATE IN A CLASS ACTION LAWSUIT OR CLASS-WIDE ARBITRATION.**
+
+## Definitions
+
+When we use the following terms in these Terms, here is what we mean:
+
+- **"AI Output"** means any code, content, text, suggestions, or other output generated by artificial intelligence models through the Services, whether such models are provided by us or by Third Party Model providers.
+- **"Content"** means Input and Output collectively.
+- **"Customer Data"** means any content, code, text, files, or other data that you input, upload, submit, or generate through the Services. Customer Data does not include Usage Data.
+- **"Input"** means any content, instructions, prompts, code, or other data you provide to the Services.
+- **"Output"** means any content generated by the Services based on your Input.
+- **"Paid Services"** means any Services that are subject to fees, as described on the Site.
+- **"Payment Processor"** means the third-party payment processor we use to bill you for the Paid Services.
+- **"Personally Identifiable Information" or "PII"** means any information that identifies, relates to, describes, or could reasonably be linked to a specific individual.
+- **"Services"** means the OpenWork website ([openworklabs.com](https://openworklabs.com)), desktop application, cloud service, and all related features, tools, and support services made available to you under these Terms.
+- **"Site"** means [openworklabs.com](https://openworklabs.com) and any associated domains or subdomains we control.
+- **"Third Party Models"** means third-party artificial intelligence models or related services that you can access through the Services.
+- **"Usage Data"** means telemetry, logs, performance data, usage metrics, and other technical data generated by or in connection with your use of the Services. Usage Data does not include Customer Data or PII.
+
+## What is OpenWork?
+
+OpenWork is an AI-powered desktop application and related hosted services that let individuals and teams run, manage, and share agentic workflows using large language models. Certain of these large language models are provided by third parties ("Third Party Models"), and certain models or hosted runtime capabilities may be provided directly by us if you use a paid offering. Depending on how you use the Services, OpenWork may run locally on your device, connect to remote workers or servers, and enable you to access model functionality across your projects and connected tools.
+
+## Will these Terms ever change?
+
+We are constantly trying to improve our Services, so these Terms may need to change along with our Services. We reserve the right to change the Terms at any time, but if we do, we will place a notice on our site located at [openworklabs.com](https://openworklabs.com), send you an email, and/or notify you by some other means.
+
+If you don't agree with the new Terms, you are free to reject them; unfortunately, that means you will no longer be able to use the Services. If you use the Services in any way after a change to the Terms is effective, that means you agree to all of the changes.
+
+Except for changes by us as described here, no other amendment or modification of these Terms will be effective unless in writing and signed by both you and us.
+
+## What about my privacy?
+
+OpenWork takes the privacy of its users very seriously. For the current OpenWork Privacy Policy, please [click here](/privacy).
+
+## Eligibility
+
+The Services are not intended for individuals under the age of eighteen (18). You may use the Services only if you are at least eighteen (18) years old or the age of majority in your jurisdiction, whichever is greater, and have the legal capacity to enter into a binding contract. We do not knowingly collect or solicit personally identifiable information from anyone under the age of eighteen (18). If we discover that we have collected personal data from an individual under this age without verifiable parental consent, we will promptly delete that information. If you believe we may have collected such data, please contact us at [team@openworklabs.com](mailto:team@openworklabs.com).
+
+## What are the basics of using OpenWork?
+
+You represent and warrant that you are at least eighteen (18) years old or the age of majority in your jurisdiction, whichever is greater, and have the legal capacity to form a binding contract. If you're agreeing to these Terms on behalf of an organization or entity, you represent and warrant that you are authorized to agree to these Terms on that organization's or entity's behalf and bind them to these Terms (in which case, the references to "you" and "your" in these Terms, except for in this sentence, refer to that organization or entity).
+
+You will only use the Services for your own internal use, and not on behalf of or for the benefit of any third party, and only in a manner that complies with all laws that apply to you. If your use of the Services is prohibited by applicable laws, then you aren't authorized to use the Services. We can't and won't be responsible for your using the Services in a way that breaks the law.
+
+## Are there restrictions in how I can use the Services?
+
+You represent, warrant, and agree that you will not provide or contribute anything, including any Content, to the Services, or otherwise use or interact with the Services, in a manner that:
+
+- infringes or violates the intellectual property rights or any other rights of anyone else (including OpenWork);
+- violates any law or regulation, including, without limitation, any applicable export control laws, privacy laws or any other purpose not reasonably intended by OpenWork;
+- is dangerous, harmful, fraudulent, deceptive, threatening, harassing, defamatory, obscene, or otherwise objectionable;
+- automatically or programmatically extracts data or Output;
+- represents that the Output was human-generated when it was not;
+- uses Output to develop artificial intelligence models that compete with the Services or any Third Party Models;
+- attempts, in any manner, to obtain the password, account, or other security information from any other user;
+- violates the security of any computer network, or cracks any passwords or security encryption codes;
+- runs Maillist, Listserv, any form of auto-responder or "spam" on the Services, or any processes that run or are activated while you are not logged into the Services, or that otherwise interfere with the proper working of the Services (including by placing an unreasonable load on the Services' infrastructure);
+- "crawls," "scrapes," or "spiders" any page, data, or portion of or relating to the Services or Content (through use of manual or automated means);
+- copies or stores any significant portion of the Content; or
+- decompiles, reverse engineers, or otherwise attempts to obtain the source code or underlying ideas or information of or relating to the Services.
+
+A violation of any of the foregoing is grounds for termination of your right to use or access the Services.
+
+### Export Controls and Sanctions
+
+You may not use the Services if you are located in, or acting on behalf of a person or entity located in, a country or territory that is subject to U.S. government embargoes or sanctions, or if you are on any U.S. government list of restricted or prohibited parties. You represent and warrant that you are not subject to such restrictions and that your use of the Services will comply with all applicable export control laws, sanctions, and regulations.
+
+## Who Owns the Services and Content?
+
+### Our IP
+
+We retain all right, title and interest in and to the Services. Except as expressly set forth herein, no rights to the Services or Third Party Models are granted to you.
+
+### Your IP
+
+You may provide input to the Services ("Input"), and receive output from the Services based on the Input ("Output"). Input and Output are collectively "Content." You are responsible for Content, including ensuring that it does not violate any applicable law or these Terms. You represent and warrant that you have all rights, licenses, and permissions needed to provide Input to our Services.
+
+As between you and us, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output. We hereby assign to you all our right, title, and interest, if any, in and to Output.
+
+Due to the nature of our Services and artificial intelligence generally, output may not be unique and other users may receive similar output from our Services. Our assignment above does not extend to other users' output.
+
+We use Content to provide our Services, comply with applicable law, enforce our terms and policies, and keep our Services safe. We do not retain your Content after it has been processed.
+
+If you use OpenWork with Third Party Models, then your Content will be subject to the data retention policies of the providers of such Third Party Models. We cannot and do not control the retention practices of Third Party Model providers. You should review the terms and conditions applicable to any Third Party Model for more information about the data use and retention policies applicable to such Third Party Models.
+
+### Usage Data
+
+We do not collect analytics or telemetry data during normal use of the Desktop App. The Cloud Service collects limited operational telemetry (such as service availability, error rates, and performance metrics) solely to monitor and maintain the reliability and security of the service. This operational telemetry does not contain Customer Data or Personally Identifiable Information. Diagnostic data submitted through voluntary bug reports is used exclusively to reproduce and resolve software issues and is deleted once the related issue is resolved.
+
+## What about Third Party Models?
+
+The Services enable you to access and use Third Party Models, which are not owned or controlled by OpenWork. Your ability to access Third Party Models is contingent on you having API keys or otherwise having the right to access such Third Party Models.
+
+OpenWork has no control over, and assumes no responsibility for, the content, accuracy, privacy policies, or practices of any providers of Third Party Models. We encourage you to read the terms and conditions and privacy policy of each provider of a Third Party Model that you choose to utilize. By using the Services, you release and hold us harmless from any and all liability arising from your use of any Third Party Model.
+
+### AI Output Disclaimer
+
+The Services use artificial intelligence models to generate code, content, and other AI Output. AI Output may contain errors, inaccuracies, security vulnerabilities, or other issues and should not be relied upon without independent review and testing. You are solely responsible for reviewing, validating, testing, and using any AI Output, whether it is generated through our own models or through Third Party Models you access via the Services. You assume full responsibility for your use of AI Output and agree not to rely on it for critical or high-risk functions — including medical, legal, financial, or safety-related purposes — without appropriate independent safeguards and human review. AI Output may be similar or identical to content generated for other users who submit similar prompts. We do not guarantee that AI Output will be unique, free of third-party intellectual property rights, accurate, complete, or suitable for any particular purpose.
+
+### No Sensitive Data
+
+You agree not to upload, input, or otherwise provide through the Services any protected health information subject to HIPAA, or any other sensitive categories of data such as financial account numbers, government-issued identification numbers, or biometric data. The Services are not designed or intended to process, store, or handle such data, and we disclaim all responsibility and liability if you choose to submit it.
+
+## Will OpenWork ever change the Services?
+
+We're always trying to improve our Services, so they may change over time. We may suspend or discontinue any part of the Services, or we may introduce new features or impose limits on certain features or restrict access to parts or all of the Services.
+
+### Beta and Experimental Features
+
+From time to time, we may make features available that are identified as beta, preview, or experimental. Such features may be incomplete, may change at any time, and may be discontinued without notice. They are provided "as is," without warranties of any kind, and may be subject to additional terms. We shall have no liability for any harm or damage arising out of or in connection with any beta or experimental feature.
+
+## Do the Services cost anything?
+
+The Services may be free or we may charge a fee for using the Services. If you are using a free version of the Services, we will notify you before any Services you are then using begin carrying a fee, and if you wish to continue using such Services, you must pay all applicable fees for such Services. Any and all such charges, fees or costs are your sole responsibility.
+
+### Paid Services
+
+Certain of our Services may be subject to payments now or in the future (the "Paid Services"). Please see our [pricing page](/pricing) for a description of the current Paid Services. Please note that any payment terms presented to you in the process of using or signing up for a Paid Service are deemed part of these Terms.
+
+### Billing
+
+We use a third-party payment processor (the "Payment Processor") to bill you through a payment account linked to your account on the Services (your "Billing Account") for use of the Paid Services. The processing of payments will be subject to the terms, conditions and privacy policies of the Payment Processor in addition to these Terms. Currently, we use Polar Software, Inc. as our Payment Processor. You can access [Polar's Terms of Service](https://polar.sh/legal/master-services-terms) and their [Privacy Policy](https://polar.sh/legal/privacy-policy). We are not responsible for any error by, or other acts or omissions of, the Payment Processor. By choosing to use Paid Services, you agree to pay us, through the Payment Processor, all charges at the prices then in effect for any use of such Paid Services in accordance with the applicable payment terms, and you authorize us, through the Payment Processor, to charge your chosen payment provider (your "Payment Method"). You agree to make payment using that selected Payment Method. We reserve the right to correct any errors or mistakes that the Payment Processor makes even if it has already requested or received payment.
+
+### Payment Method
+
+The terms of your payment will be based on your Payment Method and may be determined by agreements between you and the financial institution, credit card issuer or other provider of your chosen Payment Method. If we, through the Payment Processor, do not receive payment from you, you agree to pay all amounts due on your Billing Account upon demand.
+
+### Recurring Billing
+
+Some of the Paid Services may consist of an initial period, for which there is a one-time charge, followed by recurring period charges as agreed to by you. By choosing a recurring payment plan, you acknowledge that such Services have an initial and recurring payment feature and you accept responsibility for all recurring charges prior to cancellation. **WE MAY SUBMIT PERIODIC CHARGES (E.G., MONTHLY) WITHOUT FURTHER AUTHORIZATION FROM YOU, UNTIL YOU PROVIDE PRIOR NOTICE (RECEIPT OF WHICH IS CONFIRMED BY US) THAT YOU HAVE TERMINATED THIS AUTHORIZATION OR WISH TO CHANGE YOUR PAYMENT METHOD. SUCH NOTICE WILL NOT AFFECT CHARGES SUBMITTED BEFORE WE REASONABLY COULD ACT. YOU MAY TERMINATE YOUR AUTHORIZATION OR CHANGE YOUR PAYMENT METHOD AT ANY TIME THROUGH YOUR ACCOUNT SETTINGS. IF YOU ARE UNABLE TO TERMINATE YOUR SUBSCRIPTION THROUGH THE APPLICATION, YOU MAY CONTACT US AT [TEAM@OPENWORKLABS.COM](mailto:team@openworklabs.com) AND WE WILL PROCESS YOUR REQUEST. IF YOUR CANCELLATION REQUEST IS SUBMITTED AFTER THE CURRENT BILLING PERIOD HAS ALREADY BEEN CHARGED, ANY REFUND OR CREDIT SHALL BE GRANTED OR DENIED AT OUR SOLE DISCRETION.**
+
+### Free Trials and Other Promotions
+
+Any free trial or other promotion that provides access to a Paid Service must be used within the specified time of the trial. You must stop using a Paid Service before the end of the trial period in order to avoid being charged for that Paid Service. If you cancel prior to the end of the trial period and are inadvertently charged for a Paid Service, please contact us at [team@openworklabs.com](mailto:team@openworklabs.com).
+
+### Feedback
+
+If you provide us with any feedback, suggestions, ideas, bug reports, or other information relating to the Services or our business ("Feedback"), you agree that we may use, copy, modify, distribute, publish, or otherwise exploit that Feedback for any purpose, in any form, and through any medium, without restriction or compensation to you. You also agree that we have no obligation to keep Feedback confidential or to attribute it to you.
+
+### Publicity Rights
+
+If you are a business entity, you grant us a non-exclusive, worldwide, royalty-free license to use your name, logo, and trademarks ("Marks") to identify you as a customer on our website, in customer lists, pitch materials, investor presentations, and other marketing and promotional materials. You may revoke this license at any time by giving us written notice at [team@openworklabs.com](mailto:team@openworklabs.com). After we receive your notice, we will make commercially reasonable efforts to stop using your Marks in new materials, but we are not required to recall or destroy materials already in use. You represent and warrant that you have all necessary rights to grant this license and that our use of your Marks as permitted here will not infringe or misappropriate any third-party rights.
+
+## What if I want to stop using the Services?
+
+You're free to do that at any time; please refer to our [Privacy Policy](/privacy), as well as the licenses above, to understand how we treat information you provide to us after you have stopped using our Services.
+
+OpenWork is also free to terminate (or suspend access to) your use of the Services for any reason in our discretion, including your breach of these Terms. OpenWork has the sole right to decide whether you are in violation of any of the restrictions set forth in these Terms.
+
+Provisions that, by their nature, should survive termination of these Terms shall survive termination. By way of example, all of the following will survive termination: any obligation you have to pay us or indemnify us, any limitations on our liability, any terms regarding ownership or intellectual property rights, and terms regarding disputes between us, including without limitation the arbitration agreement.
+
+## What else do I need to know?
+
+### Warranty Disclaimer
+
+OpenWork and its licensors, suppliers, partners, parent, subsidiaries or affiliated entities, and each of their respective officers, directors, members, employees, consultants, contract employees, representatives and agents, and each of their respective successors and assigns (OpenWork and all such parties together, the "OpenWork Parties") make no representations or warranties concerning the Services, including without limitation regarding any Content contained in or accessed through the Services, and the OpenWork Parties will not be responsible or liable for the accuracy, copyright compliance, legality, or decency of material contained in or accessed through the Services or any claims, actions, suits procedures, costs, expenses, damages or liabilities arising out of use of, or in any way related to your participation in, the Services. The OpenWork Parties make no representations or warranties regarding suggestions or recommendations of services or products offered or purchased through or in connection with the Services. **THE SERVICES AND CONTENT ARE PROVIDED BY OPENWORK (AND ITS LICENSORS AND SUPPLIERS) ON AN "AS-IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT USE OF THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE. SOME STATES DO NOT ALLOW LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU.**
+
+### Limitation of Liability
+
+**TO THE FULLEST EXTENT ALLOWED BY APPLICABLE LAW, UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, TORT, CONTRACT, STRICT LIABILITY, OR OTHERWISE) SHALL ANY OF THE OPENWORK PARTIES BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES OF ANY KIND, INCLUDING DAMAGES FOR LOST PROFITS, BUSINESS INTERRUPTION, LOSS OF DATA, LOSS OF GOODWILL, WORK STOPPAGE, ACCURACY OF RESULTS, OR COMPUTER FAILURE OR MALFUNCTION, (B) ANY SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY, (C) ANY AMOUNT, IN THE AGGREGATE, IN EXCESS OF THE GREATER OF (I) ONE-HUNDRED ($100) DOLLARS OR (II) THE AMOUNTS PAID AND/OR PAYABLE BY YOU TO OPENWORK IN CONNECTION WITH THE SERVICES IN THE TWELVE (12) MONTH PERIOD PRECEDING THIS APPLICABLE CLAIM OR (D) ANY MATTER BEYOND OUR REASONABLE CONTROL. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL OR CERTAIN OTHER DAMAGES, SO THE ABOVE LIMITATION AND EXCLUSIONS MAY NOT APPLY TO YOU.**
+
+### Indemnity
+
+You agree to indemnify and hold the OpenWork Parties harmless from and against any and all claims, liabilities, damages (actual and consequential), losses and expenses (including attorneys' fees) arising from or in any way related to any claims relating to (a) your use of the Services, and (b) your violation of these Terms. In the event of such a claim, suit, or action ("Claim"), we will attempt to provide notice of the Claim to the contact information we have for your account (provided that failure to deliver such notice shall not eliminate or reduce your indemnification obligations hereunder).
+
+### Assignment
+
+You may not assign, delegate or transfer these Terms or your rights or obligations hereunder, or your Services account, in any way (by operation of law or otherwise) without OpenWork's prior written consent. We may transfer, assign, or delegate these Terms and our rights and obligations without consent.
+
+### Choice of Law
+
+These Terms are governed by and will be construed under the Federal Arbitration Act, applicable federal law, and the laws of the State of Delaware, without regard to the conflicts of laws provisions thereof.
+
+## Arbitration Agreement
+
+Please read the following **ARBITRATION AGREEMENT** carefully because it requires you to arbitrate certain disputes and claims with OpenWork and limits the manner in which you can seek relief from OpenWork. Both you and OpenWork acknowledge and agree that for the purposes of any dispute arising out of or relating to the subject matter of these Terms, OpenWork's officers, directors, employees and independent contractors ("Personnel") are third-party beneficiaries of these Terms, and that upon your acceptance of these Terms, Personnel will have the right (and will be deemed to have accepted the right) to enforce these Terms against you as the third-party beneficiary hereof.
+
+### Arbitration Rules; Applicability of Arbitration Agreement
+
+The parties shall use their best efforts to settle any dispute, claim, question, or disagreement arising out of or relating to the subject matter of these Terms directly through good-faith negotiations, which shall be a precondition to either party initiating arbitration. If such negotiations do not resolve the dispute, it shall be finally settled by binding arbitration in New Castle County, Delaware. The arbitration will proceed in the English language, in accordance with the JAMS Streamlined Arbitration Rules and Procedures (the "Rules") then in effect, by one commercial arbitrator with substantial experience in resolving intellectual property and commercial contract disputes. The arbitrator shall be selected from the appropriate list of JAMS arbitrators in accordance with such Rules. Judgment upon the award rendered by such arbitrator may be entered in any court of competent jurisdiction.
+
+### Costs of Arbitration
+
+Each party shall bear its own arbitration fees and costs as determined by the Rules, unless the arbitrator allocates fees differently in accordance with applicable law. OpenWork will not seek its attorneys' fees and costs in arbitration unless the arbitrator determines that your claim is frivolous.
+
+### Small Claims Court; Infringement
+
+Either you or OpenWork may assert claims, if they qualify, in small claims court in New Castle County, Delaware or any United States county where you live or work. Furthermore, notwithstanding the foregoing obligation to arbitrate disputes, each party shall have the right to pursue injunctive or other equitable relief at any time, from any court of competent jurisdiction, to prevent the actual or threatened infringement, misappropriation or violation of a party's copyrights, trademarks, trade secrets, patents or other intellectual property rights.
+
+### Waiver of Jury Trial
+
+**YOU AND OPENWORK WAIVE ANY CONSTITUTIONAL AND STATUTORY RIGHTS TO GO TO COURT AND HAVE A TRIAL IN FRONT OF A JUDGE OR JURY.** You and OpenWork are instead choosing to have claims and disputes resolved by arbitration. Arbitration procedures are typically more limited, more efficient, and less costly than rules applicable in court and are subject to very limited review by a court. In any litigation between you and OpenWork over whether to vacate or enforce an arbitration award, **YOU AND OPENWORK WAIVE ALL RIGHTS TO A JURY TRIAL**, and elect instead to have the dispute be resolved by a judge.
+
+### Waiver of Class or Consolidated Actions
+
+**ALL CLAIMS AND DISPUTES WITHIN THE SCOPE OF THIS ARBITRATION AGREEMENT MUST BE ARBITRATED OR LITIGATED ON AN INDIVIDUAL BASIS AND NOT ON A CLASS BASIS. CLAIMS OF MORE THAN ONE CUSTOMER OR USER CANNOT BE ARBITRATED OR LITIGATED JOINTLY OR CONSOLIDATED WITH THOSE OF ANY OTHER CUSTOMER OR USER.** If however, this waiver of class or consolidated actions is deemed invalid or unenforceable, neither you nor OpenWork is entitled to arbitration; instead all claims and disputes will be resolved in a court as set forth in (g) below.
+
+### Opt-out
+
+You have the right to opt out of the provisions of this Section by sending written notice of your decision to opt out to the following address: 28 Geary St STE 650 Suite #188, San Francisco, California 94108, United States postmarked within thirty (30) days of first accepting these Terms. You must include (i) your name and residence address, (ii) the email address and/or telephone number associated with your account, and (iii) a clear statement that you want to opt out of these Terms' arbitration agreement.
+
+### Exclusive Venue
+
+If you send the opt-out notice in (f), and/or in any circumstances where the foregoing arbitration agreement permits either you or OpenWork to litigate any dispute arising out of or relating to the subject matter of these Terms in court, then the foregoing arbitration agreement will not apply to either party, and both you and OpenWork agree that any judicial proceeding (other than small claims actions) will be brought in the state or federal courts located in, respectively, New Castle County, Delaware, or the federal district in which that county falls.
+
+### Severability
+
+If the prohibition against class actions and other claims brought on behalf of third parties contained above is found to be unenforceable, then all of the preceding language in this Arbitration Agreement section will be null and void. This arbitration agreement will survive the termination of your relationship with OpenWork.
+
+## Miscellaneous
+
+You will be responsible for paying, withholding, filing, and reporting all taxes, duties, and other governmental assessments associated with your activity in connection with the Services, provided that OpenWork may, in its sole discretion, do any of the foregoing on your behalf or for itself as it sees fit. The failure of either you or us to exercise, in any way, any right herein shall not be deemed a waiver of any further rights hereunder. You and OpenWork agree that these Terms are the complete and exclusive statement of the mutual understanding between you and OpenWork, and that these Terms supersede and cancel all previous written and oral agreements, communications and other understandings relating to the subject matter of these Terms. You hereby acknowledge and agree that you are not an employee, agent, partner, or joint venture of OpenWork, and you do not have any authority of any kind to bind OpenWork in any respect whatsoever.
+
+Except as expressly set forth in the section above regarding the arbitration agreement, you and OpenWork agree there are no third-party beneficiaries intended under these Terms.
+
+## Severability
+
+If any provision of these Terms is found by a court of competent jurisdiction or arbitrator to be unlawful, void, or unenforceable for any reason, that provision shall be enforced to the maximum extent permissible so as to give effect to its intent, or if that is not possible, shall be deemed severed from these Terms. The invalidity or unenforceability of any provision shall not affect the validity or enforceability of any other provision of these Terms, and the remaining provisions shall continue in full force and effect. No waiver, amendment, or modification of any provision shall be deemed a waiver, amendment, or modification of any other provision.
+
+## Entire Agreement
+
+These Terms, together with the [Privacy Policy](/privacy) and any applicable Additional Terms, constitute the entire agreement between you and OpenWork regarding the Services and supersede all prior or contemporaneous agreements, communications, and understandings (whether written or oral) relating to the Services. In the event of a conflict between these Terms and the Privacy Policy, these Terms shall control except with respect to matters of data privacy and data protection, for which the Privacy Policy shall control.
diff --git a/ee/apps/landing/app/trust/page.tsx b/ee/apps/landing/app/trust/page.tsx
new file mode 100644
index 0000000000..43b8381e57
--- /dev/null
+++ b/ee/apps/landing/app/trust/page.tsx
@@ -0,0 +1,29 @@
+import { LandingTrustOverview } from "../../components/landing-trust";
+import { getGithubData } from "../../lib/github";
+import { baseOpenGraph } from "../../lib/seo";
+
+export const metadata = {
+  title: "OpenWork — Security & Data Privacy",
+  description:
+    "How OpenWork handles data, subprocessors, incident response, and compliance for self-hosted enterprise deployments.",
+  alternates: {
+    canonical: "/trust"
+  },
+  openGraph: {
+    ...baseOpenGraph,
+    url: "https://openworklabs.com/trust"
+  }
+};
+
+export default async function TrustPage() {
+  const github = await getGithubData();
+  const cal = process.env.NEXT_PUBLIC_CAL_URL ?? "";
+
+  return (
+    <LandingTrustOverview
+      stars={github.stars}
+      downloadHref={github.downloads.macos}
+      calUrl={cal}
+    />
+  );
+}
diff --git a/ee/apps/landing/components/app-feedback-form.tsx b/ee/apps/landing/components/app-feedback-form.tsx
new file mode 100644
index 0000000000..39f3dadd59
--- /dev/null
+++ b/ee/apps/landing/components/app-feedback-form.tsx
@@ -0,0 +1,273 @@
+"use client";
+
+import { AlertCircle, CheckCircle2, MessageSquareText, Send } from "lucide-react";
+import { useMemo, useState } from "react";
+
+export type AppFeedbackPrefill = {
+  source: string;
+  entrypoint: string;
+  deployment: string;
+  appVersion: string;
+  openworkServerVersion: string;
+  opencodeVersion: string;
+  orchestratorVersion: string;
+  opencodeRouterVersion: string;
+  osName: string;
+  osVersion: string;
+  platform: string;
+};
+
+type Props = {
+  prefill: AppFeedbackPrefill;
+};
+
+type SubmitState = "idle" | "loading" | "success" | "error";
+
+const INITIAL_MESSAGE = "";
+
+export function AppFeedbackForm(props: Props) {
+  const [name, setName] = useState("");
+  const [email, setEmail] = useState("");
+  const [message, setMessage] = useState(INITIAL_MESSAGE);
+  const [website, setWebsite] = useState("");
+  const [startedAt, setStartedAt] = useState(() => Date.now());
+  const [state, setState] = useState<SubmitState>("idle");
+  const [errorMessage, setErrorMessage] = useState("");
+
+  const contextItems = useMemo(
+    () => [
+      { label: "App version", value: props.prefill.appVersion },
+      { label: "OpenWork server", value: props.prefill.openworkServerVersion },
+      { label: "OpenCode", value: props.prefill.opencodeVersion },
+      { label: "Orchestrator", value: props.prefill.orchestratorVersion },
+      { label: "Router", value: props.prefill.opencodeRouterVersion },
+      {
+        label: "OS",
+        value: [props.prefill.osName, props.prefill.osVersion].filter(Boolean).join(" "),
+      },
+      { label: "Platform", value: props.prefill.platform },
+      { label: "Opened from", value: props.prefill.entrypoint },
+      { label: "Deployment", value: props.prefill.deployment },
+    ].filter((item) => item.value),
+    [props.prefill],
+  );
+
+  const reset = () => {
+    setName("");
+    setEmail("");
+    setMessage(INITIAL_MESSAGE);
+    setWebsite("");
+    setStartedAt(Date.now());
+    setState("idle");
+    setErrorMessage("");
+  };
+
+  const handleSubmit = async (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const trimmedName = name.trim();
+    const trimmedEmail = email.trim();
+    const trimmed = message.trim();
+    if (!trimmedName) {
+      setState("error");
+      setErrorMessage("Please add your name so we know who sent this.");
+      return;
+    }
+
+    if (!trimmedEmail) {
+      setState("error");
+      setErrorMessage("Please add your email so we can follow up.");
+      return;
+    }
+
+    if (!trimmed) {
+      setState("error");
+      setErrorMessage("Please describe the issue before sending feedback.");
+      return;
+    }
+
+    setState("loading");
+    setErrorMessage("");
+
+    try {
+      const response = await fetch("/api/app-feedback", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          name: trimmedName,
+          email: trimmedEmail,
+          message: trimmed,
+          website,
+          startedAt,
+          context: props.prefill,
+        }),
+      });
+
+      if (!response.ok) {
+        const data = (await response.json().catch(() => null)) as
+          | { error?: string }
+          | null;
+        setState("error");
+        setErrorMessage(
+          data?.error ?? "Something went wrong while sending feedback.",
+        );
+        return;
+      }
+
+      setState("success");
+      setMessage(INITIAL_MESSAGE);
+    } catch (error) {
+      setState("error");
+      setErrorMessage(
+        error instanceof Error
+          ? error.message
+          : "Something went wrong while sending feedback.",
+      );
+    }
+  };
+
+  return (
+    <section className="landing-shell rounded-[2rem] p-6 md:p-8">
+      <div className="grid gap-6 lg:grid-cols-[1.2fr_0.8fr]">
+        <div className="rounded-[1.5rem] border border-white/70 bg-white/85 p-6 shadow-sm backdrop-blur">
+          <div className="mb-4 inline-flex items-center gap-2 rounded-full border border-slate-200/80 bg-slate-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-slate-500">
+            <MessageSquareText size={12} />
+            app feedback
+          </div>
+          <h1 className="max-w-2xl text-3xl font-semibold tracking-tight text-[#011627] md:text-4xl">
+            Tell us what broke, felt rough, or needs polish.
+          </h1>
+          <p className="mt-3 max-w-2xl text-[15px] leading-relaxed text-slate-600">
+            Your note goes to the OpenWork team with your contact details, app
+            version, and runtime context already attached.
+          </p>
+
+          {state === "success" ? (
+            <div className="mt-6 rounded-[1.5rem] border border-emerald-200 bg-emerald-50/90 p-5 text-emerald-900">
+              <div className="flex items-start gap-3">
+                <CheckCircle2 className="mt-0.5 h-5 w-5 shrink-0" />
+                <div>
+                  <div className="text-[15px] font-semibold">Feedback sent</div>
+                  <p className="mt-1 text-[14px] leading-relaxed text-emerald-800">
+                    Thanks. We received your note and the attached diagnostics.
+                  </p>
+                  <button
+                    type="button"
+                    onClick={reset}
+                    className="mt-4 inline-flex items-center rounded-full border border-emerald-300 bg-white px-4 py-2 text-[13px] font-medium text-emerald-900 transition hover:border-emerald-400 hover:bg-emerald-100"
+                  >
+                    Send another message
+                  </button>
+                </div>
+              </div>
+            </div>
+          ) : (
+            <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
+              <div className="hidden" aria-hidden="true">
+                <label>
+                  Website
+                  <input
+                    type="text"
+                    value={website}
+                    onChange={(event) => setWebsite(event.target.value)}
+                    autoComplete="off"
+                    tabIndex={-1}
+                  />
+                </label>
+              </div>
+              <div className="grid gap-4 md:grid-cols-2">
+                <div>
+                  <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                    Your name
+                  </label>
+                  <input
+                    type="text"
+                    value={name}
+                    onChange={(event) => setName(event.target.value)}
+                    placeholder="Jane Doe"
+                    className="w-full rounded-[1.2rem] border border-slate-200 bg-white px-4 py-3 text-[15px] text-[#011627] outline-none transition focus:border-slate-300 focus:ring-4 focus:ring-slate-100"
+                    disabled={state === "loading"}
+                    autoComplete="name"
+                    required
+                  />
+                </div>
+                <div>
+                  <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                    Your email
+                  </label>
+                  <input
+                    type="email"
+                    value={email}
+                    onChange={(event) => setEmail(event.target.value)}
+                    placeholder="jane@company.com"
+                    className="w-full rounded-[1.2rem] border border-slate-200 bg-white px-4 py-3 text-[15px] text-[#011627] outline-none transition focus:border-slate-300 focus:ring-4 focus:ring-slate-100"
+                    disabled={state === "loading"}
+                    autoComplete="email"
+                    required
+                  />
+                </div>
+              </div>
+
+              <div>
+                <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                  What happened?
+                </label>
+                <textarea
+                  value={message}
+                  onChange={(event) => setMessage(event.target.value)}
+                  placeholder="What were you trying to do? What did you expect? What actually happened?"
+                  className="min-h-[220px] w-full rounded-[1.5rem] border border-slate-200 bg-white px-4 py-4 text-[15px] leading-relaxed text-[#011627] outline-none transition focus:border-slate-300 focus:ring-4 focus:ring-slate-100"
+                  disabled={state === "loading"}
+                  required
+                />
+              </div>
+
+              {state === "error" ? (
+                <div className="flex items-start gap-3 rounded-[1.25rem] border border-red-200 bg-red-50/90 px-4 py-3 text-[13px] leading-relaxed text-red-700">
+                  <AlertCircle className="mt-0.5 h-4 w-4 shrink-0" />
+                  <div>{errorMessage}</div>
+                </div>
+              ) : null}
+
+              <button
+                type="submit"
+                disabled={state === "loading"}
+                className="doc-button inline-flex items-center gap-2 disabled:cursor-not-allowed disabled:opacity-60"
+              >
+                <Send size={16} />
+                {state === "loading" ? "Sending..." : "Send feedback"}
+              </button>
+            </form>
+          )}
+        </div>
+
+        <aside className="rounded-[1.5rem] border border-slate-200/80 bg-[#0b1728] p-5 text-white shadow-sm">
+          <div className="text-[11px] font-semibold uppercase tracking-[0.18em] text-sky-200/80">
+            Attached context
+          </div>
+          <p className="mt-3 text-[14px] leading-relaxed text-slate-300">
+            These details are captured from the app link so the team can triage
+            the issue faster.
+          </p>
+
+          <div className="mt-5 grid gap-3">
+            {contextItems.map((item) => (
+              <div
+                key={item.label}
+                className="rounded-[1.15rem] border border-white/10 bg-white/5 px-4 py-3"
+              >
+                <div className="text-[11px] font-semibold uppercase tracking-[0.16em] text-slate-400">
+                  {item.label}
+                </div>
+                <div className="mt-1 break-words font-mono text-[13px] text-white">
+                  {item.value}
+                </div>
+              </div>
+            ))}
+          </div>
+        </aside>
+      </div>
+    </section>
+  );
+}
diff --git a/ee/apps/landing/components/book-call-form.tsx b/ee/apps/landing/components/book-call-form.tsx
new file mode 100644
index 0000000000..8b455e3142
--- /dev/null
+++ b/ee/apps/landing/components/book-call-form.tsx
@@ -0,0 +1,192 @@
+"use client";
+
+import { Mail } from "lucide-react";
+import { useEffect, useState } from "react";
+
+type FormState = "idle" | "loading" | "success" | "error";
+
+type FormFields = {
+  fullName: string;
+  companyEmail: string;
+  message: string;
+};
+
+const initialFields: FormFields = {
+  fullName: "",
+  companyEmail: "",
+  message: ""
+};
+
+export function BookCallForm() {
+  const [fields, setFields] = useState<FormFields>(initialFields);
+  const [website, setWebsite] = useState("");
+  const [startedAt, setStartedAt] = useState(() => Date.now());
+  const [state, setState] = useState<FormState>("idle");
+  const [errorMsg, setErrorMsg] = useState("");
+  const [hydrated, setHydrated] = useState(false);
+
+  useEffect(() => {
+    setHydrated(true);
+  }, []);
+
+  const setField = (key: keyof FormFields, value: string) => {
+    setFields(current => ({ ...current, [key]: value }));
+  };
+
+  const reset = () => {
+    setFields(initialFields);
+    setWebsite("");
+    setStartedAt(Date.now());
+    setState("idle");
+    setErrorMsg("");
+  };
+
+  const handleSubmit = async (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setState("loading");
+    setErrorMsg("");
+
+    try {
+      const response = await fetch("/api/enterprise-contact", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          ...fields,
+          website,
+          startedAt
+        })
+      });
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => null);
+        setState("error");
+        setErrorMsg(
+          data?.error ?? "Something went wrong. Please try again."
+        );
+        return;
+      }
+
+      setState("success");
+      setFields(initialFields);
+    } catch (error) {
+      setState("error");
+      setErrorMsg(
+        error instanceof Error
+          ? error.message
+          : "Something went wrong. Please try again."
+      );
+    }
+  };
+
+  return (
+    <section id="book" className="rounded-[2rem] border border-gray-200 bg-white p-6 md:p-8">
+      <div className="rounded-[1.5rem] border border-slate-200/70 bg-white p-5 md:p-6">
+        <div className="mb-3 inline-flex items-center gap-2 rounded-full border border-slate-200/70 bg-slate-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-slate-500">
+          <Mail size={12} />
+          Get in touch with us
+        </div>
+        <h3 className="mb-3 text-2xl font-medium tracking-tight text-[#011627]">
+          Tell us what you need.
+        </h3>
+        <p className="mb-6 max-w-2xl text-[15px] leading-relaxed text-slate-600">
+          Share your team context and we&apos;ll get back to you over email.
+        </p>
+
+        {state === "success" ? (
+          <div className="rounded-2xl border border-emerald-200 bg-emerald-50/80 p-4 text-[14px] leading-relaxed text-emerald-800">
+            Thanks. We&apos;ve got your note and will follow up soon.
+            <button
+              type="button"
+              onClick={reset}
+              className="mt-3 block text-[13px] font-medium text-emerald-700 transition hover:text-emerald-900"
+            >
+              Send another message
+            </button>
+          </div>
+        ) : (
+          <form className="space-y-4" onSubmit={handleSubmit}>
+            <div className="grid gap-4 md:grid-cols-2">
+              <div className="hidden" aria-hidden="true">
+                <label>
+                  Website
+                  <input
+                    value={website}
+                    onChange={event => setWebsite(event.target.value)}
+                    autoComplete="off"
+                    tabIndex={-1}
+                  />
+                </label>
+              </div>
+              <div>
+                <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                  Full name
+                </label>
+                <input
+                  value={fields.fullName}
+                  onChange={event => setField("fullName", event.target.value)}
+                  placeholder="Jeff Bezos"
+                  className="w-full rounded-2xl border border-slate-200 bg-white/90 px-4 py-3 text-[14px] text-[#011627] outline-none transition focus:border-slate-300 focus:bg-white"
+                  autoComplete="name"
+                  required
+                  type="text"
+                  disabled={state === "loading"}
+                />
+              </div>
+              <div>
+                <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                  Company email
+                </label>
+                <input
+                  value={fields.companyEmail}
+                  onChange={event =>
+                    setField("companyEmail", event.target.value)
+                  }
+                  placeholder="jeff@amazon.com"
+                  className="w-full rounded-2xl border border-slate-200 bg-white/90 px-4 py-3 text-[14px] text-[#011627] outline-none transition focus:border-slate-300 focus:bg-white"
+                  autoComplete="email"
+                  required
+                  type="email"
+                  disabled={state === "loading"}
+                />
+              </div>
+            </div>
+
+            <div>
+              <label className="mb-2 block text-[12px] font-semibold uppercase tracking-[0.16em] text-slate-500">
+                How can we help?
+              </label>
+              <textarea
+                value={fields.message}
+                onChange={event => setField("message", event.target.value)}
+                placeholder="Share more about what you want to accomplish"
+                className="min-h-[160px] w-full rounded-2xl border border-slate-200 bg-white/90 px-4 py-3 text-[14px] text-[#011627] outline-none transition focus:border-slate-300 focus:bg-white"
+                required
+                disabled={state === "loading"}
+              />
+            </div>
+
+            {state === "error" ? (
+              <div className="rounded-2xl border border-red-200 bg-red-50/80 px-4 py-3 text-[13px] leading-relaxed text-red-700">
+                {errorMsg}
+              </div>
+            ) : null}
+
+            <button
+              type="submit"
+              disabled={!hydrated || state === "loading"}
+              className="doc-button w-full sm:w-auto disabled:opacity-60"
+            >
+              {!hydrated
+                ? "Loading..."
+                : state === "loading"
+                  ? "Sending..."
+                  : "Get in touch"}
+            </button>
+          </form>
+        )}
+      </div>
+    </section>
+  );
+}
diff --git a/ee/apps/landing/components/landing-app-demo-panel.tsx b/ee/apps/landing/components/landing-app-demo-panel.tsx
new file mode 100644
index 0000000000..06708371fb
--- /dev/null
+++ b/ee/apps/landing/components/landing-app-demo-panel.tsx
@@ -0,0 +1,125 @@
+import { ChevronRight } from "lucide-react";
+
+import type { DemoFlow } from "./landing-demo-flows";
+import { landingDemoFlowTimes } from "./landing-demo-flows";
+
+type Props = {
+  flows: DemoFlow[];
+  activeFlowId: string;
+  onSelectFlow: (id: string) => void;
+  timesById?: Record<string, string>;
+  className?: string;
+};
+
+export function LandingAppDemoPanel(props: Props) {
+  const activeFlow = props.flows.find((flow) => flow.id === props.activeFlowId) ?? props.flows[0];
+  const timesById = props.timesById ?? landingDemoFlowTimes;
+
+  return (
+    <div className={["relative z-10 flex flex-col gap-4 md:flex-row", props.className].filter(Boolean).join(" ")}>
+      <div className="flex w-full flex-col gap-1 rounded-xl border border-gray-100 bg-gray-50 p-2 md:w-1/3">
+        {activeFlow.agents.map((agent) => (
+          <div
+            key={agent.name}
+            className="flex cursor-pointer items-center justify-between rounded-xl p-3 transition-colors hover:bg-gray-50/80"
+          >
+            <div className="flex items-center gap-3">
+              <div className={`h-6 w-6 rounded-full ${agent.color}`}></div>
+              <span className="text-sm font-medium">{agent.name}</span>
+            </div>
+            {agent.desc ? <span className="text-xs text-gray-400">{agent.desc}</span> : null}
+          </div>
+        ))}
+
+        <div className="mt-4 px-1 pb-1">
+          <div className="relative flex flex-col gap-1 pl-3 before:absolute before:bottom-2 before:left-0 before:top-2 before:w-[2px] before:bg-gray-100 before:content-['']">
+            {props.flows.map((flow) => {
+              const isActive = flow.id === activeFlow.id;
+
+              return (
+                <button
+                  key={flow.id}
+                  type="button"
+                  onClick={() => props.onSelectFlow(flow.id)}
+                  className={`flex items-center justify-between rounded-xl px-3 py-2.5 text-left text-[13px] transition-colors ${
+                    isActive ? "bg-gray-100/80" : "hover:bg-gray-50/80"
+                  }`}
+                >
+                  <span
+                    className={`mr-2 truncate ${
+                      isActive ? "font-medium text-gray-700" : "text-gray-600"
+                    }`}
+                  >
+                    {flow.tabLabel}
+                  </span>
+                  <span className="whitespace-nowrap text-gray-400">
+                    {timesById[flow.id] ?? "Now"}
+                  </span>
+                </button>
+              );
+            })}
+          </div>
+        </div>
+      </div>
+
+      <div className="flex min-h-[400px] w-full flex-col overflow-hidden rounded-xl border border-gray-100 bg-white shadow-sm md:w-2/3">
+        <div className="flex flex-1 flex-col gap-6 overflow-y-auto p-6 text-[13px]">
+          {activeFlow.chatHistory.map((message, index) => {
+            if (message.role === "user") {
+              return (
+                <div
+                  key={`${message.role}-${index}`}
+                  className="mt-2 max-w-[85%] self-center rounded-3xl bg-gray-100/80 px-5 py-3 text-center text-gray-800"
+                >
+                  {message.content}
+                </div>
+              );
+            }
+
+            if (message.role === "timeline") {
+              return (
+                <div
+                  key={`${message.role}-${index}`}
+                  className="ml-2 flex flex-col gap-3 text-xs text-gray-400"
+                >
+                  {message.items.map((item) => (
+                    <div key={item} className="flex items-center gap-2">
+                      <ChevronRight size={10} className="text-gray-300" />
+                      <span>{item}</span>
+                    </div>
+                  ))}
+                </div>
+              );
+            }
+
+            return (
+              <div
+                key={`${message.role}-${index}`}
+                className="mb-2 ml-2 max-w-[95%] text-[13px] leading-relaxed text-gray-800"
+              >
+                {message.content}
+              </div>
+            );
+          })}
+        </div>
+
+        <div className="border-t border-white/50 bg-white/50 p-4">
+          <div className="mb-2 px-1 text-xs text-gray-400">Describe your task</div>
+          <div className="rounded-xl border border-gray-100 bg-white p-3.5 text-sm leading-relaxed text-[#011627] shadow-sm">
+            {activeFlow.task} <span className="text-gray-400">[task]</span> {activeFlow.context}{" "}
+            <span className="text-gray-400">[context]</span> {activeFlow.output}{" "}
+            <span className="text-gray-400">[result]</span>
+          </div>
+          <div className="mt-3 flex items-center justify-end px-1">
+            <button
+              type="button"
+              className="rounded-lg bg-[#011627] px-4 py-2 text-xs font-medium text-white shadow-[0_1px_2px_rgba(17,24,39,0.12)] transition-colors hover:bg-black"
+            >
+              Run Task
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/landing-background.tsx b/ee/apps/landing/components/landing-background.tsx
new file mode 100644
index 0000000000..c32de3cc4c
--- /dev/null
+++ b/ee/apps/landing/components/landing-background.tsx
@@ -0,0 +1,54 @@
+"use client";
+
+export function LandingBackground() {
+  return (
+    <>
+      {/* <div className="pointer-events-none fixed inset-0 z-0 bg-[#f6f9fc]" /> */}
+
+      {/*
+        Top landing paper-grain background is intentionally disabled for now.
+        Keep this block for quick reactivation later.
+
+        <div className="landing-background-fade pointer-events-none fixed inset-0 z-0">
+          <ResponsiveGrain
+            colors={["#f6f9fc", "#f6f9fc", "#1e293b", "#334155"]}
+            colorBack="#f6f9fc"
+            softness={1}
+            intensity={0.03}
+            noise={0.14}
+            shape="corners"
+            speed={0.2}
+          />
+        </div>
+      */}
+
+      <style jsx>{`
+        .landing-background-fade {
+          opacity: 0.6;
+          will-change: opacity;
+        }
+
+        @supports (animation-timeline: scroll(root block)) {
+          .landing-background-fade {
+            animation-name: landing-background-fade-out;
+            animation-duration: 1s;
+            animation-timing-function: linear;
+            animation-fill-mode: both;
+            animation-timeline: scroll(root block);
+            animation-range: 0px 500px;
+          }
+        }
+
+        @keyframes landing-background-fade-out {
+          from {
+            opacity: 0.6;
+          }
+
+          to {
+            opacity: 0;
+          }
+        }
+      `}</style>
+    </>
+  );
+}
diff --git a/ee/apps/landing/components/landing-cloud-workers-card.tsx b/ee/apps/landing/components/landing-cloud-workers-card.tsx
new file mode 100644
index 0000000000..54fd4e2b45
--- /dev/null
+++ b/ee/apps/landing/components/landing-cloud-workers-card.tsx
@@ -0,0 +1,81 @@
+type Props = {
+  className?: string;
+};
+
+const summaryStats = [
+  { value: "3", label: "Skills" },
+  { value: "3", label: "MCPs" },
+  { value: "2", label: "Plugins" },
+];
+
+export function LandingCloudWorkersCard(props: Props) {
+  return (
+    <div
+      className={[
+        "flex w-full max-w-lg flex-col overflow-hidden rounded-xl border border-gray-200 bg-white shadow-sm",
+        props.className,
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    >
+      {/* Browser chrome */}
+      <div className="flex items-center gap-3 border-b border-gray-100 bg-gray-50/80 px-4 py-2.5">
+        <div className="flex gap-1.5">
+          <div className="h-2.5 w-2.5 rounded-full bg-red-400/70" />
+          <div className="h-2.5 w-2.5 rounded-full bg-yellow-400/70" />
+          <div className="h-2.5 w-2.5 rounded-full bg-green-400/70" />
+        </div>
+        <div className="flex flex-1 items-center gap-2 rounded-md border border-gray-200 bg-white px-3 py-1">
+          <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="text-gray-400" aria-hidden="true">
+            <rect x="3" y="11" width="18" height="11" rx="2" ry="2" />
+            <path d="M7 11V7a5 5 0 0 1 10 0v4" />
+          </svg>
+          <span className="truncate text-[11px] text-gray-400">
+            share.openworklabs.com/b/01KNB...
+          </span>
+        </div>
+      </div>
+
+      {/* Page content */}
+      <div className="flex flex-col gap-5 p-5 md:p-6">
+        <div>
+          <div className="mb-1 text-[11px] font-semibold uppercase tracking-[0.2em] text-blue-500">
+            Workspace Template
+          </div>
+          <h3 className="mb-2 text-xl font-medium tracking-tight text-[#011627]">
+            SDR for Acme Company
+          </h3>
+          <p className="text-sm leading-relaxed text-gray-500">
+            3 skills, 3 MCPs, and 2 plugins. Ready to import.
+          </p>
+        </div>
+
+        <div className="grid grid-cols-3 gap-2">
+          {summaryStats.map((stat) => (
+            <div
+              key={stat.label}
+              className="rounded-xl border border-gray-100 bg-gray-50/60 px-4 py-3"
+            >
+              <div className="text-base font-semibold text-[#011627]">
+                {stat.value}
+              </div>
+              <div className="text-[12px] text-gray-500">{stat.label}</div>
+            </div>
+          ))}
+        </div>
+
+        <button
+          type="button"
+          className="flex w-full items-center justify-center gap-2 rounded-lg bg-[#011627] py-2.5 text-sm font-medium text-white shadow-[0_1px_2px_rgba(17,24,39,0.12)] transition-colors hover:bg-black"
+        >
+          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
+            <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" />
+            <polyline points="15 3 21 3 21 9" />
+            <line x1="10" y1="14" x2="21" y2="3" />
+          </svg>
+          Open in OpenWork
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/landing-demo-flows.ts b/ee/apps/landing/components/landing-demo-flows.ts
new file mode 100644
index 0000000000..8f088fab46
--- /dev/null
+++ b/ee/apps/landing/components/landing-demo-flows.ts
@@ -0,0 +1,167 @@
+export type ChatMessage =
+  | {
+      role: "user" | "agent";
+      content: string;
+    }
+  | {
+      role: "timeline";
+      items: string[];
+    };
+
+export type DemoFlow = {
+  id: string;
+  categoryLabel: string;
+  tabLabel: string;
+  title: string;
+  description: string;
+  activeAgent: { name: string; color: string };
+  agents: { name: string; desc: string; color: string }[];
+  task: string;
+  context: string;
+  output: string;
+  chatHistory: ChatMessage[];
+};
+
+export const landingDemoFlows: DemoFlow[] = [
+  {
+    id: "browser-automation",
+    categoryLabel: "Browser Automation",
+    tabLabel: "Like Twitter replies and export users",
+    title: "Like Twitter replies and export users",
+    description:
+      "Turn plain-language requests into browser actions across the tools your team already uses.",
+    activeAgent: {
+      name: "Sales Team",
+      color: "bg-[#0f9f7f]"
+    },
+    agents: [
+      {
+        name: "Sales Team",
+        desc: "Daily tasks",
+        color: "bg-[#0f9f7f]"
+      }
+    ],
+    task:
+      'Open this Twitter thread, like all the replies, and extract the user details into a CSV file.',
+    context:
+      'Ensure you scroll through the entire thread to load all replies before interacting and extracting data.',
+    output: 'Save the extracted data as "tweet_replies.csv" on my desktop.',
+    chatHistory: [
+      {
+        role: "user",
+        content:
+          "Here is a link to a tweet: https://x.com/user/status/12345. Like all the replies and save the user details to a CSV on your computer."
+      },
+      {
+        role: "timeline",
+        items: [
+          "Execution timeline 1 step - Navigates to tweet URL in browser",
+          'Execution timeline 4 steps - Scrolls to load and clicks "like" on all 42 replies',
+          "Execution timeline 2 steps - Extracts usernames and bio data",
+          'Execution timeline 1 step - Writes tweet_replies.csv to local filesystem'
+        ]
+      },
+      {
+        role: "agent",
+        content:
+          'I have successfully liked 42 replies on that thread and saved the user details to "tweet_replies.csv" on your computer. Is there anything else you need?'
+      }
+    ]
+  },
+  {
+    id: "data-analysis",
+    categoryLabel: "Data Analysis",
+    tabLabel: "Summarize Q3 revenue outliers",
+    title: "Summarize Q3 revenue outliers",
+    description:
+      "Work from Excel files or pasted spreadsheets without changing how your team already shares data.",
+    activeAgent: {
+      name: "Excel Analyst",
+      color: "bg-[#0f9f7f]"
+    },
+    agents: [
+      {
+        name: "Sales Team",
+        desc: "Daily tasks",
+        color: "bg-[#0f9f7f]"
+      }
+    ],
+    task:
+      "Analyze this Excel model even if the user uploads the file or pastes the spreadsheet directly into chat.",
+    context:
+      "Flag the biggest changes in revenue, explain the outliers, and compare each segment against plan.",
+    output:
+      "Return the findings as a clean table plus a short executive summary.",
+    chatHistory: [
+      {
+        role: "user",
+        content: "Here is the Q3_Financials.xlsx file. Find the biggest outliers."
+      },
+      {
+        role: "timeline",
+        items: [
+          "Execution timeline 1 step - Reads Q3_Financials.xlsx",
+          "Execution timeline 2 steps - Parses sheets and normalizes data",
+          "Execution timeline 1 step - Runs statistical anomaly detection"
+        ]
+      },
+      {
+        role: "agent",
+        content:
+          "I analyzed the spreadsheet and found 3 major outliers. The most significant is a 42% spike in marketing spend during August, which correlates with the new campaign launch."
+      }
+    ]
+  },
+  {
+    id: "outreach-creation",
+    categoryLabel: "Outreach Creation",
+    tabLabel: "Draft follow-up for Acme Corp",
+    title: "Draft follow-up for Acme Corp",
+    description:
+      "Turn Notion MCP context into personalized outreach, then push the final result into your CRM.",
+    activeAgent: {
+      name: "Outreach Writer",
+      color: "bg-[#d97706]"
+    },
+    agents: [
+      {
+        name: "Sales Team",
+        desc: "Daily tasks",
+        color: "bg-[#0f9f7f]"
+      }
+    ],
+    task:
+      "Draft founder outreach from our Notion workspace, then save the final message and next step into HubSpot.",
+    context:
+      "Use the Notion MCP notes for tone, product context, and the last touchpoint before writing.",
+    output: "Create the email, update the CRM record, and queue the follow-up.",
+    chatHistory: [
+      {
+        role: "user",
+        content:
+          "Draft a follow-up to Acme Corp based on our last meeting notes in Notion."
+      },
+      {
+        role: "timeline",
+        items: [
+          'Execution timeline 1 step - Queries Notion MCP for "Acme Corp meeting notes"',
+          "Execution timeline 2 steps - Extracts action items and tone preferences",
+          "Execution timeline 1 step - Generates personalized email draft"
+        ]
+      },
+      {
+        role: "agent",
+        content:
+          "I've drafted the follow-up email based on the action items from the Notion notes. It highlights the custom integration timeline we discussed. Would you like me to push this to HubSpot?"
+      }
+    ]
+  }
+];
+
+export const landingDemoFlowTimes: Record<string, string> = {
+  "browser-automation": "1s ago",
+  "data-analysis": "15m ago",
+  "outreach-creation": "22h ago"
+};
+
+export const defaultLandingDemoFlowId = landingDemoFlows[0]?.id ?? "";
diff --git a/ee/apps/landing/components/landing-enterprise-hero.tsx b/ee/apps/landing/components/landing-enterprise-hero.tsx
new file mode 100644
index 0000000000..004e16075f
--- /dev/null
+++ b/ee/apps/landing/components/landing-enterprise-hero.tsx
@@ -0,0 +1,842 @@
+"use client";
+
+import {
+  Bell,
+  Brain,
+  ChevronRight,
+  DollarSign,
+  Gauge,
+  Search,
+  Users
+} from "lucide-react";
+import { useState } from "react";
+import { OpenWorkMark } from "./openwork-mark";
+
+type Department = {
+  name: string;
+  dailyActive: string;
+  spend: string;
+  avgPerPerson: string;
+  /** Daily active users over the last 10 weekdays. */
+  trend: number[];
+  powerUsers: string[];
+};
+
+type ToolRow = {
+  tool: string;
+  penetration: string;
+  topDepartment: string;
+  topUsers: string[];
+  featured?: boolean;
+};
+
+type PowerUser = {
+  name: string;
+  initials: string;
+  department: string;
+  topTool: string;
+  /** Cumulative requests by weekday (10 weekdays). Shape reveals usage personality. */
+  trend: number[];
+  /** One-line descriptor of the usage personality (shown as tooltip). */
+  trendNote: string;
+  requests: string;
+  inputTokens: string;
+  outputTokens: string;
+  cost: string;
+};
+
+const departments: Department[] = [
+  {
+    name: "Engineering",
+    dailyActive: "48 / 82",
+    spend: "$330K",
+    avgPerPerson: "$4.1K",
+    trend: [42, 44, 43, 45, 46, 46, 47, 47, 48, 48],
+    powerUsers: ["JC", "LT", "AL", "+5"]
+  },
+  {
+    name: "Product",
+    dailyActive: "9 / 24",
+    spend: "$90K",
+    avgPerPerson: "$3.8K",
+    trend: [4, 5, 5, 4, 6, 7, 6, 8, 8, 9],
+    powerUsers: ["HL", "DG", "AR", "+1"]
+  },
+  {
+    name: "Customer Support",
+    dailyActive: "7 / 36",
+    spend: "$30K",
+    avgPerPerson: "$968",
+    trend: [3, 4, 4, 5, 5, 6, 6, 7, 7, 7],
+    powerUsers: ["MF", "SG", "RM", "+2"]
+  },
+  {
+    name: "Marketing",
+    dailyActive: "3 / 28",
+    spend: "$18K",
+    avgPerPerson: "$643",
+    trend: [1, 1, 1, 2, 1, 2, 2, 3, 3, 3],
+    powerUsers: ["RF", "AS", "JR", "+1"]
+  },
+  {
+    name: "Sales",
+    dailyActive: "1 / 25",
+    spend: "$15K",
+    avgPerPerson: "$600",
+    trend: [0, 1, 0, 0, 0, 1, 1, 0, 1, 1],
+    powerUsers: ["AC", "WB", "HF", "+2"]
+  },
+  {
+    name: "Legal",
+    dailyActive: "0 / 12",
+    spend: "$7K",
+    avgPerPerson: "$583",
+    trend: [3, 2, 2, 1, 1, 1, 0, 0, 0, 0],
+    powerUsers: ["SD", "OB", "RH", "+1"]
+  }
+];
+
+const toolRows: ToolRow[] = [
+  {
+    tool: "OpenWork",
+    penetration: "41%",
+    topDepartment: "Customer Support",
+    topUsers: ["AL", "AC", "WB"],
+    featured: true
+  },
+  {
+    tool: "Cursor",
+    penetration: "24%",
+    topDepartment: "Engineering",
+    topUsers: ["JC", "LT", "AT"]
+  },
+  {
+    tool: "Figma AI",
+    penetration: "11%",
+    topDepartment: "Product",
+    topUsers: ["HL", "RF"]
+  },
+  {
+    tool: "Notion AI",
+    penetration: "9%",
+    topDepartment: "Product",
+    topUsers: ["DG", "AS"]
+  },
+  {
+    tool: "Zendesk AI",
+    penetration: "7%",
+    topDepartment: "Customer Support",
+    topUsers: ["MF", "SG"]
+  }
+];
+
+const powerUsers: PowerUser[] = [
+  {
+    name: "John Carmack",
+    initials: "JC",
+    department: "Engineering",
+    topTool: "Zed",
+    trend: [60, 200, 290, 490, 610, 780, 860, 1080, 1260, 1400],
+    trendNote: "Deep-work bursts, quiet days in between",
+    requests: "1.4K",
+    inputTokens: "820K",
+    outputTokens: "310K",
+    cost: "$1.2K"
+  },
+  {
+    name: "Linus Torvalds",
+    initials: "LT",
+    department: "Engineering",
+    topTool: "Omarchy",
+    trend: [105, 217, 325, 440, 550, 658, 771, 881, 993, 1100],
+    trendNote: "Steady daily rhythm, every weekday the same",
+    requests: "1.1K",
+    inputTokens: "640K",
+    outputTokens: "250K",
+    cost: "$910"
+  },
+  {
+    name: "Ada Lovelace",
+    initials: "AL",
+    department: "Engineering",
+    topTool: "Hugging Face",
+    trend: [160, 300, 420, 530, 630, 720, 800, 860, 920, 960],
+    trendNote: "Early-adopter curve — curiosity cooling off",
+    requests: "960",
+    inputTokens: "540K",
+    outputTokens: "210K",
+    cost: "$780"
+  },
+  {
+    name: "Alan Turing",
+    initials: "AT",
+    department: "Engineering",
+    topTool: "Claude Code",
+    trend: [88, 176, 264, 352, 440, 528, 616, 704, 792, 880],
+    trendNote: "Scheduled automation — same batch every day",
+    requests: "880",
+    inputTokens: "500K",
+    outputTokens: "200K",
+    cost: "$690"
+  },
+  {
+    name: "Marie Curie",
+    initials: "MC",
+    department: "Engineering",
+    topTool: "OpenWork",
+    trend: [30, 70, 120, 180, 250, 330, 420, 520, 615, 680],
+    trendNote: "Learning curve — compounding every week",
+    requests: "680",
+    inputTokens: "380K",
+    outputTokens: "170K",
+    cost: "$520"
+  },
+  {
+    name: "Andrew Carnegie",
+    initials: "AC",
+    department: "Sales",
+    topTool: "OpenWork",
+    trend: [15, 35, 60, 90, 130, 190, 265, 345, 430, 510],
+    trendNote: "Late adopter — just caught the wave",
+    requests: "510",
+    inputTokens: "290K",
+    outputTokens: "140K",
+    cost: "$420"
+  },
+  {
+    name: "Warren Buffett",
+    initials: "WB",
+    department: "Sales",
+    topTool: "OpenWork",
+    trend: [40, 82, 125, 168, 210, 253, 297, 341, 386, 430],
+    trendNote: "Patient, near-identical daily habit",
+    requests: "430",
+    inputTokens: "240K",
+    outputTokens: "115K",
+    cost: "$360"
+  }
+];
+
+const peopleByInitials: Record<
+  string,
+  { name?: string; department: string }
+> = {
+  JC: { name: "John Carmack", department: "Engineering" },
+  LT: { name: "Linus Torvalds", department: "Engineering" },
+  AL: { name: "Ada Lovelace", department: "Engineering" },
+  MC: { name: "Marie Curie", department: "Engineering" },
+  AT: { name: "Alan Turing", department: "Engineering" },
+  AC: { name: "Andrew Carnegie", department: "Sales" },
+  WB: { name: "Warren Buffett", department: "Sales" },
+  HF: { name: "Henry Ford", department: "Sales" },
+  HL: { department: "Product" },
+  DG: { department: "Product" },
+  AR: { department: "Product" },
+  MF: { department: "Customer Support" },
+  SG: { department: "Customer Support" },
+  RM: { department: "Customer Support" },
+  RF: { department: "Marketing" },
+  AS: { department: "Marketing" },
+  JR: { department: "Marketing" },
+  SD: { department: "Legal" },
+  OB: { department: "Legal" },
+  RH: { department: "Legal" }
+};
+
+type TabId = "departments" | "users" | "tools";
+
+type Props = {
+  /** When true, the outer card renders its own rounded border + shadow. When false, the caller wraps it. */
+  standalone?: boolean;
+};
+
+export function LandingEnterpriseHero({ standalone = false }: Props) {
+  const [activeTab, setActiveTab] = useState<TabId>("departments");
+
+  const shell = standalone
+    ? "overflow-hidden rounded-[28px] border border-[#dde2ea] bg-[#fbfbfa] shadow-[0_18px_60px_rgba(7,25,44,0.08)]"
+    : "overflow-hidden bg-[#fbfbfa]";
+
+  const tabCopy: Record<TabId, { crumb: string; description: string }> = {
+    departments: {
+      crumb: "Departments",
+      description:
+        "Where AI usage is concentrated across the org, by team."
+    },
+    users: {
+      crumb: "Power users",
+      description:
+        "The individuals driving the most AI usage. Use them to teach the rest of the org."
+    },
+    tools: {
+      crumb: "AI tools",
+      description:
+        "The tools people reach for, who uses them most, and who to ask for access."
+    }
+  };
+
+  return (
+    <div className={shell}>
+      <MacChrome />
+
+      <div className="relative border-t border-[#e7e9f0] px-4 pb-5 pt-3 sm:px-6 md:px-8 md:pb-6 md:pt-4">
+        <div className="pointer-events-none absolute inset-x-0 top-0 h-[180px] bg-[radial-gradient(circle_at_88%_20%,rgba(122,92,255,0.1),transparent_26%),radial-gradient(circle_at_98%_28%,rgba(255,143,71,0.06),transparent_16%)]" />
+
+        <HeaderBar crumb={tabCopy[activeTab].crumb} />
+
+        <p className="relative z-10 mt-2 text-[13px] leading-6 text-[#5A6886] md:text-[14px] md:leading-6">
+          {tabCopy[activeTab].description}
+        </p>
+
+        <div className="relative z-10 mt-4 grid gap-3 md:grid-cols-3 md:gap-3.5">
+          <StatCard
+            icon={<Users className="h-5 w-5 text-[#6F3DFF]" />}
+            title="Daily active AI users"
+            value="68 / 131"
+            tone="violet"
+          />
+          <StatCard
+            icon={<DollarSign className="h-5 w-5 text-[#18A34A]" />}
+            title="Monthly spend"
+            value="$480K"
+            tone="green"
+          />
+          <StatCard
+            icon={<Gauge className="h-5 w-5 text-[#1D63FF]" />}
+            title="Top-tool penetration"
+            value="41%"
+            subvalue="OpenWork · 54 users"
+            tone="blue"
+          />
+        </div>
+
+        <div className="relative z-10 mt-4">
+          <TabBar activeTab={activeTab} onChange={setActiveTab} />
+        </div>
+
+        <div className="relative z-10 mt-3">
+          {activeTab === "departments" ? <DepartmentsTable /> : null}
+          {activeTab === "users" ? <PowerUsersTable /> : null}
+          {activeTab === "tools" ? <ToolsTable /> : null}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function MacChrome() {
+  return (
+    <div className="flex h-8 items-center gap-1.5 bg-[#f6f6f4] px-3 md:h-10 md:gap-2 md:px-4">
+      <div className="h-2.5 w-2.5 rounded-full bg-[#FF5F57]" />
+      <div className="h-2.5 w-2.5 rounded-full bg-[#FEBC2E]" />
+      <div className="h-2.5 w-2.5 rounded-full bg-[#28C840]" />
+    </div>
+  );
+}
+
+function HeaderBar({ crumb }: { crumb: string }) {
+  return (
+    <div className="relative z-10 flex flex-wrap items-center justify-between gap-3 border-b border-[#e7e9f0] pb-3">
+      <div className="flex flex-wrap items-center gap-2.5 md:gap-3">
+        <OpenWorkMark className="h-[24px] w-[30px] md:h-[26px] md:w-[33px]" />
+        <span className="inline-flex items-center rounded-[8px] bg-[#F8E8D7] px-2.5 py-0.5 text-[11px] font-semibold text-[#E56A17] md:text-[12px]">
+          Q2
+        </span>
+        <span className="text-[13px] font-medium tracking-[-0.01em] text-[#5A6886] md:text-[14px]">
+          AI Adoption
+        </span>
+        <ChevronRight className="h-3.5 w-3.5 text-[#9AA5BA]" />
+        <span className="text-[13px] font-semibold tracking-[-0.01em] text-[#07192C] md:text-[14px]">
+          {crumb}
+        </span>
+      </div>
+
+      <div className="flex items-center gap-3 text-[#30405F] md:gap-4">
+        <button
+          type="button"
+          title="Search"
+          aria-label="Search"
+          className="rounded-full p-1 transition-colors hover:bg-[#EEF2FB]"
+        >
+          <Search className="h-[18px] w-[18px] stroke-[1.8] md:h-5 md:w-5" aria-hidden="true" />
+        </button>
+        <button
+          type="button"
+          title="Notifications"
+          aria-label="Notifications"
+          className="rounded-full p-1 transition-colors hover:bg-[#EEF2FB]"
+        >
+          <Bell className="h-[18px] w-[18px] stroke-[1.8] md:h-5 md:w-5" aria-hidden="true" />
+        </button>
+        <div
+          title="Alex Garcia · Admin"
+          className="flex h-7 w-7 cursor-default items-center justify-center rounded-full bg-[#EEF2FB] text-[12px] font-medium text-[#30405F] md:h-8 md:w-8 md:text-[13px]"
+        >
+          AG
+        </div>
+      </div>
+    </div>
+  );
+}
+
+type StatCardProps = {
+  icon: React.ReactNode;
+  title: string;
+  value: string;
+  subvalue?: string;
+  tone: "violet" | "green" | "blue";
+};
+
+function StatCard({ icon, title, value, subvalue, tone }: StatCardProps) {
+  return (
+    <div className="rounded-[14px] border border-[#e3e7ee] bg-white/90 px-3.5 py-3 md:rounded-[16px] md:px-4 md:py-3.5">
+      <div className="flex items-center gap-3">
+        <div
+          className={`flex h-10 w-10 shrink-0 items-center justify-center rounded-[10px] md:h-11 md:w-11 md:rounded-[12px] ${toneBg(tone)}`}
+        >
+          {icon}
+        </div>
+
+        <div className="min-w-0">
+          <div className="text-[12px] font-medium tracking-[-0.01em] text-[#30405F] md:text-[13px]">
+            {title}
+          </div>
+          <div className="mt-0.5 text-[18px] font-semibold tracking-[-0.03em] text-[#07192C] md:text-[20px]">
+            {value}
+          </div>
+          {subvalue ? (
+            <div className="mt-0.5 truncate text-[11px] text-[#637291] md:text-[12px]">
+              {subvalue}
+            </div>
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+type TabBarProps = {
+  activeTab: TabId;
+  onChange: (tab: TabId) => void;
+};
+
+function TabBar({ activeTab, onChange }: TabBarProps) {
+  const tabs: Array<{ id: TabId; label: string }> = [
+    { id: "departments", label: "Departments" },
+    { id: "users", label: "Power users" },
+    { id: "tools", label: "AI tools" }
+  ];
+
+  return (
+    <div
+      role="tablist"
+      aria-label="Enterprise AI leaderboard"
+      className="inline-flex items-center gap-1 rounded-full border border-[#e3e7ee] bg-white/80 p-1"
+    >
+      {tabs.map((tab) => {
+        const selected = tab.id === activeTab;
+        return (
+          <button
+            key={tab.id}
+            type="button"
+            role="tab"
+            aria-selected={selected}
+            tabIndex={selected ? 0 : -1}
+            onClick={() => onChange(tab.id)}
+            className={`rounded-full px-3 py-1 text-[12px] font-medium transition-colors md:text-[13px] ${
+              selected
+                ? "bg-[#07192C] text-white"
+                : "text-[#30405F] hover:bg-[#F4F6FB] hover:text-[#07192C]"
+            }`}
+          >
+            {tab.label}
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+function DepartmentsTable() {
+  return (
+    <div
+      role="tabpanel"
+      aria-label="Departments leaderboard"
+      className="overflow-hidden rounded-[14px] border border-[#e3e7ee] bg-white/90 md:rounded-[16px]"
+    >
+      <div className="grid grid-cols-[1.2fr_0.65fr_0.55fr_0.65fr_0.85fr_1.1fr] gap-3 border-b border-[#e9edf3] px-4 py-2.5 text-[11px] font-medium text-[#5A6886] md:px-5 md:py-3 md:text-[12px]">
+        <div>Team</div>
+        <div>Daily active</div>
+        <div>Spend</div>
+        <div>Avg / person</div>
+        <div>Adoption trend</div>
+        <div>Power users</div>
+      </div>
+
+      {departments.map((row) => (
+        <div
+          key={row.name}
+          className="grid grid-cols-[1.2fr_0.65fr_0.55fr_0.65fr_0.85fr_1.1fr] items-center gap-3 border-b border-[#eef1f5] px-4 py-2.5 transition-colors last:border-b-0 hover:bg-[#F6F8FC] md:px-5 md:py-3"
+        >
+          <div className="text-[13px] font-medium tracking-[-0.01em] text-[#07192C] md:text-[14px]">
+            {row.name}
+          </div>
+          <div className="text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {row.dailyActive}
+          </div>
+          <div className="text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {row.spend}
+          </div>
+          <div className="text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {row.avgPerPerson}
+          </div>
+          <div>
+            <Sparkline
+              values={row.trend}
+              color={trendDirectionColor(row.trend)}
+              title={`${row.name} adoption: ${row.trend[0]} \u2192 ${row.trend[row.trend.length - 1]} daily active users`}
+            />
+          </div>
+          <div className="flex items-center gap-1">
+            {row.powerUsers.map((user) =>
+              user.startsWith("+") ? (
+                <span
+                  key={user}
+                  className="text-[11px] text-[#5A6886] md:text-[12px]"
+                  title={`${user.replace("+", "")} more in ${row.name}`}
+                >
+                  {user}
+                </span>
+              ) : (
+                <InitialPill
+                  key={user}
+                  department={peopleByInitials[user]?.department ?? row.name}
+                  initials={user}
+                  name={peopleByInitials[user]?.name}
+                />
+              )
+            )}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function PowerUsersTable() {
+  return (
+    <div
+      role="tabpanel"
+      aria-label="Power users leaderboard"
+      className="overflow-hidden rounded-[14px] border border-[#e3e7ee] bg-white/90 md:rounded-[16px]"
+    >
+      <div className="grid grid-cols-[1.6fr_1fr_0.85fr_0.55fr_0.7fr_0.7fr_0.6fr] gap-2 border-b border-[#e9edf3] px-4 py-2.5 text-[11px] font-medium text-[#5A6886] md:px-5 md:py-3 md:text-[12px]">
+        <div>Name</div>
+        <div>Top tool</div>
+        <div>Cumulative trend</div>
+        <div className="text-right">Requests</div>
+        <div className="text-right">In tokens</div>
+        <div className="text-right">Out tokens</div>
+        <div className="text-right">Cost</div>
+      </div>
+
+      {powerUsers.map((user) => (
+        <div
+          key={user.name}
+          className="grid grid-cols-[1.6fr_1fr_0.85fr_0.55fr_0.7fr_0.7fr_0.6fr] items-center gap-2 border-b border-[#eef1f5] px-4 py-2.5 transition-colors last:border-b-0 hover:bg-[#F6F8FC] md:px-5 md:py-3"
+        >
+          <div className="flex min-w-0 items-center gap-2.5">
+            <InitialPill
+              department={user.department}
+              initials={user.initials}
+              name={user.name}
+            />
+            <div className="min-w-0">
+              <div className="truncate text-[13px] font-medium tracking-[-0.01em] text-[#07192C] md:text-[14px]">
+                {user.name}
+              </div>
+              <div className="truncate text-[11px] text-[#637291] md:text-[12px]">
+                {user.department}
+              </div>
+            </div>
+          </div>
+
+          <div className="flex min-w-0 items-center gap-2">
+            <ToolGlyph tool={user.topTool} small />
+            <span className="truncate text-[12px] font-medium tracking-[-0.01em] text-[#07192C] md:text-[13px]">
+              {user.topTool}
+            </span>
+          </div>
+
+          <div>
+            <Sparkline
+              values={user.trend}
+              color={sparklineColor(user.department)}
+              title={`${user.trendNote} — cumulative ${user.trend[0].toLocaleString()} \u2192 ${user.trend[user.trend.length - 1].toLocaleString()} over 10 weekdays`}
+            />
+          </div>
+
+          <div className="text-right text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {user.requests}
+          </div>
+          <div className="text-right text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {user.inputTokens}
+          </div>
+          <div className="text-right text-[12px] tabular-nums text-[#30405F] md:text-[13px]">
+            {user.outputTokens}
+          </div>
+          <div className="text-right text-[12px] font-medium tabular-nums text-[#07192C] md:text-[13px]">
+            {user.cost}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function ToolsTable() {
+  return (
+    <div
+      role="tabpanel"
+      aria-label="AI tools leaderboard"
+      className="overflow-hidden rounded-[14px] border border-[#e3e7ee] bg-white/90 md:rounded-[16px]"
+    >
+      <div className="grid grid-cols-[1.4fr_0.7fr_1.2fr_1fr] gap-3 border-b border-[#e9edf3] px-4 py-2.5 text-[11px] font-medium text-[#5A6886] md:px-5 md:py-3 md:text-[12px]">
+        <div>Tool</div>
+        <div>Penetration</div>
+        <div>Top department</div>
+        <div>Power users</div>
+      </div>
+
+      {toolRows.map((row) => (
+        <div
+          key={row.tool}
+          className={`grid grid-cols-[1.4fr_0.7fr_1.2fr_1fr] items-center gap-3 border-b border-[#eef1f5] px-4 py-3 transition-colors last:border-b-0 md:px-5 md:py-3.5 ${
+            row.featured
+              ? "bg-[#EEF3FF] hover:bg-[#E3EBFE]"
+              : "hover:bg-[#F6F8FC]"
+          }`}
+        >
+          <div className="flex items-center gap-2.5">
+            <ToolGlyph tool={row.tool} />
+            <span className="truncate text-[13px] font-medium tracking-[-0.01em] text-[#07192C] md:text-[14px]">
+              {row.tool}
+            </span>
+          </div>
+          <div className="text-[13px] tabular-nums text-[#30405F] md:text-[14px]">
+            {row.penetration}
+          </div>
+          <div className="text-[13px] text-[#30405F] md:text-[14px]">
+            {row.topDepartment}
+          </div>
+          <div className="flex items-center gap-1.5">
+            {row.topUsers.map((initials) => {
+              const person = peopleByInitials[initials];
+              return (
+                <InitialPill
+                  key={initials}
+                  department={person?.department ?? row.topDepartment}
+                  initials={initials}
+                  name={person?.name}
+                />
+              );
+            })}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+type SparklineProps = {
+  values: number[];
+  color: string;
+  title?: string;
+};
+
+function Sparkline({ values, color, title }: SparklineProps) {
+  const width = 80;
+  const height = 20;
+  const padding = 2;
+
+  if (values.length === 0) return null;
+
+  const min = Math.min(...values);
+  const max = Math.max(...values);
+  const range = Math.max(max - min, 1);
+  const stepX = (width - padding * 2) / Math.max(values.length - 1, 1);
+
+  const points = values.map((v, i) => {
+    const x = padding + i * stepX;
+    const y = padding + (height - padding * 2) * (1 - (v - min) / range);
+    return `${x.toFixed(1)},${y.toFixed(1)}`;
+  });
+
+  const areaPath =
+    `M ${padding},${height - padding} ` +
+    points.map((p) => `L ${p}`).join(" ") +
+    ` L ${width - padding},${height - padding} Z`;
+
+  const linePath = `M ${points.join(" L ")}`;
+
+  const last = points[points.length - 1].split(",");
+
+  return (
+    <svg
+      viewBox={`0 0 ${width} ${height}`}
+      width={width}
+      height={height}
+      role="img"
+      aria-label={title ?? `Trend ${values[0]} to ${values[values.length - 1]}`}
+      className="block"
+    >
+      {title ? <title>{title}</title> : null}
+      <path d={areaPath} fill={color} fillOpacity="0.12" />
+      <path
+        d={linePath}
+        fill="none"
+        stroke={color}
+        strokeWidth="1.4"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+      />
+      <circle cx={last[0]} cy={last[1]} r="1.6" fill={color} />
+    </svg>
+  );
+}
+
+function ToolGlyph({ tool, small = false }: { tool: string; small?: boolean }) {
+  const sizeClass = small
+    ? "h-5 w-5 rounded-[6px]"
+    : "h-6 w-6 rounded-[7px] md:h-7 md:w-7 md:rounded-[8px]";
+
+  if (tool === "OpenWork") {
+    return (
+      <div
+        title={tool}
+        className={`flex shrink-0 items-center justify-center border border-[#d9ddeb] bg-[#fbfbfa] p-0.5 text-[#011627] ${sizeClass}`}
+      >
+        <OpenWorkMark
+          className={small ? "h-3 w-4" : "h-3.5 w-4 md:h-4 md:w-[18px]"}
+        />
+      </div>
+    );
+  }
+
+  const textSizeClass = small
+    ? "text-[10px] font-semibold"
+    : "text-[11px] font-semibold md:text-[12px]";
+
+  const iconMap: Record<string, React.ReactNode> = {
+    Cursor: <span className={textSizeClass}>C</span>,
+    "Figma AI": <span className={textSizeClass}>F</span>,
+    "Notion AI": <span className={textSizeClass}>N</span>,
+    "Zendesk AI": <span className={textSizeClass}>Z</span>,
+    Zed: <span className={textSizeClass}>Z</span>,
+    Omarchy: <span className={textSizeClass}>O</span>,
+    "Hugging Face": <span className={small ? "text-[11px]" : "text-[13px] md:text-[14px]"}>🤗</span>,
+    "Claude Code": <span className={textSizeClass}>CC</span>
+  };
+
+  return (
+    <div
+      title={tool}
+      className={`flex shrink-0 items-center justify-center border border-[#d9ddeb] bg-[#f7f8fb] text-[#30405F] ${sizeClass}`}
+    >
+      {iconMap[tool] ?? (
+        <Brain className={small ? "h-3 w-3" : "h-3.5 w-3.5"} />
+      )}
+    </div>
+  );
+}
+
+function InitialPill({
+  initials,
+  department,
+  name
+}: {
+  initials: string;
+  department: string;
+  name?: string;
+}) {
+  const tooltip = name
+    ? `${name} · ${department}`
+    : `${initials} · ${department}`;
+
+  return (
+    <div
+      title={tooltip}
+      aria-label={tooltip}
+      className={`flex h-6 w-6 shrink-0 cursor-default items-center justify-center rounded-full text-[10px] font-semibold tracking-[-0.02em] md:h-7 md:w-7 md:text-[11px] ${departmentColor(
+        department
+      )}`}
+    >
+      {initials}
+    </div>
+  );
+}
+
+function departmentColor(department: string) {
+  switch (department) {
+    case "Engineering":
+      return "bg-[#F9DADB] text-[#B43035]";
+    case "Product":
+      return "bg-[#DFEAFE] text-[#1D63FF]";
+    case "Customer Support":
+      return "bg-[#DFF5F6] text-[#127B85]";
+    case "Marketing":
+      return "bg-[#FBE6D7] text-[#E56A17]";
+    case "Sales":
+      return "bg-[#E3F4DF] text-[#2C8B39]";
+    case "Legal":
+      return "bg-[#E8EBEF] text-[#5A6886]";
+    default:
+      return "bg-[#EEF2F7] text-[#30405F]";
+  }
+}
+
+function sparklineColor(department: string) {
+  switch (department) {
+    case "Engineering":
+      return "#B43035";
+    case "Product":
+      return "#1D63FF";
+    case "Customer Support":
+      return "#127B85";
+    case "Marketing":
+      return "#E56A17";
+    case "Sales":
+      return "#2C8B39";
+    case "Legal":
+      return "#5A6886";
+    default:
+      return "#30405F";
+  }
+}
+
+/**
+ * Color the adoption trend line by direction so users can scan up/down/flat at a glance.
+ * Uses 3-point rolling averages at each end to avoid false signals on a single spiky day.
+ */
+function trendDirectionColor(trend: number[]): string {
+  if (trend.length < 3) return "#637291";
+  const startAvg = (trend[0] + trend[1] + trend[2]) / 3;
+  const endAvg = trend.slice(-3).reduce((a, b) => a + b, 0) / 3;
+  const delta = endAvg - startAvg;
+  if (delta > 0.5) return "#18A34A"; // green
+  if (delta < -0.5) return "#B43035"; // red
+  return "#637291"; // gray
+}
+
+function toneBg(tone: "violet" | "green" | "blue") {
+  switch (tone) {
+    case "violet":
+      return "bg-[#EDE4FF]";
+    case "green":
+      return "bg-[#E3F3E3]";
+    case "blue":
+      return "bg-[#E4ECFB]";
+  }
+}
+
+export default LandingEnterpriseHero;
diff --git a/ee/apps/landing/components/landing-enterprise.tsx b/ee/apps/landing/components/landing-enterprise.tsx
new file mode 100644
index 0000000000..070b7ca6ee
--- /dev/null
+++ b/ee/apps/landing/components/landing-enterprise.tsx
@@ -0,0 +1,237 @@
+"use client";
+
+import {
+  Cloud,
+  Monitor,
+  PlugZap,
+  ShieldCheck,
+  Users
+} from "lucide-react";
+import { useState } from "react";
+import { BookCallForm } from "./book-call-form";
+import { LandingAppDemoPanel } from "./landing-app-demo-panel";
+import { LandingBackground } from "./landing-background";
+import { LandingEnterpriseHero } from "./landing-enterprise-hero";
+import {
+  defaultLandingDemoFlowId,
+  landingDemoFlows,
+  landingDemoFlowTimes
+} from "./landing-demo-flows";
+import { SiteFooter } from "./site-footer";
+import { SiteNav } from "./site-nav";
+
+type Props = {
+  stars: string;
+  downloadHref: string;
+  calUrl: string;
+};
+
+const stackItems = [
+  {
+    id: "desktop",
+    title: "Desktop app",
+    description:
+      "Employees get an easy-to-use desktop app with your shared skills and plugins ready to run.",
+    icon: Monitor
+  },
+  {
+    id: "cloud",
+    title: "Cloud",
+    description:
+      "Admins set guardrails, providers, and policy controls, then deploy workflows across the organisation.",
+    icon: Cloud,
+    imageSrc: "/stack-cloud-dashboard.png"
+  },
+  {
+    id: "skill-hub",
+    title: "Skill Hub",
+    description:
+      "Publish reusable workflows and team-specific skill packs from one place.",
+    icon: PlugZap,
+    imageSrc: "/stack-skill-hub.png"
+  },
+  {
+    id: "onboarding",
+    title: "Custom onboarding",
+    description:
+      "Roll out the right tools, context, and templates for each team from day one.",
+    icon: ShieldCheck,
+    imageSrc: "/stack-custom-onboarding.png"
+  }
+];
+
+export function LandingEnterprise(props: Props) {
+  const [activeStackDemoId, setActiveStackDemoId] = useState(defaultLandingDemoFlowId);
+
+  return (
+    <div className="relative min-h-screen overflow-hidden text-[#011627]">
+      <LandingBackground />
+
+      <div className="relative z-10 flex min-h-screen flex-col items-center pb-3 pt-1 md:pb-4 md:pt-2">
+        <div className="w-full">
+          <SiteNav
+            stars={props.stars}
+            callUrl={props.calUrl}
+            downloadHref={props.downloadHref}
+            active="enterprise"
+          />
+        </div>
+
+        <main className="mx-auto flex w-full max-w-5xl flex-col gap-16 px-6 pb-24 md:gap-20 md:px-8 md:pb-28">
+          <section>
+            <div className="max-w-4xl">
+              <h1 className="mb-5 text-4xl font-medium leading-[1.1] tracking-tight md:text-5xl lg:text-6xl">
+                A privacy-first alternative to Claude Cowork<br />for your organization
+              </h1>
+
+              <p className="max-w-3xl text-lg leading-relaxed text-slate-600 md:text-xl">
+                Get your entire organisation running on shared skills, plugins,
+                and AI workflows. Bring your own LLM providers, choose from 50+
+                supported models, and integrate with LiteLLM out of the box.
+              </p>
+
+              <div className="mt-8 flex flex-col items-start gap-4 sm:flex-row sm:items-center">
+                <a
+                  href={props.calUrl || "#book"}
+                  target={props.calUrl ? "_blank" : undefined}
+                  rel={props.calUrl ? "noreferrer" : undefined}
+                  className="doc-button"
+                >
+                  Book a call
+                </a>
+                <a href="/trust" className="secondary-button">
+                  Security Review
+                </a>
+
+                <div className="flex items-center gap-2 opacity-80 sm:ml-4">
+                  <span className="text-[13px] font-medium text-gray-500">
+                    Backed by
+                  </span>
+                  <div className="flex items-center gap-1.5">
+                    <div className="flex h-[18px] w-[18px] items-center justify-center rounded-[4px] bg-[#ff6600] text-[11px] font-bold leading-none text-white">
+                      Y
+                    </div>
+                    <span className="text-[13px] font-semibold tracking-tight text-gray-600">
+                      Combinator
+                    </span>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <figure
+              aria-label="OpenWork enterprise dashboard showing AI adoption, spend, and tool penetration by department"
+              className="mt-12 overflow-hidden rounded-xl border border-gray-200 bg-white shadow-[0_24px_60px_-30px_rgba(1,22,39,0.25)] md:mt-16 lg:-mx-16 xl:-mx-32"
+            >
+              <LandingEnterpriseHero />
+            </figure>
+          </section>
+
+          <section className="space-y-6">
+            <div>
+              <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+                {stackItems.map((item) => {
+                  const Icon = item.icon;
+                  return (
+                    <div
+                      key={item.title}
+                      className="flex flex-col overflow-hidden rounded-xl border border-gray-200 bg-white"
+                    >
+                      <div className="flex h-[220px] items-center justify-center bg-gray-50/60 p-4 md:h-[280px]">
+                        {item.id === "desktop" ? (
+                          <div className="h-full w-full overflow-hidden rounded-lg border border-gray-200 bg-white">
+                            <div className="relative flex h-7 items-center border-b border-gray-100 bg-gradient-to-b from-white to-gray-50 px-3">
+                              <div className="flex gap-1.5">
+                                <div className="h-2 w-2 rounded-full bg-[#ff5f56]"></div>
+                                <div className="h-2 w-2 rounded-full bg-[#ffbd2e]"></div>
+                                <div className="h-2 w-2 rounded-full bg-[#27c93f]"></div>
+                              </div>
+                              <div className="absolute left-1/2 -translate-x-1/2 text-[10px] font-medium tracking-wide text-gray-500">
+                                OpenWork
+                              </div>
+                            </div>
+                            <div className="h-[calc(100%-1.75rem)] overflow-hidden">
+                              <div className="origin-top-left scale-[0.58]">
+                                <div className="w-[172.413793%] bg-white">
+                                  <LandingAppDemoPanel
+                                    flows={landingDemoFlows}
+                                    activeFlowId={activeStackDemoId}
+                                    onSelectFlow={setActiveStackDemoId}
+                                    timesById={landingDemoFlowTimes}
+                                  />
+                                </div>
+                              </div>
+                            </div>
+                          </div>
+                        ) : item.imageSrc ? (
+                          <img
+                            src={item.imageSrc}
+                            alt={`${item.title} interface`}
+                            className={`h-full w-full rounded-md ${
+                              item.id === "skill-hub" || item.id === "onboarding"
+                                ? "object-cover object-center scale-[1.02]"
+                                : "object-cover object-top"
+                            }`}
+                          />
+                        ) : (
+                          <div className="flex h-11 w-11 items-center justify-center rounded-2xl bg-white text-[#011627]">
+                            <Icon size={18} />
+                          </div>
+                        )}
+                      </div>
+                      <div className="border-t border-gray-100 p-5">
+                        <h4 className="text-[16px] font-medium tracking-tight text-[#011627]">
+                          {item.title}
+                        </h4>
+                        <p className="mt-1 text-[14px] text-gray-500">
+                          {item.description}
+                        </p>
+                      </div>
+                    </div>
+                  );
+                })}
+              </div>
+            </div>
+
+            <div className="grid gap-6 md:grid-cols-[minmax(0,2fr)_minmax(0,1fr)]">
+              <div className="rounded-[2rem] border border-gray-200 bg-white p-6 md:p-8">
+                <div className="mb-3 inline-flex items-center gap-2 rounded-full border border-emerald-100 bg-emerald-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-emerald-700">
+                  <ShieldCheck size={12} />
+                  Information security
+                </div>
+                <h3 className="mb-3 text-2xl font-medium tracking-tight text-[#011627]">
+                  Compliance-ready agentic workflows
+                </h3>
+                <p className="max-w-3xl text-[15px] leading-relaxed text-slate-600">
+                  OpenWork helps organizations run agentic workflows with a
+                  local-first, permission-aware architecture built for privacy,
+                  access control, and deployment flexibility across HIPAA, SOC 2
+                  Type II, ISO 27001, CCPA, and GDPR-sensitive environments.
+                </p>
+              </div>
+
+              <div className="rounded-[2rem] border border-gray-200 bg-white p-6">
+                <div className="mb-3 inline-flex items-center gap-2 rounded-full border border-blue-100 bg-blue-50 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.18em] text-blue-700">
+                  <PlugZap size={12} />
+                  Deployment
+                </div>
+                <h3 className="mb-3 text-[1.35rem] font-medium tracking-tight text-[#011627]">
+                  Self-hosted or managed
+                </h3>
+                <p className="text-[14px] leading-relaxed text-slate-600">
+                  Deploy inside your own environment or work with us on a
+                  managed rollout, with your gateway, MCP servers, skills, and
+                  internal data sources connected.
+                </p>
+              </div>
+            </div>
+
+            <BookCallForm />
+          </section>
+
+          <SiteFooter />
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/landing-home.tsx b/ee/apps/landing/components/landing-home.tsx
new file mode 100644
index 0000000000..811ab0f2f4
--- /dev/null
+++ b/ee/apps/landing/components/landing-home.tsx
@@ -0,0 +1,421 @@
+"use client";
+import { AnimatePresence, motion, useInView } from "framer-motion";
+import { Download, Users } from "lucide-react";
+import { useMemo, useRef, useState } from "react";
+
+import { LandingAppDemoPanel } from "./landing-app-demo-panel";
+import { LandingBackground } from "./landing-background";
+import { LandingCloudWorkersCard } from "./landing-cloud-workers-card";
+import {
+  defaultLandingDemoFlowId,
+  landingDemoFlows,
+  landingDemoFlowTimes
+} from "./landing-demo-flows";
+import { LandingSharePackageCard } from "./landing-share-package-card";
+import { SiteFooter } from "./site-footer";
+import { SiteNav } from "./site-nav";
+import { WaitlistForm } from "./waitlist-form";
+
+type Props = {
+  stars: string;
+  downloadHref: string;
+  callHref: string;
+  isMobileVisitor: boolean;
+};
+
+const externalLinkProps = (href: string) =>
+  /^https?:\/\//.test(href)
+    ? { rel: "noreferrer", target: "_blank" as const }
+    : {};
+
+export function LandingHome(props: Props) {
+  const [activeDemoId, setActiveDemoId] = useState(defaultLandingDemoFlowId);
+  const [activeUseCase, setActiveUseCase] = useState(0);
+  const enterpriseShowcaseRef = useRef<HTMLElement>(null);
+  const showEnterpriseShowcase = useInView(enterpriseShowcaseRef, {
+    once: true,
+    margin: "-15% 0px"
+  });
+
+  const activeDemo = useMemo(
+    () => landingDemoFlows.find((flow) => flow.id === activeDemoId) ?? landingDemoFlows[0],
+    [activeDemoId]
+  );
+
+  const callLinkProps = externalLinkProps(props.callHref);
+  const primaryCtaHref = props.isMobileVisitor
+    ? "https://app.openworklabs.com"
+    : "/download";
+  const primaryCtaLabel = props.isMobileVisitor
+    ? "Open the app"
+    : "Download for free";
+  const primaryCtaLinkProps = props.isMobileVisitor
+    ? {}
+    : externalLinkProps(primaryCtaHref);
+
+  return (
+    <div className="relative min-h-screen overflow-hidden text-[#011627]">
+      <LandingBackground />
+
+      <div className="relative z-10 flex min-h-screen flex-col items-center pb-3 pt-1 md:pb-4 md:pt-2">
+        <div className="w-full">
+          <SiteNav
+            stars={props.stars}
+            downloadHref={props.downloadHref}
+            callUrl={props.callHref}
+            mobilePrimaryHref="https://app.openworklabs.com"
+            mobilePrimaryLabel="Open app"
+            active="home"
+          />
+        </div>
+
+        <div className="mx-auto flex w-full max-w-5xl flex-col gap-16 px-6 pb-24 md:gap-20 md:px-8 md:pb-28">
+          <section className="max-w-4xl pt-8 md:pt-12">
+            <h1 className="mb-5 text-4xl font-medium leading-[1.1] tracking-tight md:text-5xl lg:text-6xl">
+              The open source Claude Cowork<br />for your team
+            </h1>
+            <p className="mb-6 max-w-4xl text-lg leading-relaxed text-gray-700 md:mb-7 md:text-xl">
+              OpenWork is the desktop app that lets you use 50+ LLMs, bring your
+              own keys, and share your setups seamlessly with your team.
+            </p>
+
+            <div className="mt-6 flex flex-col items-start gap-4 sm:flex-row sm:items-center">
+              <div className="flex w-full flex-col gap-3 sm:w-auto sm:flex-row">
+                <a
+                  href={primaryCtaHref}
+                  className="doc-button inline-flex items-center gap-2"
+                  {...primaryCtaLinkProps}
+                >
+                  {primaryCtaLabel} <Download size={18} />
+                </a>
+                <a
+                  href={props.callHref}
+                  className="secondary-button"
+                  {...callLinkProps}
+                >
+                  Contact sales
+                </a>
+              </div>
+
+              <div className="flex items-center gap-2 opacity-80 sm:ml-4">
+                <span className="text-[13px] font-medium text-gray-500">
+                  Backed by
+                </span>
+                <div className="flex items-center gap-1.5">
+                  <div className="flex h-[18px] w-[18px] items-center justify-center rounded-[4px] bg-[#ff6600] text-[11px] font-bold leading-none text-white">
+                    Y
+                  </div>
+                  <span className="text-[13px] font-semibold tracking-tight text-gray-600">
+                    Combinator
+                  </span>
+                </div>
+              </div>
+
+            </div>
+          </section>
+
+          {props.isMobileVisitor ? (
+            <section
+              id="mobile-signup"
+              className="landing-shell-soft -mt-6 rounded-xl p-6 md:hidden"
+            >
+              <div className="mb-2 text-[11px] font-semibold uppercase tracking-[0.24em] text-gray-400">
+                Mobile signup
+              </div>
+              <h2 className="mb-3 text-2xl font-medium leading-tight text-[#011627]">
+                Start on mobile. Continue on desktop.
+              </h2>
+              <p className="mb-5 text-[15px] leading-7 text-gray-600">
+                OpenWork is a desktop app. Sign up here from your phone and keep the
+                desktop install flow handy for when you switch to your computer.
+              </p>
+              <WaitlistForm contactHref={props.callHref} />
+              <p className="mt-4 text-[13px] leading-6 text-gray-500">
+                Best path on mobile: landing, signup, then download on desktop.
+              </p>
+            </section>
+          ) : null}
+
+          <section className="relative flex flex-col gap-6 overflow-hidden md:gap-8">
+            <div className="landing-shell relative flex flex-col overflow-hidden rounded-2xl">
+              <div className="relative z-20 flex h-10 w-full shrink-0 items-center border-b border-white/50 bg-gradient-to-b from-white/90 to-white/60 px-4">
+                <div className="flex gap-1.5">
+                  <div className="h-3 w-3 rounded-full border border-[#e0443e]/20 bg-[#ff5f56]/90 shadow-sm"></div>
+                  <div className="h-3 w-3 rounded-full border border-[#dea123]/20 bg-[#ffbd2e]/90 shadow-sm"></div>
+                  <div className="h-3 w-3 rounded-full border border-[#1aab29]/20 bg-[#27c93f]/90 shadow-sm"></div>
+                </div>
+                <div className="absolute left-1/2 -translate-x-1/2 text-[12px] font-medium tracking-wide text-gray-500">
+                  OpenWork
+                </div>
+              </div>
+ 
+              <div className="bg-white p-4 md:p-6">
+                <LandingAppDemoPanel
+                  flows={landingDemoFlows}
+                  activeFlowId={activeDemo.id}
+                  onSelectFlow={setActiveDemoId}
+                  timesById={landingDemoFlowTimes}
+                />
+              </div>
+
+              <div className="relative z-10 mb-4 flex w-full flex-col items-start justify-between gap-4 px-2 md:flex-row md:items-center">
+                <div className="landing-chip flex w-full flex-wrap gap-2 overflow-x-auto rounded-full p-1.5 md:w-[600px]">
+                  {landingDemoFlows.map((flow) => {
+                    const isActive = flow.id === activeDemo.id;
+
+                    return (
+                      <button
+                        key={flow.id}
+                        type="button"
+                        onClick={() => setActiveDemoId(flow.id)}
+                        aria-pressed={isActive}
+                        className={`relative cursor-pointer whitespace-nowrap rounded-full px-5 py-2 text-sm font-medium transition-colors ${
+                          isActive
+                            ? "text-[#011627]"
+                            : "text-gray-600 hover:text-gray-900"
+                        }`}
+                      >
+                        {isActive ? (
+                          <motion.div
+                            layoutId="active-pill"
+                            className="absolute inset-0 rounded-full border border-gray-100 bg-white shadow-sm"
+                            transition={{ type: "spring", stiffness: 400, damping: 30 }}
+                          />
+                        ) : null}
+                        <span className="relative z-10">{flow.categoryLabel}</span>
+                      </button>
+                    );
+                  })}
+                </div>
+
+                <div className="min-h-[44px] text-left md:text-right">
+                  <AnimatePresence mode="wait">
+                    <motion.div
+                      key={activeDemo.id}
+                      initial={{ opacity: 0, y: 5 }}
+                      animate={{ opacity: 1, y: 0 }}
+                      exit={{ opacity: 0, y: -5 }}
+                      transition={{ duration: 0.2 }}
+                    >
+                      <div className="text-lg font-medium text-[#011627]">
+                        {activeDemo.title}
+                      </div>
+                      <div className="ml-auto mt-1 max-w-md text-sm text-gray-500">
+                        {activeDemo.description}
+                      </div>
+                    </motion.div>
+                  </AnimatePresence>
+                </div>
+              </div>
+            </div>
+          </section>
+
+          <section
+            ref={enterpriseShowcaseRef}
+            className="landing-shell rounded-[2.5rem] p-8 md:p-12"
+          >
+            <div className="mb-4 flex items-center gap-2.5 text-[11px] font-semibold uppercase tracking-[0.2em] text-gray-400">
+              <Users size={18} />
+              For Teams &amp; Enterprises
+            </div>
+            <h2 className="mb-16 max-w-2xl text-3xl font-medium leading-[1.15] tracking-tight md:text-4xl lg:text-5xl">
+              Build skills, workflows, connections once.<br />Share a link. Your team runs it instantly.
+            </h2>
+
+            <div className="flex flex-col gap-12 lg:flex-row lg:gap-20">
+              <div className="flex w-full flex-col gap-10 lg:w-1/3">
+                <button
+                  type="button"
+                  className={`text-left transition-opacity ${
+                    activeUseCase === 0
+                      ? "opacity-100"
+                      : "opacity-50 hover:opacity-100"
+                  }`}
+                  onClick={() => setActiveUseCase(0)}
+                >
+                  <h3 className={`mb-2 text-xl font-medium ${
+                    activeUseCase === 0 ? "text-[#011627]" : "text-gray-800"
+                  }`}>
+                    Share everything in one link.
+                  </h3>
+                  <p className={`text-sm leading-relaxed ${
+                    activeUseCase === 0 ? "text-[#011627]" : "text-gray-600"
+                  }`}>
+                    Create skills, MCPs, plugins, and configs on your desktop.
+                    Generate a single link that packages your entire setup for
+                    your team.
+                  </p>
+                </button>
+
+                <button
+                  type="button"
+                  className={`text-left transition-opacity ${
+                    activeUseCase === 1
+                      ? "opacity-100"
+                      : "opacity-50 hover:opacity-100"
+                  }`}
+                  onClick={() => setActiveUseCase(1)}
+                >
+                  <h3 className={`mb-2 text-xl font-medium ${
+                    activeUseCase === 1 ? "text-[#011627]" : "text-gray-800"
+                  }`}>
+                    Import in one click.
+                  </h3>
+                  <p className={`text-sm leading-relaxed ${
+                    activeUseCase === 1 ? "text-[#011627]" : "text-gray-600"
+                  }`}>
+                    Your teammate opens the link and imports everything. Skills,
+                    MCPs, plugins, configs. No terminal, no setup guide, no
+                    technical knowledge needed.
+                  </p>
+                </button>
+
+                <button
+                  type="button"
+                  className={`text-left transition-opacity ${
+                    activeUseCase === 2
+                      ? "opacity-100"
+                      : "opacity-50 hover:opacity-100"
+                  }`}
+                  onClick={() => setActiveUseCase(2)}
+                >
+                  <h3 className={`mb-2 text-xl font-medium ${
+                    activeUseCase === 2 ? "text-[#011627]" : "text-gray-800"
+                  }`}>
+                    Ready to run.
+                  </h3>
+                  <p className={`text-sm leading-relaxed ${
+                    activeUseCase === 2 ? "text-[#011627]" : "text-gray-600"
+                  }`}>
+                    Everything imported. Skills already executing.
+                  </p>
+                </button>
+              </div>
+
+              <div
+                className="relative flex min-h-[400px] w-full items-center justify-center overflow-hidden rounded-3xl border border-gray-100 bg-cover bg-center p-6 lg:w-2/3 md:p-10"
+                style={{ backgroundImage: "url('/enterprise-showcase-bg.jpg')" }}
+              >
+                {showEnterpriseShowcase ? (
+                  <div className="grid w-full [&>*]:col-start-1 [&>*]:row-start-1">
+                    <motion.div
+                      animate={{ opacity: activeUseCase === 0 ? 1 : 0 }}
+                      transition={{ duration: 0.2 }}
+                      className={`z-10 flex w-full justify-center ${activeUseCase !== 0 ? "pointer-events-none" : ""}`}
+                    >
+                      <LandingSharePackageCard />
+                    </motion.div>
+                    <motion.div
+                      animate={{ opacity: activeUseCase === 1 ? 1 : 0 }}
+                      transition={{ duration: 0.2 }}
+                      className={`z-10 flex w-full justify-center ${activeUseCase !== 1 ? "pointer-events-none" : ""}`}
+                    >
+                      <LandingCloudWorkersCard />
+                    </motion.div>
+                    <motion.div
+                      animate={{ opacity: activeUseCase === 2 ? 1 : 0 }}
+                      transition={{ duration: 0.2 }}
+                      className={`z-10 flex w-full justify-center ${activeUseCase !== 2 ? "pointer-events-none" : ""}`}
+                    >
+                        <div className="flex w-full max-w-lg flex-col overflow-hidden rounded-xl border border-gray-200 bg-white shadow-sm">
+                          {/* App chrome */}
+                          <div className="flex items-center gap-3 border-b border-gray-100 bg-gray-50/80 px-4 py-2.5">
+                            <div className="flex gap-1.5">
+                              <div className="h-2.5 w-2.5 rounded-full bg-red-400/70" />
+                              <div className="h-2.5 w-2.5 rounded-full bg-yellow-400/70" />
+                              <div className="h-2.5 w-2.5 rounded-full bg-green-400/70" />
+                            </div>
+                            <div className="text-[12px] font-medium text-gray-500">OpenWork</div>
+                          </div>
+
+                          <div className="flex flex-1">
+                            {/* Sidebar */}
+                            <div className="hidden w-[180px] flex-col border-r border-gray-100 bg-gray-50/50 p-3 sm:flex">
+                              <div className="flex flex-col gap-1.5">
+                                <div className="flex items-center justify-between rounded-2xl bg-white px-2.5 py-2">
+                                  <div className="flex items-center gap-2">
+                                    <span className="h-6 w-6 rounded-full bg-gradient-to-br from-amber-400 to-orange-400" />
+                                    <span className="text-[11px] font-medium text-[#011627]">Meeting Brief</span>
+                                  </div>
+                                  <span className="text-[9px] text-green-600">Active</span>
+                                </div>
+                                <div className="flex items-center justify-between rounded-lg px-2.5 py-2">
+                                  <div className="flex items-center gap-2">
+                                    <span className="h-6 w-6 rounded-full bg-gradient-to-br from-amber-400 to-orange-400" />
+                                    <span className="text-[11px] font-medium text-gray-600">Contract Reviewer</span>
+                                  </div>
+                                </div>
+                                <div className="flex items-center justify-between rounded-lg px-2.5 py-2">
+                                  <div className="flex items-center gap-2">
+                                    <span className="h-6 w-6 rounded-full bg-gradient-to-br from-amber-400 to-orange-400" />
+                                    <span className="text-[11px] font-medium text-gray-600">Outreach CRM</span>
+                                  </div>
+                                </div>
+                              </div>
+
+                              <div className="mt-4 flex flex-col gap-1 border-t border-gray-100 pt-3">
+                                <div className="truncate rounded-2xl bg-white px-2.5 py-1.5 text-[10px] text-gray-500">
+                                  Generate brief for Acme...
+                                  <span className="ml-1 text-gray-400">1s ago</span>
+                                </div>
+                                <div className="truncate px-2.5 py-1.5 text-[10px] text-gray-400">
+                                  Review NDA draft...
+                                  <span className="ml-1">12m ago</span>
+                                </div>
+                              </div>
+                            </div>
+
+                            {/* Main content - chat */}
+                            <div className="flex flex-1 flex-col">
+                              <div className="flex flex-1 flex-col gap-4 p-4">
+                                {/* User prompt */}
+                                <div className="self-end rounded-2xl rounded-br-md bg-gray-100 px-4 py-2.5 text-[12px] leading-relaxed text-[#011627]">
+                                  Prepare a meeting brief for tomorrow&apos;s call with Acme Corp. Pull context from HubSpot and Notion.
+                                </div>
+
+                                {/* Execution timeline */}
+                                <div className="flex flex-col gap-1 pl-1">
+                                  <div className="flex items-center gap-1.5 text-[10px] text-gray-400">
+                                    <span className="text-gray-300">&rsaquo;</span> Execution 1 step — Queried HubSpot MCP for deal history
+                                  </div>
+                                  <div className="flex items-center gap-1.5 text-[10px] text-gray-400">
+                                    <span className="text-gray-300">&rsaquo;</span> Execution 2 steps — Pulled Notion meeting notes
+                                  </div>
+                                  <div className="flex items-center gap-1.5 text-[10px] text-gray-400">
+                                    <span className="text-gray-300">&rsaquo;</span> Execution 1 step — Generated brief and saved to desktop
+                                  </div>
+                                </div>
+
+                                {/* Response */}
+                                <div className="text-[12px] leading-relaxed text-[#011627]">
+                                  I&apos;ve prepared your meeting brief for the Acme Corp call. It includes deal history, recent notes, and 3 talking points.
+                                </div>
+                              </div>
+
+                              {/* Input bar */}
+                              <div className="border-t border-gray-100 p-3">
+                                <div className="flex items-center justify-between rounded-lg border border-gray-200 px-3 py-2">
+                                  <span className="text-[12px] text-gray-400">Describe your task</span>
+                                  <span className="rounded-full bg-[#011627] px-3 py-1 text-[10px] font-medium text-white">Run Task</span>
+                                </div>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                    </motion.div>
+                  </div>
+                ) : (
+                  <div className="z-10 flex w-full justify-center">
+                    <div className="landing-shell h-[320px] w-full max-w-lg rounded-xl border border-dashed border-gray-200" />
+                  </div>
+                )}
+              </div>
+            </div>
+          </section>
+
+          <SiteFooter />
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/landing-share-package-card.tsx b/ee/apps/landing/components/landing-share-package-card.tsx
new file mode 100644
index 0000000000..3c9db4d794
--- /dev/null
+++ b/ee/apps/landing/components/landing-share-package-card.tsx
@@ -0,0 +1,108 @@
+type Props = {
+  className?: string;
+};
+
+const items = [
+  { name: "Meeting Brief Generator", type: "Skill", tone: "skill" },
+  { name: "Contract Reviewer", type: "Skill", tone: "skill" },
+  { name: "Outreach CRM", type: "Skill", tone: "skill" },
+  { name: "Notion", type: "MCP", tone: "mcp" },
+  { name: "HubSpot", type: "MCP", tone: "mcp" },
+  { name: "Chrome MCP", type: "MCP", tone: "mcp" },
+] as const;
+
+const dotClass: Record<string, string> = {
+  skill: "bg-gradient-to-br from-amber-400 to-orange-400",
+  command: "bg-gradient-to-br from-violet-400 to-purple-500",
+  mcp: "bg-gradient-to-br from-teal-400 to-cyan-500",
+};
+
+function LinkIcon() {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      aria-hidden="true"
+    >
+      <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path>
+      <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path>
+    </svg>
+  );
+}
+
+export function LandingSharePackageCard(props: Props) {
+  return (
+    <div
+      className={[
+        "flex w-full max-w-lg flex-col overflow-hidden rounded-xl border border-gray-200 bg-white shadow-sm",
+        props.className,
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    >
+      {/* App chrome */}
+      <div className="flex items-center gap-3 border-b border-gray-100 bg-gray-50/80 px-4 py-2.5">
+        <div className="flex gap-1.5">
+          <div className="h-2.5 w-2.5 rounded-full bg-red-400/70" />
+          <div className="h-2.5 w-2.5 rounded-full bg-yellow-400/70" />
+          <div className="h-2.5 w-2.5 rounded-full bg-green-400/70" />
+        </div>
+        <div className="text-[12px] font-medium text-gray-500">OpenWork</div>
+      </div>
+
+      <div className="flex flex-1 flex-col gap-3 p-4 text-left md:p-5">
+        <div>
+          <div className="mb-1 text-[11px] font-semibold uppercase tracking-[0.2em] text-blue-500">
+            Workspace Template
+          </div>
+          <h3 className="text-lg font-medium tracking-tight text-[#011627]">
+            SDR for Acme Company
+          </h3>
+        </div>
+
+        <div className="text-[11px] font-semibold uppercase tracking-[0.2em] text-gray-400">
+          Included
+        </div>
+
+        <div className="flex flex-col gap-1.5">
+          {items.map((item, i) => (
+            <div
+              key={item.name}
+              className={`flex items-center gap-2.5 rounded-lg border px-3 py-2 transition-all ${
+                i === 0
+                  ? "border-blue-300 bg-blue-50/60 shadow-sm"
+                  : "border-gray-100 bg-white"
+              }`}
+            >
+              <span
+                className={`h-6 w-6 shrink-0 rounded-full ${dotClass[item.tone]}`}
+              />
+              <span className="min-w-0 flex-1">
+                <span className="block truncate text-[13px] font-medium text-[#011627]">
+                  {item.name}
+                </span>
+                <span className="block text-[11px] text-gray-500">
+                  {item.type}
+                </span>
+              </span>
+            </div>
+          ))}
+        </div>
+
+        <button
+          type="button"
+          className="flex w-full items-center justify-center gap-2 rounded-lg bg-[#011627] py-2 text-[13px] font-medium text-white shadow-[0_1px_2px_rgba(17,24,39,0.12)] transition-colors hover:bg-black"
+        >
+          <LinkIcon />
+          Generate Share Link
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/landing-trust.tsx b/ee/apps/landing/components/landing-trust.tsx
new file mode 100644
index 0000000000..6c83a5bf1b
--- /dev/null
+++ b/ee/apps/landing/components/landing-trust.tsx
@@ -0,0 +1,351 @@
+import { SiteFooter } from "./site-footer";
+import { LandingBackground } from "./landing-background";
+import { SiteNav } from "./site-nav";
+import {
+  dataHandlingRows,
+  keyFacts,
+  sectionAnchors,
+  securityContact,
+  subprocessors
+} from "./trust-content";
+
+type SharedProps = {
+  stars: string;
+  downloadHref: string;
+  calUrl: string;
+};
+
+/* ------------------------------------------------------------------ */
+/*  Shared primitives                                                 */
+/* ------------------------------------------------------------------ */
+
+function SectionHeading({ id, children }: { id: string; children: React.ReactNode }) {
+  return (
+    <h2
+      id={id}
+      className="scroll-mt-24 text-xl font-semibold tracking-tight text-[#011627]"
+    >
+      {children}
+    </h2>
+  );
+}
+
+function Bullet({ children }: { children: React.ReactNode }) {
+  return (
+    <li className="flex gap-2.5">
+      <span className="mt-[7px] h-1.5 w-1.5 shrink-0 rounded-full bg-slate-300" />
+      <span>{children}</span>
+    </li>
+  );
+}
+
+function Prose({ children }: { children: React.ReactNode }) {
+  return (
+    <p className="mt-3 text-[14px] leading-relaxed text-slate-600">{children}</p>
+  );
+}
+
+/* ------------------------------------------------------------------ */
+/*  Main component                                                    */
+/* ------------------------------------------------------------------ */
+
+export function LandingTrustOverview(props: SharedProps) {
+  const callHref = props.calUrl || "/enterprise#book";
+
+  return (
+    <div className="relative min-h-screen overflow-hidden text-[#011627]">
+      <LandingBackground />
+
+      <div className="relative z-10 flex min-h-screen flex-col items-center pb-3 pt-1 md:pb-4 md:pt-2">
+        <div className="w-full">
+          <SiteNav
+            stars={props.stars}
+            callUrl={callHref}
+            downloadHref={props.downloadHref}
+          />
+        </div>
+
+        <main className="mx-auto w-full max-w-3xl flex-1 px-6 pb-16 md:px-8">
+          {/* ── Header ── */}
+          <section className="pt-8 md:pt-12">
+            <h1 className="text-3xl font-semibold tracking-tight md:text-4xl">
+              Security &amp; Data Privacy
+            </h1>
+            <Prose>
+              OpenWork enterprise runs on your servers. We don&apos;t see your code, your API
+              keys, or your prompts. There is no hosted control plane and no
+              phone-home telemetry.
+            </Prose>
+          </section>
+
+          {/* ── On this page ── */}
+          <nav className="mt-6 flex flex-wrap gap-x-1 gap-y-1 text-[12px]">
+            {sectionAnchors.map((a, i) => (
+              <span key={a.id} className="flex items-center">
+                {i > 0 && <span className="mr-1 text-slate-300">·</span>}
+                <a
+                  href={`#${a.id}`}
+                  className="text-slate-500 underline decoration-slate-300 underline-offset-2 hover:text-[#011627]"
+                >
+                  {a.label}
+                </a>
+              </span>
+            ))}
+          </nav>
+
+          {/* ── Key Facts Grid ── */}
+          <section className="mt-8">
+            <div className="grid grid-cols-2 gap-3 md:grid-cols-3">
+              {keyFacts.map((fact) => {
+                const Icon = fact.icon;
+                return (
+                  <div
+                    key={fact.label}
+                    className="rounded-xl border border-slate-200/70 bg-white/80 p-4"
+                  >
+                    <Icon size={16} className="text-slate-400" />
+                    <div className="mt-2 text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+                      {fact.label}
+                    </div>
+                    <div className="mt-1 text-[15px] font-semibold text-[#011627]">
+                      {fact.value}
+                    </div>
+                    <div className="mt-0.5 text-[12px] text-slate-500">
+                      {fact.detail}
+                    </div>
+                  </div>
+                );
+              })}
+            </div>
+          </section>
+
+          {/* ── Deployment Model ── */}
+          <section className="mt-14">
+            <SectionHeading id="deployment">Deployment model</SectionHeading>
+            <Prose>
+              OpenWork ships as a desktop app that you host on your own servers. You
+              bring your own LLM gateway and your own auth stack. Traffic between
+              your users and their LLM provider goes direct; we don&apos;t sit in the
+              middle.
+            </Prose>
+            <ul className="mt-4 space-y-2.5 text-[14px] leading-relaxed text-slate-600">
+              <Bullet>
+                <strong>Desktop app</strong> runs on your servers. No data leaves
+                your infrastructure unless a user explicitly connects to an LLM
+                provider.
+              </Bullet>
+              <Bullet>
+                <strong>LLM gateway</strong> is your choice (LiteLLM, Cloudflare AI
+                Gateway, etc.). OpenWork doesn&apos;t proxy, store, or log API
+                traffic.
+              </Bullet>
+              <Bullet>
+                <strong>Authentication</strong> plugs into your existing SSO or SAML
+                provider.
+              </Bullet>
+            </ul>
+          </section>
+
+          {/* ── Data Handling ── */}
+          <section className="mt-14">
+            <SectionHeading id="data-handling">Data handling</SectionHeading>
+            <Prose>
+              We receive zero customer data in a self-hosted deployment.
+            </Prose>
+            <div className="mt-4 overflow-x-auto rounded-xl border border-slate-200/70">
+              <table className="w-full text-[13px]">
+                <thead>
+                  <tr className="border-b border-slate-200/70 bg-slate-50/80">
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Data type
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Self-hosted
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Cloud
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {dataHandlingRows.map((row) => (
+                    <tr
+                      key={row.dataType}
+                      className="border-b border-slate-200/70 last:border-0"
+                    >
+                      <td className="px-4 py-2.5 font-medium text-[#011627]">
+                        {row.dataType}
+                      </td>
+                      <td className="px-4 py-2.5 text-slate-600">
+                        {row.selfHosted}
+                      </td>
+                      <td className="px-4 py-2.5 text-slate-600">{row.cloud}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+          </section>
+
+          {/* ── Data Residency ── */}
+          <section className="mt-14">
+            <SectionHeading id="data-residency">Data residency</SectionHeading>
+            <Prose>
+              You pick the region, the network boundary, and the egress policy.
+              Nothing replicates outside your environment.
+            </Prose>
+            <ul className="mt-4 space-y-2.5 text-[14px] leading-relaxed text-slate-600">
+              <Bullet>
+                OpenWork doesn&apos;t impose a data region. You decide where things
+                live.
+              </Bullet>
+              <Bullet>
+                Switching your LLM provider doesn&apos;t affect where data is stored.
+                The two decisions are independent.
+              </Bullet>
+            </ul>
+          </section>
+
+          {/* ── Subprocessors ── */}
+          <section className="mt-14">
+            <SectionHeading id="subprocessors">Subprocessors</SectionHeading>
+            <Prose>
+              These vendors apply to the OpenWork website and cloud service only.
+              If you self-host, none of them touch your environment.
+            </Prose>
+            <div className="mt-4 overflow-x-auto rounded-xl border border-slate-200/70">
+              <table className="w-full text-[13px]">
+                <thead>
+                  <tr className="border-b border-slate-200/70 bg-slate-50/80">
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Vendor
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Purpose
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Category
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Region
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {subprocessors.map((sp) => (
+                    <tr
+                      key={sp.name}
+                      className="border-b border-slate-200/70 last:border-0"
+                    >
+                      <td className="px-4 py-2.5 font-medium text-[#011627]">
+                        <a
+                          href={sp.href}
+                          target="_blank"
+                          rel="noreferrer"
+                          className="underline decoration-slate-300 underline-offset-2 hover:text-slate-900"
+                        >
+                          {sp.name}
+                        </a>
+                      </td>
+                      <td className="px-4 py-2.5 text-slate-600">{sp.purpose}</td>
+                      <td className="px-4 py-2.5 text-slate-600">{sp.category}</td>
+                      <td className="px-4 py-2.5 text-slate-600">{sp.location}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+          </section>
+
+          {/* ── Incident Response ── */}
+          <section className="mt-14">
+            <SectionHeading id="incident-response">Incident response</SectionHeading>
+            <Prose>
+              Report security issues via email or GitHub issue. Our response
+              commitments:
+            </Prose>
+            <ul className="mt-4 space-y-2.5 text-[14px] leading-relaxed text-slate-600">
+              <Bullet>
+                Acknowledge receipt within <strong>3 business days</strong>
+              </Bullet>
+              <Bullet>
+                Initial triage and assessment within <strong>7 business days</strong>
+              </Bullet>
+              <Bullet>
+                Notify affected customers of any major security incident within{" "}
+                <strong>72 hours</strong>
+              </Bullet>
+            </ul>
+            <div className="mt-4 text-[13px] text-slate-500">
+              See our{" "}
+              <a
+                href="https://github.com/different-ai/openwork/blob/dev/SECURITY.md"
+                target="_blank"
+                rel="noreferrer"
+                className="underline decoration-slate-300 underline-offset-2 hover:text-[#011627]"
+              >
+                security policy
+              </a>{" "}
+              for reporting guidelines.
+            </div>
+          </section>
+
+          {/* ── Compliance ── */}
+          <section className="mt-14">
+            <SectionHeading id="compliance">Compliance</SectionHeading>
+            <div className="mt-4 overflow-x-auto rounded-xl border border-slate-200/70">
+              <table className="w-full text-[13px]">
+                <thead>
+                  <tr className="border-b border-slate-200/70 bg-slate-50/80">
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Certification
+                    </th>
+                    <th className="px-4 py-2.5 text-left font-semibold text-slate-600">
+                      Status
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr className="border-b border-slate-200/70 last:border-0">
+                    <td className="px-4 py-2.5 font-medium text-[#011627]">
+                      SOC 2 Type II
+                    </td>
+                    <td className="px-4 py-2.5 text-slate-600">In progress</td>
+                  </tr>
+                </tbody>
+              </table>
+            </div>
+            <Prose>
+              If you need a DPA or help with a vendor security questionnaire, reach
+              out below.
+            </Prose>
+          </section>
+
+          {/* ── Security Contact ── */}
+          <section className="mt-14">
+            <SectionHeading id="contact">Security contact</SectionHeading>
+            <Prose>
+              Security questions, vendor questionnaires, vulnerability reports:
+            </Prose>
+            <div className="mt-4 rounded-xl border border-slate-200/70 bg-white/80 px-4 py-3">
+              <div className="text-[14px] font-medium text-[#011627]">
+                {securityContact.name}
+              </div>
+              <a
+                href={`mailto:${securityContact.email}`}
+                className="text-[13px] text-slate-600 underline decoration-slate-300 underline-offset-2 hover:text-[#011627]"
+              >
+                {securityContact.email}
+              </a>
+            </div>
+          </section>
+
+        </main>
+
+        <div className="mx-auto w-full max-w-5xl px-6 pb-16 md:px-8">
+          <SiteFooter />
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/legal-page.tsx b/ee/apps/landing/components/legal-page.tsx
new file mode 100644
index 0000000000..22e7bcc750
--- /dev/null
+++ b/ee/apps/landing/components/legal-page.tsx
@@ -0,0 +1,50 @@
+import fs from "fs";
+import path from "path";
+import { LandingBackground } from "./landing-background";
+import { SiteFooter } from "./site-footer";
+import { SiteNav } from "./site-nav";
+import { getGithubData } from "../lib/github";
+import { renderMarkdown } from "../lib/render-markdown";
+
+interface LegalPageProps {
+  /** Path to the .md file relative to the app directory (e.g. "privacy/privacy-policy.md") */
+  file: string;
+}
+
+/**
+ * Full-page layout for legal pages. Reads a markdown file at build time
+ * and renders it with nav, footer, and prose styling. No external dependencies.
+ */
+export async function LegalPage({ file }: LegalPageProps) {
+  const github = await getGithubData();
+  const callUrl = process.env.NEXT_PUBLIC_CAL_URL || "/enterprise#book";
+
+  const raw = fs.readFileSync(
+    path.join(process.cwd(), "app", file),
+    "utf-8"
+  );
+
+  return (
+    <div className="relative min-h-screen overflow-hidden text-[#011627]">
+      <LandingBackground />
+
+      <div className="relative z-10 flex min-h-screen flex-col items-center pb-3 pt-1 md:pb-4 md:pt-2">
+        <div className="w-full">
+          <SiteNav
+            stars={github.stars}
+            callUrl={callUrl}
+            downloadHref={github.downloads.macos}
+          />
+        </div>
+
+        <main className="mx-auto flex w-full max-w-6xl flex-col gap-16 px-6 pb-24 md:gap-20 md:px-8 md:pb-28">
+          <article className="legal-prose max-w-4xl pt-6 md:pt-10">
+            {renderMarkdown(raw)}
+          </article>
+
+          <SiteFooter />
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/og-image-content.tsx b/ee/apps/landing/components/og-image-content.tsx
new file mode 100644
index 0000000000..dee1a2a803
--- /dev/null
+++ b/ee/apps/landing/components/og-image-content.tsx
@@ -0,0 +1,238 @@
+import { ChevronRight } from "lucide-react";
+
+const demoData = {
+  task: "Like Twitter replies and extract users to CSV.",
+  chatHistory: [
+    {
+      role: "user" as const,
+      content: "Like all the replies to this tweet and save the users to a CSV."
+    },
+    {
+      role: "timeline" as const,
+      items: ["Navigates to tweet URL", "Extracts bio data to tweet_replies.csv"]
+    },
+    {
+      role: "agent" as const,
+      content:
+        'I liked 42 replies and saved the data to "tweet_replies.csv" on your desktop.'
+    }
+  ]
+};
+
+export function OpenWorkLogo(props: { size?: number; titleSize?: number }) {
+  const size = props.size ?? 48;
+  const titleSize = props.titleSize ?? 36;
+
+  return (
+    <div style={{ alignItems: "center", color: "#011627", display: "flex", gap: 12 }}>
+      <svg width={size} height={(size * 38) / 48} viewBox="0 0 834 649" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <path fill="#011627" transform="scale(0.723958 0.723958)" d="M670.016 9.80456C700.542 8.39359 721.223 21.2698 746.57 35.5705L792.565 61.3465L847.289 91.9071C861.282 99.6812 879.667 108.971 891.37 119.122C910.759 135.939 922.626 160.834 923.473 186.494C924.114 205.907 923.794 226.341 923.773 245.989L923.73 349.326L923.701 452.801C923.701 491.695 925.84 526.276 916.777 564.412C907.001 605.263 886.973 642.948 858.584 673.909C826.943 708.919 799.772 720.54 759.28 742.808L656.306 799.701L556.464 854.887C526.234 871.401 510.158 884.943 474.89 886.713C445.361 888.851 423.246 874.824 398.753 861.145L348.95 833.283L297.76 804.589C284.087 796.924 267.119 788.262 255.629 778.354C235.171 760.712 222.689 733.072 221.867 706.162C221.224 685.111 221.553 662.351 221.553 641.051L221.576 517.07L221.614 408.776C221.629 379.759 220.064 344.661 226.113 316.826C233.67 282.822 249.679 251.272 272.658 225.092C284.43 211.721 297.948 199.996 312.849 190.232C333.526 176.657 361.689 162.577 384.045 150.508L488.852 93.2977L569.651 48.8522C588.06 38.5972 607.72 27.1256 626.955 18.6589C640.795 12.5669 655.03 10.7158 670.016 9.80456Z" />
+        <path fill="#ffffff" transform="scale(0.723958 0.723958)" d="M829.487 135.206C839.064 133.893 851.239 136.27 859.872 140.361C872.035 146.116 881.351 156.549 885.698 169.284C892.339 188.377 889.96 235.005 889.915 256.763L889.722 375.252L889.607 467.527C889.591 488.951 890.29 512.574 887.824 533.687C884.836 557.275 877.921 580.198 867.367 601.505C835.619 666.244 794.376 685.014 734.634 717.66L635.404 772.211L549.448 819.837C531.359 829.896 508.335 844.125 489.262 850.662C457.163 857.628 434.189 843.398 430.792 809.357C428.903 790.424 429.894 770.325 429.902 751.191L429.989 644.028L429.931 504.112C429.924 479.801 428.443 440.879 432.509 418.505C437.748 390.523 449.846 364.277 467.72 342.118C478.981 328.009 492.366 315.735 507.396 305.735C522.026 296.022 545.776 284.138 561.947 275.36L648.741 227.647L752.85 170.462C765.64 163.415 778.534 156.274 791.235 149.076C804.257 141.697 814.291 136.922 829.487 135.206Z" />
+        <path fill="#011627" transform="scale(0.723958 0.723958)" d="M752.698 267.949C792.924 267.604 788.579 308.951 788.564 336.845L788.585 395.288L788.609 477.57C788.603 494.548 789.375 516.803 786.777 533.202C783.78 551.695 776.962 569.361 766.76 585.074C758.088 598.597 747.062 610.456 734.205 620.088C724.627 627.261 714.835 632.194 704.389 637.937L666.519 658.795L610.672 689.615C599.016 695.993 580.979 707.112 568.502 709.784L568.034 709.835C559.615 710.678 551.383 709.367 544.8 703.665C532.06 692.631 532.83 674.84 532.78 659.49C532.755 651.94 532.77 644.39 532.773 636.841L532.81 567.068L532.753 492.436C532.737 472.715 531.898 447.901 535.692 428.969C539.526 409.586 548.169 391.476 560.827 376.302C567.674 368.272 575.58 361.208 584.328 355.304C593.645 349.065 605.712 342.738 615.677 337.293L663.439 311.294L705.777 287.916C719.643 280.242 736.788 269.239 752.698 267.949Z" />
+        <path fill="#ffffff" transform="scale(0.723958 0.723958)" d="M752.913 438.639L753.463 438.778C754.402 440.415 754.084 513.012 753.537 520.047C753.037 527.281 751.739 534.438 749.667 541.387C744.735 558.163 735.4 573.311 722.632 585.259C710.656 596.329 696.524 603.478 682.332 611.21L648.714 629.521L567.884 673.796L567.231 673.473C566.74 670.541 567.024 663.862 567.033 660.643L567.08 635.07C567.229 603.622 567.218 572.174 567.045 540.727C575.136 535.657 588.415 529.038 597.043 524.399L644.088 498.651L706.909 464.13C722.043 455.693 737.614 446.664 752.913 438.639Z" />
+        <path fill="#ffffff" transform="scale(0.723958 0.723958)" d="M748.561 302.532C753.088 302.142 754.018 304.969 754.273 308.994C754.978 320.091 754.665 331.35 754.632 342.482L754.729 398.185C693.808 432.288 632.619 465.911 571.168 499.05L566.544 501.649C566.412 470.288 561.729 429.298 580.961 402.878C592.009 387.702 608.244 380.226 624.28 371.42L664.102 349.529L717.771 319.55C727.609 314.034 738.563 307.565 748.561 302.532Z" />
+        <path fill="#ffffff" transform="scale(0.723958 0.723958)" d="M667.193 44.1094C680.449 43.5092 692.49 44.9422 704.362 51.1416C737.072 68.2222 768.804 87.7213 801.453 104.917C775.143 117.607 742.995 136.732 717.098 151.114L582.343 225.05C566.476 233.888 550.541 242.604 534.541 251.197C507.787 265.651 485.812 276.356 462.96 297.099C433.115 324.436 411.878 359.872 401.844 399.08C394.466 427.889 395.661 449.011 395.673 478.449L395.706 538.159L395.686 710.557L395.74 799.307C395.768 801.943 396.645 819.624 396.045 820.843L395.165 820.538L324.394 780.635C284.71 758.335 254.533 747.018 255.521 694.363C255.857 676.496 255.46 656.444 255.473 638.345L255.501 519.039L255.481 406.593C255.475 383.399 254.214 349.449 258.574 327.533C264.527 298.517 277.805 271.506 297.144 249.069C307.058 237.556 318.555 227.507 331.293 219.225C349.031 207.589 375.141 194.437 394.449 183.918L494.962 128.661L589.084 76.9263C604.628 68.3986 620.309 59.3498 636.171 51.4434C645.64 46.7238 656.691 44.9119 667.193 44.1094Z" />
+      </svg>
+      <span style={{ fontSize: titleSize, fontWeight: 600, letterSpacing: -0.7, lineHeight: 1, textTransform: "lowercase" }}>
+        OpenWork
+      </span>
+    </div>
+  );
+}
+
+export function OGImageContent() {
+  return (
+    <div
+      style={{
+        width: "100%",
+        height: "100%",
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "space-between",
+        padding: "0 64px",
+        position: "relative",
+        zIndex: 1,
+        color: "#011627",
+        fontFamily: "Inter, ui-sans-serif, system-ui, sans-serif"
+      }}
+    >
+      <div style={{ width: 500, display: "flex", flexDirection: "column", gap: 32, paddingLeft: 32 }}>
+        <OpenWorkLogo />
+
+        <div
+          style={{
+            display: "flex",
+            flexDirection: "column",
+            fontSize: 62,
+            fontWeight: 500,
+            letterSpacing: -2.2,
+            lineHeight: 1.05
+          }}
+        >
+          <div>The team layer for your</div>
+          <div style={{ display: "flex", alignItems: "baseline", gap: 12 }}>
+            existing <span style={{ fontSize: 74 }}>agent</span> setup.
+          </div>
+        </div>
+
+        <div
+          style={{
+            display: "flex",
+            alignItems: "center",
+            gap: 8,
+            padding: "14px 20px",
+            background: "rgba(255, 255, 255, 0.6)",
+            border: "1px solid rgba(229, 231, 235, 0.6)",
+            borderRadius: 9999,
+            boxShadow: "0 1px 2px rgba(15, 23, 42, 0.06)",
+            alignSelf: "flex-start",
+            marginTop: 16
+          }}
+        >
+          <span style={{ color: "#6b7280", fontSize: 15, fontWeight: 500 }}>Backed by</span>
+          <div style={{ display: "flex", alignItems: "center", gap: 8 }}>
+            <div
+              style={{
+                width: 22,
+                height: 22,
+                background: "#ff6600",
+                borderRadius: 5,
+                display: "flex",
+                alignItems: "center",
+                justifyContent: "center",
+                color: "#fff",
+                fontSize: 13,
+                fontWeight: 700,
+                lineHeight: 1
+              }}
+            >
+              Y
+            </div>
+            <span style={{ color: "#374151", fontSize: 15, fontWeight: 600, letterSpacing: -0.2 }}>
+              Combinator
+            </span>
+          </div>
+        </div>
+      </div>
+
+      <div
+        style={{
+          width: 580,
+          height: 480,
+          background: "rgba(255, 255, 255, 0.8)",
+          borderRadius: 24,
+          boxShadow: "0 20px 60px -15px rgba(0, 0, 0, 0.15)",
+          border: "1px solid rgba(255, 255, 255, 1)",
+          overflow: "hidden",
+          display: "flex",
+          flexDirection: "column",
+          transform: "translateY(48px)"
+        }}
+      >
+        <div
+          style={{
+            height: 40,
+            width: "100%",
+            background: "linear-gradient(to bottom, rgba(255,255,255,0.9), rgba(255,255,255,0.6))",
+            borderBottom: "1px solid #f3f4f6",
+            display: "flex",
+            alignItems: "center",
+            padding: "0 16px",
+            position: "relative",
+            flexShrink: 0
+          }}
+        >
+          <div style={{ display: "flex", gap: 6 }}>
+            <div style={{ width: 12, height: 12, borderRadius: 9999, background: "rgba(255, 95, 86, 0.9)", border: "1px solid rgba(224, 68, 62, 0.2)" }} />
+            <div style={{ width: 12, height: 12, borderRadius: 9999, background: "rgba(255, 189, 46, 0.9)", border: "1px solid rgba(222, 161, 35, 0.2)" }} />
+            <div style={{ width: 12, height: 12, borderRadius: 9999, background: "rgba(39, 201, 63, 0.9)", border: "1px solid rgba(26, 171, 41, 0.2)" }} />
+          </div>
+          <div style={{ position: "absolute", left: "50%", transform: "translateX(-50%)", fontSize: 12, fontWeight: 500, color: "#6b7280", letterSpacing: 0.5 }}>
+            OpenWork
+          </div>
+        </div>
+
+        <div style={{ padding: 20, flex: 1, background: "#fff", display: "flex", gap: 16 }}>
+          <div
+            style={{
+              width: 200,
+              background: "#f9fafb",
+              borderRadius: 12,
+              padding: 12,
+              display: "flex",
+              flexDirection: "column",
+              gap: 8,
+              border: "1px solid #f3f4f6",
+              flexShrink: 0
+            }}
+          >
+            <div style={{ display: "flex", alignItems: "center", gap: 12, padding: 12, background: "#fff", boxShadow: "0 1px 2px rgba(15, 23, 42, 0.06)", borderRadius: 12, border: "1px solid #f3f4f6" }}>
+              <div style={{ width: 24, height: 24, borderRadius: 9999, background: "linear-gradient(135deg, #34d399, #0f9f7f)", flexShrink: 0 }} />
+              <div style={{ display: "flex", flexDirection: "column", minWidth: 0 }}>
+                <div style={{ fontWeight: 500, fontSize: 14, color: "#011627", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }}>Sales Team</div>
+                <div style={{ fontSize: 12, color: "#6b7280", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }}>Daily tasks</div>
+              </div>
+            </div>
+
+            <div style={{ marginTop: 16, padding: "0 4px 4px" }}>
+              <div style={{ display: "flex", flexDirection: "column", gap: 4, position: "relative", paddingLeft: 12 }}>
+                <div style={{ position: "absolute", left: 0, top: 8, bottom: 8, width: 2, background: "#e5e7eb" }} />
+                <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", padding: "10px 12px", borderRadius: 12, background: "rgba(229, 231, 235, 0.5)", fontSize: 13 }}>
+                  <span style={{ marginRight: 8, color: "#374151", fontWeight: 500 }}>Twitter replies...</span>
+                  <span style={{ color: "#9ca3af" }}>1s ago</span>
+                </div>
+                <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", padding: "10px 12px", borderRadius: 12, fontSize: 13 }}>
+                  <span style={{ marginRight: 8, color: "#4b5563" }}>Q3 outliers</span>
+                  <span style={{ color: "#9ca3af" }}>15m</span>
+                </div>
+              </div>
+            </div>
+          </div>
+
+          <div
+            style={{
+              flex: 1,
+              background: "#fff",
+              borderRadius: 12,
+              display: "flex",
+              flexDirection: "column",
+              border: "1px solid #f3f4f6",
+              boxShadow: "0 1px 2px rgba(15, 23, 42, 0.06)",
+              overflow: "hidden"
+            }}
+          >
+            <div style={{ flex: 1, padding: 20, display: "flex", flexDirection: "column", gap: 24, fontSize: 14 }}>
+              {demoData.chatHistory.map((msg, idx) =>
+                msg.role === "user" ? (
+                  <div key={idx} style={{ background: "rgba(243, 244, 246, 0.8)", borderRadius: 9999, padding: "12px 20px", color: "#1f2937", alignSelf: "center", maxWidth: "85%", textAlign: "center", marginTop: 8 }}>
+                    {msg.content}
+                  </div>
+                ) : msg.role === "timeline" ? (
+                  <div key={idx} style={{ display: "flex", flexDirection: "column", gap: 12, color: "#9ca3af", fontSize: 12, marginLeft: 8 }}>
+                    {msg.items.map((item, itemIdx) => (
+                      <div key={itemIdx} style={{ display: "flex", alignItems: "center", gap: 8 }}>
+                        <ChevronRight size={12} color="#d1d5db" />
+                        <span>{item}</span>
+                      </div>
+                    ))}
+                  </div>
+                ) : (
+                  <div key={idx} style={{ color: "#1f2937", lineHeight: 1.6, marginLeft: 8, maxWidth: "95%", fontSize: 14, marginBottom: 8, fontWeight: 500 }}>
+                    {msg.content}
+                  </div>
+                )
+              )}
+            </div>
+
+            <div style={{ padding: 16, background: "#f9fafb", borderTop: "1px solid #f3f4f6", marginTop: "auto", display: "flex", flexDirection: "column" }}>
+              <div style={{ fontSize: 12, color: "#9ca3af", marginBottom: 8, padding: "0 4px" }}>Describe your task</div>
+              <div style={{ fontSize: 13, lineHeight: 1.5, color: "#011627", background: "#fff", padding: 12, borderRadius: 12, border: "1px solid #f3f4f6", boxShadow: "0 1px 2px rgba(15, 23, 42, 0.06)", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }}>
+                {demoData.task}
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/og-image.tsx b/ee/apps/landing/components/og-image.tsx
new file mode 100644
index 0000000000..4221257086
--- /dev/null
+++ b/ee/apps/landing/components/og-image.tsx
@@ -0,0 +1,21 @@
+import { OGImageContent } from "./og-image-content";
+import { ResponsiveGrain } from "./responsive-grain";
+
+export default function OGImage() {
+  return (
+    <div className="relative flex h-[630px] w-[1200px] shrink-0 items-center justify-center overflow-hidden bg-[#f6f9fc] font-sans text-[#011627]">
+      <div className="pointer-events-none absolute inset-0 z-0 mix-blend-multiply opacity-[0.45]">
+        <ResponsiveGrain
+          colors={["#f6f9fc", "#1e293b", "#334155", "#475569"]}
+          colorBack="#f6f9fc"
+          softness={1}
+          intensity={0.08}
+          noise={0.14}
+          shape="corners"
+          speed={0}
+        />
+      </div>
+      <OGImageContent />
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/opencode-logo.tsx b/ee/apps/landing/components/opencode-logo.tsx
new file mode 100644
index 0000000000..bcec67d21a
--- /dev/null
+++ b/ee/apps/landing/components/opencode-logo.tsx
@@ -0,0 +1,19 @@
+import Image from "next/image";
+
+type Props = {
+  className?: string;
+};
+
+export function OpenCodeLogo(props: Props) {
+  return (
+    <Image
+      src="/opencode-wordmark.svg"
+      alt=""
+      aria-hidden="true"
+      className={props.className}
+      width={234}
+      height={42}
+      unoptimized
+    />
+  );
+}
diff --git a/ee/apps/landing/components/openwork-mark.tsx b/ee/apps/landing/components/openwork-mark.tsx
new file mode 100644
index 0000000000..cdb0cd8b71
--- /dev/null
+++ b/ee/apps/landing/components/openwork-mark.tsx
@@ -0,0 +1,19 @@
+import Image from "next/image";
+
+type Props = {
+  className?: string;
+};
+
+export function OpenWorkMark(props: Props) {
+  return (
+    <Image
+      src="/openwork-mark.svg"
+      alt=""
+      aria-hidden="true"
+      className={props.className}
+      width={834}
+      height={649}
+      unoptimized
+    />
+  );
+}
diff --git a/ee/apps/landing/components/pricing-grid.tsx b/ee/apps/landing/components/pricing-grid.tsx
new file mode 100644
index 0000000000..3b6ce71998
--- /dev/null
+++ b/ee/apps/landing/components/pricing-grid.tsx
@@ -0,0 +1,186 @@
+"use client";
+
+import { ArrowUpRight, Cloud, Download, Shield } from "lucide-react";
+import { ResponsiveGrain } from "./responsive-grain";
+
+type PricingGridProps = {
+  callUrl: string;
+  showHeader?: boolean;
+};
+
+type PricingCard = {
+  id: string;
+  title: string;
+  price: string;
+  priceSub: string;
+  ctaLabel: string;
+  href: string;
+  external?: boolean;
+  features: Array<{ text: string; icon: typeof Download }>;
+  footer?: string;
+  gradientColors: string[];
+  gradientBack: string;
+  gradientShape: "corners" | "wave" | "dots" | "truchet" | "ripple" | "blob" | "sphere";
+  isCustomPricing?: boolean;
+};
+
+function PricingCardView({ card }: { card: PricingCard }) {
+  return (
+    <div className="flex h-full flex-col relative group">
+      {/* ── Header card ── */}
+      <div className="relative p-5 rounded-[20px] overflow-hidden mb-6 flex-shrink-0 bg-[#F4F4F4] text-gray-900 group-hover:text-white transition-colors duration-300">
+        {/* Shader layer — hidden by default, revealed on hover */}
+        <div className="absolute inset-0 opacity-0 group-hover:opacity-100 transition-opacity duration-300">
+          <ResponsiveGrain
+            colors={card.gradientColors}
+            colorBack={card.gradientBack}
+            softness={0.6}
+            intensity={0.35}
+            noise={0.06}
+            shape={card.gradientShape}
+            speed={0.4}
+          />
+          <div className="absolute inset-0 bg-black/10 mix-blend-overlay" />
+        </div>
+
+        <div className="relative z-10 flex flex-col h-full min-h-[160px] justify-between">
+          <div>
+            <div className="flex justify-between items-start mb-6">
+              <h2 className="text-[17px] font-medium tracking-tight">{card.title}</h2>
+            </div>
+
+            {card.isCustomPricing ? (
+              <div className="text-[16px] font-semibold mt-4 mb-2">{card.price}</div>
+            ) : (
+              <div className="mt-4">
+                <div className="flex items-baseline gap-1.5">
+                  <span className="text-[28px] font-semibold tracking-tight leading-none">{card.price}</span>
+                  <span className="text-[12px] font-medium text-gray-500 group-hover:text-white/80 transition-colors duration-300">
+                    {card.priceSub}
+                  </span>
+                </div>
+              </div>
+            )}
+          </div>
+
+          <a
+            href={card.href}
+            {...(card.external ? { rel: "noreferrer", target: "_blank" as const } : {})}
+            className="w-full mt-6 py-2.5 rounded-full text-[13px] font-medium bg-gray-950 text-white hover:bg-gray-900 shadow-sm transition-colors flex items-center justify-center gap-2"
+          >
+            {card.ctaLabel}
+            <ArrowUpRight size={14} />
+          </a>
+        </div>
+      </div>
+
+      {/* ── Features list ── */}
+      <div className="flex-1 pr-4">
+        <div className="flex flex-col">
+          {card.features.map((feature, idx) => {
+            const Icon = feature.icon;
+            return (
+              <div
+                key={idx}
+                className="flex items-start gap-3 py-3 border-b border-dotted border-gray-400/40 last:border-0 text-[13px] text-gray-700 font-medium"
+              >
+                <Icon className="w-[18px] h-[18px] text-gray-500 shrink-0 mt-0.5" strokeWidth={1.5} />
+                <span className="leading-snug">{feature.text}</span>
+              </div>
+            );
+          })}
+        </div>
+      </div>
+
+      {/* ── Footer ── */}
+      {card.footer ? (
+        <div className="mt-auto pt-8">
+          <div className="text-[14px] font-medium text-gray-800">{card.footer}</div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+export function PricingGrid(props: PricingGridProps) {
+  const cards: PricingCard[] = [
+    {
+      id: "solo",
+      title: "Solo",
+      price: "$0",
+      priceSub: "open source",
+      ctaLabel: "Download free",
+      href: "/download",
+      features: [
+        { text: "Open source desktop app", icon: Download },
+        { text: "macOS and Linux downloads", icon: Download },
+        { text: "Bring your own keys", icon: Download },
+      ],
+      footer: "Free forever",
+      gradientColors: ["#7C3AED", "#A855F7", "#6D28D9", "#4338CA"],
+      gradientBack: "#1E1B4B",
+      gradientShape: "wave",
+    },
+    {
+      id: "cloud-workers",
+      title: "Team starter",
+      price: "$50",
+      priceSub: "per month",
+      ctaLabel: "Start team plan",
+      href: "https://app.openworklabs.com/checkout",
+      external: true,
+      features: [
+        { text: "5 seats included", icon: Cloud },
+        { text: "API access", icon: Cloud },
+        { text: "Skill Hub Manager", icon: Cloud },
+        { text: "Bring your own LLM keys, distributed to your team", icon: Cloud },
+      ],
+      gradientColors: ["#2563EB", "#0284C7", "#0EA5E9", "#0F172A"],
+      gradientBack: "#0C1220",
+      gradientShape: "ripple",
+    },
+    {
+      id: "enterprise-license",
+      title: "Enterprise",
+      price: "Custom pricing",
+      priceSub: "",
+      isCustomPricing: true,
+      ctaLabel: "Talk to us",
+      href: props.callUrl,
+      external: /^https?:\/\//.test(props.callUrl),
+      features: [
+        { text: "Enterprise rollout support", icon: Shield },
+        { text: "Deployment guidance", icon: Shield },
+        { text: "Custom commercial terms", icon: Shield },
+      ],
+      footer: "For org-wide rollout and custom terms",
+      gradientColors: ["#F97316", "#E11D48", "#9333EA", "#4338CA"],
+      gradientBack: "#111827",
+      gradientShape: "corners",
+    },
+  ];
+
+  return (
+    <section className="grid gap-8">
+      {props.showHeader !== false ? (
+        <div className="flex flex-col gap-4 md:flex-row md:items-end md:justify-between">
+          <h2 className="text-[40px] md:text-[46px] font-medium tracking-tight text-gray-900 leading-[1.1]">
+            Pricing
+          </h2>
+        </div>
+      ) : null}
+
+      <div className="grid grid-cols-1 md:grid-cols-3 relative border-l border-t border-dotted border-gray-400/50">
+        {cards.map((card) => (
+          <div key={card.id} className="p-6 border-r border-b border-dotted border-gray-400/50 flex flex-col h-full">
+            <PricingCardView card={card} />
+          </div>
+        ))}
+      </div>
+
+      <p className="text-center text-[12px] font-medium text-gray-500">
+        Prices exclude taxes.
+      </p>
+    </section>
+  );
+}
diff --git a/ee/apps/landing/components/responsive-grain.tsx b/ee/apps/landing/components/responsive-grain.tsx
new file mode 100644
index 0000000000..f76af2ca5a
--- /dev/null
+++ b/ee/apps/landing/components/responsive-grain.tsx
@@ -0,0 +1,31 @@
+"use client";
+
+import { PaperGrainGradient } from "@openwork/ui/react";
+
+type Props = {
+  seed?: string;
+  colors: string[];
+  colorBack: string;
+  softness: number;
+  intensity: number;
+  noise: number;
+  shape: "corners" | "wave" | "dots" | "truchet" | "ripple" | "blob" | "sphere";
+  speed: number;
+  className?: string;
+};
+
+export function ResponsiveGrain(props: Props) {
+  return (
+    <PaperGrainGradient
+      className={`absolute inset-0 overflow-hidden ${props.className || ""}`}
+      seed={props.seed}
+      colors={props.colors}
+      colorBack={props.colorBack}
+      softness={props.softness}
+      intensity={props.intensity}
+      noise={props.noise}
+      shape={props.shape}
+      speed={props.speed}
+    />
+  );
+}
diff --git a/ee/apps/landing/components/site-footer.tsx b/ee/apps/landing/components/site-footer.tsx
new file mode 100644
index 0000000000..5337528d23
--- /dev/null
+++ b/ee/apps/landing/components/site-footer.tsx
@@ -0,0 +1,55 @@
+import Link from "next/link";
+import { OpenCodeLogo } from "./opencode-logo";
+
+export function SiteFooter() {
+  return (
+    <footer className="pt-10 text-sm text-gray-500">
+      <div className="flex flex-col items-start justify-between gap-6 border-t border-gray-200 pt-10 md:flex-row md:items-center">
+        <div className="flex flex-col gap-2">
+          <div className="font-medium text-gray-800">Powered by</div>
+          <a
+            href="https://opencode.ai"
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex items-center gap-3 text-gray-500 transition-colors hover:text-gray-800"
+          >
+            <OpenCodeLogo className="h-3 w-auto" />
+          </a>
+        </div>
+
+        <div className="flex flex-wrap items-center gap-4 md:gap-8">
+          <Link href="/docs" target="_blank" className="transition-colors hover:text-gray-800">
+            Docs
+          </Link>
+          <Link href="/pricing" className="transition-colors hover:text-gray-800">
+            Pricing
+          </Link>
+          <Link href="/download" className="transition-colors hover:text-gray-800">
+            Desktop
+          </Link>
+          <a
+            href="https://app.openworklabs.com"
+            target="_blank"
+            rel="noreferrer"
+            className="transition-colors hover:text-gray-800"
+          >
+            Cloud
+          </a>
+          <Link href="/enterprise" className="transition-colors hover:text-gray-800">
+            Enterprise
+          </Link>
+          <Link href="/trust" className="transition-colors hover:text-gray-800">
+            Trust Center
+          </Link>
+          <Link href="/privacy" className="transition-colors hover:text-gray-800">
+            Privacy
+          </Link>
+          <Link href="/terms" className="transition-colors hover:text-gray-800">
+            Terms
+          </Link>
+          <div>© 2026 Different AI</div>
+        </div>
+      </div>
+    </footer>
+  );
+}
diff --git a/ee/apps/landing/components/site-nav.tsx b/ee/apps/landing/components/site-nav.tsx
new file mode 100644
index 0000000000..671ed6a8bf
--- /dev/null
+++ b/ee/apps/landing/components/site-nav.tsx
@@ -0,0 +1,173 @@
+"use client";
+
+import Link from "next/link";
+import { Download, Menu, X } from "lucide-react";
+import { useEffect, useState } from "react";
+import { OpenWorkMark } from "./openwork-mark";
+
+type Props = {
+  stars: string;
+  callUrl?: string;
+  downloadHref?: string;
+  mobilePrimaryHref?: string;
+  mobilePrimaryLabel?: string;
+  active?: "home" | "pricing" | "download" | "enterprise" | "cloud" | "docs";
+};
+
+export function SiteNav(props: Props) {
+  const [mobileOpen, setMobileOpen] = useState(false);
+  const [scrolled, setScrolled] = useState(false);
+
+  useEffect(() => {
+    const onScroll = () => setScrolled(window.scrollY > 10);
+    onScroll();
+    window.addEventListener("scroll", onScroll, { passive: true });
+    return () => window.removeEventListener("scroll", onScroll);
+  }, []);
+  const callHref = props.callUrl || "/enterprise#book";
+  const downloadHref = props.downloadHref || "/download";
+  const downloadPageHref = "/download";
+  const mobilePrimaryHref = props.mobilePrimaryHref || downloadHref;
+  const mobilePrimaryLabel = props.mobilePrimaryLabel || "Desktop";
+  const callExternal = /^https?:\/\//.test(callHref);
+  const mobilePrimaryExternal = /^https?:\/\//.test(mobilePrimaryHref);
+  const navItems = [
+    { href: "/docs", label: "Docs", key: "docs", newTab: true },
+    { href: "/pricing", label: "Pricing", key: "pricing" },
+    { href: "/download", label: "Desktop", key: "download" },
+    { href: "https://app.openworklabs.com", label: "Cloud", key: "cloud" },
+    { href: "/enterprise", label: "Enterprise", key: "enterprise" }
+  ] as const;
+
+  const opensInNewTab = (item: (typeof navItems)[number]) =>
+    ("newTab" in item && item.newTab) || /^(?:https?:\/\/)/.test(item.href);
+
+  const navLink = (isActive: boolean) =>
+    isActive
+      ? "text-[#011627]"
+      : "text-gray-600 transition-colors hover:text-[#011627]";
+
+  return (
+    <header className={`sticky top-0 z-20 w-full transition-all duration-300 ${scrolled ? "bg-white/80 shadow-sm backdrop-blur-md" : ""}`}>
+      <div className="mx-auto flex max-w-5xl flex-col px-6 md:px-8">
+        <div className="grid grid-cols-[auto_1fr_auto] items-center py-4">
+          <Link
+            href="/"
+            className="group inline-flex items-center gap-1.5"
+            onClick={() => setMobileOpen(false)}
+          >
+            <OpenWorkMark className="h-[30px] w-[38px] transition-opacity group-hover:opacity-80" />
+            <span className="text-[1.2rem] font-semibold tracking-tight text-[#011627] md:text-[1.3rem]">
+              OpenWork
+            </span>
+          </Link>
+
+          <nav className="hidden items-center justify-center gap-8 text-[15px] font-medium md:flex">
+            {navItems.map(item => (
+              <Link
+                key={item.key}
+                href={item.href}
+                {...(opensInNewTab(item) ? { target: "_blank", rel: "noreferrer" } : {})}
+                className={navLink(props.active === item.key)}
+              >
+                {item.label}
+              </Link>
+            ))}
+          </nav>
+
+          <div className="flex items-center gap-4">
+            <a
+              href="https://github.com/different-ai/openwork"
+              className="hidden items-center gap-2 rounded-full border border-gray-100 bg-white px-3.5 py-2 text-sm font-medium text-gray-500 shadow-[0_1px_2px_rgba(17,24,39,0.06)] transition-colors hover:text-[#011627] sm:flex"
+              rel="noreferrer"
+              target="_blank"
+              aria-label="OpenWork GitHub stars"
+            >
+              <svg
+                className="h-4 w-4"
+                fill="currentColor"
+                viewBox="0 0 24 24"
+                aria-hidden="true"
+              >
+                <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.041-1.416-4.041-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" />
+              </svg>
+              {props.stars}
+            </a>
+            <Link
+              href={downloadPageHref}
+              className="doc-button !hidden items-center gap-2 md:!inline-flex"
+            >
+              Desktop <Download size={16} />
+            </Link>
+            <button
+              type="button"
+              className="rounded-full p-2 text-[#011627] transition-colors hover:bg-white/70 md:hidden"
+              onClick={() => setMobileOpen(current => !current)}
+              aria-expanded={mobileOpen}
+              aria-label={
+                mobileOpen ? "Close navigation menu" : "Open navigation menu"
+              }
+            >
+              {mobileOpen ? <X size={24} /> : <Menu size={24} />}
+            </button>
+          </div>
+        </div>
+
+        {mobileOpen ? (
+          <div className="landing-shell mb-8 rounded-xl p-4 md:hidden">
+            <div className="flex flex-col gap-1 text-[15px] font-medium text-gray-700">
+              {navItems.map(item => (
+                <Link
+                  key={item.key}
+                  href={item.href}
+                  {...(opensInNewTab(item) ? { target: "_blank", rel: "noreferrer" } : {})}
+                  className={`rounded-2xl px-4 py-3 ${navLink(
+                    props.active === item.key
+                  )}`}
+                  onClick={() => setMobileOpen(false)}
+                >
+                  {item.label}
+                </Link>
+              ))}
+            </div>
+
+            <div className="mt-4 flex flex-col gap-3">
+              <a
+                href={mobilePrimaryHref}
+                className="doc-button text-sm"
+                rel={mobilePrimaryExternal ? "noreferrer" : undefined}
+                target={mobilePrimaryExternal ? "_blank" : undefined}
+              >
+                {mobilePrimaryLabel}
+              </a>
+              <a
+                href={callHref}
+                className="secondary-button text-sm"
+                rel={callExternal ? "noreferrer" : undefined}
+                target={callExternal ? "_blank" : undefined}
+              >
+                Book a call
+              </a>
+              <a
+                href="https://github.com/different-ai/openwork"
+                className="inline-flex items-center justify-center gap-2 rounded-lg border border-gray-100 bg-white px-4 py-2 text-sm font-medium text-gray-500 shadow-[0_1px_2px_rgba(17,24,39,0.06)] transition-colors hover:text-[#011627]"
+                rel="noreferrer"
+                target="_blank"
+              >
+                <svg
+                  className="h-4 w-4"
+                  fill="currentColor"
+                  viewBox="0 0 24 24"
+                  aria-hidden="true"
+                >
+                  <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.041-1.416-4.041-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" />
+                </svg>
+                GitHub {props.stars}
+              </a>
+            </div>
+          </div>
+        ) : null}
+      </div>
+    </header>
+  );
+}
diff --git a/ee/apps/landing/components/structured-data.tsx b/ee/apps/landing/components/structured-data.tsx
new file mode 100644
index 0000000000..52deee09b0
--- /dev/null
+++ b/ee/apps/landing/components/structured-data.tsx
@@ -0,0 +1,12 @@
+type StructuredDataProps = {
+  data: Record<string, unknown> | Array<Record<string, unknown>>;
+};
+
+export function StructuredData({ data }: StructuredDataProps) {
+  return (
+    <script
+      type="application/ld+json"
+      dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}
+    />
+  );
+}
diff --git a/ee/apps/landing/components/trust-content.tsx b/ee/apps/landing/components/trust-content.tsx
new file mode 100644
index 0000000000..22484e4a7a
--- /dev/null
+++ b/ee/apps/landing/components/trust-content.tsx
@@ -0,0 +1,170 @@
+import {
+  Building2,
+  Clock,
+  HardDrive,
+  KeyRound,
+  Shield,
+  Users,
+  type LucideIcon
+} from "lucide-react";
+
+/* ------------------------------------------------------------------ */
+/*  Key facts — the at-a-glance grid at the top of the page           */
+/* ------------------------------------------------------------------ */
+
+export type KeyFact = {
+  label: string;
+  value: string;
+  detail: string;
+  icon: LucideIcon;
+};
+
+export const keyFacts: KeyFact[] = [
+  {
+    label: "Deployment",
+    value: "Self-hosted",
+    detail: "Desktop app on your servers",
+    icon: Building2
+  },
+  {
+    label: "Data storage",
+    value: "Local-only",
+    detail: "Nothing leaves your machine",
+    icon: HardDrive
+  },
+  {
+    label: "LLM keys",
+    value: "Bring your own",
+    detail: "Direct to your provider",
+    icon: KeyRound
+  },
+  {
+    label: "Telemetry",
+    value: "None",
+    detail: "Opt-in feedback only",
+    icon: Shield
+  },
+  {
+    label: "Incident SLA",
+    value: "72hr notify",
+    detail: "3-day ack · 7-day triage",
+    icon: Clock
+  },
+  {
+    label: "Subprocessors",
+    value: "5 named vendors",
+    detail: "Cloud & website only",
+    icon: Users
+  }
+];
+
+/* ------------------------------------------------------------------ */
+/*  Data handling table                                               */
+/* ------------------------------------------------------------------ */
+
+export type DataHandlingRow = {
+  dataType: string;
+  selfHosted: string;
+  cloud: string;
+};
+
+export const dataHandlingRows: DataHandlingRow[] = [
+  {
+    dataType: "Source code",
+    selfHosted: "Local only. Never leaves your machine.",
+    cloud: "Not stored by OpenWork. Accessed at runtime through your LLM provider."
+  },
+  {
+    dataType: "LLM API keys",
+    selfHosted: "Local keychain or environment variables",
+    cloud: "Held by your LLM provider, not by OpenWork"
+  },
+  {
+    dataType: "Prompts & responses",
+    selfHosted: "Local only",
+    cloud: "Sent to your LLM provider. Not logged by OpenWork."
+  },
+  {
+    dataType: "Usage telemetry",
+    selfHosted: "None",
+    cloud: "Anonymous, via PostHog; can be disabled"
+  },
+  {
+    dataType: "Authentication",
+    selfHosted: "Your SSO / SAML provider",
+    cloud: "Google or GitHub OAuth"
+  }
+];
+
+/* ------------------------------------------------------------------ */
+/*  Subprocessors                                                     */
+/* ------------------------------------------------------------------ */
+
+export type Subprocessor = {
+  name: string;
+  purpose: string;
+  category: string;
+  location: string;
+  href: string;
+};
+
+export const subprocessors: Subprocessor[] = [
+  {
+    name: "PostHog",
+    purpose: "Anonymous website analytics and product telemetry",
+    category: "Analytics",
+    location: "US / EU",
+    href: "https://posthog.com"
+  },
+  {
+    name: "Polar",
+    purpose: "Subscription billing and payment processing",
+    category: "Payments",
+    location: "US",
+    href: "https://polar.sh"
+  },
+  {
+    name: "Google",
+    purpose: "OAuth sign-in and authentication services",
+    category: "Authentication",
+    location: "US",
+    href: "https://google.com"
+  },
+  {
+    name: "GitHub",
+    purpose: "OAuth sign-in and source code hosting",
+    category: "Authentication",
+    location: "US",
+    href: "https://github.com"
+  },
+  {
+    name: "Daytona",
+    purpose: "Virtual sandbox infrastructure for the Cloud Service",
+    category: "Infrastructure",
+    location: "EU",
+    href: "https://daytona.io"
+  }
+];
+
+/* ------------------------------------------------------------------ */
+/*  Section anchors (for the "On this page" nav)                      */
+/* ------------------------------------------------------------------ */
+
+export const sectionAnchors = [
+  { id: "deployment", label: "Deployment model" },
+  { id: "data-handling", label: "Data handling" },
+  { id: "data-residency", label: "Data residency" },
+  { id: "subprocessors", label: "Subprocessors" },
+  { id: "incident-response", label: "Incident response" },
+  { id: "compliance", label: "Compliance" },
+  { id: "contact", label: "Security contact" }
+];
+
+/* ------------------------------------------------------------------ */
+/*  Security contact                                                  */
+/* ------------------------------------------------------------------ */
+
+export const securityContact = {
+  name: "Omar McAdam",
+  email: "team+security@openworklabs.com"
+};
diff --git a/ee/apps/landing/components/waitlist-form.tsx b/ee/apps/landing/components/waitlist-form.tsx
new file mode 100644
index 0000000000..139d5e25fc
--- /dev/null
+++ b/ee/apps/landing/components/waitlist-form.tsx
@@ -0,0 +1,32 @@
+type Props = {
+  contactHref?: string;
+};
+
+export function WaitlistForm(props: Props) {
+  const href = props.contactHref || "/enterprise#book";
+
+  return (
+    <div className="flex flex-wrap items-center gap-3">
+      <a href={href} className="doc-button">
+        Contact sales
+        <svg
+          className="h-4 w-4"
+          fill="none"
+          stroke="currentColor"
+          viewBox="0 0 24 24"
+          aria-hidden="true"
+        >
+          <path
+            strokeLinecap="round"
+            strokeLinejoin="round"
+            strokeWidth="2"
+            d="M14 5l7 7m0 0l-7 7m7-7H3"
+          />
+        </svg>
+      </a>
+      <p className="text-[13px] text-gray-500">
+        Cloud signup is temporarily paused while we onboard teams directly.
+      </p>
+    </div>
+  );
+}
diff --git a/ee/apps/landing/components/webmcp-provider.tsx b/ee/apps/landing/components/webmcp-provider.tsx
new file mode 100644
index 0000000000..4feb497680
--- /dev/null
+++ b/ee/apps/landing/components/webmcp-provider.tsx
@@ -0,0 +1,175 @@
+"use client"
+
+import { useEffect } from "react"
+
+type ModelContext = {
+  provideContext: (context: { tools: Tool[] }) => void | Promise<void>
+}
+
+type Tool = {
+  name: string
+  description: string
+  inputSchema: Record<string, unknown>
+  execute: (args: Record<string, unknown>) => unknown | Promise<unknown>
+}
+
+const destinations: Record<string, string> = {
+  home: "/",
+  download: "/download",
+  pricing: "/pricing",
+  enterprise: "/enterprise",
+  cloud: "https://app.openworklabs.com",
+  docs: "/docs",
+  trust: "/trust",
+  feedback: "/feedback",
+}
+
+const pricingSummary = {
+  plans: [
+    {
+      id: "solo",
+      name: "Solo",
+      price: "$0",
+      cadence: "free forever",
+      highlights: [
+        "Open-source desktop app",
+        "macOS, Windows, Linux downloads",
+        "Bring your own provider keys",
+      ],
+      cta: { label: "Download", href: "/download" },
+    },
+    {
+      id: "team-starter",
+      name: "Team Starter",
+      price: "$50",
+      cadence: "per month",
+      highlights: [
+        "5 seats included",
+        "API access",
+        "Skill Hub Manager",
+        "Bring your own LLM keys, distributed to your team",
+      ],
+      cta: { label: "Start team plan", href: "https://app.openworklabs.com/checkout" },
+    },
+    {
+      id: "enterprise",
+      name: "Enterprise",
+      price: "custom",
+      cadence: "contact us",
+      highlights: [
+        "Enterprise rollout support",
+        "Deployment guidance",
+        "Custom commercial terms",
+      ],
+      cta: { label: "Talk to us", href: "/enterprise#book" },
+    },
+  ],
+  notes: "Prices exclude taxes.",
+}
+
+const downloadLinks = {
+  page: "https://openworklabs.com/download",
+  githubReleases: "https://github.com/different-ai/openwork/releases/latest",
+  platforms: {
+    macos: {
+      page: "https://openworklabs.com/download#macos",
+      note: "Electron Apple Silicon (.dmg) and Intel (.dmg) builds resolved from the latest GitHub release.",
+    },
+    windows: {
+      page: "https://openworklabs.com/download#windows",
+      note: "Electron x64 .exe installer resolved from the latest GitHub release.",
+    },
+    linux: {
+      page: "https://openworklabs.com/download#linux",
+      note: "Electron AppImage and tar.gz builds for x64 and arm64.",
+    },
+  },
+}
+
+const tools: Tool[] = [
+  {
+    name: "navigate_to",
+    description:
+      "Navigate the current tab to a key section of openworklabs.com. Use this when the user expresses intent to view pricing, download, enterprise, cloud, docs, trust, or feedback.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        destination: {
+          type: "string",
+          enum: Object.keys(destinations),
+          description: "The named section to navigate to.",
+        },
+      },
+      required: ["destination"],
+      additionalProperties: false,
+    },
+    execute: async (args) => {
+      const key = String(args.destination ?? "")
+      const href = destinations[key]
+      if (!href) {
+        return { ok: false, error: `unknown destination: ${key}` }
+      }
+      if (typeof window !== "undefined") {
+        window.location.assign(href)
+      }
+      return { ok: true, href }
+    },
+  },
+  {
+    name: "open_enterprise_contact",
+    description:
+      "Navigate to the Enterprise page and scroll to the book-a-call section. Use this when the user wants to talk to sales or needs SSO, audit, or procurement support.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+    execute: async () => {
+      if (typeof window !== "undefined") {
+        window.location.assign("/enterprise#book")
+      }
+      return { ok: true, href: "/enterprise#book" }
+    },
+  },
+  {
+    name: "get_pricing_summary",
+    description:
+      "Return OpenWork's pricing tiers, what each includes, and the CTA destination. Read-only; does not navigate.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+    execute: async () => pricingSummary,
+  },
+  {
+    name: "get_download_links",
+    description:
+      "Return the canonical download page URLs per platform plus the GitHub releases URL. Use this to tell the user where to get the desktop app. Read-only; does not navigate.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+    execute: async () => downloadLinks,
+  },
+]
+
+export function WebMcpProvider() {
+  useEffect(() => {
+    const nav = typeof navigator === "undefined" ? null : (navigator as Navigator & { modelContext?: ModelContext })
+    const modelContext = nav?.modelContext
+    if (!modelContext || typeof modelContext.provideContext !== "function") return
+
+    try {
+      const result = modelContext.provideContext({ tools })
+      if (result && typeof (result as Promise<unknown>).catch === "function") {
+        ;(result as Promise<unknown>).catch(() => {})
+      }
+    } catch {
+      // Silently ignore: WebMCP is best-effort.
+    }
+  }, [])
+
+  return null
+}
diff --git a/ee/apps/landing/lib/agent-markdown.ts b/ee/apps/landing/lib/agent-markdown.ts
new file mode 100644
index 0000000000..bd2cae8736
--- /dev/null
+++ b/ee/apps/landing/lib/agent-markdown.ts
@@ -0,0 +1,155 @@
+const home = `# OpenWork
+
+> The open-source Claude Cowork alternative. OpenWork is a desktop app that lets teams chat with 50+ LLMs, bring their own provider keys, and ship reusable agent setups with guardrails.
+
+## What it is
+
+- Desktop app (macOS, Windows, Linux) — GUI for OpenCode
+- Bring your own model and provider (OpenAI, Anthropic, local models, 50+ supported)
+- Skills, plugins, and MCP servers extend what the agent can do
+- Shared agent setups for teams, with policy and guardrails
+- Free and open source
+
+## Primary calls-to-action
+
+- **Try it free** — [Download the desktop app](https://openworklabs.com/download)
+- **Hosted cloud workers** — [Pricing](https://openworklabs.com/pricing) (\\$50/mo per worker)
+- **Sign in to the hosted workspace** — [Cloud](https://app.openworklabs.com)
+- **SSO / audit / procurement** — [Enterprise](https://openworklabs.com/enterprise)
+- **Docs** — [openworklabs.com/docs](https://openworklabs.com/docs)
+
+## For agents
+
+- Agent skills index — \`/.well-known/agent-skills/index.json\`
+- llms.txt — \`/llms.txt\`
+- API catalog (RFC 9727) — \`/.well-known/api-catalog\`
+- Sitemap — \`/sitemap.xml\`
+
+Backed by Y Combinator.
+`
+
+const pricing = `# OpenWork pricing — free, team, and enterprise
+
+> OpenWork has three tiers: free open-source desktop, \\$50/mo Team Starter, and custom Enterprise.
+
+## Solo — \\$0
+
+- Open-source desktop app
+- macOS, Windows, Linux downloads
+- Bring your own provider keys
+- Free forever
+- CTA: [Download](https://openworklabs.com/download)
+
+## Team Starter — \\$50 / month
+
+- 5 seats included
+- API access
+- Skill Hub Manager
+- Bring your own LLM keys, distributed to your team
+- CTA: [Start team plan](https://app.openworklabs.com/checkout)
+
+## Enterprise — Custom pricing
+
+- Enterprise rollout support
+- Deployment guidance
+- Custom commercial terms
+- For org-wide rollout and custom terms
+- CTA: [Talk to us](https://openworklabs.com/enterprise#book)
+
+Prices exclude taxes.
+`
+
+const enterprise = `# A privacy-first alternative to Claude Cowork for your organization
+
+> The open-source Claude Cowork alternative — self-hosted, permissioned, and compliance-ready. SSO, audit, custom deployment, and procurement support.
+
+## What Enterprise includes
+
+- Enterprise rollout support and deployment guidance
+- Custom commercial terms
+- SSO / SAML integration
+- Audit logs and policy controls
+- Named security contact and incident response
+
+## Deployment models
+
+- Self-hosted desktop app — data stays local, bring your own keys
+- Cloud workers — managed by OpenWork, sandbox infrastructure via Daytona (EU)
+
+## Next step
+
+- [Book a call](https://openworklabs.com/enterprise#book)
+- [Security Review](https://openworklabs.com/trust) — data handling, subprocessors, and incident SLA
+- See [Pricing](https://openworklabs.com/pricing) for tier comparison
+`
+
+const download = `# Download OpenWork
+
+> Desktop app for macOS, Windows, and Linux. Latest release published on GitHub.
+
+## macOS
+
+- **Apple Silicon (M-series)** — recommended for M1/M2/M3/M4. \`.dmg\`
+- **Intel (x64)** — for Intel-based Macs. \`.dmg\`
+
+## Windows
+
+- **x64** — Electron ".exe" installer
+
+## Linux
+
+- **AppImage** — Electron build for x64 and arm64
+- **Tarball** — Electron \`.tar.gz\` build for x64 and arm64
+
+Direct download URLs resolve from the latest GitHub release. Browse all assets at [github.com/openworklabs/openwork/releases/latest](https://github.com/openworklabs/openwork/releases/latest).
+
+## After installing
+
+Once the desktop app is running, use the [workspace-guide skill](https://openworklabs.com/.well-known/agent-skills/workspace-guide/SKILL.md) for first-run orientation.
+`
+
+const trust = `# Trust & Security
+
+> How OpenWork handles data, what subprocessors are involved, and how to reach the security team.
+
+## Key facts
+
+- **Deployment** — self-hosted desktop app on your machines
+- **Data storage** — local-only, nothing leaves your machine in desktop mode
+- **LLM keys** — bring your own, sent directly to your provider
+- **Telemetry** — none in desktop mode; opt-in feedback only
+- **Incident SLA** — 72hr notify, 3-day ack, 7-day triage
+- **Subprocessors** — 5 named vendors (cloud & website only)
+
+## Data handling
+
+| Data type | Self-hosted | Cloud |
+|---|---|---|
+| Source code | Local only | Accessed at runtime via your LLM provider; not stored |
+| LLM API keys | Local keychain / env vars | Held by your LLM provider, not by OpenWork |
+| Prompts & responses | Local only | Sent to your LLM provider; not logged by OpenWork |
+| Usage telemetry | None | Anonymous via PostHog; can be disabled |
+| Authentication | Your SSO / SAML | Google or GitHub OAuth |
+
+## Subprocessors
+
+- PostHog — analytics (US/EU)
+- Polar — billing (US)
+- Google — OAuth (US)
+- GitHub — OAuth (US)
+- Daytona — cloud sandbox infrastructure (EU)
+
+## Security contact
+
+Omar McAdam — team+security@openworklabs.com
+`
+
+export const agentMarkdown: Record<string, string> = {
+  "/": home,
+  "/pricing": pricing,
+  "/enterprise": enterprise,
+  "/download": download,
+  "/trust": trust,
+}
+
+export const agentMarkdownRoutes = Object.keys(agentMarkdown)
diff --git a/ee/apps/landing/lib/github.ts b/ee/apps/landing/lib/github.ts
new file mode 100644
index 0000000000..ff603fb5ad
--- /dev/null
+++ b/ee/apps/landing/lib/github.ts
@@ -0,0 +1,168 @@
+type ReleaseAsset = {
+  name?: string;
+  browser_download_url?: string;
+};
+
+type Release = {
+  draft?: boolean;
+  prerelease?: boolean;
+  html_url?: string;
+  tag_name?: string;
+  assets?: ReleaseAsset[];
+};
+
+type Repo = {
+  stargazers_count?: number;
+};
+
+const FALLBACK_RELEASE = "https://github.com/different-ai/openwork/releases";
+
+const formatCompact = (value: number) => {
+  try {
+    return new Intl.NumberFormat("en", {
+      notation: "compact",
+      maximumFractionDigits: 1
+    }).format(value);
+  } catch {
+    return String(value);
+  }
+};
+
+const selectAsset = (
+  assets: ReleaseAsset[],
+  extensions: string[],
+  keywords: string[] = []
+) => {
+  const matches = assets.filter((asset) => {
+    if (!asset?.name || !asset?.browser_download_url) return false;
+    const name = asset.name.toLowerCase();
+    const extensionMatch = extensions.some((ext) => name.endsWith(ext));
+    const keywordMatch =
+      keywords.length === 0 || keywords.some((key) => name.includes(key));
+    return extensionMatch && keywordMatch;
+  });
+
+  if (matches.length === 0) return null;
+
+  return (
+    matches.find((asset) => asset.name?.toLowerCase().includes("adhoc")) ||
+    matches.find((asset) => asset.name?.toLowerCase().includes("universal")) ||
+    matches.find((asset) => asset.name?.toLowerCase().includes("aarch64")) ||
+    matches.find((asset) => asset.name?.toLowerCase().includes("arm64")) ||
+    matches[0]
+  );
+};
+
+const fetchJson = async <T,>(url: string): Promise<T | null> => {
+  try {
+    const response = await fetch(url, {
+      headers: {
+        Accept: "application/vnd.github+json"
+      },
+      next: { revalidate: 60 * 60 }
+    });
+
+    if (!response.ok) return null;
+    return (await response.json()) as T;
+  } catch {
+    return null;
+  }
+};
+
+export const getGithubData = async () => {
+  const [repo, releases] = await Promise.all([
+    fetchJson<Repo>("https://api.github.com/repos/different-ai/openwork"),
+    fetchJson<Release[]>(
+      "https://api.github.com/repos/different-ai/openwork/releases?per_page=50"
+    )
+  ]);
+
+  const stars =
+    typeof repo?.stargazers_count === "number"
+      ? formatCompact(repo.stargazers_count)
+      : "—";
+
+  const releaseList = Array.isArray(releases) ? releases : [];
+  const hasDownloadAsset = (release: Release) => {
+    const assets = Array.isArray(release?.assets) ? release.assets : [];
+    return assets.some((asset) => asset?.browser_download_url);
+  };
+  const isElectronDesktopAsset = (name: string) =>
+    name.startsWith("openwork-mac-") ||
+    name.startsWith("openwork-win-") ||
+    name.startsWith("openwork-linux-");
+
+  const hasWindowsDesktopAsset = (release: Release) => {
+    const assets = Array.isArray(release?.assets) ? release.assets : [];
+    return assets.some((asset) => {
+      const name = String(asset?.name || "").toLowerCase();
+      return name.startsWith("openwork-win-x64-") && name.endsWith(".exe");
+    });
+  };
+
+  const isStableDesktopRelease = (release: Release) => {
+    if (!release || release.draft || release.prerelease) return false;
+    const tag = String(release.tag_name || "").trim();
+    if (!/^v\d+\.\d+\.\d+([.-][0-9A-Za-z.-]+)?$/.test(tag)) return false;
+    const assets = Array.isArray(release.assets) ? release.assets : [];
+    return assets.some((asset) => {
+      const name = String(asset?.name || "").toLowerCase();
+      return isElectronDesktopAsset(name);
+    });
+  };
+
+  const pick =
+    releaseList.find((release) => isStableDesktopRelease(release)) ||
+    releaseList.find((release) => !release?.draft && hasDownloadAsset(release));
+
+  const windowsPick =
+    releaseList.find((release) => isStableDesktopRelease(release) && hasWindowsDesktopAsset(release)) ||
+    releaseList.find((release) => !release?.draft && hasWindowsDesktopAsset(release));
+
+  const assets = Array.isArray(pick?.assets) ? pick.assets : [];
+  const releaseUrl = pick?.html_url || FALLBACK_RELEASE;
+  const windowsAssets = Array.isArray(windowsPick?.assets) ? windowsPick.assets : assets;
+  const windowsReleaseUrl = windowsPick?.html_url || releaseUrl;
+  const dmg = selectAsset(assets, [".dmg"], ["openwork-mac-"]);
+  const exe = selectAsset(windowsAssets, [".exe"], ["openwork-win-"]);
+  const macosApple = selectAsset(assets, [".dmg"], ["mac-arm64"]);
+  const macosIntel = selectAsset(assets, [".dmg"], ["mac-x64"]);
+  const windowsX64 =
+    selectAsset(windowsAssets, [".exe"], ["win-x64"]) || exe;
+
+  const linuxAppImageX64 =
+    selectAsset(assets, [".appimage"], ["linux-x86_64"]) ||
+    selectAsset(assets, [".appimage"], ["linux-x64"]);
+  const linuxAppImageArm64 = selectAsset(assets, [".appimage"], ["linux-arm64"]);
+  const linuxTarX64 = selectAsset(assets, [".tar.gz"], ["linux-x64"]);
+  const linuxTarArm64 = selectAsset(assets, [".tar.gz"], ["linux-arm64"]);
+
+  return {
+    stars,
+    releaseUrl,
+    releaseTag: pick?.tag_name || "",
+    downloads: {
+      macos: dmg?.browser_download_url || FALLBACK_RELEASE,
+      windows: exe?.browser_download_url || FALLBACK_RELEASE,
+      linux:
+        linuxAppImageX64?.browser_download_url ||
+        linuxTarX64?.browser_download_url ||
+        FALLBACK_RELEASE
+    },
+    installers: {
+      macos: {
+        appleSilicon: macosApple?.browser_download_url || dmg?.browser_download_url || releaseUrl,
+        intel: macosIntel?.browser_download_url || dmg?.browser_download_url || releaseUrl
+      },
+      windows: {
+        x64: windowsX64?.browser_download_url || windowsReleaseUrl
+      },
+      linux: {
+        appImageX64: linuxAppImageX64?.browser_download_url || releaseUrl,
+        appImageArm64: linuxAppImageArm64?.browser_download_url || releaseUrl,
+        tarX64: linuxTarX64?.browser_download_url || releaseUrl,
+        tarArm64: linuxTarArm64?.browser_download_url || releaseUrl
+      }
+    }
+  };
+};
diff --git a/ee/apps/landing/lib/render-markdown.tsx b/ee/apps/landing/lib/render-markdown.tsx
new file mode 100644
index 0000000000..641eb76a59
--- /dev/null
+++ b/ee/apps/landing/lib/render-markdown.tsx
@@ -0,0 +1,159 @@
+import { ReactNode } from "react";
+
+/**
+ * Minimal markdown-to-JSX renderer for legal pages.
+ * Supports: headings, bold, links, lists, blockquotes, horizontal rules, paragraphs.
+ * No external dependencies.
+ */
+
+/** Render inline markdown (bold, links) within a text string. */
+function renderInline(text: string): ReactNode {
+  // Split on **bold**, [text](url), and bare URLs
+  const parts: ReactNode[] = [];
+  const regex =
+    /(\*\*(.+?)\*\*)|(\[([^\]]+)\]\(([^)]+)\))|(https?:\/\/[^\s,)<>]+[^\s,)<>.;:])|([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/g;
+  let lastIndex = 0;
+  let match;
+
+  while ((match = regex.exec(text)) !== null) {
+    if (match.index > lastIndex) {
+      parts.push(text.slice(lastIndex, match.index));
+    }
+
+    if (match[1]) {
+      // **bold**
+      parts.push(
+        <strong key={match.index} className="font-semibold text-[#011627]">
+          {match[2]}
+        </strong>
+      );
+    } else if (match[3]) {
+      // [text](url)
+      const href = match[5];
+      const isExternal = href.startsWith("http");
+      parts.push(
+        <a
+          key={match.index}
+          href={href}
+          {...(isExternal ? { target: "_blank", rel: "noreferrer" } : {})}
+        >
+          {match[4]}
+        </a>
+      );
+    } else if (match[6]) {
+      // bare URL
+      parts.push(
+        <a key={match.index} href={match[6]} target="_blank" rel="noreferrer">
+          {match[6]}
+        </a>
+      );
+    } else if (match[7]) {
+      // email
+      parts.push(
+        <a key={match.index} href={`mailto:${match[7]}`}>
+          {match[7]}
+        </a>
+      );
+    }
+
+    lastIndex = match.index + match[0].length;
+  }
+
+  if (lastIndex < text.length) {
+    parts.push(text.slice(lastIndex));
+  }
+
+  return parts.length === 1 ? parts[0] : parts;
+}
+
+/** Parse a markdown string and return React elements. */
+export function renderMarkdown(md: string): ReactNode {
+  const lines = md.split("\n");
+  const elements: ReactNode[] = [];
+  let i = 0;
+  let key = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Blank line — skip
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+
+    // Headings
+    const headingMatch = line.match(/^(#{1,3})\s+(.+)$/);
+    if (headingMatch) {
+      const level = headingMatch[1].length;
+      const text = headingMatch[2];
+      if (level === 1) {
+        elements.push(<h1 key={key++}>{renderInline(text)}</h1>);
+      } else if (level === 2) {
+        elements.push(<h2 key={key++}>{renderInline(text)}</h2>);
+      } else {
+        elements.push(<h3 key={key++}>{renderInline(text)}</h3>);
+      }
+      i++;
+      continue;
+    }
+
+    // Horizontal rule
+    if (/^---+$/.test(line.trim())) {
+      elements.push(<hr key={key++} />);
+      i++;
+      continue;
+    }
+
+    // Blockquote — collect consecutive > lines
+    if (line.startsWith(">")) {
+      const bqLines: string[] = [];
+      while (i < lines.length && lines[i].startsWith(">")) {
+        bqLines.push(lines[i].replace(/^>\s?/, ""));
+        i++;
+      }
+      elements.push(
+        <blockquote key={key++}>
+          {renderMarkdown(bqLines.join("\n"))}
+        </blockquote>
+      );
+      continue;
+    }
+
+    // List — collect consecutive - lines
+    if (line.match(/^\s*-\s/)) {
+      const items: string[] = [];
+      while (i < lines.length && lines[i].match(/^\s*-\s/)) {
+        items.push(lines[i].replace(/^\s*-\s/, ""));
+        i++;
+      }
+      elements.push(
+        <ul key={key++}>
+          {items.map((item, j) => (
+            <li key={j}>{renderInline(item)}</li>
+          ))}
+        </ul>
+      );
+      continue;
+    }
+
+    // Paragraph — collect consecutive non-blank, non-special lines
+    const paraLines: string[] = [];
+    while (
+      i < lines.length &&
+      lines[i].trim() !== "" &&
+      !lines[i].match(/^#{1,3}\s/) &&
+      !lines[i].match(/^\s*-\s/) &&
+      !lines[i].startsWith(">") &&
+      !/^---+$/.test(lines[i].trim())
+    ) {
+      paraLines.push(lines[i]);
+      i++;
+    }
+    if (paraLines.length > 0) {
+      elements.push(<p key={key++}>{renderInline(paraLines.join(" "))}</p>);
+    }
+  }
+
+  return elements;
+}
diff --git a/ee/apps/landing/lib/seo.ts b/ee/apps/landing/lib/seo.ts
new file mode 100644
index 0000000000..3c27cb421c
--- /dev/null
+++ b/ee/apps/landing/lib/seo.ts
@@ -0,0 +1,6 @@
+export const baseOpenGraph = {
+  type: "website" as const,
+  siteName: "OpenWork",
+  locale: "en_US",
+  images: ["/og-image-clean.png"]
+};
diff --git a/ee/apps/landing/middleware.ts b/ee/apps/landing/middleware.ts
new file mode 100644
index 0000000000..edd2d0fbed
--- /dev/null
+++ b/ee/apps/landing/middleware.ts
@@ -0,0 +1,79 @@
+import { NextResponse, type NextRequest } from "next/server"
+import { agentMarkdown } from "./lib/agent-markdown"
+
+export const config = {
+  matcher: ["/", "/pricing", "/enterprise", "/download", "/trust"],
+}
+
+export function middleware(request: NextRequest) {
+  const accept = request.headers.get("accept") ?? ""
+  const pathname = request.nextUrl.pathname
+  const body = agentMarkdown[pathname]
+
+  if (!body || !prefersMarkdown(accept)) {
+    const passthrough = NextResponse.next()
+    passthrough.headers.set("Vary", "Accept")
+    return passthrough
+  }
+
+  const tokens = estimateTokens(body)
+  return new NextResponse(body, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/markdown; charset=utf-8",
+      "Content-Length": String(new TextEncoder().encode(body).byteLength),
+      Vary: "Accept",
+      "Cache-Control": "public, max-age=300, stale-while-revalidate=86400",
+      "Access-Control-Allow-Origin": "*",
+      "X-Markdown-Tokens": String(tokens),
+    },
+  })
+}
+
+function prefersMarkdown(accept: string): boolean {
+  const offers = parseAccept(accept)
+  if (offers.length === 0) return false
+  const markdown = bestMatch(offers, ["text/markdown", "text/x-markdown"])
+  if (!markdown) return false
+  const html = bestMatch(offers, ["text/html", "application/xhtml+xml"])
+  if (!html) return true
+  return markdown.q > html.q
+}
+
+type Offer = { type: string; q: number }
+
+function parseAccept(accept: string): Offer[] {
+  return accept
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => {
+      const [type, ...params] = part.split(";").map((p) => p.trim())
+      let q = 1
+      for (const param of params) {
+        const [k, v] = param.split("=").map((s) => s.trim())
+        if (k === "q" && v) {
+          const parsed = Number(v)
+          if (Number.isFinite(parsed)) q = parsed
+        }
+      }
+      return { type: type.toLowerCase(), q }
+    })
+}
+
+function bestMatch(offers: Offer[], candidates: string[]): Offer | undefined {
+  let best: Offer | undefined
+  for (const offer of offers) {
+    const matches =
+      candidates.includes(offer.type) ||
+      offer.type === "*/*" ||
+      (offer.type.endsWith("/*") && candidates.some((c) => c.startsWith(offer.type.slice(0, -1))))
+    if (!matches) continue
+    if (!best || offer.q > best.q) best = offer
+  }
+  return best
+}
+
+function estimateTokens(text: string): number {
+  return Math.ceil(text.length / 4)
+}
diff --git a/ee/apps/landing/next-env.d.ts b/ee/apps/landing/next-env.d.ts
new file mode 100644
index 0000000000..40c3d68096
--- /dev/null
+++ b/ee/apps/landing/next-env.d.ts
@@ -0,0 +1,5 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
diff --git a/ee/apps/landing/next.config.js b/ee/apps/landing/next.config.js
new file mode 100644
index 0000000000..129520f056
--- /dev/null
+++ b/ee/apps/landing/next.config.js
@@ -0,0 +1,51 @@
+const { withBotId } = require("botid/next/config");
+
+/** @type {import('next').NextConfig} */
+const mintlifyOrigin = "https://differentai.mintlify.dev";
+
+const nextConfig = {
+  reactStrictMode: true,
+  transpilePackages: ["@openwork/ui"],
+  async rewrites() {
+    return [
+      {
+        source: "/docs",
+        destination: `${mintlifyOrigin}/docs`,
+      },
+      {
+        source: "/docs/:match*",
+        destination: `${mintlifyOrigin}/docs/:match*`,
+      },
+    ];
+  },
+  async headers() {
+    return [
+      {
+        source: "/",
+        headers: [
+          {
+            key: "Link",
+            value:
+              '</docs>; rel="service-doc", </.well-known/agent-skills/index.json>; rel="https://agentskills.io/rel/index", </.well-known/api-catalog>; rel="api-catalog"; type="application/linkset+json"',
+          },
+        ],
+      },
+      {
+        source: "/.well-known/agent-skills/index.json",
+        headers: [
+          { key: "Content-Type", value: "application/json" },
+          { key: "Access-Control-Allow-Origin", value: "*" },
+        ],
+      },
+      {
+        source: "/.well-known/agent-skills/:path*/SKILL.md",
+        headers: [
+          { key: "Content-Type", value: "text/markdown; charset=utf-8" },
+          { key: "Access-Control-Allow-Origin", value: "*" },
+        ],
+      },
+    ];
+  },
+};
+
+module.exports = withBotId(nextConfig);
diff --git a/ee/apps/landing/package.json b/ee/apps/landing/package.json
new file mode 100644
index 0000000000..64adbe47f4
--- /dev/null
+++ b/ee/apps/landing/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "@openwork-ee/landing",
+  "private": true,
+  "version": "0.0.0",
+  "scripts": {
+    "dev": "OPENWORK_DEV_MODE=1 next dev --hostname 0.0.0.0",
+    "prebuild": "pnpm --dir ../../../packages/ui build",
+    "build": "next build",
+    "start": "next start --hostname 0.0.0.0",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "@openwork/ui": "workspace:*",
+    "botid": "^1.5.11",
+    "framer-motion": "^12.35.1",
+    "lucide-react": "^0.577.0",
+    "next": "14.2.35",
+    "react": "18.2.0",
+    "react-dom": "18.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "20.12.12",
+    "@types/react": "18.2.79",
+    "@types/react-dom": "18.2.25",
+    "autoprefixer": "10.4.19",
+    "postcss": "8.4.38",
+    "tailwindcss": "3.4.7",
+    "typescript": "5.4.5"
+  }
+}
diff --git a/ee/apps/landing/postcss.config.js b/ee/apps/landing/postcss.config.js
new file mode 100644
index 0000000000..5cbc2c7d87
--- /dev/null
+++ b/ee/apps/landing/postcss.config.js
@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {}
+  }
+};
diff --git a/ee/apps/landing/pr/trust-page-overview.png b/ee/apps/landing/pr/trust-page-overview.png
new file mode 100644
index 0000000000..a4ec9042f6
Binary files /dev/null and b/ee/apps/landing/pr/trust-page-overview.png differ
diff --git a/ee/apps/landing/public/.well-known/agent-skills/index.json b/ee/apps/landing/public/.well-known/agent-skills/index.json
new file mode 100644
index 0000000000..7e43b45350
--- /dev/null
+++ b/ee/apps/landing/public/.well-known/agent-skills/index.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://agentskills.io/schemas/v0.2.0/index.json",
+  "skills": [
+    {
+      "name": "workspace-guide",
+      "type": "skill",
+      "description": "Workspace guide to introduce OpenWork and onboard new users.",
+      "url": "https://openworklabs.com/.well-known/agent-skills/workspace-guide/SKILL.md",
+      "sha256": "3ac4a29e608decea652bed0aa0280b43d628f84cef6485bcb76de7cbfc655a69"
+    }
+  ]
+}
diff --git a/ee/apps/landing/public/.well-known/agent-skills/workspace-guide/SKILL.md b/ee/apps/landing/public/.well-known/agent-skills/workspace-guide/SKILL.md
new file mode 100644
index 0000000000..24feaaae3f
--- /dev/null
+++ b/ee/apps/landing/public/.well-known/agent-skills/workspace-guide/SKILL.md
@@ -0,0 +1,47 @@
+---
+name: workspace-guide
+description: Workspace guide to introduce OpenWork and onboard new users.
+---
+
+# Welcome to OpenWork
+
+Hi, I'm Ben and this is OpenWork. It's an open-source alternative to Claude's cowork. It helps you work on your files with AI and automate the mundane tasks so you don't have to.
+
+Before we start, use the question tool to ask:
+"Are you more technical or non-technical? I'll tailor the explanation."
+
+## If the person is non-technical
+OpenWork feels like a chat app, but it can safely work with the files you allow. Put files in this workspace and I can summarize them, create new ones, or help organize them.
+
+Try:
+- "Summarize the files in this workspace."
+- "Create a checklist for my week."
+- "Draft a short summary from this document."
+
+## Skills and plugins (simple)
+Skills add new capabilities. Plugins add advanced features like scheduling or browser automation. We can add them later when you're ready.
+
+## If the person is technical
+OpenWork is a GUI for OpenCode. Everything that works in OpenCode works here.
+
+Most reliable setup today:
+1) Install OpenCode from opencode.ai
+2) Configure providers there (models and API keys)
+3) Come back to OpenWork and start a session
+
+Skills:
+- Install from the Skills tab, or add them to this workspace.
+- Docs: https://opencode.ai/docs/skills
+
+Plugins:
+- Configure in opencode.json or use the Plugins tab.
+- Docs: https://opencode.ai/docs/plugins/
+
+MCP servers:
+- Add external tools via opencode.json.
+- Docs: https://opencode.ai/docs/mcp-servers/
+
+Config reference:
+- Docs: https://opencode.ai/docs/config/
+
+End with two friendly next actions to try in OpenWork.
diff --git a/ee/apps/landing/public/app-demo.mp4 b/ee/apps/landing/public/app-demo.mp4
new file mode 100644
index 0000000000..cc27fa2da4
Binary files /dev/null and b/ee/apps/landing/public/app-demo.mp4 differ
diff --git a/ee/apps/landing/public/enterprise-hero.png b/ee/apps/landing/public/enterprise-hero.png
new file mode 100644
index 0000000000..374d8f626b
Binary files /dev/null and b/ee/apps/landing/public/enterprise-hero.png differ
diff --git a/ee/apps/landing/public/enterprise-showcase-bg.jpg b/ee/apps/landing/public/enterprise-showcase-bg.jpg
new file mode 100644
index 0000000000..be64cbcd79
Binary files /dev/null and b/ee/apps/landing/public/enterprise-showcase-bg.jpg differ
diff --git a/ee/apps/landing/public/enterprise-showcase-bg.png b/ee/apps/landing/public/enterprise-showcase-bg.png
new file mode 100644
index 0000000000..11b31cc2f5
Binary files /dev/null and b/ee/apps/landing/public/enterprise-showcase-bg.png differ
diff --git a/ee/apps/landing/public/fonts/FKRasterRomanCompact-Blended.woff2 b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Blended.woff2
new file mode 100644
index 0000000000..b036c9fb7d
Binary files /dev/null and b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Blended.woff2 differ
diff --git a/ee/apps/landing/public/fonts/FKRasterRomanCompact-Rounded.woff2 b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Rounded.woff2
new file mode 100644
index 0000000000..72cb8424c0
Binary files /dev/null and b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Rounded.woff2 differ
diff --git a/ee/apps/landing/public/fonts/FKRasterRomanCompact-Sharp.woff2 b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Sharp.woff2
new file mode 100644
index 0000000000..e2e1fc0591
Binary files /dev/null and b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Sharp.woff2 differ
diff --git a/ee/apps/landing/public/fonts/FKRasterRomanCompact-Smooth.woff2 b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Smooth.woff2
new file mode 100644
index 0000000000..46a871f1f7
Binary files /dev/null and b/ee/apps/landing/public/fonts/FKRasterRomanCompact-Smooth.woff2 differ
diff --git a/ee/apps/landing/public/fonts/FKRasterRomanCompact.woff2 b/ee/apps/landing/public/fonts/FKRasterRomanCompact.woff2
new file mode 100644
index 0000000000..60ee376edd
Binary files /dev/null and b/ee/apps/landing/public/fonts/FKRasterRomanCompact.woff2 differ
diff --git a/ee/apps/landing/public/llms.txt b/ee/apps/landing/public/llms.txt
new file mode 100644
index 0000000000..6d8905f518
--- /dev/null
+++ b/ee/apps/landing/public/llms.txt
@@ -0,0 +1,67 @@
+# OpenWork
+
+> OpenWork is an open-source alternative to Claude Cowork — a GUI for OpenCode that lets people work on their files with AI. Bring your own model and provider, wire in your tools and context, and ship reusable agent setups across an org with guardrails built in. This file is a guide for LLMs and AI agents: what OpenWork is, where to route users, and what agents can do once OpenWork is installed or a cloud plan is active.
+
+## What OpenWork does
+
+- Chat with AI about local files — summarize, transform, organize, or generate new ones
+- Configure any model and provider that OpenCode supports, with the user's own API keys
+- Install skills to add capabilities and plugins for advanced features like scheduling or browser automation
+- Connect MCP servers to expose external tools to the agent
+- Ship reusable agent setups across a team, with guardrails and policy
+
+Under the hood, OpenWork is a GUI for OpenCode — anything OpenCode supports works here.
+
+## Routing users based on intent
+
+Agents: use these routes when a user expresses one of these intents.
+
+- Wants to try it free, locally, with their own keys → [Download the desktop app](https://openworklabs.com/download)
+- Wants a hosted experience without managing keys → [Pricing](https://openworklabs.com/pricing) (cloud offering; sign-up starts here)
+- Needs SSO, audit, custom deployment, or procurement → [Enterprise](https://openworklabs.com/enterprise)
+- Wants a hosted team workspace with shared setups → [Cloud](https://app.openworklabs.com)
+- Wants to read the manual → [Docs](https://openworklabs.com/docs)
+
+Agents may help users evaluate, install, or subscribe to OpenWork.
+
+## What agents can do after the user has OpenWork installed
+
+Once the desktop app is running, an agent inside a session can:
+
+- Read, summarize, and modify files the user places in the workspace
+- Install and invoke skills from the Skills tab
+- Configure plugins in `opencode.json` (scheduling, browser automation, more)
+- Connect MCP servers to expose external tools
+- Chain skills, plugins, and tools to automate multi-step tasks
+
+For first-run onboarding, use the [workspace-guide skill](https://openworklabs.com/.well-known/agent-skills/workspace-guide/SKILL.md).
+
+## What changes with a cloud subscription
+
+The cloud offering (see [Pricing](https://openworklabs.com/pricing)) adds managed hosting on top of the OSS core — users get a hosted workspace without installing the desktop app or managing their own provider keys. Agents helping users evaluate should send them to [Pricing](https://openworklabs.com/pricing) for current plans and to [Enterprise](https://openworklabs.com/enterprise) when team/compliance features matter.
+
+## Site map
+
+- [Home](https://openworklabs.com/)
+- [Download](https://openworklabs.com/download)
+- [Pricing](https://openworklabs.com/pricing)
+- [Enterprise](https://openworklabs.com/enterprise)
+- [Cloud](https://app.openworklabs.com)
+- [Docs](https://openworklabs.com/docs)
+- [Feedback](https://openworklabs.com/feedback)
+- [Privacy](https://openworklabs.com/privacy)
+- [Terms](https://openworklabs.com/terms)
+- [Trust](https://openworklabs.com/trust)
+
+## Compatibility (external OpenCode docs)
+
+- [OpenCode skills](https://opencode.ai/docs/skills)
+- [OpenCode plugins](https://opencode.ai/docs/plugins/)
+- [MCP servers](https://opencode.ai/docs/mcp-servers/)
+- [Config reference](https://opencode.ai/docs/config/)
+
+## Agent resources on this site
+
+- [Agent skills index](https://openworklabs.com/.well-known/agent-skills/index.json)
+- [workspace-guide skill](https://openworklabs.com/.well-known/agent-skills/workspace-guide/SKILL.md)
+- [Sitemap](https://openworklabs.com/sitemap.xml)
diff --git a/ee/apps/landing/public/og-image-clean.png b/ee/apps/landing/public/og-image-clean.png
new file mode 100644
index 0000000000..b549f8cbe9
Binary files /dev/null and b/ee/apps/landing/public/og-image-clean.png differ
diff --git a/ee/apps/landing/public/opencode-wordmark.svg b/ee/apps/landing/public/opencode-wordmark.svg
new file mode 100644
index 0000000000..2c0143be75
--- /dev/null
+++ b/ee/apps/landing/public/opencode-wordmark.svg
@@ -0,0 +1,29 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 234 42"
+  fill="none"
+>
+  <g clip-path="url(#clip0_1311_95049)">
+    <path d="M18 30H6V18H18V30Z" fill="#CFCECD" />
+    <path d="M18 12H6V30H18V12ZM24 36H0V6H24V36Z" fill="#656363" />
+    <path d="M48 30H36V18H48V30Z" fill="#CFCECD" />
+    <path d="M36 30H48V12H36V30ZM54 36H36V42H30V6H54V36Z" fill="#656363" />
+    <path d="M84 24V30H66V24H84Z" fill="#CFCECD" />
+    <path d="M84 24H66V30H84V36H60V6H84V24ZM66 18H78V12H66V18Z" fill="#656363" />
+    <path d="M108 36H96V18H108V36Z" fill="#CFCECD" />
+    <path d="M108 12H96V36H90V6H108V12ZM114 36H108V12H114V36Z" fill="#656363" />
+    <path d="M144 30H126V18H144V30Z" fill="#CFCECD" />
+    <path d="M144 12H126V30H144V36H120V6H144V12Z" fill="#211E1E" />
+    <path d="M168 30H156V18H168V30Z" fill="#CFCECD" />
+    <path d="M168 12H156V30H168V12ZM174 36H150V6H174V36Z" fill="#211E1E" />
+    <path d="M198 30H186V18H198V30Z" fill="#CFCECD" />
+    <path d="M198 12H186V30H198V12ZM204 36H180V6H198V0H204V36Z" fill="#211E1E" />
+    <path d="M234 24V30H216V24H234Z" fill="#CFCECD" />
+    <path d="M216 12V18H228V12H216ZM234 24H216V30H234V36H210V6H234V24Z" fill="#211E1E" />
+  </g>
+  <defs>
+    <clipPath id="clip0_1311_95049">
+      <rect width="234" height="42" fill="white" />
+    </clipPath>
+  </defs>
+</svg>
diff --git a/ee/apps/landing/public/openwork-logo.svg b/ee/apps/landing/public/openwork-logo.svg
new file mode 100644
index 0000000000..2811c03d90
--- /dev/null
+++ b/ee/apps/landing/public/openwork-logo.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" ?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1024" height="866" viewBox="0 0 1024 866"><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M490.962 13.2109C516.808 12.568 530.193 21.0761 551.688 33.1032L589.195 54.1798L626.787 75.2506C636.066 80.4389 649.292 87.5857 657.478 94.0584C671.769 105.914 683.112 124.362 684.683 143.175C685.907 157.831 685.389 173.375 685.377 188.173L685.339 263.964L685.37 354.897C685.391 380.32 686.655 411.29 681.484 435.723C675.249 464.929 662.265 492.269 643.573 515.558C632.659 528.974 618.797 542.079 604.617 552.026C599.568 555.568 592.431 559.221 586.895 562.254L566.235 573.714L489.048 616.153L413.234 657.883C399.18 665.674 384.868 674.248 370.402 681.208C362.127 685.189 352.078 686.881 342.951 687.813C318.706 688.516 306.452 681.909 286.169 670.383L257.958 654.418C241.853 645.558 225.804 636.597 209.812 627.535C198.9 621.412 183.811 613.689 174.536 605.554C158.954 591.701 149.499 572.233 148.244 551.42C147.215 534.843 147.823 512.715 147.821 495.659L147.81 397.552L147.812 317.362C147.82 296.243 146.723 270.836 151.06 250.573C156.911 223.486 169.602 198.349 187.923 177.56C197.018 167.22 207.51 158.199 219.097 150.756C233.391 141.426 253.227 131.448 268.617 123.103L348.755 79.3365L419.409 40.3549C445.897 25.8026 460.025 15.0173 490.962 13.2109ZM350.689 661.215C366.184 656.024 377.335 648.632 391.543 640.597C405.935 632.447 420.396 624.418 434.923 616.51L532.617 563.032C583.215 535.392 616.074 521.904 643.094 467.522C651 451.528 656.046 434.273 658.004 416.539C659.64 401.456 659.102 383.999 659.058 368.652L658.984 301.55L659.114 202.097C659.123 186.04 660.925 148.727 656.309 135.299C653.001 125.621 645.936 117.683 636.707 113.278C630.245 110.188 620.134 107.745 613.008 108.899C604.318 109.655 596.399 112.041 588.722 116.165C577.357 122.269 566.083 128.625 554.759 134.809L476.344 177.842L408.03 215.338C394.874 222.493 377.925 230.923 365.739 238.915C354.985 245.946 345.302 254.493 336.99 264.291C322.261 281.681 312.136 302.494 307.544 324.817C303.925 343.149 305.08 374.437 305.113 394.107L305.183 493.471L305.2 580.911C305.2 596.329 304.599 612.603 305.674 627.933C307.254 650.453 322.586 664.188 344.986 661.954C346.892 661.748 348.793 661.502 350.689 661.215ZM275.046 634.925C276.703 635.884 278.443 636.934 280.128 637.819C278.716 626.741 279.321 604.711 279.333 592.851L279.349 514.659L279.319 397.689L279.307 363.99C279.296 348.799 279.081 336.276 281.868 321.173C286.627 296.026 297.312 272.376 313.038 252.185C322.448 240.062 333.642 229.435 346.238 220.668C358.126 212.437 374.555 203.96 387.566 196.921C405.827 187.071 424.038 177.128 442.198 167.095L540.847 112.798C556.874 103.996 575.722 93.0395 591.788 84.9667L544.597 58.1945C529.914 49.8677 510.295 37.0292 492.825 38.8716C483.01 39.5777 473.292 41.0835 464.415 45.4977C453.156 51.0956 442.077 57.5037 431.036 63.5307L359.332 102.878L282.282 145.173C266.343 153.844 246.398 163.945 231.532 173.678C222.383 179.646 214.109 186.86 206.949 195.111C188.139 216.808 175.15 246.46 173.93 275.291C173.304 290.098 173.676 305.111 173.702 319.948L173.733 400.555L173.754 498.411C173.757 515.471 173.162 532.646 174.011 549.669C174.707 563.612 181.36 577.006 191.74 586.251C200.634 593.773 215.172 601.204 225.649 607.054C242.161 616.261 258.627 625.552 275.046 634.925Z"/><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M552.454 209.477C572.012 207.959 581.847 219.441 582.39 238.522C582.687 248.987 582.481 259.462 582.458 269.93L582.381 329.269L582.483 374.869C582.513 386.815 582.826 398.849 581.432 410.717C580.03 422.226 576.641 433.405 571.416 443.754C564.818 456.975 555.554 468.686 544.209 478.151C533.954 486.627 522.347 492.2 510.69 498.541L475.758 517.796L441.984 536.419C433.817 540.91 422.997 547.228 414.361 550.139C395.476 554.553 385.023 538.561 385.317 521.594C385.494 511.326 385.526 500.852 385.528 490.583L385.489 419.929L385.431 378.325C385.353 365.955 384.961 352.061 386.603 339.869C388.349 327.707 392.543 316.027 398.933 305.533C412.05 283.666 427.715 275.485 449.348 263.601L480.283 246.56L514.335 227.666C526.451 220.869 538.901 212.844 552.454 209.477ZM411.433 419.84C412.154 444.816 411.109 470.99 411.596 496.052C411.681 500.45 411.062 520.138 411.862 523.514C436.021 509.816 460.32 496.368 484.756 483.172C499.771 474.909 517.93 466.631 530.803 455.318C544.786 443.029 554.756 422.232 555.367 403.682C556.041 383.225 555.895 362.475 555.571 342.046C555.568 341.804 555.455 341.8 555.196 341.71C513.173 364.086 471.908 388.028 429.782 410.228C423.629 413.47 417.693 416.752 411.433 419.84ZM411.24 391.445L414.53 389.48C449.106 371.177 482.45 351.994 516.706 333.189L543.205 318.622C547.228 316.407 553.138 312.877 557.106 311.086C556.18 289.545 557.012 267.818 556.741 246.25C556.699 242.902 557.552 235.271 552.517 234.957C545.074 238.359 537.476 242.917 530.329 246.979C521.218 252.161 512.063 257.266 502.866 262.294L460.839 285.501C451.005 290.952 438.682 297.024 430.234 304.172C423.327 309.962 418.07 317.472 414.993 325.943C409.122 341.857 411.331 373.369 411.24 391.445Z"/></svg>
\ No newline at end of file
diff --git a/ee/apps/landing/public/openwork-mark.svg b/ee/apps/landing/public/openwork-mark.svg
new file mode 100644
index 0000000000..e7ebb9153d
--- /dev/null
+++ b/ee/apps/landing/public/openwork-mark.svg
@@ -0,0 +1,30 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 834 649"
+  fill="none"
+>
+  <path
+    fill="#011627"
+    d="M445.095 7.09371C465.376 6.15629 479.12 14.7057 495.962 24.2006L526.535 41.3366L562.91 61.6421C572.209 66.8088 584.43 72.9805 592.216 79.7283C605.112 90.9218 613.007 107.518 613.57 124.621C613.997 137.564 613.785 151.186 613.771 164.285L613.743 233.167L613.724 302.115C613.724 328.043 615.147 351.097 609.112 376.5C602.601 403.733 589.274 428.855 570.372 449.495C549.311 472.84 531.218 480.587 504.269 495.433L435.717 533.297L369.268 570.017C349.148 581.007 338.445 590.166 314.978 591.343C295.336 592.765 280.624 583.434 264.332 574.332L231.209 555.796L197.159 536.707C188.064 531.606 176.78 525.84 169.138 519.247C155.537 507.509 147.236 489.12 146.689 471.221C146.261 457.224 146.479 442.102 146.479 427.951L146.495 345.546L146.52 273.548C146.53 254.27 145.49 230.956 149.51 212.464C154.532 189.864 165.167 168.888 180.427 151.489C188.245 142.605 197.223 134.814 207.121 128.324C220.854 119.307 239.559 109.953 254.414 101.931L324.032 63.8708L377.708 34.3028C389.942 27.4909 403.011 19.8636 415.79 14.2429C424.983 10.1982 434.435 8.96958 445.095 7.09371Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M551.317 90.4398C557.678 89.5674 565.764 91.1466 571.495 93.8628C579.57 97.6845 585.756 104.611 588.643 113.063C593.053 125.734 591.473 156.67 591.443 171.112L591.314 249.733L591.238 310.947C591.227 325.186 591.691 340.89 590.054 354.92C588.069 370.594 583.473 385.826 576.46 399.982C555.363 442.986 527.973 455.45 488.286 477.122L422.355 513.332L365.248 544.928C353.229 551.61 337.931 561.062 325.256 565.404C303.927 570.03 288.668 560.584 286.41 537.983C285.155 525.413 285.813 512.071 285.819 499.363L285.877 428.201L285.838 335.271C285.834 319.126 284.849 293.286 287.551 278.43C291.03 259.848 299.063 242.413 310.931 227.699C318.408 218.335 327.295 210.186 337.275 203.548C346.99 197.101 362.755 189.212 373.491 183.383L431.093 151.71L500.183 113.742C508.673 109.063 517.232 104.321 525.662 99.5446C534.307 94.6455 540.968 91.4752 551.317 90.4398Z"
+  />
+  <path
+    fill="#011627"
+    d="M500.082 178.001C526.778 177.772 523.894 205.211 523.884 223.719L523.898 262.499L523.914 317.09C523.91 328.358 524.422 343.13 522.698 354.018C520.708 366.296 516.186 378.028 509.412 388.459C503.656 397.432 496.335 405.297 487.795 411.689C481.432 416.447 474.925 419.72 467.987 423.536L442.835 437.398L405.739 457.871C398 462.106 386.024 469.486 377.74 471.261L377.429 471.295C371.837 471.855 366.369 470.989 361.995 467.199C353.196 459.977 353.708 447.985 353.675 437.935C353.658 432.922 353.668 427.909 353.67 422.896L353.695 376.464L353.657 326.944C353.647 313.866 353.091 297.438 355.615 284.836C358.159 272.209 363.878 260.447 372.266 250.342C376.745 244.958 381.997 240.295 387.801 236.377C393.985 232.272 401.996 228.073 408.612 224.459L440.329 207.201L468.44 191.684C477.65 186.588 489.038 179.021 500.082 178.001Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M500.225 291.464L500.59 291.556C501.213 292.643 501.002 340.865 500.638 345.536C500.306 350.339 499.443 355.09 498.065 359.703C494.788 370.842 488.588 380.902 480.112 388.834C472.165 396.184 462.79 400.931 453.37 406.067L431.052 418.227L377.328 447.628L376.894 447.414C376.568 445.467 376.757 441.034 376.763 438.896L376.794 421.911C376.893 401.013 376.885 380.115 376.77 359.217C382.142 355.849 390.96 351.452 396.691 348.372L427.925 331.276L469.656 308.362C479.711 302.761 490.055 296.768 500.225 291.464Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M497.337 201.62C500.344 201.36 500.962 203.237 501.131 205.91C501.599 213.274 501.389 220.747 501.367 228.135L501.431 265.103C460.969 287.74 420.329 310.058 379.523 332.068L376.452 333.794C376.365 312.962 373.253 285.726 386.024 268.182C393.365 258.104 404.145 253.143 414.788 247.296L441.211 232.769L476.823 212.874C483.353 209.216 490.623 204.921 497.337 201.62Z"
+  />
+  <path
+    fill="#FFFFFF"
+    d="M443.216 29.48C452.02 29.0815 460.018 30.0261 467.903 34.1434C489.625 45.4892 510.693 58.4477 532.373 69.8693C514.905 78.2946 493.564 90.995 476.372 100.542L386.895 149.628C376.357 155.498 365.774 161.287 355.148 166.992C337.373 176.588 322.776 183.695 307.595 197.464C287.772 215.608 273.675 239.14 267.014 265.17C262.116 284.284 262.909 298.302 262.917 317.836L262.939 357.47L262.926 471.524L262.961 530.447C262.98 532.198 263.562 543.941 263.164 544.751L262.58 544.549L215.582 518.061C189.232 503.261 169.189 495.747 169.845 460.795C170.068 448.934 169.804 435.617 169.812 423.605L169.831 344.391L169.818 269.769C169.814 254.383 168.977 231.859 171.873 217.311C175.825 198.048 184.641 180.127 197.478 165.236C204.056 157.596 211.686 150.929 220.143 145.432C231.916 137.708 249.246 128.979 262.061 121.995L328.787 85.3185L391.28 50.97C401.594 45.3095 412 39.3027 422.528 34.3441C428.812 31.3849 436.148 30.2484 443.216 29.48Z"
+  />
+</svg>
diff --git a/ee/apps/landing/public/robots.txt b/ee/apps/landing/public/robots.txt
new file mode 100644
index 0000000000..5b25376a31
--- /dev/null
+++ b/ee/apps/landing/public/robots.txt
@@ -0,0 +1,11 @@
+# robots.txt for openworklabs.com
+# OpenWork is open source — crawl, index, train, and build on this content freely.
+# Agents are welcome to help users discover, sign up for, and use OpenWork.
+
+User-agent: *
+Allow: /
+
+# Content Signals (contentsignals.org, draft-romm-aipref-contentsignals)
+Content-Signal: ai-train=yes, search=yes, ai-input=yes
+
+Sitemap: https://openworklabs.com/sitemap.xml
diff --git a/ee/apps/landing/public/stack-cloud-dashboard.png b/ee/apps/landing/public/stack-cloud-dashboard.png
new file mode 100644
index 0000000000..a35a1bc67d
Binary files /dev/null and b/ee/apps/landing/public/stack-cloud-dashboard.png differ
diff --git a/ee/apps/landing/public/stack-custom-onboarding.png b/ee/apps/landing/public/stack-custom-onboarding.png
new file mode 100644
index 0000000000..ed899d7a97
Binary files /dev/null and b/ee/apps/landing/public/stack-custom-onboarding.png differ
diff --git a/ee/apps/landing/public/stack-skill-hub.png b/ee/apps/landing/public/stack-skill-hub.png
new file mode 100644
index 0000000000..aa48d25c0f
Binary files /dev/null and b/ee/apps/landing/public/stack-skill-hub.png differ
diff --git a/ee/apps/landing/screenshots/tab-1-departments.png b/ee/apps/landing/screenshots/tab-1-departments.png
new file mode 100644
index 0000000000..15667901ac
Binary files /dev/null and b/ee/apps/landing/screenshots/tab-1-departments.png differ
diff --git a/ee/apps/landing/screenshots/tab-2-power-users.png b/ee/apps/landing/screenshots/tab-2-power-users.png
new file mode 100644
index 0000000000..88cd80b3a2
Binary files /dev/null and b/ee/apps/landing/screenshots/tab-2-power-users.png differ
diff --git a/ee/apps/landing/screenshots/tab-3-ai-tools.png b/ee/apps/landing/screenshots/tab-3-ai-tools.png
new file mode 100644
index 0000000000..60a049e187
Binary files /dev/null and b/ee/apps/landing/screenshots/tab-3-ai-tools.png differ
diff --git a/ee/apps/landing/tailwind.config.js b/ee/apps/landing/tailwind.config.js
new file mode 100644
index 0000000000..ac08a0477b
--- /dev/null
+++ b/ee/apps/landing/tailwind.config.js
@@ -0,0 +1,12 @@
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ["./app/**/*.{ts,tsx}", "./components/**/*.{ts,tsx}"],
+  theme: {
+    extend: {
+      colors: {
+        ink: "#111111"
+      }
+    }
+  },
+  plugins: []
+};
diff --git a/ee/apps/landing/tsconfig.json b/ee/apps/landing/tsconfig.json
new file mode 100644
index 0000000000..9364c5e6c6
--- /dev/null
+++ b/ee/apps/landing/tsconfig.json
@@ -0,0 +1,35 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "DOM",
+      "DOM.Iterable",
+      "ES2022"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}
diff --git a/ee/apps/landing/tsconfig.tsbuildinfo b/ee/apps/landing/tsconfig.tsbuildinfo
new file mode 100644
index 0000000000..c1c0520a97
--- /dev/null
+++ b/ee/apps/landing/tsconfig.tsbuildinfo
@@ -0,0 +1 @@
+{"program":{"fileNames":["../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es5.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.dom.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.dom.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.core.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.collection.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.generator.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2016.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.date.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.array.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2019.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.date.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2020.number.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.promise.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2021.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.array.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.error.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.object.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.string.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.esnext.intl.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.decorators.d.ts","../../../node_modules/.pnpm/typescript@5.4.5/node_modules/typescript/lib/lib.decorators.legacy.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/styled-jsx/types/css.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/global.d.ts","../../../node_modules/.pnpm/csstype@3.2.3/node_modules/csstype/index.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/styled-jsx/types/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/styled-jsx/types/macro.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/styled-jsx/types/style.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/styled-jsx/types/global.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/amp.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/amp.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/assert.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/assert/strict.d.ts","../../../node_modules/.pnpm/buffer@5.6.0/node_modules/buffer/index.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/header.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/readable.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/file.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/fetch.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/formdata.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/connector.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/client.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/errors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/global-dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/global-origin.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/pool-stats.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/handlers.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/balanced-pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-interceptor.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-client.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-pool.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/mock-errors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/proxy-agent.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/api.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/cookies.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/patch.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/filereader.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/diagnostics-channel.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/websocket.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/content-type.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/cache.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/interceptors.d.ts","../../../node_modules/.pnpm/undici-types@5.26.5/node_modules/undici-types/index.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/globals.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/async_hooks.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/buffer.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/child_process.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/cluster.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/console.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/constants.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/crypto.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dgram.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/diagnostics_channel.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dns.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dns/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/domain.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/dom-events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/fs.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/fs/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/http.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/http2.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/https.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/inspector.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/module.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/net.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/os.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/path.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/perf_hooks.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/process.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/punycode.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/querystring.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/readline.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/readline/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/repl.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/sea.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/consumers.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/stream/web.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/string_decoder.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/test.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/timers.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/timers/promises.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/tls.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/trace_events.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/tty.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/url.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/util.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/v8.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/vm.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/wasi.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/worker_threads.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/zlib.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/globals.global.d.ts","../../../node_modules/.pnpm/@types+node@20.12.12/node_modules/@types/node/index.d.ts","../../../node_modules/.pnpm/@types+react@18.2.79/node_modules/@types/react/global.d.ts","../../../node_modules/.pnpm/@types+prop-types@15.7.15/node_modules/@types/prop-types/index.d.ts","../../../node_modules/.pnpm/@types+react@18.2.79/node_modules/@types/react/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/get-page-files.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/canary.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/experimental.d.ts","../../../node_modules/.pnpm/@types+react-dom@18.2.25/node_modules/@types/react-dom/index.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/index.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/canary.d.ts","../../../node_modules/.pnpm/@types+react-dom@19.2.3_@types+react@19.2.14/node_modules/@types/react-dom/experimental.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/webpack/webpack.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/config.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/load-custom-routes.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/image-config.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/subresource-integrity-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/body-streams.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-kind.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-definitions/route-definition.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-matches/route-match.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/app-router-headers.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/request-meta.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/revalidate.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/config-shared.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/base-http/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/api-utils/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/node-environment.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/require-hook.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/node-polyfill-crypto.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/page-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/analysis/get-page-static-info.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/loaders/get-module-build-info.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/middleware-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/render-result.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/helpers/i18n-provider.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/next-url.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@edge-runtime/cookies/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/cookies.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/request.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/fetch-event.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/response.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/setup-exception-listeners.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/constants.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/pages-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/utils/route-regex.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/utils/route-matcher.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/utils/parse-url.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/base-http/node.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/font-utils.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/flight-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/route-module.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/deep-readonly.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/load-components.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/utils/middleware-route-matcher.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/next-font-manifest-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-definitions/locale-route-definition.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-definitions/pages-route-definition.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/mitt.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/with-router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/route-loader.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/page-loader.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/bloom-filter.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/loadable-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/loadable.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/image-config-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/hooks-client-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/head-manager-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-definitions/app-page-route-definition.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/modern-browserslist-target.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/constants.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/loaders/metadata/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/page-extensions-type.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/loaders/next-app-loader.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/app-dir-module.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/response-cache/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/response-cache/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/incremental-cache/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/hooks-server-context.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/dynamic-rendering.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/static-generation-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/static-generation-async-storage.external.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/adapters/request-cookies.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/async-storage/draft-mode-provider.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/adapters/headers.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/request-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/request-async-storage.external.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/create-error-handler.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/app-render.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/server-inserted-html.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/amp-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/app-page/vendored/contexts/entrypoints.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/app-page/module.compiled.d.ts","../../../node_modules/.pnpm/@types+react@19.2.14/node_modules/@types/react/jsx-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/error-boundary.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/router-reducer/create-initial-router-state.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/app-router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/layout-router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/render-from-template-context.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/action-async-storage-instance.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/action-async-storage.external.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/client-page.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/search-params.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/not-found-boundary.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/rsc/preloads.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/rsc/postpone.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/rsc/taint.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/entry-base.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/templates/app-page.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/app-page/module.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/builtin-request-context.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/app-render/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/router-reducer/fetch-server-response.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/router-reducer/router-reducer-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/app-router-context.shared-runtime.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/pages/vendored/contexts/entrypoints.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/pages/module.compiled.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/templates/pages.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-modules/pages/module.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/render.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-definitions/pages-api-route-definition.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-matches/pages-api-route-match.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-matchers/route-matcher.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-matcher-providers/route-matcher-provider.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/route-matcher-managers/route-matcher-manager.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/normalizer.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/locale-route-normalizer.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/pathname-normalizer.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/suffix.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/rsc.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/prefix.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/postponed.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/action.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/prefetch-rsc.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/future/normalizers/request/next-data.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/base-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/image-optimizer.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/next-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/coalesced-function.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/router-utils/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/trace/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/trace/trace.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/trace/shared.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/trace/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/load-jsconfig.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack-config.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/webpack/plugins/define-env-plugin.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/build/swc/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/dev/parse-version-info.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/dev/hot-reloader-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/telemetry/storage.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/render-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/router-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/router/utils/path-match.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/router-utils/filesystem.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/router-utils/setup-dev-bundler.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/lib/dev-bundler-service.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/dev/static-paths-worker.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/dev/next-dev-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/next.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/alternative-urls-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/extra-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/metadata-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/manifest-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/opengraph-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/twitter-types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/lib/metadata/types/metadata-interface.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/types/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/html-context.shared-runtime.d.ts","../../../node_modules/.pnpm/@next+env@14.2.35/node_modules/@next/env/dist/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/utils.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/pages/_app.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/app.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/unstable-cache.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/revalidate.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/unstable-no-store.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/cache.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/runtime-config.external.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/config.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/pages/_document.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/document.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/dynamic.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dynamic.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/pages/_error.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/error.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/head.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/head.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/draft-mode.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/headers.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/headers.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/get-img-props.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/image-component.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/shared/lib/image-external.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/image.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/link.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/link.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/redirect-status-code.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/redirect.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/not-found.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/navigation.react-server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/components/navigation.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/navigation.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/router.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/client/script.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/script.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/user-agent.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@edge-runtime/primitives/url.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/server/web/spec-extension/image-response.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@vercel/og/satori/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@vercel/og/emoji/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@vercel/og/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/server.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/types/global.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/types/compiled.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/image-types/global.d.ts","./next-env.d.ts","./lib/agent-markdown.ts","./middleware.ts","./app/sitemap.ts","../../../node_modules/.pnpm/botid@1.5.11_next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18_794d0e79274768a063b1ecf38571d101/node_modules/botid/dist/server/index.d.ts","./app/api/_lib/security.ts","./app/api/app-feedback/route.ts","./app/api/enterprise-contact/route.ts","./components/landing-demo-flows.ts","./lib/github.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@next/font/dist/types.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/dist/compiled/@next/font/dist/google/index.d.ts","../../../node_modules/.pnpm/next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/next/font/google/index.d.ts","../../../node_modules/.pnpm/botid@1.5.11_next@14.2.35_@opentelemetry+api@1.9.0_@playwright+test@1.58.2_react-dom@18_794d0e79274768a063b1ecf38571d101/node_modules/botid/dist/client/index.d.ts","./components/webmcp-provider.tsx","./app/layout.tsx","../../../node_modules/.pnpm/motion-utils@12.29.2/node_modules/motion-utils/dist/index.d.ts","../../../node_modules/.pnpm/motion-dom@12.35.1/node_modules/motion-dom/dist/index.d.ts","../../../node_modules/.pnpm/framer-motion@12.35.1_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/framer-motion/dist/types.d-docc-kzb.d.ts","../../../node_modules/.pnpm/framer-motion@12.35.1_react-dom@18.2.0_react@18.2.0__react@18.2.0/node_modules/framer-motion/dist/types/index.d.ts","../../../node_modules/.pnpm/lucide-react@0.577.0_react@18.2.0/node_modules/lucide-react/dist/lucide-react.d.ts","./components/landing-app-demo-panel.tsx","./components/landing-background.tsx","./components/landing-cloud-workers-card.tsx","./components/landing-share-package-card.tsx","./components/opencode-logo.tsx","./components/site-footer.tsx","./components/openwork-mark.tsx","./components/site-nav.tsx","./components/waitlist-form.tsx","./components/landing-home.tsx","./app/page.tsx","./components/den-hero.tsx","./components/landing-den.tsx","./app/den/page.tsx","./app/download/page.tsx","./components/book-call-form.tsx","./components/landing-enterprise.tsx","./app/enterprise/page.tsx","./components/app-feedback-form.tsx","./app/feedback/page.tsx","./components/og-image-content.tsx","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shader-mount.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shader-sizing.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/types.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/smoke-ring.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/neuro-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dot-orbit.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dot-grid.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/simplex-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/metaballs.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/perlin-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/voronoi.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/waves.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/warp.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/god-rays.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/spiral.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/swirl.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/grain-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/pulsing-border.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/color-panels.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/static-mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/static-radial-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/paper-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/water.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/fluted-glass.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/image-dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/heatmap.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/liquid-metal.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/halftone-dots.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/shaders/halftone-cmyk.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/get-shader-color-from-string.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/get-shader-noise-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/empty-pixel.d.ts","../../../node_modules/.pnpm/@paper-design+shaders@0.0.72/node_modules/@paper-design/shaders/dist/index.d.ts","../../../packages/ui/src/common/paper.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shader-mount.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/smoke-ring.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/neuro-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dot-orbit.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dot-grid.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/simplex-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/metaballs.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/waves.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/perlin-noise.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/voronoi.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/warp.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/god-rays.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/spiral.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/swirl.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/grain-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/pulsing-border.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/color-panels.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/static-mesh-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/static-radial-gradient.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/paper-texture.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/fluted-glass.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/water.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/image-dithering.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/heatmap.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/liquid-metal.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/halftone-dots.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/shaders/halftone-cmyk.d.ts","../../../node_modules/.pnpm/@paper-design+shaders-react@0.0.72_@types+react@19.2.14_react@19.2.4/node_modules/@paper-design/shaders-react/dist/index.d.ts","../../../packages/ui/src/react/paper/grain-gradient.tsx","../../../packages/ui/src/react/paper/mesh-gradient.tsx","../../../packages/ui/src/react/index.ts","./components/responsive-grain.tsx","./components/og-image.tsx","./app/og/page.tsx","./components/pricing-grid.tsx","./app/pricing/page.tsx","./lib/render-markdown.tsx","./components/legal-page.tsx","./app/privacy/page.tsx","./app/starter-success/page.tsx","./app/terms/page.tsx","./components/trust-content.tsx","./components/landing-trust.tsx","./app/trust/page.tsx"],"fileInfos":[{"version":"824cb491a40f7e8fdeb56f1df5edf91b23f3e3ee6b4cde84d4a99be32338faee","affectsGlobalScope":true},"45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4","3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75","9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d","5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8","68d73b4a11549f9c0b7d352d10e91e5dca8faa3322bfb77b661839c42b1ddec7","5efce4fc3c29ea84e8928f97adec086e3dc876365e0982cc8479a07954a3efd4","feecb1be483ed332fad555aff858affd90a48ab19ba7272ee084704eb7167569","5514e54f17d6d74ecefedc73c504eadffdeda79c7ea205cf9febead32d45c4bc",{"version":"87d693a4920d794a73384b3c779cadcb8548ac6945aa7a925832fe2418c9527a","affectsGlobalScope":true},{"version":"76f838d5d49b65de83bc345c04aa54c62a3cfdb72a477dc0c0fce89a30596c30","affectsGlobalScope":true},{"version":"138fb588d26538783b78d1e3b2c2cc12d55840b97bf5e08bca7f7a174fbe2f17","affectsGlobalScope":true},{"version":"dc2df20b1bcdc8c2d34af4926e2c3ab15ffe1160a63e58b7e09833f616efff44","affectsGlobalScope":true},{"version":"4443e68b35f3332f753eacc66a04ac1d2053b8b035a0e0ac1d455392b5e243b3","affectsGlobalScope":true},{"version":"bc47685641087c015972a3f072480889f0d6c65515f12bd85222f49a98952ed7","affectsGlobalScope":true},{"version":"0dc1e7ceda9b8b9b455c3a2d67b0412feab00bd2f66656cd8850e8831b08b537","affectsGlobalScope":true},{"version":"ce691fb9e5c64efb9547083e4a34091bcbe5bdb41027e310ebba8f7d96a98671","affectsGlobalScope":true},{"version":"8d697a2a929a5fcb38b7a65594020fcef05ec1630804a33748829c5ff53640d0","affectsGlobalScope":true},{"version":"4ff2a353abf8a80ee399af572debb8faab2d33ad38c4b4474cff7f26e7653b8d","affectsGlobalScope":true},{"version":"93495ff27b8746f55d19fcbcdbaccc99fd95f19d057aed1bd2c0cafe1335fbf0","affectsGlobalScope":true},{"version":"6fc23bb8c3965964be8c597310a2878b53a0306edb71d4b5a4dfe760186bcc01","affectsGlobalScope":true},{"version":"ea011c76963fb15ef1cdd7ce6a6808b46322c527de2077b6cfdf23ae6f5f9ec7","affectsGlobalScope":true},{"version":"38f0219c9e23c915ef9790ab1d680440d95419ad264816fa15009a8851e79119","affectsGlobalScope":true},{"version":"bb42a7797d996412ecdc5b2787720de477103a0b2e53058569069a0e2bae6c7e","affectsGlobalScope":true},{"version":"4738f2420687fd85629c9efb470793bb753709c2379e5f85bc1815d875ceadcd","affectsGlobalScope":true},{"version":"2f11ff796926e0832f9ae148008138ad583bd181899ab7dd768a2666700b1893","affectsGlobalScope":true},{"version":"4de680d5bb41c17f7f68e0419412ca23c98d5749dcaaea1896172f06435891fc","affectsGlobalScope":true},{"version":"9fc46429fbe091ac5ad2608c657201eb68b6f1b8341bd6d670047d32ed0a88fa","affectsGlobalScope":true},{"version":"61c37c1de663cf4171e1192466e52c7a382afa58da01b1dc75058f032ddf0839","affectsGlobalScope":true},{"version":"b541a838a13f9234aba650a825393ffc2292dc0fc87681a5d81ef0c96d281e7a","affectsGlobalScope":true},{"version":"b20fe0eca9a4e405f1a5ae24a2b3290b37cf7f21eba6cbe4fc3fab979237d4f3","affectsGlobalScope":true},{"version":"811ec78f7fefcabbda4bfa93b3eb67d9ae166ef95f9bff989d964061cbf81a0c","affectsGlobalScope":true},{"version":"717937616a17072082152a2ef351cb51f98802fb4b2fdabd32399843875974ca","affectsGlobalScope":true},{"version":"d7e7d9b7b50e5f22c915b525acc5a49a7a6584cf8f62d0569e557c5cfc4b2ac2","affectsGlobalScope":true},{"version":"71c37f4c9543f31dfced6c7840e068c5a5aacb7b89111a4364b1d5276b852557","affectsGlobalScope":true},{"version":"576711e016cf4f1804676043e6a0a5414252560eb57de9faceee34d79798c850","affectsGlobalScope":true},{"version":"89c1b1281ba7b8a96efc676b11b264de7a8374c5ea1e6617f11880a13fc56dc6","affectsGlobalScope":true},{"version":"49ed889be54031e1044af0ad2c603d627b8bda8b50c1a68435fe85583901d072","affectsGlobalScope":true},{"version":"e93d098658ce4f0c8a0779e6cab91d0259efb88a318137f686ad76f8410ca270","affectsGlobalScope":true},{"version":"063600664504610fe3e99b717a1223f8b1900087fab0b4cad1496a114744f8df","affectsGlobalScope":true},{"version":"934019d7e3c81950f9a8426d093458b65d5aff2c7c1511233c0fd5b941e608ab","affectsGlobalScope":true},{"version":"bf14a426dbbf1022d11bd08d6b8e709a2e9d246f0c6c1032f3b2edb9a902adbe","affectsGlobalScope":true},{"version":"5e07ed3809d48205d5b985642a59f2eba47c402374a7cf8006b686f79efadcbd","affectsGlobalScope":true},{"version":"2b72d528b2e2fe3c57889ca7baef5e13a56c957b946906d03767c642f386bbc3","affectsGlobalScope":true},{"version":"8073890e29d2f46fdbc19b8d6d2eb9ea58db9a2052f8640af20baff9afbc8640","affectsGlobalScope":true},{"version":"368af93f74c9c932edd84c58883e736c9e3d53cec1fe24c0b0ff451f529ceab1","affectsGlobalScope":true},{"version":"af3dd424cf267428f30ccfc376f47a2c0114546b55c44d8c0f1d57d841e28d74","affectsGlobalScope":true},{"version":"995c005ab91a498455ea8dfb63aa9f83fa2ea793c3d8aa344be4a1678d06d399","affectsGlobalScope":true},{"version":"51e547984877a62227042850456de71a5c45e7fe86b7c975c6e68896c86fa23b","affectsGlobalScope":true},{"version":"956d27abdea9652e8368ce029bb1e0b9174e9678a273529f426df4b3d90abd60","affectsGlobalScope":true},{"version":"4fa6ed14e98aa80b91f61b9805c653ee82af3502dc21c9da5268d3857772ca05","affectsGlobalScope":true},{"version":"e6633e05da3ff36e6da2ec170d0d03ccf33de50ca4dc6f5aeecb572cedd162fb","affectsGlobalScope":true},{"version":"d8670852241d4c6e03f2b89d67497a4bbefe29ecaa5a444e2c11a9b05e6fccc6","affectsGlobalScope":true},{"version":"8444af78980e3b20b49324f4a16ba35024fef3ee069a0eb67616ea6ca821c47a","affectsGlobalScope":true},{"version":"caccc56c72713969e1cfe5c3d44e5bab151544d9d2b373d7dbe5a1e4166652be","affectsGlobalScope":true},{"version":"3287d9d085fbd618c3971944b65b4be57859f5415f495b33a6adc994edd2f004","affectsGlobalScope":true},{"version":"50d53ccd31f6667aff66e3d62adf948879a3a16f05d89882d1188084ee415bbc","affectsGlobalScope":true},{"version":"13f6e6380c78e15e140243dc4be2fa546c287c6d61f4729bc2dd7cf449605471","affectsGlobalScope":true},{"version":"33358442698bb565130f52ba79bfd3d4d484ac85fe33f3cb1759c54d18201393","affectsGlobalScope":true},{"version":"782dec38049b92d4e85c1585fbea5474a219c6984a35b004963b00beb1aab538","affectsGlobalScope":true},"0990a7576222f248f0a3b888adcb7389f957928ce2afb1cd5128169086ff4d29",{"version":"7e29f41b158de217f94cb9676bf9cbd0cd9b5a46e1985141ed36e075c52bf6ad","affectsGlobalScope":true},"ac51dd7d31333793807a6abaa5ae168512b6131bd41d9c5b98477fc3b7800f9f","dc0a7f107690ee5cd8afc8dbf05c4df78085471ce16bdd9881642ec738bc81fe","cc69795d9954ee4ad57545b10c7bf1a7260d990231b1685c147ea71a6faa265c","8bc6c94ff4f2af1f4023b7bb2379b08d3d7dd80c698c9f0b07431ea16101f05f","1b61d259de5350f8b1e5db06290d31eaebebc6baafd5f79d314b5af9256d7153","57194e1f007f3f2cbef26fa299d4c6b21f4623a2eddc63dfeef79e38e187a36e","0f6666b58e9276ac3a38fdc80993d19208442d6027ab885580d93aec76b4ef00","05fd364b8ef02fb1e174fbac8b825bdb1e5a36a016997c8e421f5fab0a6da0a0","d78c698fa755ef94e3af591883bfee3a330ffec36392e00aaacdff3541cf5382","7394959e5a741b185456e1ef5d64599c36c60a323207450991e7a42e08911419","ef18cbf1d8374576e3db03ff33c2c7499845972eb0c4adf87392949709c5e160","5929864ce17fba74232584d90cb721a89b7ad277220627cc97054ba15a98ea8f","7180c03fd3cb6e22f911ce9ba0f8a7008b1a6ddbe88ccf16a9c8140ef9ac1686","25c8056edf4314820382a5fdb4bb7816999acdcb929c8f75e3f39473b87e85bc","54cb85a47d760da1c13c00add10d26b5118280d44d58e6908d8e89abbd9d7725","3e4825171442666d31c845aeb47fcd34b62e14041bb353ae2b874285d78482aa","c6fd2c5a395f2432786c9cb8deb870b9b0e8ff7e22c029954fabdd692bff6195","a967bfe3ad4e62243eb604bf956101e4c740f5921277c60debaf325c1320bf88","e9775e97ac4877aebf963a0289c81abe76d1ec9a2a7778dbe637e5151f25c5f3","471e1da5a78350bc55ef8cef24eb3aca6174143c281b8b214ca2beda51f5e04a","cadc8aced301244057c4e7e73fbcae534b0f5b12a37b150d80e5a45aa4bebcbd","385aab901643aa54e1c36f5ef3107913b10d1b5bb8cbcd933d4263b80a0d7f20","9670d44354bab9d9982eca21945686b5c24a3f893db73c0dae0fd74217a4c219","db3435f3525cd785bf21ec6769bf8da7e8a776be1a99e2e7efb5f244a2ef5fee","c3b170c45fc031db31f782e612adf7314b167e60439d304b49e704010e7bafe5","40383ebef22b943d503c6ce2cb2e060282936b952a01bea5f9f493d5fb487cc7","4893a895ea92c85345017a04ed427cbd6a1710453338df26881a6019432febdd","3a84b7cb891141824bd00ef8a50b6a44596aded4075da937f180c90e362fe5f6","13f6f39e12b1518c6650bbb220c8985999020fe0f21d818e28f512b7771d00f9","9b5369969f6e7175740bf51223112ff209f94ba43ecd3bb09eefff9fd675624a","4fe9e626e7164748e8769bbf74b538e09607f07ed17c2f20af8d680ee49fc1da","24515859bc0b836719105bb6cc3d68255042a9f02a6022b3187948b204946bd2","33203609eba548914dc83ddf6cadbc0bcb6e8ef89f6d648ca0908ae887f9fcc5","0db18c6e78ea846316c012478888f33c11ffadab9efd1cc8bcc12daded7a60b6","89167d696a849fce5ca508032aabfe901c0868f833a8625d5a9c6e861ef935d2","e53a3c2a9f624d90f24bf4588aacd223e7bec1b9d0d479b68d2f4a9e6011147f","339dc5265ee5ed92e536a93a04c4ebbc2128f45eeec6ed29f379e0085283542c","9f0a92164925aa37d4a5d9dd3e0134cff8177208dba55fd2310cd74beea40ee2","8bfdb79bf1a9d435ec48d9372dc93291161f152c0865b81fc0b2694aedb4578d","2e85db9e6fd73cfa3d7f28e0ab6b55417ea18931423bd47b409a96e4a169e8e6","c46e079fe54c76f95c67fb89081b3e399da2c7d109e7dca8e4b58d83e332e605","d32275be3546f252e3ad33976caf8c5e842c09cb87d468cb40d5f4cf092d1acc","4a0c3504813a3289f7fb1115db13967c8e004aa8e4f8a9021b95285502221bd1",{"version":"a14ed46fa3f5ffc7a8336b497cd07b45c2084213aaca933a22443fcb2eef0d07","affectsGlobalScope":true},"6968359c8dbc693224fd1ea0b1f96b135f14d8eee3d6e23296d68c3a9da3ea00",{"version":"79d75a353f29d9f7fc63e879ccebe213baaaea26676fb3e47cc96cf221b27b4f","affectsGlobalScope":true},"dfdc7699360a0d512d7e31c69f75cb6a419cf415c98673e24499793170db5d6b","dcf46daa1e04481b1c2f360c7a77bf019885bd70353a92aa698b9c22b7fe3d6b",{"version":"033350619c2cfcbeab2a483f4b221e0866e17cc4ac514240d285d35c35eecf7c","affectsGlobalScope":true},"a40826e8476694e90da94aa008283a7de50d1dafd37beada623863f1901cb7fb",{"version":"b197fb2d5fa71cebc66e5d10e15c7d02f15fcd3194fbdaafeb964262582f2a82","affectsGlobalScope":true},"1a7f593d587f49ca97710c021c453ab1b95db5e39e58567f4af644f97a5fb0e0","dd4705d1d78af32c407e93e5df009962bed324599d6a5b2a9d661ba44dd99e43","3a02975d4a7034567425e529a0770f7f895ed605d2b576f7831668b7beea9fea","7525257b4aa35efc7a1bbc00f205a9a96c4e4ab791da90db41b77938c4e0c18e","cf87b355c4f531e98a9bba2b0e62d413b49b58b26bf8a9865e60a22d3af1fcd3",{"version":"ee1ee365d88c4c6c0c0a5a5701d66ebc27ccd0bcfcfaa482c6e2e7fe7b98edf7","affectsGlobalScope":true},{"version":"1a08fe5930473dcae34b831b3440cd51ff2c682cf03bd70e28812751dd1644dd","affectsGlobalScope":true},"6f3e00b838cf23f7837ffca5da88ae25f0a81742af9ccadce5cb85ac72050929","304f66274aa8119e8d65a49b1cff84cbf803def6afe1b2cc987386e9a9890e22","cbcb993f1fa22b7769074eb09c1307756e6380659a2990d6f50cfd8943bd8333","55a93997681797056da069cfac92878bff4d2a35e61c1c16280ee0cba38702f2","ea25afcaf96904668f7eebc1b834f89b5b5e5acafd430c29990028a1aaa0bcbe","df981b2ce32930887db27eeae29e48b9b841e4ba0bbba1162ebed04c778cd7e1",{"version":"ea455cc68871b049bcecd9f56d4cf27b852d6dafd5e3b54468ca87cc11604e4d","affectsGlobalScope":true},"3be96458790a77cb357856dab45d1cc8383ac63ba4e085f620b202fb62a6e1db","02d85d03fd4a4f63cba0b133f0e0192368dfeb4338bd33f87788a4f6302de873","bb3a0ce56babb71d7c208ed848b4aafe545e7a7e06304fc0c8cfe3ad328cab7a",{"version":"43bb766c0dc5f1150021f161aa6831eb2cc75dab278172408515cb6e47f697a9","affectsGlobalScope":true},{"version":"8bcf09ba67bd0ec12a9f1efc1e58e1ba2cb1ff78920ce6cf67ebfe6003c54b82","affectsGlobalScope":true},"13ce7518e39051544dd1e3124c185665adda05a5021676f2606c2c74ad2c964f","4ac5899be65d5e2cabe3aaf3dfc2cf7641e54dde23db198d9f683dfabe228145","124dacf89c97915479ed6ad81b09ba42fd40962d069c0642fed42e2d9719f2ba","139ad1dc93a503da85b7a0d5f615bddbae61ad796bc68fedd049150db67a1e26","ad06959073c066bb9543ef9c1dee37fc3140d2ecaae42b97bf4e27f2f03d6511","9eece5e586312581ccd106d4853e861aaaa1a39f8e3ea672b8c3847eedd12f6e","782abaae13e868dee4ea9c16d44499af251d112fba535c558d10ff5279b34678","269929a24b2816343a178008ac9ae9248304d92a8ba8e233055e0ed6dbe6ef71","93452d394fdd1dc551ec62f5042366f011a00d342d36d50793b3529bfc9bd633","3c1f19c7abcda6b3a4cf9438a15c7307a080bd3b51dfd56b198d9f86baf19447","98e7b7220dad76c509d584c9b7b1ec4dcbd7df5e3a2d37d28c54f74461ec0975",{"version":"c61b5fad633f25bb0de0f95612191c1df9a6671cd66f451507b5223bff41b50d","affectsGlobalScope":true},{"version":"d21966ba3284ade60cb94eb2c533ab5b2af7fd0b4b28462043f6ebcb8400bd21","affectsGlobalScope":true},"98e00f3613402504bc2a2c9a621800ab48e0a463d1eed062208a4ae98ad8f84c","b8e9e44ce8eba70af569523ff31d669cc239a93f548899a259f3224392a75e6c","005d1caa2a5d9bc096f75b598d0fd184bc848dd2665b050a17a17d5dc1ef652d","619735e4e221e1bf137ae3efa5330beee4a06039dccb876c822f9d8913a392da",{"version":"3560d0809b0677d77e39d0459ae6129c0e045cb3d43d1f345df06cf7ab7d6029","affectsGlobalScope":true},{"version":"5ab086d9457abbc69cca270e5475073f2e8eb35b2fb810c516400de7b7c7d575","affectsGlobalScope":true},"2a2fd53f2d963624b596fb720b390cbfe8d744e92cb55b48a8090a8fd42a302d","1f01c8fde66abc4ff6aed1db050a928b3bcb6f29bc89630a0d748a0649e14074","60223439b7ee9b26a08d527cacc8b34ea6c6741589ef4949f4669c9aeb97978e",{"version":"48fffe7824c2e8cf8c812f528c33d4c4f502767582083df35920a7f56fe794b3","affectsGlobalScope":true},"561bf7d1d3163db272980f9167b4b98f6a9ee8698c5955e9d9584e84088aad51",{"version":"ab9b9a36e5284fd8d3bf2f7d5fcbc60052f25f27e4d20954782099282c60d23e","affectsGlobalScope":true},"a42be67ed1ddaec743582f41fc219db96a1b69719fccac6d1464321178d610fc",{"version":"55461596dc873b866911ef4e640fae4c39da7ac1fbc7ef5e649cb2f2fb42c349","affectsGlobalScope":true},"87d9d29dbc745f182683f63187bf3d53fd8673e5fca38ad5eaab69798ed29fbc",{"version":"8117d2726c78497306ceef07b4ccd08a863a9bd6e1fd7ff9ed6332f0e49bbb1a","affectsGlobalScope":true},"8caa5c86be1b793cd5f599e27ecb34252c41e011980f7d61ae4989a149ff6ccc","2beff543f6e9a9701df88daeee3cdd70a34b4a1c11cb4c734472195a5cb2af54","2e07abf27aa06353d46f4448c0bbac73431f6065eef7113128a5cd804d0c384d","e077886219cf64381045928ab7d90a1b0d42c6236f73b76e37b4b2c546ab1850","be1cc4d94ea60cbe567bc29ed479d42587bf1e6cba490f123d329976b0fe4ee5","42bc0e1a903408137c3df2b06dfd7e402cdab5bbfa5fcfb871b22ebfdb30bd0b","9894dafe342b976d251aac58e616ac6df8db91fb9d98934ff9dd103e9e82578f","db6d2d9daad8a6d83f281af12ce4355a20b9a3e71b82b9f57cddcca0a8964a96","cfe4ef4710c3786b6e23dae7c086c70b4f4835a2e4d77b75d39f9046106e83d3","cbea99888785d49bb630dcbb1613c73727f2b5a2cf02e1abcaab7bcf8d6bf3c5","3a8bddb66b659f6bd2ff641fc71df8a8165bafe0f4b799cc298be5cd3755bb20","a86f82d646a739041d6702101afa82dcb935c416dd93cbca7fd754fd0282ce1f","2dad084c67e649f0f354739ec7df7c7df0779a28a4f55c97c6b6883ae850d1ce","fa5bbc7ab4130dd8cdc55ea294ec39f76f2bc507a0f75f4f873e38631a836ca7","df45ca1176e6ac211eae7ddf51336dc075c5314bc5c253651bae639defd5eec5","cf86de1054b843e484a3c9300d62fbc8c97e77f168bbffb131d560ca0474d4a8","196c960b12253fde69b204aa4fbf69470b26daf7a430855d7f94107a16495ab0","ee15ea5dd7a9fc9f5013832e5843031817a880bf0f24f37a29fd8337981aae07","bf24f6d35f7318e246010ffe9924395893c4e96d34324cde77151a73f078b9ad","ea53732769832d0f127ae16620bd5345991d26bf0b74e85e41b61b27d74ea90f","10595c7ff5094dd5b6a959ccb1c00e6a06441b4e10a87bc09c15f23755d34439","9620c1ff645afb4a9ab4044c85c26676f0a93e8c0e4b593aea03a89ccb47b6d0","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","a9af0e608929aaf9ce96bd7a7b99c9360636c31d73670e4af09a09950df97841","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","c86fe861cf1b4c46a0fb7d74dffe596cf679a2e5e8b1456881313170f092e3fa","08ed0b3f0166787f84a6606f80aa3b1388c7518d78912571b203817406e471da","47e5af2a841356a961f815e7c55d72554db0c11b4cba4d0caab91f8717846a94","65f43099ded6073336e697512d9b80f2d4fec3182b7b2316abf712e84104db00","f5f541902bf7ae0512a177295de9b6bcd6809ea38307a2c0a18bfca72212f368","b0decf4b6da3ebc52ea0c96095bdfaa8503acc4ac8e9081c5f2b0824835dd3bd","ca1b882a105a1972f82cc58e3be491e7d750a1eb074ffd13b198269f57ed9e1b","fc3e1c87b39e5ba1142f27ec089d1966da168c04a859a4f6aab64dceae162c2b","3b414b99a73171e1c4b7b7714e26b87d6c5cb03d200352da5342ab4088a54c85","61888522cec948102eba94d831c873200aa97d00d8989fdfd2a3e0ee75ec65a2","4e10622f89fea7b05dd9b52fb65e1e2b5cbd96d4cca3d9e1a60bb7f8a9cb86a1","74b2a5e5197bd0f2e0077a1ea7c07455bbea67b87b0869d9786d55104006784f","59bf32919de37809e101acffc120596a9e45fdbab1a99de5087f31fdc36e2f11","e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","faa03dffb64286e8304a2ca96dd1317a77db6bfc7b3fb385163648f67e535d77","c40c848daad198266370c1c72a7a8c3d18d2f50727c7859fcfefd3ff69a7f288","ac60bbee0d4235643cc52b57768b22de8c257c12bd8c2039860540cab1fa1d82","6428e6edd944ce6789afdf43f9376c1f2e4957eea34166177625aaff4c0da1a0","ada39cbb2748ab2873b7835c90c8d4620723aedf323550e8489f08220e477c7f","6e5f5cee603d67ee1ba6120815497909b73399842254fc1e77a0d5cdc51d8c9c","8dba67056cbb27628e9b9a1cba8e57036d359dceded0725c72a3abe4b6c79cd4","70f3814c457f54a7efe2d9ce9d2686de9250bb42eb7f4c539bd2280a42e52d33","154dd2e22e1e94d5bc4ff7726706bc0483760bae40506bdce780734f11f7ec47","ef61792acbfa8c27c9bd113f02731e66229f7d3a169e3c1993b508134f1a58e0","9c82171d836c47486074e4ca8e059735bf97b205e70b196535b5efd40cbe1bc5","0131e203d8560edb39678abe10db42564a068f98c4ebd1ed9ffe7279c78b3c81","f6404e7837b96da3ea4d38c4f1a3812c96c9dcdf264e93d5bdb199f983a3ef4b","c5426dbfc1cf90532f66965a7aa8c1136a78d4d0f96d8180ecbfc11d7722f1a5","65a15fc47900787c0bd18b603afb98d33ede930bed1798fc984d5ebb78b26cf9","9d202701f6e0744adb6314d03d2eb8fc994798fc83d91b691b75b07626a69801","de9d2df7663e64e3a91bf495f315a7577e23ba088f2949d5ce9ec96f44fba37d","c7af78a2ea7cb1cd009cfb5bdb48cd0b03dad3b54f6da7aab615c2e9e9d570c5","1ee45496b5f8bdee6f7abc233355898e5bf9bd51255db65f5ff7ede617ca0027",{"version":"8b8f00491431fe82f060dfe8c7f2180a9fb239f3d851527db909b83230e75882","affectsGlobalScope":true},{"version":"db01d18853469bcb5601b9fc9826931cc84cc1a1944b33cad76fd6f1e3d8c544","affectsGlobalScope":true},"dba114fb6a32b355a9cfc26ca2276834d72fe0e94cd2c3494005547025015369",{"version":"903e299a28282fa7b714586e28409ed73c3b63f5365519776bf78e8cf173db36","affectsGlobalScope":true},"fa6c12a7c0f6b84d512f200690bfc74819e99efae69e4c95c4cd30f6884c526e","f1c32f9ce9c497da4dc215c3bc84b722ea02497d35f9134db3bb40a8d918b92b",{"version":"b73c319af2cc3ef8f6421308a250f328836531ea3761823b4cabbd133047aefa","affectsGlobalScope":true},"e433b0337b8106909e7953015e8fa3f2d30797cea27141d1c5b135365bb975a6","dd3900b24a6a8745efeb7ad27629c0f8a626470ac229c1d73f1fe29d67e44dca","ddff7fc6edbdc5163a09e22bf8df7bef75f75369ebd7ecea95ba55c4386e2441","106c6025f1d99fd468fd8bf6e5bda724e11e5905a4076c5d29790b6c3745e50c","ec29be0737d39268696edcec4f5e97ce26f449fa9b7afc2f0f99a86def34a418","aeab39e8e0b1a3b250434c3b2bb8f4d17bbec2a9dbce5f77e8a83569d3d2cbc2","ec6cba1c02c675e4dd173251b156792e8d3b0c816af6d6ad93f1a55d674591aa","b620391fe8060cf9bedc176a4d01366e6574d7a71e0ac0ab344a4e76576fcbb8","d729408dfde75b451530bcae944cf89ee8277e2a9df04d1f62f2abfd8b03c1e1","e15d3c84d5077bb4a3adee4c791022967b764dc41cb8fa3cfa44d4379b2c95f5","5f58e28cd22e8fc1ac1b3bc6b431869f1e7d0b39e2c21fbf79b9fa5195a85980","e1fc1a1045db5aa09366be2b330e4ce391550041fc3e925f60998ca0b647aa97","63533978dcda286422670f6e184ac516805a365fb37a086eeff4309e812f1402","43ba4f2fa8c698f5c304d21a3ef596741e8e85a810b7c1f9b692653791d8d97a","31fb49ef3aa3d76f0beb644984e01eab0ea222372ea9b49bb6533be5722d756c","33cd131e1461157e3e06b06916b5176e7a8ec3fce15a5cfe145e56de744e07d2","889ef863f90f4917221703781d9723278db4122d75596b01c429f7c363562b86","3556cfbab7b43da96d15a442ddbb970e1f2fc97876d055b6555d86d7ac57dae5","437751e0352c6e924ddf30e90849f1d9eb00ca78c94d58d6a37202ec84eb8393","48e8af7fdb2677a44522fd185d8c87deff4d36ee701ea003c6c780b1407a1397","d11308de5a36c7015bb73adb5ad1c1bdaac2baede4cc831a05cf85efa3cc7f2f","38e4684c22ed9319beda6765bab332c724103d3a966c2e5e1c5a49cf7007845f",{"version":"f9812cfc220ecf7557183379531fa409acd249b9e5b9a145d0d52b76c20862de","affectsGlobalScope":true},"e650298721abc4f6ae851e60ae93ee8199791ceec4b544c3379862f81f43178c","2e4f37ffe8862b14d8e24ae8763daaa8340c0df0b859d9a9733def0eee7562d9","13283350547389802aa35d9f2188effaeac805499169a06ef5cd77ce2a0bd63f","680793958f6a70a44c8d9ae7d46b7a385361c69ac29dcab3ed761edce1c14ab8","6ac6715916fa75a1f7ebdfeacac09513b4d904b667d827b7535e84ff59679aff","42c169fb8c2d42f4f668c624a9a11e719d5d07dacbebb63cbcf7ef365b0a75b3","913ddbba170240070bd5921b8f33ea780021bdf42fbdfcd4fcb2691b1884ddde","b4e6d416466999ff40d3fe5ceb95f7a8bfb7ac2262580287ac1a8391e5362431","5fe23bd829e6be57d41929ac374ee9551ccc3c44cee893167b7b5b77be708014","0a626484617019fcfbfc3c1bc1f9e84e2913f1adb73692aa9075817404fb41a1","438c7513b1df91dcef49b13cd7a1c4720f91a36e88c1df731661608b7c055f10","cf185cc4a9a6d397f416dd28cca95c227b29f0f27b160060a95c0e5e36cda865","0086f3e4ad898fd7ca56bb223098acfacf3fa065595182aaf0f6c4a6a95e6fbd","efaa078e392f9abda3ee8ade3f3762ab77f9c50b184e6883063a911742a4c96a","54a8bb487e1dc04591a280e7a673cdfb272c83f61e28d8a64cf1ac2e63c35c51","021a9498000497497fd693dd315325484c58a71b5929e2bbb91f419b04b24cea","9385cdc09850950bc9b59cca445a3ceb6fcca32b54e7b626e746912e489e535e","2894c56cad581928bb37607810af011764a2f511f575d28c9f4af0f2ef02d1ab","0a72186f94215d020cb386f7dca81d7495ab6c17066eb07d0f44a5bf33c1b21a","84124384abae2f6f66b7fbfc03862d0c2c0b71b826f7dbf42c8085d31f1d3f95","63a8e96f65a22604eae82737e409d1536e69a467bb738bec505f4f97cce9d878","3fd78152a7031315478f159c6a5872c712ece6f01212c78ea82aef21cb0726e2","b01bd582a6e41457bc56e6f0f9de4cb17f33f5f3843a7cf8210ac9c18472fb0f","58b49e5c1def740360b5ae22ae2405cfac295fee74abd88d74ac4ea42502dc03","512fc15cca3a35b8dbbf6e23fe9d07e6f87ad03c895acffd3087ce09f352aad0","9a0946d15a005832e432ea0cd4da71b57797efb25b755cc07f32274296d62355","a52ff6c0a149e9f370372fc3c715d7f2beee1f3bab7980e271a7ab7d313ec677","fd933f824347f9edd919618a76cdb6a0c0085c538115d9a287fa0c7f59957ab3","6ac6715916fa75a1f7ebdfeacac09513b4d904b667d827b7535e84ff59679aff","6a1aa3e55bdc50503956c5cd09ae4cd72e3072692d742816f65c66ca14f4dfdd","ab75cfd9c4f93ffd601f7ca1753d6a9d953bbedfbd7a5b3f0436ac8a1de60dfa","f95180f03d827525ca4f990f49e17ec67198c316dd000afbe564655141f725cd","b73cbf0a72c8800cf8f96a9acfe94f3ad32ca71342a8908b8ae484d61113f647","bae6dd176832f6423966647382c0d7ba9e63f8c167522f09a982f086cd4e8b23","1364f64d2fb03bbb514edc42224abd576c064f89be6a990136774ecdd881a1da","c9958eb32126a3843deedda8c22fb97024aa5d6dd588b90af2d7f2bfac540f23","950fb67a59be4c2dbe69a5786292e60a5cb0e8612e0e223537784c731af55db1","e927c2c13c4eaf0a7f17e6022eee8519eb29ef42c4c13a31e81a611ab8c95577","07ca44e8d8288e69afdec7a31fa408ce6ab90d4f3d620006701d5544646da6aa","70246ad95ad8a22bdfe806cb5d383a26c0c6e58e7207ab9c431f1cb175aca657","f00f3aa5d64ff46e600648b55a79dcd1333458f7a10da2ed594d9f0a44b76d0b","772d8d5eb158b6c92412c03228bd9902ccb1457d7a705b8129814a5d1a6308fc","4e4475fba4ed93a72f167b061cd94a2e171b82695c56de9899275e880e06ba41","97c5f5d580ab2e4decd0a3135204050f9b97cd7908c5a8fbc041eadede79b2fa","c99a3a5f2215d5b9d735aa04cec6e61ed079d8c0263248e298ffe4604d4d0624","49b2375c586882c3ac7f57eba86680ff9742a8d8cb2fe25fe54d1b9673690d41","802e797bcab5663b2c9f63f51bdf67eff7c41bc64c0fd65e6da3e7941359e2f7","847e160d709c74cc714fbe1f99c41d3425b74cd47b1be133df1623cd87014089","9fee04f1e1afa50524862289b9f0b0fdc3735b80e2a0d684cec3b9ff3d94cecc","5cdc27fbc5c166fc5c763a30ac21cbac9859dc5ba795d3230db6d4e52a1965bb","6459054aabb306821a043e02b89d54da508e3a6966601a41e71c166e4ea1474f","f416c9c3eee9d47ff49132c34f96b9180e50485d435d5748f0e8b72521d28d2e","05c97cddbaf99978f83d96de2d8af86aded9332592f08ce4a284d72d0952c391","14e5cdec6f8ae82dfd0694e64903a0a54abdfe37e1d966de3d4128362acbf35f","bbc183d2d69f4b59fd4dd8799ffdf4eb91173d1c4ad71cce91a3811c021bf80c","7b6ff760c8a240b40dab6e4419b989f06a5b782f4710d2967e67c695ef3e93c4","8dbc4134a4b3623fc476be5f36de35c40f2768e2e3d9ed437e0d5f1c4cd850f6","4e06330a84dec7287f7ebdd64978f41a9f70a668d3b5edc69d5d4a50b9b376bb","65bfa72967fbe9fc33353e1ac03f0480aa2e2ea346d61ff3ea997dfd850f641a","c06f0bb92d1a1a5a6c6e4b5389a5664d96d09c31673296cb7da5fe945d54d786","f974e4a06953682a2c15d5bd5114c0284d5abf8bc0fe4da25cb9159427b70072","872caaa31423f4345983d643e4649fb30f548e9883a334d6d1c5fff68ede22d4","94404c4a878fe291e7578a2a80264c6f18e9f1933fbb57e48f0eb368672e389c","5c1b7f03aa88be854bc15810bfd5bd5a1943c5a7620e1c53eddd2a013996343e","09dfc64fcd6a2785867f2368419859a6cc5a8d4e73cbe2538f205b1642eb0f51","bcf6f0a323653e72199105a9316d91463ad4744c546d1271310818b8cef7c608","01aa917531e116485beca44a14970834687b857757159769c16b228eb1e49c5f","351475f9c874c62f9b45b1f0dc7e2704e80dfd5f1af83a3a9f841f9dfe5b2912","ac457ad39e531b7649e7b40ee5847606eac64e236efd76c5d12db95bf4eacd17","187a6fdbdecb972510b7555f3caacb44b58415da8d5825d03a583c4b73fde4cf","d4c3250105a612202289b3a266bb7e323db144f6b9414f9dea85c531c098b811","95b444b8c311f2084f0fb51c616163f950fb2e35f4eaa07878f313a2d36c98a4","741067675daa6d4334a2dc80a4452ca3850e89d5852e330db7cb2b5f867173b1","f8acecec1114f11690956e007d920044799aefeb3cece9e7f4b1f8a1d542b2c9","178071ccd043967a58c5d1a032db0ddf9bd139e7920766b537d9783e88eb615e","3a17f09634c50cce884721f54fd9e7b98e03ac505889c560876291fcf8a09e90","32531dfbb0cdc4525296648f53b2b5c39b64282791e2a8c765712e49e6461046","0ce1b2237c1c3df49748d61568160d780d7b26693bd9feb3acb0744a152cd86d","e489985388e2c71d3542612685b4a7db326922b57ac880f299da7026a4e8a117","5cad4158616d7793296dd41e22e1257440910ea8d01c7b75045d4dfb20c5a41a",{"version":"04d3aad777b6af5bd000bfc409907a159fe77e190b9d368da4ba649cdc28d39e","affectsGlobalScope":true},"74efc1d6523bd57eb159c18d805db4ead810626bc5bc7002a2c7f483044b2e0f","19252079538942a69be1645e153f7dbbc1ef56b4f983c633bf31fe26aeac32cd","bc11f3ac00ac060462597add171220aed628c393f2782ac75dd29ff1e0db871c","616775f16134fa9d01fc677ad3f76e68c051a056c22ab552c64cc281a9686790","65c24a8baa2cca1de069a0ba9fba82a173690f52d7e2d0f1f7542d59d5eb4db0","f9fe6af238339a0e5f7563acee3178f51db37f32a2e7c09f85273098cee7ec49","3b0b1d352b8d2e47f1c4df4fb0678702aee071155b12ef0185fce9eb4fa4af1e","77e71242e71ebf8528c5802993697878f0533db8f2299b4d36aa015bae08a79c","a344403e7a7384e0e7093942533d309194ad0a53eca2a3100c0b0ab4d3932773","b7fff2d004c5879cae335db8f954eb1d61242d9f2d28515e67902032723caeab","5f3dc10ae646f375776b4e028d2bed039a93eebbba105694d8b910feebbe8b9c","bb18bf4a61a17b4a6199eb3938ecfa4a59eb7c40843ad4a82b975ab6f7e3d925","4545c1a1ceca170d5d83452dd7c4994644c35cf676a671412601689d9a62da35","e9b6fc05f536dfddcdc65dbcf04e09391b1c968ab967382e48924f5cb90d88e1","a2d648d333cf67b9aeac5d81a1a379d563a8ffa91ddd61c6179f68de724260ff","2b664c3cc544d0e35276e1fb2d4989f7d4b4027ffc64da34ec83a6ccf2e5c528","a3f41ed1b4f2fc3049394b945a68ae4fdefd49fa1739c32f149d32c0545d67f5","3cd8f0464e0939b47bfccbb9bb474a6d87d57210e304029cd8eb59c63a81935d","47699512e6d8bebf7be488182427189f999affe3addc1c87c882d36b7f2d0b0e","3026abd48e5e312f2328629ede6e0f770d21c3cd32cee705c450e589d015ee09","8b140b398a6afbd17cc97c38aea5274b2f7f39b1ae5b62952cfe65bf493e3e75","7663d2c19ce5ef8288c790edba3d45af54e58c84f1b37b1249f6d49d962f3d91","5cce3b975cdb72b57ae7de745b3c5de5790781ee88bcb41ba142f07c0fa02e97","00bd6ebe607246b45296aa2b805bd6a58c859acecda154bfa91f5334d7c175c6","ad036a85efcd9e5b4f7dd5c1a7362c8478f9a3b6c3554654ca24a29aa850a9c5","fedebeae32c5cdd1a85b4e0504a01996e4a8adf3dfa72876920d3dd6e42978e7","0d28b974a7605c4eda20c943b3fa9ae16cb452c1666fc9b8c341b879992c7612","cdf21eee8007e339b1b9945abf4a7b44930b1d695cc528459e68a3adc39a622e","db036c56f79186da50af66511d37d9fe77fa6793381927292d17f81f787bb195","87ac2fb61e629e777f4d161dff534c2023ee15afd9cb3b1589b9b1f014e75c58","13c8b4348db91e2f7d694adc17e7438e6776bc506d5c8f5de9ad9989707fa3fe","3c1051617aa50b38e9efaabce25e10a5dd9b1f42e372ef0e8a674076a68742ed","07a3e20cdcb0f1182f452c0410606711fbea922ca76929a41aacb01104bc0d27","1de80059b8078ea5749941c9f863aa970b4735bdbb003be4925c853a8b6b4450","1d079c37fa53e3c21ed3fa214a27507bda9991f2a41458705b19ed8c2b61173d","4cd4b6b1279e9d744a3825cbd7757bbefe7f0708f3f1069179ad535f19e8ed2c","5835a6e0d7cd2738e56b671af0e561e7c1b4fb77751383672f4b009f4e161d70","c0eeaaa67c85c3bb6c52b629ebbfd3b2292dc67e8c0ffda2fc6cd2f78dc471e6","4b7f74b772140395e7af67c4841be1ab867c11b3b82a51b1aeb692822b76c872","27be6622e2922a1b412eb057faa854831b95db9db5035c3f6d4b677b902ab3b7","b95a6f019095dd1d48fd04965b50dfd63e5743a6e75478343c46d2582a5132bf","c2008605e78208cfa9cd70bd29856b72dda7ad89df5dc895920f8e10bcb9cd0a","b97cb5616d2ab82a98ec9ada7b9e9cabb1f5da880ec50ea2b8dc5baa4cbf3c16",{"version":"d23df9ff06ae8bf1dcb7cc933e97ae7da418ac77749fecee758bb43a8d69f840","affectsGlobalScope":true},{"version":"040c71dde2c406f869ad2f41e8d4ce579cc60c8dbe5aa0dd8962ac943b846572","affectsGlobalScope":true},"3586f5ea3cc27083a17bd5c9059ede9421d587286d5a47f4341a4c2d00e4fa91","a6df929821e62f4719551f7955b9f42c0cd53c1370aec2dd322e24196a7dfe33","b789bf89eb19c777ed1e956dbad0925ca795701552d22e68fd130a032008b9f9","9dd9d642cdb87d4d5b3173217e0c45429b3e47a6f5cf5fb0ead6c644ec5fed01",{"version":"0a62259f3f3fe54972759d6862d29935909427b80d207412079a420e6503b8d9","signature":"6b3cfaf7c0e6065ff01aefc360b9c1820eaae425630f27c3ba133aef659d7cb0"},{"version":"b1f468d7812fbbe005c5195d6f61e32eb6e70220093067553739b04ffec8dce8","signature":"ca2b77fbb3b02c9d7bcbb4b11df3890bde6296ce50143df5039e63dfc6775138"},{"version":"eb33c402b0071d49412ec4358af5af4780d4727a3e7ac5649b4a326f472228a1","signature":"ebc450cf4888573aef03e1d85e34f8587789f7436e4c80a3f1417a66429a9a29"},"f23ebd35cba6ebc2e0499912aeeee3aed8183140cbe7ba65d53f40dc3fcd9e1d",{"version":"ea1363500df825e4c1e9324b9318afe49807e60722ce6ddf772bf2d01481e36c","signature":"cb05bc98a45f3ba835e4f0407eb32fa27fccecd0bdb855311f7c3e7973c586df"},{"version":"288b918290375fdfe19a2dcc20d00856e012a2823f6010e8ea4bb803d73d7518","signature":"c87493ab36df48048a847be46a72b19c4a87f8fc839b8b5b2321a39ff48ce6de"},{"version":"61c4816b3d9b25534252aeba5162683a7c95b4aa454d53cb6ec63f4e5edce4c6","signature":"c87493ab36df48048a847be46a72b19c4a87f8fc839b8b5b2321a39ff48ce6de"},{"version":"3fd3963fca222d8491ae25096eb220ad6fca4e8ee1adf248b25889a8cae8d8bc","signature":"38acab70ac06cb2d2edfeb75f068f2fd9adf814c7bed5e88835746135e67d18d"},{"version":"3a97a6e510431276da469ecf5c95fe808c477ddd7ebe3f76bf126fb4677e09be","signature":"1374647013c8c04ba912c471ce54cc86c0b9f0ff03e5fc1de0caa39268763743"},"fe93c474ab38ac02e30e3af073412b4f92b740152cf3a751fdaee8cbea982341","aa4feed67c9af19fa98fe02a12f424def3cdc41146fb87b8d8dab077ad9ceb3c","1e00b8bf9e3766c958218cd6144ffe08418286f89ff44ba5a2cc830c03dd22c7",{"version":"cadcd37df7171e6fb2f03e638266049e383cf82dcec9a5fd5d64ef6b0c83c775","affectsGlobalScope":true},{"version":"337c67e922bf81fcc083b08c77d0f33a2036dbf070cc079a37d0c7b841641cb5","signature":"640959dc62b4e32495bcbefeff717d7cd5f0f578ac0851f2554043b42adc5afa"},{"version":"f95aedbfef6b3dc0b3108de5be2a046e487080968fcbfe4ed0755ebc42cfadc4","signature":"0d8a615a89cfc0456861b5b71aa7db91b73f0295393b77b633e25e4c3d51b5fb"},"37c7961117708394f64361ade31a41f96cef7f2a6606300821c72438dd4abda3",{"version":"d3c9548085759a0d4f1878865ab81496bc1fa19a43c18e9e00b8348865d28846","affectsGlobalScope":true},"3d9189f26f01d4e36d3fb380810ef5999992235282e3c293da77d1d8aed09d9f","a4af8389a20cfb4ab325dc1ce77661792e1b0bab9e0d871847a1765a3682e16c","db7da89b083e353471f3911adb59288c2d4bda401b25433943e8128d654e0afc",{"version":"6c079bbb932793632432ba78a29e4de6805bace4747131f9d8d2fa426e55b095","signature":"3dc2d86457059e88f70931d884e5dee157c51b1431f2165bb6611620db62ab4d"},{"version":"be856cdaf46478c5213685fd1141383805f22c874b6bb707740d04941094cc4b","signature":"d0acd2ff35aa9d7e9d180c509cabeccfda969e9ee60bc8782ed6b986d7fbac59"},{"version":"c08eac714d68ce1b185ef581a000abf67d71123eea8a575445ca00c06bebefc3","signature":"e5c627adddd1152ea489176054e8f12309b1a41c577dc204c45d110b2568b239"},{"version":"e914c4ef63fd0f6d21fb4350fcd6238d03dd27305c44b3c92287d70b77e55015","signature":"cefcbe9814468f57a7c28a18dd4c62fde91a151de02d4fcdab8619752e15fadf"},{"version":"1a17717bc1c6e26481d94454b1bee44ba0950e61d31ba0a608169845b08ef42f","signature":"fb83dd3967d2a417808431c1b462599fd9f47b65c58c61964f698f4a2b0280c2"},{"version":"7a328adbafa90f5e787160c335637bcaeba9797b565ae24162240fe91f7f49f3","signature":"2f1920e0fb258d65e8b4360ced1653a516204fbd9abf40f7a4c06744da35a330"},{"version":"525e5436b12154efbf3ea4a6be2ba77e49ac5f630bfb3a9d5f415e5a275a3f51","signature":"1e3d82f1012484c20929ac86b2e681fb538817408f0eb4b307ebf8107ef58434"},{"version":"b4e35db20de72acbfb0f860b69d9fe9fbc0a34514134b9d437ff183fb77fe6fe","signature":"f0f5808f88b6f8e59ba93467842724addc7dc4fc2930e8da371d9d3a87895309"},{"version":"37fd7a0acbb2d773eabbb0a1b228635e6ac89293c14c24cf1a093cf076437478","signature":"1df3d04a476f9696dde149f0198c684bffac6b677ce5e7c7a590ef2e2dbcfd85"},{"version":"9dbeca460a3b3af2bcb227c29db4e760dfc7ad6f51ceff4dae0a94ad3a9ec706","signature":"8804a194fff45016ff35a5d4cc2a33922a9a6cdda9b21807891d55b9421902c0"},{"version":"b12188c87ba864883e9519e6453c1b88f2299f6eb5e03ddf1cfbee30f5777ceb","signature":"623a3fbc715929f31b2a20ad6ba54bcbb37f84616faee51468045bd243afe363"},{"version":"4e55972b44736f8c44d6645448763f5308a86c718981ede1ecce4ebc53cfb1d1","signature":"efa73c947bbb63d7ff1f4b96ff3adfe5db74dc63b84ccfc03261cf3337f33ff4"},{"version":"a014b2aaca6228eacb24cce9d3a0de39448ff058c268fa00f23c0f239b4ee9dd","signature":"8b8d340731c9ce97b8a05e5d764eaa4c372e0b04fb9cd25348fd737f50b5edb5"},{"version":"5825ec2993d14ff1d8a461719f94c32b93b9942fb067ac74183a187686d9a430","signature":"aacb3b7139572ced2b38f1a0a45ccd465432facb048bb876162f12899c889b26"},{"version":"1171b3d3da8b96340f8aa5bdb7b74a52837c78e01190882fa5495850052d74ba","signature":"e59a0fb1c24a352d8d465f1fc9dd13902d3409c6f23ab06c7afebd26beb965cd"},{"version":"a4dd0069f2d00d24dd32fd1b2c6ace3d9bd9e7b7734214ca829998d168526e8a","signature":"66f2989f8e3f6143e323a744928b2a7fb163200ab4af7e15b08fc06f57da6af6"},{"version":"2dc481991b07f316b2e61d00d35c755ce1d85a2cc6a5ce1053b88be6f5f549dc","signature":"e79840b9cd24bed32462a4228e2524fd36f77c0ca6bbc008139fcffaea81e50f"},{"version":"13fc65ba3f6fd1ba57d7fb602f959d15cde6b70123514c7464e9673a961fd257","signature":"e82caf10374ffb673a88e6b6a5fd7cf47d69c0e800c9dc9c133eebe815f15997"},{"version":"99aee55753de2fe5dee914e3a6011de95c4e73b465fab5078af42977839d43bc","signature":"b4cc00f6db6c314f78a238849dc31a597cacb0ccad7f4c001d068d2bfe50d5d7"},{"version":"c4bcd937d4caa40108500cd982338945e2a2c5d3319bb52c05480de4d483893e","signature":"e6a19a704427309c5eebf23c6ce9dc5d139121e8386da1efc3f18f88983cd980"},{"version":"1c309deccced4c39c281ebd7441057d966ccab8d963680492313ae61d41a8b9d","signature":"021cd31d1abe40bdc5573b80aa18adf586f7c24e04bfc92356a8ecddadc9c878"},"8f95b4b53d4522f8d1010a073c07aebdda64f44d56b0a22a89400242aa3f4723","7e0dd7745de5cfc3c45f808d9f8553f65ab5e46137c1ee44ab0c6952e2293d7c","7d726479d24cdccd0a77a47b7203a4dd231ae8c97035c12c568dc6966ddb6a64","c335ba6a64c20a5feaff899e6491ec4c4e5dd69e70066b3a4d7e2bc964cd3057","123e805b51c37983b549cbbcc52f644b9714b6595e40145f79472e8a84b9ed86","5d8b31143c299a58ee75de8d08640b76d02b14ed21dd0d2f4f4ab2474f5a7d90","50cca1953dae077b33f08a532c408045e877a7b8c078ee5513231b005664cfd0","5e3dbd3b43e6ec52958b141af2b4bef1b2de8f602d9bea636f37eec83d4440b2","e92837bb84d6e09cf2a41029ca445effec2eb26c22317118439e546fdd33835a","7ed9b4563cbc9f9baac3be14c05ec6236314b9352606ee36758e088a6ec2eeec","7d13c1f2e06b846642d1843412df218725c7b87976e83129f62e8f2d4c58fa52","94a8c1c289ef27f42280c1d730100a28540f709492fff746cff2286b0e406a26","8c26acc596067d21f15f5dc136b4d3daf5658854461c29f4dc6ec66a480718e3","3bec811f5aeba45b7ff3adc9abbfb8aff256984bf44b26a5d1ba276aa79d261d","3737225833b121f3fcb4402070c095d87c29bf453796707a26da829f4228c1fc","7cac781e1c51f3eabbbdd6a2e17f83ad04ed016267ae0ce45d57d4fd14f563c4","c9d927a8c00c15ae154d85cfdc3830e18d3d0972eb549311473468ffd682826d","3c2179e56922a2e287e466534c6fb20691f83853b870d99f609ceb9bc7526a55","c1247c0820d5d9645163386bdb52947ecb9fbc45c436213c0c2c91e1dc8449ca","ed5e4d71f85fa8c7b70eac885fa1da580c7d5632cbbacf6478b675c67d3ec9df","0e24b3fb18105ee4e4536de9d15f885d22a8119633550ff52c6d5aa27cfc4cf5","3ce2e95dba28838c21a981faff028630d7e874c8c429e6d515cdc448cb868e42","e03e31f8cd337c7fd31b106d463960d35344860bc7a02f8f1da9a872eeb686f4","c4b966e6c010c501a32ac2bc8dc9420a87e5c4a3e0685f700262f02c045b6fb4","8d98489d008026dd1a38cb9d70b31558c0164ec488b9815b8ae0ed466d215df9","32c5af30582fc4d9cd817aab004de53994027c64a2931dbd4229935fa677dc31","11b1d083ec7b7de157f7bdad5a11a4b53913d1caa56007773b9a32b203e86781","18d99cee5c26fd8e9fbf386f055ac2b269fa7d645c1e4fd3e7bb5b3476ad6aec","2dde80ffcef0c366a1ae22a6eea8dbc6821d518092b6a0bbdceb37da0d53cfbf","0eab6314ceccba630cc6cca396d80e8415efe03903df730d57517ef1bb30bc4f","bab2e3c1a519be231dafb3d9b0463fc7415e356f89c08b785c0eb8b86d7556c4","ffa44f47e95902b40d02b5a2a2395a2825937df7ca08542716b015dfc61862ca","2b6ec928ac39e9e63c9406c427c0fb7d1e84d80d7b3c8dd78be121c8e5b32ee9","eff6fa1bcb36c62e15a4ab37e4717aa804986cb095c6c0cf676a596d614126eb","9d39ae81494ec822f28812de06f4441ff839940aa06b7e3cb0f9e02623cc310c","c869fea6f6781ff27332ff370d422ceae6f1c8ebda4ca79275d89d147786c1d4","d438883ea02e1c9e045f47b8a18ae014e4011d4c7ab8798b7b9f1be8b55bab20","babae7f05d084027561e1b7812edb6a660687946bd2c7729d5e186b9e494f9ab","e9a9f2962a374bd2d2b53059357d6ce9f0416f49e2c53d38f5c514ce00692c30","24bd9f28cb058c7bef45cc6f9babaa3af9694c6d68f8037cb6fe88f2419b1c1c","cc4f3e808c9e0251a3e4ac160a5836832eff53194dcb39e3cb2f3e70eaeb511c","7450441efd97dc54f68fe785a6a7f1eae875c11338134889bc88eaf052b70df0","426a1be9f47a8db226a21250158562e1837ad36862671cd4764d4d360f0c9eea","5fc1a3db11db206c64d5038b44276e94dcd402b262776b9a27c19e9176f2e8e6","c73e8393670ba80643a3bc0078a7f3de8193acfe1fd7c84e76132312562a419a","28a7f3ca9fcca7caca89b6bf74c2aefe982f7ff57f36bcb5f29c91833d39b302","d036b54cb57366f779bb8b998d92778ad1453e3e1483013cad43df76dd7c4eb1","325c9eda18d6e766fa14c006d4c1c329f3ad8cbdc2ed7c117af113b71f7aaeed","1105bd9fa22a9508097685f15ea765554eb65d55b455d273150dac014246f787","7092715152a127a874c1453831de3bda4e6527200b5fb79af83c420d4a445b7f","83562fedbc941e235a3be1c99b337cc69d6f9aae4999ac836adef2f920b9e3dc","26fbcd7cd9416ce4438e56417ae7b8b91eafb1cc647bac002778d57583dfecf4","95eb8982a57d9933d65e2afdd5c866bc715e40c30a0dbaceb59892501ad659e8","21a53758e5f95a22f56995233bfe18bd3f39c23ad64a57936cf793f5fb01fdbb","8cbf0fbcb7706d0a2394eae1a564825d50a0d0c1ee9336f8bc8c7da41711ed44","a31738774f95b193a777d9531f9c3609e0294cefe7f0971acce955e8ef52e8d5","ea88363b3147f77e19ea1b55f0cb038626364d476863e8e2f91cf60cf286e7e7","913ad4fa2f9e0b444c264605fce1605cbeb47d5be25137f9bdd25f3ccd7be556","d2a7cc6e7044a81891d07d0be88dd12f7559fbbb35227a3ad42514c9fb96b83a","914260e95660c84a6e283ad91dd832d9f3119fe9a7cb7ffcd0764716dc4f705a","0eb6cee7bcf4262afd1a083f9fef4ec12de5022e29e9fa0c86d0acd635eb37ac","a6b39f1d2ceaf4f5bb3dab98483fff79e4ede4786928c93307a482d0e888d12d","3cd99ec82de92fff68a2768cab73739911766bb7c6e7d10e29706d656107a2b5","c21314a38f4337202999e6473579aeaaef6371b6d001973692715433f4e7fc89","899bc20734112d2094d89e4f55644c6f3115d2440c250822ffbd4fa212b158a5","d39fd2772f9bb4dacc97319c5ed760ea9e2d83458b522eb5894ab09b0674a704","3f635b32106636b9c54c7cce0c73372f99859f9ae90c0de7d83d01f48af3064f","d114c65d009de428f5c9ae22fab8ab7a602d22822fb8eb77ba3f09ca7aaef895","fdc9ee7bc24198eb4ef75bff9c3233bab7b7586bad8ea11bf18cd6faacbc5c65",{"version":"0d2a7418e35a98ade26bfc6c9de422e24c28a60fe96dfd252f7ac3e060f00808","signature":"1d33a8040d75aa986e14dd4681238feb9da025643c24820918e9394c6e086d3f"},{"version":"1ef1df325523650410ebda29211c06c7c963768c67b5352ca13e8f6bc07510d1","signature":"b4d655435f7c04654e7e231feb20c8386c210f10486779a239aa7080acec6eda"},{"version":"84641b9cf9af126a9eef5a684d025cc6ebc470446ffef7daa3e0faa8520818c4","signature":"162bf5de97e0b3b8137af0a02a8cc0c4ba63e1bfdfa5dbdd97a38944fb1142fc"},{"version":"e3002b088b7ea35d20f2e12a2a031be1462b465e883ef9d0ed1a6c519f5772cc","signature":"77c6e550f786975c9cc008336a68b3ec57004422bdbab444ad7186bab84069dd"},{"version":"ea949b19ab3485cc36820def10c71017433fe625cba38f91d5fb9ce4eb76a4b1","signature":"b56298cc4d619f4743ed1c4d4ec44c7a5a6b90bcd6bcc0aef5f0a0c73a5528ec"},{"version":"74d8baa7dd01b47bf627a69bd5c31e4921eedc144ed57cd5ab07b47987706cc4","signature":"faf8cf21ad337cbd3d619e2a41973df9aa06bab9225b15259c27c92d79eb5849"},{"version":"00083e3ac1629da5988b212d7d5838413cec78c49f40c8c27283f3618b026b70","signature":"409e25e967d6532bbe47bd5898852c5ca81eea79db58ea6668d6b87846d22fce"},{"version":"8f6c68ebfd56c8a3768e133ed22cc8e600d8b649210c8bd1b76965270f319acc","signature":"9349bed174f681b858c8b8db6d7aa14126739cac62bdc48a7aa861e26b79b73c"},{"version":"402a0b76fe63dff5c265ce5296f104b45339daccefc09b47f50d6ef8f32814d5","signature":"ebb6956d78f9ea4abd279fe448f4a644f3ed02ecc29b0aefef3a56aec9d1e401"},{"version":"9a39de24549e405d22b5399360ed9676ba297665a3c7c45d8db8764af5c5f35f","signature":"220d366ee201a414b40b356d6da0b3e63a10b07537e726f82098c24f8ca844d6"},{"version":"5b15ff18e3d49141d2f817dd3d1158f11cc7122d653a4cb1386fa3eb7ad86f01","signature":"7a8841cbfbfce9ced5230e4ac6d1098e673a0432d6b0a419ac6084e4804e3fb6"},{"version":"1ec69a9cd5b108a5a26fc1af4138e104519c111e181c796c531c21020cdce8c2","signature":"f7e84c9c7399d73a2f36bcf513f06922e854e66da16bdb1827b8dda29645a910"},{"version":"8e5065b7ae5e3be50166e4687e625bc86ae614510991de8ba48305fc907ec721","signature":"669f09b2f989bd8d3af204c5c906ae7f6304fed94cfb18961927a456b0c6cad5"}],"root":[[379,382],[384,388],393,394,[400,420],[490,502]],"options":{"allowJs":true,"esModuleInterop":true,"jsx":1,"module":99,"skipLibCheck":true,"strict":true,"target":9},"fileIdsList":[[383],[384],[388,412],[388,405,407],[388,416],[358,405,406,418],[367,391,392,393],[491],[352,388,409],[388,401,405,407,493],[496],[377],[388,501],[161,399],[387,399],[401,405,407,411],[161,387,399,400,401,405,407,415],[161,387,398,399,400,401,402,403,405,407,408],[401,405,407,500],[121,130,388,401,405,407,495],[399],[420,490],[356],[399,490],[489],[358,404],[161,358,399,406],[161],[374,380],[377,378],[455,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485],[455],[455,457],[64,455,457],[421,422,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454],[421,422,423],[421,422],[422],[71],[107],[108,113,142],[109,120,121,128,139,150],[109,110,120,128],[111,151],[112,113,121,129],[113,139,147],[114,116,120,128],[107,115],[116,117],[120],[118,120],[107,120],[120,121,122,139,150],[120,121,122,135,139,142],[105,108,155],[116,120,123,128,139,150],[120,121,123,124,128,139,147,150],[123,125,139,147,150],[71,72,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],[120,126],[127,150,155],[116,120,128,139],[129],[130],[107,131],[128,129,132,149,155],[133],[134],[120,135,136],[135,137,151,153],[108,120,139,140,141,142],[108,139,141],[139,140],[142],[143],[107,139],[120,145,146],[145,146],[113,128,139,147],[148],[128,149],[108,123,134,150],[113,151],[139,152],[127,153],[154],[108,113,120,122,131,139,150,153,155],[139,156],[64],[64,68,163,164,166,168,330,373],[64,68,163,164,166,167,330,373],[64,68,163,164,167,168,330,373],[63,159,160],[64,68,164,166,167,168,330,373],[64,68,163,166,167,168,330,373],[62,63],[255],[123],[64,396],[64,161,255,395,396,397],[395],[69],[334],[336,337,338],[340],[171,181,187,189,330],[171,178,180,183,201],[181],[181,183,308],[236,254,269,376],[278],[171,181,188,222,232,305,306,376],[188,376],[181,232,233,234,376],[181,188,222,376],[376],[171,188,189,376],[262],[107,158,261],[64,255,256,257,275,276],[161,255],[245],[64,255],[244,246,350],[64,255,256,273],[251,276,362],[360,361],[195,359],[248],[107,158,195,211,244,245,246,247],[64,273,275,276],[273,275],[273,274,276],[134,158],[243],[107,158,180,182,239,240,241,242],[64,172,353],[64,150,158],[64,188,220],[64,188],[218,223],[64,219,333],[389],[64,68,123,158,161,163,164,166,167,168,330,371,372],[330],[170],[323,324,325,326,327,328],[325],[64,219,255,333],[64,255,331,333],[64,255,333],[123,158,182,333],[123,158,179,180,191,209,211,243,248,249,271,273],[240,243,248,256,258,259,260,262,263,264,265,266,267,268,376],[241],[134,158,161,180,181,209,211,212,214,239,271,272,276,330,376],[123,158,182,183,195,196,244],[123,158,181,183],[123,139,158,179,182,183],[123,134,150,158,179,180,181,182,183,188,191,192,202,203,205,208,209,211,212,213,214,238,239,272,273,281,283,286,288,291,293,294,295,296],[123,139,158],[171,172,173,179,180,330,333,376],[123,139,150,158,176,307,309,310,376],[134,150,158,176,179,182,199,203,205,206,207,212,239,286,297,299,305,319,320],[181,185,239],[179,181],[192,287],[289,290],[289],[287],[289,292],[175,176],[175,215],[175],[177,192,285],[284],[176,177],[177,282],[176],[271],[123,158,179,191,210,230,236,250,253,270,273],[224,225,226,227,228,229,251,252,276,331],[280],[123,158,179,191,210,216,277,279,281,330,333],[123,150,158,172,179,181,238],[235],[123,158,313,318],[202,211,238,333],[301,305,319,322],[123,185,305,313,314,322],[171,181,202,213,316],[123,158,181,188,213,300,301,311,312,315,317],[162,209,210,211,330,333],[123,134,150,158,177,179,180,182,185,190,191,199,202,203,205,206,207,208,212,214,238,239,283,297,298,333],[123,158,179,181,185,299,321],[123,158,180,182],[64,123,134,158,170,172,179,180,183,191,208,209,211,212,214,280,330,333],[123,134,150,158,174,177,178,182],[175,237],[123,158,175,180,191],[123,158,181,192],[123,158],[195],[194],[196],[181,193,195,199],[181,193,195],[123,158,174,181,182,188,196,197,198],[64,273,274,275],[231],[161,172],[64,161,205],[64,161,162,208,211,214,330,333],[64,172],[172,353,354],[64,223],[64,134,150,158,170,217,219,221,222,333],[182,188,205],[204],[64,121,123,134,158,170,223,232,330,331,332],[61,64,65,66,67,163,164,166,167,168,330,373],[113],[302,303,304],[302],[342],[344],[346],[390],[348],[351],[355],[68,70,330,335,339,341,343,345,347,349,352,356,358,364,365,367,374,375,376],[357],[363],[219],[366],[107,196,197,198,199,368,369,370,373],[158],[64,68,123,125,134,158,161,163,164,165,166,167,168,170,183,322,329,333,373],[82,86,150],[82,139,150],[77],[79,82,147,150],[128,147],[77,158],[79,82,128,150],[74,75,78,81,108,120,139,150],[74,80],[78,82,108,142,150,158],[108,158],[98,108,158],[76,77,158],[82],[76,77,78,79,80,81,82,83,84,86,87,88,89,90,91,92,93,94,95,96,97,99,100,101,102,103,104],[82,89,90],[80,82,90,91],[81],[74,77,82],[82,86,90,91],[86],[80,82,85,150],[74,79,80,82,86,89],[108,139],[77,82,98,108,155,158],[456,487,488],[455,456,486],[456,486],[64,387],[374]],"referencedMap":[[384,1],[385,2],[386,2],[413,3],[414,4],[417,5],[419,6],[394,7],[492,8],[410,9],[494,10],[497,11],[382,12],[498,4],[499,11],[502,13],[418,14],[415,14],[400,15],[412,16],[416,17],[409,18],[501,19],[496,20],[420,21],[491,22],[404,23],[406,23],[493,24],[490,25],[405,26],[407,27],[500,21],[393,28],[495,28],[381,29],[379,30],[486,31],[457,32],[475,33],[472,33],[462,33],[461,33],[479,33],[469,33],[473,33],[485,33],[484,33],[482,34],[481,33],[483,33],[458,33],[464,33],[460,33],[478,33],[466,33],[474,33],[463,33],[459,33],[470,33],[476,33],[477,33],[471,33],[467,33],[468,33],[480,33],[465,33],[455,35],[441,36],[438,37],[428,38],[427,36],[446,37],[435,36],[439,36],[451,37],[450,37],[448,36],[447,37],[449,37],[424,36],[430,36],[426,37],[444,37],[431,37],[440,36],[429,36],[425,36],[436,37],[442,36],[443,36],[437,36],[432,36],[434,36],[445,37],[433,38],[71,39],[72,39],[107,40],[108,41],[109,42],[110,43],[111,44],[112,45],[113,46],[114,47],[115,48],[116,49],[117,49],[119,50],[118,51],[120,52],[121,53],[122,54],[106,55],[123,56],[124,57],[125,58],[158,59],[126,60],[127,61],[128,62],[129,63],[130,64],[131,65],[132,66],[133,67],[134,68],[135,69],[136,69],[137,70],[139,71],[141,72],[140,73],[142,74],[143,75],[144,76],[145,77],[146,78],[147,79],[148,80],[149,81],[150,82],[151,83],[152,84],[153,85],[154,86],[155,87],[156,88],[165,89],[167,90],[168,91],[166,92],[161,93],[163,94],[164,95],[64,96],[255,89],[392,97],[383,98],[397,99],[398,100],[399,89],[396,101],[70,102],[335,103],[339,104],[341,105],[188,106],[202,107],[306,108],[309,109],[270,110],[279,111],[307,112],[189,113],[235,114],[308,115],[209,116],[190,117],[214,116],[203,116],[173,116],[261,118],[262,119],[258,120],[263,121],[350,122],[256,123],[351,124],[259,125],[363,126],[362,127],[265,123],[360,128],[260,28],[247,129],[248,130],[257,131],[274,132],[275,133],[264,134],[242,135],[243,136],[354,137],[357,138],[221,139],[220,140],[219,141],[366,89],[218,142],[390,143],[371,89],[373,144],[201,145],[171,146],[329,147],[327,148],[328,148],[334,149],[342,150],[346,151],[183,152],[250,153],[241,135],[269,154],[267,155],[273,156],[245,157],[182,158],[207,159],[297,160],[174,161],[181,162],[170,108],[311,163],[321,164],[320,165],[192,166],[288,167],[294,168],[296,169],[289,170],[293,171],[295,168],[292,170],[291,168],[290,170],[230,172],[215,172],[282,173],[216,173],[176,174],[286,175],[285,176],[284,177],[283,178],[177,179],[254,180],[271,181],[253,182],[278,183],[280,184],[277,182],[210,179],[298,185],[236,186],[319,187],[239,188],[314,189],[315,190],[317,191],[318,192],[313,161],[212,193],[299,194],[322,195],[191,196],[281,197],[179,198],[238,199],[237,200],[193,201],[246,202],[244,203],[195,204],[197,205],[196,206],[198,207],[199,208],[252,89],[276,209],[232,210],[344,89],[353,211],[229,89],[348,123],[228,212],[331,213],[227,214],[355,215],[225,89],[226,89],[224,216],[223,217],[213,218],[206,134],[205,219],[251,89],[333,220],[68,221],[65,89],[312,222],[305,223],[303,224],[343,225],[345,226],[347,227],[391,228],[349,229],[352,230],[378,231],[356,231],[377,232],[358,233],[364,234],[365,235],[367,236],[374,237],[375,238],[330,239],[89,240],[96,241],[88,240],[103,242],[80,243],[79,244],[102,238],[97,245],[100,246],[82,247],[81,248],[77,249],[76,250],[99,251],[78,252],[83,253],[87,253],[105,254],[104,253],[91,255],[92,256],[94,257],[90,258],[93,259],[98,238],[85,260],[86,261],[95,262],[75,263],[101,264],[456,32],[489,265],[487,266],[488,267]],"exportedModulesMap":[[413,89],[414,89],[417,89],[419,89],[394,89],[492,89],[410,89],[494,89],[497,89],[382,12],[498,89],[499,89],[502,89],[418,89],[415,89],[411,89],[400,268],[401,89],[402,89],[412,89],[416,89],[409,89],[403,89],[501,89],[496,89],[420,89],[491,89],[404,89],[406,89],[493,89],[490,89],[405,89],[407,89],[500,21],[408,89],[495,28],[381,269],[379,30],[486,31],[457,32],[475,33],[472,33],[462,33],[461,33],[479,33],[469,33],[473,33],[485,33],[484,33],[482,34],[481,33],[483,33],[458,33],[464,33],[460,33],[478,33],[466,33],[474,33],[463,33],[459,33],[470,33],[476,33],[477,33],[471,33],[467,33],[468,33],[480,33],[465,33],[455,35],[441,36],[438,37],[428,38],[427,36],[446,37],[435,36],[439,36],[451,37],[450,37],[448,36],[447,37],[449,37],[424,36],[430,36],[426,37],[444,37],[431,37],[440,36],[429,36],[425,36],[436,37],[442,36],[443,36],[437,36],[432,36],[434,36],[445,37],[433,38],[71,39],[72,39],[107,40],[108,41],[109,42],[110,43],[111,44],[112,45],[113,46],[114,47],[115,48],[116,49],[117,49],[119,50],[118,51],[120,52],[121,53],[122,54],[106,55],[123,56],[124,57],[125,58],[158,59],[126,60],[127,61],[128,62],[129,63],[130,64],[131,65],[132,66],[133,67],[134,68],[135,69],[136,69],[137,70],[139,71],[141,72],[140,73],[142,74],[143,75],[144,76],[145,77],[146,78],[147,79],[148,80],[149,81],[150,82],[151,83],[152,84],[153,85],[154,86],[155,87],[156,88],[165,28],[167,90],[168,91],[166,92],[161,93],[163,94],[164,95],[64,96],[255,89],[392,97],[383,98],[397,99],[398,100],[399,89],[396,101],[70,102],[335,103],[339,104],[341,105],[188,106],[202,107],[306,108],[309,109],[270,110],[279,111],[307,112],[189,113],[235,114],[308,115],[209,116],[190,117],[214,116],[203,116],[173,116],[261,118],[262,119],[258,120],[263,121],[350,122],[256,123],[351,124],[259,125],[363,126],[362,127],[265,123],[360,128],[260,28],[247,129],[248,130],[257,131],[274,132],[275,133],[264,134],[242,135],[243,136],[354,137],[357,138],[221,139],[220,140],[219,141],[366,89],[218,142],[390,143],[371,89],[373,144],[201,145],[171,146],[329,147],[327,148],[328,148],[334,149],[342,150],[346,151],[183,152],[250,153],[241,135],[269,154],[267,155],[273,156],[245,157],[182,158],[207,159],[297,160],[174,161],[181,162],[170,108],[311,163],[321,164],[320,165],[192,166],[288,167],[294,168],[296,169],[289,170],[293,171],[295,168],[292,170],[291,168],[290,170],[230,172],[215,172],[282,173],[216,173],[176,174],[286,175],[285,176],[284,177],[283,178],[177,179],[254,180],[271,181],[253,182],[278,183],[280,184],[277,182],[210,179],[298,185],[236,186],[319,187],[239,188],[314,189],[315,190],[317,191],[318,192],[313,161],[212,193],[299,194],[322,195],[191,196],[281,197],[179,198],[238,199],[237,200],[193,201],[246,202],[244,203],[195,204],[197,205],[196,206],[198,207],[199,208],[252,89],[276,209],[232,210],[344,89],[353,211],[229,89],[348,123],[228,212],[331,213],[227,214],[355,215],[225,89],[226,89],[224,216],[223,217],[213,218],[206,134],[205,219],[251,89],[333,220],[68,221],[65,89],[312,222],[305,223],[303,224],[343,225],[345,226],[347,227],[391,228],[349,229],[352,230],[378,231],[356,231],[377,232],[358,233],[364,234],[365,235],[367,236],[374,237],[375,238],[330,239],[89,240],[96,241],[88,240],[103,242],[80,243],[79,244],[102,238],[97,245],[100,246],[82,247],[81,248],[77,249],[76,250],[99,251],[78,252],[83,253],[87,253],[105,254],[104,253],[91,255],[92,256],[94,257],[90,258],[93,259],[98,238],[85,260],[86,261],[95,262],[75,263],[101,264],[456,32],[489,265],[487,266],[488,267]],"semanticDiagnosticsPerFile":[384,385,386,413,414,417,419,394,492,410,494,497,382,498,499,502,418,415,411,400,401,402,387,412,416,409,403,501,496,420,491,404,406,493,490,405,407,500,408,393,380,388,495,381,379,332,486,457,475,472,462,461,479,469,473,485,484,482,481,483,458,464,460,478,466,474,463,459,470,476,477,471,467,468,480,465,454,452,453,455,421,422,441,438,428,427,446,435,439,451,450,448,447,449,424,430,426,444,431,440,429,425,436,442,443,437,432,434,445,433,423,71,72,107,108,109,110,111,112,113,114,115,116,117,119,118,120,121,122,106,157,123,124,125,158,126,127,128,129,130,131,132,133,134,135,136,137,138,139,141,140,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,160,165,167,168,166,159,161,163,164,62,64,255,392,383,73,63,397,398,399,396,395,70,335,339,341,188,202,306,234,309,270,279,307,189,233,235,308,209,190,214,203,173,261,262,178,258,263,350,256,351,240,259,363,362,265,361,359,360,260,247,248,257,274,275,264,242,243,354,357,221,220,219,366,218,194,369,390,389,372,371,373,169,300,201,171,323,324,326,329,325,327,328,187,200,334,342,346,183,250,249,241,269,267,266,268,273,245,182,207,297,174,181,170,311,321,310,320,208,192,288,287,294,296,289,293,295,292,291,290,230,215,282,216,176,175,286,285,284,283,177,254,271,253,278,280,277,210,162,298,236,272,319,239,314,180,315,317,318,301,313,212,299,322,184,186,191,281,179,185,238,237,193,246,244,195,197,370,196,198,337,336,338,368,199,252,69,276,222,232,211,344,353,229,348,228,331,227,172,355,225,226,217,231,224,223,213,206,316,205,204,340,251,333,61,68,65,66,67,312,305,304,303,302,343,345,347,391,349,352,378,356,377,358,364,365,367,374,376,375,330,59,60,10,11,13,12,2,14,15,16,17,18,19,20,21,3,22,4,23,27,24,25,26,28,29,30,5,31,32,33,34,6,38,35,36,37,39,7,40,45,46,41,42,43,44,8,50,47,48,49,51,9,52,53,54,57,55,56,1,58,89,96,88,103,80,79,102,97,100,82,81,77,76,99,78,83,84,87,74,105,104,91,92,94,90,93,98,85,86,95,75,101,456,489,487,488],"affectedFilesPendingEmit":[384,385,386,413,414,417,419,394,492,410,494,497,382,498,499,502,418,415,411,400,401,402,387,412,416,409,403,501,496,420,491,404,406,493,490,405,407,500,408,393,380,388,495,381]},"version":"5.4.5"}
\ No newline at end of file
diff --git a/ee/packages/den-db/.env.example b/ee/packages/den-db/.env.example
new file mode 100644
index 0000000000..2d9c437180
--- /dev/null
+++ b/ee/packages/den-db/.env.example
@@ -0,0 +1,14 @@
+# MySQL mode: if DATABASE_URL is set, den-db uses mysql/mysql2.
+DATABASE_URL=
+
+# Required dedicated DB encryption key for encrypted columns. Minimum 32 chars.
+# Generate one with: openssl rand -base64 128
+DEN_DB_ENCRYPTION_KEY=
+
+# PlanetScale mode: used when DATABASE_URL is not set.
+DATABASE_HOST=
+DATABASE_USERNAME=
+DATABASE_PASSWORD=
+
+# Optional explicit env file path for Drizzle commands.
+# OPENWORK_DEN_DB_ENV_PATH=/absolute/path/to/.env.production
diff --git a/ee/packages/den-db/README.md b/ee/packages/den-db/README.md
new file mode 100644
index 0000000000..9b2b6c7e0a
--- /dev/null
+++ b/ee/packages/den-db/README.md
@@ -0,0 +1,36 @@
+# den-db
+
+`@openwork-ee/den-db` owns the Den database schema and migration history.
+
+## Canonical workflow
+
+- Keep schema changes in `src/schema/**`.
+- Keep generated SQL migrations in `drizzle/`.
+- Always generate new migrations with Drizzle from this package.
+- Do not create migrations from `den-api`, `den-controller`, or other apps.
+
+## Commands
+
+Generate a migration after editing the schema:
+
+```bash
+pnpm --dir ee/packages/den-db db:generate
+```
+
+Apply schema directly to a development database:
+
+```bash
+pnpm --dir ee/packages/den-db db:push
+```
+
+Run Drizzle migrations against a configured database:
+
+```bash
+pnpm --dir ee/packages/den-db db:migrate
+```
+
+## Notes
+
+- `db:generate` is the default path for new migration files.
+- `drizzle/meta/` must stay in sync with the SQL migration history so future generation stays incremental.
+- Only repair `drizzle/meta/` manually when recovering broken Drizzle history.
diff --git a/ee/packages/den-db/drizzle.config.ts b/ee/packages/den-db/drizzle.config.ts
new file mode 100644
index 0000000000..ea72da42ec
--- /dev/null
+++ b/ee/packages/den-db/drizzle.config.ts
@@ -0,0 +1,44 @@
+import "./src/load-env.ts"
+import { defineConfig } from "drizzle-kit"
+import { parseMySqlConnectionConfig } from "./src/mysql-config.ts"
+
+const databaseUrl = process.env.DATABASE_URL?.trim()
+
+function isGenerateCommand() {
+  return process.argv.some((arg) => arg === "generate")
+}
+
+function resolveDrizzleDbCredentials() {
+  if (databaseUrl) {
+    return parseMySqlConnectionConfig(databaseUrl)
+  }
+
+  const host = process.env.DATABASE_HOST?.trim()
+  const user = process.env.DATABASE_USERNAME?.trim()
+  const password = process.env.DATABASE_PASSWORD ?? ""
+
+  if (!host || !user) {
+    if (isGenerateCommand()) {
+      return {
+        host: "127.0.0.1",
+        user: "root",
+        password: "",
+      }
+    }
+
+    throw new Error("Provide DATABASE_URL for mysql or DATABASE_HOST/DATABASE_USERNAME/DATABASE_PASSWORD for planetscale")
+  }
+
+  return {
+    host,
+    user,
+    password,
+  }
+}
+
+export default defineConfig({
+  dialect: "mysql",
+  schema: "./src/schema.ts",
+  out: "./drizzle",
+  dbCredentials: resolveDrizzleDbCredentials(),
+})
diff --git a/ee/packages/den-db/drizzle/0001_desktop_handoff_grants.sql b/ee/packages/den-db/drizzle/0001_desktop_handoff_grants.sql
new file mode 100644
index 0000000000..dc6f120465
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0001_desktop_handoff_grants.sql
@@ -0,0 +1,13 @@
+CREATE TABLE `desktop_handoff_grant` (
+	`id` varchar(64) NOT NULL,
+	`user_id` varchar(64) NOT NULL,
+	`session_token` text NOT NULL,
+	`expires_at` timestamp(3) NOT NULL,
+	`consumed_at` timestamp(3),
+	`created_at` timestamp(3) NOT NULL DEFAULT (now(3)),
+	CONSTRAINT `desktop_handoff_grant_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE INDEX `desktop_handoff_grant_user_id` ON `desktop_handoff_grant` (`user_id`);
+--> statement-breakpoint
+CREATE INDEX `desktop_handoff_grant_expires_at` ON `desktop_handoff_grant` (`expires_at`);
diff --git a/ee/packages/den-db/drizzle/0002_worker_activity_heartbeat.sql b/ee/packages/den-db/drizzle/0002_worker_activity_heartbeat.sql
new file mode 100644
index 0000000000..88a85187b4
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0002_worker_activity_heartbeat.sql
@@ -0,0 +1,12 @@
+ALTER TABLE `worker`
+	ADD `last_heartbeat_at` timestamp(3);
+--> statement-breakpoint
+ALTER TABLE `worker`
+	ADD `last_active_at` timestamp(3);
+--> statement-breakpoint
+CREATE INDEX `worker_last_heartbeat_at` ON `worker` (`last_heartbeat_at`);
+--> statement-breakpoint
+CREATE INDEX `worker_last_active_at` ON `worker` (`last_active_at`);
+--> statement-breakpoint
+ALTER TABLE `worker_token`
+	MODIFY COLUMN `scope` enum('client','host','activity') NOT NULL;
diff --git a/ee/packages/den-db/drizzle/0003_rate_limit.sql b/ee/packages/den-db/drizzle/0003_rate_limit.sql
new file mode 100644
index 0000000000..eaed29bd57
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0003_rate_limit.sql
@@ -0,0 +1,8 @@
+CREATE TABLE `rate_limit` (
+	`id` varchar(255) NOT NULL,
+	`key` varchar(512) NOT NULL,
+	`count` int NOT NULL DEFAULT 0,
+	`last_request` bigint NOT NULL,
+	CONSTRAINT `rate_limit_id` PRIMARY KEY(`id`),
+	CONSTRAINT `rate_limit_key` UNIQUE(`key`)
+);
diff --git a/ee/packages/den-db/drizzle/0004_organization_plugin.manual.sql b/ee/packages/den-db/drizzle/0004_organization_plugin.manual.sql
new file mode 100644
index 0000000000..63fe1e78b5
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0004_organization_plugin.manual.sql
@@ -0,0 +1,105 @@
+-- Manual SQL variant for MySQL/Vitess consoles.
+-- - No `--> statement-breakpoint` markers
+-- - No PREPARE/EXECUTE dynamic SQL
+-- - Avoids `ADD COLUMN IF NOT EXISTS` (not supported in some Vitess setups)
+
+-- Run these only if the columns are missing.
+-- Check first:
+-- SELECT column_name FROM information_schema.columns
+-- WHERE table_schema = DATABASE() AND table_name = 'session'
+--   AND column_name IN ('active_organization_id', 'active_team_id');
+
+ALTER TABLE `session`
+  ADD COLUMN `active_organization_id` varchar(64) NULL;
+
+ALTER TABLE `session`
+  ADD COLUMN `active_team_id` varchar(64) NULL;
+
+CREATE TABLE IF NOT EXISTS `organization` (
+  `id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `slug` varchar(255) NOT NULL,
+  `logo` varchar(2048),
+  `metadata` text,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `organization_id` PRIMARY KEY(`id`),
+  CONSTRAINT `organization_slug` UNIQUE(`slug`)
+);
+
+CREATE TABLE IF NOT EXISTS `member` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `user_id` varchar(64) NOT NULL,
+  `role` varchar(255) NOT NULL DEFAULT 'member',
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `member_id` PRIMARY KEY(`id`),
+  CONSTRAINT `member_organization_user` UNIQUE(`organization_id`, `user_id`),
+  KEY `member_organization_id` (`organization_id`),
+  KEY `member_user_id` (`user_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `invitation` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `email` varchar(255) NOT NULL,
+  `role` varchar(255) NOT NULL,
+  `status` varchar(32) NOT NULL DEFAULT 'pending',
+  `team_id` varchar(64) DEFAULT NULL,
+  `inviter_id` varchar(64) NOT NULL,
+  `expires_at` timestamp(3) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `invitation_id` PRIMARY KEY(`id`),
+  KEY `invitation_organization_id` (`organization_id`),
+  KEY `invitation_email` (`email`),
+  KEY `invitation_status` (`status`),
+  KEY `invitation_team_id` (`team_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `team` (
+  `id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `team_id` PRIMARY KEY(`id`),
+  CONSTRAINT `team_organization_name` UNIQUE(`organization_id`, `name`),
+  KEY `team_organization_id` (`organization_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `team_member` (
+  `id` varchar(64) NOT NULL,
+  `team_id` varchar(64) NOT NULL,
+  `user_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `team_member_id` PRIMARY KEY(`id`),
+  CONSTRAINT `team_member_team_user` UNIQUE(`team_id`, `user_id`),
+  KEY `team_member_team_id` (`team_id`),
+  KEY `team_member_user_id` (`user_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `organization_role` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `role` varchar(255) NOT NULL,
+  `permission` text NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `organization_role_id` PRIMARY KEY(`id`),
+  CONSTRAINT `organization_role_name` UNIQUE(`organization_id`, `role`),
+  KEY `organization_role_organization_id` (`organization_id`)
+);
+
+-- Optional legacy backfill. Run only if these legacy tables exist:
+--   org
+--   org_membership
+--
+-- INSERT INTO `organization` (`id`, `name`, `slug`, `logo`, `metadata`, `created_at`, `updated_at`)
+-- SELECT `id`, `name`, `slug`, NULL, NULL, `created_at`, `updated_at`
+-- FROM `org`
+-- WHERE `id` NOT IN (SELECT `id` FROM `organization`);
+--
+-- INSERT INTO `member` (`id`, `organization_id`, `user_id`, `role`, `created_at`)
+-- SELECT `id`, `org_id`, `user_id`, `role`, `created_at`
+-- FROM `org_membership`
+-- WHERE `id` NOT IN (SELECT `id` FROM `member`);
diff --git a/ee/packages/den-db/drizzle/0004_organization_plugin.sql b/ee/packages/den-db/drizzle/0004_organization_plugin.sql
new file mode 100644
index 0000000000..646d9ef99b
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0004_organization_plugin.sql
@@ -0,0 +1,152 @@
+SET @has_active_organization_id := (
+  SELECT COUNT(*)
+  FROM information_schema.columns
+  WHERE table_schema = DATABASE()
+    AND table_name = 'session'
+    AND column_name = 'active_organization_id'
+);
+--> statement-breakpoint
+SET @add_active_organization_id_sql := IF(
+  @has_active_organization_id = 0,
+  'ALTER TABLE `session` ADD COLUMN `active_organization_id` varchar(64) NULL',
+  'SELECT 1'
+);
+--> statement-breakpoint
+PREPARE add_active_organization_id_stmt FROM @add_active_organization_id_sql;
+--> statement-breakpoint
+EXECUTE add_active_organization_id_stmt;
+--> statement-breakpoint
+DEALLOCATE PREPARE add_active_organization_id_stmt;
+--> statement-breakpoint
+SET @has_active_team_id := (
+  SELECT COUNT(*)
+  FROM information_schema.columns
+  WHERE table_schema = DATABASE()
+    AND table_name = 'session'
+    AND column_name = 'active_team_id'
+);
+--> statement-breakpoint
+SET @add_active_team_id_sql := IF(
+  @has_active_team_id = 0,
+  'ALTER TABLE `session` ADD COLUMN `active_team_id` varchar(64) NULL',
+  'SELECT 1'
+);
+--> statement-breakpoint
+PREPARE add_active_team_id_stmt FROM @add_active_team_id_sql;
+--> statement-breakpoint
+EXECUTE add_active_team_id_stmt;
+--> statement-breakpoint
+DEALLOCATE PREPARE add_active_team_id_stmt;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `organization` (
+  `id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `slug` varchar(255) NOT NULL,
+  `logo` varchar(2048),
+  `metadata` text,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `organization_id` PRIMARY KEY(`id`),
+  CONSTRAINT `organization_slug` UNIQUE(`slug`)
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `member` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `user_id` varchar(64) NOT NULL,
+  `role` varchar(255) NOT NULL DEFAULT 'member',
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `member_id` PRIMARY KEY(`id`),
+  CONSTRAINT `member_organization_user` UNIQUE(`organization_id`, `user_id`),
+  KEY `member_organization_id` (`organization_id`),
+  KEY `member_user_id` (`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `invitation` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `email` varchar(255) NOT NULL,
+  `role` varchar(255) NOT NULL,
+  `status` varchar(32) NOT NULL DEFAULT 'pending',
+  `team_id` varchar(64) DEFAULT NULL,
+  `inviter_id` varchar(64) NOT NULL,
+  `expires_at` timestamp(3) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `invitation_id` PRIMARY KEY(`id`),
+  KEY `invitation_organization_id` (`organization_id`),
+  KEY `invitation_email` (`email`),
+  KEY `invitation_status` (`status`),
+  KEY `invitation_team_id` (`team_id`)
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `team` (
+  `id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `team_id` PRIMARY KEY(`id`),
+  CONSTRAINT `team_organization_name` UNIQUE(`organization_id`, `name`),
+  KEY `team_organization_id` (`organization_id`)
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `team_member` (
+  `id` varchar(64) NOT NULL,
+  `team_id` varchar(64) NOT NULL,
+  `user_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `team_member_id` PRIMARY KEY(`id`),
+  CONSTRAINT `team_member_team_user` UNIQUE(`team_id`, `user_id`),
+  KEY `team_member_team_id` (`team_id`),
+  KEY `team_member_user_id` (`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `organization_role` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `role` varchar(255) NOT NULL,
+  `permission` text NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `organization_role_id` PRIMARY KEY(`id`),
+  CONSTRAINT `organization_role_name` UNIQUE(`organization_id`, `role`),
+  KEY `organization_role_organization_id` (`organization_id`)
+);
+--> statement-breakpoint
+SET @has_legacy_org_table := (
+  SELECT COUNT(*)
+  FROM information_schema.tables
+  WHERE table_schema = DATABASE()
+    AND table_name = 'org'
+);
+--> statement-breakpoint
+SET @copy_legacy_org_sql := IF(
+  @has_legacy_org_table > 0,
+  'INSERT INTO `organization` (`id`, `name`, `slug`, `logo`, `metadata`, `created_at`, `updated_at`) SELECT `id`, `name`, `slug`, NULL, NULL, `created_at`, `updated_at` FROM `org` WHERE `id` NOT IN (SELECT `id` FROM `organization`)',
+  'SELECT 1'
+);
+--> statement-breakpoint
+PREPARE copy_legacy_org_stmt FROM @copy_legacy_org_sql;
+--> statement-breakpoint
+EXECUTE copy_legacy_org_stmt;
+--> statement-breakpoint
+DEALLOCATE PREPARE copy_legacy_org_stmt;
+--> statement-breakpoint
+SET @has_legacy_org_membership_table := (
+  SELECT COUNT(*)
+  FROM information_schema.tables
+  WHERE table_schema = DATABASE()
+    AND table_name = 'org_membership'
+);
+--> statement-breakpoint
+SET @copy_legacy_org_membership_sql := IF(
+  @has_legacy_org_membership_table > 0,
+  'INSERT INTO `member` (`id`, `organization_id`, `user_id`, `role`, `created_at`) SELECT `id`, `org_id`, `user_id`, `role`, `created_at` FROM `org_membership` WHERE `id` NOT IN (SELECT `id` FROM `member`)',
+  'SELECT 1'
+);
+--> statement-breakpoint
+PREPARE copy_legacy_org_membership_stmt FROM @copy_legacy_org_membership_sql;
+--> statement-breakpoint
+EXECUTE copy_legacy_org_membership_stmt;
+--> statement-breakpoint
+DEALLOCATE PREPARE copy_legacy_org_membership_stmt;
diff --git a/ee/packages/den-db/drizzle/0005_temp_template_sharing.sql b/ee/packages/den-db/drizzle/0005_temp_template_sharing.sql
new file mode 100644
index 0000000000..21348a06a9
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0005_temp_template_sharing.sql
@@ -0,0 +1,14 @@
+CREATE TABLE IF NOT EXISTS `temp_template_sharing` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `creator_member_id` varchar(64) NOT NULL,
+  `creator_user_id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `template_json` text NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `temp_template_sharing_id` PRIMARY KEY(`id`),
+  KEY `temp_template_sharing_org_id` (`organization_id`),
+  KEY `temp_template_sharing_creator_member_id` (`creator_member_id`),
+  KEY `temp_template_sharing_creator_user_id` (`creator_user_id`)
+);
diff --git a/ee/packages/den-db/drizzle/0006_skill_hub.sql b/ee/packages/den-db/drizzle/0006_skill_hub.sql
new file mode 100644
index 0000000000..92e82562e3
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0006_skill_hub.sql
@@ -0,0 +1,88 @@
+ALTER TABLE `team_member`
+	ADD COLUMN `org_membership_id` varchar(64) NULL AFTER `team_id`;
+--> statement-breakpoint
+UPDATE `team_member` tm
+	INNER JOIN `team` t ON t.`id` = tm.`team_id`
+	INNER JOIN `member` m ON m.`organization_id` = t.`organization_id` AND m.`user_id` = tm.`user_id`
+SET tm.`org_membership_id` = m.`id`
+WHERE tm.`org_membership_id` IS NULL;
+--> statement-breakpoint
+DROP INDEX `team_member_team_user` ON `team_member`;
+--> statement-breakpoint
+DROP INDEX `team_member_user_id` ON `team_member`;
+--> statement-breakpoint
+ALTER TABLE `team_member`
+	MODIFY COLUMN `org_membership_id` varchar(64) NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `team_member_org_membership_id` ON `team_member` (`org_membership_id`);
+--> statement-breakpoint
+ALTER TABLE `team_member`
+	ADD CONSTRAINT `team_member_team_org_membership` UNIQUE(`team_id`, `org_membership_id`);
+--> statement-breakpoint
+ALTER TABLE `team_member`
+	DROP COLUMN `user_id`;
+--> statement-breakpoint
+CREATE TABLE `skill` (
+	`id` varchar(64) NOT NULL,
+	`organization_id` varchar(64) NOT NULL,
+	`created_by_org_membership_id` varchar(64) NOT NULL,
+	`title` varchar(255) NOT NULL,
+	`description` text,
+	`skill_text` text NOT NULL,
+	`shared` enum('org','public'),
+	`created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	`updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+	CONSTRAINT `skill_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE INDEX `skill_organization_id` ON `skill` (`organization_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_created_by_org_membership_id` ON `skill` (`created_by_org_membership_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_shared` ON `skill` (`shared`);
+--> statement-breakpoint
+CREATE TABLE `skill_hub` (
+	`id` varchar(64) NOT NULL,
+	`organization_id` varchar(64) NOT NULL,
+	`created_by_org_membership_id` varchar(64) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	`updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+	CONSTRAINT `skill_hub_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_organization_id` ON `skill_hub` (`organization_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_created_by_org_membership_id` ON `skill_hub` (`created_by_org_membership_id`);
+--> statement-breakpoint
+CREATE TABLE `skill_hub_skill` (
+	`id` varchar(64) NOT NULL,
+	`skill_hub_id` varchar(64) NOT NULL,
+	`skill_id` varchar(64) NOT NULL,
+	`org_membership_id` varchar(64) NOT NULL,
+	`created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	CONSTRAINT `skill_hub_skill_id` PRIMARY KEY(`id`),
+	CONSTRAINT `skill_hub_skill_hub_skill` UNIQUE(`skill_hub_id`, `skill_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_skill_skill_hub_id` ON `skill_hub_skill` (`skill_hub_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_skill_skill_id` ON `skill_hub_skill` (`skill_id`);
+--> statement-breakpoint
+CREATE TABLE `skill_hub_member` (
+	`id` varchar(64) NOT NULL,
+	`skill_hub_id` varchar(64) NOT NULL,
+	`org_membership_id` varchar(64),
+	`team_id` varchar(64),
+	`created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+	CONSTRAINT `skill_hub_member_id` PRIMARY KEY(`id`),
+	CONSTRAINT `skill_hub_member_hub_org_membership` UNIQUE(`skill_hub_id`, `org_membership_id`),
+	CONSTRAINT `skill_hub_member_hub_team` UNIQUE(`skill_hub_id`, `team_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_member_skill_hub_id` ON `skill_hub_member` (`skill_hub_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_member_org_membership_id` ON `skill_hub_member` (`org_membership_id`);
+--> statement-breakpoint
+CREATE INDEX `skill_hub_member_team_id` ON `skill_hub_member` (`team_id`);
diff --git a/ee/packages/den-db/drizzle/0007_organization_metadata_limits.sql b/ee/packages/den-db/drizzle/0007_organization_metadata_limits.sql
new file mode 100644
index 0000000000..092b35531f
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0007_organization_metadata_limits.sql
@@ -0,0 +1,27 @@
+UPDATE `organization`
+SET `metadata` = '{}'
+WHERE `metadata` IS NULL
+   OR TRIM(`metadata`) = ''
+   OR JSON_VALID(`metadata`) = 0;
+
+ALTER TABLE `organization`
+  MODIFY COLUMN `metadata` json NULL;
+
+UPDATE `organization`
+SET `metadata` = JSON_SET(
+  `metadata`,
+  '$.limits.members',
+  COALESCE(
+    NULLIF(CAST(JSON_UNQUOTE(JSON_EXTRACT(`metadata`, '$.limits.members')) AS SIGNED), 0),
+    5
+  ),
+  '$.limits.workers',
+  COALESCE(
+    NULLIF(CAST(JSON_UNQUOTE(COALESCE(JSON_EXTRACT(`metadata`, '$.limits.workers'), JSON_EXTRACT(`metadata`, '$.limits.Workers'))) AS SIGNED), 0),
+    1
+  )
+);
+
+UPDATE `organization`
+SET `metadata` = JSON_REMOVE(`metadata`, '$.limits.Workers')
+WHERE JSON_EXTRACT(`metadata`, '$.limits.Workers') IS NOT NULL;
diff --git a/ee/packages/den-db/drizzle/0008_cynical_boomerang.sql b/ee/packages/den-db/drizzle/0008_cynical_boomerang.sql
new file mode 100644
index 0000000000..e15db62944
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0008_cynical_boomerang.sql
@@ -0,0 +1,45 @@
+CREATE TABLE `llm_provider_access` (
+	`id` varchar(64) NOT NULL,
+	`llm_provider_id` varchar(64) NOT NULL,
+	`org_membership_id` varchar(64),
+	`team_id` varchar(64),
+	`created_at` timestamp(3) NOT NULL DEFAULT (now()),
+	CONSTRAINT `llm_provider_access_id` PRIMARY KEY(`id`),
+	CONSTRAINT `llm_provider_access_provider_org_membership` UNIQUE(`llm_provider_id`,`org_membership_id`),
+	CONSTRAINT `llm_provider_access_provider_team` UNIQUE(`llm_provider_id`,`team_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `llm_provider_model` (
+	`id` varchar(64) NOT NULL,
+	`llm_provider_id` varchar(64) NOT NULL,
+	`model_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`model_config` json NOT NULL,
+	`created_at` timestamp(3) NOT NULL DEFAULT (now()),
+	CONSTRAINT `llm_provider_model_id` PRIMARY KEY(`id`),
+	CONSTRAINT `llm_provider_model_provider_model` UNIQUE(`llm_provider_id`,`model_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `llm_provider` (
+	`id` varchar(64) NOT NULL,
+	`organization_id` varchar(64) NOT NULL,
+	`created_by_org_membership_id` varchar(64) NOT NULL,
+	`source` enum('models_dev','custom') NOT NULL,
+	`provider_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`provider_config` json NOT NULL,
+	`api_key` text,
+	`created_at` timestamp(3) NOT NULL DEFAULT (now()),
+	`updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+	CONSTRAINT `llm_provider_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE INDEX `llm_provider_access_llm_provider_id` ON `llm_provider_access` (`llm_provider_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_access_org_membership_id` ON `llm_provider_access` (`org_membership_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_access_team_id` ON `llm_provider_access` (`team_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_model_llm_provider_id` ON `llm_provider_model` (`llm_provider_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_model_model_id` ON `llm_provider_model` (`model_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_organization_id` ON `llm_provider` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_created_by_org_membership_id` ON `llm_provider` (`created_by_org_membership_id`);--> statement-breakpoint
+CREATE INDEX `llm_provider_source` ON `llm_provider` (`source`);--> statement-breakpoint
+CREATE INDEX `llm_provider_provider_id` ON `llm_provider` (`provider_id`);
\ No newline at end of file
diff --git a/ee/packages/den-db/drizzle/0009_api_keys.sql b/ee/packages/den-db/drizzle/0009_api_keys.sql
new file mode 100644
index 0000000000..f5dd8d0923
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0009_api_keys.sql
@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS `apikey` (
+  `id` varchar(64) NOT NULL,
+  `config_id` varchar(255) NOT NULL DEFAULT 'default',
+  `name` varchar(255) DEFAULT NULL,
+  `start` varchar(32) DEFAULT NULL,
+  `prefix` varchar(255) DEFAULT NULL,
+  `key` varchar(255) NOT NULL,
+  `reference_id` varchar(64) NOT NULL,
+  `refill_interval` bigint DEFAULT NULL,
+  `refill_amount` int DEFAULT NULL,
+  `last_refill_at` timestamp(3) NULL,
+  `enabled` boolean NOT NULL DEFAULT true,
+  `rate_limit_enabled` boolean NOT NULL DEFAULT true,
+  `rate_limit_time_window` bigint DEFAULT NULL,
+  `rate_limit_max` int DEFAULT NULL,
+  `request_count` int DEFAULT 0,
+  `remaining` int DEFAULT NULL,
+  `last_request` timestamp(3) NULL,
+  `expires_at` timestamp(3) NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  `permissions` text,
+  `metadata` text,
+  CONSTRAINT `apikey_id` PRIMARY KEY (`id`),
+  KEY `apikey_config_id` (`config_id`),
+  KEY `apikey_reference_id` (`reference_id`),
+  KEY `apikey_key` (`key`)
+);
diff --git a/ee/packages/den-db/drizzle/0010_plugin_arch.sql b/ee/packages/den-db/drizzle/0010_plugin_arch.sql
new file mode 100644
index 0000000000..c4edcbe56e
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0010_plugin_arch.sql
@@ -0,0 +1,284 @@
+CREATE TABLE IF NOT EXISTS `config_object` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `object_type` enum('skill','agent','command','tool','mcp','hook','context','custom') NOT NULL,
+  `source_mode` enum('cloud','import','connector') NOT NULL,
+  `title` varchar(255) NOT NULL,
+  `description` text,
+  `search_text` text,
+  `current_file_name` varchar(255),
+  `current_file_extension` varchar(64),
+  `current_relative_path` varchar(2048),
+  `status` enum('active','inactive','deleted','archived','ingestion_error') NOT NULL DEFAULT 'active',
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64),
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  `deleted_at` timestamp(3) NULL,
+  CONSTRAINT `config_object_id` PRIMARY KEY(`id`),
+  KEY `config_object_organization_id` (`organization_id`),
+  KEY `config_object_type` (`object_type`),
+  KEY `config_object_source_mode` (`source_mode`),
+  KEY `config_object_status` (`status`),
+  KEY `config_object_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `config_object_connector_instance_id` (`connector_instance_id`),
+  KEY `config_object_current_relative_path` (`current_relative_path`)
+);
+
+CREATE TABLE IF NOT EXISTS `config_object_version` (
+  `id` varchar(64) NOT NULL,
+  `config_object_id` varchar(64) NOT NULL,
+  `normalized_payload_json` text,
+  `raw_source_text` text,
+  `schema_version` varchar(100),
+  `created_via` enum('cloud','import','connector','system') NOT NULL,
+  `created_by_org_membership_id` varchar(64),
+  `connector_sync_event_id` varchar(64),
+  `source_revision_ref` varchar(255),
+  `is_deleted_version` boolean NOT NULL DEFAULT false,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `config_object_version_id` PRIMARY KEY(`id`),
+  KEY `config_object_version_config_object_id` (`config_object_id`),
+  KEY `config_object_version_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `config_object_version_connector_sync_event_id` (`connector_sync_event_id`),
+  KEY `config_object_version_source_revision_ref` (`source_revision_ref`),
+  KEY `config_object_version_lookup_latest` (`config_object_id`, `created_at`, `id`)
+);
+
+CREATE TABLE IF NOT EXISTS `plugin` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `description` text,
+  `status` enum('active','inactive','deleted','archived') NOT NULL DEFAULT 'active',
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  `deleted_at` timestamp(3) NULL,
+  CONSTRAINT `plugin_id` PRIMARY KEY(`id`),
+  KEY `plugin_organization_id` (`organization_id`),
+  KEY `plugin_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `plugin_status` (`status`),
+  KEY `plugin_name` (`name`)
+);
+
+CREATE TABLE IF NOT EXISTS `plugin_config_object` (
+  `id` varchar(64) NOT NULL,
+  `plugin_id` varchar(64) NOT NULL,
+  `config_object_id` varchar(64) NOT NULL,
+  `membership_source` enum('manual','connector','api','system') NOT NULL DEFAULT 'manual',
+  `connector_mapping_id` varchar(64),
+  `created_by_org_membership_id` varchar(64),
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `plugin_config_object_id` PRIMARY KEY(`id`),
+  CONSTRAINT `plugin_config_object_plugin_config_object` UNIQUE(`plugin_id`, `config_object_id`),
+  KEY `plugin_config_object_plugin_id` (`plugin_id`),
+  KEY `plugin_config_object_config_object_id` (`config_object_id`),
+  KEY `plugin_config_object_connector_mapping_id` (`connector_mapping_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `config_object_access_grant` (
+  `id` varchar(64) NOT NULL,
+  `config_object_id` varchar(64) NOT NULL,
+  `org_membership_id` varchar(64),
+  `team_id` varchar(64),
+  `org_wide` boolean NOT NULL DEFAULT false,
+  `role` enum('viewer','editor','manager') NOT NULL,
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `config_object_access_grant_id` PRIMARY KEY(`id`),
+  CONSTRAINT `config_object_access_grant_object_org_membership` UNIQUE(`config_object_id`, `org_membership_id`),
+  CONSTRAINT `config_object_access_grant_object_team` UNIQUE(`config_object_id`, `team_id`),
+  KEY `config_object_access_grant_config_object_id` (`config_object_id`),
+  KEY `config_object_access_grant_org_membership_id` (`org_membership_id`),
+  KEY `config_object_access_grant_team_id` (`team_id`),
+  KEY `config_object_access_grant_org_wide` (`org_wide`)
+);
+
+CREATE TABLE IF NOT EXISTS `plugin_access_grant` (
+  `id` varchar(64) NOT NULL,
+  `plugin_id` varchar(64) NOT NULL,
+  `org_membership_id` varchar(64),
+  `team_id` varchar(64),
+  `org_wide` boolean NOT NULL DEFAULT false,
+  `role` enum('viewer','editor','manager') NOT NULL,
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `plugin_access_grant_id` PRIMARY KEY(`id`),
+  CONSTRAINT `plugin_access_grant_plugin_org_membership` UNIQUE(`plugin_id`, `org_membership_id`),
+  CONSTRAINT `plugin_access_grant_plugin_team` UNIQUE(`plugin_id`, `team_id`),
+  KEY `plugin_access_grant_plugin_id` (`plugin_id`),
+  KEY `plugin_access_grant_org_membership_id` (`org_membership_id`),
+  KEY `plugin_access_grant_team_id` (`team_id`),
+  KEY `plugin_access_grant_org_wide` (`org_wide`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_account` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255) NOT NULL,
+  `external_account_ref` varchar(255),
+  `display_name` varchar(255) NOT NULL,
+  `status` enum('active','inactive','disconnected','error') NOT NULL DEFAULT 'active',
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `metadata_json` json,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `connector_account_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_account_org_type_remote_id` UNIQUE(`organization_id`, `connector_type`, `remote_id`),
+  KEY `connector_account_organization_id` (`organization_id`),
+  KEY `connector_account_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `connector_account_connector_type` (`connector_type`),
+  KEY `connector_account_status` (`status`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_instance` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `connector_account_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255),
+  `name` varchar(255) NOT NULL,
+  `status` enum('active','disabled','archived','error') NOT NULL DEFAULT 'active',
+  `instance_config_json` json,
+  `last_synced_at` timestamp(3) NULL,
+  `last_sync_status` enum('pending','queued','running','completed','failed','partial','ignored'),
+  `last_sync_cursor` text,
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `connector_instance_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_instance_org_name` UNIQUE(`organization_id`, `name`),
+  KEY `connector_instance_organization_id` (`organization_id`),
+  KEY `connector_instance_connector_account_id` (`connector_account_id`),
+  KEY `connector_instance_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `connector_instance_connector_type` (`connector_type`),
+  KEY `connector_instance_status` (`status`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_instance_access_grant` (
+  `id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `org_membership_id` varchar(64),
+  `team_id` varchar(64),
+  `org_wide` boolean NOT NULL DEFAULT false,
+  `role` enum('viewer','editor','manager') NOT NULL,
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `connector_instance_access_grant_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_instance_access_grant_instance_org_membership` UNIQUE(`connector_instance_id`, `org_membership_id`),
+  CONSTRAINT `connector_instance_access_grant_instance_team` UNIQUE(`connector_instance_id`, `team_id`),
+  KEY `connector_instance_access_grant_instance_id` (`connector_instance_id`),
+  KEY `connector_instance_access_grant_org_membership_id` (`org_membership_id`),
+  KEY `connector_instance_access_grant_team_id` (`team_id`),
+  KEY `connector_instance_access_grant_org_wide` (`org_wide`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_target` (
+  `id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255) NOT NULL,
+  `target_kind` enum('repository_branch') NOT NULL,
+  `external_target_ref` varchar(255),
+  `target_config_json` json NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `connector_target_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_target_instance_remote_id` UNIQUE(`connector_instance_id`, `remote_id`),
+  KEY `connector_target_connector_instance_id` (`connector_instance_id`),
+  KEY `connector_target_connector_type` (`connector_type`),
+  KEY `connector_target_target_kind` (`target_kind`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_mapping` (
+  `id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `connector_target_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255),
+  `mapping_kind` enum('path','api','custom') NOT NULL,
+  `selector` varchar(1024) NOT NULL,
+  `object_type` enum('skill','agent','command','tool','mcp','hook','context','custom') NOT NULL,
+  `plugin_id` varchar(64),
+  `auto_add_to_plugin` boolean NOT NULL DEFAULT false,
+  `mapping_config_json` json,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  CONSTRAINT `connector_mapping_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_mapping_target_selector_object_type` UNIQUE(`connector_target_id`, `selector`, `object_type`),
+  KEY `connector_mapping_connector_instance_id` (`connector_instance_id`),
+  KEY `connector_mapping_connector_target_id` (`connector_target_id`),
+  KEY `connector_mapping_object_type` (`object_type`),
+  KEY `connector_mapping_plugin_id` (`plugin_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_sync_event` (
+  `id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `connector_target_id` varchar(64),
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255),
+  `event_type` enum('push','installation','installation_repositories','repository','manual_resync') NOT NULL,
+  `external_event_ref` varchar(255),
+  `source_revision_ref` varchar(255),
+  `status` enum('pending','queued','running','completed','failed','partial','ignored') NOT NULL DEFAULT 'pending',
+  `summary_json` json,
+  `started_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `completed_at` timestamp(3) NULL,
+  CONSTRAINT `connector_sync_event_id` PRIMARY KEY(`id`),
+  KEY `connector_sync_event_connector_instance_id` (`connector_instance_id`),
+  KEY `connector_sync_event_connector_target_id` (`connector_target_id`),
+  KEY `connector_sync_event_event_type` (`event_type`),
+  KEY `connector_sync_event_status` (`status`),
+  KEY `connector_sync_event_source_revision_ref` (`source_revision_ref`),
+  KEY `connector_sync_event_external_event_ref` (`external_event_ref`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_source_binding` (
+  `id` varchar(64) NOT NULL,
+  `config_object_id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `connector_target_id` varchar(64) NOT NULL,
+  `connector_mapping_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255),
+  `external_locator` varchar(2048) NOT NULL,
+  `external_stable_ref` varchar(255),
+  `last_seen_source_revision_ref` varchar(255),
+  `status` enum('active','inactive','deleted','archived','ingestion_error') NOT NULL DEFAULT 'active',
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  `deleted_at` timestamp(3) NULL,
+  CONSTRAINT `connector_source_binding_id` PRIMARY KEY(`id`),
+  CONSTRAINT `connector_source_binding_config_object` UNIQUE(`config_object_id`),
+  KEY `connector_source_binding_connector_instance_id` (`connector_instance_id`),
+  KEY `connector_source_binding_connector_target_id` (`connector_target_id`),
+  KEY `connector_source_binding_connector_mapping_id` (`connector_mapping_id`),
+  KEY `connector_source_binding_external_locator` (`external_locator`)
+);
+
+CREATE TABLE IF NOT EXISTS `connector_source_tombstone` (
+  `id` varchar(64) NOT NULL,
+  `connector_instance_id` varchar(64) NOT NULL,
+  `connector_target_id` varchar(64) NOT NULL,
+  `connector_mapping_id` varchar(64) NOT NULL,
+  `connector_type` enum('github') NOT NULL,
+  `remote_id` varchar(255),
+  `external_locator` varchar(2048) NOT NULL,
+  `former_config_object_id` varchar(64) NOT NULL,
+  `deleted_in_sync_event_id` varchar(64) NOT NULL,
+  `deleted_source_revision_ref` varchar(255),
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  CONSTRAINT `connector_source_tombstone_id` PRIMARY KEY(`id`),
+  KEY `connector_source_tombstone_connector_instance_id` (`connector_instance_id`),
+  KEY `connector_source_tombstone_connector_target_id` (`connector_target_id`),
+  KEY `connector_source_tombstone_connector_mapping_id` (`connector_mapping_id`),
+  KEY `connector_source_tombstone_external_locator` (`external_locator`),
+  KEY `connector_source_tombstone_former_config_object_id` (`former_config_object_id`)
+);
diff --git a/ee/packages/den-db/drizzle/0011_marketplaces.sql b/ee/packages/den-db/drizzle/0011_marketplaces.sql
new file mode 100644
index 0000000000..38fbc2552b
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0011_marketplaces.sql
@@ -0,0 +1,53 @@
+CREATE TABLE IF NOT EXISTS `marketplace` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `description` text,
+  `status` enum('active','inactive','deleted','archived') NOT NULL DEFAULT 'active',
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  `deleted_at` timestamp(3) NULL,
+  CONSTRAINT `marketplace_id` PRIMARY KEY(`id`),
+  KEY `marketplace_organization_id` (`organization_id`),
+  KEY `marketplace_created_by_org_membership_id` (`created_by_org_membership_id`),
+  KEY `marketplace_status` (`status`),
+  KEY `marketplace_name` (`name`)
+);
+
+CREATE TABLE IF NOT EXISTS `marketplace_plugin` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `marketplace_id` varchar(64) NOT NULL,
+  `plugin_id` varchar(64) NOT NULL,
+  `membership_source` enum('manual','connector','api','system') NOT NULL DEFAULT 'manual',
+  `created_by_org_membership_id` varchar(64),
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `marketplace_plugin_id` PRIMARY KEY(`id`),
+  CONSTRAINT `marketplace_plugin_marketplace_plugin` UNIQUE(`marketplace_id`, `plugin_id`),
+  KEY `marketplace_plugin_organization_id` (`organization_id`),
+  KEY `marketplace_plugin_marketplace_id` (`marketplace_id`),
+  KEY `marketplace_plugin_plugin_id` (`plugin_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `marketplace_access_grant` (
+  `id` varchar(64) NOT NULL,
+  `organization_id` varchar(64) NOT NULL,
+  `marketplace_id` varchar(64) NOT NULL,
+  `org_membership_id` varchar(64),
+  `team_id` varchar(64),
+  `org_wide` boolean NOT NULL DEFAULT false,
+  `role` enum('viewer','editor','manager') NOT NULL,
+  `created_by_org_membership_id` varchar(64) NOT NULL,
+  `created_at` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `removed_at` timestamp(3) NULL,
+  CONSTRAINT `marketplace_access_grant_id` PRIMARY KEY(`id`),
+  CONSTRAINT `marketplace_access_grant_marketplace_org_membership` UNIQUE(`marketplace_id`, `org_membership_id`),
+  CONSTRAINT `marketplace_access_grant_marketplace_team` UNIQUE(`marketplace_id`, `team_id`),
+  KEY `marketplace_access_grant_organization_id` (`organization_id`),
+  KEY `marketplace_access_grant_marketplace_id` (`marketplace_id`),
+  KEY `marketplace_access_grant_org_membership_id` (`org_membership_id`),
+  KEY `marketplace_access_grant_team_id` (`team_id`),
+  KEY `marketplace_access_grant_org_wide` (`org_wide`)
+);
diff --git a/ee/packages/den-db/drizzle/0012_allowed_email_domains.sql b/ee/packages/den-db/drizzle/0012_allowed_email_domains.sql
new file mode 100644
index 0000000000..b2ae4250e3
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0012_allowed_email_domains.sql
@@ -0,0 +1,2 @@
+ALTER TABLE `organization`
+ADD COLUMN `allowed_email_domains` json;
diff --git a/ee/packages/den-db/drizzle/0013_desktop_app_restrictions.sql b/ee/packages/den-db/drizzle/0013_desktop_app_restrictions.sql
new file mode 100644
index 0000000000..e541b3b942
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0013_desktop_app_restrictions.sql
@@ -0,0 +1,2 @@
+ALTER TABLE `organization`
+ADD COLUMN `desktop_app_restrictions` json NOT NULL DEFAULT (json_object());
diff --git a/ee/packages/den-db/drizzle/0014_drop_temp_template_sharing.sql b/ee/packages/den-db/drizzle/0014_drop_temp_template_sharing.sql
new file mode 100644
index 0000000000..d945f4d1a1
--- /dev/null
+++ b/ee/packages/den-db/drizzle/0014_drop_temp_template_sharing.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS `temp_template_sharing`;
diff --git a/ee/packages/den-db/drizzle/meta/0006_snapshot.json b/ee/packages/den-db/drizzle/meta/0006_snapshot.json
new file mode 100644
index 0000000000..0e7f3d2762
--- /dev/null
+++ b/ee/packages/den-db/drizzle/meta/0006_snapshot.json
@@ -0,0 +1,2066 @@
+{
+  "version": "5",
+  "dialect": "mysql",
+  "id": "01bf4a61-490e-449d-b17d-295d8546bd22",
+  "prevId": "1da3dfe9-e476-4347-8b0e-0969b517ab84",
+  "tables": {
+    "account": {
+      "name": "account",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "account_user_id": {
+          "name": "account_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "account_id": {
+          "name": "account_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "session": {
+      "name": "session",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active_team_id": {
+          "name": "active_team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "session_token": {
+          "name": "session_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        },
+        "session_user_id": {
+          "name": "session_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "session_id": {
+          "name": "session_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "user": {
+      "name": "user",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "user_email": {
+          "name": "user_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "user_id": {
+          "name": "user_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "verification": {
+      "name": "verification",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "verification_identifier": {
+          "name": "verification_identifier",
+          "columns": [
+            "identifier"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "verification_id": {
+          "name": "verification_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "desktop_handoff_grant": {
+      "name": "desktop_handoff_grant",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "session_token": {
+          "name": "session_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "consumed_at": {
+          "name": "consumed_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "desktop_handoff_grant_user_id": {
+          "name": "desktop_handoff_grant_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "desktop_handoff_grant_expires_at": {
+          "name": "desktop_handoff_grant_expires_at",
+          "columns": [
+            "expires_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "desktop_handoff_grant_id": {
+          "name": "desktop_handoff_grant_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "invitation": {
+      "name": "invitation",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'pending'"
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "invitation_organization_id": {
+          "name": "invitation_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "invitation_email": {
+          "name": "invitation_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": false
+        },
+        "invitation_status": {
+          "name": "invitation_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "invitation_team_id": {
+          "name": "invitation_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "invitation_id": {
+          "name": "invitation_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "member": {
+      "name": "member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'member'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "member_organization_id": {
+          "name": "member_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "member_user_id": {
+          "name": "member_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "member_organization_user": {
+          "name": "member_organization_user",
+          "columns": [
+            "organization_id",
+            "user_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "member_id": {
+          "name": "member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization": {
+      "name": "organization",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "logo": {
+          "name": "logo",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_slug": {
+          "name": "organization_slug",
+          "columns": [
+            "slug"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_id": {
+          "name": "organization_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization_role": {
+      "name": "organization_role",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "permission": {
+          "name": "permission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_role_organization_id": {
+          "name": "organization_role_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "organization_role_name": {
+          "name": "organization_role_name",
+          "columns": [
+            "organization_id",
+            "role"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_role_id": {
+          "name": "organization_role_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "temp_template_sharing": {
+      "name": "temp_template_sharing",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_member_id": {
+          "name": "creator_member_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_user_id": {
+          "name": "creator_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "template_json": {
+          "name": "template_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "temp_template_sharing_org_id": {
+          "name": "temp_template_sharing_org_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_member_id": {
+          "name": "temp_template_sharing_creator_member_id",
+          "columns": [
+            "creator_member_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_user_id": {
+          "name": "temp_template_sharing_creator_user_id",
+          "columns": [
+            "creator_user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "temp_template_sharing_id": {
+          "name": "temp_template_sharing_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_member": {
+      "name": "skill_hub_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_member_skill_hub_id": {
+          "name": "skill_hub_member_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_org_membership_id": {
+          "name": "skill_hub_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_team_id": {
+          "name": "skill_hub_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_hub_org_membership": {
+          "name": "skill_hub_member_hub_org_membership",
+          "columns": [
+            "skill_hub_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        },
+        "skill_hub_member_hub_team": {
+          "name": "skill_hub_member_hub_team",
+          "columns": [
+            "skill_hub_id",
+            "team_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_member_id": {
+          "name": "skill_hub_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_skill": {
+      "name": "skill_hub_skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_skill_skill_hub_id": {
+          "name": "skill_hub_skill_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_skill_id": {
+          "name": "skill_hub_skill_skill_id",
+          "columns": [
+            "skill_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_hub_skill": {
+          "name": "skill_hub_skill_hub_skill",
+          "columns": [
+            "skill_hub_id",
+            "skill_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_skill_id": {
+          "name": "skill_hub_skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub": {
+      "name": "skill_hub",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_hub_organization_id": {
+          "name": "skill_hub_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_created_by_org_membership_id": {
+          "name": "skill_hub_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill": {
+      "name": "skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "skill_text": {
+          "name": "skill_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "shared": {
+          "name": "shared",
+          "type": "enum('org','public')",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_organization_id": {
+          "name": "skill_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_created_by_org_membership_id": {
+          "name": "skill_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_shared": {
+          "name": "skill_shared",
+          "columns": [
+            "shared"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_id": {
+          "name": "skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team_member": {
+      "name": "team_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "team_member_team_id": {
+          "name": "team_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_org_membership_id": {
+          "name": "team_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_team_org_membership": {
+          "name": "team_member_team_org_membership",
+          "columns": [
+            "team_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_member_id": {
+          "name": "team_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team": {
+      "name": "team",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "team_organization_id": {
+          "name": "team_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "team_organization_name": {
+          "name": "team_organization_name",
+          "columns": [
+            "organization_id",
+            "name"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_id": {
+          "name": "team_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "audit_event": {
+      "name": "audit_event",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "action": {
+          "name": "action",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "audit_event_org_id": {
+          "name": "audit_event_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "audit_event_worker_id": {
+          "name": "audit_event_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "audit_event_id": {
+          "name": "audit_event_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "daytona_sandbox": {
+      "name": "daytona_sandbox",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sandbox_id": {
+          "name": "sandbox_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "workspace_volume_id": {
+          "name": "workspace_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "data_volume_id": {
+          "name": "data_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url": {
+          "name": "signed_preview_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url_expires_at": {
+          "name": "signed_preview_url_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "daytona_sandbox_worker_id": {
+          "name": "daytona_sandbox_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": true
+        },
+        "daytona_sandbox_sandbox_id": {
+          "name": "daytona_sandbox_sandbox_id",
+          "columns": [
+            "sandbox_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "daytona_sandbox_id": {
+          "name": "daytona_sandbox_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_bundle": {
+      "name": "worker_bundle",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "storage_url": {
+          "name": "storage_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "worker_bundle_worker_id": {
+          "name": "worker_bundle_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_bundle_id": {
+          "name": "worker_bundle_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_instance": {
+      "name": "worker_instance",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "url": {
+          "name": "url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_instance_worker_id": {
+          "name": "worker_instance_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_instance_id": {
+          "name": "worker_instance_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker": {
+      "name": "worker",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "destination": {
+          "name": "destination",
+          "type": "enum('local','cloud')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "image_version": {
+          "name": "image_version",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "workspace_path": {
+          "name": "workspace_path",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sandbox_backend": {
+          "name": "sandbox_backend",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_active_at": {
+          "name": "last_active_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_org_id": {
+          "name": "worker_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "worker_created_by_user_id": {
+          "name": "worker_created_by_user_id",
+          "columns": [
+            "created_by_user_id"
+          ],
+          "isUnique": false
+        },
+        "worker_status": {
+          "name": "worker_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "worker_last_heartbeat_at": {
+          "name": "worker_last_heartbeat_at",
+          "columns": [
+            "last_heartbeat_at"
+          ],
+          "isUnique": false
+        },
+        "worker_last_active_at": {
+          "name": "worker_last_active_at",
+          "columns": [
+            "last_active_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_id": {
+          "name": "worker_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_token": {
+      "name": "worker_token",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "enum('client','host','activity')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "worker_token_worker_id": {
+          "name": "worker_token_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        },
+        "worker_token_token": {
+          "name": "worker_token_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_token_id": {
+          "name": "worker_token_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "admin_allowlist": {
+      "name": "admin_allowlist",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "note": {
+          "name": "note",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "admin_allowlist_email": {
+          "name": "admin_allowlist_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "admin_allowlist_id": {
+          "name": "admin_allowlist_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "rate_limit": {
+      "name": "rate_limit",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "key": {
+          "name": "key",
+          "type": "varchar(512)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "count": {
+          "name": "count",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "last_request": {
+          "name": "last_request",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "rate_limit_key": {
+          "name": "rate_limit_key",
+          "columns": [
+            "key"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "rate_limit_id": {
+          "name": "rate_limit_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    }
+  },
+  "views": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "tables": {},
+    "indexes": {}
+  }
+}
\ No newline at end of file
diff --git a/ee/packages/den-db/drizzle/meta/0007_snapshot.json b/ee/packages/den-db/drizzle/meta/0007_snapshot.json
new file mode 100644
index 0000000000..7c53ac8d5d
--- /dev/null
+++ b/ee/packages/den-db/drizzle/meta/0007_snapshot.json
@@ -0,0 +1,2066 @@
+{
+  "version": "5",
+  "dialect": "mysql",
+  "id": "0c7f8a74-8ffd-40db-9a67-f5ae72db8656",
+  "prevId": "01bf4a61-490e-449d-b17d-295d8546bd22",
+  "tables": {
+    "account": {
+      "name": "account",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "account_user_id": {
+          "name": "account_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "account_id": {
+          "name": "account_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "session": {
+      "name": "session",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active_team_id": {
+          "name": "active_team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "session_token": {
+          "name": "session_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        },
+        "session_user_id": {
+          "name": "session_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "session_id": {
+          "name": "session_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "user": {
+      "name": "user",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "user_email": {
+          "name": "user_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "user_id": {
+          "name": "user_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "verification": {
+      "name": "verification",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "verification_identifier": {
+          "name": "verification_identifier",
+          "columns": [
+            "identifier"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "verification_id": {
+          "name": "verification_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "desktop_handoff_grant": {
+      "name": "desktop_handoff_grant",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "session_token": {
+          "name": "session_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "consumed_at": {
+          "name": "consumed_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "desktop_handoff_grant_user_id": {
+          "name": "desktop_handoff_grant_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "desktop_handoff_grant_expires_at": {
+          "name": "desktop_handoff_grant_expires_at",
+          "columns": [
+            "expires_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "desktop_handoff_grant_id": {
+          "name": "desktop_handoff_grant_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "invitation": {
+      "name": "invitation",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'pending'"
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "invitation_organization_id": {
+          "name": "invitation_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "invitation_email": {
+          "name": "invitation_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": false
+        },
+        "invitation_status": {
+          "name": "invitation_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "invitation_team_id": {
+          "name": "invitation_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "invitation_id": {
+          "name": "invitation_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "member": {
+      "name": "member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'member'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "member_organization_id": {
+          "name": "member_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "member_user_id": {
+          "name": "member_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "member_organization_user": {
+          "name": "member_organization_user",
+          "columns": [
+            "organization_id",
+            "user_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "member_id": {
+          "name": "member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization": {
+      "name": "organization",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "logo": {
+          "name": "logo",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_slug": {
+          "name": "organization_slug",
+          "columns": [
+            "slug"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_id": {
+          "name": "organization_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization_role": {
+      "name": "organization_role",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "permission": {
+          "name": "permission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_role_organization_id": {
+          "name": "organization_role_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "organization_role_name": {
+          "name": "organization_role_name",
+          "columns": [
+            "organization_id",
+            "role"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_role_id": {
+          "name": "organization_role_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "temp_template_sharing": {
+      "name": "temp_template_sharing",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_member_id": {
+          "name": "creator_member_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_user_id": {
+          "name": "creator_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "template_json": {
+          "name": "template_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "temp_template_sharing_org_id": {
+          "name": "temp_template_sharing_org_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_member_id": {
+          "name": "temp_template_sharing_creator_member_id",
+          "columns": [
+            "creator_member_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_user_id": {
+          "name": "temp_template_sharing_creator_user_id",
+          "columns": [
+            "creator_user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "temp_template_sharing_id": {
+          "name": "temp_template_sharing_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_member": {
+      "name": "skill_hub_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_member_skill_hub_id": {
+          "name": "skill_hub_member_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_org_membership_id": {
+          "name": "skill_hub_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_team_id": {
+          "name": "skill_hub_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_hub_org_membership": {
+          "name": "skill_hub_member_hub_org_membership",
+          "columns": [
+            "skill_hub_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        },
+        "skill_hub_member_hub_team": {
+          "name": "skill_hub_member_hub_team",
+          "columns": [
+            "skill_hub_id",
+            "team_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_member_id": {
+          "name": "skill_hub_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_skill": {
+      "name": "skill_hub_skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_skill_skill_hub_id": {
+          "name": "skill_hub_skill_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_skill_id": {
+          "name": "skill_hub_skill_skill_id",
+          "columns": [
+            "skill_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_hub_skill": {
+          "name": "skill_hub_skill_hub_skill",
+          "columns": [
+            "skill_hub_id",
+            "skill_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_skill_id": {
+          "name": "skill_hub_skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub": {
+      "name": "skill_hub",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_hub_organization_id": {
+          "name": "skill_hub_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_created_by_org_membership_id": {
+          "name": "skill_hub_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill": {
+      "name": "skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "skill_text": {
+          "name": "skill_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "shared": {
+          "name": "shared",
+          "type": "enum('org','public')",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_organization_id": {
+          "name": "skill_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_created_by_org_membership_id": {
+          "name": "skill_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_shared": {
+          "name": "skill_shared",
+          "columns": [
+            "shared"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_id": {
+          "name": "skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team_member": {
+      "name": "team_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "team_member_team_id": {
+          "name": "team_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_org_membership_id": {
+          "name": "team_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_team_org_membership": {
+          "name": "team_member_team_org_membership",
+          "columns": [
+            "team_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_member_id": {
+          "name": "team_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team": {
+      "name": "team",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "team_organization_id": {
+          "name": "team_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "team_organization_name": {
+          "name": "team_organization_name",
+          "columns": [
+            "organization_id",
+            "name"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_id": {
+          "name": "team_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "audit_event": {
+      "name": "audit_event",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "action": {
+          "name": "action",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "audit_event_org_id": {
+          "name": "audit_event_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "audit_event_worker_id": {
+          "name": "audit_event_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "audit_event_id": {
+          "name": "audit_event_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "daytona_sandbox": {
+      "name": "daytona_sandbox",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sandbox_id": {
+          "name": "sandbox_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "workspace_volume_id": {
+          "name": "workspace_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "data_volume_id": {
+          "name": "data_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url": {
+          "name": "signed_preview_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url_expires_at": {
+          "name": "signed_preview_url_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "daytona_sandbox_worker_id": {
+          "name": "daytona_sandbox_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": true
+        },
+        "daytona_sandbox_sandbox_id": {
+          "name": "daytona_sandbox_sandbox_id",
+          "columns": [
+            "sandbox_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "daytona_sandbox_id": {
+          "name": "daytona_sandbox_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_bundle": {
+      "name": "worker_bundle",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "storage_url": {
+          "name": "storage_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "worker_bundle_worker_id": {
+          "name": "worker_bundle_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_bundle_id": {
+          "name": "worker_bundle_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_instance": {
+      "name": "worker_instance",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "url": {
+          "name": "url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_instance_worker_id": {
+          "name": "worker_instance_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_instance_id": {
+          "name": "worker_instance_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker": {
+      "name": "worker",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "destination": {
+          "name": "destination",
+          "type": "enum('local','cloud')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "image_version": {
+          "name": "image_version",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "workspace_path": {
+          "name": "workspace_path",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sandbox_backend": {
+          "name": "sandbox_backend",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_active_at": {
+          "name": "last_active_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_org_id": {
+          "name": "worker_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "worker_created_by_user_id": {
+          "name": "worker_created_by_user_id",
+          "columns": [
+            "created_by_user_id"
+          ],
+          "isUnique": false
+        },
+        "worker_status": {
+          "name": "worker_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "worker_last_heartbeat_at": {
+          "name": "worker_last_heartbeat_at",
+          "columns": [
+            "last_heartbeat_at"
+          ],
+          "isUnique": false
+        },
+        "worker_last_active_at": {
+          "name": "worker_last_active_at",
+          "columns": [
+            "last_active_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_id": {
+          "name": "worker_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_token": {
+      "name": "worker_token",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "enum('client','host','activity')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "worker_token_worker_id": {
+          "name": "worker_token_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        },
+        "worker_token_token": {
+          "name": "worker_token_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_token_id": {
+          "name": "worker_token_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "admin_allowlist": {
+      "name": "admin_allowlist",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "note": {
+          "name": "note",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "admin_allowlist_email": {
+          "name": "admin_allowlist_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "admin_allowlist_id": {
+          "name": "admin_allowlist_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "rate_limit": {
+      "name": "rate_limit",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "key": {
+          "name": "key",
+          "type": "varchar(512)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "count": {
+          "name": "count",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "last_request": {
+          "name": "last_request",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "rate_limit_key": {
+          "name": "rate_limit_key",
+          "columns": [
+            "key"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "rate_limit_id": {
+          "name": "rate_limit_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    }
+  },
+  "views": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "tables": {},
+    "indexes": {}
+  }
+}
diff --git a/ee/packages/den-db/drizzle/meta/0008_snapshot.json b/ee/packages/den-db/drizzle/meta/0008_snapshot.json
new file mode 100644
index 0000000000..1b7c3d68be
--- /dev/null
+++ b/ee/packages/den-db/drizzle/meta/0008_snapshot.json
@@ -0,0 +1,2358 @@
+{
+  "version": "5",
+  "dialect": "mysql",
+  "id": "e465c2af-b7a2-457f-89cd-2a0f02645bc8",
+  "prevId": "0c7f8a74-8ffd-40db-9a67-f5ae72db8656",
+  "tables": {
+    "account": {
+      "name": "account",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "account_user_id": {
+          "name": "account_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "account_id": {
+          "name": "account_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "session": {
+      "name": "session",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active_team_id": {
+          "name": "active_team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "session_token": {
+          "name": "session_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        },
+        "session_user_id": {
+          "name": "session_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "session_id": {
+          "name": "session_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "user": {
+      "name": "user",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "user_email": {
+          "name": "user_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "user_id": {
+          "name": "user_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "verification": {
+      "name": "verification",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "verification_identifier": {
+          "name": "verification_identifier",
+          "columns": [
+            "identifier"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "verification_id": {
+          "name": "verification_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "desktop_handoff_grant": {
+      "name": "desktop_handoff_grant",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "session_token": {
+          "name": "session_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "consumed_at": {
+          "name": "consumed_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "desktop_handoff_grant_user_id": {
+          "name": "desktop_handoff_grant_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "desktop_handoff_grant_expires_at": {
+          "name": "desktop_handoff_grant_expires_at",
+          "columns": [
+            "expires_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "desktop_handoff_grant_id": {
+          "name": "desktop_handoff_grant_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "invitation": {
+      "name": "invitation",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'pending'"
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "invitation_organization_id": {
+          "name": "invitation_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "invitation_email": {
+          "name": "invitation_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": false
+        },
+        "invitation_status": {
+          "name": "invitation_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "invitation_team_id": {
+          "name": "invitation_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "invitation_id": {
+          "name": "invitation_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "member": {
+      "name": "member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'member'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "member_organization_id": {
+          "name": "member_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "member_user_id": {
+          "name": "member_user_id",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "member_organization_user": {
+          "name": "member_organization_user",
+          "columns": [
+            "organization_id",
+            "user_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "member_id": {
+          "name": "member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization_role": {
+      "name": "organization_role",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "permission": {
+          "name": "permission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_role_organization_id": {
+          "name": "organization_role_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "organization_role_name": {
+          "name": "organization_role_name",
+          "columns": [
+            "organization_id",
+            "role"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_role_id": {
+          "name": "organization_role_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "organization": {
+      "name": "organization",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "logo": {
+          "name": "logo",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "organization_slug": {
+          "name": "organization_slug",
+          "columns": [
+            "slug"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "organization_id": {
+          "name": "organization_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "temp_template_sharing": {
+      "name": "temp_template_sharing",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_member_id": {
+          "name": "creator_member_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "creator_user_id": {
+          "name": "creator_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "template_json": {
+          "name": "template_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "temp_template_sharing_org_id": {
+          "name": "temp_template_sharing_org_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_member_id": {
+          "name": "temp_template_sharing_creator_member_id",
+          "columns": [
+            "creator_member_id"
+          ],
+          "isUnique": false
+        },
+        "temp_template_sharing_creator_user_id": {
+          "name": "temp_template_sharing_creator_user_id",
+          "columns": [
+            "creator_user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "temp_template_sharing_id": {
+          "name": "temp_template_sharing_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "llm_provider_access": {
+      "name": "llm_provider_access",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "llm_provider_id": {
+          "name": "llm_provider_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "llm_provider_access_llm_provider_id": {
+          "name": "llm_provider_access_llm_provider_id",
+          "columns": [
+            "llm_provider_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_access_org_membership_id": {
+          "name": "llm_provider_access_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_access_team_id": {
+          "name": "llm_provider_access_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_access_provider_org_membership": {
+          "name": "llm_provider_access_provider_org_membership",
+          "columns": [
+            "llm_provider_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        },
+        "llm_provider_access_provider_team": {
+          "name": "llm_provider_access_provider_team",
+          "columns": [
+            "llm_provider_id",
+            "team_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "llm_provider_access_id": {
+          "name": "llm_provider_access_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "llm_provider_model": {
+      "name": "llm_provider_model",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "llm_provider_id": {
+          "name": "llm_provider_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "model_id": {
+          "name": "model_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "model_config": {
+          "name": "model_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "llm_provider_model_llm_provider_id": {
+          "name": "llm_provider_model_llm_provider_id",
+          "columns": [
+            "llm_provider_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_model_model_id": {
+          "name": "llm_provider_model_model_id",
+          "columns": [
+            "model_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_model_provider_model": {
+          "name": "llm_provider_model_provider_model",
+          "columns": [
+            "llm_provider_id",
+            "model_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "llm_provider_model_id": {
+          "name": "llm_provider_model_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "llm_provider": {
+      "name": "llm_provider",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "source": {
+          "name": "source",
+          "type": "enum('models_dev','custom')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider_config": {
+          "name": "provider_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "api_key": {
+          "name": "api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "llm_provider_organization_id": {
+          "name": "llm_provider_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_created_by_org_membership_id": {
+          "name": "llm_provider_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_source": {
+          "name": "llm_provider_source",
+          "columns": [
+            "source"
+          ],
+          "isUnique": false
+        },
+        "llm_provider_provider_id": {
+          "name": "llm_provider_provider_id",
+          "columns": [
+            "provider_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "llm_provider_id": {
+          "name": "llm_provider_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_member": {
+      "name": "skill_hub_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_member_skill_hub_id": {
+          "name": "skill_hub_member_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_org_membership_id": {
+          "name": "skill_hub_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_team_id": {
+          "name": "skill_hub_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_member_hub_org_membership": {
+          "name": "skill_hub_member_hub_org_membership",
+          "columns": [
+            "skill_hub_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        },
+        "skill_hub_member_hub_team": {
+          "name": "skill_hub_member_hub_team",
+          "columns": [
+            "skill_hub_id",
+            "team_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_member_id": {
+          "name": "skill_hub_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub_skill": {
+      "name": "skill_hub_skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "skill_hub_skill_skill_hub_id": {
+          "name": "skill_hub_skill_skill_hub_id",
+          "columns": [
+            "skill_hub_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_skill_id": {
+          "name": "skill_hub_skill_skill_id",
+          "columns": [
+            "skill_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_skill_hub_skill": {
+          "name": "skill_hub_skill_hub_skill",
+          "columns": [
+            "skill_hub_id",
+            "skill_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_skill_id": {
+          "name": "skill_hub_skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill_hub": {
+      "name": "skill_hub",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_hub_organization_id": {
+          "name": "skill_hub_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_hub_created_by_org_membership_id": {
+          "name": "skill_hub_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_hub_id": {
+          "name": "skill_hub_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "skill": {
+      "name": "skill",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_org_membership_id": {
+          "name": "created_by_org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "skill_text": {
+          "name": "skill_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "shared": {
+          "name": "shared",
+          "type": "enum('org','public')",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "skill_organization_id": {
+          "name": "skill_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "skill_created_by_org_membership_id": {
+          "name": "skill_created_by_org_membership_id",
+          "columns": [
+            "created_by_org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "skill_shared": {
+          "name": "skill_shared",
+          "columns": [
+            "shared"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "skill_id": {
+          "name": "skill_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team_member": {
+      "name": "team_member",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_membership_id": {
+          "name": "org_membership_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "team_member_team_id": {
+          "name": "team_member_team_id",
+          "columns": [
+            "team_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_org_membership_id": {
+          "name": "team_member_org_membership_id",
+          "columns": [
+            "org_membership_id"
+          ],
+          "isUnique": false
+        },
+        "team_member_team_org_membership": {
+          "name": "team_member_team_org_membership",
+          "columns": [
+            "team_id",
+            "org_membership_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_member_id": {
+          "name": "team_member_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "team": {
+      "name": "team",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "team_organization_id": {
+          "name": "team_organization_id",
+          "columns": [
+            "organization_id"
+          ],
+          "isUnique": false
+        },
+        "team_organization_name": {
+          "name": "team_organization_name",
+          "columns": [
+            "organization_id",
+            "name"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "team_id": {
+          "name": "team_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "audit_event": {
+      "name": "audit_event",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "action": {
+          "name": "action",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "audit_event_org_id": {
+          "name": "audit_event_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "audit_event_worker_id": {
+          "name": "audit_event_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "audit_event_id": {
+          "name": "audit_event_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "daytona_sandbox": {
+      "name": "daytona_sandbox",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "sandbox_id": {
+          "name": "sandbox_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "workspace_volume_id": {
+          "name": "workspace_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "data_volume_id": {
+          "name": "data_volume_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url": {
+          "name": "signed_preview_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "signed_preview_url_expires_at": {
+          "name": "signed_preview_url_expires_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "daytona_sandbox_worker_id": {
+          "name": "daytona_sandbox_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": true
+        },
+        "daytona_sandbox_sandbox_id": {
+          "name": "daytona_sandbox_sandbox_id",
+          "columns": [
+            "sandbox_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "daytona_sandbox_id": {
+          "name": "daytona_sandbox_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_bundle": {
+      "name": "worker_bundle",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "storage_url": {
+          "name": "storage_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        }
+      },
+      "indexes": {
+        "worker_bundle_worker_id": {
+          "name": "worker_bundle_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_bundle_id": {
+          "name": "worker_bundle_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_instance": {
+      "name": "worker_instance",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "region": {
+          "name": "region",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "url": {
+          "name": "url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_instance_worker_id": {
+          "name": "worker_instance_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_instance_id": {
+          "name": "worker_instance_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker": {
+      "name": "worker",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "description": {
+          "name": "description",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "destination": {
+          "name": "destination",
+          "type": "enum('local','cloud')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "enum('provisioning','healthy','failed','stopped')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "image_version": {
+          "name": "image_version",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "workspace_path": {
+          "name": "workspace_path",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sandbox_backend": {
+          "name": "sandbox_backend",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_active_at": {
+          "name": "last_active_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "worker_org_id": {
+          "name": "worker_org_id",
+          "columns": [
+            "org_id"
+          ],
+          "isUnique": false
+        },
+        "worker_created_by_user_id": {
+          "name": "worker_created_by_user_id",
+          "columns": [
+            "created_by_user_id"
+          ],
+          "isUnique": false
+        },
+        "worker_status": {
+          "name": "worker_status",
+          "columns": [
+            "status"
+          ],
+          "isUnique": false
+        },
+        "worker_last_heartbeat_at": {
+          "name": "worker_last_heartbeat_at",
+          "columns": [
+            "last_heartbeat_at"
+          ],
+          "isUnique": false
+        },
+        "worker_last_active_at": {
+          "name": "worker_last_active_at",
+          "columns": [
+            "last_active_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_id": {
+          "name": "worker_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "worker_token": {
+      "name": "worker_token",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "worker_id": {
+          "name": "worker_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "enum('client','host','activity')",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "worker_token_worker_id": {
+          "name": "worker_token_worker_id",
+          "columns": [
+            "worker_id"
+          ],
+          "isUnique": false
+        },
+        "worker_token_token": {
+          "name": "worker_token_token",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "worker_token_id": {
+          "name": "worker_token_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "admin_allowlist": {
+      "name": "admin_allowlist",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "note": {
+          "name": "note",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp(3)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)"
+        }
+      },
+      "indexes": {
+        "admin_allowlist_email": {
+          "name": "admin_allowlist_email",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "admin_allowlist_id": {
+          "name": "admin_allowlist_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "rate_limit": {
+      "name": "rate_limit",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "key": {
+          "name": "key",
+          "type": "varchar(512)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "count": {
+          "name": "count",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "last_request": {
+          "name": "last_request",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "rate_limit_key": {
+          "name": "rate_limit_key",
+          "columns": [
+            "key"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "rate_limit_id": {
+          "name": "rate_limit_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    }
+  },
+  "views": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "tables": {},
+    "indexes": {}
+  }
+}
\ No newline at end of file
diff --git a/ee/packages/den-db/drizzle/meta/_journal.json b/ee/packages/den-db/drizzle/meta/_journal.json
new file mode 100644
index 0000000000..676a480514
--- /dev/null
+++ b/ee/packages/den-db/drizzle/meta/_journal.json
@@ -0,0 +1,104 @@
+{
+  "version": "7",
+  "dialect": "mysql",
+  "entries": [
+    {
+      "idx": 1,
+      "version": "5",
+      "when": 1775077000001,
+      "tag": "0001_desktop_handoff_grants",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "5",
+      "when": 1775077000002,
+      "tag": "0002_worker_activity_heartbeat",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "5",
+      "when": 1775077000003,
+      "tag": "0003_rate_limit",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "5",
+      "when": 1775077000004,
+      "tag": "0004_organization_plugin",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "5",
+      "when": 1775077000005,
+      "tag": "0005_temp_template_sharing",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "5",
+      "when": 1775077000006,
+      "tag": "0006_skill_hub",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "5",
+      "when": 1775170250887,
+      "tag": "0007_organization_metadata_limits",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "5",
+      "when": 1775261156284,
+      "tag": "0008_cynical_boomerang",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "5",
+      "when": 1775350000000,
+      "tag": "0009_api_keys",
+      "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "5",
+      "when": 1776427000000,
+      "tag": "0010_plugin_arch",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "5",
+      "when": 1776440000000,
+      "tag": "0011_marketplaces",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "5",
+      "when": 1776628833797,
+      "tag": "0012_allowed_email_domains",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "5",
+      "when": 1776632400000,
+      "tag": "0013_desktop_app_restrictions",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "5",
+      "when": 1777400000000,
+      "tag": "0014_drop_temp_template_sharing",
+      "breakpoints": true
+    }
+  ]
+}
diff --git a/ee/packages/den-db/package.json b/ee/packages/den-db/package.json
new file mode 100644
index 0000000000..f5f67c37fb
--- /dev/null
+++ b/ee/packages/den-db/package.json
@@ -0,0 +1,76 @@
+{
+  "name": "@openwork-ee/den-db",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./src/index.ts",
+  "source": "./src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "development": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./schema": {
+      "types": "./src/schema.ts",
+      "development": "./src/schema.ts",
+      "default": "./dist/schema.js"
+    },
+    "./schema/auth": {
+      "types": "./src/schema/auth.ts",
+      "development": "./src/schema/auth.ts",
+      "default": "./dist/schema/auth.js"
+    },
+    "./schema/org": {
+      "types": "./src/schema/org.ts",
+      "development": "./src/schema/org.ts",
+      "default": "./dist/schema/org.js"
+    },
+    "./schema/teams": {
+      "types": "./src/schema/teams.ts",
+      "development": "./src/schema/teams.ts",
+      "default": "./dist/schema/teams.js"
+    },
+    "./schema/sharables/skills": {
+      "types": "./src/schema/sharables/skills.ts",
+      "development": "./src/schema/sharables/skills.ts",
+      "default": "./dist/schema/sharables/skills.js"
+    },
+    "./schema/workers": {
+      "types": "./src/schema/workers.ts",
+      "development": "./src/schema/workers.ts",
+      "default": "./dist/schema/workers.js"
+    },
+    "./schema/system": {
+      "types": "./src/schema/system.ts",
+      "development": "./src/schema/system.ts",
+      "default": "./dist/schema/system.js"
+    },
+    "./drizzle": {
+      "types": "./src/drizzle.ts",
+      "development": "./src/drizzle.ts",
+      "default": "./dist/drizzle.js"
+    }
+  },
+  "scripts": {
+    "build": "pnpm run build:utils && tsup",
+    "build:utils": "pnpm --dir ../utils run build",
+    "db:generate": "pnpm run build && node --import tsx ./node_modules/drizzle-kit/bin.cjs generate --config drizzle.config.ts",
+    "db:migrate": "pnpm run build && node --import tsx ./node_modules/drizzle-kit/bin.cjs migrate --config drizzle.config.ts",
+    "db:push": "pnpm run build && node --import tsx ./node_modules/drizzle-kit/bin.cjs push --config drizzle.config.ts"
+  },
+  "dependencies": {
+    "@openwork/types": "workspace:*",
+    "@openwork-ee/utils": "workspace:*",
+    "@planetscale/database": "^1.19.0",
+    "drizzle-orm": "^0.45.1",
+    "mysql2": "^3.11.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.30",
+    "drizzle-kit": "^0.31.9",
+    "tsup": "^8.5.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.5.4"
+  }
+}
diff --git a/ee/packages/den-db/src/client.ts b/ee/packages/den-db/src/client.ts
new file mode 100644
index 0000000000..865077b3b9
--- /dev/null
+++ b/ee/packages/den-db/src/client.ts
@@ -0,0 +1,182 @@
+import { Client } from "@planetscale/database"
+import { drizzle } from "drizzle-orm/mysql2"
+import { drizzle as drizzlePlanetScale } from "drizzle-orm/planetscale-serverless"
+import type { FieldPacket, QueryOptions, QueryResult } from "mysql2"
+import mysql from "mysql2/promise"
+import { parseMySqlConnectionConfig } from "./mysql-config"
+import * as schema from "./schema"
+
+export type DenDbMode = "mysql" | "planetscale"
+type DenDb = ReturnType<typeof drizzlePlanetScale>
+export type PlanetScaleCredentials = {
+  host: string
+  username: string
+  password: string
+}
+
+const TRANSIENT_DB_ERROR_CODES = new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "ETIMEDOUT",
+  "PROTOCOL_CONNECTION_LOST",
+  "PROTOCOL_ENQUEUE_AFTER_FATAL_ERROR",
+])
+
+const RETRYABLE_QUERY_PREFIXES = ["select", "show", "describe", "explain"]
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function getErrorCode(error: unknown): string | null {
+  if (!isRecord(error)) {
+    return null
+  }
+
+  if (typeof error.code === "string") {
+    return error.code
+  }
+
+  return getErrorCode(error.cause)
+}
+
+export function isTransientDbConnectionError(error: unknown): boolean {
+  const code = getErrorCode(error)
+  if (!code) {
+    return false
+  }
+  return TRANSIENT_DB_ERROR_CODES.has(code)
+}
+
+function extractSql(value: unknown): string | null {
+  if (typeof value === "string") {
+    return value
+  }
+
+  if (!isRecord(value)) {
+    return null
+  }
+
+  if (typeof value.sql === "string") {
+    return value.sql
+  }
+
+  return null
+}
+
+function isRetryableReadQuery(sql: string | null): boolean {
+  if (!sql) {
+    return false
+  }
+
+  const normalized = sql.trimStart().toLowerCase()
+  return RETRYABLE_QUERY_PREFIXES.some((prefix) => normalized.startsWith(prefix))
+}
+
+async function retryReadQuery<T>(label: "query" | "execute", sql: string | null, run: () => Promise<T>): Promise<T> {
+  try {
+    return await run()
+  } catch (error) {
+    if (!isRetryableReadQuery(sql) || !isTransientDbConnectionError(error)) {
+      throw error
+    }
+
+    const queryType = sql?.trimStart().split(/\s+/, 1)[0]?.toUpperCase() ?? "QUERY"
+    console.warn(`[db] transient mysql error on ${label} (${queryType}); retrying once`)
+    return run()
+  }
+}
+
+function parsePlanetScaleConfigFromDatabaseUrl(databaseUrl: string): PlanetScaleCredentials {
+  const parsed = new URL(databaseUrl)
+  if (!parsed.hostname || !parsed.username) {
+    throw new Error("DATABASE_URL must include host and username when DB_MODE=planetscale")
+  }
+
+  return {
+    host: parsed.hostname,
+    username: decodeURIComponent(parsed.username),
+    password: decodeURIComponent(parsed.password),
+  }
+}
+
+function resolveDbMode(input: { mode?: DenDbMode; databaseUrl?: string | null }): DenDbMode {
+  if (input.mode) {
+    return input.mode
+  }
+
+  return input.databaseUrl ? "mysql" : "planetscale"
+}
+
+export function createDenDb(input: {
+  databaseUrl?: string | null
+  mode?: DenDbMode
+  planetscale?: PlanetScaleCredentials | null
+}) {
+  const mode = resolveDbMode(input)
+
+  if (mode === "planetscale") {
+    const credentials = input.planetscale ?? (input.databaseUrl ? parsePlanetScaleConfigFromDatabaseUrl(input.databaseUrl) : null)
+    if (!credentials) {
+      throw new Error("PlanetScale mode requires DATABASE_HOST, DATABASE_USERNAME, and DATABASE_PASSWORD")
+    }
+
+    const client = new Client(credentials)
+    return {
+      client,
+      db: drizzlePlanetScale(client, { schema }) as unknown as DenDb,
+    }
+  }
+
+  if (!input.databaseUrl) {
+    throw new Error("MySQL mode requires DATABASE_URL")
+  }
+
+  const client = mysql.createPool({
+    ...parseMySqlConnectionConfig(input.databaseUrl),
+    waitForConnections: true,
+    connectionLimit: 10,
+    maxIdle: 10,
+    idleTimeout: 60_000,
+    queueLimit: 0,
+    enableKeepAlive: true,
+    keepAliveInitialDelay: 0,
+  })
+
+  const query = client.query.bind(client)
+
+  async function retryingQuery<T extends QueryResult>(sql: string): Promise<[T, FieldPacket[]]>
+  async function retryingQuery<T extends QueryResult>(sql: string, values: unknown): Promise<[T, FieldPacket[]]>
+  async function retryingQuery<T extends QueryResult>(options: QueryOptions): Promise<[T, FieldPacket[]]>
+  async function retryingQuery<T extends QueryResult>(options: QueryOptions, values: unknown): Promise<[T, FieldPacket[]]>
+  async function retryingQuery<T extends QueryResult>(
+    sqlOrOptions: string | QueryOptions,
+    values?: unknown,
+  ): Promise<[T, FieldPacket[]]> {
+    const sql = extractSql(sqlOrOptions)
+    return retryReadQuery("query", sql, () => query<T>(sqlOrOptions as never, values as never))
+  }
+
+  client.query = retryingQuery
+
+  const execute = client.execute.bind(client)
+
+  async function retryingExecute<T extends QueryResult>(sql: string): Promise<[T, FieldPacket[]]>
+  async function retryingExecute<T extends QueryResult>(sql: string, values: unknown): Promise<[T, FieldPacket[]]>
+  async function retryingExecute<T extends QueryResult>(options: QueryOptions): Promise<[T, FieldPacket[]]>
+  async function retryingExecute<T extends QueryResult>(options: QueryOptions, values: unknown): Promise<[T, FieldPacket[]]>
+  async function retryingExecute<T extends QueryResult>(
+    sqlOrOptions: string | QueryOptions,
+    values?: unknown,
+  ): Promise<[T, FieldPacket[]]> {
+    const sql = extractSql(sqlOrOptions)
+    return retryReadQuery("execute", sql, () => execute<T>(sqlOrOptions as never, values as never))
+  }
+
+  client.execute = retryingExecute
+
+  return {
+    client,
+    db: drizzle(client, { schema, mode: "default" }) as unknown as DenDb,
+  }
+}
diff --git a/ee/packages/den-db/src/columns.ts b/ee/packages/den-db/src/columns.ts
new file mode 100644
index 0000000000..3edab745c0
--- /dev/null
+++ b/ee/packages/den-db/src/columns.ts
@@ -0,0 +1,130 @@
+import * as crypto from "node:crypto"
+import { customType, timestamp, varchar } from "drizzle-orm/mysql-core"
+import {
+  type DenTypeId,
+  type DenTypeIdName,
+  normalizeDenTypeId,
+} from "@openwork-ee/utils/typeid"
+import { sql } from "drizzle-orm"
+
+const INTERNAL_ID_LENGTH = 64
+const AUTH_EXTERNAL_ID_LENGTH = 36
+const ENCRYPTION_VERSION_PREFIX = "enc:v1:"
+const ENCRYPTION_ALGORITHM = "aes-256-gcm"
+const MIN_ENCRYPTION_KEY_LENGTH = 32
+
+export const authExternalIdColumn = (columnName: string) =>
+  varchar(columnName, { length: AUTH_EXTERNAL_ID_LENGTH })
+
+function getDatabaseEncryptionSecret() {
+  const explicit = process.env.DEN_DB_ENCRYPTION_KEY?.trim()
+  if (!explicit) {
+    throw new Error(
+      "DEN_DB_ENCRYPTION_KEY is required to use encrypted database columns",
+    )
+  }
+
+  if (explicit.length < MIN_ENCRYPTION_KEY_LENGTH) {
+    throw new Error(
+      `DEN_DB_ENCRYPTION_KEY must be at least ${MIN_ENCRYPTION_KEY_LENGTH} characters long`,
+    )
+  }
+
+  return explicit
+}
+
+function getDatabaseEncryptionKey() {
+  return new Uint8Array(
+    crypto.createHash("sha256").update(getDatabaseEncryptionSecret()).digest(),
+  )
+}
+
+function encryptDatabaseValue(value: string) {
+  const ivBuffer = crypto.randomBytes(12)
+  const iv = new Uint8Array(ivBuffer)
+  const cipher = crypto.createCipheriv(
+    ENCRYPTION_ALGORITHM,
+    getDatabaseEncryptionKey(),
+    iv,
+  )
+  let encrypted = cipher.update(value, "utf8", "base64")
+  encrypted += cipher.final("base64")
+  const authTag = cipher.getAuthTag().toString("base64")
+  const ivBase64 = ivBuffer.toString("base64")
+  return `${ENCRYPTION_VERSION_PREFIX}${ivBase64}.${authTag}.${encrypted}`
+}
+
+function decryptDatabaseValue(value: string) {
+  if (!value.startsWith(ENCRYPTION_VERSION_PREFIX)) {
+    throw new Error("Encrypted value is missing a supported prefix")
+  }
+
+  const [ivBase64, authTagBase64, encrypted] = value
+    .slice(ENCRYPTION_VERSION_PREFIX.length)
+    .split(".")
+  if (!ivBase64 || !authTagBase64 || !encrypted) {
+    throw new Error("Encrypted value is malformed")
+  }
+
+  const iv = new Uint8Array(Buffer.from(ivBase64, "base64"))
+  const decipher = crypto.createDecipheriv(
+    ENCRYPTION_ALGORITHM,
+    getDatabaseEncryptionKey(),
+    iv,
+  )
+  decipher.setAuthTag(new Uint8Array(Buffer.from(authTagBase64, "base64")))
+  let decrypted = decipher.update(encrypted, "base64", "utf8")
+  decrypted += decipher.final("utf8")
+  return decrypted
+}
+
+type EncryptedColumnOptions<TData> = {
+  serialize: (value: TData) => string
+  deserialize: (value: string) => TData
+}
+
+export function encryptedColumn<TData>(
+  columnName: string,
+  options: EncryptedColumnOptions<TData>,
+) {
+  return customType<{ data: TData; driverData: string }>({
+    dataType() {
+      return "text"
+    },
+    toDriver(value) {
+      return encryptDatabaseValue(options.serialize(value))
+    },
+    fromDriver(value) {
+      return options.deserialize(decryptDatabaseValue(value))
+    },
+  })(columnName)
+}
+
+export const encryptedTextColumn = (columnName: string) =>
+  encryptedColumn<string>(columnName, {
+    serialize: (value) => value,
+    deserialize: (value) => value,
+  })
+
+export const denTypeIdColumn = <TName extends DenTypeIdName>(
+  name: TName,
+  columnName: string,
+) =>
+  customType<{ data: DenTypeId<TName>; driverData: string }>({
+    dataType() {
+      return `varchar(${INTERNAL_ID_LENGTH})`
+    },
+    toDriver(value) {
+      return normalizeDenTypeId(name, value)
+    },
+    fromDriver(value) {
+      return normalizeDenTypeId(name, value)
+    },
+  })(columnName)
+
+export const timestamps = {
+  created_at: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  updated_at: timestamp("updated_at", { fsp: 3 })
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+}
diff --git a/ee/packages/den-db/src/drizzle.ts b/ee/packages/den-db/src/drizzle.ts
new file mode 100644
index 0000000000..e2e9600f05
--- /dev/null
+++ b/ee/packages/den-db/src/drizzle.ts
@@ -0,0 +1 @@
+export { and, asc, desc, eq, gt, inArray, isNotNull, isNull, or, sql } from "drizzle-orm"
diff --git a/ee/packages/den-db/src/index.ts b/ee/packages/den-db/src/index.ts
new file mode 100644
index 0000000000..ca637f9c1a
--- /dev/null
+++ b/ee/packages/den-db/src/index.ts
@@ -0,0 +1,4 @@
+export * from "./client"
+export * from "./columns"
+export * from "./mysql-config"
+export * from "./schema"
diff --git a/ee/packages/den-db/src/load-env.ts b/ee/packages/den-db/src/load-env.ts
new file mode 100644
index 0000000000..008463c499
--- /dev/null
+++ b/ee/packages/den-db/src/load-env.ts
@@ -0,0 +1,75 @@
+import { existsSync, readFileSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+function findUpwards(startDir: string, fileName: string, maxDepth = 6) {
+  let current = startDir
+
+  for (let depth = 0; depth <= maxDepth; depth += 1) {
+    const candidate = path.join(current, fileName)
+    if (existsSync(candidate)) {
+      return candidate
+    }
+
+    const parent = path.dirname(current)
+    if (parent === current) {
+      break
+    }
+    current = parent
+  }
+
+  return null
+}
+
+function parseEnvFile(contents: string) {
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim()
+    if (!line || line.startsWith("#")) {
+      continue
+    }
+
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/)
+    if (!match) {
+      continue
+    }
+
+    const key = match[1]
+    let value = match[2] ?? ""
+
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1)
+    }
+
+    if (process.env[key] === undefined) {
+      process.env[key] = value
+    }
+  }
+}
+
+function loadEnvFile(filePath: string) {
+  if (!existsSync(filePath)) {
+    return
+  }
+
+  parseEnvFile(readFileSync(filePath, "utf8"))
+}
+
+const currentDir = path.dirname(fileURLToPath(import.meta.url))
+const packageDir = path.resolve(currentDir, "..")
+
+for (const filePath of [
+  path.join(packageDir, ".env.local"),
+  path.join(packageDir, ".env"),
+]) {
+  loadEnvFile(filePath)
+}
+
+const explicitEnvPath =
+  process.env.OPENWORK_DEN_DB_ENV_PATH?.trim() ||
+  process.env.DATABASE_ENV_FILE?.trim()
+const detectedRootEnvPath = findUpwards(path.resolve(packageDir, "..", ".."), ".env")
+const envPath = explicitEnvPath || detectedRootEnvPath
+
+if (envPath) {
+  loadEnvFile(envPath)
+}
diff --git a/ee/packages/den-db/src/mysql-config.ts b/ee/packages/den-db/src/mysql-config.ts
new file mode 100644
index 0000000000..aa6f6f194e
--- /dev/null
+++ b/ee/packages/den-db/src/mysql-config.ts
@@ -0,0 +1,48 @@
+type ParsedMySqlConfig = {
+  host: string
+  port: number
+  user: string
+  password: string
+  database: string
+  ssl?: {
+    rejectUnauthorized: boolean
+  }
+}
+
+function readSslSettings(parsed: URL) {
+  const sslAccept = parsed.searchParams.get("sslaccept")?.trim().toLowerCase()
+  const sslMode =
+    parsed.searchParams.get("sslmode")?.trim().toLowerCase() ??
+    parsed.searchParams.get("ssl-mode")?.trim().toLowerCase()
+
+  const needsSsl = Boolean(sslAccept || sslMode)
+  if (!needsSsl) {
+    return undefined
+  }
+
+  const rejectUnauthorized =
+    sslAccept === "strict" ||
+    sslMode === "verify-ca" ||
+    sslMode === "verify-full" ||
+    sslMode === "require"
+
+  return { rejectUnauthorized }
+}
+
+export function parseMySqlConnectionConfig(databaseUrl: string): ParsedMySqlConfig {
+  const parsed = new URL(databaseUrl)
+  const database = parsed.pathname.replace(/^\//, "")
+
+  if (!parsed.hostname || !parsed.username || !database) {
+    throw new Error("DATABASE_URL must include host, username, and database for mysql mode")
+  }
+
+  return {
+    host: parsed.hostname,
+    port: Number(parsed.port || "3306"),
+    user: decodeURIComponent(parsed.username),
+    password: decodeURIComponent(parsed.password),
+    database,
+    ssl: readSslSettings(parsed),
+  }
+}
diff --git a/ee/packages/den-db/src/schema.ts b/ee/packages/den-db/src/schema.ts
new file mode 100644
index 0000000000..216d9a38fa
--- /dev/null
+++ b/ee/packages/den-db/src/schema.ts
@@ -0,0 +1 @@
+export * from "./schema/index"
diff --git a/ee/packages/den-db/src/schema/auth.ts b/ee/packages/den-db/src/schema/auth.ts
new file mode 100644
index 0000000000..984c4e151b
--- /dev/null
+++ b/ee/packages/den-db/src/schema/auth.ts
@@ -0,0 +1,244 @@
+import * as crypto from "node:crypto"
+import { sql } from "drizzle-orm"
+import { bigint, boolean, index, int, mysqlTable, text, timestamp, uniqueIndex, varchar } from "drizzle-orm/mysql-core"
+import { denTypeIdColumn } from "../columns"
+
+export const AuthUserTable = mysqlTable(
+  "user",
+  {
+    id: denTypeIdColumn("user", "id").notNull().primaryKey(),
+    name: varchar("name", { length: 255 }).notNull(),
+    email: varchar("email", { length: 255 }).notNull(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [uniqueIndex("user_email").on(table.email)],
+)
+
+export const AuthSessionTable = mysqlTable(
+  "session",
+  {
+    id: denTypeIdColumn("session", "id").notNull().primaryKey(),
+    userId: denTypeIdColumn("user", "user_id").notNull(),
+    activeOrganizationId: denTypeIdColumn("organization", "active_organization_id"),
+    activeTeamId: denTypeIdColumn("team", "active_team_id"),
+    token: varchar("token", { length: 255 }).notNull(),
+    expiresAt: timestamp("expires_at", { fsp: 3 }).notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [uniqueIndex("session_token").on(table.token), index("session_user_id").on(table.userId)],
+)
+
+export const AuthAccountTable = mysqlTable(
+  "account",
+  {
+    id: denTypeIdColumn("account", "id").notNull().primaryKey(),
+    userId: denTypeIdColumn("user", "user_id").notNull(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at", { fsp: 3 }),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { fsp: 3 }),
+    scope: text("scope"),
+    idToken: text("id_token"),
+    password: text("password"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [index("account_user_id").on(table.userId)],
+)
+
+export const AuthVerificationTable = mysqlTable(
+  "verification",
+  {
+    id: denTypeIdColumn("verification", "id").notNull().primaryKey(),
+    identifier: varchar("identifier", { length: 255 }).notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at", { fsp: 3 }).notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [index("verification_identifier").on(table.identifier)],
+)
+
+export const AuthApiKeyTable = mysqlTable(
+  "apikey",
+  {
+    id: varchar("id", { length: 64 }).notNull().primaryKey(),
+    configId: varchar("config_id", { length: 255 }).notNull().default("default"),
+    name: varchar("name", { length: 255 }),
+    start: varchar("start", { length: 32 }),
+    prefix: varchar("prefix", { length: 255 }),
+    key: varchar("key", { length: 255 }).notNull(),
+    referenceId: varchar("reference_id", { length: 64 }).notNull(),
+    refillInterval: bigint("refill_interval", { mode: "number" }),
+    refillAmount: int("refill_amount"),
+    lastRefillAt: timestamp("last_refill_at", { fsp: 3 }),
+    enabled: boolean("enabled").notNull().default(true),
+    rateLimitEnabled: boolean("rate_limit_enabled").notNull().default(true),
+    rateLimitTimeWindow: bigint("rate_limit_time_window", { mode: "number" }),
+    rateLimitMax: int("rate_limit_max"),
+    requestCount: int("request_count").default(0),
+    remaining: int("remaining"),
+    lastRequest: timestamp("last_request", { fsp: 3 }),
+    expiresAt: timestamp("expires_at", { fsp: 3 }),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    permissions: text("permissions"),
+    metadata: text("metadata"),
+  },
+  (table) => [
+    index("apikey_config_id").on(table.configId),
+    index("apikey_reference_id").on(table.referenceId),
+    index("apikey_key").on(table.key),
+  ],
+)
+
+export const AuthJwksTable = mysqlTable("jwks", {
+  id: varchar("id", { length: 64 })
+    .notNull()
+    .$defaultFn(() => crypto.randomUUID())
+    .primaryKey(),
+  publicKey: text("public_key").notNull(),
+  privateKey: text("private_key").notNull(),
+  createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  expiresAt: timestamp("expires_at", { fsp: 3 }),
+  alg: varchar("alg", { length: 32 }),
+  crv: varchar("crv", { length: 32 }),
+})
+
+export const OAuthClientTable = mysqlTable(
+  "oauthClient",
+  {
+    id: denTypeIdColumn("oauthClient", "id").notNull().primaryKey(),
+    clientId: varchar("client_id", { length: 255 }).notNull(),
+    clientSecret: text("client_secret"),
+    disabled: boolean("disabled").default(false),
+    skipConsent: boolean("skip_consent"),
+    enableEndSession: boolean("enable_end_session"),
+    subjectType: varchar("subject_type", { length: 64 }),
+    scopes: text("scopes"),
+    userId: denTypeIdColumn("user", "user_id"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    name: varchar("name", { length: 255 }),
+    uri: text("uri"),
+    icon: text("icon"),
+    contacts: text("contacts"),
+    tos: text("tos"),
+    policy: text("policy"),
+    softwareId: varchar("software_id", { length: 255 }),
+    softwareVersion: varchar("software_version", { length: 255 }),
+    softwareStatement: text("software_statement"),
+    redirectUris: text("redirect_uris").notNull(),
+    postLogoutRedirectUris: text("post_logout_redirect_uris"),
+    tokenEndpointAuthMethod: varchar("token_endpoint_auth_method", { length: 128 }),
+    grantTypes: text("grant_types"),
+    responseTypes: text("response_types"),
+    public: boolean("public"),
+    type: varchar("type", { length: 64 }),
+    requirePKCE: boolean("require_pkce"),
+    referenceId: varchar("reference_id", { length: 64 }),
+    metadata: text("metadata"),
+  },
+  (table) => [
+    uniqueIndex("oauth_client_client_id").on(table.clientId),
+    index("oauth_client_user_id").on(table.userId),
+    index("oauth_client_reference_id").on(table.referenceId),
+  ],
+)
+
+export const OAuthRefreshTokenTable = mysqlTable(
+  "oauthRefreshToken",
+  {
+    id: denTypeIdColumn("oauthRefreshToken", "id").notNull().primaryKey(),
+    token: text("token").notNull(),
+    clientId: varchar("client_id", { length: 255 }).notNull(),
+    sessionId: denTypeIdColumn("session", "session_id"),
+    userId: denTypeIdColumn("user", "user_id").notNull(),
+    referenceId: varchar("reference_id", { length: 64 }),
+    expiresAt: timestamp("expires_at", { fsp: 3 }).notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    revoked: timestamp("revoked", { fsp: 3 }),
+    authTime: timestamp("auth_time", { fsp: 3 }),
+    scopes: text("scopes").notNull(),
+  },
+  (table) => [
+    index("oauth_refresh_token_client_id").on(table.clientId),
+    index("oauth_refresh_token_session_id").on(table.sessionId),
+    index("oauth_refresh_token_user_id").on(table.userId),
+    index("oauth_refresh_token_reference_id").on(table.referenceId),
+  ],
+)
+
+export const OAuthAccessTokenTable = mysqlTable(
+  "oauthAccessToken",
+  {
+    id: denTypeIdColumn("oauthAccessToken", "id").notNull().primaryKey(),
+    token: text("token").notNull(),
+    clientId: varchar("client_id", { length: 255 }).notNull(),
+    sessionId: denTypeIdColumn("session", "session_id"),
+    userId: denTypeIdColumn("user", "user_id"),
+    referenceId: varchar("reference_id", { length: 64 }),
+    refreshId: denTypeIdColumn("oauthRefreshToken", "refresh_id"),
+    expiresAt: timestamp("expires_at", { fsp: 3 }).notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    scopes: text("scopes").notNull(),
+  },
+  (table) => [
+    index("oauth_access_token_client_id").on(table.clientId),
+    index("oauth_access_token_session_id").on(table.sessionId),
+    index("oauth_access_token_user_id").on(table.userId),
+    index("oauth_access_token_reference_id").on(table.referenceId),
+    index("oauth_access_token_refresh_id").on(table.refreshId),
+  ],
+)
+
+export const OAuthConsentTable = mysqlTable(
+  "oauthConsent",
+  {
+    id: denTypeIdColumn("oauthConsent", "id").notNull().primaryKey(),
+    clientId: varchar("client_id", { length: 255 }).notNull(),
+    userId: denTypeIdColumn("user", "user_id"),
+    referenceId: varchar("reference_id", { length: 64 }),
+    scopes: text("scopes").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("oauth_consent_client_id").on(table.clientId),
+    index("oauth_consent_user_id").on(table.userId),
+    index("oauth_consent_reference_id").on(table.referenceId),
+  ],
+)
+
+export const user = AuthUserTable
+export const session = AuthSessionTable
+export const account = AuthAccountTable
+export const verification = AuthVerificationTable
+export const apikey = AuthApiKeyTable
+export const jwks = AuthJwksTable
+export const oauthClient = OAuthClientTable
+export const oauthRefreshToken = OAuthRefreshTokenTable
+export const oauthAccessToken = OAuthAccessTokenTable
+export const oauthConsent = OAuthConsentTable
diff --git a/ee/packages/den-db/src/schema/index.ts b/ee/packages/den-db/src/schema/index.ts
new file mode 100644
index 0000000000..cd6375fff4
--- /dev/null
+++ b/ee/packages/den-db/src/schema/index.ts
@@ -0,0 +1,8 @@
+export * from "./auth"
+export * from "./org"
+export * from "./sharables/llm-providers"
+export * from "./sharables/plugin-arch"
+export * from "./sharables/skills"
+export * from "./teams"
+export * from "./workers"
+export * from "./system"
diff --git a/ee/packages/den-db/src/schema/org.ts b/ee/packages/den-db/src/schema/org.ts
new file mode 100644
index 0000000000..9069a195fd
--- /dev/null
+++ b/ee/packages/den-db/src/schema/org.ts
@@ -0,0 +1,117 @@
+import { relations, sql } from "drizzle-orm"
+import { index, json, mysqlTable, text, timestamp, uniqueIndex, varchar } from "drizzle-orm/mysql-core"
+import type { DesktopAppRestrictions } from "@openwork/types/den/desktop-app-restrictions"
+import { denTypeIdColumn } from "../columns"
+
+export const DesktopHandoffGrantTable = mysqlTable(
+  "desktop_handoff_grant",
+  {
+    id: varchar("id", { length: 64 }).notNull().primaryKey(),
+    user_id: denTypeIdColumn("user", "user_id").notNull(),
+    session_token: text("session_token").notNull(),
+    expires_at: timestamp("expires_at", { fsp: 3 }).notNull(),
+    consumed_at: timestamp("consumed_at", { fsp: 3 }),
+    created_at: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("desktop_handoff_grant_user_id").on(table.user_id),
+    index("desktop_handoff_grant_expires_at").on(table.expires_at),
+  ],
+)
+
+export const OrganizationTable = mysqlTable(
+  "organization",
+  {
+    id: denTypeIdColumn("organization", "id").notNull().primaryKey(),
+    name: varchar("name", { length: 255 }).notNull(),
+    slug: varchar("slug", { length: 255 }).notNull(),
+    logo: varchar("logo", { length: 2048 }),
+    allowedEmailDomains: json("allowed_email_domains").$type<string[] | null>(),
+    desktopAppRestrictions: json("desktop_app_restrictions").$type<DesktopAppRestrictions>().notNull().default(sql`(json_object())`),
+    metadata: json("metadata").$type<Record<string, unknown> | null>(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [uniqueIndex("organization_slug").on(table.slug)],
+)
+
+export const MemberTable = mysqlTable(
+  "member",
+  {
+    id: denTypeIdColumn("member", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    userId: denTypeIdColumn("user", "user_id").notNull(),
+    role: varchar("role", { length: 255 }).notNull().default("member"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("member_organization_id").on(table.organizationId),
+    index("member_user_id").on(table.userId),
+    uniqueIndex("member_organization_user").on(table.organizationId, table.userId),
+  ],
+)
+
+export const InvitationTable = mysqlTable(
+  "invitation",
+  {
+    id: denTypeIdColumn("invitation", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    email: varchar("email", { length: 255 }).notNull(),
+    role: varchar("role", { length: 255 }).notNull(),
+    status: varchar("status", { length: 32 }).notNull().default("pending"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    inviterId: denTypeIdColumn("user", "inviter_id").notNull(),
+    expiresAt: timestamp("expires_at", { fsp: 3 }).notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("invitation_organization_id").on(table.organizationId),
+    index("invitation_email").on(table.email),
+    index("invitation_status").on(table.status),
+    index("invitation_team_id").on(table.teamId),
+  ],
+)
+
+export const OrganizationRoleTable = mysqlTable(
+  "organization_role",
+  {
+    id: denTypeIdColumn("organizationRole", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    role: varchar("role", { length: 255 }).notNull(),
+    permission: text("permission").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("organization_role_organization_id").on(table.organizationId),
+    uniqueIndex("organization_role_name").on(table.organizationId, table.role),
+  ],
+)
+
+export const organizationRelations = relations(OrganizationTable, ({ many }) => ({
+  members: many(MemberTable),
+  roles: many(OrganizationRoleTable),
+}))
+
+export const memberRelations = relations(MemberTable, ({ many, one }) => ({
+  organization: one(OrganizationTable, {
+    fields: [MemberTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+}))
+
+export const organizationRoleRelations = relations(OrganizationRoleTable, ({ one }) => ({
+  organization: one(OrganizationTable, {
+    fields: [OrganizationRoleTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+}))
+
+export const organization = OrganizationTable
+export const member = MemberTable
+export const invitation = InvitationTable
+export const organizationRole = OrganizationRoleTable
diff --git a/ee/packages/den-db/src/schema/sharables/llm-providers.ts b/ee/packages/den-db/src/schema/sharables/llm-providers.ts
new file mode 100644
index 0000000000..c004f400e7
--- /dev/null
+++ b/ee/packages/den-db/src/schema/sharables/llm-providers.ts
@@ -0,0 +1,138 @@
+import { relations, sql } from "drizzle-orm"
+import {
+  index,
+  json,
+  mysqlEnum,
+  mysqlTable,
+  timestamp,
+  uniqueIndex,
+  varchar,
+} from "drizzle-orm/mysql-core"
+import { denTypeIdColumn, encryptedTextColumn } from "../../columns"
+import { MemberTable, OrganizationTable } from "../org"
+import { TeamTable } from "../teams"
+
+export const LlmProviderTable = mysqlTable(
+  "llm_provider",
+  {
+    id: denTypeIdColumn("llmProvider", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn(
+      "organization",
+      "organization_id",
+    ).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn(
+      "member",
+      "created_by_org_membership_id",
+    ).notNull(),
+    source: mysqlEnum("source", ["models_dev", "custom"]).notNull(),
+    providerId: varchar("provider_id", { length: 255 }).notNull(),
+    name: varchar("name", { length: 255 }).notNull(),
+    providerConfig: json("provider_config")
+      .$type<Record<string, unknown>>()
+      .notNull(),
+    apiKey: encryptedTextColumn("api_key"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("llm_provider_organization_id").on(table.organizationId),
+    index("llm_provider_created_by_org_membership_id").on(
+      table.createdByOrgMembershipId,
+    ),
+    index("llm_provider_source").on(table.source),
+    index("llm_provider_provider_id").on(table.providerId),
+  ],
+)
+
+export const LlmProviderModelTable = mysqlTable(
+  "llm_provider_model",
+  {
+    id: denTypeIdColumn("llmProviderModel", "id").notNull().primaryKey(),
+    llmProviderId: denTypeIdColumn("llmProvider", "llm_provider_id").notNull(),
+    modelId: varchar("model_id", { length: 255 }).notNull(),
+    name: varchar("name", { length: 255 }).notNull(),
+    modelConfig: json("model_config")
+      .$type<Record<string, unknown>>()
+      .notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("llm_provider_model_llm_provider_id").on(table.llmProviderId),
+    index("llm_provider_model_model_id").on(table.modelId),
+    uniqueIndex("llm_provider_model_provider_model").on(
+      table.llmProviderId,
+      table.modelId,
+    ),
+  ],
+)
+
+export const LlmProviderAccessTable = mysqlTable(
+  "llm_provider_access",
+  {
+    id: denTypeIdColumn("llmProviderAccess", "id").notNull().primaryKey(),
+    llmProviderId: denTypeIdColumn("llmProvider", "llm_provider_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("llm_provider_access_llm_provider_id").on(table.llmProviderId),
+    index("llm_provider_access_org_membership_id").on(table.orgMembershipId),
+    index("llm_provider_access_team_id").on(table.teamId),
+    uniqueIndex("llm_provider_access_provider_org_membership").on(
+      table.llmProviderId,
+      table.orgMembershipId,
+    ),
+    uniqueIndex("llm_provider_access_provider_team").on(
+      table.llmProviderId,
+      table.teamId,
+    ),
+  ],
+)
+
+export const llmProviderRelations = relations(LlmProviderTable, ({ many, one }) => ({
+  organization: one(OrganizationTable, {
+    fields: [LlmProviderTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [LlmProviderTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  models: many(LlmProviderModelTable),
+  accessLinks: many(LlmProviderAccessTable),
+}))
+
+export const llmProviderModelRelations = relations(
+  LlmProviderModelTable,
+  ({ one }) => ({
+    llmProvider: one(LlmProviderTable, {
+      fields: [LlmProviderModelTable.llmProviderId],
+      references: [LlmProviderTable.id],
+    }),
+  }),
+)
+
+export const llmProviderAccessRelations = relations(
+  LlmProviderAccessTable,
+  ({ one }) => ({
+    llmProvider: one(LlmProviderTable, {
+      fields: [LlmProviderAccessTable.llmProviderId],
+      references: [LlmProviderTable.id],
+    }),
+    orgMembership: one(MemberTable, {
+      fields: [LlmProviderAccessTable.orgMembershipId],
+      references: [MemberTable.id],
+    }),
+    team: one(TeamTable, {
+      fields: [LlmProviderAccessTable.teamId],
+      references: [TeamTable.id],
+    }),
+  }),
+)
+
+export const llmProvider = LlmProviderTable
+export const llmProviderModel = LlmProviderModelTable
+export const llmProviderAccess = LlmProviderAccessTable
diff --git a/ee/packages/den-db/src/schema/sharables/plugin-arch.ts b/ee/packages/den-db/src/schema/sharables/plugin-arch.ts
new file mode 100644
index 0000000000..183ae82a5b
--- /dev/null
+++ b/ee/packages/den-db/src/schema/sharables/plugin-arch.ts
@@ -0,0 +1,774 @@
+import { relations, sql } from "drizzle-orm"
+import {
+  boolean,
+  index,
+  json,
+  mysqlEnum,
+  mysqlTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  varchar,
+} from "drizzle-orm/mysql-core"
+import { denTypeIdColumn, encryptedColumn, encryptedTextColumn } from "../../columns"
+import { MemberTable, OrganizationTable } from "../org"
+import { TeamTable } from "../teams"
+
+export const configObjectTypeValues = ["skill", "agent", "command", "tool", "mcp", "hook", "context", "custom"] as const
+export const configObjectSourceModeValues = ["cloud", "import", "connector"] as const
+export const configObjectStatusValues = ["active", "inactive", "deleted", "archived", "ingestion_error"] as const
+export const configObjectCreatedViaValues = ["cloud", "import", "connector", "system"] as const
+export const pluginStatusValues = ["active", "inactive", "deleted", "archived"] as const
+export const marketplaceStatusValues = ["active", "inactive", "deleted", "archived"] as const
+export const membershipSourceValues = ["manual", "connector", "api", "system"] as const
+export const accessRoleValues = ["viewer", "editor", "manager"] as const
+export const connectorTypeValues = ["github"] as const
+export const connectorAccountStatusValues = ["active", "inactive", "disconnected", "error"] as const
+export const connectorInstanceStatusValues = ["active", "disabled", "archived", "error"] as const
+export const connectorTargetKindValues = ["repository_branch"] as const
+export const connectorMappingKindValues = ["path", "api", "custom"] as const
+export const connectorSyncEventTypeValues = ["push", "installation", "installation_repositories", "repository", "manual_resync"] as const
+export const connectorSyncStatusValues = ["pending", "queued", "running", "completed", "failed", "partial", "ignored"] as const
+
+function encryptedJsonColumn<TData extends Record<string, unknown> | Array<unknown> | null>(columnName: string) {
+  return encryptedColumn<TData>(columnName, {
+    deserialize: (value) => JSON.parse(value) as TData,
+    serialize: (value) => JSON.stringify(value),
+  })
+}
+
+export const ConfigObjectTable = mysqlTable(
+  "config_object",
+  {
+    id: denTypeIdColumn("configObject", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    objectType: mysqlEnum("object_type", configObjectTypeValues).notNull(),
+    sourceMode: mysqlEnum("source_mode", configObjectSourceModeValues).notNull(),
+    title: varchar("title", { length: 255 }).notNull(),
+    description: text("description"),
+    searchText: text("search_text"),
+    currentFileName: varchar("current_file_name", { length: 255 }),
+    currentFileExtension: varchar("current_file_extension", { length: 64 }),
+    currentRelativePath: varchar("current_relative_path", { length: 255 }),
+    status: mysqlEnum("status", configObjectStatusValues).notNull().default("active"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    deletedAt: timestamp("deleted_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("config_object_organization_id").on(table.organizationId),
+    index("config_object_type").on(table.objectType),
+    index("config_object_source_mode").on(table.sourceMode),
+    index("config_object_status").on(table.status),
+    index("config_object_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("config_object_connector_instance_id").on(table.connectorInstanceId),
+    index("config_object_current_relative_path").on(table.currentRelativePath),
+  ],
+)
+
+export const ConfigObjectVersionTable = mysqlTable(
+  "config_object_version",
+  {
+    id: denTypeIdColumn("configObjectVersion", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    configObjectId: denTypeIdColumn("configObject", "config_object_id").notNull(),
+    normalizedPayloadJson: encryptedJsonColumn<Record<string, unknown> | null>("normalized_payload_json"),
+    rawSourceText: encryptedTextColumn("raw_source_text"),
+    schemaVersion: varchar("schema_version", { length: 100 }),
+    createdVia: mysqlEnum("created_via", configObjectCreatedViaValues).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id"),
+    connectorSyncEventId: denTypeIdColumn("connectorSyncEvent", "connector_sync_event_id"),
+    sourceRevisionRef: varchar("source_revision_ref", { length: 255 }),
+    isDeletedVersion: boolean("is_deleted_version").notNull().default(false),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("config_object_version_organization_id").on(table.organizationId),
+    index("config_object_version_config_object_id").on(table.configObjectId),
+    index("config_object_version_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("config_object_version_connector_sync_event_id").on(table.connectorSyncEventId),
+    index("config_object_version_source_revision_ref").on(table.sourceRevisionRef),
+    index("config_object_version_lookup_latest").on(table.configObjectId, table.createdAt, table.id),
+  ],
+)
+
+export const PluginTable = mysqlTable(
+  "plugin",
+  {
+    id: denTypeIdColumn("plugin", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    name: varchar("name", { length: 255 }).notNull(),
+    description: text("description"),
+    status: mysqlEnum("status", pluginStatusValues).notNull().default("active"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    deletedAt: timestamp("deleted_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("plugin_organization_id").on(table.organizationId),
+    index("plugin_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("plugin_status").on(table.status),
+    index("plugin_name").on(table.name),
+  ],
+)
+
+export const MarketplaceTable = mysqlTable(
+  "marketplace",
+  {
+    id: denTypeIdColumn("marketplace", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    name: varchar("name", { length: 255 }).notNull(),
+    description: text("description"),
+    status: mysqlEnum("status", marketplaceStatusValues).notNull().default("active"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    deletedAt: timestamp("deleted_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("marketplace_organization_id").on(table.organizationId),
+    index("marketplace_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("marketplace_status").on(table.status),
+    index("marketplace_name").on(table.name),
+  ],
+)
+
+export const MarketplacePluginTable = mysqlTable(
+  "marketplace_plugin",
+  {
+    id: denTypeIdColumn("marketplacePlugin", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    marketplaceId: denTypeIdColumn("marketplace", "marketplace_id").notNull(),
+    pluginId: denTypeIdColumn("plugin", "plugin_id").notNull(),
+    membershipSource: mysqlEnum("membership_source", membershipSourceValues).notNull().default("manual"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("marketplace_plugin_organization_id").on(table.organizationId),
+    index("marketplace_plugin_marketplace_id").on(table.marketplaceId),
+    index("marketplace_plugin_plugin_id").on(table.pluginId),
+    uniqueIndex("marketplace_plugin_marketplace_plugin").on(table.marketplaceId, table.pluginId),
+  ],
+)
+
+export const MarketplaceAccessGrantTable = mysqlTable(
+  "marketplace_access_grant",
+  {
+    id: denTypeIdColumn("marketplaceAccessGrant", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    marketplaceId: denTypeIdColumn("marketplace", "marketplace_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    orgWide: boolean("org_wide").notNull().default(false),
+    role: mysqlEnum("role", accessRoleValues).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("marketplace_access_grant_organization_id").on(table.organizationId),
+    index("marketplace_access_grant_marketplace_id").on(table.marketplaceId),
+    index("marketplace_access_grant_org_membership_id").on(table.orgMembershipId),
+    index("marketplace_access_grant_team_id").on(table.teamId),
+    index("marketplace_access_grant_org_wide").on(table.orgWide),
+    uniqueIndex("marketplace_access_grant_marketplace_org_membership").on(table.marketplaceId, table.orgMembershipId),
+    uniqueIndex("marketplace_access_grant_marketplace_team").on(table.marketplaceId, table.teamId),
+  ],
+)
+
+export const PluginConfigObjectTable = mysqlTable(
+  "plugin_config_object",
+  {
+    id: denTypeIdColumn("pluginConfigObject", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    pluginId: denTypeIdColumn("plugin", "plugin_id").notNull(),
+    configObjectId: denTypeIdColumn("configObject", "config_object_id").notNull(),
+    membershipSource: mysqlEnum("membership_source", membershipSourceValues).notNull().default("manual"),
+    connectorMappingId: denTypeIdColumn("connectorMapping", "connector_mapping_id"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("plugin_config_object_organization_id").on(table.organizationId),
+    index("plugin_config_object_plugin_id").on(table.pluginId),
+    index("plugin_config_object_config_object_id").on(table.configObjectId),
+    index("plugin_config_object_connector_mapping_id").on(table.connectorMappingId),
+    uniqueIndex("plugin_config_object_plugin_config_object").on(table.pluginId, table.configObjectId),
+  ],
+)
+
+export const ConfigObjectAccessGrantTable = mysqlTable(
+  "config_object_access_grant",
+  {
+    id: denTypeIdColumn("configObjectAccessGrant", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    configObjectId: denTypeIdColumn("configObject", "config_object_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    orgWide: boolean("org_wide").notNull().default(false),
+    role: mysqlEnum("role", accessRoleValues).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("config_object_access_grant_organization_id").on(table.organizationId),
+    index("config_object_access_grant_config_object_id").on(table.configObjectId),
+    index("config_object_access_grant_org_membership_id").on(table.orgMembershipId),
+    index("config_object_access_grant_team_id").on(table.teamId),
+    index("config_object_access_grant_org_wide").on(table.orgWide),
+    uniqueIndex("config_object_access_grant_object_org_membership").on(table.configObjectId, table.orgMembershipId),
+    uniqueIndex("config_object_access_grant_object_team").on(table.configObjectId, table.teamId),
+  ],
+)
+
+export const PluginAccessGrantTable = mysqlTable(
+  "plugin_access_grant",
+  {
+    id: denTypeIdColumn("pluginAccessGrant", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    pluginId: denTypeIdColumn("plugin", "plugin_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    orgWide: boolean("org_wide").notNull().default(false),
+    role: mysqlEnum("role", accessRoleValues).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("plugin_access_grant_organization_id").on(table.organizationId),
+    index("plugin_access_grant_plugin_id").on(table.pluginId),
+    index("plugin_access_grant_org_membership_id").on(table.orgMembershipId),
+    index("plugin_access_grant_team_id").on(table.teamId),
+    index("plugin_access_grant_org_wide").on(table.orgWide),
+    uniqueIndex("plugin_access_grant_plugin_org_membership").on(table.pluginId, table.orgMembershipId),
+    uniqueIndex("plugin_access_grant_plugin_team").on(table.pluginId, table.teamId),
+  ],
+)
+
+export const ConnectorAccountTable = mysqlTable(
+  "connector_account",
+  {
+    id: denTypeIdColumn("connectorAccount", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }).notNull(),
+    externalAccountRef: varchar("external_account_ref", { length: 255 }),
+    displayName: varchar("display_name", { length: 255 }).notNull(),
+    status: mysqlEnum("status", connectorAccountStatusValues).notNull().default("active"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    metadataJson: json("metadata_json").$type<Record<string, unknown> | null>(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("connector_account_organization_id").on(table.organizationId),
+    index("connector_account_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("connector_account_connector_type").on(table.connectorType),
+    index("connector_account_status").on(table.status),
+    uniqueIndex("connector_account_org_type_remote_id").on(table.organizationId, table.connectorType, table.remoteId),
+  ],
+)
+
+export const ConnectorInstanceTable = mysqlTable(
+  "connector_instance",
+  {
+    id: denTypeIdColumn("connectorInstance", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorAccountId: denTypeIdColumn("connectorAccount", "connector_account_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }),
+    name: varchar("name", { length: 255 }).notNull(),
+    status: mysqlEnum("status", connectorInstanceStatusValues).notNull().default("active"),
+    instanceConfigJson: json("instance_config_json").$type<Record<string, unknown> | null>(),
+    lastSyncedAt: timestamp("last_synced_at", { fsp: 3 }),
+    lastSyncStatus: mysqlEnum("last_sync_status", connectorSyncStatusValues),
+    lastSyncCursor: text("last_sync_cursor"),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("connector_instance_organization_id").on(table.organizationId),
+    index("connector_instance_connector_account_id").on(table.connectorAccountId),
+    index("connector_instance_created_by_org_membership_id").on(table.createdByOrgMembershipId),
+    index("connector_instance_connector_type").on(table.connectorType),
+    index("connector_instance_status").on(table.status),
+    uniqueIndex("connector_instance_org_name").on(table.organizationId, table.name),
+  ],
+)
+
+export const ConnectorInstanceAccessGrantTable = mysqlTable(
+  "connector_instance_access_grant",
+  {
+    id: denTypeIdColumn("connectorInstanceAccessGrant", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+    teamId: denTypeIdColumn("team", "team_id"),
+    orgWide: boolean("org_wide").notNull().default(false),
+    role: mysqlEnum("role", accessRoleValues).notNull(),
+    createdByOrgMembershipId: denTypeIdColumn("member", "created_by_org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    removedAt: timestamp("removed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("connector_instance_access_grant_organization_id").on(table.organizationId),
+    index("connector_instance_access_grant_instance_id").on(table.connectorInstanceId),
+    index("connector_instance_access_grant_org_membership_id").on(table.orgMembershipId),
+    index("connector_instance_access_grant_team_id").on(table.teamId),
+    index("connector_instance_access_grant_org_wide").on(table.orgWide),
+    uniqueIndex("connector_instance_access_grant_instance_org_membership").on(table.connectorInstanceId, table.orgMembershipId),
+    uniqueIndex("connector_instance_access_grant_instance_team").on(table.connectorInstanceId, table.teamId),
+  ],
+)
+
+export const ConnectorTargetTable = mysqlTable(
+  "connector_target",
+  {
+    id: denTypeIdColumn("connectorTarget", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }).notNull(),
+    targetKind: mysqlEnum("target_kind", connectorTargetKindValues).notNull(),
+    externalTargetRef: varchar("external_target_ref", { length: 255 }),
+    targetConfigJson: json("target_config_json").$type<Record<string, unknown>>().notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("connector_target_organization_id").on(table.organizationId),
+    index("connector_target_connector_instance_id").on(table.connectorInstanceId),
+    index("connector_target_connector_type").on(table.connectorType),
+    index("connector_target_target_kind").on(table.targetKind),
+    uniqueIndex("connector_target_instance_remote_id").on(table.connectorInstanceId, table.remoteId),
+  ],
+)
+
+export const ConnectorMappingTable = mysqlTable(
+  "connector_mapping",
+  {
+    id: denTypeIdColumn("connectorMapping", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    connectorTargetId: denTypeIdColumn("connectorTarget", "connector_target_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }),
+    mappingKind: mysqlEnum("mapping_kind", connectorMappingKindValues).notNull(),
+    selector: varchar("selector", { length: 255 }).notNull(),
+    objectType: mysqlEnum("object_type", configObjectTypeValues).notNull(),
+    pluginId: denTypeIdColumn("plugin", "plugin_id"),
+    autoAddToPlugin: boolean("auto_add_to_plugin").notNull().default(false),
+    mappingConfigJson: json("mapping_config_json").$type<Record<string, unknown> | null>(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("connector_mapping_organization_id").on(table.organizationId),
+    index("connector_mapping_connector_instance_id").on(table.connectorInstanceId),
+    index("connector_mapping_connector_target_id").on(table.connectorTargetId),
+    index("connector_mapping_object_type").on(table.objectType),
+    index("connector_mapping_plugin_id").on(table.pluginId),
+    uniqueIndex("connector_mapping_target_selector_object_type").on(table.connectorTargetId, table.selector, table.objectType),
+  ],
+)
+
+export const ConnectorSyncEventTable = mysqlTable(
+  "connector_sync_event",
+  {
+    id: denTypeIdColumn("connectorSyncEvent", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    connectorTargetId: denTypeIdColumn("connectorTarget", "connector_target_id"),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }),
+    eventType: mysqlEnum("event_type", connectorSyncEventTypeValues).notNull(),
+    externalEventRef: varchar("external_event_ref", { length: 255 }),
+    sourceRevisionRef: varchar("source_revision_ref", { length: 255 }),
+    status: mysqlEnum("status", connectorSyncStatusValues).notNull().default("pending"),
+    summaryJson: json("summary_json").$type<Record<string, unknown> | null>(),
+    startedAt: timestamp("started_at", { fsp: 3 }).notNull().defaultNow(),
+    completedAt: timestamp("completed_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("connector_sync_event_organization_id").on(table.organizationId),
+    index("connector_sync_event_connector_instance_id").on(table.connectorInstanceId),
+    index("connector_sync_event_connector_target_id").on(table.connectorTargetId),
+    index("connector_sync_event_event_type").on(table.eventType),
+    index("connector_sync_event_status").on(table.status),
+    index("connector_sync_event_source_revision_ref").on(table.sourceRevisionRef),
+    index("connector_sync_event_external_event_ref").on(table.externalEventRef),
+  ],
+)
+
+export const ConnectorSourceBindingTable = mysqlTable(
+  "connector_source_binding",
+  {
+    id: denTypeIdColumn("connectorSourceBinding", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    configObjectId: denTypeIdColumn("configObject", "config_object_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    connectorTargetId: denTypeIdColumn("connectorTarget", "connector_target_id").notNull(),
+    connectorMappingId: denTypeIdColumn("connectorMapping", "connector_mapping_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }),
+    externalLocator: varchar("external_locator", { length: 255 }).notNull(),
+    externalStableRef: varchar("external_stable_ref", { length: 255 }),
+    lastSeenSourceRevisionRef: varchar("last_seen_source_revision_ref", { length: 255 }),
+    status: mysqlEnum("status", configObjectStatusValues).notNull().default("active"),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 }).notNull().default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    deletedAt: timestamp("deleted_at", { fsp: 3 }),
+  },
+  (table) => [
+    index("connector_source_binding_organization_id").on(table.organizationId),
+    index("connector_source_binding_config_object_id").on(table.configObjectId),
+    index("connector_source_binding_connector_instance_id").on(table.connectorInstanceId),
+    index("connector_source_binding_connector_target_id").on(table.connectorTargetId),
+    index("connector_source_binding_connector_mapping_id").on(table.connectorMappingId),
+    index("connector_source_binding_external_locator").on(table.externalLocator),
+    uniqueIndex("connector_source_binding_config_object").on(table.configObjectId),
+  ],
+)
+
+export const ConnectorSourceTombstoneTable = mysqlTable(
+  "connector_source_tombstone",
+  {
+    id: denTypeIdColumn("connectorSourceTombstone", "id").notNull().primaryKey(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    connectorInstanceId: denTypeIdColumn("connectorInstance", "connector_instance_id").notNull(),
+    connectorTargetId: denTypeIdColumn("connectorTarget", "connector_target_id").notNull(),
+    connectorMappingId: denTypeIdColumn("connectorMapping", "connector_mapping_id").notNull(),
+    connectorType: mysqlEnum("connector_type", connectorTypeValues).notNull(),
+    remoteId: varchar("remote_id", { length: 255 }),
+    externalLocator: varchar("external_locator", { length: 255 }).notNull(),
+    formerConfigObjectId: denTypeIdColumn("configObject", "former_config_object_id").notNull(),
+    deletedInSyncEventId: denTypeIdColumn("connectorSyncEvent", "deleted_in_sync_event_id").notNull(),
+    deletedSourceRevisionRef: varchar("deleted_source_revision_ref", { length: 255 }),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("connector_source_tombstone_organization_id").on(table.organizationId),
+    index("connector_source_tombstone_connector_instance_id").on(table.connectorInstanceId),
+    index("connector_source_tombstone_connector_target_id").on(table.connectorTargetId),
+    index("connector_source_tombstone_connector_mapping_id").on(table.connectorMappingId),
+    index("connector_source_tombstone_external_locator").on(table.externalLocator),
+    index("connector_source_tombstone_former_config_object_id").on(table.formerConfigObjectId),
+  ],
+)
+
+export const configObjectRelations = relations(ConfigObjectTable, ({ many, one }) => ({
+  accessGrants: many(ConfigObjectAccessGrantTable),
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConfigObjectTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConfigObjectTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  memberships: many(PluginConfigObjectTable),
+  organization: one(OrganizationTable, {
+    fields: [ConfigObjectTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+  sourceBindings: many(ConnectorSourceBindingTable),
+  versions: many(ConfigObjectVersionTable),
+}))
+
+export const configObjectVersionRelations = relations(ConfigObjectVersionTable, ({ one }) => ({
+  configObject: one(ConfigObjectTable, {
+    fields: [ConfigObjectVersionTable.configObjectId],
+    references: [ConfigObjectTable.id],
+  }),
+  connectorSyncEvent: one(ConnectorSyncEventTable, {
+    fields: [ConfigObjectVersionTable.connectorSyncEventId],
+    references: [ConnectorSyncEventTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConfigObjectVersionTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+}))
+
+export const pluginRelations = relations(PluginTable, ({ many, one }) => ({
+  accessGrants: many(PluginAccessGrantTable),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [PluginTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  marketplaces: many(MarketplacePluginTable),
+  memberships: many(PluginConfigObjectTable),
+  organization: one(OrganizationTable, {
+    fields: [PluginTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+  mappings: many(ConnectorMappingTable),
+}))
+
+export const marketplaceRelations = relations(MarketplaceTable, ({ many, one }) => ({
+  accessGrants: many(MarketplaceAccessGrantTable),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [MarketplaceTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  memberships: many(MarketplacePluginTable),
+  organization: one(OrganizationTable, {
+    fields: [MarketplaceTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+}))
+
+export const marketplacePluginRelations = relations(MarketplacePluginTable, ({ one }) => ({
+  createdByOrgMembership: one(MemberTable, {
+    fields: [MarketplacePluginTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  marketplace: one(MarketplaceTable, {
+    fields: [MarketplacePluginTable.marketplaceId],
+    references: [MarketplaceTable.id],
+  }),
+  plugin: one(PluginTable, {
+    fields: [MarketplacePluginTable.pluginId],
+    references: [PluginTable.id],
+  }),
+}))
+
+export const marketplaceAccessGrantRelations = relations(MarketplaceAccessGrantTable, ({ one }) => ({
+  createdByOrgMembership: one(MemberTable, {
+    fields: [MarketplaceAccessGrantTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  marketplace: one(MarketplaceTable, {
+    fields: [MarketplaceAccessGrantTable.marketplaceId],
+    references: [MarketplaceTable.id],
+  }),
+  orgMembership: one(MemberTable, {
+    fields: [MarketplaceAccessGrantTable.orgMembershipId],
+    references: [MemberTable.id],
+  }),
+  team: one(TeamTable, {
+    fields: [MarketplaceAccessGrantTable.teamId],
+    references: [TeamTable.id],
+  }),
+}))
+
+export const pluginConfigObjectRelations = relations(PluginConfigObjectTable, ({ one }) => ({
+  configObject: one(ConfigObjectTable, {
+    fields: [PluginConfigObjectTable.configObjectId],
+    references: [ConfigObjectTable.id],
+  }),
+  connectorMapping: one(ConnectorMappingTable, {
+    fields: [PluginConfigObjectTable.connectorMappingId],
+    references: [ConnectorMappingTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [PluginConfigObjectTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  plugin: one(PluginTable, {
+    fields: [PluginConfigObjectTable.pluginId],
+    references: [PluginTable.id],
+  }),
+}))
+
+export const configObjectAccessGrantRelations = relations(ConfigObjectAccessGrantTable, ({ one }) => ({
+  configObject: one(ConfigObjectTable, {
+    fields: [ConfigObjectAccessGrantTable.configObjectId],
+    references: [ConfigObjectTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConfigObjectAccessGrantTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  orgMembership: one(MemberTable, {
+    fields: [ConfigObjectAccessGrantTable.orgMembershipId],
+    references: [MemberTable.id],
+  }),
+  team: one(TeamTable, {
+    fields: [ConfigObjectAccessGrantTable.teamId],
+    references: [TeamTable.id],
+  }),
+}))
+
+export const pluginAccessGrantRelations = relations(PluginAccessGrantTable, ({ one }) => ({
+  createdByOrgMembership: one(MemberTable, {
+    fields: [PluginAccessGrantTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  orgMembership: one(MemberTable, {
+    fields: [PluginAccessGrantTable.orgMembershipId],
+    references: [MemberTable.id],
+  }),
+  plugin: one(PluginTable, {
+    fields: [PluginAccessGrantTable.pluginId],
+    references: [PluginTable.id],
+  }),
+  team: one(TeamTable, {
+    fields: [PluginAccessGrantTable.teamId],
+    references: [TeamTable.id],
+  }),
+}))
+
+export const connectorAccountRelations = relations(ConnectorAccountTable, ({ many, one }) => ({
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConnectorAccountTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  instances: many(ConnectorInstanceTable),
+  organization: one(OrganizationTable, {
+    fields: [ConnectorAccountTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+}))
+
+export const connectorInstanceRelations = relations(ConnectorInstanceTable, ({ many, one }) => ({
+  accessGrants: many(ConnectorInstanceAccessGrantTable),
+  account: one(ConnectorAccountTable, {
+    fields: [ConnectorInstanceTable.connectorAccountId],
+    references: [ConnectorAccountTable.id],
+  }),
+  configObjects: many(ConfigObjectTable),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConnectorInstanceTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  mappings: many(ConnectorMappingTable),
+  organization: one(OrganizationTable, {
+    fields: [ConnectorInstanceTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+  sourceBindings: many(ConnectorSourceBindingTable),
+  syncEvents: many(ConnectorSyncEventTable),
+  targets: many(ConnectorTargetTable),
+  tombstones: many(ConnectorSourceTombstoneTable),
+}))
+
+export const connectorInstanceAccessGrantRelations = relations(ConnectorInstanceAccessGrantTable, ({ one }) => ({
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorInstanceAccessGrantTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  createdByOrgMembership: one(MemberTable, {
+    fields: [ConnectorInstanceAccessGrantTable.createdByOrgMembershipId],
+    references: [MemberTable.id],
+  }),
+  orgMembership: one(MemberTable, {
+    fields: [ConnectorInstanceAccessGrantTable.orgMembershipId],
+    references: [MemberTable.id],
+  }),
+  team: one(TeamTable, {
+    fields: [ConnectorInstanceAccessGrantTable.teamId],
+    references: [TeamTable.id],
+  }),
+}))
+
+export const connectorTargetRelations = relations(ConnectorTargetTable, ({ many, one }) => ({
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorTargetTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  mappings: many(ConnectorMappingTable),
+  sourceBindings: many(ConnectorSourceBindingTable),
+  syncEvents: many(ConnectorSyncEventTable),
+  tombstones: many(ConnectorSourceTombstoneTable),
+}))
+
+export const connectorMappingRelations = relations(ConnectorMappingTable, ({ many, one }) => ({
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorMappingTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  connectorTarget: one(ConnectorTargetTable, {
+    fields: [ConnectorMappingTable.connectorTargetId],
+    references: [ConnectorTargetTable.id],
+  }),
+  plugin: one(PluginTable, {
+    fields: [ConnectorMappingTable.pluginId],
+    references: [PluginTable.id],
+  }),
+  pluginMemberships: many(PluginConfigObjectTable),
+  sourceBindings: many(ConnectorSourceBindingTable),
+  tombstones: many(ConnectorSourceTombstoneTable),
+}))
+
+export const connectorSyncEventRelations = relations(ConnectorSyncEventTable, ({ many, one }) => ({
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorSyncEventTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  connectorTarget: one(ConnectorTargetTable, {
+    fields: [ConnectorSyncEventTable.connectorTargetId],
+    references: [ConnectorTargetTable.id],
+  }),
+  tombstones: many(ConnectorSourceTombstoneTable),
+  versions: many(ConfigObjectVersionTable),
+}))
+
+export const connectorSourceBindingRelations = relations(ConnectorSourceBindingTable, ({ one }) => ({
+  configObject: one(ConfigObjectTable, {
+    fields: [ConnectorSourceBindingTable.configObjectId],
+    references: [ConfigObjectTable.id],
+  }),
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorSourceBindingTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  connectorMapping: one(ConnectorMappingTable, {
+    fields: [ConnectorSourceBindingTable.connectorMappingId],
+    references: [ConnectorMappingTable.id],
+  }),
+  connectorTarget: one(ConnectorTargetTable, {
+    fields: [ConnectorSourceBindingTable.connectorTargetId],
+    references: [ConnectorTargetTable.id],
+  }),
+}))
+
+export const connectorSourceTombstoneRelations = relations(ConnectorSourceTombstoneTable, ({ one }) => ({
+  connectorInstance: one(ConnectorInstanceTable, {
+    fields: [ConnectorSourceTombstoneTable.connectorInstanceId],
+    references: [ConnectorInstanceTable.id],
+  }),
+  connectorMapping: one(ConnectorMappingTable, {
+    fields: [ConnectorSourceTombstoneTable.connectorMappingId],
+    references: [ConnectorMappingTable.id],
+  }),
+  connectorTarget: one(ConnectorTargetTable, {
+    fields: [ConnectorSourceTombstoneTable.connectorTargetId],
+    references: [ConnectorTargetTable.id],
+  }),
+  deletedInSyncEvent: one(ConnectorSyncEventTable, {
+    fields: [ConnectorSourceTombstoneTable.deletedInSyncEventId],
+    references: [ConnectorSyncEventTable.id],
+  }),
+  formerConfigObject: one(ConfigObjectTable, {
+    fields: [ConnectorSourceTombstoneTable.formerConfigObjectId],
+    references: [ConfigObjectTable.id],
+  }),
+}))
+
+export const configObject = ConfigObjectTable
+export const configObjectVersion = ConfigObjectVersionTable
+export const plugin = PluginTable
+export const marketplace = MarketplaceTable
+export const marketplacePlugin = MarketplacePluginTable
+export const marketplaceAccessGrant = MarketplaceAccessGrantTable
+export const pluginConfigObject = PluginConfigObjectTable
+export const configObjectAccessGrant = ConfigObjectAccessGrantTable
+export const pluginAccessGrant = PluginAccessGrantTable
+export const connectorAccount = ConnectorAccountTable
+export const connectorInstance = ConnectorInstanceTable
+export const connectorInstanceAccessGrant = ConnectorInstanceAccessGrantTable
+export const connectorTarget = ConnectorTargetTable
+export const connectorMapping = ConnectorMappingTable
+export const connectorSyncEvent = ConnectorSyncEventTable
+export const connectorSourceBinding = ConnectorSourceBindingTable
+export const connectorSourceTombstone = ConnectorSourceTombstoneTable
diff --git a/ee/packages/den-db/src/schema/sharables/skills.ts b/ee/packages/den-db/src/schema/sharables/skills.ts
new file mode 100644
index 0000000000..f9a6cf3fdf
--- /dev/null
+++ b/ee/packages/den-db/src/schema/sharables/skills.ts
@@ -0,0 +1,182 @@
+import { relations, sql } from "drizzle-orm";
+import {
+    index,
+    mysqlEnum,
+    mysqlTable,
+    text,
+    timestamp,
+    uniqueIndex,
+    varchar,
+} from "drizzle-orm/mysql-core";
+import { denTypeIdColumn } from "../../columns";
+import { MemberTable, OrganizationTable } from "../org";
+import { TeamTable } from "../teams";
+
+export const SkillTable = mysqlTable(
+    "skill",
+    {
+        id: denTypeIdColumn("skill", "id").notNull().primaryKey(),
+        organizationId: denTypeIdColumn(
+            "organization",
+            "organization_id",
+        ).notNull(),
+        createdByOrgMembershipId: denTypeIdColumn(
+            "member",
+            "created_by_org_membership_id",
+        ).notNull(),
+        title: varchar("title", { length: 255 }).notNull(),
+        description: text("description"),
+        skillText: text("skill_text").notNull(),
+        shared: mysqlEnum("shared", ["org", "public"]),
+        createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+        updatedAt: timestamp("updated_at", { fsp: 3 })
+            .notNull()
+            .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    },
+    (table) => [
+        index("skill_organization_id").on(table.organizationId),
+        index("skill_created_by_org_membership_id").on(
+            table.createdByOrgMembershipId,
+        ),
+        index("skill_shared").on(table.shared),
+    ],
+);
+
+export const SkillHubTable = mysqlTable(
+    "skill_hub",
+    {
+        id: denTypeIdColumn("skillHub", "id").notNull().primaryKey(),
+        organizationId: denTypeIdColumn(
+            "organization",
+            "organization_id",
+        ).notNull(),
+        createdByOrgMembershipId: denTypeIdColumn(
+            "member",
+            "created_by_org_membership_id",
+        ).notNull(),
+        name: varchar("name", { length: 255 }).notNull(),
+        description: text("description"),
+        createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+        updatedAt: timestamp("updated_at", { fsp: 3 })
+            .notNull()
+            .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+    },
+    (table) => [
+        index("skill_hub_organization_id").on(table.organizationId),
+        index("skill_hub_created_by_org_membership_id").on(
+            table.createdByOrgMembershipId,
+        ),
+    ],
+);
+
+export const SkillHubSkillTable = mysqlTable(
+    "skill_hub_skill",
+    {
+        id: denTypeIdColumn("skillHubSkill", "id").notNull().primaryKey(),
+        skillHubId: denTypeIdColumn("skillHub", "skill_hub_id").notNull(),
+        skillId: denTypeIdColumn("skill", "skill_id").notNull(),
+        addedByOrgMembershipId: denTypeIdColumn(
+            "member",
+            "org_membership_id",
+        ).notNull(),
+        createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    },
+    (table) => [
+        index("skill_hub_skill_skill_hub_id").on(table.skillHubId),
+        index("skill_hub_skill_skill_id").on(table.skillId),
+        uniqueIndex("skill_hub_skill_hub_skill").on(
+            table.skillHubId,
+            table.skillId,
+        ),
+    ],
+);
+
+export const SkillHubMemberTable = mysqlTable(
+    "skill_hub_member",
+    {
+        id: denTypeIdColumn("skillHubMember", "id").notNull().primaryKey(),
+        skillHubId: denTypeIdColumn("skillHub", "skill_hub_id").notNull(),
+        orgMembershipId: denTypeIdColumn("member", "org_membership_id"),
+        teamId: denTypeIdColumn("team", "team_id"),
+        createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    },
+    (table) => [
+        index("skill_hub_member_skill_hub_id").on(table.skillHubId),
+        index("skill_hub_member_org_membership_id").on(table.orgMembershipId),
+        index("skill_hub_member_team_id").on(table.teamId),
+        uniqueIndex("skill_hub_member_hub_org_membership").on(
+            table.skillHubId,
+            table.orgMembershipId,
+        ),
+        uniqueIndex("skill_hub_member_hub_team").on(
+            table.skillHubId,
+            table.teamId,
+        ),
+    ],
+);
+
+export const skillRelations = relations(SkillTable, ({ many, one }) => ({
+    organization: one(OrganizationTable, {
+        fields: [SkillTable.organizationId],
+        references: [OrganizationTable.id],
+    }),
+    createdByOrgMembership: one(MemberTable, {
+        fields: [SkillTable.createdByOrgMembershipId],
+        references: [MemberTable.id],
+    }),
+    skillHubLinks: many(SkillHubSkillTable),
+}));
+
+export const skillHubRelations = relations(SkillHubTable, ({ many, one }) => ({
+    organization: one(OrganizationTable, {
+        fields: [SkillHubTable.organizationId],
+        references: [OrganizationTable.id],
+    }),
+    createdByOrgMembership: one(MemberTable, {
+        fields: [SkillHubTable.createdByOrgMembershipId],
+        references: [MemberTable.id],
+    }),
+    skillLinks: many(SkillHubSkillTable),
+    memberLinks: many(SkillHubMemberTable),
+}));
+
+export const skillHubSkillRelations = relations(
+    SkillHubSkillTable,
+    ({ one }) => ({
+        skillHub: one(SkillHubTable, {
+            fields: [SkillHubSkillTable.skillHubId],
+            references: [SkillHubTable.id],
+        }),
+        skill: one(SkillTable, {
+            fields: [SkillHubSkillTable.skillId],
+            references: [SkillTable.id],
+        }),
+        addedByOrgMembership: one(MemberTable, {
+            fields: [SkillHubSkillTable.addedByOrgMembershipId],
+            references: [MemberTable.id],
+        }),
+    }),
+);
+
+export const skillHubMemberRelations = relations(
+    SkillHubMemberTable,
+    ({ one }) => ({
+        skillHub: one(SkillHubTable, {
+            fields: [SkillHubMemberTable.skillHubId],
+            references: [SkillHubTable.id],
+        }),
+        orgMembership: one(MemberTable, {
+            fields: [SkillHubMemberTable.orgMembershipId],
+            references: [MemberTable.id],
+        }),
+        team: one(TeamTable, {
+            fields: [SkillHubMemberTable.teamId],
+            references: [TeamTable.id],
+        }),
+    }),
+);
+
+export const skill = SkillTable;
+export const skillHub = SkillHubTable;
+export const skillHubSkill = SkillHubSkillTable;
+export const skillHubMember = SkillHubMemberTable;
diff --git a/ee/packages/den-db/src/schema/system.ts b/ee/packages/den-db/src/schema/system.ts
new file mode 100644
index 0000000000..9855211b6b
--- /dev/null
+++ b/ee/packages/den-db/src/schema/system.ts
@@ -0,0 +1,26 @@
+import { bigint, int, mysqlTable, uniqueIndex, varchar } from "drizzle-orm/mysql-core"
+import { denTypeIdColumn, timestamps } from "../columns"
+
+export const RateLimitTable = mysqlTable(
+  "rate_limit",
+  {
+    id: denTypeIdColumn("rateLimit", "id").notNull().primaryKey(),
+    key: varchar("key", { length: 512 }).notNull(),
+    count: int("count").notNull().default(0),
+    lastRequest: bigint("last_request", { mode: "number" }).notNull(),
+  },
+  (table) => [uniqueIndex("rate_limit_key").on(table.key)],
+)
+
+export const AdminAllowlistTable = mysqlTable(
+  "admin_allowlist",
+  {
+    id: denTypeIdColumn("adminAllowlist", "id").notNull().primaryKey(),
+    email: varchar("email", { length: 255 }).notNull(),
+    note: varchar("note", { length: 255 }),
+    ...timestamps,
+  },
+  (table) => [uniqueIndex("admin_allowlist_email").on(table.email)],
+)
+
+export const rateLimit = RateLimitTable
diff --git a/ee/packages/den-db/src/schema/teams.ts b/ee/packages/den-db/src/schema/teams.ts
new file mode 100644
index 0000000000..0f1424405c
--- /dev/null
+++ b/ee/packages/den-db/src/schema/teams.ts
@@ -0,0 +1,58 @@
+import { relations, sql } from "drizzle-orm"
+import { index, mysqlTable, timestamp, uniqueIndex, varchar } from "drizzle-orm/mysql-core"
+import { denTypeIdColumn } from "../columns"
+import { MemberTable, OrganizationTable } from "./org"
+
+export const TeamTable = mysqlTable(
+  "team",
+  {
+    id: denTypeIdColumn("team", "id").notNull().primaryKey(),
+    name: varchar("name", { length: 255 }).notNull(),
+    organizationId: denTypeIdColumn("organization", "organization_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { fsp: 3 })
+      .notNull()
+      .default(sql`CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)`),
+  },
+  (table) => [
+    index("team_organization_id").on(table.organizationId),
+    uniqueIndex("team_organization_name").on(table.organizationId, table.name),
+  ],
+)
+
+export const TeamMemberTable = mysqlTable(
+  "team_member",
+  {
+    id: denTypeIdColumn("teamMember", "id").notNull().primaryKey(),
+    teamId: denTypeIdColumn("team", "team_id").notNull(),
+    orgMembershipId: denTypeIdColumn("member", "org_membership_id").notNull(),
+    createdAt: timestamp("created_at", { fsp: 3 }).notNull().defaultNow(),
+  },
+  (table) => [
+    index("team_member_team_id").on(table.teamId),
+    index("team_member_org_membership_id").on(table.orgMembershipId),
+    uniqueIndex("team_member_team_org_membership").on(table.teamId, table.orgMembershipId),
+  ],
+)
+
+export const teamRelations = relations(TeamTable, ({ many, one }) => ({
+  organization: one(OrganizationTable, {
+    fields: [TeamTable.organizationId],
+    references: [OrganizationTable.id],
+  }),
+  memberships: many(TeamMemberTable),
+}))
+
+export const teamMemberRelations = relations(TeamMemberTable, ({ one }) => ({
+  team: one(TeamTable, {
+    fields: [TeamMemberTable.teamId],
+    references: [TeamTable.id],
+  }),
+  orgMembership: one(MemberTable, {
+    fields: [TeamMemberTable.orgMembershipId],
+    references: [MemberTable.id],
+  }),
+}))
+
+export const team = TeamTable
+export const teamMember = TeamMemberTable
diff --git a/ee/packages/den-db/src/schema/workers.ts b/ee/packages/den-db/src/schema/workers.ts
new file mode 100644
index 0000000000..a807ca8d85
--- /dev/null
+++ b/ee/packages/den-db/src/schema/workers.ts
@@ -0,0 +1,104 @@
+import { index, json, mysqlEnum, mysqlTable, timestamp, uniqueIndex, varchar } from "drizzle-orm/mysql-core"
+import { denTypeIdColumn, timestamps } from "../columns"
+
+export const WorkerDestination = ["local", "cloud"] as const
+export const WorkerStatus = ["provisioning", "healthy", "failed", "stopped"] as const
+export const TokenScope = ["client", "host", "activity"] as const
+
+export const WorkerTable = mysqlTable(
+  "worker",
+  {
+    id: denTypeIdColumn("worker", "id").notNull().primaryKey(),
+    org_id: denTypeIdColumn("org", "org_id").notNull(),
+    created_by_user_id: denTypeIdColumn("user", "created_by_user_id"),
+    name: varchar("name", { length: 255 }).notNull(),
+    description: varchar("description", { length: 1024 }),
+    destination: mysqlEnum("destination", WorkerDestination).notNull(),
+    status: mysqlEnum("status", WorkerStatus).notNull(),
+    image_version: varchar("image_version", { length: 128 }),
+    workspace_path: varchar("workspace_path", { length: 1024 }),
+    sandbox_backend: varchar("sandbox_backend", { length: 64 }),
+    last_heartbeat_at: timestamp("last_heartbeat_at", { fsp: 3 }),
+    last_active_at: timestamp("last_active_at", { fsp: 3 }),
+    ...timestamps,
+  },
+  (table) => [
+    index("worker_org_id").on(table.org_id),
+    index("worker_created_by_user_id").on(table.created_by_user_id),
+    index("worker_status").on(table.status),
+    index("worker_last_heartbeat_at").on(table.last_heartbeat_at),
+    index("worker_last_active_at").on(table.last_active_at),
+  ],
+)
+
+export const WorkerInstanceTable = mysqlTable(
+  "worker_instance",
+  {
+    id: denTypeIdColumn("workerInstance", "id").notNull().primaryKey(),
+    worker_id: denTypeIdColumn("worker", "worker_id").notNull(),
+    provider: varchar("provider", { length: 64 }).notNull(),
+    region: varchar("region", { length: 64 }),
+    url: varchar("url", { length: 2048 }).notNull(),
+    status: mysqlEnum("status", WorkerStatus).notNull(),
+    ...timestamps,
+  },
+  (table) => [index("worker_instance_worker_id").on(table.worker_id)],
+)
+
+export const DaytonaSandboxTable = mysqlTable(
+  "daytona_sandbox",
+  {
+    id: denTypeIdColumn("daytonaSandbox", "id").notNull().primaryKey(),
+    worker_id: denTypeIdColumn("worker", "worker_id").notNull(),
+    sandbox_id: varchar("sandbox_id", { length: 128 }).notNull(),
+    workspace_volume_id: varchar("workspace_volume_id", { length: 128 }).notNull(),
+    data_volume_id: varchar("data_volume_id", { length: 128 }).notNull(),
+    signed_preview_url: varchar("signed_preview_url", { length: 2048 }).notNull(),
+    signed_preview_url_expires_at: timestamp("signed_preview_url_expires_at", { fsp: 3 }).notNull(),
+    region: varchar("region", { length: 64 }),
+    ...timestamps,
+  },
+  (table) => [
+    uniqueIndex("daytona_sandbox_worker_id").on(table.worker_id),
+    uniqueIndex("daytona_sandbox_sandbox_id").on(table.sandbox_id),
+  ],
+)
+
+export const WorkerTokenTable = mysqlTable(
+  "worker_token",
+  {
+    id: denTypeIdColumn("workerToken", "id").notNull().primaryKey(),
+    worker_id: denTypeIdColumn("worker", "worker_id").notNull(),
+    scope: mysqlEnum("scope", TokenScope).notNull(),
+    token: varchar("token", { length: 128 }).notNull(),
+    created_at: timestamps.created_at,
+    revoked_at: timestamp("revoked_at", { fsp: 3 }),
+  },
+  (table) => [index("worker_token_worker_id").on(table.worker_id), uniqueIndex("worker_token_token").on(table.token)],
+)
+
+export const WorkerBundleTable = mysqlTable(
+  "worker_bundle",
+  {
+    id: denTypeIdColumn("workerBundle", "id").notNull().primaryKey(),
+    worker_id: denTypeIdColumn("worker", "worker_id").notNull(),
+    storage_url: varchar("storage_url", { length: 2048 }).notNull(),
+    status: varchar("status", { length: 64 }).notNull(),
+    created_at: timestamps.created_at,
+  },
+  (table) => [index("worker_bundle_worker_id").on(table.worker_id)],
+)
+
+export const AuditEventTable = mysqlTable(
+  "audit_event",
+  {
+    id: denTypeIdColumn("auditEvent", "id").notNull().primaryKey(),
+    org_id: denTypeIdColumn("org", "org_id").notNull(),
+    worker_id: denTypeIdColumn("worker", "worker_id"),
+    actor_user_id: denTypeIdColumn("user", "actor_user_id").notNull(),
+    action: varchar("action", { length: 128 }).notNull(),
+    payload: json("payload"),
+    created_at: timestamps.created_at,
+  },
+  (table) => [index("audit_event_org_id").on(table.org_id), index("audit_event_worker_id").on(table.worker_id)],
+)
diff --git a/ee/packages/den-db/tsconfig.json b/ee/packages/den-db/tsconfig.json
new file mode 100644
index 0000000000..850ef6bbe6
--- /dev/null
+++ b/ee/packages/den-db/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src"]
+}
diff --git a/ee/packages/den-db/tsup.config.ts b/ee/packages/den-db/tsup.config.ts
new file mode 100644
index 0000000000..8652a82cec
--- /dev/null
+++ b/ee/packages/den-db/tsup.config.ts
@@ -0,0 +1,23 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: {
+    index: "src/index.ts",
+    schema: "src/schema.ts",
+    "schema/auth": "src/schema/auth.ts",
+    "schema/org": "src/schema/org.ts",
+    "schema/sharables/skills": "src/schema/sharables/skills.ts",
+    "schema/teams": "src/schema/teams.ts",
+    "schema/workers": "src/schema/workers.ts",
+    "schema/system": "src/schema/system.ts",
+    drizzle: "src/drizzle.ts",
+  },
+  format: ["esm"],
+  dts: true,
+  clean: true,
+  target: "es2022",
+  platform: "node",
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+})
diff --git a/ee/packages/utils/package.json b/ee/packages/utils/package.json
new file mode 100644
index 0000000000..9ff94c1563
--- /dev/null
+++ b/ee/packages/utils/package.json
@@ -0,0 +1,35 @@
+{
+  "name": "@openwork-ee/utils",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./src/index.ts",
+  "source": "./src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "development": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./typeid": {
+      "types": "./src/typeid.ts",
+      "development": "./src/typeid.ts",
+      "default": "./dist/typeid.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "luxon": "^3.6.1",
+    "typeid-js": "^1.2.0",
+    "uuid": "^11.1.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/luxon": "^3.6.2",
+    "@types/node": "^20.11.30",
+    "tsup": "^8.5.0",
+    "typescript": "^5.5.4"
+  }
+}
diff --git a/ee/packages/utils/src/index.ts b/ee/packages/utils/src/index.ts
new file mode 100644
index 0000000000..a2ee8741c4
--- /dev/null
+++ b/ee/packages/utils/src/index.ts
@@ -0,0 +1,2 @@
+export * from "./typeid"
+export * from "./skill-markdown"
diff --git a/ee/packages/utils/src/skill-markdown.ts b/ee/packages/utils/src/skill-markdown.ts
new file mode 100644
index 0000000000..0bdb4a5172
--- /dev/null
+++ b/ee/packages/utils/src/skill-markdown.ts
@@ -0,0 +1,180 @@
+export type ParsedSkillMarkdown = {
+  name: string
+  description: string
+  body: string
+  hasFrontmatter: boolean
+}
+
+const SKILL_FRONTMATTER_PATTERN = /^---\n([\s\S]*?)\n---\n?/
+
+function normalizeSkillText(content: string): string {
+  return String(content ?? "").replace(/^\uFEFF/, "").replace(/\r\n/g, "\n")
+}
+
+function normalizeFrontmatterValue(value: string | undefined): string {
+  const normalized = String(value ?? "").trim()
+  if (!normalized) {
+    return ""
+  }
+
+  if (normalized.startsWith('"') && normalized.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(normalized)
+      return typeof parsed === "string" ? parsed.trim() : normalized
+    } catch {
+      return normalized.slice(1, -1).trim()
+    }
+  }
+
+  if (normalized.startsWith("'") && normalized.endsWith("'")) {
+    return normalized.slice(1, -1).trim()
+  }
+
+  return normalized
+}
+
+function foldYamlBlockLines(lines: string[], mode: "literal" | "folded"): string {
+  const normalized = lines.map((line) => line.replace(/[ \t]+$/g, ""))
+  if (mode === "literal") {
+    return normalized.join("\n").trim()
+  }
+
+  const folded: string[] = []
+  let paragraph: string[] = []
+
+  const flushParagraph = () => {
+    if (paragraph.length === 0) {
+      return
+    }
+    folded.push(paragraph.join(" "))
+    paragraph = []
+  }
+
+  for (const line of normalized) {
+    if (!line.trim()) {
+      flushParagraph()
+      if (folded.length === 0 || folded[folded.length - 1] !== "") {
+        folded.push("")
+      }
+      continue
+    }
+    paragraph.push(line.trim())
+  }
+
+  flushParagraph()
+  return folded.join("\n").trim()
+}
+
+function parseFrontmatter(header: string): Record<string, string> {
+  const data: Record<string, string> = {}
+  const lines = header.split("\n")
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? ""
+    const trimmed = line.trim()
+    if (!trimmed) {
+      continue
+    }
+
+    const match = line.match(/^([A-Za-z0-9_-]+)\s*:\s*(.*)$/)
+    if (!match) {
+      continue
+    }
+
+    const key = match[1]?.trim().toLowerCase()
+    if (!key) {
+      continue
+    }
+
+    const rawValue = (match[2] ?? "").trimEnd()
+    const blockScalarMatch = rawValue.match(/^([>|])[-+0-9]*$/)
+
+    if (blockScalarMatch) {
+      const mode = blockScalarMatch[1] === ">" ? "folded" : "literal"
+      const blockLines: string[] = []
+      let blockIndent: number | null = null
+      let nextIndex = index + 1
+
+      for (; nextIndex < lines.length; nextIndex += 1) {
+        const nextLine = lines[nextIndex] ?? ""
+        const nextTrimmed = nextLine.trim()
+        if (!nextTrimmed) {
+          blockLines.push("")
+          continue
+        }
+
+        const indent = nextLine.match(/^(\s*)/)?.[1]?.length ?? 0
+        if (blockIndent === null) {
+          if (indent === 0) {
+            break
+          }
+          blockIndent = indent
+        }
+
+        if (indent < blockIndent) {
+          break
+        }
+
+        blockLines.push(nextLine.slice(blockIndent))
+      }
+
+      data[key] = foldYamlBlockLines(blockLines, mode)
+      index = nextIndex - 1
+      continue
+    }
+
+    data[key] = normalizeFrontmatterValue(rawValue)
+  }
+
+  return data
+}
+
+export function yamlValue(value: string): string {
+  const normalized = String(value ?? "").trim()
+  if (/^[A-Za-z0-9._/\- ]+$/.test(normalized) && normalized && !normalized.includes(":")) {
+    return normalized
+  }
+  return JSON.stringify(normalized)
+}
+
+export function parseSkillMarkdown(content: string): ParsedSkillMarkdown {
+  const text = normalizeSkillText(content)
+  const match = text.match(SKILL_FRONTMATTER_PATTERN)
+  if (!match) {
+    return {
+      name: "",
+      description: "",
+      body: text,
+      hasFrontmatter: false,
+    }
+  }
+
+  const header = match[1] ?? ""
+  const data = parseFrontmatter(header)
+
+  return {
+    name: normalizeFrontmatterValue(data.name),
+    description: normalizeFrontmatterValue(data.description),
+    body: text.slice(match[0].length),
+    hasFrontmatter: true,
+  }
+}
+
+export function hasSkillFrontmatterName(content: string): boolean {
+  const parsed = parseSkillMarkdown(content)
+  return parsed.hasFrontmatter && Boolean(parsed.name.trim())
+}
+
+export function composeSkillMarkdown(name: string, description: string, body: string): string {
+  const normalizedName = String(name ?? "").trim()
+  const normalizedDescription = String(description ?? "").trim()
+  const normalizedBody = normalizeSkillText(body).trim()
+  const frontmatter = [
+    "---",
+    `name: ${yamlValue(normalizedName)}`,
+    ...(normalizedDescription ? [`description: ${yamlValue(normalizedDescription)}`] : []),
+    "---",
+  ].join("\n")
+
+  return normalizedBody ? `${frontmatter}\n\n${normalizedBody}\n` : `${frontmatter}\n`
+}
diff --git a/ee/packages/utils/src/typeid.ts b/ee/packages/utils/src/typeid.ts
new file mode 100644
index 0000000000..919fcd5622
--- /dev/null
+++ b/ee/packages/utils/src/typeid.ts
@@ -0,0 +1,224 @@
+import { DateTime } from "luxon"
+import { TypeID, typeid } from "typeid-js"
+import { v7 as uuidv7 } from "uuid"
+import { z } from "zod"
+
+export const TYPE_ID_SUFFIX_LENGTH = 26
+
+const BASE32_REGEX = /^[0-9a-hjkmnp-tv-z]+$/
+
+export const idTypesMapNameToPrefix = {
+  request: "req",
+  user: "usr",
+  session: "ses",
+  account: "acc",
+  verification: "ver",
+  apiKey: "apk",
+  oauthClient: "oac",
+  oauthAccessToken: "oat",
+  oauthRefreshToken: "ort",
+  oauthConsent: "oco",
+  rateLimit: "rli",
+  org: "org",
+  organization: "org",
+  orgMembership: "om",
+  member: "om",
+  invitation: "inv",
+  team: "tem",
+  teamMember: "tmb",
+  skill: "skl",
+  skillHub: "shb",
+  skillHubSkill: "shs",
+  skillHubMember: "shm",
+  configObject: "cob",
+  configObjectVersion: "cov",
+  configObjectAccessGrant: "coa",
+  plugin: "plg",
+  pluginConfigObject: "pco",
+  pluginAccessGrant: "pag",
+  marketplace: "mkt",
+  marketplacePlugin: "mkp",
+  marketplaceAccessGrant: "mag",
+  connectorAccount: "cac",
+  connectorInstance: "cin",
+  connectorInstanceAccessGrant: "cia",
+  connectorTarget: "ctg",
+  connectorMapping: "cmp",
+  connectorSyncEvent: "cse",
+  connectorSourceBinding: "csb",
+  connectorSourceTombstone: "cst",
+  llmProvider: "lpr",
+  llmProviderModel: "lpm",
+  llmProviderAccess: "lpa",
+  organizationRole: "orl",
+  adminAllowlist: "aal",
+  worker: "wrk",
+  workerInstance: "wki",
+  daytonaSandbox: "dts",
+  workerToken: "wkt",
+  workerBundle: "wkb",
+  auditEvent: "aev",
+} as const
+
+export const denTypeIdPrefixes = idTypesMapNameToPrefix
+
+type IdTypesMapNameToPrefix = typeof idTypesMapNameToPrefix
+type IdTypesMapPrefixToName = {
+  [K in keyof IdTypesMapNameToPrefix as IdTypesMapNameToPrefix[K]]: K
+}
+
+const idTypesMapPrefixToName = Object.fromEntries(
+  Object.entries(idTypesMapNameToPrefix).map(([name, prefix]) => [prefix, name]),
+) as IdTypesMapPrefixToName
+
+export type IdTypePrefixNames = keyof typeof idTypesMapNameToPrefix
+export type DenTypeIdName = IdTypePrefixNames
+export type TypeId<T extends IdTypePrefixNames> = `${IdTypesMapNameToPrefix[T]}_${string}`
+export type DenTypeId<TName extends DenTypeIdName> = TypeId<TName>
+
+type TypeIdSchema<T extends IdTypePrefixNames> = z.ZodType<TypeId<T>, string>
+
+const schemaCache = new Map<IdTypePrefixNames, z.ZodType<string, string>>()
+
+const buildTypeIdSchema = <const T extends IdTypePrefixNames>(prefix: T): TypeIdSchema<T> => {
+  const expectedPrefix = idTypesMapNameToPrefix[prefix]
+  const expectedLength = TYPE_ID_SUFFIX_LENGTH + expectedPrefix.length + 1
+
+  return z
+    .string()
+    .length(expectedLength, {
+      message: `TypeID must be ${expectedLength} characters (${expectedPrefix}_<26 char suffix>)`,
+    })
+    .startsWith(`${expectedPrefix}_`, {
+      message: `TypeID must start with '${expectedPrefix}_'`,
+    })
+    .refine(
+      (input) => {
+        const suffix = input.slice(expectedPrefix.length + 1)
+        return BASE32_REGEX.test(suffix)
+      },
+      { message: "TypeID suffix contains invalid base32 characters" },
+    )
+    .refine(
+      (input) => {
+        try {
+          TypeID.fromString(input)
+          return true
+        } catch {
+          return false
+        }
+      },
+      { message: "TypeID is structurally invalid" },
+    )
+    .transform((input) => TypeID.fromString(input).toString() as TypeId<T>)
+}
+
+const typeIdZodSchema = <const T extends IdTypePrefixNames>(prefix: T): TypeIdSchema<T> => {
+  let schema = schemaCache.get(prefix)
+  if (!schema) {
+    schema = buildTypeIdSchema(prefix)
+    schemaCache.set(prefix, schema)
+  }
+  return schema as TypeIdSchema<T>
+}
+
+const typeIdGenerator = <const T extends IdTypePrefixNames>(
+  prefix: T,
+) => typeid(idTypesMapNameToPrefix[prefix]).toString() as TypeId<T>
+
+const validateTypeId = <const T extends IdTypePrefixNames>(
+  prefix: T,
+  data: unknown,
+): data is TypeId<T> => typeIdZodSchema(prefix).safeParse(data).success
+
+const inferTypeId = <T extends keyof IdTypesMapPrefixToName>(
+  input: `${T}_${string}`,
+): IdTypesMapPrefixToName[T] => {
+  const parsed = TypeID.fromString(input)
+  const prefix = parsed.getType() as T
+  const typeName = idTypesMapPrefixToName[prefix]
+
+  if (typeName === undefined) {
+    throw new Error(
+      `Unknown TypeID prefix '${prefix}'. Registered prefixes: ${Object.keys(idTypesMapPrefixToName).join(", ")}`,
+    )
+  }
+
+  return typeName
+}
+
+const typeIdFromString = <const T extends IdTypePrefixNames>(
+  typeName: T,
+  input: string,
+): TypeId<T> => {
+  const parsed = TypeID.fromString(input)
+  const expectedPrefix = idTypesMapNameToPrefix[typeName]
+  const actualPrefix = parsed.getType()
+
+  if (actualPrefix !== expectedPrefix) {
+    throw new Error(
+      `TypeID prefix mismatch: expected '${expectedPrefix}' but got '${actualPrefix}'`,
+    )
+  }
+
+  return parsed.toString() as TypeId<T>
+}
+
+const typeIdWithTimestamp = <const T extends IdTypePrefixNames>(
+  typeName: T,
+  timestamp?: Date | number,
+): TypeId<T> => {
+  let msecs: number
+
+  if (timestamp === undefined) {
+    msecs = DateTime.now().toMillis()
+  } else if (timestamp instanceof Date) {
+    msecs = timestamp.getTime()
+  } else {
+    msecs = timestamp
+  }
+
+  if (!Number.isFinite(msecs)) {
+    throw new Error(`Invalid timestamp: expected finite number, got ${msecs}`)
+  }
+  if (msecs < 0) {
+    throw new Error(`Invalid timestamp: expected non-negative number, got ${msecs}`)
+  }
+
+  const uuid = uuidv7({ msecs })
+  const prefix = idTypesMapNameToPrefix[typeName]
+  return TypeID.fromUUID(prefix, uuid).toString() as TypeId<T>
+}
+
+const getColumnLength = <const T extends IdTypePrefixNames>(typeName: T) =>
+  idTypesMapNameToPrefix[typeName].length + 1 + TYPE_ID_SUFFIX_LENGTH
+
+export const typeId = {
+  schema: typeIdZodSchema,
+  generator: typeIdGenerator,
+  generatorWithTimestamp: typeIdWithTimestamp,
+  validator: validateTypeId,
+  infer: inferTypeId,
+  fromString: typeIdFromString,
+  suffixLength: TYPE_ID_SUFFIX_LENGTH,
+  prefix: idTypesMapNameToPrefix,
+  columnLength: getColumnLength,
+}
+
+export function createDenTypeId<TName extends DenTypeIdName>(name: TName): DenTypeId<TName> {
+  return typeId.generator(name)
+}
+
+export function normalizeDenTypeId<TName extends DenTypeIdName>(
+  name: TName,
+  value: string,
+): DenTypeId<TName> {
+  return typeId.fromString(name, value)
+}
+
+export function isDenTypeId<TName extends DenTypeIdName>(
+  name: TName,
+  value: unknown,
+): value is DenTypeId<TName> {
+  return typeId.validator(name, value)
+}
diff --git a/ee/packages/utils/tsconfig.json b/ee/packages/utils/tsconfig.json
new file mode 100644
index 0000000000..850ef6bbe6
--- /dev/null
+++ b/ee/packages/utils/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src"]
+}
diff --git a/ee/packages/utils/tsup.config.ts b/ee/packages/utils/tsup.config.ts
new file mode 100644
index 0000000000..37660715a2
--- /dev/null
+++ b/ee/packages/utils/tsup.config.ts
@@ -0,0 +1,16 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: {
+    index: "src/index.ts",
+    typeid: "src/typeid.ts",
+  },
+  format: ["esm"],
+  dts: true,
+  clean: true,
+  target: "es2022",
+  platform: "node",
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+})
diff --git a/evals/README.md b/evals/README.md
new file mode 100644
index 0000000000..b73fccf800
--- /dev/null
+++ b/evals/README.md
@@ -0,0 +1,48 @@
+# OpenWork UI evals
+
+Human-readable scenarios that an LLM (or a person) can replay against a live
+OpenWork instance to verify end-to-end behavior of the UI.
+
+Each eval is:
+- A short list of steps written in plain English.
+- An **expected outcome** with observable signals.
+- The most useful Chrome DevTools MCP calls to drive it.
+
+They are not unit tests. They intentionally exercise the running stack
+(OpenCode + OpenWork server + React UI) so regressions in wiring — not just
+types — get caught.
+
+## How to run
+
+1. Start the narrowest supported local app/server stack for the flow under test.
+   Use its web URL and avoid hard-coding default ports unless that stack documents them.
+
+2. Pick a runner:
+   - **Chrome DevTools MCP** (recommended). The tool names referenced in each
+     flow are the `chrome-devtools_*` tools from the Chrome DevTools MCP
+     server. Open the printed web URL in a fresh page via
+     `chrome-devtools_new_page` and drive from there.
+   - **Manual browser** — open the URL and follow the step lists by hand.
+
+3. Walk each eval top-to-bottom. Only mark ✅ when every expected signal is
+   visible. Capture a screenshot with `chrome-devtools_take_screenshot` if you
+   want evidence.
+
+4. Stop the stack using the teardown command for the stack you started.
+
+## Conventions
+
+- Selectors in the steps are descriptive, not CSS. Resolve them via
+  `chrome-devtools_take_snapshot` and click by `uid`.
+- When asked to "wait for X", use `chrome-devtools_wait_for` with the exact
+  visible text. Keep the text short and unique.
+- If a step expects a connected provider and the stack shows none, note it
+  as an environment limitation, not an eval failure.
+
+## Files
+
+- [`react-session-flows.md`](./react-session-flows.md) — the 9 core
+  session/settings flows verified during the React port cutover.
+- [`onboarding-welcome-flows.md`](./onboarding-welcome-flows.md) — the 7
+  onboarding/welcome flows covering first-run experience and folder
+  explanation.
diff --git a/evals/onboarding-welcome-flows.md b/evals/onboarding-welcome-flows.md
new file mode 100644
index 0000000000..a1b77fa38e
--- /dev/null
+++ b/evals/onboarding-welcome-flows.md
@@ -0,0 +1,274 @@
+# Onboarding / welcome flows
+
+End-to-end scenarios that cover the first-run onboarding experience
+introduced in `feat/onboarding-welcome`. Run them before shipping any
+change that touches:
+
+- `apps/app/src/react-app/domains/onboarding/**`
+- `apps/app/src/react-app/shell/welcome-route.tsx`
+- `apps/app/src/react-app/shell/app-root.tsx` (route table)
+- `apps/app/src/react-app/domains/workspace/create-workspace-local-panel.tsx`
+- `apps/app/src/react-app/kernel/local-provider.tsx` (`hasCompletedOnboarding`)
+- `apps/app/src/react-app/shell/session-route.tsx` (redirect to `/welcome`)
+
+## Preflight
+
+Before running any eval:
+
+1. Reset onboarding state so the welcome screen appears:
+   - Open DevTools console and run:
+     ```js
+     const raw = localStorage.getItem("openwork.preferences");
+     const prefs = raw ? JSON.parse(raw) : {};
+     prefs.hasCompletedOnboarding = false;
+     localStorage.setItem("openwork.preferences", JSON.stringify(prefs));
+     location.reload();
+     ```
+   - Alternatively: use the "Reset onboarding" button in Settings > Recovery
+     (debug mode).
+
+2. Remove all workspaces so the app detects `workspaces.length === 0`:
+   - This can be done via the sidebar "Remove workspace" menu for each
+     workspace, or by clearing app state entirely.
+
+3. Reload the app. It should redirect to `/welcome`.
+
+---
+
+## Flow 20 — Welcome screen renders on first launch
+
+**Why**: When a user opens OpenWork for the first time with zero
+workspaces and `hasCompletedOnboarding === false`, they must see the
+full-screen welcome page — not the session empty state.
+
+Steps:
+1. Ensure preflight conditions are met (no workspaces, onboarding not
+   completed).
+2. Navigate to `/` or `/session`.
+3. Expect: URL redirects to `/welcome`.
+4. Expect: full-screen page renders with:
+   - "Welcome to OpenWork" heading.
+   - "Your computer, but it works for you." subtitle.
+   - Six capability cards: spreadsheets, browser, files, automate,
+     content, APIs.
+   - A "Get started" button.
+5. No sidebar, no session chrome, no loading overlay.
+
+Tool recipe:
+```
+chrome-devtools_take_snapshot
+```
+
+Pass criteria:
+- URL is `/welcome`.
+- Heading "Welcome to OpenWork" is visible.
+- All six capability cards are present.
+- "Get started" button is visible and clickable.
+- No sidebar or session layout is rendered.
+
+Known regressions this catches:
+- Missing `/welcome` route in `app-root.tsx`.
+- Redirect logic in `session-route.tsx` not firing because `loading`
+  never becomes false.
+- `hasCompletedOnboarding` not defaulting to `false` for new installs.
+
+---
+
+## Flow 21 — Get started opens workspace creation modal
+
+**Why**: The "Get started" button is the single CTA on the welcome
+page. It must open the `CreateWorkspaceModal` with the chooser screen
+(local / remote / cloud).
+
+Steps:
+1. From `/welcome`, click "Get started".
+2. Expect: the `CreateWorkspaceModal` overlay appears.
+3. Expect: the modal shows three option cards:
+   - "Local workspace"
+   - "Connect custom remote"
+   - "Shared workspaces"
+4. Click the close button (X).
+5. Expect: modal closes, welcome page is still visible.
+
+Tool recipe:
+```
+chrome-devtools_take_snapshot
+chrome-devtools_click { uid: <Get started button> }
+chrome-devtools_take_snapshot
+chrome-devtools_click { uid: <Close modal button> }
+chrome-devtools_take_snapshot
+```
+
+Pass criteria:
+- Modal opens on "Get started" click.
+- All three workspace type options are visible.
+- Closing the modal returns to the welcome page (stays on `/welcome`).
+
+Known regressions this catches:
+- `CreateWorkspaceModal` not rendering because `open` prop isn't wired.
+- Modal z-index too low, hidden behind the welcome page.
+
+---
+
+## Flow 22 — Local workspace creation from welcome flow
+
+**Why**: The most common first-run path: pick a local folder and
+create a workspace. After creation, onboarding must be marked complete
+and the user lands on `/settings/general`.
+
+Steps:
+1. From `/welcome`, click "Get started".
+2. Click "Local workspace".
+3. Expect: the local panel shows:
+   - "Pick a folder" heading.
+   - Explanation text: "This folder becomes your workspace. OpenWork
+     will be able to:"
+   - Three bullet points with check icons (read, write, anything).
+   - "Drop files in anytime..." hint.
+   - Folder picker input (empty).
+   - "Select folder" button.
+4. Click "Select folder" and choose a folder.
+5. Click "Create Workspace".
+6. Expect: workspace is created; URL changes to `/settings/general`.
+7. Navigate to `/welcome`.
+8. Expect: URL redirects back to `/session` (not `/welcome`), because
+   `hasCompletedOnboarding` is now true.
+
+Tool recipe:
+```
+chrome-devtools_take_snapshot
+chrome-devtools_click { uid: <Get started> }
+chrome-devtools_click { uid: <Local workspace card> }
+chrome-devtools_take_snapshot
+-- verify folder explanation content --
+chrome-devtools_click { uid: <Select folder> }
+-- native picker interaction --
+chrome-devtools_click { uid: <Create Workspace> }
+chrome-devtools_wait_for { text: ["Settings"], timeout: 15000 }
+chrome-devtools_take_snapshot
+```
+
+Pass criteria:
+- Folder explanation (bullets, hint) is visible before picking.
+- After workspace creation, URL is `/settings/general`.
+- Navigating to `/welcome` redirects away (onboarding flagged done).
+- `localStorage` contains `hasCompletedOnboarding: true` in
+  `openwork.preferences`.
+
+Known regressions this catches:
+- `hasCompletedOnboarding` not persisted after local workspace creation.
+- Folder explanation i18n keys missing or untranslated.
+- Welcome route not checking `hasCompletedOnboarding` on mount.
+
+---
+
+## Flow 23 — Folder explanation visible in local workspace panel
+
+**Why**: The folder explanation must appear every time the local
+workspace panel opens — not just from the welcome flow. Users creating
+a second workspace from the session sidebar should also see it.
+
+Steps:
+1. From an existing session (at least one workspace exists), click
+   "Add workspace" in the sidebar.
+2. Click "Local workspace".
+3. Expect: the same folder explanation is visible:
+   - "Pick a folder" title.
+   - "This folder becomes your workspace..." explanation.
+   - Three check-mark bullet points.
+   - "Drop files in anytime..." hint.
+
+Pass criteria:
+- Folder explanation is present in the local panel regardless of entry
+  point (welcome flow or session sidebar).
+- No layout shift or broken spacing.
+
+Known regressions this catches:
+- Explanation conditionally rendered only during onboarding.
+- i18n keys only loaded in the welcome route context.
+
+---
+
+## Flow 24 — Remote workspace creation from welcome flow
+
+**Why**: Users connecting to a remote OpenWork server from the welcome
+flow should also have onboarding marked complete.
+
+Steps:
+1. From `/welcome`, click "Get started".
+2. Click "Connect custom remote".
+3. Enter a valid OpenWork server URL.
+4. Click "Connect remote".
+5. Expect: workspace connects; URL changes away from `/welcome`.
+6. Navigate to `/welcome`.
+7. Expect: URL redirects to `/session`.
+
+Pass criteria:
+- `hasCompletedOnboarding` is set to true after remote workspace
+  creation.
+- `/welcome` is no longer accessible after onboarding.
+
+---
+
+## Flow 25 — Welcome screen skipped when workspaces exist
+
+**Why**: If a user already has workspaces, the welcome screen must
+never appear — even if `hasCompletedOnboarding` is false (e.g., after
+a migration from a pre-onboarding version).
+
+Steps:
+1. Ensure at least one workspace exists.
+2. Set `hasCompletedOnboarding` to false in localStorage.
+3. Navigate to `/session`.
+4. Expect: the session page renders normally. No redirect to
+   `/welcome`.
+
+Tool recipe:
+```
+chrome-devtools_evaluate_script {
+  function: "() => {
+    const raw = localStorage.getItem('openwork.preferences');
+    const prefs = raw ? JSON.parse(raw) : {};
+    prefs.hasCompletedOnboarding = false;
+    localStorage.setItem('openwork.preferences', JSON.stringify(prefs));
+    return 'done';
+  }"
+}
+chrome-devtools_navigate_page { type: "url", url: "<base>/session" }
+chrome-devtools_take_snapshot
+```
+
+Pass criteria:
+- URL stays at `/session` (no redirect to `/welcome`).
+- Session page renders normally with the existing workspace.
+
+Known regressions this catches:
+- Redirect logic only checks `hasCompletedOnboarding` without also
+  checking `workspaces.length === 0`.
+
+---
+
+## Flow 26 — Reset onboarding restores welcome screen
+
+**Why**: The debug "Reset onboarding" button should clear the flag
+so developers and testers can re-trigger the welcome flow.
+
+Steps:
+1. Go to Settings > Recovery (debug).
+2. Click "Reset onboarding".
+3. Remove all workspaces.
+4. Reload the app.
+5. Expect: URL redirects to `/welcome` and the full welcome screen
+   renders.
+
+Pass criteria:
+- After reset + removing workspaces + reload, the welcome screen
+  appears.
+- This confirms `hasCompletedOnboarding` was cleared.
+
+---
+
+## Change log
+
+- 2026-04-29 — initial doc for the onboarding welcome feature
+  (Flows 20-26).
diff --git a/evals/react-session-flows.md b/evals/react-session-flows.md
new file mode 100644
index 0000000000..b9798e8c22
--- /dev/null
+++ b/evals/react-session-flows.md
@@ -0,0 +1,540 @@
+# React session flows
+
+End-to-end scenarios that cover the most important UI behaviors introduced
+during the React port cutover. Run them before shipping any change that touches:
+
+- `apps/app/src/react-app/shell/session-route.tsx`
+- `apps/app/src/react-app/shell/settings-route.tsx`
+- `apps/app/src/react-app/domains/session/**`
+- `apps/app/src/react-app/domains/settings/**`
+- OpenWork server proxy endpoints for `/w/:workspaceId/opencode/session/**`
+
+## Preflight
+
+Before running any eval:
+
+1. Install dependencies in the OpenWork repo:
+   ```bash
+   pnpm install --frozen-lockfile
+   ```
+2. Start the Electron dev app:
+   ```bash
+   nohup pnpm dev:electron > .openwork-run/electron.log 2>&1 &
+   ```
+   Wait ~15s for Vite + Electron to boot. The log will show
+   `[openwork] Electron CDP exposed at http://127.0.0.1:9823` when ready.
+3. Chrome MCP automatically connects to the Electron renderer via CDP on
+   port 9823. Verify by taking a snapshot:
+   ```
+   chrome-devtools_take_snapshot
+   ```
+   You should see the full OpenWork UI tree (sidebar, composer, footer).
+4. Confirm the footer shows **"OpenWork Ready"**.
+5. Check the JS console for errors with
+   `chrome-devtools_list_console_messages { types: ["error"] }`. It must be
+   empty of `Maximum update depth exceeded` warnings. Any of those means the
+   settings route has a re-render loop and every other eval below will be
+   unreliable.
+
+### Why Electron + Chrome MCP
+
+The Electron app exposes a Chrome DevTools Protocol endpoint that Chrome MCP
+connects to directly. This gives full access to the accessibility tree
+(`take_snapshot`), DOM interaction (`click`, `type_text`, `fill`), network
+inspection, and console messages — without needing Docker or a separate
+browser window. It tests the real desktop app, not a web-only build.
+
+### Paste testing note
+
+CDP keyboard commands (`press_key Meta+V`) do not trigger real clipboard
+paste events in Electron. To test paste flows (Flow 15), use osascript:
+```bash
+pbcopy <<'CLIP'
+<multi-line text here>
+CLIP
+osascript \
+  -e 'tell application "System Events" to tell process "Electron" to set frontmost to true' \
+  -e 'delay 0.3' \
+  -e 'tell application "System Events" to keystroke "v" using command down'
+```
+
+---
+
+## Flow 1 — Send a message and observe streaming
+
+**Why**: Streaming uses `ReactSessionRuntime` to subscribe to the OpenCode
+event stream and populate the transcript cache. If the subscription isn't
+mounted, prompts still submit but the UI shows empty responses until reload.
+
+Steps:
+1. Hover the workspace header in the sidebar → click **New task**.
+2. Expect: URL becomes `/session/ses_*`, main area heading is **"New session"**.
+3. Fill the composer: `"Count from 1 to 5, one number per line with a short sentence about each."`
+4. Click **Run task**.
+5. Expect: within ~1s, the user bubble appears in the transcript; within
+   ~3–5s the assistant bubble appears and text progressively fills in.
+
+Tool recipe:
+```
+chrome-devtools_take_snapshot
+chrome-devtools_click { uid: <New task button> }
+chrome-devtools_click { uid: <composer textbox> }
+chrome-devtools_type_text { text: "Count from 1 to 5..." }
+chrome-devtools_click { uid: <Run task> }
+chrome-devtools_wait_for { text: ["Ready"], timeout: 30000 }
+chrome-devtools_take_snapshot
+```
+
+Pass criteria:
+- The user message renders immediately (not after reload).
+- The assistant message renders progressively and becomes non-empty.
+- Status bar transitions `Running...` → `Ready`.
+
+Known regressions this catches:
+- Missing `<ReactSessionRuntime />` mount in `session-route.tsx`.
+- Transcript query keyed on a workspace/session id that doesn't match what
+  the runtime publishes to.
+
+---
+
+## Flow 2 — Add a new session
+
+Steps:
+1. Hover the workspace header.
+2. Click **New task**.
+
+Pass criteria:
+- URL changes to `/session/ses_*`.
+- Sidebar shows a new **"New session"** entry above existing sessions.
+- Main area renders the composer with **"No transcript yet."**.
+- Composer model label is whatever is saved as default (e.g.
+  `opencode/minimax-m2.5-free`).
+
+Known regressions this catches:
+- `onCreateTaskInWorkspace` silently failing because the route has no
+  OpenCode client.
+- Created session not landing in the sidebar list (sidebar not refreshed
+  after create).
+
+---
+
+## Flow 3 — Remove / Flow 8 — Delete a session
+
+Steps:
+1. Select the session you want to delete in the sidebar.
+2. Click the **Session actions** (overflow `…`) button on the selected row.
+3. Click **Delete session** in the popover.
+4. Confirm in the dialog by clicking **Delete**.
+
+Pass criteria:
+- The dialog closes.
+- The session is removed from the sidebar.
+- URL returns to `/session` (no session id).
+- The main area shows the `session.select_or_create_session` empty state.
+
+Known regressions this catches:
+- `onDeleteSession` not wired → menu has no Delete entry.
+- Missing server-side `client.deleteSession(workspaceId, sessionId)` call.
+- Sidebar not refreshed after delete.
+
+---
+
+## Flow 4 — Rename a session
+
+Steps:
+1. Select a session.
+2. Click **Session actions** → **Rename session**.
+3. In the modal, replace the current name with `"Counting helper"`.
+4. Click **Save**.
+
+Pass criteria:
+- Modal closes.
+- Sidebar label updates to the new name.
+- Main-area heading updates to the new name.
+
+Known regressions this catches:
+- `onRenameSession` not wired → menu has no Rename entry.
+- Missing call to `opencodeClient.session.update({ sessionID, title })`.
+- Local state not refreshed, so only the server knows the new title until
+  reload.
+
+---
+
+## Flow 5 — Open Connect Providers modal
+
+Steps:
+1. Click the **Settings** button in the session footer.
+2. On the General tab, click **Connect provider**.
+
+Pass criteria:
+- Modal **"Connect providers"** opens.
+- It lists at least OpenAI, Anthropic, Github Copilot, Gitlab.
+- Closing the modal with **Close** returns focus to the General tab without
+  navigating the route.
+
+Known regressions this catches:
+- Provider auth store never initialized → modal empty or stuck on spinner.
+- Infinite render loop making the modal immediately close itself.
+
+---
+
+## Flow 6 — Select a new default model
+
+Steps:
+1. On the General tab click **Change** (under "Model").
+2. In the picker, search or scroll to a model in an already-connected
+   provider (e.g. `opencode/minimax-m2.5-free`).
+3. Click the model card.
+
+Pass criteria:
+- Modal closes.
+- Under "Model" the label changes from `session.default_model` (or the
+  previous model) to the new model id.
+- If you open a new session afterward, the composer's model label reflects
+  the new default.
+
+Known regressions this catches:
+- Missing wiring of `ModelPickerModal`.
+- Model list empty because `opencodeClient.config.providers` call was not
+  made or was filtered too aggressively.
+- Infinite loop caused by `refreshProviders()` inside a `useEffect` whose
+  deps include `providerConnectedIds` (see changelog in
+  `84286ebe fix(react-app/settings): break infinite loop…`).
+
+---
+
+## Flow 7 — Toggle thinking mode (Show model reasoning)
+
+Steps:
+1. On the General tab, click the **Off/On** button next to "Show model
+   reasoning".
+
+Pass criteria:
+- Button state flips (Off → On or On → Off) instantly without a spinner.
+- Reloading the page preserves the new state.
+
+Known regressions this catches:
+- `local.prefs.showThinking` not persisted to IndexedDB / localStorage.
+
+---
+
+## Flow 9 — Navigate every settings tab, close, then create a session
+
+This is the full navigation smoke test. If any tab content fails to render
+it's almost always the infinite-render loop (tab button highlights but body
+stays on General).
+
+Steps:
+1. From `/session`, click the footer **Settings** button. URL becomes
+   `/settings/general`.
+2. Click each workspace tab in order:
+   `Settings → Skills → Extensions → Messaging → Advanced`.
+3. Click each global tab in order:
+   `Cloud → Appearance → Updates → Recovery`.
+4. Click the **X Close settings** button in the header.
+5. Back on `/session`, hover workspace → click **New task**.
+
+Pass criteria for each tab click:
+- URL updates to `/settings/<tab>`.
+- Heading (level 1 *and* level 2) updates to the tab name.
+- Tab body content matches the tab (e.g. Skills shows hub list,
+  Extensions shows integrations, Advanced shows runtime status, etc.).
+- Close settings returns to `/session` and re-renders the session shell,
+  not a stale settings DOM.
+
+Known regressions this catches:
+- Infinite render loop — the URL updates but body stays on General.
+- `Routes key={location.pathname}` accidentally reintroduced, which
+  unmounts/remounts routes and breaks fast transitions.
+- Tab click dispatches but `parseSettingsPath` returns `general` because it
+  doesn't recognize new segments.
+
+---
+
+---
+
+## Flow 10 — Keyboard: Cmd+N creates a new session
+
+**Why**: `Cmd/Ctrl+N` is the direct shortcut to create a session in the
+currently selected workspace (distinct from `Cmd+K` which opens the palette).
+
+Steps:
+1. From the session view with a workspace selected, press `Cmd+N` (macOS) or
+   `Ctrl+N` (elsewhere) while focus is **not** in the composer.
+
+Pass criteria:
+- URL changes to `/session/ses_*`.
+- New "New session" row appears at the top of the sidebar.
+- Composer is visible and ready.
+
+Known regressions this catches:
+- Shortcut handler missing from `session-route.tsx`.
+- Handler short-circuited because focus was on an `<input>` / contentEditable.
+
+---
+
+## Flow 11 — Command palette (Cmd+K)
+
+**Why**: The palette is the cross-surface quick switcher — create sessions,
+jump between workspaces/sessions, and open settings without leaving
+keyboard context.
+
+Steps:
+1. Press `Cmd+K` (or `Ctrl+K`).
+2. Expect: overlay appears with "Create new session", "Search sessions",
+   "Settings", plus an input at the top and the hint
+   "Arrow keys to navigate · Enter to run · Esc to close".
+3. Press `ArrowDown`, then `Enter`, to enter the **Sessions** sub-mode.
+4. Expect: flat list of every session in every workspace, active workspace
+   first. Each row shows session title, workspace title, and a
+   `CURRENT WORKSPACE` / `SWITCH` badge.
+5. Press `Esc`. Expect: sub-mode returns to root (not fully closed).
+6. Press `Esc` again. Expect: overlay closes.
+
+Pass criteria:
+- Palette opens on `Cmd+K`, closes on `Cmd+K` or `Esc`.
+- "Create new session" → creates a session in the selected workspace and
+  closes the palette.
+- "Search sessions" row → swaps to sessions mode.
+- "Settings" row → navigates to `/settings/general` and closes.
+
+Known regressions this catches:
+- Palette missing from the port (we hit this once: the Solid palette in
+  `apps/app/src/app/session/react-session-command-palette*.tsx` had been
+  deleted with the Solid tree and never re-ported).
+- `Cmd+K` bound to the wrong handler (e.g. browser default "search").
+- Sessions list empty because `workspaceSessionGroups` isn't wired.
+
+---
+
+## Flow 12 — Workspace options menu (Edit name / Share / Reveal / Remove)
+
+**Why**: The workspace row in the sidebar has an overflow menu (`…`) for
+renaming, sharing, revealing the folder, and removing the workspace.
+Post-cutover, all four handlers were stubs.
+
+Steps:
+1. In the sidebar, click the `…` button on the selected workspace row.
+2. Expect: popover opens with **Edit name**, **Share…**, **Reveal in Finder**
+   (desktop only), **Remove workspace**.
+3. Click **Edit name** → modal appears with current name selected.
+4. Type a new name and click **Save**.
+   - Pass: sidebar label and main header update immediately.
+5. Open the menu again → **Reveal in Finder**.
+   - Pass: Finder becomes frontmost with the workspace folder highlighted
+     (desktop only; no-op on web).
+6. Open the menu again → **Share…**.
+   - Pass: workspace path is copied to the clipboard. (Full ShareWorkspaceModal
+     flow is still pending a second pass — see change log.)
+7. Open the menu again → **Remove workspace**.
+   - Pass: workspace disappears from the sidebar; `workspace_bootstrap`
+     returns the remaining workspaces.
+
+Known regressions this catches:
+- Handlers stubbed out as `() => {}` in `session-route.tsx` / `settings-route.tsx`.
+- `workspaceUpdateDisplayName` IPC missing from `apps/app/src/app/lib/tauri.ts`.
+- `revealItemInDir` import broken (wrong package or dynamic import failing on web).
+
+---
+
+## Desktop (Tauri) specifics
+
+The same evals run against the Tauri desktop app (`pnpm dev`). Use the shared
+`evals/desktop-runner.md` (companion doc) for the AppleScript + cliclick
+runner. Key differences:
+
+- Focus-within reveals the `+` and `…` buttons on every workspace row, not just
+  on hover. Clicking the row first (or pressing Tab) ensures they're
+  reachable; on the selected workspace they stay visible continuously.
+- The Tauri window chrome offsets screen coords by the window's `(X, Y)` and
+  the OS titlebar. The helper script must re-query `position of first window`
+  on every interaction.
+- macOS screencapture produces a **point-space** PNG (same dimensions as
+  window points), not a Retina 2x image. Don't divide coordinates by 2 when
+  converting image pixels back to screen points.
+
+---
+
+## Tips for an LLM runner
+
+- Always start with `chrome-devtools_take_snapshot` after each interaction.
+  Never trust that a click "worked" — re-snapshot and verify the new `uid`s.
+- When text you're waiting for might also match a sidebar button, pass a
+  longer, more specific phrase to `chrome-devtools_wait_for` (e.g.
+  `"Browse skill surfaces"` instead of `"Skills"`).
+- If a single flow fails, immediately run
+  `chrome-devtools_list_console_messages { types: ["error"], pageSize: 5 }`.
+  A `Maximum update depth exceeded` error invalidates the rest of the
+  session — reload and reproduce with a narrower repro before continuing.
+- For Flow 1 streaming, don't insist on exact assistant text. Confirm the
+  assistant bubble becomes non-empty and status returns to `Ready`.
+
+---
+
+## Flow 13 — Slash command selection and backspace
+
+**Why**: The slash menu used to cause render churn and RAM growth from
+unstable regex dependencies and uncached command fetches.
+
+Steps:
+1. Create a new session.
+2. Type `/rev` in the composer.
+3. Expect: slash menu opens with `/review` as the top fuzzy match.
+4. Click `/review`.
+5. Expect: composer shows `/review` chip (purple pill) + trailing space;
+   slash menu closes.
+6. Press Backspace once.
+7. Expect: the entire `/review` chip is removed atomically (not one char at
+   a time). Composer is empty.
+
+Pass criteria:
+- Menu items don't flicker or reset while typing.
+- One backspace removes the chip + space together.
+- No console errors or `react.render_loop_suspected` watchdog warnings.
+
+---
+
+## Flow 14 — Slash command error with model recovery
+
+**Why**: When a slash command fails (e.g. model not found), the error must
+show inline in the session area with a recovery action — not as raw
+`[object Object]` below the composer.
+
+Steps:
+1. Create a new session.
+2. Type `/init`, select it, click Run task.
+3. If the command's configured model is unavailable, expect: an inline error
+   card appears in the session area with a human-readable message like
+   "Model openai/gpt-5.2-codex is not available."
+4. Expect: a "Change model" button is visible on the error card.
+5. Click "Change model".
+6. Expect: the model picker opens. Select a valid model.
+7. Composer should be cleared and editable (not stuck readonly).
+
+Pass criteria:
+- Error renders inline in the session (not below the composer).
+- Error message is human-readable (no `[object Object]`).
+- "Change model" opens the picker (not sets the failed model as default).
+- Composer resets on error.
+
+---
+
+## Flow 15 — Paste chip collapse
+
+**Why**: Pasting large text (3+ lines or 200+ chars) should collapse into an
+inline amber chip in the composer instead of flooding the editor.
+
+Steps:
+1. Create a new session.
+2. Copy a multi-line code snippet (10+ lines) to the system clipboard.
+3. Paste into the composer (Cmd+V).
+4. Expect: an amber "Pasted · N lines" chip appears inline in the composer
+   instead of the raw text.
+5. Type `explain this code:` before the chip.
+6. Click Run task.
+7. Expect: the user message in the transcript shows the full expanded text
+   (not the `[pasted text ...]` placeholder).
+8. The assistant response should reference the pasted code correctly.
+
+Pass criteria:
+- Text over threshold collapses into a chip in the composer.
+- Short pastes (< 3 lines, < 200 chars) go in as plain text.
+- `resolvedText` sent to the model contains the full pasted content.
+- User message in the transcript shows the full text, not the placeholder.
+
+Note: CDP `Meta+V` does not trigger real clipboard events in Electron; use
+osascript (`pbcopy` + `keystroke "v" using command down`) to test paste.
+
+---
+
+## Flow 16 — User message display
+
+**Why**: Hand-typed user messages must never be truncated in the transcript.
+Only pasted chip placeholders should render as collapsible.
+
+Steps:
+1. Send a long message (10+ lines of hand-typed text).
+2. Expect: the full message renders in the user bubble without truncation or
+   "expand" chips.
+
+Pass criteria:
+- No `CollapsibleUserText` or "N lines · expand" button on hand-typed text.
+- The full message is visible immediately without clicking.
+
+---
+
+## Flow 17 — Stop / Run task single button
+
+**Why**: The composer should have a single action button that toggles between
+"Run task" (idle or has draft while busy) and "Stop" (busy with no draft).
+
+Steps:
+1. Send a message that triggers a long response.
+2. Expect: the button label changes from "Run task" to "Stop" while
+   the assistant is streaming.
+3. Once the response finishes, expect: button returns to "Run task".
+4. While streaming, type text into the composer.
+5. Expect: button shows "Run task" (to queue the follow-up), not "Stop".
+
+Pass criteria:
+- Only one button visible at any time (no side-by-side Stop + Run task).
+- Button label toggles based on busy state and draft content.
+
+---
+
+## Flow 18 — Skill lifecycle (create, verify, use)
+
+**Why**: Skills should be createable from the UI, appear on disk, and be
+usable in new sessions after reload.
+
+Steps:
+1. Go to Settings → Skills.
+2. Click "Create skill in chat".
+3. Expect: navigates to a new session.
+4. Type `/skill-creator create a skill about weather alerts`.
+5. Select the command and run it.
+6. Expect: the assistant creates `.opencode/skills/weather-alerts/SKILL.md`
+   (requires a model with tool-use capability).
+7. Verify the file exists on disk.
+8. Reload the app (or trigger config reload).
+9. Create a new session and check that `/weather-alerts` appears in the
+   slash command list.
+10. Run `/weather-alerts` and expect the skill template is used.
+
+Pass criteria:
+- "Create skill in chat" navigates away from settings to a session.
+- The skill command actually writes files to `.opencode/skills/`.
+- After reload, the new skill appears in the slash menu.
+- Running the new skill uses its template as the user message.
+
+Note: requires a model with tool-use support (e.g. Claude, GPT-4). Free-tier
+models may describe what they would do without actually calling tools.
+
+---
+
+## Flow 19 — Add workspace button placement
+
+**Why**: The "Add workspace" button must not clip against the Tauri/Electron
+window bottom corners.
+
+Steps:
+1. Look at the sidebar bottom.
+2. Expect: the "Add workspace" button has visible padding below it, above the
+   footer bar.
+
+Pass criteria:
+- At least 16px gap between the button bottom edge and the window edge.
+
+---
+
+## Change log
+
+- 2026-04-16 — initial doc after the React port cutover fixed streaming,
+  session CRUD, the model picker, and the settings tab infinite loop.
+- 2026-04-17 — added Flow 10 (Cmd+N new session), Flow 11 (Cmd+K command
+  palette), Flow 12 (workspace options menu). Also added the desktop-runtime
+  boot hook and restored 17 missing i18n keys that were leaking as raw
+  identifiers in the UI.
+- 2026-04-28 — added Flows 13-19: slash command stability, error recovery
+  with model change, paste chip collapse, user message display, single action
+  button, skill lifecycle, and workspace button placement.
diff --git a/examples/microsandbox-openwork-rust/.gitignore b/examples/microsandbox-openwork-rust/.gitignore
new file mode 100644
index 0000000000..2f7896d1d1
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/.gitignore
@@ -0,0 +1 @@
+target/
diff --git a/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_send.ts b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_send.ts
new file mode 100644
index 0000000000..42b4321423
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_send.ts
@@ -0,0 +1,103 @@
+import { tool } from "@opencode-ai/plugin"
+
+const redactTarget = (value) => {
+  const text = String(value || '').trim()
+  if (!text) return ''
+  if (text.length <= 6) return 'hidden'
+  return `${text.slice(0, 2)}…${text.slice(-2)}`
+}
+
+const buildGuidance = (result) => {
+  const sent = Number(result?.sent || 0)
+  const attempted = Number(result?.attempted || 0)
+  const reason = String(result?.reason || '')
+  const failures = Array.isArray(result?.failures) ? result.failures : []
+
+  if (sent > 0 && failures.length === 0) return 'Delivered successfully.'
+  if (sent > 0) return 'Delivered to at least one conversation, but some targets failed.'
+
+  const chatNotFound = failures.some((item) => /chat not found/i.test(String(item?.error || '')))
+  if (chatNotFound) {
+    return 'Delivery failed because the recipient has not started a chat with the bot yet. Ask them to send /start, then retry.'
+  }
+
+  if (/No bound conversations/i.test(reason)) {
+    return 'No linked conversation found for this workspace yet. Ask the recipient to message the bot first, then retry.'
+  }
+
+  if (attempted === 0) return 'No eligible delivery target found.'
+  return 'Delivery failed. Retry after confirming the recipient and bot linkage.'
+}
+
+export default tool({
+  description: "Send a message via opencodeRouter (Telegram/Slack) to a peer or directory bindings.",
+  args: {
+    text: tool.schema.string().describe("Message text to send"),
+    channel: tool.schema.enum(["telegram", "slack"]).optional().describe("Channel to send on (default: telegram)"),
+    identityId: tool.schema.string().optional().describe("OpenCodeRouter identity id (default: all identities)"),
+    directory: tool.schema.string().optional().describe("Directory to target for fan-out (default: current session directory)"),
+    peerId: tool.schema.string().optional().describe("Direct destination peer id (chat/thread id)"),
+    autoBind: tool.schema.boolean().optional().describe("When direct sending, bind peerId to directory if provided"),
+  },
+  async execute(args, context) {
+    const rawPort = (process.env.OPENCODE_ROUTER_HEALTH_PORT || "3005").trim()
+    const port = Number(rawPort)
+    if (!Number.isFinite(port) || port <= 0) {
+      throw new Error(`Invalid OPENCODE_ROUTER_HEALTH_PORT: ${rawPort}`)
+    }
+    const channel = (args.channel || "telegram").trim()
+    if (channel !== "telegram" && channel !== "slack") {
+      throw new Error("channel must be telegram or slack")
+    }
+    const text = String(args.text || "")
+    if (!text.trim()) throw new Error("text is required")
+    const directory = (args.directory || context.directory || "").trim()
+    const peerId = String(args.peerId || "").trim()
+    if (!directory && !peerId) throw new Error("Either directory or peerId is required")
+    const payload = {
+      channel,
+      text,
+      ...(args.identityId ? { identityId: String(args.identityId) } : {}),
+      ...(directory ? { directory } : {}),
+      ...(peerId ? { peerId } : {}),
+      ...(args.autoBind === true ? { autoBind: true } : {}),
+    }
+    const response = await fetch(`http://127.0.0.1:${port}/send`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+    })
+    const body = await response.text()
+    let json = null
+    try {
+      json = JSON.parse(body)
+    } catch {
+      json = null
+    }
+    if (!response.ok) {
+      throw new Error(`opencodeRouter /send failed (${response.status}): ${body}`)
+    }
+
+    const sent = Number(json?.sent || 0)
+    const attempted = Number(json?.attempted || 0)
+    const reason = typeof json?.reason === 'string' ? json.reason : ''
+    const failuresRaw = Array.isArray(json?.failures) ? json.failures : []
+    const failures = failuresRaw.map((item) => ({
+      identityId: String(item?.identityId || ''),
+      error: String(item?.error || 'delivery failed'),
+      ...(item?.peerId ? { target: redactTarget(item.peerId) } : {}),
+    }))
+
+    const result = {
+      ok: true,
+      channel,
+      sent,
+      attempted,
+      guidance: buildGuidance({ sent, attempted, reason, failures }),
+      ...(reason ? { reason } : {}),
+      ...(failures.length ? { failures } : {}),
+    }
+    return JSON.stringify(result, null, 2)
+  },
+})
+
diff --git a/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_status.ts b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_status.ts
new file mode 100644
index 0000000000..eb3b1a13d6
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/data/openwork-orchestrator/opencode-config/tools/opencode_router_status.ts
@@ -0,0 +1,157 @@
+import { tool } from "@opencode-ai/plugin"
+
+const redactTarget = (value) => {
+  const text = String(value || '').trim()
+  if (!text) return ''
+  if (text.length <= 6) return 'hidden'
+  return `${text.slice(0, 2)}…${text.slice(-2)}`
+}
+
+const isNumericTelegramPeerId = (value) => /^-?\d+$/.test(String(value || '').trim())
+
+export default tool({
+  description: "Check opencodeRouter messaging readiness (health, identities, bindings).",
+  args: {
+    channel: tool.schema.enum(["telegram", "slack"]).optional().describe("Channel to inspect (default: telegram)"),
+    identityId: tool.schema.string().optional().describe("Identity id to scope checks"),
+    directory: tool.schema.string().optional().describe("Directory to inspect bindings for (default: current session directory)"),
+    peerId: tool.schema.string().optional().describe("Peer id to inspect bindings for"),
+    includeBindings: tool.schema.boolean().optional().describe("Include binding details (default: false)"),
+  },
+  async execute(args, context) {
+    const rawPort = (process.env.OPENCODE_ROUTER_HEALTH_PORT || "3005").trim()
+    const port = Number(rawPort)
+    if (!Number.isFinite(port) || port <= 0) {
+      throw new Error(`Invalid OPENCODE_ROUTER_HEALTH_PORT: ${rawPort}`)
+    }
+    const channel = (args.channel || "telegram").trim()
+    if (channel !== "telegram" && channel !== "slack") {
+      throw new Error("channel must be telegram or slack")
+    }
+    const identityId = String(args.identityId || "").trim()
+    const directory = (args.directory || context.directory || "").trim()
+    const peerId = String(args.peerId || "").trim()
+    const targetValid = channel !== 'telegram' || !peerId || isNumericTelegramPeerId(peerId)
+    const includeBindings = args.includeBindings === true
+
+    const fetchJson = async (path) => {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`)
+      const body = await response.text()
+      let json = null
+      try {
+        json = JSON.parse(body)
+      } catch {
+        json = null
+      }
+      if (!response.ok) {
+        return { ok: false, status: response.status, json, error: typeof json?.error === "string" ? json.error : body }
+      }
+      return { ok: true, status: response.status, json }
+    }
+
+    const health = await fetchJson('/health')
+    const identities = await fetchJson(`/identities/${channel}`)
+    let bindings = null
+    if (includeBindings) {
+      const search = new URLSearchParams()
+      search.set('channel', channel)
+      if (identityId) search.set('identityId', identityId)
+      bindings = await fetchJson(`/bindings?${search.toString()}`)
+    }
+
+    const identityItems = Array.isArray(identities?.json?.items) ? identities.json.items : []
+    const scopedIdentityItems = identityId
+      ? identityItems.filter((item) => String(item?.id || '').trim() === identityId)
+      : identityItems
+    const runningItems = scopedIdentityItems.filter((item) => item && item.enabled === true && item.running === true)
+    const enabledItems = scopedIdentityItems.filter((item) => item && item.enabled === true)
+
+    const bindingItems = Array.isArray(bindings?.json?.items) ? bindings.json.items : []
+    const filteredBindings = bindingItems.filter((item) => {
+      if (!item || typeof item !== 'object') return false
+      if (directory && String(item.directory || '').trim() !== directory) return false
+      if (peerId && String(item.peerId || '').trim() !== peerId) return false
+      return true
+    })
+    const publicBindings = filteredBindings.map((item) => ({
+      channel: String(item.channel || channel),
+      identityId: String(item.identityId || ''),
+      directory: String(item.directory || ''),
+      ...(item?.peerId ? { target: redactTarget(item.peerId) } : {}),
+      updatedAt: item?.updatedAt,
+    }))
+
+    let ready = false
+    let guidance = ''
+    let nextAction = ''
+    if (!health.ok) {
+      guidance = 'OpenCode Router health endpoint is unavailable'
+      nextAction = 'check_router_health'
+    } else if (!identities.ok) {
+      guidance = `Identity lookup failed for ${channel}`
+      nextAction = 'check_identity_config'
+    } else if (runningItems.length === 0) {
+      guidance = `No running ${channel} identity`
+      nextAction = 'start_identity'
+    } else if (!targetValid) {
+      guidance = 'Telegram direct targets must be numeric chat IDs. Prefer linked conversations over asking users for raw IDs.'
+      nextAction = 'use_linked_conversation'
+    } else if (peerId) {
+      ready = true
+      guidance = 'Ready for direct send'
+      nextAction = 'send_direct'
+    } else if (directory) {
+      ready = filteredBindings.length > 0
+      guidance = ready
+        ? 'Ready for directory fan-out send'
+        : channel === 'telegram'
+          ? 'No linked Telegram conversations yet. Ask the recipient to message your bot (for example /start), then retry.'
+          : 'No linked conversations found for this directory yet'
+      nextAction = ready ? 'send_directory' : channel === 'telegram' ? 'wait_for_recipient_start' : 'link_conversation'
+    } else {
+      ready = true
+      guidance = 'Ready. Provide a message target (peer or directory).'
+      nextAction = 'choose_target'
+    }
+
+    const result = {
+      ok: health.ok && identities.ok && (!bindings || bindings.ok),
+      ready,
+      guidance,
+      nextAction,
+      channel,
+      ...(identityId ? { identityId } : {}),
+      ...(directory ? { directory } : {}),
+      ...(peerId ? { targetProvided: true } : {}),
+      ...(peerId ? { targetValid } : {}),
+      health: {
+        ok: health.ok,
+        status: health.status,
+        error: health.ok ? undefined : health.error,
+        snapshot: health.ok ? health.json : undefined,
+      },
+      identities: {
+        ok: identities.ok,
+        status: identities.status,
+        error: identities.ok ? undefined : identities.error,
+        configured: scopedIdentityItems.length,
+        enabled: enabledItems.length,
+        running: runningItems.length,
+        items: scopedIdentityItems,
+      },
+      ...(includeBindings
+        ? {
+            bindings: {
+              ok: Boolean(bindings?.ok),
+              status: bindings?.status,
+              error: bindings?.ok ? undefined : bindings?.error,
+              count: filteredBindings.length,
+              items: publicBindings,
+            },
+          }
+        : {}),
+    }
+    return JSON.stringify(result, null, 2)
+  },
+})
+
diff --git a/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/workspace/opencode.jsonc b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/workspace/opencode.jsonc
new file mode 100644
index 0000000000..720ece5c15
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/.state/openwork-microsandbox-rust-homefix/workspace/opencode.jsonc
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://opencode.ai/config.json"
+}
diff --git a/examples/microsandbox-openwork-rust/Cargo.lock b/examples/microsandbox-openwork-rust/Cargo.lock
new file mode 100644
index 0000000000..88a4ec811c
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/Cargo.lock
@@ -0,0 +1,6056 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "aliasable"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "astral-tokio-tar"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c23f3af104b40a3430ccb90ed5f7bd877a8dc5c26fc92fde51a22b40890dcf9"
+dependencies = [
+ "filetime",
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.4.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0f9ee0f6e02ffd7ad5816e9464499fba7b3effd01123b515c41d1697c43dad1"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+dependencies = [
+ "async-channel",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if",
+ "event-listener",
+ "futures-lite",
+ "rustix",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43c070bbf59cd3570b6b2dd54cd772527c7c3620fce8be898406dd3ed6adc64c"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if",
+ "futures-core",
+ "futures-io",
+ "rustix",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bincode"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36eaf5d7b090263e8150820482d5d93cd964a81e4019913c972f4edcc6edb740"
+dependencies = [
+ "bincode_derive",
+ "unty",
+]
+
+[[package]]
+name = "bincode_derive"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf95709a440f45e986983918d0e8a1f30a9b1df04918fc828670606804ac3c09"
+dependencies = [
+ "virtue",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blocking"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "bzip2"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47"
+dependencies = [
+ "bzip2-sys",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "capng"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a26766f93f07f7e8b8309ed2824fa2a68f5d12d219de855e24688e9fbe89e85"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "caps"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd1ddba47aba30b6a889298ad0109c3b8dcb0e8fc993b459daa7067d46f865e0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7a4d3ec6524d28a329fc53654bbadc9bdd7b0431f5d65f1a56ffb28a1ee5283"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1110bd8a634a1ab8cb04345d8d878267d57c3cf1b38d91b71af6686408bbca6a"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "compression-codecs"
+version = "0.4.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb7b51a7d9c967fc26773061ba86150f19c50c0d65c887cb1fbe295fd16619b7"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+ "zstd",
+ "zstd-safe",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "const_format"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7faa7469a93a566e9ccc1c73fe783b4a65c274c5ace346038dca9c39fe0030ad"
+dependencies = [
+ "const_format_proc_macros",
+]
+
+[[package]]
+name = "const_format_proc_macros"
+version = "0.2.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
+
+[[package]]
+name = "crc32c"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
+dependencies = [
+ "rustc_version",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crossterm"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
+dependencies = [
+ "bitflags 2.11.0",
+ "crossterm_winapi",
+ "derive_more",
+ "document-features",
+ "mio",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "dbus"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b3aa68d7e7abee336255bd7248ea965cc393f3e70411135a6f6a4b651345d4"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "dbus-secret-service"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
+dependencies = [
+ "aes",
+ "block-padding",
+ "cbc",
+ "dbus",
+ "fastrand",
+ "hkdf",
+ "num",
+ "once_cell",
+ "sha2 0.10.9",
+ "zeroize",
+]
+
+[[package]]
+name = "defmt"
+version = "0.3.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad"
+dependencies = [
+ "defmt 1.0.1",
+]
+
+[[package]]
+name = "defmt"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "548d977b6da32fa1d1fda2876453da1e7df63ad0304c8b3dae4dbe7b96f39b78"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d4fc12a85bcf441cfe44344c4b72d58493178ce635338a3f3b78943aceb258e"
+dependencies = [
+ "defmt-parser",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn",
+ "unicode-xid",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
+dependencies = [
+ "block-buffer 0.12.0",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.1",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d89dfcba45b4afad7450a99b39e751590463e45c04728cf555d36bb66940de8"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "endi"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "getset"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cf0fc11e47561d47397154977bc219f4cf809b2974facc3ccb3b89e2436f912"
+dependencies = [
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heapless"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af2455f757db2b292a9b1768c4b70186d443bcb3b316252d6b540aec1cd89ed"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hickory-proto"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "idna",
+ "ipnet",
+ "once_cell",
+ "rand 0.9.2",
+ "ring",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto",
+ "ipconfig",
+ "moka",
+ "once_cell",
+ "parking_lot",
+ "rand 0.9.2",
+ "resolv-conf",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-auth"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "150fa4a9462ef926824cf4519c84ed652ca8f4fbae34cb8af045b5cbcaf98822"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.6",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "imago"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e8e4b92aa0dd860579cfba776dbf0918a3a7ac5cb601af7d3fc835e71592a5b"
+dependencies = [
+ "async-trait",
+ "bincode",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "nix 0.30.1",
+ "page_size",
+ "rustc_version",
+ "tokio",
+ "tracing",
+ "vm-memory 0.18.0",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45a8a2b9cb3e0b0c1803dbb0758ffac5de2f425b23c28f518faabd9d805342ff"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inherent"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c727f80bfa4a6c6e2508d2f05b6f4bfce242030bd88ed15ae5331c5b5d30fba7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
+[[package]]
+name = "ipconfig"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
+dependencies = [
+ "socket2",
+ "widestring",
+ "windows-registry",
+ "windows-result",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "ipnetwork"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "iri-string"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25e659a4bb38e810ebc252e53b5814ff908a8c58c2a9ce2fae1bbec24cbf4e20"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e04e2ef80ce82e13552136fabeef8a5ed1f985a96805761cbb9a2c34e7664d9"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "10.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
+dependencies = [
+ "base64 0.22.1",
+ "getrandom 0.2.17",
+ "js-sys",
+ "serde",
+ "serde_json",
+ "signature",
+]
+
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "byteorder",
+ "dbus-secret-service",
+ "linux-keyutils",
+ "log",
+ "secret-service",
+ "security-framework 2.11.1",
+ "security-framework 3.7.0",
+ "windows-sys 0.60.2",
+ "zeroize",
+]
+
+[[package]]
+name = "kvm-bindings"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b3c06ff73c7ce03e780887ec2389d62d2a2a9ddf471ab05c2ff69207cd3f3b4"
+dependencies = [
+ "vmm-sys-util",
+]
+
+[[package]]
+name = "kvm-ioctls"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "333f77a20344a448f3f70664918135fddeb804e938f28a99d685bd92926e0b19"
+dependencies = [
+ "bitflags 2.11.0",
+ "kvm-bindings",
+ "libc",
+ "vmm-sys-util",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.184"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ddbf48fd451246b1f8c2610bd3b4ac0cc6e149d89832867093ab69a17194f08"
+dependencies = [
+ "bitflags 2.11.0",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.3",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-keyutils"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83270a18e9f90d0707c41e9f35efada77b64c0e6f3f1810e71c8368a864d5590"
+dependencies = [
+ "bitflags 2.11.0",
+ "libc",
+]
+
+[[package]]
+name = "linux-loader"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "870c3814345f050991f99869417779f6062542bcf4ed81db7a1b926ad1306638"
+dependencies = [
+ "vm-memory 0.16.2",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "lru"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "managed"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "microsandbox"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7de3be20e09b7b0c3bb4535ffba4cfccef696ac4443e0192241ae27bd8e6417e"
+dependencies = [
+ "bytes",
+ "chrono",
+ "crossterm",
+ "dirs",
+ "docker_credential",
+ "flate2",
+ "futures",
+ "keyring",
+ "libc",
+ "microsandbox-db",
+ "microsandbox-filesystem",
+ "microsandbox-image",
+ "microsandbox-migration",
+ "microsandbox-network",
+ "microsandbox-protocol",
+ "microsandbox-runtime",
+ "microsandbox-utils",
+ "nix 0.30.1",
+ "reqwest 0.13.2",
+ "scopeguard",
+ "sea-orm",
+ "serde",
+ "serde_json",
+ "tar",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "typed-builder",
+ "ureq",
+ "which",
+]
+
+[[package]]
+name = "microsandbox-db"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9af1d519dd597b1f2258b492fb2732b265e47cfc539972146fcf2710d203cc"
+dependencies = [
+ "sea-orm",
+]
+
+[[package]]
+name = "microsandbox-filesystem"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eccf6dee1f0aa0385759f09cbd0489a2e49075132f3124a7946f1f703ac2b5c"
+dependencies = [
+ "libc",
+ "microsandbox-utils",
+ "msb_krun",
+ "scopeguard",
+ "tempfile",
+ "tracing",
+ "ureq",
+]
+
+[[package]]
+name = "microsandbox-image"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d784c1eedb06e654631a99f3f244d0f1c5f8dc15ace301374ef11863e7dcac97"
+dependencies = [
+ "astral-tokio-tar",
+ "async-compression",
+ "futures",
+ "hex",
+ "libc",
+ "microsandbox-utils",
+ "oci-client",
+ "oci-spec",
+ "scopeguard",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "xattr",
+]
+
+[[package]]
+name = "microsandbox-migration"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6536341f9547f6f8ec9ee47790ab978b0eac213d4d17db9762289423812a8f42"
+dependencies = [
+ "sea-orm-migration",
+]
+
+[[package]]
+name = "microsandbox-network"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e27242214612a447381cc227408faffa0c5a0c9d1a1004946aad64b119dee768"
+dependencies = [
+ "bytes",
+ "crossbeam-queue",
+ "dirs",
+ "hickory-proto",
+ "hickory-resolver",
+ "ipnetwork",
+ "libc",
+ "lru",
+ "microsandbox-utils",
+ "msb_krun",
+ "rcgen",
+ "rustls",
+ "rustls-native-certs",
+ "serde",
+ "smoltcp",
+ "time",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+]
+
+[[package]]
+name = "microsandbox-openwork-rust"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "microsandbox",
+ "reqwest 0.12.28",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "microsandbox-protocol"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dea7706d28bf6b5c1048967d8ed0858c88e8073f71263c71b316abffb014f12"
+dependencies = [
+ "chrono",
+ "ciborium",
+ "serde",
+ "serde_bytes",
+ "thiserror 2.0.18",
+ "tokio",
+]
+
+[[package]]
+name = "microsandbox-runtime"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1170cf90388ae9125ae7e69555efc83971ab6e762ed2141ddfd613faf10c8bd0"
+dependencies = [
+ "bytes",
+ "chrono",
+ "clap",
+ "crossbeam-queue",
+ "libc",
+ "microsandbox-db",
+ "microsandbox-filesystem",
+ "microsandbox-network",
+ "microsandbox-protocol",
+ "microsandbox-utils",
+ "msb_krun",
+ "nix 0.30.1",
+ "rustls",
+ "sea-orm",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "microsandbox-utils"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f488b643809213b2479e312f475cb95500c1bb3a7b0727258c2495e482b8d3"
+dependencies = [
+ "crc32c",
+ "libc",
+ "scopeguard",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
+[[package]]
+name = "msb_krun"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "482757de70ab2e6d133320b90357844dd9911bea2f2bc3a1da0b208fe9d3a463"
+dependencies = [
+ "crossbeam-channel",
+ "kvm-bindings",
+ "kvm-ioctls",
+ "libc",
+ "libloading",
+ "log",
+ "msb_krun_devices",
+ "msb_krun_hvf",
+ "msb_krun_polly",
+ "msb_krun_utils",
+ "msb_krun_vmm",
+ "vm-memory 0.16.2",
+]
+
+[[package]]
+name = "msb_krun_arch"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c09713c910b5a709b86c843c06761270188529605049683784a51c56f7f361"
+dependencies = [
+ "kvm-bindings",
+ "kvm-ioctls",
+ "libc",
+ "msb_krun_arch_gen",
+ "msb_krun_smbios",
+ "msb_krun_utils",
+ "vm-memory 0.16.2",
+ "vmm-sys-util",
+]
+
+[[package]]
+name = "msb_krun_arch_gen"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "150ba0c87d781c52a755cd46cda41bce95c87213f6d6bb4d03421d8609328aa6"
+
+[[package]]
+name = "msb_krun_cpuid"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45ac7305e87bc9a3ae2057ac1c6f55f131387eecf36f75654583b56b4c6ad799"
+dependencies = [
+ "kvm-bindings",
+ "kvm-ioctls",
+ "vmm-sys-util",
+]
+
+[[package]]
+name = "msb_krun_devices"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dcdf72e5800c2bee0a4dc34b5feaaf02afffeb44ca67661cdc6c4aae3ca678c"
+dependencies = [
+ "bitflags 1.3.2",
+ "capng",
+ "caps",
+ "crossbeam-channel",
+ "imago",
+ "kvm-bindings",
+ "kvm-ioctls",
+ "libc",
+ "libloading",
+ "log",
+ "lru",
+ "msb_krun_arch",
+ "msb_krun_hvf",
+ "msb_krun_polly",
+ "msb_krun_utils",
+ "nix 0.30.1",
+ "rand 0.9.2",
+ "virtio-bindings",
+ "vm-fdt",
+ "vm-memory 0.16.2",
+]
+
+[[package]]
+name = "msb_krun_hvf"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ffe7b9fd536ef259e07d81be24764b4c4824da6cb59d5ea203015da3532aadc"
+dependencies = [
+ "crossbeam-channel",
+ "libloading",
+ "log",
+ "msb_krun_arch",
+]
+
+[[package]]
+name = "msb_krun_kernel"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86322881d073cb7fc64dfe4cc452e244936afdb82af8c3de71aad7486f7baa63"
+dependencies = [
+ "msb_krun_utils",
+ "vm-memory 0.16.2",
+]
+
+[[package]]
+name = "msb_krun_polly"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d613563f3c275230da6b70a1f995ddd2029c4ea4fffd3f5ce4161f1c1d8ebd"
+dependencies = [
+ "libc",
+ "msb_krun_utils",
+]
+
+[[package]]
+name = "msb_krun_smbios"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca1cbd0e82de1386898a75923a47ad80bce1a86dcf0466c65c5077dbbf0c3a48"
+dependencies = [
+ "vm-memory 0.16.2",
+]
+
+[[package]]
+name = "msb_krun_utils"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d7718c988ff1408cfdacc9bff1b5ac78a52cf664d5c0cb727c677f7e5db6062"
+dependencies = [
+ "bitflags 1.3.2",
+ "crossbeam-channel",
+ "kvm-bindings",
+ "libc",
+ "log",
+ "nix 0.30.1",
+ "vmm-sys-util",
+]
+
+[[package]]
+name = "msb_krun_vmm"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4271a097ed7d435060a608fbd963833b51c346f716050233228a7d2c5b194e0"
+dependencies = [
+ "bzip2",
+ "crossbeam-channel",
+ "flate2",
+ "kvm-bindings",
+ "kvm-ioctls",
+ "libc",
+ "linux-loader",
+ "log",
+ "msb_krun_arch",
+ "msb_krun_arch_gen",
+ "msb_krun_cpuid",
+ "msb_krun_devices",
+ "msb_krun_hvf",
+ "msb_krun_kernel",
+ "msb_krun_polly",
+ "msb_krun_utils",
+ "nix 0.30.1",
+ "vm-memory 0.16.2",
+ "vmm-sys-util",
+ "zstd",
+]
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.11.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.11.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "oci-client"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b7f8deaffcd3b0e3baf93dddcab3d18b91d46dc37d38a8b170089b234de5bb3"
+dependencies = [
+ "bytes",
+ "chrono",
+ "futures-util",
+ "http",
+ "http-auth",
+ "jsonwebtoken",
+ "lazy_static",
+ "oci-spec",
+ "olpc-cjson",
+ "regex",
+ "reqwest 0.13.2",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "unicase",
+]
+
+[[package]]
+name = "oci-spec"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8445a2631507cec628a15fdd6154b54a3ab3f20ed4fe9d73a3b8b7a4e1ba03a"
+dependencies = [
+ "const_format",
+ "derive_builder",
+ "getset",
+ "regex",
+ "serde",
+ "serde_json",
+ "strum 0.27.2",
+ "strum_macros",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "olpc-cjson"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "696183c9b5fe81a7715d074fd632e8bd46f4ccc0231a3ed7fc580a80de5f7083"
+dependencies = [
+ "serde",
+ "serde_json",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "ordered-float"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "ouroboros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0f050db9c44b97a94723127e6be766ac5c340c48f2c4bb3ffa11713744be59"
+dependencies = [
+ "aliasable",
+ "ouroboros_macro",
+ "static_assertions",
+]
+
+[[package]]
+name = "ouroboros_macro"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c7028bdd3d43083f6d8d4d5187680d0d3560d54df4cc9d752005268b41e64d0"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+ "yansi",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 1.0.6",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+]
+
+[[package]]
+name = "resolv-conf"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.11.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 3.7.0",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework 3.7.0",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sea-bae"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f694a6ab48f14bc063cfadff30ab551d3c7e46d8f81836c51989d548f44a2a25"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sea-orm"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dc312fedd460a47ea563911761d254a84e7b51d8cc73ec92c929e78f33fa957"
+dependencies = [
+ "async-stream",
+ "async-trait",
+ "chrono",
+ "derive_more",
+ "futures-util",
+ "log",
+ "ouroboros",
+ "sea-orm-macros",
+ "sea-query",
+ "sea-query-binder",
+ "serde",
+ "sqlx",
+ "strum 0.26.3",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "sea-orm-cli"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da80ebcdb44571e86f03a2bdcb5532136a87397f366f38bbce64673fc5e6a450"
+dependencies = [
+ "chrono",
+ "glob",
+ "regex",
+ "sea-schema",
+ "sqlx",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+]
+
+[[package]]
+name = "sea-orm-macros"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b9a3f90e336ec74803e8eb98c61bc98754c1adfba3b4f84d946237b752b1c88"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "sea-bae",
+ "syn",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sea-orm-migration"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07c577f2959277e936c1d08109acd1e08fc36a95ef29ec028190ba82cad8f96e"
+dependencies = [
+ "async-trait",
+ "sea-orm",
+ "sea-orm-cli",
+ "sea-schema",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "sea-query"
+version = "0.32.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a5d1c518eaf5eda38e5773f902b26ab6d5e9e9e2bb2349ca6c64cf96f80448c"
+dependencies = [
+ "chrono",
+ "inherent",
+ "ordered-float",
+ "sea-query-derive",
+]
+
+[[package]]
+name = "sea-query-binder"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0019f47430f7995af63deda77e238c17323359af241233ec768aba1faea7608"
+dependencies = [
+ "chrono",
+ "sea-query",
+ "sqlx",
+]
+
+[[package]]
+name = "sea-query-derive"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bae0cbad6ab996955664982739354128c58d16e126114fe88c2a493642502aab"
+dependencies = [
+ "darling",
+ "heck 0.4.1",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "sea-schema"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2239ff574c04858ca77485f112afea1a15e53135d3097d0c86509cef1def1338"
+dependencies = [
+ "futures",
+ "sea-query",
+ "sea-query-binder",
+ "sea-schema-derive",
+ "sqlx",
+]
+
+[[package]]
+name = "sea-schema-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "debdc8729c37fdbf88472f97fd470393089f997a909e535ff67c544d18cfccf0"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "secret-service"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4d35ad99a181be0a60ffcbe85d680d98f87bdc4d7644ade319b87076b9dbfd4"
+dependencies = [
+ "aes",
+ "cbc",
+ "futures-util",
+ "generic-array",
+ "hkdf",
+ "num",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "sha2 0.10.9",
+ "zbus",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.11.0",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.11.0",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smoltcp"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac729b0a77bd092a3f06ddaddc59fe0d67f48ba0de45a9abe707c2842c7f8767"
+dependencies = [
+ "bitflags 1.3.2",
+ "byteorder",
+ "cfg-if",
+ "defmt 0.3.100",
+ "heapless",
+ "managed",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.5.0",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags 2.11.0",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest 0.10.7",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2 0.10.9",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags 2.11.0",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.11.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tar"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd1c4c0fc4a7ab90fc15ef6daaa3ec3b893f004f915f2392557ed23237820cd"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.10+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a82418ca169e235e6c399a84e395ab6debeb3bc90edc959bf0f48647c6a32d1b"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.11.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typed-builder"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31aa81521b70f94402501d848ccc0ecaa8f93c8eb6999eb9747e72287757ffda"
+dependencies = [
+ "typed-builder-macro",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "076a02dc54dd46795c2e9c8282ed40bcfb1e22747e955de9389a1de28190fb26"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "unty"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
+
+[[package]]
+name = "ureq"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+dependencies = [
+ "base64 0.22.1",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots 1.0.6",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
+dependencies = [
+ "getrandom 0.4.2",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "virtio-bindings"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "091f1f09cfbf2a78563b562e7a949465cce1aef63b6065645188d995162f8868"
+
+[[package]]
+name = "virtue"
+version = "0.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "051eb1abcf10076295e815102942cc58f9d5e3b4560e46e53c21e8ff6f3af7b1"
+
+[[package]]
+name = "vm-fdt"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e21282841a059bb62627ce8441c491f09603622cd5a21c43bfedc85a2952f23"
+
+[[package]]
+name = "vm-memory"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd5e56d48353c5f54ef50bd158a0452fc82f5383da840f7b8efc31695dd3b9d"
+dependencies = [
+ "libc",
+ "thiserror 1.0.69",
+ "winapi",
+]
+
+[[package]]
+name = "vm-memory"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b55e753c7725603745cb32b2287ef7ef3da05c03c7702cda3fa8abe25ae0465"
+dependencies = [
+ "libc",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "vmm-sys-util"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "506c62fdf617a5176827c2f9afbcf1be155b03a9b4bf9617a60dbc07e3a1642f"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0551fc1bb415591e3372d0bc4780db7e587d84e2a7e79da121051c5c4b89d0b0"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03623de6905b7206edd0a75f69f747f134b7f0a2323392d664448bf2d3c5d87e"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fbdf9a35adf44786aecd5ff89b4563a90325f9da0923236f6104e603c7e86be"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dca9693ef2bab6d4e6707234500350d8dad079eb508dca05530c85dc3a529ff2"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39129a682a6d2d841b6c429d0c51e5cb0ed1a03829d8b3d1e69a011e62cb3d3b"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.11.0",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd70027e39b12f0849461e08ffc50b9cd7688d942c1c8e3c7b22273236b4dd0a"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804f18a4ac2676ffb4e8b5b5fa9ae38af06df08162314f96a68d2a363e21a8ca"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.6",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "which"
+version = "8.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09dac053f1cd375980747450bfc7250c264eaae0583872e845c0c7cd578872b5"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.0",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "xdg-home"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec1cdab258fb55c0da61328dc52c8764709b249011b2cad0454c72f0bf10a1f6"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zbus"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725"
+dependencies = [
+ "async-broadcast",
+ "async-process",
+ "async-recursion",
+ "async-trait",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hex",
+ "nix 0.29.0",
+ "ordered-stream",
+ "rand 0.8.5",
+ "serde",
+ "serde_repr",
+ "sha1",
+ "static_assertions",
+ "tracing",
+ "uds_windows",
+ "windows-sys 0.52.0",
+ "xdg-home",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
+dependencies = [
+ "serde",
+ "static_assertions",
+ "zvariant",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "zvariant"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "static_assertions",
+ "zvariant_derive",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
diff --git a/examples/microsandbox-openwork-rust/Cargo.toml b/examples/microsandbox-openwork-rust/Cargo.toml
new file mode 100644
index 0000000000..6fb8718bc4
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "microsandbox-openwork-rust"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+anyhow = "1"
+microsandbox = "0.3.12"
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+serde_json = "1"
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal", "time"] }
diff --git a/examples/microsandbox-openwork-rust/README.md b/examples/microsandbox-openwork-rust/README.md
new file mode 100644
index 0000000000..b1f3fb9492
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/README.md
@@ -0,0 +1,69 @@
+# Microsandbox OpenWork Rust Example
+
+Small standalone Rust example that starts the OpenWork micro-sandbox image with the `microsandbox` SDK, publishes the OpenWork server on a host port, persists `/workspace` and `/data` with host bind mounts, verifies `/health`, checks that `/workspaces` is `401` without a token and `200` with the client token, then keeps the sandbox alive until `Ctrl+C` while streaming the sandbox logs to your terminal.
+
+## Run
+
+```bash
+cargo run --manifest-path examples/microsandbox-openwork-rust/Cargo.toml
+```
+
+Useful environment overrides:
+
+- `OPENWORK_MICROSANDBOX_IMAGE` - OCI image reference to boot. Defaults to `openwork-microsandbox:dev`.
+- `OPENWORK_MICROSANDBOX_NAME` - sandbox name. Defaults to `openwork-microsandbox-rust`.
+- `OPENWORK_MICROSANDBOX_WORKSPACE_DIR` - host directory bind-mounted at `/workspace`. Defaults to `examples/microsandbox-openwork-rust/.state/<sandbox-name>/workspace`.
+- `OPENWORK_MICROSANDBOX_DATA_DIR` - host directory bind-mounted at `/data`. Defaults to `examples/microsandbox-openwork-rust/.state/<sandbox-name>/data`.
+- `OPENWORK_MICROSANDBOX_REPLACE` - set to `1` or `true` to replace the sandbox instead of reusing persistent state. Defaults to off.
+- `OPENWORK_MICROSANDBOX_PORT` - published host port. Defaults to `8787`.
+- `OPENWORK_CONNECT_HOST` - hostname you want clients to use. Defaults to `127.0.0.1`.
+- `OPENWORK_TOKEN` - remote-connect client token. Defaults to `microsandbox-token`.
+- `OPENWORK_HOST_TOKEN` - host/admin token. Defaults to `microsandbox-host-token`.
+
+Example:
+
+```bash
+OPENWORK_MICROSANDBOX_IMAGE=ghcr.io/example/openwork-microsandbox:dev \
+OPENWORK_MICROSANDBOX_WORKSPACE_DIR="$PWD/examples/microsandbox-openwork-rust/.state/demo/workspace" \
+OPENWORK_MICROSANDBOX_DATA_DIR="$PWD/examples/microsandbox-openwork-rust/.state/demo/data" \
+OPENWORK_CONNECT_HOST=127.0.0.1 \
+OPENWORK_TOKEN=some-shared-secret \
+OPENWORK_HOST_TOKEN=some-owner-secret \
+cargo run --manifest-path examples/microsandbox-openwork-rust/Cargo.toml
+```
+
+## Test
+
+The crate includes an ignored end-to-end smoke test that:
+
+- boots the microsandbox image
+- waits for `/health`
+- verifies unauthenticated `/workspaces` returns `401`
+- verifies authenticated `/workspaces` returns `200`
+- creates an OpenCode session through `/w/:workspaceId/opencode/session`
+- fetches the created session and its messages
+
+Run it explicitly:
+
+```bash
+OPENWORK_MICROSANDBOX_IMAGE=ttl.sh/openwork-microsandbox-11559:1d \
+cargo test --manifest-path examples/microsandbox-openwork-rust/Cargo.toml -- --ignored --nocapture
+```
+
+## Persistence behavior
+
+By default, the example creates and reuses two host directories under `examples/microsandbox-openwork-rust/.state/<sandbox-name>/`:
+
+- `/workspace`
+- `/data`
+
+That keeps OpenWork and OpenCode state around across sandbox restarts, while using normal host filesystem semantics instead of managed microsandbox named volumes.
+
+If you want a clean reset, either:
+
+- change the sandbox name or bind mount paths, or
+- set `OPENWORK_MICROSANDBOX_REPLACE=1`
+
+## Note on local Docker images
+
+`microsandbox` expects an OCI image reference. If `openwork-microsandbox:dev` only exists in your local Docker daemon, the SDK may not be able to resolve it directly. In that case, push the image to a registry or otherwise make it available as a pullable OCI image reference first, then set `OPENWORK_MICROSANDBOX_IMAGE` to that ref.
diff --git a/examples/microsandbox-openwork-rust/src/bin/debug_env.rs b/examples/microsandbox-openwork-rust/src/bin/debug_env.rs
new file mode 100644
index 0000000000..1b4a954514
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/src/bin/debug_env.rs
@@ -0,0 +1,30 @@
+use anyhow::Result;
+use microsandbox::{NetworkPolicy, Sandbox};
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let sandbox = Sandbox::builder("owmsb-env-debug")
+        .image("ttl.sh/openwork-microsandbox-11559:1d")
+        .replace()
+        .memory(1024)
+        .cpus(1)
+        .network(|n| n.policy(NetworkPolicy::allow_all()))
+        .create()
+        .await?;
+
+    let out = sandbox
+        .exec(
+            "/bin/sh",
+            [
+                "-lc",
+                "id; pwd; echo HOME=$HOME; echo USER=$USER; echo SHELL=$SHELL; env | sort | grep -E '^(HOME|USER|SHELL|XDG|PATH)=' || true; ls -ld /root /tmp /workspace /data 2>/dev/null || true; /usr/local/bin/opencode --version; rm -f /tmp/opencode.log; (/usr/local/bin/opencode serve --hostname 127.0.0.1 --port 4096 >/tmp/opencode.log 2>&1 &) ; sleep 5; echo '--- HEALTH ---'; curl -iS http://127.0.0.1:4096/health || true; echo; echo '--- SESSION CREATE ---'; curl -iS -X POST -H 'content-type: application/json' -d '{\"title\":\"debug\"}' http://127.0.0.1:4096/session || true; echo; echo '--- PROVIDER ---'; curl -iS http://127.0.0.1:4096/provider || true; echo; echo '--- OPENCODE LOG ---'; cat /tmp/opencode.log || true",
+            ],
+        )
+        .await?;
+
+    println!("stdout:\n{}", out.stdout()?);
+    eprintln!("stderr:\n{}", out.stderr()?);
+
+    sandbox.stop().await?;
+    Ok(())
+}
diff --git a/examples/microsandbox-openwork-rust/src/main.rs b/examples/microsandbox-openwork-rust/src/main.rs
new file mode 100644
index 0000000000..1ca909eda5
--- /dev/null
+++ b/examples/microsandbox-openwork-rust/src/main.rs
@@ -0,0 +1,322 @@
+use anyhow::{Context, Result};
+use microsandbox::{ExecEvent, NetworkPolicy, Sandbox};
+use reqwest::StatusCode;
+use std::env;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let image = env::var("OPENWORK_MICROSANDBOX_IMAGE")
+        .unwrap_or_else(|_| "openwork-microsandbox:dev".to_string());
+    let name = env::var("OPENWORK_MICROSANDBOX_NAME")
+        .unwrap_or_else(|_| "openwork-microsandbox-rust".to_string());
+    let workspace_dir = env::var("OPENWORK_MICROSANDBOX_WORKSPACE_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| default_bind_dir(&name, "workspace"));
+    let data_dir = env::var("OPENWORK_MICROSANDBOX_DATA_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| default_bind_dir(&name, "data"));
+    let replace = env_flag("OPENWORK_MICROSANDBOX_REPLACE");
+    let host_port = env::var("OPENWORK_MICROSANDBOX_PORT")
+        .ok()
+        .and_then(|value| value.parse::<u16>().ok())
+        .unwrap_or(8787);
+    let connect_host =
+        env::var("OPENWORK_CONNECT_HOST").unwrap_or_else(|_| "127.0.0.1".to_string());
+    let client_token =
+        env::var("OPENWORK_TOKEN").unwrap_or_else(|_| "microsandbox-token".to_string());
+    let host_token =
+        env::var("OPENWORK_HOST_TOKEN").unwrap_or_else(|_| "microsandbox-host-token".to_string());
+
+    println!(
+        "Starting microsandbox `{name}` from image `{image}` on http://{connect_host}:{host_port}"
+    );
+
+    ensure_bind_dir(&workspace_dir).await?;
+    ensure_bind_dir(&data_dir).await?;
+
+    let mut builder = Sandbox::builder(&name)
+        .image(image.as_str())
+        .memory(2048)
+        .cpus(2)
+        .env("OPENWORK_CONNECT_HOST", &connect_host)
+        .env("OPENWORK_TOKEN", &client_token)
+        .env("OPENWORK_HOST_TOKEN", &host_token)
+        .env("OPENWORK_APPROVAL_MODE", "auto")
+        .port(host_port, 8787)
+        .volume("/workspace", |v| {
+            v.bind(workspace_dir.to_string_lossy().as_ref())
+        })
+        .volume("/data", |v| v.bind(data_dir.to_string_lossy().as_ref()))
+        .network(|n| n.policy(NetworkPolicy::allow_all()));
+
+    if replace {
+        builder = builder.replace();
+    }
+
+    let sandbox = builder
+        .create()
+        .await
+        .with_context(|| {
+            format!(
+                "failed to create microsandbox from image `{image}`; if this image only exists in Docker, push it to a registry or otherwise make it available as an OCI image reference first"
+            )
+        })?;
+
+    let server = sandbox
+        .exec_stream(
+            "/bin/sh",
+            ["-lc", "/usr/local/bin/microsandbox-entrypoint.sh"],
+        )
+        .await
+        .context("failed to start the OpenWork microsandbox entrypoint inside the VM")?;
+
+    let log_task = tokio::spawn(async move {
+        let mut server = server;
+        while let Some(event) = server.recv().await {
+            match event {
+                ExecEvent::Stdout(data) => print!("{}", String::from_utf8_lossy(&data)),
+                ExecEvent::Stderr(data) => eprint!("{}", String::from_utf8_lossy(&data)),
+                ExecEvent::Exited { code } => {
+                    eprintln!("microsandbox entrypoint exited with code {code}");
+                    break;
+                }
+                _ => {}
+            }
+        }
+    });
+
+    let base_url = format!("http://127.0.0.1:{host_port}");
+    wait_for_health(&base_url).await?;
+    verify_remote_connect(&base_url, &client_token).await?;
+
+    println!();
+    println!("Health check passed: {base_url}/health");
+    println!("Remote connect URL: http://{connect_host}:{host_port}");
+    println!("Remote connect token: {client_token}");
+    println!("Host/admin token: {host_token}");
+    println!("Workspace dir: {}", workspace_dir.display());
+    println!("Data dir: {}", data_dir.display());
+    println!("Sandbox logs are streaming below.");
+    println!("Press Ctrl+C to stop the sandbox.");
+
+    tokio::signal::ctrl_c()
+        .await
+        .context("failed waiting for Ctrl+C")?;
+    println!("Stopping microsandbox `{name}`...");
+    sandbox
+        .stop()
+        .await
+        .context("failed to stop microsandbox")?;
+    let _ = tokio::time::timeout(Duration::from_secs(5), log_task).await;
+
+    Ok(())
+}
+
+fn env_flag(name: &str) -> bool {
+    matches!(
+        env::var(name).ok().as_deref(),
+        Some("1") | Some("true") | Some("TRUE") | Some("yes") | Some("YES")
+    )
+}
+
+fn default_bind_dir(name: &str, suffix: &str) -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join(".state")
+        .join(name)
+        .join(suffix)
+}
+
+async fn ensure_bind_dir(path: &Path) -> Result<()> {
+    tokio::fs::create_dir_all(path)
+        .await
+        .with_context(|| format!("failed to create bind mount directory `{}`", path.display()))
+}
+
+async fn wait_for_health(base_url: &str) -> Result<()> {
+    let client = reqwest::Client::new();
+    let deadline = Instant::now() + Duration::from_secs(60);
+    let health_url = format!("{base_url}/health");
+
+    loop {
+        match client.get(&health_url).send().await {
+            Ok(response) if response.status().is_success() => return Ok(()),
+            Ok(_) | Err(_) if Instant::now() < deadline => {
+                tokio::time::sleep(Duration::from_secs(1)).await;
+            }
+            Ok(response) => {
+                anyhow::bail!("health check failed with status {}", response.status());
+            }
+            Err(error) => {
+                return Err(error).context("health check never succeeded before timeout");
+            }
+        }
+    }
+}
+
+async fn verify_remote_connect(base_url: &str, token: &str) -> Result<()> {
+    let client = reqwest::Client::new();
+    let workspaces_url = format!("{base_url}/workspaces");
+
+    let unauthorized = client
+        .get(&workspaces_url)
+        .send()
+        .await
+        .context("failed to query workspaces without auth")?;
+    if unauthorized.status() != StatusCode::UNAUTHORIZED {
+        anyhow::bail!(
+            "expected unauthenticated /workspaces to return 401, got {}",
+            unauthorized.status()
+        );
+    }
+
+    let authorized = client
+        .get(&workspaces_url)
+        .bearer_auth(token)
+        .send()
+        .await
+        .context("failed to query workspaces with client token")?;
+    if !authorized.status().is_success() {
+        anyhow::bail!(
+            "expected authenticated /workspaces to succeed, got {}",
+            authorized.status()
+        );
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{json, Value};
+    use std::env::temp_dir;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    #[tokio::test]
+    #[ignore = "requires microsandbox runtime and a pullable OCI image"]
+    async fn rust_example_smoke_test_checks_health_and_session_endpoints() -> Result<()> {
+        let image = env::var("OPENWORK_MICROSANDBOX_IMAGE")
+            .unwrap_or_else(|_| "ttl.sh/openwork-microsandbox-11559:1d".to_string());
+        let connect_host = "127.0.0.1";
+        let client_token = "some-shared-secret";
+        let host_token = "some-owner-secret";
+        let host_port = 28787;
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("time went backwards")
+            .as_millis();
+        let short = unique % 1_000_000;
+        let name = format!("owmsb-{short}");
+        let base_dir = temp_dir().join(format!("owmsb-{short}"));
+        let workspace_dir = base_dir.join("workspace");
+        let data_dir = base_dir.join("data");
+
+        ensure_bind_dir(&workspace_dir).await?;
+        ensure_bind_dir(&data_dir).await?;
+
+        let sandbox = Sandbox::builder(&name)
+            .image(image.as_str())
+            .replace()
+            .memory(2048)
+            .cpus(2)
+            .env("OPENWORK_CONNECT_HOST", connect_host)
+            .env("OPENWORK_TOKEN", client_token)
+            .env("OPENWORK_HOST_TOKEN", host_token)
+            .env("OPENWORK_APPROVAL_MODE", "auto")
+            .port(host_port, 8787)
+            .volume("/workspace", |v| {
+                v.bind(workspace_dir.to_string_lossy().as_ref())
+            })
+            .volume("/data", |v| v.bind(data_dir.to_string_lossy().as_ref()))
+            .network(|n| n.policy(NetworkPolicy::allow_all()))
+            .create()
+            .await?;
+
+        let server = sandbox
+            .exec_stream(
+                "/bin/sh",
+                ["-lc", "/usr/local/bin/microsandbox-entrypoint.sh"],
+            )
+            .await?;
+
+        let log_task = tokio::spawn(async move {
+            let mut server = server;
+            while let Some(event) = server.recv().await {
+                match event {
+                    ExecEvent::Stdout(data) => print!("{}", String::from_utf8_lossy(&data)),
+                    ExecEvent::Stderr(data) => eprint!("{}", String::from_utf8_lossy(&data)),
+                    ExecEvent::Exited { code } => {
+                        eprintln!("test microsandbox entrypoint exited with code {code}");
+                        break;
+                    }
+                    _ => {}
+                }
+            }
+        });
+
+        let base_url = format!("http://127.0.0.1:{host_port}");
+        let result = async {
+            wait_for_health(&base_url).await?;
+            verify_remote_connect(&base_url, client_token).await?;
+
+            let client = reqwest::Client::new();
+            let workspaces: Value = client
+                .get(format!("{base_url}/workspaces"))
+                .bearer_auth(client_token)
+                .send()
+                .await?
+                .error_for_status()?
+                .json()
+                .await?;
+            let workspace_id = workspaces
+                .get("items")
+                .and_then(Value::as_array)
+                .and_then(|items| items.first())
+                .and_then(|item| item.get("id"))
+                .and_then(Value::as_str)
+                .context("missing workspace id from /workspaces")?;
+
+            let created: Value = client
+                .post(format!("{base_url}/w/{workspace_id}/opencode/session"))
+                .bearer_auth(client_token)
+                .json(&json!({ "title": "Rust microsandbox smoke test" }))
+                .send()
+                .await?
+                .error_for_status()?
+                .json()
+                .await?;
+            let session_id = created
+                .get("id")
+                .and_then(Value::as_str)
+                .context("missing session id from session create response")?;
+
+            client
+                .get(format!(
+                    "{base_url}/w/{workspace_id}/opencode/session/{session_id}"
+                ))
+                .bearer_auth(client_token)
+                .send()
+                .await?
+                .error_for_status()?;
+
+            client
+                .get(format!(
+                    "{base_url}/w/{workspace_id}/opencode/session/{session_id}/message?limit=10"
+                ))
+                .bearer_auth(client_token)
+                .send()
+                .await?
+                .error_for_status()?;
+
+            Result::<()>::Ok(())
+        }
+        .await;
+
+        let stop_result = sandbox.stop().await;
+        let _ = tokio::time::timeout(Duration::from_secs(5), log_task).await;
+        stop_result?;
+        result
+    }
+}
diff --git a/index.html b/index.html
deleted file mode 100644
index 84dc04b5cf..0000000000
--- a/index.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>OpenWork</title>
-
-    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
-    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
-    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
-  </head>
-  <body class="bg-neutral-950 text-neutral-100">
-    <div id="root"></div>
-    <script type="module" src="/src/index.tsx"></script>
-  </body>
-</html>
diff --git a/opencode.json b/opencode.json
new file mode 100644
index 0000000000..720ece5c15
--- /dev/null
+++ b/opencode.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://opencode.ai/config.json"
+}
diff --git a/opencode.jsonc b/opencode.jsonc
new file mode 100644
index 0000000000..93679a35f8
--- /dev/null
+++ b/opencode.jsonc
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "control-chrome": {
+      "type": "local",
+      "command": [
+        "chrome-devtools-mcp"
+      ]
+    }
+  },
+  "model": "openai/gpt-5.2-codex",
+  "plugin": [
+    "opencode-scheduler"
+  ]
+}
diff --git a/openwork-logo-transparent.svg b/openwork-logo-transparent.svg
new file mode 100644
index 0000000000..bd3332b734
--- /dev/null
+++ b/openwork-logo-transparent.svg
@@ -0,0 +1,12 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_182_19)">
+<path d="M612.283 48.1887C625.496 46.0953 647.01 49.7669 659.498 54.1301C674.701 59.4419 689.252 67.9192 703.298 75.7141C718.677 84.3343 734.102 92.872 749.572 101.326C768.927 111.916 788.228 122.606 807.473 133.396C840.683 151.785 870.254 166.532 883.97 205.384C893.264 231.712 891.051 259.314 891.044 286.774L891.035 375.676L891.027 510.719C891.027 548.514 892.711 592.842 885.28 629.363C877.45 668.196 860.873 704.734 836.807 736.199C819.076 759.099 797.811 779.03 773.812 795.243C753.081 809.457 728.663 821.54 706.376 833.38L617.657 880.867L519.187 933.624C490.696 948.991 465.95 966.39 433.129 970.741C420.834 972.69 402.72 969.583 391.229 965.263C381.115 961.46 370.688 955.51 361.175 950.28L324.758 930.253L256.121 892.792C236.955 882.325 217.038 872.18 199.807 858.867C174.606 839.396 159.573 811.138 156.147 779.58C153.961 759.436 154.618 735.47 154.621 714.854L154.558 621.205L154.822 470.301C155.178 436.128 153.699 403.213 160.327 369.35C166.568 336.451 180.643 305.541 201.361 279.235C215.839 261.25 232.92 245.526 252.038 232.581C269.567 220.687 292.408 208.988 311.365 198.724L398.702 151.378L502.977 95.0881L543.077 73.4368C567.921 60.1065 583.278 51.3671 612.283 48.1887ZM833.058 194.304C823.696 186.764 810.462 183.336 798.57 184.177C771.778 187.62 742.31 206.444 718.286 219.565L628.893 268.315C589.049 289.644 549.367 311.277 509.854 333.213C493.187 342.415 468.999 354.487 453.64 364.719C437.593 375.25 423.409 388.377 411.669 403.562C393.449 427.391 381.387 455.347 376.551 484.951C373.498 502.539 373.265 522.833 373.19 540.702L373.144 586.463L373.108 737.774L373.06 834.782C373.036 850.93 372.755 867.066 373.301 883.201C374.493 918.481 396.493 935.629 430.624 933.974C454.078 931.219 483.649 912.278 504.852 900.772L597.104 850.665L686.12 802.92C707.445 791.522 728.945 780.569 749.24 767.331C798.823 734.99 835.505 681.466 848.284 623.706C855.778 589.832 854.001 552.144 854.009 517.346L854.081 399.85C854.507 364.925 854.64 329.996 854.48 295.069C854.474 284.199 854.406 273.352 854.338 262.486C854.188 238.496 853.425 210.709 833.058 194.304ZM699.028 114.926C675.263 101.784 646.691 83.1971 618.776 85.2073C589.573 87.7692 569.517 101.526 544.458 115.132L465.686 158.248L345.258 223.919C316.332 239.825 284.352 255.692 258.192 275.931C226.008 300.832 206.21 336.477 198.533 376.138C192.736 406.084 194.036 436.541 193.35 466.938C192.258 519.066 193.754 571.457 193.968 623.546L194.003 719.207C194.002 757.248 188.736 801.436 221.267 828.343C231.847 837.093 242.715 842.79 254.608 849.344L288.732 868.112L319.865 885.469C324.589 888.118 331.038 892.047 335.685 894.323L335.066 888.161C333.868 859.228 334.498 827.775 334.504 798.64L334.711 648.9L334.819 558.867C334.801 526.582 333.303 498.295 340.325 466.563C348.141 430.493 365.381 397.139 390.288 369.904C418.661 339.049 446.341 325.558 482.31 306.174L539.163 275.25L694.589 190.489L740.329 165.625C748.779 161.046 757.55 156.593 765.789 151.719L699.028 114.926Z" fill="black"/>
+<path d="M612.283 48.1887C625.496 46.0953 647.01 49.7669 659.498 54.1301C674.701 59.4419 689.252 67.9192 703.298 75.7141C718.677 84.3343 734.102 92.872 749.572 101.326C768.927 111.916 788.228 122.606 807.473 133.396C840.683 151.785 870.254 166.532 883.97 205.384C893.264 231.712 891.051 259.314 891.044 286.774L891.035 375.676L891.027 510.719C891.027 548.514 892.711 592.842 885.28 629.363C877.45 668.196 860.873 704.734 836.807 736.199C819.076 759.099 797.811 779.03 773.812 795.243C753.081 809.457 728.663 821.54 706.376 833.38L617.657 880.867L519.187 933.624C490.696 948.991 465.95 966.39 433.129 970.741C420.834 972.69 402.72 969.583 391.229 965.263C381.115 961.46 370.688 955.51 361.175 950.28L324.758 930.253L256.121 892.792C236.955 882.325 217.038 872.18 199.807 858.867C174.606 839.396 159.573 811.138 156.147 779.58C153.961 759.436 154.618 735.47 154.621 714.854L154.558 621.205L154.822 470.301C155.178 436.128 153.699 403.213 160.327 369.35C166.568 336.451 180.643 305.541 201.361 279.235C215.839 261.25 232.92 245.526 252.038 232.581C269.567 220.687 292.408 208.988 311.365 198.724L398.702 151.378L502.977 95.0881L543.077 73.4368C567.921 60.1065 583.278 51.3671 612.283 48.1887ZM833.058 194.304C823.696 186.764 810.462 183.336 798.57 184.177C771.778 187.62 742.31 206.444 718.286 219.565L628.893 268.315C589.049 289.644 549.367 311.277 509.854 333.213C493.187 342.415 468.999 354.487 453.64 364.719C437.593 375.25 423.409 388.377 411.669 403.562C393.449 427.391 381.387 455.347 376.551 484.951C373.498 502.539 373.265 522.833 373.19 540.702L373.144 586.463L373.108 737.774L373.06 834.782C373.036 850.93 372.755 867.066 373.301 883.201C374.493 918.481 396.493 935.629 430.624 933.974C454.078 931.219 483.649 912.278 504.852 900.772L597.104 850.665L686.12 802.92C707.445 791.522 728.945 780.569 749.24 767.331C798.823 734.99 835.505 681.466 848.284 623.706C855.778 589.832 854.001 552.144 854.009 517.346L854.081 399.85C854.507 364.925 854.64 329.996 854.48 295.069C854.474 284.199 854.406 273.352 854.338 262.486C854.188 238.496 853.425 210.709 833.058 194.304ZM699.028 114.926C675.263 101.784 646.691 83.1971 618.776 85.2073C589.573 87.7692 569.517 101.526 544.458 115.132L465.686 158.248L345.258 223.919C316.332 239.825 284.352 255.692 258.192 275.931C226.008 300.832 206.21 336.477 198.533 376.138C192.736 406.084 194.036 436.541 193.35 466.938C192.258 519.066 193.754 571.457 193.968 623.546L194.003 719.207C194.002 757.248 188.736 801.436 221.267 828.343C231.847 837.093 242.715 842.79 254.608 849.344L288.732 868.112L319.865 885.469C324.589 888.118 331.038 892.047 335.685 894.323L335.066 888.161C333.868 859.228 334.498 827.775 334.504 798.64L334.711 648.9L334.819 558.867C334.801 526.582 333.303 498.295 340.325 466.563C348.141 430.493 365.381 397.139 390.288 369.904C418.661 339.049 446.341 325.558 482.31 306.174L539.163 275.25L694.589 190.489L740.329 165.625C748.779 161.046 757.55 156.593 765.789 151.719L699.028 114.926Z" stroke="black"/>
+<path d="M707.136 316.628C721.059 315.692 731.348 318.341 738.451 324.629C745.562 330.925 749.575 340.951 750.75 354.977C752.107 371.153 751.571 386.95 751.565 403.22L751.606 477.994L751.608 538.359V538.36C751.633 572.695 751.503 598.89 737.268 631.095C728.146 651.702 714.527 670.004 697.41 684.661L697.409 684.662C676.943 702.314 659.598 710.334 635.98 722.932L635.978 722.933L586.056 749.815L544.081 772.435C534.514 777.579 525.114 783.188 515.06 787.067C513.944 787.441 512.739 787.881 511.654 788.086C499.816 790.33 491.415 788.801 485.444 784.882C479.468 780.96 475.838 774.585 473.666 766.955C471.493 759.325 470.794 750.489 470.643 741.717C470.492 732.925 470.89 724.301 470.896 716.971L470.927 647.705L470.959 556.256L470.955 552.466C470.837 513.478 469.04 479.71 492.344 445.513C510.52 418.843 533.546 407.36 560.949 392.612L560.951 392.61L602.102 370.225H602.103L660.639 338.258C667.632 334.456 675.45 329.791 683.469 325.685C691.468 321.589 699.592 318.09 707.136 316.628ZM713.285 496.62C644.143 531.96 575.912 571.385 507.254 607.595L506.988 607.736V608.036C506.983 613.716 506.787 647.908 506.725 681.064C506.694 697.638 506.696 713.95 506.774 726.3C506.813 732.475 506.871 737.661 506.952 741.396C506.992 743.262 507.039 744.77 507.092 745.858C507.119 746.401 507.147 746.845 507.178 747.178C507.194 747.344 507.21 747.488 507.228 747.606C507.244 747.713 507.266 747.832 507.301 747.929L507.353 748.069L507.472 748.158L507.937 748.503L508.195 748.695L508.477 748.54L607.909 693.874L607.91 693.873C618.778 687.883 631.73 681.28 644.136 674.15C656.55 667.015 668.482 659.315 677.361 651.088C692.481 637.21 703.503 619.447 709.22 599.735C711.523 591.803 713.05 583.665 713.78 575.437C714.03 572.658 714.449 554.214 714.645 535.938C714.743 526.793 714.786 517.678 714.724 510.568C714.693 507.013 714.635 503.956 714.545 501.646C714.501 500.491 714.448 499.519 714.385 498.762C714.324 498.021 714.251 497.445 714.156 497.112L714.125 497.002L714.049 496.917L713.886 496.734L713.629 496.444L713.285 496.62ZM711.494 352.851C709.637 352.076 708.003 352.436 706.092 352.578L706.015 352.583L705.944 352.612C698.889 355.425 686.232 362.852 679.152 366.748H679.151L629.312 394.263L569.9 426.668C547.09 439.062 525.912 446.909 515.215 472.603C506.341 493.917 506.996 512.768 506.979 535.002L506.955 567.674V568.538L507.704 568.109L514.16 564.408L651.968 489.63H651.969L694.011 466.743C699.714 463.658 709.097 458.251 714.832 455.792L715.136 455.662L715.135 455.33C715.038 434.764 715.049 414.198 715.169 393.633V393.63C715.172 389.759 715.464 380.757 715.231 372.222C715.115 367.951 714.866 363.773 714.382 360.388C714.14 358.696 713.837 357.189 713.458 355.96C713.082 354.746 712.613 353.744 712.004 353.12L711.945 353.06L711.868 353.022L711.494 352.851Z" fill="black" stroke="black"/>
+</g>
+<defs>
+<clipPath id="clip0_182_19">
+<rect width="1024" height="1024" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000000..75b7e570ce
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,12 @@
+{
+  "name": "@different-ai/openwork-workspace",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@different-ai/openwork-workspace",
+      "version": "0.0.0"
+    }
+  }
+}
diff --git a/package.json b/package.json
index 0a877204aa..120c1af987 100644
--- a/package.json
+++ b/package.json
@@ -1,36 +1,73 @@
 {
-  "name": "@different-ai/openwork",
+  "name": "@different-ai/openwork-workspace",
   "private": true,
-  "version": "0.1.1",
-  "type": "module",
+  "version": "0.0.0",
   "scripts": {
-    "dev": "tauri dev",
-    "build": "tauri build",
-    "dev:web": "vite",
-    "build:web": "vite build",
-    "preview": "vite preview",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test:health": "node scripts/health.mjs",
-    "test:sessions": "node scripts/sessions.mjs",
-    "test:events": "node scripts/events.mjs",
-    "test:todos": "node scripts/todos.mjs",
-    "test:permissions": "node scripts/permissions.mjs",
-    "test:e2e": "node scripts/e2e.mjs"
-  },
-  "dependencies": {
-    "@opencode-ai/sdk": "^1.1.19",
-    "@tauri-apps/api": "^2.0.0",
-    "@tauri-apps/plugin-dialog": "^2.5.0",
-    "lucide-solid": "^0.562.0",
-    "solid-js": "^1.9.0"
+    "dev": "OPENWORK_DEV_MODE=1 pnpm --filter @openwork/desktop dev",
+    "dev:electron": "OPENWORK_DEV_MODE=1 pnpm --filter @openwork/desktop dev:electron",
+    "dev:server-v2": "node scripts/dev-server-v2.mjs",
+    "dev:server-v2:server": "node scripts/dev-server-v2.mjs --no-app",
+    "dev:windows": ".\\scripts\\dev-windows.cmd",
+    "dev:windows:x64": ".\\scripts\\dev-windows.cmd x64",
+    "dev:ui": "OPENWORK_DEV_MODE=1 pnpm --filter @openwork/app dev",
+    "dev:ui-demo": "pnpm --filter @openwork/ui-demo dev",
+    "dev:story": "OPENWORK_DEV_MODE=1 pnpm --filter @openwork/story-book dev",
+    "dev:web": "pnpm run dev:den:web",
+    "dev:den": "node scripts/dev-local.mjs",
+    "dev:den-local": "pnpm run dev:den",
+    "dev:den:mysql": "docker compose -p openwork-den-local -f packaging/docker/docker-compose.web-local.yml up -d --wait mysql",
+    "dev:den:mysql:down": "docker compose -p openwork-den-local -f packaging/docker/docker-compose.web-local.yml down",
+    "dev:den:db-push": "sh -lc 'DATABASE_URL=${DATABASE_URL:-mysql://root:password@127.0.0.1:3306/openwork_den} DEN_DB_ENCRYPTION_KEY=${DEN_DB_ENCRYPTION_KEY:-local-dev-db-encryption-key-please-change-1234567890} pnpm --filter @openwork-ee/den-db db:push'",
+    "dev:den:api": "sh -lc 'DEN_WEB_PORT=${DEN_WEB_PORT:-3005}; OPENWORK_APP_PORT=${OPENWORK_APP_PORT:-5173}; DEN_LOCAL_ORIGINS=http://localhost:$DEN_WEB_PORT,http://127.0.0.1:$DEN_WEB_PORT,http://localhost:$OPENWORK_APP_PORT,http://127.0.0.1:$OPENWORK_APP_PORT; OPENWORK_DEV_MODE=1 PORT=${DEN_API_PORT:-8790} DATABASE_URL=${DATABASE_URL:-mysql://root:password@127.0.0.1:3306/openwork_den} DEN_DB_ENCRYPTION_KEY=${DEN_DB_ENCRYPTION_KEY:-local-dev-db-encryption-key-please-change-1234567890} BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-local-dev-secret-not-for-production-use!!} BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:$DEN_WEB_PORT} DEN_BETTER_AUTH_TRUSTED_ORIGINS=${DEN_BETTER_AUTH_TRUSTED_ORIGINS:-$DEN_LOCAL_ORIGINS} CORS_ORIGINS=${CORS_ORIGINS:-$DEN_LOCAL_ORIGINS} PROVISIONER_MODE=${PROVISIONER_MODE:-stub} pnpm --filter @openwork-ee/den-api dev:local'",
+    "dev:den:web": "sh -lc 'DEN_API_PORT=${DEN_API_PORT:-8790}; DEN_WEB_PORT=${DEN_WEB_PORT:-3005}; OPENWORK_DEV_MODE=1 NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= DEN_API_BASE=${DEN_API_BASE:-http://localhost:$DEN_API_PORT} DEN_AUTH_ORIGIN=${DEN_AUTH_ORIGIN:-http://localhost:$DEN_WEB_PORT} DEN_AUTH_FALLBACK_BASE=${DEN_AUTH_FALLBACK_BASE:-http://localhost:$DEN_API_PORT} pnpm --filter @openwork-ee/den-web dev:local'",
+    "dev:den-docker": "bash packaging/docker/den-dev-up.sh",
+    "dev:den:seed-demo": "pnpm --filter @openwork-ee/den-api seed:demo-org",
+    "dev:headless-web": "OPENWORK_DEV_MODE=1 bun scripts/dev-headless-web.ts",
+    "build": "node scripts/build.mjs",
+    "build:ui": "pnpm --filter @openwork/app build",
+    "build:web": "pnpm --filter @openwork-ee/den-web build",
+    "preview": "pnpm --filter @openwork/app preview",
+    "sdk:generate": "pnpm --filter openwork-server-v2 openapi:generate && pnpm --filter @openwork/server-sdk generate",
+    "sdk:watch": "pnpm --filter @openwork/server-sdk watch",
+    "contract:check": "node scripts/check-server-v2-contract.mjs",
+    "typecheck": "pnpm run sdk:generate && pnpm --filter @openwork/app typecheck",
+    "test:health": "pnpm --filter @openwork/app test:health",
+    "test:sessions": "pnpm --filter @openwork/app test:sessions",
+    "test:refactor": "pnpm --filter @openwork/app test:refactor",
+    "test:events": "pnpm --filter @openwork/app test:events",
+    "test:todos": "pnpm --filter @openwork/app test:todos",
+    "test:permissions": "pnpm --filter @openwork/app test:permissions",
+    "test:session-error-recovery": "pnpm --filter @openwork/app test:session-error-recovery",
+    "test:session-scope": "pnpm --filter @openwork/app test:session-scope",
+    "test:session-switch": "pnpm --filter @openwork/app test:session-switch",
+    "test:fs-engine": "pnpm --filter @openwork/app test:fs-engine",
+    "test:e2e": "pnpm --filter @openwork/app test:e2e",
+    "test:orchestrator": "pnpm --filter openwork-orchestrator test:router",
+    "bump:patch": "pnpm --filter @openwork/app bump:patch",
+    "bump:minor": "pnpm --filter @openwork/app bump:minor",
+    "bump:major": "pnpm --filter @openwork/app bump:major",
+    "bump:set": "pnpm --filter @openwork/app bump:set",
+    "release:review": "node scripts/release/review.mjs",
+    "release:prepare": "node scripts/release/prepare.mjs",
+    "release:prepare:dry": "node scripts/release/prepare.mjs --dry-run",
+    "release:ship": "node scripts/release/ship.mjs",
+    "release:ship:watch": "node scripts/release/ship.mjs --watch",
+    "tauri": "pnpm --filter @openwork/desktop exec tauri"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.0.0",
-    "autoprefixer": "^10.4.20",
-    "postcss": "^8.5.0",
-    "tailwindcss": "^3.4.17",
-    "typescript": "^5.6.3",
-    "vite": "^6.0.1",
-    "vite-plugin-solid": "^2.11.0"
-  }
+    "turbo": "^2.5.5"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@whiskeysockets/baileys",
+      "better-sqlite3",
+      "electron",
+      "esbuild",
+      "protobufjs"
+    ],
+    "patchedDependencies": {
+      "@solidjs/router@0.15.4": "patches/@solidjs__router@0.15.4.patch"
+    }
+  },
+  "packageManager": "pnpm@10.27.0"
 }
diff --git a/packages/app/pr/persistent-openwork-server-token-persistence.md b/packages/app/pr/persistent-openwork-server-token-persistence.md
new file mode 100644
index 0000000000..d919a36cb2
--- /dev/null
+++ b/packages/app/pr/persistent-openwork-server-token-persistence.md
@@ -0,0 +1,22 @@
+# Persistent OpenWork share tokens
+
+## Why
+- Reopening the desktop app regenerated the OpenWork server's collaborator token and minted a new owner token.
+- That made the same local worker show different share codes after a full app quit and restart.
+
+## What changed
+- The desktop app now stores the OpenWork server token set per workspace in the app data directory.
+- The stored collaborator token and host token are reused when the same workspace starts again.
+- The owner token is minted once, cached alongside that workspace, and shown again on later launches instead of creating a new one.
+
+## Verification
+- `cargo test --lib` in `packages/desktop/src-tauri`
+- `cargo test openwork_server::tests::legacy_unpersisted_tokens_change_between_starts --lib -- --exact --nocapture`
+- `cargo test openwork_server::tests::reuses_tokens_for_the_same_workspace_after_restart --lib -- --exact --nocapture`
+
+## Before / after screenshots
+- Before: `packages/app/pr/screenshots/persistent-openwork-tokens/before-restart-token-change.png`
+- After: `packages/app/pr/screenshots/persistent-openwork-tokens/after-restart-token-stable.png`
+
+## Notes
+- I did not run the Docker + Chrome MCP end-to-end flow for this change because the behavior lives in the desktop Tauri host path, not the web stack. The verification here exercises the token lifecycle directly in the desktop Rust code.
diff --git a/packages/app/pr/screenshots/den-api-keys/api-key-created.png b/packages/app/pr/screenshots/den-api-keys/api-key-created.png
new file mode 100644
index 0000000000..ae2c820f0b
Binary files /dev/null and b/packages/app/pr/screenshots/den-api-keys/api-key-created.png differ
diff --git a/packages/app/pr/screenshots/den-api-keys/api-key-deleted.png b/packages/app/pr/screenshots/den-api-keys/api-key-deleted.png
new file mode 100644
index 0000000000..eb185d3b5a
Binary files /dev/null and b/packages/app/pr/screenshots/den-api-keys/api-key-deleted.png differ
diff --git a/packages/app/pr/screenshots/den-api-keys/api-keys-page.png b/packages/app/pr/screenshots/den-api-keys/api-keys-page.png
new file mode 100644
index 0000000000..b02c1d441a
Binary files /dev/null and b/packages/app/pr/screenshots/den-api-keys/api-keys-page.png differ
diff --git a/packages/app/pr/screenshots/den-invite-confirmation/after-join-dashboard.png b/packages/app/pr/screenshots/den-invite-confirmation/after-join-dashboard.png
new file mode 100644
index 0000000000..d0f22b32d7
Binary files /dev/null and b/packages/app/pr/screenshots/den-invite-confirmation/after-join-dashboard.png differ
diff --git a/packages/app/pr/screenshots/den-invite-confirmation/before-signup.png b/packages/app/pr/screenshots/den-invite-confirmation/before-signup.png
new file mode 100644
index 0000000000..31ff41be24
Binary files /dev/null and b/packages/app/pr/screenshots/den-invite-confirmation/before-signup.png differ
diff --git a/packages/app/pr/screenshots/den-invite-confirmation/join-confirmation.png b/packages/app/pr/screenshots/den-invite-confirmation/join-confirmation.png
new file mode 100644
index 0000000000..54eb2b798c
Binary files /dev/null and b/packages/app/pr/screenshots/den-invite-confirmation/join-confirmation.png differ
diff --git a/packages/app/pr/screenshots/persistent-openwork-tokens/after-restart-token-stable.png b/packages/app/pr/screenshots/persistent-openwork-tokens/after-restart-token-stable.png
new file mode 100644
index 0000000000..e826f1c49a
Binary files /dev/null and b/packages/app/pr/screenshots/persistent-openwork-tokens/after-restart-token-stable.png differ
diff --git a/packages/app/pr/screenshots/persistent-openwork-tokens/before-restart-token-change.png b/packages/app/pr/screenshots/persistent-openwork-tokens/before-restart-token-change.png
new file mode 100644
index 0000000000..d5fc2378f7
Binary files /dev/null and b/packages/app/pr/screenshots/persistent-openwork-tokens/before-restart-token-change.png differ
diff --git a/packages/app/src/app/lib/deep-link-bridge.ts b/packages/app/src/app/lib/deep-link-bridge.ts
new file mode 100644
index 0000000000..a0b716dcf4
--- /dev/null
+++ b/packages/app/src/app/lib/deep-link-bridge.ts
@@ -0,0 +1,43 @@
+export const deepLinkBridgeEvent = "openwork:deep-link";
+export const nativeDeepLinkEvent = "openwork:deep-link-native";
+
+export type DeepLinkBridgeDetail = {
+  urls: string[];
+};
+
+declare global {
+  interface Window {
+    __OPENWORK__?: {
+      deepLinks?: string[];
+    };
+  }
+}
+
+function normalizeDeepLinks(urls: readonly string[]): string[] {
+  return urls.map((url) => url.trim()).filter(Boolean);
+}
+
+export function pushPendingDeepLinks(target: Window, urls: readonly string[]): string[] {
+  const normalized = normalizeDeepLinks(urls);
+  if (normalized.length === 0) {
+    return [];
+  }
+
+  target.__OPENWORK__ ??= {};
+  const pending = target.__OPENWORK__.deepLinks ?? [];
+  target.__OPENWORK__.deepLinks = [...pending, ...normalized];
+  target.dispatchEvent(
+    new CustomEvent<DeepLinkBridgeDetail>(deepLinkBridgeEvent, {
+      detail: { urls: normalized },
+    }),
+  );
+  return normalized;
+}
+
+export function drainPendingDeepLinks(target: Window): string[] {
+  const pending = target.__OPENWORK__?.deepLinks ?? [];
+  if (target.__OPENWORK__) {
+    target.__OPENWORK__.deepLinks = [];
+  }
+  return [...pending];
+}
diff --git a/packages/docs/changelog.mdx b/packages/docs/changelog.mdx
new file mode 100644
index 0000000000..56e20cd613
--- /dev/null
+++ b/packages/docs/changelog.mdx
@@ -0,0 +1,263 @@
+---
+title: "Changelog"
+---
+<Update label="April 20th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.212](https://github.com/different-ai/openwork/compare/v0.11.210...v0.11.212): Den desktop controls tighten and Cloud providers stay in sync
+
+  - Better org controls: Organization owners can now limit or block models, providers, and updates to specific releases.
+  - Auto-sync cloud providers into the active org workspace. The app should be able to update, remove, and reconcile disconnects more reliably.
+  - Improved admin flows in the cloud, with explicit names for LLM providers and a more robust active-org handling.
+
+</Update>
+
+<Update label="April 20th" tags={["🚀 New Features"]}>
+
+  ## [v0.11.210](https://github.com/different-ai/openwork/compare/v0.11.207...v0.11.210): Den enterprise org controls expand and microsandbox preview lands
+
+  - Added a microsandbox preview mode. Toggle in `Settings` > `Advanced` to enable it and test it out. That means no more docker as requirement to create fast, isolated workspaces.
+  - Openwork Organization owners can now define allowed email domains. Active-Org-Aware Desktop sign-in, and rename their org. 
+  - Better control for Org owners regarding who accepts invites and invite delivery failures.
+  - Quality of life: Added Spanish and Catalan localization, a shortcut to access the docs in the app and made the landing page easier to read for agents.
+
+</Update>
+
+<Update label="April 13th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.207](https://github.com/different-ai/openwork/compare/v0.11.206...v0.11.207): Windows downloads return and OpenWork speaks French
+
+  - Restored free public Windows desktop downloads across the landing and download flows so Windows users can download installers again without a paid checkout path.
+  - Added French localization for the OpenWork app so users can navigate core product surfaces in French.
+
+</Update>
+
+<Update label="April 7th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.205](https://github.com/different-ai/openwork/compare/v0.11.202...v0.11.205): OpenWork Cloud launches for teams
+
+  - OpenWork Cloud now has orgs, teams, shared skills and workers.
+  - Added custom LLM providers so everyone in the company can use the same org-approved LLMs in Openwork.
+  - As an org admin, you can control members, invitations, teams, and custom RBAC roles for your company.
+
+  <table>
+    <tr>
+      <td>
+        <img src="/images/cloud-dashboard-overview.png" alt="OpenWork Cloud dashboard overview" />
+        <p><em>OpenWork Cloud</em></p>
+      </td>
+      <td>
+        <img src="/images/cloud-skill-hub-access-and-skills.png" alt="Skill hub access and included skills in OpenWork Cloud" />
+        <p><em>Shared skills</em></p>
+      </td>
+    </tr>
+  </table>
+
+</Update>
+
+<Update label="April 4th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.202](https://github.com/different-ai/openwork/compare/v0.11.200...v0.11.202): Translations support for several languages
+
+  - Added Thai and Japanese in-app translations
+  - Additional documentation, privacy, terms and conditions.
+
+</Update>
+
+<Update label="April 3rd" tags={["🚀 New Features"]}>
+
+  ## [v0.11.200](https://github.com/different-ai/openwork/compare/v0.11.199...v0.11.200): Minor improvements around Cloud skills
+
+  - Added an OpenWork Cloud skills catalog to the Skills page. 
+
+</Update>
+
+<Update label="April 2nd" tags={["🚀 New Features", "🐛 Bug Fixes", "🏗️ Refactoring"]}>
+
+  ## [v0.11.199](https://github.com/different-ai/openwork/compare/v0.11.198...v0.11.199): Paywall for windows, skillsHub
+
+  - Added a pricing page for Windows versions. 
+  - Expanded Den with skill hubs, a new `den-api`, and a simpler org-invite signup flow.
+
+</Update>
+
+<Update label="March 31st" tags={["🐛 Bug Fixes"]}>
+
+  ## [v0.11.198](https://github.com/different-ai/openwork/compare/v0.11.196...v0.11.198): Improved workspace export security 
+
+  - Blocked sensitive workspace exports and showed warnings before sharing risky config or secrets.
+  - Trusted bundle imports only from the configured publisher unless users explicitly choose a warning-backed manual path.
+
+</Update>
+
+<Update label="March 30th" tags={["🚀 New Features", "🐛 Bug Fixes", "🏗️ Refactoring"]}>
+
+  ## [v0.11.196](https://github.com/different-ai/openwork/compare/v0.11.194...v0.11.196): OpenWork resumes where you left off
+
+  - Moved automations onto a dedicated page inside settings.
+  - Got rid of the initial loading state on app open.
+
+</Update>
+
+<Update label="March 26th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.194](https://github.com/different-ai/openwork/compare/v0.11.192...v0.11.194): Team template sharing and autocompaction
+
+  - Auto compaction is done into the workspace config.
+  - Keeps scheduled jobs live in-app, and adds a faster Den local-dev path.
+  - Introduces Den organizations, member roles, invitations, custom roles, and org-scoped template APIs and screens.
+
+</Update>
+
+<Update label="March 25th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.192](https://github.com/different-ai/openwork/compare/v0.11.190...v0.11.192): Better Workspace switching and detached workers
+
+  - Switching a workspace no longer  flips the active worker.
+  - Detached workers share credentials are now preserved across restarts
+
+</Update>
+
+<Update label="March 24th" tags={["🐛 Bug Fixes", "🚀 New Features"]}>
+
+  ## [v0.11.190](https://github.com/different-ai/openwork/compare/v0.11.184...v0.11.190): More docs, improved safety around sharing.
+
+  - More docs regarding onboarding and connection guides
+  - Better restart and reconnect flows so it stays attached to the intended directory.
+  - Local workers now stay localhost-only unles users opt into remote exposure
+
+</Update>
+
+<Update label="March 23rd" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.184](https://github.com/different-ai/openwork/compare/v0.11.181...v0.11.184): Docs reset, exa and local workspaces
+
+  - Rebuilt the docs around a single CLI-first quickstart.
+  - Enables Exa search from opencode settings.
+  - More reliable first-runs and simplified remote connect modal.
+
+</Update>
+
+<Update label="March 22nd" tags={["🐛 Bug Fixes", "🏗️ Refactoring", "🚀 New Features"]}>
+
+  ## [v0.11.181](https://github.com/different-ai/openwork/compare/v0.11.177...v0.11.181): Simplified den checkout and workspace sharing
+
+  - Simplifies Den billing, dashboard and workspace creation flows.
+  - Made model pickers model-aware with provider icons and per-model reasoning or behavior controls.
+
+</Update>
+
+<Update label="March 20th" tags={["🐛 Bug Fixes", "🚀 New Features", "🏗️ Refactoring"]}>
+
+  ## [v0.11.177](https://github.com/different-ai/openwork/compare/v0.11.172...v0.11.177): Cloud worker heartbeats
+
+  - Adds worker heartbeats for Cloud workers
+  - Added Settings-based folder authorization and server-backed empty states
+
+</Update>
+
+<Update label="March 19th" tags={["🐛 Bug Fixes", "🏗️ Refactoring", "🚀 New Features"]}>
+
+  ## [v0.11.172](https://github.com/different-ai/openwork/compare/v0.11.168...v0.11.172): Remote reconnects and cloud flows
+
+  - Rebuilt Den webapp onboarding and billing.
+  - Persisted worker share tokens and repeated deeplinks across restarts.
+  - Added self-serve Cloud settings, OpenAI headless auth, and tray-on-close desktop behavior.
+
+</Update>
+
+<Update label="March 17th" tags={["🐛 Bug Fixes", "🚀 New Features"]}>
+
+  ## [v0.11.168](https://github.com/different-ai/openwork/compare/v0.11.164...v0.11.168): Release recovery with repaired installers
+  - Cloud Migration from render VMs to Daytona Sandbox workers
+  - pnpm web:dev-local working reliably when starting from scratch in a new worktree 
+  - Restored Shared bundle installs and better cache clearing of disconnected provider credentials.
+
+</Update>
+
+<Update label="March 16th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.164](https://github.com/different-ai/openwork/compare/v0.11.160...v0.11.164): Public skills and subagents
+
+  - You can now add public repos as skill repository
+  - Simplified docker testing pipeline
+  - Minor sidebar bug fixes
+  
+</Update>
+
+<Update label="March 15th" tags={["🐛 Bug Fixes", "🚀 New Features"]}>
+
+  ## [v0.11.160](https://github.com/different-ai/openwork/compare/v0.11.159...v0.11.160): Bug fixes on den, telemetry and providers
+
+  - Checkout handling for additional den workers
+  - Landing page downloads points tot he right installer
+  - Fixed release-pipeline diagnostics and in-app feedback email
+  
+
+</Update>
+
+<Update label="March 14th" tags={["🐛 Bug Fixes", "🚀 New Features", "🏗️ Refactoring"]}>
+
+  ## [v0.11.149](https://github.com/different-ai/openwork/compare/v0.11.146...v0.11.149): Better share page, den onboarding flow and Oath
+
+  - Simplified Den onboarding flow and openworkshare page to publish a single skill
+  - More polished feedback card and telemetry around bug reporting. 
+  - Shared skills can now be imported into existing workers. 
+  - ChatGPT Oath added to "New chat Session"
+
+    <img src="/images/chatgpt-new-session-cta.png" alt="New session with Connect ChatGPT for free CTA" />
+
+</Update>
+
+<Update label="March 13th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.146](https://github.com/different-ai/openwork/compare/v0.11.1444...v0.11.146): Den admin view and Aesthetic changes 
+
+  - Den worker redeploys, better dekstop skill reload and adjustable sidebar width. 
+
+</Update>
+
+<Update label="March 12th" tags={["🐛 Bug Fixes", "🚀 New Features", "🏗️ Refactoring"]}>
+
+  ## [v0.11.144](https://github.com/different-ai/openwork/compare/v0.11.140...v0.11.144): Workspace shell recovery and clearer docs entrypoints
+
+  - Improved workspace shell recovery and inline error sessions
+  - Cloud worker creation
+  - Deprecated soul mode
+
+</Update>
+
+<Update label="March 11th" tags={["🚀 New features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.140](https://github.com/different-ai/openwork/compare/v0.11.136...v0.11.140): Improved workers, sharing skills, GOAuth
+
+  - Creating a new worker opens up an empty session instead of automations
+  - Share skills with one click at share.openworklabs.com
+  - Task list not sticking to the composer box
+  - Google and GitHub
+
+  <img src="/images/improved-skills-march11th.gif" alt="New worker opens on an empty session" />
+
+</Update>
+
+<Update label="March 10th" tags={["🚀 New Features", "🐛 Bug Fixes"]}>
+
+  ## [v0.11.136](https://github.com/different-ai/openwork/compare/v0.11.135...v0.11.136): Improved model picker, Share and MCP auth
+
+  - Model picker now separates enabled and not-enabled providers, and clicking a disabled provider opens its settings.
+  - OpenWork Share now packages dropped skills, agents, commands, and MCP or OpenWork config into worker bundles.
+  - MCP auth now waits for agents to stop or finish before continuing.
+
+  <table>
+    <tr>
+      <td>
+        <img src="/images/10thMarch-model-picker.gif" alt="Model picker grouped by enabled and not-enabled providers" />
+        <p><em>Model picker</em></p>
+      </td>
+      <td>
+        <img src="/images/10thMarch-better-mcp-auth.gif" alt="MCP settings with connected provider and improved auth handling" />
+        <p><em>MCP auth</em></p>
+      </td>
+    </tr>
+  </table>
+
+</Update>
diff --git a/packages/docs/cloud/enterprise.mdx b/packages/docs/cloud/enterprise.mdx
new file mode 100644
index 0000000000..2efd132404
--- /dev/null
+++ b/packages/docs/cloud/enterprise.mdx
@@ -0,0 +1,21 @@
+---
+title: "Enterprise"
+description: "Deploy OpenWork on your own infrastructure"
+---
+
+Want to run OpenWork on your own infra? We'll help you get there.
+
+OpenWork can be deployed inside your VPC or on-prem, with SSO, audit logs, and controls over which models and tools your team can use. If you're exploring a self-hosted or private-cloud rollout, talk to us.
+
+<Card title="Book a call with our team" icon="calendar" href="https://calendar.app.google/86QpCENvhfEzDFLu5">
+  Schedule a 30-minute intro at [calendar.app.google/86QpCENvhfEzDFLu5](https://calendar.app.google/86QpCENvhfEzDFLu5) to scope your deployment.
+</Card>
+
+## What we'll cover
+
+- Your target environment (cloud provider, VPC, on-prem)
+- Identity, access, and audit requirements
+- Model and tool allowlists
+- Rollout plan and support model
+
+Prefer email? Reach us at [team@openworklabs.com](mailto:team@openworklabs.com?subject=Enterprise%20deployment).
diff --git a/packages/docs/cloud/get-started.mdx b/packages/docs/cloud/get-started.mdx
new file mode 100644
index 0000000000..353c400dc2
--- /dev/null
+++ b/packages/docs/cloud/get-started.mdx
@@ -0,0 +1,53 @@
+---
+title: "Get started with OpenWork Cloud"
+description: "Connect the desktop app to your OpenWork Cloud org and unlock shared workspaces, skill hubs, and shared providers"
+---
+
+OpenWork Cloud requires an active subscription at [app.openworklabs.com](https://app.openworklabs.com/).
+It is intended for teams what want to share `SKILLs.md`, `MCPs` and `configs`. 
+
+
+First, you should connect your desktop app with Openwork Cloud.
+
+<Frame>
+  ![OpenWork Cloud org settings with organization identity, allowed email domains, and desktop restrictions](/images/cloud-org-settings.png)
+</Frame>
+
+1. Open [app.openworklabs.com](https://app.openworklabs.com/) in your browser.
+2. Click `Create organization`.
+3. Enter your org name.
+4. Finish checkout if OpenWork Cloud asks for billing.
+5. Return to the desktop app and refresh `Active org`.
+
+Once you're there, you can configure the settings for the organization.
+
+## Configure org settings
+
+Note: You need to be logged in as an `org_owner` in order to make modifications.
+
+1. Open the `dashboard/org_settings` [page](https://app.openworklabs.com/dashboard/org-settings) in the cloud app.
+2. Set the name for your organization
+3. Optional: enable `Restrict allowed email domains` and add the approved domains.
+4. Optional: change any `Desktop restrictions` that should apply after people sign in from the desktop app.
+
+These settings apply across the org. You can also create teams, share workspaces, install org skills or skill hubs, and import shared providers.
+
+Next, you want to make sure you can sign in the desktop app.
+
+## Sign in from the desktop app
+
+1. Open `Settings -> Cloud`.
+2. Click `Sign in`.
+3. Finish sign-in in your browser.
+4. If the browser does not return to OpenWork automatically, click `Paste sign-in code`, paste the `openwork://den-auth?...` link or one-time code from OpenWork Cloud, then click `Finish sign-in`.
+
+## Choose your organization
+
+After sign-in, pick your org in `Settings -> Cloud -> Active org`.
+
+## What to do next
+
+- Use [Skill hubs](/cloud/share-with-your-team/skill-hubs) to publish grouped skills for teams, or save a single skill directly from the desktop app and install it from `Skills -> Cloud`.
+- Use [Shared workspaces](/cloud/run-in-the-cloud/shared-workspace) to deploy hosted OpenWork runtimes that teammates can open from the desktop app.
+- Use [LLM providers](/cloud/share-with-your-team/managed-llm-provider) or [custom LLM providers](/cloud/share-with-your-team/custom-llm-provider) to manage shared model access.
+- Use [Members and RBAC](/cloud/members-and-rbac) to invite people, create teams, and control access.
diff --git a/packages/docs/cloud/members-and-rbac.mdx b/packages/docs/cloud/members-and-rbac.mdx
new file mode 100644
index 0000000000..347afa65e7
--- /dev/null
+++ b/packages/docs/cloud/members-and-rbac.mdx
@@ -0,0 +1,75 @@
+---
+title: "Managing members and RBAC"
+description: "Invite teammates, create teams, and control Cloud access with owners, admins, members, and custom roles"
+---
+
+OpenWork Cloud separates org membership from team assignment. Teams are used for skill hub and provider access; roles control what a person can manage across the org.
+
+## Default roles
+
+OpenWork Cloud comes with three default roles:
+
+- `Owner`: full org control, including member roles and custom roles.
+- `Admin`: can invite people, manage teams, and manage most shared Cloud resources.
+- `Member`: can use resources shared with them but cannot manage org administration.
+
+Only `Owner` can change member roles, remove members, or create, edit, and delete custom roles.
+
+## Invite members
+
+1. Open `Members`.
+2. On the `Members` or `Invitations` tab, click `Add member` or `Invite member`.
+3. Enter the teammate `Email`.
+4. Choose the initial `Role`.
+5. Click `Send invite`.
+
+<Frame>
+  ![Members and RBAC dashboard in OpenWork Cloud](/images/cloud-members-and-rbac-dashboard.png)
+</Frame>
+
+Invites are tied to the invited email address.
+
+## Restrict who can join
+
+If you only want teammates from specific companies or domains to join:
+
+1. Open `Org settings`.
+2. Turn on `Restrict allowed email domains`.
+3. Add each approved domain to the `Domain allowlist`.
+4. Click `Save settings`.
+
+When this is enabled, OpenWork Cloud only lets people join with email addresses from the approved domains. Existing invites still target a specific email address, so both checks apply: the invitee must use the invited email address and that address must match the allowlist.
+
+## Create teams
+
+1. Open `Members -> Teams`.
+2. Click `Create Team`.
+3. Set `Team name`.
+4. Choose `Team members`.
+5. Click `Create team`.
+
+You can use teams to control access to skill hubs and LLM providers without assigning people one by one.
+
+## Use custom roles when needed
+
+1. Open `Members -> Roles`.
+2. Click `Create role`.
+3. Enter `Role name`.
+4. Choose the permissions that role should have.
+5. Click `Create role`.
+
+## Practical access pattern
+
+A simple setup that works well for most orgs:
+
+- keep 1-2 `Owner` users
+- give day-to-day operators `Admin`
+- keep most people as `Member`
+- use `Teams` to decide who can see specific skill hubs or providers
+
+## Notes
+
+- You cannot change the org owner's role or remove the owner.
+- Owners and admins can manage teams and invitations, but only owners can handle the sensitive RBAC changes.
+- Only owners can change `Org settings`, including allowed email domains and desktop restrictions.
+- You cannot delete a custom role while members or pending invitations still use it.
diff --git a/packages/docs/cloud/run-in-the-cloud/cloud-mcp.mdx b/packages/docs/cloud/run-in-the-cloud/cloud-mcp.mdx
new file mode 100644
index 0000000000..434feac755
--- /dev/null
+++ b/packages/docs/cloud/run-in-the-cloud/cloud-mcp.mdx
@@ -0,0 +1,62 @@
+---
+title: "Connect OpenWork Cloud MCP"
+description: "Use the hosted OpenWork Cloud MCP server from OpenWork or another OAuth-capable MCP client"
+---
+
+OpenWork Cloud exposes a hosted MCP server at `https://api.openworklabs.com/mcp`. Add it to an MCP client when you want agents to use your OpenWork Cloud organization, skills, plugins, marketplaces, workers, and other Cloud API resources through MCP tools.
+
+The server uses OAuth. Your MCP client opens a browser, you sign in to OpenWork Cloud, choose the organization to authorize, and the client stores the returned token.
+
+## MCP config
+
+Add this server to your MCP config:
+
+```json
+{
+  "mcp": {
+    "openwork-cloud": {
+      "type": "remote",
+      "enabled": true,
+      "url": "https://api.openworklabs.com/mcp",
+      "oauth": {}
+    }
+  }
+}
+```
+
+If your client expects the server map directly, use just the server entry:
+
+```json
+{
+  "openwork-cloud": {
+    "type": "remote",
+    "enabled": true,
+    "url": "https://api.openworklabs.com/mcp",
+    "oauth": {}
+  }
+}
+```
+
+## Authorize access
+
+1. Save the MCP config in your client.
+2. Start the client's MCP auth flow for `openwork-cloud`.
+3. Sign in at `app.openworklabs.com` when the browser opens.
+4. Choose the OpenWork Cloud organization that should receive MCP access.
+5. Return to your MCP client after authorization completes.
+
+The token is scoped to the organization you select during OAuth. If you need to switch organizations, remove the stored MCP auth token in your client and run the auth flow again.
+
+## What the server exposes
+
+The hosted MCP server exposes OpenWork Cloud API tools for normal product resources, including config objects, connectors, plugins, marketplaces, skill hubs, skills, workers, members, roles, teams, and LLM providers.
+
+It intentionally does not expose authentication internals, admin-only system routes, webhooks, API-key creation or deletion, or credential-returning endpoints.
+
+## Requirements
+
+- An OpenWork Cloud account and organization.
+- An MCP client that supports remote Streamable HTTP MCP servers.
+- OAuth support in the MCP client, including browser-based authorization.
+
+If your client does not support OAuth for remote MCP servers, it cannot connect to `openwork-cloud` yet.
diff --git a/packages/docs/cloud/run-in-the-cloud/connect-slack.mdx b/packages/docs/cloud/run-in-the-cloud/connect-slack.mdx
new file mode 100644
index 0000000000..1bdfe92ecd
--- /dev/null
+++ b/packages/docs/cloud/run-in-the-cloud/connect-slack.mdx
@@ -0,0 +1,97 @@
+---
+title: "Connecting Slack to your workspace"
+description: "Learn how to connect Slack with your workspace"
+---
+
+In order to connect `slack` with your openwork `workspace`, you will need the following:
+
+1. Valid slack admin permissions to add an app
+2. Create a simple slack app
+3. Connect said slack app with your workspace
+
+This is one of the most relevant and meaningful applications of Openwork, and we use it daily ourselves.
+
+> **Disclaimer:** We recommend setting the slackbot with a remote workspace instead of in your local machine to ensure there's `hardware isolation` between the remote workspace the ai can access and your local machine.
+
+For team-owned Slack or other long-running connectors, you can host the runtime in an OpenWork Cloud [shared workspace](/cloud/run-in-the-cloud/shared-workspace) instead of keeping it on a laptop or self-managed server.
+
+## Having the right slack permissions
+
+You should either be a slack `owner`, `admin` or have the right level of approval to be able to add an app into slack.
+
+## Creating a slack app
+
+Go to [Create new app](https://api.slack.com/apps?new_app=1) in Slack. What you need to obtain are the `xoxb` (bot) and `xapp` (Websocket) tokens to paste into Openwork. For more guidelines, questions and instructions regarding slack, please follow [own slack's own documentation.](https://docs.slack.dev/tools/bolt-python/building-an-app)
+
+1. Create the App Manifest: Go to `api.slack.com/apps` → `Create New App` → `From a manifest` → pick your workspace.
+2. Install to Workspace & Grab Tokens After creating the app:
+
+- Install App — `sidebar` → `Install App` → `Install to Workspace` → authorize.
+- Copy the Bot token (`xoxb-...`) — shown right on the "Install App" page after authorization.
+
+3. Generate an App-Level Token (for Socket Mode)
+
+- Sidebar → `Basic Information` → scroll to `App-Level Tokens`.
+- Click Generate Token and Scopes → add scope `connections:write` → name it anything → Generate.
+- This gives you the `xapp-` token that we use to open the websocket connection.
+
+> Note: We're sharing a `template manifest` at the end of this tutorial for you to use directly
+
+## Connecting the slackbot with the workspace
+
+Now, once you have both of these tokens, you can directly paste them into the app.
+
+<Frame>
+  ![Slack messaging settings with bot and app token fields](/images/slack-connect-tokens.png)
+
+  Paste you `xorb-` and `xapp-` tokens into `Settings` \> `messaging`
+</Frame>
+
+## Send test message
+
+Test the bot by sending a message. It should respond instantly indicating that a new session has been initiatied and then send the actual response afterwards. For now, you will have to use `@slack-bot-name` every time you want to talk to it.
+
+<Frame>
+  ![Slack thread showing the bot reply to a test message](/images/slack-test-message-thread.png)
+</Frame>
+
+## Template Manifest Example
+
+Feel free to use this as a template (or modify it accordingly according to your own use-case)
+
+```yaml
+display_information:
+  name: MyBot
+  description: Your description
+  background_color: "#000000"
+features:
+  bot_user:
+    display_name: your-display-name
+    always_online: false
+oauth_config:
+  scopes:
+    bot:
+      - assistant:write
+      - app_mentions:read
+      - channels:read
+      - channels:history
+      - chat:write
+      - files:read
+      - files:write
+      - im:history
+      - links:read
+      - links:write
+      - lists:read
+      - lists:write
+  pkce_enabled: false
+settings:
+  event_subscriptions:
+    bot_events:
+      - app_mention
+      - message.im
+  interactivity:
+    is_enabled: true
+  org_deploy_enabled: false
+  socket_mode_enabled: true
+  token_rotation_enabled: false
+```
diff --git a/packages/docs/cloud/run-in-the-cloud/shared-workspace.mdx b/packages/docs/cloud/run-in-the-cloud/shared-workspace.mdx
new file mode 100644
index 0000000000..1cea5fd9b5
--- /dev/null
+++ b/packages/docs/cloud/run-in-the-cloud/shared-workspace.mdx
@@ -0,0 +1,35 @@
+---
+title: "Deploying a shared workspace"
+description: "Launch a cloud worker in OpenWork Cloud and open it from the desktop app"
+---
+
+OpenWork Cloud currently labels shared workers as `Shared Workspaces` in the web dashboard. Once the workspace is ready, the desktop app opens it through the normal remote connect flow.
+
+## Deploy the shared workspace
+
+1. Open your org dashboard and go to `Shared Workspace`.
+2. Click `Add workspace`.
+3. Wait until the status becomes `Ready`.
+4. Click `Connect`.
+
+From the connection drawer you can choose `Open in desktop`, `Open in web`, or copy the `Connection URL` plus `Owner token` / `Client token`.
+
+## Open it from the desktop app
+
+You can open Cloud-hosted workspaces from either place:
+
+1. `Add workspace -> Shared workspaces`
+2. `Settings -> Cloud -> Cloud workers`
+
+Choose the right org, wait for the workspace to be `Ready`, then click `Connect` or `Open`.
+
+## When to use this flow
+
+Use a shared workspace when your team needs a hosted OpenWork runtime, a stable place for long-running tasks or messaging connectors, or one workspace that several people can open from the same org.
+
+## Notes
+
+- This area is currently marked `Alpha` in the Cloud dashboard.
+- A workspace must be `Ready` before the desktop app can open it.
+- OpenWork Cloud plan limits apply to hosted workspaces.
+- If you prefer to self-host, the desktop [Get Started](/start-here/get-started) guide still works with `openwork-orchestrator`.
diff --git a/packages/docs/cloud/share-with-your-team/custom-llm-provider.mdx b/packages/docs/cloud/share-with-your-team/custom-llm-provider.mdx
new file mode 100644
index 0000000000..d190ad4e39
--- /dev/null
+++ b/packages/docs/cloud/share-with-your-team/custom-llm-provider.mdx
@@ -0,0 +1,131 @@
+---
+title: "Adding a custom LLM provider"
+description: "Create a custom provider definition in OpenWork Cloud and import it into the desktop app"
+---
+
+Use this when the provider is not in the catalog. The Cloud dashboard accepts a models.dev-style JSON definition, stores the shared credential once, and then lets desktop workspaces import it.
+
+<Frame>
+  ![Custom LLM provider detail in OpenWork Cloud](/images/cloud-custom-llm-provider-detail.png)
+</Frame>
+
+## Create the custom provider
+
+1. Open `LLM Providers`.
+2. Click `Add Provider`.
+3. Switch to `Custom provider`.
+4. Paste the `Custom provider JSON`.
+5. Paste the shared `API key / credential`.
+6. Choose `People access` and/or `Team access`.
+7. Click `Create Provider`.
+
+The JSON must include `id`, `name`, `npm`, `env`, `doc`, and `models`. `api` is optional, but most OpenAI-compatible providers use it. The editor also requires valid JSON, at least one environment variable, and at least one model.
+
+```json
+{
+  "id": "custom-provider",
+  "name": "Custom Provider",
+  "npm": "@ai-sdk/openai-compatible",
+  "env": [
+    "CUSTOM_PROVIDER_API_KEY"
+  ],
+  "doc": "https://example.com/docs/models",
+  "api": "https://api.example.com/v1",
+  "models": [
+    {
+      "id": "custom-provider/example-model",
+      "name": "Example Model",
+      "attachment": false,
+      "reasoning": false,
+      "tool_call": true,
+      "structured_output": true,
+      "temperature": true,
+      "release_date": "2026-01-01",
+      "last_updated": "2026-01-01",
+      "open_weights": false,
+      "limit": {
+        "context": 128000,
+        "input": 128000,
+        "output": 8192
+      },
+      "modalities": {
+        "input": [
+          "text"
+        ],
+        "output": [
+          "text"
+        ]
+      }
+    }
+  ]
+}
+```
+
+## Import it into the desktop app
+
+1. Open `Settings -> Cloud`.
+2. Choose the correct `Active org`.
+3. Under `Cloud providers`, click `Import`.
+4. Reload the workspace when OpenWork asks.
+
+### Functional example: an LLM gateway (Infron)
+
+An LLM gateway is one OpenAI-compatible endpoint that fans out to many model providers. If you want to run the routing yourself, [LiteLLM](https://infron.ai/docs/frameworks-and-integrations/litellm) is a good starting point. [Infron](https://infron.ai) is the hosted option: one API key gets you every model in its [marketplace](https://infron.ai/models) with automatic provider fallbacks and a single invoice, so adding a new LLM to OpenWork is just another entry under `models`.
+
+Grab a key from the [API Keys dashboard](https://infron.ai/dashboard/apiKeys). If you don't have an account yet, sign up at [infron.ai/login](https://infron.ai/login) and their [quickstart](https://infron.ai/docs/overview/quickstart/text) walks you through your first request.
+
+Paste the key into `API key / credential` and use this JSON:
+
+```json
+{
+  "id": "infron",
+  "name": "Infron",
+  "npm": "@ai-sdk/openai-compatible",
+  "env": [
+    "INFRON_API_KEY"
+  ],
+  "doc": "https://infron.ai/docs/frameworks-and-integrations/openwork",
+  "api": "https://llm.onerouter.pro/v1",
+  "models": [
+    {
+      "id": "deepseek/deepseek-v3.2",
+      "name": "DeepSeek V3.2",
+      "attachment": false,
+      "reasoning": true,
+      "tool_call": true,
+      "structured_output": true,
+      "temperature": true,
+      "release_date": "2025-09-29",
+      "last_updated": "2025-09-29",
+      "open_weights": true,
+      "limit": {
+        "context": 128000,
+        "input": 128000,
+        "output": 8192
+      },
+      "modalities": {
+        "input": ["text"],
+        "output": ["text"]
+      }
+    }
+  ]
+}
+```
+
+Once imported, Infron models show up in the Chat model picker alongside everything else:
+
+<Frame>
+  ![DeepSeek V3.2 via Infron in the OpenWork Chat model picker](/images/infron-model-picker.png)
+</Frame>
+
+Pick the model and it's live in the session footer:
+
+<Frame>
+  ![Infron · DeepSeek V3.2 selected in an OpenWork session](/images/infron-model-active.png)
+</Frame>
+
+Add more entries under `models` to expose other routes the gateway supports (e.g. `openai/gpt-5.4`, `google/gemini-2.5-flash`).
+
+## When to use a cloud provider
+
+Use a Cloud provider when the setup is meant to be shared across an org or team. For solo use, configuring it directly in the desktop app is simpler.
diff --git a/packages/docs/cloud/share-with-your-team/managed-llm-provider.mdx b/packages/docs/cloud/share-with-your-team/managed-llm-provider.mdx
new file mode 100644
index 0000000000..14a6801830
--- /dev/null
+++ b/packages/docs/cloud/share-with-your-team/managed-llm-provider.mdx
@@ -0,0 +1,40 @@
+---
+title: "Adding a managed LLM provider"
+description: "Create an org-managed provider in OpenWork Cloud and import it into the desktop app"
+---
+
+Use `LLM Providers` when you want the org to manage the credential, model list, and access rules once, then let each desktop workspace import the providers from cloud.
+
+## Create the provider in OpenWork Cloud
+
+1. Open `LLM Providers`.
+2. Click `Add Provider`.
+3. Stay on `Catalog provider`.
+4. Choose the provider in `Provider`.
+5. Select the models the org should expose.
+6. Paste the shared `API key / credential`.
+7. Choose `People access` and/or `Team access`.
+8. Click `Create Provider`.
+
+<Frame>
+  ![Managed LLM provider detail in OpenWork Cloud](/images/cloud-managed-llm-provider-detail.png)
+</Frame>
+
+
+## Import it into the desktop app
+
+1. Open `Settings -> Cloud`.
+2. Choose the correct `Active org`.
+3. Under `Cloud providers`, click `Import`.
+4. Reload the workspace when OpenWork asks.
+
+OpenWork writes the imported provider into the workspace `opencode.jsonc` and stores the org credential for that workspace.
+
+## Update or remove it later
+
+- Use `Sync` after changing models or access in OpenWork Cloud.
+- Use `Remove` to stop managing the imported provider from this workspace.
+- If the provider was deleted in Cloud, the desktop app shows `Removed from cloud` and lets you `Uninstall` the local config.
+- The provider must have a stored org credential before the desktop app can import it.
+
+If you only need a one-off local setup, use the desktop guide at [Adding a custom LLM provider/model](/start-here/connect-your-stack/add-a-custom-llm).
diff --git a/packages/docs/cloud/share-with-your-team/skill-hubs.mdx b/packages/docs/cloud/share-with-your-team/skill-hubs.mdx
new file mode 100644
index 0000000000..387c707eef
--- /dev/null
+++ b/packages/docs/cloud/share-with-your-team/skill-hubs.mdx
@@ -0,0 +1,66 @@
+---
+title: "Skill hubs for teams"
+description: "Create org skill hubs, assign them to teams, and import them into the desktop app"
+---
+
+Skill hubs are the team-wide way to distribute grouped skills in OpenWork Cloud. You create the skills and team assignments in the Cloud dashboard, then each desktop workspace can import the hub in one step.
+
+If you only need to publish a single skill, you can also save it directly from the desktop app without adding it to a hub. Those standalone org skills still appear in `Skills -> Cloud` and `Settings -> Cloud -> Skills`, but hubs are the better fit when you want one team-managed collection.
+
+## 1. Create the organization
+
+If you do not already have one, open [app.openworklabs.com](https://app.openworklabs.com/), click `Create organization`, enter the org name, and finish checkout if prompted.
+
+## 2. Create the team
+
+1. Open `Members -> Teams`.
+2. Click `Create Team`.
+3. Enter `Team name`.
+4. Select the `Team members` that should receive the hub.
+5. Click `Create team`.
+
+Note: __Only `Owner` and `Admin` members can manage teams.__
+
+## 3. Create the skill or upload it from the desktop app
+
+1. Open `Skill Hubs -> All Skills`.
+2. Click `Add Skill`.
+3. Choose `Manual Entry` or `Upload SKILL.md`.
+4. Fill `Skill Name`, `Short Description`, and `Detailed Instructions (Markdown)`.
+5. Choose the right `Visibility`.
+6. Click `Create Skill`.
+
+Skill creators and org admins can manage skills and hubs.
+
+If the skill already exists in a desktop workspace, you can also open `Workspace -> Skills`, click `Share skill`, choose `Team`, and save it to your active organization before attaching it to a hub.
+
+## 4. Create the hub and assign it to the team
+
+1. Open `Skill Hubs -> Hubs`.
+2. Click `Create Hub`.
+3. Set `Hub Name` and optional `Description`.
+4. Under `Assigned Teams`, select the teams that should access the hub.
+5. Under `Hub Skills`, select the skills to include.
+6. Click `Create Hub`.
+
+<Frame>
+  ![Skill hub access and included skills in OpenWork Cloud](/images/cloud-skill-hub-access-and-skills.png)
+</Frame>
+
+## 5. Import the hub into the desktop app
+
+1. Open the desktop app and go to `Settings -> Cloud`.
+2. Choose the same `Active org`.
+3. Under `Skill hubs`, click `Import all` on the hub.
+4. Reload the workspace when OpenWork asks.
+
+OpenWork installs the hub's skills into `.opencode/skills` for that workspace.
+
+If you need just one shared skill instead of the entire hub, open `Skills -> Cloud` or `Settings -> Cloud -> Skills` and install it there.
+
+
+## Keeping it up to date
+
+- Use `Sync` in `Settings -> Cloud -> Skill hubs` after the hub changes.
+- Use `Settings -> Cloud -> Skills` or `Skills -> Cloud` to sync, uninstall, or review individual skills that came from the org.
+- Use `Remove` to stop managing the hub from this workspace.
diff --git a/packages/docs/cloud/share-with-your-team/team-templates.mdx b/packages/docs/cloud/share-with-your-team/team-templates.mdx
new file mode 100644
index 0000000000..73bec7a12f
--- /dev/null
+++ b/packages/docs/cloud/share-with-your-team/team-templates.mdx
@@ -0,0 +1,29 @@
+---
+title: "Team templates"
+description: "Create reusable workspace templates for teams in OpenWork Cloud"
+---
+
+Team templates are the Cloud path for giving a team the same starting workspace setup. Use them when a group should begin with the same skills, MCP config, commands, agents, and provider settings instead of rebuilding those pieces one desktop app at a time.
+
+## When to use templates
+
+- Use a template for repeated team setups, client onboarding, or internal operating systems.
+- Use [Skill hubs](/cloud/share-with-your-team/skill-hubs) when you only need to distribute skills.
+- Use [managed providers](/cloud/share-with-your-team/managed-llm-provider) when the only shared piece is model access.
+
+## Recommended flow
+
+1. Build the workspace locally in the OpenWork desktop app.
+2. Add the skills, MCP servers, commands, agents, and providers the team should start with.
+3. Share the setup to your OpenWork Cloud organization.
+4. Assign the template to the right team.
+5. Ask teammates to import the template from `Settings -> Cloud`.
+
+## Keep it maintainable
+
+- Keep secrets out of templates.
+- Put shared model credentials in Cloud providers instead of config files.
+- Keep reusable skills in skill hubs when several templates need the same skill set.
+- Create separate templates for separate teams or client environments.
+
+Team templates are meant to stay boring: one known-good starting point, assigned to the people who need it, imported into the desktop app when they join the workflow.
diff --git a/packages/docs/docs.json b/packages/docs/docs.json
new file mode 100644
index 0000000000..1b7339c1e8
--- /dev/null
+++ b/packages/docs/docs.json
@@ -0,0 +1,136 @@
+{
+  "$schema": "https://mintlify.com/docs.json",
+  "theme": "mint",
+  "name": "OpenWork Docs",
+  "favicon": "/logo/light.svg",
+  "logo": {
+    "light": "/logo/light.svg",
+    "dark": "/logo/dark.svg"
+  },
+  "colors": {
+    "primary": "#011627",
+    "light": "#3b82f6",
+    "dark": "#011627"
+  },
+  "api": {
+    "openapi": "openapi.json"
+  },
+  "navigation": {
+    "tabs": [
+      {
+        "tab": "Start here",
+        "pages": [
+          "start-here/get-started",
+          {
+            "group": "Connect your stack",
+            "pages": [
+              "start-here/connect-your-stack/sign-in-with-chatgpt",
+              "start-here/connect-your-stack/add-anthropic-api-key",
+              "start-here/connect-your-stack/add-a-custom-llm",
+              "start-here/connect-your-stack/add-an-mcp-server",
+              "start-here/connect-your-stack/enable-exa-search"
+            ]
+          },
+          {
+            "group": "Do work with it",
+            "pages": [
+              "start-here/do-work-with-it/control-the-browser",
+              "start-here/do-work-with-it/import-a-skill",
+              "start-here/do-work-with-it/share-your-setup"
+            ]
+          },
+          {
+            "group": "Self-host",
+            "pages": [
+              "start-here/self-host"
+            ]
+          },
+          {
+            "group": "Help improve OpenWork",
+            "pages": [
+              "start-here/missing-docs",
+              "start-here/missing-languages"
+            ]
+          }
+        ]
+      },
+      {
+        "tab": "Cloud",
+        "pages": [
+          "cloud/get-started",
+          {
+            "group": "Share with your team",
+            "pages": [
+              "cloud/share-with-your-team/team-templates",
+              "cloud/share-with-your-team/skill-hubs",
+              "cloud/share-with-your-team/managed-llm-provider",
+              "cloud/share-with-your-team/custom-llm-provider"
+            ]
+          },
+          {
+            "group": "Run in the cloud",
+            "pages": [
+              "cloud/run-in-the-cloud/shared-workspace",
+              "cloud/run-in-the-cloud/cloud-mcp",
+              "cloud/run-in-the-cloud/connect-slack"
+            ]
+          },
+          "cloud/members-and-rbac",
+          "cloud/enterprise"
+        ]
+      },
+      {
+        "tab": "API",
+        "openapi": "/openapi.json"
+      },
+      {
+        "tab": "Roadmap",
+        "pages": [
+          "roadmap"
+        ]
+      },
+      {
+        "tab": "Changelog",
+        "pages": [
+          "changelog"
+        ]
+      }
+    ]
+  },
+  "redirects": [
+    {
+      "source": "/",
+      "destination": "/start-here/get-started"
+    },
+    {
+      "source": "/quickstart",
+      "destination": "/start-here/get-started"
+    },
+    {
+      "source": "/introduction",
+      "destination": "/cloud/get-started"
+    },
+    {
+      "source": "/roadmap/roadmap",
+      "destination": "/roadmap"
+    },
+    {
+      "source": "/changelog/changelog",
+      "destination": "/changelog"
+    }
+  ],
+  "errors": {
+    "404": {
+      "redirect": false,
+      "title": "Missing Documentation?",
+      "description": "If you're technical and want to use a specific part of the app that is not documented well yet, [send us a quick email](mailto:team@openworklabs.com?subject=missing%20documentation&body=hey%20my%20github%20is%20%7Busername%7D%2C%20I%27m%20interested%20in%20%7Bfeature%7D%20from%20openwork%20but%20I%27m%20missing%20documentation%20on%20it%2C%20could%20you%20create%20it%3F%0A%0AThanks) and tell us what you're missing."
+    }
+  },
+  "navbar": {
+    "primary": {
+      "type": "button",
+      "label": "Download OpenWork",
+      "href": "https://openworklabs.com/download"
+    }
+  }
+}
diff --git a/packages/docs/images/10thMarch-better-mcp-auth.gif b/packages/docs/images/10thMarch-better-mcp-auth.gif
new file mode 100644
index 0000000000..f000974bca
Binary files /dev/null and b/packages/docs/images/10thMarch-better-mcp-auth.gif differ
diff --git a/packages/docs/images/10thMarch-model-picker.gif b/packages/docs/images/10thMarch-model-picker.gif
new file mode 100644
index 0000000000..f233b890e8
Binary files /dev/null and b/packages/docs/images/10thMarch-model-picker.gif differ
diff --git a/packages/docs/images/anthropic-key.png b/packages/docs/images/anthropic-key.png
new file mode 100644
index 0000000000..fbf34c3bce
Binary files /dev/null and b/packages/docs/images/anthropic-key.png differ
diff --git a/packages/docs/images/anthropic-openwork-key.png b/packages/docs/images/anthropic-openwork-key.png
new file mode 100644
index 0000000000..cbb20c9eb5
Binary files /dev/null and b/packages/docs/images/anthropic-openwork-key.png differ
diff --git a/packages/docs/images/chatgpt-connect-provider-settings.png b/packages/docs/images/chatgpt-connect-provider-settings.png
new file mode 100644
index 0000000000..99071c6784
Binary files /dev/null and b/packages/docs/images/chatgpt-connect-provider-settings.png differ
diff --git a/packages/docs/images/chatgpt-model-list.png b/packages/docs/images/chatgpt-model-list.png
new file mode 100644
index 0000000000..0c83352cb8
Binary files /dev/null and b/packages/docs/images/chatgpt-model-list.png differ
diff --git a/packages/docs/images/chatgpt-model-selector.png b/packages/docs/images/chatgpt-model-selector.png
new file mode 100644
index 0000000000..0e5c49da13
Binary files /dev/null and b/packages/docs/images/chatgpt-model-selector.png differ
diff --git a/packages/docs/images/chatgpt-new-session-cta.png b/packages/docs/images/chatgpt-new-session-cta.png
new file mode 100644
index 0000000000..e167de0021
Binary files /dev/null and b/packages/docs/images/chatgpt-new-session-cta.png differ
diff --git a/packages/docs/images/chatgpt-openai-auth-login.png b/packages/docs/images/chatgpt-openai-auth-login.png
new file mode 100644
index 0000000000..46f0fbabd0
Binary files /dev/null and b/packages/docs/images/chatgpt-openai-auth-login.png differ
diff --git a/packages/docs/images/cloud-custom-llm-provider-detail.png b/packages/docs/images/cloud-custom-llm-provider-detail.png
new file mode 100644
index 0000000000..90c40c6f79
Binary files /dev/null and b/packages/docs/images/cloud-custom-llm-provider-detail.png differ
diff --git a/packages/docs/images/cloud-dashboard-overview.png b/packages/docs/images/cloud-dashboard-overview.png
new file mode 100644
index 0000000000..b1e7d86b2c
Binary files /dev/null and b/packages/docs/images/cloud-dashboard-overview.png differ
diff --git a/packages/docs/images/cloud-managed-llm-provider-detail.png b/packages/docs/images/cloud-managed-llm-provider-detail.png
new file mode 100644
index 0000000000..aaf0369bbb
Binary files /dev/null and b/packages/docs/images/cloud-managed-llm-provider-detail.png differ
diff --git a/packages/docs/images/cloud-members-and-rbac-dashboard.png b/packages/docs/images/cloud-members-and-rbac-dashboard.png
new file mode 100644
index 0000000000..f817ecdf2c
Binary files /dev/null and b/packages/docs/images/cloud-members-and-rbac-dashboard.png differ
diff --git a/packages/docs/images/cloud-org-settings.png b/packages/docs/images/cloud-org-settings.png
new file mode 100644
index 0000000000..f7021a4fc9
Binary files /dev/null and b/packages/docs/images/cloud-org-settings.png differ
diff --git a/packages/docs/images/cloud-skill-hub-access-and-skills.png b/packages/docs/images/cloud-skill-hub-access-and-skills.png
new file mode 100644
index 0000000000..a491700993
Binary files /dev/null and b/packages/docs/images/cloud-skill-hub-access-and-skills.png differ
diff --git a/packages/docs/images/cloud-team-templates-library.png b/packages/docs/images/cloud-team-templates-library.png
new file mode 100644
index 0000000000..3ccd19933b
Binary files /dev/null and b/packages/docs/images/cloud-team-templates-library.png differ
diff --git a/packages/docs/images/control-chrome-setup-modal.png b/packages/docs/images/control-chrome-setup-modal.png
new file mode 100644
index 0000000000..9dccf17846
Binary files /dev/null and b/packages/docs/images/control-chrome-setup-modal.png differ
diff --git a/packages/docs/images/deprecated/CleanShot2026-03-25at12.03.06@2x.png b/packages/docs/images/deprecated/CleanShot2026-03-25at12.03.06@2x.png
new file mode 100644
index 0000000000..a9a41e0220
Binary files /dev/null and b/packages/docs/images/deprecated/CleanShot2026-03-25at12.03.06@2x.png differ
diff --git a/packages/docs/images/deprecated/CleanShot2026-03-25at12.11.56@2x.png b/packages/docs/images/deprecated/CleanShot2026-03-25at12.11.56@2x.png
new file mode 100644
index 0000000000..98164c2b66
Binary files /dev/null and b/packages/docs/images/deprecated/CleanShot2026-03-25at12.11.56@2x.png differ
diff --git a/packages/docs/images/deprecated/CleanShot2026-03-25at12.23.47@2x.png b/packages/docs/images/deprecated/CleanShot2026-03-25at12.23.47@2x.png
new file mode 100644
index 0000000000..f635d297da
Binary files /dev/null and b/packages/docs/images/deprecated/CleanShot2026-03-25at12.23.47@2x.png differ
diff --git a/packages/docs/images/deprecated/den-landing-page.png b/packages/docs/images/deprecated/den-landing-page.png
new file mode 100644
index 0000000000..e8a331aa80
Binary files /dev/null and b/packages/docs/images/deprecated/den-landing-page.png differ
diff --git a/packages/docs/images/deprecated/google-auth.png b/packages/docs/images/deprecated/google-auth.png
new file mode 100644
index 0000000000..64d8d35007
Binary files /dev/null and b/packages/docs/images/deprecated/google-auth.png differ
diff --git a/packages/docs/images/deprecated/image-6.png b/packages/docs/images/deprecated/image-6.png
new file mode 100644
index 0000000000..78f373b807
Binary files /dev/null and b/packages/docs/images/deprecated/image-6.png differ
diff --git a/packages/docs/images/deprecated/new-worker-empty-session.mov b/packages/docs/images/deprecated/new-worker-empty-session.mov
new file mode 100644
index 0000000000..19aa3ba7b1
Binary files /dev/null and b/packages/docs/images/deprecated/new-worker-empty-session.mov differ
diff --git a/packages/docs/images/exa-search-toggle.png b/packages/docs/images/exa-search-toggle.png
new file mode 100644
index 0000000000..e998284494
Binary files /dev/null and b/packages/docs/images/exa-search-toggle.png differ
diff --git a/packages/docs/images/extensions-control-chrome-app.png b/packages/docs/images/extensions-control-chrome-app.png
new file mode 100644
index 0000000000..e907e674da
Binary files /dev/null and b/packages/docs/images/extensions-control-chrome-app.png differ
diff --git a/packages/docs/images/get-started-add-remote-workspace.png b/packages/docs/images/get-started-add-remote-workspace.png
new file mode 100644
index 0000000000..75e93927f2
Binary files /dev/null and b/packages/docs/images/get-started-add-remote-workspace.png differ
diff --git a/packages/docs/images/get-started-cli-output.png b/packages/docs/images/get-started-cli-output.png
new file mode 100644
index 0000000000..bfb71395e1
Binary files /dev/null and b/packages/docs/images/get-started-cli-output.png differ
diff --git a/packages/docs/images/improved-skills-march11th.gif b/packages/docs/images/improved-skills-march11th.gif
new file mode 100644
index 0000000000..4c0621070f
Binary files /dev/null and b/packages/docs/images/improved-skills-march11th.gif differ
diff --git a/packages/docs/images/infron-model-active.png b/packages/docs/images/infron-model-active.png
new file mode 100644
index 0000000000..d4c604c7de
Binary files /dev/null and b/packages/docs/images/infron-model-active.png differ
diff --git a/packages/docs/images/infron-model-picker.png b/packages/docs/images/infron-model-picker.png
new file mode 100644
index 0000000000..7e233e0cf7
Binary files /dev/null and b/packages/docs/images/infron-model-picker.png differ
diff --git a/packages/docs/images/mcp-add-server-dialog.png b/packages/docs/images/mcp-add-server-dialog.png
new file mode 100644
index 0000000000..03bc56d301
Binary files /dev/null and b/packages/docs/images/mcp-add-server-dialog.png differ
diff --git a/packages/docs/images/mcp-dynamic-registration-error.png b/packages/docs/images/mcp-dynamic-registration-error.png
new file mode 100644
index 0000000000..eae53ca6c8
Binary files /dev/null and b/packages/docs/images/mcp-dynamic-registration-error.png differ
diff --git a/packages/docs/images/mcp-extensions-advanced-settings.png b/packages/docs/images/mcp-extensions-advanced-settings.png
new file mode 100644
index 0000000000..b13867e05a
Binary files /dev/null and b/packages/docs/images/mcp-extensions-advanced-settings.png differ
diff --git a/packages/docs/images/mcp-oauth-approval-page.png b/packages/docs/images/mcp-oauth-approval-page.png
new file mode 100644
index 0000000000..4d06503514
Binary files /dev/null and b/packages/docs/images/mcp-oauth-approval-page.png differ
diff --git a/packages/docs/images/ollama-added-as-provider.png b/packages/docs/images/ollama-added-as-provider.png
new file mode 100644
index 0000000000..ae477aadbc
Binary files /dev/null and b/packages/docs/images/ollama-added-as-provider.png differ
diff --git a/packages/docs/images/ollama-custom-provider.png b/packages/docs/images/ollama-custom-provider.png
new file mode 100644
index 0000000000..0ca2919df5
Binary files /dev/null and b/packages/docs/images/ollama-custom-provider.png differ
diff --git a/packages/docs/images/openwork-providers.png b/packages/docs/images/openwork-providers.png
new file mode 100644
index 0000000000..f83ac685b1
Binary files /dev/null and b/packages/docs/images/openwork-providers.png differ
diff --git a/packages/docs/images/sharing-create-link-dialog.png b/packages/docs/images/sharing-create-link-dialog.png
new file mode 100644
index 0000000000..a31a257096
Binary files /dev/null and b/packages/docs/images/sharing-create-link-dialog.png differ
diff --git a/packages/docs/images/sharing-skill-share-page.png b/packages/docs/images/sharing-skill-share-page.png
new file mode 100644
index 0000000000..ee772ad3a7
Binary files /dev/null and b/packages/docs/images/sharing-skill-share-page.png differ
diff --git a/packages/docs/images/sharing-skills-list.png b/packages/docs/images/sharing-skills-list.png
new file mode 100644
index 0000000000..f755778b7c
Binary files /dev/null and b/packages/docs/images/sharing-skills-list.png differ
diff --git a/packages/docs/images/sharing-workspace-template-dialog.png b/packages/docs/images/sharing-workspace-template-dialog.png
new file mode 100644
index 0000000000..65df57d9e1
Binary files /dev/null and b/packages/docs/images/sharing-workspace-template-dialog.png differ
diff --git a/packages/docs/images/skill-import-reload-required.png b/packages/docs/images/skill-import-reload-required.png
new file mode 100644
index 0000000000..e93715ab44
Binary files /dev/null and b/packages/docs/images/skill-import-reload-required.png differ
diff --git a/packages/docs/images/skill-import-select-workspace.png b/packages/docs/images/skill-import-select-workspace.png
new file mode 100644
index 0000000000..9f69c58682
Binary files /dev/null and b/packages/docs/images/skill-import-select-workspace.png differ
diff --git a/packages/docs/images/skill-import-share-page.png b/packages/docs/images/skill-import-share-page.png
new file mode 100644
index 0000000000..04e24e7420
Binary files /dev/null and b/packages/docs/images/skill-import-share-page.png differ
diff --git a/packages/docs/images/skill-import-share-your-skill.png b/packages/docs/images/skill-import-share-your-skill.png
new file mode 100644
index 0000000000..bceaeb1f7c
Binary files /dev/null and b/packages/docs/images/skill-import-share-your-skill.png differ
diff --git a/packages/docs/images/skill-import-skill-creator-command.png b/packages/docs/images/skill-import-skill-creator-command.png
new file mode 100644
index 0000000000..e740274e60
Binary files /dev/null and b/packages/docs/images/skill-import-skill-creator-command.png differ
diff --git a/packages/docs/images/skill-import-use-in-chat.png b/packages/docs/images/skill-import-use-in-chat.png
new file mode 100644
index 0000000000..63f33d7e43
Binary files /dev/null and b/packages/docs/images/skill-import-use-in-chat.png differ
diff --git a/packages/docs/images/slack-connect-tokens.png b/packages/docs/images/slack-connect-tokens.png
new file mode 100644
index 0000000000..ab5efe21e2
Binary files /dev/null and b/packages/docs/images/slack-connect-tokens.png differ
diff --git a/packages/docs/images/slack-test-message-thread.png b/packages/docs/images/slack-test-message-thread.png
new file mode 100644
index 0000000000..487a32aa12
Binary files /dev/null and b/packages/docs/images/slack-test-message-thread.png differ
diff --git a/packages/docs/logo/dark.svg b/packages/docs/logo/dark.svg
new file mode 100644
index 0000000000..2811c03d90
--- /dev/null
+++ b/packages/docs/logo/dark.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" ?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1024" height="866" viewBox="0 0 1024 866"><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M490.962 13.2109C516.808 12.568 530.193 21.0761 551.688 33.1032L589.195 54.1798L626.787 75.2506C636.066 80.4389 649.292 87.5857 657.478 94.0584C671.769 105.914 683.112 124.362 684.683 143.175C685.907 157.831 685.389 173.375 685.377 188.173L685.339 263.964L685.37 354.897C685.391 380.32 686.655 411.29 681.484 435.723C675.249 464.929 662.265 492.269 643.573 515.558C632.659 528.974 618.797 542.079 604.617 552.026C599.568 555.568 592.431 559.221 586.895 562.254L566.235 573.714L489.048 616.153L413.234 657.883C399.18 665.674 384.868 674.248 370.402 681.208C362.127 685.189 352.078 686.881 342.951 687.813C318.706 688.516 306.452 681.909 286.169 670.383L257.958 654.418C241.853 645.558 225.804 636.597 209.812 627.535C198.9 621.412 183.811 613.689 174.536 605.554C158.954 591.701 149.499 572.233 148.244 551.42C147.215 534.843 147.823 512.715 147.821 495.659L147.81 397.552L147.812 317.362C147.82 296.243 146.723 270.836 151.06 250.573C156.911 223.486 169.602 198.349 187.923 177.56C197.018 167.22 207.51 158.199 219.097 150.756C233.391 141.426 253.227 131.448 268.617 123.103L348.755 79.3365L419.409 40.3549C445.897 25.8026 460.025 15.0173 490.962 13.2109ZM350.689 661.215C366.184 656.024 377.335 648.632 391.543 640.597C405.935 632.447 420.396 624.418 434.923 616.51L532.617 563.032C583.215 535.392 616.074 521.904 643.094 467.522C651 451.528 656.046 434.273 658.004 416.539C659.64 401.456 659.102 383.999 659.058 368.652L658.984 301.55L659.114 202.097C659.123 186.04 660.925 148.727 656.309 135.299C653.001 125.621 645.936 117.683 636.707 113.278C630.245 110.188 620.134 107.745 613.008 108.899C604.318 109.655 596.399 112.041 588.722 116.165C577.357 122.269 566.083 128.625 554.759 134.809L476.344 177.842L408.03 215.338C394.874 222.493 377.925 230.923 365.739 238.915C354.985 245.946 345.302 254.493 336.99 264.291C322.261 281.681 312.136 302.494 307.544 324.817C303.925 343.149 305.08 374.437 305.113 394.107L305.183 493.471L305.2 580.911C305.2 596.329 304.599 612.603 305.674 627.933C307.254 650.453 322.586 664.188 344.986 661.954C346.892 661.748 348.793 661.502 350.689 661.215ZM275.046 634.925C276.703 635.884 278.443 636.934 280.128 637.819C278.716 626.741 279.321 604.711 279.333 592.851L279.349 514.659L279.319 397.689L279.307 363.99C279.296 348.799 279.081 336.276 281.868 321.173C286.627 296.026 297.312 272.376 313.038 252.185C322.448 240.062 333.642 229.435 346.238 220.668C358.126 212.437 374.555 203.96 387.566 196.921C405.827 187.071 424.038 177.128 442.198 167.095L540.847 112.798C556.874 103.996 575.722 93.0395 591.788 84.9667L544.597 58.1945C529.914 49.8677 510.295 37.0292 492.825 38.8716C483.01 39.5777 473.292 41.0835 464.415 45.4977C453.156 51.0956 442.077 57.5037 431.036 63.5307L359.332 102.878L282.282 145.173C266.343 153.844 246.398 163.945 231.532 173.678C222.383 179.646 214.109 186.86 206.949 195.111C188.139 216.808 175.15 246.46 173.93 275.291C173.304 290.098 173.676 305.111 173.702 319.948L173.733 400.555L173.754 498.411C173.757 515.471 173.162 532.646 174.011 549.669C174.707 563.612 181.36 577.006 191.74 586.251C200.634 593.773 215.172 601.204 225.649 607.054C242.161 616.261 258.627 625.552 275.046 634.925Z"/><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M552.454 209.477C572.012 207.959 581.847 219.441 582.39 238.522C582.687 248.987 582.481 259.462 582.458 269.93L582.381 329.269L582.483 374.869C582.513 386.815 582.826 398.849 581.432 410.717C580.03 422.226 576.641 433.405 571.416 443.754C564.818 456.975 555.554 468.686 544.209 478.151C533.954 486.627 522.347 492.2 510.69 498.541L475.758 517.796L441.984 536.419C433.817 540.91 422.997 547.228 414.361 550.139C395.476 554.553 385.023 538.561 385.317 521.594C385.494 511.326 385.526 500.852 385.528 490.583L385.489 419.929L385.431 378.325C385.353 365.955 384.961 352.061 386.603 339.869C388.349 327.707 392.543 316.027 398.933 305.533C412.05 283.666 427.715 275.485 449.348 263.601L480.283 246.56L514.335 227.666C526.451 220.869 538.901 212.844 552.454 209.477ZM411.433 419.84C412.154 444.816 411.109 470.99 411.596 496.052C411.681 500.45 411.062 520.138 411.862 523.514C436.021 509.816 460.32 496.368 484.756 483.172C499.771 474.909 517.93 466.631 530.803 455.318C544.786 443.029 554.756 422.232 555.367 403.682C556.041 383.225 555.895 362.475 555.571 342.046C555.568 341.804 555.455 341.8 555.196 341.71C513.173 364.086 471.908 388.028 429.782 410.228C423.629 413.47 417.693 416.752 411.433 419.84ZM411.24 391.445L414.53 389.48C449.106 371.177 482.45 351.994 516.706 333.189L543.205 318.622C547.228 316.407 553.138 312.877 557.106 311.086C556.18 289.545 557.012 267.818 556.741 246.25C556.699 242.902 557.552 235.271 552.517 234.957C545.074 238.359 537.476 242.917 530.329 246.979C521.218 252.161 512.063 257.266 502.866 262.294L460.839 285.501C451.005 290.952 438.682 297.024 430.234 304.172C423.327 309.962 418.07 317.472 414.993 325.943C409.122 341.857 411.331 373.369 411.24 391.445Z"/></svg>
\ No newline at end of file
diff --git a/packages/docs/logo/light.svg b/packages/docs/logo/light.svg
new file mode 100644
index 0000000000..2811c03d90
--- /dev/null
+++ b/packages/docs/logo/light.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" ?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1024" height="866" viewBox="0 0 1024 866"><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M490.962 13.2109C516.808 12.568 530.193 21.0761 551.688 33.1032L589.195 54.1798L626.787 75.2506C636.066 80.4389 649.292 87.5857 657.478 94.0584C671.769 105.914 683.112 124.362 684.683 143.175C685.907 157.831 685.389 173.375 685.377 188.173L685.339 263.964L685.37 354.897C685.391 380.32 686.655 411.29 681.484 435.723C675.249 464.929 662.265 492.269 643.573 515.558C632.659 528.974 618.797 542.079 604.617 552.026C599.568 555.568 592.431 559.221 586.895 562.254L566.235 573.714L489.048 616.153L413.234 657.883C399.18 665.674 384.868 674.248 370.402 681.208C362.127 685.189 352.078 686.881 342.951 687.813C318.706 688.516 306.452 681.909 286.169 670.383L257.958 654.418C241.853 645.558 225.804 636.597 209.812 627.535C198.9 621.412 183.811 613.689 174.536 605.554C158.954 591.701 149.499 572.233 148.244 551.42C147.215 534.843 147.823 512.715 147.821 495.659L147.81 397.552L147.812 317.362C147.82 296.243 146.723 270.836 151.06 250.573C156.911 223.486 169.602 198.349 187.923 177.56C197.018 167.22 207.51 158.199 219.097 150.756C233.391 141.426 253.227 131.448 268.617 123.103L348.755 79.3365L419.409 40.3549C445.897 25.8026 460.025 15.0173 490.962 13.2109ZM350.689 661.215C366.184 656.024 377.335 648.632 391.543 640.597C405.935 632.447 420.396 624.418 434.923 616.51L532.617 563.032C583.215 535.392 616.074 521.904 643.094 467.522C651 451.528 656.046 434.273 658.004 416.539C659.64 401.456 659.102 383.999 659.058 368.652L658.984 301.55L659.114 202.097C659.123 186.04 660.925 148.727 656.309 135.299C653.001 125.621 645.936 117.683 636.707 113.278C630.245 110.188 620.134 107.745 613.008 108.899C604.318 109.655 596.399 112.041 588.722 116.165C577.357 122.269 566.083 128.625 554.759 134.809L476.344 177.842L408.03 215.338C394.874 222.493 377.925 230.923 365.739 238.915C354.985 245.946 345.302 254.493 336.99 264.291C322.261 281.681 312.136 302.494 307.544 324.817C303.925 343.149 305.08 374.437 305.113 394.107L305.183 493.471L305.2 580.911C305.2 596.329 304.599 612.603 305.674 627.933C307.254 650.453 322.586 664.188 344.986 661.954C346.892 661.748 348.793 661.502 350.689 661.215ZM275.046 634.925C276.703 635.884 278.443 636.934 280.128 637.819C278.716 626.741 279.321 604.711 279.333 592.851L279.349 514.659L279.319 397.689L279.307 363.99C279.296 348.799 279.081 336.276 281.868 321.173C286.627 296.026 297.312 272.376 313.038 252.185C322.448 240.062 333.642 229.435 346.238 220.668C358.126 212.437 374.555 203.96 387.566 196.921C405.827 187.071 424.038 177.128 442.198 167.095L540.847 112.798C556.874 103.996 575.722 93.0395 591.788 84.9667L544.597 58.1945C529.914 49.8677 510.295 37.0292 492.825 38.8716C483.01 39.5777 473.292 41.0835 464.415 45.4977C453.156 51.0956 442.077 57.5037 431.036 63.5307L359.332 102.878L282.282 145.173C266.343 153.844 246.398 163.945 231.532 173.678C222.383 179.646 214.109 186.86 206.949 195.111C188.139 216.808 175.15 246.46 173.93 275.291C173.304 290.098 173.676 305.111 173.702 319.948L173.733 400.555L173.754 498.411C173.757 515.471 173.162 532.646 174.011 549.669C174.707 563.612 181.36 577.006 191.74 586.251C200.634 593.773 215.172 601.204 225.649 607.054C242.161 616.261 258.627 625.552 275.046 634.925Z"/><path fill="#257CE9" transform="scale(1.22782 1.22782)" d="M552.454 209.477C572.012 207.959 581.847 219.441 582.39 238.522C582.687 248.987 582.481 259.462 582.458 269.93L582.381 329.269L582.483 374.869C582.513 386.815 582.826 398.849 581.432 410.717C580.03 422.226 576.641 433.405 571.416 443.754C564.818 456.975 555.554 468.686 544.209 478.151C533.954 486.627 522.347 492.2 510.69 498.541L475.758 517.796L441.984 536.419C433.817 540.91 422.997 547.228 414.361 550.139C395.476 554.553 385.023 538.561 385.317 521.594C385.494 511.326 385.526 500.852 385.528 490.583L385.489 419.929L385.431 378.325C385.353 365.955 384.961 352.061 386.603 339.869C388.349 327.707 392.543 316.027 398.933 305.533C412.05 283.666 427.715 275.485 449.348 263.601L480.283 246.56L514.335 227.666C526.451 220.869 538.901 212.844 552.454 209.477ZM411.433 419.84C412.154 444.816 411.109 470.99 411.596 496.052C411.681 500.45 411.062 520.138 411.862 523.514C436.021 509.816 460.32 496.368 484.756 483.172C499.771 474.909 517.93 466.631 530.803 455.318C544.786 443.029 554.756 422.232 555.367 403.682C556.041 383.225 555.895 362.475 555.571 342.046C555.568 341.804 555.455 341.8 555.196 341.71C513.173 364.086 471.908 388.028 429.782 410.228C423.629 413.47 417.693 416.752 411.433 419.84ZM411.24 391.445L414.53 389.48C449.106 371.177 482.45 351.994 516.706 333.189L543.205 318.622C547.228 316.407 553.138 312.877 557.106 311.086C556.18 289.545 557.012 267.818 556.741 246.25C556.699 242.902 557.552 235.271 552.517 234.957C545.074 238.359 537.476 242.917 530.329 246.979C521.218 252.161 512.063 257.266 502.866 262.294L460.839 285.501C451.005 290.952 438.682 297.024 430.234 304.172C423.327 309.962 418.07 317.472 414.993 325.943C409.122 341.857 411.331 373.369 411.24 391.445Z"/></svg>
\ No newline at end of file
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
new file mode 100644
index 0000000000..68a2a0a2b8
--- /dev/null
+++ b/packages/docs/openapi.json
@@ -0,0 +1 @@
+{"openapi":"3.1.0","info":{"title":"Den API","description":"OpenAPI spec for the Den control plane API.\n\nAuthentication:\n- Use `Authorization: Bearer <session-token>` for user-authenticated routes that require a Den session.\n- Use `x-api-key: <den-api-key>` for API-key-authenticated routes that accept organization API keys.\n- Public routes like health and documentation do not require authentication.\n\nSwagger tip: use the security schemes in the Authorize dialog to set either `bearerAuth` or `denApiKey` before trying protected endpoints.","version":"dev"},"servers":[{"url":"https://api.openworklabs.com"}],"tags":[{"name":"System","description":"Service health and operational routes."},{"name":"Organizations","description":"Top-level organization creation and context routes."},{"name":"Invitations","description":"Invitation preview, acceptance, creation, and cancellation routes."},{"name":"API Keys","description":"Organization API key management routes."},{"name":"Members","description":"Organization member management routes."},{"name":"Roles","description":"Organization custom role management routes."},{"name":"Teams","description":"Organization team management routes."},{"name":"Templates","description":"Organization shared template routes."},{"name":"LLM Providers","description":"Organization LLM provider catalog, configuration, and access routes."},{"name":"Skills","description":"Organization skill authoring and sharing routes."},{"name":"Skill Hubs","description":"Organization skill hub management and access routes."},{"name":"Workers","description":"Worker lifecycle, billing, and runtime routes."},{"name":"Worker Runtime","description":"Worker runtime inspection and upgrade routes."},{"name":"Worker Activity","description":"Worker heartbeat and activity reporting routes."},{"name":"Admin","description":"Administrative reporting routes."},{"name":"Users","description":"Current user and membership routes."}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"session-token","description":"Session token passed as `Authorization: Bearer <session-token>` for user-authenticated Den routes."},"denApiKey":{"type":"apiKey","in":"header","name":"x-api-key","description":"Organization API key passed as the `x-api-key` header for API-key-authenticated Den routes."}},"schemas":{"DenApiHealthResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"service":{"type":"string","const":"den-api"}},"required":["ok","service"]},"AdminOverviewResponse":{"type":"object","properties":{"viewer":{"type":"object","properties":{"id":{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},"email":{"type":"string"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["id","email","name"]},"admins":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}},"summary":{"type":"object","properties":{},"additionalProperties":{}},"users":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}},"generatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["viewer","admins","summary","users","generatedAt"]},"InvalidRequestError":{"type":"object","properties":{"error":{"type":"string","const":"invalid_request"},"details":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"path":{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"number"}]}}},"required":["message"],"additionalProperties":{}}}},"required":["error","details"]},"UnauthorizedError":{"type":"object","properties":{"error":{"type":"string","const":"unauthorized"}},"required":["error"]},"DesktopHandoffGrantResponse":{"type":"object","properties":{"grant":{"type":"string"},"expiresAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"openworkUrl":{"type":"string","format":"uri"}},"required":["grant","expiresAt","openworkUrl"]},"DesktopHandoffExchangeResponse":{"type":"object","properties":{"token":{"type":"string"},"user":{"type":"object","properties":{"id":{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},"email":{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["id","email","name"]}},"required":["token","user"]},"DesktopHandoffGrantNotFoundError":{"type":"object","properties":{"error":{"type":"string","const":"grant_not_found"},"message":{"type":"string"}},"required":["error","message"]},"CurrentUserResponse":{"type":"object","properties":{"user":{"type":"object","properties":{},"additionalProperties":{}},"session":{"type":"object","properties":{},"additionalProperties":{}}},"required":["user","session"]},"CurrentUserOrganizationsResponse":{"type":"object","properties":{"orgs":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"isActive":{"type":"boolean"}},"required":["id","isActive"],"additionalProperties":{}}},"activeOrgId":{"anyOf":[{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},{"type":"null"}]},"activeOrgSlug":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["orgs","activeOrgId","activeOrgSlug"]},"CurrentUserDesktopConfigResponse":{"type":"object","properties":{"disallowNonCloudModels":{"type":"boolean"},"blockZenModel":{"type":"boolean"},"blockMultipleWorkspaces":{"type":"boolean"},"allowedDesktopVersions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":32}}}},"OrganizationResponse":{"type":"object","properties":{"organization":{"anyOf":[{"type":"object","properties":{},"additionalProperties":{}},{"type":"null"}]}},"required":["organization"]},"PaymentRequiredError":{"type":"object","properties":{"error":{"type":"string","const":"payment_required"},"message":{"type":"string"},"polar":{"type":"object","properties":{"checkoutUrl":{"anyOf":[{"type":"string"},{"type":"null"}]},"productId":{"anyOf":[{"type":"string"},{"type":"null"}]},"benefitId":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["checkoutUrl"],"additionalProperties":{}}},"required":["error","message","polar"]},"ForbiddenError":{"type":"object","properties":{"error":{"type":"string","const":"forbidden"},"message":{"type":"string"}},"required":["error"]},"InvitationPreviewResponse":{"type":"object","properties":{},"additionalProperties":{}},"NotFoundError":{"type":"object","properties":{"error":{"type":"string"},"message":{"type":"string"}},"required":["error"]},"InvitationAcceptedResponse":{"type":"object","properties":{"accepted":{"type":"boolean","const":true},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"organizationSlug":{"anyOf":[{"type":"string"},{"type":"null"}]},"invitationId":{"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"}},"required":["accepted","organizationId","organizationSlug","invitationId"]},"AccountEmailDomainNotAllowedError":{"type":"object","properties":{"error":{"type":"string","const":"account_email_domain_not_allowed"},"message":{"type":"string"},"emailDomain":{"anyOf":[{"type":"string"},{"type":"null"}]},"allowedEmailDomains":{"type":"array","items":{"type":"string"}}},"required":["error","message","emailDomain","allowedEmailDomains"]},"InvalidEmailDomainError":{"type":"object","properties":{"error":{"type":"string","const":"invalid_email_domain"},"message":{"type":"string"},"invalidDomains":{"type":"array","items":{"type":"string"}}},"required":["error","message","invalidDomains"]},"DenDesktopAppRestrictions":{"type":"object","properties":{"disallowNonCloudModels":{"type":"boolean"},"blockZenModel":{"type":"boolean"},"blockMultipleWorkspaces":{"type":"boolean"}}},"OrganizationOwner":{"type":"object","properties":{"memberId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"userId":{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]},"email":{"anyOf":[{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"},{"type":"null"}]},"image":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["memberId","userId","name","email"]},"OrganizationContextResponse":{"type":"object","properties":{"organization":{"type":"object","properties":{"owner":{"anyOf":[{"$ref":"#/components/schemas/OrganizationOwner"},{"type":"null"}]}},"additionalProperties":{}},"currentMember":{"type":"object","properties":{},"additionalProperties":{}},"currentMemberTeams":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"required":["organization","currentMember","currentMemberTeams"],"additionalProperties":{}},"OrganizationApiKeyOwner":{"type":"object","properties":{"userId":{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},"memberId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"name":{"type":"string"},"email":{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"},"image":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["userId","memberId","name","email","image"]},"OrganizationApiKey":{"type":"object","properties":{"id":{"type":"string"},"configId":{"type":"string"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]},"start":{"anyOf":[{"type":"string"},{"type":"null"}]},"prefix":{"anyOf":[{"type":"string"},{"type":"null"}]},"enabled":{"type":"boolean"},"rateLimitEnabled":{"type":"boolean"},"rateLimitMax":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"rateLimitTimeWindow":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"lastRequest":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"expiresAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"owner":{"$ref":"#/components/schemas/OrganizationApiKeyOwner"}},"required":["id","configId","name","start","prefix","enabled","rateLimitEnabled","rateLimitMax","rateLimitTimeWindow","lastRequest","expiresAt","createdAt","updatedAt","owner"]},"OrganizationApiKeyListResponse":{"type":"object","properties":{"apiKeys":{"type":"array","items":{"$ref":"#/components/schemas/OrganizationApiKey"}}},"required":["apiKeys"]},"OrganizationApiKeyForbiddenError":{"type":"object","properties":{"error":{"type":"string","const":"forbidden"},"message":{"type":"string"}},"required":["error","message"]},"OrganizationNotFoundError":{"type":"object","properties":{"error":{"type":"string","const":"organization_not_found"}},"required":["error"]},"CreatedOrganizationApiKey":{"type":"object","properties":{"id":{"type":"string"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]},"start":{"anyOf":[{"type":"string"},{"type":"null"}]},"prefix":{"anyOf":[{"type":"string"},{"type":"null"}]},"enabled":{"type":"boolean"},"rateLimitEnabled":{"type":"boolean"},"rateLimitMax":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"rateLimitTimeWindow":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["id","name","start","prefix","enabled","rateLimitEnabled","rateLimitMax","rateLimitTimeWindow","createdAt","updatedAt"]},"CreateOrganizationApiKeyResponse":{"type":"object","properties":{"apiKey":{"$ref":"#/components/schemas/CreatedOrganizationApiKey"},"key":{"type":"string","minLength":1}},"required":["apiKey","key"]},"CreateOrganizationApiKeyRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":64}},"required":["name"]},"OrganizationApiKeyNotFoundError":{"type":"object","properties":{"error":{"type":"string","const":"api_key_not_found"}},"required":["error"]},"InvitationResponse":{"type":"object","properties":{"invitationId":{"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"},"email":{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"},"role":{"type":"string"},"expiresAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["invitationId","email","role","expiresAt"]},"InviteEmailDomainNotAllowedError":{"type":"object","properties":{"error":{"type":"string","const":"invite_email_domain_not_allowed"},"message":{"type":"string"},"emailDomain":{"anyOf":[{"type":"string"},{"type":"null"}]},"allowedEmailDomains":{"type":"array","items":{"type":"string"}}},"required":["error","message","emailDomain","allowedEmailDomains"]},"InvitationEmailFailedError":{"type":"object","properties":{"error":{"type":"string","const":"invitation_email_failed"},"reason":{"type":"string","enum":["loops_not_configured","loops_rejected","loops_network"]},"message":{"type":"string"},"invitationId":{"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"}},"required":["error","reason","message","invitationId"]},"SuccessResponse":{"type":"object","properties":{"success":{"type":"boolean","const":true}},"required":["success"]},"LlmProviderCatalogListResponse":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"required":["providers"]},"ProviderCatalogUnavailableError":{"type":"object","properties":{"error":{"type":"string","const":"provider_catalog_unavailable"},"message":{"type":"string"}},"required":["error","message"]},"LlmProviderCatalogResponse":{"type":"object","properties":{"provider":{"type":"object","properties":{},"additionalProperties":{}}},"required":["provider"]},"LlmProviderListResponse":{"type":"object","properties":{"llmProviders":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"required":["llmProviders"]},"LlmProviderResponse":{"type":"object","properties":{"llmProvider":{"type":"object","properties":{},"additionalProperties":{}}},"required":["llmProvider"]},"ConflictError":{"type":"object","properties":{"error":{"type":"string"},"message":{"type":"string"}},"required":["error"]},"PluginArchGithubInstallStartResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"redirectUrl":{"type":"string","format":"uri"},"state":{"type":"string","minLength":1}},"required":["redirectUrl","state"]}},"required":["ok","item"]},"PluginArchConnectorAccount":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"type":"string","minLength":1,"maxLength":255},"externalAccountRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"displayName":{"type":"string","minLength":1,"maxLength":255},"status":{"type":"string","enum":["active","inactive","disconnected","error"]},"createdByName":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"metadata":{"type":"object","properties":{},"additionalProperties":{}}},"required":["id","organizationId","connectorType","remoteId","externalAccountRef","displayName","status","createdByOrgMembershipId","createdAt","updatedAt"]},"PluginArchGithubRepository":{"type":"object","properties":{"id":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"fullName":{"type":"string","minLength":1},"defaultBranch":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"hasPluginManifest":{"type":"boolean"},"manifestKind":{"anyOf":[{"type":"string","enum":["marketplace","plugin"]},{"type":"null"}]},"marketplacePluginCount":{"anyOf":[{"type":"integer","minimum":0,"maximum":9007199254740991},{"type":"null"}]},"private":{"type":"boolean"}},"required":["id","fullName","defaultBranch","private"]},"PluginArchGithubInstallCompleteResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"connectorAccount":{"$ref":"#/components/schemas/PluginArchConnectorAccount"},"repositories":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchGithubRepository"}}},"required":["connectorAccount","repositories"]}},"required":["ok","item"]},"PluginArchConfigObjectVersion":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cov_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cov_.*"},"configObjectId":{"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"schemaVersion":{"anyOf":[{"type":"string","minLength":1,"maxLength":100},{"type":"null"}]},"normalizedPayloadJson":{"anyOf":[{"type":"object","properties":{},"additionalProperties":{}},{"type":"null"}]},"rawSourceText":{"anyOf":[{"type":"string"},{"type":"null"}]},"createdVia":{"type":"string","enum":["cloud","import","connector","system"]},"createdByOrgMembershipId":{"anyOf":[{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},{"type":"null"}]},"connectorSyncEventId":{"anyOf":[{"description":"Den TypeID with 'cse_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cse_.*"},{"type":"null"}]},"sourceRevisionRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"isDeletedVersion":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"}},"required":["id","configObjectId","schemaVersion","normalizedPayloadJson","rawSourceText","createdVia","createdByOrgMembershipId","connectorSyncEventId","sourceRevisionRef","isDeletedVersion","createdAt"]},"PluginArchConfigObject":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"objectType":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"sourceMode":{"type":"string","enum":["cloud","import","connector"]},"title":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"searchText":{"anyOf":[{"type":"string","minLength":1,"maxLength":65535},{"type":"null"}]},"currentFileName":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"currentFileExtension":{"anyOf":[{"type":"string","minLength":1,"maxLength":32},{"type":"null"}]},"currentRelativePath":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"status":{"type":"string","enum":["active","inactive","deleted","archived","ingestion_error"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"connectorInstanceId":{"anyOf":[{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"deletedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"latestVersion":{"anyOf":[{"$ref":"#/components/schemas/PluginArchConfigObjectVersion"},{"type":"null"}]}},"required":["id","organizationId","objectType","sourceMode","title","description","searchText","currentFileName","currentFileExtension","currentRelativePath","status","createdByOrgMembershipId","connectorInstanceId","createdAt","updatedAt","deletedAt","latestVersion"]},"PluginArchConfigObjectListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConfigObject"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConfigObjectMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchConfigObject"}},"required":["ok","item"]},"PluginArchConfigObjectDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConfigObject"}},"required":["item"]},"PluginArchConfigObjectVersionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConfigObjectVersion"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConfigObjectVersionDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConfigObjectVersion"}},"required":["item"]},"PluginArchPluginMembership":{"type":"object","properties":{"id":{"description":"Den TypeID with 'pco_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^pco_.*"},"pluginId":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"configObjectId":{"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"membershipSource":{"type":"string","enum":["manual","connector","api","system"]},"connectorMappingId":{"anyOf":[{"description":"Den TypeID with 'cmp_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cmp_.*"},{"type":"null"}]},"createdByOrgMembershipId":{"anyOf":[{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"removedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"configObject":{"$ref":"#/components/schemas/PluginArchConfigObject"}},"required":["id","pluginId","configObjectId","membershipSource","connectorMappingId","createdByOrgMembershipId","createdAt","removedAt"]},"PluginArchPluginMembershipListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchPluginMembership"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchPluginMembershipMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchPluginMembership"}},"required":["ok","item"]},"PluginArchAccessGrant":{"type":"object","properties":{"id":{"anyOf":[{"description":"Den TypeID with 'coa_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^coa_.*"},{"description":"Den TypeID with 'pag_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^pag_.*"},{"description":"Den TypeID with 'mag_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mag_.*"},{"description":"Den TypeID with 'cia_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cia_.*"}]},"orgMembershipId":{"anyOf":[{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},{"type":"null"}]},"teamId":{"anyOf":[{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},{"type":"null"}]},"orgWide":{"type":"boolean"},"role":{"type":"string","enum":["viewer","editor","manager"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"removedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]}},"required":["id","orgMembershipId","teamId","orgWide","role","createdByOrgMembershipId","createdAt","removedAt"]},"PluginArchAccessGrantListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchAccessGrant"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchAccessGrantMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchAccessGrant"}},"required":["ok","item"]},"PluginArchPlugin":{"type":"object","properties":{"id":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"status":{"type":"string","enum":["active","inactive","deleted","archived"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"deletedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"memberCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"marketplaces":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"name":{"type":"string","minLength":1,"maxLength":255}},"required":["id","name"]}}},"required":["id","organizationId","name","description","status","createdByOrgMembershipId","createdAt","updatedAt","deletedAt"]},"PluginArchPluginListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchPlugin"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchPluginMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchPlugin"}},"required":["ok","item"]},"PluginArchPluginDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchPlugin"}},"required":["item"]},"PluginArchMarketplace":{"type":"object","properties":{"id":{"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"status":{"type":"string","enum":["active","inactive","deleted","archived"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"deletedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"pluginCount":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["id","organizationId","name","description","status","createdByOrgMembershipId","createdAt","updatedAt","deletedAt"]},"PluginArchMarketplaceListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchMarketplace"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchMarketplaceMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchMarketplace"}},"required":["ok","item"]},"PluginArchMarketplaceDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchMarketplace"}},"required":["item"]},"PluginArchMarketplacePluginMembership":{"type":"object","properties":{"id":{"description":"Den TypeID with 'mkp_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkp_.*"},"marketplaceId":{"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"pluginId":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"membershipSource":{"type":"string","enum":["manual","connector","api","system"]},"createdByOrgMembershipId":{"anyOf":[{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"removedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"plugin":{"$ref":"#/components/schemas/PluginArchPlugin"}},"required":["id","marketplaceId","pluginId","membershipSource","createdByOrgMembershipId","createdAt","removedAt"]},"PluginArchMarketplacePluginListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchMarketplacePluginMembership"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchMarketplaceResolvedResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"marketplace":{"$ref":"#/components/schemas/PluginArchMarketplace"},"plugins":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"status":{"type":"string","enum":["active","inactive","deleted","archived"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"deletedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"memberCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"marketplaces":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"name":{"type":"string","minLength":1,"maxLength":255}},"required":["id","name"]}},"componentCounts":{"default":{},"type":"object","propertyNames":{"type":"string"},"additionalProperties":{"type":"integer","minimum":0,"maximum":9007199254740991}}},"required":["id","organizationId","name","description","status","createdByOrgMembershipId","createdAt","updatedAt","deletedAt"]}},"source":{"anyOf":[{"type":"object","properties":{"connectorAccountId":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"connectorInstanceId":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"accountLogin":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"repositoryFullName":{"type":"string","minLength":1},"branch":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]}},"required":["connectorAccountId","connectorInstanceId","accountLogin","repositoryFullName","branch"]},{"type":"null"}]}},"required":["marketplace","plugins","source"]}},"required":["ok","item"]},"PluginArchMarketplacePluginMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchMarketplacePluginMembership"}},"required":["ok","item"]},"PluginArchConnectorAccountListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorAccount"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorAccountMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchConnectorAccount"}},"required":["ok","item"]},"PluginArchConnectorAccountDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConnectorAccount"}},"required":["item"]},"PluginArchConnectorAccountDisconnectResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"deletedConfigObjectCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletedConnectorInstanceCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletedConnectorMappingCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"disconnectedAccountId":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"reason":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["deletedConfigObjectCount","deletedConnectorInstanceCount","deletedConnectorMappingCount","disconnectedAccountId","reason"]}},"required":["ok","item"]},"PluginArchConnectorInstance":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"connectorAccountId":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"name":{"type":"string","minLength":1,"maxLength":255},"status":{"type":"string","enum":["active","disabled","archived","error"]},"instanceConfigJson":{"anyOf":[{"type":"object","properties":{},"additionalProperties":{}},{"type":"null"}]},"lastSyncedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"lastSyncStatus":{"anyOf":[{"type":"string","enum":["pending","queued","running","completed","failed","partial","ignored"]},{"type":"null"}]},"lastSyncCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"}},"required":["id","organizationId","connectorAccountId","connectorType","remoteId","name","status","instanceConfigJson","lastSyncedAt","lastSyncStatus","lastSyncCursor","createdByOrgMembershipId","createdAt","updatedAt"]},"PluginArchConnectorInstanceListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorInstance"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorInstanceMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchConnectorInstance"}},"required":["ok","item"]},"PluginArchConnectorInstanceDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConnectorInstance"}},"required":["item"]},"PluginArchConnectorInstanceConfiguredPlugin":{"type":"object","properties":{"id":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"status":{"type":"string","enum":["active","inactive","deleted","archived"]},"createdByOrgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"deletedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]},"memberCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"marketplaces":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"name":{"type":"string","minLength":1,"maxLength":255}},"required":["id","name"]}},"componentCounts":{"default":{},"type":"object","propertyNames":{"type":"string"},"additionalProperties":{"type":"integer","minimum":0,"maximum":9007199254740991}},"rootPath":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["id","organizationId","name","description","status","createdByOrgMembershipId","createdAt","updatedAt","deletedAt","rootPath"]},"PluginArchConnectorInstanceConfigurationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"autoImportNewPlugins":{"type":"boolean"},"configuredPlugins":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorInstanceConfiguredPlugin"}},"connectorInstance":{"$ref":"#/components/schemas/PluginArchConnectorInstance"},"importedConfigObjectCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"mappingCount":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["autoImportNewPlugins","configuredPlugins","connectorInstance","importedConfigObjectCount","mappingCount"]}},"required":["ok","item"]},"PluginArchConnectorInstanceRemoveResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"deletedConfigObjectCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletedConnectorMappingCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"removedConnectorInstanceId":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"}},"required":["deletedConfigObjectCount","deletedConnectorMappingCount","removedConnectorInstanceId"]}},"required":["ok","item"]},"PluginArchConnectorTarget":{"type":"object","properties":{"id":{"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"connectorInstanceId":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"type":"string","minLength":1,"maxLength":255},"targetKind":{"type":"string","enum":["repository_branch"]},"externalTargetRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"targetConfigJson":{"type":"object","properties":{},"additionalProperties":{}},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"}},"required":["id","connectorInstanceId","connectorType","remoteId","targetKind","externalTargetRef","targetConfigJson","createdAt","updatedAt"]},"PluginArchGithubDiscoveredPlugin":{"type":"object","properties":{"key":{"type":"string","minLength":1},"sourceKind":{"type":"string","enum":["marketplace_entry","plugin_manifest","standalone_claude","folder_inference"]},"rootPath":{"type":"string"},"displayName":{"type":"string","minLength":1},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"selectedByDefault":{"type":"boolean"},"supported":{"type":"boolean"},"manifestPath":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"warnings":{"type":"array","items":{"type":"string","minLength":1}},"componentKinds":{"type":"array","items":{"type":"string","enum":["skill","command","agent","hook","mcp_server","lsp_server","monitor","settings"]}},"componentPaths":{"type":"object","properties":{"agents":{"type":"array","items":{"type":"string","minLength":1}},"commands":{"type":"array","items":{"type":"string","minLength":1}},"hooks":{"type":"array","items":{"type":"string","minLength":1}},"lspServers":{"type":"array","items":{"type":"string","minLength":1}},"mcpServers":{"type":"array","items":{"type":"string","minLength":1}},"monitors":{"type":"array","items":{"type":"string","minLength":1}},"settings":{"type":"array","items":{"type":"string","minLength":1}},"skills":{"type":"array","items":{"type":"string","minLength":1}}},"required":["agents","commands","hooks","lspServers","mcpServers","monitors","settings","skills"]},"metadata":{"type":"object","properties":{},"additionalProperties":{}}},"required":["key","sourceKind","rootPath","displayName","description","selectedByDefault","supported","manifestPath","warnings","componentKinds","componentPaths","metadata"]},"PluginArchGithubDiscoveryStep":{"type":"object","properties":{"id":{"type":"string","enum":["read_repository_structure","check_marketplace_manifest","check_plugin_manifests","prepare_discovered_plugins"]},"label":{"type":"string","minLength":1},"status":{"type":"string","enum":["completed","running","warning"]}},"required":["id","label","status"]},"PluginArchGithubDiscoveryTreeSummary":{"type":"object","properties":{"scannedEntryCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"strategy":{"type":"string","enum":["git-tree-recursive"]},"truncated":{"type":"boolean"}},"required":["scannedEntryCount","strategy","truncated"]},"PluginArchGithubConnectorDiscoveryResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"autoImportNewPlugins":{"type":"boolean"},"classification":{"type":"string","enum":["claude_marketplace_repo","claude_multi_plugin_repo","claude_single_plugin_repo","folder_inferred_repo","unsupported"]},"connectorInstance":{"$ref":"#/components/schemas/PluginArchConnectorInstance"},"connectorTarget":{"$ref":"#/components/schemas/PluginArchConnectorTarget"},"discoveredPlugins":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchGithubDiscoveredPlugin"}},"repositoryFullName":{"type":"string","minLength":1},"sourceRevisionRef":{"type":"string","minLength":1},"steps":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchGithubDiscoveryStep"}},"treeSummary":{"$ref":"#/components/schemas/PluginArchGithubDiscoveryTreeSummary"},"warnings":{"type":"array","items":{"type":"string","minLength":1}}},"required":["autoImportNewPlugins","classification","connectorInstance","connectorTarget","discoveredPlugins","repositoryFullName","sourceRevisionRef","steps","treeSummary","warnings"]}},"required":["ok","item"]},"PluginArchGithubDiscoveryTreeEntry":{"type":"object","properties":{"id":{"type":"string","minLength":1},"kind":{"type":"string","enum":["blob","tree"]},"path":{"type":"string","minLength":1},"sha":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"size":{"anyOf":[{"type":"integer","minimum":0,"maximum":9007199254740991},{"type":"null"}]}},"required":["id","kind","path","sha","size"]},"PluginArchGithubDiscoveryTreeResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchGithubDiscoveryTreeEntry"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorMapping":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cmp_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cmp_.*"},"connectorInstanceId":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"connectorTargetId":{"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"mappingKind":{"type":"string","enum":["path","api","custom"]},"selector":{"type":"string","minLength":1,"maxLength":255},"objectType":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"pluginId":{"anyOf":[{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},{"type":"null"}]},"autoAddToPlugin":{"type":"boolean"},"mappingConfigJson":{"anyOf":[{"type":"object","properties":{},"additionalProperties":{}},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"}},"required":["id","connectorInstanceId","connectorTargetId","connectorType","remoteId","mappingKind","selector","objectType","pluginId","autoAddToPlugin","mappingConfigJson","createdAt","updatedAt"]},"PluginArchGithubDiscoveryApplyResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"autoImportNewPlugins":{"type":"boolean"},"createdMarketplace":{"anyOf":[{"$ref":"#/components/schemas/PluginArchMarketplace"},{"type":"null"}]},"connectorInstance":{"$ref":"#/components/schemas/PluginArchConnectorInstance"},"connectorTarget":{"$ref":"#/components/schemas/PluginArchConnectorTarget"},"createdPlugins":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchPlugin"}},"createdMappings":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorMapping"}},"materializedConfigObjects":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConfigObject"}},"sourceRevisionRef":{"type":"string","minLength":1}},"required":["autoImportNewPlugins","connectorInstance","connectorTarget","createdPlugins","createdMappings","materializedConfigObjects","sourceRevisionRef"]}},"required":["ok","item"]},"PluginArchConnectorTargetListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorTarget"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorTargetMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchConnectorTarget"}},"required":["ok","item"]},"PluginArchConnectorTargetDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConnectorTarget"}},"required":["item"]},"PluginArchConnectorSyncAsyncResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"queued":{"type":"boolean","const":true},"job":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cse_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cse_.*"}},"required":["id"]}},"required":["ok","queued","job"]},"PluginArchConnectorMappingListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorMapping"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorMappingMutationResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"$ref":"#/components/schemas/PluginArchConnectorMapping"}},"required":["ok","item"]},"PluginArchConnectorSyncSummary":{"type":"object","properties":{"createdCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"updatedCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletedCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"skippedCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"failedCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"failures":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"additionalProperties":{}},"PluginArchConnectorSyncEvent":{"type":"object","properties":{"id":{"description":"Den TypeID with 'cse_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cse_.*"},"connectorInstanceId":{"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"connectorTargetId":{"anyOf":[{"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},{"type":"null"}]},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"eventType":{"type":"string","enum":["push","installation","installation_repositories","repository","manual_resync"]},"externalEventRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"sourceRevisionRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"status":{"type":"string","enum":["pending","queued","running","completed","failed","partial","ignored"]},"summaryJson":{"anyOf":[{"$ref":"#/components/schemas/PluginArchConnectorSyncSummary"},{"type":"null"}]},"startedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"completedAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},{"type":"null"}]}},"required":["id","connectorInstanceId","connectorTargetId","connectorType","remoteId","eventType","externalEventRef","sourceRevisionRef","status","summaryJson","startedAt","completedAt"]},"PluginArchConnectorSyncEventListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchConnectorSyncEvent"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchConnectorSyncEventDetailResponse":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/PluginArchConnectorSyncEvent"}},"required":["item"]},"PluginArchGithubSetupResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"connectorAccount":{"$ref":"#/components/schemas/PluginArchConnectorAccount"},"connectorInstance":{"$ref":"#/components/schemas/PluginArchConnectorInstance"},"connectorTarget":{"$ref":"#/components/schemas/PluginArchConnectorTarget"}},"required":["connectorAccount","connectorInstance","connectorTarget"]}},"required":["ok","item"]},"PluginArchGithubRepositoryListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PluginArchGithubRepository"}},"nextCursor":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]}},"required":["items","nextCursor"]},"PluginArchGithubValidateTargetResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"item":{"type":"object","properties":{"branchExists":{"type":"boolean"},"defaultBranch":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"repositoryAccessible":{"type":"boolean"}},"required":["branchExists","defaultBranch","repositoryAccessible"]}},"required":["ok","item"]},"SkillResponse":{"type":"object","properties":{"skill":{"type":"object","properties":{},"additionalProperties":{}}},"required":["skill"]},"SkillListResponse":{"type":"object","properties":{"skills":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"required":["skills"]},"SkillHubResponse":{"type":"object","properties":{"skillHub":{"type":"object","properties":{},"additionalProperties":{}}},"required":["skillHub"]},"SkillHubListResponse":{"type":"object","properties":{"skillHubs":{"type":"array","items":{"type":"object","properties":{},"additionalProperties":{}}}},"required":["skillHubs"]},"SkillHubAccessResponse":{"type":"object","properties":{"access":{"type":"object","properties":{},"additionalProperties":{}}},"required":["access"]},"TeamResponse":{"type":"object","properties":{"team":{"type":"object","properties":{"id":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"organizationId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"name":{"type":"string"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"memberIds":{"type":"array","items":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"}}},"required":["id","organizationId","name","createdAt","updatedAt","memberIds"]}},"required":["team"]},"DenAppVersionResponse":{"type":"object","properties":{"minAppVersion":{"type":"string"},"latestAppVersion":{"type":"string","minLength":1}},"required":["minAppVersion","latestAppVersion"]},"PluginArchGithubWebhookIgnoredResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"accepted":{"type":"boolean","const":false},"reason":{"type":"string","minLength":1}},"required":["ok","accepted","reason"]},"PluginArchGithubWebhookAcceptedResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"accepted":{"type":"boolean","const":true},"event":{"type":"string","enum":["push","installation","installation_repositories","repository"]},"deliveryId":{"type":"string","minLength":1},"queued":{"type":"boolean"}},"required":["ok","accepted","event","deliveryId","queued"]},"PluginArchGithubWebhookUnauthorizedResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":false},"error":{"type":"string","const":"invalid signature"}},"required":["ok","error"]},"WorkerHeartbeatResponse":{"type":"object","properties":{"ok":{"type":"boolean","const":true},"workerId":{"type":"string"},"isActiveRecently":{"type":"boolean"},"openSessionCount":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"lastHeartbeatAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"lastActiveAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]}},"required":["ok","workerId","isActiveRecently","openSessionCount","lastHeartbeatAt","lastActiveAt"]},"WorkerBillingResponse":{"type":"object","properties":{"billing":{"type":"object","properties":{"status":{"type":"string"},"featureGateEnabled":{"type":"boolean"},"productId":{"anyOf":[{"type":"string"},{"type":"null"}]},"benefitId":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["status","featureGateEnabled"],"additionalProperties":{}}},"required":["billing"]},"UserEmailRequiredError":{"type":"object","properties":{"error":{"type":"string","const":"user_email_required"}},"required":["error"]},"WorkerBillingSubscriptionResponse":{"type":"object","properties":{"subscription":{"type":"object","properties":{},"additionalProperties":{}},"billing":{"type":"object","properties":{"status":{"type":"string"},"featureGateEnabled":{"type":"boolean"},"productId":{"anyOf":[{"type":"string"},{"type":"null"}]},"benefitId":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["status","featureGateEnabled"],"additionalProperties":{}}},"required":["subscription","billing"]},"WorkerInstance":{"anyOf":[{"type":"object","properties":{"provider":{"type":"string"},"region":{"anyOf":[{"type":"string"},{"type":"null"}]},"url":{"anyOf":[{"type":"string"},{"type":"null"}]},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["provider","region","url","status","createdAt","updatedAt"]},{"type":"null"}]},"WorkerListResponse":{"type":"object","properties":{"workers":{"type":"array","items":{"type":"object","properties":{"instance":{"$ref":"#/components/schemas/WorkerInstance"},"id":{"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"orgId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"createdByUserId":{"anyOf":[{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},{"type":"null"}]},"isMine":{"type":"boolean"},"name":{"type":"string"},"description":{"anyOf":[{"type":"string"},{"type":"null"}]},"destination":{"type":"string"},"status":{"type":"string"},"imageVersion":{"anyOf":[{"type":"string"},{"type":"null"}]},"workspacePath":{"anyOf":[{"type":"string"},{"type":"null"}]},"sandboxBackend":{"anyOf":[{"type":"string"},{"type":"null"}]},"lastHeartbeatAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"lastActiveAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["instance","id","orgId","createdByUserId","isMine","name","description","destination","status","imageVersion","workspacePath","sandboxBackend","lastHeartbeatAt","lastActiveAt","createdAt","updatedAt"]}}},"required":["workers"]},"Worker":{"type":"object","properties":{"id":{"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"orgId":{"description":"Den TypeID with 'org_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^org_.*"},"createdByUserId":{"anyOf":[{"description":"Den TypeID with 'usr_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^usr_.*"},{"type":"null"}]},"isMine":{"type":"boolean"},"name":{"type":"string"},"description":{"anyOf":[{"type":"string"},{"type":"null"}]},"destination":{"type":"string"},"status":{"type":"string"},"imageVersion":{"anyOf":[{"type":"string"},{"type":"null"}]},"workspacePath":{"anyOf":[{"type":"string"},{"type":"null"}]},"sandboxBackend":{"anyOf":[{"type":"string"},{"type":"null"}]},"lastHeartbeatAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"lastActiveAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"createdAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"updatedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["id","orgId","createdByUserId","isMine","name","description","destination","status","imageVersion","workspacePath","sandboxBackend","lastHeartbeatAt","lastActiveAt","createdAt","updatedAt"]},"WorkerCreateResponse":{"type":"object","properties":{"worker":{"$ref":"#/components/schemas/Worker"},"tokens":{"type":"object","properties":{"owner":{"type":"string"},"host":{"type":"string"},"client":{"type":"string"}},"required":["owner","host","client"]},"instance":{"$ref":"#/components/schemas/WorkerInstance"},"launch":{"type":"object","properties":{"mode":{"type":"string"},"pollAfterMs":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["mode","pollAfterMs"]}},"required":["worker","tokens","instance","launch"]},"OrganizationUnavailableError":{"type":"object","properties":{"error":{"type":"string","const":"organization_unavailable"}},"required":["error"]},"WorkspacePathRequiredError":{"type":"object","properties":{"error":{"type":"string","const":"workspace_path_required"}},"required":["error"]},"WorkerOrgLimitReachedError":{"type":"object","properties":{"error":{"type":"string","const":"org_limit_reached"},"limitType":{"type":"string","const":"workers"},"limit":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"currentCount":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"message":{"type":"string"}},"required":["error","limitType","limit","currentCount","message"]},"WorkerResponse":{"type":"object","properties":{"worker":{"$ref":"#/components/schemas/Worker"},"instance":{"$ref":"#/components/schemas/WorkerInstance"}},"required":["worker","instance"]},"WorkerUpdateResponse":{"type":"object","properties":{"worker":{"$ref":"#/components/schemas/Worker"}},"required":["worker"]},"WorkerTokensResponse":{"type":"object","properties":{"tokens":{"type":"object","properties":{"owner":{"type":"string"},"host":{"type":"string"},"client":{"type":"string"}},"required":["owner","host","client"]},"connect":{"anyOf":[{"type":"object","properties":{"openworkUrl":{"anyOf":[{"type":"string"},{"type":"null"}]},"workspaceId":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["openworkUrl","workspaceId"]},{"type":"null"}]}},"required":["tokens","connect"]},"WorkerConnectionError":{"anyOf":[{"type":"object","properties":{"error":{"type":"string","const":"worker_tokens_unavailable"},"message":{"type":"string"}},"required":["error","message"]},{"type":"object","properties":{"error":{"type":"string","const":"worker_runtime_unavailable"},"message":{"type":"string"}},"required":["error","message"]}]},"WorkerRuntimeResponse":{"type":"object","properties":{},"additionalProperties":{}},"OpenApiDocument":{"type":"object","properties":{"openapi":{"type":"string"},"info":{"type":"object","properties":{"title":{"type":"string"},"version":{"type":"string"}},"required":["title","version"],"additionalProperties":{}},"paths":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},"components":{"type":"object","properties":{},"additionalProperties":{}}},"required":["openapi","info","paths"],"additionalProperties":{}}}},"paths":{"/health":{"get":{"operationId":"getHealth","tags":["System"],"summary":"Check den-api health","description":"Returns a lightweight health payload for den-api.","responses":{"200":{"description":"den-api is reachable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DenApiHealthResponse"}}}}}}},"/v1/admin/overview":{"get":{"operationId":"getV1AdminOverview","tags":["Admin"],"summary":"Get admin overview","description":"Returns a high-level administrative overview of users, sessions, workers, admins, and optional billing data for Den operations.","responses":{"200":{"description":"Administrative overview returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminOverviewResponse"}}}},"400":{"description":"The admin overview query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be an authenticated admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}},"parameters":[{"in":"query","name":"includeBilling","schema":{"type":"string"}}]}},"/api/auth/.well-known/oauth-authorization-server":{"get":{"operationId":"getApiAuthWellKnownOauthAuthorizationServer","responses":{"200":{"description":"Response"}}}},"/api/auth/.well-known/openid-configuration":{"get":{"operationId":"getApiAuthWellKnownOpenidConfiguration","responses":{"200":{"description":"Response"}}}},"/.well-known/oauth-authorization-server/api/auth":{"get":{"operationId":"getWellKnownOauthAuthorizationServerApiAuth","responses":{"200":{"description":"Response"}}}},"/.well-known/openid-configuration/api/auth":{"get":{"operationId":"getWellKnownOpenidConfigurationApiAuth","responses":{"200":{"description":"Response"}}}},"/.well-known/oauth-authorization-server":{"get":{"operationId":"getWellKnownOauthAuthorizationServer","responses":{"200":{"description":"Response"}}}},"/.well-known/openid-configuration":{"get":{"operationId":"getWellKnownOpenidConfiguration","responses":{"200":{"description":"Response"}}}},"/register":{"post":{"operationId":"postRegister","responses":{"200":{"description":"Response"}}}},"/api/auth/oauth2/register":{"post":{"operationId":"postApiAuthOauth2Register","responses":{"200":{"description":"Response"}}}},"/api/auth/oauth2/authorize":{"get":{"operationId":"getApiAuthOauth2Authorize","responses":{"200":{"description":"Response"}}}},"/v1/me":{"get":{"operationId":"getV1Me","tags":["Users"],"summary":"Get current user","description":"Returns the currently authenticated user and active session details for the caller.","responses":{"200":{"description":"Current user and session returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUserResponse"}}}},"401":{"description":"The caller must be signed in to read profile data.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/me/orgs":{"get":{"operationId":"getV1MeOrgs","tags":["Users"],"summary":"List current user's organizations","description":"Lists the organizations visible to the current user and marks which organization is currently active.","responses":{"200":{"description":"Current user organizations returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUserOrganizationsResponse"}}}}}}},"/v1/me/desktop-config":{"get":{"operationId":"getV1MeDesktopConfig","tags":["Users"],"summary":"Get current user's desktop config","description":"Returns the authenticated desktop app restrictions for the caller's active organization.","responses":{"200":{"description":"Current user desktop config returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUserDesktopConfigResponse"}}}},"401":{"description":"The caller must be signed in to read desktop config.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/org":{"patch":{"operationId":"patchV1Org","tags":["Organizations"],"summary":"Update organization","description":"Updates organization fields that workspace owners are allowed to change, including the display name, allowed invitation email domains, and desktop app restrictions. The slug is immutable to avoid breaking dashboard URLs.","responses":{"200":{"description":"Organization updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationResponse"}}}},"400":{"description":"The organization update request body was invalid or contained malformed email domains.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidEmailDomainError"}}}},"401":{"description":"The caller must be signed in to update an organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can update the organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":120},"allowedEmailDomains":{"anyOf":[{"maxItems":100,"type":"array","items":{"type":"string","minLength":1,"maxLength":255}},{"type":"null"}]},"desktopAppRestrictions":{"$ref":"#/components/schemas/DenDesktopAppRestrictions"},"allowedDesktopVersions":{"anyOf":[{"maxItems":200,"type":"array","items":{"type":"string","minLength":1,"maxLength":32}},{"type":"null"}]}}}}}}},"get":{"operationId":"getV1Org","tags":["Organizations"],"summary":"Get active organization","description":"Returns the active organization from the current session, including its owner, the current member record, and their team memberships.","responses":{"200":{"description":"Organization context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationContextResponse"}}}},"401":{"description":"The caller must be signed in to load organization context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/orgs/invitations/preview":{"get":{"operationId":"getV1OrgsInvitationsPreview","tags":["Invitations"],"summary":"Preview organization invitation","description":"Returns invitation preview details so a user can inspect an organization invite before accepting it.","responses":{"200":{"description":"Invitation preview returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationPreviewResponse"}}}},"400":{"description":"The invitation preview query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"404":{"description":"The invitation could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"query","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"},"required":true,"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix."}]}},"/v1/orgs/invitations/accept":{"post":{"operationId":"postV1OrgsInvitationsAccept","tags":["Invitations"],"summary":"Accept organization invitation","description":"Accepts an organization invitation for the current signed-in user and switches their active organization to the accepted workspace.","responses":{"200":{"description":"Invitation accepted successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationAcceptedResponse"}}}},"400":{"description":"The invitation acceptance request body was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to accept an invitation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"API keys cannot accept organization invitations.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The invitation could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The current account email is not allowed to join this organization.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountEmailDomainNotAllowedError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"}},"required":["id"]}}}}}},"/v1/api-keys":{"get":{"operationId":"getV1ApiKeys","tags":["API Keys"],"summary":"List organization API keys","description":"Returns the API keys that belong to the selected organization.","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Organization API keys","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationApiKeyListResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can list API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationApiKeyForbiddenError"}}}},"404":{"description":"Organization not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationNotFoundError"}}}}}}},"/v1/invitations":{"post":{"operationId":"postV1Invitations","tags":["Invitations"],"summary":"Create organization invitation","description":"Creates or refreshes a pending organization invitation for an email address and sends the invite email. Returns 502 when the invitation row is persisted but the email provider (Loops) failed to send; the client should surface the error and give the user a retry affordance.","responses":{"200":{"description":"Existing invitation refreshed successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationResponse"}}}},"201":{"description":"Invitation created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationResponse"}}}},"400":{"description":"The invitation request body or path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to invite organization members.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can create or resend invitations.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The email address is outside this workspace's allowed domains.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InviteEmailDomainNotAllowedError"}}}},"502":{"description":"The invitation was saved but the email provider (Loops) rejected or failed to deliver it. Retry by submitting the same email again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationEmailFailedError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","pattern":"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"},"role":{"type":"string","minLength":1,"maxLength":64}},"required":["email","role"]}}}}}},"/v1/invitations/{invitationId}/cancel":{"post":{"operationId":"postV1InvitationsByInvitationIdCancel","tags":["Invitations"],"summary":"Cancel organization invitation","description":"Cancels a pending organization invitation so the invite link can no longer be used.","responses":{"200":{"description":"Invitation cancelled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"The invitation cancellation path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to cancel invitations.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can cancel invitations.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The invitation or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"invitationId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^inv_.*"},"required":true,"description":"Den TypeID with 'inv_' prefix and a 26-character base32 suffix."}]}},"/v1/llm-provider-catalog":{"get":{"operationId":"getV1LlmProviderCatalog","tags":["LLM Providers"],"summary":"List LLM provider catalog","description":"Lists the provider catalog from models.dev so an organization can choose which LLM providers to configure.","responses":{"200":{"description":"Provider catalog returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderCatalogListResponse"}}}},"400":{"description":"The provider catalog path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to browse the provider catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"502":{"description":"The external provider catalog was unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCatalogUnavailableError"}}}}}}},"/v1/llm-provider-catalog/{providerId}":{"get":{"operationId":"getV1LlmProviderCatalogByProviderId","tags":["LLM Providers"],"summary":"Get LLM provider catalog entry","description":"Returns the full models.dev catalog record for one provider, including its config template and model list.","responses":{"200":{"description":"Provider catalog entry returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderCatalogResponse"}}}},"400":{"description":"The provider catalog path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to inspect provider catalog entries.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The requested provider catalog entry could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"502":{"description":"The external provider catalog was unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCatalogUnavailableError"}}}}},"parameters":[{"in":"path","name":"providerId","schema":{"type":"string","minLength":1,"maxLength":255},"required":true}]}},"/v1/llm-providers":{"get":{"operationId":"getV1LlmProviders","tags":["LLM Providers"],"summary":"List organization LLM providers","description":"Lists the LLM providers that the current organization member is allowed to see and potentially manage.","responses":{"200":{"description":"Accessible organization LLM providers returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderListResponse"}}}},"400":{"description":"The provider list path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list organization LLM providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1LlmProviders","tags":["LLM Providers"],"summary":"Create organization LLM provider","description":"Creates a new organization-scoped LLM provider from either a models.dev provider template or a pasted custom configuration.","responses":{"201":{"description":"Organization LLM provider created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderResponse"}}}},"400":{"description":"The provider creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create organization LLM providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"A referenced provider, model, member, or team could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"source":{"type":"string","enum":["models_dev","custom"]},"providerId":{"type":"string","minLength":1,"maxLength":255},"modelIds":{"minItems":1,"type":"array","items":{"type":"string","minLength":1,"maxLength":255}},"customConfigText":{"type":"string","minLength":1},"apiKey":{"type":"string","maxLength":65535},"memberIds":{"maxItems":500,"type":"array","items":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"}},"teamIds":{"maxItems":500,"type":"array","items":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"}}},"required":["name","source"]}}}}}},"/v1/llm-providers/{llmProviderId}/connect":{"get":{"operationId":"getV1LlmProvidersByLlmProviderIdConnect","tags":["LLM Providers"],"summary":"Get LLM provider connect payload","description":"Returns one accessible organization LLM provider with the concrete model configuration needed to connect to it.","responses":{"200":{"description":"Provider connection payload returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderResponse"}}}},"400":{"description":"The provider connect path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to connect to an organization LLM provider.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only members with access grants, the provider creator, or workspace admins can connect to this provider.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The provider could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"llmProviderId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^lpr_.*"},"required":true,"description":"Den TypeID with 'lpr_' prefix and a 26-character base32 suffix."}]}},"/v1/llm-providers/{llmProviderId}":{"patch":{"operationId":"patchV1LlmProvidersByLlmProviderId","tags":["LLM Providers"],"summary":"Update organization LLM provider","description":"Updates an existing organization LLM provider, including its provider config, selected models, secret, and access grants.","responses":{"200":{"description":"Organization LLM provider updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LlmProviderResponse"}}}},"400":{"description":"The provider update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update organization LLM providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the provider creator or a workspace admin can update providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The provider or a referenced resource could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"llmProviderId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^lpr_.*"},"required":true,"description":"Den TypeID with 'lpr_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"source":{"type":"string","enum":["models_dev","custom"]},"providerId":{"type":"string","minLength":1,"maxLength":255},"modelIds":{"minItems":1,"type":"array","items":{"type":"string","minLength":1,"maxLength":255}},"customConfigText":{"type":"string","minLength":1},"apiKey":{"type":"string","maxLength":65535},"memberIds":{"maxItems":500,"type":"array","items":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"}},"teamIds":{"maxItems":500,"type":"array","items":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"}}},"required":["name","source"]}}}}},"delete":{"operationId":"deleteV1LlmProvidersByLlmProviderId","tags":["LLM Providers"],"summary":"Delete organization LLM provider","description":"Deletes an organization LLM provider and removes its models and access rules.","responses":{"204":{"description":"Organization LLM provider deleted successfully."},"400":{"description":"The provider deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete organization LLM providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the provider creator or a workspace admin can delete providers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The provider could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"llmProviderId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^lpr_.*"},"required":true,"description":"Den TypeID with 'lpr_' prefix and a 26-character base32 suffix."}]}},"/v1/llm-providers/{llmProviderId}/access/{accessId}":{"delete":{"operationId":"deleteV1LlmProvidersByLlmProviderIdAccessByAccessId","tags":["LLM Providers"],"summary":"Remove LLM provider access grant","description":"Removes one explicit member or team access grant from an organization LLM provider.","responses":{"204":{"description":"Organization LLM provider access removed successfully."},"400":{"description":"The provider access deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage provider access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the provider creator or a workspace admin can manage provider access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The provider or access grant could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The request tried to remove a protected provider access entry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConflictError"}}}}},"parameters":[{"in":"path","name":"llmProviderId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^lpr_.*"},"required":true,"description":"Den TypeID with 'lpr_' prefix and a 26-character base32 suffix."},{"in":"path","name":"accessId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^lpa_.*"},"required":true,"description":"Den TypeID with 'lpa_' prefix and a 26-character base32 suffix."}]}},"/v1/members/{memberId}/role":{"post":{"operationId":"postV1MembersByMemberIdRole","tags":["Members"],"summary":"Update member role","description":"Changes the role assigned to a specific organization member.","responses":{"200":{"description":"Member role updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"The member role update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update member roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can update member roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The member or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"memberId","schema":{"format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"required":true,"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"type":"string","minLength":1,"maxLength":64}},"required":["role"]}}}}}},"/v1/members/{memberId}":{"delete":{"operationId":"deleteV1MembersByMemberId","tags":["Members"],"summary":"Remove organization member","description":"Removes a member from an organization while protecting the owner role from deletion.","responses":{"204":{"description":"Member removed successfully."},"400":{"description":"The member removal request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to remove organization members.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can remove members.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The member or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"memberId","schema":{"format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"required":true,"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix."}]}},"/v1/connectors/github/install/start":{"post":{"operationId":"postV1ConnectorsGithubInstallStart","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"returnPath":{"type":"string","minLength":1,"maxLength":1024}},"required":["returnPath"]}}}},"tags":["GitHub"],"summary":"Start GitHub install","description":"Builds a GitHub App install redirect URL for the current organization.","responses":{"200":{"description":"GitHub install redirect returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubInstallStartResponse"}}}},"400":{"description":"The GitHub install request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to connect GitHub.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to connect GitHub.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/connectors/github/install/complete":{"post":{"operationId":"postV1ConnectorsGithubInstallComplete","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"installationId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"state":{"type":"string","minLength":1,"maxLength":4096}},"required":["installationId","state"]}}}},"tags":["GitHub"],"summary":"Complete GitHub install","description":"Completes a GitHub App installation for the current organization and returns visible repositories.","responses":{"200":{"description":"GitHub installation completed successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubInstallCompleteResponse"}}}},"400":{"description":"The GitHub install completion request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to complete GitHub connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to complete GitHub connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/config-objects":{"get":{"operationId":"getV1ConfigObjects","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"type","schema":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]}},{"in":"query","name":"status","schema":{"type":"string","enum":["active","inactive","deleted","archived","ingestion_error"]}},{"in":"query","name":"sourceMode","schema":{"type":"string","enum":["cloud","import","connector"]}},{"in":"query","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."},{"in":"query","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."},{"in":"query","name":"includeDeleted","schema":{"type":"string","enum":["true","false"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Config Objects"],"summary":"List config objects","description":"Lists current config object projections visible to the current organization member.","responses":{"200":{"description":"Config objects returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectListResponse"}}}},"400":{"description":"The config object query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1ConfigObjects","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"type":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"sourceMode":{"type":"string","enum":["cloud","import","connector"]},"pluginIds":{"maxItems":100,"type":"array","items":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"}},"input":{"type":"object","properties":{"rawSourceText":{"type":"string","minLength":1},"normalizedPayloadJson":{"type":"object","properties":{},"additionalProperties":{}},"parserMode":{"type":"string","minLength":1,"maxLength":100},"schemaVersion":{"type":"string","minLength":1,"maxLength":100},"metadata":{"type":"object","properties":{},"additionalProperties":{}}}}},"required":["type","sourceMode","input"]}}}},"tags":["Config Objects"],"summary":"Create config object","description":"Creates a new private config object and initial immutable version.","responses":{"201":{"description":"Config object created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectMutationResponse"}}}},"400":{"description":"The config object creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/config-objects/{configObjectId}":{"get":{"operationId":"getV1ConfigObjectsByConfigObjectId","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"Get config object","description":"Returns one config object detail when the caller can view it.","responses":{"200":{"description":"Config object returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectDetailResponse"}}}},"400":{"description":"The config object path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/versions":{"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdVersions","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"object","properties":{"rawSourceText":{"type":"string","minLength":1},"normalizedPayloadJson":{"type":"object","properties":{},"additionalProperties":{}},"parserMode":{"type":"string","minLength":1,"maxLength":100},"schemaVersion":{"type":"string","minLength":1,"maxLength":100},"metadata":{"type":"object","properties":{},"additionalProperties":{}}}},"reason":{"type":"string","minLength":1,"maxLength":255}},"required":["input"]}}}},"tags":["Config Objects"],"summary":"Create config object version","description":"Creates a new immutable config object version.","responses":{"201":{"description":"Config object version created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectMutationResponse"}}}},"400":{"description":"The config object version request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create config object versions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this config object.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"get":{"operationId":"getV1ConfigObjectsByConfigObjectIdVersions","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."},{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"includeDeleted","schema":{"type":"string","enum":["true","false"]}}],"tags":["Config Objects"],"summary":"List config object versions","description":"Returns immutable versions for one config object.","responses":{"200":{"description":"Config object versions returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectVersionListResponse"}}}},"400":{"description":"The version list request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view config object versions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/versions/{versionId}":{"get":{"operationId":"getV1ConfigObjectsByConfigObjectIdVersionsByVersionId","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."},{"in":"path","name":"versionId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cov_.*"},"required":true,"description":"Den TypeID with 'cov_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"Get config object version","description":"Returns one immutable config object version.","responses":{"200":{"description":"Config object version returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectVersionDetailResponse"}}}},"400":{"description":"The version path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view config object versions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The config object version could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/versions/latest":{"get":{"operationId":"getV1ConfigObjectsByConfigObjectIdVersionsLatest","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"Get latest config object version","description":"Returns the latest config object version by created_at and id ordering.","responses":{"200":{"description":"Latest config object version returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectVersionDetailResponse"}}}},"400":{"description":"The latest-version path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view config object versions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The config object version could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/archive":{"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdArchive","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"archive config object","description":"archive a config object without removing its history.","responses":{"200":{"description":"Config object lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectMutationResponse"}}}},"400":{"description":"The lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this config object.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/delete":{"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdDelete","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"delete config object","description":"delete a config object without removing its history.","responses":{"200":{"description":"Config object lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectMutationResponse"}}}},"400":{"description":"The lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this config object.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/restore":{"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdRestore","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"restore config object","description":"restore a config object without removing its history.","responses":{"200":{"description":"Config object lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConfigObjectMutationResponse"}}}},"400":{"description":"The lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config objects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this config object.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/plugins":{"get":{"operationId":"getV1ConfigObjectsByConfigObjectIdPlugins","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"List config object plugins","description":"Lists plugins that currently include the config object.","responses":{"200":{"description":"Config object plugins returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMembershipListResponse"}}}},"400":{"description":"The config object plugin path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view config object plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdPlugins","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"pluginId":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"membershipSource":{"type":"string","enum":["manual","connector","api","system"]}},"required":["pluginId"]}}}},"tags":["Config Objects"],"summary":"Attach config object to plugin","description":"Adds a config object to a plugin when the caller can edit the target plugin.","responses":{"201":{"description":"Plugin membership created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMembershipMutationResponse"}}}},"400":{"description":"The plugin membership request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin membership.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit the target plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object or plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/plugins/{pluginId}":{"delete":{"operationId":"deleteV1ConfigObjectsByConfigObjectIdPluginsByPluginId","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."},{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"Remove config object from plugin","description":"Removes one active plugin membership from a config object.","responses":{"204":{"description":"Plugin membership removed successfully."},"400":{"description":"The plugin membership path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin membership.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit the target plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin membership could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/access":{"get":{"operationId":"getV1ConfigObjectsByConfigObjectIdAccess","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"List config object access grants","description":"Lists direct, team, and org-wide grants for one config object.","responses":{"200":{"description":"Config object access grants returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantListResponse"}}}},"400":{"description":"The access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1ConfigObjectsByConfigObjectIdAccess","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"orgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"teamId":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"orgWide":{"default":false,"type":"boolean"},"role":{"type":"string","enum":["viewer","editor","manager"]}},"required":["role"]}}}},"tags":["Config Objects"],"summary":"Grant config object access","description":"Creates or reactivates one access grant for a config object.","responses":{"201":{"description":"Config object access grant created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantMutationResponse"}}}},"400":{"description":"The access grant request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/config-objects/{configObjectId}/access/{grantId}":{"delete":{"operationId":"deleteV1ConfigObjectsByConfigObjectIdAccessByGrantId","parameters":[{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."},{"in":"path","name":"grantId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^coa_.*"},"required":true,"description":"Den TypeID with 'coa_' prefix and a 26-character base32 suffix."}],"tags":["Config Objects"],"summary":"Revoke config object access","description":"Soft-revokes one config object access grant.","responses":{"204":{"description":"Config object access revoked successfully."},"400":{"description":"The access grant path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage config object access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The access grant could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins":{"get":{"operationId":"getV1Plugins","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"status","schema":{"type":"string","enum":["active","inactive","deleted","archived"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Plugins"],"summary":"List plugins","description":"Lists plugins visible to the current organization member.","responses":{"200":{"description":"Plugins returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginListResponse"}}}},"400":{"description":"The plugin query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1Plugins","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]}},"required":["name"]}}}},"tags":["Plugins"],"summary":"Create plugin","description":"Creates a new private plugin and grants the creator manager access.","responses":{"201":{"description":"Plugin created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMutationResponse"}}}},"400":{"description":"The plugin creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/plugins/{pluginId}":{"get":{"operationId":"getV1PluginsByPluginId","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"Get plugin","description":"Returns one plugin detail when the caller can view it.","responses":{"200":{"description":"Plugin returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginDetailResponse"}}}},"400":{"description":"The plugin path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"patch":{"operationId":"patchV1PluginsByPluginId","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]}}}}}},"tags":["Plugins"],"summary":"Update plugin","description":"Updates plugin metadata.","responses":{"200":{"description":"Plugin updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMutationResponse"}}}},"400":{"description":"The plugin update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/archive":{"post":{"operationId":"postV1PluginsByPluginIdArchive","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"archive plugin","description":"archive a plugin without touching its historical memberships.","responses":{"200":{"description":"Plugin lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMutationResponse"}}}},"400":{"description":"The plugin lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/restore":{"post":{"operationId":"postV1PluginsByPluginIdRestore","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"restore plugin","description":"restore a plugin without touching its historical memberships.","responses":{"200":{"description":"Plugin lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMutationResponse"}}}},"400":{"description":"The plugin lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/config-objects":{"get":{"operationId":"getV1PluginsByPluginIdConfigObjects","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"List plugin config objects","description":"Lists plugin memberships and resolved config object projections.","responses":{"200":{"description":"Plugin memberships returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMembershipListResponse"}}}},"400":{"description":"The plugin membership path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view plugin memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1PluginsByPluginIdConfigObjects","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"configObjectId":{"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"membershipSource":{"type":"string","enum":["manual","connector","api","system"]}},"required":["configObjectId"]}}}},"tags":["Plugins"],"summary":"Add plugin config object","description":"Adds a config object to a plugin.","responses":{"201":{"description":"Plugin membership created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMembershipMutationResponse"}}}},"400":{"description":"The plugin membership request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin or config object could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/config-objects/{configObjectId}":{"delete":{"operationId":"deleteV1PluginsByPluginIdConfigObjectsByConfigObjectId","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."},{"in":"path","name":"configObjectId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cob_.*"},"required":true,"description":"Den TypeID with 'cob_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"Remove plugin config object","description":"Removes one config object from a plugin.","responses":{"204":{"description":"Plugin membership removed successfully."},"400":{"description":"The plugin membership path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin membership could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/resolved":{"get":{"operationId":"getV1PluginsByPluginIdResolved","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"Get resolved plugin","description":"Lists active plugin memberships with the current config object projection for each item.","responses":{"200":{"description":"Resolved plugin returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchPluginMembershipListResponse"}}}},"400":{"description":"The plugin path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view resolved plugins.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/access":{"get":{"operationId":"getV1PluginsByPluginIdAccess","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"List plugin access grants","description":"Lists direct, team, and org-wide grants for a plugin.","responses":{"200":{"description":"Plugin access grants returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantListResponse"}}}},"400":{"description":"The plugin access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1PluginsByPluginIdAccess","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"orgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"teamId":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"orgWide":{"default":false,"type":"boolean"},"role":{"type":"string","enum":["viewer","editor","manager"]}},"required":["role"]}}}},"tags":["Plugins"],"summary":"Grant plugin access","description":"Creates or reactivates one access grant for a plugin.","responses":{"201":{"description":"Plugin access grant created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantMutationResponse"}}}},"400":{"description":"The plugin access request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/plugins/{pluginId}/access/{grantId}":{"delete":{"operationId":"deleteV1PluginsByPluginIdAccessByGrantId","parameters":[{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."},{"in":"path","name":"grantId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^pag_.*"},"required":true,"description":"Den TypeID with 'pag_' prefix and a 26-character base32 suffix."}],"tags":["Plugins"],"summary":"Revoke plugin access","description":"Soft-revokes one plugin access grant.","responses":{"204":{"description":"Plugin access revoked successfully."},"400":{"description":"The plugin access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage plugin access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The access grant could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces":{"get":{"operationId":"getV1Marketplaces","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"status","schema":{"type":"string","enum":["active","inactive","deleted","archived"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Marketplaces"],"summary":"List marketplaces","description":"Lists marketplaces visible to the current organization member.","responses":{"200":{"description":"Marketplaces returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceListResponse"}}}},"400":{"description":"The marketplace query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1Marketplaces","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]}},"required":["name"]}}}},"tags":["Marketplaces"],"summary":"Create marketplace","description":"Creates a new private marketplace and grants the creator manager access.","responses":{"201":{"description":"Marketplace created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceMutationResponse"}}}},"400":{"description":"The marketplace creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/marketplaces/{marketplaceId}":{"get":{"operationId":"getV1MarketplacesByMarketplaceId","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"Get marketplace","description":"Returns one marketplace detail when the caller can view it.","responses":{"200":{"description":"Marketplace returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceDetailResponse"}}}},"400":{"description":"The marketplace path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"patch":{"operationId":"patchV1MarketplacesByMarketplaceId","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]}}}}}},"tags":["Marketplaces"],"summary":"Update marketplace","description":"Updates marketplace metadata.","responses":{"200":{"description":"Marketplace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceMutationResponse"}}}},"400":{"description":"The marketplace update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this marketplace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/archive":{"post":{"operationId":"postV1MarketplacesByMarketplaceIdArchive","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"archive marketplace","description":"archive a marketplace without touching membership history.","responses":{"200":{"description":"Marketplace lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceMutationResponse"}}}},"400":{"description":"The marketplace lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this marketplace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/restore":{"post":{"operationId":"postV1MarketplacesByMarketplaceIdRestore","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"restore marketplace","description":"restore a marketplace without touching membership history.","responses":{"200":{"description":"Marketplace lifecycle updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceMutationResponse"}}}},"400":{"description":"The marketplace lifecycle path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this marketplace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/plugins":{"get":{"operationId":"getV1MarketplacesByMarketplaceIdPlugins","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"List marketplace plugins","description":"Lists marketplace memberships and resolved plugin projections.","responses":{"200":{"description":"Marketplace memberships returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplacePluginListResponse"}}}},"400":{"description":"The marketplace membership path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view marketplace memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1MarketplacesByMarketplaceIdPlugins","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"pluginId":{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"membershipSource":{"type":"string","enum":["manual","connector","api","system"]}},"required":["pluginId"]}}}},"tags":["Marketplaces"],"summary":"Add marketplace plugin","description":"Adds a plugin to a marketplace.","responses":{"201":{"description":"Marketplace membership created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplacePluginMutationResponse"}}}},"400":{"description":"The marketplace membership request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplace memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this marketplace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace or plugin could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/resolved":{"get":{"operationId":"getV1MarketplacesByMarketplaceIdResolved","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"Get marketplace resolved","description":"Returns marketplace detail with plugins and derived source info.","responses":{"200":{"description":"Marketplace resolved detail returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchMarketplaceResolvedResponse"}}}},"400":{"description":"The marketplace path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view marketplaces.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/plugins/{pluginId}":{"delete":{"operationId":"deleteV1MarketplacesByMarketplaceIdPluginsByPluginId","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."},{"in":"path","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"required":true,"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"Remove marketplace plugin","description":"Removes one plugin from a marketplace.","responses":{"204":{"description":"Marketplace membership removed successfully."},"400":{"description":"The marketplace membership path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplace memberships.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this marketplace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace membership could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/access":{"get":{"operationId":"getV1MarketplacesByMarketplaceIdAccess","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"List marketplace access grants","description":"Lists direct, team, and org-wide grants for a marketplace.","responses":{"200":{"description":"Marketplace access grants returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantListResponse"}}}},"400":{"description":"The marketplace access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1MarketplacesByMarketplaceIdAccess","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"orgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"teamId":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"orgWide":{"default":false,"type":"boolean"},"role":{"type":"string","enum":["viewer","editor","manager"]}},"required":["role"]}}}},"tags":["Marketplaces"],"summary":"Grant marketplace access","description":"Creates or reactivates one access grant for a marketplace.","responses":{"201":{"description":"Marketplace access grant created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantMutationResponse"}}}},"400":{"description":"The marketplace access request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The marketplace could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/marketplaces/{marketplaceId}/access/{grantId}":{"delete":{"operationId":"deleteV1MarketplacesByMarketplaceIdAccessByGrantId","parameters":[{"in":"path","name":"marketplaceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mkt_.*"},"required":true,"description":"Den TypeID with 'mkt_' prefix and a 26-character base32 suffix."},{"in":"path","name":"grantId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^mag_.*"},"required":true,"description":"Den TypeID with 'mag_' prefix and a 26-character base32 suffix."}],"tags":["Marketplaces"],"summary":"Revoke marketplace access","description":"Soft-revokes one marketplace access grant.","responses":{"204":{"description":"Marketplace access revoked successfully."},"400":{"description":"The marketplace access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage marketplace access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The access grant could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-accounts":{"get":{"operationId":"getV1ConnectorAccounts","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"connectorType","schema":{"type":"string","enum":["github"]}},{"in":"query","name":"status","schema":{"type":"string","enum":["active","inactive","disconnected","error"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Connectors"],"summary":"List connector accounts","description":"Lists connector accounts for the organization.","responses":{"200":{"description":"Connector accounts returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorAccountListResponse"}}}},"400":{"description":"The connector account query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1ConnectorAccounts","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"connectorType":{"type":"string","enum":["github"]},"remoteId":{"type":"string","minLength":1,"maxLength":255},"externalAccountRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"displayName":{"type":"string","minLength":1,"maxLength":255},"metadata":{"type":"object","properties":{},"additionalProperties":{}}},"required":["connectorType","remoteId","displayName"]}}}},"tags":["Connectors"],"summary":"Create connector account","description":"Creates a connector account such as a GitHub App installation binding.","responses":{"201":{"description":"Connector account created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorAccountMutationResponse"}}}},"400":{"description":"The connector account creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/connector-accounts/{connectorAccountId}":{"get":{"operationId":"getV1ConnectorAccountsByConnectorAccountId","parameters":[{"in":"path","name":"connectorAccountId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"required":true,"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Get connector account","description":"Returns one connector account detail.","responses":{"200":{"description":"Connector account returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorAccountDetailResponse"}}}},"400":{"description":"The connector account path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector account could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-accounts/{connectorAccountId}/disconnect":{"post":{"operationId":"postV1ConnectorAccountsByConnectorAccountIdDisconnect","parameters":[{"in":"path","name":"connectorAccountId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"required":true,"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"reason":{"type":"string","minLength":1,"maxLength":255}}}}}},"tags":["Connectors"],"summary":"Disconnect connector account","description":"Disconnects a connector account and cleans up all associated connector-managed records.","responses":{"200":{"description":"Connector account disconnected and cleaned up successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorAccountDisconnectResponse"}}}},"400":{"description":"The connector account disconnect request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector account could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances":{"get":{"operationId":"getV1ConnectorInstances","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"connectorAccountId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix."},{"in":"query","name":"connectorType","schema":{"type":"string","enum":["github"]}},{"in":"query","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."},{"in":"query","name":"status","schema":{"type":"string","enum":["active","disabled","archived","error"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Connectors"],"summary":"List connector instances","description":"Lists connector instances visible to the current member.","responses":{"200":{"description":"Connector instances returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceListResponse"}}}},"400":{"description":"The connector instance query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}},"post":{"operationId":"postV1ConnectorInstances","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"connectorAccountId":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"connectorType":{"type":"string","enum":["github"]},"remoteId":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"name":{"type":"string","minLength":1,"maxLength":255},"config":{"type":"object","properties":{},"additionalProperties":{}}},"required":["connectorAccountId","connectorType","name"]}}}},"tags":["Connectors"],"summary":"Create connector instance","description":"Creates a new connector instance.","responses":{"201":{"description":"Connector instance created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceMutationResponse"}}}},"400":{"description":"The connector instance creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector account could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceId","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Get connector instance","description":"Returns one connector instance detail.","responses":{"200":{"description":"Connector instance returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceDetailResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"patch":{"operationId":"patchV1ConnectorInstancesByConnectorInstanceId","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"remoteId":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"name":{"type":"string","minLength":1,"maxLength":255},"status":{"type":"string","enum":["active","disabled","archived","error"]},"config":{"type":"object","properties":{},"additionalProperties":{}}}}}}},"tags":["Connectors"],"summary":"Update connector instance","description":"Updates one connector instance.","responses":{"200":{"description":"Connector instance updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceMutationResponse"}}}},"400":{"description":"The connector instance update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/archive":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdArchive","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"archive connector instance","description":"archive a connector instance.","responses":{"200":{"description":"Connector instance updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceMutationResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/disable":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdDisable","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"disable connector instance","description":"disable a connector instance.","responses":{"200":{"description":"Connector instance updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceMutationResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/enable":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdEnable","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"enable connector instance","description":"enable a connector instance.","responses":{"200":{"description":"Connector instance updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceMutationResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/configuration":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceIdConfiguration","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Get connector instance configuration","description":"Returns the currently configured plugins and import stats for a connector instance.","responses":{"200":{"description":"Connector instance configuration returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceConfigurationResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to inspect connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/remove":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdRemove","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Remove connector instance","description":"Removes a connector instance and deletes the plugins, mappings, config objects, and bindings associated with it.","responses":{"200":{"description":"Connector instance removed and cleaned up successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceRemoveResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to remove connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to remove this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/auto-import":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdAutoImport","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"autoImportNewPlugins":{"type":"boolean"}},"required":["autoImportNewPlugins"]}}}},"tags":["Connectors"],"summary":"Set connector instance auto-import","description":"Enables or disables auto-import of new plugins on future push webhooks for a connector instance.","responses":{"200":{"description":"Connector instance auto-import updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorInstanceConfigurationResponse"}}}},"400":{"description":"The auto-import request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to configure connector instances.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to configure this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/discovery":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceIdDiscovery","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["GitHub"],"summary":"Get GitHub connector discovery","description":"Analyzes a GitHub connector target and returns discovered plugin candidates.","responses":{"200":{"description":"GitHub connector discovery returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubConnectorDiscoveryResponse"}}}},"400":{"description":"The connector instance path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to inspect GitHub discovery.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/discovery/tree":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceIdDiscoveryTree","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."},{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","exclusiveMinimum":0,"maximum":500}},{"in":"query","name":"prefix","schema":{"type":"string","minLength":1,"maxLength":1024}}],"tags":["GitHub"],"summary":"List GitHub discovery tree entries","description":"Pages through the normalized GitHub repository tree used during discovery.","responses":{"200":{"description":"GitHub discovery tree returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubDiscoveryTreeResponse"}}}},"400":{"description":"The discovery tree request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to inspect GitHub discovery tree entries.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/discovery/apply":{"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdDiscoveryApply","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"autoImportNewPlugins":{"default":false,"type":"boolean"},"selectedKeys":{"maxItems":200,"type":"array","items":{"type":"string","minLength":1,"maxLength":255}}},"required":["selectedKeys"]}}}},"tags":["GitHub"],"summary":"Apply GitHub discovery selection","description":"Creates OpenWork plugins and connector mappings from selected discovery candidates.","responses":{"200":{"description":"GitHub discovery selection applied successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubDiscoveryApplyResponse"}}}},"400":{"description":"The discovery apply request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to apply discovery selections.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/access":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceIdAccess","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"List connector instance access grants","description":"Lists direct, team, and org-wide grants for a connector instance.","responses":{"200":{"description":"Connector instance access grants returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantListResponse"}}}},"400":{"description":"The connector instance access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdAccess","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"orgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"teamId":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"orgWide":{"default":false,"type":"boolean"},"role":{"type":"string","enum":["viewer","editor","manager"]}},"required":["role"]}}}},"tags":["Connectors"],"summary":"Grant connector instance access","description":"Creates or reactivates one access grant for a connector instance.","responses":{"201":{"description":"Connector instance access grant created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchAccessGrantMutationResponse"}}}},"400":{"description":"The connector instance access request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/access/{grantId}":{"delete":{"operationId":"deleteV1ConnectorInstancesByConnectorInstanceIdAccessByGrantId","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."},{"in":"path","name":"grantId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cia_.*"},"required":true,"description":"Den TypeID with 'cia_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Revoke connector instance access","description":"Soft-revokes one connector instance access grant.","responses":{"204":{"description":"Connector instance access revoked successfully."},"400":{"description":"The connector instance access path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to manage connector instance access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The access grant could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-instances/{connectorInstanceId}/targets":{"get":{"operationId":"getV1ConnectorInstancesByConnectorInstanceIdTargets","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."},{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"targetKind","schema":{"type":"string","enum":["repository_branch"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Connectors"],"summary":"List connector targets","description":"Lists connector targets for one connector instance.","responses":{"200":{"description":"Connector targets returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorTargetListResponse"}}}},"400":{"description":"The connector target query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list connector targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1ConnectorInstancesByConnectorInstanceIdTargets","parameters":[{"in":"path","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"required":true,"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"connectorType":{"type":"string","enum":["github"]},"remoteId":{"type":"string","minLength":1,"maxLength":255},"targetKind":{"type":"string","enum":["repository_branch"]},"externalTargetRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"config":{"type":"object","properties":{},"additionalProperties":{}}},"required":["connectorType","remoteId","targetKind","config"]}}}},"tags":["Connectors"],"summary":"Create connector target","description":"Creates a connector target under a connector instance.","responses":{"201":{"description":"Connector target created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorTargetMutationResponse"}}}},"400":{"description":"The connector target creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create connector targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector instance could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-targets/{connectorTargetId}":{"get":{"operationId":"getV1ConnectorTargetsByConnectorTargetId","parameters":[{"in":"path","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"required":true,"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Get connector target","description":"Returns one connector target detail.","responses":{"200":{"description":"Connector target returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorTargetDetailResponse"}}}},"400":{"description":"The connector target path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view connector targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"patch":{"operationId":"patchV1ConnectorTargetsByConnectorTargetId","parameters":[{"in":"path","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"required":true,"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"remoteId":{"type":"string","minLength":1,"maxLength":255},"externalTargetRef":{"anyOf":[{"type":"string","minLength":1,"maxLength":255},{"type":"null"}]},"config":{"type":"object","properties":{},"additionalProperties":{}}}}}}},"tags":["Connectors"],"summary":"Update connector target","description":"Updates one connector target.","responses":{"200":{"description":"Connector target updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorTargetMutationResponse"}}}},"400":{"description":"The connector target update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update connector targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-targets/{connectorTargetId}/resync":{"post":{"operationId":"postV1ConnectorTargetsByConnectorTargetIdResync","parameters":[{"in":"path","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"required":true,"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Resync connector target","description":"Queues a manual resync for a connector target.","responses":{"202":{"description":"Connector target resync queued successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorSyncAsyncResponse"}}}},"400":{"description":"The connector target path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to resync connector targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-targets/{connectorTargetId}/mappings":{"get":{"operationId":"getV1ConnectorTargetsByConnectorTargetIdMappings","parameters":[{"in":"path","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"required":true,"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."},{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"mappingKind","schema":{"type":"string","enum":["path","api","custom"]}},{"in":"query","name":"objectType","schema":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]}},{"in":"query","name":"pluginId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix."},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Connectors"],"summary":"List connector mappings","description":"Lists mappings under a connector target.","responses":{"200":{"description":"Connector mappings returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorMappingListResponse"}}}},"400":{"description":"The connector mapping query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list connector mappings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"post":{"operationId":"postV1ConnectorTargetsByConnectorTargetIdMappings","parameters":[{"in":"path","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"required":true,"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"mappingKind":{"type":"string","enum":["path","api","custom"]},"selector":{"type":"string","minLength":1,"maxLength":255},"objectType":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"pluginId":{"anyOf":[{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},{"type":"null"}]},"autoAddToPlugin":{"default":false,"type":"boolean"},"config":{"type":"object","properties":{},"additionalProperties":{}}},"required":["mappingKind","selector","objectType"]}}}},"tags":["Connectors"],"summary":"Create connector mapping","description":"Creates a connector mapping.","responses":{"201":{"description":"Connector mapping created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorMappingMutationResponse"}}}},"400":{"description":"The connector mapping creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create connector mappings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance or target plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-mappings/{connectorMappingId}":{"patch":{"operationId":"patchV1ConnectorMappingsByConnectorMappingId","parameters":[{"in":"path","name":"connectorMappingId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cmp_.*"},"required":true,"description":"Den TypeID with 'cmp_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"selector":{"type":"string","minLength":1,"maxLength":255},"objectType":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"pluginId":{"anyOf":[{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},{"type":"null"}]},"autoAddToPlugin":{"type":"boolean"},"config":{"type":"object","properties":{},"additionalProperties":{}}}}}}},"tags":["Connectors"],"summary":"Update connector mapping","description":"Updates one connector mapping.","responses":{"200":{"description":"Connector mapping updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorMappingMutationResponse"}}}},"400":{"description":"The connector mapping update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update connector mappings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance or target plugin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector mapping could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}},"delete":{"operationId":"deleteV1ConnectorMappingsByConnectorMappingId","parameters":[{"in":"path","name":"connectorMappingId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cmp_.*"},"required":true,"description":"Den TypeID with 'cmp_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Delete connector mapping","description":"Deletes one connector mapping.","responses":{"204":{"description":"Connector mapping deleted successfully."},"400":{"description":"The connector mapping path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete connector mappings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector mapping could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-sync-events":{"get":{"operationId":"getV1ConnectorSyncEvents","parameters":[{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"connectorInstanceId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cin_.*"},"description":"Den TypeID with 'cin_' prefix and a 26-character base32 suffix."},{"in":"query","name":"connectorTargetId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^ctg_.*"},"description":"Den TypeID with 'ctg_' prefix and a 26-character base32 suffix."},{"in":"query","name":"eventType","schema":{"type":"string","enum":["push","installation","installation_repositories","repository","manual_resync"]}},{"in":"query","name":"status","schema":{"type":"string","enum":["pending","queued","running","completed","failed","partial","ignored"]}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["Connectors"],"summary":"List connector sync events","description":"Lists connector sync events visible to the current member.","responses":{"200":{"description":"Connector sync events returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorSyncEventListResponse"}}}},"400":{"description":"The connector sync event query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list connector sync events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/connector-sync-events/{connectorSyncEventId}":{"get":{"operationId":"getV1ConnectorSyncEventsByConnectorSyncEventId","parameters":[{"in":"path","name":"connectorSyncEventId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cse_.*"},"required":true,"description":"Den TypeID with 'cse_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Get connector sync event","description":"Returns one connector sync event detail.","responses":{"200":{"description":"Connector sync event returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorSyncEventDetailResponse"}}}},"400":{"description":"The connector sync event path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to view connector sync events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector sync event could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connector-sync-events/{connectorSyncEventId}/retry":{"post":{"operationId":"postV1ConnectorSyncEventsByConnectorSyncEventIdRetry","parameters":[{"in":"path","name":"connectorSyncEventId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cse_.*"},"required":true,"description":"Den TypeID with 'cse_' prefix and a 26-character base32 suffix."}],"tags":["Connectors"],"summary":"Retry connector sync event","description":"Re-queues one connector sync event.","responses":{"202":{"description":"Connector sync event retried successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorSyncAsyncResponse"}}}},"400":{"description":"The connector sync event path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to retry connector sync events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to edit this connector instance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The connector sync event could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connectors/github/accounts":{"post":{"operationId":"postV1ConnectorsGithubAccounts","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"installationId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"accountLogin":{"type":"string","minLength":1,"maxLength":255},"accountType":{"type":"string","enum":["Organization","User"]},"displayName":{"type":"string","minLength":1,"maxLength":255}},"required":["installationId","accountLogin","accountType","displayName"]}}}},"tags":["GitHub"],"summary":"Create GitHub connector account","description":"Persists one GitHub App installation as a connector account.","responses":{"201":{"description":"GitHub connector account created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchConnectorAccountMutationResponse"}}}},"400":{"description":"The GitHub account creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create GitHub connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to create GitHub connector accounts.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/connectors/github/setup":{"post":{"operationId":"postV1ConnectorsGithubSetup","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"installationId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"connectorAccountId":{"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"connectorInstanceName":{"type":"string","minLength":1,"maxLength":255},"repositoryId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"repositoryFullName":{"type":"string","minLength":1,"maxLength":255},"branch":{"type":"string","minLength":1,"maxLength":255},"ref":{"type":"string","minLength":1,"maxLength":255},"mappings":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"mappingKind":{"type":"string","enum":["path","api","custom"]},"selector":{"type":"string","minLength":1,"maxLength":255},"objectType":{"type":"string","enum":["skill","agent","command","tool","mcp","hook","context","custom"]},"pluginId":{"anyOf":[{"description":"Den TypeID with 'plg_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^plg_.*"},{"type":"null"}]},"autoAddToPlugin":{"default":false,"type":"boolean"},"config":{"type":"object","properties":{},"additionalProperties":{}}},"required":["mappingKind","selector","objectType"]}}},"required":["installationId","connectorInstanceName","repositoryId","repositoryFullName","branch","ref"]}}}},"tags":["GitHub"],"summary":"Setup GitHub connector","description":"Creates a GitHub connector account, instance, target, and initial mappings in one flow.","responses":{"201":{"description":"GitHub connector setup created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubSetupResponse"}}}},"400":{"description":"The GitHub setup request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to setup GitHub connectors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"The caller lacks permission to setup GitHub connectors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}}}}},"/v1/connectors/github/accounts/{connectorAccountId}/repositories":{"get":{"operationId":"getV1ConnectorsGithubAccountsByConnectorAccountIdRepositories","parameters":[{"in":"path","name":"connectorAccountId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^cac_.*"},"required":true,"description":"Den TypeID with 'cac_' prefix and a 26-character base32 suffix."},{"in":"query","name":"cursor","schema":{"type":"string","minLength":1,"maxLength":255}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100}},{"in":"query","name":"q","schema":{"type":"string","minLength":1,"maxLength":255}}],"tags":["GitHub"],"summary":"List GitHub repositories","description":"Lists repositories visible to one GitHub connector account.","responses":{"200":{"description":"GitHub repositories returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubRepositoryListResponse"}}}},"400":{"description":"The GitHub repository query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list GitHub repositories.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The connector account could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}}}},"/v1/connectors/github/validate-target":{"post":{"operationId":"postV1ConnectorsGithubValidateTarget","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"installationId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"repositoryId":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"repositoryFullName":{"type":"string","minLength":1,"maxLength":255},"branch":{"type":"string","minLength":1,"maxLength":255},"ref":{"type":"string","minLength":1,"maxLength":255}},"required":["installationId","repositoryId","repositoryFullName","branch","ref"]}}}},"tags":["GitHub"],"summary":"Validate GitHub target","description":"Validates one repository-branch target before persisting it.","responses":{"200":{"description":"GitHub target validated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubValidateTargetResponse"}}}},"400":{"description":"The GitHub target validation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to validate GitHub targets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/roles":{"post":{"operationId":"postV1Roles","tags":["Roles"],"summary":"Create organization role","description":"Creates a custom organization role with a named permission map.","responses":{"201":{"description":"Organization role created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"The role creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create organization roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can create custom roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"roleName":{"type":"string","minLength":2,"maxLength":64},"permission":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["roleName","permission"]}}}}}},"/v1/roles/{roleId}":{"patch":{"operationId":"patchV1RolesByRoleId","tags":["Roles"],"summary":"Update organization role","description":"Updates a custom organization role and propagates role name changes to members and pending invitations.","responses":{"200":{"description":"Organization role updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"The role update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update organization roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can update custom roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The role or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"roleId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^orl_.*"},"required":true,"description":"Den TypeID with 'orl_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"roleName":{"type":"string","minLength":2,"maxLength":64},"permission":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{"type":"array","items":{"type":"string"}}}}}}}}},"delete":{"operationId":"deleteV1RolesByRoleId","tags":["Roles"],"summary":"Delete organization role","description":"Deletes a custom organization role after confirming that no members or pending invitations still depend on it.","responses":{"204":{"description":"Organization role deleted successfully."},"400":{"description":"The role deletion request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete organization roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners can delete custom roles.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The role or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"roleId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^orl_.*"},"required":true,"description":"Den TypeID with 'orl_' prefix and a 26-character base32 suffix."}]}},"/v1/skills":{"post":{"operationId":"postV1Skills","tags":["Skills"],"summary":"Create skill","description":"Creates a new skill in the organization from markdown content and optional sharing visibility.","responses":{"201":{"description":"Skill created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillResponse"}}}},"400":{"description":"The skill creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"skillText":{"type":"string"},"shared":{"anyOf":[{"type":"string","enum":["org","public"]},{"type":"null"}]}},"required":["skillText"]}}}}},"get":{"operationId":"getV1Skills","tags":["Skills"],"summary":"List skills","description":"Lists the skills the current member can view, including owned skills, shared skills, and skills available through hub access.","responses":{"200":{"description":"Accessible skills returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillListResponse"}}}},"400":{"description":"The skill list path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/skills/{skillId}":{"delete":{"operationId":"deleteV1SkillsBySkillId","tags":["Skills"],"summary":"Delete skill","description":"Deletes one organization skill when the caller is allowed to manage it.","responses":{"204":{"description":"Skill deleted successfully."},"400":{"description":"The skill deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the skill creator or a workspace admin can delete skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^skl_.*"},"required":true,"description":"Den TypeID with 'skl_' prefix and a 26-character base32 suffix."}]},"patch":{"operationId":"patchV1SkillsBySkillId","tags":["Skills"],"summary":"Update skill","description":"Updates a skill's markdown content and-or sharing visibility while keeping derived metadata in sync.","responses":{"200":{"description":"Skill updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillResponse"}}}},"400":{"description":"The skill update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the skill creator or a workspace admin can update skills.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^skl_.*"},"required":true,"description":"Den TypeID with 'skl_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"skillText":{"type":"string"},"shared":{"anyOf":[{"type":"string","enum":["org","public"]},{"type":"null"}]}}}}}}}},"/v1/skill-hubs":{"post":{"operationId":"postV1SkillHubs","tags":["Skill Hubs"],"summary":"Create skill hub","description":"Creates a skill hub that can group skills and assign access to specific members or teams.","responses":{"201":{"description":"Skill hub created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillHubResponse"}}}},"400":{"description":"The skill hub creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","maxLength":65535},{"type":"null"}]}},"required":["name"]}}}}},"get":{"operationId":"getV1SkillHubs","tags":["Skill Hubs"],"summary":"List skill hubs","description":"Lists the skill hubs the current member can access, along with linked skills and access metadata.","responses":{"200":{"description":"Accessible skill hubs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillHubListResponse"}}}},"400":{"description":"The skill hub list path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}}}},"/v1/skill-hubs/{skillHubId}":{"patch":{"operationId":"patchV1SkillHubsBySkillHubId","tags":["Skill Hubs"],"summary":"Update skill hub","description":"Updates a skill hub's display name or description.","responses":{"200":{"description":"Skill hub updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillHubResponse"}}}},"400":{"description":"The skill hub update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can update skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","maxLength":65535},{"type":"null"}]}}}}}}},"delete":{"operationId":"deleteV1SkillHubsBySkillHubId","tags":["Skill Hubs"],"summary":"Delete skill hub","description":"Deletes a skill hub and removes its access links and skill links.","responses":{"204":{"description":"Skill hub deleted successfully."},"400":{"description":"The skill hub deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can delete skill hubs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."}]}},"/v1/skill-hubs/{skillHubId}/skills":{"post":{"operationId":"postV1SkillHubsBySkillHubIdSkills","tags":["Skill Hubs"],"summary":"Add skill to skill hub","description":"Adds an existing organization skill to a skill hub so hub members can discover and use it.","responses":{"201":{"description":"Skill added to skill hub successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"The add-skill-to-hub request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage skill hub contents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can manage hub skills, and private skills stay creator-controlled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub or skill could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The skill is already attached to the skill hub.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConflictError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"skillId":{"description":"Den TypeID with 'skl_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^skl_.*"}},"required":["skillId"]}}}}}},"/v1/skill-hubs/{skillHubId}/skills/{skillId}":{"delete":{"operationId":"deleteV1SkillHubsBySkillHubIdSkillsBySkillId","tags":["Skill Hubs"],"summary":"Remove skill from skill hub","description":"Removes a skill from a skill hub without deleting the underlying skill itself.","responses":{"204":{"description":"Skill removed from skill hub successfully."},"400":{"description":"The remove-skill-from-hub path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage skill hub contents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can remove skills from a hub.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub or hub-skill link could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."},{"in":"path","name":"skillId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^skl_.*"},"required":true,"description":"Den TypeID with 'skl_' prefix and a 26-character base32 suffix."}]}},"/v1/skill-hubs/{skillHubId}/access":{"post":{"operationId":"postV1SkillHubsBySkillHubIdAccess","tags":["Skill Hubs"],"summary":"Grant skill hub access","description":"Grants a specific member or team access to a skill hub.","responses":{"201":{"description":"Skill hub access granted successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillHubAccessResponse"}}}},"400":{"description":"The skill hub access request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage skill hub access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can grant hub access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub or access target could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The requested access entry already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConflictError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"orgMembershipId":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"},"teamId":{"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"}}}}}}}},"/v1/skill-hubs/{skillHubId}/access/{accessId}":{"delete":{"operationId":"deleteV1SkillHubsBySkillHubIdAccessByAccessId","tags":["Skill Hubs"],"summary":"Revoke skill hub access","description":"Revokes one member or team access entry from a skill hub.","responses":{"204":{"description":"Skill hub access removed successfully."},"400":{"description":"The skill hub access deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to manage skill hub access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the hub creator or a workspace admin can revoke hub access.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The skill hub or access entry could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"skillHubId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shb_.*"},"required":true,"description":"Den TypeID with 'shb_' prefix and a 26-character base32 suffix."},{"in":"path","name":"accessId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^shm_.*"},"required":true,"description":"Den TypeID with 'shm_' prefix and a 26-character base32 suffix."}]}},"/v1/teams":{"post":{"operationId":"postV1Teams","tags":["Teams"],"summary":"Create team","description":"Creates a team inside an organization and can optionally attach existing organization members to it.","responses":{"201":{"description":"Team created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}},"400":{"description":"The team creation request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to create teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can create teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The organization or a referenced member could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"memberIds":{"type":"array","items":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"}}},"required":["name"]}}}}}},"/v1/teams/{teamId}":{"patch":{"operationId":"patchV1TeamsByTeamId","tags":["Teams"],"summary":"Update team","description":"Updates a team's name and-or membership list within an organization.","responses":{"200":{"description":"Team updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}},"400":{"description":"The team update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can update teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The team, organization, or a referenced member could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"teamId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"required":true,"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"memberIds":{"type":"array","items":{"description":"Den TypeID with 'om_' prefix and a 26-character base32 suffix.","format":"typeid","type":"string","minLength":29,"maxLength":29,"pattern":"^om_.*"}}}}}}}},"delete":{"operationId":"deleteV1TeamsByTeamId","tags":["Teams"],"summary":"Delete team","description":"Deletes a team and removes its related hub-access and team-membership records.","responses":{"204":{"description":"Team deleted successfully."},"400":{"description":"The team deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only workspace owners and admins can delete teams.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The team or organization could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"teamId","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^tem_.*"},"required":true,"description":"Den TypeID with 'tem_' prefix and a 26-character base32 suffix."}]}},"/v1/app-version":{"get":{"operationId":"getV1AppVersion","tags":["System"],"summary":"Get desktop app version metadata","description":"Returns the minimum supported desktop app version and the latest desktop app version published with this Den API build.","responses":{"200":{"description":"Desktop app version metadata returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DenAppVersionResponse"}}}}}}},"/v1/webhooks/connectors/github":{"post":{"operationId":"postV1WebhooksConnectorsGithub","tags":["Webhooks"],"summary":"GitHub webhook ingress","description":"Verifies a GitHub App webhook signature against the raw request body, then records any relevant sync work.","responses":{"200":{"description":"Ignored but valid GitHub webhook delivery.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubWebhookIgnoredResponse"}}}},"202":{"description":"Accepted GitHub webhook delivery.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubWebhookAcceptedResponse"}}}},"401":{"description":"Invalid GitHub webhook signature.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PluginArchGithubWebhookUnauthorizedResponse"}}}},"503":{"description":"GitHub webhook secret is not configured."}}}},"/v1/workers/{id}/activity-heartbeat":{"post":{"operationId":"postV1WorkersByIdActivityHeartbeat","tags":["Workers","Worker Activity"],"summary":"Record worker heartbeat","description":"Accepts signed heartbeat and recent-activity updates from a worker so Den can track worker health and recent usage.","responses":{"200":{"description":"Worker heartbeat accepted successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerHeartbeatResponse"}}}},"400":{"description":"The heartbeat payload or worker path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The worker heartbeat token was missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"sentAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"isActiveRecently":{"type":"boolean"},"lastActivityAt":{"anyOf":[{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},{"type":"null"}]},"openSessionCount":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["isActiveRecently"]}}}}}},"/v1/workers":{"get":{"operationId":"getV1Workers","tags":["Workers"],"summary":"List workers","description":"Lists the workers that belong to the caller's active organization, including each worker's latest known instance state.","responses":{"200":{"description":"Workers returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerListResponse"}}}},"400":{"description":"The worker list query parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to list workers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}}},"parameters":[{"in":"query","name":"limit","schema":{"default":20,"type":"integer","minimum":1,"maximum":50}}]},"post":{"operationId":"postV1Workers","tags":["Workers"],"summary":"Create worker","description":"Creates a local or cloud worker for the active organization and returns the initial tokens needed to connect to it.","responses":{"201":{"description":"Local worker created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerCreateResponse"}}}},"202":{"description":"Cloud worker creation started successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerCreateResponse"}}}},"400":{"description":"The worker creation payload was invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/InvalidRequestError"},{"$ref":"#/components/schemas/OrganizationUnavailableError"},{"$ref":"#/components/schemas/WorkspacePathRequiredError"}]}}}},"401":{"description":"The caller must be signed in to create workers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"409":{"description":"The organization has reached its worker limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerOrgLimitReachedError"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1},"description":{"type":"string"},"destination":{"type":"string","enum":["local","cloud"]},"workspacePath":{"type":"string"},"sandboxBackend":{"type":"string"},"imageVersion":{"type":"string"}},"required":["name","destination"]}}}}}},"/v1/workers/{id}":{"get":{"operationId":"getV1WorkersById","tags":["Workers"],"summary":"Get worker","description":"Returns one worker from the active organization together with its latest provisioned instance details.","responses":{"200":{"description":"Worker returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerResponse"}}}},"400":{"description":"The worker path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to read worker details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}]},"patch":{"operationId":"patchV1WorkersById","tags":["Workers"],"summary":"Update worker","description":"Renames a worker, but only when the caller is the user who originally created that worker.","responses":{"200":{"description":"Worker updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerUpdateResponse"}}}},"400":{"description":"The worker update request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to update workers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"403":{"description":"Only the worker owner can rename this worker.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255}},"required":["name"]}}}}},"delete":{"operationId":"deleteV1WorkersById","tags":["Workers"],"summary":"Delete worker","description":"Deletes a worker and cascades cleanup for its tokens, runtime records, and provider-specific resources.","responses":{"204":{"description":"Worker deleted successfully."},"400":{"description":"The worker deletion path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to delete workers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}]}},"/v1/workers/{id}/tokens":{"post":{"operationId":"postV1WorkersByIdTokens","tags":["Workers"],"summary":"Get worker connection tokens","description":"Returns connection tokens and the resolved OpenWork connect URL for an existing worker.","responses":{"200":{"description":"Worker connection tokens returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerTokensResponse"}}}},"400":{"description":"The worker token path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to request worker tokens.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"409":{"description":"The worker is not ready to return connection tokens yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerConnectionError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}]}},"/v1/workers/{id}/runtime":{"get":{"operationId":"getV1WorkersByIdRuntime","tags":["Workers","Worker Runtime"],"summary":"Get worker runtime status","description":"Fetches runtime version and status information from a specific worker's runtime endpoint.","responses":{"200":{"description":"Worker runtime information returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerRuntimeResponse"}}}},"400":{"description":"The worker runtime path parameters were invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to read worker runtime information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}]}},"/v1/workers/{id}/runtime/upgrade":{"post":{"operationId":"postV1WorkersByIdRuntimeUpgrade","tags":["Workers","Worker Runtime"],"summary":"Upgrade worker runtime","description":"Forwards a runtime upgrade request to a specific worker and returns the worker runtime's response.","responses":{"200":{"description":"Worker runtime upgrade request completed successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkerRuntimeResponse"}}}},"400":{"description":"The runtime upgrade request was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvalidRequestError"}}}},"401":{"description":"The caller must be signed in to upgrade a worker runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"404":{"description":"The worker could not be found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}}},"parameters":[{"in":"path","name":"id","schema":{"format":"typeid","type":"string","minLength":30,"maxLength":30,"pattern":"^wrk_.*"},"required":true,"description":"Den TypeID with 'wrk_' prefix and a 26-character base32 suffix."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{},"additionalProperties":{}}}}}}},"/.well-known/oauth-protected-resource":{"get":{"operationId":"getWellKnownOauthProtectedResource","responses":{"200":{"description":"Response"}}}},"/.well-known/oauth-protected-resource/mcp":{"get":{"operationId":"getWellKnownOauthProtectedResourceMcp","responses":{"200":{"description":"Response"}}}},"/mcp/.well-known/oauth-protected-resource":{"get":{"operationId":"getMcpWellKnownOauthProtectedResource","responses":{"200":{"description":"Response"}}}}}}
\ No newline at end of file
diff --git a/packages/docs/roadmap.mdx b/packages/docs/roadmap.mdx
new file mode 100644
index 0000000000..fe7f2e2efd
--- /dev/null
+++ b/packages/docs/roadmap.mdx
@@ -0,0 +1,26 @@
+---
+title: "Roadmap"
+description: "What OpenWork supports today and what is coming next."
+---
+
+Sharing the upcoming items in our roadmap:
+
+Last updated: 04/16/2026
+
+## Live today
+
+- Desktop app on Windows, Mac, and Linux.
+- Shared agents, skills, Agents, and MCPs.
+- Sign in with OpenAI Auth or other LLM providers.
+- Use any LLM, including LiteLLM and Cloudflare Gateaway.
+- Connect to a remote workspace or a cloud worker for long running tasks.
+- Cloud: Org Hub with provisioned Skills, Agents, and MCPs.
+- Cloud: RBAC, teams within an org, and the ability to deploy cloud workers.
+
+## Roadmap
+
+- Better support for Windows.
+- Claude-compatible plugin marketplace.
+- Git-based provisioning for plugins, skills, and MCPs.
+- Automatic push-based provisioning and sync.
+- Advanced enterprise controls: RBAC, audit trails, SSO/SAML, MDM provisioning...
diff --git a/packages/docs/start-here/connect-your-stack/add-a-custom-llm.mdx b/packages/docs/start-here/connect-your-stack/add-a-custom-llm.mdx
new file mode 100644
index 0000000000..e7b5519df9
--- /dev/null
+++ b/packages/docs/start-here/connect-your-stack/add-a-custom-llm.mdx
@@ -0,0 +1,59 @@
+---
+title: "Add a custom LLM"
+description: "How to connect a custom provider with OpenWork"
+---
+
+Because `OpenWork` is built on `OpenCode` primitives, we support everything that you could modify in `.opencode.json`, like adding a [model](https://opencode.ai/docs/models/). However, our recommendation is to add it to `/path-to-your-workspace/.config/opencode/opencode.json` instead of modifying `~/.config/opencode/opencode.json`.
+
+Inside `/path-to-your-workspace/.config/opencode/opencode.json`:
+```
+{
+  "provider": {
+    "my-api": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "My model",
+      "options": {
+        "baseURL": "https://your API address/v1"
+      },
+      "models": {
+        "model-name": {
+          "name": "Model name"
+        }
+      }
+    }
+  }
+}
+```
+
+We've also built a [custom skill](https://share.openworklabs.com/b/01KNBQDQAK41VZSZDF5G9MW4MW) that you can import in OpenWork following [this guide](/start-here/do-work-with-it/import-a-skill).
+
+The following tutorial covers how to [import a custom provider using the skill](https://x.com/getopenwork/status/2034129039317995908?s=20).
+
+### Functional example: Ollama (Qwen3 8B)
+
+This setup a local [Ollama](https://docs.ollama.com/api/openai-compatibility) instance running `qwen3:8b`. 
+
+```
+{
+  "provider": {
+    "ollama": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Ollama",
+      "options": {
+        "baseURL": "http://localhost:11434/v1"
+      },
+      "models": {
+        "qwen3:8b": {
+          "name": "Qwen3 8B"
+        }
+      }
+    }
+  }
+}
+```
+
+Pull the model first with `ollama pull qwen3:8b`, then make sure the Ollama server is reachable at `http://localhost:11434` with `ollama serve`
+
+Open your desktop, change the provider name and voila! You have an fully local LLM running in your machine.
+
+For teams, you can manage the provider in OpenWork Cloud under [LLM Providers](/cloud/share-with-your-team/managed-llm-provider), then import it into each workspace from `Settings -> Cloud`.
\ No newline at end of file
diff --git a/packages/docs/start-here/connect-your-stack/add-an-mcp-server.mdx b/packages/docs/start-here/connect-your-stack/add-an-mcp-server.mdx
new file mode 100644
index 0000000000..2c75250239
--- /dev/null
+++ b/packages/docs/start-here/connect-your-stack/add-an-mcp-server.mdx
@@ -0,0 +1,36 @@
+---
+title: "Add an MCP server"
+description: "How to connect a custom MCP server with openwork"
+---
+
+Connecting a custom MCP server with openwork takes four clicks.
+
+- Inside your workspace, click in `Extensions` \> `Advanced Settings` \> `Add MCP server`
+
+<Frame>
+  ![Extensions page with Advanced Settings link](/images/mcp-extensions-advanced-settings.png)
+</Frame>
+
+You can choose to add the MCP server in this workspace or for all workspaces (global Ow config)
+
+<Frame>
+  ![Add MCP Server dialog with name, URL, and OAuth toggle](/images/mcp-add-server-dialog.png)
+
+  You should indicate wether it requires OAuth or not.
+</Frame>
+
+This setup is aimed at servers that allow for dynamic user registration (eg: OAuth based MCPs)
+
+<Frame>
+  ![OAuth approval page for MCP server](/images/mcp-oauth-approval-page.png)
+</Frame>
+
+Once in their Oath page, you should just continue with the registration or custom setup. It should redirect back to openwork. Feel free to [open an issue](https://github.com/different-ai/openwork/issues/) if you require a custom MCP that we currently do not support.
+
+### Troubleshooting
+
+Some MCP servers do not support dynamic client registration. We do not currently support them.
+
+<Frame>
+  ![Error when MCP server does not support dynamic client registration](/images/mcp-dynamic-registration-error.png)
+</Frame>
\ No newline at end of file
diff --git a/packages/docs/start-here/connect-your-stack/add-anthropic-api-key.mdx b/packages/docs/start-here/connect-your-stack/add-anthropic-api-key.mdx
new file mode 100644
index 0000000000..ba9491f962
--- /dev/null
+++ b/packages/docs/start-here/connect-your-stack/add-anthropic-api-key.mdx
@@ -0,0 +1,53 @@
+---
+title: "Add Anthropic API key"
+description: "Create an Anthropic API key and use it in OpenWork"
+---
+
+Anthropic has disabled 3rd party authentication for their OAuth. In order to continue supporting Anthropic based models in OpenWork, we now default to manual API key entry for Anthropic.
+That means you create the key in Anthropic first, then paste it into OpenWork.
+
+## Before you start
+
+- You need an Anthropic account at [platform.claude.com](https://platform.claude.com).
+- Your Claude subscription and your Anthropic API billing are not always the same thing, so make sure API access is enabled on your Anthropic account.
+- Treat the key like a password. Anthropic will only show the full value when you create it.
+
+If this key should be shared across a team, add Anthropic once in OpenWork Cloud `LLM Providers` and import it from [Settings -> Cloud](/cloud/share-with-your-team/managed-llm-provider) instead of pasting it into each workspace separately.
+
+## Create the key in Anthropic
+
+1. Sign in at [platform.claude.com](https://platform.claude.com).
+2. Open the `API Keys` page.
+
+<Frame>
+  ![Anthropic API Keys page](/images/anthropic-key.png)
+</Frame>
+
+3. Click `Create Key`.
+4. Give the key a recognizable name like `OpenWork`.
+
+<Frame>
+  ![Anthropic Create Key dialog](/images/anthropic-openwork-key.png)
+</Frame>
+
+5. Copy the new key right away. It should look like `sk-ant-...`.
+
+## Add the key to OpenWork
+
+
+1. Open `Settings` in OpenWork.
+2. Go to `Connect Provider` and choose `Anthropic`.
+3. Paste the API key into the manual key field.
+4. Save the provider, then choose an Anthropic model in chat.
+
+<Frame>
+  ![How to add a new provider in OpenWork](/images/openwork-providers.png)
+</Frame>
+
+## Common issues
+
+- If the key is rejected, make sure you copied the full value without extra spaces.
+- If you cannot see `API Keys`, check that your Anthropic account has API access and billing set up.
+- If you lose the key, create a new one in Anthropic and update OpenWork with the new value.
+
+The same general process applies to most providers that use manual API keys: create the key in the provider's developer console, copy it once, and paste it into OpenWork.
diff --git a/packages/docs/start-here/connect-your-stack/enable-exa-search.mdx b/packages/docs/start-here/connect-your-stack/enable-exa-search.mdx
new file mode 100644
index 0000000000..7126049672
--- /dev/null
+++ b/packages/docs/start-here/connect-your-stack/enable-exa-search.mdx
@@ -0,0 +1,10 @@
+---
+title: "Enable Exa search"
+---
+
+[Exa](https://exa.ai) is a very fast search engine for AI. We support it as part of a global setting that is currently in  `Settings` -> `Advanced`.
+
+<Frame>
+  ![Enable Exa web search toggle in Settings > Advanced](/images/exa-search-toggle.png)
+</Frame>
+
diff --git a/packages/docs/start-here/connect-your-stack/sign-in-with-chatgpt.mdx b/packages/docs/start-here/connect-your-stack/sign-in-with-chatgpt.mdx
new file mode 100644
index 0000000000..04c584370b
--- /dev/null
+++ b/packages/docs/start-here/connect-your-stack/sign-in-with-chatgpt.mdx
@@ -0,0 +1,30 @@
+---
+title: "Sign in with ChatGPT"
+description: "How to use ChatGPT OAuth with Openwork"
+---
+
+Connecting ChatGPT with openwork takes four clicks.
+
+- Go to `Settings` \> `Connect Provider` \> `OpenAI` \> `ChatGPT Pro/Plus`
+
+<Frame>
+  ![Settings page showing Connect Provider button](/images/chatgpt-connect-provider-settings.png)
+</Frame>
+
+Then, login into `openai Auth`  with a valid subscription email
+
+<Frame>
+  ![OpenAI authentication login page](/images/chatgpt-openai-auth-login.png)
+</Frame>
+
+Once you have finished the auth, you can change the model below in the chat.
+
+<Frame>
+  ![Model selector dropdown in chat](/images/chatgpt-model-selector.png)
+</Frame>
+
+You will be able to choose among any model offered by all the providers you're connected to:
+
+<Frame>
+  ![Model list showing available models from all providers](/images/chatgpt-model-list.png)
+</Frame>
\ No newline at end of file
diff --git a/packages/docs/start-here/do-work-with-it/control-the-browser.mdx b/packages/docs/start-here/do-work-with-it/control-the-browser.mdx
new file mode 100644
index 0000000000..27f51df80c
--- /dev/null
+++ b/packages/docs/start-here/do-work-with-it/control-the-browser.mdx
@@ -0,0 +1,25 @@
+---
+title: "Control the browser"
+description: "How to use OpenWork to automate your Chrome Browser"
+---
+
+Computer-Use in OpenWork currently works as a browser automation in Google Chrome. It does not yet mean full desktop control of Ubuntu, macOS, or Windows apps.
+
+With the right skills, your OpenWork agent will be able to runs browser actions and take screnshots as proof of having completed said actions. If you connect to a remote OpenWork server, that remote machine also needs to have Chrome installed.
+
+Today, the supported path is `Control Chrome`, which uses Chrome DevTools MCP.
+
+## Requirements
+
+- Google Chrome on the machine running the session
+- In `Settings > Extensions > Control Chrome`
+
+<Frame>
+  ![Extensions page with Control Chrome MCP app](/images/extensions-control-chrome-app.png)
+
+  - Enable it and follow the instructions in the configuration screen _Note_: _do note use "Use my existing Chrome profile". It's currently not well supported._
+    <Frame>
+      ![Set up Control Chrome dialog](/images/control-chrome-setup-modal.png)
+    </Frame>
+    Go back to the session view and ask it to open a website
+</Frame>
\ No newline at end of file
diff --git a/packages/docs/start-here/do-work-with-it/import-a-skill.mdx b/packages/docs/start-here/do-work-with-it/import-a-skill.mdx
new file mode 100644
index 0000000000..44fc6ff9d8
--- /dev/null
+++ b/packages/docs/start-here/do-work-with-it/import-a-skill.mdx
@@ -0,0 +1,86 @@
+---
+title: "Import a skill"
+description: "How to import an external skill into your workspace in OpenWork"
+---
+
+There are currently four direct ways to import an external skill.
+
+1. Open an existing skill share link from `share.openworklabs.com`
+2. Paste a skill into the share site, then import it
+3. Create a skill with `Create skill in chat` and paste the external skill into that flow
+4. Install a shared skill from your OpenWork Cloud organization in `Skills -> Cloud` or `Settings -> Cloud`
+
+There is another option if you're technical: place it directly in `.opencode/skills/<skill-name>/SKILL.md` inside your workspace.
+
+We recommend (1) and (3) because they match the built-in OpenWork flows most closely.
+
+For teams, OpenWork Cloud can publish shared skills either as standalone org skills or inside a skill hub. Each desktop workspace can install them from the `Cloud` tab on the Skills page or from [Settings -> Cloud](/cloud/share-with-your-team/skill-hubs).
+
+## Installing a skill from OpenWork Cloud
+
+If someone on your team saved a skill to your active OpenWork Cloud organization, open either `Skills -> Cloud` or `Settings -> Cloud` in the desktop app.
+
+From there you can:
+
+- click `Install` to add the skill to the current workspace
+- click `Sync` when the cloud version changes
+- click `Uninstall` if you no longer want the workspace-managed copy
+
+If the skill belongs to a hub, OpenWork also shows the hub name so you know where it came from.
+
+## Importing an existing skill with a share URL
+
+When you have an OpenWork [share URL](https://share.openworklabs.com/b/01KNBQDPGSS39J4AG3MN9FVZ73), click `Open in OpenWork`.
+
+<Frame>
+  ![Share page with Open in OpenWork button](/images/skill-import-share-page.png)
+</Frame>
+
+Then select the workspace where you want to install it (for example, `the-factory`).
+
+<Frame>
+  ![Select workspace dialog for importing a skill](/images/skill-import-select-workspace.png)
+</Frame>
+
+Once the skill is installed, OpenWork prompts you to reload so it can load the new skill into your workspace.
+
+<Frame>
+  ![Reload required banner after installing a skill](/images/skill-import-reload-required.png)
+</Frame>
+
+After you reload the app, you can use the skill directly in that workspace:
+
+<Frame>
+  ![Using an imported skill in chat with autocomplete](/images/skill-import-use-in-chat.png)
+</Frame>
+
+## Pasting a skill into the share site, then importing it
+
+Start at [the OpenWork share page](https://share.openworklabs.com/) without any skill loaded. Paste or upload the skill there, then click `Generate link`:
+
+<Frame>
+  ![Share your skill page with Generate share link button](/images/skill-import-share-your-skill.png)
+</Frame>
+
+To import an external skill, the file needs to follow this structure:
+
+```text
+---
+name: name of the skill
+description: one line description of what the skill does
+---
+
+Any markdown text with instructions and description of the skill
+```
+
+Make sure the file follows that format when importing skills from other marketplaces or other teams.
+
+That redirects you to the share page for the valid skill, and from there you can follow the steps from the previous section.
+
+## Creating a skill with `/skill-creator` in chat
+
+Type `/skill-creator` in chat, then either paste the external skill you want to import or describe what you want the skill to do. OpenWork will generate a workspace-local skill from that input.
+
+<Frame>
+  ![Using the /skill-creator command in chat](/images/skill-import-skill-creator-command.png)
+</Frame>
diff --git a/packages/docs/start-here/do-work-with-it/share-your-setup.mdx b/packages/docs/start-here/do-work-with-it/share-your-setup.mdx
new file mode 100644
index 0000000000..ceaca3ed31
--- /dev/null
+++ b/packages/docs/start-here/do-work-with-it/share-your-setup.mdx
@@ -0,0 +1,41 @@
+---
+title: "Share skills"
+description: "Learn how to share skills with others"
+---
+
+OpenWork sharing focuses on skills. You can create a public skill link or save a skill to your OpenWork Cloud organization so teammates can install it from the Cloud tab.
+
+## How to share a SKILL.md
+
+You can share a `SKILL.md` by clicking under `Your_Workspace` \> `Skills`
+
+<Frame>
+  ![Skills management page showing installed skills](/images/sharing-skills-list.png)
+</Frame>
+
+Then, on `Create Link` which will create a custom page for the skill at `share.openworklabs.com/b/:skill_id`
+
+<Frame>
+  ![Create share link dialog for a skill](/images/sharing-create-link-dialog.png)
+</Frame>
+
+This creates a url that you can share with other people so they can `copy the skill` or `Open in Openwork`
+
+<Frame>
+  ![Shared skill page with Copy and Open in OpenWork buttons](/images/sharing-skill-share-page.png)
+</Frame>
+
+## How to save a skill to your OpenWork Cloud organization
+
+1. Open `Workspace -> Skills` in the desktop app.
+2. Pick the installed skill you want to share.
+3. Click `Share skill`.
+4. Choose the `Team` option.
+5. Sign in to OpenWork Cloud if needed.
+6. Pick the sharing permission:
+   - `Organization Only - Not in hub` keeps the skill available to the active org without adding it to a hub.
+   - `Private for me only` uploads it to the org but keeps it limited to your account.
+   - If a hub is available, you can also attach the skill to that hub during the same flow.
+7. Click `Upload and save`.
+
+After that, teammates can install the skill from `Skills -> Cloud`. If the skill was attached to a hub, it also appears in `Settings -> Cloud -> Skills` with the hub label so people can sync or remove it later.
diff --git a/packages/docs/start-here/get-started.mdx b/packages/docs/start-here/get-started.mdx
new file mode 100644
index 0000000000..3461d8ff8c
--- /dev/null
+++ b/packages/docs/start-here/get-started.mdx
@@ -0,0 +1,40 @@
+---
+title: "Get started"
+description: "Privacy-first, open-source alternative to Claude Cowork."
+---
+
+Most people should start with the [OpenWork app](https://openworklabs.com/download). It lets you use any LLM, skill, and plugin locally, then share that setup with your team when you are ready.
+
+## Start
+
+Get started by connecting your LLM provider of choice and sending your first message:
+
+<CardGroup cols={3}>
+  <Card title="Connect a provider" icon="plug" href="/start-here/connect-your-stack/sign-in-with-chatgpt">
+    Sign in with ChatGPT or bring your own LLM key in a few clicks.
+  </Card>
+  <Card title="Add an MCP" icon="puzzle-piece" href="/start-here/connect-your-stack/add-an-mcp-server">
+    Plug custom MCP servers into your workspace in minutes.
+  </Card>
+  <Card title="Control the browser" icon="globe" href="/start-here/do-work-with-it/control-the-browser">
+    Let OpenWork run and screenshot tasks in Chrome for you.
+  </Card>
+</CardGroup>
+
+## Choose your setup
+
+<CardGroup cols={3}>
+  <Card title="Download OpenWork" icon="download" href="https://openworklabs.com/download">
+    Start with the desktop app, connect providers, add MCP servers, and run tasks right away.
+  </Card>
+  <Card title="OpenWork Cloud" icon="users" href="/cloud/get-started">
+    Meant for teams: Shared workspaces, org skill hubs, hosted workers, and managed LLM providers.
+  </Card>
+  <Card title="Enterprise" icon="building" href="/cloud/enterprise">
+    Get support with an enterprise deployment if you need a private rollout or custom requirements.
+  </Card>
+</CardGroup>
+
+---
+
+[GitHub](https://github.com/different-ai/openwork) · [Changelog](/changelog) · [Product Roadmap](/roadmap) · [Missing docs](/start-here/missing-docs) · [Missing languages](/start-here/missing-languages)
diff --git a/packages/docs/start-here/missing-docs.mdx b/packages/docs/start-here/missing-docs.mdx
new file mode 100644
index 0000000000..fbe7d4d529
--- /dev/null
+++ b/packages/docs/start-here/missing-docs.mdx
@@ -0,0 +1,14 @@
+---
+title: "Missing docs?"
+description: "Request a page or contribute one yourself."
+---
+
+Two ways to fix it.
+
+## Ask us to write it
+
+[Email the team](mailto:team@openworklabs.com?subject=missing%20documentation&body=hey%20my%20github%20is%20%7Busername%7D%2C%20I%27m%20interested%20in%20%7Bfeature%7D%20from%20openwork%20but%20I%27m%20missing%20documentation%20on%20it%2C%20could%20you%20create%20it%3F%0A%0AThanks) with the feature you're trying to use and we'll write the page.
+
+## Write it yourself
+
+OpenWork docs live in the [openwork repo](https://github.com/different-ai/openwork/tree/dev/packages/docs). Open a PR with a new `.mdx` page and we'll review it.
\ No newline at end of file
diff --git a/packages/docs/start-here/missing-languages.mdx b/packages/docs/start-here/missing-languages.mdx
new file mode 100644
index 0000000000..9847e2d70b
--- /dev/null
+++ b/packages/docs/start-here/missing-languages.mdx
@@ -0,0 +1,54 @@
+---
+title: "Missing languages"
+description: "See which OpenWork languages ship today and help us improve them."
+---
+
+OpenWork already ships with a growing set of languages, and we want to keep expanding that list.
+
+<Frame>
+  <iframe
+    width="100%"
+    height="400"
+    src="https://www.youtube.com/embed/orGF117Snu8"
+    title="OpenWork missing languages overview"
+    allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+    allowFullScreen
+  />
+</Frame>
+
+## Languages available today
+
+Watch the video above for a quick overview, then use this list as the current source of truth for languages supported in the app:
+
+- English (`en`)
+- Japanese (`ja`)
+- Simplified Chinese (`zh`)
+- Vietnamese (`vi`)
+- Portuguese (Brazil) (`pt-BR`)
+- Thai (`th`)
+- French (`fr`)
+- Catalan (`ca`)
+- Spanish (`es`)
+
+## Improve current translations
+
+If you want to improve an existing translation, start in [`apps/app/src/i18n/locales`](https://github.com/different-ai/openwork/tree/dev/apps/app/src/i18n/locales).
+
+Each language lives in its own file, so most fixes are simple copy updates inside one locale file such as `apps/app/src/i18n/locales/fr.ts` or `apps/app/src/i18n/locales/es.ts`.
+
+## Add a new language
+
+If you want to add a new language to OpenWork, the basic file changes are:
+
+- Create a new locale file in `apps/app/src/i18n/locales/<language-code>.ts`.
+- Register that locale in `apps/app/src/i18n/index.ts` by adding the import, language code, language option, and translation map entry.
+- Re-export the locale from `apps/app/src/i18n/locales/index.ts`.
+- Add the new locale code to `scripts/i18n-audit.mjs` so the audit script checks it.
+
+After that, run the audit script to spot missing keys:
+
+```bash
+node scripts/i18n-audit.mjs --missing
+```
+
+If you want to follow broader localization work, language requests, or upcoming improvements, check the [i18n roadmap](https://github.com/different-ai/openwork/issues/1385).
diff --git a/packages/docs/start-here/self-host.mdx b/packages/docs/start-here/self-host.mdx
new file mode 100644
index 0000000000..993a688afb
--- /dev/null
+++ b/packages/docs/start-here/self-host.mdx
@@ -0,0 +1,97 @@
+---
+title: "Self-host"
+description: "Run OpenWork on your own server or infrastructure."
+---
+
+Most users just use the [desktop app](https://openworklabs.com/download). Self-hosting is for teams that want OpenWork to run on their own server, VPC, or private cloud and then connect the desktop app to it remotely.
+
+Want hosted workspaces, team skill hubs, or shared providers without running infra? Use [OpenWork Cloud](/cloud/get-started) instead. Rolling this out across a company? [Book a call](https://calendar.app.google/86QpCENvhfEzDFLu5) about [Enterprise](/cloud/enterprise).
+
+## What you deploy
+
+OpenWork is split into normal services:
+
+- **OpenWork app**: the desktop or web client people use.
+- **Den web**: the web app for sign-in, worker launch, and connect links if you want a cloud-style setup.
+- **Den controller**: the control plane for auth, workers, and provisioning.
+- **Worker proxy**: optional layer for provider-backed workers and signed runtime URLs.
+
+If you only need one private remote workspace, deploy the worker runtime. If you want OpenWork Cloud-style accounts, teams, and worker creation, deploy Den web, Den controller, the worker proxy, and worker runtimes.
+
+## How we deploy hosted workers
+
+Our hosted deployment uses Render for long-running services and worker provisioning. Render gives us service deploys, env vars, health checks, logs, and worker builds without asking us to operate raw AWS services directly. If you want to run closer to AWS yourself, use the same service boundaries on ECS/Fargate, EC2, Kubernetes, or another container platform.
+
+The production shape is straightforward:
+
+- Put HTTPS in front of every public service.
+- Expose the OpenWork server/worker URL, not raw opencode.
+- Keep workspace and data paths on durable storage.
+- Configure public URLs, auth origins, CORS origins, tokens, and provider credentials with env vars.
+- Run Den database migrations before the Den controller receives traffic.
+
+For a containerized worker runtime, start from the [Docker packaging](https://github.com/different-ai/openwork/tree/dev/packaging/docker) in the repo.
+
+## Databases and storage
+
+- Worker runtimes use filesystem state and opencode SQLite data inside the mounted workspace/data paths.
+- The Den control plane uses a MySQL-compatible database. Local Docker uses MySQL 8.4; production can use standard MySQL or PlanetScale-compatible credentials.
+- Postgres is not required by the current Den deployment path.
+- The share service stores public bundle payloads in Vercel Blob in our hosted setup. Local/dev can fall back to filesystem storage. If you self-host share, use equivalent object storage or leave share disabled.
+
+## Auth and SSO
+
+Den uses Better Auth. It runs in your deployment, uses your database, and is configured with your `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, trusted origins, and optional GitHub/Google OAuth credentials.
+
+SSO (SAML/OIDC) is in the current rollout and is designed to run against your own identity provider. When enabled, callback URLs and trusted origins should point at your self-hosted Den web/controller hosts.
+
+If you do not deploy Den, worker access is token-based with `OPENWORK_TOKEN` and `OPENWORK_HOST_TOKEN`.
+
+## Minimal Working Stack
+
+#### OpenWork Cloud and the Desktop App
+
+OpenWork cloud is composed of two services:
+
+- NextJS frontend
+- NodeJS backend (Hono) with MySQL DB
+- Electron/React desktop app
+
+These three alone cover most feature but do not include:
+
+- Remote code execution through sandboxes
+- Analytic
+- Telemetry (upcoming) via open telemetry
+- Email management: inviting users, etc.
+
+## Optional vendors
+
+OpenWork does not require many third-party services for the core runtime. These are optional or deployment-specific:
+
+- We use Render: our current hosted service and worker deployment path.
+- Daytona: optional sandbox provider for cloud workers.
+- Vercel: optional Den web/share hosting and worker DNS automation.
+- PostHog: optional analytics for public web surfaces. You can point it at self-hosted PostHog with `NEXT_PUBLIC_POSTHOG_HOST`, or remove/clear the key in your self-hosted web build if you do not want analytics.
+- Polar: optional billing/paywall for hosted cloud workers.
+- Loops: optional user sync and lifecycle messaging.
+- GitHub/Google OAuth: optional social sign-in providers for Better Auth.
+
+## Don't want to run infra?
+
+Skip the server. [**OpenWork Cloud**](/cloud/get-started) runs hosted workers for your team.
+
+Cloud also gives you org-wide primitives you'd otherwise have to build: [team skill hubs](/cloud/share-with-your-team/skill-hubs), [shared LLM providers](/cloud/share-with-your-team/managed-llm-provider), [RBAC](/cloud/members-and-rbac), and [shared workspaces](/cloud/run-in-the-cloud/shared-workspace).
+
+## Looking for support for a larger rollout?
+
+If you're rolling OpenWork out across a company of 150\+ employees, the orchestrator on a single VM might be harder to manage.
+
+At that scale our customers typically want:
+
+- **SSO (SAML/OIDC)** so people sign in with the identity your company already uses
+- **Audit logs** across sessions, tool calls, and model usage
+- **Model and tool allowlists** enforced centrally, not per-workspace
+- **VPC / on-prem deployment** with your own networking and compliance constraints
+- **Support and rollout help** from our team and custom deployment, not just in GitHub.
+
+You can check the [**Enterprise**](/cloud/enterprise) page or [book a 30-minute call](https://calendar.app.google/86QpCENvhfEzDFLu5).
\ No newline at end of file
diff --git a/packages/openwork-server-sdk/openapi-ts.config.ts b/packages/openwork-server-sdk/openapi-ts.config.ts
new file mode 100644
index 0000000000..2b50d7d3ca
--- /dev/null
+++ b/packages/openwork-server-sdk/openapi-ts.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from "@hey-api/openapi-ts";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const configDir = dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  input: resolve(configDir, "../../apps/server-v2/openapi/openapi.json"),
+  output: resolve(configDir, "generated"),
+});
diff --git a/packages/openwork-server-sdk/package.json b/packages/openwork-server-sdk/package.json
new file mode 100644
index 0000000000..984e17ce69
--- /dev/null
+++ b/packages/openwork-server-sdk/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "@openwork/server-sdk",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "development": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  },
+  "files": [
+    "generated",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "generate": "pnpm exec openapi-ts -f openapi-ts.config.ts",
+    "watch": "node ./scripts/watch.mjs",
+    "pretypecheck": "pnpm --dir ../.. run sdk:generate",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@hey-api/client-fetch": "0.13.1"
+  },
+  "devDependencies": {
+    "@hey-api/openapi-ts": "0.95.0",
+    "typescript": "^5.6.3"
+  }
+}
diff --git a/packages/openwork-server-sdk/scripts/watch.mjs b/packages/openwork-server-sdk/scripts/watch.mjs
new file mode 100644
index 0000000000..fbc1658fbe
--- /dev/null
+++ b/packages/openwork-server-sdk/scripts/watch.mjs
@@ -0,0 +1,72 @@
+import { spawn } from "node:child_process";
+import { watch } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const packageDir = path.resolve(scriptDir, "..");
+const specPath = path.resolve(packageDir, "../../apps/server-v2/openapi/openapi.json");
+const specDir = path.dirname(specPath);
+const specFilename = path.basename(specPath);
+
+let activeChild = null;
+let queued = false;
+let timer = null;
+
+function runGenerate() {
+  if (activeChild) {
+    queued = true;
+    return;
+  }
+
+  activeChild = spawn("pnpm", ["run", "generate"], {
+    cwd: packageDir,
+    stdio: "inherit",
+    env: process.env,
+  });
+
+  activeChild.once("exit", (code) => {
+    activeChild = null;
+    if (code && code !== 0) {
+      process.stderr.write(`[openwork-server-sdk] generation failed with exit code ${code}.\n`);
+    }
+    if (queued) {
+      queued = false;
+      scheduleGenerate();
+    }
+  });
+}
+
+function scheduleGenerate() {
+  if (timer) {
+    clearTimeout(timer);
+  }
+  timer = setTimeout(() => {
+    timer = null;
+    runGenerate();
+  }, 120);
+}
+
+try {
+  watch(specDir, (_eventType, filename) => {
+    if (!filename || path.basename(String(filename)) !== specFilename) {
+      return;
+    }
+    scheduleGenerate();
+  });
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+}
+
+runGenerate();
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => {
+    if (activeChild && activeChild.exitCode === null) {
+      activeChild.kill("SIGTERM");
+    }
+    process.exit(0);
+  });
+}
diff --git a/packages/openwork-server-sdk/src/client.ts b/packages/openwork-server-sdk/src/client.ts
new file mode 100644
index 0000000000..8120e72c25
--- /dev/null
+++ b/packages/openwork-server-sdk/src/client.ts
@@ -0,0 +1,17 @@
+import { createClient } from "../generated/client/index";
+import type { Client, Config, CreateClientConfig } from "../generated/client/index";
+
+export type OpenWorkServerClientConfig = Config;
+export type OpenWorkServerClient = Client;
+export type OpenWorkServerClientFactory = CreateClientConfig;
+
+export function normalizeServerBaseUrl(baseUrl: string) {
+  return baseUrl.replace(/\/+$/, "") || baseUrl;
+}
+
+export function createOpenWorkServerClient(config: OpenWorkServerClientConfig = {}): OpenWorkServerClient {
+  return createClient({
+    ...config,
+    baseUrl: config.baseUrl ? normalizeServerBaseUrl(config.baseUrl) : config.baseUrl,
+  });
+}
diff --git a/packages/openwork-server-sdk/src/index.ts b/packages/openwork-server-sdk/src/index.ts
new file mode 100644
index 0000000000..46b84c3891
--- /dev/null
+++ b/packages/openwork-server-sdk/src/index.ts
@@ -0,0 +1,18 @@
+export * from "../generated/index";
+export { createClient } from "../generated/client/index";
+export type {
+  Client,
+  ClientOptions,
+  Config,
+  CreateClientConfig,
+  RequestOptions,
+  RequestResult,
+} from "../generated/client/index";
+export {
+  createOpenWorkServerClient,
+  normalizeServerBaseUrl,
+  type OpenWorkServerClient,
+  type OpenWorkServerClientConfig,
+  type OpenWorkServerClientFactory,
+} from "./client.js";
+export * from "./streams/index.js";
diff --git a/packages/openwork-server-sdk/src/streams/index.ts b/packages/openwork-server-sdk/src/streams/index.ts
new file mode 100644
index 0000000000..606d66b7e9
--- /dev/null
+++ b/packages/openwork-server-sdk/src/streams/index.ts
@@ -0,0 +1,12 @@
+export {
+  createOpenWorkServerEventStream,
+  type OpenWorkServerEventStreamOptions,
+  type OpenWorkServerEventStreamResult,
+  type OpenWorkServerStreamEvent,
+} from "./sse.js";
+export {
+  createOpenWorkServerWorkspaceEventStream,
+  type OpenWorkServerWorkspaceEvent,
+  type OpenWorkServerWorkspaceEventStreamOptions,
+  type OpenWorkServerWorkspaceEventStreamResult,
+} from "./workspace-events.js";
diff --git a/packages/openwork-server-sdk/src/streams/sse.ts b/packages/openwork-server-sdk/src/streams/sse.ts
new file mode 100644
index 0000000000..ee075ccd58
--- /dev/null
+++ b/packages/openwork-server-sdk/src/streams/sse.ts
@@ -0,0 +1,10 @@
+import { createSseClient } from "../../generated/core/serverSentEvents.gen";
+import type { ServerSentEventsOptions, ServerSentEventsResult, StreamEvent } from "../../generated/core/serverSentEvents.gen";
+
+export type OpenWorkServerEventStreamOptions<TData = unknown> = ServerSentEventsOptions<TData>;
+export type OpenWorkServerEventStreamResult<TData = unknown> = ServerSentEventsResult<TData>;
+export type OpenWorkServerStreamEvent<TData = unknown> = StreamEvent<TData>;
+
+export function createOpenWorkServerEventStream<TData = unknown>(options: OpenWorkServerEventStreamOptions<TData>) {
+  return createSseClient<TData>(options as ServerSentEventsOptions<unknown>) as OpenWorkServerEventStreamResult<TData>;
+}
diff --git a/packages/openwork-server-sdk/src/streams/workspace-events.ts b/packages/openwork-server-sdk/src/streams/workspace-events.ts
new file mode 100644
index 0000000000..c41f43ee09
--- /dev/null
+++ b/packages/openwork-server-sdk/src/streams/workspace-events.ts
@@ -0,0 +1,30 @@
+import { normalizeServerBaseUrl } from "../client.js";
+import type { OpenWorkServerV2WorkspaceEvent } from "../../generated/types.gen";
+import {
+  createOpenWorkServerEventStream,
+  type OpenWorkServerEventStreamOptions,
+  type OpenWorkServerEventStreamResult,
+} from "./sse.js";
+
+export type OpenWorkServerWorkspaceEvent = OpenWorkServerV2WorkspaceEvent;
+
+export type OpenWorkServerWorkspaceEventStreamOptions = Omit<
+  OpenWorkServerEventStreamOptions<OpenWorkServerWorkspaceEvent>,
+  "url"
+> & {
+  baseUrl: string;
+  workspaceId: string;
+};
+
+export type OpenWorkServerWorkspaceEventStreamResult = OpenWorkServerEventStreamResult<OpenWorkServerWorkspaceEvent>;
+
+export function createOpenWorkServerWorkspaceEventStream(
+  options: OpenWorkServerWorkspaceEventStreamOptions,
+): OpenWorkServerWorkspaceEventStreamResult {
+  const baseUrl = normalizeServerBaseUrl(options.baseUrl);
+  const url = `${baseUrl}/workspaces/${encodeURIComponent(options.workspaceId)}/events`;
+  return createOpenWorkServerEventStream<OpenWorkServerWorkspaceEvent>({
+    ...options,
+    url,
+  });
+}
diff --git a/packages/openwork-server-sdk/tsconfig.json b/packages/openwork-server-sdk/tsconfig.json
new file mode 100644
index 0000000000..a2be0f4944
--- /dev/null
+++ b/packages/openwork-server-sdk/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["src", "generated"]
+}
diff --git a/packages/openwork-ui-mcp/index.mjs b/packages/openwork-ui-mcp/index.mjs
new file mode 100644
index 0000000000..4ae7d344cc
--- /dev/null
+++ b/packages/openwork-ui-mcp/index.mjs
@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+
+/**
+ * openwork-ui-mcp
+ *
+ * MCP server that exposes OpenWork's UI control surface as MCP tools.
+ * Speaks MCP stdio and proxies to the OpenWork desktop bridge HTTP API.
+ *
+ * Requires OpenWork desktop running with the local UI control bridge active.
+ *
+ * Usage:
+ *   npx openwork-ui-mcp
+ *
+ * MCP config (OpenCode / Claude Desktop / Cursor / etc.):
+ *   {
+ *     "mcpServers": {
+ *       "openwork-ui": {
+ *         "command": "npx",
+ *         "args": ["-y", "openwork-ui-mcp"]
+ *       }
+ *     }
+ *   }
+ */
+
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir, platform } from "node:os";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+// ── Bridge discovery ──
+
+const DISCOVERY_FILE = "openwork-ui-control.json";
+const BRIDGE_CACHE_MS = 2_000;
+const BRIDGE_TIMEOUT_MS = 5_000;
+let cachedBridge = null;
+let cachedBridgeAt = 0;
+
+function userAppDataDir() {
+  if (platform() === "darwin") return join(homedir(), "Library", "Application Support");
+  if (platform() === "win32") return process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+  return process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+}
+
+function discoveryPaths() {
+  return [
+    process.env.OPENWORK_UI_CONTROL_DISCOVERY?.trim(),
+    join(userAppDataDir(), "com.differentai.openwork", DISCOVERY_FILE),
+    join(userAppDataDir(), "com.differentai.openwork.dev", DISCOVERY_FILE),
+  ].filter(Boolean);
+}
+
+function clearBridgeCache() {
+  cachedBridge = null;
+  cachedBridgeAt = 0;
+}
+
+async function discoverBridge() {
+  if (cachedBridge && Date.now() - cachedBridgeAt < BRIDGE_CACHE_MS) return cachedBridge;
+
+  for (const candidate of discoveryPaths()) {
+    try {
+      const raw = await readFile(candidate, "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.baseUrl === "string" && typeof parsed.token === "string") {
+        cachedBridge = { baseUrl: parsed.baseUrl, token: parsed.token, path: candidate };
+        cachedBridgeAt = Date.now();
+        return cachedBridge;
+      }
+    } catch {
+      // Try next
+    }
+  }
+  return null;
+}
+
+async function bridgeRequest(path, options = {}) {
+  const bridge = await discoverBridge();
+  if (!bridge) {
+    return {
+      ok: false,
+      error: "OpenWork is not running. Launch the OpenWork desktop app first.",
+      hint: "The MCP server connects to a running OpenWork instance via its local bridge.",
+    };
+  }
+  const url = `${bridge.baseUrl}${path}`;
+  try {
+    const response = await fetch(url, {
+      method: options.method || "GET",
+      signal: AbortSignal.timeout(options.timeoutMs ?? BRIDGE_TIMEOUT_MS),
+      headers: {
+        Authorization: `Bearer ${bridge.token}`,
+        ...(options.body ? { "Content-Type": "application/json" } : {}),
+      },
+      ...(options.body ? { body: JSON.stringify(options.body) } : {}),
+    });
+    const text = await response.text();
+    try {
+      const parsed = JSON.parse(text);
+      if (!response.ok) clearBridgeCache();
+      return parsed;
+    } catch {
+      if (!response.ok) clearBridgeCache();
+      return { ok: false, error: text || `HTTP ${response.status}` };
+    }
+  } catch (error) {
+    clearBridgeCache();
+    return { ok: false, error: `Bridge unreachable at ${url}: ${error.message}` };
+  }
+}
+
+function formatArgs(action) {
+  const lines = [];
+  if (Array.isArray(action.args) && action.args.length > 0) {
+    lines.push("    Args:");
+    for (const arg of action.args) {
+      const required = arg.required ? "required" : "optional";
+      const type = arg.type || "unknown";
+      lines.push(`      - ${arg.name} (${type}, ${required})${arg.description ? `: ${arg.description}` : ""}`);
+    }
+  } else if (action.requiresArgs) {
+    lines.push("    Args: required; this action has not published detailed argument metadata yet.");
+  }
+  if (action.previewArgs !== undefined) {
+    lines.push(`    Example: ${JSON.stringify(action.previewArgs)}`);
+  }
+  return lines.join("\n");
+}
+
+function formatActionLine(action) {
+  const disabled = action.disabled ? " [disabled]" : "";
+  const busy = action.busy ? " [busy]" : "";
+  const args = formatArgs(action);
+  return `${action.id}${disabled}${busy}\n    ${action.label || ""}${action.description ? ` — ${action.description}` : ""}${args ? `\n${args}` : ""}`;
+}
+
+function formatExecutionResult(actionId, result) {
+  const payload = result?.result ?? result;
+  if (payload === true || payload === undefined || payload === null) return `Executed ${actionId}.`;
+  if (typeof payload === "string") return payload;
+  if (typeof payload === "number" || typeof payload === "boolean") return `Result: ${payload}`;
+  if (typeof payload === "object") {
+    const lines = [`Executed ${actionId}.`];
+    for (const [key, value] of Object.entries(payload).slice(0, 12)) {
+      if (key === "ok" || key === "actionId") continue;
+      const rendered = typeof value === "object" ? JSON.stringify(value) : String(value);
+      lines.push(`${key}: ${rendered}`);
+    }
+    return lines.join("\n");
+  }
+  return `Executed ${actionId}.`;
+}
+
+// ── MCP Server ──
+
+const server = new McpServer({
+  name: "openwork-ui",
+  version: "0.1.0",
+});
+
+// ── ui.snapshot ──
+server.tool(
+  "ui_snapshot",
+  "Get a snapshot of the current OpenWork UI state: active route, narration, visible actions, and status. Use this before taking action to understand what the user sees.",
+  {},
+  async () => {
+    const result = await bridgeRequest("/snapshot");
+    if (!result.ok && result.error) {
+      return { content: [{ type: "text", text: `Error: ${result.error}${result.hint ? `\n${result.hint}` : ""}` }], isError: true };
+    }
+    const snapshot = result.snapshot ?? result;
+    const lines = [];
+    if (snapshot.route) lines.push(`Route: ${snapshot.route}`);
+    if (snapshot.status) lines.push(`Status: ${snapshot.status}`);
+    if (snapshot.narration) lines.push(`Narration: ${snapshot.narration}`);
+    if (snapshot.busyActionId) lines.push(`Busy: ${snapshot.busyActionId}`);
+    if (Array.isArray(snapshot.actions)) {
+      lines.push(`\nActions (${snapshot.actions.length}):`);
+      for (const action of snapshot.actions) {
+        const args = Array.isArray(action.args) && action.args.length ? ` [${action.args.map((a) => a.name).join(", ")}]` : "";
+        lines.push(`  ${action.id} — ${action.label || action.description || ""}${args}`);
+      }
+    }
+    return { content: [{ type: "text", text: lines.join("\n") || "OpenWork is reachable, but it did not return visible UI state." }] };
+  }
+);
+
+// ── ui.list_actions ──
+server.tool(
+  "ui_list_actions",
+  "List all UI control actions currently available in OpenWork: session navigation, composer control, transcript access, and more. Each action has an id you can pass to ui_execute_action.",
+  {},
+  async () => {
+    const result = await bridgeRequest("/actions");
+    if (!result.ok && result.error) {
+      return { content: [{ type: "text", text: `Error: ${result.error}` }], isError: true };
+    }
+    if (!Array.isArray(result.actions) || result.actions.length === 0) {
+      return { content: [{ type: "text", text: "No actions available. Is OpenWork on the main screen?" }] };
+    }
+    const text = result.actions.map(formatActionLine).join("\n\n");
+    return { content: [{ type: "text", text: `${result.actions.length} actions:\n\n${text}` }] };
+  }
+);
+
+// ── ui.execute_action ──
+server.tool(
+  "ui_execute_action",
+  "Execute an OpenWork UI action by its id. Use ui_list_actions first to see available actions and their required arguments.",
+  {
+    actionId: z.string().describe("The action id from ui_list_actions, e.g. 'session.create_task' or 'composer.set_text'"),
+    args: z.record(z.unknown()).optional().describe("JSON arguments for the action, if required"),
+  },
+  async ({ actionId, args }) => {
+    const result = await bridgeRequest("/execute", {
+      method: "POST",
+      body: { actionId, args: args ?? {} },
+    });
+    if (!result.ok && result.error) {
+      return { content: [{ type: "text", text: `Error executing ${actionId}: ${result.error}` }], isError: true };
+    }
+    return { content: [{ type: "text", text: formatExecutionResult(actionId, result) }] };
+  }
+);
+
+// ── ui.status ──
+server.tool(
+  "ui_status",
+  "Check if OpenWork is running and the bridge is reachable. Returns connection status and app info.",
+  {},
+  async () => {
+    const bridge = await discoverBridge();
+    if (!bridge) {
+      return { content: [{ type: "text", text: "OpenWork is not running.\nLaunch the OpenWork desktop app to enable UI control." }], isError: true };
+    }
+    try {
+      const response = await fetch(`${bridge.baseUrl}/health`, { signal: AbortSignal.timeout(3000) });
+      const data = await response.json();
+      return { content: [{ type: "text", text: `Connected to ${data.app || "OpenWork"}\nBridge: ${bridge.baseUrl}\nVersion: ${data.version ?? "?"}` }] };
+    } catch (error) {
+      clearBridgeCache();
+      return { content: [{ type: "text", text: `Bridge file found but not reachable: ${error.message}\nOpenWork may have quit. Relaunch it.` }], isError: true };
+    }
+  }
+);
+
+// ── Start ──
+const transport = new StdioServerTransport();
+await server.connect(transport);
diff --git a/packages/openwork-ui-mcp/package.json b/packages/openwork-ui-mcp/package.json
new file mode 100644
index 0000000000..8745b67829
--- /dev/null
+++ b/packages/openwork-ui-mcp/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "openwork-ui-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for OpenWork UI control — exposes snapshot, actions, and execute as MCP tools",
+  "author": "OpenWork <support@openworklabs.com>",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "openwork-ui-mcp": "index.mjs"
+  },
+  "files": [
+    "index.mjs"
+  ],
+  "scripts": {
+    "check": "node --check index.mjs",
+    "test": "node --check index.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/different-ai/openwork.git",
+    "directory": "packages/openwork-ui-mcp"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^3.25.76"
+  }
+}
diff --git a/packages/types/package.json b/packages/types/package.json
new file mode 100644
index 0000000000..fc0d73ef88
--- /dev/null
+++ b/packages/types/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "@openwork/types",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "development": "./src/index.ts",
+      "default": "./src/index.ts"
+    },
+    "./den/desktop-app-restrictions": {
+      "types": "./src/den/desktop-app-restrictions.ts",
+      "development": "./src/den/desktop-app-restrictions.ts",
+      "default": "./src/den/desktop-app-restrictions.ts"
+    }
+  },
+  "files": [
+    "src",
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5.6.3"
+  }
+}
diff --git a/packages/types/src/den/desktop-app-restrictions.ts b/packages/types/src/den/desktop-app-restrictions.ts
new file mode 100644
index 0000000000..79481971c6
--- /dev/null
+++ b/packages/types/src/den/desktop-app-restrictions.ts
@@ -0,0 +1,75 @@
+import { z } from "zod"
+
+export const desktopAppRestrictionsSchema = z.object({
+  disallowNonCloudModels: z.boolean().optional(),
+  blockZenModel: z.boolean().optional(),
+  blockMultipleWorkspaces: z.boolean().optional(),
+}).meta({ ref: "DenDesktopAppRestrictions" })
+
+export type DesktopAppRestrictions = z.infer<typeof desktopAppRestrictionsSchema>
+
+export const desktopConfigSchema = desktopAppRestrictionsSchema.extend({
+  allowedDesktopVersions: z.array(z.string().trim().min(1).max(32)).optional(),
+}).meta({ ref: "DenDesktopConfig" })
+
+export type DesktopConfig = z.infer<typeof desktopConfigSchema>
+
+function normalizeDesktopVersionString(value: unknown) {
+  if (typeof value !== "string") {
+    return null
+  }
+
+  const normalized = value.trim().replace(/^v/i, "")
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(normalized)
+    ? normalized
+    : null
+}
+
+function normalizeAllowedDesktopVersions(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) {
+    return undefined
+  }
+
+  const versions = [
+    ...new Set(
+      value
+        .map((entry) => normalizeDesktopVersionString(entry))
+        .filter((entry): entry is string => Boolean(entry)),
+    ),
+  ]
+
+  return versions
+}
+
+export function normalizeDesktopAppRestrictions(value: unknown): DesktopAppRestrictions {
+  const parsed = desktopAppRestrictionsSchema.safeParse(value)
+  if (parsed.success) {
+    return {
+      ...(parsed.data.disallowNonCloudModels === true ? { disallowNonCloudModels: true } : {}),
+      ...(parsed.data.blockZenModel === true ? { blockZenModel: true } : {}),
+      ...(parsed.data.blockMultipleWorkspaces === true ? { blockMultipleWorkspaces: true } : {}),
+    }
+  }
+
+  const legacy = value as {
+    models?: {
+      removeZen?: unknown
+    }
+  } | null
+
+  return {
+    ...(legacy?.models?.removeZen === true ? { blockZenModel: true } : {}),
+  }
+}
+
+export function normalizeDesktopConfig(value: unknown): DesktopConfig {
+  const restrictions = normalizeDesktopAppRestrictions(value)
+  const allowedDesktopVersions = normalizeAllowedDesktopVersions(
+    (value as { allowedDesktopVersions?: unknown } | null)?.allowedDesktopVersions,
+  )
+
+  return {
+    ...restrictions,
+    ...(allowedDesktopVersions !== undefined ? { allowedDesktopVersions } : {}),
+  }
+}
diff --git a/packages/types/src/index.ts b/packages/types/src/index.ts
new file mode 100644
index 0000000000..c5f30dc83a
--- /dev/null
+++ b/packages/types/src/index.ts
@@ -0,0 +1 @@
+export * from "./den/desktop-app-restrictions"
diff --git a/packages/types/tsconfig.json b/packages/types/tsconfig.json
new file mode 100644
index 0000000000..70f2966156
--- /dev/null
+++ b/packages/types/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true
+  },
+  "include": [
+    "src/**/*"
+  ]
+}
diff --git a/packages/types/tsup.config.ts b/packages/types/tsup.config.ts
new file mode 100644
index 0000000000..5f2f60ec32
--- /dev/null
+++ b/packages/types/tsup.config.ts
@@ -0,0 +1,20 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: {
+    index: "src/index.ts",
+    "den/desktop-app-restrictions": "src/den/desktop-app-restrictions.ts",
+  },
+  tsconfig: "./tsconfig.json",
+  format: ["esm"],
+  dts: {
+    tsconfig: "./tsconfig.json",
+  },
+  clean: true,
+  target: "es2022",
+  platform: "neutral",
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+  external: ["zod"],
+})
diff --git a/packages/ui/README.md b/packages/ui/README.md
new file mode 100644
index 0000000000..4c21a033c9
--- /dev/null
+++ b/packages/ui/README.md
@@ -0,0 +1,39 @@
+# @openwork/ui
+
+Shared UI primitives for OpenWork apps.
+
+This package intentionally ships two framework-specific entrypoints:
+
+- `@openwork/ui/react` for React apps like `ee/apps/den-web`
+- `@openwork/ui/solid` for Solid apps like `apps/app`
+
+The public API should stay aligned across both entrypoints. If you add a new component, add both implementations in the same task unless there is a documented blocker.
+
+## Paper components
+
+The first shared components live under the `paper` namespace and wrap Paper Design shaders with OpenWork-specific defaults and deterministic seed support.
+
+Current components:
+
+- `PaperMeshGradient`
+- `PaperGrainGradient`
+
+Both accept a `seed` prop. Pass a TypeID-like string such as `om_01kmhbscaze02vp04ykqa4tcsb` and the component will deterministically derive colors and shader params from it. The same seed always produces the same result.
+
+Explicit props still work and override the seeded values, so the merge order is:
+
+1. OpenWork defaults
+2. Seed-derived values from `seed`
+3. Explicit props passed by the caller
+
+## Layout convention
+
+These components default to `fill={true}`, which means they render at `width: 100%` and `height: 100%`. Put them inside a sized container and they will fill it without needing manual width or height props.
+
+## Agent notes
+
+- Shared seed logic lives in `src/common/paper.ts`
+- React wrappers live in `src/react/paper/*`
+- Solid wrappers live in `src/solid/paper/*`
+- Keep the framework prop names aligned unless there is a hard runtime mismatch
+- Prefer extending the existing seed helpers instead of inventing per-app one-off shader configs
diff --git a/packages/ui/package.json b/packages/ui/package.json
new file mode 100644
index 0000000000..914ed66961
--- /dev/null
+++ b/packages/ui/package.json
@@ -0,0 +1,38 @@
+{
+  "name": "@openwork/ui",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./react": {
+      "types": "./src/react/index.ts",
+      "development": "./src/react/index.ts",
+      "default": "./src/react/index.ts"
+    },
+    "./solid": {
+      "types": "./src/solid/index.ts",
+      "development": "./src/solid/index.ts",
+      "default": "./src/solid/index.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup --config tsup.config.react.ts && tsup --config tsup.config.solid.ts"
+  },
+  "dependencies": {
+    "@paper-design/shaders": "0.0.72",
+    "@paper-design/shaders-react": "0.0.72"
+  },
+  "peerDependencies": {
+    "react": "^18 || ^19",
+    "solid-js": "^1.9.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.14",
+    "tsup": "^8.5.0",
+    "typescript": "^5.6.3"
+  }
+}
diff --git a/packages/ui/src/common/paper.ts b/packages/ui/src/common/paper.ts
new file mode 100644
index 0000000000..f719360932
--- /dev/null
+++ b/packages/ui/src/common/paper.ts
@@ -0,0 +1,499 @@
+import type {
+  GrainGradientParams,
+  GrainGradientShape,
+  MeshGradientParams,
+} from "@paper-design/shaders";
+
+export type PaperMeshGradientConfig = Required<
+  Pick<
+    MeshGradientParams,
+    | "colors"
+    | "distortion"
+    | "swirl"
+    | "grainMixer"
+    | "grainOverlay"
+    | "speed"
+    | "frame"
+  >
+>;
+
+export type PaperGrainGradientConfig = Required<
+  Pick<
+    GrainGradientParams,
+    | "colorBack"
+    | "colors"
+    | "softness"
+    | "intensity"
+    | "noise"
+    | "shape"
+    | "speed"
+    | "frame"
+  >
+>;
+
+export type SeededPaperOption = {
+  seed?: string;
+};
+
+export const paperMeshGradientDefaults: PaperMeshGradientConfig = {
+  colors: ["#e0eaff", "#241d9a", "#f75092", "#9f50d3"],
+  distortion: 0.8,
+  swirl: 0.1,
+  grainMixer: 0,
+  grainOverlay: 0,
+  speed: 0.1,
+  frame: 0,
+};
+
+export const paperGrainGradientDefaults: PaperGrainGradientConfig = {
+  colors: ["#7300ff", "#eba8ff", "#00bfff", "#2b00ff"],
+  colorBack: "#000000",
+  softness: 0.5,
+  intensity: 0.5,
+  noise: 0.25,
+  shape: "ripple",
+  speed: 0.4,
+  frame: 0,
+};
+
+const grainShapes: GrainGradientShape[] = [
+  "corners",
+  "wave",
+  "dots",
+  "truchet",
+  "ripple",
+  "blob",
+  "sphere",
+];
+
+const meshPaletteFamilies = [
+  ["#e0eaff", "#241d9a", "#f75092", "#9f50d3"],
+  ["#ddfff5", "#006c67", "#35d8c0", "#8cff7a"],
+  ["#ffe5c2", "#8a2500", "#ff7b39", "#ffd166"],
+  ["#f5f7ff", "#0d1b52", "#3f8cff", "#00c2ff"],
+  ["#fff2f2", "#6f1237", "#ff4d6d", "#ffb703"],
+  ["#f0ffe1", "#254d00", "#8cc63f", "#00a76f"],
+  ["#f5edff", "#44206b", "#b5179e", "#7209b7"],
+  ["#f4f1ea", "#3a2f1f", "#927c55", "#d0c2a8"],
+];
+
+const grainPaletteFamilies = [
+  ["#7300ff", "#eba8ff", "#00bfff", "#2b00ff"],
+  ["#0df2c1", "#0b7cff", "#74efff", "#1a2cff"],
+  ["#ff7a18", "#ffd166", "#ff4d6d", "#5f0f40"],
+  ["#8dff6a", "#1f7a1f", "#d7ff70", "#00c48c"],
+  ["#f6a6ff", "#7027c9", "#ff66c4", "#20115b"],
+  ["#b9ecff", "#006494", "#00a6a6", "#072ac8"],
+  ["#f7f0d6", "#8c5e34", "#d68c45", "#4e342e"],
+  ["#ffd9f5", "#ff006e", "#8338ec", "#3a0ca3"],
+];
+
+const paletteModes = [
+  {
+    hueOffsets: [0, 22, 182, 238],
+    saturations: [0.92, 0.7, 0.84, 0.74],
+    lightnesses: [0.82, 0.28, 0.6, 0.5],
+  },
+  {
+    hueOffsets: [0, 118, 242, 304],
+    saturations: [0.88, 0.76, 0.82, 0.7],
+    lightnesses: [0.8, 0.42, 0.58, 0.48],
+  },
+  {
+    hueOffsets: [0, 44, 156, 214],
+    saturations: [0.94, 0.78, 0.86, 0.72],
+    lightnesses: [0.78, 0.4, 0.6, 0.46],
+  },
+  {
+    hueOffsets: [0, 76, 184, 326],
+    saturations: [0.86, 0.8, 0.78, 0.76],
+    lightnesses: [0.82, 0.52, 0.42, 0.58],
+  },
+  {
+    hueOffsets: [0, 140, 196, 224],
+    saturations: [0.84, 0.7, 0.76, 0.88],
+    lightnesses: [0.86, 0.46, 0.36, 0.54],
+  },
+  {
+    hueOffsets: [0, 162, 212, 342],
+    saturations: [0.9, 0.72, 0.8, 0.82],
+    lightnesses: [0.8, 0.38, 0.52, 0.56],
+  },
+];
+
+type MeshGradientOverrides = SeededPaperOption &
+  Partial<PaperMeshGradientConfig>;
+type GrainGradientOverrides = SeededPaperOption &
+  Partial<PaperGrainGradientConfig>;
+
+export function getSeededPaperMeshGradientConfig(
+  seed: string,
+): PaperMeshGradientConfig {
+  const random = createRandom(seed, "mesh");
+
+  return {
+    colors: createSeededPalette(
+      paperMeshGradientDefaults.colors,
+      seed,
+      "mesh-colors",
+      {
+        families: meshPaletteFamilies,
+        hueShift: 42,
+        saturationShift: 0.18,
+        lightnessShift: 0.14,
+        baseBlend: [0.08, 0.2],
+      },
+    ),
+    distortion: roundTo(clamp(0.58 + random() * 0.32, 0, 1), 3),
+    swirl: roundTo(clamp(0.03 + random() * 0.28, 0, 1), 3),
+    grainMixer: roundTo(clamp(random() * 0.18, 0, 1), 3),
+    grainOverlay: roundTo(clamp(random() * 0.12, 0, 1), 3),
+    speed: 0.5,
+    frame: Math.round(random() * 240000),
+  };
+}
+
+export function getSeededPaperGrainGradientConfig(
+  seed: string,
+): PaperGrainGradientConfig {
+  const random = createRandom(seed, "grain");
+  const colors = createSeededPalette(
+    paperGrainGradientDefaults.colors,
+    seed,
+    "grain-colors",
+    {
+      families: grainPaletteFamilies,
+      hueShift: 58,
+      saturationShift: 0.22,
+      lightnessShift: 0.18,
+      baseBlend: [0.04, 0.14],
+    },
+  );
+  const anchorColor = colors[Math.floor(random() * colors.length)] ?? colors[0];
+
+  return {
+    colors,
+    colorBack: createSeededBackground(anchorColor, seed, "grain-background"),
+    softness: roundTo(clamp(0.22 + random() * 0.56, 0, 1), 3),
+    intensity: roundTo(clamp(0.2 + random() * 0.6, 0, 1), 3),
+    noise: roundTo(clamp(0.12 + random() * 0.34, 0, 1), 3),
+    shape:
+      grainShapes[Math.floor(random() * grainShapes.length)] ??
+      paperGrainGradientDefaults.shape,
+    speed: roundTo(0.2 + random() * 0.6, 3),
+    frame: Math.round(random() * 320000),
+  };
+}
+
+export function resolvePaperMeshGradientConfig(
+  options: MeshGradientOverrides = {},
+): PaperMeshGradientConfig {
+  const seeded = options.seed
+    ? getSeededPaperMeshGradientConfig(options.seed)
+    : paperMeshGradientDefaults;
+
+  return {
+    colors: options.colors ?? seeded.colors,
+    distortion: options.distortion ?? seeded.distortion,
+    swirl: options.swirl ?? seeded.swirl,
+    grainMixer: options.grainMixer ?? seeded.grainMixer,
+    grainOverlay: options.grainOverlay ?? seeded.grainOverlay,
+    speed: options.speed ?? seeded.speed,
+    frame: options.frame ?? seeded.frame,
+  };
+}
+
+export function resolvePaperGrainGradientConfig(
+  options: GrainGradientOverrides = {},
+): PaperGrainGradientConfig {
+  const seeded = options.seed
+    ? getSeededPaperGrainGradientConfig(options.seed)
+    : paperGrainGradientDefaults;
+
+  return {
+    colors: options.colors ?? seeded.colors,
+    colorBack: options.colorBack ?? seeded.colorBack,
+    softness: options.softness ?? seeded.softness,
+    intensity: options.intensity ?? seeded.intensity,
+    noise: options.noise ?? seeded.noise,
+    shape: options.shape ?? seeded.shape,
+    speed: options.speed ?? seeded.speed,
+    frame: options.frame ?? seeded.frame,
+  };
+}
+
+function buildSeedSource(seed: string) {
+  const trimmedSeed = seed.trim();
+  const separatorIndex = trimmedSeed.indexOf("_");
+
+  if (separatorIndex === -1) {
+    return trimmedSeed;
+  }
+
+  const prefix = trimmedSeed.slice(0, separatorIndex);
+  const suffix = trimmedSeed.slice(separatorIndex + 1);
+  const suffixTail = suffix.slice(5) || suffix;
+
+  return `${trimmedSeed}|${prefix}|${suffix}|${suffixTail}`;
+}
+
+function createSeededPalette(
+  baseColors: string[],
+  seed: string,
+  namespace: string,
+  options: {
+    families: string[][];
+    hueShift: number;
+    saturationShift: number;
+    lightnessShift: number;
+    baseBlend: [number, number];
+  },
+) {
+  const familyRandom = createRandom(seed, `${namespace}:family`);
+  const primaryIndex = Math.floor(familyRandom() * options.families.length);
+  const secondaryOffset =
+    1 + Math.floor(familyRandom() * (options.families.length - 1));
+  const secondaryIndex =
+    (primaryIndex + secondaryOffset) % options.families.length;
+  const primary = options.families[primaryIndex] ?? baseColors;
+  const secondary =
+    options.families[secondaryIndex] ?? [...baseColors].reverse();
+  const primaryShift = Math.floor(familyRandom() * primary.length);
+  const secondaryShift = Math.floor(familyRandom() * secondary.length);
+  const paletteMode =
+    paletteModes[Math.floor(familyRandom() * paletteModes.length)] ??
+    paletteModes[0];
+  const baseHue = familyRandom() * 360;
+
+  return baseColors.map((color, index) => {
+    const random = createRandom(seed, `${namespace}:${index}`);
+    const primaryColor =
+      primary[(index + primaryShift) % primary.length] ?? color;
+    const secondaryColor =
+      secondary[(index + secondaryShift) % secondary.length] ?? primaryColor;
+    const proceduralColor = hslToHex(
+      (baseHue +
+        paletteMode.hueOffsets[index % paletteMode.hueOffsets.length] +
+        (random() * 2 - 1) * 18 +
+        360) %
+        360,
+      clamp(
+        paletteMode.saturations[index % paletteMode.saturations.length] +
+          (random() * 2 - 1) * 0.08,
+        0,
+        1,
+      ),
+      clamp(
+        paletteMode.lightnesses[index % paletteMode.lightnesses.length] +
+          (random() * 2 - 1) * 0.08,
+        0,
+        1,
+      ),
+    );
+    const mixedFamilyColor = mixHexColors(
+      primaryColor,
+      secondaryColor,
+      0.18 + random() * 0.64,
+    );
+    const remixedFamilyColor = mixHexColors(
+      mixedFamilyColor,
+      primary[(index + secondaryShift + 1) % primary.length] ??
+        mixedFamilyColor,
+      random() * 0.32,
+    );
+    const proceduralFamilyColor = mixHexColors(
+      proceduralColor,
+      remixedFamilyColor,
+      0.22 + random() * 0.34,
+    );
+    const [minBaseBlend, maxBaseBlend] = options.baseBlend;
+    const blendedBaseColor = mixHexColors(
+      proceduralFamilyColor,
+      color,
+      minBaseBlend + random() * (maxBaseBlend - minBaseBlend),
+    );
+
+    return adjustHexColor(blendedBaseColor, {
+      hueShift: (random() * 2 - 1) * options.hueShift + (random() * 2 - 1) * 14,
+      saturationShift: (random() * 2 - 1) * options.saturationShift + 0.06,
+      lightnessShift: (random() * 2 - 1) * options.lightnessShift,
+    });
+  });
+}
+
+function createSeededBackground(
+  baseColor: string,
+  seed: string,
+  namespace: string,
+) {
+  const [red, green, blue] = hexToRgb(baseColor);
+  const [hue] = rgbToHsl(red, green, blue);
+  const random = createRandom(seed, namespace);
+
+  return hslToHex(
+    hue,
+    clamp(0.18 + random() * 0.18, 0, 1),
+    clamp(0.03 + random() * 0.09, 0, 1),
+  );
+}
+
+function adjustHexColor(
+  hex: string,
+  adjustments: {
+    hueShift: number;
+    saturationShift: number;
+    lightnessShift: number;
+  },
+) {
+  const [red, green, blue] = hexToRgb(hex);
+  const [hue, saturation, lightness] = rgbToHsl(red, green, blue);
+
+  return hslToHex(
+    (hue + adjustments.hueShift + 360) % 360,
+    clamp(saturation + adjustments.saturationShift, 0, 1),
+    clamp(lightness + adjustments.lightnessShift, 0, 1),
+  );
+}
+
+function mixHexColors(colorA: string, colorB: string, amount: number) {
+  const [redA, greenA, blueA] = hexToRgb(colorA);
+  const [redB, greenB, blueB] = hexToRgb(colorB);
+  const mixAmount = clamp(amount, 0, 1);
+
+  return rgbToHex(
+    Math.round(redA + (redB - redA) * mixAmount),
+    Math.round(greenA + (greenB - greenA) * mixAmount),
+    Math.round(blueA + (blueB - blueA) * mixAmount),
+  );
+}
+
+function createRandom(seed: string, namespace: string) {
+  return mulberry32(hashString(`${buildSeedSource(seed)}::${namespace}`));
+}
+
+function hashString(input: string) {
+  let hash = 2166136261;
+
+  for (let index = 0; index < input.length; index += 1) {
+    hash ^= input.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+
+  return hash >>> 0;
+}
+
+function mulberry32(seed: number) {
+  return function nextRandom() {
+    let value = (seed += 0x6d2b79f5);
+    value = Math.imul(value ^ (value >>> 15), value | 1);
+    value ^= value + Math.imul(value ^ (value >>> 7), value | 61);
+    return ((value ^ (value >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+function clamp(value: number, min: number, max: number) {
+  return Math.min(max, Math.max(min, value));
+}
+
+function roundTo(value: number, precision: number) {
+  const power = 10 ** precision;
+  return Math.round(value * power) / power;
+}
+
+function hexToRgb(hex: string): [number, number, number] {
+  const normalized = hex.replace(/^#/, "");
+  const expanded =
+    normalized.length === 3
+      ? normalized
+          .split("")
+          .map((part) => `${part}${part}`)
+          .join("")
+      : normalized;
+
+  if (expanded.length !== 6) {
+    throw new Error(`Unsupported hex color: ${hex}`);
+  }
+
+  const value = Number.parseInt(expanded, 16);
+
+  return [(value >> 16) & 255, (value >> 8) & 255, value & 255];
+}
+
+function rgbToHsl(
+  red: number,
+  green: number,
+  blue: number,
+): [number, number, number] {
+  const normalizedRed = red / 255;
+  const normalizedGreen = green / 255;
+  const normalizedBlue = blue / 255;
+  const max = Math.max(normalizedRed, normalizedGreen, normalizedBlue);
+  const min = Math.min(normalizedRed, normalizedGreen, normalizedBlue);
+  const lightness = (max + min) / 2;
+
+  if (max === min) {
+    return [0, 0, lightness];
+  }
+
+  const delta = max - min;
+  const saturation =
+    lightness > 0.5 ? delta / (2 - max - min) : delta / (max + min);
+
+  let hue = 0;
+
+  switch (max) {
+    case normalizedRed:
+      hue =
+        (normalizedGreen - normalizedBlue) / delta +
+        (normalizedGreen < normalizedBlue ? 6 : 0);
+      break;
+    case normalizedGreen:
+      hue = (normalizedBlue - normalizedRed) / delta + 2;
+      break;
+    default:
+      hue = (normalizedRed - normalizedGreen) / delta + 4;
+      break;
+  }
+
+  return [hue * 60, saturation, lightness];
+}
+
+function hslToHex(hue: number, saturation: number, lightness: number) {
+  if (saturation === 0) {
+    const value = Math.round(lightness * 255);
+    return rgbToHex(value, value, value);
+  }
+
+  const hueToRgb = (p: number, q: number, t: number) => {
+    let normalizedT = t;
+
+    if (normalizedT < 0) normalizedT += 1;
+    if (normalizedT > 1) normalizedT -= 1;
+    if (normalizedT < 1 / 6) return p + (q - p) * 6 * normalizedT;
+    if (normalizedT < 1 / 2) return q;
+    if (normalizedT < 2 / 3) return p + (q - p) * (2 / 3 - normalizedT) * 6;
+    return p;
+  };
+
+  const normalizedHue = hue / 360;
+  const q =
+    lightness < 0.5
+      ? lightness * (1 + saturation)
+      : lightness + saturation - lightness * saturation;
+  const p = 2 * lightness - q;
+  const red = hueToRgb(p, q, normalizedHue + 1 / 3);
+  const green = hueToRgb(p, q, normalizedHue);
+  const blue = hueToRgb(p, q, normalizedHue - 1 / 3);
+
+  return rgbToHex(
+    Math.round(red * 255),
+    Math.round(green * 255),
+    Math.round(blue * 255),
+  );
+}
+
+function rgbToHex(red: number, green: number, blue: number) {
+  return `#${[red, green, blue]
+    .map((value) => value.toString(16).padStart(2, "0"))
+    .join("")}`;
+}
diff --git a/packages/ui/src/react/index.ts b/packages/ui/src/react/index.ts
new file mode 100644
index 0000000000..5945ca552b
--- /dev/null
+++ b/packages/ui/src/react/index.ts
@@ -0,0 +1,17 @@
+export {
+  getSeededPaperGrainGradientConfig,
+  getSeededPaperMeshGradientConfig,
+  paperGrainGradientDefaults,
+  paperMeshGradientDefaults,
+  resolvePaperGrainGradientConfig,
+  resolvePaperMeshGradientConfig,
+} from "../common/paper"
+export type {
+  PaperGrainGradientConfig,
+  PaperMeshGradientConfig,
+  SeededPaperOption,
+} from "../common/paper"
+export { PaperGrainGradient } from "./paper/grain-gradient"
+export type { PaperGrainGradientProps } from "./paper/grain-gradient"
+export { PaperMeshGradient } from "./paper/mesh-gradient"
+export type { PaperMeshGradientProps } from "./paper/mesh-gradient"
diff --git a/packages/ui/src/react/paper/grain-gradient.tsx b/packages/ui/src/react/paper/grain-gradient.tsx
new file mode 100644
index 0000000000..a247eecdc6
--- /dev/null
+++ b/packages/ui/src/react/paper/grain-gradient.tsx
@@ -0,0 +1,101 @@
+"use client"
+
+import {
+  defaultObjectSizing,
+  defaultPatternSizing,
+  type GrainGradientShape,
+} from "@paper-design/shaders"
+import { GrainGradient, type GrainGradientProps } from "@paper-design/shaders-react"
+import { resolvePaperGrainGradientConfig } from "../../common/paper"
+
+export interface PaperGrainGradientProps
+  extends Omit<
+    GrainGradientProps,
+    "colorBack" | "colors" | "softness" | "intensity" | "noise" | "shape" | "speed" | "frame"
+  > {
+  seed?: string
+  fill?: boolean
+  colorBack?: string
+  colors?: string[]
+  softness?: number
+  intensity?: number
+  noise?: number
+  shape?: GrainGradientProps["shape"]
+  speed?: number
+  frame?: number
+}
+
+export function PaperGrainGradient({
+  seed,
+  fill = true,
+  colorBack,
+  colors,
+  softness,
+  intensity,
+  noise,
+  shape,
+  speed,
+  frame,
+  fit,
+  rotation,
+  scale,
+  originX,
+  originY,
+  offsetX,
+  offsetY,
+  worldWidth,
+  worldHeight,
+  width,
+  height,
+  ...props
+}: PaperGrainGradientProps) {
+  const resolved = resolvePaperGrainGradientConfig({
+    seed,
+    colorBack,
+    colors,
+    softness,
+    intensity,
+    noise,
+    shape,
+    speed,
+    frame,
+  })
+
+  const sizingDefaults = getSizingDefaults(resolved.shape)
+
+  return (
+    <GrainGradient
+      {...props}
+      width={width ?? (fill ? "100%" : undefined)}
+      height={height ?? (fill ? "100%" : undefined)}
+      fit={fit ?? sizingDefaults.fit}
+      rotation={rotation ?? sizingDefaults.rotation}
+      scale={scale ?? sizingDefaults.scale}
+      originX={originX ?? sizingDefaults.originX}
+      originY={originY ?? sizingDefaults.originY}
+      offsetX={offsetX ?? sizingDefaults.offsetX}
+      offsetY={offsetY ?? sizingDefaults.offsetY}
+      worldWidth={worldWidth ?? sizingDefaults.worldWidth}
+      worldHeight={worldHeight ?? sizingDefaults.worldHeight}
+      colorBack={resolved.colorBack}
+      colors={resolved.colors}
+      softness={resolved.softness}
+      intensity={resolved.intensity}
+      noise={resolved.noise}
+      shape={resolved.shape}
+      speed={resolved.speed}
+      frame={resolved.frame}
+    />
+  )
+}
+
+function getSizingDefaults(shape: GrainGradientShape) {
+  switch (shape) {
+    case "wave":
+    case "dots":
+    case "truchet":
+      return defaultPatternSizing
+    default:
+      return defaultObjectSizing
+  }
+}
diff --git a/packages/ui/src/react/paper/mesh-gradient.tsx b/packages/ui/src/react/paper/mesh-gradient.tsx
new file mode 100644
index 0000000000..da9fe68ae2
--- /dev/null
+++ b/packages/ui/src/react/paper/mesh-gradient.tsx
@@ -0,0 +1,61 @@
+"use client"
+
+import { MeshGradient, type MeshGradientProps } from "@paper-design/shaders-react"
+import { resolvePaperMeshGradientConfig } from "../../common/paper"
+
+export interface PaperMeshGradientProps
+  extends Omit<
+    MeshGradientProps,
+    "colors" | "distortion" | "swirl" | "grainMixer" | "grainOverlay" | "speed" | "frame"
+  > {
+  seed?: string
+  fill?: boolean
+  colors?: string[]
+  distortion?: number
+  swirl?: number
+  grainMixer?: number
+  grainOverlay?: number
+  speed?: number
+  frame?: number
+}
+
+export function PaperMeshGradient({
+  seed,
+  fill = true,
+  colors,
+  distortion,
+  swirl,
+  grainMixer,
+  grainOverlay,
+  speed,
+  frame,
+  width,
+  height,
+  ...props
+}: PaperMeshGradientProps) {
+  const resolved = resolvePaperMeshGradientConfig({
+    seed,
+    colors,
+    distortion,
+    swirl,
+    grainMixer,
+    grainOverlay,
+    speed,
+    frame,
+  })
+
+  return (
+    <MeshGradient
+      {...props}
+      width={width ?? (fill ? "100%" : undefined)}
+      height={height ?? (fill ? "100%" : undefined)}
+      colors={resolved.colors}
+      distortion={resolved.distortion}
+      swirl={resolved.swirl}
+      grainMixer={resolved.grainMixer}
+      grainOverlay={resolved.grainOverlay}
+      speed={resolved.speed}
+      frame={resolved.frame}
+    />
+  )
+}
diff --git a/packages/ui/src/solid/index.ts b/packages/ui/src/solid/index.ts
new file mode 100644
index 0000000000..5945ca552b
--- /dev/null
+++ b/packages/ui/src/solid/index.ts
@@ -0,0 +1,17 @@
+export {
+  getSeededPaperGrainGradientConfig,
+  getSeededPaperMeshGradientConfig,
+  paperGrainGradientDefaults,
+  paperMeshGradientDefaults,
+  resolvePaperGrainGradientConfig,
+  resolvePaperMeshGradientConfig,
+} from "../common/paper"
+export type {
+  PaperGrainGradientConfig,
+  PaperMeshGradientConfig,
+  SeededPaperOption,
+} from "../common/paper"
+export { PaperGrainGradient } from "./paper/grain-gradient"
+export type { PaperGrainGradientProps } from "./paper/grain-gradient"
+export { PaperMeshGradient } from "./paper/mesh-gradient"
+export type { PaperMeshGradientProps } from "./paper/mesh-gradient"
diff --git a/packages/ui/src/solid/paper/grain-gradient.tsx b/packages/ui/src/solid/paper/grain-gradient.tsx
new file mode 100644
index 0000000000..81c057a2fa
--- /dev/null
+++ b/packages/ui/src/solid/paper/grain-gradient.tsx
@@ -0,0 +1,125 @@
+import {
+  defaultObjectSizing,
+  defaultPatternSizing,
+  getShaderColorFromString,
+  getShaderNoiseTexture,
+  grainGradientFragmentShader,
+  GrainGradientShapes,
+  ShaderFitOptions,
+  type GrainGradientParams,
+} from "@paper-design/shaders"
+import type { JSX } from "solid-js"
+import { resolvePaperGrainGradientConfig } from "../../common/paper"
+import { SolidShaderMount } from "./shader-mount"
+
+type SharedGrainProps = Pick<
+  GrainGradientParams,
+  "fit" | "rotation" | "scale" | "originX" | "originY" | "offsetX" | "offsetY" | "worldWidth" | "worldHeight"
+>
+
+export interface PaperGrainGradientProps
+  extends Omit<JSX.HTMLAttributes<HTMLDivElement>, "ref">,
+    Partial<SharedGrainProps> {
+  ref?: (element: HTMLDivElement) => void
+  seed?: string
+  fill?: boolean
+  colorBack?: string
+  colors?: string[]
+  softness?: number
+  intensity?: number
+  noise?: number
+  shape?: GrainGradientParams["shape"]
+  speed?: number
+  frame?: number
+  minPixelRatio?: number
+  maxPixelCount?: number
+  webGlContextAttributes?: WebGLContextAttributes
+  width?: string | number
+  height?: string | number
+}
+
+export function PaperGrainGradient({
+  seed,
+  fill = true,
+  colorBack,
+  colors,
+  softness,
+  intensity,
+  noise,
+  shape,
+  speed,
+  frame,
+  fit,
+  rotation,
+  scale,
+  originX,
+  originY,
+  offsetX,
+  offsetY,
+  worldWidth,
+  worldHeight,
+  minPixelRatio,
+  maxPixelCount,
+  webGlContextAttributes,
+  width,
+  height,
+  ...props
+}: PaperGrainGradientProps) {
+  const resolved = resolvePaperGrainGradientConfig({
+    seed,
+    colorBack,
+    colors,
+    softness,
+    intensity,
+    noise,
+    shape,
+    speed,
+    frame,
+  })
+
+  const sizingDefaults = getSizingDefaults(resolved.shape)
+
+  return (
+    <SolidShaderMount
+      {...props}
+      width={width ?? (fill ? "100%" : undefined)}
+      height={height ?? (fill ? "100%" : undefined)}
+      speed={resolved.speed}
+      frame={resolved.frame}
+      minPixelRatio={minPixelRatio}
+      maxPixelCount={maxPixelCount}
+      webGlContextAttributes={webGlContextAttributes}
+      fragmentShader={grainGradientFragmentShader}
+      uniforms={{
+        u_colorBack: getShaderColorFromString(resolved.colorBack),
+        u_colors: resolved.colors.map(getShaderColorFromString),
+        u_colorsCount: resolved.colors.length,
+        u_softness: resolved.softness,
+        u_intensity: resolved.intensity,
+        u_noise: resolved.noise,
+        u_shape: GrainGradientShapes[resolved.shape],
+        u_noiseTexture: getShaderNoiseTexture(),
+        u_fit: ShaderFitOptions[fit ?? sizingDefaults.fit],
+        u_scale: scale ?? sizingDefaults.scale,
+        u_rotation: rotation ?? sizingDefaults.rotation,
+        u_offsetX: offsetX ?? sizingDefaults.offsetX,
+        u_offsetY: offsetY ?? sizingDefaults.offsetY,
+        u_originX: originX ?? sizingDefaults.originX,
+        u_originY: originY ?? sizingDefaults.originY,
+        u_worldWidth: worldWidth ?? sizingDefaults.worldWidth,
+        u_worldHeight: worldHeight ?? sizingDefaults.worldHeight,
+      }}
+    />
+  )
+}
+
+function getSizingDefaults(shape: NonNullable<GrainGradientParams["shape"]>) {
+  switch (shape) {
+    case "wave":
+    case "dots":
+    case "truchet":
+      return defaultPatternSizing
+    default:
+      return defaultObjectSizing
+  }
+}
diff --git a/packages/ui/src/solid/paper/mesh-gradient.tsx b/packages/ui/src/solid/paper/mesh-gradient.tsx
new file mode 100644
index 0000000000..234c6f42a6
--- /dev/null
+++ b/packages/ui/src/solid/paper/mesh-gradient.tsx
@@ -0,0 +1,104 @@
+import {
+  defaultObjectSizing,
+  getShaderColorFromString,
+  meshGradientFragmentShader,
+  ShaderFitOptions,
+  type MeshGradientParams,
+} from "@paper-design/shaders"
+import type { JSX } from "solid-js"
+import { resolvePaperMeshGradientConfig } from "../../common/paper"
+import { SolidShaderMount } from "./shader-mount"
+
+type SharedMeshProps = Pick<
+  MeshGradientParams,
+  "fit" | "rotation" | "scale" | "originX" | "originY" | "offsetX" | "offsetY" | "worldWidth" | "worldHeight"
+>
+
+export interface PaperMeshGradientProps
+  extends Omit<JSX.HTMLAttributes<HTMLDivElement>, "ref">,
+    Partial<SharedMeshProps> {
+  ref?: (element: HTMLDivElement) => void
+  seed?: string
+  fill?: boolean
+  colors?: string[]
+  distortion?: number
+  swirl?: number
+  grainMixer?: number
+  grainOverlay?: number
+  speed?: number
+  frame?: number
+  minPixelRatio?: number
+  maxPixelCount?: number
+  webGlContextAttributes?: WebGLContextAttributes
+  width?: string | number
+  height?: string | number
+}
+
+export function PaperMeshGradient({
+  seed,
+  fill = true,
+  colors,
+  distortion,
+  swirl,
+  grainMixer,
+  grainOverlay,
+  speed,
+  frame,
+  fit = defaultObjectSizing.fit,
+  rotation = defaultObjectSizing.rotation,
+  scale = defaultObjectSizing.scale,
+  originX = defaultObjectSizing.originX,
+  originY = defaultObjectSizing.originY,
+  offsetX = defaultObjectSizing.offsetX,
+  offsetY = defaultObjectSizing.offsetY,
+  worldWidth = defaultObjectSizing.worldWidth,
+  worldHeight = defaultObjectSizing.worldHeight,
+  minPixelRatio,
+  maxPixelCount,
+  webGlContextAttributes,
+  width,
+  height,
+  ...props
+}: PaperMeshGradientProps) {
+  const resolved = resolvePaperMeshGradientConfig({
+    seed,
+    colors,
+    distortion,
+    swirl,
+    grainMixer,
+    grainOverlay,
+    speed,
+    frame,
+  })
+
+  return (
+    <SolidShaderMount
+      {...props}
+      width={width ?? (fill ? "100%" : undefined)}
+      height={height ?? (fill ? "100%" : undefined)}
+      speed={resolved.speed}
+      frame={resolved.frame}
+      minPixelRatio={minPixelRatio}
+      maxPixelCount={maxPixelCount}
+      webGlContextAttributes={webGlContextAttributes}
+      fragmentShader={meshGradientFragmentShader}
+      uniforms={{
+        u_colors: resolved.colors.map(getShaderColorFromString),
+        u_colorsCount: resolved.colors.length,
+        u_distortion: resolved.distortion,
+        u_swirl: resolved.swirl,
+        u_grainMixer: resolved.grainMixer,
+        u_grainOverlay: resolved.grainOverlay,
+        u_fit: ShaderFitOptions[fit],
+        u_rotation: rotation,
+        u_scale: scale,
+        u_offsetX: offsetX,
+        u_offsetY: offsetY,
+        u_originX: originX,
+        u_originY: originY,
+        u_worldWidth: worldWidth,
+        u_worldHeight: worldHeight,
+      }}
+    />
+  )
+}
diff --git a/packages/ui/src/solid/paper/shader-mount.tsx b/packages/ui/src/solid/paper/shader-mount.tsx
new file mode 100644
index 0000000000..c8c0d4fe3f
--- /dev/null
+++ b/packages/ui/src/solid/paper/shader-mount.tsx
@@ -0,0 +1,115 @@
+import { ShaderMount, type ShaderMountUniforms } from "@paper-design/shaders"
+import { createEffect, onCleanup, onMount, splitProps, type JSX } from "solid-js"
+
+type SolidShaderMountProps = Omit<JSX.HTMLAttributes<HTMLDivElement>, "ref"> & {
+  ref?: (element: HTMLDivElement) => void
+  fragmentShader: string
+  uniforms: ShaderMountUniforms
+  speed?: number
+  frame?: number
+  minPixelRatio?: number
+  maxPixelCount?: number
+  webGlContextAttributes?: WebGLContextAttributes
+  width?: string | number
+  height?: string | number
+}
+
+export function SolidShaderMount(props: SolidShaderMountProps) {
+  const [local, rest] = splitProps(props, [
+    "ref",
+    "fragmentShader",
+    "uniforms",
+    "speed",
+    "frame",
+    "minPixelRatio",
+    "maxPixelCount",
+    "webGlContextAttributes",
+    "width",
+    "height",
+    "style",
+  ])
+
+  let element: HTMLDivElement | undefined
+  let shaderMount: ShaderMount | undefined
+
+  onMount(() => {
+    if (!element) {
+      return
+    }
+
+    shaderMount = new ShaderMount(
+      element,
+      local.fragmentShader,
+      local.uniforms,
+      local.webGlContextAttributes,
+      local.speed,
+      local.frame,
+      local.minPixelRatio,
+      local.maxPixelCount,
+    )
+
+    onCleanup(() => {
+      shaderMount?.dispose()
+      shaderMount = undefined
+    })
+  })
+
+  createEffect(() => {
+    shaderMount?.setUniforms(local.uniforms)
+  })
+
+  createEffect(() => {
+    shaderMount?.setSpeed(local.speed)
+  })
+
+  createEffect(() => {
+    if (local.frame !== undefined) {
+      shaderMount?.setFrame(local.frame)
+    }
+  })
+
+  createEffect(() => {
+    shaderMount?.setMinPixelRatio(local.minPixelRatio)
+  })
+
+  createEffect(() => {
+    shaderMount?.setMaxPixelCount(local.maxPixelCount)
+  })
+
+  return (
+    <div
+      {...rest}
+      ref={(node) => {
+        element = node
+        local.ref?.(node)
+      }}
+      style={mergeStyle(local.style, local.width, local.height)}
+    />
+  )
+}
+
+function mergeStyle(
+  style: JSX.CSSProperties | string | undefined,
+  width: string | number | undefined,
+  height: string | number | undefined,
+) {
+  if (typeof style === "string") {
+    return [
+      width !== undefined ? `width:${toCssSize(width)}` : "",
+      height !== undefined ? `height:${toCssSize(height)}` : "",
+      style,
+    ]
+      .filter(Boolean)
+      .join(";")
+  }
+
+  return {
+    ...(style ?? {}),
+    ...(width !== undefined ? { width: toCssSize(width) } : {}),
+    ...(height !== undefined ? { height: toCssSize(height) } : {}),
+  }
+}
+
+function toCssSize(value: string | number) {
+  return typeof value === "number" ? `${value}px` : value
+}
diff --git a/packages/ui/tsconfig.react.json b/packages/ui/tsconfig.react.json
new file mode 100644
index 0000000000..5c86881652
--- /dev/null
+++ b/packages/ui/tsconfig.react.json
@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "jsx": "react-jsx"
+  },
+  "include": [
+    "src/common/**/*",
+    "src/react/**/*"
+  ]
+}
diff --git a/packages/ui/tsconfig.solid.json b/packages/ui/tsconfig.solid.json
new file mode 100644
index 0000000000..de511d1beb
--- /dev/null
+++ b/packages/ui/tsconfig.solid.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "jsx": "preserve",
+    "jsxImportSource": "solid-js/h"
+  },
+  "include": [
+    "src/common/**/*",
+    "src/solid/**/*"
+  ]
+}
diff --git a/packages/ui/tsup.config.react.ts b/packages/ui/tsup.config.react.ts
new file mode 100644
index 0000000000..aa28ae73fc
--- /dev/null
+++ b/packages/ui/tsup.config.react.ts
@@ -0,0 +1,23 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: {
+    "react/index": "src/react/index.ts",
+  },
+  tsconfig: "./tsconfig.react.json",
+  format: ["esm"],
+  dts: {
+    tsconfig: "./tsconfig.react.json",
+  },
+  clean: true,
+  target: "es2022",
+  platform: "browser",
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+  external: ["react", "react/jsx-runtime"],
+  esbuildOptions(options) {
+    options.jsx = "automatic"
+    options.jsxImportSource = "react"
+  },
+})
diff --git a/packages/ui/tsup.config.solid.ts b/packages/ui/tsup.config.solid.ts
new file mode 100644
index 0000000000..293f1bc09e
--- /dev/null
+++ b/packages/ui/tsup.config.solid.ts
@@ -0,0 +1,23 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: {
+    "solid/index": "src/solid/index.ts",
+  },
+  tsconfig: "./tsconfig.solid.json",
+  format: ["esm"],
+  dts: {
+    tsconfig: "./tsconfig.solid.json",
+  },
+  clean: false,
+  target: "es2022",
+  platform: "browser",
+  sourcemap: false,
+  splitting: false,
+  treeshake: true,
+  external: ["solid-js", "solid-js/jsx-runtime"],
+  esbuildOptions(options) {
+    options.jsx = "automatic"
+    options.jsxImportSource = "solid-js/h"
+  },
+})
diff --git a/packaging/aur/.SRCINFO b/packaging/aur/.SRCINFO
new file mode 100644
index 0000000000..3d208a1f88
--- /dev/null
+++ b/packaging/aur/.SRCINFO
@@ -0,0 +1,23 @@
+pkgbase = openwork
+	pkgdesc = An Open source alternative to Claude Cowork
+	pkgver = 0.13.3
+	pkgrel = 1
+	url = https://github.com/different-ai/openwork
+	arch = x86_64
+	arch = aarch64
+	license = MIT
+	depends = gtk3
+	depends = glib2
+	depends = libayatana-appindicator
+	depends = libsoup3
+	depends = webkit2gtk-4.1
+	depends = openssl
+	depends = dbus
+	depends = librsvg
+	noextract = openwork-0.13.3.deb
+	source_x86_64 = openwork-0.13.3.deb::https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-desktop-linux-amd64.deb
+	sha256sums_x86_64 = b6fb8ecb86eb9e62d4379f3beb9390106378d3d95dd24b2d405a3377a4acc4a1
+	source_aarch64 = openwork-0.13.3.deb::https://github.com/different-ai/openwork/releases/download/v0.13.3/openwork-desktop-linux-arm64.deb
+	sha256sums_aarch64 = 9f5602b30536a014a39850e9eb656bcb10242c84988b08c8e961a59f9453c93c
+
+pkgname = openwork
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
new file mode 100644
index 0000000000..84336c9bff
--- /dev/null
+++ b/packaging/aur/PKGBUILD
@@ -0,0 +1,42 @@
+pkgname=openwork
+pkgver=0.13.3
+pkgrel=1 # pkgrel should change when PKGBUILD does. Standard is to change back to 1 next time. Any interger is valid.
+pkgdesc="An Open source alternative to Claude Cowork"
+arch=('x86_64' 'aarch64')
+url="https://github.com/different-ai/openwork"
+license=('MIT')
+# webkit2gtk-4.1 provides both webkit2gtk-4.1.pc and javascriptcoregtk-4.1.pc
+depends=('gtk3' 'glib2' 'libayatana-appindicator' 'libsoup3' 'webkit2gtk-4.1' 'openssl' 'dbus' 'librsvg')
+
+# Architecture-specific sources and checksums
+source_x86_64=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/openwork-desktop-linux-amd64.deb")
+sha256sums_x86_64=('b6fb8ecb86eb9e62d4379f3beb9390106378d3d95dd24b2d405a3377a4acc4a1')
+
+source_aarch64=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/openwork-desktop-linux-arm64.deb")
+sha256sums_aarch64=('9f5602b30536a014a39850e9eb656bcb10242c84988b08c8e961a59f9453c93c')
+
+# Makes sure makepkg doesn't extract the .deb since it will break
+noextract=("${pkgname}-${pkgver}.deb")
+
+package() {
+  # cd cwd
+  cd "${srcdir}"
+
+  # Extract the internal data archive directly to the cwd.
+  bsdtar -O -xf "${pkgname}-${pkgver}.deb" 'data.tar*' | bsdtar -C "${pkgdir}" -xf -
+
+  # The upstream .deb includes /usr/bin/opencode, but the AUR package should
+  # not claim the global CLI name. OpenWork uses its bundled copy under
+  # /opt/openwork/ at runtime, while opencode-bin should remain the owner of
+  # /usr/bin/opencode when users install the standalone CLI.
+  rm -f "${pkgdir}/usr/bin/opencode"
+}
+# .deb Internal Structure Reference:
+# └── openwork-desktop-linux-amd64.deb
+#     ├── debian-binary
+#     ├── control.tar.zst
+#     └── data.tar.zst (Extracted to $pkgdir)
+#         ├── opt/openwork/ (App files)
+#         └── usr/bin/
+#             ├── opencode (Terminal agent)
+#             └── openwork (GUI launcher)
diff --git a/packaging/aur/README.md b/packaging/aur/README.md
new file mode 100644
index 0000000000..6266fc9df7
--- /dev/null
+++ b/packaging/aur/README.md
@@ -0,0 +1,86 @@
+# Arch Linux AMD64 package
+
+Use this directory to build and install the AMD64 OpenWork package locally on Arch Linux without Docker.
+
+## What this packaging does
+
+- Targets `x86_64` Arch Linux.
+- Downloads the published GitHub release asset `openwork-desktop-linux-amd64.deb`.
+- Repackages the `.deb` contents into an Arch package with `makepkg`.
+- Removes the bundled `/usr/bin/opencode` file so the package does not conflict with `opencode-bin`.
+
+## Prerequisites
+
+- Arch Linux on `x86_64`
+- `base-devel`
+- `bsdtar` / `libarchive`
+- `curl`
+
+Install the packaging prerequisites once:
+
+```bash
+sudo pacman -S --needed base-devel curl libarchive
+```
+
+## Build and install the current packaged version
+
+From the repo root:
+
+```bash
+cd packaging/aur
+makepkg -si
+```
+
+That will:
+
+1. download the AMD64 `.deb` pinned in `PKGBUILD`
+2. build an Arch package such as `openwork-<version>-1-x86_64.pkg.tar.zst`
+3. install it locally with `pacman`
+
+After install, `openwork` is available as the desktop launcher. If you also want the standalone OpenCode CLI, install `opencode-bin` separately.
+
+## OpenCode CLI conflict note
+
+Recent `.deb` builds include `/usr/bin/opencode`, but the AUR package intentionally strips that file during repackaging.
+
+That keeps OpenWork compatible with systems that already install the OpenCode CLI from `opencode-bin`, which should remain the owner of the global `opencode` command.
+
+## Update the package to a newer release
+
+If the GitHub release version changed, refresh the packaging metadata first:
+
+```bash
+scripts/aur/update-aur.sh v0.11.162
+```
+
+Then rebuild:
+
+```bash
+cd packaging/aur
+makepkg -si
+```
+
+## Build without installing
+
+```bash
+cd packaging/aur
+makepkg -s
+```
+
+This leaves the built package in `packaging/aur/` so you can install it later with:
+
+```bash
+sudo pacman -U openwork-<version>-1-x86_64.pkg.tar.zst
+```
+
+## Verify the installed app
+
+```bash
+openwork
+```
+
+If you want to confirm the package contents first:
+
+```bash
+pacman -Ql openwork
+```
diff --git a/packaging/docker/Dockerfile b/packaging/docker/Dockerfile
new file mode 100644
index 0000000000..62df069914
--- /dev/null
+++ b/packaging/docker/Dockerfile
@@ -0,0 +1,48 @@
+FROM node:22-bookworm-slim
+
+ARG OPENWORK_ORCHESTRATOR_VERSION=0.11.22
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    tar \
+    unzip \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g "openwork-orchestrator@${OPENWORK_ORCHESTRATOR_VERSION}"
+
+# Persistent directories (mount volumes here on PaaS/SSH).
+ENV OPENWORK_DATA_DIR=/data/openwork-orchestrator
+ENV OPENWORK_SIDECAR_DIR=/data/sidecars
+
+# The workspace is mounted from the host/volume.
+ENV OPENWORK_WORKSPACE=/workspace
+
+# OpenWork host contract surface.
+EXPOSE 8787
+
+# Optional: opencode-router health (only relevant if you enable the router).
+EXPOSE 3005
+
+VOLUME ["/workspace", "/data"]
+
+# Defaults:
+# - OpenWork server is published intentionally via --remote-access
+# - OpenCode stays internal (127.0.0.1:4096)
+# - OpenWork server proxies OpenCode via localhost
+# - OpenCode Router disabled by default
+CMD [
+  "openwork",
+  "serve",
+  "--workspace", "/workspace",
+  "--remote-access",
+  "--openwork-port", "8787",
+  "--opencode-host", "127.0.0.1",
+  "--opencode-port", "4096",
+  "--connect-host", "127.0.0.1",
+  "--cors", "*",
+  "--approval", "manual",
+  "--no-opencode-router"
+]
diff --git a/packaging/docker/Dockerfile.den b/packaging/docker/Dockerfile.den
new file mode 100644
index 0000000000..733e0d546e
--- /dev/null
+++ b/packaging/docker/Dockerfile.den
@@ -0,0 +1,28 @@
+FROM node:22-bookworm-slim
+
+RUN corepack enable
+
+WORKDIR /app
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml /app/
+COPY .npmrc /app/.npmrc
+COPY patches /app/patches
+COPY packages/types/package.json /app/packages/types/package.json
+COPY ee/packages/utils/package.json /app/ee/packages/utils/package.json
+COPY ee/packages/den-db/package.json /app/ee/packages/den-db/package.json
+COPY ee/apps/den-api/package.json /app/ee/apps/den-api/package.json
+
+RUN pnpm install --frozen-lockfile
+
+COPY packages/types /app/packages/types
+COPY ee/packages/utils /app/ee/packages/utils
+COPY ee/packages/den-db /app/ee/packages/den-db
+COPY ee/apps/den-api /app/ee/apps/den-api
+
+RUN pnpm --dir /app/ee/packages/utils run build
+RUN pnpm --dir /app/ee/packages/den-db run build
+RUN pnpm --dir /app/ee/apps/den-api run build
+
+EXPOSE 8788
+
+CMD ["sh", "-lc", "yes | pnpm --dir /app/ee/packages/den-db run db:push && node ee/apps/den-api/dist/server.js"]
diff --git a/packaging/docker/Dockerfile.den-web b/packaging/docker/Dockerfile.den-web
new file mode 100644
index 0000000000..c9ff26e374
--- /dev/null
+++ b/packaging/docker/Dockerfile.den-web
@@ -0,0 +1,26 @@
+FROM node:22-bookworm-slim
+
+RUN corepack enable
+
+WORKDIR /app
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml /app/
+COPY .npmrc /app/.npmrc
+COPY patches /app/patches
+COPY packages/types/package.json /app/packages/types/package.json
+COPY packages/ui/package.json /app/packages/ui/package.json
+COPY ee/packages/utils/package.json /app/ee/packages/utils/package.json
+COPY ee/apps/den-web/package.json /app/ee/apps/den-web/package.json
+
+RUN pnpm install --frozen-lockfile --filter @openwork-ee/den-web...
+
+COPY packages/types /app/packages/types
+COPY packages/ui /app/packages/ui
+COPY ee/packages/utils /app/ee/packages/utils
+COPY ee/apps/den-web /app/ee/apps/den-web
+
+WORKDIR /app/ee/apps/den-web
+
+EXPOSE 3005
+
+CMD ["sh", "-lc", "pnpm run build && pnpm run start"]
diff --git a/packaging/docker/Dockerfile.den-worker-proxy b/packaging/docker/Dockerfile.den-worker-proxy
new file mode 100644
index 0000000000..671312e70e
--- /dev/null
+++ b/packaging/docker/Dockerfile.den-worker-proxy
@@ -0,0 +1,28 @@
+FROM node:22-bookworm-slim
+
+RUN corepack enable
+
+WORKDIR /app
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml /app/
+COPY .npmrc /app/.npmrc
+COPY patches /app/patches
+COPY packages/types/package.json /app/packages/types/package.json
+COPY ee/packages/utils/package.json /app/ee/packages/utils/package.json
+COPY ee/packages/den-db/package.json /app/ee/packages/den-db/package.json
+COPY ee/apps/den-worker-proxy/package.json /app/ee/apps/den-worker-proxy/package.json
+
+RUN pnpm install --frozen-lockfile
+
+COPY packages/types /app/packages/types
+COPY ee/packages/utils /app/ee/packages/utils
+COPY ee/packages/den-db /app/ee/packages/den-db
+COPY ee/apps/den-worker-proxy /app/ee/apps/den-worker-proxy
+
+RUN pnpm --dir /app/ee/packages/utils run build
+RUN pnpm --dir /app/ee/packages/den-db run build
+RUN pnpm --dir /app/ee/apps/den-worker-proxy run build
+
+EXPOSE 8789
+
+CMD ["sh", "-lc", "node ee/apps/den-worker-proxy/dist/server.js"]
diff --git a/packaging/docker/Dockerfile.microsandbox b/packaging/docker/Dockerfile.microsandbox
new file mode 100644
index 0000000000..f44f73297b
--- /dev/null
+++ b/packaging/docker/Dockerfile.microsandbox
@@ -0,0 +1,71 @@
+FROM node:22-bookworm-slim AS openwork-builder
+
+WORKDIR /src
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl git unzip \
+  && npm install -g bun \
+  && corepack enable \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY . .
+
+RUN pnpm install --frozen-lockfile --filter openwork-orchestrator... --filter openwork-server... \
+  && pnpm --filter openwork-orchestrator build:bin \
+  && pnpm --filter openwork-server build:bin
+
+FROM node:22-bookworm-slim
+
+ARG OPENWORK_ORCHESTRATOR_VERSION
+ARG OPENWORK_SERVER_VERSION
+ARG OPENCODE_VERSION
+ARG OPENCODE_DOWNLOAD_URL=
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl tar unzip \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=openwork-builder /src/apps/orchestrator/dist/bin/openwork /usr/local/bin/openwork
+COPY --from=openwork-builder /src/apps/server/dist/bin/openwork-server /usr/local/bin/openwork-server
+COPY --from=openwork-builder /src/constants.json /usr/local/constants.json
+COPY packaging/docker/microsandbox-entrypoint.sh /usr/local/bin/microsandbox-entrypoint.sh
+
+RUN set -eux; \
+  test -n "$OPENWORK_ORCHESTRATOR_VERSION"; \
+  test -n "$OPENWORK_SERVER_VERSION"; \
+  test -n "$OPENCODE_VERSION"; \
+  arch="$(dpkg --print-architecture)"; \
+  case "$arch" in \
+    amd64) asset="opencode-linux-x64-baseline.tar.gz" ;; \
+    arm64) asset="opencode-linux-arm64.tar.gz" ;; \
+    *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
+  esac; \
+  url="$OPENCODE_DOWNLOAD_URL"; \
+  if [ -z "$url" ]; then \
+    url="https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/${asset}"; \
+  fi; \
+  tmpdir="$(mktemp -d)"; \
+  curl -fsSL "$url" -o "$tmpdir/$asset"; \
+  tar -xzf "$tmpdir/$asset" -C "$tmpdir"; \
+  binary="$(find "$tmpdir" -type f -name opencode | head -n 1)"; \
+  test -n "$binary"; \
+  install -m 0755 "$binary" /usr/local/bin/opencode; \
+  chmod +x /usr/local/bin/microsandbox-entrypoint.sh; \
+  rm -rf "$tmpdir"
+
+RUN test "$(openwork --version)" = "$OPENWORK_ORCHESTRATOR_VERSION" \
+  && test "$(openwork-server --version)" = "$OPENWORK_SERVER_VERSION" \
+  && opencode --version
+
+ENV OPENWORK_DATA_DIR=/data/openwork-orchestrator
+ENV OPENWORK_SIDECAR_DIR=/data/sidecars
+ENV OPENWORK_WORKSPACE=/workspace
+
+EXPOSE 8787
+
+VOLUME ["/workspace", "/data"]
+
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=12 \
+  CMD /bin/sh -c 'curl -fsS "http://127.0.0.1:${OPENWORK_PORT:-8787}/health" >/dev/null || exit 1'
+
+ENTRYPOINT ["/usr/local/bin/microsandbox-entrypoint.sh"]
diff --git a/packaging/docker/README.md b/packaging/docker/README.md
new file mode 100644
index 0000000000..52afe42c46
--- /dev/null
+++ b/packaging/docker/README.md
@@ -0,0 +1,186 @@
+# OpenWork Host (Docker)
+
+## Den local stack (Docker)
+
+One command for the Den control plane, local MySQL, and the cloud web app.
+
+From the repo root:
+
+```bash
+./packaging/docker/den-dev-up.sh
+```
+
+Or via pnpm:
+
+```bash
+pnpm dev:den-docker
+```
+
+What it does:
+- Starts **MySQL** for the Den service
+- Starts **Den control plane** on port 8788 inside Docker with `PROVISIONER_MODE=stub`
+- Runs **Den migrations** automatically before the API starts
+- Starts the **OpenWork Cloud web app** on port 3005 inside Docker
+- Points the web app's auth + API proxy routes at the local Den service
+- Prints randomized host URLs so multiple stacks can run side by side
+
+### Demo org seed
+
+After the Den DB is running, seed a full local demo org with users, teams, pending invites, and imported plugin data from `anthropics/knowledge-work-plugins`:
+
+```bash
+pnpm dev:den:seed-demo
+```
+
+The seed is local/dev-only, idempotent for the `acme-robotics-demo` org, and does not create workers or live integrations. It imports plugin marketplace rows, plugin rows, access grants, and config objects so plugin pages look populated without connecting external services.
+
+Default demo login:
+
+- Email: `alex@acme.test`
+- Password: `OpenWorkDemo123!`
+
+For the Docker stack with randomized MySQL ports, source the printed runtime env file first and pass `DEN_MYSQL_URL` as `DATABASE_URL`:
+
+```bash
+source tmp/.den-dev-env-<id>
+DATABASE_URL="$DEN_MYSQL_URL" pnpm dev:den:seed-demo
+```
+
+Set `DEN_DEMO_SEED_FETCH_GITHUB=0` to skip live GitHub source fetching and use built-in plugin fallbacks only.
+
+Useful commands:
+- Logs: `docker compose -p <project> -f packaging/docker/docker-compose.den-dev.yml logs`
+- Tear down: `docker compose -p <project> -f packaging/docker/docker-compose.den-dev.yml down`
+- Tear down + reset DB: `docker compose -p <project> -f packaging/docker/docker-compose.den-dev.yml down -v`
+
+Optional env vars (via `.env` or `export`):
+- `DEN_API_PORT` — host port to map to the Den control plane :8788
+- `DEN_WEB_PORT` — host port to map to the cloud web app :3005
+- `DEN_BETTER_AUTH_SECRET` — Better Auth secret (auto-generated if unset)
+- `DEN_PUBLIC_HOST` — host name/IP used for default auth URL + printed LAN/public URLs (defaults to your machine hostname)
+- `DEN_BETTER_AUTH_URL` — browser-facing auth base URL (defaults to `http://$DEN_PUBLIC_HOST:<DEN_WEB_PORT>`)
+- `DEN_MCP_RESOURCE_URL` — API-facing MCP resource URL (defaults to `http://localhost:<DEN_API_PORT>/mcp`)
+- `DEN_BETTER_AUTH_TRUSTED_ORIGINS` — trusted origins for Better Auth (defaults to `DEN_CORS_ORIGINS`)
+- `DEN_CORS_ORIGINS` — trusted origins for Express CORS (defaults include hostname, localhost, `127.0.0.1`, `0.0.0.0`, and detected LAN IPv4)
+- `DEN_PROVISIONER_MODE` — `stub` or `render` (defaults to `stub`)
+- `DEN_WORKER_URL_TEMPLATE` — stub worker URL template with `{workerId}` placeholder
+
+### Faster inner-loop alternative
+
+If you are iterating on Den locally and do not need the full Dockerized web stack, use the hybrid path instead:
+
+From the OpenWork repo root:
+
+```bash
+pnpm dev:den
+```
+
+Or from the OpenWork enterprise root:
+
+```bash
+pnpm --dir _repos/openwork dev:den
+```
+
+What it does:
+- Starts only **MySQL** in Docker
+- Runs **Den controller** locally in watch mode
+- Runs **OpenWork Cloud web app** locally in Next.js dev mode
+- Reuses the existing local-dev wiring in `scripts/dev-web-local.sh`
+
+This is usually the fastest path for UI/auth/control-plane iteration because it avoids rebuilding the Docker web image on each boot.
+
+If you want to run the pieces in separate terminals, use the root package scripts:
+
+```bash
+pnpm dev:den:mysql
+pnpm dev:den:db-push
+pnpm dev:den:api
+pnpm dev:den:web
+```
+
+The split API/web flow defaults to Den API on `http://localhost:8790` and Den web on `http://localhost:3005`. Stop the local MySQL container with:
+
+```bash
+pnpm dev:den:mysql:down
+```
+
+---
+
+## Pre-baked Micro-Sandbox Image
+
+For micro-sandbox work, use the pre-baked image that compiles `openwork` and `openwork-server` from source and downloads the pinned `opencode` binary during `docker build`.
+
+Build it from the repo root:
+
+```bash
+./scripts/build-microsandbox-openwork-image.sh
+```
+
+Run it locally:
+
+```bash
+docker run --rm -p 8787:8787 \
+  -e OPENWORK_CONNECT_HOST=127.0.0.1 \
+  openwork-microsandbox:dev
+```
+
+Defaults:
+- `OPENWORK_TOKEN=microsandbox-token`
+- `OPENWORK_HOST_TOKEN=microsandbox-host-token`
+- `OPENWORK_APPROVAL_MODE=auto`
+
+Verification:
+- Health: `curl http://127.0.0.1:8787/health`
+- Authenticated API call: `curl -H "Authorization: Bearer microsandbox-token" http://127.0.0.1:8787/workspaces`
+- Docker health: `docker inspect --format '{{json .State.Health}}' <container>`
+
+Useful overrides:
+- `OPENWORK_TOKEN` — set your own client bearer token
+- `OPENWORK_HOST_TOKEN` — set your own host/admin token
+- `OPENWORK_CONNECT_HOST` — host name embedded in the printed connect URL
+- `DOCKER_PLATFORM` — optional platform passed to `docker build`
+
+---
+
+## Production container
+
+This is a minimal packaging template to run the OpenWork Host contract in a single container.
+
+It runs:
+
+- `opencode serve` (engine) bound to `127.0.0.1:4096` inside the container
+- `openwork-server` published on `0.0.0.0:8787` via an explicit `--remote-access` launch path (the only published surface)
+
+### Local run (compose)
+
+From this directory:
+
+```bash
+docker compose up --build
+```
+
+Then open:
+
+- `http://127.0.0.1:8787/ui`
+
+### Config
+
+Recommended env vars:
+
+- `OPENWORK_TOKEN` (client token)
+- `OPENWORK_HOST_TOKEN` (host/owner token)
+
+Optional:
+
+- `OPENWORK_APPROVAL_MODE=auto|manual`
+- `OPENWORK_APPROVAL_TIMEOUT_MS=30000`
+
+Persistence:
+
+- Workspace is mounted at `/workspace`
+- Host data dir is mounted at `/data` (OpenCode caches + OpenWork server config/tokens)
+
+### Notes
+
+- OpenCode is not exposed directly; access it via the OpenWork proxy (`/opencode/*`).
+- For PaaS, replace `./workspace:/workspace` with a volume or a checkout strategy (git clone on boot).
diff --git a/packaging/docker/den-dev-up.sh b/packaging/docker/den-dev-up.sh
new file mode 100755
index 0000000000..ff95c7986a
--- /dev/null
+++ b/packaging/docker/den-dev-up.sh
@@ -0,0 +1,299 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bring up a local Den testability stack with random host ports.
+#
+# Usage (from _repos/openwork repo root):
+#   packaging/docker/den-dev-up.sh
+#
+# Outputs:
+# - Cloud web app URL
+# - Den control plane demo/API URL
+# - Runtime env file path with ports + project name
+#
+# Notes:
+# - This script auto-generates a Better Auth secret per run.
+# - It also uses a premade dev-only DB encryption key unless you override
+#   DEN_DB_ENCRYPTION_KEY yourself.
+# - Generate a replacement with: openssl rand -base64 128
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+COMPOSE_FILE="$ROOT_DIR/packaging/docker/docker-compose.den-dev.yml"
+RUNTIME_DIR="$ROOT_DIR/tmp/docker-den-dev"
+DAYTONA_ENV_FILE="${DAYTONA_ENV_FILE:-$ROOT_DIR/.env.daytona}"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker is required" >&2
+  exit 1
+fi
+
+pick_port() {
+  node -e "
+    const net = require('net');
+    const server = net.createServer();
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      console.log(port);
+      server.close();
+    });
+  "
+}
+
+random_hex() {
+  local bytes="$1"
+  node -e "console.log(require('crypto').randomBytes(${bytes}).toString('hex'))"
+}
+
+detect_lan_ipv4() {
+  node -e '
+    const os = require("os");
+    const nets = os.networkInterfaces();
+    for (const entries of Object.values(nets)) {
+      for (const entry of entries || []) {
+        if (!entry || entry.internal || entry.family !== "IPv4") continue;
+        if (entry.address.startsWith("127.")) continue;
+        process.stdout.write(entry.address);
+        process.exit(0);
+      }
+    }
+  '
+}
+
+detect_tailscale_dns_name() {
+  if ! command -v tailscale >/dev/null 2>&1; then
+    return 1
+  fi
+
+  tailscale status --json 2>/dev/null | node -e '
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => { data += chunk; });
+    process.stdin.on("end", () => {
+      try {
+        const parsed = JSON.parse(data);
+        const value = (parsed?.Self?.DNSName || "").replace(/\.$/, "").trim();
+        if (!value) process.exit(1);
+        process.stdout.write(value);
+      } catch {
+        process.exit(1);
+      }
+    });
+  '
+}
+
+detect_public_host() {
+  if [ -n "${DEN_PUBLIC_HOST:-}" ]; then
+    printf '%s\n' "$DEN_PUBLIC_HOST"
+    return
+  fi
+
+  local lan_ipv4
+  lan_ipv4="$(detect_lan_ipv4 || true)"
+  if [ -n "$lan_ipv4" ]; then
+    printf '%s\n' "$lan_ipv4"
+    return
+  fi
+
+  local host
+  host="$(hostname -s 2>/dev/null || hostname 2>/dev/null || true)"
+  host="${host//$'\n'/}"
+  host="${host// /}"
+  if [ -n "$host" ]; then
+    printf '%s\n' "$host"
+    return
+  fi
+
+  printf '%s\n' "localhost"
+}
+
+append_origin() {
+  local value="$1"
+  [ -n "$value" ] || return 0
+  if [ -z "${DEN_CORS_ORIGINS:-}" ]; then
+    DEN_CORS_ORIGINS="$value"
+    return 0
+  fi
+  case ",${DEN_CORS_ORIGINS}," in
+    *",${value},"*) ;;
+    *) DEN_CORS_ORIGINS="${DEN_CORS_ORIGINS},${value}" ;;
+  esac
+}
+
+DEV_ID="$(node -e "console.log(require('crypto').randomUUID().slice(0, 8))")"
+PROJECT="openwork-den-dev-$DEV_ID"
+DEN_WATCH_OTP_CODES="${DEN_WATCH_OTP_CODES:-1}"
+
+DEN_API_PORT="${DEN_API_PORT:-$(pick_port)}"
+DEN_WEB_PORT="${DEN_WEB_PORT:-$(pick_port)}"
+DEN_WORKER_PROXY_PORT="${DEN_WORKER_PROXY_PORT:-$(pick_port)}"
+DEN_MYSQL_PORT="${DEN_MYSQL_PORT:-$(pick_port)}"
+if [ "$DEN_WEB_PORT" = "$DEN_API_PORT" ]; then
+  DEN_WEB_PORT="$(pick_port)"
+fi
+if [ "$DEN_WORKER_PROXY_PORT" = "$DEN_API_PORT" ] || [ "$DEN_WORKER_PROXY_PORT" = "$DEN_WEB_PORT" ]; then
+  DEN_WORKER_PROXY_PORT="$(pick_port)"
+fi
+if [ "$DEN_MYSQL_PORT" = "$DEN_API_PORT" ] || [ "$DEN_MYSQL_PORT" = "$DEN_WEB_PORT" ] || [ "$DEN_MYSQL_PORT" = "$DEN_WORKER_PROXY_PORT" ]; then
+  DEN_MYSQL_PORT="$(pick_port)"
+fi
+
+PUBLIC_HOST="$(detect_public_host)"
+LAN_IPV4="$(detect_lan_ipv4 || true)"
+TAILSCALE_DNS_NAME="$(detect_tailscale_dns_name || true)"
+
+DEN_BETTER_AUTH_SECRET="${DEN_BETTER_AUTH_SECRET:-$(random_hex 32)}"
+DEN_DB_ENCRYPTION_KEY="${DEN_DB_ENCRYPTION_KEY:-dev-den-db-encryption-key-please-change-1234567890}"
+DEN_BETTER_AUTH_URL="${DEN_BETTER_AUTH_URL:-http://$PUBLIC_HOST:$DEN_WEB_PORT}"
+DEN_PROVISIONER_MODE="${DEN_PROVISIONER_MODE:-stub}"
+DEN_WORKER_URL_TEMPLATE="${DEN_WORKER_URL_TEMPLATE:-https://workers.local/{workerId}}"
+DEN_DAYTONA_WORKER_PROXY_BASE_URL="${DEN_DAYTONA_WORKER_PROXY_BASE_URL:-http://$PUBLIC_HOST:$DEN_WORKER_PROXY_PORT}"
+DEN_CORS_ORIGINS="${DEN_CORS_ORIGINS:-http://localhost:$DEN_WEB_PORT,http://127.0.0.1:$DEN_WEB_PORT,http://0.0.0.0:$DEN_WEB_PORT,http://localhost:$DEN_API_PORT,http://127.0.0.1:$DEN_API_PORT}"
+append_origin "http://$PUBLIC_HOST:$DEN_WEB_PORT"
+append_origin "http://$PUBLIC_HOST:$DEN_API_PORT"
+append_origin "http://$PUBLIC_HOST:$DEN_WORKER_PROXY_PORT"
+if [ -n "$LAN_IPV4" ]; then
+  append_origin "http://$LAN_IPV4:$DEN_WEB_PORT"
+  append_origin "http://$LAN_IPV4:$DEN_API_PORT"
+  append_origin "http://$LAN_IPV4:$DEN_WORKER_PROXY_PORT"
+fi
+DEN_BETTER_AUTH_TRUSTED_ORIGINS="${DEN_BETTER_AUTH_TRUSTED_ORIGINS:-$DEN_CORS_ORIGINS}"
+
+if [ "$DEN_PROVISIONER_MODE" = "daytona" ] && [ -f "$DAYTONA_ENV_FILE" ]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$DAYTONA_ENV_FILE"
+  set +a
+fi
+
+if [ "$DEN_PROVISIONER_MODE" = "daytona" ] && [ -z "${DAYTONA_API_KEY:-}" ]; then
+  echo "DAYTONA_API_KEY is required when DEN_PROVISIONER_MODE=daytona" >&2
+  echo "Set DAYTONA_ENV_FILE to your .env.daytona path or export DAYTONA_API_KEY before running den-dev-up.sh" >&2
+  exit 1
+fi
+
+mkdir -p "$RUNTIME_DIR"
+RUNTIME_FILE="$ROOT_DIR/tmp/.den-dev-env-$DEV_ID"
+
+start_otp_log_watch() {
+  if [ "$DEN_WATCH_OTP_CODES" != "1" ]; then
+    return
+  fi
+
+  (
+    docker compose -p "$PROJECT" -f "$COMPOSE_FILE" logs -f --since=1s den 2>&1 | while IFS= read -r line; do
+      case "$line" in
+        *"[auth] dev verification code for "*)
+          if [[ "$line" == *" | "* ]]; then
+            line="${line#* | }"
+          fi
+          printf '\n[den otp] %s\n' "$line" >&2
+          ;;
+      esac
+    done
+  ) &
+
+  OTP_LOG_PID=$!
+}
+
+cat > "$RUNTIME_FILE" <<EOF
+PROJECT=$PROJECT
+DEN_API_PORT=$DEN_API_PORT
+DEN_WEB_PORT=$DEN_WEB_PORT
+DEN_WORKER_PROXY_PORT=$DEN_WORKER_PROXY_PORT
+DEN_MYSQL_PORT=$DEN_MYSQL_PORT
+DEN_API_URL=http://localhost:$DEN_API_PORT
+DEN_WEB_URL=http://localhost:$DEN_WEB_PORT
+DEN_WORKER_PROXY_URL=http://localhost:$DEN_WORKER_PROXY_PORT
+DEN_API_PUBLIC_URL=http://$PUBLIC_HOST:$DEN_API_PORT
+DEN_WEB_PUBLIC_URL=http://$PUBLIC_HOST:$DEN_WEB_PORT
+DEN_WORKER_PROXY_PUBLIC_URL=http://$PUBLIC_HOST:$DEN_WORKER_PROXY_PORT
+DEN_MYSQL_URL=mysql://root:password@127.0.0.1:$DEN_MYSQL_PORT/openwork_den
+DEN_BETTER_AUTH_URL=$DEN_BETTER_AUTH_URL
+DEN_DB_ENCRYPTION_KEY=$DEN_DB_ENCRYPTION_KEY
+COMPOSE_FILE=$COMPOSE_FILE
+DEN_WATCH_OTP_CODES=$DEN_WATCH_OTP_CODES
+EOF
+
+echo "Starting Docker Compose project: $PROJECT" >&2
+echo "- DEN_API_PORT=$DEN_API_PORT" >&2
+echo "- DEN_WEB_PORT=$DEN_WEB_PORT" >&2
+echo "- DEN_WORKER_PROXY_PORT=$DEN_WORKER_PROXY_PORT" >&2
+echo "- DEN_MYSQL_PORT=$DEN_MYSQL_PORT" >&2
+echo "- DEN_BETTER_AUTH_URL=$DEN_BETTER_AUTH_URL" >&2
+echo "- DEN_DB_ENCRYPTION_KEY=[set] (dev default unless overridden)" >&2
+echo "- DEN_PROVISIONER_MODE=$DEN_PROVISIONER_MODE" >&2
+echo "- OTP verification codes will stream back to this terminal" >&2
+if [ "$DEN_PROVISIONER_MODE" = "daytona" ]; then
+  echo "- DAYTONA_API_URL=${DAYTONA_API_URL:-https://app.daytona.io/api}" >&2
+  if [ -n "${DAYTONA_TARGET:-}" ]; then
+    echo "- DAYTONA_TARGET=$DAYTONA_TARGET" >&2
+  fi
+fi
+
+if ! DEN_API_PORT="$DEN_API_PORT" \
+  DEN_WEB_PORT="$DEN_WEB_PORT" \
+  DEN_WORKER_PROXY_PORT="$DEN_WORKER_PROXY_PORT" \
+  DEN_MYSQL_PORT="$DEN_MYSQL_PORT" \
+  DEN_BETTER_AUTH_SECRET="$DEN_BETTER_AUTH_SECRET" \
+  DEN_DB_ENCRYPTION_KEY="$DEN_DB_ENCRYPTION_KEY" \
+  DEN_BETTER_AUTH_URL="$DEN_BETTER_AUTH_URL" \
+  DEN_CORS_ORIGINS="$DEN_CORS_ORIGINS" \
+  DEN_BETTER_AUTH_TRUSTED_ORIGINS="$DEN_BETTER_AUTH_TRUSTED_ORIGINS" \
+  DEN_PROVISIONER_MODE="$DEN_PROVISIONER_MODE" \
+  DEN_WORKER_URL_TEMPLATE="$DEN_WORKER_URL_TEMPLATE" \
+  DEN_DAYTONA_WORKER_PROXY_BASE_URL="$DEN_DAYTONA_WORKER_PROXY_BASE_URL" \
+  DAYTONA_API_URL="${DAYTONA_API_URL:-}" \
+  DAYTONA_API_KEY="${DAYTONA_API_KEY:-}" \
+  DAYTONA_TARGET="${DAYTONA_TARGET:-}" \
+  DAYTONA_SNAPSHOT="${DAYTONA_SNAPSHOT:-}" \
+  docker compose -p "$PROJECT" -f "$COMPOSE_FILE" up -d --build --wait; then
+  echo "Den Docker stack failed to start. Recent logs:" >&2
+  docker compose -p "$PROJECT" -f "$COMPOSE_FILE" logs --tail=200 >&2 || true
+  exit 1
+fi
+
+OTP_LOG_PID=""
+start_otp_log_watch
+
+if [ -n "$OTP_LOG_PID" ]; then
+  printf 'OTP_LOG_PID=%s\n' "$OTP_LOG_PID" >> "$RUNTIME_FILE"
+fi
+
+echo "" >&2
+echo "OpenWork Cloud web UI:  http://localhost:$DEN_WEB_PORT" >&2
+echo "OpenWork Cloud web UI (LAN/public): http://$PUBLIC_HOST:$DEN_WEB_PORT" >&2
+if [ -n "$LAN_IPV4" ]; then
+  echo "OpenWork Cloud web UI (LAN IP):     http://$LAN_IPV4:$DEN_WEB_PORT" >&2
+fi
+if [ -n "$TAILSCALE_DNS_NAME" ]; then
+  echo "OpenWork Cloud web UI (Tailscale):  http://$TAILSCALE_DNS_NAME:$DEN_WEB_PORT" >&2
+fi
+echo "Den demo/API:          http://localhost:$DEN_API_PORT" >&2
+echo "Den demo/API (LAN/public):         http://$PUBLIC_HOST:$DEN_API_PORT" >&2
+if [ -n "$LAN_IPV4" ]; then
+  echo "Den demo/API (LAN IP):             http://$LAN_IPV4:$DEN_API_PORT" >&2
+fi
+if [ -n "$TAILSCALE_DNS_NAME" ]; then
+  echo "Den demo/API (Tailscale):          http://$TAILSCALE_DNS_NAME:$DEN_API_PORT" >&2
+fi
+echo "Worker proxy:          http://localhost:$DEN_WORKER_PROXY_PORT" >&2
+echo "Worker proxy (LAN/public):         http://$PUBLIC_HOST:$DEN_WORKER_PROXY_PORT" >&2
+if [ -n "$LAN_IPV4" ]; then
+  echo "Worker proxy (LAN IP):             http://$LAN_IPV4:$DEN_WORKER_PROXY_PORT" >&2
+fi
+if [ -n "$TAILSCALE_DNS_NAME" ]; then
+  echo "Worker proxy (Tailscale):          http://$TAILSCALE_DNS_NAME:$DEN_WORKER_PROXY_PORT" >&2
+fi
+echo "MySQL:                 mysql://root:password@127.0.0.1:$DEN_MYSQL_PORT/openwork_den" >&2
+echo "Health check:          http://localhost:$DEN_API_PORT/health" >&2
+echo "Runtime env file:      $RUNTIME_FILE" >&2
+if [ -n "$OTP_LOG_PID" ]; then
+  echo "OTP watch:             active in this terminal (PID $OTP_LOG_PID)" >&2
+  echo "Stop OTP watch only:   kill $OTP_LOG_PID" >&2
+  echo "                        export DEN_WATCH_OTP_CODES=0 to disable" >&2
+fi
+echo "" >&2
+echo "To stop this stack (keep DB data):" >&2
+echo "  docker compose -p $PROJECT -f $COMPOSE_FILE down" >&2
+echo "To stop and reset the DB:" >&2
+echo "  docker compose -p $PROJECT -f $COMPOSE_FILE down -v" >&2
diff --git a/packaging/docker/docker-compose.den-dev.yml b/packaging/docker/docker-compose.den-dev.yml
new file mode 100644
index 0000000000..9b0b89caeb
--- /dev/null
+++ b/packaging/docker/docker-compose.den-dev.yml
@@ -0,0 +1,150 @@
+# docker-compose.den-dev.yml — Den local testability stack
+#
+# Usage (from repo root):
+#   docker compose -f packaging/docker/docker-compose.den-dev.yml up
+#
+# Then open the printed web UI or Den demo URL.
+#
+# Env overrides (optional, via export or .env):
+#   DEN_API_PORT            — host port to map to Den control plane :8788
+#   DEN_WEB_PORT            — host port to map to the cloud web app :3005
+#   DEN_WORKER_PROXY_PORT   — host port to map to the worker proxy :8789
+#   DEN_MYSQL_PORT          — host port to map to MySQL :3306
+#   DEN_BETTER_AUTH_SECRET  — Better Auth secret (auto-generated by den-dev-up.sh)
+#   DEN_DB_ENCRYPTION_KEY   — dev-only DB encryption key for encrypted columns
+#                           — defaults to a premade local key for Docker smoke tests
+#                           — generate a replacement with: openssl rand -base64 128
+#   DEN_PUBLIC_HOST         — browser-facing host/IP for LAN access (set by den-dev-up.sh)
+#   DEN_BETTER_AUTH_URL     — browser-facing auth origin (default: http://<DEN_PUBLIC_HOST>:<DEN_WEB_PORT>)
+#   DEN_BETTER_AUTH_TRUSTED_ORIGINS — Better Auth trusted origins (defaults to DEN_CORS_ORIGINS)
+#   DEN_CORS_ORIGINS        — comma-separated trusted origins for Better Auth + CORS
+#   DEN_PROVISIONER_MODE    — stub, render, or daytona (default: stub)
+#   DEN_WORKER_URL_TEMPLATE — worker URL template used by stub provisioning
+#   DAYTONA_API_URL / DAYTONA_API_KEY / DAYTONA_TARGET / DAYTONA_SNAPSHOT
+#                           — optional Daytona passthrough vars when DEN_PROVISIONER_MODE=daytona
+#   POLAR_FEATURE_GATE_ENABLED / POLAR_API_BASE / POLAR_ACCESS_TOKEN
+#   POLAR_PRODUCT_ID / POLAR_BENEFIT_ID / POLAR_SUCCESS_URL / POLAR_RETURN_URL
+#                           — optional Polar passthrough vars for billing/paywall testing
+
+x-shared: &shared
+  restart: unless-stopped
+
+services:
+  mysql:
+    image: mysql:8.4
+    command:
+      - --performance_schema=OFF
+      - --innodb-buffer-pool-size=64M
+      - --innodb-log-buffer-size=8M
+      - --tmp-table-size=16M
+      - --max-heap-table-size=16M
+    environment:
+      MYSQL_ROOT_PASSWORD: password
+      MYSQL_DATABASE: openwork_den
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -ppassword --silent"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 10s
+    ports:
+      - "${DEN_MYSQL_PORT:-3306}:3306"
+    volumes:
+      - den-mysql-data:/var/lib/mysql
+
+  den:
+    <<: *shared
+    build:
+      context: ../../
+      dockerfile: packaging/docker/Dockerfile.den
+    depends_on:
+      mysql:
+        condition: service_healthy
+    ports:
+      - "${DEN_API_PORT:-8788}:8788"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8788/health').then((res)=>process.exit(res.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 120s
+    environment:
+      CI: "true"
+      OPENWORK_DEV_MODE: ${OPENWORK_DEV_MODE:-1}
+      DATABASE_URL: mysql://root:password@mysql:3306/openwork_den
+      BETTER_AUTH_SECRET: ${DEN_BETTER_AUTH_SECRET:-dev-den-local-auth-secret-please-override-1234567890}
+      DEN_DB_ENCRYPTION_KEY: ${DEN_DB_ENCRYPTION_KEY:-dev-den-db-encryption-key-please-change-1234567890}
+      BETTER_AUTH_URL: ${DEN_BETTER_AUTH_URL:-http://localhost:3005}
+      DEN_MCP_RESOURCE_URL: ${DEN_MCP_RESOURCE_URL:-http://localhost:8788/mcp}
+      DEN_BETTER_AUTH_TRUSTED_ORIGINS: ${DEN_BETTER_AUTH_TRUSTED_ORIGINS:-}
+      PORT: "8788"
+      CORS_ORIGINS: ${DEN_CORS_ORIGINS:-http://localhost:3005,http://127.0.0.1:3005,http://0.0.0.0:3005,http://localhost:5173,http://127.0.0.1:5173,http://localhost:8788,http://127.0.0.1:8788}
+      PROVISIONER_MODE: ${DEN_PROVISIONER_MODE:-stub}
+      WORKER_URL_TEMPLATE: ${DEN_WORKER_URL_TEMPLATE:-}
+      POLAR_FEATURE_GATE_ENABLED: ${POLAR_FEATURE_GATE_ENABLED:-false}
+      POLAR_API_BASE: ${POLAR_API_BASE:-}
+      POLAR_ACCESS_TOKEN: ${POLAR_ACCESS_TOKEN:-}
+      POLAR_PRODUCT_ID: ${POLAR_PRODUCT_ID:-}
+      POLAR_BENEFIT_ID: ${POLAR_BENEFIT_ID:-}
+      POLAR_SUCCESS_URL: ${POLAR_SUCCESS_URL:-}
+      POLAR_RETURN_URL: ${POLAR_RETURN_URL:-}
+      DAYTONA_API_URL: ${DAYTONA_API_URL:-}
+      DAYTONA_API_KEY: ${DAYTONA_API_KEY:-}
+      DAYTONA_TARGET: ${DAYTONA_TARGET:-}
+      DAYTONA_SNAPSHOT: ${DAYTONA_SNAPSHOT:-}
+      DAYTONA_WORKER_PROXY_BASE_URL: ${DEN_DAYTONA_WORKER_PROXY_BASE_URL:-http://localhost:8789}
+
+  worker-proxy:
+    <<: *shared
+    build:
+      context: ../../
+      dockerfile: packaging/docker/Dockerfile.den-worker-proxy
+    depends_on:
+      mysql:
+        condition: service_healthy
+    ports:
+      - "${DEN_WORKER_PROXY_PORT:-8789}:8789"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8789/unknown').then((res)=>process.exit([404,502].includes(res.status)?0:1)).catch(()=>process.exit(1))"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 90s
+    environment:
+      CI: "true"
+      DATABASE_URL: mysql://root:password@mysql:3306/openwork_den
+      PORT: "8789"
+      OPENWORK_DAYTONA_ENV_PATH: ${OPENWORK_DAYTONA_ENV_PATH:-}
+      DAYTONA_API_URL: ${DAYTONA_API_URL:-}
+      DAYTONA_API_KEY: ${DAYTONA_API_KEY:-}
+      DAYTONA_TARGET: ${DAYTONA_TARGET:-}
+      DAYTONA_OPENWORK_PORT: ${DAYTONA_OPENWORK_PORT:-8787}
+      DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS: ${DAYTONA_SIGNED_PREVIEW_EXPIRES_SECONDS:-86400}
+
+  web:
+    <<: *shared
+    build:
+      context: ../../
+      dockerfile: packaging/docker/Dockerfile.den-web
+    command: ["sh", "-lc", "npm run build && npm run start"]
+    depends_on:
+      den:
+        condition: service_healthy
+    ports:
+      - "${DEN_WEB_PORT:-3005}:3005"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3005/api/den/health').then((res)=>process.exit(res.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 5s
+      timeout: 10s
+      retries: 30
+      start_period: 180s
+    environment:
+      CI: "true"
+      OPENWORK_DEV_MODE: "1"
+      DEN_API_BASE: http://den:8788
+      DEN_AUTH_FALLBACK_BASE: http://den:8788
+      DEN_AUTH_ORIGIN: ${DEN_BETTER_AUTH_URL:-http://localhost:3005}
+      NEXT_PUBLIC_OPENWORK_AUTH_CALLBACK_URL: ${DEN_BETTER_AUTH_URL:-http://localhost:3005}
+
+volumes:
+  den-mysql-data:
diff --git a/packaging/docker/docker-compose.dev.yml b/packaging/docker/docker-compose.dev.yml
new file mode 100644
index 0000000000..c3574a6397
--- /dev/null
+++ b/packaging/docker/docker-compose.dev.yml
@@ -0,0 +1,228 @@
+# docker-compose.dev.yml — Dev testability stack (no custom Dockerfile)
+#
+# Usage (from repo root):
+#   docker compose -f packaging/docker/docker-compose.dev.yml up
+#
+# Then open the printed Web UI URL — already wired to headless, no config needed.
+#
+# Env overrides (optional, via .env or export):
+#   OPENWORK_TOKEN        — shared client token (auto-generated if unset)
+#   OPENWORK_HOST_TOKEN   — host/admin token (auto-generated if unset)
+#   OPENWORK_WORKSPACE    — host path to mount as workspace (default: ./workspace)
+#   OPENWORK_PORT         — host port to map to container :8787 (default: 8787)
+#   WEB_PORT              — host port to map to container :5173 (default: 5173)
+#   SHARE_PORT            — host port to map to the share service :3000 (default: 3006)
+#   OPENWORK_DEV_ID       — unique ID for this stack (default: default)
+#   OPENWORK_DEV_MODE     — enables isolated OpenCode dev state
+#   OPENWORK_PUBLIC_HOST  — browser-facing host/IP for LAN-accessible URLs
+#   OPENWORK_DOCKER_DEV_MOUNT_HOST_OPENCODE=1 — import host OpenCode config/auth into the isolated dev state
+#   OPENWORK_OPENCODE_CONFIG_DIR      — host OpenCode config dir detection override
+#   OPENWORK_OPENCODE_DATA_DIR        — host OpenCode data dir detection override
+#   OPENWORK_HOST_OPENCODE_CONFIG_DIR — import source for OpenCode config
+#   OPENWORK_HOST_OPENCODE_DATA_DIR   — import source for OpenCode auth/data
+
+x-shared: &shared
+  image: node:22-bookworm-slim
+  working_dir: /app
+  volumes:
+    # Mount the entire repo so both services share node_modules + source
+    - ../../:/app
+    - pnpm-store:/root/.local/share/pnpm/store
+    - bun-install:/root/.bun
+    - ${OPENWORK_WORKSPACE:-./workspace}:/workspace
+    - ${OPENWORK_HOST_OPENCODE_CONFIG_DIR:-./workspace/.openwork-host-opencode-config}:/persist/.config/opencode:ro
+    - ${OPENWORK_HOST_OPENCODE_DATA_DIR:-./workspace/.openwork-host-opencode-data}:/persist/.openwork-host-opencode-data:ro
+
+services:
+  orchestrator:
+    <<: *shared
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -e
+
+        # --- Ensure workspace dir is writable ---
+        mkdir -p /workspace && touch /workspace/.keep 2>/dev/null || true
+
+        # --- Install system deps ---
+        apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+          curl ca-certificates unzip git >/dev/null 2>&1
+
+        # --- Install bun (cached in named volume) ---
+        export BUN_INSTALL="/root/.bun"
+        export PATH="$$BUN_INSTALL/bin:$$PATH"
+        if ! command -v bun >/dev/null 2>&1; then
+          echo "[orchestrator] Installing bun..."
+          curl -fsSL https://bun.sh/install | bash
+        fi
+
+        # --- Enable pnpm via corepack ---
+        corepack enable && corepack prepare pnpm@10.27.0 --activate
+
+        # --- Install deps ---
+        echo "[orchestrator] Installing dependencies..."
+        pnpm install --no-frozen-lockfile --network-concurrency 1 --child-concurrency 1
+
+        # --- Use source entrypoints for the dev stack ---
+        # The orchestrator can spawn .ts files via Bun directly, which avoids bind-mount
+        # issues from bun --compile inside Docker on macOS.
+        export OPENWORK_SERVER_BIN="/app/apps/server/src/cli.ts"
+        export OPENCODE_ROUTER_BIN="/app/apps/opencode-router/src/cli.ts"
+
+        # --- Resolve tokens ---
+        if [ -z "$$OPENWORK_TOKEN" ]; then
+          OPENWORK_TOKEN=$$(cat /proc/sys/kernel/random/uuid)
+          export OPENWORK_TOKEN
+        fi
+        if [ -z "$$OPENWORK_HOST_TOKEN" ]; then
+          OPENWORK_HOST_TOKEN=$$(cat /proc/sys/kernel/random/uuid)
+          export OPENWORK_HOST_TOKEN
+        fi
+
+        # Write tokens so the web service can source them
+        mkdir -p /app/tmp
+        printf 'OPENWORK_TOKEN=%s\nOPENWORK_HOST_TOKEN=%s\n' \
+          "$$OPENWORK_TOKEN" "$$OPENWORK_HOST_TOKEN" > "/app/tmp/.dev-env-${OPENWORK_DEV_ID:-default}"
+
+        echo ""
+        echo "============================================"
+        echo "  OpenWork orchestrator"
+        echo "  Server:     http://localhost:${OPENWORK_PORT:-8787}"
+        echo "  Health:     http://localhost:${OPENWORK_PORT:-8787}/health"
+        echo "  Token:      $$OPENWORK_TOKEN"
+        echo "  Host token: $$OPENWORK_HOST_TOKEN"
+        echo "============================================"
+        echo ""
+
+        exec pnpm --filter openwork-orchestrator dev -- start \
+          --workspace /workspace \
+          --remote-access \
+          --openwork-port 8787 \
+          --openwork-token "$$OPENWORK_TOKEN" \
+          --openwork-host-token "$$OPENWORK_HOST_TOKEN" \
+          --openwork-server-bin "$$OPENWORK_SERVER_BIN" \
+          --opencode-router-bin "$$OPENCODE_ROUTER_BIN" \
+          --approval auto \
+          --allow-external \
+          --cors "*"
+    ports:
+      - "${OPENWORK_PORT:-8787}:8787"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8787/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 90s
+    environment:
+      CI: "true"
+      OPENWORK_TOKEN: ${OPENWORK_TOKEN:-}
+      OPENWORK_HOST_TOKEN: ${OPENWORK_HOST_TOKEN:-}
+      OPENWORK_DEV_ID: ${OPENWORK_DEV_ID:-default}
+      OPENWORK_DEV_MODE: ${OPENWORK_DEV_MODE:-1}
+      OPENWORK_PUBLISHER_BASE_URL: http://${OPENWORK_PUBLIC_HOST:-localhost}:${SHARE_PORT:-3006}
+      OPENWORK_DEV_OPENCODE_IMPORT_CONFIG_DIR: /persist/.config/opencode
+      OPENWORK_DEV_OPENCODE_IMPORT_DATA_DIR: /persist/.openwork-host-opencode-data
+      OPENWORK_SIDECAR_SOURCE: external
+ 
+  web:
+    <<: *shared
+    depends_on:
+      orchestrator:
+        condition: service_healthy
+      share:
+        condition: service_healthy
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -e
+
+        # --- Install system deps ---
+        apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+          curl ca-certificates >/dev/null 2>&1
+
+        # --- Bun + pnpm ---
+        export BUN_INSTALL="/root/.bun"
+        export PATH="$$BUN_INSTALL/bin:$$PATH"
+        if ! command -v bun >/dev/null 2>&1; then
+          curl -fsSL https://bun.sh/install | bash
+        fi
+        corepack enable && corepack prepare pnpm@10.27.0 --activate
+
+        # --- Read token written by orchestrator ---
+        if [ -f "/app/tmp/.dev-env-${OPENWORK_DEV_ID:-default}" ]; then
+          . "/app/tmp/.dev-env-${OPENWORK_DEV_ID:-default}"
+          export VITE_OPENWORK_TOKEN="$$OPENWORK_TOKEN"
+        fi
+
+        echo ""
+        echo "============================================"
+        echo "  OpenWork web UI"
+        echo "  URL:   http://localhost:${WEB_PORT:-5173}"
+        echo "  Token: $${VITE_OPENWORK_TOKEN:-<see orchestrator logs>}"
+        echo "============================================"
+        echo ""
+
+        export VITE_OPENWORK_URL="http://${OPENWORK_PUBLIC_HOST:-localhost}:${OPENWORK_PORT:-8787}"
+        export VITE_OPENWORK_PORT="${OPENWORK_PORT:-8787}"
+        export VITE_OPENWORK_PUBLISHER_BASE_URL="http://${OPENWORK_PUBLIC_HOST:-localhost}:${SHARE_PORT:-3006}"
+        export VITE_ALLOWED_HOSTS="all"
+        export HOST="0.0.0.0"
+        export PORT="5173"
+
+        exec pnpm --filter @openwork/app exec vite \
+          --host 0.0.0.0 \
+          --port 5173 \
+          --strictPort
+    ports:
+      - "${WEB_PORT:-5173}:5173"
+    environment:
+      OPENWORK_DEV_ID: ${OPENWORK_DEV_ID:-default}
+
+  share:
+    <<: *shared
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -e
+
+        apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+          curl ca-certificates >/dev/null 2>&1
+
+        corepack enable && corepack prepare pnpm@10.27.0 --activate
+
+        echo "[share] Installing dependencies..."
+        pnpm install --no-frozen-lockfile --network-concurrency 1 --child-concurrency 1
+
+        mkdir -p /app/tmp/share-service-blobs
+
+        echo "[share] Building Next app..."
+        pnpm --dir apps/share build
+
+        echo ""
+        echo "============================================"
+        echo "  OpenWork share service"
+        echo "  URL: http://localhost:${SHARE_PORT:-3006}"
+        echo "============================================"
+        echo ""
+
+        exec pnpm --dir apps/share exec next start --hostname 0.0.0.0 --port 3000
+    ports:
+      - "${SHARE_PORT:-3006}:3000"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:3000/api/health || exit 1"]
+      interval: 5s
+      timeout: 10s
+      retries: 30
+      start_period: 180s
+    environment:
+      CI: "true"
+      OPENWORK_DEV_MODE: ${OPENWORK_DEV_MODE:-1}
+      LOCAL_BLOB_DIR: /app/tmp/share-service-blobs
+      PUBLIC_BASE_URL: http://${OPENWORK_PUBLIC_HOST:-localhost}:${SHARE_PORT:-3006}
+      PUBLIC_OPENWORK_APP_URL: http://${OPENWORK_PUBLIC_HOST:-localhost}:${WEB_PORT:-5173}
+
+volumes:
+  pnpm-store:
+    name: openwork-dev-pnpm-store
+  bun-install:
+    name: openwork-dev-bun-install
diff --git a/packaging/docker/docker-compose.web-local.yml b/packaging/docker/docker-compose.web-local.yml
new file mode 100644
index 0000000000..f6b7560d84
--- /dev/null
+++ b/packaging/docker/docker-compose.web-local.yml
@@ -0,0 +1,20 @@
+services:
+  mysql:
+    image: mysql:8.4
+    container_name: openwork-web-local-mysql
+    ports:
+      - "3306:3306"
+    environment:
+      MYSQL_ROOT_PASSWORD: password
+      MYSQL_DATABASE: openwork_den
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -ppassword --silent"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 10s
+    volumes:
+      - openwork-web-local-mysql-data:/var/lib/mysql
+
+volumes:
+  openwork-web-local-mysql-data:
diff --git a/packaging/docker/docker-compose.yml b/packaging/docker/docker-compose.yml
new file mode 100644
index 0000000000..5e50de5fc2
--- /dev/null
+++ b/packaging/docker/docker-compose.yml
@@ -0,0 +1,23 @@
+services:
+  openwork-host:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        # Keep this in sync with apps/orchestrator/package.json if you want a pinned release.
+        OPENWORK_ORCHESTRATOR_VERSION: 0.11.22
+    ports:
+      - "8787:8787"
+    environment:
+      # Set these explicitly for stable sharing.
+      # OPENWORK_TOKEN: "..."
+      # OPENWORK_HOST_TOKEN: "..."
+      # Optional: OPENWORK_APPROVAL_MODE: "auto"
+      # Optional: OPENWORK_APPROVAL_TIMEOUT_MS: "30000"
+      OPENWORK_DATA_DIR: /data/openwork-orchestrator
+      OPENWORK_SIDECAR_DIR: /data/sidecars
+    volumes:
+      # Mount an existing project/workspace here.
+      - ./workspace:/workspace
+      # Persistent host data (OpenCode caches, server config, tokens).
+      - ./data:/data
diff --git a/packaging/docker/microsandbox-entrypoint.sh b/packaging/docker/microsandbox-entrypoint.sh
new file mode 100755
index 0000000000..40045d37a0
--- /dev/null
+++ b/packaging/docker/microsandbox-entrypoint.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env sh
+set -eu
+
+OPENWORK_WORKSPACE="${OPENWORK_WORKSPACE:-/workspace}"
+OPENWORK_DATA_DIR="${OPENWORK_DATA_DIR:-/data/openwork-orchestrator}"
+OPENWORK_SIDECAR_DIR="${OPENWORK_SIDECAR_DIR:-/data/sidecars}"
+OPENWORK_PORT="${OPENWORK_PORT:-8787}"
+OPENWORK_OPENCODE_PORT="${OPENWORK_OPENCODE_PORT:-4096}"
+OPENWORK_TOKEN="${OPENWORK_TOKEN:-microsandbox-token}"
+OPENWORK_HOST_TOKEN="${OPENWORK_HOST_TOKEN:-microsandbox-host-token}"
+OPENWORK_APPROVAL_MODE="${OPENWORK_APPROVAL_MODE:-auto}"
+OPENWORK_CORS_ORIGINS="${OPENWORK_CORS_ORIGINS:-*}"
+OPENWORK_CONNECT_HOST="${OPENWORK_CONNECT_HOST:-127.0.0.1}"
+HOME="${HOME:-/root}"
+USER="${USER:-root}"
+SHELL="${SHELL:-/bin/sh}"
+XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
+XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
+XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
+XDG_STATE_HOME="${XDG_STATE_HOME:-$HOME/.local/state}"
+
+if [ "$HOME" = "/" ]; then
+  HOME=/root
+  XDG_CONFIG_HOME="$HOME/.config"
+  XDG_CACHE_HOME="$HOME/.cache"
+  XDG_DATA_HOME="$HOME/.local/share"
+  XDG_STATE_HOME="$HOME/.local/state"
+fi
+
+export HOME USER SHELL XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME
+
+mkdir -p "$OPENWORK_WORKSPACE" "$OPENWORK_DATA_DIR" "$OPENWORK_SIDECAR_DIR"
+mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME"
+
+printf '%s\n' "Starting OpenWork micro-sandbox"
+printf '%s\n' "- workspace: $OPENWORK_WORKSPACE"
+printf '%s\n' "- home: $HOME"
+printf '%s\n' "- openwork url: http://$OPENWORK_CONNECT_HOST:$OPENWORK_PORT"
+printf '%s\n' "- client token: $OPENWORK_TOKEN"
+printf '%s\n' "- host token: $OPENWORK_HOST_TOKEN"
+printf '%s\n' "- health: curl http://$OPENWORK_CONNECT_HOST:$OPENWORK_PORT/health"
+printf '%s\n' "- auth test: curl -H \"Authorization: Bearer $OPENWORK_TOKEN\" http://$OPENWORK_CONNECT_HOST:$OPENWORK_PORT/workspaces"
+
+exec openwork serve \
+  --workspace "$OPENWORK_WORKSPACE" \
+  --remote-access \
+  --openwork-port "$OPENWORK_PORT" \
+  --opencode-host 127.0.0.1 \
+  --opencode-port "$OPENWORK_OPENCODE_PORT" \
+  --openwork-token "$OPENWORK_TOKEN" \
+  --openwork-host-token "$OPENWORK_HOST_TOKEN" \
+  --approval "$OPENWORK_APPROVAL_MODE" \
+  --cors "$OPENWORK_CORS_ORIGINS" \
+  --connect-host "$OPENWORK_CONNECT_HOST" \
+  --allow-external \
+  --sidecar-source external \
+  --opencode-source external \
+  --openwork-server-bin /usr/local/bin/openwork-server \
+  --opencode-bin /usr/local/bin/opencode \
+  --no-opencode-router
diff --git a/patches/@solidjs__router@0.15.4.patch b/patches/@solidjs__router@0.15.4.patch
new file mode 100644
index 0000000000..5093ec3f59
--- /dev/null
+++ b/patches/@solidjs__router@0.15.4.patch
@@ -0,0 +1,20 @@
+diff --git a/dist/index.d.ts b/dist/index.d.ts
+index 2acf9f2213ac91f71bf844c53bf63be28ce7d79d..49eac35140e3e004963ad5f9b2ffe315a740339f 100644
+--- a/dist/index.d.ts
++++ b/dist/index.d.ts
+@@ -1,4 +1,5 @@
+ export * from "./routers/index.js";
++export * from "./routers/index.js";
+ export * from "./components.jsx";
+ export * from "./lifecycle.js";
+ export { useHref, useIsRouting, useLocation, useMatch, useCurrentMatches, useNavigate, useParams, useResolvedPath, useSearchParams, useBeforeLeave, usePreloadRoute } from "./routing.js";
+diff --git a/dist/index.jsx b/dist/index.jsx
+index c9079ba9cf5244de3c4a3fe938d33c67ab13fc00..305f052987ae0b2aec0edb163fec6d0dcf663581 100644
+--- a/dist/index.jsx
++++ b/dist/index.jsx
+@@ -1,4 +1,5 @@
+ export * from "./routers/index.js";
++export * from "./routers/index.js";
+ export * from "./components.jsx";
+ export * from "./lifecycle.js";
+ export { useHref, useIsRouting, useLocation, useMatch, useCurrentMatches, useNavigate, useParams, useResolvedPath, useSearchParams, useBeforeLeave, usePreloadRoute } from "./routing.js";
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
new file mode 100644
index 0000000000..632ede94a1
--- /dev/null
+++ b/pnpm-lock.yaml
@@ -0,0 +1,16741 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+patchedDependencies:
+  '@solidjs/router@0.15.4':
+    hash: 1db11a7c28fe4da76187d42efaffc6b9a70ad370462fffb794ff90e67744d770
+    path: patches/@solidjs__router@0.15.4.patch
+
+importers:
+
+  .:
+    devDependencies:
+      turbo:
+        specifier: ^2.5.5
+        version: 2.8.20
+
+  apps/app:
+    dependencies:
+      '@ai-sdk/react':
+        specifier: ^3.0.148
+        version: 3.0.148(react@19.2.4)(zod@4.3.6)
+      '@base-ui/react':
+        specifier: ^1.4.1
+        version: 1.4.1(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@codemirror/commands':
+        specifier: ^6.8.0
+        version: 6.10.2
+      '@codemirror/lang-markdown':
+        specifier: ^6.3.3
+        version: 6.5.0
+      '@codemirror/language':
+        specifier: ^6.11.0
+        version: 6.12.1
+      '@codemirror/state':
+        specifier: ^6.5.2
+        version: 6.5.4
+      '@codemirror/view':
+        specifier: ^6.38.0
+        version: 6.39.14
+      '@fontsource-variable/geist':
+        specifier: ^5.2.8
+        version: 5.2.8
+      '@fontsource-variable/ibm-plex-sans':
+        specifier: ^5.2.8
+        version: 5.2.8
+      '@lexical/react':
+        specifier: ^0.35.0
+        version: 0.35.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.30)
+      '@opencode-ai/sdk':
+        specifier: ^1.4.9
+        version: 1.4.9
+      '@openwork/types':
+        specifier: workspace:*
+        version: link:../../packages/types
+      '@openwork/ui':
+        specifier: workspace:*
+        version: link:../../packages/ui
+      '@radix-ui/colors':
+        specifier: ^3.0.0
+        version: 3.0.0
+      '@tanstack/react-query':
+        specifier: ^5.90.3
+        version: 5.96.2(react@19.2.4)
+      '@tanstack/react-virtual':
+        specifier: ^3.13.23
+        version: 3.13.23(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@tauri-apps/api':
+        specifier: ^2.0.0
+        version: 2.10.1
+      '@tauri-apps/plugin-deep-link':
+        specifier: ^2.4.7
+        version: 2.4.7
+      '@tauri-apps/plugin-dialog':
+        specifier: ~2.6.0
+        version: 2.6.0
+      '@tauri-apps/plugin-http':
+        specifier: ~2.5.6
+        version: 2.5.6
+      '@tauri-apps/plugin-opener':
+        specifier: ^2.5.3
+        version: 2.5.3
+      '@tauri-apps/plugin-process':
+        specifier: ~2.3.1
+        version: 2.3.1
+      '@tauri-apps/plugin-updater':
+        specifier: ~2.9.0
+        version: 2.9.0
+      ai:
+        specifier: ^6.0.146
+        version: 6.0.146(zod@4.3.6)
+      class-variance-authority:
+        specifier: ^0.7.1
+        version: 0.7.1
+      clsx:
+        specifier: ^2.1.1
+        version: 2.1.1
+      fuzzysort:
+        specifier: ^3.1.0
+        version: 3.1.0
+      jsonc-parser:
+        specifier: ^3.2.1
+        version: 3.3.1
+      lexical:
+        specifier: ^0.35.0
+        version: 0.35.0
+      lucide-react:
+        specifier: ^0.577.0
+        version: 0.577.0(react@19.2.4)
+      marked:
+        specifier: ^17.0.1
+        version: 17.0.1
+      react:
+        specifier: ^19.1.1
+        version: 19.2.4
+      react-dom:
+        specifier: ^19.1.1
+        version: 19.2.4(react@19.2.4)
+      react-markdown:
+        specifier: ^10.1.0
+        version: 10.1.0(@types/react@19.2.14)(react@19.2.4)
+      react-router-dom:
+        specifier: ^7.14.1
+        version: 7.14.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      remark-gfm:
+        specifier: ^4.0.1
+        version: 4.0.1
+      shadcn:
+        specifier: ^4.6.0
+        version: 4.6.0(@types/node@25.6.0)(typescript@5.9.3)
+      streamdown:
+        specifier: ^2.5.0
+        version: 2.5.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      tailwind-merge:
+        specifier: ^3.5.0
+        version: 3.5.0
+      tw-animate-css:
+        specifier: ^1.4.0
+        version: 1.4.0
+      zustand:
+        specifier: ^5.0.12
+        version: 5.0.12(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4))
+    devDependencies:
+      '@tailwindcss/vite':
+        specifier: ^4.1.18
+        version: 4.1.18(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+      '@types/node':
+        specifier: ^25.6.0
+        version: 25.6.0
+      '@types/react':
+        specifier: ^19.2.2
+        version: 19.2.14
+      '@types/react-dom':
+        specifier: ^19.2.2
+        version: 19.2.3(@types/react@19.2.14)
+      '@vitejs/plugin-react':
+        specifier: ^5.0.4
+        version: 5.2.0(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+      tailwindcss:
+        specifier: ^4.1.18
+        version: 4.1.18
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+      vite:
+        specifier: ^6.0.1
+        version: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+
+  apps/desktop:
+    dependencies:
+      electron-updater:
+        specifier: ^6.3.9
+        version: 6.8.3
+    devDependencies:
+      '@tauri-apps/cli':
+        specifier: ^2.0.0
+        version: 2.9.6
+      electron:
+        specifier: ^35.0.0
+        version: 35.7.5
+      electron-builder:
+        specifier: ^25.1.8
+        version: 25.1.8(electron-builder-squirrel-windows@25.1.8)
+      electron-devtools-installer:
+        specifier: ^4.0.0
+        version: 4.0.0
+
+  apps/opencode-router:
+    dependencies:
+      '@opencode-ai/sdk':
+        specifier: ^1.4.9
+        version: 1.4.9
+      '@slack/socket-mode':
+        specifier: ^2.0.5
+        version: 2.0.5
+      '@slack/web-api':
+        specifier: ^7.13.0
+        version: 7.13.0
+      commander:
+        specifier: ^12.1.0
+        version: 12.1.0
+      dotenv:
+        specifier: ^16.4.7
+        version: 16.6.1
+      grammy:
+        specifier: ^1.39.3
+        version: 1.39.3(encoding@0.1.13)
+      pino:
+        specifier: ^9.6.0
+        version: 9.14.0
+    devDependencies:
+      '@types/node':
+        specifier: ^22.10.2
+        version: 22.19.7
+      bun-types:
+        specifier: ^1.3.6
+        version: 1.3.6
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  apps/orchestrator:
+    dependencies:
+      '@opencode-ai/sdk':
+        specifier: ^1.4.9
+        version: 1.4.9
+      '@opentui/core':
+        specifier: 0.1.77
+        version: 0.1.77(stage-js@1.0.0-alpha.17)(typescript@5.9.3)(web-tree-sitter@0.25.10)
+      '@opentui/solid':
+        specifier: 0.1.77
+        version: 0.1.77(solid-js@1.9.9)(stage-js@1.0.0-alpha.17)(typescript@5.9.3)(web-tree-sitter@0.25.10)
+      opencode-router:
+        specifier: 0.13.3
+        version: link:../opencode-router
+      openwork-server:
+        specifier: 0.13.3
+        version: link:../server
+      solid-js:
+        specifier: 1.9.9
+        version: 1.9.9
+    devDependencies:
+      '@opentui/core-darwin-arm64':
+        specifier: 0.1.77
+        version: 0.1.77
+      '@opentui/core-darwin-x64':
+        specifier: 0.1.77
+        version: 0.1.77
+      '@opentui/core-linux-arm64':
+        specifier: 0.1.77
+        version: 0.1.77
+      '@opentui/core-linux-x64':
+        specifier: 0.1.77
+        version: 0.1.77
+      '@opentui/core-win32-x64':
+        specifier: 0.1.77
+        version: 0.1.77
+      '@types/node':
+        specifier: ^22.10.2
+        version: 22.19.7
+      bun-types:
+        specifier: ^1.3.6
+        version: 1.3.6
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  apps/server:
+    dependencies:
+      jsonc-parser:
+        specifier: ^3.2.1
+        version: 3.3.1
+      minimatch:
+        specifier: ^10.0.1
+        version: 10.1.1
+      yaml:
+        specifier: ^2.6.1
+        version: 2.8.2
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      '@types/minimatch':
+        specifier: ^5.1.2
+        version: 5.1.2
+      '@types/node':
+        specifier: ^22.10.2
+        version: 22.19.7
+      bun-types:
+        specifier: ^1.3.6
+        version: 1.3.6
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  apps/server-v2:
+    dependencies:
+      '@opencode-ai/sdk':
+        specifier: 1.4.9
+        version: 1.4.9
+      hono:
+        specifier: 4.12.12
+        version: 4.12.12
+      hono-openapi:
+        specifier: 1.3.0
+        version: 1.3.0(@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.12))(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6))(@types/json-schema@7.0.15)(hono@4.12.12)(openapi-types@12.1.3)
+      jsonc-parser:
+        specifier: ^3.3.1
+        version: 3.3.1
+      yaml:
+        specifier: ^2.8.1
+        version: 2.8.2
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      '@types/node':
+        specifier: ^22.10.2
+        version: 22.19.7
+      bun-types:
+        specifier: ^1.3.6
+        version: 1.3.6
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  apps/share:
+    dependencies:
+      '@vercel/blob':
+        specifier: ^0.27.0
+        version: 0.27.3
+      botid:
+        specifier: ^1.5.11
+        version: 1.5.11(next@16.1.6(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
+      jsonc-parser:
+        specifier: ^3.3.1
+        version: 3.3.1
+      next:
+        specifier: 16.1.6
+        version: 16.1.6(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react:
+        specifier: 19.2.4
+        version: 19.2.4
+      react-dom:
+        specifier: 19.2.4
+        version: 19.2.4(react@19.2.4)
+      sharp:
+        specifier: ^0.34.5
+        version: 0.34.5
+      ulid:
+        specifier: ^2.3.0
+        version: 2.4.0
+      yaml:
+        specifier: ^2.8.1
+        version: 2.8.2
+    devDependencies:
+      '@playwright/test':
+        specifier: ^1.51.1
+        version: 1.58.2
+      '@types/node':
+        specifier: ^25.4.0
+        version: 25.4.0
+      '@types/react':
+        specifier: 18.2.79
+        version: 18.2.79
+      '@types/react-dom':
+        specifier: 18.2.25
+        version: 18.2.25
+      typescript:
+        specifier: ^5.9.3
+        version: 5.9.3
+
+  apps/story-book:
+    dependencies:
+      '@codemirror/commands':
+        specifier: ^6.8.0
+        version: 6.10.2
+      '@codemirror/lang-markdown':
+        specifier: ^6.3.3
+        version: 6.5.0
+      '@codemirror/language':
+        specifier: ^6.11.0
+        version: 6.12.1
+      '@codemirror/state':
+        specifier: ^6.5.2
+        version: 6.5.4
+      '@codemirror/view':
+        specifier: ^6.38.0
+        version: 6.39.14
+      '@opencode-ai/sdk':
+        specifier: ^1.4.9
+        version: 1.4.9
+      '@radix-ui/colors':
+        specifier: ^3.0.0
+        version: 3.0.0
+      '@solid-primitives/event-bus':
+        specifier: ^1.1.2
+        version: 1.1.2(solid-js@1.9.9)
+      '@solid-primitives/storage':
+        specifier: ^4.3.3
+        version: 4.3.3(solid-js@1.9.9)
+      '@solidjs/router':
+        specifier: ^0.15.4
+        version: 0.15.4(patch_hash=1db11a7c28fe4da76187d42efaffc6b9a70ad370462fffb794ff90e67744d770)(solid-js@1.9.9)
+      '@tanstack/solid-virtual':
+        specifier: ^3.13.19
+        version: 3.13.19(solid-js@1.9.9)
+      fuzzysort:
+        specifier: ^3.1.0
+        version: 3.1.0
+      jsonc-parser:
+        specifier: ^3.2.1
+        version: 3.3.1
+      lucide-solid:
+        specifier: ^0.562.0
+        version: 0.562.0(solid-js@1.9.9)
+      marked:
+        specifier: ^17.0.1
+        version: 17.0.1
+      solid-js:
+        specifier: ^1.9.0
+        version: 1.9.9
+    devDependencies:
+      '@tailwindcss/vite':
+        specifier: ^4.1.18
+        version: 4.1.18(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+      tailwindcss:
+        specifier: ^4.1.18
+        version: 4.1.18
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+      vite:
+        specifier: ^6.0.1
+        version: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+      vite-plugin-solid:
+        specifier: ^2.11.0
+        version: 2.11.10(solid-js@1.9.9)(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+
+  apps/ui-demo:
+    dependencies:
+      '@openwork/ui':
+        specifier: workspace:*
+        version: link:../../packages/ui
+      react:
+        specifier: 19.2.4
+        version: 19.2.4
+      react-dom:
+        specifier: 19.2.4
+        version: 19.2.4(react@19.2.4)
+    devDependencies:
+      '@types/react':
+        specifier: 19.2.14
+        version: 19.2.14
+      '@types/react-dom':
+        specifier: 19.2.3
+        version: 19.2.3(@types/react@19.2.14)
+      '@vitejs/plugin-react':
+        specifier: ^5.0.4
+        version: 5.2.0(vite@7.3.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+      typescript:
+        specifier: ^5.9.3
+        version: 5.9.3
+      vite:
+        specifier: ^7.1.12
+        version: 7.3.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+
+  ee/apps/den-api:
+    dependencies:
+      '@better-auth/api-key':
+        specifier: ^1.5.6
+        version: 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(better-auth@1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10))
+      '@better-auth/oauth-provider':
+        specifier: ^1.5.6
+        version: 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(better-auth@1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10))(better-call@1.3.2(zod@4.3.6))
+      '@daytonaio/sdk':
+        specifier: ^0.150.0
+        version: 0.150.0(ws@8.19.0)
+      '@hono/mcp':
+        specifier: ^0.2.5
+        version: 0.2.5(@modelcontextprotocol/sdk@1.29.0(zod@4.3.6))(hono-rate-limiter@0.4.2(hono@4.12.8))(hono@4.12.8)(zod@4.3.6)
+      '@hono/node-server':
+        specifier: ^1.13.8
+        version: 1.19.11(hono@4.12.8)
+      '@hono/standard-validator':
+        specifier: ^0.2.2
+        version: 0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.8)
+      '@hono/swagger-ui':
+        specifier: ^0.6.1
+        version: 0.6.1(hono@4.12.8)
+      '@modelcontextprotocol/sdk':
+        specifier: ^1.29.0
+        version: 1.29.0(zod@4.3.6)
+      '@openwork-ee/den-db':
+        specifier: workspace:*
+        version: link:../../packages/den-db
+      '@openwork-ee/utils':
+        specifier: workspace:*
+        version: link:../../packages/utils
+      '@openwork/types':
+        specifier: workspace:*
+        version: link:../../../packages/types
+      '@standard-community/standard-json':
+        specifier: ^0.3.5
+        version: 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6)
+      '@standard-community/standard-openapi':
+        specifier: ^0.2.9
+        version: 0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6)
+      '@standard-schema/spec':
+        specifier: ^1.1.0
+        version: 1.1.0
+      better-auth:
+        specifier: ^1.5.6
+        version: 1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10)
+      better-call:
+        specifier: ^1.3.2
+        version: 1.3.2(zod@4.3.6)
+      dotenv:
+        specifier: ^16.4.5
+        version: 16.6.1
+      hono:
+        specifier: ^4.7.2
+        version: 4.12.8
+      hono-openapi:
+        specifier: ^1.3.0
+        version: 1.3.0(@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.8))(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6))(@types/json-schema@7.0.15)(hono@4.12.8)(openapi-types@12.1.3)
+      openapi-types:
+        specifier: ^12.1.3
+        version: 12.1.3
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      '@types/json-schema':
+        specifier: ^7.0.15
+        version: 7.0.15
+      '@types/node':
+        specifier: ^20.11.30
+        version: 20.12.12
+      tsx:
+        specifier: ^4.15.7
+        version: 4.21.0
+      typescript:
+        specifier: ^5.5.4
+        version: 5.9.3
+
+  ee/apps/den-web:
+    dependencies:
+      '@openwork-ee/utils':
+        specifier: workspace:*
+        version: link:../../packages/utils
+      '@openwork/types':
+        specifier: workspace:*
+        version: link:../../../packages/types
+      '@openwork/ui':
+        specifier: workspace:*
+        version: link:../../../packages/ui
+      '@paper-design/shaders-react':
+        specifier: 0.0.72
+        version: 0.0.72(@types/react@19.2.14)(react@19.2.4)
+      '@tanstack/react-query':
+        specifier: ^5.96.2
+        version: 5.96.2(react@19.2.4)
+      lucide-react:
+        specifier: ^0.577.0
+        version: 0.577.0(react@19.2.4)
+      next:
+        specifier: 16.2.1
+        version: 16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react:
+        specifier: 19.2.4
+        version: 19.2.4
+      react-dom:
+        specifier: 19.2.4
+        version: 19.2.4(react@19.2.4)
+    devDependencies:
+      '@types/node':
+        specifier: 20.12.12
+        version: 20.12.12
+      '@types/react':
+        specifier: 19.2.14
+        version: 19.2.14
+      '@types/react-dom':
+        specifier: 19.2.3
+        version: 19.2.3(@types/react@19.2.14)
+      autoprefixer:
+        specifier: 10.4.19
+        version: 10.4.19(postcss@8.4.38)
+      postcss:
+        specifier: 8.4.38
+        version: 8.4.38
+      tailwindcss:
+        specifier: 3.4.7
+        version: 3.4.7
+      typescript:
+        specifier: 5.4.5
+        version: 5.4.5
+
+  ee/apps/den-worker-proxy:
+    dependencies:
+      '@daytonaio/sdk':
+        specifier: ^0.150.0
+        version: 0.150.0(ws@8.19.0)
+      '@hono/node-server':
+        specifier: ^1.13.8
+        version: 1.19.11(hono@4.12.8)
+      '@openwork-ee/den-db':
+        specifier: workspace:*
+        version: link:../../packages/den-db
+      '@openwork-ee/utils':
+        specifier: workspace:*
+        version: link:../../packages/utils
+      dotenv:
+        specifier: ^16.4.5
+        version: 16.6.1
+      hono:
+        specifier: ^4.7.2
+        version: 4.12.8
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      '@types/node':
+        specifier: ^20.11.30
+        version: 20.12.12
+      tsx:
+        specifier: ^4.15.7
+        version: 4.21.0
+      typescript:
+        specifier: ^5.5.4
+        version: 5.9.3
+
+  ee/apps/landing:
+    dependencies:
+      '@openwork/ui':
+        specifier: workspace:*
+        version: link:../../../packages/ui
+      botid:
+        specifier: ^1.5.11
+        version: 1.5.11(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)
+      framer-motion:
+        specifier: ^12.35.1
+        version: 12.35.1(react-dom@18.2.0(react@18.2.0))(react@18.2.0)
+      lucide-react:
+        specifier: ^0.577.0
+        version: 0.577.0(react@18.2.0)
+      next:
+        specifier: 14.2.35
+        version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)
+      react:
+        specifier: 18.2.0
+        version: 18.2.0
+      react-dom:
+        specifier: 18.2.0
+        version: 18.2.0(react@18.2.0)
+    devDependencies:
+      '@types/node':
+        specifier: 20.12.12
+        version: 20.12.12
+      '@types/react':
+        specifier: 18.2.79
+        version: 18.2.79
+      '@types/react-dom':
+        specifier: 18.2.25
+        version: 18.2.25
+      autoprefixer:
+        specifier: 10.4.19
+        version: 10.4.19(postcss@8.4.38)
+      postcss:
+        specifier: 8.4.38
+        version: 8.4.38
+      tailwindcss:
+        specifier: 3.4.7
+        version: 3.4.7
+      typescript:
+        specifier: 5.4.5
+        version: 5.4.5
+
+  ee/packages/den-db:
+    dependencies:
+      '@openwork-ee/utils':
+        specifier: workspace:*
+        version: link:../utils
+      '@openwork/types':
+        specifier: workspace:*
+        version: link:../../../packages/types
+      '@planetscale/database':
+        specifier: ^1.19.0
+        version: 1.19.0
+      drizzle-orm:
+        specifier: ^0.45.1
+        version: 0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4)
+      mysql2:
+        specifier: ^3.11.3
+        version: 3.17.4
+    devDependencies:
+      '@types/node':
+        specifier: ^20.11.30
+        version: 20.12.12
+      drizzle-kit:
+        specifier: ^0.31.9
+        version: 0.31.9
+      tsup:
+        specifier: ^8.5.0
+        version: 8.5.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3)(yaml@2.8.2)
+      tsx:
+        specifier: ^4.21.0
+        version: 4.21.0
+      typescript:
+        specifier: ^5.5.4
+        version: 5.9.3
+
+  ee/packages/utils:
+    dependencies:
+      luxon:
+        specifier: ^3.6.1
+        version: 3.7.2
+      typeid-js:
+        specifier: ^1.2.0
+        version: 1.2.0
+      uuid:
+        specifier: ^11.1.0
+        version: 11.1.0
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      '@types/luxon':
+        specifier: ^3.6.2
+        version: 3.7.1
+      '@types/node':
+        specifier: ^20.11.30
+        version: 20.12.12
+      tsup:
+        specifier: ^8.5.0
+        version: 8.5.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3)(yaml@2.8.2)
+      typescript:
+        specifier: ^5.5.4
+        version: 5.9.3
+
+  packages/openwork-server-sdk:
+    dependencies:
+      '@hey-api/client-fetch':
+        specifier: 0.13.1
+        version: 0.13.1(@hey-api/openapi-ts@0.95.0(typescript@5.9.3))
+    devDependencies:
+      '@hey-api/openapi-ts':
+        specifier: 0.95.0
+        version: 0.95.0(typescript@5.9.3)
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  packages/openwork-ui-mcp:
+    dependencies:
+      '@modelcontextprotocol/sdk':
+        specifier: ^1.29.0
+        version: 1.29.0(zod@3.25.76)
+      zod:
+        specifier: ^3.25.76
+        version: 3.25.76
+
+  packages/types:
+    dependencies:
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
+    devDependencies:
+      tsup:
+        specifier: ^8.5.0
+        version: 8.5.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3)(yaml@2.8.2)
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+  packages/ui:
+    dependencies:
+      '@paper-design/shaders':
+        specifier: 0.0.72
+        version: 0.0.72
+      '@paper-design/shaders-react':
+        specifier: 0.0.72
+        version: 0.0.72(@types/react@19.2.14)(react@19.2.4)
+      react:
+        specifier: ^18 || ^19
+        version: 19.2.4
+      solid-js:
+        specifier: ^1.9.0
+        version: 1.9.9
+    devDependencies:
+      '@types/react':
+        specifier: ^19.2.14
+        version: 19.2.14
+      tsup:
+        specifier: ^8.5.0
+        version: 8.5.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3)(yaml@2.8.2)
+      typescript:
+        specifier: ^5.6.3
+        version: 5.9.3
+
+packages:
+
+  7zip-bin@5.2.0:
+    resolution: {integrity: sha512-ukTPVhqG4jNzMro2qA9HSCSSVJN3aN7tlb+hfqYCt3ER0yWroeA2VR38MNrOHLQ/cVj+DaIMad0kFCtWWowh/A==}
+
+  '@ai-sdk/gateway@3.0.88':
+    resolution: {integrity: sha512-AFoj7xdWAtCQcy0jJ235ENSakYM8D28qBX+rB+/rX4r8qe/LXgl0e5UivOqxAlIM5E9jnQdYxIPuj3XFtGk/yg==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider-utils@4.0.22':
+    resolution: {integrity: sha512-B2OTFcRw/Pdka9ZTjpXv6T6qZ6RruRuLokyb8HwW+aoW9ndJ3YasA3/mVswyJw7VMBF8ofXgqvcrCt9KYvFifg==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider@3.0.8':
+    resolution: {integrity: sha512-oGMAgGoQdBXbZqNG0Ze56CHjDZ1IDYOwGYxYjO5KLSlz5HiNQ9udIXsPZ61VWaHGZ5XW/jyjmr6t2xz2jGVwbQ==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/react@3.0.148':
+    resolution: {integrity: sha512-bxKtS3KINzjtEf9xrAhORRN0HIMgqlI1Nwhd0eaAXL3Eljf3XVl9Bw+HXiCLVNzyOcyOwwBLlvq8SZ0amys7eA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      react: ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1
+
+  '@alloc/quick-lru@5.2.0':
+    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
+    engines: {node: '>=10'}
+
+  '@ampproject/remapping@2.3.0':
+    resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
+    engines: {node: '>=6.0.0'}
+
+  '@antfu/install-pkg@1.1.0':
+    resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
+
+  '@aws-crypto/crc32@5.2.0':
+    resolution: {integrity: sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==}
+    engines: {node: '>=16.0.0'}
+
+  '@aws-crypto/crc32c@5.2.0':
+    resolution: {integrity: sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag==}
+
+  '@aws-crypto/sha1-browser@5.2.0':
+    resolution: {integrity: sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg==}
+
+  '@aws-crypto/sha256-browser@5.2.0':
+    resolution: {integrity: sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw==}
+
+  '@aws-crypto/sha256-js@5.2.0':
+    resolution: {integrity: sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==}
+    engines: {node: '>=16.0.0'}
+
+  '@aws-crypto/supports-web-crypto@5.2.0':
+    resolution: {integrity: sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg==}
+
+  '@aws-crypto/util@5.2.0':
+    resolution: {integrity: sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==}
+
+  '@aws-sdk/client-s3@3.1009.0':
+    resolution: {integrity: sha512-luy8CxallkoiGWTqU86ca/BbvkWJjs0oala7uIIRN1JtQxMb5i4Yl/PBZVcQFhbK9kQi0PK0GfD8gIpLkI91fw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/core@3.973.20':
+    resolution: {integrity: sha512-i3GuX+lowD892F3IuJf8o6AbyDupMTdyTxQrCJGcn71ni5hTZ82L4nQhcdumxZ7XPJRJJVHS/CR3uYOIIs0PVA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/crc64-nvme@3.972.5':
+    resolution: {integrity: sha512-2VbTstbjKdT+yKi8m7b3a9CiVac+pL/IY2PHJwsaGkkHmuuqkJZIErPck1h6P3T9ghQMLSdMPyW6Qp7Di5swFg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-env@3.972.18':
+    resolution: {integrity: sha512-X0B8AlQY507i5DwjLByeU2Af4ARsl9Vr84koDcXCbAkplmU+1xBFWxEPrWRAoh56waBne/yJqEloSwvRf4x6XA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-http@3.972.20':
+    resolution: {integrity: sha512-ey9Lelj001+oOfrbKmS6R2CJAiXX7QKY4Vj9VJv6L2eE6/VjD8DocHIoYqztTm70xDLR4E1jYPTKfIui+eRNDA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-ini@3.972.20':
+    resolution: {integrity: sha512-5flXSnKHMloObNF+9N0cupKegnH1Z37cdVlpETVgx8/rAhCe+VNlkcZH3HDg2SDn9bI765S+rhNPXGDJJPfbtA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-login@3.972.20':
+    resolution: {integrity: sha512-gEWo54nfqp2jABMu6HNsjVC4hDLpg9HC8IKSJnp0kqWtxIJYHTmiLSsIfI4ScQjxEwpB+jOOH8dOLax1+hy/Hw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-node@3.972.21':
+    resolution: {integrity: sha512-hah8if3/B/Q+LBYN5FukyQ1Mym6PLPDsBOBsIgNEYD6wLyZg0UmUF/OKIVC3nX9XH8TfTPuITK+7N/jenVACWA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-process@3.972.18':
+    resolution: {integrity: sha512-Tpl7SRaPoOLT32jbTWchPsn52hYYgJ0kpiFgnwk8pxTANQdUymVSZkzFvv1+oOgZm1CrbQUP9MBeoMZ9IzLZjA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-sso@3.972.20':
+    resolution: {integrity: sha512-p+R+PYR5Z7Gjqf/6pvbCnzEHcqPCpLzR7Yf127HjJ6EAb4hUcD+qsNRnuww1sB/RmSeCLxyay8FMyqREw4p1RA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-web-identity@3.972.20':
+    resolution: {integrity: sha512-rWCmh8o7QY4CsUj63qopzMzkDq/yPpkrpb+CnjBEFSOg/02T/we7sSTVg4QsDiVS9uwZ8VyONhq98qt+pIh3KA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/lib-storage@3.1009.0':
+    resolution: {integrity: sha512-gHQh1sNeTuxZxPSMSQWOq/Xli8I5499uWyRKMakMSv8N7IYfoyDdyT52Ul6697qcqVaoPHixmYTllfEWMo1AKg==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      '@aws-sdk/client-s3': ^3.1009.0
+
+  '@aws-sdk/middleware-bucket-endpoint@3.972.8':
+    resolution: {integrity: sha512-WR525Rr2QJSETa9a050isktyWi/4yIGcmY3BQ1kpHqb0LqUglQHCS8R27dTJxxWNZvQ0RVGtEZjTCbZJpyF3Aw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-expect-continue@3.972.8':
+    resolution: {integrity: sha512-5DTBTiotEES1e2jOHAq//zyzCjeMB78lEHd35u15qnrid4Nxm7diqIf9fQQ3Ov0ChH1V3Vvt13thOnrACmfGVQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-flexible-checksums@3.973.6':
+    resolution: {integrity: sha512-0nYEgkJH7Yt9k+nZJyllTghnkKaz17TWFcr5Mi0XMVMzYlF4ytDZADQpF2/iJo36cKL5AYSzRsvlykE4M/ErTA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-host-header@3.972.8':
+    resolution: {integrity: sha512-wAr2REfKsqoKQ+OkNqvOShnBoh+nkPurDKW7uAeVSu6kUECnWlSJiPvnoqxGlfousEY/v9LfS9sNc46hjSYDIQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-location-constraint@3.972.8':
+    resolution: {integrity: sha512-KaUoFuoFPziIa98DSQsTPeke1gvGXlc5ZGMhy+b+nLxZ4A7jmJgLzjEF95l8aOQN2T/qlPP3MrAyELm8ExXucw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-logger@3.972.8':
+    resolution: {integrity: sha512-CWl5UCM57WUFaFi5kB7IBY1UmOeLvNZAZ2/OZ5l20ldiJ3TiIz1pC65gYj8X0BCPWkeR1E32mpsCk1L1I4n+lA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-recursion-detection@3.972.8':
+    resolution: {integrity: sha512-BnnvYs2ZEpdlmZ2PNlV2ZyQ8j8AEkMTjN79y/YA475ER1ByFYrkVR85qmhni8oeTaJcDqbx364wDpitDAA/wCA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-sdk-s3@3.972.20':
+    resolution: {integrity: sha512-yhva/xL5H4tWQgsBjwV+RRD0ByCzg0TcByDCLp3GXdn/wlyRNfy8zsswDtCvr1WSKQkSQYlyEzPuWkJG0f5HvQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-ssec@3.972.8':
+    resolution: {integrity: sha512-wqlK0yO/TxEC2UsY9wIlqeeutF6jjLe0f96Pbm40XscTo57nImUk9lBcw0dPgsm0sppFtAkSlDrfpK+pC30Wqw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/middleware-user-agent@3.972.21':
+    resolution: {integrity: sha512-62XRl1GDYPpkt7cx1AX1SPy9wgNE9Iw/NPuurJu4lmhCWS7sGKO+kS53TQ8eRmIxy3skmvNInnk0ZbWrU5Dpyg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/nested-clients@3.996.10':
+    resolution: {integrity: sha512-SlDol5Z+C7Ivnc2rKGqiqfSUmUZzY1qHfVs9myt/nxVwswgfpjdKahyTzLTx802Zfq0NFRs7AejwKzzzl5Co2w==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/region-config-resolver@3.972.8':
+    resolution: {integrity: sha512-1eD4uhTDeambO/PNIDVG19A6+v4NdD7xzwLHDutHsUqz0B+i661MwQB2eYO4/crcCvCiQG4SRm1k81k54FEIvw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/signature-v4-multi-region@3.996.8':
+    resolution: {integrity: sha512-n1qYFD+tbqZuyskVaxUE+t10AUz9g3qzDw3Tp6QZDKmqsjfDmZBd4GIk2EKJJNtcCBtE5YiUjDYA+3djFAFBBg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/token-providers@3.1009.0':
+    resolution: {integrity: sha512-KCPLuTqN9u0Rr38Arln78fRG9KXpzsPWmof+PZzfAHMMQq2QED6YjQrkrfiH7PDefLWEposY1o4/eGwrmKA4JA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/types@3.973.6':
+    resolution: {integrity: sha512-Atfcy4E++beKtwJHiDln2Nby8W/mam64opFPTiHEqgsthqeydFS1pY+OUlN1ouNOmf8ArPU/6cDS65anOP3KQw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/util-arn-parser@3.972.3':
+    resolution: {integrity: sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/util-endpoints@3.996.5':
+    resolution: {integrity: sha512-Uh93L5sXFNbyR5sEPMzUU8tJ++Ku97EY4udmC01nB8Zu+xfBPwpIwJ6F7snqQeq8h2pf+8SGN5/NoytfKgYPIw==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/util-locate-window@3.965.5':
+    resolution: {integrity: sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/util-user-agent-browser@3.972.8':
+    resolution: {integrity: sha512-B3KGXJviV2u6Cdw2SDY2aDhoJkVfY/Q/Trwk2CMSkikE1Oi6gRzxhvhIfiRpHfmIsAhV4EA54TVEX8K6CbHbkA==}
+
+  '@aws-sdk/util-user-agent-node@3.973.7':
+    resolution: {integrity: sha512-Hz6EZMUAEzqUd7e+vZ9LE7mn+5gMbxltXy18v+YSFY+9LBJz15wkNZvw5JqfX3z0FS9n3bgUtz3L5rAsfh4YlA==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      aws-crt: '>=1.0.0'
+    peerDependenciesMeta:
+      aws-crt:
+        optional: true
+
+  '@aws-sdk/xml-builder@3.972.11':
+    resolution: {integrity: sha512-iitV/gZKQMvY9d7ovmyFnFuTHbBAtrmLnvaSb/3X8vOKyevwtpmEtyc8AdhVWZe0pI/1GsHxlEvQeOePFzy7KQ==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws/lambda-invoke-store@0.2.4':
+    resolution: {integrity: sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@babel/code-frame@7.28.6':
+    resolution: {integrity: sha512-JYgintcMjRiCvS8mMECzaEn+m3PfoQiyqukOMCCVQtoJGYJw8j/8LBJEiqkHLkfwCcs74E3pbAUFNg7d9VNJ+Q==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/code-frame@7.29.0':
+    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.28.6':
+    resolution: {integrity: sha512-2lfu57JtzctfIrcGMz992hyLlByuzgIk58+hhGCxjKZ3rWI82NnVLjXcaTqkI2NvlcvOskZaiZ5kjUALo3Lpxg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.28.0':
+    resolution: {integrity: sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.28.6':
+    resolution: {integrity: sha512-H3mcG6ZDLTlYfaSNi0iOKkigqMFvkTKlGUYlD8GW7nNOYRrevuA46iTypPyv+06V3fEmvvazfntkBU34L0azAw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.0':
+    resolution: {integrity: sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.28.6':
+    resolution: {integrity: sha512-lOoVRwADj8hjf7al89tvQ2a1lf53Z+7tiXMgpZJL3maQPDxh0DgLMN62B2MKUOFcoodBHLMbDM6WAbKgNy5Suw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.1':
+    resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-annotate-as-pure@7.27.3':
+    resolution: {integrity: sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.28.6':
+    resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-create-class-features-plugin@7.28.6':
+    resolution: {integrity: sha512-dTOdvsjnG3xNT9Y0AUg1wAl38y+4Rl4sf9caSQZOXdNqVn+H+HbbJ4IyyHaIqNR6SW9oJpA/RuRjsjCw2IdIow==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-globals@7.28.0':
+    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-member-expression-to-functions@7.28.5':
+    resolution: {integrity: sha512-cwM7SBRZcPCLgl8a7cY0soT1SptSzAlMH39vwiRpOQkJlh53r5hdHwLSCZpQdVLT39sZt+CRpNwYG4Y2v77atg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.18.6':
+    resolution: {integrity: sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.28.6':
+    resolution: {integrity: sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.28.6':
+    resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-optimise-call-expression@7.27.1':
+    resolution: {integrity: sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-plugin-utils@7.28.6':
+    resolution: {integrity: sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-replace-supers@7.28.6':
+    resolution: {integrity: sha512-mq8e+laIk94/yFec3DxSjCRD2Z0TAjhVbEJY3UQrlwVo15Lmt7C2wAUbK4bjnTs4APkwsYLTahXRraQXhb1WCg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.27.1':
+    resolution: {integrity: sha512-Tub4ZKEXqbPjXgWLl2+3JpQAYBJ8+ikpQ2Ocj/q/r0LwE3UhENh7EUabyHjz2kCEsrRY83ew2DQdHluuiDQFzg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.27.1':
+    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.28.5':
+    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.27.1':
+    resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.28.6':
+    resolution: {integrity: sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.28.6':
+    resolution: {integrity: sha512-TeR9zWR18BvbfPmGbLampPMW+uW1NZnJlRuuHso8i87QZNq2JRF9i6RgxRqtEq+wQGsS19NNTWr2duhnE49mfQ==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/parser@7.29.2':
+    resolution: {integrity: sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-syntax-jsx@7.28.6':
+    resolution: {integrity: sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-typescript@7.28.6':
+    resolution: {integrity: sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-modules-commonjs@7.28.6':
+    resolution: {integrity: sha512-jppVbf8IV9iWWwWTQIxJMAJCWBuuKx71475wHwYytrRGQ2CWiDvYlADQno3tcYpS/T2UUWFQp3nVtYfK/YBQrA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-self@7.27.1':
+    resolution: {integrity: sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.27.1':
+    resolution: {integrity: sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-typescript@7.28.6':
+    resolution: {integrity: sha512-0YWL2RFxOqEm9Efk5PvreamxPME8OyY0wM5wh5lHjF+VtVhdneCWGzZeSqzOfiobVqQaNCd2z0tQvnI9DaPWPw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/preset-typescript@7.27.1':
+    resolution: {integrity: sha512-l7WfQfX0WK4M0v2RudjuQK4u99BS6yLHYEmdtVPP7lKV013zr9DygFuWNlnbvQ9LR+LS0Egz/XAvGx5U9MX0fQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/runtime@7.29.2':
+    resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/template@7.28.6':
+    resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.28.6':
+    resolution: {integrity: sha512-fgWX62k02qtjqdSNTAGxmKYY/7FSL9WAS1o2Hu5+I5m9T0yxZzr4cnrfXQ/MX0rIifthCSs6FKTlzYbJcPtMNg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.0':
+    resolution: {integrity: sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.28.6':
+    resolution: {integrity: sha512-0ZrskXVEHSWIqZM/sQZ4EV3jZJXRkio/WCxaqKZP1g//CEWEPSfeZFcms4XeKBCHU0ZKnIkdJeU/kF+eRp5lBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.0':
+    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
+    engines: {node: '>=6.9.0'}
+
+  '@base-ui/react@1.4.1':
+    resolution: {integrity: sha512-Ab5/LIhcmL8BQcsBUYiOfkSDRdLpvgUBzMK30cu684JPcLclYlztharvCZyNNgzJtbAiREzI9q0pI5erHCMgCw==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      '@date-fns/tz': ^1.2.0
+      '@types/react': ^17 || ^18 || ^19
+      date-fns: ^4.0.0
+      react: ^17 || ^18 || ^19
+      react-dom: ^17 || ^18 || ^19
+    peerDependenciesMeta:
+      '@date-fns/tz':
+        optional: true
+      '@types/react':
+        optional: true
+      date-fns:
+        optional: true
+
+  '@base-ui/utils@0.2.8':
+    resolution: {integrity: sha512-jvOi+c+ftGlGotNcKnzPVg2IhCaDTB6/6R3JeqdjdXktuAJi3wKH9T7+svuaKh1mmfVU11UWzUZVH74JDfi/wQ==}
+    peerDependencies:
+      '@types/react': ^17 || ^18 || ^19
+      react: ^17 || ^18 || ^19
+      react-dom: ^17 || ^18 || ^19
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@better-auth/api-key@1.5.6':
+    resolution: {integrity: sha512-jr3m4/caFxn9BuY9pGDJ4B1HP1Qoqmyd7heBHm4KUFel+a9Whe/euROgZ/L+o7mbmUdZtreneaU15dpn0tJZ5g==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': 0.3.1
+      better-auth: 1.5.6
+
+  '@better-auth/core@1.5.6':
+    resolution: {integrity: sha512-Ez9DZdIMFyxHremmoLz1emFPGNQomDC1jqqBPnZ6Ci+6TiGN3R9w/Y03cJn6I8r1ycKgOzeVMZtJ/erOZ27Gsw==}
+    peerDependencies:
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      '@cloudflare/workers-types': '>=4'
+      '@opentelemetry/api': ^1.9.0
+      better-call: 1.3.2
+      jose: ^6.1.0
+      kysely: ^0.28.5
+      nanostores: ^1.0.1
+    peerDependenciesMeta:
+      '@cloudflare/workers-types':
+        optional: true
+
+  '@better-auth/drizzle-adapter@1.5.6':
+    resolution: {integrity: sha512-VfFFmaoFw3ug12SiSuIwzrMoHyIVmkMGWm9gZ4sXdYYVX4HboCL4m3fjzOhppcmK5OGatRuU+N1UX6wxCITcXw==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': ^0.3.0
+      drizzle-orm: '>=0.41.0'
+    peerDependenciesMeta:
+      drizzle-orm:
+        optional: true
+
+  '@better-auth/kysely-adapter@1.5.6':
+    resolution: {integrity: sha512-Fnf+h8WVKtw6lEOmVmiVVzDf3shJtM60AYf9XTnbdCeUd6MxN/KnaJZpkgtYnRs7a+nwtkVB+fg4lGETebGFXQ==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': ^0.3.0
+      kysely: ^0.27.0 || ^0.28.0
+    peerDependenciesMeta:
+      kysely:
+        optional: true
+
+  '@better-auth/memory-adapter@1.5.6':
+    resolution: {integrity: sha512-rS7ZsrIl5uvloUgNN0u9LOZJMMXnsZXVdUZ3MrTBKWM2KpoJjzPr9yN3Szyma5+0V7SltnzSGHPkYj2bEzzmlA==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': ^0.3.0
+
+  '@better-auth/mongo-adapter@1.5.6':
+    resolution: {integrity: sha512-6+M3MS2mor8fTUV3EI1FBLP0cs6QfbN+Ovx9+XxR/GdfKIBoNFzmPEPRbdGt+ft6PvrITsUm+T70+kkHgVSP6w==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': ^0.3.0
+      mongodb: ^6.0.0 || ^7.0.0
+    peerDependenciesMeta:
+      mongodb:
+        optional: true
+
+  '@better-auth/oauth-provider@1.5.6':
+    resolution: {integrity: sha512-DSkdC4GLwUiDwwd4hxQZa+aqzFoMXQV0Im3k4igzGIW6VB2S0p0CIR+YCOxJP7lAP+1eepxvjTfG07sTXzu2Bw==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      better-auth: 1.5.6
+      better-call: 1.3.2
+
+  '@better-auth/prisma-adapter@1.5.6':
+    resolution: {integrity: sha512-UxY9vQJs1Tt+O+T2YQnseDMlWmUSQvFZSBb5YiFRg7zcm+TEzujh4iX2/csA0YiZptLheovIuVWTP9nriewEBA==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+      '@better-auth/utils': ^0.3.0
+      '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
+      prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
+    peerDependenciesMeta:
+      '@prisma/client':
+        optional: true
+      prisma:
+        optional: true
+
+  '@better-auth/telemetry@1.5.6':
+    resolution: {integrity: sha512-yXC7NSxnIFlxDkGdpD7KA+J9nqIQAPCJKe77GoaC5bWoe/DALo1MYorZfTgOafS7wrslNtsPT4feV/LJi1ubqQ==}
+    peerDependencies:
+      '@better-auth/core': 1.5.6
+
+  '@better-auth/utils@0.3.1':
+    resolution: {integrity: sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==}
+
+  '@better-fetch/fetch@1.1.21':
+    resolution: {integrity: sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A==}
+
+  '@braintree/sanitize-url@7.1.2':
+    resolution: {integrity: sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==}
+
+  '@chevrotain/cst-dts-gen@11.1.2':
+    resolution: {integrity: sha512-XTsjvDVB5nDZBQB8o0o/0ozNelQtn2KrUVteIHSlPd2VAV2utEb6JzyCJaJ8tGxACR4RiBNWy5uYUHX2eji88Q==}
+
+  '@chevrotain/gast@11.1.2':
+    resolution: {integrity: sha512-Z9zfXR5jNZb1Hlsd/p+4XWeUFugrHirq36bKzPWDSIacV+GPSVXdk+ahVWZTwjhNwofAWg/sZg58fyucKSQx5g==}
+
+  '@chevrotain/regexp-to-ast@11.1.2':
+    resolution: {integrity: sha512-nMU3Uj8naWer7xpZTYJdxbAs6RIv/dxYzkYU8GSwgUtcAAlzjcPfX1w+RKRcYG8POlzMeayOQ/znfwxEGo5ulw==}
+
+  '@chevrotain/types@11.1.2':
+    resolution: {integrity: sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==}
+
+  '@chevrotain/utils@11.1.2':
+    resolution: {integrity: sha512-4mudFAQ6H+MqBTfqLmU7G1ZwRzCLfJEooL/fsF6rCX5eePMbGhoy5n4g+G4vlh2muDcsCTJtL+uKbOzWxs5LHA==}
+
+  '@codemirror/autocomplete@6.20.0':
+    resolution: {integrity: sha512-bOwvTOIJcG5FVo5gUUupiwYh8MioPLQ4UcqbcRf7UQ98X90tCa9E1kZ3Z7tqwpZxYyOvh1YTYbmZE9RTfTp5hg==}
+
+  '@codemirror/commands@6.10.2':
+    resolution: {integrity: sha512-vvX1fsih9HledO1c9zdotZYUZnE4xV0m6i3m25s5DIfXofuprk6cRcLUZvSk3CASUbwjQX21tOGbkY2BH8TpnQ==}
+
+  '@codemirror/lang-css@6.3.1':
+    resolution: {integrity: sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg==}
+
+  '@codemirror/lang-html@6.4.11':
+    resolution: {integrity: sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw==}
+
+  '@codemirror/lang-javascript@6.2.4':
+    resolution: {integrity: sha512-0WVmhp1QOqZ4Rt6GlVGwKJN3KW7Xh4H2q8ZZNGZaP6lRdxXJzmjm4FqvmOojVj6khWJHIb9sp7U/72W7xQgqAA==}
+
+  '@codemirror/lang-markdown@6.5.0':
+    resolution: {integrity: sha512-0K40bZ35jpHya6FriukbgaleaqzBLZfOh7HuzqbMxBXkbYMJDxfF39c23xOgxFezR+3G+tR2/Mup+Xk865OMvw==}
+
+  '@codemirror/language@6.12.1':
+    resolution: {integrity: sha512-Fa6xkSiuGKc8XC8Cn96T+TQHYj4ZZ7RdFmXA3i9xe/3hLHfwPZdM+dqfX0Cp0zQklBKhVD8Yzc8LS45rkqcwpQ==}
+
+  '@codemirror/lint@6.9.4':
+    resolution: {integrity: sha512-ABc9vJ8DEmvOWuH26P3i8FpMWPQkduD9Rvba5iwb6O3hxASgclm3T3krGo8NASXkHCidz6b++LWlzWIUfEPSWw==}
+
+  '@codemirror/state@6.5.4':
+    resolution: {integrity: sha512-8y7xqG/hpB53l25CIoit9/ngxdfoG+fx+V3SHBrinnhOtLvKHRyAJJuHzkWrR4YXXLX8eXBsejgAAxHUOdW1yw==}
+
+  '@codemirror/view@6.39.14':
+    resolution: {integrity: sha512-WJcvgHm/6Q7dvGT0YFv/6PSkoc36QlR0VCESS6x9tGsnF1lWLmmYxOgX3HH6v8fo6AvSLgpcs+H0Olre6MKXlg==}
+
+  '@daytonaio/api-client@0.150.0':
+    resolution: {integrity: sha512-NXGE1sgd8+VBzu3B7P/pLrlpci9nMoZecvLmK3zFDh8hr5Ra5vuXJN9pEVJmev93zUItQxHbuvaxaWrYzHevVA==}
+
+  '@daytonaio/sdk@0.150.0':
+    resolution: {integrity: sha512-JmNulFaLhmpjVVFtaRDZa84fxPuy0axQYVLrj1lvRgcZzcrwJRdHv9FZPMLbKdrbicMh3D7GYA9XeBMYVZBTIg==}
+
+  '@daytonaio/toolbox-api-client@0.150.0':
+    resolution: {integrity: sha512-7MCbD1FrzYjOaOmqpMDQe7cyoQTSImEOjQ+6Js4NlBOwPlz2PMi352XuG9qrBp9ngNpo8fpduYr35iDOjrpIVg==}
+
+  '@develar/schema-utils@2.6.5':
+    resolution: {integrity: sha512-0cp4PsWQ/9avqTVMCtZ+GirikIA36ikvjtHweU4/j8yLtgObI0+JUPhYFScgwlteveGB1rt3Cm8UhN04XayDig==}
+    engines: {node: '>= 8.9.0'}
+
+  '@dimforge/rapier2d-simd-compat@0.17.3':
+    resolution: {integrity: sha512-bijvwWz6NHsNj5e5i1vtd3dU2pDhthSaTUZSh14DUGGKJfw8eMnlWZsxwHBxB/a3AXVNDjL9abuHw1k9FGR+jg==}
+
+  '@dotenvx/dotenvx@1.64.0':
+    resolution: {integrity: sha512-6+xRpZaWuHXEqnhBjae+VmQI9Uaqw5Uzu/ScpO+W7ww9Zp3lHSNBoNjFcUxhrCyc7pRGQzyDjhKzloqrPHERiQ==}
+    hasBin: true
+
+  '@drizzle-team/brocli@0.10.2':
+    resolution: {integrity: sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==}
+
+  '@ecies/ciphers@0.2.6':
+    resolution: {integrity: sha512-patgsRPKGkhhoBjETV4XxD0En4ui5fbX0hzayqI3M8tvNMGUoUvmyYAIWwlxBc1KX5cturfqByYdj5bYGRpN9g==}
+    engines: {bun: '>=1', deno: '>=2.7.10', node: '>=16'}
+    peerDependencies:
+      '@noble/ciphers': ^1.0.0
+
+  '@electron/asar@3.4.1':
+    resolution: {integrity: sha512-i4/rNPRS84t0vSRa2HorerGRXWyF4vThfHesw0dmcWHp+cspK743UanA0suA5Q5y8kzY2y6YKrvbIUn69BCAiA==}
+    engines: {node: '>=10.12.0'}
+    hasBin: true
+
+  '@electron/get@2.0.3':
+    resolution: {integrity: sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==}
+    engines: {node: '>=12'}
+
+  '@electron/notarize@2.5.0':
+    resolution: {integrity: sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==}
+    engines: {node: '>= 10.0.0'}
+
+  '@electron/osx-sign@1.3.1':
+    resolution: {integrity: sha512-BAfviURMHpmb1Yb50YbCxnOY0wfwaLXH5KJ4+80zS0gUkzDX3ec23naTlEqKsN+PwYn+a1cCzM7BJ4Wcd3sGzw==}
+    engines: {node: '>=12.0.0'}
+    hasBin: true
+
+  '@electron/rebuild@3.6.1':
+    resolution: {integrity: sha512-f6596ZHpEq/YskUd8emYvOUne89ij8mQgjYFA5ru25QwbrRO+t1SImofdDv7kKOuWCmVOuU5tvfkbgGxIl3E/w==}
+    engines: {node: '>=12.13.0'}
+    hasBin: true
+
+  '@electron/universal@2.0.1':
+    resolution: {integrity: sha512-fKpv9kg4SPmt+hY7SVBnIYULE9QJl8L3sCfcBsnqbJwwBwAeTLokJ9TRt9y7bK0JAzIW2y78TVVjvnQEms/yyA==}
+    engines: {node: '>=16.4'}
+
+  '@emnapi/runtime@1.8.1':
+    resolution: {integrity: sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==}
+
+  '@esbuild-kit/core-utils@3.3.2':
+    resolution: {integrity: sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==}
+    deprecated: 'Merged into tsx: https://tsx.is'
+
+  '@esbuild-kit/esm-loader@2.6.5':
+    resolution: {integrity: sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==}
+    deprecated: 'Merged into tsx: https://tsx.is'
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/aix-ppc64@0.27.2':
+    resolution: {integrity: sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.18.20':
+    resolution: {integrity: sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.27.2':
+    resolution: {integrity: sha512-pvz8ZZ7ot/RBphf8fv60ljmaoydPU12VuXHImtAs0XhLLw+EXBi2BLe3OYSBslR4rryHvweW5gmkKFwTiFy6KA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.18.20':
+    resolution: {integrity: sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.27.2':
+    resolution: {integrity: sha512-DVNI8jlPa7Ujbr1yjU2PfUSRtAUZPG9I1RwW4F4xFB1Imiu2on0ADiI/c3td+KmDtVKNbi+nffGDQMfcIMkwIA==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.18.20':
+    resolution: {integrity: sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.27.2':
+    resolution: {integrity: sha512-z8Ank4Byh4TJJOh4wpz8g2vDy75zFL0TlZlkUkEwYXuPSgX8yzep596n6mT7905kA9uHZsf/o2OJZubl2l3M7A==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.18.20':
+    resolution: {integrity: sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.27.2':
+    resolution: {integrity: sha512-davCD2Zc80nzDVRwXTcQP/28fiJbcOwvdolL0sOiOsbwBa72kegmVU0Wrh1MYrbuCL98Omp5dVhQFWRKR2ZAlg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.18.20':
+    resolution: {integrity: sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.27.2':
+    resolution: {integrity: sha512-ZxtijOmlQCBWGwbVmwOF/UCzuGIbUkqB1faQRf5akQmxRJ1ujusWsb3CVfk/9iZKr2L5SMU5wPBi1UWbvL+VQA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.18.20':
+    resolution: {integrity: sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.27.2':
+    resolution: {integrity: sha512-lS/9CN+rgqQ9czogxlMcBMGd+l8Q3Nj1MFQwBZJyoEKI50XGxwuzznYdwcav6lpOGv5BqaZXqvBSiB/kJ5op+g==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.18.20':
+    resolution: {integrity: sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.27.2':
+    resolution: {integrity: sha512-tAfqtNYb4YgPnJlEFu4c212HYjQWSO/w/h/lQaBK7RbwGIkBOuNKQI9tqWzx7Wtp7bTPaGC6MJvWI608P3wXYA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.18.20':
+    resolution: {integrity: sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.27.2':
+    resolution: {integrity: sha512-hYxN8pr66NsCCiRFkHUAsxylNOcAQaxSSkHMMjcpx0si13t1LHFphxJZUiGwojB1a/Hd5OiPIqDdXONia6bhTw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.18.20':
+    resolution: {integrity: sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.27.2':
+    resolution: {integrity: sha512-vWfq4GaIMP9AIe4yj1ZUW18RDhx6EPQKjwe7n8BbIecFtCQG4CfHGaHuh7fdfq+y3LIA2vGS/o9ZBGVxIDi9hw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.18.20':
+    resolution: {integrity: sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.27.2':
+    resolution: {integrity: sha512-MJt5BRRSScPDwG2hLelYhAAKh9imjHK5+NE/tvnRLbIqUWa+0E9N4WNMjmp/kXXPHZGqPLxggwVhz7QP8CTR8w==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.18.20':
+    resolution: {integrity: sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==}
+    engines: {node: '>=12'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.27.2':
+    resolution: {integrity: sha512-lugyF1atnAT463aO6KPshVCJK5NgRnU4yb3FUumyVz+cGvZbontBgzeGFO1nF+dPueHD367a2ZXe1NtUkAjOtg==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.18.20':
+    resolution: {integrity: sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==}
+    engines: {node: '>=12'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.27.2':
+    resolution: {integrity: sha512-nlP2I6ArEBewvJ2gjrrkESEZkB5mIoaTswuqNFRv/WYd+ATtUpe9Y09RnJvgvdag7he0OWgEZWhviS1OTOKixw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.18.20':
+    resolution: {integrity: sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==}
+    engines: {node: '>=12'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.27.2':
+    resolution: {integrity: sha512-C92gnpey7tUQONqg1n6dKVbx3vphKtTHJaNG2Ok9lGwbZil6DrfyecMsp9CrmXGQJmZ7iiVXvvZH6Ml5hL6XdQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.18.20':
+    resolution: {integrity: sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==}
+    engines: {node: '>=12'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.27.2':
+    resolution: {integrity: sha512-B5BOmojNtUyN8AXlK0QJyvjEZkWwy/FKvakkTDCziX95AowLZKR6aCDhG7LeF7uMCXEJqwa8Bejz5LTPYm8AvA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.18.20':
+    resolution: {integrity: sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==}
+    engines: {node: '>=12'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.27.2':
+    resolution: {integrity: sha512-p4bm9+wsPwup5Z8f4EpfN63qNagQ47Ua2znaqGH6bqLlmJ4bx97Y9JdqxgGZ6Y8xVTixUnEkoKSHcpRlDnNr5w==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.18.20':
+    resolution: {integrity: sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.27.2':
+    resolution: {integrity: sha512-uwp2Tip5aPmH+NRUwTcfLb+W32WXjpFejTIOWZFw/v7/KnpCDKG66u4DLcurQpiYTiYwQ9B7KOeMJvLCu/OvbA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-arm64@0.27.2':
+    resolution: {integrity: sha512-Kj6DiBlwXrPsCRDeRvGAUb/LNrBASrfqAIok+xB0LxK8CHqxZ037viF13ugfsIpePH93mX7xfJp97cyDuTZ3cw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.18.20':
+    resolution: {integrity: sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.27.2':
+    resolution: {integrity: sha512-HwGDZ0VLVBY3Y+Nw0JexZy9o/nUAWq9MlV7cahpaXKW6TOzfVno3y3/M8Ga8u8Yr7GldLOov27xiCnqRZf0tCA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-arm64@0.27.2':
+    resolution: {integrity: sha512-DNIHH2BPQ5551A7oSHD0CKbwIA/Ox7+78/AWkbS5QoRzaqlev2uFayfSxq68EkonB+IKjiuxBFoV8ESJy8bOHA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.18.20':
+    resolution: {integrity: sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.27.2':
+    resolution: {integrity: sha512-/it7w9Nb7+0KFIzjalNJVR5bOzA9Vay+yIPLVHfIQYG/j+j9VTH84aNB8ExGKPU4AzfaEvN9/V4HV+F+vo8OEg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/openharmony-arm64@0.27.2':
+    resolution: {integrity: sha512-LRBbCmiU51IXfeXk59csuX/aSaToeG7w48nMwA6049Y4J4+VbWALAuXcs+qcD04rHDuSCSRKdmY63sruDS5qag==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.18.20':
+    resolution: {integrity: sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.27.2':
+    resolution: {integrity: sha512-kMtx1yqJHTmqaqHPAzKCAkDaKsffmXkPHThSfRwZGyuqyIeBvf08KSsYXl+abf5HDAPMJIPnbBfXvP2ZC2TfHg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.18.20':
+    resolution: {integrity: sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.27.2':
+    resolution: {integrity: sha512-Yaf78O/B3Kkh+nKABUF++bvJv5Ijoy9AN1ww904rOXZFLWVc5OLOfL56W+C8F9xn5JQZa3UX6m+IktJnIb1Jjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.18.20':
+    resolution: {integrity: sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.27.2':
+    resolution: {integrity: sha512-Iuws0kxo4yusk7sw70Xa2E2imZU5HoixzxfGCdxwBdhiDgt9vX9VUCBhqcwY7/uh//78A1hMkkROMJq9l27oLQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.18.20':
+    resolution: {integrity: sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.27.2':
+    resolution: {integrity: sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@fastify/busboy@2.1.1':
+    resolution: {integrity: sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==}
+    engines: {node: '>=14'}
+
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+
+  '@floating-ui/react-dom@2.1.8':
+    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
+    peerDependencies:
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@floating-ui/react@0.27.19':
+    resolution: {integrity: sha512-31B8h5mm8YxotlE7/AU/PhNAl8eWxAmjL/v2QOxroDNkTFLk3Uu82u63N3b6TXa4EGJeeZLVcd/9AlNlVqzeog==}
+    peerDependencies:
+      react: '>=17.0.0'
+      react-dom: '>=17.0.0'
+
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+
+  '@fontsource-variable/geist@5.2.8':
+    resolution: {integrity: sha512-cJ6m9e+8MQ5dCYJsLylfZrgBh6KkG4bOLckB35Tr9J/EqdkEM6QllH5PxqP1dhTvFup+HtMRPuz9xOjxXJggxw==}
+
+  '@fontsource-variable/ibm-plex-sans@5.2.8':
+    resolution: {integrity: sha512-n5PF2iFa0CZT0QYTPzxvZ39opC9LnU0zdoRccoADbs+Dtsd+lbXOZF7RNuIPHcQX1dKjF63sxnRImQIB5eD0Ag==}
+
+  '@gar/promisify@1.1.3':
+    resolution: {integrity: sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==}
+
+  '@grammyjs/types@3.23.0':
+    resolution: {integrity: sha512-D3jQ4UWERPsyR3op/YFudMMIPNTU47vy7L51uO9/73tMELmjO/+LX5N36/Y0CG5IQfIsz43MxiHI5rgsK0/k+g==}
+
+  '@grpc/grpc-js@1.14.3':
+    resolution: {integrity: sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==}
+    engines: {node: '>=12.10.0'}
+
+  '@grpc/proto-loader@0.8.0':
+    resolution: {integrity: sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  '@hey-api/client-fetch@0.13.1':
+    resolution: {integrity: sha512-29jBRYNdxVGlx5oewFgOrkulZckpIpBIRHth3uHFn1PrL2ucMy52FvWOY3U3dVx2go1Z3kUmMi6lr07iOpUqqA==}
+    deprecated: Starting with v0.73.0, this package is bundled directly inside @hey-api/openapi-ts.
+    peerDependencies:
+      '@hey-api/openapi-ts': < 2
+
+  '@hey-api/codegen-core@0.7.4':
+    resolution: {integrity: sha512-DGd9yeSQzflOWO3Y5mt1GRXkXH9O/yIMgbxPjwLI3jwu/3nAjoXXD26lEeFb6tclYlg0JAqTIs5d930G/qxHeA==}
+    engines: {node: '>=20.19.0'}
+
+  '@hey-api/json-schema-ref-parser@1.3.1':
+    resolution: {integrity: sha512-7atnpUkT8TyUPHYPLk91j/GyaqMuwTEHanLOe50Dlx0EEvNuQqFD52Yjg8x4KU0UFL1mWlyhE+sUE/wAtQ1N2A==}
+    engines: {node: '>=20.19.0'}
+
+  '@hey-api/openapi-ts@0.95.0':
+    resolution: {integrity: sha512-lk5C+WKl5yqEmliQihEyhX/jNcWlAykTSEqkDeKa9xSq5YDAzOFvx7oos8YTqiIzdc4TemtlEaB8Rns7+8A0qg==}
+    engines: {node: '>=20.19.0'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>=5.5.3 || >=6.0.0 || 6.0.1-rc'
+
+  '@hey-api/shared@0.3.0':
+    resolution: {integrity: sha512-G+4GPojdLEh9bUwRG88teMPM1HdqMm/IsJ38cbnNxhyDu1FkFGwilkA1EqnULCzfTam/ZoZkaLdmAd8xEh4Xsw==}
+    engines: {node: '>=20.19.0'}
+
+  '@hey-api/spec-types@0.1.0':
+    resolution: {integrity: sha512-StS4RrAO5pyJCBwe6uF9MAuPflkztriW+FPnVb7oEjzDYv1sxPwP+f7fL6u6D+UVrKpZ/9bPNx/xXVdkeWPU6A==}
+
+  '@hey-api/types@0.1.4':
+    resolution: {integrity: sha512-thWfawrDIP7wSI9ioT13I5soaaqB5vAPIiZmgD8PbeEVKNrkonc0N/Sjj97ezl7oQgusZmaNphGdMKipPO6IBg==}
+
+  '@hono/mcp@0.2.5':
+    resolution: {integrity: sha512-JsaJes7VlNvUrUQ9j2b9C13xjFLvyKQY515aWtsdJ9cwhBmWz5od2yUCbDu7cX38GeADmlLmpu4BKNNAV6G27w==}
+    peerDependencies:
+      '@modelcontextprotocol/sdk': ^1.25.1
+      hono: '*'
+      hono-rate-limiter: ^0.4.2
+      zod: ^3.25.0 || ^4.0.0
+
+  '@hono/node-server@1.19.11':
+    resolution: {integrity: sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==}
+    engines: {node: '>=18.14.1'}
+    peerDependencies:
+      hono: ^4
+
+  '@hono/standard-validator@0.2.2':
+    resolution: {integrity: sha512-mJ7W84Bt/rSvoIl63Ynew+UZOHAzzRAoAXb3JaWuxAkM/Lzg+ZHTCUiz77KOtn2e623WNN8LkD57Dk0szqUrIw==}
+    peerDependencies:
+      '@standard-schema/spec': ^1.0.0
+      hono: '>=3.9.0'
+
+  '@hono/swagger-ui@0.6.1':
+    resolution: {integrity: sha512-sJTvldu1GPeEPfyeLG7gRj+W4vEuD+JDi+JjJ3TJs/DvMUtBLs0KJO5yokGegWWdy5qrbdnQGekbhgNRmPmYKQ==}
+    peerDependencies:
+      hono: '>=4.0.0'
+
+  '@iarna/toml@2.2.5':
+    resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==}
+
+  '@iconify/types@2.0.0':
+    resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
+
+  '@iconify/utils@3.1.0':
+    resolution: {integrity: sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw==}
+
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.34.5':
+    resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linux-arm64@0.34.5':
+    resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linux-arm@0.34.5':
+    resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-linux-s390x@0.34.5':
+    resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-linux-x64@0.34.5':
+    resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-wasm32@0.34.5':
+    resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.34.5':
+    resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.34.5':
+    resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.34.5':
+    resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@inquirer/ansi@2.0.5':
+    resolution: {integrity: sha512-doc2sWgJpbFQ64UflSVd17ibMGDuxO1yKgOgLMwavzESnXjFWJqUeG8saYosqKpHp4kWiM5x1nXvEjbpx90gzw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
+
+  '@inquirer/confirm@6.0.12':
+    resolution: {integrity: sha512-h9FgGun3QwVYNj5TWIZZ+slii73bMoBFjPfVIGtnFuL4t8gBiNDV9PcSfIzkuxvgquJKt9nr1QzszpBzTbH8Og==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/core@11.1.9':
+    resolution: {integrity: sha512-BDE4fG22uYh1bGSifcj7JSx119TVYNViMhMu85usp4Fswrzh6M0DV3yld64jA98uOAa2GSQ4Bg4bZRm2d2cwSg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/figures@2.0.5':
+    resolution: {integrity: sha512-NsSs4kzfm12lNetHwAn3GEuH317IzpwrMCbOuMIVytpjnJ90YYHNwdRgYGuKmVxwuIqSgqk3M5qqQt1cDk0tGQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
+
+  '@inquirer/type@4.0.5':
+    resolution: {integrity: sha512-aetVUNeKNc/VriqXlw1NRSW0zhMBB0W4bNbWRJgzRl/3d0QNDQFfk0GO5SDdtjMZVg6o8ZKEiadd7SCCzoOn5Q==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@isaacs/balanced-match@4.0.1':
+    resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==}
+    engines: {node: 20 || >=22}
+
+  '@isaacs/brace-expansion@5.0.0':
+    resolution: {integrity: sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==}
+    engines: {node: 20 || >=22}
+
+  '@isaacs/cliui@8.0.2':
+    resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
+    engines: {node: '>=12'}
+
+  '@isaacs/fs-minipass@4.0.1':
+    resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
+    engines: {node: '>=18.0.0'}
+
+  '@jimp/core@1.6.0':
+    resolution: {integrity: sha512-EQQlKU3s9QfdJqiSrZWNTxBs3rKXgO2W+GxNXDtwchF3a4IqxDheFX1ti+Env9hdJXDiYLp2jTRjlxhPthsk8w==}
+    engines: {node: '>=18'}
+
+  '@jimp/diff@1.6.0':
+    resolution: {integrity: sha512-+yUAQ5gvRC5D1WHYxjBHZI7JBRusGGSLf8AmPRPCenTzh4PA+wZ1xv2+cYqQwTfQHU5tXYOhA0xDytfHUf1Zyw==}
+    engines: {node: '>=18'}
+
+  '@jimp/file-ops@1.6.0':
+    resolution: {integrity: sha512-Dx/bVDmgnRe1AlniRpCKrGRm5YvGmUwbDzt+MAkgmLGf+jvBT75hmMEZ003n9HQI/aPnm/YKnXjg/hOpzNCpHQ==}
+    engines: {node: '>=18'}
+
+  '@jimp/js-bmp@1.6.0':
+    resolution: {integrity: sha512-FU6Q5PC/e3yzLyBDXupR3SnL3htU7S3KEs4e6rjDP6gNEOXRFsWs6YD3hXuXd50jd8ummy+q2WSwuGkr8wi+Gw==}
+    engines: {node: '>=18'}
+
+  '@jimp/js-gif@1.6.0':
+    resolution: {integrity: sha512-N9CZPHOrJTsAUoWkWZstLPpwT5AwJ0wge+47+ix3++SdSL/H2QzyMqxbcDYNFe4MoI5MIhATfb0/dl/wmX221g==}
+    engines: {node: '>=18'}
+
+  '@jimp/js-jpeg@1.6.0':
+    resolution: {integrity: sha512-6vgFDqeusblf5Pok6B2DUiMXplH8RhIKAryj1yn+007SIAQ0khM1Uptxmpku/0MfbClx2r7pnJv9gWpAEJdMVA==}
+    engines: {node: '>=18'}
+
+  '@jimp/js-png@1.6.0':
+    resolution: {integrity: sha512-AbQHScy3hDDgMRNfG0tPjL88AV6qKAILGReIa3ATpW5QFjBKpisvUaOqhzJ7Reic1oawx3Riyv152gaPfqsBVg==}
+    engines: {node: '>=18'}
+
+  '@jimp/js-tiff@1.6.0':
+    resolution: {integrity: sha512-zhReR8/7KO+adijj3h0ZQUOiun3mXUv79zYEAKvE0O+rP7EhgtKvWJOZfRzdZSNv0Pu1rKtgM72qgtwe2tFvyw==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-blit@1.6.0':
+    resolution: {integrity: sha512-M+uRWl1csi7qilnSK8uxK4RJMSuVeBiO1AY0+7APnfUbQNZm6hCe0CCFv1Iyw1D/Dhb8ph8fQgm5mwM0eSxgVA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-blur@1.6.0':
+    resolution: {integrity: sha512-zrM7iic1OTwUCb0g/rN5y+UnmdEsT3IfuCXCJJNs8SZzP0MkZ1eTvuwK9ZidCuMo4+J3xkzCidRwYXB5CyGZTw==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-circle@1.6.0':
+    resolution: {integrity: sha512-xt1Gp+LtdMKAXfDp3HNaG30SPZW6AQ7dtAtTnoRKorRi+5yCJjKqXRgkewS5bvj8DEh87Ko1ydJfzqS3P2tdWw==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-color@1.6.0':
+    resolution: {integrity: sha512-J5q8IVCpkBsxIXM+45XOXTrsyfblyMZg3a9eAo0P7VPH4+CrvyNQwaYatbAIamSIN1YzxmO3DkIZXzRjFSz1SA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-contain@1.6.0':
+    resolution: {integrity: sha512-oN/n+Vdq/Qg9bB4yOBOxtY9IPAtEfES8J1n9Ddx+XhGBYT1/QTU/JYkGaAkIGoPnyYvmLEDqMz2SGihqlpqfzQ==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-cover@1.6.0':
+    resolution: {integrity: sha512-Iow0h6yqSC269YUJ8HC3Q/MpCi2V55sMlbkkTTx4zPvd8mWZlC0ykrNDeAy9IJegrQ7v5E99rJwmQu25lygKLA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-crop@1.6.0':
+    resolution: {integrity: sha512-KqZkEhvs+21USdySCUDI+GFa393eDIzbi1smBqkUPTE+pRwSWMAf01D5OC3ZWB+xZsNla93BDS9iCkLHA8wang==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-displace@1.6.0':
+    resolution: {integrity: sha512-4Y10X9qwr5F+Bo5ME356XSACEF55485j5nGdiyJ9hYzjQP9nGgxNJaZ4SAOqpd+k5sFaIeD7SQ0Occ26uIng5Q==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-dither@1.6.0':
+    resolution: {integrity: sha512-600d1RxY0pKwgyU0tgMahLNKsqEcxGdbgXadCiVCoGd6V6glyCvkNrnnwC0n5aJ56Htkj88PToSdF88tNVZEEQ==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-fisheye@1.6.0':
+    resolution: {integrity: sha512-E5QHKWSCBFtpgZarlmN3Q6+rTQxjirFqo44ohoTjzYVrDI6B6beXNnPIThJgPr0Y9GwfzgyarKvQuQuqCnnfbA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-flip@1.6.0':
+    resolution: {integrity: sha512-/+rJVDuBIVOgwoyVkBjUFHtP+wmW0r+r5OQ2GpatQofToPVbJw1DdYWXlwviSx7hvixTWLKVgRWQ5Dw862emDg==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-hash@1.6.0':
+    resolution: {integrity: sha512-wWzl0kTpDJgYVbZdajTf+4NBSKvmI3bRI8q6EH9CVeIHps9VWVsUvEyb7rpbcwVLWYuzDtP2R0lTT6WeBNQH9Q==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-mask@1.6.0':
+    resolution: {integrity: sha512-Cwy7ExSJMZszvkad8NV8o/Z92X2kFUFM8mcDAhNVxU0Q6tA0op2UKRJY51eoK8r6eds/qak3FQkXakvNabdLnA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-print@1.6.0':
+    resolution: {integrity: sha512-zarTIJi8fjoGMSI/M3Xh5yY9T65p03XJmPsuNet19K/Q7mwRU6EV2pfj+28++2PV2NJ+htDF5uecAlnGyxFN2A==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-quantize@1.6.0':
+    resolution: {integrity: sha512-EmzZ/s9StYQwbpG6rUGBCisc3f64JIhSH+ncTJd+iFGtGo0YvSeMdAd+zqgiHpfZoOL54dNavZNjF4otK+mvlg==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-resize@1.6.0':
+    resolution: {integrity: sha512-uSUD1mqXN9i1SGSz5ov3keRZ7S9L32/mAQG08wUwZiEi5FpbV0K8A8l1zkazAIZi9IJzLlTauRNU41Mi8IF9fA==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-rotate@1.6.0':
+    resolution: {integrity: sha512-JagdjBLnUZGSG4xjCLkIpQOZZ3Mjbg8aGCCi4G69qR+OjNpOeGI7N2EQlfK/WE8BEHOW5vdjSyglNqcYbQBWRw==}
+    engines: {node: '>=18'}
+
+  '@jimp/plugin-threshold@1.6.0':
+    resolution: {integrity: sha512-M59m5dzLoHOVWdM41O8z9SyySzcDn43xHseOH0HavjsfQsT56GGCC4QzU1banJidbUrePhzoEdS42uFE8Fei8w==}
+    engines: {node: '>=18'}
+
+  '@jimp/types@1.6.0':
+    resolution: {integrity: sha512-7UfRsiKo5GZTAATxm2qQ7jqmUXP0DxTArztllTcYdyw6Xi5oT4RaoXynVtCD4UyLK5gJgkZJcwonoijrhYFKfg==}
+    engines: {node: '>=18'}
+
+  '@jimp/utils@1.6.0':
+    resolution: {integrity: sha512-gqFTGEosKbOkYF/WFj26jMHOI5OH2jeP1MmC/zbK6BF6VJBf8rIC5898dPfSzZEbSA0wbbV5slbntWVc5PKLFA==}
+    engines: {node: '>=18'}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@js-sdsl/ordered-map@4.4.2':
+    resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==}
+
+  '@jsdevtools/ono@7.1.3':
+    resolution: {integrity: sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==}
+
+  '@lexical/clipboard@0.35.0':
+    resolution: {integrity: sha512-ko7xSIIiayvDiqjNDX6fgH9RlcM6r9vrrvJYTcfGVBor5httx16lhIi0QJZ4+RNPvGtTjyFv4bwRmsixRRwImg==}
+
+  '@lexical/code@0.35.0':
+    resolution: {integrity: sha512-ox4DZwETQ9IA7+DS6PN8RJNwSAF7RMjL7YTVODIqFZ5tUFIf+5xoCHbz7Fll0Bvixlp12hVH90xnLwTLRGpkKw==}
+
+  '@lexical/devtools-core@0.35.0':
+    resolution: {integrity: sha512-C2wwtsMCR6ZTfO0TqpSM17RLJWyfHmifAfCTjFtOJu15p3M6NO/nHYK5Mt7YMQteuS89mOjB4ng8iwoLEZ6QpQ==}
+    peerDependencies:
+      react: '>=17.x'
+      react-dom: '>=17.x'
+
+  '@lexical/dragon@0.35.0':
+    resolution: {integrity: sha512-SL6mT5pcqrt6hEbJ16vWxip5+r3uvMd0bQV5UUxuk+cxIeuP86iTgRh0HFR7SM2dRTYovL6/tM/O+8QLAUGTIg==}
+
+  '@lexical/hashtag@0.35.0':
+    resolution: {integrity: sha512-LYJWzXuO2ZjKsvQwrLkNZiS2TsjwYkKjlDgtugzejquTBQ/o/nfSn/MmVx6EkYLOYizaJemmZbz3IBh+u732FA==}
+
+  '@lexical/history@0.35.0':
+    resolution: {integrity: sha512-onjDRLLxGbCfHexSxxrQaDaieIHyV28zCDrbxR5dxTfW8F8PxjuNyuaG0z6o468AXYECmclxkP+P4aT6poHEpQ==}
+
+  '@lexical/html@0.35.0':
+    resolution: {integrity: sha512-rXGFE5S5rKsg3tVnr1s4iEgOfCApNXGpIFI3T2jGEShaCZ5HLaBY9NVBXnE9Nb49e9bkDkpZ8FZd1qokCbQXbw==}
+
+  '@lexical/link@0.35.0':
+    resolution: {integrity: sha512-+0Wx6cBwO8TfdMzpkYFacsmgFh8X1rkiYbq3xoLvk3qV8upYxaMzK1s8Q1cpKmWyI0aZrU6z7fiK4vUqB7+69w==}
+
+  '@lexical/list@0.35.0':
+    resolution: {integrity: sha512-owsmc8iwgExBX8sFe8fKTiwJVhYULt9hD1RZ/HwfaiEtRZZkINijqReOBnW2mJfRxBzhFSWc4NG3ISB+fHYzqw==}
+
+  '@lexical/mark@0.35.0':
+    resolution: {integrity: sha512-W0hwMTAVeexvpk9/+J6n1G/sNkpI/Meq1yeDazahFLLAwXLHtvhIAq2P/klgFknDy1hr8X7rcsQuN/bqKcKHYg==}
+
+  '@lexical/markdown@0.35.0':
+    resolution: {integrity: sha512-BlNyXZAt4gWidMw0SRWrhBETY1BpPglFBZI7yzfqukFqgXRh7HUQA28OYeI/nsx9pgNob8TiUduUwShqqvOdEA==}
+
+  '@lexical/offset@0.35.0':
+    resolution: {integrity: sha512-DRE4Df6qYf2XiV6foh6KpGNmGAv2ANqt3oVXpyS6W8hTx3+cUuAA1APhCZmLNuU107um4zmHym7taCu6uXW5Yg==}
+
+  '@lexical/overflow@0.35.0':
+    resolution: {integrity: sha512-B25YvnJQTGlZcrNv7b0PJBLWq3tl8sql497OHfYYLem7EOMPKKDGJScJAKM/91D4H/mMAsx5gnA/XgKobriuTg==}
+
+  '@lexical/plain-text@0.35.0':
+    resolution: {integrity: sha512-lwBCUNMJf7Gujp2syVWMpKRahfbTv5Wq+H3HK1Q1gKH1P2IytPRxssCHvexw9iGwprSyghkKBlbF3fGpEdIJvQ==}
+
+  '@lexical/react@0.35.0':
+    resolution: {integrity: sha512-uYAZSqumH8tRymMef+A0f2hQvMwplKK9DXamcefnk3vSNDHHqRWQXpiUo6kD+rKWuQmMbVa5RW4xRQebXEW+1A==}
+    peerDependencies:
+      react: '>=17.x'
+      react-dom: '>=17.x'
+
+  '@lexical/rich-text@0.35.0':
+    resolution: {integrity: sha512-qEHu8g7vOEzz9GUz1VIUxZBndZRJPh9iJUFI+qTDHj+tQqnd5LCs+G9yz6jgNfiuWWpezTp0i1Vz/udNEuDPKQ==}
+
+  '@lexical/selection@0.35.0':
+    resolution: {integrity: sha512-mMtDE7Q0nycXdFTTH/+ta6EBrBwxBB4Tg8QwsGntzQ1Cq//d838dpXpFjJOqHEeVHUqXpiuj+cBG8+bvz/rPRw==}
+
+  '@lexical/table@0.35.0':
+    resolution: {integrity: sha512-9jlTlkVideBKwsEnEkqkdg7A3mije1SvmfiqoYnkl1kKJCLA5iH90ywx327PU0p+bdnURAytWUeZPXaEuEl2OA==}
+
+  '@lexical/text@0.35.0':
+    resolution: {integrity: sha512-uaMh46BkysV8hK8wQwp5g/ByZW+2hPDt8ahAErxtf8NuzQem1FHG/f5RTchmFqqUDVHO3qLNTv4AehEGmXv8MA==}
+
+  '@lexical/utils@0.35.0':
+    resolution: {integrity: sha512-2H393EYDnFznYCDFOW3MHiRzwEO5M/UBhtUjvTT+9kc+qhX4U3zc8ixQalo5UmZ5B2nh7L/inXdTFzvSRXtsRA==}
+
+  '@lexical/yjs@0.35.0':
+    resolution: {integrity: sha512-3DSP7QpmTGYU9bN/yljP0PIao4tNIQtsR4ycauWNSawxs/GQCZtSmAPcLRnCm6qpqsDDjUtKjO/1Ej8FRp0m0w==}
+    peerDependencies:
+      yjs: '>=13.5.22'
+
+  '@lezer/common@1.5.1':
+    resolution: {integrity: sha512-6YRVG9vBkaY7p1IVxL4s44n5nUnaNnGM2/AckNgYOnxTG2kWh1vR8BMxPseWPjRNpb5VtXnMpeYAEAADoRV1Iw==}
+
+  '@lezer/css@1.3.0':
+    resolution: {integrity: sha512-pBL7hup88KbI7hXnZV3PQsn43DHy6TWyzuyk2AO9UyoXcDltvIdqWKE1dLL/45JVZ+YZkHe1WVHqO6wugZZWcw==}
+
+  '@lezer/highlight@1.2.3':
+    resolution: {integrity: sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==}
+
+  '@lezer/html@1.3.13':
+    resolution: {integrity: sha512-oI7n6NJml729m7pjm9lvLvmXbdoMoi2f+1pwSDJkl9d68zGr7a9Btz8NdHTGQZtW2DA25ybeuv/SyDb9D5tseg==}
+
+  '@lezer/javascript@1.5.4':
+    resolution: {integrity: sha512-vvYx3MhWqeZtGPwDStM2dwgljd5smolYD2lR2UyFcHfxbBQebqx8yjmFmxtJ/E6nN6u1D9srOiVWm3Rb4tmcUA==}
+
+  '@lezer/lr@1.4.8':
+    resolution: {integrity: sha512-bPWa0Pgx69ylNlMlPvBPryqeLYQjyJjqPx+Aupm5zydLIF3NE+6MMLT8Yi23Bd9cif9VS00aUebn+6fDIGBcDA==}
+
+  '@lezer/markdown@1.6.3':
+    resolution: {integrity: sha512-jpGm5Ps+XErS+xA4urw7ogEGkeZOahVQF21Z6oECF0sj+2liwZopd2+I8uH5I/vZsRuuze3OxBREIANLf6KKUw==}
+
+  '@malept/cross-spawn-promise@2.0.0':
+    resolution: {integrity: sha512-1DpKU0Z5ThltBwjNySMC14g0CkbyhCaz9FkhxqNsZI6uAPJXFS8cMXlBKo26FJ8ZuW6S9GCMcR9IO5k2X5/9Fg==}
+    engines: {node: '>= 12.13.0'}
+
+  '@malept/flatpak-bundler@0.4.0':
+    resolution: {integrity: sha512-9QOtNffcOF/c1seMCDnjckb3R9WHcG34tky+FHpNKKCW0wc/scYLwMtO+ptyGUfMW0/b/n4qRiALlaFHc9Oj7Q==}
+    engines: {node: '>= 10.0.0'}
+
+  '@marijn/find-cluster-break@1.0.2':
+    resolution: {integrity: sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==}
+
+  '@mermaid-js/parser@1.1.0':
+    resolution: {integrity: sha512-gxK9ZX2+Fex5zu8LhRQoMeMPEHbc73UKZ0FQ54YrQtUxE1VVhMwzeNtKRPAu5aXks4FasbMe4xB4bWrmq6Jlxw==}
+
+  '@modelcontextprotocol/sdk@1.29.0':
+    resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@cfworker/json-schema': ^4.1.1
+      zod: ^3.25 || ^4.0
+    peerDependenciesMeta:
+      '@cfworker/json-schema':
+        optional: true
+
+  '@mswjs/interceptors@0.41.8':
+    resolution: {integrity: sha512-pRLMNKTSGRoLq+KnEB/7OY5vijw1XmcheAAOiv6pj7W1FG32kAGqj1C/RK/cqxRGr1Fh+zBi8sDur8kj3EQv6A==}
+    engines: {node: '>=18'}
+
+  '@next/env@14.2.35':
+    resolution: {integrity: sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==}
+
+  '@next/env@16.1.6':
+    resolution: {integrity: sha512-N1ySLuZjnAtN3kFnwhAwPvZah8RJxKasD7x1f8shFqhncnWZn4JMfg37diLNuoHsLAlrDfM3g4mawVdtAG8XLQ==}
+
+  '@next/env@16.2.1':
+    resolution: {integrity: sha512-n8P/HCkIWW+gVal2Z8XqXJ6aB3J0tuM29OcHpCsobWlChH/SITBs1DFBk/HajgrwDkqqBXPbuUuzgDvUekREPg==}
+
+  '@next/swc-darwin-arm64@14.2.33':
+    resolution: {integrity: sha512-HqYnb6pxlsshoSTubdXKu15g3iivcbsMXg4bYpjL2iS/V6aQot+iyF4BUc2qA/J/n55YtvE4PHMKWBKGCF/+wA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@next/swc-darwin-arm64@16.1.6':
+    resolution: {integrity: sha512-wTzYulosJr/6nFnqGW7FrG3jfUUlEf8UjGA0/pyypJl42ExdVgC6xJgcXQ+V8QFn6niSG2Pb8+MIG1mZr2vczw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@next/swc-darwin-arm64@16.2.1':
+    resolution: {integrity: sha512-BwZ8w8YTaSEr2HIuXLMLxIdElNMPvY9fLqb20LX9A9OMGtJilhHLbCL3ggyd0TwjmMcTxi0XXt+ur1vWUoxj2Q==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@next/swc-darwin-x64@14.2.33':
+    resolution: {integrity: sha512-8HGBeAE5rX3jzKvF593XTTFg3gxeU4f+UWnswa6JPhzaR6+zblO5+fjltJWIZc4aUalqTclvN2QtTC37LxvZAA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@next/swc-darwin-x64@16.1.6':
+    resolution: {integrity: sha512-BLFPYPDO+MNJsiDWbeVzqvYd4NyuRrEYVB5k2N3JfWncuHAy2IVwMAOlVQDFjj+krkWzhY2apvmekMkfQR0CUQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@next/swc-darwin-x64@16.2.1':
+    resolution: {integrity: sha512-/vrcE6iQSJq3uL3VGVHiXeaKbn8Es10DGTGRJnRZlkNQQk3kaNtAJg8Y6xuAlrx/6INKVjkfi5rY0iEXorZ6uA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@next/swc-linux-arm64-gnu@14.2.33':
+    resolution: {integrity: sha512-JXMBka6lNNmqbkvcTtaX8Gu5by9547bukHQvPoLe9VRBx1gHwzf5tdt4AaezW85HAB3pikcvyqBToRTDA4DeLw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-gnu@16.1.6':
+    resolution: {integrity: sha512-OJYkCd5pj/QloBvoEcJ2XiMnlJkRv9idWA/j0ugSuA34gMT6f5b7vOiCQHVRpvStoZUknhl6/UxOXL4OwtdaBw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-gnu@16.2.1':
+    resolution: {integrity: sha512-uLn+0BK+C31LTVbQ/QU+UaVrV0rRSJQ8RfniQAHPghDdgE+SlroYqcmFnO5iNjNfVWCyKZHYrs3Nl0mUzWxbBw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-musl@14.2.33':
+    resolution: {integrity: sha512-Bm+QulsAItD/x6Ih8wGIMfRJy4G73tu1HJsrccPW6AfqdZd0Sfm5Imhgkgq2+kly065rYMnCOxTBvmvFY1BKfg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-musl@16.1.6':
+    resolution: {integrity: sha512-S4J2v+8tT3NIO9u2q+S0G5KdvNDjXfAv06OhfOzNDaBn5rw84DGXWndOEB7d5/x852A20sW1M56vhC/tRVbccQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-arm64-musl@16.2.1':
+    resolution: {integrity: sha512-ssKq6iMRnHdnycGp9hCuGnXJZ0YPr4/wNwrfE5DbmvEcgl9+yv97/Kq3TPVDfYome1SW5geciLB9aiEqKXQjlQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@next/swc-linux-x64-gnu@14.2.33':
+    resolution: {integrity: sha512-FnFn+ZBgsVMbGDsTqo8zsnRzydvsGV8vfiWwUo1LD8FTmPTdV+otGSWKc4LJec0oSexFnCYVO4hX8P8qQKaSlg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-gnu@16.1.6':
+    resolution: {integrity: sha512-2eEBDkFlMMNQnkTyPBhQOAyn2qMxyG2eE7GPH2WIDGEpEILcBPI/jdSv4t6xupSP+ot/jkfrCShLAa7+ZUPcJQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-gnu@16.2.1':
+    resolution: {integrity: sha512-HQm7SrHRELJ30T1TSmT706IWovFFSRGxfgUkyWJZF/RKBMdbdRWJuFrcpDdE5vy9UXjFOx6L3mRdqH04Mmx0hg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-musl@14.2.33':
+    resolution: {integrity: sha512-345tsIWMzoXaQndUTDv1qypDRiebFxGYx9pYkhwY4hBRaOLt8UGfiWKr9FSSHs25dFIf8ZqIFaPdy5MljdoawA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-musl@16.1.6':
+    resolution: {integrity: sha512-oicJwRlyOoZXVlxmIMaTq7f8pN9QNbdes0q2FXfRsPhfCi8n8JmOZJm5oo1pwDaFbnnD421rVU409M3evFbIqg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-linux-x64-musl@16.2.1':
+    resolution: {integrity: sha512-aV2iUaC/5HGEpbBkE+4B8aHIudoOy5DYekAKOMSHoIYQ66y/wIVeaRx8MS2ZMdxe/HIXlMho4ubdZs/J8441Tg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@next/swc-win32-arm64-msvc@14.2.33':
+    resolution: {integrity: sha512-nscpt0G6UCTkrT2ppnJnFsYbPDQwmum4GNXYTeoTIdsmMydSKFz9Iny2jpaRupTb+Wl298+Rh82WKzt9LCcqSQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@next/swc-win32-arm64-msvc@16.1.6':
+    resolution: {integrity: sha512-gQmm8izDTPgs+DCWH22kcDmuUp7NyiJgEl18bcr8irXA5N2m2O+JQIr6f3ct42GOs9c0h8QF3L5SzIxcYAAXXw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@next/swc-win32-arm64-msvc@16.2.1':
+    resolution: {integrity: sha512-IXdNgiDHaSk0ZUJ+xp0OQTdTgnpx1RCfRTalhn3cjOP+IddTMINwA7DXZrwTmGDO8SUr5q2hdP/du4DcrB1GxA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@next/swc-win32-ia32-msvc@14.2.33':
+    resolution: {integrity: sha512-pc9LpGNKhJ0dXQhZ5QMmYxtARwwmWLpeocFmVG5Z0DzWq5Uf0izcI8tLc+qOpqxO1PWqZ5A7J1blrUIKrIFc7Q==}
+    engines: {node: '>= 10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@next/swc-win32-x64-msvc@14.2.33':
+    resolution: {integrity: sha512-nOjfZMy8B94MdisuzZo9/57xuFVLHJaDj5e/xrduJp9CV2/HrfxTRH2fbyLe+K9QT41WBLUd4iXX3R7jBp0EUg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@next/swc-win32-x64-msvc@16.1.6':
+    resolution: {integrity: sha512-NRfO39AIrzBnixKbjuo2YiYhB6o9d8v/ymU9m/Xk8cyVk+k7XylniXkHwjs4s70wedVffc6bQNbufk5v0xEm0A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@next/swc-win32-x64-msvc@16.2.1':
+    resolution: {integrity: sha512-qvU+3a39Hay+ieIztkGSbF7+mccbbg1Tk25hc4JDylf8IHjYmY/Zm64Qq1602yPyQqvie+vf5T/uPwNxDNIoeg==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@noble/ciphers@1.3.0':
+    resolution: {integrity: sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@noble/ciphers@2.1.1':
+    resolution: {integrity: sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==}
+    engines: {node: '>= 20.19.0'}
+
+  '@noble/curves@1.9.7':
+    resolution: {integrity: sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@noble/hashes@2.0.1':
+    resolution: {integrity: sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==}
+    engines: {node: '>= 20.19.0'}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@npmcli/fs@2.1.2':
+    resolution: {integrity: sha512-yOJKRvohFOaLqipNtwYB9WugyZKhC/DZC4VYPmpaCzDBrA8YpK3qHZ8/HGscMnE4GqbkLNuVcCnxkeQEdGt6LQ==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  '@npmcli/move-file@2.0.1':
+    resolution: {integrity: sha512-mJd2Z5TjYWq/ttPLLGqArdtnC74J6bOzg4rMDnN+p1xTacZ2yPRCk2y0oSWQtygLR9YVQXgOcONrwtnk3JupxQ==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    deprecated: This functionality has been moved to @npmcli/fs
+
+  '@open-draft/deferred-promise@2.2.0':
+    resolution: {integrity: sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==}
+
+  '@open-draft/deferred-promise@3.0.0':
+    resolution: {integrity: sha512-XW375UK8/9SqUVNVa6M0yEy8+iTi4QN5VZ7aZuRFQmy76LRwI9wy5F4YIBU6T+eTe2/DNDo8tqu8RHlwLHM6RA==}
+
+  '@open-draft/logger@0.3.0':
+    resolution: {integrity: sha512-X2g45fzhxH238HKO4xbSr7+wBS8Fvw6ixhTDuvLd5mqh6bJJCFAPwU9mPDxbcrRtfxv4u5IHCEH77BmxvXmmxQ==}
+
+  '@open-draft/until@2.1.0':
+    resolution: {integrity: sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==}
+
+  '@opencode-ai/sdk@1.4.9':
+    resolution: {integrity: sha512-S8WQLuBFu2WwvSc1wupsV4qskniBA+JN1VaZZs52BPWwiN2zQFTD5/6dMh6oiYOMDtPjKsTFZ6qLFxDvVPNggQ==}
+
+  '@opentelemetry/api-logs@0.207.0':
+    resolution: {integrity: sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==}
+    engines: {node: '>=8.0.0'}
+
+  '@opentelemetry/api@1.9.0':
+    resolution: {integrity: sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==}
+    engines: {node: '>=8.0.0'}
+
+  '@opentelemetry/context-async-hooks@2.2.0':
+    resolution: {integrity: sha512-qRkLWiUEZNAmYapZ7KGS5C4OmBLcP/H2foXeOEaowYCR0wi89fHejrfYfbuLVCMLp/dWZXKvQusdbUEZjERfwQ==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/core@2.2.0':
+    resolution: {integrity: sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/core@2.6.0':
+    resolution: {integrity: sha512-HLM1v2cbZ4TgYN6KEOj+Bbj8rAKriOdkF9Ed3tG25FoprSiQl7kYc+RRT6fUZGOvx0oMi5U67GoFdT+XUn8zEg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/exporter-logs-otlp-grpc@0.207.0':
+    resolution: {integrity: sha512-K92RN+kQGTMzFDsCzsYNGqOsXRUnko/Ckk+t/yPJao72MewOLgBUTWVHhebgkNfRCYqDz1v3K0aPT9OJkemvgg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-logs-otlp-http@0.207.0':
+    resolution: {integrity: sha512-JpOh7MguEUls8eRfkVVW3yRhClo5b9LqwWTOg8+i4gjr/+8eiCtquJnC7whvpTIGyff06cLZ2NsEj+CVP3Mjeg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-logs-otlp-proto@0.207.0':
+    resolution: {integrity: sha512-RQJEV/K6KPbQrIUbsrRkEe0ufks1o5OGLHy6jbDD8tRjeCsbFHWfg99lYBRqBV33PYZJXsigqMaAbjWGTFYzLw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-metrics-otlp-grpc@0.207.0':
+    resolution: {integrity: sha512-6flX89W54gkwmqYShdcTBR1AEF5C1Ob0O8pDgmLPikTKyEv27lByr9yBmO5WrP0+5qJuNPHrLfgFQFYi6npDGA==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-metrics-otlp-http@0.207.0':
+    resolution: {integrity: sha512-fG8FAJmvXOrKXGIRN8+y41U41IfVXxPRVwyB05LoMqYSjugx/FSBkMZUZXUT/wclTdmBKtS5MKoi0bEKkmRhSw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-metrics-otlp-proto@0.207.0':
+    resolution: {integrity: sha512-kDBxiTeQjaRlUQzS1COT9ic+et174toZH6jxaVuVAvGqmxOkgjpLOjrI5ff8SMMQE69r03L3Ll3nPKekLopLwg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-prometheus@0.207.0':
+    resolution: {integrity: sha512-Y5p1s39FvIRmU+F1++j7ly8/KSqhMmn6cMfpQqiDCqDjdDHwUtSq0XI0WwL3HYGnZeaR/VV4BNmsYQJ7GAPrhw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-trace-otlp-grpc@0.207.0':
+    resolution: {integrity: sha512-7u2ZmcIx6D4KG/+5np4X2qA0o+O0K8cnUDhR4WI/vr5ZZ0la9J9RG+tkSjC7Yz+2XgL6760gSIM7/nyd3yaBLA==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-trace-otlp-http@0.207.0':
+    resolution: {integrity: sha512-HSRBzXHIC7C8UfPQdu15zEEoBGv0yWkhEwxqgPCHVUKUQ9NLHVGXkVrf65Uaj7UwmAkC1gQfkuVYvLlD//AnUQ==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-trace-otlp-proto@0.207.0':
+    resolution: {integrity: sha512-ruUQB4FkWtxHjNmSXjrhmJZFvyMm+tBzHyMm7YPQshApy4wvZUTcrpPyP/A/rCl/8M4BwoVIZdiwijMdbZaq4w==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/exporter-zipkin@2.2.0':
+    resolution: {integrity: sha512-VV4QzhGCT7cWrGasBWxelBjqbNBbyHicWWS/66KoZoe9BzYwFB72SH2/kkc4uAviQlO8iwv2okIJy+/jqqEHTg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.0.0
+
+  '@opentelemetry/instrumentation-http@0.207.0':
+    resolution: {integrity: sha512-FC4i5hVixTzuhg4SV2ycTEAYx+0E2hm+GwbdoVPSA6kna0pPVI4etzaA9UkpJ9ussumQheFXP6rkGIaFJjMxsw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/instrumentation@0.207.0':
+    resolution: {integrity: sha512-y6eeli9+TLKnznrR8AZlQMSJT7wILpXH+6EYq5Vf/4Ao+huI7EedxQHwRgVUOMLFbe7VFDvHJrX9/f4lcwnJsA==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/otlp-exporter-base@0.207.0':
+    resolution: {integrity: sha512-4RQluMVVGMrHok/3SVeSJ6EnRNkA2MINcX88sh+d/7DjGUrewW/WT88IsMEci0wUM+5ykTpPPNbEOoW+jwHnbw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/otlp-grpc-exporter-base@0.207.0':
+    resolution: {integrity: sha512-eKFjKNdsPed4q9yYqeI5gBTLjXxDM/8jwhiC0icw3zKxHVGBySoDsed5J5q/PGY/3quzenTr3FiTxA3NiNT+nw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/otlp-transformer@0.207.0':
+    resolution: {integrity: sha512-+6DRZLqM02uTIY5GASMZWUwr52sLfNiEe20+OEaZKhztCs3+2LxoTjb6JxFRd9q1qNqckXKYlUKjbH/AhG8/ZA==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': ^1.3.0
+
+  '@opentelemetry/propagator-b3@2.2.0':
+    resolution: {integrity: sha512-9CrbTLFi5Ee4uepxg2qlpQIozoJuoAZU5sKMx0Mn7Oh+p7UrgCiEV6C02FOxxdYVRRFQVCinYR8Kf6eMSQsIsw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/propagator-jaeger@2.2.0':
+    resolution: {integrity: sha512-FfeOHOrdhiNzecoB1jZKp2fybqmqMPJUXe2ZOydP7QzmTPYcfPeuaclTLYVhK3HyJf71kt8sTl92nV4YIaLaKA==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/resources@2.2.0':
+    resolution: {integrity: sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+  '@opentelemetry/resources@2.6.0':
+    resolution: {integrity: sha512-D4y/+OGe3JSuYUCBxtH5T9DSAWNcvCb/nQWIga8HNtXTVPQn59j0nTBAgaAXxUVBDl40mG3Tc76b46wPlZaiJQ==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+  '@opentelemetry/sdk-logs@0.207.0':
+    resolution: {integrity: sha512-4MEQmn04y+WFe6cyzdrXf58hZxilvY59lzZj2AccuHW/+BxLn/rGVN/Irsi/F0qfBOpMOrrCLKTExoSL2zoQmg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.4.0 <1.10.0'
+
+  '@opentelemetry/sdk-metrics@2.2.0':
+    resolution: {integrity: sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.9.0 <1.10.0'
+
+  '@opentelemetry/sdk-node@0.207.0':
+    resolution: {integrity: sha512-hnRsX/M8uj0WaXOBvFenQ8XsE8FLVh2uSnn1rkWu4mx+qu7EKGUZvZng6y/95cyzsqOfiaDDr08Ek4jppkIDNg==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+  '@opentelemetry/sdk-trace-base@2.2.0':
+    resolution: {integrity: sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+  '@opentelemetry/sdk-trace-base@2.6.0':
+    resolution: {integrity: sha512-g/OZVkqlxllgFM7qMKqbPV9c1DUPhQ7d4n3pgZFcrnrNft9eJXZM2TNHTPYREJBrtNdRytYyvwjgL5geDKl3EQ==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+  '@opentelemetry/sdk-trace-node@2.2.0':
+    resolution: {integrity: sha512-+OaRja3f0IqGG2kptVeYsrZQK9nKRSpfFrKtRBq4uh6nIB8bTBgaGvYQrQoRrQWQMA5dK5yLhDMDc0dvYvCOIQ==}
+    engines: {node: ^18.19.0 || >=20.6.0}
+    peerDependencies:
+      '@opentelemetry/api': '>=1.0.0 <1.10.0'
+
+  '@opentelemetry/semantic-conventions@1.40.0':
+    resolution: {integrity: sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw==}
+    engines: {node: '>=14'}
+
+  '@opentui/core-darwin-arm64@0.1.77':
+    resolution: {integrity: sha512-SNqmygCMEsPCW7xWjzCZ5caBf36xaprwVdAnFijGDOuIzLA4iaDa6um8cj3TJh7awenN3NTRsuRc7OuH42UH+g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@opentui/core-darwin-x64@0.1.77':
+    resolution: {integrity: sha512-/8fsa03swEHTQt/9NrGm98kemlU+VuTURI/OFZiH53vPDRrOYIYoa4Jyga/H7ZMcG+iFhkq97zIe+0Kw95LGmA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@opentui/core-linux-arm64@0.1.77':
+    resolution: {integrity: sha512-QfUXZJPc69OvqoMu+AlLgjqXrwu4IeqcBuUWYMuH8nPTeLsVUc3CBbXdV2lv9UDxWzxzrxdS4ALPaxvmEv9lsQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@opentui/core-linux-x64@0.1.77':
+    resolution: {integrity: sha512-Kmfx0yUKnPj67AoXYIgL7qQo0QVsUG5Iw8aRtv6XFzXqa5SzBPhaKkKZ9yHPjOmTalZquUs+9zcCRNKpYYuL7A==}
+    cpu: [x64]
+    os: [linux]
+
+  '@opentui/core-win32-arm64@0.1.77':
+    resolution: {integrity: sha512-HGTscPXc7gdd23Nh1DbzUNjog1I+5IZp95XPtLftGTpjrWs60VcetXcyJqK2rQcXNxewJK5yDyaa5QyMjfEhCQ==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@opentui/core-win32-x64@0.1.77':
+    resolution: {integrity: sha512-c7GijsbvVgnlzd2murIbwuwrGbcv76KdUw6WlVv7a0vex50z6xJCpv1keGzpe0QfxrZ/6fFEFX7JnwGLno0wjA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@opentui/core@0.1.77':
+    resolution: {integrity: sha512-lE3kabm6jdqK3AuBq+O0zZrXdxt6ulmibTc57sf+AsPny6cmwYHnWI4wD6hcreFiYoQVNVvdiJchVgPtowMlEg==}
+    peerDependencies:
+      web-tree-sitter: 0.25.10
+
+  '@opentui/solid@0.1.77':
+    resolution: {integrity: sha512-JY+hUbXVV+XCk6bC8dvcwawWCEmC3Gid6GDs23AJWBgHZ3TU2kRKrgwTdltm45DOq2cZXrYCt690/yE8bP+Gxg==}
+    peerDependencies:
+      solid-js: 1.9.9
+
+  '@paper-design/shaders-react@0.0.72':
+    resolution: {integrity: sha512-q6KwquL93ZVNcuSM7pqzW0z/VLjnDVb/NSpYyGJBxf7MEHHCXx37E+zw/Px6RZLt3SGCUerIDDCGCMT385oW0w==}
+    peerDependencies:
+      '@types/react': ^18 || ^19
+      react: ^18 || ^19
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@paper-design/shaders@0.0.72':
+    resolution: {integrity: sha512-rk2BFuV5ood2DaivbxJC2jQMzaB434isDUzdUQ85Cy0OWnUMuxl8kyGMR74TDPyjo3EvcHIyreNLkJdRG+GfSA==}
+
+  '@pinojs/redact@0.4.0':
+    resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
+
+  '@pkgjs/parseargs@0.11.0':
+    resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
+    engines: {node: '>=14'}
+
+  '@planetscale/database@1.19.0':
+    resolution: {integrity: sha512-Tv4jcFUFAFjOWrGSio49H6R2ijALv0ZzVBfJKIdm+kl9X046Fh4LLawrF9OMsglVbK6ukqMJsUCeucGAFTBcMA==}
+    engines: {node: '>=16'}
+
+  '@playwright/test@1.58.2':
+    resolution: {integrity: sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  '@protobufjs/aspromise@1.1.2':
+    resolution: {integrity: sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==}
+
+  '@protobufjs/base64@1.1.2':
+    resolution: {integrity: sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==}
+
+  '@protobufjs/codegen@2.0.4':
+    resolution: {integrity: sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==}
+
+  '@protobufjs/eventemitter@1.1.0':
+    resolution: {integrity: sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==}
+
+  '@protobufjs/fetch@1.1.0':
+    resolution: {integrity: sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==}
+
+  '@protobufjs/float@1.0.2':
+    resolution: {integrity: sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==}
+
+  '@protobufjs/inquire@1.1.0':
+    resolution: {integrity: sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==}
+
+  '@protobufjs/path@1.1.2':
+    resolution: {integrity: sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==}
+
+  '@protobufjs/pool@1.1.0':
+    resolution: {integrity: sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==}
+
+  '@protobufjs/utf8@1.1.0':
+    resolution: {integrity: sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==}
+
+  '@radix-ui/colors@3.0.0':
+    resolution: {integrity: sha512-FUOsGBkHrYJwCSEtWRCIfQbZG7q1e6DgxCIOe1SUQzDe/7rXXeA47s8yCn6fuTNQAj1Zq4oTFi9Yjp3wzElcxg==}
+
+  '@rolldown/pluginutils@1.0.0-rc.3':
+    resolution: {integrity: sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==}
+
+  '@rollup/rollup-android-arm-eabi@4.55.1':
+    resolution: {integrity: sha512-9R0DM/ykwfGIlNu6+2U09ga0WXeZ9MRC2Ter8jnz8415VbuIykVuc6bhdrbORFZANDmTDvq26mJrEVTl8TdnDg==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.55.1':
+    resolution: {integrity: sha512-eFZCb1YUqhTysgW3sj/55du5cG57S7UTNtdMjCW7LwVcj3dTTcowCsC8p7uBdzKsZYa8J7IDE8lhMI+HX1vQvg==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.55.1':
+    resolution: {integrity: sha512-p3grE2PHcQm2e8PSGZdzIhCKbMCw/xi9XvMPErPhwO17vxtvCN5FEA2mSLgmKlCjHGMQTP6phuQTYWUnKewwGg==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.55.1':
+    resolution: {integrity: sha512-rDUjG25C9qoTm+e02Esi+aqTKSBYwVTaoS1wxcN47/Luqef57Vgp96xNANwt5npq9GDxsH7kXxNkJVEsWEOEaQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.55.1':
+    resolution: {integrity: sha512-+JiU7Jbp5cdxekIgdte0jfcu5oqw4GCKr6i3PJTlXTCU5H5Fvtkpbs4XJHRmWNXF+hKmn4v7ogI5OQPaupJgOg==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.55.1':
+    resolution: {integrity: sha512-V5xC1tOVWtLLmr3YUk2f6EJK4qksksOYiz/TCsFHu/R+woubcLWdC9nZQmwjOAbmExBIVKsm1/wKmEy4z4u4Bw==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.55.1':
+    resolution: {integrity: sha512-Rn3n+FUk2J5VWx+ywrG/HGPTD9jXNbicRtTM11e/uorplArnXZYsVifnPPqNNP5BsO3roI4n8332ukpY/zN7rQ==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.55.1':
+    resolution: {integrity: sha512-grPNWydeKtc1aEdrJDWk4opD7nFtQbMmV7769hiAaYyUKCT1faPRm2av8CX1YJsZ4TLAZcg9gTR1KvEzoLjXkg==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-gnu@4.55.1':
+    resolution: {integrity: sha512-a59mwd1k6x8tXKcUxSyISiquLwB5pX+fJW9TkWU46lCqD/GRDe9uDN31jrMmVP3feI3mhAdvcCClhV8V5MhJFQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-musl@4.55.1':
+    resolution: {integrity: sha512-puS1MEgWX5GsHSoiAsF0TYrpomdvkaXm0CofIMG5uVkP6IBV+ZO9xhC5YEN49nsgYo1DuuMquF9+7EDBVYu4uA==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-gnu@4.55.1':
+    resolution: {integrity: sha512-r3Wv40in+lTsULSb6nnoudVbARdOwb2u5fpeoOAZjFLznp6tDU8kd+GTHmJoqZ9lt6/Sys33KdIHUaQihFcu7g==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-musl@4.55.1':
+    resolution: {integrity: sha512-MR8c0+UxAlB22Fq4R+aQSPBayvYa3+9DrwG/i1TKQXFYEaoW3B5b/rkSRIypcZDdWjWnpcvxbNaAJDcSbJU3Lw==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.55.1':
+    resolution: {integrity: sha512-3KhoECe1BRlSYpMTeVrD4sh2Pw2xgt4jzNSZIIPLFEsnQn9gAnZagW9+VqDqAHgm1Xc77LzJOo2LdigS5qZ+gw==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-musl@4.55.1':
+    resolution: {integrity: sha512-ziR1OuZx0vdYZZ30vueNZTg73alF59DicYrPViG0NEgDVN8/Jl87zkAPu4u6VjZST2llgEUjaiNl9JM6HH1Vdw==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.55.1':
+    resolution: {integrity: sha512-uW0Y12ih2XJRERZ4jAfKamTyIHVMPQnTZcQjme2HMVDAHY4amf5u414OqNYC+x+LzRdRcnIG1YodLrrtA8xsxw==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-musl@4.55.1':
+    resolution: {integrity: sha512-u9yZ0jUkOED1BFrqu3BwMQoixvGHGZ+JhJNkNKY/hyoEgOwlqKb62qu+7UjbPSHYjiVy8kKJHvXKv5coH4wDeg==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-s390x-gnu@4.55.1':
+    resolution: {integrity: sha512-/0PenBCmqM4ZUd0190j7J0UsQ/1nsi735iPRakO8iPciE7BQ495Y6msPzaOmvx0/pn+eJVVlZrNrSh4WSYLxNg==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-gnu@4.55.1':
+    resolution: {integrity: sha512-a8G4wiQxQG2BAvo+gU6XrReRRqj+pLS2NGXKm8io19goR+K8lw269eTrPkSdDTALwMmJp4th2Uh0D8J9bEV1vg==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-musl@4.55.1':
+    resolution: {integrity: sha512-bD+zjpFrMpP/hqkfEcnjXWHMw5BIghGisOKPj+2NaNDuVT+8Ds4mPf3XcPHuat1tz89WRL+1wbcxKY3WSbiT7w==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-openbsd-x64@4.55.1':
+    resolution: {integrity: sha512-eLXw0dOiqE4QmvikfQ6yjgkg/xDM+MdU9YJuP4ySTibXU0oAvnEWXt7UDJmD4UkYialMfOGFPJnIHSe/kdzPxg==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.55.1':
+    resolution: {integrity: sha512-xzm44KgEP11te3S2HCSyYf5zIzWmx3n8HDCc7EE59+lTcswEWNpvMLfd9uJvVX8LCg9QWG67Xt75AuHn4vgsXw==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.55.1':
+    resolution: {integrity: sha512-yR6Bl3tMC/gBok5cz/Qi0xYnVbIxGx5Fcf/ca0eB6/6JwOY+SRUcJfI0OpeTpPls7f194as62thCt/2BjxYN8g==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.55.1':
+    resolution: {integrity: sha512-3fZBidchE0eY0oFZBnekYCfg+5wAB0mbpCBuofh5mZuzIU/4jIVkbESmd2dOsFNS78b53CYv3OAtwqkZZmU5nA==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.55.1':
+    resolution: {integrity: sha512-xGGY5pXj69IxKb4yv/POoocPy/qmEGhimy/FoTpTSVju3FYXUQQMFCaZZXJVidsmGxRioZAwpThl/4zX41gRKg==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.55.1':
+    resolution: {integrity: sha512-SPEpaL6DX4rmcXtnhdrQYgzQ5W2uW3SCJch88lB2zImhJRhIIK44fkUrgIV/Q8yUNfw5oyZ5vkeQsZLhCb06lw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@sec-ant/readable-stream@0.4.1':
+    resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
+
+  '@sindresorhus/is@4.6.0':
+    resolution: {integrity: sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw==}
+    engines: {node: '>=10'}
+
+  '@sindresorhus/merge-streams@4.0.0':
+    resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
+    engines: {node: '>=18'}
+
+  '@slack/logger@4.0.0':
+    resolution: {integrity: sha512-Wz7QYfPAlG/DR+DfABddUZeNgoeY7d1J39OCR2jR+v7VBsB8ezulDK5szTnDDPDwLH5IWhLvXIHlCFZV7MSKgA==}
+    engines: {node: '>= 18', npm: '>= 8.6.0'}
+
+  '@slack/socket-mode@2.0.5':
+    resolution: {integrity: sha512-VaapvmrAifeFLAFaDPfGhEwwunTKsI6bQhYzxRXw7BSujZUae5sANO76WqlVsLXuhVtCVrBWPiS2snAQR2RHJQ==}
+    engines: {node: '>= 18', npm: '>= 8.6.0'}
+
+  '@slack/types@2.19.0':
+    resolution: {integrity: sha512-7+QZ38HGcNh/b/7MpvPG6jnw7mliV6UmrquJLqgdxkzJgQEYUcEztvFWRU49z0x4vthF0ixL5lTK601AXrS8IA==}
+    engines: {node: '>= 12.13.0', npm: '>= 6.12.0'}
+
+  '@slack/web-api@7.13.0':
+    resolution: {integrity: sha512-ERcExbWrnkDN8ovoWWe6Wgt/usanj1dWUd18dJLpctUI4mlPS0nKt81Joh8VI+OPbNnY1lIilVt9gdMBD9U2ig==}
+    engines: {node: '>= 18', npm: '>= 8.6.0'}
+
+  '@smithy/abort-controller@4.2.12':
+    resolution: {integrity: sha512-xolrFw6b+2iYGl6EcOL7IJY71vvyZ0DJ3mcKtpykqPe2uscwtzDZJa1uVQXyP7w9Dd+kGwYnPbMsJrGISKiY/Q==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/chunked-blob-reader-native@4.2.3':
+    resolution: {integrity: sha512-jA5k5Udn7Y5717L86h4EIv06wIr3xn8GM1qHRi/Nf31annXcXHJjBKvgztnbn2TxH3xWrPBfgwHsOwZf0UmQWw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/chunked-blob-reader@5.2.2':
+    resolution: {integrity: sha512-St+kVicSyayWQca+I1rGitaOEH6uKgE8IUWoYnnEX26SWdWQcL6LvMSD19Lg+vYHKdT9B2Zuu7rd3i6Wnyb/iw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/config-resolver@4.4.11':
+    resolution: {integrity: sha512-YxFiiG4YDAtX7WMN7RuhHZLeTmRRAOyCbr+zB8e3AQzHPnUhS8zXjB1+cniPVQI3xbWsQPM0X2aaIkO/ME0ymw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/core@3.23.11':
+    resolution: {integrity: sha512-952rGf7hBRnhUIaeLp6q4MptKW8sPFe5VvkoZ5qIzFAtx6c/QZ/54FS3yootsyUSf9gJX/NBqEBNdNR7jMIlpQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/credential-provider-imds@4.2.12':
+    resolution: {integrity: sha512-cr2lR792vNZcYMriSIj+Um3x9KWrjcu98kn234xA6reOAFMmbRpQMOv8KPgEmLLtx3eldU6c5wALKFqNOhugmg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/eventstream-codec@4.2.12':
+    resolution: {integrity: sha512-FE3bZdEl62ojmy8x4FHqxq2+BuOHlcxiH5vaZ6aqHJr3AIZzwF5jfx8dEiU/X0a8RboyNDjmXjlbr8AdEyLgiA==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/eventstream-serde-browser@4.2.12':
+    resolution: {integrity: sha512-XUSuMxlTxV5pp4VpqZf6Sa3vT/Q75FVkLSpSSE3KkWBvAQWeuWt1msTv8fJfgA4/jcJhrbrbMzN1AC/hvPmm5A==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/eventstream-serde-config-resolver@4.3.12':
+    resolution: {integrity: sha512-7epsAZ3QvfHkngz6RXQYseyZYHlmWXSTPOfPmXkiS+zA6TBNo1awUaMFL9vxyXlGdoELmCZyZe1nQE+imbmV+Q==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/eventstream-serde-node@4.2.12':
+    resolution: {integrity: sha512-D1pFuExo31854eAvg89KMn9Oab/wEeJR6Buy32B49A9Ogdtx5fwZPqBHUlDzaCDpycTFk2+fSQgX689Qsk7UGA==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/eventstream-serde-universal@4.2.12':
+    resolution: {integrity: sha512-+yNuTiyBACxOJUTvbsNsSOfH9G9oKbaJE1lNL3YHpGcuucl6rPZMi3nrpehpVOVR2E07YqFFmtwpImtpzlouHQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/fetch-http-handler@5.3.15':
+    resolution: {integrity: sha512-T4jFU5N/yiIfrtrsb9uOQn7RdELdM/7HbyLNr6uO/mpkj1ctiVs7CihVr51w4LyQlXWDpXFn4BElf1WmQvZu/A==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/hash-blob-browser@4.2.13':
+    resolution: {integrity: sha512-YrF4zWKh+ghLuquldj6e/RzE3xZYL8wIPfkt0MqCRphVICjyyjH8OwKD7LLlKpVEbk4FLizFfC1+gwK6XQdR3g==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/hash-node@4.2.12':
+    resolution: {integrity: sha512-QhBYbGrbxTkZ43QoTPrK72DoYviDeg6YKDrHTMJbbC+A0sml3kSjzFtXP7BtbyJnXojLfTQldGdUR0RGD8dA3w==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/hash-stream-node@4.2.12':
+    resolution: {integrity: sha512-O3YbmGExeafuM/kP7Y8r6+1y0hIh3/zn6GROx0uNlB54K9oihAL75Qtc+jFfLNliTi6pxOAYZrRKD9A7iA6UFw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/invalid-dependency@4.2.12':
+    resolution: {integrity: sha512-/4F1zb7Z8LOu1PalTdESFHR0RbPwHd3FcaG1sI3UEIriQTWakysgJr65lc1jj6QY5ye7aFsisajotH6UhWfm/g==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/is-array-buffer@2.2.0':
+    resolution: {integrity: sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==}
+    engines: {node: '>=14.0.0'}
+
+  '@smithy/is-array-buffer@4.2.2':
+    resolution: {integrity: sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/md5-js@4.2.12':
+    resolution: {integrity: sha512-W/oIpHCpWU2+iAkfZYyGWE+qkpuf3vEXHLxQQDx9FPNZTTdnul0dZ2d/gUFrtQ5je1G2kp4cjG0/24YueG2LbQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/middleware-content-length@4.2.12':
+    resolution: {integrity: sha512-YE58Yz+cvFInWI/wOTrB+DbvUVz/pLn5mC5MvOV4fdRUc6qGwygyngcucRQjAhiCEbmfLOXX0gntSIcgMvAjmA==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/middleware-endpoint@4.4.25':
+    resolution: {integrity: sha512-dqjLwZs2eBxIUG6Qtw8/YZ4DvzHGIf0DA18wrgtfP6a50UIO7e2nY0FPdcbv5tVJKqWCCU5BmGMOUwT7Puan+A==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/middleware-retry@4.4.42':
+    resolution: {integrity: sha512-vbwyqHRIpIZutNXZpLAozakzamcINaRCpEy1MYmK6xBeW3xN+TyPRA123GjXnuxZIjc9848MRRCugVMTXxC4Eg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/middleware-serde@4.2.14':
+    resolution: {integrity: sha512-+CcaLoLa5apzSRtloOyG7lQvkUw2ZDml3hRh4QiG9WyEPfW5Ke/3tPOPiPjUneuT59Tpn8+c3RVaUvvkkwqZwg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/middleware-stack@4.2.12':
+    resolution: {integrity: sha512-kruC5gRHwsCOuyCd4ouQxYjgRAym2uDlCvQ5acuMtRrcdfg7mFBg6blaxcJ09STpt3ziEkis6bhg1uwrWU7txw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/node-config-provider@4.3.12':
+    resolution: {integrity: sha512-tr2oKX2xMcO+rBOjobSwVAkV05SIfUKz8iI53rzxEmgW3GOOPOv0UioSDk+J8OpRQnpnhsO3Af6IEBabQBVmiw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/node-http-handler@4.4.16':
+    resolution: {integrity: sha512-ULC8UCS/HivdCB3jhi+kLFYe4B5gxH2gi9vHBfEIiRrT2jfKiZNiETJSlzRtE6B26XbBHjPtc8iZKSNqMol9bw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/property-provider@4.2.12':
+    resolution: {integrity: sha512-jqve46eYU1v7pZ5BM+fmkbq3DerkSluPr5EhvOcHxygxzD05ByDRppRwRPPpFrsFo5yDtCYLKu+kreHKVrvc7A==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/protocol-http@5.3.12':
+    resolution: {integrity: sha512-fit0GZK9I1xoRlR4jXmbLhoN0OdEpa96ul8M65XdmXnxXkuMxM0Y8HDT0Fh0Xb4I85MBvBClOzgSrV1X2s1Hxw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/querystring-builder@4.2.12':
+    resolution: {integrity: sha512-6wTZjGABQufekycfDGMEB84BgtdOE/rCVTov+EDXQ8NHKTUNIp/j27IliwP7tjIU9LR+sSzyGBOXjeEtVgzCHg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/querystring-parser@4.2.12':
+    resolution: {integrity: sha512-P2OdvrgiAKpkPNKlKUtWbNZKB1XjPxM086NeVhK+W+wI46pIKdWBe5QyXvhUm3MEcyS/rkLvY8rZzyUdmyDZBw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/service-error-classification@4.2.12':
+    resolution: {integrity: sha512-LlP29oSQN0Tw0b6D0Xo6BIikBswuIiGYbRACy5ujw/JgWSzTdYj46U83ssf6Ux0GyNJVivs2uReU8pt7Eu9okQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/shared-ini-file-loader@4.4.7':
+    resolution: {integrity: sha512-HrOKWsUb+otTeo1HxVWeEb99t5ER1XrBi/xka2Wv6NVmTbuCUC1dvlrksdvxFtODLBjsC+PHK+fuy2x/7Ynyiw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/signature-v4@5.3.12':
+    resolution: {integrity: sha512-B/FBwO3MVOL00DaRSXfXfa/TRXRheagt/q5A2NM13u7q+sHS59EOVGQNfG7DkmVtdQm5m3vOosoKAXSqn/OEgw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/smithy-client@4.12.5':
+    resolution: {integrity: sha512-UqwYawyqSr/aog8mnLnfbPurS0gi4G7IYDcD28cUIBhsvWs1+rQcL2IwkUQ+QZ7dibaoRzhNF99fAQ9AUcO00w==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/types@4.13.1':
+    resolution: {integrity: sha512-787F3yzE2UiJIQ+wYW1CVg2odHjmaWLGksnKQHUrK/lYZSEcy1msuLVvxaR/sI2/aDe9U+TBuLsXnr3vod1g0g==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/url-parser@4.2.12':
+    resolution: {integrity: sha512-wOPKPEpso+doCZGIlr+e1lVI6+9VAKfL4kZWFgzVgGWY2hZxshNKod4l2LXS3PRC9otH/JRSjtEHqQ/7eLciRA==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-base64@4.3.2':
+    resolution: {integrity: sha512-XRH6b0H/5A3SgblmMa5ErXQ2XKhfbQB+Fm/oyLZ2O2kCUrwgg55bU0RekmzAhuwOjA9qdN5VU2BprOvGGUkOOQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-body-length-browser@4.2.2':
+    resolution: {integrity: sha512-JKCrLNOup3OOgmzeaKQwi4ZCTWlYR5H4Gm1r2uTMVBXoemo1UEghk5vtMi1xSu2ymgKVGW631e2fp9/R610ZjQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-body-length-node@4.2.3':
+    resolution: {integrity: sha512-ZkJGvqBzMHVHE7r/hcuCxlTY8pQr1kMtdsVPs7ex4mMU+EAbcXppfo5NmyxMYi2XU49eqaz56j2gsk4dHHPG/g==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-buffer-from@2.2.0':
+    resolution: {integrity: sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==}
+    engines: {node: '>=14.0.0'}
+
+  '@smithy/util-buffer-from@4.2.2':
+    resolution: {integrity: sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-config-provider@4.2.2':
+    resolution: {integrity: sha512-dWU03V3XUprJwaUIFVv4iOnS1FC9HnMHDfUrlNDSh4315v0cWyaIErP8KiqGVbf5z+JupoVpNM7ZB3jFiTejvQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-defaults-mode-browser@4.3.41':
+    resolution: {integrity: sha512-M1w1Ux0rSVvBOxIIiqbxvZvhnjQ+VUjJrugtORE90BbadSTH+jsQL279KRL3Hv0w69rE7EuYkV/4Lepz/NBW9g==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-defaults-mode-node@4.2.44':
+    resolution: {integrity: sha512-YPze3/lD1KmWuZsl9JlfhcgGLX7AXhSoaCDtiPntUjNW5/YY0lOHjkcgxyE9x/h5vvS1fzDifMGjzqnNlNiqOQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-endpoints@3.3.3':
+    resolution: {integrity: sha512-VACQVe50j0HZPjpwWcjyT51KUQ4AnsvEaQ2lKHOSL4mNLD0G9BjEniQ+yCt1qqfKfiAHRAts26ud7hBjamrwig==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-hex-encoding@4.2.2':
+    resolution: {integrity: sha512-Qcz3W5vuHK4sLQdyT93k/rfrUwdJ8/HZ+nMUOyGdpeGA1Wxt65zYwi3oEl9kOM+RswvYq90fzkNDahPS8K0OIg==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-middleware@4.2.12':
+    resolution: {integrity: sha512-Er805uFUOvgc0l8nv0e0su0VFISoxhJ/AwOn3gL2NWNY2LUEldP5WtVcRYSQBcjg0y9NfG8JYrCJaYDpupBHJQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-retry@4.2.12':
+    resolution: {integrity: sha512-1zopLDUEOwumjcHdJ1mwBHddubYF8GMQvstVCLC54Y46rqoHwlIU+8ZzUeaBcD+WCJHyDGSeZ2ml9YSe9aqcoQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-stream@4.5.19':
+    resolution: {integrity: sha512-v4sa+3xTweL1CLO2UP0p7tvIMH/Rq1X4KKOxd568mpe6LSLMQCnDHs4uv7m3ukpl3HvcN2JH6jiCS0SNRXKP/w==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-uri-escape@4.2.2':
+    resolution: {integrity: sha512-2kAStBlvq+lTXHyAZYfJRb/DfS3rsinLiwb+69SstC9Vb0s9vNWkRwpnj918Pfi85mzi42sOqdV72OLxWAISnw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-utf8@2.3.0':
+    resolution: {integrity: sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==}
+    engines: {node: '>=14.0.0'}
+
+  '@smithy/util-utf8@4.2.2':
+    resolution: {integrity: sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/util-waiter@4.2.13':
+    resolution: {integrity: sha512-2zdZ9DTHngRtcYxJK1GUDxruNr53kv5W2Lupe0LMU+Imr6ohQg8M2T14MNkj1Y0wS3FFwpgpGQyvuaMF7CiTmQ==}
+    engines: {node: '>=18.0.0'}
+
+  '@smithy/uuid@1.1.2':
+    resolution: {integrity: sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g==}
+    engines: {node: '>=18.0.0'}
+
+  '@solid-primitives/event-bus@1.1.2':
+    resolution: {integrity: sha512-l+n10/51neGcMaP3ypYt21bXfoeWh8IaC8k7fYuY3ww2a8S1Zv2N2a7FF5Qn+waTu86l0V8/nRHjkyqVIZBYwA==}
+    peerDependencies:
+      solid-js: ^1.6.12
+
+  '@solid-primitives/storage@4.3.3':
+    resolution: {integrity: sha512-ACbNwMZ1s8VAvld6EUXkDkX/US3IhtlPLxg6+B2s9MwNUugwdd51I98LPEaHrdLpqPmyzqgoJe0TxEFlf3Dqrw==}
+    peerDependencies:
+      '@tauri-apps/plugin-store': '*'
+      solid-js: ^1.6.12
+      solid-start: '*'
+    peerDependenciesMeta:
+      '@tauri-apps/plugin-store':
+        optional: true
+      solid-start:
+        optional: true
+
+  '@solid-primitives/utils@6.3.2':
+    resolution: {integrity: sha512-hZ/M/qr25QOCcwDPOHtGjxTD8w2mNyVAYvcfgwzBHq2RwNqHNdDNsMZYap20+ruRwW4A3Cdkczyoz0TSxLCAPQ==}
+    peerDependencies:
+      solid-js: ^1.6.12
+
+  '@solidjs/router@0.15.4':
+    resolution: {integrity: sha512-WOpgg9a9T638cR+5FGbFi/IV4l2FpmBs1GpIMSPa0Ce9vyJN7Wts+X2PqMf9IYn0zUj2MlSJtm1gp7/HI/n5TQ==}
+    peerDependencies:
+      solid-js: ^1.8.6
+
+  '@standard-community/standard-json@0.3.5':
+    resolution: {integrity: sha512-4+ZPorwDRt47i+O7RjyuaxHRK/37QY/LmgxlGrRrSTLYoFatEOzvqIc85GTlM18SFZ5E91C+v0o/M37wZPpUHA==}
+    peerDependencies:
+      '@standard-schema/spec': ^1.0.0
+      '@types/json-schema': ^7.0.15
+      '@valibot/to-json-schema': ^1.3.0
+      arktype: ^2.1.20
+      effect: ^3.16.8
+      quansync: ^0.2.11
+      sury: ^10.0.0
+      typebox: ^1.0.17
+      valibot: ^1.1.0
+      zod: ^3.25.0 || ^4.0.0
+      zod-to-json-schema: ^3.24.5
+    peerDependenciesMeta:
+      '@valibot/to-json-schema':
+        optional: true
+      arktype:
+        optional: true
+      effect:
+        optional: true
+      sury:
+        optional: true
+      typebox:
+        optional: true
+      valibot:
+        optional: true
+      zod:
+        optional: true
+      zod-to-json-schema:
+        optional: true
+
+  '@standard-community/standard-openapi@0.2.9':
+    resolution: {integrity: sha512-htj+yldvN1XncyZi4rehbf9kLbu8os2Ke/rfqoZHCMHuw34kiF3LP/yQPdA0tQ940y8nDq3Iou8R3wG+AGGyvg==}
+    peerDependencies:
+      '@standard-community/standard-json': ^0.3.5
+      '@standard-schema/spec': ^1.0.0
+      arktype: ^2.1.20
+      effect: ^3.17.14
+      openapi-types: ^12.1.3
+      sury: ^10.0.0
+      typebox: ^1.0.0
+      valibot: ^1.1.0
+      zod: ^3.25.0 || ^4.0.0
+      zod-openapi: ^4
+    peerDependenciesMeta:
+      arktype:
+        optional: true
+      effect:
+        optional: true
+      sury:
+        optional: true
+      typebox:
+        optional: true
+      valibot:
+        optional: true
+      zod:
+        optional: true
+      zod-openapi:
+        optional: true
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+  '@swc/counter@0.1.3':
+    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
+
+  '@swc/helpers@0.5.15':
+    resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
+
+  '@swc/helpers@0.5.5':
+    resolution: {integrity: sha512-KGYxvIOXcceOAbEk4bi/dVLEK9z8sZ0uBB3Il5b1rhfClSpcX0yfRO0KmTkqR2cnQDymwLB+25ZyMzICg/cm/A==}
+
+  '@szmarczak/http-timer@4.0.6':
+    resolution: {integrity: sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==}
+    engines: {node: '>=10'}
+
+  '@tailwindcss/node@4.1.18':
+    resolution: {integrity: sha512-DoR7U1P7iYhw16qJ49fgXUlry1t4CpXeErJHnQ44JgTSKMaZUdf17cfn5mHchfJ4KRBZRFA/Coo+MUF5+gOaCQ==}
+
+  '@tailwindcss/oxide-android-arm64@4.1.18':
+    resolution: {integrity: sha512-dJHz7+Ugr9U/diKJA0W6N/6/cjI+ZTAoxPf9Iz9BFRF2GzEX8IvXxFIi/dZBloVJX/MZGvRuFA9rqwdiIEZQ0Q==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [android]
+
+  '@tailwindcss/oxide-darwin-arm64@4.1.18':
+    resolution: {integrity: sha512-Gc2q4Qhs660bhjyBSKgq6BYvwDz4G+BuyJ5H1xfhmDR3D8HnHCmT/BSkvSL0vQLy/nkMLY20PQ2OoYMO15Jd0A==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tailwindcss/oxide-darwin-x64@4.1.18':
+    resolution: {integrity: sha512-FL5oxr2xQsFrc3X9o1fjHKBYBMD1QZNyc1Xzw/h5Qu4XnEBi3dZn96HcHm41c/euGV+GRiXFfh2hUCyKi/e+yw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tailwindcss/oxide-freebsd-x64@4.1.18':
+    resolution: {integrity: sha512-Fj+RHgu5bDodmV1dM9yAxlfJwkkWvLiRjbhuO2LEtwtlYlBgiAT4x/j5wQr1tC3SANAgD+0YcmWVrj8R9trVMA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.18':
+    resolution: {integrity: sha512-Fp+Wzk/Ws4dZn+LV2Nqx3IilnhH51YZoRaYHQsVq3RQvEl+71VGKFpkfHrLM/Li+kt5c0DJe/bHXK1eHgDmdiA==}
+    engines: {node: '>= 10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@tailwindcss/oxide-linux-arm64-gnu@4.1.18':
+    resolution: {integrity: sha512-S0n3jboLysNbh55Vrt7pk9wgpyTTPD0fdQeh7wQfMqLPM/Hrxi+dVsLsPrycQjGKEQk85Kgbx+6+QnYNiHalnw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@tailwindcss/oxide-linux-arm64-musl@4.1.18':
+    resolution: {integrity: sha512-1px92582HkPQlaaCkdRcio71p8bc8i/ap5807tPRDK/uw953cauQBT8c5tVGkOwrHMfc2Yh6UuxaH4vtTjGvHg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@tailwindcss/oxide-linux-x64-gnu@4.1.18':
+    resolution: {integrity: sha512-v3gyT0ivkfBLoZGF9LyHmts0Isc8jHZyVcbzio6Wpzifg/+5ZJpDiRiUhDLkcr7f/r38SWNe7ucxmGW3j3Kb/g==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@tailwindcss/oxide-linux-x64-musl@4.1.18':
+    resolution: {integrity: sha512-bhJ2y2OQNlcRwwgOAGMY0xTFStt4/wyU6pvI6LSuZpRgKQwxTec0/3Scu91O8ir7qCR3AuepQKLU/kX99FouqQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@tailwindcss/oxide-wasm32-wasi@4.1.18':
+    resolution: {integrity: sha512-LffYTvPjODiP6PT16oNeUQJzNVyJl1cjIebq/rWWBF+3eDst5JGEFSc5cWxyRCJ0Mxl+KyIkqRxk1XPEs9x8TA==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+    bundledDependencies:
+      - '@napi-rs/wasm-runtime'
+      - '@emnapi/core'
+      - '@emnapi/runtime'
+      - '@tybys/wasm-util'
+      - '@emnapi/wasi-threads'
+      - tslib
+
+  '@tailwindcss/oxide-win32-arm64-msvc@4.1.18':
+    resolution: {integrity: sha512-HjSA7mr9HmC8fu6bdsZvZ+dhjyGCLdotjVOgLA2vEqxEBZaQo9YTX4kwgEvPCpRh8o4uWc4J/wEoFzhEmjvPbA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@tailwindcss/oxide-win32-x64-msvc@4.1.18':
+    resolution: {integrity: sha512-bJWbyYpUlqamC8dpR7pfjA0I7vdF6t5VpUGMWRkXVE3AXgIZjYUYAK7II1GNaxR8J1SSrSrppRar8G++JekE3Q==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@tailwindcss/oxide@4.1.18':
+    resolution: {integrity: sha512-EgCR5tTS5bUSKQgzeMClT6iCY3ToqE1y+ZB0AKldj809QXk1Y+3jB0upOYZrn9aGIzPtUsP7sX4QQ4XtjBB95A==}
+    engines: {node: '>= 10'}
+
+  '@tailwindcss/vite@4.1.18':
+    resolution: {integrity: sha512-jVA+/UpKL1vRLg6Hkao5jldawNmRo7mQYrZtNHMIVpLfLhDml5nMRUo/8MwoX2vNXvnaXNNMedrMfMugAVX1nA==}
+    peerDependencies:
+      vite: ^5.2.0 || ^6 || ^7
+
+  '@tanstack/query-core@5.96.2':
+    resolution: {integrity: sha512-hzI6cTVh4KNRk8UtoIBS7Lv9g6BnJPXvBKsvYH1aGWvv0347jT3BnSvztOE+kD76XGvZnRC/t6qdW1CaIfwCeA==}
+
+  '@tanstack/react-query@5.96.2':
+    resolution: {integrity: sha512-sYyzzJT4G0g02azzJ8o55VFFV31XvFpdUpG+unxS0vSaYsJnSPKGoI6WdPwUucJL1wpgGfwfmntNX/Ub1uOViA==}
+    peerDependencies:
+      react: ^18 || ^19
+
+  '@tanstack/react-virtual@3.13.23':
+    resolution: {integrity: sha512-XnMRnHQ23piOVj2bzJqHrRrLg4r+F86fuBcwteKfbIjJrtGxb4z7tIvPVAe4B+4UVwo9G4Giuz5fmapcrnZ0OQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  '@tanstack/solid-virtual@3.13.19':
+    resolution: {integrity: sha512-4uCuwY/nfQzoxuJCOroEGgRQkoDuzRE4wVdDq47InQ9WPQ+1dkBUyE7k7frcTPy+l1yjCCmLGdq9h9GQyofVHw==}
+    peerDependencies:
+      solid-js: ^1.3.0
+
+  '@tanstack/virtual-core@3.13.19':
+    resolution: {integrity: sha512-/BMP7kNhzKOd7wnDeB8NrIRNLwkf5AhCYCvtfZV2GXWbBieFm/el0n6LOAXlTi6ZwHICSNnQcIxRCWHrLzDY+g==}
+
+  '@tanstack/virtual-core@3.13.23':
+    resolution: {integrity: sha512-zSz2Z2HNyLjCplANTDyl3BcdQJc2k1+yyFoKhNRmCr7V7dY8o8q5m8uFTI1/Pg1kL+Hgrz6u3Xo6eFUB7l66cg==}
+
+  '@tauri-apps/api@2.10.1':
+    resolution: {integrity: sha512-hKL/jWf293UDSUN09rR69hrToyIXBb8CjGaWC7gfinvnQrBVvnLr08FeFi38gxtugAVyVcTa5/FD/Xnkb1siBw==}
+
+  '@tauri-apps/cli-darwin-arm64@2.9.6':
+    resolution: {integrity: sha512-gf5no6N9FCk1qMrti4lfwP77JHP5haASZgVbBgpZG7BUepB3fhiLCXGUK8LvuOjP36HivXewjg72LTnPDScnQQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tauri-apps/cli-darwin-x64@2.9.6':
+    resolution: {integrity: sha512-oWh74WmqbERwwrwcueJyY6HYhgCksUc6NT7WKeXyrlY/FPmNgdyQAgcLuTSkhRFuQ6zh4Np1HZpOqCTpeZBDcw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.9.6':
+    resolution: {integrity: sha512-/zde3bFroFsNXOHN204DC2qUxAcAanUjVXXSdEGmhwMUZeAQalNj5cz2Qli2elsRjKN/hVbZOJj0gQ5zaYUjSg==}
+    engines: {node: '>= 10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.9.6':
+    resolution: {integrity: sha512-pvbljdhp9VOo4RnID5ywSxgBs7qiylTPlK56cTk7InR3kYSTJKYMqv/4Q/4rGo/mG8cVppesKIeBMH42fw6wjg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-arm64-musl@2.9.6':
+    resolution: {integrity: sha512-02TKUndpodXBCR0oP//6dZWGYcc22Upf2eP27NvC6z0DIqvkBBFziQUcvi2n6SrwTRL0yGgQjkm9K5NIn8s6jw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.9.6':
+    resolution: {integrity: sha512-fmp1hnulbqzl1GkXl4aTX9fV+ubHw2LqlLH1PE3BxZ11EQk+l/TmiEongjnxF0ie4kV8DQfDNJ1KGiIdWe1GvQ==}
+    engines: {node: '>= 10'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-x64-gnu@2.9.6':
+    resolution: {integrity: sha512-vY0le8ad2KaV1PJr+jCd8fUF9VOjwwQP/uBuTJvhvKTloEwxYA/kAjKK9OpIslGA9m/zcnSo74czI6bBrm2sYA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-x64-musl@2.9.6':
+    resolution: {integrity: sha512-TOEuB8YCFZTWVDzsO2yW0+zGcoMiPPwcUgdnW1ODnmgfwccpnihDRoks+ABT1e3fHb1ol8QQWsHSCovb3o2ENQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.9.6':
+    resolution: {integrity: sha512-ujmDGMRc4qRLAnj8nNG26Rlz9klJ0I0jmZs2BPpmNNf0gM/rcVHhqbEkAaHPTBVIrtUdf7bGvQAD2pyIiUrBHQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.9.6':
+    resolution: {integrity: sha512-S4pT0yAJgFX8QRCyKA1iKjZ9Q/oPjCZf66A/VlG5Yw54Nnr88J1uBpmenINbXxzyhduWrIXBaUbEY1K80ZbpMg==}
+    engines: {node: '>= 10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-x64-msvc@2.9.6':
+    resolution: {integrity: sha512-ldWuWSSkWbKOPjQMJoYVj9wLHcOniv7diyI5UAJ4XsBdtaFB0pKHQsqw/ItUma0VXGC7vB4E9fZjivmxur60aw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@tauri-apps/cli@2.9.6':
+    resolution: {integrity: sha512-3xDdXL5omQ3sPfBfdC8fCtDKcnyV7OqyzQgfyT5P3+zY6lcPqIYKQBvUasNvppi21RSdfhy44ttvJmftb0PCDw==}
+    engines: {node: '>= 10'}
+    hasBin: true
+
+  '@tauri-apps/plugin-deep-link@2.4.7':
+    resolution: {integrity: sha512-K0FQlLM6BoV7Ws2xfkh+Tnwi5VZVdkI4Vw/3AGLSf0Xvu2y86AMBzd9w/SpzKhw9ai2B6ES8di/OoGDCExkOzg==}
+
+  '@tauri-apps/plugin-dialog@2.6.0':
+    resolution: {integrity: sha512-q4Uq3eY87TdcYzXACiYSPhmpBA76shgmQswGkSVio4C82Sz2W4iehe9TnKYwbq7weHiL88Yw19XZm7v28+Micg==}
+
+  '@tauri-apps/plugin-http@2.5.6':
+    resolution: {integrity: sha512-KhCK3TDNDF4vdz75/j+KNQipYKf+295Visa8r32QcXScg0+D3JwShcCM6D+FN8WuDF24X3KSiAB8QtRxW6jKRA==}
+
+  '@tauri-apps/plugin-opener@2.5.3':
+    resolution: {integrity: sha512-CCcUltXMOfUEArbf3db3kCE7Ggy1ExBEBl51Ko2ODJ6GDYHRp1nSNlQm5uNCFY5k7/ufaK5Ib3Du/Zir19IYQQ==}
+
+  '@tauri-apps/plugin-process@2.3.1':
+    resolution: {integrity: sha512-nCa4fGVaDL/B9ai03VyPOjfAHRHSBz5v6F/ObsB73r/dA3MHHhZtldaDMIc0V/pnUw9ehzr2iEG+XkSEyC0JJA==}
+
+  '@tauri-apps/plugin-updater@2.9.0':
+    resolution: {integrity: sha512-j++sgY8XpeDvzImTrzWA08OqqGqgkNyxczLD7FjNJJx/uXxMZFz5nDcfkyoI/rCjYuj2101Tci/r/HFmOmoxCg==}
+
+  '@tokenizer/token@0.3.0':
+    resolution: {integrity: sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==}
+
+  '@tootallnate/once@2.0.0':
+    resolution: {integrity: sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==}
+    engines: {node: '>= 10'}
+
+  '@ts-morph/common@0.27.0':
+    resolution: {integrity: sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ==}
+
+  '@turbo/darwin-64@2.8.20':
+    resolution: {integrity: sha512-FQ9EX1xMU5nbwjxXxM3yU88AQQ6Sqc6S44exPRroMcx9XZHqqppl5ymJF0Ig/z3nvQNwDmz1Gsnvxubo+nXWjQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@turbo/darwin-arm64@2.8.20':
+    resolution: {integrity: sha512-Gpyh9ATFGThD6/s9L95YWY54cizg/VRWl2B67h0yofG8BpHf67DFAh9nuJVKG7bY0+SBJDAo5cMur+wOl9YOYw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@turbo/linux-64@2.8.20':
+    resolution: {integrity: sha512-p2QxWUYyYUgUFG0b0kR+pPi8t7c9uaVlRtjTTI1AbCvVqkpjUfCcReBn6DgG/Hu8xrWdKLuyQFaLYFzQskZbcA==}
+    cpu: [x64]
+    os: [linux]
+
+  '@turbo/linux-arm64@2.8.20':
+    resolution: {integrity: sha512-Gn5yjlZGLRZWarLWqdQzv0wMqyBNIdq1QLi48F1oY5Lo9kiohuf7BPQWtWxeNVS2NgJ1+nb/DzK1JduYC4AWOA==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@turbo/windows-64@2.8.20':
+    resolution: {integrity: sha512-vyaDpYk/8T6Qz5V/X+ihKvKFEZFUoC0oxYpC1sZanK6gaESJlmV3cMRT3Qhcg4D2VxvtC2Jjs9IRkrZGL+exLw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@turbo/windows-arm64@2.8.20':
+    resolution: {integrity: sha512-voicVULvUV5yaGXo0Iue13BcHGYW3u0VgqSbfQwBaHbpj1zLjYV4KIe+7fYIo6DO8FVUJzxFps3ODCQG/Wy2Qw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/cacheable-request@6.0.3':
+    resolution: {integrity: sha512-IQ3EbTzGxIigb1I3qPZc1rWJnH0BmSKv5QYTalEwweFvyBDLSAe24zP0le/hyi7ecGfZVlIVAg4BZqb8WBwKqw==}
+
+  '@types/d3-array@3.2.2':
+    resolution: {integrity: sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==}
+
+  '@types/d3-axis@3.0.6':
+    resolution: {integrity: sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw==}
+
+  '@types/d3-brush@3.0.6':
+    resolution: {integrity: sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A==}
+
+  '@types/d3-chord@3.0.6':
+    resolution: {integrity: sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg==}
+
+  '@types/d3-color@3.1.3':
+    resolution: {integrity: sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==}
+
+  '@types/d3-contour@3.0.6':
+    resolution: {integrity: sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg==}
+
+  '@types/d3-delaunay@6.0.4':
+    resolution: {integrity: sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw==}
+
+  '@types/d3-dispatch@3.0.7':
+    resolution: {integrity: sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA==}
+
+  '@types/d3-drag@3.0.7':
+    resolution: {integrity: sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ==}
+
+  '@types/d3-dsv@3.0.7':
+    resolution: {integrity: sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g==}
+
+  '@types/d3-ease@3.0.2':
+    resolution: {integrity: sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==}
+
+  '@types/d3-fetch@3.0.7':
+    resolution: {integrity: sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA==}
+
+  '@types/d3-force@3.0.10':
+    resolution: {integrity: sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw==}
+
+  '@types/d3-format@3.0.4':
+    resolution: {integrity: sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g==}
+
+  '@types/d3-geo@3.1.0':
+    resolution: {integrity: sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ==}
+
+  '@types/d3-hierarchy@3.1.7':
+    resolution: {integrity: sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg==}
+
+  '@types/d3-interpolate@3.0.4':
+    resolution: {integrity: sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==}
+
+  '@types/d3-path@3.1.1':
+    resolution: {integrity: sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==}
+
+  '@types/d3-polygon@3.0.2':
+    resolution: {integrity: sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA==}
+
+  '@types/d3-quadtree@3.0.6':
+    resolution: {integrity: sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg==}
+
+  '@types/d3-random@3.0.3':
+    resolution: {integrity: sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ==}
+
+  '@types/d3-scale-chromatic@3.1.0':
+    resolution: {integrity: sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==}
+
+  '@types/d3-scale@4.0.9':
+    resolution: {integrity: sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==}
+
+  '@types/d3-selection@3.0.11':
+    resolution: {integrity: sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==}
+
+  '@types/d3-shape@3.1.8':
+    resolution: {integrity: sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==}
+
+  '@types/d3-time-format@4.0.3':
+    resolution: {integrity: sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg==}
+
+  '@types/d3-time@3.0.4':
+    resolution: {integrity: sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==}
+
+  '@types/d3-timer@3.0.2':
+    resolution: {integrity: sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==}
+
+  '@types/d3-transition@3.0.9':
+    resolution: {integrity: sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg==}
+
+  '@types/d3-zoom@3.0.8':
+    resolution: {integrity: sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw==}
+
+  '@types/d3@7.4.3':
+    resolution: {integrity: sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww==}
+
+  '@types/debug@4.1.13':
+    resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
+
+  '@types/estree-jsx@1.0.5':
+    resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
+  '@types/fs-extra@9.0.13':
+    resolution: {integrity: sha512-nEnwB++1u5lVDM2UI4c1+5R+FYaKfaAzS4OococimjVm3nQw3TuzH5UNsocrcTBbhnerblyHj4A49qXbIiZdpA==}
+
+  '@types/geojson@7946.0.16':
+    resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
+
+  '@types/hast@3.0.4':
+    resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
+
+  '@types/http-cache-semantics@4.2.0':
+    resolution: {integrity: sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/keyv@3.1.4':
+    resolution: {integrity: sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
+
+  '@types/luxon@3.7.1':
+    resolution: {integrity: sha512-H3iskjFIAn5SlJU7OuxUmTEpebK6TKB8rxZShDslBMZJ5u9S//KM1sbdAisiSrqwLQncVjnpi2OK2J51h+4lsg==}
+
+  '@types/mdast@4.0.4':
+    resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
+
+  '@types/minimatch@5.1.2':
+    resolution: {integrity: sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==}
+
+  '@types/ms@2.1.0':
+    resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
+
+  '@types/node@16.9.1':
+    resolution: {integrity: sha512-QpLcX9ZSsq3YYUUnD3nFDY8H7wctAhQj/TFKL8Ya8v5fMm3CFXxo8zStsLAl780ltoYoo1WvKUVGBQK+1ifr7g==}
+
+  '@types/node@20.12.12':
+    resolution: {integrity: sha512-eWLDGF/FOSPtAvEqeRAQ4C8LSA7M1I7i0ky1I8U7kD1J5ITyW3AsRhQrKVoWf5pFKZ2kILsEGJhsI9r93PYnOw==}
+
+  '@types/node@22.19.7':
+    resolution: {integrity: sha512-MciR4AKGHWl7xwxkBa6xUGxQJ4VBOmPTF7sL+iGzuahOFaO0jHCsuEfS80pan1ef4gWId1oWOweIhrDEYLuaOw==}
+
+  '@types/node@25.4.0':
+    resolution: {integrity: sha512-9wLpoeWuBlcbBpOY3XmzSTG3oscB6xjBEEtn+pYXTfhyXhIxC5FsBer2KTopBlvKEiW9l13po9fq+SJY/5lkhw==}
+
+  '@types/node@25.6.0':
+    resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==}
+
+  '@types/plist@3.0.5':
+    resolution: {integrity: sha512-E6OCaRmAe4WDmWNsL/9RMqdkkzDCY1etutkflWk4c+AcjDU07Pcz1fQwTX0TQz+Pxqn9i4L1TU3UFpjnrcDgxA==}
+
+  '@types/prop-types@15.7.15':
+    resolution: {integrity: sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==}
+
+  '@types/react-dom@18.2.25':
+    resolution: {integrity: sha512-o/V48vf4MQh7juIKZU2QGDfli6p1+OOi5oXx36Hffpc9adsHeXjVp8rHuPkjd8VT8sOJ2Zp05HR7CdpGTIUFUA==}
+
+  '@types/react-dom@19.2.3':
+    resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
+    peerDependencies:
+      '@types/react': ^19.2.0
+
+  '@types/react@18.2.79':
+    resolution: {integrity: sha512-RwGAGXPl9kSXwdNTafkOEuFrTBD5SA2B3iEB96xi8+xu5ddUa/cpvyVCSNn+asgLCTHkb5ZxN8gbuibYJi4s1w==}
+
+  '@types/react@19.2.14':
+    resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==}
+
+  '@types/responselike@1.0.3':
+    resolution: {integrity: sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==}
+
+  '@types/retry@0.12.0':
+    resolution: {integrity: sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==}
+
+  '@types/set-cookie-parser@2.4.10':
+    resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
+
+  '@types/statuses@2.0.6':
+    resolution: {integrity: sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==}
+
+  '@types/trusted-types@2.0.7':
+    resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
+
+  '@types/unist@2.0.11':
+    resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==}
+
+  '@types/unist@3.0.3':
+    resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
+
+  '@types/validate-npm-package-name@4.0.2':
+    resolution: {integrity: sha512-lrpDziQipxCEeK5kWxvljWYhUvOiB2A9izZd9B2AFarYAkqZshb4lPbRs7zKEic6eGtH8V/2qJW+dPp9OtF6bw==}
+
+  '@types/verror@1.10.11':
+    resolution: {integrity: sha512-RlDm9K7+o5stv0Co8i8ZRGxDbrTxhJtgjqjFyVh/tXQyl/rYtTKlnTvZ88oSTeYREWurwx20Js4kTuKCsFkUtg==}
+
+  '@types/ws@8.18.1':
+    resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
+
+  '@types/yauzl@2.10.3':
+    resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
+
+  '@ungap/structured-clone@1.3.0':
+    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
+
+  '@upsetjs/venn.js@2.0.0':
+    resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
+
+  '@vercel/blob@0.27.3':
+    resolution: {integrity: sha512-WizeAxzOTmv0JL7wOaxvLIU/KdBcrclM1ZUOdSlIZAxsTTTe1jsyBthStLby0Ueh7FnmKYAjLz26qRJTk5SDkQ==}
+    engines: {node: '>=16.14'}
+
+  '@vercel/oidc@3.1.0':
+    resolution: {integrity: sha512-Fw28YZpRnA3cAHHDlkt7xQHiJ0fcL+NRcIqsocZQUSmbzeIKRpwttJjik5ZGanXP+vlA4SbTg+AbA3bP363l+w==}
+    engines: {node: '>= 20'}
+
+  '@vitejs/plugin-react@5.2.0':
+    resolution: {integrity: sha512-YmKkfhOAi3wsB1PhJq5Scj3GXMn3WvtQ/JC0xoopuHoXSdmtdStOpFrYaT1kie2YgFBcIe64ROzMYRjCrYOdYw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  '@webgpu/types@0.1.69':
+    resolution: {integrity: sha512-RPmm6kgRbI8e98zSD3RVACvnuktIja5+yLgDAkTmxLr90BEwdTXRQWNLF3ETTTyH/8mKhznZuN5AveXYFEsMGQ==}
+
+  '@xmldom/xmldom@0.8.13':
+    resolution: {integrity: sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==}
+    engines: {node: '>=10.0.0'}
+
+  abbrev@1.1.1:
+    resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==}
+
+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
+  accepts@2.0.0:
+    resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
+    engines: {node: '>= 0.6'}
+
+  acorn-import-attributes@1.9.5:
+    resolution: {integrity: sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==}
+    peerDependencies:
+      acorn: ^8
+
+  acorn@8.16.0:
+    resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
+
+  agent-base@7.1.4:
+    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
+    engines: {node: '>= 14'}
+
+  agentkeepalive@4.6.0:
+    resolution: {integrity: sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==}
+    engines: {node: '>= 8.0.0'}
+
+  aggregate-error@3.1.0:
+    resolution: {integrity: sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==}
+    engines: {node: '>=8'}
+
+  ai@6.0.146:
+    resolution: {integrity: sha512-70DE8k1rR0N3mXxyyfjYAx/FxRln/kQ5ym18lt1ys1eUklcPuoIXGbUBwdfCbmkt6YF3jCDZ5+OgkWieP/NGDw==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv-keywords@3.5.2:
+    resolution: {integrity: sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==}
+    peerDependencies:
+      ajv: ^6.9.1
+
+  ajv@6.14.0:
+    resolution: {integrity: sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==}
+
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
+  ansi-regex@5.0.1:
+    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
+    engines: {node: '>=8'}
+
+  ansi-regex@6.2.2:
+    resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
+    engines: {node: '>=12'}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  ansi-styles@6.2.3:
+    resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
+    engines: {node: '>=12'}
+
+  any-base@1.1.0:
+    resolution: {integrity: sha512-uMgjozySS8adZZYePpaWs8cxB9/kdzmpX6SgJZ+wbz1K5eYk5QMYDVJaZKhxyIHUdnnJkfR7SVgStgH7LkGUyg==}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  app-builder-bin@5.0.0-alpha.10:
+    resolution: {integrity: sha512-Ev4jj3D7Bo+O0GPD2NMvJl+PGiBAfS7pUGawntBNpCbxtpncfUixqFj9z9Jme7V7s3LBGqsWZZP54fxBX3JKJw==}
+
+  app-builder-lib@25.1.8:
+    resolution: {integrity: sha512-pCqe7dfsQFBABC1jeKZXQWhGcCPF3rPCXDdfqVKjIeWBcXzyC1iOWZdfFhGl+S9MyE/k//DFmC6FzuGAUudNDg==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      dmg-builder: 25.1.8
+      electron-builder-squirrel-windows: 25.1.8
+
+  aproba@2.1.0:
+    resolution: {integrity: sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==}
+
+  archiver-utils@2.1.0:
+    resolution: {integrity: sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==}
+    engines: {node: '>= 6'}
+
+  archiver-utils@3.0.4:
+    resolution: {integrity: sha512-KVgf4XQVrTjhyWmx6cte4RxonPLR9onExufI1jhvw/MQ4BB6IsZD5gT8Lq+u/+pRkWna/6JoHpiQioaqFP5Rzw==}
+    engines: {node: '>= 10'}
+
+  archiver@5.3.2:
+    resolution: {integrity: sha512-+25nxyyznAXF7Nef3y0EbBeqmGZgeN/BxHX29Rs39djAfaFalmQ89SE6CWyDCHzGL0yt/ycBtNOmGTW0FyGWNw==}
+    engines: {node: '>= 10'}
+
+  are-we-there-yet@3.0.1:
+    resolution: {integrity: sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    deprecated: This package is no longer supported.
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  assert-plus@1.0.0:
+    resolution: {integrity: sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==}
+    engines: {node: '>=0.8'}
+
+  ast-types@0.16.1:
+    resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
+    engines: {node: '>=4'}
+
+  astral-regex@2.0.0:
+    resolution: {integrity: sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
+    engines: {node: '>=8'}
+
+  async-exit-hook@2.0.1:
+    resolution: {integrity: sha512-NW2cX8m1Q7KPA7a5M2ULQeZ2wR5qI5PAbw5L0UOMxdioVk9PMZ0h1TmyZEkPYrCvYjDlFICusOu1dlEKAAeXBw==}
+    engines: {node: '>=0.12.0'}
+
+  async-retry@1.3.3:
+    resolution: {integrity: sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==}
+
+  async@3.2.6:
+    resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
+
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  at-least-node@1.0.0:
+    resolution: {integrity: sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==}
+    engines: {node: '>= 4.0.0'}
+
+  atomic-sleep@1.0.0:
+    resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
+    engines: {node: '>=8.0.0'}
+
+  autoprefixer@10.4.19:
+    resolution: {integrity: sha512-BaENR2+zBZ8xXhM4pUaKUxlVdxZ0EZhjvbopwnXmxRUfqDmwSpC2lAi/QXvx7NRdPCo1WKEcEF6mV64si1z4Ew==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  await-to-js@3.0.0:
+    resolution: {integrity: sha512-zJAaP9zxTcvTHRlejau3ZOY4V7SRpiByf3/dxx2uyKxxor19tpmpV2QRsTKikckwhaPmr2dVpxxMr7jOCYVp5g==}
+    engines: {node: '>=6.0.0'}
+
+  aws-ssl-profiles@1.1.2:
+    resolution: {integrity: sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==}
+    engines: {node: '>= 6.0.0'}
+
+  axios@1.13.6:
+    resolution: {integrity: sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==}
+
+  babel-plugin-jsx-dom-expressions@0.40.3:
+    resolution: {integrity: sha512-5HOwwt0BYiv/zxl7j8Pf2bGL6rDXfV6nUhLs8ygBX+EFJXzBPHM/euj9j/6deMZ6wa52Wb2PBaAV5U/jKwIY1w==}
+    peerDependencies:
+      '@babel/core': ^7.20.12
+
+  babel-plugin-module-resolver@5.0.2:
+    resolution: {integrity: sha512-9KtaCazHee2xc0ibfqsDeamwDps6FZNo5S0Q81dUqEuFzVwPhcT4J5jOqIVvgCA3Q/wO9hKYxN/Ds3tIsp5ygg==}
+
+  babel-preset-solid@1.9.9:
+    resolution: {integrity: sha512-pCnxWrciluXCeli/dj5PIEHgbNzim3evtTn12snjqqg8QZWJNMjH1AWIp4iG/tbVjqQ72aBEymMSagvmgxubXw==}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+      solid-js: ^1.9.8
+    peerDependenciesMeta:
+      solid-js:
+        optional: true
+
+  bail@2.0.2:
+    resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  base64-js@1.5.1:
+    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+
+  baseline-browser-mapping@2.10.11:
+    resolution: {integrity: sha512-DAKrHphkJyiGuau/cFieRYhcTFeK/lBuD++C7cZ6KZHbMhBrisoi+EvhQ5RZrIfV5qwsW8kgQ07JIC+MDJRAhg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  baseline-browser-mapping@2.9.14:
+    resolution: {integrity: sha512-B0xUquLkiGLgHhpPBqvl7GWegWBUNuujQ6kXd/r1U38ElPT6Ok8KZ8e+FpUGEc2ZoRQUzq/aUnaKFc/svWUGSg==}
+    hasBin: true
+
+  better-auth@1.5.6:
+    resolution: {integrity: sha512-QSpJTqaT1XVfWRQe/fm3PgeuwOIlz1nWX/Dx7nsHStJ382bLzmDbQk2u7IT0IJ6wS5SRxfqEE1Ev9TXontgyAQ==}
+    peerDependencies:
+      '@lynx-js/react': '*'
+      '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
+      '@sveltejs/kit': ^2.0.0
+      '@tanstack/react-start': ^1.0.0
+      '@tanstack/solid-start': ^1.0.0
+      better-sqlite3: ^12.0.0
+      drizzle-kit: '>=0.31.4'
+      drizzle-orm: '>=0.41.0'
+      mongodb: ^6.0.0 || ^7.0.0
+      mysql2: ^3.0.0
+      next: ^14.0.0 || ^15.0.0 || ^16.0.0
+      pg: ^8.0.0
+      prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+      solid-js: ^1.0.0
+      svelte: ^4.0.0 || ^5.0.0
+      vitest: ^2.0.0 || ^3.0.0 || ^4.0.0
+      vue: ^3.0.0
+    peerDependenciesMeta:
+      '@lynx-js/react':
+        optional: true
+      '@prisma/client':
+        optional: true
+      '@sveltejs/kit':
+        optional: true
+      '@tanstack/react-start':
+        optional: true
+      '@tanstack/solid-start':
+        optional: true
+      better-sqlite3:
+        optional: true
+      drizzle-kit:
+        optional: true
+      drizzle-orm:
+        optional: true
+      mongodb:
+        optional: true
+      mysql2:
+        optional: true
+      next:
+        optional: true
+      pg:
+        optional: true
+      prisma:
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+      solid-js:
+        optional: true
+      svelte:
+        optional: true
+      vitest:
+        optional: true
+      vue:
+        optional: true
+
+  better-call@1.3.2:
+    resolution: {integrity: sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw==}
+    peerDependencies:
+      zod: ^4.0.0
+    peerDependenciesMeta:
+      zod:
+        optional: true
+
+  binary-extensions@2.3.0:
+    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
+    engines: {node: '>=8'}
+
+  bl@4.1.0:
+    resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
+
+  bluebird-lst@1.0.9:
+    resolution: {integrity: sha512-7B1Rtx82hjnSD4PGLAjVWeYH3tHAcVUmChh85a3lltKQm6FresXh9ErQo6oAv6CqxttczC3/kEg8SY5NluPuUw==}
+
+  bluebird@3.7.2:
+    resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
+
+  bmp-ts@1.0.9:
+    resolution: {integrity: sha512-cTEHk2jLrPyi+12M3dhpEbnnPOsaZuq7C45ylbbQIiWgDFZq4UVYPEY5mlqjvsj/6gJv9qX5sa+ebDzLXT28Vw==}
+
+  body-parser@2.2.2:
+    resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==}
+    engines: {node: '>=18'}
+
+  boolean@3.2.0:
+    resolution: {integrity: sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==}
+    deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
+
+  botid@1.5.11:
+    resolution: {integrity: sha512-KOO1A3+/vFVJk5aFoG3sNwiogKFPVR+x4aw4gQ1b2e0XoE+i5xp48/EZn+WqR07jRHeDGwHWQUOtV5WVm7xiww==}
+    peerDependencies:
+      next: '*'
+      react: ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      next:
+        optional: true
+      react:
+        optional: true
+
+  bowser@2.14.1:
+    resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}
+
+  brace-expansion@1.1.14:
+    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}
+
+  brace-expansion@2.0.2:
+    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.1:
+    resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  buffer-crc32@0.2.13:
+    resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
+
+  buffer-from@1.1.2:
+    resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
+
+  buffer@5.6.0:
+    resolution: {integrity: sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==}
+
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+  builder-util-runtime@9.2.10:
+    resolution: {integrity: sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==}
+    engines: {node: '>=12.0.0'}
+
+  builder-util-runtime@9.5.1:
+    resolution: {integrity: sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==}
+    engines: {node: '>=12.0.0'}
+
+  builder-util@25.1.7:
+    resolution: {integrity: sha512-7jPjzBwEGRbwNcep0gGNpLXG9P94VA3CPAZQCzxkFXiV2GMQKlziMbY//rXPI7WKfhsvGgFXjTcXdBEwgXw9ww==}
+
+  bun-ffi-structs@0.1.2:
+    resolution: {integrity: sha512-Lh1oQAYHDcnesJauieA4UNkWGXY9hYck7OA5IaRwE3Bp6K2F2pJSNYqq+hIy7P3uOvo3km3oxS8304g5gDMl/w==}
+    peerDependencies:
+      typescript: ^5
+
+  bun-types@1.3.6:
+    resolution: {integrity: sha512-OlFwHcnNV99r//9v5IIOgQ9Uk37gZqrNMCcqEaExdkVq3Avwqok1bJFmvGMCkCE0FqzdY8VMOZpfpR3lwI+CsQ==}
+
+  bun-webgpu-darwin-arm64@0.1.4:
+    resolution: {integrity: sha512-eDgLN9teKTfmvrCqgwwmWNsNszxYs7IZdCqk0S1DCarvMhr4wcajoSBlA/nQA0/owwLduPTS8xxCnQp4/N/gDg==}
+    cpu: [arm64]
+    os: [darwin]
+
+  bun-webgpu-darwin-x64@0.1.4:
+    resolution: {integrity: sha512-X+PjwJUWenUmdQBP8EtdItMyieQ6Nlpn+BH518oaouDiSnWj5+b0Y7DNDZJq7Ezom4EaxmqL/uGYZK3aCQ7CXg==}
+    cpu: [x64]
+    os: [darwin]
+
+  bun-webgpu-linux-x64@0.1.4:
+    resolution: {integrity: sha512-zMLs2YIGB+/jxrYFXaFhVKX/GBt05UTF45lc9srcHc9JXGjEj+12CIo1CHLTAWatXMTqt0Jsu6ukWEoWVT/ayA==}
+    cpu: [x64]
+    os: [linux]
+
+  bun-webgpu-win32-x64@0.1.4:
+    resolution: {integrity: sha512-Z5yAK28xrcm8Wb5k7TZ8FJKpOI/r+aVCRdlHYAqI2SDJFN3nD4mJs900X6kNVmG/xFzb5yOuKVYWGg+6ZXWbyA==}
+    cpu: [x64]
+    os: [win32]
+
+  bun-webgpu@0.1.4:
+    resolution: {integrity: sha512-Kw+HoXl1PMWJTh9wvh63SSRofTA8vYBFCw0XEP1V1fFdQEDhI8Sgf73sdndE/oDpN/7CMx0Yv/q8FCvO39ROMQ==}
+
+  bundle-name@4.1.0:
+    resolution: {integrity: sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==}
+    engines: {node: '>=18'}
+
+  bundle-require@5.1.0:
+    resolution: {integrity: sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+    peerDependencies:
+      esbuild: '>=0.18'
+
+  busboy@1.6.0:
+    resolution: {integrity: sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==}
+    engines: {node: '>=10.16.0'}
+
+  bytes@3.1.2:
+    resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
+    engines: {node: '>= 0.8'}
+
+  c12@3.3.3:
+    resolution: {integrity: sha512-750hTRvgBy5kcMNPdh95Qo+XUBeGo8C7nsKSmedDmaQI+E0r82DwHeM6vBewDe4rGFbnxoa4V9pw+sPh5+Iz8Q==}
+    peerDependencies:
+      magicast: '*'
+    peerDependenciesMeta:
+      magicast:
+        optional: true
+
+  cac@6.7.14:
+    resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
+    engines: {node: '>=8'}
+
+  cacache@16.1.3:
+    resolution: {integrity: sha512-/+Emcj9DAXxX4cwlLmRI9c166RuL3w30zp4R7Joiv2cQTtTtA+jeuCAjH3ZlGnYS3tKENSrKhAzVVP9GVyzeYQ==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  cacheable-lookup@5.0.4:
+    resolution: {integrity: sha512-2/kNscPhpcxrOigMZzbiWF7dz8ilhb/nIHU3EyZiXWXpeq/au8qJ8VhdftMkty3n7Gj6HIGalQG8oiBNB3AJgA==}
+    engines: {node: '>=10.6.0'}
+
+  cacheable-request@7.0.4:
+    resolution: {integrity: sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg==}
+    engines: {node: '>=8'}
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  caniuse-lite@1.0.30001764:
+    resolution: {integrity: sha512-9JGuzl2M+vPL+pz70gtMF9sHdMFbY9FJaQBi186cHKH3pSzDvzoUJUPV6fqiKIMyXbud9ZLg4F3Yza1vJ1+93g==}
+
+  ccount@2.0.1:
+    resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  chalk@5.6.2:
+    resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
+    engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
+
+  character-entities-html4@2.1.0:
+    resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==}
+
+  character-entities-legacy@3.0.0:
+    resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
+
+  character-entities@2.0.2:
+    resolution: {integrity: sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==}
+
+  character-reference-invalid@2.0.1:
+    resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==}
+
+  chevrotain-allstar@0.3.1:
+    resolution: {integrity: sha512-b7g+y9A0v4mxCW1qUhf3BSVPg+/NvGErk/dOkrDaHA0nQIQGAtrOjlX//9OQtRlSCy+x9rfB5N8yC71lH1nvMw==}
+    peerDependencies:
+      chevrotain: ^11.0.0
+
+  chevrotain@11.1.2:
+    resolution: {integrity: sha512-opLQzEVriiH1uUQ4Kctsd49bRoFDXGGSC4GUqj7pGyxM3RehRhvTlZJc1FL/Flew2p5uwxa1tUDWKzI4wNM8pg==}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
+  chokidar@5.0.0:
+    resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
+    engines: {node: '>= 20.19.0'}
+
+  chownr@2.0.0:
+    resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
+    engines: {node: '>=10'}
+
+  chownr@3.0.0:
+    resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==}
+    engines: {node: '>=18'}
+
+  chromium-pickle-js@0.2.0:
+    resolution: {integrity: sha512-1R5Fho+jBq0DDydt+/vHWj5KJNJCKdARKOCwZUen84I5BreWoLqRLANH1U87eJy1tiASPtMnGqJJq0ZsLoRPOw==}
+
+  ci-info@3.9.0:
+    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
+    engines: {node: '>=8'}
+
+  citty@0.1.6:
+    resolution: {integrity: sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==}
+
+  citty@0.2.2:
+    resolution: {integrity: sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==}
+
+  cjs-module-lexer@2.2.0:
+    resolution: {integrity: sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==}
+
+  class-variance-authority@0.7.1:
+    resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
+
+  clean-stack@2.2.0:
+    resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==}
+    engines: {node: '>=6'}
+
+  cli-cursor@3.1.0:
+    resolution: {integrity: sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==}
+    engines: {node: '>=8'}
+
+  cli-cursor@5.0.0:
+    resolution: {integrity: sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==}
+    engines: {node: '>=18'}
+
+  cli-spinners@2.9.2:
+    resolution: {integrity: sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==}
+    engines: {node: '>=6'}
+
+  cli-truncate@2.1.0:
+    resolution: {integrity: sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==}
+    engines: {node: '>=8'}
+
+  cli-width@4.1.0:
+    resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
+    engines: {node: '>= 12'}
+
+  client-only@0.0.1:
+    resolution: {integrity: sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==}
+
+  cliui@8.0.1:
+    resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
+    engines: {node: '>=12'}
+
+  clone-response@1.0.3:
+    resolution: {integrity: sha512-ROoL94jJH2dUVML2Y/5PEDNaSHgeOdSDicUyS7izcF63G6sTc/FTjLub4b8Il9S8S0beOfYt0TaA5qvFK+w0wA==}
+
+  clone@1.0.4:
+    resolution: {integrity: sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==}
+    engines: {node: '>=0.8'}
+
+  clsx@2.1.1:
+    resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
+    engines: {node: '>=6'}
+
+  code-block-writer@13.0.3:
+    resolution: {integrity: sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg==}
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  color-support@1.1.3:
+    resolution: {integrity: sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==}
+    hasBin: true
+
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
+  comma-separated-tokens@2.0.3:
+    resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
+
+  commander@11.1.0:
+    resolution: {integrity: sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==}
+    engines: {node: '>=16'}
+
+  commander@12.1.0:
+    resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
+    engines: {node: '>=18'}
+
+  commander@14.0.3:
+    resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+    engines: {node: '>=20'}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  commander@5.1.0:
+    resolution: {integrity: sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==}
+    engines: {node: '>= 6'}
+
+  commander@7.2.0:
+    resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==}
+    engines: {node: '>= 10'}
+
+  commander@8.3.0:
+    resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
+    engines: {node: '>= 12'}
+
+  compare-version@0.1.2:
+    resolution: {integrity: sha512-pJDh5/4wrEnXX/VWRZvruAGHkzKdr46z11OlTPN+VrATlWWhSKewNCJ1futCO5C7eJB3nPMFZA1LeYtcFboZ2A==}
+    engines: {node: '>=0.10.0'}
+
+  compress-commons@4.1.2:
+    resolution: {integrity: sha512-D3uMHtGc/fcO1Gt1/L7i1e33VOvD4A9hfQLP+6ewd+BvG/gQ84Yh4oftEhAdjSMgBgwGL+jsppT7JYNpo6MHHg==}
+    engines: {node: '>= 10'}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  confbox@0.1.8:
+    resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
+
+  confbox@0.2.4:
+    resolution: {integrity: sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==}
+
+  config-file-ts@0.2.8-rc1:
+    resolution: {integrity: sha512-GtNECbVI82bT4RiDIzBSVuTKoSHufnU7Ce7/42bkWZJZFLjmDF2WBpVsvRkhKCfKBnTBb3qZrBwPpFBU/Myvhg==}
+
+  consola@3.4.2:
+    resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
+    engines: {node: ^14.18.0 || >=16.10.0}
+
+  console-control-strings@1.1.0:
+    resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==}
+
+  content-disposition@1.1.0:
+    resolution: {integrity: sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==}
+    engines: {node: '>=18'}
+
+  content-type@1.0.5:
+    resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
+    engines: {node: '>= 0.6'}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie-signature@1.2.2:
+    resolution: {integrity: sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==}
+    engines: {node: '>=6.6.0'}
+
+  cookie@0.7.2:
+    resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
+    engines: {node: '>= 0.6'}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  core-util-is@1.0.2:
+    resolution: {integrity: sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==}
+
+  core-util-is@1.0.3:
+    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+
+  cors@2.8.6:
+    resolution: {integrity: sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==}
+    engines: {node: '>= 0.10'}
+
+  cose-base@1.0.3:
+    resolution: {integrity: sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg==}
+
+  cose-base@2.2.0:
+    resolution: {integrity: sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g==}
+
+  cosmiconfig@9.0.1:
+    resolution: {integrity: sha512-hr4ihw+DBqcvrsEDioRO31Z17x71pUYoNe/4h6Z0wB72p7MU7/9gH8Q3s12NFhHPfYBBOV3qyfUxmr/Yn3shnQ==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      typescript: '>=4.9.5'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  crc-32@1.2.2:
+    resolution: {integrity: sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==}
+    engines: {node: '>=0.8'}
+    hasBin: true
+
+  crc32-stream@4.0.3:
+    resolution: {integrity: sha512-NT7w2JVU7DFroFdYkeq8cywxrgjPHWkdX1wjpRQXPX5Asews3tA+Ght6lddQO5Mkumffp3X7GEqku3epj2toIw==}
+    engines: {node: '>= 10'}
+
+  crc@3.8.0:
+    resolution: {integrity: sha512-iX3mfgcTMIq3ZKLIsVFAbv7+Mc10kxabAGQb8HvjA1o3T1PIYprbakQ65d3I+2HGHt6nSKkM9PYjgoJO2KcFBQ==}
+
+  crelt@1.0.6:
+    resolution: {integrity: sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  cytoscape-cose-bilkent@4.1.0:
+    resolution: {integrity: sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ==}
+    peerDependencies:
+      cytoscape: ^3.2.0
+
+  cytoscape-fcose@2.2.0:
+    resolution: {integrity: sha512-ki1/VuRIHFCzxWNrsshHYPs6L7TvLu3DL+TyIGEsRcvVERmxokbf5Gdk7mFxZnTdiGtnA4cfSmjZJMviqSuZrQ==}
+    peerDependencies:
+      cytoscape: ^3.2.0
+
+  cytoscape@3.33.1:
+    resolution: {integrity: sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==}
+    engines: {node: '>=0.10'}
+
+  d3-array@2.12.1:
+    resolution: {integrity: sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ==}
+
+  d3-array@3.2.4:
+    resolution: {integrity: sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==}
+    engines: {node: '>=12'}
+
+  d3-axis@3.0.0:
+    resolution: {integrity: sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw==}
+    engines: {node: '>=12'}
+
+  d3-brush@3.0.0:
+    resolution: {integrity: sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ==}
+    engines: {node: '>=12'}
+
+  d3-chord@3.0.1:
+    resolution: {integrity: sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g==}
+    engines: {node: '>=12'}
+
+  d3-color@3.1.0:
+    resolution: {integrity: sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==}
+    engines: {node: '>=12'}
+
+  d3-contour@4.0.2:
+    resolution: {integrity: sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA==}
+    engines: {node: '>=12'}
+
+  d3-delaunay@6.0.4:
+    resolution: {integrity: sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A==}
+    engines: {node: '>=12'}
+
+  d3-dispatch@3.0.1:
+    resolution: {integrity: sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg==}
+    engines: {node: '>=12'}
+
+  d3-drag@3.0.0:
+    resolution: {integrity: sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg==}
+    engines: {node: '>=12'}
+
+  d3-dsv@3.0.1:
+    resolution: {integrity: sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q==}
+    engines: {node: '>=12'}
+    hasBin: true
+
+  d3-ease@3.0.1:
+    resolution: {integrity: sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==}
+    engines: {node: '>=12'}
+
+  d3-fetch@3.0.1:
+    resolution: {integrity: sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw==}
+    engines: {node: '>=12'}
+
+  d3-force@3.0.0:
+    resolution: {integrity: sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg==}
+    engines: {node: '>=12'}
+
+  d3-format@3.1.2:
+    resolution: {integrity: sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==}
+    engines: {node: '>=12'}
+
+  d3-geo@3.1.1:
+    resolution: {integrity: sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q==}
+    engines: {node: '>=12'}
+
+  d3-hierarchy@3.1.2:
+    resolution: {integrity: sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA==}
+    engines: {node: '>=12'}
+
+  d3-interpolate@3.0.1:
+    resolution: {integrity: sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==}
+    engines: {node: '>=12'}
+
+  d3-path@1.0.9:
+    resolution: {integrity: sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg==}
+
+  d3-path@3.1.0:
+    resolution: {integrity: sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==}
+    engines: {node: '>=12'}
+
+  d3-polygon@3.0.1:
+    resolution: {integrity: sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg==}
+    engines: {node: '>=12'}
+
+  d3-quadtree@3.0.1:
+    resolution: {integrity: sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw==}
+    engines: {node: '>=12'}
+
+  d3-random@3.0.1:
+    resolution: {integrity: sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ==}
+    engines: {node: '>=12'}
+
+  d3-sankey@0.12.3:
+    resolution: {integrity: sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ==}
+
+  d3-scale-chromatic@3.1.0:
+    resolution: {integrity: sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ==}
+    engines: {node: '>=12'}
+
+  d3-scale@4.0.2:
+    resolution: {integrity: sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==}
+    engines: {node: '>=12'}
+
+  d3-selection@3.0.0:
+    resolution: {integrity: sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==}
+    engines: {node: '>=12'}
+
+  d3-shape@1.3.7:
+    resolution: {integrity: sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw==}
+
+  d3-shape@3.2.0:
+    resolution: {integrity: sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==}
+    engines: {node: '>=12'}
+
+  d3-time-format@4.1.0:
+    resolution: {integrity: sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==}
+    engines: {node: '>=12'}
+
+  d3-time@3.1.0:
+    resolution: {integrity: sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==}
+    engines: {node: '>=12'}
+
+  d3-timer@3.0.1:
+    resolution: {integrity: sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==}
+    engines: {node: '>=12'}
+
+  d3-transition@3.0.1:
+    resolution: {integrity: sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      d3-selection: 2 - 3
+
+  d3-zoom@3.0.0:
+    resolution: {integrity: sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw==}
+    engines: {node: '>=12'}
+
+  d3@7.9.0:
+    resolution: {integrity: sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA==}
+    engines: {node: '>=12'}
+
+  dagre-d3-es@7.0.14:
+    resolution: {integrity: sha512-P4rFMVq9ESWqmOgK+dlXvOtLwYg0i7u0HBGJER0LZDJT2VHIPAMZ/riPxqJceWMStH5+E61QxFra9kIS3AqdMg==}
+
+  data-uri-to-buffer@4.0.1:
+    resolution: {integrity: sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==}
+    engines: {node: '>= 12'}
+
+  dayjs@1.11.20:
+    resolution: {integrity: sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  decode-named-character-reference@1.3.0:
+    resolution: {integrity: sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==}
+
+  decompress-response@6.0.0:
+    resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
+    engines: {node: '>=10'}
+
+  dedent@1.7.2:
+    resolution: {integrity: sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==}
+    peerDependencies:
+      babel-plugin-macros: ^3.1.0
+    peerDependenciesMeta:
+      babel-plugin-macros:
+        optional: true
+
+  deepmerge@4.3.1:
+    resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
+    engines: {node: '>=0.10.0'}
+
+  default-browser-id@5.0.1:
+    resolution: {integrity: sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==}
+    engines: {node: '>=18'}
+
+  default-browser@5.5.0:
+    resolution: {integrity: sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==}
+    engines: {node: '>=18'}
+
+  defaults@1.0.4:
+    resolution: {integrity: sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
+
+  defer-to-connect@2.0.1:
+    resolution: {integrity: sha512-4tvttepXG1VaYGrRibk5EwJd1t4udunSOVMdLSAL6mId1ix438oPwPZMALY41FCijukO1L0twNcGsdzS7dHgDg==}
+    engines: {node: '>=10'}
+
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
+  define-lazy-prop@3.0.0:
+    resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
+    engines: {node: '>=12'}
+
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
+  defu@6.1.4:
+    resolution: {integrity: sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==}
+
+  delaunator@5.1.0:
+    resolution: {integrity: sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==}
+
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
+  delegates@1.0.0:
+    resolution: {integrity: sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==}
+
+  denque@2.1.0:
+    resolution: {integrity: sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==}
+    engines: {node: '>=0.10'}
+
+  depd@2.0.0:
+    resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
+    engines: {node: '>= 0.8'}
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  destr@2.0.5:
+    resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  detect-node@2.1.0:
+    resolution: {integrity: sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==}
+
+  devlop@1.1.0:
+    resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  diff@8.0.2:
+    resolution: {integrity: sha512-sSuxWU5j5SR9QQji/o2qMvqRNYRDOcBTgsJ/DeCf4iSN4gW+gNMXM7wFIP+fdXZxoNiAnHUTGjCr+TSWXdRDKg==}
+    engines: {node: '>=0.3.1'}
+
+  dir-compare@4.2.0:
+    resolution: {integrity: sha512-2xMCmOoMrdQIPHdsTawECdNPwlVFB9zGcz3kuhmBO6U3oU+UQjsue0i8ayLKpgBcm+hcXPMVSGUN9d+pvJ6+VQ==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  dmg-builder@25.1.8:
+    resolution: {integrity: sha512-NoXo6Liy2heSklTI5OIZbCgXC1RzrDQsZkeEwXhdOro3FT1VBOvbubvscdPnjVuQ4AMwwv61oaH96AbiYg9EnQ==}
+
+  dmg-license@1.0.11:
+    resolution: {integrity: sha512-ZdzmqwKmECOWJpqefloC5OJy1+WZBBse5+MR88z9g9Zn4VY+WYUkAyojmhzJckH5YbbZGcYIuGAkY5/Ys5OM2Q==}
+    engines: {node: '>=8'}
+    os: [darwin]
+    hasBin: true
+
+  dompurify@3.3.3:
+    resolution: {integrity: sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==}
+
+  dotenv-expand@11.0.7:
+    resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
+    engines: {node: '>=12'}
+
+  dotenv@16.6.1:
+    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+    engines: {node: '>=12'}
+
+  dotenv@17.3.1:
+    resolution: {integrity: sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==}
+    engines: {node: '>=12'}
+
+  drizzle-kit@0.31.9:
+    resolution: {integrity: sha512-GViD3IgsXn7trFyBUUHyTFBpH/FsHTxYJ66qdbVggxef4UBPHRYxQaRzYLTuekYnk9i5FIEL9pbBIwMqX/Uwrg==}
+    hasBin: true
+
+  drizzle-orm@0.45.1:
+    resolution: {integrity: sha512-Te0FOdKIistGNPMq2jscdqngBRfBpC8uMFVwqjf6gtTVJHIQ/dosgV/CLBU2N4ZJBsXL5savCba9b0YJskKdcA==}
+    peerDependencies:
+      '@aws-sdk/client-rds-data': '>=3'
+      '@cloudflare/workers-types': '>=4'
+      '@electric-sql/pglite': '>=0.2.0'
+      '@libsql/client': '>=0.10.0'
+      '@libsql/client-wasm': '>=0.10.0'
+      '@neondatabase/serverless': '>=0.10.0'
+      '@op-engineering/op-sqlite': '>=2'
+      '@opentelemetry/api': ^1.4.1
+      '@planetscale/database': '>=1.13'
+      '@prisma/client': '*'
+      '@tidbcloud/serverless': '*'
+      '@types/better-sqlite3': '*'
+      '@types/pg': '*'
+      '@types/sql.js': '*'
+      '@upstash/redis': '>=1.34.7'
+      '@vercel/postgres': '>=0.8.0'
+      '@xata.io/client': '*'
+      better-sqlite3: '>=7'
+      bun-types: '*'
+      expo-sqlite: '>=14.0.0'
+      gel: '>=2'
+      knex: '*'
+      kysely: '*'
+      mysql2: '>=2'
+      pg: '>=8'
+      postgres: '>=3'
+      prisma: '*'
+      sql.js: '>=1'
+      sqlite3: '>=5'
+    peerDependenciesMeta:
+      '@aws-sdk/client-rds-data':
+        optional: true
+      '@cloudflare/workers-types':
+        optional: true
+      '@electric-sql/pglite':
+        optional: true
+      '@libsql/client':
+        optional: true
+      '@libsql/client-wasm':
+        optional: true
+      '@neondatabase/serverless':
+        optional: true
+      '@op-engineering/op-sqlite':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@planetscale/database':
+        optional: true
+      '@prisma/client':
+        optional: true
+      '@tidbcloud/serverless':
+        optional: true
+      '@types/better-sqlite3':
+        optional: true
+      '@types/pg':
+        optional: true
+      '@types/sql.js':
+        optional: true
+      '@upstash/redis':
+        optional: true
+      '@vercel/postgres':
+        optional: true
+      '@xata.io/client':
+        optional: true
+      better-sqlite3:
+        optional: true
+      bun-types:
+        optional: true
+      expo-sqlite:
+        optional: true
+      gel:
+        optional: true
+      knex:
+        optional: true
+      kysely:
+        optional: true
+      mysql2:
+        optional: true
+      pg:
+        optional: true
+      postgres:
+        optional: true
+      prisma:
+        optional: true
+      sql.js:
+        optional: true
+      sqlite3:
+        optional: true
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  eastasianwidth@0.2.0:
+    resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
+
+  eciesjs@0.4.18:
+    resolution: {integrity: sha512-wG99Zcfcys9fZux7Cft8BAX/YrOJLJSZ3jyYPfhZHqN2E+Ffx+QXBDsv3gubEgPtV6dTzJMSQUwk1H98/t/0wQ==}
+    engines: {bun: '>=1', deno: '>=2', node: '>=16'}
+
+  ee-first@1.1.1:
+    resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
+
+  ejs@3.1.10:
+    resolution: {integrity: sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==}
+    engines: {node: '>=0.10.0'}
+    hasBin: true
+
+  electron-builder-squirrel-windows@25.1.8:
+    resolution: {integrity: sha512-2ntkJ+9+0GFP6nAISiMabKt6eqBB0kX1QqHNWFWAXgi0VULKGisM46luRFpIBiU3u/TDmhZMM8tzvo2Abn3ayg==}
+
+  electron-builder@25.1.8:
+    resolution: {integrity: sha512-poRgAtUHHOnlzZnc9PK4nzG53xh74wj2Jy7jkTrqZ0MWPoHGh1M2+C//hGeYdA+4K8w4yiVCNYoLXF7ySj2Wig==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  electron-devtools-installer@4.0.0:
+    resolution: {integrity: sha512-9Tntu/jtfSn0n6N/ZI6IdvRqXpDyLQiDuuIbsBI+dL+1Ef7C8J2JwByw58P3TJiNeuqyV3ZkphpNWuZK5iSY2w==}
+
+  electron-publish@25.1.7:
+    resolution: {integrity: sha512-+jbTkR9m39eDBMP4gfbqglDd6UvBC7RLh5Y0MhFSsc6UkGHj9Vj9TWobxevHYMMqmoujL11ZLjfPpMX+Pt6YEg==}
+
+  electron-to-chromium@1.5.267:
+    resolution: {integrity: sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==}
+
+  electron-updater@6.8.3:
+    resolution: {integrity: sha512-Z6sgw3jgbikWKXei1ENdqFOxBP0WlXg3TtKfz0rgw2vIZFJUyI4pD7ZN7jrkm7EoMK+tcm/qTnPUdqfZukBlBQ==}
+
+  electron@35.7.5:
+    resolution: {integrity: sha512-dnL+JvLraKZl7iusXTVTGYs10TKfzUi30uEDTqsmTm0guN9V2tbOjTzyIZbh9n3ygUjgEYyo+igAwMRXIi3IPw==}
+    engines: {node: '>= 12.20.55'}
+    hasBin: true
+
+  emoji-regex@10.6.0:
+    resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
+
+  emoji-regex@8.0.0:
+    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
+
+  emoji-regex@9.2.2:
+    resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
+
+  encodeurl@2.0.0:
+    resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
+    engines: {node: '>= 0.8'}
+
+  encoding@0.1.13:
+    resolution: {integrity: sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==}
+
+  end-of-stream@1.4.5:
+    resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
+
+  enhanced-resolve@5.18.4:
+    resolution: {integrity: sha512-LgQMM4WXU3QI+SYgEc2liRgznaD5ojbmY3sb8LxyguVkIg5FxdpTkvk72te2R38/TGKxH634oLxXRGY6d7AP+Q==}
+    engines: {node: '>=10.13.0'}
+
+  entities@6.0.1:
+    resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
+    engines: {node: '>=0.12'}
+
+  env-paths@2.2.1:
+    resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
+    engines: {node: '>=6'}
+
+  err-code@2.0.3:
+    resolution: {integrity: sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==}
+
+  error-ex@1.3.4:
+    resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-object-atoms@1.1.1:
+    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es6-error@4.1.1:
+    resolution: {integrity: sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==}
+
+  esbuild-register@3.6.0:
+    resolution: {integrity: sha512-H2/S7Pm8a9CL1uhp9OvjwrBh5Pvx0H8qVOxNu8Wed9Y7qv56MPtq+GGM8RJpq6glYJn9Wspr8uw7l55uyinNeg==}
+    peerDependencies:
+      esbuild: '>=0.12 <1'
+
+  esbuild@0.18.20:
+    resolution: {integrity: sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==}
+    engines: {node: '>=12'}
+    hasBin: true
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  esbuild@0.27.2:
+    resolution: {integrity: sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  escape-html@1.0.3:
+    resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  escape-string-regexp@5.0.0:
+    resolution: {integrity: sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==}
+    engines: {node: '>=12'}
+
+  esprima@4.0.1:
+    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  estree-util-is-identifier-name@3.0.0:
+    resolution: {integrity: sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==}
+
+  etag@1.8.1:
+    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
+    engines: {node: '>= 0.6'}
+
+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
+  eventemitter3@4.0.7:
+    resolution: {integrity: sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}
+
+  eventemitter3@5.0.4:
+    resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==}
+
+  events@3.3.0:
+    resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
+    engines: {node: '>=0.8.x'}
+
+  eventsource-parser@3.0.6:
+    resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
+    engines: {node: '>=18.0.0'}
+
+  eventsource@3.0.7:
+    resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
+    engines: {node: '>=18.0.0'}
+
+  execa@5.1.1:
+    resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
+    engines: {node: '>=10'}
+
+  execa@9.6.1:
+    resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
+    engines: {node: ^18.19.0 || >=20.5.0}
+
+  exif-parser@0.1.12:
+    resolution: {integrity: sha512-c2bQfLNbMzLPmzQuOr8fy0csy84WmwnER81W88DzTp9CYNPJ6yzOj2EZAh9pywYpqHnshVLHQJ8WzldAyfY+Iw==}
+
+  expand-tilde@2.0.2:
+    resolution: {integrity: sha512-A5EmesHW6rfnZ9ysHQjPdJRni0SRar0tjtG5MNtm9n5TUvsYU8oozprtRD4AqHxcZWWlVuAmQo2nWKfN9oyjTw==}
+    engines: {node: '>=0.10.0'}
+
+  exponential-backoff@3.1.3:
+    resolution: {integrity: sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==}
+
+  express-rate-limit@8.4.1:
+    resolution: {integrity: sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcliS8La5EPRN3p9wzItqBwJrfNw==}
+    engines: {node: '>= 16'}
+    peerDependencies:
+      express: '>= 4.11'
+
+  express@5.2.1:
+    resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
+    engines: {node: '>= 18'}
+
+  exsolve@1.0.8:
+    resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
+
+  extend@3.0.2:
+    resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
+
+  extract-zip@2.0.1:
+    resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==}
+    engines: {node: '>= 10.17.0'}
+    hasBin: true
+
+  extsprintf@1.4.1:
+    resolution: {integrity: sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==}
+    engines: {'0': node >=0.6.0}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-string-truncated-width@3.0.3:
+    resolution: {integrity: sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==}
+
+  fast-string-width@3.0.2:
+    resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
+
+  fast-uri@3.1.0:
+    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+
+  fast-wrap-ansi@0.2.0:
+    resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==}
+
+  fast-xml-builder@1.1.3:
+    resolution: {integrity: sha512-1o60KoFw2+LWKQu3IdcfcFlGTW4dpqEWmjhYec6H82AYZU2TVBXep6tMl8Z1Y+wM+ZrzCwe3BZ9Vyd9N2rIvmg==}
+
+  fast-xml-parser@5.4.1:
+    resolution: {integrity: sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==}
+    hasBin: true
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fd-slicer@1.1.0:
+    resolution: {integrity: sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fetch-blob@3.2.0:
+    resolution: {integrity: sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==}
+    engines: {node: ^12.20 || >= 14.13}
+
+  figures@6.1.0:
+    resolution: {integrity: sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==}
+    engines: {node: '>=18'}
+
+  file-type@16.5.4:
+    resolution: {integrity: sha512-/yFHK0aGjFEgDJjEKP0pWCplsPFPhwyfwevf/pVxiN0tmE4L9LmwWxWukdJSHdoCli4VgQLehjJtwQBnqmsKcw==}
+    engines: {node: '>=10'}
+
+  filelist@1.0.6:
+    resolution: {integrity: sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  finalhandler@2.1.1:
+    resolution: {integrity: sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==}
+    engines: {node: '>= 18.0.0'}
+
+  find-babel-config@2.1.2:
+    resolution: {integrity: sha512-ZfZp1rQyp4gyuxqt1ZqjFGVeVBvmpURMqdIWXbPRfB97Bf6BzdK/xSIbylEINzQ0kB5tlDQfn9HkNXXWsqTqLg==}
+
+  find-up@3.0.0:
+    resolution: {integrity: sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==}
+    engines: {node: '>=6'}
+
+  fix-dts-default-cjs-exports@1.0.1:
+    resolution: {integrity: sha512-pVIECanWFC61Hzl2+oOCtoJ3F17kglZC/6N94eRWycFgBH35hHx0Li604ZIzhseh97mf2p0cv7vVrOZGoqhlEg==}
+
+  follow-redirects@1.15.11:
+    resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
+  foreground-child@3.3.1:
+    resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
+    engines: {node: '>=14'}
+
+  form-data@4.0.5:
+    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+    engines: {node: '>= 6'}
+
+  formdata-polyfill@4.0.10:
+    resolution: {integrity: sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==}
+    engines: {node: '>=12.20.0'}
+
+  forwarded-parse@2.1.2:
+    resolution: {integrity: sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==}
+
+  forwarded@0.2.0:
+    resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
+    engines: {node: '>= 0.6'}
+
+  fraction.js@4.3.7:
+    resolution: {integrity: sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew==}
+
+  framer-motion@12.35.1:
+    resolution: {integrity: sha512-rL8cLrjYZNShZqKV3U0Qj6Y5WDiZXYEM5giiTLfEqsIZxtspzMDCkKmrO5po76jWfvOg04+Vk+sfBvTD0iMmLw==}
+    peerDependencies:
+      '@emotion/is-prop-valid': '*'
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@emotion/is-prop-valid':
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  fresh@2.0.0:
+    resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
+    engines: {node: '>= 0.8'}
+
+  fs-constants@1.0.0:
+    resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
+
+  fs-extra@10.1.0:
+    resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==}
+    engines: {node: '>=12'}
+
+  fs-extra@11.3.4:
+    resolution: {integrity: sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA==}
+    engines: {node: '>=14.14'}
+
+  fs-extra@8.1.0:
+    resolution: {integrity: sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==}
+    engines: {node: '>=6 <7 || >=8'}
+
+  fs-extra@9.1.0:
+    resolution: {integrity: sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==}
+    engines: {node: '>=10'}
+
+  fs-minipass@2.1.0:
+    resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
+    engines: {node: '>= 8'}
+
+  fs.realpath@1.0.0:
+    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
+
+  fsevents@2.3.2:
+    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  fuzzysort@3.1.0:
+    resolution: {integrity: sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==}
+
+  gauge@4.0.4:
+    resolution: {integrity: sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    deprecated: This package is no longer supported.
+
+  generate-function@2.3.1:
+    resolution: {integrity: sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-caller-file@2.0.5:
+    resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
+    engines: {node: 6.* || 8.* || >= 10.*}
+
+  get-east-asian-width@1.5.0:
+    resolution: {integrity: sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==}
+    engines: {node: '>=18'}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-own-enumerable-keys@1.0.0:
+    resolution: {integrity: sha512-PKsK2FSrQCyxcGHsGrLDcK0lx+0Ke+6e8KFFozA9/fIQLhQzPaRvJFdcz7+Axg3jUH/Mq+NI4xa5u/UT2tQskA==}
+    engines: {node: '>=14.16'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-stream@5.2.0:
+    resolution: {integrity: sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==}
+    engines: {node: '>=8'}
+
+  get-stream@6.0.1:
+    resolution: {integrity: sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==}
+    engines: {node: '>=10'}
+
+  get-stream@9.0.1:
+    resolution: {integrity: sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==}
+    engines: {node: '>=18'}
+
+  get-tsconfig@4.13.1:
+    resolution: {integrity: sha512-EoY1N2xCn44xU6750Sx7OjOIT59FkmstNc3X6y5xpz7D5cBtZRe/3pSlTkDJgqsOk3WwZPkWfonhhUJfttQo3w==}
+
+  get-tsconfig@4.13.6:
+    resolution: {integrity: sha512-shZT/QMiSHc/YBLxxOkMtgSid5HFoauqCE3/exfsEcwg1WkeqjG+V40yBbBrsD+jW2HDXcs28xOfcbm2jI8Ddw==}
+
+  gifwrap@0.10.1:
+    resolution: {integrity: sha512-2760b1vpJHNmLzZ/ubTtNnEx5WApN/PYWJvXvgS+tL1egTTthayFYIQQNi136FLEDcN/IyEY2EcGpIITD6eYUw==}
+
+  giget@2.0.0:
+    resolution: {integrity: sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==}
+    hasBin: true
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  glob@10.5.0:
+    resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+    hasBin: true
+
+  glob@7.2.3:
+    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
+  glob@8.1.0:
+    resolution: {integrity: sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==}
+    engines: {node: '>=12'}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
+  glob@9.3.5:
+    resolution: {integrity: sha512-e1LleDykUz2Iu+MTYdkSsuWX8lvAjAcs0Xef0lNIu0S2wOAzuTxCJtcd9S3cijlwYF18EsU3rzb8jPVobxDh9Q==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
+  global-agent@3.0.0:
+    resolution: {integrity: sha512-PT6XReJ+D07JvGoxQMkT6qji/jVNfX/h364XHZOWeRzy64sSFr+xJ5OX7LI3b4MPQzdL4H8Y8M0xzPpsVMwA8Q==}
+    engines: {node: '>=10.0'}
+
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  got@11.8.6:
+    resolution: {integrity: sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==}
+    engines: {node: '>=10.19.0'}
+
+  graceful-fs@4.2.11:
+    resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
+  grammy@1.39.3:
+    resolution: {integrity: sha512-7arRRoOtOh9UwMwANZ475kJrWV6P3/EGNooeHlY0/SwZv4t3ZZ3Uiz9cAXK8Zg9xSdgmm8T21kx6n7SZaWvOcw==}
+    engines: {node: ^12.20.0 || >=14.13.1}
+
+  graphql@16.13.2:
+    resolution: {integrity: sha512-5bJ+nf/UCpAjHM8i06fl7eLyVC9iuNAjm9qzkiu2ZGhM0VscSvS6WDPfAwkdkBuoXGM9FJSbKl6wylMwP9Ktig==}
+    engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
+
+  hachure-fill@0.5.2:
+    resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  has-unicode@2.0.1:
+    resolution: {integrity: sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==}
+
+  hasown@2.0.2:
+    resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
+    engines: {node: '>= 0.4'}
+
+  hast-util-from-parse5@8.0.3:
+    resolution: {integrity: sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg==}
+
+  hast-util-parse-selector@4.0.0:
+    resolution: {integrity: sha512-wkQCkSYoOGCRKERFWcxMVMOcYE2K1AaNLU8DXS9arxnLOUEWbOXKXiJUNzEpqZ3JOKpnha3jkFrumEjVliDe7A==}
+
+  hast-util-raw@9.1.0:
+    resolution: {integrity: sha512-Y8/SBAHkZGoNkpzqqfCldijcuUKh7/su31kEBp67cFY09Wy0mTRgtsLYsiIxMJxlu0f6AA5SUTbDR8K0rxnbUw==}
+
+  hast-util-sanitize@5.0.2:
+    resolution: {integrity: sha512-3yTWghByc50aGS7JlGhk61SPenfE/p1oaFeNwkOOyrscaOkMGrcW9+Cy/QAIOBpZxP1yqDIzFMR0+Np0i0+usg==}
+
+  hast-util-to-jsx-runtime@2.3.6:
+    resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==}
+
+  hast-util-to-parse5@8.0.1:
+    resolution: {integrity: sha512-MlWT6Pjt4CG9lFCjiz4BH7l9wmrMkfkJYCxFwKQic8+RTZgWPuWxwAfjJElsXkex7DJjfSJsQIt931ilUgmwdA==}
+
+  hast-util-whitespace@3.0.0:
+    resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==}
+
+  hastscript@9.0.1:
+    resolution: {integrity: sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w==}
+
+  headers-polyfill@5.0.1:
+    resolution: {integrity: sha512-1TJ6Fih/b8h5TIcv+1+Hw0PDQWJTKDKzFZzcKOiW1wJza3XoAQlkCuXLbymPYB8+ZQyw8mHvdw560e8zVFIWyA==}
+
+  homedir-polyfill@1.0.3:
+    resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==}
+    engines: {node: '>=0.10.0'}
+
+  hono-openapi@1.3.0:
+    resolution: {integrity: sha512-xDvCWpWEIv0weEmnl3EjRQzqbHIO8LnfzMuYOCmbuyE5aes6aXxLg4vM3ybnoZD5TiTUkA6PuRQPJs3R7WRBig==}
+    peerDependencies:
+      '@hono/standard-validator': ^0.2.0
+      '@standard-community/standard-json': ^0.3.5
+      '@standard-community/standard-openapi': ^0.2.9
+      '@types/json-schema': ^7.0.15
+      hono: ^4.8.3
+      openapi-types: ^12.1.3
+    peerDependenciesMeta:
+      '@hono/standard-validator':
+        optional: true
+      hono:
+        optional: true
+
+  hono-rate-limiter@0.4.2:
+    resolution: {integrity: sha512-AAtFqgADyrmbDijcRTT/HJfwqfvhalya2Zo+MgfdrMPas3zSMD8SU03cv+ZsYwRU1swv7zgVt0shwN059yzhjw==}
+    peerDependencies:
+      hono: ^4.1.1
+
+  hono@4.12.12:
+    resolution: {integrity: sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==}
+    engines: {node: '>=16.9.0'}
+
+  hono@4.12.8:
+    resolution: {integrity: sha512-VJCEvtrezO1IAR+kqEYnxUOoStaQPGrCmX3j4wDTNOcD1uRPFpGlwQUIW8niPuvHXaTUxeOUl5MMDGrl+tmO9A==}
+    engines: {node: '>=16.9.0'}
+
+  hosted-git-info@4.1.0:
+    resolution: {integrity: sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==}
+    engines: {node: '>=10'}
+
+  html-entities@2.3.3:
+    resolution: {integrity: sha512-DV5Ln36z34NNTDgnz0EWGBLZENelNAtkiFA4kyNOG2tDI6Mz1uSWiq1wAKdyjnJwyDiDO7Fa2SO1CTxPXL8VxA==}
+
+  html-url-attributes@3.0.1:
+    resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
+
+  html-void-elements@3.0.0:
+    resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
+
+  http-cache-semantics@4.2.0:
+    resolution: {integrity: sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==}
+
+  http-errors@2.0.1:
+    resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
+    engines: {node: '>= 0.8'}
+
+  http-proxy-agent@5.0.0:
+    resolution: {integrity: sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==}
+    engines: {node: '>= 6'}
+
+  http-proxy-agent@7.0.2:
+    resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
+    engines: {node: '>= 14'}
+
+  http2-wrapper@1.0.3:
+    resolution: {integrity: sha512-V+23sDMr12Wnz7iTcDeJr3O6AIxlnvT/bmaAAAP/Xda35C90p9599p0F1eHR/N1KILWSoWVAiOMFjBBXaXSMxg==}
+    engines: {node: '>=10.19.0'}
+
+  https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+
+  https-proxy-agent@7.0.6:
+    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
+    engines: {node: '>= 14'}
+
+  human-signals@2.1.0:
+    resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
+    engines: {node: '>=10.17.0'}
+
+  human-signals@8.0.1:
+    resolution: {integrity: sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ==}
+    engines: {node: '>=18.18.0'}
+
+  humanize-ms@1.2.1:
+    resolution: {integrity: sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==}
+
+  iconv-corefoundation@1.1.7:
+    resolution: {integrity: sha512-T10qvkw0zz4wnm560lOEg0PovVqUXuOFhhHAkixw8/sycy7TJt7v/RrkEKEQnAw2viPSJu6iAkErxnzR0g8PpQ==}
+    engines: {node: ^8.11.2 || >=10}
+    os: [darwin]
+
+  iconv-lite@0.6.3:
+    resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
+    engines: {node: '>=0.10.0'}
+
+  iconv-lite@0.7.2:
+    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
+    engines: {node: '>=0.10.0'}
+
+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  image-q@4.0.0:
+    resolution: {integrity: sha512-PfJGVgIfKQJuq3s0tTDOKtztksibuUEbJQIYT3by6wctQo+Rdlh7ef4evJ5NCdxY4CfMbvFkocEwbl4BF8RlJw==}
+
+  immediate@3.0.6:
+    resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  import-in-the-middle@2.0.6:
+    resolution: {integrity: sha512-3vZV3jX0XRFW3EJDTwzWoZa+RH1b8eTTx6YOCjglrLyPuepwoBti1k3L2dKwdCUrnVEfc5CuRuGstaC/uQJJaw==}
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  indent-string@4.0.0:
+    resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
+    engines: {node: '>=8'}
+
+  infer-owner@1.0.4:
+    resolution: {integrity: sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==}
+
+  inflight@1.0.6:
+    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
+    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+  inline-style-parser@0.2.7:
+    resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
+
+  internmap@1.0.1:
+    resolution: {integrity: sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw==}
+
+  internmap@2.0.3:
+    resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==}
+    engines: {node: '>=12'}
+
+  ip-address@10.1.0:
+    resolution: {integrity: sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==}
+    engines: {node: '>= 12'}
+
+  ipaddr.js@1.9.1:
+    resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
+    engines: {node: '>= 0.10'}
+
+  is-alphabetical@2.0.1:
+    resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==}
+
+  is-alphanumerical@2.0.1:
+    resolution: {integrity: sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==}
+
+  is-arrayish@0.2.1:
+    resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-buffer@2.0.5:
+    resolution: {integrity: sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ==}
+    engines: {node: '>=4'}
+
+  is-ci@3.0.1:
+    resolution: {integrity: sha512-ZYvCgrefwqoQ6yTyYUbQu64HsITZ3NfKX1lzaEYdkTDcfKzzCI/wthRRYKkdjHKFVgNiXKAKm65Zo1pk2as/QQ==}
+    hasBin: true
+
+  is-core-module@2.16.1:
+    resolution: {integrity: sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==}
+    engines: {node: '>= 0.4'}
+
+  is-decimal@2.0.1:
+    resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==}
+
+  is-docker@3.0.0:
+    resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+    hasBin: true
+
+  is-electron@2.2.2:
+    resolution: {integrity: sha512-FO/Rhvz5tuw4MCWkpMzHFKWD2LsfHzIb7i6MdPYZ/KW7AlxawyLkqdy+jPZP1WubqEADE3O4FUENlJHDfQASRg==}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-fullwidth-code-point@3.0.0:
+    resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
+    engines: {node: '>=8'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-hexadecimal@2.0.1:
+    resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
+
+  is-in-ssh@1.0.0:
+    resolution: {integrity: sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw==}
+    engines: {node: '>=20'}
+
+  is-inside-container@1.0.0:
+    resolution: {integrity: sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==}
+    engines: {node: '>=14.16'}
+    hasBin: true
+
+  is-interactive@1.0.0:
+    resolution: {integrity: sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
+    engines: {node: '>=8'}
+
+  is-interactive@2.0.0:
+    resolution: {integrity: sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ==}
+    engines: {node: '>=12'}
+
+  is-lambda@1.0.1:
+    resolution: {integrity: sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==}
+
+  is-node-process@1.2.0:
+    resolution: {integrity: sha512-Vg4o6/fqPxIjtxgUH5QLJhwZ7gW5diGCVlXpuUfELC62CuxM1iHcRe51f2W1FDy04Ai4KJkagKjx3XaqyfRKXw==}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-obj@3.0.0:
+    resolution: {integrity: sha512-IlsXEHOjtKhpN8r/tRFj2nDyTmHvcfNeu/nrRIcXE17ROeatXchkojffa1SpdqW4cr/Fj6QkEf/Gn4zf6KKvEQ==}
+    engines: {node: '>=12'}
+
+  is-plain-obj@4.1.0:
+    resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
+    engines: {node: '>=12'}
+
+  is-promise@4.0.0:
+    resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}
+
+  is-property@1.0.2:
+    resolution: {integrity: sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==}
+
+  is-regexp@3.1.0:
+    resolution: {integrity: sha512-rbku49cWloU5bSMI+zaRaXdQHXnthP6DZ/vLnfdSKyL4zUzuWnomtOEiZZOd+ioQ+avFo/qau3KPTc7Fjy1uPA==}
+    engines: {node: '>=12'}
+
+  is-stream@2.0.1:
+    resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
+    engines: {node: '>=8'}
+
+  is-stream@4.0.1:
+    resolution: {integrity: sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==}
+    engines: {node: '>=18'}
+
+  is-unicode-supported@0.1.0:
+    resolution: {integrity: sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==}
+    engines: {node: '>=10'}
+
+  is-unicode-supported@1.3.0:
+    resolution: {integrity: sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ==}
+    engines: {node: '>=12'}
+
+  is-unicode-supported@2.1.0:
+    resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
+    engines: {node: '>=18'}
+
+  is-what@4.1.16:
+    resolution: {integrity: sha512-ZhMwEosbFJkA0YhFnNDgTM4ZxDRsS6HqTo7qsZM08fehyRYIYa0yHu5R6mgo1n/8MgaPBXiPimPD77baVFYg+A==}
+    engines: {node: '>=12.13'}
+
+  is-wsl@3.1.1:
+    resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
+    engines: {node: '>=16'}
+
+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
+  isbinaryfile@4.0.10:
+    resolution: {integrity: sha512-iHrqe5shvBUcFbmZq9zOQHBoeOhZJu6RQGrDpBgenUm/Am+F3JM2MgQj+rK3Z601fzrL5gLZWtAPH2OBaSVcyw==}
+    engines: {node: '>= 8.0.0'}
+
+  isbinaryfile@5.0.7:
+    resolution: {integrity: sha512-gnWD14Jh3FzS3CPhF0AxNOJ8CxqeblPTADzI38r0wt8ZyQl5edpy75myt08EG2oKvpyiqSqsx+Wkz9vtkbTqYQ==}
+    engines: {node: '>= 18.0.0'}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  isexe@3.1.5:
+    resolution: {integrity: sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==}
+    engines: {node: '>=18'}
+
+  isomorphic-ws@5.0.0:
+    resolution: {integrity: sha512-muId7Zzn9ywDsyXgTIafTry2sV3nySZeUDe6YedVd1Hvuuep5AsIlqK+XefWpYTyJG5e503F2xIuT2lcU6rCSw==}
+    peerDependencies:
+      ws: '*'
+
+  isomorphic.js@0.2.5:
+    resolution: {integrity: sha512-PIeMbHqMt4DnUP3MA/Flc0HElYjMXArsw1qwJZcm9sqR8mq3l8NYizFMty0pWwE/tzIGH3EKK5+jes5mAr85yw==}
+
+  jackspeak@3.4.3:
+    resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
+
+  jake@10.9.4:
+    resolution: {integrity: sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  jimp@1.6.0:
+    resolution: {integrity: sha512-YcwCHw1kiqEeI5xRpDlPPBGL2EOpBKLwO4yIBJcXWHPj5PnA5urGq0jbyhM5KoNpypQ6VboSoxc9D8HyfvngSg==}
+    engines: {node: '>=18'}
+
+  jiti@1.21.7:
+    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
+    hasBin: true
+
+  jiti@2.6.1:
+    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
+    hasBin: true
+
+  jose@6.1.3:
+    resolution: {integrity: sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==}
+
+  joycon@3.1.1:
+    resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
+    engines: {node: '>=10'}
+
+  jpeg-js@0.4.4:
+    resolution: {integrity: sha512-WZzeDOEtTOBK4Mdsar0IqEU5sMr3vSV2RqkAIzUEV2BHnUfKGyswWFPFwK5EeDo93K3FohSHbLAjj0s1Wzd+dg==}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-parse-even-better-errors@2.3.1:
+    resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  json-schema-typed@8.0.2:
+    resolution: {integrity: sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==}
+
+  json-schema@0.4.0:
+    resolution: {integrity: sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==}
+
+  json-stringify-safe@5.0.1:
+    resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  jsonc-parser@3.3.1:
+    resolution: {integrity: sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==}
+
+  jsonfile@4.0.0:
+    resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
+
+  jsonfile@6.2.1:
+    resolution: {integrity: sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==}
+
+  jszip@3.10.1:
+    resolution: {integrity: sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==}
+
+  katex@0.16.45:
+    resolution: {integrity: sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==}
+    hasBin: true
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  khroma@2.1.0:
+    resolution: {integrity: sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw==}
+
+  kleur@3.0.3:
+    resolution: {integrity: sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==}
+    engines: {node: '>=6'}
+
+  kleur@4.1.5:
+    resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
+    engines: {node: '>=6'}
+
+  kysely@0.28.15:
+    resolution: {integrity: sha512-r2clcf7HLWvDXaVUEvQymXJY4i3bSOIV3xsL/Upy3ZfSv5HeKsk9tsqbBptLvth5qHEIhxeHTA2jNLyQABkLBA==}
+    engines: {node: '>=20.0.0'}
+
+  langium@4.2.1:
+    resolution: {integrity: sha512-zu9QWmjpzJcomzdJQAHgDVhLGq5bLosVak1KVa40NzQHXfqr4eAHupvnPOVXEoLkg6Ocefvf/93d//SB7du4YQ==}
+    engines: {node: '>=20.10.0', npm: '>=10.2.3'}
+
+  layout-base@1.0.2:
+    resolution: {integrity: sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg==}
+
+  layout-base@2.0.1:
+    resolution: {integrity: sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg==}
+
+  lazy-val@1.0.5:
+    resolution: {integrity: sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q==}
+
+  lazystream@1.0.1:
+    resolution: {integrity: sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==}
+    engines: {node: '>= 0.6.3'}
+
+  lexical@0.35.0:
+    resolution: {integrity: sha512-3VuV8xXhh5xJA6tzvfDvE0YBCMkIZUmxtRilJQDDdCgJCc+eut6qAv2qbN+pbqvarqcQqPN1UF+8YvsjmyOZpw==}
+
+  lib0@0.2.117:
+    resolution: {integrity: sha512-DeXj9X5xDCjgKLU/7RR+/HQEVzuuEUiwldwOGsHK/sfAfELGWEyTcf0x+uOvCvK3O2zPmZePXWL85vtia6GyZw==}
+    engines: {node: '>=16'}
+    hasBin: true
+
+  lie@3.3.0:
+    resolution: {integrity: sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==}
+
+  lightningcss-android-arm64@1.30.2:
+    resolution: {integrity: sha512-BH9sEdOCahSgmkVhBLeU7Hc9DWeZ1Eb6wNS6Da8igvUwAe0sqROHddIlvU06q3WyXVEOYDZ6ykBZQnjTbmo4+A==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  lightningcss-darwin-arm64@1.30.2:
+    resolution: {integrity: sha512-ylTcDJBN3Hp21TdhRT5zBOIi73P6/W0qwvlFEk22fkdXchtNTOU4Qc37SkzV+EKYxLouZ6M4LG9NfZ1qkhhBWA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  lightningcss-darwin-x64@1.30.2:
+    resolution: {integrity: sha512-oBZgKchomuDYxr7ilwLcyms6BCyLn0z8J0+ZZmfpjwg9fRVZIR5/GMXd7r9RH94iDhld3UmSjBM6nXWM2TfZTQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  lightningcss-freebsd-x64@1.30.2:
+    resolution: {integrity: sha512-c2bH6xTrf4BDpK8MoGG4Bd6zAMZDAXS569UxCAGcA7IKbHNMlhGQ89eRmvpIUGfKWNVdbhSbkQaWhEoMGmGslA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  lightningcss-linux-arm-gnueabihf@1.30.2:
+    resolution: {integrity: sha512-eVdpxh4wYcm0PofJIZVuYuLiqBIakQ9uFZmipf6LF/HRj5Bgm0eb3qL/mr1smyXIS1twwOxNWndd8z0E374hiA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
+  lightningcss-linux-arm64-gnu@1.30.2:
+    resolution: {integrity: sha512-UK65WJAbwIJbiBFXpxrbTNArtfuznvxAJw4Q2ZGlU8kPeDIWEX1dg3rn2veBVUylA2Ezg89ktszWbaQnxD/e3A==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  lightningcss-linux-arm64-musl@1.30.2:
+    resolution: {integrity: sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  lightningcss-linux-x64-gnu@1.30.2:
+    resolution: {integrity: sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+
+  lightningcss-linux-x64-musl@1.30.2:
+    resolution: {integrity: sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+
+  lightningcss-win32-arm64-msvc@1.30.2:
+    resolution: {integrity: sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  lightningcss-win32-x64-msvc@1.30.2:
+    resolution: {integrity: sha512-5g1yc73p+iAkid5phb4oVFMB45417DkRevRbt/El/gKXJk4jid+vPFF/AXbxn05Aky8PapwzZrdJShv5C0avjw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  lightningcss@1.30.2:
+    resolution: {integrity: sha512-utfs7Pr5uJyyvDETitgsaqSyjCb2qNRAtuqUeWIAKztsOYdcACf2KtARYXg2pSvhkt+9NfoaNY7fxjl6nuMjIQ==}
+    engines: {node: '>= 12.0.0'}
+
+  lilconfig@2.1.0:
+    resolution: {integrity: sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==}
+    engines: {node: '>=10'}
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  load-tsconfig@0.2.5:
+    resolution: {integrity: sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  locate-path@3.0.0:
+    resolution: {integrity: sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==}
+    engines: {node: '>=6'}
+
+  lodash-es@4.17.23:
+    resolution: {integrity: sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==}
+
+  lodash-es@4.18.1:
+    resolution: {integrity: sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==}
+
+  lodash.camelcase@4.3.0:
+    resolution: {integrity: sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==}
+
+  lodash.defaults@4.2.0:
+    resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==}
+
+  lodash.difference@4.5.0:
+    resolution: {integrity: sha512-dS2j+W26TQ7taQBGN8Lbbq04ssV3emRw4NY58WErlTO29pIqS0HmoT5aJ9+TUQ1N3G+JOZSji4eugsWwGp9yPA==}
+
+  lodash.escaperegexp@4.1.2:
+    resolution: {integrity: sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw==}
+
+  lodash.flatten@4.4.0:
+    resolution: {integrity: sha512-C5N2Z3DgnnKr0LOpv/hKCgKdb7ZZwafIrsesve6lmzvZIRZRGaZ/l6Q8+2W7NaT+ZwO3fFlSCzCzrDCFdJfZ4g==}
+
+  lodash.isequal@4.5.0:
+    resolution: {integrity: sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==}
+    deprecated: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
+
+  lodash.isplainobject@4.0.6:
+    resolution: {integrity: sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==}
+
+  lodash.union@4.6.0:
+    resolution: {integrity: sha512-c4pB2CdGrGdjMKYLA+XiRDO7Y0PRQbm/Gzg8qMj+QH+pFVAoTp5sBpO0odL3FjoPCGjK96p6qsP+yQoiLoOBcw==}
+
+  lodash@4.18.1:
+    resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
+
+  log-symbols@4.1.0:
+    resolution: {integrity: sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==}
+    engines: {node: '>=10'}
+
+  log-symbols@6.0.0:
+    resolution: {integrity: sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==}
+    engines: {node: '>=18'}
+
+  long@5.3.2:
+    resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
+
+  longest-streak@3.1.0:
+    resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  lowercase-keys@2.0.0:
+    resolution: {integrity: sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==}
+    engines: {node: '>=8'}
+
+  lru-cache@10.4.3:
+    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  lru-cache@6.0.0:
+    resolution: {integrity: sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==}
+    engines: {node: '>=10'}
+
+  lru-cache@7.18.3:
+    resolution: {integrity: sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==}
+    engines: {node: '>=12'}
+
+  lru.min@1.1.4:
+    resolution: {integrity: sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==}
+    engines: {bun: '>=1.0.0', deno: '>=1.30.0', node: '>=8.0.0'}
+
+  lucide-react@0.577.0:
+    resolution: {integrity: sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  lucide-solid@0.562.0:
+    resolution: {integrity: sha512-RzxujbWUoa4KqnV+/mYPINzyf1W969bv0jukSKcGExIl96QmRuylvBQ+d0UcOeZL/ASToPOWS34p9MfdzdvS9Q==}
+    peerDependencies:
+      solid-js: ^1.4.7
+
+  luxon@3.7.2:
+    resolution: {integrity: sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew==}
+    engines: {node: '>=12'}
+
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+  make-fetch-happen@10.2.1:
+    resolution: {integrity: sha512-NgOPbRiaQM10DYXvN3/hhGVI2M5MtITFryzBGxHM5p4wnFxsVCbxkrBrDsk+EZ5OB4jEOT7AjDxtdF+KVEFT7w==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  markdown-table@3.0.4:
+    resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
+
+  marked@16.4.2:
+    resolution: {integrity: sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA==}
+    engines: {node: '>= 20'}
+    hasBin: true
+
+  marked@17.0.1:
+    resolution: {integrity: sha512-boeBdiS0ghpWcSwoNm/jJBwdpFaMnZWRzjA6SkUMYb40SVaN1x7mmfGKp0jvexGcx+7y2La5zRZsYFZI6Qpypg==}
+    engines: {node: '>= 20'}
+    hasBin: true
+
+  matcher@3.0.0:
+    resolution: {integrity: sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==}
+    engines: {node: '>=10'}
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  mdast-util-find-and-replace@3.0.2:
+    resolution: {integrity: sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==}
+
+  mdast-util-from-markdown@2.0.3:
+    resolution: {integrity: sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==}
+
+  mdast-util-gfm-autolink-literal@2.0.1:
+    resolution: {integrity: sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==}
+
+  mdast-util-gfm-footnote@2.1.0:
+    resolution: {integrity: sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==}
+
+  mdast-util-gfm-strikethrough@2.0.0:
+    resolution: {integrity: sha512-mKKb915TF+OC5ptj5bJ7WFRPdYtuHv0yTRxK2tJvi+BDqbkiG7h7u/9SI89nRAYcmap2xHQL9D+QG/6wSrTtXg==}
+
+  mdast-util-gfm-table@2.0.0:
+    resolution: {integrity: sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg==}
+
+  mdast-util-gfm-task-list-item@2.0.0:
+    resolution: {integrity: sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==}
+
+  mdast-util-gfm@3.1.0:
+    resolution: {integrity: sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==}
+
+  mdast-util-mdx-expression@2.0.1:
+    resolution: {integrity: sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==}
+
+  mdast-util-mdx-jsx@3.2.0:
+    resolution: {integrity: sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==}
+
+  mdast-util-mdxjs-esm@2.0.1:
+    resolution: {integrity: sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==}
+
+  mdast-util-phrasing@4.1.0:
+    resolution: {integrity: sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==}
+
+  mdast-util-to-hast@13.2.1:
+    resolution: {integrity: sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==}
+
+  mdast-util-to-markdown@2.1.2:
+    resolution: {integrity: sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==}
+
+  mdast-util-to-string@4.0.0:
+    resolution: {integrity: sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==}
+
+  media-typer@1.1.0:
+    resolution: {integrity: sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==}
+    engines: {node: '>= 0.8'}
+
+  merge-anything@5.1.7:
+    resolution: {integrity: sha512-eRtbOb1N5iyH0tkQDAoQ4Ipsp/5qSR79Dzrz8hEPxRX10RWWR/iQXdoKmBSRCThY1Fh5EhISDtpSc93fpxUniQ==}
+    engines: {node: '>=12.13'}
+
+  merge-descriptors@2.0.0:
+    resolution: {integrity: sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==}
+    engines: {node: '>=18'}
+
+  merge-stream@2.0.0:
+    resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  mermaid@11.14.0:
+    resolution: {integrity: sha512-GSGloRsBs+JINmmhl0JDwjpuezCsHB4WGI4NASHxL3fHo3o/BRXTxhDLKnln8/Q0lRFRyDdEjmk1/d5Sn1Xz8g==}
+
+  micromark-core-commonmark@2.0.3:
+    resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
+
+  micromark-extension-gfm-autolink-literal@2.1.0:
+    resolution: {integrity: sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==}
+
+  micromark-extension-gfm-footnote@2.1.0:
+    resolution: {integrity: sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==}
+
+  micromark-extension-gfm-strikethrough@2.1.0:
+    resolution: {integrity: sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==}
+
+  micromark-extension-gfm-table@2.1.1:
+    resolution: {integrity: sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg==}
+
+  micromark-extension-gfm-tagfilter@2.0.0:
+    resolution: {integrity: sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==}
+
+  micromark-extension-gfm-task-list-item@2.1.0:
+    resolution: {integrity: sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==}
+
+  micromark-extension-gfm@3.0.0:
+    resolution: {integrity: sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==}
+
+  micromark-factory-destination@2.0.1:
+    resolution: {integrity: sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==}
+
+  micromark-factory-label@2.0.1:
+    resolution: {integrity: sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==}
+
+  micromark-factory-space@2.0.1:
+    resolution: {integrity: sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==}
+
+  micromark-factory-title@2.0.1:
+    resolution: {integrity: sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==}
+
+  micromark-factory-whitespace@2.0.1:
+    resolution: {integrity: sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==}
+
+  micromark-util-character@2.1.1:
+    resolution: {integrity: sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==}
+
+  micromark-util-chunked@2.0.1:
+    resolution: {integrity: sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==}
+
+  micromark-util-classify-character@2.0.1:
+    resolution: {integrity: sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==}
+
+  micromark-util-combine-extensions@2.0.1:
+    resolution: {integrity: sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==}
+
+  micromark-util-decode-numeric-character-reference@2.0.2:
+    resolution: {integrity: sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==}
+
+  micromark-util-decode-string@2.0.1:
+    resolution: {integrity: sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==}
+
+  micromark-util-encode@2.0.1:
+    resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==}
+
+  micromark-util-html-tag-name@2.0.1:
+    resolution: {integrity: sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==}
+
+  micromark-util-normalize-identifier@2.0.1:
+    resolution: {integrity: sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==}
+
+  micromark-util-resolve-all@2.0.1:
+    resolution: {integrity: sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==}
+
+  micromark-util-sanitize-uri@2.0.1:
+    resolution: {integrity: sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==}
+
+  micromark-util-subtokenize@2.1.0:
+    resolution: {integrity: sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==}
+
+  micromark-util-symbol@2.0.1:
+    resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==}
+
+  micromark-util-types@2.0.2:
+    resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==}
+
+  micromark@4.0.2:
+    resolution: {integrity: sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-db@1.54.0:
+    resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@3.0.2:
+    resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
+    engines: {node: '>=18'}
+
+  mime@2.6.0:
+    resolution: {integrity: sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==}
+    engines: {node: '>=4.0.0'}
+    hasBin: true
+
+  mime@3.0.0:
+    resolution: {integrity: sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==}
+    engines: {node: '>=10.0.0'}
+    hasBin: true
+
+  mimic-fn@2.1.0:
+    resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
+    engines: {node: '>=6'}
+
+  mimic-function@5.0.1:
+    resolution: {integrity: sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==}
+    engines: {node: '>=18'}
+
+  mimic-response@1.0.1:
+    resolution: {integrity: sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ==}
+    engines: {node: '>=4'}
+
+  mimic-response@3.1.0:
+    resolution: {integrity: sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==}
+    engines: {node: '>=10'}
+
+  minimatch@10.1.1:
+    resolution: {integrity: sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==}
+    engines: {node: 20 || >=22}
+
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  minimatch@5.1.9:
+    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
+    engines: {node: '>=10'}
+
+  minimatch@8.0.4:
+    resolution: {integrity: sha512-W0Wvr9HyFXZRGIDgCicunpQ299OKXs9RgZfaukz4qAW/pJhcpUfupc9c+OObPOFueNy8VSrZgEmDtk6Kh4WzDA==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minimatch@9.0.9:
+    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minimist@1.2.8:
+    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+
+  minipass-collect@1.0.2:
+    resolution: {integrity: sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==}
+    engines: {node: '>= 8'}
+
+  minipass-fetch@2.1.2:
+    resolution: {integrity: sha512-LT49Zi2/WMROHYoqGgdlQIZh8mLPZmOrN2NdJjMXxYe4nkN6FUyuPuOAOedNJDrx0IRGg9+4guZewtp8hE6TxA==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  minipass-flush@1.0.7:
+    resolution: {integrity: sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==}
+    engines: {node: '>= 8'}
+
+  minipass-pipeline@1.2.4:
+    resolution: {integrity: sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==}
+    engines: {node: '>=8'}
+
+  minipass-sized@1.0.3:
+    resolution: {integrity: sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==}
+    engines: {node: '>=8'}
+
+  minipass@3.3.6:
+    resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==}
+    engines: {node: '>=8'}
+
+  minipass@4.2.8:
+    resolution: {integrity: sha512-fNzuVyifolSLFL4NzpF+wEF4qrgqaaKX0haXPQEdQ7NKAN+WecoKMHV09YcuL/DHxrUsYQOK3MiuDf7Ip2OXfQ==}
+    engines: {node: '>=8'}
+
+  minipass@5.0.0:
+    resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==}
+    engines: {node: '>=8'}
+
+  minipass@7.1.2:
+    resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minizlib@2.1.2:
+    resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==}
+    engines: {node: '>= 8'}
+
+  minizlib@3.1.0:
+    resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
+    engines: {node: '>= 18'}
+
+  mkdirp@0.5.6:
+    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
+    hasBin: true
+
+  mkdirp@1.0.4:
+    resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  mlly@1.8.2:
+    resolution: {integrity: sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==}
+
+  module-details-from-path@1.0.4:
+    resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==}
+
+  motion-dom@12.35.1:
+    resolution: {integrity: sha512-7n6r7TtNOsH2UFSAXzTkfzOeO5616v9B178qBIjmu/WgEyJK0uqwytCEhwKBTuM/HJA40ptAw7hLFpxtPAMRZQ==}
+
+  motion-utils@12.29.2:
+    resolution: {integrity: sha512-G3kc34H2cX2gI63RqU+cZq+zWRRPSsNIOjpdl9TN4AQwC4sgwYPl/Q/Obf/d53nOm569T0fYK+tcoSV50BWx8A==}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  msw@2.14.3:
+    resolution: {integrity: sha512-kk8G5cocVlJ4wsKMGZegn2H6XLOEKjbA+nSJE2354e/SRp4mDicCHUYnMXpymzVcVDCs+GUAsmNqSn+yHv4T2A==}
+    engines: {node: '>=18'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>= 4.8.x'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  mute-stream@3.0.0:
+    resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
+  mysql2@3.17.4:
+    resolution: {integrity: sha512-RnfuK5tyIuaiPMWOCTTl4vQX/mQXqSA8eoIbwvWccadvPGvh+BYWWVecInMS5s7wcLUkze8LqJzwB/+A4uwuAA==}
+    engines: {node: '>= 8.0'}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  named-placeholders@1.1.6:
+    resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==}
+    engines: {node: '>=8.0.0'}
+
+  nanoid@3.3.11:
+    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  nanostores@1.2.0:
+    resolution: {integrity: sha512-F0wCzbsH80G7XXo0Jd9/AVQC7ouWY6idUCTnMwW5t/Rv9W8qmO6endavDwg7TNp5GbugwSukFMVZqzPSrSMndg==}
+    engines: {node: ^20.0.0 || >=22.0.0}
+
+  negotiator@0.6.4:
+    resolution: {integrity: sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==}
+    engines: {node: '>= 0.6'}
+
+  negotiator@1.0.0:
+    resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
+    engines: {node: '>= 0.6'}
+
+  next@14.2.35:
+    resolution: {integrity: sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==}
+    engines: {node: '>=18.17.0'}
+    hasBin: true
+    peerDependencies:
+      '@opentelemetry/api': ^1.1.0
+      '@playwright/test': ^1.41.2
+      react: ^18.2.0
+      react-dom: ^18.2.0
+      sass: ^1.3.0
+    peerDependenciesMeta:
+      '@opentelemetry/api':
+        optional: true
+      '@playwright/test':
+        optional: true
+      sass:
+        optional: true
+
+  next@16.1.6:
+    resolution: {integrity: sha512-hkyRkcu5x/41KoqnROkfTm2pZVbKxvbZRuNvKXLRXxs3VfyO0WhY50TQS40EuKO9SW3rBj/sF3WbVwDACeMZyw==}
+    engines: {node: '>=20.9.0'}
+    hasBin: true
+    peerDependencies:
+      '@opentelemetry/api': ^1.1.0
+      '@playwright/test': ^1.51.1
+      babel-plugin-react-compiler: '*'
+      react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      react-dom: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      sass: ^1.3.0
+    peerDependenciesMeta:
+      '@opentelemetry/api':
+        optional: true
+      '@playwright/test':
+        optional: true
+      babel-plugin-react-compiler:
+        optional: true
+      sass:
+        optional: true
+
+  next@16.2.1:
+    resolution: {integrity: sha512-VaChzNL7o9rbfdt60HUj8tev4m6d7iC1igAy157526+cJlXOQu5LzsBXNT+xaJnTP/k+utSX5vMv7m0G+zKH+Q==}
+    engines: {node: '>=20.9.0'}
+    hasBin: true
+    peerDependencies:
+      '@opentelemetry/api': ^1.1.0
+      '@playwright/test': ^1.51.1
+      babel-plugin-react-compiler: '*'
+      react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      react-dom: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      sass: ^1.3.0
+    peerDependenciesMeta:
+      '@opentelemetry/api':
+        optional: true
+      '@playwright/test':
+        optional: true
+      babel-plugin-react-compiler:
+        optional: true
+      sass:
+        optional: true
+
+  node-abi@3.89.0:
+    resolution: {integrity: sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==}
+    engines: {node: '>=10'}
+
+  node-addon-api@1.7.2:
+    resolution: {integrity: sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==}
+
+  node-api-version@0.2.1:
+    resolution: {integrity: sha512-2xP/IGGMmmSQpI1+O/k72jF/ykvZ89JeuKX3TLJAYPDVLUalrshrLHkeVcCCZqG/eEa635cr8IBYzgnDvM2O8Q==}
+
+  node-domexception@1.0.0:
+    resolution: {integrity: sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==}
+    engines: {node: '>=10.5.0'}
+    deprecated: Use your platform's native DOMException instead
+
+  node-fetch-native@1.6.7:
+    resolution: {integrity: sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==}
+
+  node-fetch@2.7.0:
+    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
+    engines: {node: 4.x || >=6.0.0}
+    peerDependencies:
+      encoding: ^0.1.0
+    peerDependenciesMeta:
+      encoding:
+        optional: true
+
+  node-fetch@3.3.2:
+    resolution: {integrity: sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
+  node-gyp@9.4.1:
+    resolution: {integrity: sha512-OQkWKbjQKbGkMf/xqI1jjy3oCTgMKJac58G2+bjZb3fza6gW2YrCSdMQYaoTb70crvE//Gngr4f0AgVHmqHvBQ==}
+    engines: {node: ^12.13 || ^14.13 || >=16}
+    hasBin: true
+
+  node-releases@2.0.27:
+    resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
+
+  nopt@6.0.0:
+    resolution: {integrity: sha512-ZwLpbTgdhuZUnZzjd7nb1ZV+4DoiC6/sfiVKok72ym/4Tlf+DFdlHYmT2JPmcNNWV6Pi3SDf1kT+A4r9RTuT9g==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    hasBin: true
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  normalize-range@0.1.2:
+    resolution: {integrity: sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==}
+    engines: {node: '>=0.10.0'}
+
+  normalize-url@6.1.0:
+    resolution: {integrity: sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==}
+    engines: {node: '>=10'}
+
+  npm-run-path@4.0.1:
+    resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
+    engines: {node: '>=8'}
+
+  npm-run-path@6.0.0:
+    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
+    engines: {node: '>=18'}
+
+  npmlog@6.0.2:
+    resolution: {integrity: sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    deprecated: This package is no longer supported.
+
+  nypm@0.6.5:
+    resolution: {integrity: sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object-treeify@1.1.33:
+    resolution: {integrity: sha512-EFVjAYfzWqWsBMRHPMAXLCDIJnpMhdWAqR7xG6M6a2cs6PMFpl/+Z20w9zDW4vkxOFfddegBKq9Rehd0bxWE7A==}
+    engines: {node: '>= 10'}
+
+  ohash@2.0.11:
+    resolution: {integrity: sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==}
+
+  omggif@1.0.10:
+    resolution: {integrity: sha512-LMJTtvgc/nugXj0Vcrrs68Mn2D1r0zf630VNtqtpI1FEO7e+O9FP4gqs9AcnBaSEeoHIPm28u6qgPR0oyEpGSw==}
+
+  on-exit-leak-free@2.1.2:
+    resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
+    engines: {node: '>=14.0.0'}
+
+  on-finished@2.4.1:
+    resolution: {integrity: sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==}
+    engines: {node: '>= 0.8'}
+
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
+  onetime@5.1.2:
+    resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
+    engines: {node: '>=6'}
+
+  onetime@7.0.0:
+    resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
+    engines: {node: '>=18'}
+
+  open@11.0.0:
+    resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
+    engines: {node: '>=20'}
+
+  openapi-types@12.1.3:
+    resolution: {integrity: sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw==}
+
+  ora@5.4.1:
+    resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
+    engines: {node: '>=10'}
+
+  ora@8.2.0:
+    resolution: {integrity: sha512-weP+BZ8MVNnlCm8c0Qdc1WSWq4Qn7I+9CJGm7Qali6g44e/PUzbjNqJX5NJ9ljlNMosfJvg1fKEGILklK9cwnw==}
+    engines: {node: '>=18'}
+
+  outvariant@1.4.3:
+    resolution: {integrity: sha512-+Sl2UErvtsoajRDKCE5/dBz4DIvHXQQnAxtQTF04OJxY0+DyZXSo5P5Bb7XYWOh81syohlYL24hbDwxedPUJCA==}
+
+  p-cancelable@2.1.1:
+    resolution: {integrity: sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==}
+    engines: {node: '>=8'}
+
+  p-finally@1.0.0:
+    resolution: {integrity: sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==}
+    engines: {node: '>=4'}
+
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-locate@3.0.0:
+    resolution: {integrity: sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==}
+    engines: {node: '>=6'}
+
+  p-map@4.0.0:
+    resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
+    engines: {node: '>=10'}
+
+  p-queue@6.6.2:
+    resolution: {integrity: sha512-RwFpb72c/BhQLEXIZ5K2e+AhgNVmIejGlTgiB9MzZ0e93GRvqZ7uSi0dvRF7/XIXDeNkra2fNHBxTyPDGySpjQ==}
+    engines: {node: '>=8'}
+
+  p-retry@4.6.2:
+    resolution: {integrity: sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==}
+    engines: {node: '>=8'}
+
+  p-timeout@3.2.0:
+    resolution: {integrity: sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg==}
+    engines: {node: '>=8'}
+
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
+  package-json-from-dist@1.0.1:
+    resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
+
+  package-manager-detector@1.6.0:
+    resolution: {integrity: sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==}
+
+  pako@1.0.11:
+    resolution: {integrity: sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  parse-bmfont-ascii@1.0.6:
+    resolution: {integrity: sha512-U4RrVsUFCleIOBsIGYOMKjn9PavsGOXxbvYGtMOEfnId0SVNsgehXh1DxUdVPLoxd5mvcEtvmKs2Mmf0Mpa1ZA==}
+
+  parse-bmfont-binary@1.0.6:
+    resolution: {integrity: sha512-GxmsRea0wdGdYthjuUeWTMWPqm2+FAd4GI8vCvhgJsFnoGhTrLhXDDupwTo7rXVAgaLIGoVHDZS9p/5XbSqeWA==}
+
+  parse-bmfont-xml@1.1.6:
+    resolution: {integrity: sha512-0cEliVMZEhrFDwMh4SxIyVJpqYoOWDJ9P895tFuS+XuNzI5UBmBk5U5O4KuJdTnZpSBI4LFA2+ZiJaiwfSwlMA==}
+
+  parse-entities@4.0.2:
+    resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==}
+
+  parse-json@5.2.0:
+    resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
+    engines: {node: '>=8'}
+
+  parse-ms@4.0.0:
+    resolution: {integrity: sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw==}
+    engines: {node: '>=18'}
+
+  parse-passwd@1.0.0:
+    resolution: {integrity: sha512-1Y1A//QUXEZK7YKz+rD9WydcE1+EuPr6ZBgKecAB8tmoW6UFv0NREVJe1p+jRxtThkcbbKkfwIbWJe/IeE6m2Q==}
+    engines: {node: '>=0.10.0'}
+
+  parse5@7.3.0:
+    resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
+
+  parseurl@1.3.3:
+    resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
+    engines: {node: '>= 0.8'}
+
+  path-browserify@1.0.1:
+    resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==}
+
+  path-data-parser@0.1.0:
+    resolution: {integrity: sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w==}
+
+  path-exists@3.0.0:
+    resolution: {integrity: sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==}
+    engines: {node: '>=4'}
+
+  path-expression-matcher@1.1.3:
+    resolution: {integrity: sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==}
+    engines: {node: '>=14.0.0'}
+
+  path-is-absolute@1.0.1:
+    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
+    engines: {node: '>=0.10.0'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-key@4.0.0:
+    resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
+    engines: {node: '>=12'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  path-scurry@1.11.1:
+    resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
+    engines: {node: '>=16 || 14 >=14.18'}
+
+  path-to-regexp@6.3.0:
+    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
+  path-to-regexp@8.4.2:
+    resolution: {integrity: sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==}
+
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  pe-library@0.4.1:
+    resolution: {integrity: sha512-eRWB5LBz7PpDu4PUlwT0PhnQfTQJlDDdPa35urV4Osrm0t0AqQFGn+UIkU3klZvwJ8KPO3VbBFsXquA6p6kqZw==}
+    engines: {node: '>=12', npm: '>=6'}
+
+  peek-readable@4.1.0:
+    resolution: {integrity: sha512-ZI3LnwUv5nOGbQzD9c2iDG6toheuXSZP5esSHBjopsXH4dg19soufvpUGA3uohi5anFtGb2lhAVdHzH6R/Evvg==}
+    engines: {node: '>=8'}
+
+  pend@1.2.0:
+    resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==}
+
+  perfect-debounce@2.1.0:
+    resolution: {integrity: sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.3:
+    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+    engines: {node: '>=12'}
+
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+    engines: {node: '>=12'}
+
+  pify@2.3.0:
+    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
+    engines: {node: '>=0.10.0'}
+
+  pino-abstract-transport@2.0.0:
+    resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
+
+  pino-std-serializers@7.1.0:
+    resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
+
+  pino@9.14.0:
+    resolution: {integrity: sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==}
+    hasBin: true
+
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
+  pixelmatch@5.3.0:
+    resolution: {integrity: sha512-o8mkY4E/+LNUf6LzX96ht6k6CEDi65k9G2rjMtBe9Oo+VPKSvl+0GKHuH/AlG+GA5LPG/i5hrekkxUc3s2HU+Q==}
+    hasBin: true
+
+  pkce-challenge@5.0.1:
+    resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
+    engines: {node: '>=16.20.0'}
+
+  pkg-types@1.3.1:
+    resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
+
+  pkg-types@2.3.0:
+    resolution: {integrity: sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==}
+
+  pkg-up@3.1.0:
+    resolution: {integrity: sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA==}
+    engines: {node: '>=8'}
+
+  planck@1.4.2:
+    resolution: {integrity: sha512-mNbhnV3g8X2rwGxzcesjmN8BDA6qfXgQxXVMkWau9MCRlQY0RLNEkyHlVp6yFy/X6qrzAXyNONCnZ1cGDLrNew==}
+    engines: {node: '>=14.0'}
+    peerDependencies:
+      stage-js: ^1.0.0-alpha.12
+
+  playwright-core@1.58.2:
+    resolution: {integrity: sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  playwright@1.58.2:
+    resolution: {integrity: sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  plist@3.1.0:
+    resolution: {integrity: sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ==}
+    engines: {node: '>=10.4.0'}
+
+  pngjs@6.0.0:
+    resolution: {integrity: sha512-TRzzuFRRmEoSW/p1KVAmiOgPco2Irlah+bGFCeNfJXxxYGwSw7YwAOAcd7X28K/m5bjBWKsC29KyoMfHbypayg==}
+    engines: {node: '>=12.13.0'}
+
+  pngjs@7.0.0:
+    resolution: {integrity: sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==}
+    engines: {node: '>=14.19.0'}
+
+  points-on-curve@0.2.0:
+    resolution: {integrity: sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A==}
+
+  points-on-path@0.2.1:
+    resolution: {integrity: sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g==}
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@4.0.2:
+    resolution: {integrity: sha512-bSVhyJGL00wMVoPUzAVAnbEoWyqRxkjv64tUl427SKnPrENtq6hJwUojroMz2VB+Q1edmi4IfrAPpami5VVgMQ==}
+    engines: {node: '>= 14'}
+    peerDependencies:
+      postcss: '>=8.0.9'
+      ts-node: '>=9.0.0'
+    peerDependenciesMeta:
+      postcss:
+        optional: true
+      ts-node:
+        optional: true
+
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  postcss-nested@6.2.0:
+    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-selector-parser@6.1.2:
+    resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
+    engines: {node: '>=4'}
+
+  postcss-selector-parser@7.1.1:
+    resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.4.31:
+    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  postcss@8.4.38:
+    resolution: {integrity: sha512-Wglpdk03BSfXkHoQa3b/oulrotAkwrlLDRSOb9D0bN86FdRyE9lppSp33aHNPgBa0JKCoB+drFLZkQoRRYae5A==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  postcss@8.5.6:
+    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  powershell-utils@0.1.0:
+    resolution: {integrity: sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==}
+    engines: {node: '>=20'}
+
+  pretty-ms@9.3.0:
+    resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
+    engines: {node: '>=18'}
+
+  prismjs@1.30.0:
+    resolution: {integrity: sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw==}
+    engines: {node: '>=6'}
+
+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
+  process-warning@5.0.0:
+    resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}
+
+  process@0.11.10:
+    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
+    engines: {node: '>= 0.6.0'}
+
+  progress@2.0.3:
+    resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
+    engines: {node: '>=0.4.0'}
+
+  promise-inflight@1.0.1:
+    resolution: {integrity: sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==}
+    peerDependencies:
+      bluebird: '*'
+    peerDependenciesMeta:
+      bluebird:
+        optional: true
+
+  promise-retry@2.0.1:
+    resolution: {integrity: sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==}
+    engines: {node: '>=10'}
+
+  prompts@2.4.2:
+    resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
+    engines: {node: '>= 6'}
+
+  property-information@7.1.0:
+    resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==}
+
+  protobufjs@7.5.4:
+    resolution: {integrity: sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==}
+    engines: {node: '>=12.0.0'}
+
+  proxy-addr@2.0.7:
+    resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
+    engines: {node: '>= 0.10'}
+
+  proxy-from-env@1.1.0:
+    resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
+
+  pump@3.0.4:
+    resolution: {integrity: sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==}
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  qs@6.15.1:
+    resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==}
+    engines: {node: '>=0.6'}
+
+  quansync@0.2.11:
+    resolution: {integrity: sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  quick-format-unescaped@4.0.4:
+    resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
+
+  quick-lru@5.1.1:
+    resolution: {integrity: sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==}
+    engines: {node: '>=10'}
+
+  range-parser@1.2.1:
+    resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
+    engines: {node: '>= 0.6'}
+
+  raw-body@3.0.2:
+    resolution: {integrity: sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==}
+    engines: {node: '>= 0.10'}
+
+  rc9@2.1.2:
+    resolution: {integrity: sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==}
+
+  react-dom@18.2.0:
+    resolution: {integrity: sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==}
+    peerDependencies:
+      react: ^18.2.0
+
+  react-dom@19.2.4:
+    resolution: {integrity: sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==}
+    peerDependencies:
+      react: ^19.2.4
+
+  react-error-boundary@3.1.4:
+    resolution: {integrity: sha512-uM9uPzZJTF6wRQORmSrvOIgt4lJ9MC1sNgEOj2XGsDTRE4kmpWxg7ENK9EWNKJRMAOY9z0MuF4yIfl6gp4sotA==}
+    engines: {node: '>=10', npm: '>=6'}
+    peerDependencies:
+      react: '>=16.13.1'
+
+  react-markdown@10.1.0:
+    resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
+    peerDependencies:
+      '@types/react': '>=18'
+      react: '>=18'
+
+  react-refresh@0.18.0:
+    resolution: {integrity: sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==}
+    engines: {node: '>=0.10.0'}
+
+  react-router-dom@7.14.1:
+    resolution: {integrity: sha512-ZkrQuwwhGibjQLqH1eCdyiZyLWglPxzxdl5tgwgKEyCSGC76vmAjleGocRe3J/MLfzMUIKwaFJWpFVJhK3d2xA==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+
+  react-router@7.14.1:
+    resolution: {integrity: sha512-5BCvFskyAAVumqhEKh/iPhLOIkfxcEUz8WqFIARCkMg8hZZzDYX9CtwxXA0e+qT8zAxmMC0x3Ckb9iMONwc5jg==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+
+  react@18.2.0:
+    resolution: {integrity: sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==}
+    engines: {node: '>=0.10.0'}
+
+  react@19.2.4:
+    resolution: {integrity: sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==}
+    engines: {node: '>=0.10.0'}
+
+  read-binary-file-arch@1.0.6:
+    resolution: {integrity: sha512-BNg9EN3DD3GsDXX7Aa8O4p92sryjkmzYYgmgTAc6CA4uGLEDzFfxOxugu21akOxpcXHiEgsYkC6nPsQvLLLmEg==}
+    hasBin: true
+
+  read-cache@1.0.0:
+    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
+
+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
+  readable-stream@3.6.2:
+    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
+    engines: {node: '>= 6'}
+
+  readable-stream@4.7.0:
+    resolution: {integrity: sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  readable-web-to-node-stream@3.0.4:
+    resolution: {integrity: sha512-9nX56alTf5bwXQ3ZDipHJhusu9NTQJ/CVPtb/XHAJCXihZeitfJvIRS4GqQ/mfIoOE3IelHMrpayVrosdHBuLw==}
+    engines: {node: '>=8'}
+
+  readdir-glob@1.1.3:
+    resolution: {integrity: sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
+  readdirp@5.0.0:
+    resolution: {integrity: sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==}
+    engines: {node: '>= 20.19.0'}
+
+  real-require@0.2.0:
+    resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
+    engines: {node: '>= 12.13.0'}
+
+  recast@0.23.11:
+    resolution: {integrity: sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==}
+    engines: {node: '>= 4'}
+
+  rehype-harden@1.1.8:
+    resolution: {integrity: sha512-Qn7vR1xrf6fZCrkm9TDWi/AB4ylrHy+jqsNm1EHOAmbARYA6gsnVJBq/sdBh6kmT4NEZxH5vgIjrscefJAOXcw==}
+
+  rehype-raw@7.0.0:
+    resolution: {integrity: sha512-/aE8hCfKlQeA8LmyeyQvQF3eBiLRGNlfBJEvWH7ivp9sBqs7TNqBL5X3v157rM4IFETqDnIOO+z5M/biZbo9Ww==}
+
+  rehype-sanitize@6.0.0:
+    resolution: {integrity: sha512-CsnhKNsyI8Tub6L4sm5ZFsme4puGfc6pYylvXo1AeqaGbjOYyzNv3qZPwvs0oMJ39eryyeOdmxwUIo94IpEhqg==}
+
+  remark-gfm@4.0.1:
+    resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==}
+
+  remark-parse@11.0.0:
+    resolution: {integrity: sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==}
+
+  remark-rehype@11.1.2:
+    resolution: {integrity: sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw==}
+
+  remark-stringify@11.0.0:
+    resolution: {integrity: sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==}
+
+  remend@1.3.0:
+    resolution: {integrity: sha512-iIhggPkhW3hFImKtB10w0dz4EZbs28mV/dmbcYVonWEJ6UGHHpP+bFZnTh6GNWJONg5m+U56JrL+8IxZRdgWjw==}
+
+  require-directory@2.1.1:
+    resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
+    engines: {node: '>=0.10.0'}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  require-in-the-middle@8.0.1:
+    resolution: {integrity: sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==}
+    engines: {node: '>=9.3.0 || >=8.10.0 <9.0.0'}
+
+  resedit@1.7.2:
+    resolution: {integrity: sha512-vHjcY2MlAITJhC0eRD/Vv8Vlgmu9Sd3LX9zZvtGzU5ZImdTN3+d6e/4mnTyV8vEbyf1sgNIrWxhWlrys52OkEA==}
+    engines: {node: '>=12', npm: '>=6'}
+
+  reselect@4.1.8:
+    resolution: {integrity: sha512-ab9EmR80F/zQTMNeneUr4cv+jSwPJgIlvEmVwLerwrWVbpLlBuls9XHzIeTFy4cegU2NHBp3va0LKOzU5qFEYQ==}
+
+  reselect@5.1.1:
+    resolution: {integrity: sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==}
+
+  resolve-alpn@1.2.1:
+    resolution: {integrity: sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
+  resolve-pkg-maps@1.0.0:
+    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
+
+  resolve@1.22.11:
+    resolution: {integrity: sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  responselike@2.0.1:
+    resolution: {integrity: sha512-4gl03wn3hj1HP3yzgdI7d3lCkF95F21Pz4BPGvKHinyQzALR5CapwC8yIi0Rh58DEMQ/SguC03wFj2k0M/mHhw==}
+
+  restore-cursor@3.1.0:
+    resolution: {integrity: sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==}
+    engines: {node: '>=8'}
+
+  restore-cursor@5.1.0:
+    resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
+    engines: {node: '>=18'}
+
+  retry@0.12.0:
+    resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
+    engines: {node: '>= 4'}
+
+  retry@0.13.1:
+    resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
+    engines: {node: '>= 4'}
+
+  rettime@0.11.11:
+    resolution: {integrity: sha512-ILJRqVWBCTlg9r42fFgwVZx1gnFAcQF8mRoMkbgQfIrjEDf9nbBFDFx00oloOa+Q869FUtaYDXZvEfnecQSCoQ==}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rimraf@3.0.2:
+    resolution: {integrity: sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==}
+    deprecated: Rimraf versions prior to v4 are no longer supported
+    hasBin: true
+
+  roarr@2.15.4:
+    resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
+    engines: {node: '>=8.0'}
+
+  robust-predicates@3.0.3:
+    resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==}
+
+  rollup@4.55.1:
+    resolution: {integrity: sha512-wDv/Ht1BNHB4upNbK74s9usvl7hObDnvVzknxqY/E/O3X6rW1U1rV1aENEfJ54eFZDTNo7zv1f5N4edCluH7+A==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  rou3@0.7.12:
+    resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==}
+
+  roughjs@4.6.6:
+    resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==}
+
+  router@2.2.0:
+    resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
+    engines: {node: '>= 18'}
+
+  run-applescript@7.1.0:
+    resolution: {integrity: sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==}
+    engines: {node: '>=18'}
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  rw@1.3.3:
+    resolution: {integrity: sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==}
+
+  s-js@0.4.9:
+    resolution: {integrity: sha512-RtpOm+cM6O0sHg6IA70wH+UC3FZcND+rccBZpBAHzlUgNO2Bm5BN+FnM8+OBxzXdwpKWFwX11JGF0MFRkhSoIQ==}
+
+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safe-stable-stringify@2.5.0:
+    resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
+    engines: {node: '>=10'}
+
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
+  sanitize-filename@1.6.4:
+    resolution: {integrity: sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==}
+
+  sax@1.4.4:
+    resolution: {integrity: sha512-1n3r/tGXO6b6VXMdFT54SHzT9ytu9yr7TaELowdYpMqY/Ao7EnlQGmAQ1+RatX7Tkkdm6hONI2owqNx2aZj5Sw==}
+    engines: {node: '>=11.0.0'}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
+  scheduler@0.27.0:
+    resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
+
+  semver-compare@1.0.0:
+    resolution: {integrity: sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.7.3:
+    resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  send@1.2.1:
+    resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==}
+    engines: {node: '>= 18'}
+
+  serialize-error@7.0.1:
+    resolution: {integrity: sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==}
+    engines: {node: '>=10'}
+
+  seroval-plugins@1.3.3:
+    resolution: {integrity: sha512-16OL3NnUBw8JG1jBLUoZJsLnQq0n5Ua6aHalhJK4fMQkz1lqR7Osz1sA30trBtd9VUDc2NgkuRCn8+/pBwqZ+w==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      seroval: ^1.0
+
+  seroval@1.3.2:
+    resolution: {integrity: sha512-RbcPH1n5cfwKrru7v7+zrZvjLurgHhGyso3HTyGtRivGWgYjbOmGuivCQaORNELjNONoK35nj28EoWul9sb1zQ==}
+    engines: {node: '>=10'}
+
+  serve-static@2.2.1:
+    resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
+    engines: {node: '>= 18'}
+
+  set-blocking@2.0.0:
+    resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  set-cookie-parser@3.1.0:
+    resolution: {integrity: sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==}
+
+  setimmediate@1.0.5:
+    resolution: {integrity: sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==}
+
+  setprototypeof@1.2.0:
+    resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
+
+  shadcn@4.6.0:
+    resolution: {integrity: sha512-4XeMwFf8ZZxmqQQp+U+Nsq2M+cY4Da8Joo/EaMdHVc4uVuWSTJoeidlZ3gDjyxXCjYB1FLcxYwR4lYQAH8emOg==}
+    hasBin: true
+
+  sharp@0.34.5:
+    resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  shell-quote@1.8.3:
+    resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.0:
+    resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
+    engines: {node: '>= 0.4'}
+
+  signal-exit@3.0.7:
+    resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
+
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
+  simple-update-notifier@2.0.0:
+    resolution: {integrity: sha512-a2B9Y0KlNXl9u/vsW6sTIu9vGEpfKu2wRV6l1H3XEas/0gUIzGzBoP/IouTcUQbm9JWZLH3COxyn03TYlFax6w==}
+    engines: {node: '>=10'}
+
+  simple-xml-to-json@1.2.3:
+    resolution: {integrity: sha512-kWJDCr9EWtZ+/EYYM5MareWj2cRnZGF93YDNpH4jQiHB+hBIZnfPFSQiVMzZOdk+zXWqTZ/9fTeQNu2DqeiudA==}
+    engines: {node: '>=20.12.2'}
+
+  sisteransi@1.0.5:
+    resolution: {integrity: sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==}
+
+  slice-ansi@3.0.0:
+    resolution: {integrity: sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==}
+    engines: {node: '>=8'}
+
+  smart-buffer@4.2.0:
+    resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==}
+    engines: {node: '>= 6.0.0', npm: '>= 3.0.0'}
+
+  socks-proxy-agent@7.0.0:
+    resolution: {integrity: sha512-Fgl0YPZ902wEsAyiQ+idGd1A7rSFx/ayC1CQVMw5P+EQx2V0SgpGtf6OKFhVjPflPUl9YMmEOnmfjCdMUsygww==}
+    engines: {node: '>= 10'}
+
+  socks@2.8.7:
+    resolution: {integrity: sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==}
+    engines: {node: '>= 10.0.0', npm: '>= 3.0.0'}
+
+  solid-js@1.9.10:
+    resolution: {integrity: sha512-Coz956cos/EPDlhs6+jsdTxKuJDPT7B5SVIWgABwROyxjY7Xbr8wkzD68Et+NxnV7DLJ3nJdAC2r9InuV/4Jew==}
+
+  solid-js@1.9.9:
+    resolution: {integrity: sha512-A0ZBPJQldAeGCTW0YRYJmt7RCeh5rbFfPZ2aOttgYnctHE7HgKeHCBB/PVc2P7eOfmNXqMFFFoYYdm3S4dcbkA==}
+
+  solid-refresh@0.6.3:
+    resolution: {integrity: sha512-F3aPsX6hVw9ttm5LYlth8Q15x6MlI/J3Dn+o3EQyRTtTxidepSTwAYdozt01/YA+7ObcciagGEyXIopGZzQtbA==}
+    peerDependencies:
+      solid-js: ^1.3
+
+  sonic-boom@4.2.0:
+    resolution: {integrity: sha512-INb7TM37/mAcsGmc9hyyI6+QR3rR1zVRu36B0NeGXKnOOLiZOfER5SA+N7X7k3yUYRzLWafduTDvJAfDswwEww==}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  source-map-support@0.5.21:
+    resolution: {integrity: sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==}
+
+  source-map@0.6.1:
+    resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
+    engines: {node: '>=0.10.0'}
+
+  source-map@0.7.6:
+    resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
+    engines: {node: '>= 12'}
+
+  space-separated-tokens@2.0.2:
+    resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
+
+  split2@4.2.0:
+    resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
+    engines: {node: '>= 10.x'}
+
+  sprintf-js@1.1.3:
+    resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==}
+
+  sql-escaper@1.3.3:
+    resolution: {integrity: sha512-BsTCV265VpTp8tm1wyIm1xqQCS+Q9NHx2Sr+WcnUrgLrQ6yiDIvHYJV5gHxsj1lMBy2zm5twLaZao8Jd+S8JJw==}
+    engines: {bun: '>=1.0.0', deno: '>=2.0.0', node: '>=12.0.0'}
+
+  ssri@9.0.1:
+    resolution: {integrity: sha512-o57Wcn66jMQvfHG1FlYbWeZWW/dHZhJXjpIcTfXldXEk5nz5lStPo3mK0OJQfGR3RbZUlbISexbljkJzuEj/8Q==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  stage-js@1.0.0-alpha.17:
+    resolution: {integrity: sha512-AzlMO+t51v6cFvKZ+Oe9DJnL1OXEH5s9bEy6di5aOrUpcP7PCzI/wIeXF0u3zg0L89gwnceoKxrLId0ZpYnNXw==}
+    engines: {node: '>=18.0'}
+
+  stat-mode@1.0.0:
+    resolution: {integrity: sha512-jH9EhtKIjuXZ2cWxmXS8ZP80XyC3iasQxMDV8jzhNJpfDb7VbQLVW4Wvsxz9QZvzV+G4YoSfBUVKDOyxLzi/sg==}
+    engines: {node: '>= 6'}
+
+  statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
+
+  stdin-discarder@0.2.2:
+    resolution: {integrity: sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ==}
+    engines: {node: '>=18'}
+
+  stream-browserify@3.0.0:
+    resolution: {integrity: sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==}
+
+  streamdown@2.5.0:
+    resolution: {integrity: sha512-/tTnURfIOxZK/pqJAxsfCvETG/XCJHoWnk3jq9xLcuz6CSpnjjuxSRBTTL4PKGhxiZQf0lqPxGhImdpwcZ2XwA==}
+    peerDependencies:
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+
+  streamsearch@1.1.0:
+    resolution: {integrity: sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==}
+    engines: {node: '>=10.0.0'}
+
+  strict-event-emitter@0.5.1:
+    resolution: {integrity: sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==}
+
+  string-width@4.2.3:
+    resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
+    engines: {node: '>=8'}
+
+  string-width@5.1.2:
+    resolution: {integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==}
+    engines: {node: '>=12'}
+
+  string-width@7.2.0:
+    resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
+    engines: {node: '>=18'}
+
+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
+  stringify-entities@4.0.4:
+    resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
+
+  stringify-object@5.0.0:
+    resolution: {integrity: sha512-zaJYxz2FtcMb4f+g60KsRNFOpVMUyuJgA51Zi5Z1DOTC3S59+OQiVOzE9GZt0x72uBGWKsQIuBKeF9iusmKFsg==}
+    engines: {node: '>=14.16'}
+
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
+  strip-ansi@7.2.0:
+    resolution: {integrity: sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==}
+    engines: {node: '>=12'}
+
+  strip-bom@3.0.0:
+    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
+    engines: {node: '>=4'}
+
+  strip-final-newline@2.0.0:
+    resolution: {integrity: sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==}
+    engines: {node: '>=6'}
+
+  strip-final-newline@4.0.0:
+    resolution: {integrity: sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw==}
+    engines: {node: '>=18'}
+
+  strnum@2.2.0:
+    resolution: {integrity: sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==}
+
+  strtok3@6.3.0:
+    resolution: {integrity: sha512-fZtbhtvI9I48xDSywd/somNqgUHl2L2cstmXCCif0itOf96jeW18MBSyrLuNicYQVkvpOxkZtkzujiTJ9LW5Jw==}
+    engines: {node: '>=10'}
+
+  style-mod@4.1.3:
+    resolution: {integrity: sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==}
+
+  style-to-js@1.1.21:
+    resolution: {integrity: sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==}
+
+  style-to-object@1.0.14:
+    resolution: {integrity: sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==}
+
+  styled-jsx@5.1.1:
+    resolution: {integrity: sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==}
+    engines: {node: '>= 12.0.0'}
+    peerDependencies:
+      '@babel/core': '*'
+      babel-plugin-macros: '*'
+      react: '>= 16.8.0 || 17.x.x || ^18.0.0-0'
+    peerDependenciesMeta:
+      '@babel/core':
+        optional: true
+      babel-plugin-macros:
+        optional: true
+
+  styled-jsx@5.1.6:
+    resolution: {integrity: sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==}
+    engines: {node: '>= 12.0.0'}
+    peerDependencies:
+      '@babel/core': '*'
+      babel-plugin-macros: '*'
+      react: '>= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0'
+    peerDependenciesMeta:
+      '@babel/core':
+        optional: true
+      babel-plugin-macros:
+        optional: true
+
+  stylis@4.3.6:
+    resolution: {integrity: sha512-yQ3rwFWRfwNUY7H5vpU0wfdkNSnvnJinhF9830Swlaxl03zsOjCfmX0ugac+3LtK0lYSgwL/KXc8oYL3mG4YFQ==}
+
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
+  sumchecker@3.0.1:
+    resolution: {integrity: sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg==}
+    engines: {node: '>= 8.0'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  swr@2.4.1:
+    resolution: {integrity: sha512-2CC6CiKQtEwaEeNiqWTAw9PGykW8SR5zZX8MZk6TeAvEAnVS7Visz8WzphqgtQ8v2xz/4Q5K+j+SeMaKXeeQIA==}
+    peerDependencies:
+      react: ^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  tabbable@6.4.0:
+    resolution: {integrity: sha512-05PUHKSNE8ou2dwIxTngl4EzcnsCDZGJ/iCLtDflR/SHB/ny14rXc+qU5P4mG9JkusiV7EivzY9Mhm55AzAvCg==}
+
+  tagged-tag@1.0.0:
+    resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
+    engines: {node: '>=20'}
+
+  tailwind-merge@3.5.0:
+    resolution: {integrity: sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A==}
+
+  tailwindcss@3.4.7:
+    resolution: {integrity: sha512-rxWZbe87YJb4OcSopb7up2Ba4U82BoiSGUdoDr3Ydrg9ckxFS/YWsvhN323GMcddgU65QRy7JndC7ahhInhvlQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  tailwindcss@4.1.18:
+    resolution: {integrity: sha512-4+Z+0yiYyEtUVCScyfHCxOYP06L5Ne+JiHhY2IjR2KWMIWhJOYZKLSGZaP5HkZ8+bY0cxfzwDE5uOmzFXyIwxw==}
+
+  tapable@2.3.0:
+    resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
+    engines: {node: '>=6'}
+
+  tar-stream@2.2.0:
+    resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
+    engines: {node: '>=6'}
+
+  tar@6.2.1:
+    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
+    engines: {node: '>=10'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
+  tar@7.5.11:
+    resolution: {integrity: sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==}
+    engines: {node: '>=18'}
+
+  temp-file@3.4.0:
+    resolution: {integrity: sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg==}
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  thread-stream@3.1.0:
+    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
+
+  three@0.177.0:
+    resolution: {integrity: sha512-EiXv5/qWAaGI+Vz2A+JfavwYCMdGjxVsrn3oBwllUoqYeaBO75J63ZfyaQKoiLrqNHoTlUc6PFgMXnS0kI45zg==}
+
+  throttleit@2.1.0:
+    resolution: {integrity: sha512-nt6AMGKW1p/70DF/hGBdJB57B8Tspmbp5gfJ8ilhLnt7kkr2ye7hzD6NVG8GGErk2HWF34igrL2CXmNIkzKqKw==}
+    engines: {node: '>=18'}
+
+  tiny-invariant@1.3.3:
+    resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
+
+  tiny-typed-emitter@2.1.0:
+    resolution: {integrity: sha512-qVtvMxeXbVej0cQWKqVSSAHmKZEHAvxdF8HEUBFWts8h+xEo5m/lEiPakuyZ3BnCBjOD8i24kzNOiOLLgsSxhA==}
+
+  tinycolor2@1.6.0:
+    resolution: {integrity: sha512-XPaBkWQJdsf3pLKJV9p4qN/S+fm2Oj8AIPo1BTUhg5oxkvm9+SVEGFdhyOz7tTdUTfvxMiAs4sp6/eZO2Ew+pw==}
+
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
+  tinyexec@1.0.4:
+    resolution: {integrity: sha512-u9r3uZC0bdpGOXtlxUIdwf9pkmvhqJdrVCH9fapQtgy/OeTTMZ1nqH7agtvEfmGui6e1XxjcdrlxvxJvc3sMqw==}
+    engines: {node: '>=18'}
+
+  tinyglobby@0.2.15:
+    resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
+    engines: {node: '>=12.0.0'}
+
+  tldts-core@7.0.30:
+    resolution: {integrity: sha512-uiHN8PIB1VmWyS98eZYja4xzlYqeFZVjb4OuYlJQnZAuJhMw4PbKQOKgHKhBdJR3FE/t5mUQ1Kd80++B+qhD1Q==}
+
+  tldts@7.0.30:
+    resolution: {integrity: sha512-ELrFxuqsDdHUwoh0XxDbxuLD3Wnz49Z57IFvTtvWy1hJdcMZjXLIuonjilCiWHlT2GbE4Wlv1wKVTzDFnXH1aw==}
+    hasBin: true
+
+  tmp-promise@3.0.3:
+    resolution: {integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==}
+
+  tmp@0.2.5:
+    resolution: {integrity: sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==}
+    engines: {node: '>=14.14'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  toidentifier@1.0.1:
+    resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
+    engines: {node: '>=0.6'}
+
+  token-types@4.2.1:
+    resolution: {integrity: sha512-6udB24Q737UD/SDsKAHI9FCRP7Bqc9D/MQUV02ORQg5iskjtLJlZJNdN4kKtcdtwCeWIwIHDGaUsTsCCAa8sFQ==}
+    engines: {node: '>=10'}
+
+  tough-cookie@6.0.1:
+    resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
+    engines: {node: '>=16'}
+
+  tr46@0.0.3:
+    resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
+
+  tree-kill@1.2.2:
+    resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
+    hasBin: true
+
+  trim-lines@3.0.1:
+    resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==}
+
+  trough@2.2.0:
+    resolution: {integrity: sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==}
+
+  truncate-utf8-bytes@1.0.2:
+    resolution: {integrity: sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==}
+
+  ts-dedent@2.2.0:
+    resolution: {integrity: sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==}
+    engines: {node: '>=6.10'}
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  ts-morph@26.0.0:
+    resolution: {integrity: sha512-ztMO++owQnz8c/gIENcM9XfCEzgoGphTv+nKpYNM1bgsdOVC/jRZuEBf6N+mLLDNg68Kl+GgUZfOySaRiG1/Ug==}
+
+  tsconfig-paths@4.2.0:
+    resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
+    engines: {node: '>=6'}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  tsup@8.5.1:
+    resolution: {integrity: sha512-xtgkqwdhpKWr3tKPmCkvYmS9xnQK3m3XgxZHwSUjvfTjp7YfXe5tT3GgWi0F2N+ZSMsOeWeZFh7ZZFg5iPhing==}
+    engines: {node: '>=18'}
+    hasBin: true
+    peerDependencies:
+      '@microsoft/api-extractor': ^7.36.0
+      '@swc/core': ^1
+      postcss: ^8.4.12
+      typescript: '>=4.5.0'
+    peerDependenciesMeta:
+      '@microsoft/api-extractor':
+        optional: true
+      '@swc/core':
+        optional: true
+      postcss:
+        optional: true
+      typescript:
+        optional: true
+
+  tsx@4.21.0:
+    resolution: {integrity: sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
+  turbo@2.8.20:
+    resolution: {integrity: sha512-Rb4qk5YT8RUwwdXtkLpkVhNEe/lor6+WV7S5tTlLpxSz6MjV5Qi8jGNn4gS6NAvrYGA/rNrE6YUQM85sCZUDbQ==}
+    hasBin: true
+
+  tw-animate-css@1.4.0:
+    resolution: {integrity: sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ==}
+
+  type-fest@0.13.1:
+    resolution: {integrity: sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==}
+    engines: {node: '>=10'}
+
+  type-fest@5.6.0:
+    resolution: {integrity: sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA==}
+    engines: {node: '>=20'}
+
+  type-is@2.0.1:
+    resolution: {integrity: sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==}
+    engines: {node: '>= 0.6'}
+
+  typeid-js@1.2.0:
+    resolution: {integrity: sha512-t76ZucAnvGC60ea/HjVsB0TSoB0cw9yjnfurUgtInXQWUI/VcrlZGpO23KN3iSe8yOGUgb1zr7W7uEzJ3hSljA==}
+
+  typescript@5.4.5:
+    resolution: {integrity: sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  ufo@1.6.3:
+    resolution: {integrity: sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==}
+
+  ulid@2.4.0:
+    resolution: {integrity: sha512-fIRiVTJNcSRmXKPZtGzFQv9WRrZ3M9eoptl/teFJvjOzmpU+/K/JH6HZ8deBfb5vMEpicJcLn7JmvdknlMq7Zg==}
+    hasBin: true
+
+  undici-types@5.26.5:
+    resolution: {integrity: sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==}
+
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
+  undici-types@7.18.2:
+    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+
+  undici-types@7.19.2:
+    resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==}
+
+  undici@5.29.0:
+    resolution: {integrity: sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==}
+    engines: {node: '>=14.0'}
+
+  unicorn-magic@0.3.0:
+    resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
+    engines: {node: '>=18'}
+
+  unified@11.0.5:
+    resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==}
+
+  unique-filename@2.0.1:
+    resolution: {integrity: sha512-ODWHtkkdx3IAR+veKxFV+VBkUMcN+FaqzUUd7IZzt+0zhDZFPFxhlqwPF3YQvMHx1TD0tdgYl+kuPnJ8E6ql7A==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  unique-slug@3.0.0:
+    resolution: {integrity: sha512-8EyMynh679x/0gqE9fT9oilG+qEt+ibFyqjuVTsZn1+CMxH+XLlpvr2UZx4nVcCwTpx81nICr2JQFkM+HPLq4w==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  unist-util-is@6.0.1:
+    resolution: {integrity: sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==}
+
+  unist-util-position@5.0.0:
+    resolution: {integrity: sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==}
+
+  unist-util-stringify-position@4.0.0:
+    resolution: {integrity: sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==}
+
+  unist-util-visit-parents@6.0.2:
+    resolution: {integrity: sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==}
+
+  unist-util-visit@5.1.0:
+    resolution: {integrity: sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==}
+
+  universalify@0.1.2:
+    resolution: {integrity: sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==}
+    engines: {node: '>= 4.0.0'}
+
+  universalify@2.0.1:
+    resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
+    engines: {node: '>= 10.0.0'}
+
+  unpipe@1.0.0:
+    resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
+    engines: {node: '>= 0.8'}
+
+  until-async@3.0.2:
+    resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==}
+
+  unzip-crx-3@0.2.0:
+    resolution: {integrity: sha512-0+JiUq/z7faJ6oifVB5nSwt589v1KCduqIJupNVDoWSXZtWDmjDGO3RAEOvwJ07w90aoXoP4enKsR7ecMrJtWQ==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  utf8-byte-length@1.0.5:
+    resolution: {integrity: sha512-Xn0w3MtiQ6zoz2vFyUVruaCL53O/DwUvkEeOvj+uulMm0BkUGYWmBYVyElqZaSLhY6ZD0ulfU3aBra2aVT4xfA==}
+
+  utif2@4.1.0:
+    resolution: {integrity: sha512-+oknB9FHrJ7oW7A2WZYajOcv4FcDR4CfoGB0dPNfxbi4GO05RRnFmt5oa23+9w32EanrYcSJWspUiJkLMs+37w==}
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  uuid@10.0.0:
+    resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==}
+    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
+    hasBin: true
+
+  uuid@11.1.0:
+    resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==}
+    hasBin: true
+
+  validate-npm-package-name@7.0.2:
+    resolution: {integrity: sha512-hVDIBwsRruT73PbK7uP5ebUt+ezEtCmzZz3F59BSr2F6OVFnJ/6h8liuvdLrQ88Xmnk6/+xGGuq+pG9WwTuy3A==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
+  vary@1.1.2:
+    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
+    engines: {node: '>= 0.8'}
+
+  verror@1.10.1:
+    resolution: {integrity: sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==}
+    engines: {node: '>=0.6.0'}
+
+  vfile-location@5.0.3:
+    resolution: {integrity: sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg==}
+
+  vfile-message@4.0.3:
+    resolution: {integrity: sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==}
+
+  vfile@6.0.3:
+    resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
+
+  vite-plugin-solid@2.11.10:
+    resolution: {integrity: sha512-Yr1dQybmtDtDAHkii6hXuc1oVH9CPcS/Zb2jN/P36qqcrkNnVPsMTzQ06jyzFPFjj3U1IYKMVt/9ZqcwGCEbjw==}
+    peerDependencies:
+      '@testing-library/jest-dom': ^5.16.6 || ^5.17.0 || ^6.*
+      solid-js: ^1.7.2
+      vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+    peerDependenciesMeta:
+      '@testing-library/jest-dom':
+        optional: true
+
+  vite@6.4.1:
+    resolution: {integrity: sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vite@7.3.1:
+    resolution: {integrity: sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      lightningcss: ^1.21.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitefu@1.1.1:
+    resolution: {integrity: sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==}
+    peerDependencies:
+      vite: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0-beta.0
+    peerDependenciesMeta:
+      vite:
+        optional: true
+
+  vscode-jsonrpc@8.2.0:
+    resolution: {integrity: sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==}
+    engines: {node: '>=14.0.0'}
+
+  vscode-languageserver-protocol@3.17.5:
+    resolution: {integrity: sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==}
+
+  vscode-languageserver-textdocument@1.0.12:
+    resolution: {integrity: sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==}
+
+  vscode-languageserver-types@3.17.5:
+    resolution: {integrity: sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==}
+
+  vscode-languageserver@9.0.1:
+    resolution: {integrity: sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==}
+    hasBin: true
+
+  vscode-uri@3.1.0:
+    resolution: {integrity: sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==}
+
+  w3c-keyname@2.2.8:
+    resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==}
+
+  wcwidth@1.0.1:
+    resolution: {integrity: sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==}
+
+  web-namespaces@2.0.1:
+    resolution: {integrity: sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ==}
+
+  web-streams-polyfill@3.3.3:
+    resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==}
+    engines: {node: '>= 8'}
+
+  web-tree-sitter@0.25.10:
+    resolution: {integrity: sha512-Y09sF44/13XvgVKgO2cNDw5rGk6s26MgoZPXLESvMXeefBf7i6/73eFurre0IsTW6E14Y0ArIzhUMmjoc7xyzA==}
+    peerDependencies:
+      '@types/emscripten': ^1.40.0
+    peerDependenciesMeta:
+      '@types/emscripten':
+        optional: true
+
+  webidl-conversions@3.0.1:
+    resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
+
+  whatwg-url@5.0.0:
+    resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  which@4.0.0:
+    resolution: {integrity: sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==}
+    engines: {node: ^16.13.0 || >=18.0.0}
+    hasBin: true
+
+  wide-align@1.1.5:
+    resolution: {integrity: sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==}
+
+  wrap-ansi@7.0.0:
+    resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
+    engines: {node: '>=10'}
+
+  wrap-ansi@8.1.0:
+    resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
+    engines: {node: '>=12'}
+
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
+  ws@8.19.0:
+    resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  wsl-utils@0.3.1:
+    resolution: {integrity: sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg==}
+    engines: {node: '>=20'}
+
+  xml-parse-from-string@1.0.1:
+    resolution: {integrity: sha512-ErcKwJTF54uRzzNMXq2X5sMIy88zJvfN2DmdoQvy7PAFJ+tPRU6ydWuOKNMyfmOjdyBQTFREi60s0Y0SyI0G0g==}
+
+  xml2js@0.5.0:
+    resolution: {integrity: sha512-drPFnkQJik/O+uPKpqSgr22mpuFHqKdbS835iAQrUC73L2F5WkboIRd63ai/2Yg6I1jzifPFKH2NTK+cfglkIA==}
+    engines: {node: '>=4.0.0'}
+
+  xmlbuilder@11.0.1:
+    resolution: {integrity: sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==}
+    engines: {node: '>=4.0'}
+
+  xmlbuilder@15.1.1:
+    resolution: {integrity: sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==}
+    engines: {node: '>=8.0'}
+
+  y18n@5.0.8:
+    resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
+    engines: {node: '>=10'}
+
+  yaku@0.16.7:
+    resolution: {integrity: sha512-Syu3IB3rZvKvYk7yTiyl1bo/jiEFaaStrgv1V2TIJTqYPStSMQVO8EQjg/z+DRzLq/4LIIharNT3iH1hylEIRw==}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yallist@4.0.0:
+    resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
+
+  yallist@5.0.0:
+    resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
+    engines: {node: '>=18'}
+
+  yaml@2.8.2:
+    resolution: {integrity: sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==}
+    engines: {node: '>= 14.6'}
+    hasBin: true
+
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
+
+  yargs@17.7.2:
+    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+    engines: {node: '>=12'}
+
+  yauzl@2.10.0:
+    resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==}
+
+  yjs@13.6.30:
+    resolution: {integrity: sha512-vv/9h42eCMC81ZHDFswuu/MKzkl/vyq1BhaNGfHyOonwlG4CJbQF4oiBBJPvfdeCt/PlVDWh7Nov9D34YY09uQ==}
+    engines: {node: '>=16.0.0', npm: '>=8.0.0'}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+  yocto-spinner@1.2.0:
+    resolution: {integrity: sha512-Yw0hUB6UA3o4YUgKy3oSe9a4cxoaZ9sBfYDw+JSxo6Id0KoJGoxzPA24qqUXYKBWABs/zDSGTz9kww7t3F0XGw==}
+    engines: {node: '>=18.19'}
+
+  yoctocolors@2.1.2:
+    resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
+    engines: {node: '>=18'}
+
+  yoga-layout@3.2.1:
+    resolution: {integrity: sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ==}
+
+  zip-stream@4.1.1:
+    resolution: {integrity: sha512-9qv4rlDiopXg4E69k+vMHjNN63YFMe9sZMrdlvKnCjlCRWeCBswPPMPUfx+ipsAWq1LXHe70RcbaHdJJpS6hyQ==}
+    engines: {node: '>= 10'}
+
+  zod-to-json-schema@3.25.2:
+    resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
+    peerDependencies:
+      zod: ^3.25.28 || ^4
+
+  zod@3.25.76:
+    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+
+  zod@4.3.6:
+    resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
+
+  zustand@5.0.12:
+    resolution: {integrity: sha512-i77ae3aZq4dhMlRhJVCYgMLKuSiZAaUPAct2AksxQ+gOtimhGMdXljRT21P5BNpeT4kXlLIckvkPM029OljD7g==}
+    engines: {node: '>=12.20.0'}
+    peerDependencies:
+      '@types/react': '>=18.0.0'
+      immer: '>=9.0.6'
+      react: '>=18.0.0'
+      use-sync-external-store: '>=1.2.0'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      immer:
+        optional: true
+      react:
+        optional: true
+      use-sync-external-store:
+        optional: true
+
+  zwitch@2.0.4:
+    resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
+
+snapshots:
+
+  7zip-bin@5.2.0: {}
+
+  '@ai-sdk/gateway@3.0.88(zod@4.3.6)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.8
+      '@ai-sdk/provider-utils': 4.0.22(zod@4.3.6)
+      '@vercel/oidc': 3.1.0
+      zod: 4.3.6
+
+  '@ai-sdk/provider-utils@4.0.22(zod@4.3.6)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.8
+      '@standard-schema/spec': 1.1.0
+      eventsource-parser: 3.0.6
+      zod: 4.3.6
+
+  '@ai-sdk/provider@3.0.8':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/react@3.0.148(react@19.2.4)(zod@4.3.6)':
+    dependencies:
+      '@ai-sdk/provider-utils': 4.0.22(zod@4.3.6)
+      ai: 6.0.146(zod@4.3.6)
+      react: 19.2.4
+      swr: 2.4.1(react@19.2.4)
+      throttleit: 2.1.0
+    transitivePeerDependencies:
+      - zod
+
+  '@alloc/quick-lru@5.2.0': {}
+
+  '@ampproject/remapping@2.3.0':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@antfu/install-pkg@1.1.0':
+    dependencies:
+      package-manager-detector: 1.6.0
+      tinyexec: 1.0.4
+
+  '@aws-crypto/crc32@5.2.0':
+    dependencies:
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/types': 3.973.6
+      tslib: 2.8.1
+
+  '@aws-crypto/crc32c@5.2.0':
+    dependencies:
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/types': 3.973.6
+      tslib: 2.8.1
+
+  '@aws-crypto/sha1-browser@5.2.0':
+    dependencies:
+      '@aws-crypto/supports-web-crypto': 5.2.0
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-locate-window': 3.965.5
+      '@smithy/util-utf8': 2.3.0
+      tslib: 2.8.1
+
+  '@aws-crypto/sha256-browser@5.2.0':
+    dependencies:
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-crypto/supports-web-crypto': 5.2.0
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-locate-window': 3.965.5
+      '@smithy/util-utf8': 2.3.0
+      tslib: 2.8.1
+
+  '@aws-crypto/sha256-js@5.2.0':
+    dependencies:
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/types': 3.973.6
+      tslib: 2.8.1
+
+  '@aws-crypto/supports-web-crypto@5.2.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@aws-crypto/util@5.2.0':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/util-utf8': 2.3.0
+      tslib: 2.8.1
+
+  '@aws-sdk/client-s3@3.1009.0':
+    dependencies:
+      '@aws-crypto/sha1-browser': 5.2.0
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/credential-provider-node': 3.972.21
+      '@aws-sdk/middleware-bucket-endpoint': 3.972.8
+      '@aws-sdk/middleware-expect-continue': 3.972.8
+      '@aws-sdk/middleware-flexible-checksums': 3.973.6
+      '@aws-sdk/middleware-host-header': 3.972.8
+      '@aws-sdk/middleware-location-constraint': 3.972.8
+      '@aws-sdk/middleware-logger': 3.972.8
+      '@aws-sdk/middleware-recursion-detection': 3.972.8
+      '@aws-sdk/middleware-sdk-s3': 3.972.20
+      '@aws-sdk/middleware-ssec': 3.972.8
+      '@aws-sdk/middleware-user-agent': 3.972.21
+      '@aws-sdk/region-config-resolver': 3.972.8
+      '@aws-sdk/signature-v4-multi-region': 3.996.8
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-endpoints': 3.996.5
+      '@aws-sdk/util-user-agent-browser': 3.972.8
+      '@aws-sdk/util-user-agent-node': 3.973.7
+      '@smithy/config-resolver': 4.4.11
+      '@smithy/core': 3.23.11
+      '@smithy/eventstream-serde-browser': 4.2.12
+      '@smithy/eventstream-serde-config-resolver': 4.3.12
+      '@smithy/eventstream-serde-node': 4.2.12
+      '@smithy/fetch-http-handler': 5.3.15
+      '@smithy/hash-blob-browser': 4.2.13
+      '@smithy/hash-node': 4.2.12
+      '@smithy/hash-stream-node': 4.2.12
+      '@smithy/invalid-dependency': 4.2.12
+      '@smithy/md5-js': 4.2.12
+      '@smithy/middleware-content-length': 4.2.12
+      '@smithy/middleware-endpoint': 4.4.25
+      '@smithy/middleware-retry': 4.4.42
+      '@smithy/middleware-serde': 4.2.14
+      '@smithy/middleware-stack': 4.2.12
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/node-http-handler': 4.4.16
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      '@smithy/util-base64': 4.3.2
+      '@smithy/util-body-length-browser': 4.2.2
+      '@smithy/util-body-length-node': 4.2.3
+      '@smithy/util-defaults-mode-browser': 4.3.41
+      '@smithy/util-defaults-mode-node': 4.2.44
+      '@smithy/util-endpoints': 3.3.3
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-retry': 4.2.12
+      '@smithy/util-stream': 4.5.19
+      '@smithy/util-utf8': 4.2.2
+      '@smithy/util-waiter': 4.2.13
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/core@3.973.20':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/xml-builder': 3.972.11
+      '@smithy/core': 3.23.11
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/property-provider': 4.2.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/signature-v4': 5.3.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/util-base64': 4.3.2
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@aws-sdk/crc64-nvme@3.972.5':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-env@3.972.18':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-http@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/types': 3.973.6
+      '@smithy/fetch-http-handler': 5.3.15
+      '@smithy/node-http-handler': 4.4.16
+      '@smithy/property-provider': 4.2.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/util-stream': 4.5.19
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-ini@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/credential-provider-env': 3.972.18
+      '@aws-sdk/credential-provider-http': 3.972.20
+      '@aws-sdk/credential-provider-login': 3.972.20
+      '@aws-sdk/credential-provider-process': 3.972.18
+      '@aws-sdk/credential-provider-sso': 3.972.20
+      '@aws-sdk/credential-provider-web-identity': 3.972.20
+      '@aws-sdk/nested-clients': 3.996.10
+      '@aws-sdk/types': 3.973.6
+      '@smithy/credential-provider-imds': 4.2.12
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/credential-provider-login@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/nested-clients': 3.996.10
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/credential-provider-node@3.972.21':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.18
+      '@aws-sdk/credential-provider-http': 3.972.20
+      '@aws-sdk/credential-provider-ini': 3.972.20
+      '@aws-sdk/credential-provider-process': 3.972.18
+      '@aws-sdk/credential-provider-sso': 3.972.20
+      '@aws-sdk/credential-provider-web-identity': 3.972.20
+      '@aws-sdk/types': 3.973.6
+      '@smithy/credential-provider-imds': 4.2.12
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/credential-provider-process@3.972.18':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-sso@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/nested-clients': 3.996.10
+      '@aws-sdk/token-providers': 3.1009.0
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/credential-provider-web-identity@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/nested-clients': 3.996.10
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/lib-storage@3.1009.0(@aws-sdk/client-s3@3.1009.0)':
+    dependencies:
+      '@aws-sdk/client-s3': 3.1009.0
+      '@smithy/abort-controller': 4.2.12
+      '@smithy/middleware-endpoint': 4.4.25
+      '@smithy/smithy-client': 4.12.5
+      buffer: 5.6.0
+      events: 3.3.0
+      stream-browserify: 3.0.0
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-bucket-endpoint@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-arn-parser': 3.972.3
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-config-provider': 4.2.2
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-expect-continue@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-flexible-checksums@3.973.6':
+    dependencies:
+      '@aws-crypto/crc32': 5.2.0
+      '@aws-crypto/crc32c': 5.2.0
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/crc64-nvme': 3.972.5
+      '@aws-sdk/types': 3.973.6
+      '@smithy/is-array-buffer': 4.2.2
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-stream': 4.5.19
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-host-header@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-location-constraint@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-logger@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-recursion-detection@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@aws/lambda-invoke-store': 0.2.4
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-sdk-s3@3.972.20':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-arn-parser': 3.972.3
+      '@smithy/core': 3.23.11
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/signature-v4': 5.3.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/util-config-provider': 4.2.2
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-stream': 4.5.19
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-ssec@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/middleware-user-agent@3.972.21':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-endpoints': 3.996.5
+      '@smithy/core': 3.23.11
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-retry': 4.2.12
+      tslib: 2.8.1
+
+  '@aws-sdk/nested-clients@3.996.10':
+    dependencies:
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/middleware-host-header': 3.972.8
+      '@aws-sdk/middleware-logger': 3.972.8
+      '@aws-sdk/middleware-recursion-detection': 3.972.8
+      '@aws-sdk/middleware-user-agent': 3.972.21
+      '@aws-sdk/region-config-resolver': 3.972.8
+      '@aws-sdk/types': 3.973.6
+      '@aws-sdk/util-endpoints': 3.996.5
+      '@aws-sdk/util-user-agent-browser': 3.972.8
+      '@aws-sdk/util-user-agent-node': 3.973.7
+      '@smithy/config-resolver': 4.4.11
+      '@smithy/core': 3.23.11
+      '@smithy/fetch-http-handler': 5.3.15
+      '@smithy/hash-node': 4.2.12
+      '@smithy/invalid-dependency': 4.2.12
+      '@smithy/middleware-content-length': 4.2.12
+      '@smithy/middleware-endpoint': 4.4.25
+      '@smithy/middleware-retry': 4.4.42
+      '@smithy/middleware-serde': 4.2.14
+      '@smithy/middleware-stack': 4.2.12
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/node-http-handler': 4.4.16
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      '@smithy/util-base64': 4.3.2
+      '@smithy/util-body-length-browser': 4.2.2
+      '@smithy/util-body-length-node': 4.2.3
+      '@smithy/util-defaults-mode-browser': 4.3.41
+      '@smithy/util-defaults-mode-node': 4.2.44
+      '@smithy/util-endpoints': 3.3.3
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-retry': 4.2.12
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/region-config-resolver@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/config-resolver': 4.4.11
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/signature-v4-multi-region@3.996.8':
+    dependencies:
+      '@aws-sdk/middleware-sdk-s3': 3.972.20
+      '@aws-sdk/types': 3.973.6
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/signature-v4': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/token-providers@3.1009.0':
+    dependencies:
+      '@aws-sdk/core': 3.973.20
+      '@aws-sdk/nested-clients': 3.996.10
+      '@aws-sdk/types': 3.973.6
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - aws-crt
+
+  '@aws-sdk/types@3.973.6':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@aws-sdk/util-arn-parser@3.972.3':
+    dependencies:
+      tslib: 2.8.1
+
+  '@aws-sdk/util-endpoints@3.996.5':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      '@smithy/util-endpoints': 3.3.3
+      tslib: 2.8.1
+
+  '@aws-sdk/util-locate-window@3.965.5':
+    dependencies:
+      tslib: 2.8.1
+
+  '@aws-sdk/util-user-agent-browser@3.972.8':
+    dependencies:
+      '@aws-sdk/types': 3.973.6
+      '@smithy/types': 4.13.1
+      bowser: 2.14.1
+      tslib: 2.8.1
+
+  '@aws-sdk/util-user-agent-node@3.973.7':
+    dependencies:
+      '@aws-sdk/middleware-user-agent': 3.972.21
+      '@aws-sdk/types': 3.973.6
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-config-provider': 4.2.2
+      tslib: 2.8.1
+
+  '@aws-sdk/xml-builder@3.972.11':
+    dependencies:
+      '@smithy/types': 4.13.1
+      fast-xml-parser: 5.4.1
+      tslib: 2.8.1
+
+  '@aws/lambda-invoke-store@0.2.4': {}
+
+  '@babel/code-frame@7.28.6':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.28.5
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/code-frame@7.29.0':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.28.5
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.28.6': {}
+
+  '@babel/core@7.28.0':
+    dependencies:
+      '@ampproject/remapping': 2.3.0
+      '@babel/code-frame': 7.28.6
+      '@babel/generator': 7.28.6
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.0)
+      '@babel/helpers': 7.28.6
+      '@babel/parser': 7.28.6
+      '@babel/template': 7.28.6
+      '@babel/traverse': 7.28.6
+      '@babel/types': 7.28.6
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/core@7.28.6':
+    dependencies:
+      '@babel/code-frame': 7.28.6
+      '@babel/generator': 7.28.6
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.6)
+      '@babel/helpers': 7.28.6
+      '@babel/parser': 7.28.6
+      '@babel/template': 7.28.6
+      '@babel/traverse': 7.28.6
+      '@babel/types': 7.28.6
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/core@7.29.0':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/generator': 7.29.1
+      '@babel/helper-compilation-targets': 7.28.6
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helpers': 7.28.6
+      '@babel/parser': 7.29.2
+      '@babel/template': 7.28.6
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.28.6':
+    dependencies:
+      '@babel/parser': 7.29.2
+      '@babel/types': 7.28.6
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/generator@7.29.1':
+    dependencies:
+      '@babel/parser': 7.29.2
+      '@babel/types': 7.29.0
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-annotate-as-pure@7.27.3':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-compilation-targets@7.28.6':
+    dependencies:
+      '@babel/compat-data': 7.28.6
+      '@babel/helper-validator-option': 7.27.1
+      browserslist: 4.28.1
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-create-class-features-plugin@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-annotate-as-pure': 7.27.3
+      '@babel/helper-member-expression-to-functions': 7.28.5
+      '@babel/helper-optimise-call-expression': 7.27.1
+      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.28.0)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/traverse': 7.29.0
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-create-class-features-plugin@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.27.3
+      '@babel/helper-member-expression-to-functions': 7.28.5
+      '@babel/helper-optimise-call-expression': 7.27.1
+      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/traverse': 7.29.0
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-globals@7.28.0': {}
+
+  '@babel/helper-member-expression-to-functions@7.28.5':
+    dependencies:
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-imports@7.18.6':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-module-imports@7.28.6':
+    dependencies:
+      '@babel/traverse': 7.28.6
+      '@babel/types': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/traverse': 7.28.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.28.6)':
+    dependencies:
+      '@babel/core': 7.28.6
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/traverse': 7.28.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/traverse': 7.28.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-optimise-call-expression@7.27.1':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/helper-plugin-utils@7.28.6': {}
+
+  '@babel/helper-replace-supers@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-member-expression-to-functions': 7.28.5
+      '@babel/helper-optimise-call-expression': 7.27.1
+      '@babel/traverse': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-replace-supers@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-member-expression-to-functions': 7.28.5
+      '@babel/helper-optimise-call-expression': 7.27.1
+      '@babel/traverse': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-skip-transparent-expression-wrappers@7.27.1':
+    dependencies:
+      '@babel/traverse': 7.29.0
+      '@babel/types': 7.29.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-string-parser@7.27.1': {}
+
+  '@babel/helper-validator-identifier@7.28.5': {}
+
+  '@babel/helper-validator-option@7.27.1': {}
+
+  '@babel/helpers@7.28.6':
+    dependencies:
+      '@babel/template': 7.28.6
+      '@babel/types': 7.28.6
+
+  '@babel/parser@7.28.6':
+    dependencies:
+      '@babel/types': 7.28.6
+
+  '@babel/parser@7.29.2':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.28.6)':
+    dependencies:
+      '@babel/core': 7.28.6
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-transform-modules-commonjs@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.0)
+      '@babel/helper-plugin-utils': 7.28.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-modules-commonjs@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.28.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.28.6
+
+  '@babel/plugin-transform-typescript@7.28.6(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-annotate-as-pure': 7.27.3
+      '@babel/helper-create-class-features-plugin': 7.28.6(@babel/core@7.28.0)
+      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.28.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/plugin-transform-typescript@7.28.6(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-annotate-as-pure': 7.27.3
+      '@babel/helper-create-class-features-plugin': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/preset-typescript@7.27.1(@babel/core@7.28.0)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/helper-validator-option': 7.27.1
+      '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.28.0)
+      '@babel/plugin-transform-modules-commonjs': 7.28.6(@babel/core@7.28.0)
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.28.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/preset-typescript@7.27.1(@babel/core@7.29.0)':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/helper-validator-option': 7.27.1
+      '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-commonjs': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/runtime@7.29.2': {}
+
+  '@babel/template@7.28.6':
+    dependencies:
+      '@babel/code-frame': 7.28.6
+      '@babel/parser': 7.28.6
+      '@babel/types': 7.28.6
+
+  '@babel/traverse@7.28.6':
+    dependencies:
+      '@babel/code-frame': 7.28.6
+      '@babel/generator': 7.28.6
+      '@babel/helper-globals': 7.28.0
+      '@babel/parser': 7.29.2
+      '@babel/template': 7.28.6
+      '@babel/types': 7.28.6
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/traverse@7.29.0':
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      '@babel/generator': 7.29.1
+      '@babel/helper-globals': 7.28.0
+      '@babel/parser': 7.29.2
+      '@babel/template': 7.28.6
+      '@babel/types': 7.29.0
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.28.6':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+
+  '@babel/types@7.29.0':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.28.5
+
+  '@base-ui/react@1.4.1(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@babel/runtime': 7.29.2
+      '@base-ui/utils': 0.2.8(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@floating-ui/react-dom': 2.1.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@floating-ui/utils': 0.2.11
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      use-sync-external-store: 1.6.0(react@19.2.4)
+    optionalDependencies:
+      '@types/react': 19.2.14
+
+  '@base-ui/utils@0.2.8(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@babel/runtime': 7.29.2
+      '@floating-ui/utils': 0.2.11
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      reselect: 5.1.1
+      use-sync-external-store: 1.6.0(react@19.2.4)
+    optionalDependencies:
+      '@types/react': 19.2.14
+
+  '@better-auth/api-key@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(better-auth@1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10))':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+      better-auth: 1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10)
+      zod: 4.3.6
+
+  '@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)':
+    dependencies:
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/semantic-conventions': 1.40.0
+      '@standard-schema/spec': 1.1.0
+      better-call: 1.3.2(zod@4.3.6)
+      jose: 6.1.3
+      kysely: 0.28.15
+      nanostores: 1.2.0
+      zod: 4.3.6
+
+  '@better-auth/drizzle-adapter@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+    optionalDependencies:
+      drizzle-orm: 0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4)
+
+  '@better-auth/kysely-adapter@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(kysely@0.28.15)':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+    optionalDependencies:
+      kysely: 0.28.15
+
+  '@better-auth/memory-adapter@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+
+  '@better-auth/mongo-adapter@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+
+  '@better-auth/oauth-provider@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(better-auth@1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10))(better-call@1.3.2(zod@4.3.6))':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      better-auth: 1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10)
+      better-call: 1.3.2(zod@4.3.6)
+      jose: 6.1.3
+      zod: 4.3.6
+
+  '@better-auth/prisma-adapter@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+
+  '@better-auth/telemetry@1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))':
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+
+  '@better-auth/utils@0.3.1': {}
+
+  '@better-fetch/fetch@1.1.21': {}
+
+  '@braintree/sanitize-url@7.1.2': {}
+
+  '@chevrotain/cst-dts-gen@11.1.2':
+    dependencies:
+      '@chevrotain/gast': 11.1.2
+      '@chevrotain/types': 11.1.2
+      lodash-es: 4.17.23
+
+  '@chevrotain/gast@11.1.2':
+    dependencies:
+      '@chevrotain/types': 11.1.2
+      lodash-es: 4.17.23
+
+  '@chevrotain/regexp-to-ast@11.1.2': {}
+
+  '@chevrotain/types@11.1.2': {}
+
+  '@chevrotain/utils@11.1.2': {}
+
+  '@codemirror/autocomplete@6.20.0':
+    dependencies:
+      '@codemirror/language': 6.12.1
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+
+  '@codemirror/commands@6.10.2':
+    dependencies:
+      '@codemirror/language': 6.12.1
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+
+  '@codemirror/lang-css@6.3.1':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.0
+      '@codemirror/language': 6.12.1
+      '@codemirror/state': 6.5.4
+      '@lezer/common': 1.5.1
+      '@lezer/css': 1.3.0
+
+  '@codemirror/lang-html@6.4.11':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.0
+      '@codemirror/lang-css': 6.3.1
+      '@codemirror/lang-javascript': 6.2.4
+      '@codemirror/language': 6.12.1
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+      '@lezer/css': 1.3.0
+      '@lezer/html': 1.3.13
+
+  '@codemirror/lang-javascript@6.2.4':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.0
+      '@codemirror/language': 6.12.1
+      '@codemirror/lint': 6.9.4
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+      '@lezer/javascript': 1.5.4
+
+  '@codemirror/lang-markdown@6.5.0':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.0
+      '@codemirror/lang-html': 6.4.11
+      '@codemirror/language': 6.12.1
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+      '@lezer/markdown': 1.6.3
+
+  '@codemirror/language@6.12.1':
+    dependencies:
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      '@lezer/common': 1.5.1
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.8
+      style-mod: 4.1.3
+
+  '@codemirror/lint@6.9.4':
+    dependencies:
+      '@codemirror/state': 6.5.4
+      '@codemirror/view': 6.39.14
+      crelt: 1.0.6
+
+  '@codemirror/state@6.5.4':
+    dependencies:
+      '@marijn/find-cluster-break': 1.0.2
+
+  '@codemirror/view@6.39.14':
+    dependencies:
+      '@codemirror/state': 6.5.4
+      crelt: 1.0.6
+      style-mod: 4.1.3
+      w3c-keyname: 2.2.8
+
+  '@daytonaio/api-client@0.150.0':
+    dependencies:
+      axios: 1.13.6
+    transitivePeerDependencies:
+      - debug
+
+  '@daytonaio/sdk@0.150.0(ws@8.19.0)':
+    dependencies:
+      '@aws-sdk/client-s3': 3.1009.0
+      '@aws-sdk/lib-storage': 3.1009.0(@aws-sdk/client-s3@3.1009.0)
+      '@daytonaio/api-client': 0.150.0
+      '@daytonaio/toolbox-api-client': 0.150.0
+      '@iarna/toml': 2.2.5
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/exporter-trace-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/instrumentation-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-node': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.6.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+      axios: 1.13.6
+      busboy: 1.6.0
+      dotenv: 17.3.1
+      expand-tilde: 2.0.2
+      fast-glob: 3.3.3
+      form-data: 4.0.5
+      isomorphic-ws: 5.0.0(ws@8.19.0)
+      pathe: 2.0.3
+      shell-quote: 1.8.3
+      tar: 7.5.11
+    transitivePeerDependencies:
+      - aws-crt
+      - debug
+      - supports-color
+      - ws
+
+  '@daytonaio/toolbox-api-client@0.150.0':
+    dependencies:
+      axios: 1.13.6
+    transitivePeerDependencies:
+      - debug
+
+  '@develar/schema-utils@2.6.5':
+    dependencies:
+      ajv: 6.14.0
+      ajv-keywords: 3.5.2(ajv@6.14.0)
+
+  '@dimforge/rapier2d-simd-compat@0.17.3':
+    optional: true
+
+  '@dotenvx/dotenvx@1.64.0':
+    dependencies:
+      commander: 11.1.0
+      dotenv: 17.3.1
+      eciesjs: 0.4.18
+      execa: 5.1.1
+      fdir: 6.5.0(picomatch@4.0.4)
+      ignore: 5.3.2
+      object-treeify: 1.1.33
+      picomatch: 4.0.4
+      which: 4.0.0
+      yocto-spinner: 1.2.0
+
+  '@drizzle-team/brocli@0.10.2': {}
+
+  '@ecies/ciphers@0.2.6(@noble/ciphers@1.3.0)':
+    dependencies:
+      '@noble/ciphers': 1.3.0
+
+  '@electron/asar@3.4.1':
+    dependencies:
+      commander: 5.1.0
+      glob: 7.2.3
+      minimatch: 3.1.5
+
+  '@electron/get@2.0.3':
+    dependencies:
+      debug: 4.4.3
+      env-paths: 2.2.1
+      fs-extra: 8.1.0
+      got: 11.8.6
+      progress: 2.0.3
+      semver: 6.3.1
+      sumchecker: 3.0.1
+    optionalDependencies:
+      global-agent: 3.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@electron/notarize@2.5.0':
+    dependencies:
+      debug: 4.4.3
+      fs-extra: 9.1.0
+      promise-retry: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@electron/osx-sign@1.3.1':
+    dependencies:
+      compare-version: 0.1.2
+      debug: 4.4.3
+      fs-extra: 10.1.0
+      isbinaryfile: 4.0.10
+      minimist: 1.2.8
+      plist: 3.1.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@electron/rebuild@3.6.1':
+    dependencies:
+      '@malept/cross-spawn-promise': 2.0.0
+      chalk: 4.1.2
+      debug: 4.4.3
+      detect-libc: 2.1.2
+      fs-extra: 10.1.0
+      got: 11.8.6
+      node-abi: 3.89.0
+      node-api-version: 0.2.1
+      node-gyp: 9.4.1
+      ora: 5.4.1
+      read-binary-file-arch: 1.0.6
+      semver: 7.7.4
+      tar: 6.2.1
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
+  '@electron/universal@2.0.1':
+    dependencies:
+      '@electron/asar': 3.4.1
+      '@malept/cross-spawn-promise': 2.0.0
+      debug: 4.4.3
+      dir-compare: 4.2.0
+      fs-extra: 11.3.4
+      minimatch: 9.0.9
+      plist: 3.1.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@emnapi/runtime@1.8.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@esbuild-kit/core-utils@3.3.2':
+    dependencies:
+      esbuild: 0.18.20
+      source-map-support: 0.5.21
+
+  '@esbuild-kit/esm-loader@2.6.5':
+    dependencies:
+      '@esbuild-kit/core-utils': 3.3.2
+      get-tsconfig: 4.13.1
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/aix-ppc64@0.27.2':
+    optional: true
+
+  '@esbuild/android-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/android-arm@0.18.20':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.27.2':
+    optional: true
+
+  '@esbuild/android-x64@0.18.20':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.27.2':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/darwin-x64@0.18.20':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.27.2':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.27.2':
+    optional: true
+
+  '@esbuild/linux-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/linux-arm@0.18.20':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.27.2':
+    optional: true
+
+  '@esbuild/linux-ia32@0.18.20':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.27.2':
+    optional: true
+
+  '@esbuild/linux-loong64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.27.2':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.18.20':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.27.2':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.27.2':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.27.2':
+    optional: true
+
+  '@esbuild/linux-s390x@0.18.20':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.27.2':
+    optional: true
+
+  '@esbuild/linux-x64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.27.2':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.27.2':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.27.2':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/sunos-x64@0.18.20':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.27.2':
+    optional: true
+
+  '@esbuild/win32-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.27.2':
+    optional: true
+
+  '@esbuild/win32-ia32@0.18.20':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.27.2':
+    optional: true
+
+  '@esbuild/win32-x64@0.18.20':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.27.2':
+    optional: true
+
+  '@fastify/busboy@2.1.1': {}
+
+  '@floating-ui/core@1.7.5':
+    dependencies:
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/dom@1.7.6':
+    dependencies:
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/react-dom@2.1.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@floating-ui/dom': 1.7.6
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+
+  '@floating-ui/react@0.27.19(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@floating-ui/utils': 0.2.11
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      tabbable: 6.4.0
+
+  '@floating-ui/utils@0.2.11': {}
+
+  '@fontsource-variable/geist@5.2.8': {}
+
+  '@fontsource-variable/ibm-plex-sans@5.2.8': {}
+
+  '@gar/promisify@1.1.3': {}
+
+  '@grammyjs/types@3.23.0': {}
+
+  '@grpc/grpc-js@1.14.3':
+    dependencies:
+      '@grpc/proto-loader': 0.8.0
+      '@js-sdsl/ordered-map': 4.4.2
+
+  '@grpc/proto-loader@0.8.0':
+    dependencies:
+      lodash.camelcase: 4.3.0
+      long: 5.3.2
+      protobufjs: 7.5.4
+      yargs: 17.7.2
+
+  '@hey-api/client-fetch@0.13.1(@hey-api/openapi-ts@0.95.0(typescript@5.9.3))':
+    dependencies:
+      '@hey-api/openapi-ts': 0.95.0(typescript@5.9.3)
+
+  '@hey-api/codegen-core@0.7.4':
+    dependencies:
+      '@hey-api/types': 0.1.4
+      ansi-colors: 4.1.3
+      c12: 3.3.3
+      color-support: 1.1.3
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/json-schema-ref-parser@1.3.1':
+    dependencies:
+      '@jsdevtools/ono': 7.1.3
+      '@types/json-schema': 7.0.15
+      js-yaml: 4.1.1
+
+  '@hey-api/openapi-ts@0.95.0(typescript@5.9.3)':
+    dependencies:
+      '@hey-api/codegen-core': 0.7.4
+      '@hey-api/json-schema-ref-parser': 1.3.1
+      '@hey-api/shared': 0.3.0
+      '@hey-api/spec-types': 0.1.0
+      '@hey-api/types': 0.1.4
+      ansi-colors: 4.1.3
+      color-support: 1.1.3
+      commander: 14.0.3
+      get-tsconfig: 4.13.6
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/shared@0.3.0':
+    dependencies:
+      '@hey-api/codegen-core': 0.7.4
+      '@hey-api/json-schema-ref-parser': 1.3.1
+      '@hey-api/spec-types': 0.1.0
+      '@hey-api/types': 0.1.4
+      ansi-colors: 4.1.3
+      cross-spawn: 7.0.6
+      open: 11.0.0
+      semver: 7.7.3
+    transitivePeerDependencies:
+      - magicast
+
+  '@hey-api/spec-types@0.1.0':
+    dependencies:
+      '@hey-api/types': 0.1.4
+
+  '@hey-api/types@0.1.4': {}
+
+  '@hono/mcp@0.2.5(@modelcontextprotocol/sdk@1.29.0(zod@4.3.6))(hono-rate-limiter@0.4.2(hono@4.12.8))(hono@4.12.8)(zod@4.3.6)':
+    dependencies:
+      '@modelcontextprotocol/sdk': 1.29.0(zod@4.3.6)
+      hono: 4.12.8
+      hono-rate-limiter: 0.4.2(hono@4.12.8)
+      pkce-challenge: 5.0.1
+      zod: 4.3.6
+
+  '@hono/node-server@1.19.11(hono@4.12.12)':
+    dependencies:
+      hono: 4.12.12
+
+  '@hono/node-server@1.19.11(hono@4.12.8)':
+    dependencies:
+      hono: 4.12.8
+
+  '@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.12)':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      hono: 4.12.12
+    optional: true
+
+  '@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.8)':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      hono: 4.12.8
+
+  '@hono/swagger-ui@0.6.1(hono@4.12.8)':
+    dependencies:
+      hono: 4.12.8
+
+  '@iarna/toml@2.2.5': {}
+
+  '@iconify/types@2.0.0': {}
+
+  '@iconify/utils@3.1.0':
+    dependencies:
+      '@antfu/install-pkg': 1.1.0
+      '@iconify/types': 2.0.0
+      mlly: 1.8.2
+
+  '@img/colour@1.1.0': {}
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-darwin-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-arm@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-s390x@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-wasm32@0.34.5':
+    dependencies:
+      '@emnapi/runtime': 1.8.1
+    optional: true
+
+  '@img/sharp-win32-arm64@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-x64@0.34.5':
+    optional: true
+
+  '@inquirer/ansi@2.0.5': {}
+
+  '@inquirer/confirm@6.0.12(@types/node@25.6.0)':
+    dependencies:
+      '@inquirer/core': 11.1.9(@types/node@25.6.0)
+      '@inquirer/type': 4.0.5(@types/node@25.6.0)
+    optionalDependencies:
+      '@types/node': 25.6.0
+
+  '@inquirer/core@11.1.9(@types/node@25.6.0)':
+    dependencies:
+      '@inquirer/ansi': 2.0.5
+      '@inquirer/figures': 2.0.5
+      '@inquirer/type': 4.0.5(@types/node@25.6.0)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.0
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
+    optionalDependencies:
+      '@types/node': 25.6.0
+
+  '@inquirer/figures@2.0.5': {}
+
+  '@inquirer/type@4.0.5(@types/node@25.6.0)':
+    optionalDependencies:
+      '@types/node': 25.6.0
+
+  '@isaacs/balanced-match@4.0.1': {}
+
+  '@isaacs/brace-expansion@5.0.0':
+    dependencies:
+      '@isaacs/balanced-match': 4.0.1
+
+  '@isaacs/cliui@8.0.2':
+    dependencies:
+      string-width: 5.1.2
+      string-width-cjs: string-width@4.2.3
+      strip-ansi: 7.2.0
+      strip-ansi-cjs: strip-ansi@6.0.1
+      wrap-ansi: 8.1.0
+      wrap-ansi-cjs: wrap-ansi@7.0.0
+
+  '@isaacs/fs-minipass@4.0.1':
+    dependencies:
+      minipass: 7.1.2
+
+  '@jimp/core@1.6.0':
+    dependencies:
+      '@jimp/file-ops': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      await-to-js: 3.0.0
+      exif-parser: 0.1.12
+      file-type: 16.5.4
+      mime: 3.0.0
+
+  '@jimp/diff@1.6.0':
+    dependencies:
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      pixelmatch: 5.3.0
+
+  '@jimp/file-ops@1.6.0': {}
+
+  '@jimp/js-bmp@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      bmp-ts: 1.0.9
+
+  '@jimp/js-gif@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      gifwrap: 0.10.1
+      omggif: 1.0.10
+
+  '@jimp/js-jpeg@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      jpeg-js: 0.4.4
+
+  '@jimp/js-png@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      pngjs: 7.0.0
+
+  '@jimp/js-tiff@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      utif2: 4.1.0
+
+  '@jimp/plugin-blit@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-blur@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/utils': 1.6.0
+
+  '@jimp/plugin-circle@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-color@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      tinycolor2: 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-contain@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/plugin-blit': 1.6.0
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-cover@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/plugin-crop': 1.6.0
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/types': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-crop@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-displace@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-dither@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+
+  '@jimp/plugin-fisheye@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-flip@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-hash@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/js-bmp': 1.6.0
+      '@jimp/js-jpeg': 1.6.0
+      '@jimp/js-png': 1.6.0
+      '@jimp/js-tiff': 1.6.0
+      '@jimp/plugin-color': 1.6.0
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      any-base: 1.1.0
+
+  '@jimp/plugin-mask@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-print@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/js-jpeg': 1.6.0
+      '@jimp/js-png': 1.6.0
+      '@jimp/plugin-blit': 1.6.0
+      '@jimp/types': 1.6.0
+      parse-bmfont-ascii: 1.0.6
+      parse-bmfont-binary: 1.0.6
+      parse-bmfont-xml: 1.1.6
+      simple-xml-to-json: 1.2.3
+      zod: 3.25.76
+
+  '@jimp/plugin-quantize@1.6.0':
+    dependencies:
+      image-q: 4.0.0
+      zod: 3.25.76
+
+  '@jimp/plugin-resize@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/types': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-rotate@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/plugin-crop': 1.6.0
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/plugin-threshold@1.6.0':
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/plugin-color': 1.6.0
+      '@jimp/plugin-hash': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+      zod: 3.25.76
+
+  '@jimp/types@1.6.0':
+    dependencies:
+      zod: 3.25.76
+
+  '@jimp/utils@1.6.0':
+    dependencies:
+      '@jimp/types': 1.6.0
+      tinycolor2: 1.6.0
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@js-sdsl/ordered-map@4.4.2': {}
+
+  '@jsdevtools/ono@7.1.3': {}
+
+  '@lexical/clipboard@0.35.0':
+    dependencies:
+      '@lexical/html': 0.35.0
+      '@lexical/list': 0.35.0
+      '@lexical/selection': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/code@0.35.0':
+    dependencies:
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+      prismjs: 1.30.0
+
+  '@lexical/devtools-core@0.35.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@lexical/html': 0.35.0
+      '@lexical/link': 0.35.0
+      '@lexical/mark': 0.35.0
+      '@lexical/table': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+
+  '@lexical/dragon@0.35.0':
+    dependencies:
+      lexical: 0.35.0
+
+  '@lexical/hashtag@0.35.0':
+    dependencies:
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/history@0.35.0':
+    dependencies:
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/html@0.35.0':
+    dependencies:
+      '@lexical/selection': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/link@0.35.0':
+    dependencies:
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/list@0.35.0':
+    dependencies:
+      '@lexical/selection': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/mark@0.35.0':
+    dependencies:
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/markdown@0.35.0':
+    dependencies:
+      '@lexical/code': 0.35.0
+      '@lexical/link': 0.35.0
+      '@lexical/list': 0.35.0
+      '@lexical/rich-text': 0.35.0
+      '@lexical/text': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/offset@0.35.0':
+    dependencies:
+      lexical: 0.35.0
+
+  '@lexical/overflow@0.35.0':
+    dependencies:
+      lexical: 0.35.0
+
+  '@lexical/plain-text@0.35.0':
+    dependencies:
+      '@lexical/clipboard': 0.35.0
+      '@lexical/selection': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/react@0.35.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.30)':
+    dependencies:
+      '@floating-ui/react': 0.27.19(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@lexical/devtools-core': 0.35.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@lexical/dragon': 0.35.0
+      '@lexical/hashtag': 0.35.0
+      '@lexical/history': 0.35.0
+      '@lexical/link': 0.35.0
+      '@lexical/list': 0.35.0
+      '@lexical/mark': 0.35.0
+      '@lexical/markdown': 0.35.0
+      '@lexical/overflow': 0.35.0
+      '@lexical/plain-text': 0.35.0
+      '@lexical/rich-text': 0.35.0
+      '@lexical/table': 0.35.0
+      '@lexical/text': 0.35.0
+      '@lexical/utils': 0.35.0
+      '@lexical/yjs': 0.35.0(yjs@13.6.30)
+      lexical: 0.35.0
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-error-boundary: 3.1.4(react@19.2.4)
+    transitivePeerDependencies:
+      - yjs
+
+  '@lexical/rich-text@0.35.0':
+    dependencies:
+      '@lexical/clipboard': 0.35.0
+      '@lexical/selection': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/selection@0.35.0':
+    dependencies:
+      lexical: 0.35.0
+
+  '@lexical/table@0.35.0':
+    dependencies:
+      '@lexical/clipboard': 0.35.0
+      '@lexical/utils': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/text@0.35.0':
+    dependencies:
+      lexical: 0.35.0
+
+  '@lexical/utils@0.35.0':
+    dependencies:
+      '@lexical/list': 0.35.0
+      '@lexical/selection': 0.35.0
+      '@lexical/table': 0.35.0
+      lexical: 0.35.0
+
+  '@lexical/yjs@0.35.0(yjs@13.6.30)':
+    dependencies:
+      '@lexical/offset': 0.35.0
+      '@lexical/selection': 0.35.0
+      lexical: 0.35.0
+      yjs: 13.6.30
+
+  '@lezer/common@1.5.1': {}
+
+  '@lezer/css@1.3.0':
+    dependencies:
+      '@lezer/common': 1.5.1
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.8
+
+  '@lezer/highlight@1.2.3':
+    dependencies:
+      '@lezer/common': 1.5.1
+
+  '@lezer/html@1.3.13':
+    dependencies:
+      '@lezer/common': 1.5.1
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.8
+
+  '@lezer/javascript@1.5.4':
+    dependencies:
+      '@lezer/common': 1.5.1
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.8
+
+  '@lezer/lr@1.4.8':
+    dependencies:
+      '@lezer/common': 1.5.1
+
+  '@lezer/markdown@1.6.3':
+    dependencies:
+      '@lezer/common': 1.5.1
+      '@lezer/highlight': 1.2.3
+
+  '@malept/cross-spawn-promise@2.0.0':
+    dependencies:
+      cross-spawn: 7.0.6
+
+  '@malept/flatpak-bundler@0.4.0':
+    dependencies:
+      debug: 4.4.3
+      fs-extra: 9.1.0
+      lodash: 4.18.1
+      tmp-promise: 3.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@marijn/find-cluster-break@1.0.2': {}
+
+  '@mermaid-js/parser@1.1.0':
+    dependencies:
+      langium: 4.2.1
+
+  '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)':
+    dependencies:
+      '@hono/node-server': 1.19.11(hono@4.12.12)
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      content-type: 1.0.5
+      cors: 2.8.6
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      eventsource-parser: 3.0.6
+      express: 5.2.1
+      express-rate-limit: 8.4.1(express@5.2.1)
+      hono: 4.12.12
+      jose: 6.1.3
+      json-schema-typed: 8.0.2
+      pkce-challenge: 5.0.1
+      raw-body: 3.0.2
+      zod: 3.25.76
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@modelcontextprotocol/sdk@1.29.0(zod@4.3.6)':
+    dependencies:
+      '@hono/node-server': 1.19.11(hono@4.12.12)
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      content-type: 1.0.5
+      cors: 2.8.6
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      eventsource-parser: 3.0.6
+      express: 5.2.1
+      express-rate-limit: 8.4.1(express@5.2.1)
+      hono: 4.12.12
+      jose: 6.1.3
+      json-schema-typed: 8.0.2
+      pkce-challenge: 5.0.1
+      raw-body: 3.0.2
+      zod: 4.3.6
+      zod-to-json-schema: 3.25.2(zod@4.3.6)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@mswjs/interceptors@0.41.8':
+    dependencies:
+      '@open-draft/deferred-promise': 2.2.0
+      '@open-draft/logger': 0.3.0
+      '@open-draft/until': 2.1.0
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      strict-event-emitter: 0.5.1
+
+  '@next/env@14.2.35': {}
+
+  '@next/env@16.1.6': {}
+
+  '@next/env@16.2.1': {}
+
+  '@next/swc-darwin-arm64@14.2.33':
+    optional: true
+
+  '@next/swc-darwin-arm64@16.1.6':
+    optional: true
+
+  '@next/swc-darwin-arm64@16.2.1':
+    optional: true
+
+  '@next/swc-darwin-x64@14.2.33':
+    optional: true
+
+  '@next/swc-darwin-x64@16.1.6':
+    optional: true
+
+  '@next/swc-darwin-x64@16.2.1':
+    optional: true
+
+  '@next/swc-linux-arm64-gnu@14.2.33':
+    optional: true
+
+  '@next/swc-linux-arm64-gnu@16.1.6':
+    optional: true
+
+  '@next/swc-linux-arm64-gnu@16.2.1':
+    optional: true
+
+  '@next/swc-linux-arm64-musl@14.2.33':
+    optional: true
+
+  '@next/swc-linux-arm64-musl@16.1.6':
+    optional: true
+
+  '@next/swc-linux-arm64-musl@16.2.1':
+    optional: true
+
+  '@next/swc-linux-x64-gnu@14.2.33':
+    optional: true
+
+  '@next/swc-linux-x64-gnu@16.1.6':
+    optional: true
+
+  '@next/swc-linux-x64-gnu@16.2.1':
+    optional: true
+
+  '@next/swc-linux-x64-musl@14.2.33':
+    optional: true
+
+  '@next/swc-linux-x64-musl@16.1.6':
+    optional: true
+
+  '@next/swc-linux-x64-musl@16.2.1':
+    optional: true
+
+  '@next/swc-win32-arm64-msvc@14.2.33':
+    optional: true
+
+  '@next/swc-win32-arm64-msvc@16.1.6':
+    optional: true
+
+  '@next/swc-win32-arm64-msvc@16.2.1':
+    optional: true
+
+  '@next/swc-win32-ia32-msvc@14.2.33':
+    optional: true
+
+  '@next/swc-win32-x64-msvc@14.2.33':
+    optional: true
+
+  '@next/swc-win32-x64-msvc@16.1.6':
+    optional: true
+
+  '@next/swc-win32-x64-msvc@16.2.1':
+    optional: true
+
+  '@noble/ciphers@1.3.0': {}
+
+  '@noble/ciphers@2.1.1': {}
+
+  '@noble/curves@1.9.7':
+    dependencies:
+      '@noble/hashes': 1.8.0
+
+  '@noble/hashes@1.8.0': {}
+
+  '@noble/hashes@2.0.1': {}
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.1
+
+  '@npmcli/fs@2.1.2':
+    dependencies:
+      '@gar/promisify': 1.1.3
+      semver: 7.7.4
+
+  '@npmcli/move-file@2.0.1':
+    dependencies:
+      mkdirp: 1.0.4
+      rimraf: 3.0.2
+
+  '@open-draft/deferred-promise@2.2.0': {}
+
+  '@open-draft/deferred-promise@3.0.0': {}
+
+  '@open-draft/logger@0.3.0':
+    dependencies:
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+
+  '@open-draft/until@2.1.0': {}
+
+  '@opencode-ai/sdk@1.4.9':
+    dependencies:
+      cross-spawn: 7.0.6
+
+  '@opentelemetry/api-logs@0.207.0':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+
+  '@opentelemetry/api@1.9.0': {}
+
+  '@opentelemetry/context-async-hooks@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+
+  '@opentelemetry/core@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/core@2.6.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/exporter-logs-otlp-grpc@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@grpc/grpc-js': 1.14.3
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-grpc-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-logs-otlp-http@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-logs-otlp-proto@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-metrics-otlp-grpc@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@grpc/grpc-js': 1.14.3
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-metrics-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-grpc-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-metrics-otlp-http@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-metrics-otlp-proto@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-metrics-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-prometheus@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-trace-otlp-grpc@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@grpc/grpc-js': 1.14.3
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-grpc-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-trace-otlp-http@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-trace-otlp-proto@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/exporter-zipkin@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/instrumentation-http@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/instrumentation': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+      forwarded-parse: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@opentelemetry/instrumentation@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      import-in-the-middle: 2.0.6
+      require-in-the-middle: 8.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@opentelemetry/otlp-exporter-base@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/otlp-grpc-exporter-base@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@grpc/grpc-js': 1.14.3
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-exporter-base': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/otlp-transformer': 0.207.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/otlp-transformer@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+      protobufjs: 7.5.4
+
+  '@opentelemetry/propagator-b3@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/propagator-jaeger@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/resources@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/resources@2.6.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.6.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/sdk-logs@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/sdk-metrics@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/sdk-node@0.207.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/api-logs': 0.207.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-logs-otlp-grpc': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-logs-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-logs-otlp-proto': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-metrics-otlp-grpc': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-metrics-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-metrics-otlp-proto': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-prometheus': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-trace-otlp-grpc': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-trace-otlp-http': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-trace-otlp-proto': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/exporter-zipkin': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/instrumentation': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/propagator-b3': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/propagator-jaeger': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-node': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/sdk-trace-base@2.6.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/core': 2.6.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/resources': 2.6.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/semantic-conventions': 1.40.0
+
+  '@opentelemetry/sdk-trace-node@2.2.0(@opentelemetry/api@1.9.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.0
+      '@opentelemetry/context-async-hooks': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
+      '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0)
+
+  '@opentelemetry/semantic-conventions@1.40.0': {}
+
+  '@opentui/core-darwin-arm64@0.1.77': {}
+
+  '@opentui/core-darwin-x64@0.1.77': {}
+
+  '@opentui/core-linux-arm64@0.1.77': {}
+
+  '@opentui/core-linux-x64@0.1.77': {}
+
+  '@opentui/core-win32-arm64@0.1.77':
+    optional: true
+
+  '@opentui/core-win32-x64@0.1.77': {}
+
+  '@opentui/core@0.1.77(stage-js@1.0.0-alpha.17)(typescript@5.9.3)(web-tree-sitter@0.25.10)':
+    dependencies:
+      bun-ffi-structs: 0.1.2(typescript@5.9.3)
+      diff: 8.0.2
+      jimp: 1.6.0
+      marked: 17.0.1
+      web-tree-sitter: 0.25.10
+      yoga-layout: 3.2.1
+    optionalDependencies:
+      '@dimforge/rapier2d-simd-compat': 0.17.3
+      '@opentui/core-darwin-arm64': 0.1.77
+      '@opentui/core-darwin-x64': 0.1.77
+      '@opentui/core-linux-arm64': 0.1.77
+      '@opentui/core-linux-x64': 0.1.77
+      '@opentui/core-win32-arm64': 0.1.77
+      '@opentui/core-win32-x64': 0.1.77
+      bun-webgpu: 0.1.4
+      planck: 1.4.2(stage-js@1.0.0-alpha.17)
+      three: 0.177.0
+    transitivePeerDependencies:
+      - stage-js
+      - typescript
+
+  '@opentui/solid@0.1.77(solid-js@1.9.9)(stage-js@1.0.0-alpha.17)(typescript@5.9.3)(web-tree-sitter@0.25.10)':
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/preset-typescript': 7.27.1(@babel/core@7.28.0)
+      '@opentui/core': 0.1.77(stage-js@1.0.0-alpha.17)(typescript@5.9.3)(web-tree-sitter@0.25.10)
+      babel-plugin-module-resolver: 5.0.2
+      babel-preset-solid: 1.9.9(@babel/core@7.28.0)(solid-js@1.9.9)
+      s-js: 0.4.9
+      solid-js: 1.9.9
+    transitivePeerDependencies:
+      - stage-js
+      - supports-color
+      - typescript
+      - web-tree-sitter
+
+  '@paper-design/shaders-react@0.0.72(@types/react@19.2.14)(react@19.2.4)':
+    dependencies:
+      '@paper-design/shaders': 0.0.72
+      react: 19.2.4
+    optionalDependencies:
+      '@types/react': 19.2.14
+
+  '@paper-design/shaders@0.0.72': {}
+
+  '@pinojs/redact@0.4.0': {}
+
+  '@pkgjs/parseargs@0.11.0':
+    optional: true
+
+  '@planetscale/database@1.19.0': {}
+
+  '@playwright/test@1.58.2':
+    dependencies:
+      playwright: 1.58.2
+
+  '@protobufjs/aspromise@1.1.2': {}
+
+  '@protobufjs/base64@1.1.2': {}
+
+  '@protobufjs/codegen@2.0.4': {}
+
+  '@protobufjs/eventemitter@1.1.0': {}
+
+  '@protobufjs/fetch@1.1.0':
+    dependencies:
+      '@protobufjs/aspromise': 1.1.2
+      '@protobufjs/inquire': 1.1.0
+
+  '@protobufjs/float@1.0.2': {}
+
+  '@protobufjs/inquire@1.1.0': {}
+
+  '@protobufjs/path@1.1.2': {}
+
+  '@protobufjs/pool@1.1.0': {}
+
+  '@protobufjs/utf8@1.1.0': {}
+
+  '@radix-ui/colors@3.0.0': {}
+
+  '@rolldown/pluginutils@1.0.0-rc.3': {}
+
+  '@rollup/rollup-android-arm-eabi@4.55.1':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.55.1':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.55.1':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.55.1':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.55.1':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.55.1':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.55.1':
+    optional: true
+
+  '@sec-ant/readable-stream@0.4.1': {}
+
+  '@sindresorhus/is@4.6.0': {}
+
+  '@sindresorhus/merge-streams@4.0.0': {}
+
+  '@slack/logger@4.0.0':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@slack/socket-mode@2.0.5':
+    dependencies:
+      '@slack/logger': 4.0.0
+      '@slack/web-api': 7.13.0
+      '@types/node': 25.6.0
+      '@types/ws': 8.18.1
+      eventemitter3: 5.0.4
+      ws: 8.19.0
+    transitivePeerDependencies:
+      - bufferutil
+      - debug
+      - utf-8-validate
+
+  '@slack/types@2.19.0': {}
+
+  '@slack/web-api@7.13.0':
+    dependencies:
+      '@slack/logger': 4.0.0
+      '@slack/types': 2.19.0
+      '@types/node': 25.6.0
+      '@types/retry': 0.12.0
+      axios: 1.13.6
+      eventemitter3: 5.0.4
+      form-data: 4.0.5
+      is-electron: 2.2.2
+      is-stream: 2.0.1
+      p-queue: 6.6.2
+      p-retry: 4.6.2
+      retry: 0.13.1
+    transitivePeerDependencies:
+      - debug
+
+  '@smithy/abort-controller@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/chunked-blob-reader-native@4.2.3':
+    dependencies:
+      '@smithy/util-base64': 4.3.2
+      tslib: 2.8.1
+
+  '@smithy/chunked-blob-reader@5.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/config-resolver@4.4.11':
+    dependencies:
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-config-provider': 4.2.2
+      '@smithy/util-endpoints': 3.3.3
+      '@smithy/util-middleware': 4.2.12
+      tslib: 2.8.1
+
+  '@smithy/core@3.23.11':
+    dependencies:
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      '@smithy/util-base64': 4.3.2
+      '@smithy/util-body-length-browser': 4.2.2
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-stream': 4.5.19
+      '@smithy/util-utf8': 4.2.2
+      '@smithy/uuid': 1.1.2
+      tslib: 2.8.1
+
+  '@smithy/credential-provider-imds@4.2.12':
+    dependencies:
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/property-provider': 4.2.12
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      tslib: 2.8.1
+
+  '@smithy/eventstream-codec@4.2.12':
+    dependencies:
+      '@aws-crypto/crc32': 5.2.0
+      '@smithy/types': 4.13.1
+      '@smithy/util-hex-encoding': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/eventstream-serde-browser@4.2.12':
+    dependencies:
+      '@smithy/eventstream-serde-universal': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/eventstream-serde-config-resolver@4.3.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/eventstream-serde-node@4.2.12':
+    dependencies:
+      '@smithy/eventstream-serde-universal': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/eventstream-serde-universal@4.2.12':
+    dependencies:
+      '@smithy/eventstream-codec': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/fetch-http-handler@5.3.15':
+    dependencies:
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/querystring-builder': 4.2.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-base64': 4.3.2
+      tslib: 2.8.1
+
+  '@smithy/hash-blob-browser@4.2.13':
+    dependencies:
+      '@smithy/chunked-blob-reader': 5.2.2
+      '@smithy/chunked-blob-reader-native': 4.2.3
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/hash-node@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      '@smithy/util-buffer-from': 4.2.2
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/hash-stream-node@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/invalid-dependency@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/is-array-buffer@2.2.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/is-array-buffer@4.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/md5-js@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/middleware-content-length@4.2.12':
+    dependencies:
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/middleware-endpoint@4.4.25':
+    dependencies:
+      '@smithy/core': 3.23.11
+      '@smithy/middleware-serde': 4.2.14
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      '@smithy/url-parser': 4.2.12
+      '@smithy/util-middleware': 4.2.12
+      tslib: 2.8.1
+
+  '@smithy/middleware-retry@4.4.42':
+    dependencies:
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/service-error-classification': 4.2.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-retry': 4.2.12
+      '@smithy/uuid': 1.1.2
+      tslib: 2.8.1
+
+  '@smithy/middleware-serde@4.2.14':
+    dependencies:
+      '@smithy/core': 3.23.11
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/middleware-stack@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/node-config-provider@4.3.12':
+    dependencies:
+      '@smithy/property-provider': 4.2.12
+      '@smithy/shared-ini-file-loader': 4.4.7
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/node-http-handler@4.4.16':
+    dependencies:
+      '@smithy/abort-controller': 4.2.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/querystring-builder': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/property-provider@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/protocol-http@5.3.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/querystring-builder@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      '@smithy/util-uri-escape': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/querystring-parser@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/service-error-classification@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+
+  '@smithy/shared-ini-file-loader@4.4.7':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/signature-v4@5.3.12':
+    dependencies:
+      '@smithy/is-array-buffer': 4.2.2
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-hex-encoding': 4.2.2
+      '@smithy/util-middleware': 4.2.12
+      '@smithy/util-uri-escape': 4.2.2
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/smithy-client@4.12.5':
+    dependencies:
+      '@smithy/core': 3.23.11
+      '@smithy/middleware-endpoint': 4.4.25
+      '@smithy/middleware-stack': 4.2.12
+      '@smithy/protocol-http': 5.3.12
+      '@smithy/types': 4.13.1
+      '@smithy/util-stream': 4.5.19
+      tslib: 2.8.1
+
+  '@smithy/types@4.13.1':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/url-parser@4.2.12':
+    dependencies:
+      '@smithy/querystring-parser': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-base64@4.3.2':
+    dependencies:
+      '@smithy/util-buffer-from': 4.2.2
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/util-body-length-browser@4.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/util-body-length-node@4.2.3':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/util-buffer-from@2.2.0':
+    dependencies:
+      '@smithy/is-array-buffer': 2.2.0
+      tslib: 2.8.1
+
+  '@smithy/util-buffer-from@4.2.2':
+    dependencies:
+      '@smithy/is-array-buffer': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/util-config-provider@4.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/util-defaults-mode-browser@4.3.41':
+    dependencies:
+      '@smithy/property-provider': 4.2.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-defaults-mode-node@4.2.44':
+    dependencies:
+      '@smithy/config-resolver': 4.4.11
+      '@smithy/credential-provider-imds': 4.2.12
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/property-provider': 4.2.12
+      '@smithy/smithy-client': 4.12.5
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-endpoints@3.3.3':
+    dependencies:
+      '@smithy/node-config-provider': 4.3.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-hex-encoding@4.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/util-middleware@4.2.12':
+    dependencies:
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-retry@4.2.12':
+    dependencies:
+      '@smithy/service-error-classification': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/util-stream@4.5.19':
+    dependencies:
+      '@smithy/fetch-http-handler': 5.3.15
+      '@smithy/node-http-handler': 4.4.16
+      '@smithy/types': 4.13.1
+      '@smithy/util-base64': 4.3.2
+      '@smithy/util-buffer-from': 4.2.2
+      '@smithy/util-hex-encoding': 4.2.2
+      '@smithy/util-utf8': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/util-uri-escape@4.2.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@smithy/util-utf8@2.3.0':
+    dependencies:
+      '@smithy/util-buffer-from': 2.2.0
+      tslib: 2.8.1
+
+  '@smithy/util-utf8@4.2.2':
+    dependencies:
+      '@smithy/util-buffer-from': 4.2.2
+      tslib: 2.8.1
+
+  '@smithy/util-waiter@4.2.13':
+    dependencies:
+      '@smithy/abort-controller': 4.2.12
+      '@smithy/types': 4.13.1
+      tslib: 2.8.1
+
+  '@smithy/uuid@1.1.2':
+    dependencies:
+      tslib: 2.8.1
+
+  '@solid-primitives/event-bus@1.1.2(solid-js@1.9.9)':
+    dependencies:
+      '@solid-primitives/utils': 6.3.2(solid-js@1.9.9)
+      solid-js: 1.9.9
+
+  '@solid-primitives/storage@4.3.3(solid-js@1.9.9)':
+    dependencies:
+      '@solid-primitives/utils': 6.3.2(solid-js@1.9.9)
+      solid-js: 1.9.9
+
+  '@solid-primitives/utils@6.3.2(solid-js@1.9.9)':
+    dependencies:
+      solid-js: 1.9.9
+
+  '@solidjs/router@0.15.4(patch_hash=1db11a7c28fe4da76187d42efaffc6b9a70ad370462fffb794ff90e67744d770)(solid-js@1.9.9)':
+    dependencies:
+      solid-js: 1.9.9
+
+  '@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6)':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/json-schema': 7.0.15
+      quansync: 0.2.11
+    optionalDependencies:
+      zod: 4.3.6
+      zod-to-json-schema: 3.25.2(zod@4.3.6)
+
+  '@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6)':
+    dependencies:
+      '@standard-community/standard-json': 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6)
+      '@standard-schema/spec': 1.1.0
+      openapi-types: 12.1.3
+    optionalDependencies:
+      zod: 4.3.6
+
+  '@standard-schema/spec@1.1.0': {}
+
+  '@swc/counter@0.1.3': {}
+
+  '@swc/helpers@0.5.15':
+    dependencies:
+      tslib: 2.8.1
+
+  '@swc/helpers@0.5.5':
+    dependencies:
+      '@swc/counter': 0.1.3
+      tslib: 2.8.1
+
+  '@szmarczak/http-timer@4.0.6':
+    dependencies:
+      defer-to-connect: 2.0.1
+
+  '@tailwindcss/node@4.1.18':
+    dependencies:
+      '@jridgewell/remapping': 2.3.5
+      enhanced-resolve: 5.18.4
+      jiti: 2.6.1
+      lightningcss: 1.30.2
+      magic-string: 0.30.21
+      source-map-js: 1.2.1
+      tailwindcss: 4.1.18
+
+  '@tailwindcss/oxide-android-arm64@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-darwin-arm64@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-darwin-x64@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-freebsd-x64@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm64-gnu@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-linux-arm64-musl@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-linux-x64-gnu@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-linux-x64-musl@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-wasm32-wasi@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-win32-arm64-msvc@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide-win32-x64-msvc@4.1.18':
+    optional: true
+
+  '@tailwindcss/oxide@4.1.18':
+    optionalDependencies:
+      '@tailwindcss/oxide-android-arm64': 4.1.18
+      '@tailwindcss/oxide-darwin-arm64': 4.1.18
+      '@tailwindcss/oxide-darwin-x64': 4.1.18
+      '@tailwindcss/oxide-freebsd-x64': 4.1.18
+      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.1.18
+      '@tailwindcss/oxide-linux-arm64-gnu': 4.1.18
+      '@tailwindcss/oxide-linux-arm64-musl': 4.1.18
+      '@tailwindcss/oxide-linux-x64-gnu': 4.1.18
+      '@tailwindcss/oxide-linux-x64-musl': 4.1.18
+      '@tailwindcss/oxide-wasm32-wasi': 4.1.18
+      '@tailwindcss/oxide-win32-arm64-msvc': 4.1.18
+      '@tailwindcss/oxide-win32-x64-msvc': 4.1.18
+
+  '@tailwindcss/vite@4.1.18(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))':
+    dependencies:
+      '@tailwindcss/node': 4.1.18
+      '@tailwindcss/oxide': 4.1.18
+      tailwindcss: 4.1.18
+      vite: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+
+  '@tanstack/query-core@5.96.2': {}
+
+  '@tanstack/react-query@5.96.2(react@19.2.4)':
+    dependencies:
+      '@tanstack/query-core': 5.96.2
+      react: 19.2.4
+
+  '@tanstack/react-virtual@3.13.23(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@tanstack/virtual-core': 3.13.23
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+
+  '@tanstack/solid-virtual@3.13.19(solid-js@1.9.9)':
+    dependencies:
+      '@tanstack/virtual-core': 3.13.19
+      solid-js: 1.9.9
+
+  '@tanstack/virtual-core@3.13.19': {}
+
+  '@tanstack/virtual-core@3.13.23': {}
+
+  '@tauri-apps/api@2.10.1': {}
+
+  '@tauri-apps/cli-darwin-arm64@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-darwin-x64@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-musl@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-gnu@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-musl@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli-win32-x64-msvc@2.9.6':
+    optional: true
+
+  '@tauri-apps/cli@2.9.6':
+    optionalDependencies:
+      '@tauri-apps/cli-darwin-arm64': 2.9.6
+      '@tauri-apps/cli-darwin-x64': 2.9.6
+      '@tauri-apps/cli-linux-arm-gnueabihf': 2.9.6
+      '@tauri-apps/cli-linux-arm64-gnu': 2.9.6
+      '@tauri-apps/cli-linux-arm64-musl': 2.9.6
+      '@tauri-apps/cli-linux-riscv64-gnu': 2.9.6
+      '@tauri-apps/cli-linux-x64-gnu': 2.9.6
+      '@tauri-apps/cli-linux-x64-musl': 2.9.6
+      '@tauri-apps/cli-win32-arm64-msvc': 2.9.6
+      '@tauri-apps/cli-win32-ia32-msvc': 2.9.6
+      '@tauri-apps/cli-win32-x64-msvc': 2.9.6
+
+  '@tauri-apps/plugin-deep-link@2.4.7':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tauri-apps/plugin-dialog@2.6.0':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tauri-apps/plugin-http@2.5.6':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tauri-apps/plugin-opener@2.5.3':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tauri-apps/plugin-process@2.3.1':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tauri-apps/plugin-updater@2.9.0':
+    dependencies:
+      '@tauri-apps/api': 2.10.1
+
+  '@tokenizer/token@0.3.0': {}
+
+  '@tootallnate/once@2.0.0': {}
+
+  '@ts-morph/common@0.27.0':
+    dependencies:
+      fast-glob: 3.3.3
+      minimatch: 10.1.1
+      path-browserify: 1.0.1
+
+  '@turbo/darwin-64@2.8.20':
+    optional: true
+
+  '@turbo/darwin-arm64@2.8.20':
+    optional: true
+
+  '@turbo/linux-64@2.8.20':
+    optional: true
+
+  '@turbo/linux-arm64@2.8.20':
+    optional: true
+
+  '@turbo/windows-64@2.8.20':
+    optional: true
+
+  '@turbo/windows-arm64@2.8.20':
+    optional: true
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.28.6
+      '@babel/types': 7.28.6
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.28.6
+      '@babel/types': 7.29.0
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.0
+
+  '@types/cacheable-request@6.0.3':
+    dependencies:
+      '@types/http-cache-semantics': 4.2.0
+      '@types/keyv': 3.1.4
+      '@types/node': 25.6.0
+      '@types/responselike': 1.0.3
+
+  '@types/d3-array@3.2.2': {}
+
+  '@types/d3-axis@3.0.6':
+    dependencies:
+      '@types/d3-selection': 3.0.11
+
+  '@types/d3-brush@3.0.6':
+    dependencies:
+      '@types/d3-selection': 3.0.11
+
+  '@types/d3-chord@3.0.6': {}
+
+  '@types/d3-color@3.1.3': {}
+
+  '@types/d3-contour@3.0.6':
+    dependencies:
+      '@types/d3-array': 3.2.2
+      '@types/geojson': 7946.0.16
+
+  '@types/d3-delaunay@6.0.4': {}
+
+  '@types/d3-dispatch@3.0.7': {}
+
+  '@types/d3-drag@3.0.7':
+    dependencies:
+      '@types/d3-selection': 3.0.11
+
+  '@types/d3-dsv@3.0.7': {}
+
+  '@types/d3-ease@3.0.2': {}
+
+  '@types/d3-fetch@3.0.7':
+    dependencies:
+      '@types/d3-dsv': 3.0.7
+
+  '@types/d3-force@3.0.10': {}
+
+  '@types/d3-format@3.0.4': {}
+
+  '@types/d3-geo@3.1.0':
+    dependencies:
+      '@types/geojson': 7946.0.16
+
+  '@types/d3-hierarchy@3.1.7': {}
+
+  '@types/d3-interpolate@3.0.4':
+    dependencies:
+      '@types/d3-color': 3.1.3
+
+  '@types/d3-path@3.1.1': {}
+
+  '@types/d3-polygon@3.0.2': {}
+
+  '@types/d3-quadtree@3.0.6': {}
+
+  '@types/d3-random@3.0.3': {}
+
+  '@types/d3-scale-chromatic@3.1.0': {}
+
+  '@types/d3-scale@4.0.9':
+    dependencies:
+      '@types/d3-time': 3.0.4
+
+  '@types/d3-selection@3.0.11': {}
+
+  '@types/d3-shape@3.1.8':
+    dependencies:
+      '@types/d3-path': 3.1.1
+
+  '@types/d3-time-format@4.0.3': {}
+
+  '@types/d3-time@3.0.4': {}
+
+  '@types/d3-timer@3.0.2': {}
+
+  '@types/d3-transition@3.0.9':
+    dependencies:
+      '@types/d3-selection': 3.0.11
+
+  '@types/d3-zoom@3.0.8':
+    dependencies:
+      '@types/d3-interpolate': 3.0.4
+      '@types/d3-selection': 3.0.11
+
+  '@types/d3@7.4.3':
+    dependencies:
+      '@types/d3-array': 3.2.2
+      '@types/d3-axis': 3.0.6
+      '@types/d3-brush': 3.0.6
+      '@types/d3-chord': 3.0.6
+      '@types/d3-color': 3.1.3
+      '@types/d3-contour': 3.0.6
+      '@types/d3-delaunay': 6.0.4
+      '@types/d3-dispatch': 3.0.7
+      '@types/d3-drag': 3.0.7
+      '@types/d3-dsv': 3.0.7
+      '@types/d3-ease': 3.0.2
+      '@types/d3-fetch': 3.0.7
+      '@types/d3-force': 3.0.10
+      '@types/d3-format': 3.0.4
+      '@types/d3-geo': 3.1.0
+      '@types/d3-hierarchy': 3.1.7
+      '@types/d3-interpolate': 3.0.4
+      '@types/d3-path': 3.1.1
+      '@types/d3-polygon': 3.0.2
+      '@types/d3-quadtree': 3.0.6
+      '@types/d3-random': 3.0.3
+      '@types/d3-scale': 4.0.9
+      '@types/d3-scale-chromatic': 3.1.0
+      '@types/d3-selection': 3.0.11
+      '@types/d3-shape': 3.1.8
+      '@types/d3-time': 3.0.4
+      '@types/d3-time-format': 4.0.3
+      '@types/d3-timer': 3.0.2
+      '@types/d3-transition': 3.0.9
+      '@types/d3-zoom': 3.0.8
+
+  '@types/debug@4.1.13':
+    dependencies:
+      '@types/ms': 2.1.0
+
+  '@types/estree-jsx@1.0.5':
+    dependencies:
+      '@types/estree': 1.0.8
+
+  '@types/estree@1.0.8': {}
+
+  '@types/fs-extra@9.0.13':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@types/geojson@7946.0.16': {}
+
+  '@types/hast@3.0.4':
+    dependencies:
+      '@types/unist': 3.0.3
+
+  '@types/http-cache-semantics@4.2.0': {}
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/keyv@3.1.4':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@types/luxon@3.7.1': {}
+
+  '@types/mdast@4.0.4':
+    dependencies:
+      '@types/unist': 3.0.3
+
+  '@types/minimatch@5.1.2': {}
+
+  '@types/ms@2.1.0': {}
+
+  '@types/node@16.9.1': {}
+
+  '@types/node@20.12.12':
+    dependencies:
+      undici-types: 5.26.5
+
+  '@types/node@22.19.7':
+    dependencies:
+      undici-types: 6.21.0
+
+  '@types/node@25.4.0':
+    dependencies:
+      undici-types: 7.18.2
+
+  '@types/node@25.6.0':
+    dependencies:
+      undici-types: 7.19.2
+
+  '@types/plist@3.0.5':
+    dependencies:
+      '@types/node': 25.6.0
+      xmlbuilder: 15.1.1
+    optional: true
+
+  '@types/prop-types@15.7.15': {}
+
+  '@types/react-dom@18.2.25':
+    dependencies:
+      '@types/react': 19.2.14
+
+  '@types/react-dom@19.2.3(@types/react@19.2.14)':
+    dependencies:
+      '@types/react': 19.2.14
+
+  '@types/react@18.2.79':
+    dependencies:
+      '@types/prop-types': 15.7.15
+      csstype: 3.2.3
+
+  '@types/react@19.2.14':
+    dependencies:
+      csstype: 3.2.3
+
+  '@types/responselike@1.0.3':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@types/retry@0.12.0': {}
+
+  '@types/set-cookie-parser@2.4.10':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@types/statuses@2.0.6': {}
+
+  '@types/trusted-types@2.0.7':
+    optional: true
+
+  '@types/unist@2.0.11': {}
+
+  '@types/unist@3.0.3': {}
+
+  '@types/validate-npm-package-name@4.0.2': {}
+
+  '@types/verror@1.10.11':
+    optional: true
+
+  '@types/ws@8.18.1':
+    dependencies:
+      '@types/node': 25.6.0
+
+  '@types/yauzl@2.10.3':
+    dependencies:
+      '@types/node': 25.6.0
+    optional: true
+
+  '@ungap/structured-clone@1.3.0': {}
+
+  '@upsetjs/venn.js@2.0.0':
+    optionalDependencies:
+      d3-selection: 3.0.0
+      d3-transition: 3.0.1(d3-selection@3.0.0)
+
+  '@vercel/blob@0.27.3':
+    dependencies:
+      async-retry: 1.3.3
+      is-buffer: 2.0.5
+      is-node-process: 1.2.0
+      throttleit: 2.1.0
+      undici: 5.29.0
+
+  '@vercel/oidc@3.1.0': {}
+
+  '@vitejs/plugin-react@5.2.0(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.29.0)
+      '@rolldown/pluginutils': 1.0.0-rc.3
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.18.0
+      vite: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@vitejs/plugin-react@5.2.0(vite@7.3.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))':
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.29.0)
+      '@rolldown/pluginutils': 1.0.0-rc.3
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.18.0
+      vite: 7.3.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@webgpu/types@0.1.69':
+    optional: true
+
+  '@xmldom/xmldom@0.8.13': {}
+
+  abbrev@1.1.1: {}
+
+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
+  accepts@2.0.0:
+    dependencies:
+      mime-types: 3.0.2
+      negotiator: 1.0.0
+
+  acorn-import-attributes@1.9.5(acorn@8.16.0):
+    dependencies:
+      acorn: 8.16.0
+
+  acorn@8.16.0: {}
+
+  agent-base@6.0.2:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  agent-base@7.1.4: {}
+
+  agentkeepalive@4.6.0:
+    dependencies:
+      humanize-ms: 1.2.1
+
+  aggregate-error@3.1.0:
+    dependencies:
+      clean-stack: 2.2.0
+      indent-string: 4.0.0
+
+  ai@6.0.146(zod@4.3.6):
+    dependencies:
+      '@ai-sdk/gateway': 3.0.88(zod@4.3.6)
+      '@ai-sdk/provider': 3.0.8
+      '@ai-sdk/provider-utils': 4.0.22(zod@4.3.6)
+      '@opentelemetry/api': 1.9.0
+      zod: 4.3.6
+
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
+  ajv-keywords@3.5.2(ajv@6.14.0):
+    dependencies:
+      ajv: 6.14.0
+
+  ajv@6.14.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ajv@8.20.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.0
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  ansi-colors@4.1.3: {}
+
+  ansi-regex@5.0.1: {}
+
+  ansi-regex@6.2.2: {}
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  ansi-styles@6.2.3: {}
+
+  any-base@1.1.0: {}
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.1
+
+  app-builder-bin@5.0.0-alpha.10: {}
+
+  app-builder-lib@25.1.8(dmg-builder@25.1.8)(electron-builder-squirrel-windows@25.1.8):
+    dependencies:
+      '@develar/schema-utils': 2.6.5
+      '@electron/notarize': 2.5.0
+      '@electron/osx-sign': 1.3.1
+      '@electron/rebuild': 3.6.1
+      '@electron/universal': 2.0.1
+      '@malept/flatpak-bundler': 0.4.0
+      '@types/fs-extra': 9.0.13
+      async-exit-hook: 2.0.1
+      bluebird-lst: 1.0.9
+      builder-util: 25.1.7
+      builder-util-runtime: 9.2.10
+      chromium-pickle-js: 0.2.0
+      config-file-ts: 0.2.8-rc1
+      debug: 4.4.3
+      dmg-builder: 25.1.8(electron-builder-squirrel-windows@25.1.8)
+      dotenv: 16.6.1
+      dotenv-expand: 11.0.7
+      ejs: 3.1.10
+      electron-builder-squirrel-windows: 25.1.8(dmg-builder@25.1.8)
+      electron-publish: 25.1.7
+      form-data: 4.0.5
+      fs-extra: 10.1.0
+      hosted-git-info: 4.1.0
+      is-ci: 3.0.1
+      isbinaryfile: 5.0.7
+      js-yaml: 4.1.1
+      json5: 2.2.3
+      lazy-val: 1.0.5
+      minimatch: 10.1.1
+      resedit: 1.7.2
+      sanitize-filename: 1.6.4
+      semver: 7.7.4
+      tar: 6.2.1
+      temp-file: 3.4.0
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
+  aproba@2.1.0: {}
+
+  archiver-utils@2.1.0:
+    dependencies:
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      lazystream: 1.0.1
+      lodash.defaults: 4.2.0
+      lodash.difference: 4.5.0
+      lodash.flatten: 4.4.0
+      lodash.isplainobject: 4.0.6
+      lodash.union: 4.6.0
+      normalize-path: 3.0.0
+      readable-stream: 2.3.8
+
+  archiver-utils@3.0.4:
+    dependencies:
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      lazystream: 1.0.1
+      lodash.defaults: 4.2.0
+      lodash.difference: 4.5.0
+      lodash.flatten: 4.4.0
+      lodash.isplainobject: 4.0.6
+      lodash.union: 4.6.0
+      normalize-path: 3.0.0
+      readable-stream: 3.6.2
+
+  archiver@5.3.2:
+    dependencies:
+      archiver-utils: 2.1.0
+      async: 3.2.6
+      buffer-crc32: 0.2.13
+      readable-stream: 3.6.2
+      readdir-glob: 1.1.3
+      tar-stream: 2.2.0
+      zip-stream: 4.1.1
+
+  are-we-there-yet@3.0.1:
+    dependencies:
+      delegates: 1.0.0
+      readable-stream: 3.6.2
+
+  arg@5.0.2: {}
+
+  argparse@2.0.1: {}
+
+  assert-plus@1.0.0:
+    optional: true
+
+  ast-types@0.16.1:
+    dependencies:
+      tslib: 2.8.1
+
+  astral-regex@2.0.0:
+    optional: true
+
+  async-exit-hook@2.0.1: {}
+
+  async-retry@1.3.3:
+    dependencies:
+      retry: 0.13.1
+
+  async@3.2.6: {}
+
+  asynckit@0.4.0: {}
+
+  at-least-node@1.0.0: {}
+
+  atomic-sleep@1.0.0: {}
+
+  autoprefixer@10.4.19(postcss@8.4.38):
+    dependencies:
+      browserslist: 4.28.1
+      caniuse-lite: 1.0.30001764
+      fraction.js: 4.3.7
+      normalize-range: 0.1.2
+      picocolors: 1.1.1
+      postcss: 8.4.38
+      postcss-value-parser: 4.2.0
+
+  await-to-js@3.0.0: {}
+
+  aws-ssl-profiles@1.1.2: {}
+
+  axios@1.13.6:
+    dependencies:
+      follow-redirects: 1.15.11
+      form-data: 4.0.5
+      proxy-from-env: 1.1.0
+    transitivePeerDependencies:
+      - debug
+
+  babel-plugin-jsx-dom-expressions@0.40.3(@babel/core@7.28.0):
+    dependencies:
+      '@babel/core': 7.28.0
+      '@babel/helper-module-imports': 7.18.6
+      '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.28.0)
+      '@babel/types': 7.29.0
+      html-entities: 2.3.3
+      parse5: 7.3.0
+
+  babel-plugin-jsx-dom-expressions@0.40.3(@babel/core@7.28.6):
+    dependencies:
+      '@babel/core': 7.28.6
+      '@babel/helper-module-imports': 7.18.6
+      '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.28.6)
+      '@babel/types': 7.29.0
+      html-entities: 2.3.3
+      parse5: 7.3.0
+
+  babel-plugin-module-resolver@5.0.2:
+    dependencies:
+      find-babel-config: 2.1.2
+      glob: 9.3.5
+      pkg-up: 3.1.0
+      reselect: 4.1.8
+      resolve: 1.22.11
+
+  babel-preset-solid@1.9.9(@babel/core@7.28.0)(solid-js@1.9.9):
+    dependencies:
+      '@babel/core': 7.28.0
+      babel-plugin-jsx-dom-expressions: 0.40.3(@babel/core@7.28.0)
+    optionalDependencies:
+      solid-js: 1.9.9
+
+  babel-preset-solid@1.9.9(@babel/core@7.28.6)(solid-js@1.9.9):
+    dependencies:
+      '@babel/core': 7.28.6
+      babel-plugin-jsx-dom-expressions: 0.40.3(@babel/core@7.28.6)
+    optionalDependencies:
+      solid-js: 1.9.9
+
+  bail@2.0.2: {}
+
+  balanced-match@1.0.2: {}
+
+  base64-js@1.5.1: {}
+
+  baseline-browser-mapping@2.10.11: {}
+
+  baseline-browser-mapping@2.9.14: {}
+
+  better-auth@1.5.6(@opentelemetry/api@1.9.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))(mysql2@3.17.4)(next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(solid-js@1.9.10):
+    dependencies:
+      '@better-auth/core': 1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0)
+      '@better-auth/drizzle-adapter': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4))
+      '@better-auth/kysely-adapter': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)(kysely@0.28.15)
+      '@better-auth/memory-adapter': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)
+      '@better-auth/mongo-adapter': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)
+      '@better-auth/prisma-adapter': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))(@better-auth/utils@0.3.1)
+      '@better-auth/telemetry': 1.5.6(@better-auth/core@1.5.6(@better-auth/utils@0.3.1)(@better-fetch/fetch@1.1.21)(@opentelemetry/api@1.9.0)(better-call@1.3.2(zod@4.3.6))(jose@6.1.3)(kysely@0.28.15)(nanostores@1.2.0))
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      '@noble/ciphers': 2.1.1
+      '@noble/hashes': 2.0.1
+      better-call: 1.3.2(zod@4.3.6)
+      defu: 6.1.4
+      jose: 6.1.3
+      kysely: 0.28.15
+      nanostores: 1.2.0
+      zod: 4.3.6
+    optionalDependencies:
+      drizzle-kit: 0.31.9
+      drizzle-orm: 0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4)
+      mysql2: 3.17.4
+      next: 16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      solid-js: 1.9.10
+    transitivePeerDependencies:
+      - '@cloudflare/workers-types'
+      - '@opentelemetry/api'
+
+  better-call@1.3.2(zod@4.3.6):
+    dependencies:
+      '@better-auth/utils': 0.3.1
+      '@better-fetch/fetch': 1.1.21
+      rou3: 0.7.12
+      set-cookie-parser: 3.1.0
+    optionalDependencies:
+      zod: 4.3.6
+
+  binary-extensions@2.3.0: {}
+
+  bl@4.1.0:
+    dependencies:
+      buffer: 5.6.0
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+
+  bluebird-lst@1.0.9:
+    dependencies:
+      bluebird: 3.7.2
+
+  bluebird@3.7.2: {}
+
+  bmp-ts@1.0.9: {}
+
+  body-parser@2.2.2:
+    dependencies:
+      bytes: 3.1.2
+      content-type: 1.0.5
+      debug: 4.4.3
+      http-errors: 2.0.1
+      iconv-lite: 0.7.2
+      on-finished: 2.4.1
+      qs: 6.15.1
+      raw-body: 3.0.2
+      type-is: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  boolean@3.2.0:
+    optional: true
+
+  botid@1.5.11(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0):
+    optionalDependencies:
+      next: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)
+      react: 18.2.0
+
+  botid@1.5.11(next@16.1.6(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4):
+    optionalDependencies:
+      next: 16.1.6(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+
+  bowser@2.14.1: {}
+
+  brace-expansion@1.1.14:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@2.0.2:
+    dependencies:
+      balanced-match: 1.0.2
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.1:
+    dependencies:
+      baseline-browser-mapping: 2.9.14
+      caniuse-lite: 1.0.30001764
+      electron-to-chromium: 1.5.267
+      node-releases: 2.0.27
+      update-browserslist-db: 1.2.3(browserslist@4.28.1)
+
+  buffer-crc32@0.2.13: {}
+
+  buffer-from@1.1.2: {}
+
+  buffer@5.6.0:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  builder-util-runtime@9.2.10:
+    dependencies:
+      debug: 4.4.3
+      sax: 1.4.4
+    transitivePeerDependencies:
+      - supports-color
+
+  builder-util-runtime@9.5.1:
+    dependencies:
+      debug: 4.4.3
+      sax: 1.4.4
+    transitivePeerDependencies:
+      - supports-color
+
+  builder-util@25.1.7:
+    dependencies:
+      7zip-bin: 5.2.0
+      '@types/debug': 4.1.13
+      app-builder-bin: 5.0.0-alpha.10
+      bluebird-lst: 1.0.9
+      builder-util-runtime: 9.2.10
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      fs-extra: 10.1.0
+      http-proxy-agent: 7.0.2
+      https-proxy-agent: 7.0.6
+      is-ci: 3.0.1
+      js-yaml: 4.1.1
+      source-map-support: 0.5.21
+      stat-mode: 1.0.0
+      temp-file: 3.4.0
+    transitivePeerDependencies:
+      - supports-color
+
+  bun-ffi-structs@0.1.2(typescript@5.9.3):
+    dependencies:
+      typescript: 5.9.3
+
+  bun-types@1.3.6:
+    dependencies:
+      '@types/node': 25.6.0
+
+  bun-webgpu-darwin-arm64@0.1.4:
+    optional: true
+
+  bun-webgpu-darwin-x64@0.1.4:
+    optional: true
+
+  bun-webgpu-linux-x64@0.1.4:
+    optional: true
+
+  bun-webgpu-win32-x64@0.1.4:
+    optional: true
+
+  bun-webgpu@0.1.4:
+    dependencies:
+      '@webgpu/types': 0.1.69
+    optionalDependencies:
+      bun-webgpu-darwin-arm64: 0.1.4
+      bun-webgpu-darwin-x64: 0.1.4
+      bun-webgpu-linux-x64: 0.1.4
+      bun-webgpu-win32-x64: 0.1.4
+    optional: true
+
+  bundle-name@4.1.0:
+    dependencies:
+      run-applescript: 7.1.0
+
+  bundle-require@5.1.0(esbuild@0.27.2):
+    dependencies:
+      esbuild: 0.27.2
+      load-tsconfig: 0.2.5
+
+  busboy@1.6.0:
+    dependencies:
+      streamsearch: 1.1.0
+
+  bytes@3.1.2: {}
+
+  c12@3.3.3:
+    dependencies:
+      chokidar: 5.0.0
+      confbox: 0.2.4
+      defu: 6.1.4
+      dotenv: 17.3.1
+      exsolve: 1.0.8
+      giget: 2.0.0
+      jiti: 2.6.1
+      ohash: 2.0.11
+      pathe: 2.0.3
+      perfect-debounce: 2.1.0
+      pkg-types: 2.3.0
+      rc9: 2.1.2
+
+  cac@6.7.14: {}
+
+  cacache@16.1.3:
+    dependencies:
+      '@npmcli/fs': 2.1.2
+      '@npmcli/move-file': 2.0.1
+      chownr: 2.0.0
+      fs-minipass: 2.1.0
+      glob: 8.1.0
+      infer-owner: 1.0.4
+      lru-cache: 7.18.3
+      minipass: 3.3.6
+      minipass-collect: 1.0.2
+      minipass-flush: 1.0.7
+      minipass-pipeline: 1.2.4
+      mkdirp: 1.0.4
+      p-map: 4.0.0
+      promise-inflight: 1.0.1
+      rimraf: 3.0.2
+      ssri: 9.0.1
+      tar: 6.2.1
+      unique-filename: 2.0.1
+    transitivePeerDependencies:
+      - bluebird
+
+  cacheable-lookup@5.0.4: {}
+
+  cacheable-request@7.0.4:
+    dependencies:
+      clone-response: 1.0.3
+      get-stream: 5.2.0
+      http-cache-semantics: 4.2.0
+      keyv: 4.5.4
+      lowercase-keys: 2.0.0
+      normalize-url: 6.1.0
+      responselike: 2.0.1
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+  callsites@3.1.0: {}
+
+  camelcase-css@2.0.1: {}
+
+  caniuse-lite@1.0.30001764: {}
+
+  ccount@2.0.1: {}
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  chalk@5.6.2: {}
+
+  character-entities-html4@2.1.0: {}
+
+  character-entities-legacy@3.0.0: {}
+
+  character-entities@2.0.2: {}
+
+  character-reference-invalid@2.0.1: {}
+
+  chevrotain-allstar@0.3.1(chevrotain@11.1.2):
+    dependencies:
+      chevrotain: 11.1.2
+      lodash-es: 4.18.1
+
+  chevrotain@11.1.2:
+    dependencies:
+      '@chevrotain/cst-dts-gen': 11.1.2
+      '@chevrotain/gast': 11.1.2
+      '@chevrotain/regexp-to-ast': 11.1.2
+      '@chevrotain/types': 11.1.2
+      '@chevrotain/utils': 11.1.2
+      lodash-es: 4.17.23
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
+  chokidar@5.0.0:
+    dependencies:
+      readdirp: 5.0.0
+
+  chownr@2.0.0: {}
+
+  chownr@3.0.0: {}
+
+  chromium-pickle-js@0.2.0: {}
+
+  ci-info@3.9.0: {}
+
+  citty@0.1.6:
+    dependencies:
+      consola: 3.4.2
+
+  citty@0.2.2: {}
+
+  cjs-module-lexer@2.2.0: {}
+
+  class-variance-authority@0.7.1:
+    dependencies:
+      clsx: 2.1.1
+
+  clean-stack@2.2.0: {}
+
+  cli-cursor@3.1.0:
+    dependencies:
+      restore-cursor: 3.1.0
+
+  cli-cursor@5.0.0:
+    dependencies:
+      restore-cursor: 5.1.0
+
+  cli-spinners@2.9.2: {}
+
+  cli-truncate@2.1.0:
+    dependencies:
+      slice-ansi: 3.0.0
+      string-width: 4.2.3
+    optional: true
+
+  cli-width@4.1.0: {}
+
+  client-only@0.0.1: {}
+
+  cliui@8.0.1:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 7.0.0
+
+  clone-response@1.0.3:
+    dependencies:
+      mimic-response: 1.0.1
+
+  clone@1.0.4: {}
+
+  clsx@2.1.1: {}
+
+  code-block-writer@13.0.3: {}
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.4: {}
+
+  color-support@1.1.3: {}
+
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
+  comma-separated-tokens@2.0.3: {}
+
+  commander@11.1.0: {}
+
+  commander@12.1.0: {}
+
+  commander@14.0.3: {}
+
+  commander@4.1.1: {}
+
+  commander@5.1.0: {}
+
+  commander@7.2.0: {}
+
+  commander@8.3.0: {}
+
+  compare-version@0.1.2: {}
+
+  compress-commons@4.1.2:
+    dependencies:
+      buffer-crc32: 0.2.13
+      crc32-stream: 4.0.3
+      normalize-path: 3.0.0
+      readable-stream: 3.6.2
+
+  concat-map@0.0.1: {}
+
+  confbox@0.1.8: {}
+
+  confbox@0.2.4: {}
+
+  config-file-ts@0.2.8-rc1:
+    dependencies:
+      glob: 10.5.0
+      typescript: 5.9.3
+
+  consola@3.4.2: {}
+
+  console-control-strings@1.1.0: {}
+
+  content-disposition@1.1.0: {}
+
+  content-type@1.0.5: {}
+
+  convert-source-map@2.0.0: {}
+
+  cookie-signature@1.2.2: {}
+
+  cookie@0.7.2: {}
+
+  cookie@1.1.1: {}
+
+  core-util-is@1.0.2:
+    optional: true
+
+  core-util-is@1.0.3: {}
+
+  cors@2.8.6:
+    dependencies:
+      object-assign: 4.1.1
+      vary: 1.1.2
+
+  cose-base@1.0.3:
+    dependencies:
+      layout-base: 1.0.2
+
+  cose-base@2.2.0:
+    dependencies:
+      layout-base: 2.0.1
+
+  cosmiconfig@9.0.1(typescript@5.9.3):
+    dependencies:
+      env-paths: 2.2.1
+      import-fresh: 3.3.1
+      js-yaml: 4.1.1
+      parse-json: 5.2.0
+    optionalDependencies:
+      typescript: 5.9.3
+
+  crc-32@1.2.2: {}
+
+  crc32-stream@4.0.3:
+    dependencies:
+      crc-32: 1.2.2
+      readable-stream: 3.6.2
+
+  crc@3.8.0:
+    dependencies:
+      buffer: 5.6.0
+    optional: true
+
+  crelt@1.0.6: {}
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  cytoscape-cose-bilkent@4.1.0(cytoscape@3.33.1):
+    dependencies:
+      cose-base: 1.0.3
+      cytoscape: 3.33.1
+
+  cytoscape-fcose@2.2.0(cytoscape@3.33.1):
+    dependencies:
+      cose-base: 2.2.0
+      cytoscape: 3.33.1
+
+  cytoscape@3.33.1: {}
+
+  d3-array@2.12.1:
+    dependencies:
+      internmap: 1.0.1
+
+  d3-array@3.2.4:
+    dependencies:
+      internmap: 2.0.3
+
+  d3-axis@3.0.0: {}
+
+  d3-brush@3.0.0:
+    dependencies:
+      d3-dispatch: 3.0.1
+      d3-drag: 3.0.0
+      d3-interpolate: 3.0.1
+      d3-selection: 3.0.0
+      d3-transition: 3.0.1(d3-selection@3.0.0)
+
+  d3-chord@3.0.1:
+    dependencies:
+      d3-path: 3.1.0
+
+  d3-color@3.1.0: {}
+
+  d3-contour@4.0.2:
+    dependencies:
+      d3-array: 3.2.4
+
+  d3-delaunay@6.0.4:
+    dependencies:
+      delaunator: 5.1.0
+
+  d3-dispatch@3.0.1: {}
+
+  d3-drag@3.0.0:
+    dependencies:
+      d3-dispatch: 3.0.1
+      d3-selection: 3.0.0
+
+  d3-dsv@3.0.1:
+    dependencies:
+      commander: 7.2.0
+      iconv-lite: 0.6.3
+      rw: 1.3.3
+
+  d3-ease@3.0.1: {}
+
+  d3-fetch@3.0.1:
+    dependencies:
+      d3-dsv: 3.0.1
+
+  d3-force@3.0.0:
+    dependencies:
+      d3-dispatch: 3.0.1
+      d3-quadtree: 3.0.1
+      d3-timer: 3.0.1
+
+  d3-format@3.1.2: {}
+
+  d3-geo@3.1.1:
+    dependencies:
+      d3-array: 3.2.4
+
+  d3-hierarchy@3.1.2: {}
+
+  d3-interpolate@3.0.1:
+    dependencies:
+      d3-color: 3.1.0
+
+  d3-path@1.0.9: {}
+
+  d3-path@3.1.0: {}
+
+  d3-polygon@3.0.1: {}
+
+  d3-quadtree@3.0.1: {}
+
+  d3-random@3.0.1: {}
+
+  d3-sankey@0.12.3:
+    dependencies:
+      d3-array: 2.12.1
+      d3-shape: 1.3.7
+
+  d3-scale-chromatic@3.1.0:
+    dependencies:
+      d3-color: 3.1.0
+      d3-interpolate: 3.0.1
+
+  d3-scale@4.0.2:
+    dependencies:
+      d3-array: 3.2.4
+      d3-format: 3.1.2
+      d3-interpolate: 3.0.1
+      d3-time: 3.1.0
+      d3-time-format: 4.1.0
+
+  d3-selection@3.0.0: {}
+
+  d3-shape@1.3.7:
+    dependencies:
+      d3-path: 1.0.9
+
+  d3-shape@3.2.0:
+    dependencies:
+      d3-path: 3.1.0
+
+  d3-time-format@4.1.0:
+    dependencies:
+      d3-time: 3.1.0
+
+  d3-time@3.1.0:
+    dependencies:
+      d3-array: 3.2.4
+
+  d3-timer@3.0.1: {}
+
+  d3-transition@3.0.1(d3-selection@3.0.0):
+    dependencies:
+      d3-color: 3.1.0
+      d3-dispatch: 3.0.1
+      d3-ease: 3.0.1
+      d3-interpolate: 3.0.1
+      d3-selection: 3.0.0
+      d3-timer: 3.0.1
+
+  d3-zoom@3.0.0:
+    dependencies:
+      d3-dispatch: 3.0.1
+      d3-drag: 3.0.0
+      d3-interpolate: 3.0.1
+      d3-selection: 3.0.0
+      d3-transition: 3.0.1(d3-selection@3.0.0)
+
+  d3@7.9.0:
+    dependencies:
+      d3-array: 3.2.4
+      d3-axis: 3.0.0
+      d3-brush: 3.0.0
+      d3-chord: 3.0.1
+      d3-color: 3.1.0
+      d3-contour: 4.0.2
+      d3-delaunay: 6.0.4
+      d3-dispatch: 3.0.1
+      d3-drag: 3.0.0
+      d3-dsv: 3.0.1
+      d3-ease: 3.0.1
+      d3-fetch: 3.0.1
+      d3-force: 3.0.0
+      d3-format: 3.1.2
+      d3-geo: 3.1.1
+      d3-hierarchy: 3.1.2
+      d3-interpolate: 3.0.1
+      d3-path: 3.1.0
+      d3-polygon: 3.0.1
+      d3-quadtree: 3.0.1
+      d3-random: 3.0.1
+      d3-scale: 4.0.2
+      d3-scale-chromatic: 3.1.0
+      d3-selection: 3.0.0
+      d3-shape: 3.2.0
+      d3-time: 3.1.0
+      d3-time-format: 4.1.0
+      d3-timer: 3.0.1
+      d3-transition: 3.0.1(d3-selection@3.0.0)
+      d3-zoom: 3.0.0
+
+  dagre-d3-es@7.0.14:
+    dependencies:
+      d3: 7.9.0
+      lodash-es: 4.18.1
+
+  data-uri-to-buffer@4.0.1: {}
+
+  dayjs@1.11.20: {}
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  decode-named-character-reference@1.3.0:
+    dependencies:
+      character-entities: 2.0.2
+
+  decompress-response@6.0.0:
+    dependencies:
+      mimic-response: 3.1.0
+
+  dedent@1.7.2: {}
+
+  deepmerge@4.3.1: {}
+
+  default-browser-id@5.0.1: {}
+
+  default-browser@5.5.0:
+    dependencies:
+      bundle-name: 4.1.0
+      default-browser-id: 5.0.1
+
+  defaults@1.0.4:
+    dependencies:
+      clone: 1.0.4
+
+  defer-to-connect@2.0.1: {}
+
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+    optional: true
+
+  define-lazy-prop@3.0.0: {}
+
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+    optional: true
+
+  defu@6.1.4: {}
+
+  delaunator@5.1.0:
+    dependencies:
+      robust-predicates: 3.0.3
+
+  delayed-stream@1.0.0: {}
+
+  delegates@1.0.0: {}
+
+  denque@2.1.0: {}
+
+  depd@2.0.0: {}
+
+  dequal@2.0.3: {}
+
+  destr@2.0.5: {}
+
+  detect-libc@2.1.2: {}
+
+  detect-node@2.1.0:
+    optional: true
+
+  devlop@1.1.0:
+    dependencies:
+      dequal: 2.0.3
+
+  didyoumean@1.2.2: {}
+
+  diff@8.0.2: {}
+
+  dir-compare@4.2.0:
+    dependencies:
+      minimatch: 3.1.5
+      p-limit: 3.1.0
+
+  dlv@1.1.3: {}
+
+  dmg-builder@25.1.8(electron-builder-squirrel-windows@25.1.8):
+    dependencies:
+      app-builder-lib: 25.1.8(dmg-builder@25.1.8)(electron-builder-squirrel-windows@25.1.8)
+      builder-util: 25.1.7
+      builder-util-runtime: 9.2.10
+      fs-extra: 10.1.0
+      iconv-lite: 0.6.3
+      js-yaml: 4.1.1
+    optionalDependencies:
+      dmg-license: 1.0.11
+    transitivePeerDependencies:
+      - bluebird
+      - electron-builder-squirrel-windows
+      - supports-color
+
+  dmg-license@1.0.11:
+    dependencies:
+      '@types/plist': 3.0.5
+      '@types/verror': 1.10.11
+      ajv: 6.14.0
+      crc: 3.8.0
+      iconv-corefoundation: 1.1.7
+      plist: 3.1.0
+      smart-buffer: 4.2.0
+      verror: 1.10.1
+    optional: true
+
+  dompurify@3.3.3:
+    optionalDependencies:
+      '@types/trusted-types': 2.0.7
+
+  dotenv-expand@11.0.7:
+    dependencies:
+      dotenv: 16.6.1
+
+  dotenv@16.6.1: {}
+
+  dotenv@17.3.1: {}
+
+  drizzle-kit@0.31.9:
+    dependencies:
+      '@drizzle-team/brocli': 0.10.2
+      '@esbuild-kit/esm-loader': 2.6.5
+      esbuild: 0.25.12
+      esbuild-register: 3.6.0(esbuild@0.25.12)
+    transitivePeerDependencies:
+      - supports-color
+
+  drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@planetscale/database@1.19.0)(bun-types@1.3.6)(kysely@0.28.15)(mysql2@3.17.4):
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.0
+      '@planetscale/database': 1.19.0
+      bun-types: 1.3.6
+      kysely: 0.28.15
+      mysql2: 3.17.4
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  eastasianwidth@0.2.0: {}
+
+  eciesjs@0.4.18:
+    dependencies:
+      '@ecies/ciphers': 0.2.6(@noble/ciphers@1.3.0)
+      '@noble/ciphers': 1.3.0
+      '@noble/curves': 1.9.7
+      '@noble/hashes': 1.8.0
+
+  ee-first@1.1.1: {}
+
+  ejs@3.1.10:
+    dependencies:
+      jake: 10.9.4
+
+  electron-builder-squirrel-windows@25.1.8(dmg-builder@25.1.8):
+    dependencies:
+      app-builder-lib: 25.1.8(dmg-builder@25.1.8)(electron-builder-squirrel-windows@25.1.8)
+      archiver: 5.3.2
+      builder-util: 25.1.7
+      fs-extra: 10.1.0
+    transitivePeerDependencies:
+      - bluebird
+      - dmg-builder
+      - supports-color
+
+  electron-builder@25.1.8(electron-builder-squirrel-windows@25.1.8):
+    dependencies:
+      app-builder-lib: 25.1.8(dmg-builder@25.1.8)(electron-builder-squirrel-windows@25.1.8)
+      builder-util: 25.1.7
+      builder-util-runtime: 9.2.10
+      chalk: 4.1.2
+      dmg-builder: 25.1.8(electron-builder-squirrel-windows@25.1.8)
+      fs-extra: 10.1.0
+      is-ci: 3.0.1
+      lazy-val: 1.0.5
+      simple-update-notifier: 2.0.0
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - bluebird
+      - electron-builder-squirrel-windows
+      - supports-color
+
+  electron-devtools-installer@4.0.0:
+    dependencies:
+      unzip-crx-3: 0.2.0
+
+  electron-publish@25.1.7:
+    dependencies:
+      '@types/fs-extra': 9.0.13
+      builder-util: 25.1.7
+      builder-util-runtime: 9.2.10
+      chalk: 4.1.2
+      fs-extra: 10.1.0
+      lazy-val: 1.0.5
+      mime: 2.6.0
+    transitivePeerDependencies:
+      - supports-color
+
+  electron-to-chromium@1.5.267: {}
+
+  electron-updater@6.8.3:
+    dependencies:
+      builder-util-runtime: 9.5.1
+      fs-extra: 10.1.0
+      js-yaml: 4.1.1
+      lazy-val: 1.0.5
+      lodash.escaperegexp: 4.1.2
+      lodash.isequal: 4.5.0
+      semver: 7.7.4
+      tiny-typed-emitter: 2.1.0
+    transitivePeerDependencies:
+      - supports-color
+
+  electron@35.7.5:
+    dependencies:
+      '@electron/get': 2.0.3
+      '@types/node': 22.19.7
+      extract-zip: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  emoji-regex@10.6.0: {}
+
+  emoji-regex@8.0.0: {}
+
+  emoji-regex@9.2.2: {}
+
+  encodeurl@2.0.0: {}
+
+  encoding@0.1.13:
+    dependencies:
+      iconv-lite: 0.6.3
+    optional: true
+
+  end-of-stream@1.4.5:
+    dependencies:
+      once: 1.4.0
+
+  enhanced-resolve@5.18.4:
+    dependencies:
+      graceful-fs: 4.2.11
+      tapable: 2.3.0
+
+  entities@6.0.1: {}
+
+  env-paths@2.2.1: {}
+
+  err-code@2.0.3: {}
+
+  error-ex@1.3.4:
+    dependencies:
+      is-arrayish: 0.2.1
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-object-atoms@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.2
+
+  es6-error@4.1.1:
+    optional: true
+
+  esbuild-register@3.6.0(esbuild@0.25.12):
+    dependencies:
+      debug: 4.4.3
+      esbuild: 0.25.12
+    transitivePeerDependencies:
+      - supports-color
+
+  esbuild@0.18.20:
+    optionalDependencies:
+      '@esbuild/android-arm': 0.18.20
+      '@esbuild/android-arm64': 0.18.20
+      '@esbuild/android-x64': 0.18.20
+      '@esbuild/darwin-arm64': 0.18.20
+      '@esbuild/darwin-x64': 0.18.20
+      '@esbuild/freebsd-arm64': 0.18.20
+      '@esbuild/freebsd-x64': 0.18.20
+      '@esbuild/linux-arm': 0.18.20
+      '@esbuild/linux-arm64': 0.18.20
+      '@esbuild/linux-ia32': 0.18.20
+      '@esbuild/linux-loong64': 0.18.20
+      '@esbuild/linux-mips64el': 0.18.20
+      '@esbuild/linux-ppc64': 0.18.20
+      '@esbuild/linux-riscv64': 0.18.20
+      '@esbuild/linux-s390x': 0.18.20
+      '@esbuild/linux-x64': 0.18.20
+      '@esbuild/netbsd-x64': 0.18.20
+      '@esbuild/openbsd-x64': 0.18.20
+      '@esbuild/sunos-x64': 0.18.20
+      '@esbuild/win32-arm64': 0.18.20
+      '@esbuild/win32-ia32': 0.18.20
+      '@esbuild/win32-x64': 0.18.20
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  esbuild@0.27.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.27.2
+      '@esbuild/android-arm': 0.27.2
+      '@esbuild/android-arm64': 0.27.2
+      '@esbuild/android-x64': 0.27.2
+      '@esbuild/darwin-arm64': 0.27.2
+      '@esbuild/darwin-x64': 0.27.2
+      '@esbuild/freebsd-arm64': 0.27.2
+      '@esbuild/freebsd-x64': 0.27.2
+      '@esbuild/linux-arm': 0.27.2
+      '@esbuild/linux-arm64': 0.27.2
+      '@esbuild/linux-ia32': 0.27.2
+      '@esbuild/linux-loong64': 0.27.2
+      '@esbuild/linux-mips64el': 0.27.2
+      '@esbuild/linux-ppc64': 0.27.2
+      '@esbuild/linux-riscv64': 0.27.2
+      '@esbuild/linux-s390x': 0.27.2
+      '@esbuild/linux-x64': 0.27.2
+      '@esbuild/netbsd-arm64': 0.27.2
+      '@esbuild/netbsd-x64': 0.27.2
+      '@esbuild/openbsd-arm64': 0.27.2
+      '@esbuild/openbsd-x64': 0.27.2
+      '@esbuild/openharmony-arm64': 0.27.2
+      '@esbuild/sunos-x64': 0.27.2
+      '@esbuild/win32-arm64': 0.27.2
+      '@esbuild/win32-ia32': 0.27.2
+      '@esbuild/win32-x64': 0.27.2
+
+  escalade@3.2.0: {}
+
+  escape-html@1.0.3: {}
+
+  escape-string-regexp@4.0.0:
+    optional: true
+
+  escape-string-regexp@5.0.0: {}
+
+  esprima@4.0.1: {}
+
+  estree-util-is-identifier-name@3.0.0: {}
+
+  etag@1.8.1: {}
+
+  event-target-shim@5.0.1: {}
+
+  eventemitter3@4.0.7: {}
+
+  eventemitter3@5.0.4: {}
+
+  events@3.3.0: {}
+
+  eventsource-parser@3.0.6: {}
+
+  eventsource@3.0.7:
+    dependencies:
+      eventsource-parser: 3.0.6
+
+  execa@5.1.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      get-stream: 6.0.1
+      human-signals: 2.1.0
+      is-stream: 2.0.1
+      merge-stream: 2.0.0
+      npm-run-path: 4.0.1
+      onetime: 5.1.2
+      signal-exit: 3.0.7
+      strip-final-newline: 2.0.0
+
+  execa@9.6.1:
+    dependencies:
+      '@sindresorhus/merge-streams': 4.0.0
+      cross-spawn: 7.0.6
+      figures: 6.1.0
+      get-stream: 9.0.1
+      human-signals: 8.0.1
+      is-plain-obj: 4.1.0
+      is-stream: 4.0.1
+      npm-run-path: 6.0.0
+      pretty-ms: 9.3.0
+      signal-exit: 4.1.0
+      strip-final-newline: 4.0.0
+      yoctocolors: 2.1.2
+
+  exif-parser@0.1.12: {}
+
+  expand-tilde@2.0.2:
+    dependencies:
+      homedir-polyfill: 1.0.3
+
+  exponential-backoff@3.1.3: {}
+
+  express-rate-limit@8.4.1(express@5.2.1):
+    dependencies:
+      express: 5.2.1
+      ip-address: 10.1.0
+
+  express@5.2.1:
+    dependencies:
+      accepts: 2.0.0
+      body-parser: 2.2.2
+      content-disposition: 1.1.0
+      content-type: 1.0.5
+      cookie: 0.7.2
+      cookie-signature: 1.2.2
+      debug: 4.4.3
+      depd: 2.0.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      finalhandler: 2.1.1
+      fresh: 2.0.0
+      http-errors: 2.0.1
+      merge-descriptors: 2.0.0
+      mime-types: 3.0.2
+      on-finished: 2.4.1
+      once: 1.4.0
+      parseurl: 1.3.3
+      proxy-addr: 2.0.7
+      qs: 6.15.1
+      range-parser: 1.2.1
+      router: 2.2.0
+      send: 1.2.1
+      serve-static: 2.2.1
+      statuses: 2.0.2
+      type-is: 2.0.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  exsolve@1.0.8: {}
+
+  extend@3.0.2: {}
+
+  extract-zip@2.0.1:
+    dependencies:
+      debug: 4.4.3
+      get-stream: 5.2.0
+      yauzl: 2.10.0
+    optionalDependencies:
+      '@types/yauzl': 2.10.3
+    transitivePeerDependencies:
+      - supports-color
+
+  extsprintf@1.4.1:
+    optional: true
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-string-truncated-width@3.0.3: {}
+
+  fast-string-width@3.0.2:
+    dependencies:
+      fast-string-truncated-width: 3.0.3
+
+  fast-uri@3.1.0: {}
+
+  fast-wrap-ansi@0.2.0:
+    dependencies:
+      fast-string-width: 3.0.2
+
+  fast-xml-builder@1.1.3:
+    dependencies:
+      path-expression-matcher: 1.1.3
+
+  fast-xml-parser@5.4.1:
+    dependencies:
+      fast-xml-builder: 1.1.3
+      strnum: 2.2.0
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fd-slicer@1.1.0:
+    dependencies:
+      pend: 1.2.0
+
+  fdir@6.5.0(picomatch@4.0.3):
+    optionalDependencies:
+      picomatch: 4.0.3
+
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
+  fetch-blob@3.2.0:
+    dependencies:
+      node-domexception: 1.0.0
+      web-streams-polyfill: 3.3.3
+
+  figures@6.1.0:
+    dependencies:
+      is-unicode-supported: 2.1.0
+
+  file-type@16.5.4:
+    dependencies:
+      readable-web-to-node-stream: 3.0.4
+      strtok3: 6.3.0
+      token-types: 4.2.1
+
+  filelist@1.0.6:
+    dependencies:
+      minimatch: 5.1.9
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  finalhandler@2.1.1:
+    dependencies:
+      debug: 4.4.3
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      statuses: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  find-babel-config@2.1.2:
+    dependencies:
+      json5: 2.2.3
+
+  find-up@3.0.0:
+    dependencies:
+      locate-path: 3.0.0
+
+  fix-dts-default-cjs-exports@1.0.1:
+    dependencies:
+      magic-string: 0.30.21
+      mlly: 1.8.2
+      rollup: 4.55.1
+
+  follow-redirects@1.15.11: {}
+
+  foreground-child@3.3.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
+  form-data@4.0.5:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.2
+      mime-types: 2.1.35
+
+  formdata-polyfill@4.0.10:
+    dependencies:
+      fetch-blob: 3.2.0
+
+  forwarded-parse@2.1.2: {}
+
+  forwarded@0.2.0: {}
+
+  fraction.js@4.3.7: {}
+
+  framer-motion@12.35.1(react-dom@18.2.0(react@18.2.0))(react@18.2.0):
+    dependencies:
+      motion-dom: 12.35.1
+      motion-utils: 12.29.2
+      tslib: 2.8.1
+    optionalDependencies:
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+
+  fresh@2.0.0: {}
+
+  fs-constants@1.0.0: {}
+
+  fs-extra@10.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 6.2.1
+      universalify: 2.0.1
+
+  fs-extra@11.3.4:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 6.2.1
+      universalify: 2.0.1
+
+  fs-extra@8.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+
+  fs-extra@9.1.0:
+    dependencies:
+      at-least-node: 1.0.0
+      graceful-fs: 4.2.11
+      jsonfile: 6.2.1
+      universalify: 2.0.1
+
+  fs-minipass@2.1.0:
+    dependencies:
+      minipass: 3.3.6
+
+  fs.realpath@1.0.0: {}
+
+  fsevents@2.3.2:
+    optional: true
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  fuzzysort@3.1.0: {}
+
+  gauge@4.0.4:
+    dependencies:
+      aproba: 2.1.0
+      color-support: 1.1.3
+      console-control-strings: 1.1.0
+      has-unicode: 2.0.1
+      signal-exit: 3.0.7
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wide-align: 1.1.5
+
+  generate-function@2.3.1:
+    dependencies:
+      is-property: 1.0.2
+
+  gensync@1.0.0-beta.2: {}
+
+  get-caller-file@2.0.5: {}
+
+  get-east-asian-width@1.5.0: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.2
+      math-intrinsics: 1.1.0
+
+  get-own-enumerable-keys@1.0.0: {}
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.1
+
+  get-stream@5.2.0:
+    dependencies:
+      pump: 3.0.4
+
+  get-stream@6.0.1: {}
+
+  get-stream@9.0.1:
+    dependencies:
+      '@sec-ant/readable-stream': 0.4.1
+      is-stream: 4.0.1
+
+  get-tsconfig@4.13.1:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
+  get-tsconfig@4.13.6:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
+  gifwrap@0.10.1:
+    dependencies:
+      image-q: 4.0.0
+      omggif: 1.0.10
+
+  giget@2.0.0:
+    dependencies:
+      citty: 0.1.6
+      consola: 3.4.2
+      defu: 6.1.4
+      node-fetch-native: 1.6.7
+      nypm: 0.6.5
+      pathe: 2.0.3
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob@10.5.0:
+    dependencies:
+      foreground-child: 3.3.1
+      jackspeak: 3.4.3
+      minimatch: 9.0.9
+      minipass: 7.1.2
+      package-json-from-dist: 1.0.1
+      path-scurry: 1.11.1
+
+  glob@7.2.3:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 3.1.5
+      once: 1.4.0
+      path-is-absolute: 1.0.1
+
+  glob@8.1.0:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 5.1.9
+      once: 1.4.0
+
+  glob@9.3.5:
+    dependencies:
+      fs.realpath: 1.0.0
+      minimatch: 8.0.4
+      minipass: 4.2.8
+      path-scurry: 1.11.1
+
+  global-agent@3.0.0:
+    dependencies:
+      boolean: 3.2.0
+      es6-error: 4.1.1
+      matcher: 3.0.0
+      roarr: 2.15.4
+      semver: 7.7.4
+      serialize-error: 7.0.1
+    optional: true
+
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
+    optional: true
+
+  gopd@1.2.0: {}
+
+  got@11.8.6:
+    dependencies:
+      '@sindresorhus/is': 4.6.0
+      '@szmarczak/http-timer': 4.0.6
+      '@types/cacheable-request': 6.0.3
+      '@types/responselike': 1.0.3
+      cacheable-lookup: 5.0.4
+      cacheable-request: 7.0.4
+      decompress-response: 6.0.0
+      http2-wrapper: 1.0.3
+      lowercase-keys: 2.0.0
+      p-cancelable: 2.1.1
+      responselike: 2.0.1
+
+  graceful-fs@4.2.11: {}
+
+  grammy@1.39.3(encoding@0.1.13):
+    dependencies:
+      '@grammyjs/types': 3.23.0
+      abort-controller: 3.0.0
+      debug: 4.4.3
+      node-fetch: 2.7.0(encoding@0.1.13)
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
+  graphql@16.13.2: {}
+
+  hachure-fill@0.5.2: {}
+
+  has-flag@4.0.0: {}
+
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+    optional: true
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  has-unicode@2.0.1: {}
+
+  hasown@2.0.2:
+    dependencies:
+      function-bind: 1.1.2
+
+  hast-util-from-parse5@8.0.3:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/unist': 3.0.3
+      devlop: 1.1.0
+      hastscript: 9.0.1
+      property-information: 7.1.0
+      vfile: 6.0.3
+      vfile-location: 5.0.3
+      web-namespaces: 2.0.1
+
+  hast-util-parse-selector@4.0.0:
+    dependencies:
+      '@types/hast': 3.0.4
+
+  hast-util-raw@9.1.0:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/unist': 3.0.3
+      '@ungap/structured-clone': 1.3.0
+      hast-util-from-parse5: 8.0.3
+      hast-util-to-parse5: 8.0.1
+      html-void-elements: 3.0.0
+      mdast-util-to-hast: 13.2.1
+      parse5: 7.3.0
+      unist-util-position: 5.0.0
+      unist-util-visit: 5.1.0
+      vfile: 6.0.3
+      web-namespaces: 2.0.1
+      zwitch: 2.0.4
+
+  hast-util-sanitize@5.0.2:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@ungap/structured-clone': 1.3.0
+      unist-util-position: 5.0.0
+
+  hast-util-to-jsx-runtime@2.3.6:
+    dependencies:
+      '@types/estree': 1.0.8
+      '@types/hast': 3.0.4
+      '@types/unist': 3.0.3
+      comma-separated-tokens: 2.0.3
+      devlop: 1.1.0
+      estree-util-is-identifier-name: 3.0.0
+      hast-util-whitespace: 3.0.0
+      mdast-util-mdx-expression: 2.0.1
+      mdast-util-mdx-jsx: 3.2.0
+      mdast-util-mdxjs-esm: 2.0.1
+      property-information: 7.1.0
+      space-separated-tokens: 2.0.2
+      style-to-js: 1.1.21
+      unist-util-position: 5.0.0
+      vfile-message: 4.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  hast-util-to-parse5@8.0.1:
+    dependencies:
+      '@types/hast': 3.0.4
+      comma-separated-tokens: 2.0.3
+      devlop: 1.1.0
+      property-information: 7.1.0
+      space-separated-tokens: 2.0.2
+      web-namespaces: 2.0.1
+      zwitch: 2.0.4
+
+  hast-util-whitespace@3.0.0:
+    dependencies:
+      '@types/hast': 3.0.4
+
+  hastscript@9.0.1:
+    dependencies:
+      '@types/hast': 3.0.4
+      comma-separated-tokens: 2.0.3
+      hast-util-parse-selector: 4.0.0
+      property-information: 7.1.0
+      space-separated-tokens: 2.0.2
+
+  headers-polyfill@5.0.1:
+    dependencies:
+      '@types/set-cookie-parser': 2.4.10
+      set-cookie-parser: 3.1.0
+
+  homedir-polyfill@1.0.3:
+    dependencies:
+      parse-passwd: 1.0.0
+
+  hono-openapi@1.3.0(@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.12))(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6))(@types/json-schema@7.0.15)(hono@4.12.12)(openapi-types@12.1.3):
+    dependencies:
+      '@standard-community/standard-json': 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6)
+      '@standard-community/standard-openapi': 0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6)
+      '@types/json-schema': 7.0.15
+      openapi-types: 12.1.3
+    optionalDependencies:
+      '@hono/standard-validator': 0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.12)
+      hono: 4.12.12
+
+  hono-openapi@1.3.0(@hono/standard-validator@0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.8))(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6))(@types/json-schema@7.0.15)(hono@4.12.8)(openapi-types@12.1.3):
+    dependencies:
+      '@standard-community/standard-json': 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6)
+      '@standard-community/standard-openapi': 0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.11)(zod-to-json-schema@3.25.2(zod@4.3.6))(zod@4.3.6))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@4.3.6)
+      '@types/json-schema': 7.0.15
+      openapi-types: 12.1.3
+    optionalDependencies:
+      '@hono/standard-validator': 0.2.2(@standard-schema/spec@1.1.0)(hono@4.12.8)
+      hono: 4.12.8
+
+  hono-rate-limiter@0.4.2(hono@4.12.8):
+    dependencies:
+      hono: 4.12.8
+
+  hono@4.12.12: {}
+
+  hono@4.12.8: {}
+
+  hosted-git-info@4.1.0:
+    dependencies:
+      lru-cache: 6.0.0
+
+  html-entities@2.3.3: {}
+
+  html-url-attributes@3.0.1: {}
+
+  html-void-elements@3.0.0: {}
+
+  http-cache-semantics@4.2.0: {}
+
+  http-errors@2.0.1:
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      toidentifier: 1.0.1
+
+  http-proxy-agent@5.0.0:
+    dependencies:
+      '@tootallnate/once': 2.0.0
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  http-proxy-agent@7.0.2:
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  http2-wrapper@1.0.3:
+    dependencies:
+      quick-lru: 5.1.1
+      resolve-alpn: 1.2.1
+
+  https-proxy-agent@5.0.1:
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  https-proxy-agent@7.0.6:
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  human-signals@2.1.0: {}
+
+  human-signals@8.0.1: {}
+
+  humanize-ms@1.2.1:
+    dependencies:
+      ms: 2.1.3
+
+  iconv-corefoundation@1.1.7:
+    dependencies:
+      cli-truncate: 2.1.0
+      node-addon-api: 1.7.2
+    optional: true
+
+  iconv-lite@0.6.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  iconv-lite@0.7.2:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  ieee754@1.2.1: {}
+
+  ignore@5.3.2: {}
+
+  image-q@4.0.0:
+    dependencies:
+      '@types/node': 16.9.1
+
+  immediate@3.0.6: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  import-in-the-middle@2.0.6:
+    dependencies:
+      acorn: 8.16.0
+      acorn-import-attributes: 1.9.5(acorn@8.16.0)
+      cjs-module-lexer: 2.2.0
+      module-details-from-path: 1.0.4
+
+  imurmurhash@0.1.4: {}
+
+  indent-string@4.0.0: {}
+
+  infer-owner@1.0.4: {}
+
+  inflight@1.0.6:
+    dependencies:
+      once: 1.4.0
+      wrappy: 1.0.2
+
+  inherits@2.0.4: {}
+
+  inline-style-parser@0.2.7: {}
+
+  internmap@1.0.1: {}
+
+  internmap@2.0.3: {}
+
+  ip-address@10.1.0: {}
+
+  ipaddr.js@1.9.1: {}
+
+  is-alphabetical@2.0.1: {}
+
+  is-alphanumerical@2.0.1:
+    dependencies:
+      is-alphabetical: 2.0.1
+      is-decimal: 2.0.1
+
+  is-arrayish@0.2.1: {}
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.3.0
+
+  is-buffer@2.0.5: {}
+
+  is-ci@3.0.1:
+    dependencies:
+      ci-info: 3.9.0
+
+  is-core-module@2.16.1:
+    dependencies:
+      hasown: 2.0.2
+
+  is-decimal@2.0.1: {}
+
+  is-docker@3.0.0: {}
+
+  is-electron@2.2.2: {}
+
+  is-extglob@2.1.1: {}
+
+  is-fullwidth-code-point@3.0.0: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-hexadecimal@2.0.1: {}
+
+  is-in-ssh@1.0.0: {}
+
+  is-inside-container@1.0.0:
+    dependencies:
+      is-docker: 3.0.0
+
+  is-interactive@1.0.0: {}
+
+  is-interactive@2.0.0: {}
+
+  is-lambda@1.0.1: {}
+
+  is-node-process@1.2.0: {}
+
+  is-number@7.0.0: {}
+
+  is-obj@3.0.0: {}
+
+  is-plain-obj@4.1.0: {}
+
+  is-promise@4.0.0: {}
+
+  is-property@1.0.2: {}
+
+  is-regexp@3.1.0: {}
+
+  is-stream@2.0.1: {}
+
+  is-stream@4.0.1: {}
+
+  is-unicode-supported@0.1.0: {}
+
+  is-unicode-supported@1.3.0: {}
+
+  is-unicode-supported@2.1.0: {}
+
+  is-what@4.1.16: {}
+
+  is-wsl@3.1.1:
+    dependencies:
+      is-inside-container: 1.0.0
+
+  isarray@1.0.0: {}
+
+  isbinaryfile@4.0.10: {}
+
+  isbinaryfile@5.0.7: {}
+
+  isexe@2.0.0: {}
+
+  isexe@3.1.5: {}
+
+  isomorphic-ws@5.0.0(ws@8.19.0):
+    dependencies:
+      ws: 8.19.0
+
+  isomorphic.js@0.2.5: {}
+
+  jackspeak@3.4.3:
+    dependencies:
+      '@isaacs/cliui': 8.0.2
+    optionalDependencies:
+      '@pkgjs/parseargs': 0.11.0
+
+  jake@10.9.4:
+    dependencies:
+      async: 3.2.6
+      filelist: 1.0.6
+      picocolors: 1.1.1
+
+  jimp@1.6.0:
+    dependencies:
+      '@jimp/core': 1.6.0
+      '@jimp/diff': 1.6.0
+      '@jimp/js-bmp': 1.6.0
+      '@jimp/js-gif': 1.6.0
+      '@jimp/js-jpeg': 1.6.0
+      '@jimp/js-png': 1.6.0
+      '@jimp/js-tiff': 1.6.0
+      '@jimp/plugin-blit': 1.6.0
+      '@jimp/plugin-blur': 1.6.0
+      '@jimp/plugin-circle': 1.6.0
+      '@jimp/plugin-color': 1.6.0
+      '@jimp/plugin-contain': 1.6.0
+      '@jimp/plugin-cover': 1.6.0
+      '@jimp/plugin-crop': 1.6.0
+      '@jimp/plugin-displace': 1.6.0
+      '@jimp/plugin-dither': 1.6.0
+      '@jimp/plugin-fisheye': 1.6.0
+      '@jimp/plugin-flip': 1.6.0
+      '@jimp/plugin-hash': 1.6.0
+      '@jimp/plugin-mask': 1.6.0
+      '@jimp/plugin-print': 1.6.0
+      '@jimp/plugin-quantize': 1.6.0
+      '@jimp/plugin-resize': 1.6.0
+      '@jimp/plugin-rotate': 1.6.0
+      '@jimp/plugin-threshold': 1.6.0
+      '@jimp/types': 1.6.0
+      '@jimp/utils': 1.6.0
+
+  jiti@1.21.7: {}
+
+  jiti@2.6.1: {}
+
+  jose@6.1.3: {}
+
+  joycon@3.1.1: {}
+
+  jpeg-js@0.4.4: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json-buffer@3.0.1: {}
+
+  json-parse-even-better-errors@2.3.1: {}
+
+  json-schema-traverse@0.4.1: {}
+
+  json-schema-traverse@1.0.0: {}
+
+  json-schema-typed@8.0.2: {}
+
+  json-schema@0.4.0: {}
+
+  json-stringify-safe@5.0.1:
+    optional: true
+
+  json5@2.2.3: {}
+
+  jsonc-parser@3.3.1: {}
+
+  jsonfile@4.0.0:
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
+  jsonfile@6.2.1:
+    dependencies:
+      universalify: 2.0.1
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
+  jszip@3.10.1:
+    dependencies:
+      lie: 3.3.0
+      pako: 1.0.11
+      readable-stream: 2.3.8
+      setimmediate: 1.0.5
+
+  katex@0.16.45:
+    dependencies:
+      commander: 8.3.0
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  khroma@2.1.0: {}
+
+  kleur@3.0.3: {}
+
+  kleur@4.1.5: {}
+
+  kysely@0.28.15: {}
+
+  langium@4.2.1:
+    dependencies:
+      chevrotain: 11.1.2
+      chevrotain-allstar: 0.3.1(chevrotain@11.1.2)
+      vscode-languageserver: 9.0.1
+      vscode-languageserver-textdocument: 1.0.12
+      vscode-uri: 3.1.0
+
+  layout-base@1.0.2: {}
+
+  layout-base@2.0.1: {}
+
+  lazy-val@1.0.5: {}
+
+  lazystream@1.0.1:
+    dependencies:
+      readable-stream: 2.3.8
+
+  lexical@0.35.0: {}
+
+  lib0@0.2.117:
+    dependencies:
+      isomorphic.js: 0.2.5
+
+  lie@3.3.0:
+    dependencies:
+      immediate: 3.0.6
+
+  lightningcss-android-arm64@1.30.2:
+    optional: true
+
+  lightningcss-darwin-arm64@1.30.2:
+    optional: true
+
+  lightningcss-darwin-x64@1.30.2:
+    optional: true
+
+  lightningcss-freebsd-x64@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm-gnueabihf@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm64-gnu@1.30.2:
+    optional: true
+
+  lightningcss-linux-arm64-musl@1.30.2:
+    optional: true
+
+  lightningcss-linux-x64-gnu@1.30.2:
+    optional: true
+
+  lightningcss-linux-x64-musl@1.30.2:
+    optional: true
+
+  lightningcss-win32-arm64-msvc@1.30.2:
+    optional: true
+
+  lightningcss-win32-x64-msvc@1.30.2:
+    optional: true
+
+  lightningcss@1.30.2:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.30.2
+      lightningcss-darwin-arm64: 1.30.2
+      lightningcss-darwin-x64: 1.30.2
+      lightningcss-freebsd-x64: 1.30.2
+      lightningcss-linux-arm-gnueabihf: 1.30.2
+      lightningcss-linux-arm64-gnu: 1.30.2
+      lightningcss-linux-arm64-musl: 1.30.2
+      lightningcss-linux-x64-gnu: 1.30.2
+      lightningcss-linux-x64-musl: 1.30.2
+      lightningcss-win32-arm64-msvc: 1.30.2
+      lightningcss-win32-x64-msvc: 1.30.2
+
+  lilconfig@2.1.0: {}
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  load-tsconfig@0.2.5: {}
+
+  locate-path@3.0.0:
+    dependencies:
+      p-locate: 3.0.0
+      path-exists: 3.0.0
+
+  lodash-es@4.17.23: {}
+
+  lodash-es@4.18.1: {}
+
+  lodash.camelcase@4.3.0: {}
+
+  lodash.defaults@4.2.0: {}
+
+  lodash.difference@4.5.0: {}
+
+  lodash.escaperegexp@4.1.2: {}
+
+  lodash.flatten@4.4.0: {}
+
+  lodash.isequal@4.5.0: {}
+
+  lodash.isplainobject@4.0.6: {}
+
+  lodash.union@4.6.0: {}
+
+  lodash@4.18.1: {}
+
+  log-symbols@4.1.0:
+    dependencies:
+      chalk: 4.1.2
+      is-unicode-supported: 0.1.0
+
+  log-symbols@6.0.0:
+    dependencies:
+      chalk: 5.6.2
+      is-unicode-supported: 1.3.0
+
+  long@5.3.2: {}
+
+  longest-streak@3.1.0: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  lowercase-keys@2.0.0: {}
+
+  lru-cache@10.4.3: {}
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  lru-cache@6.0.0:
+    dependencies:
+      yallist: 4.0.0
+
+  lru-cache@7.18.3: {}
+
+  lru.min@1.1.4: {}
+
+  lucide-react@0.577.0(react@18.2.0):
+    dependencies:
+      react: 18.2.0
+
+  lucide-react@0.577.0(react@19.2.4):
+    dependencies:
+      react: 19.2.4
+
+  lucide-solid@0.562.0(solid-js@1.9.9):
+    dependencies:
+      solid-js: 1.9.9
+
+  luxon@3.7.2: {}
+
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  make-fetch-happen@10.2.1:
+    dependencies:
+      agentkeepalive: 4.6.0
+      cacache: 16.1.3
+      http-cache-semantics: 4.2.0
+      http-proxy-agent: 5.0.0
+      https-proxy-agent: 5.0.1
+      is-lambda: 1.0.1
+      lru-cache: 7.18.3
+      minipass: 3.3.6
+      minipass-collect: 1.0.2
+      minipass-fetch: 2.1.2
+      minipass-flush: 1.0.7
+      minipass-pipeline: 1.2.4
+      negotiator: 0.6.4
+      promise-retry: 2.0.1
+      socks-proxy-agent: 7.0.0
+      ssri: 9.0.1
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
+  markdown-table@3.0.4: {}
+
+  marked@16.4.2: {}
+
+  marked@17.0.1: {}
+
+  matcher@3.0.0:
+    dependencies:
+      escape-string-regexp: 4.0.0
+    optional: true
+
+  math-intrinsics@1.1.0: {}
+
+  mdast-util-find-and-replace@3.0.2:
+    dependencies:
+      '@types/mdast': 4.0.4
+      escape-string-regexp: 5.0.0
+      unist-util-is: 6.0.1
+      unist-util-visit-parents: 6.0.2
+
+  mdast-util-from-markdown@2.0.3:
+    dependencies:
+      '@types/mdast': 4.0.4
+      '@types/unist': 3.0.3
+      decode-named-character-reference: 1.3.0
+      devlop: 1.1.0
+      mdast-util-to-string: 4.0.0
+      micromark: 4.0.2
+      micromark-util-decode-numeric-character-reference: 2.0.2
+      micromark-util-decode-string: 2.0.1
+      micromark-util-normalize-identifier: 2.0.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+      unist-util-stringify-position: 4.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-gfm-autolink-literal@2.0.1:
+    dependencies:
+      '@types/mdast': 4.0.4
+      ccount: 2.0.1
+      devlop: 1.1.0
+      mdast-util-find-and-replace: 3.0.2
+      micromark-util-character: 2.1.1
+
+  mdast-util-gfm-footnote@2.1.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      devlop: 1.1.0
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+      micromark-util-normalize-identifier: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-gfm-strikethrough@2.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-gfm-table@2.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      devlop: 1.1.0
+      markdown-table: 3.0.4
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-gfm-task-list-item@2.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      devlop: 1.1.0
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-gfm@3.1.0:
+    dependencies:
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-gfm-autolink-literal: 2.0.1
+      mdast-util-gfm-footnote: 2.1.0
+      mdast-util-gfm-strikethrough: 2.0.0
+      mdast-util-gfm-table: 2.0.0
+      mdast-util-gfm-task-list-item: 2.0.0
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-mdx-expression@2.0.1:
+    dependencies:
+      '@types/estree-jsx': 1.0.5
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      devlop: 1.1.0
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-mdx-jsx@3.2.0:
+    dependencies:
+      '@types/estree-jsx': 1.0.5
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      '@types/unist': 3.0.3
+      ccount: 2.0.1
+      devlop: 1.1.0
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+      parse-entities: 4.0.2
+      stringify-entities: 4.0.4
+      unist-util-stringify-position: 4.0.0
+      vfile-message: 4.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-mdxjs-esm@2.0.1:
+    dependencies:
+      '@types/estree-jsx': 1.0.5
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      devlop: 1.1.0
+      mdast-util-from-markdown: 2.0.3
+      mdast-util-to-markdown: 2.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  mdast-util-phrasing@4.1.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      unist-util-is: 6.0.1
+
+  mdast-util-to-hast@13.2.1:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      '@ungap/structured-clone': 1.3.0
+      devlop: 1.1.0
+      micromark-util-sanitize-uri: 2.0.1
+      trim-lines: 3.0.1
+      unist-util-position: 5.0.0
+      unist-util-visit: 5.1.0
+      vfile: 6.0.3
+
+  mdast-util-to-markdown@2.1.2:
+    dependencies:
+      '@types/mdast': 4.0.4
+      '@types/unist': 3.0.3
+      longest-streak: 3.1.0
+      mdast-util-phrasing: 4.1.0
+      mdast-util-to-string: 4.0.0
+      micromark-util-classify-character: 2.0.1
+      micromark-util-decode-string: 2.0.1
+      unist-util-visit: 5.1.0
+      zwitch: 2.0.4
+
+  mdast-util-to-string@4.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+
+  media-typer@1.1.0: {}
+
+  merge-anything@5.1.7:
+    dependencies:
+      is-what: 4.1.16
+
+  merge-descriptors@2.0.0: {}
+
+  merge-stream@2.0.0: {}
+
+  merge2@1.4.1: {}
+
+  mermaid@11.14.0:
+    dependencies:
+      '@braintree/sanitize-url': 7.1.2
+      '@iconify/utils': 3.1.0
+      '@mermaid-js/parser': 1.1.0
+      '@types/d3': 7.4.3
+      '@upsetjs/venn.js': 2.0.0
+      cytoscape: 3.33.1
+      cytoscape-cose-bilkent: 4.1.0(cytoscape@3.33.1)
+      cytoscape-fcose: 2.2.0(cytoscape@3.33.1)
+      d3: 7.9.0
+      d3-sankey: 0.12.3
+      dagre-d3-es: 7.0.14
+      dayjs: 1.11.20
+      dompurify: 3.3.3
+      katex: 0.16.45
+      khroma: 2.1.0
+      lodash-es: 4.18.1
+      marked: 16.4.2
+      roughjs: 4.6.6
+      stylis: 4.3.6
+      ts-dedent: 2.2.0
+      uuid: 11.1.0
+
+  micromark-core-commonmark@2.0.3:
+    dependencies:
+      decode-named-character-reference: 1.3.0
+      devlop: 1.1.0
+      micromark-factory-destination: 2.0.1
+      micromark-factory-label: 2.0.1
+      micromark-factory-space: 2.0.1
+      micromark-factory-title: 2.0.1
+      micromark-factory-whitespace: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-chunked: 2.0.1
+      micromark-util-classify-character: 2.0.1
+      micromark-util-html-tag-name: 2.0.1
+      micromark-util-normalize-identifier: 2.0.1
+      micromark-util-resolve-all: 2.0.1
+      micromark-util-subtokenize: 2.1.0
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-autolink-literal@2.1.0:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-sanitize-uri: 2.0.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-footnote@2.1.0:
+    dependencies:
+      devlop: 1.1.0
+      micromark-core-commonmark: 2.0.3
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-normalize-identifier: 2.0.1
+      micromark-util-sanitize-uri: 2.0.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-strikethrough@2.1.0:
+    dependencies:
+      devlop: 1.1.0
+      micromark-util-chunked: 2.0.1
+      micromark-util-classify-character: 2.0.1
+      micromark-util-resolve-all: 2.0.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-table@2.1.1:
+    dependencies:
+      devlop: 1.1.0
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-tagfilter@2.0.0:
+    dependencies:
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm-task-list-item@2.1.0:
+    dependencies:
+      devlop: 1.1.0
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-extension-gfm@3.0.0:
+    dependencies:
+      micromark-extension-gfm-autolink-literal: 2.1.0
+      micromark-extension-gfm-footnote: 2.1.0
+      micromark-extension-gfm-strikethrough: 2.1.0
+      micromark-extension-gfm-table: 2.1.1
+      micromark-extension-gfm-tagfilter: 2.0.0
+      micromark-extension-gfm-task-list-item: 2.1.0
+      micromark-util-combine-extensions: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-factory-destination@2.0.1:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-factory-label@2.0.1:
+    dependencies:
+      devlop: 1.1.0
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-factory-space@2.0.1:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-types: 2.0.2
+
+  micromark-factory-title@2.0.1:
+    dependencies:
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-factory-whitespace@2.0.1:
+    dependencies:
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-character@2.1.1:
+    dependencies:
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-chunked@2.0.1:
+    dependencies:
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-classify-character@2.0.1:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-combine-extensions@2.0.1:
+    dependencies:
+      micromark-util-chunked: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-decode-numeric-character-reference@2.0.2:
+    dependencies:
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-decode-string@2.0.1:
+    dependencies:
+      decode-named-character-reference: 1.3.0
+      micromark-util-character: 2.1.1
+      micromark-util-decode-numeric-character-reference: 2.0.2
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-encode@2.0.1: {}
+
+  micromark-util-html-tag-name@2.0.1: {}
+
+  micromark-util-normalize-identifier@2.0.1:
+    dependencies:
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-resolve-all@2.0.1:
+    dependencies:
+      micromark-util-types: 2.0.2
+
+  micromark-util-sanitize-uri@2.0.1:
+    dependencies:
+      micromark-util-character: 2.1.1
+      micromark-util-encode: 2.0.1
+      micromark-util-symbol: 2.0.1
+
+  micromark-util-subtokenize@2.1.0:
+    dependencies:
+      devlop: 1.1.0
+      micromark-util-chunked: 2.0.1
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+
+  micromark-util-symbol@2.0.1: {}
+
+  micromark-util-types@2.0.2: {}
+
+  micromark@4.0.2:
+    dependencies:
+      '@types/debug': 4.1.13
+      debug: 4.4.3
+      decode-named-character-reference: 1.3.0
+      devlop: 1.1.0
+      micromark-core-commonmark: 2.0.3
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-chunked: 2.0.1
+      micromark-util-combine-extensions: 2.0.1
+      micromark-util-decode-numeric-character-reference: 2.0.2
+      micromark-util-encode: 2.0.1
+      micromark-util-normalize-identifier: 2.0.1
+      micromark-util-resolve-all: 2.0.1
+      micromark-util-sanitize-uri: 2.0.1
+      micromark-util-subtokenize: 2.1.0
+      micromark-util-symbol: 2.0.1
+      micromark-util-types: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
+  mime-db@1.52.0: {}
+
+  mime-db@1.54.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
+  mime-types@3.0.2:
+    dependencies:
+      mime-db: 1.54.0
+
+  mime@2.6.0: {}
+
+  mime@3.0.0: {}
+
+  mimic-fn@2.1.0: {}
+
+  mimic-function@5.0.1: {}
+
+  mimic-response@1.0.1: {}
+
+  mimic-response@3.1.0: {}
+
+  minimatch@10.1.1:
+    dependencies:
+      '@isaacs/brace-expansion': 5.0.0
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.14
+
+  minimatch@5.1.9:
+    dependencies:
+      brace-expansion: 2.0.2
+
+  minimatch@8.0.4:
+    dependencies:
+      brace-expansion: 2.0.2
+
+  minimatch@9.0.9:
+    dependencies:
+      brace-expansion: 2.0.2
+
+  minimist@1.2.8: {}
+
+  minipass-collect@1.0.2:
+    dependencies:
+      minipass: 3.3.6
+
+  minipass-fetch@2.1.2:
+    dependencies:
+      minipass: 3.3.6
+      minipass-sized: 1.0.3
+      minizlib: 2.1.2
+    optionalDependencies:
+      encoding: 0.1.13
+
+  minipass-flush@1.0.7:
+    dependencies:
+      minipass: 3.3.6
+
+  minipass-pipeline@1.2.4:
+    dependencies:
+      minipass: 3.3.6
+
+  minipass-sized@1.0.3:
+    dependencies:
+      minipass: 3.3.6
+
+  minipass@3.3.6:
+    dependencies:
+      yallist: 4.0.0
+
+  minipass@4.2.8: {}
+
+  minipass@5.0.0: {}
+
+  minipass@7.1.2: {}
+
+  minizlib@2.1.2:
+    dependencies:
+      minipass: 3.3.6
+      yallist: 4.0.0
+
+  minizlib@3.1.0:
+    dependencies:
+      minipass: 7.1.2
+
+  mkdirp@0.5.6:
+    dependencies:
+      minimist: 1.2.8
+
+  mkdirp@1.0.4: {}
+
+  mlly@1.8.2:
+    dependencies:
+      acorn: 8.16.0
+      pathe: 2.0.3
+      pkg-types: 1.3.1
+      ufo: 1.6.3
+
+  module-details-from-path@1.0.4: {}
+
+  motion-dom@12.35.1:
+    dependencies:
+      motion-utils: 12.29.2
+
+  motion-utils@12.29.2: {}
+
+  ms@2.1.3: {}
+
+  msw@2.14.3(@types/node@25.6.0)(typescript@5.9.3):
+    dependencies:
+      '@inquirer/confirm': 6.0.12(@types/node@25.6.0)
+      '@mswjs/interceptors': 0.41.8
+      '@open-draft/deferred-promise': 3.0.0
+      '@types/statuses': 2.0.6
+      cookie: 1.1.1
+      graphql: 16.13.2
+      headers-polyfill: 5.0.1
+      is-node-process: 1.2.0
+      outvariant: 1.4.3
+      path-to-regexp: 6.3.0
+      picocolors: 1.1.1
+      rettime: 0.11.11
+      statuses: 2.0.2
+      strict-event-emitter: 0.5.1
+      tough-cookie: 6.0.1
+      type-fest: 5.6.0
+      until-async: 3.0.2
+      yargs: 17.7.2
+    optionalDependencies:
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - '@types/node'
+
+  mute-stream@3.0.0: {}
+
+  mysql2@3.17.4:
+    dependencies:
+      aws-ssl-profiles: 1.1.2
+      denque: 2.1.0
+      generate-function: 2.3.1
+      iconv-lite: 0.7.2
+      long: 5.3.2
+      lru.min: 1.1.4
+      named-placeholders: 1.1.6
+      sql-escaper: 1.3.3
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  named-placeholders@1.1.6:
+    dependencies:
+      lru.min: 1.1.4
+
+  nanoid@3.3.11: {}
+
+  nanostores@1.2.0: {}
+
+  negotiator@0.6.4: {}
+
+  negotiator@1.0.0: {}
+
+  next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@18.2.0(react@18.2.0))(react@18.2.0):
+    dependencies:
+      '@next/env': 14.2.35
+      '@swc/helpers': 0.5.5
+      busboy: 1.6.0
+      caniuse-lite: 1.0.30001764
+      graceful-fs: 4.2.11
+      postcss: 8.4.31
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+      styled-jsx: 5.1.1(react@18.2.0)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 14.2.33
+      '@next/swc-darwin-x64': 14.2.33
+      '@next/swc-linux-arm64-gnu': 14.2.33
+      '@next/swc-linux-arm64-musl': 14.2.33
+      '@next/swc-linux-x64-gnu': 14.2.33
+      '@next/swc-linux-x64-musl': 14.2.33
+      '@next/swc-win32-arm64-msvc': 14.2.33
+      '@next/swc-win32-ia32-msvc': 14.2.33
+      '@next/swc-win32-x64-msvc': 14.2.33
+      '@opentelemetry/api': 1.9.0
+      '@playwright/test': 1.58.2
+    transitivePeerDependencies:
+      - '@babel/core'
+      - babel-plugin-macros
+
+  next@16.1.6(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      '@next/env': 16.1.6
+      '@swc/helpers': 0.5.15
+      baseline-browser-mapping: 2.9.14
+      caniuse-lite: 1.0.30001764
+      postcss: 8.4.31
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      styled-jsx: 5.1.6(react@19.2.4)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 16.1.6
+      '@next/swc-darwin-x64': 16.1.6
+      '@next/swc-linux-arm64-gnu': 16.1.6
+      '@next/swc-linux-arm64-musl': 16.1.6
+      '@next/swc-linux-x64-gnu': 16.1.6
+      '@next/swc-linux-x64-musl': 16.1.6
+      '@next/swc-win32-arm64-msvc': 16.1.6
+      '@next/swc-win32-x64-msvc': 16.1.6
+      '@opentelemetry/api': 1.9.0
+      '@playwright/test': 1.58.2
+      sharp: 0.34.5
+    transitivePeerDependencies:
+      - '@babel/core'
+      - babel-plugin-macros
+
+  next@16.2.1(@opentelemetry/api@1.9.0)(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      '@next/env': 16.2.1
+      '@swc/helpers': 0.5.15
+      baseline-browser-mapping: 2.10.11
+      caniuse-lite: 1.0.30001764
+      postcss: 8.4.31
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      styled-jsx: 5.1.6(react@19.2.4)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 16.2.1
+      '@next/swc-darwin-x64': 16.2.1
+      '@next/swc-linux-arm64-gnu': 16.2.1
+      '@next/swc-linux-arm64-musl': 16.2.1
+      '@next/swc-linux-x64-gnu': 16.2.1
+      '@next/swc-linux-x64-musl': 16.2.1
+      '@next/swc-win32-arm64-msvc': 16.2.1
+      '@next/swc-win32-x64-msvc': 16.2.1
+      '@opentelemetry/api': 1.9.0
+      '@playwright/test': 1.58.2
+      sharp: 0.34.5
+    transitivePeerDependencies:
+      - '@babel/core'
+      - babel-plugin-macros
+
+  node-abi@3.89.0:
+    dependencies:
+      semver: 7.7.4
+
+  node-addon-api@1.7.2:
+    optional: true
+
+  node-api-version@0.2.1:
+    dependencies:
+      semver: 7.7.4
+
+  node-domexception@1.0.0: {}
+
+  node-fetch-native@1.6.7: {}
+
+  node-fetch@2.7.0(encoding@0.1.13):
+    dependencies:
+      whatwg-url: 5.0.0
+    optionalDependencies:
+      encoding: 0.1.13
+
+  node-fetch@3.3.2:
+    dependencies:
+      data-uri-to-buffer: 4.0.1
+      fetch-blob: 3.2.0
+      formdata-polyfill: 4.0.10
+
+  node-gyp@9.4.1:
+    dependencies:
+      env-paths: 2.2.1
+      exponential-backoff: 3.1.3
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      make-fetch-happen: 10.2.1
+      nopt: 6.0.0
+      npmlog: 6.0.2
+      rimraf: 3.0.2
+      semver: 7.7.4
+      tar: 6.2.1
+      which: 2.0.2
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
+  node-releases@2.0.27: {}
+
+  nopt@6.0.0:
+    dependencies:
+      abbrev: 1.1.1
+
+  normalize-path@3.0.0: {}
+
+  normalize-range@0.1.2: {}
+
+  normalize-url@6.1.0: {}
+
+  npm-run-path@4.0.1:
+    dependencies:
+      path-key: 3.1.1
+
+  npm-run-path@6.0.0:
+    dependencies:
+      path-key: 4.0.0
+      unicorn-magic: 0.3.0
+
+  npmlog@6.0.2:
+    dependencies:
+      are-we-there-yet: 3.0.1
+      console-control-strings: 1.1.0
+      gauge: 4.0.4
+      set-blocking: 2.0.0
+
+  nypm@0.6.5:
+    dependencies:
+      citty: 0.2.2
+      pathe: 2.0.3
+      tinyexec: 1.0.4
+
+  object-assign@4.1.1: {}
+
+  object-hash@3.0.0: {}
+
+  object-inspect@1.13.4: {}
+
+  object-keys@1.1.1:
+    optional: true
+
+  object-treeify@1.1.33: {}
+
+  ohash@2.0.11: {}
+
+  omggif@1.0.10: {}
+
+  on-exit-leak-free@2.1.2: {}
+
+  on-finished@2.4.1:
+    dependencies:
+      ee-first: 1.1.1
+
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
+  onetime@5.1.2:
+    dependencies:
+      mimic-fn: 2.1.0
+
+  onetime@7.0.0:
+    dependencies:
+      mimic-function: 5.0.1
+
+  open@11.0.0:
+    dependencies:
+      default-browser: 5.5.0
+      define-lazy-prop: 3.0.0
+      is-in-ssh: 1.0.0
+      is-inside-container: 1.0.0
+      powershell-utils: 0.1.0
+      wsl-utils: 0.3.1
+
+  openapi-types@12.1.3: {}
+
+  ora@5.4.1:
+    dependencies:
+      bl: 4.1.0
+      chalk: 4.1.2
+      cli-cursor: 3.1.0
+      cli-spinners: 2.9.2
+      is-interactive: 1.0.0
+      is-unicode-supported: 0.1.0
+      log-symbols: 4.1.0
+      strip-ansi: 6.0.1
+      wcwidth: 1.0.1
+
+  ora@8.2.0:
+    dependencies:
+      chalk: 5.6.2
+      cli-cursor: 5.0.0
+      cli-spinners: 2.9.2
+      is-interactive: 2.0.0
+      is-unicode-supported: 2.1.0
+      log-symbols: 6.0.0
+      stdin-discarder: 0.2.2
+      string-width: 7.2.0
+      strip-ansi: 7.2.0
+
+  outvariant@1.4.3: {}
+
+  p-cancelable@2.1.1: {}
+
+  p-finally@1.0.0: {}
+
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-locate@3.0.0:
+    dependencies:
+      p-limit: 2.3.0
+
+  p-map@4.0.0:
+    dependencies:
+      aggregate-error: 3.1.0
+
+  p-queue@6.6.2:
+    dependencies:
+      eventemitter3: 4.0.7
+      p-timeout: 3.2.0
+
+  p-retry@4.6.2:
+    dependencies:
+      '@types/retry': 0.12.0
+      retry: 0.13.1
+
+  p-timeout@3.2.0:
+    dependencies:
+      p-finally: 1.0.0
+
+  p-try@2.2.0: {}
+
+  package-json-from-dist@1.0.1: {}
+
+  package-manager-detector@1.6.0: {}
+
+  pako@1.0.11: {}
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  parse-bmfont-ascii@1.0.6: {}
+
+  parse-bmfont-binary@1.0.6: {}
+
+  parse-bmfont-xml@1.1.6:
+    dependencies:
+      xml-parse-from-string: 1.0.1
+      xml2js: 0.5.0
+
+  parse-entities@4.0.2:
+    dependencies:
+      '@types/unist': 2.0.11
+      character-entities-legacy: 3.0.0
+      character-reference-invalid: 2.0.1
+      decode-named-character-reference: 1.3.0
+      is-alphanumerical: 2.0.1
+      is-decimal: 2.0.1
+      is-hexadecimal: 2.0.1
+
+  parse-json@5.2.0:
+    dependencies:
+      '@babel/code-frame': 7.29.0
+      error-ex: 1.3.4
+      json-parse-even-better-errors: 2.3.1
+      lines-and-columns: 1.2.4
+
+  parse-ms@4.0.0: {}
+
+  parse-passwd@1.0.0: {}
+
+  parse5@7.3.0:
+    dependencies:
+      entities: 6.0.1
+
+  parseurl@1.3.3: {}
+
+  path-browserify@1.0.1: {}
+
+  path-data-parser@0.1.0: {}
+
+  path-exists@3.0.0: {}
+
+  path-expression-matcher@1.1.3: {}
+
+  path-is-absolute@1.0.1: {}
+
+  path-key@3.1.1: {}
+
+  path-key@4.0.0: {}
+
+  path-parse@1.0.7: {}
+
+  path-scurry@1.11.1:
+    dependencies:
+      lru-cache: 10.4.3
+      minipass: 7.1.2
+
+  path-to-regexp@6.3.0: {}
+
+  path-to-regexp@8.4.2: {}
+
+  pathe@2.0.3: {}
+
+  pe-library@0.4.1: {}
+
+  peek-readable@4.1.0: {}
+
+  pend@1.2.0: {}
+
+  perfect-debounce@2.1.0: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.1: {}
+
+  picomatch@4.0.3: {}
+
+  picomatch@4.0.4: {}
+
+  pify@2.3.0: {}
+
+  pino-abstract-transport@2.0.0:
+    dependencies:
+      split2: 4.2.0
+
+  pino-std-serializers@7.1.0: {}
+
+  pino@9.14.0:
+    dependencies:
+      '@pinojs/redact': 0.4.0
+      atomic-sleep: 1.0.0
+      on-exit-leak-free: 2.1.2
+      pino-abstract-transport: 2.0.0
+      pino-std-serializers: 7.1.0
+      process-warning: 5.0.0
+      quick-format-unescaped: 4.0.4
+      real-require: 0.2.0
+      safe-stable-stringify: 2.5.0
+      sonic-boom: 4.2.0
+      thread-stream: 3.1.0
+
+  pirates@4.0.7: {}
+
+  pixelmatch@5.3.0:
+    dependencies:
+      pngjs: 6.0.0
+
+  pkce-challenge@5.0.1: {}
+
+  pkg-types@1.3.1:
+    dependencies:
+      confbox: 0.1.8
+      mlly: 1.8.2
+      pathe: 2.0.3
+
+  pkg-types@2.3.0:
+    dependencies:
+      confbox: 0.2.4
+      exsolve: 1.0.8
+      pathe: 2.0.3
+
+  pkg-up@3.1.0:
+    dependencies:
+      find-up: 3.0.0
+
+  planck@1.4.2(stage-js@1.0.0-alpha.17):
+    dependencies:
+      stage-js: 1.0.0-alpha.17
+    optional: true
+
+  playwright-core@1.58.2: {}
+
+  playwright@1.58.2:
+    dependencies:
+      playwright-core: 1.58.2
+    optionalDependencies:
+      fsevents: 2.3.2
+
+  plist@3.1.0:
+    dependencies:
+      '@xmldom/xmldom': 0.8.13
+      base64-js: 1.5.1
+      xmlbuilder: 15.1.1
+
+  pngjs@6.0.0: {}
+
+  pngjs@7.0.0: {}
+
+  points-on-curve@0.2.0: {}
+
+  points-on-path@0.2.1:
+    dependencies:
+      path-data-parser: 0.1.0
+      points-on-curve: 0.2.0
+
+  postcss-import@15.1.0(postcss@8.4.38):
+    dependencies:
+      postcss: 8.4.38
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.0
+      resolve: 1.22.11
+
+  postcss-js@4.1.0(postcss@8.4.38):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.4.38
+
+  postcss-load-config@4.0.2(postcss@8.4.38):
+    dependencies:
+      lilconfig: 3.1.3
+      yaml: 2.8.2
+    optionalDependencies:
+      postcss: 8.4.38
+
+  postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(yaml@2.8.2):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 2.6.1
+      postcss: 8.5.6
+      tsx: 4.21.0
+      yaml: 2.8.2
+
+  postcss-nested@6.2.0(postcss@8.4.38):
+    dependencies:
+      postcss: 8.4.38
+      postcss-selector-parser: 6.1.2
+
+  postcss-selector-parser@6.1.2:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-selector-parser@7.1.1:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.4.31:
+    dependencies:
+      nanoid: 3.3.11
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  postcss@8.4.38:
+    dependencies:
+      nanoid: 3.3.11
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  postcss@8.5.6:
+    dependencies:
+      nanoid: 3.3.11
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  powershell-utils@0.1.0: {}
+
+  pretty-ms@9.3.0:
+    dependencies:
+      parse-ms: 4.0.0
+
+  prismjs@1.30.0: {}
+
+  process-nextick-args@2.0.1: {}
+
+  process-warning@5.0.0: {}
+
+  process@0.11.10: {}
+
+  progress@2.0.3: {}
+
+  promise-inflight@1.0.1: {}
+
+  promise-retry@2.0.1:
+    dependencies:
+      err-code: 2.0.3
+      retry: 0.12.0
+
+  prompts@2.4.2:
+    dependencies:
+      kleur: 3.0.3
+      sisteransi: 1.0.5
+
+  property-information@7.1.0: {}
+
+  protobufjs@7.5.4:
+    dependencies:
+      '@protobufjs/aspromise': 1.1.2
+      '@protobufjs/base64': 1.1.2
+      '@protobufjs/codegen': 2.0.4
+      '@protobufjs/eventemitter': 1.1.0
+      '@protobufjs/fetch': 1.1.0
+      '@protobufjs/float': 1.0.2
+      '@protobufjs/inquire': 1.1.0
+      '@protobufjs/path': 1.1.2
+      '@protobufjs/pool': 1.1.0
+      '@protobufjs/utf8': 1.1.0
+      '@types/node': 25.6.0
+      long: 5.3.2
+
+  proxy-addr@2.0.7:
+    dependencies:
+      forwarded: 0.2.0
+      ipaddr.js: 1.9.1
+
+  proxy-from-env@1.1.0: {}
+
+  pump@3.0.4:
+    dependencies:
+      end-of-stream: 1.4.5
+      once: 1.4.0
+
+  punycode@2.3.1: {}
+
+  qs@6.15.1:
+    dependencies:
+      side-channel: 1.1.0
+
+  quansync@0.2.11: {}
+
+  queue-microtask@1.2.3: {}
+
+  quick-format-unescaped@4.0.4: {}
+
+  quick-lru@5.1.1: {}
+
+  range-parser@1.2.1: {}
+
+  raw-body@3.0.2:
+    dependencies:
+      bytes: 3.1.2
+      http-errors: 2.0.1
+      iconv-lite: 0.7.2
+      unpipe: 1.0.0
+
+  rc9@2.1.2:
+    dependencies:
+      defu: 6.1.4
+      destr: 2.0.5
+
+  react-dom@18.2.0(react@18.2.0):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.2.0
+      scheduler: 0.23.2
+
+  react-dom@19.2.4(react@19.2.4):
+    dependencies:
+      react: 19.2.4
+      scheduler: 0.27.0
+
+  react-error-boundary@3.1.4(react@19.2.4):
+    dependencies:
+      '@babel/runtime': 7.29.2
+      react: 19.2.4
+
+  react-markdown@10.1.0(@types/react@19.2.14)(react@19.2.4):
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      '@types/react': 19.2.14
+      devlop: 1.1.0
+      hast-util-to-jsx-runtime: 2.3.6
+      html-url-attributes: 3.0.1
+      mdast-util-to-hast: 13.2.1
+      react: 19.2.4
+      remark-parse: 11.0.0
+      remark-rehype: 11.1.2
+      unified: 11.0.5
+      unist-util-visit: 5.1.0
+      vfile: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  react-refresh@0.18.0: {}
+
+  react-router-dom@7.14.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-router: 7.14.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+
+  react-router@7.14.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      cookie: 1.1.1
+      react: 19.2.4
+      set-cookie-parser: 2.7.2
+    optionalDependencies:
+      react-dom: 19.2.4(react@19.2.4)
+
+  react@18.2.0:
+    dependencies:
+      loose-envify: 1.4.0
+
+  react@19.2.4: {}
+
+  read-binary-file-arch@1.0.6:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  read-cache@1.0.0:
+    dependencies:
+      pify: 2.3.0
+
+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
+  readable-stream@3.6.2:
+    dependencies:
+      inherits: 2.0.4
+      string_decoder: 1.3.0
+      util-deprecate: 1.0.2
+
+  readable-stream@4.7.0:
+    dependencies:
+      abort-controller: 3.0.0
+      buffer: 6.0.3
+      events: 3.3.0
+      process: 0.11.10
+      string_decoder: 1.3.0
+
+  readable-web-to-node-stream@3.0.4:
+    dependencies:
+      readable-stream: 4.7.0
+
+  readdir-glob@1.1.3:
+    dependencies:
+      minimatch: 5.1.9
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.1
+
+  readdirp@4.1.2: {}
+
+  readdirp@5.0.0: {}
+
+  real-require@0.2.0: {}
+
+  recast@0.23.11:
+    dependencies:
+      ast-types: 0.16.1
+      esprima: 4.0.1
+      source-map: 0.6.1
+      tiny-invariant: 1.3.3
+      tslib: 2.8.1
+
+  rehype-harden@1.1.8:
+    dependencies:
+      unist-util-visit: 5.1.0
+
+  rehype-raw@7.0.0:
+    dependencies:
+      '@types/hast': 3.0.4
+      hast-util-raw: 9.1.0
+      vfile: 6.0.3
+
+  rehype-sanitize@6.0.0:
+    dependencies:
+      '@types/hast': 3.0.4
+      hast-util-sanitize: 5.0.2
+
+  remark-gfm@4.0.1:
+    dependencies:
+      '@types/mdast': 4.0.4
+      mdast-util-gfm: 3.1.0
+      micromark-extension-gfm: 3.0.0
+      remark-parse: 11.0.0
+      remark-stringify: 11.0.0
+      unified: 11.0.5
+    transitivePeerDependencies:
+      - supports-color
+
+  remark-parse@11.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      mdast-util-from-markdown: 2.0.3
+      micromark-util-types: 2.0.2
+      unified: 11.0.5
+    transitivePeerDependencies:
+      - supports-color
+
+  remark-rehype@11.1.2:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      mdast-util-to-hast: 13.2.1
+      unified: 11.0.5
+      vfile: 6.0.3
+
+  remark-stringify@11.0.0:
+    dependencies:
+      '@types/mdast': 4.0.4
+      mdast-util-to-markdown: 2.1.2
+      unified: 11.0.5
+
+  remend@1.3.0: {}
+
+  require-directory@2.1.1: {}
+
+  require-from-string@2.0.2: {}
+
+  require-in-the-middle@8.0.1:
+    dependencies:
+      debug: 4.4.3
+      module-details-from-path: 1.0.4
+    transitivePeerDependencies:
+      - supports-color
+
+  resedit@1.7.2:
+    dependencies:
+      pe-library: 0.4.1
+
+  reselect@4.1.8: {}
+
+  reselect@5.1.1: {}
+
+  resolve-alpn@1.2.1: {}
+
+  resolve-from@4.0.0: {}
+
+  resolve-from@5.0.0: {}
+
+  resolve-pkg-maps@1.0.0: {}
+
+  resolve@1.22.11:
+    dependencies:
+      is-core-module: 2.16.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  responselike@2.0.1:
+    dependencies:
+      lowercase-keys: 2.0.0
+
+  restore-cursor@3.1.0:
+    dependencies:
+      onetime: 5.1.2
+      signal-exit: 3.0.7
+
+  restore-cursor@5.1.0:
+    dependencies:
+      onetime: 7.0.0
+      signal-exit: 4.1.0
+
+  retry@0.12.0: {}
+
+  retry@0.13.1: {}
+
+  rettime@0.11.11: {}
+
+  reusify@1.1.0: {}
+
+  rimraf@3.0.2:
+    dependencies:
+      glob: 7.2.3
+
+  roarr@2.15.4:
+    dependencies:
+      boolean: 3.2.0
+      detect-node: 2.1.0
+      globalthis: 1.0.4
+      json-stringify-safe: 5.0.1
+      semver-compare: 1.0.0
+      sprintf-js: 1.1.3
+    optional: true
+
+  robust-predicates@3.0.3: {}
+
+  rollup@4.55.1:
+    dependencies:
+      '@types/estree': 1.0.8
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.55.1
+      '@rollup/rollup-android-arm64': 4.55.1
+      '@rollup/rollup-darwin-arm64': 4.55.1
+      '@rollup/rollup-darwin-x64': 4.55.1
+      '@rollup/rollup-freebsd-arm64': 4.55.1
+      '@rollup/rollup-freebsd-x64': 4.55.1
+      '@rollup/rollup-linux-arm-gnueabihf': 4.55.1
+      '@rollup/rollup-linux-arm-musleabihf': 4.55.1
+      '@rollup/rollup-linux-arm64-gnu': 4.55.1
+      '@rollup/rollup-linux-arm64-musl': 4.55.1
+      '@rollup/rollup-linux-loong64-gnu': 4.55.1
+      '@rollup/rollup-linux-loong64-musl': 4.55.1
+      '@rollup/rollup-linux-ppc64-gnu': 4.55.1
+      '@rollup/rollup-linux-ppc64-musl': 4.55.1
+      '@rollup/rollup-linux-riscv64-gnu': 4.55.1
+      '@rollup/rollup-linux-riscv64-musl': 4.55.1
+      '@rollup/rollup-linux-s390x-gnu': 4.55.1
+      '@rollup/rollup-linux-x64-gnu': 4.55.1
+      '@rollup/rollup-linux-x64-musl': 4.55.1
+      '@rollup/rollup-openbsd-x64': 4.55.1
+      '@rollup/rollup-openharmony-arm64': 4.55.1
+      '@rollup/rollup-win32-arm64-msvc': 4.55.1
+      '@rollup/rollup-win32-ia32-msvc': 4.55.1
+      '@rollup/rollup-win32-x64-gnu': 4.55.1
+      '@rollup/rollup-win32-x64-msvc': 4.55.1
+      fsevents: 2.3.3
+
+  rou3@0.7.12: {}
+
+  roughjs@4.6.6:
+    dependencies:
+      hachure-fill: 0.5.2
+      path-data-parser: 0.1.0
+      points-on-curve: 0.2.0
+      points-on-path: 0.2.1
+
+  router@2.2.0:
+    dependencies:
+      debug: 4.4.3
+      depd: 2.0.0
+      is-promise: 4.0.0
+      parseurl: 1.3.3
+      path-to-regexp: 8.4.2
+    transitivePeerDependencies:
+      - supports-color
+
+  run-applescript@7.1.0: {}
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  rw@1.3.3: {}
+
+  s-js@0.4.9: {}
+
+  safe-buffer@5.1.2: {}
+
+  safe-buffer@5.2.1: {}
+
+  safe-stable-stringify@2.5.0: {}
+
+  safer-buffer@2.1.2: {}
+
+  sanitize-filename@1.6.4:
+    dependencies:
+      truncate-utf8-bytes: 1.0.2
+
+  sax@1.4.4: {}
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0
+
+  scheduler@0.27.0: {}
+
+  semver-compare@1.0.0:
+    optional: true
+
+  semver@6.3.1: {}
+
+  semver@7.7.3: {}
+
+  semver@7.7.4: {}
+
+  send@1.2.1:
+    dependencies:
+      debug: 4.4.3
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      fresh: 2.0.0
+      http-errors: 2.0.1
+      mime-types: 3.0.2
+      ms: 2.1.3
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      statuses: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  serialize-error@7.0.1:
+    dependencies:
+      type-fest: 0.13.1
+    optional: true
+
+  seroval-plugins@1.3.3(seroval@1.3.2):
+    dependencies:
+      seroval: 1.3.2
+
+  seroval@1.3.2: {}
+
+  serve-static@2.2.1:
+    dependencies:
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      parseurl: 1.3.3
+      send: 1.2.1
+    transitivePeerDependencies:
+      - supports-color
+
+  set-blocking@2.0.0: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  set-cookie-parser@3.1.0: {}
+
+  setimmediate@1.0.5: {}
+
+  setprototypeof@1.2.0: {}
+
+  shadcn@4.6.0(@types/node@25.6.0)(typescript@5.9.3):
+    dependencies:
+      '@babel/core': 7.29.0
+      '@babel/parser': 7.29.2
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0)
+      '@babel/preset-typescript': 7.27.1(@babel/core@7.29.0)
+      '@dotenvx/dotenvx': 1.64.0
+      '@modelcontextprotocol/sdk': 1.29.0(zod@3.25.76)
+      '@types/validate-npm-package-name': 4.0.2
+      browserslist: 4.28.1
+      commander: 14.0.3
+      cosmiconfig: 9.0.1(typescript@5.9.3)
+      dedent: 1.7.2
+      deepmerge: 4.3.1
+      diff: 8.0.2
+      execa: 9.6.1
+      fast-glob: 3.3.3
+      fs-extra: 11.3.4
+      fuzzysort: 3.1.0
+      https-proxy-agent: 7.0.6
+      kleur: 4.1.5
+      msw: 2.14.3(@types/node@25.6.0)(typescript@5.9.3)
+      node-fetch: 3.3.2
+      open: 11.0.0
+      ora: 8.2.0
+      postcss: 8.5.6
+      postcss-selector-parser: 7.1.1
+      prompts: 2.4.2
+      recast: 0.23.11
+      stringify-object: 5.0.0
+      tailwind-merge: 3.5.0
+      ts-morph: 26.0.0
+      tsconfig-paths: 4.2.0
+      validate-npm-package-name: 7.0.2
+      zod: 3.25.76
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+    transitivePeerDependencies:
+      - '@cfworker/json-schema'
+      - '@types/node'
+      - babel-plugin-macros
+      - supports-color
+      - typescript
+
+  sharp@0.34.5:
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.7.4
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.34.5
+      '@img/sharp-darwin-x64': 0.34.5
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+      '@img/sharp-libvips-linux-arm': 1.2.4
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+      '@img/sharp-libvips-linux-x64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+      '@img/sharp-linux-arm': 0.34.5
+      '@img/sharp-linux-arm64': 0.34.5
+      '@img/sharp-linux-ppc64': 0.34.5
+      '@img/sharp-linux-riscv64': 0.34.5
+      '@img/sharp-linux-s390x': 0.34.5
+      '@img/sharp-linux-x64': 0.34.5
+      '@img/sharp-linuxmusl-arm64': 0.34.5
+      '@img/sharp-linuxmusl-x64': 0.34.5
+      '@img/sharp-wasm32': 0.34.5
+      '@img/sharp-win32-arm64': 0.34.5
+      '@img/sharp-win32-ia32': 0.34.5
+      '@img/sharp-win32-x64': 0.34.5
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  shell-quote@1.8.3: {}
+
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+  signal-exit@3.0.7: {}
+
+  signal-exit@4.1.0: {}
+
+  simple-update-notifier@2.0.0:
+    dependencies:
+      semver: 7.7.4
+
+  simple-xml-to-json@1.2.3: {}
+
+  sisteransi@1.0.5: {}
+
+  slice-ansi@3.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      astral-regex: 2.0.0
+      is-fullwidth-code-point: 3.0.0
+    optional: true
+
+  smart-buffer@4.2.0: {}
+
+  socks-proxy-agent@7.0.0:
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+      socks: 2.8.7
+    transitivePeerDependencies:
+      - supports-color
+
+  socks@2.8.7:
+    dependencies:
+      ip-address: 10.1.0
+      smart-buffer: 4.2.0
+
+  solid-js@1.9.10:
+    dependencies:
+      csstype: 3.2.3
+      seroval: 1.3.2
+      seroval-plugins: 1.3.3(seroval@1.3.2)
+    optional: true
+
+  solid-js@1.9.9:
+    dependencies:
+      csstype: 3.2.3
+      seroval: 1.3.2
+      seroval-plugins: 1.3.3(seroval@1.3.2)
+
+  solid-refresh@0.6.3(solid-js@1.9.9):
+    dependencies:
+      '@babel/generator': 7.28.6
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/types': 7.28.6
+      solid-js: 1.9.9
+    transitivePeerDependencies:
+      - supports-color
+
+  sonic-boom@4.2.0:
+    dependencies:
+      atomic-sleep: 1.0.0
+
+  source-map-js@1.2.1: {}
+
+  source-map-support@0.5.21:
+    dependencies:
+      buffer-from: 1.1.2
+      source-map: 0.6.1
+
+  source-map@0.6.1: {}
+
+  source-map@0.7.6: {}
+
+  space-separated-tokens@2.0.2: {}
+
+  split2@4.2.0: {}
+
+  sprintf-js@1.1.3:
+    optional: true
+
+  sql-escaper@1.3.3: {}
+
+  ssri@9.0.1:
+    dependencies:
+      minipass: 3.3.6
+
+  stage-js@1.0.0-alpha.17:
+    optional: true
+
+  stat-mode@1.0.0: {}
+
+  statuses@2.0.2: {}
+
+  stdin-discarder@0.2.2: {}
+
+  stream-browserify@3.0.0:
+    dependencies:
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+
+  streamdown@2.5.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      clsx: 2.1.1
+      hast-util-to-jsx-runtime: 2.3.6
+      html-url-attributes: 3.0.1
+      marked: 17.0.1
+      mermaid: 11.14.0
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      rehype-harden: 1.1.8
+      rehype-raw: 7.0.0
+      rehype-sanitize: 6.0.0
+      remark-gfm: 4.0.1
+      remark-parse: 11.0.0
+      remark-rehype: 11.1.2
+      remend: 1.3.0
+      tailwind-merge: 3.5.0
+      unified: 11.0.5
+      unist-util-visit: 5.1.0
+      unist-util-visit-parents: 6.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  streamsearch@1.1.0: {}
+
+  strict-event-emitter@0.5.1: {}
+
+  string-width@4.2.3:
+    dependencies:
+      emoji-regex: 8.0.0
+      is-fullwidth-code-point: 3.0.0
+      strip-ansi: 6.0.1
+
+  string-width@5.1.2:
+    dependencies:
+      eastasianwidth: 0.2.0
+      emoji-regex: 9.2.2
+      strip-ansi: 7.2.0
+
+  string-width@7.2.0:
+    dependencies:
+      emoji-regex: 10.6.0
+      get-east-asian-width: 1.5.0
+      strip-ansi: 7.2.0
+
+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  stringify-entities@4.0.4:
+    dependencies:
+      character-entities-html4: 2.1.0
+      character-entities-legacy: 3.0.0
+
+  stringify-object@5.0.0:
+    dependencies:
+      get-own-enumerable-keys: 1.0.0
+      is-obj: 3.0.0
+      is-regexp: 3.1.0
+
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
+  strip-ansi@7.2.0:
+    dependencies:
+      ansi-regex: 6.2.2
+
+  strip-bom@3.0.0: {}
+
+  strip-final-newline@2.0.0: {}
+
+  strip-final-newline@4.0.0: {}
+
+  strnum@2.2.0: {}
+
+  strtok3@6.3.0:
+    dependencies:
+      '@tokenizer/token': 0.3.0
+      peek-readable: 4.1.0
+
+  style-mod@4.1.3: {}
+
+  style-to-js@1.1.21:
+    dependencies:
+      style-to-object: 1.0.14
+
+  style-to-object@1.0.14:
+    dependencies:
+      inline-style-parser: 0.2.7
+
+  styled-jsx@5.1.1(react@18.2.0):
+    dependencies:
+      client-only: 0.0.1
+      react: 18.2.0
+
+  styled-jsx@5.1.6(react@19.2.4):
+    dependencies:
+      client-only: 0.0.1
+      react: 19.2.4
+
+  stylis@4.3.6: {}
+
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.15
+      ts-interface-checker: 0.1.13
+
+  sumchecker@3.0.1:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  swr@2.4.1(react@19.2.4):
+    dependencies:
+      dequal: 2.0.3
+      react: 19.2.4
+      use-sync-external-store: 1.6.0(react@19.2.4)
+
+  tabbable@6.4.0: {}
+
+  tagged-tag@1.0.0: {}
+
+  tailwind-merge@3.5.0: {}
+
+  tailwindcss@3.4.7:
+    dependencies:
+      '@alloc/quick-lru': 5.2.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.3
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.21.7
+      lilconfig: 2.1.0
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.4.38
+      postcss-import: 15.1.0(postcss@8.4.38)
+      postcss-js: 4.1.0(postcss@8.4.38)
+      postcss-load-config: 4.0.2(postcss@8.4.38)
+      postcss-nested: 6.2.0(postcss@8.4.38)
+      postcss-selector-parser: 6.1.2
+      resolve: 1.22.11
+      sucrase: 3.35.1
+    transitivePeerDependencies:
+      - ts-node
+
+  tailwindcss@4.1.18: {}
+
+  tapable@2.3.0: {}
+
+  tar-stream@2.2.0:
+    dependencies:
+      bl: 4.1.0
+      end-of-stream: 1.4.5
+      fs-constants: 1.0.0
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+
+  tar@6.2.1:
+    dependencies:
+      chownr: 2.0.0
+      fs-minipass: 2.1.0
+      minipass: 5.0.0
+      minizlib: 2.1.2
+      mkdirp: 1.0.4
+      yallist: 4.0.0
+
+  tar@7.5.11:
+    dependencies:
+      '@isaacs/fs-minipass': 4.0.1
+      chownr: 3.0.0
+      minipass: 7.1.2
+      minizlib: 3.1.0
+      yallist: 5.0.0
+
+  temp-file@3.4.0:
+    dependencies:
+      async-exit-hook: 2.0.1
+      fs-extra: 10.1.0
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  thread-stream@3.1.0:
+    dependencies:
+      real-require: 0.2.0
+
+  three@0.177.0:
+    optional: true
+
+  throttleit@2.1.0: {}
+
+  tiny-invariant@1.3.3: {}
+
+  tiny-typed-emitter@2.1.0: {}
+
+  tinycolor2@1.6.0: {}
+
+  tinyexec@0.3.2: {}
+
+  tinyexec@1.0.4: {}
+
+  tinyglobby@0.2.15:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.3)
+      picomatch: 4.0.3
+
+  tldts-core@7.0.30: {}
+
+  tldts@7.0.30:
+    dependencies:
+      tldts-core: 7.0.30
+
+  tmp-promise@3.0.3:
+    dependencies:
+      tmp: 0.2.5
+
+  tmp@0.2.5: {}
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  toidentifier@1.0.1: {}
+
+  token-types@4.2.1:
+    dependencies:
+      '@tokenizer/token': 0.3.0
+      ieee754: 1.2.1
+
+  tough-cookie@6.0.1:
+    dependencies:
+      tldts: 7.0.30
+
+  tr46@0.0.3: {}
+
+  tree-kill@1.2.2: {}
+
+  trim-lines@3.0.1: {}
+
+  trough@2.2.0: {}
+
+  truncate-utf8-bytes@1.0.2:
+    dependencies:
+      utf8-byte-length: 1.0.5
+
+  ts-dedent@2.2.0: {}
+
+  ts-interface-checker@0.1.13: {}
+
+  ts-morph@26.0.0:
+    dependencies:
+      '@ts-morph/common': 0.27.0
+      code-block-writer: 13.0.3
+
+  tsconfig-paths@4.2.0:
+    dependencies:
+      json5: 2.2.3
+      minimist: 1.2.8
+      strip-bom: 3.0.0
+
+  tslib@2.8.1: {}
+
+  tsup@8.5.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3)(yaml@2.8.2):
+    dependencies:
+      bundle-require: 5.1.0(esbuild@0.27.2)
+      cac: 6.7.14
+      chokidar: 4.0.3
+      consola: 3.4.2
+      debug: 4.4.3
+      esbuild: 0.27.2
+      fix-dts-default-cjs-exports: 1.0.1
+      joycon: 3.1.1
+      picocolors: 1.1.1
+      postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.21.0)(yaml@2.8.2)
+      resolve-from: 5.0.0
+      rollup: 4.55.1
+      source-map: 0.7.6
+      sucrase: 3.35.1
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.15
+      tree-kill: 1.2.2
+    optionalDependencies:
+      postcss: 8.5.6
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - jiti
+      - supports-color
+      - tsx
+      - yaml
+
+  tsx@4.21.0:
+    dependencies:
+      esbuild: 0.27.2
+      get-tsconfig: 4.13.1
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  turbo@2.8.20:
+    optionalDependencies:
+      '@turbo/darwin-64': 2.8.20
+      '@turbo/darwin-arm64': 2.8.20
+      '@turbo/linux-64': 2.8.20
+      '@turbo/linux-arm64': 2.8.20
+      '@turbo/windows-64': 2.8.20
+      '@turbo/windows-arm64': 2.8.20
+
+  tw-animate-css@1.4.0: {}
+
+  type-fest@0.13.1:
+    optional: true
+
+  type-fest@5.6.0:
+    dependencies:
+      tagged-tag: 1.0.0
+
+  type-is@2.0.1:
+    dependencies:
+      content-type: 1.0.5
+      media-typer: 1.1.0
+      mime-types: 3.0.2
+
+  typeid-js@1.2.0:
+    dependencies:
+      uuid: 10.0.0
+
+  typescript@5.4.5: {}
+
+  typescript@5.9.3: {}
+
+  ufo@1.6.3: {}
+
+  ulid@2.4.0: {}
+
+  undici-types@5.26.5: {}
+
+  undici-types@6.21.0: {}
+
+  undici-types@7.18.2: {}
+
+  undici-types@7.19.2: {}
+
+  undici@5.29.0:
+    dependencies:
+      '@fastify/busboy': 2.1.1
+
+  unicorn-magic@0.3.0: {}
+
+  unified@11.0.5:
+    dependencies:
+      '@types/unist': 3.0.3
+      bail: 2.0.2
+      devlop: 1.1.0
+      extend: 3.0.2
+      is-plain-obj: 4.1.0
+      trough: 2.2.0
+      vfile: 6.0.3
+
+  unique-filename@2.0.1:
+    dependencies:
+      unique-slug: 3.0.0
+
+  unique-slug@3.0.0:
+    dependencies:
+      imurmurhash: 0.1.4
+
+  unist-util-is@6.0.1:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-position@5.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-stringify-position@4.0.0:
+    dependencies:
+      '@types/unist': 3.0.3
+
+  unist-util-visit-parents@6.0.2:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-is: 6.0.1
+
+  unist-util-visit@5.1.0:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-is: 6.0.1
+      unist-util-visit-parents: 6.0.2
+
+  universalify@0.1.2: {}
+
+  universalify@2.0.1: {}
+
+  unpipe@1.0.0: {}
+
+  until-async@3.0.2: {}
+
+  unzip-crx-3@0.2.0:
+    dependencies:
+      jszip: 3.10.1
+      mkdirp: 0.5.6
+      yaku: 0.16.7
+
+  update-browserslist-db@1.2.3(browserslist@4.28.1):
+    dependencies:
+      browserslist: 4.28.1
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  use-sync-external-store@1.6.0(react@19.2.4):
+    dependencies:
+      react: 19.2.4
+
+  utf8-byte-length@1.0.5: {}
+
+  utif2@4.1.0:
+    dependencies:
+      pako: 1.0.11
+
+  util-deprecate@1.0.2: {}
+
+  uuid@10.0.0: {}
+
+  uuid@11.1.0: {}
+
+  validate-npm-package-name@7.0.2: {}
+
+  vary@1.1.2: {}
+
+  verror@1.10.1:
+    dependencies:
+      assert-plus: 1.0.0
+      core-util-is: 1.0.2
+      extsprintf: 1.4.1
+    optional: true
+
+  vfile-location@5.0.3:
+    dependencies:
+      '@types/unist': 3.0.3
+      vfile: 6.0.3
+
+  vfile-message@4.0.3:
+    dependencies:
+      '@types/unist': 3.0.3
+      unist-util-stringify-position: 4.0.0
+
+  vfile@6.0.3:
+    dependencies:
+      '@types/unist': 3.0.3
+      vfile-message: 4.0.3
+
+  vite-plugin-solid@2.11.10(solid-js@1.9.9)(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)):
+    dependencies:
+      '@babel/core': 7.28.6
+      '@types/babel__core': 7.20.5
+      babel-preset-solid: 1.9.9(@babel/core@7.28.6)(solid-js@1.9.9)
+      merge-anything: 5.1.7
+      solid-js: 1.9.9
+      solid-refresh: 0.6.3(solid-js@1.9.9)
+      vite: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+      vitefu: 1.1.1(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))
+    transitivePeerDependencies:
+      - supports-color
+
+  vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.3)
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rollup: 4.55.1
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 25.6.0
+      fsevents: 2.3.3
+      jiti: 2.6.1
+      lightningcss: 1.30.2
+      tsx: 4.21.0
+      yaml: 2.8.2
+
+  vite@7.3.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2):
+    dependencies:
+      esbuild: 0.27.2
+      fdir: 6.5.0(picomatch@4.0.3)
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rollup: 4.55.1
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 25.6.0
+      fsevents: 2.3.3
+      jiti: 2.6.1
+      lightningcss: 1.30.2
+      tsx: 4.21.0
+      yaml: 2.8.2
+
+  vitefu@1.1.1(vite@6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)):
+    optionalDependencies:
+      vite: 6.4.1(@types/node@25.6.0)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2)
+
+  vscode-jsonrpc@8.2.0: {}
+
+  vscode-languageserver-protocol@3.17.5:
+    dependencies:
+      vscode-jsonrpc: 8.2.0
+      vscode-languageserver-types: 3.17.5
+
+  vscode-languageserver-textdocument@1.0.12: {}
+
+  vscode-languageserver-types@3.17.5: {}
+
+  vscode-languageserver@9.0.1:
+    dependencies:
+      vscode-languageserver-protocol: 3.17.5
+
+  vscode-uri@3.1.0: {}
+
+  w3c-keyname@2.2.8: {}
+
+  wcwidth@1.0.1:
+    dependencies:
+      defaults: 1.0.4
+
+  web-namespaces@2.0.1: {}
+
+  web-streams-polyfill@3.3.3: {}
+
+  web-tree-sitter@0.25.10: {}
+
+  webidl-conversions@3.0.1: {}
+
+  whatwg-url@5.0.0:
+    dependencies:
+      tr46: 0.0.3
+      webidl-conversions: 3.0.1
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  which@4.0.0:
+    dependencies:
+      isexe: 3.1.5
+
+  wide-align@1.1.5:
+    dependencies:
+      string-width: 4.2.3
+
+  wrap-ansi@7.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  wrap-ansi@8.1.0:
+    dependencies:
+      ansi-styles: 6.2.3
+      string-width: 5.1.2
+      strip-ansi: 7.2.0
+
+  wrappy@1.0.2: {}
+
+  ws@8.19.0: {}
+
+  wsl-utils@0.3.1:
+    dependencies:
+      is-wsl: 3.1.1
+      powershell-utils: 0.1.0
+
+  xml-parse-from-string@1.0.1: {}
+
+  xml2js@0.5.0:
+    dependencies:
+      sax: 1.4.4
+      xmlbuilder: 11.0.1
+
+  xmlbuilder@11.0.1: {}
+
+  xmlbuilder@15.1.1: {}
+
+  y18n@5.0.8: {}
+
+  yaku@0.16.7: {}
+
+  yallist@3.1.1: {}
+
+  yallist@4.0.0: {}
+
+  yallist@5.0.0: {}
+
+  yaml@2.8.2: {}
+
+  yargs-parser@21.1.1: {}
+
+  yargs@17.7.2:
+    dependencies:
+      cliui: 8.0.1
+      escalade: 3.2.0
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      string-width: 4.2.3
+      y18n: 5.0.8
+      yargs-parser: 21.1.1
+
+  yauzl@2.10.0:
+    dependencies:
+      buffer-crc32: 0.2.13
+      fd-slicer: 1.1.0
+
+  yjs@13.6.30:
+    dependencies:
+      lib0: 0.2.117
+
+  yocto-queue@0.1.0: {}
+
+  yocto-spinner@1.2.0:
+    dependencies:
+      yoctocolors: 2.1.2
+
+  yoctocolors@2.1.2: {}
+
+  yoga-layout@3.2.1: {}
+
+  zip-stream@4.1.1:
+    dependencies:
+      archiver-utils: 3.0.4
+      compress-commons: 4.1.2
+      readable-stream: 3.6.2
+
+  zod-to-json-schema@3.25.2(zod@3.25.76):
+    dependencies:
+      zod: 3.25.76
+
+  zod-to-json-schema@3.25.2(zod@4.3.6):
+    dependencies:
+      zod: 4.3.6
+
+  zod@3.25.76: {}
+
+  zod@4.3.6: {}
+
+  zustand@5.0.12(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4)):
+    optionalDependencies:
+      '@types/react': 19.2.14
+      react: 19.2.4
+      use-sync-external-store: 1.6.0(react@19.2.4)
+
+  zwitch@2.0.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000000..da6e35ea68
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+packages:
+  - "apps/*"
+  - "packages/*"
+  - "ee/apps/*"
+  - "ee/packages/*"
diff --git a/pr/anthropic-hide-create-api-key/anthropic-api-key-screen.png b/pr/anthropic-hide-create-api-key/anthropic-api-key-screen.png
new file mode 100644
index 0000000000..a7fa110012
Binary files /dev/null and b/pr/anthropic-hide-create-api-key/anthropic-api-key-screen.png differ
diff --git a/pr/anthropic-hide-create-api-key/anthropic-connect-modal.png b/pr/anthropic-hide-create-api-key/anthropic-connect-modal.png
new file mode 100644
index 0000000000..6927b18bc9
Binary files /dev/null and b/pr/anthropic-hide-create-api-key/anthropic-connect-modal.png differ
diff --git a/pr/anthropic-hide-create-api-key/anthropic-filtered-modal.png b/pr/anthropic-hide-create-api-key/anthropic-filtered-modal.png
new file mode 100644
index 0000000000..38effd4b16
Binary files /dev/null and b/pr/anthropic-hide-create-api-key/anthropic-filtered-modal.png differ
diff --git a/pr/flow20-welcome-screen.png b/pr/flow20-welcome-screen.png
new file mode 100644
index 0000000000..15afdc1630
Binary files /dev/null and b/pr/flow20-welcome-screen.png differ
diff --git a/pr/flow21-create-workspace-modal.png b/pr/flow21-create-workspace-modal.png
new file mode 100644
index 0000000000..22c64a9a77
Binary files /dev/null and b/pr/flow21-create-workspace-modal.png differ
diff --git a/pr/flow23-folder-explanation.png b/pr/flow23-folder-explanation.png
new file mode 100644
index 0000000000..9a2918da66
Binary files /dev/null and b/pr/flow23-folder-explanation.png differ
diff --git a/pr/flow25-skip-welcome-with-workspaces.png b/pr/flow25-skip-welcome-with-workspaces.png
new file mode 100644
index 0000000000..a638d92ac7
Binary files /dev/null and b/pr/flow25-skip-welcome-with-workspaces.png differ
diff --git a/pr/llm-hub/den-llm-provider-encrypted-flow.png b/pr/llm-hub/den-llm-provider-encrypted-flow.png
new file mode 100644
index 0000000000..3b6880f392
Binary files /dev/null and b/pr/llm-hub/den-llm-provider-encrypted-flow.png differ
diff --git a/pr/llm-hub/llm-provider-detail-openai.png b/pr/llm-hub/llm-provider-detail-openai.png
new file mode 100644
index 0000000000..ae8bee1bd4
Binary files /dev/null and b/pr/llm-hub/llm-provider-detail-openai.png differ
diff --git a/pr/llm-hub/llm-provider-list.png b/pr/llm-hub/llm-provider-list.png
new file mode 100644
index 0000000000..caa54fc24b
Binary files /dev/null and b/pr/llm-hub/llm-provider-list.png differ
diff --git a/prds/electron-1-1-port-audit.md b/prds/electron-1-1-port-audit.md
new file mode 100644
index 0000000000..8c60c838f5
--- /dev/null
+++ b/prds/electron-1-1-port-audit.md
@@ -0,0 +1,434 @@
+# Electron 1:1 Port Audit
+
+## Goal
+
+Port the current desktop product on `origin/dev` from Tauri 2.x to Electron without changing user-visible behavior.
+
+Parity means keeping all of the following working:
+
+- local desktop host mode
+- orchestrator and direct runtime modes
+- deep links: `openwork://` and `openwork-dev://`
+- single-instance handoff behavior
+- folder/file pickers and save dialogs
+- open URL, open path, reveal in folder
+- auto-update and release-channel behavior
+- workspace file watching and reload-required events
+- sidecar staging and version metadata
+- desktop bootstrap config and forced sign-in flows
+- window focus, relaunch, decorations, and zoom behavior
+- renderer access to localhost/OpenWork/OpenCode HTTP surfaces
+
+## Current State
+
+- There is no shipping Electron implementation in the current tree. A repo-wide search for `electron` found no existing desktop shell to extend.
+- Tauri is not isolated to `apps/desktop`; it leaks into the renderer, package manifests, CI, release scripts, docs, locales, and planning docs.
+- The minimum realistic scope is: replace the native shell, replace the renderer/native bridge, then update every build/release/doc surface that still assumes Tauri.
+
+## Hard Blockers
+
+These capabilities need an Electron equivalent before the port can be called 1:1:
+
+1. `invoke`-style IPC for the current native command surface.
+2. Desktop-safe HTTP/fetch behavior currently handled by `@tauri-apps/plugin-http`.
+3. Folder/file/save dialogs.
+4. Open URL/open path/reveal path behavior.
+5. Relaunch/restart behavior.
+6. Single-instance + forwarded deep-link handling.
+7. Updater integration and release-channel endpoint selection.
+8. Webview zoom behavior.
+9. Window decoration toggling.
+10. Workspace file watching and native event emission.
+11. Sidecar spawning, supervision, shutdown, and cleanup.
+12. Desktop bootstrap config persistence.
+
+## Native Contract That Must Be Recreated
+
+The current Tauri bridge is not small.
+
+- `apps/app/src/app/lib/tauri.ts` exports `63` wrappers.
+- `apps/desktop/src-tauri/src/commands/*.rs` exposes `57` `#[tauri::command]` handlers.
+
+Current command count by Rust module:
+
+```text
+apps/desktop/src-tauri/src/commands/workspace.rs: 14
+apps/desktop/src-tauri/src/commands/orchestrator.rs: 8
+apps/desktop/src-tauri/src/commands/engine.rs: 6
+apps/desktop/src-tauri/src/commands/skills.rs: 6
+apps/desktop/src-tauri/src/commands/misc.rs: 5
+apps/desktop/src-tauri/src/commands/opencode_router.rs: 5
+apps/desktop/src-tauri/src/commands/command_files.rs: 3
+apps/desktop/src-tauri/src/commands/scheduler.rs: 2
+apps/desktop/src-tauri/src/commands/openwork_server.rs: 2
+apps/desktop/src-tauri/src/commands/desktop_bootstrap.rs: 2
+apps/desktop/src-tauri/src/commands/config.rs: 2
+apps/desktop/src-tauri/src/commands/window.rs: 1
+apps/desktop/src-tauri/src/commands/updater.rs: 1
+```
+
+## Exact Change Inventory
+
+### 1. Root Workspace Surface
+
+These files change because the workspace entrypoints and dependency graph still expose Tauri directly.
+
+```text
+package.json
+pnpm-lock.yaml
+```
+
+Notes:
+
+- `package.json` currently exposes a root `tauri` script and routes desktop dev/build through the Tauri-based package.
+- `pnpm-lock.yaml` will change when `@tauri-apps/*` packages are removed and Electron packages are added.
+
+### 2. App Renderer And Shared Desktop Bridge
+
+Everything below is in scope because it either imports `@tauri-apps/*`, imports `app/lib/tauri`, checks `isTauriRuntime()`, references `__TAURI_INTERNALS__`, or documents Tauri-specific renderer behavior.
+
+Total files: `58`
+
+#### Shared app modules
+
+```text
+apps/app/package.json
+apps/app/scripts/bump-version.mjs
+apps/app/src/app/bundles/apply.ts
+apps/app/src/app/bundles/sources.ts
+apps/app/src/app/lib/den.ts
+apps/app/src/app/lib/opencode.ts
+apps/app/src/app/lib/openwork-server.ts
+apps/app/src/app/lib/release-channels.ts
+apps/app/src/app/lib/tauri.ts
+apps/app/src/app/mcp.ts
+apps/app/src/app/types.ts
+apps/app/src/app/utils/index.ts
+apps/app/src/app/utils/plugins.ts
+apps/app/src/index.react.tsx
+apps/app/src/react-app/ARCHITECTURE.md
+```
+
+What changes here:
+
+- Replace the Tauri-specific runtime boundary with an Electron preload/IPC boundary.
+- Remove direct `@tauri-apps/*` dependencies from the renderer.
+- Rename or replace `app/lib/tauri.ts`; a parity-first port should move this to a generic desktop bridge early.
+- Rework update-channel copy and assumptions in `release-channels.ts`.
+- Update version bump flow so it no longer edits `Cargo.toml`, `Cargo.lock`, or `tauri.conf.json`.
+- Revisit router selection in `index.react.tsx`; it currently uses `HashRouter` when `isTauriRuntime()` is true.
+
+#### React shell and kernel
+
+```text
+apps/app/src/react-app/kernel/platform.tsx
+apps/app/src/react-app/kernel/server-provider.tsx
+apps/app/src/react-app/kernel/system-state.ts
+apps/app/src/react-app/shell/app-root.tsx
+apps/app/src/react-app/shell/desktop-runtime-boot.ts
+apps/app/src/react-app/shell/font-zoom.ts
+apps/app/src/react-app/shell/providers.tsx
+apps/app/src/react-app/shell/session-route.tsx
+apps/app/src/react-app/shell/settings-route.tsx
+apps/app/src/react-app/shell/startup-deep-links.ts
+```
+
+What changes here:
+
+- `platform.tsx` currently hardcodes Tauri open-link and relaunch behavior.
+- `server-provider.tsx`, `openwork-server.ts`, `opencode.ts`, `den.ts`, and `bundles/sources.ts` use Tauri HTTP fetch in desktop mode.
+- `system-state.ts` uses Tauri relaunch and reset flow.
+- `font-zoom.ts` uses `@tauri-apps/api/webview` directly.
+- `startup-deep-links.ts` depends on Tauri deep-link and event APIs.
+- `session-route.tsx` and `settings-route.tsx` assume Tauri-native workspace/bootstrap behavior.
+
+#### React domain files
+
+```text
+apps/app/src/react-app/domains/bundles/skill-destination-modal.tsx
+apps/app/src/react-app/domains/cloud/forced-signin-page.tsx
+apps/app/src/react-app/domains/connections/mcp-auth-modal.tsx
+apps/app/src/react-app/domains/connections/mcp-view.tsx
+apps/app/src/react-app/domains/connections/openwork-server-store.ts
+apps/app/src/react-app/domains/connections/provider-auth/provider-auth-modal.tsx
+apps/app/src/react-app/domains/connections/provider-auth/store.ts
+apps/app/src/react-app/domains/connections/store.ts
+apps/app/src/react-app/domains/session/chat/session-page.tsx
+apps/app/src/react-app/domains/session/sidebar/workspace-session-list.tsx
+apps/app/src/react-app/domains/session/surface/message-list.tsx
+apps/app/src/react-app/domains/settings/pages/advanced-view.tsx
+apps/app/src/react-app/domains/settings/pages/appearance-view.tsx
+apps/app/src/react-app/domains/settings/pages/automations-view.tsx
+apps/app/src/react-app/domains/settings/pages/config-view.tsx
+apps/app/src/react-app/domains/settings/pages/debug-view.tsx
+apps/app/src/react-app/domains/settings/pages/mcp-view.tsx
+apps/app/src/react-app/domains/settings/pages/recovery-view.tsx
+apps/app/src/react-app/domains/settings/pages/updates-view.tsx
+apps/app/src/react-app/domains/settings/panels/authorized-folders-panel.tsx
+apps/app/src/react-app/domains/settings/state/automations-store.ts
+apps/app/src/react-app/domains/settings/state/debug-view-model.ts
+apps/app/src/react-app/domains/settings/state/extensions-store.ts
+apps/app/src/react-app/domains/workspace/share-workspace-state.ts
+```
+
+What changes here:
+
+- Replace direct bridge imports with the new Electron desktop bridge.
+- Replace Tauri-only file/path/dialog helpers.
+- Rework updater UI to target Electron update semantics.
+- Keep forced-signin/deep-link auth flows working after the native deep-link layer changes.
+- Keep settings pages working for filesystem-backed edits, scheduler access, local-skill management, and reveal/open actions.
+
+#### Locale strings
+
+These locale files all contain the current `app.error.tauri_required` copy and need wording changes once Tauri is gone.
+
+```text
+apps/app/src/i18n/locales/ca.ts
+apps/app/src/i18n/locales/en.ts
+apps/app/src/i18n/locales/es.ts
+apps/app/src/i18n/locales/fr.ts
+apps/app/src/i18n/locales/ja.ts
+apps/app/src/i18n/locales/pt-BR.ts
+apps/app/src/i18n/locales/th.ts
+apps/app/src/i18n/locales/vi.ts
+apps/app/src/i18n/locales/zh.ts
+```
+
+### 3. Story Book / Demo Runtime
+
+These files still pull Tauri packages into the demo shell.
+
+```text
+apps/story-book/package.json
+apps/story-book/src/index.tsx
+```
+
+What changes here:
+
+- Remove `@tauri-apps/*` dependencies from Story Book.
+- Replace the demo platform implementation so it no longer references Tauri opener/process APIs.
+
+### 4. Native Desktop Shell Replacement
+
+This is the core of the port. The current desktop package is Tauri/Rust-based and must be replaced or fully reimplemented behind Electron main/preload.
+
+Total files: `64`
+
+#### Package and build scripts
+
+```text
+apps/desktop/package.json
+apps/desktop/scripts/chrome-devtools-mcp-shim.ts
+apps/desktop/scripts/dev-windows.mjs
+apps/desktop/scripts/prepare-sidecar.mjs
+apps/desktop/scripts/tauri-before-build.mjs
+apps/desktop/scripts/tauri-before-dev.mjs
+```
+
+What changes here:
+
+- Replace `tauri dev` / `tauri build` entrypoints with Electron equivalents.
+- Keep sidecar staging, but retarget output paths away from `src-tauri`.
+- Rework Windows desktop dev launcher for Electron.
+- `chrome-devtools-mcp-shim.ts` may stay logically the same, but its build/staging path changes with the shell.
+
+#### Tauri manifests, build metadata, and generated capability artifacts
+
+```text
+apps/desktop/src-tauri/build.rs
+apps/desktop/src-tauri/capabilities/default.json
+apps/desktop/src-tauri/Cargo.lock
+apps/desktop/src-tauri/Cargo.toml
+apps/desktop/src-tauri/entitlements.plist
+apps/desktop/src-tauri/gen/schemas/acl-manifests.json
+apps/desktop/src-tauri/gen/schemas/capabilities.json
+apps/desktop/src-tauri/gen/schemas/desktop-schema.json
+apps/desktop/src-tauri/gen/schemas/macOS-schema.json
+apps/desktop/src-tauri/gen/schemas/windows-schema.json
+apps/desktop/src-tauri/Info.dev.plist
+apps/desktop/src-tauri/tauri.conf.json
+apps/desktop/src-tauri/tauri.dev.conf.json
+```
+
+What changes here:
+
+- `Cargo.toml`/`Cargo.lock`/`build.rs` go away if the native shell is no longer Rust-based.
+- Tauri config, capability JSON, and generated schemas are Tauri-specific and must be removed or replaced.
+- macOS packaging metadata may still be needed, but not in current Tauri form.
+
+#### Rust bootstrap, managers, helpers, and process orchestration
+
+```text
+apps/desktop/src-tauri/src/bun_env.rs
+apps/desktop/src-tauri/src/config.rs
+apps/desktop/src-tauri/src/desktop_bootstrap.rs
+apps/desktop/src-tauri/src/fs.rs
+apps/desktop/src-tauri/src/lib.rs
+apps/desktop/src-tauri/src/main.rs
+apps/desktop/src-tauri/src/paths.rs
+apps/desktop/src-tauri/src/types.rs
+apps/desktop/src-tauri/src/updater.rs
+apps/desktop/src-tauri/src/utils.rs
+apps/desktop/src-tauri/src/platform/mod.rs
+apps/desktop/src-tauri/src/platform/unix.rs
+apps/desktop/src-tauri/src/platform/windows.rs
+apps/desktop/src-tauri/src/engine/doctor.rs
+apps/desktop/src-tauri/src/engine/manager.rs
+apps/desktop/src-tauri/src/engine/mod.rs
+apps/desktop/src-tauri/src/engine/paths.rs
+apps/desktop/src-tauri/src/engine/spawn.rs
+apps/desktop/src-tauri/src/opencode_router/manager.rs
+apps/desktop/src-tauri/src/opencode_router/mod.rs
+apps/desktop/src-tauri/src/opencode_router/spawn.rs
+apps/desktop/src-tauri/src/openwork_server/manager.rs
+apps/desktop/src-tauri/src/openwork_server/mod.rs
+apps/desktop/src-tauri/src/openwork_server/spawn.rs
+apps/desktop/src-tauri/src/orchestrator/manager.rs
+apps/desktop/src-tauri/src/orchestrator/mod.rs
+apps/desktop/src-tauri/src/workspace/commands.rs
+apps/desktop/src-tauri/src/workspace/files.rs
+apps/desktop/src-tauri/src/workspace/mod.rs
+apps/desktop/src-tauri/src/workspace/state.rs
+apps/desktop/src-tauri/src/workspace/watch.rs
+```
+
+What changes here:
+
+- `lib.rs` currently owns plugin registration, single-instance behavior, deep-link forwarding, shutdown cleanup, and command registration.
+- `workspace/watch.rs` emits `openwork://reload-required` from native file-watch events.
+- `desktop_bootstrap.rs` persists the external desktop bootstrap file and seeds Den startup behavior.
+- `updater.rs` contains macOS DMG/translocation gating for updates.
+- `engine/*`, `orchestrator/*`, `openwork_server/*`, and `opencode_router/*` currently spawn and supervise local child processes.
+- `paths.rs` and related helpers contain native-side path resolution and sidecar discovery logic.
+
+#### Rust command modules that the renderer depends on
+
+```text
+apps/desktop/src-tauri/src/commands/command_files.rs
+apps/desktop/src-tauri/src/commands/config.rs
+apps/desktop/src-tauri/src/commands/desktop_bootstrap.rs
+apps/desktop/src-tauri/src/commands/engine.rs
+apps/desktop/src-tauri/src/commands/misc.rs
+apps/desktop/src-tauri/src/commands/mod.rs
+apps/desktop/src-tauri/src/commands/opencode_router.rs
+apps/desktop/src-tauri/src/commands/openwork_server.rs
+apps/desktop/src-tauri/src/commands/orchestrator.rs
+apps/desktop/src-tauri/src/commands/scheduler.rs
+apps/desktop/src-tauri/src/commands/skills.rs
+apps/desktop/src-tauri/src/commands/updater.rs
+apps/desktop/src-tauri/src/commands/window.rs
+apps/desktop/src-tauri/src/commands/workspace.rs
+```
+
+What changes here:
+
+- Every renderer call currently funneled through `app/lib/tauri.ts` must be backed by Electron IPC instead.
+- The desktop event contract also needs parity, not just request/response IPC.
+
+### 5. Runtime / Sidecar Build Hooks Outside `apps/desktop`
+
+These packages can mostly keep their product logic, but they still contain shell-coupled assumptions that must change for Electron packaging.
+
+```text
+apps/orchestrator/src/cli.ts
+apps/server-v2/script/build.ts
+```
+
+What changes here:
+
+- `apps/server-v2/script/build.ts` still supports `--bundle-dir` embedding for Tauri sidecar layouts.
+- `apps/orchestrator/src/cli.ts` remains product-runtime logic, but any shell packaging, path, or supervision assumptions tied to the Tauri app layout must be reviewed during the cutover.
+
+### 6. CI, Release, And Ops Scripts
+
+These files will keep failing or generating the wrong artifacts until they are rewritten for Electron.
+
+```text
+.github/workflows/alpha-macos-aarch64.yml
+.github/workflows/build-desktop.yml
+.github/workflows/prerelease.yml
+.github/workflows/release-macos-aarch64.yml
+.github/workflows/windows-signed-artifacts.yml
+scripts/find-unused.README.md
+scripts/find-unused.sh
+scripts/openwork-debug.sh
+scripts/release/review.mjs
+scripts/release/verify-tag.mjs
+```
+
+What changes here:
+
+- CI currently caches Cargo, builds Tauri bundles, uploads Tauri artifacts, and signs/notarizes Tauri outputs.
+- Release review/verify scripts compare desktop package version against `Cargo.toml` and `tauri.conf.json`.
+- `openwork-debug.sh` kills Tauri dev processes.
+- `find-unused.sh` and its README explicitly whitelist Tauri hooks/configs.
+
+### 7. Live Product And Developer Docs
+
+These are active docs, not just historical notes. They should be updated in the same implementation stream so the repo stops advertising Tauri as the current shell.
+
+```text
+AGENTS.md
+ARCHITECTURE.md
+README.md
+translated_readmes/README_JA.md
+translated_readmes/README_ZH_hk.md
+translated_readmes/README_ZH.md
+```
+
+Why they change:
+
+- `AGENTS.md` still says the desktop/mobile shell is Tauri 2.x and calls out Tauri commands/events as IPC.
+- `ARCHITECTURE.md` explicitly frames native-shell fallback behavior around Tauri and documents Tauri updater/channel behavior.
+- `README.md` and translated readmes currently require Rust + Tauri CLI and describe Tauri folder-picker and desktop build steps.
+
+### 8. Planning Docs That Become Stale
+
+These docs are not build blockers, but they will actively mislead future work if the Electron port lands and they still describe the desktop layer as Tauri-first.
+
+```text
+prds/openwork-desktop-bootstrap-config/desktop-bootstrap-and-org-runtime-config.md
+prds/react-incremental-adoption.md
+prds/server-v2-plan/app-audit.md
+prds/server-v2-plan/distribution.md
+prds/server-v2-plan/final-cutover-checklist.md
+prds/server-v2-plan/ideal-flow.md
+prds/server-v2-plan/plan.md
+prds/server-v2-plan/tauri-audit.md
+prds/server-v2-plan/ui-migration.md
+```
+
+## Recommended Cutover Order
+
+1. Keep `apps/app` behavior frozen and define a generic desktop bridge that matches the current Tauri contract.
+2. Stand up an Electron main/preload shell under `apps/desktop` that can satisfy the same bridge.
+3. Port native process supervision, deep links, single-instance handling, updater logic, dialogs, open/reveal helpers, and file watching.
+4. Swap renderer imports off direct `@tauri-apps/*` usage.
+5. Replace Tauri build/release/versioning logic in scripts and GitHub Actions.
+6. Update docs, translated readmes, and locale copy.
+7. Delete the remaining Tauri-only codepaths and configs only after desktop parity is verified.
+
+## Decisions To Make Before Implementation
+
+1. Keep the package name `@openwork/desktop` and replace internals in place, or create a parallel Electron package and cut over later.
+2. Keep a HashRouter-based desktop renderer, or move Electron to a different route/bootstrap strategy.
+3. Keep GitHub-hosted updater artifacts/endpoints, or change updater infrastructure while doing the shell migration.
+4. Reimplement native process/file-watch logic in Node/Electron only, or keep a small Rust helper binary for pieces like watcher/process supervision.
+
+## Bottom Line
+
+This is not just an `apps/desktop` rewrite.
+
+A full 1:1 Electron port touches:
+
+- root workspace scripts and lockfile
+- `58` renderer/shared-app files
+- `2` Story Book files
+- `64` desktop shell files
+- `2` runtime/build hook files outside the shell package
+- `10` CI/release/ops script files
+- `6` live product/developer docs
+- `9` planning docs that become stale after cutover
+
+If the goal is strict parity, the safest path is to port the current Tauri contract first, then simplify after the Electron app is feature-complete.
diff --git a/prds/electron-migration-plan.md b/prds/electron-migration-plan.md
new file mode 100644
index 0000000000..7d8a29e5b9
--- /dev/null
+++ b/prds/electron-migration-plan.md
@@ -0,0 +1,301 @@
+# Migration plan: Tauri → Electron
+
+Goal: every existing Tauri user ends up on the Electron build without
+manual action, keeps all workspaces / tokens / sessions, and continues to
+auto-update from Electron going forward — all through the update mechanism
+users already trust.
+
+## Where data lives today
+
+### Tauri shell — `app_data_dir()` per OS
+
+| OS       | Path                                                     |
+| -------- | -------------------------------------------------------- |
+| macOS    | `~/Library/Application Support/com.differentai.openwork/`|
+| Windows  | `%APPDATA%\com.differentai.openwork\`                    |
+| Linux    | `~/.config/com.differentai.openwork/`                    |
+
+Contents (observed on a real machine):
+- `openwork-workspaces.json` (Tauri's name)
+- `openwork-server-state.json`
+- `openwork-server-tokens.json`
+- `workspaces/` subtree
+
+### Electron shell — `app.getPath("userData")` default
+
+| OS       | Path                                           |
+| -------- | ---------------------------------------------- |
+| macOS    | `~/Library/Application Support/Electron/`      |
+| Windows  | `%APPDATA%\Electron\`                          |
+| Linux    | `~/.config/Electron/`                          |
+
+Contents written today:
+- `workspace-state.json` (Electron's name — differs from Tauri's)
+- `openwork-server-state.json`
+- `openwork-server-tokens.json`
+- `desktop-bootstrap.json`
+
+### Shared state (already portable)
+- `~/.openwork/openwork-orchestrator/` — orchestrator daemon data
+- Each workspace's own `.opencode/` — sessions, messages, skills, MCP config
+- Neither has to migrate.
+
+## Tauri updater today
+
+- `apps/desktop/src-tauri/tauri.conf.json` →
+  `endpoints: ["https://github.com/different-ai/openwork/releases/latest/download/latest.json"]`
+- minisign signature required (pubkey baked into config)
+- installs a DMG/zip in place
+
+A straight-swap to an Electron installer fails: the Tauri updater
+won't accept an asset that isn't minisign-signed in the format it expects.
+
+## Plan
+
+### 1 — Make Electron read the same folder Tauri writes
+
+Before any user-facing migration, flip two knobs in the current PR's Electron
+shell:
+
+```js
+// apps/desktop/electron/main.mjs
+app.setName("OpenWork");
+app.setPath(
+  "userData",
+  path.join(app.getPath("appData"), "com.differentai.openwork"),
+);
+```
+
+```yaml
+# apps/desktop/electron-builder.yml
+appId: com.differentai.openwork   # (currently com.differentai.openwork.electron)
+```
+
+Effects:
+- macOS Launchpad / Dock / notarization identity stay the same → Gatekeeper
+  doesn't re-prompt, the icon doesn't split into two slots.
+- First Electron launch finds the Tauri-written `openwork-server-*.json`
+  already present → workspaces, tokens, orchestrator state survive with
+  zero copy. Same `workspaces/` subtree, same orchestrator data dir, same
+  workspace `.opencode/` dirs (they live inside user folders anyway).
+
+Filename compatibility layer:
+
+```js
+// Electron runtime on load, once per launch
+async function readWorkspaceState() {
+  const legacy = path.join(userData, "openwork-workspaces.json"); // Tauri
+  const current = path.join(userData, "workspace-state.json");   // Electron
+  if (existsSync(legacy) && !existsSync(current)) {
+    await rename(legacy, current); // idempotent migration
+  }
+  return existsSync(current) ? JSON.parse(await readFile(current)) : EMPTY;
+}
+```
+
+### 2 — One final Tauri release: v0.12.0-migrate
+
+This release uses the existing Tauri updater. Users click "Install update"
+as they always do. What v0.12.0-migrate ships:
+
+1. A single new command `migrate_to_electron()` in the Tauri shell that:
+   - Downloads the matching Electron installer from the same GitHub Release
+     (`OpenWork-0.12.0-mac-<arch>.dmg`, `.exe`, `.AppImage`).
+   - Verifies signature via OS-native tools (`codesign --verify --deep --strict`
+     on mac, Authenticode on Windows, minisign or GH attestations on Linux).
+   - Opens the installer and schedules Tauri quit.
+
+2. A one-time prompt:
+
+   > OpenWork is moving to a new desktop engine. We'll install the new
+   > version and keep all your workspaces. ~30 seconds.
+   > [Install now] [Later]
+
+   "Later" defers 24h once, then force-installs on next launch — no
+   indefinite stragglers.
+
+3. `tauri.conf.json.version` → `0.12.0`, `latest.json.version` → `0.12.0`,
+   minisign-signed as usual. Installed = still a Tauri binary, but whose
+   only remaining job is to launch the Electron installer.
+
+This is the only new Tauri release required. After v0.12.0 we stop
+publishing `latest.json` updates.
+
+### 3 — Flow (ASCII)
+
+```
+Tauri v0.11.x
+      │  (normal Tauri updater poll)
+      ▼
+latest.json says 0.12.0 is out → DMG installed in-place → Tauri v0.12.0-migrate
+      │  on first launch shows migration prompt
+      ▼
+migrate_to_electron():
+  download OpenWork-0.12.0-electron-mac.dmg from same release
+  codesign --verify ✓
+  open installer, schedule Tauri quit
+      │
+      ▼
+Installer replaces the .app bundle
+  appId = com.differentai.openwork (same as Tauri)
+  Launchpad slot + Dock pin preserved, no duplicate "OpenWork" icon
+      │
+      ▼
+OpenWork Electron v0.12.0 first launch
+  app.setPath("userData", .../com.differentai.openwork) points at the
+  Tauri-written folder → tokens, workspaces, orchestrator state already there
+  rename openwork-workspaces.json → workspace-state.json (once)
+      │
+      ▼
+electron-updater now owns the feed (latest-mac.yml, latest.yml, latest-linux.yml)
+  every future release is an Electron-only .dmg / .exe / .AppImage
+```
+
+### 4 — Post-migration auto-updater
+
+Use `electron-updater` (ships with `electron-builder`) against the same
+GitHub release stream:
+
+```yaml
+# apps/desktop/electron-builder.yml
+publish:
+  - provider: github
+    owner: different-ai
+    repo: openwork
+    releaseType: release
+mac:
+  notarize: true           # reuse existing Apple Developer ID
+  icon: src-tauri/icons/icon.icns
+win:
+  sign: ./scripts/sign-windows.mjs   # reuse existing EV cert
+  icon: src-tauri/icons/icon.ico
+```
+
+Runtime:
+
+```js
+import { autoUpdater } from "electron-updater";
+autoUpdater.channel = app.isPackaged ? (releaseChannel ?? "latest") : "latest";
+autoUpdater.autoDownload = prefs.updateAutoDownload;
+autoUpdater.checkForUpdatesAndNotify();
+```
+
+Alpha/beta channels reuse the existing alpha GitHub release. During the
+migration window, `.github/workflows/alpha-macos-aarch64.yml` publishes both
+notarized Tauri assets (`latest.json`) and notarized Electron assets
+(`latest-mac.yml`) to `alpha-macos-latest`.
+
+Delta updates: electron-updater's block-map diffs drop a typical mac update
+from ~120MB full bundle to ~5-20MB. A net win over Tauri's no-delta default.
+
+### 5 — Release-engineering changes
+
+- `Release App` workflow:
+  - Replaces `tauri build` with `pnpm --filter @openwork/desktop package:electron`.
+  - Uploads DMG + zip + `latest-mac.yml` + `latest.yml` + `latest-linux.yml`
+    to the same GitHub release asset list.
+  - Keeps publishing minisign-signed `latest.json` for the v0.12.0 release
+    only (so current Tauri users can pick up the migration update). After
+    that release, stop updating `latest.json`.
+- `build-electron-desktop.yml` (already scaffolded in this PR): flip to a
+  required check once the migration release is in flight.
+
+### 6 — Rollout
+
+| Stage   | Audience            | What ships                                                                  |
+| ------- | ------------------- | --------------------------------------------------------------------------- |
+| Week 0  | this PR merged      | Electron co-exists, Tauri is default, no user impact                        |
+| Week 1  | internal            | Dogfood `pnpm dev:electron` on same data dir as Tauri                       |
+| Week 2  | alpha channel       | First real Electron release via alpha updater. Only opt-in alpha users get it. |
+| Week 3  | stable — v0.12.0    | Migration release. Tauri prompt → Electron install → back online, same data.|
+| Week 4+ | stable — v0.12.x    | Electron-only. Tauri `latest.json` frozen.                                  |
+
+### 7 — Rollback
+
+- Users already on Electron: ship `0.12.1` through `electron-updater`. Same
+  mechanism as any normal update.
+- Users still on Tauri: they never received the migration prompt; they stay
+  on Tauri. Pull `latest.json` if there's a systemic issue.
+- Users mid-migration: Tauri is only quit *after* the Electron installer
+  finishes writing the new bundle. If the installer aborts, Tauri remains
+  the working app until the user retries.
+
+### 8 — Risks and mitigations
+
+- **Bundle-identifier drift**. If Electron `appId` is different from Tauri,
+  macOS treats it as a separate app (new Launchpad icon, new Gatekeeper
+  prompt, new TCC permissions). Fixed in step 1 by unifying to
+  `com.differentai.openwork`.
+- **Notarization / signing**. Electron builds need Apple Developer ID +
+  notarization for the same team. Reusing the existing Tauri CI secrets
+  (`APPLE_CERTIFICATE`, `APPLE_API_KEY`, etc.) makes this a config change
+  rather than a new credential story.
+- **Electron bundle size**. First Electron update is ~120MB vs ~20MB today.
+  Mac universal build keeps it to one download per platform. Future deltas
+  via block-map diffs recover most of the gap.
+- **Third-party integrations depending on the Tauri identifier** (Sparkle,
+  crash reporters, etc.): none in the current build, so zero action.
+
+### 9 — localStorage migration
+
+localStorage lives inside Chromium leveldb keyed by origin. Tauri serves
+the renderer from `tauri://localhost`, Electron serves it from `file://`
+(packaged) or `http://localhost:5173` (dev). Pointing Electron's
+`userData` at the Tauri folder is not enough — the leveldb records are
+invisible across origins.
+
+Scope: **workspace list + selection only**. Everything else (theme,
+font zoom, sidebar widths, feature flags) is cheap to redo.
+
+Migrated keys (allowlist):
+- `openwork.react.activeWorkspace` — last selected workspace
+- `openwork.react.sessionByWorkspace` — per-workspace last session
+- `openwork.server.list` — multi-server list
+- `openwork.server.active` — selected server
+- `openwork.server.urlOverride` — server override
+- `openwork.server.token` — server token
+
+Implementation (landed in this PR):
+- Tauri Rust command `write_migration_snapshot(payload)` serializes the
+  allowlist into `<app_data_dir>/migration-snapshot.v1.json`.
+- `apps/app/src/app/lib/migration.ts` exposes:
+  - `writeMigrationSnapshotFromTauri()` — scrapes localStorage via the
+    pattern list and hands it to the Rust command.
+  - `ingestMigrationSnapshotOnElectronBoot()` — called once from
+    `desktop-runtime-boot.ts` on Electron only; hydrates localStorage
+    keys that are empty, then acks via IPC so the snapshot is renamed
+    to `migration-snapshot.v1.done.json`.
+- Electron main exposes `openwork:migration:read` and
+  `openwork:migration:ack` IPC handlers; preload bridges them under
+  `window.__OPENWORK_ELECTRON__.migration`.
+
+The "last Tauri release" still needs to call
+`writeMigrationSnapshotFromTauri()` right before it kicks off the
+Electron installer. That's the UI/Rust-command-downloader piece in the
+final PR below.
+
+### 10 — Concrete PRs (order matters)
+
+1. **PR #1522** (merged) — Electron shell lives side-by-side. No user impact.
+2. **This PR** — "migration engine". Unifies `appId` + `userData` path to
+   Tauri's, adds `openwork-workspaces.json` → `workspace-state.json`
+   auto-copy, adds electron-updater wiring, adds migration snapshot
+   read/write plumbing on both sides. Zero user impact by itself (there's
+   no Tauri release yet that calls the snapshot writer).
+3. **Last Tauri release v0.12.0** — ships:
+   - a Rust command `migrate_to_electron()` that downloads the Electron
+     installer, verifies its code signature, and opens it;
+   - a one-time prompt ("OpenWork is moving to a new engine — install?")
+     that calls `writeMigrationSnapshotFromTauri()` then
+     `migrate_to_electron()`;
+   - bumps `tauri.conf.json` + `latest.json` so the existing Tauri
+     updater delivers this release.
+4. **Release-engineering PR**: update `Release App` workflow to emit
+   Electron artifacts + `latest*.yml` feeds alongside the Tauri assets
+   for the v0.12.0 release, and only Electron for v0.12.1+.
+
+After (3) rolls out, flip the default `apps/desktop/package.json`
+scripts so `dev` / `build` / `package` use Electron, and delete
+`src-tauri/`. Electron packaging should keep using `apps/desktop/resources/`
+for icons and generated sidecars so deleting `src-tauri/` is not a packaging
+dependency cutover at the same time.
diff --git a/prds/mcp-server/consent-page-test.png b/prds/mcp-server/consent-page-test.png
new file mode 100644
index 0000000000..7f54da2fd9
Binary files /dev/null and b/prds/mcp-server/consent-page-test.png differ
diff --git a/prds/mcp-server/plan.md b/prds/mcp-server/plan.md
new file mode 100644
index 0000000000..d06299998e
--- /dev/null
+++ b/prds/mcp-server/plan.md
@@ -0,0 +1,513 @@
+# PRD: Den API MCP Server
+
+## Status: Draft
+## Date: 2026-04-28
+
+## Problem
+
+OpenWork Cloud needs an MCP server for `ee/apps/den-api` so users and agents can interact with the Den control-plane API through MCP clients.
+
+The API already has a Hono server and a generated OpenAPI document. Most existing Den API endpoints should become MCP tools, but some endpoints must remain unavailable over MCP because they are auth, admin, webhook, billing, hidden, or otherwise unsafe for agent-driven access.
+
+Users should authenticate to the MCP server through OAuth, not static API keys. The authorization flow should let users sign in, approve MCP access, select the organization that the grant applies to when needed, and receive tokens that are explicitly identifiable as MCP tokens.
+
+## Goals
+
+- Host the MCP server inside the existing `ee/apps/den-api` Hono process.
+- Use the existing Hono route handlers as the source of behavior instead of duplicating endpoint logic.
+- Use the existing OpenAPI document as the source of truth for MCP tool generation.
+- Use Better Auth's OAuth 2.1 provider plugin for MCP authentication.
+- Support sign-in, consent, and organization selection for organization-scoped MCP access.
+- Store and identify OAuth grants/tokens as MCP usage through resource audience, scopes, client metadata, and token claims.
+- Make the MCP tool catalog auto-maintainable as API routes are added or changed.
+- Provide explicit allow/deny policy for operations that should not be exposed through MCP.
+- Keep MCP credentials separate from existing Den API keys.
+
+## Non-Goals
+
+- Creating a separate generated MCP server project.
+- Using `openapi-mcp-generator` as a production dependency.
+- Exposing every Den API endpoint over MCP by default without policy checks.
+- Letting MCP OAuth tokens become general-purpose REST API tokens.
+- Replacing existing Den web sign-in flows.
+- Reworking the entire Den API route structure.
+
+## Recommended Architecture
+
+Use three layers:
+
+- Better Auth OAuth provider for authorization, token issuance, dynamic client registration, consent, org selection, and JWT verification.
+- `@hono/mcp` for the Hono-compatible MCP Streamable HTTP transport.
+- A small OpenWork-owned OpenAPI-to-MCP adapter that builds tools from the current Den OpenAPI document and dispatches tool calls through the existing Hono app.
+
+Target request flow:
+
+```text
+MCP client
+-> discovers MCP + OAuth metadata
+-> starts OAuth authorization with resource=https://api.openworklabs.com/mcp
+-> user signs in through Den auth
+-> user selects an organization when required
+-> user consents to MCP scopes
+-> client receives OAuth access token and optional refresh token
+-> client calls /mcp with Authorization: Bearer <access_token>
+-> /mcp verifies JWT audience, issuer, scope, token_use, and org claim
+-> MCP tool call maps to an OpenAPI operation
+-> adapter dispatches to existing Hono route handler
+-> JSON response returns as MCP tool content
+```
+
+## Package Choices
+
+### Use `@better-auth/oauth-provider`
+
+The Better Auth OAuth provider plugin should be the OAuth foundation because it supports:
+
+- OAuth 2.1 authorization-code flow with PKCE.
+- Public clients for AI/MCP clients.
+- Dynamic client registration.
+- MCP/resource-server metadata support.
+- Organization-aware post-login flow through `postLogin` and `consentReferenceId`.
+- JWT access tokens and JWKS verification.
+- Resource/audience validation.
+- Consent, revocation, refresh tokens, and introspection endpoints.
+
+### Use `@hono/mcp`
+
+`@hono/mcp` should be used only as the Hono transport glue for `/mcp`.
+
+It should not own auth policy, OpenAPI conversion, endpoint filtering, or Den-specific dispatch.
+
+### Do Not Use `openapi-mcp-generator`
+
+`openapi-mcp-generator` is useful as a reference but should not be used as the production solution.
+
+Reasons:
+
+- It generates a separate MCP proxy project.
+- It does not live inside the existing Hono process.
+- It would create a second lifecycle and deployment surface.
+- Its auth model is upstream-env-token oriented, not Den OAuth/org-consent oriented.
+- We need route-level policy and internal dispatch through our existing middleware.
+
+## OAuth Design
+
+### Resource and Audience
+
+Use a dedicated MCP resource audience:
+
+```text
+https://api.openworklabs.com/mcp
+```
+
+All MCP access tokens must have this audience. `/mcp` should reject tokens without it.
+
+### Scopes
+
+Initial scopes:
+
+- `openid`
+- `profile`
+- `email`
+- `offline_access`
+- `mcp:read`
+- `mcp:write`
+
+Start with coarse scopes. Keep fine-grained route permissions in the MCP exposure policy and existing Den organization permissions.
+
+Potential later scopes:
+
+- `mcp:workers:read`
+- `mcp:workers:write`
+- `mcp:org:read`
+- `mcp:org:write`
+- `mcp:plugins:read`
+- `mcp:plugins:write`
+
+### Token Identification
+
+MCP-issued tokens should be identifiable by multiple signals:
+
+- OAuth resource/audience is `https://api.openworklabs.com/mcp`.
+- OAuth scopes include `mcp:*`.
+- OAuth client metadata includes `{ "kind": "mcp" }` when the client is known or dynamically registered for MCP.
+- OAuth consent `reference_id` is the selected organization ID for org-scoped grants.
+- Custom JWT claim includes token use and org ID.
+
+Proposed custom claims:
+
+```json
+{
+  "https://openworklabs.com/token_use": "mcp",
+  "https://openworklabs.com/org_id": "org_...",
+  "https://openworklabs.com/resource": "https://api.openworklabs.com/mcp"
+}
+```
+
+### Organization Selection
+
+Use Better Auth OAuth provider `postLogin`, not the consent page, for organization selection.
+
+The flow should be:
+
+- User starts OAuth authorization from an MCP client.
+- If not signed in, Better Auth redirects to Den sign-in.
+- After sign-in, Better Auth checks whether requested scopes include `mcp:*`.
+- If the user has multiple organizations or no active organization, redirect to `/mcp/select-organization` in Den web.
+- The selection page sets the active organization through the existing Better Auth organization endpoint.
+- The selection page calls `oauth2.continue({ postLogin: true })`.
+- `consentReferenceId` returns the active organization ID for MCP scopes.
+- Consent is stored against that organization reference.
+
+This makes the org binding part of the OAuth grant instead of a separate MCP-only side channel.
+
+### Consent Screen
+
+Create a Den web consent page for MCP grants.
+
+The page should show:
+
+- MCP client name.
+- Selected organization.
+- Requested scopes.
+- Plain-language capabilities.
+- Approve and deny actions.
+
+The consent page should call Better Auth's OAuth consent endpoint.
+
+### Dynamic Client Registration
+
+Enable dynamic registration for MCP public clients, with a conservative policy.
+
+Initial approach:
+
+- Allow dynamic client registration.
+- Allow unauthenticated public client registration only if required by target MCP clients.
+- Restrict default dynamic scopes to `openid profile email mcp:read`.
+- Allow `offline_access` and `mcp:write` only when explicitly requested and approved.
+- Store MCP client metadata with `kind: "mcp"`.
+
+If unauthenticated public registration is too permissive for launch, start with pre-registered trusted clients for known MCP clients and add dynamic registration after compatibility testing.
+
+## Den API Integration
+
+### Auth Configuration
+
+Update `ee/apps/den-api/src/auth.ts`:
+
+- Add Better Auth `jwt()` plugin if required by `oauthProvider`.
+- Add `oauthProvider(...)` after the existing sign-in and organization plugins.
+- Configure `loginPage`, `consentPage`, `postLogin.page`, scopes, valid audiences, and custom claims.
+- Add TypeID generation cases for new Better Auth OAuth models if needed.
+
+### Database Schema
+
+Run Better Auth schema generation or manually add OAuth provider tables to `ee/packages/den-db`.
+
+Expected work:
+
+- Add OAuth client table.
+- Add OAuth consent table.
+- Add OAuth token/verification storage required by the plugin.
+- Add indexes for client ID, user ID, reference ID, token lookup, and expiry cleanup.
+- Add TypeID prefixes for new OAuth models if Better Auth allows custom IDs for those models.
+
+The current auth schema only includes user, session, account, verification, and API key tables, so OAuth provider persistence will require a migration.
+
+### Well-Known Metadata
+
+Expose required metadata endpoints from Den API and Den web proxy paths:
+
+- OAuth authorization server metadata.
+- OpenID configuration if `openid` is supported.
+- OAuth protected resource metadata for MCP.
+- JWKS endpoint for JWT verification.
+
+The Den web `/api/auth/*` proxy currently forwards auth traffic to Den API and rewrites auth locations. Ensure well-known metadata is reachable at the paths MCP clients expect.
+
+### MCP Endpoint
+
+Add a module under `ee/apps/den-api/src/mcp`:
+
+```text
+src/mcp/
+├── index.ts
+├── auth.ts
+├── catalog.ts
+├── invoke.ts
+├── policy.ts
+└── schemas.ts
+```
+
+Responsibilities:
+
+- `index.ts`: register `/mcp` on the Hono app.
+- `auth.ts`: verify OAuth JWT access tokens for MCP.
+- `catalog.ts`: convert OpenAPI operations into MCP tools.
+- `invoke.ts`: dispatch tool calls to existing Hono routes.
+- `policy.ts`: include/exclude OpenAPI operations.
+- `schemas.ts`: map OpenAPI schemas into MCP input schemas.
+
+Register the MCP route in `src/app.ts` after global middleware and before `notFound`.
+
+## OpenAPI-to-MCP Tool Catalog
+
+### Tool Naming
+
+Use OpenAPI `operationId` as the MCP tool name.
+
+The current Den API already creates stable operation IDs through `buildOperationId(method, path)`.
+
+Tool names should be validated for uniqueness during startup/tests.
+
+### Tool Description
+
+Build descriptions from:
+
+- OpenAPI summary.
+- OpenAPI description.
+- HTTP method and path.
+- Tags.
+- Scope requirements.
+
+### Tool Input Shape
+
+Use a predictable input envelope:
+
+```json
+{
+  "path": {},
+  "query": {},
+  "body": {}
+}
+```
+
+Only include sections required by the operation.
+
+This avoids collisions between path parameters, query parameters, and JSON body fields.
+
+### Tool Output Shape
+
+Return JSON responses as MCP text content initially.
+
+Later, add structured content when MCP client support is consistent.
+
+### Catalog Refresh
+
+Generate the catalog from the in-process OpenAPI document at startup.
+
+No generated MCP code should be committed for each route.
+
+Add tests that fail if exposed operations cannot be converted into valid MCP tools.
+
+## Exposure Policy
+
+Most existing endpoints should be exposed over MCP, but not all.
+
+Initial exclusion rules:
+
+- Exclude routes with `hide: true`.
+- Exclude `System` routes except MCP metadata if needed.
+- Exclude `Auth` routes.
+- Exclude `Webhooks` routes.
+- Exclude `Admin` routes.
+- Exclude API key creation/deletion routes.
+- Exclude billing callback/internal routes.
+- Exclude endpoints that create or return credentials unless explicitly approved.
+
+Initial inclusion tags:
+
+- `Users`
+- `Organizations`
+- `Members`
+- `Roles`
+- `Teams`
+- `Templates`
+- `LLM Providers`
+- `Skills`
+- `Skill Hubs`
+- `Workers`
+- `Worker Runtime`
+
+Add a Den-specific OpenAPI extension for explicit policy:
+
+```ts
+describeDenRoute({
+  summary: "List workers",
+  mcp: true,
+  responses: { ... },
+})
+```
+
+or directly as OpenAPI metadata:
+
+```yaml
+x-mcp: false
+```
+
+Policy precedence:
+
+- Explicit operation-level `mcp: false` always excludes.
+- Explicit operation-level `mcp: true` can include if the tag/path is not globally blocked.
+- Global hard-deny categories always win.
+- Hidden routes are excluded unless a future review explicitly changes that rule.
+
+## Internal Dispatch
+
+MCP tools should dispatch through existing Hono route handlers rather than calling business functions directly.
+
+Preferred approach:
+
+- Verify OAuth token at `/mcp`.
+- Resolve user ID and organization ID from token claims.
+- Create an internal request to the corresponding `/v1/*` route.
+- Attach a signed internal principal header that only in-process code can produce.
+- Update auth/session middleware to recognize the internal MCP principal and populate `user`, `session`, and organization context.
+- Call `app.fetch(internalRequest, c.env)`.
+
+Do not forward the OAuth access token as if it were a normal Den REST bearer token.
+
+This keeps MCP credentials scoped to `/mcp` while still reusing existing route middleware and permissions.
+
+## Security Requirements
+
+- Require HTTPS in production.
+- Require PKCE for public clients.
+- Verify JWT access tokens locally where possible.
+- Reject opaque tokens at `/mcp` for launch.
+- Verify issuer, audience, expiry, scopes, and token-use claim.
+- Verify that the org claim/reference still maps to a current membership.
+- Enforce existing Den RBAC inside the invoked route.
+- Never expose auth, webhook, admin, hidden, or credential-issuing routes by accident.
+- Log MCP tool invocation with request ID, user ID, org ID, client ID, operation ID, status, and duration.
+- Do not log raw access tokens or refresh tokens.
+
+## Implementation Phases
+
+### Phase 1: OAuth Provider Foundation
+
+- Add `@better-auth/oauth-provider` dependency.
+- Add any required Better Auth JWT dependency/config.
+- Configure OAuth provider in `ee/apps/den-api/src/auth.ts`.
+- Add OAuth provider DB schema and migrations.
+- Add required well-known metadata routes.
+- Verify OAuth authorize/token flow manually with a public test client.
+
+Acceptance criteria:
+
+- OAuth metadata is reachable.
+- A public client can complete authorization code + PKCE.
+- Token endpoint issues JWT access tokens for the MCP audience.
+- Tokens include MCP-identifying claims.
+
+### Phase 2: Org Selection and Consent
+
+- Add Den web `/mcp/select-organization` page.
+- Add Den web `/mcp/consent` page.
+- Wire Better Auth `postLogin` for MCP scopes.
+- Bind consent `reference_id` to selected org.
+- Add tests for users with zero, one, and multiple organizations.
+
+Acceptance criteria:
+
+- A user with one org can authorize without unnecessary selection friction.
+- A user with multiple orgs must choose an org.
+- Token claims include the selected org ID.
+- Revoking consent prevents future refresh/use.
+
+### Phase 3: MCP Transport and Token Verification
+
+- Add `@hono/mcp` and `@modelcontextprotocol/sdk` dependencies.
+- Add `/mcp` route inside Den API.
+- Verify MCP OAuth JWTs at the MCP route.
+- Return useful MCP auth errors for missing, expired, or wrong-audience tokens.
+- Add MCP protected resource metadata if required by clients.
+
+Acceptance criteria:
+
+- `/mcp` rejects unauthenticated requests.
+- `/mcp` rejects non-MCP tokens.
+- `/mcp` accepts a valid MCP OAuth token.
+
+### Phase 4: OpenAPI Tool Catalog
+
+- Build catalog from the live OpenAPI document.
+- Convert operations into MCP tools using operation IDs.
+- Implement initial OpenAPI schema-to-tool input conversion.
+- Implement policy filtering.
+- Add catalog tests.
+
+Acceptance criteria:
+
+- Tool names are unique and stable.
+- Hidden/auth/admin/webhook routes are not exposed.
+- Included operations are callable in test mode.
+- Adding route metadata updates the MCP catalog without generated code changes.
+
+### Phase 5: Internal Invocation
+
+- Implement OpenAPI operation-to-Hono-request mapping.
+- Add signed internal MCP principal support.
+- Dispatch tool calls through `app.fetch`.
+- Preserve request IDs and logging.
+- Map HTTP errors into MCP tool errors predictably.
+
+Acceptance criteria:
+
+- MCP `listWorkers` calls the existing `/v1/workers` handler.
+- Existing org/RBAC middleware still applies.
+- MCP tokens cannot be used directly against `/v1/*` REST endpoints.
+
+### Phase 6: Hardening and Observability
+
+- Add audit logging for MCP authorizations and tool calls.
+- Add rate limits for `/mcp` and OAuth endpoints if defaults are insufficient.
+- Add token revocation tests.
+- Add denied-route regression tests.
+- Add documentation for connecting MCP clients.
+
+Acceptance criteria:
+
+- Security-sensitive routes remain excluded.
+- Revoked/expired tokens fail.
+- Tool invocation logs are enough to debug user reports.
+
+## Testing Plan
+
+- Unit test OAuth claim construction and token verification.
+- Unit test MCP exposure policy.
+- Unit test OpenAPI-to-tool conversion.
+- Integration test OAuth flow with org selection.
+- Integration test `/mcp` with valid and invalid tokens.
+- Integration test selected high-value tools: list workers, get worker, list skills, list members.
+- Regression test excluded routes: auth, webhooks, admin, API-key creation/deletion, hidden routes.
+- Manual MCP Inspector test against local Den API.
+
+## Open Questions
+
+- Which MCP clients must be supported at launch, and do they require unauthenticated dynamic client registration?
+- Should `mcp:write` be offered at launch or start read-only?
+- Should credential-returning endpoints like worker token retrieval be excluded from MCP initially?
+- Do we want OAuth grants to be visible in existing org API-key screens, or a separate connected MCP apps screen?
+- Should the MCP endpoint be `/mcp` or `/v1/mcp`?
+- Should Den web or Den API be the canonical issuer URL in production?
+
+## Recommended Launch Cut
+
+Launch with:
+
+- OAuth authorization-code + PKCE.
+- JWT-only MCP access tokens.
+- Org-bound grants.
+- `mcp:read` and `mcp:write` scopes.
+- Conservative route exclusions.
+- OpenAPI-generated tool catalog.
+- Internal Hono dispatch.
+- Manual testing with MCP Inspector.
+
+Defer:
+
+- Fine-grained per-tag scopes.
+- Opaque-token introspection.
+- Complex structured MCP output.
+- Broad unauthenticated dynamic client registration if target clients do not require it.
diff --git a/prds/mcp-server/select-organization-page-test.png b/prds/mcp-server/select-organization-page-test.png
new file mode 100644
index 0000000000..dd451861c3
Binary files /dev/null and b/prds/mcp-server/select-organization-page-test.png differ
diff --git a/prds/new-plugin-arch/GitHub-connector.md b/prds/new-plugin-arch/GitHub-connector.md
new file mode 100644
index 0000000000..429312c96c
--- /dev/null
+++ b/prds/new-plugin-arch/GitHub-connector.md
@@ -0,0 +1,773 @@
+# GitHub Connector
+
+This document describes how the GitHub connector should work for the new plugin architecture.
+
+## Goal
+
+Let an organization use a GitHub repo as a source of truth for config objects and plugins.
+
+The GitHub connector should:
+
+- connect through a GitHub App;
+- let admins choose a repo and branch;
+- let admins map repo paths to config object types and optional plugins;
+- ingest matching files into OpenWork;
+- keep OpenWork in sync when GitHub sends webhook events.
+
+## Core model
+
+The recommended model is:
+
+- GitHub is an external source;
+- OpenWork stores a connector account, connector instance, target repo, and path mappings;
+- GitHub webhooks notify OpenWork that the selected branch changed;
+- OpenWork then reconciles against the current branch head state;
+- OpenWork does not treat individual changed files in the webhook payload as the final source of truth.
+
+That means the primary sync model is:
+
+- branch-head reconciliation, not event-by-event mutation replay.
+
+## Why branch-head reconciliation is the right model
+
+When a commit lands on the selected branch, the safest thing to do is:
+
+1. determine the new head commit for the tracked branch;
+2. read the current repo state at that commit;
+3. evaluate all configured mappings against that state;
+4. create, update, or tombstone config objects accordingly.
+
+This is better than replaying per-file webhook changes because it:
+
+- makes merges and squash merges behave the same way as regular pushes;
+- avoids drift if webhook deliveries arrive out of order;
+- makes retries idempotent;
+- lets us recover from partial ingestion failures by re-running the same reconciliation at the same commit;
+- treats GitHub branch state as the authoritative source, not webhook payload details.
+
+The webhook tells us that something changed.
+The repo head tells us what is now true.
+
+## Main components
+
+### GitHub App
+
+We create and operate a GitHub App.
+
+Users:
+
+- install the app on their GitHub org or selected repos;
+- authorize OpenWork to see which installations/repos they can use;
+- choose one installed repo during connector setup.
+
+The GitHub App gives us:
+
+- installation identity;
+- repo access;
+- webhook delivery from GitHub;
+- installation tokens for API access.
+
+### OpenWork connector records
+
+The GitHub connector should fit the generic connector model already documented in `prds/new-plugin-arch/datastructure.md`.
+
+Relevant records:
+
+- `connector_account`
+  - represents the GitHub App installation / account binding;
+- `connector_instance`
+  - represents one configured use of GitHub inside an org;
+- `connector_target`
+  - represents a specific repo + branch target;
+- `connector_mapping`
+  - maps paths in that repo to config object types and optional plugin auto-membership;
+- `connector_sync_event`
+  - records each webhook-triggered or manual sync run;
+- `connector_source_binding`
+  - links an ingested config object to its GitHub source path;
+- `connector_source_tombstone`
+  - preserves deleted path history.
+
+### Flexible connector ids
+
+The shared connector model should always keep:
+
+- a local OpenWork `id`
+- a connector `type`
+- a connector-native `remote_id`
+
+Current GitHub mapping:
+
+- `type`: `github`
+- target `remote_id`: `org/repo`
+
+Recommended GitHub-specific examples:
+
+- `connector_account.remote_id`
+  - GitHub installation id, or installation-scoped account key if we need a string form;
+- `connector_target.remote_id`
+  - `org/repo`;
+- `connector_source_binding.remote_id`
+  - GitHub blob/file identifier if useful, otherwise nullable and path-based identity is enough.
+
+This keeps the schema flexible for other connectors while still preserving GitHub-specific identifiers.
+
+## Setup flow
+
+### 1. Install GitHub App
+
+Admin installs the GitHub App into their GitHub org or user account.
+
+OpenWork stores:
+
+- GitHub installation id;
+- GitHub account/org identity;
+- available repos for that installation.
+
+This becomes the `connector_account`.
+
+Recommended stored fields:
+
+- `connector_type = github`
+- `remote_id = <github_installation_id>`
+- installation account login/name
+- installation account type (`Organization` or `User`)
+
+### 2. Create connector instance
+
+Inside OpenWork, an admin creates a GitHub connector instance.
+
+They choose:
+
+- installation/account;
+- repo;
+- branch;
+- optional name for this connector instance.
+
+This becomes:
+
+- `connector_instance`
+- one `connector_target` for repo + branch.
+
+Recommended stored target fields:
+
+- `connector_target.connector_type = github`
+- `connector_target.remote_id = org/repo`
+- repo numeric id
+- repo owner login
+- repo name
+- branch name / full ref
+- default branch at time of setup if useful for validation
+
+### 3. Create repo mappings
+
+Admin configures one or more mappings from repo paths to config object types.
+
+Examples:
+
+- `/sales/skills/**` -> `skill` -> plugin A
+- `/sales/agents/**` -> `agent` -> plugin A
+- `/finance/commands/**` -> `command` -> plugin B
+- `/shared/mcps/**` -> `mcp` -> no auto-plugin
+
+Each mapping may include:
+
+- path selector/glob;
+- target config object type;
+- parser mode if needed;
+- plugin id if auto-adding to a plugin;
+- `auto_add_to_plugin` flag.
+
+This becomes `connector_mapping`.
+
+### 4. Initial full sync
+
+After setup, OpenWork should run an initial full reconciliation against the selected branch head.
+
+This seeds:
+
+- config objects;
+- config object versions;
+- plugin memberships;
+- source bindings.
+
+## Webhook model
+
+### Endpoint shape
+
+GitHub Apps support a single webhook URL per app registration.
+
+So the recommended shape is:
+
+- one public GitHub ingress endpoint;
+- internal routing to event-specific handlers.
+
+Recommended public endpoint:
+
+- `POST /v1/webhooks/connectors/github`
+
+Recommended internal handler split:
+
+- `githubWebhookIngress()`
+  - receives the raw HTTP request
+  - verifies the signature
+  - parses headers and payload
+  - dispatches by event type
+- `handleGithubPushEvent()`
+- `handleGithubInstallationEvent()`
+- `handleGithubInstallationRepositoriesEvent()`
+- `handleGithubRepositoryEvent()` optional later
+
+If we want subpath-style organization inside the app, we can still do that after ingress.
+
+Example internal structure:
+
+- public ingress: `POST /v1/webhooks/connectors/github`
+- internal modules:
+  - `webhooks/connectors/github/push`
+  - `webhooks/connectors/github/installation`
+  - `webhooks/connectors/github/installation-repositories`
+
+Important constraint:
+
+- GitHub itself should send to one externally registered webhook URL;
+- event-specific subpaths are best treated as internal server organization, not multiple GitHub-facing URLs.
+
+### Events we care about
+
+For v1, the main event should be GitHub `push` webhook deliveries.
+
+Why:
+
+- a merge to the tracked branch produces a push event;
+- a direct commit to the tracked branch also produces a push event;
+- the push event gives us the repo, branch ref, and head commit.
+
+So the practical rule is:
+
+- ignore webhook events that do not change the selected branch;
+- enqueue reconciliation when a push hits the selected branch.
+
+We may also care about some non-content events for connector health, but not for ingestion truth:
+
+- installation removed;
+- repo access removed;
+- repo renamed or archived.
+
+Those should update connector state, but they should not replace branch-head content sync.
+
+Current implementation note:
+
+- `installation.deleted` updates matching `connector_account` rows to `disconnected` and does not enqueue a content sync job.
+
+### Events we can ignore for ingestion
+
+For config ingestion, we should ignore or de-prioritize:
+
+- pushes to other branches;
+- pull request open/update events;
+- issue events;
+- comment events;
+- check runs;
+- release events.
+
+We do not need PR merge events separately if push-to-branch is our source trigger.
+
+## What happens on webhook
+
+### Recommended flow
+
+When GitHub sends a webhook:
+
+1. verify the GitHub webhook signature before doing anything else;
+2. identify the GitHub installation and repo;
+3. find matching `connector_target` rows;
+4. ignore any target where the webhook ref does not equal the configured branch ref;
+5. create a `connector_sync_event` in `pending` or `running` state;
+6. enqueue a reconciliation job keyed by connector target + head commit;
+7. return success to GitHub quickly.
+
+Important:
+
+- signature verification is mandatory, not optional;
+- webhook handling should be lightweight;
+- actual ingestion should happen asynchronously in a job worker.
+
+### Signature verification requirements
+
+OpenWork must verify the GitHub App webhook secret on every incoming webhook delivery.
+
+Requirements:
+
+- store the GitHub App webhook secret securely on the server side;
+- validate the signature header from GitHub against the raw request body before JSON parsing or event processing;
+- reject the request if the signature is missing, invalid, or computed from a body that does not match the raw bytes received;
+- use a constant-time comparison when checking the computed signature;
+- log verification failures at a security/ops level, but do not process the event.
+
+Practical rule:
+
+- no signature match, no webhook processing.
+
+Additional hardening:
+
+- record the GitHub delivery id for traceability;
+- make delivery handling idempotent so safe retries are possible;
+- optionally track duplicate delivery ids to reduce redundant work.
+
+### Verification implementation shape
+
+The signature check should happen in the public ingress endpoint before event dispatch.
+
+Recommended flow:
+
+1. read the raw request body bytes exactly as received;
+2. read GitHub headers:
+   - `X-Hub-Signature-256`
+   - `X-GitHub-Event`
+   - `X-GitHub-Delivery`
+3. compute HMAC SHA-256 over the raw body using the GitHub App webhook secret;
+4. compare the computed digest with `X-Hub-Signature-256` using constant-time comparison;
+5. reject the request if verification fails;
+6. only then parse JSON and dispatch by event type.
+
+Key implementation rule:
+
+- the signature must be computed from the raw body, not from re-serialized JSON.
+
+Recommended pseudocode shape:
+
+```ts
+async function githubWebhookIngress(req: Request) {
+  const rawBody = await req.text()
+  const signature = req.headers.get("x-hub-signature-256")
+
+  if (!signature) return new Response("missing signature", { status: 401 })
+
+  const expected = signGithubBody(rawBody, env.GITHUB_CONNECTOR_APP_WEBHOOK_SECRET)
+  if (!timingSafeEqual(signature, expected)) {
+    return new Response("invalid signature", { status: 401 })
+  }
+
+  const event = req.headers.get("x-github-event")
+  const deliveryId = req.headers.get("x-github-delivery")
+  const payload = JSON.parse(rawBody)
+
+  return dispatchGithubWebhook({ event, deliveryId, payload })
+}
+```
+
+Recommended helper responsibilities:
+
+- `signGithubBody(rawBody, secret)`
+  - returns `sha256=<digest>`
+- `timingSafeEqual(a, b)`
+  - prevents naive string comparison timing leaks
+- `dispatchGithubWebhook()`
+  - routes to event-specific handlers
+
+### Dispatch model
+
+After signature verification, the ingress should dispatch by event type.
+
+Recommended event routing:
+
+- `push` -> `handleGithubPushEvent`
+- `installation` -> `handleGithubInstallationEvent`
+- `installation_repositories` -> `handleGithubInstallationRepositoriesEvent`
+- `repository` -> `handleGithubRepositoryEvent` optional later
+- everything else -> acknowledge and ignore
+
+That gives us:
+
+- one secure ingress path;
+- explicit event-specific logic;
+- easy expansion later without changing the GitHub App registration URL.
+
+For GitHub, useful preserved webhook fields include:
+
+- `X-GitHub-Delivery`
+- installation id
+- repository id
+- repository full name
+- ref
+- after SHA / head SHA
+
+### API shape
+
+This is the recommended API contract shape around the webhook ingress and async sync pipeline.
+
+#### Public webhook ingress
+
+Endpoint:
+
+- `POST /v1/webhooks/connectors/github`
+
+Input:
+
+- raw GitHub webhook request body
+- GitHub headers including:
+  - `X-Hub-Signature-256`
+  - `X-GitHub-Event`
+  - `X-GitHub-Delivery`
+
+Behavior:
+
+1. verify signature against raw body
+2. reject with `401` if invalid or missing
+3. parse event metadata
+4. if event is irrelevant, acknowledge and return success
+5. if event is relevant, create or update a `connector_sync_event`
+6. enqueue async reconciliation keyed by connector target and head SHA
+7. return quickly without doing full ingestion inline
+
+Recommended responses:
+
+- `401 Unauthorized`
+  - signature missing or invalid
+- `202 Accepted`
+  - valid event accepted for async processing
+- `200 OK`
+  - valid but intentionally ignored event
+
+Example response shape for accepted events:
+
+```json
+{
+  "ok": true,
+  "accepted": true,
+  "event": "push",
+  "deliveryId": "<github-delivery-id>",
+  "queued": true
+}
+```
+
+Example response shape for ignored events:
+
+```json
+{
+  "ok": true,
+  "accepted": false,
+  "reason": "event ignored"
+}
+```
+
+Example response shape for invalid signature:
+
+```json
+{
+  "ok": false,
+  "error": "invalid signature"
+}
+```
+
+#### Internal webhook dispatch contract
+
+Recommended normalized dispatch input:
+
+```ts
+type GithubWebhookEnvelope = {
+  deliveryId: string
+  event: string
+  installationId?: number
+  repositoryId?: number
+  repositoryFullName?: string
+  ref?: string
+  headSha?: string
+  payload: unknown
+}
+```
+
+The ingress should build this envelope once, then hand it to event-specific handlers.
+
+#### Internal sync enqueue contract
+
+For relevant push events on a tracked branch, enqueue an internal sync job.
+
+Recommended job payload shape:
+
+```ts
+type GithubConnectorSyncJob = {
+  connectorType: "github"
+  connectorInstanceId: string
+  connectorTargetId: string
+  connectorSyncEventId: string
+  deliveryId: string
+  installationId: number
+  repositoryId: number
+  repositoryFullName: string
+  ref: string
+  headSha: string
+}
+```
+
+Important:
+
+- dedupe jobs on `connectorTargetId + headSha`
+- preserve `deliveryId` for observability
+- do not require webhook redelivery to retry; the job should be rerunnable internally
+
+#### Internal sync trigger behavior
+
+The enqueue layer should:
+
+- resolve matching connector targets by `connector_type`, repo identity, and branch ref
+- create one logical sync event per target + head SHA
+- avoid double-enqueuing the same target/head combination
+- mark the sync event as queued/running before worker execution
+
+#### Worker result contract
+
+The reconciliation worker should update the corresponding `connector_sync_event` with at least:
+
+- final status (`completed`, `failed`, `partial`)
+- target id
+- head SHA
+- counts for created / updated / deleted / skipped objects
+- per-file parse failures if any
+- completed timestamp
+
+This does not need to be a public API response, but it should be the internal result shape we can rely on for UI and debugging.
+
+## Reconciliation job
+
+### Input
+
+The reconciliation job should take:
+
+- `connector_instance_id`
+- `connector_target_id`
+- repo owner/name
+- branch ref
+- head commit SHA from the webhook
+
+### Step 1: fetch current repo state
+
+OpenWork should fetch repo state at the selected branch head commit.
+
+Recommended rule:
+
+- treat the head commit tree as the truth;
+- do not rely solely on the changed-file list in the webhook.
+
+Implementation choices:
+
+- use GitHub contents/tree APIs for mapped paths;
+- or fetch an archive / git tree snapshot for the relevant branch;
+- or diff previous ingested SHA vs new SHA as an optimization later.
+
+For v1, the clearest behavior is:
+
+- enumerate all files matching the configured mappings at the new branch head.
+
+### Step 2: resolve applicable files
+
+For each `connector_mapping`:
+
+1. list files under the mapped selector;
+2. filter to files that are valid for that config type;
+3. parse the file into the normalized config type shape;
+4. build the desired-state set for that mapping.
+
+This gives us the desired current set of GitHub-backed config objects for that target and commit.
+
+### Step 3: compare desired state to current bindings
+
+For each mapping, compare:
+
+- desired files at branch head
+vs
+- active `connector_source_binding` rows for that mapping.
+
+Then:
+
+- file exists and binding exists -> update existing object with a new version if content changed;
+- file exists and no binding exists -> create a new object and binding;
+- binding exists and file no longer exists -> tombstone the binding and mark the object deleted/inactive;
+- file reappears at a previously deleted path -> create a new object identity, do not revive the tombstoned one.
+
+### Step 4: create or update config objects
+
+For each live file:
+
+1. parse raw source according to config type;
+2. create a new `config_object_version` if content or relevant parsed state changed;
+3. project current searchable metadata onto `config_object`;
+4. update `connector_source_binding.last_seen_source_revision_ref`;
+5. ensure plugin membership exists if the mapping auto-adds to a plugin.
+
+### Step 5: handle deletions
+
+For files no longer present at the branch head:
+
+1. create a deleted version or otherwise mark the object deleted/inactive;
+2. close the active `connector_source_binding`;
+3. insert `connector_source_tombstone` with the deleted path and prior object id;
+4. keep plugin membership history intact, but exclude deleted objects from active delivery.
+
+## Plugin auto-membership behavior
+
+If a mapping is bound to a plugin and `auto_add_to_plugin = true`:
+
+- newly discovered files create config objects and are automatically added to that plugin;
+- updated files stay in the plugin;
+- deleted files remain historically associated but are not active downloadable members.
+
+If a mapping has no plugin binding:
+
+- config objects are still ingested and managed by the connector;
+- plugin membership can be added manually later through the API/UI.
+
+## Current recommendation on diffs vs full scan
+
+The recommended answer to your question is:
+
+- yes, after a qualifying webhook we should read the repo state and ingest from that state.
+
+More precisely:
+
+- we should reconcile against the selected branch head, not trust file diffs alone.
+
+The changed-file list from GitHub push events can be useful later as an optimization, but it should not be the authoritative ingestion algorithm for v1.
+
+## Idempotency and retries
+
+The sync worker should be idempotent.
+
+That means:
+
+- same connector target + same head SHA should be safe to process more than once;
+- if a previous attempt failed halfway through, we should be able to rerun it;
+- duplicate webhook deliveries should not create duplicate objects or bindings.
+
+Good guardrails:
+
+- dedupe jobs on `connector_target_id + head_sha`;
+- store sync event status transitions;
+- skip creating a new version if parsed content did not materially change.
+
+## Failure handling
+
+If some files fail to parse:
+
+- do not fail the entire connector target unless the repo itself could not be read;
+- record per-file failures in sync metadata;
+- leave previously successful objects intact;
+- mark the affected object or sync event with an ingestion error state.
+
+Admins should be able to see:
+
+- last successful sync time;
+- last attempted commit SHA;
+- parse failures by file path;
+- whether the connector target is currently healthy.
+
+## Security and permissions
+
+### GitHub side
+
+We should request the smallest practical GitHub App permissions needed for branch-head reconciliation.
+
+Recommended repository permissions:
+
+- `Contents: Read-only`
+  - required to read files, trees, and branch-head content for mapped paths;
+- `Metadata: Read-only`
+  - required for basic repository identity and repo metadata;
+
+Recommended account/install scope:
+
+- installable on organizations and optionally user accounts if we want both use cases;
+- repo access should preferably be selected repos, not all repos, unless the user explicitly chooses broader scope.
+
+Recommended webhook subscriptions:
+
+- `push`
+  - primary content-ingestion trigger for the selected branch;
+- `installation`
+  - detect app uninstalls or installation-level lifecycle changes;
+- `installation_repositories`
+  - detect when repo access is added or removed from the installation.
+
+Optional later webhook subscriptions if product needs them:
+
+- `repository`
+  - useful for rename/archive/default-branch changes if we want explicit lifecycle updates.
+
+Permissions we should avoid unless later requirements demand them:
+
+- write permissions on repository contents;
+- issues, pull requests, actions, deployments, or admin permissions;
+- any org/user permissions unrelated to connector setup and repo reading.
+
+Operational note:
+
+- installation tokens are generated from the GitHub App installation and are not themselves a separate permission choice, but the app/server must securely mint and use them only when reading the configured repo state.
+
+### OpenWork side
+
+Separate RBAC should govern:
+
+- who can connect a GitHub installation;
+- who can create connector instances;
+- who can edit mappings;
+- who can bind mappings to plugins;
+- who can manually edit ingested objects after sync.
+
+## State we should preserve
+
+For every ingested GitHub-backed object, we should preserve:
+
+- installation id;
+- GitHub account/org login;
+- repository id;
+- repo owner/name;
+- branch;
+- mapping id;
+- connector target `remote_id` (`org/repo`);
+- source path;
+- file name and extension;
+- last seen commit SHA;
+- sync event history;
+- tombstone history for deleted paths.
+
+## Suggested lifecycle summary
+
+### On setup
+
+1. install GitHub App
+2. create connector account
+3. create connector instance and target repo/branch
+4. create mappings
+5. run initial full reconciliation
+
+### On qualifying push webhook
+
+1. verify event
+2. check selected branch match
+3. enqueue reconciliation
+4. fetch current branch-head state
+5. evaluate mappings
+6. create/update/delete/tombstone config objects
+7. update plugin memberships
+8. mark sync event complete
+
+## Recommendation summary
+
+The GitHub connector should work like this:
+
+- GitHub App installation gives OpenWork repo access and webhooks;
+- admins map repo paths on a selected branch to config object types and plugins;
+- GitHub push events on the selected branch trigger async reconciliation;
+- OpenWork reads the current branch-head repo state and ingests from that state;
+- OpenWork compares desired current files against existing bindings to create, update, delete, and tombstone objects;
+- plugin auto-membership is driven by connector mappings.
+
+That keeps the system deterministic, retryable, and aligned with the one-source-of-truth rule.
+
+## Open questions
+
+- Should v1 read repo state through tree APIs, archive downloads, or a shallow git mirror worker?
+- Should we ingest only mapped paths, or fetch the whole tree and filter locally?
+- Do we want manual "resync now" controls per connector target?
+- Do we want to expose last synced commit SHA in the admin UI?
diff --git a/prds/new-plugin-arch/admin-api.md b/prds/new-plugin-arch/admin-api.md
new file mode 100644
index 0000000000..5366b0f6c3
--- /dev/null
+++ b/prds/new-plugin-arch/admin-api.md
@@ -0,0 +1,328 @@
+# New Plugin Arch Admin API
+
+This document describes the authenticated admin/API-consumer surface for managing the new plugin architecture.
+
+Use this for:
+
+- OpenWork admin UI
+- direct authenticated API clients
+- backend route planning
+
+Base prefix:
+
+- `/v1/orgs/:orgId/...`
+
+## Principles
+
+- expose logical resources, not raw tables;
+- return current projections for current-state list/detail endpoints;
+- keep version history endpoints explicit;
+- keep connector sync async and observable;
+- keep type-specific convenience endpoints optional but available where UI clarity benefits.
+
+Current implementation note:
+
+- until dedicated org-capability persistence exists, create/manage-account style admin actions are gated by org owner/admin membership in the endpoint layer.
+
+## Config objects
+
+### List/search config objects
+
+- `GET /v1/orgs/:orgId/config-objects`
+
+Suggested query params:
+
+- `type`
+- `status`
+- `sourceMode`
+- `pluginId`
+- `connectorInstanceId`
+- `q`
+- `limit`
+- `cursor`
+- `includeDeleted`
+
+Returns one row per config object, not one row per version.
+
+### Get one config object
+
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId`
+
+### Create config object
+
+- `POST /v1/orgs/:orgId/config-objects`
+
+Suggested body shape:
+
+```json
+{
+  "type": "skill",
+  "sourceMode": "cloud",
+  "pluginIds": ["plugin_123"],
+  "input": {
+    "rawSourceText": "...",
+    "parserMode": "opencode"
+  }
+}
+```
+
+### Create a new version for an object
+
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/versions`
+
+Suggested body shape:
+
+```json
+{
+  "input": {
+    "rawSourceText": "..."
+  },
+  "reason": "manual edit"
+}
+```
+
+### Lifecycle endpoints
+
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/archive`
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/delete`
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/restore`
+
+### Object/plugin membership endpoints
+
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/plugins`
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/plugins`
+- `DELETE /v1/orgs/:orgId/config-objects/:configObjectId/plugins/:pluginId`
+
+### Object access endpoints
+
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/access`
+- `POST /v1/orgs/:orgId/config-objects/:configObjectId/access`
+- `DELETE /v1/orgs/:orgId/config-objects/:configObjectId/access/:grantId`
+
+## Config object versions
+
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/versions`
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/versions/:versionId`
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/versions/latest`
+- `GET /v1/orgs/:orgId/config-objects/:configObjectId/versions/compare?from=:versionA&to=:versionB`
+
+## Type-specific convenience endpoints
+
+These should sit on top of the shared config-object model.
+
+### Skills
+
+- `GET /v1/orgs/:orgId/skills`
+- `POST /v1/orgs/:orgId/skills`
+- `GET /v1/orgs/:orgId/skills/:configObjectId`
+- `POST /v1/orgs/:orgId/skills/:configObjectId/versions`
+- `POST /v1/orgs/:orgId/skills/validate`
+- `POST /v1/orgs/:orgId/skills/preview`
+
+### Agents
+
+- `GET /v1/orgs/:orgId/agents`
+- `POST /v1/orgs/:orgId/agents`
+- `GET /v1/orgs/:orgId/agents/:configObjectId`
+- `POST /v1/orgs/:orgId/agents/:configObjectId/versions`
+- `POST /v1/orgs/:orgId/agents/validate`
+
+### Commands
+
+- `GET /v1/orgs/:orgId/commands`
+- `POST /v1/orgs/:orgId/commands`
+- `GET /v1/orgs/:orgId/commands/:configObjectId`
+- `POST /v1/orgs/:orgId/commands/:configObjectId/versions`
+- `POST /v1/orgs/:orgId/commands/validate`
+- `POST /v1/orgs/:orgId/commands/render-preview`
+
+### Tools
+
+- `GET /v1/orgs/:orgId/tools`
+- `POST /v1/orgs/:orgId/tools`
+- `GET /v1/orgs/:orgId/tools/:configObjectId`
+- `POST /v1/orgs/:orgId/tools/:configObjectId/versions`
+- `POST /v1/orgs/:orgId/tools/analyze`
+- `POST /v1/orgs/:orgId/tools/validate`
+
+### MCPs
+
+- `GET /v1/orgs/:orgId/mcps`
+- `POST /v1/orgs/:orgId/mcps`
+- `GET /v1/orgs/:orgId/mcps/:configObjectId`
+- `POST /v1/orgs/:orgId/mcps/:configObjectId/versions`
+- `POST /v1/orgs/:orgId/mcps/validate`
+- `POST /v1/orgs/:orgId/mcps/:configObjectId/test-connection`
+- `POST /v1/orgs/:orgId/mcps/:configObjectId/install-check`
+
+## Plugins
+
+- `GET /v1/orgs/:orgId/plugins`
+- `GET /v1/orgs/:orgId/plugins/:pluginId`
+- `POST /v1/orgs/:orgId/plugins`
+- `PATCH /v1/orgs/:orgId/plugins/:pluginId`
+- `POST /v1/orgs/:orgId/plugins/:pluginId/archive`
+- `POST /v1/orgs/:orgId/plugins/:pluginId/restore`
+
+### Plugin membership endpoints
+
+- `GET /v1/orgs/:orgId/plugins/:pluginId/config-objects`
+- `POST /v1/orgs/:orgId/plugins/:pluginId/config-objects`
+- `DELETE /v1/orgs/:orgId/plugins/:pluginId/config-objects/:configObjectId`
+- `GET /v1/orgs/:orgId/plugins/:pluginId/resolved`
+
+### Optional plugin release endpoints
+
+- `GET /v1/orgs/:orgId/plugins/:pluginId/releases`
+- `POST /v1/orgs/:orgId/plugins/:pluginId/releases`
+- `GET /v1/orgs/:orgId/plugins/:pluginId/releases/:releaseId`
+
+### Plugin access endpoints
+
+- `GET /v1/orgs/:orgId/plugins/:pluginId/access`
+- `POST /v1/orgs/:orgId/plugins/:pluginId/access`
+- `DELETE /v1/orgs/:orgId/plugins/:pluginId/access/:grantId`
+
+## Marketplaces
+
+- `GET /v1/orgs/:orgId/marketplaces`
+- `GET /v1/orgs/:orgId/marketplaces/:marketplaceId`
+- `POST /v1/orgs/:orgId/marketplaces`
+- `PATCH /v1/orgs/:orgId/marketplaces/:marketplaceId`
+- `POST /v1/orgs/:orgId/marketplaces/:marketplaceId/archive`
+- `POST /v1/orgs/:orgId/marketplaces/:marketplaceId/restore`
+
+### Marketplace/plugin membership endpoints
+
+- `GET /v1/orgs/:orgId/marketplaces/:marketplaceId/plugins`
+- `POST /v1/orgs/:orgId/marketplaces/:marketplaceId/plugins`
+- `DELETE /v1/orgs/:orgId/marketplaces/:marketplaceId/plugins/:pluginId`
+
+### Marketplace access endpoints
+
+- `GET /v1/orgs/:orgId/marketplaces/:marketplaceId/access`
+- `POST /v1/orgs/:orgId/marketplaces/:marketplaceId/access`
+- `DELETE /v1/orgs/:orgId/marketplaces/:marketplaceId/access/:grantId`
+
+## Connector accounts
+
+- `GET /v1/orgs/:orgId/connector-accounts`
+- `POST /v1/orgs/:orgId/connector-accounts`
+- `GET /v1/orgs/:orgId/connector-accounts/:connectorAccountId`
+- `POST /v1/orgs/:orgId/connector-accounts/:connectorAccountId/disconnect`
+
+## Connector instances
+
+- `GET /v1/orgs/:orgId/connector-instances`
+- `POST /v1/orgs/:orgId/connector-instances`
+- `GET /v1/orgs/:orgId/connector-instances/:connectorInstanceId`
+- `PATCH /v1/orgs/:orgId/connector-instances/:connectorInstanceId`
+- `POST /v1/orgs/:orgId/connector-instances/:connectorInstanceId/archive`
+- `POST /v1/orgs/:orgId/connector-instances/:connectorInstanceId/disable`
+- `POST /v1/orgs/:orgId/connector-instances/:connectorInstanceId/enable`
+
+### Connector instance access endpoints
+
+- `GET /v1/orgs/:orgId/connector-instances/:connectorInstanceId/access`
+- `POST /v1/orgs/:orgId/connector-instances/:connectorInstanceId/access`
+- `DELETE /v1/orgs/:orgId/connector-instances/:connectorInstanceId/access/:grantId`
+
+## Connector targets
+
+- `GET /v1/orgs/:orgId/connector-instances/:connectorInstanceId/targets`
+- `POST /v1/orgs/:orgId/connector-instances/:connectorInstanceId/targets`
+- `GET /v1/orgs/:orgId/connector-targets/:connectorTargetId`
+- `PATCH /v1/orgs/:orgId/connector-targets/:connectorTargetId`
+- `POST /v1/orgs/:orgId/connector-targets/:connectorTargetId/resync`
+
+Example GitHub target body:
+
+```json
+{
+  "type": "github",
+  "remoteId": "org/repo",
+  "targetKind": "repository_branch",
+  "config": {
+    "repositoryId": 123456,
+    "repositoryFullName": "org/repo",
+    "branch": "main",
+    "ref": "refs/heads/main"
+  }
+}
+```
+
+## Connector mappings
+
+- `GET /v1/orgs/:orgId/connector-targets/:connectorTargetId/mappings`
+- `POST /v1/orgs/:orgId/connector-targets/:connectorTargetId/mappings`
+- `PATCH /v1/orgs/:orgId/connector-mappings/:connectorMappingId`
+- `DELETE /v1/orgs/:orgId/connector-mappings/:connectorMappingId`
+- `POST /v1/orgs/:orgId/connector-mappings/:connectorMappingId/preview`
+
+Example mapping body:
+
+```json
+{
+  "mappingKind": "path",
+  "selector": "/sales/skills/**",
+  "objectType": "skill",
+  "pluginId": "plugin_123",
+  "autoAddToPlugin": true,
+  "config": {
+    "parserMode": "opencode"
+  }
+}
+```
+
+## Connector sync events
+
+- `GET /v1/orgs/:orgId/connector-sync-events`
+- `GET /v1/orgs/:orgId/connector-sync-events/:connectorSyncEventId`
+- `POST /v1/orgs/:orgId/connector-sync-events/:connectorSyncEventId/retry`
+
+## GitHub-specific admin endpoints
+
+- `POST /v1/orgs/:orgId/connectors/github/setup`
+- `POST /v1/orgs/:orgId/connectors/github/accounts`
+- `GET /v1/orgs/:orgId/connectors/github/accounts/:connectorAccountId/repositories`
+- `POST /v1/orgs/:orgId/connectors/github/validate-target`
+
+## Response conventions
+
+List:
+
+```json
+{
+  "items": [],
+  "nextCursor": null
+}
+```
+
+Detail:
+
+```json
+{
+  "item": {}
+}
+```
+
+Mutation:
+
+```json
+{
+  "ok": true,
+  "item": {}
+}
+```
+
+Async action:
+
+```json
+{
+  "ok": true,
+  "queued": true,
+  "job": {
+    "id": "job_123"
+  }
+}
+```
diff --git a/prds/new-plugin-arch/api.md b/prds/new-plugin-arch/api.md
new file mode 100644
index 0000000000..9cba3c7f73
--- /dev/null
+++ b/prds/new-plugin-arch/api.md
@@ -0,0 +1,72 @@
+# New Plugin Arch API
+
+This document is now the API index for the new plugin architecture.
+
+## API docs
+
+- `prds/new-plugin-arch/admin-api.md`
+  - authenticated admin and direct-management APIs
+- `prds/new-plugin-arch/delivery-api.md`
+  - future client delivery and install-state APIs
+- `prds/new-plugin-arch/webhooks-api.md`
+  - public webhook ingress and async sync trigger shapes
+- `prds/new-plugin-arch/GitHub-connector.md`
+  - GitHub-specific connector flow, permissions, webhook behavior, and reconciliation model
+
+## Shared principles
+
+- expose logical resources, not raw tables;
+- current-state endpoints should return projected current rows, not version-history duplicates;
+- version/history endpoints should be explicit;
+- delivery APIs should stay distinct from admin mutation APIs;
+- public webhooks should stay distinct from authenticated APIs.
+
+## Suggested split of responsibility
+
+### Admin API
+
+Use for:
+
+- config object CRUD
+- version history access
+- plugin management
+- marketplace management
+- access grants
+- connector setup and mapping management
+- sync-event inspection and retries
+
+### Delivery API
+
+Use for:
+
+- listing accessible plugins for clients/users
+- manifest retrieval
+- download/install payloads
+- reporting and comparing installed state
+
+### Webhooks API
+
+Use for:
+
+- public connector ingress
+- signature verification
+- normalized webhook envelope handling
+- async sync enqueue contracts
+
+## Current recommendations
+
+- keep one shared `config-objects` admin surface and add type-specific convenience endpoints where UI needs them;
+- keep current-state search/list endpoints separate from version-history endpoints;
+- treat plugin access management as a first-class API surface;
+- treat marketplace access and marketplace-plugin composition as first-class API surfaces;
+- keep connector setup, target, mapping, and sync APIs explicit;
+- keep public webhook ingress separate from authenticated APIs.
+
+## Current gaps
+
+Still to decide:
+
+- exact auth model for end-user delivery endpoints;
+- rolling-latest vs release-snapshot delivery semantics;
+- which type-specific validate/preview endpoints are public vs internal-only;
+- whether bulk mutation endpoints are needed for large plugin or mapping edits.
diff --git a/prds/new-plugin-arch/config-types/README.md b/prds/new-plugin-arch/config-types/README.md
new file mode 100644
index 0000000000..8c61afa6e3
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/README.md
@@ -0,0 +1,29 @@
+# Config Types
+
+These docs describe the unique data shape for each supported config type in the new plugin architecture.
+
+They build on the shared model in `prds/new-plugin-arch/datastructure.md`:
+
+- `config_object` = current searchable projection
+- `config_object_version` = immutable history and latest-version source of truth
+
+Related API design:
+
+- `prds/new-plugin-arch/api.md`
+
+Type-specific docs:
+
+- `prds/new-plugin-arch/config-types/skills.md`
+- `prds/new-plugin-arch/config-types/agents.md`
+- `prds/new-plugin-arch/config-types/commands.md`
+- `prds/new-plugin-arch/config-types/tools.md`
+- `prds/new-plugin-arch/config-types/mcps.md`
+
+Recommended pattern across all types:
+
+- keep one shared `config_object` / `config_object_version` backbone;
+- project current, queryable metadata onto `config_object`;
+- preserve the raw source artifact on `config_object_version`;
+- encrypt key payload/content columns at rest across all config types;
+- keep friendly metadata like `title` and `description` plaintext when needed for dashboard display and search;
+- add one type-specific current projection table per type when the shape is meaningfully different or needs fast filtering.
diff --git a/prds/new-plugin-arch/config-types/agents.md b/prds/new-plugin-arch/config-types/agents.md
new file mode 100644
index 0000000000..4ef186ad31
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/agents.md
@@ -0,0 +1,117 @@
+# Agents Data Structure
+
+## Source formats to support
+
+Source: `https://opencode.ai/docs/agents/`
+
+OpenCode agents can come from:
+
+- markdown files in `.opencode/agents/`
+- JSON config under `agent` in `opencode.json`
+
+For markdown agents:
+
+- filename becomes the agent name
+- file body becomes the prompt
+- frontmatter provides structured config
+
+Recognized OpenCode agent fields from the config schema:
+
+- `model`
+- `variant`
+- `temperature`
+- `top_p`
+- `prompt`
+- `tools` deprecated
+- `disable`
+- `description`
+- `mode` (`subagent`, `primary`, `all`)
+- `hidden`
+- `options`
+- `color`
+- `steps`
+- `maxSteps` deprecated
+- `permission`
+
+Important schema behavior:
+
+- unknown keys are allowed and moved into `options`
+- legacy `tools` config is converted into permissions
+- legacy `maxSteps` is normalized into `steps`
+
+## Canonical storage recommendation
+
+### Shared tables
+
+- `config_object`
+- `config_object_version`
+
+### Current projection table
+
+Add:
+
+- `config_object_agent_current`
+
+Suggested columns:
+
+- `config_object_id`
+- `agent_name`
+- `description`
+- `prompt_text`
+- `mode`
+- `hidden` nullable
+- `disabled` nullable
+- `model` nullable
+- `variant` nullable
+- `temperature` nullable
+- `top_p` nullable
+- `steps` nullable
+- `color` nullable
+- `permission_json` nullable
+- `options_json` nullable
+- `legacy_tools_json` nullable
+- `source_format` (`markdown`, `json`, `connector`)
+
+## Raw version storage
+
+Each version should preserve:
+
+- raw markdown or raw JSON source
+- parsed frontmatter/config JSON
+- raw prompt body if markdown-based
+- normalized config JSON after alias/deprecation handling if we want auditability
+
+## Search and title strategy
+
+Friendly title strategy:
+
+- use the agent name derived from filename or JSON key
+
+Description strategy:
+
+- use `description` as the primary searchable summary
+- if needed, include prompt text in `search_text`, but not as the main title/description fields
+
+Default current search should hit:
+
+- `config_object.title`
+- `config_object.description`
+- optional `config_object_agent_current.mode`
+- optional `config_object_agent_current.model`
+
+## Why an agent-specific table helps
+
+Agents have a configuration-heavy shape with many current-state filters that may matter in UI:
+
+- mode
+- model
+- hidden/disabled state
+- steps cap
+- permission summary
+
+Putting these on a type-specific projection table avoids repeated JSON scans.
+
+## Table recommendation summary
+
+- shared backbone: `config_object`, `config_object_version`
+- type projection: `config_object_agent_current`
diff --git a/prds/new-plugin-arch/config-types/commands.md b/prds/new-plugin-arch/config-types/commands.md
new file mode 100644
index 0000000000..cb661f9330
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/commands.md
@@ -0,0 +1,92 @@
+# Commands Data Structure
+
+## Source formats to support
+
+Source: `https://opencode.ai/docs/commands/`
+
+OpenCode commands can come from:
+
+- markdown files in `.opencode/commands/`
+- JSON config under `command` in `opencode.json`
+
+For markdown commands:
+
+- filename becomes the command name
+- file body becomes the template
+
+Recognized command fields from the config schema:
+
+- `template` required
+- `description` optional
+- `agent` optional
+- `model` optional
+- `subtask` optional
+
+Runtime template features are part of the content rather than top-level fields:
+
+- `$ARGUMENTS`, `$1`, `$2`, etc.
+- shell injection like `!\`command\``
+- file references like `@path/to/file`
+
+## Canonical storage recommendation
+
+### Shared tables
+
+- `config_object`
+- `config_object_version`
+
+### Current projection table
+
+Add:
+
+- `config_object_command_current`
+
+Suggested columns:
+
+- `config_object_id`
+- `command_name`
+- `description` nullable
+- `template_text`
+- `default_agent` nullable
+- `model` nullable
+- `subtask` nullable
+- `source_format` (`markdown`, `json`, `connector`)
+- `uses_arguments` boolean
+- `uses_shell_injection` boolean
+- `uses_file_references` boolean
+
+## Raw version storage
+
+Each version should preserve:
+
+- raw markdown or raw JSON source
+- parsed command config JSON
+- raw template text
+
+## Search and title strategy
+
+Friendly title strategy:
+
+- use the command name derived from filename or JSON key
+
+Description strategy:
+
+- use explicit `description` when present
+- if missing, optionally derive a short summary from the first sentence of `template_text` for dashboard display only
+
+Search should hit current command rows, not version history.
+
+## Why a command-specific table helps
+
+Commands are structurally simple, but users will likely want to filter by:
+
+- target agent
+- whether the command runs as a subtask
+- whether the template uses arguments or shell injection
+
+These are current-state concerns, so a small projection table is enough.
+
+## Table recommendation summary
+
+- shared backbone: `config_object`, `config_object_version`
+- type projection: `config_object_command_current`
diff --git a/prds/new-plugin-arch/config-types/mcps.md b/prds/new-plugin-arch/config-types/mcps.md
new file mode 100644
index 0000000000..8d12becacc
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/mcps.md
@@ -0,0 +1,142 @@
+# MCPs Data Structure
+
+## Source formats to support
+
+Source docs:
+
+- `https://opencode.ai/docs/mcp-servers/`
+
+Actual allowed keys verified from the OpenCode SDK/config schema:
+
+- local MCP
+  - `type: "local"`
+  - `command: string[]`
+  - `environment?: Record<string, string>`
+  - `enabled?: boolean`
+  - `timeout?: number`
+- remote MCP
+  - `type: "remote"`
+  - `url: string`
+  - `enabled?: boolean`
+  - `headers?: Record<string, string>`
+  - `oauth?: McpOAuthConfig | false`
+  - `timeout?: number`
+- OAuth config
+  - `clientId?: string`
+  - `clientSecret?: string`
+  - `scope?: string`
+
+Important schema behavior:
+
+- the OpenCode MCP config is strict and discriminated by `type`
+- unlike agents, MCP objects do not accept arbitrary extra keys in the core schema
+
+## Canonical storage recommendation
+
+### Shared tables
+
+- `config_object`
+- `config_object_version`
+
+### Current projection table
+
+Add:
+
+- `config_object_mcp_current`
+
+Suggested columns:
+
+- `config_object_id`
+- `mcp_name`
+- `connection_type` (`local`, `remote`)
+- `enabled` nullable
+- `timeout_ms` nullable
+- `command_json` nullable
+- `environment_json` nullable
+- `url` nullable
+- `headers_json` nullable
+- `oauth_mode` nullable (`auto`, `configured`, `disabled`)
+- `oauth_client_id` nullable
+- `oauth_scope` nullable
+- `has_oauth_client_secret` boolean nullable
+
+### OpenWork-specific local install fields
+
+For local MCPs, we likely want extra product fields that are not part of the upstream OpenCode schema but help with distribution and setup.
+
+Suggested additional columns:
+
+- `requires_install` boolean nullable
+- `install_command_script` nullable
+- `install_docs_link` nullable
+- `install_notes` nullable
+
+Optional future additions:
+
+- `install_check_command` nullable
+- `platforms_json` nullable
+- `package_manager` nullable
+
+## Raw version storage
+
+Each version should preserve:
+
+- raw JSON or markdown-derived config source
+- normalized MCP config JSON
+- parser version
+
+## Secret-handling note
+
+MCPs are the most likely type to contain secrets or sensitive values.
+
+Recommendations:
+
+- treat `headers` and `environment` as potentially secret-bearing;
+- like all config-object key payload columns, MCP core config data should be encrypted at rest;
+- avoid copying secret material into searchable top-level text fields;
+- if we later support secure secret storage, keep secret references separate from public metadata.
+
+This is especially important for:
+
+- remote MCP headers
+- local MCP environment values
+- OAuth client secrets
+
+## Search and title strategy
+
+Friendly title strategy:
+
+- use the MCP object name from the config key
+
+Description strategy:
+
+- MCP objects do not have a native `description` field in the upstream schema;
+- for dashboard UX, we should probably allow a local friendly description on `config_object.description` even though it is not part of the OpenCode MCP payload.
+
+This means MCPs are a strong example of:
+
+- raw source-of-truth in version history
+- plus locally-managed friendly metadata on the parent object
+
+## Why an MCP-specific table helps
+
+MCPs have discriminated connection shapes and operational concerns that we will want to filter by:
+
+- local vs remote
+- enabled/disabled
+- install required
+- OAuth mode
+- timeout
+
+These are current operational fields and should not require parsing historical versions for every UI query.
+
+## Table recommendation summary
+
+- shared backbone: `config_object`, `config_object_version`
+- type projection: `config_object_mcp_current`
+
+## Open questions specific to MCPs
+
+- Should local install scripts be executable content we store directly, or pointers to bundled files/docs?
+- Should secret-bearing headers and environment values be split into secure secret references from day one?
+- Do we want friendly dashboard metadata for MCPs to be always locally editable even when the core MCP payload is connector-managed?
diff --git a/prds/new-plugin-arch/config-types/skills.md b/prds/new-plugin-arch/config-types/skills.md
new file mode 100644
index 0000000000..6a58e45e21
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/skills.md
@@ -0,0 +1,145 @@
+# Skills Data Structure
+
+## Source formats to support
+
+We should support both OpenCode-native and Claude-compatible skill formats.
+
+### OpenCode skill shape
+
+Source: `https://opencode.ai/docs/skills/`
+
+Expected file layout:
+
+- directory name is the skill name
+- entry file is always `SKILL.md`
+
+Recognized frontmatter fields in OpenCode:
+
+- `name` required
+- `description` required
+- `license` optional
+- `compatibility` optional
+- `metadata` optional string-to-string map
+
+Important OpenCode constraints:
+
+- `name` must match the containing directory name
+- `name` is lowercase alphanumeric with single hyphen separators
+- `description` is 1-1024 chars
+
+### Claude-compatible skill shape
+
+Sources:
+
+- `https://code.claude.com/docs/en/skills`
+- OpenCode also discovers `.claude/skills/*/SKILL.md`
+
+Claude-compatible frontmatter can additionally include:
+
+- `when_to_use`
+- `argument-hint`
+- `disable-model-invocation`
+- `user-invocable`
+- `allowed-tools`
+- `model`
+- `effort`
+- `context`
+- `agent`
+- `hooks`
+- `paths`
+- `shell`
+
+Claude also supports supporting files alongside `SKILL.md` inside the skill directory.
+
+## Canonical storage recommendation
+
+### Shared tables
+
+Use the shared tables from `prds/new-plugin-arch/datastructure.md`:
+
+- `config_object`
+- `config_object_version`
+
+### Current projection table
+
+Add a skill-specific current projection table:
+
+- `config_object_skill_current`
+
+This lets us query current skill-specific metadata without hitting historical versions.
+
+Suggested columns:
+
+- `config_object_id`
+- `dialect` (`opencode`, `claude`, `hybrid`)
+- `skill_name`
+- `description`
+- `license` nullable
+- `compatibility` nullable
+- `metadata_json` nullable
+- `when_to_use` nullable
+- `argument_hint` nullable
+- `disable_model_invocation` nullable
+- `user_invocable` nullable
+- `allowed_tools_json` nullable
+- `model` nullable
+- `effort` nullable
+- `context_mode` nullable
+- `subagent` nullable
+- `hooks_json` nullable
+- `paths_json` nullable
+- `shell` nullable
+- `has_supporting_files` boolean
+- `body_markdown` optional if we want a denormalized current copy for fast preview
+
+## Raw version storage
+
+Each `config_object_version` for a skill should preserve:
+
+- raw `SKILL.md` content
+- parsed frontmatter JSON
+- parsed body markdown
+- parser dialect used
+- extraction status / warnings if parsing was partial
+
+If the source came from a connector-backed skill directory, keep path data so we can recreate:
+
+- `SKILL.md` relative path
+- skill directory path
+- any supporting file paths via connector source records
+
+## Search and title strategy
+
+For skills, current search should hit:
+
+- `config_object.title`
+- `config_object.description`
+- optionally `config_object.search_text`
+- optionally `config_object_skill_current.when_to_use`
+
+Friendly title strategy:
+
+- prefer frontmatter `name`
+- if missing in Claude-compatible input, fall back to directory name
+
+Description strategy:
+
+- prefer frontmatter `description`
+- optionally append `when_to_use` into `search_text`, but do not necessarily surface it as the main dashboard description
+
+## Why a skill-specific table helps
+
+Skills have the richest frontmatter of any planned type.
+
+A dedicated table helps with:
+
+- filtering skills by invocation mode
+- showing whether a skill is user-invocable vs model-invocable
+- showing bound model / effort / subagent behavior
+- preserving compatible subsets across OpenCode and Claude skill formats
+
+## Table recommendation summary
+
+- shared backbone: `config_object`, `config_object_version`
+- type projection: `config_object_skill_current`
+- connector path history: `connector_source_binding`, `connector_source_tombstone`
diff --git a/prds/new-plugin-arch/config-types/tools.md b/prds/new-plugin-arch/config-types/tools.md
new file mode 100644
index 0000000000..9a5a44acfa
--- /dev/null
+++ b/prds/new-plugin-arch/config-types/tools.md
@@ -0,0 +1,115 @@
+# Tools Data Structure
+
+## Scope
+
+In this doc, `tool` means a custom OpenCode tool definition, not a built-in native tool like `read` or `bash`.
+
+Source: `https://opencode.ai/docs/tools/` plus `https://opencode.ai/docs/custom-tools/`
+
+## Source formats to support
+
+Custom tools are code modules, usually TypeScript or JavaScript files, placed in:
+
+- `.opencode/tools/`
+- `~/.config/opencode/tools/`
+
+Observed tool definition shape from the plugin helper:
+
+- `description` required
+- `args` required
+- `execute(args, context)` required
+
+The helper type is effectively:
+
+```ts
+tool({
+  description: string,
+  args: ZodRawShape,
+  execute(args, context): Promise<string>
+})
+```
+
+Naming behavior:
+
+- default export -> tool name comes from filename
+- multiple named exports -> tool names become `<filename>_<exportname>`
+
+## Canonical storage recommendation
+
+### Shared tables
+
+- `config_object`
+- `config_object_version`
+
+### Current projection table
+
+Add:
+
+- `config_object_tool_current`
+
+Suggested columns:
+
+- `config_object_id`
+- `tool_name`
+- `module_file_name`
+- `module_relative_path` nullable
+- `export_name` nullable
+- `definition_style` (`default_export`, `named_export`)
+- `description`
+- `args_schema_json` nullable
+- `args_schema_text` nullable
+- `runtime_language` nullable
+- `static_analysis_status`
+- `is_multi_tool_module` boolean
+
+## Raw version storage
+
+Each version should preserve:
+
+- raw module source code
+- parsed metadata from static analysis if available
+- extraction warnings if analysis is partial or failed
+
+## Important design note
+
+Tools are harder to normalize than skills, agents, or commands because the source of truth is executable code.
+
+That means:
+
+- raw code must remain authoritative for reconstruction;
+- description and args metadata should be treated as extracted projections;
+- extraction may need AST parsing or other static analysis;
+- if static analysis fails, the object should still be storable, but may show degraded metadata in the UI.
+
+## Search and title strategy
+
+Friendly title strategy:
+
+- use the final resolved tool name
+
+Description strategy:
+
+- use extracted `description`
+- if extraction fails, fall back to file name and a generic label like `Custom tool definition`
+
+## Why a tool-specific table helps
+
+Tools are code-backed and may need UI around:
+
+- resolved tool names
+- export style
+- argument schema preview
+- static analysis health
+
+These are not good candidates for repeated JSON scanning of version history.
+
+## Table recommendation summary
+
+- shared backbone: `config_object`, `config_object_version`
+- type projection: `config_object_tool_current`
+
+## Open questions specific to tools
+
+- Do we require successful static analysis before a tool can be published?
+- Do we support only JS/TS source at first, or arbitrary-language wrappers as first-class tool objects?
+- Do we want to store a JSON Schema projection of args, or only a human-readable summary?
diff --git a/prds/new-plugin-arch/datastructure.md b/prds/new-plugin-arch/datastructure.md
new file mode 100644
index 0000000000..19019db299
--- /dev/null
+++ b/prds/new-plugin-arch/datastructure.md
@@ -0,0 +1,585 @@
+# New Plugin Arch Data Structure
+
+This document holds the proposed data model and schema direction for the new plugin architecture.
+
+It is intentionally separate from `prds/new-plugin-arch/plan.md` so the plan can stay focused on product direction and architectural decisions while this file captures implementation-oriented structure.
+
+Type-specific shape docs live in:
+
+- `prds/new-plugin-arch/config-types/README.md`
+
+API design lives in:
+
+- `prds/new-plugin-arch/api.md`
+
+RBAC design lives in:
+
+- `prds/new-plugin-arch/rbac.md`
+
+## Guiding rules
+
+- config objects are first-class and versioned;
+- plugins link to config object identities, never directly to object versions;
+- plugin resolution always uses the latest active object version;
+- marketplace resolution always uses the latest active plugin state;
+- latest version is derived from `config_object_version` ordering, not stored separately on `config_object`;
+- key config payload/data columns should be encrypted at rest;
+- friendly current metadata like `title` and `description` can remain plaintext for UI and search;
+- connector provenance is stored explicitly;
+- deletes are soft and path tombstones are preserved for connector-managed items;
+- RBAC shape should stay consistent across config objects, plugins, and connectors.
+
+## Core tables
+
+### `config_object`
+
+Stable identity row for one logical config object.
+
+Suggested columns:
+
+- `id`
+- `organization_id`
+- `object_type` (`skill`, `mcp`, `command`, `agent`, `hook`, `context`, `custom`)
+- `source_mode` (`cloud`, `import`, `connector`)
+- `title`
+- `description` nullable
+- `search_text` nullable
+- `slug` or stable org-local key if needed
+- `current_file_name` nullable
+- `current_file_extension` nullable
+- `current_relative_path` nullable
+- `status` (`active`, `inactive`, `deleted`, `archived`, `ingestion_error`)
+- `created_by_org_membership_id`
+- `connector_instance_id` nullable
+- `created_at`
+- `updated_at`
+- `deleted_at` nullable
+
+Notes:
+
+- this is the row plugins reference;
+- this is also the row current search and dashboard queries should hit;
+- title/description on this row are the current projection derived from the latest version, not an independent historical source of truth;
+- `title`, `description`, and `search_text` may remain plaintext because they are intended for dashboard rendering and search;
+- `updated_at` is convenience metadata only and should not be treated as the source of truth for latest version resolution;
+- connector-managed objects still use the same identity table.
+
+### `config_object_version`
+
+Immutable content/history row for each version of a config object.
+
+Suggested columns:
+
+- `id`
+- `config_object_id`
+- `normalized_payload_json`
+- `raw_source_text` nullable
+- `schema_version` or parser version nullable
+- `created_via` (`cloud`, `import`, `connector`, `system`)
+- `created_by_org_membership_id` nullable
+- `connector_sync_event_id` nullable
+- `source_revision_ref` nullable
+- `is_deleted_version` boolean default false
+- `created_at`
+
+Notes:
+
+- object-type-specific fields should generally live in payload JSON, not as many sparse columns on the shared table;
+- version rows should not be the primary surface for current library search because that would create duplicate hits across historical versions of the same object;
+- a deleted source file can create a terminal deleted version while leaving the identity row intact;
+- `normalized_payload_json`, `raw_source_text`, and any equivalent key content columns for config objects should be encrypted at rest;
+- `config_object_version` is the single source of truth for version history and latest-version lookup.
+
+Current metadata projection rule:
+
+- after creating a new latest version, parse whatever title/description/friendly metadata can be derived from that version and write the current projection onto the parent `config_object` row;
+- current dashboard/search experiences should query `config_object`, not `config_object_version`.
+
+Suggested index:
+
+- (`config_object_id`, `created_at` DESC, `id` DESC)
+
+Latest lookup rule:
+
+- latest version for an object = newest row for that `config_object_id`, ordered by `created_at DESC, id DESC`.
+- `created_at` should be database-generated so ordering stays authoritative.
+
+Version number note:
+
+- v1 does not require a separate version-number column on `config_object_version`;
+- immutable ids plus `created_at` are enough for history and latest-version resolution;
+- add a human-facing version number later only if product UX needs ordered revision labels.
+
+Metadata extraction note:
+
+- some config types derive title/description from file contents, such as skill frontmatter;
+- other config types may derive friendly metadata from file name, path, or type-specific parsing rules;
+- type-specific extraction rules should run when projecting the latest version onto `config_object`.
+
+### `plugin`
+
+Stable deliverable row.
+
+Suggested columns:
+
+- `id`
+- `organization_id`
+- `name`
+- `description`
+- `status`
+- `created_by_org_membership_id`
+- `created_at`
+- `updated_at`
+- `deleted_at` nullable
+
+Notes:
+
+- a plugin is the administrator-facing unit of delivery;
+- a plugin contains config object identities, not pinned content versions;
+- when resolving a plugin, the system selects the newest version row for each linked object.
+
+### `plugin_config_object`
+
+Membership join between plugins and config object identities.
+
+Suggested columns:
+
+- `id`
+- `plugin_id`
+- `config_object_id`
+- `membership_source` (`manual`, `connector`, `api`, `system`)
+- `connector_mapping_id` nullable
+- `created_by_org_membership_id` nullable
+- `created_at`
+- `removed_at` nullable
+
+Constraints:
+
+- unique active membership on (`plugin_id`, `config_object_id`)
+
+Notes:
+
+- current implementation keeps one logical membership row per (`plugin_id`, `config_object_id`) and uses `removed_at` for soft removal/reactivation rather than append-only history rows;
+- if an object later becomes deleted, the membership row can remain while delivery skips that object.
+
+### `marketplace`
+
+Stable top-level grouping row for plugins.
+
+Suggested columns:
+
+- `id`
+- `organization_id`
+- `name`
+- `description`
+- `status`
+- `created_by_org_membership_id`
+- `created_at`
+- `updated_at`
+- `deleted_at` nullable
+
+Notes:
+
+- an org can have multiple marketplaces;
+- a marketplace groups plugins, not config objects directly;
+- marketplace access can be the primary discovery/delivery control plane for curated plugin catalogs.
+
+### `marketplace_plugin`
+
+Membership join between marketplaces and plugins.
+
+Suggested columns:
+
+- `id`
+- `marketplace_id`
+- `plugin_id`
+- `membership_source` (`manual`, `connector`, `api`, `system`)
+- `created_by_org_membership_id` nullable
+- `created_at`
+- `removed_at` nullable
+
+Constraints:
+
+- unique active membership on (`marketplace_id`, `plugin_id`)
+
+Notes:
+
+- a plugin may appear in multiple marketplaces;
+- current implementation should keep one logical membership row per (`marketplace_id`, `plugin_id`) and reactivate it by clearing `removed_at`.
+
+## Access and RBAC tables
+
+We want the same RBAC model across config objects, plugins, and connectors.
+
+There are two realistic schema options:
+
+1. Separate access tables per resource type
+   - better foreign keys
+   - more repeated schema
+2. One generic access table
+   - easier shared logic
+   - weaker relational guarantees
+
+Current recommendation:
+
+- start with separate tables that share the same shape.
+
+### `plugin_access_grant`
+
+Suggested columns:
+
+- `id`
+- `plugin_id`
+- `org_membership_id` nullable
+- `team_id` nullable
+- `org_wide` boolean default false
+- `role` or `permission_level`
+- `created_by_org_membership_id`
+- `created_at`
+- `removed_at` nullable
+
+### `config_object_access_grant`
+
+Same shape as plugin access, but scoped to `config_object_id`.
+
+### `marketplace_access_grant`
+
+Same shape as plugin access, but scoped to `marketplace_id`.
+
+### `connector_instance_access_grant`
+
+Same shape as plugin access, but scoped to `connector_instance_id`.
+
+RBAC note:
+
+- plugin delivery may be implemented primarily by plugin access grants;
+- marketplace access may sit one level above plugin access and provide discovery/view inheritance into contained plugins;
+- if a team has access to a plugin, that is effectively the publish step.
+- config objects and plugins should be private by default;
+- sharing with the whole org should be represented as one org-wide grant, not per-user entries.
+- use `org_wide = true` for v1.
+- member and team sharing should continue to use normal explicit grant rows.
+- current implementation also uses one logical grant row per target principal and reactivates it by clearing `removed_at`.
+
+## Connector tables
+
+### `connector_account`
+
+Represents one authenticated or installed connector relationship.
+
+Examples:
+
+- one GitHub App installation
+- one future API credential binding
+
+Suggested columns:
+
+- `id`
+- `organization_id`
+- `connector_type` (`github`, etc.)
+- `remote_id`
+- `external_account_ref`
+- `display_name`
+- `status`
+- `created_by_org_membership_id`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- secrets should stay out of git-backed repo files and remain private;
+- `id` is OpenWork's local primary key, while `remote_id` is the stable connector-side identifier we can use across different connector families;
+- this row is the reusable "one-time setup" layer.
+
+### `connector_instance`
+
+Represents one configured use of a connector account.
+
+Examples:
+
+- a GitHub repo + branch configuration
+- a future API collection endpoint mapping
+
+Suggested columns:
+
+- `id`
+- `organization_id`
+- `connector_account_id`
+- `connector_type`
+- `remote_id` nullable
+- `name`
+- `status`
+- `instance_config_json`
+- `last_synced_at` nullable
+- `last_sync_status` nullable
+- `last_sync_cursor` nullable
+- `created_by_org_membership_id`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- one connector instance may feed multiple plugins;
+- one plugin may include objects from multiple connector instances;
+- one connector instance may ingest objects without direct plugin auto-membership;
+- `remote_id` is optional here because some connector instances may not map cleanly to one remote object, while others will.
+
+### `connector_target`
+
+Represents the external source target inside an instance.
+
+Examples:
+
+- repo owner/name
+- branch
+- API endpoint family
+- collection identifier
+
+Suggested columns:
+
+- `id`
+- `connector_instance_id`
+- `connector_type`
+- `remote_id`
+- `target_kind`
+- `external_target_ref`
+- `target_config_json`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- this table lets us support git and non-git connectors with one shared abstraction;
+- `remote_id` should be the canonical external identifier for the target, such as `org/repo` for GitHub repo targets.
+
+### `connector_mapping`
+
+Maps part of a connector target into a config object type and optional plugin behavior.
+
+Suggested columns:
+
+- `id`
+- `connector_instance_id`
+- `connector_target_id`
+- `connector_type`
+- `remote_id` nullable
+- `mapping_kind` (`path`, `api`, `custom`)
+- `selector`
+- `object_type`
+- `plugin_id` nullable
+- `auto_add_to_plugin` boolean
+- `mapping_config_json`
+- `created_at`
+- `updated_at`
+
+Examples:
+
+- selector `/sales/skills/**` -> `skill` -> plugin A
+- selector `/sales/commands/**` -> `command` -> plugin A
+- selector `/finance/skills/**` -> `skill` -> plugin B
+
+Notes:
+
+- this is the row that captures the default parent-path -> plugin behavior;
+- advanced/manual plugins can still include connector-managed objects outside this automatic mapping;
+- `remote_id` can be used if a connector exposes mapping-level remote identifiers, but it is optional.
+
+### `connector_sync_event`
+
+Audit row for each webhook/poll/sync execution.
+
+Suggested columns:
+
+- `id`
+- `connector_instance_id`
+- `connector_target_id` nullable
+- `connector_type`
+- `remote_id` nullable
+- `event_type`
+- `external_event_ref` nullable
+- `source_revision_ref` nullable
+- `status`
+- `summary_json`
+- `started_at`
+- `completed_at` nullable
+
+Notes:
+
+- useful for debugging, replay decisions, and ingestion history;
+- for GitHub this should also capture delivery ids and head commit SHAs inside `summary_json` or promoted columns if we need faster filtering.
+
+### `connector_source_binding`
+
+Links a live config object identity to its external source location.
+
+Suggested columns:
+
+- `id`
+- `config_object_id`
+- `connector_instance_id`
+- `connector_target_id`
+- `connector_mapping_id`
+- `connector_type`
+- `remote_id` nullable
+- `external_locator`
+- `external_stable_ref` nullable
+- `last_seen_source_revision_ref` nullable
+- `status`
+- `created_at`
+- `updated_at`
+- `deleted_at` nullable
+
+Examples of `external_locator`:
+
+- repo path
+- API resource id
+- remote document key
+
+Notes:
+
+- one live object should normally have one active source binding;
+- this is how we know which external path/resource created the object;
+- `remote_id` can hold a stable connector-native file/resource id when the remote system provides one.
+
+### `connector_source_tombstone`
+
+Preserves deleted source locations so we do not accidentally revive old identities.
+
+Suggested columns:
+
+- `id`
+- `connector_instance_id`
+- `connector_target_id`
+- `connector_mapping_id`
+- `connector_type`
+- `remote_id` nullable
+- `external_locator`
+- `former_config_object_id`
+- `deleted_in_sync_event_id`
+- `deleted_source_revision_ref` nullable
+- `created_at`
+
+Notes:
+
+- if the same path later reappears, ingestion creates a new config object identity;
+- this table prevents accidental reconnect of a recreated file to an old object.
+
+## Optional release/install tables
+
+We have not finalized delivery yet, but these are likely candidates.
+
+### `plugin_release`
+
+Optional first-class release/snapshot row for a plugin.
+
+Suggested columns:
+
+- `id`
+- `plugin_id`
+- `release_kind` (`manual`, `system`, `access_change`, `sync_snapshot`)
+- `created_by_org_membership_id` nullable
+- `created_at`
+- `notes` nullable
+
+### `plugin_release_item`
+
+Snapshot of the config object versions included at release time.
+
+Suggested columns:
+
+- `id`
+- `plugin_release_id`
+- `config_object_id`
+- `config_object_version_id`
+- `created_at`
+
+Notes:
+
+- even if runtime delivery is rolling latest, these tables can still be useful for audit, rollback, and support;
+- if we decide releases are unnecessary, these tables can be deferred.
+
+## Suggested write patterns
+
+### Creating a new cloud/import object
+
+1. insert `config_object`
+2. insert first `config_object_version`
+3. parse current metadata from that version and update `config_object.title`, `description`, `search_text`, and any current file metadata
+4. optionally update `config_object.updated_at`
+5. optionally insert `plugin_config_object`
+
+### Creating a new marketplace
+
+1. insert `marketplace`
+2. insert initial `marketplace_access_grant` giving the creator `manager`
+3. optionally insert `marketplace_plugin` rows for any initial plugin set
+
+### Connector sync updating an existing object
+
+1. create `connector_sync_event`
+2. locate active `connector_source_binding`
+3. insert new `config_object_version`
+4. parse current metadata from that version and update the parent `config_object` projection
+5. optionally update `config_object.updated_at`
+6. update `connector_source_binding.last_seen_source_revision_ref`
+
+### Connector sync deleting an object
+
+1. create deleted `config_object_version` or mark identity status as deleted
+2. update `config_object.status` and clear or adjust current searchable projection as needed
+3. close `connector_source_binding`
+4. insert `connector_source_tombstone`
+5. keep `plugin_config_object` history intact
+
+## Latest-version strategy
+
+To keep one source of truth and avoid out-of-date derived state, we should not store `latest_version_id` on `config_object` in v1.
+
+Instead:
+
+- treat `config_object_version` as the only source of truth for version ordering;
+- determine latest by query using `created_at DESC, id DESC`;
+- keep version rows immutable.
+
+Example lookup pattern:
+
+```sql
+select v.*
+from config_object co
+join config_object_version v on v.config_object_id = co.id
+where co.id = ?
+order by v.created_at desc, v.id desc
+limit 1;
+```
+
+Why this is the current recommendation:
+
+- no duplicated latest-version pointer to drift out of sync;
+- no revision counter race condition;
+- simple write path;
+- acceptable read cost given expected version counts and proper indexing;
+- current library search can still stay fast because it queries `config_object`, not historical versions.
+
+Future option:
+
+- if reads later prove too expensive, we can add a derived latest pointer as an optimization, but not as the authoritative source of truth.
+
+## Current schema recommendation
+
+If we had to start implementation now, the minimum useful table set would be:
+
+- `config_object`
+- `config_object_version`
+- `plugin`
+- `plugin_config_object`
+- `plugin_access_grant`
+- `marketplace`
+- `marketplace_plugin`
+- `marketplace_access_grant`
+- `connector_account`
+- `connector_instance`
+- `connector_target`
+- `connector_mapping`
+- `connector_sync_event`
+- `connector_source_binding`
+- `connector_source_tombstone`
diff --git a/prds/new-plugin-arch/delivery-api.md b/prds/new-plugin-arch/delivery-api.md
new file mode 100644
index 0000000000..2d56cad4b3
--- /dev/null
+++ b/prds/new-plugin-arch/delivery-api.md
@@ -0,0 +1,134 @@
+# New Plugin Arch Delivery API
+
+This document covers the future API surface for delivering plugins and config objects to end clients.
+
+This area is still less defined than the admin API.
+
+## Purpose
+
+Delivery endpoints should answer:
+
+- what plugins a user/team can access;
+- what config objects are currently resolved inside a plugin;
+- what content a client should install;
+- what version/state a client currently has.
+
+## Principles
+
+- delivery should expose resolved current state, not raw history by default;
+- access checks should happen at plugin/object delivery boundaries;
+- delivery endpoints should be separate from admin mutation endpoints;
+- clients should be able to fetch manifests before downloading content.
+
+## Likely resources
+
+- accessible plugins
+- plugin manifests
+- config-object download payloads
+- client install state
+- optional plugin release snapshots
+
+## Candidate endpoints
+
+### List accessible plugins for a client/user
+
+- `GET /v1/orgs/:orgId/delivery/plugins`
+
+Suggested query params:
+
+- `teamId`
+- `q`
+- `limit`
+- `cursor`
+
+### Get one deliverable plugin
+
+- `GET /v1/orgs/:orgId/delivery/plugins/:pluginId`
+
+### Get plugin download manifest
+
+- `GET /v1/orgs/:orgId/delivery/plugins/:pluginId/manifest`
+
+Purpose:
+
+- return the resolved current set of config objects and install metadata without forcing immediate download of all payloads.
+
+Likely response shape:
+
+```json
+{
+  "plugin": {
+    "id": "plugin_123",
+    "name": "Sales plugin"
+  },
+  "items": [
+    {
+      "configObjectId": "cfg_123",
+      "type": "skill",
+      "title": "mcp-arch",
+      "versionId": "ver_123"
+    }
+  ]
+}
+```
+
+### Download one plugin bundle
+
+- `GET /v1/orgs/:orgId/delivery/plugins/:pluginId/download`
+
+Purpose:
+
+- provide the resolved content package for a plugin.
+
+Open question:
+
+- whether this should return one bundle blob, a manifest plus signed URLs, or structured JSON with embedded encrypted payloads.
+
+### Download one config object
+
+- `GET /v1/orgs/:orgId/delivery/config-objects/:configObjectId/download`
+
+Purpose:
+
+- allow targeted install/update of a single object.
+
+### Optional release-aware delivery
+
+If plugin releases become first-class:
+
+- `GET /v1/orgs/:orgId/delivery/plugins/:pluginId/releases/:releaseId/manifest`
+- `GET /v1/orgs/:orgId/delivery/plugins/:pluginId/releases/:releaseId/download`
+
+## Client state endpoints
+
+These likely matter once client sync/install flows are defined.
+
+### Report client install state
+
+- `POST /v1/orgs/:orgId/delivery/clients/:clientId/state`
+
+Purpose:
+
+- let a client report what plugins/config objects/versions are installed.
+
+### Get client install state
+
+- `GET /v1/orgs/:orgId/delivery/clients/:clientId/state`
+
+### Compute client updates
+
+- `POST /v1/orgs/:orgId/delivery/clients/:clientId/check-updates`
+
+Purpose:
+
+- compare installed state with accessible current state and return required updates.
+
+## Recommended next decisions
+
+We still need to lock down:
+
+- rolling latest vs release snapshot delivery;
+- manifest shape per config type;
+- auth model for client delivery;
+- how encrypted payloads are transported to clients;
+- how install conflicts and local overrides are represented.
diff --git a/prds/new-plugin-arch/github-connection/GitHub-instructions.md b/prds/new-plugin-arch/github-connection/GitHub-instructions.md
new file mode 100644
index 0000000000..a375d8984a
--- /dev/null
+++ b/prds/new-plugin-arch/github-connection/GitHub-instructions.md
@@ -0,0 +1,320 @@
+# GitHub Instructions
+
+This document lists exactly what you need to configure for the GitHub App connection flow and where each value should go.
+
+## Goal
+
+After this setup:
+
+1. You open `Integrations` in Den Web.
+2. You click `Connect` on GitHub.
+3. GitHub shows the GitHub App install flow.
+4. GitHub redirects back to OpenWork.
+5. OpenWork shows the repositories visible to that installation.
+6. You select one repo.
+
+## Where to put the local server values
+
+Fill these values in:
+
+`ee/apps/den-api/.env.local`
+
+That file is loaded by Den API in this order:
+
+1. `ee/apps/den-api/.env.local`
+2. `ee/apps/den-api/.env`
+3. existing shell environment
+
+## Values you need from GitHub
+
+You need to create or update a GitHub App and collect these values:
+
+- GitHub App ID
+- GitHub App Client ID
+- GitHub App Client Secret
+- GitHub App Private Key
+- GitHub App Webhook Secret
+- GitHub Installation ID
+- Test repository ID
+- Test repository full name (`owner/repo`)
+- Test branch
+- Test ref (`refs/heads/<branch>`)
+
+## Exactly where each value goes
+
+Put these in `ee/apps/den-api/.env.local`:
+
+```env
+# Required Den API basics
+PORT=8790
+OPENWORK_DEV_MODE=1
+CORS_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3005
+BETTER_AUTH_URL=http://localhost:8790
+BETTER_AUTH_SECRET=<generate-a-32-plus-char-secret>
+DEN_DB_ENCRYPTION_KEY=<generate-a-32-plus-char-secret>
+DATABASE_URL=mysql://root:password@127.0.0.1:3306/den
+
+# Existing user auth GitHub values. These are separate from the connector app.
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# GitHub connector app values
+GITHUB_CONNECTOR_APP_ID=<github-app-id>
+GITHUB_CONNECTOR_APP_CLIENT_ID=<github-app-client-id>
+GITHUB_CONNECTOR_APP_CLIENT_SECRET=<github-app-client-secret>
+GITHUB_CONNECTOR_APP_PRIVATE_KEY=<github-private-key-with-escaped-newlines>
+GITHUB_CONNECTOR_APP_WEBHOOK_SECRET=<github-webhook-secret>
+
+# Handy local test values
+GITHUB_TEST_INSTALLATION_ID=<installation-id>
+GITHUB_TEST_REPOSITORY_ID=<repository-id>
+GITHUB_TEST_REPOSITORY_FULL_NAME=<owner/repo>
+GITHUB_TEST_BRANCH=main
+GITHUB_TEST_REF=refs/heads/main
+```
+
+## Important private key formatting
+
+For `GITHUB_CONNECTOR_APP_PRIVATE_KEY`, paste the private key as one line with `\n` escapes.
+
+Example:
+
+```env
+GITHUB_CONNECTOR_APP_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----\nMIIEv...\n-----END PRIVATE KEY-----
+```
+
+Do not paste raw multi-line PEM text directly unless you know the env loader path is handling it the way you expect.
+
+## GitHub App setup
+
+Go to:
+
+`GitHub -> Settings -> Developer settings -> GitHub Apps -> New GitHub App`
+
+Use these settings.
+
+### Basic info
+
+- App name: choose any unique name, for example `OpenWork Den Local`
+- Homepage URL: use your local/public Den Web URL
+  - local example: `http://localhost:3005`
+  - public example: your deployed Den Web URL
+- Description: optional
+
+### Webhooks
+
+- Webhooks: enabled
+- Webhook URL:
+  - for webhook deliveries themselves, use:
+    - `https://<your-public-den-web-host>/api/den/v1/webhooks/connectors/github`
+    - or the public Den API URL if you are not proxying through Den Web
+- Webhook secret:
+  - set this to the same value you put in `GITHUB_CONNECTOR_APP_WEBHOOK_SECRET`
+
+## Important: Setup URL vs Webhook URL
+
+GitHub App has two different relevant URLs:
+
+1. `Setup URL`
+2. `Webhook URL`
+
+### Setup URL
+
+This is where GitHub sends the user's browser back after installation.
+
+This should be an actual Den Web page, not a den-api callback route.
+
+Set it to:
+
+`https://<your-public-den-web-host>/dashboard/integrations/github`
+
+GitHub will append values like:
+
+- `installation_id`
+- `setup_action`
+- `state`
+
+Den Web reads those query params and then calls Den API to validate the signed state and load the repositories for that installation.
+
+Do not point the Setup URL at Den API for this flow.
+
+### Webhook URL
+
+This is where GitHub sends push/install webhook events.
+
+Set it to:
+
+`https://<your-public-den-web-host>/api/den/v1/webhooks/connectors/github`
+
+If your public entrypoint is Den API directly, use:
+
+`https://<your-public-den-api-host>/v1/webhooks/connectors/github`
+
+## Repository permissions
+
+Set these GitHub App repository permissions:
+
+- `Metadata`: `Read-only`
+- `Contents`: `Read-only`
+
+That is the minimum needed for the current repo-listing and validation flow.
+
+## Organization permissions
+
+None are strictly required for the current slice.
+
+## Subscribe to these webhook events
+
+Enable these events:
+
+- `Push`
+- `Installation`
+- `Installation target`
+- `Repository`
+
+## Install the app
+
+After creating the app:
+
+1. Generate a client secret.
+2. Generate a private key.
+3. Install the app on the user or org that owns the repo you want to test.
+4. Grant access to the repo you want to test.
+
+## How to collect the values after setup
+
+### App ID
+
+From the GitHub App settings page.
+
+Put in:
+
+`GITHUB_CONNECTOR_APP_ID`
+
+### Client ID
+
+From the GitHub App settings page.
+
+Put in:
+
+`GITHUB_CONNECTOR_APP_CLIENT_ID`
+
+### Client Secret
+
+Generate from the GitHub App settings page.
+
+Put in:
+
+`GITHUB_CONNECTOR_APP_CLIENT_SECRET`
+
+### Private Key
+
+Generate from the GitHub App settings page.
+
+Put in:
+
+`GITHUB_CONNECTOR_APP_PRIVATE_KEY`
+
+### Webhook Secret
+
+From the GitHub App webhook configuration.
+
+Put in:
+
+`GITHUB_CONNECTOR_APP_WEBHOOK_SECRET`
+
+### Installation ID
+
+You can get it from the GitHub install redirect/callback, or via `gh`:
+
+```bash
+gh api repos/<owner>/<repo>/installation --jq '.id'
+```
+
+Put in:
+
+`GITHUB_TEST_INSTALLATION_ID`
+
+### Repository ID
+
+```bash
+gh api repos/<owner>/<repo> --jq '.id'
+```
+
+Put in:
+
+`GITHUB_TEST_REPOSITORY_ID`
+
+### Repository full name
+
+Format:
+
+`owner/repo`
+
+Put in:
+
+`GITHUB_TEST_REPOSITORY_FULL_NAME`
+
+### Branch and ref
+
+Examples:
+
+- branch: `main`
+- ref: `refs/heads/main`
+
+Put in:
+
+- `GITHUB_TEST_BRANCH`
+- `GITHUB_TEST_REF`
+
+## Local run commands
+
+From the repo root:
+
+```bash
+pnpm --filter @openwork-ee/den-api dev
+pnpm --filter @openwork-ee/den-web dev
+```
+
+Den Web default local URL in this repo is:
+
+`http://localhost:3005`
+
+Den API default local URL in this repo is:
+
+`http://localhost:8790`
+
+## Public URL requirement
+
+GitHub must be able to reach your callback and webhook endpoints.
+
+That means for real testing you need a public URL, usually via a tunnel or deployed environment.
+
+Examples:
+
+- `ngrok`
+- `cloudflared`
+- deployed Den Web / Den API host
+
+## What to do after env is filled
+
+1. Start Den API.
+2. Start Den Web.
+3. Confirm the GitHub App `Setup URL` points to the Den Web GitHub setup page.
+4. Confirm the GitHub App `Webhook URL` points to the webhook endpoint.
+5. Go to Den Web `Integrations`.
+6. Click `Connect` on GitHub.
+7. Finish the GitHub App install flow.
+8. GitHub should return to `/dashboard/integrations/github` in Den Web.
+9. Den Web should show the repository selection screen.
+
+## Current scope note
+
+This phase currently gets you to:
+
+- GitHub App install redirect
+- return to OpenWork
+- repository list
+- selecting one repo to create a connector instance
+
+It does not yet complete full content ingestion from the selected repository.
diff --git a/prds/new-plugin-arch/github-connection/connectors.md b/prds/new-plugin-arch/github-connection/connectors.md
new file mode 100644
index 0000000000..da3f9f25db
--- /dev/null
+++ b/prds/new-plugin-arch/github-connection/connectors.md
@@ -0,0 +1,1105 @@
+# Connectors — API surface, FS convention, and lifecycle
+
+Status: draft
+Owner: src-opn
+Scope: OpenWork server + Den web + OpenCode integration
+Related: `/o/:slug/dashboard/integrations` (Den), `/o/:slug/dashboard/plugins` (Den)
+
+---
+
+## TL;DR
+
+- A **connector** is an OAuth-backed transport that reads a filesystem tree from an external system (GitHub, Bitbucket) and hands it to a shared **ingester**.
+- The ingester decomposes the tree into **Primitives** (skill, agent, command, MCP server, OpenCode plugin code).
+- **Bundles** (what the product calls "plugins") are DB-level groupings of primitives — they are **virtual** as far as OpenCode is concerned. OpenCode never sees a `plugin.json`.
+- **Installing a bundle into a workspace** means writing each member primitive to its **native `.opencode/` path** via the OpenWork server's existing per-workspace endpoints. The `reload-watcher` then propagates to running sessions.
+- `.opencode/` is the **source of truth** on disk. Our remote DB is an **index** that bundles + surfaces primitives across the org. A future "local DB triggered via a skill" will invert the index relationship locally; the server schema is designed to accommodate that.
+
+### Reader map
+
+| Looking for… | Jump to |
+|---|---|
+| What does OpenCode actually load from disk? | [OpenCode interpretation](#opencode-interpretation--what-opencode-actually-sees) |
+| End-to-end flow (create → index → denominate → install) | [Four-phase lifecycle](#four-phase-lifecycle) |
+| Exact types to implement | [Typed schemas](#typed-schemas) |
+| Every API endpoint | [API endpoints](#api-endpoints) |
+| How each step actually runs over the wire | [Sequence flows](#sequence-flows) |
+| How a user authors a plugin without a repo | [Authoring flow](#authoring-flow-creating-primitives--bundles-in-app) |
+| How we close the loop back to the ecosystem | [Publish / export](#publish--export-sharing-authored-bundles) |
+| From inside an agent / shell | [CLI surface](#cli-surface) |
+| What's shipped when | [Rollout plan](#rollout-plan) |
+| How we know it works | [Test strategy](#test-strategy) |
+| What's still undecided | [Open questions](#open-questions) |
+
+## Mental model
+
+Three nouns, kept strictly distinct:
+
+| Noun | What it is | Who creates it | Shape |
+|---|---|---|---|
+| **ConnectorType** | The adapter class itself (e.g., "github", "bitbucket", "npm", "local"). Code in our server. | Us — v1 is in-house. v2 could accept plugin-authored adapters. | Code |
+| **Integration** | An org's authorized grant to one ConnectorType + their selected sources (e.g., "GitHub account `different-ai`, 3 repos"). Persisted, scoped to an org. | End user via OAuth flow. | DB row |
+| **Bundle** ("plugin" in UI copy) | A curated collection of primitives (skills, agents, commands, MCPs, code hooks) that can be installed as a unit. | Either: imported from a connector source (e.g., `.claude-plugin/marketplace.json` in a repo), or authored directly in the app. | DB row + BundleMembers |
+
+The UI already shipped on `/integrations` (PRs #1472, #1475) drives ConnectorType + Integration. The `/plugins` UI (PR #1472) will drive Bundle browsing/detail. **A new page is needed for workspace installation** (Phase 4 below).
+
+## OpenCode interpretation — what OpenCode actually sees
+
+OpenCode is the execution layer. It **only** reads a workspace directory containing `opencode.json{c}` and an optional `.opencode/`. Any product concept that OpenCode does not see on disk is invisible to the runtime.
+
+### OpenCode vs Claude Code — compatibility table
+
+| Primitive | Claude Code convention | OpenCode convention | Auto-portable? |
+|---|---|---|---|
+| Plugin manifest | `.claude-plugin/plugin.json` | **None** (no manifest file) | ❌ — OpenWork-only DB concept |
+| Marketplace catalog | `.claude-plugin/marketplace.json` | **None** | ❌ — OpenWork-only DB concept |
+| Skills | `.claude/skills/<name>/SKILL.md` (YAML + md) | `.opencode/skill[s]/<name>/SKILL.md` **and** `.claude/skills/**/SKILL.md` **and** `.agents/skills/**/SKILL.md` (all three scanned natively unless `OPENCODE_DISABLE_EXTERNAL_SKILLS` is set) | ✅ **drop-in** |
+| Agents | `.claude/agents/<name>.md` | `.opencode/agent[s]/<name>.md` — file shape identical, path differs | ⚠️ re-home path, content unchanged |
+| Commands | `.claude/commands/<name>.md` | `.opencode/command[s]/<name>.md` — file shape identical (same `$ARGUMENTS` templating), path differs | ⚠️ re-home path, content unchanged |
+| MCP servers | `.mcp.json` (project root) | `opencode.json{c}` → `mcp{}` key | ⚠️ expand into JSONC |
+| Hooks | `.claude/hooks/` + `hooks.json` (declarative events) | **Code-only**: JS/TS module in `.opencode/plugin[s]/` exporting a `Hooks` interface | ❌ Claude JSON hooks **cannot** be auto-ported |
+| Plugins | Source-distributed bundle | `opencode.json` → `plugin[]` (npm spec) **or** `.opencode/plugin[s]/<name>.{ts,js}` (file URL, auto-installed via `bun`) | Different semantic — OpenCode plugins are code; Claude "plugins" are catalog entries |
+
+### What this forces on our design
+
+1. **"Plugin" in Claude terminology ≠ "Plugin" in OpenCode terminology.** Our internal name for the Claude concept is **Bundle**. The UI can still say "Plugins" for user familiarity, but the codebase must not conflate them.
+2. **The ingester is also a rehoming step.** A Claude-style `.claude-plugin/*` tree becomes OpenCode-native paths at materialization time. This is where the `.claude/agents/ → .opencode/agents/` move happens.
+3. **Skill compatibility is a freebie.** SKILL.md is portable; we parse it once and write it back unchanged on install.
+4. **Hooks need a policy.** See [Hooks strategy](#hooks-strategy).
+
+### Real examples we target
+
+Skill (frontmatter + body, OpenCode reads both `.opencode/skills/` and `.claude/skills/`):
+
+```markdown
+---
+name: skill-creator
+description: Create new OpenCode skills with the standard scaffold.
+---
+
+Skill creator helps create other skills that are self-buildable.
+```
+
+Command (`.opencode/commands/release.md`):
+
+```markdown
+---
+description: Run the OpenWork release flow
+---
+
+You are running the OpenWork release flow in this repo.
+Arguments: `$ARGUMENTS`
+```
+
+Agent (`.opencode/agent/triage.md`):
+
+```markdown
+---
+mode: primary
+model: opencode/claude-haiku-4-5
+tools:
+  "*": false
+  "github-triage": true
+---
+
+You are a triage agent responsible for triaging github issues.
+```
+
+MCP (inside `opencode.jsonc`):
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "control-chrome": {
+      "type": "local",
+      "command": ["chrome-devtools-mcp"]
+    }
+  },
+  "plugin": ["opencode-scheduler"]
+}
+```
+
+## Four-phase lifecycle
+
+Split the problem into four phases. Each phase has its own API surface, UI, and failure modes. The earlier phases can **assume** later ones exist; later phases **depend on** earlier ones having produced data.
+
+### Phase 1 — Ingest (connectors)
+
+> Assume: primitives already exist somewhere (a GitHub repo maintained by a human, or a `.claude-plugin/marketplace.json` tree, or an npm package). We are not authoring them here; we are **bringing them in**.
+
+Actors: connector adapter + ingester.
+
+Flow:
+
+1. User on `/integrations` authorizes GitHub/Bitbucket (OAuth).
+2. User selects repos; we create `PluginSource` rows.
+3. Ingester fetches the filesystem for each source. Supported shapes:
+   - `.claude-plugin/marketplace.json` → catalog of bundles in this repo
+   - `.claude-plugin/plugin.json` → single bundle at repo root
+   - `opencode.json{c}` + `.opencode/*` → native OpenCode workspace exported as a single "workspace bundle"
+   - Bare `skills/<name>/SKILL.md` tree with no manifest → one inferred bundle of skills
+4. Ingester walks the tree and upserts **Primitives** into the DB (Phase 2).
+5. Ingester optionally upserts **Bundles** and **BundleMembers** (Phase 3) if a manifest was present. If not, a user can create bundles manually in Phase 3.
+
+Failure modes: invalid YAML frontmatter, forbidden `../` paths, hooks written in Claude JSON (flagged, see Hooks strategy), missing required fields. All surface as non-fatal `SyncEvent`s on the source.
+
+### Phase 2 — Primitive index (DB)
+
+> Assume: Phase 1 has produced raw content. Phase 2 stores each primitive as a first-class row so it can be searched, bundled, mutated, and projected to a workspace.
+
+Every primitive gets a row with the same envelope, differing only by `kind`:
+
+```
+Primitive
+  id
+  org_id
+  kind                      # "skill" | "agent" | "command" | "mcp_server" | "plugin_code"
+  name                      # e.g. "skill-creator"  (unique within (org_id, kind, origin))
+  content                   # raw source: SKILL.md body, agent .md, command .md, TS code, or JSON for mcp
+  content_hash              # sha256 for change detection
+  metadata                  # parsed frontmatter or decoded JSON
+  origin                    # tagged union — see below
+  validation_status         # "ok" | "warn" | "error"
+  validation_messages[]
+  created_at
+  updated_at
+```
+
+`origin` tagged union:
+
+```
+  | { type: "connector", plugin_source_id, path_in_repo, commit_sha }
+  | { type: "authored",  author_org_membership_id }
+  | { type: "local_mirror", workspace_id, local_revision }   # future: local-DB SoT
+```
+
+Primitives are **org-scoped**, not workspace-scoped. The same `Primitive` row can be installed into many workspaces.
+
+### Phase 3 — Denomination (Bundle)
+
+> Assume: Phase 2 has given us primitives. Phase 3 groups them into shippable units.
+
+```
+Bundle
+  id
+  org_id
+  slug                       # "openwork-release-kit"
+  name                       # "OpenWork Release Kit"
+  description
+  version                    # "2.3.1"
+  icon                       # emoji or URL
+  category                   # display-only
+  origin                     # same tagged union as Primitive
+  published_at
+
+BundleMember
+  bundle_id
+  primitive_id
+  ordinal                    # for list display
+```
+
+Bundle creation paths:
+
+1. **Imported**: a `.claude-plugin/marketplace.json` or `plugin.json` produces one Bundle row per plugin in the catalog, with BundleMembers derived from the plugin's skill/agent/command/mcp/hook entries.
+2. **Authored in the app**: user picks existing Primitives and drags them into a new Bundle. No connector required.
+3. **Generated by another tool** (future): an agent creates a Bundle representing its own capabilities.
+
+The word "Bundle" lives in the schema; the UI can continue to say "Plugin" for user familiarity.
+
+### Phase 4 — Install (materialize into a workspace)
+
+> Assume: Phases 1–3 have produced a Bundle. Phase 4 projects its primitives onto a specific OpenCode workspace so the OpenCode runtime loads them.
+
+```
+WorkspaceInstallation
+  id
+  org_id
+  bundle_id
+  workspace_id               # the OpenWork workspace (worker + path)
+  scope                      # "org" | "user" | "workspace" — affects conflict resolution
+  status                     # "pending" | "materializing" | "applied" | "error" | "uninstalled"
+  bundle_version_at_install
+  applied_primitive_digests  # [{ primitive_id, target_path, content_hash }]
+  installed_at
+  updated_at
+  error                      # nullable; populated on failure
+```
+
+Materialization steps (all executed server-side against the OpenWork server API — not direct FS access):
+
+| Primitive kind | Target path in workspace | Mutation endpoint |
+|---|---|---|
+| `skill` | `.opencode/skills/<name>/SKILL.md` | `POST /workspace/:id/skills` |
+| `agent` | `.opencode/agents/<name>.md` | `POST /workspace/:id/files/content` *(no dedicated agents endpoint today — flagged in Open Questions)* |
+| `command` | `.opencode/commands/<name>.md` | `POST /workspace/:id/commands` |
+| `mcp_server` | merged into `opencode.jsonc` → `mcp[name]` | `POST /workspace/:id/mcp` |
+| `plugin_code` | `.opencode/plugins/<name>.ts` **and/or** `opencode.jsonc` → `plugin[]` | `POST /workspace/:id/plugins` |
+
+The `reload-watcher` on the server picks up each file write and emits `ReloadEvent`s keyed by `workspaceId`. OpenCode-running sessions pick up skills/commands/agents hot; plugin code and MCP changes require a new session (reload-watcher already handles this via `openwork.json` → `reload.auto`).
+
+**Uninstall**: the server looks up `applied_primitive_digests` and deletes each target. Content-hash check prevents stomping on user-edited files — if the current on-disk hash differs, the file is left alone and a `drift` warning is stored on the installation row.
+
+**Conflict resolution** (two bundles declare the same skill name):
+
+- Scope precedence: `workspace > user > org`. A lower-scope install overwrites a higher-scope one and restores on uninstall.
+- Same-scope collision: installation fails with a clear error; the user picks which Bundle owns the name.
+
+## Data model (updated)
+
+```
+Organization
+  └─ Integration                     1 row per (org × connector_type × provider_account)
+     ├─ connector_type               "github" | "bitbucket" | …
+     ├─ account                      { id, name, kind: "user" | "org" }
+     ├─ credentials_encrypted
+     └─ PluginSource[]               1 row per attached repo / subdir / ref
+        ├─ locator                   { repo, ref?, path?, sha? }
+        ├─ last_sync_at / _status
+        └─ discovered: Primitive[], Bundle[]
+
+Primitive                            the atoms — org-scoped
+  kind, name, content, hash, metadata, origin, validation_status
+
+Bundle                               the grouping — org-scoped (Phase 3 output)
+  ├─ BundleMember[]  →  Primitive
+
+WorkspaceInstallation                Phase 4: projection onto a workspace
+  ├─ bundle_id
+  ├─ workspace_id
+  └─ applied_primitive_digests[]
+```
+
+**Why this shape:**
+
+- Primitives and Bundles are cleanly separated — a primitive can live outside a bundle (useful for org-authored skills that aren't shipped), and the same primitive can belong to many bundles.
+- The `origin` tagged union lets the same table model both connector-imported and app-authored primitives with no special cases downstream.
+- `WorkspaceInstallation.applied_primitive_digests` gives clean uninstall + drift detection.
+- The future "local DB triggered via a skill" (§ [Local-DB future](#local-db-future)) slots in by adding `{ type: "local_mirror", … }` as a third `origin` variant without touching the rest of the schema.
+
+## Typed schemas
+
+TypeScript-style definitions for the core entities. These are the canonical shapes shared across the DB ORM, the API layer, and (eventually) the Den web SDK. Field names are camelCase in the API and snake_case in the DB per existing Den conventions — listed here in camelCase.
+
+### Shared primitives
+
+```ts
+type Iso8601 = string;                          // "2026-04-17T11:22:33Z"
+type Sha256  = string;                          // lowercased hex
+type UUID    = string;                          // v7
+type KebabCase = string;                        // ^[a-z][a-z0-9-]*$
+
+type PrimitiveKind =
+  | "skill"
+  | "agent"
+  | "command"
+  | "mcp_server"
+  | "plugin_code"
+  | "hook";                                     // claude-json hooks; warn-only in v1
+
+type ConnectorType = "github" | "bitbucket";    // extensible
+
+type InstallScope = "org" | "user" | "workspace";
+
+type ValidationStatus = "ok" | "warn" | "error";
+type ValidationMessage = { code: string; message: string; path?: string };
+
+type Origin =
+  | { type: "connector"; pluginSourceId: UUID; pathInRepo: string; commitSha: string }
+  | { type: "authored";  authorOrgMembershipId: UUID }
+  | { type: "local_mirror"; workspaceId: UUID; localRevision: number };       // future
+```
+
+### Integration + PluginSource
+
+```ts
+type Integration = {
+  id: UUID;
+  orgId: UUID;
+  connectorType: ConnectorType;
+  account: { id: string; name: string; kind: "user" | "org"; avatarUrl?: string };
+  credentialsEncrypted: string;                 // opaque; decrypted server-side only
+  tokenExpiresAt: Iso8601 | null;
+  createdAt: Iso8601;
+  updatedAt: Iso8601;
+};
+
+type PluginSourceLocator =
+  | { kind: "repo";     repo: string; ref?: string; sha?: string }            // "owner/repo"
+  | { kind: "subdir";   repo: string; path: string; ref?: string; sha?: string }
+  | { kind: "npm";      pkg:  string; version?: string; registry?: string };  // future
+
+type SyncStatus = "pending" | "ok" | "error";
+
+type PluginSource = {
+  id: UUID;
+  orgId: UUID;
+  integrationId: UUID;
+  locator: PluginSourceLocator;
+  webhookId: string | null;                     // provider-side webhook identifier
+  lastSyncAt: Iso8601 | null;
+  lastSyncStatus: SyncStatus;
+  lastSyncError: string | null;
+  createdAt: Iso8601;
+  updatedAt: Iso8601;
+};
+```
+
+### Primitive (kind-discriminated)
+
+```ts
+type Primitive = {
+  id: UUID;
+  orgId: UUID;
+  kind: PrimitiveKind;
+  name: KebabCase;                              // unique within (orgId, kind, origin-key)
+  content: string;                              // raw md/ts/json
+  contentHash: Sha256;
+  metadata: PrimitiveMetadata;                  // discriminated on kind
+  origin: Origin;
+  validationStatus: ValidationStatus;
+  validationMessages: ValidationMessage[];
+  deletedAt: Iso8601 | null;                    // soft-delete so re-ingest can restore
+  createdAt: Iso8601;
+  updatedAt: Iso8601;
+};
+
+type PrimitiveMetadata =
+  | { kind: "skill";       description: string; license?: string; tags?: string[] }
+  | { kind: "agent";       description?: string; model?: string; mode?: "primary" | "subagent" | "all"; tools?: Record<string, boolean>; color?: string }
+  | { kind: "command";     description?: string; agent?: string; model?: string; argumentsHint?: string[] }
+  | { kind: "mcp_server";  transport: "local" | "remote"; command?: string[]; url?: string; env?: Record<string, string> }
+  | { kind: "plugin_code"; language: "ts" | "js"; entryFile: string }
+  | { kind: "hook";        event: string; matcher?: string; command: string };           // claude-json shape
+```
+
+### Bundle + BundleMember
+
+```ts
+type Bundle = {
+  id: UUID;
+  orgId: UUID;
+  slug: KebabCase;                              // unique within org
+  name: string;
+  description: string;
+  version: string;                              // semver
+  icon?: string;                                // emoji or https URL
+  category?: string;
+  origin: Origin;
+  publishedAt: Iso8601 | null;
+  deletedAt: Iso8601 | null;
+  createdAt: Iso8601;
+  updatedAt: Iso8601;
+};
+
+type BundleMember = {
+  bundleId: UUID;
+  primitiveId: UUID;
+  ordinal: number;                              // display order
+};
+```
+
+### WorkspaceInstallation
+
+```ts
+type InstallationStatus =
+  | "pending" | "materializing" | "applied" | "error" | "uninstalled";
+
+type AppliedPrimitiveDigest = {
+  primitiveId: UUID;
+  kind: PrimitiveKind;
+  targetPath: string;                           // e.g. ".opencode/skills/release-prep/SKILL.md"
+  contentHashAtWrite: Sha256;                   // for drift detection on read-back
+};
+
+type WorkspaceInstallation = {
+  id: UUID;
+  orgId: UUID;
+  bundleId: UUID;
+  workspaceId: UUID;
+  scope: InstallScope;
+  status: InstallationStatus;
+  bundleVersionAtInstall: string;
+  appliedPrimitiveDigests: AppliedPrimitiveDigest[];
+  installedAt: Iso8601;
+  updatedAt: Iso8601;
+  error: { code: string; message: string } | null;
+};
+```
+
+### API request/response shapes (examples)
+
+```ts
+// POST /v1/orgs/:orgId/integrations/authorize
+type AuthorizeRequest  = { connectorType: ConnectorType; redirectAfter?: string };
+type AuthorizeResponse = { redirectUrl: string; state: string };
+
+// POST /v1/orgs/:orgId/integrations/:id/plugin-sources
+type AttachSourcesRequest  = { sources: PluginSourceLocator[] };
+type AttachSourcesResponse = { sources: PluginSource[] };
+
+// POST /v1/orgs/:orgId/bundles
+type CreateBundleRequest = {
+  slug: KebabCase;
+  name: string;
+  description: string;
+  version: string;
+  icon?: string;
+  category?: string;
+  memberPrimitiveIds: UUID[];                   // primitives must already exist in the org
+};
+type CreateBundleResponse = Bundle & { members: BundleMember[] };
+
+// POST /v1/workspaces/:workspaceId/installations
+type CreateInstallationRequest  = { bundleId: UUID; scope: InstallScope };
+type CreateInstallationResponse = WorkspaceInstallation;
+
+// GET /v1/workspaces/:workspaceId/installations/:id/status
+type InstallationStatusResponse = {
+  status: InstallationStatus;
+  progress: Array<{
+    primitiveId: UUID;
+    name: string;
+    targetPath: string;
+    state: "pending" | "writing" | "ok" | "error";
+    error?: string;
+  }>;
+};
+```
+
+## Source-of-truth policy
+
+`.opencode/` on a worker's disk is the **canonical** state of what OpenCode actually loads. The remote DB is an **index** that:
+
+1. Knows which primitives exist across the org.
+2. Knows which bundles compose which primitives.
+3. Knows which workspaces have which bundles installed.
+4. Records `applied_primitive_digests` so it can diff against disk and detect drift.
+
+When disk and DB disagree, disk wins for OpenCode loading. The DB updates its `validation_status` and drift markers but does not force a rewrite — user edits on disk are respected.
+
+### Local-DB future
+
+Long-term direction (informational — not in v1 scope):
+
+- A tiny **OpenWork skill** running inside the user's workspace maintains a **local SQLite** DB that mirrors the subset of the remote DB relevant to that workspace (primitives + installed bundles).
+- This local DB becomes the operational source of truth for the workspace; the remote DB becomes a sync target and cross-workspace index.
+- Connectors, installers, and authoring tools all read/write the local DB; a background sync skill reconciles with the remote.
+- Benefits: works offline, no network trip for "what's installed in this workspace", enables per-workspace forks of a bundle without polluting org-wide state.
+- Schema preparation: the `origin.local_mirror` variant on `Primitive` is already designed for this.
+
+For v1 we ship the remote DB only. The API contracts below do not change when the local DB lands — the local DB speaks the same schema and exposes the same endpoints over a UNIX socket or the existing server instance.
+
+## API endpoints
+
+Grouped by concern. All org-scoped routes live under `/v1/orgs/:orgId/...` consistent with the existing Den API (`/v1/orgs/:orgId/skills`, `/v1/orgs/:orgId/skill-hubs`).
+
+### 1. Connector-type registry (read-only catalog)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/connector-types` | List adapters the server supports, with display metadata, supported auth flow (`oauth2` / `token` / `local`), and required scopes. Powers the list of cards on `/integrations`. |
+| `GET` | `/v1/connector-types/:type` | Detail for one adapter. |
+
+### 2. Integrations (the OAuth dance)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/integrations` | List this org's integrations, including account + repo counts. Replaces the mock `useIntegrations()`. |
+| `POST` | `/v1/orgs/:orgId/integrations/authorize` | Body: `{ connectorType }`. Returns `{ redirectUrl, state }`. Client navigates to the provider. |
+| `GET` | `/v1/oauth/:type/callback` | Provider hits this with `?code&state`. Server exchanges for tokens, resolves the account, creates the Integration row, redirects to the app (`/o/:slug/dashboard/integrations?success=...`). |
+| `GET` | `/v1/orgs/:orgId/integrations/:id` | Detail for one integration. |
+| `POST` | `/v1/orgs/:orgId/integrations/:id/refresh-token` | Explicit refresh (mostly internal). |
+| `DELETE` | `/v1/orgs/:orgId/integrations/:id` | Disconnect; revoke at provider if possible; cascade-delete `PluginSource`s and their derived Primitives/Bundles. |
+
+### 3. Account + repo enumeration (populates the wizard steps 2 & 3)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/integrations/:id/accounts` | Proxy call to the provider for user + orgs/workspaces the grant can see. |
+| `GET` | `/v1/orgs/:orgId/integrations/:id/accounts/:accountId/repos?q=&cursor=` | Paginated repo list, optionally filtered. Each repo flagged `hasPluginManifest: boolean` (server peeks for `.claude-plugin/plugin.json` or `.claude-plugin/marketplace.json`). |
+
+### 4. Plugin sources (attaching a repo to the Integration)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/plugin-sources` | All sources attached across integrations. |
+| `POST` | `/v1/orgs/:orgId/integrations/:id/plugin-sources` | Body: `[{ repo, ref?, path?, sha? }, …]`. Server registers webhook, triggers initial sync. |
+| `DELETE` | `/v1/orgs/:orgId/plugin-sources/:sourceId` | Detach; cascade-delete the Primitives/Bundles it produced. |
+| `POST` | `/v1/orgs/:orgId/plugin-sources/:sourceId/sync` | Force a refresh. Re-reads the tree, upserts Primitives + Bundles. |
+| `GET` | `/v1/orgs/:orgId/plugin-sources/:sourceId/events` | Sync history (SSE or paginated log). |
+
+### 5. Primitives (Phase 2 — org-scoped atoms)
+
+Each primitive kind gets a resource. Shared shape, different payload. Internally backed by one `primitives` table with a `kind` discriminator.
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/primitives?kind=&originType=&q=&cursor=` | Combined index across all kinds. Powers the "All Skills / All Hooks / All MCPs" tabs on `/plugins`. |
+| `GET` | `/v1/orgs/:orgId/primitives/:id` | Detail for any primitive kind. |
+| `POST` | `/v1/orgs/:orgId/primitives` | Author a new primitive in the app. Body: `{ kind, name, content, metadata? }`. `origin` is set server-side to `{ type: "authored", author_org_membership_id }`. |
+| `PATCH` | `/v1/orgs/:orgId/primitives/:id` | Edit content/metadata of an authored primitive. Connector-sourced primitives are read-only (return 409). |
+| `DELETE` | `/v1/orgs/:orgId/primitives/:id` | Delete an authored primitive. Connector-sourced primitives get hidden (`deleted_at` set) so re-ingest can restore them. |
+
+Convenience kind-scoped views (optional; all read from the same table):
+
+- `GET /v1/orgs/:orgId/skills`
+- `GET /v1/orgs/:orgId/agents`
+- `GET /v1/orgs/:orgId/commands`
+- `GET /v1/orgs/:orgId/mcp-servers`
+- `GET /v1/orgs/:orgId/plugin-code` *(OpenCode code plugins, distinct from our Bundle concept)*
+
+The existing `GET /v1/orgs/:orgId/skills` endpoint in Den API stays and grows `originType` / `pluginSourceId` / `bundleId` filter params.
+
+### 6. Bundles (Phase 3 — denomination)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/bundles?q=&category=&originType=` | All bundles in the org. Replaces mock `usePlugins()`. |
+| `GET` | `/v1/orgs/:orgId/bundles/:id` | Bundle detail with embedded BundleMembers → resolved Primitives. Replaces mock `usePlugin(id)`. |
+| `POST` | `/v1/orgs/:orgId/bundles` | Author a new bundle. Body: `{ slug, name, description, version, icon?, category?, memberPrimitiveIds: [...] }`. |
+| `PATCH` | `/v1/orgs/:orgId/bundles/:id` | Edit authored bundle metadata. Imported bundles are read-only. |
+| `DELETE` | `/v1/orgs/:orgId/bundles/:id` | Delete an authored bundle. Imported bundles hidden (re-ingest restores). |
+| `POST` | `/v1/orgs/:orgId/bundles/:id/members` | Body: `{ primitiveId, ordinal? }`. Add a primitive to the bundle. |
+| `DELETE` | `/v1/orgs/:orgId/bundles/:id/members/:primitiveId` | Remove a primitive from the bundle. |
+| `POST` | `/v1/orgs/:orgId/bundles/:id/members/reorder` | Body: `[primitiveId, …]`. Reorders the bundle's member list. |
+
+### 7. Workspace installations (Phase 4 — projection)
+
+Workspace scope lives under `/v1/workspaces/:workspaceId/…` — mirrors the existing OpenWork server shape (`/workspace/:id/skills`, `/workspace/:id/commands`, etc.). The installation endpoints below are **orchestrators** that internally fan out to those existing workspace-level endpoints. No new filesystem primitives required.
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/workspaces/:workspaceId/installations` | What bundles are installed in this workspace, with status + drift info. |
+| `GET` | `/v1/workspaces/:workspaceId/installations/:id` | Detail: list of applied primitives with their target paths and content hashes. |
+| `POST` | `/v1/workspaces/:workspaceId/installations` | Body: `{ bundleId, scope }`. Creates the row, begins materializing. Returns `{ id, status: "materializing" }`. |
+| `GET` | `/v1/workspaces/:workspaceId/installations/:id/status` | Poll endpoint (or SSE). Reports per-primitive progress: `pending` → `writing` → `ok`/`error`. |
+| `POST` | `/v1/workspaces/:workspaceId/installations/:id/reapply` | Re-run materialization against the current Bundle version. Useful after drift. |
+| `DELETE` | `/v1/workspaces/:workspaceId/installations/:id` | Uninstall — reverses writes using `applied_primitive_digests`. Files that no longer match their recorded digest are left alone (drift safe) and reported. |
+
+Materialization engine (server-side only — not a public endpoint) maps each primitive kind to the existing per-workspace endpoint. See [materialization table](#four-phase-lifecycle) above.
+
+### 8. Webhooks (provider → us)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/v1/webhooks/github` | Signed by `X-Hub-Signature-256`. On `push` to a tracked ref, reindex affected `PluginSource`s. Triggers re-materialization for every WorkspaceInstallation whose Bundle contains a changed Primitive. |
+| `POST` | `/v1/webhooks/bitbucket` | Equivalent. |
+
+### 9. Admin / health (optional v1.1)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/v1/orgs/:orgId/integrations/:id/diagnostics` | Token expiry, last webhook time, error stream — powers a "something is wrong" banner. |
+| `GET` | `/v1/workspaces/:workspaceId/installations/:id/drift` | Compares `applied_primitive_digests` to current on-disk hashes via the existing `/workspace/:id/skills` etc. Returns per-primitive drift status. |
+
+## Sequence flows
+
+### A. Connect a source (Phase 1)
+
+```
+ User            Den web             Den API             Provider           OpenWork server
+  │                 │                  │                    │                    │
+  │─ click Connect ─▶                  │                    │                    │
+  │                 │─ POST /integrations/authorize ───────▶│                    │
+  │                 │◀──  { redirectUrl, state }  ──────────│                    │
+  │◀─ window.location = redirectUrl ───│                    │                    │
+  │────────────── OAuth consent ──────────────────▶          │                    │
+  │                                     ◀─ 302 w/ code ─────│                    │
+  │─ GET /v1/oauth/:type/callback?code&state ──▶│           │                    │
+  │                                     │  exchange code    │                    │
+  │                                     │───── POST token ─▶│                    │
+  │                                     │◀─ access_token ───│                    │
+  │                                     │  upsert Integration                    │
+  │◀─ 302 /integrations?success&id=…────│                    │                    │
+  │                 │                  │                    │                    │
+  │─ select repos ──▶                   │                    │                    │
+  │                 │─ POST /integrations/:id/plugin-sources ▶│                  │
+  │                 │  server: attach sources, register webhook                  │
+  │                 │         enqueue initial sync job       │                    │
+  │                 │◀── { sources[], jobId }────────────────│                    │
+  │                 │                  │                    │                    │
+  │                 │         (job runs)                     │                    │
+  │                 │                  │ fetchPluginFS ─────▶│                    │
+  │                 │                  │◀── FileTree ────────│                    │
+  │                 │                  │ ingest → upsert Primitives + Bundles     │
+```
+
+### B. Webhook-driven re-sync
+
+```
+ Provider           Den API                                    DB
+    │                  │                                        │
+    │─ POST /v1/webhooks/github (push event) ────▶              │
+    │                  │ verify HMAC                            │
+    │                  │ find PluginSources w/ matching ref     │
+    │                  │ for each: enqueue sync job             │
+    │                  │           ├─ fetchPluginFS             │
+    │                  │           ├─ ingest → diff             │
+    │                  │           ├─ upsert changed Primitives │
+    │                  │           └─ bump Bundle version if plugin.json version changed
+    │                  │ fan out to WorkspaceInstallation(bundleId)
+    │                  │   for each installation:               │
+    │                  │     mark "update available" (not auto-apply)
+```
+
+### C. Install a bundle into a workspace (Phase 4)
+
+```
+ User            Den web           Den API                         OpenWork server                           Disk
+  │                 │                │                                 │                                      │
+  │─ click Install ▶│                │                                 │                                      │
+  │                 │─ POST /workspaces/:wid/installations ───────────▶│                                      │
+  │                 │  body: { bundleId, scope }                       │                                      │
+  │                 │                │ create WorkspaceInstallation (status=pending)                          │
+  │                 │                │ begin materialize job           │                                      │
+  │                 │◀─ { installationId, status: "materializing" } ───│                                      │
+  │                 │                │                                 │                                      │
+  │                 │                │ for each BundleMember:          │                                      │
+  │                 │                │   switch (primitive.kind):      │                                      │
+  │                 │                │     skill   → POST /workspace/:wid/skills ─────────▶                   │
+  │                 │                │                                 │ write .opencode/skills/<name>/SKILL.md│
+  │                 │                │     command → POST /workspace/:wid/commands ────────▶                  │
+  │                 │                │     mcp     → POST /workspace/:wid/mcp ─────────────▶                  │
+  │                 │                │     plugin_code → POST /workspace/:wid/plugins ─────▶                  │
+  │                 │                │     agent   → POST /workspace/:wid/files/content ───▶                  │
+  │                 │                │   record AppliedPrimitiveDigest (targetPath, contentHashAtWrite)       │
+  │                 │                │                                 │                                      │
+  │                 │                │ reload-watcher emits ReloadEvents per affected subdir                  │
+  │                 │                │ WorkspaceInstallation.status = "applied"                               │
+  │                 │◀─ SSE/poll: status="applied", progress[] ────────│                                      │
+  │                 │                │                                 │                                      │
+  │                 │  OpenCode session:                                                                      │
+  │                 │    auto-reload if openwork.json.reload.auto, else toast "reload available"              │
+```
+
+### D. Uninstall (drift-safe)
+
+```
+ Den API                                                              Disk
+    │                                                                   │
+    │ load WorkspaceInstallation.appliedPrimitiveDigests                 │
+    │ for each digest:                                                   │
+    │   GET current file via /workspace/:wid/{skills|commands|…} ──────▶ │
+    │                                                            ◀───── │
+    │   if (currentHash === digest.contentHashAtWrite):                  │
+    │     DELETE /workspace/:wid/{…}/:name                               │
+    │   else:                                                            │
+    │     leave file; record drift.skipped[primitiveId]                  │
+    │ status = "uninstalled"                                             │
+    │ return { removed: [...], skipped: [...] }                          │
+```
+
+## How each connector is structured (GitHub + Bitbucket)
+
+Both implement the same internal interface — only the provider-specific guts differ. Pseudocode:
+
+```ts
+interface Connector {
+  type: "github" | "bitbucket";
+  displayName: string;
+  scopes: string[];
+
+  // OAuth
+  buildAuthorizeUrl({ orgId, state, redirectUri }): string;
+  exchangeCode({ code }): { accessToken, refreshToken, expiresAt, account };
+  refreshToken({ refreshToken }): { accessToken, refreshToken, expiresAt };
+  revoke({ accessToken }): void;
+
+  // Enumeration
+  listAccounts({ credentials }): Account[];
+  listRepos({ credentials, accountId, cursor? }): Page<Repo>;
+  peekManifest({ credentials, locator }): "plugin" | "marketplace" | "none";
+
+  // Ingestion — the heart of it
+  fetchPluginFS({ credentials, locator }): FileTree;
+
+  // Change detection
+  registerWebhook({ credentials, locator, secret }): webhookId;
+  unregisterWebhook({ credentials, locator, webhookId }): void;
+  verifyWebhook(req): { ok: boolean; event?: RepoPushEvent };
+}
+```
+
+A separate **ingester** (provider-agnostic) takes `FileTree`, detects the shape, produces `Primitive` upserts and (optionally) `Bundle`+`BundleMember` upserts:
+
+```
+ingest(fileTree, pluginSourceId):
+  shape = detectShape(fileTree)
+    # possible shapes:
+    #   "claude-marketplace"   (.claude-plugin/marketplace.json)
+    #   "claude-single"        (.claude-plugin/plugin.json at root)
+    #   "opencode-workspace"   (opencode.json{c} + .opencode/)
+    #   "bare-skills"          (skills/*/SKILL.md with no manifest)
+
+  for each plugin-root in shape.pluginRoots:
+    # 1. Parse primitives (always)
+    walk skills/*/SKILL.md   → upsert Primitive(kind=skill, content=<md>,   metadata=<frontmatter>)
+    walk agents/*.md         → upsert Primitive(kind=agent, content=<md>,   metadata=<frontmatter>)
+    walk commands/*.md       → upsert Primitive(kind=command, content=<md>, metadata=<frontmatter>)
+    parse .mcp.json OR       → upsert Primitive(kind=mcp_server, content=<json>, metadata=<name+config>)
+          opencode.json.mcp  → upsert Primitive(kind=mcp_server, content=<json>, metadata=<name+config>)
+    walk .opencode/plugins/*.{ts,js} → upsert Primitive(kind=plugin_code, content=<src>)
+    parse hooks/hooks.json   → flag as Primitive(kind=hook, validation_status=warn, reason="claude-json-hooks")
+                               # see "Hooks strategy" — not directly materializable on OpenCode
+
+    # All primitives get origin = { type: "connector", plugin_source_id, path_in_repo, commit_sha }
+    # content_hash = sha256(content)
+
+    # 2. Parse bundle metadata (manifest-dependent)
+    if shape == "claude-marketplace" or "claude-single":
+      parse .claude-plugin/plugin.json  → upsert Bundle(name, description, version, …)
+      link parsed primitives as BundleMembers
+    if shape == "opencode-workspace":
+      synthesize Bundle from opencode.json name/package metadata
+      link all parsed primitives as members
+    if shape == "bare-skills":
+      synthesize Bundle(name = repo name, description = readme excerpt)
+      link all skill primitives as members
+```
+
+This means the GitHub and Bitbucket connectors share ~80% of their effort as the ingester — each connector is just "auth + fetch file tree + detect changes". Adding GitLab / npm / local later is a ~200 LOC adapter, no new parsing logic.
+
+### GitHub specifics
+
+- **OAuth app** credentials server-side. Scopes `repo`, `read:org`.
+- `buildAuthorizeUrl` → `https://github.com/login/oauth/authorize?client_id=…&redirect_uri=…&scope=…&state=…`
+- `exchangeCode` → `POST https://github.com/login/oauth/access_token`
+- `listAccounts` → `GET /user` + `GET /user/orgs`
+- `listRepos(accountId)` → `GET /orgs/:org/repos` or `GET /user/repos`
+- `peekManifest` → `GET /repos/:owner/:repo/contents/.claude-plugin/marketplace.json` (404-tolerant)
+- `fetchPluginFS` → tarball download (`GET /repos/:owner/:repo/tarball/:ref`) or git tree API for surgical reads
+- `registerWebhook` → `POST /repos/:owner/:repo/hooks` filtered to `push` events
+- `verifyWebhook` → HMAC-SHA256 against `X-Hub-Signature-256` using the per-source secret
+
+### Bitbucket specifics
+
+- **OAuth consumer** credentials server-side. Scopes `repository`, `account`.
+- `buildAuthorizeUrl` → `https://bitbucket.org/site/oauth2/authorize?client_id=…&response_type=code&state=…`
+- `exchangeCode` → `POST https://bitbucket.org/site/oauth2/access_token`
+- `listAccounts` → `GET /2.0/user` + `GET /2.0/workspaces`
+- `listRepos(workspace)` → `GET /2.0/repositories/:workspace`
+- `peekManifest` → `GET /2.0/repositories/:workspace/:repo/src/:ref/.claude-plugin/marketplace.json`
+- `fetchPluginFS` → recursive `/src/:ref/` walk or `/downloads/` tarball
+- `registerWebhook` → `POST /2.0/repositories/:workspace/:repo/hooks`
+- `verifyWebhook` → HMAC against `X-Hub-Signature` using the webhook UUID secret
+
+## OAuth flow mapped to endpoints
+
+What the UI currently simulates in `IntegrationConnectDialog` maps to real calls like this:
+
+| Dialog step | Mock behavior now | Real behavior |
+|---|---|---|
+| 1. Authorize | Click advances state | `POST /integrations/authorize` → navigate to `redirectUrl` → provider redirects to `/v1/oauth/:type/callback` → Den redirects back to `/integrations?success&integrationId=…` |
+| 2. Select account | `useIntegrationAccounts(provider)` from mock | `GET /integrations/:id/accounts` |
+| 3. Select repos | `useIntegrationRepos(provider, accountId)` from mock | `GET /integrations/:id/accounts/:accountId/repos?q=…` |
+| 4. Connecting | `useConnectIntegration().mutateAsync` — local mock | `POST /integrations/:id/plugin-sources` body: the selected repos — server queues initial sync |
+| 5. Connected | Show success | Poll `GET /plugin-sources/:id/status` or SSE until `last_sync_status === "ok"` |
+
+## Security
+
+- Credentials encrypted at rest (AES-GCM with a KMS-rotated key, per-org data key).
+- OAuth `state` stored server-side for 10 min, single-use, bound to `orgId + userId`.
+- Webhook secrets per `PluginSource`, not per integration — so revoking one source doesn't nuke the rest.
+- `peekManifest` and `fetchPluginFS` must tolerate 404 / 403 / rate-limit and never throw into user flow — return typed results.
+- Per-installation revocation should call provider revoke endpoints (`DELETE /applications/:client_id/grant` for GitHub, Bitbucket equivalent).
+- Audit log row for every integration-level action (connect, disconnect, token refresh, source add, source remove, webhook verify failure).
+- **Strict manifest validation** before ingestion — reject plugins that reference files outside their plugin root (`../shared-utils`), same rule Claude Code enforces.
+
+## Hooks strategy
+
+Claude Code's `hooks.json` is declarative (events + shell commands). OpenCode's hooks are **code** (JS/TS exporting a `Hooks` interface from a plugin). These are not mechanically equivalent. Three options:
+
+| Option | What it does | Cost | Verdict |
+|---|---|---|---|
+| A. Refuse import | At ingest, detect Claude-style `hooks/hooks.json`. Store the raw JSON on the Bundle but mark those hook primitives as `validation_status: "warn"` with a message: "Claude-style JSON hooks require an OpenCode plugin wrapper. [Docs]". Nothing materializes. | Zero | **v1 default** |
+| B. Auto-wrap | On install, generate a `.opencode/plugins/<bundle-slug>-hooks.ts` that reads the JSON manifest and maps each Claude event to the equivalent OpenCode hook, spawning the declared shell command. | Medium — need a careful event mapping table and a stable wrapper runtime. | v1.1 |
+| C. Ship a universal runner | Publish one npm package `@openwork/claude-hooks-runtime` that reads JSON hooks from a well-known path (`.opencode/openwork/hooks/*.json`) and registers them once. Installing any Bundle with JSON hooks just drops files in that path. | High upfront (one-time infrastructure) but zero per-Bundle cost thereafter. | v2 — best long-term |
+
+Recommendation: **A → C**. Ship A now so imports don't fail catastrophically, schedule C as a dedicated workstream. Skip B (per-Bundle codegen is a maintenance liability).
+
+Event mapping table we'd need for B/C (Claude → OpenCode):
+
+| Claude event | OpenCode equivalent | Notes |
+|---|---|---|
+| `PreToolUse` | `tool.execute.before` | matcher on tool name |
+| `PostToolUse` | `tool.execute.after` | |
+| `SessionStart` | `event` with `session.start` | via generic event hook |
+| `SessionEnd` | `event` with `session.end` | |
+| `UserPromptSubmit` | `chat.message` or `experimental.chat.messages.transform` | |
+| `Notification` | no direct equivalent | punt |
+| `Stop` | `experimental.session.compacting` (close) | approximate |
+
+## Authoring flow (creating primitives + bundles in-app)
+
+The reverse of ingest. A user authors Primitives + Bundles directly without a connector, e.g. to capture an ad-hoc skill they just wrote in chat.
+
+### A.1 Author a primitive
+
+1. User clicks **"Create skill"** (or agent/command/MCP) from `/plugins` → `All Skills` tab.
+2. A composer drawer opens with the right form per `kind`:
+   - `skill` → YAML frontmatter (`name`, `description`) + body editor.
+   - `agent` → frontmatter (`mode`, `model`, `tools` etc.) + system-prompt body.
+   - `command` → frontmatter (`description`, `agent?`, `model?`) + template with `$ARGUMENTS`.
+   - `mcp_server` → form (transport, command/url, env).
+3. `POST /v1/orgs/:orgId/primitives` creates the row with `origin = { type: "authored", authorOrgMembershipId }`.
+4. `validation_status` is computed synchronously (frontmatter schema, name kebab-case, reserved names, forbidden paths).
+
+### A.2 Compose a bundle
+
+1. `/plugins` → **"Create plugin"** button opens the bundle composer.
+2. User picks `name`, `description`, `version`, `icon`, `category`, and searches existing Primitives to add as `BundleMember`s (drag or click).
+3. `POST /v1/orgs/:orgId/bundles` with `{ slug, name, …, memberPrimitiveIds }`.
+4. The server enforces that every referenced primitive belongs to the same org.
+
+### A.3 Edit / delete
+
+- Authored primitives + bundles are mutable via `PATCH` and `DELETE`.
+- Connector-sourced primitives/bundles are read-only; `PATCH` returns `409 conflict_readonly_connector_source` with a hint to fork.
+- **Fork**: `POST /v1/orgs/:orgId/primitives/:id/fork` (and similar for bundles) creates an authored copy the user can edit.
+
+## Publish / export (sharing authored bundles)
+
+Closes the loop with the ecosystem: an authored Bundle can be pushed back to a Git repo as a Claude-compatible marketplace tree so other OpenWork (or Claude Code) users can ingest it.
+
+### Flow
+
+1. User on a Bundle detail page clicks **"Publish to repo"**.
+2. Picks a target: a connected Integration + repo + branch.
+3. `POST /v1/orgs/:orgId/bundles/:id/publish` with `{ targetRepo, targetRef, commitMessage }`.
+4. Server materializes the Bundle into a `.claude-plugin/` tree in a scratch directory:
+   - `.claude-plugin/plugin.json` ← Bundle metadata
+   - `skills/<name>/SKILL.md` ← each `skill` Primitive
+   - `agents/<name>.md` ← each `agent` Primitive
+   - `commands/<name>.md` ← each `command` Primitive
+   - `.mcp.json` ← merged `mcp_server` Primitives
+   - OpenCode plugin code Primitives → warn (Claude target doesn't support native TS plugins)
+5. Server commits + pushes via the Integration's credentials. Returns the commit SHA + a link.
+
+### Multi-bundle publishing
+
+Publishing multiple Bundles to the same repo synthesises a `.claude-plugin/marketplace.json` catalog listing each as a plugin entry under `plugins/<slug>/`.
+
+### Round-trip guarantee
+
+Ingesting an exported tree back into OpenWork MUST produce semantically-identical Primitives (same `contentHash` per primitive, same Bundle membership). This is a tested invariant — see [Test strategy](#test-strategy).
+
+## CLI surface
+
+For agents running inside an OpenCode session to manage the catalog without leaving the shell. Mirrors Claude Code's `claude plugin …` commands.
+
+```
+openwork connector list
+openwork connector add github --repo different-ai/openwork-plugins [--ref main]
+openwork connector remove <source-id>
+openwork connector sync <source-id>
+
+openwork bundle list [--installed]
+openwork bundle show <bundle-slug>
+openwork bundle install <bundle-slug> [--scope workspace|user|org]
+openwork bundle uninstall <bundle-slug>
+openwork bundle publish <bundle-slug> --to github:owner/repo [--ref main]
+
+openwork primitive list [--kind=skill|agent|…]
+openwork primitive show <name> --kind=<kind>
+openwork primitive create --kind=skill --file=./my-skill.md
+```
+
+All commands hit the same API endpoints as the web UI — the CLI is a thin shell over `requestJson`. Output formats: `--json` for scripting, default human-friendly tables.
+
+An **OpenWork skill** wraps the CLI and surfaces it to agents:
+
+```yaml
+---
+name: openwork-plugin-manager
+description: |
+  Install, uninstall, and discover OpenWork plugins (bundles).
+
+  Triggers when user mentions:
+  - "install plugin"
+  - "what plugins are available"
+  - "publish this as a plugin"
+---
+```
+
+This makes the full lifecycle reachable from inside any OpenCode conversation — living system behavior.
+
+## Observability + audit events
+
+Every state-changing operation emits an `AuditEvent` row with structured fields. Used for debugging, billing-relevant rate limits, and compliance.
+
+```ts
+type AuditEvent = {
+  id: UUID;
+  orgId: UUID;
+  actor: { kind: "user" | "system" | "webhook"; id?: string };
+  event: AuditEventType;
+  subject: { kind: string; id: string };        // e.g. { kind: "integration", id: "…" }
+  metadata: Record<string, unknown>;             // event-specific
+  createdAt: Iso8601;
+  requestId: string;                             // for correlating with logs
+};
+
+type AuditEventType =
+  // Integrations
+  | "integration.connected"
+  | "integration.disconnected"
+  | "integration.token_refreshed"
+  | "integration.webhook_verify_failed"
+  // Sources
+  | "plugin_source.attached"
+  | "plugin_source.detached"
+  | "plugin_source.sync_started"
+  | "plugin_source.sync_succeeded"
+  | "plugin_source.sync_failed"
+  // Primitives
+  | "primitive.created"
+  | "primitive.updated"
+  | "primitive.deleted"
+  | "primitive.forked"
+  // Bundles
+  | "bundle.created"
+  | "bundle.updated"
+  | "bundle.deleted"
+  | "bundle.published"
+  // Installations
+  | "installation.started"
+  | "installation.applied"
+  | "installation.failed"
+  | "installation.uninstalled"
+  | "installation.drift_detected";
+```
+
+### Metrics (Prometheus-style labels)
+
+| Metric | Type | Labels | Purpose |
+|---|---|---|---|
+| `connectors_sync_duration_seconds` | histogram | `provider`, `status` | Ingest latency SLO |
+| `connectors_ingested_primitives_total` | counter | `provider`, `kind` | Catalog growth |
+| `installations_materialize_duration_seconds` | histogram | `status` | Install latency SLO |
+| `installations_drift_detected_total` | counter | `kind` | Track how often users edit on disk |
+| `webhooks_received_total` | counter | `provider`, `verified` | Traffic + security signal |
+
+### Alerts (proposed thresholds)
+
+- Sync failure rate > 5% over 5 min → page.
+- Materialization p95 > 30s → warn.
+- Webhook verification failures > 10/min → page (likely secret leak or attack).
+
+## Rollout plan
+
+Five slices, each independently shippable behind a feature flag. Previous slices stay on mocks until the backing slice lands.
+
+| Slice | Scope | Feature flag | Gates |
+|---|---|---|---|
+| 0 | **This PRD** (lands now) | n/a | Merged |
+| 1 | Connector-types registry + Integrations CRUD + GitHub adapter + ingester + Primitive + Bundle tables + read-only `GET /v1/orgs/:orgId/{integrations,plugins,primitives,bundles}` | `ff.connectors.read` | Ingest a real repo; Den web Phase 1–3 reads live data |
+| 2 | Authoring: `POST/PATCH/DELETE /v1/orgs/:orgId/{primitives,bundles}` + bundle members | `ff.connectors.author` | User can create + edit in-app |
+| 3 | WorkspaceInstallation + materialization engine + agents endpoint (`POST /workspace/:id/agents`) | `ff.connectors.install` | Install Bundle from mock Den workspace; file appears on disk; OpenCode loads it |
+| 4 | Bitbucket adapter + webhooks | `ff.connectors.bitbucket`, `ff.connectors.webhooks` | Multi-provider + live updates |
+| 5 | Publish/export + CLI + universal hook runtime | `ff.connectors.publish`, `ff.connectors.cli`, `ff.connectors.hook_runtime` | Round-trip + ecosystem |
+
+### Mock-removal choreography
+
+For each slice that lands, the Den web side removes exactly one mock file's contents and swaps `queryFn`:
+
+- Slice 1 → `integration-data.tsx` queries hit real endpoints; `plugin-data.tsx` `usePlugins` reads real bundles, still filtered client-side by connected integrations.
+- Slice 3 → add `useWorkspaceInstallations()` + new `/workspaces/:id/plugins` page.
+
+### Rollback
+
+Every slice's feature flag is independent. Rolling back slice N leaves slices 0..N-1 intact. Connector-written primitives are soft-deletable (`deletedAt`) so a bad sync can be reverted without data loss.
+
+### Migration
+
+No existing data to migrate — these are all new tables. The existing `/v1/orgs/:orgId/skills` endpoint (skill-hubs) keeps working; slice 1 adds a backfill that copies skill-hub skills into the `primitives` table as `origin = { type: "authored", … }` so they show up in the unified index. Skill-hubs remain as-is for deletion after slice 2.
+
+## Test strategy
+
+### Unit
+
+- **Ingester**: table-driven tests for each shape (`claude-marketplace`, `claude-single`, `opencode-workspace`, `bare-skills`). Golden-file fixtures under `test/fixtures/ingest/`.
+- **Connector adapters**: mock GitHub/Bitbucket HTTP with `nock`; assert request construction (scopes, OAuth params, webhook payloads).
+- **Materialization**: mock the OpenWork server API; assert correct endpoint + body per primitive kind; assert `appliedPrimitiveDigests` is recorded.
+- **Drift detection**: given `{ primitive.contentHash, disk.hash }` permutations, assert correct classification.
+
+### Integration
+
+- **Real GitHub**: a test org + throwaway repo under `different-ai/openwork-test-plugins` with fixture plugins. CI authenticates with a PAT; runs a full ingest + install + uninstall against a temp worktree. Skipped in local unless `OPENWORK_TEST_GITHUB_PAT` is set.
+- **Real OpenWork server**: starts a local OpenWork app/server stack, provisions a workspace, runs materialization, diffs `.opencode/` against expectations.
+
+### End-to-end
+
+- **Den web** + Chrome MCP: the flow shipped in PRs #1472 / #1475 re-run against real endpoints. Authorize GitHub → select repo → install a bundle → check `/plugins` populates → check `.opencode/skills/` on the worker.
+- **Round-trip**: author a Bundle in-app → publish to a repo → ingest that repo from another org → assert Primitives are identical (same `contentHash`) and Bundle membership matches.
+
+### Fuzz / property tests
+
+- **Path safety**: property-test the ingester against random inputs; assert no `../` path ever reaches a write.
+- **Drift math**: for any sequence of `(write, user-edit?, uninstall)`, assert uninstall never deletes a file the installer didn't write.
+
+### Regression invariants (asserted in CI)
+
+- `contentHash(ingest(export(bundle)))` === `contentHash(bundle.members.content)` for every primitive kind.
+- Installing the same Bundle twice is idempotent (same final disk state, same digests).
+- Uninstall after a user edit leaves the file untouched and records drift.
+
+## UI surfaces (where each phase lives)
+
+| Phase | UI surface | Status |
+|---|---|---|
+| 1. Ingest | `/o/:slug/dashboard/integrations` | ✅ shipped (mock), wire to real API |
+| 2. Primitive index | `/o/:slug/dashboard/plugins` — `All Skills` / `All Hooks` / `All MCPs` tabs | ✅ shipped (mock), wire to real API |
+| 3. Bundle denomination | `/o/:slug/dashboard/plugins` — list + detail view | ✅ shipped (mock); add `/plugins/new` and `/plugins/:id/edit` for authoring |
+| 4. Workspace install | **new**: `/o/:slug/dashboard/workspaces/:workspaceId/plugins` or a tab inside the existing workspace view | 🟡 not yet built |
+
+The new Phase-4 surface shows:
+
+- Currently installed bundles in this workspace (with scope badges: `Workspace` / `User` / `Org`).
+- Per-primitive status rows: "Skill `release-prep` → `.opencode/skills/release-prep/SKILL.md` ✓".
+- A "browse plugins" CTA that opens `/plugins` in install-mode with this workspace pre-selected.
+- Drift indicators when on-disk content no longer matches `applied_primitive_digests`.
+
+Rough visual: same `DashboardPageTemplate` shell, same `DenSelectableRow` for per-primitive status, reuse the `PaperMeshGradient` card per installed bundle.
+
+## Open questions
+
+**Resolved since v1 of this PRD** (keeping for trace):
+
+- ✅ Canonical FS: `.opencode/` is source of truth on disk; DB indexes. Claude `.claude/skills/` paths work natively since OpenCode reads them.
+- ✅ Plugin materialization: virtual bundles; primitives written individually to native `.opencode/` paths.
+- ✅ Primitive storage: `.opencode/` is source of truth. Remote DB is the org-wide index today; local DB (triggered via a skill) is the future direction.
+
+**Still open:**
+
+1. **Agents mutation endpoint**: OpenWork server has `/workspace/:id/{skills,commands,plugins,mcp}` but **no dedicated agents endpoint**. Options: (a) add `POST /workspace/:id/agents`, (b) use the generic `POST /workspace/:id/files/content` for agents, (c) bundle agents under plugins. Recommend (a) for parity.
+2. **Single-plugin repos vs marketplace repos**: both from day one? (Strongly yes.)
+3. **Sync strategy**: webhooks-only, webhooks+daily poll fallback, or polling only for v1? Webhooks need a public ingress; for the desktop-hosted case that's harder. Start with polling + manual "sync now", add webhooks as a cloud-only feature.
+4. **Installation scope semantics**: how does "org / user / workspace" map onto `orgMembership` / `workspace`? Specifically: can "org" scope auto-install into every newly-created workspace in that org (pre-populate from `extraKnownMarketplaces`-style config)?
+5. **Hooks strategy rollout**: confirm A-now, C-later, skip B.
+6. **Private package connector**: is npm a v1 target or punt to v1.1? npm adds tarball-fetch + auth.
+7. **Client-authored connectors**: "clients can create connectors, or we can" — is that in-scope for v1 (user-registered connector definitions in DB)? Recommend punting to v2 and keeping v1 adapter-registry code-only.
+8. **Drift policy defaults**: when a workspace's `.opencode/skills/foo/SKILL.md` differs from the installed Bundle's Primitive, do we (a) prefer disk silently, (b) prefer disk + warn on the Installations page, (c) force a reapply on next install action? Recommend (b).
+9. **Bundle versioning semantics**: if a user installs Bundle v1.2 and we re-ingest and now see v1.3, do we auto-update or require an explicit "Update available" click? Recommend explicit click — matches Claude Code's `/plugin marketplace update` semantics.
+
+## What this buys us vs. building a bespoke schema
+
+1. **OpenCode-native materialization** — we don't fight the runtime. OpenCode reads exactly what it already expects; our system produces those files.
+2. **Claude-ecosystem compatibility at the skill layer** — `.claude/skills/**/SKILL.md` trees work natively; Claude-style `.claude-plugin/marketplace.json` trees are importable (with agents/commands rehomed at ingest).
+3. **Thin connector adapters** — parsing + materialization is shared; each provider is just "auth + fetch tree + webhook verify".
+4. **Clean separation of concerns** — Primitives (atoms) ≠ Bundles (groups) ≠ WorkspaceInstallations (projection). Each layer testable in isolation.
+5. **Drift-safe uninstall** — `applied_primitive_digests` gives exact reversal without stomping on user edits.
+6. **Future-proofs the local-DB pivot** — the `origin.local_mirror` variant is already in the schema; switching SoT from remote-DB-index to local-DB-canonical is additive, not a rewrite.
+
+## Next steps
+
+Mapped directly to [Rollout plan](#rollout-plan) slices:
+
+1. **Land this PRD** (this PR — slice 0).
+2. **Slice 1** — ingest → index. Ship behind `ff.connectors.read`.
+3. **Slice 2** — authoring. Ship behind `ff.connectors.author`. Covers mock-removal for Phase 3 composer.
+4. **Slice 3** — install → materialize. Ship behind `ff.connectors.install`. New `/workspaces/:id/plugins` page + `POST /workspace/:id/agents` endpoint.
+5. **Slice 4** — Bitbucket + webhooks.
+6. **Slice 5** — publish/export + CLI + universal hook runtime.
+
+Each slice owns its feature flag, mock-removal scope, and rollback plan (see Rollout plan for details).
diff --git a/prds/new-plugin-arch/github-connection/plan.md b/prds/new-plugin-arch/github-connection/plan.md
new file mode 100644
index 0000000000..85bdadc1a7
--- /dev/null
+++ b/prds/new-plugin-arch/github-connection/plan.md
@@ -0,0 +1,123 @@
+# GitHub Connection UX Plan
+
+## Goal
+
+Define the desired user experience for connecting GitHub to OpenWork in den-web (cloud), independent of the current implementation state.
+
+This flow is for the den-api plugin connector system and GitHub App based connector onboarding.
+
+## Desired user flow
+
+1. User is in OpenWork den-web (cloud).
+2. User sees an `Integrations` entry point.
+3. User opens `Integrations`.
+4. User sees a GitHub integration card.
+5. User clicks `Connect` on GitHub.
+6. OpenWork sends the user to the GitHub App install/authorize flow.
+7. User completes the normal GitHub steps on GitHub.
+8. GitHub returns the user to OpenWork.
+9. OpenWork recognizes the completed GitHub App installation for the current org/user context.
+10. OpenWork shows the user the list of repositories available through that installation.
+11. User selects one repository.
+12. OpenWork creates a new GitHub connector instance for that selected repository.
+13. OpenWork configures webhook-driven sync for that repository.
+14. Future pushes to the connected repository trigger OpenWork sync behavior through the connector pipeline.
+
+## Product expectations
+
+### Integrations surface
+
+- den-web should expose a clear `Integrations` UI in cloud mode.
+- GitHub should appear as a first-class integration option.
+- The user should not need to manually paste GitHub installation ids or repository ids.
+
+### Connect action
+
+- Clicking `Connect` should start a GitHub App flow, not a legacy OAuth-only flow.
+- The flow should preserve enough OpenWork context to return the user to the correct org and screen after GitHub finishes.
+- The GitHub-side step should feel like a normal GitHub App installation flow.
+
+### Return to OpenWork
+
+- After GitHub redirects back, OpenWork should detect the installation that was just created or updated.
+- If installation state is incomplete or ambiguous, OpenWork should guide the user instead of silently failing.
+- The user should land back in the GitHub integration flow, not on a generic page with no next step.
+
+### Repository selection
+
+- OpenWork should list repositories available to the installation.
+- The user should be able to pick one repository as the first connected source.
+- Selecting a repository should create a connector instance for that repo in the current OpenWork org.
+- The UX may later support branch choice and mapping choice, but repository selection is the minimum required step.
+
+### Webhook + sync expectation
+
+- Once connected, OpenWork should be ready to receive GitHub App webhooks for the selected repository.
+- Pushes on the tracked branch should enter the connector sync pipeline.
+- The system should present this as a connected integration, not as a hidden backend-only setup.
+
+## User-facing behavior requirements
+
+- The user should not need to know what an installation id is.
+- The user should not need to call admin APIs manually.
+- The user should not need to configure webhooks manually in normal product usage.
+- The user should be able to understand whether GitHub is:
+  - not connected
+  - connected but no repository selected
+  - connected and repository syncing
+  - connected but needs attention
+
+## Desired backend behavior
+
+To support the UX above, the backend flow should conceptually do the following:
+
+1. Generate or expose the GitHub App install URL.
+2. Preserve OpenWork return context across the redirect.
+3. Handle the GitHub return/callback.
+4. Resolve the GitHub App installation id associated with the user action.
+5. Create or update the corresponding `connector_account`.
+6. List repositories accessible through that installation.
+7. On repo selection, create:
+   - a `connector_instance`
+   - a `connector_target` for the repo/branch
+   - any initial mappings needed for ingestion
+8. Ensure webhook events can resolve that connector target.
+9. Queue sync work when relevant webhook events arrive.
+
+## UX principles
+
+- Prefer a short, guided flow over a configuration-heavy admin experience.
+- Favor product language like `Connect GitHub` over backend nouns like `connector account`.
+- Hide raw GitHub/App identifiers from the normal UX unless needed for support/debugging.
+- Keep the first-run flow focused on success: install, return, pick repo, connected.
+- Advanced settings can exist later, but should not block first connection.
+
+## Success criteria
+
+The experience is successful when:
+
+1. A cloud user can start from den-web without using terminal commands.
+2. The user can complete GitHub App installation from the app.
+3. The user returns to OpenWork automatically.
+4. OpenWork shows repositories from that installation.
+5. The user selects a repo.
+6. OpenWork creates a connector instance for that repo.
+7. GitHub webhooks for that repo can be accepted and associated to the instance.
+8. The connection state is visible in the product UI.
+
+## Non-goals for this document
+
+- Exact API shapes for every route.
+- Full ingestion/reconciliation design details.
+- Delivery/install runtime behavior for connected content.
+- Final UI layout or visual design.
+
+## Next planning step
+
+Translate this desired UX into an implementation plan that maps:
+
+- den-web screens and states
+- den-api routes and callback behavior
+- GitHub App configuration requirements
+- connector-account / connector-instance creation behavior
+- webhook readiness and initial sync behavior
diff --git a/prds/new-plugin-arch/github-connection/repo-discovery-plan.md b/prds/new-plugin-arch/github-connection/repo-discovery-plan.md
new file mode 100644
index 0000000000..69d32a66cb
--- /dev/null
+++ b/prds/new-plugin-arch/github-connection/repo-discovery-plan.md
@@ -0,0 +1,773 @@
+# GitHub Repo Discovery Plan
+
+## Goal
+
+Define the discovery phase that happens after a user connects a GitHub repo and returns to Den Web.
+
+This phase should:
+
+1. inspect the connected repository structure;
+2. determine whether the repo is a Claude-compatible marketplace repo, a Claude-compatible single-plugin repo, or a looser folder-based repo;
+3. present the discovered plugins to the user in a setup flow;
+4. let the user choose which discovered plugins should map into OpenWork;
+5. translate the selected discovery result into OpenWork connector records and future ingestion work.
+
+This document covers:
+
+- the discovery UX;
+- the GitHub-side reads we need;
+- how we detect supported repo shapes;
+- how we infer plugins when no manifest exists;
+- how the result maps into OpenWork internal structures.
+
+Related:
+
+- `prds/new-plugin-arch/github-connection/plan.md`
+- `prds/new-plugin-arch/github-connection/connectors.md`
+- `prds/new-plugin-arch/GitHub-connector.md`
+
+## Why a discovery phase exists
+
+The current post-connect flow stops at repository selection.
+
+That is enough to create:
+
+- a `connector_account`;
+- a `connector_instance`;
+- a `connector_target`;
+- webhook-triggered `connector_sync_event` rows.
+
+It is not enough to understand the shape of the repo and convert that shape into useful OpenWork mappings.
+
+The discovery phase fills that gap.
+
+Instead of immediately asking the user to author raw path mappings, OpenWork should first inspect the repo and propose a structured interpretation of what it found.
+
+## Desired user flow
+
+### Updated high-level flow
+
+1. User connects GitHub.
+2. User selects a repository.
+3. OpenWork creates the connector instance and target.
+4. OpenWork routes the user into a dedicated `Setup` / `Discovery` page for that connector instance.
+5. OpenWork reads the repository tree and shows progress steps in the UI.
+6. OpenWork classifies the repo shape.
+7. OpenWork shows discovered plugins, preselected by default.
+8. User confirms or deselects discovered plugins.
+9. OpenWork creates the initial connector mappings and plugin records from that discovery result.
+10. OpenWork is ready for initial ingestion/sync.
+
+### User-facing setup steps
+
+The setup page should feel like a guided scan.
+
+Suggested steps:
+
+1. `Reading repository structure`
+2. `Checking for Claude marketplace manifest`
+3. `Checking for plugin manifests`
+4. `Looking for known component folders`
+5. `Preparing discovered plugins`
+
+The UI should show:
+
+- which step is currently running;
+- success/failure state per step;
+- the discovered plugins list when ready;
+- clear empty-state or unsupported-shape messaging when nothing useful is found.
+
+## Reference conventions
+
+### Official Claude plugin conventions
+
+Based on the Claude plugin docs and reference repo:
+
+- plugin manifest lives at `.claude-plugin/plugin.json`;
+- marketplace manifest lives at `.claude-plugin/marketplace.json`;
+- plugin components live at the plugin root, not inside `.claude-plugin/`;
+- common plugin root folders include:
+  - `skills/`
+  - `commands/`
+  - `agents/`
+  - `hooks/`
+  - `.mcp.json`
+  - `.lsp.json`
+  - `monitors/`
+  - `settings.json`
+- standalone Claude configuration can also live under `.claude/`, especially:
+  - `.claude/skills/`
+  - `.claude/agents/`
+  - `.claude/commands/`
+
+### Reference repo
+
+Use `https://github.com/anthropics/claude-plugins-official` as a reference shape for marketplace repos.
+
+Important observations:
+
+- the repo has a root `.claude-plugin/marketplace.json`;
+- it contains multiple plugin entries;
+- many entries point at local paths inside the repo such as `./plugins/...` or `./external_plugins/...`;
+- some entries point at external git URLs or subdirs.
+
+That means OpenWork discovery should treat marketplace repos as a first-class shape, but be explicit about what is in-scope for a connected single repo.
+
+## Discovery output model
+
+The discovery phase should produce an explicit, structured result.
+
+Suggested conceptual result:
+
+```ts
+type RepoDiscoveryResult = {
+  connectorInstanceId: string
+  connectorTargetId: string
+  repositoryFullName: string
+  ref: string
+  treeSummary: {
+    scannedEntryCount: number
+    truncated: boolean
+    strategy: "git-tree-recursive" | "contents-bfs"
+  }
+  classification:
+    | "claude_marketplace_repo"
+    | "claude_multi_plugin_repo"
+    | "claude_single_plugin_repo"
+    | "folder_inferred_repo"
+    | "unsupported"
+  discoveredPlugins: DiscoveredPlugin[]
+  warnings: DiscoveryWarning[]
+}
+
+type DiscoveredPlugin = {
+  key: string
+  sourceKind:
+    | "marketplace_entry"
+    | "plugin_manifest"
+    | "standalone_claude"
+    | "folder_inference"
+  rootPath: string
+  displayName: string
+  description: string | null
+  selectedByDefault: boolean
+  manifestPath: string | null
+  componentKinds: Array<"skill" | "command" | "agent" | "hook" | "mcp_server" | "lsp_server" | "monitor" | "settings">
+  componentPaths: {
+    skills: string[]
+    commands: string[]
+    agents: string[]
+    hooks: string[]
+    mcpServers: string[]
+    lspServers: string[]
+    monitors: string[]
+    settings: string[]
+  }
+  metadata: Record<string, unknown>
+}
+```
+
+This result is intentionally separate from final ingestion. Discovery should be cheap to recompute and safe to show in the UI.
+
+## API surface
+
+## Requirements
+
+We need an API that can, given the selected connector instance/target, read GitHub and return a normalized view of the repository tree and discovery result.
+
+The tree can be large, so the API must not assume that the full repo listing is always tiny.
+
+### Recommended endpoints
+
+#### 1. Start or refresh discovery
+
+`POST /v1/connector-instances/:connectorInstanceId/discovery/refresh`
+
+Purpose:
+
+- read GitHub using the installation token;
+- build or refresh the discovery snapshot;
+- persist the result for the UI;
+- return the current discovery state.
+
+Recommended response:
+
+- current step/state;
+- summary counts;
+- discovered plugins if already complete.
+
+#### 2. Get discovery state
+
+`GET /v1/connector-instances/:connectorInstanceId/discovery`
+
+Purpose:
+
+- return the last computed discovery result;
+- support polling while the discovery scan runs;
+- drive the setup page without recomputing every request.
+
+#### 3. Page through the normalized repo tree
+
+`GET /v1/connector-instances/:connectorInstanceId/discovery/tree?cursor=&limit=&prefix=`
+
+Purpose:
+
+- expose the discovered file list for debugging and future advanced UX;
+- avoid forcing the UI to load every path at once;
+- support drill-down into a directory prefix.
+
+### Why a persisted snapshot is better than live-only reads
+
+Discovery is more than a raw file listing.
+It is a structured interpretation step.
+
+Persisting the latest snapshot gives us:
+
+- deterministic UI reload behavior;
+- auditability of what the repo looked like when discovery ran;
+- a clean handoff from discovery UI to mapping creation;
+- a place to store warnings and unsupported cases.
+
+## GitHub reading strategy
+
+### Primary strategy
+
+Use the GitHub Git Trees API against the selected branch head commit.
+
+Preferred read path:
+
+1. fetch the tracked branch head SHA;
+2. fetch the recursive tree for that commit;
+3. normalize to a path list with type metadata.
+
+Advantages:
+
+- one request gives the full tree in the common case;
+- easy to search for known files;
+- easy to infer folder groupings;
+- deterministic against a known commit SHA.
+
+### Fallback strategy for large repos
+
+GitHub recursive tree responses can be truncated.
+
+If the recursive tree response is truncated:
+
+1. store that truncated flag;
+2. fall back to directory-by-directory `contents` traversal using BFS;
+3. page the normalized result by `prefix + cursor`;
+4. cap the total scan budget for one discovery run.
+
+### Suggested limits
+
+For v1:
+
+- default API page size: `200` normalized entries;
+- default max discovery scan budget: `10,000` paths;
+- stop scanning further when:
+  - we exceed budget;
+  - or we have enough evidence to classify the repo and build the discovered plugin list.
+
+### Practical optimization
+
+We do not need the full contents of every file during discovery.
+
+We mostly need:
+
+- the path list;
+- whether certain files exist;
+- the content of a small number of manifest files.
+
+So discovery should:
+
+- list tree entries first;
+- only fetch file contents for:
+  - `.claude-plugin/marketplace.json`
+  - any `.claude-plugin/plugin.json`
+  - any root-level `plugin.json` used as a metadata hint
+  - `.mcp.json`
+  - `.lsp.json`
+  - `hooks/hooks.json`
+  - `monitors/monitors.json`
+  - `settings.json`
+
+Do not eagerly fetch SKILL/agent/command content during the discovery phase.
+
+## Classification algorithm
+
+Discovery should classify the repo in this priority order.
+
+### 1. Marketplace repo
+
+Check for root:
+
+- `.claude-plugin/marketplace.json`
+
+If present:
+
+- classify as `claude_marketplace_repo`;
+- parse marketplace entries;
+- attempt to resolve entries that point to local repo paths;
+- present the listed plugins to the user, ticked by default.
+
+### 2. Explicit plugin manifests
+
+If no marketplace manifest exists, search for all instances of:
+
+- `.claude-plugin/plugin.json`
+
+If one or more are found:
+
+- classify as:
+  - `claude_single_plugin_repo` if exactly one plugin manifest exists and it is at repo root;
+  - `claude_multi_plugin_repo` if more than one plugin manifest exists or plugin roots live in subdirectories.
+- create one `DiscoveredPlugin` per manifest.
+
+### 3. Standalone Claude folders
+
+If no marketplace manifest and no plugin manifest is found, check for standalone Claude paths:
+
+- `.claude/skills/**`
+- `.claude/commands/**`
+- `.claude/agents/**`
+
+If present:
+
+- classify as `standalone_claude` in the discovered plugin source kind;
+- infer a single plugin rooted at repo root unless stronger folder grouping is present.
+
+### 4. Folder inference
+
+If none of the explicit Claude shapes exist, infer plugin candidates from known component folders.
+
+Known folders:
+
+- `skills/`
+- `commands/`
+- `agents/`
+
+Rule:
+
+- for each match, examine its parent folder;
+- group sibling component folders by that parent;
+- create one discovered plugin per parent folder.
+
+Example:
+
+```text
+Sales/skills
+Sales/commands
+finance/agents
+finance/commands
+```
+
+Discovery result:
+
+- plugin `Sales`
+- plugin `finance`
+
+This becomes:
+
+- one plugin candidate rooted at `Sales/`
+- one plugin candidate rooted at `finance/`
+
+If the repo itself has root-level `skills/`, `commands/`, or `agents/`, that should infer one root plugin using the repo name as the display name unless better metadata exists.
+
+## Plugin metadata resolution
+
+For each discovered plugin candidate, resolve metadata in this order.
+
+### 1. Official Claude plugin manifest
+
+Check:
+
+- `<root>/.claude-plugin/plugin.json`
+
+If present, use:
+
+- `name`
+- `description`
+- `version`
+- `author`
+- other supported metadata as hints
+
+### 2. Loose metadata hint
+
+If no official manifest exists, optionally check:
+
+- `<root>/plugin.json`
+
+This is not an official Claude plugin location.
+Treat it as a metadata hint only.
+
+Use:
+
+- `name`
+- `description`
+
+Do not treat it as proof that the repo is a Claude plugin.
+
+### 3. Folder-name fallback
+
+If no metadata file exists:
+
+- use the folder name as `displayName`;
+- derive a human-friendly label from that folder name.
+
+For a root plugin with no folder name beyond the repo itself, use the repo name.
+
+## Marketplace repo handling
+
+Marketplace repos need special treatment.
+
+### What we should support in v1
+
+Support marketplace entries whose source resolves inside the currently connected repo.
+
+Examples:
+
+- `./plugins/example-plugin`
+- `./external_plugins/something`
+
+For these entries:
+
+- resolve the local plugin root;
+- inspect that root for components;
+- create one `DiscoveredPlugin` for each entry.
+
+### What we should not silently fake in v1
+
+Marketplace entries that point to external URLs or other repos should not be treated as if they were fully present in the current repo.
+
+Examples:
+
+- `source.url = https://github.com/...`
+- `source.source = git-subdir`
+
+For those entries, discovery should either:
+
+- mark them as `external source not yet supported in repo discovery`; or
+- hide them unless we explicitly decide to support cross-repo expansion.
+
+Recommended v1 behavior:
+
+- show them in the discovery result but disable selection;
+- explain that they require external source expansion, which is out of scope for the current single-repo connector flow.
+
+This keeps the behavior honest and still lets users understand what OpenWork detected.
+
+## Inferred plugin rules
+
+### Known component directories
+
+The discovery system should recognize these as plugin-like components:
+
+- `skills/`
+- `commands/`
+- `agents/`
+- `.claude/skills/`
+- `.claude/commands/`
+- `.claude/agents/`
+
+Optional later additions:
+
+- `hooks/`
+- `.mcp.json`
+- `.lsp.json`
+- `monitors/`
+- `settings.json`
+
+### Grouping rules
+
+Group by the nearest plugin root candidate.
+
+Examples:
+
+#### Case A: explicit manifest
+
+```text
+plugins/sales/.claude-plugin/plugin.json
+plugins/sales/skills
+plugins/sales/commands
+```
+
+Result:
+
+- one discovered plugin rooted at `plugins/sales`
+
+#### Case B: inferred sibling grouping
+
+```text
+Sales/skills
+Sales/commands
+Finance/agents
+Finance/commands
+```
+
+Result:
+
+- one discovered plugin rooted at `Sales`
+- one discovered plugin rooted at `Finance`
+
+#### Case C: root standalone repo
+
+```text
+.claude/skills
+.claude/commands
+```
+
+Result:
+
+- one discovered plugin rooted at repo root
+
+## UI plan
+
+## Setup page states
+
+Suggested states:
+
+1. `loading`
+2. `discovery_running`
+3. `discovery_ready`
+4. `discovery_empty`
+5. `discovery_error`
+
+### discovery_running
+
+Show:
+
+- progress steps;
+- current repo name/branch;
+- a short explanation that OpenWork is figuring out how to map this repo.
+
+### discovery_ready
+
+Show:
+
+- discovered plugins list;
+- each item ticked by default if supported;
+- description/metadata when available;
+- badges for detected component kinds:
+  - skills
+  - commands
+  - agents
+  - hooks
+  - MCP
+- warnings for unsupported marketplace entries or ambiguous structure.
+
+Primary CTA:
+
+- `Continue with selected plugins`
+
+Secondary CTA:
+
+- `Review file structure`
+
+### discovery_empty
+
+Show:
+
+- no supported plugin structure found;
+- what OpenWork looked for;
+- option to create manual mappings.
+
+### discovery_error
+
+Show:
+
+- discovery failed;
+- which step failed;
+- retry action.
+
+## What the user selects
+
+The user should select plugin groups, not raw files.
+
+Each selected discovered plugin becomes a proposal for:
+
+- one OpenWork `plugin` row;
+- a set of `connector_mapping` rows covering that plugin's component folders.
+
+This matches the product goal better than asking the user to map individual folders one by one on first run.
+
+## Mapping discovered plugins to OpenWork internal data
+
+## Internal objects we already have
+
+- `connector_account`
+- `connector_instance`
+- `connector_target`
+- `connector_mapping`
+- `connector_sync_event`
+- `connector_source_binding`
+- `connector_source_tombstone`
+- `plugin`
+- plugin membership tables
+- `config_object`
+
+## Discovery-to-internal mapping
+
+### Discovery phase output
+
+Before the user confirms selection, discovery should exist as draft state.
+
+Recommended persistence model:
+
+- `connector_discovery_run`
+- `connector_discovery_candidate`
+
+Conceptually:
+
+```text
+connector_discovery_run
+- id
+- organization_id
+- connector_instance_id
+- connector_target_id
+- source_revision_ref
+- status
+- classification
+- tree_summary_json
+- warnings_json
+- created_at
+- updated_at
+
+connector_discovery_candidate
+- id
+- discovery_run_id
+- key
+- source_kind
+- root_path
+- display_name
+- description
+- manifest_path
+- component_summary_json
+- selection_state
+- supported
+- warnings_json
+```
+
+Why add dedicated discovery tables instead of jumping straight to `connector_mapping`?
+
+- discovery is provisional;
+- the user may deselect some plugin candidates;
+- we want to store unsupported candidates and warnings;
+- we want a clean boundary between `what we saw` and `what the user approved`.
+
+### After user confirms selection
+
+For each selected discovered plugin:
+
+1. create or upsert an OpenWork `plugin` row;
+2. create one `connector_mapping` per detected component kind/path;
+3. set `auto_add_to_plugin = true` for those mappings;
+4. link the mapping to the selected OpenWork plugin id;
+5. enqueue an initial discovery-approved ingestion sync.
+
+### Example mapping
+
+Repo:
+
+```text
+Sales/skills
+Sales/commands
+finance/agents
+finance/commands
+```
+
+Discovery result:
+
+- plugin candidate `Sales`
+- plugin candidate `finance`
+
+Internal translation after user confirms:
+
+- create OpenWork plugin `Sales`
+- create OpenWork plugin `finance`
+- create mappings:
+  - `Sales/skills/**` -> `skill` -> plugin `Sales`
+  - `Sales/commands/**` -> `command` -> plugin `Sales`
+  - `finance/agents/**` -> `agent` -> plugin `finance`
+  - `finance/commands/**` -> `command` -> plugin `finance`
+
+### Marketplace mapping
+
+For a local marketplace entry rooted at `plugins/feature-dev`:
+
+- create one OpenWork plugin from the marketplace/plugin metadata;
+- create mappings for each detected component path under that root;
+- preserve the marketplace entry metadata as origin/discovery metadata.
+
+## Discovery does not ingest content yet
+
+Discovery should stop short of full content ingestion.
+
+It should:
+
+- inspect paths;
+- read manifests and small metadata files;
+- infer plugin groups;
+- help the user approve a mapping shape.
+
+It should not yet:
+
+- parse every SKILL/agent/command file body;
+- create `config_object` rows;
+- create `connector_source_binding` rows;
+- create tombstones.
+
+Those belong to the subsequent ingestion/reconciliation phase.
+
+## Relationship to initial sync
+
+The initial sync should happen after discovery is approved.
+
+Suggested flow:
+
+1. repo selected
+2. connector instance created
+3. discovery run computes candidates
+4. user confirms selections
+5. OpenWork creates plugin rows + connector mappings
+6. OpenWork enqueues initial full sync
+7. sync executor reads repo contents and materializes config objects
+
+This sequencing is important because ingestion needs the mapping decisions.
+
+## v1 scope
+
+### In scope
+
+- dedicated setup/discovery page after repo selection;
+- repo tree listing API with pagination/limits;
+- root marketplace detection;
+- `.claude-plugin/plugin.json` discovery anywhere in the repo;
+- `.claude/skills`, `.claude/commands`, `.claude/agents` support;
+- folder-based inference from known component paths;
+- user selection UI for discovered plugins;
+- translation from selected candidates into plugin rows + connector mappings.
+
+### Explicitly out of scope for this phase
+
+- full content ingestion;
+- recursive external marketplace source expansion across other repos;
+- hooks-to-OpenWork runtime semantics beyond discovery;
+- automatic parsing of every skill/agent/command file body during discovery.
+
+## Open questions
+
+1. Should discovery run synchronously for small repos and asynchronously for larger repos, or always be modeled as a background run?
+2. Do we want to persist discovery results in dedicated tables immediately, or temporarily store the first version inside connector metadata while the shape is still changing?
+3. For marketplace repos with external URL entries, should we show unsupported entries disabled, or hide them entirely in v1?
+4. Should root-level `plugin.json` remain a metadata hint only, or do we want to formalize it as an OpenWork-specific compatibility rule?
+5. When multiple discovered plugin candidates have the same normalized name, what is the preferred display/slug collision strategy?
+
+## Recommended next implementation order
+
+1. Add a discovery result model and API endpoints.
+2. Implement GitHub tree listing with truncation-aware fallback.
+3. Implement classification + candidate extraction.
+4. Update the GitHub setup page to become the discovery page.
+5. Add the discovered plugin selection UI.
+6. Convert approved candidates into `plugin` + `connector_mapping` rows.
+7. Then implement initial ingestion against those mappings.
diff --git a/prds/new-plugin-arch/learnings.md b/prds/new-plugin-arch/learnings.md
new file mode 100644
index 0000000000..a21addd376
--- /dev/null
+++ b/prds/new-plugin-arch/learnings.md
@@ -0,0 +1,76 @@
+# Learnings
+
+Read this file before starting any implementation step.
+
+After completing a step, prepend any new learnings to the top of this file.
+
+## What counts as a learning
+
+- architecture constraints discovered in the current codebase
+- route or schema patterns that should be reused
+- persistence limitations or migration gotchas
+- RBAC edge cases or clarified decisions
+- webhook or raw-body handling pitfalls
+- test harness quirks
+- anything that would save the next agent time or prevent a bad implementation choice
+
+## Prepend format
+
+Use this shape for new entries:
+
+```md
+## YYYY-MM-DD Step N - Short title
+- learning 1
+- learning 2
+- follow-up or caution
+```
+
+## Current entries
+
+## 2026-04-21 Step 2 - GitHub App connect + repo selection slice
+- The existing Den `/integrations` UI already had the right shell, but the GitHub path was a pure client-side preview. The cleanest upgrade path is to keep Bitbucket on the mock dialog for now while sending GitHub through a real App install redirect and a dedicated post-return repo-selection screen.
+- GitHub App install does not need the normal Better Auth GitHub social login flow. The updated working slice is: den-web calls `POST /v1/connectors/github/install/start`, GitHub redirects the browser to the Den Web setup page, then den-web calls `POST /v1/connectors/github/install/complete` with `installation_id + state` so den-api can validate the signed state and load repos.
+- A signed state token based on `BETTER_AUTH_SECRET` is enough for the current redirect round-trip and is simpler than introducing a new persistence table for short-lived install state in this phase.
+- The GitHub App `Setup URL` should point at a real web page in Den Web, e.g. `/dashboard/integrations/github`, not a backend callback route.
+- Workspace dependency installation was the original gating build blocker, but after `pnpm install` the den-api build, den-web typecheck, and focused den-api tests all run in this worktree.
+
+## 2026-04-21 Step 1 - Live GitHub App admin validation
+- The GitHub-specific admin path was more stubbed than it looked: `listGithubRepositories()` only echoed cached connector-account metadata and `validateGithubTarget()` only checked whether `ref === refs/heads/${branch}` without contacting GitHub.
+- A small dedicated helper module at `ee/apps/den-api/src/routes/org/plugin-system/github-app.ts` keeps the real GitHub App mechanics isolated: normalize multiline private keys, mint an app JWT, exchange it for an installation token, then call GitHub APIs for repository listing and branch validation.
+- For real connector setup testing, the minimally required live server secrets are `GITHUB_CONNECTOR_APP_ID`, `GITHUB_CONNECTOR_APP_PRIVATE_KEY`, and `GITHUB_CONNECTOR_APP_WEBHOOK_SECRET`; `GITHUB_CONNECTOR_APP_CLIENT_ID` / `CLIENT_SECRET` are still part of the app registration but are not yet consumed by the current den-api admin flow.
+- Workspace dependency installation is still a gating factor for broader den-api tests in this worktree: pure helper tests can run with Bun, but route/store tests that import `hono` or `@openwork-ee/den-db/*` still fail until the workspace dependencies are installed.
+
+## 2026-04-17 Post-step cleanup - Type tightening and naming
+- The route directory is now `ee/apps/den-api/src/routes/org/plugin-system/`; `plugin-arch` was only the planning nickname and was too confusing as a long-lived API module name.
+- The plugin-system route wrapper can stay type-safe enough without `@ts-nocheck` by isolating Hono middleware registration behind a tiny `withPluginArchOrgContext()` helper and using explicit request-part adapters for `param`, `query`, and `json` reads.
+- The Drizzle layer is happiest when plugin-system store/access helpers use concrete typed-id aliases (`ConfigObjectId`, `PluginId`, `ConnectorInstanceId`, etc.) plus discriminated resource-target unions; broad `string` or mixed-id unions quickly break `eq()` and `inArray()` inference.
+- Connector GitHub App config should stay separate from normal GitHub OAuth login config, so den-api now reserves its own optional connector env namespace (`GITHUB_CONNECTOR_APP_*`) instead of reusing the existing auth credentials.
+
+## 2026-04-17 Step 9 - Test harness and verification
+- den-api package tests currently work best from `ee/apps/den-api/test/` rather than `ee/apps/den-api/src/`, because the package `tsconfig.json` compiles `src/**` during `pnpm --filter @openwork-ee/den-api build` and would otherwise drag Bun-only test imports into the production build.
+- Bun is available in this workspace and is the easiest way to add focused TS tests for den-api without adding a new package runner; the current test slice uses `bun test ee/apps/den-api/test/...`.
+- Webhook route tests can avoid database setup by targeting the early-exit paths: invalid signatures reject before JSON parsing/side effects, and valid signed payloads without an installation id return a clean ignored response before any connector lookup.
+- Access-helper tests can import plugin-system modules safely if they seed the minimal env vars first, because `db.ts` pulls `env.ts` during module load even when the specific test only exercises pure helper functions.
+
+## 2026-04-17 Step 5-8,10 - RBAC, routes, webhook ingress, and doc reconciliation
+- The admin endpoint slice now lives in `ee/apps/den-api/src/routes/org/plugin-system/routes.ts`, with shared access checks in `ee/apps/den-api/src/routes/org/plugin-system/access.ts` and persistence/serialization helpers in `ee/apps/den-api/src/routes/org/plugin-system/store.ts`.
+- `resolveOrganizationContextMiddleware` depends on validated `:orgId` params, so plugin-system routes must run `paramValidator(...)` before org-context resolution; the custom route helper was adjusted to inject auth/org middleware after per-route validators.
+- The current endpoint layer has no separate org-capability table, so create/manage-account capabilities are implemented as org owner/admin checks only; resource-level edit/view behavior still uses direct, team, org-wide, and plugin-inherited access resolution.
+- Config-object inherited access from plugins is view-only in the helper layer; edit/manage actions still require direct object grants or org-admin override, which keeps plugin delivery access from accidentally becoming object edit access.
+- GitHub webhook ingress is registered at `ee/apps/den-api/src/routes/webhooks/github.ts`, verifies `X-Hub-Signature-256` against the raw body before JSON parsing, queues `push` sync events into `connector_sync_event`, and treats installation lifecycle updates as connector-account health changes rather than content sync jobs.
+- Because dependencies are still missing in this worktree, verification remains limited to parse-oriented `tsc --noResolve` calls, `git diff --check`, and JSON validation; real den-api execution and automated route tests are still blocked until the workspace is installed.
+
+## 2026-04-17 Step 4 - Den DB persistence backbone
+- The persistence backbone now lives in `ee/packages/den-db/src/schema/sharables/plugin-arch.ts`; den-api can query these tables directly through the existing shared `@openwork-ee/den-db/schema` export instead of adding a new repository layer.
+- Encrypted config-object payload storage is implemented as encrypted `text` columns, not native MySQL `json`, because the existing `encryptedColumn()` helper serializes ciphertext blobs; anything that needs indexed/searchable current metadata still has to stay projected onto plaintext columns on `config_object`.
+- To keep MySQL uniqueness simple in v1, plugin memberships and access grants currently use one row per logical relationship plus `removed_at`, not append-only historical rows; re-activating a removed membership/grant should update the existing row instead of inserting a duplicate.
+- The migration for this step was written manually as `ee/packages/den-db/drizzle/0010_plugin_arch.sql` and journaled in `drizzle/meta/_journal.json` because Drizzle generation is still blocked by missing local package dependencies in this worktree.
+- `connector_source_binding` is unique on `config_object_id` only; deleted-path history is preserved in `connector_source_tombstone`, so recreated paths should mint a new object identity rather than trying to reactivate the old binding row.
+
+## 2026-04-17 Step 1-3 - Placement, contracts, and shared schemas
+- The org-scoped plugin-architecture admin APIs belong in `ee/apps/den-api/src/routes/org`, not `apps/server` or `apps/server-v2`: the existing authenticated `/v1/orgs/:orgId/...` surface, Better Auth session flow, org context middleware, and Hono OpenAPI route style already live there.
+- The persistence home for plugin-architecture resources is `ee/packages/den-db/src/schema`; `apps/server-v2` is workspace-first SQLite state for local/runtime control and is the wrong place for durable org resources like config objects, plugins, connector accounts, and grants.
+- den-api route validation is built around `hono-openapi` validators plus `requireUserMiddleware`, `resolveOrganizationContextMiddleware`, and `resolveMemberTeamsMiddleware`, so new route code should reuse those patterns instead of inventing a separate request parsing layer.
+- den-api does not currently have a webhook helper or raw-body middleware; the GitHub ingress should read `c.req.raw` directly, verify `X-Hub-Signature-256` before JSON parsing, and only then normalize the payload.
+- Adding the shared schemas early forced new TypeID families for config objects, versions, grants, plugins, and connector resources; later DB tables and route params should reuse those ids instead of falling back to plain strings.
+- Local verification is currently dependency-blocked in this worktree: `pnpm --filter @openwork-ee/den-api build` and direct `tsc` both stop immediately because package-local dependencies like `tsup`, `zod`, and other workspace modules are not installed in this checkout.
diff --git a/prds/new-plugin-arch/plan.md b/prds/new-plugin-arch/plan.md
new file mode 100644
index 0000000000..f5e0d29734
--- /dev/null
+++ b/prds/new-plugin-arch/plan.md
@@ -0,0 +1,435 @@
+# New Plugin Arch
+
+This document is a working architecture draft for the next-generation shared config system.
+
+## Purpose
+
+Replace the current skill hub model with a more general plugin system that can:
+
+- manage many config object types, not just skills;
+- ingest config objects from multiple sources, including cloud-native editing, imports, and connectors;
+- package those objects into deliverables called plugins;
+- apply one consistent RBAC model across objects, plugins, and connectors;
+- preserve source-of-truth and version provenance, especially for connector-managed content.
+
+## Core Concepts
+
+### Config object
+
+A config object is a single installable unit of product configuration.
+
+Planned object types:
+
+- Skill
+- MCP
+- Command
+- Agent
+- Hook
+- Context
+- Custom
+
+Notes:
+
+- Each type has its own shape and validation rules.
+- Each type may install differently on the client.
+- Each object needs a stable identity that survives edits and version changes.
+
+### Tags (deferred)
+
+We are removing config object groups from the v1 design.
+
+Possible future direction:
+
+- add a tag system later for organization and filtering.
+
+### Plugin
+
+A plugin is a deliverable made from:
+
+- config objects.
+
+Key idea:
+
+- administrators assemble plugins as the unit that is delivered to users.
+
+Plugins replace the current mental model of a hub.
+
+### Marketplace
+
+A marketplace is an organization-scoped grouping of plugins.
+
+Key idea:
+
+- administrators can curate multiple marketplaces per org;
+- each marketplace contains zero or more plugins;
+- marketplace access controls discovery and delivery at a higher level than individual plugins;
+- plugin-level access can still exist for direct sharing or exceptions.
+
+## Source Model
+
+Config objects may be created or updated from multiple source channels:
+
+- Cloud: created or edited directly in OpenWork Cloud.
+- Import: created from uploaded/imported material.
+- Connector: created and updated from an external system.
+
+### Source ownership rule
+
+If an object is created by a connector, it is only editable through that connector.
+
+Implications:
+
+- cloud/import objects are first-party editable in OpenWork;
+- connector-managed objects may still be editable in OpenWork by users with permission, but connector sync remains authoritative and may overwrite content on the next sync;
+- OpenWork must keep enough source metadata to re-ingest, reconcile, audit, and display provenance.
+
+## Connector Model
+
+Connectors are reusable integrations that ingest config objects from external systems.
+
+Examples:
+
+- GitHub
+- future git-based providers
+- future API-based providers
+- future non-file-based providers
+
+### Connector layers
+
+There appear to be at least two layers:
+
+1. Connector type
+   - the implementation family, such as GitHub.
+2. Connector configuration / instance
+   - a specific configured connection, such as one GitHub app installation plus repo/branch/mapping settings.
+
+The current working direction is:
+
+- one-time setup for a connector;
+- per-instance configuration for a repo or external resource;
+- that configured connector can then be tied to one or more plugins, or to config objects without an auto-managed plugin.
+
+### GitHub example
+
+For GitHub, the likely model is:
+
+- a GitHub App is installed on a repo or org;
+- OpenWork stores the repo binding;
+- the user configures the branch to watch;
+- the user configures path mappings from source paths to config object types;
+- webhook events trigger ingestion and reconciliation.
+
+Examples of mappings:
+
+- `/bundles/skills/**` -> `skill`
+- `/bundles/agents/**` -> `agent`
+
+### Connector mapping responsibilities
+
+A configured connector likely needs:
+
+- source kind, such as `github`;
+- source-specific config, such as branch;
+- path or API mappings;
+- plugin binding information;
+- ingestion mode and parser rules;
+- webhook or polling state;
+- last successful sync state.
+
+### Connector-to-plugin behavior
+
+Current direction:
+
+- one connector instance may feed multiple plugins;
+- one plugin may include objects from multiple connector instances;
+- one connector instance may also ingest objects without directly feeding a plugin;
+- plugin membership may be manually edited even when some members originated from connectors.
+
+Default UX direction:
+
+- setup should offer one plugin per parent path;
+- if `/sales/skills` maps to plugin A, then sibling mapped paths under that same parent should default to the same plugin rather than splitting automatically;
+- a different parent path such as `/finance/skills` may map to a different plugin;
+- advanced/manual plugin composition may still exist outside the default connector setup flow.
+
+### File lifecycle behavior
+
+For file-backed connectors:
+
+- new file -> create new config object and add it to the bound plugin automatically;
+- changed file -> create a new version or revision of the existing object;
+- deleted file -> mark the current object as deleted on our side, but do not hard-delete it;
+- recreated file at the same path -> create a new object identity rather than reviving the deleted one.
+
+Important nuance:
+
+- once a file-backed object is deleted, we should preserve historical path linkage, but we should not continue updating that deleted object if a file later reappears.
+
+## Proposed Domain Model
+
+### Stable identity layer
+
+We likely need a stable identity table for each logical config object, separate from versioned content rows.
+
+Why:
+
+- plugins should point at stable identities, not at a mutable single content row;
+- source ownership and provenance belong to the logical object;
+- installation tracking likely belongs to the logical object plus a chosen version;
+- object history becomes easier to preserve.
+
+Minimum identity-layer responsibilities:
+
+- stable id;
+- org id;
+- object type;
+- source mode (`cloud`, `import`, `connector`);
+- current title / friendly name;
+- current description;
+- connector instance reference if applicable;
+- current file metadata where relevant;
+- created by / created at;
+- last updated at;
+- lifecycle status.
+
+### Version layer
+
+Each edit or connector sync likely creates a new object version row.
+
+Version rows would likely hold:
+
+- version id;
+- parent object id;
+- parsed metadata for indexing;
+- raw source payload or normalized payload;
+- source revision reference such as commit SHA, webhook delivery id, or external version token;
+- created at;
+- created by or created via;
+- deletion marker if the version represents removal.
+
+Current open decision:
+
+- whether we ever need human-facing revision numbers beyond immutable version ids plus timestamps.
+
+Current leaning:
+
+- we do want durable history and a clear latest version model;
+- for v1, newest-created version is an acceptable latest-version rule if the database owns `created_at` and we use `id` as a tie-breaker;
+- external source references like commit SHA should still be stored separately;
+- implementation should prefer one source of truth over duplicated latest-version state;
+- searchable current metadata should live on the parent object so dashboard queries do not scan historical versions and return duplicates.
+
+### Plugin layer
+
+Plugins likely need:
+
+- stable id;
+- org id;
+- metadata;
+- lifecycle status;
+- membership rows pointing to config object identities;
+- optional connector bindings if the plugin is connector-managed.
+
+Important:
+
+- plugin membership should preserve historical links even if an included object later becomes deleted or inactive;
+- plugins reference config object identities, not pinned versions;
+- plugin delivery resolves the latest version of each linked object;
+- delivery logic can decide whether deleted items are omitted from downloads.
+
+### Marketplace layer
+
+Marketplaces likely need:
+
+- stable id;
+- org id;
+- metadata;
+- lifecycle status;
+- membership rows pointing to plugins;
+- access grants for member/team/org-wide visibility.
+
+Important:
+
+- orgs can have multiple marketplaces;
+- a plugin may belong to multiple marketplaces;
+- marketplace membership should preserve history even when a plugin is later archived or removed;
+- marketplace access should provide view/discovery access to included plugins without automatically granting plugin edit rights.
+
+## RBAC Direction
+
+RBAC should be consistent across:
+
+- config objects;
+- plugins;
+- marketplaces;
+- connectors.
+
+We will likely need separate permission families for:
+
+- creating config objects manually;
+- editing cloud/import-managed objects;
+- creating plugins;
+- creating marketplaces;
+- attaching objects to plugins;
+- attaching plugins to marketplaces;
+- creating connector definitions;
+- configuring connector instances;
+- binding connector instances to plugins;
+- approving connector ingestion or sync behavior;
+- managing delivery visibility to users.
+
+Open question:
+
+- plugin "publish/release" may not be a separate workflow; in practice, delivery may just mean changing access permissions, such as granting a team access to a plugin.
+
+## Provenance Requirements
+
+We need strong provenance for connector-managed content.
+
+At minimum, OpenWork should know:
+
+- how the object was created;
+- which connector instance created it;
+- the external source address;
+- the mapping that classified it;
+- the external revision that produced the current local version;
+- whether the object is active, deleted, stale, or out of sync.
+
+For GitHub-like sources, we likely also need:
+
+- app installation or account binding;
+- repo owner/name;
+- branch;
+- path;
+- commit SHA for each ingested version;
+- webhook delivery or event metadata for debugging.
+
+## Lifecycle States
+
+We likely need soft lifecycle states instead of hard deletes.
+
+Candidate statuses:
+
+- active
+- inactive
+- deleted
+- archived
+- ingestion_error
+
+Open question:
+
+- whether `deleted` should mean source removed, while `archived` means intentionally retired by an admin.
+
+## Compatibility With Current System
+
+Today:
+
+- skills are the only first-class sharable object in Den;
+- hubs are team/member-access-controlled groupings of skills;
+- the app downloads and installs individual skills, not durable plugin bundles.
+
+Future:
+
+- skills become one config object type among many;
+- hubs disappear from the product model;
+- plugins become the administrator-authored deliverable;
+- marketplaces become the higher-level catalog/grouping surface for plugins;
+- connectors can automatically populate plugins;
+- delivery/install rules move up from individual skills to plugin-aware distribution.
+
+## Data Structure
+
+The implementation-oriented schema and data-model details now live in:
+
+- `prds/new-plugin-arch/datastructure.md`
+- `prds/new-plugin-arch/rbac.md`
+
+That document currently captures:
+
+- the proposed `config_object` and `config_object_version` split;
+- plugin membership tables;
+- marketplace membership tables;
+- RBAC table direction;
+- connector/account/instance/mapping/source-binding tables;
+- latest-version lookup strategy;
+- current metadata projection rules for dashboard search;
+- optional release/install tables.
+
+Key current data-model decisions:
+
+- `config_object_version` is the single source of truth for version history and latest-version resolution;
+- `config_object` is the current searchable projection for dashboard and library queries;
+- latest version is resolved by `created_at DESC, id DESC`, not a stored latest pointer;
+- v1 does not need a version-number column;
+- connector source tombstones preserve deleted path history so recreated files get new identities.
+
+## Immediate Open Questions
+
+### Identity and typing
+
+- Is `custom` just a catch-all typed blob, or does it need subtyping?
+- Can one config object belong to many plugins? Current assumption: yes.
+
+### Versioning
+
+- v1 does not need explicit version numbers; immutable version ids plus `created_at` are enough.
+- Do we need explicit human-facing revision numbers later for UX, debugging, or APIs?
+- Plugins point to object identities and always resolve latest versions.
+- Do we want plugin releases as a first-class concept separate from object versions?
+
+### Connector ownership
+
+- Connector-managed objects should still allow local edits for authorized users, knowing connector sync may overwrite content later.
+- Membership, tags, and RBAC remain locally managed.
+- Do we need conflict indicators when local edits diverge from the connector source before the next overwrite?
+
+### Deletion and recreation
+
+- When a connector file is deleted, should the object immediately disappear from active delivery, or remain selectable with warnings?
+- If a file reappears at the same path, it should create a new object identity regardless of content.
+- We likely need tombstones for deleted external paths so we do not accidentally revive prior identities.
+
+### RBAC
+
+- Who can create cloud-native config objects?
+- Who can configure connector types vs connector instances?
+- Who can bind connector instances to plugins?
+- Who can override connector-derived membership or metadata?
+
+### Default connector UX vs advanced composition
+
+- How rigid should the default parent-path -> plugin mapping be?
+- Should manual plugins be allowed to include connector-managed objects from any path even if the default setup flow keeps path families together?
+
+### Ingestion engine
+
+- Do we normalize all source payloads into one common schema plus type-specific payload blocks?
+- How strict is validation on ingestion: reject bad files, partially ingest, or mark them errored?
+- How do we surface per-file ingestion failures to admins?
+
+### Delivery model
+
+- Are plugins downloaded as full bundles, as selected object manifests, or as live subscriptions?
+- How does install/update behavior differ by object type?
+- How do clients know which version of each object or plugin they have?
+
+## Current Recommendations
+
+- Introduce a stable identity table plus immutable version rows for config objects.
+- Treat `config_object_version` as the only source of truth for latest-version lookup in v1.
+- Do not add a version-number column in v1 unless product requirements emerge for human-facing revision labels.
+- Treat plugins as first-class entities with membership tables.
+- Treat marketplaces as first-class entities that group plugins.
+- Keep source ownership explicit on every config object identity.
+- Model connectors as reusable integration definitions plus configured instances.
+- Store connector provenance richly enough to debug and reconcile webhook-driven ingestion.
+- Use soft deletion and preserve historical membership rather than hard-deleting rows.
+
+## Next Discussion
+
+Next we should define the delivery model:
+
+- how plugins are published to users;
+- whether delivery is pinned or rolling;
+- how clients install/update each object type;
+- how to represent client state and rollout state.
diff --git a/prds/new-plugin-arch/rbac.md b/prds/new-plugin-arch/rbac.md
new file mode 100644
index 0000000000..06c0baa39b
--- /dev/null
+++ b/prds/new-plugin-arch/rbac.md
@@ -0,0 +1,531 @@
+# New Plugin Arch RBAC
+
+This document captures the first-pass RBAC design for the new plugin architecture.
+
+It is intentionally written as a discussion doc, not a final policy spec.
+
+## Goal
+
+We want one consistent RBAC model across:
+
+- config objects
+- plugins
+- marketplaces
+- connector instances
+
+And we also need org-level permissions for who can:
+
+- create and edit those resources
+- configure connector ingestion
+- manage delivery/access
+- view and debug sync state
+
+## Main design principle
+
+There are really two different permission layers:
+
+1. org capability permissions
+   - what a member is allowed to do in the org in general
+2. resource access permissions
+   - what a member/team can do with a specific config object, plugin, or connector instance
+
+That split is important.
+
+Example:
+
+- a user may have org permission to create plugins;
+- but they may still not have access to edit a specific existing plugin.
+
+Locked decision:
+
+- org admins should have implicit full access to every resource in the org.
+
+## Resources that need RBAC
+
+### Org-scoped capability layer
+
+These are not tied to one individual row.
+
+Examples:
+
+- can create config objects
+- can create plugins
+- can create connector accounts
+- can create connector instances
+- can manage org-wide access policies
+- can view connector sync diagnostics
+
+### Resource-scoped access layer
+
+These apply to individual resources.
+
+Resources:
+
+- one `config_object`
+- one `plugin`
+- one `marketplace`
+- one `connector_instance`
+
+Current recommendation:
+
+- do not make `connector_account` a day-one first-class resource with separate fine-grained RBAC unless we need it;
+- use org-level capability permissions for connector account setup, and resource-level permissions for connector instances.
+
+## Actors
+
+The natural principals appear to be:
+
+- org member
+- team
+
+Current recommendation:
+
+- grants should be assignable to either a member or a team;
+- resources should also be shareable with the org as a whole without creating per-user grants;
+- effective access is the union of direct grants plus team grants;
+- ownership/creator metadata should not automatically become the only authorization model.
+
+Locked decision:
+
+- config objects and plugins should be private by default.
+- sharing should happen through explicit RBAC grants only.
+
+## What we likely need to protect
+
+### Config objects
+
+Actions:
+
+- view metadata
+- view current content
+- view history
+- create new version
+- edit current metadata
+- archive/delete/restore
+- manage object access
+- attach/detach from plugins
+
+### Plugins
+
+Actions:
+
+- view metadata
+- view resolved members
+- edit metadata
+- add/remove config objects
+- manage plugin access
+- view delivery preview/resolved manifest
+- create release snapshot if releases exist
+
+### Marketplaces
+
+Actions:
+
+- view metadata
+- view included plugins
+- edit metadata
+- add/remove plugins
+- manage marketplace access
+
+### Connector instances
+
+Actions:
+
+- view connector config
+- edit connector config
+- edit targets and mappings
+- manually trigger sync
+- view sync events/logs
+- manage connector access
+- disable/archive connector
+
+## Recommended permission model shape
+
+### Resource roles
+
+For v1, role-based resource access is probably better than dozens of tiny per-action grants.
+
+Recommended shared roles:
+
+- `viewer`
+- `editor`
+- `manager`
+
+Suggested semantics:
+
+#### `viewer`
+
+- can view resource metadata and current state
+- can view resolved contents where applicable
+- cannot mutate
+
+#### `editor`
+
+- can modify the resource's working content/config
+- cannot manage sharing/access unless explicitly promoted
+
+#### `manager`
+
+- can edit the resource
+- can change access grants
+- can archive/restore
+- can perform high-impact control actions
+
+Current recommendation:
+
+- start with shared roles across resource types, then add per-resource-type nuances in enforcement logic if needed.
+
+## Org capability permissions
+
+These likely belong on org membership roles or org-level grants.
+
+Candidate capabilities:
+
+- `config_object.create`
+- `plugin.create`
+- `marketplace.create`
+- `connector_account.create`
+- `connector_instance.create`
+- `connector_sync.view_all`
+- `connector_sync.retry`
+- `rbac.manage_org`
+
+Current implementation note:
+
+- until separate org-capability persistence exists, the endpoint layer maps these capabilities to org owner/admin membership only.
+
+Why this matters:
+
+- resource grants alone do not answer "who is allowed to create a new thing?"
+- we need an org capability gate before resource-level RBAC even applies.
+
+## Resource access tables
+
+This doc aligns with the table direction in `prds/new-plugin-arch/datastructure.md`.
+
+Current recommendation:
+
+- separate access tables with the same shape:
+  - `config_object_access_grant`
+- `plugin_access_grant`
+- `marketplace_access_grant`
+- `connector_instance_access_grant`
+
+Suggested shared columns:
+
+- `id`
+- resource id
+- `org_membership_id` nullable
+- `team_id` nullable
+- `org_wide` boolean default false
+- `role`
+- `created_by_org_membership_id`
+- `created_at`
+- `removed_at` nullable
+
+Additional guardrails:
+
+- require exactly one grant target:
+  - `org_membership_id`
+  - `team_id`
+  - or `org_wide = true`
+- use soft revocation via `removed_at`
+- compute effective role from the strongest active grant
+
+Recommended interpretation:
+
+- `org_wide = true` means "shared with the org";
+- this creates org-wide visibility/access without creating rows for every member or team;
+- config objects and plugins remain private until such a grant is added.
+- member/team sharing still uses normal explicit grant rows.
+
+Locked decision:
+
+- use `org_wide = true` for v1.
+
+## Recommended authorization rules by resource
+
+### Config objects
+
+#### View
+
+Needs one of:
+
+- direct object grant
+- team object grant
+- object has an active org-wide grant
+- access to a plugin that currently includes the object
+- org admin implicit access
+
+#### Edit content / create version
+
+Needs one of:
+
+- `editor` or `manager` on the object
+
+#### Manage object access
+
+Needs:
+
+- `manager` on the object
+
+#### Attach object to plugin
+
+Likely needs both:
+
+- edit rights on the object
+- edit rights on the target plugin
+
+This is one of the first policy questions we should lock down.
+
+### Plugins
+
+#### View
+
+Needs one of:
+
+- direct plugin grant
+- team plugin grant
+- plugin has an active org-wide grant
+- org admin implicit access
+
+#### Edit plugin metadata / membership
+
+Needs:
+
+- `editor` or `manager` on the plugin
+
+#### Manage plugin access
+
+Needs:
+
+- `manager` on the plugin
+
+### Marketplaces
+
+#### View
+
+Needs one of:
+
+- direct marketplace grant
+- team marketplace grant
+- marketplace has an active org-wide grant
+- org admin implicit access
+
+#### Edit marketplace metadata / membership
+
+Needs:
+
+- `editor` or `manager` on the marketplace
+
+#### Manage marketplace access
+
+Needs:
+
+- `manager` on the marketplace
+
+### Connector instances
+
+#### View connector setup
+
+Needs:
+
+- direct or team connector-instance grant
+- or org admin implicit access
+
+#### Edit mappings / targets / config
+
+Needs:
+
+- `editor` or `manager` on the connector instance
+
+#### Trigger sync / retry sync
+
+Likely needs:
+
+- `editor` or `manager` on the connector instance
+- and maybe an org capability for retrying failed syncs if we want tighter control
+
+#### Manage connector access
+
+Needs:
+
+- `manager` on the connector instance
+
+## Delivery and access
+
+Current direction from the other docs:
+
+- plugin delivery is mostly controlled through plugin access grants.
+
+That means:
+
+- if team B has access to plugin A, that is effectively the publish step;
+- if team B has access to marketplace M, they should be able to discover the plugins grouped inside it;
+- the delivery system should resolve access from plugin grants, not from low-level config-object grants alone.
+
+Current recommendation:
+
+- plugin delivery should primarily check plugin access;
+- marketplace access can grant view/discovery access to included plugins, but should not automatically grant plugin edit rights;
+- config-object access should govern direct admin/editing access, not plugin delivery;
+- a user should have access to a config object if any of the following are true:
+  - they are directly granted access to the object
+  - they are on a team granted access to the object
+  - the object has an org-wide grant
+  - the object is included in a plugin they can access
+  - they are an org admin
+
+This keeps the mental model simpler:
+
+- plugins are the deliverable
+- plugin access determines who gets the deliverable
+
+## Connector-managed objects and RBAC
+
+We already decided:
+
+- connector-managed objects can still be edited locally;
+- connector sync remains authoritative and may overwrite those edits later.
+
+RBAC implication:
+
+- connector origin should not automatically make an object read-only from an authorization perspective;
+- authorization should still be based on the object's grants and org capabilities.
+
+Locked decision:
+
+- when a connector auto-creates an object, the creator should be the user who configured the connector behavior that caused the creation;
+- after creation, the object follows normal permissions like any other object.
+
+But we may want UX warnings when:
+
+- a user has permission to edit;
+- but their change is likely to be overwritten by the connector.
+
+## Cross-resource mutation questions
+
+These are the trickiest RBAC cases.
+
+### Add object to plugin
+
+Question:
+
+- should a user need edit permission on both the object and the plugin?
+
+Current recommendation:
+
+- no.
+
+Reason:
+
+- plugin composition is controlled by the plugin;
+- users only need edit rights on the plugin to add or remove objects from it.
+
+### Bind connector mapping to plugin
+
+Question:
+
+- should a user need edit permission on both the connector instance and the plugin?
+
+Current recommendation:
+
+- yes.
+
+### Auto-created objects from a connector mapping
+
+Question:
+
+- when a connector mapping auto-creates new objects and auto-adds them to a plugin, whose permission is that acting under?
+
+Current recommendation:
+
+- treat it as an automated action attributed to the human creator of the connector/mapping configuration that caused it.
+
+This should be auditable as:
+
+- `created_via = connector`
+- `created_by_org_membership_id = <connector or mapping creator>`
+
+## Inheritance and default access
+
+This is still a major open area.
+
+Questions:
+
+- when a new config object is manually created, who gets initial access?
+- when a new plugin is created, who gets initial access?
+- should creator always get `manager`?
+
+Current recommendation:
+
+- creator gets initial `manager` grant;
+- connector-created objects also default to the creator of the relevant connector/mapping action;
+- org owners/admins have implicit override access across all resources;
+- teams should only gain access through explicit grants, not automatic inheritance.
+- marketplace inclusion should only inherit downward for view/discovery, never upward into edit/manage on plugins.
+
+Locked decision:
+
+- config objects and plugins are private by default;
+- users can share with individual members, teams, or the org as a whole;
+- whole-org sharing should not create per-user or per-team rows.
+
+## Suggested v1 defaults
+
+If we need a practical starting point now:
+
+- org owner/admin
+  - implicit full access to all plugin-arch resources in the org
+- creator of a resource
+  - explicit or implicit `manager` on that resource
+- connector-created resource
+  - creator is the user whose authorized connector/mapping configuration caused creation
+- team/member grants
+  - explicit only
+- org-wide share
+  - explicit only, via one grant that applies to the org as a whole
+- delivery
+  - controlled by plugin access grants
+- object/plugin/connector roles
+  - `viewer`, `editor`, `manager`
+
+## API implications
+
+The API surface in `prds/new-plugin-arch/admin-api.md` should assume:
+
+- object access endpoints manage `config_object_access_grant`
+- plugin access endpoints manage `plugin_access_grant`
+- marketplace access endpoints manage `marketplace_access_grant`
+- connector instance access endpoints manage `connector_instance_access_grant`
+
+The API should also distinguish between:
+
+- `403 forbidden because you lack org capability`
+- `403 forbidden because you lack resource access`
+
+That distinction will help a lot with admin UX.
+
+## Locked decisions so far
+
+1. Org admins have implicit full access to every resource in the org.
+2. `viewer` / `editor` / `manager` are enough for v1.
+3. Adding an object to a plugin only requires edit rights on the plugin.
+4. Connector-created objects should attribute creation to the relevant connector/mapping creator, then follow normal object permissions.
+5. Plugin delivery checks plugin access, not per-item access.
+6. A user can access a config object if they are directly granted, team-granted, org-wide granted, or it is included in a plugin they can access.
+7. Default grants for connector auto-created objects should go to the creator.
+8. Config objects and plugins are private by default.
+9. Marketplaces are private by default.
+10. Sharing with the whole org should be represented as one org-wide grant, not per-user entries.
+11. Member and team sharing should continue to use explicit grant rows.
+12. Marketplace access may grant view access to included plugins, but not plugin edit/manage access.
+
+## Discussion questions
+
+These are the main questions still worth answering next.
+
+1. Should binding a connector mapping to a plugin require edit rights on both the connector instance and the plugin?
+2. Should connector-instance managers automatically receive grants on connector-created objects, or only the original creator plus normal explicit grants?
+3. Should plugin managers be able to include any visible object in a plugin, or only objects they can directly edit/view?
+4. Should there be extra restrictions on who can manage access for encrypted/high-sensitivity object types like MCPs?
diff --git a/prds/new-plugin-arch/webhooks-api.md b/prds/new-plugin-arch/webhooks-api.md
new file mode 100644
index 0000000000..c5ffce8c8d
--- /dev/null
+++ b/prds/new-plugin-arch/webhooks-api.md
@@ -0,0 +1,149 @@
+# New Plugin Arch Webhooks API
+
+This document covers public webhook ingress and internal async sync trigger shapes.
+
+Normal authenticated admin APIs are documented in `prds/new-plugin-arch/admin-api.md`.
+
+## Principles
+
+- public webhooks are separate from authenticated admin APIs;
+- signature verification happens before parsing or processing;
+- ingress should be fast and queue-driven;
+- connector-specific reconciliation happens asynchronously.
+
+## Public webhook endpoints
+
+### GitHub webhook ingress
+
+- `POST /v1/webhooks/connectors/github`
+
+Purpose:
+
+- receive GitHub App webhook deliveries for connector sync and connector lifecycle events.
+
+Expected request inputs:
+
+- raw request body
+- `X-Hub-Signature-256`
+- `X-GitHub-Event`
+- `X-GitHub-Delivery`
+
+Behavior:
+
+1. verify signature against raw body
+2. reject invalid/missing signatures with `401`
+3. normalize the webhook envelope
+4. dispatch by event type
+5. enqueue sync jobs for relevant branch updates
+6. return quickly
+
+Recommended responses:
+
+- `401 Unauthorized` for invalid signature
+- `202 Accepted` for relevant accepted events
+- `200 OK` for valid but ignored events
+
+## Internal webhook dispatch
+
+Recommended normalized envelope:
+
+```ts
+type GithubWebhookEnvelope = {
+  deliveryId: string
+  event: string
+  installationId?: number
+  repositoryId?: number
+  repositoryFullName?: string
+  ref?: string
+  headSha?: string
+  payload: unknown
+}
+```
+
+Recommended internal handlers:
+
+- `githubWebhookIngress()`
+- `handleGithubPushEvent()`
+- `handleGithubInstallationEvent()`
+- `handleGithubInstallationRepositoriesEvent()`
+- `handleGithubRepositoryEvent()` optional later
+
+## Signature verification shape
+
+Requirements:
+
+- use the GitHub App webhook secret;
+- compute HMAC SHA-256 from the raw body;
+- compare using constant-time comparison;
+- do not parse JSON before verification;
+- do not process if signature fails.
+
+Practical rule:
+
+- no signature match, no webhook processing.
+
+Example pseudocode:
+
+```ts
+async function githubWebhookIngress(req: Request) {
+  const rawBody = await req.text()
+  const signature = req.headers.get("x-hub-signature-256")
+
+  if (!signature) return new Response("missing signature", { status: 401 })
+
+  const expected = signGithubBody(rawBody, env.GITHUB_CONNECTOR_APP_WEBHOOK_SECRET)
+  if (!timingSafeEqual(signature, expected)) {
+    return new Response("invalid signature", { status: 401 })
+  }
+
+  const event = req.headers.get("x-github-event")
+  const deliveryId = req.headers.get("x-github-delivery")
+  const payload = JSON.parse(rawBody)
+
+  return dispatchGithubWebhook({ event, deliveryId, payload })
+}
+```
+
+## Internal sync enqueue contract
+
+For relevant push events on tracked branches, enqueue an async sync job.
+
+Recommended payload shape:
+
+```ts
+type GithubConnectorSyncJob = {
+  connectorType: "github"
+  connectorInstanceId: string
+  connectorTargetId: string
+  connectorSyncEventId: string
+  deliveryId: string
+  installationId: number
+  repositoryId: number
+  repositoryFullName: string
+  ref: string
+  headSha: string
+}
+```
+
+Recommendations:
+
+- dedupe on `connectorTargetId + headSha`
+- preserve `deliveryId` for observability
+- allow internal retries without requiring webhook redelivery
+- installation lifecycle events may update connector-account health/state without enqueuing a content reconciliation job
+
+## Worker result contract
+
+The worker should update `connector_sync_event` with:
+
+- final status (`completed`, `failed`, `partial`)
+- target id
+- head SHA
+- created / updated / deleted / skipped counts
+- per-file failures if any
+- completed timestamp
+
+## Related docs
+
+- `prds/new-plugin-arch/GitHub-connector.md`
+- `prds/new-plugin-arch/admin-api.md`
diff --git a/prds/openwork-desktop-bootstrap-config/desktop-bootstrap-and-org-runtime-config.md b/prds/openwork-desktop-bootstrap-config/desktop-bootstrap-and-org-runtime-config.md
new file mode 100644
index 0000000000..29cb48f480
--- /dev/null
+++ b/prds/openwork-desktop-bootstrap-config/desktop-bootstrap-and-org-runtime-config.md
@@ -0,0 +1,294 @@
+# OpenWork Desktop Bootstrap And Org Runtime Config
+
+## Goal
+
+Support three desktop distribution modes while still allowing all of them to update from the default app build:
+
+1. Default build pointing at the default OpenWork server with no forced sign-in.
+2. Custom build pointing at the default OpenWork server with forced sign-in.
+3. Custom build pointing at a client-specific server with forced sign-in.
+
+After install, the desktop app should preserve its initial server/sign-in behavior across app updates, then fetch org-specific runtime config from the server after the user signs in.
+
+## Non-Goals
+
+- No server-wide default desktop config.
+- No anonymous org config fetch before sign-in.
+- No attempt to make the web build own persisted bootstrap state.
+
+## Product Decision
+
+Use two config layers only:
+
+1. `bootstrap config`
+2. `org runtime config`
+
+### Bootstrap config
+
+Bootstrap config is install-level configuration. It is set by the app build, then persisted locally by the desktop app so it survives future updates.
+
+It contains only:
+
+- `server.baseUrl`
+- `server.apiBaseUrl` if needed
+- `requireSignin`
+
+Bootstrap config decides startup behavior before normal app UI renders.
+
+### Current `apps/app` locations
+
+Today, the main Den bootstrap URL logic in `apps/app` lives in:
+
+- `_repos/openwork/_worktrees/Desktop-config-den-endpoint/apps/app/src/app/lib/den.ts`
+
+Specifically:
+
+- `DEFAULT_DEN_BASE_URL` is sourced from `import.meta.env.VITE_DEN_BASE_URL`
+- the stored Den API URL is tracked as `apiBaseUrl`
+- `resolveDenBaseUrls(...)` derives or resolves both the user-facing Den base URL and the API base URL
+- `readDenSettings()` and `writeDenSettings()` are the current read/write path for persisted Den URL state
+
+This PRD assumes that the future bootstrap-config implementation will either extend this location or replace it with a more durable desktop-owned persisted config source, while keeping `apps/app` as the consumer of that state.
+
+## Ownership model
+
+For the update-safe version of this system, `apps/app` should not be the source of truth for bootstrap config.
+
+Instead:
+
+- the desktop shell owns persisted bootstrap config
+- `apps/app` consumes resolved bootstrap config
+- build-time env values are only used to seed first launch
+
+This means `apps/app` should stop treating `VITE_DEN_BASE_URL` or browser-side persisted URL state as authoritative in desktop mode after bootstrap config has been created.
+
+## How config should be passed into `apps/app`
+
+Recommended flow:
+
+1. The desktop shell starts first.
+2. It loads persisted bootstrap config from desktop app data.
+3. If no persisted bootstrap config exists yet, it seeds one from build-time defaults.
+4. The desktop shell passes the resolved bootstrap config into `apps/app` before normal UI startup completes.
+5. `apps/app` uses that resolved config for Den base URL, API base URL, and `requireSignin`.
+
+Recommended interface:
+
+- `getBootstrapConfig()`
+- `setBootstrapConfig()` if editing is allowed
+
+This can be implemented with a Tauri command, a shell-injected bootstrap object, or another desktop-owned bridge. The important part is that the desktop shell is the owner and `apps/app` is the consumer.
+
+## Build-time environment variables
+
+The desktop app supports build-time bootstrap seeding for custom distributions.
+
+Preferred desktop build variables:
+
+- `OPENWORK_DESKTOP_DEN_BASE_URL`
+- `OPENWORK_DESKTOP_DEN_API_BASE_URL`
+- `OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN`
+
+Fallback variables currently recognized by the app and desktop build:
+
+- `VITE_DEN_BASE_URL`
+- `VITE_DEN_API_BASE_URL`
+- `VITE_DEN_REQUIRE_SIGNIN`
+
+These values are baked into the desktop build as the initial bootstrap seed. After launch, the desktop shell resolves the effective bootstrap config using the external bootstrap file and any persisted bootstrap state.
+
+### Example
+
+```bash
+OPENWORK_DESKTOP_DEN_BASE_URL="https://client.example.com" \
+OPENWORK_DESKTOP_DEN_API_BASE_URL="https://client.example.com/api/den" \
+OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN="1" \
+pnpm --filter @openwork/desktop build
+```
+
+### Accepted boolean values
+
+`OPENWORK_DESKTOP_DEN_REQUIRE_SIGNIN` and `VITE_DEN_REQUIRE_SIGNIN` are treated as enabled when set to one of:
+
+- `1`
+- `true`
+- `yes`
+- `on`
+
+## Update-safe bootstrap behavior
+
+To preserve custom builds across updates:
+
+1. A one-time custom build ships with seed values such as server URL and `requireSignin`.
+2. On first launch, the desktop shell copies those seed values into persisted desktop app data.
+3. Future app updates may install the default build artifacts.
+4. On next launch, the desktop shell reads the previously persisted bootstrap config instead of reusing the default build values.
+5. `apps/app` receives the persisted bootstrap config and starts with the correct URLs and sign-in behavior.
+
+This ensures that updates do not silently reset a client build back to the default server or disable forced sign-in.
+
+## Storage boundary
+
+Bootstrap config should live outside the bundled web app and outside browser-only storage.
+
+Recommended location:
+
+- Tauri-side persisted store or app-data file
+
+For the current external bootstrap-file approach, the desktop shell should look for `desktop-bootstrap.json` in the shared OpenWork config directory, unless an explicit override path is provided with `OPENWORK_DESKTOP_BOOTSTRAP_PATH`.
+
+Expected default locations:
+
+- All platforms: `~/.config/openwork/desktop-bootstrap.json`
+
+Avoid using browser `localStorage` as the long-term source of truth for install identity in desktop mode.
+
+`localStorage` may still be used as a compatibility layer or temporary cache inside `apps/app`, but the authoritative desktop bootstrap config should live in shell-owned persisted storage.
+
+## Desktop startup contract
+
+In desktop mode, startup should behave like this:
+
+1. shell loads bootstrap config
+2. shell returns bootstrap config to `apps/app`
+3. `apps/app` initializes URL resolution from shell-provided values
+4. `apps/app` applies `requireSignin` before rendering normal UI
+5. signed-in flows then fetch org runtime config
+
+In web mode, `apps/app` can continue using its existing env-based defaults because there is no desktop shell layer.
+
+### Org runtime config
+
+Org runtime config is authenticated, org-specific configuration fetched from the server after sign-in.
+
+Initial examples:
+
+- `disallowNonCloudModels`
+- `blockZenModel`
+- `blockMultipleWorkspaces`
+
+Org runtime config should use sparse negative restriction keys. An empty object means the desktop app keeps its normal default behavior.
+
+In the cloud admin UI, these restrictions may be presented as positive capability toggles for clarity. For example, the UI can show `Allow non-cloud deployed models`, while the stored config saves `disallowNonCloudModels: true` only when that capability is turned off.
+
+This config is cached locally, applied in memory while the app runs, and refreshed from the server over time.
+
+## Why this split exists
+
+Builds 2 and 3 will only be built once, but later update using artifacts from build 1. That means any important startup behavior cannot live only in the bundled web app or binary defaults.
+
+So:
+
+- build-time config seeds the first launch
+- the desktop shell persists bootstrap config locally
+- later updates read that persisted bootstrap config instead of replacing it
+
+This preserves custom server targeting and forced sign-in across updates.
+
+## Required behavior
+
+### Startup
+
+On desktop app start:
+
+1. Load persisted bootstrap config.
+2. Use it to resolve the Den server / API base.
+3. If `requireSignin` is true and there is no valid signed-in session, show a blocking full-screen sign-in screen before rendering normal app UI.
+4. If the user is signed in, load cached org runtime config immediately.
+5. Fetch fresh org runtime config from the server.
+6. Apply fresh config in memory when it arrives.
+
+### Refresh triggers for org runtime config
+
+The app should download org runtime config:
+
+- on every successful sign-in
+- on every app start when the user is already signed in
+- every 1 hour while the app is running
+
+### Update behavior
+
+App updates must not overwrite persisted bootstrap config.
+
+The app should continue using the locally persisted bootstrap config after updating, even if the new binary is the default build.
+
+## Suggested storage model
+
+### Persisted desktop storage
+
+Store these values in desktop app data, not just in browser `localStorage`:
+
+- bootstrap config
+- last known org runtime config
+- metadata for the cached org config if needed, such as fetched time or org id
+
+### In-memory runtime state
+
+During app execution, maintain the current effective config in memory.
+
+Recommended merge order:
+
+1. bootstrap config
+2. cached org runtime config
+3. freshly fetched org runtime config
+
+Bootstrap config should only contain startup-critical fields. Org runtime config should control ongoing product behavior.
+
+## Server contract
+
+Server config is org-specific and authenticated.
+
+Recommended endpoint:
+
+- `GET /v1/me/desktop-config`
+
+Example response:
+
+```json
+{
+  "blockZenModel": true,
+  "blockMultipleWorkspaces": true
+}
+```
+
+`requireSignin` should not be part of this runtime payload. It belongs in bootstrap config.
+
+## Distribution modes
+
+### 1. Default build
+
+- `server.baseUrl`: default OpenWork server
+- `requireSignin`: `false`
+
+### 2. Custom build against default server
+
+- `server.baseUrl`: default OpenWork server
+- `requireSignin`: `true`
+
+### 3. Custom build against client server
+
+- `server.baseUrl`: client-specific server
+- `requireSignin`: `true`
+
+For modes 2 and 3, the build is only used to seed first launch. After that, the persisted bootstrap config is the source of truth.
+
+## UX requirements
+
+- Forced sign-in must block normal app UI until a valid session exists.
+- Manual navigation to other routes while forced sign-in is active should redirect back to the sign-in screen.
+- Once signed in, the app can load and apply org runtime config.
+- If cached org runtime config exists, the app may use it immediately while refreshing in the background.
+
+## Open implementation notes
+
+- Prefer a Tauri-side persisted store or app-data file for bootstrap config instead of relying on web storage alone.
+- The desktop shell should own persisted bootstrap state; the web UI should consume it.
+- If org changes matter for config, the cache key should include org identity.
+- If the org runtime config fetch fails, keep using the last known cached config when available.
+
+## Success criteria
+
+- A custom build can point at a custom server, update from the default release artifacts, and still keep its server target and forced sign-in behavior.
+- Forced sign-in works before normal UI renders.
+- Org runtime config is refreshed on sign-in, startup, and hourly.
+- Model-related config can change over time without rebuilding the app.
diff --git a/prds/react-incremental-adoption.md b/prds/react-incremental-adoption.md
new file mode 100644
index 0000000000..7d30187020
--- /dev/null
+++ b/prds/react-incremental-adoption.md
@@ -0,0 +1,620 @@
+# PRD: Incremental React Adoption with Isolated Testing
+
+## Status: Draft
+## Date: 2026-04-05
+
+## Problem
+
+The OpenWork app is 100% SolidJS. The session UI has resilience issues (white screens, flicker, route/runtime/selection mismatches) rooted in overlapping owners of truth. The plan is to incrementally adopt React for the session experience layer, then expand to replace the entire app — while keeping the existing app running at every step. Each phase must be testable in isolation against a real Docker dev stack before merging.
+
+## Current Architecture (Ground Truth)
+
+### Frontend
+- **Framework**: SolidJS only. Zero React in `apps/app/`.
+- **Monolith**: `app.tsx` (~2,500 lines) creates ~15 stores, threads ~90 props to `SessionView`.
+- **Session view**: `pages/session.tsx` (~2,000 lines) — SolidJS, receives all state as props via `SessionViewProps`.
+- **State**: SolidJS signals + `createStore()`. No external state libs.
+- **Router**: `@solidjs/router`, imperative navigation.
+- **Prepared seam**: `@openwork/ui` already exports both React and Solid components. `SessionViewProps` is a clean data-only interface.
+- **Build**: Vite + `vite-plugin-solid`. No React plugin configured.
+- **Platform**: Tauri 2.x for desktop/mobile. Web mode uses standard browser APIs. Platform abstraction lives in `context/platform.tsx`.
+
+### Backend
+- **Server**: `Bun.serve()`, hand-rolled router. No framework.
+- **Session data**: Lives in OpenCode's SQLite DB. Client reads via OpenCode SDK or proxied through `/w/:id/opencode/*`.
+- **No server-side session read endpoints**: The OpenWork server has no `GET /sessions` or `GET /session/:id`. It proxies to OpenCode.
+- **Activation**: Nearly free (array reorder). The expensive part is client-side workspace bootstrapping.
+- **Orchestrator**: Process supervisor that spawns server + OpenCode + router.
+
+### Styling
+- **CSS framework**: Tailwind CSS v4.1.18 via `@tailwindcss/vite`.
+- **Color system**: Radix UI Colors (30+ scales, 12 steps each) + DLS semantic tokens — all CSS custom properties (~700+).
+- **Dark mode**: `data-theme` attribute on `<html>` + CSS variable swap. NOT Tailwind `dark:` prefix.
+- **Component styling**: Inline Tailwind `class=` strings with template literal conditionals. No `cn()`, `clsx`, or `tailwind-merge`.
+- **Custom CSS classes**: `ow-*` prefixed classes in global `index.css` (buttons, cards, pills, inputs).
+- **CSS-in-JS**: None.
+- **Animation**: CSS-only (Tailwind transitions + custom `@keyframes`). No framer-motion or JS animation libs.
+- **Fonts**: System font stack (IBM Plex Sans preferred, no bundled fonts).
+- **Design language**: `DESIGN-LANGUAGE.md` (871 lines) — quiet, premium, flat-first. Shadow is last resort.
+- **Key files**: `tailwind.config.ts`, `src/app/index.css`, `src/styles/colors.css`, `DESIGN-LANGUAGE.md`.
+
+### Existing domain map (CUPID)
+The app follows CUPID domain organization:
+- `shell` — routing, layout, boot, global chrome
+- `session` — task/session experience, composer, messages
+- `workspace` — workspace lifecycle, switching, connect
+- `connections` — providers, MCP
+- `automations` — scheduled jobs
+- `cloud` — hosted workers, den
+- `app-settings` — preferences, themes
+- `kernel` — tiny shared primitives
+
+---
+
+## Three-Stage Transition: Solid → Hybrid → React
+
+### Stage 1: React Island (Phases 0-3)
+
+React lives inside the Solid app as a guest. Solid owns the shell, routing, and platform layer. React renders into a div that Solid manages.
+
+```
+Tauri/Web shell
+  └── Solid app (owns everything)
+        ├── Solid sidebar
+        ├── Solid settings
+        └── ReactIsland (a div)
+              └── React session view (our new code)
+```
+
+State bridge: minimal. React gets workspace URL + token + session ID from Solid via island props. React fetches its own data. Two independent state worlds.
+
+### Stage 2: React Expands, Island Inverts (Phases 5-8)
+
+React takes over more surfaces. Each Solid surface migrates to its React counterpart, one domain at a time. At a tipping point (after workspace sidebar moves to React), the island inverts:
+
+```
+Tauri/Web shell
+  └── React app (owns the shell now)
+        ├── React sidebar
+        ├── React session view
+        ├── React settings (partial)
+        └── SolidIsland (a div)  ← for remaining Solid surfaces
+              └── remaining Solid components
+```
+
+### Stage 3: React Owns Everything (Phase 9+)
+
+```
+Tauri shell (just the native window + IPC)
+  └── React app
+        ├── react/shell/
+        ├── react/session/
+        ├── react/workspace/
+        ├── react/connections/
+        ├── react/app-settings/
+        ├── react/cloud/
+        └── react/kernel/
+```
+
+At this point `vite-plugin-solid` and `solid-js` are removed. The app is a standard React SPA that happens to run inside Tauri for desktop. The web build is the same React app without the Tauri wrapper.
+
+---
+
+## State Ownership Rule
+
+**At any point in time, each piece of state has exactly one framework owning it.**
+
+When you migrate a surface from Solid to React, you delete the Solid version of that state. You never have both frameworks managing the same concern.
+
+| Concern | Stage 1 (React island) | Stage 2 (React expanding) | Stage 3 (React owns all) |
+|---------|----------------------|--------------------------|-------------------------|
+| Session messages | React (react-query) | React | React |
+| Session transition | React (transition-controller) | React | React |
+| Workspace list | Solid | React (after migration) | React |
+| Workspace switching | Solid → passes result to React via island props | React | React |
+| Routing | Solid router | Hybrid: Solid routes to React islands | React router |
+| Platform (Tauri IPC) | Solid platform provider | Framework-agnostic adapter module | React calls adapter directly |
+| Settings/config | Solid | Migrated domain by domain | React |
+
+---
+
+## Bridge Contract (Shrinks Over Time)
+
+The island props are the formal contract between Solid and React. It starts small and shrinks to zero:
+
+```ts
+// Stage 1 — React island gets minimal props from Solid
+interface IslandProps {
+  workspaceUrl: string
+  workspaceToken: string
+  workspaceId: string
+  sessionId: string | null
+  onNavigate: (path: string) => void  // React tells Solid to route
+}
+
+// Stage 2 — React takes over sidebar, fewer props needed
+interface IslandProps {
+  workspaces: WorkspaceConnection[]    // React now owns selection
+  onNavigate: (path: string) => void
+}
+
+// Stage 3 — no island, no props. React owns everything.
+// island.tsx deleted, solid-js removed.
+```
+
+Each time a surface migrates, the island props shrink. When they hit zero, the island is removed.
+
+---
+
+## File Structure (CUPID Domains, Component-Enclosed State)
+
+Mirrors the existing CUPID domain map. Each domain colocates state, data, and UI. Components own the state they render — "general" session state sits at the session boundary, local UI state lives inside the component that needs it.
+
+```
+apps/app/src/react/
+├── README.md                              # Why this exists, how to enable, migration status
+│
+├── island.tsx                             # Solid→React bridge (mounts boot.tsx into a DOM node)
+├── boot.tsx                               # React root, providers, top-level wiring
+├── feature-flag.ts                        # Read/write opt-in flag
+│
+├── kernel/                                # Smallest shared layer (CUPID kernel rules apply)
+│   ├── opencode-client.ts                 # Plain fetch() for OpenCode proxy — no Solid dependency
+│   ├── types.ts                           # Session, Message, Workspace shapes
+│   ├── query-provider.tsx                 # react-query provider + defaults
+│   └── dev-panel.tsx                      # Dev-only: renderSource, transition, timings
+│
+├── shell/                                 # App-wide composition only (thin)
+│   ├── layout.tsx                         # Sidebar + main area composition
+│   ├── router.tsx                         # Route → domain view dispatch
+│   └── index.ts
+│
+├── session/                               # Domain: active task/session experience
+│   │
+│   │  -- General session state (shared by session components) --
+│   ├── session-store.ts                   # renderedSessionId, intendedSessionId, renderSource
+│   ├── transition-controller.ts           # idle → switching → cache → live → idle
+│   ├── sessions-query.ts                  # react-query: list sessions for a workspace
+│   ├── session-snapshot-query.ts          # react-query: full session + messages
+│   │
+│   │  -- Session view (composition root for the main area) --
+│   ├── session-view.tsx                   # Composes message-list + composer + status
+│   │                                      #   owns: scroll position, view-level layout
+│   │
+│   │  -- Message list (owns its own scroll/virtualization) --
+│   ├── message-list/
+│   │   ├── message-list.tsx               # Virtualized container
+│   │   │                                  #   owns: virtualization state, scroll anchor
+│   │   ├── message-item.tsx               # Single message bubble
+│   │   │                                  #   owns: collapsed/expanded, copy state
+│   │   ├── part-view.tsx                  # Tool call, text, file, reasoning
+│   │   │                                  #   owns: expand/collapse per part
+│   │   └── index.ts
+│   │
+│   │  -- Composer (owns its own input state) --
+│   ├── composer/
+│   │   ├── composer.tsx                   # Prompt textarea + attachments + run/abort
+│   │   │                                  #   owns: draft text, file list, submitting
+│   │   ├── send-prompt.ts                 # Mutation: send, SSE subscribe, abort
+│   │   ├── attachment-picker.tsx
+│   │   │                                  #   owns: file picker open/selected state
+│   │   └── index.ts
+│   │
+│   │  -- Session sidebar (owns its own list state) --
+│   ├── session-sidebar/
+│   │   ├── session-sidebar.tsx            # Session list for one workspace
+│   │   │                                  #   owns: search filter, rename-in-progress
+│   │   ├── session-item.tsx               # Single row
+│   │   │                                  #   owns: hover, context menu open
+│   │   └── index.ts
+│   │
+│   │  -- Transition UX --
+│   ├── transition-overlay.tsx             # "Switching..." / skeleton during transitions
+│   │                                      #   owns: nothing — reads from transition-controller
+│   │
+│   └── index.ts                           # Public surface (only what shell needs)
+│
+├── workspace/                             # Domain: workspace lifecycle
+│   ├── workspace-store.ts                 # Which workspaces exist, connection info
+│   ├── workspace-list.tsx                 # Sidebar workspace groups
+│   │                                      #   owns: collapsed state, selection highlight
+│   ├── workspace-switcher.tsx             # Switching logic + transition state
+│   │                                      #   owns: switching/idle/failed for workspace changes
+│   ├── workspaces-query.ts                # react-query: list + status
+│   ├── create-workspace-modal.tsx         # Add workspace flow
+│   └── index.ts
+│
+├── connections/                           # Domain: providers, MCP
+│   └── index.ts                           # Placeholder — empty until needed
+│
+├── cloud/                                 # Domain: hosted workers, den
+│   └── index.ts                           # Placeholder — empty until needed
+│
+├── app-settings/                          # Domain: preferences, themes
+│   └── index.ts                           # Placeholder — empty until needed
+│
+└── automations/                           # Domain: scheduled jobs
+    └── index.ts                           # Placeholder — empty until needed
+```
+
+### Component-enclosed state hierarchy
+
+Visual hierarchy = state hierarchy. A human reading the tree knows who owns what:
+
+```
+shell/layout.tsx
+  ├── workspace/workspace-list.tsx          → owns: selection, collapse
+  │     └── workspace-switcher.tsx          → owns: workspace transition state
+  │
+  └── session/session-view.tsx              → reads: session-store (general)
+        ├── session/message-list/           → owns: scroll, virtualization
+        │     └── message-item.tsx          → owns: expand/collapse per message
+        │           └── part-view.tsx       → owns: expand/collapse per part
+        ├── session/composer/               → owns: draft, files, submitting
+        ├── session/session-sidebar/        → owns: search, rename-in-progress
+        └── session/transition-overlay.tsx  → reads: transition-controller (no local state)
+```
+
+General session state (`session-store.ts`, `transition-controller.ts`, queries) lives at the `session/` root — shared by components below it. Component-local state (draft text, scroll position, expand/collapse) lives inside the component that renders it. No ambiguity.
+
+---
+
+## Styling Strategy
+
+### What carries over for free
+
+The entire styling foundation is framework-agnostic. React components inherit everything without configuration:
+
+| Asset | Framework-dependent? | Notes |
+|-------|---------------------|-------|
+| Tailwind classes | No | Just CSS strings. Same classes, same output. |
+| CSS custom properties (700+ Radix + DLS tokens) | No | Pure CSS, loaded in `index.css`. |
+| Dark mode (`data-theme` + variable swap) | No | Works on any DOM element. |
+| `ow-*` CSS classes (buttons, cards, pills) | No | Global CSS, available everywhere. |
+| `@keyframes` animations | No | Pure CSS. |
+| Font stack | No | System fonts, nothing to load. |
+| `DESIGN-LANGUAGE.md` reference | No | Design rules are visual, not framework. |
+
+**React components use `className=` instead of `class=`. That is the only syntax change.**
+
+### What to add for React
+
+One utility in `react/kernel/`:
+
+```ts
+// react/kernel/cn.ts
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
+```
+
+The Solid side manages without this (template literals). The React side benefits from `cn()` for conditional classes — it's the standard React/Tailwind convention and prevents class conflicts during composition.
+
+**New dependencies (Phase 0):** `clsx`, `tailwind-merge`.
+
+### Styling rules for React components
+
+1. **Use the same Tailwind classes.** Reference `DESIGN-LANGUAGE.md` for visual decisions.
+2. **Use DLS tokens** (`dls-surface`, `dls-border`, `dls-accent`, etc.) via Tailwind config, not raw hex values.
+3. **Use Radix color scales** (`bg-gray-3`, `text-blue-11`) for non-semantic colors.
+4. **Use `ow-*` classes** where they exist (e.g., `ow-button-primary`, `ow-soft-card`).
+5. **Use `cn()`** for conditional classes instead of template literals.
+6. **No CSS-in-JS.** No styled-components, no emotion. Tailwind only.
+7. **No `dark:` prefix.** Dark mode is handled by CSS variable swap on `[data-theme="dark"]`.
+8. **Animation is CSS-only.** Use Tailwind `transition-*` and the existing custom `@keyframes`. No framer-motion.
+9. **Match the Solid component's visual output exactly.** When migrating a surface, screenshot both versions and diff. Same spacing, same colors, same radius, same shadows.
+
+### Visual parity verification
+
+Each migrated surface gets a visual comparison test:
+1. Screenshot the Solid version (Chrome DevTools).
+2. Screenshot the React version (same viewport, same data).
+3. Overlay or side-by-side compare. No visible difference = pass.
+
+This is added to the test actions for each phase.
+
+---
+
+## Isolation & Testing Strategy
+
+### Per-phase Docker isolation
+Each phase gets tested against two independent local app/server stacks:
+
+```
+Stack A (control): runs the existing SolidJS app
+  → server :PORT_A, web :PORT_A_WEB
+
+Stack B (experiment): independent server
+  → server :PORT_B, web :PORT_B_WEB
+```
+
+Both stacks share the same repo (bind-mounted), but run independent servers with independent tokens and hostnames (verified via `hostname` command through the UI).
+
+### Test actions
+Every phase adds entries to `test-actions.md` with:
+- Steps to exercise the new React surface
+- Expected results
+- Comparison against the Solid version on the control stack
+- Chrome DevTools verification (using `functions.chrome-devtools_*`)
+
+### Feature flag gate
+```
+localStorage.setItem('openwork:react-session', 'true')
+// or
+http://localhost:<WEB_PORT>/session?react=1
+```
+
+The app shell checks this flag and renders either:
+- `<SessionView />` (Solid, existing)
+- `<ReactIsland />` → React session view (new)
+
+---
+
+## Phase Roadmap
+
+### Phase 0: Build Infrastructure
+
+**Goal**: React components can render inside the SolidJS app.
+
+**Deliverables**:
+1. Add `@vitejs/plugin-react` to Vite config (alongside `vite-plugin-solid`).
+2. File convention: `*.tsx` in `src/react/` = React. Everything else = Solid.
+3. `island.tsx` — Solid component that mounts a React root into a DOM node.
+4. `boot.tsx` — React root with `QueryClientProvider`.
+5. Add `react`, `react-dom`, `@tanstack/react-query` to `apps/app/package.json`.
+6. `feature-flag.ts` — reads localStorage / query param.
+7. Verify: a trivial React component renders inside the Solid shell.
+
+**Test**:
+- Boot Docker stack.
+- Navigate to session view.
+- Enable feature flag.
+- Confirm React island mounts (check React DevTools or a visible test banner).
+
+**Does NOT change any user-visible behavior.**
+
+### Phase 1: React Session View (Read-Only)
+
+**Goal**: A React component can display a session's messages (read-only, no composer).
+
+**Deliverables**:
+1. `react/kernel/opencode-client.ts` — plain `fetch()` client for OpenCode proxy.
+2. `react/kernel/types.ts` — Session, Message, Part shapes.
+3. `react/session/session-store.ts` — `renderedSessionId`, `intendedSessionId`, `renderSource`.
+4. `react/session/sessions-query.ts` — react-query: list sessions.
+5. `react/session/session-snapshot-query.ts` — react-query: session + messages.
+6. `react/session/session-view.tsx` — composition root.
+7. `react/session/message-list/` — virtualized message rendering.
+8. Feature-flagged: `?react=1` shows React view, default shows Solid.
+
+**State ownership**: React owns all session read state. It fetches directly from the OpenCode proxy. No Solid signal subscriptions. The island props provide only: `workspaceUrl`, `workspaceToken`, `workspaceId`, `sessionId`.
+
+**Test actions**:
+- Create session in Solid view, send a prompt, get a response.
+- Switch to React view (`?react=1`) — same session's messages appear.
+- Switch sessions — React view transitions without white screen.
+- Compare: Solid view on Stack A, React view on Stack B, same prompt, same output.
+
+**Success criteria**:
+- No blank pane during session switch.
+- Messages render from cache instantly, upgrade to live data.
+- `renderSource` visible in dev panel.
+
+### Phase 2: React Composer (Send/Receive)
+
+**Goal**: The React session view can send prompts and display streaming responses.
+
+**Deliverables**:
+1. `react/session/composer/composer.tsx` — prompt input, file attachment, run/abort.
+2. `react/session/composer/send-prompt.ts` — mutation: send, SSE stream, abort.
+3. `react/session/composer/attachment-picker.tsx`.
+4. SSE subscription for streaming message parts.
+5. `streamdown` for markdown rendering of streaming text.
+
+**State ownership**: Composer owns draft text, file list, submitting state. Send mutation is local to composer. Streaming messages flow into react-query cache via SSE → cache invalidation.
+
+**Test actions**:
+- Type a prompt in React composer, click Run.
+- Response streams in real-time.
+- Abort mid-stream — session stops cleanly.
+- Switch workspace mid-stream — no crash.
+
+**Success criteria**:
+- Full send/receive/abort cycle works in React view.
+- Streaming feels identical to Solid view.
+
+### Phase 3: Transition Controller + Debug Panel
+
+**Goal**: The React path handles workspace and session switching with explicit transition states.
+
+**Deliverables**:
+1. `react/session/transition-controller.ts` — state machine:
+   ```
+   idle → switching → (cache-render) → (live-upgrade) → idle
+   idle → switching → failed → recovering → idle
+   ```
+2. `react/session/transition-overlay.tsx` — skeleton/indicator during transitions.
+3. `react/kernel/dev-panel.tsx` — shows `routeState`, `transitionState`, `renderSource`, `runtimeState`.
+
+**Test actions**:
+- Connect two Docker dev stacks as workspaces.
+- Switch between workspaces rapidly.
+- React view never shows white screen.
+- Debug panel visible and accurate.
+
+**Success criteria**:
+- Zero white screens during any switch sequence.
+- Transition states are inspectable via Chrome DevTools.
+
+### Phase 4: Backend Read APIs (parallel track)
+
+**Goal**: Session reads don't require client-side OpenCode proxy orchestration.
+
+**Deliverables** (in `apps/server/src/server.ts`):
+1. `GET /workspace/:id/sessions` — list sessions for a workspace.
+2. `GET /workspace/:id/sessions/:sessionId` — session detail with messages.
+3. `GET /workspace/:id/sessions/:sessionId/snapshot` — full session snapshot.
+4. Typed response schemas (zod).
+
+**Test actions**:
+- `curl http://localhost:<PORT>/workspace/<id>/sessions` returns session list.
+- `curl http://localhost:<PORT>/workspace/<id>/sessions/<sid>/snapshot` returns full snapshot.
+- Works for any workspace, not just the "active" one.
+- React query layer switches to these endpoints.
+
+**Success criteria**:
+- Session reads work without activation.
+- Response times < 100ms for cached reads.
+
+### Phase 5: React Session as Default
+
+**Goal**: Flip the feature flag. React session view is the default.
+
+**Deliverables**:
+1. Feature flag default flips to `true`.
+2. `?solid=1` to opt back into Solid session view.
+3. Remove any Solid↔React shims that are no longer needed for session.
+
+**Success criteria**:
+- All test actions pass with React as default.
+- No regression in any existing flow.
+
+### Phase 6: Migrate Workspace Sidebar
+
+**Goal**: React owns the workspace list and session sidebar.
+
+**Deliverables**:
+1. `react/workspace/workspace-list.tsx` — workspace groups in sidebar.
+2. `react/session/session-sidebar/` — session list per workspace.
+3. `react/workspace/workspace-switcher.tsx` — switching logic.
+4. Island props shrink: React now receives `workspaces[]` instead of single workspace info.
+
+**State ownership**: React owns workspace selection, sidebar collapse, session list filtering. Solid still owns settings and platform.
+
+### Phase 7: Migrate Settings & Connections
+
+**Goal**: React owns settings pages and provider/MCP flows.
+
+**Deliverables**:
+1. Fill `react/app-settings/` — theme, preferences, config.
+2. Fill `react/connections/` — provider auth, MCP.
+3. Fill `react/cloud/` — hosted workers, den.
+
+### Phase 8: Island Inversion
+
+**Goal**: React becomes the shell. Solid becomes the guest (if anything remains).
+
+**Deliverables**:
+1. `react/shell/layout.tsx` becomes the top-level composition.
+2. `react/shell/router.tsx` owns all routing.
+3. If any Solid surfaces remain, they render inside a `SolidIsland` React component.
+4. Island props are now zero or near-zero.
+
+### Phase 9: Remove Solid
+
+**Goal**: The app is pure React.
+
+**Deliverables**:
+1. Remove `vite-plugin-solid` from Vite config.
+2. Remove `solid-js`, `@solidjs/router`, `solid-primitives` from `package.json`.
+3. Delete `apps/app/src/app/` (the old Solid tree).
+4. `apps/app/src/react/` becomes `apps/app/src/app/` (or stays where it is).
+5. Remove `island.tsx`, `feature-flag.ts`.
+
+---
+
+## Migration Surface Order
+
+```
+Phase 0-3  → Session view (messages, composer, transitions)
+Phase 5    → Flip session default to React
+Phase 6    → Workspace sidebar + session sidebar
+             ← tipping point: React owns enough to invert the island →
+Phase 7    → Settings, connections, cloud
+Phase 8    → Shell/layout/routing — island inversion
+Phase 9    → Remove Solid entirely
+```
+
+## Timeline Guidance
+
+| Phase | Scope | Estimated Effort |
+|-------|-------|-----------------|
+| 0 | Build infra | ~1 day |
+| 1 | Read-only session view | ~1 week |
+| 2 | Composer + streaming | ~1 week |
+| 3 | Transition controller + debug | ~1 week |
+| 4 | Backend read APIs (parallel) | ~1 week |
+| 5 | Flip session default | ~1 day |
+| 6 | Workspace sidebar | ~1 week |
+| 7 | Settings, connections, cloud | ~2-3 weeks |
+| 8 | Island inversion | ~1 week |
+| 9 | Remove Solid | ~1 day |
+
+Phases 0-3 are fast and highly visible. Phase 4 can run in parallel. Phases 6+ can be paced based on stability.
+
+---
+
+## Files Changed Per Phase
+
+| Phase | Files |
+|-------|-------|
+| 0 | `apps/app/vite.config.ts`, `apps/app/package.json`, new `src/react/island.tsx`, `src/react/boot.tsx`, `src/react/feature-flag.ts` |
+| 1 | New `src/react/kernel/` (3 files), new `src/react/session/` (6-8 files), feature flag check in `app.tsx` |
+| 2 | New `src/react/session/composer/` (3 files) |
+| 3 | New `src/react/session/transition-controller.ts`, `transition-overlay.tsx`, `src/react/kernel/dev-panel.tsx` |
+| 4 | `apps/server/src/server.ts` (add 3-4 endpoints), new `apps/server/src/session-read-model.ts` |
+| 5 | `app.tsx` flag flip, cleanup |
+| 6 | New `src/react/workspace/` (4-5 files), `src/react/session/session-sidebar/` (2 files) |
+| 7 | Fill `src/react/connections/`, `src/react/app-settings/`, `src/react/cloud/` |
+| 8 | `src/react/shell/` becomes the root, island inversion |
+| 9 | Delete `src/app/`, remove Solid deps |
+
+---
+
+## Verification Approach
+
+Every phase:
+1. Boot two independent local app/server stacks.
+2. Connect Stack B as a workspace from Stack A's UI.
+3. Run the phase's test actions via Chrome DevTools (`functions.chrome-devtools_*`).
+4. Screenshot evidence saved to repo.
+5. Update `test-actions.md` with the new test actions.
+6. PR includes screenshots and test action references.
+
+---
+
+## Dependency Direction
+
+Same CUPID rules apply to the React tree:
+
+```
+shell → domain public API (index.ts) → domain internals
+```
+
+- Domains may depend on `kernel/` primitives.
+- Domains never reach into another domain's internals.
+- Cross-domain imports go through `index.ts`.
+- No bidirectional imports.
+- No "super util" files.
+
+---
+
+## Anti-Patterns
+
+- Adding feature logic to `shell/layout.tsx` (shell orchestrates, doesn't absorb).
+- Sharing state between Solid and React for the same concern (one owner always).
+- Creating `utils/` or `helpers/` buckets instead of colocating with the owning domain.
+- Migrating more than one domain per phase.
+- Rewriting Solid component behavior during migration (preserve behavior, change placement).
+
+---
+
+## Decision Heuristic
+
+- **Immediate product feel**: start with frontend Phase 0-1 (session view).
+- **Highest compounding win**: invest in backend Phase 4 (read APIs) in parallel.
+- **When to invert the island**: after workspace sidebar (Phase 6) moves to React — that's when React owns enough of the visual hierarchy to be the shell.
+- **When to remove Solid**: only after all domains are migrated and stable. Not before.
diff --git a/prds/server-v2-plan/app-audit.md b/prds/server-v2-plan/app-audit.md
new file mode 100644
index 0000000000..f3e82d140e
--- /dev/null
+++ b/prds/server-v2-plan/app-audit.md
@@ -0,0 +1,350 @@
+# App Audit
+
+## Scope
+
+This audit covers `apps/app/**` only.
+
+## Alignment Note
+
+This audit documents the current client-side footprint, not the final target-state ownership boundary.
+
+To fully match `prds/server-v2-plan/ideal-flow.md`, cloud settings, workspace/server relationship state, config mutation, and session/runtime behavior should become server-owned, while app-local storage shrinks to transient UI state and minimal reconnect data.
+
+The goal is to document:
+
+- every meaningful feature that does not explicitly contact the OpenWork server
+- every feature that does substantial local/client-side work before it eventually sends data to the server
+
+This document now assumes the target architecture is a single main server API surface, not a permanent split between app, orchestrator control plane, and server control plane.
+
+The focus is on the client-owned lifecycle: local state, browser APIs, local persistence, parsing, transformations, clipboard, dialogs, routing, rendering, Tauri-bridged local actions, and mixed local-then-server flows.
+
+## Disposition Labels
+
+- `Stay`: should remain in the app because it is transient UI state, presentation logic, or other true client behavior.
+- `Move`: should move behind the server because it is real workspace behavior.
+- `Split`: some UI orchestration or local preprocessing should stay, but the underlying capability should move behind the server.
+
+## High-Level Lifecycle
+
+1. The frontend boots and restores local shell state.
+2. Theme, zoom, window preferences, and workspace/session preferences are restored locally.
+3. Deep links and startup state are parsed locally before deciding whether to connect anywhere.
+4. Workspace creation, connection, sharing, session composition, and settings flows do a lot of local shaping before contacting server surfaces.
+5. Large parts of the UI remain purely local: layout, drafts, rendering, search, diagnostics, and clipboard/open-file helpers.
+
+## Shell And Persistent UI State
+
+Disposition guidance:
+
+- all items in this section -> `Stay`
+
+Reasoning: theme, zoom, layout, local preferences, and shell restoration are legitimate client-owned concerns.
+
+### `theme`
+
+- What it does: manages light/dark/system theme and applies it to the document.
+- Called from and when: initialized during app boot and updated when the user changes theme settings.
+- Ends up calling: `localStorage`, `matchMedia`, `document.documentElement.dataset.theme`, and CSS `color-scheme`; no server contact.
+
+### `LocalProvider` and `persisted`
+
+- What they do: persist app-level UI preferences and shell state such as tabs, thinking visibility, model defaults, and other local settings.
+- Called from and when: mounted at app startup and used throughout the app lifecycle.
+- Ends up calling: browser storage or platform storage abstractions; no server contact by themselves.
+
+### `useSessionDisplayPreferences`
+
+- What it does: stores per-user display preferences such as whether “thinking” is shown.
+- Called from and when: used while rendering session pages and on settings resets.
+- Ends up calling: local preference persistence and render state updates; no server contact.
+
+### app startup/session preference restoration in `app.tsx`
+
+- What it does: restores startup state such as last-selected session, selected base URL, engine source/runtime preferences, and update-related UI settings.
+- Called from and when: runs during app boot.
+- Ends up calling: `localStorage`, navigation setup, startup session restoration, and connection preference state; no direct server contact, though restored values may later influence server calls.
+
+### font zoom and window chrome helpers
+
+- What they do: handle zoom shortcuts, persist zoom state, apply CSS fallback zoom, and toggle Tauri window decorations.
+- Called from and when: initialized during app boot and triggered on keyboard shortcuts or preference changes.
+- Ends up calling: `localStorage`, CSS updates, Tauri webview zoom APIs, and Tauri window APIs; no server contact.
+
+### workspace shell layout persistence
+
+- What it does: stores sidebar widths, expansion state, and other shell layout preferences.
+- Called from and when: used while the session shell is open and while the user resizes or toggles layout areas.
+- Ends up calling: local storage and render/layout updates only; no server contact.
+
+## Deep Links And Cloud Session State
+
+Disposition guidance:
+
+- deep-link bridge -> `Stay`
+- deep-link parsing and controller logic -> `Split`
+- OpenWork Cloud settings persistence -> `Split`
+- manual cloud sign-in flow -> `Split`
+- OpenWork Cloud template cache -> `Stay`
+
+Reasoning: parsing, routing, and lightweight cached cloud session state stay in the UI, but durable cloud settings and auth/session state should move behind the server.
+
+### deep-link bridge
+
+- What it does: queues native/browser deep links before the app is fully ready and replays them into the running UI.
+- Called from and when: used at app boot and when desktop/native deep-link events arrive.
+- Ends up calling: `window.__OPENWORK__` state and custom browser events; no server contact by itself.
+
+### deep-link parsing and controller logic
+
+- What it does: parses OpenWork remote-connect links, Den auth links, debug links, and cleans URL state after consuming them.
+- Called from and when: runs on app boot and when deep-link events arrive.
+- Ends up calling: local routing, modal state, query-param cleanup, and cloud/session settings updates; some branches eventually contact OpenWork or Den after local parsing is complete.
+
+### OpenWork Cloud settings persistence
+
+- What it does: stores cloud base URL, auth token, and active org for Den/OpenWork cloud features.
+- Called from and when: used by cloud settings, workspace creation, and sharing flows.
+- Ends up calling: `localStorage` and local cloud-session state; in the ideal model durable cloud auth/settings move to the server DB and this becomes transient reconnect/UI state.
+
+### manual cloud sign-in flow
+
+- What it does: accepts a pasted deep link or handoff code, parses it locally, validates it, and exchanges it for a cloud token.
+- Called from and when: called from the Cloud settings panel when the user signs in manually.
+- Ends up calling: local parsing and status state first, then cloud auth endpoints.
+
+### OpenWork Cloud template cache
+
+- What it does: memoizes cloud template lists by cloud identity and org.
+- Called from and when: used when template-driven workspace creation or cloud settings panels open.
+- Ends up calling: in-memory cache and signals first; initial loads eventually fetch from cloud/server surfaces.
+
+## Workspace Creation And Connection
+
+Disposition guidance:
+
+- `CreateWorkspaceModal` -> `Stay`
+- `createWorkspaceFlow` -> `Split`
+- sandbox creation flow -> `Split`
+- `createRemoteWorkspaceFlow` -> `Split`
+- onboarding/bootstrap branching -> `Stay`
+
+Reasoning: modal state and startup branching stay in the UI, but actual workspace creation/connection/runtime behavior should move behind the server.
+
+### `CreateWorkspaceModal`
+
+- What it does: owns the local UI state for local workspace creation, remote worker connection, cloud template browsing, worker filtering, and folder selection.
+- Called from and when: opened from onboarding and create/connect workspace flows.
+- Ends up calling: local modal state, folder pickers, cloud template cache, browser/Tauri link opening, and then optionally remote or cloud connection flows.
+
+### `createWorkspaceFlow`
+
+- What it does: orchestrates local workspace creation, derives default names, queues a starter session, updates selection state, and routes into first-session setup.
+- Called from and when: called from onboarding, the create-workspace modal, and template/bundle import flows.
+- Ends up calling: local busy state, selected workspace state, navigation, Tauri local workspace creation, and starter session setup; some branches eventually use local server surfaces.
+
+### sandbox creation flow
+
+- What it does: manages local progress state, Docker preflight state, debug logs, and Tauri event subscriptions for sandbox startup.
+- Called from and when: called from sandbox/new worker creation UI.
+- Ends up calling: local progress UI, Tauri event listeners, and debug state first, then remote/server registration once the sandbox is ready.
+
+### `createRemoteWorkspaceFlow`
+
+- What it does: normalizes the remote host URL/token, resolves remote workspace identity, updates local server settings, and persists a remote workspace record.
+- Called from and when: called from deep links, onboarding connect flows, worker open actions, and remote workspace modals.
+- Ends up calling: local validation, local settings persistence, routing, selected-workspace state, and then remote server requests; in the ideal model the durable remote workspace record belongs in the local server DB, not the app.
+
+### onboarding/bootstrap branching
+
+- What it does: decides whether startup should create a welcome workspace, reconnect a local runtime, reconnect a remote worker, or stay on welcome/onboarding UI.
+- Called from and when: runs during app startup.
+- Ends up calling: local startup-phase state, navigation, and workspace-selection logic first; some branches eventually connect to server/runtime surfaces.
+
+## Bundle Import, Share, And Publish
+
+Disposition guidance:
+
+- bundle URL parsing and fetch fallback -> `Stay`
+- bundle schema parsing -> `Stay`
+- bundle workflow store -> `Split`
+- workspace share/export state -> `Split`
+- bundle publishing helpers -> `Split`
+
+Reasoning: parsing and UI state stay client-side, but import/export/share of real workspace capabilities should ultimately be server-owned.
+
+### bundle URL parsing and fetch fallback
+
+- What it does: parses bundle deep links, cleans bundle-specific query params, rewrites bundle URLs, and chooses fetch strategies.
+- Called from and when: runs on app boot, bundle deep-link open, and debug-open flows.
+- Ends up calling: local URL cleanup and fetch strategy selection first, then bundle fetches.
+
+### bundle schema parsing
+
+- What it does: validates imported bundle shape and normalizes names, presets, and files into app-friendly structures.
+- Called from and when: used whenever a bundle is opened, previewed, or imported.
+- Ends up calling: local parsing/validation only; no server contact by itself.
+
+### bundle workflow store
+
+- What it does: owns modal state and the import decision tree, including trust warnings, worker-target resolution, and import routing.
+- Called from and when: entered from bundle deep links and debug-open flows.
+- Ends up calling: local modal state, navigation, worker selection, and import state first, then workspace import or worker-creation flows.
+
+### workspace share/export state
+
+- What it does: derives shareable metadata for local and remote workspaces, resolves missing workspace IDs, and tracks share modal state.
+- Called from and when: used by the session share flow.
+- Ends up calling: local modal state, clipboard, browser/Tauri opener, and share metadata derivation first; publish/export actions later contact OpenWork or Den.
+
+### bundle publishing helpers
+
+- What they do: shape bundle payloads locally and reconcile org identity before publish.
+- Called from and when: called from sharing and skills-publish flows.
+- Ends up calling: local payload construction first, then OpenWork/Den publish APIs.
+
+## Session Composer And Session View
+
+Disposition guidance:
+
+- session draft persistence -> `Stay`
+- attachment preprocessing in the composer -> `Stay`
+- prompt and command file-part shaping -> `Split`
+- optimistic session creation and navigation -> `Split`
+- undo, redo, and compact helpers -> `Split`
+- local message search and command palette -> `Stay`
+- message-windowing and render throttling -> `Stay`
+- local file and folder affordances -> `Stay`
+
+Reasoning: drafts, rendering, local search, and client-side attachment prep stay in the UI; real session operations and workspace-aware file semantics should move behind the server.
+
+### session draft persistence
+
+- What it does: stores and restores per-workspace/per-session draft text and mode.
+- Called from and when: active while the user edits prompts and switches sessions.
+- Ends up calling: `localStorage`, custom flush events, and local composer state only; no server contact until send.
+
+### attachment preprocessing in the composer
+
+- What it does: filters incoming files, compresses images, estimates payload size, creates preview URLs, and handles drag/paste attachment intake.
+- Called from and when: called while the user edits a prompt or drops/pastes attachments.
+- Ends up calling: `FileReader`, `OffscreenCanvas` or canvas APIs, object URLs, clipboard/paste handling, and local warning state; attachments may later be sent to the server when the user submits.
+
+### prompt and command file-part shaping in the session actions store
+
+- What it does: resolves file mentions, converts attachments into data URLs, builds prompt or command payload parts, and clears drafts at the right time.
+- Called from and when: called when the user sends a prompt, retries, or creates a new session from local input.
+- Ends up calling: local prompt/draft state, file/data transformation, and then final prompt/session server calls.
+
+### optimistic session creation and navigation
+
+- What it does: creates a new session flow in the UI, preserves the initial prompt locally, selects the session, refreshes sidebar state, and navigates to it.
+- Called from and when: called when the user sends without an active session or explicitly creates one.
+- Ends up calling: local navigation and session-list state first, then session creation on the server.
+
+### undo, redo, and compact helpers
+
+- What they do: perform local prompt/session-state coordination around history operations.
+- Called from and when: called from session history controls.
+- Ends up calling: local prompt/session state first, then server-backed revert or compact operations.
+
+### local message search and session command palette
+
+- What it does: builds client-side searchable message text, debounces queries, tracks hits, and scrolls to matches; also manages local session command-palette behavior.
+- Called from and when: active while a session is open and the user searches or switches via palette.
+- Ends up calling: local render/search state, scroll positioning, and navigation only; no server contact.
+
+### message-windowing and render throttling
+
+- What it does: windows long histories, batches streaming render commits, and tracks render/perf details locally.
+- Called from and when: active during session rendering and message streaming.
+- Ends up calling: render state and performance bookkeeping only; no server contact.
+
+### local file and folder affordances in the session UI
+
+- What they do: reveal workspace directories, open local files, and reveal artifact paths.
+- Called from and when: called from message parts and session sidebars.
+- Ends up calling: Tauri opener APIs and local toast state; no server contact.
+
+## Skills, Plugins, MCP, And Local Config Editing
+
+Disposition guidance:
+
+- cloud import metadata normalization -> `Split`
+- skills and cloud-sync local prep -> `Split`
+- plugin config editing -> `Move`
+- MCP connection and config flow -> `Split`
+- cloud provider list memoization -> `Stay`
+
+Reasoning: UI-owned shaping and memoization stay local, but config mutation, skills/plugins/MCP capability changes, and other workspace mutations should move behind the server.
+
+### cloud import metadata normalization
+
+- What it does: parses and rewrites `cloudImports` metadata in workspace config.
+- Called from and when: used when syncing skills, providers, and hubs with cloud-backed metadata.
+- Ends up calling: local config-shaping logic first; final writes should route through the server, with any Tauri-backed config path treated as temporary fallback-only debt.
+
+### skills and cloud-sync local prep
+
+- What it does: slugifies names, extracts markdown bodies, builds frontmatter, tracks imported cloud-skill maps, and stores hub preferences locally.
+- Called from and when: used in skills import/edit/remove flows.
+- Ends up calling: local markdown/config shaping, local state, `localStorage`, and in some cases direct local skill-file mutation; those direct local mutation paths are temporary fallback-only debt, and successful flows should ultimately go through the server or cloud APIs.
+
+### plugin config editing
+
+- What it does: parses and rewrites plugin arrays inside `opencode.json` using local JSONC edits.
+- Called from and when: called from plugin/settings UI.
+- Ends up calling: local config parsing and file-update shaping first; writes should move behind server-backed config APIs, and local writes should be treated as temporary fallback-only debt.
+
+### MCP connection and config flow
+
+- What it does: builds MCP config objects locally, infers names, injects special Chrome DevTools env values, and edits/removes config.
+- Called from and when: called from MCP connect, remove, and auth/logout UI.
+- Ends up calling: local config editing, local MCP modal state, and then server-backed MCP writes/logout or external auth flows; direct local config edits here should be treated as temporary fallback-only debt.
+
+### cloud provider list memoization
+
+- What it does: caches and merges provider lists using local cloud session/org state.
+- Called from and when: used while provider settings or provider-auth UI is open.
+- Ends up calling: in-memory cache and local state first; refreshes eventually contact Den or the main server, and any direct OpenCode access should be treated as migration debt.
+
+## Diagnostics, Reset, And Desktop Utilities
+
+Disposition guidance:
+
+- OpenWork server settings persistence -> `Split`
+- reset and reload state management -> `Stay`
+- settings diagnostics and export helpers -> `Split`
+- incidental clipboard/open-link helpers -> `Stay`
+
+Reasoning: client preferences, reload state, clipboard, and pure diagnostics remain UI concerns, while durable connection/auth/product state should move behind the server.
+
+### OpenWork server settings persistence
+
+- What it does: normalizes and persists host URL, token, remote-access preference, and derived base URL/client settings.
+- Called from and when: used on app boot and when connection settings change.
+- Ends up calling: `localStorage` and local connection state; in the ideal model this shrinks to minimal reconnect/bootstrap hints while durable connection registry and cloud auth/session metadata move behind the server.
+
+### reset and reload state management
+
+- What it does: tracks reload-required reasons, supports local resets, and relaunch/reload behavior.
+- Called from and when: used by settings and reload-warning UI.
+- Ends up calling: local storage cleanup, local state resets, and app relaunch/reload APIs; no direct server contact.
+
+### settings diagnostics and export helpers
+
+- What they do: build local debug/export payloads, copy them to clipboard, download them as files, or reveal paths in Finder.
+- Called from and when: called from settings diagnostics UI.
+- Ends up calling: clipboard APIs, Blob download APIs, Tauri opener APIs, and local reset helpers; most paths do not contact the server.
+
+### incidental clipboard/open-link helpers
+
+- What they do: copy links, share codes, messages, and open auth/share URLs.
+- Called from and when: called from share, auth, and message actions across the UI.
+- Ends up calling: clipboard and opener/browser APIs; they often follow a server action, but the helper itself is local.
+
+## Coverage Limits
+
+- This audit stays focused on `apps/app`.
+- It intentionally excludes simple server fetch wrappers unless the client does meaningful local work first.
+- It describes mixed flows where local parsing/state/setup happens before a server request, because those are important ownership boundaries.
diff --git a/prds/server-v2-plan/architecture.md b/prds/server-v2-plan/architecture.md
new file mode 100644
index 0000000000..69d64dd79e
--- /dev/null
+++ b/prds/server-v2-plan/architecture.md
@@ -0,0 +1,593 @@
+# Server V2 Architecture
+
+## Status: Draft
+## Date: 2026-04-09
+
+## Purpose
+
+This document expands `prds/server-v2-plan/plan.md` with a more concrete technical design for Server V2.
+
+The goal is to define a whole new Hono-based server package, expose a typed contract, and support incremental client migration onto that server.
+
+## Core Model
+
+Server V2 starts as a separate new server package and process.
+
+```text
+apps/server-v2/
+├── server process
+├── OpenAPI contract
+└── server-owned runtime/workspace behavior
+```
+
+This means:
+
+- a clean replacement server boundary
+- a separate deployable/process during the transition
+- new logic isolated in new files
+- no need to preserve legacy server structure while designing the new architecture
+
+## Target End State
+
+The long-term target is a single main server API surface.
+
+Desired shape:
+
+```text
+desktop app or CLI
+-> starts or connects to one OpenWork server process
+-> OpenWork server owns workspace/runtime/product behavior
+-> OpenWork server supervises the local runtime pieces it needs
+```
+
+This means:
+
+- the orchestrator should stop being a separate product control plane
+- orchestrator runtime/workspace APIs should be folded into the main server
+- bootstrap and supervision behavior should move into the main server wherever practical
+
+## Design Principles
+
+- Server V2 code lives in new files only.
+- The new server API contract is explicit and typed.
+- Clients depend on generated contracts and a small app-side SDK adapter, not server internals.
+- Multi-server routing is explicit at the client boundary.
+- The desktop app is a thin interface layer, not a second workspace runtime.
+- Workspace behavior belongs to the server, even when the server is hosted locally by the desktop app.
+- Migration happens by vertical slice, not by broad framework churn.
+- Legacy code should be deleted as soon as each migrated slice is complete.
+
+## Ownership Boundary
+
+The architecture should enforce a simple rule:
+
+- the app presents and collects intent
+- the server performs workspace work
+
+### Desktop app owns
+
+- local UI state
+- navigation and presentation state
+- drafts, filters, and transient client-side interaction state
+- cached/derived visible server and workspace state returned by the server
+- starting or connecting to server processes
+
+### Server owns
+
+- workspace reads
+- workspace writes
+- AI/session/task behavior
+- project/runtime inspection
+- skill, plugin, MCP, and config mutation
+- OpenCode integration and sidecar/runtime coordination
+- any other workspace-scoped capability that is more than transient UI state
+
+This boundary applies even in desktop-hosted mode. Running on the same machine does not make the UI the right owner of workspace behavior.
+
+The same principle applies to the orchestrator boundary:
+
+- product/runtime control surfaces should move into the server
+- bootstrap and supervision should also move into the server wherever practical
+- the desktop shell should ideally launch one server process, not a separate runtime manager
+
+## Server Layout
+
+Proposed package layout inside `apps/server-v2`:
+
+```text
+apps/server-v2/
+├── src/
+│   ├── app.ts
+│   ├── cli.ts
+│   ├── bootstrap/
+│   ├── database/
+│   ├── context/
+│   ├── middleware/
+│   ├── routes/
+│   ├── services/
+│   ├── schemas/
+│   └── adapters/
+├── openapi/
+└── scripts/
+```
+
+### Ownership
+
+- `app.ts` builds the Hono app and mounts route groups.
+- `bootstrap/` owns server startup plus any runtime supervision that gets folded into the server.
+- `database/` owns sqlite state, migrations, and persistence boundaries.
+- `routes/` owns HTTP concerns: method, path, validation, response shape.
+- `services/` owns domain workflows.
+- `schemas/` owns request/response definitions.
+- `adapters/` owns integration with OpenCode, storage, and runtime pieces.
+- `middleware/` owns cross-cutting HTTP concerns.
+- `context/` owns per-request wiring and shared typed context.
+
+## Runtime Supervision Inside The New Server
+
+The new server should not just proxy product logic. It should also supervise the local runtime pieces it depends on.
+
+That includes:
+
+- OpenCode
+- `opencode-router`
+- any other local child runtime needed for the product surface
+
+### Router supervision model
+
+Current baseline being replaced:
+
+- orchestrator decides whether router is enabled
+- orchestrator resolves the router binary
+- orchestrator spawns and supervises the router
+
+Target model:
+
+- server bootstrap decides whether router is enabled
+- server bootstrap resolves the router binary
+- server bootstrap spawns and supervises the router
+- server API exposes router status/control behavior to the UI
+
+Recommended shape:
+
+- one `opencode-router` child per local OpenWork server
+- server-owned router config materialization from sqlite or server-managed config state
+- server-owned health checks, restart behavior, and status reporting
+
+This keeps router lifecycle under the same ownership boundary as the rest of the runtime.
+
+### Why one router per server
+
+- identities and bindings are naturally server-level
+- supervision is simpler
+- workspace scoping can still be enforced by server logic
+- the UI does not need to understand a second runtime graph
+
+## Startup Strategy
+
+The desktop app should eventually launch the new server directly.
+
+Target shape:
+
+```text
+desktop app
+-> launches apps/server-v2
+-> talks only to the new server process
+```
+
+Rules:
+
+- the new server should not be designed as a mounted sub-application of the old server
+- startup/bootstrap should move into the new server package over time
+- orchestrator control-plane routes should be replaced by main-server routes rather than preserved as a second API model
+
+## Typed Contract Flow
+
+The new server is the source of truth for its contract.
+
+```text
+Hono route + schema definitions
+-> generated OpenAPI spec
+-> generated TypeScript SDK
+-> app-side createSdk(serverId) adapter
+-> app features
+```
+
+### Why this flow
+
+- The server owns the contract.
+- The SDK stays in sync through generation.
+- App code gets strong typing without importing server implementation.
+- A tiny app-side adapter remains free to handle runtime-specific decisions without replacing the generated SDK.
+- The app can stay thin because the contract surface represents real workspace capabilities, not just transport helpers.
+
+## OpenAPI and SDK Generation
+
+Detailed generator and script choices live in `prds/server-v2-plan/sdk-generation.md`.
+
+Proposed structure:
+
+```text
+apps/server-v2/openapi/openapi.json
+packages/openwork-server-sdk/generated/**
+packages/openwork-server-sdk/src/index.ts
+apps/app/.../createSdk({ serverId }) adapter
+```
+
+### Contract rules
+
+- The OpenAPI spec is generated, not handwritten.
+- `hono-openapi` is the leading candidate for generating the new server OpenAPI spec because it is Hono-native and fits the route-first model we want.
+- The generated SDK is TypeScript-first.
+- The SDK should expose stable exports from `src/index.ts`.
+- The app should avoid importing raw generated files directly.
+- The generated SDK package should stay server-agnostic and reusable.
+- The app-facing entrypoint should look like `createSdk({ serverId })`.
+- `createSdk({ serverId })` should live in app code, resolve `serverId` into base URL, token, and capabilities locally, then prepare the generated client.
+- `createSdk({ serverId })` should stay lightweight enough that it can be called per use without meaningful overhead.
+- The SDK surface should grow until app-owned workspace behavior shrinks to near zero.
+
+`hono-openapi` should be treated as the spec-generation layer only:
+
+- it generates the OpenAPI contract from Hono routes and schemas
+- a separate SDK generator still produces the TypeScript client package
+- SSE ergonomics still likely require small handwritten helpers
+
+### App-facing SDK shape
+
+Preferred usage for standard endpoints:
+
+```ts
+await createSdk({ serverId }).sessions.listMessages({ workspaceId, sessionId })
+```
+
+This keeps:
+
+- server selection explicit through `serverId`
+- resource hierarchy explicit through params like `workspaceId` and `sessionId`
+- the client surface mostly generated rather than manually re-modeled
+
+### SSE contract note
+
+OpenAPI can document SSE endpoints, but most generated SDKs do not produce an ergonomic typed streaming API automatically.
+
+Because of that:
+
+- normal JSON endpoints should come directly from the generated SDK
+- the likely one or two SSE endpoints may need small handwritten stream helpers
+- those helpers should still be exported from the same SDK package
+- event payload types should come from generated or shared contract output, not from server source files
+
+### CI rules
+
+CI should regenerate both the OpenAPI spec and the SDK and fail if a diff appears.
+
+That gives us:
+
+- no silent contract drift
+- reproducible SDK output
+- reliable local and CI behavior
+
+## Local Development Loop
+
+The local developer experience should make contract changes visible immediately.
+
+Detailed local watch and rebuild behavior lives in `prds/server-v2-plan/local-dev.md`.
+
+Desired loop:
+
+```text
+edit new-server route or schema
+-> regenerate openapi/openapi.json
+-> regenerate TypeScript SDK
+-> app sees updated types and methods
+-> continue coding without manual sync work
+```
+
+Recommended watch pipeline:
+
+- `apps/server-v2`: watch `src/**`, regenerate `openapi/openapi.json` through `hono-openapi`
+- `packages/openwork-server-sdk`: watch `openapi/openapi.json`, regenerate the reusable generated client package
+- `apps/app`: watch the app-side `createSdk({ serverId })` adapter alongside normal app code
+- `packages/openwork-server-sdk`: optional watch build if the package publishes built output
+- `apps/app`: consumes the workspace package directly
+
+This should keep endpoint changes and client types effectively live in monorepo development.
+
+The server runtime watcher should ignore generated OpenAPI and SDK files so contract regeneration does not cause unnecessary backend restart loops.
+
+## Client Architecture
+
+The client side should use a thin adapter over the generated SDK rather than a large custom wrapper hierarchy.
+
+```text
+generated SDK
+-> createSdk({ serverId }) adapter
+-> app features
+```
+
+### Generated SDK responsibilities
+
+- typed request and response shapes
+- typed route methods
+- low-level transport helpers
+- representing server-owned workspace capabilities in a reusable client surface
+
+### Thin adapter responsibilities
+
+- resolve `serverId` into current server config
+- inject auth/token headers
+- during migration, route features to the current or new server when needed
+- prepare a lightweight client instance
+- add capability checks when needed
+
+The adapter should not rebuild a second large API model on top of the generated SDK unless there is a strong reason.
+
+It also should not become a place where workspace behavior is reimplemented in the app.
+
+## Multi-Server Target Model
+
+The system may know about different server destinations at the same time, so target selection must be explicit.
+
+The important distinction is:
+
+- a server target identifies which server to talk to
+- a workspace ID identifies which workspace on that server to operate on
+
+Those are related, but they are not the same thing.
+
+The local OpenWork server should maintain the durable registry of servers and workspaces. The app should render or cache what the server returns.
+
+That model is intentionally minimal. The app only needs enough local state to know:
+
+- which servers exist
+- which workspaces belong to which server
+- which workspace is selected in the UI
+
+It should not need to locally own the underlying workspace behavior itself.
+
+That allows:
+
+- multiple workspaces on one server
+- multiple configured servers in one app session
+- one SDK creation point per server target, with workspace IDs passed into individual operations when direct server targeting is needed
+
+Examples:
+
+- local desktop-hosted OpenWork server
+- remote worker-backed OpenWork server
+- hosted OpenWork Cloud server
+
+Proposed shared shape:
+
+```ts
+export type ServerTargetKind = "local" | "remote"
+
+export type ServerHostingKind = "desktop" | "self_hosted" | "cloud"
+
+export type ServerTarget = {
+  kind: ServerTargetKind
+  hostingKind: ServerHostingKind
+  baseUrl: string
+  token?: string
+  capabilities?: {
+    v2?: boolean
+  }
+}
+```
+
+Preferred app-facing creation during migration or server-management flows:
+
+```ts
+const sdk = createSdk({ serverId })
+```
+
+Then operations should take the workspace ID explicitly:
+
+```ts
+await sdk.sessions.list({ workspaceId })
+await sdk.sessions.get({ workspaceId, sessionId })
+await sdk.sessions.listMessages({ workspaceId, sessionId })
+```
+
+Illustrative app-side model:
+
+```ts
+type WorkspaceRecord = {
+  id: string
+  serverTargetId: string
+}
+```
+
+In that model:
+
+- `serverTargetId` tells the app which server configuration to use
+- `id` is the stable OpenWork workspace identifier the UI uses
+
+This avoids hidden globals and makes mixed-target flows possible while keeping server selection separate from workspace identity.
+
+In the ideal steady state, normal app traffic should still flow through the local OpenWork server using stable OpenWork workspace IDs, with remote OpenWork workspace IDs and OpenCode project IDs remaining server-owned mappings.
+
+## Migration Routing Model
+
+During migration, the adapter may choose between the current and new server per operation.
+
+Example decision inputs:
+
+- does the target advertise new-server capability?
+- is the feature enabled for the new server?
+- has this specific endpoint been ported?
+- do we need a temporary fallback?
+
+Illustrative flow:
+
+```text
+feature resolves workspace -> server target
+-> feature calls createSdk({ serverId }).sessions.list({ workspaceId })
+-> adapter inspects target + capability + rollout settings
+-> adapter calls the current or new server implementation
+-> feature receives typed result
+```
+
+This keeps migration logic out of the UI.
+
+The more of the product surface we move behind the server, the less special-case behavior the app needs to keep locally.
+
+## Streaming Strategy
+
+The app should consume OpenCode-related streaming only through the OpenWork server.
+
+That means:
+
+- the desktop app never connects directly to underlying OpenCode SSE endpoints
+- the new server exposes its own SSE endpoints where needed
+- the new server can proxy, translate, or normalize underlying OpenCode stream events
+
+Because there will likely be only one or two SSE endpoints, we do not need a large custom streaming framework.
+
+Recommended shape:
+
+- document the SSE routes in the new server contract
+- keep event payloads typed from generated or shared contract types
+- expose small handwritten streaming helpers from `packages/openwork-server-sdk`
+- keep those helpers under the same `createSdk({ serverId })` entrypoint
+
+Illustrative usage:
+
+```ts
+const stream = await createSdk({ serverId }).sessions.streamMessages({
+  workspaceId,
+  sessionId,
+})
+
+for await (const event of stream) {
+  // typed SSE event
+}
+```
+
+This gives us one unified client surface while accepting that OpenAPI generation alone is usually not enough for ergonomic typed SSE consumption.
+
+## Domain Slice Migration
+
+The preferred migration unit is a vertical slice.
+
+Example order:
+
+1. health and diagnostics
+2. low-risk read endpoints
+3. session reads
+4. workspace reads
+5. mutations
+6. higher-risk workflow endpoints
+
+Rules:
+
+- migrate one slice fully enough to validate the pattern
+- switch that slice's adapter routing to the new server
+- remove app-owned workspace logic for that slice when the new server version is ready
+- remove old-server code when the slice no longer needs it
+
+Example categories to move behind the server over time:
+
+1. workspace file reads and writes
+2. workspace config mutation
+3. skill/plugin/MCP mutation
+4. project/runtime inspection
+5. session/task execution behavior
+6. orchestrator workspace/runtime control APIs
+7. orchestrator-managed tool/config mutation behavior
+
+## Orchestrator Integration Path
+
+The recommended path is to collapse orchestrator responsibilities inward rather than preserve a separate orchestrator control plane forever.
+
+### What should move into the server
+
+- workspace activation and disposal semantics
+- runtime control/status/upgrade product APIs
+- daemon-style workspace/runtime control surfaces
+- config/skill/plugin/MCP mutation product capabilities
+- managed OpenCode integration behavior that clients should consume through one API
+- child process launch and supervision where practical
+- sidecar and binary resolution where practical
+- local env/port/bootstrap setup where practical
+- sandbox/container startup orchestration where practical
+
+### Recommended migration shape
+
+```text
+today:
+desktop -> orchestrator API -> server API
+
+target:
+desktop -> server API
+desktop -> launches one server process
+server -> starts and supervises local children when needed
+```
+
+This removes the separate orchestrator boundary rather than preserving it as a second permanent host layer.
+
+## Error and Compatibility Model
+
+The new server should improve consistency instead of repeating legacy inconsistencies.
+
+Targets:
+
+- consistent error envelopes
+- predictable auth failures
+- stable response schemas
+- request IDs for tracing
+- typed success and error bodies where practical
+
+During migration, the adapter may need to normalize old-server and new-server responses into one app-facing shape.
+
+## Testing Strategy
+
+We need confidence at three levels.
+
+### 1. Contract tests
+
+- route validation works
+- response schemas match expectations
+- generated SDK matches current spec
+
+### 2. Server integration tests
+
+- new-server routes hit real service/adapters
+- auth and runtime context behave correctly
+- the new server works correctly as its own process and API surface
+
+### 3. App integration tests
+
+- the SDK adapter calls the correct target
+- adapter-based old-server/new-server switching works during migration
+- desktop flows continue to work while slices are migrated
+
+## Exit Criteria for the Old Server
+
+We can remove the old server when:
+
+- all app consumers use new-server-backed SDK calls
+- no routes still require the old server
+- compatibility shims are no longer needed
+- desktop startup launches only the new server
+
+At that point, Server V2 stops being a migration concept and becomes the server.
+
+The same spirit applies to the client boundary:
+
+- the app still owns local UI state
+- but workspace capabilities should no longer be split between app and server
+- the server should be the clear owner of workspace behavior
+
+The same spirit also applies to the orchestrator boundary:
+
+- runtime/workspace product capability should no longer be split between orchestrator and server
+- bootstrap and supervision should also collapse into the server wherever possible
+- the main server should be the canonical and primary runtime control surface
+
+## Open Decisions
+
+- whether capability detection is static, dynamic, or both
+- which endpoint group becomes the first proof-of-path migration
+- whether the working name `openwork-server-v2` survives to ship time or is renamed before release
diff --git a/prds/server-v2-plan/current-server-audit.md b/prds/server-v2-plan/current-server-audit.md
new file mode 100644
index 0000000000..34673bd262
--- /dev/null
+++ b/prds/server-v2-plan/current-server-audit.md
@@ -0,0 +1,474 @@
+# Current Server Audit
+
+## Scope
+
+This audit covers the current server under `apps/server/**`.
+
+The goal is to document the current server in the same framework as the other audits:
+
+- what the major function/module is
+- what it does in human-readable language
+- where it is called from and when
+- what it ultimately calls or affects
+
+This is meant to help break down the current server into clear migration targets for the new server.
+
+## Overall Shape
+
+- The current server is still a Bun-first, custom-router server centered in `apps/server/src/server.ts`.
+- Most meaningful behavior is implemented through one large route-registration function, `createRoutes`, plus focused modules for config mutation, OpenCode integration, auth/tokens, reload/watch behavior, portable export/import, and OpenCode Router bridging.
+- The earlier in-place `/v2` scaffold under `apps/server/src/v2` has been removed. The real replacement server now lives separately under `apps/server-v2/**`.
+
+## 1. Startup, CLI, Config, And Process Boot
+
+### `src/cli.ts` main entrypoint
+
+- What it is: the packaged/server CLI entrypoint.
+- What it does: parses startup args, resolves runtime config, starts the server, and prints startup information.
+- Called from and when: called when the `openwork-server` binary or `bun src/cli.ts` is launched.
+- What it calls: `parseCliArgs`, `resolveServerConfig`, `createServerLogger`, and `startServer`.
+
+### `parseCliArgs`
+
+- What it is: CLI argument parser.
+- What it does: turns command-line flags into normalized runtime options.
+- Called from and when: called immediately at process startup.
+- What it calls: feeds `resolveServerConfig` with host/port/token/workspace/OpenCode/logging overrides.
+
+### `resolveServerConfig`
+
+- What it is: config resolution pipeline.
+- What it does: merges CLI args, env vars, and config file state into the final runtime config.
+- Called from and when: called once during boot before the server starts.
+- What it calls: `buildWorkspaceInfos`, token defaults, approval/cors/logging/read-only/authorized-roots setup.
+
+### `buildWorkspaceInfos`
+
+- What it is: workspace config normalizer.
+- What it does: turns configured workspace records into normalized `WorkspaceInfo` objects with stable IDs.
+- Called from and when: called while building the final server config.
+- What it calls: produces the workspace metadata used by routing, auth, proxying, export/import, and runtime flows.
+
+### `createServerLogger`
+
+- What it is: server logging factory.
+- What it does: creates either plain text or OTEL-style JSON logging with a run ID.
+- Called from and when: called during startup and reused for request logging.
+- What it calls: all startup, request, and reload-watcher logs.
+
+### `startServer`
+
+- What it is: main server boot function.
+- What it does: initializes approvals, reload events, tokens, watchers, route registration, and starts Bun HTTP serving.
+- Called from and when: called once after config resolution.
+- What it calls: Bun `serve`, `ApprovalService`, `TokenService`, `ReloadEventStore`, `startReloadWatchers`, proxy behavior, and all legacy routes.
+
+## 2. HTTP Routing And Request Dispatch
+
+### `startServer(...).fetch`
+
+- What it is: the top-level Bun request handler.
+- What it does: handles every incoming request, applies CORS and request logging, routes mounted workspace paths, proxies OpenCode/OpenCode Router requests, and finally dispatches to legacy routes.
+- Called from and when: called by Bun for every HTTP request.
+- What it calls: `parseWorkspaceMount`, OpenCode proxy helpers, OpenCode Router proxy helpers, and `createRoutes` matches.
+
+### `parseWorkspaceMount`
+
+- What it is: mounted-workspace path parser.
+- What it does: detects workspace-mounted URLs like `/w/:id/...`.
+- Called from and when: called early in request dispatch.
+- What it calls: enables single-workspace mounted base URL behavior.
+
+### `createRoutes`
+
+- What it is: the current legacy route registration map.
+- What it does: defines the bulk of the server API surface: status, tokens, workspaces, config, sessions, router, files, skills, plugins, MCP, export/import, approvals, and more.
+- Called from and when: called once at startup.
+- What it calls: nearly every major subsystem in the current server.
+
+### `withCors`
+
+- What it is: response header helper.
+- What it does: adds CORS headers based on configured allowlist.
+- Called from and when: applied to every response in the dispatcher finalization path.
+- What it calls: browser access policy for the server surface.
+
+### `logRequest`
+
+- What it is: per-request log helper.
+- What it does: emits structured request logs with auth/proxy metadata.
+- Called from and when: called after each request resolves or fails.
+- What it calls: operational visibility into status/auth/proxy usage.
+
+## 3. Auth, Tokens, And Approvals
+
+### `TokenService`
+
+- What it is: persisted scoped-token manager.
+- What it does: manages bearer tokens with scopes like owner, collaborator, and viewer.
+- Called from and when: instantiated at startup and used by auth and token-management routes.
+- What it calls: reads and writes `tokens.json`, resolves token scope, issues and revokes tokens.
+
+### `requireClient`
+
+- What it is: client-auth guard.
+- What it does: authenticates normal client bearer tokens.
+- Called from and when: called by client-protected routes and proxy paths.
+- What it calls: token resolution and `Actor` creation.
+
+### `requireHost`
+
+- What it is: host/admin auth guard.
+- What it does: authenticates host token or owner bearer token.
+- Called from and when: called by host-only routes like token management and approvals.
+- What it calls: elevated owner-level auth flows.
+
+### `requireClientScope`
+
+- What it is: scope enforcement helper.
+- What it does: enforces minimum client token scope for mutations.
+- Called from and when: called inside many write routes.
+- What it calls: permission failures for viewers or lower-scope actors.
+
+### `ApprovalService`
+
+- What it is: in-memory approval queue and responder.
+- What it does: stores pending approvals and resolves allow/deny/timeout outcomes.
+- Called from and when: instantiated at startup and used by approval-gated routes.
+- What it calls: mutation blocking until host/admin response.
+
+### `requireApproval`
+
+- What it is: approval wrapper.
+- What it does: enforces approval on sensitive writes.
+- Called from and when: called by config, file, plugin, skill, MCP, command, scheduler, and router identity writes.
+- What it calls: `ApprovalService`; throws `write_denied` on deny/timeout.
+
+### `/tokens` and `/approvals` routes
+
+- What they are: auth/approval control endpoints.
+- What they do: expose token inventory/issuance/revocation and pending approval inventory/response actions.
+- Called from and when: called by host/admin control UI or operator flows.
+- What they call: `TokenService` and `ApprovalService`.
+
+## 4. Workspace Lifecycle, Status, And Capabilities
+
+### `resolveWorkspace`
+
+- What it is: workspace lookup and validation helper.
+- What it does: resolves a workspace by ID, validates authorized-root membership, and repairs legacy commands if writable.
+- Called from and when: called by almost every workspace-scoped route.
+- What it calls: normalized `WorkspaceInfo` for all downstream file/config/OpenCode actions.
+
+### `/status` and `/workspaces`
+
+- What they are: core discovery/status routes.
+- What they do: expose server health, config summary, capabilities, and workspace inventory.
+- Called from and when: called by clients during connect, status refresh, and initial UI load.
+- What they call: workspace serialization, `buildCapabilities`, bind/auth/read-only summary state.
+
+### `buildCapabilities`
+
+- What it is: capability summarizer.
+- What it does: advertises what this server instance can do.
+- Called from and when: called by `/capabilities` routes.
+- What it calls: read-only mode, approvals, sandbox, browser provider, OpenCode/OpenCode Router availability.
+
+### `/workspaces/local`
+
+- What it is: local workspace creation route.
+- What it does: creates a new local workspace folder and seeds starter files.
+- Called from and when: called by host/admin workspace creation flows.
+- What it calls: `ensureWorkspaceFiles`, workspace config persistence, audit logging.
+
+### workspace rename / activate / delete routes
+
+- What they are: workspace management endpoints.
+- What they do: rename, activate, or remove a workspace from the server.
+- Called from and when: called by host/admin workspace-management UI.
+- What they call: in-memory config mutation, `server.json` persistence, reload watcher restart, audit logging.
+
+## 5. Workspace Bootstrapping And Local Config Files
+
+### `ensureWorkspaceFiles`
+
+- What it is: workspace seeding helper.
+- What it does: creates starter `.opencode` state, commands, skills, agent, `opencode.json`, and `openwork.json`.
+- Called from and when: called when creating a local workspace.
+- What it calls: OpenWork/OpenCode starter file generation.
+
+### `ensureOpencodeConfig`
+
+- What it is: OpenCode config seeder.
+- What it does: seeds `opencode.json` defaults, default agent, scheduler plugin, and starter MCP.
+- Called from and when: called during `ensureWorkspaceFiles`.
+- What it calls: first-run OpenCode behavior for the workspace.
+
+### `ensureWorkspaceOpenworkConfig`
+
+- What it is: OpenWork config seeder.
+- What it does: seeds `openwork.json` with authorized roots, blueprint sessions, and workspace metadata.
+- Called from and when: called during `ensureWorkspaceFiles`.
+- What it calls: OpenWork-specific workspace behavior and starter session metadata.
+
+### workspace config routes
+
+- What they are: config read/patch/raw text endpoints.
+- What they do: read or patch workspace `opencode` and `openwork` config, including raw OpenCode config editor flows.
+- Called from and when: called by settings/config UI.
+- What they call: JSONC mutation helpers, raw config file writes, reload events, and audit entries.
+
+## 6. OpenCode Integration And Session Read Model
+
+### `resolveWorkspaceOpencodeConnection`
+
+- What it is: OpenCode connection resolver.
+- What it does: resolves OpenCode base URL and optional Basic auth for a workspace.
+- Called from and when: called by OpenCode proxy and reload flows.
+- What it calls: upstream OpenCode connection parameters.
+
+### `proxyOpencodeRequest`
+
+- What it is: OpenCode reverse proxy.
+- What it does: forwards `/opencode` traffic to upstream OpenCode while injecting workspace directory and upstream auth.
+- Called from and when: called by the main dispatcher for `/opencode` and mounted equivalents.
+- What it calls: upstream OpenCode HTTP endpoints.
+
+### `reloadOpencodeEngine`
+
+- What it is: engine reload helper.
+- What it does: calls OpenCode `/instance/dispose` to force an engine reload.
+- Called from and when: called by `/workspace/:id/engine/reload`.
+- What it calls: upstream OpenCode instance reset.
+
+### session routes and `session-read-model.ts`
+
+- What they are: session list/detail/messages/snapshot routes plus normalization helpers.
+- What they do: fetch session data from OpenCode and validate/normalize the payloads.
+- Called from and when: called by session UI/history surfaces.
+- What they call: `fetchOpencodeJson` and `buildSessionList`, `buildSession`, `buildSessionMessages`, `buildSessionSnapshot`.
+
+### `seedOpencodeSessionMessages`
+
+- What it is: direct OpenCode DB seeding helper.
+- What it does: inserts starter messages directly into the OpenCode SQLite DB for blueprint sessions.
+- Called from and when: used during starter-session materialization.
+- What it calls: direct OpenCode DB mutation.
+
+## 7. Reload/Watch Behavior
+
+### `startReloadWatchers`
+
+- What it is: workspace reload-watcher setup.
+- What it does: starts per-workspace watchers over root config files and `.opencode` trees.
+- Called from and when: called during `startServer`, restarted when workspaces change.
+- What it calls: `ReloadEventStore` with debounced reload signals.
+
+### `ReloadEventStore`
+
+- What it is: reload event queue.
+- What it does: stores debounced workspace-scoped reload events with cursors.
+- Called from and when: instantiated at startup, used by watchers and write routes.
+- What it calls: `/workspace/:id/events` polling responses.
+
+### `emitReloadEvent`
+
+- What it is: manual reload signal helper.
+- What it does: records reload signals after server-side mutations.
+- Called from and when: called after config/plugin/skill/MCP/command/import writes.
+- What it calls: client/runtime synchronization for server-caused file changes.
+
+### `/workspace/:id/events` and `/engine/reload`
+
+- What they are: reload polling and explicit engine-reload endpoints.
+- What they do: return reload events since a cursor, and explicitly reload the upstream OpenCode engine.
+- Called from and when: called by clients that need hot-reload awareness or manual engine reload.
+- What they call: `ReloadEventStore` and `reloadOpencodeEngine`.
+
+## 8. File Access, Inbox/Outbox, And Session-Scoped File Editing
+
+### `FileSessionStore`
+
+- What it is: ephemeral file-session manager.
+- What it does: tracks scoped file editing sessions and workspace file-event cursors.
+- Called from and when: instantiated inside `createRoutes`.
+- What it calls: write eligibility, TTL, ownership, and incremental file-event streams.
+
+### file session routes
+
+- What they are: scoped file catalog/read/write/ops endpoints.
+- What they do: create a file session, return a catalog snapshot, read files, write files with conflict detection, and apply mkdir/delete/rename ops.
+- Called from and when: called by editors and remote file-management tooling.
+- What they call: actual workspace filesystem reads/writes, file event logs, approvals, and audit logging.
+
+### simple content routes
+
+- What they are: markdown-oriented read/write routes.
+- What they do: provide simpler file content APIs for lighter document flows.
+- Called from and when: called by markdown/file editors.
+- What they call: actual workspace file reads/writes plus audit and file-event signaling.
+
+### inbox/outbox routes
+
+- What they are: file ingest and artifact download endpoints.
+- What they do: manage uploadable inbox files and downloadable artifact files under `.opencode/openwork`.
+- Called from and when: called by file injection/download flows.
+- What they call: workspace file writes, file listings, and binary download responses.
+
+## 9. Plugins, Skills, MCP, Commands, And Scheduler
+
+### plugin functions
+
+- What they are: `listPlugins`, `addPlugin`, `removePlugin`.
+- What they do: expose and mutate OpenCode plugin config and plugin directories.
+- Called from and when: called by `/workspace/:id/plugins` routes.
+- What they call: `opencode.json` mutation, plugin discovery, reload events.
+
+### skill functions
+
+- What they are: `listSkills`, `upsertSkill`, `deleteSkill`, plus Skill Hub helpers.
+- What they do: discover and manage local/global skills, and install remote GitHub-backed skills.
+- Called from and when: called by `/workspace/:id/skills*` routes and workspace bootstrap flows.
+- What they call: `.opencode/skills` reads/writes, GitHub fetches, reload events.
+
+### MCP functions
+
+- What they are: `listMcp`, `addMcp`, `removeMcp`.
+- What they do: manage MCP server config in `opencode.json`.
+- Called from and when: called by `/workspace/:id/mcp*` routes.
+- What they call: MCP config mutation and tool availability changes.
+
+### command functions
+
+- What they are: `listCommands`, `upsertCommand`, `deleteCommand`, `repairCommands`.
+- What they do: manage project/global command markdown files and repair legacy frontmatter.
+- Called from and when: called by `/workspace/:id/commands*` and implicitly by `resolveWorkspace`.
+- What they call: `.opencode/commands` writes, frontmatter repair, reload events.
+
+### scheduler functions
+
+- What they are: scheduler job inspection/removal helpers.
+- What they do: inspect and delete scheduled jobs backed by launchd/systemd and JSON job files.
+- Called from and when: called by `/workspace/:id/scheduler/jobs*` routes.
+- What they call: job file deletion and OS scheduler unload/remove behavior.
+
+## 10. OpenCode Router / Messaging Integration
+
+### `resolveOpenCodeRouterProxyPolicy`
+
+- What it is: OpenCode Router auth policy resolver.
+- What it does: decides what auth and scope is required for router proxy paths.
+- Called from and when: called by the main dispatcher for `/opencode-router` paths.
+- What it calls: access control for bindings, identities, health, and other router APIs.
+
+### `proxyOpenCodeRouterRequest`
+
+- What it is: OpenCode Router reverse proxy.
+- What it does: forwards raw OpenCode Router requests to the local router service.
+- Called from and when: called for `/opencode-router` and mounted equivalents.
+- What it calls: localhost OpenCode Router health/config/send endpoints.
+
+### router identity persistence helpers
+
+- What they are: Telegram/Slack identity config writers.
+- What they do: persist messaging identity config into `opencode-router.json`.
+- Called from and when: called by workspace router-management routes.
+- What they call: local router config mutation while preserving legacy fallback fields.
+
+### `tryPostOpenCodeRouterHealth` / `tryFetchOpenCodeRouterHealth`
+
+- What they are: best-effort router apply/fetch helpers.
+- What they do: apply or fetch router health/config state without requiring a restart.
+- Called from and when: called after router config changes and health/bind/send flows.
+- What they call: live router process control/status behavior.
+
+### workspace router routes
+
+- What they are: `/workspace/:id/opencode-router/*` routes.
+- What they do: manage health, Telegram/Slack setup, identities, bindings, and outbound sends.
+- Called from and when: called by messaging/connectors UI.
+- What they call: router config files, live router process state, identity pairing state, and outbound routing behavior.
+
+## 11. Portable Export/Import And Sharing
+
+### `exportWorkspace`
+
+- What it is: portable workspace export builder.
+- What it does: builds a portable workspace bundle including config, skills, commands, and allowed portable files.
+- Called from and when: called by `/workspace/:id/export`.
+- What it calls: workspace reads, config sanitization, portable file planning, and sensitive-data warnings.
+
+### `importWorkspace`
+
+- What it is: portable workspace import applier.
+- What it does: applies imported bundle data into a workspace in replace or merge mode.
+- Called from and when: called by `/workspace/:id/import`.
+- What it calls: config writes, skills/commands writes, portable file writes, reload events.
+
+### portable config and file helpers
+
+- What they are: `sanitizePortableOpencodeConfig`, `planPortableFiles`, `listPortableFiles`, `writePortableFiles`, export-safety helpers.
+- What they do: restrict export/import to portable config/files and detect or strip sensitive data.
+- Called from and when: called by export/import flows.
+- What they call: safe config/file selection and secret-aware export behavior.
+
+### shared bundle publishing/fetching
+
+- What they are: `publishSharedBundle`, `fetchSharedBundle`.
+- What they do: publish and fetch named bundle payloads via a trusted OpenWork publisher.
+- Called from and when: called by `/share/bundles/publish` and `/share/bundles/fetch`.
+- What they call: remote publisher services and trusted-origin bundle fetch behavior.
+
+## 12. Audit Trail And Blueprint Session Materialization
+
+### audit functions
+
+- What they are: `recordAudit`, `readAuditEntries`, `readLastAudit`.
+- What they do: append and read per-workspace JSONL audit logs.
+- Called from and when: called after most mutation flows and by `/workspace/:id/audit`.
+- What they call: audit persistence under OpenWork data directories.
+
+### blueprint session helpers
+
+- What they are: blueprint template normalization/materialization helpers.
+- What they do: parse starter-session templates from `openwork.json`, track what was already materialized, create OpenCode sessions, and seed starter messages.
+- Called from and when: called by blueprint/session materialization routes and workspace bootstrap flows.
+- What they call: upstream OpenCode session creation, direct OpenCode DB seeding, and `openwork.json` updates.
+
+## 13. Runtime Control And Operational Endpoints
+
+### `/health` and related status routes
+
+- What they are: health and operational summary endpoints.
+- What they do: report reachability, uptime, actor identity, runtime status, and toy UI/debug support.
+- Called from and when: called by probes, status pages, and manual operator/debug flows.
+- What they call: server uptime/version state, auth resolution, runtime control service, and toy UI assets.
+
+### `/runtime/versions` and `/runtime/upgrade`
+
+- What they are: runtime-control proxy endpoints.
+- What they do: proxy runtime version and upgrade behavior. These are the legacy current-server route names; the Server V2 plan normalizes equivalent server-wide runtime endpoints under `/system/runtime/*`.
+- Called from and when: called by upgrade/admin flows.
+- What they call: `fetchRuntimeControl` and the configured runtime control base URL.
+
+### `fetchRuntimeControl`
+
+- What it is: runtime control HTTP client.
+- What it does: calls the configured runtime control base URL with bearer auth.
+- Called from and when: called by runtime version/upgrade routes.
+- What it calls: external runtime control plane.
+
+## Key Takeaways
+
+- The current server is dominated by one large orchestration file, `apps/server/src/server.ts`, with many meaningful domains hanging off it.
+- The best decomposition candidates for the new server are:
+  - startup/config/runtime wiring
+  - auth/tokens/approvals
+  - workspace lifecycle/config
+  - OpenCode proxy + session read model
+  - file session API
+  - OpenCode Router integrations
+  - portable export/import + sharing
+  - plugins/skills/MCP/commands/scheduler
+- The strongest existing seams are service-style modules such as `TokenService`, `ApprovalService`, `ReloadEventStore`, `FileSessionStore`, `session-read-model.ts`, `portable-files.ts`, `workspace-export-safety.ts`, and `skill-hub.ts`.
+- The weakest area is route ownership: many domains still terminate directly inside `createRoutes` instead of domain routers/controllers.
diff --git a/prds/server-v2-plan/distribution.md b/prds/server-v2-plan/distribution.md
new file mode 100644
index 0000000000..10d7e75b50
--- /dev/null
+++ b/prds/server-v2-plan/distribution.md
@@ -0,0 +1,614 @@
+# Server V2 Distribution
+
+## Status: Draft
+## Date: 2026-04-13
+
+## Purpose
+
+This document defines the preferred distribution model for the new OpenWork server.
+
+It covers:
+
+- how the new server should be built
+- how `opencode` and `opencode-router` should be packaged
+- how the desktop app should bundle the server
+- how standalone server users should install and run it
+
+## Core Distribution Goal
+
+We want one canonical server runtime per platform.
+
+That server runtime should:
+
+- be the same thing the desktop app bundles
+- also be shippable as a standalone server download
+- include the matching OpenCode and OpenCode Router sidecars
+
+## Recommended Build Model
+
+Recommended implementation/runtime choice:
+
+- implement `apps/server-v2` in TypeScript
+- run it with Bun in development
+- compile it with Bun for distribution
+
+Recommended packaging choice:
+
+- one compiled server executable per target platform
+- embed `opencode` and `opencode-router` into that executable
+- extract those sidecars into a managed runtime directory on first run
+- launch them from there
+
+This gives us a single-file-per-platform distribution model without needing a second wrapper executable, unless Bun packaging proves insufficient in practice.
+
+## Why Bun Changes The Packaging Story
+
+Bun's `--compile` support gives us a much stronger path than a normal JS runtime build.
+
+Important capabilities:
+
+- compile TypeScript into a standalone executable
+- cross-compile for other platforms
+- embed arbitrary files with `with { type: "file" }`
+- embed build-time constants
+- produce minified and bytecode-compiled binaries for faster startup
+
+That means the new server can likely:
+
+- be built as a Bun-compiled executable
+- carry embedded sidecar payloads
+- self-extract those payloads on startup
+
+## Target Distribution Shape
+
+Per platform, the canonical runtime should be:
+
+- `openwork-server-v2`
+  - compiled Bun executable
+  - embedded `opencode`
+  - embedded `opencode-router`
+  - embedded release/runtime manifest
+
+One artifact per platform, for example:
+
+- `openwork-server-v2-darwin-arm64`
+- `openwork-server-v2-darwin-x64`
+- `openwork-server-v2-linux-x64`
+- `openwork-server-v2-linux-arm64`
+- `openwork-server-v2-windows-x64.exe`
+
+## Desktop Distribution
+
+Desktop users download the desktop app.
+
+The desktop app should:
+
+- ship with the matching `openwork-server-v2` runtime embedded or bundled as an app resource
+- launch only that server
+- never directly launch `opencode` or `opencode-router`
+
+At runtime:
+
+1. Desktop app launches `openwork-server-v2`.
+2. `openwork-server-v2` checks its managed runtime directory.
+3. If needed, it extracts embedded `opencode` and `opencode-router`.
+4. It starts and supervises those sidecars itself.
+5. Desktop app talks only to the server over port + token.
+
+## Standalone Server Distribution
+
+Some users will want only the server.
+
+For them, we should publish the same canonical runtime as a standalone download.
+
+That means:
+
+- standalone users download `openwork-server-v2` for their platform
+- they run it directly
+- it performs the same sidecar extraction and supervision the desktop-bundled copy would do
+
+This keeps the runtime identical between:
+
+- desktop-hosted use
+- standalone server use
+
+## Runtime Extraction Model
+
+The server executable should embed sidecar payloads and extract them to a persistent versioned runtime directory.
+
+Current implementation note:
+
+- Phase 10 now treats the managed app-data runtime directory as the canonical release runtime location.
+- The release runtime is populated on first run from a bundled runtime source directory (for example the desktop resource sidecar directory or an executable-adjacent bundle with `manifest.json`) and is then reused across later runs.
+- `apps/server-v2/script/build.ts` now also supports `--embed-runtime`, which generates a temporary build entrypoint that embeds `opencode`, `opencode-router`, and `manifest.json` directly into the compiled Server V2 binary via Bun `with { type: "file" }` imports.
+- Extraction now uses a lock, temp directory, atomic replace, lease file, and conservative cleanup of stale runtime directories.
+- The standalone embedded artifact can now boot without an adjacent sidecar bundle: when no filesystem bundle is present, Server V2 falls back to the embedded runtime payload and extracts from there.
+
+Recommended behavior:
+
+1. On startup, the server determines its runtime version.
+2. It computes a runtime directory under app-data.
+3. It checks whether the sidecars already exist and match the expected manifest/checksums.
+4. If not, it extracts them atomically.
+5. It marks executable bits where needed.
+6. It launches sidecars from that runtime directory.
+
+Recommended runtime path shape:
+
+```text
+<app-data>/runtime/server-v2/<server-version>/
+```
+
+Example contents:
+
+```text
+<app-data>/runtime/server-v2/0.1.0/
+  manifest.json
+  opencode
+  opencode-router
+```
+
+## Why Persistent Runtime Dir Instead Of Temp
+
+We should prefer a persistent runtime directory instead of temp.
+
+Reasons:
+
+- avoids repeated extraction on every run
+- avoids temp cleanup breaking the runtime
+- improves debuggability
+- makes versioned runtime upgrades simpler
+- makes locking and atomic replacement easier
+
+## Build Pipeline
+
+Recommended build flow:
+
+1. Build or collect the platform-specific `opencode` binary.
+2. Build or collect the platform-specific `opencode-router` binary.
+3. Generate a runtime manifest containing:
+   - server version
+   - OpenCode version
+   - router version
+   - target platform
+   - checksums
+4. Compile `apps/server-v2/src/cli.ts` with Bun.
+5. Embed the sidecars and manifest into the compiled executable.
+
+Illustrative Bun compile command:
+
+```bash
+bun build --compile --minify --bytecode --target=bun-darwin-arm64 ./src/cli.ts --outfile dist/openwork-server-v2
+```
+
+The exact build script will likely be JS-driven rather than a one-liner so it can:
+
+- prepare sidecar assets
+- generate the manifest
+- inject build-time constants
+- compile per target
+
+Current implementation note:
+
+- `pnpm --filter openwork-server-v2 build:bin` builds the plain compiled executable.
+- `pnpm --filter openwork-server-v2 build:bin:embedded --bundle-dir <runtime-bundle-dir>` builds the compiled executable with embedded runtime assets from a prepared bundle directory.
+- `pnpm --filter openwork-server-v2 build:bin:embedded:all` drives the same embedding flow across the supported Bun targets when target-specific runtime bundle files are staged.
+- The build script resolves target-specific asset filenames like `opencode-<triple>` and `manifest.json-<triple>` when cross-target bundles are staged.
+
+## Bun Embedding Model
+
+The preferred Bun packaging approach is:
+
+- embed sidecar files with `with { type: "file" }`
+- access them via Bun's embedded file support
+- copy them into the persistent runtime directory on first run
+
+This means we do not need a separate wrapper binary unless Bun's real-world behavior proves insufficient.
+
+## Cross-Platform Targets
+
+The server should be built in a matrix across supported targets.
+
+Initial likely targets:
+
+- `bun-darwin-arm64`
+- `bun-darwin-x64`
+- `bun-linux-x64`
+- `bun-linux-arm64`
+- `bun-windows-x64`
+
+Possible later targets:
+
+- `bun-windows-arm64`
+- musl variants for portable Linux distribution
+
+For Linux x64, baseline builds may be safer if broad CPU compatibility matters.
+
+## Version Pinning
+
+Each server release should pin:
+
+- server version
+- OpenCode version
+- router version
+
+Recommended runtime manifest shape:
+
+```json
+{
+  "serverVersion": "0.1.0",
+  "opencodeVersion": "1.2.27",
+  "routerVersion": "0.1.0",
+  "target": "bun-darwin-arm64",
+  "files": {
+    "opencode": {
+      "sha256": "..."
+    },
+    "opencode-router": {
+      "sha256": "..."
+    }
+  }
+}
+```
+
+## Desktop Vs Standalone Release Model
+
+### Desktop release
+
+- desktop app contains the matching `openwork-server-v2` runtime
+- user launches app
+- app launches server
+
+### Standalone server release
+
+- user downloads `openwork-server-v2` for their platform
+- user launches server directly
+- server self-extracts sidecars and runs normally
+
+This gives us one runtime with two install channels.
+
+## Local Dev Asset Model
+
+Local development should preserve the same ownership model as production without requiring the final compiled single-file bundle on every edit.
+
+Recommended dev behavior:
+
+- run `apps/server-v2` directly with Bun in watch mode
+- keep `opencode-router` as a locally built workspace binary from `apps/opencode-router`
+- acquire `opencode` as a pinned release artifact rather than committing the binary into git
+- stage both binaries into a gitignored local runtime-assets directory
+- have Server V2 launch those staged binaries by absolute path
+
+The important rule is that development should still be deterministic:
+
+- no reliance on `PATH`
+- no silent use of whichever `opencode` binary happens to be installed globally
+- no checked-in release binaries under source control
+
+### Why `opencode` should not be committed into the repo
+
+We do not need the `opencode` binary checked into git.
+
+What we need is a reproducible acquisition path:
+
+- read the pinned version from `constants.json`
+- download the matching OpenCode release artifact for the current platform
+- store it in a gitignored local runtime-assets/cache location
+- use that exact file for local dev and for release embedding
+
+This keeps local dev aligned with the pinned product version while avoiding binary churn in the repo.
+
+### Source of truth for the pinned version
+
+The OpenCode version should come from the existing root `constants.json` file.
+
+For Server V2 planning, that means:
+
+- `constants.json` remains the version pin source of truth for `opencode`
+- local dev setup should read `opencodeVersion` from `constants.json`
+- release packaging should read the same value when embedding the final binary
+
+### Recommended local path shape
+
+Illustrative shape:
+
+```text
+<repo>/.local/runtime-assets/
+  opencode/
+    darwin-arm64/
+      v1.2.27/
+        opencode
+  opencode-router/
+    darwin-arm64/
+      dev/
+        opencode-router
+```
+
+Notes:
+
+- this directory should be gitignored
+- exact path names can change, but the shape should be versioned and platform-specific
+- `opencode-router` can use a `dev` slot because it is built from the local workspace during development
+- `opencode` should use the pinned version from `constants.json`
+
+### Recommended dev acquisition flow
+
+1. Read `opencodeVersion` from `constants.json`.
+2. Resolve the current platform/arch target.
+3. Check whether the pinned `opencode` binary already exists in the local runtime-assets cache.
+4. If not, download the matching OpenCode release artifact.
+5. Verify checksum if the release metadata supports it.
+6. Mark executable bits where needed.
+7. Build `apps/opencode-router` locally and place its binary in the staged dev runtime location.
+8. Start Server V2 and pass those absolute binary paths into runtime startup.
+
+### Dev vs release relationship
+
+The difference between dev and release should be only where the sidecar payloads come from:
+
+- release: sidecars are embedded into `openwork-server-v2` and extracted on first run
+- local dev: sidecars are staged into a gitignored local runtime-assets directory first
+
+The runtime ownership model should stay the same in both cases:
+
+- Server V2 resolves the binaries
+- Server V2 launches them
+- Server V2 supervises them
+
+## How This Differs From The Current System
+
+Today, runtime distribution is more fragmented.
+
+Current behavior is closer to:
+
+- desktop app bundles or prepares multiple sidecars
+- desktop/Tauri still owns more startup logic
+- orchestrator is a separate hosting/control layer
+- `openwork-server`, `opencode`, and `opencode-router` are not yet one canonical server runtime bundle
+
+Target behavior becomes:
+
+- desktop app starts one thing: `openwork-server-v2`
+- standalone users start that same `openwork-server-v2`
+- `openwork-server-v2` starts and supervises its own runtime dependencies
+
+So the key shift is:
+
+- from component distribution
+- to runtime-bundle distribution
+
+## Current Workflow Reality
+
+Based on the current repo workflows in this branch:
+
+- macOS notarization is explicitly configured
+- Windows signing now has an explicit repo workflow path in `.github/workflows/windows-signed-artifacts.yml`, but it still requires a real signing certificate and Windows validation run before broad rollout
+
+That means:
+
+- we should not assume we already have a working Windows signing pipeline
+- the new server distribution plan will need an explicit Windows signing step for both desktop and standalone runtime artifacts
+
+## Important Caveats
+
+This Bun-based single-file approach looks promising, but it still needs validation.
+
+### 1. Embedded binary extraction and execution
+
+We need to confirm that embedded sidecar binaries can be:
+
+- copied out reliably
+- marked executable reliably
+- launched reliably on all supported platforms
+
+### 2. macOS code signing and notarization
+
+This is especially important.
+
+We need to validate:
+
+- the compiled server's codesigning story
+- Bun JIT entitlements if needed
+- behavior of extracted sidecars under Gatekeeper/notarization
+
+Important practical note:
+
+- the main `openwork-server-v2` executable will need a clean signing and notarization path
+- extracted sidecars may also need to be signed appropriately if macOS quarantine or Gatekeeper treats them as separate executables
+- we should assume that "signed main binary" does not automatically make extracted child binaries a non-issue
+
+Questions to validate on macOS:
+
+- can the signed/notarized main server extract and launch sidecars without triggering new trust prompts?
+- do extracted sidecars need to preserve signatures from the embedded payloads?
+- do we need to strip quarantine attributes or will that create trust problems?
+- does Bun's compiled executable require specific JIT-related entitlements in our real deployment model?
+
+This means macOS is not just a packaging detail. It is one of the first things we should prototype before fully committing to the single-file distribution format.
+
+### 3. Windows AV / SmartScreen behavior
+
+Extracted executables may have more friction on Windows.
+
+We need to test:
+
+- first-run extraction
+- launch reliability
+- user-facing warnings
+
+Important practical note:
+
+- Windows Defender or third-party AV may treat a self-extracting executable plus child-process extraction as suspicious behavior
+- SmartScreen reputation may apply to the main executable separately from the extracted sidecars
+- repeated extraction into temp-like locations is more likely to look suspicious than extraction into a stable app-data runtime directory
+
+Questions to validate on Windows:
+
+- does first-run extraction trigger Defender or SmartScreen warnings?
+- are extracted sidecars quarantined, delayed, or scanned in ways that materially hurt startup time?
+- do signed extracted sidecars behave better than unsigned ones?
+- do we need to prefer a stable per-version runtime directory to avoid repeated AV scans and trust churn?
+
+This means Windows should also get an early prototype, especially for first-run startup latency and user-facing trust prompts.
+
+## Windows Signing Plan
+
+We should plan to sign Windows artifacts explicitly.
+
+That includes:
+
+- desktop app executable/installer
+- standalone `openwork-server-v2.exe`
+- extracted Windows sidecars when they are shipped as separate signed executables inside the embedded runtime bundle
+
+Recommended signing model:
+
+- use Authenticode signing at minimum
+- consider EV signing if SmartScreen reputation becomes a serious UX issue
+- timestamp signatures so they remain valid after certificate rotation or expiry
+
+Rule of thumb:
+
+- every Windows executable we intentionally ship to users should be signed
+
+That includes:
+
+- the desktop app executable and/or installer
+- `openwork-server-v2.exe`
+- `opencode.exe`
+- `opencode-router.exe`
+
+Important practical point:
+
+- signing only the main desktop executable is not enough for the server runtime model we want
+- if `openwork-server-v2.exe` extracts `opencode.exe` and `opencode-router.exe`, those sidecars should ideally also be signed before embedding
+
+## Suggested Windows Release Flow
+
+### Desktop release flow
+
+1. Build the Windows desktop artifact.
+2. Sign the desktop executable or installer.
+3. Verify the signature.
+4. Publish the signed asset.
+
+### Standalone server release flow
+
+1. Build `openwork-server-v2.exe` for Windows.
+2. Build or collect signed Windows `opencode.exe` and `opencode-router.exe` payloads.
+3. Embed those signed sidecar payloads into the server executable.
+4. Sign the final `openwork-server-v2.exe`.
+5. Verify the signature.
+6. Publish the signed asset.
+
+This means Windows signing happens at two layers:
+
+- sidecar payload signing
+- final runtime signing
+
+## GitHub Actions Sketch
+
+The repo does not currently show an explicit Windows signing step, so we should plan one.
+
+Illustrative shape:
+
+```yaml
+jobs:
+  build-windows-server-v2:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build server runtime
+        run: pnpm --filter openwork-server-v2 build:bin:windows
+
+      - name: Build or fetch Windows sidecars
+        run: pnpm --filter openwork-server-v2 build:sidecars:windows
+
+      - name: Import signing certificate
+        shell: pwsh
+        run: |
+          $bytes = [Convert]::FromBase64String("${{ secrets.WINDOWS_CERT_PFX_BASE64 }}")
+          [IO.File]::WriteAllBytes("codesign.pfx", $bytes)
+
+      - name: Sign sidecars
+        shell: pwsh
+        run: |
+          signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f codesign.pfx /p "${{ secrets.WINDOWS_CERT_PASSWORD }}" dist\\sidecars\\opencode.exe
+          signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f codesign.pfx /p "${{ secrets.WINDOWS_CERT_PASSWORD }}" dist\\sidecars\\opencode-router.exe
+
+      - name: Build embedded runtime
+        run: pnpm --filter openwork-server-v2 package:windows
+
+      - name: Sign final server runtime
+        shell: pwsh
+        run: |
+          signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f codesign.pfx /p "${{ secrets.WINDOWS_CERT_PASSWORD }}" dist\\openwork-server-v2.exe
+
+      - name: Verify signature
+        shell: pwsh
+        run: |
+          signtool verify /pa /v dist\\openwork-server-v2.exe
+```
+
+The desktop Windows job would follow the same pattern, but sign the desktop executable/installer artifact.
+
+## Secrets And Infrastructure Needed
+
+To support Windows signing in CI, we will likely need:
+
+- a Windows code signing certificate in PFX form
+- a password for that PFX
+- a timestamp server URL
+- possibly a separate EV signing process if we choose that route later
+
+Likely GitHub secrets:
+
+- `WINDOWS_CERT_PFX_BASE64`
+- `WINDOWS_CERT_PASSWORD`
+- `WINDOWS_TIMESTAMP_URL`
+
+## Recommendation
+
+For now, the important planning takeaway is:
+
+- Windows signing is not already clearly implemented in the repo workflows
+- we should treat it as a required new release capability for Server V2 distribution
+- both desktop and standalone server runtimes will need explicit Windows signing support
+
+### 4. Upgrade and extraction locking
+
+We need to design:
+
+- atomic extraction
+- concurrent launch locking
+- old runtime cleanup
+- rollback behavior if extraction is interrupted
+
+## Recommended Path
+
+Recommended sequence:
+
+1. Build the new server in Bun/TypeScript.
+2. Make the server own runtime supervision logically first.
+3. Prototype a multi-file per-platform build first if needed for speed.
+4. Then implement the Bun single-file embedded-sidecar distribution path.
+5. Use that same runtime artifact in both:
+   - desktop releases
+   - standalone server releases
+
+The long-term preferred model is still the Bun-based self-extracting single executable per platform.
+
+## Open Questions
+
+1. Should the extracted runtime directory be versioned only by server version, or by server+OpenCode+router tuple?
+2. What exact app-data path should we standardize on for desktop-hosted and standalone modes?
+3. How should old extracted runtimes be garbage-collected safely?
+4. Do we want to keep a multi-file fallback distribution format even after the single-file format works?
+5. What exact release pipeline should produce the platform sidecars before the Bun compile step?
diff --git a/prds/server-v2-plan/final-cutover-checklist.md b/prds/server-v2-plan/final-cutover-checklist.md
new file mode 100644
index 0000000000..d55a0602f3
--- /dev/null
+++ b/prds/server-v2-plan/final-cutover-checklist.md
@@ -0,0 +1,162 @@
+# Server V2 Final Cutover Checklist
+
+## Status
+
+In progress. This checklist is the honest Phase 10 cutover and release ledger for the current worktree state.
+
+## Default Path Checks
+
+- Desktop startup default: `Legacy`
+- App rollout default: legacy path unless `OPENWORK_UI_USE_SERVER_V2=1`
+- Runtime ownership default: Server V2 supervises OpenCode and router
+- Route mount: root-mounted (`/system/*`, `/workspaces/*`), no legacy `/v2`
+
+## Completed In Current Worktree
+
+- Composite local dev graph exists and is documented:
+  - `pnpm dev:server-v2`
+  - `pnpm dev:server-v2:server`
+- OpenAPI and SDK watch loops are hardened against replace-style writes and generator side effects.
+- Server V2 resolves a real package version instead of reporting `0.0.0`.
+- Bun compile build exists for Server V2.
+- Embedded runtime packaging exists via `apps/server-v2/script/build.ts --embed-runtime`.
+- Release runtime extraction uses a persistent versioned runtime directory with lock, atomic replace, lease tracking, and cleanup.
+- Desktop can bundle and start Server V2 when `OPENWORK_UI_USE_SERVER_V2=1` is enabled.
+- App can route through Server V2 when `OPENWORK_UI_USE_SERVER_V2=1` is enabled.
+- Windows signing workflow exists at `.github/workflows/windows-signed-artifacts.yml` for the standalone Server V2 binary, signed sidecars, and desktop Windows artifacts.
+
+## Remaining Release Gates
+
+- Delete legacy `apps/server` codepaths once no active caller needs them.
+- Delete or archive obsolete orchestrator control-plane code once no active caller needs it.
+- Commit or otherwise land the regenerated Server V2 contract so `pnpm contract:check` passes on a clean tree.
+- Validate macOS signing + notarization with real signed artifacts.
+- Validate Windows SmartScreen / Defender / AV behavior with real Windows artifacts.
+- Capture Chrome MCP success evidence once the Docker stack session flow is fixed.
+
+## Current Validation Status In This Environment
+
+- `pnpm sdk:generate` runs successfully.
+- `pnpm contract:check` still fails in this in-progress worktree because generated Phase 10 contract changes are not committed yet; it is acting as a drift detector against `HEAD`, not as a no-op generator check.
+- Server V2 package tests and typecheck pass.
+- App Server V2 boundary tests and app typecheck pass.
+- Desktop Rust tests pass.
+- Plain and embedded Server V2 Bun builds both pass.
+- Embedded standalone runtime smoke passed: the compiled Server V2 binary launched from outside the bundle directory extracted and started OpenCode from the managed runtime directory using `source: release`.
+- Docker dev stack now starts on the Server V2 path after moving the stack off orchestrator startup and serializing shared `pnpm install` work across containers.
+- Docker API-level smoke succeeded for `GET /system/health`, `GET /system/opencode/health`, and `GET /workspaces` against the running dev stack.
+- Docker product-flow API smoke now succeeds for `POST /workspaces/:id/sessions` after fixing Server V2 compatibility config materialization to emit the OpenCode-compatible `permission.external_directory` object-map format.
+- Chrome MCP validation is not runnable from this environment because the current tool session does not expose Chrome DevTools MCP actions.
+- macOS signing/notarization was not completed here because no signing identity or notary credentials are available in this session.
+- Windows signing workflow was implemented, but end-to-end signing and SmartScreen / AV validation were not completed here because no Windows runner or Windows signing certificate is available in this session.
+
+## Automated Validation Commands
+
+Run from repo root unless noted.
+
+```bash
+pnpm sdk:generate
+pnpm contract:check
+pnpm --filter openwork-server-v2 test
+pnpm --filter openwork-server-v2 typecheck
+pnpm --filter @openwork/app test:server-v2-boundary
+pnpm --filter @openwork/app typecheck
+cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
+pnpm --filter openwork-server-v2 build:bin
+pnpm --filter openwork-server-v2 build:bin:embedded --bundle-dir ../desktop/src-tauri/sidecars
+```
+
+## macOS Manual Validation
+
+Prerequisites:
+
+- Apple signing identity available in keychain
+- Notary API key and issuer configured
+- Real release-style sidecar bundle prepared
+
+Suggested validation flow:
+
+```bash
+pnpm -C apps/desktop prepare:sidecar
+pnpm --filter openwork-server-v2 build:bin:embedded --bundle-dir ../desktop/src-tauri/sidecars
+codesign --deep --force -vvvv --sign "<APPLE_IDENTITY>" --entitlements apps/desktop/src-tauri/entitlements.plist apps/server-v2/dist/bin/openwork-server-v2
+codesign -vvv --verify apps/server-v2/dist/bin/openwork-server-v2
+xcrun notarytool submit apps/server-v2/dist/bin/openwork-server-v2 --key <KEY_ID> --key-id <KEY_ID> --issuer <ISSUER_ID> --wait
+spctl --assess --type execute --verbose apps/server-v2/dist/bin/openwork-server-v2
+OPENWORK_SERVER_V2_WORKDIR="$(mktemp -d)" apps/server-v2/dist/bin/openwork-server-v2 --port 32123
+```
+
+Confirm:
+
+- the binary verifies after signing
+- notarization succeeds
+- first-run extraction succeeds from the embedded payload
+- extracted sidecars launch without trust prompts
+
+## Windows Manual Validation
+
+Prerequisites:
+
+- Windows runner or workstation
+- Authenticode certificate in PFX form
+- `signtool.exe`
+
+Suggested validation flow:
+
+```powershell
+pnpm install --frozen-lockfile
+pnpm -C apps/desktop prepare:sidecar
+pnpm --filter openwork-server-v2 build:bin:embedded --bundle-dir ../desktop/src-tauri/sidecars --target bun-windows-x64
+signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f codesign.pfx /p <PASSWORD> apps\server-v2\dist\bin\openwork-server-v2-bun-windows-x64.exe
+signtool verify /pa /v apps\server-v2\dist\bin\openwork-server-v2-bun-windows-x64.exe
+```
+
+SmartScreen / AV validation:
+
+```powershell
+$env:OPENWORK_SERVER_V2_WORKDIR = Join-Path $env:TEMP "openwork-server-v2-smoke"
+New-Item -ItemType Directory -Force -Path $env:OPENWORK_SERVER_V2_WORKDIR | Out-Null
+apps\server-v2\dist\bin\openwork-server-v2-bun-windows-x64.exe --port 32123
+Invoke-WebRequest http://127.0.0.1:32123/system/opencode/health
+Invoke-WebRequest http://127.0.0.1:32123/system/runtime/summary
+```
+
+Record:
+
+- whether SmartScreen warns on first launch
+- whether Defender delays or quarantines extracted sidecars
+- first-run vs second-run startup latency
+- whether signed extracted sidecars materially reduce warnings
+
+## End-to-End Product Validation
+
+Validate a real UI flow with Chrome MCP against the narrowest supported local app/server stack:
+
+- open the printed web URL
+- navigate to the session surface
+- send a message
+- confirm the response renders
+- save screenshot evidence
+
+If Chrome MCP is unavailable in the current environment, record that explicitly and include the expected manual reviewer steps.
+
+Current state from this worktree:
+
+- The legacy Docker dev stack reached healthy `server`, `web`, and `share` containers on the Server V2 path.
+- Docker API smoke including session creation now succeeds:
+
+```bash
+source tmp/.dev-env-<id>
+curl -H "Authorization: Bearer $OPENWORK_TOKEN" http://127.0.0.1:<OPENWORK_PORT>/workspaces
+curl -X POST -H "Authorization: Bearer $OPENWORK_TOKEN" -H "Content-Type: application/json" --data '{"title":"Docker E2E"}' http://127.0.0.1:<OPENWORK_PORT>/workspaces/<WORKSPACE_ID>/sessions
+```
+
+- Remaining manual reviewer work:
+
+```bash
+source tmp/.dev-env-<id>
+curl -H "Authorization: Bearer $OPENWORK_TOKEN" http://127.0.0.1:<OPENWORK_PORT>/workspaces
+curl -X POST -H "Authorization: Bearer $OPENWORK_TOKEN" -H "Content-Type: application/json" --data '{"title":"Docker E2E"}' http://127.0.0.1:<OPENWORK_PORT>/workspaces/<WORKSPACE_ID>/sessions
+```
+
+and then complete the Chrome MCP UI flow in the running stack.
diff --git a/prds/server-v2-plan/ideal-flow.md b/prds/server-v2-plan/ideal-flow.md
new file mode 100644
index 0000000000..52553402eb
--- /dev/null
+++ b/prds/server-v2-plan/ideal-flow.md
@@ -0,0 +1,597 @@
+# Server V2 Ideal Flow
+
+## Status: Draft
+## Date: 2026-04-13
+
+## Purpose
+
+This document captures the desired end-state runtime model for OpenWork Server V2.
+
+It is more concrete than the incremental migration docs. It describes the ideal product flow once the desktop app is a thin UI, the server owns workspace behavior, and orchestrator responsibilities have been folded into the server itself.
+
+## Core Principle
+
+The desktop app is just a UI.
+
+The server is the real system.
+
+That means:
+
+- the desktop app starts the server on launch
+- the desktop app talks to the server over a port plus tokens
+- all meaningful product data shown in the UI comes from the server
+- all workspace, file, AI, config, and runtime behavior lives behind the server
+
+## High-Level Runtime Flow
+
+Target flow:
+
+```text
+DesktopApp
+-> starts local OpenWork server
+-> connects to that server over port + token
+-> asks server for workspaces
+-> asks server for sessions within each workspace
+-> renders server-backed state
+
+OpenWork server
+-> owns local sqlite state
+-> owns workspace/config/runtime mapping
+-> talks to OpenCode via SDK
+-> talks to remote OpenWork servers for remote workspaces
+```
+
+## Server And Workspace Registry Model
+
+The local OpenWork server should maintain the canonical registry of servers and workspaces.
+
+That registry includes:
+
+- one local server
+- zero or more remote servers
+- all local, remote, control, and help workspaces
+
+Each workspace points at one server.
+
+Important nuance:
+
+- `server` is a real system concept
+- but it does not need to be a first-class user-facing concept yet
+
+The user should mainly experience:
+
+- workspaces
+- sessions inside workspaces
+
+while the server keeps the canonical mapping and the app only renders or caches what the server returns.
+
+## Desktop App Responsibilities
+
+The desktop app should only do these things:
+
+- launch the local OpenWork server
+- store enough local connection state to reconnect to the server
+- maintain transient UI state
+- maintain knowledge of which servers it is connected to
+- render workspaces, sessions, messages, settings, and actions from server data
+- send user intent to the server
+
+The desktop app should not directly own:
+
+- workspace data models
+- workspace config mutation
+- file reads or writes
+- AI/session/task behavior
+- OpenCode SDK interaction
+- direct runtime orchestration logic
+
+## Server Responsibilities
+
+The local OpenWork server becomes the primary owner of:
+
+- workspace registry
+- workspace config registry
+- session discovery and session interaction
+- local sqlite persistence
+- OpenCode project/session integration
+- local runtime supervision
+- remote OpenWork workspace connections
+- exposing local workspaces for remote consumption
+
+In the target model, the local desktop-hosted server should be able to do everything the app needs without the app performing its own parallel business logic.
+
+## Server Database
+
+The server should have its own sqlite database.
+
+This database is the source of truth for OpenWork-managed metadata and relationships.
+
+At minimum it should track:
+
+- `servers`
+  - known local or remote server connections
+  - connection metadata, base URLs, auth/token state, capability flags
+- `workspaces`
+  - local and remote workspaces
+  - workspace kind, display metadata, connection mapping, status
+- `workspace_sessions_cache` or equivalent lightweight indexes if needed
+  - optional server-side cache/index for faster listing
+- `mcps`
+  - config and auth metadata
+- `skills`
+  - skill metadata and OpenWork-managed ownership
+- `plugins`
+  - plugin metadata and enabled state
+- `provider_configs`
+  - provider definitions, auth references, workspace assignments
+- `cloud_signin`
+  - cloud auth/session metadata for the local server
+- linking tables between config items and workspaces
+  - so one config item can be attached to one or many workspaces
+
+The sqlite DB is for OpenWork-owned metadata.
+
+OpenCode remains the owner of session state.
+
+For now, the server can query sessions live from OpenCode or remote servers.
+
+It does not need a durable authoritative session cache yet.
+
+The UI can eventually keep a cache for responsiveness if needed.
+
+## Workspace Model
+
+There are three important workspace categories.
+
+### 1. Local workspaces
+
+Each local workspace:
+
+- belongs to the local OpenWork server
+- has a stable OpenWork workspace ID
+- maps to exactly one OpenCode project
+- has its own OpenWork-managed config directory
+- has its own user data directory / work directory
+
+### 2. Remote workspaces
+
+Each remote workspace:
+
+- belongs to a remote OpenWork server
+- maps to exactly one workspace on that remote OpenWork server
+- is consumed through the remote server API, not by talking to OpenCode directly
+
+### 3. Internal workspaces
+
+There should also be two local special-purpose workspaces:
+
+- Control Workspace
+- Help Workspace
+
+These should:
+
+- be preconfigured by the local server
+- exist as real server-managed workspaces
+- not appear in the normal user-facing workspace list
+- be accessible through dedicated UI flows instead of the standard workspace switcher
+
+These give the product stable built-in surfaces for control/help behavior without mixing them into the user’s normal workspace list.
+
+For now they should remain hidden.
+
+Later they can be surfaced through settings and help/support areas rather than the standard workspace list.
+
+## Local Workspace Mapping To OpenCode
+
+Each local workspace should map to one OpenCode project.
+
+That means:
+
+- OpenWork owns the workspace record
+- OpenWork workspace ID remains separate from the OpenCode project ID
+- OpenCode owns the underlying session state for that project
+- OpenWork server is responsible for translating between workspace IDs and OpenCode project/session identifiers
+
+The server should query OpenCode through the SDK for:
+
+- sessions in that project
+- messages in a session
+- archived state
+- session names
+- forks and other session primitives
+- any other OpenCode-native session/project capability we need to expose
+
+## Remote Workspace Mapping
+
+Each remote workspace should map to a single workspace on a remote OpenWork server.
+
+That means:
+
+- the local UI does not treat a remote workspace as a direct OpenCode connection
+- the local server talks to the remote OpenWork server
+- the remote OpenWork server is responsible for its own OpenCode integration
+
+This preserves one product model:
+
+- UI <-> OpenWork server
+
+instead of:
+
+- UI <-> OpenCode directly for some things
+- UI <-> OpenWork server for others
+
+## Exposing A Local Workspace Remotely
+
+The local server should be able to expose a local workspace for remote consumption.
+
+This should be modeled as:
+
+- one local OpenWork server
+- one exposed workspace access surface per workspace
+- remote consumers connect to the OpenWork server and are scoped to the workspace they were granted
+
+That access should be workspace-scoped.
+
+Each shared local workspace should have its own access key scoped just to that workspace.
+
+Important principle:
+
+- local configs affect the local server only
+- workspace-specific config should apply only to the workspace it is attached to
+
+## Startup Flow
+
+Ideal startup flow:
+
+1. Desktop app launches.
+2. Desktop app starts the local OpenWork server.
+3. Desktop app establishes a connection to the server using port + token.
+4. Desktop app asks the server for the list of visible workspaces.
+5. For each workspace, the desktop app asks the server for sessions in that workspace.
+6. The server resolves the workspace to its backend:
+   - local OpenCode project for local workspaces
+   - remote OpenWork server workspace for remote workspaces
+7. The server queries the relevant backend live for those sessions.
+8. The desktop app renders only the data returned by the server.
+
+The server should also expose explicit runtime health endpoints for its local dependencies, including OpenCode.
+
+Recommended namespace:
+
+- use `/system/*` for server-wide runtime and operational surfaces
+- for example: `/system/opencode/health`, `/system/runtime/versions`, `/system/runtime/upgrade`
+
+At minimum, the UI should be able to ask whether OpenCode is running and which version is active.
+
+## OpenCode Router Startup Flow
+
+`opencode-router` should be started by the new OpenWork server, not by the desktop app.
+
+Current baseline being replaced:
+
+- today, the orchestrator decides whether router support is needed
+- today, the orchestrator resolves the router binary
+- today, the orchestrator spawns and supervises the router child process
+
+Target flow:
+
+1. Desktop app launches the local OpenWork server.
+2. The server boots its sqlite state and runtime registry.
+3. The server evaluates whether router support is needed.
+4. If router support is needed, the server:
+   - resolves the `opencode-router` binary
+   - materializes the effective router config from server-owned state
+   - launches the router child process
+   - waits for router health
+   - tracks router status in memory and optionally in runtime state tables
+5. The server exposes router status and router-backed capabilities through its own API.
+
+The desktop app should not:
+
+- launch `opencode-router` directly
+- supervise `opencode-router` directly
+- talk to `opencode-router` directly
+
+The server should own the full lifecycle.
+
+### Recommended shape
+
+- one router process per local OpenWork server
+- server-level identities and bindings
+- workspace-aware routing enforced by the server when needed
+
+This is simpler than one router process per workspace and fits the server-first ownership model better.
+
+### Startup decision model
+
+The server should decide whether router startup is needed based on:
+
+- whether any router identities or bindings are configured
+- whether any server-owned features require router-backed behavior
+- whether messaging-related capabilities are enabled
+
+Recommended behavior:
+
+- if no router-backed capability is configured, router can stay off
+- once messaging/bindings are configured, router should be started and supervised by the server
+
+### Runtime behavior
+
+The server should also own:
+
+- router restart
+- router health checks
+- router config apply/reload behavior
+- router status reporting to the UI
+
+That makes `opencode-router` just another runtime dependency of the OpenWork server, not a separate app-owned or orchestrator-owned control surface.
+
+## Session Ownership Model
+
+The state of a session should be managed by OpenCode.
+
+That includes:
+
+- session identity
+- session name
+- archived state
+- messages
+- message ordering/history
+- forks
+- other OpenCode-native session semantics
+
+The OpenWork server should query OpenCode via the SDK to get those.
+
+OpenWork should not duplicate the source of truth for those fields in its own sqlite DB unless it needs a cache or index for performance.
+
+## Workspace Config Ownership Model
+
+The config of a workspace should be managed by OpenWork.
+
+That includes:
+
+- MCPs
+- providers
+- plugins
+- skills
+- any OpenWork-owned workspace settings
+
+When a user adds a config item:
+
+- by default it should be added to the workspace currently active in the UI
+- the UI should also let the user apply that item to other workspaces
+- nothing should be globally applied by default
+
+When that happens:
+
+1. The server creates or updates the config item in its own sqlite DB.
+2. The server creates rows in a dedicated linking table that associates the config item with one or more workspaces.
+3. The server materializes the effective OpenCode config for each affected workspace.
+4. The server updates the OpenCode config file(s) needed for that workspace only.
+
+When the server starts OpenCode, it should also be able to generate the effective OpenCode config object from its own database state and pass that config into the OpenCode runtime directly.
+
+This lets OpenWork own the config model while still projecting it into the OpenCode format OpenCode needs.
+
+When a user creates a new workspace, the product should also offer a list of existing config items that can be applied to that new workspace.
+
+## Config Directory Separation
+
+The ideal layout separates:
+
+- user data directory / project data directory
+- OpenWork-managed config directory
+- OpenCode-managed runtime state
+
+When a user adds a new local workspace:
+
+1. OpenWork prompts for the directory the user wants to work with.
+2. That chosen directory becomes the workspace data directory.
+3. OpenWork creates a separate workspace config directory under an OpenWork-controlled path.
+4. OpenCode is pointed at the OpenWork-controlled config directory.
+5. The user’s chosen data directory is added as an authorized path in config.
+
+This gives a cleaner split between:
+
+- files owned by the user
+- files controlled by OpenWork
+- files controlled by OpenCode
+
+Initial config path direction:
+
+```text
+<server-working-dir>/workspaces/<workspaceId>/config
+```
+
+## Config Absorption Model
+
+If a user manually adds config item files into a workspace config path, the server should detect that and absorb it into the local sqlite database.
+
+That means the server should eventually support:
+
+- watching workspace config directories
+- detecting unmanaged additions/changes/removals
+- parsing those items into OpenWork-owned models
+- reconciling them back into the DB as imported or externally-managed records
+
+This gives the system a path to coexist with manual edits instead of fighting them.
+
+For now:
+
+- if a file clearly matches a known managed concept such as an MCP, Skill, Plugin, or similar item, the server can absorb it
+- if it does not match a known managed concept, the server should leave it in place and not force it into the DB
+
+## Session Interaction Flow
+
+For anything related to a session, the client should always talk to the OpenWork server with the workspace ID.
+
+Example shape:
+
+```text
+client action
+-> OpenWork server request with workspaceId (+ sessionId if needed)
+-> server resolves workspace backend
+-> local OpenCode project/session OR remote OpenWork workspace
+-> response comes back through OpenWork server
+```
+
+For local workspaces:
+
+- the server forwards to the correct OpenCode project/session using the SDK
+
+For remote workspaces:
+
+- the server forwards to the remote OpenWork server
+
+The client should not need to know which backend type it is talking to beyond workspace/server identity.
+
+The server should maintain the mapping between:
+
+- OpenWork workspace ID
+- backend type
+- OpenCode project ID or remote OpenWork workspace ID
+
+## OpenCode Primitive Exposure
+
+To make this work, the OpenWork server will need to expose the OpenCode primitives it depends on.
+
+The initial minimum set of upstream OpenCode capabilities that the server must wrap should include at least:
+
+### Session list and lifecycle
+
+- `GET /session`
+  - list sessions
+- `POST /session`
+  - create session
+- `GET /session/status`
+  - get session status
+- `DELETE /session/{sessionID}`
+  - delete session
+- `PATCH /session/{sessionID}`
+  - update session
+
+### Session structure and control
+
+- `GET /session/{sessionID}/todo`
+  - get session todos
+- `POST /session/{sessionID}/init`
+  - initialize session
+- `POST /session/{sessionID}/fork`
+  - fork session
+- `POST /session/{sessionID}/abort`
+  - abort session
+- `POST /session/{sessionID}/share`
+  - share session
+- `DELETE /session/{sessionID}/share`
+  - unshare session
+- `GET /session/{sessionID}/diff`
+  - get message diff
+- `POST /session/{sessionID}/summarize`
+  - summarize session
+
+### Messages
+
+- `GET /session/{sessionID}/message`
+  - get session messages
+- `POST /session/{sessionID}/message`
+  - send message
+- `GET /session/{sessionID}/message/{messageID}`
+  - get message
+- `DELETE /session/{sessionID}/message/{messageID}`
+  - delete message
+- `DELETE /session/{sessionID}/message/{messageID}/part/{partID}`
+  - delete message part
+- `PATCH /session/{sessionID}/message/{messageID}/part/{partID}`
+  - update message part
+
+### Prompt and command execution
+
+- `POST /session/{sessionID}/prompt_async`
+  - send async message
+- `POST /session/{sessionID}/command`
+  - send command
+- `POST /session/{sessionID}/shell`
+  - run shell command
+- `POST /session/{sessionID}/revert`
+  - revert message
+- `POST /session/{sessionID}/unrevert`
+  - restore reverted messages
+
+The OpenWork server becomes the adapter and policy layer over those upstream primitives.
+
+The public API exposed to clients should not use those raw session-first routes directly.
+
+Instead, the public API should be normalized around workspace-first OpenWork routes, for example:
+
+- `GET /workspaces/{workspaceId}/sessions`
+- `POST /workspaces/{workspaceId}/sessions`
+- `GET /workspaces/{workspaceId}/sessions/status`
+- `GET /workspaces/{workspaceId}/sessions/{sessionId}`
+- `PATCH /workspaces/{workspaceId}/sessions/{sessionId}`
+- `DELETE /workspaces/{workspaceId}/sessions/{sessionId}`
+- `GET /workspaces/{workspaceId}/sessions/{sessionId}/messages`
+- `POST /workspaces/{workspaceId}/sessions/{sessionId}/messages`
+- `POST /workspaces/{workspaceId}/sessions/{sessionId}/fork`
+- `POST /workspaces/{workspaceId}/sessions/{sessionId}/abort`
+
+That means the public API shape should be normalized around:
+
+- workspace ID first
+- then session ID / message ID / other nested IDs
+
+instead of exposing raw OpenCode-shaped session-first routes directly to clients.
+
+## Recommended Data Boundaries
+
+### OpenCode owns
+
+- project/session/message state
+- session runtime behavior
+- OpenCode-native semantics around forks/history
+
+### OpenWork server owns
+
+- workspace registry
+- config registry and config/workspace assignment
+- connection registry for local and remote servers
+- special internal workspaces
+- projection of OpenWork config into OpenCode workspace config
+- exposure of workspace/session/runtime primitives to the UI
+
+### Desktop app owns
+
+- connection to the local server
+- transient UI state
+- rendering and interaction state
+
+## Implications For Migration
+
+This target implies:
+
+- Tauri-owned local workspace/config/file behavior must move behind the server
+- orchestrator-owned runtime/workspace behavior must move behind the server
+- the app should stop depending on direct local mutation as a normal path
+- remote workspace support should normalize around "one workspace on one remote OpenWork server"
+
+The migration rollout itself should be handled in a separate migration plan so existing users can be moved safely and smoothly.
+
+## Decisions Captured So Far
+
+1. Session lists can be queried live from OpenCode or remote servers for now. The UI can maintain a cache later if needed.
+2. The system has a real `servers` model and a real `workspaces` model. Each workspace points at exactly one server, even if `server` is not yet a first-class user-facing concept.
+3. Control Workspace and Help Workspace stay hidden for now, and can later surface through settings/help areas.
+4. The preferred initial config path is under the server working directory, shaped like `workspaces/<workspaceId>/config`.
+5. Nothing is global by default. When a config item is created, the user chooses which workspaces it applies to. When a workspace is created, the user can choose existing config items to apply.
+6. Config reconciliation should use both file watching and periodic/pull-based reconciliation over time.
+7. Config absorption should only occur for recognized managed concepts. Unknown/manual files should remain in place.
+8. A remotely exposed local workspace should use workspace-scoped access, with its own access key.
+9. Local workspaces keep a stable OpenWork workspace ID that is separate from the OpenCode project ID, and the server stores the mapping.
+10. Session and message primitives should be exposed through workspace-first OpenWork-shaped endpoints, not raw OpenCode endpoint shapes.
+11. The migration rollout itself should be described in a separate migration plan.
+
+## Questions To Address Next
+
+1. What exact schema should represent the `servers` table, `workspaces` table, config item tables, and workspace-config linking tables?
+2. Which other desktop-owned data should move into the server DB as part of this same ownership shift, such as cloud settings, user auth, and synced-item metadata?
+3. What exact filesystem layout should we use around the config directory beyond the initial `workspaces/<workspaceId>/config` direction?
+4. What exact workspace-first OpenWork route naming should wrap the required OpenCode session/message primitives?
diff --git a/prds/server-v2-plan/local-dev.md b/prds/server-v2-plan/local-dev.md
new file mode 100644
index 0000000000..a2dbbd4c51
--- /dev/null
+++ b/prds/server-v2-plan/local-dev.md
@@ -0,0 +1,332 @@
+# Server V2 Local Dev Workflow
+
+## Status: Draft
+## Date: 2026-04-09
+
+## Purpose
+
+This document defines how Server V2, the generated SDK, and the app should stay in sync during local development without manual rebuilds or process restarts after every change.
+
+This doc assumes Server V2 is a separate new server package, not a mounted sub-application inside the old server.
+
+While Server V2 is still under validation, the current product should continue to work by default on the legacy path. For local testing of the new path, opt in explicitly with:
+
+```bash
+OPENWORK_UI_USE_SERVER_V2=1 pnpm dev:server-v2
+```
+
+That same logical flag should control both app routing and desktop startup behavior.
+
+Detailed generator selection and script shape live in `prds/server-v2-plan/sdk-generation.md`.
+
+## Goal
+
+The ideal local loop is:
+
+```text
+edit a new-server route or schema
+-> server reloads
+-> OpenAPI spec regenerates
+-> SDK regenerates
+-> app sees the updated types and client methods
+-> continue coding without restarting everything
+```
+
+## Principle
+
+We should treat local development as three separate but connected loops:
+
+- server runtime loop
+- contract generation loop
+- app dev loop
+
+There is also one runtime-asset loop that matters specifically for Server V2:
+
+- local sidecar acquisition loop
+
+Each loop watches its own inputs and reacts only to the changes it actually cares about.
+
+## Runtime Asset Loop
+
+For Server V2 local development, runtime ownership should match production, but asset sourcing can be lighter-weight.
+
+Recommended model:
+
+- `apps/server-v2` runs directly with Bun in dev/watch mode
+- `opencode-router` is built from the local workspace source in `apps/opencode-router`
+- `opencode` is downloaded from a pinned release artifact, not committed into the repo and not resolved from `PATH`
+- both binaries are staged into a gitignored local runtime-assets directory
+- Server V2 launches those staged binaries by absolute path
+
+### Pinned version source
+
+The pinned OpenCode version for local dev should come from the root `constants.json` file.
+
+That means the local-dev flow should:
+
+- read `opencodeVersion` from `constants.json`
+- normalize the version for the upstream release download if needed
+- fetch exactly that version when the local cache is missing
+
+### Recommended local-dev behavior
+
+1. On first local Server V2 run, check the local runtime-assets cache for the pinned `opencode` binary.
+2. If the pinned binary is missing, download the matching release artifact for the current platform.
+3. Build `apps/opencode-router` locally and stage the resulting binary in the same gitignored runtime-assets area.
+4. Start Server V2 in Bun watch mode.
+5. Have Server V2 spawn the staged binaries by absolute path.
+
+### Important rules
+
+- do not require developers to install `opencode` globally for Server V2 dev
+- do not use `PATH` lookup as the default dev mechanism
+- do not check the `opencode` binary into git
+- prefer caching the downloaded pinned artifact locally so repeated dev restarts are fast
+
+## Watch Graph
+
+```text
+apps/server-v2/src/**
+-> server watch reloads server runtime
+-> OpenAPI watch regenerates apps/server-v2/openapi/openapi.json
+-> SDK watch regenerates packages/openwork-server-sdk/generated/**
+-> app dev server sees workspace package changes
+-> app recompiles with updated types and methods
+```
+
+## Watchers
+
+### 1. Server runtime watcher
+
+Purpose:
+
+- reload the backend when server code changes
+
+Inputs:
+
+- `apps/server-v2/src/**`
+
+Should ignore:
+
+- `apps/server-v2/openapi/**`
+- `packages/openwork-server-sdk/**`
+
+Reason:
+
+- generated contract artifacts should not cause unnecessary backend restarts
+
+### 2. OpenAPI watcher
+
+Purpose:
+
+- regenerate the new-server contract when routes or schemas change
+
+Inputs:
+
+- `apps/server-v2/src/**`
+
+Output:
+
+- `apps/server-v2/openapi/openapi.json`
+
+Notes:
+
+- this should use `hono-openapi`
+- it should be narrowly scoped to new-server sources
+- it should debounce rapid file changes to avoid overlapping runs
+
+### 3. SDK watcher
+
+Purpose:
+
+- regenerate the TypeScript SDK when the OpenAPI spec changes
+
+Input:
+
+- `apps/server-v2/openapi/openapi.json`
+
+Output:
+
+- `packages/openwork-server-sdk/generated/**`
+
+Notes:
+
+- it should only react when the spec actually changes
+- it should not trigger server reloads
+- it should be fast enough to run continuously in dev
+
+### 4. App dev watcher
+
+Purpose:
+
+- recompile the app when app code or SDK package code changes
+
+Inputs:
+
+- `apps/app/**`
+- `packages/openwork-server-sdk/**`
+
+Notes:
+
+- the app should consume the SDK package through a workspace dependency
+- the app should own the thin `createSdk({ serverId })` adapter that resolves local server config
+- in dev, the SDK package should preferably expose TypeScript source directly rather than requiring a full `dist/` build on every change
+
+## Preferred SDK Package Dev Shape
+
+To keep iteration fast, `packages/openwork-server-sdk` should ideally work like this in development:
+
+- generated files land in `generated/**`
+- handwritten SDK files like `src/index.ts` and SSE helpers live beside them
+- the app imports the package source through the workspace
+- the app keeps `createSdk({ serverId })` in app code rather than in the reusable SDK package
+- Vite and TypeScript pick up changes automatically
+
+That avoids a slow extra cycle like:
+
+```text
+regenerate SDK
+-> rebuild package dist
+-> app sees dist change
+```
+
+If a build step is still needed for packaging or publishing, it should exist, but dev should prefer source consumption whenever possible.
+
+## Runtime Client Creation
+
+The app-facing entrypoint stays:
+
+```ts
+const sdk = createSdk({ serverId })
+```
+
+or directly:
+
+```ts
+await createSdk({ serverId }).sessions.listMessages({ workspaceId, sessionId })
+```
+
+`createSdk({ serverId })` should remain lightweight and app-owned.
+
+In the ideal product model, most user-facing app traffic should still target the local OpenWork server as the canonical adapter and registry. Direct alternate `serverId` targeting is mainly for migration, testing, and explicit server-management flows.
+
+It should only:
+
+- resolve `serverId` to the latest known `baseUrl`, `token`, and capability info when direct target selection is needed
+- prepare a generated SDK instance plus any app-local migration routing
+- return the typed SDK object
+
+It should not:
+
+- perform network discovery by default
+- make a capability request on every call
+- do expensive initialization work
+
+This keeps per-call SDK creation cheap enough that we do not need to cache or reuse it aggressively.
+
+## What Changes Trigger What
+
+### Change: new-server route handler or schema
+
+- server reloads
+- OpenAPI spec regenerates
+- SDK regenerates
+- app sees updated methods and types
+
+### Change: server internals only, no contract change
+
+- server reloads
+- OpenAPI may regenerate
+- SDK may regenerate to identical output
+- app usually does not need any meaningful change
+
+### Change: generated SDK mapping or SSE helper
+
+- SDK package changes
+- app recompiles
+- server does not need to restart unless server code also changed
+
+### Change: app feature code only
+
+- app recompiles
+- server and SDK do not need to restart
+
+## SSE in Local Dev
+
+There will likely be only one or two SSE endpoints.
+
+Recommended approach:
+
+- document the SSE endpoints in the new server contract
+- keep event payloads typed from generated or shared contract types
+- expose small handwritten SSE helpers from `packages/openwork-server-sdk`
+- let the app consume those helpers through the same `createSdk({ serverId })` entrypoint
+
+That means SSE changes still fit the same watch graph:
+
+- server-side event contract change -> spec generation -> SDK or helper update -> app sees new types
+- helper implementation change -> app recompiles immediately
+
+## Avoiding Restart Loops
+
+The main risk in this setup is watchers causing each other to loop.
+
+We should prevent that by keeping responsibilities clean:
+
+- server watcher ignores generated spec and SDK files
+- OpenAPI watcher only watches new-server source
+- SDK watcher only watches the spec file
+- app watcher only consumes the SDK package output, not the server source tree directly
+
+If needed, generation steps should write files only when contents actually change.
+
+## CI Mirror of the Dev Flow
+
+Local dev should be convenient, but CI should still enforce correctness.
+
+CI should run the same core graph without watch mode:
+
+```text
+generate openapi spec
+-> generate sdk
+-> fail if git diff is non-empty
+```
+
+That ensures local convenience never replaces contract discipline.
+
+## Suggested Scripts
+
+Exact tooling is still open, but the shape should look like this:
+
+```text
+apps/server-v2
+- dev                 # backend watch mode
+- openapi:generate    # one-shot spec generation
+- openapi:watch       # watch new-server sources and regenerate spec
+
+packages/openwork-server-sdk
+- generate            # one-shot SDK generation
+- watch               # watch spec and regenerate sdk
+
+repo root
+- dev:server-v2       # run server watch + openapi watch + sdk watch + app dev together
+- dev:server-v2:server # run only the backend/spec/sdk watch graph when the app is not needed
+```
+
+Current implementation note:
+
+- `pnpm dev:server-v2` is the default composite command and includes the app dev server.
+- `pnpm dev:server-v2:server` exists for backend-only work.
+- The SDK watcher watches the OpenAPI directory entry instead of a single file handle so spec rewrites do not silently stop regeneration after replace-style writes.
+- OpenAPI generation runs against an isolated temporary Server V2 working directory so contract generation does not touch or depend on a developer's live imported workspace state.
+
+## Developer Experience Target
+
+From a developer's point of view, the happy path should be:
+
+1. run one dev command
+2. edit new-server routes, schemas, or app code freely
+3. let watchers keep server runtime, spec, SDK, and app types synchronized
+4. avoid manual kill/restart/build loops except when tooling itself changes
+
+That is the standard we should design toward.
diff --git a/prds/server-v2-plan/orchestrator-audit.md b/prds/server-v2-plan/orchestrator-audit.md
new file mode 100644
index 0000000000..a352d2f558
--- /dev/null
+++ b/prds/server-v2-plan/orchestrator-audit.md
@@ -0,0 +1,515 @@
+# Orchestrator Audit
+
+## Scope
+
+This audit covers `apps/orchestrator/**`.
+
+The goal is to explain what the orchestrator is, what its major functions do, where they are called from, what they ultimately affect, and which responsibilities should ideally move into the main server over time.
+
+## What The Orchestrator Is
+
+The orchestrator is the host-side runtime manager for OpenWork.
+
+In plain English, it is the thing that turns:
+
+- a workspace
+- some binaries
+- some ports and tokens
+- an execution mode
+
+into a running OpenWork worker stack.
+
+Today it is responsible for things like:
+
+- starting and supervising `opencode`
+- starting and supervising `openwork-server`
+- optionally starting `opencode-router`
+- exposing a daemon API for desktop workspace activation and disposal
+- managing detached and sandboxed runtime flows
+- handling host-side sidecar/binary resolution and upgrade control
+
+It is currently both:
+
+- a bootstrap shell for host/runtime startup
+- a mini runtime control plane
+
+That split is important, because the control-plane responsibilities should move first, and the bootstrap shell responsibilities should also be reevaluated for collapse into the main server rather than preserved automatically.
+
+## Disposition Labels
+
+- `Stay`: should remain an orchestrator/host-shell concern.
+- `Move`: should ideally move into the main server over time.
+- `Split`: some boundary or trigger may stay in the orchestrator, but the core capability should move into the main server.
+
+## High-Level Lifecycle
+
+1. CLI or desktop launches the orchestrator.
+2. The orchestrator resolves binaries, sidecars, ports, tokens, and state dirs.
+3. It starts and supervises OpenCode, OpenWork server, and optional router.
+4. In daemon mode, it persists workspace/runtime state and exposes a local daemon API.
+5. In detached or sandboxed flows, it creates and manages those host/container runtimes.
+6. It also exposes convenience CLI wrappers over some server APIs.
+
+## Single-Workspace Host Startup And Shutdown
+
+Disposition guidance:
+
+- `main()` -> `Split`
+- `runStart()` -> `Split`
+- `shutdown()` inside `runStart()` -> `Split`
+
+Reasoning: this is current-state bootstrap logic, but the large amount of runtime capability assembled by `runStart()` should ultimately be server-owned and folded into the main server.
+
+### `main()`
+
+- What it does: dispatches the top-level orchestrator CLI commands.
+- Called from and when: process entrypoint for the `openwork` CLI.
+- Ends up calling: `runStart()`, daemon commands, approvals/files/status helpers, and other CLI subcommands.
+
+### `runStart()`
+
+- What it does: main coordinator for host mode; resolves workspace, ports, tokens, binaries, sandbox mode, starts services, waits for health, and prints connect info.
+- Called from and when: called by `main()` for `openwork start` and `openwork serve`; also used indirectly when desktop detached mode shells out to `openwork start --detach`.
+- Ends up calling: OpenCode startup, OpenWork server startup, optional OpenCodeRouter startup, sandbox/container logic, health loops, owner token issuance, and runtime control server setup.
+
+### `shutdown()` inside `runStart()`
+
+- What it does: gracefully stops children, control server, timers, and optional sandbox container.
+- Called from and when: called on SIGINT/SIGTERM, fatal child exits, failed startup, and check completion.
+- Ends up calling: full host-stack shutdown.
+
+## Runtime Process Supervision And Upgrade Control
+
+Disposition guidance:
+
+- `startOpencode()` -> `Split`
+- `startOpenworkServer()` -> `Split`
+- `startOpenCodeRouter()` -> `Split`
+- child exit/spawn error handlers -> `Split`
+- runtime control server in `runStart()` -> `Move`
+- `performRuntimeUpgrade()` -> `Split`
+
+Reasoning: native child supervision exists today in the orchestrator, but even that should be treated as transition-state behavior if the main server is going to absorb bootstrap and runtime supervision over time.
+
+### `startOpencode()`
+
+- What it does: spawns OpenCode with the chosen env, auth, reload, and logging settings.
+- Called from and when: called from `runStart()` and daemon `ensureOpencode()`.
+- Ends up calling: `opencode serve` and the OpenCode runtime itself.
+
+### `startOpenworkServer()`
+
+- What it does: launches `openwork-server` with the bootstrap information needed for host mode today.
+- Called from and when: called from `runStart()` and restart paths.
+- Ends up calling: the main OpenWork API/control layer process; over time this bootstrap contract should shrink toward the minimum needed to bring the server up.
+
+### `startOpenCodeRouter()`
+
+- What it does: launches `opencode-router` when messaging/router support is enabled.
+- Called from and when: called from `runStart()` and restart paths.
+- Ends up calling: the router sidecar process; launch may remain host-owned, but router product control should move into the server.
+
+### child exit and spawn error handlers
+
+- What they do: turn child process failures into orchestrator shutdown or degraded-mode handling.
+- Called from and when: called during host mode whenever a managed child exits or fails to spawn.
+- Ends up calling: shutdown or failure-state logic for the whole host stack.
+
+### runtime control server in `runStart()`
+
+- What it does: exposes host-local legacy `/runtime/versions` and `/runtime/upgrade` endpoints; in the Server V2 target these capabilities should land under `/system/runtime/*` on the main server.
+- Called from and when: started during host startup.
+- Ends up calling: runtime inspection and rolling restart/upgrade behavior.
+
+### `performRuntimeUpgrade()`
+
+- What it does: re-resolves binaries, optionally installs packages, and restarts services.
+- Called from and when: called through the runtime control server when a client requests an upgrade.
+- Ends up calling: rolling restart of OpenCode, OpenWork server, and OpenCodeRouter.
+
+## Sidecar And Binary Resolution
+
+Disposition guidance:
+
+- all major functions in this section -> `Split`
+
+Reasoning: in the current orchestrator these are host/bootstrap concerns, but the Server V2 target changes the default distribution model. When the canonical runtime is `openwork-server-v2` bundling and extracting its own sidecars, the equivalent resolution logic should move into the server for that path. A thinner host shell may still need fallback or external-runtime resolution in some modes, so this boundary is better treated as `Split` than `Stay`.
+
+### `resolveOpenworkServerBin()`
+
+- What it does: decides which `openwork-server` binary to run.
+- Called from and when: called during startup and upgrade.
+- Ends up calling: local sidecar selection or downloaded/external binary resolution.
+
+### `resolveOpencodeBin()`
+
+- What it does: decides which OpenCode binary to run.
+- Called from and when: called during startup, daemon mode, and upgrade.
+- Ends up calling: local sidecar or installed OpenCode resolution.
+
+### `resolveOpenCodeRouterBin()`
+
+- What it does: decides which OpenCodeRouter binary to run.
+- Called from and when: called when router support is enabled.
+- Ends up calling: router binary resolution.
+
+### `resolveSidecarConfig()`
+
+- What it does: computes sidecar directories, manifests, target triple, and download URLs.
+- Called from and when: called by startup and daemon flows.
+- Ends up calling: all sidecar download logic.
+
+### `downloadSidecarBinary()`
+
+- What it does: downloads and verifies sidecar binaries.
+- Called from and when: called when sidecar source is downloaded or auto-resolved that way.
+- Ends up calling: local sidecar cache population.
+
+### version verification helpers
+
+- What they do: verify that the runtime is actually using the intended binary/version/config.
+- Called from and when: called after service health checks and during upgrade.
+- Ends up calling: startup failure or diagnostic reporting if versions do not match expectations.
+
+## Desktop Daemon And Workspace Activation
+
+Disposition guidance:
+
+- `runDaemonCommand()` -> `Split`
+- `runRouterDaemon()` -> `Split`
+- `ensureRouterDaemon()` -> `Split`
+- `ensureOpencode()` inside daemon mode -> `Split`
+- daemon HTTP API -> `Move`
+- `runWorkspaceCommand()` -> `Move`
+- `runInstanceCommand()` -> `Move`
+
+Reasoning: a host-local daemon boundary may still exist, but workspace activation and instance disposal are product/runtime control capabilities that should move into the main server.
+
+### `runDaemonCommand()`
+
+- What it does: handles daemon subcommands like start, status, stop, and run.
+- Called from and when: called by the CLI daemon entry.
+- Ends up calling: daemon startup or daemon status/control requests.
+
+### `runRouterDaemon()`
+
+- What it does: runs the long-lived desktop daemon that keeps OpenCode alive, persists workspace state, and serves the daemon HTTP API.
+- Called from and when: called by `openwork daemon run`; desktop also spawns it for desktop host mode.
+- Ends up calling: daemon HTTP service, workspace registry persistence, and OpenCode lifecycle management; this should be treated as transitional control-plane behavior rather than an enduring ownership boundary.
+
+### `ensureRouterDaemon()`
+
+- What it does: auto-starts the daemon if it is not already running and waits for health.
+- Called from and when: called by CLI workspace/instance helpers.
+- Ends up calling: daemon process startup.
+
+### `ensureOpencode()` in daemon mode
+
+- What it does: reuses or starts the single OpenCode runtime used by the daemon.
+- Called from and when: called on daemon boot and when workspace operations need OpenCode.
+- Ends up calling: daemon-managed OpenCode lifecycle.
+
+### daemon HTTP API
+
+- What it does: exposes local endpoints for health, workspace listing, workspace activation, workspace path lookup, instance disposal, and shutdown.
+- Called from and when: used by desktop and orchestrator CLI helpers.
+- Ends up calling: daemon state mutation and workspace/runtime activation behavior.
+
+### `runWorkspaceCommand()`
+
+- What it does: thin CLI wrapper for workspace add/list/switch/info/path commands.
+- Called from and when: called by `openwork workspace ...`.
+- Ends up calling: daemon HTTP API.
+
+### `runInstanceCommand()`
+
+- What it does: thin CLI wrapper for instance disposal commands.
+- Called from and when: called by `openwork instance dispose ...`.
+- Ends up calling: daemon HTTP API.
+
+## Auth, Tokens, And Local State Persistence
+
+Disposition guidance:
+
+- managed OpenCode credential resolution -> `Split`
+- owner token issuance -> `Move`
+- OpenCode state layout resolution/creation -> `Stay`
+- router/orchestrator state persistence -> `Split`
+
+Reasoning: local secret and filesystem layout for host relaunches is still host-owned, but token semantics and control-plane identity should move closer to the main server.
+
+### managed OpenCode credential resolution
+
+- What it does: generates or reads OpenCode basic-auth credentials used by the orchestrator-managed runtime.
+- Called from and when: called during host startup and daemon startup.
+- Ends up calling: OpenCode auth configuration used to protect direct OpenCode access.
+
+### `issueOpenworkOwnerToken()`
+
+- What it does: asks the server to mint an owner token from a host token.
+- Called from and when: called after server health checks in host and sandbox mode.
+- Ends up calling: the server `/tokens` API and elevated host-control access.
+
+### OpenCode state layout helpers
+
+- What they do: choose and create OpenCode config/data/cache locations, especially in dev and orchestrated modes.
+- Called from and when: called before OpenCode launch in host and daemon modes.
+- Ends up calling: local directory creation and optional auth/config import.
+
+### orchestrator state persistence helpers
+
+- What they do: read and write `openwork-orchestrator-state.json` and related state snapshots.
+- Called from and when: called throughout daemon lifecycle and desktop reconnect flows.
+- Ends up calling: daemon/workspace/binary state persistence on disk.
+
+## Docker And Apple Container Sandbox Flows
+
+Disposition guidance:
+
+- all major sandbox/container functions in this section -> `Split`
+
+Reasoning: the container substrate itself is still host-shell territory, but the runtime graph and product behavior being started inside that substrate should converge on the same Server V2 ownership model. In practice that means some container launch hooks may stay outside the server, while runtime boot config, child supervision policy, and product-facing control semantics should collapse inward.
+
+### `resolveSandboxMode()`
+
+- What it does: decides whether the runtime should be host, Docker, Apple container, or auto-selected.
+- Called from and when: called during `runStart()`.
+- Ends up calling: the runtime-mode selection path.
+
+### `resolveSandboxExtraMounts()`
+
+- What it does: validates extra host mounts for sandbox mode.
+- Called from and when: called when sandbox mounts are requested.
+- Ends up calling: host-filesystem exposure policy into the sandbox.
+
+### `stageSandboxRuntime()`
+
+- What it does: stages sidecars into a persist area for sandbox execution.
+- Called from and when: called before Docker or Apple sandbox launch.
+- Ends up calling: local staged runtime payload creation.
+
+### `writeSandboxEntrypoint()`
+
+- What it does: writes the in-container boot script that starts OpenCode, optional router, then OpenWork server.
+- Called from and when: called before container launch.
+- Ends up calling: the actual sandbox boot sequence.
+
+### `startDockerSandbox()`
+
+- What it does: starts the whole host stack inside Docker.
+- Called from and when: called from `runStart()` when Docker sandboxing is selected.
+- Ends up calling: `docker run` with mounts, env, and ports.
+
+### `startAppleContainerSandbox()`
+
+- What it does: starts the same stack inside the Apple container backend.
+- Called from and when: called from `runStart()` on supported macOS setups.
+- Ends up calling: Apple container runtime launch.
+
+## HTTP Surfaces And Control-Plane Bridging
+
+Disposition guidance:
+
+- daemon HTTP API -> `Move`
+- runtime control API -> `Move`
+- generic router request client -> `Move`
+
+Reasoning: these are useful product capabilities, but they should ideally be owned by `apps/server`, not by a separate orchestrator control API forever.
+
+### daemon HTTP API
+
+- What it does: local control API for health, workspaces, activation, path lookup, disposal, and shutdown.
+- Called from and when: used by desktop and CLI.
+- Ends up calling: daemon state and workspace activation behavior.
+
+### runtime control API
+
+- What it does: local legacy `/runtime/versions` and `/runtime/upgrade` surface; the target normalized namespace is `/system/runtime/*` once this moves into the main server.
+- Called from and when: started in host mode and later accessed through server proxy routes or clients.
+- Ends up calling: runtime inspection and controlled restart/upgrade behavior.
+
+### `requestRouter()`
+
+- What it does: thin generic CLI client for the daemon API.
+- Called from and when: used by workspace and instance commands.
+- Ends up calling: daemon HTTP API requests.
+
+## Health, Diagnostics, Checks, And Detached Mode
+
+Disposition guidance:
+
+- local health polling helpers -> `Split`
+- `runChecks()` / `runSandboxChecks()` -> `Split`
+- `runStatus()` -> `Move`
+- `handleDetach()` -> `Stay`
+
+Reasoning: host-local polling and detach UX are shell concerns, but canonical health/readiness/status surfaces should move into the main server.
+
+### health polling helpers
+
+- What they do: wait for OpenCode, server, and router health.
+- Called from and when: called throughout startup, daemon, and check flows.
+- Ends up calling: localhost health probes and startup gating.
+
+### `runChecks()` / `runSandboxChecks()`
+
+- What they do: run host-mode smoke tests for runtime correctness, sessions, router auth, workspaces, and optional event streams.
+- Called from and when: called by `openwork start --check` and related flags.
+- Ends up calling: broad end-to-end runtime verification.
+
+### `runStatus()`
+
+- What it does: reports current OpenWork/OpenCode URLs and related status in human-readable form.
+- Called from and when: called by `openwork status`.
+- Ends up calling: health endpoints and status rendering.
+
+### `handleDetach()`
+
+- What it does: detaches the orchestrator shell from the running child stack and leaves the runtime alive.
+- Called from and when: called when detached mode is requested.
+- Ends up calling: stdio unref/cleanup and detached runtime summary output.
+
+## Messaging Enablement And Managed Tool Injection
+
+Disposition guidance:
+
+- router enablement decision -> `Split`
+- managed OpenCode tool injection -> `Move`
+- generated router tool sources -> `Move`
+
+Reasoning: startup hooks may stay host-owned, but mutating OpenCode tool/config surfaces is the kind of capability that should belong to the main server/runtime layer.
+
+### router enablement decision helpers
+
+- What they do: determine whether OpenCodeRouter should run from flags, env, workspace config, or inferred defaults.
+- Called from and when: called during host startup.
+- Ends up calling: router startup decisions and sometimes persisted messaging defaults.
+
+### `ensureOpencodeManagedTools()`
+
+- What it does: writes managed router send/status tools into OpenCode config directories.
+- Called from and when: called before OpenCode startup in host and daemon mode.
+- Ends up calling: OpenCode tool-surface mutation.
+
+### generated router tool sources
+
+- What they do: generate tool implementations that send through or inspect OpenCodeRouter.
+- Called from and when: called by the managed-tool injection path.
+- Ends up calling: the OpenCodeRouter health/config/send surface.
+
+## Thin CLI Wrappers Over Server APIs
+
+Disposition guidance:
+
+- file CLI wrappers -> `Move`
+- approvals CLI wrappers -> `Move`
+- simple status wrapper -> `Move`
+
+Reasoning: these are not orchestrator responsibilities. They are convenience clients over `openwork-server` APIs.
+
+### `runFiles()`
+
+- What it does: exposes CLI wrappers for file session creation, read/write, catalog, events, mkdir, delete, and rename.
+- Called from and when: called by `openwork files ...`.
+- Ends up calling: OpenWork server file-session APIs.
+
+### `runApprovals()`
+
+- What it does: exposes CLI wrappers for approvals listing and replies.
+- Called from and when: called by `openwork approvals ...`.
+- Ends up calling: OpenWork server approvals APIs.
+
+### `runStatus()`
+
+- What it does: provides a convenience status CLI.
+- Called from and when: called by `openwork status`.
+- Ends up calling: health/status APIs.
+
+## Summary: What Should Stay Vs Move
+
+### Should stay in the orchestrator only temporarily
+
+- native process supervision
+- sidecar and binary resolution
+- host-local port/bootstrap/env setup
+- Docker and Apple container lifecycle
+- detach/TUI/log-multiplexing shell behavior
+
+### Should move into the main server
+
+- workspace/runtime control APIs as product capabilities
+- daemon HTTP control surfaces
+- file and approvals CLI wrappers over server APIs
+- managed OpenCode tool/config mutation
+- status/health/product control semantics that should be canonical server surfaces
+
+### Should be split during migration
+
+- host launch triggers can stay in the orchestrator while runtime capability ownership moves into the server
+- local auth/state persistence for relaunch can stay host-owned while token semantics move into the server
+- health polling can stay local while official health/control surfaces move into the server
+
+## Bottom Line
+
+The orchestrator is currently doing two jobs:
+
+1. host bootstrap shell
+2. mini runtime control plane
+
+The mini runtime control plane should be progressively absorbed into the main server first.
+
+After that, the remaining bootstrap shell should also be questioned and collapsed into the main server wherever practical.
+
+## Can Orchestrator Disappear?
+
+Mostly yes, if by "orchestrator" we mean a separate control-plane product layer.
+
+### Full-collapse idea
+
+The strongest form of the target architecture is:
+
+```text
+desktop app or CLI
+-> one OpenWork server process
+-> server owns workspace/runtime/product behavior
+-> server supervises the local runtime pieces it needs
+```
+
+In that model, clients do not need to understand or talk to a separate orchestrator API surface.
+
+### What should ideally be folded into the server too
+
+Even the bootstrap shell responsibilities should be treated as collapse candidates:
+
+- launching local child processes
+- resolving sidecars and binaries
+- choosing ports and env vars
+- Docker and Apple container startup
+- detach and local process supervision
+
+The strongest target is:
+
+- no separate orchestrator control plane
+- no enduring separate orchestrator bootstrap layer
+- one main server as the canonical runtime and product API
+
+### Recommended target architecture
+
+```text
+desktop app
+-> launches or connects to OpenWork server
+-> calls one main server API surface
+
+OpenWork server
+-> starts and supervises local OpenCode/router/container/runtime pieces as needed
+```
+
+### Migration implication
+
+As Server V2 grows, the priority should be:
+
+1. move orchestrator-owned workspace/runtime APIs into the server
+2. move orchestrator-owned config/tool/control semantics into the server
+3. move bootstrap and supervision responsibilities into the server as the final collapse step
+
+That is the path to "doing away with the orchestrator" in practice.
diff --git a/prds/server-v2-plan/plan.md b/prds/server-v2-plan/plan.md
new file mode 100644
index 0000000000..5ef4ce76e0
--- /dev/null
+++ b/prds/server-v2-plan/plan.md
@@ -0,0 +1,543 @@
+# PRD: Server V2 New Server Plan
+
+## Status: Draft
+## Date: 2026-04-09
+
+## Problem
+
+The current server architecture is not the one we want to keep.
+
+We want to build a whole new server as its own server package and process, make that server the real owner of product/runtime/workspace behavior, and then switch the desktop app to start and consume that new server directly.
+
+For planning purposes in this doc set, `openwork-server-v2` is the working name for that new package, binary, and runtime bundle. We can rename it later without changing the architecture direction.
+
+## Goals
+
+- Build a new server implementation in new files without extending the lifetime of the legacy architecture.
+- Build the new server as a separate server, not as a mounted sub-application inside the old server.
+- Keep full TypeScript type safety across server routes, generated clients, and the app-side SDK adapter.
+- Make the desktop app a thin client that starts the server, maintains local UI state, and sends all workspace behavior through the server.
+- Give the desktop app a clean migration layer so UI features can move to the new server bit by bit.
+- End with the desktop app starting only the new server, with the old server removed.
+
+## Non-Goals
+
+- Doing a single big-bang rewrite.
+- Repointing all desktop traffic in one release.
+- Keeping both architectures around indefinitely.
+- Rewriting storage or domain behavior unless it is required for the new server path.
+- Preserving Tauri-only or app-only workspace capabilities as a permanent parallel system.
+
+## Working Approach
+
+### 1. Build a whole new server package
+
+The new server should exist as its own package and process.
+
+Example shape:
+
+```text
+apps/server-v2/
+├── src/
+│   └── cli.ts
+├── openapi/
+└── package.json
+```
+
+This gives us:
+
+- a clean architecture from day one
+- no need to preserve old server structure while designing the new one
+- a direct path to making the desktop app launch the new server when ready
+- a clear ownership boundary for new work
+
+### 2. Put all new server work in the new server package
+
+Create a clearly isolated package for the replacement server so the migration is obvious and deletion is easy later.
+
+Proposed shape:
+
+```text
+apps/server-v2/
+├── src/
+│   ├── app.ts
+│   ├── cli.ts
+│   ├── routes/
+│   ├── middleware/
+│   ├── services/
+│   ├── schemas/
+│   └── adapters/
+└── openapi/
+```
+
+Rule: new server functionality goes into the new server package, not into legacy server files.
+
+### 3. Migrate the desktop app through an explicit API layer
+
+The desktop app should not scatter raw server paths throughout the UI. More importantly, it should stop owning workspace behavior directly.
+
+The target model is:
+
+- the desktop app spins up or connects to servers
+- the desktop app maintains local UI state and a list of connected servers
+- the desktop app maintains a list of workspaces that belong to those servers
+- all real workspace operations go through the server
+
+That means the desktop app should not be the long-term owner of:
+
+- file reads
+- file writes
+- workspace mutation
+- AI/session/task operations
+- project/runtime inspection
+- skill/plugin/config mutation
+- other workspace-scoped business logic
+
+Those should become server responsibilities, even in desktop-hosted mode.
+
+To move incrementally, the app needs a small client-side API layer that can move features onto the new server without changing the rest of the UI shape all at once.
+
+That layer should:
+
+- centralize server route construction
+- expose named operations instead of raw URL strings
+- allow per-feature or per-endpoint migration
+- make fallback possible while the new server is incomplete
+
+Example migration shape:
+
+```text
+desktop feature
+-> app server client module
+-> legacy path or v2 path
+```
+
+This lets the backend and frontend migrate independently but in a coordinated way.
+
+## Ownership Boundary
+
+The long-term ownership boundary should be explicit.
+
+### Desktop app responsibilities
+
+- launch or connect to one or more servers
+- maintain local UI state
+- maintain presentation state, navigation state, drafts, and preferences
+- cache and render the visible list of servers and workspaces returned by the server
+- render server-backed data and send user intent to the server
+
+### Server responsibilities
+
+- own all workspace-scoped behavior
+- own all file reads and writes
+- own all AI, session, and task execution behavior
+- own project discovery and runtime inspection
+- own skill, plugin, MCP, and config mutation
+- own local-runtime integration with OpenCode and related sidecars
+- expose all of that through a stable API surface for the app
+
+### Rule of thumb
+
+If something is a real workspace capability rather than transient UI state, it should live behind the server.
+
+The app is the interface. The server does the work.
+
+## Orchestrator Collapse Target
+
+The target architecture is not just "move app behavior behind the server".
+
+It is also:
+
+- stop treating the orchestrator as a separate long-term control plane
+- fold orchestrator-owned product/runtime capabilities into the main server
+- fold bootstrap and supervision responsibilities into the main server itself wherever possible
+
+Desired end state:
+
+```text
+desktop app or CLI
+-> starts or connects to one OpenWork server process
+-> OpenWork server owns workspace/runtime/product behavior
+-> OpenWork server supervises the local runtime pieces it needs
+```
+
+Not the desired end state:
+
+```text
+desktop app
+-> orchestrator control plane
+-> separate server control plane
+```
+
+What should move into the main server:
+
+- workspace activation and runtime control APIs
+- runtime status and health product surfaces
+- upgrade/control semantics exposed to clients
+- config/skill/plugin/MCP mutation flows
+- OpenCode integration behavior that is really a workspace capability
+- other orchestrator control-plane logic that clients should not need to understand separately
+- process supervision for OpenCode/router/runtime pieces where practical
+- sidecar/binary/runtime resolution where practical
+- local bootstrap logic that only exists to support the OpenWork runtime
+
+The desktop app should ideally only launch the main server process, not assemble and supervise a second runtime graph itself.
+
+## Route Strategy
+
+The new server should expose OpenWork-shaped routes directly.
+
+Recommendation:
+
+- use workspace-first OpenWork routes as the real public API shape
+- use `/system/*` for server-level operational and runtime endpoints that are not scoped to a workspace
+- do not design the route system around mounting under a legacy subpath
+- treat versioning as a deployment or compatibility concern, not as the primary organizing principle of the new server
+
+## Contract and SDK Strategy
+
+The new server should be the source of truth for its API contract.
+
+Detailed generator and script choices live in `prds/server-v2-plan/sdk-generation.md`.
+
+Planned approach:
+
+- define new-server routes in TypeScript with Hono and typed schemas
+- generate an OpenAPI spec from the Hono app, likely with `hono-openapi`
+- generate a TypeScript SDK from that OpenAPI spec
+- consume that SDK from a small app-side `createSdk({ serverId })` adapter instead of calling raw paths directly
+
+This keeps the server contract synchronized through code generation instead of manual duplication.
+
+### Recommended package shape
+
+```text
+apps/server-v2/
+├── src/...
+└── openapi/
+    └── openapi.json             # generated
+
+packages/openwork-server-sdk/
+├── generated/                  # generated from OpenAPI
+├── src/index.ts                # stable server-agnostic exports
+└── package.json
+
+apps/app/
+└── ... app-side `createSdk({ serverId })` adapter
+```
+
+### Rules
+
+- The Hono route definitions and schemas are the source of truth.
+- The OpenAPI spec is a generated artifact.
+- `hono-openapi` is the leading candidate for spec generation because it is built for Hono and aligns with the V2 stack.
+- The SDK is generated from the spec and stays TypeScript-native.
+- The generated SDK package should stay server-agnostic and reusable.
+- App features should call a single app-side entrypoint such as `createSdk({ serverId })`.
+- `createSdk({ serverId })` should live in app code, resolve server config locally, and prepare a typed client with the correct base URL and token.
+- The app should not pass raw `baseUrl` and `token` around feature code.
+- The app should not implement parallel workspace behavior when that behavior can be expressed as a server capability.
+- For standard JSON endpoints, the generated SDK should be the primary client surface.
+- For the one or two SSE endpoints, we may need small handwritten streaming helpers exposed from the same SDK package.
+- `hono-openapi` covers contract generation, not the full client story; SDK generation and SSE helpers remain separate concerns.
+
+### Why not import server code directly?
+
+We want shared contracts, not shared runtime implementation.
+
+- clients should share types and operations with the server
+- clients should not import server internals, Hono handlers, or server runtime wiring
+- the server must remain free to evolve internally without leaking implementation structure into the app
+
+### App-facing SDK shape
+
+Preferred app usage:
+
+```ts
+await createSdk({ serverId }).sessions.listMessages({ workspaceId, sessionId })
+```
+
+This gives us:
+
+- generated endpoint methods and types
+- explicit server selection through `serverId`
+- explicit resource selection through `workspaceId`, `sessionId`, and similar params
+- no need for a large handwritten fluent wrapper layer
+- no coupling between app code and server source files
+
+## Local Dev Contract Workflow
+
+The generated SDK should work in local development, not only in CI.
+
+Detailed watch-mode workflow lives in `prds/server-v2-plan/local-dev.md`.
+
+Desired loop:
+
+1. change a new-server Hono endpoint or schema
+2. regenerate the OpenAPI spec locally
+3. regenerate the TypeScript SDK locally
+4. app code sees the updated types and client methods immediately
+
+Recommended local setup:
+
+- `apps/server-v2` watches `src/**` and regenerates `openapi/openapi.json`
+- `packages/openwork-server-sdk` watches `openapi/openapi.json` and regenerates the reusable generated client package
+- `packages/openwork-server-sdk` regenerates the reusable server-agnostic client package
+- the app watches its own `createSdk({ serverId })` adapter alongside normal app code
+- the app depends on `openwork-server-sdk` through the workspace so type updates are visible immediately
+- if the SDK needs a build step, run that build in watch mode too
+
+To avoid restart loops, the server runtime watcher should ignore generated spec and SDK files.
+
+This should make endpoint changes flow into the app with minimal delay during development.
+
+### CI enforcement
+
+Local watch mode is a convenience. CI should still be the guardrail.
+
+CI should:
+
+- regenerate the OpenAPI spec
+- regenerate the SDK
+- fail if regeneration produces a git diff
+
+That makes contract drift visible immediately and keeps the generated client trustworthy.
+
+## Migration Strategy
+
+Detailed UI and desktop rollout strategy lives in `prds/server-v2-plan/ui-migration.md`.
+
+### Phase 0: Create the new server package and contract loop
+
+- Create the new server package under `apps/server-v2/`.
+- Add a minimal Hono app entrypoint.
+- Add a minimal health or test route to prove the server boots and serves requests.
+- Add OpenAPI generation for the new server, likely via `hono-openapi`.
+- Add a generated TypeScript SDK package for the new server.
+- Add an app-side `createSdk({ serverId })` adapter before migrating individual features.
+- Document which desktop-owned capabilities must move behind the server over time.
+- Define the first-run import path for existing app/orchestrator state that should move into the new server DB.
+
+Success criteria:
+
+- The new server boots independently.
+- OpenAPI generation and SDK generation succeed locally.
+- The app can target the new server through one adapter layer.
+
+### Phase 0.5: Absorb existing local product state into the server DB
+
+Before feature slices can fully move, the new server needs a clear story for taking over the durable state the app and orchestrator own today.
+
+- import or normalize workspace records from current desktop state such as `openwork-workspaces.json`
+- import remote workspace mappings and selected connection metadata into the server registry
+- import or reconstruct cloud auth/session metadata into the server-owned sqlite model
+- import or normalize orchestrator state snapshots that still matter for reconnect or migration
+- make the migration idempotent so the server can retry safely on startup
+
+Success criteria:
+
+- the server can reconstruct its canonical sqlite state from current local product state without manual hand edits
+- post-migration app startup reads server-owned workspace and connection state instead of rebuilding it locally
+- migration failures are visible and recoverable instead of silently leaving split ownership behind
+
+### Phase 1: Move low-risk read endpoints first
+
+Start with read-only or low-risk endpoints so the migration path is proven before touching write flows.
+
+- Implement new endpoints in Hono.
+- Point a small, isolated desktop surface at the new server.
+- Compare behavior against the existing implementation.
+
+Success criteria:
+
+- The desktop app can use at least one new-server endpoint in production-like flows.
+- The app-side adapter can route that surface to the new server cleanly.
+
+### Phase 2: Move mutations and workflow endpoints
+
+Once the structure is stable, move write paths and workflow endpoints into the new server in slices.
+
+- Port one capability area at a time.
+- Keep domain behavior consistent while the transport layer changes.
+- Avoid broad dual-write logic unless absolutely necessary.
+
+Success criteria:
+
+- End-to-end feature flows work through the new server for selected areas.
+- The new server becomes credible as the real future server.
+
+### Phase 3: Collapse orchestrator control-plane responsibilities into the server
+
+Once the server surface is credible, start moving orchestrator-owned product capabilities into the main server.
+
+- move workspace/runtime control APIs into the server
+- move orchestrator daemon API semantics into server-owned routes
+- move config/skill/plugin/MCP mutation ownership into the server
+- move bootstrap and supervision logic into the server so clients do not depend on a separate host runtime manager
+
+Success criteria:
+
+- clients do not need a separate orchestrator API model
+- server routes become the canonical runtime/workspace control surface
+- orchestrator disappears as a meaningful product layer
+
+### Phase 4: Make the new server the default desktop runtime
+
+- Switch desktop startup to launch the new server.
+- Switch desktop API clients to use the new server by default.
+- Monitor for gaps in auth, payload shape, and error handling.
+
+Success criteria:
+
+- New desktop traffic uses the new server by default.
+- The old server is no longer on the critical path for normal desktop usage.
+
+### Phase 5: Remove the old server and leftover orchestrator code
+
+- Delete the old server implementation once all consumers are moved.
+- Promote the new server package to be the only server implementation that matters.
+- delete or absorb orchestrator code that only existed to provide a separate control plane or bootstrap layer
+
+Success criteria:
+
+- No active desktop path depends on the old server.
+- All server behavior lives in the new server package.
+- orchestrator is no longer needed as a separate product/runtime layer.
+
+## Desktop App Requirements
+
+To migrate safely, the desktop app should introduce a server-facing boundary before moving features.
+
+The desired end state is not just route migration. It is responsibility migration.
+
+The desktop app should become a thin client.
+
+Requirements:
+
+- one module owns server resolution from `serverId`
+- features call typed operations, not literal URL paths
+- route selection can happen per endpoint or per feature area while migration lasts
+- the target server is selected explicitly by `serverId`, not hidden global state
+- it is easy to see which calls have been moved to the new server
+- the app only owns transient UI state, not durable workspace behavior
+- the app can list known servers and the workspaces available within each server
+- workspace reads, writes, AI actions, and config mutations should route through the server
+
+Nice-to-have follow-ups:
+
+- a feature flag or config switch for targeted rollout
+- a capability probe so the app can detect new-server support from the server
+- simple request logging that shows whether traffic used the current or new server during migration
+
+### Client SDK model
+
+The app may talk to multiple server destinations, but the preferred API is still one SDK entrypoint.
+
+Examples:
+
+- local desktop-hosted server
+- remote worker-backed server
+- hosted OpenWork Cloud server
+
+Because of that, SDK creation may still take an explicit `serverId` during migration and server-management flows.
+
+The key separation is:
+
+- the SDK resolves which server to call from `serverId` when needed
+- each operation receives the workspace ID to use on that server
+
+That matters because one server can host many workspaces, and the system can know about many servers at once.
+
+Example shape:
+
+```ts
+const sdk = createSdk({ serverId })
+
+await sdk.sessions.list({ workspaceId })
+await sdk.sessions.get({ workspaceId, sessionId })
+await sdk.sessions.listMessages({ workspaceId, sessionId })
+```
+
+Illustrative app-side record while migration is in progress:
+
+```ts
+type WorkspaceRecord = {
+  id: string
+  serverTargetId: string
+}
+```
+
+In the ideal model, the local OpenWork server owns the durable mapping between:
+
+- OpenWork workspace ID
+- remote OpenWork workspace ID
+- OpenCode project ID
+- backend server identity
+
+The app should usually operate on stable OpenWork workspace IDs returned by the local server, not on remote backend IDs directly.
+
+The generated SDK should stay transport-level and typed. The thin handwritten adapter should own:
+
+- server target selection
+- auth headers and tokens
+- temporary old-server versus new-server decision-making during migration
+- lightweight client preparation
+- capability checks and fallbacks
+
+It should not grow into a second workspace engine inside the app.
+
+In the ideal steady state, normal product traffic should target the local OpenWork server as the canonical adapter and registry, while direct alternate `serverId` targeting is reserved for explicit server-management or migration/testing scenarios.
+
+### SSE endpoint strategy
+
+Most new-server endpoints should be standard request/response endpoints covered directly by the generated SDK.
+
+For the likely one or two SSE endpoints:
+
+- the OpenWork server should still be the only streaming surface the app talks to
+- the SSE routes should still be documented in the new server contract
+- event payloads should still be typed from generated or shared contract types, not imported directly from server source
+- we may need a small handwritten streaming helper because most OpenAPI generators do not produce an ergonomic typed SSE client automatically
+
+Goal:
+
+- normal endpoints: fully generated TypeScript SDK methods
+- SSE endpoints: small typed streaming helpers exposed from the same package so app usage still feels unified
+
+## Architectural Principles
+
+- **New code in new files**: treat the new server package as the replacement tree, not as an extension of legacy code.
+- **New server first**: design the replacement as its own server, not as a mounted extension of the old one.
+- **One slice at a time**: move vertical feature slices instead of mixing many partial migrations.
+- **Explicit routing**: desktop traffic should move to the new server intentionally, not accidentally.
+- **Server-owned workspace behavior**: file access, AI/runtime behavior, project/config mutation, and other workspace capabilities belong to the server, not the UI.
+- **Thin desktop app**: the app should mainly launch/connect servers, hold local presentation state, and render server-backed workflows.
+- **Delete as you go**: once a feature is fully on the new server, remove the corresponding legacy code instead of letting both versions linger.
+
+## Risks
+
+- The desktop app may have too many direct server path references, making migration noisy until a client boundary exists.
+- The desktop app currently owns native and local behavior that should eventually move behind the server boundary.
+- Shared auth/session/runtime behavior may be entangled with the old server boot path.
+- Orchestrator responsibilities may be tightly coupled to host bootstrapping, making it harder to separate true bootstrap concerns from product control-plane concerns.
+- Old-server and new-server payloads may drift if both are maintained for too long.
+
+## Open Questions
+
+- Which server surface is the best first slice to migrate as a proof point?
+- Are there any external consumers besides the desktop app that must keep using the old server during the transition?
+- At what point should desktop startup switch to the new server by default?
+- What bootstrap responsibilities truly must remain outside the server process, if any, once orchestration is folded inward?
+
+## Immediate Next Steps
+
+1. Create `apps/server-v2/` as the new server package.
+2. Add OpenAPI generation for the new Hono app.
+3. Create a TypeScript SDK package generated from the new server OpenAPI spec.
+4. Define the new server startup path the desktop app will eventually launch.
+5. Add `createSdk({ serverId })` so the app resolves server config without passing raw URLs and tokens around.
+6. Define the one or two SSE endpoints and their typed event payloads.
+7. Inventory desktop-owned workspace capabilities and prioritize which ones move behind the server first.
+8. Identify the first orchestrator-owned control-plane capability to fold into the main server.
+9. Identify the first low-risk endpoint group to migrate.
+10. Port the first feature slice end to end and use it as the template for the rest.
diff --git a/prds/server-v2-plan/schema.md b/prds/server-v2-plan/schema.md
new file mode 100644
index 0000000000..60d72a92b6
--- /dev/null
+++ b/prds/server-v2-plan/schema.md
@@ -0,0 +1,497 @@
+# Server V2 Schema And State Model
+
+## Status: Draft
+## Date: 2026-04-13
+
+## Purpose
+
+This document defines the preferred server-owned sqlite schema direction for Server V2, along with the related filesystem layout and API-shape decisions.
+
+It also identifies desktop-owned state that should be moved into the server database as part of the thin-client transition.
+
+## Core Rule
+
+The local OpenWork server should become the durable owner of product state that is not inherently owned by OpenCode.
+
+That means:
+
+- OpenCode owns session/project runtime state
+- OpenWork server owns workspace registry, config registry, remote connections, and product metadata
+- the desktop app should stop being the long-term owner of those records
+
+## Database Scope
+
+The sqlite DB is for OpenWork-owned metadata and relationships.
+
+It should not become a duplicate source of truth for:
+
+- session messages
+- archived flags
+- session titles
+- other OpenCode-native session state
+
+Those should still come live from OpenCode or remote OpenWork servers.
+
+## Tables
+
+### `servers`
+
+Purpose:
+
+- store the set of known server connections the local product knows about
+
+Rows should represent:
+
+- one local server
+- zero or more remote servers
+
+Suggested columns:
+
+- `id`
+- `kind` (`local`, `remote`)
+- `hosting_kind` (`desktop`, `self_hosted`, `cloud`)
+- `label`
+- `base_url`
+- `token_ref` or encrypted token material
+- `capabilities_json`
+- `is_local`
+- `is_enabled`
+- `created_at`
+- `updated_at`
+- `last_seen_at`
+
+Notes:
+
+- `server` is a real model in the product, even if it is not yet exposed directly in the UI.
+- The app can still render a workspace-first experience while the server keeps the canonical registry.
+- Remote and cloud servers should both be modeled as remote OpenWork servers at the product level; `hosting_kind` captures whether a remote server is cloud-hosted or not.
+
+### `workspaces`
+
+Purpose:
+
+- store the canonical OpenWork workspace registry
+
+Suggested columns:
+
+- `id`
+- `server_id`
+- `kind` (`local`, `remote`, `control`, `help`)
+- `display_name`
+- `slug`
+- `is_hidden`
+- `status`
+- `opencode_project_id` nullable
+- `remote_workspace_id` nullable
+- `data_dir` nullable
+- `config_dir` nullable
+- `notes_json` nullable
+- `created_at`
+- `updated_at`
+
+Rules:
+
+- every workspace points at exactly one server
+- local workspaces keep a stable OpenWork workspace ID that is separate from the OpenCode project ID
+- remote workspaces map to exactly one workspace on a remote OpenWork server
+- control/help workspaces are real workspaces with `is_hidden = true`
+- the local OpenWork server is still the canonical routing layer that the app talks to, even when a workspace belongs to a remote server
+
+### `server_runtime_state`
+
+Purpose:
+
+- store server-wide supervision and health state for bundled runtime dependencies
+
+Suggested columns:
+
+- `server_id`
+- `runtime_version`
+- `opencode_status`
+- `opencode_version`
+- `opencode_base_url` nullable
+- `router_status`
+- `router_version` nullable
+- `restart_policy_json` nullable
+- `last_started_at` nullable
+- `last_exit_json` nullable
+- `updated_at`
+
+Notes:
+
+- this is the server-owned place for runtime health, crash history, and extracted-runtime metadata
+- this is distinct from workspace-level diagnostic state because OpenCode and router are supervised at the server level
+
+### `workspace_runtime_state`
+
+Purpose:
+
+- optional server-owned state about runtime health and derived metadata for each workspace
+
+Suggested columns:
+
+- `workspace_id`
+- `backend_kind` (`local_opencode`, `remote_openwork`)
+- `last_sync_at`
+- `last_session_refresh_at`
+- `last_error_json`
+- `health_json`
+
+Notes:
+
+- this is not the source of truth for sessions
+- it is just runtime/cache/diagnostic state the server may want
+
+### `mcps`
+
+Purpose:
+
+- store MCP definitions and related auth/config metadata as OpenWork-managed records
+
+Suggested columns:
+
+- `id`
+- `kind`
+- `display_name`
+- `config_json`
+- `auth_json`
+- `source` (`openwork_managed`, `imported`, `discovered`)
+- `created_at`
+- `updated_at`
+
+### `skills`
+
+Purpose:
+
+- store OpenWork-managed skill metadata
+
+Suggested columns:
+
+- `id`
+- `slug`
+- `display_name`
+- `body_ref` or `content_hash`
+- `source` (`openwork_managed`, `imported`, `discovered`, `cloud_synced`)
+- `cloud_item_id` nullable
+- `created_at`
+- `updated_at`
+
+### `plugins`
+
+Purpose:
+
+- store plugin definitions and enabled-state metadata
+
+Suggested columns:
+
+- `id`
+- `plugin_key`
+- `display_name`
+- `config_json`
+- `source`
+- `created_at`
+- `updated_at`
+
+### `provider_configs`
+
+Purpose:
+
+- store provider definitions, credentials references, and assignment metadata
+
+Suggested columns:
+
+- `id`
+- `provider_key`
+- `display_name`
+- `config_json`
+- `auth_json`
+- `source`
+- `created_at`
+- `updated_at`
+
+### `cloud_signin`
+
+Purpose:
+
+- store local server-owned cloud auth/session metadata
+
+Suggested columns:
+
+- `id`
+- `cloud_base_url`
+- `user_id`
+- `org_id`
+- `auth_json`
+- `last_validated_at`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- cloud sign-in should stop being purely app-owned preference state
+- the server should be able to own and apply this state directly
+
+### `workspace_shares`
+
+Purpose:
+
+- store share/access state for local workspaces that are exposed remotely
+
+Suggested columns:
+
+- `id`
+- `workspace_id`
+- `access_key_ref` or encrypted key material
+- `status` (`active`, `revoked`, `disabled`)
+- `last_used_at` nullable
+- `audit_json` nullable
+- `created_at`
+- `updated_at`
+- `revoked_at` nullable
+
+Notes:
+
+- access should be scoped to one workspace, not granted server-wide by default
+- the initial product shape can assume zero or one active share record per local workspace, while leaving room for later expansion
+
+### `router_identities`
+
+Purpose:
+
+- store server-owned router identities and their persisted config/auth metadata
+
+Suggested columns:
+
+- `id`
+- `server_id`
+- `kind`
+- `display_name`
+- `config_json`
+- `auth_json`
+- `is_enabled`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- router identity state should be server-level, not app-local
+- the server can still project this into router config files or runtime config as needed
+
+### `router_bindings`
+
+Purpose:
+
+- store server-owned router bindings and delivery targets
+
+Suggested columns:
+
+- `id`
+- `server_id`
+- `router_identity_id`
+- `binding_key`
+- `config_json`
+- `is_enabled`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- bindings are what determine whether router startup is needed at all
+- later models can add workspace scoping or policy tables without changing the basic server-owned direction
+
+## Linking Tables
+
+These tables are what let OpenWork own config items once and apply them to one or many workspaces.
+
+### `workspace_mcps`
+
+- `workspace_id`
+- `mcp_id`
+- `created_at`
+- `updated_at`
+
+### `workspace_skills`
+
+- `workspace_id`
+- `skill_id`
+- `created_at`
+- `updated_at`
+
+### `workspace_plugins`
+
+- `workspace_id`
+- `plugin_id`
+- `created_at`
+- `updated_at`
+
+### `workspace_provider_configs`
+
+- `workspace_id`
+- `provider_config_id`
+- `created_at`
+- `updated_at`
+
+Notes:
+
+- nothing should be global by default
+- when a config item is created, the user chooses which workspaces it should apply to
+- when a workspace is created, the server/UI can offer existing config items to attach
+
+## Other Desktop-Owned State That Should Move Into The Server DB
+
+Beyond the core tables above, the server should absorb other state that currently tends to live in the desktop app.
+
+### Cloud settings and user auth
+
+Should move into the server DB:
+
+- cloud base URL
+- user auth/session state
+- selected org or cloud account metadata
+- cloud validation status
+
+Reason:
+
+- this is product state, not presentation state
+- the server should be able to own cloud-backed behavior directly
+
+### Cloud-synced item metadata
+
+Should move into the server DB:
+
+- mappings to cloud-synced skills/plugins/providers
+- imported/discovered state
+- sync status and timestamps
+
+Reason:
+
+- it belongs with the config and workspace registry the server owns
+
+### Workspace share metadata
+
+Should move into the server DB:
+
+- workspace-scoped share/access keys
+- share status
+- share timestamps and audit fields
+
+Reason:
+
+- remote exposure of local workspaces is a server capability
+- this should land in `workspace_shares` or an equivalent server-owned table
+
+### Server/workspace relationship state
+
+Should move into the server DB:
+
+- which workspace belongs to which server
+- hidden control/help workspace metadata
+- remote workspace mappings
+- local OpenWork workspace ID <-> OpenCode project ID mappings
+
+Reason:
+
+- this is the canonical product graph the app should query, not reconstruct locally
+
+## Session Query Strategy
+
+For now:
+
+- session lists and session state can be queried live
+- local server queries OpenCode for local workspaces
+- local server queries remote OpenWork servers for remote workspaces
+
+Optional later enhancements:
+
+- light server-side cache/index tables
+- UI cache for responsiveness
+
+But the authoritative state should remain live in the backend systems.
+
+## Config Reconciliation Strategy
+
+Config reconciliation should use both:
+
+- file watching
+- periodic or pull-based reconciliation
+
+### File watching
+
+Use for:
+
+- fast local detection of config changes in managed directories
+- quick projection/update of DB state
+
+### Periodic or pull-based reconciliation
+
+Use for:
+
+- startup repair
+- recovering from missed file watcher events
+- validating that disk state and DB state still match
+
+### Absorption rules
+
+- if a file clearly matches a known managed concept like MCP, Skill, Plugin, or Provider Config, absorb it into the DB
+- if it does not match a known managed concept, leave it in the directory for now
+
+## Filesystem Layout
+
+Current preferred direction:
+
+```text
+<server-working-dir>/workspaces/<workspaceId>/config
+```
+
+Where:
+
+- the user chooses the workspace data directory
+- OpenWork creates and owns the config directory
+- OpenCode is pointed at the OpenWork-owned config directory
+- the user data directory is added as an authorized path
+
+This gives a clean separation between:
+
+- user-owned data
+- OpenWork-owned config
+- OpenCode-owned runtime state
+
+## API Shape
+
+All session and workspace behavior should be exposed through workspace-first OpenWork routes.
+
+That means:
+
+- the client sends `workspaceId`
+- the server resolves the backend mapping
+- the server talks to OpenCode or a remote OpenWork server
+- the client never needs raw OpenCode endpoint shapes
+
+Recommended principle:
+
+- normalize everything into OpenWork-shaped endpoints
+- do not expose raw OpenCode endpoint design directly as the public product API
+
+## Initial Primitive Surface
+
+The initial OpenCode-derived session surface should still include the primitives already listed in `prds/server-v2-plan/ideal-flow.md`, but wrapped in OpenWork route design.
+
+That means:
+
+- session listing
+- session creation/update/delete
+- session status and todos
+- init/fork/abort/share/unshare/summarize
+- message list/get/send/update/delete
+- prompt async / command / shell
+- revert / unrevert
+
+The naming and nesting should be workspace-first.
+
+## Recommended Next Step
+
+The next useful design doc after this one is a route-shape doc that turns these schema decisions into:
+
+- workspace-first REST route patterns
+- request/response envelope shape
+- mapping rules from OpenWork routes to OpenCode SDK calls
diff --git a/prds/server-v2-plan/sdk-generation.md b/prds/server-v2-plan/sdk-generation.md
new file mode 100644
index 0000000000..ba0953e837
--- /dev/null
+++ b/prds/server-v2-plan/sdk-generation.md
@@ -0,0 +1,289 @@
+# Server V2 SDK Generation
+
+## Status: Draft
+## Date: 2026-04-09
+
+## Purpose
+
+This document defines the preferred toolchain for generating the Server V2 TypeScript SDK and how that generation should fit into local development and CI.
+
+This doc assumes Server V2 is a separate new server package, not a sub-application mounted inside the old server.
+
+## Current Recommendation
+
+Preferred stack:
+
+- OpenAPI spec generation: `hono-openapi`
+- TypeScript SDK generation: `@hey-api/openapi-ts`
+- Reusable client package: `packages/openwork-server-sdk`
+- App entrypoint: app-owned `createSdk({ serverId })`
+- SSE support: small handwritten helpers exposed from the SDK package, then wrapped by the app adapter
+
+## Why `@hey-api/openapi-ts`
+
+It is the leading SDK generator candidate because it fits the current plan well:
+
+- it generates TypeScript code from OpenAPI
+- it supports SDK-oriented output, not just raw schema types
+- it aligns better with a method-based client surface than a purely path-based fetch client
+- it works well in a monorepo package setup
+
+Compared with `openapi-typescript` + `openapi-fetch`:
+
+- `openapi-fetch` is lightweight and good, but it encourages a path-shaped client surface
+- `@hey-api/openapi-ts` is a better fit for the method-based SDK style we want underneath the app-side adapter
+
+## Important Caveat
+
+`@hey-api/openapi-ts` is still in active development and recommends pinning an exact version.
+
+We should treat that as a requirement:
+
+- pin an exact version in `package.json`
+- upgrade intentionally
+- regenerate the SDK in a dedicated PR when changing versions
+
+## Toolchain Roles
+
+### 1. `hono-openapi`
+
+Role:
+
+- derive the OpenAPI spec from the new server Hono app and its schemas
+
+Output:
+
+- `apps/server-v2/openapi/openapi.json`
+
+### 2. `@hey-api/openapi-ts`
+
+Role:
+
+- generate the TypeScript SDK package from `apps/server-v2/openapi/openapi.json`
+
+Output:
+
+- `packages/openwork-server-sdk/generated/**`
+
+### 3. Handwritten SDK package files
+
+Role:
+
+- expose server-agnostic helpers over the generated client
+- expose small typed SSE helpers
+
+Files:
+
+- `packages/openwork-server-sdk/src/index.ts`
+- `packages/openwork-server-sdk/src/streams/**`
+
+### 4. App-side adapter
+
+Role:
+
+- export the app-facing `createSdk({ serverId })`
+- resolve `serverId` to current runtime config
+- inject base URL and auth/token
+- select between the current and new server behavior during migration
+
+Files:
+
+- `apps/app/.../createSdk.ts`
+
+## Proposed Package Layout
+
+```text
+apps/server-v2/
+├── src/**
+└── openapi/
+    └── openapi.json
+
+packages/openwork-server-sdk/
+├── package.json
+├── openapi-ts.config.ts
+├── generated/**
+├── src/
+│   ├── streams/
+│   └── index.ts
+└── scripts/
+    └── watch.mjs
+
+apps/app/
+└── ... app-side `createSdk({ serverId })` adapter
+```
+
+## App-Facing Shape
+
+The overall app-facing shape should be:
+
+```ts
+await createSdk({ serverId }).sessions.listMessages({ workspaceId, sessionId })
+```
+
+That means:
+
+- generated methods remain the main surface for normal endpoints
+- `createSdk({ serverId })` is an app-owned thin runtime adapter
+- the reusable SDK package stays server-agnostic
+- SSE helpers live in the SDK package and are wrapped by the app adapter as needed
+
+## Generation Flow
+
+One-shot flow:
+
+```text
+apps/server-v2/src/**
+-> hono-openapi
+-> apps/server-v2/openapi/openapi.json
+-> @hey-api/openapi-ts
+-> packages/openwork-server-sdk/generated/**
+```
+
+## Mixed Old/New Routing During Migration
+
+The generated SDK package should represent the new server contract only.
+
+During migration, typed fallback behavior for legacy server routes should live in app-owned adapter code rather than in the generated SDK package itself.
+
+Recommended split:
+
+- `packages/openwork-server-sdk`: generated Server V2 client plus small handwritten SSE helpers for Server V2
+- `apps/app/.../createSdk.ts`: rollout checks, capability gating, and per-operation routing
+- `apps/app/.../legacy/`: small handwritten compatibility shims for old-server calls that have not been ported yet
+
+Rules:
+
+- do not try to generate one SDK that merges old and new server contracts together
+- keep legacy compatibility shims thin and delete them as soon as a feature slice is fully on the new server
+- if a legacy route must be used temporarily, normalize its result in the app adapter before returning it to the rest of the UI
+- the app-facing call site should still look like `createSdk({ serverId })...` so migration logic stays out of feature code
+
+## Scripts Shape
+
+The exact implementation can vary, but the command model should look like this.
+
+### `apps/server-v2/package.json`
+
+```json
+{
+  "scripts": {
+    "openapi:generate": "node ./scripts/generate-openapi.mjs",
+    "openapi:watch": "node ./scripts/watch-openapi.mjs"
+  }
+}
+```
+
+Notes:
+
+- these scripts should load the new server Hono app and emit `openapi/openapi.json`
+- they should use `hono-openapi`
+- `openapi:watch` should only watch `src/**`
+
+### `packages/openwork-server-sdk/package.json`
+
+```json
+{
+  "scripts": {
+    "generate": "openapi-ts -c openapi-ts.config.ts",
+    "watch": "node ./scripts/watch.mjs",
+    "typecheck": "tsc --noEmit"
+  }
+}
+```
+
+Notes:
+
+- `generate` should run `@hey-api/openapi-ts` against `apps/server-v2/openapi/openapi.json`
+- `watch` can be a small file watcher that reruns `generate` when `openapi/openapi.json` changes
+- `typecheck` ensures the generated output and handwritten SDK helpers still compile together
+
+### Root `package.json`
+
+```json
+{
+  "scripts": {
+    "dev:server-v2": "pnpm run dev:server-v2:watchers",
+    "dev:server-v2:watchers": "node ./scripts/dev-server-v2.mjs",
+    "sdk:generate": "pnpm --filter openwork-server-v2 openapi:generate && pnpm --filter @openwork/server-sdk generate"
+  }
+}
+```
+
+Intent:
+
+- `dev:server-v2` starts the combined dev graph
+- `sdk:generate` is the one-shot contract regeneration command for local use and CI
+
+## Suggested Watch Implementation
+
+We should not depend on every tool having perfect built-in watch support.
+
+Instead, prefer small repo-local watcher scripts where needed.
+
+Examples:
+
+- `apps/server-v2/scripts/watch-openapi.mjs`
+  - watch `src/**`
+  - rerun OpenAPI generation
+- `packages/openwork-server-sdk/scripts/watch.mjs`
+  - watch `../../apps/server-v2/openapi/openapi.json`
+  - rerun `openapi-ts`
+- `scripts/dev-server-v2.mjs`
+  - run backend dev watch
+  - run OpenAPI watch
+  - run SDK watch
+  - run app dev, which includes the app-side adapter
+
+This gives us full control over debounce behavior, ignores, and restart-loop prevention.
+
+## Runtime Choice
+
+The server runtime remains Bun-based.
+
+The code generation toolchain does not need to match the runtime exactly.
+
+That means:
+
+- `apps/server-v2` can continue running with Bun in dev and production
+- code generation can run via `pnpm` and Node-based tooling where needed
+
+This is acceptable because code generation is a build-time/dev-time concern, not a runtime server concern.
+
+## CI Commands
+
+The CI contract check should reduce to one command or one short chain.
+
+Preferred shape:
+
+```bash
+pnpm --filter openwork-server-v2 openapi:generate && pnpm --filter @openwork/server-sdk generate && git diff --exit-code
+```
+
+That gives us:
+
+- one contract regeneration path
+- identical logic between local and CI flows
+- immediate detection of stale generated files
+
+## SSE and Generation Boundary
+
+The one or two SSE endpoints should still appear in the new server contract, but they should not block the rest of the SDK generation plan.
+
+Recommended split:
+
+- normal request/response endpoints: generated with `@hey-api/openapi-ts`
+- SSE helpers: handwritten in `packages/openwork-server-sdk/src/streams/**`
+- typed event payloads: generated or shared contract types only, never imported directly from server source
+
+This keeps the custom surface small.
+
+## Decision Summary
+
+We should plan around:
+
+- `hono-openapi` for OpenAPI generation
+- `@hey-api/openapi-ts` for SDK generation
+- app-owned `createSdk({ serverId })` as the app-facing entrypoint
+- small handwritten SSE helpers for the limited streaming surface
+
+This is the most balanced path between strong typing, monorepo ergonomics, explicit contracts, and low ongoing maintenance.
diff --git a/prds/server-v2-plan/spawning-opencode.md b/prds/server-v2-plan/spawning-opencode.md
new file mode 100644
index 0000000000..5159630339
--- /dev/null
+++ b/prds/server-v2-plan/spawning-opencode.md
@@ -0,0 +1,488 @@
+# Spawning OpenCode
+
+## Status: Draft
+## Date: 2026-04-13
+
+## Purpose
+
+This document describes the local helper we need for starting OpenCode when the new server ships with a bundled OpenCode binary.
+
+The key problem is:
+
+- `@opencode-ai/sdk` provides a `createOpencode()` helper
+- that helper expects to launch `opencode` from `PATH`
+- our distribution plan wants the OpenWork server to ship its own bundled OpenCode binary
+- therefore we need a local helper that mimics the useful startup behavior while allowing an explicit binary path
+
+## Design Goal
+
+Build a small local helper that:
+
+- starts OpenCode directly with Bun runtime process APIs
+- accepts an explicit binary path
+- waits until OpenCode is actually ready
+- accepts a custom config object generated by the OpenWork server
+- returns an OpenCode HTTP client from `@opencode-ai/sdk`
+- does not modify the upstream SDK
+
+The SDK should still be used for the HTTP client.
+
+The SDK should not be used for server startup.
+
+## Why We Need This
+
+In the target Server V2 distribution model:
+
+- `openwork-server-v2` is the primary executable
+- it embeds `opencode`
+- it extracts `opencode` into a managed runtime directory
+- it launches that exact binary path
+
+So the normal case is not:
+
+- look on `PATH` for `opencode`
+
+The normal case is:
+
+- use the exact extracted OpenCode binary path managed by the server runtime
+
+That means relying on `PATH` is the wrong startup model.
+
+We need deterministic control over:
+
+- which `opencode` binary is launched
+- which hostname and port it binds to
+- which config blob it receives
+- how readiness and failure are detected
+
+That config blob should come from the OpenWork server's own database-backed config model, not from ad hoc client state.
+
+## Proposed Helper Location
+
+Suggested local helper location:
+
+```text
+apps/server-v2/src/adapters/opencode/local.ts
+```
+
+This should remain app-local/server-local code, not a patch to `node_modules`.
+
+## Proposed Public API
+
+Use one exported function:
+
+```ts
+createLocalOpencode(opts?)
+```
+
+Suggested signature:
+
+```ts
+type CreateLocalOpencodeOptions = {
+  binary?: string
+  hostname?: string
+  port?: number
+  timeout?: number
+  signal?: AbortSignal
+  config?: Record<string, unknown>
+  client?: Record<string, unknown>
+}
+```
+
+Suggested defaults:
+
+- `binary`: omitted only if the helper can resolve the extracted bundled runtime binary path from server-managed runtime state; otherwise startup should fail
+- `hostname`: `"127.0.0.1"`
+- `port`: `4096`
+- `timeout`: `5000`
+
+Important rule:
+
+- the helper should not rely on `PATH`
+- the helper should always launch the bundled OpenCode binary extracted by the server runtime
+- if no explicit bundled binary path is available, that should be treated as a startup error, not as a signal to fall back to a system binary
+
+## Runtime Behavior
+
+The helper should:
+
+1. resolve the binary path
+2. spawn OpenCode with `serve`
+3. watch stdout/stderr for readiness
+4. parse the listening URL
+5. create an OpenCode HTTP client using `createOpencodeClient`
+6. return both the client and server process handle
+
+## Spawn Contract
+
+Spawn should use:
+
+```text
+binary
+serve
+--hostname=<hostname>
+--port=<port>
+```
+
+If `config.logLevel` exists, append:
+
+```text
+--log-level=<config.logLevel>
+```
+
+Environment should merge `process.env` with:
+
+```text
+OPENCODE_CONFIG_CONTENT=<json string>
+```
+
+Where:
+
+```ts
+JSON.stringify(config ?? {})
+```
+
+## Config Source Of Truth
+
+The config object passed into this helper should be generated by the OpenWork server.
+
+That means:
+
+- the server reads its sqlite state
+- the server resolves the effective config for the relevant runtime or workspace
+- the server materializes an OpenCode config object
+- the helper passes that object through `OPENCODE_CONFIG_CONTENT`
+
+The helper should not decide config policy.
+
+Its job is to:
+
+- receive the already-computed config object
+- serialize it
+- launch OpenCode with it
+
+This keeps the ownership boundary clean:
+
+- server DB and services own config state
+- the spawn helper owns process startup only
+
+## SDK Usage
+
+Use the SDK only for the HTTP client:
+
+```ts
+import { createOpencodeClient } from "@opencode-ai/sdk"
+```
+
+The helper should create the client after readiness:
+
+```ts
+createOpencodeClient({
+  baseUrl: url,
+  ...clientOpts,
+})
+```
+
+## Readiness Detection
+
+The helper should detect readiness by watching stdout and stderr for a line like:
+
+```text
+opencode server listening on http://...
+```
+
+It should:
+
+- capture stdout and stderr incrementally
+- parse the URL from the first matching line
+- treat that as the canonical base URL
+
+Suggested parser behavior:
+
+- scan each emitted line
+- match `http://...` or `https://...`
+- store the parsed URL exactly as reported
+
+## Failure Handling
+
+The helper should fail clearly in three main cases.
+
+### 1. Missing binary / `ENOENT`
+
+If the binary does not exist or cannot be launched:
+
+- reject immediately
+- include the binary path/name in the error
+- include a clear explanation that the executable was not found
+
+Suggested error shape:
+
+```text
+Failed to start OpenCode: executable not found at <binary>
+```
+
+### 2. Timeout before readiness
+
+If startup exceeds the timeout:
+
+- kill the child process
+- reject with a timeout error
+- include collected stdout/stderr in the error message
+
+Suggested error shape:
+
+```text
+OpenCode did not become ready within 5000ms.
+Collected output:
+...
+```
+
+### 3. Early exit before ready
+
+If the child exits before a readiness line is seen:
+
+- reject with an early-exit error
+- include exit code or signal
+- include collected stdout/stderr
+
+Suggested error shape:
+
+```text
+OpenCode exited before becoming ready (exit code 1).
+Collected output:
+...
+```
+
+## Runtime Exit And Crash Handling
+
+Startup success is not enough.
+
+The server also needs to handle the case where OpenCode exits or crashes after readiness.
+
+The helper and the surrounding runtime supervisor should support:
+
+- detecting unexpected child exit after readiness
+- surfacing a clear runtime state change to the rest of the server
+- exposing crash/error state to clients
+- controlled restart behavior
+
+### Required runtime behavior
+
+Once OpenCode is ready, the server should continue monitoring the process.
+
+If the child exits unexpectedly:
+
+- mark OpenCode as unhealthy or offline in runtime state
+- capture the exit code or signal
+- capture recent stdout/stderr for diagnostics
+- make that status visible through server APIs
+- either restart automatically or leave the process down based on the server's restart policy
+
+### Restart policy
+
+The exact restart policy is still a design decision, but the system should be built so it can support:
+
+- no automatic restart
+- bounded restart attempts with backoff
+- explicit manual restart via server control surface
+
+The important point is that OpenCode process failure must be a first-class runtime state, not an invisible child-process problem.
+
+## Abort Support
+
+If `signal` is provided:
+
+- attach an abort listener
+- kill the spawned child on abort if startup is still in progress
+- reject with an abort-related error
+
+The same signal can also be used later by the caller to coordinate shutdown policy if desired.
+
+## Returned Shape
+
+Suggested return shape:
+
+```ts
+type LocalOpencodeHandle = {
+  client: ReturnType<typeof createOpencodeClient>
+  server: {
+    url: string
+    close: () => void
+    proc: Bun.Subprocess
+  }
+}
+```
+
+Notes:
+
+- `client` is the upstream SDK HTTP client
+- `server.url` is the parsed listening URL
+- `server.close()` should terminate the spawned process
+- `server.proc` is the Bun subprocess handle for diagnostics and advanced lifecycle management
+
+The process handle should also make it possible for the server's runtime supervisor to observe post-start exit/crash behavior.
+
+## Suggested Implementation Notes
+
+Use:
+
+```ts
+import { createOpencodeClient } from "@opencode-ai/sdk"
+```
+
+Preferred runtime API inside `apps/server-v2`:
+
+```ts
+Bun.spawn(...)
+```
+
+Reasoning:
+
+- the new server is Bun-based
+- Bun is the runtime we are standardizing on for `apps/server-v2`
+- using Bun-native process APIs keeps the implementation aligned with the rest of the server runtime
+
+Compatibility note:
+
+- `node:child_process.spawn` would also work under Bun for many cases
+- but it should not be the preferred framing for this helper in the design docs
+- the helper should be documented as a Bun-based local runtime helper
+
+Implementation guidance:
+
+- use TypeScript
+- avoid `any`
+- collect output safely with bounded buffers if needed
+- make timeout cleanup and process cleanup deterministic
+- remove abort hooks, timers, and background readers after resolve/reject
+- only resolve once
+- continue observing the process after readiness so unexpected exit/crash can be surfaced to the runtime supervisor
+
+## Suggested Example Usage
+
+```ts
+const opencode = await createLocalOpencode({
+  binary: "/absolute/path/to/opencode",
+  config: {
+    model: "anthropic/claude-3-5-sonnet-20241022",
+  },
+})
+
+console.log(opencode.server.url)
+
+opencode.server.close()
+```
+
+## Tiny Usage Example
+
+```ts
+import { createLocalOpencode } from "./adapters/opencode/local"
+
+const opencode = await createLocalOpencode({
+  binary: "/runtime/opencode",
+  hostname: "127.0.0.1",
+  port: 4096,
+})
+
+const projects = await opencode.client.project.list()
+
+console.log(projects)
+
+opencode.server.close()
+```
+
+## Expected Implementation Skeleton
+
+Illustrative shape only:
+
+```ts
+import { createOpencodeClient } from "@opencode-ai/sdk"
+
+export async function createLocalOpencode(opts: CreateLocalOpencodeOptions = {}) {
+  // resolve defaults, including extracted bundled binary path when present
+  // spawn process with Bun.spawn
+  // capture stdout/stderr
+  // wait for readiness line
+  // enforce timeout
+  // reject on early exit
+  // create client with parsed URL
+  // return { client, server }
+}
+```
+
+## Relationship To The Distribution Plan
+
+This helper is important because it connects the runtime distribution plan to the actual server implementation.
+
+In the target distribution model:
+
+- `openwork-server-v2` embeds `opencode`
+- extracts it to a managed runtime directory
+- then uses this helper to launch the extracted binary by absolute path
+
+That makes startup deterministic and independent from whatever happens to be on `PATH`.
+
+## OpenCode Health Endpoint
+
+The server should expose an endpoint that allows clients to check OpenCode health.
+
+At minimum, clients should be able to ask:
+
+- is OpenCode running?
+- what version is running?
+- what URL is it bound to?
+- when did it last start or fail?
+
+Suggested shape:
+
+```text
+GET /system/opencode/health
+```
+
+Example response shape:
+
+```json
+{
+  "running": true,
+  "version": "1.2.27",
+  "baseUrl": "http://127.0.0.1:4096",
+  "lastStartedAt": "2026-04-13T12:00:00Z",
+  "lastExit": null
+}
+```
+
+If OpenCode crashed, the server should be able to report something like:
+
+```json
+{
+  "running": false,
+  "version": "1.2.27",
+  "baseUrl": "http://127.0.0.1:4096",
+  "lastStartedAt": "2026-04-13T12:00:00Z",
+  "lastExit": {
+    "code": 1,
+    "signal": null,
+    "at": "2026-04-13T12:05:00Z"
+  }
+}
+```
+
+This endpoint is important because the UI should not infer OpenCode health from indirect failures alone.
+
+The server should make runtime state explicit.
+
+## Recommendation
+
+Implement this helper locally in the new server codebase and treat it as the canonical OpenCode startup wrapper.
+
+It should be designed around the Bun-based runtime model of `apps/server-v2`, not around a generic Node-only process model.
+
+It should also be designed as one piece of a larger runtime supervision system, not just a fire-and-forget spawn helper.
+
+It should become the place where we later add:
+
+- version validation
+- health probes beyond stdout readiness
+- structured logs
+- cleanup/restart semantics
+- possibly router-adjacent startup coordination if needed
diff --git a/prds/server-v2-plan/tauri-audit.md b/prds/server-v2-plan/tauri-audit.md
new file mode 100644
index 0000000000..cb30d958e1
--- /dev/null
+++ b/prds/server-v2-plan/tauri-audit.md
@@ -0,0 +1,568 @@
+# Tauri Audit
+
+## Scope
+
+This audit covers the desktop-native layer under `apps/desktop`, especially `apps/desktop/src-tauri/**` and the desktop scripts that are directly part of dev/build/runtime.
+
+## Alignment Note
+
+This audit documents the current desktop-native footprint, not the final target-state boundary.
+
+To fully match `prds/server-v2-plan/ideal-flow.md`, durable workspace registry state, workspace watchers, config and file mutation, remote workspace persistence, and runtime/workspace control should move behind the main server, leaving the desktop shell with only native bootstrap, reconnect state, and UI-hosting duties.
+
+The goal is to document the desktop app lifecycle and every meaningful place where the desktop shell touches the local system, native runtime, sidecars, files, or OS services.
+
+This document now assumes the target architecture is a single main server API surface, with bootstrap and supervision responsibilities also collapsing into the server over time.
+
+## Disposition Labels
+
+- `Stay`: should remain in the desktop shell because it is truly native-shell, OS, packaging, windowing, or local UI-hosting behavior.
+- `Move`: should move behind the server because it is real workspace behavior or runtime coordination.
+- `Split`: the trigger or presentation may stay in the desktop shell, but the actual workspace/runtime capability should move behind the server.
+
+## High-Level Lifecycle
+
+1. Tauri boots the desktop shell.
+2. The shell registers native plugins, commands, deep-link handling, and exit behavior.
+3. Dev/build scripts prepare sidecars and frontend assets.
+4. The desktop layer starts or reconnects to the local OpenWork server host path.
+5. Any deeper runtime ownership of OpenCode, router, or orchestrator behavior is migration debt that should collapse inward behind the server over time.
+6. Workspace state is loaded and persisted.
+7. Native file watchers, dialogs, updater checks, and process management continue during the session.
+
+## App Shell Bootstrap
+
+Disposition guidance:
+
+- `run()` -> `Stay`
+- `stop_managed_services()` -> `Stay`
+- deep-link forwarding helpers -> `Stay`
+- window visibility helpers -> `Stay`
+- `set_dev_app_name()` -> `Stay`
+
+### `run()`
+
+- What it does: boots the native desktop shell, installs Tauri plugins, registers all Tauri commands, and wires the application lifecycle.
+- Called from and when: called from the desktop app entrypoint at application launch.
+- Ends up calling: Tauri plugin setup, command registration, window lifecycle hooks, deep-link hooks, updater support, shell/process support, and cleanup on exit.
+
+### `stop_managed_services()`
+
+- What it does: best-effort shutdown for native child services managed by the desktop shell.
+- Called from and when: called on app exit and exit-request flows.
+- Ends up calling: child-process kill paths for the engine, orchestrator, OpenWork server, and router.
+
+### `forwarded_deep_links()`, `emit_native_deep_links()`, `emit_forwarded_deep_links()`
+
+- What they do: normalize incoming deep links and forward them into the frontend as native events.
+- Called from and when: called when a second app instance is launched or when the OS opens the app via URL.
+- Ends up calling: Tauri event emission into the frontend.
+
+### `show_main_window()` / `hide_main_window()`
+
+- What they do: show, focus, or hide the native window.
+- Called from and when: called during reopen, second-instance handoff, and close interception flows.
+- Ends up calling: native window APIs.
+
+### `set_dev_app_name()`
+
+- What it does: renames the macOS process to `OpenWork - Dev` in dev mode.
+- Called from and when: called during desktop setup in dev mode.
+- Ends up calling: macOS process metadata APIs.
+
+## Dev And Build Pipeline
+
+Disposition guidance:
+
+- `tauri-before-dev.mjs` -> `Stay`
+- `tauri-before-build.mjs` -> `Stay`
+- `prepare-sidecar.mjs` -> `Stay`
+- `dev-windows.mjs` -> `Stay`
+- `chrome-devtools-mcp-shim.ts` -> `Stay`
+- `build.rs` -> `Stay`
+
+### `tauri-before-dev.mjs`
+
+- What it does: prepares sidecars, validates Linux desktop dependencies, detects or starts the UI dev server, and keeps process trees under control in dev mode.
+- Called from and when: called by Tauri `beforeDevCommand` during `pnpm dev` for the desktop app.
+- Ends up calling: sidecar preparation, `pkg-config`, the app dev server, process spawn/kill logic, and local HTTP checks against the Vite server.
+
+### `tauri-before-build.mjs`
+
+- What it does: prepares sidecars and builds the frontend before packaging.
+- Called from and when: called by Tauri `beforeBuildCommand` during desktop builds.
+- Ends up calling: sidecar prep and frontend build commands.
+
+### `prepare-sidecar.mjs`
+
+- What it does: builds and stages all bundled sidecars and downloads the pinned OpenCode binary.
+- Called from and when: called by both dev and build prep scripts.
+- Ends up calling: Bun compile steps, GitHub release downloads, filesystem copies into `src-tauri/sidecars`, and version metadata generation.
+
+### `dev-windows.mjs`
+
+- What it does: Windows-specific desktop dev launcher that cleans up stale processes and injects the right toolchain environment before running Tauri.
+- Called from and when: called by `pnpm dev:windows`.
+- Ends up calling: PowerShell/taskkill-style cleanup, Windows compiler environment setup, and `tauri dev`.
+
+### `chrome-devtools-mcp-shim.ts`
+
+- What it does: creates the bundled shim for Chrome DevTools MCP.
+- Called from and when: built during sidecar prep, later executed when that sidecar is needed.
+- Ends up calling: `npm exec` for the Chrome DevTools MCP package.
+
+### `build.rs`
+
+- What it does: injects build metadata and ensures sidecar placeholders or binaries exist during Rust compilation.
+- Called from and when: called by Cargo during desktop compilation.
+- Ends up calling: compile-time file generation/copy behavior and build metadata injection.
+
+## OpenCode Engine Lifecycle
+
+Disposition guidance:
+
+- `engine_start()` -> `Move`
+- `spawn_engine()` -> `Move`
+- `find_free_port()` / `build_engine_args()` -> `Move`
+- `engine_stop()` / `engine_restart()` -> `Move`
+- `engine_info()` -> `Split`
+- `engine_doctor()` and related helpers -> `Split`
+- `engine_install()` -> `Split`
+- `EngineManager` -> `Move`
+- `bun_env_overrides()` -> `Move`
+
+Reasoning: the desktop app should keep the ability to launch the OpenWork server, but OpenCode runtime ownership and coordination should move behind the server boundary over time.
+
+### `engine_start()`
+
+- What it does: starts the local OpenCode runtime and the supporting native stack around it.
+- Called from and when: called from the UI when the user starts a local runtime, creates a workspace, reconnects, or begins a local session flow.
+- Ends up calling: local project-directory setup, `opencode.json` seeding, port selection, credential generation, engine spawn, OpenWork server startup, and OpenCodeRouter startup.
+
+### `spawn_engine()`
+
+- What it does: launches `opencode serve` directly, either from a bundled sidecar or an installed binary.
+- Called from and when: called by `engine_start()` in direct-engine mode.
+- Ends up calling: process spawning, working-directory setup, PATH/env overrides, and OpenCode HTTP serving.
+
+### `find_free_port()` / `build_engine_args()`
+
+- What they do: allocate a local port and define the exact command arguments for OpenCode serve.
+- Called from and when: called during engine startup.
+- Ends up calling: localhost TCP allocation and process argument setup.
+
+### `engine_stop()` / `engine_restart()`
+
+- What they do: stop or restart the local engine stack.
+- Called from and when: called from UI controls and restart/recovery flows.
+- Ends up calling: child-process shutdown/restart across engine, router, orchestrator, and hosted OpenWork server.
+
+### `engine_info()`
+
+- What it does: reports current engine/runtime status, including reconnecting to orchestrator auth/state after relaunch.
+- Called from and when: called by the UI during startup probes, status refresh, and settings pages.
+- Ends up calling: in-memory manager state access and orchestrator state/auth file reads.
+
+### `engine_doctor()` and related helpers
+
+- What they do: detect whether OpenCode is installed and usable, inspect binary paths, and run lightweight capability probes.
+- Called from and when: called from onboarding and settings diagnostics.
+- Ends up calling: filesystem path checks and child-process execution such as `--version` and `serve --help`.
+
+### `engine_install()`
+
+- What it does: installs OpenCode from the official install script.
+- Called from and when: called from onboarding or settings when the user asks to install OpenCode.
+- Ends up calling: shell execution, network download, and writes under the user install directory.
+
+### `EngineManager`
+
+- What it does: stores the live engine child process, ports, credentials, and captured logs.
+- Called from and when: used throughout engine startup, status, stop, and reconnect flows.
+- Ends up calling: process lifecycle and in-memory runtime state management.
+
+### `bun_env_overrides()`
+
+- What it does: normalizes Bun-related environment for child processes.
+- Called from and when: used whenever the desktop shell launches Bun-based sidecars.
+- Ends up calling: child-process env mutation.
+
+## Orchestrator Lifecycle
+
+Disposition guidance:
+
+- all orchestrator lifecycle and sandbox functions in this section -> `Move`
+
+Reasoning: these are runtime and workspace orchestration concerns, not UI concerns.
+
+### `spawn_orchestrator_daemon()`
+
+- What it does: launches the OpenWork orchestrator daemon sidecar.
+- Called from and when: called by `engine_start()` when the runtime mode uses the orchestrator.
+- Ends up calling: child-process spawn, daemon HTTP startup, OpenCode management, PATH/env setup, and sidecar discovery.
+
+### `wait_for_orchestrator()` / `fetch_orchestrator_health()` / `fetch_orchestrator_workspaces_with_timeout()`
+
+- What they do: poll the orchestrator until it is healthy and query its workspace/runtime state.
+- Called from and when: called during startup and UI status refresh.
+- Ends up calling: localhost HTTP requests against orchestrator endpoints.
+
+### `resolve_orchestrator_data_dir()`, `read_orchestrator_state()`, `read_orchestrator_auth()`, `write_orchestrator_auth()`, `clear_orchestrator_auth()`
+
+- What they do: manage orchestrator runtime state and auth snapshots on disk.
+- Called from and when: used during engine/orchestrator startup, reconnect, shutdown, and recovery.
+- Ends up calling: reads and writes under the orchestrator data directory.
+
+### `request_orchestrator_shutdown()` / `OrchestratorManager::stop_locked()`
+
+- What they do: gracefully stop the orchestrator if possible, and kill it if needed.
+- Called from and when: called during engine stop and app exit.
+- Ends up calling: orchestrator `/shutdown` and child-process kill fallback.
+
+### `orchestrator_status()`
+
+- What it does: reports orchestrator/OpenCode/workspace status to the UI.
+- Called from and when: called by settings and runtime status UI.
+- Ends up calling: JSON state reads and localhost health/workspace requests.
+
+### `orchestrator_workspace_activate()`
+
+- What it does: registers and activates a workspace inside the orchestrator.
+- Called from and when: called when the user points the app at a local workspace in orchestrator mode.
+- Ends up calling: orchestrator workspace creation and activation endpoints.
+
+### `orchestrator_instance_dispose()`
+
+- What it does: disposes a running workspace instance.
+- Called from and when: called from cleanup/dispose UI.
+- Ends up calling: orchestrator disposal endpoints.
+
+### `orchestrator_start_detached()`
+
+- What it does: starts a detached host stack, optionally sandboxed, and reports progress back to the UI.
+- Called from and when: called when the user creates a detached worker or remote sandbox.
+- Ends up calling: `openwork-orchestrator start --detach`, token generation, health polling, optional owner-token issuance, and progress event emission.
+
+### `sandbox_doctor()`, `sandbox_stop()`, `sandbox_cleanup_openwork_containers()`, `sandbox_debug_probe()`
+
+- What they do: inspect and clean up Docker-based sandbox environments.
+- Called from and when: called from developer/debug settings and recovery flows.
+- Ends up calling: Docker CLI commands, temporary probe workspaces, and local filesystem cleanup.
+
+## Hosted OpenWork Server Lifecycle
+
+Disposition guidance:
+
+- `start_openwork_server()` -> `Split`
+- `spawn_openwork_server()` -> `Stay`
+- `resolve_openwork_port()` -> `Stay`
+- token and state helpers in `openwork_server/mod.rs` -> `Split`
+- `build_urls()` -> `Stay`
+- `openwork_server_info()` / `openwork_server_restart()` -> `Split`
+- `OpenworkServerManager` -> `Split`
+
+Reasoning: the desktop shell should keep launch/supervision of the local OpenWork server process, but token semantics, runtime info, and restart/control behavior should keep shrinking into the server over time.
+
+### `start_openwork_server()`
+
+- What it does: starts the local desktop-hosted OpenWork server and tracks its tokens, URLs, and health.
+- Called from and when: called by engine startup and explicit OpenWork server restart flows.
+- Ends up calling: port selection, token generation/load, server spawn, health checks, optional owner-token issuance, and persistence of port/token state; the launch path should stay, while token/control semantics should move inward.
+
+### `spawn_openwork_server()`
+
+- What it does: launches the `openwork-server` sidecar.
+- Called from and when: called by `start_openwork_server()`.
+- Ends up calling: child-process spawn, cwd selection, and env var injection including OpenCode base URL, OpenCode creds, and OpenWork tokens.
+
+### `resolve_openwork_port()`
+
+- What it does: picks an OpenWork server port with reuse and conflict avoidance.
+- Called from and when: called on host-mode server start.
+- Ends up calling: local TCP port selection logic.
+
+### token and state helpers in `openwork_server/mod.rs`
+
+- What they do: load/create workspace client/host/owner tokens and persist preferred ports and state.
+- Called from and when: called on every hosted-server start and reconnect.
+- Ends up calling: filesystem reads and writes in app data; the minimum host bootstrap state may stay, but owner/control semantics should move behind the server.
+
+### `build_urls()`
+
+- What it does: derives shareable LAN and mDNS URLs when remote access is enabled.
+- Called from and when: called during hosted-server startup.
+- Ends up calling: hostname and local-IP discovery.
+
+### `openwork_server_info()` / `openwork_server_restart()`
+
+- What they do: expose OpenWork server runtime info and restart it with the current engine credentials/workspaces.
+- Called from and when: called from settings, remote-access, and recovery UI.
+- Ends up calling: manager state reads or a full restart path; these are transitional control-plane responsibilities that should simplify as the server absorbs more runtime ownership.
+
+### `OpenworkServerManager`
+
+- What it does: stores hosted-server child state, URLs, tokens, and captured logs.
+- Called from and when: used throughout hosted-server lifecycle management.
+- Ends up calling: in-memory child-process/runtime state management, including some control-plane state that should shrink over time.
+
+## OpenCodeRouter Lifecycle
+
+Disposition guidance:
+
+- router child launch and stop helpers -> `Split`
+- router status/config/product API functions -> `Move`
+
+Reasoning: router config, status, and product-facing control should become part of server-owned workspace behavior, and even router child launch should ideally end up under server-owned supervision.
+
+### `opencodeRouter_start()`
+
+- What it does: starts the router sidecar and captures its startup state.
+- Called from and when: called automatically after engine start and from router settings UI.
+- Ends up calling: router spawn, health-port allocation, and child-process log capture.
+
+### `spawn_opencode_router()`
+
+- What it does: launches `opencode-router serve` with the active OpenCode connection.
+- Called from and when: called by `opencodeRouter_start()`.
+- Ends up calling: child-process spawn and localhost router startup.
+
+### `opencodeRouter_status()` / `opencodeRouter_info()`
+
+- What they do: report router health, config, and CLI-derived status.
+- Called from and when: called from router settings/status UI.
+- Ends up calling: localhost router health/config endpoints and router CLI commands.
+
+### `opencodeRouter_stop()`
+
+- What it does: stops the router process.
+- Called from and when: called from UI stop/recovery actions.
+- Ends up calling: child-process kill.
+
+### `opencodeRouter_config_set()`
+
+- What it does: mutates router configuration via the router CLI.
+- Called from and when: called from router settings UI.
+- Ends up calling: router CLI config writes.
+
+## Workspace State, Files, And Watchers
+
+Disposition guidance:
+
+- `workspace_bootstrap()` -> `Split`
+- workspace state load/save/repair helpers -> `Split`
+- `workspace_create()` -> `Move`
+- `ensure_workspace_files()` -> `Move`
+- enterprise creator skills seeding helpers -> `Move`
+- remote workspace create/update/forget/set-selected/set-runtime-active helpers -> `Split`
+- authorized-root and `openwork.json` read/write helpers -> `Move`
+- workspace import/export config helpers -> `Move`
+- workspace watch/update helpers -> `Move`
+
+Reasoning: the app should keep only transient selection and reconnect state. The durable registry of servers/workspaces, plus mutation, file writes, config writes, import/export, and reload watching, should move behind the server.
+
+### `workspace_bootstrap()`
+
+- What it does: loads persisted workspace state, repairs it, and starts the native file watcher.
+- Called from and when: called very early from the UI during app bootstrap.
+- Ends up calling: workspace-state reads and watcher setup.
+
+### `load_workspace_state()`, `load_workspace_state_fast()`, `save_workspace_state()`, `repair_workspace_state()`
+
+- What they do: persist and normalize the desktop app’s current workspace registry.
+- Called from and when: used throughout startup, workspace mutation, and selection flows.
+- Ends up calling: `openwork-workspaces.json` reads/writes and path canonicalization; in the ideal model this becomes transitional reconnect/cache state rather than the canonical registry.
+
+### `workspace_create()`
+
+- What it does: creates a new local workspace and seeds its initial OpenWork/OpenCode files.
+- Called from and when: called from onboarding and create-workspace UI.
+- Ends up calling: directory creation, starter file writes, and workspace-state updates.
+
+### `ensure_workspace_files()`
+
+- What it does: writes `.opencode` and related starter config files into a workspace.
+- Called from and when: called by `workspace_create()`.
+- Ends up calling: filesystem writes under the workspace path.
+
+### `spawn_enterprise_creator_skills_seed()` / `seed_enterprise_creator_skills()`
+
+- What they do: download and unpack starter skills from GitHub in the background.
+- Called from and when: called for starter workspace setup.
+- Ends up calling: network download, ZIP extraction, and workspace file writes.
+
+### `workspace_create_remote()`, `workspace_update_remote()`, `workspace_forget()`, `workspace_set_selected()`, `workspace_set_runtime_active()`
+
+- What they do: manage the app-side list of local and remote workspaces in the current implementation.
+- Called from and when: called from workspace selection, remote connect, and remote disconnect flows.
+- Ends up calling: workspace-state mutation and watcher target changes; durable remote workspace persistence should move behind the server.
+
+### `workspace_add_authorized_root()`, `workspace_openwork_read()`, `workspace_openwork_write()`
+
+- What they do: manage `.opencode/openwork.json` data for authorized roots and related settings.
+- Called from and when: called from settings/permissions UI.
+- Ends up calling: workspace-local config file reads and writes; in the ideal model this is server-side materialization into the OpenWork-managed workspace config directory.
+
+### `workspace_export_config()` / `workspace_import_config()`
+
+- What they do: export or import portable workspace config bundles.
+- Called from and when: called from import/export UI.
+- Ends up calling: zip creation/extraction and workspace filesystem mutation.
+
+### `update_workspace_watch()` / `WorkspaceWatchState`
+
+- What they do: watch the active workspace root and `.opencode/` for changes that require reload handling.
+- Called from and when: watcher is armed at bootstrap and updated when runtime-active workspace changes.
+- Ends up calling: native filesystem watching and frontend reload events.
+
+## Local Config, Commands, And Skills
+
+Disposition guidance:
+
+- `read_opencode_config()` / `write_opencode_config()` -> `Move`
+- command-file functions -> `Move`
+- skill functions -> `Move`
+- `copy_dir_recursive()` -> `Move`
+
+Reasoning: these are explicit workspace/config mutation capabilities and belong to the server.
+
+### `read_opencode_config()` / `write_opencode_config()`
+
+- What they do: read and write local or global `opencode.json[c]` files.
+- Called from and when: called by settings/config editors and by startup paths that seed project config.
+- Ends up calling: config file reads and writes.
+
+### command-file functions in `command_files.rs`
+
+- What they do: list, write, and delete local OpenCode command markdown files.
+- Called from and when: called from command-management UI.
+- Ends up calling: filesystem mutation under `.opencode/commands`.
+
+### skill functions in `skills.rs`
+
+- What they do: list, read, write, install, import, and remove local skill directories.
+- Called from and when: called from skills UI and local import/install flows.
+- Ends up calling: skill directory reads, recursive copies, and deletions.
+
+### `copy_dir_recursive()`
+
+- What it does: recursively copies local directories.
+- Called from and when: used when importing local skills.
+- Ends up calling: filesystem traversal and file copy operations.
+
+## Dialogs, Windowing, Deep Links, Updater
+
+Disposition guidance:
+
+- dialog wrappers -> `Stay`
+- `set_window_decorations()` -> `Stay`
+- deep-link scheme config and bridge -> `Stay`
+- `updater_environment()` -> `Stay`
+
+Reasoning: these are true desktop-shell concerns.
+
+### dialog wrappers used by the frontend
+
+- What they do: open native file/folder/save dialogs.
+- Called from and when: called when the user picks folders, files, or export destinations.
+- Ends up calling: Tauri dialog plugin and OS-native dialogs.
+
+### `set_window_decorations()`
+
+- What it does: toggles native window decorations.
+- Called from and when: called from hide-titlebar preference changes.
+- Ends up calling: native window APIs.
+
+### deep-link scheme config and bridge
+
+- What they do: register `openwork://` and `openwork-dev://`, receive deep links, and forward them into the UI.
+- Called from and when: called at OS/app integration time and when deep links are opened.
+- Ends up calling: OS URL-handler integration and frontend event routing.
+
+### `updater_environment()`
+
+- What it does: detects whether native auto-update is safe/supported on the current install.
+- Called from and when: called from startup and settings/about UI.
+- Ends up calling: executable/app-bundle path inspection.
+
+## Scheduler, Reset, Cache, Auth
+
+Disposition guidance:
+
+- scheduler commands -> `Move`
+- `reset_opencode_cache()` -> `Split`
+- `reset_openwork_state()` -> `Split`
+- `nuke_openwork_and_opencode_config_and_exit()` -> `Split`
+- `opencode_mcp_auth()` -> `Move`
+- `app_build_info()` -> `Stay`
+
+Reasoning: job/MCP/runtime behavior should move to the server, while destructive app reset and app metadata remain partly shell-owned.
+
+### scheduler commands
+
+- What they do: inspect and remove scheduled OpenCode jobs.
+- Called from and when: called from scheduler UI.
+- Ends up calling: scheduler file reads plus OS scheduler removal through `launchctl` or `systemctl --user`.
+
+### `reset_opencode_cache()`
+
+- What it does: deletes local OpenCode cache directories.
+- Called from and when: called from reset/repair UI.
+- Ends up calling: filesystem deletion under XDG/macOS/Windows cache locations.
+
+### `reset_openwork_state()`
+
+- What it does: stops managed services and clears OpenWork desktop state.
+- Called from and when: called from reset UI.
+- Ends up calling: process shutdown and filesystem deletion in app-data/config/cache paths.
+
+### `nuke_openwork_and_opencode_config_and_exit()`
+
+- What it does: performs a broader local reset across OpenWork and OpenCode state, then exits.
+- Called from and when: called from destructive settings/reset flows.
+- Ends up calling: large-scale filesystem deletion and app exit.
+
+### `opencode_mcp_auth()`
+
+- What it does: runs `opencode mcp auth <server>` in an authorized workspace.
+- Called from and when: called from MCP authorization UI.
+- Ends up calling: local process spawn, path validation, and any browser/OAuth flow the child process triggers.
+
+### `app_build_info()`
+
+- What it does: exposes desktop build/version metadata.
+- Called from and when: called from about/settings UI.
+- Ends up calling: compile-time metadata reads only.
+
+## Supporting Native Path And Platform Helpers
+
+Disposition guidance:
+
+- PATH helpers -> `Stay`
+- platform process-launch helpers -> `Stay`
+- Tauri capability manifest -> `Stay`
+
+Reasoning: these are implementation details of the native desktop shell itself.
+
+### `prepended_path_env()` / `sidecar_path_candidates()`
+
+- What they do: construct a safe PATH that includes bundled sidecars and common tool locations.
+- Called from and when: used when launching engine, orchestrator, router, and similar sidecars.
+- Ends up calling: child-process env mutation.
+
+### platform `command_for_program()` / `configure_hidden()` helpers
+
+- What they do: normalize native process spawning behavior across Unix and Windows.
+- Called from and when: used by diagnostics, sandbox helpers, and auth/process tools.
+- Ends up calling: OS-specific process-launch behavior.
+
+### Tauri capability manifest
+
+- What it does: grants the desktop app permission to use native dialogs, deep links, updater, HTTP, process, opener, and shell features.
+- Called from and when: applied by the Tauri runtime.
+- Ends up calling: Tauri capability gating for the whole native shell.
+
+## Coverage Limits
+
+- This audit stays focused on code in `apps/desktop`.
+- It describes the frontend boundary only when needed to explain who triggers a native call.
+- It does not attempt to re-document all downstream behavior inside `apps/server`, `apps/orchestrator`, or OpenCode itself.
diff --git a/prds/server-v2-plan/ui-migration.md b/prds/server-v2-plan/ui-migration.md
new file mode 100644
index 0000000000..f86ff82162
--- /dev/null
+++ b/prds/server-v2-plan/ui-migration.md
@@ -0,0 +1,436 @@
+# Server V2 UI Migration
+
+## Status: Draft
+## Date: 2026-04-14
+
+## Purpose
+
+This document defines how the app and desktop shell should migrate from the current mixed legacy call patterns to the new Server V2 SDK and startup model.
+
+Current Phase 10 note:
+
+- The migration rollout flag remains the practical opt-in switch while Server V2 is still being validated.
+- Current app routing and desktop startup should continue to use the legacy path by default.
+- Server V2 should be enabled explicitly with `OPENWORK_UI_USE_SERVER_V2=1` (or the Vite-exposed equivalent in the frontend build).
+
+It focuses on one practical requirement:
+
+- we need to move without breaking the current app
+- we need a clean way to opt into the new server path
+- we need to avoid sprinkling backend-selection logic across random UI call sites
+
+## Core Idea
+
+Yes, the overall migration approach makes sense.
+
+The right shape is:
+
+- Server V2 has its own generated SDK
+- the current UI remains the default path at first
+- a single rollout env var enables the new Server V2 path
+- that same rollout decision also controls desktop startup so Tauri launches the new server instead of the old runtime stack
+- during migration, each networked capability has two implementations behind one app-facing function:
+  - current legacy path by default
+  - new Server V2 path when the rollout flag is enabled
+
+The important refinement is how much refactoring we require up front.
+
+We should not block migration on first rewriting the whole UI behind one perfect adapter layer.
+
+Instead, we should support incremental per-call-site branching with one shared rollout helper.
+
+## Migration Goals
+
+- keep the current product working while Server V2 is still incomplete
+- let developers boot the whole app against Server V2 with one flag
+- make it easy to port one feature slice at a time
+- keep UI call sites stable while the transport and runtime ownership change underneath
+- make it easy to delete legacy paths once a feature area is fully migrated
+
+## One Logical Rollout Flag
+
+Use one logical rollout flag for the migration.
+
+Recommended behavior:
+
+- flag off or unset: current app behavior and current desktop runtime startup
+- flag on: app routes eligible calls through the new Server V2 adapter path, and desktop startup launches Server V2 instead of the old local stack
+
+Example conceptual flag:
+
+```text
+OPENWORK_UI_USE_SERVER_V2=1
+```
+
+Current implementation note:
+
+- legacy/default behavior should continue when the flag is unset
+- Server V2 should only become the active app + desktop path when this flag is explicitly enabled
+- do not remove this flag until the old path is intentionally retired
+
+Implementation note:
+
+- the frontend build may still need a platform-specific env bridge such as a Vite-exposed variable
+- that should still be treated as one logical rollout flag, not as two separate product switches
+
+## Main Rule: Use One Shared Flag Helper
+
+The migration can look like this in many places during rollout:
+
+```ts
+const isServerV2 = checkServerFlag()
+
+if (isServerV2) {
+  // new server path
+} else {
+  // old path
+}
+```
+
+That is acceptable for this migration.
+
+Instead:
+
+- use one shared helper such as `checkServerFlag()` or `isServerV2Enabled()`
+- avoid reading raw env state differently in many places
+- branch at the existing call site when that is the lowest-risk migration path
+- only introduce a deeper adapter when it clearly reduces repeated migration logic
+
+This keeps the migration practical without forcing a whole-app client refactor before the server migration can begin.
+
+## Recommended Helper Shape
+
+Recommended minimal shape:
+
+```text
+apps/app/src/app/kernel/server-version/
+├── flag.ts                # shared UI-side rollout helper
+├── sdk.ts                 # Server V2 client creation helpers
+└── index.ts
+
+apps/desktop/src-tauri/src/
+└── openwork_server/
+    └── startup_mode.rs    # desktop startup branch for old vs Server V2
+```
+
+Example UI-side helper shape:
+
+```ts
+export function checkServerFlag() {
+  return import.meta.env.VITE_OPENWORK_UI_USE_SERVER_V2 === "1"
+}
+```
+
+Example usage at an existing call site:
+
+```ts
+const isServerV2 = checkServerFlag()
+
+if (isServerV2) {
+  return createSdk({ serverId }).workspaces.list()
+}
+
+return listWorkspacesLegacy()
+```
+
+Example desktop-side shape:
+
+```rust
+if check_server_v2_flag() {
+    start_server_v2(...)
+} else {
+    start_legacy_runtime(...)
+}
+```
+
+Notes:
+
+- exact filenames can change, but the flag helper should live in one obvious shell or kernel location
+- the helper should return a boolean and hide platform-specific env lookup details
+- Tauri should follow the same logical flag, even if its implementation reads that value through a different runtime or build-time path
+- `createSdk({ serverId })` should sit near the same shell or kernel area so the new-server branch is easy to reuse
+
+## Desired Layering
+
+Recommended split:
+
+- `packages/openwork-server-sdk`
+  - generated SDK for Server V2 only
+- `apps/app/.../checkServerFlag.ts` or equivalent
+  - one shared helper for rollout checks
+- `apps/app/.../createSdk.ts`
+  - app-owned runtime adapter for places that do use Server V2 calls
+- `apps/app/.../legacy/`
+  - thin handwritten legacy fetch/client helpers for flows not yet migrated
+- `apps/desktop/src-tauri/**`
+  - startup and runtime wiring that chooses whether to launch the old stack or the new server
+
+The stable rule is:
+
+- generated SDK for new server
+- one shared rollout helper for migration checks
+- thin legacy shims for old server
+- reuse existing call sites where that is cheaper than introducing a new abstraction first
+
+## What Counts As A Migration Target
+
+The UI currently reaches behavior through several kinds of call sites.
+
+We should treat all of these as migration targets:
+
+- direct fetches to current OpenWork server endpoints
+- direct calls to handwritten server client helpers
+- Tauri commands that really represent server or runtime capabilities
+- startup and reconnect flows that assemble local runtime pieces in the desktop shell
+- local config/file mutations that exist only because the server does not own that capability yet
+
+In other words, the migration is not just about replacing `fetch()` calls.
+
+It also includes shrinking Tauri-owned runtime orchestration and local workspace mutation paths.
+
+It is fine if some migrated places switch to SDK calls while others still branch between raw endpoints, local files, or Tauri commands during the rollout period.
+
+## Dual-Path Pattern Per Capability
+
+For each capability being migrated, use the lightest-weight branch that gets the job done safely.
+
+Sometimes that will be a stable exported domain function.
+
+Sometimes that will simply be an existing function or store action updated to branch on the shared rollout helper.
+
+Example shape:
+
+```ts
+const isServerV2 = checkServerFlag()
+
+export async function listWorkspaceSessions(args: ListWorkspaceSessionsArgs) {
+  if (isServerV2) {
+    return createSdk({ serverId }).sessions.list({ workspaceId: args.workspaceId })
+  }
+
+  return listWorkspaceSessionsLegacy(args)
+}
+```
+
+Rules:
+
+- prefer a shared helper instead of repeated raw env lookups
+- if the code already has a natural function boundary, branch there
+- the Server V2 branch should use the generated SDK where possible
+- the legacy branch should remain thin and isolated
+- the function should normalize outputs so the rest of the UI sees one stable shape
+
+This gives us one place to remove the legacy path later, without requiring that every feature be fully re-layered first.
+
+## Startup Migration Pattern
+
+The rollout flag should affect both app request routing and desktop startup.
+
+### Flag Off
+
+- keep the current startup graph
+- keep the current app network and Tauri paths
+- keep legacy behavior as the safe default
+
+### Flag On
+
+- desktop starts Server V2 instead of assembling the old local runtime stack
+- app connects to Server V2 using the normal port and token model
+- eligible app capability adapters call Server V2 through its SDK
+- legacy fallbacks remain only for capability areas not yet ported
+
+This matters because we do not just want a new SDK.
+
+We want the app to experience the new ownership model end to end.
+
+## App Adapter Strategy
+
+The app-facing shape should stay consistent with the rest of the plan:
+
+```ts
+await createSdk({ serverId }).sessions.listMessages({ workspaceId, sessionId })
+```
+
+Recommended responsibilities for `createSdk({ serverId })` during migration:
+
+- prepare the Server V2 SDK client for code paths that are on the new server
+- create the Server V2 SDK client when that path is enabled
+- hide base URL and token handling from feature code
+
+It should not:
+
+- expose raw `baseUrl` or `token` handling to domain code
+- force the whole app to migrate behind one adapter before we can ship any Server V2 path
+
+Important clarification:
+
+- `createSdk({ serverId })` is for the new-server branch
+- it does not need to absorb every legacy code path immediately
+- some areas can branch locally and only use `createSdk({ serverId })` inside the Server V2 branch
+
+## Desktop / Tauri Strategy
+
+The same rollout decision should control desktop-native startup.
+
+Recommended behavior:
+
+- when the flag is off, the desktop shell uses the current startup path
+- when the flag is on, the desktop shell launches Server V2 and connects the app to it
+
+That means the desktop migration should be treated as part of the same UI migration, not as a separate unrelated effort.
+
+Practical effect:
+
+- the UI should not talk to a legacy startup stack while pretending it is on the new server model
+- if the flag says Server V2, startup should align with that choice as much as possible
+
+## Where To Put The Branches
+
+Recommended branching layers:
+
+### 1. Shell-level rollout resolver
+
+- parse the env var once
+- expose a small `checkServerFlag()` or equivalent helper
+
+### 2. Desktop startup boundary
+
+- choose old runtime startup versus Server V2 startup
+
+### 3. Existing feature call sites or domain helpers
+
+- choose legacy versus Server V2 implementation for each migrated capability
+- use the shared rollout helper rather than ad hoc env parsing
+
+### 4. Legacy compatibility helpers
+
+- preserve old transport details in a quarantined area until they can be deleted
+
+Not recommended:
+
+- reading env vars directly in many different ways
+- large pre-migration refactors whose only purpose is to create a perfect adapter layer
+- mixing transport selection with rendering logic when a nearby helper or action can own the branch instead
+
+## Migration Order
+
+Recommended order:
+
+### Phase 1: Introduce the rollout boundary
+
+- add the logical rollout flag
+- add one shared rollout resolver
+- add desktop startup branching for old versus new server launch
+
+Success criteria:
+
+- one switch can boot the app in legacy mode or Server V2 mode
+- migrated call sites can switch behavior using one shared helper without duplicating env parsing logic
+
+### Phase 2: Wrap existing calls before porting behavior
+
+- inventory current direct fetches, client helpers, and Tauri commands that represent server behavior
+- add branches only where needed for the next migration slice
+- keep behavior unchanged at first unless the branch is explicitly being ported
+
+Success criteria:
+
+- the next feature slice can migrate without a large unrelated app refactor
+- rollout logic is centralized in a shared helper even if branching still happens in many places
+
+### Phase 3: Port read paths first
+
+- move status, discovery, workspace list, session list, and similar read-heavy surfaces first
+- use the generated Server V2 SDK for the new path
+- keep legacy fallback until confidence is high
+
+Success criteria:
+
+- the app can render selected surfaces fully from Server V2 with the flag enabled
+
+### Phase 4: Port write and workflow paths
+
+- move mutations, workspace creation flows, config mutation, share/import/export flows, and runtime control flows in slices
+- keep transport normalization as close to the migration branch as practical
+
+Success criteria:
+
+- whole workflows succeed in Server V2 mode without Tauri-only fallback paths for the migrated areas
+
+### Phase 5: Flip the default
+
+- once the new path is credible, make Server V2 the default
+- keep a temporary escape hatch for the old path only if needed for rollback
+
+### Phase 6: Delete legacy paths
+
+- remove legacy helper modules
+- remove old startup branching
+- remove the rollout flag once it is no longer needed
+
+## Normalization Rule
+
+During migration, old and new backends may not return identical shapes at first.
+
+The UI should not absorb those differences directly.
+
+Instead:
+
+- normalize old and new responses inside the adapter layer
+- return one stable shape to the rest of the UI
+- keep temporary compatibility code close to the transport boundary
+
+This is especially important for:
+
+- workspace summaries
+- session list/detail payloads
+- runtime status and health payloads
+- settings and config mutation responses
+
+## What Should Stay Local In The UI
+
+The migration does not mean everything moves out of the app.
+
+These should still stay UI-local:
+
+- modal state
+- routing and presentation state
+- draft text and transient form state
+- attachment preprocessing before upload
+- client-only search, scrolling, and render performance logic
+- clipboard and opener helpers
+
+The migration target is server and runtime ownership, not the removal of normal UI state.
+
+## Guardrails
+
+- default to legacy behavior until a feature slice is proven
+- use one shared rollout helper for all migration checks
+- never require feature code to pass around raw server URLs and tokens
+- do not dual-write unless there is no safer option
+- keep the legacy path isolated and deletable
+- prefer deleting a migrated legacy branch quickly instead of letting both paths fossilize
+- do not treat Tauri-only filesystem mutation as a permanent parallel capability set
+
+## Relationship To Other Docs
+
+- `prds/server-v2-plan/plan.md`
+  - overall server migration phases
+- `prds/server-v2-plan/sdk-generation.md`
+  - generated SDK plus legacy compatibility split
+- `prds/server-v2-plan/app-audit.md`
+  - UI-owned areas and migration targets inside the app
+- `prds/server-v2-plan/tauri-audit.md`
+  - desktop-native startup and runtime responsibilities that should shrink over time
+
+## Decision Summary
+
+The migration model should be:
+
+- one logical env var controls whether the app is in legacy mode or Server V2 mode
+- that same rollout decision affects both UI network routing and desktop startup
+- the new server uses its own generated SDK
+- each migrated area can branch locally using one shared rollout helper
+- `createSdk({ serverId })` powers the Server V2 path without requiring a whole-app adapter refactor first
+
+That is the safest way to migrate the UI incrementally without locking the app into a permanent dual-architecture mess.
diff --git a/progress.json b/progress.json
deleted file mode 100644
index 9379a41b17..0000000000
--- a/progress.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "project": "openwork",
-  "target": "v0.3",
-  "milestones": {
-    "v0.1": {
-      "description": "Engine + client",
-      "items": [
-        { "id": "v0.1-1", "title": "Tauri app shell", "status": "completed" },
-        {
-          "id": "v0.1-2",
-          "title": "Start/stop OpenCode server (host mode)",
-          "status": "completed"
-        },
-        { "id": "v0.1-3", "title": "Connect client and show health", "status": "completed" },
-        { "id": "v0.1-4", "title": "List sessions", "status": "completed" }
-      ]
-    },
-    "v0.2": {
-      "description": "Full run loop",
-      "items": [
-        { "id": "v0.2-1", "title": "Create session", "status": "completed" },
-        { "id": "v0.2-2", "title": "Send prompt", "status": "completed" },
-        { "id": "v0.2-3", "title": "Subscribe to SSE events", "status": "completed" },
-        { "id": "v0.2-4", "title": "Render step/tool timeline", "status": "completed" },
-        { "id": "v0.2-5", "title": "Surface permission requests + respond", "status": "completed" }
-      ]
-    },
-    "v0.3": {
-      "description": "Premium UX",
-      "items": [
-        { "id": "v0.3-1", "title": "Design-driven UI (design.ts)", "status": "completed" },
-        { "id": "v0.3-2", "title": "Mobile navigation + responsive layouts", "status": "completed" },
-        { "id": "v0.3-3", "title": "Templates (create/save/run)", "status": "completed" },
-        { "id": "v0.3-4", "title": "Skills manager (list/install/import)", "status": "completed" },
-        { "id": "v0.3-5", "title": "Folder picker (native dialog)", "status": "completed" },
-        { "id": "v0.3-6", "title": "No reasoning/tool metadata leaks", "status": "completed" }
-      ]
-    }
-  },
-  "notes": [
-    "Frontend uses @opencode-ai/sdk/v2/client to avoid bundling Node-only server code.",
-    "Engine spawns `opencode serve` from Rust with a per-run working directory.",
-    "`cargo check` runs successfully; a placeholder icon exists at `src-tauri/icons/icon.png`.",
-    "OpenCode mirror cloned at `vendor/opencode` (gitignored).",
-    "UI follows `design.ts` (ported to Solid + Tailwind) and is wired to real OpenCode v2 sessions/messages/todos/permissions.",
-    "Folder picking uses Tauri dialog plugin (no manual path required in Host mode).",
-    "Templates UI exists (create/save/run) backed by localStorage.",
-    "Skills UI exists: list installed `.opencode/skill` and install/import via OpenPackage + local folder import (Host mode).",
-    "Redacts sensitive metadata keys (e.g. reasoningEncryptedContent) from UI to prevent leaks.",
-    "`pnpm typecheck` and `pnpm build:web` succeed.",
-    "Permissions entrypoint exists, but permission prompts may not appear without agent-driven tool calls."
-  ],
-  "lastUpdated": "2026-01-14"
-}
diff --git a/public/apple-touch-icon.png b/public/apple-touch-icon.png
deleted file mode 100644
index b80ee73e30..0000000000
Binary files a/public/apple-touch-icon.png and /dev/null differ
diff --git a/public/favicon-16x16.png b/public/favicon-16x16.png
deleted file mode 100644
index 0bddec113a..0000000000
Binary files a/public/favicon-16x16.png and /dev/null differ
diff --git a/public/favicon-32x32.png b/public/favicon-32x32.png
deleted file mode 100644
index d815d04091..0000000000
Binary files a/public/favicon-32x32.png and /dev/null differ
diff --git a/public/icon-512.png b/public/icon-512.png
deleted file mode 100644
index 71e3fa73ad..0000000000
Binary files a/public/icon-512.png and /dev/null differ
diff --git a/public/logo.png b/public/logo.png
deleted file mode 100644
index 81e265adc8..0000000000
Binary files a/public/logo.png and /dev/null differ
diff --git a/scripts/aur/open-pr.sh b/scripts/aur/open-pr.sh
new file mode 100755
index 0000000000..0fd93a734b
--- /dev/null
+++ b/scripts/aur/open-pr.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+
+TAG="${1:-${RELEASE_TAG:-}}"
+if [ -z "$TAG" ]; then
+  echo "Missing release tag (arg or RELEASE_TAG)." >&2
+  exit 1
+fi
+
+if [[ "$TAG" != v* ]]; then
+  TAG="v${TAG}"
+fi
+
+VERSION="${TAG#v}"
+"${ROOT_DIR}/scripts/aur/update-aur.sh" "$TAG"
+
+cd "$ROOT_DIR"
+
+if ! git status --porcelain -- packaging/aur/PKGBUILD packaging/aur/.SRCINFO | grep -q .; then
+  echo "AUR packaging already up to date."
+  exit 0
+fi
+
+BRANCH="chore/aur-${VERSION}"
+git switch -c "$BRANCH" 2>/dev/null || git switch "$BRANCH"
+
+git add packaging/aur/PKGBUILD packaging/aur/.SRCINFO
+git -c user.name="OpenWork Release Bot" \
+    -c user.email="release-bot@users.noreply.github.com" \
+    commit -m "chore(aur): update PKGBUILD for ${VERSION}"
+
+git push --set-upstream origin "$BRANCH"
+
+if gh pr list --head "$BRANCH" --state open --json number --jq 'length > 0' | grep -q true; then
+  echo "PR already open for ${BRANCH}."
+  exit 0
+fi
+
+gh pr create --title "chore(aur): update PKGBUILD for ${VERSION}" --base dev --body "$(cat <<'EOF'
+## Summary
+- Update AUR PKGBUILD and .SRCINFO for the ${VERSION} release
+- Refresh sha256 for the Linux .deb release asset
+EOF
+)"
diff --git a/scripts/aur/publish-aur.sh b/scripts/aur/publish-aur.sh
new file mode 100755
index 0000000000..9363eae360
--- /dev/null
+++ b/scripts/aur/publish-aur.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+
+TAG="${1:-${RELEASE_TAG:-}}"
+if [ -z "$TAG" ]; then
+  echo "Missing release tag (arg or RELEASE_TAG)." >&2
+  exit 1
+fi
+
+if [[ "$TAG" != v* ]]; then
+  TAG="v${TAG}"
+fi
+
+VERSION="${TAG#v}"
+
+if [ -z "${AUR_SSH_PRIVATE_KEY:-}" ]; then
+  echo "AUR_SSH_PRIVATE_KEY is required to push to AUR." >&2
+  exit 1
+fi
+
+# AUR package repo name (AUR repo = ssh://aur@aur.archlinux.org/<name>.git)
+AUR_REPO="${AUR_REPO:-openwork}"
+AUR_REMOTE="ssh://aur@aur.archlinux.org/${AUR_REPO}.git"
+
+if [ "${AUR_SKIP_UPDATE:-}" != "1" ]; then
+  "${ROOT_DIR}/scripts/aur/update-aur.sh" "$TAG"
+fi
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+KEY_PATH="${TMP_DIR}/aur.key"
+printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$KEY_PATH"
+chmod 600 "$KEY_PATH"
+
+mkdir -p "$HOME/.ssh"
+touch "$HOME/.ssh/known_hosts"
+
+if ! ssh-keygen -F aur.archlinux.org >/dev/null 2>&1; then
+  ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> "$HOME/.ssh/known_hosts" 2>/dev/null
+fi
+
+export GIT_SSH_COMMAND="ssh -i $KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+
+git clone "$AUR_REMOTE" "$TMP_DIR/aur"
+
+cp "$ROOT_DIR/packaging/aur/PKGBUILD" "$TMP_DIR/aur/PKGBUILD"
+cp "$ROOT_DIR/packaging/aur/.SRCINFO" "$TMP_DIR/aur/.SRCINFO"
+
+cd "$TMP_DIR/aur"
+
+if git diff --quiet -- PKGBUILD .SRCINFO; then
+  echo "AUR already up to date for ${AUR_REPO} (${VERSION})."
+  exit 0
+fi
+
+git add PKGBUILD .SRCINFO
+git -c user.name="OpenWork Release Bot" \
+    -c user.email="release-bot@users.noreply.github.com" \
+    commit -m "chore(aur): update PKGBUILD for ${VERSION}"
+
+current_branch=$(git symbolic-ref --short HEAD 2>/dev/null || true)
+if [ -z "$current_branch" ]; then
+  current_branch="master"
+fi
+
+git push origin "HEAD:${current_branch}"
diff --git a/scripts/aur/update-aur.sh b/scripts/aur/update-aur.sh
new file mode 100755
index 0000000000..51f73b3d06
--- /dev/null
+++ b/scripts/aur/update-aur.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+PKG_DIR="${ROOT_DIR}/packaging/aur"
+PKGBUILD="${PKG_DIR}/PKGBUILD"
+SRCINFO="${PKG_DIR}/.SRCINFO"
+
+PYTHON_BIN="${PYTHON_BIN:-}"
+if [ -z "$PYTHON_BIN" ]; then
+  if command -v python3 >/dev/null 2>&1; then
+    PYTHON_BIN="python3"
+  elif command -v python >/dev/null 2>&1; then
+    PYTHON_BIN="python"
+  else
+    echo "Python is required (python3 preferred)." >&2
+    exit 1
+  fi
+fi
+
+TAG="${1:-${RELEASE_TAG:-}}"
+if [ -z "$TAG" ]; then
+  echo "Missing release tag (arg or RELEASE_TAG)." >&2
+  exit 1
+fi
+
+if [[ "$TAG" != v* ]]; then
+  TAG="v${TAG}"
+fi
+
+VERSION="${TAG#v}"
+ASSET_NAME_AMD64="${AUR_ASSET_NAME:-openwork-desktop-linux-amd64.deb}"
+ASSET_NAME_ARM64="openwork-desktop-linux-arm64.deb"
+ASSET_URL_AMD64="https://github.com/different-ai/openwork/releases/download/${TAG}/${ASSET_NAME_AMD64}"
+ASSET_URL_ARM64="https://github.com/different-ai/openwork/releases/download/${TAG}/${ASSET_NAME_ARM64}"
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+curl -fsSL -o "${TMP_DIR}/${ASSET_NAME_AMD64}" "$ASSET_URL_AMD64"
+curl -fsSL -o "${TMP_DIR}/${ASSET_NAME_ARM64}" "$ASSET_URL_ARM64"
+
+# Calculate SHA256 checksums
+SHA256_AMD64=$(sha256sum "${TMP_DIR}/${ASSET_NAME_AMD64}" | awk '{print $1}')
+SHA256_ARM64=$(sha256sum "${TMP_DIR}/${ASSET_NAME_ARM64}" | awk '{print $1}')
+
+$PYTHON_BIN - "$PKGBUILD" "$VERSION" "$SHA256_AMD64" "$SHA256_ARM64" <<'PY'
+import pathlib
+import re
+import sys
+
+path = pathlib.Path(sys.argv[1])
+version = sys.argv[2]
+sha_amd64 = sys.argv[3]
+sha_arm64 = sys.argv[4]
+
+text = path.read_text()
+text = re.sub(r"^pkgver=.*$", f"pkgver={version}", text, flags=re.M)
+text = re.sub(r"^(pkgrel=)\d+", r"\g<1>1", text, flags=re.M)
+text = re.sub(r"^sha256sums_x86_64=.*$", f"sha256sums_x86_64=('{sha_amd64}')", text, flags=re.M)
+text = re.sub(r"^sha256sums_aarch64=.*$", f"sha256sums_aarch64=('{sha_arm64}')", text, flags=re.M)
+path.write_text(text)
+PY
+
+$PYTHON_BIN - "$SRCINFO" "$PKGBUILD" "$VERSION" "$SHA256_AMD64" "$SHA256_ARM64" "$ASSET_URL_AMD64" "$ASSET_URL_ARM64" <<'PY'
+import pathlib
+import re
+import sys
+
+srcinfo_path = pathlib.Path(sys.argv[1])
+pkgbuild_path = pathlib.Path(sys.argv[2])
+version = sys.argv[3]
+sha_amd64 = sys.argv[4]
+sha_arm64 = sys.argv[5]
+url_amd64 = sys.argv[6]
+url_arm64 = sys.argv[7]
+
+pkgbuild = pkgbuild_path.read_text()
+match = re.search(r"^pkgname=(.+)$", pkgbuild, flags=re.M)
+if not match:
+    raise SystemExit("Could not determine pkgname from PKGBUILD")
+pkgname = match.group(1).strip()
+
+renamed = f"{pkgname}-{version}.deb"
+
+text = srcinfo_path.read_text()
+text = re.sub(r"^\s*pkgver = .*", f"\tpkgver = {version}", text, flags=re.M)
+text = re.sub(r"^\s*pkgrel = .*", "\tpkgrel = 1", text, flags=re.M)
+text = re.sub(r"^\s*noextract = .*", f"\tnoextract = {renamed}", text, flags=re.M)
+text = re.sub(
+    r"^\s*source_x86_64 = .*",
+    f"\tsource_x86_64 = {renamed}::{url_amd64}",
+    text,
+    flags=re.M,
+)
+text = re.sub(r"^\s*sha256sums_x86_64 = .*", f"\tsha256sums_x86_64 = {sha_amd64}", text, flags=re.M)
+text = re.sub(
+    r"^\s*source_aarch64 = .*",
+    f"\tsource_aarch64 = {renamed}::{url_arm64}",
+    text,
+    flags=re.M,
+)
+text = re.sub(r"^\s*sha256sums_aarch64 = .*", f"\tsha256sums_aarch64 = {sha_arm64}", text, flags=re.M)
+srcinfo_path.write_text(text)
+PY
diff --git a/scripts/build-microsandbox-openwork-image.sh b/scripts/build-microsandbox-openwork-image.sh
new file mode 100755
index 0000000000..c7149a8534
--- /dev/null
+++ b/scripts/build-microsandbox-openwork-image.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DOCKERFILE="$ROOT_DIR/packaging/docker/Dockerfile.microsandbox"
+
+IMAGE_REF="${1:-openwork-microsandbox:dev}"
+DOCKER_PLATFORM="${DOCKER_PLATFORM:-}"
+OPENCODE_VERSION="${OPENCODE_VERSION:-$(node -e 'const fs=require("fs"); const parsed=JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(String(parsed.opencodeVersion || "").trim().replace(/^v/, ""));' "$ROOT_DIR/constants.json")}"
+OPENWORK_ORCHESTRATOR_VERSION="${OPENWORK_ORCHESTRATOR_VERSION:-$(node -e 'const fs=require("fs"); const pkg=JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(String(pkg.version));' "$ROOT_DIR/apps/orchestrator/package.json")}"
+OPENWORK_SERVER_VERSION="${OPENWORK_SERVER_VERSION:-$(node -e 'const fs=require("fs"); const pkg=JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(String(pkg.version));' "$ROOT_DIR/apps/server/package.json")}"
+
+args=(
+  build
+  -t "$IMAGE_REF"
+  -f "$DOCKERFILE"
+  --build-arg "OPENWORK_ORCHESTRATOR_VERSION=$OPENWORK_ORCHESTRATOR_VERSION"
+  --build-arg "OPENWORK_SERVER_VERSION=$OPENWORK_SERVER_VERSION"
+  --build-arg "OPENCODE_VERSION=$OPENCODE_VERSION"
+)
+
+if [ -n "$DOCKER_PLATFORM" ]; then
+  args+=(--platform "$DOCKER_PLATFORM")
+fi
+
+args+=("$ROOT_DIR")
+
+printf 'Building micro-sandbox image %s\n' "$IMAGE_REF"
+printf '  openwork-orchestrator@%s\n' "$OPENWORK_ORCHESTRATOR_VERSION"
+printf '  openwork-server@%s\n' "$OPENWORK_SERVER_VERSION"
+printf '  opencode@%s\n' "$OPENCODE_VERSION"
+
+docker "${args[@]}"
+
+printf '\nBuilt micro-sandbox image: %s\n' "$IMAGE_REF"
+printf 'Run example:\n'
+printf '  docker run --rm -p 8787:8787 -e OPENWORK_CONNECT_HOST=127.0.0.1 %s\n' "$IMAGE_REF"
+printf 'Verify:\n'
+printf '  curl http://127.0.0.1:8787/health\n'
+printf '  curl -H "Authorization: Bearer microsandbox-token" http://127.0.0.1:8787/workspaces\n'
diff --git a/scripts/build.mjs b/scripts/build.mjs
new file mode 100644
index 0000000000..b087bbf298
--- /dev/null
+++ b/scripts/build.mjs
@@ -0,0 +1,8 @@
+import { execSync } from "node:child_process";
+
+const isVercel = Boolean(process.env.VERCEL);
+const command = isVercel
+  ? "pnpm --dir apps/share run build"
+  : "pnpm --filter @openwork/desktop build";
+
+execSync(command, { stdio: "inherit" });
diff --git a/scripts/check-server-v2-contract.mjs b/scripts/check-server-v2-contract.mjs
new file mode 100644
index 0000000000..f0a0fc61dd
--- /dev/null
+++ b/scripts/check-server-v2-contract.mjs
@@ -0,0 +1,43 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const repoDir = path.resolve(scriptDir, "..");
+
+function run(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: repoDir,
+      env: process.env,
+      stdio: "inherit",
+    });
+
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+
+      reject(new Error(`${command} ${args.join(" ")} failed with ${signal ? `signal ${signal}` : `exit code ${code ?? 1}`}`));
+    });
+  });
+}
+
+async function main() {
+  await run("pnpm", ["run", "sdk:generate"]);
+  await run("git", [
+    "diff",
+    "--exit-code",
+    "--",
+    "apps/server-v2/openapi/openapi.json",
+    "packages/openwork-server-sdk/generated",
+  ]);
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+  process.exit(1);
+});
diff --git a/scripts/create-daytona-openwork-snapshot.sh b/scripts/create-daytona-openwork-snapshot.sh
new file mode 100755
index 0000000000..3e436b40d9
--- /dev/null
+++ b/scripts/create-daytona-openwork-snapshot.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DOCKERFILE="$ROOT_DIR/ee/apps/den-worker-runtime/Dockerfile.daytona-snapshot"
+DAYTONA_ENV_FILE="${DAYTONA_ENV_FILE:-$ROOT_DIR/.env.daytona}"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker is required" >&2
+  exit 1
+fi
+
+if ! command -v daytona >/dev/null 2>&1; then
+  echo "daytona CLI is required" >&2
+  exit 1
+fi
+
+if [ -f "$DAYTONA_ENV_FILE" ]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$DAYTONA_ENV_FILE"
+  set +a
+fi
+
+if [ -n "${DAYTONA_API_KEY:-}" ]; then
+  echo "Authenticating Daytona CLI" >&2
+  daytona login --api-key "$DAYTONA_API_KEY" >/dev/null
+fi
+
+SNAPSHOT_NAME="${1:-${DAYTONA_SNAPSHOT_NAME:-openwork-runtime}}"
+SNAPSHOT_REGION="${DAYTONA_SNAPSHOT_REGION:-${DAYTONA_TARGET:-}}"
+SNAPSHOT_CPU="${DAYTONA_SNAPSHOT_CPU:-1}"
+SNAPSHOT_MEMORY="${DAYTONA_SNAPSHOT_MEMORY:-2}"
+SNAPSHOT_DISK="${DAYTONA_SNAPSHOT_DISK:-8}"
+LOCAL_IMAGE_TAG="${DAYTONA_LOCAL_IMAGE_TAG:-openwork-daytona-snapshot:${SNAPSHOT_NAME//[^a-zA-Z0-9_.-]/-}}"
+
+OPENWORK_ORCHESTRATOR_VERSION="${OPENWORK_ORCHESTRATOR_VERSION:-$(node -e 'const fs=require("fs"); const pkg=JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(String(pkg.version));' "$ROOT_DIR/apps/orchestrator/package.json")}"
+OPENCODE_VERSION="$(node -e 'const fs=require("fs"); const parsed=JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(String(parsed.opencodeVersion || "").trim().replace(/^v/, ""));' "$ROOT_DIR/constants.json")"
+
+echo "Building local image $LOCAL_IMAGE_TAG" >&2
+echo "- openwork-orchestrator@$OPENWORK_ORCHESTRATOR_VERSION" >&2
+echo "- opencode@$OPENCODE_VERSION" >&2
+
+docker buildx build \
+  --platform linux/amd64 \
+  -t "$LOCAL_IMAGE_TAG" \
+  -f "$DOCKERFILE" \
+  --build-arg "OPENWORK_ORCHESTRATOR_VERSION=$OPENWORK_ORCHESTRATOR_VERSION" \
+  --build-arg "OPENCODE_VERSION=$OPENCODE_VERSION" \
+  --load \
+  "$ROOT_DIR"
+
+args=(snapshot push "$LOCAL_IMAGE_TAG" --name "$SNAPSHOT_NAME" --cpu "$SNAPSHOT_CPU" --memory "$SNAPSHOT_MEMORY" --disk "$SNAPSHOT_DISK")
+if [ -n "$SNAPSHOT_REGION" ]; then
+  args+=(--region "$SNAPSHOT_REGION")
+fi
+
+EXISTING_SNAPSHOT_ID="$({
+  daytona snapshot list --format json | node -e '
+const fs = require("fs");
+
+const target = process.argv[1];
+const raw = fs.readFileSync(0, "utf8").trim();
+
+if (!raw || !target) {
+  process.exit(0);
+}
+
+let data;
+try {
+  data = JSON.parse(raw);
+} catch (error) {
+  console.error(`Failed to parse Daytona snapshot list JSON: ${error.message}`);
+  process.exit(1);
+}
+
+const stack = [data];
+while (stack.length > 0) {
+  const value = stack.pop();
+  if (!value || typeof value !== "object") {
+    continue;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      stack.push(item);
+    }
+    continue;
+  }
+
+  const name = typeof value.name === "string" ? value.name : "";
+  const id = typeof value.id === "string" ? value.id : "";
+  if (name === target) {
+    process.stdout.write(id || name);
+    process.exit(0);
+  }
+
+  for (const child of Object.values(value)) {
+    stack.push(child);
+  }
+}
+' "$SNAPSHOT_NAME";
+} )"
+
+if [ -n "$EXISTING_SNAPSHOT_ID" ]; then
+  echo "Deleting existing Daytona snapshot $SNAPSHOT_NAME" >&2
+  daytona snapshot delete "$EXISTING_SNAPSHOT_ID"
+fi
+
+echo "Pushing Daytona snapshot $SNAPSHOT_NAME" >&2
+daytona "${args[@]}"
+
+echo >&2
+echo "Snapshot ready: $SNAPSHOT_NAME" >&2
+echo "Set DAYTONA_SNAPSHOT=$SNAPSHOT_NAME in .env.daytona before starting Den." >&2
diff --git a/scripts/dev-den-local.sh b/scripts/dev-den-local.sh
new file mode 100755
index 0000000000..31f9cff8b5
--- /dev/null
+++ b/scripts/dev-den-local.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+exec bash "$ROOT_DIR/scripts/dev-web-local.sh" "$@"
diff --git a/scripts/dev-headless-web.ts b/scripts/dev-headless-web.ts
new file mode 100644
index 0000000000..026a483b60
--- /dev/null
+++ b/scripts/dev-headless-web.ts
@@ -0,0 +1,325 @@
+import { spawn } from "node:child_process";
+import { openSync } from "node:fs";
+import { access, mkdir } from "node:fs/promises";
+import { createServer } from "node:net";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+
+const cwd = process.cwd();
+const tmpDir = path.join(cwd, "tmp");
+
+const ensureTmp = async () => {
+  await mkdir(tmpDir, { recursive: true });
+};
+
+const isPortFree = (port: number, host: string) =>
+  new Promise<boolean>((resolve) => {
+    const server = createServer();
+    server.once("error", () => resolve(false));
+    server.listen(port, host, () => {
+      server.close(() => resolve(true));
+    });
+  });
+
+const getFreePort = (host: string) =>
+  new Promise<number>((resolve, reject) => {
+    const server = createServer();
+    server.once("error", reject);
+    server.listen(0, host, () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(() => reject(new Error("Unable to resolve free port")));
+        return;
+      }
+      const port = address.port;
+      server.close(() => resolve(port));
+    });
+  });
+
+const resolvePort = async (value: string | undefined, host: string) => {
+  if (value) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      const free = await isPortFree(parsed, host);
+      if (free) return parsed;
+    }
+  }
+  return await getFreePort(host);
+};
+
+const logLine = (message: string) => {
+  process.stdout.write(`${message}\n`);
+};
+
+const readBool = (value: string | undefined) => {
+  const normalized = (value ?? "").trim().toLowerCase();
+  return (
+    normalized === "1" ||
+    normalized === "true" ||
+    normalized === "yes" ||
+    normalized === "on"
+  );
+};
+
+const silent = process.argv.includes("--silent");
+
+const autoBuildEnabled =
+  process.env.OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD == null
+    ? true
+    : readBool(process.env.OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD);
+
+const runCommand = (command: string, args: string[]) =>
+  new Promise<void>((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd,
+      env: process.env,
+      stdio: silent ? "ignore" : "inherit",
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(
+        new Error(
+          `${command} ${args.join(" ")} exited with code ${code ?? "unknown"}`,
+        ),
+      );
+    });
+  });
+
+const spawnLogged = (
+  command: string,
+  args: string[],
+  logPath: string,
+  env: NodeJS.ProcessEnv,
+) => {
+  const logFd = openSync(logPath, "w");
+  return spawn(command, args, {
+    cwd,
+    env,
+    stdio: ["ignore", logFd, logFd],
+  });
+};
+
+const shutdown = (
+  label: string,
+  code: number | null,
+  signal: NodeJS.Signals | null,
+) => {
+  const reason =
+    code !== null ? `code ${code}` : signal ? `signal ${signal}` : "unknown";
+  logLine(`[dev:headless-web] ${label} exited (${reason})`);
+  process.exit(code ?? 1);
+};
+
+await ensureTmp();
+
+const remoteAccessEnabled = readBool(process.env.OPENWORK_REMOTE_ACCESS);
+const host = remoteAccessEnabled ? "0.0.0.0" : "127.0.0.1";
+const viteHost = process.env.VITE_HOST ?? process.env.HOST ?? host;
+const publicHost = process.env.OPENWORK_PUBLIC_HOST ?? null;
+const clientHost = publicHost ?? (host === "0.0.0.0" ? "127.0.0.1" : host);
+const workspace = process.env.OPENWORK_WORKSPACE ?? cwd;
+const openworkPort = await resolvePort(process.env.OPENWORK_PORT, "127.0.0.1");
+const webPort = await resolvePort(process.env.OPENWORK_WEB_PORT, "127.0.0.1");
+const openworkToken = process.env.OPENWORK_TOKEN ?? randomUUID();
+const openworkHostToken = process.env.OPENWORK_HOST_TOKEN ?? randomUUID();
+const openworkServerBin = path.join(
+  cwd,
+  "apps/server/dist/bin/openwork-server",
+);
+const opencodeRouterBin = path.join(
+  cwd,
+  "apps/opencode-router/dist/bin/opencode-router",
+);
+
+const ensureOpenworkServer = async () => {
+  try {
+    await access(openworkServerBin);
+  } catch {
+    if (!autoBuildEnabled) {
+      logLine(
+        `[dev:headless-web] Missing OpenWork server binary at ${openworkServerBin}`,
+      );
+      logLine(
+        "[dev:headless-web] Auto-build disabled (OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD=0)",
+      );
+      logLine(
+        "[dev:headless-web] Run: pnpm --filter openwork-server build:bin",
+      );
+      logLine(
+        "[dev:headless-web] Or unset/enable OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD to auto-build.",
+      );
+      process.exit(1);
+    }
+
+    logLine(
+      `[dev:headless-web] Missing OpenWork server binary at ${openworkServerBin}`,
+    );
+    logLine(
+      "[dev:headless-web] Auto-building: pnpm --filter openwork-server build:bin",
+    );
+    try {
+      await runCommand("pnpm", ["--filter", "openwork-server", "build:bin"]);
+      await access(openworkServerBin);
+    } catch (error) {
+      logLine(
+        `[dev:headless-web] Auto-build failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+      process.exit(1);
+    }
+  }
+};
+
+const ensureOpencodeRouter = async () => {
+  try {
+    await access(opencodeRouterBin);
+  } catch {
+    if (!autoBuildEnabled) {
+      logLine(
+        `[dev:headless-web] Missing opencode-router binary at ${opencodeRouterBin}`,
+      );
+      logLine(
+        "[dev:headless-web] Auto-build disabled (OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD=0)",
+      );
+      logLine(
+        "[dev:headless-web] Run: pnpm --filter opencode-router build:bin",
+      );
+      logLine(
+        "[dev:headless-web] Or unset/enable OPENWORK_DEV_HEADLESS_WEB_AUTOBUILD to auto-build.",
+      );
+      process.exit(1);
+    }
+
+    logLine(
+      `[dev:headless-web] Missing opencode-router binary at ${opencodeRouterBin}`,
+    );
+    logLine(
+      "[dev:headless-web] Auto-building: pnpm --filter opencode-router build:bin",
+    );
+    try {
+      await runCommand("pnpm", ["--filter", "opencode-router", "build:bin"]);
+      await access(opencodeRouterBin);
+    } catch (error) {
+      logLine(
+        `[dev:headless-web] Auto-build failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+      process.exit(1);
+    }
+  }
+};
+
+const openworkUrl = `http://${clientHost}:${openworkPort}`;
+const webUrl = `http://${clientHost}:${webPort}`;
+// In practice we want opencode-router on for end-to-end messaging tests.
+// Allow opt-out via OPENWORK_DEV_OPENCODE_ROUTER=0.
+const opencodeRouterEnabled =
+  process.env.OPENWORK_DEV_OPENCODE_ROUTER == null
+    ? true
+    : readBool(process.env.OPENWORK_DEV_OPENCODE_ROUTER);
+const opencodeRouterRequired = readBool(
+  process.env.OPENWORK_DEV_OPENCODE_ROUTER_REQUIRED,
+);
+const viteEnv = {
+  ...process.env,
+  HOST: viteHost,
+  PORT: String(webPort),
+  VITE_OPENWORK_URL: process.env.VITE_OPENWORK_URL ?? openworkUrl,
+  VITE_OPENWORK_PORT: process.env.VITE_OPENWORK_PORT ?? String(openworkPort),
+  VITE_OPENWORK_TOKEN: process.env.VITE_OPENWORK_TOKEN ?? openworkToken,
+};
+const headlessEnv = {
+  ...process.env,
+  OPENWORK_WORKSPACE: workspace,
+  OPENWORK_HOST: host,
+  OPENWORK_REMOTE_ACCESS: remoteAccessEnabled ? "1" : "0",
+  OPENWORK_PORT: String(openworkPort),
+  OPENWORK_TOKEN: openworkToken,
+  OPENWORK_HOST_TOKEN: openworkHostToken,
+  OPENWORK_SERVER_BIN: openworkServerBin,
+  OPENWORK_SIDECAR_SOURCE: process.env.OPENWORK_SIDECAR_SOURCE ?? "external",
+  OPENCODE_ROUTER_BIN: process.env.OPENCODE_ROUTER_BIN ?? opencodeRouterBin,
+};
+
+await ensureOpenworkServer();
+if (opencodeRouterEnabled) {
+  await ensureOpencodeRouter();
+}
+
+logLine("[dev:headless-web] Starting services");
+logLine(`[dev:headless-web] Workspace: ${workspace}`);
+logLine(`[dev:headless-web] OpenWork server: ${openworkUrl}`);
+logLine(`[dev:headless-web] Web host: ${viteHost}`);
+logLine(`[dev:headless-web] Web port: ${webPort}`);
+logLine(`[dev:headless-web] Web URL: ${webUrl}`);
+logLine(
+  `[dev:headless-web] OpenCodeRouter: ${opencodeRouterEnabled ? "on" : "off"} (set OPENWORK_DEV_OPENCODE_ROUTER=0 to disable)`,
+);
+logLine("[dev:headless-web] OPENWORK_TOKEN: [REDACTED]");
+logLine("[dev:headless-web] OPENWORK_HOST_TOKEN: [REDACTED]");
+logLine(
+  `[dev:headless-web] Web logs: ${path.relative(cwd, path.join(tmpDir, "dev-web.log"))}`,
+);
+logLine(
+  `[dev:headless-web] Headless logs: ${path.relative(cwd, path.join(tmpDir, "dev-headless.log"))}`,
+);
+
+const webProcess = spawnLogged(
+  "pnpm",
+  [
+    "--filter",
+    "@openwork/app",
+    "exec",
+    "vite",
+    "--host",
+    viteHost,
+    "--port",
+    String(webPort),
+    "--strictPort",
+  ],
+  path.join(tmpDir, "dev-web.log"),
+  viteEnv,
+);
+
+const headlessProcess = spawnLogged(
+  "pnpm",
+  [
+    "--filter",
+    "openwork-orchestrator",
+    "dev",
+    "--",
+    "start",
+    "--workspace",
+    workspace,
+    "--approval",
+    "auto",
+    "--allow-external",
+    "--opencode-router",
+    opencodeRouterEnabled ? "true" : "false",
+    ...(opencodeRouterRequired ? ["--opencode-router-required"] : []),
+    ...(remoteAccessEnabled ? ["--remote-access"] : []),
+    "--openwork-port",
+    String(openworkPort),
+  ],
+  path.join(tmpDir, "dev-headless.log"),
+  headlessEnv,
+);
+
+const stopAll = (signal: NodeJS.Signals) => {
+  webProcess.kill(signal);
+  headlessProcess.kill(signal);
+};
+
+process.on("SIGINT", () => {
+  stopAll("SIGINT");
+});
+process.on("SIGTERM", () => {
+  stopAll("SIGTERM");
+});
+
+webProcess.on("exit", (code, signal) => shutdown("web", code, signal));
+headlessProcess.on("exit", (code, signal) =>
+  shutdown("orchestrator", code, signal),
+);
diff --git a/scripts/dev-local.mjs b/scripts/dev-local.mjs
new file mode 100644
index 0000000000..c4f34f661f
--- /dev/null
+++ b/scripts/dev-local.mjs
@@ -0,0 +1,232 @@
+import { spawn } from "node:child_process"
+import net from "node:net"
+import os from "node:os"
+import path from "node:path"
+import process from "node:process"
+import { fileURLToPath } from "node:url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.resolve(__dirname, "..")
+const composeFile = path.join(rootDir, "packaging", "docker", "docker-compose.web-local.yml")
+const composeProject = "openwork-den-local"
+
+const apiPort = process.env.DEN_API_PORT?.trim() || process.env.DEN_CONTROLLER_PORT?.trim() || "8788"
+const workerProxyPort = process.env.DEN_WORKER_PROXY_PORT?.trim() || "8789"
+const webPort = process.env.DEN_WEB_PORT?.trim() || "3005"
+const appPort = process.env.OPENWORK_APP_PORT?.trim() || process.env.PORT?.trim() || "5173"
+const databaseUrl = process.env.DATABASE_URL?.trim() || "mysql://root:password@127.0.0.1:3306/openwork_den"
+const dbEncryptionKey =
+  process.env.DEN_DB_ENCRYPTION_KEY?.trim() ||
+  "local-dev-db-encryption-key-please-change-1234567890"
+
+function detectWebOrigins() {
+  const origins = new Set([
+    `http://localhost:${webPort}`,
+    `http://127.0.0.1:${webPort}`,
+    `http://0.0.0.0:${webPort}`,
+    `http://localhost:${appPort}`,
+    `http://127.0.0.1:${appPort}`,
+  ])
+
+  for (const entries of Object.values(os.networkInterfaces())) {
+    for (const entry of entries || []) {
+      if (!entry || entry.internal || entry.family !== "IPv4") {
+        continue
+      }
+
+      origins.add(`http://${entry.address}:${webPort}`)
+    }
+  }
+
+  return Array.from(origins).join(",")
+}
+
+function parseDatabaseEndpoint(value) {
+  const parsed = new URL(value)
+  return {
+    host: parsed.hostname,
+    port: Number(parsed.port || "3306"),
+  }
+}
+
+function canReachMysql(host, port) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection({ host, port })
+
+    const finalize = (result) => {
+      socket.destroy()
+      resolve(result)
+    }
+
+    socket.setTimeout(1500)
+    socket.once("connect", () => finalize(true))
+    socket.once("error", () => finalize(false))
+    socket.once("timeout", () => finalize(false))
+  })
+}
+
+function canListenOnPort(port) {
+  return new Promise((resolve) => {
+    const server = net.createServer()
+
+    const finalize = (result) => {
+      server.close(() => resolve(result))
+    }
+
+    server.once("error", () => resolve(false))
+    server.once("listening", () => finalize(true))
+    server.listen(port, "0.0.0.0")
+  })
+}
+
+function run(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: rootDir,
+      stdio: "inherit",
+      ...options,
+    })
+
+    child.once("error", reject)
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve()
+        return
+      }
+
+      const detail = signal ? `signal ${signal}` : `exit code ${code ?? 1}`
+      reject(new Error(`${command} ${args.join(" ")} failed with ${detail}`))
+    })
+  })
+}
+
+let startedMysql = false
+let turboChild = null
+let cleaningUp = false
+
+function stopTurboChild() {
+  if (!turboChild || turboChild.exitCode !== null) {
+    return Promise.resolve()
+  }
+
+  return new Promise((resolve) => {
+    turboChild.once("exit", resolve)
+
+    try {
+      if (process.platform !== "win32") {
+        process.kill(-turboChild.pid, "SIGINT")
+      } else {
+        turboChild.kill("SIGINT")
+      }
+    } catch {
+      turboChild.kill("SIGINT")
+    }
+  })
+}
+
+async function cleanup(exitCode = 0) {
+  if (cleaningUp) {
+    return
+  }
+
+  cleaningUp = true
+
+  await stopTurboChild()
+
+  if (startedMysql) {
+    await run("docker", ["compose", "-p", composeProject, "-f", composeFile, "down"], {
+      stdio: "inherit",
+    }).catch(() => {})
+  }
+
+  process.exit(exitCode)
+}
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => {
+    void cleanup(0)
+  })
+}
+
+async function main() {
+  for (const [name, port] of [["den-web", webPort], ["den-api", apiPort], ["den-worker-proxy", workerProxyPort]]) {
+    const available = await canListenOnPort(Number(port))
+    if (!available) {
+      throw new Error(`${name} local port ${port} is already in use. Stop the existing process or rerun with a different port env override.`)
+    }
+  }
+
+  const { host, port } = parseDatabaseEndpoint(databaseUrl)
+  const mysqlAvailable = await canReachMysql(host, port)
+
+  if (!mysqlAvailable) {
+    if (!(host === "127.0.0.1" || host === "localhost")) {
+      throw new Error(`MySQL at ${host}:${port} is not reachable, and auto-start only supports localhost`) 
+    }
+
+    console.log(`[den] MySQL not reachable at ${host}:${port}; starting Docker MySQL...`)
+    await run("docker", ["compose", "-p", composeProject, "-f", composeFile, "up", "-d", "--wait", "mysql"])
+    startedMysql = true
+  } else {
+    console.log(`[den] Using existing MySQL at ${host}:${port}`)
+  }
+
+  console.log("[den] Syncing Den schema...")
+  await run("bash", ["-lc", "pnpm --filter @openwork-ee/den-db build && pnpm --filter @openwork-ee/den-db exec node --import tsx ./node_modules/drizzle-kit/bin.cjs push --config drizzle.config.ts --force"], {
+    env: {
+      ...process.env,
+      DATABASE_URL: databaseUrl,
+    },
+  })
+
+  const webOrigins = detectWebOrigins()
+  console.log(`[den] Allowed local web origins: ${webOrigins}`)
+
+  turboChild = spawn(
+    "pnpm",
+    [
+      "exec",
+      "turbo",
+      "run",
+      "dev:local",
+      "--output-logs=full",
+        "--filter=@openwork-ee/den-api",
+        "--filter=@openwork-ee/den-worker-proxy",
+        "--filter=@openwork-ee/den-web",
+    ],
+    {
+      cwd: rootDir,
+      stdio: "inherit",
+      detached: process.platform !== "win32",
+      env: {
+        ...process.env,
+        OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE?.trim() || "1",
+        DATABASE_URL: databaseUrl,
+        DEN_DB_ENCRYPTION_KEY: dbEncryptionKey,
+        BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET?.trim() || "local-dev-secret-not-for-production-use!!",
+        BETTER_AUTH_URL: process.env.BETTER_AUTH_URL?.trim() || `http://localhost:${webPort}`,
+        DEN_MCP_RESOURCE_URL: process.env.DEN_MCP_RESOURCE_URL?.trim() || `http://127.0.0.1:${apiPort}/mcp`,
+        DEN_BETTER_AUTH_TRUSTED_ORIGINS: process.env.DEN_BETTER_AUTH_TRUSTED_ORIGINS?.trim() || webOrigins,
+        CORS_ORIGINS: process.env.CORS_ORIGINS?.trim() || webOrigins,
+        DEN_API_PORT: apiPort,
+        DEN_CONTROLLER_PORT: apiPort,
+        DEN_WORKER_PROXY_PORT: workerProxyPort,
+        DEN_WEB_PORT: webPort,
+        DEN_API_BASE: process.env.DEN_API_BASE?.trim() || `http://127.0.0.1:${apiPort}`,
+        DEN_AUTH_ORIGIN: process.env.DEN_AUTH_ORIGIN?.trim() || `http://localhost:${webPort}`,
+        DEN_AUTH_FALLBACK_BASE: process.env.DEN_AUTH_FALLBACK_BASE?.trim() || `http://127.0.0.1:${apiPort}`,
+        PROVISIONER_MODE: process.env.PROVISIONER_MODE?.trim() || "stub",
+      },
+    },
+  )
+
+  turboChild.once("exit", (code, signal) => {
+    const exitCode = code ?? (signal ? 1 : 0)
+    void cleanup(exitCode)
+  })
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error))
+  void cleanup(1)
+})
diff --git a/scripts/dev-server-v2.mjs b/scripts/dev-server-v2.mjs
new file mode 100644
index 0000000000..b84972d29e
--- /dev/null
+++ b/scripts/dev-server-v2.mjs
@@ -0,0 +1,96 @@
+import { spawn } from "node:child_process";
+import process from "node:process";
+
+const includeApp = !process.argv.includes("--no-app");
+
+function run(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: "inherit",
+      env: process.env,
+      cwd: process.cwd(),
+    });
+
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+
+      reject(new Error(`${command} ${args.join(" ")} exited with ${code ?? signal ?? "unknown status"}`));
+    });
+  });
+}
+
+const commands = [
+  {
+    name: "server",
+    args: ["--filter", "openwork-server-v2", "dev"],
+  },
+  {
+    name: "openapi",
+    args: ["--filter", "openwork-server-v2", "openapi:watch"],
+  },
+  {
+    name: "sdk",
+    args: ["--filter", "@openwork/server-sdk", "watch"],
+  },
+];
+
+if (includeApp) {
+  commands.push({
+    name: "app",
+    args: ["dev:ui"],
+  });
+}
+
+const children = [];
+let shuttingDown = false;
+
+function stopAll(exitCode = 0) {
+  if (shuttingDown) {
+    return;
+  }
+
+  shuttingDown = true;
+
+  for (const child of children) {
+    if (child.exitCode === null) {
+      child.kill("SIGTERM");
+    }
+  }
+
+  setTimeout(() => {
+    process.exit(exitCode);
+  }, 100);
+}
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => stopAll(0));
+}
+
+async function main() {
+  await run("pnpm", ["run", "sdk:generate"]);
+
+  for (const command of commands) {
+    const child = spawn("pnpm", command.args, {
+      stdio: "inherit",
+      env: process.env,
+      cwd: process.cwd(),
+    });
+    children.push(child);
+    child.once("exit", (code, signal) => {
+      if (shuttingDown) {
+        return;
+      }
+      const exitCode = code ?? (signal ? 1 : 0);
+      stopAll(exitCode);
+    });
+  }
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+});
diff --git a/scripts/dev-web-local.sh b/scripts/dev-web-local.sh
new file mode 100644
index 0000000000..3591ff04d7
--- /dev/null
+++ b/scripts/dev-web-local.sh
@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+COMPOSE_FILE="$ROOT_DIR/packaging/docker/docker-compose.web-local.yml"
+PROJECT_NAME="openwork-web-local"
+
+# Local-dev defaults — match the MySQL container in docker-compose.web-local.yml.
+# These are only used when not already set in the environment or .env.
+: "${DATABASE_URL:=mysql://root:password@127.0.0.1:3306/openwork_den}"
+: "${BETTER_AUTH_SECRET:=local-dev-secret-not-for-production-use!!}"
+
+pick_port() {
+  node <<'EOF'
+const net = require('net');
+const server = net.createServer();
+server.listen(0, '127.0.0.1', () => {
+  const { port } = server.address();
+  process.stdout.write(String(port));
+  server.close();
+});
+EOF
+}
+
+port_is_free() {
+  local port="$1"
+  node -e "const net=require('net'); const server=net.createServer(); server.once('error',()=>process.exit(1)); server.once('listening',()=>server.close(()=>process.exit(0))); server.listen(${port});"
+}
+
+choose_port() {
+  local preferred="$1"
+  if port_is_free "$preferred"; then
+    printf '%s\n' "$preferred"
+    return
+  fi
+  pick_port
+}
+
+detect_web_origins() {
+  local web_port="$1"
+  WEB_PORT="$web_port" node <<'EOF'
+const os = require('os');
+const port = process.env.WEB_PORT;
+
+const origins = new Set([
+  `http://localhost:${port}`,
+  `http://127.0.0.1:${port}`,
+  `http://0.0.0.0:${port}`,
+]);
+
+for (const entries of Object.values(os.networkInterfaces())) {
+  for (const entry of entries || []) {
+    if (!entry || entry.internal || entry.family !== 'IPv4') continue;
+    origins.add(`http://${entry.address}:${port}`);
+  }
+}
+
+process.stdout.write(Array.from(origins).join(','));
+EOF
+}
+
+cleanup() {
+  local exit_code=$?
+  trap - EXIT INT TERM
+
+  for pid_var in DEN_PID WEB_PID; do
+    if [[ -n "${!pid_var:-}" ]]; then
+      kill "${!pid_var}" >/dev/null 2>&1 || true
+      wait "${!pid_var}" 2>/dev/null || true
+    fi
+  done
+
+  docker compose -p "$PROJECT_NAME" -f "$COMPOSE_FILE" down -v >/dev/null 2>&1 || true
+  exit "$exit_code"
+}
+
+trap cleanup EXIT INT TERM
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker is required for pnpm dev:web-local" >&2
+  exit 1
+fi
+
+DEN_API_PORT="$(choose_port "${DEN_LOCAL_API_PORT:-8788}")"
+DEN_WEB_PORT="$(choose_port "${DEN_LOCAL_WEB_PORT:-3005}")"
+DEN_WEB_ORIGIN="http://localhost:${DEN_WEB_PORT}"
+
+: "${BETTER_AUTH_URL:=$DEN_WEB_ORIGIN}"
+export DATABASE_URL BETTER_AUTH_SECRET BETTER_AUTH_URL
+
+echo "Starting local MySQL..."
+docker compose -p "$PROJECT_NAME" -f "$COMPOSE_FILE" down -v >/dev/null 2>&1 || true
+docker compose -p "$PROJECT_NAME" -f "$COMPOSE_FILE" up -d --wait mysql
+
+echo "Running Den migrations..."
+pnpm --filter @openwork-ee/den-db db:push <<'EOF'
+y
+EOF
+
+WEB_CORS_ORIGINS="$(detect_web_origins "$DEN_WEB_PORT")"
+echo "Allowing Better Auth origins: $WEB_CORS_ORIGINS"
+
+echo "Starting Den and web dev servers..."
+echo "Den controller: http://localhost:$DEN_API_PORT"
+echo "Den web:        $DEN_WEB_ORIGIN"
+
+(
+  cd "$ROOT_DIR/ee/apps/den-controller"
+  env \
+    OPENWORK_DEV_MODE=1 \
+    DATABASE_URL="$DATABASE_URL" \
+    BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    BETTER_AUTH_URL="$BETTER_AUTH_URL" \
+    CORS_ORIGINS="$WEB_CORS_ORIGINS" \
+    PORT="$DEN_API_PORT" \
+    sh -lc 'pnpm run build:den-db && exec pnpm exec tsx watch src/index.ts'
+) &
+DEN_PID=$!
+
+(
+  cd "$ROOT_DIR/ee/apps/den-web"
+  env \
+    OPENWORK_DEV_MODE=1 \
+    NEXT_PUBLIC_POSTHOG_KEY= \
+    NEXT_PUBLIC_POSTHOG_API_KEY= \
+    DEN_API_BASE="http://127.0.0.1:$DEN_API_PORT" \
+    DEN_AUTH_FALLBACK_BASE="http://127.0.0.1:$DEN_API_PORT" \
+    DEN_AUTH_ORIGIN="$DEN_WEB_ORIGIN" \
+    NEXT_PUBLIC_OPENWORK_AUTH_CALLBACK_URL="$DEN_WEB_ORIGIN" \
+    pnpm exec next dev --hostname 0.0.0.0 --port "$DEN_WEB_PORT"
+) &
+WEB_PID=$!
+
+wait "$DEN_PID" "$WEB_PID"
diff --git a/scripts/dev-windows.cmd b/scripts/dev-windows.cmd
new file mode 100644
index 0000000000..3a002929b6
--- /dev/null
+++ b/scripts/dev-windows.cmd
@@ -0,0 +1,30 @@
+@echo off
+setlocal
+
+set "TARGET_ARCH=%~1"
+set "VSDEVCMD=%VSDEVCMD_PATH%"
+set "HOST_ARCH=x64"
+
+if /I "%PROCESSOR_ARCHITECTURE%"=="ARM64" set "HOST_ARCH=arm64"
+if /I "%TARGET_ARCH%"=="x64" (
+  set "VS_ARCH=x64"
+) else (
+  set "VS_ARCH=%HOST_ARCH%"
+)
+
+if not defined VSDEVCMD if exist "%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" for /f "usebackq delims=" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -find Common7\Tools\VsDevCmd.bat`) do set "VSDEVCMD=%%i"
+if not defined VSDEVCMD if exist "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\VsDevCmd.bat" set "VSDEVCMD=C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\VsDevCmd.bat"
+
+if not defined VSDEVCMD (
+  echo [openwork] Could not find VsDevCmd.bat. Install Visual Studio Build Tools with Desktop development with C++.
+  exit /b 1
+)
+
+call "%VSDEVCMD%" -arch=%VS_ARCH% -host_arch=%HOST_ARCH% >nul
+if errorlevel 1 exit /b %errorlevel%
+
+if /I "%TARGET_ARCH%"=="x64" (
+  call corepack pnpm --filter @openwork/desktop dev:windows:x64
+) else (
+  call corepack pnpm --filter @openwork/desktop dev:windows
+)
diff --git a/scripts/find-unused.README.md b/scripts/find-unused.README.md
new file mode 100644
index 0000000000..9a42188bd2
--- /dev/null
+++ b/scripts/find-unused.README.md
@@ -0,0 +1,61 @@
+# find-unused.sh
+
+Wrapper around [knip](https://knip.dev) that detects unused files and cross-references them against CI configs, build configs, package.json scripts, tsconfig files, convention-based usage, file-based routing directories, and sibling repo CI/CD pipelines to reduce false positives.
+
+## Usage
+
+```bash
+bash scripts/find-unused.sh
+```
+
+Requires `npx` (knip is fetched automatically). A fake `DATABASE_URL` is injected so config resolution doesn't fail.
+
+The script auto-detects whether it's running inside a factory layout (`../../.._repos/`). When inside a factory, it cross-references sibling repos. When standalone, it skips sibling checks gracefully and still runs all internal checks.
+
+## What it does
+
+1. **Runs `knip --include files`** to get a list of unused files across the monorepo.
+2. **Indexes infra files** — collects all build/config/CI files into a single searchable set:
+   - GitHub workflow YAMLs
+   - Dockerfiles and docker-compose files
+   - Deployment configs (Vercel, Tauri)
+   - Build tool configs (vite, tailwind, postcss, next, drizzle, tsup, playwright)
+   - Build scripts (`.mjs`, `.ts`, `.sh` across all workspaces)
+   - `.opencode` skill scripts
+   - All `package.json` files (for script references)
+   - All `tsconfig*.json` files (for path aliases and includes)
+3. **Cross-references** each file against:
+   - **Internal infra** — all indexed config/build files, searching by filename and relative path
+   - **Convention patterns** — filenames like `postinstall`, `drizzle.config`, Tauri hooks
+   - **File-based routing dirs** — Next.js server routes, app routes, and API routes that are entry points by convention
+   - **Sibling repo CI/CD** — workflows, Dockerfiles, and build scripts in sibling repos and factory-level CI, with smart filtering to avoid false positives on generic filenames (e.g., `index`, `utils`, `config`)
+4. **Displays results in two buckets** (oldest first within each):
+   - `✗` **Safe to remove** — no references found anywhere (red)
+   - `⚠` **Review before removing** — referenced in infra/CI (yellow) or sibling CI (cyan)
+
+A progress indicator shows the current file being checked during cross-referencing.
+
+Certain paths are ignored entirely (scripts, dev tools) — see the `IGNORE_PREFIXES` array in the script.
+
+## Using knip directly
+
+The script only checks for unused **files**. Knip can detect much more — run it directly for deeper analysis:
+
+```bash
+# Unused exports (functions, types, constants)
+npx knip --include exports
+
+# Unused dependencies in package.json
+npx knip --include dependencies
+
+# Everything at once
+npx knip
+
+# Scope to a single workspace
+npx knip --workspace apps/app
+
+# Auto-fix removable issues (careful — modifies files)
+npx knip --fix
+```
+
+See the [knip docs](https://knip.dev) for the full set of options.
diff --git a/scripts/find-unused.sh b/scripts/find-unused.sh
new file mode 100755
index 0000000000..ac25d6a0f1
--- /dev/null
+++ b/scripts/find-unused.sh
@@ -0,0 +1,414 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ── Config ──────────────────────────────────────────────────────────────────
+OPENWORK_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+# Detect whether we're inside a factory layout (../../.. has _repos/)
+FACTORY_CANDIDATE="$(cd "$OPENWORK_ROOT/../../.." 2>/dev/null && pwd)"
+if [ -d "$FACTORY_CANDIDATE/_repos" ]; then
+  FACTORY_ROOT="$FACTORY_CANDIDATE"
+else
+  FACTORY_ROOT=""
+fi
+
+# All sibling repos to cross-reference against (empty when outside factory)
+SIBLING_REPOS=()
+if [ -n "$FACTORY_ROOT" ]; then
+  for d in "$FACTORY_ROOT"/_repos/*/; do
+    [ -d "$d" ] || continue
+    [ "$(cd "$d" && pwd)" = "$OPENWORK_ROOT" ] && continue
+    SIBLING_REPOS+=("$d")
+  done
+fi
+
+# ── Internal infra: all build/config/CI files that may reference source ────
+# These are files WITHIN openwork that knip can't trace but that use source files
+# by convention, config, or build step.
+INFRA_GLOBS=(
+  # CI/CD
+  ".github/workflows/*.yml"
+  # Docker
+  "packaging/docker/Dockerfile*"
+  "packaging/docker/docker-compose*.yml"
+  "ee/apps/den-worker-runtime/Dockerfile*"
+  # Deployment
+  "apps/app/vercel.json"
+  "apps/share/vercel.json"
+  "ee/apps/den-web/vercel.json"
+  # Tauri
+  "apps/desktop/src-tauri/tauri.conf.json"
+  # Monorepo orchestration
+  "turbo.json"
+  # Build configs
+  "apps/app/vite.config.ts"
+  "apps/app/tailwind.config.ts"
+  "apps/story-book/vite.config.ts"
+  "apps/ui-demo/vite.config.ts"
+  "apps/share/next.config.ts"
+  "apps/share/playwright.config.ts"
+  "ee/apps/den-web/next.config.js"
+  "ee/apps/den-web/postcss.config.js"
+  "ee/apps/den-web/tailwind.config.js"
+  "ee/apps/landing/next.config.js"
+  "ee/apps/landing/postcss.config.js"
+  "ee/apps/landing/tailwind.config.js"
+  "ee/packages/den-db/drizzle.config.ts"
+  "ee/packages/den-db/tsup.config.ts"
+  "ee/packages/utils/tsup.config.ts"
+  "packages/ui/tsup.config.ts"
+  # Build scripts (all)
+  "scripts/*.mjs"
+  "scripts/*.ts"
+  "scripts/*.sh"
+  "scripts/**/*.mjs"
+  "scripts/**/*.ts"
+  "scripts/**/*.sh"
+  "apps/*/scripts/*.mjs"
+  "apps/*/scripts/*.ts"
+  "apps/*/scripts/*.sh"
+  "ee/apps/*/scripts/*.mjs"
+  "ee/apps/*/scripts/*.sh"
+  # .opencode skills/commands that may invoke source
+  ".opencode/skills/*/scripts/*.sh"
+  ".opencode/skills/*/*.sh"
+)
+
+# Files used by convention (framework/tool magic), not imports
+CONVENTION_PATTERNS=(
+  "postinstall"
+  "drizzle.config"
+  "tauri-before-build"
+  "tauri-before-dev"
+)
+
+# File-based routing directories — files here are entry points by convention
+ROUTING_DIRS=(
+  "apps/share/server/"
+  "apps/share/app/"
+  "ee/apps/den-web/app/"
+  "ee/apps/landing/app/"
+)
+
+# Paths to ignore entirely
+IGNORE_PREFIXES=(
+  "apps/app/scripts/"
+  "apps/desktop/scripts/"
+  "apps/orchestrator/scripts/"
+  "scripts/stats"
+)
+
+# ── Colors ──────────────────────────────────────────────────────────────────
+RED='\033[0;31m'
+YELLOW='\033[0;33m'
+GREEN='\033[0;32m'
+CYAN='\033[0;36m'
+DIM='\033[2m'
+BOLD='\033[1m'
+RESET='\033[0m'
+
+# ── Helpers ─────────────────────────────────────────────────────────────────
+
+# Collect all internal infra files once
+collect_infra_files() {
+  local files=""
+  for glob_pattern in "${INFRA_GLOBS[@]}"; do
+    # Use find-based expansion to handle globs
+    local matched
+    matched=$(find "$OPENWORK_ROOT" -path "$OPENWORK_ROOT/$glob_pattern" 2>/dev/null || true)
+    if [ -n "$matched" ]; then
+      files="${files}${matched}"$'\n'
+    fi
+  done
+  # Also add all package.json files (for script references)
+  local pkg_jsons
+  pkg_jsons=$(find "$OPENWORK_ROOT" -name package.json -not -path '*/node_modules/*' -not -path '*/.git/*')
+  files="${files}${pkg_jsons}"$'\n'
+  # And all tsconfig*.json files (for path aliases / includes)
+  local tsconfigs
+  tsconfigs=$(find "$OPENWORK_ROOT" -name 'tsconfig*.json' -not -path '*/node_modules/*' -not -path '*/.git/*')
+  files="${files}${tsconfigs}"$'\n'
+  echo "$files" | sed '/^$/d' | sort -u
+}
+
+# Search infra files for a pattern
+search_infra() {
+  local pattern="$1"
+  echo "$INFRA_FILES" | xargs grep -l "$pattern" 2>/dev/null || true
+}
+
+# Search sibling repo CI/CD and build scripts for an openwork-relative path.
+# Only checks infra files (workflows, Dockerfiles, build scripts), NOT source code,
+# since no sibling repo has an npm dependency on openwork packages.
+search_sibling_ci() {
+  local pattern="$1"
+  local hits=""
+  for repo in "${SIBLING_REPOS[@]}"; do
+    for ci_dir in ".github/workflows" "packaging" "containers" "infra" ".circleci" "script" "scripts"; do
+      [ -d "${repo}${ci_dir}" ] || continue
+      local ci_hits
+      ci_hits=$(grep -rl "$pattern" "${repo}${ci_dir}" 2>/dev/null || true)
+      if [ -n "$ci_hits" ]; then
+        hits="${hits}${ci_hits}"$'\n'
+      fi
+    done
+    # Dockerfiles anywhere in the repo
+    local docker_hits
+    docker_hits=$(find "$repo" -name 'Dockerfile*' -not -path '*/node_modules/*' -not -path '*/.git/*' \
+      -exec grep -l "$pattern" {} + 2>/dev/null || true)
+    if [ -n "$docker_hits" ]; then
+      hits="${hits}${docker_hits}"$'\n'
+    fi
+  done
+  # Factory-level CI
+  [ -n "$FACTORY_ROOT" ] && [ -d "$FACTORY_ROOT/.github" ] && {
+    local factory_ci
+    factory_ci=$(grep -rl "$pattern" "$FACTORY_ROOT/.github" 2>/dev/null || true)
+    [ -n "$factory_ci" ] && hits="${hits}${factory_ci}"$'\n'
+  }
+  echo "$hits" | sed '/^$/d'
+}
+
+# Format refs: show short paths, max 3 entries
+format_refs() {
+  local refs="$1"
+  local formatted=""
+  local count=0
+  local total
+  total=$(echo "$refs" | grep -c '.' || true)
+
+  while IFS= read -r ref; do
+    [ -z "$ref" ] && continue
+    count=$((count + 1))
+    [ $count -gt 3 ] && continue
+
+    local short="$ref"
+    if [[ "$ref" == "$OPENWORK_ROOT/"* ]]; then
+      short="${ref#"$OPENWORK_ROOT/"}"
+    elif [[ "$ref" == *"/_repos/"* ]]; then
+      short=$(echo "$ref" | sed "s|.*/_repos/||")
+    elif [[ "$ref" == "$FACTORY_ROOT/"* ]]; then
+      short="${ref#"$FACTORY_ROOT/"}"
+    fi
+
+    [ -n "$formatted" ] && formatted="${formatted}, "
+    formatted="${formatted}${short}"
+  done <<< "$refs"
+
+  local remaining=$((total - 3))
+  if [ "$remaining" -gt 0 ] 2>/dev/null; then
+    formatted="${formatted} (+${remaining} more)"
+  fi
+
+  echo "$formatted"
+}
+
+# ── Step 1: Run knip ───────────────────────────────────────────────────────
+cd "$OPENWORK_ROOT"
+echo -e "${BOLD}Running knip to detect unused files...${RESET}"
+KNIP_OUTPUT=$(DATABASE_URL=mysql://fake:fake@localhost/fake npx knip --include files --no-progress --no-config-hints 2>&1 || true)
+
+UNUSED_FILES=()
+while IFS= read -r line; do
+  trimmed=$(echo "$line" | sed 's/[[:space:]]*$//')
+  [ -z "$trimmed" ] && continue
+  [[ "$trimmed" == Unused* ]] && continue
+  [[ "$trimmed" == npm* ]] && continue
+  [ -f "$trimmed" ] || continue
+  skip=false
+  for prefix in "${IGNORE_PREFIXES[@]}"; do
+    if [[ "$trimmed" == "$prefix"* ]]; then
+      skip=true
+      break
+    fi
+  done
+  $skip || UNUSED_FILES+=("$trimmed")
+done <<< "$KNIP_OUTPUT"
+
+if [ ${#UNUSED_FILES[@]} -eq 0 ]; then
+  echo -e "${GREEN}No unused files detected by knip.${RESET}"
+  exit 0
+fi
+
+echo -e "Found ${BOLD}${#UNUSED_FILES[@]}${RESET} unused files. Cross-referencing...\n"
+
+# ── Step 2: Build infra file list once ─────────────────────────────────────
+echo -e "${DIM}  Indexing infra files...${RESET}" >&2
+INFRA_FILES=$(collect_infra_files)
+INFRA_FILE_COUNT=$(echo "$INFRA_FILES" | wc -l | tr -d ' ')
+echo -e "${DIM}  Found ${INFRA_FILE_COUNT} infra/config files to check against.${RESET}" >&2
+if [ -n "$FACTORY_ROOT" ]; then
+  echo -e "${DIM}  Checking ${#SIBLING_REPOS[@]} sibling repos CI/CD pipelines...${RESET}\n" >&2
+else
+  echo -e "${DIM}  No factory layout detected — skipping sibling repo checks.${RESET}\n" >&2
+fi
+
+# ── Step 3: Cross-reference each file ──────────────────────────────────────
+declare -A FILE_STATUS  # "safe" | "infra" | "convention" | "routing" | "sibling_ci"
+declare -A FILE_REFS
+declare -A FILE_DATES
+
+total=${#UNUSED_FILES[@]}
+i=0
+
+for filepath in "${UNUSED_FILES[@]}"; do
+  i=$((i + 1))
+  printf "\r${DIM}  [%d/%d] %s${RESET}%*s" "$i" "$total" "$filepath" 20 "" >&2
+
+  name=$(basename "$filepath")
+  stem="${name%.*}"
+  status="safe"
+  refs=""
+
+  # ── Check 1: Internal infra (CI, Docker, build scripts, configs, tsconfigs, package.jsons) ──
+  infra_hits=$(search_infra "$name")
+  # Also try the relative path for more specific matches in CI workflows
+  if [ -z "$infra_hits" ]; then
+    infra_hits=$(search_infra "$filepath")
+  fi
+  if [ -n "$infra_hits" ]; then
+    status="infra"
+    refs="$infra_hits"
+  fi
+
+  # ── Check 2: Convention-based usage ──
+  if [ "$status" = "safe" ]; then
+    for pat in "${CONVENTION_PATTERNS[@]}"; do
+      if [[ "$name" == *"$pat"* ]]; then
+        status="convention"
+        refs="used by convention ($pat)"
+        break
+      fi
+    done
+  fi
+
+  # ── Check 3: File-based routing dirs ──
+  if [ "$status" = "safe" ]; then
+    for dir in "${ROUTING_DIRS[@]}"; do
+      if [[ "$filepath" == "$dir"* ]]; then
+        status="routing"
+        refs="file-based route ($dir)"
+        break
+      fi
+    done
+  fi
+
+  # ── Check 4: Sibling repo CI/CD references ──
+  # Only search by the openwork-relative path (precise) or unique filename.
+  # Since no sibling repo has npm deps on openwork packages, we only check
+  # CI/CD and build scripts for direct path references.
+  if [ "$status" = "safe" ]; then
+    sibling_hits=$(search_sibling_ci "$filepath")
+    if [ -z "$sibling_hits" ]; then
+      # Try filename only if it's specific enough (not a generic name)
+      case "$stem" in
+        index|utils|helpers|types|config|constants|schema|paths|extensions|sessions|\
+        system|context|sync|state|card|server|client|app|lib|store|api|auth|data|\
+        error|events|hooks|theme|styles|test|main|shared|common|base|core|model|\
+        service|provider|route|router|handler|middleware|plugin|loader|init|setup|\
+        health|status|log|logger|build|dev|start|run|layout|page|screen)
+          ;; # skip generic names
+        *)
+          sibling_hits=$(search_sibling_ci "$name")
+          ;;
+      esac
+    fi
+    if [ -n "$sibling_hits" ]; then
+      status="sibling_ci"
+      refs="$sibling_hits"
+    fi
+  fi
+
+  # Get last commit date
+  last_date=$(git log -1 --format="%aI" -- "$filepath" 2>/dev/null || echo "unknown")
+
+  FILE_STATUS["$filepath"]="$status"
+  FILE_REFS["$filepath"]="$refs"
+  FILE_DATES["$filepath"]="$last_date"
+done
+
+printf "\r%*s\r" 120 "" >&2
+
+# ── Step 4: Split into two buckets, sort by date ──────────────────────────
+safe_entries=()
+flagged_entries=()
+
+for filepath in "${UNUSED_FILES[@]}"; do
+  entry="${FILE_DATES[$filepath]}|$filepath"
+  if [ "${FILE_STATUS[$filepath]}" = "safe" ]; then
+    safe_entries+=("$entry")
+  else
+    flagged_entries+=("$entry")
+  fi
+done
+
+IFS=$'\n' safe_sorted=($(printf '%s\n' "${safe_entries[@]}" 2>/dev/null | sort)); unset IFS
+IFS=$'\n' flagged_sorted=($(printf '%s\n' "${flagged_entries[@]}" 2>/dev/null | sort)); unset IFS
+
+safe_count=${#safe_sorted[@]}
+flagged_count=${#flagged_sorted[@]}
+
+# ── Step 5: Display ───────────────────────────────────────────────────────
+
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
+echo -e "${RED}${BOLD} UNUSED — safe to remove (${safe_count})${RESET}"
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
+echo -e "${DIM}  No imports in openwork source, no references in CI/CD, build${RESET}"
+echo -e "${DIM}  scripts, configs, conventions, routing, or sibling repo pipelines.${RESET}"
+echo ""
+
+if [ "$safe_count" -eq 0 ]; then
+  echo -e "  ${GREEN}None — all files have references somewhere.${RESET}"
+else
+  for entry in "${safe_sorted[@]}"; do
+    date="${entry%%|*}"
+    filepath="${entry#*|}"
+    short_date="${date%%T*}"
+    echo -e "  ${RED}✗${RESET} ${DIM}${short_date}${RESET}  ./$filepath:1"
+  done
+fi
+
+echo ""
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
+echo -e "${YELLOW}${BOLD} REVIEW — referenced in infra/CI (${flagged_count})${RESET}"
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
+echo -e "${DIM}  Not imported in source, but referenced by build/CI/config/routing.${RESET}"
+echo -e "${DIM}  Verify the reference is real before removing.${RESET}"
+echo ""
+
+if [ "$flagged_count" -eq 0 ]; then
+  echo -e "  ${GREEN}None.${RESET}"
+else
+  for entry in "${flagged_sorted[@]}"; do
+    date="${entry%%|*}"
+    filepath="${entry#*|}"
+    status="${FILE_STATUS[$filepath]}"
+    refs="${FILE_REFS[$filepath]}"
+    short_date="${date%%T*}"
+    formatted_refs=$(format_refs "$refs")
+
+    case "$status" in
+      infra)
+        echo -e "  ${YELLOW}⚠${RESET} ${DIM}${short_date}${RESET}  ./$filepath:1"
+        echo -e "    ${DIM}↳ ${formatted_refs}${RESET}"
+        ;;
+      convention)
+        echo -e "  ${YELLOW}⚠${RESET} ${DIM}${short_date}${RESET}  ./$filepath:1"
+        echo -e "    ${DIM}↳ ${refs}${RESET}"
+        ;;
+      routing)
+        echo -e "  ${YELLOW}⚠${RESET} ${DIM}${short_date}${RESET}  ./$filepath:1"
+        echo -e "    ${DIM}↳ ${refs}${RESET}"
+        ;;
+      sibling_ci)
+        echo -e "  ${CYAN}⚠${RESET} ${DIM}${short_date}${RESET}  ./$filepath:1"
+        echo -e "    ${DIM}↳ sibling CI: ${formatted_refs}${RESET}"
+        ;;
+    esac
+  done
+fi
+
+echo ""
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
+echo -e "${BOLD}Summary:${RESET}  ${RED}${safe_count} removable${RESET}  │  ${YELLOW}${flagged_count} need review${RESET}  │  ${#UNUSED_FILES[@]} total"
+echo -e "${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
diff --git a/scripts/generate-changelog.mjs b/scripts/generate-changelog.mjs
new file mode 100644
index 0000000000..871212e1f9
--- /dev/null
+++ b/scripts/generate-changelog.mjs
@@ -0,0 +1,283 @@
+#!/usr/bin/env node
+
+import fs from "node:fs/promises"
+import { resolve, dirname } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const ROOT = resolve(__dirname, "..")
+const TRACKER_DIR = resolve(ROOT, "changelog")
+const OUTPUT_PATH = resolve(ROOT, "packages/docs/changelog.mdx")
+const COMPARE_BASE = "https://github.com/different-ai/openwork/compare"
+const TRACKER_FILE_PATTERN = /^release-tracker-\d{4}-\d{2}-\d{2}\.md$/
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const ORDINAL_RULES = new Map([
+  [1, "st"], [2, "nd"], [3, "rd"],
+  [21, "st"], [22, "nd"], [23, "rd"],
+  [31, "st"],
+])
+
+function ordinal(day) {
+  return ORDINAL_RULES.get(day) || "th"
+}
+
+const MONTHS = [
+  "January", "February", "March", "April", "May", "June",
+  "July", "August", "September", "October", "November", "December",
+]
+
+/** "2026-02-19T17:49:05Z" → "February 19th" */
+function formatDate(raw) {
+  // Handle non-standard values like "Unreleased draft release. Tagged at `2026-03-22T09:29:16-07:00`."
+  const isoMatch = raw.match(/(\d{4}-\d{2}-\d{2}T[\d:.Z+-]+)/)
+  if (!isoMatch) return null
+
+  const d = new Date(isoMatch[1])
+  if (isNaN(d.getTime())) return null
+
+  const month = MONTHS[d.getUTCMonth()]
+  const day = d.getUTCDate()
+  return `${month} ${day}${ordinal(day)}`
+}
+
+/**
+ * Build an array of applicable tags for a release.
+ *
+ * Returns all categories that have count > 0.
+ * If none apply, returns ["Misc"].
+ */
+function resolveTags(features, bugs, deprecated) {
+  const tags = []
+  if (features > 0) tags.push("🚀 New Features")
+  if (bugs > 0) tags.push("🐛 Bug Fixes")
+  if (deprecated > 0) tags.push("🏗️ Refactoring")
+  return tags.length > 0 ? tags : ["🔧 Misc"]
+}
+
+function inferPreviousVersion(version) {
+  const match = version.match(/^v(\d+)\.(\d+)\.(\d+)$/)
+  if (!match) return null
+
+  const [major, minor, patch] = match.slice(1).map(Number)
+  if (patch <= 0) return null
+
+  return `v${major}.${minor}.${patch - 1}`
+}
+
+// ---------------------------------------------------------------------------
+// Parser
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a release-tracker file into structured release objects.
+ *
+ * Splits on `## v` headings, then extracts `#### ` subsections inside each.
+ */
+function parseTracker(text) {
+  // Split into release blocks. First element is the file header.
+  const blocks = text.split(/^## /m).slice(1)
+
+  return blocks.map((block) => {
+    const lines = block.split("\n")
+    const versionLine = lines[0].trim() // e.g. "v0.11.100"
+    const version = versionLine
+
+    // Extract subsections keyed by their #### title
+    const sections = {}
+    let currentKey = null
+    for (let i = 1; i < lines.length; i++) {
+      const line = lines[i]
+      const heading = line.match(/^#### (.+)/)
+      if (heading) {
+        currentKey = heading[1].trim()
+        sections[currentKey] = []
+      } else if (currentKey !== null) {
+        sections[currentKey].push(line)
+      }
+    }
+
+    // Trim and join each section's content
+    for (const key of Object.keys(sections)) {
+      sections[key] = sections[key].join("\n").trim()
+    }
+
+    return { version, sections }
+  })
+}
+
+/**
+ * Transform a parsed release into a changelog entry object.
+ *
+ * @param {object} release  - parsed release block
+ * @param {string|null} prevVersion - previous version string for compare URL
+ */
+function toEntry(release, prevVersion) {
+  const s = release.sections
+
+  const releasedAt = s["Released at"]?.replace(/`/g, "").trim() || ""
+  const date = releasedAt ? formatDate(releasedAt) : null
+
+  const importance = (s["Release importance"] || "").toLowerCase()
+  const isMajor = importance.startsWith("major")
+
+  const oneLiner = s["One-line summary"]?.trim() || ""
+  const mainChanges = s["Main changes"]?.trim() || ""
+  const title = s["Title"]?.trim() || ""
+
+  const features = parseInt(s["Number of major improvements"] || "0", 10)
+  const bugs = parseInt(s["Number of major bugs resolved"] || "0", 10)
+  const deprecated = parseInt(s["Number of deprecated features"] || "0", 10)
+
+  const tags = resolveTags(features, bugs, deprecated)
+
+  // Build compare URL from consecutive versions: v0.11.200...v0.11.201
+  const compareBaseVersion = prevVersion || inferPreviousVersion(release.version)
+  const compareUrl = compareBaseVersion
+    ? `${COMPARE_BASE}/${compareBaseVersion}...${release.version}`
+    : ""
+
+  return {
+    version: release.version,
+    date,
+    isMajor,
+    tags,
+    title,
+    oneLiner,
+    mainChanges,
+    compareUrl,
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Renderer
+// ---------------------------------------------------------------------------
+
+/**
+ * Render a single version block (used inside a grouped day).
+ */
+function renderVersionBlock(entry) {
+  const lines = []
+
+  // Version is the linked heading; title is appended after it.
+  if (entry.compareUrl) {
+    lines.push(
+      entry.title
+        ? `  ## [${entry.version}](${entry.compareUrl}): ${entry.title}`
+        : `  ## [${entry.version}](${entry.compareUrl})`,
+    )
+  } else {
+    lines.push(entry.title ? `  ## ${entry.version}: ${entry.title}` : `  ## ${entry.version}`)
+  }
+
+  lines.push("")
+
+  // Body: major → bullet points, minor → one-liner
+  if (entry.isMajor && entry.mainChanges) {
+    const indented = entry.mainChanges
+      .split("\n")
+      .map((l) => (l.length > 0 ? `  ${l}` : ""))
+      .join("\n")
+    lines.push(indented)
+  } else {
+    lines.push(`  ${entry.oneLiner}`)
+  }
+
+  return lines.join("\n")
+}
+
+/**
+ * Group entries by date and render each group as a single <Update>.
+ * Tags are unioned across all entries in the day.
+ * "🔧 Misc" is dropped if any real tag exists.
+ */
+function renderDayGroup(dayEntries) {
+  // Union tags, dedup, drop Misc if real tags exist
+  const allTags = [...new Set(dayEntries.flatMap((e) => e.tags))]
+  const filtered = allTags.filter((t) => t !== "🔧 Misc")
+  const tags = filtered.length > 0 ? filtered : ["🔧 Misc"]
+
+  const tagsJsx = tags.map((t) => `"${t}"`).join(", ")
+  const date = dayEntries[0].date
+
+  const lines = []
+  lines.push(`<Update label="${date}" tags={[${tagsJsx}]}>`)
+
+  for (const entry of dayEntries) {
+    lines.push("")
+    lines.push(renderVersionBlock(entry))
+  }
+
+  lines.push("")
+  lines.push("</Update>")
+
+  return lines.join("\n")
+}
+
+function renderChangelog(entries) {
+  const header = [
+    "---",
+    'title: "Changelog"',
+    "---",
+    "",
+  ].join("\n")
+
+  // Filter, reverse (newest first), then group by date
+  const valid = entries.filter((e) => e.date !== null).reverse()
+  const grouped = []
+  for (const entry of valid) {
+    const last = grouped[grouped.length - 1]
+    if (last && last[0].date === entry.date) {
+      last.push(entry)
+    } else {
+      grouped.push([entry])
+    }
+  }
+
+  const body = grouped
+    .map(renderDayGroup)
+    .join("\n\n")
+
+  return header + body + "\n"
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+async function loadTrackerReleases() {
+  const entries = await fs.readdir(TRACKER_DIR, { withFileTypes: true })
+  const trackerFiles = entries
+    .filter((entry) => entry.isFile() && TRACKER_FILE_PATTERN.test(entry.name))
+    .map((entry) => entry.name)
+    .sort()
+
+  if (trackerFiles.length === 0) {
+    throw new Error(`No tracker files found in ${TRACKER_DIR}`)
+  }
+
+  const releases = []
+  for (const fileName of trackerFiles) {
+    const raw = await fs.readFile(resolve(TRACKER_DIR, fileName), "utf-8")
+    releases.push(...parseTracker(raw))
+  }
+
+  return { trackerFiles, releases }
+}
+
+async function main() {
+  const { trackerFiles, releases } = await loadTrackerReleases()
+  const entries = releases.map((r, i) => toEntry(r, i > 0 ? releases[i - 1].version : null))
+  const output = renderChangelog(entries)
+
+  await fs.writeFile(OUTPUT_PATH, output, "utf-8")
+  console.log(`Wrote ${entries.length} entries from ${trackerFiles.length} tracker files to ${OUTPUT_PATH}`)
+}
+
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})
diff --git a/scripts/i18n-audit.mjs b/scripts/i18n-audit.mjs
new file mode 100644
index 0000000000..41bbaf91d7
--- /dev/null
+++ b/scripts/i18n-audit.mjs
@@ -0,0 +1,636 @@
+#!/usr/bin/env node
+/**
+ * i18n-audit.mjs — Find missing translations and improperly used translation keys.
+ *
+ * Usage:
+ *   node scripts/i18n-audit.mjs              # full audit (default, excludes --hardcoded, --prune, --sort)
+ *   node scripts/i18n-audit.mjs --ci         # same as default but does not fail on missing non-en keys
+ *   node scripts/i18n-audit.mjs --missing    # missing keys (in EN but not in locale)
+ *   node scripts/i18n-audit.mjs --orphan     # orphan keys (in locale but not in EN)
+ *   node scripts/i18n-audit.mjs --duplicates # duplicate keys in any locale
+ *   node scripts/i18n-audit.mjs --unused     # unused keys (in EN but not referenced in repo)
+ *   node scripts/i18n-audit.mjs --dangling   # t() calls referencing keys not in en.ts
+ *   node scripts/i18n-audit.mjs --aliases    # aliased t() calls (translate/tr instead of t)
+ *   node scripts/i18n-audit.mjs --placeholders # placeholder integrity check
+ *   node scripts/i18n-audit.mjs --plurals    # each locale has bare key OR all CLDR plural forms it needs
+ *   node scripts/i18n-audit.mjs --hardcoded  # hardcoded English strings in source files
+ *   node scripts/i18n-audit.mjs --prune      # (destructive) remove unused keys from all locales
+ *   node scripts/i18n-audit.mjs --sort       # (destructive) alphabetically sort keys in all locales
+ */
+
+import { readFileSync, readdirSync, existsSync, writeFileSync } from "node:fs";
+import { join, basename, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, "..");
+const LOCALES_DIR = join(REPO_ROOT, "apps/app/src/i18n/locales");
+const APP_SRC = join(REPO_ROOT, "apps/app/src");
+
+const LOCALES = ["ja", "zh", "vi", "pt-BR", "th", "fr", "ca", "es", "ru"];
+const EN_FILE = join(LOCALES_DIR, "en.ts");
+
+const PLURAL_SUFFIXES = ["zero", "one", "two", "few", "many", "other"];
+const PLURAL_SUFFIX_RE = /_(zero|one|two|few|many|other)$/;
+const stripPluralSuffix = (key) => key.replace(PLURAL_SUFFIX_RE, "");
+
+// Directory names skipped during the source scan. The "locales" dir is intentionally
+// skipped; otherwise translation keys will trivially match themselves.
+const SKIP_DIRS = ["locales", "node_modules", "target", "dist", "build", "out", "coverage"];
+
+const mode = process.argv[2] ?? "--all";
+const isCi = mode === "--ci";
+const isAll = mode === "--all" || isCi;
+const EXCLUDED_FROM_ALL = new Set(["--hardcoded"]);
+const shouldRun = (...modes) => (isAll && !modes.some((m) => EXCLUDED_FROM_ALL.has(m))) || modes.includes(mode);
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Parse a locale .ts file into a JS object via eval. */
+function parseLocale(filePath) {
+  const content = readFileSync(filePath, "utf-8");
+  const match = content.match(/export default \{([\s\S]*?)\} as const;/);
+  if (!match) throw new Error(`Could not parse ${filePath}`);
+  return new Function(`return {${match[1]}}`)();
+}
+
+/** Extract translation keys from a locale .ts file (as a Set). */
+function extractKeys(filePath) {
+  return new Set(Object.keys(parseLocale(filePath)));
+}
+
+/** Extract key→value map from a locale .ts file. */
+function extractKeyValues(filePath) {
+  return new Map(Object.entries(parseLocale(filePath)));
+}
+
+/** Find all {placeholders} in a string. */
+function findPlaceholders(str) {
+  return [...str.matchAll(/\{([a-z_]+)\}/g)].map((m) => m[0]).sort();
+}
+
+/** Recursively collect all .ts/.tsx files under a directory. */
+function collectSourceFiles(dir, exclude) {
+  const results = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (exclude && exclude(full)) continue;
+      results.push(...collectSourceFiles(full, exclude));
+    } else if (/\.(ts|tsx)$/.test(entry.name)) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+/** Group an array of strings by prefix (before first dot). */
+function groupByPrefix(keys) {
+  const groups = new Map();
+  for (const key of keys) {
+    const prefix = key.split(".")[0];
+    groups.set(prefix, (groups.get(prefix) ?? 0) + 1);
+  }
+  return [...groups.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+/** Find duplicate keys in a file (must use regex — JSON.parse dedupes silently). */
+function findDuplicates(filePath) {
+  const content = readFileSync(filePath, "utf-8");
+  const seen = new Map();
+  const dupes = [];
+  for (const match of content.matchAll(/^\s*"([^"]+)"\s*:/gm)) {
+    const key = match[1];
+    if (seen.has(key)) dupes.push(key);
+    else seen.set(key, true);
+  }
+  return dupes;
+}
+
+// ---------------------------------------------------------------------------
+// Audit
+// ---------------------------------------------------------------------------
+
+const enKeys = extractKeys(EN_FILE);
+const enKeyValues = extractKeyValues(EN_FILE);
+let exitCode = 0;
+
+console.log("╔══════════════════════════════════════════════════╗");
+console.log("║              i18n Audit Report                   ║");
+console.log("╚══════════════════════════════════════════════════╝");
+console.log();
+
+// --- 1. Key counts ---
+console.log("=== Key counts ===");
+console.log(`  en       ${enKeys.size} keys (source of truth)`);
+for (const locale of LOCALES) {
+  const file = join(LOCALES_DIR, `${locale}.ts`);
+  if (!existsSync(file)) {
+    console.log(`  ${locale.padEnd(8)} MISSING FILE`);
+    continue;
+  }
+  const keys = extractKeys(file);
+  const pct = Math.round((keys.size / enKeys.size) * 100);
+  console.log(`  ${locale.padEnd(8)} ${keys.size} keys (${pct}%)`);
+}
+console.log();
+
+// --- 2. Missing keys ---
+if (shouldRun("--missing")) {
+  console.log("=== Missing keys (in en.ts but not in locale) ===");
+  for (const locale of LOCALES) {
+    const file = join(LOCALES_DIR, `${locale}.ts`);
+    if (!existsSync(file)) continue;
+    const localeKeys = extractKeys(file);
+    const missing = [...enKeys].filter((k) => !localeKeys.has(k));
+
+    if (missing.length === 0) {
+      console.log(`  ${locale}: ✓ no missing`);
+    } else {
+      console.log(`  ${locale}: ✗ ${missing.length} missing`);
+      if (!isCi) exitCode = 1;
+      if (mode !== "--summary") {
+        for (const [prefix, count] of groupByPrefix(missing).slice(0, 15)) {
+          console.log(`    ${String(count).padStart(4)}  ${prefix}.*`);
+        }
+        const totalGroups = new Set(missing.map((k) => k.split(".")[0])).size;
+        if (totalGroups > 15) console.log(`    ... and ${totalGroups - 15} more groups`);
+      }
+    }
+  }
+  console.log();
+}
+
+// Locales without plurals (e.g. Chinese, Japanese) use the bare key while en
+// defines suffixed variants — that's not orphan. The reverse (locale has a
+// suffix en doesn't) is also fine: the runtime falls back to en's bare or
+// other-suffix key.
+const enHasAnyPluralVariant = (key) =>
+  PLURAL_SUFFIXES.some((suffix) => enKeys.has(`${key}_${suffix}`));
+const isOrphan = (key) => {
+  if (enKeys.has(key)) return false;
+  if (enHasAnyPluralVariant(key)) return false;
+  const base = stripPluralSuffix(key);
+  if (base !== key) {
+    if (enKeys.has(base)) return false;
+    if (enHasAnyPluralVariant(base)) return false;
+  }
+  return true;
+};
+
+// --- 3. Orphan keys ---
+const orphansByLocale = {};
+if (shouldRun("--orphan", "--prune")) {
+  console.log("=== Orphan keys (in locale but not in en.ts) ===");
+  for (const locale of LOCALES) {
+    const file = join(LOCALES_DIR, `${locale}.ts`);
+    if (!existsSync(file)) continue;
+    const localeKeys = extractKeys(file);
+    const orphans = [...localeKeys].filter(isOrphan);
+    orphansByLocale[locale] = orphans;
+
+    if (orphans.length === 0) {
+      console.log(`  ${locale}: ✓ no orphans`);
+    } else {
+      console.log(`  ${locale}: ⚠ ${orphans.length} orphan keys`);
+      if (mode !== "--summary") {
+        for (const key of orphans.slice(0, 10)) console.log(`    ${key}`);
+        if (orphans.length > 10) console.log(`    ... and ${orphans.length - 10} more`);
+      }
+    }
+  }
+  console.log();
+}
+
+// --- 4. Duplicate keys ---
+if (shouldRun("--duplicates")) {
+  console.log("=== Duplicate keys ===");
+  for (const locale of ["en", ...LOCALES]) {
+    const file = join(LOCALES_DIR, `${locale}.ts`);
+    if (!existsSync(file)) continue;
+    const dupes = findDuplicates(file);
+    if (dupes.length === 0) {
+      console.log(`  ${locale}: ✓ no duplicates`);
+    } else {
+      console.log(`  ${locale}: ✗ ${dupes.length} duplicate keys`);
+      exitCode = 1;
+      if (mode !== "--summary") {
+        for (const key of dupes.slice(0, 5)) console.log(`    ${key}`);
+      }
+    }
+  }
+  console.log();
+}
+
+// --- 5. Unused keys ---
+let unusedKeys = [];
+if (shouldRun("--unused", "--prune")) {
+  console.log("=== Unused keys (in en.ts but never referenced in repo) ===");
+
+  // Search the entire repo (not just apps/app/src) for key references.
+  const repoSourceFiles = collectSourceFiles(REPO_ROOT, (dir) => {
+    const name = basename(dir);
+    return name.startsWith(".") || SKIP_DIRS.includes(name);
+  });
+  const allSource = repoSourceFiles.map((f) => readFileSync(f, "utf-8")).join("\n");
+
+  // A plural-suffixed key (foo_one / foo_other) counts as "used" when the
+  // base key (foo) is referenced — `t(key, { count })` resolves the suffix at
+  // runtime so the source never names the suffixed variant directly.
+  unusedKeys = [...enKeys].filter((key) => {
+    if (allSource.includes(key)) return false;
+    const base = stripPluralSuffix(key);
+    if (base !== key && allSource.includes(base)) return false;
+    return true;
+  });
+
+  if (unusedKeys.length === 0) {
+    console.log("  ✓ all keys referenced in source");
+  } else {
+    console.log(`  ⚠ ${unusedKeys.length} potentially unused keys`);
+    if (mode !== "--summary") {
+      for (const [prefix, count] of groupByPrefix(unusedKeys).slice(0, 15)) {
+        console.log(`    ${String(count).padStart(4)}  ${prefix}.*`);
+      }
+      console.log();
+      for (const key of unusedKeys) console.log(`    ${key}`);
+    }
+    if (mode !== "--prune") {
+      console.log();
+      console.log("  (auto-fix with --prune option)");
+    }
+  }
+  console.log();
+}
+
+// --- 6. Dangling t() calls (referencing keys not in en.ts) ---
+if (shouldRun("--dangling")) {
+  console.log("=== Dangling t() calls (keys not in en.ts) ===");
+
+  const sourceFiles = collectSourceFiles(APP_SRC, (dir) => dir.includes("locales"));
+  // Match t("key.name"), t("key.name", ...), translate("key.name"), tr("key.name")
+  const keyRefPattern = /\b(?:t|translate|tr)\(\s*"([a-z][a-z0-9_]*\.[a-z][a-z0-9_.]*?)"/g;
+
+  // A `t("foo")` call resolves if `foo` exists OR any plural variant
+  // (`foo_one`, `foo_other`, etc.) exists — the runtime picks a variant
+  // based on params.count.
+  const keyResolves = (key) => {
+    if (enKeys.has(key)) return true;
+    return PLURAL_SUFFIXES.some((suffix) => enKeys.has(`${key}_${suffix}`));
+  };
+
+  const dangling = [];
+  for (const file of sourceFiles) {
+    const content = readFileSync(file, "utf-8");
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      for (const match of lines[i].matchAll(keyRefPattern)) {
+        const key = match[1];
+        if (!keyResolves(key)) {
+          dangling.push({ key, file: file.replace(REPO_ROOT + "/", ""), line: i + 1 });
+        }
+      }
+    }
+  }
+
+  if (dangling.length === 0) {
+    console.log("  ✓ all t() keys exist in en.ts");
+  } else {
+    console.log(`  ✗ ${dangling.length} dangling references`);
+    exitCode = 1;
+    if (mode !== "--summary") {
+      for (const { key, file, line } of dangling) {
+        console.log(`    ${file}:${line} → "${key}"`);
+      }
+    }
+  }
+  console.log();
+
+  // --- 7. Dynamic t() calls (keys built at runtime) ---
+  console.log("=== Dynamic t() calls (keys built at runtime) ===");
+  const dynamicPattern = /\b(?:t|translate|tr)\(\s*(`[^`]*\$\{|[^"'][^,)]*\+)/g;
+  const dynamicHits = [];
+  for (const file of sourceFiles) {
+    const content = readFileSync(file, "utf-8");
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      if (dynamicPattern.test(lines[i])) {
+        dynamicHits.push({ file: file.replace(REPO_ROOT + "/", ""), line: i + 1, text: lines[i].trim() });
+      }
+      dynamicPattern.lastIndex = 0;
+    }
+  }
+
+  if (dynamicHits.length === 0) {
+    console.log("  ✓ no dynamic key construction");
+  } else {
+    console.log(`  ✗ ${dynamicHits.length} dynamic key constructions (should be static strings)`);
+    exitCode = 1;
+    for (const { file, line, text } of dynamicHits) {
+      console.log(`    ${file}:${line}`);
+      console.log(`      ${text.slice(0, 120)}`);
+    }
+  }
+  console.log();
+}
+
+// --- 8. Aliased t() calls (should use t() directly, not translate/tr wrappers) ---
+if (shouldRun("--aliases")) {
+  console.log("=== Aliased t() calls (should use t() directly) ===");
+
+  const aliasSourceFiles = collectSourceFiles(APP_SRC, (dir) => dir.includes("locales"));
+  const aliasPattern = /\b(?:translate|tr)\s*\(/g;
+  const aliasDefPattern = /(?:const|function)\s+(?:translate|tr)\s*[=(]/;
+  const aliasSkipPattern = /translate\s*\(\s*[-\d]|translate\s*\(\s*0|props\.translate|:\s*\(key:\s*string\)|`translate\(/;
+  const hits = [];
+
+  for (const file of aliasSourceFiles) {
+    const content = readFileSync(file, "utf-8");
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      if (aliasDefPattern.test(lines[i])) continue;
+      if (aliasSkipPattern.test(lines[i])) continue;
+      if (aliasPattern.test(lines[i])) {
+        hits.push({ file: file.replace(REPO_ROOT + "/", ""), line: i + 1, text: lines[i].trim() });
+      }
+      aliasPattern.lastIndex = 0;
+    }
+  }
+
+  if (hits.length === 0) {
+    console.log("  ✓ all calls use t() directly");
+  } else {
+    console.log(`  ⚠ ${hits.length} aliased calls (translate/tr instead of t)`);
+    for (const { file, line, text } of hits) {
+      console.log(`    ${file}:${line}`);
+      console.log(`      ${text.slice(0, 120)}`);
+    }
+  }
+  console.log();
+}
+
+// --- 9. Placeholder integrity ---
+if (shouldRun("--placeholders")) {
+  console.log("=== Placeholder integrity ===");
+  let problems = 0;
+
+  for (const [key, enValue] of enKeyValues) {
+    const enPh = findPlaceholders(enValue);
+    if (enPh.length === 0) continue;
+
+    for (const locale of LOCALES) {
+      const file = join(LOCALES_DIR, `${locale}.ts`);
+      if (!existsSync(file)) continue;
+      const localeKV = extractKeyValues(file);
+      const localeValue = localeKV.get(key);
+      if (!localeValue) continue;
+
+      const localePh = findPlaceholders(localeValue);
+      // {count} is optional in `_zero` / `_one` variants — the translator
+      // can write "No messages" or "1 message" instead of "{count} message".
+      const countOptional = /_(zero|one)$/.test(key);
+      for (const ph of enPh) {
+        if (countOptional && ph === "{count}") continue;
+        if (!localePh.includes(ph)) {
+          console.log(`  ✗ ${locale}/${key}: missing placeholder ${ph}`);
+          problems++;
+          exitCode = 1;
+        }
+      }
+    }
+  }
+
+  if (problems === 0) console.log("  ✓ all placeholders preserved");
+  else console.log(`  ✗ ${problems} placeholder issues`);
+  console.log();
+}
+
+// --- 10. Plural completeness ---
+// For every key whose en value contains `{count}`, each locale must define
+// either the bare key (catch-all) or every plural form its language needs.
+// Most languages use `_one`+`_other`; `PLURAL_FORMS` lists the languages
+// that need more, verified against `Intl.PluralRules` (what `t()` uses at
+// runtime based on CLDR).
+const DEFAULT_PLURAL_FORM = ["one", "other"];
+const PLURAL_FORMS = {
+  ar: ["zero", "one", "two", "few", "many", "other"], // Arabic
+  be: ["one", "few", "many", "other"],                // Belarusian
+  bs: ["one", "few", "other"],                        // Bosnian
+  cs: ["one", "few", "many", "other"],                // Czech
+  cy: ["zero", "one", "two", "few", "many", "other"], // Welsh
+  ga: ["one", "two", "few", "many", "other"],         // Irish
+  gd: ["one", "two", "few", "other"],                 // Scottish Gaelic
+  gv: ["one", "two", "few", "many", "other"],         // Manx
+  he: ["one", "two", "other"],                        // Hebrew
+  hr: ["one", "few", "other"],                        // Croatian
+  iu: ["one", "two", "other"],                        // Inuktitut
+  kw: ["zero", "one", "two", "few", "many", "other"], // Cornish
+  lt: ["one", "few", "many", "other"],                // Lithuanian
+  lv: ["zero", "one", "other"],                       // Latvian
+  mt: ["one", "two", "few", "many", "other"],         // Maltese
+  pl: ["one", "few", "many", "other"],                // Polish
+  ro: ["one", "few", "other"],                        // Romanian
+  ru: ["one", "few", "many", "other"],                // Russian
+  sk: ["one", "few", "many", "other"],                // Slovak
+  sl: ["one", "two", "few", "other"],                 // Slovenian
+  sr: ["one", "few", "other"],                        // Serbian
+  uk: ["one", "few", "many", "other"],                // Ukrainian
+};
+
+if (shouldRun("--plurals")) {
+  console.log("=== Plural completeness ===");
+
+  const pluralBases = new Set();
+  for (const [key, value] of enKeyValues) {
+    if (typeof value === "string" && value.includes("{count}")) {
+      pluralBases.add(stripPluralSuffix(key));
+    }
+  }
+
+  for (const locale of ["en", ...LOCALES]) {
+    const file = join(LOCALES_DIR, `${locale}.ts`);
+    if (!existsSync(file)) continue;
+    const required = PLURAL_FORMS[locale] ?? DEFAULT_PLURAL_FORM;
+    const localeKeys = extractKeys(file);
+    const incomplete = [];
+
+    for (const base of pluralBases) {
+      if (localeKeys.has(base)) continue;
+      const missing = required.filter((cat) => !localeKeys.has(`${base}_${cat}`));
+      if (missing.length === required.length) continue; // locale has none of these — handled by --missing
+      if (missing.length > 0) incomplete.push({ base, missing });
+    }
+
+    if (incomplete.length === 0) {
+      console.log(`  ${locale}: ✓ all plural keys complete`);
+    } else {
+      console.log(`  ${locale}: ✗ ${incomplete.length} incomplete plural keys`);
+      exitCode = 1;
+      if (mode !== "--summary") {
+        for (const { base, missing } of incomplete) {
+          console.log(`    ${base}: missing ${missing.map((m) => `_${m}`).join(", ")}`);
+        }
+      }
+    }
+  }
+  if (pluralBases.size === 0) {
+    console.log("  (no plural-base keys found in en.ts)");
+  }
+  console.log();
+}
+
+// --- 11. Hardcoded English scan ---
+if (shouldRun("--hardcoded")) {
+  console.log("=== Hardcoded English scan ===");
+
+  const hardcodedFiles = collectSourceFiles(APP_SRC, (dir) => dir.includes("locales"));
+
+  const excludePatterns = [
+    /import\b/, /from\s+"/, /class=/, /\btype\s/, /\bconst\s/, /variant=/,
+    /\bt\(/, /translate\(/, /"connected"/, /"allow"/, /"local"/, /"remote"/,
+    /"object"/, /"string"/, /"user"/, /"assistant"/, /"Escape"/, /"Arrow/,
+    /"Enter"/, /"prompt"/, /"session"/, /"automation"/, /"minimal"/, /"starter"/,
+    /"docker"/, /"opencode"/, /"simple"/, /"Started"/, /"Progress"/,
+    /^\s*\/\//, /^\s*\/\*/,
+  ];
+
+  const englishPattern = />[A-Z][a-z]{2,}[^<]*<|"[A-Z][a-z]{3,}[a-z ]+[.!?]?"/;
+
+  for (const full of hardcodedFiles) {
+    const name = full.replace(APP_SRC + "/", "");
+    const lines = readFileSync(full, "utf-8").split("\n");
+    const hits = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!englishPattern.test(line)) continue;
+      if (excludePatterns.some((p) => p.test(line))) continue;
+      hits.push(`    ${i + 1}: ${line.trim()}`);
+      if (hits.length >= 5) break;
+    }
+
+    if (hits.length === 0) {
+      console.log(`  ${name}: ✓ clean`);
+    } else {
+      console.log(`  ${name}: ⚠ possible hardcoded strings:`);
+      for (const hit of hits) console.log(hit);
+    }
+  }
+  console.log();
+}
+
+// --- 11. Sort ---
+if (mode === "--sort") {
+  console.log("=== Sorting all locale files alphabetically ===");
+  const allLocaleFiles = ["en", ...LOCALES].map((l) => join(LOCALES_DIR, `${l}.ts`));
+
+  const PLURAL_ORDER = { _zero: 0, _one: 1, _two: 2, _few: 3, _many: 4, _other: 5 };
+
+  function sortKey(key) {
+    let normalized = key.replace(/\./g, "\x00");
+    for (const [suffix, order] of Object.entries(PLURAL_ORDER)) {
+      if (normalized.endsWith(suffix)) {
+        normalized = normalized.slice(0, -suffix.length) + `\x01${order}`;
+        break;
+      }
+    }
+    return normalized;
+  }
+
+  for (const file of allLocaleFiles) {
+    if (!existsSync(file)) continue;
+    const content = readFileSync(file, "utf-8");
+
+    // Extract preamble (header comment) and body
+    const exportMatch = content.match(/^([\s\S]*?)(export default \{)([\s\S]*?)(\} as const;\s*)$/);
+    if (!exportMatch) {
+      console.log(`  ${basename(file, ".ts")}: ⚠ could not parse, skipped`);
+      continue;
+    }
+    const [, preamble, , body] = exportMatch;
+
+    // Eval the body as a JS object to get all key-value pairs
+    let obj;
+    try {
+      obj = new Function(`return {${body}}`)();
+    } catch (e) {
+      console.log(`  ${basename(file, ".ts")}: ⚠ eval failed, skipped (${e.message})`);
+      continue;
+    }
+
+    // Sort keys
+    const sortedKeys = Object.keys(obj).sort((a, b) => {
+      const ak = sortKey(a);
+      const bk = sortKey(b);
+      return ak < bk ? -1 : ak > bk ? 1 : 0;
+    });
+
+    // Rebuild — JSON.stringify handles all escaping (\n, quotes, etc.)
+    const lines = sortedKeys.map((key) =>
+      `  ${JSON.stringify(key)}: ${JSON.stringify(obj[key])},`
+    );
+    writeFileSync(file, `${preamble}export default {\n${lines.join("\n")}\n} as const;\n`);
+    const locale = basename(file, ".ts");
+    console.log(`  ${locale}: ${sortedKeys.length} keys sorted`);
+  }
+  console.log();
+}
+
+// --- 12. Prune (destructive) ---
+// Runs last so the user sees the unused/orphan reports above before
+// keys are actually removed. Removes both unused-from-source keys (en
+// only) and per-locale orphans (keys missing from en).
+if (mode === "--prune") {
+  console.log("=== Pruning ===");
+  const unusedSet = new Set(unusedKeys);
+  const allLocaleFiles = ["en", ...LOCALES].map((l) => join(LOCALES_DIR, `${l}.ts`));
+  let totalRemoved = 0;
+
+  for (const file of allLocaleFiles) {
+    if (!existsSync(file)) continue;
+    const localeName = basename(file, ".ts");
+    const removeSet = new Set(unusedSet);
+    const orphans = orphansByLocale[localeName] ?? [];
+    for (const key of orphans) removeSet.add(key);
+    const orphanCount = orphans.length;
+    if (removeSet.size === 0) continue;
+
+    const content = readFileSync(file, "utf-8");
+    const lines = content.split("\n");
+    const filtered = [];
+    let skipNextLine = false;
+
+    for (let i = 0; i < lines.length; i++) {
+      if (skipNextLine) {
+        skipNextLine = false;
+        continue;
+      }
+      const keyMatch = lines[i].match(/^\s*"([^"]+)"\s*:/);
+      if (keyMatch && removeSet.has(keyMatch[1])) {
+        // Multi-line entry: value on next line
+        if (!lines[i].includes('",') && !lines[i].includes('": "') && i + 1 < lines.length) {
+          skipNextLine = true;
+        }
+        continue;
+      }
+      filtered.push(lines[i]);
+    }
+
+    writeFileSync(file, filtered.join("\n"));
+    const removed = lines.length - filtered.length;
+    totalRemoved += removed;
+    const breakdown = orphanCount > 0
+      ? ` (${removed - orphanCount} unused, ${orphanCount} orphan)`
+      : "";
+    console.log(`  ${localeName}: removed ${removed} lines${breakdown}`);
+  }
+
+  if (totalRemoved === 0) console.log("  ✓ nothing to prune");
+  console.log();
+}
+
+// --- Done ---
+console.log("=== Done ===");
+process.exit(exitCode);
diff --git a/scripts/migration/01-cut-migration-release.mjs b/scripts/migration/01-cut-migration-release.mjs
new file mode 100755
index 0000000000..2c72f30238
--- /dev/null
+++ b/scripts/migration/01-cut-migration-release.mjs
@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+// Cut the Tauri → Electron migration release (v0.12.0 or whatever).
+// Bumps versions, writes the migration-release env fragment, commits, tags,
+// pushes. Idempotent safeties: refuses to run on a dirty tree.
+//
+// Usage:
+//   node scripts/migration/01-cut-migration-release.mjs \
+//     --version 0.12.0 \
+//     --mac-url   'https://.../OpenWork-darwin-arm64-0.12.0-mac.zip' \
+//     --mac-arm64-url 'https://.../openwork-mac-arm64-0.12.0.zip' \
+//     --mac-x64-url   'https://.../openwork-mac-x64-0.12.0.zip' \
+//     --win-url   'https://.../OpenWork-Setup-0.12.0.exe'  (optional) \
+//     --linux-url 'https://.../OpenWork-0.12.0.AppImage'   (optional) \
+//     --dry-run
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, "../..");
+
+function parseArgs(argv) {
+  const out = { dryRun: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--dry-run") out.dryRun = true;
+    else if (arg === "--version") out.version = argv[++i];
+    else if (arg === "--mac-url") out.macUrl = argv[++i];
+    else if (arg === "--mac-arm64-url") out.macArm64Url = argv[++i];
+    else if (arg === "--mac-x64-url") out.macX64Url = argv[++i];
+    else if (arg === "--mac-sha256") out.macSha256 = argv[++i];
+    else if (arg === "--win-url") out.winUrl = argv[++i];
+    else if (arg === "--win-x64-url") out.winX64Url = argv[++i];
+    else if (arg === "--linux-url") out.linuxUrl = argv[++i];
+    else if (arg === "--linux-arm64-url") out.linuxArm64Url = argv[++i];
+    else if (arg === "--linux-x64-url") out.linuxX64Url = argv[++i];
+    else if (arg === "--help" || arg === "-h") out.help = true;
+    else {
+      console.error(`unknown arg: ${arg}`);
+      process.exit(2);
+    }
+  }
+  return out;
+}
+
+function die(msg) {
+  console.error(`[cut-release] ${msg}`);
+  process.exit(1);
+}
+
+function run(cmd, args, opts = {}) {
+  console.log(`[cut-release] $ ${cmd} ${args.join(" ")}`);
+  if (opts.dryRun) return "";
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd ?? repoRoot,
+    stdio: opts.capture ? ["ignore", "pipe", "inherit"] : "inherit",
+    encoding: "utf8",
+  });
+  if (result.status !== 0) die(`command failed: ${cmd}`);
+  return (result.stdout ?? "").trim();
+}
+
+function gitStatusClean() {
+  const result = spawnSync("git", ["status", "--porcelain"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+  return result.status === 0 && (result.stdout ?? "").trim().length === 0;
+}
+
+function currentBranch() {
+  const result = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+  return (result.stdout ?? "").trim();
+}
+
+function tagExists(tag) {
+  const result = spawnSync("git", ["rev-parse", "-q", "--verify", `refs/tags/${tag}`], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+  return result.status === 0;
+}
+
+function remoteTagExists(tag) {
+  const result = spawnSync("git", ["ls-remote", "--tags", "origin", tag], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+  return result.status === 0 && (result.stdout ?? "").includes(`refs/tags/${tag}`);
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    console.log(
+      [
+        "Cut the Tauri → Electron migration release.",
+        "",
+        "Required: --version, --mac-url (or --mac-arm64-url + --mac-x64-url)",
+        "Optional: --mac-sha256, --win-url, --win-x64-url, --linux-url, --linux-arm64-url, --linux-x64-url, --dry-run",
+      ].join("\n"),
+    );
+    return;
+  }
+
+  if (!args.version) die("--version is required (e.g. --version 0.12.0)");
+  if (!args.macUrl && (!args.macArm64Url || !args.macX64Url)) {
+    die("--mac-url or both --mac-arm64-url + --mac-x64-url are required");
+  }
+  if (!/^\d+\.\d+\.\d+$/.test(args.version)) {
+    die(`--version must look like X.Y.Z, got "${args.version}"`);
+  }
+
+  if (!gitStatusClean()) {
+    die("working tree is dirty. commit or stash before cutting a release.");
+  }
+
+  const branch = currentBranch();
+  if (branch !== "dev" && branch !== "main") {
+    console.warn(
+      `[cut-release] WARNING: current branch is "${branch}". Releases are usually cut from main/dev.`,
+    );
+  }
+
+  const tag = `v${args.version}`;
+  if (tagExists(tag)) die(`tag ${tag} already exists locally`);
+  if (remoteTagExists(tag)) die(`tag ${tag} already exists on origin`);
+
+  // 1. Bump all 5 sync files via the existing helper.
+  run("pnpm", ["bump:set", "--", args.version], { dryRun: args.dryRun });
+
+  // Keep CI/release jobs using --frozen-lockfile green after bumping
+  // workspace package versions referenced by pnpm-lock.yaml.
+  run("pnpm", ["install", "--no-frozen-lockfile"], { dryRun: args.dryRun });
+
+  // 2. Write the migration-release env fragment. Gets picked up by the
+  //    app build step during `Release App` via --copy-config.
+  const envFragment =
+    [
+      "# Generated by scripts/migration/01-cut-migration-release.mjs.",
+      "# Consumed by apps/app Vite build during the v0.12.0 release only.",
+      "VITE_OPENWORK_MIGRATION_RELEASE=1",
+      `VITE_OPENWORK_MIGRATION_VERSION=${args.version}`,
+      args.macUrl ? `VITE_OPENWORK_MIGRATION_MAC_URL=${args.macUrl}` : "",
+      args.macArm64Url ? `VITE_OPENWORK_MIGRATION_MAC_ARM64_URL=${args.macArm64Url}` : "",
+      args.macX64Url ? `VITE_OPENWORK_MIGRATION_MAC_X64_URL=${args.macX64Url}` : "",
+      args.macSha256 ? `VITE_OPENWORK_MIGRATION_MAC_SHA256=${args.macSha256}` : "",
+      args.winUrl ? `VITE_OPENWORK_MIGRATION_WINDOWS_URL=${args.winUrl}` : "",
+      args.winX64Url ? `VITE_OPENWORK_MIGRATION_WINDOWS_X64_URL=${args.winX64Url}` : "",
+      args.linuxUrl ? `VITE_OPENWORK_MIGRATION_LINUX_URL=${args.linuxUrl}` : "",
+      args.linuxArm64Url ? `VITE_OPENWORK_MIGRATION_LINUX_ARM64_URL=${args.linuxArm64Url}` : "",
+      args.linuxX64Url ? `VITE_OPENWORK_MIGRATION_LINUX_X64_URL=${args.linuxX64Url}` : "",
+      "",
+    ]
+      .filter(Boolean)
+      .join("\n");
+
+  const envPath = resolve(repoRoot, "apps/app/.env.migration-release");
+  console.log(`[cut-release] writing ${envPath}`);
+  if (!args.dryRun) {
+    await writeFile(envPath, envFragment, "utf8");
+  }
+
+  // 3. Commit version bump + env fragment.
+  run("git", ["add", "-A"], { dryRun: args.dryRun });
+  run(
+    "git",
+    ["commit", "-m", `chore(release): cut v${args.version} (Tauri → Electron migration)`],
+    { dryRun: args.dryRun },
+  );
+
+  // 4. Tag + push.
+  run("git", ["tag", tag], { dryRun: args.dryRun });
+  run("git", ["push", "origin", branch], { dryRun: args.dryRun });
+  run("git", ["push", "origin", tag], { dryRun: args.dryRun });
+
+  console.log("");
+  console.log(`[cut-release] pushed ${tag}.`);
+  console.log(`[cut-release] watch the workflow:`);
+  console.log(`    gh run list --repo different-ai/openwork --workflow "Release App" --limit 3`);
+  console.log(`    gh run watch --repo different-ai/openwork`);
+  console.log("");
+  console.log(`[cut-release] once the workflow finishes, run:`);
+  console.log(`    node scripts/migration/02-validate-migration.mjs --tag ${tag}`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/scripts/migration/02-validate-migration.mjs b/scripts/migration/02-validate-migration.mjs
new file mode 100755
index 0000000000..61d2610941
--- /dev/null
+++ b/scripts/migration/02-validate-migration.mjs
@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+// Guided validation for a migration release. Mix of automated probes and
+// checklist prompts you acknowledge in-terminal. Designed to be run in a
+// release-review pair session.
+//
+// Usage:
+//   node scripts/migration/02-validate-migration.mjs --tag v0.12.0
+//   node scripts/migration/02-validate-migration.mjs --tag v0.12.0 --skip-manual
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createReadStream, existsSync } from "node:fs";
+import { mkdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, "../..");
+
+function parseArgs(argv) {
+  const out = { skipManual: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--skip-manual") out.skipManual = true;
+    else if (arg === "--tag") out.tag = argv[++i];
+    else if (arg === "--help" || arg === "-h") out.help = true;
+  }
+  return out;
+}
+
+function die(msg) {
+  console.error(`[validate] ${msg}`);
+  process.exit(1);
+}
+
+async function sha256(path) {
+  const hash = createHash("sha256");
+  return await new Promise((resolvePromise, rejectPromise) => {
+    createReadStream(path)
+      .on("data", (chunk) => hash.update(chunk))
+      .on("end", () => resolvePromise(hash.digest("hex")))
+      .on("error", rejectPromise);
+  });
+}
+
+async function confirm(prompt) {
+  const rl = createInterface({ input, output });
+  try {
+    const answer = (await rl.question(`${prompt} [y/N] `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
+async function ghReleaseAssets(tag) {
+  const result = spawnSync(
+    "gh",
+    [
+      "release",
+      "view",
+      tag,
+      "--repo",
+      "different-ai/openwork",
+      "--json",
+      "assets",
+    ],
+    { encoding: "utf8" },
+  );
+  if (result.status !== 0) die(`gh release view ${tag} failed`);
+  const parsed = JSON.parse(result.stdout);
+  return parsed.assets ?? [];
+}
+
+async function ghDownload(tag, assetName, targetDir) {
+  await mkdir(targetDir, { recursive: true });
+  const target = join(targetDir, assetName);
+  const result = spawnSync(
+    "gh",
+    [
+      "release",
+      "download",
+      tag,
+      "--repo",
+      "different-ai/openwork",
+      "--pattern",
+      assetName,
+      "--dir",
+      targetDir,
+      "--clobber",
+    ],
+    { stdio: "inherit" },
+  );
+  if (result.status !== 0) die(`gh release download failed for ${assetName}`);
+  return target;
+}
+
+function codesignVerify(appPath) {
+  const result = spawnSync(
+    "codesign",
+    ["--verify", "--deep", "--strict", "--verbose=2", appPath],
+    { encoding: "utf8" },
+  );
+  return {
+    ok: result.status === 0,
+    message: (result.stderr ?? "").trim() || (result.stdout ?? "").trim(),
+  };
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help || !args.tag) {
+    console.log("Usage: 02-validate-migration.mjs --tag vX.Y.Z [--skip-manual]");
+    process.exit(args.help ? 0 : 2);
+  }
+
+  const workDir = join(tmpdir(), `openwork-migrate-validate-${args.tag}`);
+  await rm(workDir, { recursive: true, force: true });
+  await mkdir(workDir, { recursive: true });
+
+  console.log(`[validate] scratch dir: ${workDir}`);
+
+  // 1. List assets on the release.
+  const assets = await ghReleaseAssets(args.tag);
+  const names = assets.map((a) => a.name);
+  console.log(`[validate] release ${args.tag} has ${assets.length} assets`);
+  names.forEach((n) => console.log(`    - ${n}`));
+
+  const electronZip = names.find(
+    (n) => /electron|\.zip$/i.test(n) && n.includes("mac"),
+  ) ?? names.find((n) => n.endsWith(".zip"));
+  const electronYml = names.find((n) => n === "latest-mac.yml");
+  const tauriLatestJson = names.find((n) => n === "latest.json");
+
+  const presenceChecks = [
+    ["electron macOS zip", electronZip],
+    ["electron-updater manifest (latest-mac.yml)", electronYml],
+    ["tauri minisign feed (latest.json)", tauriLatestJson],
+  ];
+  console.log("");
+  console.log("[validate] required release assets:");
+  presenceChecks.forEach(([label, name]) => {
+    console.log(`    ${name ? "✓" : "✗"} ${label}${name ? ` — ${name}` : ""}`);
+  });
+  if (!electronZip) die("no Electron zip asset on the release.");
+
+  // 2. Download + Apple sig check on the Electron zip.
+  console.log("");
+  console.log("[validate] downloading Electron zip for signature check…");
+  const zipPath = await ghDownload(args.tag, electronZip, workDir);
+  console.log(`[validate] got ${zipPath} (${(await readFile(zipPath)).byteLength} bytes)`);
+  const zipHash = await sha256(zipPath);
+  console.log(`[validate] sha256 = ${zipHash}`);
+
+  const unzipDir = join(workDir, "unzipped");
+  await mkdir(unzipDir, { recursive: true });
+  const unzipResult = spawnSync("unzip", ["-q", "-o", zipPath, "-d", unzipDir], {
+    stdio: "inherit",
+  });
+  if (unzipResult.status !== 0) die("unzip failed");
+  const appPath = join(unzipDir, "OpenWork.app");
+  if (!existsSync(appPath)) {
+    console.log(`[validate] ✗ OpenWork.app not found inside zip (got: ${unzipDir})`);
+    die("zip layout unexpected");
+  }
+  const sig = codesignVerify(appPath);
+  console.log(`[validate] ${sig.ok ? "✓" : "✗"} codesign verify on ${appPath}`);
+  if (!sig.ok) console.log(sig.message);
+
+  // 3. Manual steps.
+  if (args.skipManual) {
+    console.log("[validate] --skip-manual: stopping here.");
+    return;
+  }
+
+  console.log("");
+  console.log("[validate] manual checklist — acknowledge each step.");
+  const steps = [
+    "Install a fresh Tauri v0.11.x build on a test machine (or VM).",
+    `Launch it, "Check for updates" → migrates to ${args.tag}.`,
+    "Restart, see the 'OpenWork is moving' modal, click 'Install now'.",
+    "Confirm Electron app launches automatically after ~30s.",
+    "Confirm sidebar shows every workspace that was visible in Tauri.",
+    "Open one workspace; confirm last session is preselected.",
+    "Settings → Advanced: both runtimes show 'Connected'.",
+    "Reopen: confirm the migration modal does NOT reappear.",
+  ];
+  for (const step of steps) {
+    const ok = await confirm(`  ☐ ${step}`);
+    if (!ok) die(`manual step declined: ${step}`);
+  }
+
+  console.log("");
+  console.log("[validate] all checks passed. Migration release is healthy.");
+  console.log("[validate] watch v0.12.0 telemetry for ~1-2 weeks before running");
+  console.log("           node scripts/migration/03-post-migration-cleanup.mjs");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/scripts/migration/03-post-migration-cleanup.mjs b/scripts/migration/03-post-migration-cleanup.mjs
new file mode 100755
index 0000000000..9b74a065d3
--- /dev/null
+++ b/scripts/migration/03-post-migration-cleanup.mjs
@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+// Post-migration cleanup. Run this ONLY after v0.12.x has been stable
+// for ~1-2 weeks and telemetry confirms users have rolled over to the
+// Electron build. Irreversible (well, revertible via git, but not
+// trivial to redeploy the Tauri path after removing it).
+//
+// Usage:
+//   node scripts/migration/03-post-migration-cleanup.mjs --dry-run   # default
+//   node scripts/migration/03-post-migration-cleanup.mjs --execute   # actually do it
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, "../..");
+
+function parseArgs(argv) {
+  // Default is dry-run for safety; --execute required to actually do it.
+  const out = { dryRun: true };
+  for (const arg of argv) {
+    if (arg === "--execute") out.dryRun = false;
+    else if (arg === "--dry-run") out.dryRun = true;
+    else if (arg === "--help" || arg === "-h") out.help = true;
+    else {
+      console.error(`unknown arg: ${arg}`);
+      process.exit(2);
+    }
+  }
+  return out;
+}
+
+function log(msg) {
+  console.log(`[cleanup] ${msg}`);
+}
+
+function run(cmd, args, opts = {}) {
+  log(`$ ${cmd} ${args.join(" ")}`);
+  if (opts.dryRun) return "";
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd ?? repoRoot,
+    stdio: "inherit",
+  });
+  if (result.status !== 0) {
+    console.error(`[cleanup] command failed: ${cmd}`);
+    process.exit(1);
+  }
+}
+
+async function patchJson(path, updater, { dryRun }) {
+  const raw = await readFile(path, "utf8");
+  const parsed = JSON.parse(raw);
+  const next = updater(parsed);
+  if (JSON.stringify(parsed) === JSON.stringify(next)) {
+    log(`no change needed: ${path}`);
+    return;
+  }
+  log(`patching: ${path}`);
+  if (!dryRun) {
+    await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+  }
+}
+
+async function replaceInFile(path, replacements, { dryRun }) {
+  if (!existsSync(path)) return;
+  const original = await readFile(path, "utf8");
+  let next = original;
+  for (const [pattern, replacement] of replacements) {
+    next = next.replace(pattern, replacement);
+  }
+  if (next === original) return;
+  log(`rewriting: ${path}`);
+  if (!dryRun) {
+    await writeFile(path, next, "utf8");
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    console.log(
+      [
+        "Post-migration cleanup (Tauri → Electron).",
+        "",
+        "Runs in dry-run mode by default. Pass --execute to actually change files.",
+      ].join("\n"),
+    );
+    return;
+  }
+
+  if (args.dryRun) {
+    log("DRY RUN — no filesystem changes. Pass --execute to apply.");
+  }
+
+  // 1. Flip apps/desktop/package.json defaults to Electron.
+  const desktopPkgPath = resolve(repoRoot, "apps/desktop/package.json");
+  await patchJson(
+    desktopPkgPath,
+    (pkg) => {
+      const scripts = { ...(pkg.scripts ?? {}) };
+      scripts.dev = "node ./scripts/electron-dev.mjs";
+      scripts.build = "node ./scripts/electron-build.mjs";
+      scripts.package =
+        "pnpm run build && pnpm exec electron-builder --config electron-builder.yml";
+      scripts["dev:electron"] = undefined;
+      scripts["build:electron"] = undefined;
+      scripts["package:electron"] = undefined;
+      scripts["package:electron:dir"] =
+        "pnpm run build && pnpm exec electron-builder --config electron-builder.yml --dir";
+      scripts.electron = undefined;
+      scripts["dev:react-session"] = undefined;
+      scripts["dev:electron:react-session"] =
+        "VITE_OPENWORK_REACT_SESSION=1 node ./scripts/electron-dev.mjs";
+      // Remove Tauri-specific script entries.
+      scripts["build:debug:react-session"] = undefined;
+      scripts["dev:windows"] = undefined;
+      scripts["dev:windows:x64"] = undefined;
+
+      const filteredScripts = Object.fromEntries(
+        Object.entries(scripts).filter(([, v]) => v != null),
+      );
+      const devDeps = { ...(pkg.devDependencies ?? {}) };
+      delete devDeps["@tauri-apps/cli"];
+      return { ...pkg, scripts: filteredScripts, devDependencies: devDeps };
+    },
+    { dryRun: args.dryRun },
+  );
+
+  // 2. Strip @tauri-apps/* from apps/app and apps/story-book package.json.
+  for (const pkgPath of [
+    resolve(repoRoot, "apps/app/package.json"),
+    resolve(repoRoot, "apps/story-book/package.json"),
+  ]) {
+    if (!existsSync(pkgPath)) continue;
+    await patchJson(
+      pkgPath,
+      (pkg) => {
+        const deps = { ...(pkg.dependencies ?? {}) };
+        const devDeps = { ...(pkg.devDependencies ?? {}) };
+        for (const name of Object.keys(deps)) {
+          if (name.startsWith("@tauri-apps/")) delete deps[name];
+        }
+        for (const name of Object.keys(devDeps)) {
+          if (name.startsWith("@tauri-apps/")) delete devDeps[name];
+        }
+        return { ...pkg, dependencies: deps, devDependencies: devDeps };
+      },
+      { dryRun: args.dryRun },
+    );
+  }
+
+  // 3. Delete src-tauri/ entirely.
+  run("git", ["rm", "-r", "-f", "apps/desktop/src-tauri"], { dryRun: args.dryRun });
+
+  // 4. Collapse desktop-tauri.ts into desktop.ts. We do a surgical rename
+  //    for now and leave the collapse for a follow-up PR; deleting the
+  //    proxy layer is a bigger refactor.
+  log(
+    "[reminder] apps/app/src/app/lib/desktop-tauri.ts still exists. After this script lands,",
+  );
+  log(
+    "           open a follow-up PR that inlines desktop.ts's Electron path and removes the",
+  );
+  log("           proxy + re-export surface.");
+
+  // 5. Drop AGENTS.md / ARCHITECTURE.md / README.md Tauri references.
+  const docReplacements = [
+    [/Tauri 2\.x/g, "Electron"],
+    [/\| Desktop\/Mobile shell \| Tauri 2\.x\s+\|/g, "| Desktop/Mobile shell | Electron |"],
+    [/apps\/desktop\/src-tauri/g, "apps/desktop/electron"],
+  ];
+  for (const path of [
+    resolve(repoRoot, "AGENTS.md"),
+    resolve(repoRoot, "ARCHITECTURE.md"),
+    resolve(repoRoot, "README.md"),
+  ]) {
+    await replaceInFile(path, docReplacements, { dryRun: args.dryRun });
+  }
+
+  // 6. Remove the migration-release env fragment once it's no longer
+  //    relevant.
+  run("git", ["rm", "-f", "apps/app/.env.migration-release"], {
+    dryRun: args.dryRun,
+  });
+
+  // 7. Once Tauri is gone, make the sidecar helper's default output match the
+  //    Electron resource layout. Before cleanup, Tauri still uses the old
+  //    default and Electron passes --outdir explicitly.
+  await replaceInFile(
+    resolve(repoRoot, "apps/desktop/scripts/prepare-sidecar.mjs"),
+    [
+      [
+        /join\(__dirname, "\.\.", "src-tauri", "sidecars"\)/,
+        'join(__dirname, "..", "resources", "sidecars")',
+      ],
+    ],
+    { dryRun: args.dryRun },
+  );
+
+  // 8. Stage + commit.
+  run("git", ["add", "-A"], { dryRun: args.dryRun });
+  run(
+    "git",
+    [
+      "commit",
+      "-m",
+      "chore(desktop): remove Tauri shell, make Electron the default\n\nRun after v0.12.x stabilized in the wild. See\nscripts/migration/README.md for the full runbook.",
+    ],
+    { dryRun: args.dryRun },
+  );
+
+  log("");
+  log(
+    args.dryRun
+      ? "dry run complete. rerun with --execute to apply."
+      : "commit created. push + open PR for review.",
+  );
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/scripts/migration/README.md b/scripts/migration/README.md
new file mode 100644
index 0000000000..b3b0802acd
--- /dev/null
+++ b/scripts/migration/README.md
@@ -0,0 +1,146 @@
+# Tauri → Electron migration runbook
+
+Three scripts. Run in order. Each one is idempotent and prints what it
+will do before it does it.
+
+```
+scripts/migration/01-cut-migration-release.mjs   # cut v0.12.0, the last Tauri release
+scripts/migration/02-validate-migration.mjs      # guided post-release smoke test
+scripts/migration/03-post-migration-cleanup.mjs  # delete src-tauri, flip defaults (run after users stabilize)
+```
+
+## When to run what
+
+| Step | When | What user-visible effect |
+| ---- | ---- | ------------------------ |
+| 01   | Ready to ship the migration | Tauri users see "OpenWork is moving" prompt on next update |
+| 02   | Right after the workflow finishes | Dogfood validation — no user effect |
+| 03   | After 1-2 weeks of stable Electron telemetry | Dev repo is Electron-only; no user effect |
+
+## Current safe-prep rollout
+
+The next release is intentionally **non-destructive**:
+
+- Tauri remains the main/stable desktop build and keeps using the existing
+  Tauri updater feed (`latest.json`).
+- The alpha macOS arm64 release now carries both notarized Tauri artifacts
+  (`latest.json`) and notarized Electron artifacts (`latest-mac.yml`) on the
+  rolling `alpha-macos-latest` release.
+- Electron is built as a preview artifact on every push by
+  `.github/workflows/build-electron-desktop.yml`.
+- Pushes to `dev` or `main` refresh the rolling prerelease bucket at
+  <https://github.com/different-ai/openwork/releases/tag/electron-preview-latest>.
+- The Debug settings migration controls are Tauri-only and developer-mode only.
+  The default action, **Prepare migration data**, only writes
+  `migration-snapshot.v1.json`; it does not quit, replace, or delete Tauri.
+- The install handoff requires a pasted Electron artifact URL plus two explicit
+  confirmations. On macOS the native handoff keeps the previous bundle at
+  `OpenWork.app.migrate-bak` for rollback.
+
+Use this safe-prep release to test migration data capture and preview downloads
+before enabling any user-facing migration prompt.
+
+### Sharing Electron preview downloads
+
+1. Wait for `Build Electron Desktop Preview` to finish on the target commit.
+2. Share the rolling preview release page:
+   <https://github.com/different-ai/openwork/releases/tag/electron-preview-latest>
+3. Ask testers to download the matching platform artifact:
+   - macOS Apple Silicon: `openwork-mac-arm64-*.dmg` or `.zip`
+   - macOS Intel: `openwork-mac-x64-*.dmg` or `.zip`
+   - Windows: `openwork-win-x64-*.exe`
+   - Linux: `openwork-linux-x64-*.AppImage` or `.tar.gz`
+
+Do not point stable Tauri users at these preview assets as an automatic update
+until the explicit migration release is cut and validated.
+
+## 01 — cut-migration-release.mjs
+
+```bash
+node scripts/migration/01-cut-migration-release.mjs --version 0.12.0 \
+  --mac-url 'https://github.com/different-ai/openwork/releases/download/v0.12.0/OpenWork-darwin-arm64-0.12.0-mac.zip' \
+  --dry-run         # inspect planned changes first
+```
+
+What it does:
+
+1. Refuses to run on a dirty working tree.
+2. Runs `pnpm bump:set -- <version>` (bumps all 5 sync files per
+   AGENTS.md release runbook).
+3. Creates a release-config fragment at
+   `apps/app/.env.migration-release` setting
+   `VITE_OPENWORK_MIGRATION_RELEASE=1` and the per-platform download
+   URLs. The `Release App` workflow copies this into the build env so
+   the migration prompt is dormant on every other build but live for
+   this release.
+4. Commits the version bump.
+5. Creates and pushes the `vX.Y.Z` tag.
+6. Prints `gh run watch` command so you can follow the workflow.
+
+Drop `--dry-run` to actually execute.
+
+## 02 — validate-migration.mjs
+
+```bash
+node scripts/migration/02-validate-migration.mjs --tag v0.12.0
+```
+
+Interactive guided check. Prints steps and confirms each one before
+moving on:
+
+1. Downloads the Tauri DMG for the tag and verifies its minisign
+   signature (reuses the existing updater public key).
+2. Downloads the Electron .zip for the tag and verifies the Apple
+   Developer ID signature.
+3. Prompts you to install the Tauri DMG on a fresh machine / VM and
+   confirm the migration prompt appears.
+4. Drops a canary key into localStorage on the Tauri side, triggers
+   "Install now", and checks that the canary survives into the Electron
+   launch via `readMigrationSnapshot` + localStorage inspection.
+5. Reports pass/fail for each step.
+
+Needs `--skip-manual` to run the automated parts only. Useful inside a
+release-review meeting as a shared checklist.
+
+## 03 — post-migration-cleanup.mjs
+
+```bash
+node scripts/migration/03-post-migration-cleanup.mjs --dry-run
+```
+
+Once v0.12.x has been stable for 1-2 weeks:
+
+1. Flips `apps/desktop/package.json` defaults:
+   - `dev` → `node ./scripts/electron-dev.mjs`
+   - `build` → `node ./scripts/electron-build.mjs`
+   - `package` → `pnpm run build && pnpm exec electron-builder …`
+2. Removes `apps/desktop/src-tauri/` entirely. Electron icons and generated
+   sidecars already live under `apps/desktop/resources/`, so this step no
+   longer removes anything the Electron packager needs.
+3. Strips `@tauri-apps/*` from `apps/app/package.json` and
+   `apps/story-book/package.json`.
+4. Collapses `apps/app/src/app/lib/desktop-tauri.ts` into
+   `desktop.ts` (direct Electron implementation).
+5. Updates `AGENTS.md`, `ARCHITECTURE.md`, `README.md`, translated
+   READMEs to drop Tauri references.
+6. Updates the release runbook in `AGENTS.md` to remove the
+   `Cargo.toml` and `tauri.conf.json` version-bump entries.
+7. Creates a commit with the combined cleanup.
+
+Drop `--dry-run` to actually perform the changes.
+
+## Emergency rollback
+
+If the v0.12.0 migration release is bad:
+
+- Users on Electron already: ship v0.12.1 via electron-updater. Same
+  mechanism as any other update.
+- Users still on Tauri: the migrate prompt is gated on
+  `VITE_OPENWORK_MIGRATION_RELEASE=1` at build time. Re-cut the
+  release with that flag unset, minisign-sign a replacement
+  `latest.json`, and users who haven't clicked "Install now" yet will
+  fall back to the non-migrating release.
+- Users mid-migration: the Rust `migrate_to_electron` command keeps
+  the previous `.app` at `OpenWork.app.migrate-bak`. Instruct users
+  to `mv OpenWork.app.migrate-bak OpenWork.app` if the Electron
+  launch fails.
diff --git a/scripts/openwork-debug.sh b/scripts/openwork-debug.sh
new file mode 100755
index 0000000000..9a72e00f6d
--- /dev/null
+++ b/scripts/openwork-debug.sh
@@ -0,0 +1,633 @@
+#!/usr/bin/env bash
+#
+# openwork-debug.sh — one-stop observability + lifecycle control for the
+# OpenWork dev stack.
+#
+# Subcommands:
+#   snapshot        (default) processes, ports, health, orphans, sink preview
+#   status          same as snapshot
+#   tail            live tail pnpm dev + the /dev/log sink
+#   sink            print the dev log sink path
+#   kill-orphans    remove orphan openwork/opencode processes (ppid == launchd)
+#   diagnose-hang   classify Electron crash/hang/sidecar/app-state failures
+#   stop            full, layered teardown of the dev stack (no cache wipe)
+#   start           launch pnpm dev in the background with the log sink on
+#   wait-healthy    block until openwork-server reports /health = 200
+#   reset           stop + wipe Vite dep cache + truncate log sink + start
+#   restart         alias for reset
+#
+# Variant (OPENWORK_DEV_VARIANT):
+#   electron   (default) pnpm --filter @openwork/desktop dev:electron
+#              Electron shell + CDP on 127.0.0.1:9823 for chrome-devtools MCP.
+#              Sidecars run from apps/desktop/src-tauri/sidecars/*.
+#   tauri      legacy: pnpm dev (Tauri dev webview, no CDP).
+#              Sidecars run from apps/desktop/src-tauri/target/debug/*.
+#
+# Teardown ordering (important, both variants):
+#   1. pnpm dev / dev:electron supervisor  (parent supervisor)
+#   2. tauri dev                           (Rust dev runner, if still alive)
+#   3. Tauri webview       (target/debug/OpenWork-Dev)  <-- never /Applications/
+#   4. Electron main+helpers (node_modules/electron/...Electron.app)
+#   5. Vite                (node node_modules/.../vite)
+#   6. orchestrator + openwork-server + opencode + opencode-router
+#      (both target/debug/* and src-tauri/sidecars/* trees)
+#
+# Cache/ephemeral state wiped by `reset`:
+#   - Vite dep pre-bundle cache: apps/app/node_modules/.vite
+#   - Vite metadata cache:        node_modules/.vite (root, if present)
+#   - dev log sink file (truncated, not deleted)
+#
+# Explicitly NOT touched by `reset`:
+#   - ~/Library/Application Support/com.differentai.openwork.dev/** (tokens,
+#     workspaces registry, prefs). Use `reset-webview` for WebKit state.
+#   - /Applications/OpenWork.app (prod build never targeted).
+#
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Config
+
+REPO_ROOT="${REPO_ROOT:-}"
+if [[ -z "$REPO_ROOT" ]]; then
+  REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
+fi
+if [[ -z "$REPO_ROOT" ]]; then
+  REPO_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+fi
+
+DEV_LOG_FILE="${OPENWORK_DEV_LOG_FILE:-$HOME/.openwork/debug/openwork-dev.log}"
+PNPM_DEV_LOG="${OPENWORK_PNPM_DEV_LOG:-/tmp/openwork-test/pnpm-dev.log}"
+PNPM_DEV_PID_FILE="${OPENWORK_PNPM_DEV_PID:-/tmp/openwork-test/pnpm-dev.pid}"
+WAIT_HEALTHY_SECS="${OPENWORK_WAIT_HEALTHY_SECS:-90}"
+ELECTRON_CDP_PORT="${OPENWORK_ELECTRON_REMOTE_DEBUG_PORT:-9823}"
+
+# Dev variant. 'electron' (default) launches pnpm dev:electron with CDP on
+# 127.0.0.1:9823 so chrome-devtools MCP can attach. 'tauri' preserves the
+# legacy pnpm dev (Tauri webview) for users still on that path.
+DEV_VARIANT="${OPENWORK_DEV_VARIANT:-electron}"
+case "$DEV_VARIANT" in electron|tauri) ;; *)
+  printf '[openwork-debug] unknown OPENWORK_DEV_VARIANT=%s (expected electron|tauri)\n' "$DEV_VARIANT" >&2
+  exit 2
+  ;;
+esac
+
+# ---------------------------------------------------------------------------
+# Helpers
+
+log() { printf '[openwork-debug] %s\n' "$*"; }
+
+kill_by_pattern() {
+  # Sends TERM then KILL to every process whose full command line matches the
+  # given regex. Used for targeted teardown of things like the Tauri dev
+  # webview (matched by its target/debug path, so prod OpenWork.app is safe).
+  local pattern="$1"
+  local pids
+  pids=$(pgrep -f "$pattern" || true)
+  if [[ -z "$pids" ]]; then
+    return 0
+  fi
+  # shellcheck disable=SC2086
+  kill $pids 2>/dev/null || true
+  sleep 1
+  pids=$(pgrep -f "$pattern" || true)
+  if [[ -n "$pids" ]]; then
+    # shellcheck disable=SC2086
+    kill -9 $pids 2>/dev/null || true
+  fi
+}
+
+kill_pid_file() {
+  local file="$1"
+  [[ -f "$file" ]] || return 0
+  local pid
+  pid=$(tr -d '\n' <"$file" || true)
+  rm -f "$file" 2>/dev/null || true
+  [[ -z "$pid" ]] && return 0
+  if kill -0 "$pid" 2>/dev/null; then
+    kill "$pid" 2>/dev/null || true
+    sleep 1
+    kill -0 "$pid" 2>/dev/null && kill -9 "$pid" 2>/dev/null || true
+  fi
+}
+
+discover_openwork_server_port() {
+  ps -Ao command \
+    | grep -E "(target/debug|apps/desktop/src-tauri/sidecars)/openwork-server" \
+    | grep -v grep \
+    | grep -oE '\-\-port [0-9]+' \
+    | head -1 \
+    | awk '{print $2}' \
+    || true
+}
+
+electron_renderer_stats() {
+  ps -axo pid,ppid,pcpu,pmem,rss,command \
+    | awk '/Electron Helper \(Renderer\)/ && /com\.differentai\.openwork/ && !/awk/ && !/grep/ {print; found=1} END {exit found ? 0 : 1}' \
+    || true
+}
+
+electron_renderer_pid() {
+  electron_renderer_stats | awk 'NR == 1 {print $1}'
+}
+
+electron_renderer_cpu() {
+  electron_renderer_stats | awk 'NR == 1 {print $3}'
+}
+
+probe_electron_page_cdp() {
+  node <<'NODE'
+const port = process.env.OPENWORK_ELECTRON_REMOTE_DEBUG_PORT || "9823";
+const controller = new AbortController();
+const fail = (message) => {
+  console.error(message);
+  process.exit(1);
+};
+const timeout = setTimeout(() => controller.abort(), 1800);
+let targets;
+try {
+  const response = await fetch(`http://127.0.0.1:${port}/json/list`, { signal: controller.signal });
+  targets = await response.json();
+} catch (error) {
+  clearTimeout(timeout);
+  fail(`target-list-failed: ${error instanceof Error ? error.message : String(error)}`);
+}
+clearTimeout(timeout);
+const page = targets.find((target) => target.type === "page" && target.webSocketDebuggerUrl);
+if (!page) fail("no-page-target");
+
+const ws = new WebSocket(page.webSocketDebuggerUrl);
+let settled = false;
+const timer = setTimeout(() => {
+  if (settled) return;
+  settled = true;
+  try { ws.close(); } catch {}
+  fail("page-cdp-timeout");
+}, 2200);
+ws.onopen = () => {
+  ws.send(JSON.stringify({ id: 1, method: "Runtime.evaluate", params: { expression: "1+1", returnByValue: true } }));
+};
+ws.onerror = () => {
+  if (settled) return;
+  settled = true;
+  clearTimeout(timer);
+  fail("page-cdp-websocket-error");
+};
+ws.onmessage = (event) => {
+  try {
+    const message = JSON.parse(event.data);
+    if (message.id !== 1) return;
+    settled = true;
+    clearTimeout(timer);
+    try { ws.close(); } catch {}
+    if (message.error) fail(`page-cdp-error: ${message.error.message ?? JSON.stringify(message.error)}`);
+    console.log("ok");
+    process.exit(0);
+  } catch (error) {
+    settled = true;
+    clearTimeout(timer);
+    fail(`page-cdp-parse-error: ${error instanceof Error ? error.message : String(error)}`);
+  }
+};
+NODE
+}
+
+# ---------------------------------------------------------------------------
+# Public subcommands
+
+snapshot() {
+  echo "=== dev stack processes ==="
+  ps -Ao pid,ppid,command | awk '/target\/debug\/OpenWork-Dev|node_modules\/electron\/dist\/Electron\.app\/Contents\/MacOS\/Electron|apps\/desktop\/scripts\/electron-dev\.mjs|target\/debug\/openwork-server|target\/debug\/openwork-orchestrator|target\/debug\/opencode( |\/)|target\/debug\/opencode-router|apps\/desktop\/src-tauri\/sidecars\/openwork-server|apps\/desktop\/src-tauri\/sidecars\/openwork-orchestrator|apps\/desktop\/src-tauri\/sidecars\/opencode( |\/)|apps\/desktop\/src-tauri\/sidecars\/opencode-router|vite|pnpm .*dev/ && !/awk/ && !/grep/' | sed -E 's#/Users/[^ ]*/#…/#g' | head -20
+
+  echo
+  echo "=== openwork-server ==="
+  local port
+  port=$(discover_openwork_server_port)
+  if [[ -z "$port" ]]; then
+    echo "  (no dev openwork-server running)"
+  else
+    echo "  port=$port  health:"
+    curl -sS --max-time 2 "http://127.0.0.1:$port/health" || echo "    unreachable"
+    echo
+  fi
+
+  echo
+  echo "=== opencode (via orchestrator) ==="
+  local oc_port
+  oc_port=$(ps -Ao command \
+    | grep -E "(target/debug|apps/desktop/src-tauri/sidecars)/openwork-orchestrator" \
+    | grep -v grep \
+    | grep -oE '\-\-opencode-port [0-9]+' \
+    | head -1 \
+    | awk '{print $2}' \
+    || true)
+  if [[ -z "$oc_port" ]]; then
+    echo "  (no opencode port)"
+  else
+    echo "  port=$oc_port"
+    curl -sS --max-time 2 "http://127.0.0.1:$oc_port/app" | head -c 200
+    echo
+  fi
+
+  echo
+  echo "=== opencode-router ==="
+  local r_port
+  r_port=$(ps -Ao command \
+    | grep -E "(target/debug|apps/desktop/src-tauri/sidecars)/opencode-router" \
+    | grep -v grep \
+    | grep -oE '\-\-opencode-url http://127.0.0.1:[0-9]+' \
+    | head -1 \
+    | awk '{print $2}' \
+    || true)
+  if [[ -z "$r_port" ]]; then
+    echo "  (no opencode-router info)"
+  else
+    echo "  attached to $r_port"
+  fi
+
+  echo
+  echo "=== orphans (parent == 1) ==="
+  ps -Ao pid,ppid,command | awk '$2 == 1 && $3 ~ /openwork-server|openwork-orchestrator|opencode( |\/)|opencode-router/' | head
+
+  echo
+  echo "=== dev log sink ==="
+  echo "  path=$DEV_LOG_FILE"
+  if [[ -f "$DEV_LOG_FILE" ]]; then
+    ls -la "$DEV_LOG_FILE"
+    echo "  last 5 entries:"
+    tail -5 "$DEV_LOG_FILE"
+  else
+    echo "  (no sink file yet — run the dev app with OPENWORK_DEV_LOG_FILE set)"
+  fi
+}
+
+tail_logs() {
+  local sources=()
+  [[ -f "$PNPM_DEV_LOG" ]] && sources+=("$PNPM_DEV_LOG")
+  [[ -f "$DEV_LOG_FILE" ]] && sources+=("$DEV_LOG_FILE")
+  if [[ ${#sources[@]} -eq 0 ]]; then
+    echo "no log files to tail yet" >&2
+    exit 1
+  fi
+  echo "tailing: ${sources[*]}" >&2
+  tail -F "${sources[@]}"
+}
+
+kill_orphans() {
+  local pids
+  pids=$(ps -Ao pid,ppid,command | awk '$2 == 1 && $3 ~ /openwork-server|openwork-orchestrator|opencode( |\/)|opencode-router/ {print $1}')
+  if [[ -z "$pids" ]]; then
+    log "no orphans"
+    return 0
+  fi
+  log "killing orphans: $pids"
+  # shellcheck disable=SC2086
+  kill $pids 2>/dev/null || true
+  sleep 1
+  # shellcheck disable=SC2086
+  kill -9 $pids 2>/dev/null || true
+}
+
+diagnose_hang() {
+  local now
+  now=$(date "+%Y-%m-%dT%H:%M:%S%z")
+  echo "=== openwork hang diagnosis ==="
+  echo "time=$now"
+  echo "repo=$REPO_ROOT"
+  echo "cdp=http://127.0.0.1:$ELECTRON_CDP_PORT"
+  echo
+
+  echo "=== browser CDP ==="
+  local browser_json target_json
+  browser_json=$(curl -sS --max-time 2 "http://127.0.0.1:$ELECTRON_CDP_PORT/json/version" 2>&1 || true)
+  if [[ "$browser_json" == *"webSocketDebuggerUrl"* ]]; then
+    echo "  browser: responsive"
+    printf '%s\n' "$browser_json" | sed -n '1,8p'
+  else
+    echo "  browser: not reachable"
+    printf '  %s\n' "$browser_json"
+  fi
+
+  echo
+  echo "=== page target ==="
+  target_json=$(curl -sS --max-time 2 "http://127.0.0.1:$ELECTRON_CDP_PORT/json/list" 2>&1 || true)
+  if [[ "$target_json" == *"webSocketDebuggerUrl"* ]]; then
+    printf '%s\n' "$target_json" | sed -n '1,20p'
+  else
+    echo "  no page target (or target list failed)"
+    printf '  %s\n' "$target_json"
+  fi
+
+  echo
+  echo "=== renderer process ==="
+  local renderer_stats renderer_pid renderer_cpu
+  renderer_stats=$(electron_renderer_stats)
+  renderer_pid=$(printf '%s\n' "$renderer_stats" | awk 'NR == 1 {print $1}')
+  renderer_cpu=$(printf '%s\n' "$renderer_stats" | awk 'NR == 1 {print $3}')
+  if [[ -n "$renderer_pid" ]]; then
+    echo "  renderer: alive"
+    echo "  PID PPID %CPU %MEM RSS COMMAND"
+    printf '  %s\n' "$renderer_stats" | sed -E 's#/Users/[^ ]*/#…/#g'
+  else
+    echo "  renderer: missing"
+  fi
+
+  echo
+  echo "=== page CDP probe ==="
+  local page_probe="skipped"
+  if [[ "$browser_json" == *"webSocketDebuggerUrl"* && "$target_json" == *"webSocketDebuggerUrl"* ]]; then
+    if page_probe=$(OPENWORK_ELECTRON_REMOTE_DEBUG_PORT="$ELECTRON_CDP_PORT" probe_electron_page_cdp 2>&1); then
+      echo "  page: responsive ($page_probe)"
+      page_probe="ok"
+    else
+      echo "  page: unresponsive ($page_probe)"
+      page_probe="failed"
+    fi
+  else
+    echo "  page: skipped (browser or page target unavailable)"
+  fi
+
+  echo
+  echo "=== classification ==="
+  local high_cpu="false"
+  if [[ -n "${renderer_cpu:-}" ]]; then
+    high_cpu=$(awk -v cpu="$renderer_cpu" 'BEGIN {print (cpu + 0 >= 80) ? "true" : "false"}')
+  fi
+  if [[ "$browser_json" != *"webSocketDebuggerUrl"* ]]; then
+    echo "  no-electron-cdp: Electron is down or was not launched with CDP."
+  elif [[ "$target_json" == *"webSocketDebuggerUrl"* && -z "$renderer_pid" ]]; then
+    echo "  renderer-crashed: browser CDP advertises a page but no renderer process exists."
+    echo "  next: inspect latest macOS .ips crash report below."
+  elif [[ -n "$renderer_pid" && "$page_probe" == "failed" && "$high_cpu" == "true" ]]; then
+    echo "  renderer-hung-hot: renderer exists, page CDP timed out, CPU >= 80%."
+    echo "  next: use the sample captured below; logs will usually stop once wedged."
+  elif [[ -n "$renderer_pid" && "$page_probe" == "failed" ]]; then
+    echo "  renderer-unresponsive: renderer exists but page CDP timed out."
+    echo "  next: sample + check memory/CPU; could be blocked main thread or native stall."
+  elif [[ -n "$renderer_pid" && "$page_probe" == "ok" ]]; then
+    echo "  renderer-responsive: likely app-state or sidecar/API issue, not a renderer hang."
+  else
+    echo "  unknown: insufficient signal."
+  fi
+
+  echo
+  echo "=== latest crash report ==="
+  local crash
+  crash=$(ls -t "$HOME"/Library/Logs/DiagnosticReports/*"Electron Helper (Renderer)"*.ips 2>/dev/null | head -1 || true)
+  if [[ -n "$crash" ]]; then
+    ls -la "$crash"
+    sed -n '1,55p' "$crash" 2>/dev/null | sed -n '1,25p'
+  else
+    echo "  no Electron renderer .ips crash report found"
+  fi
+
+  echo
+  echo "=== sidecar health ==="
+  local port
+  port=$(discover_openwork_server_port)
+  if [[ -n "$port" ]]; then
+    echo "  openwork-server port=$port"
+    curl -sS --max-time 2 "http://127.0.0.1:$port/health" || echo "unreachable"
+    echo
+  else
+    echo "  no openwork-server port discovered"
+  fi
+
+  echo
+  echo "=== recent dev sink ==="
+  echo "  path=$DEV_LOG_FILE"
+  if [[ -f "$DEV_LOG_FILE" ]]; then
+    ls -la "$DEV_LOG_FILE"
+    tail -40 "$DEV_LOG_FILE"
+  else
+    echo "  missing"
+  fi
+
+  echo
+  echo "=== recent pnpm log ==="
+  echo "  path=$PNPM_DEV_LOG"
+  if [[ -f "$PNPM_DEV_LOG" ]]; then
+    ls -la "$PNPM_DEV_LOG"
+    tail -80 "$PNPM_DEV_LOG"
+  else
+    echo "  missing"
+  fi
+
+  echo
+  echo "=== renderer sample ==="
+  if [[ -n "$renderer_pid" && ( "$page_probe" == "failed" || "$high_cpu" == "true" ) ]]; then
+    local sample_file="/tmp/openwork-renderer-${renderer_pid}-$(date +%Y%m%dT%H%M%S).sample.txt"
+    if sample "$renderer_pid" 3 -file "$sample_file" >/dev/null 2>&1; then
+      echo "  captured=$sample_file"
+      grep -n "Thread_.*CrRendererMain\|Call graph:\|Physical footprint" "$sample_file" | head -20 || true
+    else
+      echo "  sample failed for pid=$renderer_pid"
+    fi
+  elif [[ -n "$renderer_pid" ]]; then
+    echo "  skipped (renderer responsive and CPU not high). Set OPENWORK_FORCE_SAMPLE=1 not currently supported."
+  else
+    echo "  skipped (no renderer process to sample)."
+  fi
+}
+
+# Ordered teardown. Safe to run when nothing is up; each step is idempotent.
+stop() {
+  log "stopping dev stack (layered)"
+
+  # 1. pnpm dev: prefer the PID file we wrote at start-time so we match the
+  #    exact process tree for this stack, not some unrelated pnpm run.
+  kill_pid_file "$PNPM_DEV_PID_FILE"
+
+  # Also catch any other pnpm dev supervisor that might be running against
+  # this repo (e.g. started by a different terminal before the PID file
+  # existed). The cwd match keeps us from touching pnpm runs in other repos.
+  kill_by_pattern "pnpm .*dev"
+
+  # 2. tauri dev (node bin). Tauri CLI supervises its own child processes.
+  kill_by_pattern "tauri(-cli)? +dev"
+  kill_by_pattern "@tauri-apps/cli"
+
+  # 2b. Electron variant supervisor (scripts/electron-dev.mjs). Idempotent if
+  #     the current variant is tauri; harmless if nothing matches.
+  kill_by_pattern "apps/desktop/scripts/electron-dev\.mjs"
+
+  # 3. Tauri dev webview — match full path so the installed /Applications/
+  #    prod bundle is never targeted.
+  kill_by_pattern "target/debug/OpenWork-Dev"
+
+  # 3b. Electron main (the helpers die with the main via mach-port rendezvous
+  #     loss; we still pattern-match them below in case a crash left orphans).
+  #     Scoped to this repo's node_modules/electron so /Applications/Slack,
+  #     Cursor, VSCode, etc. are never touched.
+  kill_by_pattern "node_modules/electron/dist/Electron\.app/Contents/MacOS/Electron"
+
+  # 4. Vite. Match the node process that loads the vite binary from this
+  #    repo's node_modules, not any arbitrary node process on the host.
+  kill_by_pattern "node_modules/\.bin/vite"
+  kill_by_pattern "node_modules/vite/bin/vite\.js"
+
+  # 5. openwork-server / orchestrator / opencode / opencode-router for the
+  #    current dev build. These are the longest-lived children and the ones
+  #    most likely to orphan after an unclean shutdown.
+  #    Tauri dev runs them from target/debug/, Electron dev runs them from
+  #    src-tauri/sidecars/ — kill both trees, both are idempotent.
+  kill_by_pattern "target/debug/openwork-server"
+  kill_by_pattern "target/debug/openwork-orchestrator"
+  kill_by_pattern "target/debug/opencode"
+  kill_by_pattern "target/debug/opencode-router"
+  kill_by_pattern "apps/desktop/src-tauri/sidecars/openwork-server"
+  kill_by_pattern "apps/desktop/src-tauri/sidecars/openwork-orchestrator"
+  kill_by_pattern "apps/desktop/src-tauri/sidecars/opencode( |/)"
+  kill_by_pattern "apps/desktop/src-tauri/sidecars/opencode-router"
+
+  # Safety net for stragglers we don't own directly.
+  kill_orphans
+
+  sleep 1
+  log "stop complete"
+  echo
+  snapshot | sed -n '1,20p'
+}
+
+start() {
+  mkdir -p "$(dirname -- "$DEV_LOG_FILE")" "$(dirname -- "$PNPM_DEV_LOG")" "$(dirname -- "$PNPM_DEV_PID_FILE")"
+
+  if [[ -f "$PNPM_DEV_PID_FILE" ]]; then
+    local prev
+    prev=$(tr -d '\n' <"$PNPM_DEV_PID_FILE" || true)
+    if [[ -n "$prev" ]] && kill -0 "$prev" 2>/dev/null; then
+      log "pnpm dev already running (pid=$prev); run 'stop' or 'reset' first"
+      return 0
+    fi
+  fi
+
+  cd "$REPO_ROOT"
+  local pid
+  case "$DEV_VARIANT" in
+    electron)
+      log "starting pnpm dev:electron (variant=electron, log sink: $DEV_LOG_FILE, CDP: 127.0.0.1:9823)"
+      env OPENWORK_DEV_LOG_FILE="$DEV_LOG_FILE" \
+        nohup pnpm --filter @openwork/desktop dev:electron >"$PNPM_DEV_LOG" 2>&1 &
+      pid=$!
+      ;;
+    tauri)
+      log "starting pnpm dev (variant=tauri, log sink: $DEV_LOG_FILE)"
+      env OPENWORK_DEV_LOG_FILE="$DEV_LOG_FILE" \
+        nohup pnpm dev >"$PNPM_DEV_LOG" 2>&1 &
+      pid=$!
+      ;;
+  esac
+  disown "$pid" 2>/dev/null || true
+  echo "$pid" >"$PNPM_DEV_PID_FILE"
+  log "pnpm dev pid=$pid"
+}
+
+wait_healthy() {
+  local deadline=$((SECONDS + WAIT_HEALTHY_SECS))
+  while (( SECONDS < deadline )); do
+    local port
+    port=$(discover_openwork_server_port)
+    if [[ -n "$port" ]]; then
+      local code
+      code=$(curl -sS --max-time 2 -o /dev/null -w "%{http_code}" "http://127.0.0.1:$port/health" 2>/dev/null || true)
+      if [[ "$code" == "200" ]]; then
+        log "openwork-server healthy on :$port"
+        return 0
+      fi
+    fi
+    sleep 1
+  done
+  log "openwork-server did not become healthy within ${WAIT_HEALTHY_SECS}s" >&2
+  return 1
+}
+
+reset() {
+  stop
+
+  log "wiping Vite caches"
+  # Vite pre-bundled deps. Almost always the culprit when a pull doesn't take.
+  rm -rf "$REPO_ROOT/apps/app/node_modules/.vite" 2>/dev/null || true
+  # Root-level vite metadata cache if the workspace uses one.
+  rm -rf "$REPO_ROOT/node_modules/.vite" 2>/dev/null || true
+  # Also clear any transformed-module cache the Tauri dev window might keep.
+  rm -rf "$REPO_ROOT/apps/desktop/node_modules/.vite" 2>/dev/null || true
+
+  log "truncating dev log sink"
+  mkdir -p "$(dirname -- "$DEV_LOG_FILE")"
+  : >"$DEV_LOG_FILE"
+
+  start
+  wait_healthy || true
+  echo
+  snapshot | sed -n '1,20p'
+  echo
+  case "$DEV_VARIANT" in
+    electron)
+      log "reset complete (variant=electron) — Electron CDP should be up at"
+      log "http://127.0.0.1:9823; chrome-devtools MCP can attach there."
+      log "If the window looks stale, Cmd+Shift+R to drop its Vite module cache."
+      ;;
+    tauri)
+      log "reset complete — now reload the Tauri webview (Cmd+Shift+R) to drop"
+      log "its in-memory module cache and pick up the fresh Vite."
+      ;;
+  esac
+}
+
+reset_webview_state() {
+  # Destructive: clears the desktop dev app's WebKit LocalStorage so stale
+  # URL overrides / tokens don't leak across code changes. Does NOT touch
+  # the openwork-workspaces.json registry or server-side tokens.
+  local webkit_dir="$HOME/Library/WebKit/com.differentai.openwork.dev"
+  if [[ ! -d "$webkit_dir" ]]; then
+    log "no dev WebKit dir found at $webkit_dir"
+    return 0
+  fi
+  log "clearing dev WebKit WebsiteData under $webkit_dir (you may need to restart the app)"
+  rm -rf "$webkit_dir/WebsiteData" 2>/dev/null || true
+}
+
+# ---------------------------------------------------------------------------
+# Dispatcher
+
+cmd="${1:-snapshot}"
+
+case "$cmd" in
+  snapshot|status|"")
+    snapshot
+    ;;
+  tail)
+    tail_logs
+    ;;
+  sink)
+    echo "$DEV_LOG_FILE"
+    ;;
+  kill-orphans)
+    kill_orphans
+    ;;
+  diagnose-hang)
+    diagnose_hang
+    ;;
+  stop)
+    stop
+    ;;
+  start)
+    start
+    ;;
+  wait-healthy)
+    wait_healthy
+    ;;
+  reset|restart)
+    reset
+    ;;
+  reset-webview)
+    reset_webview_state
+    ;;
+  help|-h|--help)
+    grep -E '^#( |$)' "$0" | sed -E 's/^# ?//'
+    ;;
+  *)
+    echo "unknown command: $cmd" >&2
+    echo "try: $0 help" >&2
+    exit 1
+    ;;
+esac
diff --git a/scripts/release/generate-latest-json.mjs b/scripts/release/generate-latest-json.mjs
new file mode 100644
index 0000000000..73d60803a3
--- /dev/null
+++ b/scripts/release/generate-latest-json.mjs
@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+
+const ARCH_ALIASES = new Map([
+  ["x64", "x86_64"],
+  ["amd64", "x86_64"],
+  ["arm64", "aarch64"],
+]);
+
+function normalizeArch(arch) {
+  const key = String(arch || "").trim().toLowerCase();
+  return ARCH_ALIASES.get(key) || key;
+}
+
+function parseArgs(argv) {
+  const options = {
+    tag: process.env.RELEASE_TAG || "",
+    repo: process.env.GITHUB_REPOSITORY || "different-ai/openwork",
+    output: "latest.json",
+    version: process.env.RELEASE_VERSION || "",
+  };
+
+  for (let i = 2; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--tag") {
+      options.tag = argv[i + 1] || "";
+      i += 1;
+      continue;
+    }
+    if (arg === "--repo") {
+      options.repo = argv[i + 1] || options.repo;
+      i += 1;
+      continue;
+    }
+    if (arg === "--output") {
+      options.output = argv[i + 1] || options.output;
+      i += 1;
+      continue;
+    }
+    if (arg === "--version") {
+      options.version = argv[i + 1] || options.version;
+      i += 1;
+      continue;
+    }
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+
+  if (!options.tag) {
+    throw new Error("Missing release tag. Pass --tag vX.Y.Z or set RELEASE_TAG.");
+  }
+
+  return options;
+}
+
+function updaterPlatformKeys(assetName) {
+  if (!assetName.startsWith("openwork-desktop-")) return [];
+
+  const stem = assetName.slice("openwork-desktop-".length);
+
+  if (stem.endsWith(".app.tar.gz")) {
+    const match = stem.match(/^([^-]+)-([^.]+)\.app\.tar\.gz$/);
+    if (!match) return [];
+    const platform = match[1];
+    const arch = normalizeArch(match[2]);
+    const base = `${platform}-${arch}`;
+    if (platform === "darwin") {
+      return [base, `${base}-app`];
+    }
+    return [base];
+  }
+
+  if (stem.endsWith(".msi")) {
+    const match = stem.match(/^([^-]+)-([^.]+)\.msi$/);
+    if (!match) return [];
+    const platform = match[1];
+    const arch = normalizeArch(match[2]);
+    const base = `${platform}-${arch}`;
+    return [base, `${base}-msi`];
+  }
+
+  if (stem.endsWith(".deb")) {
+    const match = stem.match(/^([^-]+)-([^.]+)\.deb$/);
+    if (!match) return [];
+    const platform = match[1];
+    const arch = normalizeArch(match[2]);
+    const base = `${platform}-${arch}`;
+    return [base, `${base}-deb`];
+  }
+
+  if (stem.endsWith(".rpm")) {
+    const match = stem.match(/^([^-]+)-([^.]+)\.rpm$/);
+    if (!match) return [];
+    const platform = match[1];
+    const arch = normalizeArch(match[2]);
+    return [`${platform}-${arch}-rpm`];
+  }
+
+  if (stem.endsWith(".AppImage")) {
+    const match = stem.match(/^([^-]+)-([^.]+)\.AppImage$/);
+    if (!match) return [];
+    const platform = match[1];
+    const arch = normalizeArch(match[2]);
+    return [`${platform}-${arch}`];
+  }
+
+  return [];
+}
+
+function authHeaders() {
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "openwork-release-latest-json",
+  };
+  const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+
+async function fetchJson(url) {
+  const response = await fetch(url, { headers: authHeaders() });
+  if (!response.ok) {
+    throw new Error(`GitHub API request failed (${response.status}): ${url}`);
+  }
+  return response.json();
+}
+
+async function fetchReleaseByTag(repo, tag) {
+  const encodedTag = encodeURIComponent(tag);
+  const releaseByTagUrl = `https://api.github.com/repos/${repo}/releases/tags/${encodedTag}`;
+
+  const byTagResponse = await fetch(releaseByTagUrl, { headers: authHeaders() });
+  if (byTagResponse.ok) {
+    return byTagResponse.json();
+  }
+
+  if (byTagResponse.status !== 404) {
+    throw new Error(`GitHub API request failed (${byTagResponse.status}): ${releaseByTagUrl}`);
+  }
+
+  // Draft releases are not returned by /releases/tags/{tag}; fall back to paginated releases list.
+  for (let page = 1; page <= 10; page += 1) {
+    const listUrl = `https://api.github.com/repos/${repo}/releases?per_page=100&page=${page}`;
+    const releases = await fetchJson(listUrl);
+    if (!Array.isArray(releases) || releases.length === 0) break;
+
+    const match = releases.find((release) => {
+      const candidate = String(release?.tag_name || "");
+      return candidate === tag;
+    });
+    if (match) return match;
+  }
+
+  throw new Error(`Release ${repo}@${tag} not found (including drafts).`);
+}
+
+function releaseAssetUrl(repo, tag, assetName) {
+  return `https://github.com/${repo}/releases/download/${encodeURIComponent(tag)}/${assetName}`;
+}
+
+async function fetchText(url, accept = "text/plain") {
+  const headers = authHeaders();
+  headers.Accept = accept;
+  const response = await fetch(url, { headers });
+  if (!response.ok) {
+    throw new Error(`Failed to download signature (${response.status}): ${url}`);
+  }
+  return response.text();
+}
+
+function sortObjectEntries(input) {
+  const sorted = {};
+  for (const key of Object.keys(input).sort()) {
+    sorted[key] = input[key];
+  }
+  return sorted;
+}
+
+async function main() {
+  const { tag, repo, output, version } = parseArgs(process.argv);
+  const release = await fetchReleaseByTag(repo, tag);
+
+  const assets = Array.isArray(release.assets) ? release.assets : [];
+  const assetsByName = new Map();
+  for (const asset of assets) {
+    if (asset && typeof asset.name === "string") {
+      assetsByName.set(asset.name, asset);
+    }
+  }
+
+  const platforms = {};
+
+  for (const asset of assets) {
+    if (!asset || typeof asset.name !== "string" || !asset.name.endsWith(".sig")) continue;
+
+    const targetName = asset.name.slice(0, -4);
+    const targetAsset = assetsByName.get(targetName);
+    if (!targetAsset) continue;
+
+    const keys = updaterPlatformKeys(targetName);
+    if (!keys.length) continue;
+
+    if (typeof asset.url !== "string") continue;
+
+    const signature = (await fetchText(asset.url, "application/octet-stream")).trim();
+    if (!signature) continue;
+
+    const url = releaseAssetUrl(repo, tag, targetName);
+
+    for (const key of keys) {
+      platforms[key] = {
+        signature,
+        url,
+      };
+    }
+  }
+
+  if (!Object.keys(platforms).length) {
+    throw new Error(`No updater platforms were resolved for ${repo}@${tag}.`);
+  }
+
+  const latest = {
+    version: version || String(release.tag_name || tag).replace(/^v/, ""),
+    notes:
+      typeof release.body === "string" && release.body.trim()
+        ? release.body
+        : "See the assets to download this version and install.",
+    pub_date: release.published_at || new Date().toISOString(),
+    platforms: sortObjectEntries(platforms),
+  };
+
+  const fs = await import("node:fs/promises");
+  await fs.writeFile(output, `${JSON.stringify(latest, null, 2)}\n`, "utf8");
+
+  console.log(`Wrote ${output} with ${Object.keys(latest.platforms).length} updater platforms.`);
+}
+
+main().catch((error) => {
+  const message = error instanceof Error ? error.stack || error.message : String(error);
+  console.error(message);
+  process.exit(1);
+});
diff --git a/scripts/release/prepare.mjs b/scripts/release/prepare.mjs
new file mode 100644
index 0000000000..964378ab8a
--- /dev/null
+++ b/scripts/release/prepare.mjs
@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * release:prepare [patch|minor|major]
+ *
+ * Bumps versions, runs lockfile check, runs release:review,
+ * commits, and tags — but does NOT push.
+ *
+ * Flags:
+ *   --dry-run   Print what would happen without mutating anything.
+ *   --ci        Skip interactive-safety checks (branch, clean-tree).
+ */
+import { execSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const args = process.argv.slice(2);
+
+const dryRun = args.includes("--dry-run");
+const ci = args.includes("--ci");
+const bumpType = args.find((a) => ["patch", "minor", "major"].includes(a)) ?? "patch";
+
+const log = (msg) => console.log(`  ${msg}`);
+const heading = (msg) => console.log(`\n▸ ${msg}`);
+const success = (msg) => console.log(`  ✓ ${msg}`);
+const fail = (msg) => {
+  console.error(`  ✗ ${msg}`);
+  process.exit(1);
+};
+
+const run = (cmd, opts = {}) => {
+  if (dryRun && !opts.readOnly) {
+    log(`[dry-run] ${cmd}`);
+    return "";
+  }
+  try {
+    return execSync(cmd, { cwd: root, encoding: "utf8", stdio: opts.stdio ?? "pipe" }).trim();
+  } catch (err) {
+    if (opts.allowFail) return "";
+    fail(`Command failed: ${cmd}\n${err.stderr || err.message}`);
+  }
+};
+
+// ── Step 1: Verify state ────────────────────────────────────────────
+heading("Checking git state");
+
+if (!ci) {
+  const branch = run("git rev-parse --abbrev-ref HEAD", { readOnly: true });
+  if (branch !== "dev") fail(`Must be on 'dev' branch (currently on '${branch}')`);
+  success(`On branch ${branch}`);
+}
+
+const dirty = run("git status --porcelain", { readOnly: true });
+if (dirty && !ci) fail(`Working tree is dirty:\n${dirty}`);
+success("Working tree clean");
+
+heading("Syncing with origin/dev");
+run("git fetch origin dev", { readOnly: true });
+const behind = run("git rev-list HEAD..origin/dev --count", { readOnly: true });
+if (behind !== "0" && !dryRun) {
+  log(`Behind origin/dev by ${behind} commits — pulling…`);
+  run("git pull --rebase origin dev");
+}
+success("Up to date with origin/dev");
+
+// ── Step 2: Bump versions ───────────────────────────────────────────
+heading(`Bumping versions (${bumpType})`);
+const bumpOutput = run(`pnpm bump:${bumpType}`, { stdio: "pipe" });
+if (!dryRun) {
+  log(bumpOutput);
+}
+
+// Read the new version
+const appPkg = JSON.parse(readFileSync(resolve(root, "apps/app/package.json"), "utf8"));
+const version = appPkg.version;
+success(`Version is now ${version}`);
+
+// ── Step 3: Lockfile ────────────────────────────────────────────────
+heading("Checking lockfile");
+run("pnpm install --lockfile-only");
+const lockfileChanged = run("git diff --name-only -- pnpm-lock.yaml", { readOnly: true });
+if (lockfileChanged) {
+  success("Lockfile updated");
+} else {
+  success("Lockfile unchanged");
+}
+
+// ── Step 4: Release review ──────────────────────────────────────────
+heading("Running release review");
+const reviewOutput = run("node scripts/release/review.mjs --strict", { readOnly: true, allowFail: false });
+log(reviewOutput);
+success("Release review passed");
+
+// ── Step 5: Commit ──────────────────────────────────────────────────
+heading("Committing version bump");
+run("git add -A");
+run(`git commit -m "chore: bump version to ${version}"`);
+success(`Committed: chore: bump version to ${version}`);
+
+// ── Step 6: Tag ─────────────────────────────────────────────────────
+heading("Creating tag");
+const tag = `v${version}`;
+run(`git tag ${tag}`);
+success(`Tagged ${tag}`);
+
+// ── Summary ─────────────────────────────────────────────────────────
+console.log("\n" + "─".repeat(50));
+console.log(`  Release prepared: ${tag}`);
+console.log(`  Version:          ${version}`);
+console.log(`  Bump type:        ${bumpType}`);
+if (dryRun) {
+  console.log("  Mode:             DRY RUN (nothing was changed)");
+}
+console.log("");
+console.log("  Next step:");
+console.log(`    pnpm release:ship`);
+console.log("─".repeat(50) + "\n");
diff --git a/scripts/release/review.mjs b/scripts/release/review.mjs
new file mode 100644
index 0000000000..3a579bf1a8
--- /dev/null
+++ b/scripts/release/review.mjs
@@ -0,0 +1,197 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const args = process.argv.slice(2);
+const outputJson = args.includes("--json");
+const strict = args.includes("--strict");
+
+const readJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+const readText = (path) => readFileSync(path, "utf8");
+
+const readCargoVersion = (path) => {
+  const content = readText(path);
+  const match = content.match(/^version\s*=\s*"([^"]+)"/m);
+  return match ? match[1] : null;
+};
+
+const appPkg = readJson(resolve(root, "apps", "app", "package.json"));
+const desktopPkg = readJson(resolve(root, "apps", "desktop", "package.json"));
+const orchestratorPkg = readJson(
+  resolve(root, "apps", "orchestrator", "package.json"),
+);
+const pinnedOpencodeVersion = String(
+  readJson(resolve(root, "constants.json")).opencodeVersion ?? "",
+)
+  .trim()
+  .replace(/^v/, "");
+const serverPkg = readJson(resolve(root, "apps", "server", "package.json"));
+const opencodeRouterPkg = readJson(
+  resolve(root, "apps", "opencode-router", "package.json"),
+);
+const tauriConfig = readJson(
+  resolve(root, "apps", "desktop", "src-tauri", "tauri.conf.json"),
+);
+const cargoVersion = readCargoVersion(
+  resolve(root, "apps", "desktop", "src-tauri", "Cargo.toml"),
+);
+
+const versions = {
+  app: appPkg.version ?? null,
+  desktop: desktopPkg.version ?? null,
+  tauri: tauriConfig.version ?? null,
+  cargo: cargoVersion ?? null,
+  server: serverPkg.version ?? null,
+  orchestrator: orchestratorPkg.version ?? null,
+  opencodeRouter: opencodeRouterPkg.version ?? null,
+  opencode: pinnedOpencodeVersion || null,
+  opencodeRouterVersionPinned: desktopPkg.opencodeRouterVersion ?? null,
+  orchestratorOpenworkServerRange:
+    orchestratorPkg.dependencies?.["openwork-server"] ?? null,
+};
+
+const checks = [];
+const warnings = [];
+let ok = true;
+
+const addCheck = (label, pass, details) => {
+  checks.push({ label, ok: pass, details });
+  if (!pass) ok = false;
+};
+
+const addWarning = (message) => warnings.push(message);
+
+addCheck(
+  "App/desktop versions match",
+  versions.app && versions.desktop && versions.app === versions.desktop,
+  `${versions.app ?? "?"} vs ${versions.desktop ?? "?"}`,
+);
+addCheck(
+  "App/openwork-orchestrator versions match",
+  versions.app &&
+    versions.orchestrator &&
+    versions.app === versions.orchestrator,
+  `${versions.app ?? "?"} vs ${versions.orchestrator ?? "?"}`,
+);
+addCheck(
+  "App/openwork-server versions match",
+  versions.app && versions.server && versions.app === versions.server,
+  `${versions.app ?? "?"} vs ${versions.server ?? "?"}`,
+);
+addCheck(
+  "App/opencode-router versions match",
+  versions.app &&
+    versions.opencodeRouter &&
+    versions.app === versions.opencodeRouter,
+  `${versions.app ?? "?"} vs ${versions.opencodeRouter ?? "?"}`,
+);
+addCheck(
+  "Desktop/Tauri versions match",
+  versions.desktop && versions.tauri && versions.desktop === versions.tauri,
+  `${versions.desktop ?? "?"} vs ${versions.tauri ?? "?"}`,
+);
+addCheck(
+  "Desktop/Cargo versions match",
+  versions.desktop && versions.cargo && versions.desktop === versions.cargo,
+  `${versions.desktop ?? "?"} vs ${versions.cargo ?? "?"}`,
+);
+addCheck(
+  "OpenCodeRouter version pinned in desktop",
+  versions.opencodeRouter &&
+    versions.opencodeRouterVersionPinned &&
+    versions.opencodeRouter === versions.opencodeRouterVersionPinned,
+  `${versions.opencodeRouterVersionPinned ?? "?"} vs ${versions.opencodeRouter ?? "?"}`,
+);
+if (versions.opencode) {
+  addCheck(
+    "OpenCode version pin exists",
+    Boolean(versions.opencode),
+    String(versions.opencode),
+  );
+} else {
+  addWarning(
+    "OpenCode version is not pinned in constants.json.",
+  );
+}
+
+const openworkServerRange = versions.orchestratorOpenworkServerRange ?? "";
+const openworkServerPinned = /^\d+\.\d+\.\d+/.test(openworkServerRange);
+if (!openworkServerRange) {
+  addWarning("openwork-orchestrator is missing an openwork-server dependency.");
+} else if (!openworkServerPinned) {
+  addWarning(
+    `openwork-orchestrator openwork-server dependency is not pinned (${openworkServerRange}).`,
+  );
+} else {
+  addCheck(
+    "Openwork-server dependency matches server version",
+    versions.server && openworkServerRange === versions.server,
+    `${openworkServerRange} vs ${versions.server ?? "?"}`,
+  );
+}
+
+const sidecarManifestPath = resolve(
+  root,
+  "apps",
+  "orchestrator",
+  "dist",
+  "sidecars",
+  "openwork-orchestrator-sidecars.json",
+);
+if (existsSync(sidecarManifestPath)) {
+  const manifest = readJson(sidecarManifestPath);
+  addCheck(
+    "Sidecar manifest version matches openwork-orchestrator",
+    versions.orchestrator && manifest.version === versions.orchestrator,
+    `${manifest.version ?? "?"} vs ${versions.orchestrator ?? "?"}`,
+  );
+  const serverEntry = manifest.entries?.["openwork-server"]?.version;
+  const routerEntry = manifest.entries?.["opencode-router"]?.version;
+  if (serverEntry) {
+    addCheck(
+      "Sidecar manifest openwork-server version matches",
+      versions.server && serverEntry === versions.server,
+      `${serverEntry ?? "?"} vs ${versions.server ?? "?"}`,
+    );
+  }
+  if (routerEntry) {
+    addCheck(
+      "Sidecar manifest opencode-router version matches",
+      versions.opencodeRouter && routerEntry === versions.opencodeRouter,
+      `${routerEntry ?? "?"} vs ${versions.opencodeRouter ?? "?"}`,
+    );
+  }
+} else {
+  addWarning(
+    "Sidecar manifest missing (run pnpm --filter openwork-orchestrator build:sidecars).",
+  );
+}
+
+if (!process.env.SOURCE_DATE_EPOCH) {
+  addWarning(
+    "SOURCE_DATE_EPOCH is not set (sidecar manifests will include current time).",
+  );
+}
+
+const report = { ok, versions, checks, warnings };
+
+if (outputJson) {
+  console.log(JSON.stringify(report, null, 2));
+} else {
+  console.log("Release review");
+  for (const check of checks) {
+    const status = check.ok ? "ok" : "fail";
+    console.log(`- ${status}: ${check.label} (${check.details})`);
+  }
+  if (warnings.length) {
+    console.log("Warnings:");
+    for (const warning of warnings) {
+      console.log(`- ${warning}`);
+    }
+  }
+}
+
+if (strict && !ok) {
+  process.exit(1);
+}
diff --git a/scripts/release/ship.mjs b/scripts/release/ship.mjs
new file mode 100644
index 0000000000..00d1654e2b
--- /dev/null
+++ b/scripts/release/ship.mjs
@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * release:ship
+ *
+ * Pushes the current tag + dev branch to origin, then prints the
+ * GitHub Actions workflow URL. Optionally tails the workflow run.
+ *
+ * Flags:
+ *   --dry-run   Print what would happen without pushing.
+ *   --watch     Tail the GHA workflow run after push.
+ */
+import { execSync } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const args = process.argv.slice(2);
+
+const dryRun = args.includes("--dry-run");
+const watch = args.includes("--watch");
+
+const log = (msg) => console.log(`  ${msg}`);
+const heading = (msg) => console.log(`\n▸ ${msg}`);
+const success = (msg) => console.log(`  ✓ ${msg}`);
+const fail = (msg) => {
+  console.error(`  ✗ ${msg}`);
+  process.exit(1);
+};
+
+const run = (cmd, opts = {}) => {
+  if (dryRun && !opts.readOnly) {
+    log(`[dry-run] ${cmd}`);
+    return "";
+  }
+  try {
+    return execSync(cmd, {
+      cwd: root,
+      encoding: "utf8",
+      stdio: opts.inherit ? "inherit" : "pipe",
+    }).trim();
+  } catch (err) {
+    if (opts.allowFail) return "";
+    fail(`Command failed: ${cmd}\n${err.stderr || err.message}`);
+  }
+};
+
+// ── Step 1: Resolve tag from HEAD ───────────────────────────────────
+heading("Resolving tag");
+
+const tag = run("git describe --tags --exact-match HEAD", {
+  readOnly: true,
+  allowFail: true,
+});
+
+if (!tag) {
+  fail(
+    "HEAD is not tagged. Run 'pnpm release:prepare' first.\n" +
+    "  (Expected a vX.Y.Z tag on HEAD)"
+  );
+}
+
+if (!/^v\d+\.\d+\.\d+/.test(tag)) {
+  fail(`Tag '${tag}' does not look like a release tag (expected vX.Y.Z)`);
+}
+
+success(`Found tag: ${tag}`);
+
+// ── Step 2: Push tag ────────────────────────────────────────────────
+heading("Pushing tag to origin");
+run(`git push origin ${tag}`);
+success(`Pushed ${tag}`);
+
+// ── Step 3: Push dev ────────────────────────────────────────────────
+heading("Pushing dev to origin");
+run("git push origin dev");
+success("Pushed dev");
+
+// ── Step 4: Print workflow URL ──────────────────────────────────────
+heading("GitHub Actions");
+
+const repo = "different-ai/openwork";
+const url = `https://github.com/${repo}/actions/workflows/release-macos-aarch64.yml`;
+log(`Workflow: ${url}`);
+log(`Release:  https://github.com/${repo}/releases/tag/${tag}`);
+
+// ── Step 5: Optionally watch ────────────────────────────────────────
+if (watch && !dryRun) {
+  heading("Watching workflow run");
+  log("Waiting for workflow to appear…");
+
+  // Give GitHub a moment to register the run
+  execSync("sleep 10", { cwd: root });
+
+  try {
+    const runs = run(
+      `gh run list --repo ${repo} --workflow "Release App" --limit 1 --json databaseId,headBranch,event -q ".[0].databaseId"`,
+      { readOnly: true }
+    );
+    if (runs) {
+      log(`Run ID: ${runs}`);
+      run(`gh run watch ${runs} --repo ${repo} --exit-status`, { inherit: true });
+    } else {
+      log("Could not find the workflow run. Check the Actions tab manually.");
+    }
+  } catch {
+    log("Workflow watch exited (check status on GitHub).");
+  }
+}
+
+// ── Summary ─────────────────────────────────────────────────────────
+console.log("\n" + "─".repeat(50));
+console.log(`  Shipped: ${tag}`);
+if (dryRun) {
+  console.log("  Mode:    DRY RUN (nothing was pushed)");
+}
+console.log("─".repeat(50) + "\n");
diff --git a/scripts/release/verify-tag.mjs b/scripts/release/verify-tag.mjs
new file mode 100644
index 0000000000..30f6024821
--- /dev/null
+++ b/scripts/release/verify-tag.mjs
@@ -0,0 +1,63 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const args = process.argv.slice(2);
+const tagIndex = args.indexOf("--tag");
+const tagArg = tagIndex >= 0 ? args[tagIndex + 1] : null;
+const tag = (tagArg || process.env.RELEASE_TAG || "").trim();
+
+if (!tag) {
+  console.error("Release tag missing. Provide --tag or set RELEASE_TAG.");
+  process.exit(1);
+}
+
+const version = tag.startsWith("v") ? tag.slice(1) : tag;
+
+const readJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+const readText = (path) => readFileSync(path, "utf8");
+
+const readCargoVersion = (path) => {
+  const content = readText(path);
+  const match = content.match(/^version\s*=\s*"([^"]+)"/m);
+  return match ? match[1] : null;
+};
+
+const appVersion = readJson(resolve(root, "apps", "app", "package.json")).version ?? null;
+const desktopVersion = readJson(resolve(root, "apps", "desktop", "package.json")).version ?? null;
+const orchestratorVersion =
+  readJson(resolve(root, "apps", "orchestrator", "package.json")).version ?? null;
+const serverVersion = readJson(resolve(root, "apps", "server", "package.json")).version ?? null;
+const opencodeRouterVersion = readJson(resolve(root, "apps", "opencode-router", "package.json")).version ?? null;
+const tauriVersion = readJson(resolve(root, "apps", "desktop", "src-tauri", "tauri.conf.json")).version ?? null;
+const cargoVersion = readCargoVersion(resolve(root, "apps", "desktop", "src-tauri", "Cargo.toml"));
+
+const mismatches = [];
+const check = (label, actual) => {
+  if (!actual) {
+    mismatches.push(`${label} missing`);
+    return;
+  }
+  if (actual !== version) {
+    mismatches.push(`${label}=${actual} (expected ${version})`);
+  }
+};
+
+check("app", appVersion);
+check("desktop", desktopVersion);
+check("openwork-orchestrator", orchestratorVersion);
+check("openwork-server", serverVersion);
+check("opencode-router", opencodeRouterVersion);
+check("tauri", tauriVersion);
+check("cargo", cargoVersion);
+
+if (mismatches.length) {
+  console.error(`Release tag ${tag} does not match package versions:`);
+  for (const mismatch of mismatches) {
+    console.error(`- ${mismatch}`);
+  }
+  process.exit(1);
+}
+
+console.log(`Release tag ${tag} matches app/desktop/openwork-orchestrator versions.`);
diff --git a/scripts/stats.mjs b/scripts/stats.mjs
new file mode 100644
index 0000000000..83a0613580
--- /dev/null
+++ b/scripts/stats.mjs
@@ -0,0 +1,335 @@
+#!/usr/bin/env node
+
+import fs from "node:fs/promises"
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+
+const POSTHOG_KEY = process.env.POSTHOG_KEY || process.env.POSTHOG_API_KEY
+const POSTHOG_HOST = process.env.POSTHOG_HOST || "https://us.i.posthog.com"
+const POSTHOG_LEGACY_EVENT = process.env.POSTHOG_LEGACY_EVENT || process.env.POSTHOG_EVENT || "download"
+const POSTHOG_V2_EVENT = process.env.POSTHOG_V2_EVENT || "release_asset_snapshot"
+const POSTHOG_DISTINCT_ID = process.env.POSTHOG_DISTINCT_ID || "openwork-download"
+const GITHUB_REPO = process.env.GITHUB_REPO || "different-ai/openwork"
+const STATS_FILE = process.env.STATS_FILE || "STATS.md"
+const STATS_V2_FILE = process.env.STATS_V2_FILE || "STATS_V2.md"
+
+const LEGACY_HEADER = [
+  "# Download Stats",
+  "",
+  "Legacy cumulative release-asset totals. For classified v2 buckets, see `STATS_V2.md`.",
+  "",
+  "| Date | GitHub Downloads | Total |",
+  "|------|------------------|-------|",
+].join("\n")
+
+const V2_HEADER = [
+  "# Download Stats V2",
+  "",
+  "Classified GitHub release asset snapshots. `Manual installs` counts installer downloads (`.dmg`, `.msi`, `.deb`, `.rpm`). `Updater` counts updater artifacts (`latest.json`, macOS updater bundles, updater signatures). `Other` captures signatures, sidecars, and uncategorized assets.",
+  "",
+  "| Date | Manual Installs | Updater | Other | All Release Assets |",
+  "|------|-----------------|---------|-------|--------------------|",
+].join("\n")
+
+const MANUAL_INSTALL_SUFFIXES = [".dmg", ".msi", ".deb", ".rpm", ".pkg", ".appimage", ".exe"]
+const UPDATER_SUFFIXES = ["latest.json", ".blockmap", ".app.tar.gz", ".app.tar.gz.sig"]
+const V2_BUCKETS = ["manual_install", "updater", "other", "all"]
+
+async function sendToPostHog(event, properties, distinctId = POSTHOG_DISTINCT_ID) {
+  if (!POSTHOG_KEY) {
+    console.warn("POSTHOG_KEY not set, skipping PostHog event")
+    return
+  }
+
+  const response = await fetch(`${POSTHOG_HOST}/i/v0/e/`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      distinct_id: distinctId,
+      api_key: POSTHOG_KEY,
+      event,
+      properties,
+    }),
+  }).catch(() => null)
+
+  if (response && !response.ok) {
+    console.warn(`PostHog API error: ${response.status}`)
+  }
+}
+
+function isDesktopRelease(release) {
+  return typeof release?.tag_name === "string" && /^v\d/.test(release.tag_name)
+}
+
+export function classifyAsset(release, asset) {
+  const name = String(asset?.name || "").toLowerCase()
+
+  if (!name) return "other"
+
+  if (isDesktopRelease(release)) {
+    if (UPDATER_SUFFIXES.some((suffix) => name === suffix || name.endsWith(suffix))) {
+      return "updater"
+    }
+
+    if (MANUAL_INSTALL_SUFFIXES.some((suffix) => name.endsWith(suffix))) {
+      return "manual_install"
+    }
+  }
+
+  return "other"
+}
+
+async function fetchReleases() {
+  const releases = []
+  let page = 1
+  const perPage = 100
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "openwork-download-stats",
+  }
+  const token = process.env.GITHUB_TOKEN
+
+  if (token) {
+    headers.Authorization = `Bearer ${token}`
+  }
+
+  while (true) {
+    const url = `https://api.github.com/repos/${GITHUB_REPO}/releases?page=${page}&per_page=${perPage}`
+    const response = await fetch(url, { headers })
+
+    if (!response.ok) {
+      throw new Error(`GitHub API error: ${response.status} ${response.statusText}`)
+    }
+
+    const batch = await response.json()
+    if (!Array.isArray(batch) || batch.length === 0) break
+
+    releases.push(...batch)
+    console.log(`Fetched page ${page} with ${batch.length} releases`)
+
+    if (batch.length < perPage) break
+    page += 1
+    await new Promise((resolve) => setTimeout(resolve, 1000))
+  }
+
+  return releases
+}
+
+export function calculate(releases) {
+  let legacyTotal = 0
+  const buckets = {
+    manual_install: 0,
+    updater: 0,
+    other: 0,
+  }
+  const stats = []
+
+  for (const release of releases) {
+    let downloads = 0
+    const assets = []
+
+    for (const asset of release.assets ?? []) {
+      const count = Number(asset.download_count) || 0
+      const bucket = classifyAsset(release, asset)
+
+      downloads += count
+      legacyTotal += count
+      buckets[bucket] += count
+      assets.push({
+        name: asset.name,
+        downloads: count,
+        bucket,
+      })
+    }
+
+    stats.push({
+      tag: release.tag_name,
+      name: release.name,
+      downloads,
+      assets,
+    })
+  }
+
+  return {
+    total: legacyTotal,
+    legacyTotal,
+    buckets: {
+      ...buckets,
+      all: legacyTotal,
+    },
+    stats,
+  }
+}
+
+export function parseCountCell(cell) {
+  const match = String(cell || "").match(/-?[\d,]+/)
+  if (!match) return 0
+  return parseInt(match[0].replace(/,/g, ""), 10)
+}
+
+export function parseLastDataRow(content, expectedColumns) {
+  const lines = String(content || "")
+    .trim()
+    .split("\n")
+
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = lines[i].trim()
+    if (!line.startsWith("|")) continue
+
+    const cells = line
+      .split("|")
+      .map((cell) => cell.trim())
+      .filter(Boolean)
+
+    if (cells.length !== expectedColumns) continue
+    if (cells[0] === "Date") continue
+    if (cells.every((cell) => /^-+$/.test(cell))) continue
+
+    return cells
+  }
+
+  return null
+}
+
+function formatChange(change) {
+  if (change > 0) return ` (+${change.toLocaleString()})`
+  if (change < 0) return ` (${change.toLocaleString()})`
+  return " (+0)"
+}
+
+function withTrailingNewline(content) {
+  return content.endsWith("\n") ? content : `${content}\n`
+}
+
+async function loadOrInitialize(filePath, header) {
+  try {
+    return await fs.readFile(filePath, "utf8")
+  } catch {
+    return `${header}\n`
+  }
+}
+
+async function saveLegacyStats(githubTotal) {
+  const date = new Date().toISOString().split("T")[0]
+  let content = await loadOrInitialize(STATS_FILE, LEGACY_HEADER)
+
+  if (!content.includes("| Date | GitHub Downloads | Total |")) {
+    content = `${LEGACY_HEADER}\n`
+  }
+
+  const previous = parseLastDataRow(content, 3)
+  const previousGithub = previous ? parseCountCell(previous[1]) : 0
+  const previousTotal = previous ? parseCountCell(previous[2]) : 0
+
+  const githubChange = githubTotal - previousGithub
+  const totalChange = githubTotal - previousTotal
+  const line = `| ${date} | ${githubTotal.toLocaleString()}${formatChange(githubChange)} | ${githubTotal.toLocaleString()}${formatChange(totalChange)} |\n`
+
+  await fs.writeFile(STATS_FILE, `${withTrailingNewline(content)}${line}`, "utf8")
+
+  console.log(
+    `\nAppended legacy stats to ${STATS_FILE}: GitHub ${githubTotal.toLocaleString()}${formatChange(githubChange)}, Total ${githubTotal.toLocaleString()}${formatChange(totalChange)}`,
+  )
+
+  return {
+    date,
+    totals: {
+      github: githubTotal,
+      total: githubTotal,
+    },
+    deltas: {
+      github: githubChange,
+      total: totalChange,
+    },
+  }
+}
+
+async function saveV2Stats(totals) {
+  const date = new Date().toISOString().split("T")[0]
+  let content = await loadOrInitialize(STATS_V2_FILE, V2_HEADER)
+
+  if (!content.includes("| Date | Manual Installs | Updater | Other | All Release Assets |")) {
+    content = `${V2_HEADER}\n`
+  }
+
+  const previous = parseLastDataRow(content, 5)
+  const previousTotals = {
+    manual_install: previous ? parseCountCell(previous[1]) : 0,
+    updater: previous ? parseCountCell(previous[2]) : 0,
+    other: previous ? parseCountCell(previous[3]) : 0,
+    all: previous ? parseCountCell(previous[4]) : 0,
+  }
+
+  const deltas = {
+    manual_install: totals.manual_install - previousTotals.manual_install,
+    updater: totals.updater - previousTotals.updater,
+    other: totals.other - previousTotals.other,
+    all: totals.all - previousTotals.all,
+  }
+
+  const line = `| ${date} | ${totals.manual_install.toLocaleString()}${formatChange(deltas.manual_install)} | ${totals.updater.toLocaleString()}${formatChange(deltas.updater)} | ${totals.other.toLocaleString()}${formatChange(deltas.other)} | ${totals.all.toLocaleString()}${formatChange(deltas.all)} |`
+
+  await fs.writeFile(STATS_V2_FILE, `${withTrailingNewline(content)}${line}\n`, "utf8")
+
+  console.log(
+    `Appended classified stats to ${STATS_V2_FILE}: manual ${totals.manual_install.toLocaleString()}${formatChange(deltas.manual_install)}, updater ${totals.updater.toLocaleString()}${formatChange(deltas.updater)}, other ${totals.other.toLocaleString()}${formatChange(deltas.other)}, all ${totals.all.toLocaleString()}${formatChange(deltas.all)}`,
+  )
+
+  return {
+    date,
+    totals,
+    deltas,
+  }
+}
+
+async function sendClassifiedSnapshot(snapshot) {
+  for (const bucket of V2_BUCKETS) {
+    await sendToPostHog(
+      POSTHOG_V2_EVENT,
+      {
+        metric_version: 2,
+        bucket,
+        total: snapshot.totals[bucket],
+        delta: snapshot.deltas[bucket],
+        source: "github",
+        repo: GITHUB_REPO,
+        date: snapshot.date,
+      },
+      `${POSTHOG_DISTINCT_ID}-${bucket}`,
+    )
+  }
+}
+
+export async function main() {
+  console.log(`Fetching GitHub releases for ${GITHUB_REPO}...\n`)
+
+  const releases = await fetchReleases()
+  console.log(`\nFetched ${releases.length} releases total\n`)
+
+  const { total: githubTotal, buckets } = calculate(releases)
+  const legacySnapshot = await saveLegacyStats(githubTotal)
+  const v2Snapshot = await saveV2Stats(buckets)
+
+  await sendToPostHog(POSTHOG_LEGACY_EVENT, {
+    count: githubTotal,
+    source: "github",
+    repo: GITHUB_REPO,
+    date: legacySnapshot.date,
+  })
+
+  await sendClassifiedSnapshot(v2Snapshot)
+
+  console.log("=".repeat(60))
+  console.log(`TOTAL DOWNLOADS: ${githubTotal.toLocaleString()}`)
+  console.log(`  Legacy all assets: ${githubTotal.toLocaleString()}`)
+  console.log(`  Manual installs: ${buckets.manual_install.toLocaleString()}`)
+  console.log(`  Updater: ${buckets.updater.toLocaleString()}`)
+  console.log(`  Other: ${buckets.other.toLocaleString()}`)
+  console.log("=".repeat(60))
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  await main()
+}
diff --git a/scripts/stats.test.mjs b/scripts/stats.test.mjs
new file mode 100644
index 0000000000..15fbd0b37b
--- /dev/null
+++ b/scripts/stats.test.mjs
@@ -0,0 +1,67 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+
+import { calculate, classifyAsset, parseCountCell, parseLastDataRow } from "./stats.mjs"
+
+test("classifyAsset buckets manual installer assets", () => {
+  const release = { tag_name: "v0.11.135" }
+
+  assert.equal(classifyAsset(release, { name: "openwork-desktop-darwin-aarch64.dmg" }), "manual_install")
+  assert.equal(classifyAsset(release, { name: "openwork-desktop-windows-x64.msi" }), "manual_install")
+  assert.equal(classifyAsset(release, { name: "openwork-desktop-linux-amd64.deb" }), "manual_install")
+})
+
+test("classifyAsset buckets updater and non-desktop assets separately", () => {
+  const desktopRelease = { tag_name: "v0.11.135" }
+  const sidecarRelease = { tag_name: "openwork-orchestrator-v0.11.135" }
+
+  assert.equal(classifyAsset(desktopRelease, { name: "latest.json" }), "updater")
+  assert.equal(classifyAsset(desktopRelease, { name: "openwork-desktop-darwin-aarch64.app.tar.gz" }), "updater")
+  assert.equal(classifyAsset(desktopRelease, { name: "openwork-desktop-darwin-aarch64.app.tar.gz.sig" }), "updater")
+  assert.equal(classifyAsset(desktopRelease, { name: "openwork-desktop-linux-aarch64.rpm.sig" }), "other")
+  assert.equal(classifyAsset(sidecarRelease, { name: "openwork-server-darwin-arm64" }), "other")
+})
+
+test("calculate aggregates legacy total and v2 buckets", () => {
+  const releases = [
+    {
+      tag_name: "v0.11.135",
+      assets: [
+        { name: "openwork-desktop-darwin-aarch64.dmg", download_count: 10 },
+        { name: "openwork-desktop-darwin-aarch64.app.tar.gz", download_count: 4 },
+        { name: "latest.json", download_count: 6 },
+        { name: "openwork-desktop-linux-aarch64.rpm.sig", download_count: 3 },
+      ],
+    },
+    {
+      tag_name: "openwork-orchestrator-v0.11.135",
+      assets: [{ name: "openwork-server-darwin-arm64", download_count: 8 }],
+    },
+  ]
+
+  const result = calculate(releases)
+
+  assert.equal(result.total, 31)
+  assert.deepEqual(result.buckets, {
+    manual_install: 10,
+    updater: 10,
+    other: 11,
+    all: 31,
+  })
+})
+
+test("table helpers parse formatted rows with deltas", () => {
+  const content = [
+    "# Download Stats V2",
+    "",
+    "| Date | Manual Installs | Updater | Other | All Release Assets |",
+    "|------|-----------------|---------|-------|--------------------|",
+    "| 2026-03-07 | 1,234 (+12) | 567 (+5) | 89 (+1) | 1,890 (+18) |",
+  ].join("\n")
+
+  const row = parseLastDataRow(content, 5)
+
+  assert.deepEqual(row, ["2026-03-07", "1,234 (+12)", "567 (+5)", "89 (+1)", "1,890 (+18)"])
+  assert.equal(parseCountCell(row[1]), 1234)
+  assert.equal(parseCountCell(row[4]), 1890)
+})
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
deleted file mode 100644
index cf798bc3f2..0000000000
--- a/src-tauri/Cargo.toml
+++ /dev/null
@@ -1,22 +0,0 @@
-[package]
-name = "openwork"
-version = "0.1.1"
-description = "OpenWork"
-authors = ["Different AI"]
-edition = "2021"
-
-[build-dependencies]
-tauri-build = { version = "2", features = [] }
-
-[dependencies]
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-tauri = { version = "2", features = [] }
-tauri-plugin-dialog = "2"
-
-[profile.release]
-panic = "abort"
-codegen-units = 1
-lto = true
-opt-level = "s"
-strip = true
diff --git a/src-tauri/build.rs b/src-tauri/build.rs
deleted file mode 100644
index 311900de5c..0000000000
--- a/src-tauri/build.rs
+++ /dev/null
@@ -1,3 +0,0 @@
-fn main() {
-  tauri_build::build();
-}
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
deleted file mode 100644
index fe9c74dcc8..0000000000
--- a/src-tauri/capabilities/default.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "identifier": "openwork-default",
-  "description": "Default OpenWork capability (UI permissions)",
-  "windows": ["*"],
-  "permissions": [
-    "core:default",
-    "dialog:allow-open"
-  ]
-}
diff --git a/src-tauri/gen/schemas/capabilities.json b/src-tauri/gen/schemas/capabilities.json
deleted file mode 100644
index 7a70d8bf09..0000000000
--- a/src-tauri/gen/schemas/capabilities.json
+++ /dev/null
@@ -1 +0,0 @@
-{"openwork-default":{"identifier":"openwork-default","description":"Default OpenWork capability (UI permissions)","local":true,"windows":["*"],"permissions":["core:default","dialog:allow-open"]}}
\ No newline at end of file
diff --git a/src-tauri/icons/128x128.png b/src-tauri/icons/128x128.png
deleted file mode 100644
index 5a2797a2fa..0000000000
Binary files a/src-tauri/icons/128x128.png and /dev/null differ
diff --git a/src-tauri/icons/128x128@2x.png b/src-tauri/icons/128x128@2x.png
deleted file mode 100644
index 382b99cf78..0000000000
Binary files a/src-tauri/icons/128x128@2x.png and /dev/null differ
diff --git a/src-tauri/icons/32x32.png b/src-tauri/icons/32x32.png
deleted file mode 100644
index b81151e5bf..0000000000
Binary files a/src-tauri/icons/32x32.png and /dev/null differ
diff --git a/src-tauri/icons/64x64.png b/src-tauri/icons/64x64.png
deleted file mode 100644
index ca3144bbe6..0000000000
Binary files a/src-tauri/icons/64x64.png and /dev/null differ
diff --git a/src-tauri/icons/Square107x107Logo.png b/src-tauri/icons/Square107x107Logo.png
deleted file mode 100644
index 15dc480c76..0000000000
Binary files a/src-tauri/icons/Square107x107Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square142x142Logo.png b/src-tauri/icons/Square142x142Logo.png
deleted file mode 100644
index 3a383c174a..0000000000
Binary files a/src-tauri/icons/Square142x142Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square150x150Logo.png b/src-tauri/icons/Square150x150Logo.png
deleted file mode 100644
index ba56fe5133..0000000000
Binary files a/src-tauri/icons/Square150x150Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square284x284Logo.png b/src-tauri/icons/Square284x284Logo.png
deleted file mode 100644
index f88bee9f04..0000000000
Binary files a/src-tauri/icons/Square284x284Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square30x30Logo.png b/src-tauri/icons/Square30x30Logo.png
deleted file mode 100644
index 0509010eea..0000000000
Binary files a/src-tauri/icons/Square30x30Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square310x310Logo.png b/src-tauri/icons/Square310x310Logo.png
deleted file mode 100644
index 2dff093e42..0000000000
Binary files a/src-tauri/icons/Square310x310Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square44x44Logo.png b/src-tauri/icons/Square44x44Logo.png
deleted file mode 100644
index 58123b3188..0000000000
Binary files a/src-tauri/icons/Square44x44Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square71x71Logo.png b/src-tauri/icons/Square71x71Logo.png
deleted file mode 100644
index 9cf3626c82..0000000000
Binary files a/src-tauri/icons/Square71x71Logo.png and /dev/null differ
diff --git a/src-tauri/icons/Square89x89Logo.png b/src-tauri/icons/Square89x89Logo.png
deleted file mode 100644
index f24e8f598c..0000000000
Binary files a/src-tauri/icons/Square89x89Logo.png and /dev/null differ
diff --git a/src-tauri/icons/StoreLogo.png b/src-tauri/icons/StoreLogo.png
deleted file mode 100644
index f4a1600077..0000000000
Binary files a/src-tauri/icons/StoreLogo.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png b/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png
deleted file mode 100644
index 5f3546d26d..0000000000
Binary files a/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png b/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png
deleted file mode 100644
index 5fc28ec389..0000000000
Binary files a/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png b/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png
deleted file mode 100644
index 78c52f2bb0..0000000000
Binary files a/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png b/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png
deleted file mode 100644
index 1eb80d2d74..0000000000
Binary files a/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png b/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png
deleted file mode 100644
index bccf770e15..0000000000
Binary files a/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png b/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png
deleted file mode 100644
index f29d4b3c8a..0000000000
Binary files a/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png b/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png
deleted file mode 100644
index 6458ebafde..0000000000
Binary files a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png b/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png
deleted file mode 100644
index 1bd63fe994..0000000000
Binary files a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png b/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png
deleted file mode 100644
index f0573c03e7..0000000000
Binary files a/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png b/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png
deleted file mode 100644
index efd71129a2..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png b/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png
deleted file mode 100644
index e924108ccb..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png b/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png
deleted file mode 100644
index b91d84980d..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png b/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png
deleted file mode 100644
index a1bbd7261f..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png b/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png
deleted file mode 100644
index cddf7e1bf4..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png and /dev/null differ
diff --git a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png b/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png
deleted file mode 100644
index 38a8383ee4..0000000000
Binary files a/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png and /dev/null differ
diff --git a/src-tauri/icons/icon.icns b/src-tauri/icons/icon.icns
deleted file mode 100644
index f2761907e1..0000000000
Binary files a/src-tauri/icons/icon.icns and /dev/null differ
diff --git a/src-tauri/icons/icon.ico b/src-tauri/icons/icon.ico
deleted file mode 100644
index 3d11b111a0..0000000000
Binary files a/src-tauri/icons/icon.ico and /dev/null differ
diff --git a/src-tauri/icons/icon.png b/src-tauri/icons/icon.png
deleted file mode 100644
index b6089a1c4c..0000000000
Binary files a/src-tauri/icons/icon.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-20x20@1x.png b/src-tauri/icons/ios/AppIcon-20x20@1x.png
deleted file mode 100644
index 139b06f3c9..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-20x20@1x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-20x20@2x-1.png b/src-tauri/icons/ios/AppIcon-20x20@2x-1.png
deleted file mode 100644
index 7c4e4cbd2e..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-20x20@2x-1.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-20x20@2x.png b/src-tauri/icons/ios/AppIcon-20x20@2x.png
deleted file mode 100644
index 7c4e4cbd2e..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-20x20@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-20x20@3x.png b/src-tauri/icons/ios/AppIcon-20x20@3x.png
deleted file mode 100644
index dc993311a0..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-20x20@3x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-29x29@1x.png b/src-tauri/icons/ios/AppIcon-29x29@1x.png
deleted file mode 100644
index 66e16af958..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-29x29@1x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-29x29@2x-1.png b/src-tauri/icons/ios/AppIcon-29x29@2x-1.png
deleted file mode 100644
index fe18b4eb79..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-29x29@2x-1.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-29x29@2x.png b/src-tauri/icons/ios/AppIcon-29x29@2x.png
deleted file mode 100644
index fe18b4eb79..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-29x29@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-29x29@3x.png b/src-tauri/icons/ios/AppIcon-29x29@3x.png
deleted file mode 100644
index 9b17e4b2da..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-29x29@3x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-40x40@1x.png b/src-tauri/icons/ios/AppIcon-40x40@1x.png
deleted file mode 100644
index 7c4e4cbd2e..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-40x40@1x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-40x40@2x-1.png b/src-tauri/icons/ios/AppIcon-40x40@2x-1.png
deleted file mode 100644
index e200457433..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-40x40@2x-1.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-40x40@2x.png b/src-tauri/icons/ios/AppIcon-40x40@2x.png
deleted file mode 100644
index e200457433..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-40x40@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-40x40@3x.png b/src-tauri/icons/ios/AppIcon-40x40@3x.png
deleted file mode 100644
index 35b4c90170..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-40x40@3x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-512@2x.png b/src-tauri/icons/ios/AppIcon-512@2x.png
deleted file mode 100644
index 9125dccfbe..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-512@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-60x60@2x.png b/src-tauri/icons/ios/AppIcon-60x60@2x.png
deleted file mode 100644
index 35b4c90170..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-60x60@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-60x60@3x.png b/src-tauri/icons/ios/AppIcon-60x60@3x.png
deleted file mode 100644
index 0144f29d82..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-60x60@3x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-76x76@1x.png b/src-tauri/icons/ios/AppIcon-76x76@1x.png
deleted file mode 100644
index 2e813148c7..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-76x76@1x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-76x76@2x.png b/src-tauri/icons/ios/AppIcon-76x76@2x.png
deleted file mode 100644
index 1850930b68..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-76x76@2x.png and /dev/null differ
diff --git a/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png b/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png
deleted file mode 100644
index fa257be06a..0000000000
Binary files a/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png and /dev/null differ
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
deleted file mode 100644
index 6fee40de5a..0000000000
--- a/src-tauri/src/lib.rs
+++ /dev/null
@@ -1,300 +0,0 @@
-use std::{
-  fs,
-  net::TcpListener,
-  path::{Path, PathBuf},
-  process::{Child, Command, Stdio},
-  sync::Mutex,
-};
-
-use serde::Serialize;
-use tauri::State;
-
-#[derive(Default)]
-struct EngineManager {
-  inner: Mutex<EngineState>,
-}
-
-#[derive(Default)]
-struct EngineState {
-  child: Option<Child>,
-  project_dir: Option<String>,
-  hostname: Option<String>,
-  port: Option<u16>,
-  base_url: Option<String>,
-}
-
-#[derive(Debug, Serialize, Clone)]
-#[serde(rename_all = "camelCase")]
-pub struct EngineInfo {
-  pub running: bool,
-  pub base_url: Option<String>,
-  pub project_dir: Option<String>,
-  pub hostname: Option<String>,
-  pub port: Option<u16>,
-  pub pid: Option<u32>,
-}
-
-#[derive(Debug, Serialize, Clone)]
-#[serde(rename_all = "camelCase")]
-pub struct ExecResult {
-  pub ok: bool,
-  pub status: i32,
-  pub stdout: String,
-  pub stderr: String,
-}
-
-fn find_free_port() -> Result<u16, String> {
-  let listener = TcpListener::bind(("127.0.0.1", 0)).map_err(|e| e.to_string())?;
-  let port = listener.local_addr().map_err(|e| e.to_string())?.port();
-  Ok(port)
-}
-
-fn run_capture(command: &mut Command) -> Result<ExecResult, String> {
-  let output = command
-    .output()
-    .map_err(|e| format!("Failed to run command: {e}"))?;
-
-  let status = output.status.code().unwrap_or(-1);
-
-  Ok(ExecResult {
-    ok: output.status.success(),
-    status,
-    stdout: String::from_utf8_lossy(&output.stdout).to_string(),
-    stderr: String::from_utf8_lossy(&output.stderr).to_string(),
-  })
-}
-
-fn copy_dir_recursive(src: &Path, dest: &Path) -> Result<(), String> {
-  if !src.is_dir() {
-    return Err(format!("Source is not a directory: {}", src.display()));
-  }
-
-  fs::create_dir_all(dest).map_err(|e| format!("Failed to create dir {}: {e}", dest.display()))?;
-
-  for entry in fs::read_dir(src).map_err(|e| format!("Failed to read dir {}: {e}", src.display()))? {
-    let entry = entry.map_err(|e| e.to_string())?;
-    let file_type = entry.file_type().map_err(|e| e.to_string())?;
-
-    let from = entry.path();
-    let to = dest.join(entry.file_name());
-
-    if file_type.is_dir() {
-      copy_dir_recursive(&from, &to)?;
-      continue;
-    }
-
-    if file_type.is_file() {
-      fs::copy(&from, &to)
-        .map_err(|e| format!("Failed to copy {} -> {}: {e}", from.display(), to.display()))?;
-      continue;
-    }
-
-    // Skip symlinks and other non-regular entries.
-  }
-
-  Ok(())
-}
-
-impl EngineManager {
-  fn snapshot_locked(state: &mut EngineState) -> EngineInfo {
-    let (running, pid) = match state.child.as_mut() {
-      None => (false, None),
-      Some(child) => match child.try_wait() {
-        Ok(Some(_status)) => {
-          // Process exited.
-          state.child = None;
-          (false, None)
-        }
-        Ok(None) => (true, Some(child.id())),
-        Err(_) => (true, Some(child.id())),
-      },
-    };
-
-    EngineInfo {
-      running,
-      base_url: state.base_url.clone(),
-      project_dir: state.project_dir.clone(),
-      hostname: state.hostname.clone(),
-      port: state.port,
-      pid,
-    }
-  }
-
-  fn stop_locked(state: &mut EngineState) {
-    if let Some(mut child) = state.child.take() {
-      let _ = child.kill();
-      let _ = child.wait();
-    }
-    state.base_url = None;
-    state.project_dir = None;
-    state.hostname = None;
-    state.port = None;
-  }
-}
-
-#[tauri::command]
-fn engine_info(manager: State<EngineManager>) -> EngineInfo {
-  let mut state = manager.inner.lock().expect("engine mutex poisoned");
-  EngineManager::snapshot_locked(&mut state)
-}
-
-#[tauri::command]
-fn engine_stop(manager: State<EngineManager>) -> EngineInfo {
-  let mut state = manager.inner.lock().expect("engine mutex poisoned");
-  EngineManager::stop_locked(&mut state);
-  EngineManager::snapshot_locked(&mut state)
-}
-
-#[tauri::command]
-fn engine_start(manager: State<EngineManager>, project_dir: String) -> Result<EngineInfo, String> {
-  let project_dir = project_dir.trim().to_string();
-  if project_dir.is_empty() {
-    return Err("projectDir is required".to_string());
-  }
-
-  let hostname = "127.0.0.1".to_string();
-  let port = find_free_port()?;
-
-  let mut state = manager.inner.lock().expect("engine mutex poisoned");
-
-  // Stop any existing engine first.
-  EngineManager::stop_locked(&mut state);
-
-  let mut command = Command::new("opencode");
-  command
-    .arg("serve")
-    .arg("--hostname")
-    .arg(&hostname)
-    .arg("--port")
-    .arg(port.to_string())
-    // Allow the Vite dev server origin, plus common Tauri origins.
-    .arg("--cors")
-    .arg("http://localhost:5173")
-    .arg("--cors")
-    .arg("tauri://localhost")
-    .arg("--cors")
-    .arg("http://tauri.localhost")
-    .current_dir(&project_dir)
-    .stdin(Stdio::null())
-    .stdout(Stdio::null())
-    .stderr(Stdio::null());
-
-  let child = command
-    .spawn()
-    .map_err(|e| format!("Failed to start opencode: {e}"))?;
-
-  state.child = Some(child);
-  state.project_dir = Some(project_dir);
-  state.hostname = Some(hostname.clone());
-  state.port = Some(port);
-  state.base_url = Some(format!("http://{hostname}:{port}"));
-
-  Ok(EngineManager::snapshot_locked(&mut state))
-}
-
-#[tauri::command]
-fn opkg_install(project_dir: String, package: String) -> Result<ExecResult, String> {
-  let project_dir = project_dir.trim().to_string();
-  if project_dir.is_empty() {
-    return Err("projectDir is required".to_string());
-  }
-
-  let package = package.trim().to_string();
-  if package.is_empty() {
-    return Err("package is required".to_string());
-  }
-
-  let mut command = Command::new("opkg");
-  command
-    .arg("install")
-    .arg(&package)
-    .current_dir(&project_dir)
-    .stdin(Stdio::null())
-    .stdout(Stdio::piped())
-    .stderr(Stdio::piped());
-
-  match command.output() {
-    Ok(output) => {
-      let status = output.status.code().unwrap_or(-1);
-      Ok(ExecResult {
-        ok: output.status.success(),
-        status,
-        stdout: String::from_utf8_lossy(&output.stdout).to_string(),
-        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
-      })
-    }
-    Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-      // Fallback: use pnpm to download+run opkg on demand.
-      let mut pnpm = Command::new("pnpm");
-      pnpm
-        .arg("dlx")
-        .arg("opkg")
-        .arg("install")
-        .arg(&package)
-        .current_dir(&project_dir)
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-
-      run_capture(&mut pnpm)
-    }
-    Err(e) => Err(format!("Failed to run opkg: {e}")),
-  }
-}
-
-#[tauri::command]
-fn import_skill(project_dir: String, source_dir: String, overwrite: bool) -> Result<ExecResult, String> {
-  let project_dir = project_dir.trim().to_string();
-  if project_dir.is_empty() {
-    return Err("projectDir is required".to_string());
-  }
-
-  let source_dir = source_dir.trim().to_string();
-  if source_dir.is_empty() {
-    return Err("sourceDir is required".to_string());
-  }
-
-  let src = PathBuf::from(&source_dir);
-  let name = src
-    .file_name()
-    .and_then(|s| s.to_str())
-    .ok_or_else(|| "Failed to infer skill name from directory".to_string())?;
-
-  let dest = PathBuf::from(&project_dir)
-    .join(".opencode")
-    .join("skill")
-    .join(name);
-
-  if dest.exists() {
-    if overwrite {
-      fs::remove_dir_all(&dest)
-        .map_err(|e| format!("Failed to remove existing skill dir {}: {e}", dest.display()))?;
-    } else {
-      return Err(format!("Skill already exists at {}", dest.display()));
-    }
-  }
-
-  copy_dir_recursive(&src, &dest)?;
-
-  Ok(ExecResult {
-    ok: true,
-    status: 0,
-    stdout: format!("Imported skill to {}", dest.display()),
-    stderr: String::new(),
-  })
-}
-
-pub fn run() {
-  tauri::Builder::default()
-    .plugin(tauri_plugin_dialog::init())
-    .manage(EngineManager::default())
-    .invoke_handler(tauri::generate_handler![
-      engine_start,
-      engine_stop,
-      engine_info,
-      opkg_install,
-      import_skill
-    ])
-    .run(tauri::generate_context!())
-    .expect("error while running OpenWork");
-}
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
deleted file mode 100644
index fd3889079c..0000000000
--- a/src-tauri/tauri.conf.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "$schema": "https://schema.tauri.app/config/2",
-  "productName": "OpenWork",
-  "version": "0.1.1",
-  "identifier": "com.differentai.openwork",
-  "build": {
-    "beforeDevCommand": "pnpm dev:web",
-    "beforeBuildCommand": "pnpm build:web",
-    "devUrl": "http://localhost:5173",
-    "frontendDist": "../dist"
-  },
-  "app": {
-    "windows": [
-      {
-        "title": "OpenWork",
-        "width": 1180,
-        "height": 820,
-        "resizable": true
-      }
-    ],
-    "security": {
-      "csp": null
-    }
-  },
-  "bundle": {
-    "icon": [
-      "icons/32x32.png",
-      "icons/128x128.png",
-      "icons/128x128@2x.png",
-      "icons/icon.icns",
-      "icons/icon.ico"
-    ]
-  }
-}
diff --git a/src/App.tsx b/src/App.tsx
deleted file mode 100644
index 3b1344557d..0000000000
--- a/src/App.tsx
+++ /dev/null
@@ -1,2358 +0,0 @@
-import {
-  For,
-  Match,
-  Show,
-  Switch,
-  createEffect,
-  createMemo,
-  createSignal,
-  onCleanup,
-  onMount,
-} from "solid-js";
-
-import type {
-  Message,
-  Part,
-  PermissionRequest as ApiPermissionRequest,
-  Session,
-} from "@opencode-ai/sdk/v2/client";
-
-import {
-  ArrowRight,
-  CheckCircle2,
-  ChevronRight,
-  Circle,
-  Clock,
-  Command,
-  Cpu,
-  FileText,
-  Folder,
-  HardDrive,
-  Menu,
-  Package,
-  Play,
-  Plus,
-  Settings,
-  Shield,
-  Smartphone,
-  Trash2,
-  Upload,
-  X,
-  Zap,
-} from "lucide-solid";
-
-import Button from "./components/Button";
-import PartView from "./components/PartView";
-import TextInput from "./components/TextInput";
-import { createClient, unwrap, waitForHealthy } from "./lib/opencode";
-import {
-  engineInfo,
-  engineStart,
-  engineStop,
-  importSkill,
-  opkgInstall,
-  pickDirectory,
-  type EngineInfo,
-} from "./lib/tauri";
-
-type Client = ReturnType<typeof createClient>;
-
-type MessageWithParts = {
-  info: Message;
-  parts: Part[];
-};
-
-type OpencodeEvent = {
-  type: string;
-  properties?: unknown;
-};
-
-type View = "onboarding" | "dashboard" | "session";
-
-type Mode = "host" | "client";
-
-type OnboardingStep = "mode" | "host" | "client" | "connecting";
-
-type DashboardTab = "home" | "sessions" | "templates" | "skills" | "settings";
-
-type Template = {
-  id: string;
-  title: string;
-  description: string;
-  prompt: string;
-  createdAt: number;
-};
-
-type SkillCard = {
-  name: string;
-  path: string;
-  description?: string;
-};
-
-type PendingPermission = ApiPermissionRequest & {
-  receivedAt: number;
-};
-
-function isTauriRuntime() {
-  return typeof window !== "undefined" && (window as any).__TAURI_INTERNALS__ != null;
-}
-
-function safeStringify(value: unknown) {
-  const seen = new WeakSet<object>();
-
-  try {
-    return JSON.stringify(
-      value,
-      (key, val) => {
-        if (val && typeof val === "object") {
-          if (seen.has(val as object)) {
-            return "<circular>";
-          }
-          seen.add(val as object);
-        }
-
-        const lowerKey = key.toLowerCase();
-        if (
-          lowerKey === "reasoningencryptedcontent" ||
-          lowerKey.includes("api_key") ||
-          lowerKey.includes("apikey") ||
-          lowerKey.includes("access_token") ||
-          lowerKey.includes("refresh_token") ||
-          lowerKey.includes("token") ||
-          lowerKey.includes("authorization") ||
-          lowerKey.includes("cookie") ||
-          lowerKey.includes("secret")
-        ) {
-          return "[redacted]";
-        }
-
-        return val;
-      },
-      2,
-    );
-  } catch {
-    return "<unserializable>";
-  }
-}
-
-function normalizeEvent(raw: unknown): OpencodeEvent | null {
-  if (!raw || typeof raw !== "object") {
-    return null;
-  }
-
-  const record = raw as Record<string, unknown>;
-
-  if (typeof record.type === "string") {
-    return {
-      type: record.type,
-      properties: record.properties,
-    };
-  }
-
-  if (record.payload && typeof record.payload === "object") {
-    const payload = record.payload as Record<string, unknown>;
-    if (typeof payload.type === "string") {
-      return {
-        type: payload.type,
-        properties: payload.properties,
-      };
-    }
-  }
-
-  return null;
-}
-
-function formatRelativeTime(timestampMs: number) {
-  const delta = Date.now() - timestampMs;
-
-  if (delta < 0) {
-    return "just now";
-  }
-
-  if (delta < 60_000) {
-    return `${Math.max(1, Math.round(delta / 1000))}s ago`;
-  }
-
-  if (delta < 60 * 60_000) {
-    return `${Math.max(1, Math.round(delta / 60_000))}m ago`;
-  }
-
-  if (delta < 24 * 60 * 60_000) {
-    return `${Math.max(1, Math.round(delta / (60 * 60_000)))}h ago`;
-  }
-
-  return new Date(timestampMs).toLocaleDateString();
-}
-
-function upsertSession(list: Session[], next: Session) {
-  const idx = list.findIndex((s) => s.id === next.id);
-  if (idx === -1) return [...list, next];
-
-  const copy = list.slice();
-  copy[idx] = next;
-  return copy;
-}
-
-function upsertMessage(list: MessageWithParts[], nextInfo: Message) {
-  const idx = list.findIndex((m) => m.info.id === nextInfo.id);
-  if (idx === -1) {
-    return list.concat({ info: nextInfo, parts: [] });
-  }
-
-  const copy = list.slice();
-  copy[idx] = { ...copy[idx], info: nextInfo };
-  return copy;
-}
-
-function upsertPart(list: MessageWithParts[], nextPart: Part) {
-  const msgIdx = list.findIndex((m) => m.info.id === nextPart.messageID);
-  if (msgIdx === -1) {
-    return list;
-  }
-
-  const copy = list.slice();
-  const msg = copy[msgIdx];
-  const parts = msg.parts.slice();
-  const partIdx = parts.findIndex((p) => p.id === nextPart.id);
-
-  if (partIdx === -1) {
-    parts.push(nextPart);
-  } else {
-    parts[partIdx] = nextPart;
-  }
-
-  copy[msgIdx] = { ...msg, parts };
-  return copy;
-}
-
-function removePart(list: MessageWithParts[], messageID: string, partID: string) {
-  const msgIdx = list.findIndex((m) => m.info.id === messageID);
-  if (msgIdx === -1) return list;
-
-  const copy = list.slice();
-  const msg = copy[msgIdx];
-  copy[msgIdx] = { ...msg, parts: msg.parts.filter((p) => p.id !== partID) };
-  return copy;
-}
-
-function normalizeSessionStatus(status: unknown) {
-  if (!status || typeof status !== "object") return "idle";
-  const record = status as Record<string, unknown>;
-  if (record.type === "busy") return "running";
-  if (record.type === "retry") return "retry";
-  if (record.type === "idle") return "idle";
-  return "idle";
-}
-
-export default function App() {
-  const [view, setView] = createSignal<View>("onboarding");
-  const [mode, setMode] = createSignal<Mode | null>(null);
-  const [onboardingStep, setOnboardingStep] = createSignal<OnboardingStep>("mode");
-  const [tab, setTab] = createSignal<DashboardTab>("home");
-
-  const [engine, setEngine] = createSignal<EngineInfo | null>(null);
-
-  const [projectDir, setProjectDir] = createSignal("");
-  const [authorizedDirs, setAuthorizedDirs] = createSignal<string[]>([]);
-  const [newAuthorizedDir, setNewAuthorizedDir] = createSignal("");
-
-  const [baseUrl, setBaseUrl] = createSignal("http://127.0.0.1:4096");
-  const [clientDirectory, setClientDirectory] = createSignal("");
-
-  const [client, setClient] = createSignal<Client | null>(null);
-  const [connectedVersion, setConnectedVersion] = createSignal<string | null>(null);
-  const [sseConnected, setSseConnected] = createSignal(false);
-
-  const [sessions, setSessions] = createSignal<Session[]>([]);
-  const [selectedSessionId, setSelectedSessionId] = createSignal<string | null>(null);
-  const [sessionStatusById, setSessionStatusById] = createSignal<Record<string, string>>({});
-
-  const [messages, setMessages] = createSignal<MessageWithParts[]>([]);
-  const [todos, setTodos] = createSignal<
-    Array<{ id: string; content: string; status: string; priority: string }>
-  >([]);
-  const [pendingPermissions, setPendingPermissions] = createSignal<PendingPermission[]>([]);
-
-  const [prompt, setPrompt] = createSignal("");
-  const [lastPromptSent, setLastPromptSent] = createSignal("");
-
-  const [templates, setTemplates] = createSignal<Template[]>([]);
-  const [templateModalOpen, setTemplateModalOpen] = createSignal(false);
-  const [templateDraftTitle, setTemplateDraftTitle] = createSignal("");
-  const [templateDraftDescription, setTemplateDraftDescription] = createSignal("");
-  const [templateDraftPrompt, setTemplateDraftPrompt] = createSignal("");
-
-  const [skills, setSkills] = createSignal<SkillCard[]>([]);
-  const [skillsStatus, setSkillsStatus] = createSignal<string | null>(null);
-  const [openPackageSource, setOpenPackageSource] = createSignal("");
-
-  const [events, setEvents] = createSignal<OpencodeEvent[]>([]);
-  const [developerMode, setDeveloperMode] = createSignal(false);
-
-  const [busy, setBusy] = createSignal(false);
-  const [busyLabel, setBusyLabel] = createSignal<string | null>(null);
-  const [busyStartedAt, setBusyStartedAt] = createSignal<number | null>(null);
-  const [error, setError] = createSignal<string | null>(null);
-
-  const busySeconds = createMemo(() => {
-    const start = busyStartedAt();
-    if (!start) return 0;
-    return Math.max(0, Math.round((Date.now() - start) / 1000));
-  });
-
-  const newTaskDisabled = createMemo(() => {
-    const label = busyLabel();
-    // Allow creating a new session even while a run is in progress.
-    if (busy() && label === "Running") return false;
-
-    // Otherwise, block during engine / connection transitions.
-    if (busy() && (label === "Connecting" || label === "Starting engine" || label === "Disconnecting")) {
-      return true;
-    }
-
-    return busy();
-  });
-
-  const selectedSession = createMemo(() => {
-    const id = selectedSessionId();
-    if (!id) return null;
-    return sessions().find((s) => s.id === id) ?? null;
-  });
-
-  const selectedSessionStatus = createMemo(() => {
-    const id = selectedSessionId();
-    if (!id) return "idle";
-    return sessionStatusById()[id] ?? "idle";
-  });
-
-  const activePermission = createMemo(() => {
-    const id = selectedSessionId();
-    const list = pendingPermissions();
-
-    if (id) {
-      return list.find((p) => p.sessionID === id) ?? null;
-    }
-
-    return list[0] ?? null;
-  });
-
-  async function refreshEngine() {
-    if (!isTauriRuntime()) return;
-
-    try {
-      const info = await engineInfo();
-      setEngine(info);
-
-      if (info.projectDir) {
-        setProjectDir(info.projectDir);
-      }
-      if (info.baseUrl) {
-        setBaseUrl(info.baseUrl);
-      }
-    } catch {
-      // ignore
-    }
-  }
-
-  async function loadSessions(c: Client) {
-    const list = unwrap(await c.session.list());
-    setSessions(list);
-  }
-
-  async function refreshPendingPermissions(c: Client) {
-    const list = unwrap(await c.permission.list());
-
-    setPendingPermissions((current) => {
-      const now = Date.now();
-      const byId = new Map(current.map((p) => [p.id, p] as const));
-      return list.map((p) => ({ ...p, receivedAt: byId.get(p.id)?.receivedAt ?? now }));
-    });
-  }
-
-  async function connectToServer(nextBaseUrl: string, directory?: string) {
-    setError(null);
-    setBusy(true);
-    setBusyLabel("Connecting");
-    setBusyStartedAt(Date.now());
-    setSseConnected(false);
-
-    try {
-      const nextClient = createClient(nextBaseUrl, directory);
-      const health = await waitForHealthy(nextClient, { timeoutMs: 12_000 });
-
-      setClient(nextClient);
-      setConnectedVersion(health.version);
-      setBaseUrl(nextBaseUrl);
-
-      await loadSessions(nextClient);
-      await refreshPendingPermissions(nextClient);
-
-      setSelectedSessionId(null);
-      setMessages([]);
-      setTodos([]);
-
-      setView("dashboard");
-      setTab("home");
-      refreshSkills().catch(() => undefined);
-      return true;
-    } catch (e) {
-      setClient(null);
-      setConnectedVersion(null);
-      setError(e instanceof Error ? e.message : safeStringify(e));
-      return false;
-    } finally {
-      setBusy(false);
-      setBusyLabel(null);
-      setBusyStartedAt(null);
-    }
-  }
-
-  async function startHost() {
-    if (!isTauriRuntime()) {
-      setError("Host mode requires the Tauri app runtime. Use `pnpm dev`.");
-      return false;
-    }
-
-    const dir = projectDir().trim();
-    if (!dir) {
-      setError("Pick a folder path to start OpenCode in.");
-      return false;
-    }
-
-    setError(null);
-    setBusy(true);
-    setBusyLabel("Starting engine");
-    setBusyStartedAt(Date.now());
-
-    try {
-      const info = await engineStart(dir);
-      setEngine(info);
-
-      if (info.baseUrl) {
-        const ok = await connectToServer(info.baseUrl, info.projectDir ?? undefined);
-        if (!ok) return false;
-      }
-
-      return true;
-    } catch (e) {
-      setError(e instanceof Error ? e.message : safeStringify(e));
-      return false;
-    } finally {
-      setBusy(false);
-      setBusyLabel(null);
-      setBusyStartedAt(null);
-    }
-  }
-
-  async function stopHost() {
-    setError(null);
-    setBusy(true);
-    setBusyLabel("Disconnecting");
-    setBusyStartedAt(Date.now());
-
-    try {
-      if (isTauriRuntime()) {
-        const info = await engineStop();
-        setEngine(info);
-      }
-
-      setClient(null);
-      setConnectedVersion(null);
-      setSessions([]);
-      setSelectedSessionId(null);
-      setMessages([]);
-      setTodos([]);
-      setPendingPermissions([]);
-      setSessionStatusById({});
-      setSseConnected(false);
-
-      setMode(null);
-      setOnboardingStep("mode");
-      setView("onboarding");
-    } catch (e) {
-      setError(e instanceof Error ? e.message : safeStringify(e));
-    } finally {
-      setBusy(false);
-      setBusyLabel(null);
-      setBusyStartedAt(null);
-    }
-  }
-
-  async function selectSession(sessionID: string) {
-    const c = client();
-    if (!c) return;
-
-    setSelectedSessionId(sessionID);
-    setError(null);
-
-    const msgs = unwrap(await c.session.messages({ sessionID }));
-    setMessages(msgs);
-
-    try {
-      setTodos(unwrap(await c.session.todo({ sessionID })));
-    } catch {
-      setTodos([]);
-    }
-
-    try {
-      await refreshPendingPermissions(c);
-    } catch {
-      // ignore
-    }
-  }
-
-  async function createSessionAndOpen() {
-    const c = client();
-    if (!c) return;
-
-    setBusy(true);
-    setBusyLabel("Creating session");
-    setBusyStartedAt(Date.now());
-    setError(null);
-
-    try {
-      const session = unwrap(await c.session.create({ title: "New task" }));
-      await loadSessions(c);
-      await selectSession(session.id);
-      setView("session");
-    } catch (e) {
-      setError(e instanceof Error ? e.message : safeStringify(e));
-    } finally {
-      setBusy(false);
-      setBusyLabel(null);
-      setBusyStartedAt(null);
-    }
-  }
-
-  async function sendPrompt() {
-    const c = client();
-    const sessionID = selectedSessionId();
-    if (!c || !sessionID) return;
-
-    const content = prompt().trim();
-    if (!content) return;
-
-    setBusy(true);
-    setBusyLabel("Running");
-    setBusyStartedAt(Date.now());
-    setError(null);
-
-    try {
-      setLastPromptSent(content);
-      setPrompt("");
-      unwrap(
-        await c.session.prompt({
-          sessionID,
-          parts: [{ type: "text", text: content }],
-        }),
-      );
-
-      const msgs = unwrap(await c.session.messages({ sessionID }));
-      setMessages(msgs);
-
-      try {
-        setTodos(unwrap(await c.session.todo({ sessionID })));
-      } catch {
-        setTodos([]);
-      }
-
-      await loadSessions(c);
-    } catch (e) {
-      setError(e instanceof Error ? e.message : safeStringify(e));
-    } finally {
-      setBusy(false);
-      setBusyLabel(null);
-      setBusyStartedAt(null);
-    }
-  }
-
-  function openTemplateModal() {
-    const seedTitle = selectedSession()?.title ?? "";
-    const seedPrompt = lastPromptSent() || prompt();
-
-    setTemplateDraftTitle(seedTitle);
-    setTemplateDraftDescription("");
-    setTemplateDraftPrompt(seedPrompt);
-    setTemplateModalOpen(true);
-  }
-
-  function saveTemplate() {
-    const title = templateDraftTitle().trim();
-    const promptText = templateDraftPrompt().trim();
-    const description = templateDraftDescription().trim();
-
-    if (!title || !promptText) {
-      setError("Template title and prompt are required.");
-      return;
-    }
-
-    const template: Template = {
-      id: `tmpl_${Date.now()}`,
-      title,
-      description,
-      prompt: promptText,
-      createdAt: Date.now(),
-    };
-
-    setTemplates((current) => [template, ...current]);
-    setTemplateModalOpen(false);
-  }
-
-  function deleteTemplate(templateId: string) {
-    setTemplates((current) => current.filter((t) => t.id !== templateId));
-  }
-
-  async function runTemplate(template: Template) {
-    const c = client();
-    if (!c) return;
-
-    setBusy(true);
-    setError(null);
-
-    try {
-      const session = unwrap(await c.session.create({ title: template.title }));
-      await loadSessions(c);
-      await selectSession(session.id);
-      setView("session");
-
-      unwrap(
-        await c.session.prompt({
-          sessionID: session.id,
-          parts: [{ type: "text", text: template.prompt }],
-        }),
-      );
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Unknown error");
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  async function refreshSkills() {
-    const c = client();
-    if (!c) return;
-
-    try {
-      setSkillsStatus(null);
-      const nodes = unwrap(await c.file.list({ path: ".opencode/skill" }));
-      const dirs = nodes.filter((n) => n.type === "directory" && !n.ignored);
-
-      const next: SkillCard[] = [];
-
-      for (const dir of dirs) {
-        let description: string | undefined;
-
-        try {
-          const skillDoc = unwrap(
-            await c.file.read({ path: `.opencode/skill/${dir.name}/SKILL.md` }),
-          );
-
-          if (skillDoc.type === "text") {
-            const lines = skillDoc.content.split("\n");
-            const first = lines
-              .map((l) => l.trim())
-              .filter((l) => l && !l.startsWith("#"))
-              .slice(0, 2)
-              .join(" ");
-            if (first) {
-              description = first;
-            }
-          }
-        } catch {
-          // ignore missing SKILL.md
-        }
-
-        next.push({ name: dir.name, path: dir.path, description });
-      }
-
-      setSkills(next);
-      if (!next.length) {
-        setSkillsStatus("No skills found in .opencode/skill");
-      }
-    } catch (e) {
-      setSkills([]);
-      setSkillsStatus(e instanceof Error ? e.message : "Failed to load skills");
-    }
-  }
-
-  async function installFromOpenPackage() {
-    if (mode() !== "host" || !isTauriRuntime()) {
-      setError("OpenPackage installs are only available in Host mode.");
-      return;
-    }
-
-    const targetDir = projectDir().trim();
-    const pkg = openPackageSource().trim();
-
-    if (!targetDir) {
-      setError("Pick a project folder first.");
-      return;
-    }
-
-    if (!pkg) {
-      setError("Enter an OpenPackage source (e.g. github:anthropics/claude-code).");
-      return;
-    }
-
-    setBusy(true);
-    setError(null);
-    setSkillsStatus(null);
-
-    try {
-      const result = await opkgInstall(targetDir, pkg);
-      if (!result.ok) {
-        setSkillsStatus(result.stderr || result.stdout || `opkg failed (${result.status})`);
-      } else {
-        setSkillsStatus(result.stdout || "Installed.");
-      }
-
-      await refreshSkills();
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Unknown error");
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  async function importLocalSkill() {
-    if (mode() !== "host" || !isTauriRuntime()) {
-      setError("Skill import is only available in Host mode.");
-      return;
-    }
-
-    const targetDir = projectDir().trim();
-    if (!targetDir) {
-      setError("Pick a project folder first.");
-      return;
-    }
-
-    setBusy(true);
-    setError(null);
-    setSkillsStatus(null);
-
-    try {
-      const selection = await pickDirectory({ title: "Select skill folder" });
-      const sourceDir =
-        typeof selection === "string" ? selection : Array.isArray(selection) ? selection[0] : null;
-
-      if (!sourceDir) {
-        return;
-      }
-
-      const result = await importSkill(targetDir, sourceDir, { overwrite: false });
-      if (!result.ok) {
-        setSkillsStatus(result.stderr || result.stdout || `Import failed (${result.status})`);
-      } else {
-        setSkillsStatus(result.stdout || "Imported.");
-      }
-
-      await refreshSkills();
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Unknown error");
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  async function respondPermission(requestID: string, reply: "once" | "always" | "reject") {
-    const c = client();
-    if (!c) return;
-
-    setBusy(true);
-    setError(null);
-
-    try {
-      unwrap(await c.permission.reply({ requestID, reply }));
-      await refreshPendingPermissions(c);
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Unknown error");
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  function addAuthorizedDir() {
-    const next = newAuthorizedDir().trim();
-    if (!next) return;
-
-    setAuthorizedDirs((current) => {
-      if (current.includes(next)) return current;
-      return [...current, next];
-    });
-    setNewAuthorizedDir("");
-  }
-
-  function removeAuthorizedDir(index: number) {
-    setAuthorizedDirs((current) => current.filter((_, i) => i !== index));
-  }
-
-  onMount(async () => {
-    if (typeof window !== "undefined") {
-      try {
-        const storedBaseUrl = window.localStorage.getItem("openwork.baseUrl");
-        if (storedBaseUrl) {
-          setBaseUrl(storedBaseUrl);
-        }
-
-        const storedClientDir = window.localStorage.getItem("openwork.clientDirectory");
-        if (storedClientDir) {
-          setClientDirectory(storedClientDir);
-        }
-
-        const storedProjectDir = window.localStorage.getItem("openwork.projectDir");
-        if (storedProjectDir) {
-          setProjectDir(storedProjectDir);
-        }
-
-        const storedAuthorized = window.localStorage.getItem("openwork.authorizedDirs");
-        if (storedAuthorized) {
-          const parsed = JSON.parse(storedAuthorized) as unknown;
-          if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
-            setAuthorizedDirs(parsed);
-          }
-        }
-
-        const storedTemplates = window.localStorage.getItem("openwork.templates");
-        if (storedTemplates) {
-          const parsed = JSON.parse(storedTemplates) as unknown;
-          if (Array.isArray(parsed)) {
-            setTemplates(parsed as Template[]);
-          }
-        }
-      } catch {
-        // ignore
-      }
-    }
-
-    await refreshEngine();
-
-    const info = engine();
-    if (info?.baseUrl) {
-      setBaseUrl(info.baseUrl);
-    }
-  });
-
-  createEffect(() => {
-    if (typeof window === "undefined") return;
-    try {
-      window.localStorage.setItem("openwork.baseUrl", baseUrl());
-    } catch {
-      // ignore
-    }
-  });
-
-  createEffect(() => {
-    if (typeof window === "undefined") return;
-    try {
-      window.localStorage.setItem("openwork.clientDirectory", clientDirectory());
-    } catch {
-      // ignore
-    }
-  });
-
-  createEffect(() => {
-    if (typeof window === "undefined") return;
-    try {
-      window.localStorage.setItem("openwork.projectDir", projectDir());
-    } catch {
-      // ignore
-    }
-  });
-
-  createEffect(() => {
-    if (typeof window === "undefined") return;
-    try {
-      window.localStorage.setItem("openwork.authorizedDirs", JSON.stringify(authorizedDirs()));
-    } catch {
-      // ignore
-    }
-  });
-
-  createEffect(() => {
-    if (typeof window === "undefined") return;
-    try {
-      window.localStorage.setItem("openwork.templates", JSON.stringify(templates()));
-    } catch {
-      // ignore
-    }
-  });
-
-  createEffect(() => {
-    const c = client();
-    if (!c) return;
-
-    const controller = new AbortController();
-    let cancelled = false;
-
-    (async () => {
-      try {
-        const sub = await c.event.subscribe(undefined, { signal: controller.signal });
-
-        for await (const raw of sub.stream) {
-          if (cancelled) break;
-
-          const event = normalizeEvent(raw);
-          if (!event) continue;
-
-          if (event.type === "server.connected") {
-            setSseConnected(true);
-          }
-
-          if (developerMode()) {
-            setEvents((current) => {
-              const next = [{ type: event.type, properties: event.properties }, ...current];
-              return next.slice(0, 150);
-            });
-          }
-
-          if (event.type === "session.updated" || event.type === "session.created") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              if (record.info && typeof record.info === "object") {
-                setSessions((current) => upsertSession(current, record.info as Session));
-              }
-            }
-          }
-
-          if (event.type === "session.deleted") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              const info = record.info as Session | undefined;
-              if (info?.id) {
-                setSessions((current) => current.filter((s) => s.id !== info.id));
-              }
-            }
-          }
-
-          if (event.type === "session.status") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              const sessionID = typeof record.sessionID === "string" ? record.sessionID : null;
-              if (sessionID) {
-                setSessionStatusById((current) => ({
-                  ...current,
-                  [sessionID]: normalizeSessionStatus(record.status),
-                }));
-              }
-            }
-          }
-
-          if (event.type === "session.idle") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              const sessionID = typeof record.sessionID === "string" ? record.sessionID : null;
-              if (sessionID) {
-                setSessionStatusById((current) => ({
-                  ...current,
-                  [sessionID]: "idle",
-                }));
-              }
-            }
-          }
-
-          if (event.type === "message.updated") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              if (record.info && typeof record.info === "object") {
-                const info = record.info as Message;
-                if (selectedSessionId() && info.sessionID === selectedSessionId()) {
-                  setMessages((current) => upsertMessage(current, info));
-                }
-              }
-            }
-          }
-
-          if (event.type === "message.removed") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              if (
-                selectedSessionId() &&
-                record.sessionID === selectedSessionId() &&
-                typeof record.messageID === "string"
-              ) {
-                setMessages((current) => current.filter((m) => m.info.id !== record.messageID));
-              }
-            }
-          }
-
-          if (event.type === "message.part.updated") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              if (record.part && typeof record.part === "object") {
-                const part = record.part as Part;
-                if (selectedSessionId() && part.sessionID === selectedSessionId()) {
-                  setMessages((current) => upsertPart(current, part));
-                }
-              }
-            }
-          }
-
-          if (event.type === "message.part.removed") {
-            if (event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              const sessionID = typeof record.sessionID === "string" ? record.sessionID : null;
-              const messageID = typeof record.messageID === "string" ? record.messageID : null;
-              const partID = typeof record.partID === "string" ? record.partID : null;
-
-              if (sessionID && selectedSessionId() && sessionID === selectedSessionId() && messageID && partID) {
-                setMessages((current) => removePart(current, messageID, partID));
-              }
-            }
-          }
-
-          if (event.type === "todo.updated") {
-            const id = selectedSessionId();
-            if (id && event.properties && typeof event.properties === "object") {
-              const record = event.properties as Record<string, unknown>;
-              if (record.sessionID === id && Array.isArray(record.todos)) {
-                setTodos(record.todos as any);
-              }
-            }
-          }
-
-          if (event.type === "permission.asked" || event.type === "permission.replied") {
-            try {
-              await refreshPendingPermissions(c);
-            } catch {
-              // ignore
-            }
-          }
-        }
-      } catch (e) {
-        if (cancelled) return;
-
-        const message = e instanceof Error ? e.message : String(e);
-        if (message.toLowerCase().includes("abort")) return;
-
-        setError(message);
-      }
-    })();
-
-    onCleanup(() => {
-      cancelled = true;
-      controller.abort();
-    });
-  });
-
-  const headerStatus = createMemo(() => {
-    if (!client() || !connectedVersion()) return "Disconnected";
-    const bits = [`Connected · ${connectedVersion()}`];
-    if (sseConnected()) bits.push("Live");
-    return bits.join(" · ");
-  });
-
-  const busyHint = createMemo(() => {
-    if (!busy() || !busyLabel()) return null;
-    const seconds = busySeconds();
-    return seconds > 0 ? `${busyLabel()} · ${seconds}s` : busyLabel();
-  });
-
-  function OnboardingView() {
-    return (
-      <Switch>
-        <Match when={onboardingStep() === "connecting"}>
-          <div class="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative overflow-hidden">
-            <div class="absolute inset-0 bg-[radial-gradient(circle_at_center,_var(--tw-gradient-stops))] from-zinc-900 via-black to-black opacity-50" />
-            <div class="z-10 flex flex-col items-center gap-6">
-              <div class="relative">
-                <div class="w-16 h-16 rounded-full border-2 border-zinc-800 flex items-center justify-center animate-spin-slow">
-                  <div class="w-12 h-12 rounded-full border-2 border-t-white border-zinc-800 animate-spin" />
-                </div>
-                <div class="absolute inset-0 flex items-center justify-center">
-                  <Zap size={20} class="text-white" />
-                </div>
-              </div>
-              <div class="text-center">
-                <h2 class="text-xl font-medium mb-2">
-                  {mode() === "host" ? "Starting OpenCode Engine..." : "Connecting..."}
-                </h2>
-                <p class="text-zinc-500 text-sm">
-                  {mode() === "host" ? "Initializing localhost server" : "Verifying handshake"}
-                </p>
-              </div>
-            </div>
-          </div>
-        </Match>
-
-        <Match when={onboardingStep() === "host"}>
-          <div class="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative">
-            <div class="absolute top-0 left-0 w-full h-96 bg-gradient-to-b from-zinc-900 to-transparent opacity-20 pointer-events-none" />
-
-            <div class="max-w-md w-full z-10 space-y-8">
-              <div class="text-center space-y-2">
-                <div class="w-12 h-12 bg-zinc-900 rounded-2xl mx-auto flex items-center justify-center border border-zinc-800 mb-6">
-                  <Shield class="text-zinc-400" />
-                </div>
-                <h2 class="text-2xl font-bold tracking-tight">Authorized Workspaces</h2>
-                <p class="text-zinc-400 text-sm leading-relaxed">
-                  OpenWork runs locally. Select which folders it is allowed to access.
-                </p>
-              </div>
-
-              <div class="space-y-4">
-                <div>
-                  <div class="mb-1 flex items-center justify-between gap-3">
-                    <div class="text-xs font-medium text-zinc-300">Project folder</div>
-                  </div>
-                  <div class="flex gap-2">
-                    <input
-                      class="w-full bg-neutral-900/60 px-3 py-2 text-sm text-neutral-100 placeholder:text-neutral-500 shadow-[0_0_0_1px_rgba(255,255,255,0.08)] focus:outline-none focus:ring-2 focus:ring-white/20 rounded-xl"
-                      placeholder="/path/to/project"
-                      value={projectDir()}
-                      onInput={(e) => setProjectDir(e.currentTarget.value)}
-                    />
-                    <Show when={isTauriRuntime()}>
-                      <Button
-                        variant="secondary"
-                        onClick={async () => {
-                          try {
-                            const selection = await pickDirectory({ title: "Select project folder" });
-                            const path =
-                              typeof selection === "string"
-                                ? selection
-                                : Array.isArray(selection)
-                                  ? selection[0]
-                                  : null;
-                            if (path) {
-                              setProjectDir(path);
-                            }
-                          } catch (e) {
-                            setError(e instanceof Error ? e.message : "Unknown error");
-                          }
-                        }}
-                        disabled={busy()}
-                      >
-                        Browse
-                      </Button>
-                    </Show>
-                  </div>
-                  <div class="mt-1 text-xs text-neutral-500">
-                    {isTauriRuntime()
-                      ? "Engine will start in this folder."
-                      : "Host mode requires the Tauri app runtime."}
-                  </div>
-                </div>
-
-                <div class="space-y-3">
-                  <For each={authorizedDirs()}>
-                    {(folder, idx) => (
-                      <div class="group flex items-center justify-between p-4 bg-zinc-900/50 rounded-xl border border-zinc-800/80 hover:border-zinc-700 transition-colors">
-                        <div class="flex items-center gap-3 overflow-hidden">
-                          <Folder size={18} class="text-indigo-400 shrink-0" />
-                          <span class="font-mono text-sm text-zinc-300 truncate">{folder}</span>
-                        </div>
-                        <button
-                          onClick={() => removeAuthorizedDir(idx())}
-                          class="text-zinc-600 hover:text-red-400 p-1 opacity-0 group-hover:opacity-100 transition-all"
-                          title="Remove"
-                        >
-                          <Trash2 size={16} />
-                        </button>
-                      </div>
-                    )}
-                  </For>
-
-                  <Show when={!authorizedDirs().length}>
-                    <div class="text-xs text-zinc-600">
-                      No authorized folders yet. Add at least your project folder.
-                    </div>
-                  </Show>
-
-                  <div class="flex gap-2">
-                    <input
-                      class="w-full bg-zinc-900/50 border border-zinc-800 rounded-xl px-3 py-2 text-sm text-white placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-zinc-600 focus:border-zinc-600 transition-all"
-                      placeholder="Add folder path…"
-                      value={newAuthorizedDir()}
-                      onInput={(e) => setNewAuthorizedDir(e.currentTarget.value)}
-                      onKeyDown={(e) => {
-                        if (e.key === "Enter") {
-                          addAuthorizedDir();
-                        }
-                      }}
-                    />
-                    <Show when={isTauriRuntime()}>
-                      <Button
-                        variant="outline"
-                        onClick={async () => {
-                          try {
-                            const selection = await pickDirectory({ title: "Add authorized folder" });
-                            const path =
-                              typeof selection === "string"
-                                ? selection
-                                : Array.isArray(selection)
-                                  ? selection[0]
-                                  : null;
-                            if (path) {
-                              setAuthorizedDirs((current) =>
-                                current.includes(path) ? current : [...current, path],
-                              );
-                            }
-                          } catch (e) {
-                            setError(e instanceof Error ? e.message : safeStringify(e));
-                          }
-                        }}
-                        disabled={busy()}
-                      >
-                        Pick
-                      </Button>
-                    </Show>
-                    <Button
-                      variant="secondary"
-                      onClick={addAuthorizedDir}
-                      disabled={!newAuthorizedDir().trim()}
-                    >
-                      <Plus size={16} />
-                      Add
-                    </Button>
-                  </div>
-
-                  <Button
-                    onClick={async () => {
-                      if (!authorizedDirs().length && projectDir().trim()) {
-                        setAuthorizedDirs([projectDir().trim()]);
-                      }
-
-                      setMode("host");
-                      setOnboardingStep("connecting");
-                      const ok = await startHost();
-                      if (!ok) {
-                        setOnboardingStep("host");
-                      }
-                    }}
-                    disabled={busy()}
-                    class="w-full py-3 text-base"
-                  >
-                    Confirm & Start Engine
-                  </Button>
-
-                  <Button
-                    variant="ghost"
-                    onClick={() => {
-                      setMode(null);
-                      setOnboardingStep("mode");
-                    }}
-                    disabled={busy()}
-                    class="w-full"
-                  >
-                    Back
-                  </Button>
-
-                  <p class="text-center text-xs text-zinc-600">
-                    You can change these later in Settings.
-                  </p>
-                </div>
-              </div>
-
-              <Show when={error()}>
-                <div class="rounded-2xl bg-red-950/40 px-5 py-4 text-sm text-red-200 border border-red-500/20">
-                  {error()}
-                </div>
-              </Show>
-            </div>
-          </div>
-        </Match>
-
-        <Match when={onboardingStep() === "client"}>
-          <div class="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative">
-            <div class="absolute top-0 left-0 w-full h-96 bg-gradient-to-b from-zinc-900 to-transparent opacity-20 pointer-events-none" />
-
-            <div class="max-w-md w-full z-10 space-y-8">
-              <div class="text-center space-y-2">
-                <div class="w-12 h-12 bg-zinc-900 rounded-2xl mx-auto flex items-center justify-center border border-zinc-800 mb-6">
-                  <Smartphone class="text-zinc-400" />
-                </div>
-                <h2 class="text-2xl font-bold tracking-tight">Connect to Host</h2>
-                <p class="text-zinc-400 text-sm leading-relaxed">
-                  Pair with an existing OpenCode server (LAN or tunnel).
-                </p>
-              </div>
-
-              <div class="space-y-4">
-                <TextInput
-                  label="Server URL"
-                  placeholder="http://127.0.0.1:4096"
-                  value={baseUrl()}
-                  onInput={(e) => setBaseUrl(e.currentTarget.value)}
-                />
-                <TextInput
-                  label="Directory (optional)"
-                  placeholder="/path/to/project"
-                  value={clientDirectory()}
-                  onInput={(e) => setClientDirectory(e.currentTarget.value)}
-                  hint="Use if your host runs multiple workspaces."
-                />
-
-                <Button
-                  onClick={async () => {
-                    setMode("client");
-                    setOnboardingStep("connecting");
-
-                    const ok = await connectToServer(
-                      baseUrl().trim(),
-                      clientDirectory().trim() ? clientDirectory().trim() : undefined,
-                    );
-
-                    if (!ok) {
-                      setOnboardingStep("client");
-                    }
-                  }}
-                  disabled={busy() || !baseUrl().trim()}
-                  class="w-full py-3 text-base"
-                >
-                  Connect
-                </Button>
-
-                <Button
-                  variant="ghost"
-                  onClick={() => {
-                    setMode(null);
-                    setOnboardingStep("mode");
-                  }}
-                  disabled={busy()}
-                  class="w-full"
-                >
-                  Back
-                </Button>
-
-                <Show when={error()}>
-                  <div class="rounded-2xl bg-red-950/40 px-5 py-4 text-sm text-red-200 border border-red-500/20">
-                    {error()}
-                  </div>
-                </Show>
-              </div>
-            </div>
-          </div>
-        </Match>
-
-        <Match when={true}>
-          <div class="min-h-screen flex flex-col items-center justify-center bg-black text-white p-6 relative">
-            <div class="absolute top-0 left-0 w-full h-96 bg-gradient-to-b from-zinc-900 to-transparent opacity-20 pointer-events-none" />
-
-            <div class="max-w-2xl w-full z-10 space-y-12">
-              <div class="text-center space-y-4">
-                <div class="flex items-center justify-center gap-3 mb-6">
-                  <div class="w-10 h-10 bg-white rounded-xl flex items-center justify-center">
-                    <Command class="text-black" />
-                  </div>
-                  <h1 class="text-3xl font-bold tracking-tight">OpenWork</h1>
-                </div>
-                <h2 class="text-xl text-zinc-400 font-light">
-                  How would you like to run OpenWork today?
-                </h2>
-                <div class="text-xs text-zinc-600">{headerStatus()}</div>
-              </div>
-
-              <div class="grid md:grid-cols-2 gap-4">
-                <button
-                  onClick={() => {
-                    setMode("host");
-                    setOnboardingStep("host");
-                  }}
-                  class="group relative bg-zinc-900 hover:bg-zinc-800 border border-zinc-800 hover:border-zinc-700 p-8 rounded-3xl text-left transition-all duration-300 hover:-translate-y-1"
-                >
-                  <div class="mb-6 w-12 h-12 rounded-2xl bg-gradient-to-br from-indigo-500/20 to-purple-500/20 flex items-center justify-center border border-indigo-500/20 group-hover:border-indigo-500/40 transition-colors">
-                    <HardDrive class="text-indigo-400" />
-                  </div>
-                  <h3 class="text-lg font-medium text-white mb-2">Host Mode</h3>
-                  <p class="text-zinc-500 text-sm leading-relaxed">
-                    Run the OpenCode engine locally on this machine.
-                  </p>
-                  <div class="mt-6 flex items-center gap-2 text-xs font-mono text-zinc-600">
-                    <div class="w-2 h-2 rounded-full bg-green-500" />
-                    127.0.0.1
-                  </div>
-                </button>
-
-                <button
-                  onClick={() => {
-                    setMode("client");
-                    setOnboardingStep("client");
-                  }}
-                  class="group relative bg-zinc-900 hover:bg-zinc-800 border border-zinc-800 hover:border-zinc-700 p-8 rounded-3xl text-left transition-all duration-300 hover:-translate-y-1"
-                >
-                  <div class="mb-6 w-12 h-12 rounded-2xl bg-gradient-to-br from-emerald-500/20 to-teal-500/20 flex items-center justify-center border border-emerald-500/20 group-hover:border-emerald-500/40 transition-colors">
-                    <Smartphone class="text-emerald-400" />
-                  </div>
-                  <h3 class="text-lg font-medium text-white mb-2">Client Mode</h3>
-                  <p class="text-zinc-500 text-sm leading-relaxed">
-                    Connect to an existing OpenCode instance.
-                  </p>
-                  <div class="mt-6 flex items-center gap-2 text-xs font-mono text-zinc-600">
-                    <div class="w-2 h-2 rounded-full bg-zinc-600" />
-                    Remote pairing
-                  </div>
-                </button>
-              </div>
-
-              <Show when={engine()?.running && engine()?.baseUrl}>
-                <div class="rounded-2xl bg-zinc-900/40 border border-zinc-800 p-5 flex items-center justify-between">
-                  <div>
-                    <div class="text-sm text-white font-medium">Engine already running</div>
-                    <div class="text-xs text-zinc-500 font-mono">{engine()?.baseUrl}</div>
-                  </div>
-                  <Button
-                    variant="secondary"
-                    onClick={async () => {
-                      setMode("host");
-                      setOnboardingStep("connecting");
-                      const ok = await connectToServer(
-                        engine()!.baseUrl!,
-                        engine()!.projectDir ?? undefined,
-                      );
-                      if (!ok) {
-                        setOnboardingStep("mode");
-                      }
-                    }}
-                    disabled={busy()}
-                  >
-                    Attach
-                  </Button>
-                </div>
-              </Show>
-            </div>
-          </div>
-        </Match>
-      </Switch>
-    );
-  }
-
-  function DashboardView() {
-    const title = createMemo(() => {
-      switch (tab()) {
-        case "sessions":
-          return "Sessions";
-        case "templates":
-          return "Templates";
-        case "skills":
-          return "Skills";
-        case "settings":
-          return "Settings";
-        default:
-          return "Dashboard";
-      }
-    });
-
-    const quickTemplates = createMemo(() => templates().slice(0, 3));
-
-    createEffect(() => {
-      if (tab() === "skills") {
-        refreshSkills().catch(() => undefined);
-      }
-    });
-
-    const navItem = (t: DashboardTab, label: string, icon: any) => {
-      const active = () => tab() === t;
-      return (
-        <button
-          class={`w-full flex items-center gap-3 px-3 py-2.5 rounded-xl text-sm font-medium transition-colors ${
-            active() ? "bg-zinc-900 text-white" : "text-zinc-500 hover:text-white hover:bg-zinc-900/50"
-          }`}
-          onClick={() => setTab(t)}
-        >
-          {icon}
-          {label}
-        </button>
-      );
-    };
-
-
-    const content = () => (
-      <Switch>
-        <Match when={tab() === "home"}>
-          <section>
-            <div class="bg-gradient-to-r from-zinc-900 to-zinc-800 rounded-3xl p-1 border border-zinc-800 shadow-2xl">
-              <div class="bg-zinc-950 rounded-[22px] p-6 md:p-8 flex flex-col md:flex-row items-center justify-between gap-6">
-                <div class="space-y-2 text-center md:text-left">
-                  <h2 class="text-2xl font-semibold text-white">What should we do today?</h2>
-                  <p class="text-zinc-400">
-                    Describe an outcome. OpenWork will run it and keep an audit trail.
-                  </p>
-                </div>
-                <Button
-                  onClick={createSessionAndOpen}
-                  disabled={newTaskDisabled()}
-                  title={newTaskDisabled() ? busyHint() ?? "Busy" : ""}
-                  class="w-full md:w-auto py-3 px-6 text-base"
-                >
-                  <Play size={18} />
-                  New Task
-                </Button>
-              </div>
-            </div>
-          </section>
-
-          <section>
-            <div class="flex items-center justify-between mb-4">
-              <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider">Quick Start Templates</h3>
-              <button
-                class="text-sm text-zinc-500 hover:text-white"
-                onClick={() => setTab("templates")}
-              >
-                View all
-              </button>
-            </div>
-
-            <Show
-              when={quickTemplates().length}
-              fallback={
-                <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-6 text-sm text-zinc-500">
-                  No templates yet. Save one from a session.
-                </div>
-              }
-            >
-              <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
-                <For each={quickTemplates()}>
-                  {(t) => (
-                    <button
-                      onClick={() => runTemplate(t)}
-                      class="group p-5 rounded-2xl bg-zinc-900/30 border border-zinc-800/50 hover:bg-zinc-900 hover:border-zinc-700 transition-all text-left"
-                    >
-                      <div class="w-10 h-10 rounded-full bg-zinc-800 flex items-center justify-center mb-4 group-hover:scale-110 transition-transform">
-                        <FileText size={20} class="text-indigo-400" />
-                      </div>
-                      <h4 class="font-medium text-white mb-1">{t.title}</h4>
-                      <p class="text-sm text-zinc-500">{t.description || "Run a saved workflow"}</p>
-                    </button>
-                  )}
-                </For>
-              </div>
-            </Show>
-          </section>
-
-          <section>
-            <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider mb-4">Recent Sessions</h3>
-
-            <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl overflow-hidden">
-              <For each={sessions().slice(0, 12)}>
-                {(s, idx) => (
-                  <button
-                    class={`w-full p-4 flex items-center justify-between hover:bg-zinc-800/50 transition-colors text-left ${
-                      idx() !== Math.min(sessions().length, 12) - 1 ? "border-b border-zinc-800/50" : ""
-                    }`}
-                    onClick={async () => {
-                      await selectSession(s.id);
-                      setView("session");
-                      setTab("sessions");
-                    }}
-                  >
-                    <div class="flex items-center gap-4">
-                      <div class="w-8 h-8 rounded-full bg-zinc-800 flex items-center justify-center text-xs text-zinc-500 font-mono">
-                        #{s.slug?.slice(0, 2) ?? ".."}
-                      </div>
-                      <div>
-                        <div class="font-medium text-sm text-zinc-200">{s.title}</div>
-                        <div class="text-xs text-zinc-500 flex items-center gap-2">
-                          <Clock size={10} /> {formatRelativeTime(s.time.updated)}
-                        </div>
-                      </div>
-                    </div>
-                    <div class="flex items-center gap-4">
-                      <span class="text-xs px-2 py-0.5 rounded-full border border-zinc-700/60 text-zinc-400 flex items-center gap-1.5">
-                        <span class="w-1.5 h-1.5 rounded-full bg-current" />
-                        {sessionStatusById()[s.id] ?? "idle"}
-                      </span>
-                      <ChevronRight size={16} class="text-zinc-600" />
-                    </div>
-                  </button>
-                )}
-              </For>
-
-              <Show when={!sessions().length}>
-                <div class="p-6 text-sm text-zinc-500">No sessions yet.</div>
-              </Show>
-            </div>
-          </section>
-        </Match>
-
-        <Match when={tab() === "sessions"}>
-          <section>
-            <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider mb-4">All Sessions</h3>
-
-            <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl overflow-hidden">
-              <For each={sessions()}>
-                {(s, idx) => (
-                  <button
-                    class={`w-full p-4 flex items-center justify-between hover:bg-zinc-800/50 transition-colors text-left ${
-                      idx() !== sessions().length - 1 ? "border-b border-zinc-800/50" : ""
-                    }`}
-                    onClick={async () => {
-                      await selectSession(s.id);
-                      setView("session");
-                    }}
-                  >
-                    <div class="flex items-center gap-4">
-                      <div class="w-8 h-8 rounded-full bg-zinc-800 flex items-center justify-center text-xs text-zinc-500 font-mono">
-                        #{s.slug?.slice(0, 2) ?? ".."}
-                      </div>
-                      <div>
-                        <div class="font-medium text-sm text-zinc-200">{s.title}</div>
-                        <div class="text-xs text-zinc-500 flex items-center gap-2">
-                          <Clock size={10} /> {formatRelativeTime(s.time.updated)}
-                        </div>
-                      </div>
-                    </div>
-                    <div class="flex items-center gap-4">
-                      <span class="text-xs px-2 py-0.5 rounded-full border border-zinc-700/60 text-zinc-400 flex items-center gap-1.5">
-                        <span class="w-1.5 h-1.5 rounded-full bg-current" />
-                        {sessionStatusById()[s.id] ?? "idle"}
-                      </span>
-                      <ChevronRight size={16} class="text-zinc-600" />
-                    </div>
-                  </button>
-                )}
-              </For>
-
-              <Show when={!sessions().length}>
-                <div class="p-6 text-sm text-zinc-500">No sessions yet.</div>
-              </Show>
-            </div>
-          </section>
-        </Match>
-
-        <Match when={tab() === "templates"}>
-          <section class="space-y-4">
-            <div class="flex items-center justify-between">
-              <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider">Templates</h3>
-              <Button
-                variant="secondary"
-                onClick={() => {
-                  setTemplateDraftTitle("");
-                  setTemplateDraftDescription("");
-                  setTemplateDraftPrompt("");
-                  setTemplateModalOpen(true);
-                }}
-                disabled={busy()}
-              >
-                <Plus size={16} />
-                New
-              </Button>
-            </div>
-
-            <Show
-              when={templates().length}
-              fallback={
-                <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-6 text-sm text-zinc-500">
-                  No templates yet. Save one from a session, or create one here.
-                </div>
-              }
-            >
-              <div class="space-y-3">
-                <For each={templates()}>
-                  {(t) => (
-                    <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-5 flex items-start justify-between gap-4">
-                      <div class="min-w-0">
-                        <div class="flex items-center gap-2">
-                          <FileText size={16} class="text-indigo-400" />
-                          <div class="font-medium text-white truncate">{t.title}</div>
-                        </div>
-                        <div class="mt-1 text-sm text-zinc-500">{t.description || ""}</div>
-                        <div class="mt-2 text-xs text-zinc-600 font-mono">{formatRelativeTime(t.createdAt)}</div>
-                      </div>
-                      <div class="shrink-0 flex gap-2">
-                        <Button variant="secondary" onClick={() => runTemplate(t)} disabled={busy()}>
-                          <Play size={16} />
-                          Run
-                        </Button>
-                        <Button variant="danger" onClick={() => deleteTemplate(t.id)} disabled={busy()}>
-                          <Trash2 size={16} />
-                        </Button>
-                      </div>
-                    </div>
-                  )}
-                </For>
-              </div>
-            </Show>
-          </section>
-        </Match>
-
-        <Match when={tab() === "skills"}>
-          <section class="space-y-6">
-            <div class="flex items-center justify-between">
-              <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider">Skills</h3>
-              <Button variant="secondary" onClick={() => refreshSkills()} disabled={busy()}>
-                Refresh
-              </Button>
-            </div>
-
-            <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-5 space-y-4">
-              <div class="flex items-center justify-between gap-3">
-                <div class="text-sm font-medium text-white">Install from OpenPackage</div>
-                <Show when={mode() !== "host"}>
-                  <div class="text-xs text-zinc-500">Host mode only</div>
-                </Show>
-              </div>
-              <div class="flex flex-col md:flex-row gap-2">
-                <input
-                  class="w-full bg-zinc-900/50 border border-zinc-800 rounded-xl px-3 py-2 text-sm text-white placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-zinc-600 focus:border-zinc-600 transition-all"
-                  placeholder="github:anthropics/claude-code"
-                  value={openPackageSource()}
-                  onInput={(e) => setOpenPackageSource(e.currentTarget.value)}
-                />
-                <Button
-                  onClick={installFromOpenPackage}
-                  disabled={busy() || mode() !== "host" || !isTauriRuntime()}
-                  class="md:w-auto"
-                >
-                  <Package size={16} />
-                  Install
-                </Button>
-              </div>
-              <div class="text-xs text-zinc-500">
-                Installs OpenPackage packages into the current workspace. Skills should land in `.opencode/skill`.
-              </div>
-
-              <div class="flex items-center justify-between gap-3 pt-2 border-t border-zinc-800/60">
-                <div class="text-sm font-medium text-white">Import local skill</div>
-                <Button
-                  variant="secondary"
-                  onClick={importLocalSkill}
-                  disabled={busy() || mode() !== "host" || !isTauriRuntime()}
-                >
-                  <Upload size={16} />
-                  Import
-                </Button>
-              </div>
-
-              <Show when={skillsStatus()}>
-                <div class="rounded-xl bg-black/20 border border-zinc-800 p-3 text-xs text-zinc-300 whitespace-pre-wrap break-words">
-                  {skillsStatus()}
-                </div>
-              </Show>
-            </div>
-
-            <div>
-              <div class="flex items-center justify-between mb-3">
-                <div class="text-sm font-medium text-white">Installed skills</div>
-                <div class="text-xs text-zinc-500">{skills().length}</div>
-              </div>
-
-              <Show
-                when={skills().length}
-                fallback={
-                  <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-6 text-sm text-zinc-500">
-                    No skills detected in `.opencode/skill`.
-                  </div>
-                }
-              >
-                <div class="grid gap-3">
-                  <For each={skills()}>
-                    {(s) => (
-                      <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-5">
-                        <div class="flex items-center gap-2">
-                          <Package size={16} class="text-zinc-400" />
-                          <div class="font-medium text-white">{s.name}</div>
-                        </div>
-                        <Show when={s.description}>
-                          <div class="mt-1 text-sm text-zinc-500">{s.description}</div>
-                        </Show>
-                        <div class="mt-2 text-xs text-zinc-600 font-mono">{s.path}</div>
-                      </div>
-                    )}
-                  </For>
-                </div>
-              </Show>
-            </div>
-          </section>
-        </Match>
-
-        <Match when={tab() === "settings"}>
-          <section class="space-y-6">
-            <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-5 space-y-3">
-              <div class="text-sm font-medium text-white">Connection</div>
-              <div class="text-xs text-zinc-500">{headerStatus()}</div>
-              <div class="text-xs text-zinc-600 font-mono">{baseUrl()}</div>
-              <div class="pt-2 flex flex-wrap gap-2">
-                <Button variant="secondary" onClick={() => setDeveloperMode((v) => !v)}>
-                  <Shield size={16} />
-                  {developerMode() ? "Developer On" : "Developer Off"}
-                </Button>
-                <Show when={mode() === "host"}>
-                  <Button variant="danger" onClick={stopHost} disabled={busy()}>
-                    Stop engine
-                  </Button>
-                </Show>
-                <Show when={mode() === "client"}>
-                  <Button variant="outline" onClick={stopHost} disabled={busy()}>
-                    Disconnect
-                  </Button>
-                </Show>
-              </div>
-            </div>
-
-            <Show when={developerMode()}>
-              <section>
-                <h3 class="text-sm font-medium text-zinc-400 uppercase tracking-wider mb-4">Developer</h3>
-
-                <div class="grid md:grid-cols-2 gap-4">
-                  <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-4">
-                    <div class="text-xs text-zinc-500 mb-2">Pending permissions</div>
-                    <pre class="text-xs text-zinc-200 whitespace-pre-wrap break-words max-h-64 overflow-auto">
-                      {safeStringify(pendingPermissions())}
-                    </pre>
-                  </div>
-                  <div class="bg-zinc-900/30 border border-zinc-800/50 rounded-2xl p-4">
-                    <div class="text-xs text-zinc-500 mb-2">Recent events</div>
-                    <pre class="text-xs text-zinc-200 whitespace-pre-wrap break-words max-h-64 overflow-auto">
-                      {safeStringify(events())}
-                    </pre>
-                  </div>
-                </div>
-              </section>
-            </Show>
-          </section>
-        </Match>
-      </Switch>
-    );
-
-    return (
-      <div class="flex h-screen bg-zinc-950 text-white overflow-hidden">
-        <aside class="w-64 border-r border-zinc-800 p-6 hidden md:flex flex-col justify-between bg-zinc-950">
-          <div>
-            <div class="flex items-center gap-3 mb-10 px-2">
-              <div class="w-8 h-8 bg-white rounded-lg flex items-center justify-center">
-                <Command size={18} class="text-black" />
-              </div>
-              <span class="font-bold text-lg tracking-tight">OpenWork</span>
-            </div>
-
-            <nav class="space-y-1">
-              {navItem("home", "Dashboard", <Command size={18} />)}
-              {navItem("sessions", "Sessions", <Play size={18} />)}
-              {navItem("templates", "Templates", <FileText size={18} />)}
-              {navItem("skills", "Skills", <Package size={18} />)}
-              {navItem("settings", "Settings", <Settings size={18} />)}
-            </nav>
-          </div>
-
-          <div class="space-y-4">
-            <div class="px-3 py-3 rounded-xl bg-zinc-900/50 border border-zinc-800">
-              <div class="flex items-center gap-2 text-xs font-medium text-zinc-400 mb-2">
-                {mode() === "host" ? <Cpu size={12} /> : <Smartphone size={12} />}
-                {mode() === "host" ? "Local Engine" : "Client Mode"}
-              </div>
-              <div class="flex items-center gap-2">
-                <div
-                  class={`w-2 h-2 rounded-full ${
-                    client() ? "bg-emerald-500 animate-pulse" : "bg-zinc-600"
-                  }`}
-                />
-                <span
-                  class={`text-sm font-mono ${client() ? "text-emerald-500" : "text-zinc-500"}`}
-                >
-                  {client() ? "Connected" : "Disconnected"}
-                </span>
-              </div>
-              <div class="mt-2 text-[11px] text-zinc-600 font-mono truncate">{baseUrl()}</div>
-            </div>
-
-            <Show when={mode() === "host"}>
-              <Button variant="danger" onClick={stopHost} disabled={busy()} class="w-full">
-                Stop & Disconnect
-              </Button>
-            </Show>
-
-            <Show when={mode() === "client"}>
-              <Button variant="outline" onClick={stopHost} disabled={busy()} class="w-full">
-                Disconnect
-              </Button>
-            </Show>
-          </div>
-        </aside>
-
-        <main class="flex-1 overflow-y-auto relative pb-24 md:pb-0">
-          <header class="h-16 flex items-center justify-between px-6 md:px-10 border-b border-zinc-800 sticky top-0 bg-zinc-950/80 backdrop-blur-md z-10">
-            <div class="flex items-center gap-3">
-              <div class="md:hidden">
-                <Menu class="text-zinc-400" />
-              </div>
-              <h1 class="text-lg font-medium">{title()}</h1>
-              <span class="text-xs text-zinc-600">{headerStatus()}</span>
-              <Show when={busyHint()}>
-                <span class="text-xs text-zinc-500">· {busyHint()}</span>
-              </Show>
-            </div>
-            <div class="flex items-center gap-2">
-              <Show when={tab() === "home" || tab() === "sessions"}>
-                <Button onClick={createSessionAndOpen} disabled={newTaskDisabled()} title={newTaskDisabled() ? busyHint() ?? "Busy" : ""}>
-                  <Play size={16} />
-                  New Task
-                </Button>
-              </Show>
-              <Show when={tab() === "templates"}>
-                <Button
-                  variant="secondary"
-                  onClick={() => {
-                    setTemplateDraftTitle("");
-                    setTemplateDraftDescription("");
-                    setTemplateDraftPrompt("");
-                    setTemplateModalOpen(true);
-                  }}
-                  disabled={busy()}
-                >
-                  <Plus size={16} />
-                  New
-                </Button>
-              </Show>
-              <Button variant="ghost" onClick={() => setDeveloperMode((v) => !v)}>
-                <Shield size={16} />
-              </Button>
-            </div>
-          </header>
-
-          <div class="p-6 md:p-10 max-w-5xl mx-auto space-y-10">{content()}</div>
-
-          <Show when={error()}>
-            <div class="mx-auto max-w-5xl px-6 md:px-10 pb-24 md:pb-10">
-              <div class="rounded-2xl bg-red-950/40 px-5 py-4 text-sm text-red-200 border border-red-500/20">
-                {error()}
-              </div>
-            </div>
-          </Show>
-
-          <nav class="md:hidden fixed bottom-0 left-0 right-0 border-t border-zinc-800 bg-zinc-950/90 backdrop-blur-md">
-            <div class="mx-auto max-w-5xl px-4 py-3 grid grid-cols-5 gap-2">
-              <button
-                class={`flex flex-col items-center gap-1 text-xs ${
-                  tab() === "home" ? "text-white" : "text-zinc-500"
-                }`}
-                onClick={() => setTab("home")}
-              >
-                <Command size={18} />
-                Home
-              </button>
-              <button
-                class={`flex flex-col items-center gap-1 text-xs ${
-                  tab() === "sessions" ? "text-white" : "text-zinc-500"
-                }`}
-                onClick={() => setTab("sessions")}
-              >
-                <Play size={18} />
-                Runs
-              </button>
-              <button
-                class={`flex flex-col items-center gap-1 text-xs ${
-                  tab() === "templates" ? "text-white" : "text-zinc-500"
-                }`}
-                onClick={() => setTab("templates")}
-              >
-                <FileText size={18} />
-                Templates
-              </button>
-              <button
-                class={`flex flex-col items-center gap-1 text-xs ${
-                  tab() === "skills" ? "text-white" : "text-zinc-500"
-                }`}
-                onClick={() => setTab("skills")}
-              >
-                <Package size={18} />
-                Skills
-              </button>
-              <button
-                class={`flex flex-col items-center gap-1 text-xs ${
-                  tab() === "settings" ? "text-white" : "text-zinc-500"
-                }`}
-                onClick={() => setTab("settings")}
-              >
-                <Settings size={18} />
-                Settings
-              </button>
-            </div>
-          </nav>
-        </main>
-      </div>
-    );
-  }
-
-  function SessionView() {
-    let messagesEndEl: HTMLDivElement | undefined;
-
-    createEffect(() => {
-      messages();
-      todos();
-      messagesEndEl?.scrollIntoView({ behavior: "smooth" });
-    });
-
-    return (
-      <Show
-        when={selectedSessionId()}
-        fallback={
-          <div class="min-h-screen flex items-center justify-center bg-zinc-950 text-white p-6">
-            <div class="text-center space-y-4">
-              <div class="text-lg font-medium">No session selected</div>
-              <Button
-                onClick={() => {
-                  setView("dashboard");
-                  setTab("sessions");
-                }}
-              >
-                Back to dashboard
-              </Button>
-            </div>
-          </div>
-        }
-      >
-        <div class="h-screen flex flex-col bg-zinc-950 text-white relative">
-          <header class="h-16 border-b border-zinc-800 flex items-center justify-between px-4 bg-zinc-950/80 backdrop-blur-md z-10 sticky top-0">
-            <div class="flex items-center gap-4">
-              <Button
-                variant="ghost"
-                class="!p-2 rounded-full"
-                onClick={() => {
-                  setView("dashboard");
-                  setTab("sessions");
-                }}
-              >
-                <ArrowRight class="rotate-180 w-5 h-5" />
-              </Button>
-              <div>
-                <h2 class="font-semibold text-sm">{selectedSession()?.title ?? "Session"}</h2>
-                <div class="flex items-center gap-2 text-xs text-zinc-400">
-                  <span
-                    class={`w-2 h-2 rounded-full ${
-                      selectedSessionStatus() === "running"
-                        ? "bg-blue-500 animate-pulse"
-                        : selectedSessionStatus() === "retry"
-                          ? "bg-amber-500"
-                          : selectedSessionStatus() === "idle"
-                            ? "bg-emerald-500"
-                            : "bg-zinc-600"
-                    }`}
-                  />
-                  {selectedSessionStatus()}
-                </div>
-              </div>
-            </div>
-
-            <div class="flex gap-2">
-              <Button variant="ghost" class="text-xs" onClick={openTemplateModal} disabled={busy()}>
-                <FileText size={14} />
-              </Button>
-              <Button variant="ghost" class="text-xs" onClick={() => setDeveloperMode((v) => !v)}>
-                <Shield size={14} />
-              </Button>
-            </div>
-          </header>
-
-          <div class="flex-1 flex overflow-hidden">
-            <div class="flex-1 overflow-y-auto p-4 md:p-8 scroll-smooth">
-              <div class="max-w-2xl mx-auto space-y-6 pb-32">
-                <Show when={messages().length === 0}>
-                  <div class="text-center py-20 space-y-4">
-                    <div class="w-16 h-16 bg-zinc-900 rounded-3xl mx-auto flex items-center justify-center border border-zinc-800">
-                      <Zap class="text-zinc-600" />
-                    </div>
-                    <h3 class="text-xl font-medium">Ready to work</h3>
-                    <p class="text-zinc-500 text-sm max-w-xs mx-auto">
-                      Describe a task. I’ll show progress and ask for permissions when needed.
-                    </p>
-                  </div>
-                </Show>
-
-                <For each={messages()}>
-                  {(msg) => {
-                    const renderableParts = () =>
-                      msg.parts.filter((p) => {
-                        if (p.type === "reasoning") {
-                          return developerMode();
-                        }
-
-                        if (p.type === "step-start" || p.type === "step-finish") {
-                          // Too noisy for normal users.
-                          return developerMode();
-                        }
-
-                        if (p.type === "text" || p.type === "tool") {
-                          return true;
-                        }
-
-                        return developerMode();
-                      });
-
-                    return (
-                      <Show when={renderableParts().length > 0}>
-                        <div class={`flex ${msg.info.role === "user" ? "justify-end" : "justify-start"}`}>
-                          <div
-                            class={`max-w-[85%] p-4 rounded-2xl text-sm leading-relaxed ${
-                              msg.info.role === "user"
-                                ? "bg-white text-black rounded-tr-sm shadow-xl shadow-white/5"
-                                : "bg-zinc-900 border border-zinc-800 text-zinc-200 rounded-tl-sm"
-                            }`}
-                          >
-                            <For each={renderableParts()}>
-                              {(p, idx) => (
-                                <div class={idx() === renderableParts().length - 1 ? "" : "mb-2"}>
-                                  <PartView
-                                    part={p}
-                                    developerMode={developerMode()}
-                                    tone={msg.info.role === "user" ? "dark" : "light"}
-                                  />
-                                </div>
-                              )}
-                            </For>
-                          </div>
-                        </div>
-                      </Show>
-                    );
-                  }}
-                </For>
-
-                <div ref={(el) => (messagesEndEl = el)} />
-              </div>
-            </div>
-
-            <div class="hidden lg:flex w-80 border-l border-zinc-800 bg-zinc-950 flex-col">
-              <div class="p-4 border-b border-zinc-800 font-medium text-sm text-zinc-400 flex items-center justify-between">
-                <span>Execution Plan</span>
-                <span class="text-xs bg-zinc-800 px-2 py-0.5 rounded text-zinc-500">
-                  {todos().filter((t) => t.status === "completed").length}/{todos().length}
-                </span>
-              </div>
-              <div class="p-4 space-y-4 overflow-y-auto flex-1">
-                <Show
-                  when={todos().length}
-                  fallback={
-                    <div class="text-zinc-600 text-sm text-center py-10 italic">
-                      Plan will appear here...
-                    </div>
-                  }
-                >
-                  <For each={todos()}>
-                    {(t, idx) => (
-                      <div class="relative pl-6 pb-6 last:pb-0">
-                        <Show when={idx() !== todos().length - 1}>
-                          <div
-                            class={`absolute left-[9px] top-6 bottom-0 w-px ${
-                              t.status === "completed" ? "bg-emerald-500/20" : "bg-zinc-800"
-                            }`}
-                          />
-                        </Show>
-
-                        <div
-                          class={`absolute left-0 top-1 w-5 h-5 rounded-full border flex items-center justify-center bg-zinc-950 z-10 ${
-                            t.status === "completed"
-                              ? "border-emerald-500 text-emerald-500"
-                              : t.status === "in_progress"
-                                ? "border-blue-500 text-blue-500"
-                                : t.status === "cancelled"
-                                  ? "border-zinc-600 text-zinc-600"
-                                  : "border-zinc-700 text-zinc-700"
-                          }`}
-                        >
-                          <Show
-                            when={t.status === "completed"}
-                            fallback={
-                              <Show
-                                when={t.status === "in_progress"}
-                                fallback={
-                                  <Show
-                                    when={t.status === "cancelled"}
-                                    fallback={<Circle size={10} />}
-                                  >
-                                    <X size={12} />
-                                  </Show>
-                                }
-                              >
-                                <div class="w-2 h-2 rounded-full bg-current animate-pulse" />
-                              </Show>
-                            }
-                          >
-                            <CheckCircle2 size={12} />
-                          </Show>
-                        </div>
-
-                        <div
-                          class={`text-sm ${
-                            t.status === "completed"
-                              ? "text-zinc-400"
-                              : t.status === "in_progress"
-                                ? "text-blue-100"
-                                : "text-zinc-500"
-                          }`}
-                        >
-                          {t.content}
-                        </div>
-                      </div>
-                    )}
-                  </For>
-                </Show>
-              </div>
-            </div>
-          </div>
-
-          <div class="p-4 border-t border-zinc-800 bg-zinc-950 sticky bottom-0 z-20">
-            <div class="max-w-2xl mx-auto relative">
-              <input
-                type="text"
-                disabled={busy()}
-                value={prompt()}
-                onInput={(e) => setPrompt(e.currentTarget.value)}
-                onKeyDown={(e) => {
-                  if (e.key === "Enter") {
-                    sendPrompt().catch(() => undefined);
-                  }
-                }}
-                placeholder={busy() ? "Working..." : "Ask OpenWork to do something..."}
-                class="w-full bg-zinc-900 border border-zinc-800 rounded-2xl py-4 pl-5 pr-14 text-white placeholder-zinc-500 focus:outline-none focus:ring-1 focus:ring-zinc-600 focus:border-zinc-600 transition-all disabled:opacity-50"
-              />
-              <button
-                disabled={!prompt().trim() || busy()}
-                onClick={() => sendPrompt().catch(() => undefined)}
-                class="absolute right-2 top-2 p-2 bg-white text-black rounded-xl hover:scale-105 active:scale-95 transition-all disabled:opacity-0 disabled:scale-75"
-                title="Run"
-              >
-                <ArrowRight size={20} />
-              </button>
-            </div>
-          </div>
-
-          <Show when={activePermission()}>
-            <div class="absolute inset-0 z-50 bg-black/60 backdrop-blur-sm flex items-center justify-center p-4">
-              <div class="bg-zinc-900 border border-amber-500/30 w-full max-w-md rounded-2xl shadow-2xl overflow-hidden">
-                <div class="p-6">
-                  <div class="flex items-start gap-4 mb-4">
-                    <div class="p-3 bg-amber-500/10 rounded-full text-amber-500">
-                      <Shield size={24} />
-                    </div>
-                    <div>
-                      <h3 class="text-lg font-semibold text-white">Permission Required</h3>
-                      <p class="text-sm text-zinc-400 mt-1">
-                        OpenCode is requesting permission to continue.
-                      </p>
-                    </div>
-                  </div>
-
-                  <div class="bg-zinc-950/50 rounded-xl p-4 border border-zinc-800 mb-6">
-                    <div class="text-xs text-zinc-500 uppercase tracking-wider mb-2 font-semibold">
-                      Permission
-                    </div>
-                    <div class="text-sm text-zinc-200 font-mono">{activePermission()!.permission}</div>
-
-                    <div class="text-xs text-zinc-500 uppercase tracking-wider mt-4 mb-2 font-semibold">
-                      Scope
-                    </div>
-                    <div class="flex items-center gap-2 text-sm font-mono text-amber-200 bg-amber-950/30 px-2 py-1 rounded border border-amber-500/20">
-                      <HardDrive size={12} />
-                      {activePermission()!.patterns.join(", ")}
-                    </div>
-
-                    <Show when={Object.keys(activePermission()!.metadata ?? {}).length > 0}>
-                      <details class="mt-4 rounded-lg bg-black/20 p-2">
-                        <summary class="cursor-pointer text-xs text-zinc-400">Details</summary>
-                        <pre class="mt-2 whitespace-pre-wrap break-words text-xs text-zinc-200">
-                          {safeStringify(activePermission()!.metadata)}
-                        </pre>
-                      </details>
-                    </Show>
-                  </div>
-
-                  <div class="grid grid-cols-2 gap-3">
-                    <Button
-                      variant="outline"
-                      class="w-full border-red-500/20 text-red-400 hover:bg-red-950/30"
-                      onClick={() => respondPermission(activePermission()!.id, "reject")}
-                      disabled={busy()}
-                    >
-                      Deny
-                    </Button>
-                    <div class="grid grid-cols-2 gap-2">
-                      <Button
-                        variant="secondary"
-                        class="text-xs"
-                        onClick={() => respondPermission(activePermission()!.id, "once")}
-                        disabled={busy()}
-                      >
-                        Once
-                      </Button>
-                      <Button
-                        variant="primary"
-                        class="text-xs font-bold bg-amber-500 hover:bg-amber-400 text-black border-none shadow-amber-500/20"
-                        onClick={() => respondPermission(activePermission()!.id, "always")}
-                        disabled={busy()}
-                      >
-                        Allow
-                      </Button>
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </div>
-          </Show>
-        </div>
-      </Show>
-    );
-  }
-
-  return (
-    <>
-      <Show when={client()} fallback={<OnboardingView />}>
-        <Switch>
-          <Match when={view() === "dashboard"}>
-            <DashboardView />
-          </Match>
-          <Match when={view() === "session"}>
-            <SessionView />
-          </Match>
-          <Match when={true}>
-            <DashboardView />
-          </Match>
-        </Switch>
-      </Show>
-
-      <Show when={templateModalOpen()}>
-        <div class="fixed inset-0 z-50 bg-black/60 backdrop-blur-sm flex items-center justify-center p-4">
-          <div class="bg-zinc-900 border border-zinc-800/70 w-full max-w-xl rounded-2xl shadow-2xl overflow-hidden">
-            <div class="p-6">
-              <div class="flex items-start justify-between gap-4">
-                <div>
-                  <h3 class="text-lg font-semibold text-white">Save Template</h3>
-                  <p class="text-sm text-zinc-400 mt-1">Reuse a workflow with one tap.</p>
-                </div>
-                <Button
-                  variant="ghost"
-                  class="!p-2 rounded-full"
-                  onClick={() => setTemplateModalOpen(false)}
-                >
-                  <X size={16} />
-                </Button>
-              </div>
-
-              <div class="mt-6 space-y-4">
-                <TextInput
-                  label="Title"
-                  value={templateDraftTitle()}
-                  onInput={(e) => setTemplateDraftTitle(e.currentTarget.value)}
-                  placeholder="e.g. Daily standup summary"
-                />
-
-                <TextInput
-                  label="Description (optional)"
-                  value={templateDraftDescription()}
-                  onInput={(e) => setTemplateDraftDescription(e.currentTarget.value)}
-                  placeholder="What does this template do?"
-                />
-
-                <label class="block">
-                  <div class="mb-1 text-xs font-medium text-neutral-300">Prompt</div>
-                  <textarea
-                    class="w-full min-h-40 rounded-xl bg-neutral-900/60 px-3 py-2 text-sm text-neutral-100 placeholder:text-neutral-500 shadow-[0_0_0_1px_rgba(255,255,255,0.08)] focus:outline-none focus:ring-2 focus:ring-white/20"
-                    value={templateDraftPrompt()}
-                    onInput={(e) => setTemplateDraftPrompt(e.currentTarget.value)}
-                    placeholder="Write the instructions you want to reuse…"
-                  />
-                  <div class="mt-1 text-xs text-neutral-500">This becomes the first user message.</div>
-                </label>
-              </div>
-
-              <div class="mt-6 flex justify-end gap-2">
-                <Button variant="outline" onClick={() => setTemplateModalOpen(false)}>
-                  Cancel
-                </Button>
-                <Button onClick={saveTemplate}>Save</Button>
-              </div>
-            </div>
-          </div>
-        </div>
-      </Show>
-    </>
-  );
-}
diff --git a/src/components/Button.tsx b/src/components/Button.tsx
deleted file mode 100644
index 194cdca6f1..0000000000
--- a/src/components/Button.tsx
+++ /dev/null
@@ -1,29 +0,0 @@
-import type { JSX } from "solid-js";
-
-type ButtonProps = JSX.ButtonHTMLAttributes<HTMLButtonElement> & {
-  variant?: "primary" | "secondary" | "ghost" | "outline" | "danger";
-};
-
-export default function Button(props: ButtonProps) {
-  const variant = () => props.variant ?? "primary";
-
-  const base =
-    "inline-flex items-center justify-center gap-2 rounded-xl px-4 py-2.5 text-sm font-medium transition-all duration-200 active:scale-95 focus:outline-none focus:ring-2 focus:ring-white/15 disabled:opacity-50 disabled:cursor-not-allowed";
-
-  const variants: Record<NonNullable<ButtonProps["variant"]>, string> = {
-    primary: "bg-white text-black hover:bg-zinc-100 shadow-lg shadow-white/5",
-    secondary: "bg-zinc-800 text-zinc-100 hover:bg-zinc-700 border border-zinc-700/50",
-    ghost: "bg-transparent text-zinc-400 hover:text-white hover:bg-zinc-800/50",
-    outline: "border border-zinc-700 text-zinc-300 hover:border-zinc-500 bg-transparent",
-    danger: "bg-red-500/10 text-red-400 hover:bg-red-500/20 border border-red-500/20",
-  };
-
-  const { variant: _variant, class: className, ...rest } = props;
-
-  return (
-    <button
-      {...rest}
-      class={`${base} ${variants[variant()]} ${className ?? ""}`.trim()}
-    />
-  );
-}
diff --git a/src/components/Card.tsx b/src/components/Card.tsx
deleted file mode 100644
index 44802228c8..0000000000
--- a/src/components/Card.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import type { JSX } from "solid-js";
-
-type CardProps = {
-  title?: string;
-  children: JSX.Element;
-  actions?: JSX.Element;
-};
-
-export default function Card(props: CardProps) {
-  return (
-    <div class="rounded-2xl bg-zinc-900/50 border border-zinc-800/60 backdrop-blur-xl shadow-[0_20px_80px_rgba(0,0,0,0.55)]">
-      {props.title || props.actions ? (
-        <div class="flex items-center justify-between gap-3 border-b border-zinc-800/70 px-5 py-4">
-          <div class="text-sm font-semibold text-white">{props.title}</div>
-          <div>{props.actions}</div>
-        </div>
-      ) : null}
-      <div class="px-5 py-4">{props.children}</div>
-    </div>
-  );
-}
diff --git a/src/components/PartView.tsx b/src/components/PartView.tsx
deleted file mode 100644
index 11a2568156..0000000000
--- a/src/components/PartView.tsx
+++ /dev/null
@@ -1,166 +0,0 @@
-import { Match, Show, Switch } from "solid-js";
-
-import type { Part } from "@opencode-ai/sdk/v2/client";
-
-type Props = {
-  part: Part;
-  developerMode?: boolean;
-  tone?: "light" | "dark";
-};
-
-function safeStringify(value: unknown) {
-  const seen = new WeakSet<object>();
-
-  try {
-    return JSON.stringify(
-      value,
-      (key, val) => {
-        if (val && typeof val === "object") {
-          if (seen.has(val as object)) {
-            return "<circular>";
-          }
-          seen.add(val as object);
-        }
-
-        const lowerKey = key.toLowerCase();
-        if (
-          lowerKey === "reasoningencryptedcontent" ||
-          lowerKey.includes("api_key") ||
-          lowerKey.includes("apikey") ||
-          lowerKey.includes("access_token") ||
-          lowerKey.includes("refresh_token") ||
-          lowerKey.includes("token") ||
-          lowerKey.includes("authorization") ||
-          lowerKey.includes("cookie") ||
-          lowerKey.includes("secret")
-        ) {
-          return "[redacted]";
-        }
-
-        return val;
-      },
-      2,
-    );
-  } catch {
-    return "<unserializable>";
-  }
-}
-
-function clampText(text: string, max = 800) {
-  if (text.length <= max) return text;
-  return `${text.slice(0, max)}\n\n… (truncated)`;
-}
-
-export default function PartView(props: Props) {
-  const p = () => props.part;
-  const developerMode = () => props.developerMode ?? false;
-  const tone = () => props.tone ?? "light";
-
-  const textClass = () => (tone() === "dark" ? "text-black" : "text-neutral-100");
-  const subtleTextClass = () => (tone() === "dark" ? "text-black/70" : "text-neutral-400");
-  const panelBgClass = () => (tone() === "dark" ? "bg-black/10" : "bg-black/30");
-
-  return (
-    <Switch>
-      <Match when={p().type === "text"}>
-        <div class={`whitespace-pre-wrap break-words ${textClass()}`.trim()}>{(p() as any).text}</div>
-      </Match>
-
-      <Match when={p().type === "reasoning"}>
-        <Show when={developerMode() && typeof (p() as any).text === "string" && (p() as any).text.trim()}>
-          <details class={`rounded-lg ${panelBgClass()} p-2`.trim()}>
-            <summary class={`cursor-pointer text-xs ${subtleTextClass()}`.trim()}>Reasoning</summary>
-            <pre
-              class={`mt-2 whitespace-pre-wrap break-words text-xs ${
-                tone() === "dark" ? "text-black" : "text-neutral-200"
-              }`.trim()}
-            >
-              {clampText(String((p() as any).text), 2000)}
-            </pre>
-          </details>
-        </Show>
-      </Match>
-
-      <Match when={p().type === "tool"}>
-        <div class="grid gap-2">
-          <div class="flex items-center justify-between gap-3">
-            <div
-              class={`text-xs font-medium ${tone() === "dark" ? "text-black" : "text-neutral-200"}`.trim()}
-            >
-              Tool · {String((p() as any).tool)}
-            </div>
-            <div
-              class={`rounded-full px-2 py-0.5 text-[11px] font-medium ${
-                (p() as any).state?.status === "completed"
-                  ? "bg-emerald-500/15 text-emerald-200"
-                  : (p() as any).state?.status === "running"
-                    ? "bg-blue-500/15 text-blue-200"
-                    : (p() as any).state?.status === "error"
-                      ? "bg-red-500/15 text-red-200"
-                      : "bg-white/10 text-neutral-200"
-              }`}
-            >
-              {String((p() as any).state?.status ?? "unknown")}
-            </div>
-          </div>
-
-          <Show when={(p() as any).state?.title}>
-            <div class={`text-xs ${subtleTextClass()}`.trim()}>{String((p() as any).state.title)}</div>
-          </Show>
-
-          <Show when={(p() as any).state?.output && typeof (p() as any).state.output === "string"}>
-            <pre
-              class={`whitespace-pre-wrap break-words rounded-lg ${panelBgClass()} p-2 text-xs ${
-                tone() === "dark" ? "text-black" : "text-neutral-200"
-              }`.trim()}
-            >
-              {clampText(String((p() as any).state.output))}
-            </pre>
-          </Show>
-
-          <Show when={(p() as any).state?.error && typeof (p() as any).state.error === "string"}>
-            <div class="rounded-lg bg-red-950/40 p-2 text-xs text-red-200">
-              {String((p() as any).state.error)}
-            </div>
-          </Show>
-
-          <Show when={developerMode() && (p() as any).state?.input != null}>
-            <details class={`rounded-lg ${panelBgClass()} p-2`.trim()}>
-              <summary class={`cursor-pointer text-xs ${subtleTextClass()}`.trim()}>Input</summary>
-              <pre
-                class={`mt-2 whitespace-pre-wrap break-words text-xs ${
-                  tone() === "dark" ? "text-black" : "text-neutral-200"
-                }`.trim()}
-              >
-                {safeStringify((p() as any).state.input)}
-              </pre>
-            </details>
-          </Show>
-        </div>
-      </Match>
-
-      <Match when={p().type === "step-start" || p().type === "step-finish"}>
-        <div class={`text-xs ${subtleTextClass()}`.trim()}>
-          {p().type === "step-start" ? "Step started" : "Step finished"}
-          <Show when={(p() as any).reason}>
-            <span class={tone() === "dark" ? "text-black/80" : "text-neutral-300"}>
-              {" "}· {String((p() as any).reason)}
-            </span>
-          </Show>
-        </div>
-      </Match>
-
-      <Match when={true}>
-        <Show when={developerMode()}>
-          <pre
-            class={`whitespace-pre-wrap break-words text-xs ${
-              tone() === "dark" ? "text-black" : "text-neutral-200"
-            }`.trim()}
-          >
-            {safeStringify(p())}
-          </pre>
-        </Show>
-      </Match>
-    </Switch>
-  );
-}
diff --git a/src/components/TextInput.tsx b/src/components/TextInput.tsx
deleted file mode 100644
index 52aefca1bf..0000000000
--- a/src/components/TextInput.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import type { JSX } from "solid-js";
-
-type TextInputProps = JSX.InputHTMLAttributes<HTMLInputElement> & {
-  label?: string;
-  hint?: string;
-};
-
-export default function TextInput(props: TextInputProps) {
-  const { label, hint, class: className, ...rest } = props;
-
-  return (
-    <label class="block">
-      {label ? (
-        <div class="mb-1 text-xs font-medium text-neutral-300">{label}</div>
-      ) : null}
-      <input
-        {...rest}
-        class={`w-full rounded-xl bg-neutral-900/60 px-3 py-2 text-sm text-neutral-100 placeholder:text-neutral-500 shadow-[0_0_0_1px_rgba(255,255,255,0.08)] focus:outline-none focus:ring-2 focus:ring-white/20 ${
-          className ?? ""
-        }`.trim()}
-      />
-      {hint ? <div class="mt-1 text-xs text-neutral-500">{hint}</div> : null}
-    </label>
-  );
-}
diff --git a/src/index.tsx b/src/index.tsx
deleted file mode 100644
index 8116dab0fb..0000000000
--- a/src/index.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-/* @refresh reload */
-import { render } from "solid-js/web";
-
-import "./styles.css";
-import App from "./App";
-
-const root = document.getElementById("root");
-
-if (!root) {
-  throw new Error("Root element not found");
-}
-
-render(() => <App />, root);
diff --git a/src/lib/opencode.ts b/src/lib/opencode.ts
deleted file mode 100644
index 770761d841..0000000000
--- a/src/lib/opencode.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-import { createOpencodeClient } from "@opencode-ai/sdk/v2/client";
-
-type FieldsResult<T> =
-  | ({ data: T; error?: undefined } & { request: Request; response: Response })
-  | ({ data?: undefined; error: unknown } & { request: Request; response: Response });
-
-export function unwrap<T>(result: FieldsResult<T>): NonNullable<T> {
-  if (result.data !== undefined) {
-    return result.data as NonNullable<T>;
-  }
-  const message =
-    result.error instanceof Error
-      ? result.error.message
-      : typeof result.error === "string"
-        ? result.error
-        : JSON.stringify(result.error);
-  throw new Error(message || "Unknown error");
-}
-
-export function createClient(baseUrl: string, directory?: string) {
-  return createOpencodeClient({
-    baseUrl,
-    directory,
-  });
-}
-
-export async function waitForHealthy(
-  client: ReturnType<typeof createClient>,
-  options?: { timeoutMs?: number; pollMs?: number },
-) {
-  const timeoutMs = options?.timeoutMs ?? 10_000;
-  const pollMs = options?.pollMs ?? 250;
-
-  const start = Date.now();
-  let lastError: string | null = null;
-
-  while (Date.now() - start < timeoutMs) {
-    try {
-      const health = unwrap(await client.global.health());
-      if (health.healthy) {
-        return health;
-      }
-      lastError = "Server reported unhealthy";
-    } catch (error) {
-      lastError = error instanceof Error ? error.message : "Unknown error";
-    }
-    await new Promise((resolve) => setTimeout(resolve, pollMs));
-  }
-
-  throw new Error(lastError ?? "Timed out waiting for server health");
-}
diff --git a/src/lib/tauri.ts b/src/lib/tauri.ts
deleted file mode 100644
index df19777f3f..0000000000
--- a/src/lib/tauri.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { invoke } from "@tauri-apps/api/core";
-
-export type EngineInfo = {
-  running: boolean;
-  baseUrl: string | null;
-  projectDir: string | null;
-  hostname: string | null;
-  port: number | null;
-  pid: number | null;
-};
-
-export async function engineStart(projectDir: string): Promise<EngineInfo> {
-  return invoke<EngineInfo>("engine_start", { projectDir });
-}
-
-export async function engineStop(): Promise<EngineInfo> {
-  return invoke<EngineInfo>("engine_stop");
-}
-
-export async function engineInfo(): Promise<EngineInfo> {
-  return invoke<EngineInfo>("engine_info");
-}
-
-export async function pickDirectory(options?: {
-  title?: string;
-  defaultPath?: string;
-  multiple?: boolean;
-}): Promise<string | string[] | null> {
-  const { open } = await import("@tauri-apps/plugin-dialog");
-  return open({
-    title: options?.title,
-    defaultPath: options?.defaultPath,
-    directory: true,
-    multiple: options?.multiple,
-  });
-}
-
-export type ExecResult = {
-  ok: boolean;
-  status: number;
-  stdout: string;
-  stderr: string;
-};
-
-export async function opkgInstall(projectDir: string, pkg: string): Promise<ExecResult> {
-  return invoke<ExecResult>("opkg_install", { projectDir, package: pkg });
-}
-
-export async function importSkill(
-  projectDir: string,
-  sourceDir: string,
-  options?: { overwrite?: boolean },
-): Promise<ExecResult> {
-  return invoke<ExecResult>("import_skill", {
-    projectDir,
-    sourceDir,
-    overwrite: options?.overwrite ?? false,
-  });
-}
diff --git a/src/styles.css b/src/styles.css
deleted file mode 100644
index 7da4e308d2..0000000000
--- a/src/styles.css
+++ /dev/null
@@ -1,26 +0,0 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
-
-:root {
-  color-scheme: dark;
-}
-
-html,
-body {
-  height: 100%;
-}
-
-body {
-  margin: 0;
-  font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
-    "Helvetica Neue", Arial, "Noto Sans", "Apple Color Emoji", "Segoe UI Emoji";
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-}
-
-@layer utilities {
-  .animate-spin-slow {
-    animation: spin 3s linear infinite;
-  }
-}
diff --git a/tailwind.config.ts b/tailwind.config.ts
deleted file mode 100644
index cc64f09fad..0000000000
--- a/tailwind.config.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { Config } from "tailwindcss";
-
-export default {
-  content: ["./index.html", "./src/**/*.{ts,tsx}"] ,
-  theme: {
-    extend: {
-      colors: {
-        glass: {
-          900: "rgba(10, 10, 10, 0.65)",
-          700: "rgba(17, 17, 17, 0.45)",
-        },
-      },
-    },
-  },
-  plugins: [],
-} satisfies Config;
diff --git a/translated_readmes/README.md b/translated_readmes/README.md
new file mode 100644
index 0000000000..11a38c2750
--- /dev/null
+++ b/translated_readmes/README.md
@@ -0,0 +1,3 @@
+# OpenWork README Languages
+
+Available: [English](../README.md), [简体中文](./README_ZH.md), [繁體中文](./README_ZH_hk.md), [日本語](./README_JA.md)
diff --git a/translated_readmes/README_JA.md b/translated_readmes/README_JA.md
new file mode 100644
index 0000000000..8e196a64fd
--- /dev/null
+++ b/translated_readmes/README_JA.md
@@ -0,0 +1,233 @@
+[![Discord](https://img.shields.io/badge/discord-加入-5865F2?logo=discord&logoColor=white)](https://discord.gg/VEhNQXxYMB)
+
+[English](../README.md) | 日本語 | [他の翻訳README](./README.md)
+
+# OpenWork
+> OpenWorkは、Claude Cowork/Codex（デスクトップアプリ）のオープンソース代替です。
+
+## 基本理念
+
+- ローカルファースト、クラウド対応: OpenWorkはワンクリックであなたのマシン上で動作します。メッセージを即座に送信できます。
+- コンポーザブル: デスクトップアプリ、WhatsApp/Slack/Telegramコネクタ、またはサーバー。用途に合ったものを使えます。ロックインなし。
+- エジェクタブル: OpenWorkはOpenCodeで動いているため、OpenCodeでできることはすべてOpenWorkでも動作します（UIがなくても）。
+- シェアリング・イズ・ケアリング: localhostでソロ作業を始め、必要に応じてリモート共有を明示的にオプトインできます。
+
+<p align="center">
+  <img src="../app-demo.gif" alt="OpenWork デモ" width="800" />
+</p>
+
+OpenWorkは、エージェントワークフローを再現可能なプロダクト化されたプロセスとして簡単にリリースできるように設計されています。
+
+## 代替UI
+- **OpenWork Orchestrator（CLIホスト）**: デスクトップUIなしでOpenCode + OpenWorkサーバーを実行します。
+  - インストール: `npm install -g openwork-orchestrator`
+  - 実行: `openwork start --workspace /path/to/workspace --approval auto`
+  - ドキュメント: [apps/orchestrator/README.md](../apps/orchestrator/README.md)
+
+## クイックスタート
+
+デスクトップアプリを[openworklabs.com/download](https://openworklabs.com/download)からダウンロードするか、最新の[GitHubリリース](https://github.com/different-ai/openwork/releases)を取得するか、以下の手順でソースからインストールしてください。
+
+- macOSおよびLinux向けのダウンロードが直接利用可能です。
+- Windowsへのアクセスは現在、[openworklabs.com/pricing#windows-support](https://openworklabs.com/pricing#windows-support)の有料サポートプランで提供されています。
+- ホステッドOpenWork Cloudワーカーは、チェックアウト後にWebアプリから起動し、デスクトップアプリから`Add a worker` -> `Connect remote`で接続します。
+
+## なぜOpenWorkか
+
+現在のOpenCode向けCLIやGUIは開発者を中心に設計されています。つまり、ファイルの差分、ツール名、そしてCLIを公開しなければ拡張が難しい機能に焦点が当てられています。
+
+OpenWorkは以下を目指して設計されています:
+
+- **拡張可能**: スキルとOpenCodeプラグインはインストール可能なモジュールです。
+- **監査可能**: 何が、いつ、なぜ起きたかを表示します。
+- **権限管理**: 特権フローへのアクセスを制御します。
+- **ローカル/リモート**: OpenWorkはローカルでもリモートサーバーへの接続でも動作します。
+
+## 含まれる機能
+
+- **ホストモード**: ローカルコンピュータ上でOpenCodeを実行します。
+- **クライアントモード**: URLで既存のOpenCodeサーバーに接続します。
+- **セッション**: セッションの作成/選択とプロンプトの送信。
+- **ライブストリーミング**: SSE `/event` サブスクリプションによるリアルタイム更新。
+- **実行計画**: OpenCodeのTodoをタイムラインとして表示。
+- **権限**: 権限リクエストを表示し、応答（一度許可 / 常に許可 / 拒否）。
+- **テンプレート**: 一般的なワークフローを保存して再実行（ローカル保存）。
+- **デバッグエクスポート**: バグ報告時に、設定 -> デバッグからランタイムデバッグレポートと開発者ログストリームをコピーまたはエクスポート。
+- **スキルマネージャー**:
+  - インストール済みの `.opencode/skills` フォルダを一覧表示
+  - ローカルのスキルフォルダを `.opencode/skills/<skill-name>` にインポート
+
+## スキルマネージャー
+
+<img width="1292" height="932" alt="image" src="https://github.com/user-attachments/assets/b500c1c6-a218-42ce-8a11-52787f5642b6" />
+
+## ローカルコンピュータまたはサーバーで動作
+
+<img width="1292" height="932" alt="Screenshot 2026-01-13 at 7 05 16 PM" src="https://github.com/user-attachments/assets/9c864390-de69-48f2-82c1-93b328dd60c3" />
+
+## クイックスタート
+
+### 必要要件
+
+- Node.js + `pnpm`
+- Rustツールチェーン（Tauri用）: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` でインストール
+- Tauri CLI: `cargo install tauri-cli`
+- OpenCode CLIがPATH上にインストールされていること: `opencode`
+
+### ローカル開発の前提条件（デスクトップ）
+
+`pnpm dev` を実行する前に、以下がシェルにインストールされ有効になっていることを確認してください:
+
+- Node + pnpm（リポジトリは `pnpm@10.27.0` を使用）
+- **Bun 1.3.9+**（`bun --version`）
+- Rustツールチェーン（Tauri用）、現在の `rustup` stableからのCargo（`Cargo.lock` v4対応）
+- Xcode Command Line Tools（macOS）
+- Linux環境では、`pkg-config` が `webkit2gtk-4.1` と `javascriptcoregtk-4.1` を解決できるようにWebKitGTK 4.1開発パッケージが必要
+
+### 1分間の動作確認
+
+リポジトリルートから実行:
+
+```bash
+git checkout dev
+git pull --ff-only origin dev
+pnpm install --frozen-lockfile
+
+which bun
+bun --version
+pnpm --filter @openwork/desktop exec tauri --version
+```
+
+### インストール
+
+```bash
+pnpm install
+```
+
+OpenWorkは現在 `apps/app`（UI）と `apps/desktop`（デスクトップシェル）に配置されています。
+
+### 実行（デスクトップ）
+
+```bash
+pnpm dev
+```
+
+`pnpm dev` は自動的に `OPENWORK_DEV_MODE=1` を有効にするため、デスクトップ開発では個人のグローバル設定/認証/データの代わりに分離されたOpenCode状態を使用します。
+
+### 実行（Web UIのみ）
+
+```bash
+pnpm dev:ui
+```
+
+リポジトリのすべての `dev` エントリポイントは同じ開発モード分離にオプトインするため、ローカルテストでは一貫してOpenWork管理のOpenCode状態を使用します。
+
+### Archユーザー向け:
+
+```bash
+sudo pacman -S --needed webkit2gtk-4.1
+curl -fsSL https://opencode.ai/install | bash -s -- --version "$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")" --no-modify-path
+```
+
+## アーキテクチャ（概要）
+
+- **ホストモード**では、OpenWorkはローカルホストスタックを実行し、UIをそれに接続します。
+  - デフォルトランタイム: `openwork`（`openwork-orchestrator` からインストール）。`opencode`、`openwork-server`、およびオプションで `opencode-router` をオーケストレーションします。
+  - フォールバックランタイム: `direct`。デスクトップアプリが直接 `opencode serve --hostname 127.0.0.1 --port <free-port>` を起動します。
+
+プロジェクトフォルダを選択すると、OpenWorkはそのフォルダを使用してローカルでホストスタックを実行し、デスクトップUIを接続します。
+これにより、リモートサーバーなしで完全にマシン上でエージェントワークフローの実行、プロンプトの送信、進捗の確認が可能です。
+
+- UIは `@opencode-ai/sdk/v2/client` を使用して:
+  - サーバーに接続
+  - セッションの一覧表示/作成
+  - プロンプトの送信
+  - SSEイベントのサブスクライブ（サーバーからUIへのリアルタイム更新のストリーミングにServer-Sent Eventsを使用）
+  - Todoと権限リクエストの読み取り
+
+## フォルダピッカー
+
+フォルダピッカーはTauriダイアログプラグインを使用します。
+ケイパビリティの権限は以下で定義されています:
+
+- `apps/desktop/src-tauri/capabilities/default.json`
+
+## OpenCodeプラグイン
+
+プラグインはOpenCodeを拡張する**ネイティブ**な方法です。OpenWorkはスキルタブから `opencode.json` を読み書きして管理します。
+
+- **プロジェクトスコープ**: `<workspace>/opencode.json`
+- **グローバルスコープ**: `~/.config/opencode/opencode.json`（または `$XDG_CONFIG_HOME/opencode/opencode.json`）
+
+`opencode.json` を手動で編集することもできます。OpenWorkはOpenCode CLIと同じ形式を使用します:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-wakatime"]
+}
+```
+
+## 便利なコマンド
+
+```bash
+pnpm dev
+pnpm dev:ui
+pnpm typecheck
+pnpm build
+pnpm build:ui
+pnpm test:e2e
+```
+
+## トラブルシューティング
+
+デスクトップやセッションのバグを報告する必要がある場合は、Issueを作成する前に設定 -> デバッグからランタイムデバッグレポートと開発者ログの両方をエクスポートしてください。
+
+### Linux / Wayland（Hyprland）
+
+OpenWorkがWebKitGTKエラー（`Failed to create GBM buffer` など）で起動時にクラッシュする場合は、起動前にdmabufまたはコンポジティングを無効にしてください。以下のいずれかの環境変数フラグを試してください。
+
+```bash
+WEBKIT_DISABLE_DMABUF_RENDERER=1 openwork
+```
+
+```bash
+WEBKIT_DISABLE_COMPOSITING_MODE=1 openwork
+```
+
+## セキュリティに関する注意
+
+- OpenWorkはデフォルトでモデルの推論と機密ツールメタデータを非表示にします。
+- ホストモードはデフォルトで `127.0.0.1` にバインドします。
+
+## コントリビューション
+
+- 変更を行う前に、`AGENTS.md`、`VISION.md`、`PRINCIPLES.md`、`PRODUCT.md`、`ARCHITECTURE.md` を確認してプロダクトの目標を理解してください。
+- リポジトリ内で作業する前に、Node.js、`pnpm`、Rustツールチェーン、および `opencode` がインストールされていることを確認してください。
+- チェックアウトごとに `pnpm install` を実行し、PRを作成する前に `pnpm typecheck` と `pnpm test:e2e`（または対象のスクリプトサブセット）で変更を検証してください。
+- PRを作成する際は `.github/pull_request_template.md` を使用し、実行したコマンド、結果、手動検証手順、およびエビデンスを含めてください。
+- CIが失敗した場合は、PRの本文でコード関連のリグレッションか外部/環境/認証のブロッカーかを分類してください。
+- 新しいPRDは `AGENTS.md` に記載されている `.opencode/skills/prd-conventions/SKILL.md` の規約に従い、`apps/app/pr/<name>.md` に追加してください。
+
+コミュニティドキュメント:
+
+- `CODE_OF_CONDUCT.md`
+- `SECURITY.md`
+- `SUPPORT.md`
+- `TRIAGE.md`
+
+初回コントリビューションチェックリスト:
+
+- [ ] `pnpm install` とベースライン検証コマンドを実行する。
+- [ ] 変更に明確なIssueリンクとスコープがあることを確認する。
+- [ ] 動作変更に対してテストを追加/更新する。
+- [ ] PRに実行したコマンドと結果を含める。
+- [ ] ユーザー向けフロー変更のスクリーンショット/動画を追加する。
+
+## チーム・企業向け
+
+組織でのOpenWork利用に興味がありますか？ぜひお聞かせください — [ben@openworklabs.com](mailto:ben@openworklabs.com) までユースケースについてご連絡ください。
+
+## ライセンス
+
+MIT — `LICENSE` をご確認ください。
diff --git a/translated_readmes/README_ZH.md b/translated_readmes/README_ZH.md
new file mode 100644
index 0000000000..403aa7bd87
--- /dev/null
+++ b/translated_readmes/README_ZH.md
@@ -0,0 +1,199 @@
+[![Discord](https://img.shields.io/badge/discord-加入-5865F2?logo=discord&logoColor=white)](https://discord.gg/VEhNQXxYMB)
+
+[English](../README.md) | 简体中文 | [其他语言](./README.md)
+
+# OpenWork
+> 让您的公司提升 1000 倍的生产力。
+
+我们为 AI 智能体配备您团队已经在使用的工具，并让它们从您的行为中学习。您使用 OpenWork 越多，工具之间的连接就越紧密，积累的知识就越多，能够自动化的工作块就越大。
+
+OpenWork 是 opencode 的最简单界面。双击，选择一个文件夹，即可立即获得三大核心优势：
+1. 零摩擦设置 — 您现有的 opencode 配置开箱即用，无需迁移
+2. 聊天集成 — WhatsApp 和 Telegram 即时可用（一个令牌，全部搞定）
+3. 云端就绪 — 每个应用都可以作为客户端；部署到云端，随时随地访问
+> **创建安全智能体工作流程并与团队共享的最简单方式**
+
+它是 "Claude Work" 的**可扩展开源替代品**。
+
+
+<img width="1292" height="932" alt="Screenshot 2026-01-31 at 16 22 39" src="https://github.com/user-attachments/assets/5742be91-9cfb-4212-b32d-cf2a27b1c093" />
+
+
+<img width="1292" height="932" alt="Screenshot 2026-01-31 at 13 43 30" src="https://github.com/user-attachments/assets/6639d1ef-c831-406e-a812-87fde403e6d5" />
+
+
+OpenWork 围绕一个核心理念设计：让您可以轻松地将智能体工作流程作为可重复的、产品化的流程进行交付。
+
+它是一个原生桌面应用程序，底层运行 **OpenCode**，但将其呈现为简洁的引导式工作流程：
+- 选择工作区
+- 开始运行
+- 观察进度 + 计划更新
+- 需要时批准权限
+- 重用有效的方法（命令 + 技能）
+
+目标：让"智能体工作"感觉像一个产品，而不是终端。
+
+## 其他界面
+
+- **Owpenbot (WhatsApp 机器人)**：为运行中的 OpenCode 服务器提供的轻量级 WhatsApp 桥接器。安装方法：
+  - `curl -fsSL https://raw.githubusercontent.com/different-ai/owpenbot/dev/install.sh | bash`
+  - 运行 `owpenbot setup`，然后 `owpenbot whatsapp login`，接着 `owpenbot start`
+  - 完整设置：https://github.com/different-ai/owpenbot/blob/dev/README.md
+- **Openwrk (CLI 主机)**：无需桌面 UI 即可运行 OpenCode + OpenWork 服务器。使用 `npm install -g openwrk` 安装。
+  - 文档：[apps/orchestrator/README.md](../apps/orchestrator/README.md)
+
+
+## 快速开始
+在此处下载 dmg：https://github.com/different-ai/openwork/releases（或按照下面的说明从源代码安装）
+
+## 为什么选择 OpenWork
+
+当前 opencode 的 CLI 和 GUI 都以开发者为中心。这意味着专注于文件差异、工具名称，以及在不依赖某种形式的 CLI 的情况下难以扩展的功能。
+
+OpenWork 的设计目标是：
+- **可扩展**：技能和 opencode 插件是可安装的模块。
+- **可审计**：显示发生了什么、何时发生以及为什么发生。
+- **权限控制**：访问特权流程。
+- **本地/远程**：OpenWork 可以在本地工作，也可以连接到远程服务器。
+
+## 包含的功能
+
+- **主机模式**：在您的计算机上本地运行 opencode
+- **客户端模式**：通过 URL 连接到现有的 OpenCode 服务器
+- **会话**：创建/选择会话并发送提示
+- **实时流传输**：SSE `/event` 订阅以获取实时更新
+- **执行计划**：将 OpenCode 待办事项呈现为时间线
+- **权限**：显示权限请求并回复（允许一次/始终允许/拒绝）
+- **模板**：保存并重新运行常见工作流程（本地存储）
+- **技能管理器**：
+  - 列出已安装的 `.opencode/skills` 文件夹
+  - 将本地技能文件夹导入到 `.opencode/skills/<skill-name>`
+ 
+
+## 技能管理器    
+<img width="1292" height="932" alt="image" src="https://github.com/user-attachments/assets/b500c1c6-a218-42ce-8a11-52787f5642b6" />
+
+
+## 适用于本地计算机或服务器
+<img width="1292" height="932" alt="Screenshot 2026-01-13 at 7 05 16 PM" src="https://github.com/user-attachments/assets/9c864390-de69-48f2-82c1-93b328dd60c3" />
+
+
+## 快速开始
+
+### 系统要求
+
+- Node.js + `pnpm`
+- Rust 工具链（用于 Tauri）：通过 `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` 安装
+- Tauri CLI：`cargo install tauri-cli`
+- 已安装 OpenCode CLI 且可在 PATH 中使用：`opencode`
+
+### 安装
+
+```bash
+pnpm install
+```
+
+OpenWork 现在位于 `packages/app`（UI）和 `packages/desktop`（桌面外壳）中。
+
+### 运行（桌面版）
+
+```bash
+pnpm dev
+```
+
+### 运行（仅 Web UI）
+
+```bash
+pnpm dev:ui
+```
+
+### Arch 用户：
+
+```bash
+curl -fsSL https://opencode.ai/install | bash -s -- --version "$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")" --no-modify-path
+```
+
+## 架构（高级）
+
+- 在**主机模式**中，OpenWork 启动：
+  - `opencode serve --hostname 127.0.0.1 --port <free-port>`
+  - 以您选择的项目文件夹作为进程工作目录。
+在主机模式下，OpenWork 直接在您的计算机上后台启动 OpenCode 服务器。
+当您选择项目文件夹时，OpenWork 使用该文件夹在本地运行 OpenCode 并将桌面 UI 连接到它。
+这允许您完全在您的机器上运行智能体工作流程、发送提示并查看进度，而无需依赖远程服务器。
+
+- UI 使用 `@opencode-ai/sdk/v2/client` 来：
+  - 连接到服务器
+  - 列出/创建会话
+  - 发送提示
+  - 订阅 SSE 事件（即“服务器发送事件”，用于从服务器向 UI 流式传输实时更新）
+  - 读取待办事项和权限请求
+
+
+
+## 文件夹选择器
+
+文件夹选择器使用 Tauri 对话框插件。
+功能权限在以下文件中定义：
+- `packages/desktop/src-tauri/capabilities/default.json`
+
+## OpenCode 插件
+
+插件是扩展 OpenCode 的**原生**方式。OpenWork 现在通过从技能选项卡读取和写入 `opencode.json` 来管理它们。
+
+- **项目范围**：`<workspace>/opencode.json`
+- **全局范围**：`~/.config/opencode/opencode.json`（或 `$XDG_CONFIG_HOME/opencode/opencode.json`）
+
+您仍然可以手动编辑 `opencode.json`；OpenWork 使用与 OpenCode CLI 相同的格式：
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-wakatime"]
+}
+```
+
+## 有用的命令
+
+```bash
+pnpm dev
+pnpm dev:ui
+pnpm typecheck
+pnpm build
+pnpm build:ui
+pnpm test:e2e
+```
+
+## 故障排除
+
+### Linux / Wayland (Hyprland)
+
+如果 OpenWork 在启动时因 WebKitGTK 错误（如 `Failed to create GBM buffer`）而崩溃，请在启动前禁用 dmabuf 或合成。尝试以下环境标志之一。
+
+```bash
+WEBKIT_DISABLE_DMABUF_RENDERER=1 openwork
+```
+
+```bash
+WEBKIT_DISABLE_COMPOSITING_MODE=1 openwork
+```
+
+## 安全说明
+
+- OpenWork 默认隐藏模型推理和敏感工具元数据。
+- 主机模式默认绑定到 `127.0.0.1`。
+
+## 贡献
+
+- 在进行更改之前，请查看 `AGENTS.md` 以及 `VISION.md`、`PRINCIPLES.md`、`PRODUCT.md` 和 `ARCHITECTURE.md` 以了解产品目标。
+- 在仓库内工作之前，确保已安装 Node.js、`pnpm`、Rust 工具链和 `opencode`。
+- 每次检出后运行一次 `pnpm install`，然后在打开 PR 之前使用 `pnpm typecheck` 加上 `pnpm test:e2e`（或目标脚本子集）验证您的更改。
+- 按照 `AGENTS.md` 中描述的 `.opencode/skills/prd-conventions/SKILL.md` 约定，将新的 PRD 添加到 `packages/app/pr/<name>.md`。
+
+## 面向团队和企业
+
+有兴趣在您的组织中使用 OpenWork？我们很乐意听取您的意见 — 请发送邮件至 [benjamin.shafii@gmail.com](mailto:benjamin.shafii@gmail.com) 与我们讨论您的用例。
+
+## 许可证
+
+MIT — 请参见 `LICENSE`。
diff --git a/translated_readmes/README_ZH_hk.md b/translated_readmes/README_ZH_hk.md
new file mode 100644
index 0000000000..9105c379a1
--- /dev/null
+++ b/translated_readmes/README_ZH_hk.md
@@ -0,0 +1,199 @@
+[![Discord](https://img.shields.io/badge/discord-加入-5865F2?logo=discord&logoColor=white)](https://discord.gg/VEhNQXxYMB)
+
+[English](../README.md) | 繁體中文 | [其他語言](./README.md)
+
+# OpenWork
+> 讓您的公司提升 1000 倍的生產力。
+
+我們為 AI 智能體配備您團隊已經在使用的工具，並讓它們從您的行為中學習。您使用 OpenWork 越多，工具之間的連接就越緊密，積累的知識就越多，能夠自動化的工作塊就越大。
+
+OpenWork 是 opencode 的最簡單介面。雙擊，選擇一個資料夾，即可立即獲得三大核心優勢：
+1. 零摩擦設置 — 您現有的 opencode 配置開箱即用，無需遷移
+2. 聊天集成 — WhatsApp 和 Telegram 即時可用（一個令牌，全部搞定）
+3. 雲端就緒 — 每個應用都可以作為客戶端；部署到雲端，隨時隨地訪問
+> **創建安全智能體工作流程並與團隊共享的最簡單方式**
+
+它是 "Claude Work" 的**可擴展開源替代品**。
+
+
+<img width="1292" height="932" alt="Screenshot 2026-01-31 at 16 22 39" src="https://github.com/user-attachments/assets/5742be91-9cfb-4212-b32d-cf2a27b1c093" />
+
+
+<img width="1292" height="932" alt="Screenshot 2026-01-31 at 13 43 30" src="https://github.com/user-attachments/assets/6639d1ef-c831-406e-a812-87fde403e6d5" />
+
+
+OpenWork 圍繞一個核心理念設計：讓您可以輕鬆地將智能體工作流程作為可重複的、產品化的流程進行交付。
+
+它是一個原生桌面應用程式，底層運行 **OpenCode**，但將其呈現為簡潔的引導式工作流程：
+- 選擇工作區
+- 開始運行
+- 觀察進度 + 計劃更新
+- 需要時批准權限
+- 重用有效的方法（命令 + 技能）
+
+目標：讓"智能體工作"感覺像一個產品，而不是終端。
+
+## 其他介面
+
+- **Owpenbot (WhatsApp 機器人)**：為運行中的 OpenCode 伺服器提供的輕量級 WhatsApp 橋接器。安裝方法：
+  - `curl -fsSL https://raw.githubusercontent.com/different-ai/owpenbot/dev/install.sh | bash`
+  - 運行 `owpenbot setup`，然後 `owpenbot whatsapp login`，接著 `owpenbot start`
+  - 完整設置：https://github.com/different-ai/owpenbot/blob/dev/README.md
+- **Openwrk (CLI 主機)**：無需桌面 UI 即可運行 OpenCode + OpenWork 伺服器。使用 `npm install -g openwrk` 安裝。
+  - 文檔：[apps/orchestrator/README.md](../apps/orchestrator/README.md)
+
+
+## 快速開始
+在此處下載 dmg：https://github.com/different-ai/openwork/releases（或按照下面的說明從源代碼安裝）
+
+## 為什麼選擇 OpenWork
+
+當前 opencode 的 CLI 和 GUI 都以開發者為中心。這意味著專注於檔案差異、工具名稱，以及在不依賴某種形式的 CLI 的情況下難以擴展的功能。
+
+OpenWork 的設計目標是：
+- **可擴展**：技能和 opencode 插件是可安裝的模組。
+- **可審計**：顯示發生了什麼、何時發生以及為什麼發生。
+- **權限控制**：訪問特權流程。
+- **本地/遠端**：OpenWork 可以在本地工作，也可以連接到遠端伺服器。
+
+## 包含的功能
+
+- **主機模式**：在您的電腦上本地運行 opencode
+- **客戶端模式**：通過 URL 連接到現有的 OpenCode 伺服器
+- **會話**：創建/選擇會話並發送提示
+- **實時流傳輸**：SSE `/event` 訂閱以獲取實時更新
+- **執行計劃**：將 OpenCode 待辦事項呈現為時間線
+- **權限**：顯示權限請求並回覆（允許一次/始終允許/拒絕）
+- **模板**：保存並重新運行常見工作流程（本地存儲）
+- **技能管理器**：
+  - 列出已安裝的 `.opencode/skills` 資料夾
+  - 將本地技能資料夾導入到 `.opencode/skills/<skill-name>`
+ 
+
+## 技能管理器    
+<img width="1292" height="932" alt="image" src="https://github.com/user-attachments/assets/b500c1c6-a218-42ce-8a11-52787f5642b6" />
+
+
+## 適用於本地電腦或伺服器
+<img width="1292" height="932" alt="Screenshot 2026-01-13 at 7 05 16 PM" src="https://github.com/user-attachments/assets/9c864390-de69-48f2-82c1-93b328dd60c3" />
+
+
+## 快速開始
+
+### 系統要求
+
+- Node.js + `pnpm`
+- Rust 工具鏈（用於 Tauri）：通過 `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` 安裝
+- Tauri CLI：`cargo install tauri-cli`
+- 已安裝 OpenCode CLI 且可在 PATH 中使用：`opencode`
+
+### 安裝
+
+```bash
+pnpm install
+```
+
+OpenWork 現在位於 `packages/app`（UI）和 `packages/desktop`（桌面外殼）中。
+
+### 運行（桌面版）
+
+```bash
+pnpm dev
+```
+
+### 運行（僅 Web UI）
+
+```bash
+pnpm dev:ui
+```
+
+### Arch 用戶：
+
+```bash
+curl -fsSL https://opencode.ai/install | bash -s -- --version "$(node -e "const fs=require('fs'); const parsed=JSON.parse(fs.readFileSync('constants.json','utf8')); process.stdout.write(String(parsed.opencodeVersion||'').trim().replace(/^v/,''));")" --no-modify-path
+```
+
+## 架構（高級）
+
+- 在**主機模式**中，OpenWork 啟動：
+  - `opencode serve --hostname 127.0.0.1 --port <free-port>`
+  - 以您選擇的專案資料夾作為進程工作目錄。
+在主機模式下，OpenWork 直接在您的電腦後台啟動 OpenCode 伺服器。
+當您選擇專案資料夾時，OpenWork 使用該資料夾在本地運行 OpenCode 並將桌面 UI 連接到它。
+這允許您完全在您的機器上運行智能體工作流程、發送提示並查看進度，而無需依賴遠端伺服器。
+
+- UI 使用 `@opencode-ai/sdk/v2/client` 來：
+  - 連接到伺服器
+  - 列出/創建會話
+  - 發送提示
+  - 訂閱 SSE 事件（即「伺服器發送事件」，用於從伺服器向 UI 流式傳輸實時更新）
+  - 讀取待辦事項和權限請求
+
+
+
+## 資料夾選擇器
+
+資料夾選擇器使用 Tauri 對話框插件。
+功能權限在以下檔案中定義：
+- `packages/desktop/src-tauri/capabilities/default.json`
+
+## OpenCode 插件
+
+插件是擴展 OpenCode 的**原生**方式。OpenWork 現在通過從技能選項卡讀取和寫入 `opencode.json` 來管理它們。
+
+- **專案範圍**：`<workspace>/opencode.json`
+- **全局範圍**：`~/.config/opencode/opencode.json`（或 `$XDG_CONFIG_HOME/opencode/opencode.json`）
+
+您仍然可以手動編輯 `opencode.json`；OpenWork 使用與 OpenCode CLI 相同的格式：
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-wakatime"]
+}
+```
+
+## 有用的命令
+
+```bash
+pnpm dev
+pnpm dev:ui
+pnpm typecheck
+pnpm build
+pnpm build:ui
+pnpm test:e2e
+```
+
+## 故障排除
+
+### Linux / Wayland (Hyprland)
+
+如果 OpenWork 在啟動時因 WebKitGTK 錯誤（如 `Failed to create GBM buffer`）而崩潰，請在啟動前禁用 dmabuf 或合成。嘗試以下環境標誌之一。
+
+```bash
+WEBKIT_DISABLE_DMABUF_RENDERER=1 openwork
+```
+
+```bash
+WEBKIT_DISABLE_COMPOSITING_MODE=1 openwork
+```
+
+## 安全說明
+
+- OpenWork 默認隱藏模型推理和敏感工具元數據。
+- 主機模式默認綁定到 `127.0.0.1`。
+
+## 貢獻
+
+- 在進行更改之前，請查看 `AGENTS.md` 以及 `VISION.md`、`PRINCIPLES.md`、`PRODUCT.md` 和 `ARCHITECTURE.md` 以了解產品目標。
+- 在倉庫內工作之前，確保已安裝 Node.js、`pnpm`、Rust 工具鏈和 `opencode`。
+- 每次檢出後運行一次 `pnpm install`，然後在打開 PR 之前使用 `pnpm typecheck` 加上 `pnpm test:e2e`（或目標腳本子集）驗證您的更改。
+- 按照 `AGENTS.md` 中描述的 `.opencode/skills/prd-conventions/SKILL.md` 約定，將新的 PRD 添加到 `packages/app/pr/<name>.md`。
+
+## 面向團隊和企業
+
+有興趣在您的組織中使用 OpenWork？我們很樂意聽取您的意見 — 請發送郵件至 [benjamin.shafii@gmail.com](mailto:benjamin.shafii@gmail.com) 與我們討論您的用例。
+
+## 許可證
+
+MIT — 請參見 `LICENSE`。
diff --git a/turbo.json b/turbo.json
new file mode 100644
index 0000000000..8f8a47411d
--- /dev/null
+++ b/turbo.json
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://turbo.build/schema.json",
+  "globalEnv": [
+    "OPENWORK_DEV_MODE",
+    "DATABASE_URL",
+    "DEN_DB_ENCRYPTION_KEY",
+    "BETTER_AUTH_SECRET",
+    "BETTER_AUTH_URL",
+    "DEN_BETTER_AUTH_TRUSTED_ORIGINS",
+    "CORS_ORIGINS",
+    "DEN_API_PORT",
+    "DEN_CONTROLLER_PORT",
+    "DEN_WORKER_PROXY_PORT",
+    "DEN_WEB_PORT",
+    "DEN_API_BASE",
+    "DEN_AUTH_ORIGIN",
+    "DEN_AUTH_FALLBACK_BASE",
+    "PROVISIONER_MODE"
+  ],
+  "tasks": {
+    "dev": {
+      "cache": false,
+      "persistent": true
+    },
+    "dev:local": {
+      "cache": false,
+      "persistent": true
+    },
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["dist/**", ".next/**"]
+    }
+  }
+}
diff --git a/vite.config.ts b/vite.config.ts
deleted file mode 100644
index 7065a0d90a..0000000000
--- a/vite.config.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { defineConfig } from "vite";
-import solid from "vite-plugin-solid";
-
-export default defineConfig({
-  plugins: [solid()],
-  server: {
-    port: 5173,
-    strictPort: true,
-  },
-  build: {
-    target: "esnext",
-  },
-});